xref: /freebsd/sys/netinet/sctp_input.c (revision 076ad2f836d5f49dc1375f1677335a48fe0d4b82)
1 /*-
2  * Copyright (c) 2001-2008, by Cisco Systems, Inc. All rights reserved.
3  * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved.
4  * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions are met:
8  *
9  * a) Redistributions of source code must retain the above copyright notice,
10  *    this list of conditions and the following disclaimer.
11  *
12  * b) Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in
14  *    the documentation and/or other materials provided with the distribution.
15  *
16  * c) Neither the name of Cisco Systems, Inc. nor the names of its
17  *    contributors may be used to endorse or promote products derived
18  *    from this software without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
21  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
22  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
24  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
30  * THE POSSIBILITY OF SUCH DAMAGE.
31  */
32 
33 #include <sys/cdefs.h>
34 __FBSDID("$FreeBSD$");
35 
36 #include <netinet/sctp_os.h>
37 #include <netinet/sctp_var.h>
38 #include <netinet/sctp_sysctl.h>
39 #include <netinet/sctp_pcb.h>
40 #include <netinet/sctp_header.h>
41 #include <netinet/sctputil.h>
42 #include <netinet/sctp_output.h>
43 #include <netinet/sctp_input.h>
44 #include <netinet/sctp_auth.h>
45 #include <netinet/sctp_indata.h>
46 #include <netinet/sctp_asconf.h>
47 #include <netinet/sctp_bsd_addr.h>
48 #include <netinet/sctp_timer.h>
49 #include <netinet/sctp_crc32.h>
50 #if defined(INET) || defined(INET6)
51 #include <netinet/udp.h>
52 #endif
53 #include <sys/smp.h>
54 
55 
56 
57 static void
58 sctp_stop_all_cookie_timers(struct sctp_tcb *stcb)
59 {
60 	struct sctp_nets *net;
61 
62 	/*
63 	 * This now not only stops all cookie timers it also stops any INIT
64 	 * timers as well. This will make sure that the timers are stopped
65 	 * in all collision cases.
66 	 */
67 	SCTP_TCB_LOCK_ASSERT(stcb);
68 	TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
69 		if (net->rxt_timer.type == SCTP_TIMER_TYPE_COOKIE) {
70 			sctp_timer_stop(SCTP_TIMER_TYPE_COOKIE,
71 			    stcb->sctp_ep,
72 			    stcb,
73 			    net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_1);
74 		} else if (net->rxt_timer.type == SCTP_TIMER_TYPE_INIT) {
75 			sctp_timer_stop(SCTP_TIMER_TYPE_INIT,
76 			    stcb->sctp_ep,
77 			    stcb,
78 			    net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_2);
79 		}
80 	}
81 }
82 
83 /* INIT handler */
84 static void
85 sctp_handle_init(struct mbuf *m, int iphlen, int offset,
86     struct sockaddr *src, struct sockaddr *dst, struct sctphdr *sh,
87     struct sctp_init_chunk *cp, struct sctp_inpcb *inp,
88     struct sctp_tcb *stcb, struct sctp_nets *net, int *abort_no_unlock,
89     uint8_t mflowtype, uint32_t mflowid,
90     uint32_t vrf_id, uint16_t port)
91 {
92 	struct sctp_init *init;
93 	struct mbuf *op_err;
94 
95 	SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_init: handling INIT tcb:%p\n",
96 	    (void *)stcb);
97 	if (stcb == NULL) {
98 		SCTP_INP_RLOCK(inp);
99 	}
100 	/* validate length */
101 	if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_init_chunk)) {
102 		op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
103 		sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err,
104 		    mflowtype, mflowid,
105 		    vrf_id, port);
106 		if (stcb)
107 			*abort_no_unlock = 1;
108 		goto outnow;
109 	}
110 	/* validate parameters */
111 	init = &cp->init;
112 	if (init->initiate_tag == 0) {
113 		/* protocol error... send abort */
114 		op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
115 		sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err,
116 		    mflowtype, mflowid,
117 		    vrf_id, port);
118 		if (stcb)
119 			*abort_no_unlock = 1;
120 		goto outnow;
121 	}
122 	if (ntohl(init->a_rwnd) < SCTP_MIN_RWND) {
123 		/* invalid parameter... send abort */
124 		op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
125 		sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err,
126 		    mflowtype, mflowid,
127 		    vrf_id, port);
128 		if (stcb)
129 			*abort_no_unlock = 1;
130 		goto outnow;
131 	}
132 	if (init->num_inbound_streams == 0) {
133 		/* protocol error... send abort */
134 		op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
135 		sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err,
136 		    mflowtype, mflowid,
137 		    vrf_id, port);
138 		if (stcb)
139 			*abort_no_unlock = 1;
140 		goto outnow;
141 	}
142 	if (init->num_outbound_streams == 0) {
143 		/* protocol error... send abort */
144 		op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
145 		sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err,
146 		    mflowtype, mflowid,
147 		    vrf_id, port);
148 		if (stcb)
149 			*abort_no_unlock = 1;
150 		goto outnow;
151 	}
152 	if (sctp_validate_init_auth_params(m, offset + sizeof(*cp),
153 	    offset + ntohs(cp->ch.chunk_length))) {
154 		/* auth parameter(s) error... send abort */
155 		op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
156 		    "Problem with AUTH parameters");
157 		sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err,
158 		    mflowtype, mflowid,
159 		    vrf_id, port);
160 		if (stcb)
161 			*abort_no_unlock = 1;
162 		goto outnow;
163 	}
164 	/* We are only accepting if we have a socket with positive
165 	 * so_qlimit. */
166 	if ((stcb == NULL) &&
167 	    ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
168 	    (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
169 	    (inp->sctp_socket == NULL) ||
170 	    (inp->sctp_socket->so_qlimit == 0))) {
171 		/*
172 		 * FIX ME ?? What about TCP model and we have a
173 		 * match/restart case? Actually no fix is needed. the lookup
174 		 * will always find the existing assoc so stcb would not be
175 		 * NULL. It may be questionable to do this since we COULD
176 		 * just send back the INIT-ACK and hope that the app did
177 		 * accept()'s by the time the COOKIE was sent. But there is
178 		 * a price to pay for COOKIE generation and I don't want to
179 		 * pay it on the chance that the app will actually do some
180 		 * accepts(). The App just looses and should NOT be in this
181 		 * state :-)
182 		 */
183 		if (SCTP_BASE_SYSCTL(sctp_blackhole) == 0) {
184 			op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
185 			    "No listener");
186 			sctp_send_abort(m, iphlen, src, dst, sh, 0, op_err,
187 			    mflowtype, mflowid, inp->fibnum,
188 			    vrf_id, port);
189 		}
190 		goto outnow;
191 	}
192 	if ((stcb != NULL) &&
193 	    (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT)) {
194 		SCTPDBG(SCTP_DEBUG_INPUT3, "sctp_handle_init: sending SHUTDOWN-ACK\n");
195 		sctp_send_shutdown_ack(stcb, NULL);
196 		sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC, SCTP_SO_NOT_LOCKED);
197 	} else {
198 		SCTPDBG(SCTP_DEBUG_INPUT3, "sctp_handle_init: sending INIT-ACK\n");
199 		sctp_send_initiate_ack(inp, stcb, net, m, iphlen, offset,
200 		    src, dst, sh, cp,
201 		    mflowtype, mflowid,
202 		    vrf_id, port,
203 		    ((stcb == NULL) ? SCTP_HOLDS_LOCK : SCTP_NOT_LOCKED));
204 	}
205 outnow:
206 	if (stcb == NULL) {
207 		SCTP_INP_RUNLOCK(inp);
208 	}
209 }
210 
211 /*
212  * process peer "INIT/INIT-ACK" chunk returns value < 0 on error
213  */
214 
215 int
216 sctp_is_there_unsent_data(struct sctp_tcb *stcb, int so_locked
217 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
218     SCTP_UNUSED
219 #endif
220 )
221 {
222 	int unsent_data;
223 	unsigned int i;
224 	struct sctp_stream_queue_pending *sp;
225 	struct sctp_association *asoc;
226 
227 	/*
228 	 * This function returns if any stream has true unsent data on it.
229 	 * Note that as it looks through it will clean up any places that
230 	 * have old data that has been sent but left at top of stream queue.
231 	 */
232 	asoc = &stcb->asoc;
233 	unsent_data = 0;
234 	SCTP_TCB_SEND_LOCK(stcb);
235 	if (!stcb->asoc.ss_functions.sctp_ss_is_empty(stcb, asoc)) {
236 		/* Check to see if some data queued */
237 		for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
238 			/* sa_ignore FREED_MEMORY */
239 			sp = TAILQ_FIRST(&stcb->asoc.strmout[i].outqueue);
240 			if (sp == NULL) {
241 				continue;
242 			}
243 			if ((sp->msg_is_complete) &&
244 			    (sp->length == 0) &&
245 			    (sp->sender_all_done)) {
246 				/*
247 				 * We are doing differed cleanup. Last time
248 				 * through when we took all the data the
249 				 * sender_all_done was not set.
250 				 */
251 				if (sp->put_last_out == 0) {
252 					SCTP_PRINTF("Gak, put out entire msg with NO end!-1\n");
253 					SCTP_PRINTF("sender_done:%d len:%d msg_comp:%d put_last_out:%d\n",
254 					    sp->sender_all_done,
255 					    sp->length,
256 					    sp->msg_is_complete,
257 					    sp->put_last_out);
258 				}
259 				atomic_subtract_int(&stcb->asoc.stream_queue_cnt, 1);
260 				TAILQ_REMOVE(&stcb->asoc.strmout[i].outqueue, sp, next);
261 				stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, &asoc->strmout[i], sp, 1);
262 				if (sp->net) {
263 					sctp_free_remote_addr(sp->net);
264 					sp->net = NULL;
265 				}
266 				if (sp->data) {
267 					sctp_m_freem(sp->data);
268 					sp->data = NULL;
269 				}
270 				sctp_free_a_strmoq(stcb, sp, so_locked);
271 				if (!TAILQ_EMPTY(&stcb->asoc.strmout[i].outqueue)) {
272 					unsent_data++;
273 				}
274 			} else {
275 				unsent_data++;
276 			}
277 			if (unsent_data > 0) {
278 				break;
279 			}
280 		}
281 	}
282 	SCTP_TCB_SEND_UNLOCK(stcb);
283 	return (unsent_data);
284 }
285 
286 static int
287 sctp_process_init(struct sctp_init_chunk *cp, struct sctp_tcb *stcb)
288 {
289 	struct sctp_init *init;
290 	struct sctp_association *asoc;
291 	struct sctp_nets *lnet;
292 	unsigned int i;
293 
294 	init = &cp->init;
295 	asoc = &stcb->asoc;
296 	/* save off parameters */
297 	asoc->peer_vtag = ntohl(init->initiate_tag);
298 	asoc->peers_rwnd = ntohl(init->a_rwnd);
299 	/* init tsn's */
300 	asoc->highest_tsn_inside_map = asoc->asconf_seq_in = ntohl(init->initial_tsn) - 1;
301 
302 	if (!TAILQ_EMPTY(&asoc->nets)) {
303 		/* update any ssthresh's that may have a default */
304 		TAILQ_FOREACH(lnet, &asoc->nets, sctp_next) {
305 			lnet->ssthresh = asoc->peers_rwnd;
306 			if (SCTP_BASE_SYSCTL(sctp_logging_level) & (SCTP_CWND_MONITOR_ENABLE | SCTP_CWND_LOGGING_ENABLE)) {
307 				sctp_log_cwnd(stcb, lnet, 0, SCTP_CWND_INITIALIZATION);
308 			}
309 		}
310 	}
311 	SCTP_TCB_SEND_LOCK(stcb);
312 	if (asoc->pre_open_streams > ntohs(init->num_inbound_streams)) {
313 		unsigned int newcnt;
314 		struct sctp_stream_out *outs;
315 		struct sctp_stream_queue_pending *sp, *nsp;
316 		struct sctp_tmit_chunk *chk, *nchk;
317 
318 		/* abandon the upper streams */
319 		newcnt = ntohs(init->num_inbound_streams);
320 		TAILQ_FOREACH_SAFE(chk, &asoc->send_queue, sctp_next, nchk) {
321 			if (chk->rec.data.sid >= newcnt) {
322 				TAILQ_REMOVE(&asoc->send_queue, chk, sctp_next);
323 				asoc->send_queue_cnt--;
324 				if (asoc->strmout[chk->rec.data.sid].chunks_on_queues > 0) {
325 					asoc->strmout[chk->rec.data.sid].chunks_on_queues--;
326 #ifdef INVARIANTS
327 				} else {
328 					panic("No chunks on the queues for sid %u.", chk->rec.data.sid);
329 #endif
330 				}
331 				if (chk->data != NULL) {
332 					sctp_free_bufspace(stcb, asoc, chk, 1);
333 					sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb,
334 					    0, chk, SCTP_SO_NOT_LOCKED);
335 					if (chk->data) {
336 						sctp_m_freem(chk->data);
337 						chk->data = NULL;
338 					}
339 				}
340 				sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
341 				/* sa_ignore FREED_MEMORY */
342 			}
343 		}
344 		if (asoc->strmout) {
345 			for (i = newcnt; i < asoc->pre_open_streams; i++) {
346 				outs = &asoc->strmout[i];
347 				TAILQ_FOREACH_SAFE(sp, &outs->outqueue, next, nsp) {
348 					atomic_subtract_int(&stcb->asoc.stream_queue_cnt, 1);
349 					TAILQ_REMOVE(&outs->outqueue, sp, next);
350 					stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, outs, sp, 1);
351 					sctp_ulp_notify(SCTP_NOTIFY_SPECIAL_SP_FAIL,
352 					    stcb, 0, sp, SCTP_SO_NOT_LOCKED);
353 					if (sp->data) {
354 						sctp_m_freem(sp->data);
355 						sp->data = NULL;
356 					}
357 					if (sp->net) {
358 						sctp_free_remote_addr(sp->net);
359 						sp->net = NULL;
360 					}
361 					/* Free the chunk */
362 					sctp_free_a_strmoq(stcb, sp, SCTP_SO_NOT_LOCKED);
363 					/* sa_ignore FREED_MEMORY */
364 				}
365 				outs->state = SCTP_STREAM_CLOSED;
366 			}
367 		}
368 		/* cut back the count */
369 		asoc->pre_open_streams = newcnt;
370 	}
371 	SCTP_TCB_SEND_UNLOCK(stcb);
372 	asoc->streamoutcnt = asoc->pre_open_streams;
373 	if (asoc->strmout) {
374 		for (i = 0; i < asoc->streamoutcnt; i++) {
375 			asoc->strmout[i].state = SCTP_STREAM_OPEN;
376 		}
377 	}
378 	/* EY - nr_sack: initialize highest tsn in nr_mapping_array */
379 	asoc->highest_tsn_inside_nr_map = asoc->highest_tsn_inside_map;
380 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {
381 		sctp_log_map(0, 5, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
382 	}
383 	/* This is the next one we expect */
384 	asoc->str_reset_seq_in = asoc->asconf_seq_in + 1;
385 
386 	asoc->mapping_array_base_tsn = ntohl(init->initial_tsn);
387 	asoc->tsn_last_delivered = asoc->cumulative_tsn = asoc->asconf_seq_in;
388 
389 	asoc->advanced_peer_ack_point = asoc->last_acked_seq;
390 	/* open the requested streams */
391 
392 	if (asoc->strmin != NULL) {
393 		/* Free the old ones */
394 		for (i = 0; i < asoc->streamincnt; i++) {
395 			sctp_clean_up_stream(stcb, &asoc->strmin[i].inqueue);
396 			sctp_clean_up_stream(stcb, &asoc->strmin[i].uno_inqueue);
397 		}
398 		SCTP_FREE(asoc->strmin, SCTP_M_STRMI);
399 	}
400 	if (asoc->max_inbound_streams > ntohs(init->num_outbound_streams)) {
401 		asoc->streamincnt = ntohs(init->num_outbound_streams);
402 	} else {
403 		asoc->streamincnt = asoc->max_inbound_streams;
404 	}
405 	SCTP_MALLOC(asoc->strmin, struct sctp_stream_in *, asoc->streamincnt *
406 	    sizeof(struct sctp_stream_in), SCTP_M_STRMI);
407 	if (asoc->strmin == NULL) {
408 		/* we didn't get memory for the streams! */
409 		SCTPDBG(SCTP_DEBUG_INPUT2, "process_init: couldn't get memory for the streams!\n");
410 		return (-1);
411 	}
412 	for (i = 0; i < asoc->streamincnt; i++) {
413 		asoc->strmin[i].sid = i;
414 		asoc->strmin[i].last_mid_delivered = 0xffffffff;
415 		TAILQ_INIT(&asoc->strmin[i].inqueue);
416 		TAILQ_INIT(&asoc->strmin[i].uno_inqueue);
417 		asoc->strmin[i].pd_api_started = 0;
418 		asoc->strmin[i].delivery_started = 0;
419 	}
420 	/*
421 	 * load_address_from_init will put the addresses into the
422 	 * association when the COOKIE is processed or the INIT-ACK is
423 	 * processed. Both types of COOKIE's existing and new call this
424 	 * routine. It will remove addresses that are no longer in the
425 	 * association (for the restarting case where addresses are
426 	 * removed). Up front when the INIT arrives we will discard it if it
427 	 * is a restart and new addresses have been added.
428 	 */
429 	/* sa_ignore MEMLEAK */
430 	return (0);
431 }
432 
433 /*
434  * INIT-ACK message processing/consumption returns value < 0 on error
435  */
436 static int
437 sctp_process_init_ack(struct mbuf *m, int iphlen, int offset,
438     struct sockaddr *src, struct sockaddr *dst, struct sctphdr *sh,
439     struct sctp_init_ack_chunk *cp, struct sctp_tcb *stcb,
440     struct sctp_nets *net, int *abort_no_unlock,
441     uint8_t mflowtype, uint32_t mflowid,
442     uint32_t vrf_id)
443 {
444 	struct sctp_association *asoc;
445 	struct mbuf *op_err;
446 	int retval, abort_flag;
447 	uint32_t initack_limit;
448 	int nat_friendly = 0;
449 
450 	/* First verify that we have no illegal param's */
451 	abort_flag = 0;
452 
453 	op_err = sctp_arethere_unrecognized_parameters(m,
454 	    (offset + sizeof(struct sctp_init_chunk)),
455 	    &abort_flag, (struct sctp_chunkhdr *)cp, &nat_friendly);
456 	if (abort_flag) {
457 		/* Send an abort and notify peer */
458 		sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
459 		*abort_no_unlock = 1;
460 		return (-1);
461 	}
462 	asoc = &stcb->asoc;
463 	asoc->peer_supports_nat = (uint8_t)nat_friendly;
464 	/* process the peer's parameters in the INIT-ACK */
465 	retval = sctp_process_init((struct sctp_init_chunk *)cp, stcb);
466 	if (retval < 0) {
467 		return (retval);
468 	}
469 	initack_limit = offset + ntohs(cp->ch.chunk_length);
470 	/* load all addresses */
471 	if ((retval = sctp_load_addresses_from_init(stcb, m,
472 	    (offset + sizeof(struct sctp_init_chunk)), initack_limit,
473 	    src, dst, NULL, stcb->asoc.port))) {
474 		op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
475 		    "Problem with address parameters");
476 		SCTPDBG(SCTP_DEBUG_INPUT1,
477 		    "Load addresses from INIT causes an abort %d\n",
478 		    retval);
479 		sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
480 		    src, dst, sh, op_err,
481 		    mflowtype, mflowid,
482 		    vrf_id, net->port);
483 		*abort_no_unlock = 1;
484 		return (-1);
485 	}
486 	/* if the peer doesn't support asconf, flush the asconf queue */
487 	if (asoc->asconf_supported == 0) {
488 		struct sctp_asconf_addr *param, *nparam;
489 
490 		TAILQ_FOREACH_SAFE(param, &asoc->asconf_queue, next, nparam) {
491 			TAILQ_REMOVE(&asoc->asconf_queue, param, next);
492 			SCTP_FREE(param, SCTP_M_ASC_ADDR);
493 		}
494 	}
495 	stcb->asoc.peer_hmac_id = sctp_negotiate_hmacid(stcb->asoc.peer_hmacs,
496 	    stcb->asoc.local_hmacs);
497 	if (op_err) {
498 		sctp_queue_op_err(stcb, op_err);
499 		/* queuing will steal away the mbuf chain to the out queue */
500 		op_err = NULL;
501 	}
502 	/* extract the cookie and queue it to "echo" it back... */
503 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
504 		sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
505 		    stcb->asoc.overall_error_count,
506 		    0,
507 		    SCTP_FROM_SCTP_INPUT,
508 		    __LINE__);
509 	}
510 	stcb->asoc.overall_error_count = 0;
511 	net->error_count = 0;
512 
513 	/*
514 	 * Cancel the INIT timer, We do this first before queueing the
515 	 * cookie. We always cancel at the primary to assue that we are
516 	 * canceling the timer started by the INIT which always goes to the
517 	 * primary.
518 	 */
519 	sctp_timer_stop(SCTP_TIMER_TYPE_INIT, stcb->sctp_ep, stcb,
520 	    asoc->primary_destination, SCTP_FROM_SCTP_INPUT + SCTP_LOC_3);
521 
522 	/* calculate the RTO */
523 	net->RTO = sctp_calculate_rto(stcb, asoc, net, &asoc->time_entered, sctp_align_safe_nocopy,
524 	    SCTP_RTT_FROM_NON_DATA);
525 	retval = sctp_send_cookie_echo(m, offset, stcb, net);
526 	if (retval < 0) {
527 		/*
528 		 * No cookie, we probably should send a op error. But in any
529 		 * case if there is no cookie in the INIT-ACK, we can
530 		 * abandon the peer, its broke.
531 		 */
532 		if (retval == -3) {
533 			uint16_t len;
534 
535 			len = (uint16_t)(sizeof(struct sctp_error_missing_param) + sizeof(uint16_t));
536 			/* We abort with an error of missing mandatory param */
537 			op_err = sctp_get_mbuf_for_msg(len, 0, M_NOWAIT, 1, MT_DATA);
538 			if (op_err != NULL) {
539 				struct sctp_error_missing_param *cause;
540 
541 				SCTP_BUF_LEN(op_err) = len;
542 				cause = mtod(op_err, struct sctp_error_missing_param *);
543 				/* Subtract the reserved param */
544 				cause->cause.code = htons(SCTP_CAUSE_MISSING_PARAM);
545 				cause->cause.length = htons(len);
546 				cause->num_missing_params = htonl(1);
547 				cause->type[0] = htons(SCTP_STATE_COOKIE);
548 			}
549 			sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
550 			    src, dst, sh, op_err,
551 			    mflowtype, mflowid,
552 			    vrf_id, net->port);
553 			*abort_no_unlock = 1;
554 		}
555 		return (retval);
556 	}
557 	return (0);
558 }
559 
560 static void
561 sctp_handle_heartbeat_ack(struct sctp_heartbeat_chunk *cp,
562     struct sctp_tcb *stcb, struct sctp_nets *net)
563 {
564 	union sctp_sockstore store;
565 	struct sctp_nets *r_net, *f_net;
566 	struct timeval tv;
567 	int req_prim = 0;
568 	uint16_t old_error_counter;
569 
570 	if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_heartbeat_chunk)) {
571 		/* Invalid length */
572 		return;
573 	}
574 	memset(&store, 0, sizeof(store));
575 	switch (cp->heartbeat.hb_info.addr_family) {
576 #ifdef INET
577 	case AF_INET:
578 		if (cp->heartbeat.hb_info.addr_len == sizeof(struct sockaddr_in)) {
579 			store.sin.sin_family = cp->heartbeat.hb_info.addr_family;
580 			store.sin.sin_len = cp->heartbeat.hb_info.addr_len;
581 			store.sin.sin_port = stcb->rport;
582 			memcpy(&store.sin.sin_addr, cp->heartbeat.hb_info.address,
583 			    sizeof(store.sin.sin_addr));
584 		} else {
585 			return;
586 		}
587 		break;
588 #endif
589 #ifdef INET6
590 	case AF_INET6:
591 		if (cp->heartbeat.hb_info.addr_len == sizeof(struct sockaddr_in6)) {
592 			store.sin6.sin6_family = cp->heartbeat.hb_info.addr_family;
593 			store.sin6.sin6_len = cp->heartbeat.hb_info.addr_len;
594 			store.sin6.sin6_port = stcb->rport;
595 			memcpy(&store.sin6.sin6_addr, cp->heartbeat.hb_info.address, sizeof(struct in6_addr));
596 		} else {
597 			return;
598 		}
599 		break;
600 #endif
601 	default:
602 		return;
603 	}
604 	r_net = sctp_findnet(stcb, &store.sa);
605 	if (r_net == NULL) {
606 		SCTPDBG(SCTP_DEBUG_INPUT1, "Huh? I can't find the address I sent it to, discard\n");
607 		return;
608 	}
609 	if ((r_net && (r_net->dest_state & SCTP_ADDR_UNCONFIRMED)) &&
610 	    (r_net->heartbeat_random1 == cp->heartbeat.hb_info.random_value1) &&
611 	    (r_net->heartbeat_random2 == cp->heartbeat.hb_info.random_value2)) {
612 		/*
613 		 * If the its a HB and it's random value is correct when can
614 		 * confirm the destination.
615 		 */
616 		r_net->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
617 		if (r_net->dest_state & SCTP_ADDR_REQ_PRIMARY) {
618 			stcb->asoc.primary_destination = r_net;
619 			r_net->dest_state &= ~SCTP_ADDR_REQ_PRIMARY;
620 			f_net = TAILQ_FIRST(&stcb->asoc.nets);
621 			if (f_net != r_net) {
622 				/*
623 				 * first one on the list is NOT the primary
624 				 * sctp_cmpaddr() is much more efficient if
625 				 * the primary is the first on the list,
626 				 * make it so.
627 				 */
628 				TAILQ_REMOVE(&stcb->asoc.nets, r_net, sctp_next);
629 				TAILQ_INSERT_HEAD(&stcb->asoc.nets, r_net, sctp_next);
630 			}
631 			req_prim = 1;
632 		}
633 		sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
634 		    stcb, 0, (void *)r_net, SCTP_SO_NOT_LOCKED);
635 		sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb,
636 		    r_net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_4);
637 		sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb, r_net);
638 	}
639 	old_error_counter = r_net->error_count;
640 	r_net->error_count = 0;
641 	r_net->hb_responded = 1;
642 	tv.tv_sec = cp->heartbeat.hb_info.time_value_1;
643 	tv.tv_usec = cp->heartbeat.hb_info.time_value_2;
644 	/* Now lets do a RTO with this */
645 	r_net->RTO = sctp_calculate_rto(stcb, &stcb->asoc, r_net, &tv, sctp_align_safe_nocopy,
646 	    SCTP_RTT_FROM_NON_DATA);
647 	if (!(r_net->dest_state & SCTP_ADDR_REACHABLE)) {
648 		r_net->dest_state |= SCTP_ADDR_REACHABLE;
649 		sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_UP, stcb,
650 		    0, (void *)r_net, SCTP_SO_NOT_LOCKED);
651 	}
652 	if (r_net->dest_state & SCTP_ADDR_PF) {
653 		r_net->dest_state &= ~SCTP_ADDR_PF;
654 		stcb->asoc.cc_functions.sctp_cwnd_update_exit_pf(stcb, net);
655 	}
656 	if (old_error_counter > 0) {
657 		sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
658 		    stcb, r_net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_5);
659 		sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb, r_net);
660 	}
661 	if (r_net == stcb->asoc.primary_destination) {
662 		if (stcb->asoc.alternate) {
663 			/* release the alternate, primary is good */
664 			sctp_free_remote_addr(stcb->asoc.alternate);
665 			stcb->asoc.alternate = NULL;
666 		}
667 	}
668 	/* Mobility adaptation */
669 	if (req_prim) {
670 		if ((sctp_is_mobility_feature_on(stcb->sctp_ep,
671 		    SCTP_MOBILITY_BASE) ||
672 		    sctp_is_mobility_feature_on(stcb->sctp_ep,
673 		    SCTP_MOBILITY_FASTHANDOFF)) &&
674 		    sctp_is_mobility_feature_on(stcb->sctp_ep,
675 		    SCTP_MOBILITY_PRIM_DELETED)) {
676 
677 			sctp_timer_stop(SCTP_TIMER_TYPE_PRIM_DELETED,
678 			    stcb->sctp_ep, stcb, NULL,
679 			    SCTP_FROM_SCTP_INPUT + SCTP_LOC_6);
680 			if (sctp_is_mobility_feature_on(stcb->sctp_ep,
681 			    SCTP_MOBILITY_FASTHANDOFF)) {
682 				sctp_assoc_immediate_retrans(stcb,
683 				    stcb->asoc.primary_destination);
684 			}
685 			if (sctp_is_mobility_feature_on(stcb->sctp_ep,
686 			    SCTP_MOBILITY_BASE)) {
687 				sctp_move_chunks_from_net(stcb,
688 				    stcb->asoc.deleted_primary);
689 			}
690 			sctp_delete_prim_timer(stcb->sctp_ep, stcb,
691 			    stcb->asoc.deleted_primary);
692 		}
693 	}
694 }
695 
696 static int
697 sctp_handle_nat_colliding_state(struct sctp_tcb *stcb)
698 {
699 	/*
700 	 * return 0 means we want you to proceed with the abort non-zero
701 	 * means no abort processing
702 	 */
703 	struct sctpasochead *head;
704 
705 	if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_WAIT) {
706 		/* generate a new vtag and send init */
707 		LIST_REMOVE(stcb, sctp_asocs);
708 		stcb->asoc.my_vtag = sctp_select_a_tag(stcb->sctp_ep, stcb->sctp_ep->sctp_lport, stcb->rport, 1);
709 		head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag, SCTP_BASE_INFO(hashasocmark))];
710 		/*
711 		 * put it in the bucket in the vtag hash of assoc's for the
712 		 * system
713 		 */
714 		LIST_INSERT_HEAD(head, stcb, sctp_asocs);
715 		sctp_send_initiate(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);
716 		return (1);
717 	}
718 	if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_ECHOED) {
719 		/*
720 		 * treat like a case where the cookie expired i.e.: - dump
721 		 * current cookie. - generate a new vtag. - resend init.
722 		 */
723 		/* generate a new vtag and send init */
724 		LIST_REMOVE(stcb, sctp_asocs);
725 		stcb->asoc.state &= ~SCTP_STATE_COOKIE_ECHOED;
726 		stcb->asoc.state |= SCTP_STATE_COOKIE_WAIT;
727 		sctp_stop_all_cookie_timers(stcb);
728 		sctp_toss_old_cookies(stcb, &stcb->asoc);
729 		stcb->asoc.my_vtag = sctp_select_a_tag(stcb->sctp_ep, stcb->sctp_ep->sctp_lport, stcb->rport, 1);
730 		head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag, SCTP_BASE_INFO(hashasocmark))];
731 		/*
732 		 * put it in the bucket in the vtag hash of assoc's for the
733 		 * system
734 		 */
735 		LIST_INSERT_HEAD(head, stcb, sctp_asocs);
736 		sctp_send_initiate(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);
737 		return (1);
738 	}
739 	return (0);
740 }
741 
742 static int
743 sctp_handle_nat_missing_state(struct sctp_tcb *stcb,
744     struct sctp_nets *net)
745 {
746 	/*
747 	 * return 0 means we want you to proceed with the abort non-zero
748 	 * means no abort processing
749 	 */
750 	if (stcb->asoc.auth_supported == 0) {
751 		SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_nat_missing_state: Peer does not support AUTH, cannot send an asconf\n");
752 		return (0);
753 	}
754 	sctp_asconf_send_nat_state_update(stcb, net);
755 	return (1);
756 }
757 
758 
759 static void
760 sctp_handle_abort(struct sctp_abort_chunk *abort,
761     struct sctp_tcb *stcb, struct sctp_nets *net)
762 {
763 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
764 	struct socket *so;
765 #endif
766 	uint16_t len;
767 	uint16_t error;
768 
769 	SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_abort: handling ABORT\n");
770 	if (stcb == NULL)
771 		return;
772 
773 	len = ntohs(abort->ch.chunk_length);
774 	if (len > sizeof(struct sctp_chunkhdr)) {
775 		/*
776 		 * Need to check the cause codes for our two magic nat
777 		 * aborts which don't kill the assoc necessarily.
778 		 */
779 		struct sctp_gen_error_cause *cause;
780 
781 		cause = (struct sctp_gen_error_cause *)(abort + 1);
782 		error = ntohs(cause->code);
783 		if (error == SCTP_CAUSE_NAT_COLLIDING_STATE) {
784 			SCTPDBG(SCTP_DEBUG_INPUT2, "Received Colliding state abort flags:%x\n",
785 			    abort->ch.chunk_flags);
786 			if (sctp_handle_nat_colliding_state(stcb)) {
787 				return;
788 			}
789 		} else if (error == SCTP_CAUSE_NAT_MISSING_STATE) {
790 			SCTPDBG(SCTP_DEBUG_INPUT2, "Received missing state abort flags:%x\n",
791 			    abort->ch.chunk_flags);
792 			if (sctp_handle_nat_missing_state(stcb, net)) {
793 				return;
794 			}
795 		}
796 	} else {
797 		error = 0;
798 	}
799 	/* stop any receive timers */
800 	sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, net,
801 	    SCTP_FROM_SCTP_INPUT + SCTP_LOC_7);
802 	/* notify user of the abort and clean up... */
803 	sctp_abort_notification(stcb, 1, error, abort, SCTP_SO_NOT_LOCKED);
804 	/* free the tcb */
805 	SCTP_STAT_INCR_COUNTER32(sctps_aborted);
806 	if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
807 	    (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
808 		SCTP_STAT_DECR_GAUGE32(sctps_currestab);
809 	}
810 #ifdef SCTP_ASOCLOG_OF_TSNS
811 	sctp_print_out_track_log(stcb);
812 #endif
813 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
814 	so = SCTP_INP_SO(stcb->sctp_ep);
815 	atomic_add_int(&stcb->asoc.refcnt, 1);
816 	SCTP_TCB_UNLOCK(stcb);
817 	SCTP_SOCKET_LOCK(so, 1);
818 	SCTP_TCB_LOCK(stcb);
819 	atomic_subtract_int(&stcb->asoc.refcnt, 1);
820 #endif
821 	stcb->asoc.state |= SCTP_STATE_WAS_ABORTED;
822 	(void)sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC,
823 	    SCTP_FROM_SCTP_INPUT + SCTP_LOC_8);
824 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
825 	SCTP_SOCKET_UNLOCK(so, 1);
826 #endif
827 	SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_abort: finished\n");
828 }
829 
830 static void
831 sctp_start_net_timers(struct sctp_tcb *stcb)
832 {
833 	uint32_t cnt_hb_sent;
834 	struct sctp_nets *net;
835 
836 	cnt_hb_sent = 0;
837 	TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
838 		/*
839 		 * For each network start: 1) A pmtu timer. 2) A HB timer 3)
840 		 * If the dest in unconfirmed send a hb as well if under
841 		 * max_hb_burst have been sent.
842 		 */
843 		sctp_timer_start(SCTP_TIMER_TYPE_PATHMTURAISE, stcb->sctp_ep, stcb, net);
844 		sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb, net);
845 		if ((net->dest_state & SCTP_ADDR_UNCONFIRMED) &&
846 		    (cnt_hb_sent < SCTP_BASE_SYSCTL(sctp_hb_maxburst))) {
847 			sctp_send_hb(stcb, net, SCTP_SO_NOT_LOCKED);
848 			cnt_hb_sent++;
849 		}
850 	}
851 	if (cnt_hb_sent) {
852 		sctp_chunk_output(stcb->sctp_ep, stcb,
853 		    SCTP_OUTPUT_FROM_COOKIE_ACK,
854 		    SCTP_SO_NOT_LOCKED);
855 	}
856 }
857 
858 
859 static void
860 sctp_handle_shutdown(struct sctp_shutdown_chunk *cp,
861     struct sctp_tcb *stcb, struct sctp_nets *net, int *abort_flag)
862 {
863 	struct sctp_association *asoc;
864 	int some_on_streamwheel;
865 	int old_state;
866 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
867 	struct socket *so;
868 #endif
869 
870 	SCTPDBG(SCTP_DEBUG_INPUT2,
871 	    "sctp_handle_shutdown: handling SHUTDOWN\n");
872 	if (stcb == NULL)
873 		return;
874 	asoc = &stcb->asoc;
875 	if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||
876 	    (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) {
877 		return;
878 	}
879 	if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_shutdown_chunk)) {
880 		/* Shutdown NOT the expected size */
881 		return;
882 	}
883 	old_state = SCTP_GET_STATE(asoc);
884 	sctp_update_acked(stcb, cp, abort_flag);
885 	if (*abort_flag) {
886 		return;
887 	}
888 	if (asoc->control_pdapi) {
889 		/*
890 		 * With a normal shutdown we assume the end of last record.
891 		 */
892 		SCTP_INP_READ_LOCK(stcb->sctp_ep);
893 		if (asoc->control_pdapi->on_strm_q) {
894 			struct sctp_stream_in *strm;
895 
896 			strm = &asoc->strmin[asoc->control_pdapi->sinfo_stream];
897 			if (asoc->control_pdapi->on_strm_q == SCTP_ON_UNORDERED) {
898 				/* Unordered */
899 				TAILQ_REMOVE(&strm->uno_inqueue, asoc->control_pdapi, next_instrm);
900 				asoc->control_pdapi->on_strm_q = 0;
901 			} else if (asoc->control_pdapi->on_strm_q == SCTP_ON_ORDERED) {
902 				/* Ordered */
903 				TAILQ_REMOVE(&strm->inqueue, asoc->control_pdapi, next_instrm);
904 				asoc->control_pdapi->on_strm_q = 0;
905 #ifdef INVARIANTS
906 			} else {
907 				panic("Unknown state on ctrl:%p on_strm_q:%d",
908 				    asoc->control_pdapi,
909 				    asoc->control_pdapi->on_strm_q);
910 #endif
911 			}
912 		}
913 		asoc->control_pdapi->end_added = 1;
914 		asoc->control_pdapi->pdapi_aborted = 1;
915 		asoc->control_pdapi = NULL;
916 		SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
917 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
918 		so = SCTP_INP_SO(stcb->sctp_ep);
919 		atomic_add_int(&stcb->asoc.refcnt, 1);
920 		SCTP_TCB_UNLOCK(stcb);
921 		SCTP_SOCKET_LOCK(so, 1);
922 		SCTP_TCB_LOCK(stcb);
923 		atomic_subtract_int(&stcb->asoc.refcnt, 1);
924 		if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
925 			/* assoc was freed while we were unlocked */
926 			SCTP_SOCKET_UNLOCK(so, 1);
927 			return;
928 		}
929 #endif
930 		if (stcb->sctp_socket) {
931 			sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
932 		}
933 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
934 		SCTP_SOCKET_UNLOCK(so, 1);
935 #endif
936 	}
937 	/* goto SHUTDOWN_RECEIVED state to block new requests */
938 	if (stcb->sctp_socket) {
939 		if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) &&
940 		    (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT) &&
941 		    (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT)) {
942 			SCTP_SET_STATE(asoc, SCTP_STATE_SHUTDOWN_RECEIVED);
943 			SCTP_CLEAR_SUBSTATE(asoc, SCTP_STATE_SHUTDOWN_PENDING);
944 			/*
945 			 * notify upper layer that peer has initiated a
946 			 * shutdown
947 			 */
948 			sctp_ulp_notify(SCTP_NOTIFY_PEER_SHUTDOWN, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
949 
950 			/* reset time */
951 			(void)SCTP_GETTIME_TIMEVAL(&asoc->time_entered);
952 		}
953 	}
954 	if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) {
955 		/*
956 		 * stop the shutdown timer, since we WILL move to
957 		 * SHUTDOWN-ACK-SENT.
958 		 */
959 		sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb,
960 		    net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_9);
961 	}
962 	/* Now is there unsent data on a stream somewhere? */
963 	some_on_streamwheel = sctp_is_there_unsent_data(stcb, SCTP_SO_NOT_LOCKED);
964 
965 	if (!TAILQ_EMPTY(&asoc->send_queue) ||
966 	    !TAILQ_EMPTY(&asoc->sent_queue) ||
967 	    some_on_streamwheel) {
968 		/* By returning we will push more data out */
969 		return;
970 	} else {
971 		/* no outstanding data to send, so move on... */
972 		/* send SHUTDOWN-ACK */
973 		/* move to SHUTDOWN-ACK-SENT state */
974 		if ((SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) ||
975 		    (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
976 			SCTP_STAT_DECR_GAUGE32(sctps_currestab);
977 		}
978 		SCTP_CLEAR_SUBSTATE(asoc, SCTP_STATE_SHUTDOWN_PENDING);
979 		if (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT) {
980 			SCTP_SET_STATE(asoc, SCTP_STATE_SHUTDOWN_ACK_SENT);
981 			sctp_stop_timers_for_shutdown(stcb);
982 			sctp_send_shutdown_ack(stcb, net);
983 			sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNACK,
984 			    stcb->sctp_ep, stcb, net);
985 		} else if (old_state == SCTP_STATE_SHUTDOWN_ACK_SENT) {
986 			sctp_send_shutdown_ack(stcb, net);
987 		}
988 	}
989 }
990 
991 static void
992 sctp_handle_shutdown_ack(struct sctp_shutdown_ack_chunk *cp SCTP_UNUSED,
993     struct sctp_tcb *stcb,
994     struct sctp_nets *net)
995 {
996 	struct sctp_association *asoc;
997 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
998 	struct socket *so;
999 
1000 	so = SCTP_INP_SO(stcb->sctp_ep);
1001 #endif
1002 	SCTPDBG(SCTP_DEBUG_INPUT2,
1003 	    "sctp_handle_shutdown_ack: handling SHUTDOWN ACK\n");
1004 	if (stcb == NULL)
1005 		return;
1006 
1007 	asoc = &stcb->asoc;
1008 	/* process according to association state */
1009 	if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||
1010 	    (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) {
1011 		/* unexpected SHUTDOWN-ACK... do OOTB handling... */
1012 		sctp_send_shutdown_complete(stcb, net, 1);
1013 		SCTP_TCB_UNLOCK(stcb);
1014 		return;
1015 	}
1016 	if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) &&
1017 	    (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) {
1018 		/* unexpected SHUTDOWN-ACK... so ignore... */
1019 		SCTP_TCB_UNLOCK(stcb);
1020 		return;
1021 	}
1022 	if (asoc->control_pdapi) {
1023 		/*
1024 		 * With a normal shutdown we assume the end of last record.
1025 		 */
1026 		SCTP_INP_READ_LOCK(stcb->sctp_ep);
1027 		asoc->control_pdapi->end_added = 1;
1028 		asoc->control_pdapi->pdapi_aborted = 1;
1029 		asoc->control_pdapi = NULL;
1030 		SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
1031 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1032 		atomic_add_int(&stcb->asoc.refcnt, 1);
1033 		SCTP_TCB_UNLOCK(stcb);
1034 		SCTP_SOCKET_LOCK(so, 1);
1035 		SCTP_TCB_LOCK(stcb);
1036 		atomic_subtract_int(&stcb->asoc.refcnt, 1);
1037 		if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
1038 			/* assoc was freed while we were unlocked */
1039 			SCTP_SOCKET_UNLOCK(so, 1);
1040 			return;
1041 		}
1042 #endif
1043 		sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
1044 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1045 		SCTP_SOCKET_UNLOCK(so, 1);
1046 #endif
1047 	}
1048 #ifdef INVARIANTS
1049 	if (!TAILQ_EMPTY(&asoc->send_queue) ||
1050 	    !TAILQ_EMPTY(&asoc->sent_queue) ||
1051 	    sctp_is_there_unsent_data(stcb, SCTP_SO_NOT_LOCKED)) {
1052 		panic("Queues are not empty when handling SHUTDOWN-ACK");
1053 	}
1054 #endif
1055 	/* stop the timer */
1056 	sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, net,
1057 	    SCTP_FROM_SCTP_INPUT + SCTP_LOC_10);
1058 	/* send SHUTDOWN-COMPLETE */
1059 	sctp_send_shutdown_complete(stcb, net, 0);
1060 	/* notify upper layer protocol */
1061 	if (stcb->sctp_socket) {
1062 		if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
1063 		    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
1064 			stcb->sctp_socket->so_snd.sb_cc = 0;
1065 		}
1066 		sctp_ulp_notify(SCTP_NOTIFY_ASSOC_DOWN, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
1067 	}
1068 	SCTP_STAT_INCR_COUNTER32(sctps_shutdown);
1069 	/* free the TCB but first save off the ep */
1070 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1071 	atomic_add_int(&stcb->asoc.refcnt, 1);
1072 	SCTP_TCB_UNLOCK(stcb);
1073 	SCTP_SOCKET_LOCK(so, 1);
1074 	SCTP_TCB_LOCK(stcb);
1075 	atomic_subtract_int(&stcb->asoc.refcnt, 1);
1076 #endif
1077 	(void)sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC,
1078 	    SCTP_FROM_SCTP_INPUT + SCTP_LOC_11);
1079 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1080 	SCTP_SOCKET_UNLOCK(so, 1);
1081 #endif
1082 }
1083 
1084 /*
1085  * Skip past the param header and then we will find the chunk that caused the
1086  * problem. There are two possibilities ASCONF or FWD-TSN other than that and
1087  * our peer must be broken.
1088  */
1089 static void
1090 sctp_process_unrecog_chunk(struct sctp_tcb *stcb, struct sctp_paramhdr *phdr,
1091     struct sctp_nets *net)
1092 {
1093 	struct sctp_chunkhdr *chk;
1094 
1095 	chk = (struct sctp_chunkhdr *)((caddr_t)phdr + sizeof(*phdr));
1096 	switch (chk->chunk_type) {
1097 	case SCTP_ASCONF_ACK:
1098 	case SCTP_ASCONF:
1099 		sctp_asconf_cleanup(stcb, net);
1100 		break;
1101 	case SCTP_IFORWARD_CUM_TSN:
1102 	case SCTP_FORWARD_CUM_TSN:
1103 		stcb->asoc.prsctp_supported = 0;
1104 		break;
1105 	default:
1106 		SCTPDBG(SCTP_DEBUG_INPUT2,
1107 		    "Peer does not support chunk type %d(%x)??\n",
1108 		    chk->chunk_type, (uint32_t)chk->chunk_type);
1109 		break;
1110 	}
1111 }
1112 
1113 /*
1114  * Skip past the param header and then we will find the param that caused the
1115  * problem.  There are a number of param's in a ASCONF OR the prsctp param
1116  * these will turn of specific features.
1117  * XXX: Is this the right thing to do?
1118  */
1119 static void
1120 sctp_process_unrecog_param(struct sctp_tcb *stcb, struct sctp_paramhdr *phdr)
1121 {
1122 	struct sctp_paramhdr *pbad;
1123 
1124 	pbad = phdr + 1;
1125 	switch (ntohs(pbad->param_type)) {
1126 		/* pr-sctp draft */
1127 	case SCTP_PRSCTP_SUPPORTED:
1128 		stcb->asoc.prsctp_supported = 0;
1129 		break;
1130 	case SCTP_SUPPORTED_CHUNK_EXT:
1131 		break;
1132 		/* draft-ietf-tsvwg-addip-sctp */
1133 	case SCTP_HAS_NAT_SUPPORT:
1134 		stcb->asoc.peer_supports_nat = 0;
1135 		break;
1136 	case SCTP_ADD_IP_ADDRESS:
1137 	case SCTP_DEL_IP_ADDRESS:
1138 	case SCTP_SET_PRIM_ADDR:
1139 		stcb->asoc.asconf_supported = 0;
1140 		break;
1141 	case SCTP_SUCCESS_REPORT:
1142 	case SCTP_ERROR_CAUSE_IND:
1143 		SCTPDBG(SCTP_DEBUG_INPUT2, "Huh, the peer does not support success? or error cause?\n");
1144 		SCTPDBG(SCTP_DEBUG_INPUT2,
1145 		    "Turning off ASCONF to this strange peer\n");
1146 		stcb->asoc.asconf_supported = 0;
1147 		break;
1148 	default:
1149 		SCTPDBG(SCTP_DEBUG_INPUT2,
1150 		    "Peer does not support param type %d(%x)??\n",
1151 		    pbad->param_type, (uint32_t)pbad->param_type);
1152 		break;
1153 	}
1154 }
1155 
1156 static int
1157 sctp_handle_error(struct sctp_chunkhdr *ch,
1158     struct sctp_tcb *stcb, struct sctp_nets *net)
1159 {
1160 	int chklen;
1161 	struct sctp_paramhdr *phdr;
1162 	uint16_t error, error_type;
1163 	uint16_t error_len;
1164 	struct sctp_association *asoc;
1165 	int adjust;
1166 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1167 	struct socket *so;
1168 #endif
1169 
1170 	/* parse through all of the errors and process */
1171 	asoc = &stcb->asoc;
1172 	phdr = (struct sctp_paramhdr *)((caddr_t)ch +
1173 	    sizeof(struct sctp_chunkhdr));
1174 	chklen = ntohs(ch->chunk_length) - sizeof(struct sctp_chunkhdr);
1175 	error = 0;
1176 	while ((size_t)chklen >= sizeof(struct sctp_paramhdr)) {
1177 		/* Process an Error Cause */
1178 		error_type = ntohs(phdr->param_type);
1179 		error_len = ntohs(phdr->param_length);
1180 		if ((error_len > chklen) || (error_len == 0)) {
1181 			/* invalid param length for this param */
1182 			SCTPDBG(SCTP_DEBUG_INPUT1, "Bogus length in error param- chunk left:%d errorlen:%d\n",
1183 			    chklen, error_len);
1184 			return (0);
1185 		}
1186 		if (error == 0) {
1187 			/* report the first error cause */
1188 			error = error_type;
1189 		}
1190 		switch (error_type) {
1191 		case SCTP_CAUSE_INVALID_STREAM:
1192 		case SCTP_CAUSE_MISSING_PARAM:
1193 		case SCTP_CAUSE_INVALID_PARAM:
1194 		case SCTP_CAUSE_NO_USER_DATA:
1195 			SCTPDBG(SCTP_DEBUG_INPUT1, "Software error we got a %d back? We have a bug :/ (or do they?)\n",
1196 			    error_type);
1197 			break;
1198 		case SCTP_CAUSE_NAT_COLLIDING_STATE:
1199 			SCTPDBG(SCTP_DEBUG_INPUT2, "Received Colliding state abort flags:%x\n",
1200 			    ch->chunk_flags);
1201 			if (sctp_handle_nat_colliding_state(stcb)) {
1202 				return (0);
1203 			}
1204 			break;
1205 		case SCTP_CAUSE_NAT_MISSING_STATE:
1206 			SCTPDBG(SCTP_DEBUG_INPUT2, "Received missing state abort flags:%x\n",
1207 			    ch->chunk_flags);
1208 			if (sctp_handle_nat_missing_state(stcb, net)) {
1209 				return (0);
1210 			}
1211 			break;
1212 		case SCTP_CAUSE_STALE_COOKIE:
1213 			/*
1214 			 * We only act if we have echoed a cookie and are
1215 			 * waiting.
1216 			 */
1217 			if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) {
1218 				int *p;
1219 
1220 				p = (int *)((caddr_t)phdr + sizeof(*phdr));
1221 				/* Save the time doubled */
1222 				asoc->cookie_preserve_req = ntohl(*p) << 1;
1223 				asoc->stale_cookie_count++;
1224 				if (asoc->stale_cookie_count >
1225 				    asoc->max_init_times) {
1226 					sctp_abort_notification(stcb, 0, 0, NULL, SCTP_SO_NOT_LOCKED);
1227 					/* now free the asoc */
1228 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1229 					so = SCTP_INP_SO(stcb->sctp_ep);
1230 					atomic_add_int(&stcb->asoc.refcnt, 1);
1231 					SCTP_TCB_UNLOCK(stcb);
1232 					SCTP_SOCKET_LOCK(so, 1);
1233 					SCTP_TCB_LOCK(stcb);
1234 					atomic_subtract_int(&stcb->asoc.refcnt, 1);
1235 #endif
1236 					(void)sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC,
1237 					    SCTP_FROM_SCTP_INPUT + SCTP_LOC_12);
1238 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1239 					SCTP_SOCKET_UNLOCK(so, 1);
1240 #endif
1241 					return (-1);
1242 				}
1243 				/* blast back to INIT state */
1244 				sctp_toss_old_cookies(stcb, &stcb->asoc);
1245 				asoc->state &= ~SCTP_STATE_COOKIE_ECHOED;
1246 				asoc->state |= SCTP_STATE_COOKIE_WAIT;
1247 				sctp_stop_all_cookie_timers(stcb);
1248 				sctp_send_initiate(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);
1249 			}
1250 			break;
1251 		case SCTP_CAUSE_UNRESOLVABLE_ADDR:
1252 			/*
1253 			 * Nothing we can do here, we don't do hostname
1254 			 * addresses so if the peer does not like my IPv6
1255 			 * (or IPv4 for that matter) it does not matter. If
1256 			 * they don't support that type of address, they can
1257 			 * NOT possibly get that packet type... i.e. with no
1258 			 * IPv6 you can't receive a IPv6 packet. so we can
1259 			 * safely ignore this one. If we ever added support
1260 			 * for HOSTNAME Addresses, then we would need to do
1261 			 * something here.
1262 			 */
1263 			break;
1264 		case SCTP_CAUSE_UNRECOG_CHUNK:
1265 			sctp_process_unrecog_chunk(stcb, phdr, net);
1266 			break;
1267 		case SCTP_CAUSE_UNRECOG_PARAM:
1268 			sctp_process_unrecog_param(stcb, phdr);
1269 			break;
1270 		case SCTP_CAUSE_COOKIE_IN_SHUTDOWN:
1271 			/*
1272 			 * We ignore this since the timer will drive out a
1273 			 * new cookie anyway and there timer will drive us
1274 			 * to send a SHUTDOWN_COMPLETE. We can't send one
1275 			 * here since we don't have their tag.
1276 			 */
1277 			break;
1278 		case SCTP_CAUSE_DELETING_LAST_ADDR:
1279 		case SCTP_CAUSE_RESOURCE_SHORTAGE:
1280 		case SCTP_CAUSE_DELETING_SRC_ADDR:
1281 			/*
1282 			 * We should NOT get these here, but in a
1283 			 * ASCONF-ACK.
1284 			 */
1285 			SCTPDBG(SCTP_DEBUG_INPUT2, "Peer sends ASCONF errors in a Operational Error?<%d>?\n",
1286 			    error_type);
1287 			break;
1288 		case SCTP_CAUSE_OUT_OF_RESC:
1289 			/*
1290 			 * And what, pray tell do we do with the fact that
1291 			 * the peer is out of resources? Not really sure we
1292 			 * could do anything but abort. I suspect this
1293 			 * should have came WITH an abort instead of in a
1294 			 * OP-ERROR.
1295 			 */
1296 			break;
1297 		default:
1298 			SCTPDBG(SCTP_DEBUG_INPUT1, "sctp_handle_error: unknown error type = 0x%xh\n",
1299 			    error_type);
1300 			break;
1301 		}
1302 		adjust = SCTP_SIZE32(error_len);
1303 		chklen -= adjust;
1304 		phdr = (struct sctp_paramhdr *)((caddr_t)phdr + adjust);
1305 	}
1306 	sctp_ulp_notify(SCTP_NOTIFY_REMOTE_ERROR, stcb, error, ch, SCTP_SO_NOT_LOCKED);
1307 	return (0);
1308 }
1309 
1310 static int
1311 sctp_handle_init_ack(struct mbuf *m, int iphlen, int offset,
1312     struct sockaddr *src, struct sockaddr *dst, struct sctphdr *sh,
1313     struct sctp_init_ack_chunk *cp, struct sctp_tcb *stcb,
1314     struct sctp_nets *net, int *abort_no_unlock,
1315     uint8_t mflowtype, uint32_t mflowid,
1316     uint32_t vrf_id)
1317 {
1318 	struct sctp_init_ack *init_ack;
1319 	struct mbuf *op_err;
1320 
1321 	SCTPDBG(SCTP_DEBUG_INPUT2,
1322 	    "sctp_handle_init_ack: handling INIT-ACK\n");
1323 
1324 	if (stcb == NULL) {
1325 		SCTPDBG(SCTP_DEBUG_INPUT2,
1326 		    "sctp_handle_init_ack: TCB is null\n");
1327 		return (-1);
1328 	}
1329 	if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_init_ack_chunk)) {
1330 		/* Invalid length */
1331 		op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
1332 		sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
1333 		    src, dst, sh, op_err,
1334 		    mflowtype, mflowid,
1335 		    vrf_id, net->port);
1336 		*abort_no_unlock = 1;
1337 		return (-1);
1338 	}
1339 	init_ack = &cp->init;
1340 	/* validate parameters */
1341 	if (init_ack->initiate_tag == 0) {
1342 		/* protocol error... send an abort */
1343 		op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
1344 		sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
1345 		    src, dst, sh, op_err,
1346 		    mflowtype, mflowid,
1347 		    vrf_id, net->port);
1348 		*abort_no_unlock = 1;
1349 		return (-1);
1350 	}
1351 	if (ntohl(init_ack->a_rwnd) < SCTP_MIN_RWND) {
1352 		/* protocol error... send an abort */
1353 		op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
1354 		sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
1355 		    src, dst, sh, op_err,
1356 		    mflowtype, mflowid,
1357 		    vrf_id, net->port);
1358 		*abort_no_unlock = 1;
1359 		return (-1);
1360 	}
1361 	if (init_ack->num_inbound_streams == 0) {
1362 		/* protocol error... send an abort */
1363 		op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
1364 		sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
1365 		    src, dst, sh, op_err,
1366 		    mflowtype, mflowid,
1367 		    vrf_id, net->port);
1368 		*abort_no_unlock = 1;
1369 		return (-1);
1370 	}
1371 	if (init_ack->num_outbound_streams == 0) {
1372 		/* protocol error... send an abort */
1373 		op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
1374 		sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
1375 		    src, dst, sh, op_err,
1376 		    mflowtype, mflowid,
1377 		    vrf_id, net->port);
1378 		*abort_no_unlock = 1;
1379 		return (-1);
1380 	}
1381 	/* process according to association state... */
1382 	switch (stcb->asoc.state & SCTP_STATE_MASK) {
1383 	case SCTP_STATE_COOKIE_WAIT:
1384 		/* this is the expected state for this chunk */
1385 		/* process the INIT-ACK parameters */
1386 		if (stcb->asoc.primary_destination->dest_state &
1387 		    SCTP_ADDR_UNCONFIRMED) {
1388 			/*
1389 			 * The primary is where we sent the INIT, we can
1390 			 * always consider it confirmed when the INIT-ACK is
1391 			 * returned. Do this before we load addresses
1392 			 * though.
1393 			 */
1394 			stcb->asoc.primary_destination->dest_state &=
1395 			    ~SCTP_ADDR_UNCONFIRMED;
1396 			sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
1397 			    stcb, 0, (void *)stcb->asoc.primary_destination, SCTP_SO_NOT_LOCKED);
1398 		}
1399 		if (sctp_process_init_ack(m, iphlen, offset, src, dst, sh, cp, stcb,
1400 		    net, abort_no_unlock,
1401 		    mflowtype, mflowid,
1402 		    vrf_id) < 0) {
1403 			/* error in parsing parameters */
1404 			return (-1);
1405 		}
1406 		/* update our state */
1407 		SCTPDBG(SCTP_DEBUG_INPUT2, "moving to COOKIE-ECHOED state\n");
1408 		SCTP_SET_STATE(&stcb->asoc, SCTP_STATE_COOKIE_ECHOED);
1409 
1410 		/* reset the RTO calc */
1411 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
1412 			sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
1413 			    stcb->asoc.overall_error_count,
1414 			    0,
1415 			    SCTP_FROM_SCTP_INPUT,
1416 			    __LINE__);
1417 		}
1418 		stcb->asoc.overall_error_count = 0;
1419 		(void)SCTP_GETTIME_TIMEVAL(&stcb->asoc.time_entered);
1420 		/*
1421 		 * collapse the init timer back in case of a exponential
1422 		 * backoff
1423 		 */
1424 		sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, stcb->sctp_ep,
1425 		    stcb, net);
1426 		/*
1427 		 * the send at the end of the inbound data processing will
1428 		 * cause the cookie to be sent
1429 		 */
1430 		break;
1431 	case SCTP_STATE_SHUTDOWN_SENT:
1432 		/* incorrect state... discard */
1433 		break;
1434 	case SCTP_STATE_COOKIE_ECHOED:
1435 		/* incorrect state... discard */
1436 		break;
1437 	case SCTP_STATE_OPEN:
1438 		/* incorrect state... discard */
1439 		break;
1440 	case SCTP_STATE_EMPTY:
1441 	case SCTP_STATE_INUSE:
1442 	default:
1443 		/* incorrect state... discard */
1444 		return (-1);
1445 		break;
1446 	}
1447 	SCTPDBG(SCTP_DEBUG_INPUT1, "Leaving handle-init-ack end\n");
1448 	return (0);
1449 }
1450 
1451 static struct sctp_tcb *
1452 sctp_process_cookie_new(struct mbuf *m, int iphlen, int offset,
1453     struct sockaddr *src, struct sockaddr *dst,
1454     struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len,
1455     struct sctp_inpcb *inp, struct sctp_nets **netp,
1456     struct sockaddr *init_src, int *notification,
1457     int auth_skipped, uint32_t auth_offset, uint32_t auth_len,
1458     uint8_t mflowtype, uint32_t mflowid,
1459     uint32_t vrf_id, uint16_t port);
1460 
1461 
1462 /*
1463  * handle a state cookie for an existing association m: input packet mbuf
1464  * chain-- assumes a pullup on IP/SCTP/COOKIE-ECHO chunk note: this is a
1465  * "split" mbuf and the cookie signature does not exist offset: offset into
1466  * mbuf to the cookie-echo chunk
1467  */
1468 static struct sctp_tcb *
1469 sctp_process_cookie_existing(struct mbuf *m, int iphlen, int offset,
1470     struct sockaddr *src, struct sockaddr *dst,
1471     struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len,
1472     struct sctp_inpcb *inp, struct sctp_tcb *stcb, struct sctp_nets **netp,
1473     struct sockaddr *init_src, int *notification,
1474     int auth_skipped, uint32_t auth_offset, uint32_t auth_len,
1475     uint8_t mflowtype, uint32_t mflowid,
1476     uint32_t vrf_id, uint16_t port)
1477 {
1478 	struct sctp_association *asoc;
1479 	struct sctp_init_chunk *init_cp, init_buf;
1480 	struct sctp_init_ack_chunk *initack_cp, initack_buf;
1481 	struct sctp_nets *net;
1482 	struct mbuf *op_err;
1483 	int init_offset, initack_offset, i;
1484 	int retval;
1485 	int spec_flag = 0;
1486 	uint32_t how_indx;
1487 #if defined(SCTP_DETAILED_STR_STATS)
1488 	int j;
1489 #endif
1490 
1491 	net = *netp;
1492 	/* I know that the TCB is non-NULL from the caller */
1493 	asoc = &stcb->asoc;
1494 	for (how_indx = 0; how_indx < sizeof(asoc->cookie_how); how_indx++) {
1495 		if (asoc->cookie_how[how_indx] == 0)
1496 			break;
1497 	}
1498 	if (how_indx < sizeof(asoc->cookie_how)) {
1499 		asoc->cookie_how[how_indx] = 1;
1500 	}
1501 	if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) {
1502 		/* SHUTDOWN came in after sending INIT-ACK */
1503 		sctp_send_shutdown_ack(stcb, stcb->asoc.primary_destination);
1504 		op_err = sctp_generate_cause(SCTP_CAUSE_COOKIE_IN_SHUTDOWN, "");
1505 		sctp_send_operr_to(src, dst, sh, cookie->peers_vtag, op_err,
1506 		    mflowtype, mflowid, inp->fibnum,
1507 		    vrf_id, net->port);
1508 		if (how_indx < sizeof(asoc->cookie_how))
1509 			asoc->cookie_how[how_indx] = 2;
1510 		return (NULL);
1511 	}
1512 	/*
1513 	 * find and validate the INIT chunk in the cookie (peer's info) the
1514 	 * INIT should start after the cookie-echo header struct (chunk
1515 	 * header, state cookie header struct)
1516 	 */
1517 	init_offset = offset += sizeof(struct sctp_cookie_echo_chunk);
1518 
1519 	init_cp = (struct sctp_init_chunk *)
1520 	    sctp_m_getptr(m, init_offset, sizeof(struct sctp_init_chunk),
1521 	    (uint8_t *)&init_buf);
1522 	if (init_cp == NULL) {
1523 		/* could not pull a INIT chunk in cookie */
1524 		return (NULL);
1525 	}
1526 	if (init_cp->ch.chunk_type != SCTP_INITIATION) {
1527 		return (NULL);
1528 	}
1529 	/*
1530 	 * find and validate the INIT-ACK chunk in the cookie (my info) the
1531 	 * INIT-ACK follows the INIT chunk
1532 	 */
1533 	initack_offset = init_offset + SCTP_SIZE32(ntohs(init_cp->ch.chunk_length));
1534 	initack_cp = (struct sctp_init_ack_chunk *)
1535 	    sctp_m_getptr(m, initack_offset, sizeof(struct sctp_init_ack_chunk),
1536 	    (uint8_t *)&initack_buf);
1537 	if (initack_cp == NULL) {
1538 		/* could not pull INIT-ACK chunk in cookie */
1539 		return (NULL);
1540 	}
1541 	if (initack_cp->ch.chunk_type != SCTP_INITIATION_ACK) {
1542 		return (NULL);
1543 	}
1544 	if ((ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag) &&
1545 	    (ntohl(init_cp->init.initiate_tag) == asoc->peer_vtag)) {
1546 		/*
1547 		 * case D in Section 5.2.4 Table 2: MMAA process accordingly
1548 		 * to get into the OPEN state
1549 		 */
1550 		if (ntohl(initack_cp->init.initial_tsn) != asoc->init_seq_number) {
1551 			/*-
1552 			 * Opps, this means that we somehow generated two vtag's
1553 			 * the same. I.e. we did:
1554 			 *  Us               Peer
1555 			 *   <---INIT(tag=a)------
1556 			 *   ----INIT-ACK(tag=t)-->
1557 			 *   ----INIT(tag=t)------> *1
1558 			 *   <---INIT-ACK(tag=a)---
1559                          *   <----CE(tag=t)------------- *2
1560 			 *
1561 			 * At point *1 we should be generating a different
1562 			 * tag t'. Which means we would throw away the CE and send
1563 			 * ours instead. Basically this is case C (throw away side).
1564 			 */
1565 			if (how_indx < sizeof(asoc->cookie_how))
1566 				asoc->cookie_how[how_indx] = 17;
1567 			return (NULL);
1568 
1569 		}
1570 		switch (SCTP_GET_STATE(asoc)) {
1571 		case SCTP_STATE_COOKIE_WAIT:
1572 		case SCTP_STATE_COOKIE_ECHOED:
1573 			/*
1574 			 * INIT was sent but got a COOKIE_ECHO with the
1575 			 * correct tags... just accept it...but we must
1576 			 * process the init so that we can make sure we have
1577 			 * the right seq no's.
1578 			 */
1579 			/* First we must process the INIT !! */
1580 			retval = sctp_process_init(init_cp, stcb);
1581 			if (retval < 0) {
1582 				if (how_indx < sizeof(asoc->cookie_how))
1583 					asoc->cookie_how[how_indx] = 3;
1584 				return (NULL);
1585 			}
1586 			/* we have already processed the INIT so no problem */
1587 			sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp,
1588 			    stcb, net,
1589 			    SCTP_FROM_SCTP_INPUT + SCTP_LOC_13);
1590 			sctp_timer_stop(SCTP_TIMER_TYPE_INIT, inp,
1591 			    stcb, net,
1592 			    SCTP_FROM_SCTP_INPUT + SCTP_LOC_14);
1593 			/* update current state */
1594 			if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)
1595 				SCTP_STAT_INCR_COUNTER32(sctps_activeestab);
1596 			else
1597 				SCTP_STAT_INCR_COUNTER32(sctps_collisionestab);
1598 
1599 			SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);
1600 			if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
1601 				sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
1602 				    stcb->sctp_ep, stcb, asoc->primary_destination);
1603 			}
1604 			SCTP_STAT_INCR_GAUGE32(sctps_currestab);
1605 			sctp_stop_all_cookie_timers(stcb);
1606 			if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
1607 			    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
1608 			    (inp->sctp_socket->so_qlimit == 0)
1609 			    ) {
1610 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1611 				struct socket *so;
1612 #endif
1613 				/*
1614 				 * Here is where collision would go if we
1615 				 * did a connect() and instead got a
1616 				 * init/init-ack/cookie done before the
1617 				 * init-ack came back..
1618 				 */
1619 				stcb->sctp_ep->sctp_flags |=
1620 				    SCTP_PCB_FLAGS_CONNECTED;
1621 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1622 				so = SCTP_INP_SO(stcb->sctp_ep);
1623 				atomic_add_int(&stcb->asoc.refcnt, 1);
1624 				SCTP_TCB_UNLOCK(stcb);
1625 				SCTP_SOCKET_LOCK(so, 1);
1626 				SCTP_TCB_LOCK(stcb);
1627 				atomic_add_int(&stcb->asoc.refcnt, -1);
1628 				if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
1629 					SCTP_SOCKET_UNLOCK(so, 1);
1630 					return (NULL);
1631 				}
1632 #endif
1633 				soisconnected(stcb->sctp_socket);
1634 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1635 				SCTP_SOCKET_UNLOCK(so, 1);
1636 #endif
1637 			}
1638 			/* notify upper layer */
1639 			*notification = SCTP_NOTIFY_ASSOC_UP;
1640 			/*
1641 			 * since we did not send a HB make sure we don't
1642 			 * double things
1643 			 */
1644 			net->hb_responded = 1;
1645 			net->RTO = sctp_calculate_rto(stcb, asoc, net,
1646 			    &cookie->time_entered,
1647 			    sctp_align_unsafe_makecopy,
1648 			    SCTP_RTT_FROM_NON_DATA);
1649 
1650 			if (stcb->asoc.sctp_autoclose_ticks &&
1651 			    (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE))) {
1652 				sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE,
1653 				    inp, stcb, NULL);
1654 			}
1655 			break;
1656 		default:
1657 			/*
1658 			 * we're in the OPEN state (or beyond), so peer must
1659 			 * have simply lost the COOKIE-ACK
1660 			 */
1661 			break;
1662 		}		/* end switch */
1663 		sctp_stop_all_cookie_timers(stcb);
1664 		/*
1665 		 * We ignore the return code here.. not sure if we should
1666 		 * somehow abort.. but we do have an existing asoc. This
1667 		 * really should not fail.
1668 		 */
1669 		if (sctp_load_addresses_from_init(stcb, m,
1670 		    init_offset + sizeof(struct sctp_init_chunk),
1671 		    initack_offset, src, dst, init_src, stcb->asoc.port)) {
1672 			if (how_indx < sizeof(asoc->cookie_how))
1673 				asoc->cookie_how[how_indx] = 4;
1674 			return (NULL);
1675 		}
1676 		/* respond with a COOKIE-ACK */
1677 		sctp_toss_old_cookies(stcb, asoc);
1678 		sctp_send_cookie_ack(stcb);
1679 		if (how_indx < sizeof(asoc->cookie_how))
1680 			asoc->cookie_how[how_indx] = 5;
1681 		return (stcb);
1682 	}
1683 	if (ntohl(initack_cp->init.initiate_tag) != asoc->my_vtag &&
1684 	    ntohl(init_cp->init.initiate_tag) == asoc->peer_vtag &&
1685 	    cookie->tie_tag_my_vtag == 0 &&
1686 	    cookie->tie_tag_peer_vtag == 0) {
1687 		/*
1688 		 * case C in Section 5.2.4 Table 2: XMOO silently discard
1689 		 */
1690 		if (how_indx < sizeof(asoc->cookie_how))
1691 			asoc->cookie_how[how_indx] = 6;
1692 		return (NULL);
1693 	}
1694 	/*
1695 	 * If nat support, and the below and stcb is established, send back
1696 	 * a ABORT(colliding state) if we are established.
1697 	 */
1698 	if ((SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) &&
1699 	    (asoc->peer_supports_nat) &&
1700 	    ((ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag) &&
1701 	    ((ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) ||
1702 	    (asoc->peer_vtag == 0)))) {
1703 		/*
1704 		 * Special case - Peer's support nat. We may have two init's
1705 		 * that we gave out the same tag on since one was not
1706 		 * established.. i.e. we get INIT from host-1 behind the nat
1707 		 * and we respond tag-a, we get a INIT from host-2 behind
1708 		 * the nat and we get tag-a again. Then we bring up host-1
1709 		 * (or 2's) assoc, Then comes the cookie from hsot-2 (or 1).
1710 		 * Now we have colliding state. We must send an abort here
1711 		 * with colliding state indication.
1712 		 */
1713 		op_err = sctp_generate_cause(SCTP_CAUSE_NAT_COLLIDING_STATE, "");
1714 		sctp_send_abort(m, iphlen, src, dst, sh, 0, op_err,
1715 		    mflowtype, mflowid, inp->fibnum,
1716 		    vrf_id, port);
1717 		return (NULL);
1718 	}
1719 	if ((ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag) &&
1720 	    ((ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) ||
1721 	    (asoc->peer_vtag == 0))) {
1722 		/*
1723 		 * case B in Section 5.2.4 Table 2: MXAA or MOAA my info
1724 		 * should be ok, re-accept peer info
1725 		 */
1726 		if (ntohl(initack_cp->init.initial_tsn) != asoc->init_seq_number) {
1727 			/*
1728 			 * Extension of case C. If we hit this, then the
1729 			 * random number generator returned the same vtag
1730 			 * when we first sent our INIT-ACK and when we later
1731 			 * sent our INIT. The side with the seq numbers that
1732 			 * are different will be the one that normnally
1733 			 * would have hit case C. This in effect "extends"
1734 			 * our vtags in this collision case to be 64 bits.
1735 			 * The same collision could occur aka you get both
1736 			 * vtag and seq number the same twice in a row.. but
1737 			 * is much less likely. If it did happen then we
1738 			 * would proceed through and bring up the assoc.. we
1739 			 * may end up with the wrong stream setup however..
1740 			 * which would be bad.. but there is no way to
1741 			 * tell.. until we send on a stream that does not
1742 			 * exist :-)
1743 			 */
1744 			if (how_indx < sizeof(asoc->cookie_how))
1745 				asoc->cookie_how[how_indx] = 7;
1746 
1747 			return (NULL);
1748 		}
1749 		if (how_indx < sizeof(asoc->cookie_how))
1750 			asoc->cookie_how[how_indx] = 8;
1751 		sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net,
1752 		    SCTP_FROM_SCTP_INPUT + SCTP_LOC_15);
1753 		sctp_stop_all_cookie_timers(stcb);
1754 		/*
1755 		 * since we did not send a HB make sure we don't double
1756 		 * things
1757 		 */
1758 		net->hb_responded = 1;
1759 		if (stcb->asoc.sctp_autoclose_ticks &&
1760 		    sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE)) {
1761 			sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb,
1762 			    NULL);
1763 		}
1764 		asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd);
1765 		asoc->pre_open_streams = ntohs(initack_cp->init.num_outbound_streams);
1766 
1767 		if (ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) {
1768 			/*
1769 			 * Ok the peer probably discarded our data (if we
1770 			 * echoed a cookie+data). So anything on the
1771 			 * sent_queue should be marked for retransmit, we
1772 			 * may not get something to kick us so it COULD
1773 			 * still take a timeout to move these.. but it can't
1774 			 * hurt to mark them.
1775 			 */
1776 			struct sctp_tmit_chunk *chk;
1777 
1778 			TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
1779 				if (chk->sent < SCTP_DATAGRAM_RESEND) {
1780 					chk->sent = SCTP_DATAGRAM_RESEND;
1781 					sctp_flight_size_decrease(chk);
1782 					sctp_total_flight_decrease(stcb, chk);
1783 					sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
1784 					spec_flag++;
1785 				}
1786 			}
1787 
1788 		}
1789 		/* process the INIT info (peer's info) */
1790 		retval = sctp_process_init(init_cp, stcb);
1791 		if (retval < 0) {
1792 			if (how_indx < sizeof(asoc->cookie_how))
1793 				asoc->cookie_how[how_indx] = 9;
1794 			return (NULL);
1795 		}
1796 		if (sctp_load_addresses_from_init(stcb, m,
1797 		    init_offset + sizeof(struct sctp_init_chunk),
1798 		    initack_offset, src, dst, init_src, stcb->asoc.port)) {
1799 			if (how_indx < sizeof(asoc->cookie_how))
1800 				asoc->cookie_how[how_indx] = 10;
1801 			return (NULL);
1802 		}
1803 		if ((asoc->state & SCTP_STATE_COOKIE_WAIT) ||
1804 		    (asoc->state & SCTP_STATE_COOKIE_ECHOED)) {
1805 			*notification = SCTP_NOTIFY_ASSOC_UP;
1806 
1807 			if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
1808 			    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
1809 			    (inp->sctp_socket->so_qlimit == 0)) {
1810 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1811 				struct socket *so;
1812 #endif
1813 				stcb->sctp_ep->sctp_flags |=
1814 				    SCTP_PCB_FLAGS_CONNECTED;
1815 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1816 				so = SCTP_INP_SO(stcb->sctp_ep);
1817 				atomic_add_int(&stcb->asoc.refcnt, 1);
1818 				SCTP_TCB_UNLOCK(stcb);
1819 				SCTP_SOCKET_LOCK(so, 1);
1820 				SCTP_TCB_LOCK(stcb);
1821 				atomic_add_int(&stcb->asoc.refcnt, -1);
1822 				if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
1823 					SCTP_SOCKET_UNLOCK(so, 1);
1824 					return (NULL);
1825 				}
1826 #endif
1827 				soisconnected(stcb->sctp_socket);
1828 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1829 				SCTP_SOCKET_UNLOCK(so, 1);
1830 #endif
1831 			}
1832 			if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)
1833 				SCTP_STAT_INCR_COUNTER32(sctps_activeestab);
1834 			else
1835 				SCTP_STAT_INCR_COUNTER32(sctps_collisionestab);
1836 			SCTP_STAT_INCR_GAUGE32(sctps_currestab);
1837 		} else if (SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) {
1838 			SCTP_STAT_INCR_COUNTER32(sctps_restartestab);
1839 		} else {
1840 			SCTP_STAT_INCR_COUNTER32(sctps_collisionestab);
1841 		}
1842 		SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);
1843 		if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
1844 			sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
1845 			    stcb->sctp_ep, stcb, asoc->primary_destination);
1846 		}
1847 		sctp_stop_all_cookie_timers(stcb);
1848 		sctp_toss_old_cookies(stcb, asoc);
1849 		sctp_send_cookie_ack(stcb);
1850 		if (spec_flag) {
1851 			/*
1852 			 * only if we have retrans set do we do this. What
1853 			 * this call does is get only the COOKIE-ACK out and
1854 			 * then when we return the normal call to
1855 			 * sctp_chunk_output will get the retrans out behind
1856 			 * this.
1857 			 */
1858 			sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_COOKIE_ACK, SCTP_SO_NOT_LOCKED);
1859 		}
1860 		if (how_indx < sizeof(asoc->cookie_how))
1861 			asoc->cookie_how[how_indx] = 11;
1862 
1863 		return (stcb);
1864 	}
1865 	if ((ntohl(initack_cp->init.initiate_tag) != asoc->my_vtag &&
1866 	    ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) &&
1867 	    cookie->tie_tag_my_vtag == asoc->my_vtag_nonce &&
1868 	    cookie->tie_tag_peer_vtag == asoc->peer_vtag_nonce &&
1869 	    cookie->tie_tag_peer_vtag != 0) {
1870 		struct sctpasochead *head;
1871 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1872 		struct socket *so;
1873 #endif
1874 
1875 		if (asoc->peer_supports_nat) {
1876 			/*
1877 			 * This is a gross gross hack. Just call the
1878 			 * cookie_new code since we are allowing a duplicate
1879 			 * association. I hope this works...
1880 			 */
1881 			return (sctp_process_cookie_new(m, iphlen, offset, src, dst,
1882 			    sh, cookie, cookie_len,
1883 			    inp, netp, init_src, notification,
1884 			    auth_skipped, auth_offset, auth_len,
1885 			    mflowtype, mflowid,
1886 			    vrf_id, port));
1887 		}
1888 		/*
1889 		 * case A in Section 5.2.4 Table 2: XXMM (peer restarted)
1890 		 */
1891 		/* temp code */
1892 		if (how_indx < sizeof(asoc->cookie_how))
1893 			asoc->cookie_how[how_indx] = 12;
1894 		sctp_timer_stop(SCTP_TIMER_TYPE_INIT, inp, stcb, net,
1895 		    SCTP_FROM_SCTP_INPUT + SCTP_LOC_16);
1896 		sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net,
1897 		    SCTP_FROM_SCTP_INPUT + SCTP_LOC_17);
1898 
1899 		/* notify upper layer */
1900 		*notification = SCTP_NOTIFY_ASSOC_RESTART;
1901 		atomic_add_int(&stcb->asoc.refcnt, 1);
1902 		if ((SCTP_GET_STATE(asoc) != SCTP_STATE_OPEN) &&
1903 		    (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) &&
1904 		    (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT)) {
1905 			SCTP_STAT_INCR_GAUGE32(sctps_currestab);
1906 		}
1907 		if (SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) {
1908 			SCTP_STAT_INCR_GAUGE32(sctps_restartestab);
1909 		} else if (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) {
1910 			SCTP_STAT_INCR_GAUGE32(sctps_collisionestab);
1911 		}
1912 		if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
1913 			SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);
1914 			sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
1915 			    stcb->sctp_ep, stcb, asoc->primary_destination);
1916 
1917 		} else if (!(asoc->state & SCTP_STATE_SHUTDOWN_SENT)) {
1918 			/* move to OPEN state, if not in SHUTDOWN_SENT */
1919 			SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);
1920 		}
1921 		asoc->pre_open_streams =
1922 		    ntohs(initack_cp->init.num_outbound_streams);
1923 		asoc->init_seq_number = ntohl(initack_cp->init.initial_tsn);
1924 		asoc->sending_seq = asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number;
1925 		asoc->asconf_seq_out_acked = asoc->asconf_seq_out - 1;
1926 
1927 		asoc->asconf_seq_in = asoc->last_acked_seq = asoc->init_seq_number - 1;
1928 
1929 		asoc->str_reset_seq_in = asoc->init_seq_number;
1930 
1931 		asoc->advanced_peer_ack_point = asoc->last_acked_seq;
1932 		if (asoc->mapping_array) {
1933 			memset(asoc->mapping_array, 0,
1934 			    asoc->mapping_array_size);
1935 		}
1936 		if (asoc->nr_mapping_array) {
1937 			memset(asoc->nr_mapping_array, 0,
1938 			    asoc->mapping_array_size);
1939 		}
1940 		SCTP_TCB_UNLOCK(stcb);
1941 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1942 		so = SCTP_INP_SO(stcb->sctp_ep);
1943 		SCTP_SOCKET_LOCK(so, 1);
1944 #endif
1945 		SCTP_INP_INFO_WLOCK();
1946 		SCTP_INP_WLOCK(stcb->sctp_ep);
1947 		SCTP_TCB_LOCK(stcb);
1948 		atomic_add_int(&stcb->asoc.refcnt, -1);
1949 		/* send up all the data */
1950 		SCTP_TCB_SEND_LOCK(stcb);
1951 
1952 		sctp_report_all_outbound(stcb, 0, 1, SCTP_SO_LOCKED);
1953 		for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
1954 			stcb->asoc.strmout[i].chunks_on_queues = 0;
1955 #if defined(SCTP_DETAILED_STR_STATS)
1956 			for (j = 0; j < SCTP_PR_SCTP_MAX + 1; j++) {
1957 				asoc->strmout[i].abandoned_sent[j] = 0;
1958 				asoc->strmout[i].abandoned_unsent[j] = 0;
1959 			}
1960 #else
1961 			asoc->strmout[i].abandoned_sent[0] = 0;
1962 			asoc->strmout[i].abandoned_unsent[0] = 0;
1963 #endif
1964 			stcb->asoc.strmout[i].sid = i;
1965 			stcb->asoc.strmout[i].next_mid_ordered = 0;
1966 			stcb->asoc.strmout[i].next_mid_unordered = 0;
1967 			stcb->asoc.strmout[i].last_msg_incomplete = 0;
1968 		}
1969 		/* process the INIT-ACK info (my info) */
1970 		asoc->my_vtag = ntohl(initack_cp->init.initiate_tag);
1971 		asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd);
1972 
1973 		/* pull from vtag hash */
1974 		LIST_REMOVE(stcb, sctp_asocs);
1975 		/* re-insert to new vtag position */
1976 		head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag,
1977 		    SCTP_BASE_INFO(hashasocmark))];
1978 		/*
1979 		 * put it in the bucket in the vtag hash of assoc's for the
1980 		 * system
1981 		 */
1982 		LIST_INSERT_HEAD(head, stcb, sctp_asocs);
1983 
1984 		SCTP_TCB_SEND_UNLOCK(stcb);
1985 		SCTP_INP_WUNLOCK(stcb->sctp_ep);
1986 		SCTP_INP_INFO_WUNLOCK();
1987 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1988 		SCTP_SOCKET_UNLOCK(so, 1);
1989 #endif
1990 		asoc->total_flight = 0;
1991 		asoc->total_flight_count = 0;
1992 		/* process the INIT info (peer's info) */
1993 		retval = sctp_process_init(init_cp, stcb);
1994 		if (retval < 0) {
1995 			if (how_indx < sizeof(asoc->cookie_how))
1996 				asoc->cookie_how[how_indx] = 13;
1997 
1998 			return (NULL);
1999 		}
2000 		/*
2001 		 * since we did not send a HB make sure we don't double
2002 		 * things
2003 		 */
2004 		net->hb_responded = 1;
2005 
2006 		if (sctp_load_addresses_from_init(stcb, m,
2007 		    init_offset + sizeof(struct sctp_init_chunk),
2008 		    initack_offset, src, dst, init_src, stcb->asoc.port)) {
2009 			if (how_indx < sizeof(asoc->cookie_how))
2010 				asoc->cookie_how[how_indx] = 14;
2011 
2012 			return (NULL);
2013 		}
2014 		/* respond with a COOKIE-ACK */
2015 		sctp_stop_all_cookie_timers(stcb);
2016 		sctp_toss_old_cookies(stcb, asoc);
2017 		sctp_send_cookie_ack(stcb);
2018 		if (how_indx < sizeof(asoc->cookie_how))
2019 			asoc->cookie_how[how_indx] = 15;
2020 
2021 		return (stcb);
2022 	}
2023 	if (how_indx < sizeof(asoc->cookie_how))
2024 		asoc->cookie_how[how_indx] = 16;
2025 	/* all other cases... */
2026 	return (NULL);
2027 }
2028 
2029 
2030 /*
2031  * handle a state cookie for a new association m: input packet mbuf chain--
2032  * assumes a pullup on IP/SCTP/COOKIE-ECHO chunk note: this is a "split" mbuf
2033  * and the cookie signature does not exist offset: offset into mbuf to the
2034  * cookie-echo chunk length: length of the cookie chunk to: where the init
2035  * was from returns a new TCB
2036  */
2037 static struct sctp_tcb *
2038 sctp_process_cookie_new(struct mbuf *m, int iphlen, int offset,
2039     struct sockaddr *src, struct sockaddr *dst,
2040     struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len,
2041     struct sctp_inpcb *inp, struct sctp_nets **netp,
2042     struct sockaddr *init_src, int *notification,
2043     int auth_skipped, uint32_t auth_offset, uint32_t auth_len,
2044     uint8_t mflowtype, uint32_t mflowid,
2045     uint32_t vrf_id, uint16_t port)
2046 {
2047 	struct sctp_tcb *stcb;
2048 	struct sctp_init_chunk *init_cp, init_buf;
2049 	struct sctp_init_ack_chunk *initack_cp, initack_buf;
2050 	union sctp_sockstore store;
2051 	struct sctp_association *asoc;
2052 	int init_offset, initack_offset, initack_limit;
2053 	int retval;
2054 	int error = 0;
2055 	uint8_t auth_chunk_buf[SCTP_PARAM_BUFFER_SIZE];
2056 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2057 	struct socket *so;
2058 
2059 	so = SCTP_INP_SO(inp);
2060 #endif
2061 
2062 	/*
2063 	 * find and validate the INIT chunk in the cookie (peer's info) the
2064 	 * INIT should start after the cookie-echo header struct (chunk
2065 	 * header, state cookie header struct)
2066 	 */
2067 	init_offset = offset + sizeof(struct sctp_cookie_echo_chunk);
2068 	init_cp = (struct sctp_init_chunk *)
2069 	    sctp_m_getptr(m, init_offset, sizeof(struct sctp_init_chunk),
2070 	    (uint8_t *)&init_buf);
2071 	if (init_cp == NULL) {
2072 		/* could not pull a INIT chunk in cookie */
2073 		SCTPDBG(SCTP_DEBUG_INPUT1,
2074 		    "process_cookie_new: could not pull INIT chunk hdr\n");
2075 		return (NULL);
2076 	}
2077 	if (init_cp->ch.chunk_type != SCTP_INITIATION) {
2078 		SCTPDBG(SCTP_DEBUG_INPUT1, "HUH? process_cookie_new: could not find INIT chunk!\n");
2079 		return (NULL);
2080 	}
2081 	initack_offset = init_offset + SCTP_SIZE32(ntohs(init_cp->ch.chunk_length));
2082 	/*
2083 	 * find and validate the INIT-ACK chunk in the cookie (my info) the
2084 	 * INIT-ACK follows the INIT chunk
2085 	 */
2086 	initack_cp = (struct sctp_init_ack_chunk *)
2087 	    sctp_m_getptr(m, initack_offset, sizeof(struct sctp_init_ack_chunk),
2088 	    (uint8_t *)&initack_buf);
2089 	if (initack_cp == NULL) {
2090 		/* could not pull INIT-ACK chunk in cookie */
2091 		SCTPDBG(SCTP_DEBUG_INPUT1, "process_cookie_new: could not pull INIT-ACK chunk hdr\n");
2092 		return (NULL);
2093 	}
2094 	if (initack_cp->ch.chunk_type != SCTP_INITIATION_ACK) {
2095 		return (NULL);
2096 	}
2097 	/*
2098 	 * NOTE: We can't use the INIT_ACK's chk_length to determine the
2099 	 * "initack_limit" value.  This is because the chk_length field
2100 	 * includes the length of the cookie, but the cookie is omitted when
2101 	 * the INIT and INIT_ACK are tacked onto the cookie...
2102 	 */
2103 	initack_limit = offset + cookie_len;
2104 
2105 	/*
2106 	 * now that we know the INIT/INIT-ACK are in place, create a new TCB
2107 	 * and popluate
2108 	 */
2109 
2110 	/*
2111 	 * Here we do a trick, we set in NULL for the proc/thread argument.
2112 	 * We do this since in effect we only use the p argument when the
2113 	 * socket is unbound and we must do an implicit bind. Since we are
2114 	 * getting a cookie, we cannot be unbound.
2115 	 */
2116 	stcb = sctp_aloc_assoc(inp, init_src, &error,
2117 	    ntohl(initack_cp->init.initiate_tag), vrf_id,
2118 	    ntohs(initack_cp->init.num_outbound_streams),
2119 	    port,
2120 	    (struct thread *)NULL
2121 	    );
2122 	if (stcb == NULL) {
2123 		struct mbuf *op_err;
2124 
2125 		/* memory problem? */
2126 		SCTPDBG(SCTP_DEBUG_INPUT1,
2127 		    "process_cookie_new: no room for another TCB!\n");
2128 		op_err = sctp_generate_cause(SCTP_CAUSE_OUT_OF_RESC, "");
2129 		sctp_abort_association(inp, (struct sctp_tcb *)NULL, m, iphlen,
2130 		    src, dst, sh, op_err,
2131 		    mflowtype, mflowid,
2132 		    vrf_id, port);
2133 		return (NULL);
2134 	}
2135 	/* get the correct sctp_nets */
2136 	if (netp)
2137 		*netp = sctp_findnet(stcb, init_src);
2138 
2139 	asoc = &stcb->asoc;
2140 	/* get scope variables out of cookie */
2141 	asoc->scope.ipv4_local_scope = cookie->ipv4_scope;
2142 	asoc->scope.site_scope = cookie->site_scope;
2143 	asoc->scope.local_scope = cookie->local_scope;
2144 	asoc->scope.loopback_scope = cookie->loopback_scope;
2145 
2146 	if ((asoc->scope.ipv4_addr_legal != cookie->ipv4_addr_legal) ||
2147 	    (asoc->scope.ipv6_addr_legal != cookie->ipv6_addr_legal)) {
2148 		struct mbuf *op_err;
2149 
2150 		/*
2151 		 * Houston we have a problem. The EP changed while the
2152 		 * cookie was in flight. Only recourse is to abort the
2153 		 * association.
2154 		 */
2155 		atomic_add_int(&stcb->asoc.refcnt, 1);
2156 		op_err = sctp_generate_cause(SCTP_CAUSE_OUT_OF_RESC, "");
2157 		sctp_abort_association(inp, (struct sctp_tcb *)NULL, m, iphlen,
2158 		    src, dst, sh, op_err,
2159 		    mflowtype, mflowid,
2160 		    vrf_id, port);
2161 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2162 		SCTP_TCB_UNLOCK(stcb);
2163 		SCTP_SOCKET_LOCK(so, 1);
2164 		SCTP_TCB_LOCK(stcb);
2165 #endif
2166 		(void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
2167 		    SCTP_FROM_SCTP_INPUT + SCTP_LOC_18);
2168 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2169 		SCTP_SOCKET_UNLOCK(so, 1);
2170 #endif
2171 		atomic_subtract_int(&stcb->asoc.refcnt, 1);
2172 		return (NULL);
2173 	}
2174 	/* process the INIT-ACK info (my info) */
2175 	asoc->my_vtag = ntohl(initack_cp->init.initiate_tag);
2176 	asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd);
2177 	asoc->pre_open_streams = ntohs(initack_cp->init.num_outbound_streams);
2178 	asoc->init_seq_number = ntohl(initack_cp->init.initial_tsn);
2179 	asoc->sending_seq = asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number;
2180 	asoc->asconf_seq_out_acked = asoc->asconf_seq_out - 1;
2181 	asoc->asconf_seq_in = asoc->last_acked_seq = asoc->init_seq_number - 1;
2182 	asoc->str_reset_seq_in = asoc->init_seq_number;
2183 
2184 	asoc->advanced_peer_ack_point = asoc->last_acked_seq;
2185 
2186 	/* process the INIT info (peer's info) */
2187 	if (netp)
2188 		retval = sctp_process_init(init_cp, stcb);
2189 	else
2190 		retval = 0;
2191 	if (retval < 0) {
2192 		atomic_add_int(&stcb->asoc.refcnt, 1);
2193 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2194 		SCTP_TCB_UNLOCK(stcb);
2195 		SCTP_SOCKET_LOCK(so, 1);
2196 		SCTP_TCB_LOCK(stcb);
2197 #endif
2198 		(void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
2199 		    SCTP_FROM_SCTP_INPUT + SCTP_LOC_19);
2200 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2201 		SCTP_SOCKET_UNLOCK(so, 1);
2202 #endif
2203 		atomic_subtract_int(&stcb->asoc.refcnt, 1);
2204 		return (NULL);
2205 	}
2206 	/* load all addresses */
2207 	if (sctp_load_addresses_from_init(stcb, m,
2208 	    init_offset + sizeof(struct sctp_init_chunk), initack_offset,
2209 	    src, dst, init_src, port)) {
2210 		atomic_add_int(&stcb->asoc.refcnt, 1);
2211 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2212 		SCTP_TCB_UNLOCK(stcb);
2213 		SCTP_SOCKET_LOCK(so, 1);
2214 		SCTP_TCB_LOCK(stcb);
2215 #endif
2216 		(void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
2217 		    SCTP_FROM_SCTP_INPUT + SCTP_LOC_20);
2218 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2219 		SCTP_SOCKET_UNLOCK(so, 1);
2220 #endif
2221 		atomic_subtract_int(&stcb->asoc.refcnt, 1);
2222 		return (NULL);
2223 	}
2224 	/*
2225 	 * verify any preceding AUTH chunk that was skipped
2226 	 */
2227 	/* pull the local authentication parameters from the cookie/init-ack */
2228 	sctp_auth_get_cookie_params(stcb, m,
2229 	    initack_offset + sizeof(struct sctp_init_ack_chunk),
2230 	    initack_limit - (initack_offset + sizeof(struct sctp_init_ack_chunk)));
2231 	if (auth_skipped) {
2232 		struct sctp_auth_chunk *auth;
2233 
2234 		auth = (struct sctp_auth_chunk *)
2235 		    sctp_m_getptr(m, auth_offset, auth_len, auth_chunk_buf);
2236 		if ((auth == NULL) || sctp_handle_auth(stcb, auth, m, auth_offset)) {
2237 			/* auth HMAC failed, dump the assoc and packet */
2238 			SCTPDBG(SCTP_DEBUG_AUTH1,
2239 			    "COOKIE-ECHO: AUTH failed\n");
2240 			atomic_add_int(&stcb->asoc.refcnt, 1);
2241 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2242 			SCTP_TCB_UNLOCK(stcb);
2243 			SCTP_SOCKET_LOCK(so, 1);
2244 			SCTP_TCB_LOCK(stcb);
2245 #endif
2246 			(void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
2247 			    SCTP_FROM_SCTP_INPUT + SCTP_LOC_21);
2248 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2249 			SCTP_SOCKET_UNLOCK(so, 1);
2250 #endif
2251 			atomic_subtract_int(&stcb->asoc.refcnt, 1);
2252 			return (NULL);
2253 		} else {
2254 			/* remaining chunks checked... good to go */
2255 			stcb->asoc.authenticated = 1;
2256 		}
2257 	}
2258 	/* update current state */
2259 	SCTPDBG(SCTP_DEBUG_INPUT2, "moving to OPEN state\n");
2260 	SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);
2261 	if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
2262 		sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
2263 		    stcb->sctp_ep, stcb, asoc->primary_destination);
2264 	}
2265 	sctp_stop_all_cookie_timers(stcb);
2266 	SCTP_STAT_INCR_COUNTER32(sctps_passiveestab);
2267 	SCTP_STAT_INCR_GAUGE32(sctps_currestab);
2268 
2269 	/*
2270 	 * if we're doing ASCONFs, check to see if we have any new local
2271 	 * addresses that need to get added to the peer (eg. addresses
2272 	 * changed while cookie echo in flight).  This needs to be done
2273 	 * after we go to the OPEN state to do the correct asconf
2274 	 * processing. else, make sure we have the correct addresses in our
2275 	 * lists
2276 	 */
2277 
2278 	/* warning, we re-use sin, sin6, sa_store here! */
2279 	/* pull in local_address (our "from" address) */
2280 	switch (cookie->laddr_type) {
2281 #ifdef INET
2282 	case SCTP_IPV4_ADDRESS:
2283 		/* source addr is IPv4 */
2284 		memset(&store.sin, 0, sizeof(struct sockaddr_in));
2285 		store.sin.sin_family = AF_INET;
2286 		store.sin.sin_len = sizeof(struct sockaddr_in);
2287 		store.sin.sin_addr.s_addr = cookie->laddress[0];
2288 		break;
2289 #endif
2290 #ifdef INET6
2291 	case SCTP_IPV6_ADDRESS:
2292 		/* source addr is IPv6 */
2293 		memset(&store.sin6, 0, sizeof(struct sockaddr_in6));
2294 		store.sin6.sin6_family = AF_INET6;
2295 		store.sin6.sin6_len = sizeof(struct sockaddr_in6);
2296 		store.sin6.sin6_scope_id = cookie->scope_id;
2297 		memcpy(&store.sin6.sin6_addr, cookie->laddress, sizeof(struct in6_addr));
2298 		break;
2299 #endif
2300 	default:
2301 		atomic_add_int(&stcb->asoc.refcnt, 1);
2302 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2303 		SCTP_TCB_UNLOCK(stcb);
2304 		SCTP_SOCKET_LOCK(so, 1);
2305 		SCTP_TCB_LOCK(stcb);
2306 #endif
2307 		(void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
2308 		    SCTP_FROM_SCTP_INPUT + SCTP_LOC_22);
2309 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2310 		SCTP_SOCKET_UNLOCK(so, 1);
2311 #endif
2312 		atomic_subtract_int(&stcb->asoc.refcnt, 1);
2313 		return (NULL);
2314 	}
2315 
2316 	/* set up to notify upper layer */
2317 	*notification = SCTP_NOTIFY_ASSOC_UP;
2318 	if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
2319 	    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
2320 	    (inp->sctp_socket->so_qlimit == 0)) {
2321 		/*
2322 		 * This is an endpoint that called connect() how it got a
2323 		 * cookie that is NEW is a bit of a mystery. It must be that
2324 		 * the INIT was sent, but before it got there.. a complete
2325 		 * INIT/INIT-ACK/COOKIE arrived. But of course then it
2326 		 * should have went to the other code.. not here.. oh well..
2327 		 * a bit of protection is worth having..
2328 		 */
2329 		stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_CONNECTED;
2330 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2331 		atomic_add_int(&stcb->asoc.refcnt, 1);
2332 		SCTP_TCB_UNLOCK(stcb);
2333 		SCTP_SOCKET_LOCK(so, 1);
2334 		SCTP_TCB_LOCK(stcb);
2335 		atomic_subtract_int(&stcb->asoc.refcnt, 1);
2336 		if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
2337 			SCTP_SOCKET_UNLOCK(so, 1);
2338 			return (NULL);
2339 		}
2340 #endif
2341 		soisconnected(stcb->sctp_socket);
2342 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2343 		SCTP_SOCKET_UNLOCK(so, 1);
2344 #endif
2345 	} else if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
2346 	    (inp->sctp_socket->so_qlimit)) {
2347 		/*
2348 		 * We don't want to do anything with this one. Since it is
2349 		 * the listening guy. The timer will get started for
2350 		 * accepted connections in the caller.
2351 		 */
2352 		;
2353 	}
2354 	/* since we did not send a HB make sure we don't double things */
2355 	if ((netp) && (*netp))
2356 		(*netp)->hb_responded = 1;
2357 
2358 	if (stcb->asoc.sctp_autoclose_ticks &&
2359 	    sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE)) {
2360 		sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb, NULL);
2361 	}
2362 	(void)SCTP_GETTIME_TIMEVAL(&stcb->asoc.time_entered);
2363 	if ((netp != NULL) && (*netp != NULL)) {
2364 		/* calculate the RTT and set the encaps port */
2365 		(*netp)->RTO = sctp_calculate_rto(stcb, asoc, *netp,
2366 		    &cookie->time_entered, sctp_align_unsafe_makecopy,
2367 		    SCTP_RTT_FROM_NON_DATA);
2368 	}
2369 	/* respond with a COOKIE-ACK */
2370 	sctp_send_cookie_ack(stcb);
2371 
2372 	/*
2373 	 * check the address lists for any ASCONFs that need to be sent
2374 	 * AFTER the cookie-ack is sent
2375 	 */
2376 	sctp_check_address_list(stcb, m,
2377 	    initack_offset + sizeof(struct sctp_init_ack_chunk),
2378 	    initack_limit - (initack_offset + sizeof(struct sctp_init_ack_chunk)),
2379 	    &store.sa, cookie->local_scope, cookie->site_scope,
2380 	    cookie->ipv4_scope, cookie->loopback_scope);
2381 
2382 
2383 	return (stcb);
2384 }
2385 
2386 /*
2387  * CODE LIKE THIS NEEDS TO RUN IF the peer supports the NAT extension, i.e
2388  * we NEED to make sure we are not already using the vtag. If so we
2389  * need to send back an ABORT-TRY-AGAIN-WITH-NEW-TAG No middle box bit!
2390 	head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(tag,
2391 							    SCTP_BASE_INFO(hashasocmark))];
2392 	LIST_FOREACH(stcb, head, sctp_asocs) {
2393 	        if ((stcb->asoc.my_vtag == tag) && (stcb->rport == rport) && (inp == stcb->sctp_ep))  {
2394 		       -- SEND ABORT - TRY AGAIN --
2395 		}
2396 	}
2397 */
2398 
2399 /*
2400  * handles a COOKIE-ECHO message stcb: modified to either a new or left as
2401  * existing (non-NULL) TCB
2402  */
2403 static struct mbuf *
2404 sctp_handle_cookie_echo(struct mbuf *m, int iphlen, int offset,
2405     struct sockaddr *src, struct sockaddr *dst,
2406     struct sctphdr *sh, struct sctp_cookie_echo_chunk *cp,
2407     struct sctp_inpcb **inp_p, struct sctp_tcb **stcb, struct sctp_nets **netp,
2408     int auth_skipped, uint32_t auth_offset, uint32_t auth_len,
2409     struct sctp_tcb **locked_tcb,
2410     uint8_t mflowtype, uint32_t mflowid,
2411     uint32_t vrf_id, uint16_t port)
2412 {
2413 	struct sctp_state_cookie *cookie;
2414 	struct sctp_tcb *l_stcb = *stcb;
2415 	struct sctp_inpcb *l_inp;
2416 	struct sockaddr *to;
2417 	struct sctp_pcb *ep;
2418 	struct mbuf *m_sig;
2419 	uint8_t calc_sig[SCTP_SIGNATURE_SIZE], tmp_sig[SCTP_SIGNATURE_SIZE];
2420 	uint8_t *sig;
2421 	uint8_t cookie_ok = 0;
2422 	unsigned int sig_offset, cookie_offset;
2423 	unsigned int cookie_len;
2424 	struct timeval now;
2425 	struct timeval time_expires;
2426 	int notification = 0;
2427 	struct sctp_nets *netl;
2428 	int had_a_existing_tcb = 0;
2429 	int send_int_conf = 0;
2430 #ifdef INET
2431 	struct sockaddr_in sin;
2432 #endif
2433 #ifdef INET6
2434 	struct sockaddr_in6 sin6;
2435 #endif
2436 
2437 	SCTPDBG(SCTP_DEBUG_INPUT2,
2438 	    "sctp_handle_cookie: handling COOKIE-ECHO\n");
2439 
2440 	if (inp_p == NULL) {
2441 		return (NULL);
2442 	}
2443 	cookie = &cp->cookie;
2444 	cookie_offset = offset + sizeof(struct sctp_chunkhdr);
2445 	cookie_len = ntohs(cp->ch.chunk_length);
2446 
2447 	if ((cookie->peerport != sh->src_port) ||
2448 	    (cookie->myport != sh->dest_port) ||
2449 	    (cookie->my_vtag != sh->v_tag)) {
2450 		/*
2451 		 * invalid ports or bad tag.  Note that we always leave the
2452 		 * v_tag in the header in network order and when we stored
2453 		 * it in the my_vtag slot we also left it in network order.
2454 		 * This maintains the match even though it may be in the
2455 		 * opposite byte order of the machine :->
2456 		 */
2457 		return (NULL);
2458 	}
2459 	if (cookie_len < sizeof(struct sctp_cookie_echo_chunk) +
2460 	    sizeof(struct sctp_init_chunk) +
2461 	    sizeof(struct sctp_init_ack_chunk) + SCTP_SIGNATURE_SIZE) {
2462 		/* cookie too small */
2463 		return (NULL);
2464 	}
2465 	/*
2466 	 * split off the signature into its own mbuf (since it should not be
2467 	 * calculated in the sctp_hmac_m() call).
2468 	 */
2469 	sig_offset = offset + cookie_len - SCTP_SIGNATURE_SIZE;
2470 	m_sig = m_split(m, sig_offset, M_NOWAIT);
2471 	if (m_sig == NULL) {
2472 		/* out of memory or ?? */
2473 		return (NULL);
2474 	}
2475 #ifdef SCTP_MBUF_LOGGING
2476 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
2477 		sctp_log_mbc(m_sig, SCTP_MBUF_SPLIT);
2478 	}
2479 #endif
2480 
2481 	/*
2482 	 * compute the signature/digest for the cookie
2483 	 */
2484 	ep = &(*inp_p)->sctp_ep;
2485 	l_inp = *inp_p;
2486 	if (l_stcb) {
2487 		SCTP_TCB_UNLOCK(l_stcb);
2488 	}
2489 	SCTP_INP_RLOCK(l_inp);
2490 	if (l_stcb) {
2491 		SCTP_TCB_LOCK(l_stcb);
2492 	}
2493 	/* which cookie is it? */
2494 	if ((cookie->time_entered.tv_sec < (long)ep->time_of_secret_change) &&
2495 	    (ep->current_secret_number != ep->last_secret_number)) {
2496 		/* it's the old cookie */
2497 		(void)sctp_hmac_m(SCTP_HMAC,
2498 		    (uint8_t *)ep->secret_key[(int)ep->last_secret_number],
2499 		    SCTP_SECRET_SIZE, m, cookie_offset, calc_sig, 0);
2500 	} else {
2501 		/* it's the current cookie */
2502 		(void)sctp_hmac_m(SCTP_HMAC,
2503 		    (uint8_t *)ep->secret_key[(int)ep->current_secret_number],
2504 		    SCTP_SECRET_SIZE, m, cookie_offset, calc_sig, 0);
2505 	}
2506 	/* get the signature */
2507 	SCTP_INP_RUNLOCK(l_inp);
2508 	sig = (uint8_t *)sctp_m_getptr(m_sig, 0, SCTP_SIGNATURE_SIZE, (uint8_t *)&tmp_sig);
2509 	if (sig == NULL) {
2510 		/* couldn't find signature */
2511 		sctp_m_freem(m_sig);
2512 		return (NULL);
2513 	}
2514 	/* compare the received digest with the computed digest */
2515 	if (memcmp(calc_sig, sig, SCTP_SIGNATURE_SIZE) != 0) {
2516 		/* try the old cookie? */
2517 		if ((cookie->time_entered.tv_sec == (long)ep->time_of_secret_change) &&
2518 		    (ep->current_secret_number != ep->last_secret_number)) {
2519 			/* compute digest with old */
2520 			(void)sctp_hmac_m(SCTP_HMAC,
2521 			    (uint8_t *)ep->secret_key[(int)ep->last_secret_number],
2522 			    SCTP_SECRET_SIZE, m, cookie_offset, calc_sig, 0);
2523 			/* compare */
2524 			if (memcmp(calc_sig, sig, SCTP_SIGNATURE_SIZE) == 0)
2525 				cookie_ok = 1;
2526 		}
2527 	} else {
2528 		cookie_ok = 1;
2529 	}
2530 
2531 	/*
2532 	 * Now before we continue we must reconstruct our mbuf so that
2533 	 * normal processing of any other chunks will work.
2534 	 */
2535 	{
2536 		struct mbuf *m_at;
2537 
2538 		m_at = m;
2539 		while (SCTP_BUF_NEXT(m_at) != NULL) {
2540 			m_at = SCTP_BUF_NEXT(m_at);
2541 		}
2542 		SCTP_BUF_NEXT(m_at) = m_sig;
2543 	}
2544 
2545 	if (cookie_ok == 0) {
2546 		SCTPDBG(SCTP_DEBUG_INPUT2, "handle_cookie_echo: cookie signature validation failed!\n");
2547 		SCTPDBG(SCTP_DEBUG_INPUT2,
2548 		    "offset = %u, cookie_offset = %u, sig_offset = %u\n",
2549 		    (uint32_t)offset, cookie_offset, sig_offset);
2550 		return (NULL);
2551 	}
2552 	/*
2553 	 * check the cookie timestamps to be sure it's not stale
2554 	 */
2555 	(void)SCTP_GETTIME_TIMEVAL(&now);
2556 	/* Expire time is in Ticks, so we convert to seconds */
2557 	time_expires.tv_sec = cookie->time_entered.tv_sec + TICKS_TO_SEC(cookie->cookie_life);
2558 	time_expires.tv_usec = cookie->time_entered.tv_usec;
2559 	/*
2560 	 * TODO sctp_constants.h needs alternative time macros when _KERNEL
2561 	 * is undefined.
2562 	 */
2563 	if (timevalcmp(&now, &time_expires, >)) {
2564 		/* cookie is stale! */
2565 		struct mbuf *op_err;
2566 		struct sctp_error_stale_cookie *cause;
2567 		uint32_t tim;
2568 
2569 		op_err = sctp_get_mbuf_for_msg(sizeof(struct sctp_error_stale_cookie),
2570 		    0, M_NOWAIT, 1, MT_DATA);
2571 		if (op_err == NULL) {
2572 			/* FOOBAR */
2573 			return (NULL);
2574 		}
2575 		/* Set the len */
2576 		SCTP_BUF_LEN(op_err) = sizeof(struct sctp_error_stale_cookie);
2577 		cause = mtod(op_err, struct sctp_error_stale_cookie *);
2578 		cause->cause.code = htons(SCTP_CAUSE_STALE_COOKIE);
2579 		cause->cause.length = htons((sizeof(struct sctp_paramhdr) +
2580 		    (sizeof(uint32_t))));
2581 		/* seconds to usec */
2582 		tim = (now.tv_sec - time_expires.tv_sec) * 1000000;
2583 		/* add in usec */
2584 		if (tim == 0)
2585 			tim = now.tv_usec - cookie->time_entered.tv_usec;
2586 		cause->stale_time = htonl(tim);
2587 		sctp_send_operr_to(src, dst, sh, cookie->peers_vtag, op_err,
2588 		    mflowtype, mflowid, l_inp->fibnum,
2589 		    vrf_id, port);
2590 		return (NULL);
2591 	}
2592 	/*
2593 	 * Now we must see with the lookup address if we have an existing
2594 	 * asoc. This will only happen if we were in the COOKIE-WAIT state
2595 	 * and a INIT collided with us and somewhere the peer sent the
2596 	 * cookie on another address besides the single address our assoc
2597 	 * had for him. In this case we will have one of the tie-tags set at
2598 	 * least AND the address field in the cookie can be used to look it
2599 	 * up.
2600 	 */
2601 	to = NULL;
2602 	switch (cookie->addr_type) {
2603 #ifdef INET6
2604 	case SCTP_IPV6_ADDRESS:
2605 		memset(&sin6, 0, sizeof(sin6));
2606 		sin6.sin6_family = AF_INET6;
2607 		sin6.sin6_len = sizeof(sin6);
2608 		sin6.sin6_port = sh->src_port;
2609 		sin6.sin6_scope_id = cookie->scope_id;
2610 		memcpy(&sin6.sin6_addr.s6_addr, cookie->address,
2611 		    sizeof(sin6.sin6_addr.s6_addr));
2612 		to = (struct sockaddr *)&sin6;
2613 		break;
2614 #endif
2615 #ifdef INET
2616 	case SCTP_IPV4_ADDRESS:
2617 		memset(&sin, 0, sizeof(sin));
2618 		sin.sin_family = AF_INET;
2619 		sin.sin_len = sizeof(sin);
2620 		sin.sin_port = sh->src_port;
2621 		sin.sin_addr.s_addr = cookie->address[0];
2622 		to = (struct sockaddr *)&sin;
2623 		break;
2624 #endif
2625 	default:
2626 		/* This should not happen */
2627 		return (NULL);
2628 	}
2629 	if (*stcb == NULL) {
2630 		/* Yep, lets check */
2631 		*stcb = sctp_findassociation_ep_addr(inp_p, to, netp, dst, NULL);
2632 		if (*stcb == NULL) {
2633 			/*
2634 			 * We should have only got back the same inp. If we
2635 			 * got back a different ep we have a problem. The
2636 			 * original findep got back l_inp and now
2637 			 */
2638 			if (l_inp != *inp_p) {
2639 				SCTP_PRINTF("Bad problem find_ep got a diff inp then special_locate?\n");
2640 			}
2641 		} else {
2642 			if (*locked_tcb == NULL) {
2643 				/*
2644 				 * In this case we found the assoc only
2645 				 * after we locked the create lock. This
2646 				 * means we are in a colliding case and we
2647 				 * must make sure that we unlock the tcb if
2648 				 * its one of the cases where we throw away
2649 				 * the incoming packets.
2650 				 */
2651 				*locked_tcb = *stcb;
2652 
2653 				/*
2654 				 * We must also increment the inp ref count
2655 				 * since the ref_count flags was set when we
2656 				 * did not find the TCB, now we found it
2657 				 * which reduces the refcount.. we must
2658 				 * raise it back out to balance it all :-)
2659 				 */
2660 				SCTP_INP_INCR_REF((*stcb)->sctp_ep);
2661 				if ((*stcb)->sctp_ep != l_inp) {
2662 					SCTP_PRINTF("Huh? ep:%p diff then l_inp:%p?\n",
2663 					    (void *)(*stcb)->sctp_ep, (void *)l_inp);
2664 				}
2665 			}
2666 		}
2667 	}
2668 	cookie_len -= SCTP_SIGNATURE_SIZE;
2669 	if (*stcb == NULL) {
2670 		/* this is the "normal" case... get a new TCB */
2671 		*stcb = sctp_process_cookie_new(m, iphlen, offset, src, dst, sh,
2672 		    cookie, cookie_len, *inp_p,
2673 		    netp, to, &notification,
2674 		    auth_skipped, auth_offset, auth_len,
2675 		    mflowtype, mflowid,
2676 		    vrf_id, port);
2677 	} else {
2678 		/* this is abnormal... cookie-echo on existing TCB */
2679 		had_a_existing_tcb = 1;
2680 		*stcb = sctp_process_cookie_existing(m, iphlen, offset,
2681 		    src, dst, sh,
2682 		    cookie, cookie_len, *inp_p, *stcb, netp, to,
2683 		    &notification, auth_skipped, auth_offset, auth_len,
2684 		    mflowtype, mflowid,
2685 		    vrf_id, port);
2686 	}
2687 
2688 	if (*stcb == NULL) {
2689 		/* still no TCB... must be bad cookie-echo */
2690 		return (NULL);
2691 	}
2692 	if (*netp != NULL) {
2693 		(*netp)->flowtype = mflowtype;
2694 		(*netp)->flowid = mflowid;
2695 	}
2696 	/*
2697 	 * Ok, we built an association so confirm the address we sent the
2698 	 * INIT-ACK to.
2699 	 */
2700 	netl = sctp_findnet(*stcb, to);
2701 	/*
2702 	 * This code should in theory NOT run but
2703 	 */
2704 	if (netl == NULL) {
2705 		/* TSNH! Huh, why do I need to add this address here? */
2706 		if (sctp_add_remote_addr(*stcb, to, NULL, port,
2707 		    SCTP_DONOT_SETSCOPE, SCTP_IN_COOKIE_PROC)) {
2708 			return (NULL);
2709 		}
2710 		netl = sctp_findnet(*stcb, to);
2711 	}
2712 	if (netl) {
2713 		if (netl->dest_state & SCTP_ADDR_UNCONFIRMED) {
2714 			netl->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
2715 			(void)sctp_set_primary_addr((*stcb), (struct sockaddr *)NULL,
2716 			    netl);
2717 			send_int_conf = 1;
2718 		}
2719 	}
2720 	sctp_start_net_timers(*stcb);
2721 	if ((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) {
2722 		if (!had_a_existing_tcb ||
2723 		    (((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0)) {
2724 			/*
2725 			 * If we have a NEW cookie or the connect never
2726 			 * reached the connected state during collision we
2727 			 * must do the TCP accept thing.
2728 			 */
2729 			struct socket *so, *oso;
2730 			struct sctp_inpcb *inp;
2731 
2732 			if (notification == SCTP_NOTIFY_ASSOC_RESTART) {
2733 				/*
2734 				 * For a restart we will keep the same
2735 				 * socket, no need to do anything. I THINK!!
2736 				 */
2737 				sctp_ulp_notify(notification, *stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
2738 				if (send_int_conf) {
2739 					sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
2740 					    (*stcb), 0, (void *)netl, SCTP_SO_NOT_LOCKED);
2741 				}
2742 				return (m);
2743 			}
2744 			oso = (*inp_p)->sctp_socket;
2745 			atomic_add_int(&(*stcb)->asoc.refcnt, 1);
2746 			SCTP_TCB_UNLOCK((*stcb));
2747 			CURVNET_SET(oso->so_vnet);
2748 			so = sonewconn(oso, 0
2749 			    );
2750 			CURVNET_RESTORE();
2751 			SCTP_TCB_LOCK((*stcb));
2752 			atomic_subtract_int(&(*stcb)->asoc.refcnt, 1);
2753 
2754 			if (so == NULL) {
2755 				struct mbuf *op_err;
2756 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2757 				struct socket *pcb_so;
2758 #endif
2759 				/* Too many sockets */
2760 				SCTPDBG(SCTP_DEBUG_INPUT1, "process_cookie_new: no room for another socket!\n");
2761 				op_err = sctp_generate_cause(SCTP_CAUSE_OUT_OF_RESC, "");
2762 				sctp_abort_association(*inp_p, NULL, m, iphlen,
2763 				    src, dst, sh, op_err,
2764 				    mflowtype, mflowid,
2765 				    vrf_id, port);
2766 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2767 				pcb_so = SCTP_INP_SO(*inp_p);
2768 				atomic_add_int(&(*stcb)->asoc.refcnt, 1);
2769 				SCTP_TCB_UNLOCK((*stcb));
2770 				SCTP_SOCKET_LOCK(pcb_so, 1);
2771 				SCTP_TCB_LOCK((*stcb));
2772 				atomic_subtract_int(&(*stcb)->asoc.refcnt, 1);
2773 #endif
2774 				(void)sctp_free_assoc(*inp_p, *stcb, SCTP_NORMAL_PROC,
2775 				    SCTP_FROM_SCTP_INPUT + SCTP_LOC_23);
2776 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2777 				SCTP_SOCKET_UNLOCK(pcb_so, 1);
2778 #endif
2779 				return (NULL);
2780 			}
2781 			inp = (struct sctp_inpcb *)so->so_pcb;
2782 			SCTP_INP_INCR_REF(inp);
2783 			/*
2784 			 * We add the unbound flag here so that if we get an
2785 			 * soabort() before we get the move_pcb done, we
2786 			 * will properly cleanup.
2787 			 */
2788 			inp->sctp_flags = (SCTP_PCB_FLAGS_TCPTYPE |
2789 			    SCTP_PCB_FLAGS_CONNECTED |
2790 			    SCTP_PCB_FLAGS_IN_TCPPOOL |
2791 			    SCTP_PCB_FLAGS_UNBOUND |
2792 			    (SCTP_PCB_COPY_FLAGS & (*inp_p)->sctp_flags) |
2793 			    SCTP_PCB_FLAGS_DONT_WAKE);
2794 			inp->sctp_features = (*inp_p)->sctp_features;
2795 			inp->sctp_mobility_features = (*inp_p)->sctp_mobility_features;
2796 			inp->sctp_socket = so;
2797 			inp->sctp_frag_point = (*inp_p)->sctp_frag_point;
2798 			inp->max_cwnd = (*inp_p)->max_cwnd;
2799 			inp->sctp_cmt_on_off = (*inp_p)->sctp_cmt_on_off;
2800 			inp->ecn_supported = (*inp_p)->ecn_supported;
2801 			inp->prsctp_supported = (*inp_p)->prsctp_supported;
2802 			inp->auth_supported = (*inp_p)->auth_supported;
2803 			inp->asconf_supported = (*inp_p)->asconf_supported;
2804 			inp->reconfig_supported = (*inp_p)->reconfig_supported;
2805 			inp->nrsack_supported = (*inp_p)->nrsack_supported;
2806 			inp->pktdrop_supported = (*inp_p)->pktdrop_supported;
2807 			inp->partial_delivery_point = (*inp_p)->partial_delivery_point;
2808 			inp->sctp_context = (*inp_p)->sctp_context;
2809 			inp->local_strreset_support = (*inp_p)->local_strreset_support;
2810 			inp->fibnum = (*inp_p)->fibnum;
2811 			inp->inp_starting_point_for_iterator = NULL;
2812 			/*
2813 			 * copy in the authentication parameters from the
2814 			 * original endpoint
2815 			 */
2816 			if (inp->sctp_ep.local_hmacs)
2817 				sctp_free_hmaclist(inp->sctp_ep.local_hmacs);
2818 			inp->sctp_ep.local_hmacs =
2819 			    sctp_copy_hmaclist((*inp_p)->sctp_ep.local_hmacs);
2820 			if (inp->sctp_ep.local_auth_chunks)
2821 				sctp_free_chunklist(inp->sctp_ep.local_auth_chunks);
2822 			inp->sctp_ep.local_auth_chunks =
2823 			    sctp_copy_chunklist((*inp_p)->sctp_ep.local_auth_chunks);
2824 
2825 			/*
2826 			 * Now we must move it from one hash table to
2827 			 * another and get the tcb in the right place.
2828 			 */
2829 
2830 			/*
2831 			 * This is where the one-2-one socket is put into
2832 			 * the accept state waiting for the accept!
2833 			 */
2834 			if (*stcb) {
2835 				(*stcb)->asoc.state |= SCTP_STATE_IN_ACCEPT_QUEUE;
2836 			}
2837 			sctp_move_pcb_and_assoc(*inp_p, inp, *stcb);
2838 
2839 			atomic_add_int(&(*stcb)->asoc.refcnt, 1);
2840 			SCTP_TCB_UNLOCK((*stcb));
2841 
2842 			sctp_pull_off_control_to_new_inp((*inp_p), inp, *stcb,
2843 			    0);
2844 			SCTP_TCB_LOCK((*stcb));
2845 			atomic_subtract_int(&(*stcb)->asoc.refcnt, 1);
2846 
2847 
2848 			/*
2849 			 * now we must check to see if we were aborted while
2850 			 * the move was going on and the lock/unlock
2851 			 * happened.
2852 			 */
2853 			if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
2854 				/*
2855 				 * yep it was, we leave the assoc attached
2856 				 * to the socket since the sctp_inpcb_free()
2857 				 * call will send an abort for us.
2858 				 */
2859 				SCTP_INP_DECR_REF(inp);
2860 				return (NULL);
2861 			}
2862 			SCTP_INP_DECR_REF(inp);
2863 			/* Switch over to the new guy */
2864 			*inp_p = inp;
2865 			sctp_ulp_notify(notification, *stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
2866 			if (send_int_conf) {
2867 				sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
2868 				    (*stcb), 0, (void *)netl, SCTP_SO_NOT_LOCKED);
2869 			}
2870 			/*
2871 			 * Pull it from the incomplete queue and wake the
2872 			 * guy
2873 			 */
2874 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2875 			atomic_add_int(&(*stcb)->asoc.refcnt, 1);
2876 			SCTP_TCB_UNLOCK((*stcb));
2877 			SCTP_SOCKET_LOCK(so, 1);
2878 #endif
2879 			soisconnected(so);
2880 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2881 			SCTP_TCB_LOCK((*stcb));
2882 			atomic_subtract_int(&(*stcb)->asoc.refcnt, 1);
2883 			SCTP_SOCKET_UNLOCK(so, 1);
2884 #endif
2885 			return (m);
2886 		}
2887 	}
2888 	if (notification) {
2889 		sctp_ulp_notify(notification, *stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
2890 	}
2891 	if (send_int_conf) {
2892 		sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
2893 		    (*stcb), 0, (void *)netl, SCTP_SO_NOT_LOCKED);
2894 	}
2895 	return (m);
2896 }
2897 
2898 static void
2899 sctp_handle_cookie_ack(struct sctp_cookie_ack_chunk *cp SCTP_UNUSED,
2900     struct sctp_tcb *stcb, struct sctp_nets *net)
2901 {
2902 	/* cp must not be used, others call this without a c-ack :-) */
2903 	struct sctp_association *asoc;
2904 
2905 	SCTPDBG(SCTP_DEBUG_INPUT2,
2906 	    "sctp_handle_cookie_ack: handling COOKIE-ACK\n");
2907 	if ((stcb == NULL) || (net == NULL)) {
2908 		return;
2909 	}
2910 	asoc = &stcb->asoc;
2911 
2912 	sctp_stop_all_cookie_timers(stcb);
2913 	/* process according to association state */
2914 	if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) {
2915 		/* state change only needed when I am in right state */
2916 		SCTPDBG(SCTP_DEBUG_INPUT2, "moving to OPEN state\n");
2917 		SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);
2918 		sctp_start_net_timers(stcb);
2919 		if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
2920 			sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
2921 			    stcb->sctp_ep, stcb, asoc->primary_destination);
2922 
2923 		}
2924 		/* update RTO */
2925 		SCTP_STAT_INCR_COUNTER32(sctps_activeestab);
2926 		SCTP_STAT_INCR_GAUGE32(sctps_currestab);
2927 		if (asoc->overall_error_count == 0) {
2928 			net->RTO = sctp_calculate_rto(stcb, asoc, net,
2929 			    &asoc->time_entered, sctp_align_safe_nocopy,
2930 			    SCTP_RTT_FROM_NON_DATA);
2931 		}
2932 		(void)SCTP_GETTIME_TIMEVAL(&asoc->time_entered);
2933 		sctp_ulp_notify(SCTP_NOTIFY_ASSOC_UP, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
2934 		if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
2935 		    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
2936 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2937 			struct socket *so;
2938 
2939 #endif
2940 			stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_CONNECTED;
2941 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2942 			so = SCTP_INP_SO(stcb->sctp_ep);
2943 			atomic_add_int(&stcb->asoc.refcnt, 1);
2944 			SCTP_TCB_UNLOCK(stcb);
2945 			SCTP_SOCKET_LOCK(so, 1);
2946 			SCTP_TCB_LOCK(stcb);
2947 			atomic_subtract_int(&stcb->asoc.refcnt, 1);
2948 #endif
2949 			if ((stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) == 0) {
2950 				soisconnected(stcb->sctp_socket);
2951 			}
2952 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2953 			SCTP_SOCKET_UNLOCK(so, 1);
2954 #endif
2955 		}
2956 		/*
2957 		 * since we did not send a HB make sure we don't double
2958 		 * things
2959 		 */
2960 		net->hb_responded = 1;
2961 
2962 		if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
2963 			/*
2964 			 * We don't need to do the asconf thing, nor hb or
2965 			 * autoclose if the socket is closed.
2966 			 */
2967 			goto closed_socket;
2968 		}
2969 		sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
2970 		    stcb, net);
2971 
2972 
2973 		if (stcb->asoc.sctp_autoclose_ticks &&
2974 		    sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_AUTOCLOSE)) {
2975 			sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE,
2976 			    stcb->sctp_ep, stcb, NULL);
2977 		}
2978 		/*
2979 		 * send ASCONF if parameters are pending and ASCONFs are
2980 		 * allowed (eg. addresses changed when init/cookie echo were
2981 		 * in flight)
2982 		 */
2983 		if ((sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_DO_ASCONF)) &&
2984 		    (stcb->asoc.asconf_supported == 1) &&
2985 		    (!TAILQ_EMPTY(&stcb->asoc.asconf_queue))) {
2986 #ifdef SCTP_TIMER_BASED_ASCONF
2987 			sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2988 			    stcb->sctp_ep, stcb,
2989 			    stcb->asoc.primary_destination);
2990 #else
2991 			sctp_send_asconf(stcb, stcb->asoc.primary_destination,
2992 			    SCTP_ADDR_NOT_LOCKED);
2993 #endif
2994 		}
2995 	}
2996 closed_socket:
2997 	/* Toss the cookie if I can */
2998 	sctp_toss_old_cookies(stcb, asoc);
2999 	if (!TAILQ_EMPTY(&asoc->sent_queue)) {
3000 		/* Restart the timer if we have pending data */
3001 		struct sctp_tmit_chunk *chk;
3002 
3003 		chk = TAILQ_FIRST(&asoc->sent_queue);
3004 		sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, chk->whoTo);
3005 	}
3006 }
3007 
3008 static void
3009 sctp_handle_ecn_echo(struct sctp_ecne_chunk *cp,
3010     struct sctp_tcb *stcb)
3011 {
3012 	struct sctp_nets *net;
3013 	struct sctp_tmit_chunk *lchk;
3014 	struct sctp_ecne_chunk bkup;
3015 	uint8_t override_bit;
3016 	uint32_t tsn, window_data_tsn;
3017 	int len;
3018 	unsigned int pkt_cnt;
3019 
3020 	len = ntohs(cp->ch.chunk_length);
3021 	if ((len != sizeof(struct sctp_ecne_chunk)) &&
3022 	    (len != sizeof(struct old_sctp_ecne_chunk))) {
3023 		return;
3024 	}
3025 	if (len == sizeof(struct old_sctp_ecne_chunk)) {
3026 		/* Its the old format */
3027 		memcpy(&bkup, cp, sizeof(struct old_sctp_ecne_chunk));
3028 		bkup.num_pkts_since_cwr = htonl(1);
3029 		cp = &bkup;
3030 	}
3031 	SCTP_STAT_INCR(sctps_recvecne);
3032 	tsn = ntohl(cp->tsn);
3033 	pkt_cnt = ntohl(cp->num_pkts_since_cwr);
3034 	lchk = TAILQ_LAST(&stcb->asoc.send_queue, sctpchunk_listhead);
3035 	if (lchk == NULL) {
3036 		window_data_tsn = stcb->asoc.sending_seq - 1;
3037 	} else {
3038 		window_data_tsn = lchk->rec.data.tsn;
3039 	}
3040 
3041 	/* Find where it was sent to if possible. */
3042 	net = NULL;
3043 	TAILQ_FOREACH(lchk, &stcb->asoc.sent_queue, sctp_next) {
3044 		if (lchk->rec.data.tsn == tsn) {
3045 			net = lchk->whoTo;
3046 			net->ecn_prev_cwnd = lchk->rec.data.cwnd_at_send;
3047 			break;
3048 		}
3049 		if (SCTP_TSN_GT(lchk->rec.data.tsn, tsn)) {
3050 			break;
3051 		}
3052 	}
3053 	if (net == NULL) {
3054 		/*
3055 		 * What to do. A previous send of a CWR was possibly lost.
3056 		 * See how old it is, we may have it marked on the actual
3057 		 * net.
3058 		 */
3059 		TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
3060 			if (tsn == net->last_cwr_tsn) {
3061 				/* Found him, send it off */
3062 				break;
3063 			}
3064 		}
3065 		if (net == NULL) {
3066 			/*
3067 			 * If we reach here, we need to send a special CWR
3068 			 * that says hey, we did this a long time ago and
3069 			 * you lost the response.
3070 			 */
3071 			net = TAILQ_FIRST(&stcb->asoc.nets);
3072 			if (net == NULL) {
3073 				/* TSNH */
3074 				return;
3075 			}
3076 			override_bit = SCTP_CWR_REDUCE_OVERRIDE;
3077 		} else {
3078 			override_bit = 0;
3079 		}
3080 	} else {
3081 		override_bit = 0;
3082 	}
3083 	if (SCTP_TSN_GT(tsn, net->cwr_window_tsn) &&
3084 	    ((override_bit & SCTP_CWR_REDUCE_OVERRIDE) == 0)) {
3085 		/*
3086 		 * JRS - Use the congestion control given in the pluggable
3087 		 * CC module
3088 		 */
3089 		stcb->asoc.cc_functions.sctp_cwnd_update_after_ecn_echo(stcb, net, 0, pkt_cnt);
3090 		/*
3091 		 * We reduce once every RTT. So we will only lower cwnd at
3092 		 * the next sending seq i.e. the window_data_tsn
3093 		 */
3094 		net->cwr_window_tsn = window_data_tsn;
3095 		net->ecn_ce_pkt_cnt += pkt_cnt;
3096 		net->lost_cnt = pkt_cnt;
3097 		net->last_cwr_tsn = tsn;
3098 	} else {
3099 		override_bit |= SCTP_CWR_IN_SAME_WINDOW;
3100 		if (SCTP_TSN_GT(tsn, net->last_cwr_tsn) &&
3101 		    ((override_bit & SCTP_CWR_REDUCE_OVERRIDE) == 0)) {
3102 			/*
3103 			 * Another loss in the same window update how many
3104 			 * marks/packets lost we have had.
3105 			 */
3106 			int cnt = 1;
3107 
3108 			if (pkt_cnt > net->lost_cnt) {
3109 				/* Should be the case */
3110 				cnt = (pkt_cnt - net->lost_cnt);
3111 				net->ecn_ce_pkt_cnt += cnt;
3112 			}
3113 			net->lost_cnt = pkt_cnt;
3114 			net->last_cwr_tsn = tsn;
3115 			/*
3116 			 * Most CC functions will ignore this call, since we
3117 			 * are in-window yet of the initial CE the peer saw.
3118 			 */
3119 			stcb->asoc.cc_functions.sctp_cwnd_update_after_ecn_echo(stcb, net, 1, cnt);
3120 		}
3121 	}
3122 	/*
3123 	 * We always send a CWR this way if our previous one was lost our
3124 	 * peer will get an update, or if it is not time again to reduce we
3125 	 * still get the cwr to the peer. Note we set the override when we
3126 	 * could not find the TSN on the chunk or the destination network.
3127 	 */
3128 	sctp_send_cwr(stcb, net, net->last_cwr_tsn, override_bit);
3129 }
3130 
3131 static void
3132 sctp_handle_ecn_cwr(struct sctp_cwr_chunk *cp, struct sctp_tcb *stcb, struct sctp_nets *net)
3133 {
3134 	/*
3135 	 * Here we get a CWR from the peer. We must look in the outqueue and
3136 	 * make sure that we have a covered ECNE in the control chunk part.
3137 	 * If so remove it.
3138 	 */
3139 	struct sctp_tmit_chunk *chk;
3140 	struct sctp_ecne_chunk *ecne;
3141 	int override;
3142 	uint32_t cwr_tsn;
3143 
3144 	cwr_tsn = ntohl(cp->tsn);
3145 	override = cp->ch.chunk_flags & SCTP_CWR_REDUCE_OVERRIDE;
3146 	TAILQ_FOREACH(chk, &stcb->asoc.control_send_queue, sctp_next) {
3147 		if (chk->rec.chunk_id.id != SCTP_ECN_ECHO) {
3148 			continue;
3149 		}
3150 		if ((override == 0) && (chk->whoTo != net)) {
3151 			/* Must be from the right src unless override is set */
3152 			continue;
3153 		}
3154 		ecne = mtod(chk->data, struct sctp_ecne_chunk *);
3155 		if (SCTP_TSN_GE(cwr_tsn, ntohl(ecne->tsn))) {
3156 			/* this covers this ECNE, we can remove it */
3157 			stcb->asoc.ecn_echo_cnt_onq--;
3158 			TAILQ_REMOVE(&stcb->asoc.control_send_queue, chk,
3159 			    sctp_next);
3160 			sctp_m_freem(chk->data);
3161 			chk->data = NULL;
3162 			stcb->asoc.ctrl_queue_cnt--;
3163 			sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
3164 			if (override == 0) {
3165 				break;
3166 			}
3167 		}
3168 	}
3169 }
3170 
3171 static void
3172 sctp_handle_shutdown_complete(struct sctp_shutdown_complete_chunk *cp SCTP_UNUSED,
3173     struct sctp_tcb *stcb, struct sctp_nets *net)
3174 {
3175 	struct sctp_association *asoc;
3176 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3177 	struct socket *so;
3178 #endif
3179 
3180 	SCTPDBG(SCTP_DEBUG_INPUT2,
3181 	    "sctp_handle_shutdown_complete: handling SHUTDOWN-COMPLETE\n");
3182 	if (stcb == NULL)
3183 		return;
3184 
3185 	asoc = &stcb->asoc;
3186 	/* process according to association state */
3187 	if (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT) {
3188 		/* unexpected SHUTDOWN-COMPLETE... so ignore... */
3189 		SCTPDBG(SCTP_DEBUG_INPUT2,
3190 		    "sctp_handle_shutdown_complete: not in SCTP_STATE_SHUTDOWN_ACK_SENT --- ignore\n");
3191 		SCTP_TCB_UNLOCK(stcb);
3192 		return;
3193 	}
3194 	/* notify upper layer protocol */
3195 	if (stcb->sctp_socket) {
3196 		sctp_ulp_notify(SCTP_NOTIFY_ASSOC_DOWN, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
3197 	}
3198 #ifdef INVARIANTS
3199 	if (!TAILQ_EMPTY(&asoc->send_queue) ||
3200 	    !TAILQ_EMPTY(&asoc->sent_queue) ||
3201 	    sctp_is_there_unsent_data(stcb, SCTP_SO_NOT_LOCKED)) {
3202 		panic("Queues are not empty when handling SHUTDOWN-COMPLETE");
3203 	}
3204 #endif
3205 	/* stop the timer */
3206 	sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWNACK, stcb->sctp_ep, stcb, net,
3207 	    SCTP_FROM_SCTP_INPUT + SCTP_LOC_24);
3208 	SCTP_STAT_INCR_COUNTER32(sctps_shutdown);
3209 	/* free the TCB */
3210 	SCTPDBG(SCTP_DEBUG_INPUT2,
3211 	    "sctp_handle_shutdown_complete: calls free-asoc\n");
3212 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3213 	so = SCTP_INP_SO(stcb->sctp_ep);
3214 	atomic_add_int(&stcb->asoc.refcnt, 1);
3215 	SCTP_TCB_UNLOCK(stcb);
3216 	SCTP_SOCKET_LOCK(so, 1);
3217 	SCTP_TCB_LOCK(stcb);
3218 	atomic_subtract_int(&stcb->asoc.refcnt, 1);
3219 #endif
3220 	(void)sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC,
3221 	    SCTP_FROM_SCTP_INPUT + SCTP_LOC_25);
3222 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3223 	SCTP_SOCKET_UNLOCK(so, 1);
3224 #endif
3225 	return;
3226 }
3227 
3228 static int
3229 process_chunk_drop(struct sctp_tcb *stcb, struct sctp_chunk_desc *desc,
3230     struct sctp_nets *net, uint8_t flg)
3231 {
3232 	switch (desc->chunk_type) {
3233 	case SCTP_DATA:
3234 		/* find the tsn to resend (possibly */
3235 		{
3236 			uint32_t tsn;
3237 			struct sctp_tmit_chunk *tp1;
3238 
3239 			tsn = ntohl(desc->tsn_ifany);
3240 			TAILQ_FOREACH(tp1, &stcb->asoc.sent_queue, sctp_next) {
3241 				if (tp1->rec.data.tsn == tsn) {
3242 					/* found it */
3243 					break;
3244 				}
3245 				if (SCTP_TSN_GT(tp1->rec.data.tsn, tsn)) {
3246 					/* not found */
3247 					tp1 = NULL;
3248 					break;
3249 				}
3250 			}
3251 			if (tp1 == NULL) {
3252 				/*
3253 				 * Do it the other way , aka without paying
3254 				 * attention to queue seq order.
3255 				 */
3256 				SCTP_STAT_INCR(sctps_pdrpdnfnd);
3257 				TAILQ_FOREACH(tp1, &stcb->asoc.sent_queue, sctp_next) {
3258 					if (tp1->rec.data.tsn == tsn) {
3259 						/* found it */
3260 						break;
3261 					}
3262 				}
3263 			}
3264 			if (tp1 == NULL) {
3265 				SCTP_STAT_INCR(sctps_pdrptsnnf);
3266 			}
3267 			if ((tp1) && (tp1->sent < SCTP_DATAGRAM_ACKED)) {
3268 				uint8_t *ddp;
3269 
3270 				if (((flg & SCTP_BADCRC) == 0) &&
3271 				    ((flg & SCTP_FROM_MIDDLE_BOX) == 0)) {
3272 					return (0);
3273 				}
3274 				if ((stcb->asoc.peers_rwnd == 0) &&
3275 				    ((flg & SCTP_FROM_MIDDLE_BOX) == 0)) {
3276 					SCTP_STAT_INCR(sctps_pdrpdiwnp);
3277 					return (0);
3278 				}
3279 				if (stcb->asoc.peers_rwnd == 0 &&
3280 				    (flg & SCTP_FROM_MIDDLE_BOX)) {
3281 					SCTP_STAT_INCR(sctps_pdrpdizrw);
3282 					return (0);
3283 				}
3284 				ddp = (uint8_t *)(mtod(tp1->data, caddr_t)+
3285 				    sizeof(struct sctp_data_chunk));
3286 				{
3287 					unsigned int iii;
3288 
3289 					for (iii = 0; iii < sizeof(desc->data_bytes);
3290 					    iii++) {
3291 						if (ddp[iii] != desc->data_bytes[iii]) {
3292 							SCTP_STAT_INCR(sctps_pdrpbadd);
3293 							return (-1);
3294 						}
3295 					}
3296 				}
3297 
3298 				if (tp1->do_rtt) {
3299 					/*
3300 					 * this guy had a RTO calculation
3301 					 * pending on it, cancel it
3302 					 */
3303 					if (tp1->whoTo->rto_needed == 0) {
3304 						tp1->whoTo->rto_needed = 1;
3305 					}
3306 					tp1->do_rtt = 0;
3307 				}
3308 				SCTP_STAT_INCR(sctps_pdrpmark);
3309 				if (tp1->sent != SCTP_DATAGRAM_RESEND)
3310 					sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
3311 				/*
3312 				 * mark it as if we were doing a FR, since
3313 				 * we will be getting gap ack reports behind
3314 				 * the info from the router.
3315 				 */
3316 				tp1->rec.data.doing_fast_retransmit = 1;
3317 				/*
3318 				 * mark the tsn with what sequences can
3319 				 * cause a new FR.
3320 				 */
3321 				if (TAILQ_EMPTY(&stcb->asoc.send_queue)) {
3322 					tp1->rec.data.fast_retran_tsn = stcb->asoc.sending_seq;
3323 				} else {
3324 					tp1->rec.data.fast_retran_tsn = (TAILQ_FIRST(&stcb->asoc.send_queue))->rec.data.tsn;
3325 				}
3326 
3327 				/* restart the timer */
3328 				sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
3329 				    stcb, tp1->whoTo,
3330 				    SCTP_FROM_SCTP_INPUT + SCTP_LOC_26);
3331 				sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
3332 				    stcb, tp1->whoTo);
3333 
3334 				/* fix counts and things */
3335 				if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) {
3336 					sctp_misc_ints(SCTP_FLIGHT_LOG_DOWN_PDRP,
3337 					    tp1->whoTo->flight_size,
3338 					    tp1->book_size,
3339 					    (uint32_t)(uintptr_t)stcb,
3340 					    tp1->rec.data.tsn);
3341 				}
3342 				if (tp1->sent < SCTP_DATAGRAM_RESEND) {
3343 					sctp_flight_size_decrease(tp1);
3344 					sctp_total_flight_decrease(stcb, tp1);
3345 				}
3346 				tp1->sent = SCTP_DATAGRAM_RESEND;
3347 			} {
3348 				/* audit code */
3349 				unsigned int audit;
3350 
3351 				audit = 0;
3352 				TAILQ_FOREACH(tp1, &stcb->asoc.sent_queue, sctp_next) {
3353 					if (tp1->sent == SCTP_DATAGRAM_RESEND)
3354 						audit++;
3355 				}
3356 				TAILQ_FOREACH(tp1, &stcb->asoc.control_send_queue,
3357 				    sctp_next) {
3358 					if (tp1->sent == SCTP_DATAGRAM_RESEND)
3359 						audit++;
3360 				}
3361 				if (audit != stcb->asoc.sent_queue_retran_cnt) {
3362 					SCTP_PRINTF("**Local Audit finds cnt:%d asoc cnt:%d\n",
3363 					    audit, stcb->asoc.sent_queue_retran_cnt);
3364 #ifndef SCTP_AUDITING_ENABLED
3365 					stcb->asoc.sent_queue_retran_cnt = audit;
3366 #endif
3367 				}
3368 			}
3369 		}
3370 		break;
3371 	case SCTP_ASCONF:
3372 		{
3373 			struct sctp_tmit_chunk *asconf;
3374 
3375 			TAILQ_FOREACH(asconf, &stcb->asoc.control_send_queue,
3376 			    sctp_next) {
3377 				if (asconf->rec.chunk_id.id == SCTP_ASCONF) {
3378 					break;
3379 				}
3380 			}
3381 			if (asconf) {
3382 				if (asconf->sent != SCTP_DATAGRAM_RESEND)
3383 					sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
3384 				asconf->sent = SCTP_DATAGRAM_RESEND;
3385 				asconf->snd_count--;
3386 			}
3387 		}
3388 		break;
3389 	case SCTP_INITIATION:
3390 		/* resend the INIT */
3391 		stcb->asoc.dropped_special_cnt++;
3392 		if (stcb->asoc.dropped_special_cnt < SCTP_RETRY_DROPPED_THRESH) {
3393 			/*
3394 			 * If we can get it in, in a few attempts we do
3395 			 * this, otherwise we let the timer fire.
3396 			 */
3397 			sctp_timer_stop(SCTP_TIMER_TYPE_INIT, stcb->sctp_ep,
3398 			    stcb, net,
3399 			    SCTP_FROM_SCTP_INPUT + SCTP_LOC_27);
3400 			sctp_send_initiate(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);
3401 		}
3402 		break;
3403 	case SCTP_SELECTIVE_ACK:
3404 	case SCTP_NR_SELECTIVE_ACK:
3405 		/* resend the sack */
3406 		sctp_send_sack(stcb, SCTP_SO_NOT_LOCKED);
3407 		break;
3408 	case SCTP_HEARTBEAT_REQUEST:
3409 		/* resend a demand HB */
3410 		if ((stcb->asoc.overall_error_count + 3) < stcb->asoc.max_send_times) {
3411 			/*
3412 			 * Only retransmit if we KNOW we wont destroy the
3413 			 * tcb
3414 			 */
3415 			sctp_send_hb(stcb, net, SCTP_SO_NOT_LOCKED);
3416 		}
3417 		break;
3418 	case SCTP_SHUTDOWN:
3419 		sctp_send_shutdown(stcb, net);
3420 		break;
3421 	case SCTP_SHUTDOWN_ACK:
3422 		sctp_send_shutdown_ack(stcb, net);
3423 		break;
3424 	case SCTP_COOKIE_ECHO:
3425 		{
3426 			struct sctp_tmit_chunk *cookie;
3427 
3428 			cookie = NULL;
3429 			TAILQ_FOREACH(cookie, &stcb->asoc.control_send_queue,
3430 			    sctp_next) {
3431 				if (cookie->rec.chunk_id.id == SCTP_COOKIE_ECHO) {
3432 					break;
3433 				}
3434 			}
3435 			if (cookie) {
3436 				if (cookie->sent != SCTP_DATAGRAM_RESEND)
3437 					sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
3438 				cookie->sent = SCTP_DATAGRAM_RESEND;
3439 				sctp_stop_all_cookie_timers(stcb);
3440 			}
3441 		}
3442 		break;
3443 	case SCTP_COOKIE_ACK:
3444 		sctp_send_cookie_ack(stcb);
3445 		break;
3446 	case SCTP_ASCONF_ACK:
3447 		/* resend last asconf ack */
3448 		sctp_send_asconf_ack(stcb);
3449 		break;
3450 	case SCTP_IFORWARD_CUM_TSN:
3451 	case SCTP_FORWARD_CUM_TSN:
3452 		send_forward_tsn(stcb, &stcb->asoc);
3453 		break;
3454 		/* can't do anything with these */
3455 	case SCTP_PACKET_DROPPED:
3456 	case SCTP_INITIATION_ACK:	/* this should not happen */
3457 	case SCTP_HEARTBEAT_ACK:
3458 	case SCTP_ABORT_ASSOCIATION:
3459 	case SCTP_OPERATION_ERROR:
3460 	case SCTP_SHUTDOWN_COMPLETE:
3461 	case SCTP_ECN_ECHO:
3462 	case SCTP_ECN_CWR:
3463 	default:
3464 		break;
3465 	}
3466 	return (0);
3467 }
3468 
3469 void
3470 sctp_reset_in_stream(struct sctp_tcb *stcb, uint32_t number_entries, uint16_t *list)
3471 {
3472 	uint32_t i;
3473 	uint16_t temp;
3474 
3475 	/*
3476 	 * We set things to 0xffffffff since this is the last delivered
3477 	 * sequence and we will be sending in 0 after the reset.
3478 	 */
3479 
3480 	if (number_entries) {
3481 		for (i = 0; i < number_entries; i++) {
3482 			temp = ntohs(list[i]);
3483 			if (temp >= stcb->asoc.streamincnt) {
3484 				continue;
3485 			}
3486 			stcb->asoc.strmin[temp].last_mid_delivered = 0xffffffff;
3487 		}
3488 	} else {
3489 		list = NULL;
3490 		for (i = 0; i < stcb->asoc.streamincnt; i++) {
3491 			stcb->asoc.strmin[i].last_mid_delivered = 0xffffffff;
3492 		}
3493 	}
3494 	sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_RECV, stcb, number_entries, (void *)list, SCTP_SO_NOT_LOCKED);
3495 }
3496 
3497 static void
3498 sctp_reset_out_streams(struct sctp_tcb *stcb, uint32_t number_entries, uint16_t *list)
3499 {
3500 	uint32_t i;
3501 	uint16_t temp;
3502 
3503 	if (number_entries > 0) {
3504 		for (i = 0; i < number_entries; i++) {
3505 			temp = ntohs(list[i]);
3506 			if (temp >= stcb->asoc.streamoutcnt) {
3507 				/* no such stream */
3508 				continue;
3509 			}
3510 			stcb->asoc.strmout[temp].next_mid_ordered = 0;
3511 			stcb->asoc.strmout[temp].next_mid_unordered = 0;
3512 		}
3513 	} else {
3514 		for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
3515 			stcb->asoc.strmout[i].next_mid_ordered = 0;
3516 			stcb->asoc.strmout[i].next_mid_unordered = 0;
3517 		}
3518 	}
3519 	sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_SEND, stcb, number_entries, (void *)list, SCTP_SO_NOT_LOCKED);
3520 }
3521 
3522 static void
3523 sctp_reset_clear_pending(struct sctp_tcb *stcb, uint32_t number_entries, uint16_t *list)
3524 {
3525 	uint32_t i;
3526 	uint16_t temp;
3527 
3528 	if (number_entries > 0) {
3529 		for (i = 0; i < number_entries; i++) {
3530 			temp = ntohs(list[i]);
3531 			if (temp >= stcb->asoc.streamoutcnt) {
3532 				/* no such stream */
3533 				continue;
3534 			}
3535 			stcb->asoc.strmout[temp].state = SCTP_STREAM_OPEN;
3536 		}
3537 	} else {
3538 		for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
3539 			stcb->asoc.strmout[i].state = SCTP_STREAM_OPEN;
3540 		}
3541 	}
3542 }
3543 
3544 
3545 struct sctp_stream_reset_request *
3546 sctp_find_stream_reset(struct sctp_tcb *stcb, uint32_t seq, struct sctp_tmit_chunk **bchk)
3547 {
3548 	struct sctp_association *asoc;
3549 	struct sctp_chunkhdr *ch;
3550 	struct sctp_stream_reset_request *r;
3551 	struct sctp_tmit_chunk *chk;
3552 	int len, clen;
3553 
3554 	asoc = &stcb->asoc;
3555 	if (TAILQ_EMPTY(&stcb->asoc.control_send_queue)) {
3556 		asoc->stream_reset_outstanding = 0;
3557 		return (NULL);
3558 	}
3559 	if (stcb->asoc.str_reset == NULL) {
3560 		asoc->stream_reset_outstanding = 0;
3561 		return (NULL);
3562 	}
3563 	chk = stcb->asoc.str_reset;
3564 	if (chk->data == NULL) {
3565 		return (NULL);
3566 	}
3567 	if (bchk) {
3568 		/* he wants a copy of the chk pointer */
3569 		*bchk = chk;
3570 	}
3571 	clen = chk->send_size;
3572 	ch = mtod(chk->data, struct sctp_chunkhdr *);
3573 	r = (struct sctp_stream_reset_request *)(ch + 1);
3574 	if (ntohl(r->request_seq) == seq) {
3575 		/* found it */
3576 		return (r);
3577 	}
3578 	len = SCTP_SIZE32(ntohs(r->ph.param_length));
3579 	if (clen > (len + (int)sizeof(struct sctp_chunkhdr))) {
3580 		/* move to the next one, there can only be a max of two */
3581 		r = (struct sctp_stream_reset_request *)((caddr_t)r + len);
3582 		if (ntohl(r->request_seq) == seq) {
3583 			return (r);
3584 		}
3585 	}
3586 	/* that seq is not here */
3587 	return (NULL);
3588 }
3589 
3590 static void
3591 sctp_clean_up_stream_reset(struct sctp_tcb *stcb)
3592 {
3593 	struct sctp_association *asoc;
3594 	struct sctp_tmit_chunk *chk = stcb->asoc.str_reset;
3595 
3596 	if (stcb->asoc.str_reset == NULL) {
3597 		return;
3598 	}
3599 	asoc = &stcb->asoc;
3600 
3601 	sctp_timer_stop(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb,
3602 	    chk->whoTo, SCTP_FROM_SCTP_INPUT + SCTP_LOC_28);
3603 	TAILQ_REMOVE(&asoc->control_send_queue,
3604 	    chk,
3605 	    sctp_next);
3606 	if (chk->data) {
3607 		sctp_m_freem(chk->data);
3608 		chk->data = NULL;
3609 	}
3610 	asoc->ctrl_queue_cnt--;
3611 	sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
3612 	/* sa_ignore NO_NULL_CHK */
3613 	stcb->asoc.str_reset = NULL;
3614 }
3615 
3616 
3617 static int
3618 sctp_handle_stream_reset_response(struct sctp_tcb *stcb,
3619     uint32_t seq, uint32_t action,
3620     struct sctp_stream_reset_response *respin)
3621 {
3622 	uint16_t type;
3623 	int lparm_len;
3624 	struct sctp_association *asoc = &stcb->asoc;
3625 	struct sctp_tmit_chunk *chk;
3626 	struct sctp_stream_reset_request *req_param;
3627 	struct sctp_stream_reset_out_request *req_out_param;
3628 	struct sctp_stream_reset_in_request *req_in_param;
3629 	uint32_t number_entries;
3630 
3631 	if (asoc->stream_reset_outstanding == 0) {
3632 		/* duplicate */
3633 		return (0);
3634 	}
3635 	if (seq == stcb->asoc.str_reset_seq_out) {
3636 		req_param = sctp_find_stream_reset(stcb, seq, &chk);
3637 		if (req_param != NULL) {
3638 			stcb->asoc.str_reset_seq_out++;
3639 			type = ntohs(req_param->ph.param_type);
3640 			lparm_len = ntohs(req_param->ph.param_length);
3641 			if (type == SCTP_STR_RESET_OUT_REQUEST) {
3642 				int no_clear = 0;
3643 
3644 				req_out_param = (struct sctp_stream_reset_out_request *)req_param;
3645 				number_entries = (lparm_len - sizeof(struct sctp_stream_reset_out_request)) / sizeof(uint16_t);
3646 				asoc->stream_reset_out_is_outstanding = 0;
3647 				if (asoc->stream_reset_outstanding)
3648 					asoc->stream_reset_outstanding--;
3649 				if (action == SCTP_STREAM_RESET_RESULT_PERFORMED) {
3650 					/* do it */
3651 					sctp_reset_out_streams(stcb, number_entries, req_out_param->list_of_streams);
3652 				} else if (action == SCTP_STREAM_RESET_RESULT_DENIED) {
3653 					sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_DENIED_OUT, stcb, number_entries, req_out_param->list_of_streams, SCTP_SO_NOT_LOCKED);
3654 				} else if (action == SCTP_STREAM_RESET_RESULT_IN_PROGRESS) {
3655 					/*
3656 					 * Set it up so we don't stop
3657 					 * retransmitting
3658 					 */
3659 					asoc->stream_reset_outstanding++;
3660 					stcb->asoc.str_reset_seq_out--;
3661 					asoc->stream_reset_out_is_outstanding = 1;
3662 					no_clear = 1;
3663 				} else {
3664 					sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_FAILED_OUT, stcb, number_entries, req_out_param->list_of_streams, SCTP_SO_NOT_LOCKED);
3665 				}
3666 				if (no_clear == 0) {
3667 					sctp_reset_clear_pending(stcb, number_entries, req_out_param->list_of_streams);
3668 				}
3669 			} else if (type == SCTP_STR_RESET_IN_REQUEST) {
3670 				req_in_param = (struct sctp_stream_reset_in_request *)req_param;
3671 				number_entries = (lparm_len - sizeof(struct sctp_stream_reset_in_request)) / sizeof(uint16_t);
3672 				if (asoc->stream_reset_outstanding)
3673 					asoc->stream_reset_outstanding--;
3674 				if (action == SCTP_STREAM_RESET_RESULT_DENIED) {
3675 					sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_DENIED_IN, stcb,
3676 					    number_entries, req_in_param->list_of_streams, SCTP_SO_NOT_LOCKED);
3677 				} else if (action != SCTP_STREAM_RESET_RESULT_PERFORMED) {
3678 					sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_FAILED_IN, stcb,
3679 					    number_entries, req_in_param->list_of_streams, SCTP_SO_NOT_LOCKED);
3680 				}
3681 			} else if (type == SCTP_STR_RESET_ADD_OUT_STREAMS) {
3682 				/* Ok we now may have more streams */
3683 				int num_stream;
3684 
3685 				num_stream = stcb->asoc.strm_pending_add_size;
3686 				if (num_stream > (stcb->asoc.strm_realoutsize - stcb->asoc.streamoutcnt)) {
3687 					/* TSNH */
3688 					num_stream = stcb->asoc.strm_realoutsize - stcb->asoc.streamoutcnt;
3689 				}
3690 				stcb->asoc.strm_pending_add_size = 0;
3691 				if (asoc->stream_reset_outstanding)
3692 					asoc->stream_reset_outstanding--;
3693 				if (action == SCTP_STREAM_RESET_RESULT_PERFORMED) {
3694 					/* Put the new streams into effect */
3695 					int i;
3696 
3697 					for (i = asoc->streamoutcnt; i < (asoc->streamoutcnt + num_stream); i++) {
3698 						asoc->strmout[i].state = SCTP_STREAM_OPEN;
3699 					}
3700 					asoc->streamoutcnt += num_stream;
3701 					sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt, 0);
3702 				} else if (action == SCTP_STREAM_RESET_RESULT_DENIED) {
3703 					sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt,
3704 					    SCTP_STREAM_CHANGE_DENIED);
3705 				} else {
3706 					sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt,
3707 					    SCTP_STREAM_CHANGE_FAILED);
3708 				}
3709 			} else if (type == SCTP_STR_RESET_ADD_IN_STREAMS) {
3710 				if (asoc->stream_reset_outstanding)
3711 					asoc->stream_reset_outstanding--;
3712 				if (action == SCTP_STREAM_RESET_RESULT_DENIED) {
3713 					sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt,
3714 					    SCTP_STREAM_CHANGE_DENIED);
3715 				} else if (action != SCTP_STREAM_RESET_RESULT_PERFORMED) {
3716 					sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt,
3717 					    SCTP_STREAM_CHANGE_FAILED);
3718 				}
3719 			} else if (type == SCTP_STR_RESET_TSN_REQUEST) {
3720 				/**
3721 				 * a) Adopt the new in tsn.
3722 				 * b) reset the map
3723 				 * c) Adopt the new out-tsn
3724 				 */
3725 				struct sctp_stream_reset_response_tsn *resp;
3726 				struct sctp_forward_tsn_chunk fwdtsn;
3727 				int abort_flag = 0;
3728 
3729 				if (respin == NULL) {
3730 					/* huh ? */
3731 					return (0);
3732 				}
3733 				if (ntohs(respin->ph.param_length) < sizeof(struct sctp_stream_reset_response_tsn)) {
3734 					return (0);
3735 				}
3736 				if (action == SCTP_STREAM_RESET_RESULT_PERFORMED) {
3737 					resp = (struct sctp_stream_reset_response_tsn *)respin;
3738 					asoc->stream_reset_outstanding--;
3739 					fwdtsn.ch.chunk_length = htons(sizeof(struct sctp_forward_tsn_chunk));
3740 					fwdtsn.ch.chunk_type = SCTP_FORWARD_CUM_TSN;
3741 					fwdtsn.new_cumulative_tsn = htonl(ntohl(resp->senders_next_tsn) - 1);
3742 					sctp_handle_forward_tsn(stcb, &fwdtsn, &abort_flag, NULL, 0);
3743 					if (abort_flag) {
3744 						return (1);
3745 					}
3746 					stcb->asoc.highest_tsn_inside_map = (ntohl(resp->senders_next_tsn) - 1);
3747 					if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {
3748 						sctp_log_map(0, 7, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
3749 					}
3750 					stcb->asoc.tsn_last_delivered = stcb->asoc.cumulative_tsn = stcb->asoc.highest_tsn_inside_map;
3751 					stcb->asoc.mapping_array_base_tsn = ntohl(resp->senders_next_tsn);
3752 					memset(stcb->asoc.mapping_array, 0, stcb->asoc.mapping_array_size);
3753 
3754 					stcb->asoc.highest_tsn_inside_nr_map = stcb->asoc.highest_tsn_inside_map;
3755 					memset(stcb->asoc.nr_mapping_array, 0, stcb->asoc.mapping_array_size);
3756 
3757 					stcb->asoc.sending_seq = ntohl(resp->receivers_next_tsn);
3758 					stcb->asoc.last_acked_seq = stcb->asoc.cumulative_tsn;
3759 
3760 					sctp_reset_out_streams(stcb, 0, (uint16_t *)NULL);
3761 					sctp_reset_in_stream(stcb, 0, (uint16_t *)NULL);
3762 					sctp_notify_stream_reset_tsn(stcb, stcb->asoc.sending_seq, (stcb->asoc.mapping_array_base_tsn + 1), 0);
3763 				} else if (action == SCTP_STREAM_RESET_RESULT_DENIED) {
3764 					sctp_notify_stream_reset_tsn(stcb, stcb->asoc.sending_seq, (stcb->asoc.mapping_array_base_tsn + 1),
3765 					    SCTP_ASSOC_RESET_DENIED);
3766 				} else {
3767 					sctp_notify_stream_reset_tsn(stcb, stcb->asoc.sending_seq, (stcb->asoc.mapping_array_base_tsn + 1),
3768 					    SCTP_ASSOC_RESET_FAILED);
3769 				}
3770 			}
3771 			/* get rid of the request and get the request flags */
3772 			if (asoc->stream_reset_outstanding == 0) {
3773 				sctp_clean_up_stream_reset(stcb);
3774 			}
3775 		}
3776 	}
3777 	if (asoc->stream_reset_outstanding == 0) {
3778 		sctp_send_stream_reset_out_if_possible(stcb, SCTP_SO_NOT_LOCKED);
3779 	}
3780 	return (0);
3781 }
3782 
3783 static void
3784 sctp_handle_str_reset_request_in(struct sctp_tcb *stcb,
3785     struct sctp_tmit_chunk *chk,
3786     struct sctp_stream_reset_in_request *req, int trunc)
3787 {
3788 	uint32_t seq;
3789 	int len, i;
3790 	int number_entries;
3791 	uint16_t temp;
3792 
3793 	/*
3794 	 * peer wants me to send a str-reset to him for my outgoing seq's if
3795 	 * seq_in is right.
3796 	 */
3797 	struct sctp_association *asoc = &stcb->asoc;
3798 
3799 	seq = ntohl(req->request_seq);
3800 	if (asoc->str_reset_seq_in == seq) {
3801 		asoc->last_reset_action[1] = asoc->last_reset_action[0];
3802 		if (!(asoc->local_strreset_support & SCTP_ENABLE_RESET_STREAM_REQ)) {
3803 			asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
3804 		} else if (trunc) {
3805 			/* Can't do it, since they exceeded our buffer size  */
3806 			asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
3807 		} else if (stcb->asoc.stream_reset_out_is_outstanding == 0) {
3808 			len = ntohs(req->ph.param_length);
3809 			number_entries = ((len - sizeof(struct sctp_stream_reset_in_request)) / sizeof(uint16_t));
3810 			if (number_entries) {
3811 				for (i = 0; i < number_entries; i++) {
3812 					temp = ntohs(req->list_of_streams[i]);
3813 					if (temp >= stcb->asoc.streamoutcnt) {
3814 						asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
3815 						goto bad_boy;
3816 					}
3817 					req->list_of_streams[i] = temp;
3818 				}
3819 				for (i = 0; i < number_entries; i++) {
3820 					if (stcb->asoc.strmout[req->list_of_streams[i]].state == SCTP_STREAM_OPEN) {
3821 						stcb->asoc.strmout[req->list_of_streams[i]].state = SCTP_STREAM_RESET_PENDING;
3822 					}
3823 				}
3824 			} else {
3825 				/* Its all */
3826 				for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
3827 					if (stcb->asoc.strmout[i].state == SCTP_STREAM_OPEN)
3828 						stcb->asoc.strmout[i].state = SCTP_STREAM_RESET_PENDING;
3829 				}
3830 			}
3831 			asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_PERFORMED;
3832 		} else {
3833 			/* Can't do it, since we have sent one out */
3834 			asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_ERR_IN_PROGRESS;
3835 		}
3836 bad_boy:
3837 		sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
3838 		asoc->str_reset_seq_in++;
3839 	} else if (asoc->str_reset_seq_in - 1 == seq) {
3840 		sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
3841 	} else if (asoc->str_reset_seq_in - 2 == seq) {
3842 		sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]);
3843 	} else {
3844 		sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_RESULT_ERR_BAD_SEQNO);
3845 	}
3846 	sctp_send_stream_reset_out_if_possible(stcb, SCTP_SO_NOT_LOCKED);
3847 }
3848 
3849 static int
3850 sctp_handle_str_reset_request_tsn(struct sctp_tcb *stcb,
3851     struct sctp_tmit_chunk *chk,
3852     struct sctp_stream_reset_tsn_request *req)
3853 {
3854 	/* reset all in and out and update the tsn */
3855 	/*
3856 	 * A) reset my str-seq's on in and out. B) Select a receive next,
3857 	 * and set cum-ack to it. Also process this selected number as a
3858 	 * fwd-tsn as well. C) set in the response my next sending seq.
3859 	 */
3860 	struct sctp_forward_tsn_chunk fwdtsn;
3861 	struct sctp_association *asoc = &stcb->asoc;
3862 	int abort_flag = 0;
3863 	uint32_t seq;
3864 
3865 	seq = ntohl(req->request_seq);
3866 	if (asoc->str_reset_seq_in == seq) {
3867 		asoc->last_reset_action[1] = stcb->asoc.last_reset_action[0];
3868 		if (!(asoc->local_strreset_support & SCTP_ENABLE_CHANGE_ASSOC_REQ)) {
3869 			asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
3870 		} else {
3871 			fwdtsn.ch.chunk_length = htons(sizeof(struct sctp_forward_tsn_chunk));
3872 			fwdtsn.ch.chunk_type = SCTP_FORWARD_CUM_TSN;
3873 			fwdtsn.ch.chunk_flags = 0;
3874 			fwdtsn.new_cumulative_tsn = htonl(stcb->asoc.highest_tsn_inside_map + 1);
3875 			sctp_handle_forward_tsn(stcb, &fwdtsn, &abort_flag, NULL, 0);
3876 			if (abort_flag) {
3877 				return (1);
3878 			}
3879 			asoc->highest_tsn_inside_map += SCTP_STREAM_RESET_TSN_DELTA;
3880 			if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {
3881 				sctp_log_map(0, 10, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
3882 			}
3883 			asoc->tsn_last_delivered = asoc->cumulative_tsn = asoc->highest_tsn_inside_map;
3884 			asoc->mapping_array_base_tsn = asoc->highest_tsn_inside_map + 1;
3885 			memset(asoc->mapping_array, 0, asoc->mapping_array_size);
3886 			asoc->highest_tsn_inside_nr_map = asoc->highest_tsn_inside_map;
3887 			memset(asoc->nr_mapping_array, 0, asoc->mapping_array_size);
3888 			atomic_add_int(&asoc->sending_seq, 1);
3889 			/* save off historical data for retrans */
3890 			asoc->last_sending_seq[1] = asoc->last_sending_seq[0];
3891 			asoc->last_sending_seq[0] = asoc->sending_seq;
3892 			asoc->last_base_tsnsent[1] = asoc->last_base_tsnsent[0];
3893 			asoc->last_base_tsnsent[0] = asoc->mapping_array_base_tsn;
3894 			sctp_reset_out_streams(stcb, 0, (uint16_t *)NULL);
3895 			sctp_reset_in_stream(stcb, 0, (uint16_t *)NULL);
3896 			asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_PERFORMED;
3897 			sctp_notify_stream_reset_tsn(stcb, asoc->sending_seq, (asoc->mapping_array_base_tsn + 1), 0);
3898 		}
3899 		sctp_add_stream_reset_result_tsn(chk, seq, asoc->last_reset_action[0],
3900 		    asoc->last_sending_seq[0], asoc->last_base_tsnsent[0]);
3901 		asoc->str_reset_seq_in++;
3902 	} else if (asoc->str_reset_seq_in - 1 == seq) {
3903 		sctp_add_stream_reset_result_tsn(chk, seq, asoc->last_reset_action[0],
3904 		    asoc->last_sending_seq[0], asoc->last_base_tsnsent[0]);
3905 	} else if (asoc->str_reset_seq_in - 2 == seq) {
3906 		sctp_add_stream_reset_result_tsn(chk, seq, asoc->last_reset_action[1],
3907 		    asoc->last_sending_seq[1], asoc->last_base_tsnsent[1]);
3908 	} else {
3909 		sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_RESULT_ERR_BAD_SEQNO);
3910 	}
3911 	return (0);
3912 }
3913 
3914 static void
3915 sctp_handle_str_reset_request_out(struct sctp_tcb *stcb,
3916     struct sctp_tmit_chunk *chk,
3917     struct sctp_stream_reset_out_request *req, int trunc)
3918 {
3919 	uint32_t seq, tsn;
3920 	int number_entries, len;
3921 	struct sctp_association *asoc = &stcb->asoc;
3922 
3923 	seq = ntohl(req->request_seq);
3924 
3925 	/* now if its not a duplicate we process it */
3926 	if (asoc->str_reset_seq_in == seq) {
3927 		len = ntohs(req->ph.param_length);
3928 		number_entries = ((len - sizeof(struct sctp_stream_reset_out_request)) / sizeof(uint16_t));
3929 		/*
3930 		 * the sender is resetting, handle the list issue.. we must
3931 		 * a) verify if we can do the reset, if so no problem b) If
3932 		 * we can't do the reset we must copy the request. c) queue
3933 		 * it, and setup the data in processor to trigger it off
3934 		 * when needed and dequeue all the queued data.
3935 		 */
3936 		tsn = ntohl(req->send_reset_at_tsn);
3937 
3938 		/* move the reset action back one */
3939 		asoc->last_reset_action[1] = asoc->last_reset_action[0];
3940 		if (!(asoc->local_strreset_support & SCTP_ENABLE_RESET_STREAM_REQ)) {
3941 			asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
3942 		} else if (trunc) {
3943 			asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
3944 		} else if (SCTP_TSN_GE(asoc->cumulative_tsn, tsn)) {
3945 			/* we can do it now */
3946 			sctp_reset_in_stream(stcb, number_entries, req->list_of_streams);
3947 			asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_PERFORMED;
3948 		} else {
3949 			/*
3950 			 * we must queue it up and thus wait for the TSN's
3951 			 * to arrive that are at or before tsn
3952 			 */
3953 			struct sctp_stream_reset_list *liste;
3954 			int siz;
3955 
3956 			siz = sizeof(struct sctp_stream_reset_list) + (number_entries * sizeof(uint16_t));
3957 			SCTP_MALLOC(liste, struct sctp_stream_reset_list *,
3958 			    siz, SCTP_M_STRESET);
3959 			if (liste == NULL) {
3960 				/* gak out of memory */
3961 				asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
3962 				sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
3963 				return;
3964 			}
3965 			liste->seq = seq;
3966 			liste->tsn = tsn;
3967 			liste->number_entries = number_entries;
3968 			memcpy(&liste->list_of_streams, req->list_of_streams, number_entries * sizeof(uint16_t));
3969 			TAILQ_INSERT_TAIL(&asoc->resetHead, liste, next_resp);
3970 			asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_IN_PROGRESS;
3971 		}
3972 		sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
3973 		asoc->str_reset_seq_in++;
3974 	} else if ((asoc->str_reset_seq_in - 1) == seq) {
3975 		/*
3976 		 * one seq back, just echo back last action since my
3977 		 * response was lost.
3978 		 */
3979 		sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
3980 	} else if ((asoc->str_reset_seq_in - 2) == seq) {
3981 		/*
3982 		 * two seq back, just echo back last action since my
3983 		 * response was lost.
3984 		 */
3985 		sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]);
3986 	} else {
3987 		sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_RESULT_ERR_BAD_SEQNO);
3988 	}
3989 }
3990 
3991 static void
3992 sctp_handle_str_reset_add_strm(struct sctp_tcb *stcb, struct sctp_tmit_chunk *chk,
3993     struct sctp_stream_reset_add_strm *str_add)
3994 {
3995 	/*
3996 	 * Peer is requesting to add more streams. If its within our
3997 	 * max-streams we will allow it.
3998 	 */
3999 	uint32_t num_stream, i;
4000 	uint32_t seq;
4001 	struct sctp_association *asoc = &stcb->asoc;
4002 	struct sctp_queued_to_read *ctl, *nctl;
4003 
4004 	/* Get the number. */
4005 	seq = ntohl(str_add->request_seq);
4006 	num_stream = ntohs(str_add->number_of_streams);
4007 	/* Now what would be the new total? */
4008 	if (asoc->str_reset_seq_in == seq) {
4009 		num_stream += stcb->asoc.streamincnt;
4010 		stcb->asoc.last_reset_action[1] = stcb->asoc.last_reset_action[0];
4011 		if (!(asoc->local_strreset_support & SCTP_ENABLE_CHANGE_ASSOC_REQ)) {
4012 			asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
4013 		} else if ((num_stream > stcb->asoc.max_inbound_streams) ||
4014 		    (num_stream > 0xffff)) {
4015 			/* We must reject it they ask for to many */
4016 	denied:
4017 			stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
4018 		} else {
4019 			/* Ok, we can do that :-) */
4020 			struct sctp_stream_in *oldstrm;
4021 
4022 			/* save off the old */
4023 			oldstrm = stcb->asoc.strmin;
4024 			SCTP_MALLOC(stcb->asoc.strmin, struct sctp_stream_in *,
4025 			    (num_stream * sizeof(struct sctp_stream_in)),
4026 			    SCTP_M_STRMI);
4027 			if (stcb->asoc.strmin == NULL) {
4028 				stcb->asoc.strmin = oldstrm;
4029 				goto denied;
4030 			}
4031 			/* copy off the old data */
4032 			for (i = 0; i < stcb->asoc.streamincnt; i++) {
4033 				TAILQ_INIT(&stcb->asoc.strmin[i].inqueue);
4034 				TAILQ_INIT(&stcb->asoc.strmin[i].uno_inqueue);
4035 				stcb->asoc.strmin[i].sid = i;
4036 				stcb->asoc.strmin[i].last_mid_delivered = oldstrm[i].last_mid_delivered;
4037 				stcb->asoc.strmin[i].delivery_started = oldstrm[i].delivery_started;
4038 				stcb->asoc.strmin[i].pd_api_started = oldstrm[i].pd_api_started;
4039 				/* now anything on those queues? */
4040 				TAILQ_FOREACH_SAFE(ctl, &oldstrm[i].inqueue, next_instrm, nctl) {
4041 					TAILQ_REMOVE(&oldstrm[i].inqueue, ctl, next_instrm);
4042 					TAILQ_INSERT_TAIL(&stcb->asoc.strmin[i].inqueue, ctl, next_instrm);
4043 				}
4044 				TAILQ_FOREACH_SAFE(ctl, &oldstrm[i].uno_inqueue, next_instrm, nctl) {
4045 					TAILQ_REMOVE(&oldstrm[i].uno_inqueue, ctl, next_instrm);
4046 					TAILQ_INSERT_TAIL(&stcb->asoc.strmin[i].uno_inqueue, ctl, next_instrm);
4047 				}
4048 			}
4049 			/* Init the new streams */
4050 			for (i = stcb->asoc.streamincnt; i < num_stream; i++) {
4051 				TAILQ_INIT(&stcb->asoc.strmin[i].inqueue);
4052 				TAILQ_INIT(&stcb->asoc.strmin[i].uno_inqueue);
4053 				stcb->asoc.strmin[i].sid = i;
4054 				stcb->asoc.strmin[i].last_mid_delivered = 0xffffffff;
4055 				stcb->asoc.strmin[i].pd_api_started = 0;
4056 				stcb->asoc.strmin[i].delivery_started = 0;
4057 			}
4058 			SCTP_FREE(oldstrm, SCTP_M_STRMI);
4059 			/* update the size */
4060 			stcb->asoc.streamincnt = num_stream;
4061 			stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_PERFORMED;
4062 			sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt, 0);
4063 		}
4064 		sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
4065 		asoc->str_reset_seq_in++;
4066 	} else if ((asoc->str_reset_seq_in - 1) == seq) {
4067 		/*
4068 		 * one seq back, just echo back last action since my
4069 		 * response was lost.
4070 		 */
4071 		sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
4072 	} else if ((asoc->str_reset_seq_in - 2) == seq) {
4073 		/*
4074 		 * two seq back, just echo back last action since my
4075 		 * response was lost.
4076 		 */
4077 		sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]);
4078 	} else {
4079 		sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_RESULT_ERR_BAD_SEQNO);
4080 
4081 	}
4082 }
4083 
4084 static void
4085 sctp_handle_str_reset_add_out_strm(struct sctp_tcb *stcb, struct sctp_tmit_chunk *chk,
4086     struct sctp_stream_reset_add_strm *str_add)
4087 {
4088 	/*
4089 	 * Peer is requesting to add more streams. If its within our
4090 	 * max-streams we will allow it.
4091 	 */
4092 	uint16_t num_stream;
4093 	uint32_t seq;
4094 	struct sctp_association *asoc = &stcb->asoc;
4095 
4096 	/* Get the number. */
4097 	seq = ntohl(str_add->request_seq);
4098 	num_stream = ntohs(str_add->number_of_streams);
4099 	/* Now what would be the new total? */
4100 	if (asoc->str_reset_seq_in == seq) {
4101 		stcb->asoc.last_reset_action[1] = stcb->asoc.last_reset_action[0];
4102 		if (!(asoc->local_strreset_support & SCTP_ENABLE_CHANGE_ASSOC_REQ)) {
4103 			asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
4104 		} else if (stcb->asoc.stream_reset_outstanding) {
4105 			/* We must reject it we have something pending */
4106 			stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_ERR_IN_PROGRESS;
4107 		} else {
4108 			/* Ok, we can do that :-) */
4109 			int mychk;
4110 
4111 			mychk = stcb->asoc.streamoutcnt;
4112 			mychk += num_stream;
4113 			if (mychk < 0x10000) {
4114 				stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_PERFORMED;
4115 				if (sctp_send_str_reset_req(stcb, 0, NULL, 0, 0, 1, num_stream, 0, 1)) {
4116 					stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
4117 				}
4118 			} else {
4119 				stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
4120 			}
4121 		}
4122 		sctp_add_stream_reset_result(chk, seq, stcb->asoc.last_reset_action[0]);
4123 		asoc->str_reset_seq_in++;
4124 	} else if ((asoc->str_reset_seq_in - 1) == seq) {
4125 		/*
4126 		 * one seq back, just echo back last action since my
4127 		 * response was lost.
4128 		 */
4129 		sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
4130 	} else if ((asoc->str_reset_seq_in - 2) == seq) {
4131 		/*
4132 		 * two seq back, just echo back last action since my
4133 		 * response was lost.
4134 		 */
4135 		sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]);
4136 	} else {
4137 		sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_RESULT_ERR_BAD_SEQNO);
4138 	}
4139 }
4140 
4141 #ifdef __GNUC__
4142 __attribute__((noinline))
4143 #endif
4144 static int
4145 sctp_handle_stream_reset(struct sctp_tcb *stcb, struct mbuf *m, int offset,
4146     struct sctp_chunkhdr *ch_req)
4147 {
4148 	uint16_t remaining_length, param_len, ptype;
4149 	struct sctp_paramhdr pstore;
4150 	uint8_t cstore[SCTP_CHUNK_BUFFER_SIZE];
4151 	uint32_t seq = 0;
4152 	int num_req = 0;
4153 	int trunc = 0;
4154 	struct sctp_tmit_chunk *chk;
4155 	struct sctp_chunkhdr *ch;
4156 	struct sctp_paramhdr *ph;
4157 	int ret_code = 0;
4158 	int num_param = 0;
4159 
4160 	/* now it may be a reset or a reset-response */
4161 	remaining_length = ntohs(ch_req->chunk_length) - sizeof(struct sctp_chunkhdr);
4162 
4163 	/* setup for adding the response */
4164 	sctp_alloc_a_chunk(stcb, chk);
4165 	if (chk == NULL) {
4166 		return (ret_code);
4167 	}
4168 	chk->copy_by_ref = 0;
4169 	chk->rec.chunk_id.id = SCTP_STREAM_RESET;
4170 	chk->rec.chunk_id.can_take_data = 0;
4171 	chk->flags = 0;
4172 	chk->asoc = &stcb->asoc;
4173 	chk->no_fr_allowed = 0;
4174 	chk->book_size = chk->send_size = sizeof(struct sctp_chunkhdr);
4175 	chk->book_size_scale = 0;
4176 	chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA);
4177 	if (chk->data == NULL) {
4178 strres_nochunk:
4179 		if (chk->data) {
4180 			sctp_m_freem(chk->data);
4181 			chk->data = NULL;
4182 		}
4183 		sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
4184 		return (ret_code);
4185 	}
4186 	SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD);
4187 
4188 	/* setup chunk parameters */
4189 	chk->sent = SCTP_DATAGRAM_UNSENT;
4190 	chk->snd_count = 0;
4191 	chk->whoTo = NULL;
4192 
4193 	ch = mtod(chk->data, struct sctp_chunkhdr *);
4194 	ch->chunk_type = SCTP_STREAM_RESET;
4195 	ch->chunk_flags = 0;
4196 	ch->chunk_length = htons(chk->send_size);
4197 	SCTP_BUF_LEN(chk->data) = SCTP_SIZE32(chk->send_size);
4198 	offset += sizeof(struct sctp_chunkhdr);
4199 	while (remaining_length >= sizeof(struct sctp_paramhdr)) {
4200 		ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset, sizeof(pstore), (uint8_t *)&pstore);
4201 		if (ph == NULL) {
4202 			/* TSNH */
4203 			break;
4204 		}
4205 		param_len = ntohs(ph->param_length);
4206 		if ((param_len > remaining_length) ||
4207 		    (param_len < (sizeof(struct sctp_paramhdr) + sizeof(uint32_t)))) {
4208 			/* bad parameter length */
4209 			break;
4210 		}
4211 		ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset, min(param_len, sizeof(cstore)),
4212 		    (uint8_t *)&cstore);
4213 		if (ph == NULL) {
4214 			/* TSNH */
4215 			break;
4216 		}
4217 		ptype = ntohs(ph->param_type);
4218 		num_param++;
4219 		if (param_len > sizeof(cstore)) {
4220 			trunc = 1;
4221 		} else {
4222 			trunc = 0;
4223 		}
4224 		if (num_param > SCTP_MAX_RESET_PARAMS) {
4225 			/* hit the max of parameters already sorry.. */
4226 			break;
4227 		}
4228 		if (ptype == SCTP_STR_RESET_OUT_REQUEST) {
4229 			struct sctp_stream_reset_out_request *req_out;
4230 
4231 			if (param_len < sizeof(struct sctp_stream_reset_out_request)) {
4232 				break;
4233 			}
4234 			req_out = (struct sctp_stream_reset_out_request *)ph;
4235 			num_req++;
4236 			if (stcb->asoc.stream_reset_outstanding) {
4237 				seq = ntohl(req_out->response_seq);
4238 				if (seq == stcb->asoc.str_reset_seq_out) {
4239 					/* implicit ack */
4240 					(void)sctp_handle_stream_reset_response(stcb, seq, SCTP_STREAM_RESET_RESULT_PERFORMED, NULL);
4241 				}
4242 			}
4243 			sctp_handle_str_reset_request_out(stcb, chk, req_out, trunc);
4244 		} else if (ptype == SCTP_STR_RESET_ADD_OUT_STREAMS) {
4245 			struct sctp_stream_reset_add_strm *str_add;
4246 
4247 			if (param_len < sizeof(struct sctp_stream_reset_add_strm)) {
4248 				break;
4249 			}
4250 			str_add = (struct sctp_stream_reset_add_strm *)ph;
4251 			num_req++;
4252 			sctp_handle_str_reset_add_strm(stcb, chk, str_add);
4253 		} else if (ptype == SCTP_STR_RESET_ADD_IN_STREAMS) {
4254 			struct sctp_stream_reset_add_strm *str_add;
4255 
4256 			if (param_len < sizeof(struct sctp_stream_reset_add_strm)) {
4257 				break;
4258 			}
4259 			str_add = (struct sctp_stream_reset_add_strm *)ph;
4260 			num_req++;
4261 			sctp_handle_str_reset_add_out_strm(stcb, chk, str_add);
4262 		} else if (ptype == SCTP_STR_RESET_IN_REQUEST) {
4263 			struct sctp_stream_reset_in_request *req_in;
4264 
4265 			num_req++;
4266 			req_in = (struct sctp_stream_reset_in_request *)ph;
4267 			sctp_handle_str_reset_request_in(stcb, chk, req_in, trunc);
4268 		} else if (ptype == SCTP_STR_RESET_TSN_REQUEST) {
4269 			struct sctp_stream_reset_tsn_request *req_tsn;
4270 
4271 			num_req++;
4272 			req_tsn = (struct sctp_stream_reset_tsn_request *)ph;
4273 			if (sctp_handle_str_reset_request_tsn(stcb, chk, req_tsn)) {
4274 				ret_code = 1;
4275 				goto strres_nochunk;
4276 			}
4277 			/* no more */
4278 			break;
4279 		} else if (ptype == SCTP_STR_RESET_RESPONSE) {
4280 			struct sctp_stream_reset_response *resp;
4281 			uint32_t result;
4282 
4283 			if (param_len < sizeof(struct sctp_stream_reset_response)) {
4284 				break;
4285 			}
4286 			resp = (struct sctp_stream_reset_response *)ph;
4287 			seq = ntohl(resp->response_seq);
4288 			result = ntohl(resp->result);
4289 			if (sctp_handle_stream_reset_response(stcb, seq, result, resp)) {
4290 				ret_code = 1;
4291 				goto strres_nochunk;
4292 			}
4293 		} else {
4294 			break;
4295 		}
4296 		offset += SCTP_SIZE32(param_len);
4297 		if (remaining_length >= SCTP_SIZE32(param_len)) {
4298 			remaining_length -= SCTP_SIZE32(param_len);
4299 		} else {
4300 			remaining_length = 0;
4301 		}
4302 	}
4303 	if (num_req == 0) {
4304 		/* we have no response free the stuff */
4305 		goto strres_nochunk;
4306 	}
4307 	/* ok we have a chunk to link in */
4308 	TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue,
4309 	    chk,
4310 	    sctp_next);
4311 	stcb->asoc.ctrl_queue_cnt++;
4312 	return (ret_code);
4313 }
4314 
4315 /*
4316  * Handle a router or endpoints report of a packet loss, there are two ways
4317  * to handle this, either we get the whole packet and must disect it
4318  * ourselves (possibly with truncation and or corruption) or it is a summary
4319  * from a middle box that did the disectting for us.
4320  */
4321 static void
4322 sctp_handle_packet_dropped(struct sctp_pktdrop_chunk *cp,
4323     struct sctp_tcb *stcb, struct sctp_nets *net, uint32_t limit)
4324 {
4325 	uint32_t bottle_bw, on_queue;
4326 	uint16_t trunc_len;
4327 	unsigned int chlen;
4328 	unsigned int at;
4329 	struct sctp_chunk_desc desc;
4330 	struct sctp_chunkhdr *ch;
4331 
4332 	chlen = ntohs(cp->ch.chunk_length);
4333 	chlen -= sizeof(struct sctp_pktdrop_chunk);
4334 	/* XXX possible chlen underflow */
4335 	if (chlen == 0) {
4336 		ch = NULL;
4337 		if (cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX)
4338 			SCTP_STAT_INCR(sctps_pdrpbwrpt);
4339 	} else {
4340 		ch = (struct sctp_chunkhdr *)(cp->data + sizeof(struct sctphdr));
4341 		chlen -= sizeof(struct sctphdr);
4342 		/* XXX possible chlen underflow */
4343 		memset(&desc, 0, sizeof(desc));
4344 	}
4345 	trunc_len = (uint16_t)ntohs(cp->trunc_len);
4346 	if (trunc_len > limit) {
4347 		trunc_len = limit;
4348 	}
4349 	/* now the chunks themselves */
4350 	while ((ch != NULL) && (chlen >= sizeof(struct sctp_chunkhdr))) {
4351 		desc.chunk_type = ch->chunk_type;
4352 		/* get amount we need to move */
4353 		at = ntohs(ch->chunk_length);
4354 		if (at < sizeof(struct sctp_chunkhdr)) {
4355 			/* corrupt chunk, maybe at the end? */
4356 			SCTP_STAT_INCR(sctps_pdrpcrupt);
4357 			break;
4358 		}
4359 		if (trunc_len == 0) {
4360 			/* we are supposed to have all of it */
4361 			if (at > chlen) {
4362 				/* corrupt skip it */
4363 				SCTP_STAT_INCR(sctps_pdrpcrupt);
4364 				break;
4365 			}
4366 		} else {
4367 			/* is there enough of it left ? */
4368 			if (desc.chunk_type == SCTP_DATA) {
4369 				if (chlen < (sizeof(struct sctp_data_chunk) +
4370 				    sizeof(desc.data_bytes))) {
4371 					break;
4372 				}
4373 			} else {
4374 				if (chlen < sizeof(struct sctp_chunkhdr)) {
4375 					break;
4376 				}
4377 			}
4378 		}
4379 		if (desc.chunk_type == SCTP_DATA) {
4380 			/* can we get out the tsn? */
4381 			if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX))
4382 				SCTP_STAT_INCR(sctps_pdrpmbda);
4383 
4384 			if (chlen >= (sizeof(struct sctp_data_chunk) + sizeof(uint32_t))) {
4385 				/* yep */
4386 				struct sctp_data_chunk *dcp;
4387 				uint8_t *ddp;
4388 				unsigned int iii;
4389 
4390 				dcp = (struct sctp_data_chunk *)ch;
4391 				ddp = (uint8_t *)(dcp + 1);
4392 				for (iii = 0; iii < sizeof(desc.data_bytes); iii++) {
4393 					desc.data_bytes[iii] = ddp[iii];
4394 				}
4395 				desc.tsn_ifany = dcp->dp.tsn;
4396 			} else {
4397 				/* nope we are done. */
4398 				SCTP_STAT_INCR(sctps_pdrpnedat);
4399 				break;
4400 			}
4401 		} else {
4402 			if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX))
4403 				SCTP_STAT_INCR(sctps_pdrpmbct);
4404 		}
4405 
4406 		if (process_chunk_drop(stcb, &desc, net, cp->ch.chunk_flags)) {
4407 			SCTP_STAT_INCR(sctps_pdrppdbrk);
4408 			break;
4409 		}
4410 		if (SCTP_SIZE32(at) > chlen) {
4411 			break;
4412 		}
4413 		chlen -= SCTP_SIZE32(at);
4414 		if (chlen < sizeof(struct sctp_chunkhdr)) {
4415 			/* done, none left */
4416 			break;
4417 		}
4418 		ch = (struct sctp_chunkhdr *)((caddr_t)ch + SCTP_SIZE32(at));
4419 	}
4420 	/* Now update any rwnd --- possibly */
4421 	if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX) == 0) {
4422 		/* From a peer, we get a rwnd report */
4423 		uint32_t a_rwnd;
4424 
4425 		SCTP_STAT_INCR(sctps_pdrpfehos);
4426 
4427 		bottle_bw = ntohl(cp->bottle_bw);
4428 		on_queue = ntohl(cp->current_onq);
4429 		if (bottle_bw && on_queue) {
4430 			/* a rwnd report is in here */
4431 			if (bottle_bw > on_queue)
4432 				a_rwnd = bottle_bw - on_queue;
4433 			else
4434 				a_rwnd = 0;
4435 
4436 			if (a_rwnd == 0)
4437 				stcb->asoc.peers_rwnd = 0;
4438 			else {
4439 				if (a_rwnd > stcb->asoc.total_flight) {
4440 					stcb->asoc.peers_rwnd =
4441 					    a_rwnd - stcb->asoc.total_flight;
4442 				} else {
4443 					stcb->asoc.peers_rwnd = 0;
4444 				}
4445 				if (stcb->asoc.peers_rwnd <
4446 				    stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
4447 					/* SWS sender side engages */
4448 					stcb->asoc.peers_rwnd = 0;
4449 				}
4450 			}
4451 		}
4452 	} else {
4453 		SCTP_STAT_INCR(sctps_pdrpfmbox);
4454 	}
4455 
4456 	/* now middle boxes in sat networks get a cwnd bump */
4457 	if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX) &&
4458 	    (stcb->asoc.sat_t3_loss_recovery == 0) &&
4459 	    (stcb->asoc.sat_network)) {
4460 		/*
4461 		 * This is debatable but for sat networks it makes sense
4462 		 * Note if a T3 timer has went off, we will prohibit any
4463 		 * changes to cwnd until we exit the t3 loss recovery.
4464 		 */
4465 		stcb->asoc.cc_functions.sctp_cwnd_update_after_packet_dropped(stcb,
4466 		    net, cp, &bottle_bw, &on_queue);
4467 	}
4468 }
4469 
4470 /*
4471  * handles all control chunks in a packet inputs: - m: mbuf chain, assumed to
4472  * still contain IP/SCTP header - stcb: is the tcb found for this packet -
4473  * offset: offset into the mbuf chain to first chunkhdr - length: is the
4474  * length of the complete packet outputs: - length: modified to remaining
4475  * length after control processing - netp: modified to new sctp_nets after
4476  * cookie-echo processing - return NULL to discard the packet (ie. no asoc,
4477  * bad packet,...) otherwise return the tcb for this packet
4478  */
4479 #ifdef __GNUC__
4480 __attribute__((noinline))
4481 #endif
4482 static struct sctp_tcb *
4483 sctp_process_control(struct mbuf *m, int iphlen, int *offset, int length,
4484     struct sockaddr *src, struct sockaddr *dst,
4485     struct sctphdr *sh, struct sctp_chunkhdr *ch, struct sctp_inpcb *inp,
4486     struct sctp_tcb *stcb, struct sctp_nets **netp, int *fwd_tsn_seen,
4487     uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum,
4488     uint32_t vrf_id, uint16_t port)
4489 {
4490 	struct sctp_association *asoc;
4491 	struct mbuf *op_err;
4492 	char msg[SCTP_DIAG_INFO_LEN];
4493 	uint32_t vtag_in;
4494 	int num_chunks = 0;	/* number of control chunks processed */
4495 	uint32_t chk_length;
4496 	int ret;
4497 	int abort_no_unlock = 0;
4498 	int ecne_seen = 0;
4499 
4500 	/*
4501 	 * How big should this be, and should it be alloc'd? Lets try the
4502 	 * d-mtu-ceiling for now (2k) and that should hopefully work ...
4503 	 * until we get into jumbo grams and such..
4504 	 */
4505 	uint8_t chunk_buf[SCTP_CHUNK_BUFFER_SIZE];
4506 	struct sctp_tcb *locked_tcb = stcb;
4507 	int got_auth = 0;
4508 	uint32_t auth_offset = 0, auth_len = 0;
4509 	int auth_skipped = 0;
4510 	int asconf_cnt = 0;
4511 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4512 	struct socket *so;
4513 #endif
4514 
4515 	SCTPDBG(SCTP_DEBUG_INPUT1, "sctp_process_control: iphlen=%u, offset=%u, length=%u stcb:%p\n",
4516 	    iphlen, *offset, length, (void *)stcb);
4517 
4518 	/* validate chunk header length... */
4519 	if (ntohs(ch->chunk_length) < sizeof(*ch)) {
4520 		SCTPDBG(SCTP_DEBUG_INPUT1, "Invalid header length %d\n",
4521 		    ntohs(ch->chunk_length));
4522 		if (locked_tcb) {
4523 			SCTP_TCB_UNLOCK(locked_tcb);
4524 		}
4525 		return (NULL);
4526 	}
4527 	/*
4528 	 * validate the verification tag
4529 	 */
4530 	vtag_in = ntohl(sh->v_tag);
4531 
4532 	if (locked_tcb) {
4533 		SCTP_TCB_LOCK_ASSERT(locked_tcb);
4534 	}
4535 	if (ch->chunk_type == SCTP_INITIATION) {
4536 		SCTPDBG(SCTP_DEBUG_INPUT1, "Its an INIT of len:%d vtag:%x\n",
4537 		    ntohs(ch->chunk_length), vtag_in);
4538 		if (vtag_in != 0) {
4539 			/* protocol error- silently discard... */
4540 			SCTP_STAT_INCR(sctps_badvtag);
4541 			if (locked_tcb) {
4542 				SCTP_TCB_UNLOCK(locked_tcb);
4543 			}
4544 			return (NULL);
4545 		}
4546 	} else if (ch->chunk_type != SCTP_COOKIE_ECHO) {
4547 		/*
4548 		 * If there is no stcb, skip the AUTH chunk and process
4549 		 * later after a stcb is found (to validate the lookup was
4550 		 * valid.
4551 		 */
4552 		if ((ch->chunk_type == SCTP_AUTHENTICATION) &&
4553 		    (stcb == NULL) &&
4554 		    (inp->auth_supported == 1)) {
4555 			/* save this chunk for later processing */
4556 			auth_skipped = 1;
4557 			auth_offset = *offset;
4558 			auth_len = ntohs(ch->chunk_length);
4559 
4560 			/* (temporarily) move past this chunk */
4561 			*offset += SCTP_SIZE32(auth_len);
4562 			if (*offset >= length) {
4563 				/* no more data left in the mbuf chain */
4564 				*offset = length;
4565 				if (locked_tcb) {
4566 					SCTP_TCB_UNLOCK(locked_tcb);
4567 				}
4568 				return (NULL);
4569 			}
4570 			ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
4571 			    sizeof(struct sctp_chunkhdr), chunk_buf);
4572 		}
4573 		if (ch == NULL) {
4574 			/* Help */
4575 			*offset = length;
4576 			if (locked_tcb) {
4577 				SCTP_TCB_UNLOCK(locked_tcb);
4578 			}
4579 			return (NULL);
4580 		}
4581 		if (ch->chunk_type == SCTP_COOKIE_ECHO) {
4582 			goto process_control_chunks;
4583 		}
4584 		/*
4585 		 * first check if it's an ASCONF with an unknown src addr we
4586 		 * need to look inside to find the association
4587 		 */
4588 		if (ch->chunk_type == SCTP_ASCONF && stcb == NULL) {
4589 			struct sctp_chunkhdr *asconf_ch = ch;
4590 			uint32_t asconf_offset = 0, asconf_len = 0;
4591 
4592 			/* inp's refcount may be reduced */
4593 			SCTP_INP_INCR_REF(inp);
4594 
4595 			asconf_offset = *offset;
4596 			do {
4597 				asconf_len = ntohs(asconf_ch->chunk_length);
4598 				if (asconf_len < sizeof(struct sctp_asconf_paramhdr))
4599 					break;
4600 				stcb = sctp_findassociation_ep_asconf(m,
4601 				    *offset,
4602 				    dst,
4603 				    sh, &inp, netp, vrf_id);
4604 				if (stcb != NULL)
4605 					break;
4606 				asconf_offset += SCTP_SIZE32(asconf_len);
4607 				asconf_ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, asconf_offset,
4608 				    sizeof(struct sctp_chunkhdr), chunk_buf);
4609 			} while (asconf_ch != NULL && asconf_ch->chunk_type == SCTP_ASCONF);
4610 			if (stcb == NULL) {
4611 				/*
4612 				 * reduce inp's refcount if not reduced in
4613 				 * sctp_findassociation_ep_asconf().
4614 				 */
4615 				SCTP_INP_DECR_REF(inp);
4616 			} else {
4617 				locked_tcb = stcb;
4618 			}
4619 
4620 			/* now go back and verify any auth chunk to be sure */
4621 			if (auth_skipped && (stcb != NULL)) {
4622 				struct sctp_auth_chunk *auth;
4623 
4624 				auth = (struct sctp_auth_chunk *)
4625 				    sctp_m_getptr(m, auth_offset,
4626 				    auth_len, chunk_buf);
4627 				got_auth = 1;
4628 				auth_skipped = 0;
4629 				if ((auth == NULL) || sctp_handle_auth(stcb, auth, m,
4630 				    auth_offset)) {
4631 					/* auth HMAC failed so dump it */
4632 					*offset = length;
4633 					if (locked_tcb) {
4634 						SCTP_TCB_UNLOCK(locked_tcb);
4635 					}
4636 					return (NULL);
4637 				} else {
4638 					/* remaining chunks are HMAC checked */
4639 					stcb->asoc.authenticated = 1;
4640 				}
4641 			}
4642 		}
4643 		if (stcb == NULL) {
4644 			snprintf(msg, sizeof(msg), "OOTB, %s:%d at %s", __FILE__, __LINE__, __func__);
4645 			op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
4646 			    msg);
4647 			/* no association, so it's out of the blue... */
4648 			sctp_handle_ootb(m, iphlen, *offset, src, dst, sh, inp, op_err,
4649 			    mflowtype, mflowid, inp->fibnum,
4650 			    vrf_id, port);
4651 			*offset = length;
4652 			if (locked_tcb) {
4653 				SCTP_TCB_UNLOCK(locked_tcb);
4654 			}
4655 			return (NULL);
4656 		}
4657 		asoc = &stcb->asoc;
4658 		/* ABORT and SHUTDOWN can use either v_tag... */
4659 		if ((ch->chunk_type == SCTP_ABORT_ASSOCIATION) ||
4660 		    (ch->chunk_type == SCTP_SHUTDOWN_COMPLETE) ||
4661 		    (ch->chunk_type == SCTP_PACKET_DROPPED)) {
4662 			/* Take the T-bit always into account. */
4663 			if ((((ch->chunk_flags & SCTP_HAD_NO_TCB) == 0) &&
4664 			    (vtag_in == asoc->my_vtag)) ||
4665 			    (((ch->chunk_flags & SCTP_HAD_NO_TCB) == SCTP_HAD_NO_TCB) &&
4666 			    (vtag_in == asoc->peer_vtag))) {
4667 				/* this is valid */
4668 			} else {
4669 				/* drop this packet... */
4670 				SCTP_STAT_INCR(sctps_badvtag);
4671 				if (locked_tcb) {
4672 					SCTP_TCB_UNLOCK(locked_tcb);
4673 				}
4674 				return (NULL);
4675 			}
4676 		} else if (ch->chunk_type == SCTP_SHUTDOWN_ACK) {
4677 			if (vtag_in != asoc->my_vtag) {
4678 				/*
4679 				 * this could be a stale SHUTDOWN-ACK or the
4680 				 * peer never got the SHUTDOWN-COMPLETE and
4681 				 * is still hung; we have started a new asoc
4682 				 * but it won't complete until the shutdown
4683 				 * is completed
4684 				 */
4685 				if (locked_tcb) {
4686 					SCTP_TCB_UNLOCK(locked_tcb);
4687 				}
4688 				snprintf(msg, sizeof(msg), "OOTB, %s:%d at %s", __FILE__, __LINE__, __func__);
4689 				op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
4690 				    msg);
4691 				sctp_handle_ootb(m, iphlen, *offset, src, dst,
4692 				    sh, inp, op_err,
4693 				    mflowtype, mflowid, fibnum,
4694 				    vrf_id, port);
4695 				return (NULL);
4696 			}
4697 		} else {
4698 			/* for all other chunks, vtag must match */
4699 			if (vtag_in != asoc->my_vtag) {
4700 				/* invalid vtag... */
4701 				SCTPDBG(SCTP_DEBUG_INPUT3,
4702 				    "invalid vtag: %xh, expect %xh\n",
4703 				    vtag_in, asoc->my_vtag);
4704 				SCTP_STAT_INCR(sctps_badvtag);
4705 				if (locked_tcb) {
4706 					SCTP_TCB_UNLOCK(locked_tcb);
4707 				}
4708 				*offset = length;
4709 				return (NULL);
4710 			}
4711 		}
4712 	}			/* end if !SCTP_COOKIE_ECHO */
4713 	/*
4714 	 * process all control chunks...
4715 	 */
4716 	if (((ch->chunk_type == SCTP_SELECTIVE_ACK) ||
4717 	    (ch->chunk_type == SCTP_NR_SELECTIVE_ACK) ||
4718 	    (ch->chunk_type == SCTP_HEARTBEAT_REQUEST)) &&
4719 	    (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_ECHOED)) {
4720 		/* implied cookie-ack.. we must have lost the ack */
4721 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
4722 			sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
4723 			    stcb->asoc.overall_error_count,
4724 			    0,
4725 			    SCTP_FROM_SCTP_INPUT,
4726 			    __LINE__);
4727 		}
4728 		stcb->asoc.overall_error_count = 0;
4729 		sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb,
4730 		    *netp);
4731 	}
4732 process_control_chunks:
4733 	while (IS_SCTP_CONTROL(ch)) {
4734 		/* validate chunk length */
4735 		chk_length = ntohs(ch->chunk_length);
4736 		SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_process_control: processing a chunk type=%u, len=%u\n",
4737 		    ch->chunk_type, chk_length);
4738 		SCTP_LTRACE_CHK(inp, stcb, ch->chunk_type, chk_length);
4739 		if (chk_length < sizeof(*ch) ||
4740 		    (*offset + (int)chk_length) > length) {
4741 			*offset = length;
4742 			if (locked_tcb) {
4743 				SCTP_TCB_UNLOCK(locked_tcb);
4744 			}
4745 			return (NULL);
4746 		}
4747 		SCTP_STAT_INCR_COUNTER64(sctps_incontrolchunks);
4748 		/*
4749 		 * INIT-ACK only gets the init ack "header" portion only
4750 		 * because we don't have to process the peer's COOKIE. All
4751 		 * others get a complete chunk.
4752 		 */
4753 		if ((ch->chunk_type == SCTP_INITIATION_ACK) ||
4754 		    (ch->chunk_type == SCTP_INITIATION)) {
4755 			/* get an init-ack chunk */
4756 			ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
4757 			    sizeof(struct sctp_init_ack_chunk), chunk_buf);
4758 			if (ch == NULL) {
4759 				*offset = length;
4760 				if (locked_tcb) {
4761 					SCTP_TCB_UNLOCK(locked_tcb);
4762 				}
4763 				return (NULL);
4764 			}
4765 		} else {
4766 			/* For cookies and all other chunks. */
4767 			if (chk_length > sizeof(chunk_buf)) {
4768 				/*
4769 				 * use just the size of the chunk buffer so
4770 				 * the front part of our chunks fit in
4771 				 * contiguous space up to the chunk buffer
4772 				 * size (508 bytes). For chunks that need to
4773 				 * get more than that they must use the
4774 				 * sctp_m_getptr() function or other means
4775 				 * (e.g. know how to parse mbuf chains).
4776 				 * Cookies do this already.
4777 				 */
4778 				ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
4779 				    (sizeof(chunk_buf) - 4),
4780 				    chunk_buf);
4781 				if (ch == NULL) {
4782 					*offset = length;
4783 					if (locked_tcb) {
4784 						SCTP_TCB_UNLOCK(locked_tcb);
4785 					}
4786 					return (NULL);
4787 				}
4788 			} else {
4789 				/* We can fit it all */
4790 				ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
4791 				    chk_length, chunk_buf);
4792 				if (ch == NULL) {
4793 					SCTP_PRINTF("sctp_process_control: Can't get the all data....\n");
4794 					*offset = length;
4795 					if (locked_tcb) {
4796 						SCTP_TCB_UNLOCK(locked_tcb);
4797 					}
4798 					return (NULL);
4799 				}
4800 			}
4801 		}
4802 		num_chunks++;
4803 		/* Save off the last place we got a control from */
4804 		if (stcb != NULL) {
4805 			if (((netp != NULL) && (*netp != NULL)) || (ch->chunk_type == SCTP_ASCONF)) {
4806 				/*
4807 				 * allow last_control to be NULL if
4808 				 * ASCONF... ASCONF processing will find the
4809 				 * right net later
4810 				 */
4811 				if ((netp != NULL) && (*netp != NULL))
4812 					stcb->asoc.last_control_chunk_from = *netp;
4813 			}
4814 		}
4815 #ifdef SCTP_AUDITING_ENABLED
4816 		sctp_audit_log(0xB0, ch->chunk_type);
4817 #endif
4818 
4819 		/* check to see if this chunk required auth, but isn't */
4820 		if ((stcb != NULL) &&
4821 		    (stcb->asoc.auth_supported == 1) &&
4822 		    sctp_auth_is_required_chunk(ch->chunk_type, stcb->asoc.local_auth_chunks) &&
4823 		    !stcb->asoc.authenticated) {
4824 			/* "silently" ignore */
4825 			SCTP_STAT_INCR(sctps_recvauthmissing);
4826 			goto next_chunk;
4827 		}
4828 		switch (ch->chunk_type) {
4829 		case SCTP_INITIATION:
4830 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_INIT\n");
4831 			/* The INIT chunk must be the only chunk. */
4832 			if ((num_chunks > 1) ||
4833 			    (length - *offset > (int)SCTP_SIZE32(chk_length))) {
4834 				/* RFC 4960 requires that no ABORT is sent */
4835 				*offset = length;
4836 				if (locked_tcb) {
4837 					SCTP_TCB_UNLOCK(locked_tcb);
4838 				}
4839 				return (NULL);
4840 			}
4841 			/* Honor our resource limit. */
4842 			if (chk_length > SCTP_LARGEST_INIT_ACCEPTED) {
4843 				op_err = sctp_generate_cause(SCTP_CAUSE_OUT_OF_RESC, "");
4844 				sctp_abort_association(inp, stcb, m, iphlen,
4845 				    src, dst, sh, op_err,
4846 				    mflowtype, mflowid,
4847 				    vrf_id, port);
4848 				*offset = length;
4849 				return (NULL);
4850 			}
4851 			sctp_handle_init(m, iphlen, *offset, src, dst, sh,
4852 			    (struct sctp_init_chunk *)ch, inp,
4853 			    stcb, *netp, &abort_no_unlock,
4854 			    mflowtype, mflowid,
4855 			    vrf_id, port);
4856 			*offset = length;
4857 			if ((!abort_no_unlock) && (locked_tcb)) {
4858 				SCTP_TCB_UNLOCK(locked_tcb);
4859 			}
4860 			return (NULL);
4861 			break;
4862 		case SCTP_PAD_CHUNK:
4863 			break;
4864 		case SCTP_INITIATION_ACK:
4865 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_INIT-ACK\n");
4866 			if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4867 				/* We are not interested anymore */
4868 				if ((stcb) && (stcb->asoc.total_output_queue_size)) {
4869 					;
4870 				} else {
4871 					if ((locked_tcb != NULL) && (locked_tcb != stcb)) {
4872 						/* Very unlikely */
4873 						SCTP_TCB_UNLOCK(locked_tcb);
4874 					}
4875 					*offset = length;
4876 					if (stcb) {
4877 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4878 						so = SCTP_INP_SO(inp);
4879 						atomic_add_int(&stcb->asoc.refcnt, 1);
4880 						SCTP_TCB_UNLOCK(stcb);
4881 						SCTP_SOCKET_LOCK(so, 1);
4882 						SCTP_TCB_LOCK(stcb);
4883 						atomic_subtract_int(&stcb->asoc.refcnt, 1);
4884 #endif
4885 						(void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
4886 						    SCTP_FROM_SCTP_INPUT + SCTP_LOC_29);
4887 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4888 						SCTP_SOCKET_UNLOCK(so, 1);
4889 #endif
4890 					}
4891 					return (NULL);
4892 				}
4893 			}
4894 			/* The INIT-ACK chunk must be the only chunk. */
4895 			if ((num_chunks > 1) ||
4896 			    (length - *offset > (int)SCTP_SIZE32(chk_length))) {
4897 				*offset = length;
4898 				if (locked_tcb) {
4899 					SCTP_TCB_UNLOCK(locked_tcb);
4900 				}
4901 				return (NULL);
4902 			}
4903 			if ((netp) && (*netp)) {
4904 				ret = sctp_handle_init_ack(m, iphlen, *offset,
4905 				    src, dst, sh,
4906 				    (struct sctp_init_ack_chunk *)ch,
4907 				    stcb, *netp,
4908 				    &abort_no_unlock,
4909 				    mflowtype, mflowid,
4910 				    vrf_id);
4911 			} else {
4912 				ret = -1;
4913 			}
4914 			*offset = length;
4915 			if (abort_no_unlock) {
4916 				return (NULL);
4917 			}
4918 			/*
4919 			 * Special case, I must call the output routine to
4920 			 * get the cookie echoed
4921 			 */
4922 			if ((stcb != NULL) && (ret == 0)) {
4923 				sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC, SCTP_SO_NOT_LOCKED);
4924 			}
4925 			if (locked_tcb) {
4926 				SCTP_TCB_UNLOCK(locked_tcb);
4927 			}
4928 			return (NULL);
4929 			break;
4930 		case SCTP_SELECTIVE_ACK:
4931 			{
4932 				struct sctp_sack_chunk *sack;
4933 				int abort_now = 0;
4934 				uint32_t a_rwnd, cum_ack;
4935 				uint16_t num_seg, num_dup;
4936 				uint8_t flags;
4937 				int offset_seg, offset_dup;
4938 
4939 				SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SACK\n");
4940 				SCTP_STAT_INCR(sctps_recvsacks);
4941 				if (stcb == NULL) {
4942 					SCTPDBG(SCTP_DEBUG_INDATA1, "No stcb when processing SACK chunk\n");
4943 					break;
4944 				}
4945 				if (chk_length < sizeof(struct sctp_sack_chunk)) {
4946 					SCTPDBG(SCTP_DEBUG_INDATA1, "Bad size on SACK chunk, too small\n");
4947 					break;
4948 				}
4949 				if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) {
4950 					/*-
4951 					 * If we have sent a shutdown-ack, we will pay no
4952 					 * attention to a sack sent in to us since
4953 					 * we don't care anymore.
4954 					 */
4955 					break;
4956 				}
4957 				sack = (struct sctp_sack_chunk *)ch;
4958 				flags = ch->chunk_flags;
4959 				cum_ack = ntohl(sack->sack.cum_tsn_ack);
4960 				num_seg = ntohs(sack->sack.num_gap_ack_blks);
4961 				num_dup = ntohs(sack->sack.num_dup_tsns);
4962 				a_rwnd = (uint32_t)ntohl(sack->sack.a_rwnd);
4963 				if (sizeof(struct sctp_sack_chunk) +
4964 				    num_seg * sizeof(struct sctp_gap_ack_block) +
4965 				    num_dup * sizeof(uint32_t) != chk_length) {
4966 					SCTPDBG(SCTP_DEBUG_INDATA1, "Bad size of SACK chunk\n");
4967 					break;
4968 				}
4969 				offset_seg = *offset + sizeof(struct sctp_sack_chunk);
4970 				offset_dup = offset_seg + num_seg * sizeof(struct sctp_gap_ack_block);
4971 				SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SACK process cum_ack:%x num_seg:%d a_rwnd:%d\n",
4972 				    cum_ack, num_seg, a_rwnd);
4973 				stcb->asoc.seen_a_sack_this_pkt = 1;
4974 				if ((stcb->asoc.pr_sctp_cnt == 0) &&
4975 				    (num_seg == 0) &&
4976 				    SCTP_TSN_GE(cum_ack, stcb->asoc.last_acked_seq) &&
4977 				    (stcb->asoc.saw_sack_with_frags == 0) &&
4978 				    (stcb->asoc.saw_sack_with_nr_frags == 0) &&
4979 				    (!TAILQ_EMPTY(&stcb->asoc.sent_queue))
4980 				    ) {
4981 					/*
4982 					 * We have a SIMPLE sack having no
4983 					 * prior segments and data on sent
4984 					 * queue to be acked.. Use the
4985 					 * faster path sack processing. We
4986 					 * also allow window update sacks
4987 					 * with no missing segments to go
4988 					 * this way too.
4989 					 */
4990 					sctp_express_handle_sack(stcb, cum_ack, a_rwnd, &abort_now, ecne_seen);
4991 				} else {
4992 					if (netp && *netp)
4993 						sctp_handle_sack(m, offset_seg, offset_dup, stcb,
4994 						    num_seg, 0, num_dup, &abort_now, flags,
4995 						    cum_ack, a_rwnd, ecne_seen);
4996 				}
4997 				if (abort_now) {
4998 					/* ABORT signal from sack processing */
4999 					*offset = length;
5000 					return (NULL);
5001 				}
5002 				if (TAILQ_EMPTY(&stcb->asoc.send_queue) &&
5003 				    TAILQ_EMPTY(&stcb->asoc.sent_queue) &&
5004 				    (stcb->asoc.stream_queue_cnt == 0)) {
5005 					sctp_ulp_notify(SCTP_NOTIFY_SENDER_DRY, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
5006 				}
5007 			}
5008 			break;
5009 			/*
5010 			 * EY - nr_sack:  If the received chunk is an
5011 			 * nr_sack chunk
5012 			 */
5013 		case SCTP_NR_SELECTIVE_ACK:
5014 			{
5015 				struct sctp_nr_sack_chunk *nr_sack;
5016 				int abort_now = 0;
5017 				uint32_t a_rwnd, cum_ack;
5018 				uint16_t num_seg, num_nr_seg, num_dup;
5019 				uint8_t flags;
5020 				int offset_seg, offset_dup;
5021 
5022 				SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_NR_SACK\n");
5023 				SCTP_STAT_INCR(sctps_recvsacks);
5024 				if (stcb == NULL) {
5025 					SCTPDBG(SCTP_DEBUG_INDATA1, "No stcb when processing NR-SACK chunk\n");
5026 					break;
5027 				}
5028 				if (stcb->asoc.nrsack_supported == 0) {
5029 					goto unknown_chunk;
5030 				}
5031 				if (chk_length < sizeof(struct sctp_nr_sack_chunk)) {
5032 					SCTPDBG(SCTP_DEBUG_INDATA1, "Bad size on NR-SACK chunk, too small\n");
5033 					break;
5034 				}
5035 				if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) {
5036 					/*-
5037 					 * If we have sent a shutdown-ack, we will pay no
5038 					 * attention to a sack sent in to us since
5039 					 * we don't care anymore.
5040 					 */
5041 					break;
5042 				}
5043 				nr_sack = (struct sctp_nr_sack_chunk *)ch;
5044 				flags = ch->chunk_flags;
5045 				cum_ack = ntohl(nr_sack->nr_sack.cum_tsn_ack);
5046 				num_seg = ntohs(nr_sack->nr_sack.num_gap_ack_blks);
5047 				num_nr_seg = ntohs(nr_sack->nr_sack.num_nr_gap_ack_blks);
5048 				num_dup = ntohs(nr_sack->nr_sack.num_dup_tsns);
5049 				a_rwnd = (uint32_t)ntohl(nr_sack->nr_sack.a_rwnd);
5050 				if (sizeof(struct sctp_nr_sack_chunk) +
5051 				    (num_seg + num_nr_seg) * sizeof(struct sctp_gap_ack_block) +
5052 				    num_dup * sizeof(uint32_t) != chk_length) {
5053 					SCTPDBG(SCTP_DEBUG_INDATA1, "Bad size of NR_SACK chunk\n");
5054 					break;
5055 				}
5056 				offset_seg = *offset + sizeof(struct sctp_nr_sack_chunk);
5057 				offset_dup = offset_seg + num_seg * sizeof(struct sctp_gap_ack_block);
5058 				SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_NR_SACK process cum_ack:%x num_seg:%d a_rwnd:%d\n",
5059 				    cum_ack, num_seg, a_rwnd);
5060 				stcb->asoc.seen_a_sack_this_pkt = 1;
5061 				if ((stcb->asoc.pr_sctp_cnt == 0) &&
5062 				    (num_seg == 0) && (num_nr_seg == 0) &&
5063 				    SCTP_TSN_GE(cum_ack, stcb->asoc.last_acked_seq) &&
5064 				    (stcb->asoc.saw_sack_with_frags == 0) &&
5065 				    (stcb->asoc.saw_sack_with_nr_frags == 0) &&
5066 				    (!TAILQ_EMPTY(&stcb->asoc.sent_queue))) {
5067 					/*
5068 					 * We have a SIMPLE sack having no
5069 					 * prior segments and data on sent
5070 					 * queue to be acked. Use the faster
5071 					 * path sack processing. We also
5072 					 * allow window update sacks with no
5073 					 * missing segments to go this way
5074 					 * too.
5075 					 */
5076 					sctp_express_handle_sack(stcb, cum_ack, a_rwnd,
5077 					    &abort_now, ecne_seen);
5078 				} else {
5079 					if (netp && *netp)
5080 						sctp_handle_sack(m, offset_seg, offset_dup, stcb,
5081 						    num_seg, num_nr_seg, num_dup, &abort_now, flags,
5082 						    cum_ack, a_rwnd, ecne_seen);
5083 				}
5084 				if (abort_now) {
5085 					/* ABORT signal from sack processing */
5086 					*offset = length;
5087 					return (NULL);
5088 				}
5089 				if (TAILQ_EMPTY(&stcb->asoc.send_queue) &&
5090 				    TAILQ_EMPTY(&stcb->asoc.sent_queue) &&
5091 				    (stcb->asoc.stream_queue_cnt == 0)) {
5092 					sctp_ulp_notify(SCTP_NOTIFY_SENDER_DRY, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
5093 				}
5094 			}
5095 			break;
5096 
5097 		case SCTP_HEARTBEAT_REQUEST:
5098 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_HEARTBEAT\n");
5099 			if ((stcb) && netp && *netp) {
5100 				SCTP_STAT_INCR(sctps_recvheartbeat);
5101 				sctp_send_heartbeat_ack(stcb, m, *offset,
5102 				    chk_length, *netp);
5103 
5104 				/* He's alive so give him credit */
5105 				if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
5106 					sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
5107 					    stcb->asoc.overall_error_count,
5108 					    0,
5109 					    SCTP_FROM_SCTP_INPUT,
5110 					    __LINE__);
5111 				}
5112 				stcb->asoc.overall_error_count = 0;
5113 			}
5114 			break;
5115 		case SCTP_HEARTBEAT_ACK:
5116 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_HEARTBEAT-ACK\n");
5117 			if ((stcb == NULL) || (chk_length != sizeof(struct sctp_heartbeat_chunk))) {
5118 				/* Its not ours */
5119 				*offset = length;
5120 				if (locked_tcb) {
5121 					SCTP_TCB_UNLOCK(locked_tcb);
5122 				}
5123 				return (NULL);
5124 			}
5125 			/* He's alive so give him credit */
5126 			if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
5127 				sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
5128 				    stcb->asoc.overall_error_count,
5129 				    0,
5130 				    SCTP_FROM_SCTP_INPUT,
5131 				    __LINE__);
5132 			}
5133 			stcb->asoc.overall_error_count = 0;
5134 			SCTP_STAT_INCR(sctps_recvheartbeatack);
5135 			if (netp && *netp)
5136 				sctp_handle_heartbeat_ack((struct sctp_heartbeat_chunk *)ch,
5137 				    stcb, *netp);
5138 			break;
5139 		case SCTP_ABORT_ASSOCIATION:
5140 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ABORT, stcb %p\n",
5141 			    (void *)stcb);
5142 			if ((stcb) && netp && *netp)
5143 				sctp_handle_abort((struct sctp_abort_chunk *)ch,
5144 				    stcb, *netp);
5145 			*offset = length;
5146 			return (NULL);
5147 			break;
5148 		case SCTP_SHUTDOWN:
5149 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SHUTDOWN, stcb %p\n",
5150 			    (void *)stcb);
5151 			if ((stcb == NULL) || (chk_length != sizeof(struct sctp_shutdown_chunk))) {
5152 				*offset = length;
5153 				if (locked_tcb) {
5154 					SCTP_TCB_UNLOCK(locked_tcb);
5155 				}
5156 				return (NULL);
5157 			}
5158 			if (netp && *netp) {
5159 				int abort_flag = 0;
5160 
5161 				sctp_handle_shutdown((struct sctp_shutdown_chunk *)ch,
5162 				    stcb, *netp, &abort_flag);
5163 				if (abort_flag) {
5164 					*offset = length;
5165 					return (NULL);
5166 				}
5167 			}
5168 			break;
5169 		case SCTP_SHUTDOWN_ACK:
5170 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SHUTDOWN-ACK, stcb %p\n", (void *)stcb);
5171 			if ((stcb) && (netp) && (*netp))
5172 				sctp_handle_shutdown_ack((struct sctp_shutdown_ack_chunk *)ch, stcb, *netp);
5173 			*offset = length;
5174 			return (NULL);
5175 			break;
5176 
5177 		case SCTP_OPERATION_ERROR:
5178 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_OP-ERR\n");
5179 			if ((stcb) && netp && *netp && sctp_handle_error(ch, stcb, *netp) < 0) {
5180 				*offset = length;
5181 				return (NULL);
5182 			}
5183 			break;
5184 		case SCTP_COOKIE_ECHO:
5185 			SCTPDBG(SCTP_DEBUG_INPUT3,
5186 			    "SCTP_COOKIE-ECHO, stcb %p\n", (void *)stcb);
5187 			if ((stcb) && (stcb->asoc.total_output_queue_size)) {
5188 				;
5189 			} else {
5190 				if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
5191 					/* We are not interested anymore */
5192 			abend:
5193 					if (stcb) {
5194 						SCTP_TCB_UNLOCK(stcb);
5195 					}
5196 					*offset = length;
5197 					return (NULL);
5198 				}
5199 			}
5200 			/*
5201 			 * First are we accepting? We do this again here
5202 			 * since it is possible that a previous endpoint WAS
5203 			 * listening responded to a INIT-ACK and then
5204 			 * closed. We opened and bound.. and are now no
5205 			 * longer listening.
5206 			 */
5207 
5208 			if ((stcb == NULL) && (inp->sctp_socket->so_qlen >= inp->sctp_socket->so_qlimit)) {
5209 				if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
5210 				    (SCTP_BASE_SYSCTL(sctp_abort_if_one_2_one_hits_limit))) {
5211 					op_err = sctp_generate_cause(SCTP_CAUSE_OUT_OF_RESC, "");
5212 					sctp_abort_association(inp, stcb, m, iphlen,
5213 					    src, dst, sh, op_err,
5214 					    mflowtype, mflowid,
5215 					    vrf_id, port);
5216 				}
5217 				*offset = length;
5218 				return (NULL);
5219 			} else {
5220 				struct mbuf *ret_buf;
5221 				struct sctp_inpcb *linp;
5222 
5223 				if (stcb) {
5224 					linp = NULL;
5225 				} else {
5226 					linp = inp;
5227 				}
5228 
5229 				if (linp) {
5230 					SCTP_ASOC_CREATE_LOCK(linp);
5231 					if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
5232 					    (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
5233 						SCTP_ASOC_CREATE_UNLOCK(linp);
5234 						goto abend;
5235 					}
5236 				}
5237 				if (netp) {
5238 					ret_buf =
5239 					    sctp_handle_cookie_echo(m, iphlen,
5240 					    *offset,
5241 					    src, dst,
5242 					    sh,
5243 					    (struct sctp_cookie_echo_chunk *)ch,
5244 					    &inp, &stcb, netp,
5245 					    auth_skipped,
5246 					    auth_offset,
5247 					    auth_len,
5248 					    &locked_tcb,
5249 					    mflowtype,
5250 					    mflowid,
5251 					    vrf_id,
5252 					    port);
5253 				} else {
5254 					ret_buf = NULL;
5255 				}
5256 				if (linp) {
5257 					SCTP_ASOC_CREATE_UNLOCK(linp);
5258 				}
5259 				if (ret_buf == NULL) {
5260 					if (locked_tcb) {
5261 						SCTP_TCB_UNLOCK(locked_tcb);
5262 					}
5263 					SCTPDBG(SCTP_DEBUG_INPUT3,
5264 					    "GAK, null buffer\n");
5265 					*offset = length;
5266 					return (NULL);
5267 				}
5268 				/* if AUTH skipped, see if it verified... */
5269 				if (auth_skipped) {
5270 					got_auth = 1;
5271 					auth_skipped = 0;
5272 				}
5273 				if (!TAILQ_EMPTY(&stcb->asoc.sent_queue)) {
5274 					/*
5275 					 * Restart the timer if we have
5276 					 * pending data
5277 					 */
5278 					struct sctp_tmit_chunk *chk;
5279 
5280 					chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
5281 					sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, chk->whoTo);
5282 				}
5283 			}
5284 			break;
5285 		case SCTP_COOKIE_ACK:
5286 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_COOKIE-ACK, stcb %p\n", (void *)stcb);
5287 			if ((stcb == NULL) || chk_length != sizeof(struct sctp_cookie_ack_chunk)) {
5288 				if (locked_tcb) {
5289 					SCTP_TCB_UNLOCK(locked_tcb);
5290 				}
5291 				return (NULL);
5292 			}
5293 			if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
5294 				/* We are not interested anymore */
5295 				if ((stcb) && (stcb->asoc.total_output_queue_size)) {
5296 					;
5297 				} else if (stcb) {
5298 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
5299 					so = SCTP_INP_SO(inp);
5300 					atomic_add_int(&stcb->asoc.refcnt, 1);
5301 					SCTP_TCB_UNLOCK(stcb);
5302 					SCTP_SOCKET_LOCK(so, 1);
5303 					SCTP_TCB_LOCK(stcb);
5304 					atomic_subtract_int(&stcb->asoc.refcnt, 1);
5305 #endif
5306 					(void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
5307 					    SCTP_FROM_SCTP_INPUT + SCTP_LOC_30);
5308 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
5309 					SCTP_SOCKET_UNLOCK(so, 1);
5310 #endif
5311 					*offset = length;
5312 					return (NULL);
5313 				}
5314 			}
5315 			/* He's alive so give him credit */
5316 			if ((stcb) && netp && *netp) {
5317 				if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
5318 					sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
5319 					    stcb->asoc.overall_error_count,
5320 					    0,
5321 					    SCTP_FROM_SCTP_INPUT,
5322 					    __LINE__);
5323 				}
5324 				stcb->asoc.overall_error_count = 0;
5325 				sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb, *netp);
5326 			}
5327 			break;
5328 		case SCTP_ECN_ECHO:
5329 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ECN-ECHO\n");
5330 			/* He's alive so give him credit */
5331 			if ((stcb == NULL) || (chk_length != sizeof(struct sctp_ecne_chunk))) {
5332 				/* Its not ours */
5333 				if (locked_tcb) {
5334 					SCTP_TCB_UNLOCK(locked_tcb);
5335 				}
5336 				*offset = length;
5337 				return (NULL);
5338 			}
5339 			if (stcb) {
5340 				if (stcb->asoc.ecn_supported == 0) {
5341 					goto unknown_chunk;
5342 				}
5343 				if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
5344 					sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
5345 					    stcb->asoc.overall_error_count,
5346 					    0,
5347 					    SCTP_FROM_SCTP_INPUT,
5348 					    __LINE__);
5349 				}
5350 				stcb->asoc.overall_error_count = 0;
5351 				sctp_handle_ecn_echo((struct sctp_ecne_chunk *)ch,
5352 				    stcb);
5353 				ecne_seen = 1;
5354 			}
5355 			break;
5356 		case SCTP_ECN_CWR:
5357 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ECN-CWR\n");
5358 			/* He's alive so give him credit */
5359 			if ((stcb == NULL) || (chk_length != sizeof(struct sctp_cwr_chunk))) {
5360 				/* Its not ours */
5361 				if (locked_tcb) {
5362 					SCTP_TCB_UNLOCK(locked_tcb);
5363 				}
5364 				*offset = length;
5365 				return (NULL);
5366 			}
5367 			if (stcb) {
5368 				if (stcb->asoc.ecn_supported == 0) {
5369 					goto unknown_chunk;
5370 				}
5371 				if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
5372 					sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
5373 					    stcb->asoc.overall_error_count,
5374 					    0,
5375 					    SCTP_FROM_SCTP_INPUT,
5376 					    __LINE__);
5377 				}
5378 				stcb->asoc.overall_error_count = 0;
5379 				sctp_handle_ecn_cwr((struct sctp_cwr_chunk *)ch, stcb, *netp);
5380 			}
5381 			break;
5382 		case SCTP_SHUTDOWN_COMPLETE:
5383 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SHUTDOWN-COMPLETE, stcb %p\n", (void *)stcb);
5384 			/* must be first and only chunk */
5385 			if ((num_chunks > 1) ||
5386 			    (length - *offset > (int)SCTP_SIZE32(chk_length))) {
5387 				*offset = length;
5388 				if (locked_tcb) {
5389 					SCTP_TCB_UNLOCK(locked_tcb);
5390 				}
5391 				return (NULL);
5392 			}
5393 			if ((stcb) && netp && *netp) {
5394 				sctp_handle_shutdown_complete((struct sctp_shutdown_complete_chunk *)ch,
5395 				    stcb, *netp);
5396 			}
5397 			*offset = length;
5398 			return (NULL);
5399 			break;
5400 		case SCTP_ASCONF:
5401 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ASCONF\n");
5402 			/* He's alive so give him credit */
5403 			if (stcb) {
5404 				if (stcb->asoc.asconf_supported == 0) {
5405 					goto unknown_chunk;
5406 				}
5407 				if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
5408 					sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
5409 					    stcb->asoc.overall_error_count,
5410 					    0,
5411 					    SCTP_FROM_SCTP_INPUT,
5412 					    __LINE__);
5413 				}
5414 				stcb->asoc.overall_error_count = 0;
5415 				sctp_handle_asconf(m, *offset, src,
5416 				    (struct sctp_asconf_chunk *)ch, stcb, asconf_cnt == 0);
5417 				asconf_cnt++;
5418 			}
5419 			break;
5420 		case SCTP_ASCONF_ACK:
5421 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ASCONF-ACK\n");
5422 			if (chk_length < sizeof(struct sctp_asconf_ack_chunk)) {
5423 				/* Its not ours */
5424 				if (locked_tcb) {
5425 					SCTP_TCB_UNLOCK(locked_tcb);
5426 				}
5427 				*offset = length;
5428 				return (NULL);
5429 			}
5430 			if ((stcb) && netp && *netp) {
5431 				if (stcb->asoc.asconf_supported == 0) {
5432 					goto unknown_chunk;
5433 				}
5434 				/* He's alive so give him credit */
5435 				if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
5436 					sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
5437 					    stcb->asoc.overall_error_count,
5438 					    0,
5439 					    SCTP_FROM_SCTP_INPUT,
5440 					    __LINE__);
5441 				}
5442 				stcb->asoc.overall_error_count = 0;
5443 				sctp_handle_asconf_ack(m, *offset,
5444 				    (struct sctp_asconf_ack_chunk *)ch, stcb, *netp, &abort_no_unlock);
5445 				if (abort_no_unlock)
5446 					return (NULL);
5447 			}
5448 			break;
5449 		case SCTP_FORWARD_CUM_TSN:
5450 		case SCTP_IFORWARD_CUM_TSN:
5451 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_FWD-TSN\n");
5452 			if (chk_length < sizeof(struct sctp_forward_tsn_chunk)) {
5453 				/* Its not ours */
5454 				if (locked_tcb) {
5455 					SCTP_TCB_UNLOCK(locked_tcb);
5456 				}
5457 				*offset = length;
5458 				return (NULL);
5459 			}
5460 			/* He's alive so give him credit */
5461 			if (stcb) {
5462 				int abort_flag = 0;
5463 
5464 				if (stcb->asoc.prsctp_supported == 0) {
5465 					goto unknown_chunk;
5466 				}
5467 				stcb->asoc.overall_error_count = 0;
5468 				if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
5469 					sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
5470 					    stcb->asoc.overall_error_count,
5471 					    0,
5472 					    SCTP_FROM_SCTP_INPUT,
5473 					    __LINE__);
5474 				}
5475 				*fwd_tsn_seen = 1;
5476 				if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
5477 					/* We are not interested anymore */
5478 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
5479 					so = SCTP_INP_SO(inp);
5480 					atomic_add_int(&stcb->asoc.refcnt, 1);
5481 					SCTP_TCB_UNLOCK(stcb);
5482 					SCTP_SOCKET_LOCK(so, 1);
5483 					SCTP_TCB_LOCK(stcb);
5484 					atomic_subtract_int(&stcb->asoc.refcnt, 1);
5485 #endif
5486 					(void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
5487 					    SCTP_FROM_SCTP_INPUT + SCTP_LOC_31);
5488 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
5489 					SCTP_SOCKET_UNLOCK(so, 1);
5490 #endif
5491 					*offset = length;
5492 					return (NULL);
5493 				}
5494 				/*
5495 				 * For sending a SACK this looks like DATA
5496 				 * chunks.
5497 				 */
5498 				stcb->asoc.last_data_chunk_from = stcb->asoc.last_control_chunk_from;
5499 				sctp_handle_forward_tsn(stcb,
5500 				    (struct sctp_forward_tsn_chunk *)ch, &abort_flag, m, *offset);
5501 				if (abort_flag) {
5502 					*offset = length;
5503 					return (NULL);
5504 				} else {
5505 					if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
5506 						sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
5507 						    stcb->asoc.overall_error_count,
5508 						    0,
5509 						    SCTP_FROM_SCTP_INPUT,
5510 						    __LINE__);
5511 					}
5512 					stcb->asoc.overall_error_count = 0;
5513 				}
5514 
5515 			}
5516 			break;
5517 		case SCTP_STREAM_RESET:
5518 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_STREAM_RESET\n");
5519 			if (((stcb == NULL) || (ch == NULL) || (chk_length < sizeof(struct sctp_stream_reset_tsn_req)))) {
5520 				/* Its not ours */
5521 				if (locked_tcb) {
5522 					SCTP_TCB_UNLOCK(locked_tcb);
5523 				}
5524 				*offset = length;
5525 				return (NULL);
5526 			}
5527 			if (stcb->asoc.reconfig_supported == 0) {
5528 				goto unknown_chunk;
5529 			}
5530 			if (sctp_handle_stream_reset(stcb, m, *offset, ch)) {
5531 				/* stop processing */
5532 				*offset = length;
5533 				return (NULL);
5534 			}
5535 			break;
5536 		case SCTP_PACKET_DROPPED:
5537 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_PACKET_DROPPED\n");
5538 			/* re-get it all please */
5539 			if (chk_length < sizeof(struct sctp_pktdrop_chunk)) {
5540 				/* Its not ours */
5541 				if (locked_tcb) {
5542 					SCTP_TCB_UNLOCK(locked_tcb);
5543 				}
5544 				*offset = length;
5545 				return (NULL);
5546 			}
5547 			if (ch && (stcb) && netp && (*netp)) {
5548 				if (stcb->asoc.pktdrop_supported == 0) {
5549 					goto unknown_chunk;
5550 				}
5551 				sctp_handle_packet_dropped((struct sctp_pktdrop_chunk *)ch,
5552 				    stcb, *netp,
5553 				    min(chk_length, (sizeof(chunk_buf) - 4)));
5554 
5555 			}
5556 			break;
5557 		case SCTP_AUTHENTICATION:
5558 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_AUTHENTICATION\n");
5559 			if (stcb == NULL) {
5560 				/* save the first AUTH for later processing */
5561 				if (auth_skipped == 0) {
5562 					auth_offset = *offset;
5563 					auth_len = chk_length;
5564 					auth_skipped = 1;
5565 				}
5566 				/* skip this chunk (temporarily) */
5567 				goto next_chunk;
5568 			}
5569 			if (stcb->asoc.auth_supported == 0) {
5570 				goto unknown_chunk;
5571 			}
5572 			if ((chk_length < (sizeof(struct sctp_auth_chunk))) ||
5573 			    (chk_length > (sizeof(struct sctp_auth_chunk) +
5574 			    SCTP_AUTH_DIGEST_LEN_MAX))) {
5575 				/* Its not ours */
5576 				if (locked_tcb) {
5577 					SCTP_TCB_UNLOCK(locked_tcb);
5578 				}
5579 				*offset = length;
5580 				return (NULL);
5581 			}
5582 			if (got_auth == 1) {
5583 				/* skip this chunk... it's already auth'd */
5584 				goto next_chunk;
5585 			}
5586 			got_auth = 1;
5587 			if ((ch == NULL) || sctp_handle_auth(stcb, (struct sctp_auth_chunk *)ch,
5588 			    m, *offset)) {
5589 				/* auth HMAC failed so dump the packet */
5590 				*offset = length;
5591 				return (stcb);
5592 			} else {
5593 				/* remaining chunks are HMAC checked */
5594 				stcb->asoc.authenticated = 1;
5595 			}
5596 			break;
5597 
5598 		default:
5599 	unknown_chunk:
5600 			/* it's an unknown chunk! */
5601 			if ((ch->chunk_type & 0x40) && (stcb != NULL)) {
5602 				struct sctp_gen_error_cause *cause;
5603 				int len;
5604 
5605 				op_err = sctp_get_mbuf_for_msg(sizeof(struct sctp_gen_error_cause),
5606 				    0, M_NOWAIT, 1, MT_DATA);
5607 				if (op_err != NULL) {
5608 					len = min(SCTP_SIZE32(chk_length), (uint32_t)(length - *offset));
5609 					cause = mtod(op_err, struct sctp_gen_error_cause *);
5610 					cause->code = htons(SCTP_CAUSE_UNRECOG_CHUNK);
5611 					cause->length = htons((uint16_t)(len + sizeof(struct sctp_gen_error_cause)));
5612 					SCTP_BUF_LEN(op_err) = sizeof(struct sctp_gen_error_cause);
5613 					SCTP_BUF_NEXT(op_err) = SCTP_M_COPYM(m, *offset, len, M_NOWAIT);
5614 					if (SCTP_BUF_NEXT(op_err) != NULL) {
5615 #ifdef SCTP_MBUF_LOGGING
5616 						if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
5617 							sctp_log_mbc(SCTP_BUF_NEXT(op_err), SCTP_MBUF_ICOPY);
5618 						}
5619 #endif
5620 						sctp_queue_op_err(stcb, op_err);
5621 					} else {
5622 						sctp_m_freem(op_err);
5623 					}
5624 				}
5625 			}
5626 			if ((ch->chunk_type & 0x80) == 0) {
5627 				/* discard this packet */
5628 				*offset = length;
5629 				return (stcb);
5630 			}	/* else skip this bad chunk and continue... */
5631 			break;
5632 		}		/* switch (ch->chunk_type) */
5633 
5634 
5635 next_chunk:
5636 		/* get the next chunk */
5637 		*offset += SCTP_SIZE32(chk_length);
5638 		if (*offset >= length) {
5639 			/* no more data left in the mbuf chain */
5640 			break;
5641 		}
5642 		ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
5643 		    sizeof(struct sctp_chunkhdr), chunk_buf);
5644 		if (ch == NULL) {
5645 			if (locked_tcb) {
5646 				SCTP_TCB_UNLOCK(locked_tcb);
5647 			}
5648 			*offset = length;
5649 			return (NULL);
5650 		}
5651 	}			/* while */
5652 
5653 	if (asconf_cnt > 0 && stcb != NULL) {
5654 		sctp_send_asconf_ack(stcb);
5655 	}
5656 	return (stcb);
5657 }
5658 
5659 
5660 /*
5661  * common input chunk processing (v4 and v6)
5662  */
5663 void
5664 sctp_common_input_processing(struct mbuf **mm, int iphlen, int offset, int length,
5665     struct sockaddr *src, struct sockaddr *dst,
5666     struct sctphdr *sh, struct sctp_chunkhdr *ch,
5667 #if !defined(SCTP_WITH_NO_CSUM)
5668     uint8_t compute_crc,
5669 #endif
5670     uint8_t ecn_bits,
5671     uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum,
5672     uint32_t vrf_id, uint16_t port)
5673 {
5674 	uint32_t high_tsn;
5675 	int fwd_tsn_seen = 0, data_processed = 0;
5676 	struct mbuf *m = *mm, *op_err;
5677 	char msg[SCTP_DIAG_INFO_LEN];
5678 	int un_sent;
5679 	int cnt_ctrl_ready = 0;
5680 	struct sctp_inpcb *inp = NULL, *inp_decr = NULL;
5681 	struct sctp_tcb *stcb = NULL;
5682 	struct sctp_nets *net = NULL;
5683 
5684 	SCTP_STAT_INCR(sctps_recvdatagrams);
5685 #ifdef SCTP_AUDITING_ENABLED
5686 	sctp_audit_log(0xE0, 1);
5687 	sctp_auditing(0, inp, stcb, net);
5688 #endif
5689 #if !defined(SCTP_WITH_NO_CSUM)
5690 	if (compute_crc != 0) {
5691 		uint32_t check, calc_check;
5692 
5693 		check = sh->checksum;
5694 		sh->checksum = 0;
5695 		calc_check = sctp_calculate_cksum(m, iphlen);
5696 		sh->checksum = check;
5697 		if (calc_check != check) {
5698 			SCTPDBG(SCTP_DEBUG_INPUT1, "Bad CSUM on SCTP packet calc_check:%x check:%x  m:%p mlen:%d iphlen:%d\n",
5699 			    calc_check, check, (void *)m, length, iphlen);
5700 			stcb = sctp_findassociation_addr(m, offset, src, dst,
5701 			    sh, ch, &inp, &net, vrf_id);
5702 #if defined(INET) || defined(INET6)
5703 			if ((ch->chunk_type != SCTP_INITIATION) &&
5704 			    (net != NULL) && (net->port != port)) {
5705 				if (net->port == 0) {
5706 					/* UDP encapsulation turned on. */
5707 					net->mtu -= sizeof(struct udphdr);
5708 					if (stcb->asoc.smallest_mtu > net->mtu) {
5709 						sctp_pathmtu_adjustment(stcb, net->mtu);
5710 					}
5711 				} else if (port == 0) {
5712 					/* UDP encapsulation turned off. */
5713 					net->mtu += sizeof(struct udphdr);
5714 					/* XXX Update smallest_mtu */
5715 				}
5716 				net->port = port;
5717 			}
5718 #endif
5719 			if (net != NULL) {
5720 				net->flowtype = mflowtype;
5721 				net->flowid = mflowid;
5722 			}
5723 			if ((inp != NULL) && (stcb != NULL)) {
5724 				sctp_send_packet_dropped(stcb, net, m, length, iphlen, 1);
5725 				sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_INPUT_ERROR, SCTP_SO_NOT_LOCKED);
5726 			} else if ((inp != NULL) && (stcb == NULL)) {
5727 				inp_decr = inp;
5728 			}
5729 			SCTP_STAT_INCR(sctps_badsum);
5730 			SCTP_STAT_INCR_COUNTER32(sctps_checksumerrors);
5731 			goto out;
5732 		}
5733 	}
5734 #endif
5735 	/* Destination port of 0 is illegal, based on RFC4960. */
5736 	if (sh->dest_port == 0) {
5737 		SCTP_STAT_INCR(sctps_hdrops);
5738 		goto out;
5739 	}
5740 	stcb = sctp_findassociation_addr(m, offset, src, dst,
5741 	    sh, ch, &inp, &net, vrf_id);
5742 #if defined(INET) || defined(INET6)
5743 	if ((ch->chunk_type != SCTP_INITIATION) &&
5744 	    (net != NULL) && (net->port != port)) {
5745 		if (net->port == 0) {
5746 			/* UDP encapsulation turned on. */
5747 			net->mtu -= sizeof(struct udphdr);
5748 			if (stcb->asoc.smallest_mtu > net->mtu) {
5749 				sctp_pathmtu_adjustment(stcb, net->mtu);
5750 			}
5751 		} else if (port == 0) {
5752 			/* UDP encapsulation turned off. */
5753 			net->mtu += sizeof(struct udphdr);
5754 			/* XXX Update smallest_mtu */
5755 		}
5756 		net->port = port;
5757 	}
5758 #endif
5759 	if (net != NULL) {
5760 		net->flowtype = mflowtype;
5761 		net->flowid = mflowid;
5762 	}
5763 	if (inp == NULL) {
5764 		SCTP_STAT_INCR(sctps_noport);
5765 		if (badport_bandlim(BANDLIM_SCTP_OOTB) < 0) {
5766 			goto out;
5767 		}
5768 		if (ch->chunk_type == SCTP_SHUTDOWN_ACK) {
5769 			sctp_send_shutdown_complete2(src, dst, sh,
5770 			    mflowtype, mflowid, fibnum,
5771 			    vrf_id, port);
5772 			goto out;
5773 		}
5774 		if (ch->chunk_type == SCTP_SHUTDOWN_COMPLETE) {
5775 			goto out;
5776 		}
5777 		if (ch->chunk_type != SCTP_ABORT_ASSOCIATION) {
5778 			if ((SCTP_BASE_SYSCTL(sctp_blackhole) == 0) ||
5779 			    ((SCTP_BASE_SYSCTL(sctp_blackhole) == 1) &&
5780 			    (ch->chunk_type != SCTP_INIT))) {
5781 				op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
5782 				    "Out of the blue");
5783 				sctp_send_abort(m, iphlen, src, dst,
5784 				    sh, 0, op_err,
5785 				    mflowtype, mflowid, fibnum,
5786 				    vrf_id, port);
5787 			}
5788 		}
5789 		goto out;
5790 	} else if (stcb == NULL) {
5791 		inp_decr = inp;
5792 	}
5793 	SCTPDBG(SCTP_DEBUG_INPUT1, "Ok, Common input processing called, m:%p iphlen:%d offset:%d length:%d stcb:%p\n",
5794 	    (void *)m, iphlen, offset, length, (void *)stcb);
5795 	if (stcb) {
5796 		/* always clear this before beginning a packet */
5797 		stcb->asoc.authenticated = 0;
5798 		stcb->asoc.seen_a_sack_this_pkt = 0;
5799 		SCTPDBG(SCTP_DEBUG_INPUT1, "stcb:%p state:%x\n",
5800 		    (void *)stcb, stcb->asoc.state);
5801 
5802 		if ((stcb->asoc.state & SCTP_STATE_WAS_ABORTED) ||
5803 		    (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED)) {
5804 			/*-
5805 			 * If we hit here, we had a ref count
5806 			 * up when the assoc was aborted and the
5807 			 * timer is clearing out the assoc, we should
5808 			 * NOT respond to any packet.. its OOTB.
5809 			 */
5810 			SCTP_TCB_UNLOCK(stcb);
5811 			stcb = NULL;
5812 			snprintf(msg, sizeof(msg), "OOTB, %s:%d at %s", __FILE__, __LINE__, __func__);
5813 			op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
5814 			    msg);
5815 			sctp_handle_ootb(m, iphlen, offset, src, dst, sh, inp, op_err,
5816 			    mflowtype, mflowid, inp->fibnum,
5817 			    vrf_id, port);
5818 			goto out;
5819 		}
5820 	}
5821 	if (IS_SCTP_CONTROL(ch)) {
5822 		/* process the control portion of the SCTP packet */
5823 		/* sa_ignore NO_NULL_CHK */
5824 		stcb = sctp_process_control(m, iphlen, &offset, length,
5825 		    src, dst, sh, ch,
5826 		    inp, stcb, &net, &fwd_tsn_seen,
5827 		    mflowtype, mflowid, fibnum,
5828 		    vrf_id, port);
5829 		if (stcb) {
5830 			/*
5831 			 * This covers us if the cookie-echo was there and
5832 			 * it changes our INP.
5833 			 */
5834 			inp = stcb->sctp_ep;
5835 #if defined(INET) || defined(INET6)
5836 			if ((ch->chunk_type != SCTP_INITIATION) &&
5837 			    (net != NULL) && (net->port != port)) {
5838 				if (net->port == 0) {
5839 					/* UDP encapsulation turned on. */
5840 					net->mtu -= sizeof(struct udphdr);
5841 					if (stcb->asoc.smallest_mtu > net->mtu) {
5842 						sctp_pathmtu_adjustment(stcb, net->mtu);
5843 					}
5844 				} else if (port == 0) {
5845 					/* UDP encapsulation turned off. */
5846 					net->mtu += sizeof(struct udphdr);
5847 					/* XXX Update smallest_mtu */
5848 				}
5849 				net->port = port;
5850 			}
5851 #endif
5852 		}
5853 	} else {
5854 		/*
5855 		 * no control chunks, so pre-process DATA chunks (these
5856 		 * checks are taken care of by control processing)
5857 		 */
5858 
5859 		/*
5860 		 * if DATA only packet, and auth is required, then punt...
5861 		 * can't have authenticated without any AUTH (control)
5862 		 * chunks
5863 		 */
5864 		if ((stcb != NULL) &&
5865 		    (stcb->asoc.auth_supported == 1) &&
5866 		    sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.local_auth_chunks)) {
5867 			/* "silently" ignore */
5868 			SCTP_STAT_INCR(sctps_recvauthmissing);
5869 			goto out;
5870 		}
5871 		if (stcb == NULL) {
5872 			/* out of the blue DATA chunk */
5873 			snprintf(msg, sizeof(msg), "OOTB, %s:%d at %s", __FILE__, __LINE__, __func__);
5874 			op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
5875 			    msg);
5876 			sctp_handle_ootb(m, iphlen, offset, src, dst, sh, inp, op_err,
5877 			    mflowtype, mflowid, fibnum,
5878 			    vrf_id, port);
5879 			goto out;
5880 		}
5881 		if (stcb->asoc.my_vtag != ntohl(sh->v_tag)) {
5882 			/* v_tag mismatch! */
5883 			SCTP_STAT_INCR(sctps_badvtag);
5884 			goto out;
5885 		}
5886 	}
5887 
5888 	if (stcb == NULL) {
5889 		/*
5890 		 * no valid TCB for this packet, or we found it's a bad
5891 		 * packet while processing control, or we're done with this
5892 		 * packet (done or skip rest of data), so we drop it...
5893 		 */
5894 		goto out;
5895 	}
5896 	/*
5897 	 * DATA chunk processing
5898 	 */
5899 	/* plow through the data chunks while length > offset */
5900 
5901 	/*
5902 	 * Rest should be DATA only.  Check authentication state if AUTH for
5903 	 * DATA is required.
5904 	 */
5905 	if ((length > offset) &&
5906 	    (stcb != NULL) &&
5907 	    (stcb->asoc.auth_supported == 1) &&
5908 	    sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.local_auth_chunks) &&
5909 	    !stcb->asoc.authenticated) {
5910 		/* "silently" ignore */
5911 		SCTP_STAT_INCR(sctps_recvauthmissing);
5912 		SCTPDBG(SCTP_DEBUG_AUTH1,
5913 		    "Data chunk requires AUTH, skipped\n");
5914 		goto trigger_send;
5915 	}
5916 	if (length > offset) {
5917 		int retval;
5918 
5919 		/*
5920 		 * First check to make sure our state is correct. We would
5921 		 * not get here unless we really did have a tag, so we don't
5922 		 * abort if this happens, just dump the chunk silently.
5923 		 */
5924 		switch (SCTP_GET_STATE(&stcb->asoc)) {
5925 		case SCTP_STATE_COOKIE_ECHOED:
5926 			/*
5927 			 * we consider data with valid tags in this state
5928 			 * shows us the cookie-ack was lost. Imply it was
5929 			 * there.
5930 			 */
5931 			if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
5932 				sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
5933 				    stcb->asoc.overall_error_count,
5934 				    0,
5935 				    SCTP_FROM_SCTP_INPUT,
5936 				    __LINE__);
5937 			}
5938 			stcb->asoc.overall_error_count = 0;
5939 			sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb, net);
5940 			break;
5941 		case SCTP_STATE_COOKIE_WAIT:
5942 			/*
5943 			 * We consider OOTB any data sent during asoc setup.
5944 			 */
5945 			snprintf(msg, sizeof(msg), "OOTB, %s:%d at %s", __FILE__, __LINE__, __func__);
5946 			op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
5947 			    msg);
5948 			sctp_handle_ootb(m, iphlen, offset, src, dst, sh, inp, op_err,
5949 			    mflowtype, mflowid, inp->fibnum,
5950 			    vrf_id, port);
5951 			goto out;
5952 			/* sa_ignore NOTREACHED */
5953 			break;
5954 		case SCTP_STATE_EMPTY:	/* should not happen */
5955 		case SCTP_STATE_INUSE:	/* should not happen */
5956 		case SCTP_STATE_SHUTDOWN_RECEIVED:	/* This is a peer error */
5957 		case SCTP_STATE_SHUTDOWN_ACK_SENT:
5958 		default:
5959 			goto out;
5960 			/* sa_ignore NOTREACHED */
5961 			break;
5962 		case SCTP_STATE_OPEN:
5963 		case SCTP_STATE_SHUTDOWN_SENT:
5964 			break;
5965 		}
5966 		/* plow through the data chunks while length > offset */
5967 		retval = sctp_process_data(mm, iphlen, &offset, length,
5968 		    inp, stcb, net, &high_tsn);
5969 		if (retval == 2) {
5970 			/*
5971 			 * The association aborted, NO UNLOCK needed since
5972 			 * the association is destroyed.
5973 			 */
5974 			stcb = NULL;
5975 			goto out;
5976 		}
5977 		data_processed = 1;
5978 		/*
5979 		 * Anything important needs to have been m_copy'ed in
5980 		 * process_data
5981 		 */
5982 	}
5983 	/* take care of ecn */
5984 	if ((data_processed == 1) &&
5985 	    (stcb->asoc.ecn_supported == 1) &&
5986 	    ((ecn_bits & SCTP_CE_BITS) == SCTP_CE_BITS)) {
5987 		/* Yep, we need to add a ECNE */
5988 		sctp_send_ecn_echo(stcb, net, high_tsn);
5989 	}
5990 	if ((data_processed == 0) && (fwd_tsn_seen)) {
5991 		int was_a_gap;
5992 		uint32_t highest_tsn;
5993 
5994 		if (SCTP_TSN_GT(stcb->asoc.highest_tsn_inside_nr_map, stcb->asoc.highest_tsn_inside_map)) {
5995 			highest_tsn = stcb->asoc.highest_tsn_inside_nr_map;
5996 		} else {
5997 			highest_tsn = stcb->asoc.highest_tsn_inside_map;
5998 		}
5999 		was_a_gap = SCTP_TSN_GT(highest_tsn, stcb->asoc.cumulative_tsn);
6000 		stcb->asoc.send_sack = 1;
6001 		sctp_sack_check(stcb, was_a_gap);
6002 	} else if (fwd_tsn_seen) {
6003 		stcb->asoc.send_sack = 1;
6004 	}
6005 	/* trigger send of any chunks in queue... */
6006 trigger_send:
6007 #ifdef SCTP_AUDITING_ENABLED
6008 	sctp_audit_log(0xE0, 2);
6009 	sctp_auditing(1, inp, stcb, net);
6010 #endif
6011 	SCTPDBG(SCTP_DEBUG_INPUT1,
6012 	    "Check for chunk output prw:%d tqe:%d tf=%d\n",
6013 	    stcb->asoc.peers_rwnd,
6014 	    TAILQ_EMPTY(&stcb->asoc.control_send_queue),
6015 	    stcb->asoc.total_flight);
6016 	un_sent = (stcb->asoc.total_output_queue_size - stcb->asoc.total_flight);
6017 	if (!TAILQ_EMPTY(&stcb->asoc.control_send_queue)) {
6018 		cnt_ctrl_ready = stcb->asoc.ctrl_queue_cnt - stcb->asoc.ecn_echo_cnt_onq;
6019 	}
6020 	if (!TAILQ_EMPTY(&stcb->asoc.asconf_send_queue) ||
6021 	    cnt_ctrl_ready ||
6022 	    stcb->asoc.trigger_reset ||
6023 	    ((un_sent) &&
6024 	    (stcb->asoc.peers_rwnd > 0 ||
6025 	    (stcb->asoc.peers_rwnd <= 0 && stcb->asoc.total_flight == 0)))) {
6026 		SCTPDBG(SCTP_DEBUG_INPUT3, "Calling chunk OUTPUT\n");
6027 		sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC, SCTP_SO_NOT_LOCKED);
6028 		SCTPDBG(SCTP_DEBUG_INPUT3, "chunk OUTPUT returns\n");
6029 	}
6030 #ifdef SCTP_AUDITING_ENABLED
6031 	sctp_audit_log(0xE0, 3);
6032 	sctp_auditing(2, inp, stcb, net);
6033 #endif
6034 out:
6035 	if (stcb != NULL) {
6036 		SCTP_TCB_UNLOCK(stcb);
6037 	}
6038 	if (inp_decr != NULL) {
6039 		/* reduce ref-count */
6040 		SCTP_INP_WLOCK(inp_decr);
6041 		SCTP_INP_DECR_REF(inp_decr);
6042 		SCTP_INP_WUNLOCK(inp_decr);
6043 	}
6044 	return;
6045 }
6046 
6047 #ifdef INET
6048 void
6049 sctp_input_with_port(struct mbuf *i_pak, int off, uint16_t port)
6050 {
6051 	struct mbuf *m;
6052 	int iphlen;
6053 	uint32_t vrf_id = 0;
6054 	uint8_t ecn_bits;
6055 	struct sockaddr_in src, dst;
6056 	struct ip *ip;
6057 	struct sctphdr *sh;
6058 	struct sctp_chunkhdr *ch;
6059 	int length, offset;
6060 #if !defined(SCTP_WITH_NO_CSUM)
6061 	uint8_t compute_crc;
6062 #endif
6063 	uint32_t mflowid;
6064 	uint8_t mflowtype;
6065 	uint16_t fibnum;
6066 
6067 	iphlen = off;
6068 	if (SCTP_GET_PKT_VRFID(i_pak, vrf_id)) {
6069 		SCTP_RELEASE_PKT(i_pak);
6070 		return;
6071 	}
6072 	m = SCTP_HEADER_TO_CHAIN(i_pak);
6073 #ifdef SCTP_MBUF_LOGGING
6074 	/* Log in any input mbufs */
6075 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
6076 		sctp_log_mbc(m, SCTP_MBUF_INPUT);
6077 	}
6078 #endif
6079 #ifdef SCTP_PACKET_LOGGING
6080 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING) {
6081 		sctp_packet_log(m);
6082 	}
6083 #endif
6084 	SCTPDBG(SCTP_DEBUG_CRCOFFLOAD,
6085 	    "sctp_input(): Packet of length %d received on %s with csum_flags 0x%b.\n",
6086 	    m->m_pkthdr.len,
6087 	    if_name(m->m_pkthdr.rcvif),
6088 	    (int)m->m_pkthdr.csum_flags, CSUM_BITS);
6089 	mflowid = m->m_pkthdr.flowid;
6090 	mflowtype = M_HASHTYPE_GET(m);
6091 	fibnum = M_GETFIB(m);
6092 	SCTP_STAT_INCR(sctps_recvpackets);
6093 	SCTP_STAT_INCR_COUNTER64(sctps_inpackets);
6094 	/* Get IP, SCTP, and first chunk header together in the first mbuf. */
6095 	offset = iphlen + sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr);
6096 	if (SCTP_BUF_LEN(m) < offset) {
6097 		if ((m = m_pullup(m, offset)) == NULL) {
6098 			SCTP_STAT_INCR(sctps_hdrops);
6099 			return;
6100 		}
6101 	}
6102 	ip = mtod(m, struct ip *);
6103 	sh = (struct sctphdr *)((caddr_t)ip + iphlen);
6104 	ch = (struct sctp_chunkhdr *)((caddr_t)sh + sizeof(struct sctphdr));
6105 	offset -= sizeof(struct sctp_chunkhdr);
6106 	memset(&src, 0, sizeof(struct sockaddr_in));
6107 	src.sin_family = AF_INET;
6108 	src.sin_len = sizeof(struct sockaddr_in);
6109 	src.sin_port = sh->src_port;
6110 	src.sin_addr = ip->ip_src;
6111 	memset(&dst, 0, sizeof(struct sockaddr_in));
6112 	dst.sin_family = AF_INET;
6113 	dst.sin_len = sizeof(struct sockaddr_in);
6114 	dst.sin_port = sh->dest_port;
6115 	dst.sin_addr = ip->ip_dst;
6116 	length = ntohs(ip->ip_len);
6117 	/* Validate mbuf chain length with IP payload length. */
6118 	if (SCTP_HEADER_LEN(m) != length) {
6119 		SCTPDBG(SCTP_DEBUG_INPUT1,
6120 		    "sctp_input() length:%d reported length:%d\n", length, SCTP_HEADER_LEN(m));
6121 		SCTP_STAT_INCR(sctps_hdrops);
6122 		goto out;
6123 	}
6124 	/* SCTP does not allow broadcasts or multicasts */
6125 	if (IN_MULTICAST(ntohl(dst.sin_addr.s_addr))) {
6126 		goto out;
6127 	}
6128 	if (SCTP_IS_IT_BROADCAST(dst.sin_addr, m)) {
6129 		goto out;
6130 	}
6131 	ecn_bits = ip->ip_tos;
6132 #if defined(SCTP_WITH_NO_CSUM)
6133 	SCTP_STAT_INCR(sctps_recvnocrc);
6134 #else
6135 	if (m->m_pkthdr.csum_flags & CSUM_SCTP_VALID) {
6136 		SCTP_STAT_INCR(sctps_recvhwcrc);
6137 		compute_crc = 0;
6138 	} else {
6139 		SCTP_STAT_INCR(sctps_recvswcrc);
6140 		compute_crc = 1;
6141 	}
6142 #endif
6143 	sctp_common_input_processing(&m, iphlen, offset, length,
6144 	    (struct sockaddr *)&src,
6145 	    (struct sockaddr *)&dst,
6146 	    sh, ch,
6147 #if !defined(SCTP_WITH_NO_CSUM)
6148 	    compute_crc,
6149 #endif
6150 	    ecn_bits,
6151 	    mflowtype, mflowid, fibnum,
6152 	    vrf_id, port);
6153 out:
6154 	if (m) {
6155 		sctp_m_freem(m);
6156 	}
6157 	return;
6158 }
6159 
6160 #if defined(__FreeBSD__) && defined(SCTP_MCORE_INPUT) && defined(SMP)
6161 extern int *sctp_cpuarry;
6162 #endif
6163 
6164 int
6165 sctp_input(struct mbuf **mp, int *offp, int proto SCTP_UNUSED)
6166 {
6167 	struct mbuf *m;
6168 	int off;
6169 
6170 	m = *mp;
6171 	off = *offp;
6172 #if defined(__FreeBSD__) && defined(SCTP_MCORE_INPUT) && defined(SMP)
6173 	if (mp_ncpus > 1) {
6174 		struct ip *ip;
6175 		struct sctphdr *sh;
6176 		int offset;
6177 		int cpu_to_use;
6178 		uint32_t flowid, tag;
6179 
6180 		if (M_HASHTYPE_GET(m) != M_HASHTYPE_NONE) {
6181 			flowid = m->m_pkthdr.flowid;
6182 		} else {
6183 			/*
6184 			 * No flow id built by lower layers fix it so we
6185 			 * create one.
6186 			 */
6187 			offset = off + sizeof(struct sctphdr);
6188 			if (SCTP_BUF_LEN(m) < offset) {
6189 				if ((m = m_pullup(m, offset)) == NULL) {
6190 					SCTP_STAT_INCR(sctps_hdrops);
6191 					return (IPPROTO_DONE);
6192 				}
6193 			}
6194 			ip = mtod(m, struct ip *);
6195 			sh = (struct sctphdr *)((caddr_t)ip + off);
6196 			tag = htonl(sh->v_tag);
6197 			flowid = tag ^ ntohs(sh->dest_port) ^ ntohs(sh->src_port);
6198 			m->m_pkthdr.flowid = flowid;
6199 			M_HASHTYPE_SET(m, M_HASHTYPE_OPAQUE_HASH);
6200 		}
6201 		cpu_to_use = sctp_cpuarry[flowid % mp_ncpus];
6202 		sctp_queue_to_mcore(m, off, cpu_to_use);
6203 		return (IPPROTO_DONE);
6204 	}
6205 #endif
6206 	sctp_input_with_port(m, off, 0);
6207 	return (IPPROTO_DONE);
6208 }
6209 #endif
6210