xref: /freebsd/sys/netinet/sctp_input.c (revision d198b8774d2cfb6f140893e1c6236af9e97d1497)
1 /*-
2  * SPDX-License-Identifier: BSD-3-Clause
3  *
4  * Copyright (c) 2001-2008, by Cisco Systems, Inc. All rights reserved.
5  * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved.
6  * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions are met:
10  *
11  * a) Redistributions of source code must retain the above copyright notice,
12  *    this list of conditions and the following disclaimer.
13  *
14  * b) Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in
16  *    the documentation and/or other materials provided with the distribution.
17  *
18  * c) Neither the name of Cisco Systems, Inc. nor the names of its
19  *    contributors may be used to endorse or promote products derived
20  *    from this software without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
23  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
24  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
26  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
27  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
28  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
29  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
30  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
31  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
32  * THE POSSIBILITY OF SUCH DAMAGE.
33  */
34 
35 #include <sys/cdefs.h>
36 __FBSDID("$FreeBSD$");
37 
38 #include <netinet/sctp_os.h>
39 #include <netinet/sctp_var.h>
40 #include <netinet/sctp_sysctl.h>
41 #include <netinet/sctp_pcb.h>
42 #include <netinet/sctp_header.h>
43 #include <netinet/sctputil.h>
44 #include <netinet/sctp_output.h>
45 #include <netinet/sctp_input.h>
46 #include <netinet/sctp_auth.h>
47 #include <netinet/sctp_indata.h>
48 #include <netinet/sctp_asconf.h>
49 #include <netinet/sctp_bsd_addr.h>
50 #include <netinet/sctp_timer.h>
51 #include <netinet/sctp_crc32.h>
52 #include <netinet/sctp_kdtrace.h>
53 #if defined(INET) || defined(INET6)
54 #include <netinet/udp.h>
55 #endif
56 #include <sys/smp.h>
57 
58 static void
59 sctp_stop_all_cookie_timers(struct sctp_tcb *stcb)
60 {
61 	struct sctp_nets *net;
62 
63 	/*
64 	 * This now not only stops all cookie timers it also stops any INIT
65 	 * timers as well. This will make sure that the timers are stopped
66 	 * in all collision cases.
67 	 */
68 	SCTP_TCB_LOCK_ASSERT(stcb);
69 	TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
70 		if (net->rxt_timer.type == SCTP_TIMER_TYPE_COOKIE) {
71 			sctp_timer_stop(SCTP_TIMER_TYPE_COOKIE,
72 			    stcb->sctp_ep,
73 			    stcb,
74 			    net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_1);
75 		} else if (net->rxt_timer.type == SCTP_TIMER_TYPE_INIT) {
76 			sctp_timer_stop(SCTP_TIMER_TYPE_INIT,
77 			    stcb->sctp_ep,
78 			    stcb,
79 			    net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_2);
80 		}
81 	}
82 }
83 
84 /* INIT handler */
85 static void
86 sctp_handle_init(struct mbuf *m, int iphlen, int offset,
87     struct sockaddr *src, struct sockaddr *dst, struct sctphdr *sh,
88     struct sctp_init_chunk *cp, struct sctp_inpcb *inp,
89     struct sctp_tcb *stcb, struct sctp_nets *net,
90     uint8_t mflowtype, uint32_t mflowid,
91     uint32_t vrf_id, uint16_t port)
92 {
93 	struct sctp_init *init;
94 	struct mbuf *op_err;
95 
96 	SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_init: handling INIT tcb:%p\n",
97 	    (void *)stcb);
98 	if (stcb == NULL) {
99 		SCTP_INP_RLOCK(inp);
100 	}
101 	/* Validate parameters */
102 	init = &cp->init;
103 	if (ntohl(init->initiate_tag) == 0) {
104 		goto outnow;
105 	}
106 	if ((ntohl(init->a_rwnd) < SCTP_MIN_RWND) ||
107 	    (ntohs(init->num_inbound_streams) == 0) ||
108 	    (ntohs(init->num_outbound_streams) == 0)) {
109 		/* protocol error... send abort */
110 		op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
111 		sctp_send_abort(m, iphlen, src, dst, sh, init->initiate_tag, op_err,
112 		    mflowtype, mflowid, inp->fibnum,
113 		    vrf_id, port);
114 		goto outnow;
115 	}
116 	if (sctp_validate_init_auth_params(m, offset + sizeof(*cp),
117 	    offset + ntohs(cp->ch.chunk_length))) {
118 		/* auth parameter(s) error... send abort */
119 		op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
120 		    "Problem with AUTH parameters");
121 		sctp_send_abort(m, iphlen, src, dst, sh, init->initiate_tag, op_err,
122 		    mflowtype, mflowid, inp->fibnum,
123 		    vrf_id, port);
124 		goto outnow;
125 	}
126 	/* We are only accepting if we have a listening socket. */
127 	if ((stcb == NULL) &&
128 	    ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
129 	    (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
130 	    (!SCTP_IS_LISTENING(inp)))) {
131 		/*
132 		 * FIX ME ?? What about TCP model and we have a
133 		 * match/restart case? Actually no fix is needed. the lookup
134 		 * will always find the existing assoc so stcb would not be
135 		 * NULL. It may be questionable to do this since we COULD
136 		 * just send back the INIT-ACK and hope that the app did
137 		 * accept()'s by the time the COOKIE was sent. But there is
138 		 * a price to pay for COOKIE generation and I don't want to
139 		 * pay it on the chance that the app will actually do some
140 		 * accepts(). The App just looses and should NOT be in this
141 		 * state :-)
142 		 */
143 		if (SCTP_BASE_SYSCTL(sctp_blackhole) == 0) {
144 			op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
145 			    "No listener");
146 			sctp_send_abort(m, iphlen, src, dst, sh, 0, op_err,
147 			    mflowtype, mflowid, inp->fibnum,
148 			    vrf_id, port);
149 		}
150 		goto outnow;
151 	}
152 	if ((stcb != NULL) &&
153 	    (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_ACK_SENT)) {
154 		SCTPDBG(SCTP_DEBUG_INPUT3, "sctp_handle_init: sending SHUTDOWN-ACK\n");
155 		sctp_send_shutdown_ack(stcb, NULL);
156 		sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC, SCTP_SO_NOT_LOCKED);
157 	} else {
158 		SCTPDBG(SCTP_DEBUG_INPUT3, "sctp_handle_init: sending INIT-ACK\n");
159 		sctp_send_initiate_ack(inp, stcb, net, m, iphlen, offset,
160 		    src, dst, sh, cp,
161 		    mflowtype, mflowid,
162 		    vrf_id, port);
163 	}
164 outnow:
165 	if (stcb == NULL) {
166 		SCTP_INP_RUNLOCK(inp);
167 	}
168 }
169 
170 /*
171  * process peer "INIT/INIT-ACK" chunk returns value < 0 on error
172  */
173 
174 int
175 sctp_is_there_unsent_data(struct sctp_tcb *stcb, int so_locked)
176 {
177 	int unsent_data;
178 	unsigned int i;
179 	struct sctp_stream_queue_pending *sp;
180 	struct sctp_association *asoc;
181 
182 	SCTP_TCB_LOCK_ASSERT(stcb);
183 
184 	/*
185 	 * This function returns if any stream has true unsent data on it.
186 	 * Note that as it looks through it will clean up any places that
187 	 * have old data that has been sent but left at top of stream queue.
188 	 */
189 	asoc = &stcb->asoc;
190 	unsent_data = 0;
191 	if (!stcb->asoc.ss_functions.sctp_ss_is_empty(stcb, asoc)) {
192 		/* Check to see if some data queued */
193 		for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
194 			/* sa_ignore FREED_MEMORY */
195 			sp = TAILQ_FIRST(&stcb->asoc.strmout[i].outqueue);
196 			if (sp == NULL) {
197 				continue;
198 			}
199 			if ((sp->msg_is_complete) &&
200 			    (sp->length == 0) &&
201 			    (sp->sender_all_done)) {
202 				/*
203 				 * We are doing differed cleanup. Last time
204 				 * through when we took all the data the
205 				 * sender_all_done was not set.
206 				 */
207 				if (sp->put_last_out == 0) {
208 					SCTP_PRINTF("Gak, put out entire msg with NO end!-1\n");
209 					SCTP_PRINTF("sender_done:%d len:%d msg_comp:%d put_last_out:%d\n",
210 					    sp->sender_all_done,
211 					    sp->length,
212 					    sp->msg_is_complete,
213 					    sp->put_last_out);
214 				}
215 				atomic_subtract_int(&stcb->asoc.stream_queue_cnt, 1);
216 				TAILQ_REMOVE(&stcb->asoc.strmout[i].outqueue, sp, next);
217 				stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, &asoc->strmout[i], sp);
218 				if (sp->net) {
219 					sctp_free_remote_addr(sp->net);
220 					sp->net = NULL;
221 				}
222 				if (sp->data) {
223 					sctp_m_freem(sp->data);
224 					sp->data = NULL;
225 				}
226 				sctp_free_a_strmoq(stcb, sp, so_locked);
227 				if (!TAILQ_EMPTY(&stcb->asoc.strmout[i].outqueue)) {
228 					unsent_data++;
229 				}
230 			} else {
231 				unsent_data++;
232 			}
233 			if (unsent_data > 0) {
234 				break;
235 			}
236 		}
237 	}
238 	return (unsent_data);
239 }
240 
241 static int
242 sctp_process_init(struct sctp_init_chunk *cp, struct sctp_tcb *stcb)
243 {
244 	struct sctp_init *init;
245 	struct sctp_association *asoc;
246 	struct sctp_nets *lnet;
247 	unsigned int i;
248 
249 	SCTP_TCB_LOCK_ASSERT(stcb);
250 
251 	init = &cp->init;
252 	asoc = &stcb->asoc;
253 	/* save off parameters */
254 	asoc->peer_vtag = ntohl(init->initiate_tag);
255 	asoc->peers_rwnd = ntohl(init->a_rwnd);
256 	/* init tsn's */
257 	asoc->highest_tsn_inside_map = asoc->asconf_seq_in = ntohl(init->initial_tsn) - 1;
258 
259 	if (!TAILQ_EMPTY(&asoc->nets)) {
260 		/* update any ssthresh's that may have a default */
261 		TAILQ_FOREACH(lnet, &asoc->nets, sctp_next) {
262 			lnet->ssthresh = asoc->peers_rwnd;
263 			if (SCTP_BASE_SYSCTL(sctp_logging_level) & (SCTP_CWND_MONITOR_ENABLE | SCTP_CWND_LOGGING_ENABLE)) {
264 				sctp_log_cwnd(stcb, lnet, 0, SCTP_CWND_INITIALIZATION);
265 			}
266 		}
267 	}
268 	if (asoc->pre_open_streams > ntohs(init->num_inbound_streams)) {
269 		unsigned int newcnt;
270 		struct sctp_stream_out *outs;
271 		struct sctp_stream_queue_pending *sp, *nsp;
272 		struct sctp_tmit_chunk *chk, *nchk;
273 
274 		/* abandon the upper streams */
275 		newcnt = ntohs(init->num_inbound_streams);
276 		TAILQ_FOREACH_SAFE(chk, &asoc->send_queue, sctp_next, nchk) {
277 			if (chk->rec.data.sid >= newcnt) {
278 				TAILQ_REMOVE(&asoc->send_queue, chk, sctp_next);
279 				asoc->send_queue_cnt--;
280 				if (asoc->strmout[chk->rec.data.sid].chunks_on_queues > 0) {
281 					asoc->strmout[chk->rec.data.sid].chunks_on_queues--;
282 #ifdef INVARIANTS
283 				} else {
284 					panic("No chunks on the queues for sid %u.", chk->rec.data.sid);
285 #endif
286 				}
287 				if (chk->data != NULL) {
288 					sctp_free_bufspace(stcb, asoc, chk, 1);
289 					sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb,
290 					    0, chk, SCTP_SO_NOT_LOCKED);
291 					if (chk->data) {
292 						sctp_m_freem(chk->data);
293 						chk->data = NULL;
294 					}
295 				}
296 				sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
297 				/* sa_ignore FREED_MEMORY */
298 			}
299 		}
300 		if (asoc->strmout) {
301 			for (i = newcnt; i < asoc->pre_open_streams; i++) {
302 				outs = &asoc->strmout[i];
303 				TAILQ_FOREACH_SAFE(sp, &outs->outqueue, next, nsp) {
304 					atomic_subtract_int(&stcb->asoc.stream_queue_cnt, 1);
305 					TAILQ_REMOVE(&outs->outqueue, sp, next);
306 					stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, outs, sp);
307 					sctp_ulp_notify(SCTP_NOTIFY_SPECIAL_SP_FAIL,
308 					    stcb, 0, sp, SCTP_SO_NOT_LOCKED);
309 					if (sp->data) {
310 						sctp_m_freem(sp->data);
311 						sp->data = NULL;
312 					}
313 					if (sp->net) {
314 						sctp_free_remote_addr(sp->net);
315 						sp->net = NULL;
316 					}
317 					/* Free the chunk */
318 					sctp_free_a_strmoq(stcb, sp, SCTP_SO_NOT_LOCKED);
319 					/* sa_ignore FREED_MEMORY */
320 				}
321 				outs->state = SCTP_STREAM_CLOSED;
322 			}
323 		}
324 		/* cut back the count */
325 		asoc->pre_open_streams = newcnt;
326 	}
327 	asoc->streamoutcnt = asoc->pre_open_streams;
328 	if (asoc->strmout) {
329 		for (i = 0; i < asoc->streamoutcnt; i++) {
330 			asoc->strmout[i].state = SCTP_STREAM_OPEN;
331 		}
332 	}
333 	/* EY - nr_sack: initialize highest tsn in nr_mapping_array */
334 	asoc->highest_tsn_inside_nr_map = asoc->highest_tsn_inside_map;
335 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {
336 		sctp_log_map(0, 5, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
337 	}
338 	/* This is the next one we expect */
339 	asoc->str_reset_seq_in = asoc->asconf_seq_in + 1;
340 
341 	asoc->mapping_array_base_tsn = ntohl(init->initial_tsn);
342 	asoc->tsn_last_delivered = asoc->cumulative_tsn = asoc->asconf_seq_in;
343 
344 	asoc->advanced_peer_ack_point = asoc->last_acked_seq;
345 	/* open the requested streams */
346 
347 	if (asoc->strmin != NULL) {
348 		/* Free the old ones */
349 		for (i = 0; i < asoc->streamincnt; i++) {
350 			sctp_clean_up_stream(stcb, &asoc->strmin[i].inqueue);
351 			sctp_clean_up_stream(stcb, &asoc->strmin[i].uno_inqueue);
352 		}
353 		SCTP_FREE(asoc->strmin, SCTP_M_STRMI);
354 	}
355 	if (asoc->max_inbound_streams > ntohs(init->num_outbound_streams)) {
356 		asoc->streamincnt = ntohs(init->num_outbound_streams);
357 	} else {
358 		asoc->streamincnt = asoc->max_inbound_streams;
359 	}
360 	SCTP_MALLOC(asoc->strmin, struct sctp_stream_in *, asoc->streamincnt *
361 	    sizeof(struct sctp_stream_in), SCTP_M_STRMI);
362 	if (asoc->strmin == NULL) {
363 		/* we didn't get memory for the streams! */
364 		SCTPDBG(SCTP_DEBUG_INPUT2, "process_init: couldn't get memory for the streams!\n");
365 		return (-1);
366 	}
367 	for (i = 0; i < asoc->streamincnt; i++) {
368 		asoc->strmin[i].sid = i;
369 		asoc->strmin[i].last_mid_delivered = 0xffffffff;
370 		TAILQ_INIT(&asoc->strmin[i].inqueue);
371 		TAILQ_INIT(&asoc->strmin[i].uno_inqueue);
372 		asoc->strmin[i].pd_api_started = 0;
373 		asoc->strmin[i].delivery_started = 0;
374 	}
375 	/*
376 	 * load_address_from_init will put the addresses into the
377 	 * association when the COOKIE is processed or the INIT-ACK is
378 	 * processed. Both types of COOKIE's existing and new call this
379 	 * routine. It will remove addresses that are no longer in the
380 	 * association (for the restarting case where addresses are
381 	 * removed). Up front when the INIT arrives we will discard it if it
382 	 * is a restart and new addresses have been added.
383 	 */
384 	/* sa_ignore MEMLEAK */
385 	return (0);
386 }
387 
388 /*
389  * INIT-ACK message processing/consumption returns value < 0 on error
390  */
391 static int
392 sctp_process_init_ack(struct mbuf *m, int iphlen, int offset,
393     struct sockaddr *src, struct sockaddr *dst, struct sctphdr *sh,
394     struct sctp_init_ack_chunk *cp, struct sctp_tcb *stcb,
395     struct sctp_nets *net, int *abort_no_unlock,
396     uint8_t mflowtype, uint32_t mflowid,
397     uint32_t vrf_id)
398 {
399 	struct sctp_association *asoc;
400 	struct mbuf *op_err;
401 	int retval, abort_flag, cookie_found;
402 	int initack_limit;
403 	int nat_friendly = 0;
404 
405 	/* First verify that we have no illegal param's */
406 	abort_flag = 0;
407 	cookie_found = 0;
408 
409 	op_err = sctp_arethere_unrecognized_parameters(m,
410 	    (offset + sizeof(struct sctp_init_chunk)),
411 	    &abort_flag, (struct sctp_chunkhdr *)cp,
412 	    &nat_friendly, &cookie_found);
413 	if (abort_flag) {
414 		/* Send an abort and notify peer */
415 		sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
416 		    src, dst, sh, op_err,
417 		    mflowtype, mflowid,
418 		    vrf_id, net->port);
419 		*abort_no_unlock = 1;
420 		return (-1);
421 	}
422 	if (!cookie_found) {
423 		uint16_t len;
424 
425 		/* Only report the missing cookie parameter */
426 		if (op_err != NULL) {
427 			sctp_m_freem(op_err);
428 		}
429 		len = (uint16_t)(sizeof(struct sctp_error_missing_param) + sizeof(uint16_t));
430 		/* We abort with an error of missing mandatory param */
431 		op_err = sctp_get_mbuf_for_msg(len, 0, M_NOWAIT, 1, MT_DATA);
432 		if (op_err != NULL) {
433 			struct sctp_error_missing_param *cause;
434 
435 			SCTP_BUF_LEN(op_err) = len;
436 			cause = mtod(op_err, struct sctp_error_missing_param *);
437 			/* Subtract the reserved param */
438 			cause->cause.code = htons(SCTP_CAUSE_MISSING_PARAM);
439 			cause->cause.length = htons(len);
440 			cause->num_missing_params = htonl(1);
441 			cause->type[0] = htons(SCTP_STATE_COOKIE);
442 		}
443 		sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
444 		    src, dst, sh, op_err,
445 		    mflowtype, mflowid,
446 		    vrf_id, net->port);
447 		*abort_no_unlock = 1;
448 		return (-3);
449 	}
450 	asoc = &stcb->asoc;
451 	asoc->peer_supports_nat = (uint8_t)nat_friendly;
452 	/* process the peer's parameters in the INIT-ACK */
453 	if (sctp_process_init((struct sctp_init_chunk *)cp, stcb) < 0) {
454 		if (op_err != NULL) {
455 			sctp_m_freem(op_err);
456 		}
457 		op_err = sctp_generate_cause(SCTP_CAUSE_OUT_OF_RESC, "");
458 		SCTPDBG(SCTP_DEBUG_INPUT1, "sctp_process_init() failed\n");
459 		sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
460 		    src, dst, sh, op_err,
461 		    mflowtype, mflowid,
462 		    vrf_id, net->port);
463 		*abort_no_unlock = 1;
464 		return (-1);
465 	}
466 	initack_limit = offset + ntohs(cp->ch.chunk_length);
467 	/* load all addresses */
468 	if ((retval = sctp_load_addresses_from_init(stcb, m,
469 	    offset + sizeof(struct sctp_init_chunk),
470 	    initack_limit, src, dst, NULL, stcb->asoc.port)) < 0) {
471 		if (op_err != NULL) {
472 			sctp_m_freem(op_err);
473 		}
474 		op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
475 		    "Problem with address parameters");
476 		SCTPDBG(SCTP_DEBUG_INPUT1,
477 		    "Load addresses from INIT causes an abort %d\n",
478 		    retval);
479 		sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
480 		    src, dst, sh, op_err,
481 		    mflowtype, mflowid,
482 		    vrf_id, net->port);
483 		*abort_no_unlock = 1;
484 		return (-1);
485 	}
486 	/* if the peer doesn't support asconf, flush the asconf queue */
487 	if (asoc->asconf_supported == 0) {
488 		struct sctp_asconf_addr *param, *nparam;
489 
490 		TAILQ_FOREACH_SAFE(param, &asoc->asconf_queue, next, nparam) {
491 			TAILQ_REMOVE(&asoc->asconf_queue, param, next);
492 			SCTP_FREE(param, SCTP_M_ASC_ADDR);
493 		}
494 	}
495 
496 	stcb->asoc.peer_hmac_id = sctp_negotiate_hmacid(stcb->asoc.peer_hmacs,
497 	    stcb->asoc.local_hmacs);
498 	if (op_err) {
499 		sctp_queue_op_err(stcb, op_err);
500 		/* queuing will steal away the mbuf chain to the out queue */
501 		op_err = NULL;
502 	}
503 	/* extract the cookie and queue it to "echo" it back... */
504 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
505 		sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
506 		    stcb->asoc.overall_error_count,
507 		    0,
508 		    SCTP_FROM_SCTP_INPUT,
509 		    __LINE__);
510 	}
511 
512 	/*
513 	 * Cancel the INIT timer, We do this first before queueing the
514 	 * cookie. We always cancel at the primary to assume that we are
515 	 * canceling the timer started by the INIT which always goes to the
516 	 * primary.
517 	 */
518 	sctp_timer_stop(SCTP_TIMER_TYPE_INIT, stcb->sctp_ep, stcb,
519 	    asoc->primary_destination, SCTP_FROM_SCTP_INPUT + SCTP_LOC_3);
520 
521 	/* calculate the RTO */
522 	if (asoc->overall_error_count == 0) {
523 		sctp_calculate_rto(stcb, asoc, net, &asoc->time_entered,
524 		    SCTP_RTT_FROM_NON_DATA);
525 	}
526 	stcb->asoc.overall_error_count = 0;
527 	net->error_count = 0;
528 	retval = sctp_send_cookie_echo(m, offset, initack_limit, stcb, net);
529 	return (retval);
530 }
531 
532 static void
533 sctp_handle_heartbeat_ack(struct sctp_heartbeat_chunk *cp,
534     struct sctp_tcb *stcb, struct sctp_nets *net)
535 {
536 	union sctp_sockstore store;
537 	struct sctp_nets *r_net, *f_net;
538 	struct timeval tv;
539 	int req_prim = 0;
540 	uint16_t old_error_counter;
541 
542 	if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_heartbeat_chunk)) {
543 		/* Invalid length */
544 		return;
545 	}
546 
547 	memset(&store, 0, sizeof(store));
548 	switch (cp->heartbeat.hb_info.addr_family) {
549 #ifdef INET
550 	case AF_INET:
551 		if (cp->heartbeat.hb_info.addr_len == sizeof(struct sockaddr_in)) {
552 			store.sin.sin_family = cp->heartbeat.hb_info.addr_family;
553 			store.sin.sin_len = cp->heartbeat.hb_info.addr_len;
554 			store.sin.sin_port = stcb->rport;
555 			memcpy(&store.sin.sin_addr, cp->heartbeat.hb_info.address,
556 			    sizeof(store.sin.sin_addr));
557 		} else {
558 			return;
559 		}
560 		break;
561 #endif
562 #ifdef INET6
563 	case AF_INET6:
564 		if (cp->heartbeat.hb_info.addr_len == sizeof(struct sockaddr_in6)) {
565 			store.sin6.sin6_family = cp->heartbeat.hb_info.addr_family;
566 			store.sin6.sin6_len = cp->heartbeat.hb_info.addr_len;
567 			store.sin6.sin6_port = stcb->rport;
568 			memcpy(&store.sin6.sin6_addr, cp->heartbeat.hb_info.address, sizeof(struct in6_addr));
569 		} else {
570 			return;
571 		}
572 		break;
573 #endif
574 	default:
575 		return;
576 	}
577 	r_net = sctp_findnet(stcb, &store.sa);
578 	if (r_net == NULL) {
579 		SCTPDBG(SCTP_DEBUG_INPUT1, "Huh? I can't find the address I sent it to, discard\n");
580 		return;
581 	}
582 	if ((r_net && (r_net->dest_state & SCTP_ADDR_UNCONFIRMED)) &&
583 	    (r_net->heartbeat_random1 == cp->heartbeat.hb_info.random_value1) &&
584 	    (r_net->heartbeat_random2 == cp->heartbeat.hb_info.random_value2)) {
585 		/*
586 		 * If the its a HB and it's random value is correct when can
587 		 * confirm the destination.
588 		 */
589 		r_net->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
590 		if (r_net->dest_state & SCTP_ADDR_REQ_PRIMARY) {
591 			stcb->asoc.primary_destination = r_net;
592 			r_net->dest_state &= ~SCTP_ADDR_REQ_PRIMARY;
593 			f_net = TAILQ_FIRST(&stcb->asoc.nets);
594 			if (f_net != r_net) {
595 				/*
596 				 * first one on the list is NOT the primary
597 				 * sctp_cmpaddr() is much more efficient if
598 				 * the primary is the first on the list,
599 				 * make it so.
600 				 */
601 				TAILQ_REMOVE(&stcb->asoc.nets, r_net, sctp_next);
602 				TAILQ_INSERT_HEAD(&stcb->asoc.nets, r_net, sctp_next);
603 			}
604 			req_prim = 1;
605 		}
606 		sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
607 		    stcb, 0, (void *)r_net, SCTP_SO_NOT_LOCKED);
608 		sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb,
609 		    r_net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_4);
610 		sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb, r_net);
611 	}
612 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
613 		sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
614 		    stcb->asoc.overall_error_count,
615 		    0,
616 		    SCTP_FROM_SCTP_INPUT,
617 		    __LINE__);
618 	}
619 	stcb->asoc.overall_error_count = 0;
620 	old_error_counter = r_net->error_count;
621 	r_net->error_count = 0;
622 	r_net->hb_responded = 1;
623 	tv.tv_sec = cp->heartbeat.hb_info.time_value_1;
624 	tv.tv_usec = cp->heartbeat.hb_info.time_value_2;
625 	/* Now lets do a RTO with this */
626 	sctp_calculate_rto(stcb, &stcb->asoc, r_net, &tv,
627 	    SCTP_RTT_FROM_NON_DATA);
628 	if ((r_net->dest_state & SCTP_ADDR_REACHABLE) == 0) {
629 		r_net->dest_state |= SCTP_ADDR_REACHABLE;
630 		sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_UP, stcb,
631 		    0, (void *)r_net, SCTP_SO_NOT_LOCKED);
632 	}
633 	if (r_net->dest_state & SCTP_ADDR_PF) {
634 		r_net->dest_state &= ~SCTP_ADDR_PF;
635 		stcb->asoc.cc_functions.sctp_cwnd_update_exit_pf(stcb, net);
636 	}
637 	if (old_error_counter > 0) {
638 		sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
639 		    stcb, r_net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_5);
640 		sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb, r_net);
641 	}
642 	if (r_net == stcb->asoc.primary_destination) {
643 		if (stcb->asoc.alternate) {
644 			/* release the alternate, primary is good */
645 			sctp_free_remote_addr(stcb->asoc.alternate);
646 			stcb->asoc.alternate = NULL;
647 		}
648 	}
649 	/* Mobility adaptation */
650 	if (req_prim) {
651 		if ((sctp_is_mobility_feature_on(stcb->sctp_ep,
652 		    SCTP_MOBILITY_BASE) ||
653 		    sctp_is_mobility_feature_on(stcb->sctp_ep,
654 		    SCTP_MOBILITY_FASTHANDOFF)) &&
655 		    sctp_is_mobility_feature_on(stcb->sctp_ep,
656 		    SCTP_MOBILITY_PRIM_DELETED)) {
657 			sctp_timer_stop(SCTP_TIMER_TYPE_PRIM_DELETED,
658 			    stcb->sctp_ep, stcb, NULL,
659 			    SCTP_FROM_SCTP_INPUT + SCTP_LOC_6);
660 			if (sctp_is_mobility_feature_on(stcb->sctp_ep,
661 			    SCTP_MOBILITY_FASTHANDOFF)) {
662 				sctp_assoc_immediate_retrans(stcb,
663 				    stcb->asoc.primary_destination);
664 			}
665 			if (sctp_is_mobility_feature_on(stcb->sctp_ep,
666 			    SCTP_MOBILITY_BASE)) {
667 				sctp_move_chunks_from_net(stcb,
668 				    stcb->asoc.deleted_primary);
669 			}
670 			sctp_delete_prim_timer(stcb->sctp_ep, stcb);
671 		}
672 	}
673 }
674 
675 static int
676 sctp_handle_nat_colliding_state(struct sctp_tcb *stcb)
677 {
678 	/*
679 	 * Return 0 means we want you to proceed with the abort non-zero
680 	 * means no abort processing.
681 	 */
682 	uint32_t new_vtag;
683 	struct sctpasochead *head;
684 
685 	if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) ||
686 	    (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) {
687 		atomic_add_int(&stcb->asoc.refcnt, 1);
688 		SCTP_TCB_UNLOCK(stcb);
689 		SCTP_INP_INFO_WLOCK();
690 		SCTP_TCB_LOCK(stcb);
691 		atomic_subtract_int(&stcb->asoc.refcnt, 1);
692 	} else {
693 		return (0);
694 	}
695 	new_vtag = sctp_select_a_tag(stcb->sctp_ep, stcb->sctp_ep->sctp_lport, stcb->rport, 1);
696 	if (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) {
697 		/* generate a new vtag and send init */
698 		LIST_REMOVE(stcb, sctp_asocs);
699 		stcb->asoc.my_vtag = new_vtag;
700 		head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag, SCTP_BASE_INFO(hashasocmark))];
701 		/*
702 		 * put it in the bucket in the vtag hash of assoc's for the
703 		 * system
704 		 */
705 		LIST_INSERT_HEAD(head, stcb, sctp_asocs);
706 		SCTP_INP_INFO_WUNLOCK();
707 		sctp_send_initiate(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);
708 		return (1);
709 	} else {
710 		/*
711 		 * treat like a case where the cookie expired i.e.: - dump
712 		 * current cookie. - generate a new vtag. - resend init.
713 		 */
714 		/* generate a new vtag and send init */
715 		LIST_REMOVE(stcb, sctp_asocs);
716 		SCTP_SET_STATE(stcb, SCTP_STATE_COOKIE_WAIT);
717 		sctp_stop_all_cookie_timers(stcb);
718 		sctp_toss_old_cookies(stcb, &stcb->asoc);
719 		stcb->asoc.my_vtag = new_vtag;
720 		head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag, SCTP_BASE_INFO(hashasocmark))];
721 		/*
722 		 * put it in the bucket in the vtag hash of assoc's for the
723 		 * system
724 		 */
725 		LIST_INSERT_HEAD(head, stcb, sctp_asocs);
726 		SCTP_INP_INFO_WUNLOCK();
727 		sctp_send_initiate(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);
728 		return (1);
729 	}
730 	return (0);
731 }
732 
733 static int
734 sctp_handle_nat_missing_state(struct sctp_tcb *stcb,
735     struct sctp_nets *net)
736 {
737 	/*
738 	 * return 0 means we want you to proceed with the abort non-zero
739 	 * means no abort processing
740 	 */
741 	if (stcb->asoc.auth_supported == 0) {
742 		SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_nat_missing_state: Peer does not support AUTH, cannot send an asconf\n");
743 		return (0);
744 	}
745 	sctp_asconf_send_nat_state_update(stcb, net);
746 	return (1);
747 }
748 
749 /* Returns 1 if the stcb was aborted, 0 otherwise */
750 static int
751 sctp_handle_abort(struct sctp_abort_chunk *abort,
752     struct sctp_tcb *stcb, struct sctp_nets *net)
753 {
754 	uint16_t len;
755 	uint16_t error;
756 
757 	SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_abort: handling ABORT\n");
758 	if (stcb == NULL)
759 		return (0);
760 
761 	len = ntohs(abort->ch.chunk_length);
762 	if (len >= sizeof(struct sctp_chunkhdr) + sizeof(struct sctp_error_cause)) {
763 		/*
764 		 * Need to check the cause codes for our two magic nat
765 		 * aborts which don't kill the assoc necessarily.
766 		 */
767 		struct sctp_error_cause *cause;
768 
769 		cause = (struct sctp_error_cause *)(abort + 1);
770 		error = ntohs(cause->code);
771 		if (error == SCTP_CAUSE_NAT_COLLIDING_STATE) {
772 			SCTPDBG(SCTP_DEBUG_INPUT2, "Received Colliding state, ABORT flags:%x\n",
773 			    abort->ch.chunk_flags);
774 			if (sctp_handle_nat_colliding_state(stcb)) {
775 				return (0);
776 			}
777 		} else if (error == SCTP_CAUSE_NAT_MISSING_STATE) {
778 			SCTPDBG(SCTP_DEBUG_INPUT2, "Received missing state, ABORT flags:%x\n",
779 			    abort->ch.chunk_flags);
780 			if (sctp_handle_nat_missing_state(stcb, net)) {
781 				return (0);
782 			}
783 		}
784 	} else {
785 		error = 0;
786 	}
787 	/* stop any receive timers */
788 	sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, NULL,
789 	    SCTP_FROM_SCTP_INPUT + SCTP_LOC_7);
790 	/* notify user of the abort and clean up... */
791 	sctp_abort_notification(stcb, true, false, error, abort, SCTP_SO_NOT_LOCKED);
792 	/* free the tcb */
793 	SCTP_STAT_INCR_COUNTER32(sctps_aborted);
794 	if ((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) ||
795 	    (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
796 		SCTP_STAT_DECR_GAUGE32(sctps_currestab);
797 	}
798 #ifdef SCTP_ASOCLOG_OF_TSNS
799 	sctp_print_out_track_log(stcb);
800 #endif
801 	(void)sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC,
802 	    SCTP_FROM_SCTP_INPUT + SCTP_LOC_8);
803 	SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_abort: finished\n");
804 	return (1);
805 }
806 
807 static void
808 sctp_start_net_timers(struct sctp_tcb *stcb)
809 {
810 	uint32_t cnt_hb_sent;
811 	struct sctp_nets *net;
812 
813 	cnt_hb_sent = 0;
814 	TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
815 		/*
816 		 * For each network start: 1) A pmtu timer. 2) A HB timer 3)
817 		 * If the dest in unconfirmed send a hb as well if under
818 		 * max_hb_burst have been sent.
819 		 */
820 		sctp_timer_start(SCTP_TIMER_TYPE_PATHMTURAISE, stcb->sctp_ep, stcb, net);
821 		sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb, net);
822 		if ((net->dest_state & SCTP_ADDR_UNCONFIRMED) &&
823 		    (cnt_hb_sent < SCTP_BASE_SYSCTL(sctp_hb_maxburst))) {
824 			sctp_send_hb(stcb, net, SCTP_SO_NOT_LOCKED);
825 			cnt_hb_sent++;
826 		}
827 	}
828 	if (cnt_hb_sent) {
829 		sctp_chunk_output(stcb->sctp_ep, stcb,
830 		    SCTP_OUTPUT_FROM_COOKIE_ACK,
831 		    SCTP_SO_NOT_LOCKED);
832 	}
833 }
834 
835 static void
836 sctp_handle_shutdown(struct sctp_shutdown_chunk *cp,
837     struct sctp_tcb *stcb, struct sctp_nets *net, int *abort_flag)
838 {
839 	struct sctp_association *asoc;
840 	int some_on_streamwheel;
841 	int old_state;
842 
843 	SCTPDBG(SCTP_DEBUG_INPUT2,
844 	    "sctp_handle_shutdown: handling SHUTDOWN\n");
845 	if (stcb == NULL)
846 		return;
847 	asoc = &stcb->asoc;
848 	if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) ||
849 	    (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) {
850 		return;
851 	}
852 	if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_shutdown_chunk)) {
853 		/* Shutdown NOT the expected size */
854 		return;
855 	}
856 	old_state = SCTP_GET_STATE(stcb);
857 	sctp_update_acked(stcb, cp, abort_flag);
858 	if (*abort_flag) {
859 		return;
860 	}
861 	if (asoc->control_pdapi) {
862 		/*
863 		 * With a normal shutdown we assume the end of last record.
864 		 */
865 		SCTP_INP_READ_LOCK(stcb->sctp_ep);
866 		if (asoc->control_pdapi->on_strm_q) {
867 			struct sctp_stream_in *strm;
868 
869 			strm = &asoc->strmin[asoc->control_pdapi->sinfo_stream];
870 			if (asoc->control_pdapi->on_strm_q == SCTP_ON_UNORDERED) {
871 				/* Unordered */
872 				TAILQ_REMOVE(&strm->uno_inqueue, asoc->control_pdapi, next_instrm);
873 				asoc->control_pdapi->on_strm_q = 0;
874 			} else if (asoc->control_pdapi->on_strm_q == SCTP_ON_ORDERED) {
875 				/* Ordered */
876 				TAILQ_REMOVE(&strm->inqueue, asoc->control_pdapi, next_instrm);
877 				asoc->control_pdapi->on_strm_q = 0;
878 #ifdef INVARIANTS
879 			} else {
880 				panic("Unknown state on ctrl:%p on_strm_q:%d",
881 				    asoc->control_pdapi,
882 				    asoc->control_pdapi->on_strm_q);
883 #endif
884 			}
885 		}
886 		asoc->control_pdapi->end_added = 1;
887 		asoc->control_pdapi->pdapi_aborted = 1;
888 		asoc->control_pdapi = NULL;
889 		SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
890 		if (stcb->sctp_socket) {
891 			sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
892 		}
893 	}
894 	/* goto SHUTDOWN_RECEIVED state to block new requests */
895 	if (stcb->sctp_socket) {
896 		if ((SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_RECEIVED) &&
897 		    (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_ACK_SENT) &&
898 		    (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_SENT)) {
899 			SCTP_SET_STATE(stcb, SCTP_STATE_SHUTDOWN_RECEIVED);
900 			/*
901 			 * notify upper layer that peer has initiated a
902 			 * shutdown
903 			 */
904 			sctp_ulp_notify(SCTP_NOTIFY_PEER_SHUTDOWN, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
905 
906 			/* reset time */
907 			(void)SCTP_GETTIME_TIMEVAL(&asoc->time_entered);
908 		}
909 	}
910 	if (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_SENT) {
911 		/*
912 		 * stop the shutdown timer, since we WILL move to
913 		 * SHUTDOWN-ACK-SENT.
914 		 */
915 		sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb,
916 		    net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_9);
917 	}
918 	/* Now is there unsent data on a stream somewhere? */
919 	some_on_streamwheel = sctp_is_there_unsent_data(stcb, SCTP_SO_NOT_LOCKED);
920 
921 	if (!TAILQ_EMPTY(&asoc->send_queue) ||
922 	    !TAILQ_EMPTY(&asoc->sent_queue) ||
923 	    some_on_streamwheel) {
924 		/* By returning we will push more data out */
925 		return;
926 	} else {
927 		/* no outstanding data to send, so move on... */
928 		/* send SHUTDOWN-ACK */
929 		/* move to SHUTDOWN-ACK-SENT state */
930 		if ((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) ||
931 		    (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
932 			SCTP_STAT_DECR_GAUGE32(sctps_currestab);
933 		}
934 		if (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_ACK_SENT) {
935 			SCTP_SET_STATE(stcb, SCTP_STATE_SHUTDOWN_ACK_SENT);
936 			sctp_stop_timers_for_shutdown(stcb);
937 			sctp_send_shutdown_ack(stcb, net);
938 			sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNACK,
939 			    stcb->sctp_ep, stcb, net);
940 		} else if (old_state == SCTP_STATE_SHUTDOWN_ACK_SENT) {
941 			sctp_send_shutdown_ack(stcb, net);
942 		}
943 	}
944 }
945 
946 static void
947 sctp_handle_shutdown_ack(struct sctp_shutdown_ack_chunk *cp SCTP_UNUSED,
948     struct sctp_tcb *stcb,
949     struct sctp_nets *net)
950 {
951 	struct sctp_association *asoc;
952 
953 	SCTPDBG(SCTP_DEBUG_INPUT2,
954 	    "sctp_handle_shutdown_ack: handling SHUTDOWN ACK\n");
955 	if (stcb == NULL)
956 		return;
957 
958 	asoc = &stcb->asoc;
959 	/* process according to association state */
960 	if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) ||
961 	    (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) {
962 		/* unexpected SHUTDOWN-ACK... do OOTB handling... */
963 		sctp_send_shutdown_complete(stcb, net, 1);
964 		SCTP_TCB_UNLOCK(stcb);
965 		return;
966 	}
967 	if ((SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_SENT) &&
968 	    (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_ACK_SENT)) {
969 		/* unexpected SHUTDOWN-ACK... so ignore... */
970 		SCTP_TCB_UNLOCK(stcb);
971 		return;
972 	}
973 	if (asoc->control_pdapi) {
974 		/*
975 		 * With a normal shutdown we assume the end of last record.
976 		 */
977 		SCTP_INP_READ_LOCK(stcb->sctp_ep);
978 		asoc->control_pdapi->end_added = 1;
979 		asoc->control_pdapi->pdapi_aborted = 1;
980 		asoc->control_pdapi = NULL;
981 		SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
982 		sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
983 	}
984 #ifdef INVARIANTS
985 	if (!TAILQ_EMPTY(&asoc->send_queue) ||
986 	    !TAILQ_EMPTY(&asoc->sent_queue) ||
987 	    sctp_is_there_unsent_data(stcb, SCTP_SO_NOT_LOCKED)) {
988 		panic("Queues are not empty when handling SHUTDOWN-ACK");
989 	}
990 #endif
991 	/* stop the timer */
992 	sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, net,
993 	    SCTP_FROM_SCTP_INPUT + SCTP_LOC_10);
994 	/* send SHUTDOWN-COMPLETE */
995 	sctp_send_shutdown_complete(stcb, net, 0);
996 	/* notify upper layer protocol */
997 	if (stcb->sctp_socket) {
998 		if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
999 		    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
1000 			SCTP_SB_CLEAR(stcb->sctp_socket->so_snd);
1001 		}
1002 		sctp_ulp_notify(SCTP_NOTIFY_ASSOC_DOWN, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
1003 	}
1004 	SCTP_STAT_INCR_COUNTER32(sctps_shutdown);
1005 	/* free the TCB but first save off the ep */
1006 	(void)sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC,
1007 	    SCTP_FROM_SCTP_INPUT + SCTP_LOC_11);
1008 }
1009 
1010 static void
1011 sctp_process_unrecog_chunk(struct sctp_tcb *stcb, uint8_t chunk_type)
1012 {
1013 	switch (chunk_type) {
1014 	case SCTP_ASCONF_ACK:
1015 	case SCTP_ASCONF:
1016 		sctp_asconf_cleanup(stcb);
1017 		break;
1018 	case SCTP_IFORWARD_CUM_TSN:
1019 	case SCTP_FORWARD_CUM_TSN:
1020 		stcb->asoc.prsctp_supported = 0;
1021 		break;
1022 	default:
1023 		SCTPDBG(SCTP_DEBUG_INPUT2,
1024 		    "Peer does not support chunk type %d (0x%x).\n",
1025 		    chunk_type, chunk_type);
1026 		break;
1027 	}
1028 }
1029 
1030 /*
1031  * Skip past the param header and then we will find the param that caused the
1032  * problem.  There are a number of param's in a ASCONF OR the prsctp param
1033  * these will turn of specific features.
1034  * XXX: Is this the right thing to do?
1035  */
1036 static void
1037 sctp_process_unrecog_param(struct sctp_tcb *stcb, uint16_t parameter_type)
1038 {
1039 	switch (parameter_type) {
1040 		/* pr-sctp draft */
1041 	case SCTP_PRSCTP_SUPPORTED:
1042 		stcb->asoc.prsctp_supported = 0;
1043 		break;
1044 	case SCTP_SUPPORTED_CHUNK_EXT:
1045 		break;
1046 		/* draft-ietf-tsvwg-addip-sctp */
1047 	case SCTP_HAS_NAT_SUPPORT:
1048 		stcb->asoc.peer_supports_nat = 0;
1049 		break;
1050 	case SCTP_ADD_IP_ADDRESS:
1051 	case SCTP_DEL_IP_ADDRESS:
1052 	case SCTP_SET_PRIM_ADDR:
1053 		stcb->asoc.asconf_supported = 0;
1054 		break;
1055 	case SCTP_SUCCESS_REPORT:
1056 	case SCTP_ERROR_CAUSE_IND:
1057 		SCTPDBG(SCTP_DEBUG_INPUT2, "Huh, the peer does not support success? or error cause?\n");
1058 		SCTPDBG(SCTP_DEBUG_INPUT2,
1059 		    "Turning off ASCONF to this strange peer\n");
1060 		stcb->asoc.asconf_supported = 0;
1061 		break;
1062 	default:
1063 		SCTPDBG(SCTP_DEBUG_INPUT2,
1064 		    "Peer does not support param type %d (0x%x)??\n",
1065 		    parameter_type, parameter_type);
1066 		break;
1067 	}
1068 }
1069 
1070 static int
1071 sctp_handle_error(struct sctp_chunkhdr *ch,
1072     struct sctp_tcb *stcb, struct sctp_nets *net, uint32_t limit)
1073 {
1074 	struct sctp_error_cause *cause;
1075 	struct sctp_association *asoc;
1076 	uint32_t remaining_length, adjust;
1077 	uint16_t code, cause_code, cause_length;
1078 
1079 	/* parse through all of the errors and process */
1080 	asoc = &stcb->asoc;
1081 	cause = (struct sctp_error_cause *)((caddr_t)ch +
1082 	    sizeof(struct sctp_chunkhdr));
1083 	remaining_length = ntohs(ch->chunk_length);
1084 	if (remaining_length > limit) {
1085 		remaining_length = limit;
1086 	}
1087 	if (remaining_length >= sizeof(struct sctp_chunkhdr)) {
1088 		remaining_length -= sizeof(struct sctp_chunkhdr);
1089 	} else {
1090 		remaining_length = 0;
1091 	}
1092 	code = 0;
1093 	while (remaining_length >= sizeof(struct sctp_error_cause)) {
1094 		/* Process an Error Cause */
1095 		cause_code = ntohs(cause->code);
1096 		cause_length = ntohs(cause->length);
1097 		if ((cause_length > remaining_length) || (cause_length == 0)) {
1098 			/* Invalid cause length, possibly due to truncation. */
1099 			SCTPDBG(SCTP_DEBUG_INPUT1, "Bogus length in cause - bytes left: %u cause length: %u\n",
1100 			    remaining_length, cause_length);
1101 			return (0);
1102 		}
1103 		if (code == 0) {
1104 			/* report the first error cause */
1105 			code = cause_code;
1106 		}
1107 		switch (cause_code) {
1108 		case SCTP_CAUSE_INVALID_STREAM:
1109 		case SCTP_CAUSE_MISSING_PARAM:
1110 		case SCTP_CAUSE_INVALID_PARAM:
1111 		case SCTP_CAUSE_NO_USER_DATA:
1112 			SCTPDBG(SCTP_DEBUG_INPUT1, "Software error we got a %u back? We have a bug :/ (or do they?)\n",
1113 			    cause_code);
1114 			break;
1115 		case SCTP_CAUSE_NAT_COLLIDING_STATE:
1116 			SCTPDBG(SCTP_DEBUG_INPUT2, "Received Colliding state, ERROR flags: %x\n",
1117 			    ch->chunk_flags);
1118 			if (sctp_handle_nat_colliding_state(stcb)) {
1119 				return (0);
1120 			}
1121 			break;
1122 		case SCTP_CAUSE_NAT_MISSING_STATE:
1123 			SCTPDBG(SCTP_DEBUG_INPUT2, "Received missing state, ERROR flags: %x\n",
1124 			    ch->chunk_flags);
1125 			if (sctp_handle_nat_missing_state(stcb, net)) {
1126 				return (0);
1127 			}
1128 			break;
1129 		case SCTP_CAUSE_STALE_COOKIE:
1130 			/*
1131 			 * We only act if we have echoed a cookie and are
1132 			 * waiting.
1133 			 */
1134 			if ((cause_length >= sizeof(struct sctp_error_stale_cookie)) &&
1135 			    (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) {
1136 				struct timeval now;
1137 				struct sctp_error_stale_cookie *stale_cookie;
1138 				uint64_t stale_time;
1139 
1140 				asoc->stale_cookie_count++;
1141 				if (asoc->stale_cookie_count > asoc->max_init_times) {
1142 					sctp_abort_notification(stcb, false, true, 0, NULL, SCTP_SO_NOT_LOCKED);
1143 					(void)sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC,
1144 					    SCTP_FROM_SCTP_INPUT + SCTP_LOC_12);
1145 					return (-1);
1146 				}
1147 				stale_cookie = (struct sctp_error_stale_cookie *)cause;
1148 				stale_time = ntohl(stale_cookie->stale_time);
1149 				if (stale_time == 0) {
1150 					/* Use an RTT as an approximation. */
1151 					(void)SCTP_GETTIME_TIMEVAL(&now);
1152 					timevalsub(&now, &asoc->time_entered);
1153 					stale_time = (uint64_t)1000000 * (uint64_t)now.tv_sec + (uint64_t)now.tv_usec;
1154 					if (stale_time == 0) {
1155 						stale_time = 1;
1156 					}
1157 				}
1158 				/*
1159 				 * stale_time is in usec, convert it to
1160 				 * msec. Round upwards, to ensure that it is
1161 				 * non-zero.
1162 				 */
1163 				stale_time = (stale_time + 999) / 1000;
1164 				/* Double it, to be more robust on RTX. */
1165 				stale_time = 2 * stale_time;
1166 				asoc->cookie_preserve_req = (uint32_t)stale_time;
1167 				if (asoc->overall_error_count == 0) {
1168 					sctp_calculate_rto(stcb, asoc, net, &asoc->time_entered,
1169 					    SCTP_RTT_FROM_NON_DATA);
1170 				}
1171 				asoc->overall_error_count = 0;
1172 				/* Blast back to INIT state */
1173 				sctp_toss_old_cookies(stcb, &stcb->asoc);
1174 				sctp_stop_all_cookie_timers(stcb);
1175 				SCTP_SET_STATE(stcb, SCTP_STATE_COOKIE_WAIT);
1176 				(void)SCTP_GETTIME_TIMEVAL(&asoc->time_entered);
1177 				sctp_send_initiate(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);
1178 			}
1179 			break;
1180 		case SCTP_CAUSE_UNRESOLVABLE_ADDR:
1181 			/*
1182 			 * Nothing we can do here, we don't do hostname
1183 			 * addresses so if the peer does not like my IPv6
1184 			 * (or IPv4 for that matter) it does not matter. If
1185 			 * they don't support that type of address, they can
1186 			 * NOT possibly get that packet type... i.e. with no
1187 			 * IPv6 you can't receive a IPv6 packet. so we can
1188 			 * safely ignore this one. If we ever added support
1189 			 * for HOSTNAME Addresses, then we would need to do
1190 			 * something here.
1191 			 */
1192 			break;
1193 		case SCTP_CAUSE_UNRECOG_CHUNK:
1194 			if (cause_length >= sizeof(struct sctp_error_unrecognized_chunk)) {
1195 				struct sctp_error_unrecognized_chunk *unrec_chunk;
1196 
1197 				unrec_chunk = (struct sctp_error_unrecognized_chunk *)cause;
1198 				sctp_process_unrecog_chunk(stcb, unrec_chunk->ch.chunk_type);
1199 			}
1200 			break;
1201 		case SCTP_CAUSE_UNRECOG_PARAM:
1202 			/* XXX: We only consider the first parameter */
1203 			if (cause_length >= sizeof(struct sctp_error_cause) + sizeof(struct sctp_paramhdr)) {
1204 				struct sctp_paramhdr *unrec_parameter;
1205 
1206 				unrec_parameter = (struct sctp_paramhdr *)(cause + 1);
1207 				sctp_process_unrecog_param(stcb, ntohs(unrec_parameter->param_type));
1208 			}
1209 			break;
1210 		case SCTP_CAUSE_COOKIE_IN_SHUTDOWN:
1211 			/*
1212 			 * We ignore this since the timer will drive out a
1213 			 * new cookie anyway and there timer will drive us
1214 			 * to send a SHUTDOWN_COMPLETE. We can't send one
1215 			 * here since we don't have their tag.
1216 			 */
1217 			break;
1218 		case SCTP_CAUSE_DELETING_LAST_ADDR:
1219 		case SCTP_CAUSE_RESOURCE_SHORTAGE:
1220 		case SCTP_CAUSE_DELETING_SRC_ADDR:
1221 			/*
1222 			 * We should NOT get these here, but in a
1223 			 * ASCONF-ACK.
1224 			 */
1225 			SCTPDBG(SCTP_DEBUG_INPUT2, "Peer sends ASCONF errors in a error cause with code %u.\n",
1226 			    cause_code);
1227 			break;
1228 		case SCTP_CAUSE_OUT_OF_RESC:
1229 			/*
1230 			 * And what, pray tell do we do with the fact that
1231 			 * the peer is out of resources? Not really sure we
1232 			 * could do anything but abort. I suspect this
1233 			 * should have came WITH an abort instead of in a
1234 			 * OP-ERROR.
1235 			 */
1236 			break;
1237 		default:
1238 			SCTPDBG(SCTP_DEBUG_INPUT1, "sctp_handle_error: unknown code 0x%x\n",
1239 			    cause_code);
1240 			break;
1241 		}
1242 		adjust = SCTP_SIZE32(cause_length);
1243 		if (remaining_length >= adjust) {
1244 			remaining_length -= adjust;
1245 		} else {
1246 			remaining_length = 0;
1247 		}
1248 		cause = (struct sctp_error_cause *)((caddr_t)cause + adjust);
1249 	}
1250 	sctp_ulp_notify(SCTP_NOTIFY_REMOTE_ERROR, stcb, code, ch, SCTP_SO_NOT_LOCKED);
1251 	return (0);
1252 }
1253 
1254 static int
1255 sctp_handle_init_ack(struct mbuf *m, int iphlen, int offset,
1256     struct sockaddr *src, struct sockaddr *dst, struct sctphdr *sh,
1257     struct sctp_init_ack_chunk *cp, struct sctp_tcb *stcb,
1258     struct sctp_nets *net, int *abort_no_unlock,
1259     uint8_t mflowtype, uint32_t mflowid,
1260     uint32_t vrf_id)
1261 {
1262 	struct sctp_init_ack *init_ack;
1263 	struct mbuf *op_err;
1264 
1265 	SCTPDBG(SCTP_DEBUG_INPUT2,
1266 	    "sctp_handle_init_ack: handling INIT-ACK\n");
1267 
1268 	if (stcb == NULL) {
1269 		SCTPDBG(SCTP_DEBUG_INPUT2,
1270 		    "sctp_handle_init_ack: TCB is null\n");
1271 		return (-1);
1272 	}
1273 	/* Only process the INIT-ACK chunk in COOKIE WAIT state. */
1274 	if (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) {
1275 		init_ack = &cp->init;
1276 		/* Validate parameters. */
1277 		if ((ntohl(init_ack->initiate_tag) == 0) ||
1278 		    (ntohl(init_ack->a_rwnd) < SCTP_MIN_RWND) ||
1279 		    (ntohs(init_ack->num_inbound_streams) == 0) ||
1280 		    (ntohs(init_ack->num_outbound_streams) == 0)) {
1281 			/* One of the mandatory parameters is illegal. */
1282 			op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
1283 			sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
1284 			    src, dst, sh, op_err,
1285 			    mflowtype, mflowid,
1286 			    vrf_id, net->port);
1287 			*abort_no_unlock = 1;
1288 			return (-1);
1289 		}
1290 		if (stcb->asoc.primary_destination->dest_state &
1291 		    SCTP_ADDR_UNCONFIRMED) {
1292 			/*
1293 			 * The primary is where we sent the INIT, we can
1294 			 * always consider it confirmed when the INIT-ACK is
1295 			 * returned. Do this before we load addresses
1296 			 * though.
1297 			 */
1298 			stcb->asoc.primary_destination->dest_state &=
1299 			    ~SCTP_ADDR_UNCONFIRMED;
1300 			sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
1301 			    stcb, 0, (void *)stcb->asoc.primary_destination, SCTP_SO_NOT_LOCKED);
1302 		}
1303 		if (sctp_process_init_ack(m, iphlen, offset, src, dst, sh, cp, stcb,
1304 		    net, abort_no_unlock,
1305 		    mflowtype, mflowid,
1306 		    vrf_id) < 0) {
1307 			/* error in parsing parameters */
1308 			return (-1);
1309 		}
1310 		/* Update our state. */
1311 		SCTPDBG(SCTP_DEBUG_INPUT2, "moving to COOKIE-ECHOED state\n");
1312 		SCTP_SET_STATE(stcb, SCTP_STATE_COOKIE_ECHOED);
1313 
1314 		/* Reset the RTO calculation. */
1315 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
1316 			sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
1317 			    stcb->asoc.overall_error_count,
1318 			    0,
1319 			    SCTP_FROM_SCTP_INPUT,
1320 			    __LINE__);
1321 		}
1322 		stcb->asoc.overall_error_count = 0;
1323 		(void)SCTP_GETTIME_TIMEVAL(&stcb->asoc.time_entered);
1324 		/*
1325 		 * Collapse the init timer back in case of a exponential
1326 		 * backoff.
1327 		 */
1328 		sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, stcb->sctp_ep,
1329 		    stcb, net);
1330 		/*
1331 		 * The output routine at the end of the inbound data
1332 		 * processing will cause the cookie to be sent.
1333 		 */
1334 		SCTPDBG(SCTP_DEBUG_INPUT1, "Leaving handle-init-ack end\n");
1335 		return (0);
1336 	} else {
1337 		return (-1);
1338 	}
1339 }
1340 
1341 static struct sctp_tcb *
1342 sctp_process_cookie_new(struct mbuf *m, int iphlen, int offset,
1343     struct sockaddr *src, struct sockaddr *dst,
1344     struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len,
1345     struct sctp_inpcb *inp, struct sctp_nets **netp,
1346     struct sockaddr *init_src, int *notification,
1347     int auth_skipped, uint32_t auth_offset, uint32_t auth_len,
1348     uint8_t mflowtype, uint32_t mflowid,
1349     uint32_t vrf_id, uint16_t port);
1350 
1351 /*
1352  * handle a state cookie for an existing association m: input packet mbuf
1353  * chain-- assumes a pullup on IP/SCTP/COOKIE-ECHO chunk note: this is a
1354  * "split" mbuf and the cookie signature does not exist offset: offset into
1355  * mbuf to the cookie-echo chunk
1356  */
1357 static struct sctp_tcb *
1358 sctp_process_cookie_existing(struct mbuf *m, int iphlen, int offset,
1359     struct sockaddr *src, struct sockaddr *dst,
1360     struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len,
1361     struct sctp_inpcb *inp, struct sctp_tcb *stcb, struct sctp_nets **netp,
1362     struct sockaddr *init_src, int *notification,
1363     int auth_skipped, uint32_t auth_offset, uint32_t auth_len,
1364     uint8_t mflowtype, uint32_t mflowid,
1365     uint32_t vrf_id, uint16_t port)
1366 {
1367 	struct sctp_association *asoc;
1368 	struct sctp_init_chunk *init_cp, init_buf;
1369 	struct sctp_init_ack_chunk *initack_cp, initack_buf;
1370 	struct sctp_asconf_addr *aparam, *naparam;
1371 	struct sctp_asconf_ack *aack, *naack;
1372 	struct sctp_tmit_chunk *chk, *nchk;
1373 	struct sctp_stream_reset_list *strrst, *nstrrst;
1374 	struct sctp_queued_to_read *sq, *nsq;
1375 	struct sctp_nets *net;
1376 	struct mbuf *op_err;
1377 	int init_offset, initack_offset, i;
1378 	int retval;
1379 	int spec_flag = 0;
1380 	uint32_t how_indx;
1381 #if defined(SCTP_DETAILED_STR_STATS)
1382 	int j;
1383 #endif
1384 
1385 	net = *netp;
1386 	/* I know that the TCB is non-NULL from the caller */
1387 	asoc = &stcb->asoc;
1388 	for (how_indx = 0; how_indx < sizeof(asoc->cookie_how); how_indx++) {
1389 		if (asoc->cookie_how[how_indx] == 0)
1390 			break;
1391 	}
1392 	if (how_indx < sizeof(asoc->cookie_how)) {
1393 		asoc->cookie_how[how_indx] = 1;
1394 	}
1395 	if (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_ACK_SENT) {
1396 		/* SHUTDOWN came in after sending INIT-ACK */
1397 		sctp_send_shutdown_ack(stcb, stcb->asoc.primary_destination);
1398 		op_err = sctp_generate_cause(SCTP_CAUSE_COOKIE_IN_SHUTDOWN, "");
1399 		sctp_send_operr_to(src, dst, sh, cookie->peers_vtag, op_err,
1400 		    mflowtype, mflowid, inp->fibnum,
1401 		    vrf_id, net->port);
1402 		if (how_indx < sizeof(asoc->cookie_how))
1403 			asoc->cookie_how[how_indx] = 2;
1404 		SCTP_TCB_UNLOCK(stcb);
1405 		return (NULL);
1406 	}
1407 	/*
1408 	 * find and validate the INIT chunk in the cookie (peer's info) the
1409 	 * INIT should start after the cookie-echo header struct (chunk
1410 	 * header, state cookie header struct)
1411 	 */
1412 	init_offset = offset += sizeof(struct sctp_cookie_echo_chunk);
1413 
1414 	init_cp = (struct sctp_init_chunk *)
1415 	    sctp_m_getptr(m, init_offset, sizeof(struct sctp_init_chunk),
1416 	    (uint8_t *)&init_buf);
1417 	if (init_cp == NULL) {
1418 		/* could not pull a INIT chunk in cookie */
1419 		SCTP_TCB_UNLOCK(stcb);
1420 		return (NULL);
1421 	}
1422 	if (init_cp->ch.chunk_type != SCTP_INITIATION) {
1423 		SCTP_TCB_UNLOCK(stcb);
1424 		return (NULL);
1425 	}
1426 	/*
1427 	 * find and validate the INIT-ACK chunk in the cookie (my info) the
1428 	 * INIT-ACK follows the INIT chunk
1429 	 */
1430 	initack_offset = init_offset + SCTP_SIZE32(ntohs(init_cp->ch.chunk_length));
1431 	initack_cp = (struct sctp_init_ack_chunk *)
1432 	    sctp_m_getptr(m, initack_offset, sizeof(struct sctp_init_ack_chunk),
1433 	    (uint8_t *)&initack_buf);
1434 	if (initack_cp == NULL) {
1435 		/* could not pull INIT-ACK chunk in cookie */
1436 		SCTP_TCB_UNLOCK(stcb);
1437 		return (NULL);
1438 	}
1439 	if (initack_cp->ch.chunk_type != SCTP_INITIATION_ACK) {
1440 		SCTP_TCB_UNLOCK(stcb);
1441 		return (NULL);
1442 	}
1443 	if ((ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag) &&
1444 	    (ntohl(init_cp->init.initiate_tag) == asoc->peer_vtag)) {
1445 		/*
1446 		 * case D in Section 5.2.4 Table 2: MMAA process accordingly
1447 		 * to get into the OPEN state
1448 		 */
1449 		if (ntohl(initack_cp->init.initial_tsn) != asoc->init_seq_number) {
1450 			/*-
1451 			 * Opps, this means that we somehow generated two vtag's
1452 			 * the same. I.e. we did:
1453 			 *  Us               Peer
1454 			 *   <---INIT(tag=a)------
1455 			 *   ----INIT-ACK(tag=t)-->
1456 			 *   ----INIT(tag=t)------> *1
1457 			 *   <---INIT-ACK(tag=a)---
1458 			 *   <----CE(tag=t)------------- *2
1459 			 *
1460 			 * At point *1 we should be generating a different
1461 			 * tag t'. Which means we would throw away the CE and send
1462 			 * ours instead. Basically this is case C (throw away side).
1463 			 */
1464 			if (how_indx < sizeof(asoc->cookie_how))
1465 				asoc->cookie_how[how_indx] = 17;
1466 			SCTP_TCB_UNLOCK(stcb);
1467 			return (NULL);
1468 		}
1469 		switch (SCTP_GET_STATE(stcb)) {
1470 		case SCTP_STATE_COOKIE_WAIT:
1471 		case SCTP_STATE_COOKIE_ECHOED:
1472 			/*
1473 			 * INIT was sent but got a COOKIE_ECHO with the
1474 			 * correct tags... just accept it...but we must
1475 			 * process the init so that we can make sure we have
1476 			 * the right seq no's.
1477 			 */
1478 			/* First we must process the INIT !! */
1479 			if (sctp_process_init(init_cp, stcb) < 0) {
1480 				if (how_indx < sizeof(asoc->cookie_how))
1481 					asoc->cookie_how[how_indx] = 3;
1482 				op_err = sctp_generate_cause(SCTP_CAUSE_OUT_OF_RESC, "");
1483 				SCTPDBG(SCTP_DEBUG_INPUT1, "sctp_process_init() failed\n");
1484 				sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
1485 				    src, dst, sh, op_err,
1486 				    mflowtype, mflowid,
1487 				    vrf_id, net->port);
1488 				return (NULL);
1489 			}
1490 			/* we have already processed the INIT so no problem */
1491 			sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp,
1492 			    stcb, net,
1493 			    SCTP_FROM_SCTP_INPUT + SCTP_LOC_13);
1494 			sctp_timer_stop(SCTP_TIMER_TYPE_INIT, inp,
1495 			    stcb, net,
1496 			    SCTP_FROM_SCTP_INPUT + SCTP_LOC_14);
1497 			/* update current state */
1498 			if (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)
1499 				SCTP_STAT_INCR_COUNTER32(sctps_activeestab);
1500 			else
1501 				SCTP_STAT_INCR_COUNTER32(sctps_collisionestab);
1502 
1503 			SCTP_SET_STATE(stcb, SCTP_STATE_OPEN);
1504 			if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
1505 				sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
1506 				    stcb->sctp_ep, stcb, NULL);
1507 			}
1508 			SCTP_STAT_INCR_GAUGE32(sctps_currestab);
1509 			sctp_stop_all_cookie_timers(stcb);
1510 			if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
1511 			    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
1512 			    (!SCTP_IS_LISTENING(inp))) {
1513 				/*
1514 				 * Here is where collision would go if we
1515 				 * did a connect() and instead got a
1516 				 * init/init-ack/cookie done before the
1517 				 * init-ack came back..
1518 				 */
1519 				sctp_pcb_add_flags(stcb->sctp_ep, SCTP_PCB_FLAGS_CONNECTED);
1520 				soisconnected(stcb->sctp_socket);
1521 			}
1522 			/* notify upper layer */
1523 			*notification = SCTP_NOTIFY_ASSOC_UP;
1524 			net->hb_responded = 1;
1525 			if (stcb->asoc.sctp_autoclose_ticks &&
1526 			    (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE))) {
1527 				sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE,
1528 				    inp, stcb, NULL);
1529 			}
1530 			break;
1531 		default:
1532 			/*
1533 			 * we're in the OPEN state (or beyond), so peer must
1534 			 * have simply lost the COOKIE-ACK
1535 			 */
1536 			break;
1537 		}		/* end switch */
1538 		sctp_stop_all_cookie_timers(stcb);
1539 		if ((retval = sctp_load_addresses_from_init(stcb, m,
1540 		    init_offset + sizeof(struct sctp_init_chunk),
1541 		    initack_offset, src, dst, init_src, stcb->asoc.port)) < 0) {
1542 			if (how_indx < sizeof(asoc->cookie_how))
1543 				asoc->cookie_how[how_indx] = 4;
1544 			op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
1545 			    "Problem with address parameters");
1546 			SCTPDBG(SCTP_DEBUG_INPUT1,
1547 			    "Load addresses from INIT causes an abort %d\n",
1548 			    retval);
1549 			sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
1550 			    src, dst, sh, op_err,
1551 			    mflowtype, mflowid,
1552 			    vrf_id, net->port);
1553 			return (NULL);
1554 		}
1555 		/* respond with a COOKIE-ACK */
1556 		sctp_toss_old_cookies(stcb, asoc);
1557 		sctp_send_cookie_ack(stcb);
1558 		if (how_indx < sizeof(asoc->cookie_how))
1559 			asoc->cookie_how[how_indx] = 5;
1560 		return (stcb);
1561 	}
1562 
1563 	if (ntohl(initack_cp->init.initiate_tag) != asoc->my_vtag &&
1564 	    ntohl(init_cp->init.initiate_tag) == asoc->peer_vtag &&
1565 	    cookie->tie_tag_my_vtag == 0 &&
1566 	    cookie->tie_tag_peer_vtag == 0) {
1567 		/*
1568 		 * case C in Section 5.2.4 Table 2: XMOO silently discard
1569 		 */
1570 		if (how_indx < sizeof(asoc->cookie_how))
1571 			asoc->cookie_how[how_indx] = 6;
1572 		SCTP_TCB_UNLOCK(stcb);
1573 		return (NULL);
1574 	}
1575 	/*
1576 	 * If nat support, and the below and stcb is established, send back
1577 	 * a ABORT(colliding state) if we are established.
1578 	 */
1579 	if ((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) &&
1580 	    (asoc->peer_supports_nat) &&
1581 	    ((ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag) &&
1582 	    ((ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) ||
1583 	    (asoc->peer_vtag == 0)))) {
1584 		/*
1585 		 * Special case - Peer's support nat. We may have two init's
1586 		 * that we gave out the same tag on since one was not
1587 		 * established.. i.e. we get INIT from host-1 behind the nat
1588 		 * and we respond tag-a, we get a INIT from host-2 behind
1589 		 * the nat and we get tag-a again. Then we bring up host-1
1590 		 * (or 2's) assoc, Then comes the cookie from hsot-2 (or 1).
1591 		 * Now we have colliding state. We must send an abort here
1592 		 * with colliding state indication.
1593 		 */
1594 		op_err = sctp_generate_cause(SCTP_CAUSE_NAT_COLLIDING_STATE, "");
1595 		sctp_send_abort(m, iphlen, src, dst, sh, 0, op_err,
1596 		    mflowtype, mflowid, inp->fibnum,
1597 		    vrf_id, port);
1598 		SCTP_TCB_UNLOCK(stcb);
1599 		return (NULL);
1600 	}
1601 	if ((ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag) &&
1602 	    ((ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) ||
1603 	    (asoc->peer_vtag == 0))) {
1604 		/*
1605 		 * case B in Section 5.2.4 Table 2: MXAA or MOAA my info
1606 		 * should be ok, re-accept peer info
1607 		 */
1608 		if (ntohl(initack_cp->init.initial_tsn) != asoc->init_seq_number) {
1609 			/*
1610 			 * Extension of case C. If we hit this, then the
1611 			 * random number generator returned the same vtag
1612 			 * when we first sent our INIT-ACK and when we later
1613 			 * sent our INIT. The side with the seq numbers that
1614 			 * are different will be the one that normally would
1615 			 * have hit case C. This in effect "extends" our
1616 			 * vtags in this collision case to be 64 bits. The
1617 			 * same collision could occur aka you get both vtag
1618 			 * and seq number the same twice in a row.. but is
1619 			 * much less likely. If it did happen then we would
1620 			 * proceed through and bring up the assoc.. we may
1621 			 * end up with the wrong stream setup however..
1622 			 * which would be bad.. but there is no way to
1623 			 * tell.. until we send on a stream that does not
1624 			 * exist :-)
1625 			 */
1626 			if (how_indx < sizeof(asoc->cookie_how))
1627 				asoc->cookie_how[how_indx] = 7;
1628 
1629 			SCTP_TCB_UNLOCK(stcb);
1630 			return (NULL);
1631 		}
1632 		if (how_indx < sizeof(asoc->cookie_how))
1633 			asoc->cookie_how[how_indx] = 8;
1634 		sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net,
1635 		    SCTP_FROM_SCTP_INPUT + SCTP_LOC_15);
1636 		sctp_stop_all_cookie_timers(stcb);
1637 		/*
1638 		 * since we did not send a HB make sure we don't double
1639 		 * things
1640 		 */
1641 		net->hb_responded = 1;
1642 		if (stcb->asoc.sctp_autoclose_ticks &&
1643 		    sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE)) {
1644 			sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb,
1645 			    NULL);
1646 		}
1647 		asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd);
1648 		if (asoc->pre_open_streams < asoc->streamoutcnt) {
1649 			asoc->pre_open_streams = asoc->streamoutcnt;
1650 		}
1651 
1652 		if (ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) {
1653 			/*
1654 			 * Ok the peer probably discarded our data (if we
1655 			 * echoed a cookie+data). So anything on the
1656 			 * sent_queue should be marked for retransmit, we
1657 			 * may not get something to kick us so it COULD
1658 			 * still take a timeout to move these.. but it can't
1659 			 * hurt to mark them.
1660 			 */
1661 
1662 			TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
1663 				if (chk->sent < SCTP_DATAGRAM_RESEND) {
1664 					chk->sent = SCTP_DATAGRAM_RESEND;
1665 					sctp_flight_size_decrease(chk);
1666 					sctp_total_flight_decrease(stcb, chk);
1667 					sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
1668 					spec_flag++;
1669 				}
1670 			}
1671 		}
1672 		/* process the INIT info (peer's info) */
1673 		if (sctp_process_init(init_cp, stcb) < 0) {
1674 			if (how_indx < sizeof(asoc->cookie_how))
1675 				asoc->cookie_how[how_indx] = 9;
1676 			op_err = sctp_generate_cause(SCTP_CAUSE_OUT_OF_RESC, "");
1677 			SCTPDBG(SCTP_DEBUG_INPUT1, "sctp_process_init() failed\n");
1678 			sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
1679 			    src, dst, sh, op_err,
1680 			    mflowtype, mflowid,
1681 			    vrf_id, net->port);
1682 			return (NULL);
1683 		}
1684 		if ((retval = sctp_load_addresses_from_init(stcb, m,
1685 		    init_offset + sizeof(struct sctp_init_chunk),
1686 		    initack_offset, src, dst, init_src, stcb->asoc.port)) < 0) {
1687 			if (how_indx < sizeof(asoc->cookie_how))
1688 				asoc->cookie_how[how_indx] = 10;
1689 			op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
1690 			    "Problem with address parameters");
1691 			SCTPDBG(SCTP_DEBUG_INPUT1,
1692 			    "Load addresses from INIT causes an abort %d\n",
1693 			    retval);
1694 			sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
1695 			    src, dst, sh, op_err,
1696 			    mflowtype, mflowid,
1697 			    vrf_id, net->port);
1698 			return (NULL);
1699 		}
1700 		if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) ||
1701 		    (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) {
1702 			*notification = SCTP_NOTIFY_ASSOC_UP;
1703 
1704 			if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
1705 			    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
1706 			    (!SCTP_IS_LISTENING(inp))) {
1707 				sctp_pcb_add_flags(stcb->sctp_ep, SCTP_PCB_FLAGS_CONNECTED);
1708 				soisconnected(stcb->sctp_socket);
1709 			}
1710 			if (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)
1711 				SCTP_STAT_INCR_COUNTER32(sctps_activeestab);
1712 			else
1713 				SCTP_STAT_INCR_COUNTER32(sctps_collisionestab);
1714 			SCTP_STAT_INCR_GAUGE32(sctps_currestab);
1715 		} else if (SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) {
1716 			SCTP_STAT_INCR_COUNTER32(sctps_restartestab);
1717 		} else {
1718 			SCTP_STAT_INCR_COUNTER32(sctps_collisionestab);
1719 		}
1720 		SCTP_SET_STATE(stcb, SCTP_STATE_OPEN);
1721 		if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
1722 			sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
1723 			    stcb->sctp_ep, stcb, NULL);
1724 		}
1725 		sctp_stop_all_cookie_timers(stcb);
1726 		sctp_toss_old_cookies(stcb, asoc);
1727 		sctp_send_cookie_ack(stcb);
1728 		if (spec_flag) {
1729 			/*
1730 			 * only if we have retrans set do we do this. What
1731 			 * this call does is get only the COOKIE-ACK out and
1732 			 * then when we return the normal call to
1733 			 * sctp_chunk_output will get the retrans out behind
1734 			 * this.
1735 			 */
1736 			sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_COOKIE_ACK, SCTP_SO_NOT_LOCKED);
1737 		}
1738 		if (how_indx < sizeof(asoc->cookie_how))
1739 			asoc->cookie_how[how_indx] = 11;
1740 
1741 		return (stcb);
1742 	}
1743 	if ((ntohl(initack_cp->init.initiate_tag) != asoc->my_vtag &&
1744 	    ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) &&
1745 	    cookie->tie_tag_my_vtag == asoc->my_vtag_nonce &&
1746 	    cookie->tie_tag_peer_vtag == asoc->peer_vtag_nonce &&
1747 	    cookie->tie_tag_peer_vtag != 0) {
1748 		struct sctpasochead *head;
1749 
1750 		if (asoc->peer_supports_nat) {
1751 			struct sctp_tcb *local_stcb;
1752 
1753 			/*
1754 			 * This is a gross gross hack. Just call the
1755 			 * cookie_new code since we are allowing a duplicate
1756 			 * association. I hope this works...
1757 			 */
1758 			local_stcb = sctp_process_cookie_new(m, iphlen, offset, src, dst,
1759 			    sh, cookie, cookie_len,
1760 			    inp, netp, init_src, notification,
1761 			    auth_skipped, auth_offset, auth_len,
1762 			    mflowtype, mflowid,
1763 			    vrf_id, port);
1764 			if (local_stcb == NULL) {
1765 				SCTP_TCB_UNLOCK(stcb);
1766 			}
1767 			return (local_stcb);
1768 		}
1769 		/*
1770 		 * case A in Section 5.2.4 Table 2: XXMM (peer restarted)
1771 		 */
1772 		/* temp code */
1773 		if (how_indx < sizeof(asoc->cookie_how))
1774 			asoc->cookie_how[how_indx] = 12;
1775 		sctp_stop_association_timers(stcb, false);
1776 		/* notify upper layer */
1777 		*notification = SCTP_NOTIFY_ASSOC_RESTART;
1778 		atomic_add_int(&stcb->asoc.refcnt, 1);
1779 		if ((SCTP_GET_STATE(stcb) != SCTP_STATE_OPEN) &&
1780 		    (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_RECEIVED) &&
1781 		    (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_SENT)) {
1782 			SCTP_STAT_INCR_GAUGE32(sctps_currestab);
1783 		}
1784 		if (SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) {
1785 			SCTP_STAT_INCR_GAUGE32(sctps_restartestab);
1786 		} else if (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_SENT) {
1787 			SCTP_STAT_INCR_GAUGE32(sctps_collisionestab);
1788 		}
1789 		if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
1790 			SCTP_SET_STATE(stcb, SCTP_STATE_OPEN);
1791 			sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
1792 			    stcb->sctp_ep, stcb, NULL);
1793 
1794 		} else if (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_SENT) {
1795 			/* move to OPEN state, if not in SHUTDOWN_SENT */
1796 			SCTP_SET_STATE(stcb, SCTP_STATE_OPEN);
1797 		}
1798 		if (asoc->pre_open_streams < asoc->streamoutcnt) {
1799 			asoc->pre_open_streams = asoc->streamoutcnt;
1800 		}
1801 		asoc->init_seq_number = ntohl(initack_cp->init.initial_tsn);
1802 		asoc->sending_seq = asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number;
1803 		asoc->asconf_seq_out_acked = asoc->asconf_seq_out - 1;
1804 		asoc->asconf_seq_in = asoc->last_acked_seq = asoc->init_seq_number - 1;
1805 		asoc->str_reset_seq_in = asoc->init_seq_number;
1806 		asoc->advanced_peer_ack_point = asoc->last_acked_seq;
1807 		asoc->send_sack = 1;
1808 		asoc->data_pkts_seen = 0;
1809 		asoc->last_data_chunk_from = NULL;
1810 		asoc->last_control_chunk_from = NULL;
1811 		asoc->last_net_cmt_send_started = NULL;
1812 		if (asoc->mapping_array) {
1813 			memset(asoc->mapping_array, 0,
1814 			    asoc->mapping_array_size);
1815 		}
1816 		if (asoc->nr_mapping_array) {
1817 			memset(asoc->nr_mapping_array, 0,
1818 			    asoc->mapping_array_size);
1819 		}
1820 		SCTP_TCB_UNLOCK(stcb);
1821 		SCTP_INP_INFO_WLOCK();
1822 		SCTP_INP_WLOCK(stcb->sctp_ep);
1823 		SCTP_TCB_LOCK(stcb);
1824 		atomic_subtract_int(&stcb->asoc.refcnt, 1);
1825 		/* send up all the data */
1826 		sctp_report_all_outbound(stcb, 0, SCTP_SO_LOCKED);
1827 		for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
1828 			stcb->asoc.strmout[i].chunks_on_queues = 0;
1829 #if defined(SCTP_DETAILED_STR_STATS)
1830 			for (j = 0; j < SCTP_PR_SCTP_MAX + 1; j++) {
1831 				asoc->strmout[i].abandoned_sent[j] = 0;
1832 				asoc->strmout[i].abandoned_unsent[j] = 0;
1833 			}
1834 #else
1835 			asoc->strmout[i].abandoned_sent[0] = 0;
1836 			asoc->strmout[i].abandoned_unsent[0] = 0;
1837 #endif
1838 			stcb->asoc.strmout[i].next_mid_ordered = 0;
1839 			stcb->asoc.strmout[i].next_mid_unordered = 0;
1840 			stcb->asoc.strmout[i].sid = i;
1841 			stcb->asoc.strmout[i].last_msg_incomplete = 0;
1842 		}
1843 		TAILQ_FOREACH_SAFE(strrst, &asoc->resetHead, next_resp, nstrrst) {
1844 			TAILQ_REMOVE(&asoc->resetHead, strrst, next_resp);
1845 			SCTP_FREE(strrst, SCTP_M_STRESET);
1846 		}
1847 		TAILQ_FOREACH_SAFE(sq, &asoc->pending_reply_queue, next, nsq) {
1848 			TAILQ_REMOVE(&asoc->pending_reply_queue, sq, next);
1849 			if (sq->data) {
1850 				sctp_m_freem(sq->data);
1851 				sq->data = NULL;
1852 			}
1853 			sctp_free_remote_addr(sq->whoFrom);
1854 			sq->whoFrom = NULL;
1855 			sq->stcb = NULL;
1856 			sctp_free_a_readq(stcb, sq);
1857 		}
1858 		TAILQ_FOREACH_SAFE(chk, &asoc->control_send_queue, sctp_next, nchk) {
1859 			TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
1860 			if (chk->data) {
1861 				sctp_m_freem(chk->data);
1862 				chk->data = NULL;
1863 			}
1864 			if (chk->holds_key_ref)
1865 				sctp_auth_key_release(stcb, chk->auth_keyid, SCTP_SO_LOCKED);
1866 			sctp_free_remote_addr(chk->whoTo);
1867 			SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_chunk), chk);
1868 			SCTP_DECR_CHK_COUNT();
1869 		}
1870 		asoc->ctrl_queue_cnt = 0;
1871 		asoc->str_reset = NULL;
1872 		asoc->stream_reset_outstanding = 0;
1873 		TAILQ_FOREACH_SAFE(chk, &asoc->asconf_send_queue, sctp_next, nchk) {
1874 			TAILQ_REMOVE(&asoc->asconf_send_queue, chk, sctp_next);
1875 			if (chk->data) {
1876 				sctp_m_freem(chk->data);
1877 				chk->data = NULL;
1878 			}
1879 			if (chk->holds_key_ref)
1880 				sctp_auth_key_release(stcb, chk->auth_keyid, SCTP_SO_LOCKED);
1881 			sctp_free_remote_addr(chk->whoTo);
1882 			SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_chunk), chk);
1883 			SCTP_DECR_CHK_COUNT();
1884 		}
1885 		TAILQ_FOREACH_SAFE(aparam, &asoc->asconf_queue, next, naparam) {
1886 			TAILQ_REMOVE(&asoc->asconf_queue, aparam, next);
1887 			SCTP_FREE(aparam, SCTP_M_ASC_ADDR);
1888 		}
1889 		TAILQ_FOREACH_SAFE(aack, &asoc->asconf_ack_sent, next, naack) {
1890 			TAILQ_REMOVE(&asoc->asconf_ack_sent, aack, next);
1891 			if (aack->data != NULL) {
1892 				sctp_m_freem(aack->data);
1893 			}
1894 			SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_asconf_ack), aack);
1895 		}
1896 		asoc->zero_checksum = cookie->zero_checksum;
1897 
1898 		/* process the INIT-ACK info (my info) */
1899 		asoc->my_vtag = ntohl(initack_cp->init.initiate_tag);
1900 		asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd);
1901 
1902 		/* pull from vtag hash */
1903 		LIST_REMOVE(stcb, sctp_asocs);
1904 		/* re-insert to new vtag position */
1905 		head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag,
1906 		    SCTP_BASE_INFO(hashasocmark))];
1907 		/*
1908 		 * put it in the bucket in the vtag hash of assoc's for the
1909 		 * system
1910 		 */
1911 		LIST_INSERT_HEAD(head, stcb, sctp_asocs);
1912 
1913 		SCTP_INP_WUNLOCK(stcb->sctp_ep);
1914 		SCTP_INP_INFO_WUNLOCK();
1915 		asoc->total_flight = 0;
1916 		asoc->total_flight_count = 0;
1917 		/* process the INIT info (peer's info) */
1918 		if (sctp_process_init(init_cp, stcb) < 0) {
1919 			if (how_indx < sizeof(asoc->cookie_how))
1920 				asoc->cookie_how[how_indx] = 13;
1921 			op_err = sctp_generate_cause(SCTP_CAUSE_OUT_OF_RESC, "");
1922 			SCTPDBG(SCTP_DEBUG_INPUT1, "sctp_process_init() failed\n");
1923 			sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
1924 			    src, dst, sh, op_err,
1925 			    mflowtype, mflowid,
1926 			    vrf_id, net->port);
1927 			return (NULL);
1928 		}
1929 		/*
1930 		 * since we did not send a HB make sure we don't double
1931 		 * things
1932 		 */
1933 		net->hb_responded = 1;
1934 
1935 		if ((retval = sctp_load_addresses_from_init(stcb, m,
1936 		    init_offset + sizeof(struct sctp_init_chunk),
1937 		    initack_offset, src, dst, init_src, stcb->asoc.port)) < 0) {
1938 			if (how_indx < sizeof(asoc->cookie_how))
1939 				asoc->cookie_how[how_indx] = 14;
1940 			op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
1941 			    "Problem with address parameters");
1942 			SCTPDBG(SCTP_DEBUG_INPUT1,
1943 			    "Load addresses from INIT causes an abort %d\n",
1944 			    retval);
1945 			sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
1946 			    src, dst, sh, op_err,
1947 			    mflowtype, mflowid,
1948 			    vrf_id, net->port);
1949 			return (NULL);
1950 		}
1951 		/* respond with a COOKIE-ACK */
1952 		sctp_send_cookie_ack(stcb);
1953 		if (how_indx < sizeof(asoc->cookie_how))
1954 			asoc->cookie_how[how_indx] = 15;
1955 		if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE) &&
1956 		    (asoc->sctp_autoclose_ticks > 0)) {
1957 			sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb, NULL);
1958 		}
1959 		return (stcb);
1960 	}
1961 	if (how_indx < sizeof(asoc->cookie_how))
1962 		asoc->cookie_how[how_indx] = 16;
1963 	/* all other cases... */
1964 	SCTP_TCB_UNLOCK(stcb);
1965 	return (NULL);
1966 }
1967 
1968 /*
1969  * handle a state cookie for a new association m: input packet mbuf chain--
1970  * assumes a pullup on IP/SCTP/COOKIE-ECHO chunk note: this is a "split" mbuf
1971  * and the cookie signature does not exist offset: offset into mbuf to the
1972  * cookie-echo chunk length: length of the cookie chunk to: where the init
1973  * was from returns a new TCB
1974  */
1975 static struct sctp_tcb *
1976 sctp_process_cookie_new(struct mbuf *m, int iphlen, int offset,
1977     struct sockaddr *src, struct sockaddr *dst,
1978     struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len,
1979     struct sctp_inpcb *inp, struct sctp_nets **netp,
1980     struct sockaddr *init_src, int *notification,
1981     int auth_skipped, uint32_t auth_offset, uint32_t auth_len,
1982     uint8_t mflowtype, uint32_t mflowid,
1983     uint32_t vrf_id, uint16_t port)
1984 {
1985 	struct sctp_tcb *stcb;
1986 	struct sctp_init_chunk *init_cp, init_buf;
1987 	struct sctp_init_ack_chunk *initack_cp, initack_buf;
1988 	union sctp_sockstore store;
1989 	struct sctp_association *asoc;
1990 	int init_offset, initack_offset, initack_limit;
1991 	int error = 0;
1992 	uint8_t auth_chunk_buf[SCTP_CHUNK_BUFFER_SIZE];
1993 
1994 	/*
1995 	 * find and validate the INIT chunk in the cookie (peer's info) the
1996 	 * INIT should start after the cookie-echo header struct (chunk
1997 	 * header, state cookie header struct)
1998 	 */
1999 	init_offset = offset + sizeof(struct sctp_cookie_echo_chunk);
2000 	init_cp = (struct sctp_init_chunk *)
2001 	    sctp_m_getptr(m, init_offset, sizeof(struct sctp_init_chunk),
2002 	    (uint8_t *)&init_buf);
2003 	if (init_cp == NULL) {
2004 		/* could not pull a INIT chunk in cookie */
2005 		SCTPDBG(SCTP_DEBUG_INPUT1,
2006 		    "process_cookie_new: could not pull INIT chunk hdr\n");
2007 		return (NULL);
2008 	}
2009 	if (init_cp->ch.chunk_type != SCTP_INITIATION) {
2010 		SCTPDBG(SCTP_DEBUG_INPUT1, "HUH? process_cookie_new: could not find INIT chunk!\n");
2011 		return (NULL);
2012 	}
2013 	initack_offset = init_offset + SCTP_SIZE32(ntohs(init_cp->ch.chunk_length));
2014 	/*
2015 	 * find and validate the INIT-ACK chunk in the cookie (my info) the
2016 	 * INIT-ACK follows the INIT chunk
2017 	 */
2018 	initack_cp = (struct sctp_init_ack_chunk *)
2019 	    sctp_m_getptr(m, initack_offset, sizeof(struct sctp_init_ack_chunk),
2020 	    (uint8_t *)&initack_buf);
2021 	if (initack_cp == NULL) {
2022 		/* could not pull INIT-ACK chunk in cookie */
2023 		SCTPDBG(SCTP_DEBUG_INPUT1, "process_cookie_new: could not pull INIT-ACK chunk hdr\n");
2024 		return (NULL);
2025 	}
2026 	if (initack_cp->ch.chunk_type != SCTP_INITIATION_ACK) {
2027 		return (NULL);
2028 	}
2029 	/*
2030 	 * NOTE: We can't use the INIT_ACK's chk_length to determine the
2031 	 * "initack_limit" value.  This is because the chk_length field
2032 	 * includes the length of the cookie, but the cookie is omitted when
2033 	 * the INIT and INIT_ACK are tacked onto the cookie...
2034 	 */
2035 	initack_limit = offset + cookie_len;
2036 
2037 	/*
2038 	 * now that we know the INIT/INIT-ACK are in place, create a new TCB
2039 	 * and populate
2040 	 */
2041 
2042 	/*
2043 	 * Here we do a trick, we set in NULL for the proc/thread argument.
2044 	 * We do this since in effect we only use the p argument when the
2045 	 * socket is unbound and we must do an implicit bind. Since we are
2046 	 * getting a cookie, we cannot be unbound.
2047 	 */
2048 	stcb = sctp_aloc_assoc(inp, init_src, &error,
2049 	    ntohl(initack_cp->init.initiate_tag),
2050 	    ntohl(initack_cp->init.initial_tsn), vrf_id,
2051 	    ntohs(initack_cp->init.num_outbound_streams),
2052 	    port,
2053 	    (struct thread *)NULL,
2054 	    SCTP_DONT_INITIALIZE_AUTH_PARAMS);
2055 	if (stcb == NULL) {
2056 		struct mbuf *op_err;
2057 
2058 		/* memory problem? */
2059 		SCTPDBG(SCTP_DEBUG_INPUT1,
2060 		    "process_cookie_new: no room for another TCB!\n");
2061 		op_err = sctp_generate_cause(SCTP_CAUSE_OUT_OF_RESC, "");
2062 		sctp_abort_association(inp, (struct sctp_tcb *)NULL, m, iphlen,
2063 		    src, dst, sh, op_err,
2064 		    mflowtype, mflowid,
2065 		    vrf_id, port);
2066 		return (NULL);
2067 	}
2068 	asoc = &stcb->asoc;
2069 	/* get scope variables out of cookie */
2070 	asoc->scope.ipv4_local_scope = cookie->ipv4_scope;
2071 	asoc->scope.site_scope = cookie->site_scope;
2072 	asoc->scope.local_scope = cookie->local_scope;
2073 	asoc->scope.loopback_scope = cookie->loopback_scope;
2074 
2075 	if ((asoc->scope.ipv4_addr_legal != cookie->ipv4_addr_legal) ||
2076 	    (asoc->scope.ipv6_addr_legal != cookie->ipv6_addr_legal)) {
2077 		struct mbuf *op_err;
2078 
2079 		/*
2080 		 * Houston we have a problem. The EP changed while the
2081 		 * cookie was in flight. Only recourse is to abort the
2082 		 * association.
2083 		 */
2084 		op_err = sctp_generate_cause(SCTP_CAUSE_OUT_OF_RESC, "");
2085 		sctp_abort_association(inp, (struct sctp_tcb *)NULL, m, iphlen,
2086 		    src, dst, sh, op_err,
2087 		    mflowtype, mflowid,
2088 		    vrf_id, port);
2089 		(void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
2090 		    SCTP_FROM_SCTP_INPUT + SCTP_LOC_18);
2091 		return (NULL);
2092 	}
2093 	asoc->zero_checksum = cookie->zero_checksum;
2094 	/* process the INIT-ACK info (my info) */
2095 	asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd);
2096 
2097 	/* process the INIT info (peer's info) */
2098 	if (sctp_process_init(init_cp, stcb) < 0) {
2099 		(void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
2100 		    SCTP_FROM_SCTP_INPUT + SCTP_LOC_19);
2101 		return (NULL);
2102 	}
2103 	/* load all addresses */
2104 	if (sctp_load_addresses_from_init(stcb, m,
2105 	    init_offset + sizeof(struct sctp_init_chunk),
2106 	    initack_offset, src, dst, init_src, port) < 0) {
2107 		(void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
2108 		    SCTP_FROM_SCTP_INPUT + SCTP_LOC_20);
2109 		return (NULL);
2110 	}
2111 	/*
2112 	 * verify any preceding AUTH chunk that was skipped
2113 	 */
2114 	/* pull the local authentication parameters from the cookie/init-ack */
2115 	sctp_auth_get_cookie_params(stcb, m,
2116 	    initack_offset + sizeof(struct sctp_init_ack_chunk),
2117 	    initack_limit - (initack_offset + sizeof(struct sctp_init_ack_chunk)));
2118 	if (auth_skipped) {
2119 		struct sctp_auth_chunk *auth;
2120 
2121 		if (auth_len <= SCTP_CHUNK_BUFFER_SIZE) {
2122 			auth = (struct sctp_auth_chunk *)sctp_m_getptr(m, auth_offset, auth_len, auth_chunk_buf);
2123 		} else {
2124 			auth = NULL;
2125 		}
2126 		if ((auth == NULL) || sctp_handle_auth(stcb, auth, m, auth_offset)) {
2127 			/* auth HMAC failed, dump the assoc and packet */
2128 			SCTPDBG(SCTP_DEBUG_AUTH1,
2129 			    "COOKIE-ECHO: AUTH failed\n");
2130 			(void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
2131 			    SCTP_FROM_SCTP_INPUT + SCTP_LOC_21);
2132 			return (NULL);
2133 		} else {
2134 			/* remaining chunks checked... good to go */
2135 			stcb->asoc.authenticated = 1;
2136 		}
2137 	}
2138 
2139 	/*
2140 	 * if we're doing ASCONFs, check to see if we have any new local
2141 	 * addresses that need to get added to the peer (eg. addresses
2142 	 * changed while cookie echo in flight).  This needs to be done
2143 	 * after we go to the OPEN state to do the correct asconf
2144 	 * processing. else, make sure we have the correct addresses in our
2145 	 * lists
2146 	 */
2147 
2148 	/* warning, we re-use sin, sin6, sa_store here! */
2149 	/* pull in local_address (our "from" address) */
2150 	switch (cookie->laddr_type) {
2151 #ifdef INET
2152 	case SCTP_IPV4_ADDRESS:
2153 		/* source addr is IPv4 */
2154 		memset(&store.sin, 0, sizeof(struct sockaddr_in));
2155 		store.sin.sin_family = AF_INET;
2156 		store.sin.sin_len = sizeof(struct sockaddr_in);
2157 		store.sin.sin_addr.s_addr = cookie->laddress[0];
2158 		break;
2159 #endif
2160 #ifdef INET6
2161 	case SCTP_IPV6_ADDRESS:
2162 		/* source addr is IPv6 */
2163 		memset(&store.sin6, 0, sizeof(struct sockaddr_in6));
2164 		store.sin6.sin6_family = AF_INET6;
2165 		store.sin6.sin6_len = sizeof(struct sockaddr_in6);
2166 		store.sin6.sin6_scope_id = cookie->scope_id;
2167 		memcpy(&store.sin6.sin6_addr, cookie->laddress, sizeof(struct in6_addr));
2168 		break;
2169 #endif
2170 	default:
2171 		(void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
2172 		    SCTP_FROM_SCTP_INPUT + SCTP_LOC_22);
2173 		return (NULL);
2174 	}
2175 
2176 	/* update current state */
2177 	SCTPDBG(SCTP_DEBUG_INPUT2, "moving to OPEN state\n");
2178 	SCTP_SET_STATE(stcb, SCTP_STATE_OPEN);
2179 	if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
2180 		sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
2181 		    stcb->sctp_ep, stcb, NULL);
2182 	}
2183 	sctp_stop_all_cookie_timers(stcb);
2184 	SCTP_STAT_INCR_COUNTER32(sctps_passiveestab);
2185 	SCTP_STAT_INCR_GAUGE32(sctps_currestab);
2186 
2187 	/* set up to notify upper layer */
2188 	*notification = SCTP_NOTIFY_ASSOC_UP;
2189 	if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
2190 	    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
2191 	    (!SCTP_IS_LISTENING(inp))) {
2192 		/*
2193 		 * This is an endpoint that called connect() how it got a
2194 		 * cookie that is NEW is a bit of a mystery. It must be that
2195 		 * the INIT was sent, but before it got there.. a complete
2196 		 * INIT/INIT-ACK/COOKIE arrived. But of course then it
2197 		 * should have went to the other code.. not here.. oh well..
2198 		 * a bit of protection is worth having..
2199 		 *
2200 		 * XXXMJ unlocked
2201 		 */
2202 		sctp_pcb_add_flags(stcb->sctp_ep, SCTP_PCB_FLAGS_CONNECTED);
2203 		soisconnected(stcb->sctp_socket);
2204 	} else if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
2205 	    (SCTP_IS_LISTENING(inp))) {
2206 		/*
2207 		 * We don't want to do anything with this one. Since it is
2208 		 * the listening guy. The timer will get started for
2209 		 * accepted connections in the caller.
2210 		 */
2211 		;
2212 	}
2213 	if (stcb->asoc.sctp_autoclose_ticks &&
2214 	    sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE)) {
2215 		sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb, NULL);
2216 	}
2217 	(void)SCTP_GETTIME_TIMEVAL(&stcb->asoc.time_entered);
2218 	*netp = sctp_findnet(stcb, init_src);
2219 	if (*netp != NULL) {
2220 		/*
2221 		 * Since we did not send a HB, make sure we don't double
2222 		 * things.
2223 		 */
2224 		(*netp)->hb_responded = 1;
2225 	}
2226 	/* respond with a COOKIE-ACK */
2227 	sctp_send_cookie_ack(stcb);
2228 
2229 	/*
2230 	 * check the address lists for any ASCONFs that need to be sent
2231 	 * AFTER the cookie-ack is sent
2232 	 */
2233 	sctp_check_address_list(stcb, m,
2234 	    initack_offset + sizeof(struct sctp_init_ack_chunk),
2235 	    initack_limit - (initack_offset + sizeof(struct sctp_init_ack_chunk)),
2236 	    &store.sa, cookie->local_scope, cookie->site_scope,
2237 	    cookie->ipv4_scope, cookie->loopback_scope);
2238 
2239 	return (stcb);
2240 }
2241 
2242 /*
2243  * CODE LIKE THIS NEEDS TO RUN IF the peer supports the NAT extension, i.e
2244  * we NEED to make sure we are not already using the vtag. If so we
2245  * need to send back an ABORT-TRY-AGAIN-WITH-NEW-TAG No middle box bit!
2246 	head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(tag,
2247 							    SCTP_BASE_INFO(hashasocmark))];
2248 	LIST_FOREACH(stcb, head, sctp_asocs) {
2249 	        if ((stcb->asoc.my_vtag == tag) && (stcb->rport == rport) && (inp == stcb->sctp_ep)) {
2250 		       -- SEND ABORT - TRY AGAIN --
2251 		}
2252 	}
2253 */
2254 
2255 /*
2256  * handles a COOKIE-ECHO message stcb: modified to either a new or left as
2257  * existing (non-NULL) TCB
2258  */
2259 static struct mbuf *
2260 sctp_handle_cookie_echo(struct mbuf *m, int iphlen, int offset,
2261     struct sockaddr *src, struct sockaddr *dst,
2262     struct sctphdr *sh, struct sctp_cookie_echo_chunk *cp,
2263     struct sctp_inpcb **inp_p, struct sctp_tcb **stcb, struct sctp_nets **netp,
2264     int auth_skipped, uint32_t auth_offset, uint32_t auth_len,
2265     struct sctp_tcb **locked_tcb,
2266     uint8_t mflowtype, uint32_t mflowid,
2267     uint32_t vrf_id, uint16_t port)
2268 {
2269 	struct sctp_state_cookie *cookie;
2270 	struct sctp_tcb *l_stcb = *stcb;
2271 	struct sctp_inpcb *l_inp;
2272 	struct sockaddr *to;
2273 	struct sctp_pcb *ep;
2274 	struct mbuf *m_sig;
2275 	uint8_t calc_sig[SCTP_SIGNATURE_SIZE], tmp_sig[SCTP_SIGNATURE_SIZE];
2276 	uint8_t *sig;
2277 	uint8_t cookie_ok = 0;
2278 	unsigned int sig_offset, cookie_offset;
2279 	unsigned int cookie_len;
2280 	struct timeval now;
2281 	struct timeval time_entered, time_expires;
2282 	int notification = 0;
2283 	struct sctp_nets *netl;
2284 	int had_a_existing_tcb = 0;
2285 	int send_int_conf = 0;
2286 #ifdef INET
2287 	struct sockaddr_in sin;
2288 #endif
2289 #ifdef INET6
2290 	struct sockaddr_in6 sin6;
2291 #endif
2292 
2293 	SCTPDBG(SCTP_DEBUG_INPUT2,
2294 	    "sctp_handle_cookie: handling COOKIE-ECHO\n");
2295 
2296 	if (inp_p == NULL) {
2297 		return (NULL);
2298 	}
2299 	cookie = &cp->cookie;
2300 	cookie_offset = offset + sizeof(struct sctp_chunkhdr);
2301 	cookie_len = ntohs(cp->ch.chunk_length);
2302 
2303 	if (cookie_len < sizeof(struct sctp_cookie_echo_chunk) +
2304 	    sizeof(struct sctp_init_chunk) +
2305 	    sizeof(struct sctp_init_ack_chunk) + SCTP_SIGNATURE_SIZE) {
2306 		/* cookie too small */
2307 		return (NULL);
2308 	}
2309 	if ((cookie->peerport != sh->src_port) ||
2310 	    (cookie->myport != sh->dest_port) ||
2311 	    (cookie->my_vtag != sh->v_tag)) {
2312 		/*
2313 		 * invalid ports or bad tag.  Note that we always leave the
2314 		 * v_tag in the header in network order and when we stored
2315 		 * it in the my_vtag slot we also left it in network order.
2316 		 * This maintains the match even though it may be in the
2317 		 * opposite byte order of the machine :->
2318 		 */
2319 		return (NULL);
2320 	}
2321 	/*
2322 	 * split off the signature into its own mbuf (since it should not be
2323 	 * calculated in the sctp_hmac_m() call).
2324 	 */
2325 	sig_offset = offset + cookie_len - SCTP_SIGNATURE_SIZE;
2326 	m_sig = m_split(m, sig_offset, M_NOWAIT);
2327 	if (m_sig == NULL) {
2328 		/* out of memory or ?? */
2329 		return (NULL);
2330 	}
2331 #ifdef SCTP_MBUF_LOGGING
2332 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
2333 		sctp_log_mbc(m_sig, SCTP_MBUF_SPLIT);
2334 	}
2335 #endif
2336 
2337 	/*
2338 	 * compute the signature/digest for the cookie
2339 	 */
2340 	if (l_stcb != NULL) {
2341 		atomic_add_int(&l_stcb->asoc.refcnt, 1);
2342 		SCTP_TCB_UNLOCK(l_stcb);
2343 	}
2344 	l_inp = *inp_p;
2345 	SCTP_INP_RLOCK(l_inp);
2346 	if (l_stcb != NULL) {
2347 		SCTP_TCB_LOCK(l_stcb);
2348 		atomic_subtract_int(&l_stcb->asoc.refcnt, 1);
2349 	}
2350 	if (l_inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE | SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
2351 		SCTP_INP_RUNLOCK(l_inp);
2352 		sctp_m_freem(m_sig);
2353 		return (NULL);
2354 	}
2355 	ep = &(*inp_p)->sctp_ep;
2356 	/* which cookie is it? */
2357 	if ((cookie->time_entered.tv_sec < (long)ep->time_of_secret_change) &&
2358 	    (ep->current_secret_number != ep->last_secret_number)) {
2359 		/* it's the old cookie */
2360 		(void)sctp_hmac_m(SCTP_HMAC,
2361 		    (uint8_t *)ep->secret_key[(int)ep->last_secret_number],
2362 		    SCTP_SECRET_SIZE, m, cookie_offset, calc_sig, 0);
2363 	} else {
2364 		/* it's the current cookie */
2365 		(void)sctp_hmac_m(SCTP_HMAC,
2366 		    (uint8_t *)ep->secret_key[(int)ep->current_secret_number],
2367 		    SCTP_SECRET_SIZE, m, cookie_offset, calc_sig, 0);
2368 	}
2369 	/* get the signature */
2370 	SCTP_INP_RUNLOCK(l_inp);
2371 	sig = (uint8_t *)sctp_m_getptr(m_sig, 0, SCTP_SIGNATURE_SIZE, (uint8_t *)&tmp_sig);
2372 	if (sig == NULL) {
2373 		/* couldn't find signature */
2374 		sctp_m_freem(m_sig);
2375 		return (NULL);
2376 	}
2377 	/* compare the received digest with the computed digest */
2378 	if (timingsafe_bcmp(calc_sig, sig, SCTP_SIGNATURE_SIZE) != 0) {
2379 		/* try the old cookie? */
2380 		if ((cookie->time_entered.tv_sec == (long)ep->time_of_secret_change) &&
2381 		    (ep->current_secret_number != ep->last_secret_number)) {
2382 			/* compute digest with old */
2383 			(void)sctp_hmac_m(SCTP_HMAC,
2384 			    (uint8_t *)ep->secret_key[(int)ep->last_secret_number],
2385 			    SCTP_SECRET_SIZE, m, cookie_offset, calc_sig, 0);
2386 			/* compare */
2387 			if (timingsafe_bcmp(calc_sig, sig, SCTP_SIGNATURE_SIZE) == 0)
2388 				cookie_ok = 1;
2389 		}
2390 	} else {
2391 		cookie_ok = 1;
2392 	}
2393 
2394 	/*
2395 	 * Now before we continue we must reconstruct our mbuf so that
2396 	 * normal processing of any other chunks will work.
2397 	 */
2398 	{
2399 		struct mbuf *m_at;
2400 
2401 		m_at = m;
2402 		while (SCTP_BUF_NEXT(m_at) != NULL) {
2403 			m_at = SCTP_BUF_NEXT(m_at);
2404 		}
2405 		SCTP_BUF_NEXT(m_at) = m_sig;
2406 	}
2407 
2408 	if (cookie_ok == 0) {
2409 		SCTPDBG(SCTP_DEBUG_INPUT2, "handle_cookie_echo: cookie signature validation failed!\n");
2410 		SCTPDBG(SCTP_DEBUG_INPUT2,
2411 		    "offset = %u, cookie_offset = %u, sig_offset = %u\n",
2412 		    (uint32_t)offset, cookie_offset, sig_offset);
2413 		return (NULL);
2414 	}
2415 
2416 	if (sctp_ticks_to_msecs(cookie->cookie_life) > SCTP_MAX_COOKIE_LIFE) {
2417 		SCTPDBG(SCTP_DEBUG_INPUT2, "handle_cookie_echo: Invalid cookie lifetime\n");
2418 		return (NULL);
2419 	}
2420 	time_entered.tv_sec = cookie->time_entered.tv_sec;
2421 	time_entered.tv_usec = cookie->time_entered.tv_usec;
2422 	if ((time_entered.tv_sec < 0) ||
2423 	    (time_entered.tv_usec < 0) ||
2424 	    (time_entered.tv_usec >= 1000000)) {
2425 		/* Invalid time stamp. Cookie must have been modified. */
2426 		SCTPDBG(SCTP_DEBUG_INPUT2, "handle_cookie_echo: Invalid time stamp\n");
2427 		return (NULL);
2428 	}
2429 	(void)SCTP_GETTIME_TIMEVAL(&now);
2430 	if (timevalcmp(&now, &time_entered, <)) {
2431 		SCTPDBG(SCTP_DEBUG_INPUT2, "handle_cookie_echo: cookie generated in the future!\n");
2432 		return (NULL);
2433 	}
2434 	/*
2435 	 * Check the cookie timestamps to be sure it's not stale.
2436 	 * cookie_life is in ticks, so we convert to seconds.
2437 	 */
2438 	time_expires.tv_sec = time_entered.tv_sec + sctp_ticks_to_secs(cookie->cookie_life);
2439 	time_expires.tv_usec = time_entered.tv_usec;
2440 	if (timevalcmp(&now, &time_expires, >)) {
2441 		/* cookie is stale! */
2442 		struct mbuf *op_err;
2443 		struct sctp_error_stale_cookie *cause;
2444 		struct timeval diff;
2445 		uint32_t staleness;
2446 
2447 		op_err = sctp_get_mbuf_for_msg(sizeof(struct sctp_error_stale_cookie),
2448 		    0, M_NOWAIT, 1, MT_DATA);
2449 		if (op_err == NULL) {
2450 			/* FOOBAR */
2451 			return (NULL);
2452 		}
2453 		/* Set the len */
2454 		SCTP_BUF_LEN(op_err) = sizeof(struct sctp_error_stale_cookie);
2455 		cause = mtod(op_err, struct sctp_error_stale_cookie *);
2456 		cause->cause.code = htons(SCTP_CAUSE_STALE_COOKIE);
2457 		cause->cause.length = htons(sizeof(struct sctp_error_stale_cookie));
2458 		diff = now;
2459 		timevalsub(&diff, &time_expires);
2460 		if ((uint32_t)diff.tv_sec > UINT32_MAX / 1000000) {
2461 			staleness = UINT32_MAX;
2462 		} else {
2463 			staleness = (uint32_t)diff.tv_sec * 1000000;
2464 		}
2465 		if (UINT32_MAX - staleness >= (uint32_t)diff.tv_usec) {
2466 			staleness += (uint32_t)diff.tv_usec;
2467 		} else {
2468 			staleness = UINT32_MAX;
2469 		}
2470 		cause->stale_time = htonl(staleness);
2471 		sctp_send_operr_to(src, dst, sh, cookie->peers_vtag, op_err,
2472 		    mflowtype, mflowid, l_inp->fibnum,
2473 		    vrf_id, port);
2474 		return (NULL);
2475 	}
2476 	/*
2477 	 * Now we must see with the lookup address if we have an existing
2478 	 * asoc. This will only happen if we were in the COOKIE-WAIT state
2479 	 * and a INIT collided with us and somewhere the peer sent the
2480 	 * cookie on another address besides the single address our assoc
2481 	 * had for him. In this case we will have one of the tie-tags set at
2482 	 * least AND the address field in the cookie can be used to look it
2483 	 * up.
2484 	 */
2485 	to = NULL;
2486 	switch (cookie->addr_type) {
2487 #ifdef INET6
2488 	case SCTP_IPV6_ADDRESS:
2489 		memset(&sin6, 0, sizeof(sin6));
2490 		sin6.sin6_family = AF_INET6;
2491 		sin6.sin6_len = sizeof(sin6);
2492 		sin6.sin6_port = sh->src_port;
2493 		sin6.sin6_scope_id = cookie->scope_id;
2494 		memcpy(&sin6.sin6_addr.s6_addr, cookie->address,
2495 		    sizeof(sin6.sin6_addr.s6_addr));
2496 		to = (struct sockaddr *)&sin6;
2497 		break;
2498 #endif
2499 #ifdef INET
2500 	case SCTP_IPV4_ADDRESS:
2501 		memset(&sin, 0, sizeof(sin));
2502 		sin.sin_family = AF_INET;
2503 		sin.sin_len = sizeof(sin);
2504 		sin.sin_port = sh->src_port;
2505 		sin.sin_addr.s_addr = cookie->address[0];
2506 		to = (struct sockaddr *)&sin;
2507 		break;
2508 #endif
2509 	default:
2510 		/* This should not happen */
2511 		return (NULL);
2512 	}
2513 	if (*stcb == NULL) {
2514 		/* Yep, lets check */
2515 		*stcb = sctp_findassociation_ep_addr(inp_p, to, netp, dst, NULL);
2516 		if (*stcb == NULL) {
2517 			/*
2518 			 * We should have only got back the same inp. If we
2519 			 * got back a different ep we have a problem. The
2520 			 * original findep got back l_inp and now
2521 			 */
2522 			if (l_inp != *inp_p) {
2523 				SCTP_PRINTF("Bad problem find_ep got a diff inp then special_locate?\n");
2524 			}
2525 		} else {
2526 			if (*locked_tcb == NULL) {
2527 				/*
2528 				 * In this case we found the assoc only
2529 				 * after we locked the create lock. This
2530 				 * means we are in a colliding case and we
2531 				 * must make sure that we unlock the tcb if
2532 				 * its one of the cases where we throw away
2533 				 * the incoming packets.
2534 				 */
2535 				*locked_tcb = *stcb;
2536 
2537 				/*
2538 				 * We must also increment the inp ref count
2539 				 * since the ref_count flags was set when we
2540 				 * did not find the TCB, now we found it
2541 				 * which reduces the refcount.. we must
2542 				 * raise it back out to balance it all :-)
2543 				 */
2544 				SCTP_INP_INCR_REF((*stcb)->sctp_ep);
2545 				if ((*stcb)->sctp_ep != l_inp) {
2546 					SCTP_PRINTF("Huh? ep:%p diff then l_inp:%p?\n",
2547 					    (void *)(*stcb)->sctp_ep, (void *)l_inp);
2548 				}
2549 			}
2550 		}
2551 	}
2552 
2553 	cookie_len -= SCTP_SIGNATURE_SIZE;
2554 	if (*stcb == NULL) {
2555 		/* this is the "normal" case... get a new TCB */
2556 		*stcb = sctp_process_cookie_new(m, iphlen, offset, src, dst, sh,
2557 		    cookie, cookie_len, *inp_p,
2558 		    netp, to, &notification,
2559 		    auth_skipped, auth_offset, auth_len,
2560 		    mflowtype, mflowid,
2561 		    vrf_id, port);
2562 	} else {
2563 		/* this is abnormal... cookie-echo on existing TCB */
2564 		had_a_existing_tcb = 1;
2565 		*stcb = sctp_process_cookie_existing(m, iphlen, offset,
2566 		    src, dst, sh,
2567 		    cookie, cookie_len, *inp_p, *stcb, netp, to,
2568 		    &notification, auth_skipped, auth_offset, auth_len,
2569 		    mflowtype, mflowid,
2570 		    vrf_id, port);
2571 		if (*stcb == NULL) {
2572 			*locked_tcb = NULL;
2573 		}
2574 	}
2575 
2576 	if (*stcb == NULL) {
2577 		/* still no TCB... must be bad cookie-echo */
2578 		return (NULL);
2579 	}
2580 	if (*netp != NULL) {
2581 		(*netp)->flowtype = mflowtype;
2582 		(*netp)->flowid = mflowid;
2583 	}
2584 	/*
2585 	 * Ok, we built an association so confirm the address we sent the
2586 	 * INIT-ACK to.
2587 	 */
2588 	netl = sctp_findnet(*stcb, to);
2589 	/*
2590 	 * This code should in theory NOT run but
2591 	 */
2592 	if (netl == NULL) {
2593 		/* TSNH! Huh, why do I need to add this address here? */
2594 		if (sctp_add_remote_addr(*stcb, to, NULL, port,
2595 		    SCTP_DONOT_SETSCOPE, SCTP_IN_COOKIE_PROC)) {
2596 			return (NULL);
2597 		}
2598 		netl = sctp_findnet(*stcb, to);
2599 	}
2600 	if (netl) {
2601 		if (netl->dest_state & SCTP_ADDR_UNCONFIRMED) {
2602 			netl->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
2603 			(void)sctp_set_primary_addr((*stcb), (struct sockaddr *)NULL,
2604 			    netl);
2605 			send_int_conf = 1;
2606 		}
2607 	}
2608 	sctp_start_net_timers(*stcb);
2609 	if ((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) {
2610 		if (!had_a_existing_tcb ||
2611 		    (((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0)) {
2612 			/*
2613 			 * If we have a NEW cookie or the connect never
2614 			 * reached the connected state during collision we
2615 			 * must do the TCP accept thing.
2616 			 */
2617 			struct socket *so, *oso;
2618 			struct sctp_inpcb *inp;
2619 
2620 			if (notification == SCTP_NOTIFY_ASSOC_RESTART) {
2621 				/*
2622 				 * For a restart we will keep the same
2623 				 * socket, no need to do anything. I THINK!!
2624 				 */
2625 				sctp_ulp_notify(notification, *stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
2626 				if (send_int_conf) {
2627 					sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
2628 					    (*stcb), 0, (void *)netl, SCTP_SO_NOT_LOCKED);
2629 				}
2630 				return (m);
2631 			}
2632 			oso = (*inp_p)->sctp_socket;
2633 			atomic_add_int(&(*stcb)->asoc.refcnt, 1);
2634 			SCTP_TCB_UNLOCK((*stcb));
2635 			CURVNET_SET(oso->so_vnet);
2636 			so = sonewconn(oso, 0
2637 			    );
2638 			CURVNET_RESTORE();
2639 			SCTP_TCB_LOCK((*stcb));
2640 			atomic_subtract_int(&(*stcb)->asoc.refcnt, 1);
2641 
2642 			if (so == NULL) {
2643 				struct mbuf *op_err;
2644 
2645 				/* Too many sockets */
2646 				SCTPDBG(SCTP_DEBUG_INPUT1, "process_cookie_new: no room for another socket!\n");
2647 				op_err = sctp_generate_cause(SCTP_CAUSE_OUT_OF_RESC, "");
2648 				sctp_abort_association(*inp_p, NULL, m, iphlen,
2649 				    src, dst, sh, op_err,
2650 				    mflowtype, mflowid,
2651 				    vrf_id, port);
2652 				(void)sctp_free_assoc(*inp_p, *stcb, SCTP_NORMAL_PROC,
2653 				    SCTP_FROM_SCTP_INPUT + SCTP_LOC_23);
2654 				return (NULL);
2655 			}
2656 			inp = (struct sctp_inpcb *)so->so_pcb;
2657 			SCTP_INP_INCR_REF(inp);
2658 			/*
2659 			 * We add the unbound flag here so that if we get an
2660 			 * soabort() before we get the move_pcb done, we
2661 			 * will properly cleanup.
2662 			 */
2663 			inp->sctp_flags = (SCTP_PCB_FLAGS_TCPTYPE |
2664 			    SCTP_PCB_FLAGS_CONNECTED |
2665 			    SCTP_PCB_FLAGS_IN_TCPPOOL |
2666 			    SCTP_PCB_FLAGS_UNBOUND |
2667 			    (SCTP_PCB_COPY_FLAGS & (*inp_p)->sctp_flags) |
2668 			    SCTP_PCB_FLAGS_DONT_WAKE);
2669 			inp->sctp_features = (*inp_p)->sctp_features;
2670 			inp->sctp_mobility_features = (*inp_p)->sctp_mobility_features;
2671 			inp->sctp_socket = so;
2672 			inp->sctp_frag_point = (*inp_p)->sctp_frag_point;
2673 			inp->max_cwnd = (*inp_p)->max_cwnd;
2674 			inp->sctp_cmt_on_off = (*inp_p)->sctp_cmt_on_off;
2675 			inp->ecn_supported = (*inp_p)->ecn_supported;
2676 			inp->prsctp_supported = (*inp_p)->prsctp_supported;
2677 			inp->auth_supported = (*inp_p)->auth_supported;
2678 			inp->asconf_supported = (*inp_p)->asconf_supported;
2679 			inp->reconfig_supported = (*inp_p)->reconfig_supported;
2680 			inp->nrsack_supported = (*inp_p)->nrsack_supported;
2681 			inp->pktdrop_supported = (*inp_p)->pktdrop_supported;
2682 			inp->partial_delivery_point = (*inp_p)->partial_delivery_point;
2683 			inp->sctp_context = (*inp_p)->sctp_context;
2684 			inp->local_strreset_support = (*inp_p)->local_strreset_support;
2685 			inp->fibnum = (*inp_p)->fibnum;
2686 			/*
2687 			 * copy in the authentication parameters from the
2688 			 * original endpoint
2689 			 */
2690 			if (inp->sctp_ep.local_hmacs)
2691 				sctp_free_hmaclist(inp->sctp_ep.local_hmacs);
2692 			inp->sctp_ep.local_hmacs =
2693 			    sctp_copy_hmaclist((*inp_p)->sctp_ep.local_hmacs);
2694 			if (inp->sctp_ep.local_auth_chunks)
2695 				sctp_free_chunklist(inp->sctp_ep.local_auth_chunks);
2696 			inp->sctp_ep.local_auth_chunks =
2697 			    sctp_copy_chunklist((*inp_p)->sctp_ep.local_auth_chunks);
2698 
2699 			/*
2700 			 * Now we must move it from one hash table to
2701 			 * another and get the tcb in the right place.
2702 			 */
2703 
2704 			/*
2705 			 * This is where the one-2-one socket is put into
2706 			 * the accept state waiting for the accept!
2707 			 */
2708 			if (*stcb) {
2709 				SCTP_ADD_SUBSTATE(*stcb, SCTP_STATE_IN_ACCEPT_QUEUE);
2710 			}
2711 			sctp_move_pcb_and_assoc(*inp_p, inp, *stcb);
2712 
2713 			atomic_add_int(&(*stcb)->asoc.refcnt, 1);
2714 			SCTP_TCB_UNLOCK((*stcb));
2715 
2716 			sctp_pull_off_control_to_new_inp((*inp_p), inp, *stcb,
2717 			    0);
2718 			SCTP_TCB_LOCK((*stcb));
2719 			atomic_subtract_int(&(*stcb)->asoc.refcnt, 1);
2720 
2721 			/*
2722 			 * now we must check to see if we were aborted while
2723 			 * the move was going on and the lock/unlock
2724 			 * happened.
2725 			 */
2726 			if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
2727 				/*
2728 				 * yep it was, we leave the assoc attached
2729 				 * to the socket since the sctp_inpcb_free()
2730 				 * call will send an abort for us.
2731 				 */
2732 				SCTP_INP_DECR_REF(inp);
2733 				return (NULL);
2734 			}
2735 			SCTP_INP_DECR_REF(inp);
2736 			/* Switch over to the new guy */
2737 			*inp_p = inp;
2738 			sctp_ulp_notify(notification, *stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
2739 			if (send_int_conf) {
2740 				sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
2741 				    (*stcb), 0, (void *)netl, SCTP_SO_NOT_LOCKED);
2742 			}
2743 
2744 			/*
2745 			 * Pull it from the incomplete queue and wake the
2746 			 * guy
2747 			 */
2748 			soisconnected(so);
2749 			return (m);
2750 		}
2751 	}
2752 	if (notification) {
2753 		sctp_ulp_notify(notification, *stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
2754 	}
2755 	if (send_int_conf) {
2756 		sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
2757 		    (*stcb), 0, (void *)netl, SCTP_SO_NOT_LOCKED);
2758 	}
2759 	return (m);
2760 }
2761 
2762 static void
2763 sctp_handle_cookie_ack(struct sctp_cookie_ack_chunk *cp SCTP_UNUSED,
2764     struct sctp_tcb *stcb, struct sctp_nets *net)
2765 {
2766 	/* cp must not be used, others call this without a c-ack :-) */
2767 	struct sctp_association *asoc;
2768 	struct sctp_tmit_chunk *chk;
2769 
2770 	SCTPDBG(SCTP_DEBUG_INPUT2,
2771 	    "sctp_handle_cookie_ack: handling COOKIE-ACK\n");
2772 	if ((stcb == NULL) || (net == NULL)) {
2773 		return;
2774 	}
2775 
2776 	asoc = &stcb->asoc;
2777 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
2778 		sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
2779 		    asoc->overall_error_count,
2780 		    0,
2781 		    SCTP_FROM_SCTP_INPUT,
2782 		    __LINE__);
2783 	}
2784 	sctp_stop_all_cookie_timers(stcb);
2785 	/* process according to association state */
2786 	if (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED) {
2787 		/* state change only needed when I am in right state */
2788 		SCTPDBG(SCTP_DEBUG_INPUT2, "moving to OPEN state\n");
2789 		SCTP_SET_STATE(stcb, SCTP_STATE_OPEN);
2790 		sctp_start_net_timers(stcb);
2791 		if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
2792 			sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
2793 			    stcb->sctp_ep, stcb, NULL);
2794 		}
2795 		/* update RTO */
2796 		SCTP_STAT_INCR_COUNTER32(sctps_activeestab);
2797 		SCTP_STAT_INCR_GAUGE32(sctps_currestab);
2798 		if (asoc->overall_error_count == 0) {
2799 			sctp_calculate_rto(stcb, asoc, net, &asoc->time_entered,
2800 			    SCTP_RTT_FROM_NON_DATA);
2801 		}
2802 		/*
2803 		 * Since we did not send a HB make sure we don't double
2804 		 * things.
2805 		 */
2806 		asoc->overall_error_count = 0;
2807 		net->hb_responded = 1;
2808 		(void)SCTP_GETTIME_TIMEVAL(&asoc->time_entered);
2809 		sctp_ulp_notify(SCTP_NOTIFY_ASSOC_UP, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
2810 		if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
2811 		    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
2812 			sctp_pcb_add_flags(stcb->sctp_ep, SCTP_PCB_FLAGS_CONNECTED);
2813 			if ((stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) == 0) {
2814 				soisconnected(stcb->sctp_socket);
2815 			}
2816 		}
2817 
2818 		if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
2819 			/*
2820 			 * We don't need to do the asconf thing, nor hb or
2821 			 * autoclose if the socket is closed.
2822 			 */
2823 			goto closed_socket;
2824 		}
2825 
2826 		sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
2827 		    stcb, net);
2828 
2829 		if (stcb->asoc.sctp_autoclose_ticks &&
2830 		    sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_AUTOCLOSE)) {
2831 			sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE,
2832 			    stcb->sctp_ep, stcb, NULL);
2833 		}
2834 		/*
2835 		 * send ASCONF if parameters are pending and ASCONFs are
2836 		 * allowed (eg. addresses changed when init/cookie echo were
2837 		 * in flight)
2838 		 */
2839 		if ((sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_DO_ASCONF)) &&
2840 		    (stcb->asoc.asconf_supported == 1) &&
2841 		    (!TAILQ_EMPTY(&stcb->asoc.asconf_queue))) {
2842 #ifdef SCTP_TIMER_BASED_ASCONF
2843 			sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2844 			    stcb->sctp_ep, stcb,
2845 			    stcb->asoc.primary_destination);
2846 #else
2847 			sctp_send_asconf(stcb, stcb->asoc.primary_destination,
2848 			    SCTP_ADDR_NOT_LOCKED);
2849 #endif
2850 		}
2851 	}
2852 closed_socket:
2853 	/* Toss the cookie if I can */
2854 	sctp_toss_old_cookies(stcb, asoc);
2855 	/* Restart the timer if we have pending data */
2856 	TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
2857 		if (chk->whoTo != NULL) {
2858 			break;
2859 		}
2860 	}
2861 	if (chk != NULL) {
2862 		sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, chk->whoTo);
2863 	}
2864 }
2865 
2866 static void
2867 sctp_handle_ecn_echo(struct sctp_ecne_chunk *cp,
2868     struct sctp_tcb *stcb)
2869 {
2870 	struct sctp_nets *net;
2871 	struct sctp_tmit_chunk *lchk;
2872 	struct sctp_ecne_chunk bkup;
2873 	uint8_t override_bit;
2874 	uint32_t tsn, window_data_tsn;
2875 	int len;
2876 	unsigned int pkt_cnt;
2877 
2878 	len = ntohs(cp->ch.chunk_length);
2879 	if (len == sizeof(struct old_sctp_ecne_chunk)) {
2880 		/* Its the old format */
2881 		memcpy(&bkup, cp, sizeof(struct old_sctp_ecne_chunk));
2882 		bkup.num_pkts_since_cwr = htonl(1);
2883 		cp = &bkup;
2884 	}
2885 	SCTP_STAT_INCR(sctps_recvecne);
2886 	tsn = ntohl(cp->tsn);
2887 	pkt_cnt = ntohl(cp->num_pkts_since_cwr);
2888 	lchk = TAILQ_LAST(&stcb->asoc.send_queue, sctpchunk_listhead);
2889 	if (lchk == NULL) {
2890 		window_data_tsn = stcb->asoc.sending_seq - 1;
2891 	} else {
2892 		window_data_tsn = lchk->rec.data.tsn;
2893 	}
2894 
2895 	/* Find where it was sent to if possible. */
2896 	net = NULL;
2897 	TAILQ_FOREACH(lchk, &stcb->asoc.sent_queue, sctp_next) {
2898 		if (lchk->rec.data.tsn == tsn) {
2899 			net = lchk->whoTo;
2900 			net->ecn_prev_cwnd = lchk->rec.data.cwnd_at_send;
2901 			break;
2902 		}
2903 		if (SCTP_TSN_GT(lchk->rec.data.tsn, tsn)) {
2904 			break;
2905 		}
2906 	}
2907 	if (net == NULL) {
2908 		/*
2909 		 * What to do. A previous send of a CWR was possibly lost.
2910 		 * See how old it is, we may have it marked on the actual
2911 		 * net.
2912 		 */
2913 		TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
2914 			if (tsn == net->last_cwr_tsn) {
2915 				/* Found him, send it off */
2916 				break;
2917 			}
2918 		}
2919 		if (net == NULL) {
2920 			/*
2921 			 * If we reach here, we need to send a special CWR
2922 			 * that says hey, we did this a long time ago and
2923 			 * you lost the response.
2924 			 */
2925 			net = TAILQ_FIRST(&stcb->asoc.nets);
2926 			if (net == NULL) {
2927 				/* TSNH */
2928 				return;
2929 			}
2930 			override_bit = SCTP_CWR_REDUCE_OVERRIDE;
2931 		} else {
2932 			override_bit = 0;
2933 		}
2934 	} else {
2935 		override_bit = 0;
2936 	}
2937 	if (SCTP_TSN_GT(tsn, net->cwr_window_tsn) &&
2938 	    ((override_bit & SCTP_CWR_REDUCE_OVERRIDE) == 0)) {
2939 		/*
2940 		 * JRS - Use the congestion control given in the pluggable
2941 		 * CC module
2942 		 */
2943 		stcb->asoc.cc_functions.sctp_cwnd_update_after_ecn_echo(stcb, net, 0, pkt_cnt);
2944 		/*
2945 		 * We reduce once every RTT. So we will only lower cwnd at
2946 		 * the next sending seq i.e. the window_data_tsn
2947 		 */
2948 		net->cwr_window_tsn = window_data_tsn;
2949 		net->ecn_ce_pkt_cnt += pkt_cnt;
2950 		net->lost_cnt = pkt_cnt;
2951 		net->last_cwr_tsn = tsn;
2952 	} else {
2953 		override_bit |= SCTP_CWR_IN_SAME_WINDOW;
2954 		if (SCTP_TSN_GT(tsn, net->last_cwr_tsn) &&
2955 		    ((override_bit & SCTP_CWR_REDUCE_OVERRIDE) == 0)) {
2956 			/*
2957 			 * Another loss in the same window update how many
2958 			 * marks/packets lost we have had.
2959 			 */
2960 			int cnt = 1;
2961 
2962 			if (pkt_cnt > net->lost_cnt) {
2963 				/* Should be the case */
2964 				cnt = (pkt_cnt - net->lost_cnt);
2965 				net->ecn_ce_pkt_cnt += cnt;
2966 			}
2967 			net->lost_cnt = pkt_cnt;
2968 			net->last_cwr_tsn = tsn;
2969 			/*
2970 			 * Most CC functions will ignore this call, since we
2971 			 * are in-window yet of the initial CE the peer saw.
2972 			 */
2973 			stcb->asoc.cc_functions.sctp_cwnd_update_after_ecn_echo(stcb, net, 1, cnt);
2974 		}
2975 	}
2976 	/*
2977 	 * We always send a CWR this way if our previous one was lost our
2978 	 * peer will get an update, or if it is not time again to reduce we
2979 	 * still get the cwr to the peer. Note we set the override when we
2980 	 * could not find the TSN on the chunk or the destination network.
2981 	 */
2982 	sctp_send_cwr(stcb, net, net->last_cwr_tsn, override_bit);
2983 }
2984 
2985 static void
2986 sctp_handle_ecn_cwr(struct sctp_cwr_chunk *cp, struct sctp_tcb *stcb, struct sctp_nets *net)
2987 {
2988 	/*
2989 	 * Here we get a CWR from the peer. We must look in the outqueue and
2990 	 * make sure that we have a covered ECNE in the control chunk part.
2991 	 * If so remove it.
2992 	 */
2993 	struct sctp_tmit_chunk *chk, *nchk;
2994 	struct sctp_ecne_chunk *ecne;
2995 	int override;
2996 	uint32_t cwr_tsn;
2997 
2998 	cwr_tsn = ntohl(cp->tsn);
2999 	override = cp->ch.chunk_flags & SCTP_CWR_REDUCE_OVERRIDE;
3000 	TAILQ_FOREACH_SAFE(chk, &stcb->asoc.control_send_queue, sctp_next, nchk) {
3001 		if (chk->rec.chunk_id.id != SCTP_ECN_ECHO) {
3002 			continue;
3003 		}
3004 		if ((override == 0) && (chk->whoTo != net)) {
3005 			/* Must be from the right src unless override is set */
3006 			continue;
3007 		}
3008 		ecne = mtod(chk->data, struct sctp_ecne_chunk *);
3009 		if (SCTP_TSN_GE(cwr_tsn, ntohl(ecne->tsn))) {
3010 			/* this covers this ECNE, we can remove it */
3011 			stcb->asoc.ecn_echo_cnt_onq--;
3012 			TAILQ_REMOVE(&stcb->asoc.control_send_queue, chk,
3013 			    sctp_next);
3014 			stcb->asoc.ctrl_queue_cnt--;
3015 			sctp_m_freem(chk->data);
3016 			chk->data = NULL;
3017 			sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
3018 			if (override == 0) {
3019 				break;
3020 			}
3021 		}
3022 	}
3023 }
3024 
3025 static void
3026 sctp_handle_shutdown_complete(struct sctp_shutdown_complete_chunk *cp SCTP_UNUSED,
3027     struct sctp_tcb *stcb, struct sctp_nets *net)
3028 {
3029 
3030 	SCTPDBG(SCTP_DEBUG_INPUT2,
3031 	    "sctp_handle_shutdown_complete: handling SHUTDOWN-COMPLETE\n");
3032 	if (stcb == NULL)
3033 		return;
3034 
3035 	/* process according to association state */
3036 	if (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_ACK_SENT) {
3037 		/* unexpected SHUTDOWN-COMPLETE... so ignore... */
3038 		SCTPDBG(SCTP_DEBUG_INPUT2,
3039 		    "sctp_handle_shutdown_complete: not in SCTP_STATE_SHUTDOWN_ACK_SENT --- ignore\n");
3040 		SCTP_TCB_UNLOCK(stcb);
3041 		return;
3042 	}
3043 	/* notify upper layer protocol */
3044 	if (stcb->sctp_socket) {
3045 		sctp_ulp_notify(SCTP_NOTIFY_ASSOC_DOWN, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
3046 	}
3047 #ifdef INVARIANTS
3048 	if (!TAILQ_EMPTY(&stcb->asoc.send_queue) ||
3049 	    !TAILQ_EMPTY(&stcb->asoc.sent_queue) ||
3050 	    sctp_is_there_unsent_data(stcb, SCTP_SO_NOT_LOCKED)) {
3051 		panic("Queues are not empty when handling SHUTDOWN-COMPLETE");
3052 	}
3053 #endif
3054 	/* stop the timer */
3055 	sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWNACK, stcb->sctp_ep, stcb, net,
3056 	    SCTP_FROM_SCTP_INPUT + SCTP_LOC_24);
3057 	SCTP_STAT_INCR_COUNTER32(sctps_shutdown);
3058 	/* free the TCB */
3059 	SCTPDBG(SCTP_DEBUG_INPUT2,
3060 	    "sctp_handle_shutdown_complete: calls free-asoc\n");
3061 	(void)sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC,
3062 	    SCTP_FROM_SCTP_INPUT + SCTP_LOC_25);
3063 	return;
3064 }
3065 
3066 static int
3067 process_chunk_drop(struct sctp_tcb *stcb, struct sctp_chunk_desc *desc,
3068     struct sctp_nets *net, uint8_t flg)
3069 {
3070 	switch (desc->chunk_type) {
3071 	case SCTP_DATA:
3072 	case SCTP_IDATA:
3073 		/* find the tsn to resend (possibly) */
3074 		{
3075 			uint32_t tsn;
3076 			struct sctp_tmit_chunk *tp1;
3077 
3078 			tsn = ntohl(desc->tsn_ifany);
3079 			TAILQ_FOREACH(tp1, &stcb->asoc.sent_queue, sctp_next) {
3080 				if (tp1->rec.data.tsn == tsn) {
3081 					/* found it */
3082 					break;
3083 				}
3084 				if (SCTP_TSN_GT(tp1->rec.data.tsn, tsn)) {
3085 					/* not found */
3086 					tp1 = NULL;
3087 					break;
3088 				}
3089 			}
3090 			if (tp1 == NULL) {
3091 				/*
3092 				 * Do it the other way , aka without paying
3093 				 * attention to queue seq order.
3094 				 */
3095 				SCTP_STAT_INCR(sctps_pdrpdnfnd);
3096 				TAILQ_FOREACH(tp1, &stcb->asoc.sent_queue, sctp_next) {
3097 					if (tp1->rec.data.tsn == tsn) {
3098 						/* found it */
3099 						break;
3100 					}
3101 				}
3102 			}
3103 			if (tp1 == NULL) {
3104 				SCTP_STAT_INCR(sctps_pdrptsnnf);
3105 			}
3106 			if ((tp1) && (tp1->sent < SCTP_DATAGRAM_ACKED)) {
3107 				if (((flg & SCTP_BADCRC) == 0) &&
3108 				    ((flg & SCTP_FROM_MIDDLE_BOX) == 0)) {
3109 					return (0);
3110 				}
3111 				if ((stcb->asoc.peers_rwnd == 0) &&
3112 				    ((flg & SCTP_FROM_MIDDLE_BOX) == 0)) {
3113 					SCTP_STAT_INCR(sctps_pdrpdiwnp);
3114 					return (0);
3115 				}
3116 				if (stcb->asoc.peers_rwnd == 0 &&
3117 				    (flg & SCTP_FROM_MIDDLE_BOX)) {
3118 					SCTP_STAT_INCR(sctps_pdrpdizrw);
3119 					return (0);
3120 				}
3121 				if ((uint32_t)SCTP_BUF_LEN(tp1->data) <
3122 				    SCTP_DATA_CHUNK_OVERHEAD(stcb) + SCTP_NUM_DB_TO_VERIFY) {
3123 					/* Payload not matching. */
3124 					SCTP_STAT_INCR(sctps_pdrpbadd);
3125 					return (-1);
3126 				}
3127 				if (memcmp(mtod(tp1->data, caddr_t)+SCTP_DATA_CHUNK_OVERHEAD(stcb),
3128 				    desc->data_bytes, SCTP_NUM_DB_TO_VERIFY) != 0) {
3129 					/* Payload not matching. */
3130 					SCTP_STAT_INCR(sctps_pdrpbadd);
3131 					return (-1);
3132 				}
3133 				if (tp1->do_rtt) {
3134 					/*
3135 					 * this guy had a RTO calculation
3136 					 * pending on it, cancel it
3137 					 */
3138 					if (tp1->whoTo->rto_needed == 0) {
3139 						tp1->whoTo->rto_needed = 1;
3140 					}
3141 					tp1->do_rtt = 0;
3142 				}
3143 				SCTP_STAT_INCR(sctps_pdrpmark);
3144 				if (tp1->sent != SCTP_DATAGRAM_RESEND)
3145 					sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
3146 				/*
3147 				 * mark it as if we were doing a FR, since
3148 				 * we will be getting gap ack reports behind
3149 				 * the info from the router.
3150 				 */
3151 				tp1->rec.data.doing_fast_retransmit = 1;
3152 				/*
3153 				 * mark the tsn with what sequences can
3154 				 * cause a new FR.
3155 				 */
3156 				if (TAILQ_EMPTY(&stcb->asoc.send_queue)) {
3157 					tp1->rec.data.fast_retran_tsn = stcb->asoc.sending_seq;
3158 				} else {
3159 					tp1->rec.data.fast_retran_tsn = (TAILQ_FIRST(&stcb->asoc.send_queue))->rec.data.tsn;
3160 				}
3161 
3162 				/* restart the timer */
3163 				sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
3164 				    stcb, tp1->whoTo,
3165 				    SCTP_FROM_SCTP_INPUT + SCTP_LOC_26);
3166 				sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
3167 				    stcb, tp1->whoTo);
3168 
3169 				/* fix counts and things */
3170 				if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) {
3171 					sctp_misc_ints(SCTP_FLIGHT_LOG_DOWN_PDRP,
3172 					    tp1->whoTo->flight_size,
3173 					    tp1->book_size,
3174 					    (uint32_t)(uintptr_t)stcb,
3175 					    tp1->rec.data.tsn);
3176 				}
3177 				if (tp1->sent < SCTP_DATAGRAM_RESEND) {
3178 					sctp_flight_size_decrease(tp1);
3179 					sctp_total_flight_decrease(stcb, tp1);
3180 				}
3181 				tp1->sent = SCTP_DATAGRAM_RESEND;
3182 			} {
3183 				/* audit code */
3184 				unsigned int audit;
3185 
3186 				audit = 0;
3187 				TAILQ_FOREACH(tp1, &stcb->asoc.sent_queue, sctp_next) {
3188 					if (tp1->sent == SCTP_DATAGRAM_RESEND)
3189 						audit++;
3190 				}
3191 				TAILQ_FOREACH(tp1, &stcb->asoc.control_send_queue,
3192 				    sctp_next) {
3193 					if (tp1->sent == SCTP_DATAGRAM_RESEND)
3194 						audit++;
3195 				}
3196 				if (audit != stcb->asoc.sent_queue_retran_cnt) {
3197 					SCTP_PRINTF("**Local Audit finds cnt:%d asoc cnt:%d\n",
3198 					    audit, stcb->asoc.sent_queue_retran_cnt);
3199 #ifndef SCTP_AUDITING_ENABLED
3200 					stcb->asoc.sent_queue_retran_cnt = audit;
3201 #endif
3202 				}
3203 			}
3204 		}
3205 		break;
3206 	case SCTP_ASCONF:
3207 		{
3208 			struct sctp_tmit_chunk *asconf;
3209 
3210 			TAILQ_FOREACH(asconf, &stcb->asoc.control_send_queue,
3211 			    sctp_next) {
3212 				if (asconf->rec.chunk_id.id == SCTP_ASCONF) {
3213 					break;
3214 				}
3215 			}
3216 			if (asconf) {
3217 				if (asconf->sent != SCTP_DATAGRAM_RESEND)
3218 					sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
3219 				asconf->sent = SCTP_DATAGRAM_RESEND;
3220 				asconf->snd_count--;
3221 			}
3222 		}
3223 		break;
3224 	case SCTP_INITIATION:
3225 		/* resend the INIT */
3226 		stcb->asoc.dropped_special_cnt++;
3227 		if (stcb->asoc.dropped_special_cnt < SCTP_RETRY_DROPPED_THRESH) {
3228 			/*
3229 			 * If we can get it in, in a few attempts we do
3230 			 * this, otherwise we let the timer fire.
3231 			 */
3232 			sctp_timer_stop(SCTP_TIMER_TYPE_INIT, stcb->sctp_ep,
3233 			    stcb, net,
3234 			    SCTP_FROM_SCTP_INPUT + SCTP_LOC_27);
3235 			sctp_send_initiate(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);
3236 		}
3237 		break;
3238 	case SCTP_SELECTIVE_ACK:
3239 	case SCTP_NR_SELECTIVE_ACK:
3240 		/* resend the sack */
3241 		sctp_send_sack(stcb, SCTP_SO_NOT_LOCKED);
3242 		break;
3243 	case SCTP_HEARTBEAT_REQUEST:
3244 		/* resend a demand HB */
3245 		if ((stcb->asoc.overall_error_count + 3) < stcb->asoc.max_send_times) {
3246 			/*
3247 			 * Only retransmit if we KNOW we wont destroy the
3248 			 * tcb
3249 			 */
3250 			sctp_send_hb(stcb, net, SCTP_SO_NOT_LOCKED);
3251 		}
3252 		break;
3253 	case SCTP_SHUTDOWN:
3254 		sctp_send_shutdown(stcb, net);
3255 		break;
3256 	case SCTP_SHUTDOWN_ACK:
3257 		sctp_send_shutdown_ack(stcb, net);
3258 		break;
3259 	case SCTP_COOKIE_ECHO:
3260 		{
3261 			struct sctp_tmit_chunk *cookie;
3262 
3263 			cookie = NULL;
3264 			TAILQ_FOREACH(cookie, &stcb->asoc.control_send_queue,
3265 			    sctp_next) {
3266 				if (cookie->rec.chunk_id.id == SCTP_COOKIE_ECHO) {
3267 					break;
3268 				}
3269 			}
3270 			if (cookie) {
3271 				if (cookie->sent != SCTP_DATAGRAM_RESEND)
3272 					sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
3273 				cookie->sent = SCTP_DATAGRAM_RESEND;
3274 				sctp_stop_all_cookie_timers(stcb);
3275 			}
3276 		}
3277 		break;
3278 	case SCTP_COOKIE_ACK:
3279 		sctp_send_cookie_ack(stcb);
3280 		break;
3281 	case SCTP_ASCONF_ACK:
3282 		/* resend last asconf ack */
3283 		sctp_send_asconf_ack(stcb);
3284 		break;
3285 	case SCTP_IFORWARD_CUM_TSN:
3286 	case SCTP_FORWARD_CUM_TSN:
3287 		send_forward_tsn(stcb, &stcb->asoc);
3288 		break;
3289 		/* can't do anything with these */
3290 	case SCTP_PACKET_DROPPED:
3291 	case SCTP_INITIATION_ACK:	/* this should not happen */
3292 	case SCTP_HEARTBEAT_ACK:
3293 	case SCTP_ABORT_ASSOCIATION:
3294 	case SCTP_OPERATION_ERROR:
3295 	case SCTP_SHUTDOWN_COMPLETE:
3296 	case SCTP_ECN_ECHO:
3297 	case SCTP_ECN_CWR:
3298 	default:
3299 		break;
3300 	}
3301 	return (0);
3302 }
3303 
3304 void
3305 sctp_reset_in_stream(struct sctp_tcb *stcb, uint32_t number_entries, uint16_t *list)
3306 {
3307 	uint32_t i;
3308 	uint16_t temp;
3309 
3310 	/*
3311 	 * We set things to 0xffffffff since this is the last delivered
3312 	 * sequence and we will be sending in 0 after the reset.
3313 	 */
3314 
3315 	if (number_entries) {
3316 		for (i = 0; i < number_entries; i++) {
3317 			temp = ntohs(list[i]);
3318 			if (temp >= stcb->asoc.streamincnt) {
3319 				continue;
3320 			}
3321 			stcb->asoc.strmin[temp].last_mid_delivered = 0xffffffff;
3322 		}
3323 	} else {
3324 		list = NULL;
3325 		for (i = 0; i < stcb->asoc.streamincnt; i++) {
3326 			stcb->asoc.strmin[i].last_mid_delivered = 0xffffffff;
3327 		}
3328 	}
3329 	sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_RECV, stcb, number_entries, (void *)list, SCTP_SO_NOT_LOCKED);
3330 }
3331 
3332 static void
3333 sctp_reset_out_streams(struct sctp_tcb *stcb, uint32_t number_entries, uint16_t *list)
3334 {
3335 	uint32_t i;
3336 	uint16_t temp;
3337 
3338 	if (number_entries > 0) {
3339 		for (i = 0; i < number_entries; i++) {
3340 			temp = ntohs(list[i]);
3341 			if (temp >= stcb->asoc.streamoutcnt) {
3342 				/* no such stream */
3343 				continue;
3344 			}
3345 			stcb->asoc.strmout[temp].next_mid_ordered = 0;
3346 			stcb->asoc.strmout[temp].next_mid_unordered = 0;
3347 		}
3348 	} else {
3349 		for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
3350 			stcb->asoc.strmout[i].next_mid_ordered = 0;
3351 			stcb->asoc.strmout[i].next_mid_unordered = 0;
3352 		}
3353 	}
3354 	sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_SEND, stcb, number_entries, (void *)list, SCTP_SO_NOT_LOCKED);
3355 }
3356 
3357 static void
3358 sctp_reset_clear_pending(struct sctp_tcb *stcb, uint32_t number_entries, uint16_t *list)
3359 {
3360 	uint32_t i;
3361 	uint16_t temp;
3362 
3363 	if (number_entries > 0) {
3364 		for (i = 0; i < number_entries; i++) {
3365 			temp = ntohs(list[i]);
3366 			if (temp >= stcb->asoc.streamoutcnt) {
3367 				/* no such stream */
3368 				continue;
3369 			}
3370 			stcb->asoc.strmout[temp].state = SCTP_STREAM_OPEN;
3371 		}
3372 	} else {
3373 		for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
3374 			stcb->asoc.strmout[i].state = SCTP_STREAM_OPEN;
3375 		}
3376 	}
3377 }
3378 
3379 struct sctp_stream_reset_request *
3380 sctp_find_stream_reset(struct sctp_tcb *stcb, uint32_t seq, struct sctp_tmit_chunk **bchk)
3381 {
3382 	struct sctp_association *asoc;
3383 	struct sctp_chunkhdr *ch;
3384 	struct sctp_stream_reset_request *r;
3385 	struct sctp_tmit_chunk *chk;
3386 	int len, clen;
3387 
3388 	asoc = &stcb->asoc;
3389 	chk = asoc->str_reset;
3390 	if (TAILQ_EMPTY(&asoc->control_send_queue) ||
3391 	    (chk == NULL)) {
3392 		asoc->stream_reset_outstanding = 0;
3393 		return (NULL);
3394 	}
3395 	if (chk->data == NULL) {
3396 		return (NULL);
3397 	}
3398 	if (bchk != NULL) {
3399 		/* he wants a copy of the chk pointer */
3400 		*bchk = chk;
3401 	}
3402 	clen = chk->send_size;
3403 	ch = mtod(chk->data, struct sctp_chunkhdr *);
3404 	r = (struct sctp_stream_reset_request *)(ch + 1);
3405 	if (ntohl(r->request_seq) == seq) {
3406 		/* found it */
3407 		return (r);
3408 	}
3409 	len = SCTP_SIZE32(ntohs(r->ph.param_length));
3410 	if (clen > (len + (int)sizeof(struct sctp_chunkhdr))) {
3411 		/* move to the next one, there can only be a max of two */
3412 		r = (struct sctp_stream_reset_request *)((caddr_t)r + len);
3413 		if (ntohl(r->request_seq) == seq) {
3414 			return (r);
3415 		}
3416 	}
3417 	/* that seq is not here */
3418 	return (NULL);
3419 }
3420 
3421 static void
3422 sctp_clean_up_stream_reset(struct sctp_tcb *stcb)
3423 {
3424 	struct sctp_association *asoc;
3425 	struct sctp_tmit_chunk *chk;
3426 
3427 	asoc = &stcb->asoc;
3428 	chk = asoc->str_reset;
3429 	if (chk == NULL) {
3430 		return;
3431 	}
3432 	asoc->str_reset = NULL;
3433 	sctp_timer_stop(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb,
3434 	    NULL, SCTP_FROM_SCTP_INPUT + SCTP_LOC_28);
3435 	TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
3436 	asoc->ctrl_queue_cnt--;
3437 	if (chk->data) {
3438 		sctp_m_freem(chk->data);
3439 		chk->data = NULL;
3440 	}
3441 	sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
3442 }
3443 
3444 static int
3445 sctp_handle_stream_reset_response(struct sctp_tcb *stcb,
3446     uint32_t seq, uint32_t action,
3447     struct sctp_stream_reset_response *respin)
3448 {
3449 	uint16_t type;
3450 	int lparam_len;
3451 	struct sctp_association *asoc = &stcb->asoc;
3452 	struct sctp_tmit_chunk *chk;
3453 	struct sctp_stream_reset_request *req_param;
3454 	struct sctp_stream_reset_out_request *req_out_param;
3455 	struct sctp_stream_reset_in_request *req_in_param;
3456 	uint32_t number_entries;
3457 
3458 	if (asoc->stream_reset_outstanding == 0) {
3459 		/* duplicate */
3460 		return (0);
3461 	}
3462 	if (seq == stcb->asoc.str_reset_seq_out) {
3463 		req_param = sctp_find_stream_reset(stcb, seq, &chk);
3464 		if (req_param != NULL) {
3465 			stcb->asoc.str_reset_seq_out++;
3466 			type = ntohs(req_param->ph.param_type);
3467 			lparam_len = ntohs(req_param->ph.param_length);
3468 			if (type == SCTP_STR_RESET_OUT_REQUEST) {
3469 				int no_clear = 0;
3470 
3471 				req_out_param = (struct sctp_stream_reset_out_request *)req_param;
3472 				number_entries = (lparam_len - sizeof(struct sctp_stream_reset_out_request)) / sizeof(uint16_t);
3473 				asoc->stream_reset_out_is_outstanding = 0;
3474 				if (asoc->stream_reset_outstanding)
3475 					asoc->stream_reset_outstanding--;
3476 				if (action == SCTP_STREAM_RESET_RESULT_PERFORMED) {
3477 					/* do it */
3478 					sctp_reset_out_streams(stcb, number_entries, req_out_param->list_of_streams);
3479 				} else if (action == SCTP_STREAM_RESET_RESULT_DENIED) {
3480 					sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_DENIED_OUT, stcb, number_entries, req_out_param->list_of_streams, SCTP_SO_NOT_LOCKED);
3481 				} else if (action == SCTP_STREAM_RESET_RESULT_IN_PROGRESS) {
3482 					/*
3483 					 * Set it up so we don't stop
3484 					 * retransmitting
3485 					 */
3486 					asoc->stream_reset_outstanding++;
3487 					stcb->asoc.str_reset_seq_out--;
3488 					asoc->stream_reset_out_is_outstanding = 1;
3489 					no_clear = 1;
3490 				} else {
3491 					sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_FAILED_OUT, stcb, number_entries, req_out_param->list_of_streams, SCTP_SO_NOT_LOCKED);
3492 				}
3493 				if (no_clear == 0) {
3494 					sctp_reset_clear_pending(stcb, number_entries, req_out_param->list_of_streams);
3495 				}
3496 			} else if (type == SCTP_STR_RESET_IN_REQUEST) {
3497 				req_in_param = (struct sctp_stream_reset_in_request *)req_param;
3498 				number_entries = (lparam_len - sizeof(struct sctp_stream_reset_in_request)) / sizeof(uint16_t);
3499 				if (asoc->stream_reset_outstanding)
3500 					asoc->stream_reset_outstanding--;
3501 				if (action == SCTP_STREAM_RESET_RESULT_DENIED) {
3502 					sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_DENIED_IN, stcb,
3503 					    number_entries, req_in_param->list_of_streams, SCTP_SO_NOT_LOCKED);
3504 				} else if (action != SCTP_STREAM_RESET_RESULT_PERFORMED) {
3505 					sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_FAILED_IN, stcb,
3506 					    number_entries, req_in_param->list_of_streams, SCTP_SO_NOT_LOCKED);
3507 				}
3508 			} else if (type == SCTP_STR_RESET_ADD_OUT_STREAMS) {
3509 				/* Ok we now may have more streams */
3510 				int num_stream;
3511 
3512 				num_stream = stcb->asoc.strm_pending_add_size;
3513 				if (num_stream > (stcb->asoc.strm_realoutsize - stcb->asoc.streamoutcnt)) {
3514 					/* TSNH */
3515 					num_stream = stcb->asoc.strm_realoutsize - stcb->asoc.streamoutcnt;
3516 				}
3517 				stcb->asoc.strm_pending_add_size = 0;
3518 				if (asoc->stream_reset_outstanding)
3519 					asoc->stream_reset_outstanding--;
3520 				if (action == SCTP_STREAM_RESET_RESULT_PERFORMED) {
3521 					/* Put the new streams into effect */
3522 					int i;
3523 
3524 					for (i = asoc->streamoutcnt; i < (asoc->streamoutcnt + num_stream); i++) {
3525 						asoc->strmout[i].state = SCTP_STREAM_OPEN;
3526 					}
3527 					asoc->streamoutcnt += num_stream;
3528 					sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt, 0);
3529 				} else if (action == SCTP_STREAM_RESET_RESULT_DENIED) {
3530 					sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt,
3531 					    SCTP_STREAM_CHANGE_DENIED);
3532 				} else {
3533 					sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt,
3534 					    SCTP_STREAM_CHANGE_FAILED);
3535 				}
3536 			} else if (type == SCTP_STR_RESET_ADD_IN_STREAMS) {
3537 				if (asoc->stream_reset_outstanding)
3538 					asoc->stream_reset_outstanding--;
3539 				if (action == SCTP_STREAM_RESET_RESULT_DENIED) {
3540 					sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt,
3541 					    SCTP_STREAM_CHANGE_DENIED);
3542 				} else if (action != SCTP_STREAM_RESET_RESULT_PERFORMED) {
3543 					sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt,
3544 					    SCTP_STREAM_CHANGE_FAILED);
3545 				}
3546 			} else if (type == SCTP_STR_RESET_TSN_REQUEST) {
3547 				/**
3548 				 * a) Adopt the new in tsn.
3549 				 * b) reset the map
3550 				 * c) Adopt the new out-tsn
3551 				 */
3552 				struct sctp_stream_reset_response_tsn *resp;
3553 				struct sctp_forward_tsn_chunk fwdtsn;
3554 				int abort_flag = 0;
3555 
3556 				if (respin == NULL) {
3557 					/* huh ? */
3558 					return (0);
3559 				}
3560 				if (ntohs(respin->ph.param_length) < sizeof(struct sctp_stream_reset_response_tsn)) {
3561 					return (0);
3562 				}
3563 				if (action == SCTP_STREAM_RESET_RESULT_PERFORMED) {
3564 					resp = (struct sctp_stream_reset_response_tsn *)respin;
3565 					asoc->stream_reset_outstanding--;
3566 					fwdtsn.ch.chunk_length = htons(sizeof(struct sctp_forward_tsn_chunk));
3567 					fwdtsn.ch.chunk_type = SCTP_FORWARD_CUM_TSN;
3568 					fwdtsn.new_cumulative_tsn = htonl(ntohl(resp->senders_next_tsn) - 1);
3569 					sctp_handle_forward_tsn(stcb, &fwdtsn, &abort_flag, NULL, 0);
3570 					if (abort_flag) {
3571 						return (1);
3572 					}
3573 					stcb->asoc.highest_tsn_inside_map = (ntohl(resp->senders_next_tsn) - 1);
3574 					if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {
3575 						sctp_log_map(0, 7, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
3576 					}
3577 
3578 					stcb->asoc.tsn_last_delivered = stcb->asoc.cumulative_tsn = stcb->asoc.highest_tsn_inside_map;
3579 					stcb->asoc.mapping_array_base_tsn = ntohl(resp->senders_next_tsn);
3580 					memset(stcb->asoc.mapping_array, 0, stcb->asoc.mapping_array_size);
3581 
3582 					stcb->asoc.highest_tsn_inside_nr_map = stcb->asoc.highest_tsn_inside_map;
3583 					memset(stcb->asoc.nr_mapping_array, 0, stcb->asoc.mapping_array_size);
3584 
3585 					stcb->asoc.sending_seq = ntohl(resp->receivers_next_tsn);
3586 					stcb->asoc.last_acked_seq = stcb->asoc.cumulative_tsn;
3587 
3588 					sctp_reset_out_streams(stcb, 0, (uint16_t *)NULL);
3589 					sctp_reset_in_stream(stcb, 0, (uint16_t *)NULL);
3590 					sctp_notify_stream_reset_tsn(stcb, stcb->asoc.sending_seq, (stcb->asoc.mapping_array_base_tsn + 1), 0);
3591 				} else if (action == SCTP_STREAM_RESET_RESULT_DENIED) {
3592 					sctp_notify_stream_reset_tsn(stcb, stcb->asoc.sending_seq, (stcb->asoc.mapping_array_base_tsn + 1),
3593 					    SCTP_ASSOC_RESET_DENIED);
3594 				} else {
3595 					sctp_notify_stream_reset_tsn(stcb, stcb->asoc.sending_seq, (stcb->asoc.mapping_array_base_tsn + 1),
3596 					    SCTP_ASSOC_RESET_FAILED);
3597 				}
3598 			}
3599 			/* get rid of the request and get the request flags */
3600 			if (asoc->stream_reset_outstanding == 0) {
3601 				sctp_clean_up_stream_reset(stcb);
3602 			}
3603 		}
3604 	}
3605 	if (asoc->stream_reset_outstanding == 0) {
3606 		sctp_send_stream_reset_out_if_possible(stcb, SCTP_SO_NOT_LOCKED);
3607 	}
3608 	return (0);
3609 }
3610 
3611 static void
3612 sctp_handle_str_reset_request_in(struct sctp_tcb *stcb,
3613     struct sctp_tmit_chunk *chk,
3614     struct sctp_stream_reset_in_request *req, int trunc)
3615 {
3616 	uint32_t seq;
3617 	int len, i;
3618 	int number_entries;
3619 	uint16_t temp;
3620 
3621 	/*
3622 	 * peer wants me to send a str-reset to him for my outgoing seq's if
3623 	 * seq_in is right.
3624 	 */
3625 	struct sctp_association *asoc = &stcb->asoc;
3626 
3627 	seq = ntohl(req->request_seq);
3628 	if (asoc->str_reset_seq_in == seq) {
3629 		asoc->last_reset_action[1] = asoc->last_reset_action[0];
3630 		if ((asoc->local_strreset_support & SCTP_ENABLE_RESET_STREAM_REQ) == 0) {
3631 			asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
3632 		} else if (trunc) {
3633 			/* Can't do it, since they exceeded our buffer size  */
3634 			asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
3635 		} else if (stcb->asoc.stream_reset_out_is_outstanding == 0) {
3636 			len = ntohs(req->ph.param_length);
3637 			number_entries = ((len - sizeof(struct sctp_stream_reset_in_request)) / sizeof(uint16_t));
3638 			if (number_entries) {
3639 				for (i = 0; i < number_entries; i++) {
3640 					temp = ntohs(req->list_of_streams[i]);
3641 					if (temp >= stcb->asoc.streamoutcnt) {
3642 						asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
3643 						goto bad_boy;
3644 					}
3645 					req->list_of_streams[i] = temp;
3646 				}
3647 				for (i = 0; i < number_entries; i++) {
3648 					if (stcb->asoc.strmout[req->list_of_streams[i]].state == SCTP_STREAM_OPEN) {
3649 						stcb->asoc.strmout[req->list_of_streams[i]].state = SCTP_STREAM_RESET_PENDING;
3650 					}
3651 				}
3652 			} else {
3653 				/* Its all */
3654 				for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
3655 					if (stcb->asoc.strmout[i].state == SCTP_STREAM_OPEN)
3656 						stcb->asoc.strmout[i].state = SCTP_STREAM_RESET_PENDING;
3657 				}
3658 			}
3659 			asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_PERFORMED;
3660 		} else {
3661 			/* Can't do it, since we have sent one out */
3662 			asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_ERR_IN_PROGRESS;
3663 		}
3664 bad_boy:
3665 		sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
3666 		asoc->str_reset_seq_in++;
3667 	} else if (asoc->str_reset_seq_in - 1 == seq) {
3668 		sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
3669 	} else if (asoc->str_reset_seq_in - 2 == seq) {
3670 		sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]);
3671 	} else {
3672 		sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_RESULT_ERR_BAD_SEQNO);
3673 	}
3674 	sctp_send_stream_reset_out_if_possible(stcb, SCTP_SO_NOT_LOCKED);
3675 }
3676 
3677 static int
3678 sctp_handle_str_reset_request_tsn(struct sctp_tcb *stcb,
3679     struct sctp_tmit_chunk *chk,
3680     struct sctp_stream_reset_tsn_request *req)
3681 {
3682 	/* reset all in and out and update the tsn */
3683 	/*
3684 	 * A) reset my str-seq's on in and out. B) Select a receive next,
3685 	 * and set cum-ack to it. Also process this selected number as a
3686 	 * fwd-tsn as well. C) set in the response my next sending seq.
3687 	 */
3688 	struct sctp_forward_tsn_chunk fwdtsn;
3689 	struct sctp_association *asoc = &stcb->asoc;
3690 	int abort_flag = 0;
3691 	uint32_t seq;
3692 
3693 	seq = ntohl(req->request_seq);
3694 	if (asoc->str_reset_seq_in == seq) {
3695 		asoc->last_reset_action[1] = stcb->asoc.last_reset_action[0];
3696 		if ((asoc->local_strreset_support & SCTP_ENABLE_CHANGE_ASSOC_REQ) == 0) {
3697 			asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
3698 		} else {
3699 			fwdtsn.ch.chunk_length = htons(sizeof(struct sctp_forward_tsn_chunk));
3700 			fwdtsn.ch.chunk_type = SCTP_FORWARD_CUM_TSN;
3701 			fwdtsn.ch.chunk_flags = 0;
3702 			fwdtsn.new_cumulative_tsn = htonl(stcb->asoc.highest_tsn_inside_map + 1);
3703 			sctp_handle_forward_tsn(stcb, &fwdtsn, &abort_flag, NULL, 0);
3704 			if (abort_flag) {
3705 				return (1);
3706 			}
3707 			asoc->highest_tsn_inside_map += SCTP_STREAM_RESET_TSN_DELTA;
3708 			if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {
3709 				sctp_log_map(0, 10, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
3710 			}
3711 			asoc->tsn_last_delivered = asoc->cumulative_tsn = asoc->highest_tsn_inside_map;
3712 			asoc->mapping_array_base_tsn = asoc->highest_tsn_inside_map + 1;
3713 			memset(asoc->mapping_array, 0, asoc->mapping_array_size);
3714 			asoc->highest_tsn_inside_nr_map = asoc->highest_tsn_inside_map;
3715 			memset(asoc->nr_mapping_array, 0, asoc->mapping_array_size);
3716 			atomic_add_int(&asoc->sending_seq, 1);
3717 			/* save off historical data for retrans */
3718 			asoc->last_sending_seq[1] = asoc->last_sending_seq[0];
3719 			asoc->last_sending_seq[0] = asoc->sending_seq;
3720 			asoc->last_base_tsnsent[1] = asoc->last_base_tsnsent[0];
3721 			asoc->last_base_tsnsent[0] = asoc->mapping_array_base_tsn;
3722 			sctp_reset_out_streams(stcb, 0, (uint16_t *)NULL);
3723 			sctp_reset_in_stream(stcb, 0, (uint16_t *)NULL);
3724 			asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_PERFORMED;
3725 			sctp_notify_stream_reset_tsn(stcb, asoc->sending_seq, (asoc->mapping_array_base_tsn + 1), 0);
3726 		}
3727 		sctp_add_stream_reset_result_tsn(chk, seq, asoc->last_reset_action[0],
3728 		    asoc->last_sending_seq[0], asoc->last_base_tsnsent[0]);
3729 		asoc->str_reset_seq_in++;
3730 	} else if (asoc->str_reset_seq_in - 1 == seq) {
3731 		sctp_add_stream_reset_result_tsn(chk, seq, asoc->last_reset_action[0],
3732 		    asoc->last_sending_seq[0], asoc->last_base_tsnsent[0]);
3733 	} else if (asoc->str_reset_seq_in - 2 == seq) {
3734 		sctp_add_stream_reset_result_tsn(chk, seq, asoc->last_reset_action[1],
3735 		    asoc->last_sending_seq[1], asoc->last_base_tsnsent[1]);
3736 	} else {
3737 		sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_RESULT_ERR_BAD_SEQNO);
3738 	}
3739 	return (0);
3740 }
3741 
3742 static void
3743 sctp_handle_str_reset_request_out(struct sctp_tcb *stcb,
3744     struct sctp_tmit_chunk *chk,
3745     struct sctp_stream_reset_out_request *req, int trunc)
3746 {
3747 	uint32_t seq, tsn;
3748 	int number_entries, len;
3749 	struct sctp_association *asoc = &stcb->asoc;
3750 
3751 	seq = ntohl(req->request_seq);
3752 
3753 	/* now if its not a duplicate we process it */
3754 	if (asoc->str_reset_seq_in == seq) {
3755 		len = ntohs(req->ph.param_length);
3756 		number_entries = ((len - sizeof(struct sctp_stream_reset_out_request)) / sizeof(uint16_t));
3757 		/*
3758 		 * the sender is resetting, handle the list issue.. we must
3759 		 * a) verify if we can do the reset, if so no problem b) If
3760 		 * we can't do the reset we must copy the request. c) queue
3761 		 * it, and setup the data in processor to trigger it off
3762 		 * when needed and dequeue all the queued data.
3763 		 */
3764 		tsn = ntohl(req->send_reset_at_tsn);
3765 
3766 		/* move the reset action back one */
3767 		asoc->last_reset_action[1] = asoc->last_reset_action[0];
3768 		if ((asoc->local_strreset_support & SCTP_ENABLE_RESET_STREAM_REQ) == 0) {
3769 			asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
3770 		} else if (trunc) {
3771 			asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
3772 		} else if (SCTP_TSN_GE(asoc->cumulative_tsn, tsn)) {
3773 			/* we can do it now */
3774 			sctp_reset_in_stream(stcb, number_entries, req->list_of_streams);
3775 			asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_PERFORMED;
3776 		} else {
3777 			/*
3778 			 * we must queue it up and thus wait for the TSN's
3779 			 * to arrive that are at or before tsn
3780 			 */
3781 			struct sctp_stream_reset_list *liste;
3782 			int siz;
3783 
3784 			siz = sizeof(struct sctp_stream_reset_list) + (number_entries * sizeof(uint16_t));
3785 			SCTP_MALLOC(liste, struct sctp_stream_reset_list *,
3786 			    siz, SCTP_M_STRESET);
3787 			if (liste == NULL) {
3788 				/* gak out of memory */
3789 				asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
3790 				sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
3791 				return;
3792 			}
3793 			liste->seq = seq;
3794 			liste->tsn = tsn;
3795 			liste->number_entries = number_entries;
3796 			memcpy(&liste->list_of_streams, req->list_of_streams, number_entries * sizeof(uint16_t));
3797 			TAILQ_INSERT_TAIL(&asoc->resetHead, liste, next_resp);
3798 			asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_IN_PROGRESS;
3799 		}
3800 		sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
3801 		asoc->str_reset_seq_in++;
3802 	} else if ((asoc->str_reset_seq_in - 1) == seq) {
3803 		/*
3804 		 * one seq back, just echo back last action since my
3805 		 * response was lost.
3806 		 */
3807 		sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
3808 	} else if ((asoc->str_reset_seq_in - 2) == seq) {
3809 		/*
3810 		 * two seq back, just echo back last action since my
3811 		 * response was lost.
3812 		 */
3813 		sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]);
3814 	} else {
3815 		sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_RESULT_ERR_BAD_SEQNO);
3816 	}
3817 }
3818 
3819 static void
3820 sctp_handle_str_reset_add_strm(struct sctp_tcb *stcb, struct sctp_tmit_chunk *chk,
3821     struct sctp_stream_reset_add_strm *str_add)
3822 {
3823 	/*
3824 	 * Peer is requesting to add more streams. If its within our
3825 	 * max-streams we will allow it.
3826 	 */
3827 	uint32_t num_stream, i;
3828 	uint32_t seq;
3829 	struct sctp_association *asoc = &stcb->asoc;
3830 	struct sctp_queued_to_read *ctl, *nctl;
3831 
3832 	/* Get the number. */
3833 	seq = ntohl(str_add->request_seq);
3834 	num_stream = ntohs(str_add->number_of_streams);
3835 	/* Now what would be the new total? */
3836 	if (asoc->str_reset_seq_in == seq) {
3837 		num_stream += stcb->asoc.streamincnt;
3838 		stcb->asoc.last_reset_action[1] = stcb->asoc.last_reset_action[0];
3839 		if ((asoc->local_strreset_support & SCTP_ENABLE_CHANGE_ASSOC_REQ) == 0) {
3840 			asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
3841 		} else if ((num_stream > stcb->asoc.max_inbound_streams) ||
3842 		    (num_stream > 0xffff)) {
3843 			/* We must reject it they ask for to many */
3844 	denied:
3845 			stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
3846 		} else {
3847 			/* Ok, we can do that :-) */
3848 			struct sctp_stream_in *oldstrm;
3849 
3850 			/* save off the old */
3851 			oldstrm = stcb->asoc.strmin;
3852 			SCTP_MALLOC(stcb->asoc.strmin, struct sctp_stream_in *,
3853 			    (num_stream * sizeof(struct sctp_stream_in)),
3854 			    SCTP_M_STRMI);
3855 			if (stcb->asoc.strmin == NULL) {
3856 				stcb->asoc.strmin = oldstrm;
3857 				goto denied;
3858 			}
3859 			/* copy off the old data */
3860 			for (i = 0; i < stcb->asoc.streamincnt; i++) {
3861 				TAILQ_INIT(&stcb->asoc.strmin[i].inqueue);
3862 				TAILQ_INIT(&stcb->asoc.strmin[i].uno_inqueue);
3863 				stcb->asoc.strmin[i].sid = i;
3864 				stcb->asoc.strmin[i].last_mid_delivered = oldstrm[i].last_mid_delivered;
3865 				stcb->asoc.strmin[i].delivery_started = oldstrm[i].delivery_started;
3866 				stcb->asoc.strmin[i].pd_api_started = oldstrm[i].pd_api_started;
3867 				/* now anything on those queues? */
3868 				TAILQ_FOREACH_SAFE(ctl, &oldstrm[i].inqueue, next_instrm, nctl) {
3869 					TAILQ_REMOVE(&oldstrm[i].inqueue, ctl, next_instrm);
3870 					TAILQ_INSERT_TAIL(&stcb->asoc.strmin[i].inqueue, ctl, next_instrm);
3871 				}
3872 				TAILQ_FOREACH_SAFE(ctl, &oldstrm[i].uno_inqueue, next_instrm, nctl) {
3873 					TAILQ_REMOVE(&oldstrm[i].uno_inqueue, ctl, next_instrm);
3874 					TAILQ_INSERT_TAIL(&stcb->asoc.strmin[i].uno_inqueue, ctl, next_instrm);
3875 				}
3876 			}
3877 			/* Init the new streams */
3878 			for (i = stcb->asoc.streamincnt; i < num_stream; i++) {
3879 				TAILQ_INIT(&stcb->asoc.strmin[i].inqueue);
3880 				TAILQ_INIT(&stcb->asoc.strmin[i].uno_inqueue);
3881 				stcb->asoc.strmin[i].sid = i;
3882 				stcb->asoc.strmin[i].last_mid_delivered = 0xffffffff;
3883 				stcb->asoc.strmin[i].pd_api_started = 0;
3884 				stcb->asoc.strmin[i].delivery_started = 0;
3885 			}
3886 			SCTP_FREE(oldstrm, SCTP_M_STRMI);
3887 			/* update the size */
3888 			stcb->asoc.streamincnt = num_stream;
3889 			stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_PERFORMED;
3890 			sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt, 0);
3891 		}
3892 		sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
3893 		asoc->str_reset_seq_in++;
3894 	} else if ((asoc->str_reset_seq_in - 1) == seq) {
3895 		/*
3896 		 * one seq back, just echo back last action since my
3897 		 * response was lost.
3898 		 */
3899 		sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
3900 	} else if ((asoc->str_reset_seq_in - 2) == seq) {
3901 		/*
3902 		 * two seq back, just echo back last action since my
3903 		 * response was lost.
3904 		 */
3905 		sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]);
3906 	} else {
3907 		sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_RESULT_ERR_BAD_SEQNO);
3908 	}
3909 }
3910 
3911 static void
3912 sctp_handle_str_reset_add_out_strm(struct sctp_tcb *stcb, struct sctp_tmit_chunk *chk,
3913     struct sctp_stream_reset_add_strm *str_add)
3914 {
3915 	/*
3916 	 * Peer is requesting to add more streams. If its within our
3917 	 * max-streams we will allow it.
3918 	 */
3919 	uint16_t num_stream;
3920 	uint32_t seq;
3921 	struct sctp_association *asoc = &stcb->asoc;
3922 
3923 	/* Get the number. */
3924 	seq = ntohl(str_add->request_seq);
3925 	num_stream = ntohs(str_add->number_of_streams);
3926 	/* Now what would be the new total? */
3927 	if (asoc->str_reset_seq_in == seq) {
3928 		stcb->asoc.last_reset_action[1] = stcb->asoc.last_reset_action[0];
3929 		if ((asoc->local_strreset_support & SCTP_ENABLE_CHANGE_ASSOC_REQ) == 0) {
3930 			asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
3931 		} else if (stcb->asoc.stream_reset_outstanding) {
3932 			/* We must reject it we have something pending */
3933 			stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_ERR_IN_PROGRESS;
3934 		} else {
3935 			/* Ok, we can do that :-) */
3936 			int mychk;
3937 
3938 			mychk = stcb->asoc.streamoutcnt;
3939 			mychk += num_stream;
3940 			if (mychk < 0x10000) {
3941 				stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_PERFORMED;
3942 				if (sctp_send_str_reset_req(stcb, 0, NULL, 0, 0, 1, num_stream, 0, 1)) {
3943 					stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
3944 				}
3945 			} else {
3946 				stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
3947 			}
3948 		}
3949 		sctp_add_stream_reset_result(chk, seq, stcb->asoc.last_reset_action[0]);
3950 		asoc->str_reset_seq_in++;
3951 	} else if ((asoc->str_reset_seq_in - 1) == seq) {
3952 		/*
3953 		 * one seq back, just echo back last action since my
3954 		 * response was lost.
3955 		 */
3956 		sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
3957 	} else if ((asoc->str_reset_seq_in - 2) == seq) {
3958 		/*
3959 		 * two seq back, just echo back last action since my
3960 		 * response was lost.
3961 		 */
3962 		sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]);
3963 	} else {
3964 		sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_RESULT_ERR_BAD_SEQNO);
3965 	}
3966 }
3967 
3968 #ifdef __GNUC__
3969 __attribute__((noinline))
3970 #endif
3971 static int
3972 sctp_handle_stream_reset(struct sctp_tcb *stcb, struct mbuf *m, int offset,
3973     struct sctp_chunkhdr *ch_req)
3974 {
3975 	uint16_t remaining_length, param_len, ptype;
3976 	struct sctp_paramhdr pstore;
3977 	uint8_t cstore[SCTP_CHUNK_BUFFER_SIZE];
3978 	uint32_t seq = 0;
3979 	int num_req = 0;
3980 	int trunc = 0;
3981 	struct sctp_tmit_chunk *chk;
3982 	struct sctp_chunkhdr *ch;
3983 	struct sctp_paramhdr *ph;
3984 	int ret_code = 0;
3985 	int num_param = 0;
3986 
3987 	/* now it may be a reset or a reset-response */
3988 	remaining_length = ntohs(ch_req->chunk_length) - sizeof(struct sctp_chunkhdr);
3989 
3990 	/* setup for adding the response */
3991 	sctp_alloc_a_chunk(stcb, chk);
3992 	if (chk == NULL) {
3993 		return (ret_code);
3994 	}
3995 	chk->copy_by_ref = 0;
3996 	chk->rec.chunk_id.id = SCTP_STREAM_RESET;
3997 	chk->rec.chunk_id.can_take_data = 0;
3998 	chk->flags = 0;
3999 	chk->asoc = &stcb->asoc;
4000 	chk->no_fr_allowed = 0;
4001 	chk->book_size = chk->send_size = sizeof(struct sctp_chunkhdr);
4002 	chk->book_size_scale = 0;
4003 	chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA);
4004 	if (chk->data == NULL) {
4005 strres_nochunk:
4006 		if (chk->data) {
4007 			sctp_m_freem(chk->data);
4008 			chk->data = NULL;
4009 		}
4010 		sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
4011 		return (ret_code);
4012 	}
4013 	SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD);
4014 
4015 	/* setup chunk parameters */
4016 	chk->sent = SCTP_DATAGRAM_UNSENT;
4017 	chk->snd_count = 0;
4018 	chk->whoTo = NULL;
4019 
4020 	ch = mtod(chk->data, struct sctp_chunkhdr *);
4021 	ch->chunk_type = SCTP_STREAM_RESET;
4022 	ch->chunk_flags = 0;
4023 	ch->chunk_length = htons(chk->send_size);
4024 	SCTP_BUF_LEN(chk->data) = SCTP_SIZE32(chk->send_size);
4025 	offset += sizeof(struct sctp_chunkhdr);
4026 	while (remaining_length >= sizeof(struct sctp_paramhdr)) {
4027 		ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset, sizeof(pstore), (uint8_t *)&pstore);
4028 		if (ph == NULL) {
4029 			/* TSNH */
4030 			break;
4031 		}
4032 		param_len = ntohs(ph->param_length);
4033 		if ((param_len > remaining_length) ||
4034 		    (param_len < (sizeof(struct sctp_paramhdr) + sizeof(uint32_t)))) {
4035 			/* bad parameter length */
4036 			break;
4037 		}
4038 		ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset, min(param_len, sizeof(cstore)),
4039 		    (uint8_t *)&cstore);
4040 		if (ph == NULL) {
4041 			/* TSNH */
4042 			break;
4043 		}
4044 		ptype = ntohs(ph->param_type);
4045 		num_param++;
4046 		if (param_len > sizeof(cstore)) {
4047 			trunc = 1;
4048 		} else {
4049 			trunc = 0;
4050 		}
4051 		if (num_param > SCTP_MAX_RESET_PARAMS) {
4052 			/* hit the max of parameters already sorry.. */
4053 			break;
4054 		}
4055 		if (ptype == SCTP_STR_RESET_OUT_REQUEST) {
4056 			struct sctp_stream_reset_out_request *req_out;
4057 
4058 			if (param_len < sizeof(struct sctp_stream_reset_out_request)) {
4059 				break;
4060 			}
4061 			req_out = (struct sctp_stream_reset_out_request *)ph;
4062 			num_req++;
4063 			if (stcb->asoc.stream_reset_outstanding) {
4064 				seq = ntohl(req_out->response_seq);
4065 				if (seq == stcb->asoc.str_reset_seq_out) {
4066 					/* implicit ack */
4067 					(void)sctp_handle_stream_reset_response(stcb, seq, SCTP_STREAM_RESET_RESULT_PERFORMED, NULL);
4068 				}
4069 			}
4070 			sctp_handle_str_reset_request_out(stcb, chk, req_out, trunc);
4071 		} else if (ptype == SCTP_STR_RESET_ADD_OUT_STREAMS) {
4072 			struct sctp_stream_reset_add_strm *str_add;
4073 
4074 			if (param_len < sizeof(struct sctp_stream_reset_add_strm)) {
4075 				break;
4076 			}
4077 			str_add = (struct sctp_stream_reset_add_strm *)ph;
4078 			num_req++;
4079 			sctp_handle_str_reset_add_strm(stcb, chk, str_add);
4080 		} else if (ptype == SCTP_STR_RESET_ADD_IN_STREAMS) {
4081 			struct sctp_stream_reset_add_strm *str_add;
4082 
4083 			if (param_len < sizeof(struct sctp_stream_reset_add_strm)) {
4084 				break;
4085 			}
4086 			str_add = (struct sctp_stream_reset_add_strm *)ph;
4087 			num_req++;
4088 			sctp_handle_str_reset_add_out_strm(stcb, chk, str_add);
4089 		} else if (ptype == SCTP_STR_RESET_IN_REQUEST) {
4090 			struct sctp_stream_reset_in_request *req_in;
4091 
4092 			num_req++;
4093 			req_in = (struct sctp_stream_reset_in_request *)ph;
4094 			sctp_handle_str_reset_request_in(stcb, chk, req_in, trunc);
4095 		} else if (ptype == SCTP_STR_RESET_TSN_REQUEST) {
4096 			struct sctp_stream_reset_tsn_request *req_tsn;
4097 
4098 			num_req++;
4099 			req_tsn = (struct sctp_stream_reset_tsn_request *)ph;
4100 			if (sctp_handle_str_reset_request_tsn(stcb, chk, req_tsn)) {
4101 				ret_code = 1;
4102 				goto strres_nochunk;
4103 			}
4104 			/* no more */
4105 			break;
4106 		} else if (ptype == SCTP_STR_RESET_RESPONSE) {
4107 			struct sctp_stream_reset_response *resp;
4108 			uint32_t result;
4109 
4110 			if (param_len < sizeof(struct sctp_stream_reset_response)) {
4111 				break;
4112 			}
4113 			resp = (struct sctp_stream_reset_response *)ph;
4114 			seq = ntohl(resp->response_seq);
4115 			result = ntohl(resp->result);
4116 			if (sctp_handle_stream_reset_response(stcb, seq, result, resp)) {
4117 				ret_code = 1;
4118 				goto strres_nochunk;
4119 			}
4120 		} else {
4121 			break;
4122 		}
4123 		offset += SCTP_SIZE32(param_len);
4124 		if (remaining_length >= SCTP_SIZE32(param_len)) {
4125 			remaining_length -= SCTP_SIZE32(param_len);
4126 		} else {
4127 			remaining_length = 0;
4128 		}
4129 	}
4130 	if (num_req == 0) {
4131 		/* we have no response free the stuff */
4132 		goto strres_nochunk;
4133 	}
4134 	/* ok we have a chunk to link in */
4135 	TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue,
4136 	    chk,
4137 	    sctp_next);
4138 	stcb->asoc.ctrl_queue_cnt++;
4139 	return (ret_code);
4140 }
4141 
4142 /*
4143  * Handle a router or endpoints report of a packet loss, there are two ways
4144  * to handle this, either we get the whole packet and must disect it
4145  * ourselves (possibly with truncation and or corruption) or it is a summary
4146  * from a middle box that did the disecting for us.
4147  */
4148 static void
4149 sctp_handle_packet_dropped(struct sctp_pktdrop_chunk *cp,
4150     struct sctp_tcb *stcb, struct sctp_nets *net, uint32_t limit)
4151 {
4152 	struct sctp_chunk_desc desc;
4153 	struct sctp_chunkhdr *chk_hdr;
4154 	struct sctp_data_chunk *data_chunk;
4155 	struct sctp_idata_chunk *idata_chunk;
4156 	uint32_t bottle_bw, on_queue;
4157 	uint32_t offset, chk_len;
4158 	uint16_t pktdrp_len;
4159 	uint8_t pktdrp_flags;
4160 
4161 	KASSERT(sizeof(struct sctp_pktdrop_chunk) <= limit,
4162 	    ("PKTDROP chunk too small"));
4163 	pktdrp_flags = cp->ch.chunk_flags;
4164 	pktdrp_len = ntohs(cp->ch.chunk_length);
4165 	KASSERT(limit <= pktdrp_len, ("Inconsistent limit"));
4166 	if (pktdrp_flags & SCTP_PACKET_TRUNCATED) {
4167 		if (ntohs(cp->trunc_len) <= pktdrp_len - sizeof(struct sctp_pktdrop_chunk)) {
4168 			/* The peer plays games with us. */
4169 			return;
4170 		}
4171 	}
4172 	limit -= sizeof(struct sctp_pktdrop_chunk);
4173 	offset = 0;
4174 	if (offset == limit) {
4175 		if (pktdrp_flags & SCTP_FROM_MIDDLE_BOX) {
4176 			SCTP_STAT_INCR(sctps_pdrpbwrpt);
4177 		}
4178 	} else if (offset + sizeof(struct sctphdr) > limit) {
4179 		/* Only a partial SCTP common header. */
4180 		SCTP_STAT_INCR(sctps_pdrpcrupt);
4181 		offset = limit;
4182 	} else {
4183 		/* XXX: Check embedded SCTP common header. */
4184 		offset += sizeof(struct sctphdr);
4185 	}
4186 	/* Now parse through the chunks themselves. */
4187 	while (offset < limit) {
4188 		if (offset + sizeof(struct sctp_chunkhdr) > limit) {
4189 			SCTP_STAT_INCR(sctps_pdrpcrupt);
4190 			break;
4191 		}
4192 		chk_hdr = (struct sctp_chunkhdr *)(cp->data + offset);
4193 		desc.chunk_type = chk_hdr->chunk_type;
4194 		/* get amount we need to move */
4195 		chk_len = (uint32_t)ntohs(chk_hdr->chunk_length);
4196 		if (chk_len < sizeof(struct sctp_chunkhdr)) {
4197 			/* Someone is lying... */
4198 			break;
4199 		}
4200 		if (desc.chunk_type == SCTP_DATA) {
4201 			if (stcb->asoc.idata_supported) {
4202 				/* Some is playing games with us. */
4203 				break;
4204 			}
4205 			if (chk_len <= sizeof(struct sctp_data_chunk)) {
4206 				/* Some is playing games with us. */
4207 				break;
4208 			}
4209 			if (chk_len < sizeof(struct sctp_data_chunk) + SCTP_NUM_DB_TO_VERIFY) {
4210 				/*
4211 				 * Not enough data bytes available in the
4212 				 * chunk.
4213 				 */
4214 				SCTP_STAT_INCR(sctps_pdrpnedat);
4215 				goto next_chunk;
4216 			}
4217 			if (offset + sizeof(struct sctp_data_chunk) + SCTP_NUM_DB_TO_VERIFY > limit) {
4218 				/* Not enough data in buffer. */
4219 				break;
4220 			}
4221 			data_chunk = (struct sctp_data_chunk *)(cp->data + offset);
4222 			memcpy(desc.data_bytes, data_chunk + 1, SCTP_NUM_DB_TO_VERIFY);
4223 			desc.tsn_ifany = data_chunk->dp.tsn;
4224 			if (pktdrp_flags & SCTP_FROM_MIDDLE_BOX) {
4225 				SCTP_STAT_INCR(sctps_pdrpmbda);
4226 			}
4227 		} else if (desc.chunk_type == SCTP_IDATA) {
4228 			if (!stcb->asoc.idata_supported) {
4229 				/* Some is playing games with us. */
4230 				break;
4231 			}
4232 			if (chk_len <= sizeof(struct sctp_idata_chunk)) {
4233 				/* Some is playing games with us. */
4234 				break;
4235 			}
4236 			if (chk_len < sizeof(struct sctp_idata_chunk) + SCTP_NUM_DB_TO_VERIFY) {
4237 				/*
4238 				 * Not enough data bytes available in the
4239 				 * chunk.
4240 				 */
4241 				SCTP_STAT_INCR(sctps_pdrpnedat);
4242 				goto next_chunk;
4243 			}
4244 			if (offset + sizeof(struct sctp_idata_chunk) + SCTP_NUM_DB_TO_VERIFY > limit) {
4245 				/* Not enough data in buffer. */
4246 				break;
4247 			}
4248 			idata_chunk = (struct sctp_idata_chunk *)(cp->data + offset);
4249 			memcpy(desc.data_bytes, idata_chunk + 1, SCTP_NUM_DB_TO_VERIFY);
4250 			desc.tsn_ifany = idata_chunk->dp.tsn;
4251 			if (pktdrp_flags & SCTP_FROM_MIDDLE_BOX) {
4252 				SCTP_STAT_INCR(sctps_pdrpmbda);
4253 			}
4254 		} else {
4255 			if (pktdrp_flags & SCTP_FROM_MIDDLE_BOX) {
4256 				SCTP_STAT_INCR(sctps_pdrpmbct);
4257 			}
4258 		}
4259 		if (process_chunk_drop(stcb, &desc, net, pktdrp_flags)) {
4260 			SCTP_STAT_INCR(sctps_pdrppdbrk);
4261 			break;
4262 		}
4263 next_chunk:
4264 		offset += SCTP_SIZE32(chk_len);
4265 	}
4266 	/* Now update any rwnd --- possibly */
4267 	if ((pktdrp_flags & SCTP_FROM_MIDDLE_BOX) == 0) {
4268 		/* From a peer, we get a rwnd report */
4269 		uint32_t a_rwnd;
4270 
4271 		SCTP_STAT_INCR(sctps_pdrpfehos);
4272 
4273 		bottle_bw = ntohl(cp->bottle_bw);
4274 		on_queue = ntohl(cp->current_onq);
4275 		if (bottle_bw && on_queue) {
4276 			/* a rwnd report is in here */
4277 			if (bottle_bw > on_queue)
4278 				a_rwnd = bottle_bw - on_queue;
4279 			else
4280 				a_rwnd = 0;
4281 
4282 			if (a_rwnd == 0)
4283 				stcb->asoc.peers_rwnd = 0;
4284 			else {
4285 				if (a_rwnd > stcb->asoc.total_flight) {
4286 					stcb->asoc.peers_rwnd =
4287 					    a_rwnd - stcb->asoc.total_flight;
4288 				} else {
4289 					stcb->asoc.peers_rwnd = 0;
4290 				}
4291 				if (stcb->asoc.peers_rwnd <
4292 				    stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
4293 					/* SWS sender side engages */
4294 					stcb->asoc.peers_rwnd = 0;
4295 				}
4296 			}
4297 		}
4298 	} else {
4299 		SCTP_STAT_INCR(sctps_pdrpfmbox);
4300 	}
4301 
4302 	/* now middle boxes in sat networks get a cwnd bump */
4303 	if ((pktdrp_flags & SCTP_FROM_MIDDLE_BOX) &&
4304 	    (stcb->asoc.sat_t3_loss_recovery == 0) &&
4305 	    (stcb->asoc.sat_network)) {
4306 		/*
4307 		 * This is debatable but for sat networks it makes sense
4308 		 * Note if a T3 timer has went off, we will prohibit any
4309 		 * changes to cwnd until we exit the t3 loss recovery.
4310 		 */
4311 		stcb->asoc.cc_functions.sctp_cwnd_update_after_packet_dropped(stcb,
4312 		    net, cp, &bottle_bw, &on_queue);
4313 	}
4314 }
4315 
4316 /*
4317  * handles all control chunks in a packet inputs: - m: mbuf chain, assumed to
4318  * still contain IP/SCTP header - stcb: is the tcb found for this packet -
4319  * offset: offset into the mbuf chain to first chunkhdr - length: is the
4320  * length of the complete packet outputs: - length: modified to remaining
4321  * length after control processing - netp: modified to new sctp_nets after
4322  * cookie-echo processing - return NULL to discard the packet (ie. no asoc,
4323  * bad packet,...) otherwise return the tcb for this packet
4324  */
4325 #ifdef __GNUC__
4326 __attribute__((noinline))
4327 #endif
4328 static struct sctp_tcb *
4329 sctp_process_control(struct mbuf *m, int iphlen, int *offset, int length,
4330     struct sockaddr *src, struct sockaddr *dst,
4331     struct sctphdr *sh, struct sctp_chunkhdr *ch, struct sctp_inpcb *inp,
4332     struct sctp_tcb *stcb, struct sctp_nets **netp, int *fwd_tsn_seen,
4333     uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum,
4334     uint32_t vrf_id, uint16_t port)
4335 {
4336 	struct sctp_association *asoc;
4337 	struct mbuf *op_err;
4338 	char msg[SCTP_DIAG_INFO_LEN];
4339 	uint32_t vtag_in;
4340 	int num_chunks = 0;	/* number of control chunks processed */
4341 	uint32_t chk_length, contiguous;
4342 	int ret;
4343 	int abort_no_unlock = 0;
4344 	int ecne_seen = 0;
4345 	int abort_flag;
4346 
4347 	/*
4348 	 * How big should this be, and should it be alloc'd? Lets try the
4349 	 * d-mtu-ceiling for now (2k) and that should hopefully work ...
4350 	 * until we get into jumbo grams and such..
4351 	 */
4352 	uint8_t chunk_buf[SCTP_CHUNK_BUFFER_SIZE];
4353 	int got_auth = 0;
4354 	uint32_t auth_offset = 0, auth_len = 0;
4355 	int auth_skipped = 0;
4356 	int asconf_cnt = 0;
4357 
4358 	SCTPDBG(SCTP_DEBUG_INPUT1, "sctp_process_control: iphlen=%u, offset=%u, length=%u stcb:%p\n",
4359 	    iphlen, *offset, length, (void *)stcb);
4360 
4361 	if (stcb) {
4362 		SCTP_TCB_LOCK_ASSERT(stcb);
4363 	}
4364 	/* validate chunk header length... */
4365 	if (ntohs(ch->chunk_length) < sizeof(*ch)) {
4366 		SCTPDBG(SCTP_DEBUG_INPUT1, "Invalid header length %d\n",
4367 		    ntohs(ch->chunk_length));
4368 		*offset = length;
4369 		return (stcb);
4370 	}
4371 	/*
4372 	 * validate the verification tag
4373 	 */
4374 	vtag_in = ntohl(sh->v_tag);
4375 
4376 	if (ch->chunk_type == SCTP_INITIATION) {
4377 		SCTPDBG(SCTP_DEBUG_INPUT1, "Its an INIT of len:%d vtag:%x\n",
4378 		    ntohs(ch->chunk_length), vtag_in);
4379 		if (vtag_in != 0) {
4380 			/* protocol error- silently discard... */
4381 			SCTP_STAT_INCR(sctps_badvtag);
4382 			if (stcb != NULL) {
4383 				SCTP_TCB_UNLOCK(stcb);
4384 			}
4385 			return (NULL);
4386 		}
4387 	} else if (ch->chunk_type != SCTP_COOKIE_ECHO) {
4388 		/*
4389 		 * If there is no stcb, skip the AUTH chunk and process
4390 		 * later after a stcb is found (to validate the lookup was
4391 		 * valid.
4392 		 */
4393 		if ((ch->chunk_type == SCTP_AUTHENTICATION) &&
4394 		    (stcb == NULL) &&
4395 		    (inp->auth_supported == 1)) {
4396 			/* save this chunk for later processing */
4397 			auth_skipped = 1;
4398 			auth_offset = *offset;
4399 			auth_len = ntohs(ch->chunk_length);
4400 
4401 			/* (temporarily) move past this chunk */
4402 			*offset += SCTP_SIZE32(auth_len);
4403 			if (*offset >= length) {
4404 				/* no more data left in the mbuf chain */
4405 				*offset = length;
4406 				return (NULL);
4407 			}
4408 			ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
4409 			    sizeof(struct sctp_chunkhdr), chunk_buf);
4410 		}
4411 		if (ch == NULL) {
4412 			/* Help */
4413 			*offset = length;
4414 			return (stcb);
4415 		}
4416 		if (ch->chunk_type == SCTP_COOKIE_ECHO) {
4417 			goto process_control_chunks;
4418 		}
4419 		/*
4420 		 * first check if it's an ASCONF with an unknown src addr we
4421 		 * need to look inside to find the association
4422 		 */
4423 		if (ch->chunk_type == SCTP_ASCONF && stcb == NULL) {
4424 			struct sctp_chunkhdr *asconf_ch = ch;
4425 			uint32_t asconf_offset = 0, asconf_len = 0;
4426 
4427 			/* inp's refcount may be reduced */
4428 			SCTP_INP_INCR_REF(inp);
4429 
4430 			asconf_offset = *offset;
4431 			do {
4432 				asconf_len = ntohs(asconf_ch->chunk_length);
4433 				if (asconf_len < sizeof(struct sctp_asconf_paramhdr))
4434 					break;
4435 				stcb = sctp_findassociation_ep_asconf(m,
4436 				    *offset,
4437 				    dst,
4438 				    sh, &inp, netp, vrf_id);
4439 				if (stcb != NULL)
4440 					break;
4441 				asconf_offset += SCTP_SIZE32(asconf_len);
4442 				asconf_ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, asconf_offset,
4443 				    sizeof(struct sctp_chunkhdr), chunk_buf);
4444 			} while (asconf_ch != NULL && asconf_ch->chunk_type == SCTP_ASCONF);
4445 			if (stcb == NULL) {
4446 				/*
4447 				 * reduce inp's refcount if not reduced in
4448 				 * sctp_findassociation_ep_asconf().
4449 				 */
4450 				SCTP_INP_DECR_REF(inp);
4451 			}
4452 
4453 			/* now go back and verify any auth chunk to be sure */
4454 			if (auth_skipped && (stcb != NULL)) {
4455 				struct sctp_auth_chunk *auth;
4456 
4457 				if (auth_len <= SCTP_CHUNK_BUFFER_SIZE) {
4458 					auth = (struct sctp_auth_chunk *)sctp_m_getptr(m, auth_offset, auth_len, chunk_buf);
4459 					got_auth = 1;
4460 					auth_skipped = 0;
4461 				} else {
4462 					auth = NULL;
4463 				}
4464 				if ((auth == NULL) || sctp_handle_auth(stcb, auth, m,
4465 				    auth_offset)) {
4466 					/* auth HMAC failed so dump it */
4467 					*offset = length;
4468 					return (stcb);
4469 				} else {
4470 					/* remaining chunks are HMAC checked */
4471 					stcb->asoc.authenticated = 1;
4472 				}
4473 			}
4474 		}
4475 		if (stcb == NULL) {
4476 			SCTP_SNPRINTF(msg, sizeof(msg), "OOTB, %s:%d at %s", __FILE__, __LINE__, __func__);
4477 			op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
4478 			    msg);
4479 			/* no association, so it's out of the blue... */
4480 			sctp_handle_ootb(m, iphlen, *offset, src, dst, sh, inp, op_err,
4481 			    mflowtype, mflowid, inp->fibnum,
4482 			    vrf_id, port);
4483 			*offset = length;
4484 			return (NULL);
4485 		}
4486 		asoc = &stcb->asoc;
4487 		/* ABORT and SHUTDOWN can use either v_tag... */
4488 		if ((ch->chunk_type == SCTP_ABORT_ASSOCIATION) ||
4489 		    (ch->chunk_type == SCTP_SHUTDOWN_COMPLETE) ||
4490 		    (ch->chunk_type == SCTP_PACKET_DROPPED)) {
4491 			/* Take the T-bit always into account. */
4492 			if ((((ch->chunk_flags & SCTP_HAD_NO_TCB) == 0) &&
4493 			    (vtag_in == asoc->my_vtag)) ||
4494 			    (((ch->chunk_flags & SCTP_HAD_NO_TCB) == SCTP_HAD_NO_TCB) &&
4495 			    (asoc->peer_vtag != htonl(0)) &&
4496 			    (vtag_in == asoc->peer_vtag))) {
4497 				/* this is valid */
4498 			} else {
4499 				/* drop this packet... */
4500 				SCTP_STAT_INCR(sctps_badvtag);
4501 				if (stcb != NULL) {
4502 					SCTP_TCB_UNLOCK(stcb);
4503 				}
4504 				return (NULL);
4505 			}
4506 		} else {
4507 			/* for all other chunks, vtag must match */
4508 			if (vtag_in != asoc->my_vtag) {
4509 				/* invalid vtag... */
4510 				SCTPDBG(SCTP_DEBUG_INPUT3,
4511 				    "invalid vtag: %xh, expect %xh\n",
4512 				    vtag_in, asoc->my_vtag);
4513 				SCTP_STAT_INCR(sctps_badvtag);
4514 				if (stcb != NULL) {
4515 					SCTP_TCB_UNLOCK(stcb);
4516 				}
4517 				*offset = length;
4518 				return (NULL);
4519 			}
4520 		}
4521 	}			/* end if !SCTP_COOKIE_ECHO */
4522 	/*
4523 	 * process all control chunks...
4524 	 */
4525 	if (((ch->chunk_type == SCTP_SELECTIVE_ACK) ||
4526 	    (ch->chunk_type == SCTP_NR_SELECTIVE_ACK) ||
4527 	    (ch->chunk_type == SCTP_HEARTBEAT_REQUEST)) &&
4528 	    (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) {
4529 		/* implied cookie-ack.. we must have lost the ack */
4530 		sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb,
4531 		    *netp);
4532 	}
4533 
4534 process_control_chunks:
4535 	while (IS_SCTP_CONTROL(ch)) {
4536 		/* validate chunk length */
4537 		chk_length = ntohs(ch->chunk_length);
4538 		SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_process_control: processing a chunk type=%u, len=%u\n",
4539 		    ch->chunk_type, chk_length);
4540 		SCTP_LTRACE_CHK(inp, stcb, ch->chunk_type, chk_length);
4541 		if (chk_length < sizeof(*ch) ||
4542 		    (*offset + (int)chk_length) > length) {
4543 			*offset = length;
4544 			return (stcb);
4545 		}
4546 		SCTP_STAT_INCR_COUNTER64(sctps_incontrolchunks);
4547 		/*
4548 		 * INIT and INIT-ACK only gets the init ack "header" portion
4549 		 * only because we don't have to process the peer's COOKIE.
4550 		 * All others get a complete chunk.
4551 		 */
4552 		switch (ch->chunk_type) {
4553 		case SCTP_INITIATION:
4554 			contiguous = sizeof(struct sctp_init_chunk);
4555 			break;
4556 		case SCTP_INITIATION_ACK:
4557 			contiguous = sizeof(struct sctp_init_ack_chunk);
4558 			break;
4559 		default:
4560 			contiguous = min(chk_length, sizeof(chunk_buf));
4561 			break;
4562 		}
4563 		ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
4564 		    contiguous,
4565 		    chunk_buf);
4566 		if (ch == NULL) {
4567 			*offset = length;
4568 			return (stcb);
4569 		}
4570 
4571 		num_chunks++;
4572 		/* Save off the last place we got a control from */
4573 		if (stcb != NULL) {
4574 			if (((netp != NULL) && (*netp != NULL)) || (ch->chunk_type == SCTP_ASCONF)) {
4575 				/*
4576 				 * allow last_control to be NULL if
4577 				 * ASCONF... ASCONF processing will find the
4578 				 * right net later
4579 				 */
4580 				if ((netp != NULL) && (*netp != NULL))
4581 					stcb->asoc.last_control_chunk_from = *netp;
4582 			}
4583 		}
4584 #ifdef SCTP_AUDITING_ENABLED
4585 		sctp_audit_log(0xB0, ch->chunk_type);
4586 #endif
4587 
4588 		/* check to see if this chunk required auth, but isn't */
4589 		if ((stcb != NULL) &&
4590 		    sctp_auth_is_required_chunk(ch->chunk_type, stcb->asoc.local_auth_chunks) &&
4591 		    !stcb->asoc.authenticated) {
4592 			/* "silently" ignore */
4593 			SCTP_STAT_INCR(sctps_recvauthmissing);
4594 			goto next_chunk;
4595 		}
4596 		switch (ch->chunk_type) {
4597 		case SCTP_INITIATION:
4598 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_INIT\n");
4599 			/* The INIT chunk must be the only chunk. */
4600 			if ((num_chunks > 1) ||
4601 			    (length - *offset > (int)SCTP_SIZE32(chk_length))) {
4602 				/*
4603 				 * RFC 4960bis requires stopping the
4604 				 * processing of the packet.
4605 				 */
4606 				*offset = length;
4607 				return (stcb);
4608 			}
4609 			/* Honor our resource limit. */
4610 			if (chk_length > SCTP_LARGEST_INIT_ACCEPTED) {
4611 				op_err = sctp_generate_cause(SCTP_CAUSE_OUT_OF_RESC, "");
4612 				sctp_send_abort(m, iphlen, src, dst, sh, 0, op_err,
4613 				    mflowtype, mflowid, inp->fibnum,
4614 				    vrf_id, port);
4615 				*offset = length;
4616 				if (stcb != NULL) {
4617 					SCTP_TCB_UNLOCK(stcb);
4618 				}
4619 				return (NULL);
4620 			}
4621 			sctp_handle_init(m, iphlen, *offset, src, dst, sh,
4622 			    (struct sctp_init_chunk *)ch, inp,
4623 			    stcb, *netp,
4624 			    mflowtype, mflowid,
4625 			    vrf_id, port);
4626 			*offset = length;
4627 			if (stcb != NULL) {
4628 				SCTP_TCB_UNLOCK(stcb);
4629 			}
4630 			return (NULL);
4631 			break;
4632 		case SCTP_PAD_CHUNK:
4633 			break;
4634 		case SCTP_INITIATION_ACK:
4635 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_INIT_ACK\n");
4636 			if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4637 				/* We are not interested anymore */
4638 				if ((stcb != NULL) && (stcb->asoc.total_output_queue_size)) {
4639 					;
4640 				} else {
4641 					*offset = length;
4642 					if (stcb != NULL) {
4643 						(void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
4644 						    SCTP_FROM_SCTP_INPUT + SCTP_LOC_29);
4645 					}
4646 					return (NULL);
4647 				}
4648 			}
4649 			/* The INIT-ACK chunk must be the only chunk. */
4650 			if ((num_chunks > 1) ||
4651 			    (length - *offset > (int)SCTP_SIZE32(chk_length))) {
4652 				*offset = length;
4653 				return (stcb);
4654 			}
4655 			if ((netp != NULL) && (*netp != NULL)) {
4656 				ret = sctp_handle_init_ack(m, iphlen, *offset,
4657 				    src, dst, sh,
4658 				    (struct sctp_init_ack_chunk *)ch,
4659 				    stcb, *netp,
4660 				    &abort_no_unlock,
4661 				    mflowtype, mflowid,
4662 				    vrf_id);
4663 			} else {
4664 				ret = -1;
4665 			}
4666 			*offset = length;
4667 			if (abort_no_unlock) {
4668 				return (NULL);
4669 			}
4670 			/*
4671 			 * Special case, I must call the output routine to
4672 			 * get the cookie echoed
4673 			 */
4674 			if ((stcb != NULL) && (ret == 0)) {
4675 				sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC, SCTP_SO_NOT_LOCKED);
4676 			}
4677 			return (stcb);
4678 			break;
4679 		case SCTP_SELECTIVE_ACK:
4680 		case SCTP_NR_SELECTIVE_ACK:
4681 			{
4682 				int abort_now = 0;
4683 				uint32_t a_rwnd, cum_ack;
4684 				uint16_t num_seg, num_nr_seg, num_dup;
4685 				uint8_t flags;
4686 				int offset_seg, offset_dup;
4687 
4688 				SCTPDBG(SCTP_DEBUG_INPUT3, "%s\n",
4689 				    ch->chunk_type == SCTP_SELECTIVE_ACK ? "SCTP_SACK" : "SCTP_NR_SACK");
4690 				SCTP_STAT_INCR(sctps_recvsacks);
4691 				if (stcb == NULL) {
4692 					SCTPDBG(SCTP_DEBUG_INDATA1, "No stcb when processing %s chunk\n",
4693 					    (ch->chunk_type == SCTP_SELECTIVE_ACK) ? "SCTP_SACK" : "SCTP_NR_SACK");
4694 					break;
4695 				}
4696 				if (ch->chunk_type == SCTP_SELECTIVE_ACK) {
4697 					if (chk_length < sizeof(struct sctp_sack_chunk)) {
4698 						SCTPDBG(SCTP_DEBUG_INDATA1, "Bad size on SACK chunk, too small\n");
4699 						break;
4700 					}
4701 				} else {
4702 					if (stcb->asoc.nrsack_supported == 0) {
4703 						goto unknown_chunk;
4704 					}
4705 					if (chk_length < sizeof(struct sctp_nr_sack_chunk)) {
4706 						SCTPDBG(SCTP_DEBUG_INDATA1, "Bad size on NR_SACK chunk, too small\n");
4707 						break;
4708 					}
4709 				}
4710 				if (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_ACK_SENT) {
4711 					/*-
4712 					 * If we have sent a shutdown-ack, we will pay no
4713 					 * attention to a sack sent in to us since
4714 					 * we don't care anymore.
4715 					 */
4716 					break;
4717 				}
4718 				flags = ch->chunk_flags;
4719 				if (ch->chunk_type == SCTP_SELECTIVE_ACK) {
4720 					struct sctp_sack_chunk *sack;
4721 
4722 					sack = (struct sctp_sack_chunk *)ch;
4723 					cum_ack = ntohl(sack->sack.cum_tsn_ack);
4724 					num_seg = ntohs(sack->sack.num_gap_ack_blks);
4725 					num_nr_seg = 0;
4726 					num_dup = ntohs(sack->sack.num_dup_tsns);
4727 					a_rwnd = ntohl(sack->sack.a_rwnd);
4728 					if (sizeof(struct sctp_sack_chunk) +
4729 					    num_seg * sizeof(struct sctp_gap_ack_block) +
4730 					    num_dup * sizeof(uint32_t) != chk_length) {
4731 						SCTPDBG(SCTP_DEBUG_INDATA1, "Bad size of SACK chunk\n");
4732 						break;
4733 					}
4734 					offset_seg = *offset + sizeof(struct sctp_sack_chunk);
4735 					offset_dup = offset_seg + num_seg * sizeof(struct sctp_gap_ack_block);
4736 				} else {
4737 					struct sctp_nr_sack_chunk *nr_sack;
4738 
4739 					nr_sack = (struct sctp_nr_sack_chunk *)ch;
4740 					cum_ack = ntohl(nr_sack->nr_sack.cum_tsn_ack);
4741 					num_seg = ntohs(nr_sack->nr_sack.num_gap_ack_blks);
4742 					num_nr_seg = ntohs(nr_sack->nr_sack.num_nr_gap_ack_blks);
4743 					num_dup = ntohs(nr_sack->nr_sack.num_dup_tsns);
4744 					a_rwnd = ntohl(nr_sack->nr_sack.a_rwnd);
4745 					if (sizeof(struct sctp_nr_sack_chunk) +
4746 					    (num_seg + num_nr_seg) * sizeof(struct sctp_gap_ack_block) +
4747 					    num_dup * sizeof(uint32_t) != chk_length) {
4748 						SCTPDBG(SCTP_DEBUG_INDATA1, "Bad size of NR_SACK chunk\n");
4749 						break;
4750 					}
4751 					offset_seg = *offset + sizeof(struct sctp_nr_sack_chunk);
4752 					offset_dup = offset_seg + (num_seg + num_nr_seg) * sizeof(struct sctp_gap_ack_block);
4753 				}
4754 				SCTPDBG(SCTP_DEBUG_INPUT3, "%s process cum_ack:%x num_seg:%d a_rwnd:%d\n",
4755 				    (ch->chunk_type == SCTP_SELECTIVE_ACK) ? "SCTP_SACK" : "SCTP_NR_SACK",
4756 				    cum_ack, num_seg, a_rwnd);
4757 				stcb->asoc.seen_a_sack_this_pkt = 1;
4758 				if ((stcb->asoc.pr_sctp_cnt == 0) &&
4759 				    (num_seg == 0) && (num_nr_seg == 0) &&
4760 				    SCTP_TSN_GE(cum_ack, stcb->asoc.last_acked_seq) &&
4761 				    (stcb->asoc.saw_sack_with_frags == 0) &&
4762 				    (stcb->asoc.saw_sack_with_nr_frags == 0) &&
4763 				    (!TAILQ_EMPTY(&stcb->asoc.sent_queue))) {
4764 					/*
4765 					 * We have a SIMPLE sack having no
4766 					 * prior segments and data on sent
4767 					 * queue to be acked. Use the faster
4768 					 * path sack processing. We also
4769 					 * allow window update sacks with no
4770 					 * missing segments to go this way
4771 					 * too.
4772 					 */
4773 					sctp_express_handle_sack(stcb, cum_ack, a_rwnd,
4774 					    &abort_now, ecne_seen);
4775 				} else {
4776 					if ((netp != NULL) && (*netp != NULL)) {
4777 						sctp_handle_sack(m, offset_seg, offset_dup, stcb,
4778 						    num_seg, num_nr_seg, num_dup, &abort_now, flags,
4779 						    cum_ack, a_rwnd, ecne_seen);
4780 					}
4781 				}
4782 				if (abort_now) {
4783 					/* ABORT signal from sack processing */
4784 					*offset = length;
4785 					return (NULL);
4786 				}
4787 				if (TAILQ_EMPTY(&stcb->asoc.send_queue) &&
4788 				    TAILQ_EMPTY(&stcb->asoc.sent_queue) &&
4789 				    (stcb->asoc.stream_queue_cnt == 0)) {
4790 					sctp_ulp_notify(SCTP_NOTIFY_SENDER_DRY, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
4791 				}
4792 				break;
4793 			}
4794 		case SCTP_HEARTBEAT_REQUEST:
4795 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_HEARTBEAT\n");
4796 			if ((stcb != NULL) && (netp != NULL) && (*netp != NULL)) {
4797 				SCTP_STAT_INCR(sctps_recvheartbeat);
4798 				sctp_send_heartbeat_ack(stcb, m, *offset,
4799 				    chk_length, *netp);
4800 			}
4801 			break;
4802 		case SCTP_HEARTBEAT_ACK:
4803 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_HEARTBEAT_ACK\n");
4804 			if ((stcb == NULL) || (chk_length != sizeof(struct sctp_heartbeat_chunk))) {
4805 				/* Its not ours */
4806 				break;
4807 			}
4808 			SCTP_STAT_INCR(sctps_recvheartbeatack);
4809 			if ((netp != NULL) && (*netp != NULL)) {
4810 				sctp_handle_heartbeat_ack((struct sctp_heartbeat_chunk *)ch,
4811 				    stcb, *netp);
4812 			}
4813 			break;
4814 		case SCTP_ABORT_ASSOCIATION:
4815 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ABORT, stcb %p\n",
4816 			    (void *)stcb);
4817 			*offset = length;
4818 			if ((stcb != NULL) && (netp != NULL) && (*netp != NULL)) {
4819 				if (sctp_handle_abort((struct sctp_abort_chunk *)ch, stcb, *netp)) {
4820 					return (NULL);
4821 				} else {
4822 					return (stcb);
4823 				}
4824 			} else {
4825 				return (NULL);
4826 			}
4827 			break;
4828 		case SCTP_SHUTDOWN:
4829 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SHUTDOWN, stcb %p\n",
4830 			    (void *)stcb);
4831 			if ((stcb == NULL) || (chk_length != sizeof(struct sctp_shutdown_chunk))) {
4832 				break;
4833 			}
4834 			if ((netp != NULL) && (*netp != NULL)) {
4835 				abort_flag = 0;
4836 				sctp_handle_shutdown((struct sctp_shutdown_chunk *)ch,
4837 				    stcb, *netp, &abort_flag);
4838 				if (abort_flag) {
4839 					*offset = length;
4840 					return (NULL);
4841 				}
4842 			}
4843 			break;
4844 		case SCTP_SHUTDOWN_ACK:
4845 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SHUTDOWN_ACK, stcb %p\n", (void *)stcb);
4846 			if ((chk_length == sizeof(struct sctp_shutdown_ack_chunk)) &&
4847 			    (stcb != NULL) && (netp != NULL) && (*netp != NULL)) {
4848 				sctp_handle_shutdown_ack((struct sctp_shutdown_ack_chunk *)ch, stcb, *netp);
4849 				*offset = length;
4850 				return (NULL);
4851 			}
4852 			break;
4853 		case SCTP_OPERATION_ERROR:
4854 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_OP_ERR\n");
4855 			if ((stcb != NULL) && (netp != NULL) && (*netp != NULL) &&
4856 			    sctp_handle_error(ch, stcb, *netp, contiguous) < 0) {
4857 				*offset = length;
4858 				return (NULL);
4859 			}
4860 			break;
4861 		case SCTP_COOKIE_ECHO:
4862 			SCTPDBG(SCTP_DEBUG_INPUT3,
4863 			    "SCTP_COOKIE_ECHO, stcb %p\n", (void *)stcb);
4864 			if ((stcb != NULL) && (stcb->asoc.total_output_queue_size > 0)) {
4865 				;
4866 			} else {
4867 				if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4868 					/* We are not interested anymore */
4869 			abend:
4870 					if (stcb != NULL) {
4871 						SCTP_TCB_UNLOCK(stcb);
4872 					}
4873 					*offset = length;
4874 					return (NULL);
4875 				}
4876 			}
4877 			/*-
4878 			 * First are we accepting? We do this again here
4879 			 * since it is possible that a previous endpoint WAS
4880 			 * listening responded to a INIT-ACK and then
4881 			 * closed. We opened and bound.. and are now no
4882 			 * longer listening.
4883 			 *
4884 			 * XXXGL: notes on checking listen queue length.
4885 			 * 1) SCTP_IS_LISTENING() doesn't necessarily mean
4886 			 *    SOLISTENING(), because a listening "UDP type"
4887 			 *    socket isn't listening in terms of the socket
4888 			 *    layer.  It is a normal data flow socket, that
4889 			 *    can fork off new connections.  Thus, we should
4890 			 *    look into sol_qlen only in case we are !UDP.
4891 			 * 2) Checking sol_qlen in general requires locking
4892 			 *    the socket, and this code lacks that.
4893 			 */
4894 			if ((stcb == NULL) &&
4895 			    (!SCTP_IS_LISTENING(inp) ||
4896 			    (((inp->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE) == 0) &&
4897 			    inp->sctp_socket->sol_qlen >= inp->sctp_socket->sol_qlimit))) {
4898 				if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
4899 				    (SCTP_BASE_SYSCTL(sctp_abort_if_one_2_one_hits_limit))) {
4900 					op_err = sctp_generate_cause(SCTP_CAUSE_OUT_OF_RESC, "");
4901 					sctp_abort_association(inp, stcb, m, iphlen,
4902 					    src, dst, sh, op_err,
4903 					    mflowtype, mflowid,
4904 					    vrf_id, port);
4905 				}
4906 				*offset = length;
4907 				return (NULL);
4908 			} else {
4909 				struct mbuf *ret_buf;
4910 				struct sctp_inpcb *linp;
4911 				struct sctp_tmit_chunk *chk;
4912 
4913 				if (inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE |
4914 				    SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
4915 					goto abend;
4916 				}
4917 
4918 				if (stcb) {
4919 					linp = NULL;
4920 				} else {
4921 					linp = inp;
4922 				}
4923 
4924 				if (linp != NULL) {
4925 					SCTP_ASOC_CREATE_LOCK(linp);
4926 				}
4927 
4928 				if (netp != NULL) {
4929 					struct sctp_tcb *locked_stcb;
4930 
4931 					locked_stcb = stcb;
4932 					ret_buf =
4933 					    sctp_handle_cookie_echo(m, iphlen,
4934 					    *offset,
4935 					    src, dst,
4936 					    sh,
4937 					    (struct sctp_cookie_echo_chunk *)ch,
4938 					    &inp, &stcb, netp,
4939 					    auth_skipped,
4940 					    auth_offset,
4941 					    auth_len,
4942 					    &locked_stcb,
4943 					    mflowtype,
4944 					    mflowid,
4945 					    vrf_id,
4946 					    port);
4947 					if ((locked_stcb != NULL) && (locked_stcb != stcb)) {
4948 						SCTP_TCB_UNLOCK(locked_stcb);
4949 					}
4950 					if (stcb != NULL) {
4951 						SCTP_TCB_LOCK_ASSERT(stcb);
4952 					}
4953 				} else {
4954 					ret_buf = NULL;
4955 				}
4956 				if (linp != NULL) {
4957 					SCTP_ASOC_CREATE_UNLOCK(linp);
4958 				}
4959 				if (ret_buf == NULL) {
4960 					if (stcb != NULL) {
4961 						SCTP_TCB_UNLOCK(stcb);
4962 					}
4963 					SCTPDBG(SCTP_DEBUG_INPUT3,
4964 					    "GAK, null buffer\n");
4965 					*offset = length;
4966 					return (NULL);
4967 				}
4968 				/* if AUTH skipped, see if it verified... */
4969 				if (auth_skipped) {
4970 					got_auth = 1;
4971 					auth_skipped = 0;
4972 				}
4973 				/* Restart the timer if we have pending data */
4974 				TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
4975 					if (chk->whoTo != NULL) {
4976 						break;
4977 					}
4978 				}
4979 				if (chk != NULL) {
4980 					sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, chk->whoTo);
4981 				}
4982 			}
4983 			break;
4984 		case SCTP_COOKIE_ACK:
4985 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_COOKIE_ACK, stcb %p\n", (void *)stcb);
4986 			if ((stcb == NULL) || chk_length != sizeof(struct sctp_cookie_ack_chunk)) {
4987 				break;
4988 			}
4989 			if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4990 				/* We are not interested anymore */
4991 				if ((stcb) && (stcb->asoc.total_output_queue_size)) {
4992 					;
4993 				} else if (stcb) {
4994 					(void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
4995 					    SCTP_FROM_SCTP_INPUT + SCTP_LOC_30);
4996 					*offset = length;
4997 					return (NULL);
4998 				}
4999 			}
5000 			if ((netp != NULL) && (*netp != NULL)) {
5001 				sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb, *netp);
5002 			}
5003 			break;
5004 		case SCTP_ECN_ECHO:
5005 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ECN_ECHO\n");
5006 			if (stcb == NULL) {
5007 				break;
5008 			}
5009 			if (stcb->asoc.ecn_supported == 0) {
5010 				goto unknown_chunk;
5011 			}
5012 			if ((chk_length != sizeof(struct sctp_ecne_chunk)) &&
5013 			    (chk_length != sizeof(struct old_sctp_ecne_chunk))) {
5014 				break;
5015 			}
5016 			sctp_handle_ecn_echo((struct sctp_ecne_chunk *)ch, stcb);
5017 			ecne_seen = 1;
5018 			break;
5019 		case SCTP_ECN_CWR:
5020 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ECN_CWR\n");
5021 			if (stcb == NULL) {
5022 				break;
5023 			}
5024 			if (stcb->asoc.ecn_supported == 0) {
5025 				goto unknown_chunk;
5026 			}
5027 			if (chk_length != sizeof(struct sctp_cwr_chunk)) {
5028 				break;
5029 			}
5030 			sctp_handle_ecn_cwr((struct sctp_cwr_chunk *)ch, stcb, *netp);
5031 			break;
5032 		case SCTP_SHUTDOWN_COMPLETE:
5033 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SHUTDOWN_COMPLETE, stcb %p\n", (void *)stcb);
5034 			/* must be first and only chunk */
5035 			if ((num_chunks > 1) ||
5036 			    (length - *offset > (int)SCTP_SIZE32(chk_length))) {
5037 				*offset = length;
5038 				return (stcb);
5039 			}
5040 			if ((chk_length == sizeof(struct sctp_shutdown_complete_chunk)) &&
5041 			    (stcb != NULL) && (netp != NULL) && (*netp != NULL)) {
5042 				sctp_handle_shutdown_complete((struct sctp_shutdown_complete_chunk *)ch,
5043 				    stcb, *netp);
5044 				*offset = length;
5045 				return (NULL);
5046 			}
5047 			break;
5048 		case SCTP_ASCONF:
5049 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ASCONF\n");
5050 			if (stcb != NULL) {
5051 				if (stcb->asoc.asconf_supported == 0) {
5052 					goto unknown_chunk;
5053 				}
5054 				sctp_handle_asconf(m, *offset, src,
5055 				    (struct sctp_asconf_chunk *)ch, stcb, asconf_cnt == 0);
5056 				asconf_cnt++;
5057 			}
5058 			break;
5059 		case SCTP_ASCONF_ACK:
5060 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ASCONF_ACK\n");
5061 			if (stcb == NULL) {
5062 				break;
5063 			}
5064 			if (stcb->asoc.asconf_supported == 0) {
5065 				goto unknown_chunk;
5066 			}
5067 			if (chk_length < sizeof(struct sctp_asconf_ack_chunk)) {
5068 				break;
5069 			}
5070 			if ((netp != NULL) && (*netp != NULL)) {
5071 				/* He's alive so give him credit */
5072 				if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
5073 					sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
5074 					    stcb->asoc.overall_error_count,
5075 					    0,
5076 					    SCTP_FROM_SCTP_INPUT,
5077 					    __LINE__);
5078 				}
5079 				stcb->asoc.overall_error_count = 0;
5080 				sctp_handle_asconf_ack(m, *offset,
5081 				    (struct sctp_asconf_ack_chunk *)ch, stcb, *netp, &abort_no_unlock);
5082 				if (abort_no_unlock)
5083 					return (NULL);
5084 			}
5085 			break;
5086 		case SCTP_FORWARD_CUM_TSN:
5087 		case SCTP_IFORWARD_CUM_TSN:
5088 			SCTPDBG(SCTP_DEBUG_INPUT3, "%s\n",
5089 			    ch->chunk_type == SCTP_FORWARD_CUM_TSN ? "FORWARD_TSN" : "I_FORWARD_TSN");
5090 			if (stcb == NULL) {
5091 				break;
5092 			}
5093 			if (stcb->asoc.prsctp_supported == 0) {
5094 				goto unknown_chunk;
5095 			}
5096 			if (chk_length < sizeof(struct sctp_forward_tsn_chunk)) {
5097 				break;
5098 			}
5099 			if (((stcb->asoc.idata_supported == 1) && (ch->chunk_type == SCTP_FORWARD_CUM_TSN)) ||
5100 			    ((stcb->asoc.idata_supported == 0) && (ch->chunk_type == SCTP_IFORWARD_CUM_TSN))) {
5101 				if (ch->chunk_type == SCTP_FORWARD_CUM_TSN) {
5102 					SCTP_SNPRINTF(msg, sizeof(msg), "%s", "FORWARD-TSN chunk received when I-FORWARD-TSN was negotiated");
5103 				} else {
5104 					SCTP_SNPRINTF(msg, sizeof(msg), "%s", "I-FORWARD-TSN chunk received when FORWARD-TSN was negotiated");
5105 				}
5106 				op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
5107 				sctp_abort_an_association(inp, stcb, op_err, false, SCTP_SO_NOT_LOCKED);
5108 				*offset = length;
5109 				return (NULL);
5110 			}
5111 			*fwd_tsn_seen = 1;
5112 			if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
5113 				/* We are not interested anymore */
5114 				(void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
5115 				    SCTP_FROM_SCTP_INPUT + SCTP_LOC_31);
5116 				*offset = length;
5117 				return (NULL);
5118 			}
5119 			/*
5120 			 * For sending a SACK this looks like DATA chunks.
5121 			 */
5122 			stcb->asoc.last_data_chunk_from = stcb->asoc.last_control_chunk_from;
5123 			abort_flag = 0;
5124 			sctp_handle_forward_tsn(stcb,
5125 			    (struct sctp_forward_tsn_chunk *)ch, &abort_flag, m, *offset);
5126 			if (abort_flag) {
5127 				*offset = length;
5128 				return (NULL);
5129 			}
5130 			break;
5131 		case SCTP_STREAM_RESET:
5132 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_STREAM_RESET\n");
5133 			if (stcb == NULL) {
5134 				break;
5135 			}
5136 			if (stcb->asoc.reconfig_supported == 0) {
5137 				goto unknown_chunk;
5138 			}
5139 			if (chk_length < sizeof(struct sctp_stream_reset_tsn_req)) {
5140 				break;
5141 			}
5142 			if (sctp_handle_stream_reset(stcb, m, *offset, ch)) {
5143 				/* stop processing */
5144 				*offset = length;
5145 				return (NULL);
5146 			}
5147 			break;
5148 		case SCTP_PACKET_DROPPED:
5149 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_PACKET_DROPPED\n");
5150 			if (stcb == NULL) {
5151 				break;
5152 			}
5153 			if (stcb->asoc.pktdrop_supported == 0) {
5154 				goto unknown_chunk;
5155 			}
5156 			if (chk_length < sizeof(struct sctp_pktdrop_chunk)) {
5157 				break;
5158 			}
5159 			if ((netp != NULL) && (*netp != NULL)) {
5160 				sctp_handle_packet_dropped((struct sctp_pktdrop_chunk *)ch,
5161 				    stcb, *netp,
5162 				    min(chk_length, contiguous));
5163 			}
5164 			break;
5165 		case SCTP_AUTHENTICATION:
5166 			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_AUTHENTICATION\n");
5167 			if (stcb == NULL) {
5168 				/* save the first AUTH for later processing */
5169 				if (auth_skipped == 0) {
5170 					auth_offset = *offset;
5171 					auth_len = chk_length;
5172 					auth_skipped = 1;
5173 				}
5174 				/* skip this chunk (temporarily) */
5175 				break;
5176 			}
5177 			if (stcb->asoc.auth_supported == 0) {
5178 				goto unknown_chunk;
5179 			}
5180 			if ((chk_length < (sizeof(struct sctp_auth_chunk))) ||
5181 			    (chk_length > (sizeof(struct sctp_auth_chunk) +
5182 			    SCTP_AUTH_DIGEST_LEN_MAX))) {
5183 				/* Its not ours */
5184 				*offset = length;
5185 				return (stcb);
5186 			}
5187 			if (got_auth == 1) {
5188 				/* skip this chunk... it's already auth'd */
5189 				break;
5190 			}
5191 			got_auth = 1;
5192 			if (sctp_handle_auth(stcb, (struct sctp_auth_chunk *)ch, m, *offset)) {
5193 				/* auth HMAC failed so dump the packet */
5194 				*offset = length;
5195 				return (stcb);
5196 			} else {
5197 				/* remaining chunks are HMAC checked */
5198 				stcb->asoc.authenticated = 1;
5199 			}
5200 			break;
5201 
5202 		default:
5203 	unknown_chunk:
5204 			/* it's an unknown chunk! */
5205 			if ((ch->chunk_type & 0x40) &&
5206 			    (stcb != NULL) &&
5207 			    (SCTP_GET_STATE(stcb) != SCTP_STATE_EMPTY) &&
5208 			    (SCTP_GET_STATE(stcb) != SCTP_STATE_INUSE) &&
5209 			    (SCTP_GET_STATE(stcb) != SCTP_STATE_COOKIE_WAIT)) {
5210 				struct sctp_gen_error_cause *cause;
5211 				int len;
5212 
5213 				op_err = sctp_get_mbuf_for_msg(sizeof(struct sctp_gen_error_cause),
5214 				    0, M_NOWAIT, 1, MT_DATA);
5215 				if (op_err != NULL) {
5216 					len = min(SCTP_SIZE32(chk_length), (uint32_t)(length - *offset));
5217 					cause = mtod(op_err, struct sctp_gen_error_cause *);
5218 					cause->code = htons(SCTP_CAUSE_UNRECOG_CHUNK);
5219 					cause->length = htons((uint16_t)(len + sizeof(struct sctp_gen_error_cause)));
5220 					SCTP_BUF_LEN(op_err) = sizeof(struct sctp_gen_error_cause);
5221 					SCTP_BUF_NEXT(op_err) = SCTP_M_COPYM(m, *offset, len, M_NOWAIT);
5222 					if (SCTP_BUF_NEXT(op_err) != NULL) {
5223 #ifdef SCTP_MBUF_LOGGING
5224 						if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
5225 							sctp_log_mbc(SCTP_BUF_NEXT(op_err), SCTP_MBUF_ICOPY);
5226 						}
5227 #endif
5228 						sctp_queue_op_err(stcb, op_err);
5229 					} else {
5230 						sctp_m_freem(op_err);
5231 					}
5232 				}
5233 			}
5234 			if ((ch->chunk_type & 0x80) == 0) {
5235 				/* discard this packet */
5236 				*offset = length;
5237 				return (stcb);
5238 			}	/* else skip this bad chunk and continue... */
5239 			break;
5240 		}		/* switch (ch->chunk_type) */
5241 
5242 next_chunk:
5243 		/* get the next chunk */
5244 		*offset += SCTP_SIZE32(chk_length);
5245 		if (*offset >= length) {
5246 			/* no more data left in the mbuf chain */
5247 			break;
5248 		}
5249 		ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
5250 		    sizeof(struct sctp_chunkhdr), chunk_buf);
5251 		if (ch == NULL) {
5252 			*offset = length;
5253 			return (stcb);
5254 		}
5255 	}			/* while */
5256 
5257 	if ((asconf_cnt > 0) && (stcb != NULL)) {
5258 		sctp_send_asconf_ack(stcb);
5259 	}
5260 	return (stcb);
5261 }
5262 
5263 /*
5264  * common input chunk processing (v4 and v6)
5265  */
5266 void
5267 sctp_common_input_processing(struct mbuf **mm, int iphlen, int offset, int length,
5268     struct sockaddr *src, struct sockaddr *dst,
5269     struct sctphdr *sh, struct sctp_chunkhdr *ch,
5270     uint8_t compute_crc,
5271     uint8_t ecn_bits,
5272     uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum,
5273     uint32_t vrf_id, uint16_t port)
5274 {
5275 	char msg[SCTP_DIAG_INFO_LEN];
5276 	struct mbuf *m = *mm, *op_err;
5277 	struct sctp_inpcb *inp = NULL, *inp_decr = NULL;
5278 	struct sctp_tcb *stcb = NULL;
5279 	struct sctp_nets *net = NULL;
5280 	uint32_t high_tsn;
5281 	uint32_t cksum_in_hdr;
5282 	int un_sent;
5283 	int cnt_ctrl_ready = 0;
5284 	int fwd_tsn_seen = 0, data_processed = 0;
5285 	bool cksum_validated, stcb_looked_up;
5286 
5287 	SCTP_STAT_INCR(sctps_recvdatagrams);
5288 #ifdef SCTP_AUDITING_ENABLED
5289 	sctp_audit_log(0xE0, 1);
5290 	sctp_auditing(0, inp, stcb, net);
5291 #endif
5292 
5293 	stcb_looked_up = false;
5294 	if (compute_crc != 0) {
5295 		cksum_validated = false;
5296 		cksum_in_hdr = sh->checksum;
5297 		if (cksum_in_hdr != htonl(0)) {
5298 			uint32_t cksum_calculated;
5299 
5300 	validate_cksum:
5301 			sh->checksum = 0;
5302 			cksum_calculated = sctp_calculate_cksum(m, iphlen);
5303 			sh->checksum = cksum_in_hdr;
5304 			if (cksum_calculated != cksum_in_hdr) {
5305 				if (stcb_looked_up) {
5306 					/*
5307 					 * The packet has a zero checksum,
5308 					 * which is not the correct CRC, no
5309 					 * stcb has been found or an stcb
5310 					 * has been found but an incorrect
5311 					 * zero checksum is not acceptable.
5312 					 */
5313 					KASSERT(cksum_in_hdr == htonl(0),
5314 					    ("cksum in header not zero: %x",
5315 					    ntohl(cksum_in_hdr)));
5316 					if ((inp == NULL) &&
5317 					    (SCTP_BASE_SYSCTL(sctp_ootb_with_zero_cksum) == 1)) {
5318 						/*
5319 						 * This is an OOTB packet,
5320 						 * depending on the sysctl
5321 						 * variable, pretend that
5322 						 * the checksum is
5323 						 * acceptable, to allow an
5324 						 * appropriate response
5325 						 * (ABORT, for examlpe) to
5326 						 * be sent.
5327 						 */
5328 						KASSERT(stcb == NULL,
5329 						    ("stcb is %p", stcb));
5330 						SCTP_STAT_INCR(sctps_recvzerocrc);
5331 						goto cksum_validated;
5332 					}
5333 				} else {
5334 					stcb = sctp_findassociation_addr(m, offset, src, dst,
5335 					    sh, ch, &inp, &net, vrf_id);
5336 				}
5337 				SCTPDBG(SCTP_DEBUG_INPUT1, "Bad cksum in SCTP packet:%x calculated:%x m:%p mlen:%d iphlen:%d\n",
5338 				    ntohl(cksum_in_hdr), ntohl(cksum_calculated), (void *)m, length, iphlen);
5339 #if defined(INET) || defined(INET6)
5340 				if ((ch->chunk_type != SCTP_INITIATION) &&
5341 				    (net != NULL) && (net->port != port)) {
5342 					if (net->port == 0) {
5343 						/*
5344 						 * UDP encapsulation turned
5345 						 * on.
5346 						 */
5347 						net->mtu -= sizeof(struct udphdr);
5348 						if (stcb->asoc.smallest_mtu > net->mtu) {
5349 							sctp_pathmtu_adjustment(stcb, net->mtu, true);
5350 						}
5351 					} else if (port == 0) {
5352 						/*
5353 						 * UDP encapsulation turned
5354 						 * off.
5355 						 */
5356 						net->mtu += sizeof(struct udphdr);
5357 						/* XXX Update smallest_mtu */
5358 					}
5359 					net->port = port;
5360 				}
5361 #endif
5362 				if (net != NULL) {
5363 					net->flowtype = mflowtype;
5364 					net->flowid = mflowid;
5365 				}
5366 				SCTP_PROBE5(receive, NULL, stcb, m, stcb, sh);
5367 				if ((inp != NULL) && (stcb != NULL)) {
5368 					if (stcb->asoc.pktdrop_supported) {
5369 						sctp_send_packet_dropped(stcb, net, m, length, iphlen, 1);
5370 						sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_INPUT_ERROR, SCTP_SO_NOT_LOCKED);
5371 					}
5372 				} else if ((inp != NULL) && (stcb == NULL)) {
5373 					inp_decr = inp;
5374 				}
5375 				SCTP_STAT_INCR(sctps_badsum);
5376 				SCTP_STAT_INCR_COUNTER32(sctps_checksumerrors);
5377 				goto out;
5378 			} else {
5379 				cksum_validated = true;
5380 			}
5381 		}
5382 		KASSERT(cksum_validated || cksum_in_hdr == htonl(0),
5383 		    ("cksum 0x%08x not zero and not validated", ntohl(cksum_in_hdr)));
5384 		if (!cksum_validated) {
5385 			stcb = sctp_findassociation_addr(m, offset, src, dst,
5386 			    sh, ch, &inp, &net, vrf_id);
5387 			stcb_looked_up = true;
5388 			if ((stcb == NULL) || (stcb->asoc.zero_checksum == 0)) {
5389 				goto validate_cksum;
5390 			}
5391 			SCTP_STAT_INCR(sctps_recvzerocrc);
5392 		}
5393 	}
5394 cksum_validated:
5395 	/* Destination port of 0 is illegal, based on RFC4960. */
5396 	if (sh->dest_port == htons(0)) {
5397 		SCTP_STAT_INCR(sctps_hdrops);
5398 		if ((stcb == NULL) && (inp != NULL)) {
5399 			inp_decr = inp;
5400 		}
5401 		goto out;
5402 	}
5403 	if (!stcb_looked_up) {
5404 		stcb = sctp_findassociation_addr(m, offset, src, dst,
5405 		    sh, ch, &inp, &net, vrf_id);
5406 	}
5407 #if defined(INET) || defined(INET6)
5408 	if ((ch->chunk_type != SCTP_INITIATION) &&
5409 	    (net != NULL) && (net->port != port)) {
5410 		if (net->port == 0) {
5411 			/* UDP encapsulation turned on. */
5412 			net->mtu -= sizeof(struct udphdr);
5413 			if (stcb->asoc.smallest_mtu > net->mtu) {
5414 				sctp_pathmtu_adjustment(stcb, net->mtu, true);
5415 			}
5416 		} else if (port == 0) {
5417 			/* UDP encapsulation turned off. */
5418 			net->mtu += sizeof(struct udphdr);
5419 			/* XXX Update smallest_mtu */
5420 		}
5421 		net->port = port;
5422 	}
5423 #endif
5424 	if (net != NULL) {
5425 		net->flowtype = mflowtype;
5426 		net->flowid = mflowid;
5427 	}
5428 	if (inp == NULL) {
5429 		SCTP_STAT_INCR(sctps_noport);
5430 		SCTP_PROBE5(receive, NULL, stcb, m, stcb, sh);
5431 		if (badport_bandlim(BANDLIM_SCTP_OOTB) < 0) {
5432 			goto out;
5433 		}
5434 		if (ch->chunk_type == SCTP_SHUTDOWN_ACK) {
5435 			SCTP_STAT_INCR_COUNTER64(sctps_incontrolchunks);
5436 			sctp_send_shutdown_complete2(src, dst, sh,
5437 			    mflowtype, mflowid, fibnum,
5438 			    vrf_id, port);
5439 			goto out;
5440 		}
5441 		if (ch->chunk_type == SCTP_SHUTDOWN_COMPLETE) {
5442 			SCTP_STAT_INCR_COUNTER64(sctps_incontrolchunks);
5443 			goto out;
5444 		}
5445 		if (ch->chunk_type != SCTP_ABORT_ASSOCIATION) {
5446 			if ((SCTP_BASE_SYSCTL(sctp_blackhole) == 0) ||
5447 			    ((SCTP_BASE_SYSCTL(sctp_blackhole) == 1) &&
5448 			    (ch->chunk_type != SCTP_INIT))) {
5449 				op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
5450 				    "Out of the blue");
5451 				sctp_send_abort(m, iphlen, src, dst,
5452 				    sh, 0, op_err,
5453 				    mflowtype, mflowid, fibnum,
5454 				    vrf_id, port);
5455 			}
5456 		}
5457 		goto out;
5458 	} else if (stcb == NULL) {
5459 		inp_decr = inp;
5460 	}
5461 	SCTPDBG(SCTP_DEBUG_INPUT1, "Ok, Common input processing called, m:%p iphlen:%d offset:%d length:%d stcb:%p\n",
5462 	    (void *)m, iphlen, offset, length, (void *)stcb);
5463 	if (stcb) {
5464 		/* always clear this before beginning a packet */
5465 		stcb->asoc.authenticated = 0;
5466 		stcb->asoc.seen_a_sack_this_pkt = 0;
5467 		SCTPDBG(SCTP_DEBUG_INPUT1, "stcb:%p state:%x\n",
5468 		    (void *)stcb, stcb->asoc.state);
5469 
5470 		if ((stcb->asoc.state & SCTP_STATE_WAS_ABORTED) ||
5471 		    (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED)) {
5472 			/*-
5473 			 * If we hit here, we had a ref count
5474 			 * up when the assoc was aborted and the
5475 			 * timer is clearing out the assoc, we should
5476 			 * NOT respond to any packet.. its OOTB.
5477 			 */
5478 			SCTP_TCB_UNLOCK(stcb);
5479 			stcb = NULL;
5480 			SCTP_PROBE5(receive, NULL, stcb, m, stcb, sh);
5481 			SCTP_SNPRINTF(msg, sizeof(msg), "OOTB, %s:%d at %s", __FILE__, __LINE__, __func__);
5482 			op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
5483 			    msg);
5484 			sctp_handle_ootb(m, iphlen, offset, src, dst, sh, inp, op_err,
5485 			    mflowtype, mflowid, inp->fibnum,
5486 			    vrf_id, port);
5487 			goto out;
5488 		}
5489 	}
5490 	if (IS_SCTP_CONTROL(ch)) {
5491 		/* process the control portion of the SCTP packet */
5492 		/* sa_ignore NO_NULL_CHK */
5493 		stcb = sctp_process_control(m, iphlen, &offset, length,
5494 		    src, dst, sh, ch,
5495 		    inp, stcb, &net, &fwd_tsn_seen,
5496 		    mflowtype, mflowid, fibnum,
5497 		    vrf_id, port);
5498 		if (stcb) {
5499 			/*
5500 			 * This covers us if the cookie-echo was there and
5501 			 * it changes our INP.
5502 			 */
5503 			inp = stcb->sctp_ep;
5504 #if defined(INET) || defined(INET6)
5505 			if ((ch->chunk_type != SCTP_INITIATION) &&
5506 			    (net != NULL) && (net->port != port)) {
5507 				if (net->port == 0) {
5508 					/* UDP encapsulation turned on. */
5509 					net->mtu -= sizeof(struct udphdr);
5510 					if (stcb->asoc.smallest_mtu > net->mtu) {
5511 						sctp_pathmtu_adjustment(stcb, net->mtu, true);
5512 					}
5513 				} else if (port == 0) {
5514 					/* UDP encapsulation turned off. */
5515 					net->mtu += sizeof(struct udphdr);
5516 					/* XXX Update smallest_mtu */
5517 				}
5518 				net->port = port;
5519 			}
5520 #endif
5521 		}
5522 	} else {
5523 		/*
5524 		 * no control chunks, so pre-process DATA chunks (these
5525 		 * checks are taken care of by control processing)
5526 		 */
5527 
5528 		/*
5529 		 * if DATA only packet, and auth is required, then punt...
5530 		 * can't have authenticated without any AUTH (control)
5531 		 * chunks
5532 		 */
5533 		if ((stcb != NULL) &&
5534 		    sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.local_auth_chunks)) {
5535 			/* "silently" ignore */
5536 			SCTP_PROBE5(receive, NULL, stcb, m, stcb, sh);
5537 			SCTP_STAT_INCR(sctps_recvauthmissing);
5538 			goto out;
5539 		}
5540 		if (stcb == NULL) {
5541 			/* out of the blue DATA chunk */
5542 			SCTP_PROBE5(receive, NULL, NULL, m, NULL, sh);
5543 			SCTP_SNPRINTF(msg, sizeof(msg), "OOTB, %s:%d at %s", __FILE__, __LINE__, __func__);
5544 			op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
5545 			    msg);
5546 			sctp_handle_ootb(m, iphlen, offset, src, dst, sh, inp, op_err,
5547 			    mflowtype, mflowid, fibnum,
5548 			    vrf_id, port);
5549 			goto out;
5550 		}
5551 		if (stcb->asoc.my_vtag != ntohl(sh->v_tag)) {
5552 			/* v_tag mismatch! */
5553 			SCTP_PROBE5(receive, NULL, stcb, m, stcb, sh);
5554 			SCTP_STAT_INCR(sctps_badvtag);
5555 			goto out;
5556 		}
5557 	}
5558 
5559 	SCTP_PROBE5(receive, NULL, stcb, m, stcb, sh);
5560 	if (stcb == NULL) {
5561 		/*
5562 		 * no valid TCB for this packet, or we found it's a bad
5563 		 * packet while processing control, or we're done with this
5564 		 * packet (done or skip rest of data), so we drop it...
5565 		 */
5566 		goto out;
5567 	}
5568 
5569 	/*
5570 	 * DATA chunk processing
5571 	 */
5572 	/* plow through the data chunks while length > offset */
5573 
5574 	/*
5575 	 * Rest should be DATA only.  Check authentication state if AUTH for
5576 	 * DATA is required.
5577 	 */
5578 	if ((length > offset) &&
5579 	    (stcb != NULL) &&
5580 	    sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.local_auth_chunks) &&
5581 	    !stcb->asoc.authenticated) {
5582 		/* "silently" ignore */
5583 		SCTP_STAT_INCR(sctps_recvauthmissing);
5584 		SCTPDBG(SCTP_DEBUG_AUTH1,
5585 		    "Data chunk requires AUTH, skipped\n");
5586 		goto trigger_send;
5587 	}
5588 	if (length > offset) {
5589 		int retval;
5590 
5591 		/*
5592 		 * First check to make sure our state is correct. We would
5593 		 * not get here unless we really did have a tag, so we don't
5594 		 * abort if this happens, just dump the chunk silently.
5595 		 */
5596 		switch (SCTP_GET_STATE(stcb)) {
5597 		case SCTP_STATE_COOKIE_ECHOED:
5598 			/*
5599 			 * we consider data with valid tags in this state
5600 			 * shows us the cookie-ack was lost. Imply it was
5601 			 * there.
5602 			 */
5603 			sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb, net);
5604 			break;
5605 		case SCTP_STATE_COOKIE_WAIT:
5606 			/*
5607 			 * We consider OOTB any data sent during asoc setup.
5608 			 */
5609 			SCTP_SNPRINTF(msg, sizeof(msg), "OOTB, %s:%d at %s", __FILE__, __LINE__, __func__);
5610 			op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
5611 			    msg);
5612 			sctp_handle_ootb(m, iphlen, offset, src, dst, sh, inp, op_err,
5613 			    mflowtype, mflowid, inp->fibnum,
5614 			    vrf_id, port);
5615 			goto out;
5616 			/* sa_ignore NOTREACHED */
5617 			break;
5618 		case SCTP_STATE_EMPTY:	/* should not happen */
5619 		case SCTP_STATE_INUSE:	/* should not happen */
5620 		case SCTP_STATE_SHUTDOWN_RECEIVED:	/* This is a peer error */
5621 		case SCTP_STATE_SHUTDOWN_ACK_SENT:
5622 		default:
5623 			goto out;
5624 			/* sa_ignore NOTREACHED */
5625 			break;
5626 		case SCTP_STATE_OPEN:
5627 		case SCTP_STATE_SHUTDOWN_SENT:
5628 			break;
5629 		}
5630 		/* plow through the data chunks while length > offset */
5631 		retval = sctp_process_data(mm, iphlen, &offset, length,
5632 		    inp, stcb, net, &high_tsn);
5633 		if (retval == 2) {
5634 			/*
5635 			 * The association aborted, NO UNLOCK needed since
5636 			 * the association is destroyed.
5637 			 */
5638 			stcb = NULL;
5639 			goto out;
5640 		}
5641 		if (retval == 0) {
5642 			data_processed = 1;
5643 		}
5644 		/*
5645 		 * Anything important needs to have been m_copy'ed in
5646 		 * process_data
5647 		 */
5648 	}
5649 
5650 	/* take care of ecn */
5651 	if ((data_processed == 1) &&
5652 	    (stcb->asoc.ecn_supported == 1) &&
5653 	    ((ecn_bits & SCTP_CE_BITS) == SCTP_CE_BITS)) {
5654 		/* Yep, we need to add a ECNE */
5655 		sctp_send_ecn_echo(stcb, net, high_tsn);
5656 	}
5657 
5658 	if ((data_processed == 0) && (fwd_tsn_seen)) {
5659 		int was_a_gap;
5660 		uint32_t highest_tsn;
5661 
5662 		if (SCTP_TSN_GT(stcb->asoc.highest_tsn_inside_nr_map, stcb->asoc.highest_tsn_inside_map)) {
5663 			highest_tsn = stcb->asoc.highest_tsn_inside_nr_map;
5664 		} else {
5665 			highest_tsn = stcb->asoc.highest_tsn_inside_map;
5666 		}
5667 		was_a_gap = SCTP_TSN_GT(highest_tsn, stcb->asoc.cumulative_tsn);
5668 		stcb->asoc.send_sack = 1;
5669 		sctp_sack_check(stcb, was_a_gap);
5670 	} else if (fwd_tsn_seen) {
5671 		stcb->asoc.send_sack = 1;
5672 	}
5673 	/* trigger send of any chunks in queue... */
5674 trigger_send:
5675 #ifdef SCTP_AUDITING_ENABLED
5676 	sctp_audit_log(0xE0, 2);
5677 	sctp_auditing(1, inp, stcb, net);
5678 #endif
5679 	SCTPDBG(SCTP_DEBUG_INPUT1,
5680 	    "Check for chunk output prw:%d tqe:%d tf=%d\n",
5681 	    stcb->asoc.peers_rwnd,
5682 	    TAILQ_EMPTY(&stcb->asoc.control_send_queue),
5683 	    stcb->asoc.total_flight);
5684 	un_sent = (stcb->asoc.total_output_queue_size - stcb->asoc.total_flight);
5685 	if (!TAILQ_EMPTY(&stcb->asoc.control_send_queue)) {
5686 		cnt_ctrl_ready = stcb->asoc.ctrl_queue_cnt - stcb->asoc.ecn_echo_cnt_onq;
5687 	}
5688 	if (!TAILQ_EMPTY(&stcb->asoc.asconf_send_queue) ||
5689 	    cnt_ctrl_ready ||
5690 	    stcb->asoc.trigger_reset ||
5691 	    ((un_sent > 0) &&
5692 	    (stcb->asoc.peers_rwnd > 0 || stcb->asoc.total_flight == 0))) {
5693 		SCTPDBG(SCTP_DEBUG_INPUT3, "Calling chunk OUTPUT\n");
5694 		sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC, SCTP_SO_NOT_LOCKED);
5695 		SCTPDBG(SCTP_DEBUG_INPUT3, "chunk OUTPUT returns\n");
5696 	}
5697 #ifdef SCTP_AUDITING_ENABLED
5698 	sctp_audit_log(0xE0, 3);
5699 	sctp_auditing(2, inp, stcb, net);
5700 #endif
5701 out:
5702 	if (stcb != NULL) {
5703 		SCTP_TCB_UNLOCK(stcb);
5704 	}
5705 	if (inp_decr != NULL) {
5706 		/* reduce ref-count */
5707 		SCTP_INP_WLOCK(inp_decr);
5708 		SCTP_INP_DECR_REF(inp_decr);
5709 		SCTP_INP_WUNLOCK(inp_decr);
5710 	}
5711 	return;
5712 }
5713 
5714 #ifdef INET
5715 void
5716 sctp_input_with_port(struct mbuf *i_pak, int off, uint16_t port)
5717 {
5718 	struct mbuf *m;
5719 	int iphlen;
5720 	uint32_t vrf_id = 0;
5721 	uint8_t ecn_bits;
5722 	struct sockaddr_in src, dst;
5723 	struct ip *ip;
5724 	struct sctphdr *sh;
5725 	struct sctp_chunkhdr *ch;
5726 	int length, offset;
5727 	uint8_t compute_crc;
5728 	uint32_t mflowid;
5729 	uint8_t mflowtype;
5730 	uint16_t fibnum;
5731 
5732 	iphlen = off;
5733 	if (SCTP_GET_PKT_VRFID(i_pak, vrf_id)) {
5734 		SCTP_RELEASE_PKT(i_pak);
5735 		return;
5736 	}
5737 	m = SCTP_HEADER_TO_CHAIN(i_pak);
5738 #ifdef SCTP_MBUF_LOGGING
5739 	/* Log in any input mbufs */
5740 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
5741 		sctp_log_mbc(m, SCTP_MBUF_INPUT);
5742 	}
5743 #endif
5744 #ifdef SCTP_PACKET_LOGGING
5745 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING) {
5746 		sctp_packet_log(m);
5747 	}
5748 #endif
5749 	SCTPDBG(SCTP_DEBUG_CRCOFFLOAD,
5750 	    "sctp_input(): Packet of length %d received on %s with csum_flags 0x%b.\n",
5751 	    m->m_pkthdr.len,
5752 	    if_name(m->m_pkthdr.rcvif),
5753 	    (int)m->m_pkthdr.csum_flags, CSUM_BITS);
5754 	mflowid = m->m_pkthdr.flowid;
5755 	mflowtype = M_HASHTYPE_GET(m);
5756 	fibnum = M_GETFIB(m);
5757 	SCTP_STAT_INCR(sctps_recvpackets);
5758 	SCTP_STAT_INCR_COUNTER64(sctps_inpackets);
5759 	/* Get IP, SCTP, and first chunk header together in the first mbuf. */
5760 	offset = iphlen + sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr);
5761 	if (SCTP_BUF_LEN(m) < offset) {
5762 		if ((m = m_pullup(m, offset)) == NULL) {
5763 			SCTP_STAT_INCR(sctps_hdrops);
5764 			return;
5765 		}
5766 	}
5767 	ip = mtod(m, struct ip *);
5768 	sh = (struct sctphdr *)((caddr_t)ip + iphlen);
5769 	ch = (struct sctp_chunkhdr *)((caddr_t)sh + sizeof(struct sctphdr));
5770 	offset -= sizeof(struct sctp_chunkhdr);
5771 	memset(&src, 0, sizeof(struct sockaddr_in));
5772 	src.sin_family = AF_INET;
5773 	src.sin_len = sizeof(struct sockaddr_in);
5774 	src.sin_port = sh->src_port;
5775 	src.sin_addr = ip->ip_src;
5776 	memset(&dst, 0, sizeof(struct sockaddr_in));
5777 	dst.sin_family = AF_INET;
5778 	dst.sin_len = sizeof(struct sockaddr_in);
5779 	dst.sin_port = sh->dest_port;
5780 	dst.sin_addr = ip->ip_dst;
5781 	length = ntohs(ip->ip_len);
5782 	/* Validate mbuf chain length with IP payload length. */
5783 	if (SCTP_HEADER_LEN(m) != length) {
5784 		SCTPDBG(SCTP_DEBUG_INPUT1,
5785 		    "sctp_input() length:%d reported length:%d\n", length, SCTP_HEADER_LEN(m));
5786 		SCTP_STAT_INCR(sctps_hdrops);
5787 		goto out;
5788 	}
5789 	/* SCTP does not allow broadcasts or multicasts */
5790 	if (IN_MULTICAST(ntohl(dst.sin_addr.s_addr))) {
5791 		goto out;
5792 	}
5793 	if (SCTP_IS_IT_BROADCAST(dst.sin_addr, m)) {
5794 		goto out;
5795 	}
5796 	ecn_bits = ip->ip_tos;
5797 	if (m->m_pkthdr.csum_flags & CSUM_SCTP_VALID) {
5798 		SCTP_STAT_INCR(sctps_recvhwcrc);
5799 		compute_crc = 0;
5800 	} else {
5801 		SCTP_STAT_INCR(sctps_recvswcrc);
5802 		compute_crc = 1;
5803 	}
5804 	sctp_common_input_processing(&m, iphlen, offset, length,
5805 	    (struct sockaddr *)&src,
5806 	    (struct sockaddr *)&dst,
5807 	    sh, ch,
5808 	    compute_crc,
5809 	    ecn_bits,
5810 	    mflowtype, mflowid, fibnum,
5811 	    vrf_id, port);
5812 out:
5813 	if (m) {
5814 		sctp_m_freem(m);
5815 	}
5816 	return;
5817 }
5818 
5819 #if defined(SCTP_MCORE_INPUT) && defined(SMP)
5820 extern int *sctp_cpuarry;
5821 #endif
5822 
5823 int
5824 sctp_input(struct mbuf **mp, int *offp, int proto SCTP_UNUSED)
5825 {
5826 	struct mbuf *m;
5827 	int off;
5828 
5829 	m = *mp;
5830 	off = *offp;
5831 #if defined(SCTP_MCORE_INPUT) && defined(SMP)
5832 	if (mp_ncpus > 1) {
5833 		struct ip *ip;
5834 		struct sctphdr *sh;
5835 		int offset;
5836 		int cpu_to_use;
5837 		uint32_t flowid, tag;
5838 
5839 		if (M_HASHTYPE_GET(m) != M_HASHTYPE_NONE) {
5840 			flowid = m->m_pkthdr.flowid;
5841 		} else {
5842 			/*
5843 			 * No flow id built by lower layers fix it so we
5844 			 * create one.
5845 			 */
5846 			offset = off + sizeof(struct sctphdr);
5847 			if (SCTP_BUF_LEN(m) < offset) {
5848 				if ((m = m_pullup(m, offset)) == NULL) {
5849 					SCTP_STAT_INCR(sctps_hdrops);
5850 					return (IPPROTO_DONE);
5851 				}
5852 			}
5853 			ip = mtod(m, struct ip *);
5854 			sh = (struct sctphdr *)((caddr_t)ip + off);
5855 			tag = htonl(sh->v_tag);
5856 			flowid = tag ^ ntohs(sh->dest_port) ^ ntohs(sh->src_port);
5857 			m->m_pkthdr.flowid = flowid;
5858 			M_HASHTYPE_SET(m, M_HASHTYPE_OPAQUE_HASH);
5859 		}
5860 		cpu_to_use = sctp_cpuarry[flowid % mp_ncpus];
5861 		sctp_queue_to_mcore(m, off, cpu_to_use);
5862 		return (IPPROTO_DONE);
5863 	}
5864 #endif
5865 	sctp_input_with_port(m, off, 0);
5866 	return (IPPROTO_DONE);
5867 }
5868 #endif
5869