sctp_input.c revision 169352
1/*-
2 * Copyright (c) 2001-2007, Cisco Systems, Inc. All rights reserved.
3 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions are met:
6 *
7 * a) Redistributions of source code must retain the above copyright notice,
8 *   this list of conditions and the following disclaimer.
9 *
10 * b) Redistributions in binary form must reproduce the above copyright
11 *    notice, this list of conditions and the following disclaimer in
12 *   the documentation and/or other materials provided with the distribution.
13 *
14 * c) Neither the name of Cisco Systems, Inc. nor the names of its
15 *    contributors may be used to endorse or promote products derived
16 *    from this software without specific prior written permission.
17 *
18 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
19 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
20 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
22 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
23 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
24 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
25 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
26 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
27 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
28 * THE POSSIBILITY OF SUCH DAMAGE.
29 */
30
31/* $KAME: sctp_input.c,v 1.27 2005/03/06 16:04:17 itojun Exp $	 */
32
33#include <sys/cdefs.h>
34__FBSDID("$FreeBSD: head/sys/netinet/sctp_input.c 169352 2007-05-08 00:21:05Z rrs $");
35
36#include <netinet/sctp_os.h>
37#include <netinet/sctp_var.h>
38#include <netinet/sctp_sysctl.h>
39#include <netinet/sctp_pcb.h>
40#include <netinet/sctp_header.h>
41#include <netinet/sctputil.h>
42#include <netinet/sctp_output.h>
43#include <netinet/sctp_input.h>
44#include <netinet/sctp_auth.h>
45#include <netinet/sctp_indata.h>
46#include <netinet/sctp_asconf.h>
47
48
49
50
51static void
52sctp_stop_all_cookie_timers(struct sctp_tcb *stcb)
53{
54	struct sctp_nets *net;
55
56	/*
57	 * This now not only stops all cookie timers it also stops any INIT
58	 * timers as well. This will make sure that the timers are stopped
59	 * in all collision cases.
60	 */
61	SCTP_TCB_LOCK_ASSERT(stcb);
62	TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
63		if (net->rxt_timer.type == SCTP_TIMER_TYPE_COOKIE) {
64			sctp_timer_stop(SCTP_TIMER_TYPE_COOKIE,
65			    stcb->sctp_ep,
66			    stcb,
67			    net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_1);
68		} else if (net->rxt_timer.type == SCTP_TIMER_TYPE_INIT) {
69			sctp_timer_stop(SCTP_TIMER_TYPE_INIT,
70			    stcb->sctp_ep,
71			    stcb,
72			    net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_2);
73		}
74	}
75}
76
77/* INIT handler */
78static void
79sctp_handle_init(struct mbuf *m, int iphlen, int offset, struct sctphdr *sh,
80    struct sctp_init_chunk *cp, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
81    struct sctp_nets *net, int *abort_no_unlock, uint32_t vrf_id,
82    uint32_t table_id)
83{
84	struct sctp_init *init;
85	struct mbuf *op_err;
86	uint32_t init_limit;
87
88#ifdef SCTP_DEBUG
89	if (sctp_debug_on & SCTP_DEBUG_INPUT2) {
90		printf("sctp_handle_init: handling INIT tcb:%p\n", stcb);
91	}
92#endif
93	op_err = NULL;
94	init = &cp->init;
95	/* First are we accepting? */
96	if ((inp->sctp_socket->so_qlimit == 0) && (stcb == NULL)) {
97#ifdef SCTP_DEBUG
98		if (sctp_debug_on & SCTP_DEBUG_INPUT2) {
99			printf("sctp_handle_init: Abort, so_qlimit:%d\n", inp->sctp_socket->so_qlimit);
100		}
101#endif
102		/*
103		 * FIX ME ?? What about TCP model and we have a
104		 * match/restart case?
105		 */
106		sctp_abort_association(inp, stcb, m, iphlen, sh, op_err,
107		    vrf_id, table_id);
108		if (stcb)
109			*abort_no_unlock = 1;
110		return;
111	}
112	if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_init_chunk)) {
113		/* Invalid length */
114		op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
115		sctp_abort_association(inp, stcb, m, iphlen, sh, op_err,
116		    vrf_id, table_id);
117		if (stcb)
118			*abort_no_unlock = 1;
119		return;
120	}
121	/* validate parameters */
122	if (init->initiate_tag == 0) {
123		/* protocol error... send abort */
124		op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
125		sctp_abort_association(inp, stcb, m, iphlen, sh, op_err,
126		    vrf_id, table_id);
127		if (stcb)
128			*abort_no_unlock = 1;
129		return;
130	}
131	if (ntohl(init->a_rwnd) < SCTP_MIN_RWND) {
132		/* invalid parameter... send abort */
133		op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
134		sctp_abort_association(inp, stcb, m, iphlen, sh, op_err,
135		    vrf_id, table_id);
136		return;
137	}
138	if (init->num_inbound_streams == 0) {
139		/* protocol error... send abort */
140		op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
141		sctp_abort_association(inp, stcb, m, iphlen, sh, op_err,
142		    vrf_id, table_id);
143		if (stcb)
144			*abort_no_unlock = 1;
145		return;
146	}
147	if (init->num_outbound_streams == 0) {
148		/* protocol error... send abort */
149		op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
150		sctp_abort_association(inp, stcb, m, iphlen, sh, op_err,
151		    vrf_id, table_id);
152		if (stcb)
153			*abort_no_unlock = 1;
154		return;
155	}
156	init_limit = offset + ntohs(cp->ch.chunk_length);
157	if (sctp_validate_init_auth_params(m, offset + sizeof(*cp),
158	    init_limit)) {
159		/* auth parameter(s) error... send abort */
160		sctp_abort_association(inp, stcb, m, iphlen, sh, NULL, vrf_id,
161		    table_id);
162		if (stcb)
163			*abort_no_unlock = 1;
164		return;
165	}
166	/* send an INIT-ACK w/cookie */
167#ifdef SCTP_DEBUG
168	if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
169		printf("sctp_handle_init: sending INIT-ACK\n");
170	}
171#endif
172	sctp_send_initiate_ack(inp, stcb, m, iphlen, offset, sh, cp, vrf_id,
173	    table_id);
174}
175
176/*
177 * process peer "INIT/INIT-ACK" chunk returns value < 0 on error
178 */
179static int
180sctp_process_init(struct sctp_init_chunk *cp, struct sctp_tcb *stcb,
181    struct sctp_nets *net)
182{
183	struct sctp_init *init;
184	struct sctp_association *asoc;
185	struct sctp_nets *lnet;
186	unsigned int i;
187
188	init = &cp->init;
189	asoc = &stcb->asoc;
190	/* save off parameters */
191	asoc->peer_vtag = ntohl(init->initiate_tag);
192	asoc->peers_rwnd = ntohl(init->a_rwnd);
193	if (TAILQ_FIRST(&asoc->nets)) {
194		/* update any ssthresh's that may have a default */
195		TAILQ_FOREACH(lnet, &asoc->nets, sctp_next) {
196			lnet->ssthresh = asoc->peers_rwnd;
197
198#if defined(SCTP_CWND_MONITOR) || defined(SCTP_CWND_LOGGING)
199			sctp_log_cwnd(stcb, lnet, 0, SCTP_CWND_INITIALIZATION);
200#endif
201
202		}
203	}
204	SCTP_TCB_SEND_LOCK(stcb);
205	if (asoc->pre_open_streams > ntohs(init->num_inbound_streams)) {
206		unsigned int newcnt;
207		struct sctp_stream_out *outs;
208		struct sctp_stream_queue_pending *sp;
209
210		/* cut back on number of streams */
211		newcnt = ntohs(init->num_inbound_streams);
212		/* This if is probably not needed but I am cautious */
213		if (asoc->strmout) {
214			/* First make sure no data chunks are trapped */
215			for (i = newcnt; i < asoc->pre_open_streams; i++) {
216				outs = &asoc->strmout[i];
217				sp = TAILQ_FIRST(&outs->outqueue);
218				while (sp) {
219					TAILQ_REMOVE(&outs->outqueue, sp,
220					    next);
221					asoc->stream_queue_cnt--;
222					sctp_ulp_notify(SCTP_NOTIFY_SPECIAL_SP_FAIL,
223					    stcb, SCTP_NOTIFY_DATAGRAM_UNSENT,
224					    sp);
225					if (sp->data) {
226						sctp_m_freem(sp->data);
227						sp->data = NULL;
228					}
229					sctp_free_remote_addr(sp->net);
230					sp->net = NULL;
231					/* Free the chunk */
232					printf("sp:%p tcb:%p weird free case\n",
233					    sp, stcb);
234
235					sctp_free_a_strmoq(stcb, sp);
236					sp = TAILQ_FIRST(&outs->outqueue);
237				}
238			}
239		}
240		/* cut back the count and abandon the upper streams */
241		asoc->pre_open_streams = newcnt;
242	}
243	SCTP_TCB_SEND_UNLOCK(stcb);
244	asoc->streamoutcnt = asoc->pre_open_streams;
245	/* init tsn's */
246	asoc->highest_tsn_inside_map = asoc->asconf_seq_in = ntohl(init->initial_tsn) - 1;
247#ifdef SCTP_MAP_LOGGING
248	sctp_log_map(0, 5, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
249#endif
250	/* This is the next one we expect */
251	asoc->str_reset_seq_in = asoc->asconf_seq_in + 1;
252
253	asoc->mapping_array_base_tsn = ntohl(init->initial_tsn);
254	asoc->cumulative_tsn = asoc->asconf_seq_in;
255	asoc->last_echo_tsn = asoc->asconf_seq_in;
256	asoc->advanced_peer_ack_point = asoc->last_acked_seq;
257	/* open the requested streams */
258	if (asoc->strmin != NULL) {
259		/* Free the old ones */
260		struct sctp_queued_to_read *ctl;
261
262		for (i = 0; i < asoc->streamincnt; i++) {
263			ctl = TAILQ_FIRST(&asoc->strmin[i].inqueue);
264			while (ctl) {
265				TAILQ_REMOVE(&asoc->strmin[i].inqueue, ctl, next);
266				sctp_free_remote_addr(ctl->whoFrom);
267				sctp_m_freem(ctl->data);
268				ctl->data = NULL;
269				sctp_free_a_readq(stcb, ctl);
270				ctl = TAILQ_FIRST(&asoc->strmin[i].inqueue);
271			}
272		}
273		SCTP_FREE(asoc->strmin);
274	}
275	asoc->streamincnt = ntohs(init->num_outbound_streams);
276	if (asoc->streamincnt > MAX_SCTP_STREAMS) {
277		asoc->streamincnt = MAX_SCTP_STREAMS;
278	}
279	SCTP_MALLOC(asoc->strmin, struct sctp_stream_in *, asoc->streamincnt *
280	    sizeof(struct sctp_stream_in), "StreamsIn");
281	if (asoc->strmin == NULL) {
282		/* we didn't get memory for the streams! */
283#ifdef SCTP_DEBUG
284		if (sctp_debug_on & SCTP_DEBUG_INPUT2) {
285			printf("process_init: couldn't get memory for the streams!\n");
286		}
287#endif
288		return (-1);
289	}
290	for (i = 0; i < asoc->streamincnt; i++) {
291		asoc->strmin[i].stream_no = i;
292		asoc->strmin[i].last_sequence_delivered = 0xffff;
293		/*
294		 * U-stream ranges will be set when the cookie is unpacked.
295		 * Or for the INIT sender they are un set (if pr-sctp not
296		 * supported) when the INIT-ACK arrives.
297		 */
298		TAILQ_INIT(&asoc->strmin[i].inqueue);
299		asoc->strmin[i].delivery_started = 0;
300	}
301	/*
302	 * load_address_from_init will put the addresses into the
303	 * association when the COOKIE is processed or the INIT-ACK is
304	 * processed. Both types of COOKIE's existing and new call this
305	 * routine. It will remove addresses that are no longer in the
306	 * association (for the restarting case where addresses are
307	 * removed). Up front when the INIT arrives we will discard it if it
308	 * is a restart and new addresses have been added.
309	 */
310	return (0);
311}
312
313/*
314 * INIT-ACK message processing/consumption returns value < 0 on error
315 */
316static int
317sctp_process_init_ack(struct mbuf *m, int iphlen, int offset,
318    struct sctphdr *sh, struct sctp_init_ack_chunk *cp, struct sctp_tcb *stcb,
319    struct sctp_nets *net, int *abort_no_unlock, uint32_t vrf_id,
320    uint32_t table_id)
321{
322	struct sctp_association *asoc;
323	struct mbuf *op_err;
324	int retval, abort_flag;
325	uint32_t initack_limit;
326
327	/* First verify that we have no illegal param's */
328	abort_flag = 0;
329	op_err = NULL;
330
331	op_err = sctp_arethere_unrecognized_parameters(m,
332	    (offset + sizeof(struct sctp_init_chunk)),
333	    &abort_flag, (struct sctp_chunkhdr *)cp);
334	if (abort_flag) {
335		/* Send an abort and notify peer */
336		if (op_err != NULL) {
337			sctp_send_operr_to(m, iphlen, op_err,
338			    cp->init.initiate_tag, vrf_id,
339			    table_id);
340		} else {
341			/*
342			 * Just notify (abort_assoc does this if we send an
343			 * abort).
344			 */
345			sctp_abort_notification(stcb, 0);
346			/*
347			 * No sense in further INIT's since we will get the
348			 * same param back
349			 */
350			sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_3);
351			*abort_no_unlock = 1;
352		}
353		return (-1);
354	}
355	asoc = &stcb->asoc;
356	/* process the peer's parameters in the INIT-ACK */
357	retval = sctp_process_init((struct sctp_init_chunk *)cp, stcb, net);
358	if (retval < 0) {
359		return (retval);
360	}
361	initack_limit = offset + ntohs(cp->ch.chunk_length);
362	/* load all addresses */
363	if ((retval = sctp_load_addresses_from_init(stcb, m, iphlen,
364	    (offset + sizeof(struct sctp_init_chunk)), initack_limit, sh,
365	    NULL))) {
366		/* Huh, we should abort */
367#ifdef SCTP_DEBUG
368		if (sctp_debug_on & SCTP_DEBUG_INPUT1) {
369			printf("Load addresses from INIT causes an abort %d\n", retval);
370		}
371#endif
372		sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh,
373		    NULL, 0, 0);
374		*abort_no_unlock = 1;
375		return (-1);
376	}
377	stcb->asoc.peer_hmac_id = sctp_negotiate_hmacid(stcb->asoc.peer_hmacs,
378	    stcb->asoc.local_hmacs);
379	if (op_err) {
380		sctp_queue_op_err(stcb, op_err);
381		/* queuing will steal away the mbuf chain to the out queue */
382		op_err = NULL;
383	}
384	/* extract the cookie and queue it to "echo" it back... */
385	stcb->asoc.overall_error_count = 0;
386	net->error_count = 0;
387
388	/*
389	 * Cancel the INIT timer, We do this first before queueing the
390	 * cookie. We always cancel at the primary to assue that we are
391	 * canceling the timer started by the INIT which always goes to the
392	 * primary.
393	 */
394	sctp_timer_stop(SCTP_TIMER_TYPE_INIT, stcb->sctp_ep, stcb,
395	    asoc->primary_destination, SCTP_FROM_SCTP_INPUT + SCTP_LOC_4);
396
397	/* calculate the RTO */
398	net->RTO = sctp_calculate_rto(stcb, asoc, net, &asoc->time_entered);
399
400	retval = sctp_send_cookie_echo(m, offset, stcb, net);
401	if (retval < 0) {
402		/*
403		 * No cookie, we probably should send a op error. But in any
404		 * case if there is no cookie in the INIT-ACK, we can
405		 * abandon the peer, its broke.
406		 */
407		if (retval == -3) {
408			/* We abort with an error of missing mandatory param */
409			struct mbuf *op_err;
410
411			op_err =
412			    sctp_generate_invmanparam(SCTP_CAUSE_MISSING_PARAM);
413			if (op_err) {
414				/*
415				 * Expand beyond to include the mandatory
416				 * param cookie
417				 */
418				struct sctp_inv_mandatory_param *mp;
419
420				SCTP_BUF_LEN(op_err) =
421				    sizeof(struct sctp_inv_mandatory_param);
422				mp = mtod(op_err,
423				    struct sctp_inv_mandatory_param *);
424				/* Subtract the reserved param */
425				mp->length =
426				    htons(sizeof(struct sctp_inv_mandatory_param) - 2);
427				mp->num_param = htonl(1);
428				mp->param = htons(SCTP_STATE_COOKIE);
429				mp->resv = 0;
430			}
431			sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
432			    sh, op_err, 0, 0);
433			*abort_no_unlock = 1;
434		}
435		return (retval);
436	}
437	return (0);
438}
439
440static void
441sctp_handle_heartbeat_ack(struct sctp_heartbeat_chunk *cp,
442    struct sctp_tcb *stcb, struct sctp_nets *net)
443{
444	struct sockaddr_storage store;
445	struct sockaddr_in *sin;
446	struct sockaddr_in6 *sin6;
447	struct sctp_nets *r_net;
448	struct timeval tv;
449
450	if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_heartbeat_chunk)) {
451		/* Invalid length */
452		return;
453	}
454	sin = (struct sockaddr_in *)&store;
455	sin6 = (struct sockaddr_in6 *)&store;
456
457	memset(&store, 0, sizeof(store));
458	if (cp->heartbeat.hb_info.addr_family == AF_INET &&
459	    cp->heartbeat.hb_info.addr_len == sizeof(struct sockaddr_in)) {
460		sin->sin_family = cp->heartbeat.hb_info.addr_family;
461		sin->sin_len = cp->heartbeat.hb_info.addr_len;
462		sin->sin_port = stcb->rport;
463		memcpy(&sin->sin_addr, cp->heartbeat.hb_info.address,
464		    sizeof(sin->sin_addr));
465	} else if (cp->heartbeat.hb_info.addr_family == AF_INET6 &&
466	    cp->heartbeat.hb_info.addr_len == sizeof(struct sockaddr_in6)) {
467		sin6->sin6_family = cp->heartbeat.hb_info.addr_family;
468		sin6->sin6_len = cp->heartbeat.hb_info.addr_len;
469		sin6->sin6_port = stcb->rport;
470		memcpy(&sin6->sin6_addr, cp->heartbeat.hb_info.address,
471		    sizeof(sin6->sin6_addr));
472	} else {
473		return;
474	}
475	r_net = sctp_findnet(stcb, (struct sockaddr *)sin);
476	if (r_net == NULL) {
477#ifdef SCTP_DEBUG
478		if (sctp_debug_on & SCTP_DEBUG_INPUT1) {
479			printf("Huh? I can't find the address I sent it to, discard\n");
480		}
481#endif
482		return;
483	}
484	if ((r_net && (r_net->dest_state & SCTP_ADDR_UNCONFIRMED)) &&
485	    (r_net->heartbeat_random1 == cp->heartbeat.hb_info.random_value1) &&
486	    (r_net->heartbeat_random2 == cp->heartbeat.hb_info.random_value2)) {
487		/*
488		 * If the its a HB and it's random value is correct when can
489		 * confirm the destination.
490		 */
491		r_net->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
492		if (r_net->dest_state & SCTP_ADDR_REQ_PRIMARY) {
493			stcb->asoc.primary_destination = r_net;
494			r_net->dest_state &= ~SCTP_ADDR_WAS_PRIMARY;
495			r_net->dest_state &= ~SCTP_ADDR_REQ_PRIMARY;
496			r_net = TAILQ_FIRST(&stcb->asoc.nets);
497			if (r_net != stcb->asoc.primary_destination) {
498				/*
499				 * first one on the list is NOT the primary
500				 * sctp_cmpaddr() is much more efficent if
501				 * the primary is the first on the list,
502				 * make it so.
503				 */
504				TAILQ_REMOVE(&stcb->asoc.nets, stcb->asoc.primary_destination, sctp_next);
505				TAILQ_INSERT_HEAD(&stcb->asoc.nets, stcb->asoc.primary_destination, sctp_next);
506			}
507		}
508		sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
509		    stcb, 0, (void *)r_net);
510	}
511	r_net->error_count = 0;
512	r_net->hb_responded = 1;
513	tv.tv_sec = cp->heartbeat.hb_info.time_value_1;
514	tv.tv_usec = cp->heartbeat.hb_info.time_value_2;
515	if (r_net->dest_state & SCTP_ADDR_NOT_REACHABLE) {
516		r_net->dest_state &= ~SCTP_ADDR_NOT_REACHABLE;
517		r_net->dest_state |= SCTP_ADDR_REACHABLE;
518		sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_UP, stcb,
519		    SCTP_HEARTBEAT_SUCCESS, (void *)r_net);
520		/* now was it the primary? if so restore */
521		if (r_net->dest_state & SCTP_ADDR_WAS_PRIMARY) {
522			sctp_set_primary_addr(stcb, (struct sockaddr *)NULL, r_net);
523		}
524	}
525	/* Now lets do a RTO with this */
526	r_net->RTO = sctp_calculate_rto(stcb, &stcb->asoc, r_net, &tv);
527}
528
529static void
530sctp_handle_abort(struct sctp_abort_chunk *cp,
531    struct sctp_tcb *stcb, struct sctp_nets *net)
532{
533
534#ifdef SCTP_DEBUG
535	if (sctp_debug_on & SCTP_DEBUG_INPUT2) {
536		printf("sctp_handle_abort: handling ABORT\n");
537	}
538#endif
539	if (stcb == NULL)
540		return;
541	/* verify that the destination addr is in the association */
542	/* ignore abort for addresses being deleted */
543
544	/* stop any receive timers */
545	sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_5);
546	/* notify user of the abort and clean up... */
547	sctp_abort_notification(stcb, 0);
548	/* free the tcb */
549	SCTP_STAT_INCR_COUNTER32(sctps_aborted);
550	if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
551	    (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
552		SCTP_STAT_DECR_GAUGE32(sctps_currestab);
553	}
554#ifdef SCTP_ASOCLOG_OF_TSNS
555	sctp_print_out_track_log(stcb);
556#endif
557	sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_6);
558#ifdef SCTP_DEBUG
559	if (sctp_debug_on & SCTP_DEBUG_INPUT2) {
560		printf("sctp_handle_abort: finished\n");
561	}
562#endif
563}
564
565static void
566sctp_handle_shutdown(struct sctp_shutdown_chunk *cp,
567    struct sctp_tcb *stcb, struct sctp_nets *net, int *abort_flag)
568{
569	struct sctp_association *asoc;
570	int some_on_streamwheel;
571
572#ifdef SCTP_DEBUG
573	if (sctp_debug_on & SCTP_DEBUG_INPUT2) {
574		printf("sctp_handle_shutdown: handling SHUTDOWN\n");
575	}
576#endif
577	if (stcb == NULL)
578		return;
579	asoc = &stcb->asoc;
580	if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||
581	    (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) {
582		return;
583	}
584	if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_shutdown_chunk)) {
585		/* Shutdown NOT the expected size */
586		return;
587	} else {
588		sctp_update_acked(stcb, cp, net, abort_flag);
589	}
590	if (asoc->control_pdapi) {
591		/*
592		 * With a normal shutdown we assume the end of last record.
593		 */
594		SCTP_INP_READ_LOCK(stcb->sctp_ep);
595		asoc->control_pdapi->end_added = 1;
596		asoc->control_pdapi->pdapi_aborted = 1;
597		asoc->control_pdapi = NULL;
598		SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
599		sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
600	}
601	/* goto SHUTDOWN_RECEIVED state to block new requests */
602	if (stcb->sctp_socket) {
603		if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) &&
604		    (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT)) {
605			asoc->state = SCTP_STATE_SHUTDOWN_RECEIVED;
606			/*
607			 * notify upper layer that peer has initiated a
608			 * shutdown
609			 */
610			sctp_ulp_notify(SCTP_NOTIFY_PEER_SHUTDOWN, stcb, 0, NULL);
611
612			/* reset time */
613			SCTP_GETTIME_TIMEVAL(&asoc->time_entered);
614		}
615	}
616	if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) {
617		/*
618		 * stop the shutdown timer, since we WILL move to
619		 * SHUTDOWN-ACK-SENT.
620		 */
621		sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_7);
622	}
623	/* Now are we there yet? */
624	some_on_streamwheel = 0;
625	if (!TAILQ_EMPTY(&asoc->out_wheel)) {
626		/* Check to see if some data queued */
627		struct sctp_stream_out *outs;
628
629		TAILQ_FOREACH(outs, &asoc->out_wheel, next_spoke) {
630			if (!TAILQ_EMPTY(&outs->outqueue)) {
631				some_on_streamwheel = 1;
632				break;
633			}
634		}
635	}
636	if (!TAILQ_EMPTY(&asoc->send_queue) ||
637	    !TAILQ_EMPTY(&asoc->sent_queue) ||
638	    some_on_streamwheel) {
639		/* By returning we will push more data out */
640		return;
641	} else {
642		/* no outstanding data to send, so move on... */
643		/* send SHUTDOWN-ACK */
644		sctp_send_shutdown_ack(stcb, stcb->asoc.primary_destination);
645		/* move to SHUTDOWN-ACK-SENT state */
646		if ((SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) ||
647		    (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
648			SCTP_STAT_DECR_GAUGE32(sctps_currestab);
649		}
650		asoc->state = SCTP_STATE_SHUTDOWN_ACK_SENT;
651
652		/* start SHUTDOWN timer */
653		sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNACK, stcb->sctp_ep,
654		    stcb, net);
655	}
656}
657
658static void
659sctp_handle_shutdown_ack(struct sctp_shutdown_ack_chunk *cp,
660    struct sctp_tcb *stcb, struct sctp_nets *net)
661{
662	struct sctp_association *asoc;
663
664#ifdef SCTP_DEBUG
665	if (sctp_debug_on & SCTP_DEBUG_INPUT2) {
666		printf("sctp_handle_shutdown_ack: handling SHUTDOWN ACK\n");
667	}
668#endif
669	if (stcb == NULL)
670		return;
671
672	asoc = &stcb->asoc;
673	/* process according to association state */
674	if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) &&
675	    (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) {
676		/* unexpected SHUTDOWN-ACK... so ignore... */
677		SCTP_TCB_UNLOCK(stcb);
678		return;
679	}
680	if (asoc->control_pdapi) {
681		/*
682		 * With a normal shutdown we assume the end of last record.
683		 */
684		SCTP_INP_READ_LOCK(stcb->sctp_ep);
685		asoc->control_pdapi->end_added = 1;
686		asoc->control_pdapi->pdapi_aborted = 1;
687		asoc->control_pdapi = NULL;
688		SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
689		sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
690	}
691	/* are the queues empty? */
692	if (!TAILQ_EMPTY(&asoc->send_queue) ||
693	    !TAILQ_EMPTY(&asoc->sent_queue) ||
694	    !TAILQ_EMPTY(&asoc->out_wheel)) {
695		sctp_report_all_outbound(stcb, 0);
696	}
697	/* stop the timer */
698	sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_8);
699	/* send SHUTDOWN-COMPLETE */
700	sctp_send_shutdown_complete(stcb, net);
701	/* notify upper layer protocol */
702	if (stcb->sctp_socket) {
703		sctp_ulp_notify(SCTP_NOTIFY_ASSOC_DOWN, stcb, 0, NULL);
704		if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
705		    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
706			/* Set the connected flag to disconnected */
707			stcb->sctp_ep->sctp_socket->so_snd.sb_cc = 0;
708		}
709	}
710	SCTP_STAT_INCR_COUNTER32(sctps_shutdown);
711	/* free the TCB but first save off the ep */
712	sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC,
713	    SCTP_FROM_SCTP_INPUT + SCTP_LOC_9);
714}
715
716/*
717 * Skip past the param header and then we will find the chunk that caused the
718 * problem. There are two possiblities ASCONF or FWD-TSN other than that and
719 * our peer must be broken.
720 */
721static void
722sctp_process_unrecog_chunk(struct sctp_tcb *stcb, struct sctp_paramhdr *phdr,
723    struct sctp_nets *net)
724{
725	struct sctp_chunkhdr *chk;
726
727	chk = (struct sctp_chunkhdr *)((caddr_t)phdr + sizeof(*phdr));
728	switch (chk->chunk_type) {
729	case SCTP_ASCONF_ACK:
730	case SCTP_ASCONF:
731		sctp_asconf_cleanup(stcb, net);
732		break;
733	case SCTP_FORWARD_CUM_TSN:
734		stcb->asoc.peer_supports_prsctp = 0;
735		break;
736	default:
737#ifdef SCTP_DEBUG
738		if (sctp_debug_on & SCTP_DEBUG_INPUT2) {
739			printf("Peer does not support chunk type %d(%x)??\n",
740			    chk->chunk_type, (uint32_t) chk->chunk_type);
741		}
742#endif
743		break;
744	}
745}
746
747/*
748 * Skip past the param header and then we will find the param that caused the
749 * problem.  There are a number of param's in a ASCONF OR the prsctp param
750 * these will turn of specific features.
751 */
752static void
753sctp_process_unrecog_param(struct sctp_tcb *stcb, struct sctp_paramhdr *phdr)
754{
755	struct sctp_paramhdr *pbad;
756
757	pbad = phdr + 1;
758	switch (ntohs(pbad->param_type)) {
759		/* pr-sctp draft */
760	case SCTP_PRSCTP_SUPPORTED:
761		stcb->asoc.peer_supports_prsctp = 0;
762		break;
763	case SCTP_SUPPORTED_CHUNK_EXT:
764		break;
765		/* draft-ietf-tsvwg-addip-sctp */
766	case SCTP_ECN_NONCE_SUPPORTED:
767		stcb->asoc.peer_supports_ecn_nonce = 0;
768		stcb->asoc.ecn_nonce_allowed = 0;
769		stcb->asoc.ecn_allowed = 0;
770		break;
771	case SCTP_ADD_IP_ADDRESS:
772	case SCTP_DEL_IP_ADDRESS:
773	case SCTP_SET_PRIM_ADDR:
774		stcb->asoc.peer_supports_asconf = 0;
775		break;
776	case SCTP_SUCCESS_REPORT:
777	case SCTP_ERROR_CAUSE_IND:
778#ifdef SCTP_DEBUG
779		if (sctp_debug_on & SCTP_DEBUG_INPUT2) {
780			printf("Huh, the peer does not support success? or error cause?\n");
781			printf("Turning off ASCONF to this strange peer\n");
782		}
783#endif
784		stcb->asoc.peer_supports_asconf = 0;
785		break;
786	default:
787#ifdef SCTP_DEBUG
788		if (sctp_debug_on & SCTP_DEBUG_INPUT2) {
789			printf("Peer does not support param type %d(%x)??\n",
790			    pbad->param_type, (uint32_t) pbad->param_type);
791		}
792#endif
793		break;
794	}
795}
796
797static int
798sctp_handle_error(struct sctp_chunkhdr *ch,
799    struct sctp_tcb *stcb, struct sctp_nets *net)
800{
801	int chklen;
802	struct sctp_paramhdr *phdr;
803	uint16_t error_type;
804	uint16_t error_len;
805	struct sctp_association *asoc;
806
807	int adjust;
808
809	/* parse through all of the errors and process */
810	asoc = &stcb->asoc;
811	phdr = (struct sctp_paramhdr *)((caddr_t)ch +
812	    sizeof(struct sctp_chunkhdr));
813	chklen = ntohs(ch->chunk_length) - sizeof(struct sctp_chunkhdr);
814	while ((size_t)chklen >= sizeof(struct sctp_paramhdr)) {
815		/* Process an Error Cause */
816		error_type = ntohs(phdr->param_type);
817		error_len = ntohs(phdr->param_length);
818		if ((error_len > chklen) || (error_len == 0)) {
819			/* invalid param length for this param */
820#ifdef SCTP_DEBUG
821			if (sctp_debug_on & SCTP_DEBUG_INPUT1) {
822				printf("Bogus length in error param- chunk left:%d errorlen:%d\n",
823				    chklen, error_len);
824			}
825#endif				/* SCTP_DEBUG */
826			return (0);
827		}
828		switch (error_type) {
829		case SCTP_CAUSE_INVALID_STREAM:
830		case SCTP_CAUSE_MISSING_PARAM:
831		case SCTP_CAUSE_INVALID_PARAM:
832		case SCTP_CAUSE_NO_USER_DATA:
833#ifdef SCTP_DEBUG
834			if (sctp_debug_on & SCTP_DEBUG_INPUT1) {
835				printf("Software error we got a %d back? We have a bug :/ (or do they?)\n",
836				    error_type);
837			}
838#endif
839			break;
840		case SCTP_CAUSE_STALE_COOKIE:
841			/*
842			 * We only act if we have echoed a cookie and are
843			 * waiting.
844			 */
845			if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) {
846				int *p;
847
848				p = (int *)((caddr_t)phdr + sizeof(*phdr));
849				/* Save the time doubled */
850				asoc->cookie_preserve_req = ntohl(*p) << 1;
851				asoc->stale_cookie_count++;
852				if (asoc->stale_cookie_count >
853				    asoc->max_init_times) {
854					sctp_abort_notification(stcb, 0);
855					/* now free the asoc */
856					sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_10);
857					return (-1);
858				}
859				/* blast back to INIT state */
860				asoc->state &= ~SCTP_STATE_COOKIE_ECHOED;
861				asoc->state |= SCTP_STATE_COOKIE_WAIT;
862
863				sctp_stop_all_cookie_timers(stcb);
864				sctp_send_initiate(stcb->sctp_ep, stcb);
865			}
866			break;
867		case SCTP_CAUSE_UNRESOLVABLE_ADDR:
868			/*
869			 * Nothing we can do here, we don't do hostname
870			 * addresses so if the peer does not like my IPv6
871			 * (or IPv4 for that matter) it does not matter. If
872			 * they don't support that type of address, they can
873			 * NOT possibly get that packet type... i.e. with no
874			 * IPv6 you can't recieve a IPv6 packet. so we can
875			 * safely ignore this one. If we ever added support
876			 * for HOSTNAME Addresses, then we would need to do
877			 * something here.
878			 */
879			break;
880		case SCTP_CAUSE_UNRECOG_CHUNK:
881			sctp_process_unrecog_chunk(stcb, phdr, net);
882			break;
883		case SCTP_CAUSE_UNRECOG_PARAM:
884			sctp_process_unrecog_param(stcb, phdr);
885			break;
886		case SCTP_CAUSE_COOKIE_IN_SHUTDOWN:
887			/*
888			 * We ignore this since the timer will drive out a
889			 * new cookie anyway and there timer will drive us
890			 * to send a SHUTDOWN_COMPLETE. We can't send one
891			 * here since we don't have their tag.
892			 */
893			break;
894		case SCTP_CAUSE_DELETING_LAST_ADDR:
895		case SCTP_CAUSE_RESOURCE_SHORTAGE:
896		case SCTP_CAUSE_DELETING_SRC_ADDR:
897			/*
898			 * We should NOT get these here, but in a
899			 * ASCONF-ACK.
900			 */
901#ifdef SCTP_DEBUG
902			if (sctp_debug_on & SCTP_DEBUG_INPUT2) {
903				printf("Peer sends ASCONF errors in a Operational Error?<%d>?\n",
904				    error_type);
905			}
906#endif
907			break;
908		case SCTP_CAUSE_OUT_OF_RESC:
909			/*
910			 * And what, pray tell do we do with the fact that
911			 * the peer is out of resources? Not really sure we
912			 * could do anything but abort. I suspect this
913			 * should have came WITH an abort instead of in a
914			 * OP-ERROR.
915			 */
916			break;
917		default:
918#ifdef SCTP_DEBUG
919			if (sctp_debug_on & SCTP_DEBUG_INPUT1) {
920				/* don't know what this error cause is... */
921				printf("sctp_handle_error: unknown error type = 0x%xh\n",
922				    error_type);
923			}
924#endif				/* SCTP_DEBUG */
925			break;
926		}
927		adjust = SCTP_SIZE32(error_len);
928		chklen -= adjust;
929		phdr = (struct sctp_paramhdr *)((caddr_t)phdr + adjust);
930	}
931	return (0);
932}
933
934static int
935sctp_handle_init_ack(struct mbuf *m, int iphlen, int offset,
936    struct sctphdr *sh, struct sctp_init_ack_chunk *cp, struct sctp_tcb *stcb,
937    struct sctp_nets *net, int *abort_no_unlock, uint32_t vrf_id,
938    uint32_t table_id)
939{
940	struct sctp_init_ack *init_ack;
941	int *state;
942	struct mbuf *op_err;
943
944#ifdef SCTP_DEBUG
945	if (sctp_debug_on & SCTP_DEBUG_INPUT2) {
946		printf("sctp_handle_init_ack: handling INIT-ACK\n");
947	}
948#endif
949	if (stcb == NULL) {
950#ifdef SCTP_DEBUG
951		if (sctp_debug_on & SCTP_DEBUG_INPUT2) {
952			printf("sctp_handle_init_ack: TCB is null\n");
953		}
954#endif
955		return (-1);
956	}
957	if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_init_ack_chunk)) {
958		/* Invalid length */
959		op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
960		sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh,
961		    op_err, 0, 0);
962		*abort_no_unlock = 1;
963		return (-1);
964	}
965	init_ack = &cp->init;
966	/* validate parameters */
967	if (init_ack->initiate_tag == 0) {
968		/* protocol error... send an abort */
969		op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
970		sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh,
971		    op_err, 0, 0);
972		*abort_no_unlock = 1;
973		return (-1);
974	}
975	if (ntohl(init_ack->a_rwnd) < SCTP_MIN_RWND) {
976		/* protocol error... send an abort */
977		op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
978		sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh,
979		    op_err, 0, 0);
980		*abort_no_unlock = 1;
981		return (-1);
982	}
983	if (init_ack->num_inbound_streams == 0) {
984		/* protocol error... send an abort */
985		op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
986		sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh,
987		    op_err, 0, 0);
988		*abort_no_unlock = 1;
989		return (-1);
990	}
991	if (init_ack->num_outbound_streams == 0) {
992		/* protocol error... send an abort */
993		op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
994		sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh,
995		    op_err, 0, 0);
996		*abort_no_unlock = 1;
997		return (-1);
998	}
999	/* process according to association state... */
1000	state = &stcb->asoc.state;
1001	switch (*state & SCTP_STATE_MASK) {
1002	case SCTP_STATE_COOKIE_WAIT:
1003		/* this is the expected state for this chunk */
1004		/* process the INIT-ACK parameters */
1005		if (stcb->asoc.primary_destination->dest_state &
1006		    SCTP_ADDR_UNCONFIRMED) {
1007			/*
1008			 * The primary is where we sent the INIT, we can
1009			 * always consider it confirmed when the INIT-ACK is
1010			 * returned. Do this before we load addresses
1011			 * though.
1012			 */
1013			stcb->asoc.primary_destination->dest_state &=
1014			    ~SCTP_ADDR_UNCONFIRMED;
1015			sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
1016			    stcb, 0, (void *)stcb->asoc.primary_destination);
1017		}
1018		if (sctp_process_init_ack(m, iphlen, offset, sh, cp, stcb,
1019		    net, abort_no_unlock, vrf_id,
1020		    table_id) < 0) {
1021			/* error in parsing parameters */
1022			return (-1);
1023		}
1024		/* update our state */
1025#ifdef SCTP_DEBUG
1026		if (sctp_debug_on & SCTP_DEBUG_INPUT2) {
1027			printf("moving to COOKIE-ECHOED state\n");
1028		}
1029#endif
1030		if (*state & SCTP_STATE_SHUTDOWN_PENDING) {
1031			*state = SCTP_STATE_COOKIE_ECHOED |
1032			    SCTP_STATE_SHUTDOWN_PENDING;
1033		} else {
1034			*state = SCTP_STATE_COOKIE_ECHOED;
1035		}
1036
1037		/* reset the RTO calc */
1038		stcb->asoc.overall_error_count = 0;
1039		SCTP_GETTIME_TIMEVAL(&stcb->asoc.time_entered);
1040		/*
1041		 * collapse the init timer back in case of a exponential
1042		 * backoff
1043		 */
1044		sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, stcb->sctp_ep,
1045		    stcb, net);
1046		/*
1047		 * the send at the end of the inbound data processing will
1048		 * cause the cookie to be sent
1049		 */
1050		break;
1051	case SCTP_STATE_SHUTDOWN_SENT:
1052		/* incorrect state... discard */
1053		break;
1054	case SCTP_STATE_COOKIE_ECHOED:
1055		/* incorrect state... discard */
1056		break;
1057	case SCTP_STATE_OPEN:
1058		/* incorrect state... discard */
1059		break;
1060	case SCTP_STATE_EMPTY:
1061	case SCTP_STATE_INUSE:
1062	default:
1063		/* incorrect state... discard */
1064		return (-1);
1065		break;
1066	}			/* end switch asoc state */
1067#ifdef SCTP_DEBUG
1068	if (sctp_debug_on & SCTP_DEBUG_INPUT1) {
1069		printf("Leaving handle-init-ack end\n");
1070	}
1071#endif
1072	return (0);
1073}
1074
1075
1076/*
1077 * handle a state cookie for an existing association m: input packet mbuf
1078 * chain-- assumes a pullup on IP/SCTP/COOKIE-ECHO chunk note: this is a
1079 * "split" mbuf and the cookie signature does not exist offset: offset into
1080 * mbuf to the cookie-echo chunk
1081 */
1082static struct sctp_tcb *
1083sctp_process_cookie_existing(struct mbuf *m, int iphlen, int offset,
1084    struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len,
1085    struct sctp_inpcb *inp, struct sctp_tcb *stcb, struct sctp_nets *net,
1086    struct sockaddr *init_src, int *notification, sctp_assoc_t * sac_assoc_id,
1087    uint32_t vrf_id, uint32_t table_id)
1088{
1089	struct sctp_association *asoc;
1090	struct sctp_init_chunk *init_cp, init_buf;
1091	struct sctp_init_ack_chunk *initack_cp, initack_buf;
1092	int chk_length;
1093	int init_offset, initack_offset, i;
1094	int retval;
1095	int spec_flag = 0;
1096	int how_indx;
1097
1098	/* I know that the TCB is non-NULL from the caller */
1099	asoc = &stcb->asoc;
1100	for (how_indx = 0; how_indx < sizeof(asoc->cookie_how); how_indx++) {
1101		if (asoc->cookie_how[how_indx] == 0)
1102			break;
1103	}
1104	if (how_indx < sizeof(asoc->cookie_how)) {
1105		asoc->cookie_how[how_indx] = 1;
1106	}
1107	if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) {
1108		/* SHUTDOWN came in after sending INIT-ACK */
1109		struct mbuf *op_err;
1110		struct sctp_paramhdr *ph;
1111
1112		sctp_send_shutdown_ack(stcb, stcb->asoc.primary_destination);
1113		op_err = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr),
1114		    0, M_DONTWAIT, 1, MT_DATA);
1115		if (op_err == NULL) {
1116			/* FOOBAR */
1117			return (NULL);
1118		}
1119		/* pre-reserve some space */
1120		SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr));
1121		SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr));
1122		SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr));
1123		/* Set the len */
1124		SCTP_BUF_LEN(op_err) = sizeof(struct sctp_paramhdr);
1125		ph = mtod(op_err, struct sctp_paramhdr *);
1126		ph->param_type = htons(SCTP_CAUSE_COOKIE_IN_SHUTDOWN);
1127		ph->param_length = htons(sizeof(struct sctp_paramhdr));
1128		sctp_send_operr_to(m, iphlen, op_err, cookie->peers_vtag,
1129		    vrf_id, table_id);
1130		if (how_indx < sizeof(asoc->cookie_how))
1131			asoc->cookie_how[how_indx] = 2;
1132		return (NULL);
1133	}
1134	/*
1135	 * find and validate the INIT chunk in the cookie (peer's info) the
1136	 * INIT should start after the cookie-echo header struct (chunk
1137	 * header, state cookie header struct)
1138	 */
1139	init_offset = offset += sizeof(struct sctp_cookie_echo_chunk);
1140
1141	init_cp = (struct sctp_init_chunk *)
1142	    sctp_m_getptr(m, init_offset, sizeof(struct sctp_init_chunk),
1143	    (uint8_t *) & init_buf);
1144	if (init_cp == NULL) {
1145		/* could not pull a INIT chunk in cookie */
1146		return (NULL);
1147	}
1148	chk_length = ntohs(init_cp->ch.chunk_length);
1149	if (init_cp->ch.chunk_type != SCTP_INITIATION) {
1150		return (NULL);
1151	}
1152	/*
1153	 * find and validate the INIT-ACK chunk in the cookie (my info) the
1154	 * INIT-ACK follows the INIT chunk
1155	 */
1156	initack_offset = init_offset + SCTP_SIZE32(chk_length);
1157	initack_cp = (struct sctp_init_ack_chunk *)
1158	    sctp_m_getptr(m, initack_offset, sizeof(struct sctp_init_ack_chunk),
1159	    (uint8_t *) & initack_buf);
1160	if (initack_cp == NULL) {
1161		/* could not pull INIT-ACK chunk in cookie */
1162		return (NULL);
1163	}
1164	chk_length = ntohs(initack_cp->ch.chunk_length);
1165	if (initack_cp->ch.chunk_type != SCTP_INITIATION_ACK) {
1166		return (NULL);
1167	}
1168	if ((ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag) &&
1169	    (ntohl(init_cp->init.initiate_tag) == asoc->peer_vtag)) {
1170		/*
1171		 * case D in Section 5.2.4 Table 2: MMAA process accordingly
1172		 * to get into the OPEN state
1173		 */
1174		if (ntohl(initack_cp->init.initial_tsn) != asoc->init_seq_number) {
1175#ifdef INVARIANTS
1176			panic("Case D and non-match seq?");
1177#else
1178			printf("Case D, seq non-match %x vs %x?\n",
1179			    ntohl(initack_cp->init.initial_tsn), asoc->init_seq_number);
1180#endif
1181		}
1182		switch SCTP_GET_STATE
1183			(asoc) {
1184		case SCTP_STATE_COOKIE_WAIT:
1185		case SCTP_STATE_COOKIE_ECHOED:
1186			/*
1187			 * INIT was sent but got a COOKIE_ECHO with the
1188			 * correct tags... just accept it...but we must
1189			 * process the init so that we can make sure we have
1190			 * the right seq no's.
1191			 */
1192			/* First we must process the INIT !! */
1193			retval = sctp_process_init(init_cp, stcb, net);
1194			if (retval < 0) {
1195				if (how_indx < sizeof(asoc->cookie_how))
1196					asoc->cookie_how[how_indx] = 3;
1197				return (NULL);
1198			}
1199			/* we have already processed the INIT so no problem */
1200			sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb,
1201			    net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_11);
1202			sctp_timer_stop(SCTP_TIMER_TYPE_INIT, inp, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_12);
1203			/* update current state */
1204			if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)
1205				SCTP_STAT_INCR_COUNTER32(sctps_activeestab);
1206			else
1207				SCTP_STAT_INCR_COUNTER32(sctps_collisionestab);
1208			if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
1209				asoc->state = SCTP_STATE_OPEN | SCTP_STATE_SHUTDOWN_PENDING;
1210				sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
1211				    stcb->sctp_ep, stcb, asoc->primary_destination);
1212
1213			} else {
1214				/* if ok, move to OPEN state */
1215				asoc->state = SCTP_STATE_OPEN;
1216			}
1217			SCTP_STAT_INCR_GAUGE32(sctps_currestab);
1218			sctp_stop_all_cookie_timers(stcb);
1219			if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
1220			    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
1221			    (inp->sctp_socket->so_qlimit == 0)
1222			    ) {
1223				/*
1224				 * Here is where collision would go if we
1225				 * did a connect() and instead got a
1226				 * init/init-ack/cookie done before the
1227				 * init-ack came back..
1228				 */
1229				stcb->sctp_ep->sctp_flags |=
1230				    SCTP_PCB_FLAGS_CONNECTED;
1231				soisconnected(stcb->sctp_ep->sctp_socket);
1232			}
1233			/* notify upper layer */
1234			*notification = SCTP_NOTIFY_ASSOC_UP;
1235			/*
1236			 * since we did not send a HB make sure we don't
1237			 * double things
1238			 */
1239			net->hb_responded = 1;
1240
1241			if (stcb->asoc.sctp_autoclose_ticks &&
1242			    (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE))) {
1243				sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE,
1244				    inp, stcb, NULL);
1245			}
1246			break;
1247		default:
1248			/*
1249			 * we're in the OPEN state (or beyond), so peer must
1250			 * have simply lost the COOKIE-ACK
1251			 */
1252			break;
1253			}	/* end switch */
1254		sctp_stop_all_cookie_timers(stcb);
1255		/*
1256		 * We ignore the return code here.. not sure if we should
1257		 * somehow abort.. but we do have an existing asoc. This
1258		 * really should not fail.
1259		 */
1260		if (sctp_load_addresses_from_init(stcb, m, iphlen,
1261		    init_offset + sizeof(struct sctp_init_chunk),
1262		    initack_offset, sh, init_src)) {
1263			if (how_indx < sizeof(asoc->cookie_how))
1264				asoc->cookie_how[how_indx] = 4;
1265			return (NULL);
1266		}
1267		/* respond with a COOKIE-ACK */
1268		sctp_toss_old_cookies(stcb, asoc);
1269		sctp_send_cookie_ack(stcb);
1270		if (how_indx < sizeof(asoc->cookie_how))
1271			asoc->cookie_how[how_indx] = 5;
1272		return (stcb);
1273	}
1274	if (ntohl(initack_cp->init.initiate_tag) != asoc->my_vtag &&
1275	    ntohl(init_cp->init.initiate_tag) == asoc->peer_vtag &&
1276	    cookie->tie_tag_my_vtag == 0 &&
1277	    cookie->tie_tag_peer_vtag == 0) {
1278		/*
1279		 * case C in Section 5.2.4 Table 2: XMOO silently discard
1280		 */
1281		if (how_indx < sizeof(asoc->cookie_how))
1282			asoc->cookie_how[how_indx] = 6;
1283		return (NULL);
1284	}
1285	if (ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag &&
1286	    (ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag ||
1287	    init_cp->init.initiate_tag == 0)) {
1288		/*
1289		 * case B in Section 5.2.4 Table 2: MXAA or MOAA my info
1290		 * should be ok, re-accept peer info
1291		 */
1292		if (ntohl(initack_cp->init.initial_tsn) != asoc->init_seq_number) {
1293			/*
1294			 * Extension of case C. If we hit this, then the
1295			 * random number generator returned the same vtag
1296			 * when we first sent our INIT-ACK and when we later
1297			 * sent our INIT. The side with the seq numbers that
1298			 * are different will be the one that normnally
1299			 * would have hit case C. This in effect "extends"
1300			 * our vtags in this collision case to be 64 bits.
1301			 * The same collision could occur aka you get both
1302			 * vtag and seq number the same twice in a row.. but
1303			 * is much less likely. If it did happen then we
1304			 * would proceed through and bring up the assoc.. we
1305			 * may end up with the wrong stream setup however..
1306			 * which would be bad.. but there is no way to
1307			 * tell.. until we send on a stream that does not
1308			 * exist :-)
1309			 */
1310			if (how_indx < sizeof(asoc->cookie_how))
1311				asoc->cookie_how[how_indx] = 7;
1312
1313			return (NULL);
1314		}
1315		if (how_indx < sizeof(asoc->cookie_how))
1316			asoc->cookie_how[how_indx] = 8;
1317		sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_13);
1318		sctp_stop_all_cookie_timers(stcb);
1319		/*
1320		 * since we did not send a HB make sure we don't double
1321		 * things
1322		 */
1323		net->hb_responded = 1;
1324		if (stcb->asoc.sctp_autoclose_ticks &&
1325		    sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE)) {
1326			sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb,
1327			    NULL);
1328		}
1329		asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd);
1330		asoc->pre_open_streams = ntohs(initack_cp->init.num_outbound_streams);
1331
1332		/* Note last_cwr_tsn? where is this used? */
1333		asoc->last_cwr_tsn = asoc->init_seq_number - 1;
1334		if (ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) {
1335			/*
1336			 * Ok the peer probably discarded our data (if we
1337			 * echoed a cookie+data). So anything on the
1338			 * sent_queue should be marked for retransmit, we
1339			 * may not get something to kick us so it COULD
1340			 * still take a timeout to move these.. but it can't
1341			 * hurt to mark them.
1342			 */
1343			struct sctp_tmit_chunk *chk;
1344
1345			TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
1346				if (chk->sent < SCTP_DATAGRAM_RESEND) {
1347					chk->sent = SCTP_DATAGRAM_RESEND;
1348					sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
1349					spec_flag++;
1350				}
1351			}
1352
1353		}
1354		/* process the INIT info (peer's info) */
1355		retval = sctp_process_init(init_cp, stcb, net);
1356		if (retval < 0) {
1357			if (how_indx < sizeof(asoc->cookie_how))
1358				asoc->cookie_how[how_indx] = 9;
1359			return (NULL);
1360		}
1361		if (sctp_load_addresses_from_init(stcb, m, iphlen,
1362		    init_offset + sizeof(struct sctp_init_chunk),
1363		    initack_offset, sh, init_src)) {
1364			if (how_indx < sizeof(asoc->cookie_how))
1365				asoc->cookie_how[how_indx] = 10;
1366			return (NULL);
1367		}
1368		if ((asoc->state & SCTP_STATE_COOKIE_WAIT) ||
1369		    (asoc->state & SCTP_STATE_COOKIE_ECHOED)) {
1370			*notification = SCTP_NOTIFY_ASSOC_UP;
1371
1372			if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
1373			    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
1374			    (inp->sctp_socket->so_qlimit == 0)) {
1375				stcb->sctp_ep->sctp_flags |=
1376				    SCTP_PCB_FLAGS_CONNECTED;
1377				soisconnected(stcb->sctp_ep->sctp_socket);
1378			}
1379			if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)
1380				SCTP_STAT_INCR_COUNTER32(sctps_activeestab);
1381			else
1382				SCTP_STAT_INCR_COUNTER32(sctps_collisionestab);
1383			SCTP_STAT_INCR_COUNTER32(sctps_activeestab);
1384			SCTP_STAT_INCR_GAUGE32(sctps_currestab);
1385		} else if (SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) {
1386			SCTP_STAT_INCR_COUNTER32(sctps_restartestab);
1387		} else {
1388			SCTP_STAT_INCR_COUNTER32(sctps_collisionestab);
1389		}
1390		if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
1391			asoc->state = SCTP_STATE_OPEN | SCTP_STATE_SHUTDOWN_PENDING;
1392			sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
1393			    stcb->sctp_ep, stcb, asoc->primary_destination);
1394
1395		} else {
1396			asoc->state = SCTP_STATE_OPEN;
1397		}
1398		sctp_stop_all_cookie_timers(stcb);
1399		sctp_toss_old_cookies(stcb, asoc);
1400		sctp_send_cookie_ack(stcb);
1401		if (spec_flag) {
1402			/*
1403			 * only if we have retrans set do we do this. What
1404			 * this call does is get only the COOKIE-ACK out and
1405			 * then when we return the normal call to
1406			 * sctp_chunk_output will get the retrans out behind
1407			 * this.
1408			 */
1409			sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_COOKIE_ACK);
1410		}
1411		if (how_indx < sizeof(asoc->cookie_how))
1412			asoc->cookie_how[how_indx] = 11;
1413
1414		return (stcb);
1415	}
1416	if ((ntohl(initack_cp->init.initiate_tag) != asoc->my_vtag &&
1417	    ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) &&
1418	    cookie->tie_tag_my_vtag == asoc->my_vtag_nonce &&
1419	    cookie->tie_tag_peer_vtag == asoc->peer_vtag_nonce &&
1420	    cookie->tie_tag_peer_vtag != 0) {
1421		struct sctpasochead *head;
1422
1423		/*
1424		 * case A in Section 5.2.4 Table 2: XXMM (peer restarted)
1425		 */
1426		/* temp code */
1427		if (how_indx < sizeof(asoc->cookie_how))
1428			asoc->cookie_how[how_indx] = 12;
1429		sctp_timer_stop(SCTP_TIMER_TYPE_INIT, inp, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_14);
1430		sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_15);
1431
1432		*sac_assoc_id = sctp_get_associd(stcb);
1433		/* notify upper layer */
1434		*notification = SCTP_NOTIFY_ASSOC_RESTART;
1435		atomic_add_int(&stcb->asoc.refcnt, 1);
1436		if ((SCTP_GET_STATE(asoc) != SCTP_STATE_OPEN) &&
1437		    (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) &&
1438		    (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT)) {
1439			SCTP_STAT_INCR_GAUGE32(sctps_currestab);
1440		}
1441		if (SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) {
1442			SCTP_STAT_INCR_GAUGE32(sctps_restartestab);
1443		} else if (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) {
1444			SCTP_STAT_INCR_GAUGE32(sctps_collisionestab);
1445		}
1446		if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
1447			asoc->state = SCTP_STATE_OPEN |
1448			    SCTP_STATE_SHUTDOWN_PENDING;
1449			sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
1450			    stcb->sctp_ep, stcb, asoc->primary_destination);
1451
1452		} else if (!(asoc->state & SCTP_STATE_SHUTDOWN_SENT)) {
1453			/* move to OPEN state, if not in SHUTDOWN_SENT */
1454			asoc->state = SCTP_STATE_OPEN;
1455		}
1456		asoc->pre_open_streams =
1457		    ntohs(initack_cp->init.num_outbound_streams);
1458		asoc->init_seq_number = ntohl(initack_cp->init.initial_tsn);
1459		asoc->sending_seq = asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number;
1460
1461		asoc->last_cwr_tsn = asoc->init_seq_number - 1;
1462		asoc->asconf_seq_in = asoc->last_acked_seq = asoc->init_seq_number - 1;
1463
1464		asoc->str_reset_seq_in = asoc->init_seq_number;
1465
1466		asoc->advanced_peer_ack_point = asoc->last_acked_seq;
1467		if (asoc->mapping_array)
1468			memset(asoc->mapping_array, 0,
1469			    asoc->mapping_array_size);
1470		SCTP_TCB_UNLOCK(stcb);
1471		SCTP_INP_INFO_WLOCK();
1472		SCTP_INP_WLOCK(stcb->sctp_ep);
1473		SCTP_TCB_LOCK(stcb);
1474		atomic_add_int(&stcb->asoc.refcnt, -1);
1475		/* send up all the data */
1476		SCTP_TCB_SEND_LOCK(stcb);
1477
1478		sctp_report_all_outbound(stcb, 1);
1479		for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
1480			stcb->asoc.strmout[i].stream_no = i;
1481			stcb->asoc.strmout[i].next_sequence_sent = 0;
1482			stcb->asoc.strmout[i].last_msg_incomplete = 0;
1483		}
1484		/* process the INIT-ACK info (my info) */
1485		asoc->my_vtag = ntohl(initack_cp->init.initiate_tag);
1486		asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd);
1487
1488		/* pull from vtag hash */
1489		LIST_REMOVE(stcb, sctp_asocs);
1490		/* re-insert to new vtag position */
1491		head = &sctppcbinfo.sctp_asochash[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag,
1492		    sctppcbinfo.hashasocmark)];
1493		/*
1494		 * put it in the bucket in the vtag hash of assoc's for the
1495		 * system
1496		 */
1497		LIST_INSERT_HEAD(head, stcb, sctp_asocs);
1498
1499		/* Is this the first restart? */
1500		if (stcb->asoc.in_restart_hash == 0) {
1501			/* Ok add it to assoc_id vtag hash */
1502			head = &sctppcbinfo.sctp_restarthash[SCTP_PCBHASH_ASOC(stcb->asoc.assoc_id,
1503			    sctppcbinfo.hashrestartmark)];
1504			LIST_INSERT_HEAD(head, stcb, sctp_tcbrestarhash);
1505			stcb->asoc.in_restart_hash = 1;
1506		}
1507		/* process the INIT info (peer's info) */
1508		SCTP_TCB_SEND_UNLOCK(stcb);
1509		SCTP_INP_WUNLOCK(stcb->sctp_ep);
1510		SCTP_INP_INFO_WUNLOCK();
1511
1512		retval = sctp_process_init(init_cp, stcb, net);
1513		if (retval < 0) {
1514			if (how_indx < sizeof(asoc->cookie_how))
1515				asoc->cookie_how[how_indx] = 13;
1516
1517			return (NULL);
1518		}
1519		/*
1520		 * since we did not send a HB make sure we don't double
1521		 * things
1522		 */
1523		net->hb_responded = 1;
1524
1525		if (sctp_load_addresses_from_init(stcb, m, iphlen,
1526		    init_offset + sizeof(struct sctp_init_chunk),
1527		    initack_offset, sh, init_src)) {
1528			if (how_indx < sizeof(asoc->cookie_how))
1529				asoc->cookie_how[how_indx] = 14;
1530
1531			return (NULL);
1532		}
1533		/* respond with a COOKIE-ACK */
1534		sctp_stop_all_cookie_timers(stcb);
1535		sctp_toss_old_cookies(stcb, asoc);
1536		sctp_send_cookie_ack(stcb);
1537		if (how_indx < sizeof(asoc->cookie_how))
1538			asoc->cookie_how[how_indx] = 15;
1539
1540		return (stcb);
1541	}
1542	if (how_indx < sizeof(asoc->cookie_how))
1543		asoc->cookie_how[how_indx] = 16;
1544	/* all other cases... */
1545	return (NULL);
1546}
1547
1548
1549/*
1550 * handle a state cookie for a new association m: input packet mbuf chain--
1551 * assumes a pullup on IP/SCTP/COOKIE-ECHO chunk note: this is a "split" mbuf
1552 * and the cookie signature does not exist offset: offset into mbuf to the
1553 * cookie-echo chunk length: length of the cookie chunk to: where the init
1554 * was from returns a new TCB
1555 */
1556static struct sctp_tcb *
1557sctp_process_cookie_new(struct mbuf *m, int iphlen, int offset,
1558    struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len,
1559    struct sctp_inpcb *inp, struct sctp_nets **netp,
1560    struct sockaddr *init_src, int *notification,
1561    int auth_skipped, uint32_t auth_offset, uint32_t auth_len,
1562    uint32_t vrf_id, uint32_t table_id)
1563{
1564	struct sctp_tcb *stcb;
1565	struct sctp_init_chunk *init_cp, init_buf;
1566	struct sctp_init_ack_chunk *initack_cp, initack_buf;
1567	struct sockaddr_storage sa_store;
1568	struct sockaddr *initack_src = (struct sockaddr *)&sa_store;
1569	struct sockaddr_in *sin;
1570	struct sockaddr_in6 *sin6;
1571	struct sctp_association *asoc;
1572	int chk_length;
1573	int init_offset, initack_offset, initack_limit;
1574	int retval;
1575	int error = 0;
1576	uint32_t old_tag;
1577	uint8_t auth_chunk_buf[SCTP_PARAM_BUFFER_SIZE];
1578
1579	/*
1580	 * find and validate the INIT chunk in the cookie (peer's info) the
1581	 * INIT should start after the cookie-echo header struct (chunk
1582	 * header, state cookie header struct)
1583	 */
1584	init_offset = offset + sizeof(struct sctp_cookie_echo_chunk);
1585	init_cp = (struct sctp_init_chunk *)
1586	    sctp_m_getptr(m, init_offset, sizeof(struct sctp_init_chunk),
1587	    (uint8_t *) & init_buf);
1588	if (init_cp == NULL) {
1589		/* could not pull a INIT chunk in cookie */
1590#ifdef SCTP_DEBUG
1591		if (sctp_debug_on & SCTP_DEBUG_INPUT1) {
1592			printf("process_cookie_new: could not pull INIT chunk hdr\n");
1593		}
1594#endif				/* SCTP_DEBUG */
1595		return (NULL);
1596	}
1597	chk_length = ntohs(init_cp->ch.chunk_length);
1598	if (init_cp->ch.chunk_type != SCTP_INITIATION) {
1599#ifdef SCTP_DEBUG
1600		if (sctp_debug_on & SCTP_DEBUG_INPUT1) {
1601			printf("HUH? process_cookie_new: could not find INIT chunk!\n");
1602		}
1603#endif				/* SCTP_DEBUG */
1604		return (NULL);
1605	}
1606	initack_offset = init_offset + SCTP_SIZE32(chk_length);
1607	/*
1608	 * find and validate the INIT-ACK chunk in the cookie (my info) the
1609	 * INIT-ACK follows the INIT chunk
1610	 */
1611	initack_cp = (struct sctp_init_ack_chunk *)
1612	    sctp_m_getptr(m, initack_offset, sizeof(struct sctp_init_ack_chunk),
1613	    (uint8_t *) & initack_buf);
1614	if (initack_cp == NULL) {
1615		/* could not pull INIT-ACK chunk in cookie */
1616#ifdef SCTP_DEBUG
1617		if (sctp_debug_on & SCTP_DEBUG_INPUT1) {
1618			printf("process_cookie_new: could not pull INIT-ACK chunk hdr\n");
1619		}
1620#endif				/* SCTP_DEBUG */
1621		return (NULL);
1622	}
1623	chk_length = ntohs(initack_cp->ch.chunk_length);
1624	if (initack_cp->ch.chunk_type != SCTP_INITIATION_ACK) {
1625		return (NULL);
1626	}
1627	/*
1628	 * NOTE: We can't use the INIT_ACK's chk_length to determine the
1629	 * "initack_limit" value.  This is because the chk_length field
1630	 * includes the length of the cookie, but the cookie is omitted when
1631	 * the INIT and INIT_ACK are tacked onto the cookie...
1632	 */
1633	initack_limit = offset + cookie_len;
1634
1635	/*
1636	 * now that we know the INIT/INIT-ACK are in place, create a new TCB
1637	 * and popluate
1638	 */
1639	stcb = sctp_aloc_assoc(inp, init_src, 0, &error,
1640	    ntohl(initack_cp->init.initiate_tag), vrf_id);
1641	if (stcb == NULL) {
1642		struct mbuf *op_err;
1643
1644		/* memory problem? */
1645#ifdef SCTP_DEBUG
1646		if (sctp_debug_on & SCTP_DEBUG_INPUT1) {
1647			printf("process_cookie_new: no room for another TCB!\n");
1648		}
1649#endif
1650		op_err = sctp_generate_invmanparam(SCTP_CAUSE_OUT_OF_RESC);
1651		sctp_abort_association(inp, (struct sctp_tcb *)NULL, m, iphlen,
1652		    sh, op_err, vrf_id, table_id);
1653		return (NULL);
1654	}
1655	/* get the correct sctp_nets */
1656	*netp = sctp_findnet(stcb, init_src);
1657	asoc = &stcb->asoc;
1658	/* save the table id (vrf_id is done in aloc_assoc) */
1659	asoc->table_id = table_id;
1660	/* get scope variables out of cookie */
1661	asoc->ipv4_local_scope = cookie->ipv4_scope;
1662	asoc->site_scope = cookie->site_scope;
1663	asoc->local_scope = cookie->local_scope;
1664	asoc->loopback_scope = cookie->loopback_scope;
1665
1666	if ((asoc->ipv4_addr_legal != cookie->ipv4_addr_legal) ||
1667	    (asoc->ipv6_addr_legal != cookie->ipv6_addr_legal)) {
1668		struct mbuf *op_err;
1669
1670		/*
1671		 * Houston we have a problem. The EP changed while the
1672		 * cookie was in flight. Only recourse is to abort the
1673		 * association.
1674		 */
1675		op_err = sctp_generate_invmanparam(SCTP_CAUSE_OUT_OF_RESC);
1676		sctp_abort_association(inp, (struct sctp_tcb *)NULL, m, iphlen,
1677		    sh, op_err, vrf_id, table_id);
1678		return (NULL);
1679	}
1680	/* process the INIT-ACK info (my info) */
1681	old_tag = asoc->my_vtag;
1682	asoc->assoc_id = asoc->my_vtag = ntohl(initack_cp->init.initiate_tag);
1683	asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd);
1684	asoc->pre_open_streams = ntohs(initack_cp->init.num_outbound_streams);
1685	asoc->init_seq_number = ntohl(initack_cp->init.initial_tsn);
1686	asoc->sending_seq = asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number;
1687	asoc->last_cwr_tsn = asoc->init_seq_number - 1;
1688	asoc->asconf_seq_in = asoc->last_acked_seq = asoc->init_seq_number - 1;
1689	asoc->str_reset_seq_in = asoc->init_seq_number;
1690
1691	asoc->advanced_peer_ack_point = asoc->last_acked_seq;
1692
1693	/* process the INIT info (peer's info) */
1694	retval = sctp_process_init(init_cp, stcb, *netp);
1695	if (retval < 0) {
1696		sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_16);
1697		return (NULL);
1698	}
1699	/* load all addresses */
1700	if (sctp_load_addresses_from_init(stcb, m, iphlen,
1701	    init_offset + sizeof(struct sctp_init_chunk), initack_offset, sh,
1702	    init_src)) {
1703		sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_17);
1704		return (NULL);
1705	}
1706	/*
1707	 * verify any preceding AUTH chunk that was skipped
1708	 */
1709	/* pull the local authentication parameters from the cookie/init-ack */
1710	sctp_auth_get_cookie_params(stcb, m,
1711	    initack_offset + sizeof(struct sctp_init_ack_chunk),
1712	    initack_limit - (initack_offset + sizeof(struct sctp_init_ack_chunk)));
1713	if (auth_skipped) {
1714		struct sctp_auth_chunk *auth;
1715
1716		auth = (struct sctp_auth_chunk *)
1717		    sctp_m_getptr(m, auth_offset, auth_len, auth_chunk_buf);
1718		if (sctp_handle_auth(stcb, auth, m, auth_offset)) {
1719			/* auth HMAC failed, dump the assoc and packet */
1720#ifdef SCTP_DEBUG
1721			if (sctp_debug_on & SCTP_DEBUG_AUTH1)
1722				printf("COOKIE-ECHO: AUTH failed\n");
1723#endif				/* SCTP_DEBUG */
1724			sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_18);
1725			return (NULL);
1726		} else {
1727			/* remaining chunks checked... good to go */
1728			stcb->asoc.authenticated = 1;
1729		}
1730	}
1731	/* update current state */
1732#ifdef SCTP_DEBUG
1733	if (sctp_debug_on & SCTP_DEBUG_INPUT1) {
1734		printf("moving to OPEN state\n");
1735	}
1736#endif
1737	if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
1738		asoc->state = SCTP_STATE_OPEN | SCTP_STATE_SHUTDOWN_PENDING;
1739		sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
1740		    stcb->sctp_ep, stcb, asoc->primary_destination);
1741	} else {
1742		asoc->state = SCTP_STATE_OPEN;
1743	}
1744	sctp_stop_all_cookie_timers(stcb);
1745	SCTP_STAT_INCR_COUNTER32(sctps_passiveestab);
1746	SCTP_STAT_INCR_GAUGE32(sctps_currestab);
1747
1748	/*
1749	 * if we're doing ASCONFs, check to see if we have any new local
1750	 * addresses that need to get added to the peer (eg. addresses
1751	 * changed while cookie echo in flight).  This needs to be done
1752	 * after we go to the OPEN state to do the correct asconf
1753	 * processing. else, make sure we have the correct addresses in our
1754	 * lists
1755	 */
1756
1757	/* warning, we re-use sin, sin6, sa_store here! */
1758	/* pull in local_address (our "from" address) */
1759	if (cookie->laddr_type == SCTP_IPV4_ADDRESS) {
1760		/* source addr is IPv4 */
1761		sin = (struct sockaddr_in *)initack_src;
1762		memset(sin, 0, sizeof(*sin));
1763		sin->sin_family = AF_INET;
1764		sin->sin_len = sizeof(struct sockaddr_in);
1765		sin->sin_addr.s_addr = cookie->laddress[0];
1766	} else if (cookie->laddr_type == SCTP_IPV6_ADDRESS) {
1767		/* source addr is IPv6 */
1768		sin6 = (struct sockaddr_in6 *)initack_src;
1769		memset(sin6, 0, sizeof(*sin6));
1770		sin6->sin6_family = AF_INET6;
1771		sin6->sin6_len = sizeof(struct sockaddr_in6);
1772		sin6->sin6_scope_id = cookie->scope_id;
1773		memcpy(&sin6->sin6_addr, cookie->laddress,
1774		    sizeof(sin6->sin6_addr));
1775	} else {
1776		sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_19);
1777		return (NULL);
1778	}
1779
1780	sctp_check_address_list(stcb, m,
1781	    initack_offset + sizeof(struct sctp_init_ack_chunk),
1782	    initack_limit - (initack_offset + sizeof(struct sctp_init_ack_chunk)),
1783	    initack_src, cookie->local_scope, cookie->site_scope,
1784	    cookie->ipv4_scope, cookie->loopback_scope);
1785
1786
1787	/* set up to notify upper layer */
1788	*notification = SCTP_NOTIFY_ASSOC_UP;
1789	if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
1790	    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
1791	    (inp->sctp_socket->so_qlimit == 0)) {
1792		/*
1793		 * This is an endpoint that called connect() how it got a
1794		 * cookie that is NEW is a bit of a mystery. It must be that
1795		 * the INIT was sent, but before it got there.. a complete
1796		 * INIT/INIT-ACK/COOKIE arrived. But of course then it
1797		 * should have went to the other code.. not here.. oh well..
1798		 * a bit of protection is worth having..
1799		 */
1800		stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_CONNECTED;
1801		soisconnected(stcb->sctp_ep->sctp_socket);
1802	} else if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
1803	    (inp->sctp_socket->so_qlimit)) {
1804		/*
1805		 * We don't want to do anything with this one. Since it is
1806		 * the listening guy. The timer will get started for
1807		 * accepted connections in the caller.
1808		 */
1809		;
1810	}
1811	/* since we did not send a HB make sure we don't double things */
1812	(*netp)->hb_responded = 1;
1813
1814	if (stcb->asoc.sctp_autoclose_ticks &&
1815	    sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE)) {
1816		sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb, NULL);
1817	}
1818	/* respond with a COOKIE-ACK */
1819	/* calculate the RTT */
1820	(*netp)->RTO = sctp_calculate_rto(stcb, asoc, *netp,
1821	    &cookie->time_entered);
1822	sctp_send_cookie_ack(stcb);
1823	return (stcb);
1824}
1825
1826
1827/*
1828 * handles a COOKIE-ECHO message stcb: modified to either a new or left as
1829 * existing (non-NULL) TCB
1830 */
1831static struct mbuf *
1832sctp_handle_cookie_echo(struct mbuf *m, int iphlen, int offset,
1833    struct sctphdr *sh, struct sctp_cookie_echo_chunk *cp,
1834    struct sctp_inpcb **inp_p, struct sctp_tcb **stcb, struct sctp_nets **netp,
1835    int auth_skipped, uint32_t auth_offset, uint32_t auth_len,
1836    struct sctp_tcb **locked_tcb, uint32_t vrf_id, uint32_t table_id)
1837{
1838	struct sctp_state_cookie *cookie;
1839	struct sockaddr_in6 sin6;
1840	struct sockaddr_in sin;
1841	struct sctp_tcb *l_stcb = *stcb;
1842	struct sctp_inpcb *l_inp;
1843	struct sockaddr *to;
1844	sctp_assoc_t sac_restart_id;
1845	struct sctp_pcb *ep;
1846	struct mbuf *m_sig;
1847	uint8_t calc_sig[SCTP_SIGNATURE_SIZE], tmp_sig[SCTP_SIGNATURE_SIZE];
1848	uint8_t *sig;
1849	uint8_t cookie_ok = 0;
1850	unsigned int size_of_pkt, sig_offset, cookie_offset;
1851	unsigned int cookie_len;
1852	struct timeval now;
1853	struct timeval time_expires;
1854	struct sockaddr_storage dest_store;
1855	struct sockaddr *localep_sa = (struct sockaddr *)&dest_store;
1856	struct ip *iph;
1857	int notification = 0;
1858	struct sctp_nets *netl;
1859	int had_a_existing_tcb = 0;
1860
1861#ifdef SCTP_DEBUG
1862	if (sctp_debug_on & SCTP_DEBUG_INPUT2) {
1863		printf("sctp_handle_cookie: handling COOKIE-ECHO\n");
1864	}
1865#endif
1866
1867	if (inp_p == NULL) {
1868		return (NULL);
1869	}
1870	/* First get the destination address setup too. */
1871	iph = mtod(m, struct ip *);
1872	if (iph->ip_v == IPVERSION) {
1873		/* its IPv4 */
1874		struct sockaddr_in *sin;
1875
1876		sin = (struct sockaddr_in *)(localep_sa);
1877		memset(sin, 0, sizeof(*sin));
1878		sin->sin_family = AF_INET;
1879		sin->sin_len = sizeof(*sin);
1880		sin->sin_port = sh->dest_port;
1881		sin->sin_addr.s_addr = iph->ip_dst.s_addr;
1882		size_of_pkt = SCTP_GET_IPV4_LENGTH(iph);
1883	} else if (iph->ip_v == (IPV6_VERSION >> 4)) {
1884		/* its IPv6 */
1885		struct ip6_hdr *ip6;
1886		struct sockaddr_in6 *sin6;
1887
1888		sin6 = (struct sockaddr_in6 *)(localep_sa);
1889		memset(sin6, 0, sizeof(*sin6));
1890		sin6->sin6_family = AF_INET6;
1891		sin6->sin6_len = sizeof(struct sockaddr_in6);
1892		ip6 = mtod(m, struct ip6_hdr *);
1893		sin6->sin6_port = sh->dest_port;
1894		sin6->sin6_addr = ip6->ip6_dst;
1895		size_of_pkt = SCTP_GET_IPV6_LENGTH(ip6) + iphlen;
1896	} else {
1897		return (NULL);
1898	}
1899
1900	cookie = &cp->cookie;
1901	cookie_offset = offset + sizeof(struct sctp_chunkhdr);
1902	cookie_len = ntohs(cp->ch.chunk_length);
1903
1904	if ((cookie->peerport != sh->src_port) &&
1905	    (cookie->myport != sh->dest_port) &&
1906	    (cookie->my_vtag != sh->v_tag)) {
1907		/*
1908		 * invalid ports or bad tag.  Note that we always leave the
1909		 * v_tag in the header in network order and when we stored
1910		 * it in the my_vtag slot we also left it in network order.
1911		 * This maintains the match even though it may be in the
1912		 * opposite byte order of the machine :->
1913		 */
1914		return (NULL);
1915	}
1916	if (cookie_len > size_of_pkt ||
1917	    cookie_len < sizeof(struct sctp_cookie_echo_chunk) +
1918	    sizeof(struct sctp_init_chunk) +
1919	    sizeof(struct sctp_init_ack_chunk) + SCTP_SIGNATURE_SIZE) {
1920		/* cookie too long!  or too small */
1921		return (NULL);
1922	}
1923	/*
1924	 * split off the signature into its own mbuf (since it should not be
1925	 * calculated in the sctp_hmac_m() call).
1926	 */
1927	sig_offset = offset + cookie_len - SCTP_SIGNATURE_SIZE;
1928	if (sig_offset > size_of_pkt) {
1929		/* packet not correct size! */
1930		/* XXX this may already be accounted for earlier... */
1931		return (NULL);
1932	}
1933	m_sig = m_split(m, sig_offset, M_DONTWAIT);
1934	if (m_sig == NULL) {
1935		/* out of memory or ?? */
1936		return (NULL);
1937	}
1938	/*
1939	 * compute the signature/digest for the cookie
1940	 */
1941	ep = &(*inp_p)->sctp_ep;
1942	l_inp = *inp_p;
1943	if (l_stcb) {
1944		SCTP_TCB_UNLOCK(l_stcb);
1945	}
1946	SCTP_INP_RLOCK(l_inp);
1947	if (l_stcb) {
1948		SCTP_TCB_LOCK(l_stcb);
1949	}
1950	/* which cookie is it? */
1951	if ((cookie->time_entered.tv_sec < (long)ep->time_of_secret_change) &&
1952	    (ep->current_secret_number != ep->last_secret_number)) {
1953		/* it's the old cookie */
1954		sctp_hmac_m(SCTP_HMAC,
1955		    (uint8_t *) ep->secret_key[(int)ep->last_secret_number],
1956		    SCTP_SECRET_SIZE, m, cookie_offset, calc_sig);
1957	} else {
1958		/* it's the current cookie */
1959		sctp_hmac_m(SCTP_HMAC,
1960		    (uint8_t *) ep->secret_key[(int)ep->current_secret_number],
1961		    SCTP_SECRET_SIZE, m, cookie_offset, calc_sig);
1962	}
1963	/* get the signature */
1964	SCTP_INP_RUNLOCK(l_inp);
1965	sig = (uint8_t *) sctp_m_getptr(m_sig, 0, SCTP_SIGNATURE_SIZE, (uint8_t *) & tmp_sig);
1966	if (sig == NULL) {
1967		/* couldn't find signature */
1968		sctp_m_freem(m_sig);
1969		return (NULL);
1970	}
1971	/* compare the received digest with the computed digest */
1972	if (memcmp(calc_sig, sig, SCTP_SIGNATURE_SIZE) != 0) {
1973		/* try the old cookie? */
1974		if ((cookie->time_entered.tv_sec == (long)ep->time_of_secret_change) &&
1975		    (ep->current_secret_number != ep->last_secret_number)) {
1976			/* compute digest with old */
1977			sctp_hmac_m(SCTP_HMAC,
1978			    (uint8_t *) ep->secret_key[(int)ep->last_secret_number],
1979			    SCTP_SECRET_SIZE, m, cookie_offset, calc_sig);
1980			/* compare */
1981			if (memcmp(calc_sig, sig, SCTP_SIGNATURE_SIZE) == 0)
1982				cookie_ok = 1;
1983		}
1984	} else {
1985		cookie_ok = 1;
1986	}
1987
1988	/*
1989	 * Now before we continue we must reconstruct our mbuf so that
1990	 * normal processing of any other chunks will work.
1991	 */
1992	{
1993		struct mbuf *m_at;
1994
1995		m_at = m;
1996		while (SCTP_BUF_NEXT(m_at) != NULL) {
1997			m_at = SCTP_BUF_NEXT(m_at);
1998		}
1999		SCTP_BUF_NEXT(m_at) = m_sig;
2000	}
2001
2002	if (cookie_ok == 0) {
2003#ifdef SCTP_DEBUG
2004		if (sctp_debug_on & SCTP_DEBUG_INPUT2) {
2005			printf("handle_cookie_echo: cookie signature validation failed!\n");
2006			printf("offset = %u, cookie_offset = %u, sig_offset = %u\n",
2007			    (uint32_t) offset, cookie_offset, sig_offset);
2008		}
2009#endif
2010		return (NULL);
2011	}
2012	/*
2013	 * check the cookie timestamps to be sure it's not stale
2014	 */
2015	SCTP_GETTIME_TIMEVAL(&now);
2016	/* Expire time is in Ticks, so we convert to seconds */
2017	time_expires.tv_sec = cookie->time_entered.tv_sec + cookie->cookie_life;
2018	time_expires.tv_usec = cookie->time_entered.tv_usec;
2019	if (timevalcmp(&now, &time_expires, >)) {
2020		/* cookie is stale! */
2021		struct mbuf *op_err;
2022		struct sctp_stale_cookie_msg *scm;
2023		uint32_t tim;
2024
2025		op_err = sctp_get_mbuf_for_msg(sizeof(struct sctp_stale_cookie_msg),
2026		    0, M_DONTWAIT, 1, MT_DATA);
2027		if (op_err == NULL) {
2028			/* FOOBAR */
2029			return (NULL);
2030		}
2031		/* pre-reserve some space */
2032		SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr));
2033		SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr));
2034		SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr));
2035
2036		/* Set the len */
2037		SCTP_BUF_LEN(op_err) = sizeof(struct sctp_stale_cookie_msg);
2038		scm = mtod(op_err, struct sctp_stale_cookie_msg *);
2039		scm->ph.param_type = htons(SCTP_CAUSE_STALE_COOKIE);
2040		scm->ph.param_length = htons((sizeof(struct sctp_paramhdr) +
2041		    (sizeof(uint32_t))));
2042		/* seconds to usec */
2043		tim = (now.tv_sec - time_expires.tv_sec) * 1000000;
2044		/* add in usec */
2045		if (tim == 0)
2046			tim = now.tv_usec - cookie->time_entered.tv_usec;
2047		scm->time_usec = htonl(tim);
2048		sctp_send_operr_to(m, iphlen, op_err, cookie->peers_vtag,
2049		    vrf_id, table_id);
2050		return (NULL);
2051	}
2052	/*
2053	 * Now we must see with the lookup address if we have an existing
2054	 * asoc. This will only happen if we were in the COOKIE-WAIT state
2055	 * and a INIT collided with us and somewhere the peer sent the
2056	 * cookie on another address besides the single address our assoc
2057	 * had for him. In this case we will have one of the tie-tags set at
2058	 * least AND the address field in the cookie can be used to look it
2059	 * up.
2060	 */
2061	to = NULL;
2062	if (cookie->addr_type == SCTP_IPV6_ADDRESS) {
2063		memset(&sin6, 0, sizeof(sin6));
2064		sin6.sin6_family = AF_INET6;
2065		sin6.sin6_len = sizeof(sin6);
2066		sin6.sin6_port = sh->src_port;
2067		sin6.sin6_scope_id = cookie->scope_id;
2068		memcpy(&sin6.sin6_addr.s6_addr, cookie->address,
2069		    sizeof(sin6.sin6_addr.s6_addr));
2070		to = (struct sockaddr *)&sin6;
2071	} else if (cookie->addr_type == SCTP_IPV4_ADDRESS) {
2072		memset(&sin, 0, sizeof(sin));
2073		sin.sin_family = AF_INET;
2074		sin.sin_len = sizeof(sin);
2075		sin.sin_port = sh->src_port;
2076		sin.sin_addr.s_addr = cookie->address[0];
2077		to = (struct sockaddr *)&sin;
2078	}
2079	if ((*stcb == NULL) && to) {
2080		/* Yep, lets check */
2081		*stcb = sctp_findassociation_ep_addr(inp_p, to, netp, localep_sa, NULL);
2082		if (*stcb == NULL) {
2083			/*
2084			 * We should have only got back the same inp. If we
2085			 * got back a different ep we have a problem. The
2086			 * original findep got back l_inp and now
2087			 */
2088			if (l_inp != *inp_p) {
2089				printf("Bad problem find_ep got a diff inp then special_locate?\n");
2090			}
2091		} else {
2092			if (*locked_tcb == NULL) {
2093				/*
2094				 * In this case we found the assoc only
2095				 * after we locked the create lock. This
2096				 * means we are in a colliding case and we
2097				 * must make sure that we unlock the tcb if
2098				 * its one of the cases where we throw away
2099				 * the incoming packets.
2100				 */
2101				*locked_tcb = *stcb;
2102
2103				/*
2104				 * We must also increment the inp ref count
2105				 * since the ref_count flags was set when we
2106				 * did not find the TCB, now we found it
2107				 * which reduces the refcount.. we must
2108				 * raise it back out to balance it all :-)
2109				 */
2110				SCTP_INP_INCR_REF((*stcb)->sctp_ep);
2111				if ((*stcb)->sctp_ep != l_inp) {
2112					printf("Huh? ep:%p diff then l_inp:%p?\n",
2113					    (*stcb)->sctp_ep, l_inp);
2114				}
2115			}
2116		}
2117	}
2118	cookie_len -= SCTP_SIGNATURE_SIZE;
2119	if (*stcb == NULL) {
2120		/* this is the "normal" case... get a new TCB */
2121		*stcb = sctp_process_cookie_new(m, iphlen, offset, sh, cookie,
2122		    cookie_len, *inp_p, netp, to, &notification,
2123		    auth_skipped, auth_offset, auth_len, vrf_id, table_id);
2124	} else {
2125		/* this is abnormal... cookie-echo on existing TCB */
2126		had_a_existing_tcb = 1;
2127		*stcb = sctp_process_cookie_existing(m, iphlen, offset, sh,
2128		    cookie, cookie_len, *inp_p, *stcb, *netp, to, &notification,
2129		    &sac_restart_id, vrf_id, table_id);
2130	}
2131
2132	if (*stcb == NULL) {
2133		/* still no TCB... must be bad cookie-echo */
2134		return (NULL);
2135	}
2136	/*
2137	 * Ok, we built an association so confirm the address we sent the
2138	 * INIT-ACK to.
2139	 */
2140	netl = sctp_findnet(*stcb, to);
2141	/*
2142	 * This code should in theory NOT run but
2143	 */
2144	if (netl == NULL) {
2145		/* TSNH! Huh, why do I need to add this address here? */
2146		int ret;
2147
2148		ret = sctp_add_remote_addr(*stcb, to, SCTP_DONOT_SETSCOPE,
2149		    SCTP_IN_COOKIE_PROC);
2150		netl = sctp_findnet(*stcb, to);
2151	}
2152	if (netl) {
2153		if (netl->dest_state & SCTP_ADDR_UNCONFIRMED) {
2154			netl->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
2155			sctp_set_primary_addr((*stcb), (struct sockaddr *)NULL,
2156			    netl);
2157			sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
2158			    (*stcb), 0, (void *)netl);
2159		}
2160	}
2161	if (*stcb) {
2162		sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, *inp_p,
2163		    *stcb, NULL);
2164	}
2165	if ((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) {
2166		if (!had_a_existing_tcb ||
2167		    (((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0)) {
2168			/*
2169			 * If we have a NEW cookie or the connect never
2170			 * reached the connected state during collision we
2171			 * must do the TCP accept thing.
2172			 */
2173			struct socket *so, *oso;
2174			struct sctp_inpcb *inp;
2175
2176			if (notification == SCTP_NOTIFY_ASSOC_RESTART) {
2177				/*
2178				 * For a restart we will keep the same
2179				 * socket, no need to do anything. I THINK!!
2180				 */
2181				sctp_ulp_notify(notification, *stcb, 0, (void *)&sac_restart_id);
2182				return (m);
2183			}
2184			oso = (*inp_p)->sctp_socket;
2185			/*
2186			 * We do this to keep the sockets side happy durin
2187			 * the sonewcon ONLY.
2188			 */
2189			NET_LOCK_GIANT();
2190			SCTP_TCB_UNLOCK((*stcb));
2191			so = sonewconn(oso, 0
2192			    );
2193			NET_UNLOCK_GIANT();
2194			SCTP_INP_WLOCK((*stcb)->sctp_ep);
2195			SCTP_TCB_LOCK((*stcb));
2196			SCTP_INP_WUNLOCK((*stcb)->sctp_ep);
2197			if (so == NULL) {
2198				struct mbuf *op_err;
2199
2200				/* Too many sockets */
2201#ifdef SCTP_DEBUG
2202				if (sctp_debug_on & SCTP_DEBUG_INPUT1) {
2203					printf("process_cookie_new: no room for another socket!\n");
2204				}
2205#endif				/* SCTP_DEBUG */
2206				op_err = sctp_generate_invmanparam(SCTP_CAUSE_OUT_OF_RESC);
2207				sctp_abort_association(*inp_p, NULL, m, iphlen,
2208				    sh, op_err, vrf_id,
2209				    table_id);
2210				sctp_free_assoc(*inp_p, *stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_20);
2211				return (NULL);
2212			}
2213			inp = (struct sctp_inpcb *)so->so_pcb;
2214			SCTP_INP_INCR_REF(inp);
2215			/*
2216			 * We add the unbound flag here so that if we get an
2217			 * soabort() before we get the move_pcb done, we
2218			 * will properly cleanup.
2219			 */
2220			inp->sctp_flags = (SCTP_PCB_FLAGS_TCPTYPE |
2221			    SCTP_PCB_FLAGS_CONNECTED |
2222			    SCTP_PCB_FLAGS_IN_TCPPOOL |
2223			    SCTP_PCB_FLAGS_UNBOUND |
2224			    (SCTP_PCB_COPY_FLAGS & (*inp_p)->sctp_flags) |
2225			    SCTP_PCB_FLAGS_DONT_WAKE);
2226			inp->sctp_features = (*inp_p)->sctp_features;
2227			inp->sctp_socket = so;
2228			inp->sctp_frag_point = (*inp_p)->sctp_frag_point;
2229			inp->partial_delivery_point = (*inp_p)->partial_delivery_point;
2230			inp->sctp_context = (*inp_p)->sctp_context;
2231			inp->inp_starting_point_for_iterator = NULL;
2232			/*
2233			 * copy in the authentication parameters from the
2234			 * original endpoint
2235			 */
2236			if (inp->sctp_ep.local_hmacs)
2237				sctp_free_hmaclist(inp->sctp_ep.local_hmacs);
2238			inp->sctp_ep.local_hmacs =
2239			    sctp_copy_hmaclist((*inp_p)->sctp_ep.local_hmacs);
2240			if (inp->sctp_ep.local_auth_chunks)
2241				sctp_free_chunklist(inp->sctp_ep.local_auth_chunks);
2242			inp->sctp_ep.local_auth_chunks =
2243			    sctp_copy_chunklist((*inp_p)->sctp_ep.local_auth_chunks);
2244			(void)sctp_copy_skeylist(&(*inp_p)->sctp_ep.shared_keys,
2245			    &inp->sctp_ep.shared_keys);
2246
2247			/*
2248			 * Now we must move it from one hash table to
2249			 * another and get the tcb in the right place.
2250			 */
2251			sctp_move_pcb_and_assoc(*inp_p, inp, *stcb);
2252			sctp_pull_off_control_to_new_inp((*inp_p), inp, *stcb, M_NOWAIT);
2253
2254			/*
2255			 * now we must check to see if we were aborted while
2256			 * the move was going on and the lock/unlock
2257			 * happened.
2258			 */
2259			if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
2260				/*
2261				 * yep it was, we leave the assoc attached
2262				 * to the socket since the sctp_inpcb_free()
2263				 * call will send an abort for us.
2264				 */
2265				SCTP_INP_DECR_REF(inp);
2266				return (NULL);
2267			}
2268			SCTP_INP_DECR_REF(inp);
2269			/* Switch over to the new guy */
2270			*inp_p = inp;
2271			sctp_ulp_notify(notification, *stcb, 0, NULL);
2272
2273			/*
2274			 * Pull it from the incomplete queue and wake the
2275			 * guy
2276			 */
2277			soisconnected(so);
2278			return (m);
2279		}
2280	}
2281	if ((notification) && ((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE)) {
2282		sctp_ulp_notify(notification, *stcb, 0, NULL);
2283	}
2284	return (m);
2285}
2286
2287static void
2288sctp_handle_cookie_ack(struct sctp_cookie_ack_chunk *cp,
2289    struct sctp_tcb *stcb, struct sctp_nets *net)
2290{
2291	/* cp must not be used, others call this without a c-ack :-) */
2292	struct sctp_association *asoc;
2293
2294#ifdef SCTP_DEBUG
2295	if (sctp_debug_on & SCTP_DEBUG_INPUT2) {
2296		printf("sctp_handle_cookie_ack: handling COOKIE-ACK\n");
2297	}
2298#endif
2299	if (stcb == NULL)
2300		return;
2301
2302	asoc = &stcb->asoc;
2303
2304	sctp_stop_all_cookie_timers(stcb);
2305	/* process according to association state */
2306	if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) {
2307		/* state change only needed when I am in right state */
2308#ifdef SCTP_DEBUG
2309		if (sctp_debug_on & SCTP_DEBUG_INPUT2) {
2310			printf("moving to OPEN state\n");
2311		}
2312#endif
2313		if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
2314			asoc->state = SCTP_STATE_OPEN | SCTP_STATE_SHUTDOWN_PENDING;
2315			sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
2316			    stcb->sctp_ep, stcb, asoc->primary_destination);
2317
2318		} else {
2319			asoc->state = SCTP_STATE_OPEN;
2320		}
2321		/* update RTO */
2322		SCTP_STAT_INCR_COUNTER32(sctps_activeestab);
2323		SCTP_STAT_INCR_GAUGE32(sctps_currestab);
2324		if (asoc->overall_error_count == 0) {
2325			net->RTO = sctp_calculate_rto(stcb, asoc, net,
2326			    &asoc->time_entered);
2327		}
2328		SCTP_GETTIME_TIMEVAL(&asoc->time_entered);
2329		sctp_ulp_notify(SCTP_NOTIFY_ASSOC_UP, stcb, 0, NULL);
2330		if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
2331		    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
2332			stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_CONNECTED;
2333			soisconnected(stcb->sctp_ep->sctp_socket);
2334		}
2335		sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
2336		    stcb, net);
2337		/*
2338		 * since we did not send a HB make sure we don't double
2339		 * things
2340		 */
2341		net->hb_responded = 1;
2342
2343		if (stcb->asoc.sctp_autoclose_ticks &&
2344		    sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_AUTOCLOSE)) {
2345			sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE,
2346			    stcb->sctp_ep, stcb, NULL);
2347		}
2348		/*
2349		 * set ASCONF timer if ASCONFs are pending and allowed (eg.
2350		 * addresses changed when init/cookie echo in flight)
2351		 */
2352		if ((sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_DO_ASCONF)) &&
2353		    (stcb->asoc.peer_supports_asconf) &&
2354		    (!TAILQ_EMPTY(&stcb->asoc.asconf_queue))) {
2355			sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2356			    stcb->sctp_ep, stcb,
2357			    stcb->asoc.primary_destination);
2358		}
2359	}
2360	/* Toss the cookie if I can */
2361	sctp_toss_old_cookies(stcb, asoc);
2362	if (!TAILQ_EMPTY(&asoc->sent_queue)) {
2363		/* Restart the timer if we have pending data */
2364		struct sctp_tmit_chunk *chk;
2365
2366		chk = TAILQ_FIRST(&asoc->sent_queue);
2367		if (chk) {
2368			sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
2369			    stcb, chk->whoTo);
2370		}
2371	}
2372}
2373
2374static void
2375sctp_handle_ecn_echo(struct sctp_ecne_chunk *cp,
2376    struct sctp_tcb *stcb)
2377{
2378	struct sctp_nets *net;
2379	struct sctp_tmit_chunk *lchk;
2380	uint32_t tsn;
2381
2382	if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_ecne_chunk)) {
2383		return;
2384	}
2385	SCTP_STAT_INCR(sctps_recvecne);
2386	tsn = ntohl(cp->tsn);
2387	/* ECN Nonce stuff: need a resync and disable the nonce sum check */
2388	/* Also we make sure we disable the nonce_wait */
2389	lchk = TAILQ_FIRST(&stcb->asoc.send_queue);
2390	if (lchk == NULL) {
2391		stcb->asoc.nonce_resync_tsn = stcb->asoc.sending_seq;
2392	} else {
2393		stcb->asoc.nonce_resync_tsn = lchk->rec.data.TSN_seq;
2394	}
2395	stcb->asoc.nonce_wait_for_ecne = 0;
2396	stcb->asoc.nonce_sum_check = 0;
2397
2398	/* Find where it was sent, if possible */
2399	net = NULL;
2400	lchk = TAILQ_FIRST(&stcb->asoc.sent_queue);
2401	while (lchk) {
2402		if (lchk->rec.data.TSN_seq == tsn) {
2403			net = lchk->whoTo;
2404			break;
2405		}
2406		if (compare_with_wrap(lchk->rec.data.TSN_seq, tsn, MAX_SEQ))
2407			break;
2408		lchk = TAILQ_NEXT(lchk, sctp_next);
2409	}
2410	if (net == NULL)
2411		/* default is we use the primary */
2412		net = stcb->asoc.primary_destination;
2413
2414	if (compare_with_wrap(tsn, stcb->asoc.last_cwr_tsn, MAX_TSN)) {
2415#ifdef SCTP_CWND_MONITOR
2416		int old_cwnd;
2417
2418		old_cwnd = net->cwnd;
2419#endif
2420		SCTP_STAT_INCR(sctps_ecnereducedcwnd);
2421		net->ssthresh = net->cwnd / 2;
2422		if (net->ssthresh < net->mtu) {
2423			net->ssthresh = net->mtu;
2424			/* here back off the timer as well, to slow us down */
2425			net->RTO <<= 2;
2426		}
2427		net->cwnd = net->ssthresh;
2428#ifdef SCTP_CWND_MONITOR
2429		sctp_log_cwnd(stcb, net, (net->cwnd - old_cwnd), SCTP_CWND_LOG_FROM_SAT);
2430#endif
2431		/*
2432		 * we reduce once every RTT. So we will only lower cwnd at
2433		 * the next sending seq i.e. the resync_tsn.
2434		 */
2435		stcb->asoc.last_cwr_tsn = stcb->asoc.nonce_resync_tsn;
2436	}
2437	/*
2438	 * We always send a CWR this way if our previous one was lost our
2439	 * peer will get an update, or if it is not time again to reduce we
2440	 * still get the cwr to the peer.
2441	 */
2442	sctp_send_cwr(stcb, net, tsn);
2443}
2444
2445static void
2446sctp_handle_ecn_cwr(struct sctp_cwr_chunk *cp, struct sctp_tcb *stcb)
2447{
2448	/*
2449	 * Here we get a CWR from the peer. We must look in the outqueue and
2450	 * make sure that we have a covered ECNE in teh control chunk part.
2451	 * If so remove it.
2452	 */
2453	struct sctp_tmit_chunk *chk;
2454	struct sctp_ecne_chunk *ecne;
2455
2456	TAILQ_FOREACH(chk, &stcb->asoc.control_send_queue, sctp_next) {
2457		if (chk->rec.chunk_id.id != SCTP_ECN_ECHO) {
2458			continue;
2459		}
2460		/*
2461		 * Look for and remove if it is the right TSN. Since there
2462		 * is only ONE ECNE on the control queue at any one time we
2463		 * don't need to worry about more than one!
2464		 */
2465		ecne = mtod(chk->data, struct sctp_ecne_chunk *);
2466		if (compare_with_wrap(ntohl(cp->tsn), ntohl(ecne->tsn),
2467		    MAX_TSN) || (cp->tsn == ecne->tsn)) {
2468			/* this covers this ECNE, we can remove it */
2469			stcb->asoc.ecn_echo_cnt_onq--;
2470			TAILQ_REMOVE(&stcb->asoc.control_send_queue, chk,
2471			    sctp_next);
2472			if (chk->data) {
2473				sctp_m_freem(chk->data);
2474				chk->data = NULL;
2475			}
2476			stcb->asoc.ctrl_queue_cnt--;
2477			sctp_free_remote_addr(chk->whoTo);
2478			sctp_free_a_chunk(stcb, chk);
2479			break;
2480		}
2481	}
2482}
2483
2484static void
2485sctp_handle_shutdown_complete(struct sctp_shutdown_complete_chunk *cp,
2486    struct sctp_tcb *stcb, struct sctp_nets *net)
2487{
2488	struct sctp_association *asoc;
2489
2490#ifdef SCTP_DEBUG
2491	if (sctp_debug_on & SCTP_DEBUG_INPUT2) {
2492		printf("sctp_handle_shutdown_complete: handling SHUTDOWN-COMPLETE\n");
2493	}
2494#endif
2495	if (stcb == NULL)
2496		return;
2497
2498	asoc = &stcb->asoc;
2499	/* process according to association state */
2500	if (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT) {
2501		/* unexpected SHUTDOWN-COMPLETE... so ignore... */
2502		SCTP_TCB_UNLOCK(stcb);
2503		return;
2504	}
2505	/* notify upper layer protocol */
2506	if (stcb->sctp_socket) {
2507		sctp_ulp_notify(SCTP_NOTIFY_ASSOC_DOWN, stcb, 0, NULL);
2508		/* are the queues empty? they should be */
2509		if (!TAILQ_EMPTY(&asoc->send_queue) ||
2510		    !TAILQ_EMPTY(&asoc->sent_queue) ||
2511		    !TAILQ_EMPTY(&asoc->out_wheel)) {
2512			sctp_report_all_outbound(stcb, 0);
2513		}
2514	}
2515	/* stop the timer */
2516	sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_21);
2517	SCTP_STAT_INCR_COUNTER32(sctps_shutdown);
2518	/* free the TCB */
2519	sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_22);
2520	return;
2521}
2522
2523static int
2524process_chunk_drop(struct sctp_tcb *stcb, struct sctp_chunk_desc *desc,
2525    struct sctp_nets *net, uint8_t flg)
2526{
2527	switch (desc->chunk_type) {
2528		case SCTP_DATA:
2529		/* find the tsn to resend (possibly */
2530		{
2531			uint32_t tsn;
2532			struct sctp_tmit_chunk *tp1;
2533
2534			tsn = ntohl(desc->tsn_ifany);
2535			tp1 = TAILQ_FIRST(&stcb->asoc.sent_queue);
2536			while (tp1) {
2537				if (tp1->rec.data.TSN_seq == tsn) {
2538					/* found it */
2539					break;
2540				}
2541				if (compare_with_wrap(tp1->rec.data.TSN_seq, tsn,
2542				    MAX_TSN)) {
2543					/* not found */
2544					tp1 = NULL;
2545					break;
2546				}
2547				tp1 = TAILQ_NEXT(tp1, sctp_next);
2548			}
2549			if (tp1 == NULL) {
2550				/*
2551				 * Do it the other way , aka without paying
2552				 * attention to queue seq order.
2553				 */
2554				SCTP_STAT_INCR(sctps_pdrpdnfnd);
2555				tp1 = TAILQ_FIRST(&stcb->asoc.sent_queue);
2556				while (tp1) {
2557					if (tp1->rec.data.TSN_seq == tsn) {
2558						/* found it */
2559						break;
2560					}
2561					tp1 = TAILQ_NEXT(tp1, sctp_next);
2562				}
2563			}
2564			if (tp1 == NULL) {
2565				SCTP_STAT_INCR(sctps_pdrptsnnf);
2566			}
2567			if ((tp1) && (tp1->sent < SCTP_DATAGRAM_ACKED)) {
2568				uint8_t *ddp;
2569
2570				if ((stcb->asoc.peers_rwnd == 0) &&
2571				    ((flg & SCTP_FROM_MIDDLE_BOX) == 0)) {
2572					SCTP_STAT_INCR(sctps_pdrpdiwnp);
2573					return (0);
2574				}
2575				if (stcb->asoc.peers_rwnd == 0 &&
2576				    (flg & SCTP_FROM_MIDDLE_BOX)) {
2577					SCTP_STAT_INCR(sctps_pdrpdizrw);
2578					return (0);
2579				}
2580				ddp = (uint8_t *) (mtod(tp1->data, caddr_t)+
2581				    sizeof(struct sctp_data_chunk));
2582				{
2583					unsigned int iii;
2584
2585					for (iii = 0; iii < sizeof(desc->data_bytes);
2586					    iii++) {
2587						if (ddp[iii] != desc->data_bytes[iii]) {
2588							SCTP_STAT_INCR(sctps_pdrpbadd);
2589							return (-1);
2590						}
2591					}
2592				}
2593				/*
2594				 * We zero out the nonce so resync not
2595				 * needed
2596				 */
2597				tp1->rec.data.ect_nonce = 0;
2598
2599				if (tp1->do_rtt) {
2600					/*
2601					 * this guy had a RTO calculation
2602					 * pending on it, cancel it
2603					 */
2604					tp1->do_rtt = 0;
2605				}
2606				SCTP_STAT_INCR(sctps_pdrpmark);
2607				if (tp1->sent != SCTP_DATAGRAM_RESEND)
2608					sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
2609				tp1->sent = SCTP_DATAGRAM_RESEND;
2610				/*
2611				 * mark it as if we were doing a FR, since
2612				 * we will be getting gap ack reports behind
2613				 * the info from the router.
2614				 */
2615				tp1->rec.data.doing_fast_retransmit = 1;
2616				/*
2617				 * mark the tsn with what sequences can
2618				 * cause a new FR.
2619				 */
2620				if (TAILQ_EMPTY(&stcb->asoc.send_queue)) {
2621					tp1->rec.data.fast_retran_tsn = stcb->asoc.sending_seq;
2622				} else {
2623					tp1->rec.data.fast_retran_tsn = (TAILQ_FIRST(&stcb->asoc.send_queue))->rec.data.TSN_seq;
2624				}
2625
2626				/* restart the timer */
2627				sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
2628				    stcb, tp1->whoTo, SCTP_FROM_SCTP_INPUT + SCTP_LOC_23);
2629				sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
2630				    stcb, tp1->whoTo);
2631
2632				/* fix counts and things */
2633#ifdef SCTP_FLIGHT_LOGGING
2634				sctp_misc_ints(SCTP_FLIGHT_LOG_DOWN_PDRP,
2635				    tp1->whoTo->flight_size,
2636				    tp1->book_size,
2637				    (uintptr_t) stcb,
2638				    tp1->rec.data.TSN_seq);
2639#endif
2640				sctp_flight_size_decrease(tp1);
2641				sctp_total_flight_decrease(stcb, tp1);
2642			} {
2643				/* audit code */
2644				unsigned int audit;
2645
2646				audit = 0;
2647				TAILQ_FOREACH(tp1, &stcb->asoc.sent_queue, sctp_next) {
2648					if (tp1->sent == SCTP_DATAGRAM_RESEND)
2649						audit++;
2650				}
2651				TAILQ_FOREACH(tp1, &stcb->asoc.control_send_queue,
2652				    sctp_next) {
2653					if (tp1->sent == SCTP_DATAGRAM_RESEND)
2654						audit++;
2655				}
2656				if (audit != stcb->asoc.sent_queue_retran_cnt) {
2657					printf("**Local Audit finds cnt:%d asoc cnt:%d\n",
2658					    audit, stcb->asoc.sent_queue_retran_cnt);
2659#ifndef SCTP_AUDITING_ENABLED
2660					stcb->asoc.sent_queue_retran_cnt = audit;
2661#endif
2662				}
2663			}
2664		}
2665		break;
2666	case SCTP_ASCONF:
2667		{
2668			struct sctp_tmit_chunk *asconf;
2669
2670			TAILQ_FOREACH(asconf, &stcb->asoc.control_send_queue,
2671			    sctp_next) {
2672				if (asconf->rec.chunk_id.id == SCTP_ASCONF) {
2673					break;
2674				}
2675			}
2676			if (asconf) {
2677				if (asconf->sent != SCTP_DATAGRAM_RESEND)
2678					sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
2679				asconf->sent = SCTP_DATAGRAM_RESEND;
2680				asconf->snd_count--;
2681			}
2682		}
2683		break;
2684	case SCTP_INITIATION:
2685		/* resend the INIT */
2686		stcb->asoc.dropped_special_cnt++;
2687		if (stcb->asoc.dropped_special_cnt < SCTP_RETRY_DROPPED_THRESH) {
2688			/*
2689			 * If we can get it in, in a few attempts we do
2690			 * this, otherwise we let the timer fire.
2691			 */
2692			sctp_timer_stop(SCTP_TIMER_TYPE_INIT, stcb->sctp_ep,
2693			    stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_24);
2694			sctp_send_initiate(stcb->sctp_ep, stcb);
2695		}
2696		break;
2697	case SCTP_SELECTIVE_ACK:
2698		/* resend the sack */
2699		sctp_send_sack(stcb);
2700		break;
2701	case SCTP_HEARTBEAT_REQUEST:
2702		/* resend a demand HB */
2703		sctp_send_hb(stcb, 1, net);
2704		break;
2705	case SCTP_SHUTDOWN:
2706		sctp_send_shutdown(stcb, net);
2707		break;
2708	case SCTP_SHUTDOWN_ACK:
2709		sctp_send_shutdown_ack(stcb, net);
2710		break;
2711	case SCTP_COOKIE_ECHO:
2712		{
2713			struct sctp_tmit_chunk *cookie;
2714
2715			cookie = NULL;
2716			TAILQ_FOREACH(cookie, &stcb->asoc.control_send_queue,
2717			    sctp_next) {
2718				if (cookie->rec.chunk_id.id == SCTP_COOKIE_ECHO) {
2719					break;
2720				}
2721			}
2722			if (cookie) {
2723				if (cookie->sent != SCTP_DATAGRAM_RESEND)
2724					sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
2725				cookie->sent = SCTP_DATAGRAM_RESEND;
2726				sctp_stop_all_cookie_timers(stcb);
2727			}
2728		}
2729		break;
2730	case SCTP_COOKIE_ACK:
2731		sctp_send_cookie_ack(stcb);
2732		break;
2733	case SCTP_ASCONF_ACK:
2734		/* resend last asconf ack */
2735		sctp_send_asconf_ack(stcb, 1);
2736		break;
2737	case SCTP_FORWARD_CUM_TSN:
2738		send_forward_tsn(stcb, &stcb->asoc);
2739		break;
2740		/* can't do anything with these */
2741	case SCTP_PACKET_DROPPED:
2742	case SCTP_INITIATION_ACK:	/* this should not happen */
2743	case SCTP_HEARTBEAT_ACK:
2744	case SCTP_ABORT_ASSOCIATION:
2745	case SCTP_OPERATION_ERROR:
2746	case SCTP_SHUTDOWN_COMPLETE:
2747	case SCTP_ECN_ECHO:
2748	case SCTP_ECN_CWR:
2749	default:
2750		break;
2751	}
2752	return (0);
2753}
2754
2755void
2756sctp_reset_in_stream(struct sctp_tcb *stcb, int number_entries, uint16_t * list)
2757{
2758	int i;
2759	uint16_t temp;
2760
2761	/*
2762	 * We set things to 0xffff since this is the last delivered sequence
2763	 * and we will be sending in 0 after the reset.
2764	 */
2765
2766	if (number_entries) {
2767		for (i = 0; i < number_entries; i++) {
2768			temp = ntohs(list[i]);
2769			if (temp >= stcb->asoc.streamincnt) {
2770				continue;
2771			}
2772			stcb->asoc.strmin[temp].last_sequence_delivered = 0xffff;
2773		}
2774	} else {
2775		list = NULL;
2776		for (i = 0; i < stcb->asoc.streamincnt; i++) {
2777			stcb->asoc.strmin[i].last_sequence_delivered = 0xffff;
2778		}
2779	}
2780	sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_RECV, stcb, number_entries, (void *)list);
2781}
2782
2783static void
2784sctp_reset_out_streams(struct sctp_tcb *stcb, int number_entries, uint16_t * list)
2785{
2786	int i;
2787
2788	if (number_entries == 0) {
2789		for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
2790			stcb->asoc.strmout[i].next_sequence_sent = 0;
2791		}
2792	} else if (number_entries) {
2793		for (i = 0; i < number_entries; i++) {
2794			uint16_t temp;
2795
2796			temp = ntohs(list[i]);
2797			if (temp >= stcb->asoc.streamoutcnt) {
2798				/* no such stream */
2799				continue;
2800			}
2801			stcb->asoc.strmout[temp].next_sequence_sent = 0;
2802		}
2803	}
2804	sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_SEND, stcb, number_entries, (void *)list);
2805}
2806
2807
2808struct sctp_stream_reset_out_request *
2809sctp_find_stream_reset(struct sctp_tcb *stcb, uint32_t seq, struct sctp_tmit_chunk **bchk)
2810{
2811	struct sctp_association *asoc;
2812	struct sctp_stream_reset_out_req *req;
2813	struct sctp_stream_reset_out_request *r;
2814	struct sctp_tmit_chunk *chk;
2815	int len, clen;
2816
2817	asoc = &stcb->asoc;
2818	if (TAILQ_EMPTY(&stcb->asoc.control_send_queue)) {
2819		asoc->stream_reset_outstanding = 0;
2820		return (NULL);
2821	}
2822	if (stcb->asoc.str_reset == NULL) {
2823		asoc->stream_reset_outstanding = 0;
2824		return (NULL);
2825	}
2826	chk = stcb->asoc.str_reset;
2827	if (chk->data == NULL) {
2828		return (NULL);
2829	}
2830	if (bchk) {
2831		/* he wants a copy of the chk pointer */
2832		*bchk = chk;
2833	}
2834	clen = chk->send_size;
2835	req = mtod(chk->data, struct sctp_stream_reset_out_req *);
2836	r = &req->sr_req;
2837	if (ntohl(r->request_seq) == seq) {
2838		/* found it */
2839		return (r);
2840	}
2841	len = SCTP_SIZE32(ntohs(r->ph.param_length));
2842	if (clen > (len + (int)sizeof(struct sctp_chunkhdr))) {
2843		/* move to the next one, there can only be a max of two */
2844		r = (struct sctp_stream_reset_out_request *)((caddr_t)r + len);
2845		if (ntohl(r->request_seq) == seq) {
2846			return (r);
2847		}
2848	}
2849	/* that seq is not here */
2850	return (NULL);
2851}
2852
2853static void
2854sctp_clean_up_stream_reset(struct sctp_tcb *stcb)
2855{
2856	struct sctp_association *asoc;
2857	struct sctp_tmit_chunk *chk = stcb->asoc.str_reset;
2858
2859	if (stcb->asoc.str_reset == NULL) {
2860		return;
2861	}
2862	asoc = &stcb->asoc;
2863
2864	sctp_timer_stop(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo, SCTP_FROM_SCTP_INPUT + SCTP_LOC_25);
2865	TAILQ_REMOVE(&asoc->control_send_queue,
2866	    chk,
2867	    sctp_next);
2868	if (chk->data) {
2869		sctp_m_freem(chk->data);
2870		chk->data = NULL;
2871	}
2872	asoc->ctrl_queue_cnt--;
2873	sctp_free_remote_addr(chk->whoTo);
2874
2875	sctp_free_a_chunk(stcb, chk);
2876	stcb->asoc.str_reset = NULL;
2877}
2878
2879
2880static int
2881sctp_handle_stream_reset_response(struct sctp_tcb *stcb,
2882    uint32_t seq, uint32_t action,
2883    struct sctp_stream_reset_response *respin)
2884{
2885	uint16_t type;
2886	int lparm_len;
2887	struct sctp_association *asoc = &stcb->asoc;
2888	struct sctp_tmit_chunk *chk;
2889	struct sctp_stream_reset_out_request *srparam;
2890	int number_entries;
2891
2892	if (asoc->stream_reset_outstanding == 0) {
2893		/* duplicate */
2894		return (0);
2895	}
2896	if (seq == stcb->asoc.str_reset_seq_out) {
2897		srparam = sctp_find_stream_reset(stcb, seq, &chk);
2898		if (srparam) {
2899			stcb->asoc.str_reset_seq_out++;
2900			type = ntohs(srparam->ph.param_type);
2901			lparm_len = ntohs(srparam->ph.param_length);
2902			if (type == SCTP_STR_RESET_OUT_REQUEST) {
2903				number_entries = (lparm_len - sizeof(struct sctp_stream_reset_out_request)) / sizeof(uint16_t);
2904				asoc->stream_reset_out_is_outstanding = 0;
2905				if (asoc->stream_reset_outstanding)
2906					asoc->stream_reset_outstanding--;
2907				if (action == SCTP_STREAM_RESET_PERFORMED) {
2908					/* do it */
2909					sctp_reset_out_streams(stcb, number_entries, srparam->list_of_streams);
2910				} else {
2911					sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_FAILED_OUT, stcb, number_entries, srparam->list_of_streams);
2912				}
2913			} else if (type == SCTP_STR_RESET_IN_REQUEST) {
2914				/* Answered my request */
2915				number_entries = (lparm_len - sizeof(struct sctp_stream_reset_in_request)) / sizeof(uint16_t);
2916				if (asoc->stream_reset_outstanding)
2917					asoc->stream_reset_outstanding--;
2918				if (action != SCTP_STREAM_RESET_PERFORMED) {
2919					sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_FAILED_IN, stcb, number_entries, srparam->list_of_streams);
2920				}
2921			} else if (type == SCTP_STR_RESET_TSN_REQUEST) {
2922				/**
2923				 * a) Adopt the new in tsn.
2924				 * b) reset the map
2925				 * c) Adopt the new out-tsn
2926				 */
2927				struct sctp_stream_reset_response_tsn *resp;
2928				struct sctp_forward_tsn_chunk fwdtsn;
2929				int abort_flag = 0;
2930
2931				if (respin == NULL) {
2932					/* huh ? */
2933					return (0);
2934				}
2935				if (action == SCTP_STREAM_RESET_PERFORMED) {
2936					resp = (struct sctp_stream_reset_response_tsn *)respin;
2937					asoc->stream_reset_outstanding--;
2938					fwdtsn.ch.chunk_length = htons(sizeof(struct sctp_forward_tsn_chunk));
2939					fwdtsn.ch.chunk_type = SCTP_FORWARD_CUM_TSN;
2940					fwdtsn.new_cumulative_tsn = htonl(ntohl(resp->senders_next_tsn) - 1);
2941					sctp_handle_forward_tsn(stcb, &fwdtsn, &abort_flag);
2942					if (abort_flag) {
2943						return (1);
2944					}
2945					stcb->asoc.highest_tsn_inside_map = (ntohl(resp->senders_next_tsn) - 1);
2946					stcb->asoc.cumulative_tsn = stcb->asoc.highest_tsn_inside_map;
2947					stcb->asoc.mapping_array_base_tsn = ntohl(resp->senders_next_tsn);
2948					memset(stcb->asoc.mapping_array, 0, stcb->asoc.mapping_array_size);
2949					stcb->asoc.sending_seq = ntohl(resp->receivers_next_tsn);
2950					stcb->asoc.last_acked_seq = stcb->asoc.cumulative_tsn;
2951
2952					sctp_reset_out_streams(stcb, 0, (uint16_t *) NULL);
2953					sctp_reset_in_stream(stcb, 0, (uint16_t *) NULL);
2954
2955				}
2956			}
2957			/* get rid of the request and get the request flags */
2958			if (asoc->stream_reset_outstanding == 0) {
2959				sctp_clean_up_stream_reset(stcb);
2960			}
2961		}
2962	}
2963	return (0);
2964}
2965
2966static void
2967sctp_handle_str_reset_request_in(struct sctp_tcb *stcb,
2968    struct sctp_tmit_chunk *chk,
2969    struct sctp_stream_reset_in_request *req)
2970{
2971	uint32_t seq;
2972	int len, i;
2973	int number_entries;
2974	uint16_t temp;
2975
2976	/*
2977	 * peer wants me to send a str-reset to him for my outgoing seq's if
2978	 * seq_in is right.
2979	 */
2980	struct sctp_association *asoc = &stcb->asoc;
2981
2982	seq = ntohl(req->request_seq);
2983	if (asoc->str_reset_seq_in == seq) {
2984		if (stcb->asoc.stream_reset_out_is_outstanding == 0) {
2985			len = ntohs(req->ph.param_length);
2986			number_entries = ((len - sizeof(struct sctp_stream_reset_in_request)) / sizeof(uint16_t));
2987			for (i = 0; i < number_entries; i++) {
2988				temp = ntohs(req->list_of_streams[i]);
2989				req->list_of_streams[i] = temp;
2990			}
2991			/* move the reset action back one */
2992			asoc->last_reset_action[1] = asoc->last_reset_action[0];
2993			asoc->last_reset_action[0] = SCTP_STREAM_RESET_PERFORMED;
2994			sctp_add_stream_reset_out(chk, number_entries, req->list_of_streams,
2995			    asoc->str_reset_seq_out,
2996			    seq, (asoc->sending_seq - 1));
2997			asoc->stream_reset_out_is_outstanding = 1;
2998			asoc->str_reset = chk;
2999			sctp_timer_start(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo);
3000			stcb->asoc.stream_reset_outstanding++;
3001		} else {
3002			/* Can't do it, since we have sent one out */
3003			asoc->last_reset_action[1] = asoc->last_reset_action[0];
3004			asoc->last_reset_action[0] = SCTP_STREAM_RESET_TRY_LATER;
3005			sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
3006		}
3007		asoc->str_reset_seq_in++;
3008	} else if (asoc->str_reset_seq_in - 1 == seq) {
3009		sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
3010	} else if (asoc->str_reset_seq_in - 2 == seq) {
3011		sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]);
3012	} else {
3013		sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_BAD_SEQNO);
3014	}
3015}
3016
3017static int
3018sctp_handle_str_reset_request_tsn(struct sctp_tcb *stcb,
3019    struct sctp_tmit_chunk *chk,
3020    struct sctp_stream_reset_tsn_request *req)
3021{
3022	/* reset all in and out and update the tsn */
3023	/*
3024	 * A) reset my str-seq's on in and out. B) Select a receive next,
3025	 * and set cum-ack to it. Also process this selected number as a
3026	 * fwd-tsn as well. C) set in the response my next sending seq.
3027	 */
3028	struct sctp_forward_tsn_chunk fwdtsn;
3029	struct sctp_association *asoc = &stcb->asoc;
3030	int abort_flag = 0;
3031	uint32_t seq;
3032
3033	seq = ntohl(req->request_seq);
3034	if (asoc->str_reset_seq_in == seq) {
3035		fwdtsn.ch.chunk_length = htons(sizeof(struct sctp_forward_tsn_chunk));
3036		fwdtsn.ch.chunk_type = SCTP_FORWARD_CUM_TSN;
3037		fwdtsn.ch.chunk_flags = 0;
3038		fwdtsn.new_cumulative_tsn = htonl(stcb->asoc.highest_tsn_inside_map + 1);
3039		sctp_handle_forward_tsn(stcb, &fwdtsn, &abort_flag);
3040		if (abort_flag) {
3041			return (1);
3042		}
3043		stcb->asoc.highest_tsn_inside_map += SCTP_STREAM_RESET_TSN_DELTA;
3044		stcb->asoc.cumulative_tsn = stcb->asoc.highest_tsn_inside_map;
3045		stcb->asoc.mapping_array_base_tsn = stcb->asoc.highest_tsn_inside_map + 1;
3046		memset(stcb->asoc.mapping_array, 0, stcb->asoc.mapping_array_size);
3047		atomic_add_int(&stcb->asoc.sending_seq, 1);
3048		/* save off historical data for retrans */
3049		stcb->asoc.last_sending_seq[1] = stcb->asoc.last_sending_seq[0];
3050		stcb->asoc.last_sending_seq[0] = stcb->asoc.sending_seq;
3051		stcb->asoc.last_base_tsnsent[1] = stcb->asoc.last_base_tsnsent[0];
3052		stcb->asoc.last_base_tsnsent[0] = stcb->asoc.mapping_array_base_tsn;
3053
3054		sctp_add_stream_reset_result_tsn(chk,
3055		    ntohl(req->request_seq),
3056		    SCTP_STREAM_RESET_PERFORMED,
3057		    stcb->asoc.sending_seq,
3058		    stcb->asoc.mapping_array_base_tsn);
3059		sctp_reset_out_streams(stcb, 0, (uint16_t *) NULL);
3060		sctp_reset_in_stream(stcb, 0, (uint16_t *) NULL);
3061		stcb->asoc.last_reset_action[1] = stcb->asoc.last_reset_action[0];
3062		stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_PERFORMED;
3063
3064		asoc->str_reset_seq_in++;
3065	} else if (asoc->str_reset_seq_in - 1 == seq) {
3066		sctp_add_stream_reset_result_tsn(chk, seq, asoc->last_reset_action[0],
3067		    stcb->asoc.last_sending_seq[0],
3068		    stcb->asoc.last_base_tsnsent[0]
3069		    );
3070	} else if (asoc->str_reset_seq_in - 2 == seq) {
3071		sctp_add_stream_reset_result_tsn(chk, seq, asoc->last_reset_action[1],
3072		    stcb->asoc.last_sending_seq[1],
3073		    stcb->asoc.last_base_tsnsent[1]
3074		    );
3075	} else {
3076		sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_BAD_SEQNO);
3077	}
3078	return (0);
3079}
3080
3081static void
3082sctp_handle_str_reset_request_out(struct sctp_tcb *stcb,
3083    struct sctp_tmit_chunk *chk,
3084    struct sctp_stream_reset_out_request *req)
3085{
3086	uint32_t seq, tsn;
3087	int number_entries, len;
3088	struct sctp_association *asoc = &stcb->asoc;
3089
3090	seq = ntohl(req->request_seq);
3091
3092	/* now if its not a duplicate we process it */
3093	if (asoc->str_reset_seq_in == seq) {
3094		len = ntohs(req->ph.param_length);
3095		number_entries = ((len - sizeof(struct sctp_stream_reset_out_request)) / sizeof(uint16_t));
3096		/*
3097		 * the sender is resetting, handle the list issue.. we must
3098		 * a) verify if we can do the reset, if so no problem b) If
3099		 * we can't do the reset we must copy the request. c) queue
3100		 * it, and setup the data in processor to trigger it off
3101		 * when needed and dequeue all the queued data.
3102		 */
3103		tsn = ntohl(req->send_reset_at_tsn);
3104
3105		/* move the reset action back one */
3106		asoc->last_reset_action[1] = asoc->last_reset_action[0];
3107		if ((tsn == asoc->cumulative_tsn) ||
3108		    (compare_with_wrap(asoc->cumulative_tsn, tsn, MAX_TSN))) {
3109			/* we can do it now */
3110			sctp_reset_in_stream(stcb, number_entries, req->list_of_streams);
3111			sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_PERFORMED);
3112			asoc->last_reset_action[0] = SCTP_STREAM_RESET_PERFORMED;
3113		} else {
3114			/*
3115			 * we must queue it up and thus wait for the TSN's
3116			 * to arrive that are at or before tsn
3117			 */
3118			struct sctp_stream_reset_list *liste;
3119			int siz;
3120
3121			siz = sizeof(struct sctp_stream_reset_list) + (number_entries * sizeof(uint16_t));
3122			SCTP_MALLOC(liste, struct sctp_stream_reset_list *,
3123			    siz, "StrRstList");
3124			if (liste == NULL) {
3125				/* gak out of memory */
3126				sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_DENIED);
3127				asoc->last_reset_action[0] = SCTP_STREAM_RESET_DENIED;
3128				return;
3129			}
3130			liste->tsn = tsn;
3131			liste->number_entries = number_entries;
3132			memcpy(&liste->req, req,
3133			    (sizeof(struct sctp_stream_reset_out_request) + (number_entries * sizeof(uint16_t))));
3134			TAILQ_INSERT_TAIL(&asoc->resetHead, liste, next_resp);
3135			sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_PERFORMED);
3136			asoc->last_reset_action[0] = SCTP_STREAM_RESET_PERFORMED;
3137		}
3138		asoc->str_reset_seq_in++;
3139	} else if ((asoc->str_reset_seq_in - 1) == seq) {
3140		/*
3141		 * one seq back, just echo back last action since my
3142		 * response was lost.
3143		 */
3144		sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
3145	} else if ((asoc->str_reset_seq_in - 2) == seq) {
3146		/*
3147		 * two seq back, just echo back last action since my
3148		 * response was lost.
3149		 */
3150		sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]);
3151	} else {
3152		sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_BAD_SEQNO);
3153	}
3154}
3155
3156static int
3157sctp_handle_stream_reset(struct sctp_tcb *stcb, struct sctp_stream_reset_out_req *sr_req)
3158{
3159	int chk_length, param_len, ptype;
3160	uint32_t seq;
3161	int num_req = 0;
3162	struct sctp_tmit_chunk *chk;
3163	struct sctp_chunkhdr *ch;
3164	struct sctp_paramhdr *ph;
3165	int ret_code = 0;
3166	int num_param = 0;
3167
3168	/* now it may be a reset or a reset-response */
3169	chk_length = ntohs(sr_req->ch.chunk_length);
3170
3171	/* setup for adding the response */
3172	sctp_alloc_a_chunk(stcb, chk);
3173	if (chk == NULL) {
3174		return (ret_code);
3175	}
3176	chk->rec.chunk_id.id = SCTP_STREAM_RESET;
3177	chk->rec.chunk_id.can_take_data = 0;
3178	chk->asoc = &stcb->asoc;
3179	chk->no_fr_allowed = 0;
3180	chk->book_size = chk->send_size = sizeof(struct sctp_chunkhdr);
3181	chk->book_size_scale = 0;
3182	chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA);
3183	if (chk->data == NULL) {
3184strres_nochunk:
3185		if (chk->data) {
3186			sctp_m_freem(chk->data);
3187			chk->data = NULL;
3188		}
3189		sctp_free_a_chunk(stcb, chk);
3190		return (ret_code);
3191	}
3192	SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD);
3193
3194	/* setup chunk parameters */
3195	chk->sent = SCTP_DATAGRAM_UNSENT;
3196	chk->snd_count = 0;
3197	chk->whoTo = stcb->asoc.primary_destination;
3198	atomic_add_int(&chk->whoTo->ref_count, 1);
3199
3200	ch = mtod(chk->data, struct sctp_chunkhdr *);
3201	ch->chunk_type = SCTP_STREAM_RESET;
3202	ch->chunk_flags = 0;
3203	ch->chunk_length = htons(chk->send_size);
3204	SCTP_BUF_LEN(chk->data) = SCTP_SIZE32(chk->send_size);
3205	ph = (struct sctp_paramhdr *)&sr_req->sr_req;
3206	while ((size_t)chk_length >= sizeof(struct sctp_stream_reset_tsn_request)) {
3207		param_len = ntohs(ph->param_length);
3208		if (param_len < (int)sizeof(struct sctp_stream_reset_tsn_request)) {
3209			/* bad param */
3210			break;
3211		}
3212		ptype = ntohs(ph->param_type);
3213		num_param++;
3214		if (num_param > SCTP_MAX_RESET_PARAMS) {
3215			/* hit the max of parameters already sorry.. */
3216			break;
3217		}
3218		if (ptype == SCTP_STR_RESET_OUT_REQUEST) {
3219			struct sctp_stream_reset_out_request *req_out;
3220
3221			req_out = (struct sctp_stream_reset_out_request *)ph;
3222			num_req++;
3223			if (stcb->asoc.stream_reset_outstanding) {
3224				seq = ntohl(req_out->response_seq);
3225				if (seq == stcb->asoc.str_reset_seq_out) {
3226					/* implicit ack */
3227					sctp_handle_stream_reset_response(stcb, seq, SCTP_STREAM_RESET_PERFORMED, NULL);
3228				}
3229			}
3230			sctp_handle_str_reset_request_out(stcb, chk, req_out);
3231		} else if (ptype == SCTP_STR_RESET_IN_REQUEST) {
3232			struct sctp_stream_reset_in_request *req_in;
3233
3234			num_req++;
3235			req_in = (struct sctp_stream_reset_in_request *)ph;
3236			sctp_handle_str_reset_request_in(stcb, chk, req_in);
3237		} else if (ptype == SCTP_STR_RESET_TSN_REQUEST) {
3238			struct sctp_stream_reset_tsn_request *req_tsn;
3239
3240			num_req++;
3241			req_tsn = (struct sctp_stream_reset_tsn_request *)ph;
3242			if (sctp_handle_str_reset_request_tsn(stcb, chk, req_tsn)) {
3243				ret_code = 1;
3244				goto strres_nochunk;
3245			}
3246			/* no more */
3247			break;
3248		} else if (ptype == SCTP_STR_RESET_RESPONSE) {
3249			struct sctp_stream_reset_response *resp;
3250			uint32_t result;
3251
3252			resp = (struct sctp_stream_reset_response *)ph;
3253			seq = ntohl(resp->response_seq);
3254			result = ntohl(resp->result);
3255			if (sctp_handle_stream_reset_response(stcb, seq, result, resp)) {
3256				ret_code = 1;
3257				goto strres_nochunk;
3258			}
3259		} else {
3260			break;
3261		}
3262
3263		ph = (struct sctp_paramhdr *)((caddr_t)ph + SCTP_SIZE32(param_len));
3264		chk_length -= SCTP_SIZE32(param_len);
3265	}
3266	if (num_req == 0) {
3267		/* we have no response free the stuff */
3268		goto strres_nochunk;
3269	}
3270	/* ok we have a chunk to link in */
3271	TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue,
3272	    chk,
3273	    sctp_next);
3274	stcb->asoc.ctrl_queue_cnt++;
3275	return (ret_code);
3276}
3277
3278/*
3279 * Handle a router or endpoints report of a packet loss, there are two ways
3280 * to handle this, either we get the whole packet and must disect it
3281 * ourselves (possibly with truncation and or corruption) or it is a summary
3282 * from a middle box that did the disectting for us.
3283 */
3284static void
3285sctp_handle_packet_dropped(struct sctp_pktdrop_chunk *cp,
3286    struct sctp_tcb *stcb, struct sctp_nets *net)
3287{
3288	uint32_t bottle_bw, on_queue;
3289	uint16_t trunc_len;
3290	unsigned int chlen;
3291	unsigned int at;
3292	struct sctp_chunk_desc desc;
3293	struct sctp_chunkhdr *ch;
3294
3295	chlen = ntohs(cp->ch.chunk_length);
3296	chlen -= sizeof(struct sctp_pktdrop_chunk);
3297	/* XXX possible chlen underflow */
3298	if (chlen == 0) {
3299		ch = NULL;
3300		if (cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX)
3301			SCTP_STAT_INCR(sctps_pdrpbwrpt);
3302	} else {
3303		ch = (struct sctp_chunkhdr *)(cp->data + sizeof(struct sctphdr));
3304		chlen -= sizeof(struct sctphdr);
3305		/* XXX possible chlen underflow */
3306		memset(&desc, 0, sizeof(desc));
3307	}
3308	trunc_len = (uint16_t) ntohs(cp->trunc_len);
3309	/* now the chunks themselves */
3310	while ((ch != NULL) && (chlen >= sizeof(struct sctp_chunkhdr))) {
3311		desc.chunk_type = ch->chunk_type;
3312		/* get amount we need to move */
3313		at = ntohs(ch->chunk_length);
3314		if (at < sizeof(struct sctp_chunkhdr)) {
3315			/* corrupt chunk, maybe at the end? */
3316			SCTP_STAT_INCR(sctps_pdrpcrupt);
3317			break;
3318		}
3319		if (trunc_len == 0) {
3320			/* we are supposed to have all of it */
3321			if (at > chlen) {
3322				/* corrupt skip it */
3323				SCTP_STAT_INCR(sctps_pdrpcrupt);
3324				break;
3325			}
3326		} else {
3327			/* is there enough of it left ? */
3328			if (desc.chunk_type == SCTP_DATA) {
3329				if (chlen < (sizeof(struct sctp_data_chunk) +
3330				    sizeof(desc.data_bytes))) {
3331					break;
3332				}
3333			} else {
3334				if (chlen < sizeof(struct sctp_chunkhdr)) {
3335					break;
3336				}
3337			}
3338		}
3339		if (desc.chunk_type == SCTP_DATA) {
3340			/* can we get out the tsn? */
3341			if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX))
3342				SCTP_STAT_INCR(sctps_pdrpmbda);
3343
3344			if (chlen >= (sizeof(struct sctp_data_chunk) + sizeof(uint32_t))) {
3345				/* yep */
3346				struct sctp_data_chunk *dcp;
3347				uint8_t *ddp;
3348				unsigned int iii;
3349
3350				dcp = (struct sctp_data_chunk *)ch;
3351				ddp = (uint8_t *) (dcp + 1);
3352				for (iii = 0; iii < sizeof(desc.data_bytes); iii++) {
3353					desc.data_bytes[iii] = ddp[iii];
3354				}
3355				desc.tsn_ifany = dcp->dp.tsn;
3356			} else {
3357				/* nope we are done. */
3358				SCTP_STAT_INCR(sctps_pdrpnedat);
3359				break;
3360			}
3361		} else {
3362			if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX))
3363				SCTP_STAT_INCR(sctps_pdrpmbct);
3364		}
3365
3366		if (process_chunk_drop(stcb, &desc, net, cp->ch.chunk_flags)) {
3367			SCTP_STAT_INCR(sctps_pdrppdbrk);
3368			break;
3369		}
3370		if (SCTP_SIZE32(at) > chlen) {
3371			break;
3372		}
3373		chlen -= SCTP_SIZE32(at);
3374		if (chlen < sizeof(struct sctp_chunkhdr)) {
3375			/* done, none left */
3376			break;
3377		}
3378		ch = (struct sctp_chunkhdr *)((caddr_t)ch + SCTP_SIZE32(at));
3379	}
3380	/* Now update any rwnd --- possibly */
3381	if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX) == 0) {
3382		/* From a peer, we get a rwnd report */
3383		uint32_t a_rwnd;
3384
3385		SCTP_STAT_INCR(sctps_pdrpfehos);
3386
3387		bottle_bw = ntohl(cp->bottle_bw);
3388		on_queue = ntohl(cp->current_onq);
3389		if (bottle_bw && on_queue) {
3390			/* a rwnd report is in here */
3391			if (bottle_bw > on_queue)
3392				a_rwnd = bottle_bw - on_queue;
3393			else
3394				a_rwnd = 0;
3395
3396			if (a_rwnd == 0)
3397				stcb->asoc.peers_rwnd = 0;
3398			else {
3399				if (a_rwnd > stcb->asoc.total_flight) {
3400					stcb->asoc.peers_rwnd =
3401					    a_rwnd - stcb->asoc.total_flight;
3402				} else {
3403					stcb->asoc.peers_rwnd = 0;
3404				}
3405				if (stcb->asoc.peers_rwnd <
3406				    stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
3407					/* SWS sender side engages */
3408					stcb->asoc.peers_rwnd = 0;
3409				}
3410			}
3411		}
3412	} else {
3413		SCTP_STAT_INCR(sctps_pdrpfmbox);
3414	}
3415
3416	/* now middle boxes in sat networks get a cwnd bump */
3417	if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX) &&
3418	    (stcb->asoc.sat_t3_loss_recovery == 0) &&
3419	    (stcb->asoc.sat_network)) {
3420		/*
3421		 * This is debateable but for sat networks it makes sense
3422		 * Note if a T3 timer has went off, we will prohibit any
3423		 * changes to cwnd until we exit the t3 loss recovery.
3424		 */
3425		uint32_t bw_avail;
3426		int rtt, incr;
3427
3428#ifdef SCTP_CWND_MONITOR
3429		int old_cwnd = net->cwnd;
3430
3431#endif
3432		/* need real RTT for this calc */
3433		rtt = ((net->lastsa >> 2) + net->lastsv) >> 1;
3434		/* get bottle neck bw */
3435		bottle_bw = ntohl(cp->bottle_bw);
3436		/* and whats on queue */
3437		on_queue = ntohl(cp->current_onq);
3438		/*
3439		 * adjust the on-queue if our flight is more it could be
3440		 * that the router has not yet gotten data "in-flight" to it
3441		 */
3442		if (on_queue < net->flight_size)
3443			on_queue = net->flight_size;
3444
3445		/* calculate the available space */
3446		bw_avail = (bottle_bw * rtt) / 1000;
3447		if (bw_avail > bottle_bw) {
3448			/*
3449			 * Cap the growth to no more than the bottle neck.
3450			 * This can happen as RTT slides up due to queues.
3451			 * It also means if you have more than a 1 second
3452			 * RTT with a empty queue you will be limited to the
3453			 * bottle_bw per second no matter if other points
3454			 * have 1/2 the RTT and you could get more out...
3455			 */
3456			bw_avail = bottle_bw;
3457		}
3458		if (on_queue > bw_avail) {
3459			/*
3460			 * No room for anything else don't allow anything
3461			 * else to be "added to the fire".
3462			 */
3463			int seg_inflight, seg_onqueue, my_portion;
3464
3465			net->partial_bytes_acked = 0;
3466
3467			/* how much are we over queue size? */
3468			incr = on_queue - bw_avail;
3469			if (stcb->asoc.seen_a_sack_this_pkt) {
3470				/*
3471				 * undo any cwnd adjustment that the sack
3472				 * might have made
3473				 */
3474				net->cwnd = net->prev_cwnd;
3475			}
3476			/* Now how much of that is mine? */
3477			seg_inflight = net->flight_size / net->mtu;
3478			seg_onqueue = on_queue / net->mtu;
3479			my_portion = (incr * seg_inflight) / seg_onqueue;
3480
3481			/* Have I made an adjustment already */
3482			if (net->cwnd > net->flight_size) {
3483				/*
3484				 * for this flight I made an adjustment we
3485				 * need to decrease the portion by a share
3486				 * our previous adjustment.
3487				 */
3488				int diff_adj;
3489
3490				diff_adj = net->cwnd - net->flight_size;
3491				if (diff_adj > my_portion)
3492					my_portion = 0;
3493				else
3494					my_portion -= diff_adj;
3495			}
3496			/*
3497			 * back down to the previous cwnd (assume we have
3498			 * had a sack before this packet). minus what ever
3499			 * portion of the overage is my fault.
3500			 */
3501			net->cwnd -= my_portion;
3502
3503			/* we will NOT back down more than 1 MTU */
3504			if (net->cwnd <= net->mtu) {
3505				net->cwnd = net->mtu;
3506			}
3507			/* force into CA */
3508			net->ssthresh = net->cwnd - 1;
3509		} else {
3510			/*
3511			 * Take 1/4 of the space left or max burst up ..
3512			 * whichever is less.
3513			 */
3514			incr = min((bw_avail - on_queue) >> 2,
3515			    (int)stcb->asoc.max_burst * (int)net->mtu);
3516			net->cwnd += incr;
3517		}
3518		if (net->cwnd > bw_avail) {
3519			/* We can't exceed the pipe size */
3520			net->cwnd = bw_avail;
3521		}
3522		if (net->cwnd < net->mtu) {
3523			/* We always have 1 MTU */
3524			net->cwnd = net->mtu;
3525		}
3526#ifdef SCTP_CWND_MONITOR
3527		if (net->cwnd - old_cwnd != 0) {
3528			/* log only changes */
3529			sctp_log_cwnd(stcb, net, (net->cwnd - old_cwnd),
3530			    SCTP_CWND_LOG_FROM_SAT);
3531		}
3532#endif
3533	}
3534}
3535
3536/*
3537 * handles all control chunks in a packet inputs: - m: mbuf chain, assumed to
3538 * still contain IP/SCTP header - stcb: is the tcb found for this packet -
3539 * offset: offset into the mbuf chain to first chunkhdr - length: is the
3540 * length of the complete packet outputs: - length: modified to remaining
3541 * length after control processing - netp: modified to new sctp_nets after
3542 * cookie-echo processing - return NULL to discard the packet (ie. no asoc,
3543 * bad packet,...) otherwise return the tcb for this packet
3544 */
3545static struct sctp_tcb *
3546sctp_process_control(struct mbuf *m, int iphlen, int *offset, int length,
3547    struct sctphdr *sh, struct sctp_chunkhdr *ch, struct sctp_inpcb *inp,
3548    struct sctp_tcb *stcb, struct sctp_nets **netp, int *fwd_tsn_seen,
3549    uint32_t vrf_id, uint32_t table_id)
3550{
3551	struct sctp_association *asoc;
3552	uint32_t vtag_in;
3553	int num_chunks = 0;	/* number of control chunks processed */
3554	int chk_length;
3555	int ret;
3556	int abort_no_unlock = 0;
3557
3558	/*
3559	 * How big should this be, and should it be alloc'd? Lets try the
3560	 * d-mtu-ceiling for now (2k) and that should hopefully work ...
3561	 * until we get into jumbo grams and such..
3562	 */
3563	uint8_t chunk_buf[SCTP_CHUNK_BUFFER_SIZE];
3564	struct sctp_tcb *locked_tcb = stcb;
3565	int got_auth = 0;
3566	uint32_t auth_offset = 0, auth_len = 0;
3567	int auth_skipped = 0;
3568
3569#ifdef SCTP_DEBUG
3570	if (sctp_debug_on & SCTP_DEBUG_INPUT1) {
3571		printf("sctp_process_control: iphlen=%u, offset=%u, length=%u stcb:%p\n",
3572		    iphlen, *offset, length, stcb);
3573	}
3574#endif				/* SCTP_DEBUG */
3575
3576	/* validate chunk header length... */
3577	if (ntohs(ch->chunk_length) < sizeof(*ch)) {
3578		return (NULL);
3579	}
3580	/*
3581	 * validate the verification tag
3582	 */
3583	vtag_in = ntohl(sh->v_tag);
3584
3585	if (locked_tcb) {
3586		SCTP_TCB_LOCK_ASSERT(locked_tcb);
3587	}
3588	if (ch->chunk_type == SCTP_INITIATION) {
3589		if (vtag_in != 0) {
3590			/* protocol error- silently discard... */
3591			SCTP_STAT_INCR(sctps_badvtag);
3592			if (locked_tcb)
3593				SCTP_TCB_UNLOCK(locked_tcb);
3594			return (NULL);
3595		}
3596	} else if (ch->chunk_type != SCTP_COOKIE_ECHO) {
3597		/*
3598		 * If there is no stcb, skip the AUTH chunk and process
3599		 * later after a stcb is found (to validate the lookup was
3600		 * valid.
3601		 */
3602		if ((ch->chunk_type == SCTP_AUTHENTICATION) &&
3603		    (stcb == NULL) && !sctp_auth_disable) {
3604			/* save this chunk for later processing */
3605			auth_skipped = 1;
3606			auth_offset = *offset;
3607			auth_len = ntohs(ch->chunk_length);
3608
3609			/* (temporarily) move past this chunk */
3610			*offset += SCTP_SIZE32(auth_len);
3611			if (*offset >= length) {
3612				/* no more data left in the mbuf chain */
3613				*offset = length;
3614				return (NULL);
3615			}
3616			ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
3617			    sizeof(struct sctp_chunkhdr), chunk_buf);
3618		}
3619		if (ch->chunk_type == SCTP_COOKIE_ECHO) {
3620			goto process_control_chunks;
3621		}
3622		/*
3623		 * first check if it's an ASCONF with an unknown src addr we
3624		 * need to look inside to find the association
3625		 */
3626		if (ch->chunk_type == SCTP_ASCONF && stcb == NULL) {
3627			/* inp's refcount may be reduced */
3628			SCTP_INP_INCR_REF(inp);
3629
3630			stcb = sctp_findassociation_ep_asconf(m, iphlen,
3631			    *offset, sh, &inp, netp);
3632			if (stcb == NULL) {
3633				/*
3634				 * reduce inp's refcount if not reduced in
3635				 * sctp_findassociation_ep_asconf().
3636				 */
3637				SCTP_INP_DECR_REF(inp);
3638			}
3639			/* now go back and verify any auth chunk to be sure */
3640			if (auth_skipped && (stcb != NULL)) {
3641				struct sctp_auth_chunk *auth;
3642
3643				auth = (struct sctp_auth_chunk *)
3644				    sctp_m_getptr(m, auth_offset,
3645				    auth_len, chunk_buf);
3646				got_auth = 1;
3647				auth_skipped = 0;
3648				if (sctp_handle_auth(stcb, auth, m,
3649				    auth_offset)) {
3650					/* auth HMAC failed so dump it */
3651					*offset = length;
3652					return (NULL);
3653				} else {
3654					/* remaining chunks are HMAC checked */
3655					stcb->asoc.authenticated = 1;
3656				}
3657			}
3658		}
3659		if (stcb == NULL) {
3660			/* no association, so it's out of the blue... */
3661			sctp_handle_ootb(m, iphlen, *offset, sh, inp, NULL,
3662			    vrf_id, table_id);
3663			*offset = length;
3664			if (locked_tcb)
3665				SCTP_TCB_UNLOCK(locked_tcb);
3666			return (NULL);
3667		}
3668		asoc = &stcb->asoc;
3669		/* ABORT and SHUTDOWN can use either v_tag... */
3670		if ((ch->chunk_type == SCTP_ABORT_ASSOCIATION) ||
3671		    (ch->chunk_type == SCTP_SHUTDOWN_COMPLETE) ||
3672		    (ch->chunk_type == SCTP_PACKET_DROPPED)) {
3673			if ((vtag_in == asoc->my_vtag) ||
3674			    ((ch->chunk_flags & SCTP_HAD_NO_TCB) &&
3675			    (vtag_in == asoc->peer_vtag))) {
3676				/* this is valid */
3677			} else {
3678				/* drop this packet... */
3679				SCTP_STAT_INCR(sctps_badvtag);
3680				if (locked_tcb)
3681					SCTP_TCB_UNLOCK(locked_tcb);
3682				return (NULL);
3683			}
3684		} else if (ch->chunk_type == SCTP_SHUTDOWN_ACK) {
3685			if (vtag_in != asoc->my_vtag) {
3686				/*
3687				 * this could be a stale SHUTDOWN-ACK or the
3688				 * peer never got the SHUTDOWN-COMPLETE and
3689				 * is still hung; we have started a new asoc
3690				 * but it won't complete until the shutdown
3691				 * is completed
3692				 */
3693				if (locked_tcb)
3694					SCTP_TCB_UNLOCK(locked_tcb);
3695				sctp_handle_ootb(m, iphlen, *offset, sh, inp,
3696				    NULL, vrf_id, table_id);
3697				return (NULL);
3698			}
3699		} else {
3700			/* for all other chunks, vtag must match */
3701			if (vtag_in != asoc->my_vtag) {
3702				/* invalid vtag... */
3703#ifdef SCTP_DEBUG
3704				if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
3705					printf("invalid vtag: %xh, expect %xh\n", vtag_in, asoc->my_vtag);
3706				}
3707#endif				/* SCTP_DEBUG */
3708				SCTP_STAT_INCR(sctps_badvtag);
3709				if (locked_tcb)
3710					SCTP_TCB_UNLOCK(locked_tcb);
3711				*offset = length;
3712				return (NULL);
3713			}
3714		}
3715	}			/* end if !SCTP_COOKIE_ECHO */
3716	/*
3717	 * process all control chunks...
3718	 */
3719	if (((ch->chunk_type == SCTP_SELECTIVE_ACK) ||
3720	    (ch->chunk_type == SCTP_HEARTBEAT_REQUEST)) &&
3721	    (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_ECHOED)) {
3722		/* implied cookie-ack.. we must have lost the ack */
3723		stcb->asoc.overall_error_count = 0;
3724		sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb,
3725		    *netp);
3726	}
3727process_control_chunks:
3728	while (IS_SCTP_CONTROL(ch)) {
3729		/* validate chunk length */
3730		chk_length = ntohs(ch->chunk_length);
3731#ifdef SCTP_DEBUG
3732		if (sctp_debug_on & SCTP_DEBUG_INPUT2) {
3733			printf("sctp_process_control: processing a chunk type=%u, len=%u\n",
3734			    ch->chunk_type, chk_length);
3735		}
3736#endif				/* SCTP_DEBUG */
3737		if ((size_t)chk_length < sizeof(*ch) ||
3738		    (*offset + chk_length) > length) {
3739			*offset = length;
3740			if (locked_tcb)
3741				SCTP_TCB_UNLOCK(locked_tcb);
3742			return (NULL);
3743		}
3744		SCTP_STAT_INCR_COUNTER64(sctps_incontrolchunks);
3745		/*
3746		 * INIT-ACK only gets the init ack "header" portion only
3747		 * because we don't have to process the peer's COOKIE. All
3748		 * others get a complete chunk.
3749		 */
3750		if ((ch->chunk_type == SCTP_INITIATION_ACK) ||
3751		    (ch->chunk_type == SCTP_INITIATION)) {
3752			/* get an init-ack chunk */
3753			ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
3754			    sizeof(struct sctp_init_ack_chunk), chunk_buf);
3755			if (ch == NULL) {
3756				*offset = length;
3757				if (locked_tcb)
3758					SCTP_TCB_UNLOCK(locked_tcb);
3759				return (NULL);
3760			}
3761		} else if (ch->chunk_type == SCTP_COOKIE_ECHO) {
3762			if (chk_length > sizeof(chunk_buf)) {
3763				/*
3764				 * use just the size of the chunk buffer so
3765				 * the front part of our cookie is intact.
3766				 * The rest of cookie processing should use
3767				 * the sctp_m_getptr() function to access
3768				 * the other parts.
3769				 */
3770				ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
3771				    (sizeof(chunk_buf) - 4),
3772				    chunk_buf);
3773				if (ch == NULL) {
3774					*offset = length;
3775					if (locked_tcb)
3776						SCTP_TCB_UNLOCK(locked_tcb);
3777					return (NULL);
3778				}
3779			} else {
3780				/* We can fit it all */
3781				goto all_fits;
3782			}
3783		} else {
3784			/* get a complete chunk... */
3785			if ((size_t)chk_length > sizeof(chunk_buf)) {
3786				struct mbuf *oper;
3787				struct sctp_paramhdr *phdr;
3788
3789				oper = NULL;
3790				if (stcb) {
3791					oper = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr),
3792					    0, M_DONTWAIT, 1, MT_DATA);
3793
3794					if (oper) {
3795						/* pre-reserve some space */
3796						SCTP_BUF_RESV_UF(oper, sizeof(struct sctp_chunkhdr));
3797						SCTP_BUF_LEN(oper) = sizeof(struct sctp_paramhdr);
3798						phdr = mtod(oper, struct sctp_paramhdr *);
3799						phdr->param_type = htons(SCTP_CAUSE_OUT_OF_RESC);
3800						phdr->param_length = htons(sizeof(struct sctp_paramhdr));
3801						sctp_queue_op_err(stcb, oper);
3802					}
3803				}
3804				if (locked_tcb)
3805					SCTP_TCB_UNLOCK(locked_tcb);
3806				return (NULL);
3807			}
3808	all_fits:
3809			ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
3810			    chk_length, chunk_buf);
3811			if (ch == NULL) {
3812				printf("sctp_process_control: Can't get the all data....\n");
3813				*offset = length;
3814				if (locked_tcb)
3815					SCTP_TCB_UNLOCK(locked_tcb);
3816				return (NULL);
3817			}
3818		}
3819		num_chunks++;
3820		/* Save off the last place we got a control from */
3821		if (stcb != NULL) {
3822			if ((*netp != NULL) || (ch->chunk_type == SCTP_ASCONF)) {
3823				/*
3824				 * allow last_control to be NULL if
3825				 * ASCONF... ASCONF processing will find the
3826				 * right net later
3827				 */
3828				stcb->asoc.last_control_chunk_from = *netp;
3829			}
3830		}
3831#ifdef SCTP_AUDITING_ENABLED
3832		sctp_audit_log(0xB0, ch->chunk_type);
3833#endif
3834
3835		/* check to see if this chunk required auth, but isn't */
3836		if ((stcb != NULL) && !sctp_auth_disable &&
3837		    sctp_auth_is_required_chunk(ch->chunk_type,
3838		    stcb->asoc.local_auth_chunks) &&
3839		    !stcb->asoc.authenticated) {
3840			/* "silently" ignore */
3841			SCTP_STAT_INCR(sctps_recvauthmissing);
3842			goto next_chunk;
3843		}
3844		switch (ch->chunk_type) {
3845		case SCTP_INITIATION:
3846			/* must be first and only chunk */
3847#ifdef SCTP_DEBUG
3848			if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
3849				printf("SCTP_INIT\n");
3850			}
3851#endif				/* SCTP_DEBUG */
3852			if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
3853				/* We are not interested anymore? */
3854				if ((stcb) && (stcb->asoc.total_output_queue_size)) {
3855					/*
3856					 * collision case where we are
3857					 * sending to them too
3858					 */
3859					;
3860				} else {
3861					if (locked_tcb)
3862						SCTP_TCB_UNLOCK(locked_tcb);
3863					*offset = length;
3864					return (NULL);
3865				}
3866			}
3867			if ((num_chunks > 1) ||
3868			    (sctp_strict_init && (length - *offset > SCTP_SIZE32(chk_length)))) {
3869				*offset = length;
3870				if (locked_tcb)
3871					SCTP_TCB_UNLOCK(locked_tcb);
3872				return (NULL);
3873			}
3874			if ((stcb != NULL) &&
3875			    (SCTP_GET_STATE(&stcb->asoc) ==
3876			    SCTP_STATE_SHUTDOWN_ACK_SENT)) {
3877				sctp_send_shutdown_ack(stcb,
3878				    stcb->asoc.primary_destination);
3879				*offset = length;
3880				sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC);
3881				if (locked_tcb)
3882					SCTP_TCB_UNLOCK(locked_tcb);
3883				return (NULL);
3884			}
3885			sctp_handle_init(m, iphlen, *offset, sh,
3886			    (struct sctp_init_chunk *)ch, inp, stcb, *netp, &abort_no_unlock, vrf_id, table_id);
3887			if (abort_no_unlock)
3888				return (NULL);
3889
3890			*offset = length;
3891			if (locked_tcb)
3892				SCTP_TCB_UNLOCK(locked_tcb);
3893			return (NULL);
3894			break;
3895		case SCTP_INITIATION_ACK:
3896			/* must be first and only chunk */
3897#ifdef SCTP_DEBUG
3898			if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
3899				printf("SCTP_INIT-ACK\n");
3900			}
3901#endif				/* SCTP_DEBUG */
3902			if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
3903				/* We are not interested anymore */
3904				if ((stcb) && (stcb->asoc.total_output_queue_size)) {
3905					;
3906				} else {
3907					if (locked_tcb)
3908						SCTP_TCB_UNLOCK(locked_tcb);
3909					*offset = length;
3910					if (stcb) {
3911						sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_26);
3912					}
3913					return (NULL);
3914				}
3915			}
3916			if ((num_chunks > 1) ||
3917			    (sctp_strict_init && (length - *offset > SCTP_SIZE32(chk_length)))) {
3918				*offset = length;
3919				if (locked_tcb)
3920					SCTP_TCB_UNLOCK(locked_tcb);
3921				return (NULL);
3922			}
3923			ret = sctp_handle_init_ack(m, iphlen, *offset, sh,
3924			    (struct sctp_init_ack_chunk *)ch, stcb, *netp, &abort_no_unlock, vrf_id, table_id);
3925			/*
3926			 * Special case, I must call the output routine to
3927			 * get the cookie echoed
3928			 */
3929			if (abort_no_unlock)
3930				return (NULL);
3931
3932			if ((stcb) && ret == 0)
3933				sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC);
3934			*offset = length;
3935			if (locked_tcb)
3936				SCTP_TCB_UNLOCK(locked_tcb);
3937			return (NULL);
3938			break;
3939		case SCTP_SELECTIVE_ACK:
3940#ifdef SCTP_DEBUG
3941			if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
3942				printf("SCTP_SACK\n");
3943			}
3944#endif				/* SCTP_DEBUG */
3945			SCTP_STAT_INCR(sctps_recvsacks);
3946			{
3947				struct sctp_sack_chunk *sack;
3948				int abort_now = 0;
3949				uint32_t a_rwnd, cum_ack;
3950				uint16_t num_seg;
3951				int nonce_sum_flag;
3952
3953				if (chk_length < sizeof(struct sctp_sack_chunk)) {
3954#ifdef SCTP_DEBUG
3955					if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
3956						printf("Bad size on sack chunk .. to small\n");
3957					}
3958#endif
3959					*offset = length;
3960					if (locked_tcb)
3961						SCTP_TCB_UNLOCK(locked_tcb);
3962
3963					return (NULL);
3964				}
3965				sack = (struct sctp_sack_chunk *)ch;
3966				nonce_sum_flag = ch->chunk_flags & SCTP_SACK_NONCE_SUM;
3967				cum_ack = ntohl(sack->sack.cum_tsn_ack);
3968				num_seg = ntohs(sack->sack.num_gap_ack_blks);
3969				a_rwnd = (uint32_t) ntohl(sack->sack.a_rwnd);
3970				stcb->asoc.seen_a_sack_this_pkt = 1;
3971				if ((stcb->asoc.pr_sctp_cnt == 0) &&
3972				    (num_seg == 0) &&
3973				    ((compare_with_wrap(cum_ack, stcb->asoc.last_acked_seq, MAX_TSN)) ||
3974				    (cum_ack == stcb->asoc.last_acked_seq)) &&
3975				    (stcb->asoc.saw_sack_with_frags == 0) &&
3976				    (!TAILQ_EMPTY(&stcb->asoc.sent_queue))
3977				    ) {
3978					/*
3979					 * We have a SIMPLE sack having no
3980					 * prior segments and data on sent
3981					 * queue to be acked.. Use the
3982					 * faster path sack processing. We
3983					 * also allow window update sacks
3984					 * with no missing segments to go
3985					 * this way too.
3986					 */
3987					sctp_express_handle_sack(stcb, cum_ack, a_rwnd, nonce_sum_flag,
3988					    &abort_now);
3989				} else {
3990					sctp_handle_sack(sack, stcb, *netp, &abort_now, chk_length, a_rwnd);
3991				}
3992				if (abort_now) {
3993					/* ABORT signal from sack processing */
3994					*offset = length;
3995					return (NULL);
3996				}
3997			}
3998			break;
3999		case SCTP_HEARTBEAT_REQUEST:
4000#ifdef SCTP_DEBUG
4001			if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
4002				printf("SCTP_HEARTBEAT\n");
4003			}
4004#endif				/* SCTP_DEBUG */
4005			SCTP_STAT_INCR(sctps_recvheartbeat);
4006			sctp_send_heartbeat_ack(stcb, m, *offset, chk_length,
4007			    *netp);
4008
4009			/* He's alive so give him credit */
4010			stcb->asoc.overall_error_count = 0;
4011			break;
4012		case SCTP_HEARTBEAT_ACK:
4013#ifdef SCTP_DEBUG
4014			if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
4015				printf("SCTP_HEARTBEAT-ACK\n");
4016			}
4017#endif				/* SCTP_DEBUG */
4018			if (chk_length != sizeof(struct sctp_heartbeat_chunk)) {
4019				/* Its not ours */
4020				*offset = length;
4021				if (locked_tcb)
4022					SCTP_TCB_UNLOCK(locked_tcb);
4023				return (NULL);
4024			}
4025			/* He's alive so give him credit */
4026			stcb->asoc.overall_error_count = 0;
4027			SCTP_STAT_INCR(sctps_recvheartbeatack);
4028			sctp_handle_heartbeat_ack((struct sctp_heartbeat_chunk *)ch,
4029			    stcb, *netp);
4030			break;
4031		case SCTP_ABORT_ASSOCIATION:
4032#ifdef SCTP_DEBUG
4033			if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
4034				printf("SCTP_ABORT\n");
4035			}
4036#endif				/* SCTP_DEBUG */
4037			sctp_handle_abort((struct sctp_abort_chunk *)ch,
4038			    stcb, *netp);
4039			*offset = length;
4040			return (NULL);
4041			break;
4042		case SCTP_SHUTDOWN:
4043#ifdef SCTP_DEBUG
4044			if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
4045				printf("SCTP_SHUTDOWN\n");
4046			}
4047#endif				/* SCTP_DEBUG */
4048			if (chk_length != sizeof(struct sctp_shutdown_chunk)) {
4049				*offset = length;
4050				if (locked_tcb)
4051					SCTP_TCB_UNLOCK(locked_tcb);
4052				return (NULL);
4053
4054			} {
4055				int abort_flag = 0;
4056
4057				sctp_handle_shutdown((struct sctp_shutdown_chunk *)ch,
4058				    stcb, *netp, &abort_flag);
4059				if (abort_flag) {
4060					*offset = length;
4061					return (NULL);
4062				}
4063			}
4064			break;
4065		case SCTP_SHUTDOWN_ACK:
4066#ifdef SCTP_DEBUG
4067			if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
4068				printf("SCTP_SHUTDOWN-ACK\n");
4069			}
4070#endif				/* SCTP_DEBUG */
4071			sctp_handle_shutdown_ack((struct sctp_shutdown_ack_chunk *)ch, stcb, *netp);
4072			*offset = length;
4073			return (NULL);
4074			break;
4075		case SCTP_OPERATION_ERROR:
4076#ifdef SCTP_DEBUG
4077			if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
4078				printf("SCTP_OP-ERR\n");
4079			}
4080#endif				/* SCTP_DEBUG */
4081			if (sctp_handle_error(ch, stcb, *netp) < 0) {
4082				*offset = length;
4083				return (NULL);
4084			}
4085			break;
4086		case SCTP_COOKIE_ECHO:
4087#ifdef SCTP_DEBUG
4088			if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
4089				printf("SCTP_COOKIE-ECHO stcb is %p\n", stcb);
4090			}
4091#endif				/* SCTP_DEBUG */
4092			if ((stcb) && (stcb->asoc.total_output_queue_size)) {
4093				;
4094			} else {
4095				if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) &&
4096				    (stcb == NULL)) {
4097					/* We are not interested anymore */
4098					*offset = length;
4099					return (NULL);
4100				}
4101			}
4102			/*
4103			 * First are we accepting? We do this again here
4104			 * since it is possible that a previous endpoint WAS
4105			 * listening responded to a INIT-ACK and then
4106			 * closed. We opened and bound.. and are now no
4107			 * longer listening.
4108			 */
4109			if (inp->sctp_socket->so_qlimit == 0) {
4110				if ((stcb) && (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
4111					/*
4112					 * special case, is this a retran'd
4113					 * COOKIE-ECHO or a restarting assoc
4114					 * that is a peeled off or
4115					 * one-to-one style socket.
4116					 */
4117					goto process_cookie_anyway;
4118				}
4119				sctp_abort_association(inp, stcb, m, iphlen,
4120				    sh, NULL, vrf_id,
4121				    table_id);
4122				*offset = length;
4123				return (NULL);
4124			} else if (inp->sctp_socket->so_qlimit) {
4125				/* we are accepting so check limits like TCP */
4126				if (inp->sctp_socket->so_qlen >
4127				    inp->sctp_socket->so_qlimit) {
4128					/* no space */
4129					struct mbuf *oper;
4130					struct sctp_paramhdr *phdr;
4131
4132					if (sctp_abort_if_one_2_one_hits_limit) {
4133						oper = NULL;
4134						oper = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr),
4135						    0, M_DONTWAIT, 1, MT_DATA);
4136						if (oper) {
4137							SCTP_BUF_LEN(oper) =
4138							    sizeof(struct sctp_paramhdr);
4139							phdr = mtod(oper,
4140							    struct sctp_paramhdr *);
4141							phdr->param_type =
4142							    htons(SCTP_CAUSE_OUT_OF_RESC);
4143							phdr->param_length =
4144							    htons(sizeof(struct sctp_paramhdr));
4145						}
4146						sctp_abort_association(inp, stcb, m,
4147						    iphlen, sh, oper, vrf_id, table_id);
4148					}
4149					*offset = length;
4150					return (NULL);
4151				}
4152			}
4153	process_cookie_anyway:
4154			{
4155				struct mbuf *ret_buf;
4156				struct sctp_inpcb *linp;
4157
4158				if (stcb)
4159					linp = NULL;
4160				else
4161					linp = inp;
4162
4163				if (linp)
4164					SCTP_ASOC_CREATE_LOCK(linp);
4165				ret_buf =
4166				    sctp_handle_cookie_echo(m, iphlen,
4167				    *offset, sh,
4168				    (struct sctp_cookie_echo_chunk *)ch,
4169				    &inp, &stcb, netp,
4170				    auth_skipped,
4171				    auth_offset,
4172				    auth_len,
4173				    &locked_tcb,
4174				    vrf_id,
4175				    table_id);
4176				if (linp)
4177					SCTP_ASOC_CREATE_UNLOCK(linp);
4178				if (ret_buf == NULL) {
4179					if (locked_tcb) {
4180						SCTP_TCB_UNLOCK(locked_tcb);
4181					}
4182#ifdef SCTP_DEBUG
4183					if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
4184						printf("GAK, null buffer\n");
4185					}
4186#endif				/* SCTP_DEBUG */
4187					auth_skipped = 0;
4188					*offset = length;
4189					return (NULL);
4190				}
4191				/* if AUTH skipped, see if it verified... */
4192				if (auth_skipped) {
4193					got_auth = 1;
4194					auth_skipped = 0;
4195				}
4196				if (!TAILQ_EMPTY(&stcb->asoc.sent_queue)) {
4197					/*
4198					 * Restart the timer if we have
4199					 * pending data
4200					 */
4201					struct sctp_tmit_chunk *chk;
4202
4203					chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
4204					if (chk) {
4205						sctp_timer_start(SCTP_TIMER_TYPE_SEND,
4206						    stcb->sctp_ep, stcb,
4207						    chk->whoTo);
4208					}
4209				}
4210			}
4211			break;
4212		case SCTP_COOKIE_ACK:
4213#ifdef SCTP_DEBUG
4214			if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
4215				printf("SCTP_COOKIE-ACK\n");
4216			}
4217#endif				/* SCTP_DEBUG */
4218			if (chk_length != sizeof(struct sctp_cookie_ack_chunk)) {
4219				if (locked_tcb)
4220					SCTP_TCB_UNLOCK(locked_tcb);
4221				return (NULL);
4222			}
4223			if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4224				/* We are not interested anymore */
4225				if ((stcb) && (stcb->asoc.total_output_queue_size)) {
4226					;
4227				} else {
4228					sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_27);
4229					*offset = length;
4230					return (NULL);
4231				}
4232			}
4233			/* He's alive so give him credit */
4234			stcb->asoc.overall_error_count = 0;
4235			sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb, *netp);
4236			break;
4237		case SCTP_ECN_ECHO:
4238#ifdef SCTP_DEBUG
4239			if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
4240				printf("SCTP_ECN-ECHO\n");
4241			}
4242#endif				/* SCTP_DEBUG */
4243			/* He's alive so give him credit */
4244			if (chk_length != sizeof(struct sctp_ecne_chunk)) {
4245				/* Its not ours */
4246				if (locked_tcb)
4247					SCTP_TCB_UNLOCK(locked_tcb);
4248				*offset = length;
4249				return (NULL);
4250			}
4251			stcb->asoc.overall_error_count = 0;
4252			sctp_handle_ecn_echo((struct sctp_ecne_chunk *)ch,
4253			    stcb);
4254			break;
4255		case SCTP_ECN_CWR:
4256#ifdef SCTP_DEBUG
4257			if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
4258				printf("SCTP_ECN-CWR\n");
4259			}
4260#endif				/* SCTP_DEBUG */
4261			/* He's alive so give him credit */
4262			if (chk_length != sizeof(struct sctp_cwr_chunk)) {
4263				/* Its not ours */
4264				if (locked_tcb)
4265					SCTP_TCB_UNLOCK(locked_tcb);
4266				*offset = length;
4267				return (NULL);
4268			}
4269			stcb->asoc.overall_error_count = 0;
4270
4271			sctp_handle_ecn_cwr((struct sctp_cwr_chunk *)ch, stcb);
4272			break;
4273		case SCTP_SHUTDOWN_COMPLETE:
4274#ifdef SCTP_DEBUG
4275			if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
4276				printf("SCTP_SHUTDOWN-COMPLETE\n");
4277			}
4278#endif				/* SCTP_DEBUG */
4279			/* must be first and only chunk */
4280			if ((num_chunks > 1) ||
4281			    (length - *offset > SCTP_SIZE32(chk_length))) {
4282				*offset = length;
4283				if (locked_tcb)
4284					SCTP_TCB_UNLOCK(locked_tcb);
4285
4286				return (NULL);
4287			}
4288			sctp_handle_shutdown_complete((struct sctp_shutdown_complete_chunk *)ch,
4289			    stcb, *netp);
4290			*offset = length;
4291			return (NULL);
4292			break;
4293		case SCTP_ASCONF:
4294#ifdef SCTP_DEBUG
4295			if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
4296				printf("SCTP_ASCONF\n");
4297			}
4298#endif				/* SCTP_DEBUG */
4299			/* He's alive so give him credit */
4300			stcb->asoc.overall_error_count = 0;
4301
4302			sctp_handle_asconf(m, *offset,
4303			    (struct sctp_asconf_chunk *)ch, stcb);
4304			break;
4305		case SCTP_ASCONF_ACK:
4306#ifdef SCTP_DEBUG
4307			if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
4308				printf("SCTP_ASCONF-ACK\n");
4309			}
4310#endif				/* SCTP_DEBUG */
4311			if (chk_length < sizeof(struct sctp_asconf_ack_chunk)) {
4312				/* Its not ours */
4313				if (locked_tcb)
4314					SCTP_TCB_UNLOCK(locked_tcb);
4315				*offset = length;
4316				return (NULL);
4317			}
4318			/* He's alive so give him credit */
4319			stcb->asoc.overall_error_count = 0;
4320
4321			sctp_handle_asconf_ack(m, *offset,
4322			    (struct sctp_asconf_ack_chunk *)ch, stcb, *netp);
4323			break;
4324		case SCTP_FORWARD_CUM_TSN:
4325#ifdef SCTP_DEBUG
4326			if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
4327				printf("SCTP_FWD-TSN\n");
4328			}
4329#endif				/* SCTP_DEBUG */
4330			if (chk_length < sizeof(struct sctp_forward_tsn_chunk)) {
4331				/* Its not ours */
4332				if (locked_tcb)
4333					SCTP_TCB_UNLOCK(locked_tcb);
4334				*offset = length;
4335				return (NULL);
4336			}
4337			/* He's alive so give him credit */
4338			{
4339				int abort_flag = 0;
4340
4341				stcb->asoc.overall_error_count = 0;
4342				*fwd_tsn_seen = 1;
4343				if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4344					/* We are not interested anymore */
4345					sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_28);
4346					*offset = length;
4347					return (NULL);
4348				}
4349				sctp_handle_forward_tsn(stcb,
4350				    (struct sctp_forward_tsn_chunk *)ch, &abort_flag);
4351				if (abort_flag) {
4352					*offset = length;
4353					return (NULL);
4354				} else {
4355					stcb->asoc.overall_error_count = 0;
4356				}
4357
4358			}
4359			break;
4360		case SCTP_STREAM_RESET:
4361#ifdef SCTP_DEBUG
4362			if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
4363				printf("SCTP_STREAM_RESET\n");
4364			}
4365#endif				/* SCTP_DEBUG */
4366			ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
4367			    chk_length, chunk_buf);
4368			if (chk_length < sizeof(struct sctp_stream_reset_tsn_req)) {
4369				/* Its not ours */
4370				if (locked_tcb)
4371					SCTP_TCB_UNLOCK(locked_tcb);
4372				*offset = length;
4373				return (NULL);
4374			}
4375			if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4376				/* We are not interested anymore */
4377				sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_29);
4378				*offset = length;
4379				return (NULL);
4380			}
4381			if (stcb->asoc.peer_supports_strreset == 0) {
4382				/*
4383				 * hmm, peer should have announced this, but
4384				 * we will turn it on since he is sending us
4385				 * a stream reset.
4386				 */
4387				stcb->asoc.peer_supports_strreset = 1;
4388			}
4389			if (sctp_handle_stream_reset(stcb, (struct sctp_stream_reset_out_req *)ch)) {
4390				/* stop processing */
4391				*offset = length;
4392				return (NULL);
4393			}
4394			break;
4395		case SCTP_PACKET_DROPPED:
4396#ifdef SCTP_DEBUG
4397			if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
4398				printf("SCTP_PACKET_DROPPED\n");
4399			}
4400#endif				/* SCTP_DEBUG */
4401			/* re-get it all please */
4402			if (chk_length < sizeof(struct sctp_pktdrop_chunk)) {
4403				/* Its not ours */
4404				if (locked_tcb)
4405					SCTP_TCB_UNLOCK(locked_tcb);
4406				*offset = length;
4407				return (NULL);
4408			}
4409			ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
4410			    chk_length, chunk_buf);
4411
4412			sctp_handle_packet_dropped((struct sctp_pktdrop_chunk *)ch,
4413			    stcb, *netp);
4414
4415			break;
4416
4417		case SCTP_AUTHENTICATION:
4418#ifdef SCTP_DEBUG
4419			if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
4420				printf("SCTP_AUTHENTICATION\n");
4421			}
4422#endif				/* SCTP_DEBUG */
4423			if (sctp_auth_disable)
4424				goto unknown_chunk;
4425
4426			if (stcb == NULL) {
4427				/* save the first AUTH for later processing */
4428				if (auth_skipped == 0) {
4429					auth_offset = *offset;
4430					auth_len = chk_length;
4431					auth_skipped = 1;
4432				}
4433				/* skip this chunk (temporarily) */
4434				goto next_chunk;
4435			}
4436			if ((chk_length < (sizeof(struct sctp_auth_chunk))) ||
4437			    (chk_length > (sizeof(struct sctp_auth_chunk) + SCTP_AUTH_DIGEST_LEN_MAX))) {
4438				/* Its not ours */
4439				if (locked_tcb)
4440					SCTP_TCB_UNLOCK(locked_tcb);
4441				*offset = length;
4442				return (NULL);
4443			}
4444			if (got_auth == 1) {
4445				/* skip this chunk... it's already auth'd */
4446				goto next_chunk;
4447			}
4448			ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
4449			    chk_length, chunk_buf);
4450			got_auth = 1;
4451			if (sctp_handle_auth(stcb, (struct sctp_auth_chunk *)ch,
4452			    m, *offset)) {
4453				/* auth HMAC failed so dump the packet */
4454				*offset = length;
4455				return (stcb);
4456			} else {
4457				/* remaining chunks are HMAC checked */
4458				stcb->asoc.authenticated = 1;
4459			}
4460			break;
4461
4462		default:
4463	unknown_chunk:
4464			/* it's an unknown chunk! */
4465			if ((ch->chunk_type & 0x40) && (stcb != NULL)) {
4466				struct mbuf *mm;
4467				struct sctp_paramhdr *phd;
4468
4469				mm = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr),
4470				    0, M_DONTWAIT, 1, MT_DATA);
4471				if (mm) {
4472					phd = mtod(mm, struct sctp_paramhdr *);
4473					/*
4474					 * We cheat and use param type since
4475					 * we did not bother to define a
4476					 * error cause struct. They are the
4477					 * same basic format with different
4478					 * names.
4479					 */
4480					phd->param_type = htons(SCTP_CAUSE_UNRECOG_CHUNK);
4481					phd->param_length = htons(chk_length + sizeof(*phd));
4482					SCTP_BUF_LEN(mm) = sizeof(*phd);
4483					SCTP_BUF_NEXT(mm) = SCTP_M_COPYM(m, *offset, SCTP_SIZE32(chk_length),
4484					    M_DONTWAIT);
4485					if (SCTP_BUF_NEXT(mm)) {
4486						sctp_queue_op_err(stcb, mm);
4487					} else {
4488						sctp_m_freem(mm);
4489					}
4490				}
4491			}
4492			if ((ch->chunk_type & 0x80) == 0) {
4493				/* discard this packet */
4494				*offset = length;
4495				return (stcb);
4496			}	/* else skip this bad chunk and continue... */
4497			break;
4498		}		/* switch (ch->chunk_type) */
4499
4500
4501next_chunk:
4502		/* get the next chunk */
4503		*offset += SCTP_SIZE32(chk_length);
4504		if (*offset >= length) {
4505			/* no more data left in the mbuf chain */
4506			break;
4507		}
4508		ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
4509		    sizeof(struct sctp_chunkhdr), chunk_buf);
4510		if (ch == NULL) {
4511			if (locked_tcb)
4512				SCTP_TCB_UNLOCK(locked_tcb);
4513			*offset = length;
4514			return (NULL);
4515		}
4516	}			/* while */
4517	return (stcb);
4518}
4519
4520
4521/*
4522 * Process the ECN bits we have something set so we must look to see if it is
4523 * ECN(0) or ECN(1) or CE
4524 */
4525static __inline void
4526sctp_process_ecn_marked_a(struct sctp_tcb *stcb, struct sctp_nets *net,
4527    uint8_t ecn_bits)
4528{
4529	if ((ecn_bits & SCTP_CE_BITS) == SCTP_CE_BITS) {
4530		;
4531	} else if ((ecn_bits & SCTP_ECT1_BIT) == SCTP_ECT1_BIT) {
4532		/*
4533		 * we only add to the nonce sum for ECT1, ECT0 does not
4534		 * change the NS bit (that we have yet to find a way to send
4535		 * it yet).
4536		 */
4537
4538		/* ECN Nonce stuff */
4539		stcb->asoc.receiver_nonce_sum++;
4540		stcb->asoc.receiver_nonce_sum &= SCTP_SACK_NONCE_SUM;
4541
4542		/*
4543		 * Drag up the last_echo point if cumack is larger since we
4544		 * don't want the point falling way behind by more than
4545		 * 2^^31 and then having it be incorrect.
4546		 */
4547		if (compare_with_wrap(stcb->asoc.cumulative_tsn,
4548		    stcb->asoc.last_echo_tsn, MAX_TSN)) {
4549			stcb->asoc.last_echo_tsn = stcb->asoc.cumulative_tsn;
4550		}
4551	} else if ((ecn_bits & SCTP_ECT0_BIT) == SCTP_ECT0_BIT) {
4552		/*
4553		 * Drag up the last_echo point if cumack is larger since we
4554		 * don't want the point falling way behind by more than
4555		 * 2^^31 and then having it be incorrect.
4556		 */
4557		if (compare_with_wrap(stcb->asoc.cumulative_tsn,
4558		    stcb->asoc.last_echo_tsn, MAX_TSN)) {
4559			stcb->asoc.last_echo_tsn = stcb->asoc.cumulative_tsn;
4560		}
4561	}
4562}
4563
4564static __inline void
4565sctp_process_ecn_marked_b(struct sctp_tcb *stcb, struct sctp_nets *net,
4566    uint32_t high_tsn, uint8_t ecn_bits)
4567{
4568	if ((ecn_bits & SCTP_CE_BITS) == SCTP_CE_BITS) {
4569		/*
4570		 * we possibly must notify the sender that a congestion
4571		 * window reduction is in order. We do this by adding a ECNE
4572		 * chunk to the output chunk queue. The incoming CWR will
4573		 * remove this chunk.
4574		 */
4575		if (compare_with_wrap(high_tsn, stcb->asoc.last_echo_tsn,
4576		    MAX_TSN)) {
4577			/* Yep, we need to add a ECNE */
4578			sctp_send_ecn_echo(stcb, net, high_tsn);
4579			stcb->asoc.last_echo_tsn = high_tsn;
4580		}
4581	}
4582}
4583
4584/*
4585 * common input chunk processing (v4 and v6)
4586 */
4587int
4588sctp_common_input_processing(struct mbuf **mm, int iphlen, int offset,
4589    int length, struct sctphdr *sh, struct sctp_chunkhdr *ch,
4590    struct sctp_inpcb *inp, struct sctp_tcb *stcb, struct sctp_nets *net,
4591    uint8_t ecn_bits, uint32_t vrf_id, uint32_t table_id)
4592{
4593	/*
4594	 * Control chunk processing
4595	 */
4596	uint32_t high_tsn;
4597	int fwd_tsn_seen = 0, data_processed = 0;
4598	struct mbuf *m = *mm;
4599	int abort_flag = 0;
4600	int un_sent;
4601
4602	SCTP_STAT_INCR(sctps_recvdatagrams);
4603#ifdef SCTP_AUDITING_ENABLED
4604	sctp_audit_log(0xE0, 1);
4605	sctp_auditing(0, inp, stcb, net);
4606#endif
4607
4608#ifdef SCTP_DEBUG
4609	if (sctp_debug_on & SCTP_DEBUG_INPUT1) {
4610		printf("Ok, Common input processing called, m:%p iphlen:%d offset:%d\n",
4611		    m, iphlen, offset);
4612	}
4613#endif				/* SCTP_DEBUG */
4614
4615	if (stcb) {
4616		/* always clear this before beginning a packet */
4617		stcb->asoc.authenticated = 0;
4618		stcb->asoc.seen_a_sack_this_pkt = 0;
4619	}
4620	if (IS_SCTP_CONTROL(ch)) {
4621		/* process the control portion of the SCTP packet */
4622		stcb = sctp_process_control(m, iphlen, &offset, length, sh, ch,
4623		    inp, stcb, &net, &fwd_tsn_seen, vrf_id, table_id);
4624		if (stcb) {
4625			/*
4626			 * This covers us if the cookie-echo was there and
4627			 * it changes our INP.
4628			 */
4629			inp = stcb->sctp_ep;
4630		}
4631	} else {
4632		/*
4633		 * no control chunks, so pre-process DATA chunks (these
4634		 * checks are taken care of by control processing)
4635		 */
4636
4637		/*
4638		 * if DATA only packet, and auth is required, then punt...
4639		 * can't have authenticated without any AUTH (control)
4640		 * chunks
4641		 */
4642		if ((stcb != NULL) && !sctp_auth_disable &&
4643		    sctp_auth_is_required_chunk(SCTP_DATA,
4644		    stcb->asoc.local_auth_chunks)) {
4645			/* "silently" ignore */
4646			SCTP_STAT_INCR(sctps_recvauthmissing);
4647			SCTP_TCB_UNLOCK(stcb);
4648			return (1);
4649		}
4650		if (stcb == NULL) {
4651			/* out of the blue DATA chunk */
4652			sctp_handle_ootb(m, iphlen, offset, sh, inp, NULL,
4653			    vrf_id, table_id);
4654			return (1);
4655		}
4656		if (stcb->asoc.my_vtag != ntohl(sh->v_tag)) {
4657			/* v_tag mismatch! */
4658			SCTP_STAT_INCR(sctps_badvtag);
4659			SCTP_TCB_UNLOCK(stcb);
4660			return (1);
4661		}
4662	}
4663
4664	if (stcb == NULL) {
4665		/*
4666		 * no valid TCB for this packet, or we found it's a bad
4667		 * packet while processing control, or we're done with this
4668		 * packet (done or skip rest of data), so we drop it...
4669		 */
4670		return (1);
4671	}
4672	/*
4673	 * DATA chunk processing
4674	 */
4675	/* plow through the data chunks while length > offset */
4676
4677	/*
4678	 * Rest should be DATA only.  Check authentication state if AUTH for
4679	 * DATA is required.
4680	 */
4681	if ((length > offset) && (stcb != NULL) && !sctp_auth_disable &&
4682	    sctp_auth_is_required_chunk(SCTP_DATA,
4683	    stcb->asoc.local_auth_chunks) &&
4684	    !stcb->asoc.authenticated) {
4685		/* "silently" ignore */
4686		SCTP_STAT_INCR(sctps_recvauthmissing);
4687#ifdef SCTP_DEBUG
4688		if (sctp_debug_on & SCTP_DEBUG_AUTH1)
4689			printf("Data chunk requires AUTH, skipped\n");
4690#endif
4691		goto trigger_send;
4692	}
4693	if (length > offset) {
4694		int retval;
4695
4696		/*
4697		 * First check to make sure our state is correct. We would
4698		 * not get here unless we really did have a tag, so we don't
4699		 * abort if this happens, just dump the chunk silently.
4700		 */
4701		switch (SCTP_GET_STATE(&stcb->asoc)) {
4702		case SCTP_STATE_COOKIE_ECHOED:
4703			/*
4704			 * we consider data with valid tags in this state
4705			 * shows us the cookie-ack was lost. Imply it was
4706			 * there.
4707			 */
4708			stcb->asoc.overall_error_count = 0;
4709			sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb, net);
4710			break;
4711		case SCTP_STATE_COOKIE_WAIT:
4712			/*
4713			 * We consider OOTB any data sent during asoc setup.
4714			 */
4715			sctp_handle_ootb(m, iphlen, offset, sh, inp, NULL,
4716			    vrf_id, table_id);
4717			SCTP_TCB_UNLOCK(stcb);
4718			return (1);
4719			break;
4720		case SCTP_STATE_EMPTY:	/* should not happen */
4721		case SCTP_STATE_INUSE:	/* should not happen */
4722		case SCTP_STATE_SHUTDOWN_RECEIVED:	/* This is a peer error */
4723		case SCTP_STATE_SHUTDOWN_ACK_SENT:
4724		default:
4725			SCTP_TCB_UNLOCK(stcb);
4726			return (1);
4727			break;
4728		case SCTP_STATE_OPEN:
4729		case SCTP_STATE_SHUTDOWN_SENT:
4730			break;
4731		}
4732		/* take care of ECN, part 1. */
4733		if (stcb->asoc.ecn_allowed &&
4734		    (ecn_bits & (SCTP_ECT0_BIT | SCTP_ECT1_BIT))) {
4735			sctp_process_ecn_marked_a(stcb, net, ecn_bits);
4736		}
4737		/* plow through the data chunks while length > offset */
4738		retval = sctp_process_data(mm, iphlen, &offset, length, sh,
4739		    inp, stcb, net, &high_tsn);
4740		if (retval == 2) {
4741			/*
4742			 * The association aborted, NO UNLOCK needed since
4743			 * the association is destroyed.
4744			 */
4745			return (0);
4746		}
4747		data_processed = 1;
4748		if (retval == 0) {
4749			/* take care of ecn part 2. */
4750			if (stcb->asoc.ecn_allowed &&
4751			    (ecn_bits & (SCTP_ECT0_BIT | SCTP_ECT1_BIT))) {
4752				sctp_process_ecn_marked_b(stcb, net, high_tsn,
4753				    ecn_bits);
4754			}
4755		}
4756		/*
4757		 * Anything important needs to have been m_copy'ed in
4758		 * process_data
4759		 */
4760	}
4761	if ((data_processed == 0) && (fwd_tsn_seen)) {
4762		int was_a_gap = 0;
4763
4764		if (compare_with_wrap(stcb->asoc.highest_tsn_inside_map,
4765		    stcb->asoc.cumulative_tsn, MAX_TSN)) {
4766			/* there was a gap before this data was processed */
4767			was_a_gap = 1;
4768		}
4769		sctp_sack_check(stcb, 1, was_a_gap, &abort_flag);
4770		if (abort_flag) {
4771			/* Again, we aborted so NO UNLOCK needed */
4772			return (0);
4773		}
4774	}
4775	/* trigger send of any chunks in queue... */
4776trigger_send:
4777#ifdef SCTP_AUDITING_ENABLED
4778	sctp_audit_log(0xE0, 2);
4779	sctp_auditing(1, inp, stcb, net);
4780#endif
4781#ifdef SCTP_DEBUG
4782	if (sctp_debug_on & SCTP_DEBUG_INPUT1) {
4783		printf("Check for chunk output prw:%d tqe:%d tf=%d\n",
4784		    stcb->asoc.peers_rwnd,
4785		    TAILQ_EMPTY(&stcb->asoc.control_send_queue),
4786		    stcb->asoc.total_flight);
4787	}
4788#endif
4789	un_sent = (stcb->asoc.total_output_queue_size - stcb->asoc.total_flight);
4790
4791	if (!TAILQ_EMPTY(&stcb->asoc.control_send_queue) ||
4792	    ((un_sent) &&
4793	    (stcb->asoc.peers_rwnd > 0 ||
4794	    (stcb->asoc.peers_rwnd <= 0 && stcb->asoc.total_flight == 0)))) {
4795#ifdef SCTP_DEBUG
4796		if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
4797			printf("Calling chunk OUTPUT\n");
4798		}
4799#endif
4800		sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC);
4801#ifdef SCTP_DEBUG
4802		if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
4803			printf("chunk OUTPUT returns\n");
4804		}
4805#endif
4806	}
4807#ifdef SCTP_AUDITING_ENABLED
4808	sctp_audit_log(0xE0, 3);
4809	sctp_auditing(2, inp, stcb, net);
4810#endif
4811	SCTP_TCB_UNLOCK(stcb);
4812	return (0);
4813}
4814
4815
4816
4817void
4818sctp_input(i_pak, off)
4819	struct mbuf *i_pak;
4820	int off;
4821
4822{
4823#ifdef SCTP_MBUF_LOGGING
4824	struct mbuf *mat;
4825
4826#endif
4827	struct mbuf *m;
4828	int iphlen;
4829	uint32_t vrf_id = 0, table_id = 0;
4830	uint8_t ecn_bits;
4831	struct ip *ip;
4832	struct sctphdr *sh;
4833	struct sctp_inpcb *inp = NULL;
4834
4835	uint32_t check, calc_check;
4836	struct sctp_nets *net;
4837	struct sctp_tcb *stcb = NULL;
4838	struct sctp_chunkhdr *ch;
4839	int refcount_up = 0;
4840	int length, mlen, offset;
4841
4842
4843	if (SCTP_GET_PKT_VRFID(i_pak, vrf_id)) {
4844		SCTP_RELEASE_PKT(i_pak);
4845		return;
4846	}
4847	if (SCTP_GET_PKT_TABLEID(i_pak, table_id)) {
4848		SCTP_RELEASE_PKT(i_pak);
4849		return;
4850	}
4851	mlen = SCTP_HEADER_LEN(i_pak);
4852	iphlen = off;
4853	m = SCTP_HEADER_TO_CHAIN(i_pak);
4854	net = NULL;
4855	SCTP_STAT_INCR(sctps_recvpackets);
4856	SCTP_STAT_INCR_COUNTER64(sctps_inpackets);
4857
4858#ifdef SCTP_MBUF_LOGGING
4859	/* Log in any input mbufs */
4860	mat = m;
4861	while (mat) {
4862		if (SCTP_BUF_IS_EXTENDED(mat)) {
4863			sctp_log_mb(mat, SCTP_MBUF_INPUT);
4864		}
4865		mat = SCTP_BUF_NEXT(mat);
4866	}
4867#endif
4868
4869	/*
4870	 * Get IP, SCTP, and first chunk header together in first mbuf.
4871	 */
4872	ip = mtod(m, struct ip *);
4873	offset = iphlen + sizeof(*sh) + sizeof(*ch);
4874	if (SCTP_BUF_LEN(m) < offset) {
4875		if ((m = m_pullup(m, offset)) == 0) {
4876			SCTP_STAT_INCR(sctps_hdrops);
4877			return;
4878		}
4879		ip = mtod(m, struct ip *);
4880	}
4881	sh = (struct sctphdr *)((caddr_t)ip + iphlen);
4882	ch = (struct sctp_chunkhdr *)((caddr_t)sh + sizeof(*sh));
4883
4884	/* SCTP does not allow broadcasts or multicasts */
4885	if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr))) {
4886		goto bad;
4887	}
4888	if (SCTP_IS_IT_BROADCAST(ip->ip_dst, m)) {
4889		/*
4890		 * We only look at broadcast if its a front state, All
4891		 * others we will not have a tcb for anyway.
4892		 */
4893		goto bad;
4894	}
4895	/* validate SCTP checksum */
4896	if ((sctp_no_csum_on_loopback == 0) || !SCTP_IS_IT_LOOPBACK(m)) {
4897		/*
4898		 * we do NOT validate things from the loopback if the sysctl
4899		 * is set to 1.
4900		 */
4901		check = sh->checksum;	/* save incoming checksum */
4902		if ((check == 0) && (sctp_no_csum_on_loopback)) {
4903			/*
4904			 * special hook for where we got a local address
4905			 * somehow routed across a non IFT_LOOP type
4906			 * interface
4907			 */
4908			if (ip->ip_src.s_addr == ip->ip_dst.s_addr)
4909				goto sctp_skip_csum_4;
4910		}
4911		sh->checksum = 0;	/* prepare for calc */
4912		calc_check = sctp_calculate_sum(m, &mlen, iphlen);
4913		if (calc_check != check) {
4914#ifdef SCTP_DEBUG
4915			if (sctp_debug_on & SCTP_DEBUG_INPUT1) {
4916				printf("Bad CSUM on SCTP packet calc_check:%x check:%x  m:%p mlen:%d iphlen:%d\n",
4917				    calc_check, check, m, mlen, iphlen);
4918			}
4919#endif
4920
4921			stcb = sctp_findassociation_addr(m, iphlen,
4922			    offset - sizeof(*ch),
4923			    sh, ch, &inp, &net, vrf_id);
4924			if ((inp) && (stcb)) {
4925				sctp_send_packet_dropped(stcb, net, m, iphlen, 1);
4926				sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_INPUT_ERROR);
4927			} else if ((inp != NULL) && (stcb == NULL)) {
4928				refcount_up = 1;
4929			}
4930			SCTP_STAT_INCR(sctps_badsum);
4931			SCTP_STAT_INCR_COUNTER32(sctps_checksumerrors);
4932			goto bad;
4933		}
4934		sh->checksum = calc_check;
4935	}
4936sctp_skip_csum_4:
4937	/* destination port of 0 is illegal, based on RFC2960. */
4938	if (sh->dest_port == 0) {
4939		SCTP_STAT_INCR(sctps_hdrops);
4940		goto bad;
4941	}
4942	/* validate mbuf chain length with IP payload length */
4943	if (mlen < (ip->ip_len - iphlen)) {
4944		SCTP_STAT_INCR(sctps_hdrops);
4945		goto bad;
4946	}
4947	/*
4948	 * Locate pcb and tcb for datagram sctp_findassociation_addr() wants
4949	 * IP/SCTP/first chunk header...
4950	 */
4951	stcb = sctp_findassociation_addr(m, iphlen, offset - sizeof(*ch),
4952	    sh, ch, &inp, &net, vrf_id);
4953	/* inp's ref-count increased && stcb locked */
4954	if (inp == NULL) {
4955		struct sctp_init_chunk *init_chk, chunk_buf;
4956
4957		SCTP_STAT_INCR(sctps_noport);
4958#ifdef ICMP_BANDLIM
4959		/*
4960		 * we use the bandwidth limiting to protect against sending
4961		 * too many ABORTS all at once. In this case these count the
4962		 * same as an ICMP message.
4963		 */
4964		if (badport_bandlim(0) < 0)
4965			goto bad;
4966#endif				/* ICMP_BANDLIM */
4967#ifdef SCTP_DEBUG
4968		if (sctp_debug_on & SCTP_DEBUG_INPUT1) {
4969			printf("Sending a ABORT from packet entry!\n");
4970		}
4971#endif
4972		if (ch->chunk_type == SCTP_INITIATION) {
4973			/*
4974			 * we do a trick here to get the INIT tag, dig in
4975			 * and get the tag from the INIT and put it in the
4976			 * common header.
4977			 */
4978			init_chk = (struct sctp_init_chunk *)sctp_m_getptr(m,
4979			    iphlen + sizeof(*sh), sizeof(*init_chk),
4980			    (uint8_t *) & chunk_buf);
4981			if (init_chk != NULL)
4982				sh->v_tag = init_chk->init.initiate_tag;
4983		}
4984		if (ch->chunk_type == SCTP_SHUTDOWN_ACK) {
4985			sctp_send_shutdown_complete2(m, iphlen, sh, vrf_id,
4986			    table_id);
4987			goto bad;
4988		}
4989		if (ch->chunk_type == SCTP_SHUTDOWN_COMPLETE) {
4990			goto bad;
4991		}
4992		if (ch->chunk_type != SCTP_ABORT_ASSOCIATION)
4993			sctp_send_abort(m, iphlen, sh, 0, NULL, vrf_id,
4994			    table_id);
4995		goto bad;
4996	} else if (stcb == NULL) {
4997		refcount_up = 1;
4998	}
4999#ifdef IPSEC
5000	/*
5001	 * I very much doubt any of the IPSEC stuff will work but I have no
5002	 * idea, so I will leave it in place.
5003	 */
5004
5005	if (inp && ipsec4_in_reject(m, &inp->ip_inp.inp)) {
5006		ipsecstat.in_polvio++;
5007		SCTP_STAT_INCR(sctps_hdrops);
5008		goto bad;
5009	}
5010#endif				/* IPSEC */
5011
5012	/*
5013	 * common chunk processing
5014	 */
5015	length = ip->ip_len + iphlen;
5016	offset -= sizeof(struct sctp_chunkhdr);
5017
5018	ecn_bits = ip->ip_tos;
5019
5020	sctp_common_input_processing(&m, iphlen, offset, length, sh, ch,
5021	    inp, stcb, net, ecn_bits, vrf_id,
5022	    table_id);
5023	/* inp's ref-count reduced && stcb unlocked */
5024	if (m) {
5025		sctp_m_freem(m);
5026	}
5027	if ((inp) && (refcount_up)) {
5028		/* reduce ref-count */
5029		SCTP_INP_WLOCK(inp);
5030		SCTP_INP_DECR_REF(inp);
5031		SCTP_INP_WUNLOCK(inp);
5032	}
5033	return;
5034bad:
5035	if (stcb)
5036		SCTP_TCB_UNLOCK(stcb);
5037
5038	if ((inp) && (refcount_up)) {
5039		/* reduce ref-count */
5040		SCTP_INP_WLOCK(inp);
5041		SCTP_INP_DECR_REF(inp);
5042		SCTP_INP_WUNLOCK(inp);
5043	}
5044	if (m) {
5045		sctp_m_freem(m);
5046	}
5047	/* For BSD/MAC this does nothing */
5048	SCTP_DETACH_HEADER_FROM_CHAIN(i_pak);
5049	SCTP_RELEASE_HEADER(i_pak);
5050	return;
5051}
5052