sctp_input.c revision 166675
138780Snsouch/*-
238780Snsouch * Copyright (c) 2001-2007, Cisco Systems, Inc. All rights reserved.
338780Snsouch *
438780Snsouch * Redistribution and use in source and binary forms, with or without
538780Snsouch * modification, are permitted provided that the following conditions are met:
638780Snsouch *
738780Snsouch * a) Redistributions of source code must retain the above copyright notice,
838780Snsouch *   this list of conditions and the following disclaimer.
938780Snsouch *
1038780Snsouch * b) Redistributions in binary form must reproduce the above copyright
1138780Snsouch *    notice, this list of conditions and the following disclaimer in
1238780Snsouch *   the documentation and/or other materials provided with the distribution.
1338780Snsouch *
1438780Snsouch * c) Neither the name of Cisco Systems, Inc. nor the names of its
1538780Snsouch *    contributors may be used to endorse or promote products derived
1638780Snsouch *    from this software without specific prior written permission.
1738780Snsouch *
1838780Snsouch * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
1938780Snsouch * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
2038780Snsouch * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
2138780Snsouch * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
2238780Snsouch * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
2338780Snsouch * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
2438780Snsouch * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
2538780Snsouch * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
2650477Speter * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
2738780Snsouch * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
2838780Snsouch * THE POSSIBILITY OF SUCH DAMAGE.
2938780Snsouch */
3038780Snsouch
3138780Snsouch/* $KAME: sctp_input.c,v 1.27 2005/03/06 16:04:17 itojun Exp $	 */
3238780Snsouch
3338780Snsouch#include <sys/cdefs.h>
34160372Simp__FBSDID("$FreeBSD: head/sys/netinet/sctp_input.c 166675 2007-02-12 23:24:31Z rrs $");
35160372Simp
36160372Simp#include <netinet/sctp_os.h>
37160372Simp#include <netinet/sctp_var.h>
38160372Simp#include <netinet/sctp_pcb.h>
39164714Simp#include <netinet/sctp_header.h>
40164714Simp#include <netinet/sctputil.h>
41208839Snwhitehorn#include <netinet/sctp_output.h>
42208839Snwhitehorn#include <netinet/sctp_input.h>
43210998Sjoel#include <netinet/sctp_auth.h>
44160372Simp#include <netinet/sctp_indata.h>
45160372Simp#include <netinet/sctp_asconf.h>
46160372Simp
4742442Snsouch
4842442Snsouch#ifdef SCTP_DEBUG
4942442Snsouchextern uint32_t sctp_debug_on;
5042442Snsouch
5142442Snsouch#endif
5242442Snsouch
5338780Snsouch
54160372Simp
55160372Simpstruct sctp_foo_stuff sctp_logoff[30000];
56160372Simpint sctp_logoff_stuff = 0;
57160372Simp
58160372Simp
5942442Snsouchstatic void
6042442Snsouchsctp_stop_all_cookie_timers(struct sctp_tcb *stcb)
6142442Snsouch{
6242442Snsouch	struct sctp_nets *net;
6342442Snsouch
64160372Simp	/*
65187709Sraj	 * This now not only stops all cookie timers it also stops any INIT
6642442Snsouch	 * timers as well. This will make sure that the timers are stopped
6738780Snsouch	 * in all collision cases.
68	 */
69	SCTP_TCB_LOCK_ASSERT(stcb);
70	TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
71		if (net->rxt_timer.type == SCTP_TIMER_TYPE_COOKIE) {
72			sctp_timer_stop(SCTP_TIMER_TYPE_COOKIE,
73			    stcb->sctp_ep,
74			    stcb,
75			    net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_1);
76		} else if (net->rxt_timer.type == SCTP_TIMER_TYPE_INIT) {
77			sctp_timer_stop(SCTP_TIMER_TYPE_INIT,
78			    stcb->sctp_ep,
79			    stcb,
80			    net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_2);
81		}
82	}
83}
84
85/* INIT handler */
86static void
87sctp_handle_init(struct mbuf *m, int iphlen, int offset, struct sctphdr *sh,
88    struct sctp_init_chunk *cp, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
89    struct sctp_nets *net)
90{
91	struct sctp_init *init;
92	struct mbuf *op_err;
93	uint32_t init_limit;
94
95#ifdef SCTP_DEBUG
96	if (sctp_debug_on & SCTP_DEBUG_INPUT2) {
97		printf("sctp_handle_init: handling INIT tcb:%p\n", stcb);
98	}
99#endif
100	op_err = NULL;
101	init = &cp->init;
102	/* First are we accepting? */
103	if ((inp->sctp_socket->so_qlimit == 0) && (stcb == NULL)) {
104#ifdef SCTP_DEBUG
105		if (sctp_debug_on & SCTP_DEBUG_INPUT2) {
106			printf("sctp_handle_init: Abort, so_qlimit:%d\n", inp->sctp_socket->so_qlimit);
107		}
108#endif
109		/*
110		 * FIX ME ?? What about TCP model and we have a
111		 * match/restart case?
112		 */
113		sctp_abort_association(inp, stcb, m, iphlen, sh, op_err);
114		return;
115	}
116	if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_init_chunk)) {
117		/* Invalid length */
118		op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
119		sctp_abort_association(inp, stcb, m, iphlen, sh, op_err);
120		return;
121	}
122	/* validate parameters */
123	if (init->initiate_tag == 0) {
124		/* protocol error... send abort */
125		op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
126		sctp_abort_association(inp, stcb, m, iphlen, sh, op_err);
127		return;
128	}
129	if (ntohl(init->a_rwnd) < SCTP_MIN_RWND) {
130		/* invalid parameter... send abort */
131		op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
132		sctp_abort_association(inp, stcb, m, iphlen, sh, op_err);
133		return;
134	}
135	if (init->num_inbound_streams == 0) {
136		/* protocol error... send abort */
137		op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
138		sctp_abort_association(inp, stcb, m, iphlen, sh, op_err);
139		return;
140	}
141	if (init->num_outbound_streams == 0) {
142		/* protocol error... send abort */
143		op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
144		sctp_abort_association(inp, stcb, m, iphlen, sh, op_err);
145		return;
146	}
147	init_limit = offset + ntohs(cp->ch.chunk_length);
148	if (sctp_validate_init_auth_params(m, offset + sizeof(*cp),
149	    init_limit)) {
150		/* auth parameter(s) error... send abort */
151		sctp_abort_association(inp, stcb, m, iphlen, sh, NULL);
152		return;
153	}
154	/* send an INIT-ACK w/cookie */
155#ifdef SCTP_DEBUG
156	if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
157		printf("sctp_handle_init: sending INIT-ACK\n");
158	}
159#endif
160	sctp_send_initiate_ack(inp, stcb, m, iphlen, offset, sh, cp);
161}
162
163/*
164 * process peer "INIT/INIT-ACK" chunk returns value < 0 on error
165 */
166static int
167sctp_process_init(struct sctp_init_chunk *cp, struct sctp_tcb *stcb,
168    struct sctp_nets *net)
169{
170	struct sctp_init *init;
171	struct sctp_association *asoc;
172	struct sctp_nets *lnet;
173	unsigned int i;
174
175	init = &cp->init;
176	asoc = &stcb->asoc;
177	/* save off parameters */
178	asoc->peer_vtag = ntohl(init->initiate_tag);
179	asoc->peers_rwnd = ntohl(init->a_rwnd);
180	if (TAILQ_FIRST(&asoc->nets)) {
181		/* update any ssthresh's that may have a default */
182		TAILQ_FOREACH(lnet, &asoc->nets, sctp_next) {
183			lnet->ssthresh = asoc->peers_rwnd;
184
185#if defined(SCTP_CWND_MONITOR) || defined(SCTP_CWND_LOGGING)
186			sctp_log_cwnd(stcb, lnet, 0, SCTP_CWND_INITIALIZATION);
187#endif
188
189		}
190	}
191	SCTP_TCB_SEND_LOCK(stcb);
192	if (asoc->pre_open_streams > ntohs(init->num_inbound_streams)) {
193		unsigned int newcnt;
194		struct sctp_stream_out *outs;
195		struct sctp_stream_queue_pending *sp;
196
197		/* cut back on number of streams */
198		newcnt = ntohs(init->num_inbound_streams);
199		/* This if is probably not needed but I am cautious */
200		if (asoc->strmout) {
201			/* First make sure no data chunks are trapped */
202			for (i = newcnt; i < asoc->pre_open_streams; i++) {
203				outs = &asoc->strmout[i];
204				sp = TAILQ_FIRST(&outs->outqueue);
205				while (sp) {
206					TAILQ_REMOVE(&outs->outqueue, sp,
207					    next);
208					asoc->stream_queue_cnt--;
209					sctp_ulp_notify(SCTP_NOTIFY_SPECIAL_SP_FAIL,
210					    stcb, SCTP_NOTIFY_DATAGRAM_UNSENT,
211					    sp);
212					if (sp->data) {
213						sctp_m_freem(sp->data);
214						sp->data = NULL;
215					}
216					sctp_free_remote_addr(sp->net);
217					sp->net = NULL;
218					/* Free the chunk */
219					printf("sp:%p tcb:%p weird free case\n",
220					    sp, stcb);
221
222					sctp_free_a_strmoq(stcb, sp);
223					sp = TAILQ_FIRST(&outs->outqueue);
224				}
225			}
226		}
227		/* cut back the count and abandon the upper streams */
228		asoc->pre_open_streams = newcnt;
229	}
230	SCTP_TCB_SEND_UNLOCK(stcb);
231	asoc->streamoutcnt = asoc->pre_open_streams;
232	/* init tsn's */
233	asoc->highest_tsn_inside_map = asoc->asconf_seq_in = ntohl(init->initial_tsn) - 1;
234#ifdef SCTP_MAP_LOGGING
235	sctp_log_map(0, 5, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
236#endif
237	/* This is the next one we expect */
238	asoc->str_reset_seq_in = asoc->asconf_seq_in + 1;
239
240	asoc->mapping_array_base_tsn = ntohl(init->initial_tsn);
241	asoc->cumulative_tsn = asoc->asconf_seq_in;
242	asoc->last_echo_tsn = asoc->asconf_seq_in;
243	asoc->advanced_peer_ack_point = asoc->last_acked_seq;
244	/* open the requested streams */
245	if (asoc->strmin != NULL) {
246		/* Free the old ones */
247		struct sctp_queued_to_read *ctl;
248
249		for (i = 0; i < asoc->streamincnt; i++) {
250			ctl = TAILQ_FIRST(&asoc->strmin[i].inqueue);
251			while (ctl) {
252				TAILQ_REMOVE(&asoc->strmin[i].inqueue, ctl, next);
253				sctp_free_remote_addr(ctl->whoFrom);
254				sctp_m_freem(ctl->data);
255				ctl->data = NULL;
256				sctp_free_a_readq(stcb, ctl);
257				ctl = TAILQ_FIRST(&asoc->strmin[i].inqueue);
258			}
259		}
260		SCTP_FREE(asoc->strmin);
261	}
262	asoc->streamincnt = ntohs(init->num_outbound_streams);
263	if (asoc->streamincnt > MAX_SCTP_STREAMS) {
264		asoc->streamincnt = MAX_SCTP_STREAMS;
265	}
266	SCTP_MALLOC(asoc->strmin, struct sctp_stream_in *, asoc->streamincnt *
267	    sizeof(struct sctp_stream_in), "StreamsIn");
268	if (asoc->strmin == NULL) {
269		/* we didn't get memory for the streams! */
270#ifdef SCTP_DEBUG
271		if (sctp_debug_on & SCTP_DEBUG_INPUT2) {
272			printf("process_init: couldn't get memory for the streams!\n");
273		}
274#endif
275		return (-1);
276	}
277	for (i = 0; i < asoc->streamincnt; i++) {
278		asoc->strmin[i].stream_no = i;
279		asoc->strmin[i].last_sequence_delivered = 0xffff;
280		/*
281		 * U-stream ranges will be set when the cookie is unpacked.
282		 * Or for the INIT sender they are un set (if pr-sctp not
283		 * supported) when the INIT-ACK arrives.
284		 */
285		TAILQ_INIT(&asoc->strmin[i].inqueue);
286		/*
287		 * we are not on any wheel, pr-sctp streams will go on the
288		 * wheel when they have data waiting for reorder.
289		 */
290		asoc->strmin[i].next_spoke.tqe_next = 0;
291		asoc->strmin[i].next_spoke.tqe_prev = 0;
292	}
293
294	/*
295	 * load_address_from_init will put the addresses into the
296	 * association when the COOKIE is processed or the INIT-ACK is
297	 * processed. Both types of COOKIE's existing and new call this
298	 * routine. It will remove addresses that are no longer in the
299	 * association (for the restarting case where addresses are
300	 * removed). Up front when the INIT arrives we will discard it if it
301	 * is a restart and new addresses have been added.
302	 */
303	return (0);
304}
305
306/*
307 * INIT-ACK message processing/consumption returns value < 0 on error
308 */
309static int
310sctp_process_init_ack(struct mbuf *m, int iphlen, int offset,
311    struct sctphdr *sh, struct sctp_init_ack_chunk *cp, struct sctp_tcb *stcb,
312    struct sctp_nets *net)
313{
314	struct sctp_association *asoc;
315	struct mbuf *op_err;
316	int retval, abort_flag;
317	uint32_t initack_limit;
318
319	/* First verify that we have no illegal param's */
320	abort_flag = 0;
321	op_err = NULL;
322
323	op_err = sctp_arethere_unrecognized_parameters(m,
324	    (offset + sizeof(struct sctp_init_chunk)),
325	    &abort_flag, (struct sctp_chunkhdr *)cp);
326	if (abort_flag) {
327		/* Send an abort and notify peer */
328		if (op_err != NULL) {
329			sctp_send_operr_to(m, iphlen, op_err, cp->init.initiate_tag);
330		} else {
331			/*
332			 * Just notify (abort_assoc does this if we send an
333			 * abort).
334			 */
335			sctp_abort_notification(stcb, 0);
336			/*
337			 * No sense in further INIT's since we will get the
338			 * same param back
339			 */
340			sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_3);
341		}
342		return (-1);
343	}
344	asoc = &stcb->asoc;
345	/* process the peer's parameters in the INIT-ACK */
346	retval = sctp_process_init((struct sctp_init_chunk *)cp, stcb, net);
347	if (retval < 0) {
348		return (retval);
349	}
350	initack_limit = offset + ntohs(cp->ch.chunk_length);
351	/* load all addresses */
352	if ((retval = sctp_load_addresses_from_init(stcb, m, iphlen,
353	    (offset + sizeof(struct sctp_init_chunk)), initack_limit, sh,
354	    NULL))) {
355		/* Huh, we should abort */
356#ifdef SCTP_DEBUG
357		if (sctp_debug_on & SCTP_DEBUG_INPUT1) {
358			printf("Load addresses from INIT causes an abort %d\n", retval);
359		}
360#endif
361		sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh,
362		    NULL);
363		return (-1);
364	}
365	stcb->asoc.peer_hmac_id = sctp_negotiate_hmacid(stcb->asoc.peer_hmacs,
366	    stcb->asoc.local_hmacs);
367	if (op_err) {
368		sctp_queue_op_err(stcb, op_err);
369		/* queuing will steal away the mbuf chain to the out queue */
370		op_err = NULL;
371	}
372	/* extract the cookie and queue it to "echo" it back... */
373	stcb->asoc.overall_error_count = 0;
374	net->error_count = 0;
375
376	/*
377	 * Cancel the INIT timer, We do this first before queueing the
378	 * cookie. We always cancel at the primary to assue that we are
379	 * canceling the timer started by the INIT which always goes to the
380	 * primary.
381	 */
382	sctp_timer_stop(SCTP_TIMER_TYPE_INIT, stcb->sctp_ep, stcb,
383	    asoc->primary_destination, SCTP_FROM_SCTP_INPUT + SCTP_LOC_4);
384
385	/* calculate the RTO */
386	net->RTO = sctp_calculate_rto(stcb, asoc, net, &asoc->time_entered);
387
388	retval = sctp_send_cookie_echo(m, offset, stcb, net);
389	if (retval < 0) {
390		/*
391		 * No cookie, we probably should send a op error. But in any
392		 * case if there is no cookie in the INIT-ACK, we can
393		 * abandon the peer, its broke.
394		 */
395		if (retval == -3) {
396			/* We abort with an error of missing mandatory param */
397			struct mbuf *op_err;
398
399			op_err =
400			    sctp_generate_invmanparam(SCTP_CAUSE_MISSING_PARAM);
401			if (op_err) {
402				/*
403				 * Expand beyond to include the mandatory
404				 * param cookie
405				 */
406				struct sctp_inv_mandatory_param *mp;
407
408				SCTP_BUF_LEN(op_err) =
409				    sizeof(struct sctp_inv_mandatory_param);
410				mp = mtod(op_err,
411				    struct sctp_inv_mandatory_param *);
412				/* Subtract the reserved param */
413				mp->length =
414				    htons(sizeof(struct sctp_inv_mandatory_param) - 2);
415				mp->num_param = htonl(1);
416				mp->param = htons(SCTP_STATE_COOKIE);
417				mp->resv = 0;
418			}
419			sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
420			    sh, op_err);
421		}
422		return (retval);
423	}
424	return (0);
425}
426
427static void
428sctp_handle_heartbeat_ack(struct sctp_heartbeat_chunk *cp,
429    struct sctp_tcb *stcb, struct sctp_nets *net)
430{
431	struct sockaddr_storage store;
432	struct sockaddr_in *sin;
433	struct sockaddr_in6 *sin6;
434	struct sctp_nets *r_net;
435	struct timeval tv;
436
437	if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_heartbeat_chunk)) {
438		/* Invalid length */
439		return;
440	}
441	sin = (struct sockaddr_in *)&store;
442	sin6 = (struct sockaddr_in6 *)&store;
443
444	memset(&store, 0, sizeof(store));
445	if (cp->heartbeat.hb_info.addr_family == AF_INET &&
446	    cp->heartbeat.hb_info.addr_len == sizeof(struct sockaddr_in)) {
447		sin->sin_family = cp->heartbeat.hb_info.addr_family;
448		sin->sin_len = cp->heartbeat.hb_info.addr_len;
449		sin->sin_port = stcb->rport;
450		memcpy(&sin->sin_addr, cp->heartbeat.hb_info.address,
451		    sizeof(sin->sin_addr));
452	} else if (cp->heartbeat.hb_info.addr_family == AF_INET6 &&
453	    cp->heartbeat.hb_info.addr_len == sizeof(struct sockaddr_in6)) {
454		sin6->sin6_family = cp->heartbeat.hb_info.addr_family;
455		sin6->sin6_len = cp->heartbeat.hb_info.addr_len;
456		sin6->sin6_port = stcb->rport;
457		memcpy(&sin6->sin6_addr, cp->heartbeat.hb_info.address,
458		    sizeof(sin6->sin6_addr));
459	} else {
460		return;
461	}
462	r_net = sctp_findnet(stcb, (struct sockaddr *)sin);
463	if (r_net == NULL) {
464#ifdef SCTP_DEBUG
465		if (sctp_debug_on & SCTP_DEBUG_INPUT1) {
466			printf("Huh? I can't find the address I sent it to, discard\n");
467		}
468#endif
469		return;
470	}
471	if ((r_net && (r_net->dest_state & SCTP_ADDR_UNCONFIRMED)) &&
472	    (r_net->heartbeat_random1 == cp->heartbeat.hb_info.random_value1) &&
473	    (r_net->heartbeat_random2 == cp->heartbeat.hb_info.random_value2)) {
474		/*
475		 * If the its a HB and it's random value is correct when can
476		 * confirm the destination.
477		 */
478		r_net->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
479		sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
480		    stcb, 0, (void *)r_net);
481	}
482	r_net->error_count = 0;
483	r_net->hb_responded = 1;
484	tv.tv_sec = cp->heartbeat.hb_info.time_value_1;
485	tv.tv_usec = cp->heartbeat.hb_info.time_value_2;
486	if (r_net->dest_state & SCTP_ADDR_NOT_REACHABLE) {
487		r_net->dest_state &= ~SCTP_ADDR_NOT_REACHABLE;
488		r_net->dest_state |= SCTP_ADDR_REACHABLE;
489		sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_UP, stcb,
490		    SCTP_HEARTBEAT_SUCCESS, (void *)r_net);
491		/* now was it the primary? if so restore */
492		if (r_net->dest_state & SCTP_ADDR_WAS_PRIMARY) {
493			sctp_set_primary_addr(stcb, (struct sockaddr *)NULL, r_net);
494		}
495	}
496	/* Now lets do a RTO with this */
497	r_net->RTO = sctp_calculate_rto(stcb, &stcb->asoc, r_net, &tv);
498}
499
500static void
501sctp_handle_abort(struct sctp_abort_chunk *cp,
502    struct sctp_tcb *stcb, struct sctp_nets *net)
503{
504
505#ifdef SCTP_DEBUG
506	if (sctp_debug_on & SCTP_DEBUG_INPUT2) {
507		printf("sctp_handle_abort: handling ABORT\n");
508	}
509#endif
510	if (stcb == NULL)
511		return;
512	/* verify that the destination addr is in the association */
513	/* ignore abort for addresses being deleted */
514
515	/* stop any receive timers */
516	sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_5);
517	/* notify user of the abort and clean up... */
518	sctp_abort_notification(stcb, 0);
519	/* free the tcb */
520	SCTP_STAT_INCR_COUNTER32(sctps_aborted);
521	if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
522	    (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
523		SCTP_STAT_DECR_GAUGE32(sctps_currestab);
524	}
525	sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_6);
526#ifdef SCTP_DEBUG
527	if (sctp_debug_on & SCTP_DEBUG_INPUT2) {
528		printf("sctp_handle_abort: finished\n");
529	}
530#endif
531}
532
533static void
534sctp_handle_shutdown(struct sctp_shutdown_chunk *cp,
535    struct sctp_tcb *stcb, struct sctp_nets *net, int *abort_flag)
536{
537	struct sctp_association *asoc;
538	int some_on_streamwheel;
539
540#ifdef SCTP_DEBUG
541	if (sctp_debug_on & SCTP_DEBUG_INPUT2) {
542		printf("sctp_handle_shutdown: handling SHUTDOWN\n");
543	}
544#endif
545	if (stcb == NULL)
546		return;
547	asoc = &stcb->asoc;
548	if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||
549	    (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) {
550		return;
551	}
552	if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_shutdown_chunk)) {
553		/* Shutdown NOT the expected size */
554		return;
555	} else {
556		sctp_update_acked(stcb, cp, net, abort_flag);
557	}
558	if (asoc->control_pdapi) {
559		/*
560		 * With a normal shutdown we assume the end of last record.
561		 */
562		SCTP_INP_READ_LOCK(stcb->sctp_ep);
563		asoc->control_pdapi->end_added = 1;
564		asoc->control_pdapi->pdapi_aborted = 1;
565		asoc->control_pdapi = NULL;
566		SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
567		sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
568	}
569	/* goto SHUTDOWN_RECEIVED state to block new requests */
570	if (stcb->sctp_socket) {
571		if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) &&
572		    (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT)) {
573			asoc->state = SCTP_STATE_SHUTDOWN_RECEIVED;
574			/*
575			 * notify upper layer that peer has initiated a
576			 * shutdown
577			 */
578			sctp_ulp_notify(SCTP_NOTIFY_PEER_SHUTDOWN, stcb, 0, NULL);
579
580			/* reset time */
581			SCTP_GETTIME_TIMEVAL(&asoc->time_entered);
582		}
583	}
584	if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) {
585		/*
586		 * stop the shutdown timer, since we WILL move to
587		 * SHUTDOWN-ACK-SENT.
588		 */
589		sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_7);
590	}
591	/* Now are we there yet? */
592	some_on_streamwheel = 0;
593	if (!TAILQ_EMPTY(&asoc->out_wheel)) {
594		/* Check to see if some data queued */
595		struct sctp_stream_out *outs;
596
597		TAILQ_FOREACH(outs, &asoc->out_wheel, next_spoke) {
598			if (!TAILQ_EMPTY(&outs->outqueue)) {
599				some_on_streamwheel = 1;
600				break;
601			}
602		}
603	}
604	if (!TAILQ_EMPTY(&asoc->send_queue) ||
605	    !TAILQ_EMPTY(&asoc->sent_queue) ||
606	    some_on_streamwheel) {
607		/* By returning we will push more data out */
608		return;
609	} else {
610		/* no outstanding data to send, so move on... */
611		/* send SHUTDOWN-ACK */
612		sctp_send_shutdown_ack(stcb, stcb->asoc.primary_destination);
613		/* move to SHUTDOWN-ACK-SENT state */
614		if ((SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) ||
615		    (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
616			SCTP_STAT_DECR_GAUGE32(sctps_currestab);
617		}
618		asoc->state = SCTP_STATE_SHUTDOWN_ACK_SENT;
619
620		/* start SHUTDOWN timer */
621		sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNACK, stcb->sctp_ep,
622		    stcb, net);
623	}
624}
625
626static void
627sctp_handle_shutdown_ack(struct sctp_shutdown_ack_chunk *cp,
628    struct sctp_tcb *stcb, struct sctp_nets *net)
629{
630	struct sctp_association *asoc;
631
632#ifdef SCTP_DEBUG
633	if (sctp_debug_on & SCTP_DEBUG_INPUT2) {
634		printf("sctp_handle_shutdown_ack: handling SHUTDOWN ACK\n");
635	}
636#endif
637	if (stcb == NULL)
638		return;
639
640	asoc = &stcb->asoc;
641	/* process according to association state */
642	if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) &&
643	    (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) {
644		/* unexpected SHUTDOWN-ACK... so ignore... */
645		SCTP_TCB_UNLOCK(stcb);
646		return;
647	}
648	if (asoc->control_pdapi) {
649		/*
650		 * With a normal shutdown we assume the end of last record.
651		 */
652		SCTP_INP_READ_LOCK(stcb->sctp_ep);
653		asoc->control_pdapi->end_added = 1;
654		asoc->control_pdapi->pdapi_aborted = 1;
655		asoc->control_pdapi = NULL;
656		SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
657		sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
658	}
659	/* are the queues empty? */
660	if (!TAILQ_EMPTY(&asoc->send_queue) ||
661	    !TAILQ_EMPTY(&asoc->sent_queue) ||
662	    !TAILQ_EMPTY(&asoc->out_wheel)) {
663		sctp_report_all_outbound(stcb, 0);
664	}
665	/* stop the timer */
666	sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_8);
667	/* send SHUTDOWN-COMPLETE */
668	sctp_send_shutdown_complete(stcb, net);
669	/* notify upper layer protocol */
670	if (stcb->sctp_socket) {
671		sctp_ulp_notify(SCTP_NOTIFY_ASSOC_DOWN, stcb, 0, NULL);
672		if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
673		    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
674			/* Set the connected flag to disconnected */
675			stcb->sctp_ep->sctp_socket->so_snd.sb_cc = 0;
676		}
677	}
678	SCTP_STAT_INCR_COUNTER32(sctps_shutdown);
679	/* free the TCB but first save off the ep */
680	sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC,
681	    SCTP_FROM_SCTP_INPUT + SCTP_LOC_9);
682}
683
684/*
685 * Skip past the param header and then we will find the chunk that caused the
686 * problem. There are two possiblities ASCONF or FWD-TSN other than that and
687 * our peer must be broken.
688 */
689static void
690sctp_process_unrecog_chunk(struct sctp_tcb *stcb, struct sctp_paramhdr *phdr,
691    struct sctp_nets *net)
692{
693	struct sctp_chunkhdr *chk;
694
695	chk = (struct sctp_chunkhdr *)((caddr_t)phdr + sizeof(*phdr));
696	switch (chk->chunk_type) {
697	case SCTP_ASCONF_ACK:
698	case SCTP_ASCONF:
699		sctp_asconf_cleanup(stcb, net);
700		break;
701	case SCTP_FORWARD_CUM_TSN:
702		stcb->asoc.peer_supports_prsctp = 0;
703		break;
704	default:
705#ifdef SCTP_DEBUG
706		if (sctp_debug_on & SCTP_DEBUG_INPUT2) {
707			printf("Peer does not support chunk type %d(%x)??\n",
708			    chk->chunk_type, (uint32_t) chk->chunk_type);
709		}
710#endif
711		break;
712	}
713}
714
715/*
716 * Skip past the param header and then we will find the param that caused the
717 * problem.  There are a number of param's in a ASCONF OR the prsctp param
718 * these will turn of specific features.
719 */
720static void
721sctp_process_unrecog_param(struct sctp_tcb *stcb, struct sctp_paramhdr *phdr)
722{
723	struct sctp_paramhdr *pbad;
724
725	pbad = phdr + 1;
726	switch (ntohs(pbad->param_type)) {
727		/* pr-sctp draft */
728	case SCTP_PRSCTP_SUPPORTED:
729		stcb->asoc.peer_supports_prsctp = 0;
730		break;
731	case SCTP_SUPPORTED_CHUNK_EXT:
732		break;
733		/* draft-ietf-tsvwg-addip-sctp */
734	case SCTP_ECN_NONCE_SUPPORTED:
735		stcb->asoc.peer_supports_ecn_nonce = 0;
736		stcb->asoc.ecn_nonce_allowed = 0;
737		stcb->asoc.ecn_allowed = 0;
738		break;
739	case SCTP_ADD_IP_ADDRESS:
740	case SCTP_DEL_IP_ADDRESS:
741	case SCTP_SET_PRIM_ADDR:
742		stcb->asoc.peer_supports_asconf = 0;
743		break;
744	case SCTP_SUCCESS_REPORT:
745	case SCTP_ERROR_CAUSE_IND:
746#ifdef SCTP_DEBUG
747		if (sctp_debug_on & SCTP_DEBUG_INPUT2) {
748			printf("Huh, the peer does not support success? or error cause?\n");
749			printf("Turning off ASCONF to this strange peer\n");
750		}
751#endif
752		stcb->asoc.peer_supports_asconf = 0;
753		break;
754	default:
755#ifdef SCTP_DEBUG
756		if (sctp_debug_on & SCTP_DEBUG_INPUT2) {
757			printf("Peer does not support param type %d(%x)??\n",
758			    pbad->param_type, (uint32_t) pbad->param_type);
759		}
760#endif
761		break;
762	}
763}
764
765static int
766sctp_handle_error(struct sctp_chunkhdr *ch,
767    struct sctp_tcb *stcb, struct sctp_nets *net)
768{
769	int chklen;
770	struct sctp_paramhdr *phdr;
771	uint16_t error_type;
772	uint16_t error_len;
773	struct sctp_association *asoc;
774
775	int adjust;
776
777	/* parse through all of the errors and process */
778	asoc = &stcb->asoc;
779	phdr = (struct sctp_paramhdr *)((caddr_t)ch +
780	    sizeof(struct sctp_chunkhdr));
781	chklen = ntohs(ch->chunk_length) - sizeof(struct sctp_chunkhdr);
782	while ((size_t)chklen >= sizeof(struct sctp_paramhdr)) {
783		/* Process an Error Cause */
784		error_type = ntohs(phdr->param_type);
785		error_len = ntohs(phdr->param_length);
786		if ((error_len > chklen) || (error_len == 0)) {
787			/* invalid param length for this param */
788#ifdef SCTP_DEBUG
789			if (sctp_debug_on & SCTP_DEBUG_INPUT1) {
790				printf("Bogus length in error param- chunk left:%d errorlen:%d\n",
791				    chklen, error_len);
792			}
793#endif				/* SCTP_DEBUG */
794			return (0);
795		}
796		switch (error_type) {
797		case SCTP_CAUSE_INVALID_STREAM:
798		case SCTP_CAUSE_MISSING_PARAM:
799		case SCTP_CAUSE_INVALID_PARAM:
800		case SCTP_CAUSE_NO_USER_DATA:
801#ifdef SCTP_DEBUG
802			if (sctp_debug_on & SCTP_DEBUG_INPUT1) {
803				printf("Software error we got a %d back? We have a bug :/ (or do they?)\n",
804				    error_type);
805			}
806#endif
807			break;
808		case SCTP_CAUSE_STALE_COOKIE:
809			/*
810			 * We only act if we have echoed a cookie and are
811			 * waiting.
812			 */
813			if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) {
814				int *p;
815
816				p = (int *)((caddr_t)phdr + sizeof(*phdr));
817				/* Save the time doubled */
818				asoc->cookie_preserve_req = ntohl(*p) << 1;
819				asoc->stale_cookie_count++;
820				if (asoc->stale_cookie_count >
821				    asoc->max_init_times) {
822					sctp_abort_notification(stcb, 0);
823					/* now free the asoc */
824					sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_10);
825					return (-1);
826				}
827				/* blast back to INIT state */
828				asoc->state &= ~SCTP_STATE_COOKIE_ECHOED;
829				asoc->state |= SCTP_STATE_COOKIE_WAIT;
830
831				sctp_stop_all_cookie_timers(stcb);
832				sctp_send_initiate(stcb->sctp_ep, stcb);
833			}
834			break;
835		case SCTP_CAUSE_UNRESOLVABLE_ADDR:
836			/*
837			 * Nothing we can do here, we don't do hostname
838			 * addresses so if the peer does not like my IPv6
839			 * (or IPv4 for that matter) it does not matter. If
840			 * they don't support that type of address, they can
841			 * NOT possibly get that packet type... i.e. with no
842			 * IPv6 you can't recieve a IPv6 packet. so we can
843			 * safely ignore this one. If we ever added support
844			 * for HOSTNAME Addresses, then we would need to do
845			 * something here.
846			 */
847			break;
848		case SCTP_CAUSE_UNRECOG_CHUNK:
849			sctp_process_unrecog_chunk(stcb, phdr, net);
850			break;
851		case SCTP_CAUSE_UNRECOG_PARAM:
852			sctp_process_unrecog_param(stcb, phdr);
853			break;
854		case SCTP_CAUSE_COOKIE_IN_SHUTDOWN:
855			/*
856			 * We ignore this since the timer will drive out a
857			 * new cookie anyway and there timer will drive us
858			 * to send a SHUTDOWN_COMPLETE. We can't send one
859			 * here since we don't have their tag.
860			 */
861			break;
862		case SCTP_CAUSE_DELETING_LAST_ADDR:
863		case SCTP_CAUSE_RESOURCE_SHORTAGE:
864		case SCTP_CAUSE_DELETING_SRC_ADDR:
865			/*
866			 * We should NOT get these here, but in a
867			 * ASCONF-ACK.
868			 */
869#ifdef SCTP_DEBUG
870			if (sctp_debug_on & SCTP_DEBUG_INPUT2) {
871				printf("Peer sends ASCONF errors in a Operational Error?<%d>?\n",
872				    error_type);
873			}
874#endif
875			break;
876		case SCTP_CAUSE_OUT_OF_RESC:
877			/*
878			 * And what, pray tell do we do with the fact that
879			 * the peer is out of resources? Not really sure we
880			 * could do anything but abort. I suspect this
881			 * should have came WITH an abort instead of in a
882			 * OP-ERROR.
883			 */
884			break;
885		default:
886#ifdef SCTP_DEBUG
887			if (sctp_debug_on & SCTP_DEBUG_INPUT1) {
888				/* don't know what this error cause is... */
889				printf("sctp_handle_error: unknown error type = 0x%xh\n",
890				    error_type);
891			}
892#endif				/* SCTP_DEBUG */
893			break;
894		}
895		adjust = SCTP_SIZE32(error_len);
896		chklen -= adjust;
897		phdr = (struct sctp_paramhdr *)((caddr_t)phdr + adjust);
898	}
899	return (0);
900}
901
902static int
903sctp_handle_init_ack(struct mbuf *m, int iphlen, int offset, struct sctphdr *sh,
904    struct sctp_init_ack_chunk *cp, struct sctp_tcb *stcb,
905    struct sctp_nets *net)
906{
907	struct sctp_init_ack *init_ack;
908	int *state;
909	struct mbuf *op_err;
910
911#ifdef SCTP_DEBUG
912	if (sctp_debug_on & SCTP_DEBUG_INPUT2) {
913		printf("sctp_handle_init_ack: handling INIT-ACK\n");
914	}
915#endif
916	if (stcb == NULL) {
917#ifdef SCTP_DEBUG
918		if (sctp_debug_on & SCTP_DEBUG_INPUT2) {
919			printf("sctp_handle_init_ack: TCB is null\n");
920		}
921#endif
922		return (-1);
923	}
924	if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_init_ack_chunk)) {
925		/* Invalid length */
926		op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
927		sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh,
928		    op_err);
929		return (-1);
930	}
931	init_ack = &cp->init;
932	/* validate parameters */
933	if (init_ack->initiate_tag == 0) {
934		/* protocol error... send an abort */
935		op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
936		sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh,
937		    op_err);
938		return (-1);
939	}
940	if (ntohl(init_ack->a_rwnd) < SCTP_MIN_RWND) {
941		/* protocol error... send an abort */
942		op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
943		sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh,
944		    op_err);
945		return (-1);
946	}
947	if (init_ack->num_inbound_streams == 0) {
948		/* protocol error... send an abort */
949		op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
950		sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh,
951		    op_err);
952		return (-1);
953	}
954	if (init_ack->num_outbound_streams == 0) {
955		/* protocol error... send an abort */
956		op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
957		sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh,
958		    op_err);
959		return (-1);
960	}
961	/* process according to association state... */
962	state = &stcb->asoc.state;
963	switch (*state & SCTP_STATE_MASK) {
964	case SCTP_STATE_COOKIE_WAIT:
965		/* this is the expected state for this chunk */
966		/* process the INIT-ACK parameters */
967		if (stcb->asoc.primary_destination->dest_state &
968		    SCTP_ADDR_UNCONFIRMED) {
969			/*
970			 * The primary is where we sent the INIT, we can
971			 * always consider it confirmed when the INIT-ACK is
972			 * returned. Do this before we load addresses
973			 * though.
974			 */
975			stcb->asoc.primary_destination->dest_state &=
976			    ~SCTP_ADDR_UNCONFIRMED;
977			sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
978			    stcb, 0, (void *)stcb->asoc.primary_destination);
979		}
980		if (sctp_process_init_ack(m, iphlen, offset, sh, cp, stcb, net
981		    ) < 0) {
982			/* error in parsing parameters */
983			return (-1);
984		}
985		/* update our state */
986#ifdef SCTP_DEBUG
987		if (sctp_debug_on & SCTP_DEBUG_INPUT2) {
988			printf("moving to COOKIE-ECHOED state\n");
989		}
990#endif
991		if (*state & SCTP_STATE_SHUTDOWN_PENDING) {
992			*state = SCTP_STATE_COOKIE_ECHOED |
993			    SCTP_STATE_SHUTDOWN_PENDING;
994		} else {
995			*state = SCTP_STATE_COOKIE_ECHOED;
996		}
997
998		/* reset the RTO calc */
999		stcb->asoc.overall_error_count = 0;
1000		SCTP_GETTIME_TIMEVAL(&stcb->asoc.time_entered);
1001		/*
1002		 * collapse the init timer back in case of a exponential
1003		 * backoff
1004		 */
1005		sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, stcb->sctp_ep,
1006		    stcb, net);
1007		/*
1008		 * the send at the end of the inbound data processing will
1009		 * cause the cookie to be sent
1010		 */
1011		break;
1012	case SCTP_STATE_SHUTDOWN_SENT:
1013		/* incorrect state... discard */
1014		break;
1015	case SCTP_STATE_COOKIE_ECHOED:
1016		/* incorrect state... discard */
1017		break;
1018	case SCTP_STATE_OPEN:
1019		/* incorrect state... discard */
1020		break;
1021	case SCTP_STATE_EMPTY:
1022	case SCTP_STATE_INUSE:
1023	default:
1024		/* incorrect state... discard */
1025		return (-1);
1026		break;
1027	}			/* end switch asoc state */
1028#ifdef SCTP_DEBUG
1029	if (sctp_debug_on & SCTP_DEBUG_INPUT1) {
1030		printf("Leaving handle-init-ack end\n");
1031	}
1032#endif
1033	return (0);
1034}
1035
1036
1037/*
1038 * handle a state cookie for an existing association m: input packet mbuf
1039 * chain-- assumes a pullup on IP/SCTP/COOKIE-ECHO chunk note: this is a
1040 * "split" mbuf and the cookie signature does not exist offset: offset into
1041 * mbuf to the cookie-echo chunk
1042 */
1043static struct sctp_tcb *
1044sctp_process_cookie_existing(struct mbuf *m, int iphlen, int offset,
1045    struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len,
1046    struct sctp_inpcb *inp, struct sctp_tcb *stcb, struct sctp_nets *net,
1047    struct sockaddr *init_src, int *notification, sctp_assoc_t * sac_assoc_id)
1048{
1049	struct sctp_association *asoc;
1050	struct sctp_init_chunk *init_cp, init_buf;
1051	struct sctp_init_ack_chunk *initack_cp, initack_buf;
1052	int chk_length;
1053	int init_offset, initack_offset, i;
1054	int retval;
1055	int spec_flag = 0;
1056	int how_indx;
1057
1058	/* I know that the TCB is non-NULL from the caller */
1059	asoc = &stcb->asoc;
1060	for (how_indx = 0; how_indx < sizeof(asoc->cookie_how); how_indx++) {
1061		if (asoc->cookie_how[how_indx] == 0)
1062			break;
1063	}
1064	if (how_indx < sizeof(asoc->cookie_how)) {
1065		asoc->cookie_how[how_indx] = 1;
1066	}
1067	if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) {
1068		/* SHUTDOWN came in after sending INIT-ACK */
1069		struct mbuf *op_err;
1070		struct sctp_paramhdr *ph;
1071
1072		sctp_send_shutdown_ack(stcb, stcb->asoc.primary_destination);
1073		op_err = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr),
1074		    0, M_DONTWAIT, 1, MT_DATA);
1075		if (op_err == NULL) {
1076			/* FOOBAR */
1077			return (NULL);
1078		}
1079		/* pre-reserve some space */
1080		SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr));
1081		SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr));
1082		SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr));
1083		/* Set the len */
1084		SCTP_BUF_LEN(op_err) = sizeof(struct sctp_paramhdr);
1085		ph = mtod(op_err, struct sctp_paramhdr *);
1086		ph->param_type = htons(SCTP_CAUSE_COOKIE_IN_SHUTDOWN);
1087		ph->param_length = htons(sizeof(struct sctp_paramhdr));
1088		sctp_send_operr_to(m, iphlen, op_err, cookie->peers_vtag);
1089		if (how_indx < sizeof(asoc->cookie_how))
1090			asoc->cookie_how[how_indx] = 2;
1091		return (NULL);
1092	}
1093	/*
1094	 * find and validate the INIT chunk in the cookie (peer's info) the
1095	 * INIT should start after the cookie-echo header struct (chunk
1096	 * header, state cookie header struct)
1097	 */
1098	init_offset = offset += sizeof(struct sctp_cookie_echo_chunk);
1099
1100	init_cp = (struct sctp_init_chunk *)
1101	    sctp_m_getptr(m, init_offset, sizeof(struct sctp_init_chunk),
1102	    (uint8_t *) & init_buf);
1103	if (init_cp == NULL) {
1104		/* could not pull a INIT chunk in cookie */
1105		return (NULL);
1106	}
1107	chk_length = ntohs(init_cp->ch.chunk_length);
1108	if (init_cp->ch.chunk_type != SCTP_INITIATION) {
1109		return (NULL);
1110	}
1111	/*
1112	 * find and validate the INIT-ACK chunk in the cookie (my info) the
1113	 * INIT-ACK follows the INIT chunk
1114	 */
1115	initack_offset = init_offset + SCTP_SIZE32(chk_length);
1116	initack_cp = (struct sctp_init_ack_chunk *)
1117	    sctp_m_getptr(m, initack_offset, sizeof(struct sctp_init_ack_chunk),
1118	    (uint8_t *) & initack_buf);
1119	if (initack_cp == NULL) {
1120		/* could not pull INIT-ACK chunk in cookie */
1121		return (NULL);
1122	}
1123	chk_length = ntohs(initack_cp->ch.chunk_length);
1124	if (initack_cp->ch.chunk_type != SCTP_INITIATION_ACK) {
1125		return (NULL);
1126	}
1127	if ((ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag) &&
1128	    (ntohl(init_cp->init.initiate_tag) == asoc->peer_vtag)) {
1129		/*
1130		 * case D in Section 5.2.4 Table 2: MMAA process accordingly
1131		 * to get into the OPEN state
1132		 */
1133		if (ntohl(initack_cp->init.initial_tsn) != asoc->init_seq_number) {
1134#ifdef INVARIANTS
1135			panic("Case D and non-match seq?");
1136#else
1137			printf("Case D, seq non-match %x vs %x?\n",
1138			    ntohl(initack_cp->init.initial_tsn), asoc->init_seq_number);
1139#endif
1140		}
1141		switch SCTP_GET_STATE
1142			(asoc) {
1143		case SCTP_STATE_COOKIE_WAIT:
1144		case SCTP_STATE_COOKIE_ECHOED:
1145			/*
1146			 * INIT was sent, but got got a COOKIE_ECHO with the
1147			 * correct tags... just accept it...but we must
1148			 * process the init so that we can make sure we have
1149			 * the right seq no's.
1150			 */
1151			/* First we must process the INIT !! */
1152			retval = sctp_process_init(init_cp, stcb, net);
1153			if (retval < 0) {
1154				if (how_indx < sizeof(asoc->cookie_how))
1155					asoc->cookie_how[how_indx] = 3;
1156				return (NULL);
1157			}
1158			/* we have already processed the INIT so no problem */
1159			sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb,
1160			    net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_11);
1161			sctp_timer_stop(SCTP_TIMER_TYPE_INIT, inp, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_12);
1162			/* update current state */
1163			if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)
1164				SCTP_STAT_INCR_COUNTER32(sctps_activeestab);
1165			else
1166				SCTP_STAT_INCR_COUNTER32(sctps_collisionestab);
1167			if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
1168				asoc->state = SCTP_STATE_OPEN | SCTP_STATE_SHUTDOWN_PENDING;
1169				sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
1170				    stcb->sctp_ep, stcb, asoc->primary_destination);
1171
1172			} else {
1173				/* if ok, move to OPEN state */
1174				asoc->state = SCTP_STATE_OPEN;
1175			}
1176			SCTP_STAT_INCR_GAUGE32(sctps_currestab);
1177			sctp_stop_all_cookie_timers(stcb);
1178			if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
1179			    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
1180			    (inp->sctp_socket->so_qlimit == 0)
1181			    ) {
1182				/*
1183				 * Here is where collision would go if we
1184				 * did a connect() and instead got a
1185				 * init/init-ack/cookie done before the
1186				 * init-ack came back..
1187				 */
1188				stcb->sctp_ep->sctp_flags |=
1189				    SCTP_PCB_FLAGS_CONNECTED;
1190				soisconnected(stcb->sctp_ep->sctp_socket);
1191			}
1192			/* notify upper layer */
1193			*notification = SCTP_NOTIFY_ASSOC_UP;
1194			/*
1195			 * since we did not send a HB make sure we don't
1196			 * double things
1197			 */
1198			net->hb_responded = 1;
1199
1200			if (stcb->asoc.sctp_autoclose_ticks &&
1201			    (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE))) {
1202				sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE,
1203				    inp, stcb, NULL);
1204			}
1205			break;
1206		default:
1207			/*
1208			 * we're in the OPEN state (or beyond), so peer must
1209			 * have simply lost the COOKIE-ACK
1210			 */
1211
1212			break;
1213			}	/* end switch */
1214		sctp_stop_all_cookie_timers(stcb);
1215		/*
1216		 * We ignore the return code here.. not sure if we should
1217		 * somehow abort.. but we do have an existing asoc. This
1218		 * really should not fail.
1219		 */
1220		if (sctp_load_addresses_from_init(stcb, m, iphlen,
1221		    init_offset + sizeof(struct sctp_init_chunk),
1222		    initack_offset, sh, init_src)) {
1223			if (how_indx < sizeof(asoc->cookie_how))
1224				asoc->cookie_how[how_indx] = 4;
1225			return (NULL);
1226		}
1227		/* respond with a COOKIE-ACK */
1228		sctp_toss_old_cookies(stcb, asoc);
1229		sctp_send_cookie_ack(stcb);
1230		if (how_indx < sizeof(asoc->cookie_how))
1231			asoc->cookie_how[how_indx] = 5;
1232		return (stcb);
1233	}			/* end if */
1234	if (ntohl(initack_cp->init.initiate_tag) != asoc->my_vtag &&
1235	    ntohl(init_cp->init.initiate_tag) == asoc->peer_vtag &&
1236	    cookie->tie_tag_my_vtag == 0 &&
1237	    cookie->tie_tag_peer_vtag == 0) {
1238		/*
1239		 * case C in Section 5.2.4 Table 2: XMOO silently discard
1240		 */
1241		if (how_indx < sizeof(asoc->cookie_how))
1242			asoc->cookie_how[how_indx] = 6;
1243		return (NULL);
1244	}
1245	if (ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag &&
1246	    (ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag ||
1247	    init_cp->init.initiate_tag == 0)) {
1248		/*
1249		 * case B in Section 5.2.4 Table 2: MXAA or MOAA my info
1250		 * should be ok, re-accept peer info
1251		 */
1252		if (ntohl(initack_cp->init.initial_tsn) != asoc->init_seq_number) {
1253			/*
1254			 * Extension of case C. If we hit this, then the
1255			 * random number generator returned the same vtag
1256			 * when we first sent our INIT-ACK and when we later
1257			 * sent our INIT. The side with the seq numbers that
1258			 * are different will be the one that normnally
1259			 * would have hit case C. This in effect "extends"
1260			 * our vtags in this collision case to be 64 bits.
1261			 * The same collision could occur aka you get both
1262			 * vtag and seq number the same twice in a row.. but
1263			 * is much less likely. If it did happen then we
1264			 * would proceed through and bring up the assoc.. we
1265			 * may end up with the wrong stream setup however..
1266			 * which would be bad.. but there is no way to
1267			 * tell.. until we send on a stream that does not
1268			 * exist :-)
1269			 */
1270			if (how_indx < sizeof(asoc->cookie_how))
1271				asoc->cookie_how[how_indx] = 7;
1272
1273			return (NULL);
1274		}
1275		if (how_indx < sizeof(asoc->cookie_how))
1276			asoc->cookie_how[how_indx] = 8;
1277		sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_13);
1278		sctp_stop_all_cookie_timers(stcb);
1279		/*
1280		 * since we did not send a HB make sure we don't double
1281		 * things
1282		 */
1283		net->hb_responded = 1;
1284		if (stcb->asoc.sctp_autoclose_ticks &&
1285		    sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE)) {
1286			sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb,
1287			    NULL);
1288		}
1289		asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd);
1290		asoc->pre_open_streams = ntohs(initack_cp->init.num_outbound_streams);
1291
1292		/* Note last_cwr_tsn? where is this used? */
1293		asoc->last_cwr_tsn = asoc->init_seq_number - 1;
1294		if (ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) {
1295			/*
1296			 * Ok the peer probably discarded our data (if we
1297			 * echoed a cookie+data). So anything on the
1298			 * sent_queue should be marked for retransmit, we
1299			 * may not get something to kick us so it COULD
1300			 * still take a timeout to move these.. but it can't
1301			 * hurt to mark them.
1302			 */
1303			struct sctp_tmit_chunk *chk;
1304
1305			TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
1306				if (chk->sent < SCTP_DATAGRAM_RESEND) {
1307					chk->sent = SCTP_DATAGRAM_RESEND;
1308					stcb->asoc.sent_queue_retran_cnt++;
1309					spec_flag++;
1310				}
1311			}
1312
1313		}
1314		/* process the INIT info (peer's info) */
1315		retval = sctp_process_init(init_cp, stcb, net);
1316		if (retval < 0) {
1317			if (how_indx < sizeof(asoc->cookie_how))
1318				asoc->cookie_how[how_indx] = 9;
1319			return (NULL);
1320		}
1321		if (sctp_load_addresses_from_init(stcb, m, iphlen,
1322		    init_offset + sizeof(struct sctp_init_chunk),
1323		    initack_offset, sh, init_src)) {
1324			if (how_indx < sizeof(asoc->cookie_how))
1325				asoc->cookie_how[how_indx] = 10;
1326			return (NULL);
1327		}
1328		if ((asoc->state & SCTP_STATE_COOKIE_WAIT) ||
1329		    (asoc->state & SCTP_STATE_COOKIE_ECHOED)) {
1330			*notification = SCTP_NOTIFY_ASSOC_UP;
1331
1332			if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
1333			    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
1334			    (inp->sctp_socket->so_qlimit == 0)) {
1335				stcb->sctp_ep->sctp_flags |=
1336				    SCTP_PCB_FLAGS_CONNECTED;
1337				soisconnected(stcb->sctp_ep->sctp_socket);
1338			}
1339			if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)
1340				SCTP_STAT_INCR_COUNTER32(sctps_activeestab);
1341			else
1342				SCTP_STAT_INCR_COUNTER32(sctps_collisionestab);
1343			SCTP_STAT_INCR_COUNTER32(sctps_activeestab);
1344			SCTP_STAT_INCR_GAUGE32(sctps_currestab);
1345		} else if (SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) {
1346			SCTP_STAT_INCR_COUNTER32(sctps_restartestab);
1347		} else {
1348			SCTP_STAT_INCR_COUNTER32(sctps_collisionestab);
1349		}
1350		if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
1351			asoc->state = SCTP_STATE_OPEN | SCTP_STATE_SHUTDOWN_PENDING;
1352			sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
1353			    stcb->sctp_ep, stcb, asoc->primary_destination);
1354
1355		} else {
1356			asoc->state = SCTP_STATE_OPEN;
1357		}
1358		sctp_stop_all_cookie_timers(stcb);
1359		sctp_toss_old_cookies(stcb, asoc);
1360		sctp_send_cookie_ack(stcb);
1361		if (spec_flag) {
1362			/*
1363			 * only if we have retrans set do we do this. What
1364			 * this call does is get only the COOKIE-ACK out and
1365			 * then when we return the normal call to
1366			 * sctp_chunk_output will get the retrans out behind
1367			 * this.
1368			 */
1369			sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_COOKIE_ACK);
1370		}
1371		if (how_indx < sizeof(asoc->cookie_how))
1372			asoc->cookie_how[how_indx] = 11;
1373
1374		return (stcb);
1375	}
1376	if ((ntohl(initack_cp->init.initiate_tag) != asoc->my_vtag &&
1377	    ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) &&
1378	    cookie->tie_tag_my_vtag == asoc->my_vtag_nonce &&
1379	    cookie->tie_tag_peer_vtag == asoc->peer_vtag_nonce &&
1380	    cookie->tie_tag_peer_vtag != 0) {
1381		struct sctpasochead *head;
1382
1383		/*
1384		 * case A in Section 5.2.4 Table 2: XXMM (peer restarted)
1385		 */
1386		/* temp code */
1387		if (how_indx < sizeof(asoc->cookie_how))
1388			asoc->cookie_how[how_indx] = 12;
1389		sctp_timer_stop(SCTP_TIMER_TYPE_INIT, inp, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_14);
1390		sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_15);
1391
1392		*sac_assoc_id = sctp_get_associd(stcb);
1393		/* notify upper layer */
1394		*notification = SCTP_NOTIFY_ASSOC_RESTART;
1395		atomic_add_int(&stcb->asoc.refcnt, 1);
1396		if ((SCTP_GET_STATE(asoc) != SCTP_STATE_OPEN) &&
1397		    (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) &&
1398		    (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT)) {
1399			SCTP_STAT_INCR_GAUGE32(sctps_currestab);
1400		}
1401		if (SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) {
1402			SCTP_STAT_INCR_GAUGE32(sctps_restartestab);
1403		} else if (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) {
1404			SCTP_STAT_INCR_GAUGE32(sctps_collisionestab);
1405		}
1406		if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
1407			asoc->state = SCTP_STATE_OPEN |
1408			    SCTP_STATE_SHUTDOWN_PENDING;
1409			sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
1410			    stcb->sctp_ep, stcb, asoc->primary_destination);
1411
1412		} else if (!(asoc->state & SCTP_STATE_SHUTDOWN_SENT)) {
1413			/* move to OPEN state, if not in SHUTDOWN_SENT */
1414			asoc->state = SCTP_STATE_OPEN;
1415		}
1416		asoc->pre_open_streams =
1417		    ntohs(initack_cp->init.num_outbound_streams);
1418		asoc->init_seq_number = ntohl(initack_cp->init.initial_tsn);
1419		asoc->sending_seq = asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number;
1420
1421		asoc->last_cwr_tsn = asoc->init_seq_number - 1;
1422		asoc->asconf_seq_in = asoc->last_acked_seq = asoc->init_seq_number - 1;
1423
1424		asoc->str_reset_seq_in = asoc->init_seq_number;
1425
1426		asoc->advanced_peer_ack_point = asoc->last_acked_seq;
1427		if (asoc->mapping_array)
1428			memset(asoc->mapping_array, 0,
1429			    asoc->mapping_array_size);
1430		SCTP_TCB_UNLOCK(stcb);
1431		SCTP_INP_INFO_WLOCK();
1432		SCTP_INP_WLOCK(stcb->sctp_ep);
1433		SCTP_TCB_LOCK(stcb);
1434		atomic_add_int(&stcb->asoc.refcnt, -1);
1435		/* send up all the data */
1436		SCTP_TCB_SEND_LOCK(stcb);
1437
1438		sctp_report_all_outbound(stcb, 1);
1439		for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
1440			stcb->asoc.strmout[i].stream_no = i;
1441			stcb->asoc.strmout[i].next_sequence_sent = 0;
1442			stcb->asoc.strmout[i].last_msg_incomplete = 0;
1443		}
1444		/* process the INIT-ACK info (my info) */
1445		asoc->my_vtag = ntohl(initack_cp->init.initiate_tag);
1446		asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd);
1447
1448		/* pull from vtag hash */
1449		LIST_REMOVE(stcb, sctp_asocs);
1450		/* re-insert to new vtag position */
1451		head = &sctppcbinfo.sctp_asochash[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag,
1452		    sctppcbinfo.hashasocmark)];
1453		/*
1454		 * put it in the bucket in the vtag hash of assoc's for the
1455		 * system
1456		 */
1457		LIST_INSERT_HEAD(head, stcb, sctp_asocs);
1458
1459		/* Is this the first restart? */
1460		if (stcb->asoc.in_restart_hash == 0) {
1461			/* Ok add it to assoc_id vtag hash */
1462			head = &sctppcbinfo.sctp_restarthash[SCTP_PCBHASH_ASOC(stcb->asoc.assoc_id,
1463			    sctppcbinfo.hashrestartmark)];
1464			LIST_INSERT_HEAD(head, stcb, sctp_tcbrestarhash);
1465			stcb->asoc.in_restart_hash = 1;
1466		}
1467		/* process the INIT info (peer's info) */
1468		SCTP_TCB_SEND_UNLOCK(stcb);
1469		SCTP_INP_WUNLOCK(stcb->sctp_ep);
1470		SCTP_INP_INFO_WUNLOCK();
1471
1472		retval = sctp_process_init(init_cp, stcb, net);
1473		if (retval < 0) {
1474			if (how_indx < sizeof(asoc->cookie_how))
1475				asoc->cookie_how[how_indx] = 13;
1476
1477			return (NULL);
1478		}
1479		/*
1480		 * since we did not send a HB make sure we don't double
1481		 * things
1482		 */
1483		net->hb_responded = 1;
1484
1485		if (sctp_load_addresses_from_init(stcb, m, iphlen,
1486		    init_offset + sizeof(struct sctp_init_chunk),
1487		    initack_offset, sh, init_src)) {
1488			if (how_indx < sizeof(asoc->cookie_how))
1489				asoc->cookie_how[how_indx] = 14;
1490
1491			return (NULL);
1492		}
1493		/* respond with a COOKIE-ACK */
1494		sctp_stop_all_cookie_timers(stcb);
1495		sctp_toss_old_cookies(stcb, asoc);
1496		sctp_send_cookie_ack(stcb);
1497		if (how_indx < sizeof(asoc->cookie_how))
1498			asoc->cookie_how[how_indx] = 15;
1499
1500		return (stcb);
1501	}
1502	if (how_indx < sizeof(asoc->cookie_how))
1503		asoc->cookie_how[how_indx] = 16;
1504	/* all other cases... */
1505	return (NULL);
1506}
1507
1508
1509/*
1510 * handle a state cookie for a new association m: input packet mbuf chain--
1511 * assumes a pullup on IP/SCTP/COOKIE-ECHO chunk note: this is a "split" mbuf
1512 * and the cookie signature does not exist offset: offset into mbuf to the
1513 * cookie-echo chunk length: length of the cookie chunk to: where the init
1514 * was from returns a new TCB
1515 */
1516static struct sctp_tcb *
1517sctp_process_cookie_new(struct mbuf *m, int iphlen, int offset,
1518    struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len,
1519    struct sctp_inpcb *inp, struct sctp_nets **netp,
1520    struct sockaddr *init_src, int *notification,
1521    int auth_skipped, uint32_t auth_offset, uint32_t auth_len)
1522{
1523	struct sctp_tcb *stcb;
1524	struct sctp_init_chunk *init_cp, init_buf;
1525	struct sctp_init_ack_chunk *initack_cp, initack_buf;
1526	struct sockaddr_storage sa_store;
1527	struct sockaddr *initack_src = (struct sockaddr *)&sa_store;
1528	struct sockaddr_in *sin;
1529	struct sockaddr_in6 *sin6;
1530	struct sctp_association *asoc;
1531	int chk_length;
1532	int init_offset, initack_offset, initack_limit;
1533	int retval;
1534	int error = 0;
1535	uint32_t old_tag;
1536	uint8_t auth_chunk_buf[SCTP_PARAM_BUFFER_SIZE];
1537
1538	/*
1539	 * find and validate the INIT chunk in the cookie (peer's info) the
1540	 * INIT should start after the cookie-echo header struct (chunk
1541	 * header, state cookie header struct)
1542	 */
1543	init_offset = offset + sizeof(struct sctp_cookie_echo_chunk);
1544	init_cp = (struct sctp_init_chunk *)
1545	    sctp_m_getptr(m, init_offset, sizeof(struct sctp_init_chunk),
1546	    (uint8_t *) & init_buf);
1547	if (init_cp == NULL) {
1548		/* could not pull a INIT chunk in cookie */
1549#ifdef SCTP_DEBUG
1550		if (sctp_debug_on & SCTP_DEBUG_INPUT1) {
1551			printf("process_cookie_new: could not pull INIT chunk hdr\n");
1552		}
1553#endif				/* SCTP_DEBUG */
1554		return (NULL);
1555	}
1556	chk_length = ntohs(init_cp->ch.chunk_length);
1557	if (init_cp->ch.chunk_type != SCTP_INITIATION) {
1558#ifdef SCTP_DEBUG
1559		if (sctp_debug_on & SCTP_DEBUG_INPUT1) {
1560			printf("HUH? process_cookie_new: could not find INIT chunk!\n");
1561		}
1562#endif				/* SCTP_DEBUG */
1563		return (NULL);
1564	}
1565	initack_offset = init_offset + SCTP_SIZE32(chk_length);
1566	/*
1567	 * find and validate the INIT-ACK chunk in the cookie (my info) the
1568	 * INIT-ACK follows the INIT chunk
1569	 */
1570	initack_cp = (struct sctp_init_ack_chunk *)
1571	    sctp_m_getptr(m, initack_offset, sizeof(struct sctp_init_ack_chunk),
1572	    (uint8_t *) & initack_buf);
1573	if (initack_cp == NULL) {
1574		/* could not pull INIT-ACK chunk in cookie */
1575#ifdef SCTP_DEBUG
1576		if (sctp_debug_on & SCTP_DEBUG_INPUT1) {
1577			printf("process_cookie_new: could not pull INIT-ACK chunk hdr\n");
1578		}
1579#endif				/* SCTP_DEBUG */
1580		return (NULL);
1581	}
1582	chk_length = ntohs(initack_cp->ch.chunk_length);
1583	if (initack_cp->ch.chunk_type != SCTP_INITIATION_ACK) {
1584		return (NULL);
1585	}
1586	/*
1587	 * NOTE: We can't use the INIT_ACK's chk_length to determine the
1588	 * "initack_limit" value.  This is because the chk_length field
1589	 * includes the length of the cookie, but the cookie is omitted when
1590	 * the INIT and INIT_ACK are tacked onto the cookie...
1591	 */
1592	initack_limit = offset + cookie_len;
1593
1594	/*
1595	 * now that we know the INIT/INIT-ACK are in place, create a new TCB
1596	 * and popluate
1597	 */
1598	stcb = sctp_aloc_assoc(inp, init_src, 0, &error,
1599	    ntohl(initack_cp->init.initiate_tag));
1600	if (stcb == NULL) {
1601		struct mbuf *op_err;
1602
1603		/* memory problem? */
1604#ifdef SCTP_DEBUG
1605		if (sctp_debug_on & SCTP_DEBUG_INPUT1) {
1606			printf("process_cookie_new: no room for another TCB!\n");
1607		}
1608#endif				/* SCTP_DEBUG */
1609		op_err = sctp_generate_invmanparam(SCTP_CAUSE_OUT_OF_RESC);
1610		sctp_abort_association(inp, (struct sctp_tcb *)NULL, m, iphlen,
1611		    sh, op_err);
1612		return (NULL);
1613	}
1614	/* get the correct sctp_nets */
1615	*netp = sctp_findnet(stcb, init_src);
1616	asoc = &stcb->asoc;
1617	/* get scope variables out of cookie */
1618	asoc->ipv4_local_scope = cookie->ipv4_scope;
1619	asoc->site_scope = cookie->site_scope;
1620	asoc->local_scope = cookie->local_scope;
1621	asoc->loopback_scope = cookie->loopback_scope;
1622
1623	if ((asoc->ipv4_addr_legal != cookie->ipv4_addr_legal) ||
1624	    (asoc->ipv6_addr_legal != cookie->ipv6_addr_legal)) {
1625		struct mbuf *op_err;
1626
1627		/*
1628		 * Houston we have a problem. The EP changed while the
1629		 * cookie was in flight. Only recourse is to abort the
1630		 * association.
1631		 */
1632		op_err = sctp_generate_invmanparam(SCTP_CAUSE_OUT_OF_RESC);
1633		sctp_abort_association(inp, (struct sctp_tcb *)NULL, m, iphlen,
1634		    sh, op_err);
1635		return (NULL);
1636	}
1637	/* process the INIT-ACK info (my info) */
1638	old_tag = asoc->my_vtag;
1639	asoc->assoc_id = asoc->my_vtag = ntohl(initack_cp->init.initiate_tag);
1640	asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd);
1641	asoc->pre_open_streams = ntohs(initack_cp->init.num_outbound_streams);
1642	asoc->init_seq_number = ntohl(initack_cp->init.initial_tsn);
1643	asoc->sending_seq = asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number;
1644	asoc->last_cwr_tsn = asoc->init_seq_number - 1;
1645	asoc->asconf_seq_in = asoc->last_acked_seq = asoc->init_seq_number - 1;
1646	asoc->str_reset_seq_in = asoc->init_seq_number;
1647
1648	asoc->advanced_peer_ack_point = asoc->last_acked_seq;
1649
1650	/* process the INIT info (peer's info) */
1651	retval = sctp_process_init(init_cp, stcb, *netp);
1652	if (retval < 0) {
1653		sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_16);
1654		return (NULL);
1655	}
1656	/* load all addresses */
1657	if (sctp_load_addresses_from_init(stcb, m, iphlen,
1658	    init_offset + sizeof(struct sctp_init_chunk), initack_offset, sh,
1659	    init_src)) {
1660		sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_17);
1661		return (NULL);
1662	}
1663	/*
1664	 * verify any preceding AUTH chunk that was skipped
1665	 */
1666	/* pull the local authentication parameters from the cookie/init-ack */
1667	sctp_auth_get_cookie_params(stcb, m,
1668	    initack_offset + sizeof(struct sctp_init_ack_chunk),
1669	    initack_limit - (initack_offset + sizeof(struct sctp_init_ack_chunk)));
1670	if (auth_skipped) {
1671		struct sctp_auth_chunk *auth;
1672
1673		auth = (struct sctp_auth_chunk *)
1674		    sctp_m_getptr(m, auth_offset, auth_len, auth_chunk_buf);
1675		if (sctp_handle_auth(stcb, auth, m, auth_offset)) {
1676			/* auth HMAC failed, dump the assoc and packet */
1677#ifdef SCTP_DEBUG
1678			if (sctp_debug_on & SCTP_DEBUG_AUTH1)
1679				printf("COOKIE-ECHO: AUTH failed\n");
1680#endif				/* SCTP_DEBUG */
1681			sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_18);
1682			return (NULL);
1683		} else {
1684			/* remaining chunks checked... good to go */
1685			stcb->asoc.authenticated = 1;
1686		}
1687	}
1688	/* update current state */
1689#ifdef SCTP_DEBUG
1690	if (sctp_debug_on & SCTP_DEBUG_INPUT1) {
1691		printf("moving to OPEN state\n");
1692	}
1693#endif
1694	if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
1695		asoc->state = SCTP_STATE_OPEN | SCTP_STATE_SHUTDOWN_PENDING;
1696		sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
1697		    stcb->sctp_ep, stcb, asoc->primary_destination);
1698	} else {
1699		asoc->state = SCTP_STATE_OPEN;
1700	}
1701	sctp_stop_all_cookie_timers(stcb);
1702	SCTP_STAT_INCR_COUNTER32(sctps_passiveestab);
1703	SCTP_STAT_INCR_GAUGE32(sctps_currestab);
1704
1705	/*
1706	 * if we're doing ASCONFs, check to see if we have any new local
1707	 * addresses that need to get added to the peer (eg. addresses
1708	 * changed while cookie echo in flight).  This needs to be done
1709	 * after we go to the OPEN state to do the correct asconf
1710	 * processing. else, make sure we have the correct addresses in our
1711	 * lists
1712	 */
1713
1714	/* warning, we re-use sin, sin6, sa_store here! */
1715	/* pull in local_address (our "from" address) */
1716	if (cookie->laddr_type == SCTP_IPV4_ADDRESS) {
1717		/* source addr is IPv4 */
1718		sin = (struct sockaddr_in *)initack_src;
1719		memset(sin, 0, sizeof(*sin));
1720		sin->sin_family = AF_INET;
1721		sin->sin_len = sizeof(struct sockaddr_in);
1722		sin->sin_addr.s_addr = cookie->laddress[0];
1723	} else if (cookie->laddr_type == SCTP_IPV6_ADDRESS) {
1724		/* source addr is IPv6 */
1725		sin6 = (struct sockaddr_in6 *)initack_src;
1726		memset(sin6, 0, sizeof(*sin6));
1727		sin6->sin6_family = AF_INET6;
1728		sin6->sin6_len = sizeof(struct sockaddr_in6);
1729		sin6->sin6_scope_id = cookie->scope_id;
1730		memcpy(&sin6->sin6_addr, cookie->laddress,
1731		    sizeof(sin6->sin6_addr));
1732	} else {
1733		sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_19);
1734		return (NULL);
1735	}
1736
1737	sctp_check_address_list(stcb, m,
1738	    initack_offset + sizeof(struct sctp_init_ack_chunk),
1739	    initack_limit - (initack_offset + sizeof(struct sctp_init_ack_chunk)),
1740	    initack_src, cookie->local_scope, cookie->site_scope,
1741	    cookie->ipv4_scope, cookie->loopback_scope);
1742
1743
1744	/* set up to notify upper layer */
1745	*notification = SCTP_NOTIFY_ASSOC_UP;
1746	if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
1747	    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
1748	    (inp->sctp_socket->so_qlimit == 0)) {
1749		/*
1750		 * This is an endpoint that called connect() how it got a
1751		 * cookie that is NEW is a bit of a mystery. It must be that
1752		 * the INIT was sent, but before it got there.. a complete
1753		 * INIT/INIT-ACK/COOKIE arrived. But of course then it
1754		 * should have went to the other code.. not here.. oh well..
1755		 * a bit of protection is worth having..
1756		 */
1757		stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_CONNECTED;
1758		soisconnected(stcb->sctp_ep->sctp_socket);
1759	} else if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
1760	    (inp->sctp_socket->so_qlimit)) {
1761		/*
1762		 * We don't want to do anything with this one. Since it is
1763		 * the listening guy. The timer will get started for
1764		 * accepted connections in the caller.
1765		 */
1766		;
1767	}
1768	/* since we did not send a HB make sure we don't double things */
1769	(*netp)->hb_responded = 1;
1770
1771	if (stcb->asoc.sctp_autoclose_ticks &&
1772	    sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE)) {
1773		sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb, NULL);
1774	}
1775	/* respond with a COOKIE-ACK */
1776	/* calculate the RTT */
1777	(*netp)->RTO = sctp_calculate_rto(stcb, asoc, *netp,
1778	    &cookie->time_entered);
1779	sctp_send_cookie_ack(stcb);
1780	return (stcb);
1781}
1782
1783
1784/*
1785 * handles a COOKIE-ECHO message stcb: modified to either a new or left as
1786 * existing (non-NULL) TCB
1787 */
1788static struct mbuf *
1789sctp_handle_cookie_echo(struct mbuf *m, int iphlen, int offset,
1790    struct sctphdr *sh, struct sctp_cookie_echo_chunk *cp,
1791    struct sctp_inpcb **inp_p, struct sctp_tcb **stcb, struct sctp_nets **netp,
1792    int auth_skipped, uint32_t auth_offset, uint32_t auth_len, struct sctp_tcb **locked_tcb)
1793{
1794	struct sctp_state_cookie *cookie;
1795	struct sockaddr_in6 sin6;
1796	struct sockaddr_in sin;
1797	struct sctp_tcb *l_stcb = *stcb;
1798	struct sctp_inpcb *l_inp;
1799	struct sockaddr *to;
1800	sctp_assoc_t sac_restart_id;
1801	struct sctp_pcb *ep;
1802	struct mbuf *m_sig;
1803	uint8_t calc_sig[SCTP_SIGNATURE_SIZE], tmp_sig[SCTP_SIGNATURE_SIZE];
1804	uint8_t *sig;
1805	uint8_t cookie_ok = 0;
1806	unsigned int size_of_pkt, sig_offset, cookie_offset;
1807	unsigned int cookie_len;
1808	struct timeval now;
1809	struct timeval time_expires;
1810	struct sockaddr_storage dest_store;
1811	struct sockaddr *localep_sa = (struct sockaddr *)&dest_store;
1812	struct ip *iph;
1813	int notification = 0;
1814	struct sctp_nets *netl;
1815	int had_a_existing_tcb = 0;
1816
1817#ifdef SCTP_DEBUG
1818	if (sctp_debug_on & SCTP_DEBUG_INPUT2) {
1819		printf("sctp_handle_cookie: handling COOKIE-ECHO\n");
1820	}
1821#endif
1822
1823	if (inp_p == NULL) {
1824		return (NULL);
1825	}
1826	/* First get the destination address setup too. */
1827	iph = mtod(m, struct ip *);
1828	if (iph->ip_v == IPVERSION) {
1829		/* its IPv4 */
1830		struct sockaddr_in *sin;
1831
1832		sin = (struct sockaddr_in *)(localep_sa);
1833		memset(sin, 0, sizeof(*sin));
1834		sin->sin_family = AF_INET;
1835		sin->sin_len = sizeof(*sin);
1836		sin->sin_port = sh->dest_port;
1837		sin->sin_addr.s_addr = iph->ip_dst.s_addr;
1838		size_of_pkt = SCTP_GET_IPV4_LENGTH(iph);
1839	} else if (iph->ip_v == (IPV6_VERSION >> 4)) {
1840		/* its IPv6 */
1841		struct ip6_hdr *ip6;
1842		struct sockaddr_in6 *sin6;
1843
1844		sin6 = (struct sockaddr_in6 *)(localep_sa);
1845		memset(sin6, 0, sizeof(*sin6));
1846		sin6->sin6_family = AF_INET6;
1847		sin6->sin6_len = sizeof(struct sockaddr_in6);
1848		ip6 = mtod(m, struct ip6_hdr *);
1849		sin6->sin6_port = sh->dest_port;
1850		sin6->sin6_addr = ip6->ip6_dst;
1851		size_of_pkt = SCTP_GET_IPV6_LENGTH(ip6) + iphlen;
1852	} else {
1853		return (NULL);
1854	}
1855
1856	cookie = &cp->cookie;
1857	cookie_offset = offset + sizeof(struct sctp_chunkhdr);
1858	cookie_len = ntohs(cp->ch.chunk_length);
1859
1860	if ((cookie->peerport != sh->src_port) &&
1861	    (cookie->myport != sh->dest_port) &&
1862	    (cookie->my_vtag != sh->v_tag)) {
1863		/*
1864		 * invalid ports or bad tag.  Note that we always leave the
1865		 * v_tag in the header in network order and when we stored
1866		 * it in the my_vtag slot we also left it in network order.
1867		 * This maintians the match even though it may be in the
1868		 * opposite byte order of the machine :->
1869		 */
1870		return (NULL);
1871	}
1872	if (cookie_len > size_of_pkt ||
1873	    cookie_len < sizeof(struct sctp_cookie_echo_chunk) +
1874	    sizeof(struct sctp_init_chunk) +
1875	    sizeof(struct sctp_init_ack_chunk) + SCTP_SIGNATURE_SIZE) {
1876		/* cookie too long!  or too small */
1877		return (NULL);
1878	}
1879	/*
1880	 * split off the signature into its own mbuf (since it should not be
1881	 * calculated in the sctp_hmac_m() call).
1882	 */
1883	sig_offset = offset + cookie_len - SCTP_SIGNATURE_SIZE;
1884	if (sig_offset > size_of_pkt) {
1885		/* packet not correct size! */
1886		/* XXX this may already be accounted for earlier... */
1887		return (NULL);
1888	}
1889	m_sig = m_split(m, sig_offset, M_DONTWAIT);
1890	if (m_sig == NULL) {
1891		/* out of memory or ?? */
1892		return (NULL);
1893	}
1894	/*
1895	 * compute the signature/digest for the cookie
1896	 */
1897	ep = &(*inp_p)->sctp_ep;
1898	l_inp = *inp_p;
1899	if (l_stcb) {
1900		SCTP_TCB_UNLOCK(l_stcb);
1901	}
1902	SCTP_INP_RLOCK(l_inp);
1903	if (l_stcb) {
1904		SCTP_TCB_LOCK(l_stcb);
1905	}
1906	/* which cookie is it? */
1907	if ((cookie->time_entered.tv_sec < (long)ep->time_of_secret_change) &&
1908	    (ep->current_secret_number != ep->last_secret_number)) {
1909		/* it's the old cookie */
1910		sctp_hmac_m(SCTP_HMAC,
1911		    (uint8_t *) ep->secret_key[(int)ep->last_secret_number],
1912		    SCTP_SECRET_SIZE, m, cookie_offset, calc_sig);
1913	} else {
1914		/* it's the current cookie */
1915		sctp_hmac_m(SCTP_HMAC,
1916		    (uint8_t *) ep->secret_key[(int)ep->current_secret_number],
1917		    SCTP_SECRET_SIZE, m, cookie_offset, calc_sig);
1918	}
1919	/* get the signature */
1920	SCTP_INP_RUNLOCK(l_inp);
1921	sig = (uint8_t *) sctp_m_getptr(m_sig, 0, SCTP_SIGNATURE_SIZE, (uint8_t *) & tmp_sig);
1922	if (sig == NULL) {
1923		/* couldn't find signature */
1924		sctp_m_freem(m_sig);
1925		return (NULL);
1926	}
1927	/* compare the received digest with the computed digest */
1928	if (memcmp(calc_sig, sig, SCTP_SIGNATURE_SIZE) != 0) {
1929		/* try the old cookie? */
1930		if ((cookie->time_entered.tv_sec == (long)ep->time_of_secret_change) &&
1931		    (ep->current_secret_number != ep->last_secret_number)) {
1932			/* compute digest with old */
1933			sctp_hmac_m(SCTP_HMAC,
1934			    (uint8_t *) ep->secret_key[(int)ep->last_secret_number],
1935			    SCTP_SECRET_SIZE, m, cookie_offset, calc_sig);
1936			/* compare */
1937			if (memcmp(calc_sig, sig, SCTP_SIGNATURE_SIZE) == 0)
1938				cookie_ok = 1;
1939		}
1940	} else {
1941		cookie_ok = 1;
1942	}
1943
1944	/*
1945	 * Now before we continue we must reconstruct our mbuf so that
1946	 * normal processing of any other chunks will work.
1947	 */
1948	{
1949		struct mbuf *m_at;
1950
1951		m_at = m;
1952		while (SCTP_BUF_NEXT(m_at) != NULL) {
1953			m_at = SCTP_BUF_NEXT(m_at);
1954		}
1955		SCTP_BUF_NEXT(m_at) = m_sig;
1956	}
1957
1958	if (cookie_ok == 0) {
1959#ifdef SCTP_DEBUG
1960		if (sctp_debug_on & SCTP_DEBUG_INPUT2) {
1961			printf("handle_cookie_echo: cookie signature validation failed!\n");
1962			printf("offset = %u, cookie_offset = %u, sig_offset = %u\n",
1963			    (uint32_t) offset, cookie_offset, sig_offset);
1964		}
1965#endif
1966		return (NULL);
1967	}
1968	/*
1969	 * check the cookie timestamps to be sure it's not stale
1970	 */
1971	SCTP_GETTIME_TIMEVAL(&now);
1972	/* Expire time is in Ticks, so we convert to seconds */
1973	time_expires.tv_sec = cookie->time_entered.tv_sec + cookie->cookie_life;
1974	time_expires.tv_usec = cookie->time_entered.tv_usec;
1975	if (timevalcmp(&now, &time_expires, >)) {
1976		/* cookie is stale! */
1977		struct mbuf *op_err;
1978		struct sctp_stale_cookie_msg *scm;
1979		uint32_t tim;
1980
1981		op_err = sctp_get_mbuf_for_msg(sizeof(struct sctp_stale_cookie_msg),
1982		    0, M_DONTWAIT, 1, MT_DATA);
1983		if (op_err == NULL) {
1984			/* FOOBAR */
1985			return (NULL);
1986		}
1987		/* pre-reserve some space */
1988		SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr));
1989		SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr));
1990		SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr));
1991
1992		/* Set the len */
1993		SCTP_BUF_LEN(op_err) = sizeof(struct sctp_stale_cookie_msg);
1994		scm = mtod(op_err, struct sctp_stale_cookie_msg *);
1995		scm->ph.param_type = htons(SCTP_CAUSE_STALE_COOKIE);
1996		scm->ph.param_length = htons((sizeof(struct sctp_paramhdr) +
1997		    (sizeof(uint32_t))));
1998		/* seconds to usec */
1999		tim = (now.tv_sec - time_expires.tv_sec) * 1000000;
2000		/* add in usec */
2001		if (tim == 0)
2002			tim = now.tv_usec - cookie->time_entered.tv_usec;
2003		scm->time_usec = htonl(tim);
2004		sctp_send_operr_to(m, iphlen, op_err, cookie->peers_vtag);
2005		return (NULL);
2006	}
2007	/*
2008	 * Now we must see with the lookup address if we have an existing
2009	 * asoc. This will only happen if we were in the COOKIE-WAIT state
2010	 * and a INIT collided with us and somewhere the peer sent the
2011	 * cookie on another address besides the single address our assoc
2012	 * had for him. In this case we will have one of the tie-tags set at
2013	 * least AND the address field in the cookie can be used to look it
2014	 * up.
2015	 */
2016	to = NULL;
2017	if (cookie->addr_type == SCTP_IPV6_ADDRESS) {
2018		memset(&sin6, 0, sizeof(sin6));
2019		sin6.sin6_family = AF_INET6;
2020		sin6.sin6_len = sizeof(sin6);
2021		sin6.sin6_port = sh->src_port;
2022		sin6.sin6_scope_id = cookie->scope_id;
2023		memcpy(&sin6.sin6_addr.s6_addr, cookie->address,
2024		    sizeof(sin6.sin6_addr.s6_addr));
2025		to = (struct sockaddr *)&sin6;
2026	} else if (cookie->addr_type == SCTP_IPV4_ADDRESS) {
2027		memset(&sin, 0, sizeof(sin));
2028		sin.sin_family = AF_INET;
2029		sin.sin_len = sizeof(sin);
2030		sin.sin_port = sh->src_port;
2031		sin.sin_addr.s_addr = cookie->address[0];
2032		to = (struct sockaddr *)&sin;
2033	}
2034	if ((*stcb == NULL) && to) {
2035		/* Yep, lets check */
2036		*stcb = sctp_findassociation_ep_addr(inp_p, to, netp, localep_sa, NULL);
2037		if (*stcb == NULL) {
2038			/*
2039			 * We should have only got back the same inp. If we
2040			 * got back a different ep we have a problem. The
2041			 * original findep got back l_inp and now
2042			 */
2043			if (l_inp != *inp_p) {
2044				printf("Bad problem find_ep got a diff inp then special_locate?\n");
2045			}
2046		} else {
2047			if (*locked_tcb == NULL) {
2048				/*
2049				 * In this case we found the assoc only
2050				 * after we locked the create lock. This
2051				 * means we are in a colliding case and we
2052				 * must make sure that we unlock the tcb if
2053				 * its one of the cases where we throw away
2054				 * the incoming packets.
2055				 */
2056				*locked_tcb = *stcb;
2057
2058				/*
2059				 * We must also increment the inp ref count
2060				 * since the ref_count flags was set when we
2061				 * did not find the TCB, now we found it
2062				 * which reduces the refcount.. we must
2063				 * raise it back out to balance it all :-)
2064				 */
2065				SCTP_INP_INCR_REF((*stcb)->sctp_ep);
2066				if ((*stcb)->sctp_ep != l_inp) {
2067					printf("Huh? ep:%p diff then l_inp:%p?\n",
2068					    (*stcb)->sctp_ep, l_inp);
2069				}
2070			}
2071		}
2072	}
2073	cookie_len -= SCTP_SIGNATURE_SIZE;
2074	if (*stcb == NULL) {
2075		/* this is the "normal" case... get a new TCB */
2076		*stcb = sctp_process_cookie_new(m, iphlen, offset, sh, cookie,
2077		    cookie_len, *inp_p, netp, to, &notification,
2078		    auth_skipped, auth_offset, auth_len);
2079	} else {
2080		/* this is abnormal... cookie-echo on existing TCB */
2081		had_a_existing_tcb = 1;
2082		*stcb = sctp_process_cookie_existing(m, iphlen, offset, sh,
2083		    cookie, cookie_len, *inp_p, *stcb, *netp, to, &notification,
2084		    &sac_restart_id);
2085	}
2086
2087	if (*stcb == NULL) {
2088		/* still no TCB... must be bad cookie-echo */
2089		return (NULL);
2090	}
2091	/*
2092	 * Ok, we built an association so confirm the address we sent the
2093	 * INIT-ACK to.
2094	 */
2095	netl = sctp_findnet(*stcb, to);
2096	/*
2097	 * This code should in theory NOT run but
2098	 */
2099	if (netl == NULL) {
2100		/* TSNH! Huh, why do I need to add this address here? */
2101		int ret;
2102
2103		ret = sctp_add_remote_addr(*stcb, to, SCTP_DONOT_SETSCOPE,
2104		    SCTP_IN_COOKIE_PROC);
2105		netl = sctp_findnet(*stcb, to);
2106	}
2107	if (netl) {
2108		if (netl->dest_state & SCTP_ADDR_UNCONFIRMED) {
2109			netl->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
2110			sctp_set_primary_addr((*stcb), (struct sockaddr *)NULL,
2111			    netl);
2112			sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
2113			    (*stcb), 0, (void *)netl);
2114		}
2115	}
2116	if (*stcb) {
2117		sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, *inp_p,
2118		    *stcb, NULL);
2119	}
2120	if ((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) {
2121		if (!had_a_existing_tcb ||
2122		    (((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0)) {
2123			/*
2124			 * If we have a NEW cookie or the connect never
2125			 * reached the connected state during collision we
2126			 * must do the TCP accept thing.
2127			 */
2128			struct socket *so, *oso;
2129			struct sctp_inpcb *inp;
2130
2131			if (notification == SCTP_NOTIFY_ASSOC_RESTART) {
2132				/*
2133				 * For a restart we will keep the same
2134				 * socket, no need to do anything. I THINK!!
2135				 */
2136				sctp_ulp_notify(notification, *stcb, 0, (void *)&sac_restart_id);
2137				return (m);
2138			}
2139			oso = (*inp_p)->sctp_socket;
2140			/*
2141			 * We do this to keep the sockets side happy durin
2142			 * the sonewcon ONLY.
2143			 */
2144			NET_LOCK_GIANT();
2145			SCTP_TCB_UNLOCK((*stcb));
2146			so = sonewconn(oso, 0
2147			    );
2148			NET_UNLOCK_GIANT();
2149			SCTP_INP_WLOCK((*stcb)->sctp_ep);
2150			SCTP_TCB_LOCK((*stcb));
2151			SCTP_INP_WUNLOCK((*stcb)->sctp_ep);
2152			if (so == NULL) {
2153				struct mbuf *op_err;
2154
2155				/* Too many sockets */
2156#ifdef SCTP_DEBUG
2157				if (sctp_debug_on & SCTP_DEBUG_INPUT1) {
2158					printf("process_cookie_new: no room for another socket!\n");
2159				}
2160#endif				/* SCTP_DEBUG */
2161				op_err = sctp_generate_invmanparam(SCTP_CAUSE_OUT_OF_RESC);
2162				sctp_abort_association(*inp_p, NULL, m, iphlen,
2163				    sh, op_err);
2164				sctp_free_assoc(*inp_p, *stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_20);
2165				return (NULL);
2166			}
2167			inp = (struct sctp_inpcb *)so->so_pcb;
2168			SCTP_INP_INCR_REF(inp);
2169			/*
2170			 * We add the unbound flag here so that if we get an
2171			 * soabort() before we get the move_pcb done, we
2172			 * will properly cleanup.
2173			 */
2174			inp->sctp_flags = (SCTP_PCB_FLAGS_TCPTYPE |
2175			    SCTP_PCB_FLAGS_CONNECTED |
2176			    SCTP_PCB_FLAGS_IN_TCPPOOL |
2177			    SCTP_PCB_FLAGS_UNBOUND |
2178			    (SCTP_PCB_COPY_FLAGS & (*inp_p)->sctp_flags) |
2179			    SCTP_PCB_FLAGS_DONT_WAKE);
2180			inp->sctp_features = (*inp_p)->sctp_features;
2181			inp->sctp_socket = so;
2182			inp->sctp_frag_point = (*inp_p)->sctp_frag_point;
2183			inp->partial_delivery_point = (*inp_p)->partial_delivery_point;
2184			inp->sctp_context = (*inp_p)->sctp_context;
2185			inp->inp_starting_point_for_iterator = NULL;
2186			/*
2187			 * copy in the authentication parameters from the
2188			 * original endpoint
2189			 */
2190			if (inp->sctp_ep.local_hmacs)
2191				sctp_free_hmaclist(inp->sctp_ep.local_hmacs);
2192			inp->sctp_ep.local_hmacs =
2193			    sctp_copy_hmaclist((*inp_p)->sctp_ep.local_hmacs);
2194			if (inp->sctp_ep.local_auth_chunks)
2195				sctp_free_chunklist(inp->sctp_ep.local_auth_chunks);
2196			inp->sctp_ep.local_auth_chunks =
2197			    sctp_copy_chunklist((*inp_p)->sctp_ep.local_auth_chunks);
2198			(void)sctp_copy_skeylist(&(*inp_p)->sctp_ep.shared_keys,
2199			    &inp->sctp_ep.shared_keys);
2200
2201			/*
2202			 * Now we must move it from one hash table to
2203			 * another and get the tcb in the right place.
2204			 */
2205			sctp_move_pcb_and_assoc(*inp_p, inp, *stcb);
2206			sctp_pull_off_control_to_new_inp((*inp_p), inp, *stcb);
2207
2208			/*
2209			 * now we must check to see if we were aborted while
2210			 * the move was going on and the lock/unlock
2211			 * happened.
2212			 */
2213			if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
2214				/*
2215				 * yep it was, we leave the assoc attached
2216				 * to the socket since the sctp_inpcb_free()
2217				 * call will send an abort for us.
2218				 */
2219				SCTP_INP_DECR_REF(inp);
2220				return (NULL);
2221			}
2222			SCTP_INP_DECR_REF(inp);
2223			/* Switch over to the new guy */
2224			*inp_p = inp;
2225			sctp_ulp_notify(notification, *stcb, 0, NULL);
2226
2227			/*
2228			 * Pull it from the incomplete queue and wake the
2229			 * guy
2230			 */
2231			soisconnected(so);
2232			return (m);
2233		}
2234	}
2235	if ((notification) && ((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE)) {
2236		sctp_ulp_notify(notification, *stcb, 0, NULL);
2237	}
2238	return (m);
2239}
2240
2241static void
2242sctp_handle_cookie_ack(struct sctp_cookie_ack_chunk *cp,
2243    struct sctp_tcb *stcb, struct sctp_nets *net)
2244{
2245	/* cp must not be used, others call this without a c-ack :-) */
2246	struct sctp_association *asoc;
2247
2248#ifdef SCTP_DEBUG
2249	if (sctp_debug_on & SCTP_DEBUG_INPUT2) {
2250		printf("sctp_handle_cookie_ack: handling COOKIE-ACK\n");
2251	}
2252#endif
2253	if (stcb == NULL)
2254		return;
2255
2256	asoc = &stcb->asoc;
2257
2258	sctp_stop_all_cookie_timers(stcb);
2259	/* process according to association state */
2260	if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) {
2261		/* state change only needed when I am in right state */
2262#ifdef SCTP_DEBUG
2263		if (sctp_debug_on & SCTP_DEBUG_INPUT2) {
2264			printf("moving to OPEN state\n");
2265		}
2266#endif
2267		if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
2268			asoc->state = SCTP_STATE_OPEN | SCTP_STATE_SHUTDOWN_PENDING;
2269			sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
2270			    stcb->sctp_ep, stcb, asoc->primary_destination);
2271
2272		} else {
2273			asoc->state = SCTP_STATE_OPEN;
2274		}
2275		/* update RTO */
2276		SCTP_STAT_INCR_COUNTER32(sctps_activeestab);
2277		SCTP_STAT_INCR_GAUGE32(sctps_currestab);
2278		if (asoc->overall_error_count == 0) {
2279			net->RTO = sctp_calculate_rto(stcb, asoc, net,
2280			    &asoc->time_entered);
2281		}
2282		SCTP_GETTIME_TIMEVAL(&asoc->time_entered);
2283		sctp_ulp_notify(SCTP_NOTIFY_ASSOC_UP, stcb, 0, NULL);
2284		if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
2285		    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
2286			stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_CONNECTED;
2287			soisconnected(stcb->sctp_ep->sctp_socket);
2288		}
2289		sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
2290		    stcb, net);
2291		/*
2292		 * since we did not send a HB make sure we don't double
2293		 * things
2294		 */
2295		net->hb_responded = 1;
2296
2297		if (stcb->asoc.sctp_autoclose_ticks &&
2298		    sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_AUTOCLOSE)) {
2299			sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE,
2300			    stcb->sctp_ep, stcb, NULL);
2301		}
2302		/*
2303		 * set ASCONF timer if ASCONFs are pending and allowed (eg.
2304		 * addresses changed when init/cookie echo in flight)
2305		 */
2306		if ((sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_DO_ASCONF)) &&
2307		    (stcb->asoc.peer_supports_asconf) &&
2308		    (!TAILQ_EMPTY(&stcb->asoc.asconf_queue))) {
2309			sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2310			    stcb->sctp_ep, stcb,
2311			    stcb->asoc.primary_destination);
2312		}
2313	}
2314	/* Toss the cookie if I can */
2315	sctp_toss_old_cookies(stcb, asoc);
2316	if (!TAILQ_EMPTY(&asoc->sent_queue)) {
2317		/* Restart the timer if we have pending data */
2318		struct sctp_tmit_chunk *chk;
2319
2320		chk = TAILQ_FIRST(&asoc->sent_queue);
2321		if (chk) {
2322			sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
2323			    stcb, chk->whoTo);
2324		}
2325	}
2326}
2327
2328static void
2329sctp_handle_ecn_echo(struct sctp_ecne_chunk *cp,
2330    struct sctp_tcb *stcb)
2331{
2332	struct sctp_nets *net;
2333	struct sctp_tmit_chunk *lchk;
2334	uint32_t tsn;
2335
2336	if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_ecne_chunk)) {
2337		return;
2338	}
2339	SCTP_STAT_INCR(sctps_recvecne);
2340	tsn = ntohl(cp->tsn);
2341	/* ECN Nonce stuff: need a resync and disable the nonce sum check */
2342	/* Also we make sure we disable the nonce_wait */
2343	lchk = TAILQ_FIRST(&stcb->asoc.send_queue);
2344	if (lchk == NULL) {
2345		stcb->asoc.nonce_resync_tsn = stcb->asoc.sending_seq;
2346	} else {
2347		stcb->asoc.nonce_resync_tsn = lchk->rec.data.TSN_seq;
2348	}
2349	stcb->asoc.nonce_wait_for_ecne = 0;
2350	stcb->asoc.nonce_sum_check = 0;
2351
2352	/* Find where it was sent, if possible */
2353	net = NULL;
2354	lchk = TAILQ_FIRST(&stcb->asoc.sent_queue);
2355	while (lchk) {
2356		if (lchk->rec.data.TSN_seq == tsn) {
2357			net = lchk->whoTo;
2358			break;
2359		}
2360		if (compare_with_wrap(lchk->rec.data.TSN_seq, tsn, MAX_SEQ))
2361			break;
2362		lchk = TAILQ_NEXT(lchk, sctp_next);
2363	}
2364	if (net == NULL)
2365		/* default is we use the primary */
2366		net = stcb->asoc.primary_destination;
2367
2368	if (compare_with_wrap(tsn, stcb->asoc.last_cwr_tsn, MAX_TSN)) {
2369#ifdef SCTP_CWND_MONITOR
2370		int old_cwnd;
2371
2372		old_cwnd = net->cwnd;
2373#endif
2374		SCTP_STAT_INCR(sctps_ecnereducedcwnd);
2375		net->ssthresh = net->cwnd / 2;
2376		if (net->ssthresh < net->mtu) {
2377			net->ssthresh = net->mtu;
2378			/* here back off the timer as well, to slow us down */
2379			net->RTO <<= 2;
2380		}
2381		net->cwnd = net->ssthresh;
2382#ifdef SCTP_CWND_MONITOR
2383		sctp_log_cwnd(stcb, net, (net->cwnd - old_cwnd), SCTP_CWND_LOG_FROM_SAT);
2384#endif
2385		/*
2386		 * we reduce once every RTT. So we will only lower cwnd at
2387		 * the next sending seq i.e. the resync_tsn.
2388		 */
2389		stcb->asoc.last_cwr_tsn = stcb->asoc.nonce_resync_tsn;
2390	}
2391	/*
2392	 * We always send a CWR this way if our previous one was lost our
2393	 * peer will get an update, or if it is not time again to reduce we
2394	 * still get the cwr to the peer.
2395	 */
2396	sctp_send_cwr(stcb, net, tsn);
2397}
2398
2399static void
2400sctp_handle_ecn_cwr(struct sctp_cwr_chunk *cp, struct sctp_tcb *stcb)
2401{
2402	/*
2403	 * Here we get a CWR from the peer. We must look in the outqueue and
2404	 * make sure that we have a covered ECNE in teh control chunk part.
2405	 * If so remove it.
2406	 */
2407	struct sctp_tmit_chunk *chk;
2408	struct sctp_ecne_chunk *ecne;
2409
2410	TAILQ_FOREACH(chk, &stcb->asoc.control_send_queue, sctp_next) {
2411		if (chk->rec.chunk_id.id != SCTP_ECN_ECHO) {
2412			continue;
2413		}
2414		/*
2415		 * Look for and remove if it is the right TSN. Since there
2416		 * is only ONE ECNE on the control queue at any one time we
2417		 * don't need to worry about more than one!
2418		 */
2419		ecne = mtod(chk->data, struct sctp_ecne_chunk *);
2420		if (compare_with_wrap(ntohl(cp->tsn), ntohl(ecne->tsn),
2421		    MAX_TSN) || (cp->tsn == ecne->tsn)) {
2422			/* this covers this ECNE, we can remove it */
2423			stcb->asoc.ecn_echo_cnt_onq--;
2424			TAILQ_REMOVE(&stcb->asoc.control_send_queue, chk,
2425			    sctp_next);
2426			if (chk->data) {
2427				sctp_m_freem(chk->data);
2428				chk->data = NULL;
2429			}
2430			stcb->asoc.ctrl_queue_cnt--;
2431			sctp_free_remote_addr(chk->whoTo);
2432			sctp_free_a_chunk(stcb, chk);
2433			break;
2434		}
2435	}
2436}
2437
2438static void
2439sctp_handle_shutdown_complete(struct sctp_shutdown_complete_chunk *cp,
2440    struct sctp_tcb *stcb, struct sctp_nets *net)
2441{
2442	struct sctp_association *asoc;
2443
2444#ifdef SCTP_DEBUG
2445	if (sctp_debug_on & SCTP_DEBUG_INPUT2) {
2446		printf("sctp_handle_shutdown_complete: handling SHUTDOWN-COMPLETE\n");
2447	}
2448#endif
2449	if (stcb == NULL)
2450		return;
2451
2452	asoc = &stcb->asoc;
2453	/* process according to association state */
2454	if (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT) {
2455		/* unexpected SHUTDOWN-COMPLETE... so ignore... */
2456		SCTP_TCB_UNLOCK(stcb);
2457		return;
2458	}
2459	/* notify upper layer protocol */
2460	if (stcb->sctp_socket) {
2461		sctp_ulp_notify(SCTP_NOTIFY_ASSOC_DOWN, stcb, 0, NULL);
2462		/* are the queues empty? they should be */
2463		if (!TAILQ_EMPTY(&asoc->send_queue) ||
2464		    !TAILQ_EMPTY(&asoc->sent_queue) ||
2465		    !TAILQ_EMPTY(&asoc->out_wheel)) {
2466			sctp_report_all_outbound(stcb, 0);
2467		}
2468	}
2469	/* stop the timer */
2470	sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_21);
2471	SCTP_STAT_INCR_COUNTER32(sctps_shutdown);
2472	/* free the TCB */
2473	sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_22);
2474	return;
2475}
2476
2477static int
2478process_chunk_drop(struct sctp_tcb *stcb, struct sctp_chunk_desc *desc,
2479    struct sctp_nets *net, uint8_t flg)
2480{
2481	switch (desc->chunk_type) {
2482		case SCTP_DATA:
2483		/* find the tsn to resend (possibly */
2484		{
2485			uint32_t tsn;
2486			struct sctp_tmit_chunk *tp1;
2487
2488			tsn = ntohl(desc->tsn_ifany);
2489			tp1 = TAILQ_FIRST(&stcb->asoc.sent_queue);
2490			while (tp1) {
2491				if (tp1->rec.data.TSN_seq == tsn) {
2492					/* found it */
2493					break;
2494				}
2495				if (compare_with_wrap(tp1->rec.data.TSN_seq, tsn,
2496				    MAX_TSN)) {
2497					/* not found */
2498					tp1 = NULL;
2499					break;
2500				}
2501				tp1 = TAILQ_NEXT(tp1, sctp_next);
2502			}
2503			if (tp1 == NULL) {
2504				/*
2505				 * Do it the other way , aka without paying
2506				 * attention to queue seq order.
2507				 */
2508				SCTP_STAT_INCR(sctps_pdrpdnfnd);
2509				tp1 = TAILQ_FIRST(&stcb->asoc.sent_queue);
2510				while (tp1) {
2511					if (tp1->rec.data.TSN_seq == tsn) {
2512						/* found it */
2513						break;
2514					}
2515					tp1 = TAILQ_NEXT(tp1, sctp_next);
2516				}
2517			}
2518			if (tp1 == NULL) {
2519				SCTP_STAT_INCR(sctps_pdrptsnnf);
2520			}
2521			if ((tp1) && (tp1->sent < SCTP_DATAGRAM_ACKED)) {
2522				uint8_t *ddp;
2523
2524				if ((stcb->asoc.peers_rwnd == 0) &&
2525				    ((flg & SCTP_FROM_MIDDLE_BOX) == 0)) {
2526					SCTP_STAT_INCR(sctps_pdrpdiwnp);
2527					return (0);
2528				}
2529				if (stcb->asoc.peers_rwnd == 0 &&
2530				    (flg & SCTP_FROM_MIDDLE_BOX)) {
2531					SCTP_STAT_INCR(sctps_pdrpdizrw);
2532					return (0);
2533				}
2534				ddp = (uint8_t *) (mtod(tp1->data, caddr_t)+
2535				    sizeof(struct sctp_data_chunk));
2536				{
2537					unsigned int iii;
2538
2539					for (iii = 0; iii < sizeof(desc->data_bytes);
2540					    iii++) {
2541						if (ddp[iii] != desc->data_bytes[iii]) {
2542							SCTP_STAT_INCR(sctps_pdrpbadd);
2543							return (-1);
2544						}
2545					}
2546				}
2547				/*
2548				 * We zero out the nonce so resync not
2549				 * needed
2550				 */
2551				tp1->rec.data.ect_nonce = 0;
2552
2553				if (tp1->do_rtt) {
2554					/*
2555					 * this guy had a RTO calculation
2556					 * pending on it, cancel it
2557					 */
2558					tp1->whoTo->rto_pending = 0;
2559					tp1->do_rtt = 0;
2560				}
2561				SCTP_STAT_INCR(sctps_pdrpmark);
2562				if (tp1->sent != SCTP_DATAGRAM_RESEND)
2563					sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
2564				tp1->sent = SCTP_DATAGRAM_RESEND;
2565				/*
2566				 * mark it as if we were doing a FR, since
2567				 * we will be getting gap ack reports behind
2568				 * the info from the router.
2569				 */
2570				tp1->rec.data.doing_fast_retransmit = 1;
2571				/*
2572				 * mark the tsn with what sequences can
2573				 * cause a new FR.
2574				 */
2575				if (TAILQ_EMPTY(&stcb->asoc.send_queue)) {
2576					tp1->rec.data.fast_retran_tsn = stcb->asoc.sending_seq;
2577				} else {
2578					tp1->rec.data.fast_retran_tsn = (TAILQ_FIRST(&stcb->asoc.send_queue))->rec.data.TSN_seq;
2579				}
2580
2581				/* restart the timer */
2582				sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
2583				    stcb, tp1->whoTo, SCTP_FROM_SCTP_INPUT + SCTP_LOC_23);
2584				sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
2585				    stcb, tp1->whoTo);
2586
2587				/* fix counts and things */
2588#ifdef SCTP_FLIGHT_LOGGING
2589				sctp_misc_ints(SCTP_FLIGHT_LOG_DOWN,
2590				    tp1->whoTo->flight_size,
2591				    tp1->book_size,
2592				    (uintptr_t) stcb,
2593				    tp1->rec.data.TSN_seq);
2594#endif
2595				if (tp1->whoTo->flight_size >= tp1->book_size)
2596					tp1->whoTo->flight_size -= tp1->book_size;
2597				else
2598					tp1->whoTo->flight_size = 0;
2599
2600				if (stcb->asoc.total_flight >= tp1->book_size) {
2601					stcb->asoc.total_flight -= tp1->book_size;
2602					if (stcb->asoc.total_flight_count > 0)
2603						stcb->asoc.total_flight_count--;
2604				} else {
2605					stcb->asoc.total_flight = 0;
2606					stcb->asoc.total_flight_count = 0;
2607				}
2608				tp1->snd_count--;
2609			} {
2610				/* audit code */
2611				unsigned int audit;
2612
2613				audit = 0;
2614				TAILQ_FOREACH(tp1, &stcb->asoc.sent_queue, sctp_next) {
2615					if (tp1->sent == SCTP_DATAGRAM_RESEND)
2616						audit++;
2617				}
2618				TAILQ_FOREACH(tp1, &stcb->asoc.control_send_queue,
2619				    sctp_next) {
2620					if (tp1->sent == SCTP_DATAGRAM_RESEND)
2621						audit++;
2622				}
2623				if (audit != stcb->asoc.sent_queue_retran_cnt) {
2624					printf("**Local Audit finds cnt:%d asoc cnt:%d\n",
2625					    audit, stcb->asoc.sent_queue_retran_cnt);
2626#ifndef SCTP_AUDITING_ENABLED
2627					stcb->asoc.sent_queue_retran_cnt = audit;
2628#endif
2629				}
2630			}
2631		}
2632		break;
2633	case SCTP_ASCONF:
2634		{
2635			struct sctp_tmit_chunk *asconf;
2636
2637			TAILQ_FOREACH(asconf, &stcb->asoc.control_send_queue,
2638			    sctp_next) {
2639				if (asconf->rec.chunk_id.id == SCTP_ASCONF) {
2640					break;
2641				}
2642			}
2643			if (asconf) {
2644				if (asconf->sent != SCTP_DATAGRAM_RESEND)
2645					sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
2646				asconf->sent = SCTP_DATAGRAM_RESEND;
2647				asconf->snd_count--;
2648			}
2649		}
2650		break;
2651	case SCTP_INITIATION:
2652		/* resend the INIT */
2653		stcb->asoc.dropped_special_cnt++;
2654		if (stcb->asoc.dropped_special_cnt < SCTP_RETRY_DROPPED_THRESH) {
2655			/*
2656			 * If we can get it in, in a few attempts we do
2657			 * this, otherwise we let the timer fire.
2658			 */
2659			sctp_timer_stop(SCTP_TIMER_TYPE_INIT, stcb->sctp_ep,
2660			    stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_24);
2661			sctp_send_initiate(stcb->sctp_ep, stcb);
2662		}
2663		break;
2664	case SCTP_SELECTIVE_ACK:
2665		/* resend the sack */
2666		sctp_send_sack(stcb);
2667		break;
2668	case SCTP_HEARTBEAT_REQUEST:
2669		/* resend a demand HB */
2670		sctp_send_hb(stcb, 1, net);
2671		break;
2672	case SCTP_SHUTDOWN:
2673		sctp_send_shutdown(stcb, net);
2674		break;
2675	case SCTP_SHUTDOWN_ACK:
2676		sctp_send_shutdown_ack(stcb, net);
2677		break;
2678	case SCTP_COOKIE_ECHO:
2679		{
2680			struct sctp_tmit_chunk *cookie;
2681
2682			cookie = NULL;
2683			TAILQ_FOREACH(cookie, &stcb->asoc.control_send_queue,
2684			    sctp_next) {
2685				if (cookie->rec.chunk_id.id == SCTP_COOKIE_ECHO) {
2686					break;
2687				}
2688			}
2689			if (cookie) {
2690				if (cookie->sent != SCTP_DATAGRAM_RESEND)
2691					sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
2692				cookie->sent = SCTP_DATAGRAM_RESEND;
2693				sctp_stop_all_cookie_timers(stcb);
2694			}
2695		}
2696		break;
2697	case SCTP_COOKIE_ACK:
2698		sctp_send_cookie_ack(stcb);
2699		break;
2700	case SCTP_ASCONF_ACK:
2701		/* resend last asconf ack */
2702		sctp_send_asconf_ack(stcb, 1);
2703		break;
2704	case SCTP_FORWARD_CUM_TSN:
2705		send_forward_tsn(stcb, &stcb->asoc);
2706		break;
2707		/* can't do anything with these */
2708	case SCTP_PACKET_DROPPED:
2709	case SCTP_INITIATION_ACK:	/* this should not happen */
2710	case SCTP_HEARTBEAT_ACK:
2711	case SCTP_ABORT_ASSOCIATION:
2712	case SCTP_OPERATION_ERROR:
2713	case SCTP_SHUTDOWN_COMPLETE:
2714	case SCTP_ECN_ECHO:
2715	case SCTP_ECN_CWR:
2716	default:
2717		break;
2718	}
2719	return (0);
2720}
2721
2722void
2723sctp_reset_in_stream(struct sctp_tcb *stcb, int number_entries, uint16_t * list)
2724{
2725	int i;
2726	uint16_t temp;
2727
2728	/*
2729	 * We set things to 0xffff since this is the last delivered sequence
2730	 * and we will be sending in 0 after the reset.
2731	 */
2732
2733	if (number_entries) {
2734		for (i = 0; i < number_entries; i++) {
2735			temp = ntohs(list[i]);
2736			if (temp >= stcb->asoc.streamincnt) {
2737				continue;
2738			}
2739			stcb->asoc.strmin[temp].last_sequence_delivered = 0xffff;
2740		}
2741	} else {
2742		list = NULL;
2743		for (i = 0; i < stcb->asoc.streamincnt; i++) {
2744			stcb->asoc.strmin[i].last_sequence_delivered = 0xffff;
2745		}
2746	}
2747	sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_RECV, stcb, number_entries, (void *)list);
2748}
2749
2750static void
2751sctp_reset_out_streams(struct sctp_tcb *stcb, int number_entries, uint16_t * list)
2752{
2753	int i;
2754
2755	if (number_entries == 0) {
2756		for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
2757			stcb->asoc.strmout[i].next_sequence_sent = 0;
2758		}
2759	} else if (number_entries) {
2760		for (i = 0; i < number_entries; i++) {
2761			uint16_t temp;
2762
2763			temp = ntohs(list[i]);
2764			if (temp >= stcb->asoc.streamoutcnt) {
2765				/* no such stream */
2766				continue;
2767			}
2768			stcb->asoc.strmout[temp].next_sequence_sent = 0;
2769		}
2770	}
2771	sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_SEND, stcb, number_entries, (void *)list);
2772}
2773
2774
2775struct sctp_stream_reset_out_request *
2776sctp_find_stream_reset(struct sctp_tcb *stcb, uint32_t seq, struct sctp_tmit_chunk **bchk)
2777{
2778	struct sctp_association *asoc;
2779	struct sctp_stream_reset_out_req *req;
2780	struct sctp_stream_reset_out_request *r;
2781	struct sctp_tmit_chunk *chk;
2782	int len, clen;
2783
2784	asoc = &stcb->asoc;
2785	if (TAILQ_EMPTY(&stcb->asoc.control_send_queue)) {
2786		return (NULL);
2787	}
2788	if (stcb->asoc.str_reset == NULL) {
2789		return (NULL);
2790	}
2791	chk = stcb->asoc.str_reset;
2792	if (chk->data == NULL) {
2793		return (NULL);
2794	}
2795	if (bchk) {
2796		/* he wants a copy of the chk pointer */
2797		*bchk = chk;
2798	}
2799	clen = chk->send_size;
2800	req = mtod(chk->data, struct sctp_stream_reset_out_req *);
2801	r = &req->sr_req;
2802	if (ntohl(r->request_seq) == seq) {
2803		/* found it */
2804		return (r);
2805	}
2806	len = SCTP_SIZE32(ntohs(r->ph.param_length));
2807	if (clen > (len + (int)sizeof(struct sctp_chunkhdr))) {
2808		/* move to the next one, there can only be a max of two */
2809		r = (struct sctp_stream_reset_out_request *)((caddr_t)r + len);
2810		if (ntohl(r->request_seq) == seq) {
2811			return (r);
2812		}
2813	}
2814	/* that seq is not here */
2815	return (NULL);
2816}
2817
2818static void
2819sctp_clean_up_stream_reset(struct sctp_tcb *stcb)
2820{
2821	struct sctp_association *asoc;
2822	struct sctp_tmit_chunk *chk = stcb->asoc.str_reset;
2823
2824	if (stcb->asoc.str_reset == NULL) {
2825		return;
2826	}
2827	asoc = &stcb->asoc;
2828
2829	sctp_timer_stop(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo, SCTP_FROM_SCTP_INPUT + SCTP_LOC_25);
2830	TAILQ_REMOVE(&asoc->control_send_queue,
2831	    chk,
2832	    sctp_next);
2833	if (chk->data) {
2834		sctp_m_freem(chk->data);
2835		chk->data = NULL;
2836	}
2837	asoc->ctrl_queue_cnt--;
2838	sctp_free_remote_addr(chk->whoTo);
2839
2840	sctp_free_a_chunk(stcb, chk);
2841	stcb->asoc.str_reset = NULL;
2842}
2843
2844
2845static int
2846sctp_handle_stream_reset_response(struct sctp_tcb *stcb,
2847    uint32_t seq, uint32_t action,
2848    struct sctp_stream_reset_response *respin)
2849{
2850	uint16_t type;
2851	int lparm_len;
2852	struct sctp_association *asoc = &stcb->asoc;
2853	struct sctp_tmit_chunk *chk;
2854	struct sctp_stream_reset_out_request *srparam;
2855	int number_entries;
2856
2857	if (asoc->stream_reset_outstanding == 0) {
2858		/* duplicate */
2859		return (0);
2860	}
2861	if (seq == stcb->asoc.str_reset_seq_out) {
2862		srparam = sctp_find_stream_reset(stcb, seq, &chk);
2863		if (srparam) {
2864			stcb->asoc.str_reset_seq_out++;
2865			type = ntohs(srparam->ph.param_type);
2866			lparm_len = ntohs(srparam->ph.param_length);
2867			if (type == SCTP_STR_RESET_OUT_REQUEST) {
2868				number_entries = (lparm_len - sizeof(struct sctp_stream_reset_out_request)) / sizeof(uint16_t);
2869				asoc->stream_reset_out_is_outstanding = 0;
2870				if (asoc->stream_reset_outstanding)
2871					asoc->stream_reset_outstanding--;
2872				if (action == SCTP_STREAM_RESET_PERFORMED) {
2873					/* do it */
2874					sctp_reset_out_streams(stcb, number_entries, srparam->list_of_streams);
2875				} else {
2876					sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_FAILED_OUT, stcb, number_entries, srparam->list_of_streams);
2877				}
2878			} else if (type == SCTP_STR_RESET_IN_REQUEST) {
2879				/* Answered my request */
2880				number_entries = (lparm_len - sizeof(struct sctp_stream_reset_in_request)) / sizeof(uint16_t);
2881				if (asoc->stream_reset_outstanding)
2882					asoc->stream_reset_outstanding--;
2883				if (action != SCTP_STREAM_RESET_PERFORMED) {
2884					sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_FAILED_IN, stcb, number_entries, srparam->list_of_streams);
2885				}
2886			} else if (type == SCTP_STR_RESET_TSN_REQUEST) {
2887				/**
2888				 * a) Adopt the new in tsn.
2889				 * b) reset the map
2890				 * c) Adopt the new out-tsn
2891				 */
2892				struct sctp_stream_reset_response_tsn *resp;
2893				struct sctp_forward_tsn_chunk fwdtsn;
2894				int abort_flag = 0;
2895
2896				if (respin == NULL) {
2897					/* huh ? */
2898					return (0);
2899				}
2900				if (action == SCTP_STREAM_RESET_PERFORMED) {
2901					resp = (struct sctp_stream_reset_response_tsn *)respin;
2902					asoc->stream_reset_outstanding--;
2903					fwdtsn.ch.chunk_length = htons(sizeof(struct sctp_forward_tsn_chunk));
2904					fwdtsn.ch.chunk_type = SCTP_FORWARD_CUM_TSN;
2905					fwdtsn.new_cumulative_tsn = htonl(ntohl(resp->senders_next_tsn) - 1);
2906					sctp_handle_forward_tsn(stcb, &fwdtsn, &abort_flag);
2907					if (abort_flag) {
2908						return (1);
2909					}
2910					stcb->asoc.highest_tsn_inside_map = (ntohl(resp->senders_next_tsn) - 1);
2911					stcb->asoc.cumulative_tsn = stcb->asoc.highest_tsn_inside_map;
2912					stcb->asoc.mapping_array_base_tsn = ntohl(resp->senders_next_tsn);
2913					memset(stcb->asoc.mapping_array, 0, stcb->asoc.mapping_array_size);
2914					stcb->asoc.sending_seq = ntohl(resp->receivers_next_tsn);
2915					stcb->asoc.last_acked_seq = stcb->asoc.cumulative_tsn;
2916
2917					sctp_reset_out_streams(stcb, 0, (uint16_t *) NULL);
2918					sctp_reset_in_stream(stcb, 0, (uint16_t *) NULL);
2919
2920				}
2921			}
2922			/* get rid of the request and get the request flags */
2923			if (asoc->stream_reset_outstanding == 0) {
2924				sctp_clean_up_stream_reset(stcb);
2925			}
2926		}
2927	}
2928	return (0);
2929}
2930
2931static void
2932sctp_handle_str_reset_request_in(struct sctp_tcb *stcb,
2933    struct sctp_tmit_chunk *chk,
2934    struct sctp_stream_reset_in_request *req)
2935{
2936	uint32_t seq;
2937	int len, i;
2938	int number_entries;
2939	uint16_t temp;
2940
2941	/*
2942	 * peer wants me to send a str-reset to him for my outgoing seq's if
2943	 * seq_in is right.
2944	 */
2945	struct sctp_association *asoc = &stcb->asoc;
2946
2947	seq = ntohl(req->request_seq);
2948	if (asoc->str_reset_seq_in == seq) {
2949		if (stcb->asoc.stream_reset_out_is_outstanding == 0) {
2950			len = ntohs(req->ph.param_length);
2951			number_entries = ((len - sizeof(struct sctp_stream_reset_in_request)) / sizeof(uint16_t));
2952			for (i = 0; i < number_entries; i++) {
2953				temp = ntohs(req->list_of_streams[i]);
2954				req->list_of_streams[i] = temp;
2955			}
2956			/* move the reset action back one */
2957			asoc->last_reset_action[1] = asoc->last_reset_action[0];
2958			asoc->last_reset_action[0] = SCTP_STREAM_RESET_PERFORMED;
2959			sctp_add_stream_reset_out(chk, number_entries, req->list_of_streams,
2960			    asoc->str_reset_seq_out,
2961			    seq, (asoc->sending_seq - 1));
2962			asoc->stream_reset_out_is_outstanding = 1;
2963			asoc->str_reset = chk;
2964			sctp_timer_start(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo);
2965			stcb->asoc.stream_reset_outstanding++;
2966		} else {
2967			/* Can't do it, since we have sent one out */
2968			asoc->last_reset_action[1] = asoc->last_reset_action[0];
2969			asoc->last_reset_action[0] = SCTP_STREAM_RESET_TRY_LATER;
2970			sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
2971		}
2972		asoc->str_reset_seq_in++;
2973	} else if (asoc->str_reset_seq_in - 1 == seq) {
2974		sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
2975	} else if (asoc->str_reset_seq_in - 2 == seq) {
2976		sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]);
2977	} else {
2978		sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_BAD_SEQNO);
2979	}
2980}
2981
2982static int
2983sctp_handle_str_reset_request_tsn(struct sctp_tcb *stcb,
2984    struct sctp_tmit_chunk *chk,
2985    struct sctp_stream_reset_tsn_request *req)
2986{
2987	/* reset all in and out and update the tsn */
2988	/*
2989	 * A) reset my str-seq's on in and out. B) Select a receive next,
2990	 * and set cum-ack to it. Also process this selected number as a
2991	 * fwd-tsn as well. C) set in the response my next sending seq.
2992	 */
2993	struct sctp_forward_tsn_chunk fwdtsn;
2994	struct sctp_association *asoc = &stcb->asoc;
2995	int abort_flag = 0;
2996	uint32_t seq;
2997
2998	seq = ntohl(req->request_seq);
2999	if (asoc->str_reset_seq_in == seq) {
3000		fwdtsn.ch.chunk_length = htons(sizeof(struct sctp_forward_tsn_chunk));
3001		fwdtsn.ch.chunk_type = SCTP_FORWARD_CUM_TSN;
3002		fwdtsn.ch.chunk_flags = 0;
3003		fwdtsn.new_cumulative_tsn = htonl(stcb->asoc.highest_tsn_inside_map + 1);
3004		sctp_handle_forward_tsn(stcb, &fwdtsn, &abort_flag);
3005		if (abort_flag) {
3006			return (1);
3007		}
3008		stcb->asoc.highest_tsn_inside_map += SCTP_STREAM_RESET_TSN_DELTA;
3009		stcb->asoc.cumulative_tsn = stcb->asoc.highest_tsn_inside_map;
3010		stcb->asoc.mapping_array_base_tsn = stcb->asoc.highest_tsn_inside_map + 1;
3011		memset(stcb->asoc.mapping_array, 0, stcb->asoc.mapping_array_size);
3012		atomic_add_int(&stcb->asoc.sending_seq, 1);
3013		/* save off historical data for retrans */
3014		stcb->asoc.last_sending_seq[1] = stcb->asoc.last_sending_seq[0];
3015		stcb->asoc.last_sending_seq[0] = stcb->asoc.sending_seq;
3016		stcb->asoc.last_base_tsnsent[1] = stcb->asoc.last_base_tsnsent[0];
3017		stcb->asoc.last_base_tsnsent[0] = stcb->asoc.mapping_array_base_tsn;
3018
3019		sctp_add_stream_reset_result_tsn(chk,
3020		    ntohl(req->request_seq),
3021		    SCTP_STREAM_RESET_PERFORMED,
3022		    stcb->asoc.sending_seq,
3023		    stcb->asoc.mapping_array_base_tsn);
3024		sctp_reset_out_streams(stcb, 0, (uint16_t *) NULL);
3025		sctp_reset_in_stream(stcb, 0, (uint16_t *) NULL);
3026		stcb->asoc.last_reset_action[1] = stcb->asoc.last_reset_action[0];
3027		stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_PERFORMED;
3028
3029		asoc->str_reset_seq_in++;
3030	} else if (asoc->str_reset_seq_in - 1 == seq) {
3031		sctp_add_stream_reset_result_tsn(chk, seq, asoc->last_reset_action[0],
3032		    stcb->asoc.last_sending_seq[0],
3033		    stcb->asoc.last_base_tsnsent[0]
3034		    );
3035	} else if (asoc->str_reset_seq_in - 2 == seq) {
3036		sctp_add_stream_reset_result_tsn(chk, seq, asoc->last_reset_action[1],
3037		    stcb->asoc.last_sending_seq[1],
3038		    stcb->asoc.last_base_tsnsent[1]
3039		    );
3040	} else {
3041		sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_BAD_SEQNO);
3042	}
3043	return (0);
3044}
3045
3046static void
3047sctp_handle_str_reset_request_out(struct sctp_tcb *stcb,
3048    struct sctp_tmit_chunk *chk,
3049    struct sctp_stream_reset_out_request *req)
3050{
3051	uint32_t seq, tsn;
3052	int number_entries, len;
3053	struct sctp_association *asoc = &stcb->asoc;
3054
3055	seq = ntohl(req->request_seq);
3056
3057	/* now if its not a duplicate we process it */
3058	if (asoc->str_reset_seq_in == seq) {
3059		len = ntohs(req->ph.param_length);
3060		number_entries = ((len - sizeof(struct sctp_stream_reset_out_request)) / sizeof(uint16_t));
3061		/*
3062		 * the sender is resetting, handle the list issue.. we must
3063		 * a) verify if we can do the reset, if so no problem b) If
3064		 * we can't do the reset we must copy the request. c) queue
3065		 * it, and setup the data in processor to trigger it off
3066		 * when needed and dequeue all the queued data.
3067		 */
3068		tsn = ntohl(req->send_reset_at_tsn);
3069
3070		/* move the reset action back one */
3071		asoc->last_reset_action[1] = asoc->last_reset_action[0];
3072		if ((tsn == asoc->cumulative_tsn) ||
3073		    (compare_with_wrap(asoc->cumulative_tsn, tsn, MAX_TSN))) {
3074			/* we can do it now */
3075			sctp_reset_in_stream(stcb, number_entries, req->list_of_streams);
3076			sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_PERFORMED);
3077			asoc->last_reset_action[0] = SCTP_STREAM_RESET_PERFORMED;
3078		} else {
3079			/*
3080			 * we must queue it up and thus wait for the TSN's
3081			 * to arrive that are at or before tsn
3082			 */
3083			struct sctp_stream_reset_list *liste;
3084			int siz;
3085
3086			siz = sizeof(struct sctp_stream_reset_list) + (number_entries * sizeof(uint16_t));
3087			SCTP_MALLOC(liste, struct sctp_stream_reset_list *,
3088			    siz, "StrRstList");
3089			if (liste == NULL) {
3090				/* gak out of memory */
3091				sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_DENIED);
3092				asoc->last_reset_action[0] = SCTP_STREAM_RESET_DENIED;
3093				return;
3094			}
3095			liste->tsn = tsn;
3096			liste->number_entries = number_entries;
3097			memcpy(&liste->req, req,
3098			    (sizeof(struct sctp_stream_reset_out_request) + (number_entries * sizeof(uint16_t))));
3099			TAILQ_INSERT_TAIL(&asoc->resetHead, liste, next_resp);
3100			sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_PERFORMED);
3101			asoc->last_reset_action[0] = SCTP_STREAM_RESET_PERFORMED;
3102		}
3103		asoc->str_reset_seq_in++;
3104	} else if ((asoc->str_reset_seq_in - 1) == seq) {
3105		/*
3106		 * one seq back, just echo back last action since my
3107		 * response was lost.
3108		 */
3109		sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
3110	} else if ((asoc->str_reset_seq_in - 2) == seq) {
3111		/*
3112		 * two seq back, just echo back last action since my
3113		 * response was lost.
3114		 */
3115		sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]);
3116	} else {
3117		sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_BAD_SEQNO);
3118	}
3119}
3120
3121static int
3122sctp_handle_stream_reset(struct sctp_tcb *stcb, struct sctp_stream_reset_out_req *sr_req)
3123{
3124	int chk_length, param_len, ptype;
3125	uint32_t seq;
3126	int num_req = 0;
3127	struct sctp_tmit_chunk *chk;
3128	struct sctp_chunkhdr *ch;
3129	struct sctp_paramhdr *ph;
3130	int ret_code = 0;
3131	int num_param = 0;
3132
3133	/* now it may be a reset or a reset-response */
3134	chk_length = ntohs(sr_req->ch.chunk_length);
3135
3136	/* setup for adding the response */
3137	sctp_alloc_a_chunk(stcb, chk);
3138	if (chk == NULL) {
3139		return (ret_code);
3140	}
3141	chk->rec.chunk_id.id = SCTP_STREAM_RESET;
3142	chk->asoc = &stcb->asoc;
3143	chk->no_fr_allowed = 0;
3144	chk->book_size = chk->send_size = sizeof(struct sctp_chunkhdr);
3145	chk->book_size_scale = 0;
3146	chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA);
3147	if (chk->data == NULL) {
3148strres_nochunk:
3149		if (chk->data) {
3150			sctp_m_freem(chk->data);
3151			chk->data = NULL;
3152		}
3153		sctp_free_a_chunk(stcb, chk);
3154		return (ret_code);
3155	}
3156	SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD);
3157
3158	/* setup chunk parameters */
3159	chk->sent = SCTP_DATAGRAM_UNSENT;
3160	chk->snd_count = 0;
3161	chk->whoTo = stcb->asoc.primary_destination;
3162	atomic_add_int(&chk->whoTo->ref_count, 1);
3163
3164	ch = mtod(chk->data, struct sctp_chunkhdr *);
3165	ch->chunk_type = SCTP_STREAM_RESET;
3166	ch->chunk_flags = 0;
3167	ch->chunk_length = htons(chk->send_size);
3168	SCTP_BUF_LEN(chk->data) = SCTP_SIZE32(chk->send_size);
3169
3170	ph = (struct sctp_paramhdr *)&sr_req->sr_req;
3171	while ((size_t)chk_length >= sizeof(struct sctp_stream_reset_tsn_request)) {
3172		param_len = ntohs(ph->param_length);
3173		if (param_len < (int)sizeof(struct sctp_stream_reset_tsn_request)) {
3174			/* bad param */
3175			break;
3176		}
3177		ptype = ntohs(ph->param_type);
3178		num_param++;
3179		if (num_param > SCTP_MAX_RESET_PARAMS) {
3180			/* hit the max of parameters already sorry.. */
3181			break;
3182		}
3183		if (ptype == SCTP_STR_RESET_OUT_REQUEST) {
3184			struct sctp_stream_reset_out_request *req_out;
3185
3186			req_out = (struct sctp_stream_reset_out_request *)ph;
3187			num_req++;
3188			if (stcb->asoc.stream_reset_outstanding) {
3189				seq = ntohl(req_out->response_seq);
3190				if (seq == stcb->asoc.str_reset_seq_out) {
3191					/* implicit ack */
3192					sctp_handle_stream_reset_response(stcb, seq, SCTP_STREAM_RESET_PERFORMED, NULL);
3193				}
3194			}
3195			sctp_handle_str_reset_request_out(stcb, chk, req_out);
3196		} else if (ptype == SCTP_STR_RESET_IN_REQUEST) {
3197			struct sctp_stream_reset_in_request *req_in;
3198
3199			num_req++;
3200			req_in = (struct sctp_stream_reset_in_request *)ph;
3201			sctp_handle_str_reset_request_in(stcb, chk, req_in);
3202		} else if (ptype == SCTP_STR_RESET_TSN_REQUEST) {
3203			struct sctp_stream_reset_tsn_request *req_tsn;
3204
3205			num_req++;
3206			req_tsn = (struct sctp_stream_reset_tsn_request *)ph;
3207			if (sctp_handle_str_reset_request_tsn(stcb, chk, req_tsn)) {
3208				ret_code = 1;
3209				goto strres_nochunk;
3210			}
3211			/* no more */
3212			break;
3213		} else if (ptype == SCTP_STR_RESET_RESPONSE) {
3214			struct sctp_stream_reset_response *resp;
3215			uint32_t result;
3216
3217			resp = (struct sctp_stream_reset_response *)ph;
3218			seq = ntohl(resp->response_seq);
3219			result = ntohl(resp->result);
3220			if (sctp_handle_stream_reset_response(stcb, seq, result, resp)) {
3221				ret_code = 1;
3222				goto strres_nochunk;
3223			}
3224		} else {
3225			break;
3226		}
3227
3228		ph = (struct sctp_paramhdr *)((caddr_t)ph + SCTP_SIZE32(param_len));
3229		chk_length -= SCTP_SIZE32(param_len);
3230	}
3231	if (num_req == 0) {
3232		/* we have no response free the stuff */
3233		goto strres_nochunk;
3234	}
3235	/* ok we have a chunk to link in */
3236	TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue,
3237	    chk,
3238	    sctp_next);
3239	stcb->asoc.ctrl_queue_cnt++;
3240	return (ret_code);
3241}
3242
3243/*
3244 * Handle a router or endpoints report of a packet loss, there are two ways
3245 * to handle this, either we get the whole packet and must disect it
3246 * ourselves (possibly with truncation and or corruption) or it is a summary
3247 * from a middle box that did the disectting for us.
3248 */
3249static void
3250sctp_handle_packet_dropped(struct sctp_pktdrop_chunk *cp,
3251    struct sctp_tcb *stcb, struct sctp_nets *net)
3252{
3253	uint32_t bottle_bw, on_queue;
3254	uint16_t trunc_len;
3255	unsigned int chlen;
3256	unsigned int at;
3257	struct sctp_chunk_desc desc;
3258	struct sctp_chunkhdr *ch;
3259
3260	chlen = ntohs(cp->ch.chunk_length);
3261	chlen -= sizeof(struct sctp_pktdrop_chunk);
3262	/* XXX possible chlen underflow */
3263	if (chlen == 0) {
3264		ch = NULL;
3265		if (cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX)
3266			SCTP_STAT_INCR(sctps_pdrpbwrpt);
3267	} else {
3268		ch = (struct sctp_chunkhdr *)(cp->data + sizeof(struct sctphdr));
3269		chlen -= sizeof(struct sctphdr);
3270		/* XXX possible chlen underflow */
3271		memset(&desc, 0, sizeof(desc));
3272	}
3273	trunc_len = (uint16_t) ntohs(cp->trunc_len);
3274	/* now the chunks themselves */
3275	while ((ch != NULL) && (chlen >= sizeof(struct sctp_chunkhdr))) {
3276		desc.chunk_type = ch->chunk_type;
3277		/* get amount we need to move */
3278		at = ntohs(ch->chunk_length);
3279		if (at < sizeof(struct sctp_chunkhdr)) {
3280			/* corrupt chunk, maybe at the end? */
3281			SCTP_STAT_INCR(sctps_pdrpcrupt);
3282			break;
3283		}
3284		if (trunc_len == 0) {
3285			/* we are supposed to have all of it */
3286			if (at > chlen) {
3287				/* corrupt skip it */
3288				SCTP_STAT_INCR(sctps_pdrpcrupt);
3289				break;
3290			}
3291		} else {
3292			/* is there enough of it left ? */
3293			if (desc.chunk_type == SCTP_DATA) {
3294				if (chlen < (sizeof(struct sctp_data_chunk) +
3295				    sizeof(desc.data_bytes))) {
3296					break;
3297				}
3298			} else {
3299				if (chlen < sizeof(struct sctp_chunkhdr)) {
3300					break;
3301				}
3302			}
3303		}
3304		if (desc.chunk_type == SCTP_DATA) {
3305			/* can we get out the tsn? */
3306			if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX))
3307				SCTP_STAT_INCR(sctps_pdrpmbda);
3308
3309			if (chlen >= (sizeof(struct sctp_data_chunk) + sizeof(uint32_t))) {
3310				/* yep */
3311				struct sctp_data_chunk *dcp;
3312				uint8_t *ddp;
3313				unsigned int iii;
3314
3315				dcp = (struct sctp_data_chunk *)ch;
3316				ddp = (uint8_t *) (dcp + 1);
3317				for (iii = 0; iii < sizeof(desc.data_bytes); iii++) {
3318					desc.data_bytes[iii] = ddp[iii];
3319				}
3320				desc.tsn_ifany = dcp->dp.tsn;
3321			} else {
3322				/* nope we are done. */
3323				SCTP_STAT_INCR(sctps_pdrpnedat);
3324				break;
3325			}
3326		} else {
3327			if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX))
3328				SCTP_STAT_INCR(sctps_pdrpmbct);
3329		}
3330
3331		if (process_chunk_drop(stcb, &desc, net, cp->ch.chunk_flags)) {
3332			SCTP_STAT_INCR(sctps_pdrppdbrk);
3333			break;
3334		}
3335		if (SCTP_SIZE32(at) > chlen) {
3336			break;
3337		}
3338		chlen -= SCTP_SIZE32(at);
3339		if (chlen < sizeof(struct sctp_chunkhdr)) {
3340			/* done, none left */
3341			break;
3342		}
3343		ch = (struct sctp_chunkhdr *)((caddr_t)ch + SCTP_SIZE32(at));
3344	}
3345	/* Now update any rwnd --- possibly */
3346	if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX) == 0) {
3347		/* From a peer, we get a rwnd report */
3348		uint32_t a_rwnd;
3349
3350		SCTP_STAT_INCR(sctps_pdrpfehos);
3351
3352		bottle_bw = ntohl(cp->bottle_bw);
3353		on_queue = ntohl(cp->current_onq);
3354		if (bottle_bw && on_queue) {
3355			/* a rwnd report is in here */
3356			if (bottle_bw > on_queue)
3357				a_rwnd = bottle_bw - on_queue;
3358			else
3359				a_rwnd = 0;
3360
3361			if (a_rwnd == 0)
3362				stcb->asoc.peers_rwnd = 0;
3363			else {
3364				if (a_rwnd > stcb->asoc.total_flight) {
3365					stcb->asoc.peers_rwnd =
3366					    a_rwnd - stcb->asoc.total_flight;
3367				} else {
3368					stcb->asoc.peers_rwnd = 0;
3369				}
3370				if (stcb->asoc.peers_rwnd <
3371				    stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
3372					/* SWS sender side engages */
3373					stcb->asoc.peers_rwnd = 0;
3374				}
3375			}
3376		}
3377	} else {
3378		SCTP_STAT_INCR(sctps_pdrpfmbox);
3379	}
3380
3381	/* now middle boxes in sat networks get a cwnd bump */
3382	if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX) &&
3383	    (stcb->asoc.sat_t3_loss_recovery == 0) &&
3384	    (stcb->asoc.sat_network)) {
3385		/*
3386		 * This is debateable but for sat networks it makes sense
3387		 * Note if a T3 timer has went off, we will prohibit any
3388		 * changes to cwnd until we exit the t3 loss recovery.
3389		 */
3390		uint32_t bw_avail;
3391		int rtt, incr;
3392
3393#ifdef SCTP_CWND_MONITOR
3394		int old_cwnd = net->cwnd;
3395
3396#endif
3397		/* need real RTT for this calc */
3398		rtt = ((net->lastsa >> 2) + net->lastsv) >> 1;
3399		/* get bottle neck bw */
3400		bottle_bw = ntohl(cp->bottle_bw);
3401		/* and whats on queue */
3402		on_queue = ntohl(cp->current_onq);
3403		/*
3404		 * adjust the on-queue if our flight is more it could be
3405		 * that the router has not yet gotten data "in-flight" to it
3406		 */
3407		if (on_queue < net->flight_size)
3408			on_queue = net->flight_size;
3409
3410		/* calculate the available space */
3411		bw_avail = (bottle_bw * rtt) / 1000;
3412		if (bw_avail > bottle_bw) {
3413			/*
3414			 * Cap the growth to no more than the bottle neck.
3415			 * This can happen as RTT slides up due to queues.
3416			 * It also means if you have more than a 1 second
3417			 * RTT with a empty queue you will be limited to the
3418			 * bottle_bw per second no matter if other points
3419			 * have 1/2 the RTT and you could get more out...
3420			 */
3421			bw_avail = bottle_bw;
3422		}
3423		if (on_queue > bw_avail) {
3424			/*
3425			 * No room for anything else don't allow anything
3426			 * else to be "added to the fire".
3427			 */
3428			int seg_inflight, seg_onqueue, my_portion;
3429
3430			net->partial_bytes_acked = 0;
3431
3432			/* how much are we over queue size? */
3433			incr = on_queue - bw_avail;
3434			if (stcb->asoc.seen_a_sack_this_pkt) {
3435				/*
3436				 * undo any cwnd adjustment that the sack
3437				 * might have made
3438				 */
3439				net->cwnd = net->prev_cwnd;
3440			}
3441			/* Now how much of that is mine? */
3442			seg_inflight = net->flight_size / net->mtu;
3443			seg_onqueue = on_queue / net->mtu;
3444			my_portion = (incr * seg_inflight) / seg_onqueue;
3445
3446			/* Have I made an adjustment already */
3447			if (net->cwnd > net->flight_size) {
3448				/*
3449				 * for this flight I made an adjustment we
3450				 * need to decrease the portion by a share
3451				 * our previous adjustment.
3452				 */
3453				int diff_adj;
3454
3455				diff_adj = net->cwnd - net->flight_size;
3456				if (diff_adj > my_portion)
3457					my_portion = 0;
3458				else
3459					my_portion -= diff_adj;
3460			}
3461			/*
3462			 * back down to the previous cwnd (assume we have
3463			 * had a sack before this packet). minus what ever
3464			 * portion of the overage is my fault.
3465			 */
3466			net->cwnd -= my_portion;
3467
3468			/* we will NOT back down more than 1 MTU */
3469			if (net->cwnd <= net->mtu) {
3470				net->cwnd = net->mtu;
3471			}
3472			/* force into CA */
3473			net->ssthresh = net->cwnd - 1;
3474		} else {
3475			/*
3476			 * Take 1/4 of the space left or max burst up ..
3477			 * whichever is less.
3478			 */
3479			incr = min((bw_avail - on_queue) >> 2,
3480			    (int)stcb->asoc.max_burst * (int)net->mtu);
3481			net->cwnd += incr;
3482		}
3483		if (net->cwnd > bw_avail) {
3484			/* We can't exceed the pipe size */
3485			net->cwnd = bw_avail;
3486		}
3487		if (net->cwnd < net->mtu) {
3488			/* We always have 1 MTU */
3489			net->cwnd = net->mtu;
3490		}
3491#ifdef SCTP_CWND_MONITOR
3492		if (net->cwnd - old_cwnd != 0) {
3493			/* log only changes */
3494			sctp_log_cwnd(stcb, net, (net->cwnd - old_cwnd),
3495			    SCTP_CWND_LOG_FROM_SAT);
3496		}
3497#endif
3498	}
3499}
3500
3501extern int sctp_strict_init;
3502extern int sctp_abort_if_one_2_one_hits_limit;
3503
3504/*
3505 * handles all control chunks in a packet inputs: - m: mbuf chain, assumed to
3506 * still contain IP/SCTP header - stcb: is the tcb found for this packet -
3507 * offset: offset into the mbuf chain to first chunkhdr - length: is the
3508 * length of the complete packet outputs: - length: modified to remaining
3509 * length after control processing - netp: modified to new sctp_nets after
3510 * cookie-echo processing - return NULL to discard the packet (ie. no asoc,
3511 * bad packet,...) otherwise return the tcb for this packet
3512 */
3513static struct sctp_tcb *
3514sctp_process_control(struct mbuf *m, int iphlen, int *offset, int length,
3515    struct sctphdr *sh, struct sctp_chunkhdr *ch, struct sctp_inpcb *inp,
3516    struct sctp_tcb *stcb, struct sctp_nets **netp, int *fwd_tsn_seen)
3517{
3518	struct sctp_association *asoc;
3519	uint32_t vtag_in;
3520	int num_chunks = 0;	/* number of control chunks processed */
3521	int chk_length;
3522	int ret;
3523
3524	/*
3525	 * How big should this be, and should it be alloc'd? Lets try the
3526	 * d-mtu-ceiling for now (2k) and that should hopefully work ...
3527	 * until we get into jumbo grams and such..
3528	 */
3529	uint8_t chunk_buf[SCTP_CHUNK_BUFFER_SIZE];
3530	struct sctp_tcb *locked_tcb = stcb;
3531	int got_auth = 0;
3532	uint32_t auth_offset = 0, auth_len = 0;
3533	int auth_skipped = 0;
3534
3535#ifdef SCTP_DEBUG
3536	if (sctp_debug_on & SCTP_DEBUG_INPUT1) {
3537		printf("sctp_process_control: iphlen=%u, offset=%u, length=%u stcb:%p\n",
3538		    iphlen, *offset, length, stcb);
3539	}
3540#endif				/* SCTP_DEBUG */
3541
3542	/* validate chunk header length... */
3543	if (ntohs(ch->chunk_length) < sizeof(*ch)) {
3544		return (NULL);
3545	}
3546	/*
3547	 * validate the verification tag
3548	 */
3549	vtag_in = ntohl(sh->v_tag);
3550
3551	if (locked_tcb) {
3552		SCTP_TCB_LOCK_ASSERT(locked_tcb);
3553	}
3554	if (ch->chunk_type == SCTP_INITIATION) {
3555		if (vtag_in != 0) {
3556			/* protocol error- silently discard... */
3557			SCTP_STAT_INCR(sctps_badvtag);
3558			if (locked_tcb)
3559				SCTP_TCB_UNLOCK(locked_tcb);
3560			return (NULL);
3561		}
3562	} else if (ch->chunk_type != SCTP_COOKIE_ECHO) {
3563		/*
3564		 * If there is no stcb, skip the AUTH chunk and process
3565		 * later after a stcb is found (to validate the lookup was
3566		 * valid.
3567		 */
3568		if ((ch->chunk_type == SCTP_AUTHENTICATION) &&
3569		    (stcb == NULL) && !sctp_auth_disable) {
3570			/* save this chunk for later processing */
3571			auth_skipped = 1;
3572			auth_offset = *offset;
3573			auth_len = ntohs(ch->chunk_length);
3574
3575			/* (temporarily) move past this chunk */
3576			*offset += SCTP_SIZE32(auth_len);
3577			if (*offset >= length) {
3578				/* no more data left in the mbuf chain */
3579				*offset = length;
3580				return (NULL);
3581			}
3582			ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
3583			    sizeof(struct sctp_chunkhdr), chunk_buf);
3584		}
3585		if (ch->chunk_type == SCTP_COOKIE_ECHO) {
3586			goto process_control_chunks;
3587		}
3588		/*
3589		 * first check if it's an ASCONF with an unknown src addr we
3590		 * need to look inside to find the association
3591		 */
3592		if (ch->chunk_type == SCTP_ASCONF && stcb == NULL) {
3593			/* inp's refcount may be reduced */
3594			SCTP_INP_INCR_REF(inp);
3595
3596			stcb = sctp_findassociation_ep_asconf(m, iphlen,
3597			    *offset, sh, &inp, netp);
3598			if (stcb == NULL) {
3599				/*
3600				 * reduce inp's refcount if not reduced in
3601				 * sctp_findassociation_ep_asconf().
3602				 */
3603				SCTP_INP_DECR_REF(inp);
3604			}
3605			/* now go back and verify any auth chunk to be sure */
3606			if (auth_skipped && (stcb != NULL)) {
3607				struct sctp_auth_chunk *auth;
3608
3609				auth = (struct sctp_auth_chunk *)
3610				    sctp_m_getptr(m, auth_offset,
3611				    auth_len, chunk_buf);
3612				got_auth = 1;
3613				auth_skipped = 0;
3614				if (sctp_handle_auth(stcb, auth, m,
3615				    auth_offset)) {
3616					/* auth HMAC failed so dump it */
3617					*offset = length;
3618					return (NULL);
3619				} else {
3620					/* remaining chunks are HMAC checked */
3621					stcb->asoc.authenticated = 1;
3622				}
3623			}
3624		}
3625		if (stcb == NULL) {
3626			/* no association, so it's out of the blue... */
3627			sctp_handle_ootb(m, iphlen, *offset, sh, inp, NULL);
3628			*offset = length;
3629			if (locked_tcb)
3630				SCTP_TCB_UNLOCK(locked_tcb);
3631			return (NULL);
3632		}
3633		asoc = &stcb->asoc;
3634		/* ABORT and SHUTDOWN can use either v_tag... */
3635		if ((ch->chunk_type == SCTP_ABORT_ASSOCIATION) ||
3636		    (ch->chunk_type == SCTP_SHUTDOWN_COMPLETE) ||
3637		    (ch->chunk_type == SCTP_PACKET_DROPPED)) {
3638			if ((vtag_in == asoc->my_vtag) ||
3639			    ((ch->chunk_flags & SCTP_HAD_NO_TCB) &&
3640			    (vtag_in == asoc->peer_vtag))) {
3641				/* this is valid */
3642			} else {
3643				/* drop this packet... */
3644				SCTP_STAT_INCR(sctps_badvtag);
3645				if (locked_tcb)
3646					SCTP_TCB_UNLOCK(locked_tcb);
3647				return (NULL);
3648			}
3649		} else if (ch->chunk_type == SCTP_SHUTDOWN_ACK) {
3650			if (vtag_in != asoc->my_vtag) {
3651				/*
3652				 * this could be a stale SHUTDOWN-ACK or the
3653				 * peer never got the SHUTDOWN-COMPLETE and
3654				 * is still hung; we have started a new asoc
3655				 * but it won't complete until the shutdown
3656				 * is completed
3657				 */
3658				if (locked_tcb)
3659					SCTP_TCB_UNLOCK(locked_tcb);
3660				sctp_handle_ootb(m, iphlen, *offset, sh, inp,
3661				    NULL);
3662				return (NULL);
3663			}
3664		} else {
3665			/* for all other chunks, vtag must match */
3666			if (vtag_in != asoc->my_vtag) {
3667				/* invalid vtag... */
3668#ifdef SCTP_DEBUG
3669				if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
3670					printf("invalid vtag: %xh, expect %xh\n", vtag_in, asoc->my_vtag);
3671				}
3672#endif				/* SCTP_DEBUG */
3673				SCTP_STAT_INCR(sctps_badvtag);
3674				if (locked_tcb)
3675					SCTP_TCB_UNLOCK(locked_tcb);
3676				*offset = length;
3677				return (NULL);
3678			}
3679		}
3680	}			/* end if !SCTP_COOKIE_ECHO */
3681	/*
3682	 * process all control chunks...
3683	 */
3684	if (((ch->chunk_type == SCTP_SELECTIVE_ACK) ||
3685	    (ch->chunk_type == SCTP_HEARTBEAT_REQUEST)) &&
3686	    (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_ECHOED)) {
3687		/* implied cookie-ack.. we must have lost the ack */
3688		stcb->asoc.overall_error_count = 0;
3689		sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb,
3690		    *netp);
3691	}
3692process_control_chunks:
3693
3694	while (IS_SCTP_CONTROL(ch)) {
3695		/* validate chunk length */
3696		chk_length = ntohs(ch->chunk_length);
3697#ifdef SCTP_DEBUG
3698		if (sctp_debug_on & SCTP_DEBUG_INPUT2) {
3699			printf("sctp_process_control: processing a chunk type=%u, len=%u\n",
3700			    ch->chunk_type, chk_length);
3701		}
3702#endif				/* SCTP_DEBUG */
3703		if ((size_t)chk_length < sizeof(*ch) ||
3704		    (*offset + chk_length) > length) {
3705			*offset = length;
3706			if (locked_tcb)
3707				SCTP_TCB_UNLOCK(locked_tcb);
3708			return (NULL);
3709		}
3710		SCTP_STAT_INCR_COUNTER64(sctps_incontrolchunks);
3711		/*
3712		 * INIT-ACK only gets the init ack "header" portion only
3713		 * because we don't have to process the peer's COOKIE. All
3714		 * others get a complete chunk.
3715		 */
3716		if (ch->chunk_type == SCTP_INITIATION_ACK) {
3717			/* get an init-ack chunk */
3718			ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
3719			    sizeof(struct sctp_init_ack_chunk), chunk_buf);
3720			if (ch == NULL) {
3721				*offset = length;
3722				if (locked_tcb)
3723					SCTP_TCB_UNLOCK(locked_tcb);
3724				return (NULL);
3725			}
3726		} else {
3727			/* get a complete chunk... */
3728			if ((size_t)chk_length > sizeof(chunk_buf)) {
3729				struct mbuf *oper;
3730				struct sctp_paramhdr *phdr;
3731
3732				oper = NULL;
3733				oper = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr),
3734				    0, M_DONTWAIT, 1, MT_DATA);
3735				if (oper) {
3736					/* pre-reserve some space */
3737					SCTP_BUF_RESV_UF(oper, sizeof(struct sctp_chunkhdr));
3738					SCTP_BUF_LEN(oper) = sizeof(struct sctp_paramhdr);
3739					phdr = mtod(oper, struct sctp_paramhdr *);
3740					phdr->param_type = htons(SCTP_CAUSE_OUT_OF_RESC);
3741					phdr->param_length = htons(sizeof(struct sctp_paramhdr));
3742					sctp_queue_op_err(stcb, oper);
3743				}
3744				if (locked_tcb)
3745					SCTP_TCB_UNLOCK(locked_tcb);
3746				return (NULL);
3747			}
3748			ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
3749			    chk_length, chunk_buf);
3750			if (ch == NULL) {
3751				printf("sctp_process_control: Can't get the all data....\n");
3752				*offset = length;
3753				if (locked_tcb)
3754					SCTP_TCB_UNLOCK(locked_tcb);
3755				return (NULL);
3756			}
3757		}
3758		num_chunks++;
3759		/* Save off the last place we got a control from */
3760		if (stcb != NULL) {
3761			if ((*netp != NULL) || (ch->chunk_type == SCTP_ASCONF)) {
3762				/*
3763				 * allow last_control to be NULL if
3764				 * ASCONF... ASCONF processing will find the
3765				 * right net later
3766				 */
3767				stcb->asoc.last_control_chunk_from = *netp;
3768			}
3769		}
3770#ifdef SCTP_AUDITING_ENABLED
3771		sctp_audit_log(0xB0, ch->chunk_type);
3772#endif
3773
3774		/* check to see if this chunk required auth, but isn't */
3775		if ((stcb != NULL) && !sctp_auth_disable &&
3776		    sctp_auth_is_required_chunk(ch->chunk_type,
3777		    stcb->asoc.local_auth_chunks) &&
3778		    !stcb->asoc.authenticated) {
3779			/* "silently" ignore */
3780			SCTP_STAT_INCR(sctps_recvauthmissing);
3781			goto next_chunk;
3782		}
3783		switch (ch->chunk_type) {
3784		case SCTP_INITIATION:
3785			/* must be first and only chunk */
3786#ifdef SCTP_DEBUG
3787			if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
3788				printf("SCTP_INIT\n");
3789			}
3790#endif				/* SCTP_DEBUG */
3791			if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
3792				/* We are not interested anymore? */
3793				if ((stcb) && (stcb->asoc.total_output_queue_size)) {
3794					/*
3795					 * collision case where we are
3796					 * sending to them too
3797					 */
3798					;
3799				} else {
3800					if (locked_tcb)
3801						SCTP_TCB_UNLOCK(locked_tcb);
3802					*offset = length;
3803					return (NULL);
3804				}
3805			}
3806			if ((num_chunks > 1) ||
3807			    (sctp_strict_init && (length - *offset > SCTP_SIZE32(chk_length)))) {
3808				*offset = length;
3809				if (locked_tcb)
3810					SCTP_TCB_UNLOCK(locked_tcb);
3811				return (NULL);
3812			}
3813			if ((stcb != NULL) &&
3814			    (SCTP_GET_STATE(&stcb->asoc) ==
3815			    SCTP_STATE_SHUTDOWN_ACK_SENT)) {
3816				sctp_send_shutdown_ack(stcb,
3817				    stcb->asoc.primary_destination);
3818				*offset = length;
3819				sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC);
3820				if (locked_tcb)
3821					SCTP_TCB_UNLOCK(locked_tcb);
3822				return (NULL);
3823			}
3824			sctp_handle_init(m, iphlen, *offset, sh,
3825			    (struct sctp_init_chunk *)ch, inp, stcb, *netp);
3826			*offset = length;
3827			if (locked_tcb)
3828				SCTP_TCB_UNLOCK(locked_tcb);
3829			return (NULL);
3830			break;
3831		case SCTP_INITIATION_ACK:
3832			/* must be first and only chunk */
3833#ifdef SCTP_DEBUG
3834			if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
3835				printf("SCTP_INIT-ACK\n");
3836			}
3837#endif				/* SCTP_DEBUG */
3838			if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
3839				/* We are not interested anymore */
3840				if ((stcb) && (stcb->asoc.total_output_queue_size)) {
3841					;
3842				} else {
3843					if (locked_tcb)
3844						SCTP_TCB_UNLOCK(locked_tcb);
3845					*offset = length;
3846					if (stcb) {
3847						sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_26);
3848					}
3849					return (NULL);
3850				}
3851			}
3852			if ((num_chunks > 1) ||
3853			    (sctp_strict_init && (length - *offset > SCTP_SIZE32(chk_length)))) {
3854				*offset = length;
3855				if (locked_tcb)
3856					SCTP_TCB_UNLOCK(locked_tcb);
3857				return (NULL);
3858			}
3859			ret = sctp_handle_init_ack(m, iphlen, *offset, sh,
3860			    (struct sctp_init_ack_chunk *)ch, stcb, *netp);
3861			/*
3862			 * Special case, I must call the output routine to
3863			 * get the cookie echoed
3864			 */
3865			if ((stcb) && ret == 0)
3866				sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC);
3867			*offset = length;
3868			if (locked_tcb)
3869				SCTP_TCB_UNLOCK(locked_tcb);
3870			return (NULL);
3871			break;
3872		case SCTP_SELECTIVE_ACK:
3873#ifdef SCTP_DEBUG
3874			if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
3875				printf("SCTP_SACK\n");
3876			}
3877#endif				/* SCTP_DEBUG */
3878			SCTP_STAT_INCR(sctps_recvsacks);
3879			{
3880				struct sctp_sack_chunk *sack;
3881				int abort_now = 0;
3882				uint32_t a_rwnd, cum_ack;
3883				uint16_t num_seg;
3884				int nonce_sum_flag;
3885
3886				sack = (struct sctp_sack_chunk *)ch;
3887
3888				nonce_sum_flag = ch->chunk_flags & SCTP_SACK_NONCE_SUM;
3889				cum_ack = ntohl(sack->sack.cum_tsn_ack);
3890				num_seg = ntohs(sack->sack.num_gap_ack_blks);
3891				a_rwnd = (uint32_t) ntohl(sack->sack.a_rwnd);
3892				stcb->asoc.seen_a_sack_this_pkt = 1;
3893				if ((stcb->asoc.pr_sctp_cnt == 0) &&
3894				    (num_seg == 0) &&
3895				    ((compare_with_wrap(cum_ack, stcb->asoc.last_acked_seq, MAX_TSN)) ||
3896				    (cum_ack == stcb->asoc.last_acked_seq)) &&
3897				    (stcb->asoc.saw_sack_with_frags == 0) &&
3898				    (!TAILQ_EMPTY(&stcb->asoc.sent_queue))
3899				    ) {
3900					/*
3901					 * We have a SIMPLE sack having no
3902					 * prior segments and data on sent
3903					 * queue to be acked.. Use the
3904					 * faster path sack processing. We
3905					 * also allow window update sacks
3906					 * with no missing segments to go
3907					 * this way too.
3908					 */
3909					sctp_express_handle_sack(stcb, cum_ack, a_rwnd, nonce_sum_flag, &abort_now);
3910				} else {
3911					sctp_handle_sack(sack, stcb, *netp, &abort_now);
3912				}
3913				if (abort_now) {
3914					/* ABORT signal from sack processing */
3915					*offset = length;
3916					return (NULL);
3917				}
3918			}
3919			break;
3920		case SCTP_HEARTBEAT_REQUEST:
3921#ifdef SCTP_DEBUG
3922			if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
3923				printf("SCTP_HEARTBEAT\n");
3924			}
3925#endif				/* SCTP_DEBUG */
3926			SCTP_STAT_INCR(sctps_recvheartbeat);
3927			sctp_send_heartbeat_ack(stcb, m, *offset, chk_length,
3928			    *netp);
3929
3930			/* He's alive so give him credit */
3931			stcb->asoc.overall_error_count = 0;
3932			break;
3933		case SCTP_HEARTBEAT_ACK:
3934#ifdef SCTP_DEBUG
3935			if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
3936				printf("SCTP_HEARTBEAT-ACK\n");
3937			}
3938#endif				/* SCTP_DEBUG */
3939
3940			/* He's alive so give him credit */
3941			stcb->asoc.overall_error_count = 0;
3942			SCTP_STAT_INCR(sctps_recvheartbeatack);
3943			sctp_handle_heartbeat_ack((struct sctp_heartbeat_chunk *)ch,
3944			    stcb, *netp);
3945			break;
3946		case SCTP_ABORT_ASSOCIATION:
3947#ifdef SCTP_DEBUG
3948			if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
3949				printf("SCTP_ABORT\n");
3950			}
3951#endif				/* SCTP_DEBUG */
3952			sctp_handle_abort((struct sctp_abort_chunk *)ch,
3953			    stcb, *netp);
3954			*offset = length;
3955			return (NULL);
3956			break;
3957		case SCTP_SHUTDOWN:
3958#ifdef SCTP_DEBUG
3959			if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
3960				printf("SCTP_SHUTDOWN\n");
3961			}
3962#endif				/* SCTP_DEBUG */
3963			{
3964				int abort_flag = 0;
3965
3966				sctp_handle_shutdown((struct sctp_shutdown_chunk *)ch,
3967				    stcb, *netp, &abort_flag);
3968				if (abort_flag) {
3969					*offset = length;
3970					return (NULL);
3971				}
3972			}
3973			break;
3974		case SCTP_SHUTDOWN_ACK:
3975#ifdef SCTP_DEBUG
3976			if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
3977				printf("SCTP_SHUTDOWN-ACK\n");
3978			}
3979#endif				/* SCTP_DEBUG */
3980			sctp_handle_shutdown_ack((struct sctp_shutdown_ack_chunk *)ch, stcb, *netp);
3981			*offset = length;
3982			return (NULL);
3983			break;
3984		case SCTP_OPERATION_ERROR:
3985#ifdef SCTP_DEBUG
3986			if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
3987				printf("SCTP_OP-ERR\n");
3988			}
3989#endif				/* SCTP_DEBUG */
3990			if (sctp_handle_error(ch, stcb, *netp) < 0) {
3991				*offset = length;
3992				return (NULL);
3993			}
3994			break;
3995		case SCTP_COOKIE_ECHO:
3996#ifdef SCTP_DEBUG
3997			if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
3998				printf("SCTP_COOKIE-ECHO stcb is %p\n", stcb);
3999			}
4000#endif				/* SCTP_DEBUG */
4001			if ((stcb) && (stcb->asoc.total_output_queue_size)) {
4002				;
4003			} else {
4004				if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) &&
4005				    (stcb == NULL)) {
4006					/* We are not interested anymore */
4007					*offset = length;
4008					return (NULL);
4009				}
4010			}
4011			/*
4012			 * First are we accepting? We do this again here
4013			 * since it is possible that a previous endpoint WAS
4014			 * listening responded to a INIT-ACK and then
4015			 * closed. We opened and bound.. and are now no
4016			 * longer listening.
4017			 */
4018			if (inp->sctp_socket->so_qlimit == 0) {
4019				if ((stcb) && (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
4020					/*
4021					 * special case, is this a retran'd
4022					 * COOKIE-ECHO or a restarting assoc
4023					 * that is a peeled off or
4024					 * one-to-one style socket.
4025					 */
4026					goto process_cookie_anyway;
4027				}
4028				sctp_abort_association(inp, stcb, m, iphlen, sh,
4029				    NULL);
4030				*offset = length;
4031				return (NULL);
4032			} else if (inp->sctp_socket->so_qlimit) {
4033				/* we are accepting so check limits like TCP */
4034				if (inp->sctp_socket->so_qlen >
4035				    inp->sctp_socket->so_qlimit) {
4036					/* no space */
4037					struct mbuf *oper;
4038					struct sctp_paramhdr *phdr;
4039
4040					if (sctp_abort_if_one_2_one_hits_limit) {
4041						oper = NULL;
4042						oper = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr),
4043						    0, M_DONTWAIT, 1, MT_DATA);
4044						if (oper) {
4045							SCTP_BUF_LEN(oper) =
4046							    sizeof(struct sctp_paramhdr);
4047							phdr = mtod(oper,
4048							    struct sctp_paramhdr *);
4049							phdr->param_type =
4050							    htons(SCTP_CAUSE_OUT_OF_RESC);
4051							phdr->param_length =
4052							    htons(sizeof(struct sctp_paramhdr));
4053						}
4054						sctp_abort_association(inp, stcb, m,
4055						    iphlen, sh, oper);
4056					}
4057					*offset = length;
4058					return (NULL);
4059				}
4060			}
4061	process_cookie_anyway:
4062			{
4063				struct mbuf *ret_buf;
4064				struct sctp_inpcb *linp;
4065
4066				if (stcb)
4067					linp = NULL;
4068				else
4069					linp = inp;
4070
4071				if (linp)
4072					SCTP_ASOC_CREATE_LOCK(linp);
4073				ret_buf =
4074				    sctp_handle_cookie_echo(m, iphlen,
4075				    *offset, sh,
4076				    (struct sctp_cookie_echo_chunk *)ch,
4077				    &inp, &stcb, netp,
4078				    auth_skipped,
4079				    auth_offset,
4080				    auth_len,
4081				    &locked_tcb);
4082				if (linp)
4083					SCTP_ASOC_CREATE_UNLOCK(linp);
4084				if (ret_buf == NULL) {
4085					if (locked_tcb) {
4086						SCTP_TCB_UNLOCK(locked_tcb);
4087					}
4088#ifdef SCTP_DEBUG
4089					if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
4090						printf("GAK, null buffer\n");
4091					}
4092#endif				/* SCTP_DEBUG */
4093					auth_skipped = 0;
4094					*offset = length;
4095					return (NULL);
4096				}
4097				/* if AUTH skipped, see if it verified... */
4098				if (auth_skipped) {
4099					got_auth = 1;
4100					auth_skipped = 0;
4101				}
4102				if (!TAILQ_EMPTY(&stcb->asoc.sent_queue)) {
4103					/*
4104					 * Restart the timer if we have
4105					 * pending data
4106					 */
4107					struct sctp_tmit_chunk *chk;
4108
4109					chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
4110					if (chk) {
4111						sctp_timer_start(SCTP_TIMER_TYPE_SEND,
4112						    stcb->sctp_ep, stcb,
4113						    chk->whoTo);
4114					}
4115				}
4116			}
4117			break;
4118		case SCTP_COOKIE_ACK:
4119#ifdef SCTP_DEBUG
4120			if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
4121				printf("SCTP_COOKIE-ACK\n");
4122			}
4123#endif				/* SCTP_DEBUG */
4124
4125			if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4126				/* We are not interested anymore */
4127				if ((stcb) && (stcb->asoc.total_output_queue_size)) {
4128					;
4129				} else {
4130					sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_27);
4131					*offset = length;
4132					return (NULL);
4133				}
4134			}
4135			/* He's alive so give him credit */
4136			stcb->asoc.overall_error_count = 0;
4137			sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb, *netp);
4138			break;
4139		case SCTP_ECN_ECHO:
4140#ifdef SCTP_DEBUG
4141			if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
4142				printf("SCTP_ECN-ECHO\n");
4143			}
4144#endif				/* SCTP_DEBUG */
4145			/* He's alive so give him credit */
4146			stcb->asoc.overall_error_count = 0;
4147			sctp_handle_ecn_echo((struct sctp_ecne_chunk *)ch,
4148			    stcb);
4149			break;
4150		case SCTP_ECN_CWR:
4151#ifdef SCTP_DEBUG
4152			if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
4153				printf("SCTP_ECN-CWR\n");
4154			}
4155#endif				/* SCTP_DEBUG */
4156			/* He's alive so give him credit */
4157			stcb->asoc.overall_error_count = 0;
4158
4159			sctp_handle_ecn_cwr((struct sctp_cwr_chunk *)ch, stcb);
4160			break;
4161		case SCTP_SHUTDOWN_COMPLETE:
4162#ifdef SCTP_DEBUG
4163			if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
4164				printf("SCTP_SHUTDOWN-COMPLETE\n");
4165			}
4166#endif				/* SCTP_DEBUG */
4167			/* must be first and only chunk */
4168			if ((num_chunks > 1) ||
4169			    (length - *offset > SCTP_SIZE32(chk_length))) {
4170				*offset = length;
4171				if (locked_tcb)
4172					SCTP_TCB_UNLOCK(locked_tcb);
4173
4174				return (NULL);
4175			}
4176			sctp_handle_shutdown_complete((struct sctp_shutdown_complete_chunk *)ch,
4177			    stcb, *netp);
4178			*offset = length;
4179			return (NULL);
4180			break;
4181		case SCTP_ASCONF:
4182#ifdef SCTP_DEBUG
4183			if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
4184				printf("SCTP_ASCONF\n");
4185			}
4186#endif				/* SCTP_DEBUG */
4187			/* He's alive so give him credit */
4188			stcb->asoc.overall_error_count = 0;
4189
4190			sctp_handle_asconf(m, *offset,
4191			    (struct sctp_asconf_chunk *)ch, stcb);
4192			break;
4193		case SCTP_ASCONF_ACK:
4194#ifdef SCTP_DEBUG
4195			if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
4196				printf("SCTP_ASCONF-ACK\n");
4197			}
4198#endif				/* SCTP_DEBUG */
4199			/* He's alive so give him credit */
4200			stcb->asoc.overall_error_count = 0;
4201
4202			sctp_handle_asconf_ack(m, *offset,
4203			    (struct sctp_asconf_ack_chunk *)ch, stcb, *netp);
4204			break;
4205		case SCTP_FORWARD_CUM_TSN:
4206#ifdef SCTP_DEBUG
4207			if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
4208				printf("SCTP_FWD-TSN\n");
4209			}
4210#endif				/* SCTP_DEBUG */
4211			/* He's alive so give him credit */
4212			{
4213				int abort_flag = 0;
4214
4215				stcb->asoc.overall_error_count = 0;
4216				*fwd_tsn_seen = 1;
4217				if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4218					/* We are not interested anymore */
4219					sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_28);
4220					*offset = length;
4221					return (NULL);
4222				}
4223				sctp_handle_forward_tsn(stcb,
4224				    (struct sctp_forward_tsn_chunk *)ch, &abort_flag);
4225				if (abort_flag) {
4226					*offset = length;
4227					return (NULL);
4228				} else {
4229					stcb->asoc.overall_error_count = 0;
4230				}
4231
4232			}
4233			break;
4234		case SCTP_STREAM_RESET:
4235#ifdef SCTP_DEBUG
4236			if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
4237				printf("SCTP_STREAM_RESET\n");
4238			}
4239#endif				/* SCTP_DEBUG */
4240			ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
4241			    chk_length, chunk_buf);
4242			if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4243				/* We are not interested anymore */
4244				sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_29);
4245				*offset = length;
4246				return (NULL);
4247			}
4248			if (stcb->asoc.peer_supports_strreset == 0) {
4249				/*
4250				 * hmm, peer should have announced this, but
4251				 * we will turn it on since he is sending us
4252				 * a stream reset.
4253				 */
4254				stcb->asoc.peer_supports_strreset = 1;
4255			}
4256			if (sctp_handle_stream_reset(stcb, (struct sctp_stream_reset_out_req *)ch)) {
4257				/* stop processing */
4258				*offset = length;
4259				return (NULL);
4260			}
4261			break;
4262		case SCTP_PACKET_DROPPED:
4263#ifdef SCTP_DEBUG
4264			if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
4265				printf("SCTP_PACKET_DROPPED\n");
4266			}
4267#endif				/* SCTP_DEBUG */
4268			/* re-get it all please */
4269			ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
4270			    chk_length, chunk_buf);
4271
4272			sctp_handle_packet_dropped((struct sctp_pktdrop_chunk *)ch,
4273			    stcb, *netp);
4274
4275			break;
4276
4277		case SCTP_AUTHENTICATION:
4278#ifdef SCTP_DEBUG
4279			if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
4280				printf("SCTP_AUTHENTICATION\n");
4281			}
4282#endif				/* SCTP_DEBUG */
4283			if (sctp_auth_disable)
4284				goto unknown_chunk;
4285
4286			if (stcb == NULL) {
4287				/* save the first AUTH for later processing */
4288				if (auth_skipped == 0) {
4289					auth_offset = *offset;
4290					auth_len = chk_length;
4291					auth_skipped = 1;
4292				}
4293				/* skip this chunk (temporarily) */
4294				goto next_chunk;
4295			}
4296			if (got_auth == 1) {
4297				/* skip this chunk... it's already auth'd */
4298				goto next_chunk;
4299			}
4300			ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
4301			    chk_length, chunk_buf);
4302			got_auth = 1;
4303			if (sctp_handle_auth(stcb, (struct sctp_auth_chunk *)ch,
4304			    m, *offset)) {
4305				/* auth HMAC failed so dump the packet */
4306				*offset = length;
4307				return (stcb);
4308			} else {
4309				/* remaining chunks are HMAC checked */
4310				stcb->asoc.authenticated = 1;
4311			}
4312			break;
4313
4314		default:
4315	unknown_chunk:
4316			/* it's an unknown chunk! */
4317			if ((ch->chunk_type & 0x40) && (stcb != NULL)) {
4318				struct mbuf *mm;
4319				struct sctp_paramhdr *phd;
4320
4321				mm = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr),
4322				    0, M_DONTWAIT, 1, MT_DATA);
4323				if (mm) {
4324					phd = mtod(mm, struct sctp_paramhdr *);
4325					/*
4326					 * We cheat and use param type since
4327					 * we did not bother to define a
4328					 * error cause struct. They are the
4329					 * same basic format with different
4330					 * names.
4331					 */
4332					phd->param_type = htons(SCTP_CAUSE_UNRECOG_CHUNK);
4333					phd->param_length = htons(chk_length + sizeof(*phd));
4334					SCTP_BUF_LEN(mm) = sizeof(*phd);
4335					SCTP_BUF_NEXT(mm) = SCTP_M_COPYM(m, *offset, SCTP_SIZE32(chk_length),
4336					    M_DONTWAIT);
4337					if (SCTP_BUF_NEXT(mm)) {
4338						sctp_queue_op_err(stcb, mm);
4339					} else {
4340						sctp_m_freem(mm);
4341					}
4342				}
4343			}
4344			if ((ch->chunk_type & 0x80) == 0) {
4345				/* discard this packet */
4346				*offset = length;
4347				return (stcb);
4348			}	/* else skip this bad chunk and continue... */
4349			break;
4350		}		/* switch (ch->chunk_type) */
4351
4352
4353next_chunk:
4354		/* get the next chunk */
4355		*offset += SCTP_SIZE32(chk_length);
4356		if (*offset >= length) {
4357			/* no more data left in the mbuf chain */
4358			break;
4359		}
4360		ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
4361		    sizeof(struct sctp_chunkhdr), chunk_buf);
4362		if (ch == NULL) {
4363			if (locked_tcb)
4364				SCTP_TCB_UNLOCK(locked_tcb);
4365			*offset = length;
4366			return (NULL);
4367		}
4368	}			/* while */
4369	return (stcb);
4370}
4371
4372
4373/*
4374 * Process the ECN bits we have something set so we must look to see if it is
4375 * ECN(0) or ECN(1) or CE
4376 */
4377static __inline void
4378sctp_process_ecn_marked_a(struct sctp_tcb *stcb, struct sctp_nets *net,
4379    uint8_t ecn_bits)
4380{
4381	if ((ecn_bits & SCTP_CE_BITS) == SCTP_CE_BITS) {
4382		;
4383	} else if ((ecn_bits & SCTP_ECT1_BIT) == SCTP_ECT1_BIT) {
4384		/*
4385		 * we only add to the nonce sum for ECT1, ECT0 does not
4386		 * change the NS bit (that we have yet to find a way to send
4387		 * it yet).
4388		 */
4389
4390		/* ECN Nonce stuff */
4391		stcb->asoc.receiver_nonce_sum++;
4392		stcb->asoc.receiver_nonce_sum &= SCTP_SACK_NONCE_SUM;
4393
4394		/*
4395		 * Drag up the last_echo point if cumack is larger since we
4396		 * don't want the point falling way behind by more than
4397		 * 2^^31 and then having it be incorrect.
4398		 */
4399		if (compare_with_wrap(stcb->asoc.cumulative_tsn,
4400		    stcb->asoc.last_echo_tsn, MAX_TSN)) {
4401			stcb->asoc.last_echo_tsn = stcb->asoc.cumulative_tsn;
4402		}
4403	} else if ((ecn_bits & SCTP_ECT0_BIT) == SCTP_ECT0_BIT) {
4404		/*
4405		 * Drag up the last_echo point if cumack is larger since we
4406		 * don't want the point falling way behind by more than
4407		 * 2^^31 and then having it be incorrect.
4408		 */
4409		if (compare_with_wrap(stcb->asoc.cumulative_tsn,
4410		    stcb->asoc.last_echo_tsn, MAX_TSN)) {
4411			stcb->asoc.last_echo_tsn = stcb->asoc.cumulative_tsn;
4412		}
4413	}
4414}
4415
4416static __inline void
4417sctp_process_ecn_marked_b(struct sctp_tcb *stcb, struct sctp_nets *net,
4418    uint32_t high_tsn, uint8_t ecn_bits)
4419{
4420	if ((ecn_bits & SCTP_CE_BITS) == SCTP_CE_BITS) {
4421		/*
4422		 * we possibly must notify the sender that a congestion
4423		 * window reduction is in order. We do this by adding a ECNE
4424		 * chunk to the output chunk queue. The incoming CWR will
4425		 * remove this chunk.
4426		 */
4427		if (compare_with_wrap(high_tsn, stcb->asoc.last_echo_tsn,
4428		    MAX_TSN)) {
4429			/* Yep, we need to add a ECNE */
4430			sctp_send_ecn_echo(stcb, net, high_tsn);
4431			stcb->asoc.last_echo_tsn = high_tsn;
4432		}
4433	}
4434}
4435
4436/*
4437 * common input chunk processing (v4 and v6)
4438 */
4439int
4440sctp_common_input_processing(struct mbuf **mm, int iphlen, int offset,
4441    int length, struct sctphdr *sh, struct sctp_chunkhdr *ch,
4442    struct sctp_inpcb *inp, struct sctp_tcb *stcb, struct sctp_nets *net,
4443    uint8_t ecn_bits)
4444{
4445	/*
4446	 * Control chunk processing
4447	 */
4448	uint32_t high_tsn;
4449	int fwd_tsn_seen = 0, data_processed = 0;
4450	struct mbuf *m = *mm;
4451	int abort_flag = 0;
4452	int un_sent;
4453
4454	SCTP_STAT_INCR(sctps_recvdatagrams);
4455#ifdef SCTP_AUDITING_ENABLED
4456	sctp_audit_log(0xE0, 1);
4457	sctp_auditing(0, inp, stcb, net);
4458#endif
4459
4460#ifdef SCTP_DEBUG
4461	if (sctp_debug_on & SCTP_DEBUG_INPUT1) {
4462		printf("Ok, Common input processing called, m:%p iphlen:%d offset:%d\n",
4463		    m, iphlen, offset);
4464	}
4465#endif				/* SCTP_DEBUG */
4466
4467	if (stcb) {
4468		/* always clear this before beginning a packet */
4469		stcb->asoc.authenticated = 0;
4470		stcb->asoc.seen_a_sack_this_pkt = 0;
4471	}
4472	if (IS_SCTP_CONTROL(ch)) {
4473		/* process the control portion of the SCTP packet */
4474		stcb = sctp_process_control(m, iphlen, &offset, length, sh, ch,
4475		    inp, stcb, &net, &fwd_tsn_seen);
4476		if (stcb) {
4477			/*
4478			 * This covers us if the cookie-echo was there and
4479			 * it changes our INP.
4480			 */
4481			inp = stcb->sctp_ep;
4482		}
4483	} else {
4484		/*
4485		 * no control chunks, so pre-process DATA chunks (these
4486		 * checks are taken care of by control processing)
4487		 */
4488
4489		/*
4490		 * if DATA only packet, and auth is required, then punt...
4491		 * can't have authenticated without any AUTH (control)
4492		 * chunks
4493		 */
4494		if ((stcb != NULL) && !sctp_auth_disable &&
4495		    sctp_auth_is_required_chunk(SCTP_DATA,
4496		    stcb->asoc.local_auth_chunks)) {
4497			/* "silently" ignore */
4498			SCTP_STAT_INCR(sctps_recvauthmissing);
4499			SCTP_TCB_UNLOCK(stcb);
4500			return (1);
4501		}
4502		if (stcb == NULL) {
4503			/* out of the blue DATA chunk */
4504			sctp_handle_ootb(m, iphlen, offset, sh, inp, NULL);
4505			return (1);
4506		}
4507		if (stcb->asoc.my_vtag != ntohl(sh->v_tag)) {
4508			/* v_tag mismatch! */
4509			SCTP_STAT_INCR(sctps_badvtag);
4510			SCTP_TCB_UNLOCK(stcb);
4511			return (1);
4512		}
4513	}
4514
4515	if (stcb == NULL) {
4516		/*
4517		 * no valid TCB for this packet, or we found it's a bad
4518		 * packet while processing control, or we're done with this
4519		 * packet (done or skip rest of data), so we drop it...
4520		 */
4521		return (1);
4522	}
4523	/*
4524	 * DATA chunk processing
4525	 */
4526	/* plow through the data chunks while length > offset */
4527
4528	/*
4529	 * Rest should be DATA only.  Check authentication state if AUTH for
4530	 * DATA is required.
4531	 */
4532	if ((length > offset) && (stcb != NULL) && !sctp_auth_disable &&
4533	    sctp_auth_is_required_chunk(SCTP_DATA,
4534	    stcb->asoc.local_auth_chunks) &&
4535	    !stcb->asoc.authenticated) {
4536		/* "silently" ignore */
4537		SCTP_STAT_INCR(sctps_recvauthmissing);
4538#ifdef SCTP_DEBUG
4539		if (sctp_debug_on & SCTP_DEBUG_AUTH1)
4540			printf("Data chunk requires AUTH, skipped\n");
4541#endif
4542		goto trigger_send;
4543	}
4544	if (length > offset) {
4545		int retval;
4546
4547		/*
4548		 * First check to make sure our state is correct. We would
4549		 * not get here unless we really did have a tag, so we don't
4550		 * abort if this happens, just dump the chunk silently.
4551		 */
4552		switch (SCTP_GET_STATE(&stcb->asoc)) {
4553		case SCTP_STATE_COOKIE_ECHOED:
4554			/*
4555			 * we consider data with valid tags in this state
4556			 * shows us the cookie-ack was lost. Imply it was
4557			 * there.
4558			 */
4559			stcb->asoc.overall_error_count = 0;
4560			sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb, net);
4561			break;
4562		case SCTP_STATE_COOKIE_WAIT:
4563			/*
4564			 * We consider OOTB any data sent during asoc setup.
4565			 */
4566			sctp_handle_ootb(m, iphlen, offset, sh, inp, NULL);
4567			SCTP_TCB_UNLOCK(stcb);
4568			return (1);
4569			break;
4570		case SCTP_STATE_EMPTY:	/* should not happen */
4571		case SCTP_STATE_INUSE:	/* should not happen */
4572		case SCTP_STATE_SHUTDOWN_RECEIVED:	/* This is a peer error */
4573		case SCTP_STATE_SHUTDOWN_ACK_SENT:
4574		default:
4575			SCTP_TCB_UNLOCK(stcb);
4576			return (1);
4577			break;
4578		case SCTP_STATE_OPEN:
4579		case SCTP_STATE_SHUTDOWN_SENT:
4580			break;
4581		}
4582		/* take care of ECN, part 1. */
4583		if (stcb->asoc.ecn_allowed &&
4584		    (ecn_bits & (SCTP_ECT0_BIT | SCTP_ECT1_BIT))) {
4585			sctp_process_ecn_marked_a(stcb, net, ecn_bits);
4586		}
4587		/* plow through the data chunks while length > offset */
4588		retval = sctp_process_data(mm, iphlen, &offset, length, sh,
4589		    inp, stcb, net, &high_tsn);
4590		if (retval == 2) {
4591			/*
4592			 * The association aborted, NO UNLOCK needed since
4593			 * the association is destroyed.
4594			 */
4595			return (0);
4596		}
4597		data_processed = 1;
4598		if (retval == 0) {
4599			/* take care of ecn part 2. */
4600			if (stcb->asoc.ecn_allowed &&
4601			    (ecn_bits & (SCTP_ECT0_BIT | SCTP_ECT1_BIT))) {
4602				sctp_process_ecn_marked_b(stcb, net, high_tsn,
4603				    ecn_bits);
4604			}
4605		}
4606		/*
4607		 * Anything important needs to have been m_copy'ed in
4608		 * process_data
4609		 */
4610	}
4611	if ((data_processed == 0) && (fwd_tsn_seen)) {
4612		int was_a_gap = 0;
4613
4614		if (compare_with_wrap(stcb->asoc.highest_tsn_inside_map,
4615		    stcb->asoc.cumulative_tsn, MAX_TSN)) {
4616			/* there was a gap before this data was processed */
4617			was_a_gap = 1;
4618		}
4619		sctp_sack_check(stcb, 1, was_a_gap, &abort_flag);
4620		if (abort_flag) {
4621			/* Again, we aborted so NO UNLOCK needed */
4622			return (0);
4623		}
4624	}
4625	/* trigger send of any chunks in queue... */
4626trigger_send:
4627#ifdef SCTP_AUDITING_ENABLED
4628	sctp_audit_log(0xE0, 2);
4629	sctp_auditing(1, inp, stcb, net);
4630#endif
4631#ifdef SCTP_DEBUG
4632	if (sctp_debug_on & SCTP_DEBUG_INPUT1) {
4633		printf("Check for chunk output prw:%d tqe:%d tf=%d\n",
4634		    stcb->asoc.peers_rwnd,
4635		    TAILQ_EMPTY(&stcb->asoc.control_send_queue),
4636		    stcb->asoc.total_flight);
4637	}
4638#endif
4639	un_sent = (stcb->asoc.total_output_queue_size - stcb->asoc.total_flight);
4640
4641	if (!TAILQ_EMPTY(&stcb->asoc.control_send_queue) ||
4642	    ((un_sent) &&
4643	    (stcb->asoc.peers_rwnd > 0 ||
4644	    (stcb->asoc.peers_rwnd <= 0 && stcb->asoc.total_flight == 0)))) {
4645#ifdef SCTP_DEBUG
4646		if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
4647			printf("Calling chunk OUTPUT\n");
4648		}
4649#endif
4650		sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC);
4651#ifdef SCTP_DEBUG
4652		if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
4653			printf("chunk OUTPUT returns\n");
4654		}
4655#endif
4656	}
4657#ifdef SCTP_AUDITING_ENABLED
4658	sctp_audit_log(0xE0, 3);
4659	sctp_auditing(2, inp, stcb, net);
4660#endif
4661	SCTP_TCB_UNLOCK(stcb);
4662	return (0);
4663}
4664
4665extern int sctp_no_csum_on_loopback;
4666
4667
4668int sctp_buf_index = 0;
4669uint8_t sctp_list_of_chunks[30000];
4670
4671
4672void
4673sctp_input(i_pak, off)
4674	struct mbuf *i_pak;
4675	int off;
4676
4677{
4678#ifdef SCTP_MBUF_LOGGING
4679	struct mbuf *mat;
4680
4681#endif
4682	struct mbuf *m;
4683	int iphlen;
4684	uint8_t ecn_bits;
4685	struct ip *ip;
4686	struct sctphdr *sh;
4687	struct sctp_inpcb *inp = NULL;
4688
4689	uint32_t check, calc_check;
4690	struct sctp_nets *net;
4691	struct sctp_tcb *stcb = NULL;
4692	struct sctp_chunkhdr *ch;
4693	int refcount_up = 0;
4694	int length, mlen, offset;
4695
4696
4697	iphlen = off;
4698	m = SCTP_HEADER_TO_CHAIN(i_pak);
4699	net = NULL;
4700	SCTP_STAT_INCR(sctps_recvpackets);
4701	SCTP_STAT_INCR_COUNTER64(sctps_inpackets);
4702
4703	/*
4704	 * Strip IP options, we don't allow any in or out.
4705	 */
4706#ifdef SCTP_MBUF_LOGGING
4707	/* Log in any input mbufs */
4708	mat = m;
4709	while (mat) {
4710		if (SCTP_BUF_IS_EXTENDED(mat)) {
4711			sctp_log_mb(mat, SCTP_MBUF_INPUT);
4712		}
4713		mat = SCTP_BUF_NEXT(mat);
4714	}
4715#endif
4716	if ((size_t)iphlen > sizeof(struct ip)) {
4717		ip_stripoptions(m, (struct mbuf *)0);
4718		iphlen = sizeof(struct ip);
4719	}
4720	/*
4721	 * Get IP, SCTP, and first chunk header together in first mbuf.
4722	 */
4723	ip = mtod(m, struct ip *);
4724	offset = iphlen + sizeof(*sh) + sizeof(*ch);
4725	if (SCTP_BUF_LEN(m) < offset) {
4726		if ((m = m_pullup(m, offset)) == 0) {
4727			SCTP_STAT_INCR(sctps_hdrops);
4728			return;
4729		}
4730		ip = mtod(m, struct ip *);
4731	}
4732	sh = (struct sctphdr *)((caddr_t)ip + iphlen);
4733	ch = (struct sctp_chunkhdr *)((caddr_t)sh + sizeof(*sh));
4734
4735	/* SCTP does not allow broadcasts or multicasts */
4736	if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr))) {
4737		goto bad;
4738	}
4739	if (((ch->chunk_type == SCTP_INITIATION) ||
4740	    (ch->chunk_type == SCTP_INITIATION_ACK) ||
4741	    (ch->chunk_type == SCTP_COOKIE_ECHO)) &&
4742	    (SCTP_IS_IT_BROADCAST(ip->ip_dst, i_pak))) {
4743		/*
4744		 * We only look at broadcast if its a front state, All
4745		 * others we will not have a tcb for anyway.
4746		 */
4747		goto bad;
4748	}
4749	/* destination port of 0 is illegal, based on RFC2960. */
4750	if (sh->dest_port == 0) {
4751		SCTP_STAT_INCR(sctps_hdrops);
4752		goto bad;
4753	}
4754	/* validate SCTP checksum */
4755	if ((sctp_no_csum_on_loopback == 0) || !SCTP_IS_IT_LOOPBACK(i_pak)) {
4756		/*
4757		 * we do NOT validate things from the loopback if the sysctl
4758		 * is set to 1.
4759		 */
4760		check = sh->checksum;	/* save incoming checksum */
4761		if ((check == 0) && (sctp_no_csum_on_loopback)) {
4762			/*
4763			 * special hook for where we got a local address
4764			 * somehow routed across a non IFT_LOOP type
4765			 * interface
4766			 */
4767			if (ip->ip_src.s_addr == ip->ip_dst.s_addr)
4768				goto sctp_skip_csum_4;
4769		}
4770		sh->checksum = 0;	/* prepare for calc */
4771		calc_check = sctp_calculate_sum(m, &mlen, iphlen);
4772		if (calc_check != check) {
4773#ifdef SCTP_DEBUG
4774			if (sctp_debug_on & SCTP_DEBUG_INPUT1) {
4775				printf("Bad CSUM on SCTP packet calc_check:%x check:%x  m:%p mlen:%d iphlen:%d\n",
4776				    calc_check, check, m, mlen, iphlen);
4777			}
4778#endif
4779
4780			stcb = sctp_findassociation_addr(m, iphlen,
4781			    offset - sizeof(*ch),
4782			    sh, ch, &inp, &net);
4783			if ((inp) && (stcb)) {
4784				sctp_send_packet_dropped(stcb, net, m, iphlen, 1);
4785				sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_INPUT_ERROR);
4786			} else if ((inp != NULL) && (stcb == NULL)) {
4787				refcount_up = 1;
4788			}
4789			SCTP_STAT_INCR(sctps_badsum);
4790			SCTP_STAT_INCR_COUNTER32(sctps_checksumerrors);
4791			goto bad;
4792		}
4793		sh->checksum = calc_check;
4794	} else {
4795sctp_skip_csum_4:
4796		mlen = SCTP_HEADER_LEN(i_pak);
4797	}
4798	/* validate mbuf chain length with IP payload length */
4799	if (mlen < (ip->ip_len - iphlen)) {
4800		SCTP_STAT_INCR(sctps_hdrops);
4801		goto bad;
4802	} {
4803		/* TEMP log the first chunk */
4804		int x;
4805
4806		x = atomic_fetchadd_int(&sctp_buf_index, 1);
4807		if (x >= 30000) {
4808			sctp_buf_index = 1;
4809			x = 0;;
4810		}
4811		sctp_list_of_chunks[x] = ch->chunk_type;
4812	}
4813	/*
4814	 * Locate pcb and tcb for datagram sctp_findassociation_addr() wants
4815	 * IP/SCTP/first chunk header...
4816	 */
4817	stcb = sctp_findassociation_addr(m, iphlen, offset - sizeof(*ch),
4818	    sh, ch, &inp, &net);
4819	/* inp's ref-count increased && stcb locked */
4820	if (inp == NULL) {
4821		struct sctp_init_chunk *init_chk, chunk_buf;
4822
4823		SCTP_STAT_INCR(sctps_noport);
4824#ifdef ICMP_BANDLIM
4825		/*
4826		 * we use the bandwidth limiting to protect against sending
4827		 * too many ABORTS all at once. In this case these count the
4828		 * same as an ICMP message.
4829		 */
4830		if (badport_bandlim(0) < 0)
4831			goto bad;
4832#endif				/* ICMP_BANDLIM */
4833#ifdef SCTP_DEBUG
4834		if (sctp_debug_on & SCTP_DEBUG_INPUT1) {
4835			printf("Sending a ABORT from packet entry!\n");
4836		}
4837#endif
4838		if (ch->chunk_type == SCTP_INITIATION) {
4839			/*
4840			 * we do a trick here to get the INIT tag, dig in
4841			 * and get the tag from the INIT and put it in the
4842			 * common header.
4843			 */
4844			init_chk = (struct sctp_init_chunk *)sctp_m_getptr(m,
4845			    iphlen + sizeof(*sh), sizeof(*init_chk),
4846			    (uint8_t *) & chunk_buf);
4847			if (init_chk != NULL)
4848				sh->v_tag = init_chk->init.initiate_tag;
4849		}
4850		if (ch->chunk_type == SCTP_SHUTDOWN_ACK) {
4851			sctp_send_shutdown_complete2(m, iphlen, sh);
4852			goto bad;
4853		}
4854		if (ch->chunk_type == SCTP_SHUTDOWN_COMPLETE) {
4855			goto bad;
4856		}
4857		if (ch->chunk_type != SCTP_ABORT_ASSOCIATION)
4858			sctp_send_abort(m, iphlen, sh, 0, NULL);
4859		goto bad;
4860	} else if (stcb == NULL) {
4861		refcount_up = 1;
4862	}
4863#ifdef IPSEC
4864	/*
4865	 * I very much doubt any of the IPSEC stuff will work but I have no
4866	 * idea, so I will leave it in place.
4867	 */
4868
4869	if (inp && ipsec4_in_reject(m, &inp->ip_inp.inp)) {
4870		ipsecstat.in_polvio++;
4871		SCTP_STAT_INCR(sctps_hdrops);
4872		goto bad;
4873	}
4874#endif				/* IPSEC */
4875
4876
4877
4878	/*
4879	 * common chunk processing
4880	 */
4881	length = ip->ip_len + iphlen;
4882	offset -= sizeof(struct sctp_chunkhdr);
4883
4884	ecn_bits = ip->ip_tos;
4885
4886	sctp_common_input_processing(&m, iphlen, offset, length, sh, ch,
4887	    inp, stcb, net, ecn_bits);
4888	/* inp's ref-count reduced && stcb unlocked */
4889	if (m) {
4890		sctp_m_freem(m);
4891	}
4892	if ((inp) && (refcount_up)) {
4893		/* reduce ref-count */
4894		SCTP_INP_WLOCK(inp);
4895		SCTP_INP_DECR_REF(inp);
4896		SCTP_INP_WUNLOCK(inp);
4897	}
4898	return;
4899bad:
4900	if (stcb)
4901		SCTP_TCB_UNLOCK(stcb);
4902
4903	if ((inp) && (refcount_up)) {
4904		/* reduce ref-count */
4905		SCTP_INP_WLOCK(inp);
4906		SCTP_INP_DECR_REF(inp);
4907		SCTP_INP_WUNLOCK(inp);
4908	}
4909	if (m) {
4910		sctp_m_freem(m);
4911	}
4912	return;
4913}
4914