chore: cherry-pick 2c26785, b03de8b and a3c3ef6 from usrsctp.

[ppontes]

====
Author: Michael Tuexen tuexen@fh-muenster.de
Date: Mon Dec 14 00:57:51 2020 +0100

Cherry picking: Harden the handling of outgoing streams in case of an restart or INIT collision.

This avouds an out-of-bounce access in case the peer can
break the cookie signature. Thanks to Felix Wilhelm from Google for
reporting the issue.

Patch-Filename: cherry_picking_harden_the_handling_of_outgoing_streams.patch

====
commit ea25ba5043df708106cbc45e0a33ec3b74eaa767
Author: Michael Tuexen tuexen@fh-muenster.de
Date: Sat Dec 12 23:30:59 2020 +0100

Cherry picking: Clean up more resouces of an existing SCTP association in case of a restart.

This fixes a use-after-free scenario, which was reported by Felix
Wilhelm from Google in case a peer is able to modify the cookie.
However, this can also be triggered by an assciation restart under
some specific conditions.

Patch-Filename: cherry_picking_clean_up_more_resources_of_an_existing_sctp.patch

====
commit 41fd9ce4fc62eb41cb4be826abf17c93e8a78fdb
Author: Michael Tuexen tuexen@fh-muenster.de
Date: Tue Sep 29 11:38:11 2020 +0200

Cherry picking: Improve the input validation and processing of cookies.

This avoids setting the association in an inconsistent
state, which could result in a use-after-free situation.
The issue can be triggered by a malicious peer, if the peer
can modify the cookie without the local endpoint recognizing it.

Thanks to Ned Williamson for reporting the issue.

Patch-Filename: cherry_picking_improve_the_input_validation_and_processing_of.patch

Release Notes

Notes: backported the fix to CVE-2020-16044.

[ckerr]

RSLGTM

[release-clerk]

Release Notes Persisted

backported the fix to CVE-2020-16044.