xref: /freebsd/sys/netinet/sctp_input.c (revision 3c6f35363034720fb16505d13b748ecc1c5e7e93)
1f8829a4aSRandall Stewart /*-
2b1006367SRandall Stewart  * Copyright (c) 2001-2007, by Cisco Systems, Inc. All rights reserved.
3f8829a4aSRandall Stewart  *
4f8829a4aSRandall Stewart  * Redistribution and use in source and binary forms, with or without
5f8829a4aSRandall Stewart  * modification, are permitted provided that the following conditions are met:
6f8829a4aSRandall Stewart  *
7f8829a4aSRandall Stewart  * a) Redistributions of source code must retain the above copyright notice,
8f8829a4aSRandall Stewart  *   this list of conditions and the following disclaimer.
9f8829a4aSRandall Stewart  *
10f8829a4aSRandall Stewart  * b) Redistributions in binary form must reproduce the above copyright
11f8829a4aSRandall Stewart  *    notice, this list of conditions and the following disclaimer in
12f8829a4aSRandall Stewart  *   the documentation and/or other materials provided with the distribution.
13f8829a4aSRandall Stewart  *
14f8829a4aSRandall Stewart  * c) Neither the name of Cisco Systems, Inc. nor the names of its
15f8829a4aSRandall Stewart  *    contributors may be used to endorse or promote products derived
16f8829a4aSRandall Stewart  *    from this software without specific prior written permission.
17f8829a4aSRandall Stewart  *
18f8829a4aSRandall Stewart  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
19f8829a4aSRandall Stewart  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
20f8829a4aSRandall Stewart  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21f8829a4aSRandall Stewart  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
22f8829a4aSRandall Stewart  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
23f8829a4aSRandall Stewart  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
24f8829a4aSRandall Stewart  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
25f8829a4aSRandall Stewart  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
26f8829a4aSRandall Stewart  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
27f8829a4aSRandall Stewart  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
28f8829a4aSRandall Stewart  * THE POSSIBILITY OF SUCH DAMAGE.
29f8829a4aSRandall Stewart  */
30f8829a4aSRandall Stewart 
31f8829a4aSRandall Stewart /* $KAME: sctp_input.c,v 1.27 2005/03/06 16:04:17 itojun Exp $	 */
32f8829a4aSRandall Stewart 
33f8829a4aSRandall Stewart #include <sys/cdefs.h>
34f8829a4aSRandall Stewart __FBSDID("$FreeBSD$");
35f8829a4aSRandall Stewart 
36f8829a4aSRandall Stewart #include <netinet/sctp_os.h>
37f8829a4aSRandall Stewart #include <netinet/sctp_var.h>
3842551e99SRandall Stewart #include <netinet/sctp_sysctl.h>
39f8829a4aSRandall Stewart #include <netinet/sctp_pcb.h>
40f8829a4aSRandall Stewart #include <netinet/sctp_header.h>
41f8829a4aSRandall Stewart #include <netinet/sctputil.h>
42f8829a4aSRandall Stewart #include <netinet/sctp_output.h>
43f8829a4aSRandall Stewart #include <netinet/sctp_input.h>
44f8829a4aSRandall Stewart #include <netinet/sctp_auth.h>
45f8829a4aSRandall Stewart #include <netinet/sctp_indata.h>
46f8829a4aSRandall Stewart #include <netinet/sctp_asconf.h>
47207304d4SRandall Stewart #include <netinet/sctp_bsd_addr.h>
48f8829a4aSRandall Stewart 
49a5d547adSRandall Stewart 
50a5d547adSRandall Stewart 
51f8829a4aSRandall Stewart static void
52f8829a4aSRandall Stewart sctp_stop_all_cookie_timers(struct sctp_tcb *stcb)
53f8829a4aSRandall Stewart {
54f8829a4aSRandall Stewart 	struct sctp_nets *net;
55f8829a4aSRandall Stewart 
56a5d547adSRandall Stewart 	/*
57a5d547adSRandall Stewart 	 * This now not only stops all cookie timers it also stops any INIT
58a5d547adSRandall Stewart 	 * timers as well. This will make sure that the timers are stopped
59a5d547adSRandall Stewart 	 * in all collision cases.
60a5d547adSRandall Stewart 	 */
61f8829a4aSRandall Stewart 	SCTP_TCB_LOCK_ASSERT(stcb);
62f8829a4aSRandall Stewart 	TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
63a5d547adSRandall Stewart 		if (net->rxt_timer.type == SCTP_TIMER_TYPE_COOKIE) {
64f8829a4aSRandall Stewart 			sctp_timer_stop(SCTP_TIMER_TYPE_COOKIE,
65f8829a4aSRandall Stewart 			    stcb->sctp_ep,
66f8829a4aSRandall Stewart 			    stcb,
67a5d547adSRandall Stewart 			    net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_1);
68a5d547adSRandall Stewart 		} else if (net->rxt_timer.type == SCTP_TIMER_TYPE_INIT) {
69a5d547adSRandall Stewart 			sctp_timer_stop(SCTP_TIMER_TYPE_INIT,
70a5d547adSRandall Stewart 			    stcb->sctp_ep,
71a5d547adSRandall Stewart 			    stcb,
72a5d547adSRandall Stewart 			    net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_2);
73f8829a4aSRandall Stewart 		}
74f8829a4aSRandall Stewart 	}
75f8829a4aSRandall Stewart }
76f8829a4aSRandall Stewart 
77f8829a4aSRandall Stewart /* INIT handler */
78f8829a4aSRandall Stewart static void
79f8829a4aSRandall Stewart sctp_handle_init(struct mbuf *m, int iphlen, int offset, struct sctphdr *sh,
80f8829a4aSRandall Stewart     struct sctp_init_chunk *cp, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
8117205eccSRandall Stewart     struct sctp_nets *net, int *abort_no_unlock, uint32_t vrf_id,
8217205eccSRandall Stewart     uint32_t table_id)
83f8829a4aSRandall Stewart {
84f8829a4aSRandall Stewart 	struct sctp_init *init;
85f8829a4aSRandall Stewart 	struct mbuf *op_err;
86f8829a4aSRandall Stewart 	uint32_t init_limit;
87f8829a4aSRandall Stewart 
88ad81507eSRandall Stewart 	SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_init: handling INIT tcb:%p\n",
89ad81507eSRandall Stewart 	    stcb);
90f8829a4aSRandall Stewart 	op_err = NULL;
91f8829a4aSRandall Stewart 	init = &cp->init;
92f8829a4aSRandall Stewart 	/* First are we accepting? */
93f8829a4aSRandall Stewart 	if ((inp->sctp_socket->so_qlimit == 0) && (stcb == NULL)) {
94ad81507eSRandall Stewart 		SCTPDBG(SCTP_DEBUG_INPUT2,
95ad81507eSRandall Stewart 		    "sctp_handle_init: Abort, so_qlimit:%d\n",
96ad81507eSRandall Stewart 		    inp->sctp_socket->so_qlimit);
97f8829a4aSRandall Stewart 		/*
98f8829a4aSRandall Stewart 		 * FIX ME ?? What about TCP model and we have a
99f8829a4aSRandall Stewart 		 * match/restart case?
100f8829a4aSRandall Stewart 		 */
10117205eccSRandall Stewart 		sctp_abort_association(inp, stcb, m, iphlen, sh, op_err,
10217205eccSRandall Stewart 		    vrf_id, table_id);
103bff64a4dSRandall Stewart 		if (stcb)
104bff64a4dSRandall Stewart 			*abort_no_unlock = 1;
105f8829a4aSRandall Stewart 		return;
106f8829a4aSRandall Stewart 	}
107f8829a4aSRandall Stewart 	if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_init_chunk)) {
108f8829a4aSRandall Stewart 		/* Invalid length */
109f8829a4aSRandall Stewart 		op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
11017205eccSRandall Stewart 		sctp_abort_association(inp, stcb, m, iphlen, sh, op_err,
11117205eccSRandall Stewart 		    vrf_id, table_id);
112bff64a4dSRandall Stewart 		if (stcb)
113bff64a4dSRandall Stewart 			*abort_no_unlock = 1;
114f8829a4aSRandall Stewart 		return;
115f8829a4aSRandall Stewart 	}
116f8829a4aSRandall Stewart 	/* validate parameters */
117f8829a4aSRandall Stewart 	if (init->initiate_tag == 0) {
118f8829a4aSRandall Stewart 		/* protocol error... send abort */
119f8829a4aSRandall Stewart 		op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
12017205eccSRandall Stewart 		sctp_abort_association(inp, stcb, m, iphlen, sh, op_err,
12117205eccSRandall Stewart 		    vrf_id, table_id);
122bff64a4dSRandall Stewart 		if (stcb)
123bff64a4dSRandall Stewart 			*abort_no_unlock = 1;
124f8829a4aSRandall Stewart 		return;
125f8829a4aSRandall Stewart 	}
126f8829a4aSRandall Stewart 	if (ntohl(init->a_rwnd) < SCTP_MIN_RWND) {
127f8829a4aSRandall Stewart 		/* invalid parameter... send abort */
128f8829a4aSRandall Stewart 		op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
12917205eccSRandall Stewart 		sctp_abort_association(inp, stcb, m, iphlen, sh, op_err,
13017205eccSRandall Stewart 		    vrf_id, table_id);
131f8829a4aSRandall Stewart 		return;
132f8829a4aSRandall Stewart 	}
133f8829a4aSRandall Stewart 	if (init->num_inbound_streams == 0) {
134f8829a4aSRandall Stewart 		/* protocol error... send abort */
135f8829a4aSRandall Stewart 		op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
13617205eccSRandall Stewart 		sctp_abort_association(inp, stcb, m, iphlen, sh, op_err,
13717205eccSRandall Stewart 		    vrf_id, table_id);
138bff64a4dSRandall Stewart 		if (stcb)
139bff64a4dSRandall Stewart 			*abort_no_unlock = 1;
140f8829a4aSRandall Stewart 		return;
141f8829a4aSRandall Stewart 	}
142f8829a4aSRandall Stewart 	if (init->num_outbound_streams == 0) {
143f8829a4aSRandall Stewart 		/* protocol error... send abort */
144f8829a4aSRandall Stewart 		op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
14517205eccSRandall Stewart 		sctp_abort_association(inp, stcb, m, iphlen, sh, op_err,
14617205eccSRandall Stewart 		    vrf_id, table_id);
147bff64a4dSRandall Stewart 		if (stcb)
148bff64a4dSRandall Stewart 			*abort_no_unlock = 1;
149f8829a4aSRandall Stewart 		return;
150f8829a4aSRandall Stewart 	}
151f8829a4aSRandall Stewart 	init_limit = offset + ntohs(cp->ch.chunk_length);
152f8829a4aSRandall Stewart 	if (sctp_validate_init_auth_params(m, offset + sizeof(*cp),
153f8829a4aSRandall Stewart 	    init_limit)) {
154f8829a4aSRandall Stewart 		/* auth parameter(s) error... send abort */
15517205eccSRandall Stewart 		sctp_abort_association(inp, stcb, m, iphlen, sh, NULL, vrf_id,
15617205eccSRandall Stewart 		    table_id);
157bff64a4dSRandall Stewart 		if (stcb)
158bff64a4dSRandall Stewart 			*abort_no_unlock = 1;
159f8829a4aSRandall Stewart 		return;
160f8829a4aSRandall Stewart 	}
161f8829a4aSRandall Stewart 	/* send an INIT-ACK w/cookie */
162ad81507eSRandall Stewart 	SCTPDBG(SCTP_DEBUG_INPUT3, "sctp_handle_init: sending INIT-ACK\n");
16317205eccSRandall Stewart 	sctp_send_initiate_ack(inp, stcb, m, iphlen, offset, sh, cp, vrf_id,
16417205eccSRandall Stewart 	    table_id);
165f8829a4aSRandall Stewart }
166f8829a4aSRandall Stewart 
167f8829a4aSRandall Stewart /*
168f8829a4aSRandall Stewart  * process peer "INIT/INIT-ACK" chunk returns value < 0 on error
169f8829a4aSRandall Stewart  */
170f8829a4aSRandall Stewart static int
171f8829a4aSRandall Stewart sctp_process_init(struct sctp_init_chunk *cp, struct sctp_tcb *stcb,
172f8829a4aSRandall Stewart     struct sctp_nets *net)
173f8829a4aSRandall Stewart {
174f8829a4aSRandall Stewart 	struct sctp_init *init;
175f8829a4aSRandall Stewart 	struct sctp_association *asoc;
176f8829a4aSRandall Stewart 	struct sctp_nets *lnet;
177f8829a4aSRandall Stewart 	unsigned int i;
178f8829a4aSRandall Stewart 
179f8829a4aSRandall Stewart 	init = &cp->init;
180f8829a4aSRandall Stewart 	asoc = &stcb->asoc;
181f8829a4aSRandall Stewart 	/* save off parameters */
182f8829a4aSRandall Stewart 	asoc->peer_vtag = ntohl(init->initiate_tag);
183f8829a4aSRandall Stewart 	asoc->peers_rwnd = ntohl(init->a_rwnd);
184f8829a4aSRandall Stewart 	if (TAILQ_FIRST(&asoc->nets)) {
185f8829a4aSRandall Stewart 		/* update any ssthresh's that may have a default */
186f8829a4aSRandall Stewart 		TAILQ_FOREACH(lnet, &asoc->nets, sctp_next) {
187f8829a4aSRandall Stewart 			lnet->ssthresh = asoc->peers_rwnd;
188f8829a4aSRandall Stewart 
189f8829a4aSRandall Stewart #if defined(SCTP_CWND_MONITOR) || defined(SCTP_CWND_LOGGING)
190f8829a4aSRandall Stewart 			sctp_log_cwnd(stcb, lnet, 0, SCTP_CWND_INITIALIZATION);
191f8829a4aSRandall Stewart #endif
192f8829a4aSRandall Stewart 
193f8829a4aSRandall Stewart 		}
194f8829a4aSRandall Stewart 	}
1956a91f103SRandall Stewart 	SCTP_TCB_SEND_LOCK(stcb);
196f8829a4aSRandall Stewart 	if (asoc->pre_open_streams > ntohs(init->num_inbound_streams)) {
197f8829a4aSRandall Stewart 		unsigned int newcnt;
198f8829a4aSRandall Stewart 		struct sctp_stream_out *outs;
199f8829a4aSRandall Stewart 		struct sctp_stream_queue_pending *sp;
200f8829a4aSRandall Stewart 
201f8829a4aSRandall Stewart 		/* cut back on number of streams */
202f8829a4aSRandall Stewart 		newcnt = ntohs(init->num_inbound_streams);
203f8829a4aSRandall Stewart 		/* This if is probably not needed but I am cautious */
204f8829a4aSRandall Stewart 		if (asoc->strmout) {
205f8829a4aSRandall Stewart 			/* First make sure no data chunks are trapped */
206f8829a4aSRandall Stewart 			for (i = newcnt; i < asoc->pre_open_streams; i++) {
207f8829a4aSRandall Stewart 				outs = &asoc->strmout[i];
208f8829a4aSRandall Stewart 				sp = TAILQ_FIRST(&outs->outqueue);
209f8829a4aSRandall Stewart 				while (sp) {
210f8829a4aSRandall Stewart 					TAILQ_REMOVE(&outs->outqueue, sp,
211f8829a4aSRandall Stewart 					    next);
212f8829a4aSRandall Stewart 					asoc->stream_queue_cnt--;
213f8829a4aSRandall Stewart 					sctp_ulp_notify(SCTP_NOTIFY_SPECIAL_SP_FAIL,
214f8829a4aSRandall Stewart 					    stcb, SCTP_NOTIFY_DATAGRAM_UNSENT,
215f8829a4aSRandall Stewart 					    sp);
216f8829a4aSRandall Stewart 					if (sp->data) {
217f8829a4aSRandall Stewart 						sctp_m_freem(sp->data);
218f8829a4aSRandall Stewart 						sp->data = NULL;
219f8829a4aSRandall Stewart 					}
220f8829a4aSRandall Stewart 					sctp_free_remote_addr(sp->net);
221f8829a4aSRandall Stewart 					sp->net = NULL;
222f8829a4aSRandall Stewart 					/* Free the chunk */
223ad81507eSRandall Stewart 					SCTP_PRINTF("sp:%p tcb:%p weird free case\n",
224e349e6b8SRuslan Ermilov 					    sp, stcb);
225f8829a4aSRandall Stewart 
226f8829a4aSRandall Stewart 					sctp_free_a_strmoq(stcb, sp);
2273c503c28SRandall Stewart 					/* sa_ignore FREED_MEMORY */
228f8829a4aSRandall Stewart 					sp = TAILQ_FIRST(&outs->outqueue);
229f8829a4aSRandall Stewart 				}
230f8829a4aSRandall Stewart 			}
231f8829a4aSRandall Stewart 		}
232f8829a4aSRandall Stewart 		/* cut back the count and abandon the upper streams */
233f8829a4aSRandall Stewart 		asoc->pre_open_streams = newcnt;
234f8829a4aSRandall Stewart 	}
2356a91f103SRandall Stewart 	SCTP_TCB_SEND_UNLOCK(stcb);
236f8829a4aSRandall Stewart 	asoc->streamoutcnt = asoc->pre_open_streams;
237f8829a4aSRandall Stewart 	/* init tsn's */
238f8829a4aSRandall Stewart 	asoc->highest_tsn_inside_map = asoc->asconf_seq_in = ntohl(init->initial_tsn) - 1;
239f8829a4aSRandall Stewart #ifdef SCTP_MAP_LOGGING
240f8829a4aSRandall Stewart 	sctp_log_map(0, 5, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
241f8829a4aSRandall Stewart #endif
242f8829a4aSRandall Stewart 	/* This is the next one we expect */
243f8829a4aSRandall Stewart 	asoc->str_reset_seq_in = asoc->asconf_seq_in + 1;
244f8829a4aSRandall Stewart 
245f8829a4aSRandall Stewart 	asoc->mapping_array_base_tsn = ntohl(init->initial_tsn);
246f8829a4aSRandall Stewart 	asoc->cumulative_tsn = asoc->asconf_seq_in;
247f8829a4aSRandall Stewart 	asoc->last_echo_tsn = asoc->asconf_seq_in;
248f8829a4aSRandall Stewart 	asoc->advanced_peer_ack_point = asoc->last_acked_seq;
249f8829a4aSRandall Stewart 	/* open the requested streams */
250207304d4SRandall Stewart 
251f8829a4aSRandall Stewart 	if (asoc->strmin != NULL) {
252f8829a4aSRandall Stewart 		/* Free the old ones */
2536a91f103SRandall Stewart 		struct sctp_queued_to_read *ctl;
2546a91f103SRandall Stewart 
2556a91f103SRandall Stewart 		for (i = 0; i < asoc->streamincnt; i++) {
2566a91f103SRandall Stewart 			ctl = TAILQ_FIRST(&asoc->strmin[i].inqueue);
2576a91f103SRandall Stewart 			while (ctl) {
2586a91f103SRandall Stewart 				TAILQ_REMOVE(&asoc->strmin[i].inqueue, ctl, next);
2596a91f103SRandall Stewart 				sctp_free_remote_addr(ctl->whoFrom);
2606a91f103SRandall Stewart 				sctp_m_freem(ctl->data);
2616a91f103SRandall Stewart 				ctl->data = NULL;
2626a91f103SRandall Stewart 				sctp_free_a_readq(stcb, ctl);
2636a91f103SRandall Stewart 				ctl = TAILQ_FIRST(&asoc->strmin[i].inqueue);
2646a91f103SRandall Stewart 			}
2656a91f103SRandall Stewart 		}
266207304d4SRandall Stewart 		SCTP_FREE(asoc->strmin, SCTP_M_STRMI);
267f8829a4aSRandall Stewart 	}
2686a91f103SRandall Stewart 	asoc->streamincnt = ntohs(init->num_outbound_streams);
2696a91f103SRandall Stewart 	if (asoc->streamincnt > MAX_SCTP_STREAMS) {
2706a91f103SRandall Stewart 		asoc->streamincnt = MAX_SCTP_STREAMS;
2716a91f103SRandall Stewart 	}
272f8829a4aSRandall Stewart 	SCTP_MALLOC(asoc->strmin, struct sctp_stream_in *, asoc->streamincnt *
273207304d4SRandall Stewart 	    sizeof(struct sctp_stream_in), SCTP_M_STRMI);
274f8829a4aSRandall Stewart 	if (asoc->strmin == NULL) {
275f8829a4aSRandall Stewart 		/* we didn't get memory for the streams! */
276ad81507eSRandall Stewart 		SCTPDBG(SCTP_DEBUG_INPUT2, "process_init: couldn't get memory for the streams!\n");
277f8829a4aSRandall Stewart 		return (-1);
278f8829a4aSRandall Stewart 	}
279f8829a4aSRandall Stewart 	for (i = 0; i < asoc->streamincnt; i++) {
280f8829a4aSRandall Stewart 		asoc->strmin[i].stream_no = i;
281f8829a4aSRandall Stewart 		asoc->strmin[i].last_sequence_delivered = 0xffff;
282f8829a4aSRandall Stewart 		/*
283f8829a4aSRandall Stewart 		 * U-stream ranges will be set when the cookie is unpacked.
284f8829a4aSRandall Stewart 		 * Or for the INIT sender they are un set (if pr-sctp not
285f8829a4aSRandall Stewart 		 * supported) when the INIT-ACK arrives.
286f8829a4aSRandall Stewart 		 */
287f8829a4aSRandall Stewart 		TAILQ_INIT(&asoc->strmin[i].inqueue);
2889a6142d8SRandall Stewart 		asoc->strmin[i].delivery_started = 0;
289f8829a4aSRandall Stewart 	}
290f8829a4aSRandall Stewart 	/*
291f8829a4aSRandall Stewart 	 * load_address_from_init will put the addresses into the
292f8829a4aSRandall Stewart 	 * association when the COOKIE is processed or the INIT-ACK is
293f8829a4aSRandall Stewart 	 * processed. Both types of COOKIE's existing and new call this
294f8829a4aSRandall Stewart 	 * routine. It will remove addresses that are no longer in the
295f8829a4aSRandall Stewart 	 * association (for the restarting case where addresses are
296f8829a4aSRandall Stewart 	 * removed). Up front when the INIT arrives we will discard it if it
297f8829a4aSRandall Stewart 	 * is a restart and new addresses have been added.
298f8829a4aSRandall Stewart 	 */
2993c503c28SRandall Stewart 	/* sa_ignore MEMLEAK */
300f8829a4aSRandall Stewart 	return (0);
301f8829a4aSRandall Stewart }
302f8829a4aSRandall Stewart 
303f8829a4aSRandall Stewart /*
304f8829a4aSRandall Stewart  * INIT-ACK message processing/consumption returns value < 0 on error
305f8829a4aSRandall Stewart  */
306f8829a4aSRandall Stewart static int
307f8829a4aSRandall Stewart sctp_process_init_ack(struct mbuf *m, int iphlen, int offset,
308f8829a4aSRandall Stewart     struct sctphdr *sh, struct sctp_init_ack_chunk *cp, struct sctp_tcb *stcb,
30917205eccSRandall Stewart     struct sctp_nets *net, int *abort_no_unlock, uint32_t vrf_id,
31017205eccSRandall Stewart     uint32_t table_id)
311f8829a4aSRandall Stewart {
312f8829a4aSRandall Stewart 	struct sctp_association *asoc;
313f8829a4aSRandall Stewart 	struct mbuf *op_err;
314f8829a4aSRandall Stewart 	int retval, abort_flag;
315f8829a4aSRandall Stewart 	uint32_t initack_limit;
316f8829a4aSRandall Stewart 
317f8829a4aSRandall Stewart 	/* First verify that we have no illegal param's */
318f8829a4aSRandall Stewart 	abort_flag = 0;
319f8829a4aSRandall Stewart 	op_err = NULL;
320f8829a4aSRandall Stewart 
321f8829a4aSRandall Stewart 	op_err = sctp_arethere_unrecognized_parameters(m,
322f8829a4aSRandall Stewart 	    (offset + sizeof(struct sctp_init_chunk)),
323f8829a4aSRandall Stewart 	    &abort_flag, (struct sctp_chunkhdr *)cp);
324f8829a4aSRandall Stewart 	if (abort_flag) {
325f8829a4aSRandall Stewart 		/* Send an abort and notify peer */
326d61a0ae0SRandall Stewart 		sctp_abort_an_association(stcb->sctp_ep, stcb, SCTP_CAUSE_PROTOCOL_VIOLATION, op_err);
327bff64a4dSRandall Stewart 		*abort_no_unlock = 1;
328f8829a4aSRandall Stewart 		return (-1);
329f8829a4aSRandall Stewart 	}
330f8829a4aSRandall Stewart 	asoc = &stcb->asoc;
331f8829a4aSRandall Stewart 	/* process the peer's parameters in the INIT-ACK */
332f8829a4aSRandall Stewart 	retval = sctp_process_init((struct sctp_init_chunk *)cp, stcb, net);
333f8829a4aSRandall Stewart 	if (retval < 0) {
334f8829a4aSRandall Stewart 		return (retval);
335f8829a4aSRandall Stewart 	}
336f8829a4aSRandall Stewart 	initack_limit = offset + ntohs(cp->ch.chunk_length);
337f8829a4aSRandall Stewart 	/* load all addresses */
338f8829a4aSRandall Stewart 	if ((retval = sctp_load_addresses_from_init(stcb, m, iphlen,
339f8829a4aSRandall Stewart 	    (offset + sizeof(struct sctp_init_chunk)), initack_limit, sh,
340f8829a4aSRandall Stewart 	    NULL))) {
341f8829a4aSRandall Stewart 		/* Huh, we should abort */
342ad81507eSRandall Stewart 		SCTPDBG(SCTP_DEBUG_INPUT1,
343ad81507eSRandall Stewart 		    "Load addresses from INIT causes an abort %d\n",
344ad81507eSRandall Stewart 		    retval);
345f8829a4aSRandall Stewart 		sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh,
34617205eccSRandall Stewart 		    NULL, 0, 0);
347bff64a4dSRandall Stewart 		*abort_no_unlock = 1;
348f8829a4aSRandall Stewart 		return (-1);
349f8829a4aSRandall Stewart 	}
350f8829a4aSRandall Stewart 	stcb->asoc.peer_hmac_id = sctp_negotiate_hmacid(stcb->asoc.peer_hmacs,
351f8829a4aSRandall Stewart 	    stcb->asoc.local_hmacs);
352f8829a4aSRandall Stewart 	if (op_err) {
353f8829a4aSRandall Stewart 		sctp_queue_op_err(stcb, op_err);
354f8829a4aSRandall Stewart 		/* queuing will steal away the mbuf chain to the out queue */
355f8829a4aSRandall Stewart 		op_err = NULL;
356f8829a4aSRandall Stewart 	}
357f8829a4aSRandall Stewart 	/* extract the cookie and queue it to "echo" it back... */
358f8829a4aSRandall Stewart 	stcb->asoc.overall_error_count = 0;
359f8829a4aSRandall Stewart 	net->error_count = 0;
360f8829a4aSRandall Stewart 
361f8829a4aSRandall Stewart 	/*
362f8829a4aSRandall Stewart 	 * Cancel the INIT timer, We do this first before queueing the
363f8829a4aSRandall Stewart 	 * cookie. We always cancel at the primary to assue that we are
364f8829a4aSRandall Stewart 	 * canceling the timer started by the INIT which always goes to the
365f8829a4aSRandall Stewart 	 * primary.
366f8829a4aSRandall Stewart 	 */
367f8829a4aSRandall Stewart 	sctp_timer_stop(SCTP_TIMER_TYPE_INIT, stcb->sctp_ep, stcb,
368a5d547adSRandall Stewart 	    asoc->primary_destination, SCTP_FROM_SCTP_INPUT + SCTP_LOC_4);
369a5d547adSRandall Stewart 
370a5d547adSRandall Stewart 	/* calculate the RTO */
371a5d547adSRandall Stewart 	net->RTO = sctp_calculate_rto(stcb, asoc, net, &asoc->time_entered);
372f8829a4aSRandall Stewart 
373f8829a4aSRandall Stewart 	retval = sctp_send_cookie_echo(m, offset, stcb, net);
374f8829a4aSRandall Stewart 	if (retval < 0) {
375f8829a4aSRandall Stewart 		/*
376f8829a4aSRandall Stewart 		 * No cookie, we probably should send a op error. But in any
377f8829a4aSRandall Stewart 		 * case if there is no cookie in the INIT-ACK, we can
378f8829a4aSRandall Stewart 		 * abandon the peer, its broke.
379f8829a4aSRandall Stewart 		 */
380f8829a4aSRandall Stewart 		if (retval == -3) {
381f8829a4aSRandall Stewart 			/* We abort with an error of missing mandatory param */
382f8829a4aSRandall Stewart 			op_err =
383f8829a4aSRandall Stewart 			    sctp_generate_invmanparam(SCTP_CAUSE_MISSING_PARAM);
384f8829a4aSRandall Stewart 			if (op_err) {
385f8829a4aSRandall Stewart 				/*
386f8829a4aSRandall Stewart 				 * Expand beyond to include the mandatory
387f8829a4aSRandall Stewart 				 * param cookie
388f8829a4aSRandall Stewart 				 */
389f8829a4aSRandall Stewart 				struct sctp_inv_mandatory_param *mp;
390f8829a4aSRandall Stewart 
391139bc87fSRandall Stewart 				SCTP_BUF_LEN(op_err) =
392f8829a4aSRandall Stewart 				    sizeof(struct sctp_inv_mandatory_param);
393f8829a4aSRandall Stewart 				mp = mtod(op_err,
394f8829a4aSRandall Stewart 				    struct sctp_inv_mandatory_param *);
395f8829a4aSRandall Stewart 				/* Subtract the reserved param */
396f8829a4aSRandall Stewart 				mp->length =
397f8829a4aSRandall Stewart 				    htons(sizeof(struct sctp_inv_mandatory_param) - 2);
398f8829a4aSRandall Stewart 				mp->num_param = htonl(1);
399f8829a4aSRandall Stewart 				mp->param = htons(SCTP_STATE_COOKIE);
400f8829a4aSRandall Stewart 				mp->resv = 0;
401f8829a4aSRandall Stewart 			}
402f8829a4aSRandall Stewart 			sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
40317205eccSRandall Stewart 			    sh, op_err, 0, 0);
404bff64a4dSRandall Stewart 			*abort_no_unlock = 1;
405f8829a4aSRandall Stewart 		}
406f8829a4aSRandall Stewart 		return (retval);
407f8829a4aSRandall Stewart 	}
408f8829a4aSRandall Stewart 	return (0);
409f8829a4aSRandall Stewart }
410f8829a4aSRandall Stewart 
411f8829a4aSRandall Stewart static void
412f8829a4aSRandall Stewart sctp_handle_heartbeat_ack(struct sctp_heartbeat_chunk *cp,
413f8829a4aSRandall Stewart     struct sctp_tcb *stcb, struct sctp_nets *net)
414f8829a4aSRandall Stewart {
415f8829a4aSRandall Stewart 	struct sockaddr_storage store;
416f8829a4aSRandall Stewart 	struct sockaddr_in *sin;
417f8829a4aSRandall Stewart 	struct sockaddr_in6 *sin6;
418f8829a4aSRandall Stewart 	struct sctp_nets *r_net;
419f8829a4aSRandall Stewart 	struct timeval tv;
420f8829a4aSRandall Stewart 
421f8829a4aSRandall Stewart 	if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_heartbeat_chunk)) {
422f8829a4aSRandall Stewart 		/* Invalid length */
423f8829a4aSRandall Stewart 		return;
424f8829a4aSRandall Stewart 	}
425f8829a4aSRandall Stewart 	sin = (struct sockaddr_in *)&store;
426f8829a4aSRandall Stewart 	sin6 = (struct sockaddr_in6 *)&store;
427f8829a4aSRandall Stewart 
428f8829a4aSRandall Stewart 	memset(&store, 0, sizeof(store));
429f8829a4aSRandall Stewart 	if (cp->heartbeat.hb_info.addr_family == AF_INET &&
430f8829a4aSRandall Stewart 	    cp->heartbeat.hb_info.addr_len == sizeof(struct sockaddr_in)) {
431f8829a4aSRandall Stewart 		sin->sin_family = cp->heartbeat.hb_info.addr_family;
432f8829a4aSRandall Stewart 		sin->sin_len = cp->heartbeat.hb_info.addr_len;
433f8829a4aSRandall Stewart 		sin->sin_port = stcb->rport;
434f8829a4aSRandall Stewart 		memcpy(&sin->sin_addr, cp->heartbeat.hb_info.address,
435f8829a4aSRandall Stewart 		    sizeof(sin->sin_addr));
436f8829a4aSRandall Stewart 	} else if (cp->heartbeat.hb_info.addr_family == AF_INET6 &&
437f8829a4aSRandall Stewart 	    cp->heartbeat.hb_info.addr_len == sizeof(struct sockaddr_in6)) {
438f8829a4aSRandall Stewart 		sin6->sin6_family = cp->heartbeat.hb_info.addr_family;
439f8829a4aSRandall Stewart 		sin6->sin6_len = cp->heartbeat.hb_info.addr_len;
440f8829a4aSRandall Stewart 		sin6->sin6_port = stcb->rport;
441f8829a4aSRandall Stewart 		memcpy(&sin6->sin6_addr, cp->heartbeat.hb_info.address,
442f8829a4aSRandall Stewart 		    sizeof(sin6->sin6_addr));
443f8829a4aSRandall Stewart 	} else {
444f8829a4aSRandall Stewart 		return;
445f8829a4aSRandall Stewart 	}
446f8829a4aSRandall Stewart 	r_net = sctp_findnet(stcb, (struct sockaddr *)sin);
447f8829a4aSRandall Stewart 	if (r_net == NULL) {
448ad81507eSRandall Stewart 		SCTPDBG(SCTP_DEBUG_INPUT1, "Huh? I can't find the address I sent it to, discard\n");
449f8829a4aSRandall Stewart 		return;
450f8829a4aSRandall Stewart 	}
451f8829a4aSRandall Stewart 	if ((r_net && (r_net->dest_state & SCTP_ADDR_UNCONFIRMED)) &&
452f8829a4aSRandall Stewart 	    (r_net->heartbeat_random1 == cp->heartbeat.hb_info.random_value1) &&
453f8829a4aSRandall Stewart 	    (r_net->heartbeat_random2 == cp->heartbeat.hb_info.random_value2)) {
454f8829a4aSRandall Stewart 		/*
455f8829a4aSRandall Stewart 		 * If the its a HB and it's random value is correct when can
456f8829a4aSRandall Stewart 		 * confirm the destination.
457f8829a4aSRandall Stewart 		 */
458f8829a4aSRandall Stewart 		r_net->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
45942551e99SRandall Stewart 		if (r_net->dest_state & SCTP_ADDR_REQ_PRIMARY) {
46042551e99SRandall Stewart 			stcb->asoc.primary_destination = r_net;
46142551e99SRandall Stewart 			r_net->dest_state &= ~SCTP_ADDR_WAS_PRIMARY;
46242551e99SRandall Stewart 			r_net->dest_state &= ~SCTP_ADDR_REQ_PRIMARY;
46342551e99SRandall Stewart 			r_net = TAILQ_FIRST(&stcb->asoc.nets);
46442551e99SRandall Stewart 			if (r_net != stcb->asoc.primary_destination) {
46542551e99SRandall Stewart 				/*
46642551e99SRandall Stewart 				 * first one on the list is NOT the primary
46742551e99SRandall Stewart 				 * sctp_cmpaddr() is much more efficent if
46842551e99SRandall Stewart 				 * the primary is the first on the list,
46942551e99SRandall Stewart 				 * make it so.
47042551e99SRandall Stewart 				 */
47142551e99SRandall Stewart 				TAILQ_REMOVE(&stcb->asoc.nets, stcb->asoc.primary_destination, sctp_next);
47242551e99SRandall Stewart 				TAILQ_INSERT_HEAD(&stcb->asoc.nets, stcb->asoc.primary_destination, sctp_next);
47342551e99SRandall Stewart 			}
47442551e99SRandall Stewart 		}
475f8829a4aSRandall Stewart 		sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
476f8829a4aSRandall Stewart 		    stcb, 0, (void *)r_net);
477f8829a4aSRandall Stewart 	}
478f8829a4aSRandall Stewart 	r_net->error_count = 0;
479f8829a4aSRandall Stewart 	r_net->hb_responded = 1;
480f8829a4aSRandall Stewart 	tv.tv_sec = cp->heartbeat.hb_info.time_value_1;
481f8829a4aSRandall Stewart 	tv.tv_usec = cp->heartbeat.hb_info.time_value_2;
482f8829a4aSRandall Stewart 	if (r_net->dest_state & SCTP_ADDR_NOT_REACHABLE) {
483f8829a4aSRandall Stewart 		r_net->dest_state &= ~SCTP_ADDR_NOT_REACHABLE;
484f8829a4aSRandall Stewart 		r_net->dest_state |= SCTP_ADDR_REACHABLE;
485f8829a4aSRandall Stewart 		sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_UP, stcb,
486f8829a4aSRandall Stewart 		    SCTP_HEARTBEAT_SUCCESS, (void *)r_net);
487f8829a4aSRandall Stewart 		/* now was it the primary? if so restore */
488f8829a4aSRandall Stewart 		if (r_net->dest_state & SCTP_ADDR_WAS_PRIMARY) {
489ad81507eSRandall Stewart 			(void)sctp_set_primary_addr(stcb, (struct sockaddr *)NULL, r_net);
490f8829a4aSRandall Stewart 		}
491f8829a4aSRandall Stewart 	}
492f8829a4aSRandall Stewart 	/* Now lets do a RTO with this */
493f8829a4aSRandall Stewart 	r_net->RTO = sctp_calculate_rto(stcb, &stcb->asoc, r_net, &tv);
494f8829a4aSRandall Stewart }
495f8829a4aSRandall Stewart 
496f8829a4aSRandall Stewart static void
497f8829a4aSRandall Stewart sctp_handle_abort(struct sctp_abort_chunk *cp,
498f8829a4aSRandall Stewart     struct sctp_tcb *stcb, struct sctp_nets *net)
499f8829a4aSRandall Stewart {
500ad81507eSRandall Stewart 	SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_abort: handling ABORT\n");
501f8829a4aSRandall Stewart 	if (stcb == NULL)
502f8829a4aSRandall Stewart 		return;
503f8829a4aSRandall Stewart 
504f8829a4aSRandall Stewart 	/* stop any receive timers */
505a5d547adSRandall Stewart 	sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_5);
506f8829a4aSRandall Stewart 	/* notify user of the abort and clean up... */
507f8829a4aSRandall Stewart 	sctp_abort_notification(stcb, 0);
508f8829a4aSRandall Stewart 	/* free the tcb */
509f8829a4aSRandall Stewart 	SCTP_STAT_INCR_COUNTER32(sctps_aborted);
510f8829a4aSRandall Stewart 	if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
511f8829a4aSRandall Stewart 	    (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
512f8829a4aSRandall Stewart 		SCTP_STAT_DECR_GAUGE32(sctps_currestab);
513f8829a4aSRandall Stewart 	}
514f1f73e57SRandall Stewart #ifdef SCTP_ASOCLOG_OF_TSNS
515f1f73e57SRandall Stewart 	sctp_print_out_track_log(stcb);
516f1f73e57SRandall Stewart #endif
517a5d547adSRandall Stewart 	sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_6);
518ad81507eSRandall Stewart 	SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_abort: finished\n");
519f8829a4aSRandall Stewart }
520f8829a4aSRandall Stewart 
521f8829a4aSRandall Stewart static void
522f8829a4aSRandall Stewart sctp_handle_shutdown(struct sctp_shutdown_chunk *cp,
523f8829a4aSRandall Stewart     struct sctp_tcb *stcb, struct sctp_nets *net, int *abort_flag)
524f8829a4aSRandall Stewart {
525f8829a4aSRandall Stewart 	struct sctp_association *asoc;
526f8829a4aSRandall Stewart 	int some_on_streamwheel;
527f8829a4aSRandall Stewart 
528ad81507eSRandall Stewart 	SCTPDBG(SCTP_DEBUG_INPUT2,
529ad81507eSRandall Stewart 	    "sctp_handle_shutdown: handling SHUTDOWN\n");
530f8829a4aSRandall Stewart 	if (stcb == NULL)
531f8829a4aSRandall Stewart 		return;
532a5d547adSRandall Stewart 	asoc = &stcb->asoc;
533a5d547adSRandall Stewart 	if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||
534a5d547adSRandall Stewart 	    (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) {
535f8829a4aSRandall Stewart 		return;
536f8829a4aSRandall Stewart 	}
537f8829a4aSRandall Stewart 	if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_shutdown_chunk)) {
538f8829a4aSRandall Stewart 		/* Shutdown NOT the expected size */
539f8829a4aSRandall Stewart 		return;
540f8829a4aSRandall Stewart 	} else {
541f8829a4aSRandall Stewart 		sctp_update_acked(stcb, cp, net, abort_flag);
542f8829a4aSRandall Stewart 	}
543a5d547adSRandall Stewart 	if (asoc->control_pdapi) {
544f8829a4aSRandall Stewart 		/*
545f8829a4aSRandall Stewart 		 * With a normal shutdown we assume the end of last record.
546f8829a4aSRandall Stewart 		 */
547f8829a4aSRandall Stewart 		SCTP_INP_READ_LOCK(stcb->sctp_ep);
548a5d547adSRandall Stewart 		asoc->control_pdapi->end_added = 1;
549a5d547adSRandall Stewart 		asoc->control_pdapi->pdapi_aborted = 1;
550a5d547adSRandall Stewart 		asoc->control_pdapi = NULL;
551f8829a4aSRandall Stewart 		SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
55250cec919SRandall Stewart 		sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
553f8829a4aSRandall Stewart 	}
554f8829a4aSRandall Stewart 	/* goto SHUTDOWN_RECEIVED state to block new requests */
555f8829a4aSRandall Stewart 	if (stcb->sctp_socket) {
556f8829a4aSRandall Stewart 		if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) &&
557d61a0ae0SRandall Stewart 		    (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT) &&
558f8829a4aSRandall Stewart 		    (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT)) {
559f8829a4aSRandall Stewart 			asoc->state = SCTP_STATE_SHUTDOWN_RECEIVED;
560f8829a4aSRandall Stewart 			/*
561f8829a4aSRandall Stewart 			 * notify upper layer that peer has initiated a
562f8829a4aSRandall Stewart 			 * shutdown
563f8829a4aSRandall Stewart 			 */
564f8829a4aSRandall Stewart 			sctp_ulp_notify(SCTP_NOTIFY_PEER_SHUTDOWN, stcb, 0, NULL);
565f8829a4aSRandall Stewart 
566f8829a4aSRandall Stewart 			/* reset time */
5676e55db54SRandall Stewart 			(void)SCTP_GETTIME_TIMEVAL(&asoc->time_entered);
568f8829a4aSRandall Stewart 		}
569f8829a4aSRandall Stewart 	}
570f8829a4aSRandall Stewart 	if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) {
571f8829a4aSRandall Stewart 		/*
572f8829a4aSRandall Stewart 		 * stop the shutdown timer, since we WILL move to
573f8829a4aSRandall Stewart 		 * SHUTDOWN-ACK-SENT.
574f8829a4aSRandall Stewart 		 */
575a5d547adSRandall Stewart 		sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_7);
576f8829a4aSRandall Stewart 	}
577f8829a4aSRandall Stewart 	/* Now are we there yet? */
578f8829a4aSRandall Stewart 	some_on_streamwheel = 0;
579f8829a4aSRandall Stewart 	if (!TAILQ_EMPTY(&asoc->out_wheel)) {
580f8829a4aSRandall Stewart 		/* Check to see if some data queued */
581f8829a4aSRandall Stewart 		struct sctp_stream_out *outs;
582f8829a4aSRandall Stewart 
583f8829a4aSRandall Stewart 		TAILQ_FOREACH(outs, &asoc->out_wheel, next_spoke) {
584f8829a4aSRandall Stewart 			if (!TAILQ_EMPTY(&outs->outqueue)) {
585f8829a4aSRandall Stewart 				some_on_streamwheel = 1;
586f8829a4aSRandall Stewart 				break;
587f8829a4aSRandall Stewart 			}
588f8829a4aSRandall Stewart 		}
589f8829a4aSRandall Stewart 	}
590f8829a4aSRandall Stewart 	if (!TAILQ_EMPTY(&asoc->send_queue) ||
591f8829a4aSRandall Stewart 	    !TAILQ_EMPTY(&asoc->sent_queue) ||
592f8829a4aSRandall Stewart 	    some_on_streamwheel) {
593f8829a4aSRandall Stewart 		/* By returning we will push more data out */
594f8829a4aSRandall Stewart 		return;
595f8829a4aSRandall Stewart 	} else {
596f8829a4aSRandall Stewart 		/* no outstanding data to send, so move on... */
597f8829a4aSRandall Stewart 		/* send SHUTDOWN-ACK */
598f8829a4aSRandall Stewart 		sctp_send_shutdown_ack(stcb, stcb->asoc.primary_destination);
599f8829a4aSRandall Stewart 		/* move to SHUTDOWN-ACK-SENT state */
600f42a358aSRandall Stewart 		if ((SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) ||
601f42a358aSRandall Stewart 		    (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
602f8829a4aSRandall Stewart 			SCTP_STAT_DECR_GAUGE32(sctps_currestab);
603f8829a4aSRandall Stewart 		}
604f8829a4aSRandall Stewart 		asoc->state = SCTP_STATE_SHUTDOWN_ACK_SENT;
605f8829a4aSRandall Stewart 
606f8829a4aSRandall Stewart 		/* start SHUTDOWN timer */
607f8829a4aSRandall Stewart 		sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNACK, stcb->sctp_ep,
608f8829a4aSRandall Stewart 		    stcb, net);
609f8829a4aSRandall Stewart 	}
610f8829a4aSRandall Stewart }
611f8829a4aSRandall Stewart 
612f8829a4aSRandall Stewart static void
613f8829a4aSRandall Stewart sctp_handle_shutdown_ack(struct sctp_shutdown_ack_chunk *cp,
614f8829a4aSRandall Stewart     struct sctp_tcb *stcb, struct sctp_nets *net)
615f8829a4aSRandall Stewart {
616f8829a4aSRandall Stewart 	struct sctp_association *asoc;
617f8829a4aSRandall Stewart 
618ad81507eSRandall Stewart 	SCTPDBG(SCTP_DEBUG_INPUT2,
619ad81507eSRandall Stewart 	    "sctp_handle_shutdown_ack: handling SHUTDOWN ACK\n");
620f8829a4aSRandall Stewart 	if (stcb == NULL)
621f8829a4aSRandall Stewart 		return;
622f8829a4aSRandall Stewart 
623f8829a4aSRandall Stewart 	asoc = &stcb->asoc;
624f8829a4aSRandall Stewart 	/* process according to association state */
625f8829a4aSRandall Stewart 	if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) &&
626f8829a4aSRandall Stewart 	    (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) {
627f8829a4aSRandall Stewart 		/* unexpected SHUTDOWN-ACK... so ignore... */
628f8829a4aSRandall Stewart 		SCTP_TCB_UNLOCK(stcb);
629f8829a4aSRandall Stewart 		return;
630f8829a4aSRandall Stewart 	}
631a5d547adSRandall Stewart 	if (asoc->control_pdapi) {
632f8829a4aSRandall Stewart 		/*
633f8829a4aSRandall Stewart 		 * With a normal shutdown we assume the end of last record.
634f8829a4aSRandall Stewart 		 */
635f8829a4aSRandall Stewart 		SCTP_INP_READ_LOCK(stcb->sctp_ep);
636a5d547adSRandall Stewart 		asoc->control_pdapi->end_added = 1;
637a5d547adSRandall Stewart 		asoc->control_pdapi->pdapi_aborted = 1;
638a5d547adSRandall Stewart 		asoc->control_pdapi = NULL;
639f8829a4aSRandall Stewart 		SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
64050cec919SRandall Stewart 		sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
641f8829a4aSRandall Stewart 	}
642f8829a4aSRandall Stewart 	/* are the queues empty? */
643f8829a4aSRandall Stewart 	if (!TAILQ_EMPTY(&asoc->send_queue) ||
644f8829a4aSRandall Stewart 	    !TAILQ_EMPTY(&asoc->sent_queue) ||
645f8829a4aSRandall Stewart 	    !TAILQ_EMPTY(&asoc->out_wheel)) {
6467f34832bSRandall Stewart 		sctp_report_all_outbound(stcb, 0);
647f8829a4aSRandall Stewart 	}
648f8829a4aSRandall Stewart 	/* stop the timer */
649a5d547adSRandall Stewart 	sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_8);
650f8829a4aSRandall Stewart 	/* send SHUTDOWN-COMPLETE */
651f8829a4aSRandall Stewart 	sctp_send_shutdown_complete(stcb, net);
652f8829a4aSRandall Stewart 	/* notify upper layer protocol */
653f8829a4aSRandall Stewart 	if (stcb->sctp_socket) {
654f8829a4aSRandall Stewart 		sctp_ulp_notify(SCTP_NOTIFY_ASSOC_DOWN, stcb, 0, NULL);
655f8829a4aSRandall Stewart 		if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
656f8829a4aSRandall Stewart 		    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
657f8829a4aSRandall Stewart 			/* Set the connected flag to disconnected */
658f8829a4aSRandall Stewart 			stcb->sctp_ep->sctp_socket->so_snd.sb_cc = 0;
659f8829a4aSRandall Stewart 		}
660f8829a4aSRandall Stewart 	}
661f8829a4aSRandall Stewart 	SCTP_STAT_INCR_COUNTER32(sctps_shutdown);
662f8829a4aSRandall Stewart 	/* free the TCB but first save off the ep */
663a5d547adSRandall Stewart 	sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC,
664a5d547adSRandall Stewart 	    SCTP_FROM_SCTP_INPUT + SCTP_LOC_9);
665f8829a4aSRandall Stewart }
666f8829a4aSRandall Stewart 
667f8829a4aSRandall Stewart /*
668f8829a4aSRandall Stewart  * Skip past the param header and then we will find the chunk that caused the
669f8829a4aSRandall Stewart  * problem. There are two possiblities ASCONF or FWD-TSN other than that and
670f8829a4aSRandall Stewart  * our peer must be broken.
671f8829a4aSRandall Stewart  */
672f8829a4aSRandall Stewart static void
673f8829a4aSRandall Stewart sctp_process_unrecog_chunk(struct sctp_tcb *stcb, struct sctp_paramhdr *phdr,
674f8829a4aSRandall Stewart     struct sctp_nets *net)
675f8829a4aSRandall Stewart {
676f8829a4aSRandall Stewart 	struct sctp_chunkhdr *chk;
677f8829a4aSRandall Stewart 
678f8829a4aSRandall Stewart 	chk = (struct sctp_chunkhdr *)((caddr_t)phdr + sizeof(*phdr));
679f8829a4aSRandall Stewart 	switch (chk->chunk_type) {
680f8829a4aSRandall Stewart 	case SCTP_ASCONF_ACK:
681f8829a4aSRandall Stewart 	case SCTP_ASCONF:
682f8829a4aSRandall Stewart 		sctp_asconf_cleanup(stcb, net);
683f8829a4aSRandall Stewart 		break;
684f8829a4aSRandall Stewart 	case SCTP_FORWARD_CUM_TSN:
685f8829a4aSRandall Stewart 		stcb->asoc.peer_supports_prsctp = 0;
686f8829a4aSRandall Stewart 		break;
687f8829a4aSRandall Stewart 	default:
688ad81507eSRandall Stewart 		SCTPDBG(SCTP_DEBUG_INPUT2,
689ad81507eSRandall Stewart 		    "Peer does not support chunk type %d(%x)??\n",
690f8829a4aSRandall Stewart 		    chk->chunk_type, (uint32_t) chk->chunk_type);
691f8829a4aSRandall Stewart 		break;
692f8829a4aSRandall Stewart 	}
693f8829a4aSRandall Stewart }
694f8829a4aSRandall Stewart 
695f8829a4aSRandall Stewart /*
696f8829a4aSRandall Stewart  * Skip past the param header and then we will find the param that caused the
697f8829a4aSRandall Stewart  * problem.  There are a number of param's in a ASCONF OR the prsctp param
698f8829a4aSRandall Stewart  * these will turn of specific features.
699f8829a4aSRandall Stewart  */
700f8829a4aSRandall Stewart static void
701f8829a4aSRandall Stewart sctp_process_unrecog_param(struct sctp_tcb *stcb, struct sctp_paramhdr *phdr)
702f8829a4aSRandall Stewart {
703f8829a4aSRandall Stewart 	struct sctp_paramhdr *pbad;
704f8829a4aSRandall Stewart 
705f8829a4aSRandall Stewart 	pbad = phdr + 1;
706f8829a4aSRandall Stewart 	switch (ntohs(pbad->param_type)) {
707f8829a4aSRandall Stewart 		/* pr-sctp draft */
708f8829a4aSRandall Stewart 	case SCTP_PRSCTP_SUPPORTED:
709f8829a4aSRandall Stewart 		stcb->asoc.peer_supports_prsctp = 0;
710f8829a4aSRandall Stewart 		break;
711f8829a4aSRandall Stewart 	case SCTP_SUPPORTED_CHUNK_EXT:
712f8829a4aSRandall Stewart 		break;
713f8829a4aSRandall Stewart 		/* draft-ietf-tsvwg-addip-sctp */
714f8829a4aSRandall Stewart 	case SCTP_ECN_NONCE_SUPPORTED:
715f8829a4aSRandall Stewart 		stcb->asoc.peer_supports_ecn_nonce = 0;
716f8829a4aSRandall Stewart 		stcb->asoc.ecn_nonce_allowed = 0;
717f8829a4aSRandall Stewart 		stcb->asoc.ecn_allowed = 0;
718f8829a4aSRandall Stewart 		break;
719f8829a4aSRandall Stewart 	case SCTP_ADD_IP_ADDRESS:
720f8829a4aSRandall Stewart 	case SCTP_DEL_IP_ADDRESS:
721f8829a4aSRandall Stewart 	case SCTP_SET_PRIM_ADDR:
722f8829a4aSRandall Stewart 		stcb->asoc.peer_supports_asconf = 0;
723f8829a4aSRandall Stewart 		break;
724f8829a4aSRandall Stewart 	case SCTP_SUCCESS_REPORT:
725f8829a4aSRandall Stewart 	case SCTP_ERROR_CAUSE_IND:
726ad81507eSRandall Stewart 		SCTPDBG(SCTP_DEBUG_INPUT2, "Huh, the peer does not support success? or error cause?\n");
727ad81507eSRandall Stewart 		SCTPDBG(SCTP_DEBUG_INPUT2,
728ad81507eSRandall Stewart 		    "Turning off ASCONF to this strange peer\n");
729f8829a4aSRandall Stewart 		stcb->asoc.peer_supports_asconf = 0;
730f8829a4aSRandall Stewart 		break;
731f8829a4aSRandall Stewart 	default:
732ad81507eSRandall Stewart 		SCTPDBG(SCTP_DEBUG_INPUT2,
733ad81507eSRandall Stewart 		    "Peer does not support param type %d(%x)??\n",
734f8829a4aSRandall Stewart 		    pbad->param_type, (uint32_t) pbad->param_type);
735f8829a4aSRandall Stewart 		break;
736f8829a4aSRandall Stewart 	}
737f8829a4aSRandall Stewart }
738f8829a4aSRandall Stewart 
739f8829a4aSRandall Stewart static int
740f8829a4aSRandall Stewart sctp_handle_error(struct sctp_chunkhdr *ch,
741f8829a4aSRandall Stewart     struct sctp_tcb *stcb, struct sctp_nets *net)
742f8829a4aSRandall Stewart {
743f8829a4aSRandall Stewart 	int chklen;
744f8829a4aSRandall Stewart 	struct sctp_paramhdr *phdr;
745f8829a4aSRandall Stewart 	uint16_t error_type;
746f8829a4aSRandall Stewart 	uint16_t error_len;
747f8829a4aSRandall Stewart 	struct sctp_association *asoc;
748f8829a4aSRandall Stewart 
749f8829a4aSRandall Stewart 	int adjust;
750f8829a4aSRandall Stewart 
751f8829a4aSRandall Stewart 	/* parse through all of the errors and process */
752f8829a4aSRandall Stewart 	asoc = &stcb->asoc;
753f8829a4aSRandall Stewart 	phdr = (struct sctp_paramhdr *)((caddr_t)ch +
754f8829a4aSRandall Stewart 	    sizeof(struct sctp_chunkhdr));
755f8829a4aSRandall Stewart 	chklen = ntohs(ch->chunk_length) - sizeof(struct sctp_chunkhdr);
756f8829a4aSRandall Stewart 	while ((size_t)chklen >= sizeof(struct sctp_paramhdr)) {
757f8829a4aSRandall Stewart 		/* Process an Error Cause */
758f8829a4aSRandall Stewart 		error_type = ntohs(phdr->param_type);
759f8829a4aSRandall Stewart 		error_len = ntohs(phdr->param_length);
760f8829a4aSRandall Stewart 		if ((error_len > chklen) || (error_len == 0)) {
761f8829a4aSRandall Stewart 			/* invalid param length for this param */
762ad81507eSRandall Stewart 			SCTPDBG(SCTP_DEBUG_INPUT1, "Bogus length in error param- chunk left:%d errorlen:%d\n",
763f8829a4aSRandall Stewart 			    chklen, error_len);
764f8829a4aSRandall Stewart 			return (0);
765f8829a4aSRandall Stewart 		}
766f8829a4aSRandall Stewart 		switch (error_type) {
767f8829a4aSRandall Stewart 		case SCTP_CAUSE_INVALID_STREAM:
768f8829a4aSRandall Stewart 		case SCTP_CAUSE_MISSING_PARAM:
769f8829a4aSRandall Stewart 		case SCTP_CAUSE_INVALID_PARAM:
770f8829a4aSRandall Stewart 		case SCTP_CAUSE_NO_USER_DATA:
771ad81507eSRandall Stewart 			SCTPDBG(SCTP_DEBUG_INPUT1, "Software error we got a %d back? We have a bug :/ (or do they?)\n",
772f8829a4aSRandall Stewart 			    error_type);
773f8829a4aSRandall Stewart 			break;
774f8829a4aSRandall Stewart 		case SCTP_CAUSE_STALE_COOKIE:
775f8829a4aSRandall Stewart 			/*
776f8829a4aSRandall Stewart 			 * We only act if we have echoed a cookie and are
777f8829a4aSRandall Stewart 			 * waiting.
778f8829a4aSRandall Stewart 			 */
779f8829a4aSRandall Stewart 			if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) {
780f8829a4aSRandall Stewart 				int *p;
781f8829a4aSRandall Stewart 
782f8829a4aSRandall Stewart 				p = (int *)((caddr_t)phdr + sizeof(*phdr));
783f8829a4aSRandall Stewart 				/* Save the time doubled */
784f8829a4aSRandall Stewart 				asoc->cookie_preserve_req = ntohl(*p) << 1;
785f8829a4aSRandall Stewart 				asoc->stale_cookie_count++;
786f8829a4aSRandall Stewart 				if (asoc->stale_cookie_count >
787f8829a4aSRandall Stewart 				    asoc->max_init_times) {
788f8829a4aSRandall Stewart 					sctp_abort_notification(stcb, 0);
789f8829a4aSRandall Stewart 					/* now free the asoc */
790a5d547adSRandall Stewart 					sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_10);
791f8829a4aSRandall Stewart 					return (-1);
792f8829a4aSRandall Stewart 				}
793f8829a4aSRandall Stewart 				/* blast back to INIT state */
794f8829a4aSRandall Stewart 				asoc->state &= ~SCTP_STATE_COOKIE_ECHOED;
795f8829a4aSRandall Stewart 				asoc->state |= SCTP_STATE_COOKIE_WAIT;
796f8829a4aSRandall Stewart 
797f8829a4aSRandall Stewart 				sctp_stop_all_cookie_timers(stcb);
798f8829a4aSRandall Stewart 				sctp_send_initiate(stcb->sctp_ep, stcb);
799f8829a4aSRandall Stewart 			}
800f8829a4aSRandall Stewart 			break;
801f8829a4aSRandall Stewart 		case SCTP_CAUSE_UNRESOLVABLE_ADDR:
802f8829a4aSRandall Stewart 			/*
803f8829a4aSRandall Stewart 			 * Nothing we can do here, we don't do hostname
804f8829a4aSRandall Stewart 			 * addresses so if the peer does not like my IPv6
805f8829a4aSRandall Stewart 			 * (or IPv4 for that matter) it does not matter. If
806f8829a4aSRandall Stewart 			 * they don't support that type of address, they can
807f8829a4aSRandall Stewart 			 * NOT possibly get that packet type... i.e. with no
808f8829a4aSRandall Stewart 			 * IPv6 you can't recieve a IPv6 packet. so we can
809f8829a4aSRandall Stewart 			 * safely ignore this one. If we ever added support
810f8829a4aSRandall Stewart 			 * for HOSTNAME Addresses, then we would need to do
811f8829a4aSRandall Stewart 			 * something here.
812f8829a4aSRandall Stewart 			 */
813f8829a4aSRandall Stewart 			break;
814f8829a4aSRandall Stewart 		case SCTP_CAUSE_UNRECOG_CHUNK:
815f8829a4aSRandall Stewart 			sctp_process_unrecog_chunk(stcb, phdr, net);
816f8829a4aSRandall Stewart 			break;
817f8829a4aSRandall Stewart 		case SCTP_CAUSE_UNRECOG_PARAM:
818f8829a4aSRandall Stewart 			sctp_process_unrecog_param(stcb, phdr);
819f8829a4aSRandall Stewart 			break;
820f8829a4aSRandall Stewart 		case SCTP_CAUSE_COOKIE_IN_SHUTDOWN:
821f8829a4aSRandall Stewart 			/*
822f8829a4aSRandall Stewart 			 * We ignore this since the timer will drive out a
823f8829a4aSRandall Stewart 			 * new cookie anyway and there timer will drive us
824f8829a4aSRandall Stewart 			 * to send a SHUTDOWN_COMPLETE. We can't send one
825f8829a4aSRandall Stewart 			 * here since we don't have their tag.
826f8829a4aSRandall Stewart 			 */
827f8829a4aSRandall Stewart 			break;
828f8829a4aSRandall Stewart 		case SCTP_CAUSE_DELETING_LAST_ADDR:
829f8829a4aSRandall Stewart 		case SCTP_CAUSE_RESOURCE_SHORTAGE:
830f8829a4aSRandall Stewart 		case SCTP_CAUSE_DELETING_SRC_ADDR:
831f8829a4aSRandall Stewart 			/*
832f8829a4aSRandall Stewart 			 * We should NOT get these here, but in a
83393164cf9SRandall Stewart 			 * ASCONF-ACK.
834f8829a4aSRandall Stewart 			 */
835ad81507eSRandall Stewart 			SCTPDBG(SCTP_DEBUG_INPUT2, "Peer sends ASCONF errors in a Operational Error?<%d>?\n",
836f8829a4aSRandall Stewart 			    error_type);
837f8829a4aSRandall Stewart 			break;
838f8829a4aSRandall Stewart 		case SCTP_CAUSE_OUT_OF_RESC:
839f8829a4aSRandall Stewart 			/*
840f8829a4aSRandall Stewart 			 * And what, pray tell do we do with the fact that
841f8829a4aSRandall Stewart 			 * the peer is out of resources? Not really sure we
84293164cf9SRandall Stewart 			 * could do anything but abort. I suspect this
843f8829a4aSRandall Stewart 			 * should have came WITH an abort instead of in a
844f8829a4aSRandall Stewart 			 * OP-ERROR.
845f8829a4aSRandall Stewart 			 */
846f8829a4aSRandall Stewart 			break;
847f8829a4aSRandall Stewart 		default:
848ad81507eSRandall Stewart 			SCTPDBG(SCTP_DEBUG_INPUT1, "sctp_handle_error: unknown error type = 0x%xh\n",
849f8829a4aSRandall Stewart 			    error_type);
850f8829a4aSRandall Stewart 			break;
851f8829a4aSRandall Stewart 		}
852f8829a4aSRandall Stewart 		adjust = SCTP_SIZE32(error_len);
853f8829a4aSRandall Stewart 		chklen -= adjust;
854f8829a4aSRandall Stewart 		phdr = (struct sctp_paramhdr *)((caddr_t)phdr + adjust);
855f8829a4aSRandall Stewart 	}
856f8829a4aSRandall Stewart 	return (0);
857f8829a4aSRandall Stewart }
858f8829a4aSRandall Stewart 
859f8829a4aSRandall Stewart static int
86017205eccSRandall Stewart sctp_handle_init_ack(struct mbuf *m, int iphlen, int offset,
86117205eccSRandall Stewart     struct sctphdr *sh, struct sctp_init_ack_chunk *cp, struct sctp_tcb *stcb,
86217205eccSRandall Stewart     struct sctp_nets *net, int *abort_no_unlock, uint32_t vrf_id,
86317205eccSRandall Stewart     uint32_t table_id)
864f8829a4aSRandall Stewart {
865f8829a4aSRandall Stewart 	struct sctp_init_ack *init_ack;
866f8829a4aSRandall Stewart 	int *state;
867f8829a4aSRandall Stewart 	struct mbuf *op_err;
868f8829a4aSRandall Stewart 
869ad81507eSRandall Stewart 	SCTPDBG(SCTP_DEBUG_INPUT2,
870ad81507eSRandall Stewart 	    "sctp_handle_init_ack: handling INIT-ACK\n");
871ad81507eSRandall Stewart 
872f8829a4aSRandall Stewart 	if (stcb == NULL) {
873ad81507eSRandall Stewart 		SCTPDBG(SCTP_DEBUG_INPUT2,
874ad81507eSRandall Stewart 		    "sctp_handle_init_ack: TCB is null\n");
875f8829a4aSRandall Stewart 		return (-1);
876f8829a4aSRandall Stewart 	}
877f8829a4aSRandall Stewart 	if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_init_ack_chunk)) {
878f8829a4aSRandall Stewart 		/* Invalid length */
879f8829a4aSRandall Stewart 		op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
880f8829a4aSRandall Stewart 		sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh,
88117205eccSRandall Stewart 		    op_err, 0, 0);
882bff64a4dSRandall Stewart 		*abort_no_unlock = 1;
883f8829a4aSRandall Stewart 		return (-1);
884f8829a4aSRandall Stewart 	}
885f8829a4aSRandall Stewart 	init_ack = &cp->init;
886f8829a4aSRandall Stewart 	/* validate parameters */
887f8829a4aSRandall Stewart 	if (init_ack->initiate_tag == 0) {
888f8829a4aSRandall Stewart 		/* protocol error... send an abort */
889f8829a4aSRandall Stewart 		op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
890f8829a4aSRandall Stewart 		sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh,
89117205eccSRandall Stewart 		    op_err, 0, 0);
892bff64a4dSRandall Stewart 		*abort_no_unlock = 1;
893f8829a4aSRandall Stewart 		return (-1);
894f8829a4aSRandall Stewart 	}
895f8829a4aSRandall Stewart 	if (ntohl(init_ack->a_rwnd) < SCTP_MIN_RWND) {
896f8829a4aSRandall Stewart 		/* protocol error... send an abort */
897f8829a4aSRandall Stewart 		op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
898f8829a4aSRandall Stewart 		sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh,
89917205eccSRandall Stewart 		    op_err, 0, 0);
900bff64a4dSRandall Stewart 		*abort_no_unlock = 1;
901f8829a4aSRandall Stewart 		return (-1);
902f8829a4aSRandall Stewart 	}
903f8829a4aSRandall Stewart 	if (init_ack->num_inbound_streams == 0) {
904f8829a4aSRandall Stewart 		/* protocol error... send an abort */
905f8829a4aSRandall Stewart 		op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
906f8829a4aSRandall Stewart 		sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh,
90717205eccSRandall Stewart 		    op_err, 0, 0);
908bff64a4dSRandall Stewart 		*abort_no_unlock = 1;
909f8829a4aSRandall Stewart 		return (-1);
910f8829a4aSRandall Stewart 	}
911f8829a4aSRandall Stewart 	if (init_ack->num_outbound_streams == 0) {
912f8829a4aSRandall Stewart 		/* protocol error... send an abort */
913f8829a4aSRandall Stewart 		op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
914f8829a4aSRandall Stewart 		sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh,
91517205eccSRandall Stewart 		    op_err, 0, 0);
916bff64a4dSRandall Stewart 		*abort_no_unlock = 1;
917f8829a4aSRandall Stewart 		return (-1);
918f8829a4aSRandall Stewart 	}
919f8829a4aSRandall Stewart 	/* process according to association state... */
920f8829a4aSRandall Stewart 	state = &stcb->asoc.state;
921f8829a4aSRandall Stewart 	switch (*state & SCTP_STATE_MASK) {
922f8829a4aSRandall Stewart 	case SCTP_STATE_COOKIE_WAIT:
923f8829a4aSRandall Stewart 		/* this is the expected state for this chunk */
924f8829a4aSRandall Stewart 		/* process the INIT-ACK parameters */
925f8829a4aSRandall Stewart 		if (stcb->asoc.primary_destination->dest_state &
926f8829a4aSRandall Stewart 		    SCTP_ADDR_UNCONFIRMED) {
927f8829a4aSRandall Stewart 			/*
928f8829a4aSRandall Stewart 			 * The primary is where we sent the INIT, we can
929f8829a4aSRandall Stewart 			 * always consider it confirmed when the INIT-ACK is
930f8829a4aSRandall Stewart 			 * returned. Do this before we load addresses
931f8829a4aSRandall Stewart 			 * though.
932f8829a4aSRandall Stewart 			 */
933f8829a4aSRandall Stewart 			stcb->asoc.primary_destination->dest_state &=
934f8829a4aSRandall Stewart 			    ~SCTP_ADDR_UNCONFIRMED;
935f8829a4aSRandall Stewart 			sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
936f8829a4aSRandall Stewart 			    stcb, 0, (void *)stcb->asoc.primary_destination);
937f8829a4aSRandall Stewart 		}
93817205eccSRandall Stewart 		if (sctp_process_init_ack(m, iphlen, offset, sh, cp, stcb,
93917205eccSRandall Stewart 		    net, abort_no_unlock, vrf_id,
94017205eccSRandall Stewart 		    table_id) < 0) {
941f8829a4aSRandall Stewart 			/* error in parsing parameters */
942f8829a4aSRandall Stewart 			return (-1);
943f8829a4aSRandall Stewart 		}
944f8829a4aSRandall Stewart 		/* update our state */
945ad81507eSRandall Stewart 		SCTPDBG(SCTP_DEBUG_INPUT2, "moving to COOKIE-ECHOED state\n");
946f8829a4aSRandall Stewart 		if (*state & SCTP_STATE_SHUTDOWN_PENDING) {
947f8829a4aSRandall Stewart 			*state = SCTP_STATE_COOKIE_ECHOED |
948f8829a4aSRandall Stewart 			    SCTP_STATE_SHUTDOWN_PENDING;
949f8829a4aSRandall Stewart 		} else {
950f8829a4aSRandall Stewart 			*state = SCTP_STATE_COOKIE_ECHOED;
951f8829a4aSRandall Stewart 		}
952f8829a4aSRandall Stewart 
953f8829a4aSRandall Stewart 		/* reset the RTO calc */
954f8829a4aSRandall Stewart 		stcb->asoc.overall_error_count = 0;
9556e55db54SRandall Stewart 		(void)SCTP_GETTIME_TIMEVAL(&stcb->asoc.time_entered);
956f8829a4aSRandall Stewart 		/*
957f8829a4aSRandall Stewart 		 * collapse the init timer back in case of a exponential
958a5d547adSRandall Stewart 		 * backoff
959f8829a4aSRandall Stewart 		 */
960f8829a4aSRandall Stewart 		sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, stcb->sctp_ep,
961f8829a4aSRandall Stewart 		    stcb, net);
962f8829a4aSRandall Stewart 		/*
963f8829a4aSRandall Stewart 		 * the send at the end of the inbound data processing will
964f8829a4aSRandall Stewart 		 * cause the cookie to be sent
965f8829a4aSRandall Stewart 		 */
966f8829a4aSRandall Stewart 		break;
967f8829a4aSRandall Stewart 	case SCTP_STATE_SHUTDOWN_SENT:
968f8829a4aSRandall Stewart 		/* incorrect state... discard */
969f8829a4aSRandall Stewart 		break;
970f8829a4aSRandall Stewart 	case SCTP_STATE_COOKIE_ECHOED:
971f8829a4aSRandall Stewart 		/* incorrect state... discard */
972f8829a4aSRandall Stewart 		break;
973f8829a4aSRandall Stewart 	case SCTP_STATE_OPEN:
974f8829a4aSRandall Stewart 		/* incorrect state... discard */
975f8829a4aSRandall Stewart 		break;
976f8829a4aSRandall Stewart 	case SCTP_STATE_EMPTY:
977f8829a4aSRandall Stewart 	case SCTP_STATE_INUSE:
978f8829a4aSRandall Stewart 	default:
979f8829a4aSRandall Stewart 		/* incorrect state... discard */
980f8829a4aSRandall Stewart 		return (-1);
981f8829a4aSRandall Stewart 		break;
982f8829a4aSRandall Stewart 	}
983ad81507eSRandall Stewart 	SCTPDBG(SCTP_DEBUG_INPUT1, "Leaving handle-init-ack end\n");
984f8829a4aSRandall Stewart 	return (0);
985f8829a4aSRandall Stewart }
986f8829a4aSRandall Stewart 
987f8829a4aSRandall Stewart 
988f8829a4aSRandall Stewart /*
989f8829a4aSRandall Stewart  * handle a state cookie for an existing association m: input packet mbuf
990f8829a4aSRandall Stewart  * chain-- assumes a pullup on IP/SCTP/COOKIE-ECHO chunk note: this is a
991f8829a4aSRandall Stewart  * "split" mbuf and the cookie signature does not exist offset: offset into
992f8829a4aSRandall Stewart  * mbuf to the cookie-echo chunk
993f8829a4aSRandall Stewart  */
994f8829a4aSRandall Stewart static struct sctp_tcb *
995f8829a4aSRandall Stewart sctp_process_cookie_existing(struct mbuf *m, int iphlen, int offset,
996f8829a4aSRandall Stewart     struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len,
997f8829a4aSRandall Stewart     struct sctp_inpcb *inp, struct sctp_tcb *stcb, struct sctp_nets *net,
99817205eccSRandall Stewart     struct sockaddr *init_src, int *notification, sctp_assoc_t * sac_assoc_id,
99917205eccSRandall Stewart     uint32_t vrf_id, uint32_t table_id)
1000f8829a4aSRandall Stewart {
1001f8829a4aSRandall Stewart 	struct sctp_association *asoc;
1002f8829a4aSRandall Stewart 	struct sctp_init_chunk *init_cp, init_buf;
1003f8829a4aSRandall Stewart 	struct sctp_init_ack_chunk *initack_cp, initack_buf;
1004f8829a4aSRandall Stewart 	int chk_length;
1005a5d547adSRandall Stewart 	int init_offset, initack_offset, i;
1006f8829a4aSRandall Stewart 	int retval;
10077f34832bSRandall Stewart 	int spec_flag = 0;
100844b7479bSRandall Stewart 	int how_indx;
1009f8829a4aSRandall Stewart 
1010f8829a4aSRandall Stewart 	/* I know that the TCB is non-NULL from the caller */
1011f8829a4aSRandall Stewart 	asoc = &stcb->asoc;
1012f42a358aSRandall Stewart 	for (how_indx = 0; how_indx < sizeof(asoc->cookie_how); how_indx++) {
101344b7479bSRandall Stewart 		if (asoc->cookie_how[how_indx] == 0)
101444b7479bSRandall Stewart 			break;
101544b7479bSRandall Stewart 	}
101644b7479bSRandall Stewart 	if (how_indx < sizeof(asoc->cookie_how)) {
101744b7479bSRandall Stewart 		asoc->cookie_how[how_indx] = 1;
101844b7479bSRandall Stewart 	}
1019f8829a4aSRandall Stewart 	if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) {
1020f8829a4aSRandall Stewart 		/* SHUTDOWN came in after sending INIT-ACK */
1021f8829a4aSRandall Stewart 		struct mbuf *op_err;
1022f8829a4aSRandall Stewart 		struct sctp_paramhdr *ph;
1023f8829a4aSRandall Stewart 
1024f8829a4aSRandall Stewart 		sctp_send_shutdown_ack(stcb, stcb->asoc.primary_destination);
1025f8829a4aSRandall Stewart 		op_err = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr),
1026139bc87fSRandall Stewart 		    0, M_DONTWAIT, 1, MT_DATA);
1027f8829a4aSRandall Stewart 		if (op_err == NULL) {
1028f8829a4aSRandall Stewart 			/* FOOBAR */
1029f8829a4aSRandall Stewart 			return (NULL);
1030f8829a4aSRandall Stewart 		}
1031f8829a4aSRandall Stewart 		/* pre-reserve some space */
1032139bc87fSRandall Stewart 		SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr));
1033139bc87fSRandall Stewart 		SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr));
1034139bc87fSRandall Stewart 		SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr));
1035f8829a4aSRandall Stewart 		/* Set the len */
1036139bc87fSRandall Stewart 		SCTP_BUF_LEN(op_err) = sizeof(struct sctp_paramhdr);
1037f8829a4aSRandall Stewart 		ph = mtod(op_err, struct sctp_paramhdr *);
1038f8829a4aSRandall Stewart 		ph->param_type = htons(SCTP_CAUSE_COOKIE_IN_SHUTDOWN);
1039f8829a4aSRandall Stewart 		ph->param_length = htons(sizeof(struct sctp_paramhdr));
104017205eccSRandall Stewart 		sctp_send_operr_to(m, iphlen, op_err, cookie->peers_vtag,
104117205eccSRandall Stewart 		    vrf_id, table_id);
104244b7479bSRandall Stewart 		if (how_indx < sizeof(asoc->cookie_how))
104344b7479bSRandall Stewart 			asoc->cookie_how[how_indx] = 2;
1044f8829a4aSRandall Stewart 		return (NULL);
1045f8829a4aSRandall Stewart 	}
1046f8829a4aSRandall Stewart 	/*
1047f8829a4aSRandall Stewart 	 * find and validate the INIT chunk in the cookie (peer's info) the
1048f8829a4aSRandall Stewart 	 * INIT should start after the cookie-echo header struct (chunk
1049f8829a4aSRandall Stewart 	 * header, state cookie header struct)
1050f8829a4aSRandall Stewart 	 */
1051f8829a4aSRandall Stewart 	init_offset = offset += sizeof(struct sctp_cookie_echo_chunk);
1052f8829a4aSRandall Stewart 
1053f8829a4aSRandall Stewart 	init_cp = (struct sctp_init_chunk *)
1054f8829a4aSRandall Stewart 	    sctp_m_getptr(m, init_offset, sizeof(struct sctp_init_chunk),
1055f8829a4aSRandall Stewart 	    (uint8_t *) & init_buf);
1056f8829a4aSRandall Stewart 	if (init_cp == NULL) {
1057f8829a4aSRandall Stewart 		/* could not pull a INIT chunk in cookie */
1058f8829a4aSRandall Stewart 		return (NULL);
1059f8829a4aSRandall Stewart 	}
1060f8829a4aSRandall Stewart 	chk_length = ntohs(init_cp->ch.chunk_length);
1061f8829a4aSRandall Stewart 	if (init_cp->ch.chunk_type != SCTP_INITIATION) {
1062f8829a4aSRandall Stewart 		return (NULL);
1063f8829a4aSRandall Stewart 	}
1064f8829a4aSRandall Stewart 	/*
1065f8829a4aSRandall Stewart 	 * find and validate the INIT-ACK chunk in the cookie (my info) the
1066f8829a4aSRandall Stewart 	 * INIT-ACK follows the INIT chunk
1067f8829a4aSRandall Stewart 	 */
1068f8829a4aSRandall Stewart 	initack_offset = init_offset + SCTP_SIZE32(chk_length);
1069f8829a4aSRandall Stewart 	initack_cp = (struct sctp_init_ack_chunk *)
1070f8829a4aSRandall Stewart 	    sctp_m_getptr(m, initack_offset, sizeof(struct sctp_init_ack_chunk),
1071f8829a4aSRandall Stewart 	    (uint8_t *) & initack_buf);
1072f8829a4aSRandall Stewart 	if (initack_cp == NULL) {
1073f8829a4aSRandall Stewart 		/* could not pull INIT-ACK chunk in cookie */
1074f8829a4aSRandall Stewart 		return (NULL);
1075f8829a4aSRandall Stewart 	}
1076f8829a4aSRandall Stewart 	chk_length = ntohs(initack_cp->ch.chunk_length);
1077f8829a4aSRandall Stewart 	if (initack_cp->ch.chunk_type != SCTP_INITIATION_ACK) {
1078f8829a4aSRandall Stewart 		return (NULL);
1079f8829a4aSRandall Stewart 	}
1080f8829a4aSRandall Stewart 	if ((ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag) &&
1081f8829a4aSRandall Stewart 	    (ntohl(init_cp->init.initiate_tag) == asoc->peer_vtag)) {
1082f8829a4aSRandall Stewart 		/*
1083f8829a4aSRandall Stewart 		 * case D in Section 5.2.4 Table 2: MMAA process accordingly
1084f8829a4aSRandall Stewart 		 * to get into the OPEN state
1085f8829a4aSRandall Stewart 		 */
108644b7479bSRandall Stewart 		if (ntohl(initack_cp->init.initial_tsn) != asoc->init_seq_number) {
108793164cf9SRandall Stewart #ifdef INVARIANTS
108844b7479bSRandall Stewart 			panic("Case D and non-match seq?");
108993164cf9SRandall Stewart #else
1090ad81507eSRandall Stewart 			SCTP_PRINTF("Case D, seq non-match %x vs %x?\n",
1091ad81507eSRandall Stewart 			    ntohl(initack_cp->init.initial_tsn),
1092ad81507eSRandall Stewart 			    asoc->init_seq_number);
109393164cf9SRandall Stewart #endif
109444b7479bSRandall Stewart 		}
1095f8829a4aSRandall Stewart 		switch SCTP_GET_STATE
1096f8829a4aSRandall Stewart 			(asoc) {
1097f8829a4aSRandall Stewart 		case SCTP_STATE_COOKIE_WAIT:
109844b7479bSRandall Stewart 		case SCTP_STATE_COOKIE_ECHOED:
1099f8829a4aSRandall Stewart 			/*
110017205eccSRandall Stewart 			 * INIT was sent but got a COOKIE_ECHO with the
110144b7479bSRandall Stewart 			 * correct tags... just accept it...but we must
110244b7479bSRandall Stewart 			 * process the init so that we can make sure we have
110344b7479bSRandall Stewart 			 * the right seq no's.
1104f8829a4aSRandall Stewart 			 */
1105f8829a4aSRandall Stewart 			/* First we must process the INIT !! */
1106f8829a4aSRandall Stewart 			retval = sctp_process_init(init_cp, stcb, net);
1107f8829a4aSRandall Stewart 			if (retval < 0) {
110844b7479bSRandall Stewart 				if (how_indx < sizeof(asoc->cookie_how))
110944b7479bSRandall Stewart 					asoc->cookie_how[how_indx] = 3;
1110f8829a4aSRandall Stewart 				return (NULL);
1111f8829a4aSRandall Stewart 			}
1112f8829a4aSRandall Stewart 			/* we have already processed the INIT so no problem */
1113f8829a4aSRandall Stewart 			sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb,
1114a5d547adSRandall Stewart 			    net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_11);
1115a5d547adSRandall Stewart 			sctp_timer_stop(SCTP_TIMER_TYPE_INIT, inp, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_12);
1116f8829a4aSRandall Stewart 			/* update current state */
1117f42a358aSRandall Stewart 			if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)
1118f42a358aSRandall Stewart 				SCTP_STAT_INCR_COUNTER32(sctps_activeestab);
1119f42a358aSRandall Stewart 			else
1120f42a358aSRandall Stewart 				SCTP_STAT_INCR_COUNTER32(sctps_collisionestab);
1121f8829a4aSRandall Stewart 			if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
1122f42a358aSRandall Stewart 				asoc->state = SCTP_STATE_OPEN | SCTP_STATE_SHUTDOWN_PENDING;
1123f8829a4aSRandall Stewart 				sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
1124f8829a4aSRandall Stewart 				    stcb->sctp_ep, stcb, asoc->primary_destination);
1125f8829a4aSRandall Stewart 
1126f42a358aSRandall Stewart 			} else {
1127f8829a4aSRandall Stewart 				/* if ok, move to OPEN state */
1128f8829a4aSRandall Stewart 				asoc->state = SCTP_STATE_OPEN;
1129f8829a4aSRandall Stewart 			}
1130f42a358aSRandall Stewart 			SCTP_STAT_INCR_GAUGE32(sctps_currestab);
1131a5d547adSRandall Stewart 			sctp_stop_all_cookie_timers(stcb);
1132f8829a4aSRandall Stewart 			if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
1133f8829a4aSRandall Stewart 			    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
1134f8829a4aSRandall Stewart 			    (inp->sctp_socket->so_qlimit == 0)
1135f8829a4aSRandall Stewart 			    ) {
1136f8829a4aSRandall Stewart 				/*
1137f8829a4aSRandall Stewart 				 * Here is where collision would go if we
1138f8829a4aSRandall Stewart 				 * did a connect() and instead got a
1139f8829a4aSRandall Stewart 				 * init/init-ack/cookie done before the
1140f8829a4aSRandall Stewart 				 * init-ack came back..
1141f8829a4aSRandall Stewart 				 */
1142f8829a4aSRandall Stewart 				stcb->sctp_ep->sctp_flags |=
1143f8829a4aSRandall Stewart 				    SCTP_PCB_FLAGS_CONNECTED;
1144f8829a4aSRandall Stewart 				soisconnected(stcb->sctp_ep->sctp_socket);
1145f8829a4aSRandall Stewart 			}
1146f8829a4aSRandall Stewart 			/* notify upper layer */
1147f8829a4aSRandall Stewart 			*notification = SCTP_NOTIFY_ASSOC_UP;
1148f8829a4aSRandall Stewart 			/*
1149f8829a4aSRandall Stewart 			 * since we did not send a HB make sure we don't
1150f8829a4aSRandall Stewart 			 * double things
1151f8829a4aSRandall Stewart 			 */
1152f8829a4aSRandall Stewart 			net->hb_responded = 1;
1153f8829a4aSRandall Stewart 
1154f8829a4aSRandall Stewart 			if (stcb->asoc.sctp_autoclose_ticks &&
1155f8829a4aSRandall Stewart 			    (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE))) {
1156f8829a4aSRandall Stewart 				sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE,
1157f8829a4aSRandall Stewart 				    inp, stcb, NULL);
1158f8829a4aSRandall Stewart 			}
1159f8829a4aSRandall Stewart 			break;
1160f8829a4aSRandall Stewart 		default:
1161f8829a4aSRandall Stewart 			/*
1162f8829a4aSRandall Stewart 			 * we're in the OPEN state (or beyond), so peer must
1163f8829a4aSRandall Stewart 			 * have simply lost the COOKIE-ACK
1164f8829a4aSRandall Stewart 			 */
1165f8829a4aSRandall Stewart 			break;
1166f8829a4aSRandall Stewart 			}	/* end switch */
1167a5d547adSRandall Stewart 		sctp_stop_all_cookie_timers(stcb);
1168f8829a4aSRandall Stewart 		/*
1169f8829a4aSRandall Stewart 		 * We ignore the return code here.. not sure if we should
1170f8829a4aSRandall Stewart 		 * somehow abort.. but we do have an existing asoc. This
1171f8829a4aSRandall Stewart 		 * really should not fail.
1172f8829a4aSRandall Stewart 		 */
1173f8829a4aSRandall Stewart 		if (sctp_load_addresses_from_init(stcb, m, iphlen,
1174f8829a4aSRandall Stewart 		    init_offset + sizeof(struct sctp_init_chunk),
1175f8829a4aSRandall Stewart 		    initack_offset, sh, init_src)) {
117644b7479bSRandall Stewart 			if (how_indx < sizeof(asoc->cookie_how))
117744b7479bSRandall Stewart 				asoc->cookie_how[how_indx] = 4;
1178f8829a4aSRandall Stewart 			return (NULL);
1179f8829a4aSRandall Stewart 		}
1180f8829a4aSRandall Stewart 		/* respond with a COOKIE-ACK */
1181a5d547adSRandall Stewart 		sctp_toss_old_cookies(stcb, asoc);
1182f8829a4aSRandall Stewart 		sctp_send_cookie_ack(stcb);
118344b7479bSRandall Stewart 		if (how_indx < sizeof(asoc->cookie_how))
118444b7479bSRandall Stewart 			asoc->cookie_how[how_indx] = 5;
1185f8829a4aSRandall Stewart 		return (stcb);
118617205eccSRandall Stewart 	}
1187f8829a4aSRandall Stewart 	if (ntohl(initack_cp->init.initiate_tag) != asoc->my_vtag &&
1188f8829a4aSRandall Stewart 	    ntohl(init_cp->init.initiate_tag) == asoc->peer_vtag &&
1189f8829a4aSRandall Stewart 	    cookie->tie_tag_my_vtag == 0 &&
1190f8829a4aSRandall Stewart 	    cookie->tie_tag_peer_vtag == 0) {
1191f8829a4aSRandall Stewart 		/*
1192f8829a4aSRandall Stewart 		 * case C in Section 5.2.4 Table 2: XMOO silently discard
1193f8829a4aSRandall Stewart 		 */
119444b7479bSRandall Stewart 		if (how_indx < sizeof(asoc->cookie_how))
119544b7479bSRandall Stewart 			asoc->cookie_how[how_indx] = 6;
1196f8829a4aSRandall Stewart 		return (NULL);
1197f8829a4aSRandall Stewart 	}
1198f8829a4aSRandall Stewart 	if (ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag &&
1199f8829a4aSRandall Stewart 	    (ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag ||
1200f8829a4aSRandall Stewart 	    init_cp->init.initiate_tag == 0)) {
1201f8829a4aSRandall Stewart 		/*
1202f8829a4aSRandall Stewart 		 * case B in Section 5.2.4 Table 2: MXAA or MOAA my info
1203f8829a4aSRandall Stewart 		 * should be ok, re-accept peer info
1204f8829a4aSRandall Stewart 		 */
120544b7479bSRandall Stewart 		if (ntohl(initack_cp->init.initial_tsn) != asoc->init_seq_number) {
120644b7479bSRandall Stewart 			/*
120744b7479bSRandall Stewart 			 * Extension of case C. If we hit this, then the
120844b7479bSRandall Stewart 			 * random number generator returned the same vtag
120944b7479bSRandall Stewart 			 * when we first sent our INIT-ACK and when we later
121044b7479bSRandall Stewart 			 * sent our INIT. The side with the seq numbers that
121144b7479bSRandall Stewart 			 * are different will be the one that normnally
121244b7479bSRandall Stewart 			 * would have hit case C. This in effect "extends"
121344b7479bSRandall Stewart 			 * our vtags in this collision case to be 64 bits.
121444b7479bSRandall Stewart 			 * The same collision could occur aka you get both
121544b7479bSRandall Stewart 			 * vtag and seq number the same twice in a row.. but
121644b7479bSRandall Stewart 			 * is much less likely. If it did happen then we
121744b7479bSRandall Stewart 			 * would proceed through and bring up the assoc.. we
121844b7479bSRandall Stewart 			 * may end up with the wrong stream setup however..
121944b7479bSRandall Stewart 			 * which would be bad.. but there is no way to
122044b7479bSRandall Stewart 			 * tell.. until we send on a stream that does not
122144b7479bSRandall Stewart 			 * exist :-)
122244b7479bSRandall Stewart 			 */
122344b7479bSRandall Stewart 			if (how_indx < sizeof(asoc->cookie_how))
122444b7479bSRandall Stewart 				asoc->cookie_how[how_indx] = 7;
122544b7479bSRandall Stewart 
122644b7479bSRandall Stewart 			return (NULL);
122744b7479bSRandall Stewart 		}
122844b7479bSRandall Stewart 		if (how_indx < sizeof(asoc->cookie_how))
122944b7479bSRandall Stewart 			asoc->cookie_how[how_indx] = 8;
1230a5d547adSRandall Stewart 		sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_13);
1231f8829a4aSRandall Stewart 		sctp_stop_all_cookie_timers(stcb);
1232f8829a4aSRandall Stewart 		/*
1233f8829a4aSRandall Stewart 		 * since we did not send a HB make sure we don't double
1234f8829a4aSRandall Stewart 		 * things
1235f8829a4aSRandall Stewart 		 */
1236f8829a4aSRandall Stewart 		net->hb_responded = 1;
1237f8829a4aSRandall Stewart 		if (stcb->asoc.sctp_autoclose_ticks &&
1238f8829a4aSRandall Stewart 		    sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE)) {
1239f8829a4aSRandall Stewart 			sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb,
1240f8829a4aSRandall Stewart 			    NULL);
1241f8829a4aSRandall Stewart 		}
1242f8829a4aSRandall Stewart 		asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd);
12437f34832bSRandall Stewart 		asoc->pre_open_streams = ntohs(initack_cp->init.num_outbound_streams);
1244f8829a4aSRandall Stewart 
12457f34832bSRandall Stewart 		/* Note last_cwr_tsn? where is this used? */
12467f34832bSRandall Stewart 		asoc->last_cwr_tsn = asoc->init_seq_number - 1;
12477f34832bSRandall Stewart 		if (ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) {
12487f34832bSRandall Stewart 			/*
12497f34832bSRandall Stewart 			 * Ok the peer probably discarded our data (if we
12507f34832bSRandall Stewart 			 * echoed a cookie+data). So anything on the
12517f34832bSRandall Stewart 			 * sent_queue should be marked for retransmit, we
12527f34832bSRandall Stewart 			 * may not get something to kick us so it COULD
12537f34832bSRandall Stewart 			 * still take a timeout to move these.. but it can't
12547f34832bSRandall Stewart 			 * hurt to mark them.
12557f34832bSRandall Stewart 			 */
12567f34832bSRandall Stewart 			struct sctp_tmit_chunk *chk;
12577f34832bSRandall Stewart 
12587f34832bSRandall Stewart 			TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
12597f34832bSRandall Stewart 				if (chk->sent < SCTP_DATAGRAM_RESEND) {
12607f34832bSRandall Stewart 					chk->sent = SCTP_DATAGRAM_RESEND;
12615e54f665SRandall Stewart 					sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
12627f34832bSRandall Stewart 					spec_flag++;
12637f34832bSRandall Stewart 				}
12647f34832bSRandall Stewart 			}
12657f34832bSRandall Stewart 
12667f34832bSRandall Stewart 		}
1267f8829a4aSRandall Stewart 		/* process the INIT info (peer's info) */
1268f8829a4aSRandall Stewart 		retval = sctp_process_init(init_cp, stcb, net);
1269f8829a4aSRandall Stewart 		if (retval < 0) {
127044b7479bSRandall Stewart 			if (how_indx < sizeof(asoc->cookie_how))
127144b7479bSRandall Stewart 				asoc->cookie_how[how_indx] = 9;
1272f8829a4aSRandall Stewart 			return (NULL);
1273f8829a4aSRandall Stewart 		}
1274f8829a4aSRandall Stewart 		if (sctp_load_addresses_from_init(stcb, m, iphlen,
1275f8829a4aSRandall Stewart 		    init_offset + sizeof(struct sctp_init_chunk),
1276f8829a4aSRandall Stewart 		    initack_offset, sh, init_src)) {
127744b7479bSRandall Stewart 			if (how_indx < sizeof(asoc->cookie_how))
127844b7479bSRandall Stewart 				asoc->cookie_how[how_indx] = 10;
1279f8829a4aSRandall Stewart 			return (NULL);
1280f8829a4aSRandall Stewart 		}
1281f8829a4aSRandall Stewart 		if ((asoc->state & SCTP_STATE_COOKIE_WAIT) ||
1282f8829a4aSRandall Stewart 		    (asoc->state & SCTP_STATE_COOKIE_ECHOED)) {
1283f8829a4aSRandall Stewart 			*notification = SCTP_NOTIFY_ASSOC_UP;
1284f8829a4aSRandall Stewart 
1285f8829a4aSRandall Stewart 			if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
1286f8829a4aSRandall Stewart 			    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
1287f8829a4aSRandall Stewart 			    (inp->sctp_socket->so_qlimit == 0)) {
1288f8829a4aSRandall Stewart 				stcb->sctp_ep->sctp_flags |=
1289f8829a4aSRandall Stewart 				    SCTP_PCB_FLAGS_CONNECTED;
1290f8829a4aSRandall Stewart 				soisconnected(stcb->sctp_ep->sctp_socket);
1291f8829a4aSRandall Stewart 			}
1292f42a358aSRandall Stewart 			if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)
1293f42a358aSRandall Stewart 				SCTP_STAT_INCR_COUNTER32(sctps_activeestab);
1294f42a358aSRandall Stewart 			else
1295f42a358aSRandall Stewart 				SCTP_STAT_INCR_COUNTER32(sctps_collisionestab);
1296f42a358aSRandall Stewart 			SCTP_STAT_INCR_COUNTER32(sctps_activeestab);
1297f42a358aSRandall Stewart 			SCTP_STAT_INCR_GAUGE32(sctps_currestab);
1298f42a358aSRandall Stewart 		} else if (SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) {
1299f42a358aSRandall Stewart 			SCTP_STAT_INCR_COUNTER32(sctps_restartestab);
1300f42a358aSRandall Stewart 		} else {
1301f42a358aSRandall Stewart 			SCTP_STAT_INCR_COUNTER32(sctps_collisionestab);
1302f8829a4aSRandall Stewart 		}
1303f8829a4aSRandall Stewart 		if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
1304f42a358aSRandall Stewart 			asoc->state = SCTP_STATE_OPEN | SCTP_STATE_SHUTDOWN_PENDING;
1305f8829a4aSRandall Stewart 			sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
1306f8829a4aSRandall Stewart 			    stcb->sctp_ep, stcb, asoc->primary_destination);
1307f8829a4aSRandall Stewart 
1308f8829a4aSRandall Stewart 		} else {
1309f8829a4aSRandall Stewart 			asoc->state = SCTP_STATE_OPEN;
1310f8829a4aSRandall Stewart 		}
1311f8829a4aSRandall Stewart 		sctp_stop_all_cookie_timers(stcb);
1312a5d547adSRandall Stewart 		sctp_toss_old_cookies(stcb, asoc);
1313f8829a4aSRandall Stewart 		sctp_send_cookie_ack(stcb);
13147f34832bSRandall Stewart 		if (spec_flag) {
13157f34832bSRandall Stewart 			/*
13167f34832bSRandall Stewart 			 * only if we have retrans set do we do this. What
13177f34832bSRandall Stewart 			 * this call does is get only the COOKIE-ACK out and
13187f34832bSRandall Stewart 			 * then when we return the normal call to
13197f34832bSRandall Stewart 			 * sctp_chunk_output will get the retrans out behind
13207f34832bSRandall Stewart 			 * this.
13217f34832bSRandall Stewart 			 */
13227f34832bSRandall Stewart 			sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_COOKIE_ACK);
13237f34832bSRandall Stewart 		}
132444b7479bSRandall Stewart 		if (how_indx < sizeof(asoc->cookie_how))
132544b7479bSRandall Stewart 			asoc->cookie_how[how_indx] = 11;
132644b7479bSRandall Stewart 
1327f8829a4aSRandall Stewart 		return (stcb);
1328f8829a4aSRandall Stewart 	}
1329f8829a4aSRandall Stewart 	if ((ntohl(initack_cp->init.initiate_tag) != asoc->my_vtag &&
1330f8829a4aSRandall Stewart 	    ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) &&
1331f8829a4aSRandall Stewart 	    cookie->tie_tag_my_vtag == asoc->my_vtag_nonce &&
1332f8829a4aSRandall Stewart 	    cookie->tie_tag_peer_vtag == asoc->peer_vtag_nonce &&
1333f8829a4aSRandall Stewart 	    cookie->tie_tag_peer_vtag != 0) {
1334f8829a4aSRandall Stewart 		struct sctpasochead *head;
1335f8829a4aSRandall Stewart 
1336f8829a4aSRandall Stewart 		/*
1337f8829a4aSRandall Stewart 		 * case A in Section 5.2.4 Table 2: XXMM (peer restarted)
1338f8829a4aSRandall Stewart 		 */
1339a5d547adSRandall Stewart 		/* temp code */
134044b7479bSRandall Stewart 		if (how_indx < sizeof(asoc->cookie_how))
134144b7479bSRandall Stewart 			asoc->cookie_how[how_indx] = 12;
1342a5d547adSRandall Stewart 		sctp_timer_stop(SCTP_TIMER_TYPE_INIT, inp, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_14);
1343a5d547adSRandall Stewart 		sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_15);
1344139bc87fSRandall Stewart 
1345f8829a4aSRandall Stewart 		*sac_assoc_id = sctp_get_associd(stcb);
1346f8829a4aSRandall Stewart 		/* notify upper layer */
1347f8829a4aSRandall Stewart 		*notification = SCTP_NOTIFY_ASSOC_RESTART;
1348a5d547adSRandall Stewart 		atomic_add_int(&stcb->asoc.refcnt, 1);
1349f42a358aSRandall Stewart 		if ((SCTP_GET_STATE(asoc) != SCTP_STATE_OPEN) &&
1350f42a358aSRandall Stewart 		    (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) &&
1351f42a358aSRandall Stewart 		    (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT)) {
1352f42a358aSRandall Stewart 			SCTP_STAT_INCR_GAUGE32(sctps_currestab);
1353f42a358aSRandall Stewart 		}
1354f42a358aSRandall Stewart 		if (SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) {
1355f42a358aSRandall Stewart 			SCTP_STAT_INCR_GAUGE32(sctps_restartestab);
1356f42a358aSRandall Stewart 		} else if (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) {
1357f42a358aSRandall Stewart 			SCTP_STAT_INCR_GAUGE32(sctps_collisionestab);
1358f42a358aSRandall Stewart 		}
1359139bc87fSRandall Stewart 		if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
1360139bc87fSRandall Stewart 			asoc->state = SCTP_STATE_OPEN |
1361139bc87fSRandall Stewart 			    SCTP_STATE_SHUTDOWN_PENDING;
1362139bc87fSRandall Stewart 			sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
1363139bc87fSRandall Stewart 			    stcb->sctp_ep, stcb, asoc->primary_destination);
1364139bc87fSRandall Stewart 
1365139bc87fSRandall Stewart 		} else if (!(asoc->state & SCTP_STATE_SHUTDOWN_SENT)) {
1366139bc87fSRandall Stewart 			/* move to OPEN state, if not in SHUTDOWN_SENT */
1367139bc87fSRandall Stewart 			asoc->state = SCTP_STATE_OPEN;
1368139bc87fSRandall Stewart 		}
1369139bc87fSRandall Stewart 		asoc->pre_open_streams =
1370139bc87fSRandall Stewart 		    ntohs(initack_cp->init.num_outbound_streams);
1371139bc87fSRandall Stewart 		asoc->init_seq_number = ntohl(initack_cp->init.initial_tsn);
1372139bc87fSRandall Stewart 		asoc->sending_seq = asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number;
1373139bc87fSRandall Stewart 
1374139bc87fSRandall Stewart 		asoc->last_cwr_tsn = asoc->init_seq_number - 1;
1375139bc87fSRandall Stewart 		asoc->asconf_seq_in = asoc->last_acked_seq = asoc->init_seq_number - 1;
1376139bc87fSRandall Stewart 
1377139bc87fSRandall Stewart 		asoc->str_reset_seq_in = asoc->init_seq_number;
1378139bc87fSRandall Stewart 
1379139bc87fSRandall Stewart 		asoc->advanced_peer_ack_point = asoc->last_acked_seq;
1380139bc87fSRandall Stewart 		if (asoc->mapping_array)
1381139bc87fSRandall Stewart 			memset(asoc->mapping_array, 0,
1382139bc87fSRandall Stewart 			    asoc->mapping_array_size);
1383a5d547adSRandall Stewart 		SCTP_TCB_UNLOCK(stcb);
1384a5d547adSRandall Stewart 		SCTP_INP_INFO_WLOCK();
1385a5d547adSRandall Stewart 		SCTP_INP_WLOCK(stcb->sctp_ep);
1386a5d547adSRandall Stewart 		SCTP_TCB_LOCK(stcb);
1387a5d547adSRandall Stewart 		atomic_add_int(&stcb->asoc.refcnt, -1);
1388f8829a4aSRandall Stewart 		/* send up all the data */
13897f34832bSRandall Stewart 		SCTP_TCB_SEND_LOCK(stcb);
1390f8829a4aSRandall Stewart 
1391a5d547adSRandall Stewart 		sctp_report_all_outbound(stcb, 1);
1392a5d547adSRandall Stewart 		for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
1393a5d547adSRandall Stewart 			stcb->asoc.strmout[i].stream_no = i;
1394a5d547adSRandall Stewart 			stcb->asoc.strmout[i].next_sequence_sent = 0;
1395a5d547adSRandall Stewart 			stcb->asoc.strmout[i].last_msg_incomplete = 0;
1396a5d547adSRandall Stewart 		}
1397f8829a4aSRandall Stewart 		/* process the INIT-ACK info (my info) */
1398f8829a4aSRandall Stewart 		asoc->my_vtag = ntohl(initack_cp->init.initiate_tag);
1399f8829a4aSRandall Stewart 		asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd);
1400f8829a4aSRandall Stewart 
1401f8829a4aSRandall Stewart 		/* pull from vtag hash */
1402f8829a4aSRandall Stewart 		LIST_REMOVE(stcb, sctp_asocs);
1403f8829a4aSRandall Stewart 		/* re-insert to new vtag position */
1404f8829a4aSRandall Stewart 		head = &sctppcbinfo.sctp_asochash[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag,
1405f8829a4aSRandall Stewart 		    sctppcbinfo.hashasocmark)];
1406f8829a4aSRandall Stewart 		/*
1407f8829a4aSRandall Stewart 		 * put it in the bucket in the vtag hash of assoc's for the
1408f8829a4aSRandall Stewart 		 * system
1409f8829a4aSRandall Stewart 		 */
1410f8829a4aSRandall Stewart 		LIST_INSERT_HEAD(head, stcb, sctp_asocs);
1411f8829a4aSRandall Stewart 
1412f8829a4aSRandall Stewart 		/* Is this the first restart? */
1413f8829a4aSRandall Stewart 		if (stcb->asoc.in_restart_hash == 0) {
1414f8829a4aSRandall Stewart 			/* Ok add it to assoc_id vtag hash */
1415f8829a4aSRandall Stewart 			head = &sctppcbinfo.sctp_restarthash[SCTP_PCBHASH_ASOC(stcb->asoc.assoc_id,
1416f8829a4aSRandall Stewart 			    sctppcbinfo.hashrestartmark)];
1417f8829a4aSRandall Stewart 			LIST_INSERT_HEAD(head, stcb, sctp_tcbrestarhash);
1418f8829a4aSRandall Stewart 			stcb->asoc.in_restart_hash = 1;
1419f8829a4aSRandall Stewart 		}
1420f8829a4aSRandall Stewart 		/* process the INIT info (peer's info) */
14217f34832bSRandall Stewart 		SCTP_TCB_SEND_UNLOCK(stcb);
1422a5d547adSRandall Stewart 		SCTP_INP_WUNLOCK(stcb->sctp_ep);
1423a5d547adSRandall Stewart 		SCTP_INP_INFO_WUNLOCK();
1424a5d547adSRandall Stewart 
1425f8829a4aSRandall Stewart 		retval = sctp_process_init(init_cp, stcb, net);
1426f8829a4aSRandall Stewart 		if (retval < 0) {
142744b7479bSRandall Stewart 			if (how_indx < sizeof(asoc->cookie_how))
142844b7479bSRandall Stewart 				asoc->cookie_how[how_indx] = 13;
142944b7479bSRandall Stewart 
1430f8829a4aSRandall Stewart 			return (NULL);
1431f8829a4aSRandall Stewart 		}
1432f8829a4aSRandall Stewart 		/*
1433f8829a4aSRandall Stewart 		 * since we did not send a HB make sure we don't double
1434f8829a4aSRandall Stewart 		 * things
1435f8829a4aSRandall Stewart 		 */
1436f8829a4aSRandall Stewart 		net->hb_responded = 1;
1437f8829a4aSRandall Stewart 
1438f8829a4aSRandall Stewart 		if (sctp_load_addresses_from_init(stcb, m, iphlen,
1439f8829a4aSRandall Stewart 		    init_offset + sizeof(struct sctp_init_chunk),
1440f8829a4aSRandall Stewart 		    initack_offset, sh, init_src)) {
144144b7479bSRandall Stewart 			if (how_indx < sizeof(asoc->cookie_how))
144244b7479bSRandall Stewart 				asoc->cookie_how[how_indx] = 14;
144344b7479bSRandall Stewart 
1444f8829a4aSRandall Stewart 			return (NULL);
1445f8829a4aSRandall Stewart 		}
1446f8829a4aSRandall Stewart 		/* respond with a COOKIE-ACK */
1447f8829a4aSRandall Stewart 		sctp_stop_all_cookie_timers(stcb);
1448a5d547adSRandall Stewart 		sctp_toss_old_cookies(stcb, asoc);
1449f8829a4aSRandall Stewart 		sctp_send_cookie_ack(stcb);
145044b7479bSRandall Stewart 		if (how_indx < sizeof(asoc->cookie_how))
145144b7479bSRandall Stewart 			asoc->cookie_how[how_indx] = 15;
1452f8829a4aSRandall Stewart 
1453f8829a4aSRandall Stewart 		return (stcb);
1454f8829a4aSRandall Stewart 	}
145544b7479bSRandall Stewart 	if (how_indx < sizeof(asoc->cookie_how))
145644b7479bSRandall Stewart 		asoc->cookie_how[how_indx] = 16;
1457f8829a4aSRandall Stewart 	/* all other cases... */
1458f8829a4aSRandall Stewart 	return (NULL);
1459f8829a4aSRandall Stewart }
1460f8829a4aSRandall Stewart 
146193164cf9SRandall Stewart 
1462f8829a4aSRandall Stewart /*
1463f8829a4aSRandall Stewart  * handle a state cookie for a new association m: input packet mbuf chain--
1464f8829a4aSRandall Stewart  * assumes a pullup on IP/SCTP/COOKIE-ECHO chunk note: this is a "split" mbuf
1465f8829a4aSRandall Stewart  * and the cookie signature does not exist offset: offset into mbuf to the
1466f8829a4aSRandall Stewart  * cookie-echo chunk length: length of the cookie chunk to: where the init
1467f8829a4aSRandall Stewart  * was from returns a new TCB
1468f8829a4aSRandall Stewart  */
1469f8829a4aSRandall Stewart static struct sctp_tcb *
1470f8829a4aSRandall Stewart sctp_process_cookie_new(struct mbuf *m, int iphlen, int offset,
1471f8829a4aSRandall Stewart     struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len,
1472f8829a4aSRandall Stewart     struct sctp_inpcb *inp, struct sctp_nets **netp,
1473f8829a4aSRandall Stewart     struct sockaddr *init_src, int *notification,
147417205eccSRandall Stewart     int auth_skipped, uint32_t auth_offset, uint32_t auth_len,
147517205eccSRandall Stewart     uint32_t vrf_id, uint32_t table_id)
1476f8829a4aSRandall Stewart {
1477f8829a4aSRandall Stewart 	struct sctp_tcb *stcb;
1478f8829a4aSRandall Stewart 	struct sctp_init_chunk *init_cp, init_buf;
1479f8829a4aSRandall Stewart 	struct sctp_init_ack_chunk *initack_cp, initack_buf;
1480f8829a4aSRandall Stewart 	struct sockaddr_storage sa_store;
1481f8829a4aSRandall Stewart 	struct sockaddr *initack_src = (struct sockaddr *)&sa_store;
1482f8829a4aSRandall Stewart 	struct sockaddr_in *sin;
1483f8829a4aSRandall Stewart 	struct sockaddr_in6 *sin6;
1484f8829a4aSRandall Stewart 	struct sctp_association *asoc;
1485f8829a4aSRandall Stewart 	int chk_length;
1486f8829a4aSRandall Stewart 	int init_offset, initack_offset, initack_limit;
1487f8829a4aSRandall Stewart 	int retval;
1488f8829a4aSRandall Stewart 	int error = 0;
1489f8829a4aSRandall Stewart 	uint32_t old_tag;
1490f42a358aSRandall Stewart 	uint8_t auth_chunk_buf[SCTP_PARAM_BUFFER_SIZE];
1491f8829a4aSRandall Stewart 
1492f8829a4aSRandall Stewart 	/*
1493f8829a4aSRandall Stewart 	 * find and validate the INIT chunk in the cookie (peer's info) the
1494f8829a4aSRandall Stewart 	 * INIT should start after the cookie-echo header struct (chunk
1495f8829a4aSRandall Stewart 	 * header, state cookie header struct)
1496f8829a4aSRandall Stewart 	 */
1497f8829a4aSRandall Stewart 	init_offset = offset + sizeof(struct sctp_cookie_echo_chunk);
1498f8829a4aSRandall Stewart 	init_cp = (struct sctp_init_chunk *)
1499f8829a4aSRandall Stewart 	    sctp_m_getptr(m, init_offset, sizeof(struct sctp_init_chunk),
1500f8829a4aSRandall Stewart 	    (uint8_t *) & init_buf);
1501f8829a4aSRandall Stewart 	if (init_cp == NULL) {
1502f8829a4aSRandall Stewart 		/* could not pull a INIT chunk in cookie */
1503ad81507eSRandall Stewart 		SCTPDBG(SCTP_DEBUG_INPUT1,
1504ad81507eSRandall Stewart 		    "process_cookie_new: could not pull INIT chunk hdr\n");
1505f8829a4aSRandall Stewart 		return (NULL);
1506f8829a4aSRandall Stewart 	}
1507f8829a4aSRandall Stewart 	chk_length = ntohs(init_cp->ch.chunk_length);
1508f8829a4aSRandall Stewart 	if (init_cp->ch.chunk_type != SCTP_INITIATION) {
1509ad81507eSRandall Stewart 		SCTPDBG(SCTP_DEBUG_INPUT1, "HUH? process_cookie_new: could not find INIT chunk!\n");
1510f8829a4aSRandall Stewart 		return (NULL);
1511f8829a4aSRandall Stewart 	}
1512f8829a4aSRandall Stewart 	initack_offset = init_offset + SCTP_SIZE32(chk_length);
1513f8829a4aSRandall Stewart 	/*
1514f8829a4aSRandall Stewart 	 * find and validate the INIT-ACK chunk in the cookie (my info) the
1515f8829a4aSRandall Stewart 	 * INIT-ACK follows the INIT chunk
1516f8829a4aSRandall Stewart 	 */
1517f8829a4aSRandall Stewart 	initack_cp = (struct sctp_init_ack_chunk *)
1518f8829a4aSRandall Stewart 	    sctp_m_getptr(m, initack_offset, sizeof(struct sctp_init_ack_chunk),
1519f8829a4aSRandall Stewart 	    (uint8_t *) & initack_buf);
1520f8829a4aSRandall Stewart 	if (initack_cp == NULL) {
1521f8829a4aSRandall Stewart 		/* could not pull INIT-ACK chunk in cookie */
1522ad81507eSRandall Stewart 		SCTPDBG(SCTP_DEBUG_INPUT1, "process_cookie_new: could not pull INIT-ACK chunk hdr\n");
1523f8829a4aSRandall Stewart 		return (NULL);
1524f8829a4aSRandall Stewart 	}
1525f8829a4aSRandall Stewart 	chk_length = ntohs(initack_cp->ch.chunk_length);
1526f8829a4aSRandall Stewart 	if (initack_cp->ch.chunk_type != SCTP_INITIATION_ACK) {
1527f8829a4aSRandall Stewart 		return (NULL);
1528f8829a4aSRandall Stewart 	}
1529f8829a4aSRandall Stewart 	/*
1530f8829a4aSRandall Stewart 	 * NOTE: We can't use the INIT_ACK's chk_length to determine the
1531f8829a4aSRandall Stewart 	 * "initack_limit" value.  This is because the chk_length field
1532f8829a4aSRandall Stewart 	 * includes the length of the cookie, but the cookie is omitted when
1533f8829a4aSRandall Stewart 	 * the INIT and INIT_ACK are tacked onto the cookie...
1534f8829a4aSRandall Stewart 	 */
1535f8829a4aSRandall Stewart 	initack_limit = offset + cookie_len;
1536f8829a4aSRandall Stewart 
1537f8829a4aSRandall Stewart 	/*
1538f8829a4aSRandall Stewart 	 * now that we know the INIT/INIT-ACK are in place, create a new TCB
1539f8829a4aSRandall Stewart 	 * and popluate
1540f8829a4aSRandall Stewart 	 */
1541f8829a4aSRandall Stewart 	stcb = sctp_aloc_assoc(inp, init_src, 0, &error,
1542bff64a4dSRandall Stewart 	    ntohl(initack_cp->init.initiate_tag), vrf_id);
1543f8829a4aSRandall Stewart 	if (stcb == NULL) {
1544f8829a4aSRandall Stewart 		struct mbuf *op_err;
1545f8829a4aSRandall Stewart 
1546f8829a4aSRandall Stewart 		/* memory problem? */
1547ad81507eSRandall Stewart 		SCTPDBG(SCTP_DEBUG_INPUT1,
1548ad81507eSRandall Stewart 		    "process_cookie_new: no room for another TCB!\n");
1549f8829a4aSRandall Stewart 		op_err = sctp_generate_invmanparam(SCTP_CAUSE_OUT_OF_RESC);
1550f8829a4aSRandall Stewart 		sctp_abort_association(inp, (struct sctp_tcb *)NULL, m, iphlen,
155117205eccSRandall Stewart 		    sh, op_err, vrf_id, table_id);
1552f8829a4aSRandall Stewart 		return (NULL);
1553f8829a4aSRandall Stewart 	}
1554f8829a4aSRandall Stewart 	/* get the correct sctp_nets */
1555ad81507eSRandall Stewart 	if (netp)
1556f8829a4aSRandall Stewart 		*netp = sctp_findnet(stcb, init_src);
1557ad81507eSRandall Stewart 
1558f8829a4aSRandall Stewart 	asoc = &stcb->asoc;
155917205eccSRandall Stewart 	/* save the table id (vrf_id is done in aloc_assoc) */
156017205eccSRandall Stewart 	asoc->table_id = table_id;
1561f8829a4aSRandall Stewart 	/* get scope variables out of cookie */
1562f8829a4aSRandall Stewart 	asoc->ipv4_local_scope = cookie->ipv4_scope;
1563f8829a4aSRandall Stewart 	asoc->site_scope = cookie->site_scope;
1564f8829a4aSRandall Stewart 	asoc->local_scope = cookie->local_scope;
1565f8829a4aSRandall Stewart 	asoc->loopback_scope = cookie->loopback_scope;
1566f8829a4aSRandall Stewart 
1567f8829a4aSRandall Stewart 	if ((asoc->ipv4_addr_legal != cookie->ipv4_addr_legal) ||
1568f8829a4aSRandall Stewart 	    (asoc->ipv6_addr_legal != cookie->ipv6_addr_legal)) {
1569f8829a4aSRandall Stewart 		struct mbuf *op_err;
1570f8829a4aSRandall Stewart 
1571f8829a4aSRandall Stewart 		/*
1572f8829a4aSRandall Stewart 		 * Houston we have a problem. The EP changed while the
1573f8829a4aSRandall Stewart 		 * cookie was in flight. Only recourse is to abort the
1574f8829a4aSRandall Stewart 		 * association.
1575f8829a4aSRandall Stewart 		 */
1576f8829a4aSRandall Stewart 		op_err = sctp_generate_invmanparam(SCTP_CAUSE_OUT_OF_RESC);
1577f8829a4aSRandall Stewart 		sctp_abort_association(inp, (struct sctp_tcb *)NULL, m, iphlen,
157817205eccSRandall Stewart 		    sh, op_err, vrf_id, table_id);
1579f8829a4aSRandall Stewart 		return (NULL);
1580f8829a4aSRandall Stewart 	}
1581f8829a4aSRandall Stewart 	/* process the INIT-ACK info (my info) */
1582f8829a4aSRandall Stewart 	old_tag = asoc->my_vtag;
1583f8829a4aSRandall Stewart 	asoc->assoc_id = asoc->my_vtag = ntohl(initack_cp->init.initiate_tag);
1584f8829a4aSRandall Stewart 	asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd);
1585f8829a4aSRandall Stewart 	asoc->pre_open_streams = ntohs(initack_cp->init.num_outbound_streams);
1586f8829a4aSRandall Stewart 	asoc->init_seq_number = ntohl(initack_cp->init.initial_tsn);
1587f8829a4aSRandall Stewart 	asoc->sending_seq = asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number;
1588f8829a4aSRandall Stewart 	asoc->last_cwr_tsn = asoc->init_seq_number - 1;
1589f8829a4aSRandall Stewart 	asoc->asconf_seq_in = asoc->last_acked_seq = asoc->init_seq_number - 1;
1590f8829a4aSRandall Stewart 	asoc->str_reset_seq_in = asoc->init_seq_number;
1591f8829a4aSRandall Stewart 
1592f8829a4aSRandall Stewart 	asoc->advanced_peer_ack_point = asoc->last_acked_seq;
1593f8829a4aSRandall Stewart 
1594f8829a4aSRandall Stewart 	/* process the INIT info (peer's info) */
1595ad81507eSRandall Stewart 	if (netp)
1596f8829a4aSRandall Stewart 		retval = sctp_process_init(init_cp, stcb, *netp);
1597ad81507eSRandall Stewart 	else
1598ad81507eSRandall Stewart 		retval = 0;
1599f8829a4aSRandall Stewart 	if (retval < 0) {
1600a5d547adSRandall Stewart 		sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_16);
1601f8829a4aSRandall Stewart 		return (NULL);
1602f8829a4aSRandall Stewart 	}
1603f8829a4aSRandall Stewart 	/* load all addresses */
1604f8829a4aSRandall Stewart 	if (sctp_load_addresses_from_init(stcb, m, iphlen,
1605f8829a4aSRandall Stewart 	    init_offset + sizeof(struct sctp_init_chunk), initack_offset, sh,
1606f8829a4aSRandall Stewart 	    init_src)) {
1607a5d547adSRandall Stewart 		sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_17);
1608f8829a4aSRandall Stewart 		return (NULL);
1609f8829a4aSRandall Stewart 	}
1610f8829a4aSRandall Stewart 	/*
1611f8829a4aSRandall Stewart 	 * verify any preceding AUTH chunk that was skipped
1612f8829a4aSRandall Stewart 	 */
1613f8829a4aSRandall Stewart 	/* pull the local authentication parameters from the cookie/init-ack */
1614f8829a4aSRandall Stewart 	sctp_auth_get_cookie_params(stcb, m,
1615f8829a4aSRandall Stewart 	    initack_offset + sizeof(struct sctp_init_ack_chunk),
1616f8829a4aSRandall Stewart 	    initack_limit - (initack_offset + sizeof(struct sctp_init_ack_chunk)));
1617f8829a4aSRandall Stewart 	if (auth_skipped) {
1618f8829a4aSRandall Stewart 		struct sctp_auth_chunk *auth;
1619f8829a4aSRandall Stewart 
1620f8829a4aSRandall Stewart 		auth = (struct sctp_auth_chunk *)
1621f42a358aSRandall Stewart 		    sctp_m_getptr(m, auth_offset, auth_len, auth_chunk_buf);
1622ad81507eSRandall Stewart 		if ((auth == NULL) || sctp_handle_auth(stcb, auth, m, auth_offset)) {
1623f8829a4aSRandall Stewart 			/* auth HMAC failed, dump the assoc and packet */
1624ad81507eSRandall Stewart 			SCTPDBG(SCTP_DEBUG_AUTH1,
1625ad81507eSRandall Stewart 			    "COOKIE-ECHO: AUTH failed\n");
1626a5d547adSRandall Stewart 			sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_18);
1627f8829a4aSRandall Stewart 			return (NULL);
1628f8829a4aSRandall Stewart 		} else {
1629f8829a4aSRandall Stewart 			/* remaining chunks checked... good to go */
1630f8829a4aSRandall Stewart 			stcb->asoc.authenticated = 1;
1631f8829a4aSRandall Stewart 		}
1632f8829a4aSRandall Stewart 	}
1633f8829a4aSRandall Stewart 	/* update current state */
1634ad81507eSRandall Stewart 	SCTPDBG(SCTP_DEBUG_INPUT2, "moving to OPEN state\n");
1635f8829a4aSRandall Stewart 	if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
1636f8829a4aSRandall Stewart 		asoc->state = SCTP_STATE_OPEN | SCTP_STATE_SHUTDOWN_PENDING;
1637f8829a4aSRandall Stewart 		sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
1638f8829a4aSRandall Stewart 		    stcb->sctp_ep, stcb, asoc->primary_destination);
1639f8829a4aSRandall Stewart 	} else {
1640f8829a4aSRandall Stewart 		asoc->state = SCTP_STATE_OPEN;
1641f8829a4aSRandall Stewart 	}
1642a5d547adSRandall Stewart 	sctp_stop_all_cookie_timers(stcb);
1643f8829a4aSRandall Stewart 	SCTP_STAT_INCR_COUNTER32(sctps_passiveestab);
1644f8829a4aSRandall Stewart 	SCTP_STAT_INCR_GAUGE32(sctps_currestab);
1645f8829a4aSRandall Stewart 
1646f8829a4aSRandall Stewart 	/*
1647f8829a4aSRandall Stewart 	 * if we're doing ASCONFs, check to see if we have any new local
1648f8829a4aSRandall Stewart 	 * addresses that need to get added to the peer (eg. addresses
1649f8829a4aSRandall Stewart 	 * changed while cookie echo in flight).  This needs to be done
1650f8829a4aSRandall Stewart 	 * after we go to the OPEN state to do the correct asconf
1651f8829a4aSRandall Stewart 	 * processing. else, make sure we have the correct addresses in our
1652f8829a4aSRandall Stewart 	 * lists
1653f8829a4aSRandall Stewart 	 */
1654f8829a4aSRandall Stewart 
1655f8829a4aSRandall Stewart 	/* warning, we re-use sin, sin6, sa_store here! */
1656f8829a4aSRandall Stewart 	/* pull in local_address (our "from" address) */
1657f8829a4aSRandall Stewart 	if (cookie->laddr_type == SCTP_IPV4_ADDRESS) {
1658f8829a4aSRandall Stewart 		/* source addr is IPv4 */
1659f8829a4aSRandall Stewart 		sin = (struct sockaddr_in *)initack_src;
1660f8829a4aSRandall Stewart 		memset(sin, 0, sizeof(*sin));
1661f8829a4aSRandall Stewart 		sin->sin_family = AF_INET;
1662f8829a4aSRandall Stewart 		sin->sin_len = sizeof(struct sockaddr_in);
1663f8829a4aSRandall Stewart 		sin->sin_addr.s_addr = cookie->laddress[0];
1664f8829a4aSRandall Stewart 	} else if (cookie->laddr_type == SCTP_IPV6_ADDRESS) {
1665f8829a4aSRandall Stewart 		/* source addr is IPv6 */
1666f8829a4aSRandall Stewart 		sin6 = (struct sockaddr_in6 *)initack_src;
1667f8829a4aSRandall Stewart 		memset(sin6, 0, sizeof(*sin6));
1668f8829a4aSRandall Stewart 		sin6->sin6_family = AF_INET6;
1669f8829a4aSRandall Stewart 		sin6->sin6_len = sizeof(struct sockaddr_in6);
1670f8829a4aSRandall Stewart 		sin6->sin6_scope_id = cookie->scope_id;
1671f8829a4aSRandall Stewart 		memcpy(&sin6->sin6_addr, cookie->laddress,
1672f8829a4aSRandall Stewart 		    sizeof(sin6->sin6_addr));
1673f8829a4aSRandall Stewart 	} else {
1674a5d547adSRandall Stewart 		sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_19);
1675f8829a4aSRandall Stewart 		return (NULL);
1676f8829a4aSRandall Stewart 	}
1677f8829a4aSRandall Stewart 
1678f8829a4aSRandall Stewart 	sctp_check_address_list(stcb, m,
1679f8829a4aSRandall Stewart 	    initack_offset + sizeof(struct sctp_init_ack_chunk),
1680f8829a4aSRandall Stewart 	    initack_limit - (initack_offset + sizeof(struct sctp_init_ack_chunk)),
1681f8829a4aSRandall Stewart 	    initack_src, cookie->local_scope, cookie->site_scope,
1682f8829a4aSRandall Stewart 	    cookie->ipv4_scope, cookie->loopback_scope);
1683f8829a4aSRandall Stewart 
1684f8829a4aSRandall Stewart 
1685f8829a4aSRandall Stewart 	/* set up to notify upper layer */
1686f8829a4aSRandall Stewart 	*notification = SCTP_NOTIFY_ASSOC_UP;
1687f8829a4aSRandall Stewart 	if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
1688f8829a4aSRandall Stewart 	    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
1689f8829a4aSRandall Stewart 	    (inp->sctp_socket->so_qlimit == 0)) {
1690f8829a4aSRandall Stewart 		/*
1691f8829a4aSRandall Stewart 		 * This is an endpoint that called connect() how it got a
1692f8829a4aSRandall Stewart 		 * cookie that is NEW is a bit of a mystery. It must be that
1693f8829a4aSRandall Stewart 		 * the INIT was sent, but before it got there.. a complete
1694f8829a4aSRandall Stewart 		 * INIT/INIT-ACK/COOKIE arrived. But of course then it
1695f8829a4aSRandall Stewart 		 * should have went to the other code.. not here.. oh well..
1696f8829a4aSRandall Stewart 		 * a bit of protection is worth having..
1697f8829a4aSRandall Stewart 		 */
1698f8829a4aSRandall Stewart 		stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_CONNECTED;
1699f8829a4aSRandall Stewart 		soisconnected(stcb->sctp_ep->sctp_socket);
1700f8829a4aSRandall Stewart 	} else if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
1701f8829a4aSRandall Stewart 	    (inp->sctp_socket->so_qlimit)) {
1702f8829a4aSRandall Stewart 		/*
1703f8829a4aSRandall Stewart 		 * We don't want to do anything with this one. Since it is
1704f8829a4aSRandall Stewart 		 * the listening guy. The timer will get started for
1705f8829a4aSRandall Stewart 		 * accepted connections in the caller.
1706f8829a4aSRandall Stewart 		 */
1707f8829a4aSRandall Stewart 		;
1708f8829a4aSRandall Stewart 	}
1709f8829a4aSRandall Stewart 	/* since we did not send a HB make sure we don't double things */
1710ad81507eSRandall Stewart 	if ((netp) && (*netp))
1711f8829a4aSRandall Stewart 		(*netp)->hb_responded = 1;
1712f8829a4aSRandall Stewart 
1713f8829a4aSRandall Stewart 	if (stcb->asoc.sctp_autoclose_ticks &&
1714f8829a4aSRandall Stewart 	    sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE)) {
1715f8829a4aSRandall Stewart 		sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb, NULL);
1716f8829a4aSRandall Stewart 	}
1717f8829a4aSRandall Stewart 	/* respond with a COOKIE-ACK */
1718a5d547adSRandall Stewart 	/* calculate the RTT */
1719ad81507eSRandall Stewart 	if ((netp) && (*netp))
1720a5d547adSRandall Stewart 		(*netp)->RTO = sctp_calculate_rto(stcb, asoc, *netp,
1721a5d547adSRandall Stewart 		    &cookie->time_entered);
1722f8829a4aSRandall Stewart 	sctp_send_cookie_ack(stcb);
1723f8829a4aSRandall Stewart 	return (stcb);
1724f8829a4aSRandall Stewart }
1725f8829a4aSRandall Stewart 
1726f8829a4aSRandall Stewart 
1727f8829a4aSRandall Stewart /*
1728f8829a4aSRandall Stewart  * handles a COOKIE-ECHO message stcb: modified to either a new or left as
1729f8829a4aSRandall Stewart  * existing (non-NULL) TCB
1730f8829a4aSRandall Stewart  */
1731f8829a4aSRandall Stewart static struct mbuf *
1732f8829a4aSRandall Stewart sctp_handle_cookie_echo(struct mbuf *m, int iphlen, int offset,
1733f8829a4aSRandall Stewart     struct sctphdr *sh, struct sctp_cookie_echo_chunk *cp,
1734f8829a4aSRandall Stewart     struct sctp_inpcb **inp_p, struct sctp_tcb **stcb, struct sctp_nets **netp,
173517205eccSRandall Stewart     int auth_skipped, uint32_t auth_offset, uint32_t auth_len,
173617205eccSRandall Stewart     struct sctp_tcb **locked_tcb, uint32_t vrf_id, uint32_t table_id)
1737f8829a4aSRandall Stewart {
1738f8829a4aSRandall Stewart 	struct sctp_state_cookie *cookie;
1739f8829a4aSRandall Stewart 	struct sockaddr_in6 sin6;
1740f8829a4aSRandall Stewart 	struct sockaddr_in sin;
1741f8829a4aSRandall Stewart 	struct sctp_tcb *l_stcb = *stcb;
1742f8829a4aSRandall Stewart 	struct sctp_inpcb *l_inp;
1743f8829a4aSRandall Stewart 	struct sockaddr *to;
1744f8829a4aSRandall Stewart 	sctp_assoc_t sac_restart_id;
1745f8829a4aSRandall Stewart 	struct sctp_pcb *ep;
1746f8829a4aSRandall Stewart 	struct mbuf *m_sig;
1747f8829a4aSRandall Stewart 	uint8_t calc_sig[SCTP_SIGNATURE_SIZE], tmp_sig[SCTP_SIGNATURE_SIZE];
1748f8829a4aSRandall Stewart 	uint8_t *sig;
1749f8829a4aSRandall Stewart 	uint8_t cookie_ok = 0;
1750f8829a4aSRandall Stewart 	unsigned int size_of_pkt, sig_offset, cookie_offset;
1751f8829a4aSRandall Stewart 	unsigned int cookie_len;
1752f8829a4aSRandall Stewart 	struct timeval now;
1753f8829a4aSRandall Stewart 	struct timeval time_expires;
1754f8829a4aSRandall Stewart 	struct sockaddr_storage dest_store;
1755f8829a4aSRandall Stewart 	struct sockaddr *localep_sa = (struct sockaddr *)&dest_store;
1756f8829a4aSRandall Stewart 	struct ip *iph;
1757f8829a4aSRandall Stewart 	int notification = 0;
1758f8829a4aSRandall Stewart 	struct sctp_nets *netl;
1759f8829a4aSRandall Stewart 	int had_a_existing_tcb = 0;
1760f8829a4aSRandall Stewart 
1761ad81507eSRandall Stewart 	SCTPDBG(SCTP_DEBUG_INPUT2,
1762ad81507eSRandall Stewart 	    "sctp_handle_cookie: handling COOKIE-ECHO\n");
1763f8829a4aSRandall Stewart 
1764f8829a4aSRandall Stewart 	if (inp_p == NULL) {
1765f8829a4aSRandall Stewart 		return (NULL);
1766f8829a4aSRandall Stewart 	}
1767f8829a4aSRandall Stewart 	/* First get the destination address setup too. */
1768f8829a4aSRandall Stewart 	iph = mtod(m, struct ip *);
1769f8829a4aSRandall Stewart 	if (iph->ip_v == IPVERSION) {
1770f8829a4aSRandall Stewart 		/* its IPv4 */
1771f8829a4aSRandall Stewart 		struct sockaddr_in *sin;
1772f8829a4aSRandall Stewart 
1773f8829a4aSRandall Stewart 		sin = (struct sockaddr_in *)(localep_sa);
1774f8829a4aSRandall Stewart 		memset(sin, 0, sizeof(*sin));
1775f8829a4aSRandall Stewart 		sin->sin_family = AF_INET;
1776f8829a4aSRandall Stewart 		sin->sin_len = sizeof(*sin);
1777f8829a4aSRandall Stewart 		sin->sin_port = sh->dest_port;
1778f8829a4aSRandall Stewart 		sin->sin_addr.s_addr = iph->ip_dst.s_addr;
1779139bc87fSRandall Stewart 		size_of_pkt = SCTP_GET_IPV4_LENGTH(iph);
1780f8829a4aSRandall Stewart 	} else if (iph->ip_v == (IPV6_VERSION >> 4)) {
1781f8829a4aSRandall Stewart 		/* its IPv6 */
1782f8829a4aSRandall Stewart 		struct ip6_hdr *ip6;
1783f8829a4aSRandall Stewart 		struct sockaddr_in6 *sin6;
1784f8829a4aSRandall Stewart 
1785f8829a4aSRandall Stewart 		sin6 = (struct sockaddr_in6 *)(localep_sa);
1786f8829a4aSRandall Stewart 		memset(sin6, 0, sizeof(*sin6));
1787f8829a4aSRandall Stewart 		sin6->sin6_family = AF_INET6;
1788f8829a4aSRandall Stewart 		sin6->sin6_len = sizeof(struct sockaddr_in6);
1789f8829a4aSRandall Stewart 		ip6 = mtod(m, struct ip6_hdr *);
1790f8829a4aSRandall Stewart 		sin6->sin6_port = sh->dest_port;
1791f8829a4aSRandall Stewart 		sin6->sin6_addr = ip6->ip6_dst;
1792f42a358aSRandall Stewart 		size_of_pkt = SCTP_GET_IPV6_LENGTH(ip6) + iphlen;
1793f8829a4aSRandall Stewart 	} else {
1794f8829a4aSRandall Stewart 		return (NULL);
1795f8829a4aSRandall Stewart 	}
1796f8829a4aSRandall Stewart 
1797f8829a4aSRandall Stewart 	cookie = &cp->cookie;
1798f8829a4aSRandall Stewart 	cookie_offset = offset + sizeof(struct sctp_chunkhdr);
1799f8829a4aSRandall Stewart 	cookie_len = ntohs(cp->ch.chunk_length);
1800f8829a4aSRandall Stewart 
1801f8829a4aSRandall Stewart 	if ((cookie->peerport != sh->src_port) &&
1802f8829a4aSRandall Stewart 	    (cookie->myport != sh->dest_port) &&
1803f8829a4aSRandall Stewart 	    (cookie->my_vtag != sh->v_tag)) {
1804f8829a4aSRandall Stewart 		/*
1805f8829a4aSRandall Stewart 		 * invalid ports or bad tag.  Note that we always leave the
1806f8829a4aSRandall Stewart 		 * v_tag in the header in network order and when we stored
1807f8829a4aSRandall Stewart 		 * it in the my_vtag slot we also left it in network order.
180817205eccSRandall Stewart 		 * This maintains the match even though it may be in the
1809f8829a4aSRandall Stewart 		 * opposite byte order of the machine :->
1810f8829a4aSRandall Stewart 		 */
1811f8829a4aSRandall Stewart 		return (NULL);
1812f8829a4aSRandall Stewart 	}
1813f8829a4aSRandall Stewart 	if (cookie_len > size_of_pkt ||
1814f8829a4aSRandall Stewart 	    cookie_len < sizeof(struct sctp_cookie_echo_chunk) +
1815f8829a4aSRandall Stewart 	    sizeof(struct sctp_init_chunk) +
1816f8829a4aSRandall Stewart 	    sizeof(struct sctp_init_ack_chunk) + SCTP_SIGNATURE_SIZE) {
1817f8829a4aSRandall Stewart 		/* cookie too long!  or too small */
1818f8829a4aSRandall Stewart 		return (NULL);
1819f8829a4aSRandall Stewart 	}
1820f8829a4aSRandall Stewart 	/*
1821f8829a4aSRandall Stewart 	 * split off the signature into its own mbuf (since it should not be
1822f8829a4aSRandall Stewart 	 * calculated in the sctp_hmac_m() call).
1823f8829a4aSRandall Stewart 	 */
1824f8829a4aSRandall Stewart 	sig_offset = offset + cookie_len - SCTP_SIGNATURE_SIZE;
1825f8829a4aSRandall Stewart 	if (sig_offset > size_of_pkt) {
1826f8829a4aSRandall Stewart 		/* packet not correct size! */
1827f8829a4aSRandall Stewart 		/* XXX this may already be accounted for earlier... */
1828f8829a4aSRandall Stewart 		return (NULL);
1829f8829a4aSRandall Stewart 	}
1830f8829a4aSRandall Stewart 	m_sig = m_split(m, sig_offset, M_DONTWAIT);
1831f8829a4aSRandall Stewart 	if (m_sig == NULL) {
1832f8829a4aSRandall Stewart 		/* out of memory or ?? */
1833f8829a4aSRandall Stewart 		return (NULL);
1834f8829a4aSRandall Stewart 	}
1835f8829a4aSRandall Stewart 	/*
1836f8829a4aSRandall Stewart 	 * compute the signature/digest for the cookie
1837f8829a4aSRandall Stewart 	 */
1838f8829a4aSRandall Stewart 	ep = &(*inp_p)->sctp_ep;
1839f8829a4aSRandall Stewart 	l_inp = *inp_p;
1840f8829a4aSRandall Stewart 	if (l_stcb) {
1841f8829a4aSRandall Stewart 		SCTP_TCB_UNLOCK(l_stcb);
1842f8829a4aSRandall Stewart 	}
1843f8829a4aSRandall Stewart 	SCTP_INP_RLOCK(l_inp);
1844f8829a4aSRandall Stewart 	if (l_stcb) {
1845f8829a4aSRandall Stewart 		SCTP_TCB_LOCK(l_stcb);
1846f8829a4aSRandall Stewart 	}
1847f8829a4aSRandall Stewart 	/* which cookie is it? */
1848f8829a4aSRandall Stewart 	if ((cookie->time_entered.tv_sec < (long)ep->time_of_secret_change) &&
1849f8829a4aSRandall Stewart 	    (ep->current_secret_number != ep->last_secret_number)) {
1850f8829a4aSRandall Stewart 		/* it's the old cookie */
18516e55db54SRandall Stewart 		(void)sctp_hmac_m(SCTP_HMAC,
1852f8829a4aSRandall Stewart 		    (uint8_t *) ep->secret_key[(int)ep->last_secret_number],
1853f8829a4aSRandall Stewart 		    SCTP_SECRET_SIZE, m, cookie_offset, calc_sig);
1854f8829a4aSRandall Stewart 	} else {
1855f8829a4aSRandall Stewart 		/* it's the current cookie */
18566e55db54SRandall Stewart 		(void)sctp_hmac_m(SCTP_HMAC,
1857f8829a4aSRandall Stewart 		    (uint8_t *) ep->secret_key[(int)ep->current_secret_number],
1858f8829a4aSRandall Stewart 		    SCTP_SECRET_SIZE, m, cookie_offset, calc_sig);
1859f8829a4aSRandall Stewart 	}
1860f8829a4aSRandall Stewart 	/* get the signature */
1861f8829a4aSRandall Stewart 	SCTP_INP_RUNLOCK(l_inp);
1862f8829a4aSRandall Stewart 	sig = (uint8_t *) sctp_m_getptr(m_sig, 0, SCTP_SIGNATURE_SIZE, (uint8_t *) & tmp_sig);
1863f8829a4aSRandall Stewart 	if (sig == NULL) {
1864f8829a4aSRandall Stewart 		/* couldn't find signature */
186503b0b021SRandall Stewart 		sctp_m_freem(m_sig);
1866f8829a4aSRandall Stewart 		return (NULL);
1867f8829a4aSRandall Stewart 	}
1868f8829a4aSRandall Stewart 	/* compare the received digest with the computed digest */
1869f8829a4aSRandall Stewart 	if (memcmp(calc_sig, sig, SCTP_SIGNATURE_SIZE) != 0) {
1870f8829a4aSRandall Stewart 		/* try the old cookie? */
1871f8829a4aSRandall Stewart 		if ((cookie->time_entered.tv_sec == (long)ep->time_of_secret_change) &&
1872f8829a4aSRandall Stewart 		    (ep->current_secret_number != ep->last_secret_number)) {
1873f8829a4aSRandall Stewart 			/* compute digest with old */
18746e55db54SRandall Stewart 			(void)sctp_hmac_m(SCTP_HMAC,
1875f8829a4aSRandall Stewart 			    (uint8_t *) ep->secret_key[(int)ep->last_secret_number],
1876f8829a4aSRandall Stewart 			    SCTP_SECRET_SIZE, m, cookie_offset, calc_sig);
1877f8829a4aSRandall Stewart 			/* compare */
1878f8829a4aSRandall Stewart 			if (memcmp(calc_sig, sig, SCTP_SIGNATURE_SIZE) == 0)
1879f8829a4aSRandall Stewart 				cookie_ok = 1;
1880f8829a4aSRandall Stewart 		}
1881f8829a4aSRandall Stewart 	} else {
1882f8829a4aSRandall Stewart 		cookie_ok = 1;
1883f8829a4aSRandall Stewart 	}
1884f8829a4aSRandall Stewart 
1885f8829a4aSRandall Stewart 	/*
1886f8829a4aSRandall Stewart 	 * Now before we continue we must reconstruct our mbuf so that
1887f8829a4aSRandall Stewart 	 * normal processing of any other chunks will work.
1888f8829a4aSRandall Stewart 	 */
1889f8829a4aSRandall Stewart 	{
1890f8829a4aSRandall Stewart 		struct mbuf *m_at;
1891f8829a4aSRandall Stewart 
1892f8829a4aSRandall Stewart 		m_at = m;
1893139bc87fSRandall Stewart 		while (SCTP_BUF_NEXT(m_at) != NULL) {
1894139bc87fSRandall Stewart 			m_at = SCTP_BUF_NEXT(m_at);
1895f8829a4aSRandall Stewart 		}
1896139bc87fSRandall Stewart 		SCTP_BUF_NEXT(m_at) = m_sig;
1897f8829a4aSRandall Stewart 	}
1898f8829a4aSRandall Stewart 
1899f8829a4aSRandall Stewart 	if (cookie_ok == 0) {
1900ad81507eSRandall Stewart 		SCTPDBG(SCTP_DEBUG_INPUT2, "handle_cookie_echo: cookie signature validation failed!\n");
1901ad81507eSRandall Stewart 		SCTPDBG(SCTP_DEBUG_INPUT2,
1902ad81507eSRandall Stewart 		    "offset = %u, cookie_offset = %u, sig_offset = %u\n",
1903f8829a4aSRandall Stewart 		    (uint32_t) offset, cookie_offset, sig_offset);
1904f8829a4aSRandall Stewart 		return (NULL);
1905f8829a4aSRandall Stewart 	}
1906f8829a4aSRandall Stewart 	/*
1907f8829a4aSRandall Stewart 	 * check the cookie timestamps to be sure it's not stale
1908f8829a4aSRandall Stewart 	 */
19096e55db54SRandall Stewart 	(void)SCTP_GETTIME_TIMEVAL(&now);
1910f8829a4aSRandall Stewart 	/* Expire time is in Ticks, so we convert to seconds */
19113c503c28SRandall Stewart 	time_expires.tv_sec = cookie->time_entered.tv_sec + TICKS_TO_SEC(cookie->cookie_life);
1912f8829a4aSRandall Stewart 	time_expires.tv_usec = cookie->time_entered.tv_usec;
1913f8829a4aSRandall Stewart 	if (timevalcmp(&now, &time_expires, >)) {
1914f8829a4aSRandall Stewart 		/* cookie is stale! */
1915f8829a4aSRandall Stewart 		struct mbuf *op_err;
1916f8829a4aSRandall Stewart 		struct sctp_stale_cookie_msg *scm;
1917f8829a4aSRandall Stewart 		uint32_t tim;
1918f8829a4aSRandall Stewart 
1919f8829a4aSRandall Stewart 		op_err = sctp_get_mbuf_for_msg(sizeof(struct sctp_stale_cookie_msg),
1920139bc87fSRandall Stewart 		    0, M_DONTWAIT, 1, MT_DATA);
1921f8829a4aSRandall Stewart 		if (op_err == NULL) {
1922f8829a4aSRandall Stewart 			/* FOOBAR */
1923f8829a4aSRandall Stewart 			return (NULL);
1924f8829a4aSRandall Stewart 		}
1925f8829a4aSRandall Stewart 		/* pre-reserve some space */
1926139bc87fSRandall Stewart 		SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr));
1927139bc87fSRandall Stewart 		SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr));
1928139bc87fSRandall Stewart 		SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr));
1929f8829a4aSRandall Stewart 
1930f8829a4aSRandall Stewart 		/* Set the len */
1931139bc87fSRandall Stewart 		SCTP_BUF_LEN(op_err) = sizeof(struct sctp_stale_cookie_msg);
1932f8829a4aSRandall Stewart 		scm = mtod(op_err, struct sctp_stale_cookie_msg *);
1933f8829a4aSRandall Stewart 		scm->ph.param_type = htons(SCTP_CAUSE_STALE_COOKIE);
1934f8829a4aSRandall Stewart 		scm->ph.param_length = htons((sizeof(struct sctp_paramhdr) +
1935f8829a4aSRandall Stewart 		    (sizeof(uint32_t))));
1936f8829a4aSRandall Stewart 		/* seconds to usec */
1937f8829a4aSRandall Stewart 		tim = (now.tv_sec - time_expires.tv_sec) * 1000000;
1938f8829a4aSRandall Stewart 		/* add in usec */
1939f8829a4aSRandall Stewart 		if (tim == 0)
1940f8829a4aSRandall Stewart 			tim = now.tv_usec - cookie->time_entered.tv_usec;
1941f8829a4aSRandall Stewart 		scm->time_usec = htonl(tim);
194217205eccSRandall Stewart 		sctp_send_operr_to(m, iphlen, op_err, cookie->peers_vtag,
194317205eccSRandall Stewart 		    vrf_id, table_id);
1944f8829a4aSRandall Stewart 		return (NULL);
1945f8829a4aSRandall Stewart 	}
1946f8829a4aSRandall Stewart 	/*
1947f8829a4aSRandall Stewart 	 * Now we must see with the lookup address if we have an existing
1948f8829a4aSRandall Stewart 	 * asoc. This will only happen if we were in the COOKIE-WAIT state
1949f8829a4aSRandall Stewart 	 * and a INIT collided with us and somewhere the peer sent the
1950f8829a4aSRandall Stewart 	 * cookie on another address besides the single address our assoc
1951f8829a4aSRandall Stewart 	 * had for him. In this case we will have one of the tie-tags set at
1952f8829a4aSRandall Stewart 	 * least AND the address field in the cookie can be used to look it
1953f8829a4aSRandall Stewart 	 * up.
1954f8829a4aSRandall Stewart 	 */
1955f8829a4aSRandall Stewart 	to = NULL;
1956f8829a4aSRandall Stewart 	if (cookie->addr_type == SCTP_IPV6_ADDRESS) {
1957f8829a4aSRandall Stewart 		memset(&sin6, 0, sizeof(sin6));
1958f8829a4aSRandall Stewart 		sin6.sin6_family = AF_INET6;
1959f8829a4aSRandall Stewart 		sin6.sin6_len = sizeof(sin6);
1960f8829a4aSRandall Stewart 		sin6.sin6_port = sh->src_port;
1961f8829a4aSRandall Stewart 		sin6.sin6_scope_id = cookie->scope_id;
1962f8829a4aSRandall Stewart 		memcpy(&sin6.sin6_addr.s6_addr, cookie->address,
1963f8829a4aSRandall Stewart 		    sizeof(sin6.sin6_addr.s6_addr));
1964f8829a4aSRandall Stewart 		to = (struct sockaddr *)&sin6;
1965f8829a4aSRandall Stewart 	} else if (cookie->addr_type == SCTP_IPV4_ADDRESS) {
1966f8829a4aSRandall Stewart 		memset(&sin, 0, sizeof(sin));
1967f8829a4aSRandall Stewart 		sin.sin_family = AF_INET;
1968f8829a4aSRandall Stewart 		sin.sin_len = sizeof(sin);
1969f8829a4aSRandall Stewart 		sin.sin_port = sh->src_port;
1970f8829a4aSRandall Stewart 		sin.sin_addr.s_addr = cookie->address[0];
1971f8829a4aSRandall Stewart 		to = (struct sockaddr *)&sin;
1972ad81507eSRandall Stewart 	} else {
1973ad81507eSRandall Stewart 		/* This should not happen */
1974ad81507eSRandall Stewart 		return (NULL);
1975f8829a4aSRandall Stewart 	}
1976f8829a4aSRandall Stewart 	if ((*stcb == NULL) && to) {
1977f8829a4aSRandall Stewart 		/* Yep, lets check */
1978f8829a4aSRandall Stewart 		*stcb = sctp_findassociation_ep_addr(inp_p, to, netp, localep_sa, NULL);
1979f8829a4aSRandall Stewart 		if (*stcb == NULL) {
1980f8829a4aSRandall Stewart 			/*
1981f8829a4aSRandall Stewart 			 * We should have only got back the same inp. If we
1982f8829a4aSRandall Stewart 			 * got back a different ep we have a problem. The
1983f8829a4aSRandall Stewart 			 * original findep got back l_inp and now
1984f8829a4aSRandall Stewart 			 */
1985f8829a4aSRandall Stewart 			if (l_inp != *inp_p) {
1986ad81507eSRandall Stewart 				SCTP_PRINTF("Bad problem find_ep got a diff inp then special_locate?\n");
1987f8829a4aSRandall Stewart 			}
1988a5d547adSRandall Stewart 		} else {
1989a5d547adSRandall Stewart 			if (*locked_tcb == NULL) {
1990a5d547adSRandall Stewart 				/*
1991a5d547adSRandall Stewart 				 * In this case we found the assoc only
1992a5d547adSRandall Stewart 				 * after we locked the create lock. This
1993a5d547adSRandall Stewart 				 * means we are in a colliding case and we
1994a5d547adSRandall Stewart 				 * must make sure that we unlock the tcb if
1995a5d547adSRandall Stewart 				 * its one of the cases where we throw away
1996a5d547adSRandall Stewart 				 * the incoming packets.
1997a5d547adSRandall Stewart 				 */
1998a5d547adSRandall Stewart 				*locked_tcb = *stcb;
1999a5d547adSRandall Stewart 
2000a5d547adSRandall Stewart 				/*
2001a5d547adSRandall Stewart 				 * We must also increment the inp ref count
2002a5d547adSRandall Stewart 				 * since the ref_count flags was set when we
2003a5d547adSRandall Stewart 				 * did not find the TCB, now we found it
2004a5d547adSRandall Stewart 				 * which reduces the refcount.. we must
2005a5d547adSRandall Stewart 				 * raise it back out to balance it all :-)
2006a5d547adSRandall Stewart 				 */
2007a5d547adSRandall Stewart 				SCTP_INP_INCR_REF((*stcb)->sctp_ep);
2008a5d547adSRandall Stewart 				if ((*stcb)->sctp_ep != l_inp) {
2009ad81507eSRandall Stewart 					SCTP_PRINTF("Huh? ep:%p diff then l_inp:%p?\n",
2010a5d547adSRandall Stewart 					    (*stcb)->sctp_ep, l_inp);
2011a5d547adSRandall Stewart 				}
2012a5d547adSRandall Stewart 			}
2013f8829a4aSRandall Stewart 		}
2014f8829a4aSRandall Stewart 	}
2015ad81507eSRandall Stewart 	if (to == NULL)
2016ad81507eSRandall Stewart 		return (NULL);
2017ad81507eSRandall Stewart 
2018f8829a4aSRandall Stewart 	cookie_len -= SCTP_SIGNATURE_SIZE;
2019f8829a4aSRandall Stewart 	if (*stcb == NULL) {
2020f8829a4aSRandall Stewart 		/* this is the "normal" case... get a new TCB */
2021f8829a4aSRandall Stewart 		*stcb = sctp_process_cookie_new(m, iphlen, offset, sh, cookie,
2022f8829a4aSRandall Stewart 		    cookie_len, *inp_p, netp, to, &notification,
202317205eccSRandall Stewart 		    auth_skipped, auth_offset, auth_len, vrf_id, table_id);
2024f8829a4aSRandall Stewart 	} else {
2025f8829a4aSRandall Stewart 		/* this is abnormal... cookie-echo on existing TCB */
2026f8829a4aSRandall Stewart 		had_a_existing_tcb = 1;
2027f8829a4aSRandall Stewart 		*stcb = sctp_process_cookie_existing(m, iphlen, offset, sh,
2028f8829a4aSRandall Stewart 		    cookie, cookie_len, *inp_p, *stcb, *netp, to, &notification,
202917205eccSRandall Stewart 		    &sac_restart_id, vrf_id, table_id);
2030f8829a4aSRandall Stewart 	}
2031f8829a4aSRandall Stewart 
2032f8829a4aSRandall Stewart 	if (*stcb == NULL) {
2033f8829a4aSRandall Stewart 		/* still no TCB... must be bad cookie-echo */
2034f8829a4aSRandall Stewart 		return (NULL);
2035f8829a4aSRandall Stewart 	}
2036f8829a4aSRandall Stewart 	/*
2037f8829a4aSRandall Stewart 	 * Ok, we built an association so confirm the address we sent the
2038f8829a4aSRandall Stewart 	 * INIT-ACK to.
2039f8829a4aSRandall Stewart 	 */
2040f8829a4aSRandall Stewart 	netl = sctp_findnet(*stcb, to);
2041f8829a4aSRandall Stewart 	/*
2042f8829a4aSRandall Stewart 	 * This code should in theory NOT run but
2043f8829a4aSRandall Stewart 	 */
2044f8829a4aSRandall Stewart 	if (netl == NULL) {
2045f8829a4aSRandall Stewart 		/* TSNH! Huh, why do I need to add this address here? */
2046f8829a4aSRandall Stewart 		int ret;
2047f8829a4aSRandall Stewart 
2048a5d547adSRandall Stewart 		ret = sctp_add_remote_addr(*stcb, to, SCTP_DONOT_SETSCOPE,
2049a5d547adSRandall Stewart 		    SCTP_IN_COOKIE_PROC);
2050f8829a4aSRandall Stewart 		netl = sctp_findnet(*stcb, to);
2051f8829a4aSRandall Stewart 	}
2052f8829a4aSRandall Stewart 	if (netl) {
2053f8829a4aSRandall Stewart 		if (netl->dest_state & SCTP_ADDR_UNCONFIRMED) {
2054f8829a4aSRandall Stewart 			netl->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
2055ad81507eSRandall Stewart 			(void)sctp_set_primary_addr((*stcb), (struct sockaddr *)NULL,
2056f8829a4aSRandall Stewart 			    netl);
2057f8829a4aSRandall Stewart 			sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
2058f8829a4aSRandall Stewart 			    (*stcb), 0, (void *)netl);
2059f8829a4aSRandall Stewart 		}
2060f8829a4aSRandall Stewart 	}
2061f8829a4aSRandall Stewart 	if (*stcb) {
2062f8829a4aSRandall Stewart 		sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, *inp_p,
2063f8829a4aSRandall Stewart 		    *stcb, NULL);
2064f8829a4aSRandall Stewart 	}
2065f8829a4aSRandall Stewart 	if ((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) {
2066f8829a4aSRandall Stewart 		if (!had_a_existing_tcb ||
2067f8829a4aSRandall Stewart 		    (((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0)) {
2068f8829a4aSRandall Stewart 			/*
2069f8829a4aSRandall Stewart 			 * If we have a NEW cookie or the connect never
2070f8829a4aSRandall Stewart 			 * reached the connected state during collision we
2071f8829a4aSRandall Stewart 			 * must do the TCP accept thing.
2072f8829a4aSRandall Stewart 			 */
2073f8829a4aSRandall Stewart 			struct socket *so, *oso;
2074f8829a4aSRandall Stewart 			struct sctp_inpcb *inp;
2075f8829a4aSRandall Stewart 
2076f8829a4aSRandall Stewart 			if (notification == SCTP_NOTIFY_ASSOC_RESTART) {
2077f8829a4aSRandall Stewart 				/*
2078f8829a4aSRandall Stewart 				 * For a restart we will keep the same
2079f8829a4aSRandall Stewart 				 * socket, no need to do anything. I THINK!!
2080f8829a4aSRandall Stewart 				 */
2081f8829a4aSRandall Stewart 				sctp_ulp_notify(notification, *stcb, 0, (void *)&sac_restart_id);
2082f8829a4aSRandall Stewart 				return (m);
2083f8829a4aSRandall Stewart 			}
2084f8829a4aSRandall Stewart 			oso = (*inp_p)->sctp_socket;
2085f8829a4aSRandall Stewart 			/*
2086f8829a4aSRandall Stewart 			 * We do this to keep the sockets side happy durin
2087f8829a4aSRandall Stewart 			 * the sonewcon ONLY.
2088f8829a4aSRandall Stewart 			 */
2089f8829a4aSRandall Stewart 			NET_LOCK_GIANT();
2090f8829a4aSRandall Stewart 			SCTP_TCB_UNLOCK((*stcb));
209193164cf9SRandall Stewart 			so = sonewconn(oso, 0
2092f8829a4aSRandall Stewart 			    );
2093f8829a4aSRandall Stewart 			NET_UNLOCK_GIANT();
2094f8829a4aSRandall Stewart 			SCTP_INP_WLOCK((*stcb)->sctp_ep);
2095f8829a4aSRandall Stewart 			SCTP_TCB_LOCK((*stcb));
2096f8829a4aSRandall Stewart 			SCTP_INP_WUNLOCK((*stcb)->sctp_ep);
2097f8829a4aSRandall Stewart 			if (so == NULL) {
2098f8829a4aSRandall Stewart 				struct mbuf *op_err;
2099f8829a4aSRandall Stewart 
2100f8829a4aSRandall Stewart 				/* Too many sockets */
2101ad81507eSRandall Stewart 				SCTPDBG(SCTP_DEBUG_INPUT1, "process_cookie_new: no room for another socket!\n");
2102f8829a4aSRandall Stewart 				op_err = sctp_generate_invmanparam(SCTP_CAUSE_OUT_OF_RESC);
2103f8829a4aSRandall Stewart 				sctp_abort_association(*inp_p, NULL, m, iphlen,
210417205eccSRandall Stewart 				    sh, op_err, vrf_id,
210517205eccSRandall Stewart 				    table_id);
2106a5d547adSRandall Stewart 				sctp_free_assoc(*inp_p, *stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_20);
2107f8829a4aSRandall Stewart 				return (NULL);
2108f8829a4aSRandall Stewart 			}
2109f8829a4aSRandall Stewart 			inp = (struct sctp_inpcb *)so->so_pcb;
211093164cf9SRandall Stewart 			SCTP_INP_INCR_REF(inp);
211193164cf9SRandall Stewart 			/*
211293164cf9SRandall Stewart 			 * We add the unbound flag here so that if we get an
211393164cf9SRandall Stewart 			 * soabort() before we get the move_pcb done, we
211493164cf9SRandall Stewart 			 * will properly cleanup.
211593164cf9SRandall Stewart 			 */
2116f8829a4aSRandall Stewart 			inp->sctp_flags = (SCTP_PCB_FLAGS_TCPTYPE |
2117f8829a4aSRandall Stewart 			    SCTP_PCB_FLAGS_CONNECTED |
2118f8829a4aSRandall Stewart 			    SCTP_PCB_FLAGS_IN_TCPPOOL |
211993164cf9SRandall Stewart 			    SCTP_PCB_FLAGS_UNBOUND |
2120f8829a4aSRandall Stewart 			    (SCTP_PCB_COPY_FLAGS & (*inp_p)->sctp_flags) |
2121f8829a4aSRandall Stewart 			    SCTP_PCB_FLAGS_DONT_WAKE);
2122f8829a4aSRandall Stewart 			inp->sctp_features = (*inp_p)->sctp_features;
2123f8829a4aSRandall Stewart 			inp->sctp_socket = so;
2124f8829a4aSRandall Stewart 			inp->sctp_frag_point = (*inp_p)->sctp_frag_point;
2125f8829a4aSRandall Stewart 			inp->partial_delivery_point = (*inp_p)->partial_delivery_point;
2126f8829a4aSRandall Stewart 			inp->sctp_context = (*inp_p)->sctp_context;
2127f8829a4aSRandall Stewart 			inp->inp_starting_point_for_iterator = NULL;
2128f8829a4aSRandall Stewart 			/*
2129f8829a4aSRandall Stewart 			 * copy in the authentication parameters from the
2130f8829a4aSRandall Stewart 			 * original endpoint
2131f8829a4aSRandall Stewart 			 */
2132f8829a4aSRandall Stewart 			if (inp->sctp_ep.local_hmacs)
2133f8829a4aSRandall Stewart 				sctp_free_hmaclist(inp->sctp_ep.local_hmacs);
2134f8829a4aSRandall Stewart 			inp->sctp_ep.local_hmacs =
2135f8829a4aSRandall Stewart 			    sctp_copy_hmaclist((*inp_p)->sctp_ep.local_hmacs);
2136f8829a4aSRandall Stewart 			if (inp->sctp_ep.local_auth_chunks)
2137f8829a4aSRandall Stewart 				sctp_free_chunklist(inp->sctp_ep.local_auth_chunks);
2138f8829a4aSRandall Stewart 			inp->sctp_ep.local_auth_chunks =
2139f8829a4aSRandall Stewart 			    sctp_copy_chunklist((*inp_p)->sctp_ep.local_auth_chunks);
2140f8829a4aSRandall Stewart 			(void)sctp_copy_skeylist(&(*inp_p)->sctp_ep.shared_keys,
2141f8829a4aSRandall Stewart 			    &inp->sctp_ep.shared_keys);
2142f8829a4aSRandall Stewart 
2143f8829a4aSRandall Stewart 			/*
2144f8829a4aSRandall Stewart 			 * Now we must move it from one hash table to
2145f8829a4aSRandall Stewart 			 * another and get the tcb in the right place.
2146f8829a4aSRandall Stewart 			 */
2147f8829a4aSRandall Stewart 			sctp_move_pcb_and_assoc(*inp_p, inp, *stcb);
2148d61a0ae0SRandall Stewart 
2149d61a0ae0SRandall Stewart 			atomic_add_int(&(*stcb)->asoc.refcnt, 1);
2150d61a0ae0SRandall Stewart 			SCTP_TCB_UNLOCK((*stcb));
2151d61a0ae0SRandall Stewart 
2152d06c82f1SRandall Stewart 			sctp_pull_off_control_to_new_inp((*inp_p), inp, *stcb, M_NOWAIT);
2153d61a0ae0SRandall Stewart 			SCTP_TCB_LOCK((*stcb));
2154d61a0ae0SRandall Stewart 			atomic_subtract_int(&(*stcb)->asoc.refcnt, 1);
2155d61a0ae0SRandall Stewart 
2156f8829a4aSRandall Stewart 
215793164cf9SRandall Stewart 			/*
215893164cf9SRandall Stewart 			 * now we must check to see if we were aborted while
215993164cf9SRandall Stewart 			 * the move was going on and the lock/unlock
216093164cf9SRandall Stewart 			 * happened.
216193164cf9SRandall Stewart 			 */
216293164cf9SRandall Stewart 			if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
216393164cf9SRandall Stewart 				/*
216493164cf9SRandall Stewart 				 * yep it was, we leave the assoc attached
216593164cf9SRandall Stewart 				 * to the socket since the sctp_inpcb_free()
216693164cf9SRandall Stewart 				 * call will send an abort for us.
216793164cf9SRandall Stewart 				 */
216893164cf9SRandall Stewart 				SCTP_INP_DECR_REF(inp);
216993164cf9SRandall Stewart 				return (NULL);
217093164cf9SRandall Stewart 			}
217193164cf9SRandall Stewart 			SCTP_INP_DECR_REF(inp);
2172f8829a4aSRandall Stewart 			/* Switch over to the new guy */
2173f8829a4aSRandall Stewart 			*inp_p = inp;
2174f8829a4aSRandall Stewart 			sctp_ulp_notify(notification, *stcb, 0, NULL);
217593164cf9SRandall Stewart 
217693164cf9SRandall Stewart 			/*
217793164cf9SRandall Stewart 			 * Pull it from the incomplete queue and wake the
217893164cf9SRandall Stewart 			 * guy
217993164cf9SRandall Stewart 			 */
218093164cf9SRandall Stewart 			soisconnected(so);
2181f8829a4aSRandall Stewart 			return (m);
2182f8829a4aSRandall Stewart 		}
2183f8829a4aSRandall Stewart 	}
2184f8829a4aSRandall Stewart 	if ((notification) && ((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE)) {
2185f8829a4aSRandall Stewart 		sctp_ulp_notify(notification, *stcb, 0, NULL);
2186f8829a4aSRandall Stewart 	}
2187f8829a4aSRandall Stewart 	return (m);
2188f8829a4aSRandall Stewart }
2189f8829a4aSRandall Stewart 
2190f8829a4aSRandall Stewart static void
2191f8829a4aSRandall Stewart sctp_handle_cookie_ack(struct sctp_cookie_ack_chunk *cp,
2192f8829a4aSRandall Stewart     struct sctp_tcb *stcb, struct sctp_nets *net)
2193f8829a4aSRandall Stewart {
2194f8829a4aSRandall Stewart 	/* cp must not be used, others call this without a c-ack :-) */
2195f8829a4aSRandall Stewart 	struct sctp_association *asoc;
2196f8829a4aSRandall Stewart 
2197ad81507eSRandall Stewart 	SCTPDBG(SCTP_DEBUG_INPUT2,
2198ad81507eSRandall Stewart 	    "sctp_handle_cookie_ack: handling COOKIE-ACK\n");
2199f8829a4aSRandall Stewart 	if (stcb == NULL)
2200f8829a4aSRandall Stewart 		return;
2201f8829a4aSRandall Stewart 
2202f8829a4aSRandall Stewart 	asoc = &stcb->asoc;
2203f8829a4aSRandall Stewart 
2204f8829a4aSRandall Stewart 	sctp_stop_all_cookie_timers(stcb);
2205f8829a4aSRandall Stewart 	/* process according to association state */
2206f8829a4aSRandall Stewart 	if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) {
2207f8829a4aSRandall Stewart 		/* state change only needed when I am in right state */
2208ad81507eSRandall Stewart 		SCTPDBG(SCTP_DEBUG_INPUT2, "moving to OPEN state\n");
2209f8829a4aSRandall Stewart 		if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
2210f8829a4aSRandall Stewart 			asoc->state = SCTP_STATE_OPEN | SCTP_STATE_SHUTDOWN_PENDING;
2211f8829a4aSRandall Stewart 			sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
2212f8829a4aSRandall Stewart 			    stcb->sctp_ep, stcb, asoc->primary_destination);
2213f8829a4aSRandall Stewart 
2214f8829a4aSRandall Stewart 		} else {
2215f8829a4aSRandall Stewart 			asoc->state = SCTP_STATE_OPEN;
2216f8829a4aSRandall Stewart 		}
2217f8829a4aSRandall Stewart 		/* update RTO */
2218f8829a4aSRandall Stewart 		SCTP_STAT_INCR_COUNTER32(sctps_activeestab);
2219f8829a4aSRandall Stewart 		SCTP_STAT_INCR_GAUGE32(sctps_currestab);
2220f8829a4aSRandall Stewart 		if (asoc->overall_error_count == 0) {
2221f8829a4aSRandall Stewart 			net->RTO = sctp_calculate_rto(stcb, asoc, net,
2222f8829a4aSRandall Stewart 			    &asoc->time_entered);
2223f8829a4aSRandall Stewart 		}
22246e55db54SRandall Stewart 		(void)SCTP_GETTIME_TIMEVAL(&asoc->time_entered);
2225f8829a4aSRandall Stewart 		sctp_ulp_notify(SCTP_NOTIFY_ASSOC_UP, stcb, 0, NULL);
2226f8829a4aSRandall Stewart 		if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
2227f8829a4aSRandall Stewart 		    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
2228f8829a4aSRandall Stewart 			stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_CONNECTED;
2229f8829a4aSRandall Stewart 			soisconnected(stcb->sctp_ep->sctp_socket);
2230f8829a4aSRandall Stewart 		}
2231f8829a4aSRandall Stewart 		sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
2232f8829a4aSRandall Stewart 		    stcb, net);
2233f8829a4aSRandall Stewart 		/*
2234f8829a4aSRandall Stewart 		 * since we did not send a HB make sure we don't double
2235f8829a4aSRandall Stewart 		 * things
2236f8829a4aSRandall Stewart 		 */
2237f8829a4aSRandall Stewart 		net->hb_responded = 1;
2238f8829a4aSRandall Stewart 
2239f8829a4aSRandall Stewart 		if (stcb->asoc.sctp_autoclose_ticks &&
2240f8829a4aSRandall Stewart 		    sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_AUTOCLOSE)) {
2241f8829a4aSRandall Stewart 			sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE,
2242f8829a4aSRandall Stewart 			    stcb->sctp_ep, stcb, NULL);
2243f8829a4aSRandall Stewart 		}
2244f8829a4aSRandall Stewart 		/*
2245f8829a4aSRandall Stewart 		 * set ASCONF timer if ASCONFs are pending and allowed (eg.
2246f8829a4aSRandall Stewart 		 * addresses changed when init/cookie echo in flight)
2247f8829a4aSRandall Stewart 		 */
2248f8829a4aSRandall Stewart 		if ((sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_DO_ASCONF)) &&
2249f8829a4aSRandall Stewart 		    (stcb->asoc.peer_supports_asconf) &&
2250f8829a4aSRandall Stewart 		    (!TAILQ_EMPTY(&stcb->asoc.asconf_queue))) {
2251f8829a4aSRandall Stewart 			sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2252f8829a4aSRandall Stewart 			    stcb->sctp_ep, stcb,
2253f8829a4aSRandall Stewart 			    stcb->asoc.primary_destination);
2254f8829a4aSRandall Stewart 		}
2255f8829a4aSRandall Stewart 	}
2256f8829a4aSRandall Stewart 	/* Toss the cookie if I can */
2257f8829a4aSRandall Stewart 	sctp_toss_old_cookies(stcb, asoc);
2258f8829a4aSRandall Stewart 	if (!TAILQ_EMPTY(&asoc->sent_queue)) {
2259f8829a4aSRandall Stewart 		/* Restart the timer if we have pending data */
2260f8829a4aSRandall Stewart 		struct sctp_tmit_chunk *chk;
2261f8829a4aSRandall Stewart 
2262f8829a4aSRandall Stewart 		chk = TAILQ_FIRST(&asoc->sent_queue);
2263f8829a4aSRandall Stewart 		if (chk) {
2264f8829a4aSRandall Stewart 			sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
2265f8829a4aSRandall Stewart 			    stcb, chk->whoTo);
2266f8829a4aSRandall Stewart 		}
2267f8829a4aSRandall Stewart 	}
2268f8829a4aSRandall Stewart }
2269f8829a4aSRandall Stewart 
2270f8829a4aSRandall Stewart static void
2271f8829a4aSRandall Stewart sctp_handle_ecn_echo(struct sctp_ecne_chunk *cp,
2272f8829a4aSRandall Stewart     struct sctp_tcb *stcb)
2273f8829a4aSRandall Stewart {
2274f8829a4aSRandall Stewart 	struct sctp_nets *net;
2275f8829a4aSRandall Stewart 	struct sctp_tmit_chunk *lchk;
2276f8829a4aSRandall Stewart 	uint32_t tsn;
2277f8829a4aSRandall Stewart 
2278f8829a4aSRandall Stewart 	if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_ecne_chunk)) {
2279f8829a4aSRandall Stewart 		return;
2280f8829a4aSRandall Stewart 	}
2281f8829a4aSRandall Stewart 	SCTP_STAT_INCR(sctps_recvecne);
2282f8829a4aSRandall Stewart 	tsn = ntohl(cp->tsn);
2283f8829a4aSRandall Stewart 	/* ECN Nonce stuff: need a resync and disable the nonce sum check */
2284f8829a4aSRandall Stewart 	/* Also we make sure we disable the nonce_wait */
2285f8829a4aSRandall Stewart 	lchk = TAILQ_FIRST(&stcb->asoc.send_queue);
2286f8829a4aSRandall Stewart 	if (lchk == NULL) {
2287f8829a4aSRandall Stewart 		stcb->asoc.nonce_resync_tsn = stcb->asoc.sending_seq;
2288f8829a4aSRandall Stewart 	} else {
2289f8829a4aSRandall Stewart 		stcb->asoc.nonce_resync_tsn = lchk->rec.data.TSN_seq;
2290f8829a4aSRandall Stewart 	}
2291f8829a4aSRandall Stewart 	stcb->asoc.nonce_wait_for_ecne = 0;
2292f8829a4aSRandall Stewart 	stcb->asoc.nonce_sum_check = 0;
2293f8829a4aSRandall Stewart 
2294f8829a4aSRandall Stewart 	/* Find where it was sent, if possible */
2295f8829a4aSRandall Stewart 	net = NULL;
2296f8829a4aSRandall Stewart 	lchk = TAILQ_FIRST(&stcb->asoc.sent_queue);
2297f8829a4aSRandall Stewart 	while (lchk) {
2298f8829a4aSRandall Stewart 		if (lchk->rec.data.TSN_seq == tsn) {
2299f8829a4aSRandall Stewart 			net = lchk->whoTo;
2300f8829a4aSRandall Stewart 			break;
2301f8829a4aSRandall Stewart 		}
2302f8829a4aSRandall Stewart 		if (compare_with_wrap(lchk->rec.data.TSN_seq, tsn, MAX_SEQ))
2303f8829a4aSRandall Stewart 			break;
2304f8829a4aSRandall Stewart 		lchk = TAILQ_NEXT(lchk, sctp_next);
2305f8829a4aSRandall Stewart 	}
2306f8829a4aSRandall Stewart 	if (net == NULL)
2307f8829a4aSRandall Stewart 		/* default is we use the primary */
2308f8829a4aSRandall Stewart 		net = stcb->asoc.primary_destination;
2309f8829a4aSRandall Stewart 
2310f8829a4aSRandall Stewart 	if (compare_with_wrap(tsn, stcb->asoc.last_cwr_tsn, MAX_TSN)) {
2311f8829a4aSRandall Stewart #ifdef SCTP_CWND_MONITOR
2312f8829a4aSRandall Stewart 		int old_cwnd;
2313f8829a4aSRandall Stewart 
2314f8829a4aSRandall Stewart 		old_cwnd = net->cwnd;
2315f8829a4aSRandall Stewart #endif
2316f8829a4aSRandall Stewart 		SCTP_STAT_INCR(sctps_ecnereducedcwnd);
2317f8829a4aSRandall Stewart 		net->ssthresh = net->cwnd / 2;
2318f8829a4aSRandall Stewart 		if (net->ssthresh < net->mtu) {
2319f8829a4aSRandall Stewart 			net->ssthresh = net->mtu;
2320f8829a4aSRandall Stewart 			/* here back off the timer as well, to slow us down */
2321f8829a4aSRandall Stewart 			net->RTO <<= 2;
2322f8829a4aSRandall Stewart 		}
2323f8829a4aSRandall Stewart 		net->cwnd = net->ssthresh;
2324f8829a4aSRandall Stewart #ifdef SCTP_CWND_MONITOR
2325f8829a4aSRandall Stewart 		sctp_log_cwnd(stcb, net, (net->cwnd - old_cwnd), SCTP_CWND_LOG_FROM_SAT);
2326f8829a4aSRandall Stewart #endif
2327f8829a4aSRandall Stewart 		/*
2328f8829a4aSRandall Stewart 		 * we reduce once every RTT. So we will only lower cwnd at
2329f8829a4aSRandall Stewart 		 * the next sending seq i.e. the resync_tsn.
2330f8829a4aSRandall Stewart 		 */
2331f8829a4aSRandall Stewart 		stcb->asoc.last_cwr_tsn = stcb->asoc.nonce_resync_tsn;
2332f8829a4aSRandall Stewart 	}
2333f8829a4aSRandall Stewart 	/*
2334f8829a4aSRandall Stewart 	 * We always send a CWR this way if our previous one was lost our
2335f8829a4aSRandall Stewart 	 * peer will get an update, or if it is not time again to reduce we
2336f8829a4aSRandall Stewart 	 * still get the cwr to the peer.
2337f8829a4aSRandall Stewart 	 */
2338f8829a4aSRandall Stewart 	sctp_send_cwr(stcb, net, tsn);
2339f8829a4aSRandall Stewart }
2340f8829a4aSRandall Stewart 
2341f8829a4aSRandall Stewart static void
2342f8829a4aSRandall Stewart sctp_handle_ecn_cwr(struct sctp_cwr_chunk *cp, struct sctp_tcb *stcb)
2343f8829a4aSRandall Stewart {
2344f8829a4aSRandall Stewart 	/*
2345f8829a4aSRandall Stewart 	 * Here we get a CWR from the peer. We must look in the outqueue and
2346f8829a4aSRandall Stewart 	 * make sure that we have a covered ECNE in teh control chunk part.
2347f8829a4aSRandall Stewart 	 * If so remove it.
2348f8829a4aSRandall Stewart 	 */
2349f8829a4aSRandall Stewart 	struct sctp_tmit_chunk *chk;
2350f8829a4aSRandall Stewart 	struct sctp_ecne_chunk *ecne;
2351f8829a4aSRandall Stewart 
2352f8829a4aSRandall Stewart 	TAILQ_FOREACH(chk, &stcb->asoc.control_send_queue, sctp_next) {
2353f8829a4aSRandall Stewart 		if (chk->rec.chunk_id.id != SCTP_ECN_ECHO) {
2354f8829a4aSRandall Stewart 			continue;
2355f8829a4aSRandall Stewart 		}
2356f8829a4aSRandall Stewart 		/*
2357f8829a4aSRandall Stewart 		 * Look for and remove if it is the right TSN. Since there
2358f8829a4aSRandall Stewart 		 * is only ONE ECNE on the control queue at any one time we
2359f8829a4aSRandall Stewart 		 * don't need to worry about more than one!
2360f8829a4aSRandall Stewart 		 */
2361f8829a4aSRandall Stewart 		ecne = mtod(chk->data, struct sctp_ecne_chunk *);
2362f8829a4aSRandall Stewart 		if (compare_with_wrap(ntohl(cp->tsn), ntohl(ecne->tsn),
2363f8829a4aSRandall Stewart 		    MAX_TSN) || (cp->tsn == ecne->tsn)) {
2364f8829a4aSRandall Stewart 			/* this covers this ECNE, we can remove it */
2365f8829a4aSRandall Stewart 			stcb->asoc.ecn_echo_cnt_onq--;
2366f8829a4aSRandall Stewart 			TAILQ_REMOVE(&stcb->asoc.control_send_queue, chk,
2367f8829a4aSRandall Stewart 			    sctp_next);
2368f8829a4aSRandall Stewart 			if (chk->data) {
2369f8829a4aSRandall Stewart 				sctp_m_freem(chk->data);
2370f8829a4aSRandall Stewart 				chk->data = NULL;
2371f8829a4aSRandall Stewart 			}
2372f8829a4aSRandall Stewart 			stcb->asoc.ctrl_queue_cnt--;
2373f8829a4aSRandall Stewart 			sctp_free_remote_addr(chk->whoTo);
2374f8829a4aSRandall Stewart 			sctp_free_a_chunk(stcb, chk);
2375f8829a4aSRandall Stewart 			break;
2376f8829a4aSRandall Stewart 		}
2377f8829a4aSRandall Stewart 	}
2378f8829a4aSRandall Stewart }
2379f8829a4aSRandall Stewart 
2380f8829a4aSRandall Stewart static void
2381f8829a4aSRandall Stewart sctp_handle_shutdown_complete(struct sctp_shutdown_complete_chunk *cp,
2382f8829a4aSRandall Stewart     struct sctp_tcb *stcb, struct sctp_nets *net)
2383f8829a4aSRandall Stewart {
2384f8829a4aSRandall Stewart 	struct sctp_association *asoc;
2385f8829a4aSRandall Stewart 
2386ad81507eSRandall Stewart 	SCTPDBG(SCTP_DEBUG_INPUT2,
2387ad81507eSRandall Stewart 	    "sctp_handle_shutdown_complete: handling SHUTDOWN-COMPLETE\n");
2388f8829a4aSRandall Stewart 	if (stcb == NULL)
2389f8829a4aSRandall Stewart 		return;
2390f8829a4aSRandall Stewart 
2391f8829a4aSRandall Stewart 	asoc = &stcb->asoc;
2392f8829a4aSRandall Stewart 	/* process according to association state */
2393f8829a4aSRandall Stewart 	if (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT) {
2394f8829a4aSRandall Stewart 		/* unexpected SHUTDOWN-COMPLETE... so ignore... */
2395f8829a4aSRandall Stewart 		SCTP_TCB_UNLOCK(stcb);
2396f8829a4aSRandall Stewart 		return;
2397f8829a4aSRandall Stewart 	}
2398f8829a4aSRandall Stewart 	/* notify upper layer protocol */
2399f8829a4aSRandall Stewart 	if (stcb->sctp_socket) {
2400f8829a4aSRandall Stewart 		sctp_ulp_notify(SCTP_NOTIFY_ASSOC_DOWN, stcb, 0, NULL);
2401f8829a4aSRandall Stewart 		/* are the queues empty? they should be */
2402f8829a4aSRandall Stewart 		if (!TAILQ_EMPTY(&asoc->send_queue) ||
2403f8829a4aSRandall Stewart 		    !TAILQ_EMPTY(&asoc->sent_queue) ||
2404f8829a4aSRandall Stewart 		    !TAILQ_EMPTY(&asoc->out_wheel)) {
24057f34832bSRandall Stewart 			sctp_report_all_outbound(stcb, 0);
2406f8829a4aSRandall Stewart 		}
2407f8829a4aSRandall Stewart 	}
2408f8829a4aSRandall Stewart 	/* stop the timer */
2409a5d547adSRandall Stewart 	sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_21);
2410f8829a4aSRandall Stewart 	SCTP_STAT_INCR_COUNTER32(sctps_shutdown);
2411f8829a4aSRandall Stewart 	/* free the TCB */
2412a5d547adSRandall Stewart 	sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_22);
2413f8829a4aSRandall Stewart 	return;
2414f8829a4aSRandall Stewart }
2415f8829a4aSRandall Stewart 
2416f8829a4aSRandall Stewart static int
2417f8829a4aSRandall Stewart process_chunk_drop(struct sctp_tcb *stcb, struct sctp_chunk_desc *desc,
2418f8829a4aSRandall Stewart     struct sctp_nets *net, uint8_t flg)
2419f8829a4aSRandall Stewart {
2420f8829a4aSRandall Stewart 	switch (desc->chunk_type) {
2421f8829a4aSRandall Stewart 		case SCTP_DATA:
2422f8829a4aSRandall Stewart 		/* find the tsn to resend (possibly */
2423f8829a4aSRandall Stewart 		{
2424f8829a4aSRandall Stewart 			uint32_t tsn;
2425f8829a4aSRandall Stewart 			struct sctp_tmit_chunk *tp1;
2426f8829a4aSRandall Stewart 
2427f8829a4aSRandall Stewart 			tsn = ntohl(desc->tsn_ifany);
2428f8829a4aSRandall Stewart 			tp1 = TAILQ_FIRST(&stcb->asoc.sent_queue);
2429f8829a4aSRandall Stewart 			while (tp1) {
2430f8829a4aSRandall Stewart 				if (tp1->rec.data.TSN_seq == tsn) {
2431f8829a4aSRandall Stewart 					/* found it */
2432f8829a4aSRandall Stewart 					break;
2433f8829a4aSRandall Stewart 				}
2434f8829a4aSRandall Stewart 				if (compare_with_wrap(tp1->rec.data.TSN_seq, tsn,
2435f8829a4aSRandall Stewart 				    MAX_TSN)) {
2436f8829a4aSRandall Stewart 					/* not found */
2437f8829a4aSRandall Stewart 					tp1 = NULL;
2438f8829a4aSRandall Stewart 					break;
2439f8829a4aSRandall Stewart 				}
2440f8829a4aSRandall Stewart 				tp1 = TAILQ_NEXT(tp1, sctp_next);
2441f8829a4aSRandall Stewart 			}
2442f8829a4aSRandall Stewart 			if (tp1 == NULL) {
2443f8829a4aSRandall Stewart 				/*
2444f8829a4aSRandall Stewart 				 * Do it the other way , aka without paying
2445f8829a4aSRandall Stewart 				 * attention to queue seq order.
2446f8829a4aSRandall Stewart 				 */
2447f8829a4aSRandall Stewart 				SCTP_STAT_INCR(sctps_pdrpdnfnd);
2448f8829a4aSRandall Stewart 				tp1 = TAILQ_FIRST(&stcb->asoc.sent_queue);
2449f8829a4aSRandall Stewart 				while (tp1) {
2450f8829a4aSRandall Stewart 					if (tp1->rec.data.TSN_seq == tsn) {
2451f8829a4aSRandall Stewart 						/* found it */
2452f8829a4aSRandall Stewart 						break;
2453f8829a4aSRandall Stewart 					}
2454f8829a4aSRandall Stewart 					tp1 = TAILQ_NEXT(tp1, sctp_next);
2455f8829a4aSRandall Stewart 				}
2456f8829a4aSRandall Stewart 			}
2457f8829a4aSRandall Stewart 			if (tp1 == NULL) {
2458f8829a4aSRandall Stewart 				SCTP_STAT_INCR(sctps_pdrptsnnf);
2459f8829a4aSRandall Stewart 			}
2460f8829a4aSRandall Stewart 			if ((tp1) && (tp1->sent < SCTP_DATAGRAM_ACKED)) {
2461f8829a4aSRandall Stewart 				uint8_t *ddp;
2462f8829a4aSRandall Stewart 
2463f8829a4aSRandall Stewart 				if ((stcb->asoc.peers_rwnd == 0) &&
2464f8829a4aSRandall Stewart 				    ((flg & SCTP_FROM_MIDDLE_BOX) == 0)) {
2465f8829a4aSRandall Stewart 					SCTP_STAT_INCR(sctps_pdrpdiwnp);
2466f8829a4aSRandall Stewart 					return (0);
2467f8829a4aSRandall Stewart 				}
2468f8829a4aSRandall Stewart 				if (stcb->asoc.peers_rwnd == 0 &&
2469f8829a4aSRandall Stewart 				    (flg & SCTP_FROM_MIDDLE_BOX)) {
2470f8829a4aSRandall Stewart 					SCTP_STAT_INCR(sctps_pdrpdizrw);
2471f8829a4aSRandall Stewart 					return (0);
2472f8829a4aSRandall Stewart 				}
2473f8829a4aSRandall Stewart 				ddp = (uint8_t *) (mtod(tp1->data, caddr_t)+
2474f8829a4aSRandall Stewart 				    sizeof(struct sctp_data_chunk));
2475f8829a4aSRandall Stewart 				{
2476f8829a4aSRandall Stewart 					unsigned int iii;
2477f8829a4aSRandall Stewart 
2478f8829a4aSRandall Stewart 					for (iii = 0; iii < sizeof(desc->data_bytes);
2479f8829a4aSRandall Stewart 					    iii++) {
2480f8829a4aSRandall Stewart 						if (ddp[iii] != desc->data_bytes[iii]) {
2481f8829a4aSRandall Stewart 							SCTP_STAT_INCR(sctps_pdrpbadd);
2482f8829a4aSRandall Stewart 							return (-1);
2483f8829a4aSRandall Stewart 						}
2484f8829a4aSRandall Stewart 					}
2485f8829a4aSRandall Stewart 				}
2486f8829a4aSRandall Stewart 				/*
2487f8829a4aSRandall Stewart 				 * We zero out the nonce so resync not
2488f8829a4aSRandall Stewart 				 * needed
2489f8829a4aSRandall Stewart 				 */
2490f8829a4aSRandall Stewart 				tp1->rec.data.ect_nonce = 0;
2491f8829a4aSRandall Stewart 
2492f8829a4aSRandall Stewart 				if (tp1->do_rtt) {
2493f8829a4aSRandall Stewart 					/*
2494f8829a4aSRandall Stewart 					 * this guy had a RTO calculation
2495f8829a4aSRandall Stewart 					 * pending on it, cancel it
2496f8829a4aSRandall Stewart 					 */
2497f8829a4aSRandall Stewart 					tp1->do_rtt = 0;
2498f8829a4aSRandall Stewart 				}
2499f8829a4aSRandall Stewart 				SCTP_STAT_INCR(sctps_pdrpmark);
2500f8829a4aSRandall Stewart 				if (tp1->sent != SCTP_DATAGRAM_RESEND)
2501f8829a4aSRandall Stewart 					sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
2502f8829a4aSRandall Stewart 				tp1->sent = SCTP_DATAGRAM_RESEND;
2503f8829a4aSRandall Stewart 				/*
2504f8829a4aSRandall Stewart 				 * mark it as if we were doing a FR, since
2505f8829a4aSRandall Stewart 				 * we will be getting gap ack reports behind
2506f8829a4aSRandall Stewart 				 * the info from the router.
2507f8829a4aSRandall Stewart 				 */
2508f8829a4aSRandall Stewart 				tp1->rec.data.doing_fast_retransmit = 1;
2509f8829a4aSRandall Stewart 				/*
2510f8829a4aSRandall Stewart 				 * mark the tsn with what sequences can
2511f8829a4aSRandall Stewart 				 * cause a new FR.
2512f8829a4aSRandall Stewart 				 */
2513f8829a4aSRandall Stewart 				if (TAILQ_EMPTY(&stcb->asoc.send_queue)) {
2514f8829a4aSRandall Stewart 					tp1->rec.data.fast_retran_tsn = stcb->asoc.sending_seq;
2515f8829a4aSRandall Stewart 				} else {
2516f8829a4aSRandall Stewart 					tp1->rec.data.fast_retran_tsn = (TAILQ_FIRST(&stcb->asoc.send_queue))->rec.data.TSN_seq;
2517f8829a4aSRandall Stewart 				}
2518f8829a4aSRandall Stewart 
2519f8829a4aSRandall Stewart 				/* restart the timer */
2520f8829a4aSRandall Stewart 				sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
2521a5d547adSRandall Stewart 				    stcb, tp1->whoTo, SCTP_FROM_SCTP_INPUT + SCTP_LOC_23);
2522f8829a4aSRandall Stewart 				sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
2523f8829a4aSRandall Stewart 				    stcb, tp1->whoTo);
2524f8829a4aSRandall Stewart 
2525f8829a4aSRandall Stewart 				/* fix counts and things */
2526a5d547adSRandall Stewart #ifdef SCTP_FLIGHT_LOGGING
2527c105859eSRandall Stewart 				sctp_misc_ints(SCTP_FLIGHT_LOG_DOWN_PDRP,
2528a5d547adSRandall Stewart 				    tp1->whoTo->flight_size,
2529a5d547adSRandall Stewart 				    tp1->book_size,
2530a5d547adSRandall Stewart 				    (uintptr_t) stcb,
2531a5d547adSRandall Stewart 				    tp1->rec.data.TSN_seq);
2532a5d547adSRandall Stewart #endif
2533c105859eSRandall Stewart 				sctp_flight_size_decrease(tp1);
2534c105859eSRandall Stewart 				sctp_total_flight_decrease(stcb, tp1);
2535f8829a4aSRandall Stewart 			} {
2536f8829a4aSRandall Stewart 				/* audit code */
2537f8829a4aSRandall Stewart 				unsigned int audit;
2538f8829a4aSRandall Stewart 
2539f8829a4aSRandall Stewart 				audit = 0;
2540f8829a4aSRandall Stewart 				TAILQ_FOREACH(tp1, &stcb->asoc.sent_queue, sctp_next) {
2541f8829a4aSRandall Stewart 					if (tp1->sent == SCTP_DATAGRAM_RESEND)
2542f8829a4aSRandall Stewart 						audit++;
2543f8829a4aSRandall Stewart 				}
2544f8829a4aSRandall Stewart 				TAILQ_FOREACH(tp1, &stcb->asoc.control_send_queue,
2545f8829a4aSRandall Stewart 				    sctp_next) {
2546f8829a4aSRandall Stewart 					if (tp1->sent == SCTP_DATAGRAM_RESEND)
2547f8829a4aSRandall Stewart 						audit++;
2548f8829a4aSRandall Stewart 				}
2549f8829a4aSRandall Stewart 				if (audit != stcb->asoc.sent_queue_retran_cnt) {
2550ad81507eSRandall Stewart 					SCTP_PRINTF("**Local Audit finds cnt:%d asoc cnt:%d\n",
2551f8829a4aSRandall Stewart 					    audit, stcb->asoc.sent_queue_retran_cnt);
2552f8829a4aSRandall Stewart #ifndef SCTP_AUDITING_ENABLED
2553f8829a4aSRandall Stewart 					stcb->asoc.sent_queue_retran_cnt = audit;
2554f8829a4aSRandall Stewart #endif
2555f8829a4aSRandall Stewart 				}
2556f8829a4aSRandall Stewart 			}
2557f8829a4aSRandall Stewart 		}
2558f8829a4aSRandall Stewart 		break;
2559f8829a4aSRandall Stewart 	case SCTP_ASCONF:
2560f8829a4aSRandall Stewart 		{
2561f8829a4aSRandall Stewart 			struct sctp_tmit_chunk *asconf;
2562f8829a4aSRandall Stewart 
2563f8829a4aSRandall Stewart 			TAILQ_FOREACH(asconf, &stcb->asoc.control_send_queue,
2564f8829a4aSRandall Stewart 			    sctp_next) {
2565f8829a4aSRandall Stewart 				if (asconf->rec.chunk_id.id == SCTP_ASCONF) {
2566f8829a4aSRandall Stewart 					break;
2567f8829a4aSRandall Stewart 				}
2568f8829a4aSRandall Stewart 			}
2569f8829a4aSRandall Stewart 			if (asconf) {
2570f8829a4aSRandall Stewart 				if (asconf->sent != SCTP_DATAGRAM_RESEND)
2571f8829a4aSRandall Stewart 					sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
2572f8829a4aSRandall Stewart 				asconf->sent = SCTP_DATAGRAM_RESEND;
2573f8829a4aSRandall Stewart 				asconf->snd_count--;
2574f8829a4aSRandall Stewart 			}
2575f8829a4aSRandall Stewart 		}
2576f8829a4aSRandall Stewart 		break;
2577f8829a4aSRandall Stewart 	case SCTP_INITIATION:
2578f8829a4aSRandall Stewart 		/* resend the INIT */
2579f8829a4aSRandall Stewart 		stcb->asoc.dropped_special_cnt++;
2580f8829a4aSRandall Stewart 		if (stcb->asoc.dropped_special_cnt < SCTP_RETRY_DROPPED_THRESH) {
2581f8829a4aSRandall Stewart 			/*
2582f8829a4aSRandall Stewart 			 * If we can get it in, in a few attempts we do
2583f8829a4aSRandall Stewart 			 * this, otherwise we let the timer fire.
2584f8829a4aSRandall Stewart 			 */
2585f8829a4aSRandall Stewart 			sctp_timer_stop(SCTP_TIMER_TYPE_INIT, stcb->sctp_ep,
2586a5d547adSRandall Stewart 			    stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_24);
2587f8829a4aSRandall Stewart 			sctp_send_initiate(stcb->sctp_ep, stcb);
2588f8829a4aSRandall Stewart 		}
2589f8829a4aSRandall Stewart 		break;
2590f8829a4aSRandall Stewart 	case SCTP_SELECTIVE_ACK:
2591f8829a4aSRandall Stewart 		/* resend the sack */
2592f8829a4aSRandall Stewart 		sctp_send_sack(stcb);
2593f8829a4aSRandall Stewart 		break;
2594f8829a4aSRandall Stewart 	case SCTP_HEARTBEAT_REQUEST:
2595f8829a4aSRandall Stewart 		/* resend a demand HB */
25966e55db54SRandall Stewart 		(void)sctp_send_hb(stcb, 1, net);
2597f8829a4aSRandall Stewart 		break;
2598f8829a4aSRandall Stewart 	case SCTP_SHUTDOWN:
2599f8829a4aSRandall Stewart 		sctp_send_shutdown(stcb, net);
2600f8829a4aSRandall Stewart 		break;
2601f8829a4aSRandall Stewart 	case SCTP_SHUTDOWN_ACK:
2602f8829a4aSRandall Stewart 		sctp_send_shutdown_ack(stcb, net);
2603f8829a4aSRandall Stewart 		break;
2604f8829a4aSRandall Stewart 	case SCTP_COOKIE_ECHO:
2605f8829a4aSRandall Stewart 		{
2606f8829a4aSRandall Stewart 			struct sctp_tmit_chunk *cookie;
2607f8829a4aSRandall Stewart 
2608f8829a4aSRandall Stewart 			cookie = NULL;
2609f8829a4aSRandall Stewart 			TAILQ_FOREACH(cookie, &stcb->asoc.control_send_queue,
2610f8829a4aSRandall Stewart 			    sctp_next) {
2611f8829a4aSRandall Stewart 				if (cookie->rec.chunk_id.id == SCTP_COOKIE_ECHO) {
2612f8829a4aSRandall Stewart 					break;
2613f8829a4aSRandall Stewart 				}
2614f8829a4aSRandall Stewart 			}
2615f8829a4aSRandall Stewart 			if (cookie) {
2616f8829a4aSRandall Stewart 				if (cookie->sent != SCTP_DATAGRAM_RESEND)
2617f8829a4aSRandall Stewart 					sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
2618f8829a4aSRandall Stewart 				cookie->sent = SCTP_DATAGRAM_RESEND;
2619f8829a4aSRandall Stewart 				sctp_stop_all_cookie_timers(stcb);
2620f8829a4aSRandall Stewart 			}
2621f8829a4aSRandall Stewart 		}
2622f8829a4aSRandall Stewart 		break;
2623f8829a4aSRandall Stewart 	case SCTP_COOKIE_ACK:
2624f8829a4aSRandall Stewart 		sctp_send_cookie_ack(stcb);
2625f8829a4aSRandall Stewart 		break;
2626f8829a4aSRandall Stewart 	case SCTP_ASCONF_ACK:
2627f8829a4aSRandall Stewart 		/* resend last asconf ack */
2628f8829a4aSRandall Stewart 		sctp_send_asconf_ack(stcb, 1);
2629f8829a4aSRandall Stewart 		break;
2630f8829a4aSRandall Stewart 	case SCTP_FORWARD_CUM_TSN:
2631f8829a4aSRandall Stewart 		send_forward_tsn(stcb, &stcb->asoc);
2632f8829a4aSRandall Stewart 		break;
2633f8829a4aSRandall Stewart 		/* can't do anything with these */
2634f8829a4aSRandall Stewart 	case SCTP_PACKET_DROPPED:
2635f8829a4aSRandall Stewart 	case SCTP_INITIATION_ACK:	/* this should not happen */
2636f8829a4aSRandall Stewart 	case SCTP_HEARTBEAT_ACK:
2637f8829a4aSRandall Stewart 	case SCTP_ABORT_ASSOCIATION:
2638f8829a4aSRandall Stewart 	case SCTP_OPERATION_ERROR:
2639f8829a4aSRandall Stewart 	case SCTP_SHUTDOWN_COMPLETE:
2640f8829a4aSRandall Stewart 	case SCTP_ECN_ECHO:
2641f8829a4aSRandall Stewart 	case SCTP_ECN_CWR:
2642f8829a4aSRandall Stewart 	default:
2643f8829a4aSRandall Stewart 		break;
2644f8829a4aSRandall Stewart 	}
2645f8829a4aSRandall Stewart 	return (0);
2646f8829a4aSRandall Stewart }
2647f8829a4aSRandall Stewart 
2648f8829a4aSRandall Stewart void
2649f8829a4aSRandall Stewart sctp_reset_in_stream(struct sctp_tcb *stcb, int number_entries, uint16_t * list)
2650f8829a4aSRandall Stewart {
2651f8829a4aSRandall Stewart 	int i;
2652f8829a4aSRandall Stewart 	uint16_t temp;
2653f8829a4aSRandall Stewart 
2654f8829a4aSRandall Stewart 	/*
2655f8829a4aSRandall Stewart 	 * We set things to 0xffff since this is the last delivered sequence
2656f8829a4aSRandall Stewart 	 * and we will be sending in 0 after the reset.
2657f8829a4aSRandall Stewart 	 */
2658f8829a4aSRandall Stewart 
2659f8829a4aSRandall Stewart 	if (number_entries) {
2660f8829a4aSRandall Stewart 		for (i = 0; i < number_entries; i++) {
2661f8829a4aSRandall Stewart 			temp = ntohs(list[i]);
2662f8829a4aSRandall Stewart 			if (temp >= stcb->asoc.streamincnt) {
2663f8829a4aSRandall Stewart 				continue;
2664f8829a4aSRandall Stewart 			}
2665f8829a4aSRandall Stewart 			stcb->asoc.strmin[temp].last_sequence_delivered = 0xffff;
2666f8829a4aSRandall Stewart 		}
2667f8829a4aSRandall Stewart 	} else {
2668f8829a4aSRandall Stewart 		list = NULL;
2669f8829a4aSRandall Stewart 		for (i = 0; i < stcb->asoc.streamincnt; i++) {
2670f8829a4aSRandall Stewart 			stcb->asoc.strmin[i].last_sequence_delivered = 0xffff;
2671f8829a4aSRandall Stewart 		}
2672f8829a4aSRandall Stewart 	}
2673f8829a4aSRandall Stewart 	sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_RECV, stcb, number_entries, (void *)list);
2674f8829a4aSRandall Stewart }
2675f8829a4aSRandall Stewart 
2676f8829a4aSRandall Stewart static void
2677f8829a4aSRandall Stewart sctp_reset_out_streams(struct sctp_tcb *stcb, int number_entries, uint16_t * list)
2678f8829a4aSRandall Stewart {
2679f8829a4aSRandall Stewart 	int i;
2680f8829a4aSRandall Stewart 
2681f8829a4aSRandall Stewart 	if (number_entries == 0) {
2682f8829a4aSRandall Stewart 		for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
2683f8829a4aSRandall Stewart 			stcb->asoc.strmout[i].next_sequence_sent = 0;
2684f8829a4aSRandall Stewart 		}
2685f8829a4aSRandall Stewart 	} else if (number_entries) {
2686f8829a4aSRandall Stewart 		for (i = 0; i < number_entries; i++) {
2687f8829a4aSRandall Stewart 			uint16_t temp;
2688f8829a4aSRandall Stewart 
2689f8829a4aSRandall Stewart 			temp = ntohs(list[i]);
2690f8829a4aSRandall Stewart 			if (temp >= stcb->asoc.streamoutcnt) {
2691f8829a4aSRandall Stewart 				/* no such stream */
2692f8829a4aSRandall Stewart 				continue;
2693f8829a4aSRandall Stewart 			}
2694f8829a4aSRandall Stewart 			stcb->asoc.strmout[temp].next_sequence_sent = 0;
2695f8829a4aSRandall Stewart 		}
2696f8829a4aSRandall Stewart 	}
2697f8829a4aSRandall Stewart 	sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_SEND, stcb, number_entries, (void *)list);
2698f8829a4aSRandall Stewart }
2699f8829a4aSRandall Stewart 
2700f8829a4aSRandall Stewart 
2701f8829a4aSRandall Stewart struct sctp_stream_reset_out_request *
2702f8829a4aSRandall Stewart sctp_find_stream_reset(struct sctp_tcb *stcb, uint32_t seq, struct sctp_tmit_chunk **bchk)
2703f8829a4aSRandall Stewart {
2704f8829a4aSRandall Stewart 	struct sctp_association *asoc;
2705f8829a4aSRandall Stewart 	struct sctp_stream_reset_out_req *req;
2706f8829a4aSRandall Stewart 	struct sctp_stream_reset_out_request *r;
2707f8829a4aSRandall Stewart 	struct sctp_tmit_chunk *chk;
2708f8829a4aSRandall Stewart 	int len, clen;
2709f8829a4aSRandall Stewart 
2710f8829a4aSRandall Stewart 	asoc = &stcb->asoc;
2711f8829a4aSRandall Stewart 	if (TAILQ_EMPTY(&stcb->asoc.control_send_queue)) {
2712d06c82f1SRandall Stewart 		asoc->stream_reset_outstanding = 0;
2713f8829a4aSRandall Stewart 		return (NULL);
2714f8829a4aSRandall Stewart 	}
2715f8829a4aSRandall Stewart 	if (stcb->asoc.str_reset == NULL) {
2716d06c82f1SRandall Stewart 		asoc->stream_reset_outstanding = 0;
2717f8829a4aSRandall Stewart 		return (NULL);
2718f8829a4aSRandall Stewart 	}
2719f8829a4aSRandall Stewart 	chk = stcb->asoc.str_reset;
2720f8829a4aSRandall Stewart 	if (chk->data == NULL) {
2721f8829a4aSRandall Stewart 		return (NULL);
2722f8829a4aSRandall Stewart 	}
2723f8829a4aSRandall Stewart 	if (bchk) {
2724f8829a4aSRandall Stewart 		/* he wants a copy of the chk pointer */
2725f8829a4aSRandall Stewart 		*bchk = chk;
2726f8829a4aSRandall Stewart 	}
2727f8829a4aSRandall Stewart 	clen = chk->send_size;
2728f8829a4aSRandall Stewart 	req = mtod(chk->data, struct sctp_stream_reset_out_req *);
2729f8829a4aSRandall Stewart 	r = &req->sr_req;
2730f8829a4aSRandall Stewart 	if (ntohl(r->request_seq) == seq) {
2731f8829a4aSRandall Stewart 		/* found it */
2732f8829a4aSRandall Stewart 		return (r);
2733f8829a4aSRandall Stewart 	}
2734f8829a4aSRandall Stewart 	len = SCTP_SIZE32(ntohs(r->ph.param_length));
2735f8829a4aSRandall Stewart 	if (clen > (len + (int)sizeof(struct sctp_chunkhdr))) {
2736f8829a4aSRandall Stewart 		/* move to the next one, there can only be a max of two */
2737f8829a4aSRandall Stewart 		r = (struct sctp_stream_reset_out_request *)((caddr_t)r + len);
2738f8829a4aSRandall Stewart 		if (ntohl(r->request_seq) == seq) {
2739f8829a4aSRandall Stewart 			return (r);
2740f8829a4aSRandall Stewart 		}
2741f8829a4aSRandall Stewart 	}
2742f8829a4aSRandall Stewart 	/* that seq is not here */
2743f8829a4aSRandall Stewart 	return (NULL);
2744f8829a4aSRandall Stewart }
2745f8829a4aSRandall Stewart 
2746f8829a4aSRandall Stewart static void
2747f8829a4aSRandall Stewart sctp_clean_up_stream_reset(struct sctp_tcb *stcb)
2748f8829a4aSRandall Stewart {
2749f8829a4aSRandall Stewart 	struct sctp_association *asoc;
2750f8829a4aSRandall Stewart 	struct sctp_tmit_chunk *chk = stcb->asoc.str_reset;
2751f8829a4aSRandall Stewart 
2752f8829a4aSRandall Stewart 	if (stcb->asoc.str_reset == NULL) {
2753f8829a4aSRandall Stewart 		return;
2754f8829a4aSRandall Stewart 	}
2755f42a358aSRandall Stewart 	asoc = &stcb->asoc;
2756f42a358aSRandall Stewart 
2757a5d547adSRandall Stewart 	sctp_timer_stop(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo, SCTP_FROM_SCTP_INPUT + SCTP_LOC_25);
2758f8829a4aSRandall Stewart 	TAILQ_REMOVE(&asoc->control_send_queue,
2759f8829a4aSRandall Stewart 	    chk,
2760f8829a4aSRandall Stewart 	    sctp_next);
2761f8829a4aSRandall Stewart 	if (chk->data) {
2762f8829a4aSRandall Stewart 		sctp_m_freem(chk->data);
2763f8829a4aSRandall Stewart 		chk->data = NULL;
2764f8829a4aSRandall Stewart 	}
2765f8829a4aSRandall Stewart 	asoc->ctrl_queue_cnt--;
2766f8829a4aSRandall Stewart 	sctp_free_remote_addr(chk->whoTo);
2767f8829a4aSRandall Stewart 
2768f8829a4aSRandall Stewart 	sctp_free_a_chunk(stcb, chk);
2769f8829a4aSRandall Stewart 	stcb->asoc.str_reset = NULL;
2770f8829a4aSRandall Stewart }
2771f8829a4aSRandall Stewart 
2772f8829a4aSRandall Stewart 
2773f8829a4aSRandall Stewart static int
2774f8829a4aSRandall Stewart sctp_handle_stream_reset_response(struct sctp_tcb *stcb,
2775f8829a4aSRandall Stewart     uint32_t seq, uint32_t action,
277608598d70SRandall Stewart     struct sctp_stream_reset_response *respin)
2777f8829a4aSRandall Stewart {
2778f8829a4aSRandall Stewart 	uint16_t type;
2779f8829a4aSRandall Stewart 	int lparm_len;
2780f8829a4aSRandall Stewart 	struct sctp_association *asoc = &stcb->asoc;
2781f8829a4aSRandall Stewart 	struct sctp_tmit_chunk *chk;
2782f8829a4aSRandall Stewart 	struct sctp_stream_reset_out_request *srparam;
2783f8829a4aSRandall Stewart 	int number_entries;
2784f8829a4aSRandall Stewart 
2785f8829a4aSRandall Stewart 	if (asoc->stream_reset_outstanding == 0) {
2786f8829a4aSRandall Stewart 		/* duplicate */
2787f8829a4aSRandall Stewart 		return (0);
2788f8829a4aSRandall Stewart 	}
2789f8829a4aSRandall Stewart 	if (seq == stcb->asoc.str_reset_seq_out) {
2790f8829a4aSRandall Stewart 		srparam = sctp_find_stream_reset(stcb, seq, &chk);
2791f8829a4aSRandall Stewart 		if (srparam) {
2792f8829a4aSRandall Stewart 			stcb->asoc.str_reset_seq_out++;
2793f8829a4aSRandall Stewart 			type = ntohs(srparam->ph.param_type);
2794f8829a4aSRandall Stewart 			lparm_len = ntohs(srparam->ph.param_length);
2795f8829a4aSRandall Stewart 			if (type == SCTP_STR_RESET_OUT_REQUEST) {
279608598d70SRandall Stewart 				number_entries = (lparm_len - sizeof(struct sctp_stream_reset_out_request)) / sizeof(uint16_t);
2797f8829a4aSRandall Stewart 				asoc->stream_reset_out_is_outstanding = 0;
2798f8829a4aSRandall Stewart 				if (asoc->stream_reset_outstanding)
2799f8829a4aSRandall Stewart 					asoc->stream_reset_outstanding--;
2800f8829a4aSRandall Stewart 				if (action == SCTP_STREAM_RESET_PERFORMED) {
2801f8829a4aSRandall Stewart 					/* do it */
2802f8829a4aSRandall Stewart 					sctp_reset_out_streams(stcb, number_entries, srparam->list_of_streams);
2803f8829a4aSRandall Stewart 				} else {
2804f8829a4aSRandall Stewart 					sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_FAILED_OUT, stcb, number_entries, srparam->list_of_streams);
2805f8829a4aSRandall Stewart 				}
2806f8829a4aSRandall Stewart 			} else if (type == SCTP_STR_RESET_IN_REQUEST) {
2807f8829a4aSRandall Stewart 				/* Answered my request */
280808598d70SRandall Stewart 				number_entries = (lparm_len - sizeof(struct sctp_stream_reset_in_request)) / sizeof(uint16_t);
2809f8829a4aSRandall Stewart 				if (asoc->stream_reset_outstanding)
2810f8829a4aSRandall Stewart 					asoc->stream_reset_outstanding--;
2811f8829a4aSRandall Stewart 				if (action != SCTP_STREAM_RESET_PERFORMED) {
2812f8829a4aSRandall Stewart 					sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_FAILED_IN, stcb, number_entries, srparam->list_of_streams);
2813f8829a4aSRandall Stewart 				}
2814f8829a4aSRandall Stewart 			} else if (type == SCTP_STR_RESET_TSN_REQUEST) {
2815f8829a4aSRandall Stewart 				/**
2816f8829a4aSRandall Stewart 				 * a) Adopt the new in tsn.
2817f8829a4aSRandall Stewart 				 * b) reset the map
2818f8829a4aSRandall Stewart 				 * c) Adopt the new out-tsn
2819f8829a4aSRandall Stewart 				 */
2820f8829a4aSRandall Stewart 				struct sctp_stream_reset_response_tsn *resp;
2821f8829a4aSRandall Stewart 				struct sctp_forward_tsn_chunk fwdtsn;
2822f8829a4aSRandall Stewart 				int abort_flag = 0;
2823f8829a4aSRandall Stewart 
2824f8829a4aSRandall Stewart 				if (respin == NULL) {
2825f8829a4aSRandall Stewart 					/* huh ? */
2826f8829a4aSRandall Stewart 					return (0);
2827f8829a4aSRandall Stewart 				}
2828f8829a4aSRandall Stewart 				if (action == SCTP_STREAM_RESET_PERFORMED) {
2829f8829a4aSRandall Stewart 					resp = (struct sctp_stream_reset_response_tsn *)respin;
2830f8829a4aSRandall Stewart 					asoc->stream_reset_outstanding--;
2831f8829a4aSRandall Stewart 					fwdtsn.ch.chunk_length = htons(sizeof(struct sctp_forward_tsn_chunk));
2832f8829a4aSRandall Stewart 					fwdtsn.ch.chunk_type = SCTP_FORWARD_CUM_TSN;
2833f8829a4aSRandall Stewart 					fwdtsn.new_cumulative_tsn = htonl(ntohl(resp->senders_next_tsn) - 1);
2834f8829a4aSRandall Stewart 					sctp_handle_forward_tsn(stcb, &fwdtsn, &abort_flag);
2835f8829a4aSRandall Stewart 					if (abort_flag) {
2836f8829a4aSRandall Stewart 						return (1);
2837f8829a4aSRandall Stewart 					}
2838f8829a4aSRandall Stewart 					stcb->asoc.highest_tsn_inside_map = (ntohl(resp->senders_next_tsn) - 1);
2839f8829a4aSRandall Stewart 					stcb->asoc.cumulative_tsn = stcb->asoc.highest_tsn_inside_map;
2840f8829a4aSRandall Stewart 					stcb->asoc.mapping_array_base_tsn = ntohl(resp->senders_next_tsn);
2841f8829a4aSRandall Stewart 					memset(stcb->asoc.mapping_array, 0, stcb->asoc.mapping_array_size);
2842f8829a4aSRandall Stewart 					stcb->asoc.sending_seq = ntohl(resp->receivers_next_tsn);
2843f8829a4aSRandall Stewart 					stcb->asoc.last_acked_seq = stcb->asoc.cumulative_tsn;
2844f8829a4aSRandall Stewart 
2845f8829a4aSRandall Stewart 					sctp_reset_out_streams(stcb, 0, (uint16_t *) NULL);
2846f8829a4aSRandall Stewart 					sctp_reset_in_stream(stcb, 0, (uint16_t *) NULL);
2847f8829a4aSRandall Stewart 
2848f8829a4aSRandall Stewart 				}
2849f8829a4aSRandall Stewart 			}
2850f8829a4aSRandall Stewart 			/* get rid of the request and get the request flags */
2851f8829a4aSRandall Stewart 			if (asoc->stream_reset_outstanding == 0) {
2852f8829a4aSRandall Stewart 				sctp_clean_up_stream_reset(stcb);
2853f8829a4aSRandall Stewart 			}
2854f8829a4aSRandall Stewart 		}
2855f8829a4aSRandall Stewart 	}
2856f8829a4aSRandall Stewart 	return (0);
2857f8829a4aSRandall Stewart }
2858f8829a4aSRandall Stewart 
2859f8829a4aSRandall Stewart static void
2860f8829a4aSRandall Stewart sctp_handle_str_reset_request_in(struct sctp_tcb *stcb,
2861f8829a4aSRandall Stewart     struct sctp_tmit_chunk *chk,
2862f8829a4aSRandall Stewart     struct sctp_stream_reset_in_request *req)
2863f8829a4aSRandall Stewart {
2864f8829a4aSRandall Stewart 	uint32_t seq;
2865f8829a4aSRandall Stewart 	int len, i;
2866f8829a4aSRandall Stewart 	int number_entries;
2867f8829a4aSRandall Stewart 	uint16_t temp;
2868f8829a4aSRandall Stewart 
2869f8829a4aSRandall Stewart 	/*
2870f8829a4aSRandall Stewart 	 * peer wants me to send a str-reset to him for my outgoing seq's if
2871f8829a4aSRandall Stewart 	 * seq_in is right.
2872f8829a4aSRandall Stewart 	 */
2873f8829a4aSRandall Stewart 	struct sctp_association *asoc = &stcb->asoc;
2874f8829a4aSRandall Stewart 
2875f8829a4aSRandall Stewart 	seq = ntohl(req->request_seq);
2876f8829a4aSRandall Stewart 	if (asoc->str_reset_seq_in == seq) {
2877f8829a4aSRandall Stewart 		if (stcb->asoc.stream_reset_out_is_outstanding == 0) {
2878f8829a4aSRandall Stewart 			len = ntohs(req->ph.param_length);
2879f8829a4aSRandall Stewart 			number_entries = ((len - sizeof(struct sctp_stream_reset_in_request)) / sizeof(uint16_t));
2880f8829a4aSRandall Stewart 			for (i = 0; i < number_entries; i++) {
2881f8829a4aSRandall Stewart 				temp = ntohs(req->list_of_streams[i]);
2882f8829a4aSRandall Stewart 				req->list_of_streams[i] = temp;
2883f8829a4aSRandall Stewart 			}
2884f8829a4aSRandall Stewart 			/* move the reset action back one */
2885f8829a4aSRandall Stewart 			asoc->last_reset_action[1] = asoc->last_reset_action[0];
2886f8829a4aSRandall Stewart 			asoc->last_reset_action[0] = SCTP_STREAM_RESET_PERFORMED;
2887f8829a4aSRandall Stewart 			sctp_add_stream_reset_out(chk, number_entries, req->list_of_streams,
2888f8829a4aSRandall Stewart 			    asoc->str_reset_seq_out,
2889f8829a4aSRandall Stewart 			    seq, (asoc->sending_seq - 1));
2890f8829a4aSRandall Stewart 			asoc->stream_reset_out_is_outstanding = 1;
2891f8829a4aSRandall Stewart 			asoc->str_reset = chk;
2892f8829a4aSRandall Stewart 			sctp_timer_start(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo);
2893f8829a4aSRandall Stewart 			stcb->asoc.stream_reset_outstanding++;
2894f8829a4aSRandall Stewart 		} else {
2895f8829a4aSRandall Stewart 			/* Can't do it, since we have sent one out */
2896f8829a4aSRandall Stewart 			asoc->last_reset_action[1] = asoc->last_reset_action[0];
2897f8829a4aSRandall Stewart 			asoc->last_reset_action[0] = SCTP_STREAM_RESET_TRY_LATER;
2898f8829a4aSRandall Stewart 			sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
2899f8829a4aSRandall Stewart 		}
2900f8829a4aSRandall Stewart 		asoc->str_reset_seq_in++;
2901f8829a4aSRandall Stewart 	} else if (asoc->str_reset_seq_in - 1 == seq) {
2902f8829a4aSRandall Stewart 		sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
2903f8829a4aSRandall Stewart 	} else if (asoc->str_reset_seq_in - 2 == seq) {
2904f8829a4aSRandall Stewart 		sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]);
2905f8829a4aSRandall Stewart 	} else {
2906f8829a4aSRandall Stewart 		sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_BAD_SEQNO);
2907f8829a4aSRandall Stewart 	}
2908f8829a4aSRandall Stewart }
2909f8829a4aSRandall Stewart 
2910f8829a4aSRandall Stewart static int
2911f8829a4aSRandall Stewart sctp_handle_str_reset_request_tsn(struct sctp_tcb *stcb,
2912f8829a4aSRandall Stewart     struct sctp_tmit_chunk *chk,
2913f8829a4aSRandall Stewart     struct sctp_stream_reset_tsn_request *req)
2914f8829a4aSRandall Stewart {
2915f8829a4aSRandall Stewart 	/* reset all in and out and update the tsn */
2916f8829a4aSRandall Stewart 	/*
2917f8829a4aSRandall Stewart 	 * A) reset my str-seq's on in and out. B) Select a receive next,
2918f8829a4aSRandall Stewart 	 * and set cum-ack to it. Also process this selected number as a
2919f8829a4aSRandall Stewart 	 * fwd-tsn as well. C) set in the response my next sending seq.
2920f8829a4aSRandall Stewart 	 */
2921f8829a4aSRandall Stewart 	struct sctp_forward_tsn_chunk fwdtsn;
2922f8829a4aSRandall Stewart 	struct sctp_association *asoc = &stcb->asoc;
2923f8829a4aSRandall Stewart 	int abort_flag = 0;
2924f8829a4aSRandall Stewart 	uint32_t seq;
2925f8829a4aSRandall Stewart 
2926f8829a4aSRandall Stewart 	seq = ntohl(req->request_seq);
2927f8829a4aSRandall Stewart 	if (asoc->str_reset_seq_in == seq) {
2928f8829a4aSRandall Stewart 		fwdtsn.ch.chunk_length = htons(sizeof(struct sctp_forward_tsn_chunk));
2929f8829a4aSRandall Stewart 		fwdtsn.ch.chunk_type = SCTP_FORWARD_CUM_TSN;
2930f8829a4aSRandall Stewart 		fwdtsn.ch.chunk_flags = 0;
2931f8829a4aSRandall Stewart 		fwdtsn.new_cumulative_tsn = htonl(stcb->asoc.highest_tsn_inside_map + 1);
2932f8829a4aSRandall Stewart 		sctp_handle_forward_tsn(stcb, &fwdtsn, &abort_flag);
2933f8829a4aSRandall Stewart 		if (abort_flag) {
2934f8829a4aSRandall Stewart 			return (1);
2935f8829a4aSRandall Stewart 		}
2936f8829a4aSRandall Stewart 		stcb->asoc.highest_tsn_inside_map += SCTP_STREAM_RESET_TSN_DELTA;
2937f8829a4aSRandall Stewart 		stcb->asoc.cumulative_tsn = stcb->asoc.highest_tsn_inside_map;
2938f8829a4aSRandall Stewart 		stcb->asoc.mapping_array_base_tsn = stcb->asoc.highest_tsn_inside_map + 1;
2939f8829a4aSRandall Stewart 		memset(stcb->asoc.mapping_array, 0, stcb->asoc.mapping_array_size);
2940f8829a4aSRandall Stewart 		atomic_add_int(&stcb->asoc.sending_seq, 1);
2941f8829a4aSRandall Stewart 		/* save off historical data for retrans */
2942f8829a4aSRandall Stewart 		stcb->asoc.last_sending_seq[1] = stcb->asoc.last_sending_seq[0];
2943f8829a4aSRandall Stewart 		stcb->asoc.last_sending_seq[0] = stcb->asoc.sending_seq;
2944f8829a4aSRandall Stewart 		stcb->asoc.last_base_tsnsent[1] = stcb->asoc.last_base_tsnsent[0];
2945f8829a4aSRandall Stewart 		stcb->asoc.last_base_tsnsent[0] = stcb->asoc.mapping_array_base_tsn;
2946f8829a4aSRandall Stewart 
2947f8829a4aSRandall Stewart 		sctp_add_stream_reset_result_tsn(chk,
2948f8829a4aSRandall Stewart 		    ntohl(req->request_seq),
2949f8829a4aSRandall Stewart 		    SCTP_STREAM_RESET_PERFORMED,
2950f8829a4aSRandall Stewart 		    stcb->asoc.sending_seq,
2951f8829a4aSRandall Stewart 		    stcb->asoc.mapping_array_base_tsn);
2952f8829a4aSRandall Stewart 		sctp_reset_out_streams(stcb, 0, (uint16_t *) NULL);
2953f8829a4aSRandall Stewart 		sctp_reset_in_stream(stcb, 0, (uint16_t *) NULL);
2954f8829a4aSRandall Stewart 		stcb->asoc.last_reset_action[1] = stcb->asoc.last_reset_action[0];
2955f8829a4aSRandall Stewart 		stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_PERFORMED;
2956f8829a4aSRandall Stewart 
2957f8829a4aSRandall Stewart 		asoc->str_reset_seq_in++;
2958f8829a4aSRandall Stewart 	} else if (asoc->str_reset_seq_in - 1 == seq) {
2959f8829a4aSRandall Stewart 		sctp_add_stream_reset_result_tsn(chk, seq, asoc->last_reset_action[0],
2960f8829a4aSRandall Stewart 		    stcb->asoc.last_sending_seq[0],
2961f8829a4aSRandall Stewart 		    stcb->asoc.last_base_tsnsent[0]
2962f8829a4aSRandall Stewart 		    );
2963f8829a4aSRandall Stewart 	} else if (asoc->str_reset_seq_in - 2 == seq) {
2964f8829a4aSRandall Stewart 		sctp_add_stream_reset_result_tsn(chk, seq, asoc->last_reset_action[1],
2965f8829a4aSRandall Stewart 		    stcb->asoc.last_sending_seq[1],
2966f8829a4aSRandall Stewart 		    stcb->asoc.last_base_tsnsent[1]
2967f8829a4aSRandall Stewart 		    );
2968f8829a4aSRandall Stewart 	} else {
2969f8829a4aSRandall Stewart 		sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_BAD_SEQNO);
2970f8829a4aSRandall Stewart 	}
2971f8829a4aSRandall Stewart 	return (0);
2972f8829a4aSRandall Stewart }
2973f8829a4aSRandall Stewart 
2974f8829a4aSRandall Stewart static void
2975f8829a4aSRandall Stewart sctp_handle_str_reset_request_out(struct sctp_tcb *stcb,
2976f8829a4aSRandall Stewart     struct sctp_tmit_chunk *chk,
2977f8829a4aSRandall Stewart     struct sctp_stream_reset_out_request *req)
2978f8829a4aSRandall Stewart {
2979f8829a4aSRandall Stewart 	uint32_t seq, tsn;
2980f8829a4aSRandall Stewart 	int number_entries, len;
2981f8829a4aSRandall Stewart 	struct sctp_association *asoc = &stcb->asoc;
2982f8829a4aSRandall Stewart 
2983f8829a4aSRandall Stewart 	seq = ntohl(req->request_seq);
2984f8829a4aSRandall Stewart 
2985f8829a4aSRandall Stewart 	/* now if its not a duplicate we process it */
2986f8829a4aSRandall Stewart 	if (asoc->str_reset_seq_in == seq) {
2987f8829a4aSRandall Stewart 		len = ntohs(req->ph.param_length);
2988f8829a4aSRandall Stewart 		number_entries = ((len - sizeof(struct sctp_stream_reset_out_request)) / sizeof(uint16_t));
2989f8829a4aSRandall Stewart 		/*
2990f8829a4aSRandall Stewart 		 * the sender is resetting, handle the list issue.. we must
2991f8829a4aSRandall Stewart 		 * a) verify if we can do the reset, if so no problem b) If
2992f8829a4aSRandall Stewart 		 * we can't do the reset we must copy the request. c) queue
2993f8829a4aSRandall Stewart 		 * it, and setup the data in processor to trigger it off
2994f8829a4aSRandall Stewart 		 * when needed and dequeue all the queued data.
2995f8829a4aSRandall Stewart 		 */
2996f8829a4aSRandall Stewart 		tsn = ntohl(req->send_reset_at_tsn);
2997f8829a4aSRandall Stewart 
2998f8829a4aSRandall Stewart 		/* move the reset action back one */
2999f8829a4aSRandall Stewart 		asoc->last_reset_action[1] = asoc->last_reset_action[0];
3000f8829a4aSRandall Stewart 		if ((tsn == asoc->cumulative_tsn) ||
3001f8829a4aSRandall Stewart 		    (compare_with_wrap(asoc->cumulative_tsn, tsn, MAX_TSN))) {
3002f8829a4aSRandall Stewart 			/* we can do it now */
3003f8829a4aSRandall Stewart 			sctp_reset_in_stream(stcb, number_entries, req->list_of_streams);
3004f8829a4aSRandall Stewart 			sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_PERFORMED);
3005f8829a4aSRandall Stewart 			asoc->last_reset_action[0] = SCTP_STREAM_RESET_PERFORMED;
3006f8829a4aSRandall Stewart 		} else {
3007f8829a4aSRandall Stewart 			/*
3008f8829a4aSRandall Stewart 			 * we must queue it up and thus wait for the TSN's
3009f8829a4aSRandall Stewart 			 * to arrive that are at or before tsn
3010f8829a4aSRandall Stewart 			 */
3011f8829a4aSRandall Stewart 			struct sctp_stream_reset_list *liste;
3012f8829a4aSRandall Stewart 			int siz;
3013f8829a4aSRandall Stewart 
3014f8829a4aSRandall Stewart 			siz = sizeof(struct sctp_stream_reset_list) + (number_entries * sizeof(uint16_t));
3015f8829a4aSRandall Stewart 			SCTP_MALLOC(liste, struct sctp_stream_reset_list *,
3016207304d4SRandall Stewart 			    siz, SCTP_M_STRESET);
3017f8829a4aSRandall Stewart 			if (liste == NULL) {
3018f8829a4aSRandall Stewart 				/* gak out of memory */
3019f8829a4aSRandall Stewart 				sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_DENIED);
3020f8829a4aSRandall Stewart 				asoc->last_reset_action[0] = SCTP_STREAM_RESET_DENIED;
3021f8829a4aSRandall Stewart 				return;
3022f8829a4aSRandall Stewart 			}
3023f8829a4aSRandall Stewart 			liste->tsn = tsn;
3024f8829a4aSRandall Stewart 			liste->number_entries = number_entries;
3025f8829a4aSRandall Stewart 			memcpy(&liste->req, req,
3026f8829a4aSRandall Stewart 			    (sizeof(struct sctp_stream_reset_out_request) + (number_entries * sizeof(uint16_t))));
3027f8829a4aSRandall Stewart 			TAILQ_INSERT_TAIL(&asoc->resetHead, liste, next_resp);
3028f8829a4aSRandall Stewart 			sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_PERFORMED);
3029f8829a4aSRandall Stewart 			asoc->last_reset_action[0] = SCTP_STREAM_RESET_PERFORMED;
3030f8829a4aSRandall Stewart 		}
3031f8829a4aSRandall Stewart 		asoc->str_reset_seq_in++;
3032f8829a4aSRandall Stewart 	} else if ((asoc->str_reset_seq_in - 1) == seq) {
3033f8829a4aSRandall Stewart 		/*
3034f8829a4aSRandall Stewart 		 * one seq back, just echo back last action since my
3035f8829a4aSRandall Stewart 		 * response was lost.
3036f8829a4aSRandall Stewart 		 */
3037f8829a4aSRandall Stewart 		sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
3038f8829a4aSRandall Stewart 	} else if ((asoc->str_reset_seq_in - 2) == seq) {
3039f8829a4aSRandall Stewart 		/*
3040f8829a4aSRandall Stewart 		 * two seq back, just echo back last action since my
3041f8829a4aSRandall Stewart 		 * response was lost.
3042f8829a4aSRandall Stewart 		 */
3043f8829a4aSRandall Stewart 		sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]);
3044f8829a4aSRandall Stewart 	} else {
3045f8829a4aSRandall Stewart 		sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_BAD_SEQNO);
3046f8829a4aSRandall Stewart 	}
3047f8829a4aSRandall Stewart }
3048f8829a4aSRandall Stewart 
3049f8829a4aSRandall Stewart static int
3050f8829a4aSRandall Stewart sctp_handle_stream_reset(struct sctp_tcb *stcb, struct sctp_stream_reset_out_req *sr_req)
3051f8829a4aSRandall Stewart {
3052f8829a4aSRandall Stewart 	int chk_length, param_len, ptype;
3053f8829a4aSRandall Stewart 	uint32_t seq;
3054f8829a4aSRandall Stewart 	int num_req = 0;
3055f8829a4aSRandall Stewart 	struct sctp_tmit_chunk *chk;
3056f8829a4aSRandall Stewart 	struct sctp_chunkhdr *ch;
3057f8829a4aSRandall Stewart 	struct sctp_paramhdr *ph;
3058f42a358aSRandall Stewart 	int ret_code = 0;
3059f42a358aSRandall Stewart 	int num_param = 0;
3060f8829a4aSRandall Stewart 
3061f8829a4aSRandall Stewart 	/* now it may be a reset or a reset-response */
3062f8829a4aSRandall Stewart 	chk_length = ntohs(sr_req->ch.chunk_length);
3063f8829a4aSRandall Stewart 
3064f8829a4aSRandall Stewart 	/* setup for adding the response */
3065f8829a4aSRandall Stewart 	sctp_alloc_a_chunk(stcb, chk);
3066f8829a4aSRandall Stewart 	if (chk == NULL) {
3067f8829a4aSRandall Stewart 		return (ret_code);
3068f8829a4aSRandall Stewart 	}
3069f8829a4aSRandall Stewart 	chk->rec.chunk_id.id = SCTP_STREAM_RESET;
3070d06c82f1SRandall Stewart 	chk->rec.chunk_id.can_take_data = 0;
3071f8829a4aSRandall Stewart 	chk->asoc = &stcb->asoc;
3072f8829a4aSRandall Stewart 	chk->no_fr_allowed = 0;
3073f8829a4aSRandall Stewart 	chk->book_size = chk->send_size = sizeof(struct sctp_chunkhdr);
307444b7479bSRandall Stewart 	chk->book_size_scale = 0;
3075139bc87fSRandall Stewart 	chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA);
3076f8829a4aSRandall Stewart 	if (chk->data == NULL) {
3077f8829a4aSRandall Stewart strres_nochunk:
3078f8829a4aSRandall Stewart 		if (chk->data) {
3079f8829a4aSRandall Stewart 			sctp_m_freem(chk->data);
3080f8829a4aSRandall Stewart 			chk->data = NULL;
3081f8829a4aSRandall Stewart 		}
3082f8829a4aSRandall Stewart 		sctp_free_a_chunk(stcb, chk);
3083f8829a4aSRandall Stewart 		return (ret_code);
3084f8829a4aSRandall Stewart 	}
3085139bc87fSRandall Stewart 	SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD);
3086f8829a4aSRandall Stewart 
3087f8829a4aSRandall Stewart 	/* setup chunk parameters */
3088f8829a4aSRandall Stewart 	chk->sent = SCTP_DATAGRAM_UNSENT;
3089f8829a4aSRandall Stewart 	chk->snd_count = 0;
3090f8829a4aSRandall Stewart 	chk->whoTo = stcb->asoc.primary_destination;
3091f8829a4aSRandall Stewart 	atomic_add_int(&chk->whoTo->ref_count, 1);
3092f8829a4aSRandall Stewart 
3093f8829a4aSRandall Stewart 	ch = mtod(chk->data, struct sctp_chunkhdr *);
3094f8829a4aSRandall Stewart 	ch->chunk_type = SCTP_STREAM_RESET;
3095f8829a4aSRandall Stewart 	ch->chunk_flags = 0;
3096f8829a4aSRandall Stewart 	ch->chunk_length = htons(chk->send_size);
3097139bc87fSRandall Stewart 	SCTP_BUF_LEN(chk->data) = SCTP_SIZE32(chk->send_size);
3098f8829a4aSRandall Stewart 	ph = (struct sctp_paramhdr *)&sr_req->sr_req;
3099f8829a4aSRandall Stewart 	while ((size_t)chk_length >= sizeof(struct sctp_stream_reset_tsn_request)) {
3100f8829a4aSRandall Stewart 		param_len = ntohs(ph->param_length);
3101f8829a4aSRandall Stewart 		if (param_len < (int)sizeof(struct sctp_stream_reset_tsn_request)) {
3102f8829a4aSRandall Stewart 			/* bad param */
3103f8829a4aSRandall Stewart 			break;
3104f8829a4aSRandall Stewart 		}
3105f8829a4aSRandall Stewart 		ptype = ntohs(ph->param_type);
3106f8829a4aSRandall Stewart 		num_param++;
3107f8829a4aSRandall Stewart 		if (num_param > SCTP_MAX_RESET_PARAMS) {
3108f8829a4aSRandall Stewart 			/* hit the max of parameters already sorry.. */
3109f8829a4aSRandall Stewart 			break;
3110f8829a4aSRandall Stewart 		}
3111f8829a4aSRandall Stewart 		if (ptype == SCTP_STR_RESET_OUT_REQUEST) {
3112f8829a4aSRandall Stewart 			struct sctp_stream_reset_out_request *req_out;
3113f8829a4aSRandall Stewart 
3114f8829a4aSRandall Stewart 			req_out = (struct sctp_stream_reset_out_request *)ph;
3115f8829a4aSRandall Stewart 			num_req++;
3116f8829a4aSRandall Stewart 			if (stcb->asoc.stream_reset_outstanding) {
3117f8829a4aSRandall Stewart 				seq = ntohl(req_out->response_seq);
3118f8829a4aSRandall Stewart 				if (seq == stcb->asoc.str_reset_seq_out) {
3119f8829a4aSRandall Stewart 					/* implicit ack */
3120ad81507eSRandall Stewart 					(void)sctp_handle_stream_reset_response(stcb, seq, SCTP_STREAM_RESET_PERFORMED, NULL);
3121f8829a4aSRandall Stewart 				}
3122f8829a4aSRandall Stewart 			}
3123f8829a4aSRandall Stewart 			sctp_handle_str_reset_request_out(stcb, chk, req_out);
3124f8829a4aSRandall Stewart 		} else if (ptype == SCTP_STR_RESET_IN_REQUEST) {
3125f8829a4aSRandall Stewart 			struct sctp_stream_reset_in_request *req_in;
3126f8829a4aSRandall Stewart 
3127f8829a4aSRandall Stewart 			num_req++;
3128f8829a4aSRandall Stewart 			req_in = (struct sctp_stream_reset_in_request *)ph;
3129f8829a4aSRandall Stewart 			sctp_handle_str_reset_request_in(stcb, chk, req_in);
3130f8829a4aSRandall Stewart 		} else if (ptype == SCTP_STR_RESET_TSN_REQUEST) {
3131f8829a4aSRandall Stewart 			struct sctp_stream_reset_tsn_request *req_tsn;
3132f8829a4aSRandall Stewart 
3133f8829a4aSRandall Stewart 			num_req++;
3134f8829a4aSRandall Stewart 			req_tsn = (struct sctp_stream_reset_tsn_request *)ph;
3135f8829a4aSRandall Stewart 			if (sctp_handle_str_reset_request_tsn(stcb, chk, req_tsn)) {
3136f8829a4aSRandall Stewart 				ret_code = 1;
3137f8829a4aSRandall Stewart 				goto strres_nochunk;
3138f8829a4aSRandall Stewart 			}
3139f8829a4aSRandall Stewart 			/* no more */
3140f8829a4aSRandall Stewart 			break;
3141f8829a4aSRandall Stewart 		} else if (ptype == SCTP_STR_RESET_RESPONSE) {
3142f8829a4aSRandall Stewart 			struct sctp_stream_reset_response *resp;
3143f8829a4aSRandall Stewart 			uint32_t result;
3144f8829a4aSRandall Stewart 
3145f8829a4aSRandall Stewart 			resp = (struct sctp_stream_reset_response *)ph;
3146f8829a4aSRandall Stewart 			seq = ntohl(resp->response_seq);
3147f8829a4aSRandall Stewart 			result = ntohl(resp->result);
3148f8829a4aSRandall Stewart 			if (sctp_handle_stream_reset_response(stcb, seq, result, resp)) {
3149f8829a4aSRandall Stewart 				ret_code = 1;
3150f8829a4aSRandall Stewart 				goto strres_nochunk;
3151f8829a4aSRandall Stewart 			}
3152f8829a4aSRandall Stewart 		} else {
3153f8829a4aSRandall Stewart 			break;
3154f8829a4aSRandall Stewart 		}
3155f8829a4aSRandall Stewart 
3156f8829a4aSRandall Stewart 		ph = (struct sctp_paramhdr *)((caddr_t)ph + SCTP_SIZE32(param_len));
3157f8829a4aSRandall Stewart 		chk_length -= SCTP_SIZE32(param_len);
3158f8829a4aSRandall Stewart 	}
3159f8829a4aSRandall Stewart 	if (num_req == 0) {
3160f8829a4aSRandall Stewart 		/* we have no response free the stuff */
3161f8829a4aSRandall Stewart 		goto strres_nochunk;
3162f8829a4aSRandall Stewart 	}
3163f8829a4aSRandall Stewart 	/* ok we have a chunk to link in */
3164f8829a4aSRandall Stewart 	TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue,
3165f8829a4aSRandall Stewart 	    chk,
3166f8829a4aSRandall Stewart 	    sctp_next);
3167f8829a4aSRandall Stewart 	stcb->asoc.ctrl_queue_cnt++;
3168f8829a4aSRandall Stewart 	return (ret_code);
3169f8829a4aSRandall Stewart }
3170f8829a4aSRandall Stewart 
3171f8829a4aSRandall Stewart /*
3172f8829a4aSRandall Stewart  * Handle a router or endpoints report of a packet loss, there are two ways
3173f8829a4aSRandall Stewart  * to handle this, either we get the whole packet and must disect it
3174f8829a4aSRandall Stewart  * ourselves (possibly with truncation and or corruption) or it is a summary
3175f8829a4aSRandall Stewart  * from a middle box that did the disectting for us.
3176f8829a4aSRandall Stewart  */
3177f8829a4aSRandall Stewart static void
3178f8829a4aSRandall Stewart sctp_handle_packet_dropped(struct sctp_pktdrop_chunk *cp,
3179f8829a4aSRandall Stewart     struct sctp_tcb *stcb, struct sctp_nets *net)
3180f8829a4aSRandall Stewart {
3181f8829a4aSRandall Stewart 	uint32_t bottle_bw, on_queue;
3182f8829a4aSRandall Stewart 	uint16_t trunc_len;
3183f8829a4aSRandall Stewart 	unsigned int chlen;
3184f8829a4aSRandall Stewart 	unsigned int at;
3185f8829a4aSRandall Stewart 	struct sctp_chunk_desc desc;
3186f8829a4aSRandall Stewart 	struct sctp_chunkhdr *ch;
3187f8829a4aSRandall Stewart 
3188f8829a4aSRandall Stewart 	chlen = ntohs(cp->ch.chunk_length);
3189f8829a4aSRandall Stewart 	chlen -= sizeof(struct sctp_pktdrop_chunk);
3190f8829a4aSRandall Stewart 	/* XXX possible chlen underflow */
3191f8829a4aSRandall Stewart 	if (chlen == 0) {
3192f8829a4aSRandall Stewart 		ch = NULL;
3193f8829a4aSRandall Stewart 		if (cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX)
3194f8829a4aSRandall Stewart 			SCTP_STAT_INCR(sctps_pdrpbwrpt);
3195f8829a4aSRandall Stewart 	} else {
3196f8829a4aSRandall Stewart 		ch = (struct sctp_chunkhdr *)(cp->data + sizeof(struct sctphdr));
3197f8829a4aSRandall Stewart 		chlen -= sizeof(struct sctphdr);
3198f8829a4aSRandall Stewart 		/* XXX possible chlen underflow */
3199f8829a4aSRandall Stewart 		memset(&desc, 0, sizeof(desc));
3200f8829a4aSRandall Stewart 	}
3201f8829a4aSRandall Stewart 	trunc_len = (uint16_t) ntohs(cp->trunc_len);
3202f8829a4aSRandall Stewart 	/* now the chunks themselves */
3203f8829a4aSRandall Stewart 	while ((ch != NULL) && (chlen >= sizeof(struct sctp_chunkhdr))) {
3204f8829a4aSRandall Stewart 		desc.chunk_type = ch->chunk_type;
3205f8829a4aSRandall Stewart 		/* get amount we need to move */
3206f8829a4aSRandall Stewart 		at = ntohs(ch->chunk_length);
3207f8829a4aSRandall Stewart 		if (at < sizeof(struct sctp_chunkhdr)) {
3208f8829a4aSRandall Stewart 			/* corrupt chunk, maybe at the end? */
3209f8829a4aSRandall Stewart 			SCTP_STAT_INCR(sctps_pdrpcrupt);
3210f8829a4aSRandall Stewart 			break;
3211f8829a4aSRandall Stewart 		}
3212f8829a4aSRandall Stewart 		if (trunc_len == 0) {
3213f8829a4aSRandall Stewart 			/* we are supposed to have all of it */
3214f8829a4aSRandall Stewart 			if (at > chlen) {
3215f8829a4aSRandall Stewart 				/* corrupt skip it */
3216f8829a4aSRandall Stewart 				SCTP_STAT_INCR(sctps_pdrpcrupt);
3217f8829a4aSRandall Stewart 				break;
3218f8829a4aSRandall Stewart 			}
3219f8829a4aSRandall Stewart 		} else {
3220f8829a4aSRandall Stewart 			/* is there enough of it left ? */
3221f8829a4aSRandall Stewart 			if (desc.chunk_type == SCTP_DATA) {
3222f8829a4aSRandall Stewart 				if (chlen < (sizeof(struct sctp_data_chunk) +
3223f8829a4aSRandall Stewart 				    sizeof(desc.data_bytes))) {
3224f8829a4aSRandall Stewart 					break;
3225f8829a4aSRandall Stewart 				}
3226f8829a4aSRandall Stewart 			} else {
3227f8829a4aSRandall Stewart 				if (chlen < sizeof(struct sctp_chunkhdr)) {
3228f8829a4aSRandall Stewart 					break;
3229f8829a4aSRandall Stewart 				}
3230f8829a4aSRandall Stewart 			}
3231f8829a4aSRandall Stewart 		}
3232f8829a4aSRandall Stewart 		if (desc.chunk_type == SCTP_DATA) {
3233f8829a4aSRandall Stewart 			/* can we get out the tsn? */
3234f8829a4aSRandall Stewart 			if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX))
3235f8829a4aSRandall Stewart 				SCTP_STAT_INCR(sctps_pdrpmbda);
3236f8829a4aSRandall Stewart 
3237f8829a4aSRandall Stewart 			if (chlen >= (sizeof(struct sctp_data_chunk) + sizeof(uint32_t))) {
3238f8829a4aSRandall Stewart 				/* yep */
3239f8829a4aSRandall Stewart 				struct sctp_data_chunk *dcp;
3240f8829a4aSRandall Stewart 				uint8_t *ddp;
3241f8829a4aSRandall Stewart 				unsigned int iii;
3242f8829a4aSRandall Stewart 
3243f8829a4aSRandall Stewart 				dcp = (struct sctp_data_chunk *)ch;
3244f8829a4aSRandall Stewart 				ddp = (uint8_t *) (dcp + 1);
3245f8829a4aSRandall Stewart 				for (iii = 0; iii < sizeof(desc.data_bytes); iii++) {
3246f8829a4aSRandall Stewart 					desc.data_bytes[iii] = ddp[iii];
3247f8829a4aSRandall Stewart 				}
3248f8829a4aSRandall Stewart 				desc.tsn_ifany = dcp->dp.tsn;
3249f8829a4aSRandall Stewart 			} else {
3250f8829a4aSRandall Stewart 				/* nope we are done. */
3251f8829a4aSRandall Stewart 				SCTP_STAT_INCR(sctps_pdrpnedat);
3252f8829a4aSRandall Stewart 				break;
3253f8829a4aSRandall Stewart 			}
3254f8829a4aSRandall Stewart 		} else {
3255f8829a4aSRandall Stewart 			if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX))
3256f8829a4aSRandall Stewart 				SCTP_STAT_INCR(sctps_pdrpmbct);
3257f8829a4aSRandall Stewart 		}
3258f8829a4aSRandall Stewart 
3259f8829a4aSRandall Stewart 		if (process_chunk_drop(stcb, &desc, net, cp->ch.chunk_flags)) {
3260f8829a4aSRandall Stewart 			SCTP_STAT_INCR(sctps_pdrppdbrk);
3261f8829a4aSRandall Stewart 			break;
3262f8829a4aSRandall Stewart 		}
3263f8829a4aSRandall Stewart 		if (SCTP_SIZE32(at) > chlen) {
3264f8829a4aSRandall Stewart 			break;
3265f8829a4aSRandall Stewart 		}
3266f8829a4aSRandall Stewart 		chlen -= SCTP_SIZE32(at);
3267f8829a4aSRandall Stewart 		if (chlen < sizeof(struct sctp_chunkhdr)) {
3268f8829a4aSRandall Stewart 			/* done, none left */
3269f8829a4aSRandall Stewart 			break;
3270f8829a4aSRandall Stewart 		}
3271f8829a4aSRandall Stewart 		ch = (struct sctp_chunkhdr *)((caddr_t)ch + SCTP_SIZE32(at));
3272f8829a4aSRandall Stewart 	}
3273f8829a4aSRandall Stewart 	/* Now update any rwnd --- possibly */
3274f8829a4aSRandall Stewart 	if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX) == 0) {
3275f8829a4aSRandall Stewart 		/* From a peer, we get a rwnd report */
3276f8829a4aSRandall Stewart 		uint32_t a_rwnd;
3277f8829a4aSRandall Stewart 
3278f8829a4aSRandall Stewart 		SCTP_STAT_INCR(sctps_pdrpfehos);
3279f8829a4aSRandall Stewart 
3280f8829a4aSRandall Stewart 		bottle_bw = ntohl(cp->bottle_bw);
3281f8829a4aSRandall Stewart 		on_queue = ntohl(cp->current_onq);
3282f8829a4aSRandall Stewart 		if (bottle_bw && on_queue) {
3283f8829a4aSRandall Stewart 			/* a rwnd report is in here */
3284f8829a4aSRandall Stewart 			if (bottle_bw > on_queue)
3285f8829a4aSRandall Stewart 				a_rwnd = bottle_bw - on_queue;
3286f8829a4aSRandall Stewart 			else
3287f8829a4aSRandall Stewart 				a_rwnd = 0;
3288f8829a4aSRandall Stewart 
3289f8829a4aSRandall Stewart 			if (a_rwnd == 0)
3290f8829a4aSRandall Stewart 				stcb->asoc.peers_rwnd = 0;
3291f8829a4aSRandall Stewart 			else {
3292f8829a4aSRandall Stewart 				if (a_rwnd > stcb->asoc.total_flight) {
3293f8829a4aSRandall Stewart 					stcb->asoc.peers_rwnd =
3294f8829a4aSRandall Stewart 					    a_rwnd - stcb->asoc.total_flight;
3295f8829a4aSRandall Stewart 				} else {
3296f8829a4aSRandall Stewart 					stcb->asoc.peers_rwnd = 0;
3297f8829a4aSRandall Stewart 				}
3298f8829a4aSRandall Stewart 				if (stcb->asoc.peers_rwnd <
3299f8829a4aSRandall Stewart 				    stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
3300f8829a4aSRandall Stewart 					/* SWS sender side engages */
3301f8829a4aSRandall Stewart 					stcb->asoc.peers_rwnd = 0;
3302f8829a4aSRandall Stewart 				}
3303f8829a4aSRandall Stewart 			}
3304f8829a4aSRandall Stewart 		}
3305f8829a4aSRandall Stewart 	} else {
3306f8829a4aSRandall Stewart 		SCTP_STAT_INCR(sctps_pdrpfmbox);
3307f8829a4aSRandall Stewart 	}
3308f8829a4aSRandall Stewart 
3309f8829a4aSRandall Stewart 	/* now middle boxes in sat networks get a cwnd bump */
3310f8829a4aSRandall Stewart 	if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX) &&
3311f8829a4aSRandall Stewart 	    (stcb->asoc.sat_t3_loss_recovery == 0) &&
3312f8829a4aSRandall Stewart 	    (stcb->asoc.sat_network)) {
3313f8829a4aSRandall Stewart 		/*
3314f8829a4aSRandall Stewart 		 * This is debateable but for sat networks it makes sense
3315f8829a4aSRandall Stewart 		 * Note if a T3 timer has went off, we will prohibit any
3316f8829a4aSRandall Stewart 		 * changes to cwnd until we exit the t3 loss recovery.
3317f8829a4aSRandall Stewart 		 */
3318f8829a4aSRandall Stewart 		uint32_t bw_avail;
3319f8829a4aSRandall Stewart 		int rtt, incr;
3320f8829a4aSRandall Stewart 
3321f8829a4aSRandall Stewart #ifdef SCTP_CWND_MONITOR
3322f8829a4aSRandall Stewart 		int old_cwnd = net->cwnd;
3323f8829a4aSRandall Stewart 
3324f8829a4aSRandall Stewart #endif
3325f8829a4aSRandall Stewart 		/* need real RTT for this calc */
3326f8829a4aSRandall Stewart 		rtt = ((net->lastsa >> 2) + net->lastsv) >> 1;
3327f8829a4aSRandall Stewart 		/* get bottle neck bw */
3328f8829a4aSRandall Stewart 		bottle_bw = ntohl(cp->bottle_bw);
3329f8829a4aSRandall Stewart 		/* and whats on queue */
3330f8829a4aSRandall Stewart 		on_queue = ntohl(cp->current_onq);
3331f8829a4aSRandall Stewart 		/*
3332f8829a4aSRandall Stewart 		 * adjust the on-queue if our flight is more it could be
3333f8829a4aSRandall Stewart 		 * that the router has not yet gotten data "in-flight" to it
3334f8829a4aSRandall Stewart 		 */
3335f8829a4aSRandall Stewart 		if (on_queue < net->flight_size)
3336f8829a4aSRandall Stewart 			on_queue = net->flight_size;
3337f8829a4aSRandall Stewart 
3338f8829a4aSRandall Stewart 		/* calculate the available space */
3339f8829a4aSRandall Stewart 		bw_avail = (bottle_bw * rtt) / 1000;
3340f8829a4aSRandall Stewart 		if (bw_avail > bottle_bw) {
3341f8829a4aSRandall Stewart 			/*
3342f8829a4aSRandall Stewart 			 * Cap the growth to no more than the bottle neck.
3343f8829a4aSRandall Stewart 			 * This can happen as RTT slides up due to queues.
3344f8829a4aSRandall Stewart 			 * It also means if you have more than a 1 second
3345f8829a4aSRandall Stewart 			 * RTT with a empty queue you will be limited to the
3346f8829a4aSRandall Stewart 			 * bottle_bw per second no matter if other points
3347f8829a4aSRandall Stewart 			 * have 1/2 the RTT and you could get more out...
3348f8829a4aSRandall Stewart 			 */
3349f8829a4aSRandall Stewart 			bw_avail = bottle_bw;
3350f8829a4aSRandall Stewart 		}
3351f8829a4aSRandall Stewart 		if (on_queue > bw_avail) {
3352f8829a4aSRandall Stewart 			/*
3353f8829a4aSRandall Stewart 			 * No room for anything else don't allow anything
3354f8829a4aSRandall Stewart 			 * else to be "added to the fire".
3355f8829a4aSRandall Stewart 			 */
3356f8829a4aSRandall Stewart 			int seg_inflight, seg_onqueue, my_portion;
3357f8829a4aSRandall Stewart 
3358f8829a4aSRandall Stewart 			net->partial_bytes_acked = 0;
3359f8829a4aSRandall Stewart 
3360f8829a4aSRandall Stewart 			/* how much are we over queue size? */
3361f8829a4aSRandall Stewart 			incr = on_queue - bw_avail;
3362f8829a4aSRandall Stewart 			if (stcb->asoc.seen_a_sack_this_pkt) {
3363f8829a4aSRandall Stewart 				/*
3364f8829a4aSRandall Stewart 				 * undo any cwnd adjustment that the sack
3365f8829a4aSRandall Stewart 				 * might have made
3366f8829a4aSRandall Stewart 				 */
3367f8829a4aSRandall Stewart 				net->cwnd = net->prev_cwnd;
3368f8829a4aSRandall Stewart 			}
3369f8829a4aSRandall Stewart 			/* Now how much of that is mine? */
3370f8829a4aSRandall Stewart 			seg_inflight = net->flight_size / net->mtu;
3371f8829a4aSRandall Stewart 			seg_onqueue = on_queue / net->mtu;
3372f8829a4aSRandall Stewart 			my_portion = (incr * seg_inflight) / seg_onqueue;
3373f8829a4aSRandall Stewart 
3374f8829a4aSRandall Stewart 			/* Have I made an adjustment already */
3375f8829a4aSRandall Stewart 			if (net->cwnd > net->flight_size) {
3376f8829a4aSRandall Stewart 				/*
3377f8829a4aSRandall Stewart 				 * for this flight I made an adjustment we
3378f8829a4aSRandall Stewart 				 * need to decrease the portion by a share
3379f8829a4aSRandall Stewart 				 * our previous adjustment.
3380f8829a4aSRandall Stewart 				 */
3381f8829a4aSRandall Stewart 				int diff_adj;
3382f8829a4aSRandall Stewart 
3383f8829a4aSRandall Stewart 				diff_adj = net->cwnd - net->flight_size;
3384f8829a4aSRandall Stewart 				if (diff_adj > my_portion)
3385f8829a4aSRandall Stewart 					my_portion = 0;
3386f8829a4aSRandall Stewart 				else
3387f8829a4aSRandall Stewart 					my_portion -= diff_adj;
3388f8829a4aSRandall Stewart 			}
3389f8829a4aSRandall Stewart 			/*
3390f8829a4aSRandall Stewart 			 * back down to the previous cwnd (assume we have
3391f8829a4aSRandall Stewart 			 * had a sack before this packet). minus what ever
3392f8829a4aSRandall Stewart 			 * portion of the overage is my fault.
3393f8829a4aSRandall Stewart 			 */
3394f8829a4aSRandall Stewart 			net->cwnd -= my_portion;
3395f8829a4aSRandall Stewart 
3396f8829a4aSRandall Stewart 			/* we will NOT back down more than 1 MTU */
3397f8829a4aSRandall Stewart 			if (net->cwnd <= net->mtu) {
3398f8829a4aSRandall Stewart 				net->cwnd = net->mtu;
3399f8829a4aSRandall Stewart 			}
3400f8829a4aSRandall Stewart 			/* force into CA */
3401f8829a4aSRandall Stewart 			net->ssthresh = net->cwnd - 1;
3402f8829a4aSRandall Stewart 		} else {
3403f8829a4aSRandall Stewart 			/*
3404f8829a4aSRandall Stewart 			 * Take 1/4 of the space left or max burst up ..
3405f8829a4aSRandall Stewart 			 * whichever is less.
3406f8829a4aSRandall Stewart 			 */
3407f8829a4aSRandall Stewart 			incr = min((bw_avail - on_queue) >> 2,
3408f8829a4aSRandall Stewart 			    (int)stcb->asoc.max_burst * (int)net->mtu);
3409f8829a4aSRandall Stewart 			net->cwnd += incr;
3410f8829a4aSRandall Stewart 		}
3411f8829a4aSRandall Stewart 		if (net->cwnd > bw_avail) {
3412f8829a4aSRandall Stewart 			/* We can't exceed the pipe size */
3413f8829a4aSRandall Stewart 			net->cwnd = bw_avail;
3414f8829a4aSRandall Stewart 		}
3415f8829a4aSRandall Stewart 		if (net->cwnd < net->mtu) {
3416f8829a4aSRandall Stewart 			/* We always have 1 MTU */
3417f8829a4aSRandall Stewart 			net->cwnd = net->mtu;
3418f8829a4aSRandall Stewart 		}
3419f8829a4aSRandall Stewart #ifdef SCTP_CWND_MONITOR
3420f8829a4aSRandall Stewart 		if (net->cwnd - old_cwnd != 0) {
3421f8829a4aSRandall Stewart 			/* log only changes */
3422f8829a4aSRandall Stewart 			sctp_log_cwnd(stcb, net, (net->cwnd - old_cwnd),
3423f8829a4aSRandall Stewart 			    SCTP_CWND_LOG_FROM_SAT);
3424f8829a4aSRandall Stewart 		}
3425f8829a4aSRandall Stewart #endif
3426f8829a4aSRandall Stewart 	}
3427f8829a4aSRandall Stewart }
3428f8829a4aSRandall Stewart 
3429f8829a4aSRandall Stewart /*
3430f8829a4aSRandall Stewart  * handles all control chunks in a packet inputs: - m: mbuf chain, assumed to
3431f8829a4aSRandall Stewart  * still contain IP/SCTP header - stcb: is the tcb found for this packet -
3432f8829a4aSRandall Stewart  * offset: offset into the mbuf chain to first chunkhdr - length: is the
3433f8829a4aSRandall Stewart  * length of the complete packet outputs: - length: modified to remaining
3434f8829a4aSRandall Stewart  * length after control processing - netp: modified to new sctp_nets after
3435f8829a4aSRandall Stewart  * cookie-echo processing - return NULL to discard the packet (ie. no asoc,
3436f8829a4aSRandall Stewart  * bad packet,...) otherwise return the tcb for this packet
3437f8829a4aSRandall Stewart  */
34383c6f3536SRandall Stewart #ifdef __GNUC__
34393c6f3536SRandall Stewart __attribute__((noinline))
34403c6f3536SRandall Stewart #endif
3441f8829a4aSRandall Stewart 	static struct sctp_tcb *
3442f8829a4aSRandall Stewart 	         sctp_process_control(struct mbuf *m, int iphlen, int *offset, int length,
3443f8829a4aSRandall Stewart              struct sctphdr *sh, struct sctp_chunkhdr *ch, struct sctp_inpcb *inp,
344417205eccSRandall Stewart              struct sctp_tcb *stcb, struct sctp_nets **netp, int *fwd_tsn_seen,
344517205eccSRandall Stewart              uint32_t vrf_id, uint32_t table_id)
3446f8829a4aSRandall Stewart {
3447f8829a4aSRandall Stewart 	struct sctp_association *asoc;
3448f8829a4aSRandall Stewart 	uint32_t vtag_in;
3449f8829a4aSRandall Stewart 	int num_chunks = 0;	/* number of control chunks processed */
3450f8829a4aSRandall Stewart 	int chk_length;
3451f8829a4aSRandall Stewart 	int ret;
3452bff64a4dSRandall Stewart 	int abort_no_unlock = 0;
3453f8829a4aSRandall Stewart 
3454f8829a4aSRandall Stewart 	/*
3455f8829a4aSRandall Stewart 	 * How big should this be, and should it be alloc'd? Lets try the
3456f8829a4aSRandall Stewart 	 * d-mtu-ceiling for now (2k) and that should hopefully work ...
3457f8829a4aSRandall Stewart 	 * until we get into jumbo grams and such..
3458f8829a4aSRandall Stewart 	 */
3459f42a358aSRandall Stewart 	uint8_t chunk_buf[SCTP_CHUNK_BUFFER_SIZE];
3460f8829a4aSRandall Stewart 	struct sctp_tcb *locked_tcb = stcb;
3461f8829a4aSRandall Stewart 	int got_auth = 0;
3462f8829a4aSRandall Stewart 	uint32_t auth_offset = 0, auth_len = 0;
3463f8829a4aSRandall Stewart 	int auth_skipped = 0;
3464f8829a4aSRandall Stewart 
3465ad81507eSRandall Stewart 	SCTPDBG(SCTP_DEBUG_INPUT1, "sctp_process_control: iphlen=%u, offset=%u, length=%u stcb:%p\n",
3466f8829a4aSRandall Stewart 	    iphlen, *offset, length, stcb);
3467f8829a4aSRandall Stewart 
3468f8829a4aSRandall Stewart 	/* validate chunk header length... */
3469f8829a4aSRandall Stewart 	if (ntohs(ch->chunk_length) < sizeof(*ch)) {
3470d61a0ae0SRandall Stewart 		SCTPDBG(SCTP_DEBUG_INPUT1, "Invalid header length %d\n",
3471d61a0ae0SRandall Stewart 		    ntohs(ch->chunk_length));
3472207304d4SRandall Stewart 		if (locked_tcb) {
3473207304d4SRandall Stewart 			SCTP_TCB_UNLOCK(locked_tcb);
3474207304d4SRandall Stewart 		}
3475f8829a4aSRandall Stewart 		return (NULL);
3476f8829a4aSRandall Stewart 	}
3477f8829a4aSRandall Stewart 	/*
3478f8829a4aSRandall Stewart 	 * validate the verification tag
3479f8829a4aSRandall Stewart 	 */
3480f8829a4aSRandall Stewart 	vtag_in = ntohl(sh->v_tag);
3481f8829a4aSRandall Stewart 
3482a5d547adSRandall Stewart 	if (locked_tcb) {
3483a5d547adSRandall Stewart 		SCTP_TCB_LOCK_ASSERT(locked_tcb);
3484a5d547adSRandall Stewart 	}
3485f8829a4aSRandall Stewart 	if (ch->chunk_type == SCTP_INITIATION) {
3486d61a0ae0SRandall Stewart 		SCTPDBG(SCTP_DEBUG_INPUT1, "Its an INIT of len:%d vtag:%x\n",
3487d61a0ae0SRandall Stewart 		    ntohs(ch->chunk_length), vtag_in);
3488f8829a4aSRandall Stewart 		if (vtag_in != 0) {
3489f8829a4aSRandall Stewart 			/* protocol error- silently discard... */
3490f8829a4aSRandall Stewart 			SCTP_STAT_INCR(sctps_badvtag);
34916e55db54SRandall Stewart 			if (locked_tcb) {
3492f8829a4aSRandall Stewart 				SCTP_TCB_UNLOCK(locked_tcb);
34936e55db54SRandall Stewart 			}
3494f8829a4aSRandall Stewart 			return (NULL);
3495f8829a4aSRandall Stewart 		}
3496f8829a4aSRandall Stewart 	} else if (ch->chunk_type != SCTP_COOKIE_ECHO) {
3497f8829a4aSRandall Stewart 		/*
3498f8829a4aSRandall Stewart 		 * If there is no stcb, skip the AUTH chunk and process
3499f8829a4aSRandall Stewart 		 * later after a stcb is found (to validate the lookup was
3500f8829a4aSRandall Stewart 		 * valid.
3501f8829a4aSRandall Stewart 		 */
3502f8829a4aSRandall Stewart 		if ((ch->chunk_type == SCTP_AUTHENTICATION) &&
3503f8829a4aSRandall Stewart 		    (stcb == NULL) && !sctp_auth_disable) {
3504f8829a4aSRandall Stewart 			/* save this chunk for later processing */
3505f8829a4aSRandall Stewart 			auth_skipped = 1;
3506f8829a4aSRandall Stewart 			auth_offset = *offset;
3507f8829a4aSRandall Stewart 			auth_len = ntohs(ch->chunk_length);
3508f8829a4aSRandall Stewart 
3509f8829a4aSRandall Stewart 			/* (temporarily) move past this chunk */
3510f8829a4aSRandall Stewart 			*offset += SCTP_SIZE32(auth_len);
3511f8829a4aSRandall Stewart 			if (*offset >= length) {
3512f8829a4aSRandall Stewart 				/* no more data left in the mbuf chain */
3513f8829a4aSRandall Stewart 				*offset = length;
3514207304d4SRandall Stewart 				if (locked_tcb) {
3515207304d4SRandall Stewart 					SCTP_TCB_UNLOCK(locked_tcb);
3516207304d4SRandall Stewart 				}
3517f8829a4aSRandall Stewart 				return (NULL);
3518f8829a4aSRandall Stewart 			}
3519f8829a4aSRandall Stewart 			ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
3520f8829a4aSRandall Stewart 			    sizeof(struct sctp_chunkhdr), chunk_buf);
3521f8829a4aSRandall Stewart 		}
3522ad81507eSRandall Stewart 		if (ch == NULL) {
3523ad81507eSRandall Stewart 			/* Help */
3524ad81507eSRandall Stewart 			*offset = length;
3525207304d4SRandall Stewart 			if (locked_tcb) {
3526207304d4SRandall Stewart 				SCTP_TCB_UNLOCK(locked_tcb);
3527207304d4SRandall Stewart 			}
3528ad81507eSRandall Stewart 			return (NULL);
3529ad81507eSRandall Stewart 		}
3530f8829a4aSRandall Stewart 		if (ch->chunk_type == SCTP_COOKIE_ECHO) {
3531f8829a4aSRandall Stewart 			goto process_control_chunks;
3532f8829a4aSRandall Stewart 		}
3533f8829a4aSRandall Stewart 		/*
3534f8829a4aSRandall Stewart 		 * first check if it's an ASCONF with an unknown src addr we
3535f8829a4aSRandall Stewart 		 * need to look inside to find the association
3536f8829a4aSRandall Stewart 		 */
3537f8829a4aSRandall Stewart 		if (ch->chunk_type == SCTP_ASCONF && stcb == NULL) {
3538f8829a4aSRandall Stewart 			/* inp's refcount may be reduced */
3539f8829a4aSRandall Stewart 			SCTP_INP_INCR_REF(inp);
3540f8829a4aSRandall Stewart 
3541f8829a4aSRandall Stewart 			stcb = sctp_findassociation_ep_asconf(m, iphlen,
3542f8829a4aSRandall Stewart 			    *offset, sh, &inp, netp);
3543f8829a4aSRandall Stewart 			if (stcb == NULL) {
3544f8829a4aSRandall Stewart 				/*
3545f8829a4aSRandall Stewart 				 * reduce inp's refcount if not reduced in
3546f8829a4aSRandall Stewart 				 * sctp_findassociation_ep_asconf().
3547f8829a4aSRandall Stewart 				 */
3548f8829a4aSRandall Stewart 				SCTP_INP_DECR_REF(inp);
3549f8829a4aSRandall Stewart 			}
3550f8829a4aSRandall Stewart 			/* now go back and verify any auth chunk to be sure */
3551f8829a4aSRandall Stewart 			if (auth_skipped && (stcb != NULL)) {
3552f8829a4aSRandall Stewart 				struct sctp_auth_chunk *auth;
3553f8829a4aSRandall Stewart 
3554f8829a4aSRandall Stewart 				auth = (struct sctp_auth_chunk *)
3555f8829a4aSRandall Stewart 				    sctp_m_getptr(m, auth_offset,
3556f8829a4aSRandall Stewart 				    auth_len, chunk_buf);
3557f8829a4aSRandall Stewart 				got_auth = 1;
3558f8829a4aSRandall Stewart 				auth_skipped = 0;
3559ad81507eSRandall Stewart 				if ((auth == NULL) || sctp_handle_auth(stcb, auth, m,
3560f8829a4aSRandall Stewart 				    auth_offset)) {
3561f8829a4aSRandall Stewart 					/* auth HMAC failed so dump it */
3562f8829a4aSRandall Stewart 					*offset = length;
3563207304d4SRandall Stewart 					if (locked_tcb) {
3564207304d4SRandall Stewart 						SCTP_TCB_UNLOCK(locked_tcb);
3565207304d4SRandall Stewart 					}
3566f8829a4aSRandall Stewart 					return (NULL);
3567f8829a4aSRandall Stewart 				} else {
3568f8829a4aSRandall Stewart 					/* remaining chunks are HMAC checked */
3569f8829a4aSRandall Stewart 					stcb->asoc.authenticated = 1;
3570f8829a4aSRandall Stewart 				}
3571f8829a4aSRandall Stewart 			}
3572f8829a4aSRandall Stewart 		}
3573f8829a4aSRandall Stewart 		if (stcb == NULL) {
3574f8829a4aSRandall Stewart 			/* no association, so it's out of the blue... */
357517205eccSRandall Stewart 			sctp_handle_ootb(m, iphlen, *offset, sh, inp, NULL,
357617205eccSRandall Stewart 			    vrf_id, table_id);
3577f8829a4aSRandall Stewart 			*offset = length;
35786e55db54SRandall Stewart 			if (locked_tcb) {
3579f8829a4aSRandall Stewart 				SCTP_TCB_UNLOCK(locked_tcb);
35806e55db54SRandall Stewart 			}
3581f8829a4aSRandall Stewart 			return (NULL);
3582f8829a4aSRandall Stewart 		}
3583f8829a4aSRandall Stewart 		asoc = &stcb->asoc;
3584f8829a4aSRandall Stewart 		/* ABORT and SHUTDOWN can use either v_tag... */
3585f8829a4aSRandall Stewart 		if ((ch->chunk_type == SCTP_ABORT_ASSOCIATION) ||
3586f8829a4aSRandall Stewart 		    (ch->chunk_type == SCTP_SHUTDOWN_COMPLETE) ||
3587f8829a4aSRandall Stewart 		    (ch->chunk_type == SCTP_PACKET_DROPPED)) {
3588f8829a4aSRandall Stewart 			if ((vtag_in == asoc->my_vtag) ||
3589f8829a4aSRandall Stewart 			    ((ch->chunk_flags & SCTP_HAD_NO_TCB) &&
3590f8829a4aSRandall Stewart 			    (vtag_in == asoc->peer_vtag))) {
3591f8829a4aSRandall Stewart 				/* this is valid */
3592f8829a4aSRandall Stewart 			} else {
3593f8829a4aSRandall Stewart 				/* drop this packet... */
3594f8829a4aSRandall Stewart 				SCTP_STAT_INCR(sctps_badvtag);
35956e55db54SRandall Stewart 				if (locked_tcb) {
3596f8829a4aSRandall Stewart 					SCTP_TCB_UNLOCK(locked_tcb);
35976e55db54SRandall Stewart 				}
3598f8829a4aSRandall Stewart 				return (NULL);
3599f8829a4aSRandall Stewart 			}
3600f8829a4aSRandall Stewart 		} else if (ch->chunk_type == SCTP_SHUTDOWN_ACK) {
3601f8829a4aSRandall Stewart 			if (vtag_in != asoc->my_vtag) {
3602f8829a4aSRandall Stewart 				/*
3603f8829a4aSRandall Stewart 				 * this could be a stale SHUTDOWN-ACK or the
3604f8829a4aSRandall Stewart 				 * peer never got the SHUTDOWN-COMPLETE and
3605f8829a4aSRandall Stewart 				 * is still hung; we have started a new asoc
3606f8829a4aSRandall Stewart 				 * but it won't complete until the shutdown
3607f8829a4aSRandall Stewart 				 * is completed
3608f8829a4aSRandall Stewart 				 */
36096e55db54SRandall Stewart 				if (locked_tcb) {
3610f8829a4aSRandall Stewart 					SCTP_TCB_UNLOCK(locked_tcb);
36116e55db54SRandall Stewart 				}
3612f8829a4aSRandall Stewart 				sctp_handle_ootb(m, iphlen, *offset, sh, inp,
361317205eccSRandall Stewart 				    NULL, vrf_id, table_id);
3614f8829a4aSRandall Stewart 				return (NULL);
3615f8829a4aSRandall Stewart 			}
3616f8829a4aSRandall Stewart 		} else {
3617f8829a4aSRandall Stewart 			/* for all other chunks, vtag must match */
3618f8829a4aSRandall Stewart 			if (vtag_in != asoc->my_vtag) {
3619f8829a4aSRandall Stewart 				/* invalid vtag... */
3620ad81507eSRandall Stewart 				SCTPDBG(SCTP_DEBUG_INPUT3,
3621ad81507eSRandall Stewart 				    "invalid vtag: %xh, expect %xh\n",
3622ad81507eSRandall Stewart 				    vtag_in, asoc->my_vtag);
3623f8829a4aSRandall Stewart 				SCTP_STAT_INCR(sctps_badvtag);
36246e55db54SRandall Stewart 				if (locked_tcb) {
3625f8829a4aSRandall Stewart 					SCTP_TCB_UNLOCK(locked_tcb);
36266e55db54SRandall Stewart 				}
3627f8829a4aSRandall Stewart 				*offset = length;
3628f8829a4aSRandall Stewart 				return (NULL);
3629f8829a4aSRandall Stewart 			}
3630f8829a4aSRandall Stewart 		}
3631f8829a4aSRandall Stewart 	}			/* end if !SCTP_COOKIE_ECHO */
3632f8829a4aSRandall Stewart 	/*
3633f8829a4aSRandall Stewart 	 * process all control chunks...
3634f8829a4aSRandall Stewart 	 */
3635f8829a4aSRandall Stewart 	if (((ch->chunk_type == SCTP_SELECTIVE_ACK) ||
3636f8829a4aSRandall Stewart 	    (ch->chunk_type == SCTP_HEARTBEAT_REQUEST)) &&
3637f8829a4aSRandall Stewart 	    (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_ECHOED)) {
3638f8829a4aSRandall Stewart 		/* implied cookie-ack.. we must have lost the ack */
3639f8829a4aSRandall Stewart 		stcb->asoc.overall_error_count = 0;
3640f8829a4aSRandall Stewart 		sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb,
3641f8829a4aSRandall Stewart 		    *netp);
3642f8829a4aSRandall Stewart 	}
3643f8829a4aSRandall Stewart process_control_chunks:
3644f8829a4aSRandall Stewart 	while (IS_SCTP_CONTROL(ch)) {
3645f8829a4aSRandall Stewart 		/* validate chunk length */
3646f8829a4aSRandall Stewart 		chk_length = ntohs(ch->chunk_length);
3647ad81507eSRandall Stewart 		SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_process_control: processing a chunk type=%u, len=%u\n",
3648f8829a4aSRandall Stewart 		    ch->chunk_type, chk_length);
3649f8829a4aSRandall Stewart 		if ((size_t)chk_length < sizeof(*ch) ||
3650f8829a4aSRandall Stewart 		    (*offset + chk_length) > length) {
3651f8829a4aSRandall Stewart 			*offset = length;
36526e55db54SRandall Stewart 			if (locked_tcb) {
3653f8829a4aSRandall Stewart 				SCTP_TCB_UNLOCK(locked_tcb);
36546e55db54SRandall Stewart 			}
3655f8829a4aSRandall Stewart 			return (NULL);
3656f8829a4aSRandall Stewart 		}
3657f8829a4aSRandall Stewart 		SCTP_STAT_INCR_COUNTER64(sctps_incontrolchunks);
3658f8829a4aSRandall Stewart 		/*
3659f8829a4aSRandall Stewart 		 * INIT-ACK only gets the init ack "header" portion only
3660f8829a4aSRandall Stewart 		 * because we don't have to process the peer's COOKIE. All
3661f8829a4aSRandall Stewart 		 * others get a complete chunk.
3662f8829a4aSRandall Stewart 		 */
3663d06c82f1SRandall Stewart 		if ((ch->chunk_type == SCTP_INITIATION_ACK) ||
3664d06c82f1SRandall Stewart 		    (ch->chunk_type == SCTP_INITIATION)) {
3665f8829a4aSRandall Stewart 			/* get an init-ack chunk */
3666f8829a4aSRandall Stewart 			ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
3667f8829a4aSRandall Stewart 			    sizeof(struct sctp_init_ack_chunk), chunk_buf);
3668f8829a4aSRandall Stewart 			if (ch == NULL) {
3669f8829a4aSRandall Stewart 				*offset = length;
36706e55db54SRandall Stewart 				if (locked_tcb) {
3671f8829a4aSRandall Stewart 					SCTP_TCB_UNLOCK(locked_tcb);
36726e55db54SRandall Stewart 				}
3673f8829a4aSRandall Stewart 				return (NULL);
3674f8829a4aSRandall Stewart 			}
3675d06c82f1SRandall Stewart 		} else if (ch->chunk_type == SCTP_COOKIE_ECHO) {
3676d06c82f1SRandall Stewart 			if (chk_length > sizeof(chunk_buf)) {
3677d06c82f1SRandall Stewart 				/*
3678d06c82f1SRandall Stewart 				 * use just the size of the chunk buffer so
3679d06c82f1SRandall Stewart 				 * the front part of our cookie is intact.
3680d06c82f1SRandall Stewart 				 * The rest of cookie processing should use
3681d06c82f1SRandall Stewart 				 * the sctp_m_getptr() function to access
3682d06c82f1SRandall Stewart 				 * the other parts.
3683d06c82f1SRandall Stewart 				 */
3684d06c82f1SRandall Stewart 				ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
3685d06c82f1SRandall Stewart 				    (sizeof(chunk_buf) - 4),
3686d06c82f1SRandall Stewart 				    chunk_buf);
3687d06c82f1SRandall Stewart 				if (ch == NULL) {
3688d06c82f1SRandall Stewart 					*offset = length;
36896e55db54SRandall Stewart 					if (locked_tcb) {
3690d06c82f1SRandall Stewart 						SCTP_TCB_UNLOCK(locked_tcb);
36916e55db54SRandall Stewart 					}
3692d06c82f1SRandall Stewart 					return (NULL);
3693d06c82f1SRandall Stewart 				}
3694d06c82f1SRandall Stewart 			} else {
3695d06c82f1SRandall Stewart 				/* We can fit it all */
3696d06c82f1SRandall Stewart 				goto all_fits;
3697d06c82f1SRandall Stewart 			}
3698f8829a4aSRandall Stewart 		} else {
3699f8829a4aSRandall Stewart 			/* get a complete chunk... */
3700f8829a4aSRandall Stewart 			if ((size_t)chk_length > sizeof(chunk_buf)) {
3701f8829a4aSRandall Stewart 				struct mbuf *oper;
3702f8829a4aSRandall Stewart 				struct sctp_paramhdr *phdr;
3703f8829a4aSRandall Stewart 
3704f8829a4aSRandall Stewart 				oper = NULL;
3705d06c82f1SRandall Stewart 				if (stcb) {
3706f8829a4aSRandall Stewart 					oper = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr),
3707139bc87fSRandall Stewart 					    0, M_DONTWAIT, 1, MT_DATA);
3708d06c82f1SRandall Stewart 
3709f8829a4aSRandall Stewart 					if (oper) {
3710f8829a4aSRandall Stewart 						/* pre-reserve some space */
3711139bc87fSRandall Stewart 						SCTP_BUF_RESV_UF(oper, sizeof(struct sctp_chunkhdr));
3712139bc87fSRandall Stewart 						SCTP_BUF_LEN(oper) = sizeof(struct sctp_paramhdr);
3713f8829a4aSRandall Stewart 						phdr = mtod(oper, struct sctp_paramhdr *);
3714f8829a4aSRandall Stewart 						phdr->param_type = htons(SCTP_CAUSE_OUT_OF_RESC);
3715f8829a4aSRandall Stewart 						phdr->param_length = htons(sizeof(struct sctp_paramhdr));
3716f8829a4aSRandall Stewart 						sctp_queue_op_err(stcb, oper);
3717f8829a4aSRandall Stewart 					}
3718d06c82f1SRandall Stewart 				}
37196e55db54SRandall Stewart 				if (locked_tcb) {
3720f8829a4aSRandall Stewart 					SCTP_TCB_UNLOCK(locked_tcb);
37216e55db54SRandall Stewart 				}
3722f8829a4aSRandall Stewart 				return (NULL);
3723f8829a4aSRandall Stewart 			}
3724d06c82f1SRandall Stewart 	all_fits:
3725f8829a4aSRandall Stewart 			ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
3726f8829a4aSRandall Stewart 			    chk_length, chunk_buf);
3727f8829a4aSRandall Stewart 			if (ch == NULL) {
3728ad81507eSRandall Stewart 				SCTP_PRINTF("sctp_process_control: Can't get the all data....\n");
3729f8829a4aSRandall Stewart 				*offset = length;
37306e55db54SRandall Stewart 				if (locked_tcb) {
3731f8829a4aSRandall Stewart 					SCTP_TCB_UNLOCK(locked_tcb);
37326e55db54SRandall Stewart 				}
3733f8829a4aSRandall Stewart 				return (NULL);
3734f8829a4aSRandall Stewart 			}
3735f8829a4aSRandall Stewart 		}
3736f8829a4aSRandall Stewart 		num_chunks++;
3737f8829a4aSRandall Stewart 		/* Save off the last place we got a control from */
3738f8829a4aSRandall Stewart 		if (stcb != NULL) {
3739ad81507eSRandall Stewart 			if (((netp != NULL) && (*netp != NULL)) || (ch->chunk_type == SCTP_ASCONF)) {
3740f8829a4aSRandall Stewart 				/*
3741f8829a4aSRandall Stewart 				 * allow last_control to be NULL if
3742f8829a4aSRandall Stewart 				 * ASCONF... ASCONF processing will find the
3743f8829a4aSRandall Stewart 				 * right net later
3744f8829a4aSRandall Stewart 				 */
3745ad81507eSRandall Stewart 				if ((netp != NULL) && (*netp != NULL))
3746f8829a4aSRandall Stewart 					stcb->asoc.last_control_chunk_from = *netp;
3747f8829a4aSRandall Stewart 			}
3748f8829a4aSRandall Stewart 		}
3749f8829a4aSRandall Stewart #ifdef SCTP_AUDITING_ENABLED
3750f8829a4aSRandall Stewart 		sctp_audit_log(0xB0, ch->chunk_type);
3751f8829a4aSRandall Stewart #endif
3752f8829a4aSRandall Stewart 
3753f8829a4aSRandall Stewart 		/* check to see if this chunk required auth, but isn't */
3754f8829a4aSRandall Stewart 		if ((stcb != NULL) && !sctp_auth_disable &&
3755f8829a4aSRandall Stewart 		    sctp_auth_is_required_chunk(ch->chunk_type,
3756f8829a4aSRandall Stewart 		    stcb->asoc.local_auth_chunks) &&
3757f8829a4aSRandall Stewart 		    !stcb->asoc.authenticated) {
3758f8829a4aSRandall Stewart 			/* "silently" ignore */
3759f8829a4aSRandall Stewart 			SCTP_STAT_INCR(sctps_recvauthmissing);
3760f8829a4aSRandall Stewart 			goto next_chunk;
3761f8829a4aSRandall Stewart 		}
3762f8829a4aSRandall Stewart 		switch (ch->chunk_type) {
3763f8829a4aSRandall Stewart 		case SCTP_INITIATION:
3764f8829a4aSRandall Stewart 			/* must be first and only chunk */
3765ad81507eSRandall Stewart 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_INIT\n");
3766f8829a4aSRandall Stewart 			if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
3767f8829a4aSRandall Stewart 				/* We are not interested anymore? */
3768f8829a4aSRandall Stewart 				if ((stcb) && (stcb->asoc.total_output_queue_size)) {
3769f8829a4aSRandall Stewart 					/*
3770f8829a4aSRandall Stewart 					 * collision case where we are
3771f8829a4aSRandall Stewart 					 * sending to them too
3772f8829a4aSRandall Stewart 					 */
3773f8829a4aSRandall Stewart 					;
3774f8829a4aSRandall Stewart 				} else {
37756e55db54SRandall Stewart 					if (locked_tcb) {
3776f8829a4aSRandall Stewart 						SCTP_TCB_UNLOCK(locked_tcb);
37776e55db54SRandall Stewart 					}
3778f8829a4aSRandall Stewart 					*offset = length;
3779f8829a4aSRandall Stewart 					return (NULL);
3780f8829a4aSRandall Stewart 				}
3781f8829a4aSRandall Stewart 			}
3782f8829a4aSRandall Stewart 			if ((num_chunks > 1) ||
3783f8829a4aSRandall Stewart 			    (sctp_strict_init && (length - *offset > SCTP_SIZE32(chk_length)))) {
3784f8829a4aSRandall Stewart 				*offset = length;
37856e55db54SRandall Stewart 				if (locked_tcb) {
3786f8829a4aSRandall Stewart 					SCTP_TCB_UNLOCK(locked_tcb);
37876e55db54SRandall Stewart 				}
3788f8829a4aSRandall Stewart 				return (NULL);
3789f8829a4aSRandall Stewart 			}
3790f8829a4aSRandall Stewart 			if ((stcb != NULL) &&
3791f8829a4aSRandall Stewart 			    (SCTP_GET_STATE(&stcb->asoc) ==
3792f8829a4aSRandall Stewart 			    SCTP_STATE_SHUTDOWN_ACK_SENT)) {
3793f8829a4aSRandall Stewart 				sctp_send_shutdown_ack(stcb,
3794f8829a4aSRandall Stewart 				    stcb->asoc.primary_destination);
3795f8829a4aSRandall Stewart 				*offset = length;
3796f8829a4aSRandall Stewart 				sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC);
37976e55db54SRandall Stewart 				if (locked_tcb) {
3798f8829a4aSRandall Stewart 					SCTP_TCB_UNLOCK(locked_tcb);
37996e55db54SRandall Stewart 				}
3800f8829a4aSRandall Stewart 				return (NULL);
3801f8829a4aSRandall Stewart 			}
3802ad81507eSRandall Stewart 			if (netp) {
3803f8829a4aSRandall Stewart 				sctp_handle_init(m, iphlen, *offset, sh,
3804ad81507eSRandall Stewart 				    (struct sctp_init_chunk *)ch, inp,
3805ad81507eSRandall Stewart 				    stcb, *netp, &abort_no_unlock, vrf_id, table_id);
3806ad81507eSRandall Stewart 			}
3807bff64a4dSRandall Stewart 			if (abort_no_unlock)
3808bff64a4dSRandall Stewart 				return (NULL);
3809bff64a4dSRandall Stewart 
3810f8829a4aSRandall Stewart 			*offset = length;
38116e55db54SRandall Stewart 			if (locked_tcb) {
3812f8829a4aSRandall Stewart 				SCTP_TCB_UNLOCK(locked_tcb);
38136e55db54SRandall Stewart 			}
3814f8829a4aSRandall Stewart 			return (NULL);
3815f8829a4aSRandall Stewart 			break;
3816f8829a4aSRandall Stewart 		case SCTP_INITIATION_ACK:
3817f8829a4aSRandall Stewart 			/* must be first and only chunk */
3818ad81507eSRandall Stewart 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_INIT-ACK\n");
3819f8829a4aSRandall Stewart 			if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
3820f8829a4aSRandall Stewart 				/* We are not interested anymore */
3821f8829a4aSRandall Stewart 				if ((stcb) && (stcb->asoc.total_output_queue_size)) {
3822f8829a4aSRandall Stewart 					;
3823f8829a4aSRandall Stewart 				} else {
38246e55db54SRandall Stewart 					if (locked_tcb) {
3825f8829a4aSRandall Stewart 						SCTP_TCB_UNLOCK(locked_tcb);
38266e55db54SRandall Stewart 					}
3827f8829a4aSRandall Stewart 					*offset = length;
3828f8829a4aSRandall Stewart 					if (stcb) {
3829a5d547adSRandall Stewart 						sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_26);
3830f8829a4aSRandall Stewart 					}
3831f8829a4aSRandall Stewart 					return (NULL);
3832f8829a4aSRandall Stewart 				}
3833f8829a4aSRandall Stewart 			}
3834f8829a4aSRandall Stewart 			if ((num_chunks > 1) ||
3835f8829a4aSRandall Stewart 			    (sctp_strict_init && (length - *offset > SCTP_SIZE32(chk_length)))) {
3836f8829a4aSRandall Stewart 				*offset = length;
38376e55db54SRandall Stewart 				if (locked_tcb) {
3838f8829a4aSRandall Stewart 					SCTP_TCB_UNLOCK(locked_tcb);
38396e55db54SRandall Stewart 				}
3840f8829a4aSRandall Stewart 				return (NULL);
3841f8829a4aSRandall Stewart 			}
3842ad81507eSRandall Stewart 			if ((netp) && (*netp)) {
3843f8829a4aSRandall Stewart 				ret = sctp_handle_init_ack(m, iphlen, *offset, sh,
384417205eccSRandall Stewart 				    (struct sctp_init_ack_chunk *)ch, stcb, *netp, &abort_no_unlock, vrf_id, table_id);
3845ad81507eSRandall Stewart 			} else {
3846ad81507eSRandall Stewart 				ret = -1;
3847ad81507eSRandall Stewart 			}
3848f8829a4aSRandall Stewart 			/*
3849f8829a4aSRandall Stewart 			 * Special case, I must call the output routine to
3850f8829a4aSRandall Stewart 			 * get the cookie echoed
3851f8829a4aSRandall Stewart 			 */
3852bff64a4dSRandall Stewart 			if (abort_no_unlock)
3853bff64a4dSRandall Stewart 				return (NULL);
3854bff64a4dSRandall Stewart 
3855f8829a4aSRandall Stewart 			if ((stcb) && ret == 0)
3856f8829a4aSRandall Stewart 				sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC);
3857f8829a4aSRandall Stewart 			*offset = length;
38586e55db54SRandall Stewart 			if (locked_tcb) {
3859f8829a4aSRandall Stewart 				SCTP_TCB_UNLOCK(locked_tcb);
38606e55db54SRandall Stewart 			}
3861f8829a4aSRandall Stewart 			return (NULL);
3862f8829a4aSRandall Stewart 			break;
3863f8829a4aSRandall Stewart 		case SCTP_SELECTIVE_ACK:
3864ad81507eSRandall Stewart 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SACK\n");
3865f8829a4aSRandall Stewart 			SCTP_STAT_INCR(sctps_recvsacks);
3866f8829a4aSRandall Stewart 			{
3867f8829a4aSRandall Stewart 				struct sctp_sack_chunk *sack;
3868f8829a4aSRandall Stewart 				int abort_now = 0;
3869f8829a4aSRandall Stewart 				uint32_t a_rwnd, cum_ack;
3870f8829a4aSRandall Stewart 				uint16_t num_seg;
3871f8829a4aSRandall Stewart 				int nonce_sum_flag;
3872f8829a4aSRandall Stewart 
3873ad81507eSRandall Stewart 				if ((stcb == NULL) || (chk_length < sizeof(struct sctp_sack_chunk))) {
3874ad81507eSRandall Stewart 					SCTPDBG(SCTP_DEBUG_INDATA1, "Bad size on sack chunk, too small\n");
387517205eccSRandall Stewart 					*offset = length;
38766e55db54SRandall Stewart 					if (locked_tcb) {
38776114cd96SRandall Stewart 						SCTP_TCB_UNLOCK(locked_tcb);
38786e55db54SRandall Stewart 					}
3879d06c82f1SRandall Stewart 					return (NULL);
3880d06c82f1SRandall Stewart 				}
3881f8829a4aSRandall Stewart 				sack = (struct sctp_sack_chunk *)ch;
3882f8829a4aSRandall Stewart 				nonce_sum_flag = ch->chunk_flags & SCTP_SACK_NONCE_SUM;
3883f8829a4aSRandall Stewart 				cum_ack = ntohl(sack->sack.cum_tsn_ack);
3884f8829a4aSRandall Stewart 				num_seg = ntohs(sack->sack.num_gap_ack_blks);
3885f8829a4aSRandall Stewart 				a_rwnd = (uint32_t) ntohl(sack->sack.a_rwnd);
3886f8829a4aSRandall Stewart 				stcb->asoc.seen_a_sack_this_pkt = 1;
3887f8829a4aSRandall Stewart 				if ((stcb->asoc.pr_sctp_cnt == 0) &&
3888f8829a4aSRandall Stewart 				    (num_seg == 0) &&
3889f8829a4aSRandall Stewart 				    ((compare_with_wrap(cum_ack, stcb->asoc.last_acked_seq, MAX_TSN)) ||
3890f8829a4aSRandall Stewart 				    (cum_ack == stcb->asoc.last_acked_seq)) &&
3891f8829a4aSRandall Stewart 				    (stcb->asoc.saw_sack_with_frags == 0) &&
3892f8829a4aSRandall Stewart 				    (!TAILQ_EMPTY(&stcb->asoc.sent_queue))
3893f8829a4aSRandall Stewart 				    ) {
3894f8829a4aSRandall Stewart 					/*
3895f8829a4aSRandall Stewart 					 * We have a SIMPLE sack having no
3896f8829a4aSRandall Stewart 					 * prior segments and data on sent
3897f8829a4aSRandall Stewart 					 * queue to be acked.. Use the
3898f8829a4aSRandall Stewart 					 * faster path sack processing. We
3899f8829a4aSRandall Stewart 					 * also allow window update sacks
3900f8829a4aSRandall Stewart 					 * with no missing segments to go
3901f8829a4aSRandall Stewart 					 * this way too.
3902f8829a4aSRandall Stewart 					 */
3903d06c82f1SRandall Stewart 					sctp_express_handle_sack(stcb, cum_ack, a_rwnd, nonce_sum_flag,
3904d06c82f1SRandall Stewart 					    &abort_now);
3905f8829a4aSRandall Stewart 				} else {
3906ad81507eSRandall Stewart 					if (netp && *netp)
3907d06c82f1SRandall Stewart 						sctp_handle_sack(sack, stcb, *netp, &abort_now, chk_length, a_rwnd);
3908f8829a4aSRandall Stewart 				}
3909f8829a4aSRandall Stewart 				if (abort_now) {
3910f8829a4aSRandall Stewart 					/* ABORT signal from sack processing */
3911f8829a4aSRandall Stewart 					*offset = length;
3912f8829a4aSRandall Stewart 					return (NULL);
3913f8829a4aSRandall Stewart 				}
3914f8829a4aSRandall Stewart 			}
3915f8829a4aSRandall Stewart 			break;
3916f8829a4aSRandall Stewart 		case SCTP_HEARTBEAT_REQUEST:
3917ad81507eSRandall Stewart 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_HEARTBEAT\n");
3918ad81507eSRandall Stewart 			if ((stcb) && netp && *netp) {
3919f8829a4aSRandall Stewart 				SCTP_STAT_INCR(sctps_recvheartbeat);
3920ad81507eSRandall Stewart 				sctp_send_heartbeat_ack(stcb, m, *offset,
3921ad81507eSRandall Stewart 				    chk_length, *netp);
3922f8829a4aSRandall Stewart 
3923f8829a4aSRandall Stewart 				/* He's alive so give him credit */
3924f8829a4aSRandall Stewart 				stcb->asoc.overall_error_count = 0;
3925ad81507eSRandall Stewart 			}
3926f8829a4aSRandall Stewart 			break;
3927f8829a4aSRandall Stewart 		case SCTP_HEARTBEAT_ACK:
3928ad81507eSRandall Stewart 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_HEARTBEAT-ACK\n");
3929ad81507eSRandall Stewart 			if ((stcb == NULL) || (chk_length != sizeof(struct sctp_heartbeat_chunk))) {
3930d06c82f1SRandall Stewart 				/* Its not ours */
393117205eccSRandall Stewart 				*offset = length;
39326e55db54SRandall Stewart 				if (locked_tcb) {
39336114cd96SRandall Stewart 					SCTP_TCB_UNLOCK(locked_tcb);
39346e55db54SRandall Stewart 				}
3935d06c82f1SRandall Stewart 				return (NULL);
3936d06c82f1SRandall Stewart 			}
3937f8829a4aSRandall Stewart 			/* He's alive so give him credit */
3938f8829a4aSRandall Stewart 			stcb->asoc.overall_error_count = 0;
3939f8829a4aSRandall Stewart 			SCTP_STAT_INCR(sctps_recvheartbeatack);
3940ad81507eSRandall Stewart 			if (netp && *netp)
3941f8829a4aSRandall Stewart 				sctp_handle_heartbeat_ack((struct sctp_heartbeat_chunk *)ch,
3942f8829a4aSRandall Stewart 				    stcb, *netp);
3943f8829a4aSRandall Stewart 			break;
3944f8829a4aSRandall Stewart 		case SCTP_ABORT_ASSOCIATION:
3945207304d4SRandall Stewart 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ABORT, stcb %p\n",
3946207304d4SRandall Stewart 			    stcb);
3947ad81507eSRandall Stewart 			if ((stcb) && netp && *netp)
3948f8829a4aSRandall Stewart 				sctp_handle_abort((struct sctp_abort_chunk *)ch,
3949f8829a4aSRandall Stewart 				    stcb, *netp);
3950f8829a4aSRandall Stewart 			*offset = length;
3951f8829a4aSRandall Stewart 			return (NULL);
3952f8829a4aSRandall Stewart 			break;
3953f8829a4aSRandall Stewart 		case SCTP_SHUTDOWN:
3954207304d4SRandall Stewart 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SHUTDOWN, stcb %p\n",
3955207304d4SRandall Stewart 			    stcb);
3956ad81507eSRandall Stewart 			if ((stcb == NULL) || (chk_length != sizeof(struct sctp_shutdown_chunk))) {
3957d06c82f1SRandall Stewart 				*offset = length;
39586e55db54SRandall Stewart 				if (locked_tcb) {
39596114cd96SRandall Stewart 					SCTP_TCB_UNLOCK(locked_tcb);
39606e55db54SRandall Stewart 				}
3961d06c82f1SRandall Stewart 				return (NULL);
3962d06c82f1SRandall Stewart 
3963ad81507eSRandall Stewart 			}
3964ad81507eSRandall Stewart 			if (netp && *netp) {
3965f8829a4aSRandall Stewart 				int abort_flag = 0;
3966f8829a4aSRandall Stewart 
3967f8829a4aSRandall Stewart 				sctp_handle_shutdown((struct sctp_shutdown_chunk *)ch,
3968f8829a4aSRandall Stewart 				    stcb, *netp, &abort_flag);
3969f8829a4aSRandall Stewart 				if (abort_flag) {
3970f8829a4aSRandall Stewart 					*offset = length;
3971f8829a4aSRandall Stewart 					return (NULL);
3972f8829a4aSRandall Stewart 				}
3973f8829a4aSRandall Stewart 			}
3974f8829a4aSRandall Stewart 			break;
3975f8829a4aSRandall Stewart 		case SCTP_SHUTDOWN_ACK:
3976207304d4SRandall Stewart 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SHUTDOWN-ACK, stcb %p\n", stcb);
3977ad81507eSRandall Stewart 			if ((stcb) && (netp) && (*netp))
3978f8829a4aSRandall Stewart 				sctp_handle_shutdown_ack((struct sctp_shutdown_ack_chunk *)ch, stcb, *netp);
3979f8829a4aSRandall Stewart 			*offset = length;
3980f8829a4aSRandall Stewart 			return (NULL);
3981f8829a4aSRandall Stewart 			break;
3982ad81507eSRandall Stewart 
3983f8829a4aSRandall Stewart 		case SCTP_OPERATION_ERROR:
3984ad81507eSRandall Stewart 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_OP-ERR\n");
3985ad81507eSRandall Stewart 			if ((stcb) && netp && *netp && sctp_handle_error(ch, stcb, *netp) < 0) {
3986ad81507eSRandall Stewart 
3987f8829a4aSRandall Stewart 				*offset = length;
3988f8829a4aSRandall Stewart 				return (NULL);
3989f8829a4aSRandall Stewart 			}
3990f8829a4aSRandall Stewart 			break;
3991f8829a4aSRandall Stewart 		case SCTP_COOKIE_ECHO:
3992ad81507eSRandall Stewart 			SCTPDBG(SCTP_DEBUG_INPUT3,
3993207304d4SRandall Stewart 			    "SCTP_COOKIE-ECHO, stcb %p\n", stcb);
3994f8829a4aSRandall Stewart 			if ((stcb) && (stcb->asoc.total_output_queue_size)) {
3995f8829a4aSRandall Stewart 				;
3996f8829a4aSRandall Stewart 			} else {
3997ad81507eSRandall Stewart 				if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
3998f8829a4aSRandall Stewart 					/* We are not interested anymore */
3999f8829a4aSRandall Stewart 					*offset = length;
4000f8829a4aSRandall Stewart 					return (NULL);
4001f8829a4aSRandall Stewart 				}
4002f8829a4aSRandall Stewart 			}
4003f8829a4aSRandall Stewart 			/*
4004f8829a4aSRandall Stewart 			 * First are we accepting? We do this again here
4005ad81507eSRandall Stewart 			 * sincen it is possible that a previous endpoint
4006ad81507eSRandall Stewart 			 * WAS listening responded to a INIT-ACK and then
4007f8829a4aSRandall Stewart 			 * closed. We opened and bound.. and are now no
4008f8829a4aSRandall Stewart 			 * longer listening.
4009f8829a4aSRandall Stewart 			 */
4010f8829a4aSRandall Stewart 			if (inp->sctp_socket->so_qlimit == 0) {
4011f8829a4aSRandall Stewart 				if ((stcb) && (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
4012f8829a4aSRandall Stewart 					/*
4013f8829a4aSRandall Stewart 					 * special case, is this a retran'd
4014f8829a4aSRandall Stewart 					 * COOKIE-ECHO or a restarting assoc
4015f8829a4aSRandall Stewart 					 * that is a peeled off or
4016f8829a4aSRandall Stewart 					 * one-to-one style socket.
4017f8829a4aSRandall Stewart 					 */
4018f8829a4aSRandall Stewart 					goto process_cookie_anyway;
4019f8829a4aSRandall Stewart 				}
402017205eccSRandall Stewart 				sctp_abort_association(inp, stcb, m, iphlen,
402117205eccSRandall Stewart 				    sh, NULL, vrf_id,
402217205eccSRandall Stewart 				    table_id);
4023f8829a4aSRandall Stewart 				*offset = length;
4024f8829a4aSRandall Stewart 				return (NULL);
4025f8829a4aSRandall Stewart 			} else if (inp->sctp_socket->so_qlimit) {
4026f8829a4aSRandall Stewart 				/* we are accepting so check limits like TCP */
4027f8829a4aSRandall Stewart 				if (inp->sctp_socket->so_qlen >
4028f8829a4aSRandall Stewart 				    inp->sctp_socket->so_qlimit) {
4029f8829a4aSRandall Stewart 					/* no space */
4030f8829a4aSRandall Stewart 					struct mbuf *oper;
4031f8829a4aSRandall Stewart 					struct sctp_paramhdr *phdr;
4032f8829a4aSRandall Stewart 
4033f8829a4aSRandall Stewart 					if (sctp_abort_if_one_2_one_hits_limit) {
4034f8829a4aSRandall Stewart 						oper = NULL;
4035f8829a4aSRandall Stewart 						oper = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr),
4036139bc87fSRandall Stewart 						    0, M_DONTWAIT, 1, MT_DATA);
4037f8829a4aSRandall Stewart 						if (oper) {
4038139bc87fSRandall Stewart 							SCTP_BUF_LEN(oper) =
4039f8829a4aSRandall Stewart 							    sizeof(struct sctp_paramhdr);
4040f8829a4aSRandall Stewart 							phdr = mtod(oper,
4041f8829a4aSRandall Stewart 							    struct sctp_paramhdr *);
4042f8829a4aSRandall Stewart 							phdr->param_type =
4043f8829a4aSRandall Stewart 							    htons(SCTP_CAUSE_OUT_OF_RESC);
4044f8829a4aSRandall Stewart 							phdr->param_length =
4045f8829a4aSRandall Stewart 							    htons(sizeof(struct sctp_paramhdr));
4046f8829a4aSRandall Stewart 						}
4047f8829a4aSRandall Stewart 						sctp_abort_association(inp, stcb, m,
404817205eccSRandall Stewart 						    iphlen, sh, oper, vrf_id, table_id);
4049f8829a4aSRandall Stewart 					}
4050f8829a4aSRandall Stewart 					*offset = length;
4051f8829a4aSRandall Stewart 					return (NULL);
4052f8829a4aSRandall Stewart 				}
4053f8829a4aSRandall Stewart 			}
4054f8829a4aSRandall Stewart 	process_cookie_anyway:
4055f8829a4aSRandall Stewart 			{
4056f8829a4aSRandall Stewart 				struct mbuf *ret_buf;
4057a5d547adSRandall Stewart 				struct sctp_inpcb *linp;
4058f8829a4aSRandall Stewart 
4059ad81507eSRandall Stewart 				if (stcb) {
4060a5d547adSRandall Stewart 					linp = NULL;
4061ad81507eSRandall Stewart 				} else {
4062a5d547adSRandall Stewart 					linp = inp;
4063ad81507eSRandall Stewart 				}
4064a5d547adSRandall Stewart 
4065ad81507eSRandall Stewart 				if (linp) {
4066a5d547adSRandall Stewart 					SCTP_ASOC_CREATE_LOCK(linp);
4067ad81507eSRandall Stewart 				}
4068ad81507eSRandall Stewart 				if (netp) {
4069f8829a4aSRandall Stewart 					ret_buf =
4070f8829a4aSRandall Stewart 					    sctp_handle_cookie_echo(m, iphlen,
4071f8829a4aSRandall Stewart 					    *offset, sh,
4072f8829a4aSRandall Stewart 					    (struct sctp_cookie_echo_chunk *)ch,
4073f8829a4aSRandall Stewart 					    &inp, &stcb, netp,
4074f8829a4aSRandall Stewart 					    auth_skipped,
4075f8829a4aSRandall Stewart 					    auth_offset,
4076a5d547adSRandall Stewart 					    auth_len,
407717205eccSRandall Stewart 					    &locked_tcb,
407817205eccSRandall Stewart 					    vrf_id,
407917205eccSRandall Stewart 					    table_id);
4080ad81507eSRandall Stewart 				} else {
4081ad81507eSRandall Stewart 					ret_buf = NULL;
4082ad81507eSRandall Stewart 				}
4083ad81507eSRandall Stewart 				if (linp) {
4084a5d547adSRandall Stewart 					SCTP_ASOC_CREATE_UNLOCK(linp);
4085ad81507eSRandall Stewart 				}
4086f8829a4aSRandall Stewart 				if (ret_buf == NULL) {
4087f8829a4aSRandall Stewart 					if (locked_tcb) {
4088f8829a4aSRandall Stewart 						SCTP_TCB_UNLOCK(locked_tcb);
4089f8829a4aSRandall Stewart 					}
4090ad81507eSRandall Stewart 					SCTPDBG(SCTP_DEBUG_INPUT3,
4091ad81507eSRandall Stewart 					    "GAK, null buffer\n");
4092f8829a4aSRandall Stewart 					auth_skipped = 0;
4093f8829a4aSRandall Stewart 					*offset = length;
4094f8829a4aSRandall Stewart 					return (NULL);
4095f8829a4aSRandall Stewart 				}
4096f8829a4aSRandall Stewart 				/* if AUTH skipped, see if it verified... */
4097f8829a4aSRandall Stewart 				if (auth_skipped) {
4098f8829a4aSRandall Stewart 					got_auth = 1;
4099f8829a4aSRandall Stewart 					auth_skipped = 0;
4100f8829a4aSRandall Stewart 				}
4101f8829a4aSRandall Stewart 				if (!TAILQ_EMPTY(&stcb->asoc.sent_queue)) {
4102f8829a4aSRandall Stewart 					/*
4103f8829a4aSRandall Stewart 					 * Restart the timer if we have
4104f8829a4aSRandall Stewart 					 * pending data
4105f8829a4aSRandall Stewart 					 */
4106f8829a4aSRandall Stewart 					struct sctp_tmit_chunk *chk;
4107f8829a4aSRandall Stewart 
4108f8829a4aSRandall Stewart 					chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
4109f8829a4aSRandall Stewart 					if (chk) {
4110f8829a4aSRandall Stewart 						sctp_timer_start(SCTP_TIMER_TYPE_SEND,
4111f8829a4aSRandall Stewart 						    stcb->sctp_ep, stcb,
4112f8829a4aSRandall Stewart 						    chk->whoTo);
4113f8829a4aSRandall Stewart 					}
4114f8829a4aSRandall Stewart 				}
4115f8829a4aSRandall Stewart 			}
4116f8829a4aSRandall Stewart 			break;
4117f8829a4aSRandall Stewart 		case SCTP_COOKIE_ACK:
4118207304d4SRandall Stewart 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_COOKIE-ACK, stcb %p\n", stcb);
4119ad81507eSRandall Stewart 			if ((stcb == NULL) || chk_length != sizeof(struct sctp_cookie_ack_chunk)) {
41206e55db54SRandall Stewart 				if (locked_tcb) {
412117205eccSRandall Stewart 					SCTP_TCB_UNLOCK(locked_tcb);
41226e55db54SRandall Stewart 				}
412317205eccSRandall Stewart 				return (NULL);
412417205eccSRandall Stewart 			}
4125f8829a4aSRandall Stewart 			if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4126f8829a4aSRandall Stewart 				/* We are not interested anymore */
4127f8829a4aSRandall Stewart 				if ((stcb) && (stcb->asoc.total_output_queue_size)) {
4128f8829a4aSRandall Stewart 					;
4129ad81507eSRandall Stewart 				} else if (stcb) {
4130a5d547adSRandall Stewart 					sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_27);
4131f8829a4aSRandall Stewart 					*offset = length;
4132f8829a4aSRandall Stewart 					return (NULL);
4133f8829a4aSRandall Stewart 				}
4134f8829a4aSRandall Stewart 			}
4135f8829a4aSRandall Stewart 			/* He's alive so give him credit */
4136ad81507eSRandall Stewart 			if ((stcb) && netp && *netp) {
4137f8829a4aSRandall Stewart 				stcb->asoc.overall_error_count = 0;
4138f8829a4aSRandall Stewart 				sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb, *netp);
41396e55db54SRandall Stewart 			}
4140f8829a4aSRandall Stewart 			break;
4141f8829a4aSRandall Stewart 		case SCTP_ECN_ECHO:
4142ad81507eSRandall Stewart 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ECN-ECHO\n");
4143f8829a4aSRandall Stewart 			/* He's alive so give him credit */
4144ad81507eSRandall Stewart 			if ((stcb == NULL) || (chk_length != sizeof(struct sctp_ecne_chunk))) {
4145d06c82f1SRandall Stewart 				/* Its not ours */
41466e55db54SRandall Stewart 				if (locked_tcb) {
41476114cd96SRandall Stewart 					SCTP_TCB_UNLOCK(locked_tcb);
41486e55db54SRandall Stewart 				}
4149d06c82f1SRandall Stewart 				*offset = length;
4150d06c82f1SRandall Stewart 				return (NULL);
4151d06c82f1SRandall Stewart 			}
41526e55db54SRandall Stewart 			if (stcb) {
4153f8829a4aSRandall Stewart 				stcb->asoc.overall_error_count = 0;
4154f8829a4aSRandall Stewart 				sctp_handle_ecn_echo((struct sctp_ecne_chunk *)ch,
4155f8829a4aSRandall Stewart 				    stcb);
41566e55db54SRandall Stewart 			}
4157f8829a4aSRandall Stewart 			break;
4158f8829a4aSRandall Stewart 		case SCTP_ECN_CWR:
4159ad81507eSRandall Stewart 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ECN-CWR\n");
4160f8829a4aSRandall Stewart 			/* He's alive so give him credit */
4161ad81507eSRandall Stewart 			if ((stcb == NULL) || (chk_length != sizeof(struct sctp_cwr_chunk))) {
4162d06c82f1SRandall Stewart 				/* Its not ours */
41636e55db54SRandall Stewart 				if (locked_tcb) {
41646114cd96SRandall Stewart 					SCTP_TCB_UNLOCK(locked_tcb);
41656e55db54SRandall Stewart 				}
4166d06c82f1SRandall Stewart 				*offset = length;
4167d06c82f1SRandall Stewart 				return (NULL);
4168d06c82f1SRandall Stewart 			}
41696e55db54SRandall Stewart 			if (stcb) {
4170f8829a4aSRandall Stewart 				stcb->asoc.overall_error_count = 0;
4171f8829a4aSRandall Stewart 				sctp_handle_ecn_cwr((struct sctp_cwr_chunk *)ch, stcb);
41726e55db54SRandall Stewart 			}
4173f8829a4aSRandall Stewart 			break;
4174f8829a4aSRandall Stewart 		case SCTP_SHUTDOWN_COMPLETE:
4175207304d4SRandall Stewart 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SHUTDOWN-COMPLETE, stcb %p\n", stcb);
4176f8829a4aSRandall Stewart 			/* must be first and only chunk */
4177f8829a4aSRandall Stewart 			if ((num_chunks > 1) ||
4178f8829a4aSRandall Stewart 			    (length - *offset > SCTP_SIZE32(chk_length))) {
4179f8829a4aSRandall Stewart 				*offset = length;
41806e55db54SRandall Stewart 				if (locked_tcb) {
4181f8829a4aSRandall Stewart 					SCTP_TCB_UNLOCK(locked_tcb);
41826e55db54SRandall Stewart 				}
4183f8829a4aSRandall Stewart 				return (NULL);
4184f8829a4aSRandall Stewart 			}
4185ad81507eSRandall Stewart 			if ((stcb) && netp && *netp) {
4186f8829a4aSRandall Stewart 				sctp_handle_shutdown_complete((struct sctp_shutdown_complete_chunk *)ch,
4187f8829a4aSRandall Stewart 				    stcb, *netp);
41886e55db54SRandall Stewart 			}
4189f8829a4aSRandall Stewart 			*offset = length;
4190f8829a4aSRandall Stewart 			return (NULL);
4191f8829a4aSRandall Stewart 			break;
4192f8829a4aSRandall Stewart 		case SCTP_ASCONF:
4193ad81507eSRandall Stewart 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ASCONF\n");
4194f8829a4aSRandall Stewart 			/* He's alive so give him credit */
41956e55db54SRandall Stewart 			if (stcb) {
4196f8829a4aSRandall Stewart 				stcb->asoc.overall_error_count = 0;
4197f8829a4aSRandall Stewart 				sctp_handle_asconf(m, *offset,
4198f8829a4aSRandall Stewart 				    (struct sctp_asconf_chunk *)ch, stcb);
41996e55db54SRandall Stewart 			}
4200f8829a4aSRandall Stewart 			break;
4201f8829a4aSRandall Stewart 		case SCTP_ASCONF_ACK:
4202ad81507eSRandall Stewart 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ASCONF-ACK\n");
4203d06c82f1SRandall Stewart 			if (chk_length < sizeof(struct sctp_asconf_ack_chunk)) {
4204d06c82f1SRandall Stewart 				/* Its not ours */
42056e55db54SRandall Stewart 				if (locked_tcb) {
42066114cd96SRandall Stewart 					SCTP_TCB_UNLOCK(locked_tcb);
42076e55db54SRandall Stewart 				}
4208d06c82f1SRandall Stewart 				*offset = length;
4209d06c82f1SRandall Stewart 				return (NULL);
4210d06c82f1SRandall Stewart 			}
4211ad81507eSRandall Stewart 			if ((stcb) && netp && *netp) {
4212f8829a4aSRandall Stewart 				/* He's alive so give him credit */
4213f8829a4aSRandall Stewart 				stcb->asoc.overall_error_count = 0;
4214f8829a4aSRandall Stewart 				sctp_handle_asconf_ack(m, *offset,
4215f8829a4aSRandall Stewart 				    (struct sctp_asconf_ack_chunk *)ch, stcb, *netp);
42166e55db54SRandall Stewart 			}
4217f8829a4aSRandall Stewart 			break;
4218f8829a4aSRandall Stewart 		case SCTP_FORWARD_CUM_TSN:
4219ad81507eSRandall Stewart 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_FWD-TSN\n");
4220d06c82f1SRandall Stewart 			if (chk_length < sizeof(struct sctp_forward_tsn_chunk)) {
4221d06c82f1SRandall Stewart 				/* Its not ours */
42226e55db54SRandall Stewart 				if (locked_tcb) {
42236114cd96SRandall Stewart 					SCTP_TCB_UNLOCK(locked_tcb);
42246e55db54SRandall Stewart 				}
4225d06c82f1SRandall Stewart 				*offset = length;
4226d06c82f1SRandall Stewart 				return (NULL);
4227d06c82f1SRandall Stewart 			}
4228f8829a4aSRandall Stewart 			/* He's alive so give him credit */
42296e55db54SRandall Stewart 			if (stcb) {
4230f8829a4aSRandall Stewart 				int abort_flag = 0;
4231f8829a4aSRandall Stewart 
4232f8829a4aSRandall Stewart 				stcb->asoc.overall_error_count = 0;
4233f8829a4aSRandall Stewart 				*fwd_tsn_seen = 1;
4234f8829a4aSRandall Stewart 				if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4235f8829a4aSRandall Stewart 					/* We are not interested anymore */
4236a5d547adSRandall Stewart 					sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_28);
4237f8829a4aSRandall Stewart 					*offset = length;
4238f8829a4aSRandall Stewart 					return (NULL);
4239f8829a4aSRandall Stewart 				}
4240f8829a4aSRandall Stewart 				sctp_handle_forward_tsn(stcb,
4241f8829a4aSRandall Stewart 				    (struct sctp_forward_tsn_chunk *)ch, &abort_flag);
4242f8829a4aSRandall Stewart 				if (abort_flag) {
4243f8829a4aSRandall Stewart 					*offset = length;
4244f8829a4aSRandall Stewart 					return (NULL);
4245f8829a4aSRandall Stewart 				} else {
4246f8829a4aSRandall Stewart 					stcb->asoc.overall_error_count = 0;
4247f8829a4aSRandall Stewart 				}
4248f8829a4aSRandall Stewart 
4249f8829a4aSRandall Stewart 			}
4250f8829a4aSRandall Stewart 			break;
4251f8829a4aSRandall Stewart 		case SCTP_STREAM_RESET:
4252ad81507eSRandall Stewart 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_STREAM_RESET\n");
4253f8829a4aSRandall Stewart 			ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
4254f8829a4aSRandall Stewart 			    chk_length, chunk_buf);
4255ad81507eSRandall Stewart 			if (((stcb == NULL) || (ch == NULL) || (chk_length < sizeof(struct sctp_stream_reset_tsn_req)))) {
4256d06c82f1SRandall Stewart 				/* Its not ours */
42576e55db54SRandall Stewart 				if (locked_tcb) {
42586114cd96SRandall Stewart 					SCTP_TCB_UNLOCK(locked_tcb);
42596e55db54SRandall Stewart 				}
4260d06c82f1SRandall Stewart 				*offset = length;
4261d06c82f1SRandall Stewart 				return (NULL);
4262d06c82f1SRandall Stewart 			}
4263f8829a4aSRandall Stewart 			if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4264f8829a4aSRandall Stewart 				/* We are not interested anymore */
4265a5d547adSRandall Stewart 				sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_29);
4266f8829a4aSRandall Stewart 				*offset = length;
4267f8829a4aSRandall Stewart 				return (NULL);
4268f8829a4aSRandall Stewart 			}
4269f8829a4aSRandall Stewart 			if (stcb->asoc.peer_supports_strreset == 0) {
4270f8829a4aSRandall Stewart 				/*
4271ad81507eSRandall Stewart 				 * hmm, peer should have announced this, but
4272ad81507eSRandall Stewart 				 * we will turn it on since he is sending us
4273ad81507eSRandall Stewart 				 * a stream reset.
4274f8829a4aSRandall Stewart 				 */
4275f8829a4aSRandall Stewart 				stcb->asoc.peer_supports_strreset = 1;
4276f8829a4aSRandall Stewart 			}
4277f8829a4aSRandall Stewart 			if (sctp_handle_stream_reset(stcb, (struct sctp_stream_reset_out_req *)ch)) {
4278f8829a4aSRandall Stewart 				/* stop processing */
4279f8829a4aSRandall Stewart 				*offset = length;
4280f8829a4aSRandall Stewart 				return (NULL);
4281f8829a4aSRandall Stewart 			}
4282f8829a4aSRandall Stewart 			break;
4283f8829a4aSRandall Stewart 		case SCTP_PACKET_DROPPED:
4284ad81507eSRandall Stewart 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_PACKET_DROPPED\n");
4285f8829a4aSRandall Stewart 			/* re-get it all please */
4286d06c82f1SRandall Stewart 			if (chk_length < sizeof(struct sctp_pktdrop_chunk)) {
4287d06c82f1SRandall Stewart 				/* Its not ours */
42886e55db54SRandall Stewart 				if (locked_tcb) {
42896114cd96SRandall Stewart 					SCTP_TCB_UNLOCK(locked_tcb);
42906e55db54SRandall Stewart 				}
4291d06c82f1SRandall Stewart 				*offset = length;
4292d06c82f1SRandall Stewart 				return (NULL);
4293d06c82f1SRandall Stewart 			}
4294f8829a4aSRandall Stewart 			ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
4295f8829a4aSRandall Stewart 			    chk_length, chunk_buf);
4296f8829a4aSRandall Stewart 
4297ad81507eSRandall Stewart 			if (ch && (stcb) && netp && (*netp)) {
4298f8829a4aSRandall Stewart 				sctp_handle_packet_dropped((struct sctp_pktdrop_chunk *)ch,
4299f8829a4aSRandall Stewart 				    stcb, *netp);
43006e55db54SRandall Stewart 			}
4301f8829a4aSRandall Stewart 			break;
4302f8829a4aSRandall Stewart 
4303f8829a4aSRandall Stewart 		case SCTP_AUTHENTICATION:
4304ad81507eSRandall Stewart 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_AUTHENTICATION\n");
4305f8829a4aSRandall Stewart 			if (sctp_auth_disable)
4306f8829a4aSRandall Stewart 				goto unknown_chunk;
4307f8829a4aSRandall Stewart 
4308f8829a4aSRandall Stewart 			if (stcb == NULL) {
4309f8829a4aSRandall Stewart 				/* save the first AUTH for later processing */
4310f8829a4aSRandall Stewart 				if (auth_skipped == 0) {
4311f8829a4aSRandall Stewart 					auth_offset = *offset;
4312f8829a4aSRandall Stewart 					auth_len = chk_length;
4313f8829a4aSRandall Stewart 					auth_skipped = 1;
4314f8829a4aSRandall Stewart 				}
4315f8829a4aSRandall Stewart 				/* skip this chunk (temporarily) */
4316f8829a4aSRandall Stewart 				goto next_chunk;
4317f8829a4aSRandall Stewart 			}
4318d06c82f1SRandall Stewart 			if ((chk_length < (sizeof(struct sctp_auth_chunk))) ||
4319ad81507eSRandall Stewart 			    (chk_length > (sizeof(struct sctp_auth_chunk) +
4320ad81507eSRandall Stewart 			    SCTP_AUTH_DIGEST_LEN_MAX))) {
4321d06c82f1SRandall Stewart 				/* Its not ours */
43226e55db54SRandall Stewart 				if (locked_tcb) {
43236114cd96SRandall Stewart 					SCTP_TCB_UNLOCK(locked_tcb);
43246e55db54SRandall Stewart 				}
4325d06c82f1SRandall Stewart 				*offset = length;
4326d06c82f1SRandall Stewart 				return (NULL);
4327d06c82f1SRandall Stewart 			}
4328f8829a4aSRandall Stewart 			if (got_auth == 1) {
4329f8829a4aSRandall Stewart 				/* skip this chunk... it's already auth'd */
4330f8829a4aSRandall Stewart 				goto next_chunk;
4331f8829a4aSRandall Stewart 			}
4332f8829a4aSRandall Stewart 			ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
4333f8829a4aSRandall Stewart 			    chk_length, chunk_buf);
4334f8829a4aSRandall Stewart 			got_auth = 1;
4335ad81507eSRandall Stewart 			if ((ch == NULL) || sctp_handle_auth(stcb, (struct sctp_auth_chunk *)ch,
4336f8829a4aSRandall Stewart 			    m, *offset)) {
4337f8829a4aSRandall Stewart 				/* auth HMAC failed so dump the packet */
4338f8829a4aSRandall Stewart 				*offset = length;
4339f8829a4aSRandall Stewart 				return (stcb);
4340f8829a4aSRandall Stewart 			} else {
4341f8829a4aSRandall Stewart 				/* remaining chunks are HMAC checked */
4342f8829a4aSRandall Stewart 				stcb->asoc.authenticated = 1;
4343f8829a4aSRandall Stewart 			}
4344f8829a4aSRandall Stewart 			break;
4345f8829a4aSRandall Stewart 
4346f8829a4aSRandall Stewart 		default:
4347f8829a4aSRandall Stewart 	unknown_chunk:
4348f8829a4aSRandall Stewart 			/* it's an unknown chunk! */
4349f8829a4aSRandall Stewart 			if ((ch->chunk_type & 0x40) && (stcb != NULL)) {
4350f8829a4aSRandall Stewart 				struct mbuf *mm;
4351f8829a4aSRandall Stewart 				struct sctp_paramhdr *phd;
4352f8829a4aSRandall Stewart 
4353f8829a4aSRandall Stewart 				mm = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr),
4354139bc87fSRandall Stewart 				    0, M_DONTWAIT, 1, MT_DATA);
4355f8829a4aSRandall Stewart 				if (mm) {
4356f8829a4aSRandall Stewart 					phd = mtod(mm, struct sctp_paramhdr *);
4357f8829a4aSRandall Stewart 					/*
4358f8829a4aSRandall Stewart 					 * We cheat and use param type since
4359f8829a4aSRandall Stewart 					 * we did not bother to define a
4360f8829a4aSRandall Stewart 					 * error cause struct. They are the
4361f8829a4aSRandall Stewart 					 * same basic format with different
4362f8829a4aSRandall Stewart 					 * names.
4363f8829a4aSRandall Stewart 					 */
4364f8829a4aSRandall Stewart 					phd->param_type = htons(SCTP_CAUSE_UNRECOG_CHUNK);
4365f8829a4aSRandall Stewart 					phd->param_length = htons(chk_length + sizeof(*phd));
4366139bc87fSRandall Stewart 					SCTP_BUF_LEN(mm) = sizeof(*phd);
436744b7479bSRandall Stewart 					SCTP_BUF_NEXT(mm) = SCTP_M_COPYM(m, *offset, SCTP_SIZE32(chk_length),
4368f8829a4aSRandall Stewart 					    M_DONTWAIT);
4369139bc87fSRandall Stewart 					if (SCTP_BUF_NEXT(mm)) {
4370f8829a4aSRandall Stewart 						sctp_queue_op_err(stcb, mm);
4371f8829a4aSRandall Stewart 					} else {
4372f8829a4aSRandall Stewart 						sctp_m_freem(mm);
4373f8829a4aSRandall Stewart 					}
4374f8829a4aSRandall Stewart 				}
4375f8829a4aSRandall Stewart 			}
4376f8829a4aSRandall Stewart 			if ((ch->chunk_type & 0x80) == 0) {
4377f8829a4aSRandall Stewart 				/* discard this packet */
4378f8829a4aSRandall Stewart 				*offset = length;
4379f8829a4aSRandall Stewart 				return (stcb);
4380f8829a4aSRandall Stewart 			}	/* else skip this bad chunk and continue... */
4381f8829a4aSRandall Stewart 			break;
4382f8829a4aSRandall Stewart 		}		/* switch (ch->chunk_type) */
4383f8829a4aSRandall Stewart 
4384f8829a4aSRandall Stewart 
4385f8829a4aSRandall Stewart next_chunk:
4386f8829a4aSRandall Stewart 		/* get the next chunk */
4387f8829a4aSRandall Stewart 		*offset += SCTP_SIZE32(chk_length);
4388f8829a4aSRandall Stewart 		if (*offset >= length) {
4389f8829a4aSRandall Stewart 			/* no more data left in the mbuf chain */
4390f8829a4aSRandall Stewart 			break;
4391f8829a4aSRandall Stewart 		}
4392f8829a4aSRandall Stewart 		ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
4393f8829a4aSRandall Stewart 		    sizeof(struct sctp_chunkhdr), chunk_buf);
4394f8829a4aSRandall Stewart 		if (ch == NULL) {
43956e55db54SRandall Stewart 			if (locked_tcb) {
4396f8829a4aSRandall Stewart 				SCTP_TCB_UNLOCK(locked_tcb);
43976e55db54SRandall Stewart 			}
4398f8829a4aSRandall Stewart 			*offset = length;
4399f8829a4aSRandall Stewart 			return (NULL);
4400f8829a4aSRandall Stewart 		}
4401f8829a4aSRandall Stewart 	}			/* while */
4402f8829a4aSRandall Stewart 	return (stcb);
4403f8829a4aSRandall Stewart }
4404f8829a4aSRandall Stewart 
4405f8829a4aSRandall Stewart 
4406f8829a4aSRandall Stewart /*
4407f8829a4aSRandall Stewart  * Process the ECN bits we have something set so we must look to see if it is
4408f8829a4aSRandall Stewart  * ECN(0) or ECN(1) or CE
4409f8829a4aSRandall Stewart  */
4410f8829a4aSRandall Stewart static __inline void
4411f8829a4aSRandall Stewart sctp_process_ecn_marked_a(struct sctp_tcb *stcb, struct sctp_nets *net,
4412f8829a4aSRandall Stewart     uint8_t ecn_bits)
4413f8829a4aSRandall Stewart {
4414f8829a4aSRandall Stewart 	if ((ecn_bits & SCTP_CE_BITS) == SCTP_CE_BITS) {
4415f8829a4aSRandall Stewart 		;
4416f8829a4aSRandall Stewart 	} else if ((ecn_bits & SCTP_ECT1_BIT) == SCTP_ECT1_BIT) {
4417f8829a4aSRandall Stewart 		/*
4418f8829a4aSRandall Stewart 		 * we only add to the nonce sum for ECT1, ECT0 does not
4419f8829a4aSRandall Stewart 		 * change the NS bit (that we have yet to find a way to send
4420f8829a4aSRandall Stewart 		 * it yet).
4421f8829a4aSRandall Stewart 		 */
4422f8829a4aSRandall Stewart 
4423f8829a4aSRandall Stewart 		/* ECN Nonce stuff */
4424f8829a4aSRandall Stewart 		stcb->asoc.receiver_nonce_sum++;
4425f8829a4aSRandall Stewart 		stcb->asoc.receiver_nonce_sum &= SCTP_SACK_NONCE_SUM;
4426f8829a4aSRandall Stewart 
4427f8829a4aSRandall Stewart 		/*
4428f8829a4aSRandall Stewart 		 * Drag up the last_echo point if cumack is larger since we
4429f8829a4aSRandall Stewart 		 * don't want the point falling way behind by more than
4430f8829a4aSRandall Stewart 		 * 2^^31 and then having it be incorrect.
4431f8829a4aSRandall Stewart 		 */
4432f8829a4aSRandall Stewart 		if (compare_with_wrap(stcb->asoc.cumulative_tsn,
4433f8829a4aSRandall Stewart 		    stcb->asoc.last_echo_tsn, MAX_TSN)) {
4434f8829a4aSRandall Stewart 			stcb->asoc.last_echo_tsn = stcb->asoc.cumulative_tsn;
4435f8829a4aSRandall Stewart 		}
4436f8829a4aSRandall Stewart 	} else if ((ecn_bits & SCTP_ECT0_BIT) == SCTP_ECT0_BIT) {
4437f8829a4aSRandall Stewart 		/*
4438f8829a4aSRandall Stewart 		 * Drag up the last_echo point if cumack is larger since we
4439f8829a4aSRandall Stewart 		 * don't want the point falling way behind by more than
4440f8829a4aSRandall Stewart 		 * 2^^31 and then having it be incorrect.
4441f8829a4aSRandall Stewart 		 */
4442f8829a4aSRandall Stewart 		if (compare_with_wrap(stcb->asoc.cumulative_tsn,
4443f8829a4aSRandall Stewart 		    stcb->asoc.last_echo_tsn, MAX_TSN)) {
4444f8829a4aSRandall Stewart 			stcb->asoc.last_echo_tsn = stcb->asoc.cumulative_tsn;
4445f8829a4aSRandall Stewart 		}
4446f8829a4aSRandall Stewart 	}
4447f8829a4aSRandall Stewart }
4448f8829a4aSRandall Stewart 
4449f8829a4aSRandall Stewart static __inline void
4450f8829a4aSRandall Stewart sctp_process_ecn_marked_b(struct sctp_tcb *stcb, struct sctp_nets *net,
4451f8829a4aSRandall Stewart     uint32_t high_tsn, uint8_t ecn_bits)
4452f8829a4aSRandall Stewart {
4453f8829a4aSRandall Stewart 	if ((ecn_bits & SCTP_CE_BITS) == SCTP_CE_BITS) {
4454f8829a4aSRandall Stewart 		/*
4455f8829a4aSRandall Stewart 		 * we possibly must notify the sender that a congestion
4456f8829a4aSRandall Stewart 		 * window reduction is in order. We do this by adding a ECNE
4457f8829a4aSRandall Stewart 		 * chunk to the output chunk queue. The incoming CWR will
4458f8829a4aSRandall Stewart 		 * remove this chunk.
4459f8829a4aSRandall Stewart 		 */
4460f8829a4aSRandall Stewart 		if (compare_with_wrap(high_tsn, stcb->asoc.last_echo_tsn,
4461f8829a4aSRandall Stewart 		    MAX_TSN)) {
4462f8829a4aSRandall Stewart 			/* Yep, we need to add a ECNE */
4463f8829a4aSRandall Stewart 			sctp_send_ecn_echo(stcb, net, high_tsn);
4464f8829a4aSRandall Stewart 			stcb->asoc.last_echo_tsn = high_tsn;
4465f8829a4aSRandall Stewart 		}
4466f8829a4aSRandall Stewart 	}
4467f8829a4aSRandall Stewart }
4468f8829a4aSRandall Stewart 
4469f8829a4aSRandall Stewart /*
4470f8829a4aSRandall Stewart  * common input chunk processing (v4 and v6)
4471f8829a4aSRandall Stewart  */
44726e55db54SRandall Stewart void
4473f8829a4aSRandall Stewart sctp_common_input_processing(struct mbuf **mm, int iphlen, int offset,
4474f8829a4aSRandall Stewart     int length, struct sctphdr *sh, struct sctp_chunkhdr *ch,
4475f8829a4aSRandall Stewart     struct sctp_inpcb *inp, struct sctp_tcb *stcb, struct sctp_nets *net,
447617205eccSRandall Stewart     uint8_t ecn_bits, uint32_t vrf_id, uint32_t table_id)
4477f8829a4aSRandall Stewart {
4478f8829a4aSRandall Stewart 	/*
4479f8829a4aSRandall Stewart 	 * Control chunk processing
4480f8829a4aSRandall Stewart 	 */
4481f8829a4aSRandall Stewart 	uint32_t high_tsn;
4482f8829a4aSRandall Stewart 	int fwd_tsn_seen = 0, data_processed = 0;
4483f8829a4aSRandall Stewart 	struct mbuf *m = *mm;
4484f8829a4aSRandall Stewart 	int abort_flag = 0;
4485f8829a4aSRandall Stewart 	int un_sent;
4486f8829a4aSRandall Stewart 
4487f8829a4aSRandall Stewart 	SCTP_STAT_INCR(sctps_recvdatagrams);
4488f8829a4aSRandall Stewart #ifdef SCTP_AUDITING_ENABLED
4489f8829a4aSRandall Stewart 	sctp_audit_log(0xE0, 1);
4490f8829a4aSRandall Stewart 	sctp_auditing(0, inp, stcb, net);
4491f8829a4aSRandall Stewart #endif
4492f8829a4aSRandall Stewart 
4493ad81507eSRandall Stewart 	SCTPDBG(SCTP_DEBUG_INPUT1, "Ok, Common input processing called, m:%p iphlen:%d offset:%d\n",
449450cec919SRandall Stewart 	    m, iphlen, offset);
4495f8829a4aSRandall Stewart 
4496f8829a4aSRandall Stewart 	if (stcb) {
4497f8829a4aSRandall Stewart 		/* always clear this before beginning a packet */
4498f8829a4aSRandall Stewart 		stcb->asoc.authenticated = 0;
4499f8829a4aSRandall Stewart 		stcb->asoc.seen_a_sack_this_pkt = 0;
4500f8829a4aSRandall Stewart 	}
4501f8829a4aSRandall Stewart 	if (IS_SCTP_CONTROL(ch)) {
4502f8829a4aSRandall Stewart 		/* process the control portion of the SCTP packet */
45033c503c28SRandall Stewart 		/* sa_ignore NO_NULL_CHK */
4504f8829a4aSRandall Stewart 		stcb = sctp_process_control(m, iphlen, &offset, length, sh, ch,
450517205eccSRandall Stewart 		    inp, stcb, &net, &fwd_tsn_seen, vrf_id, table_id);
4506f8829a4aSRandall Stewart 		if (stcb) {
4507f8829a4aSRandall Stewart 			/*
4508f8829a4aSRandall Stewart 			 * This covers us if the cookie-echo was there and
4509f8829a4aSRandall Stewart 			 * it changes our INP.
4510f8829a4aSRandall Stewart 			 */
4511f8829a4aSRandall Stewart 			inp = stcb->sctp_ep;
4512f8829a4aSRandall Stewart 		}
4513f8829a4aSRandall Stewart 	} else {
4514f8829a4aSRandall Stewart 		/*
4515f8829a4aSRandall Stewart 		 * no control chunks, so pre-process DATA chunks (these
4516f8829a4aSRandall Stewart 		 * checks are taken care of by control processing)
4517f8829a4aSRandall Stewart 		 */
4518f8829a4aSRandall Stewart 
4519f8829a4aSRandall Stewart 		/*
4520f8829a4aSRandall Stewart 		 * if DATA only packet, and auth is required, then punt...
4521f8829a4aSRandall Stewart 		 * can't have authenticated without any AUTH (control)
4522f8829a4aSRandall Stewart 		 * chunks
4523f8829a4aSRandall Stewart 		 */
4524f8829a4aSRandall Stewart 		if ((stcb != NULL) && !sctp_auth_disable &&
4525f8829a4aSRandall Stewart 		    sctp_auth_is_required_chunk(SCTP_DATA,
4526f8829a4aSRandall Stewart 		    stcb->asoc.local_auth_chunks)) {
4527f8829a4aSRandall Stewart 			/* "silently" ignore */
4528f8829a4aSRandall Stewart 			SCTP_STAT_INCR(sctps_recvauthmissing);
4529f8829a4aSRandall Stewart 			SCTP_TCB_UNLOCK(stcb);
45306e55db54SRandall Stewart 			return;
4531f8829a4aSRandall Stewart 		}
4532f8829a4aSRandall Stewart 		if (stcb == NULL) {
4533f8829a4aSRandall Stewart 			/* out of the blue DATA chunk */
453417205eccSRandall Stewart 			sctp_handle_ootb(m, iphlen, offset, sh, inp, NULL,
453517205eccSRandall Stewart 			    vrf_id, table_id);
45366e55db54SRandall Stewart 			return;
4537f8829a4aSRandall Stewart 		}
4538f8829a4aSRandall Stewart 		if (stcb->asoc.my_vtag != ntohl(sh->v_tag)) {
4539f8829a4aSRandall Stewart 			/* v_tag mismatch! */
4540f8829a4aSRandall Stewart 			SCTP_STAT_INCR(sctps_badvtag);
4541f8829a4aSRandall Stewart 			SCTP_TCB_UNLOCK(stcb);
45426e55db54SRandall Stewart 			return;
4543f8829a4aSRandall Stewart 		}
4544f8829a4aSRandall Stewart 	}
4545f8829a4aSRandall Stewart 
4546f8829a4aSRandall Stewart 	if (stcb == NULL) {
4547f8829a4aSRandall Stewart 		/*
4548f8829a4aSRandall Stewart 		 * no valid TCB for this packet, or we found it's a bad
4549f8829a4aSRandall Stewart 		 * packet while processing control, or we're done with this
4550f8829a4aSRandall Stewart 		 * packet (done or skip rest of data), so we drop it...
4551f8829a4aSRandall Stewart 		 */
45526e55db54SRandall Stewart 		return;
4553f8829a4aSRandall Stewart 	}
4554f8829a4aSRandall Stewart 	/*
4555f8829a4aSRandall Stewart 	 * DATA chunk processing
4556f8829a4aSRandall Stewart 	 */
4557f8829a4aSRandall Stewart 	/* plow through the data chunks while length > offset */
4558f8829a4aSRandall Stewart 
4559f8829a4aSRandall Stewart 	/*
4560f8829a4aSRandall Stewart 	 * Rest should be DATA only.  Check authentication state if AUTH for
4561f8829a4aSRandall Stewart 	 * DATA is required.
4562f8829a4aSRandall Stewart 	 */
4563a5d547adSRandall Stewart 	if ((length > offset) && (stcb != NULL) && !sctp_auth_disable &&
4564f8829a4aSRandall Stewart 	    sctp_auth_is_required_chunk(SCTP_DATA,
4565f8829a4aSRandall Stewart 	    stcb->asoc.local_auth_chunks) &&
4566f8829a4aSRandall Stewart 	    !stcb->asoc.authenticated) {
4567f8829a4aSRandall Stewart 		/* "silently" ignore */
4568f8829a4aSRandall Stewart 		SCTP_STAT_INCR(sctps_recvauthmissing);
4569ad81507eSRandall Stewart 		SCTPDBG(SCTP_DEBUG_AUTH1,
4570ad81507eSRandall Stewart 		    "Data chunk requires AUTH, skipped\n");
4571a5d547adSRandall Stewart 		goto trigger_send;
4572f8829a4aSRandall Stewart 	}
4573f8829a4aSRandall Stewart 	if (length > offset) {
4574f8829a4aSRandall Stewart 		int retval;
4575f8829a4aSRandall Stewart 
4576f8829a4aSRandall Stewart 		/*
4577f8829a4aSRandall Stewart 		 * First check to make sure our state is correct. We would
4578f8829a4aSRandall Stewart 		 * not get here unless we really did have a tag, so we don't
4579f8829a4aSRandall Stewart 		 * abort if this happens, just dump the chunk silently.
4580f8829a4aSRandall Stewart 		 */
4581f8829a4aSRandall Stewart 		switch (SCTP_GET_STATE(&stcb->asoc)) {
4582f8829a4aSRandall Stewart 		case SCTP_STATE_COOKIE_ECHOED:
4583f8829a4aSRandall Stewart 			/*
4584f8829a4aSRandall Stewart 			 * we consider data with valid tags in this state
4585f8829a4aSRandall Stewart 			 * shows us the cookie-ack was lost. Imply it was
4586f8829a4aSRandall Stewart 			 * there.
4587f8829a4aSRandall Stewart 			 */
4588f8829a4aSRandall Stewart 			stcb->asoc.overall_error_count = 0;
4589f8829a4aSRandall Stewart 			sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb, net);
4590f8829a4aSRandall Stewart 			break;
4591f8829a4aSRandall Stewart 		case SCTP_STATE_COOKIE_WAIT:
4592f8829a4aSRandall Stewart 			/*
4593f8829a4aSRandall Stewart 			 * We consider OOTB any data sent during asoc setup.
4594f8829a4aSRandall Stewart 			 */
459517205eccSRandall Stewart 			sctp_handle_ootb(m, iphlen, offset, sh, inp, NULL,
459617205eccSRandall Stewart 			    vrf_id, table_id);
4597f8829a4aSRandall Stewart 			SCTP_TCB_UNLOCK(stcb);
45986e55db54SRandall Stewart 			return;
4599f8829a4aSRandall Stewart 			break;
4600f8829a4aSRandall Stewart 		case SCTP_STATE_EMPTY:	/* should not happen */
4601f8829a4aSRandall Stewart 		case SCTP_STATE_INUSE:	/* should not happen */
4602f8829a4aSRandall Stewart 		case SCTP_STATE_SHUTDOWN_RECEIVED:	/* This is a peer error */
4603f8829a4aSRandall Stewart 		case SCTP_STATE_SHUTDOWN_ACK_SENT:
4604f8829a4aSRandall Stewart 		default:
4605f8829a4aSRandall Stewart 			SCTP_TCB_UNLOCK(stcb);
46066e55db54SRandall Stewart 			return;
4607f8829a4aSRandall Stewart 			break;
4608f8829a4aSRandall Stewart 		case SCTP_STATE_OPEN:
4609f8829a4aSRandall Stewart 		case SCTP_STATE_SHUTDOWN_SENT:
4610f8829a4aSRandall Stewart 			break;
4611f8829a4aSRandall Stewart 		}
4612f8829a4aSRandall Stewart 		/* take care of ECN, part 1. */
4613f8829a4aSRandall Stewart 		if (stcb->asoc.ecn_allowed &&
4614f8829a4aSRandall Stewart 		    (ecn_bits & (SCTP_ECT0_BIT | SCTP_ECT1_BIT))) {
4615f8829a4aSRandall Stewart 			sctp_process_ecn_marked_a(stcb, net, ecn_bits);
4616f8829a4aSRandall Stewart 		}
4617f8829a4aSRandall Stewart 		/* plow through the data chunks while length > offset */
4618f8829a4aSRandall Stewart 		retval = sctp_process_data(mm, iphlen, &offset, length, sh,
4619f8829a4aSRandall Stewart 		    inp, stcb, net, &high_tsn);
4620f8829a4aSRandall Stewart 		if (retval == 2) {
4621f8829a4aSRandall Stewart 			/*
4622f8829a4aSRandall Stewart 			 * The association aborted, NO UNLOCK needed since
4623f8829a4aSRandall Stewart 			 * the association is destroyed.
4624f8829a4aSRandall Stewart 			 */
46256e55db54SRandall Stewart 			return;
4626f8829a4aSRandall Stewart 		}
4627f8829a4aSRandall Stewart 		data_processed = 1;
4628f8829a4aSRandall Stewart 		if (retval == 0) {
4629f8829a4aSRandall Stewart 			/* take care of ecn part 2. */
4630f8829a4aSRandall Stewart 			if (stcb->asoc.ecn_allowed &&
4631f8829a4aSRandall Stewart 			    (ecn_bits & (SCTP_ECT0_BIT | SCTP_ECT1_BIT))) {
4632f8829a4aSRandall Stewart 				sctp_process_ecn_marked_b(stcb, net, high_tsn,
4633f8829a4aSRandall Stewart 				    ecn_bits);
4634f8829a4aSRandall Stewart 			}
4635f8829a4aSRandall Stewart 		}
4636f8829a4aSRandall Stewart 		/*
4637f8829a4aSRandall Stewart 		 * Anything important needs to have been m_copy'ed in
4638f8829a4aSRandall Stewart 		 * process_data
4639f8829a4aSRandall Stewart 		 */
4640f8829a4aSRandall Stewart 	}
4641f8829a4aSRandall Stewart 	if ((data_processed == 0) && (fwd_tsn_seen)) {
4642f8829a4aSRandall Stewart 		int was_a_gap = 0;
4643f8829a4aSRandall Stewart 
4644f8829a4aSRandall Stewart 		if (compare_with_wrap(stcb->asoc.highest_tsn_inside_map,
4645f8829a4aSRandall Stewart 		    stcb->asoc.cumulative_tsn, MAX_TSN)) {
4646f8829a4aSRandall Stewart 			/* there was a gap before this data was processed */
4647f8829a4aSRandall Stewart 			was_a_gap = 1;
4648f8829a4aSRandall Stewart 		}
4649f8829a4aSRandall Stewart 		sctp_sack_check(stcb, 1, was_a_gap, &abort_flag);
4650f8829a4aSRandall Stewart 		if (abort_flag) {
4651f8829a4aSRandall Stewart 			/* Again, we aborted so NO UNLOCK needed */
46526e55db54SRandall Stewart 			return;
4653f8829a4aSRandall Stewart 		}
4654f8829a4aSRandall Stewart 	}
4655f8829a4aSRandall Stewart 	/* trigger send of any chunks in queue... */
4656a5d547adSRandall Stewart trigger_send:
4657f8829a4aSRandall Stewart #ifdef SCTP_AUDITING_ENABLED
4658f8829a4aSRandall Stewart 	sctp_audit_log(0xE0, 2);
4659f8829a4aSRandall Stewart 	sctp_auditing(1, inp, stcb, net);
4660f8829a4aSRandall Stewart #endif
4661ad81507eSRandall Stewart 	SCTPDBG(SCTP_DEBUG_INPUT1,
4662ad81507eSRandall Stewart 	    "Check for chunk output prw:%d tqe:%d tf=%d\n",
4663f8829a4aSRandall Stewart 	    stcb->asoc.peers_rwnd,
4664f8829a4aSRandall Stewart 	    TAILQ_EMPTY(&stcb->asoc.control_send_queue),
4665f8829a4aSRandall Stewart 	    stcb->asoc.total_flight);
4666f8829a4aSRandall Stewart 	un_sent = (stcb->asoc.total_output_queue_size - stcb->asoc.total_flight);
4667f8829a4aSRandall Stewart 
4668f8829a4aSRandall Stewart 	if (!TAILQ_EMPTY(&stcb->asoc.control_send_queue) ||
4669f8829a4aSRandall Stewart 	    ((un_sent) &&
4670f8829a4aSRandall Stewart 	    (stcb->asoc.peers_rwnd > 0 ||
4671f8829a4aSRandall Stewart 	    (stcb->asoc.peers_rwnd <= 0 && stcb->asoc.total_flight == 0)))) {
4672ad81507eSRandall Stewart 		SCTPDBG(SCTP_DEBUG_INPUT3, "Calling chunk OUTPUT\n");
4673f8829a4aSRandall Stewart 		sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC);
4674ad81507eSRandall Stewart 		SCTPDBG(SCTP_DEBUG_INPUT3, "chunk OUTPUT returns\n");
4675f8829a4aSRandall Stewart 	}
4676f8829a4aSRandall Stewart #ifdef SCTP_AUDITING_ENABLED
4677f8829a4aSRandall Stewart 	sctp_audit_log(0xE0, 3);
4678f8829a4aSRandall Stewart 	sctp_auditing(2, inp, stcb, net);
4679f8829a4aSRandall Stewart #endif
4680f8829a4aSRandall Stewart 	SCTP_TCB_UNLOCK(stcb);
46816e55db54SRandall Stewart 	return;
4682f8829a4aSRandall Stewart }
4683f8829a4aSRandall Stewart 
4684a5d547adSRandall Stewart 
4685a5d547adSRandall Stewart 
4686f8829a4aSRandall Stewart void
4687139bc87fSRandall Stewart sctp_input(i_pak, off)
4688139bc87fSRandall Stewart 	struct mbuf *i_pak;
4689f8829a4aSRandall Stewart 	int off;
4690f8829a4aSRandall Stewart 
4691f8829a4aSRandall Stewart {
4692f8829a4aSRandall Stewart #ifdef SCTP_MBUF_LOGGING
4693f8829a4aSRandall Stewart 	struct mbuf *mat;
4694f8829a4aSRandall Stewart 
4695f8829a4aSRandall Stewart #endif
4696139bc87fSRandall Stewart 	struct mbuf *m;
4697f8829a4aSRandall Stewart 	int iphlen;
469817205eccSRandall Stewart 	uint32_t vrf_id = 0, table_id = 0;
4699f8829a4aSRandall Stewart 	uint8_t ecn_bits;
4700f8829a4aSRandall Stewart 	struct ip *ip;
4701f8829a4aSRandall Stewart 	struct sctphdr *sh;
4702f8829a4aSRandall Stewart 	struct sctp_inpcb *inp = NULL;
4703f8829a4aSRandall Stewart 
4704f8829a4aSRandall Stewart 	uint32_t check, calc_check;
4705f8829a4aSRandall Stewart 	struct sctp_nets *net;
4706f8829a4aSRandall Stewart 	struct sctp_tcb *stcb = NULL;
4707f8829a4aSRandall Stewart 	struct sctp_chunkhdr *ch;
4708f8829a4aSRandall Stewart 	int refcount_up = 0;
4709f8829a4aSRandall Stewart 	int length, mlen, offset;
4710f8829a4aSRandall Stewart 
471117205eccSRandall Stewart 
471217205eccSRandall Stewart 	if (SCTP_GET_PKT_VRFID(i_pak, vrf_id)) {
471317205eccSRandall Stewart 		SCTP_RELEASE_PKT(i_pak);
471417205eccSRandall Stewart 		return;
471517205eccSRandall Stewart 	}
471617205eccSRandall Stewart 	if (SCTP_GET_PKT_TABLEID(i_pak, table_id)) {
471717205eccSRandall Stewart 		SCTP_RELEASE_PKT(i_pak);
471817205eccSRandall Stewart 		return;
471917205eccSRandall Stewart 	}
4720bff64a4dSRandall Stewart 	mlen = SCTP_HEADER_LEN(i_pak);
4721f8829a4aSRandall Stewart 	iphlen = off;
4722139bc87fSRandall Stewart 	m = SCTP_HEADER_TO_CHAIN(i_pak);
4723d61a0ae0SRandall Stewart 
4724f8829a4aSRandall Stewart 	net = NULL;
4725f8829a4aSRandall Stewart 	SCTP_STAT_INCR(sctps_recvpackets);
4726f8829a4aSRandall Stewart 	SCTP_STAT_INCR_COUNTER64(sctps_inpackets);
4727f8829a4aSRandall Stewart 
4728207304d4SRandall Stewart 
4729f8829a4aSRandall Stewart #ifdef SCTP_MBUF_LOGGING
4730f8829a4aSRandall Stewart 	/* Log in any input mbufs */
4731f8829a4aSRandall Stewart 	mat = m;
4732f8829a4aSRandall Stewart 	while (mat) {
4733139bc87fSRandall Stewart 		if (SCTP_BUF_IS_EXTENDED(mat)) {
4734f8829a4aSRandall Stewart 			sctp_log_mb(mat, SCTP_MBUF_INPUT);
4735f8829a4aSRandall Stewart 		}
4736139bc87fSRandall Stewart 		mat = SCTP_BUF_NEXT(mat);
4737f8829a4aSRandall Stewart 	}
4738f8829a4aSRandall Stewart #endif
4739207304d4SRandall Stewart #ifdef  SCTP_PACKET_LOGGING
4740207304d4SRandall Stewart 	sctp_packet_log(m, mlen);
4741207304d4SRandall Stewart #endif
4742207304d4SRandall Stewart 	/*
4743207304d4SRandall Stewart 	 * Must take out the iphlen, since mlen expects this (only effect lb
4744207304d4SRandall Stewart 	 * case)
4745207304d4SRandall Stewart 	 */
4746207304d4SRandall Stewart 	mlen -= iphlen;
47475e54f665SRandall Stewart 
4748f8829a4aSRandall Stewart 	/*
4749f8829a4aSRandall Stewart 	 * Get IP, SCTP, and first chunk header together in first mbuf.
4750f8829a4aSRandall Stewart 	 */
4751f8829a4aSRandall Stewart 	ip = mtod(m, struct ip *);
4752f8829a4aSRandall Stewart 	offset = iphlen + sizeof(*sh) + sizeof(*ch);
4753139bc87fSRandall Stewart 	if (SCTP_BUF_LEN(m) < offset) {
4754f8829a4aSRandall Stewart 		if ((m = m_pullup(m, offset)) == 0) {
4755f8829a4aSRandall Stewart 			SCTP_STAT_INCR(sctps_hdrops);
4756f8829a4aSRandall Stewart 			return;
4757f8829a4aSRandall Stewart 		}
4758f8829a4aSRandall Stewart 		ip = mtod(m, struct ip *);
4759f8829a4aSRandall Stewart 	}
4760f8829a4aSRandall Stewart 	sh = (struct sctphdr *)((caddr_t)ip + iphlen);
4761f8829a4aSRandall Stewart 	ch = (struct sctp_chunkhdr *)((caddr_t)sh + sizeof(*sh));
4762f8829a4aSRandall Stewart 
4763f8829a4aSRandall Stewart 	/* SCTP does not allow broadcasts or multicasts */
4764f8829a4aSRandall Stewart 	if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr))) {
4765f8829a4aSRandall Stewart 		goto bad;
4766f8829a4aSRandall Stewart 	}
47675e54f665SRandall Stewart 	if (SCTP_IS_IT_BROADCAST(ip->ip_dst, m)) {
4768f8829a4aSRandall Stewart 		/*
4769f8829a4aSRandall Stewart 		 * We only look at broadcast if its a front state, All
4770f8829a4aSRandall Stewart 		 * others we will not have a tcb for anyway.
4771f8829a4aSRandall Stewart 		 */
4772f8829a4aSRandall Stewart 		goto bad;
4773f8829a4aSRandall Stewart 	}
4774f8829a4aSRandall Stewart 	/* validate SCTP checksum */
47755e54f665SRandall Stewart 	if ((sctp_no_csum_on_loopback == 0) || !SCTP_IS_IT_LOOPBACK(m)) {
4776f8829a4aSRandall Stewart 		/*
4777f8829a4aSRandall Stewart 		 * we do NOT validate things from the loopback if the sysctl
4778f8829a4aSRandall Stewart 		 * is set to 1.
4779f8829a4aSRandall Stewart 		 */
4780f8829a4aSRandall Stewart 		check = sh->checksum;	/* save incoming checksum */
4781f8829a4aSRandall Stewart 		if ((check == 0) && (sctp_no_csum_on_loopback)) {
4782f8829a4aSRandall Stewart 			/*
4783f8829a4aSRandall Stewart 			 * special hook for where we got a local address
4784f8829a4aSRandall Stewart 			 * somehow routed across a non IFT_LOOP type
4785f8829a4aSRandall Stewart 			 * interface
4786f8829a4aSRandall Stewart 			 */
4787f8829a4aSRandall Stewart 			if (ip->ip_src.s_addr == ip->ip_dst.s_addr)
4788f8829a4aSRandall Stewart 				goto sctp_skip_csum_4;
4789f8829a4aSRandall Stewart 		}
4790f8829a4aSRandall Stewart 		sh->checksum = 0;	/* prepare for calc */
4791f8829a4aSRandall Stewart 		calc_check = sctp_calculate_sum(m, &mlen, iphlen);
4792f8829a4aSRandall Stewart 		if (calc_check != check) {
4793ad81507eSRandall Stewart 			SCTPDBG(SCTP_DEBUG_INPUT1, "Bad CSUM on SCTP packet calc_check:%x check:%x  m:%p mlen:%d iphlen:%d\n",
479450cec919SRandall Stewart 			    calc_check, check, m, mlen, iphlen);
4795f8829a4aSRandall Stewart 
4796f8829a4aSRandall Stewart 			stcb = sctp_findassociation_addr(m, iphlen,
4797f8829a4aSRandall Stewart 			    offset - sizeof(*ch),
4798ad81507eSRandall Stewart 			    sh, ch, &inp, &net,
4799ad81507eSRandall Stewart 			    vrf_id);
4800f8829a4aSRandall Stewart 			if ((inp) && (stcb)) {
4801f8829a4aSRandall Stewart 				sctp_send_packet_dropped(stcb, net, m, iphlen, 1);
4802f8829a4aSRandall Stewart 				sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_INPUT_ERROR);
4803f8829a4aSRandall Stewart 			} else if ((inp != NULL) && (stcb == NULL)) {
4804f8829a4aSRandall Stewart 				refcount_up = 1;
4805f8829a4aSRandall Stewart 			}
4806f8829a4aSRandall Stewart 			SCTP_STAT_INCR(sctps_badsum);
4807f8829a4aSRandall Stewart 			SCTP_STAT_INCR_COUNTER32(sctps_checksumerrors);
4808f8829a4aSRandall Stewart 			goto bad;
4809f8829a4aSRandall Stewart 		}
4810f8829a4aSRandall Stewart 		sh->checksum = calc_check;
48115e54f665SRandall Stewart 	}
4812bff64a4dSRandall Stewart sctp_skip_csum_4:
48135e54f665SRandall Stewart 	/* destination port of 0 is illegal, based on RFC2960. */
48145e54f665SRandall Stewart 	if (sh->dest_port == 0) {
48155e54f665SRandall Stewart 		SCTP_STAT_INCR(sctps_hdrops);
48165e54f665SRandall Stewart 		goto bad;
4817f8829a4aSRandall Stewart 	}
4818f8829a4aSRandall Stewart 	/* validate mbuf chain length with IP payload length */
4819f8829a4aSRandall Stewart 	if (mlen < (ip->ip_len - iphlen)) {
4820f8829a4aSRandall Stewart 		SCTP_STAT_INCR(sctps_hdrops);
4821f8829a4aSRandall Stewart 		goto bad;
4822f8829a4aSRandall Stewart 	}
4823f8829a4aSRandall Stewart 	/*
4824f8829a4aSRandall Stewart 	 * Locate pcb and tcb for datagram sctp_findassociation_addr() wants
4825f8829a4aSRandall Stewart 	 * IP/SCTP/first chunk header...
4826f8829a4aSRandall Stewart 	 */
4827f8829a4aSRandall Stewart 	stcb = sctp_findassociation_addr(m, iphlen, offset - sizeof(*ch),
4828bff64a4dSRandall Stewart 	    sh, ch, &inp, &net, vrf_id);
4829f8829a4aSRandall Stewart 	/* inp's ref-count increased && stcb locked */
4830f8829a4aSRandall Stewart 	if (inp == NULL) {
4831f8829a4aSRandall Stewart 		struct sctp_init_chunk *init_chk, chunk_buf;
4832f8829a4aSRandall Stewart 
4833f8829a4aSRandall Stewart 		SCTP_STAT_INCR(sctps_noport);
4834f8829a4aSRandall Stewart #ifdef ICMP_BANDLIM
4835f8829a4aSRandall Stewart 		/*
4836f8829a4aSRandall Stewart 		 * we use the bandwidth limiting to protect against sending
4837f8829a4aSRandall Stewart 		 * too many ABORTS all at once. In this case these count the
4838f8829a4aSRandall Stewart 		 * same as an ICMP message.
4839f8829a4aSRandall Stewart 		 */
4840f8829a4aSRandall Stewart 		if (badport_bandlim(0) < 0)
4841f8829a4aSRandall Stewart 			goto bad;
4842f8829a4aSRandall Stewart #endif				/* ICMP_BANDLIM */
4843ad81507eSRandall Stewart 		SCTPDBG(SCTP_DEBUG_INPUT1,
4844ad81507eSRandall Stewart 		    "Sending a ABORT from packet entry!\n");
4845f8829a4aSRandall Stewart 		if (ch->chunk_type == SCTP_INITIATION) {
4846f8829a4aSRandall Stewart 			/*
4847f8829a4aSRandall Stewart 			 * we do a trick here to get the INIT tag, dig in
4848f8829a4aSRandall Stewart 			 * and get the tag from the INIT and put it in the
4849f8829a4aSRandall Stewart 			 * common header.
4850f8829a4aSRandall Stewart 			 */
4851f8829a4aSRandall Stewart 			init_chk = (struct sctp_init_chunk *)sctp_m_getptr(m,
4852f8829a4aSRandall Stewart 			    iphlen + sizeof(*sh), sizeof(*init_chk),
4853f8829a4aSRandall Stewart 			    (uint8_t *) & chunk_buf);
4854f8829a4aSRandall Stewart 			if (init_chk != NULL)
4855f8829a4aSRandall Stewart 				sh->v_tag = init_chk->init.initiate_tag;
4856f8829a4aSRandall Stewart 		}
4857a5d547adSRandall Stewart 		if (ch->chunk_type == SCTP_SHUTDOWN_ACK) {
485817205eccSRandall Stewart 			sctp_send_shutdown_complete2(m, iphlen, sh, vrf_id,
485917205eccSRandall Stewart 			    table_id);
4860a5d547adSRandall Stewart 			goto bad;
4861a5d547adSRandall Stewart 		}
4862a5d547adSRandall Stewart 		if (ch->chunk_type == SCTP_SHUTDOWN_COMPLETE) {
4863a5d547adSRandall Stewart 			goto bad;
4864a5d547adSRandall Stewart 		}
4865a5d547adSRandall Stewart 		if (ch->chunk_type != SCTP_ABORT_ASSOCIATION)
486617205eccSRandall Stewart 			sctp_send_abort(m, iphlen, sh, 0, NULL, vrf_id,
486717205eccSRandall Stewart 			    table_id);
4868f8829a4aSRandall Stewart 		goto bad;
4869f8829a4aSRandall Stewart 	} else if (stcb == NULL) {
4870f8829a4aSRandall Stewart 		refcount_up = 1;
4871f8829a4aSRandall Stewart 	}
4872f8829a4aSRandall Stewart #ifdef IPSEC
4873f8829a4aSRandall Stewart 	/*
4874f8829a4aSRandall Stewart 	 * I very much doubt any of the IPSEC stuff will work but I have no
4875f8829a4aSRandall Stewart 	 * idea, so I will leave it in place.
4876f8829a4aSRandall Stewart 	 */
4877f8829a4aSRandall Stewart 
487850cec919SRandall Stewart 	if (inp && ipsec4_in_reject(m, &inp->ip_inp.inp)) {
4879f8829a4aSRandall Stewart 		ipsecstat.in_polvio++;
4880f8829a4aSRandall Stewart 		SCTP_STAT_INCR(sctps_hdrops);
4881f8829a4aSRandall Stewart 		goto bad;
4882f8829a4aSRandall Stewart 	}
4883f8829a4aSRandall Stewart #endif				/* IPSEC */
4884f8829a4aSRandall Stewart 
4885f8829a4aSRandall Stewart 	/*
4886f8829a4aSRandall Stewart 	 * common chunk processing
4887f8829a4aSRandall Stewart 	 */
4888f8829a4aSRandall Stewart 	length = ip->ip_len + iphlen;
4889f8829a4aSRandall Stewart 	offset -= sizeof(struct sctp_chunkhdr);
4890f8829a4aSRandall Stewart 
4891f8829a4aSRandall Stewart 	ecn_bits = ip->ip_tos;
4892f8829a4aSRandall Stewart 
48933c503c28SRandall Stewart 	/* sa_ignore NO_NULL_CHK */
4894f8829a4aSRandall Stewart 	sctp_common_input_processing(&m, iphlen, offset, length, sh, ch,
489517205eccSRandall Stewart 	    inp, stcb, net, ecn_bits, vrf_id,
489617205eccSRandall Stewart 	    table_id);
4897f8829a4aSRandall Stewart 	/* inp's ref-count reduced && stcb unlocked */
4898f8829a4aSRandall Stewart 	if (m) {
4899f8829a4aSRandall Stewart 		sctp_m_freem(m);
4900f8829a4aSRandall Stewart 	}
4901f8829a4aSRandall Stewart 	if ((inp) && (refcount_up)) {
4902f8829a4aSRandall Stewart 		/* reduce ref-count */
4903f8829a4aSRandall Stewart 		SCTP_INP_WLOCK(inp);
4904f8829a4aSRandall Stewart 		SCTP_INP_DECR_REF(inp);
4905f8829a4aSRandall Stewart 		SCTP_INP_WUNLOCK(inp);
4906f8829a4aSRandall Stewart 	}
4907f8829a4aSRandall Stewart 	return;
4908f8829a4aSRandall Stewart bad:
4909ad81507eSRandall Stewart 	if (stcb) {
4910f8829a4aSRandall Stewart 		SCTP_TCB_UNLOCK(stcb);
4911ad81507eSRandall Stewart 	}
4912f8829a4aSRandall Stewart 	if ((inp) && (refcount_up)) {
4913f8829a4aSRandall Stewart 		/* reduce ref-count */
4914f8829a4aSRandall Stewart 		SCTP_INP_WLOCK(inp);
4915f8829a4aSRandall Stewart 		SCTP_INP_DECR_REF(inp);
4916f8829a4aSRandall Stewart 		SCTP_INP_WUNLOCK(inp);
4917f8829a4aSRandall Stewart 	}
4918f8829a4aSRandall Stewart 	if (m) {
4919f8829a4aSRandall Stewart 		sctp_m_freem(m);
4920f8829a4aSRandall Stewart 	}
4921f8829a4aSRandall Stewart 	return;
4922f8829a4aSRandall Stewart }
4923