sys/netinet/sctp_input.c

   1 /*-
   2  * Copyright (c) 2001-2008, by Cisco Systems, Inc. All rights reserved.
   3  * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved.
   4  * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions are met:
   8  *
   9  * a) Redistributions of source code must retain the above copyright notice,
  10  *    this list of conditions and the following disclaimer.
  11  *
  12  * b) Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in
  14  *    the documentation and/or other materials provided with the distribution.
  15  *
  16  * c) Neither the name of Cisco Systems, Inc. nor the names of its
  17  *    contributors may be used to endorse or promote products derived
  18  *    from this software without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  21  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  22  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  24  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  30  * THE POSSIBILITY OF SUCH DAMAGE.
  31  */
  32
  33 #include <sys/cdefs.h>
  34 __FBSDID("$FreeBSD$");
  35
  36 #include <netinet/sctp_os.h>
  37 #include <netinet/sctp_var.h>
  38 #include <netinet/sctp_sysctl.h>
  39 #include <netinet/sctp_pcb.h>
  40 #include <netinet/sctp_header.h>
  41 #include <netinet/sctputil.h>
  42 #include <netinet/sctp_output.h>
  43 #include <netinet/sctp_input.h>
  44 #include <netinet/sctp_auth.h>
  45 #include <netinet/sctp_indata.h>
  46 #include <netinet/sctp_asconf.h>
  47 #include <netinet/sctp_bsd_addr.h>
  48 #include <netinet/sctp_timer.h>
  49 #include <netinet/sctp_crc32.h>
  50 #if defined(INET) || defined(INET6)
  51 #include <netinet/udp.h>
  52 #endif
  53 #include <sys/smp.h>
  54
  55
  56
  57 static void
  58 sctp_stop_all_cookie_timers(struct sctp_tcb *stcb)
  59 {
  60         struct sctp_nets *net;
  61
  62         /*
  63          * This now not only stops all cookie timers it also stops any INIT
  64          * timers as well. This will make sure that the timers are stopped
  65          * in all collision cases.
  66          */
  67         SCTP_TCB_LOCK_ASSERT(stcb);
  68         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
  69                 if (net->rxt_timer.type == SCTP_TIMER_TYPE_COOKIE) {
  70                         sctp_timer_stop(SCTP_TIMER_TYPE_COOKIE,
  71                             stcb->sctp_ep,
  72                             stcb,
  73                             net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_1);
  74                 } else if (net->rxt_timer.type == SCTP_TIMER_TYPE_INIT) {
  75                         sctp_timer_stop(SCTP_TIMER_TYPE_INIT,
  76                             stcb->sctp_ep,
  77                             stcb,
  78                             net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_2);
  79                 }
  80         }
  81 }
  82
  83 /* INIT handler */
  84 static void
  85 sctp_handle_init(struct mbuf *m, int iphlen, int offset,
  86     struct sockaddr *src, struct sockaddr *dst, struct sctphdr *sh,
  87     struct sctp_init_chunk *cp, struct sctp_inpcb *inp,
  88     struct sctp_tcb *stcb, struct sctp_nets *net, int *abort_no_unlock,
  89     uint8_t mflowtype, uint32_t mflowid,
  90     uint32_t vrf_id, uint16_t port)
  91 {
  92         struct sctp_init *init;
  93         struct mbuf *op_err;
  94
  95         SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_init: handling INIT tcb:%p\n",
  96             (void *)stcb);
  97         if (stcb == NULL) {
  98                 SCTP_INP_RLOCK(inp);
  99         }
 100         /* validate length */
 101         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_init_chunk)) {
 102                 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
 103                 sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err,
 104                     mflowtype, mflowid,
 105                     vrf_id, port);
 106                 if (stcb)
 107                         *abort_no_unlock = 1;
 108                 goto outnow;
 109         }
 110         /* validate parameters */
 111         init = &cp->init;
 112         if (init->initiate_tag == 0) {
 113                 /* protocol error... send abort */
 114                 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
 115                 sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err,
 116                     mflowtype, mflowid,
 117                     vrf_id, port);
 118                 if (stcb)
 119                         *abort_no_unlock = 1;
 120                 goto outnow;
 121         }
 122         if (ntohl(init->a_rwnd) < SCTP_MIN_RWND) {
 123                 /* invalid parameter... send abort */
 124                 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
 125                 sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err,
 126                     mflowtype, mflowid,
 127                     vrf_id, port);
 128                 if (stcb)
 129                         *abort_no_unlock = 1;
 130                 goto outnow;
 131         }
 132         if (init->num_inbound_streams == 0) {
 133                 /* protocol error... send abort */
 134                 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
 135                 sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err,
 136                     mflowtype, mflowid,
 137                     vrf_id, port);
 138                 if (stcb)
 139                         *abort_no_unlock = 1;
 140                 goto outnow;
 141         }
 142         if (init->num_outbound_streams == 0) {
 143                 /* protocol error... send abort */
 144                 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
 145                 sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err,
 146                     mflowtype, mflowid,
 147                     vrf_id, port);
 148                 if (stcb)
 149                         *abort_no_unlock = 1;
 150                 goto outnow;
 151         }
 152         if (sctp_validate_init_auth_params(m, offset + sizeof(*cp),
 153             offset + ntohs(cp->ch.chunk_length))) {
 154                 /* auth parameter(s) error... send abort */
 155                 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
 156                     "Problem with AUTH parameters");
 157                 sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err,
 158                     mflowtype, mflowid,
 159                     vrf_id, port);
 160                 if (stcb)
 161                         *abort_no_unlock = 1;
 162                 goto outnow;
 163         }
 164         /* We are only accepting if we have a socket with positive
 165          * so_qlimit. */
 166         if ((stcb == NULL) &&
 167             ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
 168             (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
 169             (inp->sctp_socket == NULL) ||
 170             (inp->sctp_socket->so_qlimit == 0))) {
 171                 /*
 172                  * FIX ME ?? What about TCP model and we have a
 173                  * match/restart case? Actually no fix is needed. the lookup
 174                  * will always find the existing assoc so stcb would not be
 175                  * NULL. It may be questionable to do this since we COULD
 176                  * just send back the INIT-ACK and hope that the app did
 177                  * accept()'s by the time the COOKIE was sent. But there is
 178                  * a price to pay for COOKIE generation and I don't want to
 179                  * pay it on the chance that the app will actually do some
 180                  * accepts(). The App just looses and should NOT be in this
 181                  * state :-)
 182                  */
 183                 if (SCTP_BASE_SYSCTL(sctp_blackhole) == 0) {
 184                         op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
 185                             "No listener");
 186                         sctp_send_abort(m, iphlen, src, dst, sh, 0, op_err,
 187                             mflowtype, mflowid, inp->fibnum,
 188                             vrf_id, port);
 189                 }
 190                 goto outnow;
 191         }
 192         if ((stcb != NULL) &&
 193             (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT)) {
 194                 SCTPDBG(SCTP_DEBUG_INPUT3, "sctp_handle_init: sending SHUTDOWN-ACK\n");
 195                 sctp_send_shutdown_ack(stcb, NULL);
 196                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC, SCTP_SO_NOT_LOCKED);
 197         } else {
 198                 SCTPDBG(SCTP_DEBUG_INPUT3, "sctp_handle_init: sending INIT-ACK\n");
 199                 sctp_send_initiate_ack(inp, stcb, net, m, iphlen, offset,
 200                     src, dst, sh, cp,
 201                     mflowtype, mflowid,
 202                     vrf_id, port,
 203                     ((stcb == NULL) ? SCTP_HOLDS_LOCK : SCTP_NOT_LOCKED));
 204         }
 205 outnow:
 206         if (stcb == NULL) {
 207                 SCTP_INP_RUNLOCK(inp);
 208         }
 209 }
 210
 211 /*
 212  * process peer "INIT/INIT-ACK" chunk returns value < 0 on error
 213  */
 214
 215 int
 216 sctp_is_there_unsent_data(struct sctp_tcb *stcb, int so_locked
 217 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
 218     SCTP_UNUSED
 219 #endif
 220 )
 221 {
 222         int unsent_data;
 223         unsigned int i;
 224         struct sctp_stream_queue_pending *sp;
 225         struct sctp_association *asoc;
 226
 227         /*
 228          * This function returns if any stream has true unsent data on it.
 229          * Note that as it looks through it will clean up any places that
 230          * have old data that has been sent but left at top of stream queue.
 231          */
 232         asoc = &stcb->asoc;
 233         unsent_data = 0;
 234         SCTP_TCB_SEND_LOCK(stcb);
 235         if (!stcb->asoc.ss_functions.sctp_ss_is_empty(stcb, asoc)) {
 236                 /* Check to see if some data queued */
 237                 for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
 238                         /* sa_ignore FREED_MEMORY */
 239                         sp = TAILQ_FIRST(&stcb->asoc.strmout[i].outqueue);
 240                         if (sp == NULL) {
 241                                 continue;
 242                         }
 243                         if ((sp->msg_is_complete) &&
 244                             (sp->length == 0) &&
 245                             (sp->sender_all_done)) {
 246                                 /*
 247                                  * We are doing differed cleanup. Last time
 248                                  * through when we took all the data the
 249                                  * sender_all_done was not set.
 250                                  */
 251                                 if (sp->put_last_out == 0) {
 252                                         SCTP_PRINTF("Gak, put out entire msg with NO end!-1\n");
 253                                         SCTP_PRINTF("sender_done:%d len:%d msg_comp:%d put_last_out:%d\n",
 254                                             sp->sender_all_done,
 255                                             sp->length,
 256                                             sp->msg_is_complete,
 257                                             sp->put_last_out);
 258                                 }
 259                                 atomic_subtract_int(&stcb->asoc.stream_queue_cnt, 1);
 260                                 TAILQ_REMOVE(&stcb->asoc.strmout[i].outqueue, sp, next);
 261                                 stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, &asoc->strmout[i], sp, 1);
 262                                 if (sp->net) {
 263                                         sctp_free_remote_addr(sp->net);
 264                                         sp->net = NULL;
 265                                 }
 266                                 if (sp->data) {
 267                                         sctp_m_freem(sp->data);
 268                                         sp->data = NULL;
 269                                 }
 270                                 sctp_free_a_strmoq(stcb, sp, so_locked);
 271                                 if (!TAILQ_EMPTY(&stcb->asoc.strmout[i].outqueue)) {
 272                                         unsent_data++;
 273                                 }
 274                         } else {
 275                                 unsent_data++;
 276                         }
 277                         if (unsent_data > 0) {
 278                                 break;
 279                         }
 280                 }
 281         }
 282         SCTP_TCB_SEND_UNLOCK(stcb);
 283         return (unsent_data);
 284 }
 285
 286 static int
 287 sctp_process_init(struct sctp_init_chunk *cp, struct sctp_tcb *stcb)
 288 {
 289         struct sctp_init *init;
 290         struct sctp_association *asoc;
 291         struct sctp_nets *lnet;
 292         unsigned int i;
 293
 294         init = &cp->init;
 295         asoc = &stcb->asoc;
 296         /* save off parameters */
 297         asoc->peer_vtag = ntohl(init->initiate_tag);
 298         asoc->peers_rwnd = ntohl(init->a_rwnd);
 299         /* init tsn's */
 300         asoc->highest_tsn_inside_map = asoc->asconf_seq_in = ntohl(init->initial_tsn) - 1;
 301
 302         if (!TAILQ_EMPTY(&asoc->nets)) {
 303                 /* update any ssthresh's that may have a default */
 304                 TAILQ_FOREACH(lnet, &asoc->nets, sctp_next) {
 305                         lnet->ssthresh = asoc->peers_rwnd;
 306                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & (SCTP_CWND_MONITOR_ENABLE | SCTP_CWND_LOGGING_ENABLE)) {
 307                                 sctp_log_cwnd(stcb, lnet, 0, SCTP_CWND_INITIALIZATION);
 308                         }
 309                 }
 310         }
 311         SCTP_TCB_SEND_LOCK(stcb);
 312         if (asoc->pre_open_streams > ntohs(init->num_inbound_streams)) {
 313                 unsigned int newcnt;
 314                 struct sctp_stream_out *outs;
 315                 struct sctp_stream_queue_pending *sp, *nsp;
 316                 struct sctp_tmit_chunk *chk, *nchk;
 317
 318                 /* abandon the upper streams */
 319                 newcnt = ntohs(init->num_inbound_streams);
 320                 TAILQ_FOREACH_SAFE(chk, &asoc->send_queue, sctp_next, nchk) {
 321                         if (chk->rec.data.stream_number >= newcnt) {
 322                                 TAILQ_REMOVE(&asoc->send_queue, chk, sctp_next);
 323                                 asoc->send_queue_cnt--;
 324                                 if (asoc->strmout[chk->rec.data.stream_number].chunks_on_queues > 0) {
 325                                         asoc->strmout[chk->rec.data.stream_number].chunks_on_queues--;
 326 #ifdef INVARIANTS
 327                                 } else {
 328                                         panic("No chunks on the queues for sid %u.", chk->rec.data.stream_number);
 329 #endif
 330                                 }
 331                                 if (chk->data != NULL) {
 332                                         sctp_free_bufspace(stcb, asoc, chk, 1);
 333                                         sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb,
 334                                             0, chk, SCTP_SO_NOT_LOCKED);
 335                                         if (chk->data) {
 336                                                 sctp_m_freem(chk->data);
 337                                                 chk->data = NULL;
 338                                         }
 339                                 }
 340                                 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
 341                                 /* sa_ignore FREED_MEMORY */
 342                         }
 343                 }
 344                 if (asoc->strmout) {
 345                         for (i = newcnt; i < asoc->pre_open_streams; i++) {
 346                                 outs = &asoc->strmout[i];
 347                                 TAILQ_FOREACH_SAFE(sp, &outs->outqueue, next, nsp) {
 348                                         atomic_subtract_int(&stcb->asoc.stream_queue_cnt, 1);
 349                                         TAILQ_REMOVE(&outs->outqueue, sp, next);
 350                                         stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, outs, sp, 1);
 351                                         sctp_ulp_notify(SCTP_NOTIFY_SPECIAL_SP_FAIL,
 352                                             stcb, 0, sp, SCTP_SO_NOT_LOCKED);
 353                                         if (sp->data) {
 354                                                 sctp_m_freem(sp->data);
 355                                                 sp->data = NULL;
 356                                         }
 357                                         if (sp->net) {
 358                                                 sctp_free_remote_addr(sp->net);
 359                                                 sp->net = NULL;
 360                                         }
 361                                         /* Free the chunk */
 362                                         sctp_free_a_strmoq(stcb, sp, SCTP_SO_NOT_LOCKED);
 363                                         /* sa_ignore FREED_MEMORY */
 364                                 }
 365                                 outs->state = SCTP_STREAM_CLOSED;
 366                         }
 367                 }
 368                 /* cut back the count */
 369                 asoc->pre_open_streams = newcnt;
 370         }
 371         SCTP_TCB_SEND_UNLOCK(stcb);
 372         asoc->streamoutcnt = asoc->pre_open_streams;
 373         if (asoc->strmout) {
 374                 for (i = 0; i < asoc->streamoutcnt; i++) {
 375                         asoc->strmout[i].state = SCTP_STREAM_OPEN;
 376                 }
 377         }
 378         /* EY - nr_sack: initialize highest tsn in nr_mapping_array */
 379         asoc->highest_tsn_inside_nr_map = asoc->highest_tsn_inside_map;
 380         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {
 381                 sctp_log_map(0, 5, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
 382         }
 383         /* This is the next one we expect */
 384         asoc->str_reset_seq_in = asoc->asconf_seq_in + 1;
 385
 386         asoc->mapping_array_base_tsn = ntohl(init->initial_tsn);
 387         asoc->tsn_last_delivered = asoc->cumulative_tsn = asoc->asconf_seq_in;
 388
 389         asoc->advanced_peer_ack_point = asoc->last_acked_seq;
 390         /* open the requested streams */
 391
 392         if (asoc->strmin != NULL) {
 393                 /* Free the old ones */
 394                 for (i = 0; i < asoc->streamincnt; i++) {
 395                         sctp_clean_up_stream(stcb, &asoc->strmin[i].inqueue);
 396                         sctp_clean_up_stream(stcb, &asoc->strmin[i].uno_inqueue);
 397                 }
 398                 SCTP_FREE(asoc->strmin, SCTP_M_STRMI);
 399         }
 400         if (asoc->max_inbound_streams > ntohs(init->num_outbound_streams)) {
 401                 asoc->streamincnt = ntohs(init->num_outbound_streams);
 402         } else {
 403                 asoc->streamincnt = asoc->max_inbound_streams;
 404         }
 405         SCTP_MALLOC(asoc->strmin, struct sctp_stream_in *, asoc->streamincnt *
 406             sizeof(struct sctp_stream_in), SCTP_M_STRMI);
 407         if (asoc->strmin == NULL) {
 408                 /* we didn't get memory for the streams! */
 409                 SCTPDBG(SCTP_DEBUG_INPUT2, "process_init: couldn't get memory for the streams!\n");
 410                 return (-1);
 411         }
 412         for (i = 0; i < asoc->streamincnt; i++) {
 413                 asoc->strmin[i].stream_no = i;
 414                 asoc->strmin[i].last_sequence_delivered = 0xffffffff;
 415                 TAILQ_INIT(&asoc->strmin[i].inqueue);
 416                 TAILQ_INIT(&asoc->strmin[i].uno_inqueue);
 417                 asoc->strmin[i].pd_api_started = 0;
 418                 asoc->strmin[i].delivery_started = 0;
 419         }
 420         /*
 421          * load_address_from_init will put the addresses into the
 422          * association when the COOKIE is processed or the INIT-ACK is
 423          * processed. Both types of COOKIE's existing and new call this
 424          * routine. It will remove addresses that are no longer in the
 425          * association (for the restarting case where addresses are
 426          * removed). Up front when the INIT arrives we will discard it if it
 427          * is a restart and new addresses have been added.
 428          */
 429         /* sa_ignore MEMLEAK */
 430         return (0);
 431 }
 432
 433 /*
 434  * INIT-ACK message processing/consumption returns value < 0 on error
 435  */
 436 static int
 437 sctp_process_init_ack(struct mbuf *m, int iphlen, int offset,
 438     struct sockaddr *src, struct sockaddr *dst, struct sctphdr *sh,
 439     struct sctp_init_ack_chunk *cp, struct sctp_tcb *stcb,
 440     struct sctp_nets *net, int *abort_no_unlock,
 441     uint8_t mflowtype, uint32_t mflowid,
 442     uint32_t vrf_id)
 443 {
 444         struct sctp_association *asoc;
 445         struct mbuf *op_err;
 446         int retval, abort_flag;
 447         uint32_t initack_limit;
 448         int nat_friendly = 0;
 449
 450         /* First verify that we have no illegal param's */
 451         abort_flag = 0;
 452
 453         op_err = sctp_arethere_unrecognized_parameters(m,
 454             (offset + sizeof(struct sctp_init_chunk)),
 455             &abort_flag, (struct sctp_chunkhdr *)cp, &nat_friendly);
 456         if (abort_flag) {
 457                 /* Send an abort and notify peer */
 458                 sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
 459                 *abort_no_unlock = 1;
 460                 return (-1);
 461         }
 462         asoc = &stcb->asoc;
 463         asoc->peer_supports_nat = (uint8_t) nat_friendly;
 464         /* process the peer's parameters in the INIT-ACK */
 465         retval = sctp_process_init((struct sctp_init_chunk *)cp, stcb);
 466         if (retval < 0) {
 467                 return (retval);
 468         }
 469         initack_limit = offset + ntohs(cp->ch.chunk_length);
 470         /* load all addresses */
 471         if ((retval = sctp_load_addresses_from_init(stcb, m,
 472             (offset + sizeof(struct sctp_init_chunk)), initack_limit,
 473             src, dst, NULL, stcb->asoc.port))) {
 474                 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
 475                     "Problem with address parameters");
 476                 SCTPDBG(SCTP_DEBUG_INPUT1,
 477                     "Load addresses from INIT causes an abort %d\n",
 478                     retval);
 479                 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
 480                     src, dst, sh, op_err,
 481                     mflowtype, mflowid,
 482                     vrf_id, net->port);
 483                 *abort_no_unlock = 1;
 484                 return (-1);
 485         }
 486         /* if the peer doesn't support asconf, flush the asconf queue */
 487         if (asoc->asconf_supported == 0) {
 488                 struct sctp_asconf_addr *param, *nparam;
 489
 490                 TAILQ_FOREACH_SAFE(param, &asoc->asconf_queue, next, nparam) {
 491                         TAILQ_REMOVE(&asoc->asconf_queue, param, next);
 492                         SCTP_FREE(param, SCTP_M_ASC_ADDR);
 493                 }
 494         }
 495         stcb->asoc.peer_hmac_id = sctp_negotiate_hmacid(stcb->asoc.peer_hmacs,
 496             stcb->asoc.local_hmacs);
 497         if (op_err) {
 498                 sctp_queue_op_err(stcb, op_err);
 499                 /* queuing will steal away the mbuf chain to the out queue */
 500                 op_err = NULL;
 501         }
 502         /* extract the cookie and queue it to "echo" it back... */
 503         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
 504                 sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
 505                     stcb->asoc.overall_error_count,
 506                     0,
 507                     SCTP_FROM_SCTP_INPUT,
 508                     __LINE__);
 509         }
 510         stcb->asoc.overall_error_count = 0;
 511         net->error_count = 0;
 512
 513         /*
 514          * Cancel the INIT timer, We do this first before queueing the
 515          * cookie. We always cancel at the primary to assue that we are
 516          * canceling the timer started by the INIT which always goes to the
 517          * primary.
 518          */
 519         sctp_timer_stop(SCTP_TIMER_TYPE_INIT, stcb->sctp_ep, stcb,
 520             asoc->primary_destination, SCTP_FROM_SCTP_INPUT + SCTP_LOC_3);
 521
 522         /* calculate the RTO */
 523         net->RTO = sctp_calculate_rto(stcb, asoc, net, &asoc->time_entered, sctp_align_safe_nocopy,
 524             SCTP_RTT_FROM_NON_DATA);
 525         retval = sctp_send_cookie_echo(m, offset, stcb, net);
 526         if (retval < 0) {
 527                 /*
 528                  * No cookie, we probably should send a op error. But in any
 529                  * case if there is no cookie in the INIT-ACK, we can
 530                  * abandon the peer, its broke.
 531                  */
 532                 if (retval == -3) {
 533                         uint16_t len;
 534
 535                         len = (uint16_t) (sizeof(struct sctp_error_missing_param) + sizeof(uint16_t));
 536                         /* We abort with an error of missing mandatory param */
 537                         op_err = sctp_get_mbuf_for_msg(len, 0, M_NOWAIT, 1, MT_DATA);
 538                         if (op_err != NULL) {
 539                                 struct sctp_error_missing_param *cause;
 540
 541                                 SCTP_BUF_LEN(op_err) = len;
 542                                 cause = mtod(op_err, struct sctp_error_missing_param *);
 543                                 /* Subtract the reserved param */
 544                                 cause->cause.code = htons(SCTP_CAUSE_MISSING_PARAM);
 545                                 cause->cause.length = htons(len);
 546                                 cause->num_missing_params = htonl(1);
 547                                 cause->type[0] = htons(SCTP_STATE_COOKIE);
 548                         }
 549                         sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
 550                             src, dst, sh, op_err,
 551                             mflowtype, mflowid,
 552                             vrf_id, net->port);
 553                         *abort_no_unlock = 1;
 554                 }
 555                 return (retval);
 556         }
 557         return (0);
 558 }
 559
 560 static void
 561 sctp_handle_heartbeat_ack(struct sctp_heartbeat_chunk *cp,
 562     struct sctp_tcb *stcb, struct sctp_nets *net)
 563 {
 564         union sctp_sockstore store;
 565         struct sctp_nets *r_net, *f_net;
 566         struct timeval tv;
 567         int req_prim = 0;
 568         uint16_t old_error_counter;
 569
 570         if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_heartbeat_chunk)) {
 571                 /* Invalid length */
 572                 return;
 573         }
 574         memset(&store, 0, sizeof(store));
 575         switch (cp->heartbeat.hb_info.addr_family) {
 576 #ifdef INET
 577         case AF_INET:
 578                 if (cp->heartbeat.hb_info.addr_len == sizeof(struct sockaddr_in)) {
 579                         store.sin.sin_family = cp->heartbeat.hb_info.addr_family;
 580                         store.sin.sin_len = cp->heartbeat.hb_info.addr_len;
 581                         store.sin.sin_port = stcb->rport;
 582                         memcpy(&store.sin.sin_addr, cp->heartbeat.hb_info.address,
 583                             sizeof(store.sin.sin_addr));
 584                 } else {
 585                         return;
 586                 }
 587                 break;
 588 #endif
 589 #ifdef INET6
 590         case AF_INET6:
 591                 if (cp->heartbeat.hb_info.addr_len == sizeof(struct sockaddr_in6)) {
 592                         store.sin6.sin6_family = cp->heartbeat.hb_info.addr_family;
 593                         store.sin6.sin6_len = cp->heartbeat.hb_info.addr_len;
 594                         store.sin6.sin6_port = stcb->rport;
 595                         memcpy(&store.sin6.sin6_addr, cp->heartbeat.hb_info.address, sizeof(struct in6_addr));
 596                 } else {
 597                         return;
 598                 }
 599                 break;
 600 #endif
 601         default:
 602                 return;
 603         }
 604         r_net = sctp_findnet(stcb, &store.sa);
 605         if (r_net == NULL) {
 606                 SCTPDBG(SCTP_DEBUG_INPUT1, "Huh? I can't find the address I sent it to, discard\n");
 607                 return;
 608         }
 609         if ((r_net && (r_net->dest_state & SCTP_ADDR_UNCONFIRMED)) &&
 610             (r_net->heartbeat_random1 == cp->heartbeat.hb_info.random_value1) &&
 611             (r_net->heartbeat_random2 == cp->heartbeat.hb_info.random_value2)) {
 612                 /*
 613                  * If the its a HB and it's random value is correct when can
 614                  * confirm the destination.
 615                  */
 616                 r_net->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
 617                 if (r_net->dest_state & SCTP_ADDR_REQ_PRIMARY) {
 618                         stcb->asoc.primary_destination = r_net;
 619                         r_net->dest_state &= ~SCTP_ADDR_REQ_PRIMARY;
 620                         f_net = TAILQ_FIRST(&stcb->asoc.nets);
 621                         if (f_net != r_net) {
 622                                 /*
 623                                  * first one on the list is NOT the primary
 624                                  * sctp_cmpaddr() is much more efficient if
 625                                  * the primary is the first on the list,
 626                                  * make it so.
 627                                  */
 628                                 TAILQ_REMOVE(&stcb->asoc.nets, r_net, sctp_next);
 629                                 TAILQ_INSERT_HEAD(&stcb->asoc.nets, r_net, sctp_next);
 630                         }
 631                         req_prim = 1;
 632                 }
 633                 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
 634                     stcb, 0, (void *)r_net, SCTP_SO_NOT_LOCKED);
 635                 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb,
 636                     r_net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_4);
 637                 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb, r_net);
 638         }
 639         old_error_counter = r_net->error_count;
 640         r_net->error_count = 0;
 641         r_net->hb_responded = 1;
 642         tv.tv_sec = cp->heartbeat.hb_info.time_value_1;
 643         tv.tv_usec = cp->heartbeat.hb_info.time_value_2;
 644         /* Now lets do a RTO with this */
 645         r_net->RTO = sctp_calculate_rto(stcb, &stcb->asoc, r_net, &tv, sctp_align_safe_nocopy,
 646             SCTP_RTT_FROM_NON_DATA);
 647         if (!(r_net->dest_state & SCTP_ADDR_REACHABLE)) {
 648                 r_net->dest_state |= SCTP_ADDR_REACHABLE;
 649                 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_UP, stcb,
 650                     0, (void *)r_net, SCTP_SO_NOT_LOCKED);
 651         }
 652         if (r_net->dest_state & SCTP_ADDR_PF) {
 653                 r_net->dest_state &= ~SCTP_ADDR_PF;
 654                 stcb->asoc.cc_functions.sctp_cwnd_update_exit_pf(stcb, net);
 655         }
 656         if (old_error_counter > 0) {
 657                 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
 658                     stcb, r_net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_5);
 659                 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb, r_net);
 660         }
 661         if (r_net == stcb->asoc.primary_destination) {
 662                 if (stcb->asoc.alternate) {
 663                         /* release the alternate, primary is good */
 664                         sctp_free_remote_addr(stcb->asoc.alternate);
 665                         stcb->asoc.alternate = NULL;
 666                 }
 667         }
 668         /* Mobility adaptation */
 669         if (req_prim) {
 670                 if ((sctp_is_mobility_feature_on(stcb->sctp_ep,
 671                     SCTP_MOBILITY_BASE) ||
 672                     sctp_is_mobility_feature_on(stcb->sctp_ep,
 673                     SCTP_MOBILITY_FASTHANDOFF)) &&
 674                     sctp_is_mobility_feature_on(stcb->sctp_ep,
 675                     SCTP_MOBILITY_PRIM_DELETED)) {
 676
 677                         sctp_timer_stop(SCTP_TIMER_TYPE_PRIM_DELETED,
 678                             stcb->sctp_ep, stcb, NULL,
 679                             SCTP_FROM_SCTP_INPUT + SCTP_LOC_6);
 680                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
 681                             SCTP_MOBILITY_FASTHANDOFF)) {
 682                                 sctp_assoc_immediate_retrans(stcb,
 683                                     stcb->asoc.primary_destination);
 684                         }
 685                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
 686                             SCTP_MOBILITY_BASE)) {
 687                                 sctp_move_chunks_from_net(stcb,
 688                                     stcb->asoc.deleted_primary);
 689                         }
 690                         sctp_delete_prim_timer(stcb->sctp_ep, stcb,
 691                             stcb->asoc.deleted_primary);
 692                 }
 693         }
 694 }
 695
 696 static int
 697 sctp_handle_nat_colliding_state(struct sctp_tcb *stcb)
 698 {
 699         /*
 700          * return 0 means we want you to proceed with the abort non-zero
 701          * means no abort processing
 702          */
 703         struct sctpasochead *head;
 704
 705         if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_WAIT) {
 706                 /* generate a new vtag and send init */
 707                 LIST_REMOVE(stcb, sctp_asocs);
 708                 stcb->asoc.my_vtag = sctp_select_a_tag(stcb->sctp_ep, stcb->sctp_ep->sctp_lport, stcb->rport, 1);
 709                 head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag, SCTP_BASE_INFO(hashasocmark))];
 710                 /* put it in the bucket in the vtag hash of assoc's for the
 711                  * system */
 712                 LIST_INSERT_HEAD(head, stcb, sctp_asocs);
 713                 sctp_send_initiate(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);
 714                 return (1);
 715         }
 716         if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_ECHOED) {
 717                 /*
 718                  * treat like a case where the cookie expired i.e.: - dump
 719                  * current cookie. - generate a new vtag. - resend init.
 720                  */
 721                 /* generate a new vtag and send init */
 722                 LIST_REMOVE(stcb, sctp_asocs);
 723                 stcb->asoc.state &= ~SCTP_STATE_COOKIE_ECHOED;
 724                 stcb->asoc.state |= SCTP_STATE_COOKIE_WAIT;
 725                 sctp_stop_all_cookie_timers(stcb);
 726                 sctp_toss_old_cookies(stcb, &stcb->asoc);
 727                 stcb->asoc.my_vtag = sctp_select_a_tag(stcb->sctp_ep, stcb->sctp_ep->sctp_lport, stcb->rport, 1);
 728                 head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag, SCTP_BASE_INFO(hashasocmark))];
 729                 /* put it in the bucket in the vtag hash of assoc's for the
 730                  * system */
 731                 LIST_INSERT_HEAD(head, stcb, sctp_asocs);
 732                 sctp_send_initiate(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);
 733                 return (1);
 734         }
 735         return (0);
 736 }
 737
 738 static int
 739 sctp_handle_nat_missing_state(struct sctp_tcb *stcb,
 740     struct sctp_nets *net)
 741 {
 742         /*
 743          * return 0 means we want you to proceed with the abort non-zero
 744          * means no abort processing
 745          */
 746         if (stcb->asoc.auth_supported == 0) {
 747                 SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_nat_missing_state: Peer does not support AUTH, cannot send an asconf\n");
 748                 return (0);
 749         }
 750         sctp_asconf_send_nat_state_update(stcb, net);
 751         return (1);
 752 }
 753
 754
 755 static void
 756 sctp_handle_abort(struct sctp_abort_chunk *abort,
 757     struct sctp_tcb *stcb, struct sctp_nets *net)
 758 {
 759 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 760         struct socket *so;
 761 #endif
 762         uint16_t len;
 763         uint16_t error;
 764
 765         SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_abort: handling ABORT\n");
 766         if (stcb == NULL)
 767                 return;
 768
 769         len = ntohs(abort->ch.chunk_length);
 770         if (len > sizeof(struct sctp_chunkhdr)) {
 771                 /*
 772                  * Need to check the cause codes for our two magic nat
 773                  * aborts which don't kill the assoc necessarily.
 774                  */
 775                 struct sctp_gen_error_cause *cause;
 776
 777                 cause = (struct sctp_gen_error_cause *)(abort + 1);
 778                 error = ntohs(cause->code);
 779                 if (error == SCTP_CAUSE_NAT_COLLIDING_STATE) {
 780                         SCTPDBG(SCTP_DEBUG_INPUT2, "Received Colliding state abort flags:%x\n",
 781                             abort->ch.chunk_flags);
 782                         if (sctp_handle_nat_colliding_state(stcb)) {
 783                                 return;
 784                         }
 785                 } else if (error == SCTP_CAUSE_NAT_MISSING_STATE) {
 786                         SCTPDBG(SCTP_DEBUG_INPUT2, "Received missing state abort flags:%x\n",
 787                             abort->ch.chunk_flags);
 788                         if (sctp_handle_nat_missing_state(stcb, net)) {
 789                                 return;
 790                         }
 791                 }
 792         } else {
 793                 error = 0;
 794         }
 795         /* stop any receive timers */
 796         sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, net,
 797             SCTP_FROM_SCTP_INPUT + SCTP_LOC_7);
 798         /* notify user of the abort and clean up... */
 799         sctp_abort_notification(stcb, 1, error, abort, SCTP_SO_NOT_LOCKED);
 800         /* free the tcb */
 801         SCTP_STAT_INCR_COUNTER32(sctps_aborted);
 802         if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
 803             (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
 804                 SCTP_STAT_DECR_GAUGE32(sctps_currestab);
 805         }
 806 #ifdef SCTP_ASOCLOG_OF_TSNS
 807         sctp_print_out_track_log(stcb);
 808 #endif
 809 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 810         so = SCTP_INP_SO(stcb->sctp_ep);
 811         atomic_add_int(&stcb->asoc.refcnt, 1);
 812         SCTP_TCB_UNLOCK(stcb);
 813         SCTP_SOCKET_LOCK(so, 1);
 814         SCTP_TCB_LOCK(stcb);
 815         atomic_subtract_int(&stcb->asoc.refcnt, 1);
 816 #endif
 817         stcb->asoc.state |= SCTP_STATE_WAS_ABORTED;
 818         (void)sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC,
 819             SCTP_FROM_SCTP_INPUT + SCTP_LOC_8);
 820 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 821         SCTP_SOCKET_UNLOCK(so, 1);
 822 #endif
 823         SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_abort: finished\n");
 824 }
 825
 826 static void
 827 sctp_start_net_timers(struct sctp_tcb *stcb)
 828 {
 829         uint32_t cnt_hb_sent;
 830         struct sctp_nets *net;
 831
 832         cnt_hb_sent = 0;
 833         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 834                 /*
 835                  * For each network start: 1) A pmtu timer. 2) A HB timer 3)
 836                  * If the dest in unconfirmed send a hb as well if under
 837                  * max_hb_burst have been sent.
 838                  */
 839                 sctp_timer_start(SCTP_TIMER_TYPE_PATHMTURAISE, stcb->sctp_ep, stcb, net);
 840                 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb, net);
 841                 if ((net->dest_state & SCTP_ADDR_UNCONFIRMED) &&
 842                     (cnt_hb_sent < SCTP_BASE_SYSCTL(sctp_hb_maxburst))) {
 843                         sctp_send_hb(stcb, net, SCTP_SO_NOT_LOCKED);
 844                         cnt_hb_sent++;
 845                 }
 846         }
 847         if (cnt_hb_sent) {
 848                 sctp_chunk_output(stcb->sctp_ep, stcb,
 849                     SCTP_OUTPUT_FROM_COOKIE_ACK,
 850                     SCTP_SO_NOT_LOCKED);
 851         }
 852 }
 853
 854
 855 static void
 856 sctp_handle_shutdown(struct sctp_shutdown_chunk *cp,
 857     struct sctp_tcb *stcb, struct sctp_nets *net, int *abort_flag)
 858 {
 859         struct sctp_association *asoc;
 860         int some_on_streamwheel;
 861         int old_state;
 862 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 863         struct socket *so;
 864 #endif
 865
 866         SCTPDBG(SCTP_DEBUG_INPUT2,
 867             "sctp_handle_shutdown: handling SHUTDOWN\n");
 868         if (stcb == NULL)
 869                 return;
 870         asoc = &stcb->asoc;
 871         if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||
 872             (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) {
 873                 return;
 874         }
 875         if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_shutdown_chunk)) {
 876                 /* Shutdown NOT the expected size */
 877                 return;
 878         }
 879         old_state = SCTP_GET_STATE(asoc);
 880         sctp_update_acked(stcb, cp, abort_flag);
 881         if (*abort_flag) {
 882                 return;
 883         }
 884         if (asoc->control_pdapi) {
 885                 /*
 886                  * With a normal shutdown we assume the end of last record.
 887                  */
 888                 SCTP_INP_READ_LOCK(stcb->sctp_ep);
 889                 if (asoc->control_pdapi->on_strm_q) {
 890                         struct sctp_stream_in *strm;
 891
 892                         strm = &asoc->strmin[asoc->control_pdapi->sinfo_stream];
 893                         if (asoc->control_pdapi->on_strm_q == SCTP_ON_UNORDERED) {
 894                                 /* Unordered */
 895                                 TAILQ_REMOVE(&strm->uno_inqueue, asoc->control_pdapi, next_instrm);
 896                                 asoc->control_pdapi->on_strm_q = 0;
 897                         } else if (asoc->control_pdapi->on_strm_q == SCTP_ON_ORDERED) {
 898                                 /* Ordered */
 899                                 TAILQ_REMOVE(&strm->inqueue, asoc->control_pdapi, next_instrm);
 900                                 asoc->control_pdapi->on_strm_q = 0;
 901 #ifdef INVARIANTS
 902                         } else {
 903                                 panic("Unknown state on ctrl:%p on_strm_q:%d",
 904                                     asoc->control_pdapi,
 905                                     asoc->control_pdapi->on_strm_q);
 906 #endif
 907                         }
 908                 }
 909                 asoc->control_pdapi->end_added = 1;
 910                 asoc->control_pdapi->pdapi_aborted = 1;
 911                 asoc->control_pdapi = NULL;
 912                 SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
 913 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 914                 so = SCTP_INP_SO(stcb->sctp_ep);
 915                 atomic_add_int(&stcb->asoc.refcnt, 1);
 916                 SCTP_TCB_UNLOCK(stcb);
 917                 SCTP_SOCKET_LOCK(so, 1);
 918                 SCTP_TCB_LOCK(stcb);
 919                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
 920                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
 921                         /* assoc was freed while we were unlocked */
 922                         SCTP_SOCKET_UNLOCK(so, 1);
 923                         return;
 924                 }
 925 #endif
 926                 if (stcb->sctp_socket) {
 927                         sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
 928                 }
 929 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 930                 SCTP_SOCKET_UNLOCK(so, 1);
 931 #endif
 932         }
 933         /* goto SHUTDOWN_RECEIVED state to block new requests */
 934         if (stcb->sctp_socket) {
 935                 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) &&
 936                     (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT) &&
 937                     (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT)) {
 938                         SCTP_SET_STATE(asoc, SCTP_STATE_SHUTDOWN_RECEIVED);
 939                         SCTP_CLEAR_SUBSTATE(asoc, SCTP_STATE_SHUTDOWN_PENDING);
 940                         /* notify upper layer that peer has initiated a
 941                          * shutdown */
 942                         sctp_ulp_notify(SCTP_NOTIFY_PEER_SHUTDOWN, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
 943
 944                         /* reset time */
 945                         (void)SCTP_GETTIME_TIMEVAL(&asoc->time_entered);
 946                 }
 947         }
 948         if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) {
 949                 /*
 950                  * stop the shutdown timer, since we WILL move to
 951                  * SHUTDOWN-ACK-SENT.
 952                  */
 953                 sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb,
 954                     net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_9);
 955         }
 956         /* Now is there unsent data on a stream somewhere? */
 957         some_on_streamwheel = sctp_is_there_unsent_data(stcb, SCTP_SO_NOT_LOCKED);
 958
 959         if (!TAILQ_EMPTY(&asoc->send_queue) ||
 960             !TAILQ_EMPTY(&asoc->sent_queue) ||
 961             some_on_streamwheel) {
 962                 /* By returning we will push more data out */
 963                 return;
 964         } else {
 965                 /* no outstanding data to send, so move on... */
 966                 /* send SHUTDOWN-ACK */
 967                 /* move to SHUTDOWN-ACK-SENT state */
 968                 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) ||
 969                     (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
 970                         SCTP_STAT_DECR_GAUGE32(sctps_currestab);
 971                 }
 972                 SCTP_CLEAR_SUBSTATE(asoc, SCTP_STATE_SHUTDOWN_PENDING);
 973                 if (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT) {
 974                         SCTP_SET_STATE(asoc, SCTP_STATE_SHUTDOWN_ACK_SENT);
 975                         sctp_stop_timers_for_shutdown(stcb);
 976                         sctp_send_shutdown_ack(stcb, net);
 977                         sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNACK,
 978                             stcb->sctp_ep, stcb, net);
 979                 } else if (old_state == SCTP_STATE_SHUTDOWN_ACK_SENT) {
 980                         sctp_send_shutdown_ack(stcb, net);
 981                 }
 982         }
 983 }
 984
 985 static void
 986 sctp_handle_shutdown_ack(struct sctp_shutdown_ack_chunk *cp SCTP_UNUSED,
 987     struct sctp_tcb *stcb,
 988     struct sctp_nets *net)
 989 {
 990         struct sctp_association *asoc;
 991 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 992         struct socket *so;
 993
 994         so = SCTP_INP_SO(stcb->sctp_ep);
 995 #endif
 996         SCTPDBG(SCTP_DEBUG_INPUT2,
 997             "sctp_handle_shutdown_ack: handling SHUTDOWN ACK\n");
 998         if (stcb == NULL)
 999                 return;
1000
1001         asoc = &stcb->asoc;
1002         /* process according to association state */
1003         if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||
1004             (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) {
1005                 /* unexpected SHUTDOWN-ACK... do OOTB handling... */
1006                 sctp_send_shutdown_complete(stcb, net, 1);
1007                 SCTP_TCB_UNLOCK(stcb);
1008                 return;
1009         }
1010         if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) &&
1011             (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) {
1012                 /* unexpected SHUTDOWN-ACK... so ignore... */
1013                 SCTP_TCB_UNLOCK(stcb);
1014                 return;
1015         }
1016         if (asoc->control_pdapi) {
1017                 /*
1018                  * With a normal shutdown we assume the end of last record.
1019                  */
1020                 SCTP_INP_READ_LOCK(stcb->sctp_ep);
1021                 asoc->control_pdapi->end_added = 1;
1022                 asoc->control_pdapi->pdapi_aborted = 1;
1023                 asoc->control_pdapi = NULL;
1024                 SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
1025 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1026                 atomic_add_int(&stcb->asoc.refcnt, 1);
1027                 SCTP_TCB_UNLOCK(stcb);
1028                 SCTP_SOCKET_LOCK(so, 1);
1029                 SCTP_TCB_LOCK(stcb);
1030                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
1031                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
1032                         /* assoc was freed while we were unlocked */
1033                         SCTP_SOCKET_UNLOCK(so, 1);
1034                         return;
1035                 }
1036 #endif
1037                 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
1038 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1039                 SCTP_SOCKET_UNLOCK(so, 1);
1040 #endif
1041         }
1042 #ifdef INVARIANTS
1043         if (!TAILQ_EMPTY(&asoc->send_queue) ||
1044             !TAILQ_EMPTY(&asoc->sent_queue) ||
1045             sctp_is_there_unsent_data(stcb, SCTP_SO_NOT_LOCKED)) {
1046                 panic("Queues are not empty when handling SHUTDOWN-ACK");
1047         }
1048 #endif
1049         /* stop the timer */
1050         sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, net,
1051             SCTP_FROM_SCTP_INPUT + SCTP_LOC_10);
1052         /* send SHUTDOWN-COMPLETE */
1053         sctp_send_shutdown_complete(stcb, net, 0);
1054         /* notify upper layer protocol */
1055         if (stcb->sctp_socket) {
1056                 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
1057                     (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
1058                         stcb->sctp_socket->so_snd.sb_cc = 0;
1059                 }
1060                 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_DOWN, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
1061         }
1062         SCTP_STAT_INCR_COUNTER32(sctps_shutdown);
1063         /* free the TCB but first save off the ep */
1064 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1065         atomic_add_int(&stcb->asoc.refcnt, 1);
1066         SCTP_TCB_UNLOCK(stcb);
1067         SCTP_SOCKET_LOCK(so, 1);
1068         SCTP_TCB_LOCK(stcb);
1069         atomic_subtract_int(&stcb->asoc.refcnt, 1);
1070 #endif
1071         (void)sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC,
1072             SCTP_FROM_SCTP_INPUT + SCTP_LOC_11);
1073 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1074         SCTP_SOCKET_UNLOCK(so, 1);
1075 #endif
1076 }
1077
1078 /*
1079  * Skip past the param header and then we will find the chunk that caused the
1080  * problem. There are two possibilities ASCONF or FWD-TSN other than that and
1081  * our peer must be broken.
1082  */
1083 static void
1084 sctp_process_unrecog_chunk(struct sctp_tcb *stcb, struct sctp_paramhdr *phdr,
1085     struct sctp_nets *net)
1086 {
1087         struct sctp_chunkhdr *chk;
1088
1089         chk = (struct sctp_chunkhdr *)((caddr_t)phdr + sizeof(*phdr));
1090         switch (chk->chunk_type) {
1091         case SCTP_ASCONF_ACK:
1092         case SCTP_ASCONF:
1093                 sctp_asconf_cleanup(stcb, net);
1094                 break;
1095         case SCTP_IFORWARD_CUM_TSN:
1096         case SCTP_FORWARD_CUM_TSN:
1097                 stcb->asoc.prsctp_supported = 0;
1098                 break;
1099         default:
1100                 SCTPDBG(SCTP_DEBUG_INPUT2,
1101                     "Peer does not support chunk type %d(%x)??\n",
1102                     chk->chunk_type, (uint32_t) chk->chunk_type);
1103                 break;
1104         }
1105 }
1106
1107 /*
1108  * Skip past the param header and then we will find the param that caused the
1109  * problem.  There are a number of param's in a ASCONF OR the prsctp param
1110  * these will turn of specific features.
1111  * XXX: Is this the right thing to do?
1112  */
1113 static void
1114 sctp_process_unrecog_param(struct sctp_tcb *stcb, struct sctp_paramhdr *phdr)
1115 {
1116         struct sctp_paramhdr *pbad;
1117
1118         pbad = phdr + 1;
1119         switch (ntohs(pbad->param_type)) {
1120                 /* pr-sctp draft */
1121         case SCTP_PRSCTP_SUPPORTED:
1122                 stcb->asoc.prsctp_supported = 0;
1123                 break;
1124         case SCTP_SUPPORTED_CHUNK_EXT:
1125                 break;
1126                 /* draft-ietf-tsvwg-addip-sctp */
1127         case SCTP_HAS_NAT_SUPPORT:
1128                 stcb->asoc.peer_supports_nat = 0;
1129                 break;
1130         case SCTP_ADD_IP_ADDRESS:
1131         case SCTP_DEL_IP_ADDRESS:
1132         case SCTP_SET_PRIM_ADDR:
1133                 stcb->asoc.asconf_supported = 0;
1134                 break;
1135         case SCTP_SUCCESS_REPORT:
1136         case SCTP_ERROR_CAUSE_IND:
1137                 SCTPDBG(SCTP_DEBUG_INPUT2, "Huh, the peer does not support success? or error cause?\n");
1138                 SCTPDBG(SCTP_DEBUG_INPUT2,
1139                     "Turning off ASCONF to this strange peer\n");
1140                 stcb->asoc.asconf_supported = 0;
1141                 break;
1142         default:
1143                 SCTPDBG(SCTP_DEBUG_INPUT2,
1144                     "Peer does not support param type %d(%x)??\n",
1145                     pbad->param_type, (uint32_t) pbad->param_type);
1146                 break;
1147         }
1148 }
1149
1150 static int
1151 sctp_handle_error(struct sctp_chunkhdr *ch,
1152     struct sctp_tcb *stcb, struct sctp_nets *net)
1153 {
1154         int chklen;
1155         struct sctp_paramhdr *phdr;
1156         uint16_t error, error_type;
1157         uint16_t error_len;
1158         struct sctp_association *asoc;
1159         int adjust;
1160 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1161         struct socket *so;
1162 #endif
1163
1164         /* parse through all of the errors and process */
1165         asoc = &stcb->asoc;
1166         phdr = (struct sctp_paramhdr *)((caddr_t)ch +
1167             sizeof(struct sctp_chunkhdr));
1168         chklen = ntohs(ch->chunk_length) - sizeof(struct sctp_chunkhdr);
1169         error = 0;
1170         while ((size_t)chklen >= sizeof(struct sctp_paramhdr)) {
1171                 /* Process an Error Cause */
1172                 error_type = ntohs(phdr->param_type);
1173                 error_len = ntohs(phdr->param_length);
1174                 if ((error_len > chklen) || (error_len == 0)) {
1175                         /* invalid param length for this param */
1176                         SCTPDBG(SCTP_DEBUG_INPUT1, "Bogus length in error param- chunk left:%d errorlen:%d\n",
1177                             chklen, error_len);
1178                         return (0);
1179                 }
1180                 if (error == 0) {
1181                         /* report the first error cause */
1182                         error = error_type;
1183                 }
1184                 switch (error_type) {
1185                 case SCTP_CAUSE_INVALID_STREAM:
1186                 case SCTP_CAUSE_MISSING_PARAM:
1187                 case SCTP_CAUSE_INVALID_PARAM:
1188                 case SCTP_CAUSE_NO_USER_DATA:
1189                         SCTPDBG(SCTP_DEBUG_INPUT1, "Software error we got a %d back? We have a bug :/ (or do they?)\n",
1190                             error_type);
1191                         break;
1192                 case SCTP_CAUSE_NAT_COLLIDING_STATE:
1193                         SCTPDBG(SCTP_DEBUG_INPUT2, "Received Colliding state abort flags:%x\n",
1194                             ch->chunk_flags);
1195                         if (sctp_handle_nat_colliding_state(stcb)) {
1196                                 return (0);
1197                         }
1198                         break;
1199                 case SCTP_CAUSE_NAT_MISSING_STATE:
1200                         SCTPDBG(SCTP_DEBUG_INPUT2, "Received missing state abort flags:%x\n",
1201                             ch->chunk_flags);
1202                         if (sctp_handle_nat_missing_state(stcb, net)) {
1203                                 return (0);
1204                         }
1205                         break;
1206                 case SCTP_CAUSE_STALE_COOKIE:
1207                         /*
1208                          * We only act if we have echoed a cookie and are
1209                          * waiting.
1210                          */
1211                         if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) {
1212                                 int *p;
1213
1214                                 p = (int *)((caddr_t)phdr + sizeof(*phdr));
1215                                 /* Save the time doubled */
1216                                 asoc->cookie_preserve_req = ntohl(*p) << 1;
1217                                 asoc->stale_cookie_count++;
1218                                 if (asoc->stale_cookie_count >
1219                                     asoc->max_init_times) {
1220                                         sctp_abort_notification(stcb, 0, 0, NULL, SCTP_SO_NOT_LOCKED);
1221                                         /* now free the asoc */
1222 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1223                                         so = SCTP_INP_SO(stcb->sctp_ep);
1224                                         atomic_add_int(&stcb->asoc.refcnt, 1);
1225                                         SCTP_TCB_UNLOCK(stcb);
1226                                         SCTP_SOCKET_LOCK(so, 1);
1227                                         SCTP_TCB_LOCK(stcb);
1228                                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
1229 #endif
1230                                         (void)sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC,
1231                                             SCTP_FROM_SCTP_INPUT + SCTP_LOC_12);
1232 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1233                                         SCTP_SOCKET_UNLOCK(so, 1);
1234 #endif
1235                                         return (-1);
1236                                 }
1237                                 /* blast back to INIT state */
1238                                 sctp_toss_old_cookies(stcb, &stcb->asoc);
1239                                 asoc->state &= ~SCTP_STATE_COOKIE_ECHOED;
1240                                 asoc->state |= SCTP_STATE_COOKIE_WAIT;
1241                                 sctp_stop_all_cookie_timers(stcb);
1242                                 sctp_send_initiate(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);
1243                         }
1244                         break;
1245                 case SCTP_CAUSE_UNRESOLVABLE_ADDR:
1246                         /*
1247                          * Nothing we can do here, we don't do hostname
1248                          * addresses so if the peer does not like my IPv6
1249                          * (or IPv4 for that matter) it does not matter. If
1250                          * they don't support that type of address, they can
1251                          * NOT possibly get that packet type... i.e. with no
1252                          * IPv6 you can't receive a IPv6 packet. so we can
1253                          * safely ignore this one. If we ever added support
1254                          * for HOSTNAME Addresses, then we would need to do
1255                          * something here.
1256                          */
1257                         break;
1258                 case SCTP_CAUSE_UNRECOG_CHUNK:
1259                         sctp_process_unrecog_chunk(stcb, phdr, net);
1260                         break;
1261                 case SCTP_CAUSE_UNRECOG_PARAM:
1262                         sctp_process_unrecog_param(stcb, phdr);
1263                         break;
1264                 case SCTP_CAUSE_COOKIE_IN_SHUTDOWN:
1265                         /*
1266                          * We ignore this since the timer will drive out a
1267                          * new cookie anyway and there timer will drive us
1268                          * to send a SHUTDOWN_COMPLETE. We can't send one
1269                          * here since we don't have their tag.
1270                          */
1271                         break;
1272                 case SCTP_CAUSE_DELETING_LAST_ADDR:
1273                 case SCTP_CAUSE_RESOURCE_SHORTAGE:
1274                 case SCTP_CAUSE_DELETING_SRC_ADDR:
1275                         /*
1276                          * We should NOT get these here, but in a
1277                          * ASCONF-ACK.
1278                          */
1279                         SCTPDBG(SCTP_DEBUG_INPUT2, "Peer sends ASCONF errors in a Operational Error?<%d>?\n",
1280                             error_type);
1281                         break;
1282                 case SCTP_CAUSE_OUT_OF_RESC:
1283                         /*
1284                          * And what, pray tell do we do with the fact that
1285                          * the peer is out of resources? Not really sure we
1286                          * could do anything but abort. I suspect this
1287                          * should have came WITH an abort instead of in a
1288                          * OP-ERROR.
1289                          */
1290                         break;
1291                 default:
1292                         SCTPDBG(SCTP_DEBUG_INPUT1, "sctp_handle_error: unknown error type = 0x%xh\n",
1293                             error_type);
1294                         break;
1295                 }
1296                 adjust = SCTP_SIZE32(error_len);
1297                 chklen -= adjust;
1298                 phdr = (struct sctp_paramhdr *)((caddr_t)phdr + adjust);
1299         }
1300         sctp_ulp_notify(SCTP_NOTIFY_REMOTE_ERROR, stcb, error, ch, SCTP_SO_NOT_LOCKED);
1301         return (0);
1302 }
1303
1304 static int
1305 sctp_handle_init_ack(struct mbuf *m, int iphlen, int offset,
1306     struct sockaddr *src, struct sockaddr *dst, struct sctphdr *sh,
1307     struct sctp_init_ack_chunk *cp, struct sctp_tcb *stcb,
1308     struct sctp_nets *net, int *abort_no_unlock,
1309     uint8_t mflowtype, uint32_t mflowid,
1310     uint32_t vrf_id)
1311 {
1312         struct sctp_init_ack *init_ack;
1313         struct mbuf *op_err;
1314
1315         SCTPDBG(SCTP_DEBUG_INPUT2,
1316             "sctp_handle_init_ack: handling INIT-ACK\n");
1317
1318         if (stcb == NULL) {
1319                 SCTPDBG(SCTP_DEBUG_INPUT2,
1320                     "sctp_handle_init_ack: TCB is null\n");
1321                 return (-1);
1322         }
1323         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_init_ack_chunk)) {
1324                 /* Invalid length */
1325                 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
1326                 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
1327                     src, dst, sh, op_err,
1328                     mflowtype, mflowid,
1329                     vrf_id, net->port);
1330                 *abort_no_unlock = 1;
1331                 return (-1);
1332         }
1333         init_ack = &cp->init;
1334         /* validate parameters */
1335         if (init_ack->initiate_tag == 0) {
1336                 /* protocol error... send an abort */
1337                 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
1338                 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
1339                     src, dst, sh, op_err,
1340                     mflowtype, mflowid,
1341                     vrf_id, net->port);
1342                 *abort_no_unlock = 1;
1343                 return (-1);
1344         }
1345         if (ntohl(init_ack->a_rwnd) < SCTP_MIN_RWND) {
1346                 /* protocol error... send an abort */
1347                 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
1348                 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
1349                     src, dst, sh, op_err,
1350                     mflowtype, mflowid,
1351                     vrf_id, net->port);
1352                 *abort_no_unlock = 1;
1353                 return (-1);
1354         }
1355         if (init_ack->num_inbound_streams == 0) {
1356                 /* protocol error... send an abort */
1357                 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
1358                 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
1359                     src, dst, sh, op_err,
1360                     mflowtype, mflowid,
1361                     vrf_id, net->port);
1362                 *abort_no_unlock = 1;
1363                 return (-1);
1364         }
1365         if (init_ack->num_outbound_streams == 0) {
1366                 /* protocol error... send an abort */
1367                 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
1368                 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
1369                     src, dst, sh, op_err,
1370                     mflowtype, mflowid,
1371                     vrf_id, net->port);
1372                 *abort_no_unlock = 1;
1373                 return (-1);
1374         }
1375         /* process according to association state... */
1376         switch (stcb->asoc.state & SCTP_STATE_MASK) {
1377         case SCTP_STATE_COOKIE_WAIT:
1378                 /* this is the expected state for this chunk */
1379                 /* process the INIT-ACK parameters */
1380                 if (stcb->asoc.primary_destination->dest_state &
1381                     SCTP_ADDR_UNCONFIRMED) {
1382                         /*
1383                          * The primary is where we sent the INIT, we can
1384                          * always consider it confirmed when the INIT-ACK is
1385                          * returned. Do this before we load addresses
1386                          * though.
1387                          */
1388                         stcb->asoc.primary_destination->dest_state &=
1389                             ~SCTP_ADDR_UNCONFIRMED;
1390                         sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
1391                             stcb, 0, (void *)stcb->asoc.primary_destination, SCTP_SO_NOT_LOCKED);
1392                 }
1393                 if (sctp_process_init_ack(m, iphlen, offset, src, dst, sh, cp, stcb,
1394                     net, abort_no_unlock,
1395                     mflowtype, mflowid,
1396                     vrf_id) < 0) {
1397                         /* error in parsing parameters */
1398                         return (-1);
1399                 }
1400                 /* update our state */
1401                 SCTPDBG(SCTP_DEBUG_INPUT2, "moving to COOKIE-ECHOED state\n");
1402                 SCTP_SET_STATE(&stcb->asoc, SCTP_STATE_COOKIE_ECHOED);
1403
1404                 /* reset the RTO calc */
1405                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
1406                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
1407                             stcb->asoc.overall_error_count,
1408                             0,
1409                             SCTP_FROM_SCTP_INPUT,
1410                             __LINE__);
1411                 }
1412                 stcb->asoc.overall_error_count = 0;
1413                 (void)SCTP_GETTIME_TIMEVAL(&stcb->asoc.time_entered);
1414                 /*
1415                  * collapse the init timer back in case of a exponential
1416                  * backoff
1417                  */
1418                 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, stcb->sctp_ep,
1419                     stcb, net);
1420                 /*
1421                  * the send at the end of the inbound data processing will
1422                  * cause the cookie to be sent
1423                  */
1424                 break;
1425         case SCTP_STATE_SHUTDOWN_SENT:
1426                 /* incorrect state... discard */
1427                 break;
1428         case SCTP_STATE_COOKIE_ECHOED:
1429                 /* incorrect state... discard */
1430                 break;
1431         case SCTP_STATE_OPEN:
1432                 /* incorrect state... discard */
1433                 break;
1434         case SCTP_STATE_EMPTY:
1435         case SCTP_STATE_INUSE:
1436         default:
1437                 /* incorrect state... discard */
1438                 return (-1);
1439                 break;
1440         }
1441         SCTPDBG(SCTP_DEBUG_INPUT1, "Leaving handle-init-ack end\n");
1442         return (0);
1443 }
1444
1445 static struct sctp_tcb *
1446 sctp_process_cookie_new(struct mbuf *m, int iphlen, int offset,
1447     struct sockaddr *src, struct sockaddr *dst,
1448     struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len,
1449     struct sctp_inpcb *inp, struct sctp_nets **netp,
1450     struct sockaddr *init_src, int *notification,
1451     int auth_skipped, uint32_t auth_offset, uint32_t auth_len,
1452     uint8_t mflowtype, uint32_t mflowid,
1453     uint32_t vrf_id, uint16_t port);
1454
1455
1456 /*
1457  * handle a state cookie for an existing association m: input packet mbuf
1458  * chain-- assumes a pullup on IP/SCTP/COOKIE-ECHO chunk note: this is a
1459  * "split" mbuf and the cookie signature does not exist offset: offset into
1460  * mbuf to the cookie-echo chunk
1461  */
1462 static struct sctp_tcb *
1463 sctp_process_cookie_existing(struct mbuf *m, int iphlen, int offset,
1464     struct sockaddr *src, struct sockaddr *dst,
1465     struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len,
1466     struct sctp_inpcb *inp, struct sctp_tcb *stcb, struct sctp_nets **netp,
1467     struct sockaddr *init_src, int *notification,
1468     int auth_skipped, uint32_t auth_offset, uint32_t auth_len,
1469     uint8_t mflowtype, uint32_t mflowid,
1470     uint32_t vrf_id, uint16_t port)
1471 {
1472         struct sctp_association *asoc;
1473         struct sctp_init_chunk *init_cp, init_buf;
1474         struct sctp_init_ack_chunk *initack_cp, initack_buf;
1475         struct sctp_nets *net;
1476         struct mbuf *op_err;
1477         int init_offset, initack_offset, i;
1478         int retval;
1479         int spec_flag = 0;
1480         uint32_t how_indx;
1481 #if defined(SCTP_DETAILED_STR_STATS)
1482         int j;
1483 #endif
1484
1485         net = *netp;
1486         /* I know that the TCB is non-NULL from the caller */
1487         asoc = &stcb->asoc;
1488         for (how_indx = 0; how_indx < sizeof(asoc->cookie_how); how_indx++) {
1489                 if (asoc->cookie_how[how_indx] == 0)
1490                         break;
1491         }
1492         if (how_indx < sizeof(asoc->cookie_how)) {
1493                 asoc->cookie_how[how_indx] = 1;
1494         }
1495         if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) {
1496                 /* SHUTDOWN came in after sending INIT-ACK */
1497                 sctp_send_shutdown_ack(stcb, stcb->asoc.primary_destination);
1498                 op_err = sctp_generate_cause(SCTP_CAUSE_COOKIE_IN_SHUTDOWN, "");
1499                 sctp_send_operr_to(src, dst, sh, cookie->peers_vtag, op_err,
1500                     mflowtype, mflowid, inp->fibnum,
1501                     vrf_id, net->port);
1502                 if (how_indx < sizeof(asoc->cookie_how))
1503                         asoc->cookie_how[how_indx] = 2;
1504                 return (NULL);
1505         }
1506         /*
1507          * find and validate the INIT chunk in the cookie (peer's info) the
1508          * INIT should start after the cookie-echo header struct (chunk
1509          * header, state cookie header struct)
1510          */
1511         init_offset = offset += sizeof(struct sctp_cookie_echo_chunk);
1512
1513         init_cp = (struct sctp_init_chunk *)
1514             sctp_m_getptr(m, init_offset, sizeof(struct sctp_init_chunk),
1515             (uint8_t *) & init_buf);
1516         if (init_cp == NULL) {
1517                 /* could not pull a INIT chunk in cookie */
1518                 return (NULL);
1519         }
1520         if (init_cp->ch.chunk_type != SCTP_INITIATION) {
1521                 return (NULL);
1522         }
1523         /*
1524          * find and validate the INIT-ACK chunk in the cookie (my info) the
1525          * INIT-ACK follows the INIT chunk
1526          */
1527         initack_offset = init_offset + SCTP_SIZE32(ntohs(init_cp->ch.chunk_length));
1528         initack_cp = (struct sctp_init_ack_chunk *)
1529             sctp_m_getptr(m, initack_offset, sizeof(struct sctp_init_ack_chunk),
1530             (uint8_t *) & initack_buf);
1531         if (initack_cp == NULL) {
1532                 /* could not pull INIT-ACK chunk in cookie */
1533                 return (NULL);
1534         }
1535         if (initack_cp->ch.chunk_type != SCTP_INITIATION_ACK) {
1536                 return (NULL);
1537         }
1538         if ((ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag) &&
1539             (ntohl(init_cp->init.initiate_tag) == asoc->peer_vtag)) {
1540                 /*
1541                  * case D in Section 5.2.4 Table 2: MMAA process accordingly
1542                  * to get into the OPEN state
1543                  */
1544                 if (ntohl(initack_cp->init.initial_tsn) != asoc->init_seq_number) {
1545                         /*-
1546                          * Opps, this means that we somehow generated two vtag's
1547                          * the same. I.e. we did:
1548                          *  Us               Peer
1549                          *   <---INIT(tag=a)------
1550                          *   ----INIT-ACK(tag=t)-->
1551                          *   ----INIT(tag=t)------> *1
1552                          *   <---INIT-ACK(tag=a)---
1553                          *   <----CE(tag=t)------------- *2
1554                          *
1555                          * At point *1 we should be generating a different
1556                          * tag t'. Which means we would throw away the CE and send
1557                          * ours instead. Basically this is case C (throw away side).
1558                          */
1559                         if (how_indx < sizeof(asoc->cookie_how))
1560                                 asoc->cookie_how[how_indx] = 17;
1561                         return (NULL);
1562
1563                 }
1564                 switch (SCTP_GET_STATE(asoc)) {
1565                 case SCTP_STATE_COOKIE_WAIT:
1566                 case SCTP_STATE_COOKIE_ECHOED:
1567                         /*
1568                          * INIT was sent but got a COOKIE_ECHO with the
1569                          * correct tags... just accept it...but we must
1570                          * process the init so that we can make sure we have
1571                          * the right seq no's.
1572                          */
1573                         /* First we must process the INIT !! */
1574                         retval = sctp_process_init(init_cp, stcb);
1575                         if (retval < 0) {
1576                                 if (how_indx < sizeof(asoc->cookie_how))
1577                                         asoc->cookie_how[how_indx] = 3;
1578                                 return (NULL);
1579                         }
1580                         /* we have already processed the INIT so no problem */
1581                         sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp,
1582                             stcb, net,
1583                             SCTP_FROM_SCTP_INPUT + SCTP_LOC_13);
1584                         sctp_timer_stop(SCTP_TIMER_TYPE_INIT, inp,
1585                             stcb, net,
1586                             SCTP_FROM_SCTP_INPUT + SCTP_LOC_14);
1587                         /* update current state */
1588                         if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)
1589                                 SCTP_STAT_INCR_COUNTER32(sctps_activeestab);
1590                         else
1591                                 SCTP_STAT_INCR_COUNTER32(sctps_collisionestab);
1592
1593                         SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);
1594                         if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
1595                                 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
1596                                     stcb->sctp_ep, stcb, asoc->primary_destination);
1597                         }
1598                         SCTP_STAT_INCR_GAUGE32(sctps_currestab);
1599                         sctp_stop_all_cookie_timers(stcb);
1600                         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
1601                             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
1602                             (inp->sctp_socket->so_qlimit == 0)
1603                             ) {
1604 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1605                                 struct socket *so;
1606 #endif
1607                                 /*
1608                                  * Here is where collision would go if we
1609                                  * did a connect() and instead got a
1610                                  * init/init-ack/cookie done before the
1611                                  * init-ack came back..
1612                                  */
1613                                 stcb->sctp_ep->sctp_flags |=
1614                                     SCTP_PCB_FLAGS_CONNECTED;
1615 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1616                                 so = SCTP_INP_SO(stcb->sctp_ep);
1617                                 atomic_add_int(&stcb->asoc.refcnt, 1);
1618                                 SCTP_TCB_UNLOCK(stcb);
1619                                 SCTP_SOCKET_LOCK(so, 1);
1620                                 SCTP_TCB_LOCK(stcb);
1621                                 atomic_add_int(&stcb->asoc.refcnt, -1);
1622                                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
1623                                         SCTP_SOCKET_UNLOCK(so, 1);
1624                                         return (NULL);
1625                                 }
1626 #endif
1627                                 soisconnected(stcb->sctp_socket);
1628 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1629                                 SCTP_SOCKET_UNLOCK(so, 1);
1630 #endif
1631                         }
1632                         /* notify upper layer */
1633                         *notification = SCTP_NOTIFY_ASSOC_UP;
1634                         /*
1635                          * since we did not send a HB make sure we don't
1636                          * double things
1637                          */
1638                         net->hb_responded = 1;
1639                         net->RTO = sctp_calculate_rto(stcb, asoc, net,
1640                             &cookie->time_entered,
1641                             sctp_align_unsafe_makecopy,
1642                             SCTP_RTT_FROM_NON_DATA);
1643
1644                         if (stcb->asoc.sctp_autoclose_ticks &&
1645                             (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE))) {
1646                                 sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE,
1647                                     inp, stcb, NULL);
1648                         }
1649                         break;
1650                 default:
1651                         /*
1652                          * we're in the OPEN state (or beyond), so peer must
1653                          * have simply lost the COOKIE-ACK
1654                          */
1655                         break;
1656                 }               /* end switch */
1657                 sctp_stop_all_cookie_timers(stcb);
1658                 /*
1659                  * We ignore the return code here.. not sure if we should
1660                  * somehow abort.. but we do have an existing asoc. This
1661                  * really should not fail.
1662                  */
1663                 if (sctp_load_addresses_from_init(stcb, m,
1664                     init_offset + sizeof(struct sctp_init_chunk),
1665                     initack_offset, src, dst, init_src, stcb->asoc.port)) {
1666                         if (how_indx < sizeof(asoc->cookie_how))
1667                                 asoc->cookie_how[how_indx] = 4;
1668                         return (NULL);
1669                 }
1670                 /* respond with a COOKIE-ACK */
1671                 sctp_toss_old_cookies(stcb, asoc);
1672                 sctp_send_cookie_ack(stcb);
1673                 if (how_indx < sizeof(asoc->cookie_how))
1674                         asoc->cookie_how[how_indx] = 5;
1675                 return (stcb);
1676         }
1677         if (ntohl(initack_cp->init.initiate_tag) != asoc->my_vtag &&
1678             ntohl(init_cp->init.initiate_tag) == asoc->peer_vtag &&
1679             cookie->tie_tag_my_vtag == 0 &&
1680             cookie->tie_tag_peer_vtag == 0) {
1681                 /*
1682                  * case C in Section 5.2.4 Table 2: XMOO silently discard
1683                  */
1684                 if (how_indx < sizeof(asoc->cookie_how))
1685                         asoc->cookie_how[how_indx] = 6;
1686                 return (NULL);
1687         }
1688         /*
1689          * If nat support, and the below and stcb is established, send back
1690          * a ABORT(colliding state) if we are established.
1691          */
1692         if ((SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) &&
1693             (asoc->peer_supports_nat) &&
1694             ((ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag) &&
1695             ((ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) ||
1696             (asoc->peer_vtag == 0)))) {
1697                 /*
1698                  * Special case - Peer's support nat. We may have two init's
1699                  * that we gave out the same tag on since one was not
1700                  * established.. i.e. we get INIT from host-1 behind the nat
1701                  * and we respond tag-a, we get a INIT from host-2 behind
1702                  * the nat and we get tag-a again. Then we bring up host-1
1703                  * (or 2's) assoc, Then comes the cookie from hsot-2 (or 1).
1704                  * Now we have colliding state. We must send an abort here
1705                  * with colliding state indication.
1706                  */
1707                 op_err = sctp_generate_cause(SCTP_CAUSE_NAT_COLLIDING_STATE, "");
1708                 sctp_send_abort(m, iphlen, src, dst, sh, 0, op_err,
1709                     mflowtype, mflowid, inp->fibnum,
1710                     vrf_id, port);
1711                 return (NULL);
1712         }
1713         if ((ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag) &&
1714             ((ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) ||
1715             (asoc->peer_vtag == 0))) {
1716                 /*
1717                  * case B in Section 5.2.4 Table 2: MXAA or MOAA my info
1718                  * should be ok, re-accept peer info
1719                  */
1720                 if (ntohl(initack_cp->init.initial_tsn) != asoc->init_seq_number) {
1721                         /*
1722                          * Extension of case C. If we hit this, then the
1723                          * random number generator returned the same vtag
1724                          * when we first sent our INIT-ACK and when we later
1725                          * sent our INIT. The side with the seq numbers that
1726                          * are different will be the one that normnally
1727                          * would have hit case C. This in effect "extends"
1728                          * our vtags in this collision case to be 64 bits.
1729                          * The same collision could occur aka you get both
1730                          * vtag and seq number the same twice in a row.. but
1731                          * is much less likely. If it did happen then we
1732                          * would proceed through and bring up the assoc.. we
1733                          * may end up with the wrong stream setup however..
1734                          * which would be bad.. but there is no way to
1735                          * tell.. until we send on a stream that does not
1736                          * exist :-)
1737                          */
1738                         if (how_indx < sizeof(asoc->cookie_how))
1739                                 asoc->cookie_how[how_indx] = 7;
1740
1741                         return (NULL);
1742                 }
1743                 if (how_indx < sizeof(asoc->cookie_how))
1744                         asoc->cookie_how[how_indx] = 8;
1745                 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net,
1746                     SCTP_FROM_SCTP_INPUT + SCTP_LOC_15);
1747                 sctp_stop_all_cookie_timers(stcb);
1748                 /*
1749                  * since we did not send a HB make sure we don't double
1750                  * things
1751                  */
1752                 net->hb_responded = 1;
1753                 if (stcb->asoc.sctp_autoclose_ticks &&
1754                     sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE)) {
1755                         sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb,
1756                             NULL);
1757                 }
1758                 asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd);
1759                 asoc->pre_open_streams = ntohs(initack_cp->init.num_outbound_streams);
1760
1761                 if (ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) {
1762                         /*
1763                          * Ok the peer probably discarded our data (if we
1764                          * echoed a cookie+data). So anything on the
1765                          * sent_queue should be marked for retransmit, we
1766                          * may not get something to kick us so it COULD
1767                          * still take a timeout to move these.. but it can't
1768                          * hurt to mark them.
1769                          */
1770                         struct sctp_tmit_chunk *chk;
1771
1772                         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
1773                                 if (chk->sent < SCTP_DATAGRAM_RESEND) {
1774                                         chk->sent = SCTP_DATAGRAM_RESEND;
1775                                         sctp_flight_size_decrease(chk);
1776                                         sctp_total_flight_decrease(stcb, chk);
1777                                         sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
1778                                         spec_flag++;
1779                                 }
1780                         }
1781
1782                 }
1783                 /* process the INIT info (peer's info) */
1784                 retval = sctp_process_init(init_cp, stcb);
1785                 if (retval < 0) {
1786                         if (how_indx < sizeof(asoc->cookie_how))
1787                                 asoc->cookie_how[how_indx] = 9;
1788                         return (NULL);
1789                 }
1790                 if (sctp_load_addresses_from_init(stcb, m,
1791                     init_offset + sizeof(struct sctp_init_chunk),
1792                     initack_offset, src, dst, init_src, stcb->asoc.port)) {
1793                         if (how_indx < sizeof(asoc->cookie_how))
1794                                 asoc->cookie_how[how_indx] = 10;
1795                         return (NULL);
1796                 }
1797                 if ((asoc->state & SCTP_STATE_COOKIE_WAIT) ||
1798                     (asoc->state & SCTP_STATE_COOKIE_ECHOED)) {
1799                         *notification = SCTP_NOTIFY_ASSOC_UP;
1800
1801                         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
1802                             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
1803                             (inp->sctp_socket->so_qlimit == 0)) {
1804 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1805                                 struct socket *so;
1806 #endif
1807                                 stcb->sctp_ep->sctp_flags |=
1808                                     SCTP_PCB_FLAGS_CONNECTED;
1809 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1810                                 so = SCTP_INP_SO(stcb->sctp_ep);
1811                                 atomic_add_int(&stcb->asoc.refcnt, 1);
1812                                 SCTP_TCB_UNLOCK(stcb);
1813                                 SCTP_SOCKET_LOCK(so, 1);
1814                                 SCTP_TCB_LOCK(stcb);
1815                                 atomic_add_int(&stcb->asoc.refcnt, -1);
1816                                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
1817                                         SCTP_SOCKET_UNLOCK(so, 1);
1818                                         return (NULL);
1819                                 }
1820 #endif
1821                                 soisconnected(stcb->sctp_socket);
1822 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1823                                 SCTP_SOCKET_UNLOCK(so, 1);
1824 #endif
1825                         }
1826                         if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)
1827                                 SCTP_STAT_INCR_COUNTER32(sctps_activeestab);
1828                         else
1829                                 SCTP_STAT_INCR_COUNTER32(sctps_collisionestab);
1830                         SCTP_STAT_INCR_GAUGE32(sctps_currestab);
1831                 } else if (SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) {
1832                         SCTP_STAT_INCR_COUNTER32(sctps_restartestab);
1833                 } else {
1834                         SCTP_STAT_INCR_COUNTER32(sctps_collisionestab);
1835                 }
1836                 SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);
1837                 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
1838                         sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
1839                             stcb->sctp_ep, stcb, asoc->primary_destination);
1840                 }
1841                 sctp_stop_all_cookie_timers(stcb);
1842                 sctp_toss_old_cookies(stcb, asoc);
1843                 sctp_send_cookie_ack(stcb);
1844                 if (spec_flag) {
1845                         /*
1846                          * only if we have retrans set do we do this. What
1847                          * this call does is get only the COOKIE-ACK out and
1848                          * then when we return the normal call to
1849                          * sctp_chunk_output will get the retrans out behind
1850                          * this.
1851                          */
1852                         sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_COOKIE_ACK, SCTP_SO_NOT_LOCKED);
1853                 }
1854                 if (how_indx < sizeof(asoc->cookie_how))
1855                         asoc->cookie_how[how_indx] = 11;
1856
1857                 return (stcb);
1858         }
1859         if ((ntohl(initack_cp->init.initiate_tag) != asoc->my_vtag &&
1860             ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) &&
1861             cookie->tie_tag_my_vtag == asoc->my_vtag_nonce &&
1862             cookie->tie_tag_peer_vtag == asoc->peer_vtag_nonce &&
1863             cookie->tie_tag_peer_vtag != 0) {
1864                 struct sctpasochead *head;
1865 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1866                 struct socket *so;
1867 #endif
1868
1869                 if (asoc->peer_supports_nat) {
1870                         /*
1871                          * This is a gross gross hack. Just call the
1872                          * cookie_new code since we are allowing a duplicate
1873                          * association. I hope this works...
1874                          */
1875                         return (sctp_process_cookie_new(m, iphlen, offset, src, dst,
1876                             sh, cookie, cookie_len,
1877                             inp, netp, init_src, notification,
1878                             auth_skipped, auth_offset, auth_len,
1879                             mflowtype, mflowid,
1880                             vrf_id, port));
1881                 }
1882                 /*
1883                  * case A in Section 5.2.4 Table 2: XXMM (peer restarted)
1884                  */
1885                 /* temp code */
1886                 if (how_indx < sizeof(asoc->cookie_how))
1887                         asoc->cookie_how[how_indx] = 12;
1888                 sctp_timer_stop(SCTP_TIMER_TYPE_INIT, inp, stcb, net,
1889                     SCTP_FROM_SCTP_INPUT + SCTP_LOC_16);
1890                 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net,
1891                     SCTP_FROM_SCTP_INPUT + SCTP_LOC_17);
1892
1893                 /* notify upper layer */
1894                 *notification = SCTP_NOTIFY_ASSOC_RESTART;
1895                 atomic_add_int(&stcb->asoc.refcnt, 1);
1896                 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_OPEN) &&
1897                     (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) &&
1898                     (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT)) {
1899                         SCTP_STAT_INCR_GAUGE32(sctps_currestab);
1900                 }
1901                 if (SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) {
1902                         SCTP_STAT_INCR_GAUGE32(sctps_restartestab);
1903                 } else if (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) {
1904                         SCTP_STAT_INCR_GAUGE32(sctps_collisionestab);
1905                 }
1906                 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
1907                         SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);
1908                         sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
1909                             stcb->sctp_ep, stcb, asoc->primary_destination);
1910
1911                 } else if (!(asoc->state & SCTP_STATE_SHUTDOWN_SENT)) {
1912                         /* move to OPEN state, if not in SHUTDOWN_SENT */
1913                         SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);
1914                 }
1915                 asoc->pre_open_streams =
1916                     ntohs(initack_cp->init.num_outbound_streams);
1917                 asoc->init_seq_number = ntohl(initack_cp->init.initial_tsn);
1918                 asoc->sending_seq = asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number;
1919                 asoc->asconf_seq_out_acked = asoc->asconf_seq_out - 1;
1920
1921                 asoc->asconf_seq_in = asoc->last_acked_seq = asoc->init_seq_number - 1;
1922
1923                 asoc->str_reset_seq_in = asoc->init_seq_number;
1924
1925                 asoc->advanced_peer_ack_point = asoc->last_acked_seq;
1926                 if (asoc->mapping_array) {
1927                         memset(asoc->mapping_array, 0,
1928                             asoc->mapping_array_size);
1929                 }
1930                 if (asoc->nr_mapping_array) {
1931                         memset(asoc->nr_mapping_array, 0,
1932                             asoc->mapping_array_size);
1933                 }
1934                 SCTP_TCB_UNLOCK(stcb);
1935 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1936                 so = SCTP_INP_SO(stcb->sctp_ep);
1937                 SCTP_SOCKET_LOCK(so, 1);
1938 #endif
1939                 SCTP_INP_INFO_WLOCK();
1940                 SCTP_INP_WLOCK(stcb->sctp_ep);
1941                 SCTP_TCB_LOCK(stcb);
1942                 atomic_add_int(&stcb->asoc.refcnt, -1);
1943                 /* send up all the data */
1944                 SCTP_TCB_SEND_LOCK(stcb);
1945
1946                 sctp_report_all_outbound(stcb, 0, 1, SCTP_SO_LOCKED);
1947                 for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
1948                         stcb->asoc.strmout[i].chunks_on_queues = 0;
1949 #if defined(SCTP_DETAILED_STR_STATS)
1950                         for (j = 0; j < SCTP_PR_SCTP_MAX + 1; j++) {
1951                                 asoc->strmout[i].abandoned_sent[j] = 0;
1952                                 asoc->strmout[i].abandoned_unsent[j] = 0;
1953                         }
1954 #else
1955                         asoc->strmout[i].abandoned_sent[0] = 0;
1956                         asoc->strmout[i].abandoned_unsent[0] = 0;
1957 #endif
1958                         stcb->asoc.strmout[i].stream_no = i;
1959                         stcb->asoc.strmout[i].next_mid_ordered = 0;
1960                         stcb->asoc.strmout[i].next_mid_unordered = 0;
1961                         stcb->asoc.strmout[i].last_msg_incomplete = 0;
1962                 }
1963                 /* process the INIT-ACK info (my info) */
1964                 asoc->my_vtag = ntohl(initack_cp->init.initiate_tag);
1965                 asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd);
1966
1967                 /* pull from vtag hash */
1968                 LIST_REMOVE(stcb, sctp_asocs);
1969                 /* re-insert to new vtag position */
1970                 head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag,
1971                     SCTP_BASE_INFO(hashasocmark))];
1972                 /*
1973                  * put it in the bucket in the vtag hash of assoc's for the
1974                  * system
1975                  */
1976                 LIST_INSERT_HEAD(head, stcb, sctp_asocs);
1977
1978                 SCTP_TCB_SEND_UNLOCK(stcb);
1979                 SCTP_INP_WUNLOCK(stcb->sctp_ep);
1980                 SCTP_INP_INFO_WUNLOCK();
1981 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1982                 SCTP_SOCKET_UNLOCK(so, 1);
1983 #endif
1984                 asoc->total_flight = 0;
1985                 asoc->total_flight_count = 0;
1986                 /* process the INIT info (peer's info) */
1987                 retval = sctp_process_init(init_cp, stcb);
1988                 if (retval < 0) {
1989                         if (how_indx < sizeof(asoc->cookie_how))
1990                                 asoc->cookie_how[how_indx] = 13;
1991
1992                         return (NULL);
1993                 }
1994                 /*
1995                  * since we did not send a HB make sure we don't double
1996                  * things
1997                  */
1998                 net->hb_responded = 1;
1999
2000                 if (sctp_load_addresses_from_init(stcb, m,
2001                     init_offset + sizeof(struct sctp_init_chunk),
2002                     initack_offset, src, dst, init_src, stcb->asoc.port)) {
2003                         if (how_indx < sizeof(asoc->cookie_how))
2004                                 asoc->cookie_how[how_indx] = 14;
2005
2006                         return (NULL);
2007                 }
2008                 /* respond with a COOKIE-ACK */
2009                 sctp_stop_all_cookie_timers(stcb);
2010                 sctp_toss_old_cookies(stcb, asoc);
2011                 sctp_send_cookie_ack(stcb);
2012                 if (how_indx < sizeof(asoc->cookie_how))
2013                         asoc->cookie_how[how_indx] = 15;
2014
2015                 return (stcb);
2016         }
2017         if (how_indx < sizeof(asoc->cookie_how))
2018                 asoc->cookie_how[how_indx] = 16;
2019         /* all other cases... */
2020         return (NULL);
2021 }
2022
2023
2024 /*
2025  * handle a state cookie for a new association m: input packet mbuf chain--
2026  * assumes a pullup on IP/SCTP/COOKIE-ECHO chunk note: this is a "split" mbuf
2027  * and the cookie signature does not exist offset: offset into mbuf to the
2028  * cookie-echo chunk length: length of the cookie chunk to: where the init
2029  * was from returns a new TCB
2030  */
2031 static struct sctp_tcb *
2032 sctp_process_cookie_new(struct mbuf *m, int iphlen, int offset,
2033     struct sockaddr *src, struct sockaddr *dst,
2034     struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len,
2035     struct sctp_inpcb *inp, struct sctp_nets **netp,
2036     struct sockaddr *init_src, int *notification,
2037     int auth_skipped, uint32_t auth_offset, uint32_t auth_len,
2038     uint8_t mflowtype, uint32_t mflowid,
2039     uint32_t vrf_id, uint16_t port)
2040 {
2041         struct sctp_tcb *stcb;
2042         struct sctp_init_chunk *init_cp, init_buf;
2043         struct sctp_init_ack_chunk *initack_cp, initack_buf;
2044         union sctp_sockstore store;
2045         struct sctp_association *asoc;
2046         int init_offset, initack_offset, initack_limit;
2047         int retval;
2048         int error = 0;
2049         uint8_t auth_chunk_buf[SCTP_PARAM_BUFFER_SIZE];
2050 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2051         struct socket *so;
2052
2053         so = SCTP_INP_SO(inp);
2054 #endif
2055
2056         /*
2057          * find and validate the INIT chunk in the cookie (peer's info) the
2058          * INIT should start after the cookie-echo header struct (chunk
2059          * header, state cookie header struct)
2060          */
2061         init_offset = offset + sizeof(struct sctp_cookie_echo_chunk);
2062         init_cp = (struct sctp_init_chunk *)
2063             sctp_m_getptr(m, init_offset, sizeof(struct sctp_init_chunk),
2064             (uint8_t *) & init_buf);
2065         if (init_cp == NULL) {
2066                 /* could not pull a INIT chunk in cookie */
2067                 SCTPDBG(SCTP_DEBUG_INPUT1,
2068                     "process_cookie_new: could not pull INIT chunk hdr\n");
2069                 return (NULL);
2070         }
2071         if (init_cp->ch.chunk_type != SCTP_INITIATION) {
2072                 SCTPDBG(SCTP_DEBUG_INPUT1, "HUH? process_cookie_new: could not find INIT chunk!\n");
2073                 return (NULL);
2074         }
2075         initack_offset = init_offset + SCTP_SIZE32(ntohs(init_cp->ch.chunk_length));
2076         /*
2077          * find and validate the INIT-ACK chunk in the cookie (my info) the
2078          * INIT-ACK follows the INIT chunk
2079          */
2080         initack_cp = (struct sctp_init_ack_chunk *)
2081             sctp_m_getptr(m, initack_offset, sizeof(struct sctp_init_ack_chunk),
2082             (uint8_t *) & initack_buf);
2083         if (initack_cp == NULL) {
2084                 /* could not pull INIT-ACK chunk in cookie */
2085                 SCTPDBG(SCTP_DEBUG_INPUT1, "process_cookie_new: could not pull INIT-ACK chunk hdr\n");
2086                 return (NULL);
2087         }
2088         if (initack_cp->ch.chunk_type != SCTP_INITIATION_ACK) {
2089                 return (NULL);
2090         }
2091         /*
2092          * NOTE: We can't use the INIT_ACK's chk_length to determine the
2093          * "initack_limit" value.  This is because the chk_length field
2094          * includes the length of the cookie, but the cookie is omitted when
2095          * the INIT and INIT_ACK are tacked onto the cookie...
2096          */
2097         initack_limit = offset + cookie_len;
2098
2099         /*
2100          * now that we know the INIT/INIT-ACK are in place, create a new TCB
2101          * and popluate
2102          */
2103
2104         /*
2105          * Here we do a trick, we set in NULL for the proc/thread argument.
2106          * We do this since in effect we only use the p argument when the
2107          * socket is unbound and we must do an implicit bind. Since we are
2108          * getting a cookie, we cannot be unbound.
2109          */
2110         stcb = sctp_aloc_assoc(inp, init_src, &error,
2111             ntohl(initack_cp->init.initiate_tag), vrf_id,
2112             ntohs(initack_cp->init.num_outbound_streams),
2113             port,
2114             (struct thread *)NULL
2115             );
2116         if (stcb == NULL) {
2117                 struct mbuf *op_err;
2118
2119                 /* memory problem? */
2120                 SCTPDBG(SCTP_DEBUG_INPUT1,
2121                     "process_cookie_new: no room for another TCB!\n");
2122                 op_err = sctp_generate_cause(SCTP_CAUSE_OUT_OF_RESC, "");
2123                 sctp_abort_association(inp, (struct sctp_tcb *)NULL, m, iphlen,
2124                     src, dst, sh, op_err,
2125                     mflowtype, mflowid,
2126                     vrf_id, port);
2127                 return (NULL);
2128         }
2129         /* get the correct sctp_nets */
2130         if (netp)
2131                 *netp = sctp_findnet(stcb, init_src);
2132
2133         asoc = &stcb->asoc;
2134         /* get scope variables out of cookie */
2135         asoc->scope.ipv4_local_scope = cookie->ipv4_scope;
2136         asoc->scope.site_scope = cookie->site_scope;
2137         asoc->scope.local_scope = cookie->local_scope;
2138         asoc->scope.loopback_scope = cookie->loopback_scope;
2139
2140         if ((asoc->scope.ipv4_addr_legal != cookie->ipv4_addr_legal) ||
2141             (asoc->scope.ipv6_addr_legal != cookie->ipv6_addr_legal)) {
2142                 struct mbuf *op_err;
2143
2144                 /*
2145                  * Houston we have a problem. The EP changed while the
2146                  * cookie was in flight. Only recourse is to abort the
2147                  * association.
2148                  */
2149                 atomic_add_int(&stcb->asoc.refcnt, 1);
2150                 op_err = sctp_generate_cause(SCTP_CAUSE_OUT_OF_RESC, "");
2151                 sctp_abort_association(inp, (struct sctp_tcb *)NULL, m, iphlen,
2152                     src, dst, sh, op_err,
2153                     mflowtype, mflowid,
2154                     vrf_id, port);
2155 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2156                 SCTP_TCB_UNLOCK(stcb);
2157                 SCTP_SOCKET_LOCK(so, 1);
2158                 SCTP_TCB_LOCK(stcb);
2159 #endif
2160                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
2161                     SCTP_FROM_SCTP_INPUT + SCTP_LOC_18);
2162 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2163                 SCTP_SOCKET_UNLOCK(so, 1);
2164 #endif
2165                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
2166                 return (NULL);
2167         }
2168         /* process the INIT-ACK info (my info) */
2169         asoc->my_vtag = ntohl(initack_cp->init.initiate_tag);
2170         asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd);
2171         asoc->pre_open_streams = ntohs(initack_cp->init.num_outbound_streams);
2172         asoc->init_seq_number = ntohl(initack_cp->init.initial_tsn);
2173         asoc->sending_seq = asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number;
2174         asoc->asconf_seq_out_acked = asoc->asconf_seq_out - 1;
2175         asoc->asconf_seq_in = asoc->last_acked_seq = asoc->init_seq_number - 1;
2176         asoc->str_reset_seq_in = asoc->init_seq_number;
2177
2178         asoc->advanced_peer_ack_point = asoc->last_acked_seq;
2179
2180         /* process the INIT info (peer's info) */
2181         if (netp)
2182                 retval = sctp_process_init(init_cp, stcb);
2183         else
2184                 retval = 0;
2185         if (retval < 0) {
2186                 atomic_add_int(&stcb->asoc.refcnt, 1);
2187 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2188                 SCTP_TCB_UNLOCK(stcb);
2189                 SCTP_SOCKET_LOCK(so, 1);
2190                 SCTP_TCB_LOCK(stcb);
2191 #endif
2192                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
2193                     SCTP_FROM_SCTP_INPUT + SCTP_LOC_19);
2194 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2195                 SCTP_SOCKET_UNLOCK(so, 1);
2196 #endif
2197                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
2198                 return (NULL);
2199         }
2200         /* load all addresses */
2201         if (sctp_load_addresses_from_init(stcb, m,
2202             init_offset + sizeof(struct sctp_init_chunk), initack_offset,
2203             src, dst, init_src, port)) {
2204                 atomic_add_int(&stcb->asoc.refcnt, 1);
2205 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2206                 SCTP_TCB_UNLOCK(stcb);
2207                 SCTP_SOCKET_LOCK(so, 1);
2208                 SCTP_TCB_LOCK(stcb);
2209 #endif
2210                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
2211                     SCTP_FROM_SCTP_INPUT + SCTP_LOC_20);
2212 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2213                 SCTP_SOCKET_UNLOCK(so, 1);
2214 #endif
2215                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
2216                 return (NULL);
2217         }
2218         /*
2219          * verify any preceding AUTH chunk that was skipped
2220          */
2221         /* pull the local authentication parameters from the cookie/init-ack */
2222         sctp_auth_get_cookie_params(stcb, m,
2223             initack_offset + sizeof(struct sctp_init_ack_chunk),
2224             initack_limit - (initack_offset + sizeof(struct sctp_init_ack_chunk)));
2225         if (auth_skipped) {
2226                 struct sctp_auth_chunk *auth;
2227
2228                 auth = (struct sctp_auth_chunk *)
2229                     sctp_m_getptr(m, auth_offset, auth_len, auth_chunk_buf);
2230                 if ((auth == NULL) || sctp_handle_auth(stcb, auth, m, auth_offset)) {
2231                         /* auth HMAC failed, dump the assoc and packet */
2232                         SCTPDBG(SCTP_DEBUG_AUTH1,
2233                             "COOKIE-ECHO: AUTH failed\n");
2234                         atomic_add_int(&stcb->asoc.refcnt, 1);
2235 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2236                         SCTP_TCB_UNLOCK(stcb);
2237                         SCTP_SOCKET_LOCK(so, 1);
2238                         SCTP_TCB_LOCK(stcb);
2239 #endif
2240                         (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
2241                             SCTP_FROM_SCTP_INPUT + SCTP_LOC_21);
2242 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2243                         SCTP_SOCKET_UNLOCK(so, 1);
2244 #endif
2245                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
2246                         return (NULL);
2247                 } else {
2248                         /* remaining chunks checked... good to go */
2249                         stcb->asoc.authenticated = 1;
2250                 }
2251         }
2252         /* update current state */
2253         SCTPDBG(SCTP_DEBUG_INPUT2, "moving to OPEN state\n");
2254         SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);
2255         if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
2256                 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
2257                     stcb->sctp_ep, stcb, asoc->primary_destination);
2258         }
2259         sctp_stop_all_cookie_timers(stcb);
2260         SCTP_STAT_INCR_COUNTER32(sctps_passiveestab);
2261         SCTP_STAT_INCR_GAUGE32(sctps_currestab);
2262
2263         /*
2264          * if we're doing ASCONFs, check to see if we have any new local
2265          * addresses that need to get added to the peer (eg. addresses
2266          * changed while cookie echo in flight).  This needs to be done
2267          * after we go to the OPEN state to do the correct asconf
2268          * processing. else, make sure we have the correct addresses in our
2269          * lists
2270          */
2271
2272         /* warning, we re-use sin, sin6, sa_store here! */
2273         /* pull in local_address (our "from" address) */
2274         switch (cookie->laddr_type) {
2275 #ifdef INET
2276         case SCTP_IPV4_ADDRESS:
2277                 /* source addr is IPv4 */
2278                 memset(&store.sin, 0, sizeof(struct sockaddr_in));
2279                 store.sin.sin_family = AF_INET;
2280                 store.sin.sin_len = sizeof(struct sockaddr_in);
2281                 store.sin.sin_addr.s_addr = cookie->laddress[0];
2282                 break;
2283 #endif
2284 #ifdef INET6
2285         case SCTP_IPV6_ADDRESS:
2286                 /* source addr is IPv6 */
2287                 memset(&store.sin6, 0, sizeof(struct sockaddr_in6));
2288                 store.sin6.sin6_family = AF_INET6;
2289                 store.sin6.sin6_len = sizeof(struct sockaddr_in6);
2290                 store.sin6.sin6_scope_id = cookie->scope_id;
2291                 memcpy(&store.sin6.sin6_addr, cookie->laddress, sizeof(struct in6_addr));
2292                 break;
2293 #endif
2294         default:
2295                 atomic_add_int(&stcb->asoc.refcnt, 1);
2296 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2297                 SCTP_TCB_UNLOCK(stcb);
2298                 SCTP_SOCKET_LOCK(so, 1);
2299                 SCTP_TCB_LOCK(stcb);
2300 #endif
2301                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
2302                     SCTP_FROM_SCTP_INPUT + SCTP_LOC_22);
2303 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2304                 SCTP_SOCKET_UNLOCK(so, 1);
2305 #endif
2306                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
2307                 return (NULL);
2308         }
2309
2310         /* set up to notify upper layer */
2311         *notification = SCTP_NOTIFY_ASSOC_UP;
2312         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
2313             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
2314             (inp->sctp_socket->so_qlimit == 0)) {
2315                 /*
2316                  * This is an endpoint that called connect() how it got a
2317                  * cookie that is NEW is a bit of a mystery. It must be that
2318                  * the INIT was sent, but before it got there.. a complete
2319                  * INIT/INIT-ACK/COOKIE arrived. But of course then it
2320                  * should have went to the other code.. not here.. oh well..
2321                  * a bit of protection is worth having..
2322                  */
2323                 stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_CONNECTED;
2324 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2325                 atomic_add_int(&stcb->asoc.refcnt, 1);
2326                 SCTP_TCB_UNLOCK(stcb);
2327                 SCTP_SOCKET_LOCK(so, 1);
2328                 SCTP_TCB_LOCK(stcb);
2329                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
2330                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
2331                         SCTP_SOCKET_UNLOCK(so, 1);
2332                         return (NULL);
2333                 }
2334 #endif
2335                 soisconnected(stcb->sctp_socket);
2336 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2337                 SCTP_SOCKET_UNLOCK(so, 1);
2338 #endif
2339         } else if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
2340             (inp->sctp_socket->so_qlimit)) {
2341                 /*
2342                  * We don't want to do anything with this one. Since it is
2343                  * the listening guy. The timer will get started for
2344                  * accepted connections in the caller.
2345                  */
2346                 ;
2347         }
2348         /* since we did not send a HB make sure we don't double things */
2349         if ((netp) && (*netp))
2350                 (*netp)->hb_responded = 1;
2351
2352         if (stcb->asoc.sctp_autoclose_ticks &&
2353             sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE)) {
2354                 sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb, NULL);
2355         }
2356         (void)SCTP_GETTIME_TIMEVAL(&stcb->asoc.time_entered);
2357         if ((netp != NULL) && (*netp != NULL)) {
2358                 /* calculate the RTT and set the encaps port */
2359                 (*netp)->RTO = sctp_calculate_rto(stcb, asoc, *netp,
2360                     &cookie->time_entered, sctp_align_unsafe_makecopy,
2361                     SCTP_RTT_FROM_NON_DATA);
2362         }
2363         /* respond with a COOKIE-ACK */
2364         sctp_send_cookie_ack(stcb);
2365
2366         /*
2367          * check the address lists for any ASCONFs that need to be sent
2368          * AFTER the cookie-ack is sent
2369          */
2370         sctp_check_address_list(stcb, m,
2371             initack_offset + sizeof(struct sctp_init_ack_chunk),
2372             initack_limit - (initack_offset + sizeof(struct sctp_init_ack_chunk)),
2373             &store.sa, cookie->local_scope, cookie->site_scope,
2374             cookie->ipv4_scope, cookie->loopback_scope);
2375
2376
2377         return (stcb);
2378 }
2379
2380 /*
2381  * CODE LIKE THIS NEEDS TO RUN IF the peer supports the NAT extension, i.e
2382  * we NEED to make sure we are not already using the vtag. If so we
2383  * need to send back an ABORT-TRY-AGAIN-WITH-NEW-TAG No middle box bit!
2384         head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(tag,
2385                                                             SCTP_BASE_INFO(hashasocmark))];
2386         LIST_FOREACH(stcb, head, sctp_asocs) {
2387                 if ((stcb->asoc.my_vtag == tag) && (stcb->rport == rport) && (inp == stcb->sctp_ep))  {
2388                        -- SEND ABORT - TRY AGAIN --
2389                 }
2390         }
2391 */
2392
2393 /*
2394  * handles a COOKIE-ECHO message stcb: modified to either a new or left as
2395  * existing (non-NULL) TCB
2396  */
2397 static struct mbuf *
2398 sctp_handle_cookie_echo(struct mbuf *m, int iphlen, int offset,
2399     struct sockaddr *src, struct sockaddr *dst,
2400     struct sctphdr *sh, struct sctp_cookie_echo_chunk *cp,
2401     struct sctp_inpcb **inp_p, struct sctp_tcb **stcb, struct sctp_nets **netp,
2402     int auth_skipped, uint32_t auth_offset, uint32_t auth_len,
2403     struct sctp_tcb **locked_tcb,
2404     uint8_t mflowtype, uint32_t mflowid,
2405     uint32_t vrf_id, uint16_t port)
2406 {
2407         struct sctp_state_cookie *cookie;
2408         struct sctp_tcb *l_stcb = *stcb;
2409         struct sctp_inpcb *l_inp;
2410         struct sockaddr *to;
2411         struct sctp_pcb *ep;
2412         struct mbuf *m_sig;
2413         uint8_t calc_sig[SCTP_SIGNATURE_SIZE], tmp_sig[SCTP_SIGNATURE_SIZE];
2414         uint8_t *sig;
2415         uint8_t cookie_ok = 0;
2416         unsigned int sig_offset, cookie_offset;
2417         unsigned int cookie_len;
2418         struct timeval now;
2419         struct timeval time_expires;
2420         int notification = 0;
2421         struct sctp_nets *netl;
2422         int had_a_existing_tcb = 0;
2423         int send_int_conf = 0;
2424 #ifdef INET
2425         struct sockaddr_in sin;
2426 #endif
2427 #ifdef INET6
2428         struct sockaddr_in6 sin6;
2429 #endif
2430
2431         SCTPDBG(SCTP_DEBUG_INPUT2,
2432             "sctp_handle_cookie: handling COOKIE-ECHO\n");
2433
2434         if (inp_p == NULL) {
2435                 return (NULL);
2436         }
2437         cookie = &cp->cookie;
2438         cookie_offset = offset + sizeof(struct sctp_chunkhdr);
2439         cookie_len = ntohs(cp->ch.chunk_length);
2440
2441         if ((cookie->peerport != sh->src_port) ||
2442             (cookie->myport != sh->dest_port) ||
2443             (cookie->my_vtag != sh->v_tag)) {
2444                 /*
2445                  * invalid ports or bad tag.  Note that we always leave the
2446                  * v_tag in the header in network order and when we stored
2447                  * it in the my_vtag slot we also left it in network order.
2448                  * This maintains the match even though it may be in the
2449                  * opposite byte order of the machine :->
2450                  */
2451                 return (NULL);
2452         }
2453         if (cookie_len < sizeof(struct sctp_cookie_echo_chunk) +
2454             sizeof(struct sctp_init_chunk) +
2455             sizeof(struct sctp_init_ack_chunk) + SCTP_SIGNATURE_SIZE) {
2456                 /* cookie too small */
2457                 return (NULL);
2458         }
2459         /*
2460          * split off the signature into its own mbuf (since it should not be
2461          * calculated in the sctp_hmac_m() call).
2462          */
2463         sig_offset = offset + cookie_len - SCTP_SIGNATURE_SIZE;
2464         m_sig = m_split(m, sig_offset, M_NOWAIT);
2465         if (m_sig == NULL) {
2466                 /* out of memory or ?? */
2467                 return (NULL);
2468         }
2469 #ifdef SCTP_MBUF_LOGGING
2470         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
2471                 sctp_log_mbc(m_sig, SCTP_MBUF_SPLIT);
2472         }
2473 #endif
2474
2475         /*
2476          * compute the signature/digest for the cookie
2477          */
2478         ep = &(*inp_p)->sctp_ep;
2479         l_inp = *inp_p;
2480         if (l_stcb) {
2481                 SCTP_TCB_UNLOCK(l_stcb);
2482         }
2483         SCTP_INP_RLOCK(l_inp);
2484         if (l_stcb) {
2485                 SCTP_TCB_LOCK(l_stcb);
2486         }
2487         /* which cookie is it? */
2488         if ((cookie->time_entered.tv_sec < (long)ep->time_of_secret_change) &&
2489             (ep->current_secret_number != ep->last_secret_number)) {
2490                 /* it's the old cookie */
2491                 (void)sctp_hmac_m(SCTP_HMAC,
2492                     (uint8_t *) ep->secret_key[(int)ep->last_secret_number],
2493                     SCTP_SECRET_SIZE, m, cookie_offset, calc_sig, 0);
2494         } else {
2495                 /* it's the current cookie */
2496                 (void)sctp_hmac_m(SCTP_HMAC,
2497                     (uint8_t *) ep->secret_key[(int)ep->current_secret_number],
2498                     SCTP_SECRET_SIZE, m, cookie_offset, calc_sig, 0);
2499         }
2500         /* get the signature */
2501         SCTP_INP_RUNLOCK(l_inp);
2502         sig = (uint8_t *) sctp_m_getptr(m_sig, 0, SCTP_SIGNATURE_SIZE, (uint8_t *) & tmp_sig);
2503         if (sig == NULL) {
2504                 /* couldn't find signature */
2505                 sctp_m_freem(m_sig);
2506                 return (NULL);
2507         }
2508         /* compare the received digest with the computed digest */
2509         if (memcmp(calc_sig, sig, SCTP_SIGNATURE_SIZE) != 0) {
2510                 /* try the old cookie? */
2511                 if ((cookie->time_entered.tv_sec == (long)ep->time_of_secret_change) &&
2512                     (ep->current_secret_number != ep->last_secret_number)) {
2513                         /* compute digest with old */
2514                         (void)sctp_hmac_m(SCTP_HMAC,
2515                             (uint8_t *) ep->secret_key[(int)ep->last_secret_number],
2516                             SCTP_SECRET_SIZE, m, cookie_offset, calc_sig, 0);
2517                         /* compare */
2518                         if (memcmp(calc_sig, sig, SCTP_SIGNATURE_SIZE) == 0)
2519                                 cookie_ok = 1;
2520                 }
2521         } else {
2522                 cookie_ok = 1;
2523         }
2524
2525         /*
2526          * Now before we continue we must reconstruct our mbuf so that
2527          * normal processing of any other chunks will work.
2528          */
2529         {
2530                 struct mbuf *m_at;
2531
2532                 m_at = m;
2533                 while (SCTP_BUF_NEXT(m_at) != NULL) {
2534                         m_at = SCTP_BUF_NEXT(m_at);
2535                 }
2536                 SCTP_BUF_NEXT(m_at) = m_sig;
2537         }
2538
2539         if (cookie_ok == 0) {
2540                 SCTPDBG(SCTP_DEBUG_INPUT2, "handle_cookie_echo: cookie signature validation failed!\n");
2541                 SCTPDBG(SCTP_DEBUG_INPUT2,
2542                     "offset = %u, cookie_offset = %u, sig_offset = %u\n",
2543                     (uint32_t) offset, cookie_offset, sig_offset);
2544                 return (NULL);
2545         }
2546         /*
2547          * check the cookie timestamps to be sure it's not stale
2548          */
2549         (void)SCTP_GETTIME_TIMEVAL(&now);
2550         /* Expire time is in Ticks, so we convert to seconds */
2551         time_expires.tv_sec = cookie->time_entered.tv_sec + TICKS_TO_SEC(cookie->cookie_life);
2552         time_expires.tv_usec = cookie->time_entered.tv_usec;
2553         /*
2554          * TODO sctp_constants.h needs alternative time macros when _KERNEL
2555          * is undefined.
2556          */
2557         if (timevalcmp(&now, &time_expires, >)) {
2558                 /* cookie is stale! */
2559                 struct mbuf *op_err;
2560                 struct sctp_error_stale_cookie *cause;
2561                 uint32_t tim;
2562
2563                 op_err = sctp_get_mbuf_for_msg(sizeof(struct sctp_error_stale_cookie),
2564                     0, M_NOWAIT, 1, MT_DATA);
2565                 if (op_err == NULL) {
2566                         /* FOOBAR */
2567                         return (NULL);
2568                 }
2569                 /* Set the len */
2570                 SCTP_BUF_LEN(op_err) = sizeof(struct sctp_error_stale_cookie);
2571                 cause = mtod(op_err, struct sctp_error_stale_cookie *);
2572                 cause->cause.code = htons(SCTP_CAUSE_STALE_COOKIE);
2573                 cause->cause.length = htons((sizeof(struct sctp_paramhdr) +
2574                     (sizeof(uint32_t))));
2575                 /* seconds to usec */
2576                 tim = (now.tv_sec - time_expires.tv_sec) * 1000000;
2577                 /* add in usec */
2578                 if (tim == 0)
2579                         tim = now.tv_usec - cookie->time_entered.tv_usec;
2580                 cause->stale_time = htonl(tim);
2581                 sctp_send_operr_to(src, dst, sh, cookie->peers_vtag, op_err,
2582                     mflowtype, mflowid, l_inp->fibnum,
2583                     vrf_id, port);
2584                 return (NULL);
2585         }
2586         /*
2587          * Now we must see with the lookup address if we have an existing
2588          * asoc. This will only happen if we were in the COOKIE-WAIT state
2589          * and a INIT collided with us and somewhere the peer sent the
2590          * cookie on another address besides the single address our assoc
2591          * had for him. In this case we will have one of the tie-tags set at
2592          * least AND the address field in the cookie can be used to look it
2593          * up.
2594          */
2595         to = NULL;
2596         switch (cookie->addr_type) {
2597 #ifdef INET6
2598         case SCTP_IPV6_ADDRESS:
2599                 memset(&sin6, 0, sizeof(sin6));
2600                 sin6.sin6_family = AF_INET6;
2601                 sin6.sin6_len = sizeof(sin6);
2602                 sin6.sin6_port = sh->src_port;
2603                 sin6.sin6_scope_id = cookie->scope_id;
2604                 memcpy(&sin6.sin6_addr.s6_addr, cookie->address,
2605                     sizeof(sin6.sin6_addr.s6_addr));
2606                 to = (struct sockaddr *)&sin6;
2607                 break;
2608 #endif
2609 #ifdef INET
2610         case SCTP_IPV4_ADDRESS:
2611                 memset(&sin, 0, sizeof(sin));
2612                 sin.sin_family = AF_INET;
2613                 sin.sin_len = sizeof(sin);
2614                 sin.sin_port = sh->src_port;
2615                 sin.sin_addr.s_addr = cookie->address[0];
2616                 to = (struct sockaddr *)&sin;
2617                 break;
2618 #endif
2619         default:
2620                 /* This should not happen */
2621                 return (NULL);
2622         }
2623         if (*stcb == NULL) {
2624                 /* Yep, lets check */
2625                 *stcb = sctp_findassociation_ep_addr(inp_p, to, netp, dst, NULL);
2626                 if (*stcb == NULL) {
2627                         /*
2628                          * We should have only got back the same inp. If we
2629                          * got back a different ep we have a problem. The
2630                          * original findep got back l_inp and now
2631                          */
2632                         if (l_inp != *inp_p) {
2633                                 SCTP_PRINTF("Bad problem find_ep got a diff inp then special_locate?\n");
2634                         }
2635                 } else {
2636                         if (*locked_tcb == NULL) {
2637                                 /*
2638                                  * In this case we found the assoc only
2639                                  * after we locked the create lock. This
2640                                  * means we are in a colliding case and we
2641                                  * must make sure that we unlock the tcb if
2642                                  * its one of the cases where we throw away
2643                                  * the incoming packets.
2644                                  */
2645                                 *locked_tcb = *stcb;
2646
2647                                 /*
2648                                  * We must also increment the inp ref count
2649                                  * since the ref_count flags was set when we
2650                                  * did not find the TCB, now we found it
2651                                  * which reduces the refcount.. we must
2652                                  * raise it back out to balance it all :-)
2653                                  */
2654                                 SCTP_INP_INCR_REF((*stcb)->sctp_ep);
2655                                 if ((*stcb)->sctp_ep != l_inp) {
2656                                         SCTP_PRINTF("Huh? ep:%p diff then l_inp:%p?\n",
2657                                             (void *)(*stcb)->sctp_ep, (void *)l_inp);
2658                                 }
2659                         }
2660                 }
2661         }
2662         cookie_len -= SCTP_SIGNATURE_SIZE;
2663         if (*stcb == NULL) {
2664                 /* this is the "normal" case... get a new TCB */
2665                 *stcb = sctp_process_cookie_new(m, iphlen, offset, src, dst, sh,
2666                     cookie, cookie_len, *inp_p,
2667                     netp, to, &notification,
2668                     auth_skipped, auth_offset, auth_len,
2669                     mflowtype, mflowid,
2670                     vrf_id, port);
2671         } else {
2672                 /* this is abnormal... cookie-echo on existing TCB */
2673                 had_a_existing_tcb = 1;
2674                 *stcb = sctp_process_cookie_existing(m, iphlen, offset,
2675                     src, dst, sh,
2676                     cookie, cookie_len, *inp_p, *stcb, netp, to,
2677                     &notification, auth_skipped, auth_offset, auth_len,
2678                     mflowtype, mflowid,
2679                     vrf_id, port);
2680         }
2681
2682         if (*stcb == NULL) {
2683                 /* still no TCB... must be bad cookie-echo */
2684                 return (NULL);
2685         }
2686         if (*netp != NULL) {
2687                 (*netp)->flowtype = mflowtype;
2688                 (*netp)->flowid = mflowid;
2689         }
2690         /*
2691          * Ok, we built an association so confirm the address we sent the
2692          * INIT-ACK to.
2693          */
2694         netl = sctp_findnet(*stcb, to);
2695         /*
2696          * This code should in theory NOT run but
2697          */
2698         if (netl == NULL) {
2699                 /* TSNH! Huh, why do I need to add this address here? */
2700                 if (sctp_add_remote_addr(*stcb, to, NULL, port,
2701                     SCTP_DONOT_SETSCOPE, SCTP_IN_COOKIE_PROC)) {
2702                         return (NULL);
2703                 }
2704                 netl = sctp_findnet(*stcb, to);
2705         }
2706         if (netl) {
2707                 if (netl->dest_state & SCTP_ADDR_UNCONFIRMED) {
2708                         netl->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
2709                         (void)sctp_set_primary_addr((*stcb), (struct sockaddr *)NULL,
2710                             netl);
2711                         send_int_conf = 1;
2712                 }
2713         }
2714         sctp_start_net_timers(*stcb);
2715         if ((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) {
2716                 if (!had_a_existing_tcb ||
2717                     (((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0)) {
2718                         /*
2719                          * If we have a NEW cookie or the connect never
2720                          * reached the connected state during collision we
2721                          * must do the TCP accept thing.
2722                          */
2723                         struct socket *so, *oso;
2724                         struct sctp_inpcb *inp;
2725
2726                         if (notification == SCTP_NOTIFY_ASSOC_RESTART) {
2727                                 /*
2728                                  * For a restart we will keep the same
2729                                  * socket, no need to do anything. I THINK!!
2730                                  */
2731                                 sctp_ulp_notify(notification, *stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
2732                                 if (send_int_conf) {
2733                                         sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
2734                                             (*stcb), 0, (void *)netl, SCTP_SO_NOT_LOCKED);
2735                                 }
2736                                 return (m);
2737                         }
2738                         oso = (*inp_p)->sctp_socket;
2739                         atomic_add_int(&(*stcb)->asoc.refcnt, 1);
2740                         SCTP_TCB_UNLOCK((*stcb));
2741                         CURVNET_SET(oso->so_vnet);
2742                         so = sonewconn(oso, 0
2743                             );
2744                         CURVNET_RESTORE();
2745                         SCTP_TCB_LOCK((*stcb));
2746                         atomic_subtract_int(&(*stcb)->asoc.refcnt, 1);
2747
2748                         if (so == NULL) {
2749                                 struct mbuf *op_err;
2750 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2751                                 struct socket *pcb_so;
2752 #endif
2753                                 /* Too many sockets */
2754                                 SCTPDBG(SCTP_DEBUG_INPUT1, "process_cookie_new: no room for another socket!\n");
2755                                 op_err = sctp_generate_cause(SCTP_CAUSE_OUT_OF_RESC, "");
2756                                 sctp_abort_association(*inp_p, NULL, m, iphlen,
2757                                     src, dst, sh, op_err,
2758                                     mflowtype, mflowid,
2759                                     vrf_id, port);
2760 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2761                                 pcb_so = SCTP_INP_SO(*inp_p);
2762                                 atomic_add_int(&(*stcb)->asoc.refcnt, 1);
2763                                 SCTP_TCB_UNLOCK((*stcb));
2764                                 SCTP_SOCKET_LOCK(pcb_so, 1);
2765                                 SCTP_TCB_LOCK((*stcb));
2766                                 atomic_subtract_int(&(*stcb)->asoc.refcnt, 1);
2767 #endif
2768                                 (void)sctp_free_assoc(*inp_p, *stcb, SCTP_NORMAL_PROC,
2769                                     SCTP_FROM_SCTP_INPUT + SCTP_LOC_23);
2770 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2771                                 SCTP_SOCKET_UNLOCK(pcb_so, 1);
2772 #endif
2773                                 return (NULL);
2774                         }
2775                         inp = (struct sctp_inpcb *)so->so_pcb;
2776                         SCTP_INP_INCR_REF(inp);
2777                         /*
2778                          * We add the unbound flag here so that if we get an
2779                          * soabort() before we get the move_pcb done, we
2780                          * will properly cleanup.
2781                          */
2782                         inp->sctp_flags = (SCTP_PCB_FLAGS_TCPTYPE |
2783                             SCTP_PCB_FLAGS_CONNECTED |
2784                             SCTP_PCB_FLAGS_IN_TCPPOOL |
2785                             SCTP_PCB_FLAGS_UNBOUND |
2786                             (SCTP_PCB_COPY_FLAGS & (*inp_p)->sctp_flags) |
2787                             SCTP_PCB_FLAGS_DONT_WAKE);
2788                         inp->sctp_features = (*inp_p)->sctp_features;
2789                         inp->sctp_mobility_features = (*inp_p)->sctp_mobility_features;
2790                         inp->sctp_socket = so;
2791                         inp->sctp_frag_point = (*inp_p)->sctp_frag_point;
2792                         inp->max_cwnd = (*inp_p)->max_cwnd;
2793                         inp->sctp_cmt_on_off = (*inp_p)->sctp_cmt_on_off;
2794                         inp->ecn_supported = (*inp_p)->ecn_supported;
2795                         inp->prsctp_supported = (*inp_p)->prsctp_supported;
2796                         inp->auth_supported = (*inp_p)->auth_supported;
2797                         inp->asconf_supported = (*inp_p)->asconf_supported;
2798                         inp->reconfig_supported = (*inp_p)->reconfig_supported;
2799                         inp->nrsack_supported = (*inp_p)->nrsack_supported;
2800                         inp->pktdrop_supported = (*inp_p)->pktdrop_supported;
2801                         inp->partial_delivery_point = (*inp_p)->partial_delivery_point;
2802                         inp->sctp_context = (*inp_p)->sctp_context;
2803                         inp->local_strreset_support = (*inp_p)->local_strreset_support;
2804                         inp->fibnum = (*inp_p)->fibnum;
2805                         inp->inp_starting_point_for_iterator = NULL;
2806                         /*
2807                          * copy in the authentication parameters from the
2808                          * original endpoint
2809                          */
2810                         if (inp->sctp_ep.local_hmacs)
2811                                 sctp_free_hmaclist(inp->sctp_ep.local_hmacs);
2812                         inp->sctp_ep.local_hmacs =
2813                             sctp_copy_hmaclist((*inp_p)->sctp_ep.local_hmacs);
2814                         if (inp->sctp_ep.local_auth_chunks)
2815                                 sctp_free_chunklist(inp->sctp_ep.local_auth_chunks);
2816                         inp->sctp_ep.local_auth_chunks =
2817                             sctp_copy_chunklist((*inp_p)->sctp_ep.local_auth_chunks);
2818
2819                         /*
2820                          * Now we must move it from one hash table to
2821                          * another and get the tcb in the right place.
2822                          */
2823
2824                         /*
2825                          * This is where the one-2-one socket is put into
2826                          * the accept state waiting for the accept!
2827                          */
2828                         if (*stcb) {
2829                                 (*stcb)->asoc.state |= SCTP_STATE_IN_ACCEPT_QUEUE;
2830                         }
2831                         sctp_move_pcb_and_assoc(*inp_p, inp, *stcb);
2832
2833                         atomic_add_int(&(*stcb)->asoc.refcnt, 1);
2834                         SCTP_TCB_UNLOCK((*stcb));
2835
2836                         sctp_pull_off_control_to_new_inp((*inp_p), inp, *stcb,
2837                             0);
2838                         SCTP_TCB_LOCK((*stcb));
2839                         atomic_subtract_int(&(*stcb)->asoc.refcnt, 1);
2840
2841
2842                         /*
2843                          * now we must check to see if we were aborted while
2844                          * the move was going on and the lock/unlock
2845                          * happened.
2846                          */
2847                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
2848                                 /*
2849                                  * yep it was, we leave the assoc attached
2850                                  * to the socket since the sctp_inpcb_free()
2851                                  * call will send an abort for us.
2852                                  */
2853                                 SCTP_INP_DECR_REF(inp);
2854                                 return (NULL);
2855                         }
2856                         SCTP_INP_DECR_REF(inp);
2857                         /* Switch over to the new guy */
2858                         *inp_p = inp;
2859                         sctp_ulp_notify(notification, *stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
2860                         if (send_int_conf) {
2861                                 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
2862                                     (*stcb), 0, (void *)netl, SCTP_SO_NOT_LOCKED);
2863                         }
2864                         /* Pull it from the incomplete queue and wake the
2865                          * guy */
2866 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2867                         atomic_add_int(&(*stcb)->asoc.refcnt, 1);
2868                         SCTP_TCB_UNLOCK((*stcb));
2869                         SCTP_SOCKET_LOCK(so, 1);
2870 #endif
2871                         soisconnected(so);
2872 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2873                         SCTP_TCB_LOCK((*stcb));
2874                         atomic_subtract_int(&(*stcb)->asoc.refcnt, 1);
2875                         SCTP_SOCKET_UNLOCK(so, 1);
2876 #endif
2877                         return (m);
2878                 }
2879         }
2880         if (notification) {
2881                 sctp_ulp_notify(notification, *stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
2882         }
2883         if (send_int_conf) {
2884                 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
2885                     (*stcb), 0, (void *)netl, SCTP_SO_NOT_LOCKED);
2886         }
2887         return (m);
2888 }
2889
2890 static void
2891 sctp_handle_cookie_ack(struct sctp_cookie_ack_chunk *cp SCTP_UNUSED,
2892     struct sctp_tcb *stcb, struct sctp_nets *net)
2893 {
2894         /* cp must not be used, others call this without a c-ack :-) */
2895         struct sctp_association *asoc;
2896
2897         SCTPDBG(SCTP_DEBUG_INPUT2,
2898             "sctp_handle_cookie_ack: handling COOKIE-ACK\n");
2899         if ((stcb == NULL) || (net == NULL)) {
2900                 return;
2901         }
2902         asoc = &stcb->asoc;
2903
2904         sctp_stop_all_cookie_timers(stcb);
2905         /* process according to association state */
2906         if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) {
2907                 /* state change only needed when I am in right state */
2908                 SCTPDBG(SCTP_DEBUG_INPUT2, "moving to OPEN state\n");
2909                 SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);
2910                 sctp_start_net_timers(stcb);
2911                 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
2912                         sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
2913                             stcb->sctp_ep, stcb, asoc->primary_destination);
2914
2915                 }
2916                 /* update RTO */
2917                 SCTP_STAT_INCR_COUNTER32(sctps_activeestab);
2918                 SCTP_STAT_INCR_GAUGE32(sctps_currestab);
2919                 if (asoc->overall_error_count == 0) {
2920                         net->RTO = sctp_calculate_rto(stcb, asoc, net,
2921                             &asoc->time_entered, sctp_align_safe_nocopy,
2922                             SCTP_RTT_FROM_NON_DATA);
2923                 }
2924                 (void)SCTP_GETTIME_TIMEVAL(&asoc->time_entered);
2925                 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_UP, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
2926                 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
2927                     (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
2928 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2929                         struct socket *so;
2930
2931 #endif
2932                         stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_CONNECTED;
2933 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2934                         so = SCTP_INP_SO(stcb->sctp_ep);
2935                         atomic_add_int(&stcb->asoc.refcnt, 1);
2936                         SCTP_TCB_UNLOCK(stcb);
2937                         SCTP_SOCKET_LOCK(so, 1);
2938                         SCTP_TCB_LOCK(stcb);
2939                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
2940 #endif
2941                         if ((stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) == 0) {
2942                                 soisconnected(stcb->sctp_socket);
2943                         }
2944 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2945                         SCTP_SOCKET_UNLOCK(so, 1);
2946 #endif
2947                 }
2948                 /*
2949                  * since we did not send a HB make sure we don't double
2950                  * things
2951                  */
2952                 net->hb_responded = 1;
2953
2954                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
2955                         /*
2956                          * We don't need to do the asconf thing, nor hb or
2957                          * autoclose if the socket is closed.
2958                          */
2959                         goto closed_socket;
2960                 }
2961                 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
2962                     stcb, net);
2963
2964
2965                 if (stcb->asoc.sctp_autoclose_ticks &&
2966                     sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_AUTOCLOSE)) {
2967                         sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE,
2968                             stcb->sctp_ep, stcb, NULL);
2969                 }
2970                 /*
2971                  * send ASCONF if parameters are pending and ASCONFs are
2972                  * allowed (eg. addresses changed when init/cookie echo were
2973                  * in flight)
2974                  */
2975                 if ((sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_DO_ASCONF)) &&
2976                     (stcb->asoc.asconf_supported == 1) &&
2977                     (!TAILQ_EMPTY(&stcb->asoc.asconf_queue))) {
2978 #ifdef SCTP_TIMER_BASED_ASCONF
2979                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2980                             stcb->sctp_ep, stcb,
2981                             stcb->asoc.primary_destination);
2982 #else
2983                         sctp_send_asconf(stcb, stcb->asoc.primary_destination,
2984                             SCTP_ADDR_NOT_LOCKED);
2985 #endif
2986                 }
2987         }
2988 closed_socket:
2989         /* Toss the cookie if I can */
2990         sctp_toss_old_cookies(stcb, asoc);
2991         if (!TAILQ_EMPTY(&asoc->sent_queue)) {
2992                 /* Restart the timer if we have pending data */
2993                 struct sctp_tmit_chunk *chk;
2994
2995                 chk = TAILQ_FIRST(&asoc->sent_queue);
2996                 sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, chk->whoTo);
2997         }
2998 }
2999
3000 static void
3001 sctp_handle_ecn_echo(struct sctp_ecne_chunk *cp,
3002     struct sctp_tcb *stcb)
3003 {
3004         struct sctp_nets *net;
3005         struct sctp_tmit_chunk *lchk;
3006         struct sctp_ecne_chunk bkup;
3007         uint8_t override_bit;
3008         uint32_t tsn, window_data_tsn;
3009         int len;
3010         unsigned int pkt_cnt;
3011
3012         len = ntohs(cp->ch.chunk_length);
3013         if ((len != sizeof(struct sctp_ecne_chunk)) &&
3014             (len != sizeof(struct old_sctp_ecne_chunk))) {
3015                 return;
3016         }
3017         if (len == sizeof(struct old_sctp_ecne_chunk)) {
3018                 /* Its the old format */
3019                 memcpy(&bkup, cp, sizeof(struct old_sctp_ecne_chunk));
3020                 bkup.num_pkts_since_cwr = htonl(1);
3021                 cp = &bkup;
3022         }
3023         SCTP_STAT_INCR(sctps_recvecne);
3024         tsn = ntohl(cp->tsn);
3025         pkt_cnt = ntohl(cp->num_pkts_since_cwr);
3026         lchk = TAILQ_LAST(&stcb->asoc.send_queue, sctpchunk_listhead);
3027         if (lchk == NULL) {
3028                 window_data_tsn = stcb->asoc.sending_seq - 1;
3029         } else {
3030                 window_data_tsn = lchk->rec.data.TSN_seq;
3031         }
3032
3033         /* Find where it was sent to if possible. */
3034         net = NULL;
3035         TAILQ_FOREACH(lchk, &stcb->asoc.sent_queue, sctp_next) {
3036                 if (lchk->rec.data.TSN_seq == tsn) {
3037                         net = lchk->whoTo;
3038                         net->ecn_prev_cwnd = lchk->rec.data.cwnd_at_send;
3039                         break;
3040                 }
3041                 if (SCTP_TSN_GT(lchk->rec.data.TSN_seq, tsn)) {
3042                         break;
3043                 }
3044         }
3045         if (net == NULL) {
3046                 /*
3047                  * What to do. A previous send of a CWR was possibly lost.
3048                  * See how old it is, we may have it marked on the actual
3049                  * net.
3050                  */
3051                 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
3052                         if (tsn == net->last_cwr_tsn) {
3053                                 /* Found him, send it off */
3054                                 break;
3055                         }
3056                 }
3057                 if (net == NULL) {
3058                         /*
3059                          * If we reach here, we need to send a special CWR
3060                          * that says hey, we did this a long time ago and
3061                          * you lost the response.
3062                          */
3063                         net = TAILQ_FIRST(&stcb->asoc.nets);
3064                         if (net == NULL) {
3065                                 /* TSNH */
3066                                 return;
3067                         }
3068                         override_bit = SCTP_CWR_REDUCE_OVERRIDE;
3069                 } else {
3070                         override_bit = 0;
3071                 }
3072         } else {
3073                 override_bit = 0;
3074         }
3075         if (SCTP_TSN_GT(tsn, net->cwr_window_tsn) &&
3076             ((override_bit & SCTP_CWR_REDUCE_OVERRIDE) == 0)) {
3077                 /* JRS - Use the congestion control given in the pluggable
3078                  * CC module */
3079                 stcb->asoc.cc_functions.sctp_cwnd_update_after_ecn_echo(stcb, net, 0, pkt_cnt);
3080                 /*
3081                  * We reduce once every RTT. So we will only lower cwnd at
3082                  * the next sending seq i.e. the window_data_tsn
3083                  */
3084                 net->cwr_window_tsn = window_data_tsn;
3085                 net->ecn_ce_pkt_cnt += pkt_cnt;
3086                 net->lost_cnt = pkt_cnt;
3087                 net->last_cwr_tsn = tsn;
3088         } else {
3089                 override_bit |= SCTP_CWR_IN_SAME_WINDOW;
3090                 if (SCTP_TSN_GT(tsn, net->last_cwr_tsn) &&
3091                     ((override_bit & SCTP_CWR_REDUCE_OVERRIDE) == 0)) {
3092                         /*
3093                          * Another loss in the same window update how many
3094                          * marks/packets lost we have had.
3095                          */
3096                         int cnt = 1;
3097
3098                         if (pkt_cnt > net->lost_cnt) {
3099                                 /* Should be the case */
3100                                 cnt = (pkt_cnt - net->lost_cnt);
3101                                 net->ecn_ce_pkt_cnt += cnt;
3102                         }
3103                         net->lost_cnt = pkt_cnt;
3104                         net->last_cwr_tsn = tsn;
3105                         /*
3106                          * Most CC functions will ignore this call, since we
3107                          * are in-window yet of the initial CE the peer saw.
3108                          */
3109                         stcb->asoc.cc_functions.sctp_cwnd_update_after_ecn_echo(stcb, net, 1, cnt);
3110                 }
3111         }
3112         /*
3113          * We always send a CWR this way if our previous one was lost our
3114          * peer will get an update, or if it is not time again to reduce we
3115          * still get the cwr to the peer. Note we set the override when we
3116          * could not find the TSN on the chunk or the destination network.
3117          */
3118         sctp_send_cwr(stcb, net, net->last_cwr_tsn, override_bit);
3119 }
3120
3121 static void
3122 sctp_handle_ecn_cwr(struct sctp_cwr_chunk *cp, struct sctp_tcb *stcb, struct sctp_nets *net)
3123 {
3124         /*
3125          * Here we get a CWR from the peer. We must look in the outqueue and
3126          * make sure that we have a covered ECNE in the control chunk part.
3127          * If so remove it.
3128          */
3129         struct sctp_tmit_chunk *chk;
3130         struct sctp_ecne_chunk *ecne;
3131         int override;
3132         uint32_t cwr_tsn;
3133
3134         cwr_tsn = ntohl(cp->tsn);
3135         override = cp->ch.chunk_flags & SCTP_CWR_REDUCE_OVERRIDE;
3136         TAILQ_FOREACH(chk, &stcb->asoc.control_send_queue, sctp_next) {
3137                 if (chk->rec.chunk_id.id != SCTP_ECN_ECHO) {
3138                         continue;
3139                 }
3140                 if ((override == 0) && (chk->whoTo != net)) {
3141                         /* Must be from the right src unless override is set */
3142                         continue;
3143                 }
3144                 ecne = mtod(chk->data, struct sctp_ecne_chunk *);
3145                 if (SCTP_TSN_GE(cwr_tsn, ntohl(ecne->tsn))) {
3146                         /* this covers this ECNE, we can remove it */
3147                         stcb->asoc.ecn_echo_cnt_onq--;
3148                         TAILQ_REMOVE(&stcb->asoc.control_send_queue, chk,
3149                             sctp_next);
3150                         sctp_m_freem(chk->data);
3151                         chk->data = NULL;
3152                         stcb->asoc.ctrl_queue_cnt--;
3153                         sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
3154                         if (override == 0) {
3155                                 break;
3156                         }
3157                 }
3158         }
3159 }
3160
3161 static void
3162 sctp_handle_shutdown_complete(struct sctp_shutdown_complete_chunk *cp SCTP_UNUSED,
3163     struct sctp_tcb *stcb, struct sctp_nets *net)
3164 {
3165         struct sctp_association *asoc;
3166 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3167         struct socket *so;
3168 #endif
3169
3170         SCTPDBG(SCTP_DEBUG_INPUT2,
3171             "sctp_handle_shutdown_complete: handling SHUTDOWN-COMPLETE\n");
3172         if (stcb == NULL)
3173                 return;
3174
3175         asoc = &stcb->asoc;
3176         /* process according to association state */
3177         if (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT) {
3178                 /* unexpected SHUTDOWN-COMPLETE... so ignore... */
3179                 SCTPDBG(SCTP_DEBUG_INPUT2,
3180                     "sctp_handle_shutdown_complete: not in SCTP_STATE_SHUTDOWN_ACK_SENT --- ignore\n");
3181                 SCTP_TCB_UNLOCK(stcb);
3182                 return;
3183         }
3184         /* notify upper layer protocol */
3185         if (stcb->sctp_socket) {
3186                 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_DOWN, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
3187         }
3188 #ifdef INVARIANTS
3189         if (!TAILQ_EMPTY(&asoc->send_queue) ||
3190             !TAILQ_EMPTY(&asoc->sent_queue) ||
3191             sctp_is_there_unsent_data(stcb, SCTP_SO_NOT_LOCKED)) {
3192                 panic("Queues are not empty when handling SHUTDOWN-COMPLETE");
3193         }
3194 #endif
3195         /* stop the timer */
3196         sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWNACK, stcb->sctp_ep, stcb, net,
3197             SCTP_FROM_SCTP_INPUT + SCTP_LOC_24);
3198         SCTP_STAT_INCR_COUNTER32(sctps_shutdown);
3199         /* free the TCB */
3200         SCTPDBG(SCTP_DEBUG_INPUT2,
3201             "sctp_handle_shutdown_complete: calls free-asoc\n");
3202 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3203         so = SCTP_INP_SO(stcb->sctp_ep);
3204         atomic_add_int(&stcb->asoc.refcnt, 1);
3205         SCTP_TCB_UNLOCK(stcb);
3206         SCTP_SOCKET_LOCK(so, 1);
3207         SCTP_TCB_LOCK(stcb);
3208         atomic_subtract_int(&stcb->asoc.refcnt, 1);
3209 #endif
3210         (void)sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC,
3211             SCTP_FROM_SCTP_INPUT + SCTP_LOC_25);
3212 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3213         SCTP_SOCKET_UNLOCK(so, 1);
3214 #endif
3215         return;
3216 }
3217
3218 static int
3219 process_chunk_drop(struct sctp_tcb *stcb, struct sctp_chunk_desc *desc,
3220     struct sctp_nets *net, uint8_t flg)
3221 {
3222         switch (desc->chunk_type) {
3223         case SCTP_DATA:
3224                 /* find the tsn to resend (possibly */
3225                 {
3226                         uint32_t tsn;
3227                         struct sctp_tmit_chunk *tp1;
3228
3229                         tsn = ntohl(desc->tsn_ifany);
3230                         TAILQ_FOREACH(tp1, &stcb->asoc.sent_queue, sctp_next) {
3231                                 if (tp1->rec.data.TSN_seq == tsn) {
3232                                         /* found it */
3233                                         break;
3234                                 }
3235                                 if (SCTP_TSN_GT(tp1->rec.data.TSN_seq, tsn)) {
3236                                         /* not found */
3237                                         tp1 = NULL;
3238                                         break;
3239                                 }
3240                         }
3241                         if (tp1 == NULL) {
3242                                 /*
3243                                  * Do it the other way , aka without paying
3244                                  * attention to queue seq order.
3245                                  */
3246                                 SCTP_STAT_INCR(sctps_pdrpdnfnd);
3247                                 TAILQ_FOREACH(tp1, &stcb->asoc.sent_queue, sctp_next) {
3248                                         if (tp1->rec.data.TSN_seq == tsn) {
3249                                                 /* found it */
3250                                                 break;
3251                                         }
3252                                 }
3253                         }
3254                         if (tp1 == NULL) {
3255                                 SCTP_STAT_INCR(sctps_pdrptsnnf);
3256                         }
3257                         if ((tp1) && (tp1->sent < SCTP_DATAGRAM_ACKED)) {
3258                                 uint8_t *ddp;
3259
3260                                 if (((flg & SCTP_BADCRC) == 0) &&
3261                                     ((flg & SCTP_FROM_MIDDLE_BOX) == 0)) {
3262                                         return (0);
3263                                 }
3264                                 if ((stcb->asoc.peers_rwnd == 0) &&
3265                                     ((flg & SCTP_FROM_MIDDLE_BOX) == 0)) {
3266                                         SCTP_STAT_INCR(sctps_pdrpdiwnp);
3267                                         return (0);
3268                                 }
3269                                 if (stcb->asoc.peers_rwnd == 0 &&
3270                                     (flg & SCTP_FROM_MIDDLE_BOX)) {
3271                                         SCTP_STAT_INCR(sctps_pdrpdizrw);
3272                                         return (0);
3273                                 }
3274                                 ddp = (uint8_t *) (mtod(tp1->data, caddr_t)+
3275                                     sizeof(struct sctp_data_chunk));
3276                                 {
3277                                         unsigned int iii;
3278
3279                                         for (iii = 0; iii < sizeof(desc->data_bytes);
3280                                             iii++) {
3281                                                 if (ddp[iii] != desc->data_bytes[iii]) {
3282                                                         SCTP_STAT_INCR(sctps_pdrpbadd);
3283                                                         return (-1);
3284                                                 }
3285                                         }
3286                                 }
3287
3288                                 if (tp1->do_rtt) {
3289                                         /*
3290                                          * this guy had a RTO calculation
3291                                          * pending on it, cancel it
3292                                          */
3293                                         if (tp1->whoTo->rto_needed == 0) {
3294                                                 tp1->whoTo->rto_needed = 1;
3295                                         }
3296                                         tp1->do_rtt = 0;
3297                                 }
3298                                 SCTP_STAT_INCR(sctps_pdrpmark);
3299                                 if (tp1->sent != SCTP_DATAGRAM_RESEND)
3300                                         sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
3301                                 /*
3302                                  * mark it as if we were doing a FR, since
3303                                  * we will be getting gap ack reports behind
3304                                  * the info from the router.
3305                                  */
3306                                 tp1->rec.data.doing_fast_retransmit = 1;
3307                                 /*
3308                                  * mark the tsn with what sequences can
3309                                  * cause a new FR.
3310                                  */
3311                                 if (TAILQ_EMPTY(&stcb->asoc.send_queue)) {
3312                                         tp1->rec.data.fast_retran_tsn = stcb->asoc.sending_seq;
3313                                 } else {
3314                                         tp1->rec.data.fast_retran_tsn = (TAILQ_FIRST(&stcb->asoc.send_queue))->rec.data.TSN_seq;
3315                                 }
3316
3317                                 /* restart the timer */
3318                                 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
3319                                     stcb, tp1->whoTo,
3320                                     SCTP_FROM_SCTP_INPUT + SCTP_LOC_26);
3321                                 sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
3322                                     stcb, tp1->whoTo);
3323
3324                                 /* fix counts and things */
3325                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) {
3326                                         sctp_misc_ints(SCTP_FLIGHT_LOG_DOWN_PDRP,
3327                                             tp1->whoTo->flight_size,
3328                                             tp1->book_size,
3329                                             (uint32_t) (uintptr_t) stcb,
3330                                             tp1->rec.data.TSN_seq);
3331                                 }
3332                                 if (tp1->sent < SCTP_DATAGRAM_RESEND) {
3333                                         sctp_flight_size_decrease(tp1);
3334                                         sctp_total_flight_decrease(stcb, tp1);
3335                                 }
3336                                 tp1->sent = SCTP_DATAGRAM_RESEND;
3337                         } {
3338                                 /* audit code */
3339                                 unsigned int audit;
3340
3341                                 audit = 0;
3342                                 TAILQ_FOREACH(tp1, &stcb->asoc.sent_queue, sctp_next) {
3343                                         if (tp1->sent == SCTP_DATAGRAM_RESEND)
3344                                                 audit++;
3345                                 }
3346                                 TAILQ_FOREACH(tp1, &stcb->asoc.control_send_queue,
3347                                     sctp_next) {
3348                                         if (tp1->sent == SCTP_DATAGRAM_RESEND)
3349                                                 audit++;
3350                                 }
3351                                 if (audit != stcb->asoc.sent_queue_retran_cnt) {
3352                                         SCTP_PRINTF("**Local Audit finds cnt:%d asoc cnt:%d\n",
3353                                             audit, stcb->asoc.sent_queue_retran_cnt);
3354 #ifndef SCTP_AUDITING_ENABLED
3355                                         stcb->asoc.sent_queue_retran_cnt = audit;
3356 #endif
3357                                 }
3358                         }
3359                 }
3360                 break;
3361         case SCTP_ASCONF:
3362                 {
3363                         struct sctp_tmit_chunk *asconf;
3364
3365                         TAILQ_FOREACH(asconf, &stcb->asoc.control_send_queue,
3366                             sctp_next) {
3367                                 if (asconf->rec.chunk_id.id == SCTP_ASCONF) {
3368                                         break;
3369                                 }
3370                         }
3371                         if (asconf) {
3372                                 if (asconf->sent != SCTP_DATAGRAM_RESEND)
3373                                         sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
3374                                 asconf->sent = SCTP_DATAGRAM_RESEND;
3375                                 asconf->snd_count--;
3376                         }
3377                 }
3378                 break;
3379         case SCTP_INITIATION:
3380                 /* resend the INIT */
3381                 stcb->asoc.dropped_special_cnt++;
3382                 if (stcb->asoc.dropped_special_cnt < SCTP_RETRY_DROPPED_THRESH) {
3383                         /*
3384                          * If we can get it in, in a few attempts we do
3385                          * this, otherwise we let the timer fire.
3386                          */
3387                         sctp_timer_stop(SCTP_TIMER_TYPE_INIT, stcb->sctp_ep,
3388                             stcb, net,
3389                             SCTP_FROM_SCTP_INPUT + SCTP_LOC_27);
3390                         sctp_send_initiate(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);
3391                 }
3392                 break;
3393         case SCTP_SELECTIVE_ACK:
3394         case SCTP_NR_SELECTIVE_ACK:
3395                 /* resend the sack */
3396                 sctp_send_sack(stcb, SCTP_SO_NOT_LOCKED);
3397                 break;
3398         case SCTP_HEARTBEAT_REQUEST:
3399                 /* resend a demand HB */
3400                 if ((stcb->asoc.overall_error_count + 3) < stcb->asoc.max_send_times) {
3401                         /* Only retransmit if we KNOW we wont destroy the
3402                          * tcb */
3403                         sctp_send_hb(stcb, net, SCTP_SO_NOT_LOCKED);
3404                 }
3405                 break;
3406         case SCTP_SHUTDOWN:
3407                 sctp_send_shutdown(stcb, net);
3408                 break;
3409         case SCTP_SHUTDOWN_ACK:
3410                 sctp_send_shutdown_ack(stcb, net);
3411                 break;
3412         case SCTP_COOKIE_ECHO:
3413                 {
3414                         struct sctp_tmit_chunk *cookie;
3415
3416                         cookie = NULL;
3417                         TAILQ_FOREACH(cookie, &stcb->asoc.control_send_queue,
3418                             sctp_next) {
3419                                 if (cookie->rec.chunk_id.id == SCTP_COOKIE_ECHO) {
3420                                         break;
3421                                 }
3422                         }
3423                         if (cookie) {
3424                                 if (cookie->sent != SCTP_DATAGRAM_RESEND)
3425                                         sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
3426                                 cookie->sent = SCTP_DATAGRAM_RESEND;
3427                                 sctp_stop_all_cookie_timers(stcb);
3428                         }
3429                 }
3430                 break;
3431         case SCTP_COOKIE_ACK:
3432                 sctp_send_cookie_ack(stcb);
3433                 break;
3434         case SCTP_ASCONF_ACK:
3435                 /* resend last asconf ack */
3436                 sctp_send_asconf_ack(stcb);
3437                 break;
3438         case SCTP_IFORWARD_CUM_TSN:
3439         case SCTP_FORWARD_CUM_TSN:
3440                 send_forward_tsn(stcb, &stcb->asoc);
3441                 break;
3442                 /* can't do anything with these */
3443         case SCTP_PACKET_DROPPED:
3444         case SCTP_INITIATION_ACK:       /* this should not happen */
3445         case SCTP_HEARTBEAT_ACK:
3446         case SCTP_ABORT_ASSOCIATION:
3447         case SCTP_OPERATION_ERROR:
3448         case SCTP_SHUTDOWN_COMPLETE:
3449         case SCTP_ECN_ECHO:
3450         case SCTP_ECN_CWR:
3451         default:
3452                 break;
3453         }
3454         return (0);
3455 }
3456
3457 void
3458 sctp_reset_in_stream(struct sctp_tcb *stcb, uint32_t number_entries, uint16_t * list)
3459 {
3460         uint32_t i;
3461         uint16_t temp;
3462
3463         /*
3464          * We set things to 0xffffffff since this is the last delivered
3465          * sequence and we will be sending in 0 after the reset.
3466          */
3467
3468         if (number_entries) {
3469                 for (i = 0; i < number_entries; i++) {
3470                         temp = ntohs(list[i]);
3471                         if (temp >= stcb->asoc.streamincnt) {
3472                                 continue;
3473                         }
3474                         stcb->asoc.strmin[temp].last_sequence_delivered = 0xffffffff;
3475                 }
3476         } else {
3477                 list = NULL;
3478                 for (i = 0; i < stcb->asoc.streamincnt; i++) {
3479                         stcb->asoc.strmin[i].last_sequence_delivered = 0xffffffff;
3480                 }
3481         }
3482         sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_RECV, stcb, number_entries, (void *)list, SCTP_SO_NOT_LOCKED);
3483 }
3484
3485 static void
3486 sctp_reset_out_streams(struct sctp_tcb *stcb, uint32_t number_entries, uint16_t * list)
3487 {
3488         uint32_t i;
3489         uint16_t temp;
3490
3491         if (number_entries > 0) {
3492                 for (i = 0; i < number_entries; i++) {
3493                         temp = ntohs(list[i]);
3494                         if (temp >= stcb->asoc.streamoutcnt) {
3495                                 /* no such stream */
3496                                 continue;
3497                         }
3498                         stcb->asoc.strmout[temp].next_mid_ordered = 0;
3499                         stcb->asoc.strmout[temp].next_mid_unordered = 0;
3500                 }
3501         } else {
3502                 for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
3503                         stcb->asoc.strmout[i].next_mid_ordered = 0;
3504                         stcb->asoc.strmout[i].next_mid_unordered = 0;
3505                 }
3506         }
3507         sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_SEND, stcb, number_entries, (void *)list, SCTP_SO_NOT_LOCKED);
3508 }
3509
3510 static void
3511 sctp_reset_clear_pending(struct sctp_tcb *stcb, uint32_t number_entries, uint16_t * list)
3512 {
3513         uint32_t i;
3514         uint16_t temp;
3515
3516         if (number_entries > 0) {
3517                 for (i = 0; i < number_entries; i++) {
3518                         temp = ntohs(list[i]);
3519                         if (temp >= stcb->asoc.streamoutcnt) {
3520                                 /* no such stream */
3521                                 continue;
3522                         }
3523                         stcb->asoc.strmout[temp].state = SCTP_STREAM_OPEN;
3524                 }
3525         } else {
3526                 for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
3527                         stcb->asoc.strmout[i].state = SCTP_STREAM_OPEN;
3528                 }
3529         }
3530 }
3531
3532
3533 struct sctp_stream_reset_request *
3534 sctp_find_stream_reset(struct sctp_tcb *stcb, uint32_t seq, struct sctp_tmit_chunk **bchk)
3535 {
3536         struct sctp_association *asoc;
3537         struct sctp_chunkhdr *ch;
3538         struct sctp_stream_reset_request *r;
3539         struct sctp_tmit_chunk *chk;
3540         int len, clen;
3541
3542         asoc = &stcb->asoc;
3543         if (TAILQ_EMPTY(&stcb->asoc.control_send_queue)) {
3544                 asoc->stream_reset_outstanding = 0;
3545                 return (NULL);
3546         }
3547         if (stcb->asoc.str_reset == NULL) {
3548                 asoc->stream_reset_outstanding = 0;
3549                 return (NULL);
3550         }
3551         chk = stcb->asoc.str_reset;
3552         if (chk->data == NULL) {
3553                 return (NULL);
3554         }
3555         if (bchk) {
3556                 /* he wants a copy of the chk pointer */
3557                 *bchk = chk;
3558         }
3559         clen = chk->send_size;
3560         ch = mtod(chk->data, struct sctp_chunkhdr *);
3561         r = (struct sctp_stream_reset_request *)(ch + 1);
3562         if (ntohl(r->request_seq) == seq) {
3563                 /* found it */
3564                 return (r);
3565         }
3566         len = SCTP_SIZE32(ntohs(r->ph.param_length));
3567         if (clen > (len + (int)sizeof(struct sctp_chunkhdr))) {
3568                 /* move to the next one, there can only be a max of two */
3569                 r = (struct sctp_stream_reset_request *)((caddr_t)r + len);
3570                 if (ntohl(r->request_seq) == seq) {
3571                         return (r);
3572                 }
3573         }
3574         /* that seq is not here */
3575         return (NULL);
3576 }
3577
3578 static void
3579 sctp_clean_up_stream_reset(struct sctp_tcb *stcb)
3580 {
3581         struct sctp_association *asoc;
3582         struct sctp_tmit_chunk *chk = stcb->asoc.str_reset;
3583
3584         if (stcb->asoc.str_reset == NULL) {
3585                 return;
3586         }
3587         asoc = &stcb->asoc;
3588
3589         sctp_timer_stop(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb,
3590             chk->whoTo, SCTP_FROM_SCTP_INPUT + SCTP_LOC_28);
3591         TAILQ_REMOVE(&asoc->control_send_queue,
3592             chk,
3593             sctp_next);
3594         if (chk->data) {
3595                 sctp_m_freem(chk->data);
3596                 chk->data = NULL;
3597         }
3598         asoc->ctrl_queue_cnt--;
3599         sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
3600         /* sa_ignore NO_NULL_CHK */
3601         stcb->asoc.str_reset = NULL;
3602 }
3603
3604
3605 static int
3606 sctp_handle_stream_reset_response(struct sctp_tcb *stcb,
3607     uint32_t seq, uint32_t action,
3608     struct sctp_stream_reset_response *respin)
3609 {
3610         uint16_t type;
3611         int lparm_len;
3612         struct sctp_association *asoc = &stcb->asoc;
3613         struct sctp_tmit_chunk *chk;
3614         struct sctp_stream_reset_request *req_param;
3615         struct sctp_stream_reset_out_request *req_out_param;
3616         struct sctp_stream_reset_in_request *req_in_param;
3617         uint32_t number_entries;
3618
3619         if (asoc->stream_reset_outstanding == 0) {
3620                 /* duplicate */
3621                 return (0);
3622         }
3623         if (seq == stcb->asoc.str_reset_seq_out) {
3624                 req_param = sctp_find_stream_reset(stcb, seq, &chk);
3625                 if (req_param != NULL) {
3626                         stcb->asoc.str_reset_seq_out++;
3627                         type = ntohs(req_param->ph.param_type);
3628                         lparm_len = ntohs(req_param->ph.param_length);
3629                         if (type == SCTP_STR_RESET_OUT_REQUEST) {
3630                                 int no_clear = 0;
3631
3632                                 req_out_param = (struct sctp_stream_reset_out_request *)req_param;
3633                                 number_entries = (lparm_len - sizeof(struct sctp_stream_reset_out_request)) / sizeof(uint16_t);
3634                                 asoc->stream_reset_out_is_outstanding = 0;
3635                                 if (asoc->stream_reset_outstanding)
3636                                         asoc->stream_reset_outstanding--;
3637                                 if (action == SCTP_STREAM_RESET_RESULT_PERFORMED) {
3638                                         /* do it */
3639                                         sctp_reset_out_streams(stcb, number_entries, req_out_param->list_of_streams);
3640                                 } else if (action == SCTP_STREAM_RESET_RESULT_DENIED) {
3641                                         sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_DENIED_OUT, stcb, number_entries, req_out_param->list_of_streams, SCTP_SO_NOT_LOCKED);
3642                                 } else if (action == SCTP_STREAM_RESET_RESULT_IN_PROGRESS) {
3643                                         /* Set it up so we don't stop
3644                                          * retransmitting */
3645                                         asoc->stream_reset_outstanding++;
3646                                         stcb->asoc.str_reset_seq_out--;
3647                                         asoc->stream_reset_out_is_outstanding = 1;
3648                                         no_clear = 1;
3649                                 } else {
3650                                         sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_FAILED_OUT, stcb, number_entries, req_out_param->list_of_streams, SCTP_SO_NOT_LOCKED);
3651                                 }
3652                                 if (no_clear == 0) {
3653                                         sctp_reset_clear_pending(stcb, number_entries, req_out_param->list_of_streams);
3654                                 }
3655                         } else if (type == SCTP_STR_RESET_IN_REQUEST) {
3656                                 req_in_param = (struct sctp_stream_reset_in_request *)req_param;
3657                                 number_entries = (lparm_len - sizeof(struct sctp_stream_reset_in_request)) / sizeof(uint16_t);
3658                                 if (asoc->stream_reset_outstanding)
3659                                         asoc->stream_reset_outstanding--;
3660                                 if (action == SCTP_STREAM_RESET_RESULT_DENIED) {
3661                                         sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_DENIED_IN, stcb,
3662                                             number_entries, req_in_param->list_of_streams, SCTP_SO_NOT_LOCKED);
3663                                 } else if (action != SCTP_STREAM_RESET_RESULT_PERFORMED) {
3664                                         sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_FAILED_IN, stcb,
3665                                             number_entries, req_in_param->list_of_streams, SCTP_SO_NOT_LOCKED);
3666                                 }
3667                         } else if (type == SCTP_STR_RESET_ADD_OUT_STREAMS) {
3668                                 /* Ok we now may have more streams */
3669                                 int num_stream;
3670
3671                                 num_stream = stcb->asoc.strm_pending_add_size;
3672                                 if (num_stream > (stcb->asoc.strm_realoutsize - stcb->asoc.streamoutcnt)) {
3673                                         /* TSNH */
3674                                         num_stream = stcb->asoc.strm_realoutsize - stcb->asoc.streamoutcnt;
3675                                 }
3676                                 stcb->asoc.strm_pending_add_size = 0;
3677                                 if (asoc->stream_reset_outstanding)
3678                                         asoc->stream_reset_outstanding--;
3679                                 if (action == SCTP_STREAM_RESET_RESULT_PERFORMED) {
3680                                         /* Put the new streams into effect */
3681                                         int i;
3682
3683                                         for (i = asoc->streamoutcnt; i < (asoc->streamoutcnt + num_stream); i++) {
3684                                                 asoc->strmout[i].state = SCTP_STREAM_OPEN;
3685                                         }
3686                                         asoc->streamoutcnt += num_stream;
3687                                         sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt, 0);
3688                                 } else if (action == SCTP_STREAM_RESET_RESULT_DENIED) {
3689                                         sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt,
3690                                             SCTP_STREAM_CHANGE_DENIED);
3691                                 } else {
3692                                         sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt,
3693                                             SCTP_STREAM_CHANGE_FAILED);
3694                                 }
3695                         } else if (type == SCTP_STR_RESET_ADD_IN_STREAMS) {
3696                                 if (asoc->stream_reset_outstanding)
3697                                         asoc->stream_reset_outstanding--;
3698                                 if (action == SCTP_STREAM_RESET_RESULT_DENIED) {
3699                                         sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt,
3700                                             SCTP_STREAM_CHANGE_DENIED);
3701                                 } else if (action != SCTP_STREAM_RESET_RESULT_PERFORMED) {
3702                                         sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt,
3703                                             SCTP_STREAM_CHANGE_FAILED);
3704                                 }
3705                         } else if (type == SCTP_STR_RESET_TSN_REQUEST) {
3706                                 /**
3707                                  * a) Adopt the new in tsn.
3708                                  * b) reset the map
3709                                  * c) Adopt the new out-tsn
3710                                  */
3711                                 struct sctp_stream_reset_response_tsn *resp;
3712                                 struct sctp_forward_tsn_chunk fwdtsn;
3713                                 int abort_flag = 0;
3714
3715                                 if (respin == NULL) {
3716                                         /* huh ? */
3717                                         return (0);
3718                                 }
3719                                 if (ntohs(respin->ph.param_length) < sizeof(struct sctp_stream_reset_response_tsn)) {
3720                                         return (0);
3721                                 }
3722                                 if (action == SCTP_STREAM_RESET_RESULT_PERFORMED) {
3723                                         resp = (struct sctp_stream_reset_response_tsn *)respin;
3724                                         asoc->stream_reset_outstanding--;
3725                                         fwdtsn.ch.chunk_length = htons(sizeof(struct sctp_forward_tsn_chunk));
3726                                         fwdtsn.ch.chunk_type = SCTP_FORWARD_CUM_TSN;
3727                                         fwdtsn.new_cumulative_tsn = htonl(ntohl(resp->senders_next_tsn) - 1);
3728                                         sctp_handle_forward_tsn(stcb, &fwdtsn, &abort_flag, NULL, 0);
3729                                         if (abort_flag) {
3730                                                 return (1);
3731                                         }
3732                                         stcb->asoc.highest_tsn_inside_map = (ntohl(resp->senders_next_tsn) - 1);
3733                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {
3734                                                 sctp_log_map(0, 7, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
3735                                         }
3736                                         stcb->asoc.tsn_last_delivered = stcb->asoc.cumulative_tsn = stcb->asoc.highest_tsn_inside_map;
3737                                         stcb->asoc.mapping_array_base_tsn = ntohl(resp->senders_next_tsn);
3738                                         memset(stcb->asoc.mapping_array, 0, stcb->asoc.mapping_array_size);
3739
3740                                         stcb->asoc.highest_tsn_inside_nr_map = stcb->asoc.highest_tsn_inside_map;
3741                                         memset(stcb->asoc.nr_mapping_array, 0, stcb->asoc.mapping_array_size);
3742
3743                                         stcb->asoc.sending_seq = ntohl(resp->receivers_next_tsn);
3744                                         stcb->asoc.last_acked_seq = stcb->asoc.cumulative_tsn;
3745
3746                                         sctp_reset_out_streams(stcb, 0, (uint16_t *) NULL);
3747                                         sctp_reset_in_stream(stcb, 0, (uint16_t *) NULL);
3748                                         sctp_notify_stream_reset_tsn(stcb, stcb->asoc.sending_seq, (stcb->asoc.mapping_array_base_tsn + 1), 0);
3749                                 } else if (action == SCTP_STREAM_RESET_RESULT_DENIED) {
3750                                         sctp_notify_stream_reset_tsn(stcb, stcb->asoc.sending_seq, (stcb->asoc.mapping_array_base_tsn + 1),
3751                                             SCTP_ASSOC_RESET_DENIED);
3752                                 } else {
3753                                         sctp_notify_stream_reset_tsn(stcb, stcb->asoc.sending_seq, (stcb->asoc.mapping_array_base_tsn + 1),
3754                                             SCTP_ASSOC_RESET_FAILED);
3755                                 }
3756                         }
3757                         /* get rid of the request and get the request flags */
3758                         if (asoc->stream_reset_outstanding == 0) {
3759                                 sctp_clean_up_stream_reset(stcb);
3760                         }
3761                 }
3762         }
3763         if (asoc->stream_reset_outstanding == 0) {
3764                 sctp_send_stream_reset_out_if_possible(stcb, SCTP_SO_NOT_LOCKED);
3765         }
3766         return (0);
3767 }
3768
3769 static void
3770 sctp_handle_str_reset_request_in(struct sctp_tcb *stcb,
3771     struct sctp_tmit_chunk *chk,
3772     struct sctp_stream_reset_in_request *req, int trunc)
3773 {
3774         uint32_t seq;
3775         int len, i;
3776         int number_entries;
3777         uint16_t temp;
3778
3779         /*
3780          * peer wants me to send a str-reset to him for my outgoing seq's if
3781          * seq_in is right.
3782          */
3783         struct sctp_association *asoc = &stcb->asoc;
3784
3785         seq = ntohl(req->request_seq);
3786         if (asoc->str_reset_seq_in == seq) {
3787                 asoc->last_reset_action[1] = asoc->last_reset_action[0];
3788                 if (!(asoc->local_strreset_support & SCTP_ENABLE_RESET_STREAM_REQ)) {
3789                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
3790                 } else if (trunc) {
3791                         /* Can't do it, since they exceeded our buffer size  */
3792                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
3793                 } else if (stcb->asoc.stream_reset_out_is_outstanding == 0) {
3794                         len = ntohs(req->ph.param_length);
3795                         number_entries = ((len - sizeof(struct sctp_stream_reset_in_request)) / sizeof(uint16_t));
3796                         if (number_entries) {
3797                                 for (i = 0; i < number_entries; i++) {
3798                                         temp = ntohs(req->list_of_streams[i]);
3799                                         if (temp >= stcb->asoc.streamoutcnt) {
3800                                                 asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
3801                                                 goto bad_boy;
3802                                         }
3803                                         req->list_of_streams[i] = temp;
3804                                 }
3805                                 for (i = 0; i < number_entries; i++) {
3806                                         if (stcb->asoc.strmout[req->list_of_streams[i]].state == SCTP_STREAM_OPEN) {
3807                                                 stcb->asoc.strmout[req->list_of_streams[i]].state = SCTP_STREAM_RESET_PENDING;
3808                                         }
3809                                 }
3810                         } else {
3811                                 /* Its all */
3812                                 for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
3813                                         if (stcb->asoc.strmout[i].state == SCTP_STREAM_OPEN)
3814                                                 stcb->asoc.strmout[i].state = SCTP_STREAM_RESET_PENDING;
3815                                 }
3816                         }
3817                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_PERFORMED;
3818                 } else {
3819                         /* Can't do it, since we have sent one out */
3820                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_ERR_IN_PROGRESS;
3821                 }
3822 bad_boy:
3823                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
3824                 asoc->str_reset_seq_in++;
3825         } else if (asoc->str_reset_seq_in - 1 == seq) {
3826                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
3827         } else if (asoc->str_reset_seq_in - 2 == seq) {
3828                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]);
3829         } else {
3830                 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_RESULT_ERR_BAD_SEQNO);
3831         }
3832         sctp_send_stream_reset_out_if_possible(stcb, SCTP_SO_NOT_LOCKED);
3833 }
3834
3835 static int
3836 sctp_handle_str_reset_request_tsn(struct sctp_tcb *stcb,
3837     struct sctp_tmit_chunk *chk,
3838     struct sctp_stream_reset_tsn_request *req)
3839 {
3840         /* reset all in and out and update the tsn */
3841         /*
3842          * A) reset my str-seq's on in and out. B) Select a receive next,
3843          * and set cum-ack to it. Also process this selected number as a
3844          * fwd-tsn as well. C) set in the response my next sending seq.
3845          */
3846         struct sctp_forward_tsn_chunk fwdtsn;
3847         struct sctp_association *asoc = &stcb->asoc;
3848         int abort_flag = 0;
3849         uint32_t seq;
3850
3851         seq = ntohl(req->request_seq);
3852         if (asoc->str_reset_seq_in == seq) {
3853                 asoc->last_reset_action[1] = stcb->asoc.last_reset_action[0];
3854                 if (!(asoc->local_strreset_support & SCTP_ENABLE_CHANGE_ASSOC_REQ)) {
3855                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
3856                 } else {
3857                         fwdtsn.ch.chunk_length = htons(sizeof(struct sctp_forward_tsn_chunk));
3858                         fwdtsn.ch.chunk_type = SCTP_FORWARD_CUM_TSN;
3859                         fwdtsn.ch.chunk_flags = 0;
3860                         fwdtsn.new_cumulative_tsn = htonl(stcb->asoc.highest_tsn_inside_map + 1);
3861                         sctp_handle_forward_tsn(stcb, &fwdtsn, &abort_flag, NULL, 0);
3862                         if (abort_flag) {
3863                                 return (1);
3864                         }
3865                         asoc->highest_tsn_inside_map += SCTP_STREAM_RESET_TSN_DELTA;
3866                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {
3867                                 sctp_log_map(0, 10, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
3868                         }
3869                         asoc->tsn_last_delivered = asoc->cumulative_tsn = asoc->highest_tsn_inside_map;
3870                         asoc->mapping_array_base_tsn = asoc->highest_tsn_inside_map + 1;
3871                         memset(asoc->mapping_array, 0, asoc->mapping_array_size);
3872                         asoc->highest_tsn_inside_nr_map = asoc->highest_tsn_inside_map;
3873                         memset(asoc->nr_mapping_array, 0, asoc->mapping_array_size);
3874                         atomic_add_int(&asoc->sending_seq, 1);
3875                         /* save off historical data for retrans */
3876                         asoc->last_sending_seq[1] = asoc->last_sending_seq[0];
3877                         asoc->last_sending_seq[0] = asoc->sending_seq;
3878                         asoc->last_base_tsnsent[1] = asoc->last_base_tsnsent[0];
3879                         asoc->last_base_tsnsent[0] = asoc->mapping_array_base_tsn;
3880                         sctp_reset_out_streams(stcb, 0, (uint16_t *) NULL);
3881                         sctp_reset_in_stream(stcb, 0, (uint16_t *) NULL);
3882                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_PERFORMED;
3883                         sctp_notify_stream_reset_tsn(stcb, asoc->sending_seq, (asoc->mapping_array_base_tsn + 1), 0);
3884                 }
3885                 sctp_add_stream_reset_result_tsn(chk, seq, asoc->last_reset_action[0],
3886                     asoc->last_sending_seq[0], asoc->last_base_tsnsent[0]);
3887                 asoc->str_reset_seq_in++;
3888         } else if (asoc->str_reset_seq_in - 1 == seq) {
3889                 sctp_add_stream_reset_result_tsn(chk, seq, asoc->last_reset_action[0],
3890                     asoc->last_sending_seq[0], asoc->last_base_tsnsent[0]);
3891         } else if (asoc->str_reset_seq_in - 2 == seq) {
3892                 sctp_add_stream_reset_result_tsn(chk, seq, asoc->last_reset_action[1],
3893                     asoc->last_sending_seq[1], asoc->last_base_tsnsent[1]);
3894         } else {
3895                 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_RESULT_ERR_BAD_SEQNO);
3896         }
3897         return (0);
3898 }
3899
3900 static void
3901 sctp_handle_str_reset_request_out(struct sctp_tcb *stcb,
3902     struct sctp_tmit_chunk *chk,
3903     struct sctp_stream_reset_out_request *req, int trunc)
3904 {
3905         uint32_t seq, tsn;
3906         int number_entries, len;
3907         struct sctp_association *asoc = &stcb->asoc;
3908
3909         seq = ntohl(req->request_seq);
3910
3911         /* now if its not a duplicate we process it */
3912         if (asoc->str_reset_seq_in == seq) {
3913                 len = ntohs(req->ph.param_length);
3914                 number_entries = ((len - sizeof(struct sctp_stream_reset_out_request)) / sizeof(uint16_t));
3915                 /*
3916                  * the sender is resetting, handle the list issue.. we must
3917                  * a) verify if we can do the reset, if so no problem b) If
3918                  * we can't do the reset we must copy the request. c) queue
3919                  * it, and setup the data in processor to trigger it off
3920                  * when needed and dequeue all the queued data.
3921                  */
3922                 tsn = ntohl(req->send_reset_at_tsn);
3923
3924                 /* move the reset action back one */
3925                 asoc->last_reset_action[1] = asoc->last_reset_action[0];
3926                 if (!(asoc->local_strreset_support & SCTP_ENABLE_RESET_STREAM_REQ)) {
3927                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
3928                 } else if (trunc) {
3929                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
3930                 } else if (SCTP_TSN_GE(asoc->cumulative_tsn, tsn)) {
3931                         /* we can do it now */
3932                         sctp_reset_in_stream(stcb, number_entries, req->list_of_streams);
3933                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_PERFORMED;
3934                 } else {
3935                         /*
3936                          * we must queue it up and thus wait for the TSN's
3937                          * to arrive that are at or before tsn
3938                          */
3939                         struct sctp_stream_reset_list *liste;
3940                         int siz;
3941
3942                         siz = sizeof(struct sctp_stream_reset_list) + (number_entries * sizeof(uint16_t));
3943                         SCTP_MALLOC(liste, struct sctp_stream_reset_list *,
3944                             siz, SCTP_M_STRESET);
3945                         if (liste == NULL) {
3946                                 /* gak out of memory */
3947                                 asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
3948                                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
3949                                 return;
3950                         }
3951                         liste->seq = seq;
3952                         liste->tsn = tsn;
3953                         liste->number_entries = number_entries;
3954                         memcpy(&liste->list_of_streams, req->list_of_streams, number_entries * sizeof(uint16_t));
3955                         TAILQ_INSERT_TAIL(&asoc->resetHead, liste, next_resp);
3956                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_IN_PROGRESS;
3957                 }
3958                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
3959                 asoc->str_reset_seq_in++;
3960         } else if ((asoc->str_reset_seq_in - 1) == seq) {
3961                 /*
3962                  * one seq back, just echo back last action since my
3963                  * response was lost.
3964                  */
3965                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
3966         } else if ((asoc->str_reset_seq_in - 2) == seq) {
3967                 /*
3968                  * two seq back, just echo back last action since my
3969                  * response was lost.
3970                  */
3971                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]);
3972         } else {
3973                 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_RESULT_ERR_BAD_SEQNO);
3974         }
3975 }
3976
3977 static void
3978 sctp_handle_str_reset_add_strm(struct sctp_tcb *stcb, struct sctp_tmit_chunk *chk,
3979     struct sctp_stream_reset_add_strm *str_add)
3980 {
3981         /*
3982          * Peer is requesting to add more streams. If its within our
3983          * max-streams we will allow it.
3984          */
3985         uint32_t num_stream, i;
3986         uint32_t seq;
3987         struct sctp_association *asoc = &stcb->asoc;
3988         struct sctp_queued_to_read *ctl, *nctl;
3989
3990         /* Get the number. */
3991         seq = ntohl(str_add->request_seq);
3992         num_stream = ntohs(str_add->number_of_streams);
3993         /* Now what would be the new total? */
3994         if (asoc->str_reset_seq_in == seq) {
3995                 num_stream += stcb->asoc.streamincnt;
3996                 stcb->asoc.last_reset_action[1] = stcb->asoc.last_reset_action[0];
3997                 if (!(asoc->local_strreset_support & SCTP_ENABLE_CHANGE_ASSOC_REQ)) {
3998                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
3999                 } else if ((num_stream > stcb->asoc.max_inbound_streams) ||
4000                     (num_stream > 0xffff)) {
4001                         /* We must reject it they ask for to many */
4002         denied:
4003                         stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
4004                 } else {
4005                         /* Ok, we can do that :-) */
4006                         struct sctp_stream_in *oldstrm;
4007
4008                         /* save off the old */
4009                         oldstrm = stcb->asoc.strmin;
4010                         SCTP_MALLOC(stcb->asoc.strmin, struct sctp_stream_in *,
4011                             (num_stream * sizeof(struct sctp_stream_in)),
4012                             SCTP_M_STRMI);
4013                         if (stcb->asoc.strmin == NULL) {
4014                                 stcb->asoc.strmin = oldstrm;
4015                                 goto denied;
4016                         }
4017                         /* copy off the old data */
4018                         for (i = 0; i < stcb->asoc.streamincnt; i++) {
4019                                 TAILQ_INIT(&stcb->asoc.strmin[i].inqueue);
4020                                 TAILQ_INIT(&stcb->asoc.strmin[i].uno_inqueue);
4021                                 stcb->asoc.strmin[i].stream_no = i;
4022                                 stcb->asoc.strmin[i].last_sequence_delivered = oldstrm[i].last_sequence_delivered;
4023                                 stcb->asoc.strmin[i].delivery_started = oldstrm[i].delivery_started;
4024                                 stcb->asoc.strmin[i].pd_api_started = oldstrm[i].pd_api_started;
4025                                 /* now anything on those queues? */
4026                                 TAILQ_FOREACH_SAFE(ctl, &oldstrm[i].inqueue, next_instrm, nctl) {
4027                                         TAILQ_REMOVE(&oldstrm[i].inqueue, ctl, next_instrm);
4028                                         TAILQ_INSERT_TAIL(&stcb->asoc.strmin[i].inqueue, ctl, next_instrm);
4029                                 }
4030                                 TAILQ_FOREACH_SAFE(ctl, &oldstrm[i].uno_inqueue, next_instrm, nctl) {
4031                                         TAILQ_REMOVE(&oldstrm[i].uno_inqueue, ctl, next_instrm);
4032                                         TAILQ_INSERT_TAIL(&stcb->asoc.strmin[i].uno_inqueue, ctl, next_instrm);
4033                                 }
4034                         }
4035                         /* Init the new streams */
4036                         for (i = stcb->asoc.streamincnt; i < num_stream; i++) {
4037                                 TAILQ_INIT(&stcb->asoc.strmin[i].inqueue);
4038                                 TAILQ_INIT(&stcb->asoc.strmin[i].uno_inqueue);
4039                                 stcb->asoc.strmin[i].stream_no = i;
4040                                 stcb->asoc.strmin[i].last_sequence_delivered = 0xffffffff;
4041                                 stcb->asoc.strmin[i].pd_api_started = 0;
4042                                 stcb->asoc.strmin[i].delivery_started = 0;
4043                         }
4044                         SCTP_FREE(oldstrm, SCTP_M_STRMI);
4045                         /* update the size */
4046                         stcb->asoc.streamincnt = num_stream;
4047                         stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_PERFORMED;
4048                         sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt, 0);
4049                 }
4050                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
4051                 asoc->str_reset_seq_in++;
4052         } else if ((asoc->str_reset_seq_in - 1) == seq) {
4053                 /*
4054                  * one seq back, just echo back last action since my
4055                  * response was lost.
4056                  */
4057                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
4058         } else if ((asoc->str_reset_seq_in - 2) == seq) {
4059                 /*
4060                  * two seq back, just echo back last action since my
4061                  * response was lost.
4062                  */
4063                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]);
4064         } else {
4065                 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_RESULT_ERR_BAD_SEQNO);
4066
4067         }
4068 }
4069
4070 static void
4071 sctp_handle_str_reset_add_out_strm(struct sctp_tcb *stcb, struct sctp_tmit_chunk *chk,
4072     struct sctp_stream_reset_add_strm *str_add)
4073 {
4074         /*
4075          * Peer is requesting to add more streams. If its within our
4076          * max-streams we will allow it.
4077          */
4078         uint16_t num_stream;
4079         uint32_t seq;
4080         struct sctp_association *asoc = &stcb->asoc;
4081
4082         /* Get the number. */
4083         seq = ntohl(str_add->request_seq);
4084         num_stream = ntohs(str_add->number_of_streams);
4085         /* Now what would be the new total? */
4086         if (asoc->str_reset_seq_in == seq) {
4087                 stcb->asoc.last_reset_action[1] = stcb->asoc.last_reset_action[0];
4088                 if (!(asoc->local_strreset_support & SCTP_ENABLE_CHANGE_ASSOC_REQ)) {
4089                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
4090                 } else if (stcb->asoc.stream_reset_outstanding) {
4091                         /* We must reject it we have something pending */
4092                         stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_ERR_IN_PROGRESS;
4093                 } else {
4094                         /* Ok, we can do that :-) */
4095                         int mychk;
4096
4097                         mychk = stcb->asoc.streamoutcnt;
4098                         mychk += num_stream;
4099                         if (mychk < 0x10000) {
4100                                 stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_PERFORMED;
4101                                 if (sctp_send_str_reset_req(stcb, 0, NULL, 0, 0, 1, num_stream, 0, 1)) {
4102                                         stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
4103                                 }
4104                         } else {
4105                                 stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
4106                         }
4107                 }
4108                 sctp_add_stream_reset_result(chk, seq, stcb->asoc.last_reset_action[0]);
4109                 asoc->str_reset_seq_in++;
4110         } else if ((asoc->str_reset_seq_in - 1) == seq) {
4111                 /*
4112                  * one seq back, just echo back last action since my
4113                  * response was lost.
4114                  */
4115                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
4116         } else if ((asoc->str_reset_seq_in - 2) == seq) {
4117                 /*
4118                  * two seq back, just echo back last action since my
4119                  * response was lost.
4120                  */
4121                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]);
4122         } else {
4123                 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_RESULT_ERR_BAD_SEQNO);
4124         }
4125 }
4126
4127 #ifdef __GNUC__
4128 __attribute__((noinline))
4129 #endif
4130         static int
4131             sctp_handle_stream_reset(struct sctp_tcb *stcb, struct mbuf *m, int offset,
4132         struct sctp_chunkhdr *ch_req)
4133 {
4134         uint16_t remaining_length, param_len, ptype;
4135         struct sctp_paramhdr pstore;
4136         uint8_t cstore[SCTP_CHUNK_BUFFER_SIZE];
4137         uint32_t seq = 0;
4138         int num_req = 0;
4139         int trunc = 0;
4140         struct sctp_tmit_chunk *chk;
4141         struct sctp_chunkhdr *ch;
4142         struct sctp_paramhdr *ph;
4143         int ret_code = 0;
4144         int num_param = 0;
4145
4146         /* now it may be a reset or a reset-response */
4147         remaining_length = ntohs(ch_req->chunk_length) - sizeof(struct sctp_chunkhdr);
4148
4149         /* setup for adding the response */
4150         sctp_alloc_a_chunk(stcb, chk);
4151         if (chk == NULL) {
4152                 return (ret_code);
4153         }
4154         chk->copy_by_ref = 0;
4155         chk->rec.chunk_id.id = SCTP_STREAM_RESET;
4156         chk->rec.chunk_id.can_take_data = 0;
4157         chk->flags = 0;
4158         chk->asoc = &stcb->asoc;
4159         chk->no_fr_allowed = 0;
4160         chk->book_size = chk->send_size = sizeof(struct sctp_chunkhdr);
4161         chk->book_size_scale = 0;
4162         chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA);
4163         if (chk->data == NULL) {
4164 strres_nochunk:
4165                 if (chk->data) {
4166                         sctp_m_freem(chk->data);
4167                         chk->data = NULL;
4168                 }
4169                 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
4170                 return (ret_code);
4171         }
4172         SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD);
4173
4174         /* setup chunk parameters */
4175         chk->sent = SCTP_DATAGRAM_UNSENT;
4176         chk->snd_count = 0;
4177         chk->whoTo = NULL;
4178
4179         ch = mtod(chk->data, struct sctp_chunkhdr *);
4180         ch->chunk_type = SCTP_STREAM_RESET;
4181         ch->chunk_flags = 0;
4182         ch->chunk_length = htons(chk->send_size);
4183         SCTP_BUF_LEN(chk->data) = SCTP_SIZE32(chk->send_size);
4184         offset += sizeof(struct sctp_chunkhdr);
4185         while (remaining_length >= sizeof(struct sctp_paramhdr)) {
4186                 ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset, sizeof(pstore), (uint8_t *) & pstore);
4187                 if (ph == NULL) {
4188                         /* TSNH */
4189                         break;
4190                 }
4191                 param_len = ntohs(ph->param_length);
4192                 if ((param_len > remaining_length) ||
4193                     (param_len < (sizeof(struct sctp_paramhdr) + sizeof(uint32_t)))) {
4194                         /* bad parameter length */
4195                         break;
4196                 }
4197                 ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset, min(param_len, sizeof(cstore)),
4198                     (uint8_t *) & cstore);
4199                 if (ph == NULL) {
4200                         /* TSNH */
4201                         break;
4202                 }
4203                 ptype = ntohs(ph->param_type);
4204                 num_param++;
4205                 if (param_len > sizeof(cstore)) {
4206                         trunc = 1;
4207                 } else {
4208                         trunc = 0;
4209                 }
4210                 if (num_param > SCTP_MAX_RESET_PARAMS) {
4211                         /* hit the max of parameters already sorry.. */
4212                         break;
4213                 }
4214                 if (ptype == SCTP_STR_RESET_OUT_REQUEST) {
4215                         struct sctp_stream_reset_out_request *req_out;
4216
4217                         if (param_len < sizeof(struct sctp_stream_reset_out_request)) {
4218                                 break;
4219                         }
4220                         req_out = (struct sctp_stream_reset_out_request *)ph;
4221                         num_req++;
4222                         if (stcb->asoc.stream_reset_outstanding) {
4223                                 seq = ntohl(req_out->response_seq);
4224                                 if (seq == stcb->asoc.str_reset_seq_out) {
4225                                         /* implicit ack */
4226                                         (void)sctp_handle_stream_reset_response(stcb, seq, SCTP_STREAM_RESET_RESULT_PERFORMED, NULL);
4227                                 }
4228                         }
4229                         sctp_handle_str_reset_request_out(stcb, chk, req_out, trunc);
4230                 } else if (ptype == SCTP_STR_RESET_ADD_OUT_STREAMS) {
4231                         struct sctp_stream_reset_add_strm *str_add;
4232
4233                         if (param_len < sizeof(struct sctp_stream_reset_add_strm)) {
4234                                 break;
4235                         }
4236                         str_add = (struct sctp_stream_reset_add_strm *)ph;
4237                         num_req++;
4238                         sctp_handle_str_reset_add_strm(stcb, chk, str_add);
4239                 } else if (ptype == SCTP_STR_RESET_ADD_IN_STREAMS) {
4240                         struct sctp_stream_reset_add_strm *str_add;
4241
4242                         if (param_len < sizeof(struct sctp_stream_reset_add_strm)) {
4243                                 break;
4244                         }
4245                         str_add = (struct sctp_stream_reset_add_strm *)ph;
4246                         num_req++;
4247                         sctp_handle_str_reset_add_out_strm(stcb, chk, str_add);
4248                 } else if (ptype == SCTP_STR_RESET_IN_REQUEST) {
4249                         struct sctp_stream_reset_in_request *req_in;
4250
4251                         num_req++;
4252                         req_in = (struct sctp_stream_reset_in_request *)ph;
4253                         sctp_handle_str_reset_request_in(stcb, chk, req_in, trunc);
4254                 } else if (ptype == SCTP_STR_RESET_TSN_REQUEST) {
4255                         struct sctp_stream_reset_tsn_request *req_tsn;
4256
4257                         num_req++;
4258                         req_tsn = (struct sctp_stream_reset_tsn_request *)ph;
4259                         if (sctp_handle_str_reset_request_tsn(stcb, chk, req_tsn)) {
4260                                 ret_code = 1;
4261                                 goto strres_nochunk;
4262                         }
4263                         /* no more */
4264                         break;
4265                 } else if (ptype == SCTP_STR_RESET_RESPONSE) {
4266                         struct sctp_stream_reset_response *resp;
4267                         uint32_t result;
4268
4269                         if (param_len < sizeof(struct sctp_stream_reset_response)) {
4270                                 break;
4271                         }
4272                         resp = (struct sctp_stream_reset_response *)ph;
4273                         seq = ntohl(resp->response_seq);
4274                         result = ntohl(resp->result);
4275                         if (sctp_handle_stream_reset_response(stcb, seq, result, resp)) {
4276                                 ret_code = 1;
4277                                 goto strres_nochunk;
4278                         }
4279                 } else {
4280                         break;
4281                 }
4282                 offset += SCTP_SIZE32(param_len);
4283                 if (remaining_length >= SCTP_SIZE32(param_len)) {
4284                         remaining_length -= SCTP_SIZE32(param_len);
4285                 } else {
4286                         remaining_length = 0;
4287                 }
4288         }
4289         if (num_req == 0) {
4290                 /* we have no response free the stuff */
4291                 goto strres_nochunk;
4292         }
4293         /* ok we have a chunk to link in */
4294         TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue,
4295             chk,
4296             sctp_next);
4297         stcb->asoc.ctrl_queue_cnt++;
4298         return (ret_code);
4299 }
4300
4301 /*
4302  * Handle a router or endpoints report of a packet loss, there are two ways
4303  * to handle this, either we get the whole packet and must disect it
4304  * ourselves (possibly with truncation and or corruption) or it is a summary
4305  * from a middle box that did the disectting for us.
4306  */
4307 static void
4308 sctp_handle_packet_dropped(struct sctp_pktdrop_chunk *cp,
4309     struct sctp_tcb *stcb, struct sctp_nets *net, uint32_t limit)
4310 {
4311         uint32_t bottle_bw, on_queue;
4312         uint16_t trunc_len;
4313         unsigned int chlen;
4314         unsigned int at;
4315         struct sctp_chunk_desc desc;
4316         struct sctp_chunkhdr *ch;
4317
4318         chlen = ntohs(cp->ch.chunk_length);
4319         chlen -= sizeof(struct sctp_pktdrop_chunk);
4320         /* XXX possible chlen underflow */
4321         if (chlen == 0) {
4322                 ch = NULL;
4323                 if (cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX)
4324                         SCTP_STAT_INCR(sctps_pdrpbwrpt);
4325         } else {
4326                 ch = (struct sctp_chunkhdr *)(cp->data + sizeof(struct sctphdr));
4327                 chlen -= sizeof(struct sctphdr);
4328                 /* XXX possible chlen underflow */
4329                 memset(&desc, 0, sizeof(desc));
4330         }
4331         trunc_len = (uint16_t) ntohs(cp->trunc_len);
4332         if (trunc_len > limit) {
4333                 trunc_len = limit;
4334         }
4335         /* now the chunks themselves */
4336         while ((ch != NULL) && (chlen >= sizeof(struct sctp_chunkhdr))) {
4337                 desc.chunk_type = ch->chunk_type;
4338                 /* get amount we need to move */
4339                 at = ntohs(ch->chunk_length);
4340                 if (at < sizeof(struct sctp_chunkhdr)) {
4341                         /* corrupt chunk, maybe at the end? */
4342                         SCTP_STAT_INCR(sctps_pdrpcrupt);
4343                         break;
4344                 }
4345                 if (trunc_len == 0) {
4346                         /* we are supposed to have all of it */
4347                         if (at > chlen) {
4348                                 /* corrupt skip it */
4349                                 SCTP_STAT_INCR(sctps_pdrpcrupt);
4350                                 break;
4351                         }
4352                 } else {
4353                         /* is there enough of it left ? */
4354                         if (desc.chunk_type == SCTP_DATA) {
4355                                 if (chlen < (sizeof(struct sctp_data_chunk) +
4356                                     sizeof(desc.data_bytes))) {
4357                                         break;
4358                                 }
4359                         } else {
4360                                 if (chlen < sizeof(struct sctp_chunkhdr)) {
4361                                         break;
4362                                 }
4363                         }
4364                 }
4365                 if (desc.chunk_type == SCTP_DATA) {
4366                         /* can we get out the tsn? */
4367                         if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX))
4368                                 SCTP_STAT_INCR(sctps_pdrpmbda);
4369
4370                         if (chlen >= (sizeof(struct sctp_data_chunk) + sizeof(uint32_t))) {
4371                                 /* yep */
4372                                 struct sctp_data_chunk *dcp;
4373                                 uint8_t *ddp;
4374                                 unsigned int iii;
4375
4376                                 dcp = (struct sctp_data_chunk *)ch;
4377                                 ddp = (uint8_t *) (dcp + 1);
4378                                 for (iii = 0; iii < sizeof(desc.data_bytes); iii++) {
4379                                         desc.data_bytes[iii] = ddp[iii];
4380                                 }
4381                                 desc.tsn_ifany = dcp->dp.tsn;
4382                         } else {
4383                                 /* nope we are done. */
4384                                 SCTP_STAT_INCR(sctps_pdrpnedat);
4385                                 break;
4386                         }
4387                 } else {
4388                         if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX))
4389                                 SCTP_STAT_INCR(sctps_pdrpmbct);
4390                 }
4391
4392                 if (process_chunk_drop(stcb, &desc, net, cp->ch.chunk_flags)) {
4393                         SCTP_STAT_INCR(sctps_pdrppdbrk);
4394                         break;
4395                 }
4396                 if (SCTP_SIZE32(at) > chlen) {
4397                         break;
4398                 }
4399                 chlen -= SCTP_SIZE32(at);
4400                 if (chlen < sizeof(struct sctp_chunkhdr)) {
4401                         /* done, none left */
4402                         break;
4403                 }
4404                 ch = (struct sctp_chunkhdr *)((caddr_t)ch + SCTP_SIZE32(at));
4405         }
4406         /* Now update any rwnd --- possibly */
4407         if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX) == 0) {
4408                 /* From a peer, we get a rwnd report */
4409                 uint32_t a_rwnd;
4410
4411                 SCTP_STAT_INCR(sctps_pdrpfehos);
4412
4413                 bottle_bw = ntohl(cp->bottle_bw);
4414                 on_queue = ntohl(cp->current_onq);
4415                 if (bottle_bw && on_queue) {
4416                         /* a rwnd report is in here */
4417                         if (bottle_bw > on_queue)
4418                                 a_rwnd = bottle_bw - on_queue;
4419                         else
4420                                 a_rwnd = 0;
4421
4422                         if (a_rwnd == 0)
4423                                 stcb->asoc.peers_rwnd = 0;
4424                         else {
4425                                 if (a_rwnd > stcb->asoc.total_flight) {
4426                                         stcb->asoc.peers_rwnd =
4427                                             a_rwnd - stcb->asoc.total_flight;
4428                                 } else {
4429                                         stcb->asoc.peers_rwnd = 0;
4430                                 }
4431                                 if (stcb->asoc.peers_rwnd <
4432                                     stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
4433                                         /* SWS sender side engages */
4434                                         stcb->asoc.peers_rwnd = 0;
4435                                 }
4436                         }
4437                 }
4438         } else {
4439                 SCTP_STAT_INCR(sctps_pdrpfmbox);
4440         }
4441
4442         /* now middle boxes in sat networks get a cwnd bump */
4443         if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX) &&
4444             (stcb->asoc.sat_t3_loss_recovery == 0) &&
4445             (stcb->asoc.sat_network)) {
4446                 /*
4447                  * This is debatable but for sat networks it makes sense
4448                  * Note if a T3 timer has went off, we will prohibit any
4449                  * changes to cwnd until we exit the t3 loss recovery.
4450                  */
4451                 stcb->asoc.cc_functions.sctp_cwnd_update_after_packet_dropped(stcb,
4452                     net, cp, &bottle_bw, &on_queue);
4453         }
4454 }
4455
4456 /*
4457  * handles all control chunks in a packet inputs: - m: mbuf chain, assumed to
4458  * still contain IP/SCTP header - stcb: is the tcb found for this packet -
4459  * offset: offset into the mbuf chain to first chunkhdr - length: is the
4460  * length of the complete packet outputs: - length: modified to remaining
4461  * length after control processing - netp: modified to new sctp_nets after
4462  * cookie-echo processing - return NULL to discard the packet (ie. no asoc,
4463  * bad packet,...) otherwise return the tcb for this packet
4464  */
4465 #ifdef __GNUC__
4466 __attribute__((noinline))
4467 #endif
4468         static struct sctp_tcb *
4469                  sctp_process_control(struct mbuf *m, int iphlen, int *offset, int length,
4470              struct sockaddr *src, struct sockaddr *dst,
4471              struct sctphdr *sh, struct sctp_chunkhdr *ch, struct sctp_inpcb *inp,
4472              struct sctp_tcb *stcb, struct sctp_nets **netp, int *fwd_tsn_seen,
4473              uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum,
4474              uint32_t vrf_id, uint16_t port)
4475 {
4476         struct sctp_association *asoc;
4477         struct mbuf *op_err;
4478         char msg[SCTP_DIAG_INFO_LEN];
4479         uint32_t vtag_in;
4480         int num_chunks = 0;     /* number of control chunks processed */
4481         uint32_t chk_length;
4482         int ret;
4483         int abort_no_unlock = 0;
4484         int ecne_seen = 0;
4485
4486         /*
4487          * How big should this be, and should it be alloc'd? Lets try the
4488          * d-mtu-ceiling for now (2k) and that should hopefully work ...
4489          * until we get into jumbo grams and such..
4490          */
4491         uint8_t chunk_buf[SCTP_CHUNK_BUFFER_SIZE];
4492         struct sctp_tcb *locked_tcb = stcb;
4493         int got_auth = 0;
4494         uint32_t auth_offset = 0, auth_len = 0;
4495         int auth_skipped = 0;
4496         int asconf_cnt = 0;
4497 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4498         struct socket *so;
4499 #endif
4500
4501         SCTPDBG(SCTP_DEBUG_INPUT1, "sctp_process_control: iphlen=%u, offset=%u, length=%u stcb:%p\n",
4502             iphlen, *offset, length, (void *)stcb);
4503
4504         /* validate chunk header length... */
4505         if (ntohs(ch->chunk_length) < sizeof(*ch)) {
4506                 SCTPDBG(SCTP_DEBUG_INPUT1, "Invalid header length %d\n",
4507                     ntohs(ch->chunk_length));
4508                 if (locked_tcb) {
4509                         SCTP_TCB_UNLOCK(locked_tcb);
4510                 }
4511                 return (NULL);
4512         }
4513         /*
4514          * validate the verification tag
4515          */
4516         vtag_in = ntohl(sh->v_tag);
4517
4518         if (locked_tcb) {
4519                 SCTP_TCB_LOCK_ASSERT(locked_tcb);
4520         }
4521         if (ch->chunk_type == SCTP_INITIATION) {
4522                 SCTPDBG(SCTP_DEBUG_INPUT1, "Its an INIT of len:%d vtag:%x\n",
4523                     ntohs(ch->chunk_length), vtag_in);
4524                 if (vtag_in != 0) {
4525                         /* protocol error- silently discard... */
4526                         SCTP_STAT_INCR(sctps_badvtag);
4527                         if (locked_tcb) {
4528                                 SCTP_TCB_UNLOCK(locked_tcb);
4529                         }
4530                         return (NULL);
4531                 }
4532         } else if (ch->chunk_type != SCTP_COOKIE_ECHO) {
4533                 /*
4534                  * If there is no stcb, skip the AUTH chunk and process
4535                  * later after a stcb is found (to validate the lookup was
4536                  * valid.
4537                  */
4538                 if ((ch->chunk_type == SCTP_AUTHENTICATION) &&
4539                     (stcb == NULL) &&
4540                     (inp->auth_supported == 1)) {
4541                         /* save this chunk for later processing */
4542                         auth_skipped = 1;
4543                         auth_offset = *offset;
4544                         auth_len = ntohs(ch->chunk_length);
4545
4546                         /* (temporarily) move past this chunk */
4547                         *offset += SCTP_SIZE32(auth_len);
4548                         if (*offset >= length) {
4549                                 /* no more data left in the mbuf chain */
4550                                 *offset = length;
4551                                 if (locked_tcb) {
4552                                         SCTP_TCB_UNLOCK(locked_tcb);
4553                                 }
4554                                 return (NULL);
4555                         }
4556                         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
4557                             sizeof(struct sctp_chunkhdr), chunk_buf);
4558                 }
4559                 if (ch == NULL) {
4560                         /* Help */
4561                         *offset = length;
4562                         if (locked_tcb) {
4563                                 SCTP_TCB_UNLOCK(locked_tcb);
4564                         }
4565                         return (NULL);
4566                 }
4567                 if (ch->chunk_type == SCTP_COOKIE_ECHO) {
4568                         goto process_control_chunks;
4569                 }
4570                 /*
4571                  * first check if it's an ASCONF with an unknown src addr we
4572                  * need to look inside to find the association
4573                  */
4574                 if (ch->chunk_type == SCTP_ASCONF && stcb == NULL) {
4575                         struct sctp_chunkhdr *asconf_ch = ch;
4576                         uint32_t asconf_offset = 0, asconf_len = 0;
4577
4578                         /* inp's refcount may be reduced */
4579                         SCTP_INP_INCR_REF(inp);
4580
4581                         asconf_offset = *offset;
4582                         do {
4583                                 asconf_len = ntohs(asconf_ch->chunk_length);
4584                                 if (asconf_len < sizeof(struct sctp_asconf_paramhdr))
4585                                         break;
4586                                 stcb = sctp_findassociation_ep_asconf(m,
4587                                     *offset,
4588                                     dst,
4589                                     sh, &inp, netp, vrf_id);
4590                                 if (stcb != NULL)
4591                                         break;
4592                                 asconf_offset += SCTP_SIZE32(asconf_len);
4593                                 asconf_ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, asconf_offset,
4594                                     sizeof(struct sctp_chunkhdr), chunk_buf);
4595                         } while (asconf_ch != NULL && asconf_ch->chunk_type == SCTP_ASCONF);
4596                         if (stcb == NULL) {
4597                                 /*
4598                                  * reduce inp's refcount if not reduced in
4599                                  * sctp_findassociation_ep_asconf().
4600                                  */
4601                                 SCTP_INP_DECR_REF(inp);
4602                         } else {
4603                                 locked_tcb = stcb;
4604                         }
4605
4606                         /* now go back and verify any auth chunk to be sure */
4607                         if (auth_skipped && (stcb != NULL)) {
4608                                 struct sctp_auth_chunk *auth;
4609
4610                                 auth = (struct sctp_auth_chunk *)
4611                                     sctp_m_getptr(m, auth_offset,
4612                                     auth_len, chunk_buf);
4613                                 got_auth = 1;
4614                                 auth_skipped = 0;
4615                                 if ((auth == NULL) || sctp_handle_auth(stcb, auth, m,
4616                                     auth_offset)) {
4617                                         /* auth HMAC failed so dump it */
4618                                         *offset = length;
4619                                         if (locked_tcb) {
4620                                                 SCTP_TCB_UNLOCK(locked_tcb);
4621                                         }
4622                                         return (NULL);
4623                                 } else {
4624                                         /* remaining chunks are HMAC checked */
4625                                         stcb->asoc.authenticated = 1;
4626                                 }
4627                         }
4628                 }
4629                 if (stcb == NULL) {
4630                         snprintf(msg, sizeof(msg), "OOTB, %s:%d at %s", __FILE__, __LINE__, __func__);
4631                         op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
4632                             msg);
4633                         /* no association, so it's out of the blue... */
4634                         sctp_handle_ootb(m, iphlen, *offset, src, dst, sh, inp, op_err,
4635                             mflowtype, mflowid, inp->fibnum,
4636                             vrf_id, port);
4637                         *offset = length;
4638                         if (locked_tcb) {
4639                                 SCTP_TCB_UNLOCK(locked_tcb);
4640                         }
4641                         return (NULL);
4642                 }
4643                 asoc = &stcb->asoc;
4644                 /* ABORT and SHUTDOWN can use either v_tag... */
4645                 if ((ch->chunk_type == SCTP_ABORT_ASSOCIATION) ||
4646                     (ch->chunk_type == SCTP_SHUTDOWN_COMPLETE) ||
4647                     (ch->chunk_type == SCTP_PACKET_DROPPED)) {
4648                         /* Take the T-bit always into account. */
4649                         if ((((ch->chunk_flags & SCTP_HAD_NO_TCB) == 0) &&
4650                             (vtag_in == asoc->my_vtag)) ||
4651                             (((ch->chunk_flags & SCTP_HAD_NO_TCB) == SCTP_HAD_NO_TCB) &&
4652                             (vtag_in == asoc->peer_vtag))) {
4653                                 /* this is valid */
4654                         } else {
4655                                 /* drop this packet... */
4656                                 SCTP_STAT_INCR(sctps_badvtag);
4657                                 if (locked_tcb) {
4658                                         SCTP_TCB_UNLOCK(locked_tcb);
4659                                 }
4660                                 return (NULL);
4661                         }
4662                 } else if (ch->chunk_type == SCTP_SHUTDOWN_ACK) {
4663                         if (vtag_in != asoc->my_vtag) {
4664                                 /*
4665                                  * this could be a stale SHUTDOWN-ACK or the
4666                                  * peer never got the SHUTDOWN-COMPLETE and
4667                                  * is still hung; we have started a new asoc
4668                                  * but it won't complete until the shutdown
4669                                  * is completed
4670                                  */
4671                                 if (locked_tcb) {
4672                                         SCTP_TCB_UNLOCK(locked_tcb);
4673                                 }
4674                                 snprintf(msg, sizeof(msg), "OOTB, %s:%d at %s", __FILE__, __LINE__, __func__);
4675                                 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
4676                                     msg);
4677                                 sctp_handle_ootb(m, iphlen, *offset, src, dst,
4678                                     sh, inp, op_err,
4679                                     mflowtype, mflowid, fibnum,
4680                                     vrf_id, port);
4681                                 return (NULL);
4682                         }
4683                 } else {
4684                         /* for all other chunks, vtag must match */
4685                         if (vtag_in != asoc->my_vtag) {
4686                                 /* invalid vtag... */
4687                                 SCTPDBG(SCTP_DEBUG_INPUT3,
4688                                     "invalid vtag: %xh, expect %xh\n",
4689                                     vtag_in, asoc->my_vtag);
4690                                 SCTP_STAT_INCR(sctps_badvtag);
4691                                 if (locked_tcb) {
4692                                         SCTP_TCB_UNLOCK(locked_tcb);
4693                                 }
4694                                 *offset = length;
4695                                 return (NULL);
4696                         }
4697                 }
4698         }                       /* end if !SCTP_COOKIE_ECHO *//* process all
4699                                  * control chunks... */
4700         if (((ch->chunk_type == SCTP_SELECTIVE_ACK) ||
4701             (ch->chunk_type == SCTP_NR_SELECTIVE_ACK) ||
4702             (ch->chunk_type == SCTP_HEARTBEAT_REQUEST)) &&
4703             (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_ECHOED)) {
4704                 /* implied cookie-ack.. we must have lost the ack */
4705                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
4706                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
4707                             stcb->asoc.overall_error_count,
4708                             0,
4709                             SCTP_FROM_SCTP_INPUT,
4710                             __LINE__);
4711                 }
4712                 stcb->asoc.overall_error_count = 0;
4713                 sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb,
4714                     *netp);
4715         }
4716 process_control_chunks:
4717         while (IS_SCTP_CONTROL(ch)) {
4718                 /* validate chunk length */
4719                 chk_length = ntohs(ch->chunk_length);
4720                 SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_process_control: processing a chunk type=%u, len=%u\n",
4721                     ch->chunk_type, chk_length);
4722                 SCTP_LTRACE_CHK(inp, stcb, ch->chunk_type, chk_length);
4723                 if (chk_length < sizeof(*ch) ||
4724                     (*offset + (int)chk_length) > length) {
4725                         *offset = length;
4726                         if (locked_tcb) {
4727                                 SCTP_TCB_UNLOCK(locked_tcb);
4728                         }
4729                         return (NULL);
4730                 }
4731                 SCTP_STAT_INCR_COUNTER64(sctps_incontrolchunks);
4732                 /*
4733                  * INIT-ACK only gets the init ack "header" portion only
4734                  * because we don't have to process the peer's COOKIE. All
4735                  * others get a complete chunk.
4736                  */
4737                 if ((ch->chunk_type == SCTP_INITIATION_ACK) ||
4738                     (ch->chunk_type == SCTP_INITIATION)) {
4739                         /* get an init-ack chunk */
4740                         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
4741                             sizeof(struct sctp_init_ack_chunk), chunk_buf);
4742                         if (ch == NULL) {
4743                                 *offset = length;
4744                                 if (locked_tcb) {
4745                                         SCTP_TCB_UNLOCK(locked_tcb);
4746                                 }
4747                                 return (NULL);
4748                         }
4749                 } else {
4750                         /* For cookies and all other chunks. */
4751                         if (chk_length > sizeof(chunk_buf)) {
4752                                 /*
4753                                  * use just the size of the chunk buffer so
4754                                  * the front part of our chunks fit in
4755                                  * contiguous space up to the chunk buffer
4756                                  * size (508 bytes). For chunks that need to
4757                                  * get more than that they must use the
4758                                  * sctp_m_getptr() function or other means
4759                                  * (e.g. know how to parse mbuf chains).
4760                                  * Cookies do this already.
4761                                  */
4762                                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
4763                                     (sizeof(chunk_buf) - 4),
4764                                     chunk_buf);
4765                                 if (ch == NULL) {
4766                                         *offset = length;
4767                                         if (locked_tcb) {
4768                                                 SCTP_TCB_UNLOCK(locked_tcb);
4769                                         }
4770                                         return (NULL);
4771                                 }
4772                         } else {
4773                                 /* We can fit it all */
4774                                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
4775                                     chk_length, chunk_buf);
4776                                 if (ch == NULL) {
4777                                         SCTP_PRINTF("sctp_process_control: Can't get the all data....\n");
4778                                         *offset = length;
4779                                         if (locked_tcb) {
4780                                                 SCTP_TCB_UNLOCK(locked_tcb);
4781                                         }
4782                                         return (NULL);
4783                                 }
4784                         }
4785                 }
4786                 num_chunks++;
4787                 /* Save off the last place we got a control from */
4788                 if (stcb != NULL) {
4789                         if (((netp != NULL) && (*netp != NULL)) || (ch->chunk_type == SCTP_ASCONF)) {
4790                                 /*
4791                                  * allow last_control to be NULL if
4792                                  * ASCONF... ASCONF processing will find the
4793                                  * right net later
4794                                  */
4795                                 if ((netp != NULL) && (*netp != NULL))
4796                                         stcb->asoc.last_control_chunk_from = *netp;
4797                         }
4798                 }
4799 #ifdef SCTP_AUDITING_ENABLED
4800                 sctp_audit_log(0xB0, ch->chunk_type);
4801 #endif
4802
4803                 /* check to see if this chunk required auth, but isn't */
4804                 if ((stcb != NULL) &&
4805                     (stcb->asoc.auth_supported == 1) &&
4806                     sctp_auth_is_required_chunk(ch->chunk_type, stcb->asoc.local_auth_chunks) &&
4807                     !stcb->asoc.authenticated) {
4808                         /* "silently" ignore */
4809                         SCTP_STAT_INCR(sctps_recvauthmissing);
4810                         goto next_chunk;
4811                 }
4812                 switch (ch->chunk_type) {
4813                 case SCTP_INITIATION:
4814                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_INIT\n");
4815                         /* The INIT chunk must be the only chunk. */
4816                         if ((num_chunks > 1) ||
4817                             (length - *offset > (int)SCTP_SIZE32(chk_length))) {
4818                                 /* RFC 4960 requires that no ABORT is sent */
4819                                 *offset = length;
4820                                 if (locked_tcb) {
4821                                         SCTP_TCB_UNLOCK(locked_tcb);
4822                                 }
4823                                 return (NULL);
4824                         }
4825                         /* Honor our resource limit. */
4826                         if (chk_length > SCTP_LARGEST_INIT_ACCEPTED) {
4827                                 op_err = sctp_generate_cause(SCTP_CAUSE_OUT_OF_RESC, "");
4828                                 sctp_abort_association(inp, stcb, m, iphlen,
4829                                     src, dst, sh, op_err,
4830                                     mflowtype, mflowid,
4831                                     vrf_id, port);
4832                                 *offset = length;
4833                                 return (NULL);
4834                         }
4835                         sctp_handle_init(m, iphlen, *offset, src, dst, sh,
4836                             (struct sctp_init_chunk *)ch, inp,
4837                             stcb, *netp, &abort_no_unlock,
4838                             mflowtype, mflowid,
4839                             vrf_id, port);
4840                         *offset = length;
4841                         if ((!abort_no_unlock) && (locked_tcb)) {
4842                                 SCTP_TCB_UNLOCK(locked_tcb);
4843                         }
4844                         return (NULL);
4845                         break;
4846                 case SCTP_PAD_CHUNK:
4847                         break;
4848                 case SCTP_INITIATION_ACK:
4849                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_INIT-ACK\n");
4850                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4851                                 /* We are not interested anymore */
4852                                 if ((stcb) && (stcb->asoc.total_output_queue_size)) {
4853                                         ;
4854                                 } else {
4855                                         if ((locked_tcb != NULL) && (locked_tcb != stcb)) {
4856                                                 /* Very unlikely */
4857                                                 SCTP_TCB_UNLOCK(locked_tcb);
4858                                         }
4859                                         *offset = length;
4860                                         if (stcb) {
4861 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4862                                                 so = SCTP_INP_SO(inp);
4863                                                 atomic_add_int(&stcb->asoc.refcnt, 1);
4864                                                 SCTP_TCB_UNLOCK(stcb);
4865                                                 SCTP_SOCKET_LOCK(so, 1);
4866                                                 SCTP_TCB_LOCK(stcb);
4867                                                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
4868 #endif
4869                                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
4870                                                     SCTP_FROM_SCTP_INPUT + SCTP_LOC_29);
4871 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4872                                                 SCTP_SOCKET_UNLOCK(so, 1);
4873 #endif
4874                                         }
4875                                         return (NULL);
4876                                 }
4877                         }
4878                         /* The INIT-ACK chunk must be the only chunk. */
4879                         if ((num_chunks > 1) ||
4880                             (length - *offset > (int)SCTP_SIZE32(chk_length))) {
4881                                 *offset = length;
4882                                 if (locked_tcb) {
4883                                         SCTP_TCB_UNLOCK(locked_tcb);
4884                                 }
4885                                 return (NULL);
4886                         }
4887                         if ((netp) && (*netp)) {
4888                                 ret = sctp_handle_init_ack(m, iphlen, *offset,
4889                                     src, dst, sh,
4890                                     (struct sctp_init_ack_chunk *)ch,
4891                                     stcb, *netp,
4892                                     &abort_no_unlock,
4893                                     mflowtype, mflowid,
4894                                     vrf_id);
4895                         } else {
4896                                 ret = -1;
4897                         }
4898                         *offset = length;
4899                         if (abort_no_unlock) {
4900                                 return (NULL);
4901                         }
4902                         /*
4903                          * Special case, I must call the output routine to
4904                          * get the cookie echoed
4905                          */
4906                         if ((stcb != NULL) && (ret == 0)) {
4907                                 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC, SCTP_SO_NOT_LOCKED);
4908                         }
4909                         if (locked_tcb) {
4910                                 SCTP_TCB_UNLOCK(locked_tcb);
4911                         }
4912                         return (NULL);
4913                         break;
4914                 case SCTP_SELECTIVE_ACK:
4915                         {
4916                                 struct sctp_sack_chunk *sack;
4917                                 int abort_now = 0;
4918                                 uint32_t a_rwnd, cum_ack;
4919                                 uint16_t num_seg, num_dup;
4920                                 uint8_t flags;
4921                                 int offset_seg, offset_dup;
4922
4923                                 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SACK\n");
4924                                 SCTP_STAT_INCR(sctps_recvsacks);
4925                                 if (stcb == NULL) {
4926                                         SCTPDBG(SCTP_DEBUG_INDATA1, "No stcb when processing SACK chunk\n");
4927                                         break;
4928                                 }
4929                                 if (chk_length < sizeof(struct sctp_sack_chunk)) {
4930                                         SCTPDBG(SCTP_DEBUG_INDATA1, "Bad size on SACK chunk, too small\n");
4931                                         break;
4932                                 }
4933                                 if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) {
4934                                         /*-
4935                                          * If we have sent a shutdown-ack, we will pay no
4936                                          * attention to a sack sent in to us since
4937                                          * we don't care anymore.
4938                                          */
4939                                         break;
4940                                 }
4941                                 sack = (struct sctp_sack_chunk *)ch;
4942                                 flags = ch->chunk_flags;
4943                                 cum_ack = ntohl(sack->sack.cum_tsn_ack);
4944                                 num_seg = ntohs(sack->sack.num_gap_ack_blks);
4945                                 num_dup = ntohs(sack->sack.num_dup_tsns);
4946                                 a_rwnd = (uint32_t) ntohl(sack->sack.a_rwnd);
4947                                 if (sizeof(struct sctp_sack_chunk) +
4948                                     num_seg * sizeof(struct sctp_gap_ack_block) +
4949                                     num_dup * sizeof(uint32_t) != chk_length) {
4950                                         SCTPDBG(SCTP_DEBUG_INDATA1, "Bad size of SACK chunk\n");
4951                                         break;
4952                                 }
4953                                 offset_seg = *offset + sizeof(struct sctp_sack_chunk);
4954                                 offset_dup = offset_seg + num_seg * sizeof(struct sctp_gap_ack_block);
4955                                 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SACK process cum_ack:%x num_seg:%d a_rwnd:%d\n",
4956                                     cum_ack, num_seg, a_rwnd);
4957                                 stcb->asoc.seen_a_sack_this_pkt = 1;
4958                                 if ((stcb->asoc.pr_sctp_cnt == 0) &&
4959                                     (num_seg == 0) &&
4960                                     SCTP_TSN_GE(cum_ack, stcb->asoc.last_acked_seq) &&
4961                                     (stcb->asoc.saw_sack_with_frags == 0) &&
4962                                     (stcb->asoc.saw_sack_with_nr_frags == 0) &&
4963                                     (!TAILQ_EMPTY(&stcb->asoc.sent_queue))
4964                                     ) {
4965                                         /*
4966                                          * We have a SIMPLE sack having no
4967                                          * prior segments and data on sent
4968                                          * queue to be acked.. Use the
4969                                          * faster path sack processing. We
4970                                          * also allow window update sacks
4971                                          * with no missing segments to go
4972                                          * this way too.
4973                                          */
4974                                         sctp_express_handle_sack(stcb, cum_ack, a_rwnd, &abort_now, ecne_seen);
4975                                 } else {
4976                                         if (netp && *netp)
4977                                                 sctp_handle_sack(m, offset_seg, offset_dup, stcb,
4978                                                     num_seg, 0, num_dup, &abort_now, flags,
4979                                                     cum_ack, a_rwnd, ecne_seen);
4980                                 }
4981                                 if (abort_now) {
4982                                         /* ABORT signal from sack processing */
4983                                         *offset = length;
4984                                         return (NULL);
4985                                 }
4986                                 if (TAILQ_EMPTY(&stcb->asoc.send_queue) &&
4987                                     TAILQ_EMPTY(&stcb->asoc.sent_queue) &&
4988                                     (stcb->asoc.stream_queue_cnt == 0)) {
4989                                         sctp_ulp_notify(SCTP_NOTIFY_SENDER_DRY, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
4990                                 }
4991                         }
4992                         break;
4993                         /* EY - nr_sack:  If the received chunk is an
4994                          * nr_sack chunk */
4995                 case SCTP_NR_SELECTIVE_ACK:
4996                         {
4997                                 struct sctp_nr_sack_chunk *nr_sack;
4998                                 int abort_now = 0;
4999                                 uint32_t a_rwnd, cum_ack;
5000                                 uint16_t num_seg, num_nr_seg, num_dup;
5001                                 uint8_t flags;
5002                                 int offset_seg, offset_dup;
5003
5004                                 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_NR_SACK\n");
5005                                 SCTP_STAT_INCR(sctps_recvsacks);
5006                                 if (stcb == NULL) {
5007                                         SCTPDBG(SCTP_DEBUG_INDATA1, "No stcb when processing NR-SACK chunk\n");
5008                                         break;
5009                                 }
5010                                 if (stcb->asoc.nrsack_supported == 0) {
5011                                         goto unknown_chunk;
5012                                 }
5013                                 if (chk_length < sizeof(struct sctp_nr_sack_chunk)) {
5014                                         SCTPDBG(SCTP_DEBUG_INDATA1, "Bad size on NR-SACK chunk, too small\n");
5015                                         break;
5016                                 }
5017                                 if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) {
5018                                         /*-
5019                                          * If we have sent a shutdown-ack, we will pay no
5020                                          * attention to a sack sent in to us since
5021                                          * we don't care anymore.
5022                                          */
5023                                         break;
5024                                 }
5025                                 nr_sack = (struct sctp_nr_sack_chunk *)ch;
5026                                 flags = ch->chunk_flags;
5027                                 cum_ack = ntohl(nr_sack->nr_sack.cum_tsn_ack);
5028                                 num_seg = ntohs(nr_sack->nr_sack.num_gap_ack_blks);
5029                                 num_nr_seg = ntohs(nr_sack->nr_sack.num_nr_gap_ack_blks);
5030                                 num_dup = ntohs(nr_sack->nr_sack.num_dup_tsns);
5031                                 a_rwnd = (uint32_t) ntohl(nr_sack->nr_sack.a_rwnd);
5032                                 if (sizeof(struct sctp_nr_sack_chunk) +
5033                                     (num_seg + num_nr_seg) * sizeof(struct sctp_gap_ack_block) +
5034                                     num_dup * sizeof(uint32_t) != chk_length) {
5035                                         SCTPDBG(SCTP_DEBUG_INDATA1, "Bad size of NR_SACK chunk\n");
5036                                         break;
5037                                 }
5038                                 offset_seg = *offset + sizeof(struct sctp_nr_sack_chunk);
5039                                 offset_dup = offset_seg + num_seg * sizeof(struct sctp_gap_ack_block);
5040                                 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_NR_SACK process cum_ack:%x num_seg:%d a_rwnd:%d\n",
5041                                     cum_ack, num_seg, a_rwnd);
5042                                 stcb->asoc.seen_a_sack_this_pkt = 1;
5043                                 if ((stcb->asoc.pr_sctp_cnt == 0) &&
5044                                     (num_seg == 0) && (num_nr_seg == 0) &&
5045                                     SCTP_TSN_GE(cum_ack, stcb->asoc.last_acked_seq) &&
5046                                     (stcb->asoc.saw_sack_with_frags == 0) &&
5047                                     (stcb->asoc.saw_sack_with_nr_frags == 0) &&
5048                                     (!TAILQ_EMPTY(&stcb->asoc.sent_queue))) {
5049                                         /*
5050                                          * We have a SIMPLE sack having no
5051                                          * prior segments and data on sent
5052                                          * queue to be acked. Use the faster
5053                                          * path sack processing. We also
5054                                          * allow window update sacks with no
5055                                          * missing segments to go this way
5056                                          * too.
5057                                          */
5058                                         sctp_express_handle_sack(stcb, cum_ack, a_rwnd,
5059                                             &abort_now, ecne_seen);
5060                                 } else {
5061                                         if (netp && *netp)
5062                                                 sctp_handle_sack(m, offset_seg, offset_dup, stcb,
5063                                                     num_seg, num_nr_seg, num_dup, &abort_now, flags,
5064                                                     cum_ack, a_rwnd, ecne_seen);
5065                                 }
5066                                 if (abort_now) {
5067                                         /* ABORT signal from sack processing */
5068                                         *offset = length;
5069                                         return (NULL);
5070                                 }
5071                                 if (TAILQ_EMPTY(&stcb->asoc.send_queue) &&
5072                                     TAILQ_EMPTY(&stcb->asoc.sent_queue) &&
5073                                     (stcb->asoc.stream_queue_cnt == 0)) {
5074                                         sctp_ulp_notify(SCTP_NOTIFY_SENDER_DRY, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
5075                                 }
5076                         }
5077                         break;
5078
5079                 case SCTP_HEARTBEAT_REQUEST:
5080                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_HEARTBEAT\n");
5081                         if ((stcb) && netp && *netp) {
5082                                 SCTP_STAT_INCR(sctps_recvheartbeat);
5083                                 sctp_send_heartbeat_ack(stcb, m, *offset,
5084                                     chk_length, *netp);
5085
5086                                 /* He's alive so give him credit */
5087                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
5088                                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
5089                                             stcb->asoc.overall_error_count,
5090                                             0,
5091                                             SCTP_FROM_SCTP_INPUT,
5092                                             __LINE__);
5093                                 }
5094                                 stcb->asoc.overall_error_count = 0;
5095                         }
5096                         break;
5097                 case SCTP_HEARTBEAT_ACK:
5098                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_HEARTBEAT-ACK\n");
5099                         if ((stcb == NULL) || (chk_length != sizeof(struct sctp_heartbeat_chunk))) {
5100                                 /* Its not ours */
5101                                 *offset = length;
5102                                 if (locked_tcb) {
5103                                         SCTP_TCB_UNLOCK(locked_tcb);
5104                                 }
5105                                 return (NULL);
5106                         }
5107                         /* He's alive so give him credit */
5108                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
5109                                 sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
5110                                     stcb->asoc.overall_error_count,
5111                                     0,
5112                                     SCTP_FROM_SCTP_INPUT,
5113                                     __LINE__);
5114                         }
5115                         stcb->asoc.overall_error_count = 0;
5116                         SCTP_STAT_INCR(sctps_recvheartbeatack);
5117                         if (netp && *netp)
5118                                 sctp_handle_heartbeat_ack((struct sctp_heartbeat_chunk *)ch,
5119                                     stcb, *netp);
5120                         break;
5121                 case SCTP_ABORT_ASSOCIATION:
5122                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ABORT, stcb %p\n",
5123                             (void *)stcb);
5124                         if ((stcb) && netp && *netp)
5125                                 sctp_handle_abort((struct sctp_abort_chunk *)ch,
5126                                     stcb, *netp);
5127                         *offset = length;
5128                         return (NULL);
5129                         break;
5130                 case SCTP_SHUTDOWN:
5131                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SHUTDOWN, stcb %p\n",
5132                             (void *)stcb);
5133                         if ((stcb == NULL) || (chk_length != sizeof(struct sctp_shutdown_chunk))) {
5134                                 *offset = length;
5135                                 if (locked_tcb) {
5136                                         SCTP_TCB_UNLOCK(locked_tcb);
5137                                 }
5138                                 return (NULL);
5139                         }
5140                         if (netp && *netp) {
5141                                 int abort_flag = 0;
5142
5143                                 sctp_handle_shutdown((struct sctp_shutdown_chunk *)ch,
5144                                     stcb, *netp, &abort_flag);
5145                                 if (abort_flag) {
5146                                         *offset = length;
5147                                         return (NULL);
5148                                 }
5149                         }
5150                         break;
5151                 case SCTP_SHUTDOWN_ACK:
5152                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SHUTDOWN-ACK, stcb %p\n", (void *)stcb);
5153                         if ((stcb) && (netp) && (*netp))
5154                                 sctp_handle_shutdown_ack((struct sctp_shutdown_ack_chunk *)ch, stcb, *netp);
5155                         *offset = length;
5156                         return (NULL);
5157                         break;
5158
5159                 case SCTP_OPERATION_ERROR:
5160                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_OP-ERR\n");
5161                         if ((stcb) && netp && *netp && sctp_handle_error(ch, stcb, *netp) < 0) {
5162                                 *offset = length;
5163                                 return (NULL);
5164                         }
5165                         break;
5166                 case SCTP_COOKIE_ECHO:
5167                         SCTPDBG(SCTP_DEBUG_INPUT3,
5168                             "SCTP_COOKIE-ECHO, stcb %p\n", (void *)stcb);
5169                         if ((stcb) && (stcb->asoc.total_output_queue_size)) {
5170                                 ;
5171                         } else {
5172                                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
5173                                         /* We are not interested anymore */
5174                         abend:
5175                                         if (stcb) {
5176                                                 SCTP_TCB_UNLOCK(stcb);
5177                                         }
5178                                         *offset = length;
5179                                         return (NULL);
5180                                 }
5181                         }
5182                         /*
5183                          * First are we accepting? We do this again here
5184                          * since it is possible that a previous endpoint WAS
5185                          * listening responded to a INIT-ACK and then
5186                          * closed. We opened and bound.. and are now no
5187                          * longer listening.
5188                          */
5189
5190                         if ((stcb == NULL) && (inp->sctp_socket->so_qlen >= inp->sctp_socket->so_qlimit)) {
5191                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
5192                                     (SCTP_BASE_SYSCTL(sctp_abort_if_one_2_one_hits_limit))) {
5193                                         op_err = sctp_generate_cause(SCTP_CAUSE_OUT_OF_RESC, "");
5194                                         sctp_abort_association(inp, stcb, m, iphlen,
5195                                             src, dst, sh, op_err,
5196                                             mflowtype, mflowid,
5197                                             vrf_id, port);
5198                                 }
5199                                 *offset = length;
5200                                 return (NULL);
5201                         } else {
5202                                 struct mbuf *ret_buf;
5203                                 struct sctp_inpcb *linp;
5204
5205                                 if (stcb) {
5206                                         linp = NULL;
5207                                 } else {
5208                                         linp = inp;
5209                                 }
5210
5211                                 if (linp) {
5212                                         SCTP_ASOC_CREATE_LOCK(linp);
5213                                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
5214                                             (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
5215                                                 SCTP_ASOC_CREATE_UNLOCK(linp);
5216                                                 goto abend;
5217                                         }
5218                                 }
5219                                 if (netp) {
5220                                         ret_buf =
5221                                             sctp_handle_cookie_echo(m, iphlen,
5222                                             *offset,
5223                                             src, dst,
5224                                             sh,
5225                                             (struct sctp_cookie_echo_chunk *)ch,
5226                                             &inp, &stcb, netp,
5227                                             auth_skipped,
5228                                             auth_offset,
5229                                             auth_len,
5230                                             &locked_tcb,
5231                                             mflowtype,
5232                                             mflowid,
5233                                             vrf_id,
5234                                             port);
5235                                 } else {
5236                                         ret_buf = NULL;
5237                                 }
5238                                 if (linp) {
5239                                         SCTP_ASOC_CREATE_UNLOCK(linp);
5240                                 }
5241                                 if (ret_buf == NULL) {
5242                                         if (locked_tcb) {
5243                                                 SCTP_TCB_UNLOCK(locked_tcb);
5244                                         }
5245                                         SCTPDBG(SCTP_DEBUG_INPUT3,
5246                                             "GAK, null buffer\n");
5247                                         *offset = length;
5248                                         return (NULL);
5249                                 }
5250                                 /* if AUTH skipped, see if it verified... */
5251                                 if (auth_skipped) {
5252                                         got_auth = 1;
5253                                         auth_skipped = 0;
5254                                 }
5255                                 if (!TAILQ_EMPTY(&stcb->asoc.sent_queue)) {
5256                                         /*
5257                                          * Restart the timer if we have
5258                                          * pending data
5259                                          */
5260                                         struct sctp_tmit_chunk *chk;
5261
5262                                         chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
5263                                         sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, chk->whoTo);
5264                                 }
5265                         }
5266                         break;
5267                 case SCTP_COOKIE_ACK:
5268                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_COOKIE-ACK, stcb %p\n", (void *)stcb);
5269                         if ((stcb == NULL) || chk_length != sizeof(struct sctp_cookie_ack_chunk)) {
5270                                 if (locked_tcb) {
5271                                         SCTP_TCB_UNLOCK(locked_tcb);
5272                                 }
5273                                 return (NULL);
5274                         }
5275                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
5276                                 /* We are not interested anymore */
5277                                 if ((stcb) && (stcb->asoc.total_output_queue_size)) {
5278                                         ;
5279                                 } else if (stcb) {
5280 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
5281                                         so = SCTP_INP_SO(inp);
5282                                         atomic_add_int(&stcb->asoc.refcnt, 1);
5283                                         SCTP_TCB_UNLOCK(stcb);
5284                                         SCTP_SOCKET_LOCK(so, 1);
5285                                         SCTP_TCB_LOCK(stcb);
5286                                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
5287 #endif
5288                                         (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
5289                                             SCTP_FROM_SCTP_INPUT + SCTP_LOC_30);
5290 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
5291                                         SCTP_SOCKET_UNLOCK(so, 1);
5292 #endif
5293                                         *offset = length;
5294                                         return (NULL);
5295                                 }
5296                         }
5297                         /* He's alive so give him credit */
5298                         if ((stcb) && netp && *netp) {
5299                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
5300                                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
5301                                             stcb->asoc.overall_error_count,
5302                                             0,
5303                                             SCTP_FROM_SCTP_INPUT,
5304                                             __LINE__);
5305                                 }
5306                                 stcb->asoc.overall_error_count = 0;
5307                                 sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb, *netp);
5308                         }
5309                         break;
5310                 case SCTP_ECN_ECHO:
5311                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ECN-ECHO\n");
5312                         /* He's alive so give him credit */
5313                         if ((stcb == NULL) || (chk_length != sizeof(struct sctp_ecne_chunk))) {
5314                                 /* Its not ours */
5315                                 if (locked_tcb) {
5316                                         SCTP_TCB_UNLOCK(locked_tcb);
5317                                 }
5318                                 *offset = length;
5319                                 return (NULL);
5320                         }
5321                         if (stcb) {
5322                                 if (stcb->asoc.ecn_supported == 0) {
5323                                         goto unknown_chunk;
5324                                 }
5325                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
5326                                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
5327                                             stcb->asoc.overall_error_count,
5328                                             0,
5329                                             SCTP_FROM_SCTP_INPUT,
5330                                             __LINE__);
5331                                 }
5332                                 stcb->asoc.overall_error_count = 0;
5333                                 sctp_handle_ecn_echo((struct sctp_ecne_chunk *)ch,
5334                                     stcb);
5335                                 ecne_seen = 1;
5336                         }
5337                         break;
5338                 case SCTP_ECN_CWR:
5339                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ECN-CWR\n");
5340                         /* He's alive so give him credit */
5341                         if ((stcb == NULL) || (chk_length != sizeof(struct sctp_cwr_chunk))) {
5342                                 /* Its not ours */
5343                                 if (locked_tcb) {
5344                                         SCTP_TCB_UNLOCK(locked_tcb);
5345                                 }
5346                                 *offset = length;
5347                                 return (NULL);
5348                         }
5349                         if (stcb) {
5350                                 if (stcb->asoc.ecn_supported == 0) {
5351                                         goto unknown_chunk;
5352                                 }
5353                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
5354                                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
5355                                             stcb->asoc.overall_error_count,
5356                                             0,
5357                                             SCTP_FROM_SCTP_INPUT,
5358                                             __LINE__);
5359                                 }
5360                                 stcb->asoc.overall_error_count = 0;
5361                                 sctp_handle_ecn_cwr((struct sctp_cwr_chunk *)ch, stcb, *netp);
5362                         }
5363                         break;
5364                 case SCTP_SHUTDOWN_COMPLETE:
5365                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SHUTDOWN-COMPLETE, stcb %p\n", (void *)stcb);
5366                         /* must be first and only chunk */
5367                         if ((num_chunks > 1) ||
5368                             (length - *offset > (int)SCTP_SIZE32(chk_length))) {
5369                                 *offset = length;
5370                                 if (locked_tcb) {
5371                                         SCTP_TCB_UNLOCK(locked_tcb);
5372                                 }
5373                                 return (NULL);
5374                         }
5375                         if ((stcb) && netp && *netp) {
5376                                 sctp_handle_shutdown_complete((struct sctp_shutdown_complete_chunk *)ch,
5377                                     stcb, *netp);
5378                         }
5379                         *offset = length;
5380                         return (NULL);
5381                         break;
5382                 case SCTP_ASCONF:
5383                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ASCONF\n");
5384                         /* He's alive so give him credit */
5385                         if (stcb) {
5386                                 if (stcb->asoc.asconf_supported == 0) {
5387                                         goto unknown_chunk;
5388                                 }
5389                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
5390                                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
5391                                             stcb->asoc.overall_error_count,
5392                                             0,
5393                                             SCTP_FROM_SCTP_INPUT,
5394                                             __LINE__);
5395                                 }
5396                                 stcb->asoc.overall_error_count = 0;
5397                                 sctp_handle_asconf(m, *offset, src,
5398                                     (struct sctp_asconf_chunk *)ch, stcb, asconf_cnt == 0);
5399                                 asconf_cnt++;
5400                         }
5401                         break;
5402                 case SCTP_ASCONF_ACK:
5403                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ASCONF-ACK\n");
5404                         if (chk_length < sizeof(struct sctp_asconf_ack_chunk)) {
5405                                 /* Its not ours */
5406                                 if (locked_tcb) {
5407                                         SCTP_TCB_UNLOCK(locked_tcb);
5408                                 }
5409                                 *offset = length;
5410                                 return (NULL);
5411                         }
5412                         if ((stcb) && netp && *netp) {
5413                                 if (stcb->asoc.asconf_supported == 0) {
5414                                         goto unknown_chunk;
5415                                 }
5416                                 /* He's alive so give him credit */
5417                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
5418                                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
5419                                             stcb->asoc.overall_error_count,
5420                                             0,
5421                                             SCTP_FROM_SCTP_INPUT,
5422                                             __LINE__);
5423                                 }
5424                                 stcb->asoc.overall_error_count = 0;
5425                                 sctp_handle_asconf_ack(m, *offset,
5426                                     (struct sctp_asconf_ack_chunk *)ch, stcb, *netp, &abort_no_unlock);
5427                                 if (abort_no_unlock)
5428                                         return (NULL);
5429                         }
5430                         break;
5431                 case SCTP_FORWARD_CUM_TSN:
5432                 case SCTP_IFORWARD_CUM_TSN:
5433                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_FWD-TSN\n");
5434                         if (chk_length < sizeof(struct sctp_forward_tsn_chunk)) {
5435                                 /* Its not ours */
5436                                 if (locked_tcb) {
5437                                         SCTP_TCB_UNLOCK(locked_tcb);
5438                                 }
5439                                 *offset = length;
5440                                 return (NULL);
5441                         }
5442                         /* He's alive so give him credit */
5443                         if (stcb) {
5444                                 int abort_flag = 0;
5445
5446                                 if (stcb->asoc.prsctp_supported == 0) {
5447                                         goto unknown_chunk;
5448                                 }
5449                                 stcb->asoc.overall_error_count = 0;
5450                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
5451                                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
5452                                             stcb->asoc.overall_error_count,
5453                                             0,
5454                                             SCTP_FROM_SCTP_INPUT,
5455                                             __LINE__);
5456                                 }
5457                                 *fwd_tsn_seen = 1;
5458                                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
5459                                         /* We are not interested anymore */
5460 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
5461                                         so = SCTP_INP_SO(inp);
5462                                         atomic_add_int(&stcb->asoc.refcnt, 1);
5463                                         SCTP_TCB_UNLOCK(stcb);
5464                                         SCTP_SOCKET_LOCK(so, 1);
5465                                         SCTP_TCB_LOCK(stcb);
5466                                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
5467 #endif
5468                                         (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
5469                                             SCTP_FROM_SCTP_INPUT + SCTP_LOC_31);
5470 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
5471                                         SCTP_SOCKET_UNLOCK(so, 1);
5472 #endif
5473                                         *offset = length;
5474                                         return (NULL);
5475                                 }
5476                                 /*
5477                                  * For sending a SACK this looks like DATA
5478                                  * chunks.
5479                                  */
5480                                 stcb->asoc.last_data_chunk_from = stcb->asoc.last_control_chunk_from;
5481                                 sctp_handle_forward_tsn(stcb,
5482                                     (struct sctp_forward_tsn_chunk *)ch, &abort_flag, m, *offset);
5483                                 if (abort_flag) {
5484                                         *offset = length;
5485                                         return (NULL);
5486                                 } else {
5487                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
5488                                                 sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
5489                                                     stcb->asoc.overall_error_count,
5490                                                     0,
5491                                                     SCTP_FROM_SCTP_INPUT,
5492                                                     __LINE__);
5493                                         }
5494                                         stcb->asoc.overall_error_count = 0;
5495                                 }
5496
5497                         }
5498                         break;
5499                 case SCTP_STREAM_RESET:
5500                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_STREAM_RESET\n");
5501                         if (((stcb == NULL) || (ch == NULL) || (chk_length < sizeof(struct sctp_stream_reset_tsn_req)))) {
5502                                 /* Its not ours */
5503                                 if (locked_tcb) {
5504                                         SCTP_TCB_UNLOCK(locked_tcb);
5505                                 }
5506                                 *offset = length;
5507                                 return (NULL);
5508                         }
5509                         if (stcb->asoc.reconfig_supported == 0) {
5510                                 goto unknown_chunk;
5511                         }
5512                         if (sctp_handle_stream_reset(stcb, m, *offset, ch)) {
5513                                 /* stop processing */
5514                                 *offset = length;
5515                                 return (NULL);
5516                         }
5517                         break;
5518                 case SCTP_PACKET_DROPPED:
5519                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_PACKET_DROPPED\n");
5520                         /* re-get it all please */
5521                         if (chk_length < sizeof(struct sctp_pktdrop_chunk)) {
5522                                 /* Its not ours */
5523                                 if (locked_tcb) {
5524                                         SCTP_TCB_UNLOCK(locked_tcb);
5525                                 }
5526                                 *offset = length;
5527                                 return (NULL);
5528                         }
5529                         if (ch && (stcb) && netp && (*netp)) {
5530                                 if (stcb->asoc.pktdrop_supported == 0) {
5531                                         goto unknown_chunk;
5532                                 }
5533                                 sctp_handle_packet_dropped((struct sctp_pktdrop_chunk *)ch,
5534                                     stcb, *netp,
5535                                     min(chk_length, (sizeof(chunk_buf) - 4)));
5536
5537                         }
5538                         break;
5539                 case SCTP_AUTHENTICATION:
5540                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_AUTHENTICATION\n");
5541                         if (stcb == NULL) {
5542                                 /* save the first AUTH for later processing */
5543                                 if (auth_skipped == 0) {
5544                                         auth_offset = *offset;
5545                                         auth_len = chk_length;
5546                                         auth_skipped = 1;
5547                                 }
5548                                 /* skip this chunk (temporarily) */
5549                                 goto next_chunk;
5550                         }
5551                         if (stcb->asoc.auth_supported == 0) {
5552                                 goto unknown_chunk;
5553                         }
5554                         if ((chk_length < (sizeof(struct sctp_auth_chunk))) ||
5555                             (chk_length > (sizeof(struct sctp_auth_chunk) +
5556                             SCTP_AUTH_DIGEST_LEN_MAX))) {
5557                                 /* Its not ours */
5558                                 if (locked_tcb) {
5559                                         SCTP_TCB_UNLOCK(locked_tcb);
5560                                 }
5561                                 *offset = length;
5562                                 return (NULL);
5563                         }
5564                         if (got_auth == 1) {
5565                                 /* skip this chunk... it's already auth'd */
5566                                 goto next_chunk;
5567                         }
5568                         got_auth = 1;
5569                         if ((ch == NULL) || sctp_handle_auth(stcb, (struct sctp_auth_chunk *)ch,
5570                             m, *offset)) {
5571                                 /* auth HMAC failed so dump the packet */
5572                                 *offset = length;
5573                                 return (stcb);
5574                         } else {
5575                                 /* remaining chunks are HMAC checked */
5576                                 stcb->asoc.authenticated = 1;
5577                         }
5578                         break;
5579
5580                 default:
5581         unknown_chunk:
5582                         /* it's an unknown chunk! */
5583                         if ((ch->chunk_type & 0x40) && (stcb != NULL)) {
5584                                 struct sctp_gen_error_cause *cause;
5585                                 int len;
5586
5587                                 op_err = sctp_get_mbuf_for_msg(sizeof(struct sctp_gen_error_cause),
5588                                     0, M_NOWAIT, 1, MT_DATA);
5589                                 if (op_err != NULL) {
5590                                         len = min(SCTP_SIZE32(chk_length), (uint32_t) (length - *offset));
5591                                         cause = mtod(op_err, struct sctp_gen_error_cause *);
5592                                         cause->code = htons(SCTP_CAUSE_UNRECOG_CHUNK);
5593                                         cause->length = htons((uint16_t) (len + sizeof(struct sctp_gen_error_cause)));
5594                                         SCTP_BUF_LEN(op_err) = sizeof(struct sctp_gen_error_cause);
5595                                         SCTP_BUF_NEXT(op_err) = SCTP_M_COPYM(m, *offset, len, M_NOWAIT);
5596                                         if (SCTP_BUF_NEXT(op_err) != NULL) {
5597 #ifdef SCTP_MBUF_LOGGING
5598                                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
5599                                                         sctp_log_mbc(SCTP_BUF_NEXT(op_err), SCTP_MBUF_ICOPY);
5600                                                 }
5601 #endif
5602                                                 sctp_queue_op_err(stcb, op_err);
5603                                         } else {
5604                                                 sctp_m_freem(op_err);
5605                                         }
5606                                 }
5607                         }
5608                         if ((ch->chunk_type & 0x80) == 0) {
5609                                 /* discard this packet */
5610                                 *offset = length;
5611                                 return (stcb);
5612                         } /* else skip this bad chunk and continue... */ break;
5613                 }               /* switch (ch->chunk_type) */
5614
5615
5616 next_chunk:
5617                 /* get the next chunk */
5618                 *offset += SCTP_SIZE32(chk_length);
5619                 if (*offset >= length) {
5620                         /* no more data left in the mbuf chain */
5621                         break;
5622                 }
5623                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
5624                     sizeof(struct sctp_chunkhdr), chunk_buf);
5625                 if (ch == NULL) {
5626                         if (locked_tcb) {
5627                                 SCTP_TCB_UNLOCK(locked_tcb);
5628                         }
5629                         *offset = length;
5630                         return (NULL);
5631                 }
5632         }                       /* while */
5633
5634         if (asconf_cnt > 0 && stcb != NULL) {
5635                 sctp_send_asconf_ack(stcb);
5636         }
5637         return (stcb);
5638 }
5639
5640
5641 /*
5642  * common input chunk processing (v4 and v6)
5643  */
5644 void
5645 sctp_common_input_processing(struct mbuf **mm, int iphlen, int offset, int length,
5646     struct sockaddr *src, struct sockaddr *dst,
5647     struct sctphdr *sh, struct sctp_chunkhdr *ch,
5648 #if !defined(SCTP_WITH_NO_CSUM)
5649     uint8_t compute_crc,
5650 #endif
5651     uint8_t ecn_bits,
5652     uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum,
5653     uint32_t vrf_id, uint16_t port)
5654 {
5655         uint32_t high_tsn;
5656         int fwd_tsn_seen = 0, data_processed = 0;
5657         struct mbuf *m = *mm, *op_err;
5658         char msg[SCTP_DIAG_INFO_LEN];
5659         int un_sent;
5660         int cnt_ctrl_ready = 0;
5661         struct sctp_inpcb *inp = NULL, *inp_decr = NULL;
5662         struct sctp_tcb *stcb = NULL;
5663         struct sctp_nets *net = NULL;
5664
5665         SCTP_STAT_INCR(sctps_recvdatagrams);
5666 #ifdef SCTP_AUDITING_ENABLED
5667         sctp_audit_log(0xE0, 1);
5668         sctp_auditing(0, inp, stcb, net);
5669 #endif
5670 #if !defined(SCTP_WITH_NO_CSUM)
5671         if (compute_crc != 0) {
5672                 uint32_t check, calc_check;
5673
5674                 check = sh->checksum;
5675                 sh->checksum = 0;
5676                 calc_check = sctp_calculate_cksum(m, iphlen);
5677                 sh->checksum = check;
5678                 if (calc_check != check) {
5679                         SCTPDBG(SCTP_DEBUG_INPUT1, "Bad CSUM on SCTP packet calc_check:%x check:%x  m:%p mlen:%d iphlen:%d\n",
5680                             calc_check, check, (void *)m, length, iphlen);
5681                         stcb = sctp_findassociation_addr(m, offset, src, dst,
5682                             sh, ch, &inp, &net, vrf_id);
5683 #if defined(INET) || defined(INET6)
5684                         if ((ch->chunk_type != SCTP_INITIATION) &&
5685                             (net != NULL) && (net->port != port)) {
5686                                 if (net->port == 0) {
5687                                         /* UDP encapsulation turned on. */
5688                                         net->mtu -= sizeof(struct udphdr);
5689                                         if (stcb->asoc.smallest_mtu > net->mtu) {
5690                                                 sctp_pathmtu_adjustment(stcb, net->mtu);
5691                                         }
5692                                 } else if (port == 0) {
5693                                         /* UDP encapsulation turned off. */
5694                                         net->mtu += sizeof(struct udphdr);
5695                                         /* XXX Update smallest_mtu */
5696                                 }
5697                                 net->port = port;
5698                         }
5699 #endif
5700                         if (net != NULL) {
5701                                 net->flowtype = mflowtype;
5702                                 net->flowid = mflowid;
5703                         }
5704                         if ((inp != NULL) && (stcb != NULL)) {
5705                                 sctp_send_packet_dropped(stcb, net, m, length, iphlen, 1);
5706                                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_INPUT_ERROR, SCTP_SO_NOT_LOCKED);
5707                         } else if ((inp != NULL) && (stcb == NULL)) {
5708                                 inp_decr = inp;
5709                         }
5710                         SCTP_STAT_INCR(sctps_badsum);
5711                         SCTP_STAT_INCR_COUNTER32(sctps_checksumerrors);
5712                         goto out;
5713                 }
5714         }
5715 #endif
5716         /* Destination port of 0 is illegal, based on RFC4960. */
5717         if (sh->dest_port == 0) {
5718                 SCTP_STAT_INCR(sctps_hdrops);
5719                 goto out;
5720         }
5721         stcb = sctp_findassociation_addr(m, offset, src, dst,
5722             sh, ch, &inp, &net, vrf_id);
5723 #if defined(INET) || defined(INET6)
5724         if ((ch->chunk_type != SCTP_INITIATION) &&
5725             (net != NULL) && (net->port != port)) {
5726                 if (net->port == 0) {
5727                         /* UDP encapsulation turned on. */
5728                         net->mtu -= sizeof(struct udphdr);
5729                         if (stcb->asoc.smallest_mtu > net->mtu) {
5730                                 sctp_pathmtu_adjustment(stcb, net->mtu);
5731                         }
5732                 } else if (port == 0) {
5733                         /* UDP encapsulation turned off. */
5734                         net->mtu += sizeof(struct udphdr);
5735                         /* XXX Update smallest_mtu */
5736                 }
5737                 net->port = port;
5738         }
5739 #endif
5740         if (net != NULL) {
5741                 net->flowtype = mflowtype;
5742                 net->flowid = mflowid;
5743         }
5744         if (inp == NULL) {
5745                 SCTP_STAT_INCR(sctps_noport);
5746                 if (badport_bandlim(BANDLIM_SCTP_OOTB) < 0) {
5747                         goto out;
5748                 }
5749                 if (ch->chunk_type == SCTP_SHUTDOWN_ACK) {
5750                         sctp_send_shutdown_complete2(src, dst, sh,
5751                             mflowtype, mflowid, fibnum,
5752                             vrf_id, port);
5753                         goto out;
5754                 }
5755                 if (ch->chunk_type == SCTP_SHUTDOWN_COMPLETE) {
5756                         goto out;
5757                 }
5758                 if (ch->chunk_type != SCTP_ABORT_ASSOCIATION) {
5759                         if ((SCTP_BASE_SYSCTL(sctp_blackhole) == 0) ||
5760                             ((SCTP_BASE_SYSCTL(sctp_blackhole) == 1) &&
5761                             (ch->chunk_type != SCTP_INIT))) {
5762                                 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
5763                                     "Out of the blue");
5764                                 sctp_send_abort(m, iphlen, src, dst,
5765                                     sh, 0, op_err,
5766                                     mflowtype, mflowid, fibnum,
5767                                     vrf_id, port);
5768                         }
5769                 }
5770                 goto out;
5771         } else if (stcb == NULL) {
5772                 inp_decr = inp;
5773         }
5774 #ifdef IPSEC
5775         /*-
5776          * I very much doubt any of the IPSEC stuff will work but I have no
5777          * idea, so I will leave it in place.
5778          */
5779         if (inp != NULL) {
5780                 switch (dst->sa_family) {
5781 #ifdef INET
5782                 case AF_INET:
5783                         if (ipsec4_in_reject(m, &inp->ip_inp.inp)) {
5784                                 SCTP_STAT_INCR(sctps_hdrops);
5785                                 goto out;
5786                         }
5787                         break;
5788 #endif
5789 #ifdef INET6
5790                 case AF_INET6:
5791                         if (ipsec6_in_reject(m, &inp->ip_inp.inp)) {
5792                                 SCTP_STAT_INCR(sctps_hdrops);
5793                                 goto out;
5794                         }
5795                         break;
5796 #endif
5797                 default:
5798                         break;
5799                 }
5800         }
5801 #endif
5802         SCTPDBG(SCTP_DEBUG_INPUT1, "Ok, Common input processing called, m:%p iphlen:%d offset:%d length:%d stcb:%p\n",
5803             (void *)m, iphlen, offset, length, (void *)stcb);
5804         if (stcb) {
5805                 /* always clear this before beginning a packet */
5806                 stcb->asoc.authenticated = 0;
5807                 stcb->asoc.seen_a_sack_this_pkt = 0;
5808                 SCTPDBG(SCTP_DEBUG_INPUT1, "stcb:%p state:%x\n",
5809                     (void *)stcb, stcb->asoc.state);
5810
5811                 if ((stcb->asoc.state & SCTP_STATE_WAS_ABORTED) ||
5812                     (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED)) {
5813                         /*-
5814                          * If we hit here, we had a ref count
5815                          * up when the assoc was aborted and the
5816                          * timer is clearing out the assoc, we should
5817                          * NOT respond to any packet.. its OOTB.
5818                          */
5819                         SCTP_TCB_UNLOCK(stcb);
5820                         stcb = NULL;
5821                         snprintf(msg, sizeof(msg), "OOTB, %s:%d at %s", __FILE__, __LINE__, __func__);
5822                         op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
5823                             msg);
5824                         sctp_handle_ootb(m, iphlen, offset, src, dst, sh, inp, op_err,
5825                             mflowtype, mflowid, inp->fibnum,
5826                             vrf_id, port);
5827                         goto out;
5828                 }
5829         }
5830         if (IS_SCTP_CONTROL(ch)) {
5831                 /* process the control portion of the SCTP packet */
5832                 /* sa_ignore NO_NULL_CHK */
5833                 stcb = sctp_process_control(m, iphlen, &offset, length,
5834                     src, dst, sh, ch,
5835                     inp, stcb, &net, &fwd_tsn_seen,
5836                     mflowtype, mflowid, fibnum,
5837                     vrf_id, port);
5838                 if (stcb) {
5839                         /*
5840                          * This covers us if the cookie-echo was there and
5841                          * it changes our INP.
5842                          */
5843                         inp = stcb->sctp_ep;
5844 #if defined(INET) || defined(INET6)
5845                         if ((ch->chunk_type != SCTP_INITIATION) &&
5846                             (net != NULL) && (net->port != port)) {
5847                                 if (net->port == 0) {
5848                                         /* UDP encapsulation turned on. */
5849                                         net->mtu -= sizeof(struct udphdr);
5850                                         if (stcb->asoc.smallest_mtu > net->mtu) {
5851                                                 sctp_pathmtu_adjustment(stcb, net->mtu);
5852                                         }
5853                                 } else if (port == 0) {
5854                                         /* UDP encapsulation turned off. */
5855                                         net->mtu += sizeof(struct udphdr);
5856                                         /* XXX Update smallest_mtu */
5857                                 }
5858                                 net->port = port;
5859                         }
5860 #endif
5861                 }
5862         } else {
5863                 /*
5864                  * no control chunks, so pre-process DATA chunks (these
5865                  * checks are taken care of by control processing)
5866                  */
5867
5868                 /*
5869                  * if DATA only packet, and auth is required, then punt...
5870                  * can't have authenticated without any AUTH (control)
5871                  * chunks
5872                  */
5873                 if ((stcb != NULL) &&
5874                     (stcb->asoc.auth_supported == 1) &&
5875                     sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.local_auth_chunks)) {
5876                         /* "silently" ignore */
5877                         SCTP_STAT_INCR(sctps_recvauthmissing);
5878                         goto out;
5879                 }
5880                 if (stcb == NULL) {
5881                         /* out of the blue DATA chunk */
5882                         snprintf(msg, sizeof(msg), "OOTB, %s:%d at %s", __FILE__, __LINE__, __func__);
5883                         op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
5884                             msg);
5885                         sctp_handle_ootb(m, iphlen, offset, src, dst, sh, inp, op_err,
5886                             mflowtype, mflowid, fibnum,
5887                             vrf_id, port);
5888                         goto out;
5889                 }
5890                 if (stcb->asoc.my_vtag != ntohl(sh->v_tag)) {
5891                         /* v_tag mismatch! */
5892                         SCTP_STAT_INCR(sctps_badvtag);
5893                         goto out;
5894                 }
5895         }
5896
5897         if (stcb == NULL) {
5898                 /*
5899                  * no valid TCB for this packet, or we found it's a bad
5900                  * packet while processing control, or we're done with this
5901                  * packet (done or skip rest of data), so we drop it...
5902                  */
5903                 goto out;
5904         }
5905         /*
5906          * DATA chunk processing
5907          */
5908         /* plow through the data chunks while length > offset */
5909
5910         /*
5911          * Rest should be DATA only.  Check authentication state if AUTH for
5912          * DATA is required.
5913          */
5914         if ((length > offset) &&
5915             (stcb != NULL) &&
5916             (stcb->asoc.auth_supported == 1) &&
5917             sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.local_auth_chunks) &&
5918             !stcb->asoc.authenticated) {
5919                 /* "silently" ignore */
5920                 SCTP_STAT_INCR(sctps_recvauthmissing);
5921                 SCTPDBG(SCTP_DEBUG_AUTH1,
5922                     "Data chunk requires AUTH, skipped\n");
5923                 goto trigger_send;
5924         }
5925         if (length > offset) {
5926                 int retval;
5927
5928                 /*
5929                  * First check to make sure our state is correct. We would
5930                  * not get here unless we really did have a tag, so we don't
5931                  * abort if this happens, just dump the chunk silently.
5932                  */
5933                 switch (SCTP_GET_STATE(&stcb->asoc)) {
5934                 case SCTP_STATE_COOKIE_ECHOED:
5935                         /*
5936                          * we consider data with valid tags in this state
5937                          * shows us the cookie-ack was lost. Imply it was
5938                          * there.
5939                          */
5940                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
5941                                 sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
5942                                     stcb->asoc.overall_error_count,
5943                                     0,
5944                                     SCTP_FROM_SCTP_INPUT,
5945                                     __LINE__);
5946                         }
5947                         stcb->asoc.overall_error_count = 0;
5948                         sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb, net);
5949                         break;
5950                 case SCTP_STATE_COOKIE_WAIT:
5951                         /*
5952                          * We consider OOTB any data sent during asoc setup.
5953                          */
5954                         snprintf(msg, sizeof(msg), "OOTB, %s:%d at %s", __FILE__, __LINE__, __func__);
5955                         op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
5956                             msg);
5957                         sctp_handle_ootb(m, iphlen, offset, src, dst, sh, inp, op_err,
5958                             mflowtype, mflowid, inp->fibnum,
5959                             vrf_id, port);
5960                         goto out;
5961                         /* sa_ignore NOTREACHED */
5962                         break;
5963                 case SCTP_STATE_EMPTY:  /* should not happen */
5964                 case SCTP_STATE_INUSE:  /* should not happen */
5965                 case SCTP_STATE_SHUTDOWN_RECEIVED:      /* This is a peer error */
5966                 case SCTP_STATE_SHUTDOWN_ACK_SENT:
5967                 default:
5968                         goto out;
5969                         /* sa_ignore NOTREACHED */
5970                         break;
5971                 case SCTP_STATE_OPEN:
5972                 case SCTP_STATE_SHUTDOWN_SENT:
5973                         break;
5974                 }
5975                 /* plow through the data chunks while length > offset */
5976                 retval = sctp_process_data(mm, iphlen, &offset, length,
5977                     inp, stcb, net, &high_tsn);
5978                 if (retval == 2) {
5979                         /*
5980                          * The association aborted, NO UNLOCK needed since
5981                          * the association is destroyed.
5982                          */
5983                         stcb = NULL;
5984                         goto out;
5985                 }
5986                 data_processed = 1;
5987                 /*
5988                  * Anything important needs to have been m_copy'ed in
5989                  * process_data
5990                  */
5991         }
5992         /* take care of ecn */
5993         if ((data_processed == 1) &&
5994             (stcb->asoc.ecn_supported == 1) &&
5995             ((ecn_bits & SCTP_CE_BITS) == SCTP_CE_BITS)) {
5996                 /* Yep, we need to add a ECNE */
5997                 sctp_send_ecn_echo(stcb, net, high_tsn);
5998         }
5999         if ((data_processed == 0) && (fwd_tsn_seen)) {
6000                 int was_a_gap;
6001                 uint32_t highest_tsn;
6002
6003                 if (SCTP_TSN_GT(stcb->asoc.highest_tsn_inside_nr_map, stcb->asoc.highest_tsn_inside_map)) {
6004                         highest_tsn = stcb->asoc.highest_tsn_inside_nr_map;
6005                 } else {
6006                         highest_tsn = stcb->asoc.highest_tsn_inside_map;
6007                 }
6008                 was_a_gap = SCTP_TSN_GT(highest_tsn, stcb->asoc.cumulative_tsn);
6009                 stcb->asoc.send_sack = 1;
6010                 sctp_sack_check(stcb, was_a_gap);
6011         } else if (fwd_tsn_seen) {
6012                 stcb->asoc.send_sack = 1;
6013         }
6014         /* trigger send of any chunks in queue... */
6015 trigger_send:
6016 #ifdef SCTP_AUDITING_ENABLED
6017         sctp_audit_log(0xE0, 2);
6018         sctp_auditing(1, inp, stcb, net);
6019 #endif
6020         SCTPDBG(SCTP_DEBUG_INPUT1,
6021             "Check for chunk output prw:%d tqe:%d tf=%d\n",
6022             stcb->asoc.peers_rwnd,
6023             TAILQ_EMPTY(&stcb->asoc.control_send_queue),
6024             stcb->asoc.total_flight);
6025         un_sent = (stcb->asoc.total_output_queue_size - stcb->asoc.total_flight);
6026         if (!TAILQ_EMPTY(&stcb->asoc.control_send_queue)) {
6027                 cnt_ctrl_ready = stcb->asoc.ctrl_queue_cnt - stcb->asoc.ecn_echo_cnt_onq;
6028         }
6029         if (!TAILQ_EMPTY(&stcb->asoc.asconf_send_queue) ||
6030             cnt_ctrl_ready ||
6031             stcb->asoc.trigger_reset ||
6032             ((un_sent) &&
6033             (stcb->asoc.peers_rwnd > 0 ||
6034             (stcb->asoc.peers_rwnd <= 0 && stcb->asoc.total_flight == 0)))) {
6035                 SCTPDBG(SCTP_DEBUG_INPUT3, "Calling chunk OUTPUT\n");
6036                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC, SCTP_SO_NOT_LOCKED);
6037                 SCTPDBG(SCTP_DEBUG_INPUT3, "chunk OUTPUT returns\n");
6038         }
6039 #ifdef SCTP_AUDITING_ENABLED
6040         sctp_audit_log(0xE0, 3);
6041         sctp_auditing(2, inp, stcb, net);
6042 #endif
6043 out:
6044         if (stcb != NULL) {
6045                 SCTP_TCB_UNLOCK(stcb);
6046         }
6047         if (inp_decr != NULL) {
6048                 /* reduce ref-count */
6049                 SCTP_INP_WLOCK(inp_decr);
6050                 SCTP_INP_DECR_REF(inp_decr);
6051                 SCTP_INP_WUNLOCK(inp_decr);
6052         }
6053         return;
6054 }
6055
6056 #ifdef INET
6057 void
6058 sctp_input_with_port(struct mbuf *i_pak, int off, uint16_t port)
6059 {
6060         struct mbuf *m;
6061         int iphlen;
6062         uint32_t vrf_id = 0;
6063         uint8_t ecn_bits;
6064         struct sockaddr_in src, dst;
6065         struct ip *ip;
6066         struct sctphdr *sh;
6067         struct sctp_chunkhdr *ch;
6068         int length, offset;
6069 #if !defined(SCTP_WITH_NO_CSUM)
6070         uint8_t compute_crc;
6071 #endif
6072         uint32_t mflowid;
6073         uint8_t mflowtype;
6074         uint16_t fibnum;
6075
6076         iphlen = off;
6077         if (SCTP_GET_PKT_VRFID(i_pak, vrf_id)) {
6078                 SCTP_RELEASE_PKT(i_pak);
6079                 return;
6080         }
6081         m = SCTP_HEADER_TO_CHAIN(i_pak);
6082 #ifdef SCTP_MBUF_LOGGING
6083         /* Log in any input mbufs */
6084         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
6085                 sctp_log_mbc(m, SCTP_MBUF_INPUT);
6086         }
6087 #endif
6088 #ifdef SCTP_PACKET_LOGGING
6089         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING) {
6090                 sctp_packet_log(m);
6091         }
6092 #endif
6093         SCTPDBG(SCTP_DEBUG_CRCOFFLOAD,
6094             "sctp_input(): Packet of length %d received on %s with csum_flags 0x%b.\n",
6095             m->m_pkthdr.len,
6096             if_name(m->m_pkthdr.rcvif),
6097             (int)m->m_pkthdr.csum_flags, CSUM_BITS);
6098         mflowid = m->m_pkthdr.flowid;
6099         mflowtype = M_HASHTYPE_GET(m);
6100         fibnum = M_GETFIB(m);
6101         SCTP_STAT_INCR(sctps_recvpackets);
6102         SCTP_STAT_INCR_COUNTER64(sctps_inpackets);
6103         /* Get IP, SCTP, and first chunk header together in the first mbuf. */
6104         offset = iphlen + sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr);
6105         if (SCTP_BUF_LEN(m) < offset) {
6106                 if ((m = m_pullup(m, offset)) == NULL) {
6107                         SCTP_STAT_INCR(sctps_hdrops);
6108                         return;
6109                 }
6110         }
6111         ip = mtod(m, struct ip *);
6112         sh = (struct sctphdr *)((caddr_t)ip + iphlen);
6113         ch = (struct sctp_chunkhdr *)((caddr_t)sh + sizeof(struct sctphdr));
6114         offset -= sizeof(struct sctp_chunkhdr);
6115         memset(&src, 0, sizeof(struct sockaddr_in));
6116         src.sin_family = AF_INET;
6117         src.sin_len = sizeof(struct sockaddr_in);
6118         src.sin_port = sh->src_port;
6119         src.sin_addr = ip->ip_src;
6120         memset(&dst, 0, sizeof(struct sockaddr_in));
6121         dst.sin_family = AF_INET;
6122         dst.sin_len = sizeof(struct sockaddr_in);
6123         dst.sin_port = sh->dest_port;
6124         dst.sin_addr = ip->ip_dst;
6125         length = ntohs(ip->ip_len);
6126         /* Validate mbuf chain length with IP payload length. */
6127         if (SCTP_HEADER_LEN(m) != length) {
6128                 SCTPDBG(SCTP_DEBUG_INPUT1,
6129                     "sctp_input() length:%d reported length:%d\n", length, SCTP_HEADER_LEN(m));
6130                 SCTP_STAT_INCR(sctps_hdrops);
6131                 goto out;
6132         }
6133         /* SCTP does not allow broadcasts or multicasts */
6134         if (IN_MULTICAST(ntohl(dst.sin_addr.s_addr))) {
6135                 goto out;
6136         }
6137         if (SCTP_IS_IT_BROADCAST(dst.sin_addr, m)) {
6138                 goto out;
6139         }
6140         ecn_bits = ip->ip_tos;
6141 #if defined(SCTP_WITH_NO_CSUM)
6142         SCTP_STAT_INCR(sctps_recvnocrc);
6143 #else
6144         if (m->m_pkthdr.csum_flags & CSUM_SCTP_VALID) {
6145                 SCTP_STAT_INCR(sctps_recvhwcrc);
6146                 compute_crc = 0;
6147         } else {
6148                 SCTP_STAT_INCR(sctps_recvswcrc);
6149                 compute_crc = 1;
6150         }
6151 #endif
6152         sctp_common_input_processing(&m, iphlen, offset, length,
6153             (struct sockaddr *)&src,
6154             (struct sockaddr *)&dst,
6155             sh, ch,
6156 #if !defined(SCTP_WITH_NO_CSUM)
6157             compute_crc,
6158 #endif
6159             ecn_bits,
6160             mflowtype, mflowid, fibnum,
6161             vrf_id, port);
6162 out:
6163         if (m) {
6164                 sctp_m_freem(m);
6165         }
6166         return;
6167 }
6168
6169 #if defined(__FreeBSD__) && defined(SCTP_MCORE_INPUT) && defined(SMP)
6170 extern int *sctp_cpuarry;
6171 #endif
6172
6173 int
6174 sctp_input(struct mbuf **mp, int *offp, int proto SCTP_UNUSED)
6175 {
6176         struct mbuf *m;
6177         int off;
6178
6179         m = *mp;
6180         off = *offp;
6181 #if defined(__FreeBSD__) && defined(SCTP_MCORE_INPUT) && defined(SMP)
6182         if (mp_ncpus > 1) {
6183                 struct ip *ip;
6184                 struct sctphdr *sh;
6185                 int offset;
6186                 int cpu_to_use;
6187                 uint32_t flowid, tag;
6188
6189                 if (M_HASHTYPE_GET(m) != M_HASHTYPE_NONE) {
6190                         flowid = m->m_pkthdr.flowid;
6191                 } else {
6192                         /*
6193                          * No flow id built by lower layers fix it so we
6194                          * create one.
6195                          */
6196                         offset = off + sizeof(struct sctphdr);
6197                         if (SCTP_BUF_LEN(m) < offset) {
6198                                 if ((m = m_pullup(m, offset)) == NULL) {
6199                                         SCTP_STAT_INCR(sctps_hdrops);
6200                                         return (IPPROTO_DONE);
6201                                 }
6202                         }
6203                         ip = mtod(m, struct ip *);
6204                         sh = (struct sctphdr *)((caddr_t)ip + off);
6205                         tag = htonl(sh->v_tag);
6206                         flowid = tag ^ ntohs(sh->dest_port) ^ ntohs(sh->src_port);
6207                         m->m_pkthdr.flowid = flowid;
6208                         M_HASHTYPE_SET(m, M_HASHTYPE_OPAQUE_HASH);
6209                 }
6210                 cpu_to_use = sctp_cpuarry[flowid % mp_ncpus];
6211                 sctp_queue_to_mcore(m, off, cpu_to_use);
6212                 return (IPPROTO_DONE);
6213         }
6214 #endif
6215         sctp_input_with_port(m, off, 0);
6216         return (IPPROTO_DONE);
6217 }
6218 #endif