The Tor Browser / file revision

 /*-

  * Copyright (c) 2001-2008, by Cisco Systems, Inc. All rights reserved.

  * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved.

  * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved.

  *

  * Redistribution and use in source and binary forms, with or without

  * modification, are permitted provided that the following conditions are met:

  *

  * a) Redistributions of source code must retain the above copyright notice,

  *    this list of conditions and the following disclaimer.

  *

  * b) Redistributions in binary form must reproduce the above copyright

  *    notice, this list of conditions and the following disclaimer in

  *    the documentation and/or other materials provided with the distribution.

  *

  * c) Neither the name of Cisco Systems, Inc. nor the names of its

  *    contributors may be used to endorse or promote products derived

  *    from this software without specific prior written permission.

  *

  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS

  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,

  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE

  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE

  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR

  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF

  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS

  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN

  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF

  * THE POSSIBILITY OF SUCH DAMAGE.

  */

 #ifdef __FreeBSD__

 #include <sys/cdefs.h>

 __FBSDID("$FreeBSD: head/sys/netinet/sctp_input.c 262252 2014-02-20 20:14:43Z tuexen $");

 #endif

 #include <netinet/sctp_os.h>

 #include <netinet/sctp_var.h>

 #include <netinet/sctp_sysctl.h>

 #include <netinet/sctp_pcb.h>

 #include <netinet/sctp_header.h>

 #include <netinet/sctputil.h>

 #include <netinet/sctp_output.h>

 #include <netinet/sctp_input.h>

 #include <netinet/sctp_auth.h>

 #include <netinet/sctp_indata.h>

 #include <netinet/sctp_asconf.h>

 #include <netinet/sctp_bsd_addr.h>

 #include <netinet/sctp_timer.h>

 #include <netinet/sctp_crc32.h>

 #if !defined(__Userspace_os_Windows)

 #include <netinet/udp.h>

 #endif

 #if defined(__FreeBSD__)

 #include <sys/smp.h>

 #endif

 #if defined(__APPLE__)

 #define APPLE_FILE_NO 2

 #endif

 static void

 sctp_stop_all_cookie_timers(struct sctp_tcb *stcb)

 {

 	struct sctp_nets *net;

 	/* This now not only stops all cookie timers

 	 * it also stops any INIT timers as well. This

 	 * will make sure that the timers are stopped in

 	 * all collision cases.

 	 */

 	SCTP_TCB_LOCK_ASSERT(stcb);

 	TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {

 		if (net->rxt_timer.type == SCTP_TIMER_TYPE_COOKIE) {

 			sctp_timer_stop(SCTP_TIMER_TYPE_COOKIE,

 					stcb->sctp_ep,

 					stcb,

 					net, SCTP_FROM_SCTP_INPUT+SCTP_LOC_1);

 		} else if (net->rxt_timer.type == SCTP_TIMER_TYPE_INIT) {

 			sctp_timer_stop(SCTP_TIMER_TYPE_INIT,

 					stcb->sctp_ep,

 					stcb,

 					net, SCTP_FROM_SCTP_INPUT+SCTP_LOC_2);

 		}

 	}

 }

 /* INIT handler */

 static void

 sctp_handle_init(struct mbuf *m, int iphlen, int offset,

                  struct sockaddr *src, struct sockaddr *dst, struct sctphdr *sh,

                  struct sctp_init_chunk *cp, struct sctp_inpcb *inp,

                  struct sctp_tcb *stcb, int *abort_no_unlock,

 #if defined(__FreeBSD__)

                  uint8_t use_mflowid, uint32_t mflowid,

 #endif

                  uint32_t vrf_id, uint16_t port)

 {

 	struct sctp_init *init;

 	struct mbuf *op_err;

 	SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_init: handling INIT tcb:%p\n",

 		(void *)stcb);

 	if (stcb == NULL) {

 		SCTP_INP_RLOCK(inp);

 	}

 	/* validate length */

 	if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_init_chunk)) {

 		op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);

 		sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err,

 #if defined(__FreeBSD__)

 		                       use_mflowid, mflowid,

 #endif

 				       vrf_id, port);

 		if (stcb)

 			*abort_no_unlock = 1;

 		goto outnow;

 	}

 	/* validate parameters */

 	init = &cp->init;

 	if (init->initiate_tag == 0) {

 		/* protocol error... send abort */

 		op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);

 		sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err,

 #if defined(__FreeBSD__)

 		                       use_mflowid, mflowid,

 #endif

 				       vrf_id, port);

 		if (stcb)

 			*abort_no_unlock = 1;

 		goto outnow;

 	}

 	if (ntohl(init->a_rwnd) < SCTP_MIN_RWND) {

 		/* invalid parameter... send abort */

 		op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);

 		sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err,

 #if defined(__FreeBSD__)

 		                       use_mflowid, mflowid,

 #endif

 				       vrf_id, port);

 		if (stcb)

 			*abort_no_unlock = 1;

 		goto outnow;

 	}

 	if (init->num_inbound_streams == 0) {

 		/* protocol error... send abort */

 		op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);

 		sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err,

 #if defined(__FreeBSD__)

 		                       use_mflowid, mflowid,

 #endif

 				       vrf_id, port);

 		if (stcb)

 			*abort_no_unlock = 1;

 		goto outnow;

 	}

 	if (init->num_outbound_streams == 0) {

 		/* protocol error... send abort */

 		op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);

 		sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err,

 #if defined(__FreeBSD__)

 		                       use_mflowid, mflowid,

 #endif

 				       vrf_id, port);

 		if (stcb)

 			*abort_no_unlock = 1;

 		goto outnow;

 	}

 	if (sctp_validate_init_auth_params(m, offset + sizeof(*cp),

 					   offset + ntohs(cp->ch.chunk_length))) {

 		/* auth parameter(s) error... send abort */

 		sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, NULL,

 #if defined(__FreeBSD__)

 		                       use_mflowid, mflowid,

 #endif

 		                       vrf_id, port);

 		if (stcb)

 			*abort_no_unlock = 1;

 		goto outnow;

 	}

 	/* We are only accepting if we have a socket with positive so_qlimit.*/

 	if ((stcb == NULL) &&

 	    ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||

 	     (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||

 	     (inp->sctp_socket == NULL) ||

 	     (inp->sctp_socket->so_qlimit == 0))) {

 		/*

 		 * FIX ME ?? What about TCP model and we have a

 		 * match/restart case? Actually no fix is needed.

 		 * the lookup will always find the existing assoc so stcb

 		 * would not be NULL. It may be questionable to do this

 		 * since we COULD just send back the INIT-ACK and hope that

 		 * the app did accept()'s by the time the COOKIE was sent. But

 		 * there is a price to pay for COOKIE generation and I don't

 		 * want to pay it on the chance that the app will actually do

 		 * some accepts(). The App just looses and should NOT be in

 		 * this state :-)

 		 */

 		if (SCTP_BASE_SYSCTL(sctp_blackhole) == 0) {

 			sctp_send_abort(m, iphlen, src, dst, sh, 0, NULL,

 #if defined(__FreeBSD__)

 			                use_mflowid, mflowid,

 #endif

 			                vrf_id, port);

 		}

 		goto outnow;

 	}

 	if ((stcb != NULL) &&

 	    (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT)) {

 		SCTPDBG(SCTP_DEBUG_INPUT3, "sctp_handle_init: sending SHUTDOWN-ACK\n");

 		sctp_send_shutdown_ack(stcb, NULL);

 		sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC, SCTP_SO_NOT_LOCKED);

 	} else {

 		SCTPDBG(SCTP_DEBUG_INPUT3, "sctp_handle_init: sending INIT-ACK\n");

 		sctp_send_initiate_ack(inp, stcb, m, iphlen, offset, src, dst,

 		                       sh, cp,

 #if defined(__FreeBSD__)

 		                       use_mflowid, mflowid,

 #endif

 		                       vrf_id, port,

 		                       ((stcb == NULL) ? SCTP_HOLDS_LOCK : SCTP_NOT_LOCKED));

 	}

  outnow:

 	if (stcb == NULL) {

 		SCTP_INP_RUNLOCK(inp);

 	}

 }

 /*

  * process peer "INIT/INIT-ACK" chunk returns value < 0 on error

  */

 int

 sctp_is_there_unsent_data(struct sctp_tcb *stcb, int so_locked

 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)

 	SCTP_UNUSED

 #endif

 )

 {

 	int unsent_data = 0;

 	unsigned int i;

 	struct sctp_stream_queue_pending *sp;

 	struct sctp_association *asoc;

 	/* This function returns the number of streams that have

 	 * true unsent data on them. Note that as it looks through

 	 * it will clean up any places that have old data that

 	 * has been sent but left at top of stream queue.

 	 */

 	asoc = &stcb->asoc;

 	SCTP_TCB_SEND_LOCK(stcb);

 	if (!stcb->asoc.ss_functions.sctp_ss_is_empty(stcb, asoc)) {

 		/* Check to see if some data queued */

 		for (i = 0; i < stcb->asoc.streamoutcnt; i++) {

 			/*sa_ignore FREED_MEMORY*/

 			sp = TAILQ_FIRST(&stcb->asoc.strmout[i].outqueue);

 			if (sp == NULL) {

 				continue;

 			}

 			if ((sp->msg_is_complete) &&

 			    (sp->length == 0)  &&

 			    (sp->sender_all_done)) {

 				/* We are doing differed cleanup. Last

 				 * time through when we took all the data

 				 * the sender_all_done was not set.

 				 */

 				if (sp->put_last_out == 0) {

 					SCTP_PRINTF("Gak, put out entire msg with NO end!-1\n");

 					SCTP_PRINTF("sender_done:%d len:%d msg_comp:%d put_last_out:%d\n",

 					            sp->sender_all_done,

 					            sp->length,

 					            sp->msg_is_complete,

 					            sp->put_last_out);

 				}

 				atomic_subtract_int(&stcb->asoc.stream_queue_cnt, 1);

 				TAILQ_REMOVE(&stcb->asoc.strmout[i].outqueue, sp, next);

 				if (sp->net) {

 					sctp_free_remote_addr(sp->net);

 					sp->net = NULL;

 				}

 				if (sp->data) {

 					sctp_m_freem(sp->data);

 					sp->data = NULL;

 				}

 				sctp_free_a_strmoq(stcb, sp, so_locked);

 			} else {

 				unsent_data++;

 				break;

 			}

 		}

 	}

 	SCTP_TCB_SEND_UNLOCK(stcb);

 	return (unsent_data);

 }

 static int

 sctp_process_init(struct sctp_init_chunk *cp, struct sctp_tcb *stcb)

 {

 	struct sctp_init *init;

 	struct sctp_association *asoc;

 	struct sctp_nets *lnet;

 	unsigned int i;

 	init = &cp->init;

 	asoc = &stcb->asoc;

 	/* save off parameters */

 	asoc->peer_vtag = ntohl(init->initiate_tag);

 	asoc->peers_rwnd = ntohl(init->a_rwnd);

 	/* init tsn's */

 	asoc->highest_tsn_inside_map = asoc->asconf_seq_in = ntohl(init->initial_tsn) - 1;

 	if (!TAILQ_EMPTY(&asoc->nets)) {

 		/* update any ssthresh's that may have a default */

 		TAILQ_FOREACH(lnet, &asoc->nets, sctp_next) {

 			lnet->ssthresh = asoc->peers_rwnd;

 			if (SCTP_BASE_SYSCTL(sctp_logging_level) & (SCTP_CWND_MONITOR_ENABLE|SCTP_CWND_LOGGING_ENABLE)) {

 				sctp_log_cwnd(stcb, lnet, 0, SCTP_CWND_INITIALIZATION);

 			}

 		}

 	}

 	SCTP_TCB_SEND_LOCK(stcb);

 	if (asoc->pre_open_streams > ntohs(init->num_inbound_streams)) {

 		unsigned int newcnt;

 		struct sctp_stream_out *outs;

 		struct sctp_stream_queue_pending *sp, *nsp;

 		struct sctp_tmit_chunk *chk, *nchk;

 		/* abandon the upper streams */

 		newcnt = ntohs(init->num_inbound_streams);

 		TAILQ_FOREACH_SAFE(chk, &asoc->send_queue, sctp_next, nchk) {

 			if (chk->rec.data.stream_number >= newcnt) {

 				TAILQ_REMOVE(&asoc->send_queue, chk, sctp_next);

 				asoc->send_queue_cnt--;

 				if (asoc->strmout[chk->rec.data.stream_number].chunks_on_queues > 0) {

 					asoc->strmout[chk->rec.data.stream_number].chunks_on_queues--;

 #ifdef INVARIANTS

 				} else {

 					panic("No chunks on the queues for sid %u.", chk->rec.data.stream_number);

 #endif

 				}

 				if (chk->data != NULL) {

 					sctp_free_bufspace(stcb, asoc, chk, 1);

 					sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb,

 					                0, chk, SCTP_SO_NOT_LOCKED);

 					if (chk->data) {

 						sctp_m_freem(chk->data);

 						chk->data = NULL;

 					}

 				}

 				sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);

 				/*sa_ignore FREED_MEMORY*/

 			}

 		}

 		if (asoc->strmout) {

 			for (i = newcnt; i < asoc->pre_open_streams; i++) {

 				outs = &asoc->strmout[i];

 				TAILQ_FOREACH_SAFE(sp, &outs->outqueue, next, nsp) {

 					TAILQ_REMOVE(&outs->outqueue, sp, next);

 					asoc->stream_queue_cnt--;

 					sctp_ulp_notify(SCTP_NOTIFY_SPECIAL_SP_FAIL,

 					    stcb, 0, sp, SCTP_SO_NOT_LOCKED);

 					if (sp->data) {

 						sctp_m_freem(sp->data);

 						sp->data = NULL;

 					}

 					if (sp->net) {

 						sctp_free_remote_addr(sp->net);

 						sp->net = NULL;

 					}

 					/* Free the chunk */

 					sctp_free_a_strmoq(stcb, sp, SCTP_SO_NOT_LOCKED);

 					/*sa_ignore FREED_MEMORY*/

 				}

 			}

 		}

 		/* cut back the count */

 		asoc->pre_open_streams = newcnt;

 	}

 	SCTP_TCB_SEND_UNLOCK(stcb);

 	asoc->strm_realoutsize = asoc->streamoutcnt = asoc->pre_open_streams;

 	/* EY - nr_sack: initialize highest tsn in nr_mapping_array */

 	asoc->highest_tsn_inside_nr_map = asoc->highest_tsn_inside_map;

 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {

 		sctp_log_map(0, 5, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);

 	}

 	/* This is the next one we expect */

 	asoc->str_reset_seq_in = asoc->asconf_seq_in + 1;

 	asoc->mapping_array_base_tsn = ntohl(init->initial_tsn);

 	asoc->tsn_last_delivered = asoc->cumulative_tsn = asoc->asconf_seq_in;

 	asoc->advanced_peer_ack_point = asoc->last_acked_seq;

 	/* open the requested streams */

 	if (asoc->strmin != NULL) {

 		/* Free the old ones */

 		struct sctp_queued_to_read *ctl, *nctl;

 		for (i = 0; i < asoc->streamincnt; i++) {

 			TAILQ_FOREACH_SAFE(ctl, &asoc->strmin[i].inqueue, next, nctl) {

 				TAILQ_REMOVE(&asoc->strmin[i].inqueue, ctl, next);

 				sctp_free_remote_addr(ctl->whoFrom);

 				ctl->whoFrom = NULL;

 				sctp_m_freem(ctl->data);

 				ctl->data = NULL;

 				sctp_free_a_readq(stcb, ctl);

 			}

 		}

 		SCTP_FREE(asoc->strmin, SCTP_M_STRMI);

 	}

 	if (asoc->max_inbound_streams > ntohs(init->num_outbound_streams)) {

 		asoc->streamincnt = ntohs(init->num_outbound_streams);

 	} else {

 		asoc->streamincnt = asoc->max_inbound_streams;

 	}

 	SCTP_MALLOC(asoc->strmin, struct sctp_stream_in *, asoc->streamincnt *

 		    sizeof(struct sctp_stream_in), SCTP_M_STRMI);

 	if (asoc->strmin == NULL) {

 		/* we didn't get memory for the streams! */

 		SCTPDBG(SCTP_DEBUG_INPUT2, "process_init: couldn't get memory for the streams!\n");

 		return (-1);

 	}

 	for (i = 0; i < asoc->streamincnt; i++) {

 		asoc->strmin[i].stream_no = i;

 		asoc->strmin[i].last_sequence_delivered = 0xffff;

 		TAILQ_INIT(&asoc->strmin[i].inqueue);

 		asoc->strmin[i].delivery_started = 0;

 	}

 	/*

 	 * load_address_from_init will put the addresses into the

 	 * association when the COOKIE is processed or the INIT-ACK is

 	 * processed. Both types of COOKIE's existing and new call this

 	 * routine. It will remove addresses that are no longer in the

 	 * association (for the restarting case where addresses are

 	 * removed). Up front when the INIT arrives we will discard it if it

 	 * is a restart and new addresses have been added.

 	 */

 	/* sa_ignore MEMLEAK */

 	return (0);

 }

 /*

  * INIT-ACK message processing/consumption returns value < 0 on error

  */

 static int

 sctp_process_init_ack(struct mbuf *m, int iphlen, int offset,

                       struct sockaddr *src, struct sockaddr *dst, struct sctphdr *sh,

                       struct sctp_init_ack_chunk *cp, struct sctp_tcb *stcb,

                       struct sctp_nets *net, int *abort_no_unlock,

 #if defined(__FreeBSD__)

 		      uint8_t use_mflowid, uint32_t mflowid,

 #endif

                       uint32_t vrf_id)

 {

 	struct sctp_association *asoc;

 	struct mbuf *op_err;

 	int retval, abort_flag;

 	uint32_t initack_limit;

 	int nat_friendly = 0;

 	/* First verify that we have no illegal param's */

 	abort_flag = 0;

 	op_err = sctp_arethere_unrecognized_parameters(m,

 						       (offset + sizeof(struct sctp_init_chunk)),

 						       &abort_flag, (struct sctp_chunkhdr *)cp, &nat_friendly);

 	if (abort_flag) {

 		/* Send an abort and notify peer */

 		sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);

 		*abort_no_unlock = 1;

 		return (-1);

 	}

 	asoc = &stcb->asoc;

 	asoc->peer_supports_nat = (uint8_t)nat_friendly;

 	/* process the peer's parameters in the INIT-ACK */

 	retval = sctp_process_init((struct sctp_init_chunk *)cp, stcb);

 	if (retval < 0) {

 		return (retval);

 	}

 	initack_limit = offset + ntohs(cp->ch.chunk_length);

 	/* load all addresses */

 	if ((retval = sctp_load_addresses_from_init(stcb, m,

 	    (offset + sizeof(struct sctp_init_chunk)), initack_limit,

 	    src, dst, NULL))) {

 		/* Huh, we should abort */

 		SCTPDBG(SCTP_DEBUG_INPUT1,

 			"Load addresses from INIT causes an abort %d\n",

 			retval);

 		sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,

 		                       src, dst, sh, NULL,

 #if defined(__FreeBSD__)

 		                       use_mflowid, mflowid,

 #endif

 		                       vrf_id, net->port);

 		*abort_no_unlock = 1;

 		return (-1);

 	}

 	/* if the peer doesn't support asconf, flush the asconf queue */

 	if (asoc->peer_supports_asconf == 0) {

 		struct sctp_asconf_addr *param, *nparam;

 		TAILQ_FOREACH_SAFE(param, &asoc->asconf_queue, next, nparam) {

 			TAILQ_REMOVE(&asoc->asconf_queue, param, next);

 			SCTP_FREE(param, SCTP_M_ASC_ADDR);

 		}

 	}

 	stcb->asoc.peer_hmac_id = sctp_negotiate_hmacid(stcb->asoc.peer_hmacs,

 	    stcb->asoc.local_hmacs);

 	if (op_err) {

 		sctp_queue_op_err(stcb, op_err);

 		/* queuing will steal away the mbuf chain to the out queue */

 		op_err = NULL;

 	}

 	/* extract the cookie and queue it to "echo" it back... */

 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {

 		sctp_misc_ints(SCTP_THRESHOLD_CLEAR,

 			       stcb->asoc.overall_error_count,

 			       0,

 			       SCTP_FROM_SCTP_INPUT,

 			       __LINE__);

 	}

 	stcb->asoc.overall_error_count = 0;

 	net->error_count = 0;

 	/*

 	 * Cancel the INIT timer, We do this first before queueing the

 	 * cookie. We always cancel at the primary to assue that we are

 	 * canceling the timer started by the INIT which always goes to the

 	 * primary.

 	 */

 	sctp_timer_stop(SCTP_TIMER_TYPE_INIT, stcb->sctp_ep, stcb,

 	    asoc->primary_destination, SCTP_FROM_SCTP_INPUT+SCTP_LOC_4);

 	/* calculate the RTO */

 	net->RTO = sctp_calculate_rto(stcb, asoc, net, &asoc->time_entered, sctp_align_safe_nocopy,

 				      SCTP_RTT_FROM_NON_DATA);

 	retval = sctp_send_cookie_echo(m, offset, stcb, net);

 	if (retval < 0) {

 		/*

 		 * No cookie, we probably should send a op error. But in any

 		 * case if there is no cookie in the INIT-ACK, we can

 		 * abandon the peer, its broke.

 		 */

 		if (retval == -3) {

 			/* We abort with an error of missing mandatory param */

 			op_err =

 			    sctp_generate_invmanparam(SCTP_CAUSE_MISSING_PARAM);

 			if (op_err) {

 				/*

 				 * Expand beyond to include the mandatory

 				 * param cookie

 				 */

 				struct sctp_inv_mandatory_param *mp;

 				SCTP_BUF_LEN(op_err) =

 				    sizeof(struct sctp_inv_mandatory_param);

 				mp = mtod(op_err,

 				    struct sctp_inv_mandatory_param *);

 				/* Subtract the reserved param */

 				mp->length =

 				    htons(sizeof(struct sctp_inv_mandatory_param) - 2);

 				mp->num_param = htonl(1);

 				mp->param = htons(SCTP_STATE_COOKIE);

 				mp->resv = 0;

 			}

 			sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,

 			                       src, dst, sh, op_err,

 #if defined(__FreeBSD__)

 			                       use_mflowid, mflowid,

 #endif

 			                       vrf_id, net->port);

 			*abort_no_unlock = 1;

 		}

 		return (retval);

 	}

 	return (0);

 }

 static void

 sctp_handle_heartbeat_ack(struct sctp_heartbeat_chunk *cp,

     struct sctp_tcb *stcb, struct sctp_nets *net)

 {

 	struct sockaddr_storage store;

 	struct sctp_nets *r_net, *f_net;

 	struct timeval tv;

 	int req_prim = 0;

 	uint16_t old_error_counter;

 #ifdef INET

 	struct sockaddr_in *sin;

 #endif

 #ifdef INET6

 	struct sockaddr_in6 *sin6;

 #endif

 #if defined(__Userspace__)

 	struct sockaddr_conn *sconn;

 #endif

 	if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_heartbeat_chunk)) {

 		/* Invalid length */

 		return;

 	}

 	memset(&store, 0, sizeof(store));

 	switch (cp->heartbeat.hb_info.addr_family) {

 #ifdef INET

 	case AF_INET:

 		if (cp->heartbeat.hb_info.addr_len == sizeof(struct sockaddr_in)) {

 			sin = (struct sockaddr_in *)&store;

 			sin->sin_family = cp->heartbeat.hb_info.addr_family;

 #ifdef HAVE_SIN_LEN

 			sin->sin_len = cp->heartbeat.hb_info.addr_len;

 #endif

 			sin->sin_port = stcb->rport;

 			memcpy(&sin->sin_addr, cp->heartbeat.hb_info.address,

 			       sizeof(sin->sin_addr));

 		} else {

 			return;

 		}

 		break;

 #endif

 #ifdef INET6

 	case AF_INET6:

 		if (cp->heartbeat.hb_info.addr_len == sizeof(struct sockaddr_in6)) {

 			sin6 = (struct sockaddr_in6 *)&store;

 			sin6->sin6_family = cp->heartbeat.hb_info.addr_family;

 #ifdef HAVE_SIN6_LEN

 			sin6->sin6_len = cp->heartbeat.hb_info.addr_len;

 #endif

 			sin6->sin6_port = stcb->rport;

 			memcpy(&sin6->sin6_addr, cp->heartbeat.hb_info.address,

 			       sizeof(sin6->sin6_addr));

 		} else {

 			return;

 		}

 		break;

 #endif

 #if defined(__Userspace__)

 	case AF_CONN:

 		if (cp->heartbeat.hb_info.addr_len == sizeof(struct sockaddr_conn)) {

 			sconn = (struct sockaddr_conn *)&store;

 			sconn->sconn_family = cp->heartbeat.hb_info.addr_family;

 #ifdef HAVE_SCONN_LEN

 			sconn->sconn_len = cp->heartbeat.hb_info.addr_len;

 #endif

 			sconn->sconn_port = stcb->rport;

 			memcpy(&sconn->sconn_addr, cp->heartbeat.hb_info.address,

 			       sizeof(sconn->sconn_addr));

 		} else {

 			return;

 		}

 		break;

 #endif

 	default:

 		return;

 	}

 	r_net = sctp_findnet(stcb, (struct sockaddr *)&store);

 	if (r_net == NULL) {

 		SCTPDBG(SCTP_DEBUG_INPUT1, "Huh? I can't find the address I sent it to, discard\n");

 		return;

 	}

 	if ((r_net && (r_net->dest_state & SCTP_ADDR_UNCONFIRMED)) &&

 	    (r_net->heartbeat_random1 == cp->heartbeat.hb_info.random_value1) &&

 	    (r_net->heartbeat_random2 == cp->heartbeat.hb_info.random_value2)) {

 		/*

 		 * If the its a HB and it's random value is correct when can

 		 * confirm the destination.

 		 */

 		r_net->dest_state &= ~SCTP_ADDR_UNCONFIRMED;

 		if (r_net->dest_state & SCTP_ADDR_REQ_PRIMARY) {

 			stcb->asoc.primary_destination = r_net;

 			r_net->dest_state &= ~SCTP_ADDR_REQ_PRIMARY;

 			f_net = TAILQ_FIRST(&stcb->asoc.nets);

 			if (f_net != r_net) {

 				/* first one on the list is NOT the primary

 				 * sctp_cmpaddr() is much more efficent if

 				 * the primary is the first on the list, make it

 				 * so.

 				 */

 				TAILQ_REMOVE(&stcb->asoc.nets, r_net, sctp_next);

 				TAILQ_INSERT_HEAD(&stcb->asoc.nets, r_net, sctp_next);

 			}

 			req_prim = 1;

 		}

 		sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,

 		    stcb, 0, (void *)r_net, SCTP_SO_NOT_LOCKED);

 		sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb, r_net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_3);

 		sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb, r_net);

 	}

 	old_error_counter = r_net->error_count;

 	r_net->error_count = 0;

 	r_net->hb_responded = 1;

 	tv.tv_sec = cp->heartbeat.hb_info.time_value_1;

 	tv.tv_usec = cp->heartbeat.hb_info.time_value_2;

 	/* Now lets do a RTO with this */

 	r_net->RTO = sctp_calculate_rto(stcb, &stcb->asoc, r_net, &tv, sctp_align_safe_nocopy,

 					SCTP_RTT_FROM_NON_DATA);

 	if (!(r_net->dest_state & SCTP_ADDR_REACHABLE)) {

 		r_net->dest_state |= SCTP_ADDR_REACHABLE;

 		sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_UP, stcb,

 				0, (void *)r_net, SCTP_SO_NOT_LOCKED);

 	}

 	if (r_net->dest_state & SCTP_ADDR_PF) {

 		r_net->dest_state &= ~SCTP_ADDR_PF;

 		stcb->asoc.cc_functions.sctp_cwnd_update_exit_pf(stcb, net);

 	}

 	if (old_error_counter > 0) {

 		sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb, r_net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_3);

 		sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb, r_net);

 	}

 	if (r_net == stcb->asoc.primary_destination) {

 		if (stcb->asoc.alternate) {

 			/* release the alternate, primary is good */

 			sctp_free_remote_addr(stcb->asoc.alternate);

 			stcb->asoc.alternate = NULL;

 		}

 	}

 	/* Mobility adaptation */

 	if (req_prim) {

 		if ((sctp_is_mobility_feature_on(stcb->sctp_ep,

 				       	SCTP_MOBILITY_BASE) ||

 	    	    sctp_is_mobility_feature_on(stcb->sctp_ep,

 			    		SCTP_MOBILITY_FASTHANDOFF)) &&

 	    	    sctp_is_mobility_feature_on(stcb->sctp_ep,

 					SCTP_MOBILITY_PRIM_DELETED)) {

 			sctp_timer_stop(SCTP_TIMER_TYPE_PRIM_DELETED, stcb->sctp_ep, stcb, NULL, SCTP_FROM_SCTP_TIMER+SCTP_LOC_7);

 			if (sctp_is_mobility_feature_on(stcb->sctp_ep,

 					SCTP_MOBILITY_FASTHANDOFF)) {

 				sctp_assoc_immediate_retrans(stcb,

 					stcb->asoc.primary_destination);

 			}

 			if (sctp_is_mobility_feature_on(stcb->sctp_ep,

 					SCTP_MOBILITY_BASE)) {

 				sctp_move_chunks_from_net(stcb,

 					stcb->asoc.deleted_primary);

 			}

 			sctp_delete_prim_timer(stcb->sctp_ep, stcb,

 					stcb->asoc.deleted_primary);

 		}

 	}

 }

 static int

 sctp_handle_nat_colliding_state(struct sctp_tcb *stcb)

 {

 	/* return 0 means we want you to proceed with the abort

 	 * non-zero means no abort processing

 	*/

 	struct sctpasochead *head;

 	if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_WAIT) {

 		/* generate a new vtag and send init */

 		LIST_REMOVE(stcb, sctp_asocs);

 		stcb->asoc.my_vtag = sctp_select_a_tag(stcb->sctp_ep, stcb->sctp_ep->sctp_lport, stcb->rport, 1);

 		head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag, SCTP_BASE_INFO(hashasocmark))];

 		/* put it in the bucket in the vtag hash of assoc's for the system */

 		LIST_INSERT_HEAD(head, stcb, sctp_asocs);

 		sctp_send_initiate(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);

 		return (1);

 	}

 	if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_ECHOED) {

 		/* treat like a case where the cookie expired i.e.:

 		* - dump current cookie.

 		* - generate a new vtag.

 		* - resend init.

 		*/

 		/* generate a new vtag and send init */

 		LIST_REMOVE(stcb, sctp_asocs);

 		stcb->asoc.state &= ~SCTP_STATE_COOKIE_ECHOED;

 		stcb->asoc.state |= SCTP_STATE_COOKIE_WAIT;

 		sctp_stop_all_cookie_timers(stcb);

 		sctp_toss_old_cookies(stcb, &stcb->asoc);

 		stcb->asoc.my_vtag = sctp_select_a_tag(stcb->sctp_ep, stcb->sctp_ep->sctp_lport, stcb->rport,  1);

 		head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag, SCTP_BASE_INFO(hashasocmark))];

 		/* put it in the bucket in the vtag hash of assoc's for the system */

 		LIST_INSERT_HEAD(head, stcb, sctp_asocs);

 		sctp_send_initiate(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);

 		return (1);

 	}

 	return (0);

 }

 static int

 sctp_handle_nat_missing_state(struct sctp_tcb *stcb,

 			      struct sctp_nets *net)

 {

   /* return 0 means we want you to proceed with the abort

    * non-zero means no abort processing

    */

   if (stcb->asoc.peer_supports_auth == 0) {

     SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_nat_missing_state: Peer does not support AUTH, cannot send an asconf\n");

     return (0);

   }

   sctp_asconf_send_nat_state_update(stcb, net);

   return (1);

 }

 static void

 sctp_handle_abort(struct sctp_abort_chunk *abort,

     struct sctp_tcb *stcb, struct sctp_nets *net)

 {

 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)

 	struct socket *so;

 #endif

 	uint16_t len;

 	uint16_t error;

 	SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_abort: handling ABORT\n");

 	if (stcb == NULL)

 		return;

 	len = ntohs(abort->ch.chunk_length);

 	if (len > sizeof (struct sctp_chunkhdr)) {

 		/* Need to check the cause codes for our

 		 * two magic nat aborts which don't kill the assoc

 		 * necessarily.

 		 */

 		struct sctp_missing_nat_state *natc;

 		natc = (struct sctp_missing_nat_state *)(abort + 1);

 		error = ntohs(natc->cause);

 		if (error == SCTP_CAUSE_NAT_COLLIDING_STATE) {

 			SCTPDBG(SCTP_DEBUG_INPUT2, "Received Colliding state abort flags:%x\n",

 			                           abort->ch.chunk_flags);

 			if (sctp_handle_nat_colliding_state(stcb)) {

 				return;

 			}

 		} else if (error == SCTP_CAUSE_NAT_MISSING_STATE) {

 			SCTPDBG(SCTP_DEBUG_INPUT2, "Received missing state abort flags:%x\n",

 			                           abort->ch.chunk_flags);

 			if (sctp_handle_nat_missing_state(stcb, net)) {

 				return;

 			}

 		}

 	} else {

 		error = 0;

 	}

 	/* stop any receive timers */

 	sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT+SCTP_LOC_6);

 	/* notify user of the abort and clean up... */

 	sctp_abort_notification(stcb, 1, error, abort, SCTP_SO_NOT_LOCKED);

 	/* free the tcb */

 	SCTP_STAT_INCR_COUNTER32(sctps_aborted);

 	if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||

 	    (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {

 		SCTP_STAT_DECR_GAUGE32(sctps_currestab);

 	}

 #ifdef SCTP_ASOCLOG_OF_TSNS

 	sctp_print_out_track_log(stcb);

 #endif

 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)

 	so = SCTP_INP_SO(stcb->sctp_ep);

 	atomic_add_int(&stcb->asoc.refcnt, 1);

 	SCTP_TCB_UNLOCK(stcb);

 	SCTP_SOCKET_LOCK(so, 1);

 	SCTP_TCB_LOCK(stcb);

 	atomic_subtract_int(&stcb->asoc.refcnt, 1);

 #endif

 	stcb->asoc.state |= SCTP_STATE_WAS_ABORTED;

 	(void)sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC,

 			      SCTP_FROM_SCTP_INPUT+SCTP_LOC_6);

 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)

 	SCTP_SOCKET_UNLOCK(so, 1);

 #endif

 	SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_abort: finished\n");

 }

 static void

 sctp_start_net_timers(struct sctp_tcb *stcb)

 {

 	uint32_t cnt_hb_sent;

 	struct sctp_nets *net;

 	cnt_hb_sent = 0;

 	TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {

 		/* For each network start:

 		 * 1) A pmtu timer.

 		 * 2) A HB timer

 		 * 3) If the dest in unconfirmed send

 		 *    a hb as well if under max_hb_burst have

 		 *    been sent.

 		 */

 		sctp_timer_start(SCTP_TIMER_TYPE_PATHMTURAISE, stcb->sctp_ep, stcb, net);

 		sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb, net);

 		if ((net->dest_state & SCTP_ADDR_UNCONFIRMED) &&

 		    (cnt_hb_sent < SCTP_BASE_SYSCTL(sctp_hb_maxburst))) {

 			sctp_send_hb(stcb, net, SCTP_SO_NOT_LOCKED);

 			cnt_hb_sent++;

 		}

 	}

 	if (cnt_hb_sent) {

 		sctp_chunk_output(stcb->sctp_ep, stcb,

 				  SCTP_OUTPUT_FROM_COOKIE_ACK,

 				  SCTP_SO_NOT_LOCKED);

 	}

 }

 static void

 sctp_handle_shutdown(struct sctp_shutdown_chunk *cp,

     struct sctp_tcb *stcb, struct sctp_nets *net, int *abort_flag)

 {

 	struct sctp_association *asoc;

 	int some_on_streamwheel;

 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)

 	struct socket *so;

 #endif

 	SCTPDBG(SCTP_DEBUG_INPUT2,

 		"sctp_handle_shutdown: handling SHUTDOWN\n");

 	if (stcb == NULL)

 		return;

 	asoc = &stcb->asoc;

 	if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||

 	    (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) {

 		return;

 	}

 	if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_shutdown_chunk)) {

 		/* Shutdown NOT the expected size */

 		return;

 	} else {

 		sctp_update_acked(stcb, cp, abort_flag);

 		if (*abort_flag) {

 			return;

 		}

 	}

 	if (asoc->control_pdapi) {

 		/* With a normal shutdown

 		 * we assume the end of last record.

 		 */

 		SCTP_INP_READ_LOCK(stcb->sctp_ep);

 		asoc->control_pdapi->end_added = 1;

 		asoc->control_pdapi->pdapi_aborted = 1;

 		asoc->control_pdapi = NULL;

 		SCTP_INP_READ_UNLOCK(stcb->sctp_ep);

 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)

 		so = SCTP_INP_SO(stcb->sctp_ep);

 		atomic_add_int(&stcb->asoc.refcnt, 1);

 		SCTP_TCB_UNLOCK(stcb);

 		SCTP_SOCKET_LOCK(so, 1);

 		SCTP_TCB_LOCK(stcb);

 		atomic_subtract_int(&stcb->asoc.refcnt, 1);

 		if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {

 			/* assoc was freed while we were unlocked */

 			SCTP_SOCKET_UNLOCK(so, 1);

 			return;

 		}

 #endif

 		sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);

 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)

 		SCTP_SOCKET_UNLOCK(so, 1);

 #endif

 	}

 	/* goto SHUTDOWN_RECEIVED state to block new requests */

 	if (stcb->sctp_socket) {

 		if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) &&

 		    (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT) &&

 		    (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT)) {

 			SCTP_SET_STATE(asoc, SCTP_STATE_SHUTDOWN_RECEIVED);

 			SCTP_CLEAR_SUBSTATE(asoc, SCTP_STATE_SHUTDOWN_PENDING);

 			/* notify upper layer that peer has initiated a shutdown */

 			sctp_ulp_notify(SCTP_NOTIFY_PEER_SHUTDOWN, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);

 			/* reset time */

 			(void)SCTP_GETTIME_TIMEVAL(&asoc->time_entered);

 		}

 	}

 	if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) {

 		/*

 		 * stop the shutdown timer, since we WILL move to

 		 * SHUTDOWN-ACK-SENT.

 		 */

 		sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT+SCTP_LOC_8);

 	}

 	/* Now is there unsent data on a stream somewhere? */

 	some_on_streamwheel = sctp_is_there_unsent_data(stcb, SCTP_SO_NOT_LOCKED);

 	if (!TAILQ_EMPTY(&asoc->send_queue) ||

 	    !TAILQ_EMPTY(&asoc->sent_queue) ||

 	    some_on_streamwheel) {

 		/* By returning we will push more data out */

 		return;

 	} else {

 		/* no outstanding data to send, so move on... */

 		/* send SHUTDOWN-ACK */

 		/* move to SHUTDOWN-ACK-SENT state */

 		if ((SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) ||

 		    (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {

 			SCTP_STAT_DECR_GAUGE32(sctps_currestab);

 		}

 		SCTP_SET_STATE(asoc, SCTP_STATE_SHUTDOWN_ACK_SENT);

 		SCTP_CLEAR_SUBSTATE(asoc, SCTP_STATE_SHUTDOWN_PENDING);

 		sctp_stop_timers_for_shutdown(stcb);

 		sctp_send_shutdown_ack(stcb, net);

 		sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNACK, stcb->sctp_ep,

 				 stcb, net);

 	}

 }

 static void

 sctp_handle_shutdown_ack(struct sctp_shutdown_ack_chunk *cp SCTP_UNUSED,

                          struct sctp_tcb *stcb,

                          struct sctp_nets *net)

 {

 	struct sctp_association *asoc;

 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)

 	struct socket *so;

 	so = SCTP_INP_SO(stcb->sctp_ep);

 #endif

 	SCTPDBG(SCTP_DEBUG_INPUT2,

 		"sctp_handle_shutdown_ack: handling SHUTDOWN ACK\n");

 	if (stcb == NULL)

 		return;

 	asoc = &stcb->asoc;

 	/* process according to association state */

 	if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||

 	    (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) {

 		/* unexpected SHUTDOWN-ACK... do OOTB handling... */

 		sctp_send_shutdown_complete(stcb, net, 1);

 		SCTP_TCB_UNLOCK(stcb);

 		return;

 	}

 	if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) &&

 	    (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) {

 		/* unexpected SHUTDOWN-ACK... so ignore... */

 		SCTP_TCB_UNLOCK(stcb);

 		return;

 	}

 	if (asoc->control_pdapi) {

 		/* With a normal shutdown

 		 * we assume the end of last record.

 		 */

 		SCTP_INP_READ_LOCK(stcb->sctp_ep);

 		asoc->control_pdapi->end_added = 1;

 		asoc->control_pdapi->pdapi_aborted = 1;

 		asoc->control_pdapi = NULL;

 		SCTP_INP_READ_UNLOCK(stcb->sctp_ep);

 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)

 		atomic_add_int(&stcb->asoc.refcnt, 1);

 		SCTP_TCB_UNLOCK(stcb);

 		SCTP_SOCKET_LOCK(so, 1);

 		SCTP_TCB_LOCK(stcb);

 		atomic_subtract_int(&stcb->asoc.refcnt, 1);

 		if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {

 			/* assoc was freed while we were unlocked */

 			SCTP_SOCKET_UNLOCK(so, 1);

 			return;

 		}

 #endif

 		sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);

 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)

 		SCTP_SOCKET_UNLOCK(so, 1);

 #endif

 	}

 #ifdef INVARIANTS

 	if (!TAILQ_EMPTY(&asoc->send_queue) ||

 	    !TAILQ_EMPTY(&asoc->sent_queue) ||

 	    !stcb->asoc.ss_functions.sctp_ss_is_empty(stcb, asoc)) {

 		panic("Queues are not empty when handling SHUTDOWN-ACK");

 	}

 #endif

 	/* stop the timer */

 	sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT+SCTP_LOC_9);

 	/* send SHUTDOWN-COMPLETE */

 	sctp_send_shutdown_complete(stcb, net, 0);

 	/* notify upper layer protocol */

 	if (stcb->sctp_socket) {

 		if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||

 		    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {

 			stcb->sctp_socket->so_snd.sb_cc = 0;

 		}

 		sctp_ulp_notify(SCTP_NOTIFY_ASSOC_DOWN, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);

 	}

 	SCTP_STAT_INCR_COUNTER32(sctps_shutdown);

 	/* free the TCB but first save off the ep */

 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)

 	atomic_add_int(&stcb->asoc.refcnt, 1);

 	SCTP_TCB_UNLOCK(stcb);

 	SCTP_SOCKET_LOCK(so, 1);

 	SCTP_TCB_LOCK(stcb);

 	atomic_subtract_int(&stcb->asoc.refcnt, 1);

 #endif

 	(void)sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC,

 			      SCTP_FROM_SCTP_INPUT+SCTP_LOC_10);

 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)

 	SCTP_SOCKET_UNLOCK(so, 1);

 #endif

 }

 /*

  * Skip past the param header and then we will find the chunk that caused the

  * problem. There are two possiblities ASCONF or FWD-TSN other than that and

  * our peer must be broken.

  */

 static void

 sctp_process_unrecog_chunk(struct sctp_tcb *stcb, struct sctp_paramhdr *phdr,

     struct sctp_nets *net)

 {

 	struct sctp_chunkhdr *chk;

 	chk = (struct sctp_chunkhdr *)((caddr_t)phdr + sizeof(*phdr));

 	switch (chk->chunk_type) {

 	case SCTP_ASCONF_ACK:

 	case SCTP_ASCONF:

 		sctp_asconf_cleanup(stcb, net);

 		break;

 	case SCTP_FORWARD_CUM_TSN:

 		stcb->asoc.peer_supports_prsctp = 0;

 		break;

 	default:

 		SCTPDBG(SCTP_DEBUG_INPUT2,

 			"Peer does not support chunk type %d(%x)??\n",

 			chk->chunk_type, (uint32_t) chk->chunk_type);

 		break;

 	}

 }

 /*

  * Skip past the param header and then we will find the param that caused the

  * problem.  There are a number of param's in a ASCONF OR the prsctp param

  * these will turn of specific features.

  */

 static void

 sctp_process_unrecog_param(struct sctp_tcb *stcb, struct sctp_paramhdr *phdr)

 {

 	struct sctp_paramhdr *pbad;

 	pbad = phdr + 1;

 	switch (ntohs(pbad->param_type)) {

 		/* pr-sctp draft */

 	case SCTP_PRSCTP_SUPPORTED:

 		stcb->asoc.peer_supports_prsctp = 0;

 		break;

 	case SCTP_SUPPORTED_CHUNK_EXT:

 		break;

 		/* draft-ietf-tsvwg-addip-sctp */

 	case SCTP_HAS_NAT_SUPPORT:

 	        stcb->asoc.peer_supports_nat = 0;

 	        break;

 	case SCTP_ADD_IP_ADDRESS:

 	case SCTP_DEL_IP_ADDRESS:

 	case SCTP_SET_PRIM_ADDR:

 		stcb->asoc.peer_supports_asconf = 0;

 		break;

 	case SCTP_SUCCESS_REPORT:

 	case SCTP_ERROR_CAUSE_IND:

 		SCTPDBG(SCTP_DEBUG_INPUT2, "Huh, the peer does not support success? or error cause?\n");

 		SCTPDBG(SCTP_DEBUG_INPUT2,

 			"Turning off ASCONF to this strange peer\n");

 		stcb->asoc.peer_supports_asconf = 0;

 		break;

 	default:

 		SCTPDBG(SCTP_DEBUG_INPUT2,

 			"Peer does not support param type %d(%x)??\n",

 			pbad->param_type, (uint32_t) pbad->param_type);

 		break;

 	}

 }

 static int

 sctp_handle_error(struct sctp_chunkhdr *ch,

     struct sctp_tcb *stcb, struct sctp_nets *net)

 {

 	int chklen;

 	struct sctp_paramhdr *phdr;

 	uint16_t error, error_type;

 	uint16_t error_len;

 	struct sctp_association *asoc;

 	int adjust;

 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)

 	struct socket *so;

 #endif

 	/* parse through all of the errors and process */

 	asoc = &stcb->asoc;

 	phdr = (struct sctp_paramhdr *)((caddr_t)ch +

 	    sizeof(struct sctp_chunkhdr));

 	chklen = ntohs(ch->chunk_length) - sizeof(struct sctp_chunkhdr);

 	error = 0;

 	while ((size_t)chklen >= sizeof(struct sctp_paramhdr)) {

 		/* Process an Error Cause */

 		error_type = ntohs(phdr->param_type);

 		error_len = ntohs(phdr->param_length);

 		if ((error_len > chklen) || (error_len == 0)) {

 			/* invalid param length for this param */

 			SCTPDBG(SCTP_DEBUG_INPUT1, "Bogus length in error param- chunk left:%d errorlen:%d\n",

 				chklen, error_len);

 			return (0);

 		}

 		if (error == 0) {

 			/* report the first error cause */

 			error = error_type;

 		}

 		switch (error_type) {

 		case SCTP_CAUSE_INVALID_STREAM:

 		case SCTP_CAUSE_MISSING_PARAM:

 		case SCTP_CAUSE_INVALID_PARAM:

 		case SCTP_CAUSE_NO_USER_DATA:

 			SCTPDBG(SCTP_DEBUG_INPUT1, "Software error we got a %d back? We have a bug :/ (or do they?)\n",

 				error_type);

 			break;

 		case SCTP_CAUSE_NAT_COLLIDING_STATE:

 		        SCTPDBG(SCTP_DEBUG_INPUT2, "Received Colliding state abort flags:%x\n",

 				ch->chunk_flags);

 			if (sctp_handle_nat_colliding_state(stcb)) {

 			  return (0);

 			}

 			break;

 		case SCTP_CAUSE_NAT_MISSING_STATE:

 			SCTPDBG(SCTP_DEBUG_INPUT2, "Received missing state abort flags:%x\n",

 			                           ch->chunk_flags);

 			if (sctp_handle_nat_missing_state(stcb, net)) {

 			  return (0);

 			}

 			break;

 		case SCTP_CAUSE_STALE_COOKIE:

 			/*

 			 * We only act if we have echoed a cookie and are

 			 * waiting.

 			 */

 			if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) {

 				int *p;

 				p = (int *)((caddr_t)phdr + sizeof(*phdr));

 				/* Save the time doubled */

 				asoc->cookie_preserve_req = ntohl(*p) << 1;

 				asoc->stale_cookie_count++;

 				if (asoc->stale_cookie_count >

 				    asoc->max_init_times) {

 					sctp_abort_notification(stcb, 0, 0, NULL, SCTP_SO_NOT_LOCKED);

 					/* now free the asoc */

 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)

 					so = SCTP_INP_SO(stcb->sctp_ep);

 					atomic_add_int(&stcb->asoc.refcnt, 1);

 					SCTP_TCB_UNLOCK(stcb);

 					SCTP_SOCKET_LOCK(so, 1);

 					SCTP_TCB_LOCK(stcb);

 					atomic_subtract_int(&stcb->asoc.refcnt, 1);

 #endif

 					(void)sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC,

 							      SCTP_FROM_SCTP_INPUT+SCTP_LOC_11);

 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)

 					SCTP_SOCKET_UNLOCK(so, 1);

 #endif

 					return (-1);

 				}

 				/* blast back to INIT state */

 				sctp_toss_old_cookies(stcb, &stcb->asoc);

 				asoc->state &= ~SCTP_STATE_COOKIE_ECHOED;

 				asoc->state |= SCTP_STATE_COOKIE_WAIT;

 				sctp_stop_all_cookie_timers(stcb);

 				sctp_send_initiate(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);

 			}

 			break;

 		case SCTP_CAUSE_UNRESOLVABLE_ADDR:

 			/*

 			 * Nothing we can do here, we don't do hostname

 			 * addresses so if the peer does not like my IPv6

 			 * (or IPv4 for that matter) it does not matter. If

 			 * they don't support that type of address, they can

 			 * NOT possibly get that packet type... i.e. with no

 			 * IPv6 you can't recieve a IPv6 packet. so we can

 			 * safely ignore this one. If we ever added support

 			 * for HOSTNAME Addresses, then we would need to do

 			 * something here.

 			 */

 			break;

 		case SCTP_CAUSE_UNRECOG_CHUNK:

 			sctp_process_unrecog_chunk(stcb, phdr, net);

 			break;

 		case SCTP_CAUSE_UNRECOG_PARAM:

 			sctp_process_unrecog_param(stcb, phdr);

 			break;

 		case SCTP_CAUSE_COOKIE_IN_SHUTDOWN:

 			/*

 			 * We ignore this since the timer will drive out a

 			 * new cookie anyway and there timer will drive us

 			 * to send a SHUTDOWN_COMPLETE. We can't send one

 			 * here since we don't have their tag.

 			 */

 			break;

 		case SCTP_CAUSE_DELETING_LAST_ADDR:

 		case SCTP_CAUSE_RESOURCE_SHORTAGE:

 		case SCTP_CAUSE_DELETING_SRC_ADDR:

 			/*

 			 * We should NOT get these here, but in a

 			 * ASCONF-ACK.

 			 */

 			SCTPDBG(SCTP_DEBUG_INPUT2, "Peer sends ASCONF errors in a Operational Error?<%d>?\n",

 				error_type);

 			break;

 		case SCTP_CAUSE_OUT_OF_RESC:

 			/*

 			 * And what, pray tell do we do with the fact that

 			 * the peer is out of resources? Not really sure we

 			 * could do anything but abort. I suspect this

 			 * should have came WITH an abort instead of in a

 			 * OP-ERROR.

 			 */

 			break;

 		default:

 			SCTPDBG(SCTP_DEBUG_INPUT1, "sctp_handle_error: unknown error type = 0x%xh\n",

 				error_type);

 			break;

 		}

 		adjust = SCTP_SIZE32(error_len);

 		chklen -= adjust;

 		phdr = (struct sctp_paramhdr *)((caddr_t)phdr + adjust);

 	}

 	sctp_ulp_notify(SCTP_NOTIFY_REMOTE_ERROR, stcb, error, ch, SCTP_SO_NOT_LOCKED);

 	return (0);

 }

 static int

 sctp_handle_init_ack(struct mbuf *m, int iphlen, int offset,

                      struct sockaddr *src, struct sockaddr *dst, struct sctphdr *sh,

                      struct sctp_init_ack_chunk *cp, struct sctp_tcb *stcb,

                      struct sctp_nets *net, int *abort_no_unlock,

 #if defined(__FreeBSD__)

                      uint8_t use_mflowid, uint32_t mflowid,

 #endif

                      uint32_t vrf_id)

 {

 	struct sctp_init_ack *init_ack;

 	struct mbuf *op_err;

 	SCTPDBG(SCTP_DEBUG_INPUT2,

 		"sctp_handle_init_ack: handling INIT-ACK\n");

 	if (stcb == NULL) {

 		SCTPDBG(SCTP_DEBUG_INPUT2,

 			"sctp_handle_init_ack: TCB is null\n");

 		return (-1);

 	}

 	if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_init_ack_chunk)) {

 		/* Invalid length */

 		op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);

 		sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,

 		                       src, dst, sh, op_err,

 #if defined(__FreeBSD__)

 		                       use_mflowid, mflowid,

 #endif

 		                       vrf_id, net->port);

 		*abort_no_unlock = 1;

 		return (-1);

 	}

 	init_ack = &cp->init;

 	/* validate parameters */

 	if (init_ack->initiate_tag == 0) {

 		/* protocol error... send an abort */

 		op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);

 		sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,

 		                       src, dst, sh, op_err,

 #if defined(__FreeBSD__)

 		                       use_mflowid, mflowid,

 #endif

 		                       vrf_id, net->port);

 		*abort_no_unlock = 1;

 		return (-1);

 	}

 	if (ntohl(init_ack->a_rwnd) < SCTP_MIN_RWND) {

 		/* protocol error... send an abort */

 		op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);

 		sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,

 		                       src, dst, sh, op_err,

 #if defined(__FreeBSD__)

 		                       use_mflowid, mflowid,

 #endif

 		                       vrf_id, net->port);

 		*abort_no_unlock = 1;

 		return (-1);

 	}

 	if (init_ack->num_inbound_streams == 0) {

 		/* protocol error... send an abort */

 		op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);

 		sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,

 		                       src, dst, sh, op_err,

 #if defined(__FreeBSD__)

 		                       use_mflowid, mflowid,

 #endif

 		                       vrf_id, net->port);

 		*abort_no_unlock = 1;

 		return (-1);

 	}

 	if (init_ack->num_outbound_streams == 0) {

 		/* protocol error... send an abort */

 		op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);

 		sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,

 		                       src, dst, sh, op_err,

 #if defined(__FreeBSD__)

 		                       use_mflowid, mflowid,

 #endif

 		                       vrf_id, net->port);

 		*abort_no_unlock = 1;

 		return (-1);

 	}

 	/* process according to association state... */

 	switch (stcb->asoc.state & SCTP_STATE_MASK) {

 	case SCTP_STATE_COOKIE_WAIT:

 		/* this is the expected state for this chunk */

 		/* process the INIT-ACK parameters */

 		if (stcb->asoc.primary_destination->dest_state &

 		    SCTP_ADDR_UNCONFIRMED) {

 			/*

 			 * The primary is where we sent the INIT, we can

 			 * always consider it confirmed when the INIT-ACK is

 			 * returned. Do this before we load addresses

 			 * though.

 			 */

 			stcb->asoc.primary_destination->dest_state &=

 			    ~SCTP_ADDR_UNCONFIRMED;

 			sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,

 			    stcb, 0, (void *)stcb->asoc.primary_destination, SCTP_SO_NOT_LOCKED);

 		}

 		if (sctp_process_init_ack(m, iphlen, offset, src, dst, sh, cp, stcb,

 		                          net, abort_no_unlock,

 #if defined(__FreeBSD__)

 		                          use_mflowid, mflowid,

 #endif

 		                          vrf_id) < 0) {

 			/* error in parsing parameters */

 			return (-1);

 		}

 		/* update our state */

 		SCTPDBG(SCTP_DEBUG_INPUT2, "moving to COOKIE-ECHOED state\n");

 		SCTP_SET_STATE(&stcb->asoc, SCTP_STATE_COOKIE_ECHOED);

 		/* reset the RTO calc */

 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {

 			sctp_misc_ints(SCTP_THRESHOLD_CLEAR,

 				       stcb->asoc.overall_error_count,

 				       0,

 				       SCTP_FROM_SCTP_INPUT,

 				       __LINE__);

 		}

 		stcb->asoc.overall_error_count = 0;

 		(void)SCTP_GETTIME_TIMEVAL(&stcb->asoc.time_entered);

 		/*

 		 * collapse the init timer back in case of a exponential

 		 * backoff

 		 */

 		sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, stcb->sctp_ep,

 		    stcb, net);

 		/*

 		 * the send at the end of the inbound data processing will

 		 * cause the cookie to be sent

 		 */

 		break;

 	case SCTP_STATE_SHUTDOWN_SENT:

 		/* incorrect state... discard */

 		break;

 	case SCTP_STATE_COOKIE_ECHOED:

 		/* incorrect state... discard */

 		break;

 	case SCTP_STATE_OPEN:

 		/* incorrect state... discard */

 		break;

 	case SCTP_STATE_EMPTY:

 	case SCTP_STATE_INUSE:

 	default:

 		/* incorrect state... discard */

 		return (-1);

 		break;

 	}

 	SCTPDBG(SCTP_DEBUG_INPUT1, "Leaving handle-init-ack end\n");

 	return (0);

 }

 static struct sctp_tcb *

 sctp_process_cookie_new(struct mbuf *m, int iphlen, int offset,

     struct sockaddr *src, struct sockaddr *dst,

     struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len,

     struct sctp_inpcb *inp, struct sctp_nets **netp,

     struct sockaddr *init_src, int *notification,

     int auth_skipped, uint32_t auth_offset, uint32_t auth_len,

 #if defined(__FreeBSD__)

     uint8_t use_mflowid, uint32_t mflowid,

 #endif

     uint32_t vrf_id, uint16_t port);

 /*

  * handle a state cookie for an existing association m: input packet mbuf

  * chain-- assumes a pullup on IP/SCTP/COOKIE-ECHO chunk note: this is a

  * "split" mbuf and the cookie signature does not exist offset: offset into

  * mbuf to the cookie-echo chunk

  */

 static struct sctp_tcb *

 sctp_process_cookie_existing(struct mbuf *m, int iphlen, int offset,

     struct sockaddr *src, struct sockaddr *dst,

     struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len,

     struct sctp_inpcb *inp, struct sctp_tcb *stcb, struct sctp_nets **netp,

     struct sockaddr *init_src, int *notification,

     int auth_skipped, uint32_t auth_offset, uint32_t auth_len,

 #if defined(__FreeBSD__)

     uint8_t use_mflowid, uint32_t mflowid,

 #endif

     uint32_t vrf_id, uint16_t port)

 {

 	struct sctp_association *asoc;

 	struct sctp_init_chunk *init_cp, init_buf;

 	struct sctp_init_ack_chunk *initack_cp, initack_buf;

 	struct sctp_nets *net;

 	struct mbuf *op_err;

 	struct sctp_paramhdr *ph;

 	int init_offset, initack_offset, i;

 	int retval;

 	int spec_flag = 0;

 	uint32_t how_indx;

 	net = *netp;

 	/* I know that the TCB is non-NULL from the caller */

 	asoc = &stcb->asoc;

 	for (how_indx = 0; how_indx  < sizeof(asoc->cookie_how); how_indx++) {

 		if (asoc->cookie_how[how_indx] == 0)

 			break;

 	}

 	if (how_indx < sizeof(asoc->cookie_how)) {

 		asoc->cookie_how[how_indx] = 1;

 	}

 	if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) {

 		/* SHUTDOWN came in after sending INIT-ACK */

 		sctp_send_shutdown_ack(stcb, stcb->asoc.primary_destination);

 		op_err = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr),

 					       0, M_NOWAIT, 1, MT_DATA);

 		if (op_err == NULL) {

 			/* FOOBAR */

 			return (NULL);

 		}

 		/* Set the len */

 		SCTP_BUF_LEN(op_err) = sizeof(struct sctp_paramhdr);

 		ph = mtod(op_err, struct sctp_paramhdr *);

 		ph->param_type = htons(SCTP_CAUSE_COOKIE_IN_SHUTDOWN);

 		ph->param_length = htons(sizeof(struct sctp_paramhdr));

 		sctp_send_operr_to(src, dst, sh, cookie->peers_vtag, op_err,

 #if defined(__FreeBSD__)

 		                   use_mflowid, mflowid,

 #endif

 		                   vrf_id, net->port);

 		if (how_indx < sizeof(asoc->cookie_how))

 			asoc->cookie_how[how_indx] = 2;

 		return (NULL);

 	}

 	/*

 	 * find and validate the INIT chunk in the cookie (peer's info) the

 	 * INIT should start after the cookie-echo header struct (chunk

 	 * header, state cookie header struct)

 	 */

 	init_offset = offset += sizeof(struct sctp_cookie_echo_chunk);

 	init_cp = (struct sctp_init_chunk *)

 		sctp_m_getptr(m, init_offset, sizeof(struct sctp_init_chunk),

 			      (uint8_t *) & init_buf);

 	if (init_cp == NULL) {

 		/* could not pull a INIT chunk in cookie */

 		return (NULL);

 	}

 	if (init_cp->ch.chunk_type != SCTP_INITIATION) {

 		return (NULL);

 	}

 	/*

 	 * find and validate the INIT-ACK chunk in the cookie (my info) the

 	 * INIT-ACK follows the INIT chunk

 	 */

 	initack_offset = init_offset + SCTP_SIZE32(ntohs(init_cp->ch.chunk_length));

 	initack_cp = (struct sctp_init_ack_chunk *)

 		sctp_m_getptr(m, initack_offset, sizeof(struct sctp_init_ack_chunk),

 			      (uint8_t *) & initack_buf);

 	if (initack_cp == NULL) {

 		/* could not pull INIT-ACK chunk in cookie */

 		return (NULL);

 	}

 	if (initack_cp->ch.chunk_type != SCTP_INITIATION_ACK) {

 		return (NULL);

 	}

 	if ((ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag) &&

 	    (ntohl(init_cp->init.initiate_tag) == asoc->peer_vtag)) {

 		/*

 		 * case D in Section 5.2.4 Table 2: MMAA process accordingly

 		 * to get into the OPEN state

 		 */

 		if (ntohl(initack_cp->init.initial_tsn) != asoc->init_seq_number) {

 			/*-

 			 * Opps, this means that we somehow generated two vtag's

 			 * the same. I.e. we did:

 			 *  Us               Peer

 			 *   <---INIT(tag=a)------

 			 *   ----INIT-ACK(tag=t)-->

 			 *   ----INIT(tag=t)------> *1

 			 *   <---INIT-ACK(tag=a)---

                          *   <----CE(tag=t)------------- *2

 			 *

 			 * At point *1 we should be generating a different

 			 * tag t'. Which means we would throw away the CE and send

 			 * ours instead. Basically this is case C (throw away side).

 			 */

 			if (how_indx < sizeof(asoc->cookie_how))

 				asoc->cookie_how[how_indx] = 17;

 			return (NULL);

 		}

  		switch (SCTP_GET_STATE(asoc)) {

 			case SCTP_STATE_COOKIE_WAIT:

 			case SCTP_STATE_COOKIE_ECHOED:

 				/*

 				 * INIT was sent but got a COOKIE_ECHO with the

 				 * correct tags... just accept it...but we must

 				 * process the init so that we can make sure we

 				 * have the right seq no's.

 				 */

 				/* First we must process the INIT !! */

 				retval = sctp_process_init(init_cp, stcb);

 				if (retval < 0) {

 					if (how_indx < sizeof(asoc->cookie_how))

 						asoc->cookie_how[how_indx] = 3;

 					return (NULL);

 				}

 				/* we have already processed the INIT so no problem */

 				sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb,

 						net, SCTP_FROM_SCTP_INPUT+SCTP_LOC_12);

 				sctp_timer_stop(SCTP_TIMER_TYPE_INIT, inp, stcb, net, SCTP_FROM_SCTP_INPUT+SCTP_LOC_13);

 				/* update current state */

 				if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)

 					SCTP_STAT_INCR_COUNTER32(sctps_activeestab);

 				else

 					SCTP_STAT_INCR_COUNTER32(sctps_collisionestab);

 				SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);

 				if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {

 					sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,

 							 stcb->sctp_ep, stcb, asoc->primary_destination);

 				}

 				SCTP_STAT_INCR_GAUGE32(sctps_currestab);

 				sctp_stop_all_cookie_timers(stcb);

 				if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||

 				     (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&

 				    (inp->sctp_socket->so_qlimit == 0)

 					) {

 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)

 					struct socket *so;

 #endif

 					/*

 					 * Here is where collision would go if we

 					 * did a connect() and instead got a

 					 * init/init-ack/cookie done before the

 					 * init-ack came back..

 					 */

 					stcb->sctp_ep->sctp_flags |=

 						SCTP_PCB_FLAGS_CONNECTED;

 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)

 					so = SCTP_INP_SO(stcb->sctp_ep);

 					atomic_add_int(&stcb->asoc.refcnt, 1);

 					SCTP_TCB_UNLOCK(stcb);

 					SCTP_SOCKET_LOCK(so, 1);

 					SCTP_TCB_LOCK(stcb);

 					atomic_add_int(&stcb->asoc.refcnt, -1);

 					if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {

 						SCTP_SOCKET_UNLOCK(so, 1);

  						return (NULL);

 					}

 #endif

 					soisconnected(stcb->sctp_socket);

 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)

 					SCTP_SOCKET_UNLOCK(so, 1);

 #endif

 				}

 				/* notify upper layer */

 				*notification = SCTP_NOTIFY_ASSOC_UP;

 				/*

 				 * since we did not send a HB make sure we

 				 * don't double things

 				 */

 				net->hb_responded = 1;

 				net->RTO = sctp_calculate_rto(stcb, asoc, net,

 							      &cookie->time_entered,

 							      sctp_align_unsafe_makecopy,

 							      SCTP_RTT_FROM_NON_DATA);

 				if (stcb->asoc.sctp_autoclose_ticks &&

 				    (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE))) {

 					sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE,

 							 inp, stcb, NULL);

 				}

 				break;

 			default:

 				/*

 				 * we're in the OPEN state (or beyond), so

 				 * peer must have simply lost the COOKIE-ACK

 				 */

 				break;

 		}	/* end switch */

 		sctp_stop_all_cookie_timers(stcb);

 		/*

 		 * We ignore the return code here.. not sure if we should

 		 * somehow abort.. but we do have an existing asoc. This

 		 * really should not fail.

 		 */

 		if (sctp_load_addresses_from_init(stcb, m,

 						  init_offset + sizeof(struct sctp_init_chunk),

 						  initack_offset, src, dst, init_src)) {

 			if (how_indx < sizeof(asoc->cookie_how))

 				asoc->cookie_how[how_indx] = 4;

 			return (NULL);

 		}

 		/* respond with a COOKIE-ACK */

 		sctp_toss_old_cookies(stcb, asoc);

 		sctp_send_cookie_ack(stcb);

 		if (how_indx < sizeof(asoc->cookie_how))

 			asoc->cookie_how[how_indx] = 5;

 		return (stcb);

 	}

 	if (ntohl(initack_cp->init.initiate_tag) != asoc->my_vtag &&

 	    ntohl(init_cp->init.initiate_tag) == asoc->peer_vtag &&

 	    cookie->tie_tag_my_vtag == 0 &&

 	    cookie->tie_tag_peer_vtag == 0) {

 		/*

 		 * case C in Section 5.2.4 Table 2: XMOO silently discard

 		 */

 		if (how_indx < sizeof(asoc->cookie_how))

 			asoc->cookie_how[how_indx] = 6;

 		return (NULL);

 	}

 	/* If nat support, and the below and stcb is established,

 	 * send back a ABORT(colliding state) if we are established.

 	 */

 	if ((SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN)  &&

 	    (asoc->peer_supports_nat) &&

 	    ((ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag) &&

 	    ((ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) ||

 	     (asoc->peer_vtag == 0)))) {

 		/* Special case - Peer's support nat. We may have

 		 * two init's that we gave out the same tag on since

 		 * one was not established.. i.e. we get INIT from host-1

 		 * behind the nat and we respond tag-a, we get a INIT from

 		 * host-2 behind the nat and we get tag-a again. Then we

 		 * bring up host-1 (or 2's) assoc, Then comes the cookie

 		 * from hsot-2 (or 1). Now we have colliding state. We must

 		 * send an abort here with colliding state indication.

 		 */

 		op_err = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr),

 		                               0, M_NOWAIT, 1, MT_DATA);

 		if (op_err == NULL) {

 			/* FOOBAR */

 			return (NULL);

 		}

 		/* pre-reserve some space */

 #ifdef INET6

 		SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr));

 #else

 		SCTP_BUF_RESV_UF(op_err, sizeof(struct ip));

 #endif

 		SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr));

 		SCTP_BUF_RESV_UF(op_err,  sizeof(struct sctp_chunkhdr));

 		/* Set the len */

 		SCTP_BUF_LEN(op_err) = sizeof(struct sctp_paramhdr);

 		ph = mtod(op_err, struct sctp_paramhdr *);

 		ph->param_type = htons(SCTP_CAUSE_NAT_COLLIDING_STATE);

 		ph->param_length = htons(sizeof(struct sctp_paramhdr));

 		sctp_send_abort(m, iphlen,  src, dst, sh, 0, op_err,

 #if defined(__FreeBSD__)

 		                use_mflowid, mflowid,

 #endif

 		                vrf_id, port);

 		return (NULL);

 	}

 	if ((ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag) &&

 	    ((ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) ||

 	     (asoc->peer_vtag == 0))) {

 		/*

 		 * case B in Section 5.2.4 Table 2: MXAA or MOAA my info

 		 * should be ok, re-accept peer info

 		 */

 		if (ntohl(initack_cp->init.initial_tsn) != asoc->init_seq_number) {

 			/* Extension of case C.

 			 * If we hit this, then the random number

 			 * generator returned the same vtag when we

 			 * first sent our INIT-ACK and when we later sent

 			 * our INIT. The side with the seq numbers that are

 			 * different will be the one that normnally would

 			 * have hit case C. This in effect "extends" our vtags

 			 * in this collision case to be 64 bits. The same collision

 			 * could occur aka you get both vtag and seq number the

 			 * same twice in a row.. but is much less likely. If it

 			 * did happen then we would proceed through and bring

 			 * up the assoc.. we may end up with the wrong stream

 			 * setup however.. which would be bad.. but there is

 			 * no way to tell.. until we send on a stream that does

 			 * not exist :-)

 			 */

 			if (how_indx < sizeof(asoc->cookie_how))

 				asoc->cookie_how[how_indx] = 7;

 			return (NULL);

 		}

 		if (how_indx < sizeof(asoc->cookie_how))

 			asoc->cookie_how[how_indx] = 8;

 		sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net, SCTP_FROM_SCTP_INPUT+SCTP_LOC_14);

 		sctp_stop_all_cookie_timers(stcb);

 		/*

 		 * since we did not send a HB make sure we don't double

 		 * things

 		 */

 		net->hb_responded = 1;

 		if (stcb->asoc.sctp_autoclose_ticks &&

 		    sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE)) {

 			sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb,

 					 NULL);

 		}

 		asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd);

 		asoc->pre_open_streams = ntohs(initack_cp->init.num_outbound_streams);

 		if (ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) {

 			/* Ok the peer probably discarded our

 			 * data (if we echoed a cookie+data). So anything

 			 * on the sent_queue should be marked for

 			 * retransmit, we may not get something to

 			 * kick us so it COULD still take a timeout

 			 * to move these.. but it can't hurt to mark them.

 			 */

 			struct sctp_tmit_chunk *chk;

 		        TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {

 				if (chk->sent < SCTP_DATAGRAM_RESEND) {

 					chk->sent = SCTP_DATAGRAM_RESEND;

 					sctp_flight_size_decrease(chk);

 					sctp_total_flight_decrease(stcb, chk);

 					sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);

 					spec_flag++;

 				}

 			}

 		}

 		/* process the INIT info (peer's info) */

 		retval = sctp_process_init(init_cp, stcb);

 		if (retval < 0) {

 			if (how_indx < sizeof(asoc->cookie_how))

 				asoc->cookie_how[how_indx] = 9;

 			return (NULL);

 		}

 		if (sctp_load_addresses_from_init(stcb, m,

 						  init_offset + sizeof(struct sctp_init_chunk),

 						  initack_offset, src, dst, init_src)) {

 			if (how_indx < sizeof(asoc->cookie_how))

 				asoc->cookie_how[how_indx] = 10;

 			return (NULL);

 		}

 		if ((asoc->state & SCTP_STATE_COOKIE_WAIT) ||

 		    (asoc->state & SCTP_STATE_COOKIE_ECHOED)) {

 			*notification = SCTP_NOTIFY_ASSOC_UP;

 			if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||

 			     (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&

 			    (inp->sctp_socket->so_qlimit == 0)) {

 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)

 				struct socket *so;

 #endif

 				stcb->sctp_ep->sctp_flags |=

 					SCTP_PCB_FLAGS_CONNECTED;

 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)

 				so = SCTP_INP_SO(stcb->sctp_ep);

 				atomic_add_int(&stcb->asoc.refcnt, 1);

 				SCTP_TCB_UNLOCK(stcb);

 				SCTP_SOCKET_LOCK(so, 1);

 				SCTP_TCB_LOCK(stcb);

 				atomic_add_int(&stcb->asoc.refcnt, -1);

 				if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {

 					SCTP_SOCKET_UNLOCK(so, 1);

 					return (NULL);

 				}

 #endif

 				soisconnected(stcb->sctp_socket);

 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)

 				SCTP_SOCKET_UNLOCK(so, 1);

 #endif

 			}

 			if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)

 				SCTP_STAT_INCR_COUNTER32(sctps_activeestab);

 			else

 				SCTP_STAT_INCR_COUNTER32(sctps_collisionestab);

 			SCTP_STAT_INCR_GAUGE32(sctps_currestab);

 		} else if (SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) {

 			SCTP_STAT_INCR_COUNTER32(sctps_restartestab);

 		} else {

 			SCTP_STAT_INCR_COUNTER32(sctps_collisionestab);

 		}

 		SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);

 		if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {

 			sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,

 					 stcb->sctp_ep, stcb, asoc->primary_destination);

 		}

 		sctp_stop_all_cookie_timers(stcb);

 		sctp_toss_old_cookies(stcb, asoc);

 		sctp_send_cookie_ack(stcb);

 		if (spec_flag) {

 			/* only if we have retrans set do we do this. What

 			 * this call does is get only the COOKIE-ACK out

 			 * and then when we return the normal call to

 			 * sctp_chunk_output will get the retrans out

 			 * behind this.

 			 */

 			sctp_chunk_output(inp,stcb, SCTP_OUTPUT_FROM_COOKIE_ACK, SCTP_SO_NOT_LOCKED);

 		}

 		if (how_indx < sizeof(asoc->cookie_how))

 			asoc->cookie_how[how_indx] = 11;

 		return (stcb);

 	}

 	if ((ntohl(initack_cp->init.initiate_tag) != asoc->my_vtag &&

 	     ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) &&

 	    cookie->tie_tag_my_vtag == asoc->my_vtag_nonce &&

 	    cookie->tie_tag_peer_vtag == asoc->peer_vtag_nonce &&

 	    cookie->tie_tag_peer_vtag != 0) {

 		struct sctpasochead *head;

 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)

 		struct socket *so;

 #endif

 		if (asoc->peer_supports_nat) {

 			/* This is a gross gross hack.

 			 * Just call the cookie_new code since we

 			 * are allowing a duplicate association.

 			 * I hope this works...

 			 */

 			return (sctp_process_cookie_new(m, iphlen, offset, src, dst,

 			                                sh, cookie, cookie_len,

 			                                inp, netp, init_src,notification,

 			                                auth_skipped, auth_offset, auth_len,

 #if defined(__FreeBSD__)

 			                                use_mflowid, mflowid,

 #endif

 			                                vrf_id, port));

 		}

 		/*

 		 * case A in Section 5.2.4 Table 2: XXMM (peer restarted)

 		 */

 		/* temp code */

 		if (how_indx < sizeof(asoc->cookie_how))

 			asoc->cookie_how[how_indx] = 12;

 		sctp_timer_stop(SCTP_TIMER_TYPE_INIT, inp, stcb, net, SCTP_FROM_SCTP_INPUT+SCTP_LOC_15);

 		sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net, SCTP_FROM_SCTP_INPUT+SCTP_LOC_16);

 		/* notify upper layer */

 		*notification = SCTP_NOTIFY_ASSOC_RESTART;

 		atomic_add_int(&stcb->asoc.refcnt, 1);

 		if ((SCTP_GET_STATE(asoc) != SCTP_STATE_OPEN) &&

 		    (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) &&

 		    (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT)) {

 			SCTP_STAT_INCR_GAUGE32(sctps_currestab);

 		}

 		if (SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) {

 			SCTP_STAT_INCR_GAUGE32(sctps_restartestab);

 		} else if (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) {

 			SCTP_STAT_INCR_GAUGE32(sctps_collisionestab);

 		}

 		if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {

 			SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);

 			sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,

 					 stcb->sctp_ep, stcb, asoc->primary_destination);

 		} else if (!(asoc->state & SCTP_STATE_SHUTDOWN_SENT)) {

 			/* move to OPEN state, if not in SHUTDOWN_SENT */

 			SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);

 		}

 		asoc->pre_open_streams =

 			ntohs(initack_cp->init.num_outbound_streams);

 		asoc->init_seq_number = ntohl(initack_cp->init.initial_tsn);

 		asoc->sending_seq = asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number;

 		asoc->asconf_seq_out_acked = asoc->asconf_seq_out - 1;

 		asoc->asconf_seq_in = asoc->last_acked_seq = asoc->init_seq_number - 1;

 		asoc->str_reset_seq_in = asoc->init_seq_number;

 		asoc->advanced_peer_ack_point = asoc->last_acked_seq;

 		if (asoc->mapping_array) {

 			memset(asoc->mapping_array, 0,

 			       asoc->mapping_array_size);

 		}

 		if (asoc->nr_mapping_array) {

 			memset(asoc->nr_mapping_array, 0,

 			    asoc->mapping_array_size);

 		}

 		SCTP_TCB_UNLOCK(stcb);

 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)

 		so = SCTP_INP_SO(stcb->sctp_ep);

 		SCTP_SOCKET_LOCK(so, 1);

 #endif

 		SCTP_INP_INFO_WLOCK();

 		SCTP_INP_WLOCK(stcb->sctp_ep);

 		SCTP_TCB_LOCK(stcb);

 		atomic_add_int(&stcb->asoc.refcnt, -1);

 		/* send up all the data */

 		SCTP_TCB_SEND_LOCK(stcb);

 		sctp_report_all_outbound(stcb, 0, 1, SCTP_SO_LOCKED);

 		for (i = 0; i < stcb->asoc.streamoutcnt; i++) {

 			stcb->asoc.strmout[i].chunks_on_queues = 0;

 			stcb->asoc.strmout[i].stream_no = i;

 			stcb->asoc.strmout[i].next_sequence_send = 0;

 			stcb->asoc.strmout[i].last_msg_incomplete = 0;

 		}

 		/* process the INIT-ACK info (my info) */

 		asoc->my_vtag = ntohl(initack_cp->init.initiate_tag);

 		asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd);

 		/* pull from vtag hash */

 		LIST_REMOVE(stcb, sctp_asocs);

 		/* re-insert to new vtag position */

 		head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag,

 								    SCTP_BASE_INFO(hashasocmark))];

 		/*

 		 * put it in the bucket in the vtag hash of assoc's for the

 		 * system

 		 */

 		LIST_INSERT_HEAD(head, stcb, sctp_asocs);

 		SCTP_TCB_SEND_UNLOCK(stcb);

 		SCTP_INP_WUNLOCK(stcb->sctp_ep);

 		SCTP_INP_INFO_WUNLOCK();

 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)

 		SCTP_SOCKET_UNLOCK(so, 1);

 #endif

 		asoc->total_flight = 0;

 		asoc->total_flight_count = 0;

 		/* process the INIT info (peer's info) */

 		retval = sctp_process_init(init_cp, stcb);

 		if (retval < 0) {

 			if (how_indx < sizeof(asoc->cookie_how))

 				asoc->cookie_how[how_indx] = 13;

 			return (NULL);

 		}

 		/*

 		 * since we did not send a HB make sure we don't double

 		 * things

 		 */

 		net->hb_responded = 1;

 		if (sctp_load_addresses_from_init(stcb, m,

 						  init_offset + sizeof(struct sctp_init_chunk),

 						  initack_offset, src, dst, init_src)) {

 			if (how_indx < sizeof(asoc->cookie_how))

 				asoc->cookie_how[how_indx] = 14;

 			return (NULL);

 		}

 		/* respond with a COOKIE-ACK */

 		sctp_stop_all_cookie_timers(stcb);

 		sctp_toss_old_cookies(stcb, asoc);

 		sctp_send_cookie_ack(stcb);

 		if (how_indx < sizeof(asoc->cookie_how))

 			asoc->cookie_how[how_indx] = 15;

 		return (stcb);

 	}

 	if (how_indx < sizeof(asoc->cookie_how))

 		asoc->cookie_how[how_indx] = 16;

 	/* all other cases... */

 	return (NULL);

 }

 /*

  * handle a state cookie for a new association m: input packet mbuf chain--

  * assumes a pullup on IP/SCTP/COOKIE-ECHO chunk note: this is a "split" mbuf

  * and the cookie signature does not exist offset: offset into mbuf to the

  * cookie-echo chunk length: length of the cookie chunk to: where the init

  * was from returns a new TCB

  */

 static struct sctp_tcb *

 sctp_process_cookie_new(struct mbuf *m, int iphlen, int offset,

     struct sockaddr *src, struct sockaddr *dst,

     struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len,

     struct sctp_inpcb *inp, struct sctp_nets **netp,

     struct sockaddr *init_src, int *notification,

     int auth_skipped, uint32_t auth_offset, uint32_t auth_len,

 #if defined(__FreeBSD__)

     uint8_t use_mflowid, uint32_t mflowid,

 #endif

     uint32_t vrf_id, uint16_t port)

 {

 	struct sctp_tcb *stcb;

 	struct sctp_init_chunk *init_cp, init_buf;

 	struct sctp_init_ack_chunk *initack_cp, initack_buf;

 	struct sockaddr_storage sa_store;

 	struct sockaddr *initack_src = (struct sockaddr *)&sa_store;

 	struct sctp_association *asoc;

 	int init_offset, initack_offset, initack_limit;

 	int retval;

 	int error = 0;

 	uint8_t auth_chunk_buf[SCTP_PARAM_BUFFER_SIZE];

 #ifdef INET

 	struct sockaddr_in *sin;

 #endif

 #ifdef INET6

 	struct sockaddr_in6 *sin6;

 #endif

 #if defined(__Userspace__)

 	struct sockaddr_conn *sconn;

 #endif

 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)

 	struct socket *so;

 	so = SCTP_INP_SO(inp);

 #endif

 	/*

 	 * find and validate the INIT chunk in the cookie (peer's info) the

 	 * INIT should start after the cookie-echo header struct (chunk

 	 * header, state cookie header struct)

 	 */

 	init_offset = offset + sizeof(struct sctp_cookie_echo_chunk);

 	init_cp = (struct sctp_init_chunk *)

 	    sctp_m_getptr(m, init_offset, sizeof(struct sctp_init_chunk),

 	    (uint8_t *) & init_buf);

 	if (init_cp == NULL) {

 		/* could not pull a INIT chunk in cookie */

 		SCTPDBG(SCTP_DEBUG_INPUT1,

 			"process_cookie_new: could not pull INIT chunk hdr\n");

 		return (NULL);

 	}

 	if (init_cp->ch.chunk_type != SCTP_INITIATION) {

 		SCTPDBG(SCTP_DEBUG_INPUT1, "HUH? process_cookie_new: could not find INIT chunk!\n");

 		return (NULL);

 	}

 	initack_offset = init_offset + SCTP_SIZE32(ntohs(init_cp->ch.chunk_length));

 	/*

 	 * find and validate the INIT-ACK chunk in the cookie (my info) the

 	 * INIT-ACK follows the INIT chunk

 	 */

 	initack_cp = (struct sctp_init_ack_chunk *)

 	    sctp_m_getptr(m, initack_offset, sizeof(struct sctp_init_ack_chunk),

 	    (uint8_t *) & initack_buf);

 	if (initack_cp == NULL) {

 		/* could not pull INIT-ACK chunk in cookie */

 		SCTPDBG(SCTP_DEBUG_INPUT1, "process_cookie_new: could not pull INIT-ACK chunk hdr\n");

 		return (NULL);

 	}

 	if (initack_cp->ch.chunk_type != SCTP_INITIATION_ACK) {

 		return (NULL);

 	}

 	/*

 	 * NOTE: We can't use the INIT_ACK's chk_length to determine the

 	 * "initack_limit" value.  This is because the chk_length field

 	 * includes the length of the cookie, but the cookie is omitted when

 	 * the INIT and INIT_ACK are tacked onto the cookie...

 	 */

 	initack_limit = offset + cookie_len;

 	/*

 	 * now that we know the INIT/INIT-ACK are in place, create a new TCB

 	 * and popluate

 	 */

         /*

 	 * Here we do a trick, we set in NULL for the proc/thread argument. We

 	 * do this since in effect we only use the p argument when

 	 * the socket is unbound and we must do an implicit bind.

 	 * Since we are getting a cookie, we cannot be unbound.

 	 */

 	stcb = sctp_aloc_assoc(inp, init_src, &error,

 			       ntohl(initack_cp->init.initiate_tag), vrf_id,

 #if defined(__FreeBSD__) && __FreeBSD_version >= 500000

 			       (struct thread *)NULL

 #elif defined(__Windows__)

 			       (PKTHREAD)NULL

 #else

 			       (struct proc *)NULL

 #endif

 			       );

 	if (stcb == NULL) {

 		struct mbuf *op_err;

 		/* memory problem? */

 		SCTPDBG(SCTP_DEBUG_INPUT1,

 			"process_cookie_new: no room for another TCB!\n");

 		op_err = sctp_generate_invmanparam(SCTP_CAUSE_OUT_OF_RESC);

 		sctp_abort_association(inp, (struct sctp_tcb *)NULL, m, iphlen,

 		                       src, dst, sh, op_err,

 #if defined(__FreeBSD__)

 		                       use_mflowid, mflowid,

 #endif

 		                       vrf_id, port);

 		return (NULL);

 	}

 	/* get the correct sctp_nets */

 	if (netp)

 		*netp = sctp_findnet(stcb, init_src);

 	asoc = &stcb->asoc;

 	/* get scope variables out of cookie */

 	asoc->scope.ipv4_local_scope = cookie->ipv4_scope;

 	asoc->scope.site_scope = cookie->site_scope;

 	asoc->scope.local_scope = cookie->local_scope;

 	asoc->scope.loopback_scope = cookie->loopback_scope;

 #if defined(__Userspace__)

 	if ((asoc->scope.ipv4_addr_legal != cookie->ipv4_addr_legal) ||

 	    (asoc->scope.ipv6_addr_legal != cookie->ipv6_addr_legal) ||

 	    (asoc->scope.conn_addr_legal != cookie->conn_addr_legal)) {

 #else

 	if ((asoc->scope.ipv4_addr_legal != cookie->ipv4_addr_legal) ||

 	    (asoc->scope.ipv6_addr_legal != cookie->ipv6_addr_legal)) {

 #endif

 		struct mbuf *op_err;

 		/*

 		 * Houston we have a problem. The EP changed while the

 		 * cookie was in flight. Only recourse is to abort the

 		 * association.

 		 */

 		atomic_add_int(&stcb->asoc.refcnt, 1);

 		op_err = sctp_generate_invmanparam(SCTP_CAUSE_OUT_OF_RESC);

 		sctp_abort_association(inp, (struct sctp_tcb *)NULL, m, iphlen,

 				       src, dst, sh, op_err,

 #if defined(__FreeBSD__)

 		                       use_mflowid, mflowid,

 #endif

 		                       vrf_id, port);

 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)

 		SCTP_TCB_UNLOCK(stcb);

 		SCTP_SOCKET_LOCK(so, 1);

 		SCTP_TCB_LOCK(stcb);

 #endif

 		(void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,

 				      SCTP_FROM_SCTP_INPUT+SCTP_LOC_16);

 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)

 		SCTP_SOCKET_UNLOCK(so, 1);

 #endif

 		atomic_subtract_int(&stcb->asoc.refcnt, 1);

 		return (NULL);

 	}

 	/* process the INIT-ACK info (my info) */

 	asoc->my_vtag = ntohl(initack_cp->init.initiate_tag);

 	asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd);

 	asoc->pre_open_streams = ntohs(initack_cp->init.num_outbound_streams);

 	asoc->init_seq_number = ntohl(initack_cp->init.initial_tsn);

 	asoc->sending_seq = asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number;

 	asoc->asconf_seq_out_acked = asoc->asconf_seq_out - 1;

 	asoc->asconf_seq_in = asoc->last_acked_seq = asoc->init_seq_number - 1;

 	asoc->str_reset_seq_in = asoc->init_seq_number;

 	asoc->advanced_peer_ack_point = asoc->last_acked_seq;

 	/* process the INIT info (peer's info) */

 	if (netp)

 		retval = sctp_process_init(init_cp, stcb);

 	else

 		retval = 0;

 	if (retval < 0) {

 		atomic_add_int(&stcb->asoc.refcnt, 1);

 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)

 		SCTP_TCB_UNLOCK(stcb);

 		SCTP_SOCKET_LOCK(so, 1);

 		SCTP_TCB_LOCK(stcb);

 #endif

 		(void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT+SCTP_LOC_16);

 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)

 		SCTP_SOCKET_UNLOCK(so, 1);

 #endif

 		atomic_subtract_int(&stcb->asoc.refcnt, 1);

 		return (NULL);

 	}

 	/* load all addresses */

 	if (sctp_load_addresses_from_init(stcb, m,

 	    init_offset + sizeof(struct sctp_init_chunk), initack_offset,

 	    src, dst, init_src)) {

 		atomic_add_int(&stcb->asoc.refcnt, 1);

 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)

 		SCTP_TCB_UNLOCK(stcb);

 		SCTP_SOCKET_LOCK(so, 1);

 		SCTP_TCB_LOCK(stcb);

 #endif

 		(void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT+SCTP_LOC_17);

 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)

 		SCTP_SOCKET_UNLOCK(so, 1);

 #endif

 		atomic_subtract_int(&stcb->asoc.refcnt, 1);

 		return (NULL);

 	}

 	/*

 	 * verify any preceding AUTH chunk that was skipped

 	 */

 	/* pull the local authentication parameters from the cookie/init-ack */

 	sctp_auth_get_cookie_params(stcb, m,

 	    initack_offset + sizeof(struct sctp_init_ack_chunk),

 	    initack_limit - (initack_offset + sizeof(struct sctp_init_ack_chunk)));

 	if (auth_skipped) {

 		struct sctp_auth_chunk *auth;

 		auth = (struct sctp_auth_chunk *)

 		    sctp_m_getptr(m, auth_offset, auth_len, auth_chunk_buf);

 		if ((auth == NULL) || sctp_handle_auth(stcb, auth, m, auth_offset)) {

 			/* auth HMAC failed, dump the assoc and packet */

 			SCTPDBG(SCTP_DEBUG_AUTH1,

 				"COOKIE-ECHO: AUTH failed\n");

 			atomic_add_int(&stcb->asoc.refcnt, 1);

 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)

 			SCTP_TCB_UNLOCK(stcb);

 			SCTP_SOCKET_LOCK(so, 1);

 			SCTP_TCB_LOCK(stcb);

 #endif

 			(void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT+SCTP_LOC_18);

 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)

 			SCTP_SOCKET_UNLOCK(so, 1);

 #endif

 			atomic_subtract_int(&stcb->asoc.refcnt, 1);

 			return (NULL);

 		} else {

 			/* remaining chunks checked... good to go */

 			stcb->asoc.authenticated = 1;

 		}

 	}

 	/* update current state */

 	SCTPDBG(SCTP_DEBUG_INPUT2, "moving to OPEN state\n");

 	SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);

 	if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {

 		sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,

 				 stcb->sctp_ep, stcb, asoc->primary_destination);

 	}

 	sctp_stop_all_cookie_timers(stcb);

 	SCTP_STAT_INCR_COUNTER32(sctps_passiveestab);

 	SCTP_STAT_INCR_GAUGE32(sctps_currestab);

 	/*

 	 * if we're doing ASCONFs, check to see if we have any new local

 	 * addresses that need to get added to the peer (eg. addresses

 	 * changed while cookie echo in flight).  This needs to be done

 	 * after we go to the OPEN state to do the correct asconf

 	 * processing. else, make sure we have the correct addresses in our

 	 * lists

 	 */

 	/* warning, we re-use sin, sin6, sa_store here! */

 	/* pull in local_address (our "from" address) */

 	switch (cookie->laddr_type) {

 #ifdef INET

 	case SCTP_IPV4_ADDRESS:

 		/* source addr is IPv4 */

 		sin = (struct sockaddr_in *)initack_src;

 		memset(sin, 0, sizeof(*sin));

 		sin->sin_family = AF_INET;

 #ifdef HAVE_SIN_LEN

 		sin->sin_len = sizeof(struct sockaddr_in);

 #endif

 		sin->sin_addr.s_addr = cookie->laddress[0];

 		break;

 #endif

 #ifdef INET6

 	case SCTP_IPV6_ADDRESS:

 		/* source addr is IPv6 */

 		sin6 = (struct sockaddr_in6 *)initack_src;

 		memset(sin6, 0, sizeof(*sin6));

 		sin6->sin6_family = AF_INET6;

 #ifdef HAVE_SIN6_LEN

 		sin6->sin6_len = sizeof(struct sockaddr_in6);

 #endif

 		sin6->sin6_scope_id = cookie->scope_id;

 		memcpy(&sin6->sin6_addr, cookie->laddress,

 		    sizeof(sin6->sin6_addr));

 		break;

 #endif

 #if defined(__Userspace__)

 	case SCTP_CONN_ADDRESS:

 		/* source addr is IPv4 */

 		sconn = (struct sockaddr_conn *)initack_src;

 		memset(sconn, 0, sizeof(struct sockaddr_conn));

 		sconn->sconn_family = AF_CONN;

 #ifdef HAVE_SCONN_LEN

 		sconn->sconn_len = sizeof(struct sockaddr_conn);

 #endif

 		memcpy(&sconn->sconn_addr, cookie->laddress, sizeof(void *));

 		break;

 #endif

 	default:

 		atomic_add_int(&stcb->asoc.refcnt, 1);

 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)

 		SCTP_TCB_UNLOCK(stcb);

 		SCTP_SOCKET_LOCK(so, 1);

 		SCTP_TCB_LOCK(stcb);

 #endif

 		(void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT+SCTP_LOC_19);

 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)

 		SCTP_SOCKET_UNLOCK(so, 1);

 #endif

 		atomic_subtract_int(&stcb->asoc.refcnt, 1);

 		return (NULL);

 	}

 	/* set up to notify upper layer */

 	*notification = SCTP_NOTIFY_ASSOC_UP;

 	if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||

 	    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&

 	    (inp->sctp_socket->so_qlimit == 0)) {

 		/*

 		 * This is an endpoint that called connect() how it got a

 		 * cookie that is NEW is a bit of a mystery. It must be that

 		 * the INIT was sent, but before it got there.. a complete

 		 * INIT/INIT-ACK/COOKIE arrived. But of course then it

 		 * should have went to the other code.. not here.. oh well..

 		 * a bit of protection is worth having..

 		 */

 		stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_CONNECTED;

 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)

 		atomic_add_int(&stcb->asoc.refcnt, 1);

 		SCTP_TCB_UNLOCK(stcb);

 		SCTP_SOCKET_LOCK(so, 1);

 		SCTP_TCB_LOCK(stcb);

 		atomic_subtract_int(&stcb->asoc.refcnt, 1);

 		if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {

 			SCTP_SOCKET_UNLOCK(so, 1);

 			return (NULL);

 		}

 #endif

 		soisconnected(stcb->sctp_socket);

 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)

 		SCTP_SOCKET_UNLOCK(so, 1);

 #endif

 	} else if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&

 	    (inp->sctp_socket->so_qlimit)) {

 		/*

 		 * We don't want to do anything with this one. Since it is

 		 * the listening guy. The timer will get started for

 		 * accepted connections in the caller.

 		 */

 		;

 	}

 	/* since we did not send a HB make sure we don't double things */

 	if ((netp) && (*netp))

 		(*netp)->hb_responded = 1;

 	if (stcb->asoc.sctp_autoclose_ticks &&

 	    sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE)) {

 		sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb, NULL);

 	}

 	/* calculate the RTT */

 	(void)SCTP_GETTIME_TIMEVAL(&stcb->asoc.time_entered);

 	if ((netp) && (*netp)) {

 		(*netp)->RTO = sctp_calculate_rto(stcb, asoc, *netp,

 						  &cookie->time_entered, sctp_align_unsafe_makecopy,

 						  SCTP_RTT_FROM_NON_DATA);

 	}

 	/* respond with a COOKIE-ACK */

 	sctp_send_cookie_ack(stcb);

 	/*

 	 * check the address lists for any ASCONFs that need to be sent

 	 * AFTER the cookie-ack is sent

 	 */

 	sctp_check_address_list(stcb, m,

 	    initack_offset + sizeof(struct sctp_init_ack_chunk),

 	    initack_limit - (initack_offset + sizeof(struct sctp_init_ack_chunk)),

 	    initack_src, cookie->local_scope, cookie->site_scope,

 	    cookie->ipv4_scope, cookie->loopback_scope);

 	return (stcb);

 }

 /*

  * CODE LIKE THIS NEEDS TO RUN IF the peer supports the NAT extension, i.e

  * we NEED to make sure we are not already using the vtag. If so we

  * need to send back an ABORT-TRY-AGAIN-WITH-NEW-TAG No middle box bit!

 	head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(tag,

 							    SCTP_BASE_INFO(hashasocmark))];

 	LIST_FOREACH(stcb, head, sctp_asocs) {

 	        if ((stcb->asoc.my_vtag == tag) && (stcb->rport == rport) && (inp == stcb->sctp_ep))  {

 		       -- SEND ABORT - TRY AGAIN --

 		}

 	}

 */

 /*

  * handles a COOKIE-ECHO message stcb: modified to either a new or left as

  * existing (non-NULL) TCB

  */

 static struct mbuf *

 sctp_handle_cookie_echo(struct mbuf *m, int iphlen, int offset,

     struct sockaddr *src, struct sockaddr *dst,

     struct sctphdr *sh, struct sctp_cookie_echo_chunk *cp,

     struct sctp_inpcb **inp_p, struct sctp_tcb **stcb, struct sctp_nets **netp,

     int auth_skipped, uint32_t auth_offset, uint32_t auth_len,

     struct sctp_tcb **locked_tcb,

 #if defined(__FreeBSD__)

     uint8_t use_mflowid, uint32_t mflowid,

 #endif

     uint32_t vrf_id, uint16_t port)

 {

 	struct sctp_state_cookie *cookie;

 	struct sctp_tcb *l_stcb = *stcb;

 	struct sctp_inpcb *l_inp;

 	struct sockaddr *to;

 	struct sctp_pcb *ep;

 	struct mbuf *m_sig;

 	uint8_t calc_sig[SCTP_SIGNATURE_SIZE], tmp_sig[SCTP_SIGNATURE_SIZE];

 	uint8_t *sig;

 	uint8_t cookie_ok = 0;

 	unsigned int sig_offset, cookie_offset;

 	unsigned int cookie_len;

 	struct timeval now;

 	struct timeval time_expires;

 	int notification = 0;

 	struct sctp_nets *netl;

 	int had_a_existing_tcb = 0;

 	int send_int_conf = 0;

 #ifdef INET

 	struct sockaddr_in sin;

 #endif

 #ifdef INET6

 	struct sockaddr_in6 sin6;

 #endif

 #if defined(__Userspace__)

 	struct sockaddr_conn sconn;

 #endif

 	SCTPDBG(SCTP_DEBUG_INPUT2,

 		"sctp_handle_cookie: handling COOKIE-ECHO\n");

 	if (inp_p == NULL) {

 		return (NULL);

 	}

 	cookie = &cp->cookie;

 	cookie_offset = offset + sizeof(struct sctp_chunkhdr);

 	cookie_len = ntohs(cp->ch.chunk_length);

 	if ((cookie->peerport != sh->src_port) &&

 	    (cookie->myport != sh->dest_port) &&

 	    (cookie->my_vtag != sh->v_tag)) {

 		/*

 		 * invalid ports or bad tag.  Note that we always leave the

 		 * v_tag in the header in network order and when we stored

 		 * it in the my_vtag slot we also left it in network order.

 		 * This maintains the match even though it may be in the

 		 * opposite byte order of the machine :->

 		 */

 		return (NULL);

 	}

 	if (cookie_len < sizeof(struct sctp_cookie_echo_chunk) +

 	    sizeof(struct sctp_init_chunk) +

 	    sizeof(struct sctp_init_ack_chunk) + SCTP_SIGNATURE_SIZE) {

 		/* cookie too small */

 		return (NULL);

 	}

 	/*

 	 * split off the signature into its own mbuf (since it should not be

 	 * calculated in the sctp_hmac_m() call).

 	 */

 	sig_offset = offset + cookie_len - SCTP_SIGNATURE_SIZE;

 	m_sig = m_split(m, sig_offset, M_NOWAIT);

 	if (m_sig == NULL) {

 		/* out of memory or ?? */

 		return (NULL);

 	}

 #ifdef SCTP_MBUF_LOGGING

 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {

 		struct mbuf *mat;

 		for (mat = m_sig; mat; mat = SCTP_BUF_NEXT(mat)) {

 			if (SCTP_BUF_IS_EXTENDED(mat)) {

 				sctp_log_mb(mat, SCTP_MBUF_SPLIT);

 			}

 		}

 	}

 #endif

 	/*

 	 * compute the signature/digest for the cookie

 	 */

 	ep = &(*inp_p)->sctp_ep;

 	l_inp = *inp_p;

 	if (l_stcb) {

 		SCTP_TCB_UNLOCK(l_stcb);

 	}

 	SCTP_INP_RLOCK(l_inp);

 	if (l_stcb) {

 		SCTP_TCB_LOCK(l_stcb);

 	}

 	/* which cookie is it? */

 	if ((cookie->time_entered.tv_sec < (long)ep->time_of_secret_change) &&

 	    (ep->current_secret_number != ep->last_secret_number)) {

 		/* it's the old cookie */

 		(void)sctp_hmac_m(SCTP_HMAC,

 		    (uint8_t *)ep->secret_key[(int)ep->last_secret_number],

 		    SCTP_SECRET_SIZE, m, cookie_offset, calc_sig, 0);

 	} else {

 		/* it's the current cookie */

 		(void)sctp_hmac_m(SCTP_HMAC,

 		    (uint8_t *)ep->secret_key[(int)ep->current_secret_number],

 		    SCTP_SECRET_SIZE, m, cookie_offset, calc_sig, 0);

 	}

 	/* get the signature */

 	SCTP_INP_RUNLOCK(l_inp);

 	sig = (uint8_t *) sctp_m_getptr(m_sig, 0, SCTP_SIGNATURE_SIZE, (uint8_t *) & tmp_sig);

 	if (sig == NULL) {

 		/* couldn't find signature */

 		sctp_m_freem(m_sig);

 		return (NULL);

 	}

 	/* compare the received digest with the computed digest */

 	if (memcmp(calc_sig, sig, SCTP_SIGNATURE_SIZE) != 0) {

 		/* try the old cookie? */

 		if ((cookie->time_entered.tv_sec == (long)ep->time_of_secret_change) &&

 		    (ep->current_secret_number != ep->last_secret_number)) {

 			/* compute digest with old */

 			(void)sctp_hmac_m(SCTP_HMAC,

 			    (uint8_t *)ep->secret_key[(int)ep->last_secret_number],

 			    SCTP_SECRET_SIZE, m, cookie_offset, calc_sig, 0);

 			/* compare */

 			if (memcmp(calc_sig, sig, SCTP_SIGNATURE_SIZE) == 0)

 				cookie_ok = 1;

 		}

 	} else {

 		cookie_ok = 1;

 	}

 	/*

 	 * Now before we continue we must reconstruct our mbuf so that

 	 * normal processing of any other chunks will work.

 	 */

 	{

 		struct mbuf *m_at;

 		m_at = m;

 		while (SCTP_BUF_NEXT(m_at) != NULL) {

 			m_at = SCTP_BUF_NEXT(m_at);

 		}

 		SCTP_BUF_NEXT(m_at) = m_sig;

 	}

 	if (cookie_ok == 0) {

 		SCTPDBG(SCTP_DEBUG_INPUT2, "handle_cookie_echo: cookie signature validation failed!\n");

 		SCTPDBG(SCTP_DEBUG_INPUT2,

 			"offset = %u, cookie_offset = %u, sig_offset = %u\n",

 			(uint32_t) offset, cookie_offset, sig_offset);

 		return (NULL);