xref: /illumos-gate/usr/src/uts/common/inet/ip/ip6.c (revision cbab2b2687744cbfdc12fae90f8088127a0b266c)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 /*
26  * Copyright (c) 1990 Mentat Inc.
27  */
28 
29 #pragma ident	"%Z%%M%	%I%	%E% SMI"
30 
31 #include <sys/types.h>
32 #include <sys/stream.h>
33 #include <sys/dlpi.h>
34 #include <sys/stropts.h>
35 #include <sys/sysmacros.h>
36 #include <sys/strsun.h>
37 #include <sys/strlog.h>
38 #include <sys/strsubr.h>
39 #define	_SUN_TPI_VERSION	2
40 #include <sys/tihdr.h>
41 #include <sys/ddi.h>
42 #include <sys/sunddi.h>
43 #include <sys/cmn_err.h>
44 #include <sys/debug.h>
45 #include <sys/kobj.h>
46 #include <sys/zone.h>
47 
48 #include <sys/kmem.h>
49 #include <sys/systm.h>
50 #include <sys/param.h>
51 #include <sys/socket.h>
52 #include <sys/vtrace.h>
53 #include <sys/isa_defs.h>
54 #include <sys/atomic.h>
55 #include <sys/iphada.h>
56 #include <sys/policy.h>
57 #include <net/if.h>
58 #include <net/if_types.h>
59 #include <net/route.h>
60 #include <net/if_dl.h>
61 #include <sys/sockio.h>
62 #include <netinet/in.h>
63 #include <netinet/ip6.h>
64 #include <netinet/icmp6.h>
65 #include <netinet/sctp.h>
66 
67 #include <inet/common.h>
68 #include <inet/mi.h>
69 #include <inet/mib2.h>
70 #include <inet/nd.h>
71 #include <inet/arp.h>
72 
73 #include <inet/ip.h>
74 #include <inet/ip_impl.h>
75 #include <inet/ip6.h>
76 #include <inet/ip6_asp.h>
77 #include <inet/tcp.h>
78 #include <inet/tcp_impl.h>
79 #include <inet/udp_impl.h>
80 #include <inet/ipp_common.h>
81 
82 #include <inet/ip_multi.h>
83 #include <inet/ip_if.h>
84 #include <inet/ip_ire.h>
85 #include <inet/ip_rts.h>
86 #include <inet/optcom.h>
87 #include <inet/ip_ndp.h>
88 #include <net/pfkeyv2.h>
89 #include <inet/ipsec_info.h>
90 #include <inet/sadb.h>
91 #include <inet/ipsec_impl.h>
92 #include <inet/tun.h>
93 #include <inet/sctp_ip.h>
94 #include <sys/pattr.h>
95 #include <inet/ipclassifier.h>
96 #include <inet/ipsecah.h>
97 #include <inet/udp_impl.h>
98 #include <sys/squeue.h>
99 
100 #include <sys/tsol/label.h>
101 #include <sys/tsol/tnet.h>
102 
103 #include <rpc/pmap_prot.h>
104 
105 extern squeue_func_t ip_input_proc;
106 
107 /*
108  * IP statistics.
109  */
110 #define	IP6_STAT(x)		(ip6_statistics.x.value.ui64++)
111 #define	IP6_STAT_UPDATE(x, n)	(ip6_statistics.x.value.ui64 += (n))
112 
113 typedef struct ip6_stat {
114 	kstat_named_t	ip6_udp_fast_path;
115 	kstat_named_t	ip6_udp_slow_path;
116 	kstat_named_t	ip6_udp_fannorm;
117 	kstat_named_t	ip6_udp_fanmb;
118 	kstat_named_t   ip6_out_sw_cksum;
119 	kstat_named_t   ip6_in_sw_cksum;
120 	kstat_named_t	ip6_tcp_in_full_hw_cksum_err;
121 	kstat_named_t	ip6_tcp_in_part_hw_cksum_err;
122 	kstat_named_t	ip6_tcp_in_sw_cksum_err;
123 	kstat_named_t	ip6_tcp_out_sw_cksum_bytes;
124 	kstat_named_t	ip6_udp_in_full_hw_cksum_err;
125 	kstat_named_t	ip6_udp_in_part_hw_cksum_err;
126 	kstat_named_t	ip6_udp_in_sw_cksum_err;
127 	kstat_named_t	ip6_udp_out_sw_cksum_bytes;
128 	kstat_named_t	ip6_frag_mdt_pkt_out;
129 	kstat_named_t	ip6_frag_mdt_discarded;
130 	kstat_named_t	ip6_frag_mdt_allocfail;
131 	kstat_named_t	ip6_frag_mdt_addpdescfail;
132 	kstat_named_t	ip6_frag_mdt_allocd;
133 } ip6_stat_t;
134 
135 static ip6_stat_t ip6_statistics = {
136 	{ "ip6_udp_fast_path",			KSTAT_DATA_UINT64 },
137 	{ "ip6_udp_slow_path",			KSTAT_DATA_UINT64 },
138 	{ "ip6_udp_fannorm",			KSTAT_DATA_UINT64 },
139 	{ "ip6_udp_fanmb",			KSTAT_DATA_UINT64 },
140 	{ "ip6_out_sw_cksum",			KSTAT_DATA_UINT64 },
141 	{ "ip6_in_sw_cksum",			KSTAT_DATA_UINT64 },
142 	{ "ip6_tcp_in_full_hw_cksum_err",	KSTAT_DATA_UINT64 },
143 	{ "ip6_tcp_in_part_hw_cksum_err",	KSTAT_DATA_UINT64 },
144 	{ "ip6_tcp_in_sw_cksum_err",		KSTAT_DATA_UINT64 },
145 	{ "ip6_tcp_out_sw_cksum_bytes",		KSTAT_DATA_UINT64 },
146 	{ "ip6_udp_in_full_hw_cksum_err",	KSTAT_DATA_UINT64 },
147 	{ "ip6_udp_in_part_hw_cksum_err",	KSTAT_DATA_UINT64 },
148 	{ "ip6_udp_in_sw_cksum_err",		KSTAT_DATA_UINT64 },
149 	{ "ip6_udp_out_sw_cksum_bytes",		KSTAT_DATA_UINT64 },
150 	{ "ip6_frag_mdt_pkt_out",		KSTAT_DATA_UINT64 },
151 	{ "ip6_frag_mdt_discarded",		KSTAT_DATA_UINT64 },
152 	{ "ip6_frag_mdt_allocfail",		KSTAT_DATA_UINT64 },
153 	{ "ip6_frag_mdt_addpdescfail",		KSTAT_DATA_UINT64 },
154 	{ "ip6_frag_mdt_allocd",		KSTAT_DATA_UINT64 },
155 };
156 
157 static kstat_t *ip6_kstat;
158 
159 /*
160  * Naming conventions:
161  *      These rules should be judiciously applied
162  *	if there is a need to identify something as IPv6 versus IPv4
163  *	IPv6 funcions will end with _v6 in the ip module.
164  *	IPv6 funcions will end with _ipv6 in the transport modules.
165  *	IPv6 macros:
166  *		Some macros end with _V6; e.g. ILL_FRAG_HASH_V6
167  *		Some macros start with V6_; e.g. V6_OR_V4_INADDR_ANY
168  *		And then there are ..V4_PART_OF_V6.
169  *		The intent is that macros in the ip module end with _V6.
170  *	IPv6 global variables will start with ipv6_
171  *	IPv6 structures will start with ipv6
172  *	IPv6 defined constants should start with IPV6_
173  *		(but then there are NDP_DEFAULT_VERS_PRI_AND_FLOW, etc)
174  */
175 
176 /*
177  * IPv6 mibs when the interface (ill) is not known.
178  * When the ill is known the per-interface mib in the ill is used.
179  */
180 mib2_ipv6IfStatsEntry_t	ip6_mib;
181 mib2_ipv6IfIcmpEntry_t	icmp6_mib;
182 
183 /*
184  * ip6opt_ls is used to enable IPv6 (via /etc/system on TX systems).
185  * We need to do this because we didn't obtain the IP6OPT_LS (0x0a)
186  * from IANA. This mechanism will remain in effect until an official
187  * number is obtained.
188  */
189 uchar_t ip6opt_ls;
190 
191 uint_t ipv6_ire_default_count;	/* Number of IPv6 IRE_DEFAULT entries */
192 uint_t ipv6_ire_default_index;	/* Walking IPv6 index used to mod in */
193 
194 const in6_addr_t ipv6_all_ones =
195 	{ 0xffffffffU, 0xffffffffU, 0xffffffffU, 0xffffffffU };
196 const in6_addr_t ipv6_all_zeros = { 0, 0, 0, 0 };
197 
198 #ifdef	_BIG_ENDIAN
199 const in6_addr_t ipv6_unspecified_group = { 0xff000000U, 0, 0, 0 };
200 #else	/* _BIG_ENDIAN */
201 const in6_addr_t ipv6_unspecified_group = { 0x000000ffU, 0, 0, 0 };
202 #endif	/* _BIG_ENDIAN */
203 
204 #ifdef	_BIG_ENDIAN
205 const in6_addr_t ipv6_loopback = { 0, 0, 0, 0x00000001U };
206 #else  /* _BIG_ENDIAN */
207 const in6_addr_t ipv6_loopback = { 0, 0, 0, 0x01000000U };
208 #endif /* _BIG_ENDIAN */
209 
210 #ifdef _BIG_ENDIAN
211 const in6_addr_t ipv6_all_hosts_mcast = { 0xff020000U, 0, 0, 0x00000001U };
212 #else  /* _BIG_ENDIAN */
213 const in6_addr_t ipv6_all_hosts_mcast = { 0x000002ffU, 0, 0, 0x01000000U };
214 #endif /* _BIG_ENDIAN */
215 
216 #ifdef _BIG_ENDIAN
217 const in6_addr_t ipv6_all_rtrs_mcast = { 0xff020000U, 0, 0, 0x00000002U };
218 #else  /* _BIG_ENDIAN */
219 const in6_addr_t ipv6_all_rtrs_mcast = { 0x000002ffU, 0, 0, 0x02000000U };
220 #endif /* _BIG_ENDIAN */
221 
222 #ifdef _BIG_ENDIAN
223 const in6_addr_t ipv6_all_v2rtrs_mcast = { 0xff020000U, 0, 0, 0x00000016U };
224 #else  /* _BIG_ENDIAN */
225 const in6_addr_t ipv6_all_v2rtrs_mcast = { 0x000002ffU, 0, 0, 0x16000000U };
226 #endif /* _BIG_ENDIAN */
227 
228 #ifdef _BIG_ENDIAN
229 const in6_addr_t ipv6_solicited_node_mcast =
230 			{ 0xff020000U, 0, 0x00000001U, 0xff000000U };
231 #else  /* _BIG_ENDIAN */
232 const in6_addr_t ipv6_solicited_node_mcast =
233 			{ 0x000002ffU, 0, 0x01000000U, 0x000000ffU };
234 #endif /* _BIG_ENDIAN */
235 
236 /*
237  * Used by icmp_send_redirect_v6 for picking random src.
238  */
239 uint_t	icmp_redirect_v6_src_index;
240 
241 /* Leave room for ip_newroute to tack on the src and target addresses */
242 #define	OK_RESOLVER_MP_V6(mp)						\
243 		((mp) && ((mp)->b_wptr - (mp)->b_rptr) >= (2 * IPV6_ADDR_LEN))
244 
245 static void	icmp_inbound_too_big_v6(queue_t *, mblk_t *, ill_t *ill,
246     boolean_t, zoneid_t);
247 static void	icmp_pkt_v6(queue_t *, mblk_t *, void *, size_t,
248     const in6_addr_t *, boolean_t);
249 static void	icmp_redirect_v6(queue_t *, mblk_t *, ill_t *ill);
250 static boolean_t	icmp_redirect_ok_v6(ill_t *ill, mblk_t *mp);
251 static int	ip_bind_connected_v6(conn_t *, mblk_t *, in6_addr_t *,
252     uint16_t, const in6_addr_t *, ip6_pkt_t *, uint16_t,
253     boolean_t, boolean_t, boolean_t, boolean_t);
254 static boolean_t ip_bind_insert_ire_v6(mblk_t *, ire_t *, const in6_addr_t *,
255     iulp_t *);
256 static int	ip_bind_laddr_v6(conn_t *, mblk_t *, const in6_addr_t *,
257     uint16_t, boolean_t, boolean_t, boolean_t);
258 static void	ip_fanout_proto_v6(queue_t *, mblk_t *, ip6_t *, ill_t *,
259     ill_t *, uint8_t, uint_t, uint_t, boolean_t, zoneid_t);
260 static void	ip_fanout_tcp_v6(queue_t *, mblk_t *, ip6_t *, ill_t *,
261     ill_t *, uint_t, uint_t, boolean_t, zoneid_t);
262 static void	ip_fanout_udp_v6(queue_t *, mblk_t *, ip6_t *, uint32_t,
263     ill_t *, ill_t *, uint_t, boolean_t, zoneid_t);
264 static int	ip_process_options_v6(queue_t *, mblk_t *, ip6_t *,
265     uint8_t *, uint_t, uint8_t);
266 static mblk_t	*ip_rput_frag_v6(queue_t *, mblk_t *, ip6_t *,
267     ip6_frag_t *, uint_t, uint_t *, uint32_t *, uint16_t *);
268 static boolean_t	ip_source_routed_v6(ip6_t *, mblk_t *);
269 static void	ip_wput_ire_v6(queue_t *, mblk_t *, ire_t *, int, int,
270     conn_t *, int, int, int);
271 static boolean_t ip_ulp_cando_pkt2big(int);
272 
273 static void ip_rput_v6(queue_t *, mblk_t *);
274 static void ip_wput_v6(queue_t *, mblk_t *);
275 
276 /*
277  * A template for an IPv6 AR_ENTRY_QUERY
278  */
279 static areq_t	ipv6_areq_template = {
280 	AR_ENTRY_QUERY,				/* cmd */
281 	sizeof (areq_t)+(2*IPV6_ADDR_LEN),	/* name offset */
282 	sizeof (areq_t),	/* name len (filled by ill_arp_alloc) */
283 	IP6_DL_SAP,		/* protocol, from arps perspective */
284 	sizeof (areq_t),	/* target addr offset */
285 	IPV6_ADDR_LEN,		/* target addr_length */
286 	0,			/* flags */
287 	sizeof (areq_t) + IPV6_ADDR_LEN,	/* sender addr offset */
288 	IPV6_ADDR_LEN,		/* sender addr length */
289 	6,			/* xmit_count */
290 	1000,			/* (re)xmit_interval in milliseconds */
291 	4			/* max # of requests to buffer */
292 	/* anything else filled in by the code */
293 };
294 
295 struct qinit rinit_ipv6 = {
296 	(pfi_t)ip_rput_v6,
297 	NULL,
298 	ip_open,
299 	ip_close,
300 	NULL,
301 	&ip_mod_info
302 };
303 
304 struct qinit winit_ipv6 = {
305 	(pfi_t)ip_wput_v6,
306 	(pfi_t)ip_wsrv,
307 	ip_open,
308 	ip_close,
309 	NULL,
310 	&ip_mod_info
311 };
312 
313 /*
314  * Handle IPv6 ICMP packets sent to us.  Consume the mblk passed in.
315  * The message has already been checksummed and if needed,
316  * a copy has been made to be sent any interested ICMP client (conn)
317  * Note that this is different than icmp_inbound() which does the fanout
318  * to conn's as well as local processing of the ICMP packets.
319  *
320  * All error messages are passed to the matching transport stream.
321  *
322  * Zones notes:
323  * The packet is only processed in the context of the specified zone: typically
324  * only this zone will reply to an echo request. This means that the caller must
325  * call icmp_inbound_v6() for each relevant zone.
326  */
327 static void
328 icmp_inbound_v6(queue_t *q, mblk_t *mp, ill_t *ill, uint_t hdr_length,
329     boolean_t mctl_present, uint_t flags, zoneid_t zoneid)
330 {
331 	icmp6_t		*icmp6;
332 	ip6_t		*ip6h;
333 	boolean_t	interested;
334 	ip6i_t		*ip6i;
335 	in6_addr_t	origsrc;
336 	ire_t		*ire;
337 	mblk_t		*first_mp;
338 	ipsec_in_t	*ii;
339 
340 	ASSERT(ill != NULL);
341 	first_mp = mp;
342 	if (mctl_present) {
343 		mp = first_mp->b_cont;
344 		ASSERT(mp != NULL);
345 
346 		ii = (ipsec_in_t *)first_mp->b_rptr;
347 		ASSERT(ii->ipsec_in_type == IPSEC_IN);
348 	}
349 
350 	ip6h = (ip6_t *)mp->b_rptr;
351 
352 	BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInMsgs);
353 
354 	if ((mp->b_wptr - mp->b_rptr) < (hdr_length + ICMP6_MINLEN)) {
355 		if (!pullupmsg(mp, hdr_length + ICMP6_MINLEN)) {
356 			ip1dbg(("icmp_inbound_v6: pullupmsg failed\n"));
357 			BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInErrors);
358 			freemsg(first_mp);
359 			return;
360 		}
361 		ip6h = (ip6_t *)mp->b_rptr;
362 	}
363 	if (icmp_accept_clear_messages == 0) {
364 		first_mp = ipsec_check_global_policy(first_mp, NULL,
365 		    NULL, ip6h, mctl_present);
366 		if (first_mp == NULL)
367 			return;
368 	}
369 
370 	/*
371 	 * On a labeled system, we have to check whether the zone itself is
372 	 * permitted to receive raw traffic.
373 	 */
374 	if (is_system_labeled()) {
375 		if (zoneid == ALL_ZONES)
376 			zoneid = tsol_packet_to_zoneid(mp);
377 		if (!tsol_can_accept_raw(mp, B_FALSE)) {
378 			ip1dbg(("icmp_inbound_v6: zone %d can't receive raw",
379 			    zoneid));
380 			BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInErrors);
381 			freemsg(first_mp);
382 			return;
383 		}
384 	}
385 
386 	icmp6 = (icmp6_t *)(&mp->b_rptr[hdr_length]);
387 	ip2dbg(("icmp_inbound_v6: type %d code %d\n", icmp6->icmp6_type,
388 	    icmp6->icmp6_code));
389 	interested = !(icmp6->icmp6_type & ICMP6_INFOMSG_MASK);
390 
391 	/* Initiate IPPF processing here */
392 	if (IP6_IN_IPP(flags)) {
393 
394 		/*
395 		 * If the ifindex changes due to SIOCSLIFINDEX
396 		 * packet may return to IP on the wrong ill.
397 		 */
398 		ip_process(IPP_LOCAL_IN, &mp, ill->ill_phyint->phyint_ifindex);
399 		if (mp == NULL) {
400 			if (mctl_present) {
401 				freeb(first_mp);
402 			}
403 			return;
404 		}
405 	}
406 
407 	switch (icmp6->icmp6_type) {
408 	case ICMP6_DST_UNREACH:
409 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInDestUnreachs);
410 		if (icmp6->icmp6_code == ICMP6_DST_UNREACH_ADMIN)
411 			BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInAdminProhibs);
412 		break;
413 
414 	case ICMP6_TIME_EXCEEDED:
415 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInTimeExcds);
416 		break;
417 
418 	case ICMP6_PARAM_PROB:
419 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInParmProblems);
420 		break;
421 
422 	case ICMP6_PACKET_TOO_BIG:
423 		icmp_inbound_too_big_v6(q, first_mp, ill, mctl_present,
424 		    zoneid);
425 		return;
426 	case ICMP6_ECHO_REQUEST:
427 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInEchos);
428 		if (IN6_IS_ADDR_MULTICAST(&ip6h->ip6_dst) &&
429 		    !ipv6_resp_echo_mcast)
430 			break;
431 
432 		/*
433 		 * We must have exclusive use of the mblk to convert it to
434 		 * a response.
435 		 * If not, we copy it.
436 		 */
437 		if (mp->b_datap->db_ref > 1) {
438 			mblk_t	*mp1;
439 
440 			mp1 = copymsg(mp);
441 			freemsg(mp);
442 			if (mp1 == NULL) {
443 				BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
444 				if (mctl_present)
445 					freeb(first_mp);
446 				return;
447 			}
448 			mp = mp1;
449 			ip6h = (ip6_t *)mp->b_rptr;
450 			icmp6 = (icmp6_t *)(&mp->b_rptr[hdr_length]);
451 			if (mctl_present)
452 				first_mp->b_cont = mp;
453 			else
454 				first_mp = mp;
455 		}
456 
457 		/*
458 		 * Turn the echo into an echo reply.
459 		 * Remove any extension headers (do not reverse a source route)
460 		 * and clear the flow id (keep traffic class for now).
461 		 */
462 		if (hdr_length != IPV6_HDR_LEN) {
463 			int	i;
464 
465 			for (i = 0; i < IPV6_HDR_LEN; i++)
466 				mp->b_rptr[hdr_length - i - 1] =
467 				    mp->b_rptr[IPV6_HDR_LEN - i - 1];
468 			mp->b_rptr += (hdr_length - IPV6_HDR_LEN);
469 			ip6h = (ip6_t *)mp->b_rptr;
470 			ip6h->ip6_nxt = IPPROTO_ICMPV6;
471 			hdr_length = IPV6_HDR_LEN;
472 		}
473 		ip6h->ip6_vcf &= ~IPV6_FLOWINFO_FLOWLABEL;
474 		icmp6->icmp6_type = ICMP6_ECHO_REPLY;
475 
476 		ip6h->ip6_plen =
477 		    htons((uint16_t)(msgdsize(mp) - IPV6_HDR_LEN));
478 		origsrc = ip6h->ip6_src;
479 		/*
480 		 * Reverse the source and destination addresses.
481 		 * If the return address is a multicast, zero out the source
482 		 * (ip_wput_v6 will set an address).
483 		 */
484 		if (IN6_IS_ADDR_MULTICAST(&ip6h->ip6_dst)) {
485 			ip6h->ip6_src = ipv6_all_zeros;
486 			ip6h->ip6_dst = origsrc;
487 		} else {
488 			ip6h->ip6_src = ip6h->ip6_dst;
489 			ip6h->ip6_dst = origsrc;
490 		}
491 
492 		/* set the hop limit */
493 		ip6h->ip6_hops = ipv6_def_hops;
494 
495 		/*
496 		 * Prepare for checksum by putting icmp length in the icmp
497 		 * checksum field. The checksum is calculated in ip_wput_v6.
498 		 */
499 		icmp6->icmp6_cksum = ip6h->ip6_plen;
500 		/*
501 		 * ICMP echo replies should go out on the same interface
502 		 * the request came on as probes used by in.mpathd for
503 		 * detecting NIC failures are ECHO packets. We turn-off load
504 		 * spreading by allocating a ip6i and setting ip6i_attach_if
505 		 * to B_TRUE which is handled both by ip_wput_v6 and
506 		 * ip_newroute_v6. If we don't turnoff load spreading,
507 		 * the packets might get dropped if there are no
508 		 * non-FAILED/INACTIVE interfaces for it to go out on and
509 		 * in.mpathd would wrongly detect a failure or mis-detect
510 		 * a NIC failure as a link failure. As load spreading can
511 		 * happen only if ill_group is not NULL, we do only for
512 		 * that case and this does not affect the normal case.
513 		 *
514 		 * We force this only on echo packets that came from on-link
515 		 * hosts. We restrict this to link-local addresses which
516 		 * is used by in.mpathd for probing. In the IPv6 case,
517 		 * default routes typically have an ire_ipif pointer and
518 		 * hence a MATCH_IRE_ILL later in ip_newroute_v6/ip_wput_v6
519 		 * might work. As a default route out of this interface
520 		 * may not be present, enforcing this packet to go out in
521 		 * this case may not work.
522 		 */
523 		if (ill->ill_group != NULL &&
524 		    IN6_IS_ADDR_LINKLOCAL(&origsrc)) {
525 			/*
526 			 * If we are sending replies to ourselves, don't
527 			 * set ATTACH_IF as we may not be able to find
528 			 * the IRE_LOCAL on this ill i.e setting ATTACH_IF
529 			 * causes ip_wput_v6 to look for an IRE_LOCAL on
530 			 * "ill" which it may not find and will try to
531 			 * create an IRE_CACHE for our local address. Once
532 			 * we do this, we will try to forward all packets
533 			 * meant to our LOCAL address.
534 			 */
535 			ire = ire_cache_lookup_v6(&ip6h->ip6_dst, ALL_ZONES,
536 			    NULL);
537 			if (ire == NULL || ire->ire_type != IRE_LOCAL) {
538 				mp = ip_add_info_v6(mp, NULL, &ip6h->ip6_dst);
539 				if (mp == NULL) {
540 					BUMP_MIB(ill->ill_icmp6_mib,
541 					    ipv6IfIcmpInErrors);
542 					if (ire != NULL)
543 						ire_refrele(ire);
544 					if (mctl_present)
545 						freeb(first_mp);
546 					return;
547 				} else if (mctl_present) {
548 					first_mp->b_cont = mp;
549 				} else {
550 					first_mp = mp;
551 				}
552 				ip6i = (ip6i_t *)mp->b_rptr;
553 				ip6i->ip6i_flags = IP6I_ATTACH_IF;
554 				ip6i->ip6i_ifindex =
555 				    ill->ill_phyint->phyint_ifindex;
556 			}
557 			if (ire != NULL)
558 				ire_refrele(ire);
559 		}
560 
561 		if (!mctl_present) {
562 			/*
563 			 * This packet should go out the same way as it
564 			 * came in i.e in clear. To make sure that global
565 			 * policy will not be applied to this in ip_wput,
566 			 * we attach a IPSEC_IN mp and clear ipsec_in_secure.
567 			 */
568 			ASSERT(first_mp == mp);
569 			if ((first_mp = ipsec_in_alloc(B_FALSE)) == NULL) {
570 				BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
571 				freemsg(mp);
572 				return;
573 			}
574 			ii = (ipsec_in_t *)first_mp->b_rptr;
575 
576 			/* This is not a secure packet */
577 			ii->ipsec_in_secure = B_FALSE;
578 			first_mp->b_cont = mp;
579 		}
580 		ii->ipsec_in_zoneid = zoneid;
581 		ASSERT(zoneid != ALL_ZONES);
582 		if (!ipsec_in_to_out(first_mp, NULL, ip6h)) {
583 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
584 			return;
585 		}
586 		put(WR(q), first_mp);
587 		return;
588 
589 	case ICMP6_ECHO_REPLY:
590 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInEchoReplies);
591 		break;
592 
593 	case ND_ROUTER_SOLICIT:
594 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInRouterSolicits);
595 		break;
596 
597 	case ND_ROUTER_ADVERT:
598 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInRouterAdvertisements);
599 		break;
600 
601 	case ND_NEIGHBOR_SOLICIT:
602 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInNeighborSolicits);
603 		if (mctl_present)
604 			freeb(first_mp);
605 		/* XXX may wish to pass first_mp up to ndp_input someday. */
606 		ndp_input(ill, mp);
607 		return;
608 
609 	case ND_NEIGHBOR_ADVERT:
610 		BUMP_MIB(ill->ill_icmp6_mib,
611 		    ipv6IfIcmpInNeighborAdvertisements);
612 		if (mctl_present)
613 			freeb(first_mp);
614 		/* XXX may wish to pass first_mp up to ndp_input someday. */
615 		ndp_input(ill, mp);
616 		return;
617 
618 	case ND_REDIRECT: {
619 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInRedirects);
620 
621 		if (ipv6_ignore_redirect)
622 			break;
623 
624 		/*
625 		 * As there is no upper client to deliver, we don't
626 		 * need the first_mp any more.
627 		 */
628 		if (mctl_present)
629 			freeb(first_mp);
630 		if (!pullupmsg(mp, -1) ||
631 		    !icmp_redirect_ok_v6(ill, mp)) {
632 			BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInBadRedirects);
633 			break;
634 		}
635 		icmp_redirect_v6(q, mp, ill);
636 		return;
637 	}
638 
639 	/*
640 	 * The next three icmp messages will be handled by MLD.
641 	 * Pass all valid MLD packets up to any process(es)
642 	 * listening on a raw ICMP socket. MLD messages are
643 	 * freed by mld_input function.
644 	 */
645 	case MLD_LISTENER_QUERY:
646 	case MLD_LISTENER_REPORT:
647 	case MLD_LISTENER_REDUCTION:
648 		if (mctl_present)
649 			freeb(first_mp);
650 		mld_input(q, mp, ill);
651 		return;
652 	default:
653 		break;
654 	}
655 	if (interested) {
656 		icmp_inbound_error_fanout_v6(q, first_mp, ip6h, icmp6, ill,
657 		    mctl_present, zoneid);
658 	} else {
659 		freemsg(first_mp);
660 	}
661 }
662 
663 /*
664  * Process received IPv6 ICMP Packet too big.
665  * After updating any IRE it does the fanout to any matching transport streams.
666  * Assumes the IPv6 plus ICMPv6 headers have been pulled up but nothing else.
667  */
668 /* ARGSUSED */
669 static void
670 icmp_inbound_too_big_v6(queue_t *q, mblk_t *mp, ill_t *ill,
671     boolean_t mctl_present, zoneid_t zoneid)
672 {
673 	ip6_t		*ip6h;
674 	ip6_t		*inner_ip6h;
675 	icmp6_t		*icmp6;
676 	uint16_t	hdr_length;
677 	uint32_t	mtu;
678 	ire_t		*ire, *first_ire;
679 	mblk_t		*first_mp;
680 
681 	first_mp = mp;
682 	if (mctl_present)
683 		mp = first_mp->b_cont;
684 	/*
685 	 * We must have exclusive use of the mblk to update the MTU
686 	 * in the packet.
687 	 * If not, we copy it.
688 	 *
689 	 * If there's an M_CTL present, we know that allocated first_mp
690 	 * earlier in this function, so we know first_mp has refcnt of one.
691 	 */
692 	ASSERT(!mctl_present || first_mp->b_datap->db_ref == 1);
693 	if (mp->b_datap->db_ref > 1) {
694 		mblk_t	*mp1;
695 
696 		mp1 = copymsg(mp);
697 		freemsg(mp);
698 		if (mp1 == NULL) {
699 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
700 			if (mctl_present)
701 				freeb(first_mp);
702 			return;
703 		}
704 		mp = mp1;
705 		if (mctl_present)
706 			first_mp->b_cont = mp;
707 		else
708 			first_mp = mp;
709 	}
710 	ip6h = (ip6_t *)mp->b_rptr;
711 	if (ip6h->ip6_nxt != IPPROTO_ICMPV6)
712 		hdr_length = ip_hdr_length_v6(mp, ip6h);
713 	else
714 		hdr_length = IPV6_HDR_LEN;
715 
716 	icmp6 = (icmp6_t *)(&mp->b_rptr[hdr_length]);
717 	ASSERT((size_t)(mp->b_wptr - mp->b_rptr) >= hdr_length + ICMP6_MINLEN);
718 	inner_ip6h = (ip6_t *)&icmp6[1];	/* Packet in error */
719 	if ((uchar_t *)&inner_ip6h[1] > mp->b_wptr) {
720 		if (!pullupmsg(mp, (uchar_t *)&inner_ip6h[1] - mp->b_rptr)) {
721 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
722 			freemsg(first_mp);
723 			return;
724 		}
725 		ip6h = (ip6_t *)mp->b_rptr;
726 		icmp6 = (icmp6_t *)&mp->b_rptr[hdr_length];
727 		inner_ip6h = (ip6_t *)&icmp6[1];
728 	}
729 
730 	/*
731 	 * For link local destinations matching simply on IRE type is not
732 	 * sufficient. Same link local addresses for different ILL's is
733 	 * possible.
734 	 */
735 
736 	if (IN6_IS_ADDR_LINKLOCAL(&inner_ip6h->ip6_dst)) {
737 		first_ire = ire_ctable_lookup_v6(&inner_ip6h->ip6_dst, NULL,
738 		    IRE_CACHE, ill->ill_ipif, ALL_ZONES, NULL,
739 		    MATCH_IRE_TYPE | MATCH_IRE_ILL_GROUP);
740 
741 		if (first_ire == NULL) {
742 			if (ip_debug > 2) {
743 				/* ip1dbg */
744 				pr_addr_dbg("icmp_inbound_too_big_v6:"
745 				    "no ire for dst %s\n", AF_INET6,
746 				    &inner_ip6h->ip6_dst);
747 			}
748 			freemsg(first_mp);
749 			return;
750 		}
751 
752 		mtu = ntohl(icmp6->icmp6_mtu);
753 		rw_enter(&first_ire->ire_bucket->irb_lock, RW_READER);
754 		for (ire = first_ire; ire != NULL &&
755 		    IN6_ARE_ADDR_EQUAL(&ire->ire_addr_v6, &inner_ip6h->ip6_dst);
756 		    ire = ire->ire_next) {
757 			mutex_enter(&ire->ire_lock);
758 			if (mtu < IPV6_MIN_MTU) {
759 				ip1dbg(("Received mtu less than IPv6 "
760 				    "min mtu %d: %d\n", IPV6_MIN_MTU, mtu));
761 				mtu = IPV6_MIN_MTU;
762 				/*
763 				 * If an mtu less than IPv6 min mtu is received,
764 				 * we must include a fragment header in
765 				 * subsequent packets.
766 				 */
767 				ire->ire_frag_flag |= IPH_FRAG_HDR;
768 			}
769 			ip1dbg(("Received mtu from router: %d\n", mtu));
770 			ire->ire_max_frag = MIN(ire->ire_max_frag, mtu);
771 			/* Record the new max frag size for the ULP. */
772 			if (ire->ire_frag_flag & IPH_FRAG_HDR) {
773 				/*
774 				 * If we need a fragment header in every packet
775 				 * (above case or multirouting), make sure the
776 				 * ULP takes it into account when computing the
777 				 * payload size.
778 				 */
779 				icmp6->icmp6_mtu = htonl(ire->ire_max_frag -
780 				    sizeof (ip6_frag_t));
781 			} else {
782 				icmp6->icmp6_mtu = htonl(ire->ire_max_frag);
783 			}
784 			mutex_exit(&ire->ire_lock);
785 		}
786 		rw_exit(&first_ire->ire_bucket->irb_lock);
787 		ire_refrele(first_ire);
788 	} else {
789 		irb_t	*irb = NULL;
790 		/*
791 		 * for non-link local destinations we match only on the IRE type
792 		 */
793 		ire = ire_ctable_lookup_v6(&inner_ip6h->ip6_dst, NULL,
794 		    IRE_CACHE, ill->ill_ipif, ALL_ZONES, NULL, MATCH_IRE_TYPE);
795 		if (ire == NULL) {
796 			if (ip_debug > 2) {
797 				/* ip1dbg */
798 				pr_addr_dbg("icmp_inbound_too_big_v6:"
799 				    "no ire for dst %s\n",
800 				    AF_INET6, &inner_ip6h->ip6_dst);
801 			}
802 			freemsg(first_mp);
803 			return;
804 		}
805 		irb = ire->ire_bucket;
806 		ire_refrele(ire);
807 		rw_enter(&irb->irb_lock, RW_READER);
808 		for (ire = irb->irb_ire; ire != NULL; ire = ire->ire_next) {
809 			if (IN6_ARE_ADDR_EQUAL(&ire->ire_addr_v6,
810 				&inner_ip6h->ip6_dst)) {
811 				mtu = ntohl(icmp6->icmp6_mtu);
812 				mutex_enter(&ire->ire_lock);
813 				if (mtu < IPV6_MIN_MTU) {
814 					ip1dbg(("Received mtu less than IPv6"
815 						"min mtu %d: %d\n",
816 						IPV6_MIN_MTU, mtu));
817 					mtu = IPV6_MIN_MTU;
818 					/*
819 					 * If an mtu less than IPv6 min mtu is
820 					 * received, we must include a fragment
821 					 * header in subsequent packets.
822 					 */
823 					ire->ire_frag_flag |= IPH_FRAG_HDR;
824 				}
825 
826 				ip1dbg(("Received mtu from router: %d\n", mtu));
827 				ire->ire_max_frag = MIN(ire->ire_max_frag, mtu);
828 				/* Record the new max frag size for the ULP. */
829 				if (ire->ire_frag_flag & IPH_FRAG_HDR) {
830 					/*
831 					 * If we need a fragment header in
832 					 * every packet (above case or
833 					 * multirouting), make sure the ULP
834 					 * takes it into account when computing
835 					 * the payload size.
836 					 */
837 					icmp6->icmp6_mtu =
838 					    htonl(ire->ire_max_frag -
839 					    sizeof (ip6_frag_t));
840 				} else {
841 					icmp6->icmp6_mtu =
842 					    htonl(ire->ire_max_frag);
843 				}
844 				mutex_exit(&ire->ire_lock);
845 			}
846 		}
847 		rw_exit(&irb->irb_lock);
848 	}
849 	icmp_inbound_error_fanout_v6(q, first_mp, ip6h, icmp6, ill,
850 	    mctl_present, zoneid);
851 }
852 
853 static void
854 pkt_too_big(conn_t *connp, void *arg)
855 {
856 	mblk_t *mp;
857 
858 	if (!connp->conn_ipv6_recvpathmtu)
859 		return;
860 
861 	/* create message and drop it on this connections read queue */
862 	if ((mp = dupb((mblk_t *)arg)) == NULL) {
863 		return;
864 	}
865 	mp->b_datap->db_type = M_CTL;
866 
867 	putnext(connp->conn_rq, mp);
868 }
869 
870 /*
871  * Fanout received ICMPv6 error packets to the transports.
872  * Assumes the IPv6 plus ICMPv6 headers have been pulled up but nothing else.
873  */
874 void
875 icmp_inbound_error_fanout_v6(queue_t *q, mblk_t *mp, ip6_t *ip6h,
876     icmp6_t *icmp6, ill_t *ill, boolean_t mctl_present, zoneid_t zoneid)
877 {
878 	uint16_t *up;	/* Pointer to ports in ULP header */
879 	uint32_t ports;	/* reversed ports for fanout */
880 	ip6_t rip6h;	/* With reversed addresses */
881 	uint16_t	hdr_length;
882 	uint8_t		*nexthdrp;
883 	uint8_t		nexthdr;
884 	mblk_t *first_mp;
885 	ipsec_in_t *ii;
886 	tcpha_t	*tcpha;
887 	conn_t	*connp;
888 
889 	first_mp = mp;
890 	if (mctl_present) {
891 		mp = first_mp->b_cont;
892 		ASSERT(mp != NULL);
893 
894 		ii = (ipsec_in_t *)first_mp->b_rptr;
895 		ASSERT(ii->ipsec_in_type == IPSEC_IN);
896 	} else {
897 		ii = NULL;
898 	}
899 
900 	hdr_length = (uint16_t)((uchar_t *)icmp6 - (uchar_t *)ip6h);
901 	ASSERT((size_t)(mp->b_wptr - (uchar_t *)icmp6) >= ICMP6_MINLEN);
902 
903 	/*
904 	 * Need to pullup everything in order to use
905 	 * ip_hdr_length_nexthdr_v6()
906 	 */
907 	if (mp->b_cont != NULL) {
908 		if (!pullupmsg(mp, -1)) {
909 			ip1dbg(("icmp_inbound_error_fanout_v6: "
910 			    "pullupmsg failed\n"));
911 			goto drop_pkt;
912 		}
913 		ip6h = (ip6_t *)mp->b_rptr;
914 		icmp6 = (icmp6_t *)(&mp->b_rptr[hdr_length]);
915 	}
916 
917 	ip6h = (ip6_t *)&icmp6[1];	/* Packet in error */
918 	if ((uchar_t *)&ip6h[1] > mp->b_wptr)
919 		goto drop_pkt;
920 
921 	if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &hdr_length, &nexthdrp))
922 		goto drop_pkt;
923 	nexthdr = *nexthdrp;
924 
925 	/* Set message type, must be done after pullups */
926 	mp->b_datap->db_type = M_CTL;
927 
928 	if (icmp6->icmp6_type == ICMP6_PACKET_TOO_BIG) {
929 		/*
930 		 * Deliver indication of ICMP6_PACKET_TOO_BIG to interested
931 		 * sockets.
932 		 *
933 		 * Note I don't like walking every connection to deliver
934 		 * this information to a set of listeners.  A separate
935 		 * list could be kept to keep the cost of this down.
936 		 */
937 		ipcl_walk(pkt_too_big, (void *)mp);
938 	}
939 
940 	/* Try to pass the ICMP message to clients who need it */
941 	switch (nexthdr) {
942 	case IPPROTO_UDP: {
943 		/*
944 		 * Verify we have at least ICMP_MIN_TP_HDR_LEN bytes of
945 		 * UDP header to get the port information.
946 		 */
947 		if ((uchar_t *)ip6h + hdr_length + ICMP_MIN_TP_HDR_LEN >
948 		    mp->b_wptr) {
949 			break;
950 		}
951 		/*
952 		 * Attempt to find a client stream based on port.
953 		 * Note that we do a reverse lookup since the header is
954 		 * in the form we sent it out.
955 		 * The rip6h header is only used for the IPCL_UDP_MATCH_V6
956 		 * and we only set the src and dst addresses and nexthdr.
957 		 */
958 		up = (uint16_t *)((uchar_t *)ip6h + hdr_length);
959 		rip6h.ip6_src = ip6h->ip6_dst;
960 		rip6h.ip6_dst = ip6h->ip6_src;
961 		rip6h.ip6_nxt = nexthdr;
962 		((uint16_t *)&ports)[0] = up[1];
963 		((uint16_t *)&ports)[1] = up[0];
964 
965 		ip_fanout_udp_v6(q, first_mp, &rip6h, ports, ill, ill,
966 		    IP6_NO_IPPOLICY, mctl_present, zoneid);
967 		return;
968 	}
969 	case IPPROTO_TCP: {
970 		/*
971 		 * Verify we have at least ICMP_MIN_TP_HDR_LEN bytes of
972 		 * the TCP header to get the port information.
973 		 */
974 		if ((uchar_t *)ip6h + hdr_length + ICMP_MIN_TP_HDR_LEN >
975 		    mp->b_wptr) {
976 			break;
977 		}
978 
979 		/*
980 		 * Attempt to find a client stream based on port.
981 		 * Note that we do a reverse lookup since the header is
982 		 * in the form we sent it out.
983 		 * The rip6h header is only used for the IP_TCP_*MATCH_V6 and
984 		 * we only set the src and dst addresses and nexthdr.
985 		 */
986 
987 		tcpha = (tcpha_t *)((char *)ip6h + hdr_length);
988 		connp = ipcl_tcp_lookup_reversed_ipv6(ip6h, tcpha,
989 		    TCPS_LISTEN, ill->ill_phyint->phyint_ifindex);
990 		if (connp == NULL) {
991 			goto drop_pkt;
992 		}
993 
994 		squeue_fill(connp->conn_sqp, first_mp, tcp_input,
995 		    connp, SQTAG_TCP6_INPUT_ICMP_ERR);
996 		return;
997 
998 	}
999 	case IPPROTO_SCTP:
1000 		/*
1001 		 * Verify we have at least ICMP_MIN_TP_HDR_LEN bytes of
1002 		 * the SCTP header to get the port information.
1003 		 */
1004 		if ((uchar_t *)ip6h + hdr_length + ICMP_MIN_TP_HDR_LEN >
1005 		    mp->b_wptr) {
1006 			break;
1007 		}
1008 
1009 		up = (uint16_t *)((uchar_t *)ip6h + hdr_length);
1010 		((uint16_t *)&ports)[0] = up[1];
1011 		((uint16_t *)&ports)[1] = up[0];
1012 		ip_fanout_sctp(mp, ill, (ipha_t *)ip6h, ports, 0, mctl_present,
1013 		    IP6_NO_IPPOLICY, 0, zoneid);
1014 		return;
1015 	case IPPROTO_ESP:
1016 	case IPPROTO_AH: {
1017 		int ipsec_rc;
1018 
1019 		/*
1020 		 * We need a IPSEC_IN in the front to fanout to AH/ESP.
1021 		 * We will re-use the IPSEC_IN if it is already present as
1022 		 * AH/ESP will not affect any fields in the IPSEC_IN for
1023 		 * ICMP errors. If there is no IPSEC_IN, allocate a new
1024 		 * one and attach it in the front.
1025 		 */
1026 		if (ii != NULL) {
1027 			/*
1028 			 * ip_fanout_proto_again converts the ICMP errors
1029 			 * that come back from AH/ESP to M_DATA so that
1030 			 * if it is non-AH/ESP and we do a pullupmsg in
1031 			 * this function, it would work. Convert it back
1032 			 * to M_CTL before we send up as this is a ICMP
1033 			 * error. This could have been generated locally or
1034 			 * by some router. Validate the inner IPSEC
1035 			 * headers.
1036 			 *
1037 			 * NOTE : ill_index is used by ip_fanout_proto_again
1038 			 * to locate the ill.
1039 			 */
1040 			ASSERT(ill != NULL);
1041 			ii->ipsec_in_ill_index =
1042 			    ill->ill_phyint->phyint_ifindex;
1043 			ii->ipsec_in_rill_index = ii->ipsec_in_ill_index;
1044 			first_mp->b_cont->b_datap->db_type = M_CTL;
1045 		} else {
1046 			/*
1047 			 * IPSEC_IN is not present. We attach a ipsec_in
1048 			 * message and send up to IPSEC for validating
1049 			 * and removing the IPSEC headers. Clear
1050 			 * ipsec_in_secure so that when we return
1051 			 * from IPSEC, we don't mistakenly think that this
1052 			 * is a secure packet came from the network.
1053 			 *
1054 			 * NOTE : ill_index is used by ip_fanout_proto_again
1055 			 * to locate the ill.
1056 			 */
1057 			ASSERT(first_mp == mp);
1058 			first_mp = ipsec_in_alloc(B_FALSE);
1059 			if (first_mp == NULL) {
1060 				freemsg(mp);
1061 				BUMP_MIB(&ip_mib, ipInDiscards);
1062 				return;
1063 			}
1064 			ii = (ipsec_in_t *)first_mp->b_rptr;
1065 
1066 			/* This is not a secure packet */
1067 			ii->ipsec_in_secure = B_FALSE;
1068 			first_mp->b_cont = mp;
1069 			mp->b_datap->db_type = M_CTL;
1070 			ASSERT(ill != NULL);
1071 			ii->ipsec_in_ill_index =
1072 			    ill->ill_phyint->phyint_ifindex;
1073 			ii->ipsec_in_rill_index = ii->ipsec_in_ill_index;
1074 		}
1075 
1076 		if (!ipsec_loaded()) {
1077 			ip_proto_not_sup(q, first_mp, 0, zoneid);
1078 			return;
1079 		}
1080 
1081 		if (nexthdr == IPPROTO_ESP)
1082 			ipsec_rc = ipsecesp_icmp_error(first_mp);
1083 		else
1084 			ipsec_rc = ipsecah_icmp_error(first_mp);
1085 		if (ipsec_rc == IPSEC_STATUS_FAILED)
1086 			return;
1087 
1088 		ip_fanout_proto_again(first_mp, ill, ill, NULL);
1089 		return;
1090 	}
1091 	case IPPROTO_ENCAP:
1092 	case IPPROTO_IPV6:
1093 		if ((uint8_t *)ip6h + hdr_length +
1094 		    (nexthdr == IPPROTO_ENCAP ? sizeof (ipha_t) :
1095 			sizeof (ip6_t)) > mp->b_wptr)
1096 			goto drop_pkt;
1097 
1098 		if (nexthdr == IPPROTO_ENCAP ||
1099 		    !IN6_ARE_ADDR_EQUAL(
1100 			&((ip6_t *)(((uint8_t *)ip6h) + hdr_length))->ip6_src,
1101 			&ip6h->ip6_src) ||
1102 		    !IN6_ARE_ADDR_EQUAL(
1103 			&((ip6_t *)(((uint8_t *)ip6h) + hdr_length))->ip6_dst,
1104 			&ip6h->ip6_dst)) {
1105 			/*
1106 			 * For tunnels that have used IPsec protection,
1107 			 * we need to adjust the MTU to take into account
1108 			 * the IPsec overhead.
1109 			 */
1110 			if (ii != NULL)
1111 				icmp6->icmp6_mtu = htons(
1112 				    ntohs(icmp6->icmp6_mtu) -
1113 					ipsec_in_extra_length(first_mp));
1114 		} else {
1115 			/*
1116 			 * Self-encapsulated case. As in the ipv4 case,
1117 			 * we need to strip the 2nd IP header. Since mp
1118 			 * is already pulled-up, we can simply bcopy
1119 			 * the 3rd header + data over the 2nd header.
1120 			 */
1121 			uint16_t unused_len;
1122 			ip6_t *inner_ip6h = (ip6_t *)
1123 			    ((uchar_t *)ip6h + hdr_length);
1124 
1125 			/*
1126 			 * Make sure we don't do recursion more than once.
1127 			 */
1128 			if (!ip_hdr_length_nexthdr_v6(mp, inner_ip6h,
1129 			    &unused_len, &nexthdrp) ||
1130 			    *nexthdrp == IPPROTO_IPV6) {
1131 				goto drop_pkt;
1132 			}
1133 
1134 			/*
1135 			 * We are about to modify the packet. Make a copy if
1136 			 * someone else has a reference to it.
1137 			 */
1138 			if (DB_REF(mp) > 1) {
1139 				mblk_t	*mp1;
1140 				uint16_t icmp6_offset;
1141 
1142 				mp1 = copymsg(mp);
1143 				if (mp1 == NULL) {
1144 					goto drop_pkt;
1145 				}
1146 				icmp6_offset = (uint16_t)
1147 				    ((uchar_t *)icmp6 - mp->b_rptr);
1148 				freemsg(mp);
1149 				mp = mp1;
1150 
1151 				icmp6 = (icmp6_t *)(mp->b_rptr + icmp6_offset);
1152 				ip6h = (ip6_t *)&icmp6[1];
1153 				inner_ip6h = (ip6_t *)
1154 				    ((uchar_t *)ip6h + hdr_length);
1155 
1156 				if (mctl_present)
1157 					first_mp->b_cont = mp;
1158 				else
1159 					first_mp = mp;
1160 			}
1161 
1162 			/*
1163 			 * Need to set db_type back to M_DATA before
1164 			 * refeeding mp into this function.
1165 			 */
1166 			DB_TYPE(mp) = M_DATA;
1167 
1168 			/*
1169 			 * Copy the 3rd header + remaining data on top
1170 			 * of the 2nd header.
1171 			 */
1172 			bcopy(inner_ip6h, ip6h,
1173 			    mp->b_wptr - (uchar_t *)inner_ip6h);
1174 
1175 			/*
1176 			 * Subtract length of the 2nd header.
1177 			 */
1178 			mp->b_wptr -= hdr_length;
1179 
1180 			/*
1181 			 * Now recurse, and see what I _really_ should be
1182 			 * doing here.
1183 			 */
1184 			icmp_inbound_error_fanout_v6(q, first_mp,
1185 			    (ip6_t *)mp->b_rptr, icmp6, ill, mctl_present,
1186 			    zoneid);
1187 			return;
1188 		}
1189 		/* FALLTHRU */
1190 	default:
1191 		/*
1192 		 * The rip6h header is only used for the lookup and we
1193 		 * only set the src and dst addresses and nexthdr.
1194 		 */
1195 		rip6h.ip6_src = ip6h->ip6_dst;
1196 		rip6h.ip6_dst = ip6h->ip6_src;
1197 		rip6h.ip6_nxt = nexthdr;
1198 		ip_fanout_proto_v6(q, first_mp, &rip6h, ill, ill, nexthdr, 0,
1199 		    IP6_NO_IPPOLICY, mctl_present, zoneid);
1200 		return;
1201 	}
1202 	/* NOTREACHED */
1203 drop_pkt:
1204 	BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInErrors);
1205 	ip1dbg(("icmp_inbound_error_fanout_v6: drop pkt\n"));
1206 	freemsg(first_mp);
1207 }
1208 
1209 /*
1210  * Validate the incoming redirect message,  if valid redirect
1211  * processing is done later.  This is separated from the actual
1212  * redirect processing to avoid becoming single threaded when not
1213  * necessary. (i.e invalid packet)
1214  * Assumes that any AH or ESP headers have already been removed.
1215  * The mp has already been pulled up.
1216  */
1217 boolean_t
1218 icmp_redirect_ok_v6(ill_t *ill, mblk_t *mp)
1219 {
1220 	ip6_t		*ip6h = (ip6_t *)mp->b_rptr;
1221 	nd_redirect_t	*rd;
1222 	ire_t		*ire;
1223 	uint16_t	len;
1224 	uint16_t	hdr_length;
1225 
1226 	ASSERT(mp->b_cont == NULL);
1227 	if (ip6h->ip6_nxt != IPPROTO_ICMPV6)
1228 		hdr_length = ip_hdr_length_v6(mp, ip6h);
1229 	else
1230 		hdr_length = IPV6_HDR_LEN;
1231 	rd = (nd_redirect_t *)&mp->b_rptr[hdr_length];
1232 	len = mp->b_wptr - mp->b_rptr -  hdr_length;
1233 	if (!IN6_IS_ADDR_LINKLOCAL(&ip6h->ip6_src) ||
1234 	    (ip6h->ip6_hops != IPV6_MAX_HOPS) ||
1235 	    (rd->nd_rd_code != 0) ||
1236 	    (len < sizeof (nd_redirect_t)) ||
1237 	    (IN6_IS_ADDR_V4MAPPED(&rd->nd_rd_dst)) ||
1238 	    (IN6_IS_ADDR_MULTICAST(&rd->nd_rd_dst))) {
1239 		return (B_FALSE);
1240 	}
1241 	if (!(IN6_IS_ADDR_LINKLOCAL(&rd->nd_rd_target) ||
1242 	    IN6_ARE_ADDR_EQUAL(&rd->nd_rd_target, &rd->nd_rd_dst))) {
1243 		return (B_FALSE);
1244 	}
1245 
1246 	/*
1247 	 * Verify that the IP source address of the redirect is
1248 	 * the same as the current first-hop router for the specified
1249 	 * ICMP destination address.  Just to be cautious, this test
1250 	 * will be done again before we add the redirect, in case
1251 	 * router goes away between now and then.
1252 	 */
1253 	ire = ire_route_lookup_v6(&rd->nd_rd_dst, 0,
1254 	    &ip6h->ip6_src, 0, ill->ill_ipif, NULL, ALL_ZONES, NULL,
1255 	    MATCH_IRE_GW | MATCH_IRE_ILL_GROUP);
1256 	if (ire == NULL)
1257 		return (B_FALSE);
1258 	ire_refrele(ire);
1259 	if (len > sizeof (nd_redirect_t)) {
1260 		if (!ndp_verify_optlen((nd_opt_hdr_t *)&rd[1],
1261 		    len - sizeof (nd_redirect_t)))
1262 			return (B_FALSE);
1263 	}
1264 	return (B_TRUE);
1265 }
1266 
1267 /*
1268  * Process received IPv6 ICMP Redirect messages.
1269  * Assumes that the icmp packet has already been verfied to be
1270  * valid, aligned and in a single mblk all done in icmp_redirect_ok_v6().
1271  */
1272 /* ARGSUSED */
1273 static void
1274 icmp_redirect_v6(queue_t *q, mblk_t *mp, ill_t *ill)
1275 {
1276 	ip6_t		*ip6h;
1277 	uint16_t	hdr_length;
1278 	nd_redirect_t	*rd;
1279 	ire_t		*ire;
1280 	ire_t		*prev_ire;
1281 	ire_t		*redir_ire;
1282 	in6_addr_t	*src, *dst, *gateway;
1283 	nd_opt_hdr_t	*opt;
1284 	nce_t		*nce;
1285 	int		nce_flags = 0;
1286 	int		err = 0;
1287 	boolean_t	redirect_to_router = B_FALSE;
1288 	int		len;
1289 	iulp_t		ulp_info = { 0 };
1290 	ill_t		*prev_ire_ill;
1291 	ipif_t		*ipif;
1292 
1293 	ip6h = (ip6_t *)mp->b_rptr;
1294 	if (ip6h->ip6_nxt != IPPROTO_ICMPV6)
1295 		hdr_length = ip_hdr_length_v6(mp, ip6h);
1296 	else
1297 		hdr_length = IPV6_HDR_LEN;
1298 
1299 	rd = (nd_redirect_t *)&mp->b_rptr[hdr_length];
1300 	src = &ip6h->ip6_src;
1301 	dst = &rd->nd_rd_dst;
1302 	gateway = &rd->nd_rd_target;
1303 	if (!IN6_ARE_ADDR_EQUAL(gateway, dst)) {
1304 		redirect_to_router = B_TRUE;
1305 		nce_flags |= NCE_F_ISROUTER;
1306 	}
1307 	/*
1308 	 * Make sure we had a route for the dest in question and that
1309 	 * route was pointing to the old gateway (the source of the
1310 	 * redirect packet.)
1311 	 */
1312 	ipif = ipif_get_next_ipif(NULL, ill);
1313 	if (ipif == NULL) {
1314 		freemsg(mp);
1315 		return;
1316 	}
1317 	prev_ire = ire_route_lookup_v6(dst, 0, src, 0, ipif, NULL,
1318 	    ALL_ZONES, NULL, MATCH_IRE_GW | MATCH_IRE_ILL_GROUP);
1319 	ipif_refrele(ipif);
1320 	/*
1321 	 * Check that
1322 	 *	the redirect was not from ourselves
1323 	 *	old gateway is still directly reachable
1324 	 */
1325 	if (prev_ire == NULL ||
1326 	    prev_ire->ire_type == IRE_LOCAL) {
1327 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInBadRedirects);
1328 		goto fail_redirect;
1329 	}
1330 	prev_ire_ill = ire_to_ill(prev_ire);
1331 	ASSERT(prev_ire_ill != NULL);
1332 	if (prev_ire_ill->ill_flags & ILLF_NONUD)
1333 		nce_flags |= NCE_F_NONUD;
1334 
1335 	/*
1336 	 * Should we use the old ULP info to create the new gateway?  From
1337 	 * a user's perspective, we should inherit the info so that it
1338 	 * is a "smooth" transition.  If we do not do that, then new
1339 	 * connections going thru the new gateway will have no route metrics,
1340 	 * which is counter-intuitive to user.  From a network point of
1341 	 * view, this may or may not make sense even though the new gateway
1342 	 * is still directly connected to us so the route metrics should not
1343 	 * change much.
1344 	 *
1345 	 * But if the old ire_uinfo is not initialized, we do another
1346 	 * recursive lookup on the dest using the new gateway.  There may
1347 	 * be a route to that.  If so, use it to initialize the redirect
1348 	 * route.
1349 	 */
1350 	if (prev_ire->ire_uinfo.iulp_set) {
1351 		bcopy(&prev_ire->ire_uinfo, &ulp_info, sizeof (iulp_t));
1352 	} else if (redirect_to_router) {
1353 		/*
1354 		 * Only do the following if the redirection is really to
1355 		 * a router.
1356 		 */
1357 		ire_t *tmp_ire;
1358 		ire_t *sire;
1359 
1360 		tmp_ire = ire_ftable_lookup_v6(dst, 0, gateway, 0, NULL, &sire,
1361 		    ALL_ZONES, 0, NULL,
1362 		    (MATCH_IRE_RECURSIVE | MATCH_IRE_GW | MATCH_IRE_DEFAULT));
1363 		if (sire != NULL) {
1364 			bcopy(&sire->ire_uinfo, &ulp_info, sizeof (iulp_t));
1365 			ASSERT(tmp_ire != NULL);
1366 			ire_refrele(tmp_ire);
1367 			ire_refrele(sire);
1368 		} else if (tmp_ire != NULL) {
1369 			bcopy(&tmp_ire->ire_uinfo, &ulp_info,
1370 			    sizeof (iulp_t));
1371 			ire_refrele(tmp_ire);
1372 		}
1373 	}
1374 
1375 	len = mp->b_wptr - mp->b_rptr -  hdr_length - sizeof (nd_redirect_t);
1376 	opt = (nd_opt_hdr_t *)&rd[1];
1377 	opt = ndp_get_option(opt, len, ND_OPT_TARGET_LINKADDR);
1378 	if (opt != NULL) {
1379 		err = ndp_lookup_then_add(ill,
1380 		    (uchar_t *)&opt[1],		/* Link layer address */
1381 		    gateway,
1382 		    &ipv6_all_ones,		/* prefix mask */
1383 		    &ipv6_all_zeros,		/* Mapping mask */
1384 		    0,
1385 		    nce_flags,
1386 		    ND_STALE,
1387 		    &nce);
1388 		switch (err) {
1389 		case 0:
1390 			NCE_REFRELE(nce);
1391 			break;
1392 		case EEXIST:
1393 			/*
1394 			 * Check to see if link layer address has changed and
1395 			 * process the nce_state accordingly.
1396 			 */
1397 			ndp_process(nce, (uchar_t *)&opt[1], 0, B_FALSE);
1398 			NCE_REFRELE(nce);
1399 			break;
1400 		default:
1401 			ip1dbg(("icmp_redirect_v6: NCE create failed %d\n",
1402 			    err));
1403 			goto fail_redirect;
1404 		}
1405 	}
1406 	if (redirect_to_router) {
1407 		/* icmp_redirect_ok_v6() must  have already verified this  */
1408 		ASSERT(IN6_IS_ADDR_LINKLOCAL(gateway));
1409 
1410 		/*
1411 		 * Create a Route Association.  This will allow us to remember
1412 		 * a router told us to use the particular gateway.
1413 		 */
1414 		ire = ire_create_v6(
1415 		    dst,
1416 		    &ipv6_all_ones,		/* mask */
1417 		    &prev_ire->ire_src_addr_v6,	/* source addr */
1418 		    gateway,			/* gateway addr */
1419 		    &prev_ire->ire_max_frag,	/* max frag */
1420 		    NULL,			/* Fast Path header */
1421 		    NULL, 			/* no rfq */
1422 		    NULL,			/* no stq */
1423 		    IRE_HOST_REDIRECT,
1424 		    NULL,
1425 		    prev_ire->ire_ipif,
1426 		    NULL,
1427 		    0,
1428 		    0,
1429 		    (RTF_DYNAMIC | RTF_GATEWAY | RTF_HOST),
1430 		    &ulp_info,
1431 		    NULL,
1432 		    NULL);
1433 	} else {
1434 		/*
1435 		 * Just create an on link entry, may or may not be a router
1436 		 * If there is no link layer address option ire_add() won't
1437 		 * add this.
1438 		 */
1439 		ire = ire_create_v6(
1440 		    dst,				/* gateway == dst */
1441 		    &ipv6_all_ones,			/* mask */
1442 		    &prev_ire->ire_src_addr_v6,		/* source addr */
1443 		    &ipv6_all_zeros,			/* gateway addr */
1444 		    &prev_ire->ire_max_frag,		/* max frag */
1445 		    NULL,				/* Fast Path header */
1446 		    prev_ire->ire_rfq,			/* ire rfq */
1447 		    prev_ire->ire_stq,			/* ire stq */
1448 		    IRE_CACHE,
1449 		    NULL,
1450 		    prev_ire->ire_ipif,
1451 		    &ipv6_all_ones,
1452 		    0,
1453 		    0,
1454 		    0,
1455 		    &ulp_info,
1456 		    NULL,
1457 		    NULL);
1458 	}
1459 	if (ire == NULL)
1460 		goto fail_redirect;
1461 
1462 	/*
1463 	 * XXX If there is no nce i.e there is no target link layer address
1464 	 * option with the redirect message, ire_add will fail. In that
1465 	 * case we never add the IRE_CACHE/IRE_HOST_REDIRECT. We need
1466 	 * to fix this.
1467 	 */
1468 	if (ire_add(&ire, NULL, NULL, NULL) == 0) {
1469 
1470 		/* tell routing sockets that we received a redirect */
1471 		ip_rts_change_v6(RTM_REDIRECT,
1472 		    &rd->nd_rd_dst,
1473 		    &rd->nd_rd_target,
1474 		    &ipv6_all_ones, 0, &ire->ire_src_addr_v6,
1475 		    (RTF_DYNAMIC | RTF_GATEWAY | RTF_HOST), 0,
1476 		    (RTA_DST | RTA_GATEWAY | RTA_NETMASK | RTA_AUTHOR));
1477 
1478 		/*
1479 		 * Delete any existing IRE_HOST_REDIRECT for this destination.
1480 		 * This together with the added IRE has the effect of
1481 		 * modifying an existing redirect.
1482 		 */
1483 		redir_ire = ire_ftable_lookup_v6(dst, 0, src, IRE_HOST_REDIRECT,
1484 		    ire->ire_ipif, NULL, ALL_ZONES, 0, NULL,
1485 		    (MATCH_IRE_GW | MATCH_IRE_TYPE | MATCH_IRE_ILL_GROUP));
1486 
1487 		ire_refrele(ire);		/* Held in ire_add_v6 */
1488 
1489 		if (redir_ire != NULL) {
1490 			ire_delete(redir_ire);
1491 			ire_refrele(redir_ire);
1492 		}
1493 	}
1494 
1495 	if (prev_ire->ire_type == IRE_CACHE)
1496 		ire_delete(prev_ire);
1497 	ire_refrele(prev_ire);
1498 	prev_ire = NULL;
1499 
1500 fail_redirect:
1501 	if (prev_ire != NULL)
1502 		ire_refrele(prev_ire);
1503 	freemsg(mp);
1504 }
1505 
1506 static ill_t *
1507 ip_queue_to_ill_v6(queue_t *q)
1508 {
1509 	ill_t *ill;
1510 
1511 	ASSERT(WR(q) == q);
1512 
1513 	if (q->q_next != NULL) {
1514 		ill = (ill_t *)q->q_ptr;
1515 		if (ILL_CAN_LOOKUP(ill))
1516 			ill_refhold(ill);
1517 		else
1518 			ill = NULL;
1519 	} else {
1520 		ill = ill_lookup_on_name(ipif_loopback_name, B_FALSE, B_TRUE,
1521 		    NULL, NULL, NULL, NULL, NULL);
1522 	}
1523 	if (ill == NULL)
1524 		ip0dbg(("ip_queue_to_ill_v6: no ill\n"));
1525 	return (ill);
1526 }
1527 
1528 /*
1529  * Assigns an appropriate source address to the packet.
1530  * If origdst is one of our IP addresses that use it as the source.
1531  * If the queue is an ill queue then select a source from that ill.
1532  * Otherwise pick a source based on a route lookup back to the origsrc.
1533  *
1534  * src is the return parameter. Returns a pointer to src or NULL if failure.
1535  */
1536 static in6_addr_t *
1537 icmp_pick_source_v6(queue_t *wq, in6_addr_t *origsrc, in6_addr_t *origdst,
1538     in6_addr_t *src)
1539 {
1540 	ill_t	*ill;
1541 	ire_t	*ire;
1542 	ipif_t	*ipif;
1543 	zoneid_t	zoneid;
1544 
1545 	ASSERT(!(wq->q_flag & QREADR));
1546 	if (wq->q_next != NULL) {
1547 		ill = (ill_t *)wq->q_ptr;
1548 		zoneid = GLOBAL_ZONEID;
1549 	} else {
1550 		ill = NULL;
1551 		zoneid = Q_TO_CONN(wq)->conn_zoneid;
1552 	}
1553 
1554 	ire = ire_route_lookup_v6(origdst, 0, 0, (IRE_LOCAL|IRE_LOOPBACK),
1555 	    NULL, NULL, zoneid, NULL, (MATCH_IRE_TYPE|MATCH_IRE_ZONEONLY));
1556 	if (ire != NULL) {
1557 		/* Destined to one of our addresses */
1558 		*src = *origdst;
1559 		ire_refrele(ire);
1560 		return (src);
1561 	}
1562 	if (ire != NULL) {
1563 		ire_refrele(ire);
1564 		ire = NULL;
1565 	}
1566 	if (ill == NULL) {
1567 		/* What is the route back to the original source? */
1568 		ire = ire_route_lookup_v6(origsrc, 0, 0, 0,
1569 		    NULL, NULL, zoneid, NULL,
1570 		    (MATCH_IRE_DEFAULT|MATCH_IRE_RECURSIVE));
1571 		if (ire == NULL) {
1572 			BUMP_MIB(&ip6_mib, ipv6OutNoRoutes);
1573 			return (NULL);
1574 		}
1575 		/*
1576 		 * Does not matter whether we use ire_stq or ire_ipif here.
1577 		 * Just pick an ill for ICMP replies.
1578 		 */
1579 		ASSERT(ire->ire_ipif != NULL);
1580 		ill = ire->ire_ipif->ipif_ill;
1581 		ire_refrele(ire);
1582 	}
1583 	ipif = ipif_select_source_v6(ill, origsrc, RESTRICT_TO_NONE,
1584 	    IPV6_PREFER_SRC_DEFAULT, zoneid);
1585 	if (ipif != NULL) {
1586 		*src = ipif->ipif_v6src_addr;
1587 		ipif_refrele(ipif);
1588 		return (src);
1589 	}
1590 	/*
1591 	 * Unusual case - can't find a usable source address to reach the
1592 	 * original source. Use what in the route to the source.
1593 	 */
1594 	ire = ire_route_lookup_v6(origsrc, 0, 0, 0,
1595 	    NULL, NULL, zoneid, NULL,
1596 	    (MATCH_IRE_DEFAULT|MATCH_IRE_RECURSIVE));
1597 	if (ire == NULL) {
1598 		BUMP_MIB(&ip6_mib, ipv6OutNoRoutes);
1599 		return (NULL);
1600 	}
1601 	ASSERT(ire != NULL);
1602 	*src = ire->ire_src_addr_v6;
1603 	ire_refrele(ire);
1604 	return (src);
1605 }
1606 
1607 /*
1608  * Build and ship an IPv6 ICMP message using the packet data in mp,
1609  * and the ICMP header pointed to by "stuff".  (May be called as
1610  * writer.)
1611  * Note: assumes that icmp_pkt_err_ok_v6 has been called to
1612  * verify that an icmp error packet can be sent.
1613  *
1614  * If q is an ill write side queue (which is the case when packets
1615  * arrive from ip_rput) then ip_wput code will ensure that packets to
1616  * link-local destinations are sent out that ill.
1617  *
1618  * If v6src_ptr is set use it as a source. Otherwise select a reasonable
1619  * source address (see above function).
1620  */
1621 static void
1622 icmp_pkt_v6(queue_t *q, mblk_t *mp, void *stuff, size_t len,
1623     const in6_addr_t *v6src_ptr, boolean_t mctl_present)
1624 {
1625 	ip6_t		*ip6h;
1626 	in6_addr_t	v6dst;
1627 	size_t		len_needed;
1628 	size_t		msg_len;
1629 	mblk_t		*mp1;
1630 	icmp6_t		*icmp6;
1631 	ill_t		*ill;
1632 	in6_addr_t	v6src;
1633 	mblk_t *ipsec_mp;
1634 	ipsec_out_t *io;
1635 
1636 	ill = ip_queue_to_ill_v6(q);
1637 	if (ill == NULL) {
1638 		freemsg(mp);
1639 		return;
1640 	}
1641 
1642 	if (mctl_present) {
1643 		/*
1644 		 * If it is :
1645 		 *
1646 		 * 1) a IPSEC_OUT, then this is caused by outbound
1647 		 *    datagram originating on this host. IPSEC processing
1648 		 *    may or may not have been done. Refer to comments above
1649 		 *    icmp_inbound_error_fanout for details.
1650 		 *
1651 		 * 2) a IPSEC_IN if we are generating a icmp_message
1652 		 *    for an incoming datagram destined for us i.e called
1653 		 *    from ip_fanout_send_icmp.
1654 		 */
1655 		ipsec_info_t *in;
1656 
1657 		ipsec_mp = mp;
1658 		mp = ipsec_mp->b_cont;
1659 
1660 		in = (ipsec_info_t *)ipsec_mp->b_rptr;
1661 		ip6h = (ip6_t *)mp->b_rptr;
1662 
1663 		ASSERT(in->ipsec_info_type == IPSEC_OUT ||
1664 		    in->ipsec_info_type == IPSEC_IN);
1665 
1666 		if (in->ipsec_info_type == IPSEC_IN) {
1667 			/*
1668 			 * Convert the IPSEC_IN to IPSEC_OUT.
1669 			 */
1670 			if (!ipsec_in_to_out(ipsec_mp, NULL, ip6h)) {
1671 				BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
1672 				ill_refrele(ill);
1673 				return;
1674 			}
1675 		} else {
1676 			ASSERT(in->ipsec_info_type == IPSEC_OUT);
1677 			io = (ipsec_out_t *)in;
1678 			/*
1679 			 * Clear out ipsec_out_proc_begin, so we do a fresh
1680 			 * ire lookup.
1681 			 */
1682 			io->ipsec_out_proc_begin = B_FALSE;
1683 		}
1684 	} else {
1685 		/*
1686 		 * This is in clear. The icmp message we are building
1687 		 * here should go out in clear.
1688 		 */
1689 		ipsec_in_t *ii;
1690 		ASSERT(mp->b_datap->db_type == M_DATA);
1691 		if ((ipsec_mp = ipsec_in_alloc(B_FALSE)) == NULL) {
1692 			freemsg(mp);
1693 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
1694 			ill_refrele(ill);
1695 			return;
1696 		}
1697 		ii = (ipsec_in_t *)ipsec_mp->b_rptr;
1698 
1699 		/* This is not a secure packet */
1700 		ii->ipsec_in_secure = B_FALSE;
1701 		ipsec_mp->b_cont = mp;
1702 		ip6h = (ip6_t *)mp->b_rptr;
1703 		/*
1704 		 * Convert the IPSEC_IN to IPSEC_OUT.
1705 		 */
1706 		if (!ipsec_in_to_out(ipsec_mp, NULL, ip6h)) {
1707 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
1708 			ill_refrele(ill);
1709 			return;
1710 		}
1711 	}
1712 	io = (ipsec_out_t *)ipsec_mp->b_rptr;
1713 
1714 	if (v6src_ptr != NULL) {
1715 		v6src = *v6src_ptr;
1716 	} else {
1717 		if (icmp_pick_source_v6(q, &ip6h->ip6_src, &ip6h->ip6_dst,
1718 		    &v6src) == NULL) {
1719 			freemsg(ipsec_mp);
1720 			ill_refrele(ill);
1721 			return;
1722 		}
1723 	}
1724 	v6dst = ip6h->ip6_src;
1725 	len_needed = ipv6_icmp_return - IPV6_HDR_LEN - len;
1726 	msg_len = msgdsize(mp);
1727 	if (msg_len > len_needed) {
1728 		if (!adjmsg(mp, len_needed - msg_len)) {
1729 			BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutErrors);
1730 			freemsg(ipsec_mp);
1731 			ill_refrele(ill);
1732 			return;
1733 		}
1734 		msg_len = len_needed;
1735 	}
1736 	mp1 = allocb(IPV6_HDR_LEN + len, BPRI_HI);
1737 	if (mp1 == NULL) {
1738 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutErrors);
1739 		freemsg(ipsec_mp);
1740 		ill_refrele(ill);
1741 		return;
1742 	}
1743 	ill_refrele(ill);
1744 	mp1->b_cont = mp;
1745 	mp = mp1;
1746 	ASSERT(ipsec_mp->b_datap->db_type == M_CTL &&
1747 	    io->ipsec_out_type == IPSEC_OUT);
1748 	ipsec_mp->b_cont = mp;
1749 
1750 	/*
1751 	 * Set ipsec_out_icmp_loopback so we can let the ICMP messages this
1752 	 * node generates be accepted in peace by all on-host destinations.
1753 	 * If we do NOT assume that all on-host destinations trust
1754 	 * self-generated ICMP messages, then rework here, ip.c, and spd.c.
1755 	 * (Look for ipsec_out_icmp_loopback).
1756 	 */
1757 	io->ipsec_out_icmp_loopback = B_TRUE;
1758 
1759 	ip6h = (ip6_t *)mp->b_rptr;
1760 	mp1->b_wptr = (uchar_t *)ip6h + (IPV6_HDR_LEN + len);
1761 
1762 	ip6h->ip6_vcf = IPV6_DEFAULT_VERS_AND_FLOW;
1763 	ip6h->ip6_nxt = IPPROTO_ICMPV6;
1764 	ip6h->ip6_hops = ipv6_def_hops;
1765 	ip6h->ip6_dst = v6dst;
1766 	ip6h->ip6_src = v6src;
1767 	msg_len += IPV6_HDR_LEN + len;
1768 	if (msg_len > IP_MAXPACKET + IPV6_HDR_LEN) {
1769 		(void) adjmsg(mp, IP_MAXPACKET + IPV6_HDR_LEN - msg_len);
1770 		msg_len = IP_MAXPACKET + IPV6_HDR_LEN;
1771 	}
1772 	ip6h->ip6_plen = htons((uint16_t)(msgdsize(mp) - IPV6_HDR_LEN));
1773 	icmp6 = (icmp6_t *)&ip6h[1];
1774 	bcopy(stuff, (char *)icmp6, len);
1775 	/*
1776 	 * Prepare for checksum by putting icmp length in the icmp
1777 	 * checksum field. The checksum is calculated in ip_wput_v6.
1778 	 */
1779 	icmp6->icmp6_cksum = ip6h->ip6_plen;
1780 	if (icmp6->icmp6_type == ND_REDIRECT) {
1781 		ip6h->ip6_hops = IPV6_MAX_HOPS;
1782 	}
1783 	/* Send to V6 writeside put routine */
1784 	put(q, ipsec_mp);
1785 }
1786 
1787 /*
1788  * Update the output mib when ICMPv6 packets are sent.
1789  */
1790 static void
1791 icmp_update_out_mib_v6(ill_t *ill, icmp6_t *icmp6)
1792 {
1793 	BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutMsgs);
1794 
1795 	switch (icmp6->icmp6_type) {
1796 	case ICMP6_DST_UNREACH:
1797 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutDestUnreachs);
1798 		if (icmp6->icmp6_code == ICMP6_DST_UNREACH_ADMIN)
1799 			BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutAdminProhibs);
1800 		break;
1801 
1802 	case ICMP6_TIME_EXCEEDED:
1803 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutTimeExcds);
1804 		break;
1805 
1806 	case ICMP6_PARAM_PROB:
1807 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutParmProblems);
1808 		break;
1809 
1810 	case ICMP6_PACKET_TOO_BIG:
1811 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutPktTooBigs);
1812 		break;
1813 
1814 	case ICMP6_ECHO_REQUEST:
1815 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutEchos);
1816 		break;
1817 
1818 	case ICMP6_ECHO_REPLY:
1819 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutEchoReplies);
1820 		break;
1821 
1822 	case ND_ROUTER_SOLICIT:
1823 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutRouterSolicits);
1824 		break;
1825 
1826 	case ND_ROUTER_ADVERT:
1827 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutRouterAdvertisements);
1828 		break;
1829 
1830 	case ND_NEIGHBOR_SOLICIT:
1831 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutNeighborSolicits);
1832 		break;
1833 
1834 	case ND_NEIGHBOR_ADVERT:
1835 		BUMP_MIB(ill->ill_icmp6_mib,
1836 		    ipv6IfIcmpOutNeighborAdvertisements);
1837 		break;
1838 
1839 	case ND_REDIRECT:
1840 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutRedirects);
1841 		break;
1842 
1843 	case MLD_LISTENER_QUERY:
1844 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutGroupMembQueries);
1845 		break;
1846 
1847 	case MLD_LISTENER_REPORT:
1848 	case MLD_V2_LISTENER_REPORT:
1849 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutGroupMembResponses);
1850 		break;
1851 
1852 	case MLD_LISTENER_REDUCTION:
1853 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutGroupMembReductions);
1854 		break;
1855 	}
1856 }
1857 
1858 /*
1859  * Check if it is ok to send an ICMPv6 error packet in
1860  * response to the IP packet in mp.
1861  * Free the message and return null if no
1862  * ICMP error packet should be sent.
1863  */
1864 static mblk_t *
1865 icmp_pkt_err_ok_v6(queue_t *q, mblk_t *mp,
1866     boolean_t llbcast, boolean_t mcast_ok)
1867 {
1868 	ip6_t	*ip6h;
1869 
1870 	if (!mp)
1871 		return (NULL);
1872 
1873 	ip6h = (ip6_t *)mp->b_rptr;
1874 
1875 	/* Check if source address uniquely identifies the host */
1876 
1877 	if (IN6_IS_ADDR_MULTICAST(&ip6h->ip6_src) ||
1878 	    IN6_IS_ADDR_V4MAPPED(&ip6h->ip6_src) ||
1879 	    IN6_IS_ADDR_UNSPECIFIED(&ip6h->ip6_src)) {
1880 		freemsg(mp);
1881 		return (NULL);
1882 	}
1883 
1884 	if (ip6h->ip6_nxt == IPPROTO_ICMPV6) {
1885 		size_t	len_needed = IPV6_HDR_LEN + ICMP6_MINLEN;
1886 		icmp6_t		*icmp6;
1887 
1888 		if (mp->b_wptr - mp->b_rptr < len_needed) {
1889 			if (!pullupmsg(mp, len_needed)) {
1890 				ill_t	*ill;
1891 
1892 				ill = ip_queue_to_ill_v6(q);
1893 				if (ill == NULL) {
1894 					BUMP_MIB(&icmp6_mib,
1895 					    ipv6IfIcmpInErrors);
1896 				} else {
1897 					BUMP_MIB(ill->ill_icmp6_mib,
1898 					    ipv6IfIcmpInErrors);
1899 					ill_refrele(ill);
1900 				}
1901 				freemsg(mp);
1902 				return (NULL);
1903 			}
1904 			ip6h = (ip6_t *)mp->b_rptr;
1905 		}
1906 		icmp6 = (icmp6_t *)&ip6h[1];
1907 		/* Explicitly do not generate errors in response to redirects */
1908 		if (ICMP6_IS_ERROR(icmp6->icmp6_type) ||
1909 		    icmp6->icmp6_type == ND_REDIRECT) {
1910 			freemsg(mp);
1911 			return (NULL);
1912 		}
1913 	}
1914 	/*
1915 	 * Check that the destination is not multicast and that the packet
1916 	 * was not sent on link layer broadcast or multicast.  (Exception
1917 	 * is Packet too big message as per the draft - when mcast_ok is set.)
1918 	 */
1919 	if (!mcast_ok &&
1920 	    (llbcast || IN6_IS_ADDR_MULTICAST(&ip6h->ip6_dst))) {
1921 		freemsg(mp);
1922 		return (NULL);
1923 	}
1924 	if (icmp_err_rate_limit()) {
1925 		/*
1926 		 * Only send ICMP error packets every so often.
1927 		 * This should be done on a per port/source basis,
1928 		 * but for now this will suffice.
1929 		 */
1930 		freemsg(mp);
1931 		return (NULL);
1932 	}
1933 	return (mp);
1934 }
1935 
1936 /*
1937  * Generate an ICMPv6 redirect message.
1938  * Include target link layer address option if it exits.
1939  * Always include redirect header.
1940  */
1941 static void
1942 icmp_send_redirect_v6(queue_t *q, mblk_t *mp, in6_addr_t *targetp,
1943     in6_addr_t *dest, ill_t *ill, boolean_t llbcast)
1944 {
1945 	nd_redirect_t	*rd;
1946 	nd_opt_rd_hdr_t	*rdh;
1947 	uchar_t		*buf;
1948 	nce_t		*nce = NULL;
1949 	nd_opt_hdr_t	*opt;
1950 	int		len;
1951 	int		ll_opt_len = 0;
1952 	int		max_redir_hdr_data_len;
1953 	int		pkt_len;
1954 	in6_addr_t	*srcp;
1955 
1956 	/*
1957 	 * We are called from ip_rput where we could
1958 	 * not have attached an IPSEC_IN.
1959 	 */
1960 	ASSERT(mp->b_datap->db_type == M_DATA);
1961 
1962 	mp = icmp_pkt_err_ok_v6(q, mp, llbcast, B_FALSE);
1963 	if (mp == NULL)
1964 		return;
1965 	nce = ndp_lookup(ill, targetp, B_FALSE);
1966 	if (nce != NULL && nce->nce_state != ND_INCOMPLETE) {
1967 		ll_opt_len = (sizeof (nd_opt_hdr_t) +
1968 		    ill->ill_phys_addr_length + 7)/8 * 8;
1969 	}
1970 	len = sizeof (nd_redirect_t) + sizeof (nd_opt_rd_hdr_t) + ll_opt_len;
1971 	ASSERT(len % 4 == 0);
1972 	buf = kmem_alloc(len, KM_NOSLEEP);
1973 	if (buf == NULL) {
1974 		if (nce != NULL)
1975 			NCE_REFRELE(nce);
1976 		freemsg(mp);
1977 		return;
1978 	}
1979 
1980 	rd = (nd_redirect_t *)buf;
1981 	rd->nd_rd_type = (uint8_t)ND_REDIRECT;
1982 	rd->nd_rd_code = 0;
1983 	rd->nd_rd_reserved = 0;
1984 	rd->nd_rd_target = *targetp;
1985 	rd->nd_rd_dst = *dest;
1986 
1987 	opt = (nd_opt_hdr_t *)(buf + sizeof (nd_redirect_t));
1988 	if (nce != NULL && ll_opt_len != 0) {
1989 		opt->nd_opt_type = ND_OPT_TARGET_LINKADDR;
1990 		opt->nd_opt_len = ll_opt_len/8;
1991 		bcopy((char *)nce->nce_res_mp->b_rptr +
1992 		    NCE_LL_ADDR_OFFSET(ill), &opt[1],
1993 		    ill->ill_phys_addr_length);
1994 	}
1995 	if (nce != NULL)
1996 		NCE_REFRELE(nce);
1997 	rdh = (nd_opt_rd_hdr_t *)(buf + sizeof (nd_redirect_t) + ll_opt_len);
1998 	rdh->nd_opt_rh_type = (uint8_t)ND_OPT_REDIRECTED_HEADER;
1999 	/* max_redir_hdr_data_len and nd_opt_rh_len must be multiple of 8 */
2000 	max_redir_hdr_data_len = (ipv6_icmp_return - IPV6_HDR_LEN - len)/8*8;
2001 	pkt_len = msgdsize(mp);
2002 	/* Make sure mp is 8 byte aligned */
2003 	if (pkt_len > max_redir_hdr_data_len) {
2004 		rdh->nd_opt_rh_len = (max_redir_hdr_data_len +
2005 		    sizeof (nd_opt_rd_hdr_t))/8;
2006 		(void) adjmsg(mp, max_redir_hdr_data_len - pkt_len);
2007 	} else {
2008 		rdh->nd_opt_rh_len = (pkt_len + sizeof (nd_opt_rd_hdr_t))/8;
2009 		(void) adjmsg(mp, -(pkt_len % 8));
2010 	}
2011 	rdh->nd_opt_rh_reserved1 = 0;
2012 	rdh->nd_opt_rh_reserved2 = 0;
2013 	/* ipif_v6src_addr contains the link-local source address */
2014 	rw_enter(&ill_g_lock, RW_READER);
2015 	if (ill->ill_group != NULL) {
2016 		/*
2017 		 * The receiver of the redirect will verify whether it
2018 		 * had a route through us (srcp that we will use in
2019 		 * the redirect) or not. As we load spread even link-locals,
2020 		 * we don't know which source address the receiver of
2021 		 * redirect has in its route for communicating with us.
2022 		 * Thus we randomly choose a source here and finally we
2023 		 * should get to the right one and it will eventually
2024 		 * accept the redirect from us. We can't call
2025 		 * ip_lookup_scope_v6 because we don't have the right
2026 		 * link-local address here. Thus we randomly choose one.
2027 		 */
2028 		int cnt = ill->ill_group->illgrp_ill_count;
2029 
2030 		ill = ill->ill_group->illgrp_ill;
2031 		cnt = ++icmp_redirect_v6_src_index % cnt;
2032 		while (cnt--)
2033 			ill = ill->ill_group_next;
2034 		srcp = &ill->ill_ipif->ipif_v6src_addr;
2035 	} else {
2036 		srcp = &ill->ill_ipif->ipif_v6src_addr;
2037 	}
2038 	rw_exit(&ill_g_lock);
2039 	icmp_pkt_v6(q, mp, buf, len, srcp, B_FALSE);
2040 	kmem_free(buf, len);
2041 }
2042 
2043 
2044 /* Generate an ICMP time exceeded message.  (May be called as writer.) */
2045 void
2046 icmp_time_exceeded_v6(queue_t *q, mblk_t *mp, uint8_t code,
2047     boolean_t llbcast, boolean_t mcast_ok)
2048 {
2049 	icmp6_t	icmp6;
2050 	boolean_t mctl_present;
2051 	mblk_t *first_mp;
2052 
2053 	EXTRACT_PKT_MP(mp, first_mp, mctl_present);
2054 
2055 	mp = icmp_pkt_err_ok_v6(q, mp, llbcast, mcast_ok);
2056 	if (mp == NULL) {
2057 		if (mctl_present)
2058 			freeb(first_mp);
2059 		return;
2060 	}
2061 	bzero(&icmp6, sizeof (icmp6_t));
2062 	icmp6.icmp6_type = ICMP6_TIME_EXCEEDED;
2063 	icmp6.icmp6_code = code;
2064 	icmp_pkt_v6(q, first_mp, &icmp6, sizeof (icmp6_t), NULL, mctl_present);
2065 }
2066 
2067 /*
2068  * Generate an ICMP unreachable message.
2069  */
2070 void
2071 icmp_unreachable_v6(queue_t *q, mblk_t *mp, uint8_t code,
2072     boolean_t llbcast, boolean_t mcast_ok)
2073 {
2074 	icmp6_t	icmp6;
2075 	boolean_t mctl_present;
2076 	mblk_t *first_mp;
2077 
2078 	EXTRACT_PKT_MP(mp, first_mp, mctl_present);
2079 
2080 	mp = icmp_pkt_err_ok_v6(q, mp, llbcast, mcast_ok);
2081 	if (mp == NULL) {
2082 		if (mctl_present)
2083 			freeb(first_mp);
2084 		return;
2085 	}
2086 	bzero(&icmp6, sizeof (icmp6_t));
2087 	icmp6.icmp6_type = ICMP6_DST_UNREACH;
2088 	icmp6.icmp6_code = code;
2089 	icmp_pkt_v6(q, first_mp, &icmp6, sizeof (icmp6_t), NULL, mctl_present);
2090 }
2091 
2092 /*
2093  * Generate an ICMP pkt too big message.
2094  */
2095 static void
2096 icmp_pkt2big_v6(queue_t *q, mblk_t *mp, uint32_t mtu,
2097     boolean_t llbcast, boolean_t mcast_ok)
2098 {
2099 	icmp6_t	icmp6;
2100 	mblk_t *first_mp;
2101 	boolean_t mctl_present;
2102 
2103 	EXTRACT_PKT_MP(mp, first_mp, mctl_present);
2104 
2105 	mp = icmp_pkt_err_ok_v6(q, mp, llbcast, mcast_ok);
2106 	if (mp == NULL) {
2107 		if (mctl_present)
2108 			freeb(first_mp);
2109 		return;
2110 	}
2111 	bzero(&icmp6, sizeof (icmp6_t));
2112 	icmp6.icmp6_type = ICMP6_PACKET_TOO_BIG;
2113 	icmp6.icmp6_code = 0;
2114 	icmp6.icmp6_mtu = htonl(mtu);
2115 
2116 	icmp_pkt_v6(q, first_mp, &icmp6, sizeof (icmp6_t), NULL, mctl_present);
2117 }
2118 
2119 /*
2120  * Generate an ICMP parameter problem message. (May be called as writer.)
2121  * 'offset' is the offset from the beginning of the packet in error.
2122  */
2123 static void
2124 icmp_param_problem_v6(queue_t *q, mblk_t *mp, uint8_t code,
2125     uint32_t offset, boolean_t llbcast, boolean_t mcast_ok)
2126 {
2127 	icmp6_t	icmp6;
2128 	boolean_t mctl_present;
2129 	mblk_t *first_mp;
2130 
2131 	EXTRACT_PKT_MP(mp, first_mp, mctl_present);
2132 
2133 	mp = icmp_pkt_err_ok_v6(q, mp, llbcast, mcast_ok);
2134 	if (mp == NULL) {
2135 		if (mctl_present)
2136 			freeb(first_mp);
2137 		return;
2138 	}
2139 	bzero((char *)&icmp6, sizeof (icmp6_t));
2140 	icmp6.icmp6_type = ICMP6_PARAM_PROB;
2141 	icmp6.icmp6_code = code;
2142 	icmp6.icmp6_pptr = htonl(offset);
2143 	icmp_pkt_v6(q, first_mp, &icmp6, sizeof (icmp6_t), NULL, mctl_present);
2144 }
2145 
2146 /*
2147  * This code will need to take into account the possibility of binding
2148  * to a link local address on a multi-homed host, in which case the
2149  * outgoing interface (from the conn) will need to be used when getting
2150  * an ire for the dst. Going through proper outgoing interface and
2151  * choosing the source address corresponding to the outgoing interface
2152  * is necessary when the destination address is a link-local address and
2153  * IPV6_BOUND_IF or IPV6_PKTINFO or scope_id has been set.
2154  * This can happen when active connection is setup; thus ipp pointer
2155  * is passed here from tcp_connect_*() routines, in non-TCP cases NULL
2156  * pointer is passed as ipp pointer.
2157  */
2158 mblk_t *
2159 ip_bind_v6(queue_t *q, mblk_t *mp, conn_t *connp, ip6_pkt_t *ipp)
2160 {
2161 	ssize_t			len;
2162 	int			protocol;
2163 	struct T_bind_req	*tbr;
2164 	sin6_t			*sin6;
2165 	ipa6_conn_t		*ac6;
2166 	in6_addr_t		*v6srcp;
2167 	in6_addr_t		*v6dstp;
2168 	uint16_t		lport;
2169 	uint16_t		fport;
2170 	uchar_t			*ucp;
2171 	mblk_t			*mp1;
2172 	boolean_t		ire_requested;
2173 	boolean_t		ipsec_policy_set;
2174 	int			error = 0;
2175 	boolean_t		local_bind;
2176 	boolean_t		orig_pkt_isv6 = connp->conn_pkt_isv6;
2177 	ipa6_conn_x_t		*acx6;
2178 	boolean_t		verify_dst;
2179 
2180 	ASSERT(connp->conn_af_isv6);
2181 	len = mp->b_wptr - mp->b_rptr;
2182 	if (len < (sizeof (*tbr) + 1)) {
2183 		(void) mi_strlog(q, 1, SL_ERROR|SL_TRACE,
2184 		    "ip_bind_v6: bogus msg, len %ld", len);
2185 		goto bad_addr;
2186 	}
2187 	/* Back up and extract the protocol identifier. */
2188 	mp->b_wptr--;
2189 	tbr = (struct T_bind_req *)mp->b_rptr;
2190 	/* Reset the message type in preparation for shipping it back. */
2191 	mp->b_datap->db_type = M_PCPROTO;
2192 
2193 	protocol = *mp->b_wptr & 0xFF;
2194 	connp->conn_ulp = (uint8_t)protocol;
2195 
2196 	/*
2197 	 * Check for a zero length address.  This is from a protocol that
2198 	 * wants to register to receive all packets of its type.
2199 	 */
2200 	if (tbr->ADDR_length == 0) {
2201 		if ((protocol == IPPROTO_TCP || protocol == IPPROTO_SCTP ||
2202 		    protocol == IPPROTO_ESP || protocol == IPPROTO_AH) &&
2203 		    ipcl_proto_fanout_v6[protocol].connf_head != NULL) {
2204 			/*
2205 			 * TCP, SCTP, AH, and ESP have single protocol fanouts.
2206 			 * Do not allow others to bind to these.
2207 			 */
2208 			goto bad_addr;
2209 		}
2210 
2211 		/*
2212 		 *
2213 		 * The udp module never sends down a zero-length address,
2214 		 * and allowing this on a labeled system will break MLP
2215 		 * functionality.
2216 		 */
2217 		if (is_system_labeled() && protocol == IPPROTO_UDP)
2218 			goto bad_addr;
2219 
2220 		/* Allow ipsec plumbing */
2221 		if (connp->conn_mac_exempt && protocol != IPPROTO_AH &&
2222 		    protocol != IPPROTO_ESP)
2223 			goto bad_addr;
2224 
2225 		connp->conn_srcv6 = ipv6_all_zeros;
2226 		ipcl_proto_insert_v6(connp, protocol);
2227 
2228 		tbr->PRIM_type = T_BIND_ACK;
2229 		return (mp);
2230 	}
2231 
2232 	/* Extract the address pointer from the message. */
2233 	ucp = (uchar_t *)mi_offset_param(mp, tbr->ADDR_offset,
2234 	    tbr->ADDR_length);
2235 	if (ucp == NULL) {
2236 		ip1dbg(("ip_bind_v6: no address\n"));
2237 		goto bad_addr;
2238 	}
2239 	if (!OK_32PTR(ucp)) {
2240 		ip1dbg(("ip_bind_v6: unaligned address\n"));
2241 		goto bad_addr;
2242 	}
2243 	mp1 = mp->b_cont;	/* trailing mp if any */
2244 	ire_requested = (mp1 && mp1->b_datap->db_type == IRE_DB_REQ_TYPE);
2245 	ipsec_policy_set = (mp1 && mp1->b_datap->db_type == IPSEC_POLICY_SET);
2246 
2247 	switch (tbr->ADDR_length) {
2248 	default:
2249 		ip1dbg(("ip_bind_v6: bad address length %d\n",
2250 		    (int)tbr->ADDR_length));
2251 		goto bad_addr;
2252 
2253 	case IPV6_ADDR_LEN:
2254 		/* Verification of local address only */
2255 		v6srcp = (in6_addr_t *)ucp;
2256 		lport = 0;
2257 		local_bind = B_TRUE;
2258 		break;
2259 
2260 	case sizeof (sin6_t):
2261 		sin6 = (sin6_t *)ucp;
2262 		v6srcp = &sin6->sin6_addr;
2263 		lport = sin6->sin6_port;
2264 		local_bind = B_TRUE;
2265 		break;
2266 
2267 	case sizeof (ipa6_conn_t):
2268 		/*
2269 		 * Verify that both the source and destination addresses
2270 		 * are valid.
2271 		 * Note that we allow connect to broadcast and multicast
2272 		 * addresses when ire_requested is set. Thus the ULP
2273 		 * has to check for IRE_BROADCAST and multicast.
2274 		 */
2275 		ac6 = (ipa6_conn_t *)ucp;
2276 		v6srcp = &ac6->ac6_laddr;
2277 		v6dstp = &ac6->ac6_faddr;
2278 		fport = ac6->ac6_fport;
2279 		/* For raw socket, the local port is not set. */
2280 		lport = ac6->ac6_lport != 0 ? ac6->ac6_lport :
2281 		    connp->conn_lport;
2282 		local_bind = B_FALSE;
2283 		/* Always verify destination reachability. */
2284 		verify_dst = B_TRUE;
2285 		break;
2286 
2287 	case sizeof (ipa6_conn_x_t):
2288 		/*
2289 		 * Verify that the source address is valid.
2290 		 * Note that we allow connect to broadcast and multicast
2291 		 * addresses when ire_requested is set. Thus the ULP
2292 		 * has to check for IRE_BROADCAST and multicast.
2293 		 */
2294 		acx6 = (ipa6_conn_x_t *)ucp;
2295 		ac6 = &acx6->ac6x_conn;
2296 		v6srcp = &ac6->ac6_laddr;
2297 		v6dstp = &ac6->ac6_faddr;
2298 		fport = ac6->ac6_fport;
2299 		lport = ac6->ac6_lport;
2300 		local_bind = B_FALSE;
2301 		/*
2302 		 * Client that passed ipa6_conn_x_t to us specifies whether to
2303 		 * verify destination reachability.
2304 		 */
2305 		verify_dst = (acx6->ac6x_flags & ACX_VERIFY_DST) != 0;
2306 		break;
2307 	}
2308 	if (local_bind) {
2309 		if (IN6_IS_ADDR_V4MAPPED(v6srcp) && !connp->conn_ipv6_v6only) {
2310 			/* Bind to IPv4 address */
2311 			ipaddr_t v4src;
2312 
2313 			IN6_V4MAPPED_TO_IPADDR(v6srcp, v4src);
2314 
2315 			error = ip_bind_laddr(connp, mp, v4src, lport,
2316 			    ire_requested, ipsec_policy_set,
2317 			    tbr->ADDR_length != IPV6_ADDR_LEN);
2318 			if (error != 0)
2319 				goto bad_addr;
2320 			connp->conn_pkt_isv6 = B_FALSE;
2321 		} else {
2322 			if (IN6_IS_ADDR_V4MAPPED(v6srcp)) {
2323 				error = 0;
2324 				goto bad_addr;
2325 			}
2326 			error = ip_bind_laddr_v6(connp, mp, v6srcp, lport,
2327 			    ire_requested, ipsec_policy_set,
2328 			    (tbr->ADDR_length != IPV6_ADDR_LEN));
2329 			if (error != 0)
2330 				goto bad_addr;
2331 			connp->conn_pkt_isv6 = B_TRUE;
2332 		}
2333 		if (protocol == IPPROTO_TCP)
2334 			connp->conn_recv = tcp_conn_request;
2335 	} else {
2336 		/*
2337 		 * Bind to local and remote address. Local might be
2338 		 * unspecified in which case it will be extracted from
2339 		 * ire_src_addr_v6
2340 		 */
2341 		if (IN6_IS_ADDR_V4MAPPED(v6dstp) && !connp->conn_ipv6_v6only) {
2342 			/* Connect to IPv4 address */
2343 			ipaddr_t v4src;
2344 			ipaddr_t v4dst;
2345 
2346 			/* Is the source unspecified or mapped? */
2347 			if (!IN6_IS_ADDR_V4MAPPED(v6srcp) &&
2348 			    !IN6_IS_ADDR_UNSPECIFIED(v6srcp)) {
2349 				ip1dbg(("ip_bind_v6: "
2350 				    "dst is mapped, but not the src\n"));
2351 				goto bad_addr;
2352 			}
2353 			IN6_V4MAPPED_TO_IPADDR(v6srcp, v4src);
2354 			IN6_V4MAPPED_TO_IPADDR(v6dstp, v4dst);
2355 
2356 			/*
2357 			 * XXX Fix needed. Need to pass ipsec_policy_set
2358 			 * instead of B_FALSE.
2359 			 */
2360 
2361 			/* Always verify destination reachability. */
2362 			error = ip_bind_connected(connp, mp, &v4src, lport,
2363 			    v4dst, fport, ire_requested, ipsec_policy_set,
2364 			    B_TRUE, B_TRUE);
2365 			if (error != 0)
2366 				goto bad_addr;
2367 			IN6_IPADDR_TO_V4MAPPED(v4src, v6srcp);
2368 			connp->conn_pkt_isv6 = B_FALSE;
2369 		} else if (IN6_IS_ADDR_V4MAPPED(v6srcp)) {
2370 			ip1dbg(("ip_bind_v6: "
2371 			    "src is mapped, but not the dst\n"));
2372 			goto bad_addr;
2373 		} else {
2374 			error = ip_bind_connected_v6(connp, mp, v6srcp,
2375 			    lport, v6dstp, ipp, fport, ire_requested,
2376 			    ipsec_policy_set, B_TRUE, verify_dst);
2377 			if (error != 0)
2378 				goto bad_addr;
2379 			connp->conn_pkt_isv6 = B_TRUE;
2380 		}
2381 		if (protocol == IPPROTO_TCP)
2382 			connp->conn_recv = tcp_input;
2383 	}
2384 	/* Update qinfo if v4/v6 changed */
2385 	if ((orig_pkt_isv6 != connp->conn_pkt_isv6) &&
2386 	    !(IPCL_IS_TCP(connp) || IPCL_IS_UDP(connp))) {
2387 		if (connp->conn_pkt_isv6)
2388 			ip_setqinfo(RD(q), IPV6_MINOR, B_TRUE);
2389 		else
2390 			ip_setqinfo(RD(q), IPV4_MINOR, B_TRUE);
2391 	}
2392 
2393 	/*
2394 	 * Pass the IPSEC headers size in ire_ipsec_overhead.
2395 	 * We can't do this in ip_bind_insert_ire because the policy
2396 	 * may not have been inherited at that point in time and hence
2397 	 * conn_out_enforce_policy may not be set.
2398 	 */
2399 	mp1 = mp->b_cont;
2400 	if (ire_requested && connp->conn_out_enforce_policy &&
2401 	    mp1 != NULL && DB_TYPE(mp1) == IRE_DB_REQ_TYPE) {
2402 		ire_t *ire = (ire_t *)mp1->b_rptr;
2403 		ASSERT(MBLKL(mp1) >= sizeof (ire_t));
2404 		ire->ire_ipsec_overhead = (conn_ipsec_length(connp));
2405 	}
2406 
2407 	/* Send it home. */
2408 	mp->b_datap->db_type = M_PCPROTO;
2409 	tbr->PRIM_type = T_BIND_ACK;
2410 	return (mp);
2411 
2412 bad_addr:
2413 	if (error == EINPROGRESS)
2414 		return (NULL);
2415 	if (error > 0)
2416 		mp = mi_tpi_err_ack_alloc(mp, TSYSERR, error);
2417 	else
2418 		mp = mi_tpi_err_ack_alloc(mp, TBADADDR, 0);
2419 	return (mp);
2420 }
2421 
2422 /*
2423  * Here address is verified to be a valid local address.
2424  * If the IRE_DB_REQ_TYPE mp is present, a multicast
2425  * address is also considered a valid local address.
2426  * In the case of a multicast address, however, the
2427  * upper protocol is expected to reset the src address
2428  * to 0 if it sees an ire with IN6_IS_ADDR_MULTICAST returned so that
2429  * no packets are emitted with multicast address as
2430  * source address.
2431  * The addresses valid for bind are:
2432  *	(1) - in6addr_any
2433  *	(2) - IP address of an UP interface
2434  *	(3) - IP address of a DOWN interface
2435  *	(4) - a multicast address. In this case
2436  *	the conn will only receive packets destined to
2437  *	the specified multicast address. Note: the
2438  *	application still has to issue an
2439  *	IPV6_JOIN_GROUP socket option.
2440  *
2441  * In all the above cases, the bound address must be valid in the current zone.
2442  * When the address is loopback or multicast, there might be many matching IREs
2443  * so bind has to look up based on the zone.
2444  */
2445 static int
2446 ip_bind_laddr_v6(conn_t *connp, mblk_t *mp, const in6_addr_t *v6src,
2447     uint16_t lport, boolean_t ire_requested, boolean_t ipsec_policy_set,
2448     boolean_t fanout_insert)
2449 {
2450 	int		error = 0;
2451 	ire_t		*src_ire = NULL;
2452 	ipif_t		*ipif = NULL;
2453 	mblk_t		*policy_mp;
2454 	zoneid_t	zoneid;
2455 
2456 	if (ipsec_policy_set)
2457 		policy_mp = mp->b_cont;
2458 
2459 	/*
2460 	 * If it was previously connected, conn_fully_bound would have
2461 	 * been set.
2462 	 */
2463 	connp->conn_fully_bound = B_FALSE;
2464 
2465 	zoneid = connp->conn_zoneid;
2466 
2467 	if (!IN6_IS_ADDR_UNSPECIFIED(v6src)) {
2468 		src_ire = ire_route_lookup_v6(v6src, 0, 0,
2469 		    0, NULL, NULL, zoneid, NULL, MATCH_IRE_ZONEONLY);
2470 		/*
2471 		 * If an address other than in6addr_any is requested,
2472 		 * we verify that it is a valid address for bind
2473 		 * Note: Following code is in if-else-if form for
2474 		 * readability compared to a condition check.
2475 		 */
2476 		ASSERT(src_ire == NULL || !(src_ire->ire_type & IRE_BROADCAST));
2477 		if (IRE_IS_LOCAL(src_ire)) {
2478 			/*
2479 			 * (2) Bind to address of local UP interface
2480 			 */
2481 			ipif = src_ire->ire_ipif;
2482 		} else if (IN6_IS_ADDR_MULTICAST(v6src)) {
2483 			ipif_t	*multi_ipif = NULL;
2484 			ire_t	*save_ire;
2485 			/*
2486 			 * (4) bind to multicast address.
2487 			 * Fake out the IRE returned to upper
2488 			 * layer to be a broadcast IRE in
2489 			 * ip_bind_insert_ire_v6().
2490 			 * Pass other information that matches
2491 			 * the ipif (e.g. the source address).
2492 			 * conn_multicast_ill is only used for
2493 			 * IPv6 packets
2494 			 */
2495 			mutex_enter(&connp->conn_lock);
2496 			if (connp->conn_multicast_ill != NULL) {
2497 				(void) ipif_lookup_zoneid(
2498 				    connp->conn_multicast_ill, zoneid, 0,
2499 				    &multi_ipif);
2500 			} else {
2501 				/*
2502 				 * Look for default like
2503 				 * ip_wput_v6
2504 				 */
2505 				multi_ipif = ipif_lookup_group_v6(
2506 				    &ipv6_unspecified_group, zoneid);
2507 			}
2508 			mutex_exit(&connp->conn_lock);
2509 			save_ire = src_ire;
2510 			src_ire = NULL;
2511 			if (multi_ipif == NULL || !ire_requested ||
2512 			    (src_ire = ipif_to_ire_v6(multi_ipif)) == NULL) {
2513 				src_ire = save_ire;
2514 				error = EADDRNOTAVAIL;
2515 			} else {
2516 				ASSERT(src_ire != NULL);
2517 				if (save_ire != NULL)
2518 					ire_refrele(save_ire);
2519 			}
2520 			if (multi_ipif != NULL)
2521 				ipif_refrele(multi_ipif);
2522 		} else {
2523 			*mp->b_wptr++ = (char)connp->conn_ulp;
2524 			ipif = ipif_lookup_addr_v6(v6src, NULL, zoneid,
2525 			    CONNP_TO_WQ(connp), mp, ip_wput_nondata, &error);
2526 			if (ipif == NULL) {
2527 				if (error == EINPROGRESS) {
2528 					if (src_ire != NULL)
2529 						ire_refrele(src_ire);
2530 					return (error);
2531 				}
2532 				/*
2533 				 * Not a valid address for bind
2534 				 */
2535 				error = EADDRNOTAVAIL;
2536 			} else {
2537 				ipif_refrele(ipif);
2538 			}
2539 			/*
2540 			 * Just to keep it consistent with the processing in
2541 			 * ip_bind_v6().
2542 			 */
2543 			mp->b_wptr--;
2544 		}
2545 
2546 		if (error != 0) {
2547 			/* Red Alert!  Attempting to be a bogon! */
2548 			if (ip_debug > 2) {
2549 				/* ip1dbg */
2550 				pr_addr_dbg("ip_bind_laddr_v6: bad src"
2551 				    " address %s\n", AF_INET6, v6src);
2552 			}
2553 			goto bad_addr;
2554 		}
2555 	}
2556 
2557 	/*
2558 	 * Allow setting new policies. For example, disconnects come
2559 	 * down as ipa_t bind. As we would have set conn_policy_cached
2560 	 * to B_TRUE before, we should set it to B_FALSE, so that policy
2561 	 * can change after the disconnect.
2562 	 */
2563 	connp->conn_policy_cached = B_FALSE;
2564 
2565 	/* If not fanout_insert this was just an address verification */
2566 	if (fanout_insert) {
2567 		/*
2568 		 * The addresses have been verified. Time to insert in
2569 		 * the correct fanout list.
2570 		 */
2571 		connp->conn_srcv6 = *v6src;
2572 		connp->conn_remv6 = ipv6_all_zeros;
2573 		connp->conn_lport = lport;
2574 		connp->conn_fport = 0;
2575 		error = ipcl_bind_insert_v6(connp, *mp->b_wptr, v6src, lport);
2576 	}
2577 	if (error == 0) {
2578 		if (ire_requested) {
2579 			if (!ip_bind_insert_ire_v6(mp, src_ire, v6src, NULL)) {
2580 				error = -1;
2581 				goto bad_addr;
2582 			}
2583 		} else if (ipsec_policy_set) {
2584 			if (!ip_bind_ipsec_policy_set(connp, policy_mp)) {
2585 				error = -1;
2586 				goto bad_addr;
2587 			}
2588 		}
2589 	}
2590 bad_addr:
2591 	if (error != 0) {
2592 		if (connp->conn_anon_port) {
2593 			(void) tsol_mlp_anon(crgetzone(connp->conn_cred),
2594 			    connp->conn_mlp_type, connp->conn_ulp, ntohs(lport),
2595 			    B_FALSE);
2596 		}
2597 		connp->conn_mlp_type = mlptSingle;
2598 	}
2599 
2600 	if (src_ire != NULL)
2601 		ire_refrele(src_ire);
2602 
2603 	if (ipsec_policy_set) {
2604 		ASSERT(policy_mp != NULL);
2605 		freeb(policy_mp);
2606 		/*
2607 		 * As of now assume that nothing else accompanies
2608 		 * IPSEC_POLICY_SET.
2609 		 */
2610 		mp->b_cont = NULL;
2611 	}
2612 	return (error);
2613 }
2614 
2615 /* ARGSUSED */
2616 static void
2617 ip_bind_connected_resume_v6(ipsq_t *ipsq, queue_t *q, mblk_t *mp,
2618     void *dummy_arg)
2619 {
2620 	conn_t	*connp = NULL;
2621 	t_scalar_t prim;
2622 
2623 	ASSERT(DB_TYPE(mp) == M_PROTO || DB_TYPE(mp) == M_PCPROTO);
2624 
2625 	if (CONN_Q(q))
2626 		connp = Q_TO_CONN(q);
2627 	ASSERT(connp != NULL);
2628 
2629 	prim = ((union T_primitives *)mp->b_rptr)->type;
2630 	ASSERT(prim == O_T_BIND_REQ || prim == T_BIND_REQ);
2631 
2632 	if (IPCL_IS_TCP(connp)) {
2633 		/* Pass sticky_ipp for scope_id and pktinfo */
2634 		mp = ip_bind_v6(q, mp, connp, &connp->conn_tcp->tcp_sticky_ipp);
2635 	} else {
2636 		/* For UDP and ICMP */
2637 		mp = ip_bind_v6(q, mp, connp, NULL);
2638 	}
2639 	if (mp != NULL) {
2640 		if (IPCL_IS_TCP(connp)) {
2641 			CONN_INC_REF(connp);
2642 			squeue_fill(connp->conn_sqp, mp, ip_resume_tcp_bind,
2643 			    connp, SQTAG_TCP_RPUTOTHER);
2644 		} else if (IPCL_IS_UDP(connp)) {
2645 			udp_resume_bind(connp, mp);
2646 		} else {
2647 			qreply(q, mp);
2648 			CONN_OPER_PENDING_DONE(connp);
2649 		}
2650 	}
2651 }
2652 
2653 /*
2654  * Verify that both the source and destination addresses
2655  * are valid.  If verify_dst, then destination address must also be reachable,
2656  * i.e. have a route.  Protocols like TCP want this.  Tunnels do not.
2657  * It takes ip6_pkt_t * as one of the arguments to determine correct
2658  * source address when IPV6_PKTINFO or scope_id is set along with a link-local
2659  * destination address. Note that parameter ipp is only useful for TCP connect
2660  * when scope_id is set or IPV6_PKTINFO option is set with an ifindex. For all
2661  * non-TCP cases, it is NULL and for all other tcp cases it is not useful.
2662  *
2663  */
2664 static int
2665 ip_bind_connected_v6(conn_t *connp, mblk_t *mp, in6_addr_t *v6src,
2666     uint16_t lport, const in6_addr_t *v6dst, ip6_pkt_t *ipp, uint16_t fport,
2667     boolean_t ire_requested, boolean_t ipsec_policy_set,
2668     boolean_t fanout_insert, boolean_t verify_dst)
2669 {
2670 	ire_t		*src_ire;
2671 	ire_t		*dst_ire;
2672 	int		error = 0;
2673 	int 		protocol;
2674 	mblk_t		*policy_mp;
2675 	ire_t		*sire = NULL;
2676 	ire_t		*md_dst_ire = NULL;
2677 	ill_t		*md_ill = NULL;
2678 	ill_t 		*dst_ill = NULL;
2679 	ipif_t		*src_ipif = NULL;
2680 	zoneid_t	zoneid;
2681 	boolean_t ill_held = B_FALSE;
2682 
2683 	src_ire = dst_ire = NULL;
2684 	/*
2685 	 * NOTE:  The protocol is beyond the wptr because that's how
2686 	 * the undocumented transport<-->IP T_BIND_REQ behavior works.
2687 	 */
2688 	protocol = *mp->b_wptr & 0xFF;
2689 
2690 	/*
2691 	 * If we never got a disconnect before, clear it now.
2692 	 */
2693 	connp->conn_fully_bound = B_FALSE;
2694 
2695 	if (ipsec_policy_set) {
2696 		policy_mp = mp->b_cont;
2697 	}
2698 
2699 	zoneid = connp->conn_zoneid;
2700 
2701 	if (IN6_IS_ADDR_MULTICAST(v6dst)) {
2702 		ipif_t *ipif;
2703 
2704 		/*
2705 		 * Use an "emulated" IRE_BROADCAST to tell the transport it
2706 		 * is a multicast.
2707 		 * Pass other information that matches
2708 		 * the ipif (e.g. the source address).
2709 		 *
2710 		 * conn_multicast_ill is only used for IPv6 packets
2711 		 */
2712 		mutex_enter(&connp->conn_lock);
2713 		if (connp->conn_multicast_ill != NULL) {
2714 			(void) ipif_lookup_zoneid(connp->conn_multicast_ill,
2715 			    zoneid, 0, &ipif);
2716 		} else {
2717 			/* Look for default like ip_wput_v6 */
2718 			ipif = ipif_lookup_group_v6(v6dst, zoneid);
2719 		}
2720 		mutex_exit(&connp->conn_lock);
2721 		if (ipif == NULL || !ire_requested ||
2722 		    (dst_ire = ipif_to_ire_v6(ipif)) == NULL) {
2723 			if (ipif != NULL)
2724 				ipif_refrele(ipif);
2725 			if (ip_debug > 2) {
2726 				/* ip1dbg */
2727 				pr_addr_dbg("ip_bind_connected_v6: bad "
2728 				    "connected multicast %s\n", AF_INET6,
2729 				    v6dst);
2730 			}
2731 			error = ENETUNREACH;
2732 			goto bad_addr;
2733 		}
2734 		if (ipif != NULL)
2735 			ipif_refrele(ipif);
2736 	} else {
2737 		dst_ire = ire_route_lookup_v6(v6dst, NULL, NULL, 0,
2738 		    NULL, &sire, zoneid, MBLK_GETLABEL(mp),
2739 		    MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT |
2740 		    MATCH_IRE_PARENT | MATCH_IRE_RJ_BHOLE | MATCH_IRE_SECATTR);
2741 		/*
2742 		 * We also prevent ire's with src address INADDR_ANY to
2743 		 * be used, which are created temporarily for
2744 		 * sending out packets from endpoints that have
2745 		 * conn_unspec_src set.
2746 		 */
2747 		if (dst_ire == NULL ||
2748 		    (dst_ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) ||
2749 		    IN6_IS_ADDR_UNSPECIFIED(&dst_ire->ire_src_addr_v6)) {
2750 			/*
2751 			 * When verifying destination reachability, we always
2752 			 * complain.
2753 			 *
2754 			 * When not verifying destination reachability but we
2755 			 * found an IRE, i.e. the destination is reachable,
2756 			 * then the other tests still apply and we complain.
2757 			 */
2758 			if (verify_dst || (dst_ire != NULL)) {
2759 				if (ip_debug > 2) {
2760 					/* ip1dbg */
2761 					pr_addr_dbg("ip_bind_connected_v6: bad"
2762 					    " connected dst %s\n", AF_INET6,
2763 					    v6dst);
2764 				}
2765 				if (dst_ire == NULL ||
2766 				    !(dst_ire->ire_type & IRE_HOST)) {
2767 					error = ENETUNREACH;
2768 				} else {
2769 					error = EHOSTUNREACH;
2770 				}
2771 				goto bad_addr;
2772 			}
2773 		}
2774 	}
2775 
2776 	/*
2777 	 * We now know that routing will allow us to reach the destination.
2778 	 * Check whether Trusted Solaris policy allows communication with this
2779 	 * host, and pretend that the destination is unreachable if not.
2780 	 *
2781 	 * This is never a problem for TCP, since that transport is known to
2782 	 * compute the label properly as part of the tcp_rput_other T_BIND_ACK
2783 	 * handling.  If the remote is unreachable, it will be detected at that
2784 	 * point, so there's no reason to check it here.
2785 	 *
2786 	 * Note that for sendto (and other datagram-oriented friends), this
2787 	 * check is done as part of the data path label computation instead.
2788 	 * The check here is just to make non-TCP connect() report the right
2789 	 * error.
2790 	 */
2791 	if (dst_ire != NULL && is_system_labeled() &&
2792 	    !IPCL_IS_TCP(connp) &&
2793 	    tsol_compute_label_v6(DB_CREDDEF(mp, connp->conn_cred), v6dst, NULL,
2794 	    connp->conn_mac_exempt) != 0) {
2795 		error = EHOSTUNREACH;
2796 		if (ip_debug > 2) {
2797 			pr_addr_dbg("ip_bind_connected: no label for dst %s\n",
2798 			    AF_INET6, v6dst);
2799 		}
2800 		goto bad_addr;
2801 	}
2802 
2803 	/*
2804 	 * If the app does a connect(), it means that it will most likely
2805 	 * send more than 1 packet to the destination.  It makes sense
2806 	 * to clear the temporary flag.
2807 	 */
2808 	if (dst_ire != NULL && dst_ire->ire_type == IRE_CACHE &&
2809 	    (dst_ire->ire_marks & IRE_MARK_TEMPORARY)) {
2810 		irb_t *irb = dst_ire->ire_bucket;
2811 
2812 		rw_enter(&irb->irb_lock, RW_WRITER);
2813 		dst_ire->ire_marks &= ~IRE_MARK_TEMPORARY;
2814 		irb->irb_tmp_ire_cnt--;
2815 		rw_exit(&irb->irb_lock);
2816 	}
2817 
2818 	ASSERT(dst_ire == NULL || dst_ire->ire_ipversion == IPV6_VERSION);
2819 
2820 	/*
2821 	 * See if we should notify ULP about MDT; we do this whether or not
2822 	 * ire_requested is TRUE, in order to handle active connects; MDT
2823 	 * eligibility tests for passive connects are handled separately
2824 	 * through tcp_adapt_ire().  We do this before the source address
2825 	 * selection, because dst_ire may change after a call to
2826 	 * ipif_select_source_v6().  This is a best-effort check, as the
2827 	 * packet for this connection may not actually go through
2828 	 * dst_ire->ire_stq, and the exact IRE can only be known after
2829 	 * calling ip_newroute_v6().  This is why we further check on the
2830 	 * IRE during Multidata packet transmission in tcp_multisend().
2831 	 */
2832 	if (ip_multidata_outbound && !ipsec_policy_set && dst_ire != NULL &&
2833 	    !(dst_ire->ire_type & (IRE_LOCAL | IRE_LOOPBACK | IRE_BROADCAST)) &&
2834 	    (md_ill = ire_to_ill(dst_ire), md_ill != NULL) &&
2835 	    ILL_MDT_CAPABLE(md_ill)) {
2836 		md_dst_ire = dst_ire;
2837 		IRE_REFHOLD(md_dst_ire);
2838 	}
2839 
2840 	if (dst_ire != NULL &&
2841 	    dst_ire->ire_type == IRE_LOCAL &&
2842 	    dst_ire->ire_zoneid != zoneid &&
2843 	    dst_ire->ire_zoneid != ALL_ZONES) {
2844 		src_ire = ire_ftable_lookup_v6(v6dst, 0, 0, 0, NULL, NULL,
2845 		    zoneid, 0, NULL,
2846 		    MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT |
2847 		    MATCH_IRE_RJ_BHOLE);
2848 		if (src_ire == NULL) {
2849 			error = EHOSTUNREACH;
2850 			goto bad_addr;
2851 		} else if (src_ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) {
2852 			if (!(src_ire->ire_type & IRE_HOST))
2853 				error = ENETUNREACH;
2854 			else
2855 				error = EHOSTUNREACH;
2856 			goto bad_addr;
2857 		}
2858 		if (IN6_IS_ADDR_UNSPECIFIED(v6src)) {
2859 			src_ipif = src_ire->ire_ipif;
2860 			ipif_refhold(src_ipif);
2861 			*v6src = src_ipif->ipif_v6lcl_addr;
2862 		}
2863 		ire_refrele(src_ire);
2864 		src_ire = NULL;
2865 	} else if (IN6_IS_ADDR_UNSPECIFIED(v6src) && dst_ire != NULL) {
2866 		if ((sire != NULL) && (sire->ire_flags & RTF_SETSRC)) {
2867 			*v6src = sire->ire_src_addr_v6;
2868 			ire_refrele(dst_ire);
2869 			dst_ire = sire;
2870 			sire = NULL;
2871 		} else if (dst_ire->ire_type == IRE_CACHE &&
2872 		    (dst_ire->ire_flags & RTF_SETSRC)) {
2873 			ASSERT(dst_ire->ire_zoneid == zoneid ||
2874 			    dst_ire->ire_zoneid == ALL_ZONES);
2875 			*v6src = dst_ire->ire_src_addr_v6;
2876 		} else {
2877 			/*
2878 			 * Pick a source address so that a proper inbound load
2879 			 * spreading would happen. Use dst_ill specified by the
2880 			 * app. when socket option or scopeid is set.
2881 			 */
2882 			int  err;
2883 
2884 			if (ipp != NULL && ipp->ipp_ifindex != 0) {
2885 				uint_t	if_index;
2886 
2887 				/*
2888 				 * Scope id or IPV6_PKTINFO
2889 				 */
2890 
2891 				if_index = ipp->ipp_ifindex;
2892 				dst_ill = ill_lookup_on_ifindex(
2893 				    if_index, B_TRUE, NULL, NULL, NULL, NULL);
2894 				if (dst_ill == NULL) {
2895 					ip1dbg(("ip_bind_connected_v6:"
2896 					    " bad ifindex %d\n", if_index));
2897 					error = EADDRNOTAVAIL;
2898 					goto bad_addr;
2899 				}
2900 				ill_held = B_TRUE;
2901 			} else if (connp->conn_outgoing_ill != NULL) {
2902 				/*
2903 				 * For IPV6_BOUND_IF socket option,
2904 				 * conn_outgoing_ill should be set
2905 				 * already in TCP or UDP/ICMP.
2906 				 */
2907 				dst_ill = conn_get_held_ill(connp,
2908 				    &connp->conn_outgoing_ill, &err);
2909 				if (err == ILL_LOOKUP_FAILED) {
2910 					ip1dbg(("ip_bind_connected_v6:"
2911 					    "no ill for bound_if\n"));
2912 					error = EADDRNOTAVAIL;
2913 					goto bad_addr;
2914 				}
2915 				ill_held = B_TRUE;
2916 			} else if (dst_ire->ire_stq != NULL) {
2917 				/* No need to hold ill here */
2918 				dst_ill = (ill_t *)dst_ire->ire_stq->q_ptr;
2919 			} else {
2920 				/* No need to hold ill here */
2921 				dst_ill = dst_ire->ire_ipif->ipif_ill;
2922 			}
2923 			if (!ip6_asp_can_lookup()) {
2924 				*mp->b_wptr++ = (char)protocol;
2925 				ip6_asp_pending_op(CONNP_TO_WQ(connp), mp,
2926 				    ip_bind_connected_resume_v6);
2927 				error = EINPROGRESS;
2928 				goto refrele_and_quit;
2929 			}
2930 			src_ipif = ipif_select_source_v6(dst_ill, v6dst,
2931 			    RESTRICT_TO_NONE, connp->conn_src_preferences,
2932 			    zoneid);
2933 			ip6_asp_table_refrele();
2934 			if (src_ipif == NULL) {
2935 				pr_addr_dbg("ip_bind_connected_v6: "
2936 				    "no usable source address for "
2937 				    "connection to %s\n", AF_INET6, v6dst);
2938 				error = EADDRNOTAVAIL;
2939 				goto bad_addr;
2940 			}
2941 			*v6src = src_ipif->ipif_v6lcl_addr;
2942 		}
2943 	}
2944 
2945 	/*
2946 	 * We do ire_route_lookup_v6() here (and not an interface lookup)
2947 	 * as we assert that v6src should only come from an
2948 	 * UP interface for hard binding.
2949 	 */
2950 	src_ire = ire_route_lookup_v6(v6src, 0, 0, 0, NULL,
2951 	    NULL, zoneid, NULL, MATCH_IRE_ZONEONLY);
2952 
2953 	/* src_ire must be a local|loopback */
2954 	if (!IRE_IS_LOCAL(src_ire)) {
2955 		if (ip_debug > 2) {
2956 			/* ip1dbg */
2957 			pr_addr_dbg("ip_bind_connected_v6: bad "
2958 			    "connected src %s\n", AF_INET6, v6src);
2959 		}
2960 		error = EADDRNOTAVAIL;
2961 		goto bad_addr;
2962 	}
2963 
2964 	/*
2965 	 * If the source address is a loopback address, the
2966 	 * destination had best be local or multicast.
2967 	 * The transports that can't handle multicast will reject
2968 	 * those addresses.
2969 	 */
2970 	if (src_ire->ire_type == IRE_LOOPBACK &&
2971 	    !(IRE_IS_LOCAL(dst_ire) || IN6_IS_ADDR_MULTICAST(v6dst) ||
2972 	    IN6_IS_ADDR_V4MAPPED_CLASSD(v6dst))) {
2973 		ip1dbg(("ip_bind_connected_v6: bad connected loopback\n"));
2974 		error = -1;
2975 		goto bad_addr;
2976 	}
2977 	/*
2978 	 * Allow setting new policies. For example, disconnects come
2979 	 * down as ipa_t bind. As we would have set conn_policy_cached
2980 	 * to B_TRUE before, we should set it to B_FALSE, so that policy
2981 	 * can change after the disconnect.
2982 	 */
2983 	connp->conn_policy_cached = B_FALSE;
2984 
2985 	/*
2986 	 * The addresses have been verified. Initialize the conn
2987 	 * before calling the policy as they expect the conns
2988 	 * initialized.
2989 	 */
2990 	connp->conn_srcv6 = *v6src;
2991 	connp->conn_remv6 = *v6dst;
2992 	connp->conn_lport = lport;
2993 	connp->conn_fport = fport;
2994 
2995 	ASSERT(!(ipsec_policy_set && ire_requested));
2996 	if (ire_requested) {
2997 		iulp_t *ulp_info = NULL;
2998 
2999 		/*
3000 		 * Note that sire will not be NULL if this is an off-link
3001 		 * connection and there is not cache for that dest yet.
3002 		 *
3003 		 * XXX Because of an existing bug, if there are multiple
3004 		 * default routes, the IRE returned now may not be the actual
3005 		 * default route used (default routes are chosen in a
3006 		 * round robin fashion).  So if the metrics for different
3007 		 * default routes are different, we may return the wrong
3008 		 * metrics.  This will not be a problem if the existing
3009 		 * bug is fixed.
3010 		 */
3011 		if (sire != NULL)
3012 			ulp_info = &(sire->ire_uinfo);
3013 
3014 		if (!ip_bind_insert_ire_v6(mp, dst_ire, v6dst, ulp_info)) {
3015 			error = -1;
3016 			goto bad_addr;
3017 		}
3018 	} else if (ipsec_policy_set) {
3019 		if (!ip_bind_ipsec_policy_set(connp, policy_mp)) {
3020 			error = -1;
3021 			goto bad_addr;
3022 		}
3023 	}
3024 
3025 	/*
3026 	 * Cache IPsec policy in this conn.  If we have per-socket policy,
3027 	 * we'll cache that.  If we don't, we'll inherit global policy.
3028 	 *
3029 	 * We can't insert until the conn reflects the policy. Note that
3030 	 * conn_policy_cached is set by ipsec_conn_cache_policy() even for
3031 	 * connections where we don't have a policy. This is to prevent
3032 	 * global policy lookups in the inbound path.
3033 	 *
3034 	 * If we insert before we set conn_policy_cached,
3035 	 * CONN_INBOUND_POLICY_PRESENT_V6() check can still evaluate true
3036 	 * because global policy cound be non-empty. We normally call
3037 	 * ipsec_check_policy() for conn_policy_cached connections only if
3038 	 * conn_in_enforce_policy is set. But in this case,
3039 	 * conn_policy_cached can get set anytime since we made the
3040 	 * CONN_INBOUND_POLICY_PRESENT_V6() check and ipsec_check_policy()
3041 	 * is called, which will make the above assumption false.  Thus, we
3042 	 * need to insert after we set conn_policy_cached.
3043 	 */
3044 	if ((error = ipsec_conn_cache_policy(connp, B_FALSE)) != 0)
3045 		goto bad_addr;
3046 
3047 	/* If not fanout_insert this was just an address verification */
3048 	if (fanout_insert) {
3049 		/*
3050 		 * The addresses have been verified. Time to insert in
3051 		 * the correct fanout list.
3052 		 */
3053 		error = ipcl_conn_insert_v6(connp, protocol, v6src, v6dst,
3054 		    connp->conn_ports,
3055 		    IPCL_IS_TCP(connp) ? connp->conn_tcp->tcp_bound_if : 0);
3056 	}
3057 	if (error == 0) {
3058 		connp->conn_fully_bound = B_TRUE;
3059 		/*
3060 		 * Our initial checks for MDT have passed; the IRE is not
3061 		 * LOCAL/LOOPBACK/BROADCAST, and the link layer seems to
3062 		 * be supporting MDT.  Pass the IRE, IPC and ILL into
3063 		 * ip_mdinfo_return(), which performs further checks
3064 		 * against them and upon success, returns the MDT info
3065 		 * mblk which we will attach to the bind acknowledgment.
3066 		 */
3067 		if (md_dst_ire != NULL) {
3068 			mblk_t *mdinfo_mp;
3069 
3070 			ASSERT(md_ill != NULL);
3071 			ASSERT(md_ill->ill_mdt_capab != NULL);
3072 			if ((mdinfo_mp = ip_mdinfo_return(md_dst_ire, connp,
3073 			    md_ill->ill_name, md_ill->ill_mdt_capab)) != NULL)
3074 				linkb(mp, mdinfo_mp);
3075 		}
3076 	}
3077 bad_addr:
3078 	if (ipsec_policy_set) {
3079 		ASSERT(policy_mp != NULL);
3080 		freeb(policy_mp);
3081 		/*
3082 		 * As of now assume that nothing else accompanies
3083 		 * IPSEC_POLICY_SET.
3084 		 */
3085 		mp->b_cont = NULL;
3086 	}
3087 refrele_and_quit:
3088 	if (src_ire != NULL)
3089 		IRE_REFRELE(src_ire);
3090 	if (dst_ire != NULL)
3091 		IRE_REFRELE(dst_ire);
3092 	if (sire != NULL)
3093 		IRE_REFRELE(sire);
3094 	if (src_ipif != NULL)
3095 		ipif_refrele(src_ipif);
3096 	if (md_dst_ire != NULL)
3097 		IRE_REFRELE(md_dst_ire);
3098 	if (ill_held && dst_ill != NULL)
3099 		ill_refrele(dst_ill);
3100 	return (error);
3101 }
3102 
3103 /*
3104  * Insert the ire in b_cont. Returns false if it fails (due to lack of space).
3105  * Makes the IRE be IRE_BROADCAST if dst is a multicast address.
3106  */
3107 static boolean_t
3108 ip_bind_insert_ire_v6(mblk_t *mp, ire_t *ire, const in6_addr_t *dst,
3109     iulp_t *ulp_info)
3110 {
3111 	mblk_t	*mp1;
3112 	ire_t	*ret_ire;
3113 
3114 	mp1 = mp->b_cont;
3115 	ASSERT(mp1 != NULL);
3116 
3117 	if (ire != NULL) {
3118 		/*
3119 		 * mp1 initialized above to IRE_DB_REQ_TYPE
3120 		 * appended mblk. Its <upper protocol>'s
3121 		 * job to make sure there is room.
3122 		 */
3123 		if ((mp1->b_datap->db_lim - mp1->b_rptr) < sizeof (ire_t))
3124 			return (B_FALSE);
3125 
3126 		mp1->b_datap->db_type = IRE_DB_TYPE;
3127 		mp1->b_wptr = mp1->b_rptr + sizeof (ire_t);
3128 		bcopy(ire, mp1->b_rptr, sizeof (ire_t));
3129 		ret_ire = (ire_t *)mp1->b_rptr;
3130 		if (IN6_IS_ADDR_MULTICAST(dst) ||
3131 		    IN6_IS_ADDR_V4MAPPED_CLASSD(dst)) {
3132 			ret_ire->ire_type = IRE_BROADCAST;
3133 			ret_ire->ire_addr_v6 = *dst;
3134 		}
3135 		if (ulp_info != NULL) {
3136 			bcopy(ulp_info, &(ret_ire->ire_uinfo),
3137 			    sizeof (iulp_t));
3138 		}
3139 		ret_ire->ire_mp = mp1;
3140 	} else {
3141 		/*
3142 		 * No IRE was found. Remove IRE mblk.
3143 		 */
3144 		mp->b_cont = mp1->b_cont;
3145 		freeb(mp1);
3146 	}
3147 	return (B_TRUE);
3148 }
3149 
3150 /*
3151  * Add an ip6i_t header to the front of the mblk.
3152  * Inline if possible else allocate a separate mblk containing only the ip6i_t.
3153  * Returns NULL if allocation fails (and frees original message).
3154  * Used in outgoing path when going through ip_newroute_*v6().
3155  * Used in incoming path to pass ifindex to transports.
3156  */
3157 mblk_t *
3158 ip_add_info_v6(mblk_t *mp, ill_t *ill, const in6_addr_t *dst)
3159 {
3160 	mblk_t *mp1;
3161 	ip6i_t *ip6i;
3162 	ip6_t *ip6h;
3163 
3164 	ip6h = (ip6_t *)mp->b_rptr;
3165 	ip6i = (ip6i_t *)(mp->b_rptr - sizeof (ip6i_t));
3166 	if ((uchar_t *)ip6i < mp->b_datap->db_base ||
3167 	    mp->b_datap->db_ref > 1) {
3168 		mp1 = allocb(sizeof (ip6i_t), BPRI_MED);
3169 		if (mp1 == NULL) {
3170 			freemsg(mp);
3171 			return (NULL);
3172 		}
3173 		mp1->b_wptr = mp1->b_rptr = mp1->b_datap->db_lim;
3174 		mp1->b_cont = mp;
3175 		mp = mp1;
3176 		ip6i = (ip6i_t *)(mp->b_rptr - sizeof (ip6i_t));
3177 	}
3178 	mp->b_rptr = (uchar_t *)ip6i;
3179 	ip6i->ip6i_vcf = ip6h->ip6_vcf;
3180 	ip6i->ip6i_nxt = IPPROTO_RAW;
3181 	if (ill != NULL) {
3182 		ip6i->ip6i_flags = IP6I_IFINDEX;
3183 		ip6i->ip6i_ifindex = ill->ill_phyint->phyint_ifindex;
3184 	} else {
3185 		ip6i->ip6i_flags = 0;
3186 	}
3187 	ip6i->ip6i_nexthop = *dst;
3188 	return (mp);
3189 }
3190 
3191 /*
3192  * Handle protocols with which IP is less intimate.  There
3193  * can be more than one stream bound to a particular
3194  * protocol.  When this is the case, normally each one gets a copy
3195  * of any incoming packets.
3196  * However, if the packet was tunneled and not multicast we only send to it
3197  * the first match.
3198  *
3199  * Zones notes:
3200  * Packets will be distributed to streams in all zones. This is really only
3201  * useful for ICMPv6 as only applications in the global zone can create raw
3202  * sockets for other protocols.
3203  */
3204 static void
3205 ip_fanout_proto_v6(queue_t *q, mblk_t *mp, ip6_t *ip6h, ill_t *ill,
3206     ill_t *inill, uint8_t nexthdr, uint_t nexthdr_offset, uint_t flags,
3207     boolean_t mctl_present, zoneid_t zoneid)
3208 {
3209 	queue_t	*rq;
3210 	mblk_t	*mp1, *first_mp1;
3211 	in6_addr_t dst = ip6h->ip6_dst;
3212 	in6_addr_t src = ip6h->ip6_src;
3213 	boolean_t one_only;
3214 	mblk_t *first_mp = mp;
3215 	boolean_t secure, shared_addr;
3216 	conn_t	*connp, *first_connp, *next_connp;
3217 	connf_t *connfp;
3218 
3219 	if (mctl_present) {
3220 		mp = first_mp->b_cont;
3221 		secure = ipsec_in_is_secure(first_mp);
3222 		ASSERT(mp != NULL);
3223 	} else {
3224 		secure = B_FALSE;
3225 	}
3226 
3227 	/*
3228 	 * If the packet was tunneled and not multicast we only send to it
3229 	 * the first match.
3230 	 */
3231 	one_only = ((nexthdr == IPPROTO_ENCAP || nexthdr == IPPROTO_IPV6) &&
3232 	    !IN6_IS_ADDR_MULTICAST(&dst));
3233 
3234 	shared_addr = (zoneid == ALL_ZONES);
3235 	if (shared_addr) {
3236 		/*
3237 		 * We don't allow multilevel ports for raw IP, so no need to
3238 		 * check for that here.
3239 		 */
3240 		zoneid = tsol_packet_to_zoneid(mp);
3241 	}
3242 
3243 	connfp = &ipcl_proto_fanout_v6[nexthdr];
3244 	mutex_enter(&connfp->connf_lock);
3245 	connp = connfp->connf_head;
3246 	for (connp = connfp->connf_head; connp != NULL;
3247 		connp = connp->conn_next) {
3248 		if (IPCL_PROTO_MATCH_V6(connp, nexthdr, ip6h, ill, flags,
3249 		    zoneid) &&
3250 		    (!is_system_labeled() ||
3251 		    tsol_receive_local(mp, &dst, IPV6_VERSION, shared_addr,
3252 		    connp)))
3253 			break;
3254 	}
3255 
3256 	if (connp == NULL || connp->conn_upq == NULL) {
3257 		/*
3258 		 * No one bound to this port.  Is
3259 		 * there a client that wants all
3260 		 * unclaimed datagrams?
3261 		 */
3262 		mutex_exit(&connfp->connf_lock);
3263 		if (ip_fanout_send_icmp_v6(q, first_mp, flags,
3264 		    ICMP6_PARAM_PROB, ICMP6_PARAMPROB_NEXTHEADER,
3265 		    nexthdr_offset, mctl_present, zoneid)) {
3266 			BUMP_MIB(ill->ill_ip6_mib, ipv6InUnknownProtos);
3267 		}
3268 
3269 		return;
3270 	}
3271 
3272 	CONN_INC_REF(connp);
3273 	first_connp = connp;
3274 
3275 	/*
3276 	 * XXX: Fix the multiple protocol listeners case. We should not
3277 	 * be walking the conn->next list here.
3278 	 */
3279 	if (one_only) {
3280 		/*
3281 		 * Only send message to one tunnel driver by immediately
3282 		 * terminating the loop.
3283 		 */
3284 		connp = NULL;
3285 	} else {
3286 		connp = connp->conn_next;
3287 
3288 	}
3289 	for (;;) {
3290 		while (connp != NULL) {
3291 			if (IPCL_PROTO_MATCH_V6(connp, nexthdr, ip6h, ill,
3292 			    flags, zoneid) &&
3293 			    (!is_system_labeled() ||
3294 			    tsol_receive_local(mp, &dst, IPV6_VERSION,
3295 			    shared_addr, connp)))
3296 				break;
3297 			connp = connp->conn_next;
3298 		}
3299 
3300 		/*
3301 		 * Just copy the data part alone. The mctl part is
3302 		 * needed just for verifying policy and it is never
3303 		 * sent up.
3304 		 */
3305 		if (connp == NULL || connp->conn_upq == NULL ||
3306 		    (((first_mp1 = dupmsg(first_mp)) == NULL) &&
3307 		    ((first_mp1 = ip_copymsg(first_mp)) == NULL))) {
3308 			/*
3309 			 * No more intested clients or memory
3310 			 * allocation failed
3311 			 */
3312 			connp = first_connp;
3313 			break;
3314 		}
3315 		mp1 = mctl_present ? first_mp1->b_cont : first_mp1;
3316 		CONN_INC_REF(connp);
3317 		mutex_exit(&connfp->connf_lock);
3318 		rq = connp->conn_rq;
3319 		/*
3320 		 * For link-local always add ifindex so that transport can set
3321 		 * sin6_scope_id. Avoid it for ICMP error fanout.
3322 		 */
3323 		if ((connp->conn_ipv6_recvpktinfo ||
3324 		    IN6_IS_ADDR_LINKLOCAL(&src)) &&
3325 		    (flags & IP_FF_IP6INFO)) {
3326 			/* Add header */
3327 			mp1 = ip_add_info_v6(mp1, inill, &dst);
3328 		}
3329 		if (mp1 == NULL) {
3330 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
3331 		} else if (!canputnext(rq)) {
3332 			if (flags & IP_FF_RAWIP) {
3333 				BUMP_MIB(ill->ill_ip6_mib, rawipInOverflows);
3334 			} else {
3335 				BUMP_MIB(ill->ill_icmp6_mib,
3336 				    ipv6IfIcmpInOverflows);
3337 			}
3338 
3339 			freemsg(mp1);
3340 		} else {
3341 			if (CONN_INBOUND_POLICY_PRESENT_V6(connp) || secure) {
3342 				first_mp1 = ipsec_check_inbound_policy
3343 				    (first_mp1, connp, NULL, ip6h,
3344 				    mctl_present);
3345 			}
3346 			if (first_mp1 != NULL) {
3347 				if (mctl_present)
3348 					freeb(first_mp1);
3349 				BUMP_MIB(ill->ill_ip6_mib, ipv6InDelivers);
3350 				putnext(rq, mp1);
3351 			}
3352 		}
3353 		mutex_enter(&connfp->connf_lock);
3354 		/* Follow the next pointer before releasing the conn. */
3355 		next_connp = connp->conn_next;
3356 		CONN_DEC_REF(connp);
3357 		connp = next_connp;
3358 	}
3359 
3360 	/* Last one.  Send it upstream. */
3361 	mutex_exit(&connfp->connf_lock);
3362 
3363 	/* Initiate IPPF processing */
3364 	if (IP6_IN_IPP(flags)) {
3365 		uint_t ifindex;
3366 
3367 		mutex_enter(&ill->ill_lock);
3368 		ifindex = ill->ill_phyint->phyint_ifindex;
3369 		mutex_exit(&ill->ill_lock);
3370 		ip_process(IPP_LOCAL_IN, &mp, ifindex);
3371 		if (mp == NULL) {
3372 			CONN_DEC_REF(connp);
3373 			if (mctl_present)
3374 				freeb(first_mp);
3375 			return;
3376 		}
3377 	}
3378 
3379 	/*
3380 	 * For link-local always add ifindex so that transport can set
3381 	 * sin6_scope_id. Avoid it for ICMP error fanout.
3382 	 */
3383 	if ((connp->conn_ipv6_recvpktinfo || IN6_IS_ADDR_LINKLOCAL(&src)) &&
3384 	    (flags & IP_FF_IP6INFO)) {
3385 		/* Add header */
3386 		mp = ip_add_info_v6(mp, inill, &dst);
3387 		if (mp == NULL) {
3388 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
3389 			CONN_DEC_REF(connp);
3390 			if (mctl_present)
3391 				freeb(first_mp);
3392 			return;
3393 		} else if (mctl_present) {
3394 			first_mp->b_cont = mp;
3395 		} else {
3396 			first_mp = mp;
3397 		}
3398 	}
3399 
3400 	rq = connp->conn_rq;
3401 	if (!canputnext(rq)) {
3402 		if (flags & IP_FF_RAWIP) {
3403 			BUMP_MIB(ill->ill_ip6_mib, rawipInOverflows);
3404 		} else {
3405 			BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInOverflows);
3406 		}
3407 
3408 		freemsg(first_mp);
3409 	} else {
3410 		if (CONN_INBOUND_POLICY_PRESENT_V6(connp) || secure) {
3411 			first_mp = ipsec_check_inbound_policy(first_mp, connp,
3412 			    NULL, ip6h, mctl_present);
3413 			if (first_mp == NULL) {
3414 				CONN_DEC_REF(connp);
3415 				return;
3416 			}
3417 		}
3418 		BUMP_MIB(ill->ill_ip6_mib, ipv6InDelivers);
3419 		putnext(rq, mp);
3420 		if (mctl_present)
3421 			freeb(first_mp);
3422 	}
3423 	CONN_DEC_REF(connp);
3424 }
3425 
3426 /*
3427  * Send an ICMP error after patching up the packet appropriately.  Returns
3428  * non-zero if the appropriate MIB should be bumped; zero otherwise.
3429  */
3430 int
3431 ip_fanout_send_icmp_v6(queue_t *q, mblk_t *mp, uint_t flags,
3432     uint_t icmp_type, uint8_t icmp_code, uint_t nexthdr_offset,
3433     boolean_t mctl_present, zoneid_t zoneid)
3434 {
3435 	ip6_t *ip6h;
3436 	mblk_t *first_mp;
3437 	boolean_t secure;
3438 	unsigned char db_type;
3439 
3440 	first_mp = mp;
3441 	if (mctl_present) {
3442 		mp = mp->b_cont;
3443 		secure = ipsec_in_is_secure(first_mp);
3444 		ASSERT(mp != NULL);
3445 	} else {
3446 		/*
3447 		 * If this is an ICMP error being reported - which goes
3448 		 * up as M_CTLs, we need to convert them to M_DATA till
3449 		 * we finish checking with global policy because
3450 		 * ipsec_check_global_policy() assumes M_DATA as clear
3451 		 * and M_CTL as secure.
3452 		 */
3453 		db_type = mp->b_datap->db_type;
3454 		mp->b_datap->db_type = M_DATA;
3455 		secure = B_FALSE;
3456 	}
3457 	/*
3458 	 * We are generating an icmp error for some inbound packet.
3459 	 * Called from all ip_fanout_(udp, tcp, proto) functions.
3460 	 * Before we generate an error, check with global policy
3461 	 * to see whether this is allowed to enter the system. As
3462 	 * there is no "conn", we are checking with global policy.
3463 	 */
3464 	ip6h = (ip6_t *)mp->b_rptr;
3465 	if (secure || ipsec_inbound_v6_policy_present) {
3466 		first_mp = ipsec_check_global_policy(first_mp, NULL,
3467 		    NULL, ip6h, mctl_present);
3468 		if (first_mp == NULL)
3469 			return (0);
3470 	}
3471 
3472 	if (!mctl_present)
3473 		mp->b_datap->db_type = db_type;
3474 
3475 	if (flags & IP_FF_SEND_ICMP) {
3476 		if (flags & IP_FF_HDR_COMPLETE) {
3477 			if (ip_hdr_complete_v6(ip6h, zoneid)) {
3478 				freemsg(first_mp);
3479 				return (1);
3480 			}
3481 		}
3482 		switch (icmp_type) {
3483 		case ICMP6_DST_UNREACH:
3484 			icmp_unreachable_v6(WR(q), first_mp, icmp_code,
3485 			    B_FALSE, B_FALSE);
3486 			break;
3487 		case ICMP6_PARAM_PROB:
3488 			icmp_param_problem_v6(WR(q), first_mp, icmp_code,
3489 			    nexthdr_offset, B_FALSE, B_FALSE);
3490 			break;
3491 		default:
3492 #ifdef DEBUG
3493 			panic("ip_fanout_send_icmp_v6: wrong type");
3494 			/*NOTREACHED*/
3495 #else
3496 			freemsg(first_mp);
3497 			break;
3498 #endif
3499 		}
3500 	} else {
3501 		freemsg(first_mp);
3502 		return (0);
3503 	}
3504 
3505 	return (1);
3506 }
3507 
3508 
3509 /*
3510  * Fanout for TCP packets
3511  * The caller puts <fport, lport> in the ports parameter.
3512  */
3513 static void
3514 ip_fanout_tcp_v6(queue_t *q, mblk_t *mp, ip6_t *ip6h, ill_t *ill, ill_t *inill,
3515     uint_t flags, uint_t hdr_len, boolean_t mctl_present, zoneid_t zoneid)
3516 {
3517 	mblk_t  	*first_mp;
3518 	boolean_t 	secure;
3519 	conn_t		*connp;
3520 	tcph_t		*tcph;
3521 	boolean_t	syn_present = B_FALSE;
3522 
3523 	first_mp = mp;
3524 	if (mctl_present) {
3525 		mp = first_mp->b_cont;
3526 		secure = ipsec_in_is_secure(first_mp);
3527 		ASSERT(mp != NULL);
3528 	} else {
3529 		secure = B_FALSE;
3530 	}
3531 
3532 	connp = ipcl_classify_v6(mp, IPPROTO_TCP, hdr_len, zoneid);
3533 
3534 	if (connp == NULL ||
3535 	    !conn_wantpacket_v6(connp, ill, ip6h, flags, zoneid)) {
3536 		/*
3537 		 * No hard-bound match. Send Reset.
3538 		 */
3539 		dblk_t *dp = mp->b_datap;
3540 		uint32_t ill_index;
3541 
3542 		ASSERT((dp->db_struioflag & STRUIO_IP) == 0);
3543 
3544 		/* Initiate IPPf processing, if needed. */
3545 		if (IPP_ENABLED(IPP_LOCAL_IN) && (flags & IP6_NO_IPPOLICY)) {
3546 			ill_index = ill->ill_phyint->phyint_ifindex;
3547 			ip_process(IPP_LOCAL_IN, &first_mp, ill_index);
3548 			if (first_mp == NULL) {
3549 				if (connp != NULL)
3550 					CONN_DEC_REF(connp);
3551 				return;
3552 			}
3553 		}
3554 		BUMP_MIB(ill->ill_ip6_mib, ipv6InDelivers);
3555 		tcp_xmit_listeners_reset(first_mp, hdr_len);
3556 		if (connp != NULL)
3557 			CONN_DEC_REF(connp);
3558 		return;
3559 	}
3560 
3561 	tcph = (tcph_t *)&mp->b_rptr[hdr_len];
3562 	if ((tcph->th_flags[0] & (TH_SYN|TH_ACK|TH_RST|TH_URG)) == TH_SYN) {
3563 		if (connp->conn_flags & IPCL_TCP) {
3564 			squeue_t *sqp;
3565 
3566 			/*
3567 			 * For fused tcp loopback, assign the eager's
3568 			 * squeue to be that of the active connect's.
3569 			 */
3570 			if ((flags & IP_FF_LOOPBACK) && do_tcp_fusion &&
3571 			    !CONN_INBOUND_POLICY_PRESENT_V6(connp) && !secure &&
3572 			    !IP6_IN_IPP(flags)) {
3573 				ASSERT(Q_TO_CONN(q) != NULL);
3574 				sqp = Q_TO_CONN(q)->conn_sqp;
3575 			} else {
3576 				sqp = IP_SQUEUE_GET(lbolt);
3577 			}
3578 
3579 			mp->b_datap->db_struioflag |= STRUIO_EAGER;
3580 			DB_CKSUMSTART(mp) = (intptr_t)sqp;
3581 
3582 			/*
3583 			 * db_cksumstuff is unused in the incoming
3584 			 * path; Thus store the ifindex here. It will
3585 			 * be cleared in tcp_conn_create_v6().
3586 			 */
3587 			DB_CKSUMSTUFF(mp) =
3588 			    (intptr_t)ill->ill_phyint->phyint_ifindex;
3589 			syn_present = B_TRUE;
3590 		}
3591 	}
3592 
3593 	if (IPCL_IS_TCP(connp) && IPCL_IS_BOUND(connp) && !syn_present) {
3594 		uint_t	flags = (unsigned int)tcph->th_flags[0] & 0xFF;
3595 		if ((flags & TH_RST) || (flags & TH_URG)) {
3596 			CONN_DEC_REF(connp);
3597 			freemsg(first_mp);
3598 			return;
3599 		}
3600 		if (flags & TH_ACK) {
3601 			tcp_xmit_listeners_reset(first_mp, hdr_len);
3602 			CONN_DEC_REF(connp);
3603 			return;
3604 		}
3605 
3606 		CONN_DEC_REF(connp);
3607 		freemsg(first_mp);
3608 		return;
3609 	}
3610 
3611 	if (CONN_INBOUND_POLICY_PRESENT_V6(connp) || secure) {
3612 		first_mp = ipsec_check_inbound_policy(first_mp, connp,
3613 		    NULL, ip6h, mctl_present);
3614 		if (first_mp == NULL) {
3615 			CONN_DEC_REF(connp);
3616 			return;
3617 		}
3618 		if (IPCL_IS_TCP(connp) && IPCL_IS_BOUND(connp)) {
3619 			ASSERT(syn_present);
3620 			if (mctl_present) {
3621 				ASSERT(first_mp != mp);
3622 				first_mp->b_datap->db_struioflag |=
3623 				    STRUIO_POLICY;
3624 			} else {
3625 				ASSERT(first_mp == mp);
3626 				mp->b_datap->db_struioflag &=
3627 				    ~STRUIO_EAGER;
3628 				mp->b_datap->db_struioflag |=
3629 				    STRUIO_POLICY;
3630 			}
3631 		} else {
3632 			/*
3633 			 * Discard first_mp early since we're dealing with a
3634 			 * fully-connected conn_t and tcp doesn't do policy in
3635 			 * this case. Also, if someone is bound to IPPROTO_TCP
3636 			 * over raw IP, they don't expect to see a M_CTL.
3637 			 */
3638 			if (mctl_present) {
3639 				freeb(first_mp);
3640 				mctl_present = B_FALSE;
3641 			}
3642 			first_mp = mp;
3643 		}
3644 	}
3645 
3646 	/* Initiate IPPF processing */
3647 	if (IP6_IN_IPP(flags)) {
3648 		uint_t	ifindex;
3649 
3650 		mutex_enter(&ill->ill_lock);
3651 		ifindex = ill->ill_phyint->phyint_ifindex;
3652 		mutex_exit(&ill->ill_lock);
3653 		ip_process(IPP_LOCAL_IN, &mp, ifindex);
3654 		if (mp == NULL) {
3655 			CONN_DEC_REF(connp);
3656 			if (mctl_present) {
3657 				freeb(first_mp);
3658 			}
3659 			return;
3660 		} else if (mctl_present) {
3661 			/*
3662 			 * ip_add_info_v6 might return a new mp.
3663 			 */
3664 			ASSERT(first_mp != mp);
3665 			first_mp->b_cont = mp;
3666 		} else {
3667 			first_mp = mp;
3668 		}
3669 	}
3670 
3671 	/*
3672 	 * For link-local always add ifindex so that TCP can bind to that
3673 	 * interface. Avoid it for ICMP error fanout.
3674 	 */
3675 	if (!syn_present && ((connp->conn_ipv6_recvpktinfo ||
3676 	    IN6_IS_ADDR_LINKLOCAL(&ip6h->ip6_src)) &&
3677 	    (flags & IP_FF_IP6INFO))) {
3678 		/* Add header */
3679 		mp = ip_add_info_v6(mp, inill, &ip6h->ip6_dst);
3680 		if (mp == NULL) {
3681 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
3682 			CONN_DEC_REF(connp);
3683 			if (mctl_present)
3684 				freeb(first_mp);
3685 			return;
3686 		} else if (mctl_present) {
3687 			ASSERT(first_mp != mp);
3688 			first_mp->b_cont = mp;
3689 		} else {
3690 			first_mp = mp;
3691 		}
3692 	}
3693 
3694 	BUMP_MIB(ill->ill_ip6_mib, ipv6InDelivers);
3695 	if (IPCL_IS_TCP(connp)) {
3696 		(*ip_input_proc)(connp->conn_sqp, first_mp,
3697 		    connp->conn_recv, connp, SQTAG_IP6_TCP_INPUT);
3698 	} else {
3699 		putnext(connp->conn_rq, first_mp);
3700 		CONN_DEC_REF(connp);
3701 	}
3702 }
3703 
3704 /*
3705  * Fanout for UDP packets.
3706  * The caller puts <fport, lport> in the ports parameter.
3707  * ire_type must be IRE_BROADCAST for multicast and broadcast packets.
3708  *
3709  * If SO_REUSEADDR is set all multicast and broadcast packets
3710  * will be delivered to all streams bound to the same port.
3711  *
3712  * Zones notes:
3713  * Multicast packets will be distributed to streams in all zones.
3714  */
3715 static void
3716 ip_fanout_udp_v6(queue_t *q, mblk_t *mp, ip6_t *ip6h, uint32_t ports,
3717     ill_t *ill, ill_t *inill, uint_t flags, boolean_t mctl_present,
3718     zoneid_t zoneid)
3719 {
3720 	uint32_t	dstport, srcport;
3721 	in6_addr_t	dst;
3722 	mblk_t		*first_mp;
3723 	boolean_t	secure;
3724 	conn_t		*connp;
3725 	connf_t		*connfp;
3726 	conn_t		*first_conn;
3727 	conn_t 		*next_conn;
3728 	mblk_t		*mp1, *first_mp1;
3729 	in6_addr_t	src;
3730 	boolean_t	shared_addr;
3731 
3732 	first_mp = mp;
3733 	if (mctl_present) {
3734 		mp = first_mp->b_cont;
3735 		secure = ipsec_in_is_secure(first_mp);
3736 		ASSERT(mp != NULL);
3737 	} else {
3738 		secure = B_FALSE;
3739 	}
3740 
3741 	/* Extract ports in net byte order */
3742 	dstport = htons(ntohl(ports) & 0xFFFF);
3743 	srcport = htons(ntohl(ports) >> 16);
3744 	dst = ip6h->ip6_dst;
3745 	src = ip6h->ip6_src;
3746 
3747 	shared_addr = (zoneid == ALL_ZONES);
3748 	if (shared_addr) {
3749 		zoneid = tsol_mlp_findzone(IPPROTO_UDP, dstport);
3750 		/*
3751 		 * If no shared MLP is found, tsol_mlp_findzone returns
3752 		 * ALL_ZONES.  In that case, we assume it's SLP, and
3753 		 * search for the zone based on the packet label.
3754 		 * That will also return ALL_ZONES on failure, but
3755 		 * we never allow conn_zoneid to be set to ALL_ZONES.
3756 		 */
3757 		if (zoneid == ALL_ZONES)
3758 			zoneid = tsol_packet_to_zoneid(mp);
3759 	}
3760 
3761 	/* Attempt to find a client stream based on destination port. */
3762 	connfp = &ipcl_udp_fanout[IPCL_UDP_HASH(dstport)];
3763 	mutex_enter(&connfp->connf_lock);
3764 	connp = connfp->connf_head;
3765 	if (!IN6_IS_ADDR_MULTICAST(&dst)) {
3766 		/*
3767 		 * Not multicast. Send to the one (first) client we find.
3768 		 */
3769 		while (connp != NULL) {
3770 			if (IPCL_UDP_MATCH_V6(connp, dstport, dst, srcport,
3771 			    src) && connp->conn_zoneid == zoneid &&
3772 			    conn_wantpacket_v6(connp, ill, ip6h,
3773 			    flags, zoneid)) {
3774 				break;
3775 			}
3776 			connp = connp->conn_next;
3777 		}
3778 		if (connp == NULL || connp->conn_upq == NULL)
3779 			goto notfound;
3780 
3781 		if (is_system_labeled() &&
3782 		    !tsol_receive_local(mp, &dst, IPV6_VERSION, shared_addr,
3783 		    connp))
3784 			goto notfound;
3785 
3786 		/* Found a client */
3787 		CONN_INC_REF(connp);
3788 		mutex_exit(&connfp->connf_lock);
3789 
3790 		if (CONN_UDP_FLOWCTLD(connp)) {
3791 			freemsg(first_mp);
3792 			CONN_DEC_REF(connp);
3793 			return;
3794 		}
3795 		if (CONN_INBOUND_POLICY_PRESENT_V6(connp) || secure) {
3796 			first_mp = ipsec_check_inbound_policy(first_mp,
3797 			    connp, NULL, ip6h, mctl_present);
3798 			if (first_mp == NULL) {
3799 				CONN_DEC_REF(connp);
3800 				return;
3801 			}
3802 		}
3803 		/* Initiate IPPF processing */
3804 		if (IP6_IN_IPP(flags)) {
3805 			uint_t	ifindex;
3806 
3807 			mutex_enter(&ill->ill_lock);
3808 			ifindex = ill->ill_phyint->phyint_ifindex;
3809 			mutex_exit(&ill->ill_lock);
3810 			ip_process(IPP_LOCAL_IN, &mp, ifindex);
3811 			if (mp == NULL) {
3812 				CONN_DEC_REF(connp);
3813 				if (mctl_present)
3814 					freeb(first_mp);
3815 				return;
3816 			}
3817 		}
3818 		/*
3819 		 * For link-local always add ifindex so that
3820 		 * transport can set sin6_scope_id. Avoid it for
3821 		 * ICMP error fanout.
3822 		 */
3823 		if ((connp->conn_ipv6_recvpktinfo ||
3824 		    IN6_IS_ADDR_LINKLOCAL(&src)) &&
3825 		    (flags & IP_FF_IP6INFO)) {
3826 				/* Add header */
3827 			mp = ip_add_info_v6(mp, inill, &dst);
3828 			if (mp == NULL) {
3829 				BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
3830 				CONN_DEC_REF(connp);
3831 				if (mctl_present)
3832 					freeb(first_mp);
3833 				return;
3834 			} else if (mctl_present) {
3835 				first_mp->b_cont = mp;
3836 			} else {
3837 				first_mp = mp;
3838 			}
3839 		}
3840 		BUMP_MIB(ill->ill_ip6_mib, ipv6InDelivers);
3841 
3842 		/* Send it upstream */
3843 		CONN_UDP_RECV(connp, mp);
3844 
3845 		IP6_STAT(ip6_udp_fannorm);
3846 		CONN_DEC_REF(connp);
3847 		if (mctl_present)
3848 			freeb(first_mp);
3849 		return;
3850 	}
3851 
3852 	while (connp != NULL) {
3853 		if ((IPCL_UDP_MATCH_V6(connp, dstport, dst, srcport, src)) &&
3854 		    conn_wantpacket_v6(connp, ill, ip6h, flags, zoneid) &&
3855 		    (!is_system_labeled() ||
3856 		    tsol_receive_local(mp, &dst, IPV6_VERSION, shared_addr,
3857 		    connp)))
3858 			break;
3859 		connp = connp->conn_next;
3860 	}
3861 
3862 	if (connp == NULL || connp->conn_upq == NULL)
3863 		goto notfound;
3864 
3865 	first_conn = connp;
3866 
3867 	CONN_INC_REF(connp);
3868 	connp = connp->conn_next;
3869 	for (;;) {
3870 		while (connp != NULL) {
3871 			if (IPCL_UDP_MATCH_V6(connp, dstport, dst, srcport,
3872 			    src) && conn_wantpacket_v6(connp, ill, ip6h,
3873 			    flags, zoneid) &&
3874 			    (!is_system_labeled() ||
3875 			    tsol_receive_local(mp, &dst, IPV6_VERSION,
3876 			    shared_addr, connp)))
3877 				break;
3878 			connp = connp->conn_next;
3879 		}
3880 		/*
3881 		 * Just copy the data part alone. The mctl part is
3882 		 * needed just for verifying policy and it is never
3883 		 * sent up.
3884 		 */
3885 		if (connp == NULL ||
3886 		    (((first_mp1 = dupmsg(first_mp)) == NULL) &&
3887 			((first_mp1 = ip_copymsg(first_mp))
3888 			    == NULL))) {
3889 			/*
3890 			 * No more interested clients or memory
3891 			 * allocation failed
3892 			 */
3893 			connp = first_conn;
3894 			break;
3895 		}
3896 		mp1 = mctl_present ? first_mp1->b_cont : first_mp1;
3897 		CONN_INC_REF(connp);
3898 		mutex_exit(&connfp->connf_lock);
3899 		/*
3900 		 * For link-local always add ifindex so that transport
3901 		 * can set sin6_scope_id. Avoid it for ICMP error
3902 		 * fanout.
3903 		 */
3904 		if ((connp->conn_ipv6_recvpktinfo ||
3905 		    IN6_IS_ADDR_LINKLOCAL(&src)) &&
3906 		    (flags & IP_FF_IP6INFO)) {
3907 			/* Add header */
3908 			mp1 = ip_add_info_v6(mp1, inill, &dst);
3909 		}
3910 		/* mp1 could have changed */
3911 		if (mctl_present)
3912 			first_mp1->b_cont = mp1;
3913 		else
3914 			first_mp1 = mp1;
3915 		if (mp1 == NULL) {
3916 			if (mctl_present)
3917 				freeb(first_mp1);
3918 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
3919 			goto next_one;
3920 		}
3921 		if (CONN_UDP_FLOWCTLD(connp)) {
3922 			BUMP_MIB(ill->ill_ip6_mib, udpInOverflows);
3923 			freemsg(first_mp1);
3924 			goto next_one;
3925 		}
3926 
3927 		if (CONN_INBOUND_POLICY_PRESENT_V6(connp) ||
3928 		    secure) {
3929 			first_mp1 = ipsec_check_inbound_policy
3930 			    (first_mp1, connp, NULL, ip6h,
3931 			    mctl_present);
3932 		}
3933 		if (first_mp1 != NULL) {
3934 			if (mctl_present)
3935 				freeb(first_mp1);
3936 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDelivers);
3937 
3938 			/* Send it upstream */
3939 			CONN_UDP_RECV(connp, mp1);
3940 		}
3941 next_one:
3942 		mutex_enter(&connfp->connf_lock);
3943 		/* Follow the next pointer before releasing the conn. */
3944 		next_conn = connp->conn_next;
3945 		IP6_STAT(ip6_udp_fanmb);
3946 		CONN_DEC_REF(connp);
3947 		connp = next_conn;
3948 	}
3949 
3950 	/* Last one.  Send it upstream. */
3951 	mutex_exit(&connfp->connf_lock);
3952 
3953 	/* Initiate IPPF processing */
3954 	if (IP6_IN_IPP(flags)) {
3955 		uint_t	ifindex;
3956 
3957 		mutex_enter(&ill->ill_lock);
3958 		ifindex = ill->ill_phyint->phyint_ifindex;
3959 		mutex_exit(&ill->ill_lock);
3960 		ip_process(IPP_LOCAL_IN, &mp, ifindex);
3961 		if (mp == NULL) {
3962 			CONN_DEC_REF(connp);
3963 			if (mctl_present) {
3964 				freeb(first_mp);
3965 			}
3966 			return;
3967 		}
3968 	}
3969 
3970 	/*
3971 	 * For link-local always add ifindex so that transport can set
3972 	 * sin6_scope_id. Avoid it for ICMP error fanout.
3973 	 */
3974 	if ((connp->conn_ipv6_recvpktinfo ||
3975 	    IN6_IS_ADDR_LINKLOCAL(&src)) && (flags & IP_FF_IP6INFO)) {
3976 		/* Add header */
3977 		mp = ip_add_info_v6(mp, inill, &dst);
3978 		if (mp == NULL) {
3979 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
3980 			CONN_DEC_REF(connp);
3981 			if (mctl_present)
3982 				freeb(first_mp);
3983 			return;
3984 		} else if (mctl_present) {
3985 			first_mp->b_cont = mp;
3986 		} else {
3987 			first_mp = mp;
3988 		}
3989 	}
3990 	if (CONN_UDP_FLOWCTLD(connp)) {
3991 		BUMP_MIB(ill->ill_ip6_mib, udpInOverflows);
3992 		freemsg(mp);
3993 	} else {
3994 		if (CONN_INBOUND_POLICY_PRESENT_V6(connp) || secure) {
3995 			first_mp = ipsec_check_inbound_policy(first_mp,
3996 			    connp, NULL, ip6h, mctl_present);
3997 			if (first_mp == NULL) {
3998 				BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
3999 				CONN_DEC_REF(connp);
4000 				return;
4001 			}
4002 		}
4003 		BUMP_MIB(ill->ill_ip6_mib, ipv6InDelivers);
4004 
4005 		/* Send it upstream */
4006 		CONN_UDP_RECV(connp, mp);
4007 	}
4008 	IP6_STAT(ip6_udp_fanmb);
4009 	CONN_DEC_REF(connp);
4010 	if (mctl_present)
4011 		freeb(first_mp);
4012 	return;
4013 
4014 notfound:
4015 	mutex_exit(&connfp->connf_lock);
4016 	/*
4017 	 * No one bound to this port.  Is
4018 	 * there a client that wants all
4019 	 * unclaimed datagrams?
4020 	 */
4021 	if (ipcl_proto_fanout_v6[IPPROTO_UDP].connf_head != NULL) {
4022 		ip_fanout_proto_v6(q, first_mp, ip6h, ill, inill, IPPROTO_UDP,
4023 		    0, flags | IP_FF_RAWIP | IP_FF_IP6INFO, mctl_present,
4024 		    zoneid);
4025 	} else {
4026 		if (ip_fanout_send_icmp_v6(q, first_mp, flags,
4027 		    ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_NOPORT, 0,
4028 		    mctl_present, zoneid)) {
4029 			BUMP_MIB(&ip_mib, udpNoPorts);
4030 		}
4031 	}
4032 }
4033 
4034 /*
4035  * int ip_find_hdr_v6()
4036  *
4037  * This routine is used by the upper layer protocols and the IP tunnel
4038  * module to:
4039  * - Set extension header pointers to appropriate locations
4040  * - Determine IPv6 header length and return it
4041  * - Return a pointer to the last nexthdr value
4042  *
4043  * The caller must initialize ipp_fields.
4044  *
4045  * NOTE: If multiple extension headers of the same type are present,
4046  * ip_find_hdr_v6() will set the respective extension header pointers
4047  * to the first one that it encounters in the IPv6 header.  It also
4048  * skips fragment headers.  This routine deals with malformed packets
4049  * of various sorts in which case the returned length is up to the
4050  * malformed part.
4051  */
4052 int
4053 ip_find_hdr_v6(mblk_t *mp, ip6_t *ip6h, ip6_pkt_t *ipp, uint8_t *nexthdrp)
4054 {
4055 	uint_t	length, ehdrlen;
4056 	uint8_t nexthdr;
4057 	uint8_t *whereptr, *endptr;
4058 	ip6_dest_t *tmpdstopts;
4059 	ip6_rthdr_t *tmprthdr;
4060 	ip6_hbh_t *tmphopopts;
4061 	ip6_frag_t *tmpfraghdr;
4062 
4063 	length = IPV6_HDR_LEN;
4064 	whereptr = ((uint8_t *)&ip6h[1]); /* point to next hdr */
4065 	endptr = mp->b_wptr;
4066 
4067 	nexthdr = ip6h->ip6_nxt;
4068 	while (whereptr < endptr) {
4069 		/* Is there enough left for len + nexthdr? */
4070 		if (whereptr + MIN_EHDR_LEN > endptr)
4071 			goto done;
4072 
4073 		switch (nexthdr) {
4074 		case IPPROTO_HOPOPTS:
4075 			tmphopopts = (ip6_hbh_t *)whereptr;
4076 			ehdrlen = 8 * (tmphopopts->ip6h_len + 1);
4077 			if ((uchar_t *)tmphopopts +  ehdrlen > endptr)
4078 				goto done;
4079 			nexthdr = tmphopopts->ip6h_nxt;
4080 			/* return only 1st hbh */
4081 			if (!(ipp->ipp_fields & IPPF_HOPOPTS)) {
4082 				ipp->ipp_fields |= IPPF_HOPOPTS;
4083 				ipp->ipp_hopopts = tmphopopts;
4084 				ipp->ipp_hopoptslen = ehdrlen;
4085 			}
4086 			break;
4087 		case IPPROTO_DSTOPTS:
4088 			tmpdstopts = (ip6_dest_t *)whereptr;
4089 			ehdrlen = 8 * (tmpdstopts->ip6d_len + 1);
4090 			if ((uchar_t *)tmpdstopts +  ehdrlen > endptr)
4091 				goto done;
4092 			nexthdr = tmpdstopts->ip6d_nxt;
4093 			/*
4094 			 * ipp_dstopts is set to the destination header after a
4095 			 * routing header.
4096 			 * Assume it is a post-rthdr destination header
4097 			 * and adjust when we find an rthdr.
4098 			 */
4099 			if (!(ipp->ipp_fields & IPPF_DSTOPTS)) {
4100 				ipp->ipp_fields |= IPPF_DSTOPTS;
4101 				ipp->ipp_dstopts = tmpdstopts;
4102 				ipp->ipp_dstoptslen = ehdrlen;
4103 			}
4104 			break;
4105 		case IPPROTO_ROUTING:
4106 			tmprthdr = (ip6_rthdr_t *)whereptr;
4107 			ehdrlen = 8 * (tmprthdr->ip6r_len + 1);
4108 			if ((uchar_t *)tmprthdr +  ehdrlen > endptr)
4109 				goto done;
4110 			nexthdr = tmprthdr->ip6r_nxt;
4111 			/* return only 1st rthdr */
4112 			if (!(ipp->ipp_fields & IPPF_RTHDR)) {
4113 				ipp->ipp_fields |= IPPF_RTHDR;
4114 				ipp->ipp_rthdr = tmprthdr;
4115 				ipp->ipp_rthdrlen = ehdrlen;
4116 			}
4117 			/*
4118 			 * Make any destination header we've seen be a
4119 			 * pre-rthdr destination header.
4120 			 */
4121 			if (ipp->ipp_fields & IPPF_DSTOPTS) {
4122 				ipp->ipp_fields &= ~IPPF_DSTOPTS;
4123 				ipp->ipp_fields |= IPPF_RTDSTOPTS;
4124 				ipp->ipp_rtdstopts = ipp->ipp_dstopts;
4125 				ipp->ipp_dstopts = NULL;
4126 				ipp->ipp_rtdstoptslen = ipp->ipp_dstoptslen;
4127 				ipp->ipp_dstoptslen = 0;
4128 			}
4129 			break;
4130 		case IPPROTO_FRAGMENT:
4131 			/*
4132 			 * Fragment headers are skipped.  Currently, only
4133 			 * IP cares for their existence.  If anyone other
4134 			 * than IP ever has the need to know about the
4135 			 * location of fragment headers, support can be
4136 			 * added to the ip6_pkt_t at that time.
4137 			 */
4138 			tmpfraghdr = (ip6_frag_t *)whereptr;
4139 			ehdrlen = sizeof (ip6_frag_t);
4140 			if ((uchar_t *)tmpfraghdr + ehdrlen > endptr)
4141 				goto done;
4142 			nexthdr = tmpfraghdr->ip6f_nxt;
4143 			break;
4144 		case IPPROTO_NONE:
4145 		default:
4146 			goto done;
4147 		}
4148 		length += ehdrlen;
4149 		whereptr += ehdrlen;
4150 	}
4151 done:
4152 	if (nexthdrp != NULL)
4153 		*nexthdrp = nexthdr;
4154 	return (length);
4155 }
4156 
4157 int
4158 ip_hdr_complete_v6(ip6_t *ip6h, zoneid_t zoneid)
4159 {
4160 	ire_t *ire;
4161 
4162 	if (IN6_IS_ADDR_UNSPECIFIED(&ip6h->ip6_src)) {
4163 		ire = ire_lookup_local_v6(zoneid);
4164 		if (ire == NULL) {
4165 			ip1dbg(("ip_hdr_complete_v6: no source IRE\n"));
4166 			return (1);
4167 		}
4168 		ip6h->ip6_src = ire->ire_addr_v6;
4169 		ire_refrele(ire);
4170 	}
4171 	ip6h->ip6_vcf = IPV6_DEFAULT_VERS_AND_FLOW;
4172 	ip6h->ip6_hops = ipv6_def_hops;
4173 	return (0);
4174 }
4175 
4176 /*
4177  * Try to determine where and what are the IPv6 header length and
4178  * pointer to nexthdr value for the upper layer protocol (or an
4179  * unknown next hdr).
4180  *
4181  * Parameters returns a pointer to the nexthdr value;
4182  * Must handle malformed packets of various sorts.
4183  * Function returns failure for malformed cases.
4184  */
4185 boolean_t
4186 ip_hdr_length_nexthdr_v6(mblk_t *mp, ip6_t *ip6h, uint16_t *hdr_length_ptr,
4187     uint8_t **nexthdrpp)
4188 {
4189 	uint16_t length;
4190 	uint_t	ehdrlen;
4191 	uint8_t	*nexthdrp;
4192 	uint8_t *whereptr;
4193 	uint8_t *endptr;
4194 	ip6_dest_t *desthdr;
4195 	ip6_rthdr_t *rthdr;
4196 	ip6_frag_t *fraghdr;
4197 
4198 	length = IPV6_HDR_LEN;
4199 	whereptr = ((uint8_t *)&ip6h[1]); /* point to next hdr */
4200 	endptr = mp->b_wptr;
4201 
4202 	nexthdrp = &ip6h->ip6_nxt;
4203 	while (whereptr < endptr) {
4204 		/* Is there enough left for len + nexthdr? */
4205 		if (whereptr + MIN_EHDR_LEN > endptr)
4206 			break;
4207 
4208 		switch (*nexthdrp) {
4209 		case IPPROTO_HOPOPTS:
4210 		case IPPROTO_DSTOPTS:
4211 			/* Assumes the headers are identical for hbh and dst */
4212 			desthdr = (ip6_dest_t *)whereptr;
4213 			ehdrlen = 8 * (desthdr->ip6d_len + 1);
4214 			if ((uchar_t *)desthdr +  ehdrlen > endptr)
4215 				return (B_FALSE);
4216 			nexthdrp = &desthdr->ip6d_nxt;
4217 			break;
4218 		case IPPROTO_ROUTING:
4219 			rthdr = (ip6_rthdr_t *)whereptr;
4220 			ehdrlen =  8 * (rthdr->ip6r_len + 1);
4221 			if ((uchar_t *)rthdr +  ehdrlen > endptr)
4222 				return (B_FALSE);
4223 			nexthdrp = &rthdr->ip6r_nxt;
4224 			break;
4225 		case IPPROTO_FRAGMENT:
4226 			fraghdr = (ip6_frag_t *)whereptr;
4227 			ehdrlen = sizeof (ip6_frag_t);
4228 			if ((uchar_t *)&fraghdr[1] > endptr)
4229 				return (B_FALSE);
4230 			nexthdrp = &fraghdr->ip6f_nxt;
4231 			break;
4232 		case IPPROTO_NONE:
4233 			/* No next header means we're finished */
4234 		default:
4235 			*hdr_length_ptr = length;
4236 			*nexthdrpp = nexthdrp;
4237 			return (B_TRUE);
4238 		}
4239 		length += ehdrlen;
4240 		whereptr += ehdrlen;
4241 		*hdr_length_ptr = length;
4242 		*nexthdrpp = nexthdrp;
4243 	}
4244 	switch (*nexthdrp) {
4245 	case IPPROTO_HOPOPTS:
4246 	case IPPROTO_DSTOPTS:
4247 	case IPPROTO_ROUTING:
4248 	case IPPROTO_FRAGMENT:
4249 		/*
4250 		 * If any know extension headers are still to be processed,
4251 		 * the packet's malformed (or at least all the IP header(s) are
4252 		 * not in the same mblk - and that should never happen.
4253 		 */
4254 		return (B_FALSE);
4255 
4256 	default:
4257 		/*
4258 		 * If we get here, we know that all of the IP headers were in
4259 		 * the same mblk, even if the ULP header is in the next mblk.
4260 		 */
4261 		*hdr_length_ptr = length;
4262 		*nexthdrpp = nexthdrp;
4263 		return (B_TRUE);
4264 	}
4265 }
4266 
4267 /*
4268  * Return the length of the IPv6 related headers (including extension headers)
4269  * Returns a length even if the packet is malformed.
4270  */
4271 int
4272 ip_hdr_length_v6(mblk_t *mp, ip6_t *ip6h)
4273 {
4274 	uint16_t hdr_len;
4275 	uint8_t	*nexthdrp;
4276 
4277 	(void) ip_hdr_length_nexthdr_v6(mp, ip6h, &hdr_len, &nexthdrp);
4278 	return (hdr_len);
4279 }
4280 
4281 /*
4282  * Select an ill for the packet by considering load spreading across
4283  * a different ill in the group if dst_ill is part of some group.
4284  */
4285 static ill_t *
4286 ip_newroute_get_dst_ill_v6(ill_t *dst_ill)
4287 {
4288 	ill_t *ill;
4289 
4290 	/*
4291 	 * We schedule irrespective of whether the source address is
4292 	 * INADDR_UNSPECIED or not.
4293 	 */
4294 	ill = illgrp_scheduler(dst_ill);
4295 	if (ill == NULL)
4296 		return (NULL);
4297 
4298 	/*
4299 	 * For groups with names ip_sioctl_groupname ensures that all
4300 	 * ills are of same type. For groups without names, ifgrp_insert
4301 	 * ensures this.
4302 	 */
4303 	ASSERT(dst_ill->ill_type == ill->ill_type);
4304 
4305 	return (ill);
4306 }
4307 
4308 /*
4309  * IPv6 -
4310  * ip_newroute_v6 is called by ip_rput_data_v6 or ip_wput_v6 whenever we need
4311  * to send out a packet to a destination address for which we do not have
4312  * specific routing information.
4313  *
4314  * Handle non-multicast packets. If ill is non-NULL the match is done
4315  * for that ill.
4316  *
4317  * When a specific ill is specified (using IPV6_PKTINFO,
4318  * IPV6_MULTICAST_IF, or IPV6_BOUND_IF) we will only match
4319  * on routing entries (ftable and ctable) that have a matching
4320  * ire->ire_ipif->ipif_ill. Thus this can only be used
4321  * for destinations that are on-link for the specific ill
4322  * and that can appear on multiple links. Thus it is useful
4323  * for multicast destinations, link-local destinations, and
4324  * at some point perhaps for site-local destinations (if the
4325  * node sits at a site boundary).
4326  * We create the cache entries in the regular ctable since
4327  * it can not "confuse" things for other destinations.
4328  * table.
4329  *
4330  * When ill is part of a ill group, we subject the packets
4331  * to load spreading even if the ill is specified by the
4332  * means described above. We disable only for IPV6_BOUND_PIF
4333  * and for the cases where IP6I_ATTACH_IF is set i.e NS/NA/
4334  * Echo replies to link-local destinations have IP6I_ATTACH_IF
4335  * set.
4336  *
4337  * NOTE : These are the scopes of some of the variables that point at IRE,
4338  *	  which needs to be followed while making any future modifications
4339  *	  to avoid memory leaks.
4340  *
4341  *	- ire and sire are the entries looked up initially by
4342  *	  ire_ftable_lookup_v6.
4343  *	- ipif_ire is used to hold the interface ire associated with
4344  *	  the new cache ire. But it's scope is limited, so we always REFRELE
4345  *	  it before branching out to error paths.
4346  *	- save_ire is initialized before ire_create, so that ire returned
4347  *	  by ire_create will not over-write the ire. We REFRELE save_ire
4348  *	  before breaking out of the switch.
4349  *
4350  *	Thus on failures, we have to REFRELE only ire and sire, if they
4351  *	are not NULL.
4352  *
4353  *	v6srcp may be used in the future. Currently unused.
4354  */
4355 /* ARGSUSED */
4356 void
4357 ip_newroute_v6(queue_t *q, mblk_t *mp, const in6_addr_t *v6dstp,
4358     const in6_addr_t *v6srcp, ill_t *ill, zoneid_t zoneid)
4359 {
4360 	in6_addr_t	v6gw;
4361 	in6_addr_t	dst;
4362 	ire_t		*ire = NULL;
4363 	ipif_t		*src_ipif = NULL;
4364 	ill_t		*dst_ill = NULL;
4365 	ire_t		*sire = NULL;
4366 	ire_t		*save_ire;
4367 	mblk_t		*dlureq_mp;
4368 	ip6_t		*ip6h;
4369 	int		err = 0;
4370 	mblk_t		*first_mp;
4371 	ipsec_out_t	*io;
4372 	ill_t		*attach_ill = NULL;
4373 	ushort_t	ire_marks = 0;
4374 	int		match_flags;
4375 	boolean_t	ip6i_present;
4376 	ire_t		*first_sire = NULL;
4377 	mblk_t		*copy_mp = NULL;
4378 	mblk_t		*xmit_mp = NULL;
4379 	in6_addr_t	save_dst;
4380 	uint32_t	multirt_flags =
4381 	    MULTIRT_CACHEGW | MULTIRT_USESTAMP | MULTIRT_SETSTAMP;
4382 	boolean_t	multirt_is_resolvable;
4383 	boolean_t	multirt_resolve_next;
4384 	boolean_t	need_rele = B_FALSE;
4385 	boolean_t	do_attach_ill = B_FALSE;
4386 	boolean_t	ip6_asp_table_held = B_FALSE;
4387 	tsol_ire_gw_secattr_t *attrp = NULL;
4388 	tsol_gcgrp_t	*gcgrp = NULL;
4389 	tsol_gcgrp_addr_t ga;
4390 
4391 	ASSERT(!IN6_IS_ADDR_MULTICAST(v6dstp));
4392 
4393 	first_mp = mp;
4394 	if (mp->b_datap->db_type == M_CTL) {
4395 		mp = mp->b_cont;
4396 		io = (ipsec_out_t *)first_mp->b_rptr;
4397 		ASSERT(io->ipsec_out_type == IPSEC_OUT);
4398 	} else {
4399 		io = NULL;
4400 	}
4401 
4402 	/*
4403 	 * If this end point is bound to IPIF_NOFAILOVER, set bnf_ill and
4404 	 * bind_to_nofailover B_TRUE. We can't use conn to determine as it
4405 	 * could be NULL.
4406 	 *
4407 	 * This information can appear either in an ip6i_t or an IPSEC_OUT
4408 	 * message.
4409 	 */
4410 	ip6h = (ip6_t *)mp->b_rptr;
4411 	ip6i_present = (ip6h->ip6_nxt == IPPROTO_RAW);
4412 	if (ip6i_present || (io != NULL && io->ipsec_out_attach_if)) {
4413 		if (!ip6i_present ||
4414 		    ((ip6i_t *)ip6h)->ip6i_flags & IP6I_ATTACH_IF) {
4415 			attach_ill = ip_grab_attach_ill(ill, first_mp,
4416 			    (ip6i_present ? ((ip6i_t *)ip6h)->ip6i_ifindex :
4417 				io->ipsec_out_ill_index), B_TRUE);
4418 			/* Failure case frees things for us. */
4419 			if (attach_ill == NULL)
4420 				return;
4421 
4422 			/*
4423 			 * Check if we need an ire that will not be
4424 			 * looked up by anybody else i.e. HIDDEN.
4425 			 */
4426 			if (ill_is_probeonly(attach_ill))
4427 				ire_marks = IRE_MARK_HIDDEN;
4428 		}
4429 	}
4430 
4431 	if (IN6_IS_ADDR_LOOPBACK(v6dstp)) {
4432 		ip1dbg(("ip_newroute_v6: dst with loopback addr\n"));
4433 		goto icmp_err_ret;
4434 	} else if ((v6srcp != NULL) && IN6_IS_ADDR_LOOPBACK(v6srcp)) {
4435 		ip1dbg(("ip_newroute_v6: src with loopback addr\n"));
4436 		goto icmp_err_ret;
4437 	}
4438 
4439 	/*
4440 	 * If this IRE is created for forwarding or it is not for
4441 	 * TCP traffic, mark it as temporary.
4442 	 *
4443 	 * Is it sufficient just to check the next header??
4444 	 */
4445 	if (mp->b_prev != NULL || !IP_FLOW_CONTROLLED_ULP(ip6h->ip6_nxt))
4446 		ire_marks |= IRE_MARK_TEMPORARY;
4447 
4448 	/*
4449 	 * Get what we can from ire_ftable_lookup_v6 which will follow an IRE
4450 	 * chain until it gets the most specific information available.
4451 	 * For example, we know that there is no IRE_CACHE for this dest,
4452 	 * but there may be an IRE_OFFSUBNET which specifies a gateway.
4453 	 * ire_ftable_lookup_v6 will look up the gateway, etc.
4454 	 */
4455 
4456 	if (ill == NULL) {
4457 		match_flags = MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT |
4458 		    MATCH_IRE_PARENT | MATCH_IRE_RJ_BHOLE | MATCH_IRE_SECATTR;
4459 		ire = ire_ftable_lookup_v6(v6dstp, 0, 0, 0,
4460 		    NULL, &sire, zoneid, 0, MBLK_GETLABEL(mp),
4461 		    match_flags);
4462 		/*
4463 		 * ire_add_then_send -> ip_newroute_v6 in the CGTP case passes
4464 		 * in a NULL ill, but the packet could be a neighbor
4465 		 * solicitation/advertisment and could have a valid attach_ill.
4466 		 */
4467 		if (attach_ill != NULL)
4468 			ill_refrele(attach_ill);
4469 	} else {
4470 		if (attach_ill != NULL) {
4471 			/*
4472 			 * attach_ill is set only for communicating with
4473 			 * on-link hosts. So, don't look for DEFAULT.
4474 			 * ip_wput_v6 passes the right ill in this case and
4475 			 * hence we can assert.
4476 			 */
4477 			ASSERT(ill == attach_ill);
4478 			ill_refrele(attach_ill);
4479 			do_attach_ill = B_TRUE;
4480 			match_flags = MATCH_IRE_RJ_BHOLE | MATCH_IRE_ILL;
4481 		} else {
4482 			match_flags = MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT |
4483 			    MATCH_IRE_RJ_BHOLE | MATCH_IRE_ILL_GROUP;
4484 		}
4485 		match_flags |= MATCH_IRE_PARENT | MATCH_IRE_SECATTR;
4486 		ire = ire_ftable_lookup_v6(v6dstp, NULL, NULL, 0, ill->ill_ipif,
4487 		    &sire, zoneid, 0, MBLK_GETLABEL(mp), match_flags);
4488 	}
4489 
4490 	ip3dbg(("ip_newroute_v6: ire_ftable_lookup_v6() "
4491 	    "returned ire %p, sire %p\n", (void *)ire, (void *)sire));
4492 
4493 	if (zoneid == ALL_ZONES && ire != NULL) {
4494 		/*
4495 		 * In the forwarding case, we can use a route from any zone
4496 		 * since we won't change the source address. We can easily
4497 		 * assert that the source address is already set when there's no
4498 		 * ip6_info header - otherwise we'd have to call pullupmsg().
4499 		 */
4500 		ASSERT(ip6i_present ||
4501 		    !IN6_IS_ADDR_UNSPECIFIED(&ip6h->ip6_src));
4502 		zoneid = ire->ire_zoneid;
4503 	}
4504 
4505 	/*
4506 	 * We enter a loop that will be run only once in most cases.
4507 	 * The loop is re-entered in the case where the destination
4508 	 * can be reached through multiple RTF_MULTIRT-flagged routes.
4509 	 * The intention is to compute multiple routes to a single
4510 	 * destination in a single ip_newroute_v6 call.
4511 	 * The information is contained in sire->ire_flags.
4512 	 */
4513 	do {
4514 		multirt_resolve_next = B_FALSE;
4515 
4516 		if (dst_ill != NULL) {
4517 			ill_refrele(dst_ill);
4518 			dst_ill = NULL;
4519 		}
4520 		if (src_ipif != NULL) {
4521 			ipif_refrele(src_ipif);
4522 			src_ipif = NULL;
4523 		}
4524 		if ((sire != NULL) && sire->ire_flags & RTF_MULTIRT) {
4525 			ip3dbg(("ip_newroute_v6: starting new resolution "
4526 			    "with first_mp %p, tag %d\n",
4527 			    (void *)first_mp, MULTIRT_DEBUG_TAGGED(first_mp)));
4528 
4529 			/*
4530 			 * We check if there are trailing unresolved routes for
4531 			 * the destination contained in sire.
4532 			 */
4533 			multirt_is_resolvable = ire_multirt_lookup_v6(&ire,
4534 			    &sire, multirt_flags, MBLK_GETLABEL(mp));
4535 
4536 			ip3dbg(("ip_newroute_v6: multirt_is_resolvable %d, "
4537 			    "ire %p, sire %p\n",
4538 			    multirt_is_resolvable, (void *)ire, (void *)sire));
4539 
4540 			if (!multirt_is_resolvable) {
4541 				/*
4542 				 * No more multirt routes to resolve; give up
4543 				 * (all routes resolved or no more resolvable
4544 				 * routes).
4545 				 */
4546 				if (ire != NULL) {
4547 					ire_refrele(ire);
4548 					ire = NULL;
4549 				}
4550 			} else {
4551 				ASSERT(sire != NULL);
4552 				ASSERT(ire != NULL);
4553 				/*
4554 				 * We simply use first_sire as a flag that
4555 				 * indicates if a resolvable multirt route has
4556 				 * already been found during the preceding
4557 				 * loops. If it is not the case, we may have
4558 				 * to send an ICMP error to report that the
4559 				 * destination is unreachable. We do not
4560 				 * IRE_REFHOLD first_sire.
4561 				 */
4562 				if (first_sire == NULL) {
4563 					first_sire = sire;
4564 				}
4565 			}
4566 		}
4567 		if ((ire == NULL) || (ire == sire)) {
4568 			/*
4569 			 * either ire == NULL (the destination cannot be
4570 			 * resolved) or ire == sire (the gateway cannot be
4571 			 * resolved). At this point, there are no more routes
4572 			 * to resolve for the destination, thus we exit.
4573 			 */
4574 			if (ip_debug > 3) {
4575 				/* ip2dbg */
4576 				pr_addr_dbg("ip_newroute_v6: "
4577 				    "can't resolve %s\n", AF_INET6, v6dstp);
4578 			}
4579 			ip3dbg(("ip_newroute_v6: "
4580 			    "ire %p, sire %p, first_sire %p\n",
4581 			    (void *)ire, (void *)sire, (void *)first_sire));
4582 
4583 			if (sire != NULL) {
4584 				ire_refrele(sire);
4585 				sire = NULL;
4586 			}
4587 
4588 			if (first_sire != NULL) {
4589 				/*
4590 				 * At least one multirt route has been found
4591 				 * in the same ip_newroute() call; there is no
4592 				 * need to report an ICMP error.
4593 				 * first_sire was not IRE_REFHOLDed.
4594 				 */
4595 				MULTIRT_DEBUG_UNTAG(first_mp);
4596 				freemsg(first_mp);
4597 				return;
4598 			}
4599 			ip_rts_change_v6(RTM_MISS, v6dstp, 0, 0, 0, 0, 0, 0,
4600 			    RTA_DST);
4601 			goto icmp_err_ret;
4602 		}
4603 
4604 		ASSERT(ire->ire_ipversion == IPV6_VERSION);
4605 
4606 		/*
4607 		 * Verify that the returned IRE does not have either the
4608 		 * RTF_REJECT or RTF_BLACKHOLE flags set and that the IRE is
4609 		 * either an IRE_CACHE, IRE_IF_NORESOLVER or IRE_IF_RESOLVER.
4610 		 */
4611 		if ((ire->ire_flags & (RTF_REJECT | RTF_BLACKHOLE)) ||
4612 		    (ire->ire_type & (IRE_CACHE | IRE_INTERFACE)) == 0)
4613 			goto icmp_err_ret;
4614 
4615 		/*
4616 		 * Increment the ire_ob_pkt_count field for ire if it is an
4617 		 * INTERFACE (IF_RESOLVER or IF_NORESOLVER) IRE type, and
4618 		 * increment the same for the parent IRE, sire, if it is some
4619 		 * sort of prefix IRE (which includes DEFAULT, PREFIX, HOST
4620 		 * and HOST_REDIRECT).
4621 		 */
4622 		if ((ire->ire_type & IRE_INTERFACE) != 0) {
4623 			UPDATE_OB_PKT_COUNT(ire);
4624 			ire->ire_last_used_time = lbolt;
4625 		}
4626 
4627 		if (sire != NULL) {
4628 			mutex_enter(&sire->ire_lock);
4629 			v6gw = sire->ire_gateway_addr_v6;
4630 			mutex_exit(&sire->ire_lock);
4631 			ASSERT((sire->ire_type & (IRE_CACHETABLE |
4632 			    IRE_INTERFACE)) == 0);
4633 			UPDATE_OB_PKT_COUNT(sire);
4634 			sire->ire_last_used_time = lbolt;
4635 		} else {
4636 			v6gw = ipv6_all_zeros;
4637 		}
4638 
4639 		/*
4640 		 * We have a route to reach the destination.
4641 		 *
4642 		 * 1) If the interface is part of ill group, try to get a new
4643 		 *    ill taking load spreading into account.
4644 		 *
4645 		 * 2) After selecting the ill, get a source address that might
4646 		 *    create good inbound load spreading and that matches the
4647 		 *    right scope. ipif_select_source_v6 does this for us.
4648 		 *
4649 		 * If the application specified the ill (ifindex), we still
4650 		 * load spread. Only if the packets needs to go out specifically
4651 		 * on a given ill e.g. bind to IPIF_NOFAILOVER address,
4652 		 * IPV6_BOUND_PIF we don't try to use a different ill for load
4653 		 * spreading.
4654 		 */
4655 		if (!do_attach_ill) {
4656 			/*
4657 			 * If the interface belongs to an interface group,
4658 			 * make sure the next possible interface in the group
4659 			 * is used.  This encourages load spreading among
4660 			 * peers in an interface group. However, in the case
4661 			 * of multirouting, load spreading is not used, as we
4662 			 * actually want to replicate outgoing packets through
4663 			 * particular interfaces.
4664 			 *
4665 			 * Note: While we pick a dst_ill we are really only
4666 			 * interested in the ill for load spreading.
4667 			 * The source ipif is determined by source address
4668 			 * selection below.
4669 			 */
4670 			if ((sire != NULL) && (sire->ire_flags & RTF_MULTIRT)) {
4671 				dst_ill = ire->ire_ipif->ipif_ill;
4672 				/* For uniformity do a refhold */
4673 				ill_refhold(dst_ill);
4674 			} else {
4675 				/*
4676 				 * If we are here trying to create an IRE_CACHE
4677 				 * for an offlink destination and have the
4678 				 * IRE_CACHE for the next hop and the latter is
4679 				 * using virtual IP source address selection i.e
4680 				 * it's ire->ire_ipif is pointing to a virtual
4681 				 * network interface (vni) then
4682 				 * ip_newroute_get_dst_ll() will return the vni
4683 				 * interface as the dst_ill. Since the vni is
4684 				 * virtual i.e not associated with any physical
4685 				 * interface, it cannot be the dst_ill, hence
4686 				 * in such a case call ip_newroute_get_dst_ll()
4687 				 * with the stq_ill instead of the ire_ipif ILL.
4688 				 * The function returns a refheld ill.
4689 				 */
4690 				if ((ire->ire_type == IRE_CACHE) &&
4691 				    IS_VNI(ire->ire_ipif->ipif_ill))
4692 					dst_ill = ip_newroute_get_dst_ill_v6(
4693 						ire->ire_stq->q_ptr);
4694 				else
4695 					dst_ill = ip_newroute_get_dst_ill_v6(
4696 						ire->ire_ipif->ipif_ill);
4697 			}
4698 			if (dst_ill == NULL) {
4699 				if (ip_debug > 2) {
4700 					pr_addr_dbg("ip_newroute_v6 : no dst "
4701 					    "ill for dst %s\n",
4702 					    AF_INET6, v6dstp);
4703 				}
4704 				goto icmp_err_ret;
4705 			} else if (dst_ill->ill_group == NULL && ill != NULL &&
4706 			    dst_ill != ill) {
4707 				/*
4708 				 * If "ill" is not part of any group, we should
4709 				 * have found a route matching "ill" as we
4710 				 * called ire_ftable_lookup_v6 with
4711 				 * MATCH_IRE_ILL_GROUP.
4712 				 * Rather than asserting when there is a
4713 				 * mismatch, we just drop the packet.
4714 				 */
4715 				ip0dbg(("ip_newroute_v6: BOUND_IF failed : "
4716 				    "dst_ill %s ill %s\n",
4717 				    dst_ill->ill_name,
4718 				    ill->ill_name));
4719 				goto icmp_err_ret;
4720 			}
4721 		} else {
4722 			dst_ill = ire->ire_ipif->ipif_ill;
4723 			/* For uniformity do refhold */
4724 			ill_refhold(dst_ill);
4725 			/*
4726 			 * We should have found a route matching ill as we
4727 			 * called ire_ftable_lookup_v6 with MATCH_IRE_ILL.
4728 			 * Rather than asserting, while there is a mismatch,
4729 			 * we just drop the packet.
4730 			 */
4731 			if (dst_ill != ill) {
4732 				ip0dbg(("ip_newroute_v6: Packet dropped as "
4733 				    "IP6I_ATTACH_IF ill is %s, "
4734 				    "ire->ire_ipif->ipif_ill is %s\n",
4735 				    ill->ill_name,
4736 				    dst_ill->ill_name));
4737 				goto icmp_err_ret;
4738 			}
4739 		}
4740 		/*
4741 		 * Pick a source address which matches the scope of the
4742 		 * destination address.
4743 		 * For RTF_SETSRC routes, the source address is imposed by the
4744 		 * parent ire (sire).
4745 		 */
4746 		ASSERT(src_ipif == NULL);
4747 		if (ire->ire_type == IRE_IF_RESOLVER &&
4748 		    !IN6_IS_ADDR_UNSPECIFIED(&v6gw) &&
4749 		    ip6_asp_can_lookup()) {
4750 			/*
4751 			 * The ire cache entry we're adding is for the
4752 			 * gateway itself.  The source address in this case
4753 			 * is relative to the gateway's address.
4754 			 */
4755 			ip6_asp_table_held = B_TRUE;
4756 			src_ipif = ipif_select_source_v6(dst_ill, &v6gw,
4757 			    RESTRICT_TO_GROUP, IPV6_PREFER_SRC_DEFAULT, zoneid);
4758 			if (src_ipif != NULL)
4759 				ire_marks |= IRE_MARK_USESRC_CHECK;
4760 		} else {
4761 			if ((sire != NULL) && (sire->ire_flags & RTF_SETSRC)) {
4762 				/*
4763 				 * Check that the ipif matching the requested
4764 				 * source address still exists.
4765 				 */
4766 				src_ipif = ipif_lookup_addr_v6(
4767 				    &sire->ire_src_addr_v6, NULL, zoneid,
4768 					NULL, NULL, NULL, NULL);
4769 			}
4770 			if (src_ipif == NULL && ip6_asp_can_lookup()) {
4771 				ip6_asp_table_held = B_TRUE;
4772 				src_ipif = ipif_select_source_v6(dst_ill,
4773 				    v6dstp, RESTRICT_TO_NONE,
4774 				    IPV6_PREFER_SRC_DEFAULT, zoneid);
4775 				if (src_ipif != NULL)
4776 					ire_marks |= IRE_MARK_USESRC_CHECK;
4777 			}
4778 		}
4779 
4780 		if (src_ipif == NULL) {
4781 			if (ip_debug > 2) {
4782 				/* ip1dbg */
4783 				pr_addr_dbg("ip_newroute_v6: no src for "
4784 				    "dst %s\n, ", AF_INET6, v6dstp);
4785 				printf("ip_newroute_v6: interface name %s\n",
4786 				    dst_ill->ill_name);
4787 			}
4788 			goto icmp_err_ret;
4789 		}
4790 
4791 		if (ip_debug > 3) {
4792 			/* ip2dbg */
4793 			pr_addr_dbg("ip_newroute_v6: first hop %s\n",
4794 			    AF_INET6, &v6gw);
4795 		}
4796 		ip2dbg(("\tire type %s (%d)\n",
4797 		    ip_nv_lookup(ire_nv_tbl, ire->ire_type), ire->ire_type));
4798 
4799 		/*
4800 		 * At this point in ip_newroute_v6(), ire is either the
4801 		 * IRE_CACHE of the next-hop gateway for an off-subnet
4802 		 * destination or an IRE_INTERFACE type that should be used
4803 		 * to resolve an on-subnet destination or an on-subnet
4804 		 * next-hop gateway.
4805 		 *
4806 		 * In the IRE_CACHE case, we have the following :
4807 		 *
4808 		 * 1) src_ipif - used for getting a source address.
4809 		 *
4810 		 * 2) dst_ill - from which we derive ire_stq/ire_rfq. This
4811 		 *    means packets using this IRE_CACHE will go out on dst_ill.
4812 		 *
4813 		 * 3) The IRE sire will point to the prefix that is the longest
4814 		 *    matching route for the destination. These prefix types
4815 		 *    include IRE_DEFAULT, IRE_PREFIX, IRE_HOST, and
4816 		 *    IRE_HOST_REDIRECT.
4817 		 *
4818 		 *    The newly created IRE_CACHE entry for the off-subnet
4819 		 *    destination is tied to both the prefix route and the
4820 		 *    interface route used to resolve the next-hop gateway
4821 		 *    via the ire_phandle and ire_ihandle fields, respectively.
4822 		 *
4823 		 * In the IRE_INTERFACE case, we have the following :
4824 		 *
4825 		 * 1) src_ipif - used for getting a source address.
4826 		 *
4827 		 * 2) dst_ill - from which we derive ire_stq/ire_rfq. This
4828 		 *    means packets using the IRE_CACHE that we will build
4829 		 *    here will go out on dst_ill.
4830 		 *
4831 		 * 3) sire may or may not be NULL. But, the IRE_CACHE that is
4832 		 *    to be created will only be tied to the IRE_INTERFACE that
4833 		 *    was derived from the ire_ihandle field.
4834 		 *
4835 		 *    If sire is non-NULL, it means the destination is off-link
4836 		 *    and we will first create the IRE_CACHE for the gateway.
4837 		 *    Next time through ip_newroute_v6, we will create the
4838 		 *    IRE_CACHE for the final destination as described above.
4839 		 */
4840 		save_ire = ire;
4841 		switch (ire->ire_type) {
4842 		case IRE_CACHE: {
4843 			ire_t	*ipif_ire;
4844 
4845 			ASSERT(sire != NULL);
4846 			if (IN6_IS_ADDR_UNSPECIFIED(&v6gw)) {
4847 				mutex_enter(&ire->ire_lock);
4848 				v6gw = ire->ire_gateway_addr_v6;
4849 				mutex_exit(&ire->ire_lock);
4850 			}
4851 			/*
4852 			 * We need 3 ire's to create a new cache ire for an
4853 			 * off-link destination from the cache ire of the
4854 			 * gateway.
4855 			 *
4856 			 *	1. The prefix ire 'sire'
4857 			 *	2. The cache ire of the gateway 'ire'
4858 			 *	3. The interface ire 'ipif_ire'
4859 			 *
4860 			 * We have (1) and (2). We lookup (3) below.
4861 			 *
4862 			 * If there is no interface route to the gateway,
4863 			 * it is a race condition, where we found the cache
4864 			 * but the inteface route has been deleted.
4865 			 */
4866 			ipif_ire = ire_ihandle_lookup_offlink_v6(ire, sire);
4867 			if (ipif_ire == NULL) {
4868 				ip1dbg(("ip_newroute_v6:"
4869 				    "ire_ihandle_lookup_offlink_v6 failed\n"));
4870 				goto icmp_err_ret;
4871 			}
4872 			/*
4873 			 * Assume DL_UNITDATA_REQ is same for all physical
4874 			 * interfaces in the ifgrp.  If it isn't, this code will
4875 			 * have to be seriously rewhacked to allow the
4876 			 * fastpath probing (such that I cache the link
4877 			 * header in the IRE_CACHE) to work over ifgrps.
4878 			 * We have what we need to build an IRE_CACHE.
4879 			 */
4880 			/*
4881 			 * Note: the new ire inherits RTF_SETSRC
4882 			 * and RTF_MULTIRT to propagate these flags from prefix
4883 			 * to cache.
4884 			 */
4885 
4886 			/*
4887 			 * Check cached gateway IRE for any security
4888 			 * attributes; if found, associate the gateway
4889 			 * credentials group to the destination IRE.
4890 			 */
4891 			if ((attrp = save_ire->ire_gw_secattr) != NULL) {
4892 				mutex_enter(&attrp->igsa_lock);
4893 				if ((gcgrp = attrp->igsa_gcgrp) != NULL)
4894 					GCGRP_REFHOLD(gcgrp);
4895 				mutex_exit(&attrp->igsa_lock);
4896 			}
4897 
4898 			ire = ire_create_v6(
4899 				v6dstp,			/* dest address */
4900 				&ipv6_all_ones,		/* mask */
4901 				&src_ipif->ipif_v6src_addr, /* source address */
4902 				&v6gw,			/* gateway address */
4903 				&save_ire->ire_max_frag,
4904 				NULL,			/* Fast Path header */
4905 				dst_ill->ill_rq,	/* recv-from queue */
4906 				dst_ill->ill_wq,	/* send-to queue */
4907 				IRE_CACHE,
4908 				NULL,
4909 				src_ipif,
4910 				&sire->ire_mask_v6,	/* Parent mask */
4911 				sire->ire_phandle,	/* Parent handle */
4912 				ipif_ire->ire_ihandle,	/* Interface handle */
4913 				sire->ire_flags &	/* flags if any */
4914 				    (RTF_SETSRC | RTF_MULTIRT),
4915 				&(sire->ire_uinfo),
4916 				NULL,
4917 				gcgrp);
4918 
4919 			if (ire == NULL) {
4920 				if (gcgrp != NULL) {
4921 					GCGRP_REFRELE(gcgrp);
4922 					gcgrp = NULL;
4923 				}
4924 				ire_refrele(save_ire);
4925 				ire_refrele(ipif_ire);
4926 				break;
4927 			}
4928 
4929 			/* reference now held by IRE */
4930 			gcgrp = NULL;
4931 
4932 			ire->ire_marks |= ire_marks;
4933 
4934 			/*
4935 			 * Prevent sire and ipif_ire from getting deleted. The
4936 			 * newly created ire is tied to both of them via the
4937 			 * phandle and ihandle respectively.
4938 			 */
4939 			IRB_REFHOLD(sire->ire_bucket);
4940 			/* Has it been removed already ? */
4941 			if (sire->ire_marks & IRE_MARK_CONDEMNED) {
4942 				IRB_REFRELE(sire->ire_bucket);
4943 				ire_refrele(ipif_ire);
4944 				ire_refrele(save_ire);
4945 				break;
4946 			}
4947 
4948 			IRB_REFHOLD(ipif_ire->ire_bucket);
4949 			/* Has it been removed already ? */
4950 			if (ipif_ire->ire_marks & IRE_MARK_CONDEMNED) {
4951 				IRB_REFRELE(ipif_ire->ire_bucket);
4952 				IRB_REFRELE(sire->ire_bucket);
4953 				ire_refrele(ipif_ire);
4954 				ire_refrele(save_ire);
4955 				break;
4956 			}
4957 
4958 			xmit_mp = first_mp;
4959 			if (ire->ire_flags & RTF_MULTIRT) {
4960 				copy_mp = copymsg(first_mp);
4961 				if (copy_mp != NULL) {
4962 					xmit_mp = copy_mp;
4963 					MULTIRT_DEBUG_TAG(first_mp);
4964 				}
4965 			}
4966 			ire_add_then_send(q, ire, xmit_mp);
4967 			if (ip6_asp_table_held) {
4968 				ip6_asp_table_refrele();
4969 				ip6_asp_table_held = B_FALSE;
4970 			}
4971 			ire_refrele(save_ire);
4972 
4973 			/* Assert that sire is not deleted yet. */
4974 			ASSERT(sire->ire_ptpn != NULL);
4975 			IRB_REFRELE(sire->ire_bucket);
4976 
4977 			/* Assert that ipif_ire is not deleted yet. */
4978 			ASSERT(ipif_ire->ire_ptpn != NULL);
4979 			IRB_REFRELE(ipif_ire->ire_bucket);
4980 			ire_refrele(ipif_ire);
4981 
4982 			if (copy_mp != NULL) {
4983 				/*
4984 				 * Search for the next unresolved
4985 				 * multirt route.
4986 				 */
4987 				copy_mp = NULL;
4988 				ipif_ire = NULL;
4989 				ire = NULL;
4990 				/* re-enter the loop */
4991 				multirt_resolve_next = B_TRUE;
4992 				continue;
4993 			}
4994 			ire_refrele(sire);
4995 			ill_refrele(dst_ill);
4996 			ipif_refrele(src_ipif);
4997 			return;
4998 		}
4999 		case IRE_IF_NORESOLVER:
5000 			/*
5001 			 * We have what we need to build an IRE_CACHE.
5002 			 *
5003 			 * Create a new dlureq_mp with the IPv6 gateway
5004 			 * address in destination address in the DLPI hdr
5005 			 * if the physical length is exactly 16 bytes.
5006 			 */
5007 			if (dst_ill->ill_phys_addr_length == IPV6_ADDR_LEN) {
5008 				const in6_addr_t *addr;
5009 
5010 				if (!IN6_IS_ADDR_UNSPECIFIED(&v6gw))
5011 					addr = &v6gw;
5012 				else
5013 					addr = v6dstp;
5014 
5015 				dlureq_mp = ill_dlur_gen((uchar_t *)addr,
5016 				    dst_ill->ill_phys_addr_length,
5017 				    dst_ill->ill_sap,
5018 				    dst_ill->ill_sap_length);
5019 			} else {
5020 				dlureq_mp = ire->ire_dlureq_mp;
5021 			}
5022 			if (dlureq_mp == NULL)
5023 				break;
5024 			/*
5025 			 * TSol note: We are creating the ire cache for the
5026 			 * destination 'dst'. If 'dst' is offlink, going
5027 			 * through the first hop 'gw', the security attributes
5028 			 * of 'dst' must be set to point to the gateway
5029 			 * credentials of gateway 'gw'. If 'dst' is onlink, it
5030 			 * is possible that 'dst' is a potential gateway that is
5031 			 * referenced by some route that has some security
5032 			 * attributes. Thus in the former case, we need to do a
5033 			 * gcgrp_lookup of 'gw' while in the latter case we
5034 			 * need to do gcgrp_lookup of 'dst' itself.
5035 			 */
5036 			ga.ga_af = AF_INET6;
5037 			if (!IN6_IS_ADDR_UNSPECIFIED(&v6gw))
5038 				ga.ga_addr = v6gw;
5039 			else
5040 				ga.ga_addr = *v6dstp;
5041 			gcgrp = gcgrp_lookup(&ga, B_FALSE);
5042 
5043 			/*
5044 			 * Note: the new ire inherits sire flags RTF_SETSRC
5045 			 * and RTF_MULTIRT to propagate those rules from prefix
5046 			 * to cache.
5047 			 */
5048 			ire = ire_create_v6(
5049 				v6dstp,			/* dest address */
5050 				&ipv6_all_ones,		/* mask */
5051 				&src_ipif->ipif_v6src_addr, /* source address */
5052 				&v6gw,			/* gateway address */
5053 				&save_ire->ire_max_frag,
5054 				NULL,			/* Fast Path header */
5055 				dst_ill->ill_rq,	/* recv-from queue */
5056 				dst_ill->ill_wq,	/* send-to queue */
5057 				IRE_CACHE,
5058 				dlureq_mp,
5059 				src_ipif,
5060 				&save_ire->ire_mask_v6,	/* Parent mask */
5061 				(sire != NULL) ?	/* Parent handle */
5062 				    sire->ire_phandle : 0,
5063 				save_ire->ire_ihandle,	/* Interface handle */
5064 				(sire != NULL) ?	/* flags if any */
5065 				    sire->ire_flags &
5066 				    (RTF_SETSRC | RTF_MULTIRT) : 0,
5067 				&(save_ire->ire_uinfo),
5068 				NULL,
5069 				gcgrp);
5070 
5071 			if (dst_ill->ill_phys_addr_length == IPV6_ADDR_LEN)
5072 				freeb(dlureq_mp);
5073 
5074 			if (ire == NULL) {
5075 				if (gcgrp != NULL) {
5076 					GCGRP_REFRELE(gcgrp);
5077 					gcgrp = NULL;
5078 				}
5079 				ire_refrele(save_ire);
5080 				break;
5081 			}
5082 
5083 			/* reference now held by IRE */
5084 			gcgrp = NULL;
5085 
5086 			ire->ire_marks |= ire_marks;
5087 
5088 			if (!IN6_IS_ADDR_UNSPECIFIED(&v6gw))
5089 				dst = v6gw;
5090 			else
5091 				dst = *v6dstp;
5092 			err = ndp_noresolver(dst_ill, &dst);
5093 			if (err != 0) {
5094 				ire_refrele(save_ire);
5095 				break;
5096 			}
5097 
5098 			/* Prevent save_ire from getting deleted */
5099 			IRB_REFHOLD(save_ire->ire_bucket);
5100 			/* Has it been removed already ? */
5101 			if (save_ire->ire_marks & IRE_MARK_CONDEMNED) {
5102 				IRB_REFRELE(save_ire->ire_bucket);
5103 				ire_refrele(save_ire);
5104 				break;
5105 			}
5106 
5107 			xmit_mp = first_mp;
5108 			/*
5109 			 * In case of MULTIRT, a copy of the current packet
5110 			 * to send is made to further re-enter the
5111 			 * loop and attempt another route resolution
5112 			 */
5113 			if ((sire != NULL) && sire->ire_flags & RTF_MULTIRT) {
5114 				copy_mp = copymsg(first_mp);
5115 				if (copy_mp != NULL) {
5116 					xmit_mp = copy_mp;
5117 					MULTIRT_DEBUG_TAG(first_mp);
5118 				}
5119 			}
5120 			ire_add_then_send(q, ire, xmit_mp);
5121 			if (ip6_asp_table_held) {
5122 				ip6_asp_table_refrele();
5123 				ip6_asp_table_held = B_FALSE;
5124 			}
5125 
5126 			/* Assert that it is not deleted yet. */
5127 			ASSERT(save_ire->ire_ptpn != NULL);
5128 			IRB_REFRELE(save_ire->ire_bucket);
5129 			ire_refrele(save_ire);
5130 
5131 			if (copy_mp != NULL) {
5132 				/*
5133 				 * If we found a (no)resolver, we ignore any
5134 				 * trailing top priority IRE_CACHE in
5135 				 * further loops. This ensures that we do not
5136 				 * omit any (no)resolver despite the priority
5137 				 * in this call.
5138 				 * IRE_CACHE, if any, will be processed
5139 				 * by another thread entering ip_newroute(),
5140 				 * (on resolver response, for example).
5141 				 * We use this to force multiple parallel
5142 				 * resolution as soon as a packet needs to be
5143 				 * sent. The result is, after one packet
5144 				 * emission all reachable routes are generally
5145 				 * resolved.
5146 				 * Otherwise, complete resolution of MULTIRT
5147 				 * routes would require several emissions as
5148 				 * side effect.
5149 				 */
5150 				multirt_flags &= ~MULTIRT_CACHEGW;
5151 
5152 				/*
5153 				 * Search for the next unresolved multirt
5154 				 * route.
5155 				 */
5156 				copy_mp = NULL;
5157 				save_ire = NULL;
5158 				ire = NULL;
5159 				/* re-enter the loop */
5160 				multirt_resolve_next = B_TRUE;
5161 				continue;
5162 			}
5163 
5164 			/* Don't need sire anymore */
5165 			if (sire != NULL)
5166 				ire_refrele(sire);
5167 			ill_refrele(dst_ill);
5168 			ipif_refrele(src_ipif);
5169 			return;
5170 
5171 		case IRE_IF_RESOLVER:
5172 			/*
5173 			 * We can't build an IRE_CACHE yet, but at least we
5174 			 * found a resolver that can help.
5175 			 */
5176 			dst = *v6dstp;
5177 
5178 			/*
5179 			 * To be at this point in the code with a non-zero gw
5180 			 * means that dst is reachable through a gateway that
5181 			 * we have never resolved.  By changing dst to the gw
5182 			 * addr we resolve the gateway first.  When
5183 			 * ire_add_then_send() tries to put the IP dg to dst,
5184 			 * it will reenter ip_newroute() at which time we will
5185 			 * find the IRE_CACHE for the gw and create another
5186 			 * IRE_CACHE above (for dst itself).
5187 			 */
5188 			if (!IN6_IS_ADDR_UNSPECIFIED(&v6gw)) {
5189 				save_dst = dst;
5190 				dst = v6gw;
5191 				v6gw = ipv6_all_zeros;
5192 			}
5193 			/*
5194 			 * TSol note: Please see the note above the
5195 			 * IRE_IF_NORESOLVER case.
5196 			 */
5197 			ga.ga_af = AF_INET6;
5198 			ga.ga_addr = dst;
5199 			gcgrp = gcgrp_lookup(&ga, B_FALSE);
5200 			if (dst_ill->ill_flags & ILLF_XRESOLV) {
5201 				/*
5202 				 * Ask the external resolver to do its thing.
5203 				 * Make an mblk chain in the following form:
5204 				 * ARQ_REQ_MBLK-->IRE_MBLK-->packet
5205 				 */
5206 				mblk_t		*ire_mp;
5207 				mblk_t		*areq_mp;
5208 				areq_t		*areq;
5209 				in6_addr_t	*addrp;
5210 
5211 				ip1dbg(("ip_newroute_v6:ILLF_XRESOLV\n"));
5212 				if (ip6_asp_table_held) {
5213 					ip6_asp_table_refrele();
5214 					ip6_asp_table_held = B_FALSE;
5215 				}
5216 				ire = ire_create_mp_v6(
5217 					&dst,		/* dest address */
5218 					&ipv6_all_ones,	/* mask */
5219 					&src_ipif->ipif_v6src_addr,
5220 							/* source address */
5221 					&v6gw,		/* gateway address */
5222 					NULL,		/* Fast Path header */
5223 					dst_ill->ill_rq, /* recv-from queue */
5224 					dst_ill->ill_wq, /* send-to queue */
5225 					IRE_CACHE,
5226 					NULL,
5227 					src_ipif,
5228 					&save_ire->ire_mask_v6,
5229 							/* Parent mask */
5230 					0,
5231 					save_ire->ire_ihandle,
5232 							/* Interface handle */
5233 					0,		/* flags if any */
5234 					&(save_ire->ire_uinfo),
5235 					NULL,
5236 					gcgrp);
5237 
5238 				ire_refrele(save_ire);
5239 				if (ire == NULL) {
5240 					if (gcgrp != NULL) {
5241 						GCGRP_REFRELE(gcgrp);
5242 						gcgrp = NULL;
5243 					}
5244 					ip1dbg(("ip_newroute_v6:"
5245 					    "ire is NULL\n"));
5246 					break;
5247 				}
5248 
5249 				/* reference now held by IRE */
5250 				gcgrp = NULL;
5251 
5252 				if ((sire != NULL) &&
5253 				    (sire->ire_flags & RTF_MULTIRT)) {
5254 					/*
5255 					 * processing a copy of the packet to
5256 					 * send for further resolution loops
5257 					 */
5258 					copy_mp = copymsg(first_mp);
5259 					if (copy_mp != NULL)
5260 						MULTIRT_DEBUG_TAG(copy_mp);
5261 				}
5262 				ire->ire_marks |= ire_marks;
5263 				ire_mp = ire->ire_mp;
5264 				/*
5265 				 * Now create or find an nce for this interface.
5266 				 * The hw addr will need to to be set from
5267 				 * the reply to the AR_ENTRY_QUERY that
5268 				 * we're about to send. This will be done in
5269 				 * ire_add_v6().
5270 				 */
5271 				err = ndp_resolver(dst_ill, &dst, mp, zoneid);
5272 				switch (err) {
5273 				case 0:
5274 					/*
5275 					 * New cache entry created.
5276 					 * Break, then ask the external
5277 					 * resolver.
5278 					 */
5279 					break;
5280 				case EINPROGRESS:
5281 					/*
5282 					 * Resolution in progress;
5283 					 * packet has been queued by
5284 					 * ndp_resolver().
5285 					 */
5286 					ire_delete(ire);
5287 					ire = NULL;
5288 					/*
5289 					 * Check if another multirt
5290 					 * route must be resolved.
5291 					 */
5292 					if (copy_mp != NULL) {
5293 						/*
5294 						 * If we found a resolver, we
5295 						 * ignore any trailing top
5296 						 * priority IRE_CACHE in
5297 						 * further loops. The reason is
5298 						 * the same as for noresolver.
5299 						 */
5300 						multirt_flags &=
5301 						    ~MULTIRT_CACHEGW;
5302 						/*
5303 						 * Search for the next
5304 						 * unresolved multirt route.
5305 						 */
5306 						first_mp = copy_mp;
5307 						copy_mp = NULL;
5308 						mp = first_mp;
5309 						if (mp->b_datap->db_type ==
5310 						    M_CTL) {
5311 							mp = mp->b_cont;
5312 						}
5313 						ASSERT(sire != NULL);
5314 						dst = save_dst;
5315 						/*
5316 						 * re-enter the loop
5317 						 */
5318 						multirt_resolve_next =
5319 						    B_TRUE;
5320 						continue;
5321 					}
5322 
5323 					if (sire != NULL)
5324 						ire_refrele(sire);
5325 					ill_refrele(dst_ill);
5326 					ipif_refrele(src_ipif);
5327 					return;
5328 				default:
5329 					/*
5330 					 * Transient error; packet will be
5331 					 * freed.
5332 					 */
5333 					ire_delete(ire);
5334 					ire = NULL;
5335 					break;
5336 				}
5337 				if (err != 0)
5338 					break;
5339 				/*
5340 				 * Now set up the AR_ENTRY_QUERY and send it.
5341 				 */
5342 				areq_mp = ill_arp_alloc(dst_ill,
5343 				    (uchar_t *)&ipv6_areq_template,
5344 				    (caddr_t)&dst);
5345 				if (areq_mp == NULL) {
5346 					ip1dbg(("ip_newroute_v6:"
5347 					    "areq_mp is NULL\n"));
5348 					freemsg(ire_mp);
5349 					break;
5350 				}
5351 				areq = (areq_t *)areq_mp->b_rptr;
5352 				addrp = (in6_addr_t *)((char *)areq +
5353 				    areq->areq_target_addr_offset);
5354 				*addrp = dst;
5355 				addrp = (in6_addr_t *)((char *)areq +
5356 				    areq->areq_sender_addr_offset);
5357 				*addrp = src_ipif->ipif_v6src_addr;
5358 				/*
5359 				 * link the chain, then send up to the resolver.
5360 				 */
5361 				linkb(areq_mp, ire_mp);
5362 				linkb(areq_mp, mp);
5363 				ip1dbg(("ip_newroute_v6:"
5364 				    "putnext to resolver\n"));
5365 				putnext(dst_ill->ill_rq, areq_mp);
5366 				/*
5367 				 * Check if another multirt route
5368 				 * must be resolved.
5369 				 */
5370 				ire = NULL;
5371 				if (copy_mp != NULL) {
5372 					/*
5373 					 * If we find a resolver, we ignore any
5374 					 * trailing top priority IRE_CACHE in
5375 					 * further loops. The reason is the
5376 					 * same as for noresolver.
5377 					 */
5378 					multirt_flags &= ~MULTIRT_CACHEGW;
5379 					/*
5380 					 * Search for the next unresolved
5381 					 * multirt route.
5382 					 */
5383 					first_mp = copy_mp;
5384 					copy_mp = NULL;
5385 					mp = first_mp;
5386 					if (mp->b_datap->db_type == M_CTL) {
5387 						mp = mp->b_cont;
5388 					}
5389 					ASSERT(sire != NULL);
5390 					dst = save_dst;
5391 					/*
5392 					 * re-enter the loop
5393 					 */
5394 					multirt_resolve_next = B_TRUE;
5395 					continue;
5396 				}
5397 
5398 				if (sire != NULL)
5399 					ire_refrele(sire);
5400 				ill_refrele(dst_ill);
5401 				ipif_refrele(src_ipif);
5402 				return;
5403 			}
5404 			/*
5405 			 * Non-external resolver case.
5406 			 */
5407 			ire = ire_create_v6(
5408 				&dst,			/* dest address */
5409 				&ipv6_all_ones,		/* mask */
5410 				&src_ipif->ipif_v6src_addr, /* source address */
5411 				&v6gw,			/* gateway address */
5412 				&save_ire->ire_max_frag,
5413 				NULL,			/* Fast Path header */
5414 				dst_ill->ill_rq,	/* recv-from queue */
5415 				dst_ill->ill_wq,	/* send-to queue */
5416 				IRE_CACHE,
5417 				NULL,
5418 				src_ipif,
5419 				&save_ire->ire_mask_v6,	/* Parent mask */
5420 				0,
5421 				save_ire->ire_ihandle,	/* Interface handle */
5422 				0,			/* flags if any */
5423 				&(save_ire->ire_uinfo),
5424 				NULL,
5425 				gcgrp);
5426 
5427 			if (ire == NULL) {
5428 				if (gcgrp != NULL) {
5429 					GCGRP_REFRELE(gcgrp);
5430 					gcgrp = NULL;
5431 				}
5432 				ire_refrele(save_ire);
5433 				break;
5434 			}
5435 
5436 			/* reference now held by IRE */
5437 			gcgrp = NULL;
5438 
5439 			if ((sire != NULL) &&
5440 			    (sire->ire_flags & RTF_MULTIRT)) {
5441 				copy_mp = copymsg(first_mp);
5442 				if (copy_mp != NULL)
5443 					MULTIRT_DEBUG_TAG(copy_mp);
5444 			}
5445 
5446 			ire->ire_marks |= ire_marks;
5447 			err = ndp_resolver(dst_ill, &dst, first_mp, zoneid);
5448 			switch (err) {
5449 			case 0:
5450 				/* Prevent save_ire from getting deleted */
5451 				IRB_REFHOLD(save_ire->ire_bucket);
5452 				/* Has it been removed already ? */
5453 				if (save_ire->ire_marks & IRE_MARK_CONDEMNED) {
5454 					IRB_REFRELE(save_ire->ire_bucket);
5455 					ire_refrele(save_ire);
5456 					break;
5457 				}
5458 
5459 				/*
5460 				 * We have a resolved cache entry,
5461 				 * add in the IRE.
5462 				 */
5463 				ire_add_then_send(q, ire, first_mp);
5464 				if (ip6_asp_table_held) {
5465 					ip6_asp_table_refrele();
5466 					ip6_asp_table_held = B_FALSE;
5467 				}
5468 
5469 				/* Assert that it is not deleted yet. */
5470 				ASSERT(save_ire->ire_ptpn != NULL);
5471 				IRB_REFRELE(save_ire->ire_bucket);
5472 				ire_refrele(save_ire);
5473 				/*
5474 				 * Check if another multirt route
5475 				 * must be resolved.
5476 				 */
5477 				ire = NULL;
5478 				if (copy_mp != NULL) {
5479 					/*
5480 					 * If we find a resolver, we ignore any
5481 					 * trailing top priority IRE_CACHE in
5482 					 * further loops. The reason is the
5483 					 * same as for noresolver.
5484 					 */
5485 					multirt_flags &= ~MULTIRT_CACHEGW;
5486 					/*
5487 					 * Search for the next unresolved
5488 					 * multirt route.
5489 					 */
5490 					first_mp = copy_mp;
5491 					copy_mp = NULL;
5492 					mp = first_mp;
5493 					if (mp->b_datap->db_type == M_CTL) {
5494 						mp = mp->b_cont;
5495 					}
5496 					ASSERT(sire != NULL);
5497 					dst = save_dst;
5498 					/*
5499 					 * re-enter the loop
5500 					 */
5501 					multirt_resolve_next = B_TRUE;
5502 					continue;
5503 				}
5504 
5505 				if (sire != NULL)
5506 					ire_refrele(sire);
5507 				ill_refrele(dst_ill);
5508 				ipif_refrele(src_ipif);
5509 				return;
5510 
5511 			case EINPROGRESS:
5512 				/*
5513 				 * mp was consumed - presumably queued.
5514 				 * No need for ire, presumably resolution is
5515 				 * in progress, and ire will be added when the
5516 				 * address is resolved.
5517 				 */
5518 				if (ip6_asp_table_held) {
5519 					ip6_asp_table_refrele();
5520 					ip6_asp_table_held = B_FALSE;
5521 				}
5522 				ASSERT(ire->ire_nce == NULL);
5523 				ire_delete(ire);
5524 				ire_refrele(save_ire);
5525 				/*
5526 				 * Check if another multirt route
5527 				 * must be resolved.
5528 				 */
5529 				ire = NULL;
5530 				if (copy_mp != NULL) {
5531 					/*
5532 					 * If we find a resolver, we ignore any
5533 					 * trailing top priority IRE_CACHE in
5534 					 * further loops. The reason is the
5535 					 * same as for noresolver.
5536 					 */
5537 					multirt_flags &= ~MULTIRT_CACHEGW;
5538 					/*
5539 					 * Search for the next unresolved
5540 					 * multirt route.
5541 					 */
5542 					first_mp = copy_mp;
5543 					copy_mp = NULL;
5544 					mp = first_mp;
5545 					if (mp->b_datap->db_type == M_CTL) {
5546 						mp = mp->b_cont;
5547 					}
5548 					ASSERT(sire != NULL);
5549 					dst = save_dst;
5550 					/*
5551 					 * re-enter the loop
5552 					 */
5553 					multirt_resolve_next = B_TRUE;
5554 					continue;
5555 				}
5556 				if (sire != NULL)
5557 					ire_refrele(sire);
5558 				ill_refrele(dst_ill);
5559 				ipif_refrele(src_ipif);
5560 				return;
5561 			default:
5562 				/* Some transient error */
5563 				ASSERT(ire->ire_nce == NULL);
5564 				ire_refrele(save_ire);
5565 				break;
5566 			}
5567 			break;
5568 		default:
5569 			break;
5570 		}
5571 		if (ip6_asp_table_held) {
5572 			ip6_asp_table_refrele();
5573 			ip6_asp_table_held = B_FALSE;
5574 		}
5575 	} while (multirt_resolve_next);
5576 
5577 err_ret:
5578 	ip1dbg(("ip_newroute_v6: dropped\n"));
5579 	if (src_ipif != NULL)
5580 		ipif_refrele(src_ipif);
5581 	if (dst_ill != NULL) {
5582 		need_rele = B_TRUE;
5583 		ill = dst_ill;
5584 	}
5585 	if (ill != NULL) {
5586 		if (mp->b_prev != NULL) {
5587 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
5588 		} else {
5589 			BUMP_MIB(ill->ill_ip6_mib, ipv6OutDiscards);
5590 		}
5591 
5592 		if (need_rele)
5593 			ill_refrele(ill);
5594 	} else {
5595 		if (mp->b_prev != NULL) {
5596 			BUMP_MIB(&ip6_mib, ipv6InDiscards);
5597 		} else {
5598 			BUMP_MIB(&ip6_mib, ipv6OutDiscards);
5599 		}
5600 	}
5601 	/* Did this packet originate externally? */
5602 	if (mp->b_prev) {
5603 		mp->b_next = NULL;
5604 		mp->b_prev = NULL;
5605 	}
5606 	if (copy_mp != NULL) {
5607 		MULTIRT_DEBUG_UNTAG(copy_mp);
5608 		freemsg(copy_mp);
5609 	}
5610 	MULTIRT_DEBUG_UNTAG(first_mp);
5611 	freemsg(first_mp);
5612 	if (ire != NULL)
5613 		ire_refrele(ire);
5614 	if (sire != NULL)
5615 		ire_refrele(sire);
5616 	return;
5617 
5618 icmp_err_ret:
5619 	if (ip6_asp_table_held)
5620 		ip6_asp_table_refrele();
5621 	if (src_ipif != NULL)
5622 		ipif_refrele(src_ipif);
5623 	if (dst_ill != NULL) {
5624 		need_rele = B_TRUE;
5625 		ill = dst_ill;
5626 	}
5627 	ip1dbg(("ip_newroute_v6: no route\n"));
5628 	if (sire != NULL)
5629 		ire_refrele(sire);
5630 	/*
5631 	 * We need to set sire to NULL to avoid double freeing if we
5632 	 * ever goto err_ret from below.
5633 	 */
5634 	sire = NULL;
5635 	ip6h = (ip6_t *)mp->b_rptr;
5636 	/* Skip ip6i_t header if present */
5637 	if (ip6h->ip6_nxt == IPPROTO_RAW) {
5638 		/* Make sure the IPv6 header is present */
5639 		if ((mp->b_wptr - (uchar_t *)ip6h) <
5640 		    sizeof (ip6i_t) + IPV6_HDR_LEN) {
5641 			if (!pullupmsg(mp, sizeof (ip6i_t) + IPV6_HDR_LEN)) {
5642 				ip1dbg(("ip_newroute_v6: pullupmsg failed\n"));
5643 				goto err_ret;
5644 			}
5645 		}
5646 		mp->b_rptr += sizeof (ip6i_t);
5647 		ip6h = (ip6_t *)mp->b_rptr;
5648 	}
5649 	/* Did this packet originate externally? */
5650 	if (mp->b_prev) {
5651 		if (ill != NULL) {
5652 			BUMP_MIB(ill->ill_ip6_mib, ipv6InNoRoutes);
5653 		} else {
5654 			BUMP_MIB(&ip6_mib, ipv6InNoRoutes);
5655 		}
5656 		mp->b_next = NULL;
5657 		mp->b_prev = NULL;
5658 		q = WR(q);
5659 	} else {
5660 		if (ill != NULL) {
5661 			BUMP_MIB(ill->ill_ip6_mib, ipv6OutNoRoutes);
5662 		} else {
5663 			BUMP_MIB(&ip6_mib, ipv6OutNoRoutes);
5664 		}
5665 		if (ip_hdr_complete_v6(ip6h, zoneid)) {
5666 			/* Failed */
5667 			if (copy_mp != NULL) {
5668 				MULTIRT_DEBUG_UNTAG(copy_mp);
5669 				freemsg(copy_mp);
5670 			}
5671 			MULTIRT_DEBUG_UNTAG(first_mp);
5672 			freemsg(first_mp);
5673 			if (ire != NULL)
5674 				ire_refrele(ire);
5675 			if (need_rele)
5676 				ill_refrele(ill);
5677 			return;
5678 		}
5679 	}
5680 
5681 	if (need_rele)
5682 		ill_refrele(ill);
5683 
5684 	/*
5685 	 * At this point we will have ire only if RTF_BLACKHOLE
5686 	 * or RTF_REJECT flags are set on the IRE. It will not
5687 	 * generate ICMP6_DST_UNREACH_NOROUTE if RTF_BLACKHOLE is set.
5688 	 */
5689 	if (ire != NULL) {
5690 		if (ire->ire_flags & RTF_BLACKHOLE) {
5691 			ire_refrele(ire);
5692 			if (copy_mp != NULL) {
5693 				MULTIRT_DEBUG_UNTAG(copy_mp);
5694 				freemsg(copy_mp);
5695 			}
5696 			MULTIRT_DEBUG_UNTAG(first_mp);
5697 			freemsg(first_mp);
5698 			return;
5699 		}
5700 		ire_refrele(ire);
5701 	}
5702 	if (ip_debug > 3) {
5703 		/* ip2dbg */
5704 		pr_addr_dbg("ip_newroute_v6: no route to %s\n",
5705 		    AF_INET6, v6dstp);
5706 	}
5707 	icmp_unreachable_v6(WR(q), first_mp, ICMP6_DST_UNREACH_NOROUTE,
5708 	    B_FALSE, B_FALSE);
5709 }
5710 
5711 /*
5712  * ip_newroute_ipif_v6 is called by ip_wput_v6 and ip_wput_ipsec_out_v6 whenever
5713  * we need to send out a packet to a destination address for which we do not
5714  * have specific routing information. It is only used for multicast packets.
5715  *
5716  * If unspec_src we allow creating an IRE with source address zero.
5717  * ire_send_v6() will delete it after the packet is sent.
5718  */
5719 void
5720 ip_newroute_ipif_v6(queue_t *q, mblk_t *mp, ipif_t *ipif,
5721     in6_addr_t v6dst, int unspec_src, zoneid_t zoneid)
5722 {
5723 	ire_t	*ire = NULL;
5724 	ipif_t	*src_ipif = NULL;
5725 	int	err = 0;
5726 	ill_t	*dst_ill = NULL;
5727 	ire_t	*save_ire;
5728 	ushort_t ire_marks = 0;
5729 	ipsec_out_t *io;
5730 	ill_t *attach_ill = NULL;
5731 	ill_t *ill;
5732 	ip6_t *ip6h;
5733 	mblk_t *first_mp;
5734 	boolean_t ip6i_present;
5735 	ire_t *fire = NULL;
5736 	mblk_t  *copy_mp = NULL;
5737 	boolean_t multirt_resolve_next;
5738 	in6_addr_t *v6dstp = &v6dst;
5739 	boolean_t ipif_held = B_FALSE;
5740 	boolean_t ill_held = B_FALSE;
5741 	boolean_t ip6_asp_table_held = B_FALSE;
5742 
5743 	/*
5744 	 * This loop is run only once in most cases.
5745 	 * We loop to resolve further routes only when the destination
5746 	 * can be reached through multiple RTF_MULTIRT-flagged ires.
5747 	 */
5748 	do {
5749 		multirt_resolve_next = B_FALSE;
5750 		if (dst_ill != NULL) {
5751 			ill_refrele(dst_ill);
5752 			dst_ill = NULL;
5753 		}
5754 
5755 		if (src_ipif != NULL) {
5756 			ipif_refrele(src_ipif);
5757 			src_ipif = NULL;
5758 		}
5759 		ASSERT(ipif != NULL);
5760 		ill = ipif->ipif_ill;
5761 
5762 		ASSERT(!IN6_IS_ADDR_V4MAPPED(v6dstp));
5763 		if (ip_debug > 2) {
5764 			/* ip1dbg */
5765 			pr_addr_dbg("ip_newroute_ipif_v6: v6dst %s\n",
5766 			    AF_INET6, v6dstp);
5767 			printf("ip_newroute_ipif_v6: if %s, v6 %d\n",
5768 			    ill->ill_name, ipif->ipif_isv6);
5769 		}
5770 
5771 		first_mp = mp;
5772 		if (mp->b_datap->db_type == M_CTL) {
5773 			mp = mp->b_cont;
5774 			io = (ipsec_out_t *)first_mp->b_rptr;
5775 			ASSERT(io->ipsec_out_type == IPSEC_OUT);
5776 		} else {
5777 			io = NULL;
5778 		}
5779 
5780 		/*
5781 		 * If the interface is a pt-pt interface we look for an
5782 		 * IRE_IF_RESOLVER or IRE_IF_NORESOLVER that matches both the
5783 		 * local_address and the pt-pt destination address.
5784 		 * Otherwise we just match the local address.
5785 		 */
5786 		if (!(ill->ill_flags & ILLF_MULTICAST)) {
5787 			goto err_ret;
5788 		}
5789 		/*
5790 		 * If this end point is bound to IPIF_NOFAILOVER, set bnf_ill
5791 		 * and bind_to_nofailover B_TRUE. We can't use conn to determine
5792 		 * as it could be NULL.
5793 		 *
5794 		 * This information can appear either in an ip6i_t or an
5795 		 * IPSEC_OUT message.
5796 		 */
5797 		ip6h = (ip6_t *)mp->b_rptr;
5798 		ip6i_present = (ip6h->ip6_nxt == IPPROTO_RAW);
5799 		if (ip6i_present || (io != NULL && io->ipsec_out_attach_if)) {
5800 			if (!ip6i_present ||
5801 			    ((ip6i_t *)ip6h)->ip6i_flags & IP6I_ATTACH_IF) {
5802 				attach_ill = ip_grab_attach_ill(ill, first_mp,
5803 				    (ip6i_present ?
5804 					((ip6i_t *)ip6h)->ip6i_ifindex :
5805 					io->ipsec_out_ill_index), B_TRUE);
5806 				/* Failure case frees things for us. */
5807 				if (attach_ill == NULL)
5808 					return;
5809 
5810 				/*
5811 				 * Check if we need an ire that will not be
5812 				 * looked up by anybody else i.e. HIDDEN.
5813 				 */
5814 				if (ill_is_probeonly(attach_ill))
5815 					ire_marks = IRE_MARK_HIDDEN;
5816 			}
5817 		}
5818 
5819 		/*
5820 		 * We check if an IRE_OFFSUBNET for the addr that goes through
5821 		 * ipif exists. We need it to determine if the RTF_SETSRC and/or
5822 		 * RTF_MULTIRT flags must be honored.
5823 		 */
5824 		fire = ipif_lookup_multi_ire_v6(ipif, v6dstp);
5825 		ip2dbg(("ip_newroute_ipif_v6: "
5826 			"ipif_lookup_multi_ire_v6("
5827 			"ipif %p, dst %08x) = fire %p\n",
5828 			(void *)ipif, ntohl(V4_PART_OF_V6((*v6dstp))),
5829 			(void *)fire));
5830 
5831 		/*
5832 		 * If the application specified the ill (ifindex), we still
5833 		 * load spread. Only if the packets needs to go out specifically
5834 		 * on a given ill e.g. binding to IPIF_NOFAILOVER address or
5835 		 * IPV6_BOUND_PIF, or there is a parent ire entry that specified
5836 		 * multirouting, then we don't try to use a different ill for
5837 		 * load spreading.
5838 		 */
5839 		if (attach_ill == NULL) {
5840 			/*
5841 			 * If the interface belongs to an interface group,
5842 			 * make sure the next possible interface in the group
5843 			 * is used.  This encourages load spreading among peers
5844 			 * in an interface group.
5845 			 *
5846 			 * Note: While we pick a dst_ill we are really only
5847 			 * interested in the ill for load spreading. The source
5848 			 * ipif is determined by source address selection below.
5849 			 */
5850 			if ((fire != NULL) && (fire->ire_flags & RTF_MULTIRT)) {
5851 				dst_ill = ipif->ipif_ill;
5852 				/* For uniformity do a refhold */
5853 				ill_refhold(dst_ill);
5854 			} else {
5855 				/* refheld by ip_newroute_get_dst_ill_v6 */
5856 				dst_ill =
5857 				    ip_newroute_get_dst_ill_v6(ipif->ipif_ill);
5858 			}
5859 			if (dst_ill == NULL) {
5860 				if (ip_debug > 2) {
5861 					pr_addr_dbg("ip_newroute_ipif_v6: "
5862 					    "no dst ill for dst %s\n",
5863 					    AF_INET6, v6dstp);
5864 				}
5865 				goto err_ret;
5866 			}
5867 		} else {
5868 			dst_ill = ipif->ipif_ill;
5869 			/*
5870 			 * ip_wput_v6 passes the right ipif for IPIF_NOFAILOVER
5871 			 * and IPV6_BOUND_PIF case.
5872 			 */
5873 			ASSERT(dst_ill == attach_ill);
5874 			/* attach_ill is already refheld */
5875 		}
5876 		/*
5877 		 * Pick a source address which matches the scope of the
5878 		 * destination address.
5879 		 * For RTF_SETSRC routes, the source address is imposed by the
5880 		 * parent ire (fire).
5881 		 */
5882 		ASSERT(src_ipif == NULL);
5883 		if ((fire != NULL) && (fire->ire_flags & RTF_SETSRC)) {
5884 			/*
5885 			 * Check that the ipif matching the requested source
5886 			 * address still exists.
5887 			 */
5888 			src_ipif =
5889 			    ipif_lookup_addr_v6(&fire->ire_src_addr_v6,
5890 				NULL, zoneid, NULL, NULL, NULL, NULL);
5891 		}
5892 		if (src_ipif == NULL && ip6_asp_can_lookup()) {
5893 			ip6_asp_table_held = B_TRUE;
5894 			src_ipif = ipif_select_source_v6(dst_ill, v6dstp,
5895 			    RESTRICT_TO_NONE, IPV6_PREFER_SRC_DEFAULT, zoneid);
5896 		}
5897 
5898 		if (src_ipif == NULL) {
5899 			if (!unspec_src) {
5900 				if (ip_debug > 2) {
5901 					/* ip1dbg */
5902 					pr_addr_dbg("ip_newroute_ipif_v6: "
5903 					    "no src for dst %s\n,",
5904 					    AF_INET6, v6dstp);
5905 					printf(" through interface %s\n",
5906 					    dst_ill->ill_name);
5907 				}
5908 				goto err_ret;
5909 			}
5910 			/* Use any ipif for source */
5911 			for (src_ipif = dst_ill->ill_ipif; src_ipif != NULL;
5912 			    src_ipif = src_ipif->ipif_next) {
5913 				if ((src_ipif->ipif_flags & IPIF_UP) &&
5914 				    IN6_IS_ADDR_UNSPECIFIED(
5915 				    &src_ipif->ipif_v6src_addr))
5916 					break;
5917 			}
5918 			if (src_ipif == NULL) {
5919 				if (ip_debug > 2) {
5920 					/* ip1dbg */
5921 					pr_addr_dbg("ip_newroute_ipif_v6: "
5922 					    "no src for dst %s\n ",
5923 					    AF_INET6, v6dstp);
5924 					printf("ip_newroute_ipif_v6: if %s"
5925 					    "(UNSPEC_SRC)\n",
5926 					    dst_ill->ill_name);
5927 				}
5928 				goto err_ret;
5929 			}
5930 			src_ipif = ipif;
5931 			ipif_refhold(src_ipif);
5932 		}
5933 		ire = ipif_to_ire_v6(ipif);
5934 		if (ire == NULL) {
5935 			if (ip_debug > 2) {
5936 				/* ip1dbg */
5937 				pr_addr_dbg("ip_newroute_ipif_v6: v6src %s\n",
5938 				    AF_INET6, &ipif->ipif_v6lcl_addr);
5939 				printf("ip_newroute_ipif_v6: "
5940 				    "if %s\n", dst_ill->ill_name);
5941 			}
5942 			goto err_ret;
5943 		}
5944 		if (ire->ire_flags & (RTF_REJECT | RTF_BLACKHOLE))
5945 			goto err_ret;
5946 
5947 		ASSERT(ire->ire_ipversion == IPV6_VERSION);
5948 
5949 		ip1dbg(("ip_newroute_ipif_v6: interface type %s (%d),",
5950 		    ip_nv_lookup(ire_nv_tbl, ire->ire_type), ire->ire_type));
5951 		if (ip_debug > 2) {
5952 			/* ip1dbg */
5953 			pr_addr_dbg(" address %s\n",
5954 			    AF_INET6, &ire->ire_src_addr_v6);
5955 		}
5956 		save_ire = ire;
5957 		ip2dbg(("ip_newroute_ipif: ire %p, ipif %p\n",
5958 			(void *)ire, (void *)ipif));
5959 
5960 		if ((fire != NULL) && (fire->ire_flags & RTF_MULTIRT)) {
5961 			/*
5962 			 * an IRE_OFFSUBET was looked up
5963 			 * on that interface.
5964 			 * this ire has RTF_MULTIRT flag,
5965 			 * so the resolution loop
5966 			 * will be re-entered to resolve
5967 			 * additional routes on other
5968 			 * interfaces. For that purpose,
5969 			 * a copy of the packet is
5970 			 * made at this point.
5971 			 */
5972 			fire->ire_last_used_time = lbolt;
5973 			copy_mp = copymsg(first_mp);
5974 			if (copy_mp) {
5975 				MULTIRT_DEBUG_TAG(copy_mp);
5976 			}
5977 		}
5978 
5979 		ASSERT((attach_ill == NULL) || (dst_ill == attach_ill));
5980 		switch (ire->ire_type) {
5981 		case IRE_IF_NORESOLVER: {
5982 			/* We have what we need to build an IRE_CACHE. */
5983 			mblk_t	*dlureq_mp;
5984 
5985 			/*
5986 			 * Create a new dlureq_mp with the
5987 			 * IPv6 gateway address in destination address in the
5988 			 * DLPI hdr if the physical length is exactly 16 bytes.
5989 			 */
5990 			ASSERT(dst_ill->ill_isv6);
5991 			if (dst_ill->ill_phys_addr_length == IPV6_ADDR_LEN) {
5992 				dlureq_mp = ill_dlur_gen((uchar_t *)v6dstp,
5993 				    dst_ill->ill_phys_addr_length,
5994 				    dst_ill->ill_sap,
5995 				    dst_ill->ill_sap_length);
5996 			} else {
5997 				dlureq_mp = ire->ire_dlureq_mp;
5998 			}
5999 
6000 			if (dlureq_mp == NULL)
6001 				break;
6002 			/*
6003 			 * The newly created ire will inherit the flags of the
6004 			 * parent ire, if any.
6005 			 */
6006 			ire = ire_create_v6(
6007 				v6dstp,			/* dest address */
6008 				&ipv6_all_ones,		/* mask */
6009 				&src_ipif->ipif_v6src_addr, /* source address */
6010 				NULL,			/* gateway address */
6011 				&save_ire->ire_max_frag,
6012 				NULL,			/* Fast Path header */
6013 				dst_ill->ill_rq,	/* recv-from queue */
6014 				dst_ill->ill_wq,	/* send-to queue */
6015 				IRE_CACHE,
6016 				dlureq_mp,
6017 				src_ipif,
6018 				NULL,
6019 				(fire != NULL) ?	/* Parent handle */
6020 				    fire->ire_phandle : 0,
6021 				save_ire->ire_ihandle,	/* Interface handle */
6022 				(fire != NULL) ?
6023 				(fire->ire_flags & (RTF_SETSRC | RTF_MULTIRT)) :
6024 				0,
6025 				&ire_uinfo_null,
6026 				NULL,
6027 				NULL);
6028 
6029 			if (dst_ill->ill_phys_addr_length == IPV6_ADDR_LEN)
6030 				freeb(dlureq_mp);
6031 
6032 			if (ire == NULL) {
6033 				ire_refrele(save_ire);
6034 				break;
6035 			}
6036 
6037 			ire->ire_marks |= ire_marks;
6038 
6039 			err = ndp_noresolver(dst_ill, v6dstp);
6040 			if (err != 0) {
6041 				ire_refrele(save_ire);
6042 				break;
6043 			}
6044 
6045 			/* Prevent save_ire from getting deleted */
6046 			IRB_REFHOLD(save_ire->ire_bucket);
6047 			/* Has it been removed already ? */
6048 			if (save_ire->ire_marks & IRE_MARK_CONDEMNED) {
6049 				IRB_REFRELE(save_ire->ire_bucket);
6050 				ire_refrele(save_ire);
6051 				break;
6052 			}
6053 
6054 			ire_add_then_send(q, ire, first_mp);
6055 			if (ip6_asp_table_held) {
6056 				ip6_asp_table_refrele();
6057 				ip6_asp_table_held = B_FALSE;
6058 			}
6059 
6060 			/* Assert that it is not deleted yet. */
6061 			ASSERT(save_ire->ire_ptpn != NULL);
6062 			IRB_REFRELE(save_ire->ire_bucket);
6063 			ire_refrele(save_ire);
6064 			if (fire != NULL) {
6065 				ire_refrele(fire);
6066 				fire = NULL;
6067 			}
6068 
6069 			/*
6070 			 * The resolution loop is re-entered if we
6071 			 * actually are in a multirouting case.
6072 			 */
6073 			if (copy_mp != NULL) {
6074 				boolean_t need_resolve =
6075 				    ire_multirt_need_resolve_v6(v6dstp,
6076 					MBLK_GETLABEL(copy_mp));
6077 				if (!need_resolve) {
6078 					MULTIRT_DEBUG_UNTAG(copy_mp);
6079 					freemsg(copy_mp);
6080 					copy_mp = NULL;
6081 				} else {
6082 					/*
6083 					 * ipif_lookup_group_v6() calls
6084 					 * ire_lookup_multi_v6() that uses
6085 					 * ire_ftable_lookup_v6() to find
6086 					 * an IRE_INTERFACE for the group.
6087 					 * In the multirt case,
6088 					 * ire_lookup_multi_v6() then invokes
6089 					 * ire_multirt_lookup_v6() to find
6090 					 * the next resolvable ire.
6091 					 * As a result, we obtain a new
6092 					 * interface, derived from the
6093 					 * next ire.
6094 					 */
6095 					if (ipif_held) {
6096 						ipif_refrele(ipif);
6097 						ipif_held = B_FALSE;
6098 					}
6099 					ipif = ipif_lookup_group_v6(v6dstp,
6100 					    zoneid);
6101 					ip2dbg(("ip_newroute_ipif: "
6102 						"multirt dst %08x, ipif %p\n",
6103 						ntohl(V4_PART_OF_V6((*v6dstp))),
6104 						(void *)ipif));
6105 					if (ipif != NULL) {
6106 						ipif_held = B_TRUE;
6107 						mp = copy_mp;
6108 						copy_mp = NULL;
6109 						multirt_resolve_next =
6110 						    B_TRUE;
6111 						continue;
6112 					} else {
6113 						freemsg(copy_mp);
6114 					}
6115 				}
6116 			}
6117 			ill_refrele(dst_ill);
6118 			if (ipif_held) {
6119 				ipif_refrele(ipif);
6120 				ipif_held = B_FALSE;
6121 			}
6122 			if (src_ipif != NULL)
6123 				ipif_refrele(src_ipif);
6124 			return;
6125 		}
6126 		case IRE_IF_RESOLVER: {
6127 
6128 			ASSERT(dst_ill->ill_isv6);
6129 
6130 			/*
6131 			 * We obtain a partial IRE_CACHE which we will pass
6132 			 * along with the resolver query.  When the response
6133 			 * comes back it will be there ready for us to add.
6134 			 */
6135 			/*
6136 			 * the newly created ire will inherit the flags of the
6137 			 * parent ire, if any.
6138 			 */
6139 			ire = ire_create_v6(
6140 				v6dstp,			/* dest address */
6141 				&ipv6_all_ones,		/* mask */
6142 				&src_ipif->ipif_v6src_addr, /* source address */
6143 				NULL,			/* gateway address */
6144 				&save_ire->ire_max_frag,
6145 				NULL,			/* Fast Path header */
6146 				dst_ill->ill_rq,	/* recv-from queue */
6147 				dst_ill->ill_wq,	/* send-to queue */
6148 				IRE_CACHE,
6149 				NULL,
6150 				src_ipif,
6151 				NULL,
6152 				(fire != NULL) ?	/* Parent handle */
6153 				    fire->ire_phandle : 0,
6154 				save_ire->ire_ihandle,	/* Interface handle */
6155 				(fire != NULL) ?
6156 				(fire->ire_flags & (RTF_SETSRC | RTF_MULTIRT)) :
6157 				0,
6158 				&ire_uinfo_null,
6159 				NULL,
6160 				NULL);
6161 
6162 			if (ire == NULL) {
6163 				ire_refrele(save_ire);
6164 				break;
6165 			}
6166 
6167 			ire->ire_marks |= ire_marks;
6168 
6169 			/* Resolve and add ire to the ctable */
6170 			err = ndp_resolver(dst_ill, v6dstp, first_mp, zoneid);
6171 			switch (err) {
6172 			case 0:
6173 				/* Prevent save_ire from getting deleted */
6174 				IRB_REFHOLD(save_ire->ire_bucket);
6175 				/* Has it been removed already ? */
6176 				if (save_ire->ire_marks & IRE_MARK_CONDEMNED) {
6177 					IRB_REFRELE(save_ire->ire_bucket);
6178 					ire_refrele(save_ire);
6179 					break;
6180 				}
6181 				/*
6182 				 * We have a resolved cache entry,
6183 				 * add in the IRE.
6184 				 */
6185 				ire_add_then_send(q, ire, first_mp);
6186 				if (ip6_asp_table_held) {
6187 					ip6_asp_table_refrele();
6188 					ip6_asp_table_held = B_FALSE;
6189 				}
6190 
6191 				/* Assert that it is not deleted yet. */
6192 				ASSERT(save_ire->ire_ptpn != NULL);
6193 				IRB_REFRELE(save_ire->ire_bucket);
6194 				ire_refrele(save_ire);
6195 				if (fire != NULL) {
6196 					ire_refrele(fire);
6197 					fire = NULL;
6198 				}
6199 
6200 				/*
6201 				 * The resolution loop is re-entered if we
6202 				 * actually are in a multirouting case.
6203 				 */
6204 				if (copy_mp != NULL) {
6205 					boolean_t need_resolve =
6206 					    ire_multirt_need_resolve_v6(v6dstp,
6207 						MBLK_GETLABEL(copy_mp));
6208 					if (!need_resolve) {
6209 						MULTIRT_DEBUG_UNTAG(copy_mp);
6210 						freemsg(copy_mp);
6211 						copy_mp = NULL;
6212 					} else {
6213 						/*
6214 						 * ipif_lookup_group_v6() calls
6215 						 * ire_lookup_multi_v6() that
6216 						 * uses ire_ftable_lookup_v6()
6217 						 * to find an IRE_INTERFACE for
6218 						 * the group. In the multirt
6219 						 * case, ire_lookup_multi_v6()
6220 						 * then invokes
6221 						 * ire_multirt_lookup_v6() to
6222 						 * find the next resolvable ire.
6223 						 * As a result, we obtain a new
6224 						 * interface, derived from the
6225 						 * next ire.
6226 						 */
6227 						if (ipif_held) {
6228 							ipif_refrele(ipif);
6229 							ipif_held = B_FALSE;
6230 						}
6231 						ipif = ipif_lookup_group_v6(
6232 						    v6dstp, zoneid);
6233 						ip2dbg(("ip_newroute_ipif: "
6234 						    "multirt dst %08x, "
6235 						    "ipif %p\n",
6236 						    ntohl(V4_PART_OF_V6(
6237 							(*v6dstp))),
6238 						    (void *)ipif));
6239 						if (ipif != NULL) {
6240 							ipif_held = B_TRUE;
6241 							mp = copy_mp;
6242 							copy_mp = NULL;
6243 							multirt_resolve_next =
6244 							    B_TRUE;
6245 							continue;
6246 						} else {
6247 							freemsg(copy_mp);
6248 						}
6249 					}
6250 				}
6251 				ill_refrele(dst_ill);
6252 				if (ipif_held) {
6253 					ipif_refrele(ipif);
6254 					ipif_held = B_FALSE;
6255 				}
6256 				if (src_ipif != NULL)
6257 					ipif_refrele(src_ipif);
6258 				return;
6259 
6260 			case EINPROGRESS:
6261 				/*
6262 				 * mp was consumed - presumably queued.
6263 				 * No need for ire, presumably resolution is
6264 				 * in progress, and ire will be added when the
6265 				 * address is resolved.
6266 				 */
6267 				if (ip6_asp_table_held) {
6268 					ip6_asp_table_refrele();
6269 					ip6_asp_table_held = B_FALSE;
6270 				}
6271 				ire_delete(ire);
6272 				ire_refrele(save_ire);
6273 				if (fire != NULL) {
6274 					ire_refrele(fire);
6275 					fire = NULL;
6276 				}
6277 
6278 				/*
6279 				 * The resolution loop is re-entered if we
6280 				 * actually are in a multirouting case.
6281 				 */
6282 				if (copy_mp != NULL) {
6283 					boolean_t need_resolve =
6284 					    ire_multirt_need_resolve_v6(v6dstp,
6285 						MBLK_GETLABEL(copy_mp));
6286 					if (!need_resolve) {
6287 						MULTIRT_DEBUG_UNTAG(copy_mp);
6288 						freemsg(copy_mp);
6289 						copy_mp = NULL;
6290 					} else {
6291 						/*
6292 						 * ipif_lookup_group_v6() calls
6293 						 * ire_lookup_multi_v6() that
6294 						 * uses ire_ftable_lookup_v6()
6295 						 * to find an IRE_INTERFACE for
6296 						 * the group. In the multirt
6297 						 * case, ire_lookup_multi_v6()
6298 						 * then invokes
6299 						 * ire_multirt_lookup_v6() to
6300 						 * find the next resolvable ire.
6301 						 * As a result, we obtain a new
6302 						 * interface, derived from the
6303 						 * next ire.
6304 						 */
6305 						if (ipif_held) {
6306 							ipif_refrele(ipif);
6307 							ipif_held = B_FALSE;
6308 						}
6309 						ipif = ipif_lookup_group_v6(
6310 						    v6dstp, zoneid);
6311 						ip2dbg(("ip_newroute_ipif: "
6312 						    "multirt dst %08x, "
6313 						    "ipif %p\n",
6314 						    ntohl(V4_PART_OF_V6(
6315 							(*v6dstp))),
6316 						    (void *)ipif));
6317 						if (ipif != NULL) {
6318 							ipif_held = B_TRUE;
6319 							mp = copy_mp;
6320 							copy_mp = NULL;
6321 							multirt_resolve_next =
6322 							    B_TRUE;
6323 							continue;
6324 						} else {
6325 							freemsg(copy_mp);
6326 						}
6327 					}
6328 				}
6329 				ill_refrele(dst_ill);
6330 				if (ipif_held) {
6331 					ipif_refrele(ipif);
6332 					ipif_held = B_FALSE;
6333 				}
6334 				if (src_ipif != NULL)
6335 					ipif_refrele(src_ipif);
6336 				return;
6337 			default:
6338 				/* Some transient error */
6339 				ire_refrele(save_ire);
6340 				break;
6341 			}
6342 			break;
6343 		}
6344 		default:
6345 			break;
6346 		}
6347 		if (ip6_asp_table_held) {
6348 			ip6_asp_table_refrele();
6349 			ip6_asp_table_held = B_FALSE;
6350 		}
6351 	} while (multirt_resolve_next);
6352 
6353 err_ret:
6354 	if (ip6_asp_table_held)
6355 		ip6_asp_table_refrele();
6356 	if (ire != NULL)
6357 		ire_refrele(ire);
6358 	if (fire != NULL)
6359 		ire_refrele(fire);
6360 	if (ipif != NULL && ipif_held)
6361 		ipif_refrele(ipif);
6362 	if (src_ipif != NULL)
6363 		ipif_refrele(src_ipif);
6364 	/* Multicast - no point in trying to generate ICMP error */
6365 	ASSERT((attach_ill == NULL) || (dst_ill == attach_ill));
6366 	if (dst_ill != NULL) {
6367 		ill = dst_ill;
6368 		ill_held = B_TRUE;
6369 	}
6370 	if (mp->b_prev || mp->b_next) {
6371 		BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
6372 	} else {
6373 		BUMP_MIB(ill->ill_ip6_mib, ipv6OutDiscards);
6374 	}
6375 	ip1dbg(("ip_newroute_ipif_v6: dropped\n"));
6376 	mp->b_next = NULL;
6377 	mp->b_prev = NULL;
6378 	freemsg(first_mp);
6379 	if (ill_held)
6380 		ill_refrele(ill);
6381 }
6382 
6383 /*
6384  * Parse and process any hop-by-hop or destination options.
6385  *
6386  * Assumes that q is an ill read queue so that ICMP errors for link-local
6387  * destinations are sent out the correct interface.
6388  *
6389  * Returns -1 if there was an error and mp has been consumed.
6390  * Returns 0 if no special action is needed.
6391  * Returns 1 if the packet contained a router alert option for this node
6392  * which is verified to be "interesting/known" for our implementation.
6393  *
6394  * XXX Note: In future as more hbh or dest options are defined,
6395  * it may be better to have different routines for hbh and dest
6396  * options as opt_type fields other than IP6OPT_PAD1 and IP6OPT_PADN
6397  * may have same value in different namespaces. Or is it same namespace ??
6398  * Current code checks for each opt_type (other than pads) if it is in
6399  * the expected  nexthdr (hbh or dest)
6400  */
6401 static int
6402 ip_process_options_v6(queue_t *q, mblk_t *mp, ip6_t *ip6h,
6403     uint8_t *optptr, uint_t optlen, uint8_t hdr_type)
6404 {
6405 	uint8_t opt_type;
6406 	uint_t optused;
6407 	int ret = 0;
6408 	mblk_t *first_mp;
6409 	const char *errtype;
6410 
6411 	first_mp = mp;
6412 	if (mp->b_datap->db_type == M_CTL) {
6413 		mp = mp->b_cont;
6414 	}
6415 
6416 	while (optlen != 0) {
6417 		opt_type = *optptr;
6418 		if (opt_type == IP6OPT_PAD1) {
6419 			optused = 1;
6420 		} else {
6421 			if (optlen < 2)
6422 				goto bad_opt;
6423 			errtype = "malformed";
6424 			if (opt_type == ip6opt_ls) {
6425 				optused = 2 + optptr[1];
6426 				if (optused > optlen)
6427 					goto bad_opt;
6428 			} else switch (opt_type) {
6429 			case IP6OPT_PADN:
6430 				/*
6431 				 * Note:We don't verify that (N-2) pad octets
6432 				 * are zero as required by spec. Adhere to
6433 				 * "be liberal in what you accept..." part of
6434 				 * implementation philosophy (RFC791,RFC1122)
6435 				 */
6436 				optused = 2 + optptr[1];
6437 				if (optused > optlen)
6438 					goto bad_opt;
6439 				break;
6440 
6441 			case IP6OPT_JUMBO:
6442 				if (hdr_type != IPPROTO_HOPOPTS)
6443 					goto opt_error;
6444 				goto opt_error; /* XXX Not implemented! */
6445 
6446 			case IP6OPT_ROUTER_ALERT: {
6447 				struct ip6_opt_router *or;
6448 
6449 				if (hdr_type != IPPROTO_HOPOPTS)
6450 					goto opt_error;
6451 				optused = 2 + optptr[1];
6452 				if (optused > optlen)
6453 					goto bad_opt;
6454 				or = (struct ip6_opt_router *)optptr;
6455 				/* Check total length and alignment */
6456 				if (optused != sizeof (*or) ||
6457 				    ((uintptr_t)or->ip6or_value & 0x1) != 0)
6458 					goto opt_error;
6459 				/* Check value */
6460 				switch (*((uint16_t *)or->ip6or_value)) {
6461 				case IP6_ALERT_MLD:
6462 				case IP6_ALERT_RSVP:
6463 					ret = 1;
6464 				}
6465 				break;
6466 			}
6467 			case IP6OPT_HOME_ADDRESS: {
6468 				/*
6469 				 * Minimal support for the home address option
6470 				 * (which is required by all IPv6 nodes).
6471 				 * Implement by just swapping the home address
6472 				 * and source address.
6473 				 * XXX Note: this has IPsec implications since
6474 				 * AH needs to take this into account.
6475 				 * Also, when IPsec is used we need to ensure
6476 				 * that this is only processed once
6477 				 * in the received packet (to avoid swapping
6478 				 * back and forth).
6479 				 * NOTE:This option processing is considered
6480 				 * to be unsafe and prone to a denial of
6481 				 * service attack.
6482 				 * The current processing is not safe even with
6483 				 * IPsec secured IP packets. Since the home
6484 				 * address option processing requirement still
6485 				 * is in the IETF draft and in the process of
6486 				 * being redefined for its usage, it has been
6487 				 * decided to turn off the option by default.
6488 				 * If this section of code needs to be executed,
6489 				 * ndd variable ip6_ignore_home_address_opt
6490 				 * should be set to 0 at the user's own risk.
6491 				 */
6492 				struct ip6_opt_home_address *oh;
6493 				in6_addr_t tmp;
6494 
6495 				if (ipv6_ignore_home_address_opt)
6496 					goto opt_error;
6497 
6498 				if (hdr_type != IPPROTO_DSTOPTS)
6499 					goto opt_error;
6500 				optused = 2 + optptr[1];
6501 				if (optused > optlen)
6502 					goto bad_opt;
6503 
6504 				/*
6505 				 * We did this dest. opt the first time
6506 				 * around (i.e. before AH processing).
6507 				 * If we've done AH... stop now.
6508 				 */
6509 				if (first_mp != mp) {
6510 					ipsec_in_t *ii;
6511 
6512 					ii = (ipsec_in_t *)first_mp->b_rptr;
6513 					if (ii->ipsec_in_ah_sa != NULL)
6514 						break;
6515 				}
6516 
6517 				oh = (struct ip6_opt_home_address *)optptr;
6518 				/* Check total length and alignment */
6519 				if (optused < sizeof (*oh) ||
6520 				    ((uintptr_t)oh->ip6oh_addr & 0x7) != 0)
6521 					goto opt_error;
6522 				/* Swap ip6_src and the home address */
6523 				tmp = ip6h->ip6_src;
6524 				/* XXX Note: only 8 byte alignment option */
6525 				ip6h->ip6_src = *(in6_addr_t *)oh->ip6oh_addr;
6526 				*(in6_addr_t *)oh->ip6oh_addr = tmp;
6527 				break;
6528 			}
6529 
6530 			case IP6OPT_TUNNEL_LIMIT:
6531 				if (hdr_type != IPPROTO_DSTOPTS) {
6532 					goto opt_error;
6533 				}
6534 				optused = 2 + optptr[1];
6535 				if (optused > optlen) {
6536 					goto bad_opt;
6537 				}
6538 				if (optused != 3) {
6539 					goto opt_error;
6540 				}
6541 				break;
6542 
6543 			default:
6544 				errtype = "unknown";
6545 				/* FALLTHROUGH */
6546 			opt_error:
6547 				switch (IP6OPT_TYPE(opt_type)) {
6548 				case IP6OPT_TYPE_SKIP:
6549 					optused = 2 + optptr[1];
6550 					if (optused > optlen)
6551 						goto bad_opt;
6552 					ip1dbg(("ip_process_options_v6: %s "
6553 					    "opt 0x%x skipped\n",
6554 					    errtype, opt_type));
6555 					break;
6556 				case IP6OPT_TYPE_DISCARD:
6557 					ip1dbg(("ip_process_options_v6: %s "
6558 					    "opt 0x%x; packet dropped\n",
6559 					    errtype, opt_type));
6560 					freemsg(first_mp);
6561 					return (-1);
6562 				case IP6OPT_TYPE_ICMP:
6563 					icmp_param_problem_v6(WR(q), first_mp,
6564 					    ICMP6_PARAMPROB_OPTION,
6565 					    (uint32_t)(optptr -
6566 					    (uint8_t *)ip6h),
6567 					    B_FALSE, B_FALSE);
6568 					return (-1);
6569 				case IP6OPT_TYPE_FORCEICMP:
6570 					icmp_param_problem_v6(WR(q), first_mp,
6571 					    ICMP6_PARAMPROB_OPTION,
6572 					    (uint32_t)(optptr -
6573 					    (uint8_t *)ip6h),
6574 					    B_FALSE, B_TRUE);
6575 					return (-1);
6576 				default:
6577 					ASSERT(0);
6578 				}
6579 			}
6580 		}
6581 		optlen -= optused;
6582 		optptr += optused;
6583 	}
6584 	return (ret);
6585 
6586 bad_opt:
6587 	icmp_param_problem_v6(WR(q), first_mp, ICMP6_PARAMPROB_OPTION,
6588 	    (uint32_t)(optptr - (uint8_t *)ip6h),
6589 	    B_FALSE, B_FALSE);
6590 	return (-1);
6591 }
6592 
6593 /*
6594  * Process a routing header that is not yet empty.
6595  * Only handles type 0 routing headers.
6596  */
6597 static void
6598 ip_process_rthdr(queue_t *q, mblk_t *mp, ip6_t *ip6h, ip6_rthdr_t *rth,
6599     ill_t *ill, uint_t flags, mblk_t *hada_mp)
6600 {
6601 	ip6_rthdr0_t *rthdr;
6602 	uint_t ehdrlen;
6603 	uint_t numaddr;
6604 	in6_addr_t *addrptr;
6605 	in6_addr_t tmp;
6606 
6607 	ASSERT(rth->ip6r_segleft != 0);
6608 
6609 	if (!ipv6_forward_src_routed) {
6610 		/* XXX Check for source routed out same interface? */
6611 		BUMP_MIB(ill->ill_ip6_mib, ipv6ForwProhibits);
6612 		BUMP_MIB(ill->ill_ip6_mib, ipv6InAddrErrors);
6613 		freemsg(hada_mp);
6614 		freemsg(mp);
6615 		return;
6616 	}
6617 
6618 	if (rth->ip6r_type != 0) {
6619 		if (hada_mp != NULL)
6620 			goto hada_drop;
6621 		icmp_param_problem_v6(WR(q), mp,
6622 		    ICMP6_PARAMPROB_HEADER,
6623 		    (uint32_t)((uchar_t *)&rth->ip6r_type - (uchar_t *)ip6h),
6624 		    B_FALSE, B_FALSE);
6625 		return;
6626 	}
6627 	rthdr = (ip6_rthdr0_t *)rth;
6628 	ehdrlen = 8 * (rthdr->ip6r0_len + 1);
6629 	ASSERT(mp->b_rptr + ehdrlen <= mp->b_wptr);
6630 	addrptr = (in6_addr_t *)((char *)rthdr + sizeof (*rthdr));
6631 	/* rthdr->ip6r0_len is twice the number of addresses in the header */
6632 	if (rthdr->ip6r0_len & 0x1) {
6633 		/* An odd length is impossible */
6634 		if (hada_mp != NULL)
6635 			goto hada_drop;
6636 		icmp_param_problem_v6(WR(q), mp,
6637 		    ICMP6_PARAMPROB_HEADER,
6638 		    (uint32_t)((uchar_t *)&rthdr->ip6r0_len - (uchar_t *)ip6h),
6639 		    B_FALSE, B_FALSE);
6640 		return;
6641 	}
6642 	numaddr = rthdr->ip6r0_len / 2;
6643 	if (rthdr->ip6r0_segleft > numaddr) {
6644 		/* segleft exceeds number of addresses in routing header */
6645 		if (hada_mp != NULL)
6646 			goto hada_drop;
6647 		icmp_param_problem_v6(WR(q), mp,
6648 		    ICMP6_PARAMPROB_HEADER,
6649 		    (uint32_t)((uchar_t *)&rthdr->ip6r0_segleft -
6650 			(uchar_t *)ip6h),
6651 		    B_FALSE, B_FALSE);
6652 		return;
6653 	}
6654 	addrptr += (numaddr - rthdr->ip6r0_segleft);
6655 	if (IN6_IS_ADDR_MULTICAST(&ip6h->ip6_dst) ||
6656 	    IN6_IS_ADDR_MULTICAST(addrptr)) {
6657 		BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
6658 		freemsg(hada_mp);
6659 		freemsg(mp);
6660 		return;
6661 	}
6662 	/* Swap */
6663 	tmp = *addrptr;
6664 	*addrptr = ip6h->ip6_dst;
6665 	ip6h->ip6_dst = tmp;
6666 	rthdr->ip6r0_segleft--;
6667 	/* Don't allow any mapped addresses - ip_wput_v6 can't handle them */
6668 	if (IN6_IS_ADDR_V4MAPPED(&ip6h->ip6_dst)) {
6669 		if (hada_mp != NULL)
6670 			goto hada_drop;
6671 		icmp_unreachable_v6(WR(q), mp, ICMP6_DST_UNREACH_NOROUTE,
6672 		    B_FALSE, B_FALSE);
6673 		return;
6674 	}
6675 	ip_rput_data_v6(q, ill, mp, ip6h, flags, hada_mp);
6676 	return;
6677 hada_drop:
6678 	/* IPsec kstats: bean counter? */
6679 	freemsg(hada_mp);
6680 	freemsg(mp);
6681 }
6682 
6683 /*
6684  * Read side put procedure for IPv6 module.
6685  */
6686 static void
6687 ip_rput_v6(queue_t *q, mblk_t *mp)
6688 {
6689 	mblk_t		*mp1, *first_mp, *hada_mp = NULL;
6690 	ip6_t		*ip6h;
6691 	boolean_t	ll_multicast = B_FALSE, mctl_present = B_FALSE;
6692 	ill_t		*ill;
6693 	struct iocblk	*iocp;
6694 	uint_t 		flags = 0;
6695 
6696 	ill = (ill_t *)q->q_ptr;
6697 	if (ill->ill_state_flags & ILL_CONDEMNED) {
6698 		union DL_primitives *dl;
6699 
6700 		dl = (union DL_primitives *)mp->b_rptr;
6701 		/*
6702 		 * Things are opening or closing - only accept DLPI
6703 		 * ack messages. If the stream is closing and ip_wsrv
6704 		 * has completed, ip_close is out of the qwait, but has
6705 		 * not yet completed qprocsoff. Don't proceed any further
6706 		 * because the ill has been cleaned up and things hanging
6707 		 * off the ill have been freed.
6708 		 */
6709 		if ((mp->b_datap->db_type != M_PCPROTO) ||
6710 		    (dl->dl_primitive == DL_UNITDATA_IND)) {
6711 			inet_freemsg(mp);
6712 			return;
6713 		}
6714 	}
6715 
6716 	switch (mp->b_datap->db_type) {
6717 	case M_DATA:
6718 		break;
6719 
6720 	case M_PROTO:
6721 	case M_PCPROTO:
6722 		if (((dl_unitdata_ind_t *)mp->b_rptr)->dl_primitive !=
6723 		    DL_UNITDATA_IND) {
6724 			/* Go handle anything other than data elsewhere. */
6725 			ip_rput_dlpi(q, mp);
6726 			return;
6727 		}
6728 #define	dlur	((dl_unitdata_ind_t *)mp->b_rptr)
6729 		ll_multicast = dlur->dl_group_address;
6730 #undef	dlur
6731 		/* Ditch the DLPI header. */
6732 		mp1 = mp;
6733 		mp = mp->b_cont;
6734 		freeb(mp1);
6735 		break;
6736 	case M_BREAK:
6737 		panic("ip_rput_v6: got an M_BREAK");
6738 		/*NOTREACHED*/
6739 	case M_IOCACK:
6740 		iocp = (struct iocblk *)mp->b_rptr;
6741 		switch (iocp->ioc_cmd) {
6742 		case DL_IOC_HDR_INFO:
6743 			ill = (ill_t *)q->q_ptr;
6744 			ill_fastpath_ack(ill, mp);
6745 			return;
6746 		case SIOCSTUNPARAM:
6747 		case SIOCGTUNPARAM:
6748 		case OSIOCSTUNPARAM:
6749 		case OSIOCGTUNPARAM:
6750 			/* Go through qwriter */
6751 			break;
6752 		default:
6753 			putnext(q, mp);
6754 			return;
6755 		}
6756 		/* FALLTHRU */
6757 	case M_ERROR:
6758 	case M_HANGUP:
6759 		mutex_enter(&ill->ill_lock);
6760 		if (ill->ill_state_flags & ILL_CONDEMNED) {
6761 			mutex_exit(&ill->ill_lock);
6762 			freemsg(mp);
6763 			return;
6764 		}
6765 		ill_refhold_locked(ill);
6766 		mutex_exit(&ill->ill_lock);
6767 		qwriter_ip(NULL, ill, q, mp, ip_rput_other, CUR_OP, B_FALSE);
6768 		return;
6769 	case M_CTL: {
6770 		if ((MBLKL(mp) > sizeof (int)) &&
6771 		    ((da_ipsec_t *)mp->b_rptr)->da_type == IPHADA_M_CTL) {
6772 			ASSERT(MBLKL(mp) >= sizeof (da_ipsec_t));
6773 			mctl_present = B_TRUE;
6774 			break;
6775 		}
6776 		putnext(q, mp);
6777 		return;
6778 	}
6779 	case M_IOCNAK:
6780 		iocp = (struct iocblk *)mp->b_rptr;
6781 		switch (iocp->ioc_cmd) {
6782 		case DL_IOC_HDR_INFO:
6783 		case SIOCSTUNPARAM:
6784 		case SIOCGTUNPARAM:
6785 		case OSIOCSTUNPARAM:
6786 		case OSIOCGTUNPARAM:
6787 			mutex_enter(&ill->ill_lock);
6788 			if (ill->ill_state_flags & ILL_CONDEMNED) {
6789 				mutex_exit(&ill->ill_lock);
6790 				freemsg(mp);
6791 				return;
6792 			}
6793 			ill_refhold_locked(ill);
6794 			mutex_exit(&ill->ill_lock);
6795 			qwriter_ip(NULL, ill, q, mp, ip_rput_other, CUR_OP,
6796 			    B_FALSE);
6797 			return;
6798 		default:
6799 			break;
6800 		}
6801 		/* FALLTHRU */
6802 	default:
6803 		putnext(q, mp);
6804 		return;
6805 	}
6806 
6807 	BUMP_MIB(ill->ill_ip6_mib, ipv6InReceives);
6808 	/*
6809 	 * if db_ref > 1 then copymsg and free original. Packet may be
6810 	 * changed and do not want other entity who has a reference to this
6811 	 * message to trip over the changes. This is a blind change because
6812 	 * trying to catch all places that might change packet is too
6813 	 * difficult (since it may be a module above this one).
6814 	 */
6815 	if (mp->b_datap->db_ref > 1) {
6816 		mblk_t  *mp1;
6817 
6818 		mp1 = copymsg(mp);
6819 		freemsg(mp);
6820 		if (mp1 == NULL) {
6821 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
6822 			return;
6823 		}
6824 		mp = mp1;
6825 	}
6826 	first_mp = mp;
6827 	if (mctl_present) {
6828 		hada_mp = first_mp;
6829 		mp = first_mp->b_cont;
6830 	}
6831 
6832 	ip6h = (ip6_t *)mp->b_rptr;
6833 
6834 	/* check for alignment and full IPv6 header */
6835 	if (!OK_32PTR((uchar_t *)ip6h) ||
6836 	    (mp->b_wptr - (uchar_t *)ip6h) < IPV6_HDR_LEN) {
6837 		if (!pullupmsg(mp, IPV6_HDR_LEN)) {
6838 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
6839 			ip1dbg(("ip_rput_v6: pullupmsg failed\n"));
6840 			freemsg(first_mp);
6841 			return;
6842 		}
6843 		ip6h = (ip6_t *)mp->b_rptr;
6844 	}
6845 	if ((ip6h->ip6_vcf & IPV6_VERS_AND_FLOW_MASK) ==
6846 	    IPV6_DEFAULT_VERS_AND_FLOW) {
6847 		/*
6848 		 * It may be a bit too expensive to do this mapped address
6849 		 * check here, but in the interest of robustness, it seems
6850 		 * like the correct place.
6851 		 * TODO: Avoid this check for e.g. connected TCP sockets
6852 		 */
6853 		if (IN6_IS_ADDR_V4MAPPED(&ip6h->ip6_src)) {
6854 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
6855 			ip1dbg(("ip_rput_v6: pkt with mapped src addr\n"));
6856 			freemsg(first_mp);
6857 			return;
6858 		}
6859 
6860 		if (IN6_IS_ADDR_LOOPBACK(&ip6h->ip6_src)) {
6861 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
6862 			ip1dbg(("ip_rput_v6: pkt with loopback src"));
6863 			freemsg(first_mp);
6864 			return;
6865 		} else if (IN6_IS_ADDR_LOOPBACK(&ip6h->ip6_dst)) {
6866 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
6867 			ip1dbg(("ip_rput_v6: pkt with loopback dst"));
6868 			freemsg(first_mp);
6869 			return;
6870 		}
6871 
6872 		flags |= (ll_multicast ? IP6_IN_LLMCAST : 0);
6873 		ip_rput_data_v6(q, ill, mp, ip6h, flags, hada_mp);
6874 	} else {
6875 		BUMP_MIB(ill->ill_ip6_mib, ipv6InIPv4);
6876 		BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
6877 		freemsg(first_mp);
6878 	}
6879 }
6880 
6881 /*
6882  * Walk through the IPv6 packet in mp and see if there's an AH header
6883  * in it.  See if the AH header needs to get done before other headers in
6884  * the packet.  (Worker function for ipsec_early_ah_v6().)
6885  */
6886 #define	IPSEC_HDR_DONT_PROCESS	0
6887 #define	IPSEC_HDR_PROCESS	1
6888 #define	IPSEC_MEMORY_ERROR	2
6889 static int
6890 ipsec_needs_processing_v6(mblk_t *mp, uint8_t *nexthdr)
6891 {
6892 	uint_t	length;
6893 	uint_t	ehdrlen;
6894 	uint8_t *whereptr;
6895 	uint8_t *endptr;
6896 	uint8_t *nexthdrp;
6897 	ip6_dest_t *desthdr;
6898 	ip6_rthdr_t *rthdr;
6899 	ip6_t	*ip6h;
6900 
6901 	/*
6902 	 * For now just pullup everything.  In general, the less pullups,
6903 	 * the better, but there's so much squirrelling through anyway,
6904 	 * it's just easier this way.
6905 	 */
6906 	if (!pullupmsg(mp, -1)) {
6907 		return (IPSEC_MEMORY_ERROR);
6908 	}
6909 
6910 	ip6h = (ip6_t *)mp->b_rptr;
6911 	length = IPV6_HDR_LEN;
6912 	whereptr = ((uint8_t *)&ip6h[1]); /* point to next hdr */
6913 	endptr = mp->b_wptr;
6914 
6915 	/*
6916 	 * We can't just use the argument nexthdr in the place
6917 	 * of nexthdrp becaue we don't dereference nexthdrp
6918 	 * till we confirm whether it is a valid address.
6919 	 */
6920 	nexthdrp = &ip6h->ip6_nxt;
6921 	while (whereptr < endptr) {
6922 		/* Is there enough left for len + nexthdr? */
6923 		if (whereptr + MIN_EHDR_LEN > endptr)
6924 			return (IPSEC_MEMORY_ERROR);
6925 
6926 		switch (*nexthdrp) {
6927 		case IPPROTO_HOPOPTS:
6928 		case IPPROTO_DSTOPTS:
6929 			/* Assumes the headers are identical for hbh and dst */
6930 			desthdr = (ip6_dest_t *)whereptr;
6931 			ehdrlen = 8 * (desthdr->ip6d_len + 1);
6932 			if ((uchar_t *)desthdr +  ehdrlen > endptr)
6933 				return (IPSEC_MEMORY_ERROR);
6934 			/*
6935 			 * Return DONT_PROCESS because of potential Mobile IPv6
6936 			 * cruft for destination options.
6937 			 */
6938 			if (*nexthdrp == IPPROTO_DSTOPTS)
6939 				return (IPSEC_HDR_DONT_PROCESS);
6940 			nexthdrp = &desthdr->ip6d_nxt;
6941 			break;
6942 		case IPPROTO_ROUTING:
6943 			rthdr = (ip6_rthdr_t *)whereptr;
6944 
6945 			/*
6946 			 * If there's more hops left on the routing header,
6947 			 * return now with DON'T PROCESS.
6948 			 */
6949 			if (rthdr->ip6r_segleft > 0)
6950 				return (IPSEC_HDR_DONT_PROCESS);
6951 
6952 			ehdrlen =  8 * (rthdr->ip6r_len + 1);
6953 			if ((uchar_t *)rthdr +  ehdrlen > endptr)
6954 				return (IPSEC_MEMORY_ERROR);
6955 			nexthdrp = &rthdr->ip6r_nxt;
6956 			break;
6957 		case IPPROTO_FRAGMENT:
6958 			/* Wait for reassembly */
6959 			return (IPSEC_HDR_DONT_PROCESS);
6960 		case IPPROTO_AH:
6961 			*nexthdr = IPPROTO_AH;
6962 			return (IPSEC_HDR_PROCESS);
6963 		case IPPROTO_NONE:
6964 			/* No next header means we're finished */
6965 		default:
6966 			return (IPSEC_HDR_DONT_PROCESS);
6967 		}
6968 		length += ehdrlen;
6969 		whereptr += ehdrlen;
6970 	}
6971 	panic("ipsec_needs_processing_v6");
6972 	/*NOTREACHED*/
6973 }
6974 
6975 /*
6976  * Path for AH if options are present. If this is the first time we are
6977  * sending a datagram to AH, allocate a IPSEC_IN message and prepend it.
6978  * Otherwise, just fanout.  Return value answers the boolean question:
6979  * "Did I consume the mblk you sent me?"
6980  *
6981  * Sometimes AH needs to be done before other IPv6 headers for security
6982  * reasons.  This function (and its ipsec_needs_processing_v6() above)
6983  * indicates if that is so, and fans out to the appropriate IPsec protocol
6984  * for the datagram passed in.
6985  */
6986 static boolean_t
6987 ipsec_early_ah_v6(queue_t *q, mblk_t *first_mp, boolean_t mctl_present,
6988     ill_t *ill, ire_t *ire, mblk_t *hada_mp, zoneid_t zoneid)
6989 {
6990 	mblk_t *mp;
6991 	uint8_t nexthdr;
6992 	ipsec_in_t *ii = NULL;
6993 	ah_t *ah;
6994 	ipsec_status_t ipsec_rc;
6995 
6996 	ASSERT((hada_mp == NULL) || (!mctl_present));
6997 
6998 	switch (ipsec_needs_processing_v6(
6999 	    (mctl_present ? first_mp->b_cont : first_mp), &nexthdr)) {
7000 	case IPSEC_MEMORY_ERROR:
7001 		BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
7002 		freemsg(hada_mp);
7003 		freemsg(first_mp);
7004 		return (B_TRUE);
7005 	case IPSEC_HDR_DONT_PROCESS:
7006 		return (B_FALSE);
7007 	}
7008 
7009 	/* Default means send it to AH! */
7010 	ASSERT(nexthdr == IPPROTO_AH);
7011 	if (!mctl_present) {
7012 		mp = first_mp;
7013 		if ((first_mp = ipsec_in_alloc(B_FALSE)) == NULL) {
7014 			ip1dbg(("ipsec_early_ah_v6: IPSEC_IN "
7015 			    "allocation failure.\n"));
7016 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
7017 			freemsg(hada_mp);
7018 			freemsg(mp);
7019 			return (B_TRUE);
7020 		}
7021 		/*
7022 		 * Store the ill_index so that when we come back
7023 		 * from IPSEC we ride on the same queue.
7024 		 */
7025 		ii = (ipsec_in_t *)first_mp->b_rptr;
7026 		ii->ipsec_in_ill_index = ill->ill_phyint->phyint_ifindex;
7027 		ii->ipsec_in_rill_index = ii->ipsec_in_ill_index;
7028 		first_mp->b_cont = mp;
7029 	}
7030 	/*
7031 	 * Cache hardware acceleration info.
7032 	 */
7033 	if (hada_mp != NULL) {
7034 		ASSERT(ii != NULL);
7035 		IPSECHW_DEBUG(IPSECHW_PKT, ("ipsec_early_ah_v6: "
7036 		    "caching data attr.\n"));
7037 		ii->ipsec_in_accelerated = B_TRUE;
7038 		ii->ipsec_in_da = hada_mp;
7039 	}
7040 
7041 	if (!ipsec_loaded()) {
7042 		ip_proto_not_sup(q, first_mp, IP_FF_SEND_ICMP, zoneid);
7043 		return (B_TRUE);
7044 	}
7045 
7046 	ah = ipsec_inbound_ah_sa(first_mp);
7047 	if (ah == NULL)
7048 		return (B_TRUE);
7049 	ASSERT(ii->ipsec_in_ah_sa != NULL);
7050 	ASSERT(ii->ipsec_in_ah_sa->ipsa_input_func != NULL);
7051 	ipsec_rc = ii->ipsec_in_ah_sa->ipsa_input_func(first_mp, ah);
7052 
7053 	switch (ipsec_rc) {
7054 	case IPSEC_STATUS_SUCCESS:
7055 		/* we're done with IPsec processing, send it up */
7056 		ip_fanout_proto_again(first_mp, ill, ill, ire);
7057 		break;
7058 	case IPSEC_STATUS_FAILED:
7059 		BUMP_MIB(&ip6_mib, ipv6InDiscards);
7060 		break;
7061 	case IPSEC_STATUS_PENDING:
7062 		/* no action needed */
7063 		break;
7064 	}
7065 	return (B_TRUE);
7066 }
7067 
7068 /*
7069  * ip_rput_data_v6 -- received IPv6 packets in M_DATA messages show up here.
7070  * ip_rput_v6 has already verified alignment, the min length, the version,
7071  * and db_ref = 1.
7072  *
7073  * The ill passed in (the arg named inill) is the ill that the packet
7074  * actually arrived on.  We need to remember this when saving the
7075  * input interface index into potential IPV6_PKTINFO data in
7076  * ip_add_info_v6().
7077  */
7078 void
7079 ip_rput_data_v6(queue_t *q, ill_t *inill, mblk_t *mp, ip6_t *ip6h,
7080     uint_t flags, mblk_t *hada_mp)
7081 {
7082 	ire_t		*ire = NULL;
7083 	queue_t		*rq;
7084 	ill_t		*ill = inill;
7085 	ipif_t		*ipif;
7086 	uint8_t		*whereptr;
7087 	uint8_t		nexthdr;
7088 	uint16_t	remlen;
7089 	uint_t		prev_nexthdr_offset;
7090 	uint_t		used;
7091 	size_t		pkt_len;
7092 	uint16_t	ip6_len;
7093 	uint_t		hdr_len;
7094 	boolean_t	mctl_present;
7095 	mblk_t		*first_mp;
7096 	mblk_t		*first_mp1;
7097 	boolean_t	no_forward;
7098 	ip6_hbh_t	*hbhhdr;
7099 	boolean_t	ll_multicast = (flags & IP6_IN_LLMCAST);
7100 	conn_t		*connp;
7101 	ilm_t		*ilm;
7102 	uint32_t	ports;
7103 	uint_t		ipif_id = 0;
7104 	zoneid_t	zoneid = GLOBAL_ZONEID;
7105 	uint16_t	hck_flags, reass_hck_flags;
7106 	uint32_t	reass_sum;
7107 	boolean_t	cksum_err;
7108 	mblk_t		*mp1;
7109 
7110 	EXTRACT_PKT_MP(mp, first_mp, mctl_present);
7111 
7112 	if (hada_mp != NULL) {
7113 		/*
7114 		 * It's an IPsec accelerated packet.
7115 		 * Keep a pointer to the data attributes around until
7116 		 * we allocate the ipsecinfo structure.
7117 		 */
7118 		IPSECHW_DEBUG(IPSECHW_PKT,
7119 		    ("ip_rput_data_v6: inbound HW accelerated IPsec pkt\n"));
7120 		hada_mp->b_cont = NULL;
7121 		/*
7122 		 * Since it is accelerated, it came directly from
7123 		 * the ill.
7124 		 */
7125 		ASSERT(mctl_present == B_FALSE);
7126 		ASSERT(mp->b_datap->db_type != M_CTL);
7127 	}
7128 
7129 	ASSERT(OK_32PTR((uchar_t *)ip6h) &&
7130 	    (mp->b_wptr - (uchar_t *)ip6h) >= IPV6_HDR_LEN);
7131 
7132 	if (mp->b_cont == NULL)
7133 		pkt_len = mp->b_wptr - mp->b_rptr;
7134 	else
7135 		pkt_len = msgdsize(mp);
7136 	ip6_len = ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN;
7137 
7138 	/*
7139 	 * Check for bogus (too short packet) and packet which
7140 	 * was padded by the link layer.
7141 	 */
7142 	if (ip6_len != pkt_len) {
7143 		ssize_t diff;
7144 
7145 		if (ip6_len > pkt_len) {
7146 			ip1dbg(("ip_rput_data_v6: packet too short %d %lu\n",
7147 			    ip6_len, pkt_len));
7148 			BUMP_MIB(ill->ill_ip6_mib, ipv6InTruncatedPkts);
7149 			freemsg(hada_mp);
7150 			freemsg(first_mp);
7151 			return;
7152 		}
7153 		diff = (ssize_t)(pkt_len - ip6_len);
7154 
7155 		if (!adjmsg(mp, -diff)) {
7156 			ip1dbg(("ip_rput_data_v6: adjmsg failed\n"));
7157 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
7158 			freemsg(hada_mp);
7159 			freemsg(first_mp);
7160 			return;
7161 		}
7162 		pkt_len -= diff;
7163 	}
7164 
7165 	if (ILL_HCKSUM_CAPABLE(ill) && !mctl_present && dohwcksum)
7166 		hck_flags = DB_CKSUMFLAGS(mp);
7167 	else
7168 		hck_flags = 0;
7169 
7170 	/* Clear checksum flags in case we need to forward */
7171 	DB_CKSUMFLAGS(mp) = 0;
7172 	reass_sum = reass_hck_flags = 0;
7173 
7174 	nexthdr = ip6h->ip6_nxt;
7175 
7176 	prev_nexthdr_offset = (uint_t)((uchar_t *)&ip6h->ip6_nxt -
7177 	    (uchar_t *)ip6h);
7178 	whereptr = (uint8_t *)&ip6h[1];
7179 	remlen = pkt_len - IPV6_HDR_LEN;	/* Track how much is left */
7180 
7181 	/* Process hop by hop header options */
7182 	if (nexthdr == IPPROTO_HOPOPTS) {
7183 		uint_t ehdrlen;
7184 		uint8_t *optptr;
7185 
7186 		if (remlen < MIN_EHDR_LEN)
7187 			goto pkt_too_short;
7188 		if (mp->b_cont != NULL &&
7189 		    whereptr + MIN_EHDR_LEN > mp->b_wptr) {
7190 			if (!pullupmsg(mp, IPV6_HDR_LEN + MIN_EHDR_LEN)) {
7191 				BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
7192 				freemsg(hada_mp);
7193 				freemsg(first_mp);
7194 				return;
7195 			}
7196 			ip6h = (ip6_t *)mp->b_rptr;
7197 			whereptr = (uint8_t *)ip6h + pkt_len - remlen;
7198 		}
7199 		hbhhdr = (ip6_hbh_t *)whereptr;
7200 		nexthdr = hbhhdr->ip6h_nxt;
7201 		prev_nexthdr_offset = (uint_t)(whereptr - (uint8_t *)ip6h);
7202 		ehdrlen = 8 * (hbhhdr->ip6h_len + 1);
7203 
7204 		if (remlen < ehdrlen)
7205 			goto pkt_too_short;
7206 		if (mp->b_cont != NULL &&
7207 		    whereptr + ehdrlen > mp->b_wptr) {
7208 			if (!pullupmsg(mp, IPV6_HDR_LEN + ehdrlen)) {
7209 				BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
7210 				freemsg(hada_mp);
7211 				freemsg(first_mp);
7212 				return;
7213 			}
7214 			ip6h = (ip6_t *)mp->b_rptr;
7215 			whereptr = (uint8_t *)ip6h + pkt_len - remlen;
7216 			hbhhdr = (ip6_hbh_t *)whereptr;
7217 		}
7218 
7219 		optptr = whereptr + 2;
7220 		whereptr += ehdrlen;
7221 		remlen -= ehdrlen;
7222 		switch (ip_process_options_v6(q, first_mp, ip6h, optptr,
7223 		    ehdrlen - 2, IPPROTO_HOPOPTS)) {
7224 		case -1:
7225 			/*
7226 			 * Packet has been consumed and any
7227 			 * needed ICMP messages sent.
7228 			 */
7229 			BUMP_MIB(ill->ill_ip6_mib, ipv6InHdrErrors);
7230 			freemsg(hada_mp);
7231 			return;
7232 		case 0:
7233 			/* no action needed */
7234 			break;
7235 		case 1:
7236 			/* Known router alert */
7237 			goto ipv6forus;
7238 		}
7239 	}
7240 
7241 	/*
7242 	 * Attach any necessary label information to this packet.
7243 	 */
7244 	if (is_system_labeled() && !tsol_get_pkt_label(mp, IPV6_VERSION)) {
7245 		if (ip6opt_ls != 0)
7246 			ip0dbg(("tsol_get_pkt_label v6 failed\n"));
7247 		BUMP_MIB(ill->ill_ip6_mib, ipv6InHdrErrors);
7248 		freemsg(hada_mp);
7249 		freemsg(first_mp);
7250 		return;
7251 	}
7252 
7253 	/*
7254 	 * On incoming v6 multicast packets we will bypass the ire table,
7255 	 * and assume that the read queue corresponds to the targetted
7256 	 * interface.
7257 	 *
7258 	 * The effect of this is the same as the IPv4 original code, but is
7259 	 * much cleaner I think.  See ip_rput for how that was done.
7260 	 */
7261 	if (IN6_IS_ADDR_MULTICAST(&ip6h->ip6_dst)) {
7262 		BUMP_MIB(ill->ill_ip6_mib, ipv6InMcastPkts);
7263 		/*
7264 		 * XXX TODO Give to mrouted to for multicast forwarding.
7265 		 */
7266 		ILM_WALKER_HOLD(ill);
7267 		ilm = ilm_lookup_ill_v6(ill, &ip6h->ip6_dst, ALL_ZONES);
7268 		ILM_WALKER_RELE(ill);
7269 		if (ilm == NULL) {
7270 			if (ip_debug > 3) {
7271 				/* ip2dbg */
7272 				pr_addr_dbg("ip_rput_data_v6: got mcast packet"
7273 				    "  which is not for us: %s\n", AF_INET6,
7274 				    &ip6h->ip6_dst);
7275 			}
7276 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
7277 			freemsg(hada_mp);
7278 			freemsg(first_mp);
7279 			return;
7280 		}
7281 		if (ip_debug > 3) {
7282 			/* ip2dbg */
7283 			pr_addr_dbg("ip_rput_data_v6: multicast for us: %s\n",
7284 			    AF_INET6, &ip6h->ip6_dst);
7285 		}
7286 		rq = ill->ill_rq;
7287 		zoneid = GLOBAL_ZONEID;
7288 		goto ipv6forus;
7289 	}
7290 
7291 	ipif = ill->ill_ipif;
7292 
7293 	/*
7294 	 * If a packet was received on an interface that is a 6to4 tunnel,
7295 	 * incoming IPv6 packets, with a 6to4 addressed IPv6 destination, must
7296 	 * be checked to have a 6to4 prefix (2002:V4ADDR::/48) that is equal to
7297 	 * the 6to4 prefix of the address configured on the receiving interface.
7298 	 * Otherwise, the packet was delivered to this interface in error and
7299 	 * the packet must be dropped.
7300 	 */
7301 	if ((ill->ill_is_6to4tun) && IN6_IS_ADDR_6TO4(&ip6h->ip6_dst)) {
7302 
7303 		if (!IN6_ARE_6TO4_PREFIX_EQUAL(&ipif->ipif_v6lcl_addr,
7304 		    &ip6h->ip6_dst)) {
7305 			if (ip_debug > 2) {
7306 				/* ip1dbg */
7307 				pr_addr_dbg("ip_rput_data_v6: received 6to4 "
7308 				    "addressed packet which is not for us: "
7309 				    "%s\n", AF_INET6, &ip6h->ip6_dst);
7310 			}
7311 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
7312 			freemsg(first_mp);
7313 			return;
7314 		}
7315 	}
7316 
7317 	/*
7318 	 * Find an ire that matches destination. For link-local addresses
7319 	 * we have to match the ill.
7320 	 * TBD for site local addresses.
7321 	 */
7322 	if (IN6_IS_ADDR_LINKLOCAL(&ip6h->ip6_dst)) {
7323 		ire = ire_ctable_lookup_v6(&ip6h->ip6_dst, NULL,
7324 		    IRE_CACHE|IRE_LOCAL, ill->ill_ipif, ALL_ZONES, NULL,
7325 		    MATCH_IRE_TYPE | MATCH_IRE_ILL_GROUP);
7326 	} else {
7327 		ire = ire_cache_lookup_v6(&ip6h->ip6_dst, ALL_ZONES,
7328 		    MBLK_GETLABEL(mp));
7329 	}
7330 	if (ire == NULL) {
7331 		/*
7332 		 * No matching IRE found.  Mark this packet as having
7333 		 * originated externally.
7334 		 */
7335 		if (!(ill->ill_flags & ILLF_ROUTER) || ll_multicast) {
7336 			BUMP_MIB(ill->ill_ip6_mib, ipv6ForwProhibits);
7337 			if (!(ill->ill_flags & ILLF_ROUTER))
7338 				BUMP_MIB(ill->ill_ip6_mib, ipv6InAddrErrors);
7339 			freemsg(hada_mp);
7340 			freemsg(first_mp);
7341 			return;
7342 		}
7343 		if (ip6h->ip6_hops <= 1) {
7344 			if (hada_mp != NULL)
7345 				goto hada_drop;
7346 			icmp_time_exceeded_v6(WR(q), first_mp,
7347 			    ICMP6_TIME_EXCEED_TRANSIT, ll_multicast, B_FALSE);
7348 			return;
7349 		}
7350 		/*
7351 		 * Per RFC 3513 section 2.5.2, we must not forward packets with
7352 		 * an unspecified source address.
7353 		 */
7354 		if (IN6_IS_ADDR_UNSPECIFIED(&ip6h->ip6_src)) {
7355 			BUMP_MIB(ill->ill_ip6_mib, ipv6ForwProhibits);
7356 			freemsg(hada_mp);
7357 			freemsg(first_mp);
7358 			return;
7359 		}
7360 		mp->b_prev = (mblk_t *)(uintptr_t)
7361 		    ill->ill_phyint->phyint_ifindex;
7362 		ip_newroute_v6(q, mp, &ip6h->ip6_dst, &ip6h->ip6_src,
7363 		    IN6_IS_ADDR_LINKLOCAL(&ip6h->ip6_dst) ? ill : NULL,
7364 		    ALL_ZONES);
7365 		return;
7366 	}
7367 	ipif_id = ire->ire_ipif->ipif_seqid;
7368 	/* we have a matching IRE */
7369 	if (ire->ire_stq != NULL) {
7370 		ill_group_t *ill_group;
7371 		ill_group_t *ire_group;
7372 
7373 		/*
7374 		 * To be quicker, we may wish not to chase pointers
7375 		 * (ire->ire_ipif->ipif_ill...) and instead store the
7376 		 * forwarding policy in the ire.  An unfortunate side-
7377 		 * effect of this would be requiring an ire flush whenever
7378 		 * the ILLF_ROUTER flag changes.  For now, chase pointers
7379 		 * once and store in the boolean no_forward.
7380 		 *
7381 		 * This appears twice to keep it out of the non-forwarding,
7382 		 * yes-it's-for-us-on-the-right-interface case.
7383 		 */
7384 		no_forward = ((ill->ill_flags &
7385 		    ire->ire_ipif->ipif_ill->ill_flags & ILLF_ROUTER) == 0);
7386 
7387 
7388 		ASSERT(first_mp == mp);
7389 		/*
7390 		 * This ire has a send-to queue - forward the packet.
7391 		 */
7392 		if (no_forward || ll_multicast || (hada_mp != NULL)) {
7393 			freemsg(hada_mp);
7394 			BUMP_MIB(ill->ill_ip6_mib, ipv6ForwProhibits);
7395 			if (no_forward)
7396 				BUMP_MIB(ill->ill_ip6_mib, ipv6InAddrErrors);
7397 			freemsg(mp);
7398 			ire_refrele(ire);
7399 			return;
7400 		}
7401 		if (ip6h->ip6_hops <= 1) {
7402 			ip1dbg(("ip_rput_data_v6: hop limit expired.\n"));
7403 			icmp_time_exceeded_v6(WR(q), mp,
7404 			    ICMP6_TIME_EXCEED_TRANSIT, ll_multicast, B_FALSE);
7405 			ire_refrele(ire);
7406 			return;
7407 		}
7408 		/*
7409 		 * Per RFC 3513 section 2.5.2, we must not forward packets with
7410 		 * an unspecified source address.
7411 		 */
7412 		if (IN6_IS_ADDR_UNSPECIFIED(&ip6h->ip6_src)) {
7413 			BUMP_MIB(ill->ill_ip6_mib, ipv6ForwProhibits);
7414 			freemsg(mp);
7415 			ire_refrele(ire);
7416 			return;
7417 		}
7418 
7419 		if (is_system_labeled()) {
7420 			mblk_t *mp1;
7421 
7422 			if ((mp1 = tsol_ip_forward(ire, mp)) == NULL) {
7423 				BUMP_MIB(ill->ill_ip6_mib, ipv6ForwProhibits);
7424 				freemsg(mp);
7425 				ire_refrele(ire);
7426 				return;
7427 			}
7428 			/* Size may have changed */
7429 			mp = mp1;
7430 			ip6h = (ip6_t *)mp->b_rptr;
7431 			pkt_len = msgdsize(mp);
7432 		}
7433 
7434 		if (pkt_len > ire->ire_max_frag) {
7435 			BUMP_MIB(ill->ill_ip6_mib, ipv6InTooBigErrors);
7436 			icmp_pkt2big_v6(WR(q), mp, ire->ire_max_frag,
7437 			    ll_multicast, B_TRUE);
7438 			ire_refrele(ire);
7439 			return;
7440 		}
7441 
7442 		/*
7443 		 * Check to see if we're forwarding the packet to a
7444 		 * different link from which it came.  If so, check the
7445 		 * source and destination addresses since routers must not
7446 		 * forward any packets with link-local source or
7447 		 * destination addresses to other links.  Otherwise (if
7448 		 * we're forwarding onto the same link), conditionally send
7449 		 * a redirect message.
7450 		 */
7451 		ill_group = ill->ill_group;
7452 		ire_group = ((ill_t *)(ire->ire_rfq)->q_ptr)->ill_group;
7453 		if (ire->ire_rfq != q && (ill_group == NULL ||
7454 		    ill_group != ire_group)) {
7455 			if (IN6_IS_ADDR_LINKLOCAL(&ip6h->ip6_dst) ||
7456 			    IN6_IS_ADDR_LINKLOCAL(&ip6h->ip6_src)) {
7457 				BUMP_MIB(ill->ill_ip6_mib, ipv6InAddrErrors);
7458 				freemsg(mp);
7459 				ire_refrele(ire);
7460 				return;
7461 			}
7462 			/* TBD add site-local check at site boundary? */
7463 		} else if (ipv6_send_redirects) {
7464 			in6_addr_t	*v6targ;
7465 			in6_addr_t	gw_addr_v6;
7466 			ire_t		*src_ire_v6 = NULL;
7467 
7468 			/*
7469 			 * Don't send a redirect when forwarding a source
7470 			 * routed packet.
7471 			 */
7472 			if (ip_source_routed_v6(ip6h, mp))
7473 				goto forward;
7474 
7475 			mutex_enter(&ire->ire_lock);
7476 			gw_addr_v6 = ire->ire_gateway_addr_v6;
7477 			mutex_exit(&ire->ire_lock);
7478 			if (!IN6_IS_ADDR_UNSPECIFIED(&gw_addr_v6)) {
7479 				v6targ = &gw_addr_v6;
7480 				/*
7481 				 * We won't send redirects to a router
7482 				 * that doesn't have a link local
7483 				 * address, but will forward.
7484 				 */
7485 				if (!IN6_IS_ADDR_LINKLOCAL(v6targ)) {
7486 					BUMP_MIB(ill->ill_ip6_mib,
7487 					    ipv6InAddrErrors);
7488 					goto forward;
7489 				}
7490 			} else {
7491 				v6targ = &ip6h->ip6_dst;
7492 			}
7493 
7494 			src_ire_v6 = ire_ftable_lookup_v6(&ip6h->ip6_src,
7495 			    NULL, NULL, IRE_INTERFACE, ire->ire_ipif, NULL,
7496 			    ALL_ZONES, 0, NULL,
7497 			    MATCH_IRE_IPIF | MATCH_IRE_TYPE);
7498 
7499 			if (src_ire_v6 != NULL) {
7500 				/*
7501 				 * The source is directly connected.
7502 				 */
7503 				mp1 = copymsg(mp);
7504 				if (mp1 != NULL) {
7505 					icmp_send_redirect_v6(WR(q),
7506 					    mp1, v6targ, &ip6h->ip6_dst,
7507 					    ill, B_FALSE);
7508 				}
7509 				ire_refrele(src_ire_v6);
7510 			}
7511 		}
7512 
7513 forward:
7514 		/* Hoplimit verified above */
7515 		ip6h->ip6_hops--;
7516 		UPDATE_IB_PKT_COUNT(ire);
7517 		ire->ire_last_used_time = lbolt;
7518 		BUMP_MIB(ill->ill_ip6_mib, ipv6OutForwDatagrams);
7519 		ip_xmit_v6(mp, ire, 0, NULL, B_FALSE, NULL);
7520 		IRE_REFRELE(ire);
7521 		return;
7522 	}
7523 	rq = ire->ire_rfq;
7524 
7525 	/*
7526 	 * Need to put on correct queue for reassembly to find it.
7527 	 * No need to use put() since reassembly has its own locks.
7528 	 * Note: multicast packets and packets destined to addresses
7529 	 * assigned to loopback (ire_rfq is NULL) will be reassembled on
7530 	 * the arriving ill.
7531 	 */
7532 	if (rq != q) {
7533 		boolean_t check_multi = B_TRUE;
7534 		ill_group_t *ill_group = NULL;
7535 		ill_group_t *ire_group = NULL;
7536 		ill_t	*ire_ill = NULL;
7537 		uint_t	ill_ifindex = ill->ill_usesrc_ifindex;
7538 
7539 		/*
7540 		 * To be quicker, we may wish not to chase pointers
7541 		 * (ire->ire_ipif->ipif_ill...) and instead store the
7542 		 * forwarding policy in the ire.  An unfortunate side-
7543 		 * effect of this would be requiring an ire flush whenever
7544 		 * the ILLF_ROUTER flag changes.  For now, chase pointers
7545 		 * once and store in the boolean no_forward.
7546 		 */
7547 		no_forward = ((ill->ill_flags &
7548 		    ire->ire_ipif->ipif_ill->ill_flags & ILLF_ROUTER) == 0);
7549 
7550 		ill_group = ill->ill_group;
7551 		if (rq != NULL) {
7552 			ire_ill = (ill_t *)(rq->q_ptr);
7553 			ire_group = ire_ill->ill_group;
7554 		}
7555 
7556 		/*
7557 		 * If it's part of the same IPMP group, or if it's a legal
7558 		 * address on the 'usesrc' interface, then bypass strict
7559 		 * checks.
7560 		 */
7561 		if (ill_group != NULL && ill_group == ire_group) {
7562 			check_multi = B_FALSE;
7563 		} else if (ill_ifindex != 0 && ire_ill != NULL &&
7564 		    ill_ifindex == ire_ill->ill_phyint->phyint_ifindex) {
7565 			check_multi = B_FALSE;
7566 		}
7567 
7568 		ASSERT(!IN6_IS_ADDR_MULTICAST(&ip6h->ip6_dst));
7569 		if (check_multi && ipv6_strict_dst_multihoming && no_forward) {
7570 			/*
7571 			 * This packet came in on an interface other than the
7572 			 * one associated with the destination address
7573 			 * and we are strict about matches.
7574 			 *
7575 			 * As long as the ills belong to the same group,
7576 			 * we don't consider them to arriving on the wrong
7577 			 * interface. Thus, when the switch is doing inbound
7578 			 * load spreading, we won't drop packets when we
7579 			 * are doing strict multihoming checks.
7580 			 */
7581 			BUMP_MIB(ill->ill_ip6_mib, ipv6ForwProhibits);
7582 			freemsg(hada_mp);
7583 			freemsg(first_mp);
7584 			ire_refrele(ire);
7585 			return;
7586 		}
7587 
7588 		if (rq != NULL)
7589 			q = rq;
7590 
7591 		ill = (ill_t *)q->q_ptr;
7592 		ASSERT(ill);
7593 	}
7594 
7595 	zoneid = ire->ire_zoneid;
7596 	UPDATE_IB_PKT_COUNT(ire);
7597 	ire->ire_last_used_time = lbolt;
7598 	/* Don't use the ire after this point. */
7599 	ire_refrele(ire);
7600 ipv6forus:
7601 	/*
7602 	 * Looks like this packet is for us one way or another.
7603 	 * This is where we'll process destination headers etc.
7604 	 */
7605 	for (; ; ) {
7606 		switch (nexthdr) {
7607 		case IPPROTO_TCP: {
7608 			uint16_t	*up;
7609 			uint32_t	sum;
7610 			int		offset;
7611 
7612 			hdr_len = pkt_len - remlen;
7613 
7614 			if (hada_mp != NULL) {
7615 				ip0dbg(("tcp hada drop\n"));
7616 				goto hada_drop;
7617 			}
7618 
7619 
7620 			/* TCP needs all of the TCP header */
7621 			if (remlen < TCP_MIN_HEADER_LENGTH)
7622 				goto pkt_too_short;
7623 			if (mp->b_cont != NULL &&
7624 			    whereptr + TCP_MIN_HEADER_LENGTH > mp->b_wptr) {
7625 				if (!pullupmsg(mp,
7626 				    hdr_len + TCP_MIN_HEADER_LENGTH)) {
7627 					BUMP_MIB(ill->ill_ip6_mib,
7628 					    ipv6InDiscards);
7629 					freemsg(first_mp);
7630 					return;
7631 				}
7632 				hck_flags = 0;
7633 				ip6h = (ip6_t *)mp->b_rptr;
7634 				whereptr = (uint8_t *)ip6h + hdr_len;
7635 			}
7636 			/*
7637 			 * Extract the offset field from the TCP header.
7638 			 */
7639 			offset = ((uchar_t *)ip6h)[hdr_len + 12] >> 4;
7640 			if (offset != 5) {
7641 				if (offset < 5) {
7642 					ip1dbg(("ip_rput_data_v6: short "
7643 					    "TCP data offset"));
7644 					BUMP_MIB(ill->ill_ip6_mib,
7645 					    ipv6InDiscards);
7646 					freemsg(first_mp);
7647 					return;
7648 				}
7649 				/*
7650 				 * There must be TCP options.
7651 				 * Make sure we can grab them.
7652 				 */
7653 				offset <<= 2;
7654 				if (remlen < offset)
7655 					goto pkt_too_short;
7656 				if (mp->b_cont != NULL &&
7657 				    whereptr + offset > mp->b_wptr) {
7658 					if (!pullupmsg(mp,
7659 					    hdr_len + offset)) {
7660 						BUMP_MIB(ill->ill_ip6_mib,
7661 						    ipv6InDiscards);
7662 						freemsg(first_mp);
7663 						return;
7664 					}
7665 					hck_flags = 0;
7666 					ip6h = (ip6_t *)mp->b_rptr;
7667 					whereptr = (uint8_t *)ip6h + hdr_len;
7668 				}
7669 			}
7670 
7671 			up = (uint16_t *)&ip6h->ip6_src;
7672 			/*
7673 			 * TCP checksum calculation.  First sum up the
7674 			 * pseudo-header fields:
7675 			 *  -	Source IPv6 address
7676 			 *  -	Destination IPv6 address
7677 			 *  -	TCP payload length
7678 			 *  -	TCP protocol ID
7679 			 */
7680 			sum = htons(IPPROTO_TCP + remlen) +
7681 			    up[0] + up[1] + up[2] + up[3] +
7682 			    up[4] + up[5] + up[6] + up[7] +
7683 			    up[8] + up[9] + up[10] + up[11] +
7684 			    up[12] + up[13] + up[14] + up[15];
7685 
7686 			/* Fold initial sum */
7687 			sum = (sum & 0xffff) + (sum >> 16);
7688 
7689 			mp1 = mp->b_cont;
7690 
7691 			if ((hck_flags & (HCK_FULLCKSUM|HCK_PARTIALCKSUM)) == 0)
7692 				IP6_STAT(ip6_in_sw_cksum);
7693 
7694 			IP_CKSUM_RECV(hck_flags, sum, (uchar_t *)
7695 			    ((uchar_t *)mp->b_rptr + DB_CKSUMSTART(mp)),
7696 			    (int32_t)(whereptr - (uchar_t *)mp->b_rptr),
7697 			    mp, mp1, cksum_err);
7698 
7699 			if (cksum_err) {
7700 				BUMP_MIB(&ip_mib, tcpInErrs);
7701 
7702 				if (hck_flags & HCK_FULLCKSUM)
7703 					IP6_STAT(ip6_tcp_in_full_hw_cksum_err);
7704 				else if (hck_flags & HCK_PARTIALCKSUM)
7705 					IP6_STAT(ip6_tcp_in_part_hw_cksum_err);
7706 				else
7707 					IP6_STAT(ip6_tcp_in_sw_cksum_err);
7708 
7709 				freemsg(first_mp);
7710 				return;
7711 			}
7712 tcp_fanout:
7713 			ip_fanout_tcp_v6(q, first_mp, ip6h, ill, inill,
7714 			    (flags|IP_FF_SEND_ICMP|IP_FF_SYN_ADDIRE|
7715 			    IP_FF_IP6INFO), hdr_len, mctl_present, zoneid);
7716 			return;
7717 		}
7718 		case IPPROTO_SCTP:
7719 		{
7720 			sctp_hdr_t *sctph;
7721 			uint32_t calcsum, pktsum;
7722 			uint_t hdr_len = pkt_len - remlen;
7723 
7724 			/* SCTP needs all of the SCTP header */
7725 			if (remlen < sizeof (*sctph)) {
7726 				goto pkt_too_short;
7727 			}
7728 			if (whereptr + sizeof (*sctph) > mp->b_wptr) {
7729 				ASSERT(mp->b_cont != NULL);
7730 				if (!pullupmsg(mp, hdr_len + sizeof (*sctph))) {
7731 					BUMP_MIB(ill->ill_ip6_mib,
7732 					    ipv6InDiscards);
7733 					freemsg(mp);
7734 					return;
7735 				}
7736 				ip6h = (ip6_t *)mp->b_rptr;
7737 				whereptr = (uint8_t *)ip6h + hdr_len;
7738 			}
7739 
7740 			sctph = (sctp_hdr_t *)(mp->b_rptr + hdr_len);
7741 			/* checksum */
7742 			pktsum = sctph->sh_chksum;
7743 			sctph->sh_chksum = 0;
7744 			calcsum = sctp_cksum(mp, hdr_len);
7745 			if (calcsum != pktsum) {
7746 				BUMP_MIB(&sctp_mib, sctpChecksumError);
7747 				freemsg(mp);
7748 				return;
7749 			}
7750 			sctph->sh_chksum = pktsum;
7751 			ports = *(uint32_t *)(mp->b_rptr + hdr_len);
7752 			if ((connp = sctp_fanout(&ip6h->ip6_src, &ip6h->ip6_dst,
7753 			    ports, ipif_id, zoneid, mp)) == NULL) {
7754 				ip_fanout_sctp_raw(first_mp, ill,
7755 				    (ipha_t *)ip6h, B_FALSE, ports,
7756 				    mctl_present,
7757 				    (flags|IP_FF_SEND_ICMP|IP_FF_IP6INFO),
7758 				    B_TRUE, ipif_id, zoneid);
7759 				return;
7760 			}
7761 			BUMP_MIB(&ip_mib, ipInDelivers);
7762 			sctp_input(connp, (ipha_t *)ip6h, mp, first_mp, ill,
7763 			    B_FALSE, mctl_present);
7764 			return;
7765 		}
7766 		case IPPROTO_UDP: {
7767 			uint16_t	*up;
7768 			uint32_t	sum;
7769 
7770 			hdr_len = pkt_len - remlen;
7771 
7772 			if (hada_mp != NULL) {
7773 				ip0dbg(("udp hada drop\n"));
7774 				goto hada_drop;
7775 			}
7776 
7777 			/* Verify that at least the ports are present */
7778 			if (remlen < UDPH_SIZE)
7779 				goto pkt_too_short;
7780 			if (mp->b_cont != NULL &&
7781 			    whereptr + UDPH_SIZE > mp->b_wptr) {
7782 				if (!pullupmsg(mp, hdr_len + UDPH_SIZE)) {
7783 					BUMP_MIB(ill->ill_ip6_mib,
7784 					    ipv6InDiscards);
7785 					freemsg(first_mp);
7786 					return;
7787 				}
7788 				hck_flags = 0;
7789 				ip6h = (ip6_t *)mp->b_rptr;
7790 				whereptr = (uint8_t *)ip6h + hdr_len;
7791 			}
7792 
7793 			/*
7794 			 *  Before going through the regular checksum
7795 			 *  calculation, make sure the received checksum
7796 			 *  is non-zero. RFC 2460 says, a 0x0000 checksum
7797 			 *  in a UDP packet (within IPv6 packet) is invalid
7798 			 *  and should be replaced by 0xffff. This makes
7799 			 *  sense as regular checksum calculation will
7800 			 *  pass for both the cases i.e. 0x0000 and 0xffff.
7801 			 *  Removing one of the case makes error detection
7802 			 *  stronger.
7803 			 */
7804 
7805 			if (((udpha_t *)whereptr)->uha_checksum == 0) {
7806 				/* 0x0000 checksum is invalid */
7807 				ip1dbg(("ip_rput_data_v6: Invalid UDP "
7808 				    "checksum value 0x0000\n"));
7809 				BUMP_MIB(ill->ill_ip6_mib, udpInCksumErrs);
7810 				freemsg(first_mp);
7811 				return;
7812 			}
7813 
7814 			up = (uint16_t *)&ip6h->ip6_src;
7815 
7816 			/*
7817 			 * UDP checksum calculation.  First sum up the
7818 			 * pseudo-header fields:
7819 			 *  -	Source IPv6 address
7820 			 *  -	Destination IPv6 address
7821 			 *  -	UDP payload length
7822 			 *  -	UDP protocol ID
7823 			 */
7824 
7825 			sum = htons(IPPROTO_UDP + remlen) +
7826 			    up[0] + up[1] + up[2] + up[3] +
7827 			    up[4] + up[5] + up[6] + up[7] +
7828 			    up[8] + up[9] + up[10] + up[11] +
7829 			    up[12] + up[13] + up[14] + up[15];
7830 
7831 			/* Fold initial sum */
7832 			sum = (sum & 0xffff) + (sum >> 16);
7833 
7834 			if (reass_hck_flags != 0) {
7835 				hck_flags = reass_hck_flags;
7836 
7837 				IP_CKSUM_RECV_REASS(hck_flags,
7838 				    (int32_t)(whereptr - (uchar_t *)mp->b_rptr),
7839 				    sum, reass_sum, cksum_err);
7840 			} else {
7841 				mp1 = mp->b_cont;
7842 
7843 				IP_CKSUM_RECV(hck_flags, sum, (uchar_t *)
7844 				    ((uchar_t *)mp->b_rptr + DB_CKSUMSTART(mp)),
7845 				    (int32_t)(whereptr - (uchar_t *)mp->b_rptr),
7846 				    mp, mp1, cksum_err);
7847 			}
7848 
7849 			if ((hck_flags & (HCK_FULLCKSUM|HCK_PARTIALCKSUM)) == 0)
7850 				IP6_STAT(ip6_in_sw_cksum);
7851 
7852 			if (cksum_err) {
7853 				BUMP_MIB(ill->ill_ip6_mib, udpInCksumErrs);
7854 
7855 				if (hck_flags & HCK_FULLCKSUM)
7856 					IP6_STAT(ip6_udp_in_full_hw_cksum_err);
7857 				else if (hck_flags & HCK_PARTIALCKSUM)
7858 					IP6_STAT(ip6_udp_in_part_hw_cksum_err);
7859 				else
7860 					IP6_STAT(ip6_udp_in_sw_cksum_err);
7861 
7862 				freemsg(first_mp);
7863 				return;
7864 			}
7865 			goto udp_fanout;
7866 		}
7867 		case IPPROTO_ICMPV6: {
7868 			uint16_t	*up;
7869 			uint32_t	sum;
7870 			uint_t		hdr_len = pkt_len - remlen;
7871 
7872 			if (hada_mp != NULL) {
7873 				ip0dbg(("icmp hada drop\n"));
7874 				goto hada_drop;
7875 			}
7876 
7877 			up = (uint16_t *)&ip6h->ip6_src;
7878 			sum = htons(IPPROTO_ICMPV6 + remlen) +
7879 			    up[0] + up[1] + up[2] + up[3] +
7880 			    up[4] + up[5] + up[6] + up[7] +
7881 			    up[8] + up[9] + up[10] + up[11] +
7882 			    up[12] + up[13] + up[14] + up[15];
7883 			sum = (sum & 0xffff) + (sum >> 16);
7884 			sum = IP_CSUM(mp, hdr_len, sum);
7885 			if (sum != 0) {
7886 				/* IPv6 ICMP checksum failed */
7887 				ip1dbg(("ip_rput_data_v6: ICMPv6 checksum "
7888 				    "failed %x\n",
7889 				    sum));
7890 				BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInMsgs);
7891 				BUMP_MIB(ill->ill_icmp6_mib,
7892 				    ipv6IfIcmpInErrors);
7893 				freemsg(first_mp);
7894 				return;
7895 			}
7896 
7897 		icmp_fanout:
7898 			/* Check variable for testing applications */
7899 			if (ipv6_drop_inbound_icmpv6) {
7900 				freemsg(first_mp);
7901 				return;
7902 			}
7903 			/*
7904 			 * Assume that there is always at least one conn for
7905 			 * ICMPv6 (in.ndpd) i.e. don't optimize the case
7906 			 * where there is no conn.
7907 			 */
7908 			if (IN6_IS_ADDR_MULTICAST(&ip6h->ip6_dst)) {
7909 				ASSERT(!(ill->ill_phyint->phyint_flags &
7910 				    PHYI_LOOPBACK));
7911 				/*
7912 				 * In the multicast case, applications may have
7913 				 * joined the group from different zones, so we
7914 				 * need to deliver the packet to each of them.
7915 				 * Loop through the multicast memberships
7916 				 * structures (ilm) on the receive ill and send
7917 				 * a copy of the packet up each matching one.
7918 				 */
7919 				ILM_WALKER_HOLD(ill);
7920 				for (ilm = ill->ill_ilm; ilm != NULL;
7921 				    ilm = ilm->ilm_next) {
7922 					if (ilm->ilm_flags & ILM_DELETED)
7923 						continue;
7924 					if (!IN6_ARE_ADDR_EQUAL(
7925 					    &ilm->ilm_v6addr, &ip6h->ip6_dst))
7926 						continue;
7927 					if (!ipif_lookup_zoneid(ill,
7928 					    ilm->ilm_zoneid, IPIF_UP, NULL))
7929 						continue;
7930 
7931 					first_mp1 = ip_copymsg(first_mp);
7932 					if (first_mp1 == NULL)
7933 						continue;
7934 					icmp_inbound_v6(q, first_mp1, ill,
7935 					    hdr_len, mctl_present, 0,
7936 					    ilm->ilm_zoneid);
7937 				}
7938 				ILM_WALKER_RELE(ill);
7939 			} else {
7940 				first_mp1 = ip_copymsg(first_mp);
7941 				if (first_mp1 != NULL)
7942 					icmp_inbound_v6(q, first_mp1, ill,
7943 					    hdr_len, mctl_present, 0, zoneid);
7944 			}
7945 		}
7946 			/* FALLTHRU */
7947 		default: {
7948 			/*
7949 			 * Handle protocols with which IPv6 is less intimate.
7950 			 */
7951 			uint_t proto_flags = IP_FF_RAWIP|IP_FF_IP6INFO;
7952 
7953 			if (hada_mp != NULL) {
7954 				ip0dbg(("default hada drop\n"));
7955 				goto hada_drop;
7956 			}
7957 
7958 			/*
7959 			 * Enable sending ICMP for "Unknown" nexthdr
7960 			 * case. i.e. where we did not FALLTHRU from
7961 			 * IPPROTO_ICMPV6 processing case above.
7962 			 * If we did FALLTHRU, then the packet has already been
7963 			 * processed for IPPF, don't process it again in
7964 			 * ip_fanout_proto_v6; set IP6_NO_IPPOLICY in the
7965 			 * flags
7966 			 */
7967 			if (nexthdr != IPPROTO_ICMPV6)
7968 				proto_flags |= IP_FF_SEND_ICMP;
7969 			else
7970 				proto_flags |= IP6_NO_IPPOLICY;
7971 
7972 			ip_fanout_proto_v6(q, first_mp, ip6h, ill, inill,
7973 			    nexthdr, prev_nexthdr_offset, (flags|proto_flags),
7974 			    mctl_present, zoneid);
7975 			return;
7976 		}
7977 
7978 		case IPPROTO_DSTOPTS: {
7979 			uint_t ehdrlen;
7980 			uint8_t *optptr;
7981 			ip6_dest_t *desthdr;
7982 
7983 			/* Check if AH is present. */
7984 			if (ipsec_early_ah_v6(q, first_mp, mctl_present, ill,
7985 			    ire, hada_mp, zoneid)) {
7986 				ip0dbg(("dst early hada drop\n"));
7987 				return;
7988 			}
7989 
7990 			/*
7991 			 * Reinitialize pointers, as ipsec_early_ah_v6() does
7992 			 * complete pullups.  We don't have to do more pullups
7993 			 * as a result.
7994 			 */
7995 			whereptr = (uint8_t *)((uintptr_t)mp->b_rptr +
7996 			    (uintptr_t)(whereptr - ((uint8_t *)ip6h)));
7997 			ip6h = (ip6_t *)mp->b_rptr;
7998 
7999 			if (remlen < MIN_EHDR_LEN)
8000 				goto pkt_too_short;
8001 
8002 			desthdr = (ip6_dest_t *)whereptr;
8003 			nexthdr = desthdr->ip6d_nxt;
8004 			prev_nexthdr_offset = (uint_t)(whereptr -
8005 			    (uint8_t *)ip6h);
8006 			ehdrlen = 8 * (desthdr->ip6d_len + 1);
8007 			if (remlen < ehdrlen)
8008 				goto pkt_too_short;
8009 			optptr = whereptr + 2;
8010 			/*
8011 			 * Note: XXX This code does not seem to make
8012 			 * distinction between Destination Options Header
8013 			 * being before/after Routing Header which can
8014 			 * happen if we are at the end of source route.
8015 			 * This may become significant in future.
8016 			 * (No real significant Destination Options are
8017 			 * defined/implemented yet ).
8018 			 */
8019 			switch (ip_process_options_v6(q, first_mp, ip6h, optptr,
8020 			    ehdrlen - 2, IPPROTO_DSTOPTS)) {
8021 			case -1:
8022 				/*
8023 				 * Packet has been consumed and any needed
8024 				 * ICMP errors sent.
8025 				 */
8026 				BUMP_MIB(ill->ill_ip6_mib, ipv6InHdrErrors);
8027 				freemsg(hada_mp);
8028 				return;
8029 			case 0:
8030 				/* No action needed  continue */
8031 				break;
8032 			case 1:
8033 				/*
8034 				 * Unnexpected return value
8035 				 * (Router alert is a Hop-by-Hop option)
8036 				 */
8037 #ifdef DEBUG
8038 				panic("ip_rput_data_v6: router "
8039 				    "alert hbh opt indication in dest opt");
8040 				/*NOTREACHED*/
8041 #else
8042 				freemsg(hada_mp);
8043 				freemsg(first_mp);
8044 				BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
8045 				return;
8046 #endif
8047 			}
8048 			used = ehdrlen;
8049 			break;
8050 		}
8051 		case IPPROTO_FRAGMENT: {
8052 			ip6_frag_t *fraghdr;
8053 			size_t no_frag_hdr_len;
8054 
8055 			if (hada_mp != NULL) {
8056 				ip0dbg(("frag hada drop\n"));
8057 				goto hada_drop;
8058 			}
8059 
8060 			ASSERT(first_mp == mp);
8061 			if (remlen < sizeof (ip6_frag_t))
8062 				goto pkt_too_short;
8063 
8064 			if (mp->b_cont != NULL &&
8065 			    whereptr + sizeof (ip6_frag_t) > mp->b_wptr) {
8066 				if (!pullupmsg(mp,
8067 				    pkt_len - remlen + sizeof (ip6_frag_t))) {
8068 					BUMP_MIB(ill->ill_ip6_mib,
8069 					    ipv6InDiscards);
8070 					freemsg(mp);
8071 					return;
8072 				}
8073 				hck_flags = 0;
8074 				ip6h = (ip6_t *)mp->b_rptr;
8075 				whereptr = (uint8_t *)ip6h + pkt_len - remlen;
8076 			}
8077 
8078 			fraghdr = (ip6_frag_t *)whereptr;
8079 			used = (uint_t)sizeof (ip6_frag_t);
8080 			BUMP_MIB(ill->ill_ip6_mib, ipv6ReasmReqds);
8081 
8082 			/*
8083 			 * Invoke the CGTP (multirouting) filtering module to
8084 			 * process the incoming packet. Packets identified as
8085 			 * duplicates must be discarded. Filtering is active
8086 			 * only if the the ip_cgtp_filter ndd variable is
8087 			 * non-zero.
8088 			 */
8089 			if (ip_cgtp_filter && (ip_cgtp_filter_ops != NULL)) {
8090 				int cgtp_flt_pkt =
8091 				    ip_cgtp_filter_ops->cfo_filter_v6(
8092 				    inill->ill_rq, ip6h, fraghdr);
8093 				if (cgtp_flt_pkt == CGTP_IP_PKT_DUPLICATE) {
8094 					freemsg(mp);
8095 					return;
8096 				}
8097 			}
8098 
8099 			/* Restore the flags */
8100 			DB_CKSUMFLAGS(mp) = hck_flags;
8101 
8102 			mp = ip_rput_frag_v6(q, mp, ip6h, fraghdr,
8103 			    remlen - used, &prev_nexthdr_offset,
8104 			    &reass_sum, &reass_hck_flags);
8105 			if (mp == NULL) {
8106 				/* Reassembly is still pending */
8107 				return;
8108 			}
8109 			/* The first mblk are the headers before the frag hdr */
8110 			BUMP_MIB(ill->ill_ip6_mib, ipv6ReasmOKs);
8111 
8112 			first_mp = mp;	/* mp has most likely changed! */
8113 			no_frag_hdr_len = mp->b_wptr - mp->b_rptr;
8114 			ip6h = (ip6_t *)mp->b_rptr;
8115 			nexthdr = ((char *)ip6h)[prev_nexthdr_offset];
8116 			whereptr = mp->b_rptr + no_frag_hdr_len;
8117 			remlen = ntohs(ip6h->ip6_plen)  +
8118 			    (uint16_t)(IPV6_HDR_LEN - no_frag_hdr_len);
8119 			pkt_len = msgdsize(mp);
8120 			used = 0;
8121 			break;
8122 		}
8123 		case IPPROTO_HOPOPTS:
8124 			if (hada_mp != NULL) {
8125 				ip0dbg(("hop hada drop\n"));
8126 				goto hada_drop;
8127 			}
8128 			/*
8129 			 * Illegal header sequence.
8130 			 * (Hop-by-hop headers are processed above
8131 			 *  and required to immediately follow IPv6 header)
8132 			 */
8133 			icmp_param_problem_v6(WR(q), first_mp,
8134 			    ICMP6_PARAMPROB_NEXTHEADER,
8135 			    prev_nexthdr_offset,
8136 			    B_FALSE, B_FALSE);
8137 			return;
8138 
8139 		case IPPROTO_ROUTING: {
8140 			uint_t ehdrlen;
8141 			ip6_rthdr_t *rthdr;
8142 
8143 			/* Check if AH is present. */
8144 			if (ipsec_early_ah_v6(q, first_mp, mctl_present, ill,
8145 			    ire, hada_mp, zoneid)) {
8146 				ip0dbg(("routing hada drop\n"));
8147 				return;
8148 			}
8149 
8150 			/*
8151 			 * Reinitialize pointers, as ipsec_early_ah_v6() does
8152 			 * complete pullups.  We don't have to do more pullups
8153 			 * as a result.
8154 			 */
8155 			whereptr = (uint8_t *)((uintptr_t)mp->b_rptr +
8156 			    (uintptr_t)(whereptr - ((uint8_t *)ip6h)));
8157 			ip6h = (ip6_t *)mp->b_rptr;
8158 
8159 			if (remlen < MIN_EHDR_LEN)
8160 				goto pkt_too_short;
8161 			rthdr = (ip6_rthdr_t *)whereptr;
8162 			nexthdr = rthdr->ip6r_nxt;
8163 			prev_nexthdr_offset = (uint_t)(whereptr -
8164 			    (uint8_t *)ip6h);
8165 			ehdrlen = 8 * (rthdr->ip6r_len + 1);
8166 			if (remlen < ehdrlen)
8167 				goto pkt_too_short;
8168 			if (rthdr->ip6r_segleft != 0) {
8169 				/* Not end of source route */
8170 				if (ll_multicast) {
8171 					BUMP_MIB(ill->ill_ip6_mib,
8172 					    ipv6ForwProhibits);
8173 					freemsg(hada_mp);
8174 					freemsg(mp);
8175 					return;
8176 				}
8177 				ip_process_rthdr(q, mp, ip6h, rthdr, ill,
8178 				    flags, hada_mp);
8179 				return;
8180 			}
8181 			used = ehdrlen;
8182 			break;
8183 		}
8184 		case IPPROTO_AH:
8185 		case IPPROTO_ESP: {
8186 			/*
8187 			 * Fast path for AH/ESP. If this is the first time
8188 			 * we are sending a datagram to AH/ESP, allocate
8189 			 * a IPSEC_IN message and prepend it. Otherwise,
8190 			 * just fanout.
8191 			 */
8192 
8193 			ipsec_in_t *ii;
8194 			int ipsec_rc;
8195 
8196 			if (!mctl_present) {
8197 				ASSERT(first_mp == mp);
8198 				if ((first_mp = ipsec_in_alloc(B_FALSE)) ==
8199 				    NULL) {
8200 					ip1dbg(("ip_rput_data_v6: IPSEC_IN "
8201 					    "allocation failure.\n"));
8202 					BUMP_MIB(ill->ill_ip6_mib,
8203 					    ipv6InDiscards);
8204 					freemsg(mp);
8205 					return;
8206 				}
8207 				/*
8208 				 * Store the ill_index so that when we come back
8209 				 * from IPSEC we ride on the same queue.
8210 				 */
8211 				ii = (ipsec_in_t *)first_mp->b_rptr;
8212 				ii->ipsec_in_ill_index =
8213 				    ill->ill_phyint->phyint_ifindex;
8214 				ii->ipsec_in_rill_index =
8215 				    ii->ipsec_in_ill_index;
8216 				first_mp->b_cont = mp;
8217 				/*
8218 				 * Cache hardware acceleration info.
8219 				 */
8220 				if (hada_mp != NULL) {
8221 					IPSECHW_DEBUG(IPSECHW_PKT,
8222 					    ("ip_rput_data_v6: "
8223 						"caching data attr.\n"));
8224 					ii->ipsec_in_accelerated = B_TRUE;
8225 					ii->ipsec_in_da = hada_mp;
8226 					hada_mp = NULL;
8227 				}
8228 			} else {
8229 				ii = (ipsec_in_t *)first_mp->b_rptr;
8230 			}
8231 
8232 			if (!ipsec_loaded()) {
8233 				ip_proto_not_sup(q, first_mp, IP_FF_SEND_ICMP,
8234 				    ire->ire_zoneid);
8235 				return;
8236 			}
8237 
8238 			/* select inbound SA and have IPsec process the pkt */
8239 			if (nexthdr == IPPROTO_ESP) {
8240 				esph_t *esph = ipsec_inbound_esp_sa(first_mp);
8241 				if (esph == NULL)
8242 					return;
8243 				ASSERT(ii->ipsec_in_esp_sa != NULL);
8244 				ASSERT(ii->ipsec_in_esp_sa->ipsa_input_func !=
8245 				    NULL);
8246 				ipsec_rc = ii->ipsec_in_esp_sa->ipsa_input_func(
8247 				    first_mp, esph);
8248 			} else {
8249 				ah_t *ah = ipsec_inbound_ah_sa(first_mp);
8250 				if (ah == NULL)
8251 					return;
8252 				ASSERT(ii->ipsec_in_ah_sa != NULL);
8253 				ASSERT(ii->ipsec_in_ah_sa->ipsa_input_func !=
8254 				    NULL);
8255 				ipsec_rc = ii->ipsec_in_ah_sa->ipsa_input_func(
8256 				    first_mp, ah);
8257 			}
8258 
8259 			switch (ipsec_rc) {
8260 			case IPSEC_STATUS_SUCCESS:
8261 				break;
8262 			case IPSEC_STATUS_FAILED:
8263 				BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
8264 				/* FALLTHRU */
8265 			case IPSEC_STATUS_PENDING:
8266 				return;
8267 			}
8268 			/* we're done with IPsec processing, send it up */
8269 			ip_fanout_proto_again(first_mp, ill, inill, ire);
8270 			return;
8271 		}
8272 		case IPPROTO_NONE:
8273 			/* All processing is done. Count as "delivered". */
8274 			freemsg(hada_mp);
8275 			freemsg(first_mp);
8276 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDelivers);
8277 			return;
8278 		}
8279 		whereptr += used;
8280 		ASSERT(remlen >= used);
8281 		remlen -= used;
8282 	}
8283 	/* NOTREACHED */
8284 
8285 pkt_too_short:
8286 	ip1dbg(("ip_rput_data_v6: packet too short %d %lu %d\n",
8287 	    ip6_len, pkt_len, remlen));
8288 	BUMP_MIB(ill->ill_ip6_mib, ipv6InTruncatedPkts);
8289 	freemsg(hada_mp);
8290 	freemsg(first_mp);
8291 	return;
8292 udp_fanout:
8293 	if (mctl_present || IN6_IS_ADDR_MULTICAST(&ip6h->ip6_dst)) {
8294 		connp = NULL;
8295 	} else {
8296 		connp = ipcl_classify_v6(mp, IPPROTO_UDP, hdr_len, zoneid);
8297 		if ((connp != NULL) && (connp->conn_upq == NULL)) {
8298 			CONN_DEC_REF(connp);
8299 			connp = NULL;
8300 		}
8301 	}
8302 
8303 	if (connp == NULL) {
8304 		uint32_t	ports;
8305 
8306 		ports = *(uint32_t *)(mp->b_rptr + hdr_len +
8307 		    UDP_PORTS_OFFSET);
8308 		IP6_STAT(ip6_udp_slow_path);
8309 		ip_fanout_udp_v6(q, first_mp, ip6h, ports, ill, inill,
8310 		    (flags|IP_FF_SEND_ICMP|IP_FF_IP6INFO), mctl_present,
8311 		    zoneid);
8312 		return;
8313 	}
8314 
8315 	if (CONN_UDP_FLOWCTLD(connp)) {
8316 		freemsg(first_mp);
8317 		BUMP_MIB(ill->ill_ip6_mib, udpInOverflows);
8318 		CONN_DEC_REF(connp);
8319 		return;
8320 	}
8321 
8322 	/* Initiate IPPF processing */
8323 	if (IP6_IN_IPP(flags)) {
8324 		ip_process(IPP_LOCAL_IN, &mp, ill->ill_phyint->phyint_ifindex);
8325 		if (mp == NULL) {
8326 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
8327 			CONN_DEC_REF(connp);
8328 			return;
8329 		}
8330 	}
8331 
8332 	if (connp->conn_ipv6_recvpktinfo ||
8333 	    IN6_IS_ADDR_LINKLOCAL(&ip6h->ip6_src)) {
8334 		mp = ip_add_info_v6(mp, inill, &ip6h->ip6_dst);
8335 		if (mp == NULL) {
8336 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
8337 			CONN_DEC_REF(connp);
8338 			return;
8339 		}
8340 	}
8341 
8342 	IP6_STAT(ip6_udp_fast_path);
8343 	BUMP_MIB(ill->ill_ip6_mib, ipv6InReceives);
8344 	BUMP_MIB(ill->ill_ip6_mib, ipv6InDelivers);
8345 
8346 	/* Send it upstream */
8347 	CONN_UDP_RECV(connp, mp);
8348 
8349 	CONN_DEC_REF(connp);
8350 	freemsg(hada_mp);
8351 	return;
8352 
8353 hada_drop:
8354 	ip1dbg(("ip_rput_data_v6: malformed accelerated packet\n"));
8355 	/* IPsec kstats: bump counter here */
8356 	freemsg(hada_mp);
8357 	freemsg(first_mp);
8358 }
8359 
8360 /*
8361  * Reassemble fragment.
8362  * When it returns a completed message the first mblk will only contain
8363  * the headers prior to the fragment header.
8364  *
8365  * prev_nexthdr_offset is an offset indication of where the nexthdr field is
8366  * of the preceding header.  This is needed to patch the previous header's
8367  * nexthdr field when reassembly completes.
8368  */
8369 static mblk_t *
8370 ip_rput_frag_v6(queue_t *q, mblk_t *mp, ip6_t *ip6h,
8371     ip6_frag_t *fraghdr, uint_t remlen, uint_t *prev_nexthdr_offset,
8372     uint32_t *cksum_val, uint16_t *cksum_flags)
8373 {
8374 	ill_t		*ill = (ill_t *)q->q_ptr;
8375 	uint32_t	ident = ntohl(fraghdr->ip6f_ident);
8376 	uint16_t	offset;
8377 	boolean_t	more_frags;
8378 	uint8_t		nexthdr = fraghdr->ip6f_nxt;
8379 	in6_addr_t	*v6dst_ptr;
8380 	in6_addr_t	*v6src_ptr;
8381 	uint_t		end;
8382 	uint_t		hdr_length;
8383 	size_t		count;
8384 	ipf_t		*ipf;
8385 	ipf_t		**ipfp;
8386 	ipfb_t		*ipfb;
8387 	mblk_t		*mp1;
8388 	uint8_t		ecn_info = 0;
8389 	size_t		msg_len;
8390 	mblk_t		*tail_mp;
8391 	mblk_t		*t_mp;
8392 	boolean_t	pruned = B_FALSE;
8393 	uint32_t	sum_val;
8394 	uint16_t	sum_flags;
8395 
8396 
8397 	if (cksum_val != NULL)
8398 		*cksum_val = 0;
8399 	if (cksum_flags != NULL)
8400 		*cksum_flags = 0;
8401 
8402 	/*
8403 	 * We utilize hardware computed checksum info only for UDP since
8404 	 * IP fragmentation is a normal occurence for the protocol.  In
8405 	 * addition, checksum offload support for IP fragments carrying
8406 	 * UDP payload is commonly implemented across network adapters.
8407 	 */
8408 	ASSERT(ill != NULL);
8409 	if (nexthdr == IPPROTO_UDP && dohwcksum && ILL_HCKSUM_CAPABLE(ill) &&
8410 	    (DB_CKSUMFLAGS(mp) & (HCK_FULLCKSUM | HCK_PARTIALCKSUM))) {
8411 		mblk_t *mp1 = mp->b_cont;
8412 		int32_t len;
8413 
8414 		/* Record checksum information from the packet */
8415 		sum_val = (uint32_t)DB_CKSUM16(mp);
8416 		sum_flags = DB_CKSUMFLAGS(mp);
8417 
8418 		/* fragmented payload offset from beginning of mblk */
8419 		offset = (uint16_t)((uchar_t *)&fraghdr[1] - mp->b_rptr);
8420 
8421 		if ((sum_flags & HCK_PARTIALCKSUM) &&
8422 		    (mp1 == NULL || mp1->b_cont == NULL) &&
8423 		    offset >= (uint16_t)DB_CKSUMSTART(mp) &&
8424 		    ((len = offset - (uint16_t)DB_CKSUMSTART(mp)) & 1) == 0) {
8425 			uint32_t adj;
8426 			/*
8427 			 * Partial checksum has been calculated by hardware
8428 			 * and attached to the packet; in addition, any
8429 			 * prepended extraneous data is even byte aligned.
8430 			 * If any such data exists, we adjust the checksum;
8431 			 * this would also handle any postpended data.
8432 			 */
8433 			IP_ADJCKSUM_PARTIAL(mp->b_rptr + DB_CKSUMSTART(mp),
8434 			    mp, mp1, len, adj);
8435 
8436 			/* One's complement subtract extraneous checksum */
8437 			if (adj >= sum_val)
8438 				sum_val = ~(adj - sum_val) & 0xFFFF;
8439 			else
8440 				sum_val -= adj;
8441 		}
8442 	} else {
8443 		sum_val = 0;
8444 		sum_flags = 0;
8445 	}
8446 
8447 	/* Clear hardware checksumming flag */
8448 	DB_CKSUMFLAGS(mp) = 0;
8449 
8450 	/*
8451 	 * Note: Fragment offset in header is in 8-octet units.
8452 	 * Clearing least significant 3 bits not only extracts
8453 	 * it but also gets it in units of octets.
8454 	 */
8455 	offset = ntohs(fraghdr->ip6f_offlg) & ~7;
8456 	more_frags = (fraghdr->ip6f_offlg & IP6F_MORE_FRAG);
8457 
8458 	/*
8459 	 * Is the more frags flag on and the payload length not a multiple
8460 	 * of eight?
8461 	 */
8462 	if (more_frags && (ntohs(ip6h->ip6_plen) & 7)) {
8463 		BUMP_MIB(ill->ill_ip6_mib, ipv6InHdrErrors);
8464 		icmp_param_problem_v6(WR(q), mp, ICMP6_PARAMPROB_HEADER,
8465 		    (uint32_t)((char *)&ip6h->ip6_plen -
8466 		    (char *)ip6h), B_FALSE, B_FALSE);
8467 		return (NULL);
8468 	}
8469 
8470 	v6src_ptr = &ip6h->ip6_src;
8471 	v6dst_ptr = &ip6h->ip6_dst;
8472 	end = remlen;
8473 
8474 	hdr_length = (uint_t)((char *)&fraghdr[1] - (char *)ip6h);
8475 	end += offset;
8476 
8477 	/*
8478 	 * Would fragment cause reassembled packet to have a payload length
8479 	 * greater than IP_MAXPACKET - the max payload size?
8480 	 */
8481 	if (end > IP_MAXPACKET) {
8482 		BUMP_MIB(ill->ill_ip6_mib, ipv6InHdrErrors);
8483 		icmp_param_problem_v6(WR(q), mp, ICMP6_PARAMPROB_HEADER,
8484 		    (uint32_t)((char *)&fraghdr->ip6f_offlg -
8485 		    (char *)ip6h), B_FALSE, B_FALSE);
8486 		return (NULL);
8487 	}
8488 
8489 	/*
8490 	 * This packet just has one fragment. Reassembly not
8491 	 * needed.
8492 	 */
8493 	if (!more_frags && offset == 0) {
8494 		goto reass_done;
8495 	}
8496 
8497 	/*
8498 	 * Drop the fragmented as early as possible, if
8499 	 * we don't have resource(s) to re-assemble.
8500 	 */
8501 	if (ip_reass_queue_bytes == 0) {
8502 		freemsg(mp);
8503 		return (NULL);
8504 	}
8505 
8506 	/* Record the ECN field info. */
8507 	ecn_info = (uint8_t)(ntohl(ip6h->ip6_vcf & htonl(~0xFFCFFFFF)) >> 20);
8508 	/*
8509 	 * If this is not the first fragment, dump the unfragmentable
8510 	 * portion of the packet.
8511 	 */
8512 	if (offset)
8513 		mp->b_rptr = (uchar_t *)&fraghdr[1];
8514 
8515 	/*
8516 	 * Fragmentation reassembly.  Each ILL has a hash table for
8517 	 * queueing packets undergoing reassembly for all IPIFs
8518 	 * associated with the ILL.  The hash is based on the packet
8519 	 * IP ident field.  The ILL frag hash table was allocated
8520 	 * as a timer block at the time the ILL was created.  Whenever
8521 	 * there is anything on the reassembly queue, the timer will
8522 	 * be running.
8523 	 */
8524 	msg_len = MBLKSIZE(mp);
8525 	tail_mp = mp;
8526 	while (tail_mp->b_cont != NULL) {
8527 		tail_mp = tail_mp->b_cont;
8528 		msg_len += MBLKSIZE(tail_mp);
8529 	}
8530 	/*
8531 	 * If the reassembly list for this ILL will get too big
8532 	 * prune it.
8533 	 */
8534 
8535 	if ((msg_len + sizeof (*ipf) + ill->ill_frag_count) >=
8536 	    ip_reass_queue_bytes) {
8537 		ill_frag_prune(ill, (ip_reass_queue_bytes < msg_len) ? 0
8538 		    : (ip_reass_queue_bytes - msg_len));
8539 		pruned = B_TRUE;
8540 	}
8541 
8542 	ipfb = &ill->ill_frag_hash_tbl[ILL_FRAG_HASH_V6(*v6src_ptr, ident)];
8543 	mutex_enter(&ipfb->ipfb_lock);
8544 
8545 	ipfp = &ipfb->ipfb_ipf;
8546 	/* Try to find an existing fragment queue for this packet. */
8547 	for (;;) {
8548 		ipf = ipfp[0];
8549 		if (ipf) {
8550 			/*
8551 			 * It has to match on ident, source address, and
8552 			 * dest address.
8553 			 */
8554 			if (ipf->ipf_ident == ident &&
8555 			    IN6_ARE_ADDR_EQUAL(&ipf->ipf_v6src, v6src_ptr) &&
8556 			    IN6_ARE_ADDR_EQUAL(&ipf->ipf_v6dst, v6dst_ptr)) {
8557 
8558 				/*
8559 				 * If we have received too many
8560 				 * duplicate fragments for this packet
8561 				 * free it.
8562 				 */
8563 				if (ipf->ipf_num_dups > ip_max_frag_dups) {
8564 					ill_frag_free_pkts(ill, ipfb, ipf, 1);
8565 					freemsg(mp);
8566 					mutex_exit(&ipfb->ipfb_lock);
8567 					return (NULL);
8568 				}
8569 
8570 				break;
8571 			}
8572 			ipfp = &ipf->ipf_hash_next;
8573 			continue;
8574 		}
8575 
8576 
8577 		/*
8578 		 * If we pruned the list, do we want to store this new
8579 		 * fragment?. We apply an optimization here based on the
8580 		 * fact that most fragments will be received in order.
8581 		 * So if the offset of this incoming fragment is zero,
8582 		 * it is the first fragment of a new packet. We will
8583 		 * keep it.  Otherwise drop the fragment, as we have
8584 		 * probably pruned the packet already (since the
8585 		 * packet cannot be found).
8586 		 */
8587 
8588 		if (pruned && offset != 0) {
8589 			mutex_exit(&ipfb->ipfb_lock);
8590 			freemsg(mp);
8591 			return (NULL);
8592 		}
8593 
8594 		/* New guy.  Allocate a frag message. */
8595 		mp1 = allocb(sizeof (*ipf), BPRI_MED);
8596 		if (!mp1) {
8597 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
8598 			freemsg(mp);
8599 	partial_reass_done:
8600 			mutex_exit(&ipfb->ipfb_lock);
8601 			return (NULL);
8602 		}
8603 
8604 		if (ipfb->ipfb_frag_pkts >= MAX_FRAG_PKTS)  {
8605 			/*
8606 			 * Too many fragmented packets in this hash bucket.
8607 			 * Free the oldest.
8608 			 */
8609 			ill_frag_free_pkts(ill, ipfb, ipfb->ipfb_ipf, 1);
8610 		}
8611 
8612 		mp1->b_cont = mp;
8613 
8614 		/* Initialize the fragment header. */
8615 		ipf = (ipf_t *)mp1->b_rptr;
8616 		ipf->ipf_mp = mp1;
8617 		ipf->ipf_ptphn = ipfp;
8618 		ipfp[0] = ipf;
8619 		ipf->ipf_hash_next = NULL;
8620 		ipf->ipf_ident = ident;
8621 		ipf->ipf_v6src = *v6src_ptr;
8622 		ipf->ipf_v6dst = *v6dst_ptr;
8623 		/* Record reassembly start time. */
8624 		ipf->ipf_timestamp = gethrestime_sec();
8625 		/* Record ipf generation and account for frag header */
8626 		ipf->ipf_gen = ill->ill_ipf_gen++;
8627 		ipf->ipf_count = MBLKSIZE(mp1);
8628 		ipf->ipf_protocol = nexthdr;
8629 		ipf->ipf_nf_hdr_len = 0;
8630 		ipf->ipf_prev_nexthdr_offset = 0;
8631 		ipf->ipf_last_frag_seen = B_FALSE;
8632 		ipf->ipf_ecn = ecn_info;
8633 		ipf->ipf_num_dups = 0;
8634 		ipfb->ipfb_frag_pkts++;
8635 		ipf->ipf_checksum = 0;
8636 		ipf->ipf_checksum_flags = 0;
8637 
8638 		/* Store checksum value in fragment header */
8639 		if (sum_flags != 0) {
8640 			sum_val = (sum_val & 0xFFFF) + (sum_val >> 16);
8641 			sum_val = (sum_val & 0xFFFF) + (sum_val >> 16);
8642 			ipf->ipf_checksum = sum_val;
8643 			ipf->ipf_checksum_flags = sum_flags;
8644 		}
8645 
8646 		/*
8647 		 * We handle reassembly two ways.  In the easy case,
8648 		 * where all the fragments show up in order, we do
8649 		 * minimal bookkeeping, and just clip new pieces on
8650 		 * the end.  If we ever see a hole, then we go off
8651 		 * to ip_reassemble which has to mark the pieces and
8652 		 * keep track of the number of holes, etc.  Obviously,
8653 		 * the point of having both mechanisms is so we can
8654 		 * handle the easy case as efficiently as possible.
8655 		 */
8656 		if (offset == 0) {
8657 			/* Easy case, in-order reassembly so far. */
8658 			/* Update the byte count */
8659 			ipf->ipf_count += msg_len;
8660 			ipf->ipf_tail_mp = tail_mp;
8661 			/*
8662 			 * Keep track of next expected offset in
8663 			 * ipf_end.
8664 			 */
8665 			ipf->ipf_end = end;
8666 			ipf->ipf_nf_hdr_len = hdr_length;
8667 			ipf->ipf_prev_nexthdr_offset = *prev_nexthdr_offset;
8668 		} else {
8669 			/* Hard case, hole at the beginning. */
8670 			ipf->ipf_tail_mp = NULL;
8671 			/*
8672 			 * ipf_end == 0 means that we have given up
8673 			 * on easy reassembly.
8674 			 */
8675 			ipf->ipf_end = 0;
8676 
8677 			/* Forget checksum offload from now on */
8678 			ipf->ipf_checksum_flags = 0;
8679 
8680 			/*
8681 			 * ipf_hole_cnt is set by ip_reassemble.
8682 			 * ipf_count is updated by ip_reassemble.
8683 			 * No need to check for return value here
8684 			 * as we don't expect reassembly to complete or
8685 			 * fail for the first fragment itself.
8686 			 */
8687 			(void) ip_reassemble(mp, ipf, offset, more_frags, ill,
8688 			    msg_len);
8689 		}
8690 		/* Update per ipfb and ill byte counts */
8691 		ipfb->ipfb_count += ipf->ipf_count;
8692 		ASSERT(ipfb->ipfb_count > 0);	/* Wraparound */
8693 		ill->ill_frag_count += ipf->ipf_count;
8694 		ASSERT(ill->ill_frag_count > 0);	/* Wraparound */
8695 		/* If the frag timer wasn't already going, start it. */
8696 		mutex_enter(&ill->ill_lock);
8697 		ill_frag_timer_start(ill);
8698 		mutex_exit(&ill->ill_lock);
8699 		goto partial_reass_done;
8700 	}
8701 
8702 	/*
8703 	 * If the packet's flag has changed (it could be coming up
8704 	 * from an interface different than the previous, therefore
8705 	 * possibly different checksum capability), then forget about
8706 	 * any stored checksum states.  Otherwise add the value to
8707 	 * the existing one stored in the fragment header.
8708 	 */
8709 	if (sum_flags != 0 && sum_flags == ipf->ipf_checksum_flags) {
8710 		sum_val += ipf->ipf_checksum;
8711 		sum_val = (sum_val & 0xFFFF) + (sum_val >> 16);
8712 		sum_val = (sum_val & 0xFFFF) + (sum_val >> 16);
8713 		ipf->ipf_checksum = sum_val;
8714 	} else if (ipf->ipf_checksum_flags != 0) {
8715 		/* Forget checksum offload from now on */
8716 		ipf->ipf_checksum_flags = 0;
8717 	}
8718 
8719 	/*
8720 	 * We have a new piece of a datagram which is already being
8721 	 * reassembled.  Update the ECN info if all IP fragments
8722 	 * are ECN capable.  If there is one which is not, clear
8723 	 * all the info.  If there is at least one which has CE
8724 	 * code point, IP needs to report that up to transport.
8725 	 */
8726 	if (ecn_info != IPH_ECN_NECT && ipf->ipf_ecn != IPH_ECN_NECT) {
8727 		if (ecn_info == IPH_ECN_CE)
8728 			ipf->ipf_ecn = IPH_ECN_CE;
8729 	} else {
8730 		ipf->ipf_ecn = IPH_ECN_NECT;
8731 	}
8732 
8733 	if (offset && ipf->ipf_end == offset) {
8734 		/* The new fragment fits at the end */
8735 		ipf->ipf_tail_mp->b_cont = mp;
8736 		/* Update the byte count */
8737 		ipf->ipf_count += msg_len;
8738 		/* Update per ipfb and ill byte counts */
8739 		ipfb->ipfb_count += msg_len;
8740 		ASSERT(ipfb->ipfb_count > 0);	/* Wraparound */
8741 		ill->ill_frag_count += msg_len;
8742 		ASSERT(ill->ill_frag_count > 0);	/* Wraparound */
8743 		if (more_frags) {
8744 			/* More to come. */
8745 			ipf->ipf_end = end;
8746 			ipf->ipf_tail_mp = tail_mp;
8747 			goto partial_reass_done;
8748 		}
8749 	} else {
8750 		/*
8751 		 * Go do the hard cases.
8752 		 * Call ip_reassemble().
8753 		 */
8754 		int ret;
8755 
8756 		if (offset == 0) {
8757 			if (ipf->ipf_prev_nexthdr_offset == 0) {
8758 				ipf->ipf_nf_hdr_len = hdr_length;
8759 				ipf->ipf_prev_nexthdr_offset =
8760 				    *prev_nexthdr_offset;
8761 			}
8762 		}
8763 		/* Save current byte count */
8764 		count = ipf->ipf_count;
8765 		ret = ip_reassemble(mp, ipf, offset, more_frags, ill, msg_len);
8766 
8767 		/* Count of bytes added and subtracted (freeb()ed) */
8768 		count = ipf->ipf_count - count;
8769 		if (count) {
8770 			/* Update per ipfb and ill byte counts */
8771 			ipfb->ipfb_count += count;
8772 			ASSERT(ipfb->ipfb_count > 0);	/* Wraparound */
8773 			ill->ill_frag_count += count;
8774 			ASSERT(ill->ill_frag_count > 0); /* Wraparound */
8775 		}
8776 		if (ret == IP_REASS_PARTIAL) {
8777 			goto partial_reass_done;
8778 		} else if (ret == IP_REASS_FAILED) {
8779 			/* Reassembly failed. Free up all resources */
8780 			ill_frag_free_pkts(ill, ipfb, ipf, 1);
8781 			for (t_mp = mp; t_mp != NULL; t_mp = t_mp->b_cont) {
8782 				IP_REASS_SET_START(t_mp, 0);
8783 				IP_REASS_SET_END(t_mp, 0);
8784 			}
8785 			freemsg(mp);
8786 			goto partial_reass_done;
8787 		}
8788 
8789 		/* We will reach here iff 'ret' is IP_REASS_COMPLETE */
8790 	}
8791 	/*
8792 	 * We have completed reassembly.  Unhook the frag header from
8793 	 * the reassembly list.
8794 	 *
8795 	 * Grab the unfragmentable header length next header value out
8796 	 * of the first fragment
8797 	 */
8798 	ASSERT(ipf->ipf_nf_hdr_len != 0);
8799 	hdr_length = ipf->ipf_nf_hdr_len;
8800 
8801 	/*
8802 	 * Before we free the frag header, record the ECN info
8803 	 * to report back to the transport.
8804 	 */
8805 	ecn_info = ipf->ipf_ecn;
8806 
8807 	/*
8808 	 * Store the nextheader field in the header preceding the fragment
8809 	 * header
8810 	 */
8811 	nexthdr = ipf->ipf_protocol;
8812 	*prev_nexthdr_offset = ipf->ipf_prev_nexthdr_offset;
8813 	ipfp = ipf->ipf_ptphn;
8814 
8815 	/* We need to supply these to caller */
8816 	if ((sum_flags = ipf->ipf_checksum_flags) != 0)
8817 		sum_val = ipf->ipf_checksum;
8818 	else
8819 		sum_val = 0;
8820 
8821 	mp1 = ipf->ipf_mp;
8822 	count = ipf->ipf_count;
8823 	ipf = ipf->ipf_hash_next;
8824 	if (ipf)
8825 		ipf->ipf_ptphn = ipfp;
8826 	ipfp[0] = ipf;
8827 	ill->ill_frag_count -= count;
8828 	ASSERT(ipfb->ipfb_count >= count);
8829 	ipfb->ipfb_count -= count;
8830 	ipfb->ipfb_frag_pkts--;
8831 	mutex_exit(&ipfb->ipfb_lock);
8832 	/* Ditch the frag header. */
8833 	mp = mp1->b_cont;
8834 	freeb(mp1);
8835 
8836 	/*
8837 	 * Make sure the packet is good by doing some sanity
8838 	 * check. If bad we can silentely drop the packet.
8839 	 */
8840 reass_done:
8841 	if (hdr_length < sizeof (ip6_frag_t)) {
8842 		BUMP_MIB(ill->ill_ip6_mib, ipv6InHdrErrors);
8843 		ip1dbg(("ip_rput_frag_v6: bad packet\n"));
8844 		freemsg(mp);
8845 		return (NULL);
8846 	}
8847 
8848 	/*
8849 	 * Remove the fragment header from the initial header by
8850 	 * splitting the mblk into the non-fragmentable header and
8851 	 * everthing after the fragment extension header.  This has the
8852 	 * side effect of putting all the headers that need destination
8853 	 * processing into the b_cont block-- on return this fact is
8854 	 * used in order to avoid having to look at the extensions
8855 	 * already processed.
8856 	 *
8857 	 * Note that this code assumes that the unfragmentable portion
8858 	 * of the header is in the first mblk and increments
8859 	 * the read pointer past it.  If this assumption is broken
8860 	 * this code fails badly.
8861 	 */
8862 	if (mp->b_rptr + hdr_length != mp->b_wptr) {
8863 		mblk_t *nmp;
8864 
8865 		if (!(nmp = dupb(mp))) {
8866 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
8867 			ip1dbg(("ip_rput_frag_v6: dupb failed\n"));
8868 			freemsg(mp);
8869 			return (NULL);
8870 		}
8871 		nmp->b_cont = mp->b_cont;
8872 		mp->b_cont = nmp;
8873 		nmp->b_rptr += hdr_length;
8874 	}
8875 	mp->b_wptr = mp->b_rptr + hdr_length - sizeof (ip6_frag_t);
8876 
8877 	ip6h = (ip6_t *)mp->b_rptr;
8878 	((char *)ip6h)[*prev_nexthdr_offset] = nexthdr;
8879 
8880 	/* Restore original IP length in header. */
8881 	ip6h->ip6_plen = htons((uint16_t)(msgdsize(mp) - IPV6_HDR_LEN));
8882 	/* Record the ECN info. */
8883 	ip6h->ip6_vcf &= htonl(0xFFCFFFFF);
8884 	ip6h->ip6_vcf |= htonl(ecn_info << 20);
8885 
8886 	/* Reassembly is successful; return checksum information if needed */
8887 	if (cksum_val != NULL)
8888 		*cksum_val = sum_val;
8889 	if (cksum_flags != NULL)
8890 		*cksum_flags = sum_flags;
8891 
8892 	return (mp);
8893 }
8894 
8895 /*
8896  * Walk through the options to see if there is a routing header.
8897  * If present get the destination which is the last address of
8898  * the option.
8899  */
8900 in6_addr_t
8901 ip_get_dst_v6(ip6_t *ip6h, boolean_t *is_fragment)
8902 {
8903 	uint8_t nexthdr;
8904 	uint8_t *whereptr;
8905 	ip6_hbh_t *hbhhdr;
8906 	ip6_dest_t *dsthdr;
8907 	ip6_rthdr0_t *rthdr;
8908 	ip6_frag_t *fraghdr;
8909 	int ehdrlen;
8910 	int left;
8911 	in6_addr_t *ap, rv;
8912 
8913 	if (is_fragment != NULL)
8914 		*is_fragment = B_FALSE;
8915 
8916 	rv = ip6h->ip6_dst;
8917 
8918 	nexthdr = ip6h->ip6_nxt;
8919 	whereptr = (uint8_t *)&ip6h[1];
8920 	for (;;) {
8921 
8922 		ASSERT(nexthdr != IPPROTO_RAW);
8923 		switch (nexthdr) {
8924 		case IPPROTO_HOPOPTS:
8925 			hbhhdr = (ip6_hbh_t *)whereptr;
8926 			nexthdr = hbhhdr->ip6h_nxt;
8927 			ehdrlen = 8 * (hbhhdr->ip6h_len + 1);
8928 			break;
8929 		case IPPROTO_DSTOPTS:
8930 			dsthdr = (ip6_dest_t *)whereptr;
8931 			nexthdr = dsthdr->ip6d_nxt;
8932 			ehdrlen = 8 * (dsthdr->ip6d_len + 1);
8933 			break;
8934 		case IPPROTO_ROUTING:
8935 			rthdr = (ip6_rthdr0_t *)whereptr;
8936 			nexthdr = rthdr->ip6r0_nxt;
8937 			ehdrlen = 8 * (rthdr->ip6r0_len + 1);
8938 
8939 			left = rthdr->ip6r0_segleft;
8940 			ap = (in6_addr_t *)((char *)rthdr + sizeof (*rthdr));
8941 			rv = *(ap + left - 1);
8942 			/*
8943 			 * If the caller doesn't care whether the packet
8944 			 * is a fragment or not, we can stop here since
8945 			 * we have our destination.
8946 			 */
8947 			if (is_fragment == NULL)
8948 				goto done;
8949 			break;
8950 		case IPPROTO_FRAGMENT:
8951 			fraghdr = (ip6_frag_t *)whereptr;
8952 			nexthdr = fraghdr->ip6f_nxt;
8953 			ehdrlen = sizeof (ip6_frag_t);
8954 			if (is_fragment != NULL)
8955 				*is_fragment = B_TRUE;
8956 			goto done;
8957 		default :
8958 			goto done;
8959 		}
8960 		whereptr += ehdrlen;
8961 	}
8962 
8963 done:
8964 	return (rv);
8965 }
8966 
8967 /*
8968  * ip_source_routed_v6:
8969  * This function is called by redirect code in ip_rput_data_v6 to
8970  * know whether this packet is source routed through this node i.e
8971  * whether this node (router) is part of the journey. This
8972  * function is called under two cases :
8973  *
8974  * case 1 : Routing header was processed by this node and
8975  *	    ip_process_rthdr replaced ip6_dst with the next hop
8976  *          and we are forwarding the packet to the next hop.
8977  *
8978  * case 2 : Routing header was not processed by this node and we
8979  *	    are just forwarding the packet.
8980  *
8981  * For case (1) we don't want to send redirects. For case(2) we
8982  * want to send redirects.
8983  */
8984 static boolean_t
8985 ip_source_routed_v6(ip6_t *ip6h, mblk_t *mp)
8986 {
8987 	uint8_t		nexthdr;
8988 	in6_addr_t	*addrptr;
8989 	ip6_rthdr0_t	*rthdr;
8990 	uint8_t		numaddr;
8991 	ip6_hbh_t	*hbhhdr;
8992 	uint_t		ehdrlen;
8993 	uint8_t		*byteptr;
8994 
8995 	ip2dbg(("ip_source_routed_v6\n"));
8996 	nexthdr = ip6h->ip6_nxt;
8997 	ehdrlen = IPV6_HDR_LEN;
8998 
8999 	/* if a routing hdr is preceeded by HOPOPT or DSTOPT */
9000 	while (nexthdr == IPPROTO_HOPOPTS ||
9001 	    nexthdr == IPPROTO_DSTOPTS) {
9002 		byteptr = (uint8_t *)ip6h + ehdrlen;
9003 		/*
9004 		 * Check if we have already processed
9005 		 * packets or we are just a forwarding
9006 		 * router which only pulled up msgs up
9007 		 * to IPV6HDR and  one HBH ext header
9008 		 */
9009 		if (byteptr + MIN_EHDR_LEN > mp->b_wptr) {
9010 			ip2dbg(("ip_source_routed_v6: Extension"
9011 			    " headers not processed\n"));
9012 			return (B_FALSE);
9013 		}
9014 		hbhhdr = (ip6_hbh_t *)byteptr;
9015 		nexthdr = hbhhdr->ip6h_nxt;
9016 		ehdrlen = ehdrlen + 8 * (hbhhdr->ip6h_len + 1);
9017 	}
9018 	switch (nexthdr) {
9019 	case IPPROTO_ROUTING:
9020 		byteptr = (uint8_t *)ip6h + ehdrlen;
9021 		/*
9022 		 * If for some reason, we haven't pulled up
9023 		 * the routing hdr data mblk, then we must
9024 		 * not have processed it at all. So for sure
9025 		 * we are not part of the source routed journey.
9026 		 */
9027 		if (byteptr + MIN_EHDR_LEN > mp->b_wptr) {
9028 			ip2dbg(("ip_source_routed_v6: Routing"
9029 			    " header not processed\n"));
9030 			return (B_FALSE);
9031 		}
9032 		rthdr = (ip6_rthdr0_t *)byteptr;
9033 		/*
9034 		 * Either we are an intermediate router or the
9035 		 * last hop before destination and we have
9036 		 * already processed the routing header.
9037 		 * If segment_left is greater than or equal to zero,
9038 		 * then we must be the (numaddr - segleft) entry
9039 		 * of the routing header. Although ip6r0_segleft
9040 		 * is a unit8_t variable, we still check for zero
9041 		 * or greater value, if in case the data type
9042 		 * is changed someday in future.
9043 		 */
9044 		if (rthdr->ip6r0_segleft > 0 ||
9045 		    rthdr->ip6r0_segleft == 0) {
9046 			ire_t 	*ire = NULL;
9047 
9048 			numaddr = rthdr->ip6r0_len / 2;
9049 			addrptr = (in6_addr_t *)((char *)rthdr +
9050 			    sizeof (*rthdr));
9051 			addrptr += (numaddr - (rthdr->ip6r0_segleft + 1));
9052 			if (addrptr != NULL) {
9053 				ire = ire_ctable_lookup_v6(addrptr, NULL,
9054 				    IRE_LOCAL, NULL, ALL_ZONES, NULL,
9055 				    MATCH_IRE_TYPE);
9056 				if (ire != NULL) {
9057 					ire_refrele(ire);
9058 					return (B_TRUE);
9059 				}
9060 				ip1dbg(("ip_source_routed_v6: No ire found\n"));
9061 			}
9062 		}
9063 	/* FALLTHRU */
9064 	default:
9065 		ip2dbg(("ip_source_routed_v6: Not source routed here\n"));
9066 		return (B_FALSE);
9067 	}
9068 }
9069 
9070 /*
9071  * ip_wput_v6 -- Packets sent down from transport modules show up here.
9072  * Assumes that the following set of headers appear in the first
9073  * mblk:
9074  *	ip6i_t (if present) CAN also appear as a separate mblk.
9075  *	ip6_t
9076  *	Any extension headers
9077  *	TCP/UDP/SCTP header (if present)
9078  * The routine can handle an ICMPv6 header that is not in the first mblk.
9079  *
9080  * The order to determine the outgoing interface is as follows:
9081  * 1. IPV6_BOUND_PIF is set, use that ill (conn_outgoing_pill)
9082  * 2. If conn_nofailover_ill is set then use that ill.
9083  * 3. If an ip6i_t with IP6I_IFINDEX set then use that ill.
9084  * 4. If q is an ill queue and (link local or multicast destination) then
9085  *    use that ill.
9086  * 5. If IPV6_BOUND_IF has been set use that ill.
9087  * 6. For multicast: if IPV6_MULTICAST_IF has been set use it. Otherwise
9088  *    look for the best IRE match for the unspecified group to determine
9089  *    the ill.
9090  * 7. For unicast: Just do an IRE lookup for the best match.
9091  */
9092 void
9093 ip_output_v6(void *arg, mblk_t *mp, void *arg2, int caller)
9094 {
9095 	conn_t		*connp = NULL;
9096 	queue_t		*q = (queue_t *)arg2;
9097 	ire_t		*ire = NULL;
9098 	ire_t		*sctp_ire = NULL;
9099 	ip6_t		*ip6h;
9100 	in6_addr_t	*v6dstp;
9101 	ill_t		*ill = NULL;
9102 	ipif_t		*ipif;
9103 	ip6i_t		*ip6i;
9104 	int		cksum_request;	/* -1 => normal. */
9105 			/* 1 => Skip TCP/UDP/SCTP checksum */
9106 			/* Otherwise contains insert offset for checksum */
9107 	int		unspec_src;
9108 	boolean_t	do_outrequests;	/* Increment OutRequests? */
9109 	mib2_ipv6IfStatsEntry_t	*mibptr;
9110 	int 		match_flags = MATCH_IRE_ILL_GROUP;
9111 	boolean_t	attach_if = B_FALSE;
9112 	mblk_t		*first_mp;
9113 	boolean_t	mctl_present;
9114 	ipsec_out_t	*io;
9115 	boolean_t	drop_if_delayed = B_FALSE;
9116 	boolean_t	multirt_need_resolve = B_FALSE;
9117 	mblk_t		*copy_mp = NULL;
9118 	int		err;
9119 	int		ip6i_flags = 0;
9120 	zoneid_t	zoneid;
9121 	ill_t		*saved_ill = NULL;
9122 	boolean_t	conn_lock_held;
9123 	boolean_t	need_decref = B_FALSE;
9124 
9125 	/*
9126 	 * Highest bit in version field is Reachability Confirmation bit
9127 	 * used by NUD in ip_xmit_v6().
9128 	 */
9129 #ifdef	_BIG_ENDIAN
9130 #define	IPVER(ip6h)	((((uint32_t *)ip6h)[0] >> 28) & 0x7)
9131 #else
9132 #define	IPVER(ip6h)	((((uint32_t *)ip6h)[0] >> 4) & 0x7)
9133 #endif
9134 
9135 	/*
9136 	 * M_CTL comes from 5 places
9137 	 *
9138 	 * 1) TCP sends down IPSEC_OUT(M_CTL) for detached connections
9139 	 *    both V4 and V6 datagrams.
9140 	 *
9141 	 * 2) AH/ESP sends down M_CTL after doing their job with both
9142 	 *    V4 and V6 datagrams.
9143 	 *
9144 	 * 3) NDP callbacks when nce is resolved and IPSEC_OUT has been
9145 	 *    attached.
9146 	 *
9147 	 * 4) Notifications from an external resolver (for XRESOLV ifs)
9148 	 *
9149 	 * 5) AH/ESP send down IPSEC_CTL(M_CTL) to be relayed to hardware for
9150 	 *    IPsec hardware acceleration support.
9151 	 *
9152 	 * We need to handle (1)'s IPv6 case and (3) here.  For the
9153 	 * IPv4 case in (1), and (2), IPSEC processing has already
9154 	 * started. The code in ip_wput() already knows how to handle
9155 	 * continuing IPSEC processing (for IPv4 and IPv6).  All other
9156 	 * M_CTLs (including case (4)) are passed on to ip_wput_nondata()
9157 	 * for handling.
9158 	 */
9159 	first_mp = mp;
9160 	mctl_present = B_FALSE;
9161 	io = NULL;
9162 
9163 	/* Multidata transmit? */
9164 	if (DB_TYPE(mp) == M_MULTIDATA) {
9165 		/*
9166 		 * We should never get here, since all Multidata messages
9167 		 * originating from tcp should have been directed over to
9168 		 * tcp_multisend() in the first place.
9169 		 */
9170 		BUMP_MIB(&ip6_mib, ipv6OutDiscards);
9171 		freemsg(mp);
9172 		return;
9173 	} else if (DB_TYPE(mp) == M_CTL) {
9174 		uint32_t mctltype = 0;
9175 		uint32_t mlen = MBLKL(first_mp);
9176 
9177 		mp = mp->b_cont;
9178 		mctl_present = B_TRUE;
9179 		io = (ipsec_out_t *)first_mp->b_rptr;
9180 
9181 		/*
9182 		 * Validate this M_CTL message.  The only three types of
9183 		 * M_CTL messages we expect to see in this code path are
9184 		 * ipsec_out_t or ipsec_in_t structures (allocated as
9185 		 * ipsec_info_t unions), or ipsec_ctl_t structures.
9186 		 * The ipsec_out_type and ipsec_in_type overlap in the two
9187 		 * data structures, and they are either set to IPSEC_OUT
9188 		 * or IPSEC_IN depending on which data structure it is.
9189 		 * ipsec_ctl_t is an IPSEC_CTL.
9190 		 *
9191 		 * All other M_CTL messages are sent to ip_wput_nondata()
9192 		 * for handling.
9193 		 */
9194 		if (mlen >= sizeof (io->ipsec_out_type))
9195 			mctltype = io->ipsec_out_type;
9196 
9197 		if ((mlen == sizeof (ipsec_ctl_t)) &&
9198 		    (mctltype == IPSEC_CTL)) {
9199 			ip_output(Q_TO_CONN(q), first_mp, q, caller);
9200 			return;
9201 		}
9202 
9203 		if ((mlen < sizeof (ipsec_info_t)) ||
9204 		    (mctltype != IPSEC_OUT && mctltype != IPSEC_IN) ||
9205 		    mp == NULL) {
9206 			ip_wput_nondata(NULL, q, first_mp, NULL);
9207 			return;
9208 		}
9209 		/* NDP callbacks have q_next non-NULL.  That's case #3. */
9210 		if (q->q_next == NULL) {
9211 			ip6h = (ip6_t *)mp->b_rptr;
9212 			/*
9213 			 * For a freshly-generated TCP dgram that needs IPV6
9214 			 * processing, don't call ip_wput immediately. We can
9215 			 * tell this by the ipsec_out_proc_begin. In-progress
9216 			 * IPSEC_OUT messages have proc_begin set to TRUE,
9217 			 * and we want to send all IPSEC_IN messages to
9218 			 * ip_wput() for IPsec processing or finishing.
9219 			 */
9220 			if (mctltype == IPSEC_IN ||
9221 			    IPVER(ip6h) != IPV6_VERSION ||
9222 			    io->ipsec_out_proc_begin) {
9223 				mibptr = &ip6_mib;
9224 				goto notv6;
9225 			}
9226 		}
9227 	} else if (DB_TYPE(mp) != M_DATA) {
9228 		ip_wput_nondata(NULL, q, mp, NULL);
9229 		return;
9230 	}
9231 
9232 	ip6h = (ip6_t *)mp->b_rptr;
9233 
9234 	if (IPVER(ip6h) != IPV6_VERSION) {
9235 		mibptr = &ip6_mib;
9236 		goto notv6;
9237 	}
9238 
9239 	if (q->q_next != NULL) {
9240 		ill = (ill_t *)q->q_ptr;
9241 		/*
9242 		 * We don't know if this ill will be used for IPv6
9243 		 * until the ILLF_IPV6 flag is set via SIOCSLIFNAME.
9244 		 * ipif_set_values() sets the ill_isv6 flag to true if
9245 		 * ILLF_IPV6 is set.  If the ill_isv6 flag isn't true,
9246 		 * just drop the packet.
9247 		 */
9248 		if (!ill->ill_isv6) {
9249 			ip1dbg(("ip_wput_v6: Received an IPv6 packet before "
9250 			    "ILLF_IPV6 was set\n"));
9251 			freemsg(first_mp);
9252 			return;
9253 		}
9254 		/* For uniformity do a refhold */
9255 		mutex_enter(&ill->ill_lock);
9256 		if (!ILL_CAN_LOOKUP(ill)) {
9257 			mutex_exit(&ill->ill_lock);
9258 			freemsg(first_mp);
9259 			return;
9260 		}
9261 		ill_refhold_locked(ill);
9262 		mutex_exit(&ill->ill_lock);
9263 		mibptr = ill->ill_ip6_mib;
9264 		/*
9265 		 * ill_ip6_mib is allocated by ipif_set_values() when
9266 		 * ill_isv6 is set.  Thus if ill_isv6 is true,
9267 		 * ill_ip6_mib had better not be NULL.
9268 		 */
9269 		ASSERT(mibptr != NULL);
9270 		unspec_src = 0;
9271 		BUMP_MIB(mibptr, ipv6OutRequests);
9272 		do_outrequests = B_FALSE;
9273 	} else {
9274 		connp = (conn_t *)arg;
9275 		ASSERT(connp != NULL);
9276 
9277 		/* is queue flow controlled? */
9278 		if ((q->q_first || connp->conn_draining) &&
9279 		    (caller == IP_WPUT)) {
9280 			/*
9281 			 * 1) TCP sends down M_CTL for detached connections.
9282 			 * 2) AH/ESP sends down M_CTL.
9283 			 *
9284 			 * We don't flow control either of the above. Only
9285 			 * UDP and others are flow controlled for which we
9286 			 * can't have a M_CTL.
9287 			 */
9288 			ASSERT(first_mp == mp);
9289 			(void) putq(q, mp);
9290 			return;
9291 		}
9292 		mibptr = &ip6_mib;
9293 		unspec_src = connp->conn_unspec_src;
9294 		do_outrequests = B_TRUE;
9295 		if (mp->b_flag & MSGHASREF) {
9296 			mp->b_flag &= ~MSGHASREF;
9297 			ASSERT(connp->conn_ulp == IPPROTO_SCTP);
9298 			SCTP_EXTRACT_IPINFO(mp, sctp_ire);
9299 			need_decref = B_TRUE;
9300 		}
9301 
9302 		/*
9303 		 * If there is a policy, try to attach an ipsec_out in
9304 		 * the front. At the end, first_mp either points to a
9305 		 * M_DATA message or IPSEC_OUT message linked to a
9306 		 * M_DATA message. We have to do it now as we might
9307 		 * lose the "conn" if we go through ip_newroute.
9308 		 */
9309 		if (!mctl_present &&
9310 		    (connp->conn_out_enforce_policy ||
9311 		    connp->conn_latch != NULL)) {
9312 			ASSERT(first_mp == mp);
9313 			/* XXX Any better way to get the protocol fast ? */
9314 			if (((mp = ipsec_attach_ipsec_out(mp, connp, NULL,
9315 			    connp->conn_ulp)) == NULL)) {
9316 				if (need_decref)
9317 					CONN_DEC_REF(connp);
9318 				return;
9319 			} else {
9320 				ASSERT(mp->b_datap->db_type == M_CTL);
9321 				first_mp = mp;
9322 				mp = mp->b_cont;
9323 				mctl_present = B_TRUE;
9324 				io = (ipsec_out_t *)first_mp->b_rptr;
9325 			}
9326 		}
9327 	}
9328 
9329 	/* check for alignment and full IPv6 header */
9330 	if (!OK_32PTR((uchar_t *)ip6h) ||
9331 	    (mp->b_wptr - (uchar_t *)ip6h) < IPV6_HDR_LEN) {
9332 		ip0dbg(("ip_wput_v6: bad alignment or length\n"));
9333 		if (do_outrequests)
9334 			BUMP_MIB(mibptr, ipv6OutRequests);
9335 		BUMP_MIB(mibptr, ipv6OutDiscards);
9336 		freemsg(first_mp);
9337 		if (ill != NULL)
9338 			ill_refrele(ill);
9339 		if (need_decref)
9340 			CONN_DEC_REF(connp);
9341 		return;
9342 	}
9343 	v6dstp = &ip6h->ip6_dst;
9344 	cksum_request = -1;
9345 	ip6i = NULL;
9346 
9347 	/*
9348 	 * Once neighbor discovery has completed, ndp_process() will provide
9349 	 * locally generated packets for which processing can be reattempted.
9350 	 * In these cases, connp is NULL and the original zone is part of a
9351 	 * prepended ipsec_out_t.
9352 	 */
9353 	if (io != NULL) {
9354 		zoneid = io->ipsec_out_zoneid;
9355 		ASSERT(zoneid != ALL_ZONES);
9356 	} else {
9357 		zoneid = (connp != NULL ? connp->conn_zoneid : ALL_ZONES);
9358 	}
9359 
9360 	if (ip6h->ip6_nxt == IPPROTO_RAW) {
9361 		/*
9362 		 * This is an ip6i_t header followed by an ip6_hdr.
9363 		 * Check which fields are set.
9364 		 *
9365 		 * When the packet comes from a transport we should have
9366 		 * all needed headers in the first mblk. However, when
9367 		 * going through ip_newroute*_v6 the ip6i might be in
9368 		 * a separate mblk when we return here. In that case
9369 		 * we pullup everything to ensure that extension and transport
9370 		 * headers "stay" in the first mblk.
9371 		 */
9372 		ip6i = (ip6i_t *)ip6h;
9373 		ip6i_flags = ip6i->ip6i_flags;
9374 
9375 		ASSERT((mp->b_wptr - (uchar_t *)ip6i) == sizeof (ip6i_t) ||
9376 		    ((mp->b_wptr - (uchar_t *)ip6i) >=
9377 		    sizeof (ip6i_t) + IPV6_HDR_LEN));
9378 
9379 		if ((mp->b_wptr - (uchar_t *)ip6i) == sizeof (ip6i_t)) {
9380 			if (!pullupmsg(mp, -1)) {
9381 				ip1dbg(("ip_wput_v6: pullupmsg failed\n"));
9382 				if (do_outrequests)
9383 					BUMP_MIB(mibptr, ipv6OutRequests);
9384 				BUMP_MIB(mibptr, ipv6OutDiscards);
9385 				freemsg(first_mp);
9386 				if (ill != NULL)
9387 					ill_refrele(ill);
9388 				if (need_decref)
9389 					CONN_DEC_REF(connp);
9390 				return;
9391 			}
9392 			ip6h = (ip6_t *)mp->b_rptr;
9393 			v6dstp = &ip6h->ip6_dst;
9394 			ip6i = (ip6i_t *)ip6h;
9395 		}
9396 		ip6h = (ip6_t *)&ip6i[1];
9397 
9398 		/*
9399 		 * Advance rptr past the ip6i_t to get ready for
9400 		 * transmitting the packet. However, if the packet gets
9401 		 * passed to ip_newroute*_v6 then rptr is moved back so
9402 		 * that the ip6i_t header can be inspected when the
9403 		 * packet comes back here after passing through
9404 		 * ire_add_then_send.
9405 		 */
9406 		mp->b_rptr = (uchar_t *)ip6h;
9407 
9408 		/*
9409 		 * IP6I_ATTACH_IF is set in this function when we had a
9410 		 * conn and it was either bound to the IPFF_NOFAILOVER address
9411 		 * or IPV6_BOUND_PIF was set. These options override other
9412 		 * options that set the ifindex. We come here with
9413 		 * IP6I_ATTACH_IF set when we can't find the ire and
9414 		 * ip_newroute_v6 is feeding the packet for second time.
9415 		 */
9416 		if ((ip6i->ip6i_flags & IP6I_IFINDEX) ||
9417 		    (ip6i->ip6i_flags & IP6I_ATTACH_IF)) {
9418 			ASSERT(ip6i->ip6i_ifindex != 0);
9419 			if (ill != NULL)
9420 				ill_refrele(ill);
9421 			ill = ill_lookup_on_ifindex(ip6i->ip6i_ifindex, 1,
9422 			    NULL, NULL, NULL, NULL);
9423 			if (ill == NULL) {
9424 				if (do_outrequests)
9425 					BUMP_MIB(mibptr, ipv6OutRequests);
9426 				BUMP_MIB(mibptr, ipv6OutDiscards);
9427 				ip1dbg(("ip_wput_v6: bad ifindex %d\n",
9428 				    ip6i->ip6i_ifindex));
9429 				if (need_decref)
9430 					CONN_DEC_REF(connp);
9431 				freemsg(first_mp);
9432 				return;
9433 			}
9434 			mibptr = ill->ill_ip6_mib;
9435 			if (ip6i->ip6i_flags & IP6I_IFINDEX) {
9436 				/*
9437 				 * Preserve the index so that when we return
9438 				 * from IPSEC processing, we know where to
9439 				 * send the packet.
9440 				 */
9441 				if (mctl_present) {
9442 					ASSERT(io != NULL);
9443 					io->ipsec_out_ill_index =
9444 					    ip6i->ip6i_ifindex;
9445 				}
9446 			}
9447 			if (ip6i->ip6i_flags & IP6I_ATTACH_IF) {
9448 				/*
9449 				 * This is a multipathing probe packet that has
9450 				 * been delayed in ND resolution. Drop the
9451 				 * packet for the reasons mentioned in
9452 				 * nce_queue_mp()
9453 				 */
9454 				if ((ip6i->ip6i_flags & IP6I_DROP_IFDELAYED) &&
9455 				    (ip6i->ip6i_flags & IP6I_ND_DELAYED)) {
9456 					freemsg(first_mp);
9457 					ill_refrele(ill);
9458 					if (need_decref)
9459 						CONN_DEC_REF(connp);
9460 					return;
9461 				}
9462 			}
9463 		}
9464 		if (ip6i->ip6i_flags & IP6I_VERIFY_SRC) {
9465 			cred_t *cr = DB_CREDDEF(mp, GET_QUEUE_CRED(q));
9466 
9467 			ASSERT(!IN6_IS_ADDR_UNSPECIFIED(&ip6h->ip6_src));
9468 			if (secpolicy_net_rawaccess(cr) != 0) {
9469 				ire = ire_route_lookup_v6(&ip6h->ip6_src,
9470 				    0, 0, (IRE_LOCAL|IRE_LOOPBACK), NULL,
9471 				    NULL, zoneid, NULL,
9472 				    MATCH_IRE_TYPE | MATCH_IRE_ZONEONLY);
9473 				if (ire == NULL) {
9474 					if (do_outrequests)
9475 						BUMP_MIB(mibptr,
9476 						    ipv6OutRequests);
9477 					BUMP_MIB(mibptr, ipv6OutDiscards);
9478 					ip1dbg(("ip_wput_v6: bad source "
9479 					    "addr\n"));
9480 					freemsg(first_mp);
9481 					if (ill != NULL)
9482 						ill_refrele(ill);
9483 					if (need_decref)
9484 						CONN_DEC_REF(connp);
9485 					return;
9486 				}
9487 				ire_refrele(ire);
9488 			}
9489 			/* No need to verify again when using ip_newroute */
9490 			ip6i->ip6i_flags &= ~IP6I_VERIFY_SRC;
9491 		}
9492 		if (!(ip6i->ip6i_flags & IP6I_NEXTHOP)) {
9493 			/*
9494 			 * Make sure they match since ip_newroute*_v6 etc might
9495 			 * (unknown to them) inspect ip6i_nexthop when
9496 			 * they think they access ip6_dst.
9497 			 */
9498 			ip6i->ip6i_nexthop = ip6h->ip6_dst;
9499 		}
9500 		if (ip6i->ip6i_flags & IP6I_NO_ULP_CKSUM)
9501 			cksum_request = 1;
9502 		if (ip6i->ip6i_flags & IP6I_RAW_CHECKSUM)
9503 			cksum_request = ip6i->ip6i_checksum_off;
9504 		if (ip6i->ip6i_flags & IP6I_UNSPEC_SRC)
9505 			unspec_src = 1;
9506 
9507 		if (do_outrequests && ill != NULL) {
9508 			BUMP_MIB(mibptr, ipv6OutRequests);
9509 			do_outrequests = B_FALSE;
9510 		}
9511 		/*
9512 		 * Store ip6i_t info that we need after we come back
9513 		 * from IPSEC processing.
9514 		 */
9515 		if (mctl_present) {
9516 			ASSERT(io != NULL);
9517 			io->ipsec_out_unspec_src = unspec_src;
9518 		}
9519 	}
9520 	if (connp != NULL && connp->conn_dontroute)
9521 		ip6h->ip6_hops = 1;
9522 
9523 	if (IN6_IS_ADDR_MULTICAST(v6dstp))
9524 		goto ipv6multicast;
9525 
9526 	/* 1. IPV6_BOUND_PIF takes precedence over all the ifindex settings. */
9527 	if (connp != NULL && connp->conn_outgoing_pill != NULL) {
9528 		ill_t	*conn_outgoing_pill;
9529 
9530 		conn_outgoing_pill = conn_get_held_ill(connp,
9531 		    &connp->conn_outgoing_pill, &err);
9532 		if (err == ILL_LOOKUP_FAILED) {
9533 			if (ill != NULL)
9534 				ill_refrele(ill);
9535 			if (need_decref)
9536 				CONN_DEC_REF(connp);
9537 			freemsg(first_mp);
9538 			return;
9539 		}
9540 		if (conn_outgoing_pill != NULL) {
9541 			if (ill != NULL)
9542 				ill_refrele(ill);
9543 			ill = conn_outgoing_pill;
9544 			attach_if = B_TRUE;
9545 			match_flags = MATCH_IRE_ILL;
9546 			mibptr = ill->ill_ip6_mib;
9547 
9548 			/*
9549 			 * Check if we need an ire that will not be
9550 			 * looked up by anybody else i.e. HIDDEN.
9551 			 */
9552 			if (ill_is_probeonly(ill))
9553 				match_flags |= MATCH_IRE_MARK_HIDDEN;
9554 			goto send_from_ill;
9555 		}
9556 	}
9557 
9558 	/* 2. If ipc_nofailover_ill is set then use that ill. */
9559 	if (connp != NULL && connp->conn_nofailover_ill != NULL) {
9560 		ill_t	*conn_nofailover_ill;
9561 
9562 		conn_nofailover_ill = conn_get_held_ill(connp,
9563 		    &connp->conn_nofailover_ill, &err);
9564 		if (err == ILL_LOOKUP_FAILED) {
9565 			if (ill != NULL)
9566 				ill_refrele(ill);
9567 			if (need_decref)
9568 				CONN_DEC_REF(connp);
9569 			freemsg(first_mp);
9570 			return;
9571 		}
9572 		if (conn_nofailover_ill != NULL) {
9573 			if (ill != NULL)
9574 				ill_refrele(ill);
9575 			ill = conn_nofailover_ill;
9576 			attach_if = B_TRUE;
9577 			/*
9578 			 * Assumes that ipc_nofailover_ill is used only for
9579 			 * multipathing probe packets. These packets are better
9580 			 * dropped, if they are delayed in ND resolution, for
9581 			 * the reasons described in nce_queue_mp().
9582 			 * IP6I_DROP_IFDELAYED will be set later on in this
9583 			 * function for this packet.
9584 			 */
9585 			drop_if_delayed = B_TRUE;
9586 			match_flags = MATCH_IRE_ILL;
9587 			mibptr = ill->ill_ip6_mib;
9588 
9589 			/*
9590 			 * Check if we need an ire that will not be
9591 			 * looked up by anybody else i.e. HIDDEN.
9592 			 */
9593 			if (ill_is_probeonly(ill))
9594 				match_flags |= MATCH_IRE_MARK_HIDDEN;
9595 			goto send_from_ill;
9596 		}
9597 	}
9598 
9599 	/*
9600 	 * Redo 1. If we did not find an IRE_CACHE the first time, we should
9601 	 * have an ip6i_t with IP6I_ATTACH_IF if IPV6_BOUND_PIF or
9602 	 * bind to the IPIF_NOFAILOVER address was used on this endpoint.
9603 	 */
9604 	if (ip6i != NULL && (ip6i->ip6i_flags & IP6I_ATTACH_IF)) {
9605 		ASSERT(ip6i->ip6i_ifindex != 0);
9606 		attach_if = B_TRUE;
9607 		ASSERT(ill != NULL);
9608 		match_flags = MATCH_IRE_ILL;
9609 
9610 		/*
9611 		 * Check if we need an ire that will not be
9612 		 * looked up by anybody else i.e. HIDDEN.
9613 		 */
9614 		if (ill_is_probeonly(ill))
9615 			match_flags |= MATCH_IRE_MARK_HIDDEN;
9616 		goto send_from_ill;
9617 	}
9618 
9619 	/* 3. If an ip6i_t with IP6I_IFINDEX set then use that ill. */
9620 	if (ip6i != NULL && (ip6i->ip6i_flags & IP6I_IFINDEX)) {
9621 		ASSERT(ill != NULL);
9622 		goto send_from_ill;
9623 	}
9624 
9625 	/*
9626 	 * 4. If q is an ill queue and (link local or multicast destination)
9627 	 *    then use that ill.
9628 	 */
9629 	if (ill != NULL && IN6_IS_ADDR_LINKLOCAL(v6dstp)) {
9630 		goto send_from_ill;
9631 	}
9632 
9633 	/* 5. If IPV6_BOUND_IF has been set use that ill. */
9634 	if (connp != NULL && connp->conn_outgoing_ill != NULL) {
9635 		ill_t	*conn_outgoing_ill;
9636 
9637 		conn_outgoing_ill = conn_get_held_ill(connp,
9638 		    &connp->conn_outgoing_ill, &err);
9639 		if (err == ILL_LOOKUP_FAILED) {
9640 			if (ill != NULL)
9641 				ill_refrele(ill);
9642 			if (need_decref)
9643 				CONN_DEC_REF(connp);
9644 			freemsg(first_mp);
9645 			return;
9646 		}
9647 		if (ill != NULL)
9648 			ill_refrele(ill);
9649 		ill = conn_outgoing_ill;
9650 		mibptr = ill->ill_ip6_mib;
9651 		goto send_from_ill;
9652 	}
9653 
9654 	/*
9655 	 * 6. For unicast: Just do an IRE lookup for the best match.
9656 	 * If we get here for a link-local address it is rather random
9657 	 * what interface we pick on a multihomed host.
9658 	 * *If* there is an IRE_CACHE (and the link-local address
9659 	 * isn't duplicated on multi links) this will find the IRE_CACHE.
9660 	 * Otherwise it will use one of the matching IRE_INTERFACE routes
9661 	 * for the link-local prefix. Hence, applications
9662 	 * *should* be encouraged to specify an outgoing interface when sending
9663 	 * to a link local address.
9664 	 */
9665 	if (connp == NULL || (IP_FLOW_CONTROLLED_ULP(connp->conn_ulp) &&
9666 	    !connp->conn_fully_bound)) {
9667 		/*
9668 		 * We cache IRE_CACHEs to avoid lookups. We don't do
9669 		 * this for the tcp global queue and listen end point
9670 		 * as it does not really have a real destination to
9671 		 * talk to.
9672 		 */
9673 		ire = ire_cache_lookup_v6(v6dstp, zoneid, MBLK_GETLABEL(mp));
9674 	} else {
9675 		/*
9676 		 * IRE_MARK_CONDEMNED is marked in ire_delete. We don't
9677 		 * grab a lock here to check for CONDEMNED as it is okay
9678 		 * to send a packet or two with the IRE_CACHE that is going
9679 		 * away.
9680 		 */
9681 		mutex_enter(&connp->conn_lock);
9682 		ire = sctp_ire != NULL ? sctp_ire : connp->conn_ire_cache;
9683 		if (ire != NULL &&
9684 		    IN6_ARE_ADDR_EQUAL(&ire->ire_addr_v6, v6dstp) &&
9685 		    !(ire->ire_marks & IRE_MARK_CONDEMNED)) {
9686 
9687 			IRE_REFHOLD(ire);
9688 			mutex_exit(&connp->conn_lock);
9689 
9690 		} else {
9691 			boolean_t cached = B_FALSE;
9692 
9693 			connp->conn_ire_cache = NULL;
9694 			mutex_exit(&connp->conn_lock);
9695 			/* Release the old ire */
9696 			if (ire != NULL && sctp_ire == NULL)
9697 				IRE_REFRELE_NOTR(ire);
9698 
9699 			ire = ire_cache_lookup_v6(v6dstp, zoneid,
9700 			    MBLK_GETLABEL(mp));
9701 			if (ire != NULL) {
9702 				IRE_REFHOLD_NOTR(ire);
9703 
9704 				mutex_enter(&connp->conn_lock);
9705 				if (!(connp->conn_state_flags & CONN_CLOSING) &&
9706 				    (connp->conn_ire_cache == NULL)) {
9707 					rw_enter(&ire->ire_bucket->irb_lock,
9708 					    RW_READER);
9709 					if (!(ire->ire_marks &
9710 					    IRE_MARK_CONDEMNED)) {
9711 						connp->conn_ire_cache = ire;
9712 						cached = B_TRUE;
9713 					}
9714 					rw_exit(&ire->ire_bucket->irb_lock);
9715 				}
9716 				mutex_exit(&connp->conn_lock);
9717 
9718 				/*
9719 				 * We can continue to use the ire but since it
9720 				 * was not cached, we should drop the extra
9721 				 * reference.
9722 				 */
9723 				if (!cached)
9724 					IRE_REFRELE_NOTR(ire);
9725 			}
9726 		}
9727 	}
9728 
9729 	if (ire != NULL) {
9730 		if (do_outrequests) {
9731 			/* Handle IRE_LOCAL's that might appear here */
9732 			if (ire->ire_type == IRE_CACHE) {
9733 				mibptr = ((ill_t *)ire->ire_stq->q_ptr)->
9734 				    ill_ip6_mib;
9735 			} else {
9736 				mibptr = ire->ire_ipif->ipif_ill->ill_ip6_mib;
9737 			}
9738 			BUMP_MIB(mibptr, ipv6OutRequests);
9739 		}
9740 		ASSERT(!attach_if);
9741 
9742 		/*
9743 		 * Check if the ire has the RTF_MULTIRT flag, inherited
9744 		 * from an IRE_OFFSUBNET ire entry in ip_newroute().
9745 		 */
9746 		if (ire->ire_flags & RTF_MULTIRT) {
9747 			/*
9748 			 * Force hop limit of multirouted packets if required.
9749 			 * The hop limit of such packets is bounded by the
9750 			 * ip_multirt_ttl ndd variable.
9751 			 * NDP packets must have a hop limit of 255; don't
9752 			 * change the hop limit in that case.
9753 			 */
9754 			if ((ip_multirt_ttl > 0) &&
9755 			    (ip6h->ip6_hops > ip_multirt_ttl) &&
9756 			    (ip6h->ip6_hops != IPV6_MAX_HOPS)) {
9757 				if (ip_debug > 3) {
9758 					ip2dbg(("ip_wput_v6: forcing multirt "
9759 					    "hop limit to %d (was %d) ",
9760 					    ip_multirt_ttl, ip6h->ip6_hops));
9761 					pr_addr_dbg("v6dst %s\n", AF_INET6,
9762 					    &ire->ire_addr_v6);
9763 				}
9764 				ip6h->ip6_hops = ip_multirt_ttl;
9765 			}
9766 
9767 			/*
9768 			 * We look at this point if there are pending
9769 			 * unresolved routes. ire_multirt_need_resolve_v6()
9770 			 * checks in O(n) that all IRE_OFFSUBNET ire
9771 			 * entries for the packet's destination and
9772 			 * flagged RTF_MULTIRT are currently resolved.
9773 			 * If some remain unresolved, we do a copy
9774 			 * of the current message. It will be used
9775 			 * to initiate additional route resolutions.
9776 			 */
9777 			multirt_need_resolve =
9778 			    ire_multirt_need_resolve_v6(&ire->ire_addr_v6,
9779 				MBLK_GETLABEL(first_mp));
9780 			ip2dbg(("ip_wput_v6: ire %p, "
9781 			    "multirt_need_resolve %d, first_mp %p\n",
9782 			    (void *)ire, multirt_need_resolve,
9783 			    (void *)first_mp));
9784 			if (multirt_need_resolve) {
9785 				copy_mp = copymsg(first_mp);
9786 				if (copy_mp != NULL) {
9787 					MULTIRT_DEBUG_TAG(copy_mp);
9788 				}
9789 			}
9790 		}
9791 		ip_wput_ire_v6(q, first_mp, ire, unspec_src, cksum_request,
9792 		    connp, caller, 0, ip6i_flags);
9793 		if (need_decref) {
9794 			CONN_DEC_REF(connp);
9795 			connp = NULL;
9796 		}
9797 		IRE_REFRELE(ire);
9798 
9799 		/*
9800 		 * Try to resolve another multiroute if
9801 		 * ire_multirt_need_resolve_v6() deemed it necessary.
9802 		 * copy_mp will be consumed (sent or freed) by
9803 		 * ip_newroute_v6().
9804 		 */
9805 		if (copy_mp != NULL) {
9806 			if (mctl_present) {
9807 				ip6h = (ip6_t *)copy_mp->b_cont->b_rptr;
9808 			} else {
9809 				ip6h = (ip6_t *)copy_mp->b_rptr;
9810 			}
9811 			ip_newroute_v6(q, copy_mp, &ip6h->ip6_dst,
9812 			    &ip6h->ip6_src, NULL, zoneid);
9813 		}
9814 		if (ill != NULL)
9815 			ill_refrele(ill);
9816 		return;
9817 	}
9818 
9819 	/*
9820 	 * No full IRE for this destination.  Send it to
9821 	 * ip_newroute_v6 to see if anything else matches.
9822 	 * Mark this packet as having originated on this
9823 	 * machine.
9824 	 * Update rptr if there was an ip6i_t header.
9825 	 */
9826 	mp->b_prev = NULL;
9827 	mp->b_next = NULL;
9828 	if (ip6i != NULL)
9829 		mp->b_rptr -= sizeof (ip6i_t);
9830 
9831 	if (unspec_src) {
9832 		if (ip6i == NULL) {
9833 			/*
9834 			 * Add ip6i_t header to carry unspec_src
9835 			 * until the packet comes back in ip_wput_v6.
9836 			 */
9837 			mp = ip_add_info_v6(mp, NULL, v6dstp);
9838 			if (mp == NULL) {
9839 				if (do_outrequests)
9840 					BUMP_MIB(mibptr, ipv6OutRequests);
9841 				BUMP_MIB(mibptr, ipv6OutDiscards);
9842 				if (mctl_present)
9843 					freeb(first_mp);
9844 				if (ill != NULL)
9845 					ill_refrele(ill);
9846 				if (need_decref)
9847 					CONN_DEC_REF(connp);
9848 				return;
9849 			}
9850 			ip6i = (ip6i_t *)mp->b_rptr;
9851 
9852 			if (mctl_present) {
9853 				ASSERT(first_mp != mp);
9854 				first_mp->b_cont = mp;
9855 			} else {
9856 				first_mp = mp;
9857 			}
9858 
9859 			if ((mp->b_wptr - (uchar_t *)ip6i) ==
9860 			    sizeof (ip6i_t)) {
9861 				/*
9862 				 * ndp_resolver called from ip_newroute_v6
9863 				 * expects pulled up message.
9864 				 */
9865 				if (!pullupmsg(mp, -1)) {
9866 					ip1dbg(("ip_wput_v6: pullupmsg"
9867 					    " failed\n"));
9868 					if (do_outrequests) {
9869 						BUMP_MIB(mibptr,
9870 						    ipv6OutRequests);
9871 					}
9872 					BUMP_MIB(mibptr, ipv6OutDiscards);
9873 					freemsg(first_mp);
9874 					if (ill != NULL)
9875 						ill_refrele(ill);
9876 					if (need_decref)
9877 						CONN_DEC_REF(connp);
9878 					return;
9879 				}
9880 				ip6i = (ip6i_t *)mp->b_rptr;
9881 			}
9882 			ip6h = (ip6_t *)&ip6i[1];
9883 			v6dstp = &ip6h->ip6_dst;
9884 		}
9885 		ip6i->ip6i_flags |= IP6I_UNSPEC_SRC;
9886 		if (mctl_present) {
9887 			ASSERT(io != NULL);
9888 			io->ipsec_out_unspec_src = unspec_src;
9889 		}
9890 	}
9891 	if (do_outrequests)
9892 		BUMP_MIB(mibptr, ipv6OutRequests);
9893 	if (need_decref)
9894 		CONN_DEC_REF(connp);
9895 	ip_newroute_v6(q, first_mp, v6dstp, &ip6h->ip6_src, NULL, zoneid);
9896 	if (ill != NULL)
9897 		ill_refrele(ill);
9898 	return;
9899 
9900 
9901 	/*
9902 	 * Handle multicast packets with or without an conn.
9903 	 * Assumes that the transports set ip6_hops taking
9904 	 * IPV6_MULTICAST_HOPS (and the other ways to set the hoplimit)
9905 	 * into account.
9906 	 */
9907 ipv6multicast:
9908 	ip2dbg(("ip_wput_v6: multicast\n"));
9909 
9910 	/*
9911 	 * 1. IPV6_BOUND_PIF takes precedence over all the ifindex settings
9912 	 * 2. If conn_nofailover_ill is set then use that ill.
9913 	 *
9914 	 * Hold the conn_lock till we refhold the ill of interest that is
9915 	 * pointed to from the conn. Since we cannot do an ill/ipif_refrele
9916 	 * while holding any locks, postpone the refrele until after the
9917 	 * conn_lock is dropped.
9918 	 */
9919 	if (connp != NULL) {
9920 		mutex_enter(&connp->conn_lock);
9921 		conn_lock_held = B_TRUE;
9922 	} else {
9923 		conn_lock_held = B_FALSE;
9924 	}
9925 	if (connp != NULL && connp->conn_outgoing_pill != NULL) {
9926 		err = ill_check_and_refhold(connp->conn_outgoing_pill);
9927 		if (err == ILL_LOOKUP_FAILED) {
9928 			ip1dbg(("ip_output_v6: multicast"
9929 			    " conn_outgoing_pill no ipif\n"));
9930 multicast_discard:
9931 			ASSERT(saved_ill == NULL);
9932 			if (conn_lock_held)
9933 				mutex_exit(&connp->conn_lock);
9934 			if (ill != NULL)
9935 				ill_refrele(ill);
9936 			freemsg(first_mp);
9937 			if (do_outrequests)
9938 				BUMP_MIB(mibptr, ipv6OutDiscards);
9939 			if (need_decref)
9940 				CONN_DEC_REF(connp);
9941 			return;
9942 		}
9943 		saved_ill = ill;
9944 		ill = connp->conn_outgoing_pill;
9945 		attach_if = B_TRUE;
9946 		match_flags = MATCH_IRE_ILL;
9947 		mibptr = ill->ill_ip6_mib;
9948 
9949 		/*
9950 		 * Check if we need an ire that will not be
9951 		 * looked up by anybody else i.e. HIDDEN.
9952 		 */
9953 		if (ill_is_probeonly(ill))
9954 			match_flags |= MATCH_IRE_MARK_HIDDEN;
9955 	} else if (connp != NULL && connp->conn_nofailover_ill != NULL) {
9956 		err = ill_check_and_refhold(connp->conn_nofailover_ill);
9957 		if (err == ILL_LOOKUP_FAILED) {
9958 			ip1dbg(("ip_output_v6: multicast"
9959 			    " conn_nofailover_ill no ipif\n"));
9960 			goto multicast_discard;
9961 		}
9962 		saved_ill = ill;
9963 		ill = connp->conn_nofailover_ill;
9964 		attach_if = B_TRUE;
9965 		match_flags = MATCH_IRE_ILL;
9966 
9967 		/*
9968 		 * Check if we need an ire that will not be
9969 		 * looked up by anybody else i.e. HIDDEN.
9970 		 */
9971 		if (ill_is_probeonly(ill))
9972 			match_flags |= MATCH_IRE_MARK_HIDDEN;
9973 	} else if (ip6i != NULL && (ip6i->ip6i_flags & IP6I_ATTACH_IF)) {
9974 		/*
9975 		 * Redo 1. If we did not find an IRE_CACHE the first time,
9976 		 * we should have an ip6i_t with IP6I_ATTACH_IF if
9977 		 * IPV6_BOUND_PIF or bind to the IPIF_NOFAILOVER address was
9978 		 * used on this endpoint.
9979 		 */
9980 		ASSERT(ip6i->ip6i_ifindex != 0);
9981 		attach_if = B_TRUE;
9982 		ASSERT(ill != NULL);
9983 		match_flags = MATCH_IRE_ILL;
9984 
9985 		/*
9986 		 * Check if we need an ire that will not be
9987 		 * looked up by anybody else i.e. HIDDEN.
9988 		 */
9989 		if (ill_is_probeonly(ill))
9990 			match_flags |= MATCH_IRE_MARK_HIDDEN;
9991 	} else if (ip6i != NULL && (ip6i->ip6i_flags & IP6I_IFINDEX)) {
9992 		/* 3. If an ip6i_t with IP6I_IFINDEX set then use that ill. */
9993 
9994 		ASSERT(ill != NULL);
9995 	} else if (ill != NULL) {
9996 		/*
9997 		 * 4. If q is an ill queue and (link local or multicast
9998 		 * destination) then use that ill.
9999 		 * We don't need the ipif initialization here.
10000 		 * This useless assert below is just to prevent lint from
10001 		 * reporting a null body if statement.
10002 		 */
10003 		ASSERT(ill != NULL);
10004 	} else if (connp != NULL) {
10005 		/*
10006 		 * 5. If IPV6_BOUND_IF has been set use that ill.
10007 		 *
10008 		 * 6. For multicast: if IPV6_MULTICAST_IF has been set use it.
10009 		 * Otherwise look for the best IRE match for the unspecified
10010 		 * group to determine the ill.
10011 		 *
10012 		 * conn_multicast_ill is used for only IPv6 packets.
10013 		 * conn_multicast_ipif is used for only IPv4 packets.
10014 		 * Thus a PF_INET6 socket send both IPv4 and IPv6
10015 		 * multicast packets using different IP*_MULTICAST_IF
10016 		 * interfaces.
10017 		 */
10018 		if (connp->conn_outgoing_ill != NULL) {
10019 			err = ill_check_and_refhold(connp->conn_outgoing_ill);
10020 			if (err == ILL_LOOKUP_FAILED) {
10021 				ip1dbg(("ip_output_v6: multicast"
10022 				    " conn_outgoing_ill no ipif\n"));
10023 				goto multicast_discard;
10024 			}
10025 			ill = connp->conn_outgoing_ill;
10026 		} else if (connp->conn_multicast_ill != NULL) {
10027 			err = ill_check_and_refhold(connp->conn_multicast_ill);
10028 			if (err == ILL_LOOKUP_FAILED) {
10029 				ip1dbg(("ip_output_v6: multicast"
10030 				    " conn_multicast_ill no ipif\n"));
10031 				goto multicast_discard;
10032 			}
10033 			ill = connp->conn_multicast_ill;
10034 		} else {
10035 			mutex_exit(&connp->conn_lock);
10036 			conn_lock_held = B_FALSE;
10037 			ipif = ipif_lookup_group_v6(v6dstp, zoneid);
10038 			if (ipif == NULL) {
10039 				ip1dbg(("ip_output_v6: multicast no ipif\n"));
10040 				goto multicast_discard;
10041 			}
10042 			/*
10043 			 * We have a ref to this ipif, so we can safely
10044 			 * access ipif_ill.
10045 			 */
10046 			ill = ipif->ipif_ill;
10047 			mutex_enter(&ill->ill_lock);
10048 			if (!ILL_CAN_LOOKUP(ill)) {
10049 				mutex_exit(&ill->ill_lock);
10050 				ipif_refrele(ipif);
10051 				ill = NULL;
10052 				ip1dbg(("ip_output_v6: multicast no ipif\n"));
10053 				goto multicast_discard;
10054 			}
10055 			ill_refhold_locked(ill);
10056 			mutex_exit(&ill->ill_lock);
10057 			ipif_refrele(ipif);
10058 			/*
10059 			 * Save binding until IPV6_MULTICAST_IF
10060 			 * changes it
10061 			 */
10062 			mutex_enter(&connp->conn_lock);
10063 			connp->conn_multicast_ill = ill;
10064 			connp->conn_orig_multicast_ifindex =
10065 			    ill->ill_phyint->phyint_ifindex;
10066 			mutex_exit(&connp->conn_lock);
10067 		}
10068 	}
10069 	if (conn_lock_held)
10070 		mutex_exit(&connp->conn_lock);
10071 
10072 	if (saved_ill != NULL)
10073 		ill_refrele(saved_ill);
10074 
10075 	ASSERT(ill != NULL);
10076 	/*
10077 	 * For multicast loopback interfaces replace the multicast address
10078 	 * with a unicast address for the ire lookup.
10079 	 */
10080 	if (ill->ill_phyint->phyint_flags & PHYI_LOOPBACK)
10081 		v6dstp = &ill->ill_ipif->ipif_v6lcl_addr;
10082 
10083 	mibptr = ill->ill_ip6_mib;
10084 	if (do_outrequests) {
10085 		BUMP_MIB(mibptr, ipv6OutRequests);
10086 		do_outrequests = B_FALSE;
10087 	}
10088 	BUMP_MIB(mibptr, ipv6OutMcastPkts);
10089 
10090 	/*
10091 	 * As we may lose the conn by the time we reach ip_wput_ire_v6
10092 	 * we copy conn_multicast_loop and conn_dontroute on to an
10093 	 * ipsec_out. In case if this datagram goes out secure,
10094 	 * we need the ill_index also. Copy that also into the
10095 	 * ipsec_out.
10096 	 */
10097 	if (mctl_present) {
10098 		io = (ipsec_out_t *)first_mp->b_rptr;
10099 		ASSERT(first_mp->b_datap->db_type == M_CTL);
10100 		ASSERT(io->ipsec_out_type == IPSEC_OUT);
10101 	} else {
10102 		ASSERT(mp == first_mp);
10103 		if ((first_mp = ipsec_alloc_ipsec_out()) == NULL) {
10104 			BUMP_MIB(mibptr, ipv6OutDiscards);
10105 			freemsg(mp);
10106 			if (ill != NULL)
10107 				ill_refrele(ill);
10108 			if (need_decref)
10109 				CONN_DEC_REF(connp);
10110 			return;
10111 		}
10112 		io = (ipsec_out_t *)first_mp->b_rptr;
10113 		/* This is not a secure packet */
10114 		io->ipsec_out_secure = B_FALSE;
10115 		io->ipsec_out_use_global_policy = B_TRUE;
10116 		io->ipsec_out_zoneid =
10117 		    (zoneid != ALL_ZONES ? zoneid : GLOBAL_ZONEID);
10118 		first_mp->b_cont = mp;
10119 		mctl_present = B_TRUE;
10120 	}
10121 	io->ipsec_out_ill_index = ill->ill_phyint->phyint_ifindex;
10122 	io->ipsec_out_unspec_src = unspec_src;
10123 	if (connp != NULL)
10124 		io->ipsec_out_dontroute = connp->conn_dontroute;
10125 
10126 send_from_ill:
10127 	ASSERT(ill != NULL);
10128 	ASSERT(mibptr == ill->ill_ip6_mib);
10129 	if (do_outrequests) {
10130 		BUMP_MIB(mibptr, ipv6OutRequests);
10131 		do_outrequests = B_FALSE;
10132 	}
10133 
10134 	if (io != NULL)
10135 		io->ipsec_out_ill_index = ill->ill_phyint->phyint_ifindex;
10136 
10137 	/*
10138 	 * When a specific ill is specified (using IPV6_PKTINFO,
10139 	 * IPV6_MULTICAST_IF, or IPV6_BOUND_IF) we will only match
10140 	 * on routing entries (ftable and ctable) that have a matching
10141 	 * ire->ire_ipif->ipif_ill. Thus this can only be used
10142 	 * for destinations that are on-link for the specific ill
10143 	 * and that can appear on multiple links. Thus it is useful
10144 	 * for multicast destinations, link-local destinations, and
10145 	 * at some point perhaps for site-local destinations (if the
10146 	 * node sits at a site boundary).
10147 	 * We create the cache entries in the regular ctable since
10148 	 * it can not "confuse" things for other destinations.
10149 	 * table.
10150 	 *
10151 	 * NOTE : conn_ire_cache is not used for caching ire_ctable_lookups.
10152 	 *	  It is used only when ire_cache_lookup is used above.
10153 	 */
10154 	ire = ire_ctable_lookup_v6(v6dstp, 0, 0, ill->ill_ipif,
10155 	    zoneid, MBLK_GETLABEL(mp), match_flags);
10156 	if (ire != NULL) {
10157 		/*
10158 		 * Check if the ire has the RTF_MULTIRT flag, inherited
10159 		 * from an IRE_OFFSUBNET ire entry in ip_newroute().
10160 		 */
10161 		if (ire->ire_flags & RTF_MULTIRT) {
10162 			/*
10163 			 * Force hop limit of multirouted packets if required.
10164 			 * The hop limit of such packets is bounded by the
10165 			 * ip_multirt_ttl ndd variable.
10166 			 * NDP packets must have a hop limit of 255; don't
10167 			 * change the hop limit in that case.
10168 			 */
10169 			if ((ip_multirt_ttl > 0) &&
10170 			    (ip6h->ip6_hops > ip_multirt_ttl) &&
10171 			    (ip6h->ip6_hops != IPV6_MAX_HOPS)) {
10172 				if (ip_debug > 3) {
10173 					ip2dbg(("ip_wput_v6: forcing multirt "
10174 					    "hop limit to %d (was %d) ",
10175 					    ip_multirt_ttl, ip6h->ip6_hops));
10176 					pr_addr_dbg("v6dst %s\n", AF_INET6,
10177 					    &ire->ire_addr_v6);
10178 				}
10179 				ip6h->ip6_hops = ip_multirt_ttl;
10180 			}
10181 
10182 			/*
10183 			 * We look at this point if there are pending
10184 			 * unresolved routes. ire_multirt_need_resolve_v6()
10185 			 * checks in O(n) that all IRE_OFFSUBNET ire
10186 			 * entries for the packet's destination and
10187 			 * flagged RTF_MULTIRT are currently resolved.
10188 			 * If some remain unresolved, we make a copy
10189 			 * of the current message. It will be used
10190 			 * to initiate additional route resolutions.
10191 			 */
10192 			multirt_need_resolve =
10193 			    ire_multirt_need_resolve_v6(&ire->ire_addr_v6,
10194 				MBLK_GETLABEL(first_mp));
10195 			ip2dbg(("ip_wput_v6[send_from_ill]: ire %p, "
10196 			    "multirt_need_resolve %d, first_mp %p\n",
10197 			    (void *)ire, multirt_need_resolve,
10198 			    (void *)first_mp));
10199 			if (multirt_need_resolve) {
10200 				copy_mp = copymsg(first_mp);
10201 				if (copy_mp != NULL) {
10202 					MULTIRT_DEBUG_TAG(copy_mp);
10203 				}
10204 			}
10205 		}
10206 
10207 		ip1dbg(("ip_wput_v6: send on %s, ire = %p, ill index = %d\n",
10208 		    ill->ill_name, (void *)ire,
10209 		    ill->ill_phyint->phyint_ifindex));
10210 		ip_wput_ire_v6(q, first_mp, ire, unspec_src, cksum_request,
10211 		    connp, caller,
10212 		    (attach_if ? ill->ill_phyint->phyint_ifindex : 0),
10213 		    ip6i_flags);
10214 		ire_refrele(ire);
10215 		if (need_decref) {
10216 			CONN_DEC_REF(connp);
10217 			connp = NULL;
10218 		}
10219 
10220 		/*
10221 		 * Try to resolve another multiroute if
10222 		 * ire_multirt_need_resolve_v6() deemed it necessary.
10223 		 * copy_mp will be consumed (sent or freed) by
10224 		 * ip_newroute_[ipif_]v6().
10225 		 */
10226 		if (copy_mp != NULL) {
10227 			if (mctl_present) {
10228 				ip6h = (ip6_t *)copy_mp->b_cont->b_rptr;
10229 			} else {
10230 				ip6h = (ip6_t *)copy_mp->b_rptr;
10231 			}
10232 			if (IN6_IS_ADDR_MULTICAST(&ip6h->ip6_dst)) {
10233 				ipif = ipif_lookup_group_v6(&ip6h->ip6_dst,
10234 				    zoneid);
10235 				if (ipif == NULL) {
10236 					ip1dbg(("ip_wput_v6: No ipif for "
10237 					    "multicast\n"));
10238 					MULTIRT_DEBUG_UNTAG(copy_mp);
10239 					freemsg(copy_mp);
10240 					return;
10241 				}
10242 				ip_newroute_ipif_v6(q, copy_mp, ipif,
10243 				    ip6h->ip6_dst, unspec_src, zoneid);
10244 				ipif_refrele(ipif);
10245 			} else {
10246 				ip_newroute_v6(q, copy_mp, &ip6h->ip6_dst,
10247 				    &ip6h->ip6_src, ill, zoneid);
10248 			}
10249 		}
10250 		if (ill != NULL)
10251 			ill_refrele(ill);
10252 		return;
10253 	}
10254 	if (need_decref) {
10255 		CONN_DEC_REF(connp);
10256 		connp = NULL;
10257 	}
10258 
10259 	/* Update rptr if there was an ip6i_t header. */
10260 	if (ip6i != NULL)
10261 		mp->b_rptr -= sizeof (ip6i_t);
10262 	if (unspec_src || attach_if) {
10263 		if (ip6i == NULL) {
10264 			/*
10265 			 * Add ip6i_t header to carry unspec_src
10266 			 * or attach_if until the packet comes back in
10267 			 * ip_wput_v6.
10268 			 */
10269 			if (mctl_present) {
10270 				first_mp->b_cont =
10271 				    ip_add_info_v6(mp, NULL, v6dstp);
10272 				mp = first_mp->b_cont;
10273 				if (mp == NULL)
10274 					freeb(first_mp);
10275 			} else {
10276 				first_mp = mp = ip_add_info_v6(mp, NULL,
10277 				    v6dstp);
10278 			}
10279 			if (mp == NULL) {
10280 				BUMP_MIB(mibptr, ipv6OutDiscards);
10281 				if (ill != NULL)
10282 					ill_refrele(ill);
10283 				return;
10284 			}
10285 			ip6i = (ip6i_t *)mp->b_rptr;
10286 			if ((mp->b_wptr - (uchar_t *)ip6i) ==
10287 			    sizeof (ip6i_t)) {
10288 				/*
10289 				 * ndp_resolver called from ip_newroute_v6
10290 				 * expects a pulled up message.
10291 				 */
10292 				if (!pullupmsg(mp, -1)) {
10293 					ip1dbg(("ip_wput_v6: pullupmsg"
10294 					    " failed\n"));
10295 					BUMP_MIB(mibptr, ipv6OutDiscards);
10296 					freemsg(first_mp);
10297 					return;
10298 				}
10299 				ip6i = (ip6i_t *)mp->b_rptr;
10300 			}
10301 			ip6h = (ip6_t *)&ip6i[1];
10302 			v6dstp = &ip6h->ip6_dst;
10303 		}
10304 		if (unspec_src)
10305 			ip6i->ip6i_flags |= IP6I_UNSPEC_SRC;
10306 		if (attach_if) {
10307 			/*
10308 			 * Bind to nofailover/BOUND_PIF overrides ifindex.
10309 			 */
10310 			ip6i->ip6i_flags |= IP6I_ATTACH_IF;
10311 			ip6i->ip6i_flags &= ~IP6I_IFINDEX;
10312 			ip6i->ip6i_ifindex = ill->ill_phyint->phyint_ifindex;
10313 			if (drop_if_delayed) {
10314 				/* This is a multipathing probe packet */
10315 				ip6i->ip6i_flags |= IP6I_DROP_IFDELAYED;
10316 			}
10317 		}
10318 		if (mctl_present) {
10319 			ASSERT(io != NULL);
10320 			io->ipsec_out_unspec_src = unspec_src;
10321 		}
10322 	}
10323 	if (IN6_IS_ADDR_MULTICAST(v6dstp)) {
10324 		ip_newroute_ipif_v6(q, first_mp, ill->ill_ipif, *v6dstp,
10325 		    unspec_src, zoneid);
10326 	} else {
10327 		ip_newroute_v6(q, first_mp, v6dstp, &ip6h->ip6_src, ill,
10328 		    zoneid);
10329 	}
10330 	if (ill != NULL)
10331 		ill_refrele(ill);
10332 	return;
10333 
10334 notv6:
10335 	/*
10336 	 * XXX implement a IPv4 and IPv6 packet counter per conn and
10337 	 * switch when ratio exceeds e.g. 10:1
10338 	 */
10339 	if (q->q_next == NULL) {
10340 		connp = Q_TO_CONN(q);
10341 
10342 		if (IPCL_IS_TCP(connp)) {
10343 			/* change conn_send for the tcp_v4_connections */
10344 			connp->conn_send = ip_output;
10345 		} else if (connp->conn_ulp == IPPROTO_SCTP) {
10346 			/* The 'q' is the default SCTP queue */
10347 			connp = (conn_t *)arg;
10348 		} else {
10349 			ip_setqinfo(RD(q), IPV4_MINOR, B_TRUE);
10350 		}
10351 	}
10352 	BUMP_MIB(mibptr, ipv6OutIPv4);
10353 	(void) ip_output(connp, first_mp, q, caller);
10354 	if (ill != NULL)
10355 		ill_refrele(ill);
10356 }
10357 
10358 static void
10359 ip_wput_v6(queue_t *q, mblk_t *mp)
10360 {
10361 	ip_output_v6(Q_TO_CONN(q), mp, q, IP_WPUT);
10362 }
10363 
10364 static void
10365 ipsec_out_attach_if(ipsec_out_t *io, int attach_index)
10366 {
10367 	ASSERT(io->ipsec_out_type == IPSEC_OUT);
10368 	io->ipsec_out_attach_if = B_TRUE;
10369 	io->ipsec_out_ill_index = attach_index;
10370 }
10371 
10372 /*
10373  * NULL send-to queue - packet is to be delivered locally.
10374  */
10375 void
10376 ip_wput_local_v6(queue_t *q, ill_t *ill, ip6_t *ip6h, mblk_t *first_mp,
10377     ire_t *ire, int fanout_flags)
10378 {
10379 	uint32_t	ports;
10380 	mblk_t		*mp = first_mp, *first_mp1;
10381 	boolean_t	mctl_present;
10382 	uint8_t		nexthdr;
10383 	uint16_t	hdr_length;
10384 	ipsec_out_t	*io;
10385 	mib2_ipv6IfStatsEntry_t	*mibptr;
10386 	ilm_t		*ilm;
10387 	uint_t	nexthdr_offset;
10388 
10389 	if (DB_TYPE(mp) == M_CTL) {
10390 		io = (ipsec_out_t *)mp->b_rptr;
10391 		if (!io->ipsec_out_secure) {
10392 			mp = mp->b_cont;
10393 			freeb(first_mp);
10394 			first_mp = mp;
10395 			mctl_present = B_FALSE;
10396 		} else {
10397 			mctl_present = B_TRUE;
10398 			mp = first_mp->b_cont;
10399 			ipsec_out_to_in(first_mp);
10400 		}
10401 	} else {
10402 		mctl_present = B_FALSE;
10403 	}
10404 
10405 	nexthdr = ip6h->ip6_nxt;
10406 	mibptr = ill->ill_ip6_mib;
10407 
10408 	/* Fastpath */
10409 	switch (nexthdr) {
10410 	case IPPROTO_TCP:
10411 	case IPPROTO_UDP:
10412 	case IPPROTO_ICMPV6:
10413 	case IPPROTO_SCTP:
10414 		hdr_length = IPV6_HDR_LEN;
10415 		nexthdr_offset = (uint_t)((uchar_t *)&ip6h->ip6_nxt -
10416 		    (uchar_t *)ip6h);
10417 		break;
10418 	default: {
10419 		uint8_t	*nexthdrp;
10420 
10421 		if (!ip_hdr_length_nexthdr_v6(mp, ip6h,
10422 		    &hdr_length, &nexthdrp)) {
10423 			/* Malformed packet */
10424 			BUMP_MIB(mibptr, ipv6OutDiscards);
10425 			freemsg(first_mp);
10426 			return;
10427 		}
10428 		nexthdr = *nexthdrp;
10429 		nexthdr_offset = nexthdrp - (uint8_t *)ip6h;
10430 		break;
10431 	}
10432 	}
10433 
10434 
10435 	UPDATE_OB_PKT_COUNT(ire);
10436 	ire->ire_last_used_time = lbolt;
10437 
10438 	/*
10439 	 * Remove reacability confirmation bit from version field
10440 	 * before looping back the packet.
10441 	 */
10442 	if (ip6h->ip6_vcf & IP_FORWARD_PROG) {
10443 		ip6h->ip6_vcf &= ~IP_FORWARD_PROG;
10444 	}
10445 
10446 	switch (nexthdr) {
10447 		case IPPROTO_TCP:
10448 			if (DB_TYPE(mp) == M_DATA) {
10449 				/*
10450 				 * M_DATA mblk, so init mblk (chain) for
10451 				 * no struio().
10452 				 */
10453 				mblk_t  *mp1 = mp;
10454 
10455 				do {
10456 					mp1->b_datap->db_struioflag = 0;
10457 				} while ((mp1 = mp1->b_cont) != NULL);
10458 			}
10459 			ports = *(uint32_t *)(mp->b_rptr + hdr_length +
10460 			    TCP_PORTS_OFFSET);
10461 			ip_fanout_tcp_v6(q, first_mp, ip6h, ill, ill,
10462 			    fanout_flags|IP_FF_SEND_ICMP|IP_FF_SYN_ADDIRE|
10463 			    IP_FF_IP6INFO|IP6_NO_IPPOLICY|IP_FF_LOOPBACK,
10464 			    hdr_length, mctl_present, ire->ire_zoneid);
10465 			return;
10466 
10467 		case IPPROTO_UDP:
10468 			ports = *(uint32_t *)(mp->b_rptr + hdr_length +
10469 			    UDP_PORTS_OFFSET);
10470 			ip_fanout_udp_v6(q, first_mp, ip6h, ports, ill, ill,
10471 			    fanout_flags|IP_FF_SEND_ICMP|IP_FF_IP6INFO|
10472 			    IP6_NO_IPPOLICY, mctl_present, ire->ire_zoneid);
10473 			return;
10474 
10475 		case IPPROTO_SCTP:
10476 		{
10477 			uint_t	ipif_seqid = ire->ire_ipif->ipif_seqid;
10478 
10479 			ports = *(uint32_t *)(mp->b_rptr + hdr_length);
10480 			ip_fanout_sctp(mp, ill, (ipha_t *)ip6h, ports,
10481 			    fanout_flags|IP_FF_SEND_ICMP|IP_FF_IP6INFO,
10482 			    mctl_present, IP6_NO_IPPOLICY, ipif_seqid,
10483 			    ire->ire_zoneid);
10484 			return;
10485 		}
10486 		case IPPROTO_ICMPV6: {
10487 			icmp6_t *icmp6;
10488 
10489 			/* check for full IPv6+ICMPv6 header */
10490 			if ((mp->b_wptr - mp->b_rptr) <
10491 			    (hdr_length + ICMP6_MINLEN)) {
10492 				if (!pullupmsg(mp, hdr_length + ICMP6_MINLEN)) {
10493 					ip1dbg(("ip_wput_v6: ICMP hdr pullupmsg"
10494 					    " failed\n"));
10495 					BUMP_MIB(mibptr, ipv6OutDiscards);
10496 					freemsg(first_mp);
10497 					return;
10498 				}
10499 				ip6h = (ip6_t *)mp->b_rptr;
10500 			}
10501 			icmp6 = (icmp6_t *)((uchar_t *)ip6h + hdr_length);
10502 
10503 			/* Update output mib stats */
10504 			icmp_update_out_mib_v6(ill, icmp6);
10505 
10506 			/* Check variable for testing applications */
10507 			if (ipv6_drop_inbound_icmpv6) {
10508 				freemsg(first_mp);
10509 				return;
10510 			}
10511 			/*
10512 			 * Assume that there is always at least one conn for
10513 			 * ICMPv6 (in.ndpd) i.e. don't optimize the case
10514 			 * where there is no conn.
10515 			 */
10516 			if (IN6_IS_ADDR_MULTICAST(&ip6h->ip6_dst) &&
10517 			    !(ill->ill_phyint->phyint_flags & PHYI_LOOPBACK)) {
10518 				/*
10519 				 * In the multicast case, applications may have
10520 				 * joined the group from different zones, so we
10521 				 * need to deliver the packet to each of them.
10522 				 * Loop through the multicast memberships
10523 				 * structures (ilm) on the receive ill and send
10524 				 * a copy of the packet up each matching one.
10525 				 * However, we don't do this for multicasts sent
10526 				 * on the loopback interface (PHYI_LOOPBACK flag
10527 				 * set) as they must stay in the sender's zone.
10528 				 */
10529 				ILM_WALKER_HOLD(ill);
10530 				for (ilm = ill->ill_ilm; ilm != NULL;
10531 				    ilm = ilm->ilm_next) {
10532 					if (ilm->ilm_flags & ILM_DELETED)
10533 						continue;
10534 					if (!IN6_ARE_ADDR_EQUAL(
10535 					    &ilm->ilm_v6addr, &ip6h->ip6_dst))
10536 						continue;
10537 					if ((fanout_flags &
10538 					    IP_FF_NO_MCAST_LOOP) &&
10539 					    ilm->ilm_zoneid == ire->ire_zoneid)
10540 						continue;
10541 					if (!ipif_lookup_zoneid(ill,
10542 					    ilm->ilm_zoneid, IPIF_UP, NULL))
10543 						continue;
10544 
10545 					first_mp1 = ip_copymsg(first_mp);
10546 					if (first_mp1 == NULL)
10547 						continue;
10548 					icmp_inbound_v6(q, first_mp1, ill,
10549 					    hdr_length, mctl_present,
10550 					    IP6_NO_IPPOLICY, ilm->ilm_zoneid);
10551 				}
10552 				ILM_WALKER_RELE(ill);
10553 			} else {
10554 				first_mp1 = ip_copymsg(first_mp);
10555 				if (first_mp1 != NULL)
10556 					icmp_inbound_v6(q, first_mp1, ill,
10557 					    hdr_length, mctl_present,
10558 					    IP6_NO_IPPOLICY, ire->ire_zoneid);
10559 			}
10560 		}
10561 		/* FALLTHRU */
10562 		default: {
10563 			/*
10564 			 * Handle protocols with which IPv6 is less intimate.
10565 			 */
10566 			fanout_flags |= IP_FF_RAWIP|IP_FF_IP6INFO;
10567 
10568 			/*
10569 			 * Enable sending ICMP for "Unknown" nexthdr
10570 			 * case. i.e. where we did not FALLTHRU from
10571 			 * IPPROTO_ICMPV6 processing case above.
10572 			 */
10573 			if (nexthdr != IPPROTO_ICMPV6)
10574 				fanout_flags |= IP_FF_SEND_ICMP;
10575 			/*
10576 			 * Note: There can be more than one stream bound
10577 			 * to a particular protocol. When this is the case,
10578 			 * each one gets a copy of any incoming packets.
10579 			 */
10580 			ip_fanout_proto_v6(q, first_mp, ip6h, ill, ill, nexthdr,
10581 			    nexthdr_offset, fanout_flags|IP6_NO_IPPOLICY,
10582 			    mctl_present, ire->ire_zoneid);
10583 			return;
10584 		}
10585 	}
10586 }
10587 
10588 /*
10589  * Send packet using IRE.
10590  * Checksumming is controlled by cksum_request:
10591  *	-1 => normal i.e. TCP/UDP/SCTP/ICMPv6 are checksummed and nothing else.
10592  *	1 => Skip TCP/UDP/SCTP checksum
10593  * 	Otherwise => checksum_request contains insert offset for checksum
10594  *
10595  * Assumes that the following set of headers appear in the first
10596  * mblk:
10597  *	ip6_t
10598  *	Any extension headers
10599  *	TCP/UDP/SCTP header (if present)
10600  * The routine can handle an ICMPv6 header that is not in the first mblk.
10601  *
10602  * NOTE : This function does not ire_refrele the ire passed in as the
10603  *	  argument unlike ip_wput_ire where the REFRELE is done.
10604  *	  Refer to ip_wput_ire for more on this.
10605  */
10606 static void
10607 ip_wput_ire_v6(queue_t *q, mblk_t *mp, ire_t *ire, int unspec_src,
10608     int cksum_request, conn_t *connp, int caller, int attach_index, int flags)
10609 {
10610 	ip6_t		*ip6h;
10611 	uint8_t		nexthdr;
10612 	uint16_t	hdr_length;
10613 	uint_t		reachable = 0x0;
10614 	ill_t		*ill;
10615 	mib2_ipv6IfStatsEntry_t	*mibptr;
10616 	mblk_t		*first_mp;
10617 	boolean_t	mctl_present;
10618 	ipsec_out_t	*io;
10619 	boolean_t	conn_dontroute;	/* conn value for multicast */
10620 	boolean_t	conn_multicast_loop;	/* conn value for multicast */
10621 	boolean_t 	multicast_forward;	/* Should we forward ? */
10622 	int		max_frag;
10623 	zoneid_t	zoneid;
10624 
10625 	zoneid = (connp != NULL ? connp->conn_zoneid : ALL_ZONES);
10626 	ill = ire_to_ill(ire);
10627 	first_mp = mp;
10628 	multicast_forward = B_FALSE;
10629 
10630 	if (mp->b_datap->db_type != M_CTL) {
10631 		ip6h = (ip6_t *)first_mp->b_rptr;
10632 	} else {
10633 		io = (ipsec_out_t *)first_mp->b_rptr;
10634 		ASSERT(io->ipsec_out_type == IPSEC_OUT);
10635 		/*
10636 		 * Grab the zone id now because the M_CTL can be discarded by
10637 		 * ip_wput_ire_parse_ipsec_out() below.
10638 		 */
10639 		zoneid = io->ipsec_out_zoneid;
10640 		ASSERT(zoneid != ALL_ZONES);
10641 		ip6h = (ip6_t *)first_mp->b_cont->b_rptr;
10642 		/*
10643 		 * For the multicast case, ipsec_out carries conn_dontroute and
10644 		 * conn_multicast_loop as conn may not be available here. We
10645 		 * need this for multicast loopback and forwarding which is done
10646 		 * later in the code.
10647 		 */
10648 		if (IN6_IS_ADDR_MULTICAST(&ip6h->ip6_dst)) {
10649 			conn_dontroute = io->ipsec_out_dontroute;
10650 			conn_multicast_loop = io->ipsec_out_multicast_loop;
10651 			/*
10652 			 * If conn_dontroute is not set or conn_multicast_loop
10653 			 * is set, we need to do forwarding/loopback. For
10654 			 * datagrams from ip_wput_multicast, conn_dontroute is
10655 			 * set to B_TRUE and conn_multicast_loop is set to
10656 			 * B_FALSE so that we neither do forwarding nor
10657 			 * loopback.
10658 			 */
10659 			if (!conn_dontroute || conn_multicast_loop)
10660 				multicast_forward = B_TRUE;
10661 		}
10662 	}
10663 
10664 	/*
10665 	 * If the sender didn't supply the hop limit and there is a default
10666 	 * unicast hop limit associated with the output interface, we use
10667 	 * that if the packet is unicast.  Interface specific unicast hop
10668 	 * limits as set via the SIOCSLIFLNKINFO ioctl.
10669 	 */
10670 	if (ill->ill_max_hops != 0 && !(flags & IP6I_HOPLIMIT) &&
10671 	    !(IN6_IS_ADDR_MULTICAST(&ip6h->ip6_dst))) {
10672 		ip6h->ip6_hops = ill->ill_max_hops;
10673 	}
10674 
10675 	if (ire->ire_type == IRE_LOCAL && ire->ire_zoneid != zoneid &&
10676 	    ire->ire_zoneid != ALL_ZONES) {
10677 		/*
10678 		 * When a zone sends a packet to another zone, we try to deliver
10679 		 * the packet under the same conditions as if the destination
10680 		 * was a real node on the network. To do so, we look for a
10681 		 * matching route in the forwarding table.
10682 		 * RTF_REJECT and RTF_BLACKHOLE are handled just like
10683 		 * ip_newroute_v6() does.
10684 		 */
10685 		ire_t *src_ire = ire_ftable_lookup_v6(&ip6h->ip6_dst, 0, 0, 0,
10686 		    NULL, NULL, zoneid, 0, NULL, (MATCH_IRE_RECURSIVE |
10687 		    MATCH_IRE_DEFAULT | MATCH_IRE_RJ_BHOLE));
10688 		if (src_ire != NULL &&
10689 		    !(src_ire->ire_flags & (RTF_REJECT | RTF_BLACKHOLE))) {
10690 			if (IN6_IS_ADDR_UNSPECIFIED(&ip6h->ip6_src) &&
10691 			    !unspec_src) {
10692 				ip6h->ip6_src = src_ire->ire_src_addr_v6;
10693 			}
10694 			ire_refrele(src_ire);
10695 		} else {
10696 			BUMP_MIB(ill->ill_ip6_mib, ipv6OutNoRoutes);
10697 			if (src_ire != NULL) {
10698 				if (src_ire->ire_flags & RTF_BLACKHOLE) {
10699 					ire_refrele(src_ire);
10700 					freemsg(first_mp);
10701 					return;
10702 				}
10703 				ire_refrele(src_ire);
10704 			}
10705 			if (ip_hdr_complete_v6(ip6h, zoneid)) {
10706 				/* Failed */
10707 				freemsg(first_mp);
10708 				return;
10709 			}
10710 			icmp_unreachable_v6(q, first_mp,
10711 			    ICMP6_DST_UNREACH_NOROUTE, B_FALSE, B_FALSE);
10712 			return;
10713 		}
10714 	}
10715 
10716 	if (mp->b_datap->db_type == M_CTL || ipsec_outbound_v6_policy_present) {
10717 		mp = ip_wput_ire_parse_ipsec_out(first_mp, NULL, ip6h, ire,
10718 		    connp, unspec_src);
10719 		if (mp == NULL) {
10720 			return;
10721 		}
10722 	}
10723 
10724 	first_mp = mp;
10725 	if (mp->b_datap->db_type == M_CTL) {
10726 		io = (ipsec_out_t *)mp->b_rptr;
10727 		ASSERT(io->ipsec_out_type == IPSEC_OUT);
10728 		mp = mp->b_cont;
10729 		mctl_present = B_TRUE;
10730 	} else {
10731 		mctl_present = B_FALSE;
10732 	}
10733 
10734 	ip6h = (ip6_t *)mp->b_rptr;
10735 	nexthdr = ip6h->ip6_nxt;
10736 	mibptr = ill->ill_ip6_mib;
10737 
10738 	if (IN6_IS_ADDR_UNSPECIFIED(&ip6h->ip6_src) && !unspec_src) {
10739 		ipif_t *ipif;
10740 
10741 		/*
10742 		 * Select the source address using ipif_select_source_v6.
10743 		 */
10744 		if (attach_index != 0) {
10745 			ipif = ipif_select_source_v6(ill, &ip6h->ip6_dst,
10746 			    RESTRICT_TO_ILL, IPV6_PREFER_SRC_DEFAULT, zoneid);
10747 		} else {
10748 			ipif = ipif_select_source_v6(ill, &ip6h->ip6_dst,
10749 			    RESTRICT_TO_NONE, IPV6_PREFER_SRC_DEFAULT, zoneid);
10750 		}
10751 		if (ipif == NULL) {
10752 			if (ip_debug > 2) {
10753 				/* ip1dbg */
10754 				pr_addr_dbg("ip_wput_ire_v6: no src for "
10755 				    "dst %s\n, ", AF_INET6, &ip6h->ip6_dst);
10756 				printf("ip_wput_ire_v6: interface name %s\n",
10757 				    ill->ill_name);
10758 			}
10759 			freemsg(first_mp);
10760 			return;
10761 		}
10762 		ip6h->ip6_src = ipif->ipif_v6src_addr;
10763 		ipif_refrele(ipif);
10764 	}
10765 	if (IN6_IS_ADDR_MULTICAST(&ip6h->ip6_dst)) {
10766 		if ((connp != NULL && connp->conn_multicast_loop) ||
10767 		    !(ill->ill_phyint->phyint_flags & PHYI_LOOPBACK)) {
10768 			ilm_t	*ilm;
10769 
10770 			ILM_WALKER_HOLD(ill);
10771 			ilm = ilm_lookup_ill_v6(ill, &ip6h->ip6_dst, ALL_ZONES);
10772 			ILM_WALKER_RELE(ill);
10773 			if (ilm != NULL) {
10774 				mblk_t *nmp;
10775 				int fanout_flags = 0;
10776 
10777 				if (connp != NULL &&
10778 				    !connp->conn_multicast_loop) {
10779 					fanout_flags |= IP_FF_NO_MCAST_LOOP;
10780 				}
10781 				ip1dbg(("ip_wput_ire_v6: "
10782 				    "Loopback multicast\n"));
10783 				nmp = ip_copymsg(first_mp);
10784 				if (nmp != NULL) {
10785 					ip6_t	*nip6h;
10786 
10787 					if (mctl_present) {
10788 						nip6h = (ip6_t *)
10789 						    nmp->b_cont->b_rptr;
10790 					} else {
10791 						nip6h = (ip6_t *)nmp->b_rptr;
10792 					}
10793 					/*
10794 					 * Deliver locally and to every local
10795 					 * zone, except the sending zone when
10796 					 * IPV6_MULTICAST_LOOP is disabled.
10797 					 */
10798 					ip_wput_local_v6(RD(q), ill, nip6h, nmp,
10799 					    ire, fanout_flags);
10800 				} else {
10801 					BUMP_MIB(mibptr, ipv6OutDiscards);
10802 					ip1dbg(("ip_wput_ire_v6: "
10803 					    "copymsg failed\n"));
10804 				}
10805 			}
10806 		}
10807 		if (ip6h->ip6_hops == 0 ||
10808 		    IN6_IS_ADDR_MC_NODELOCAL(&ip6h->ip6_dst) ||
10809 		    (ill->ill_phyint->phyint_flags & PHYI_LOOPBACK)) {
10810 			/*
10811 			 * Local multicast or just loopback on loopback
10812 			 * interface.
10813 			 */
10814 			BUMP_MIB(mibptr, ipv6OutMcastPkts);
10815 			ip1dbg(("ip_wput_ire_v6: local multicast only\n"));
10816 			freemsg(first_mp);
10817 			return;
10818 		}
10819 	}
10820 
10821 	if (ire->ire_stq != NULL) {
10822 		uint32_t	sum;
10823 		uint_t		ill_index =  ((ill_t *)ire->ire_stq->q_ptr)->
10824 		    ill_phyint->phyint_ifindex;
10825 		queue_t		*dev_q = ire->ire_stq->q_next;
10826 
10827 		/*
10828 		 * non-NULL send-to queue - packet is to be sent
10829 		 * out an interface.
10830 		 */
10831 
10832 		/* Driver is flow-controlling? */
10833 		if (!IP_FLOW_CONTROLLED_ULP(nexthdr) &&
10834 		    ((dev_q->q_next || dev_q->q_first) && !canput(dev_q))) {
10835 			/*
10836 			 * Queue packet if we have an conn to give back
10837 			 * pressure.  We can't queue packets intended for
10838 			 * hardware acceleration since we've tossed that
10839 			 * state already.  If the packet is being fed back
10840 			 * from ire_send_v6, we don't know the position in
10841 			 * the queue to enqueue the packet and we discard
10842 			 * the packet.
10843 			 */
10844 			if (ip_output_queue && connp != NULL &&
10845 			    !mctl_present && caller != IRE_SEND) {
10846 				if (caller == IP_WSRV) {
10847 					connp->conn_did_putbq = 1;
10848 					(void) putbq(connp->conn_wq, mp);
10849 					conn_drain_insert(connp);
10850 					/*
10851 					 * caller == IP_WSRV implies we are
10852 					 * the service thread, and the
10853 					 * queue is already noenabled.
10854 					 * The check for canput and
10855 					 * the putbq is not atomic.
10856 					 * So we need to check again.
10857 					 */
10858 					if (canput(dev_q))
10859 						connp->conn_did_putbq = 0;
10860 				} else {
10861 					(void) putq(connp->conn_wq, mp);
10862 				}
10863 				return;
10864 			}
10865 			BUMP_MIB(mibptr, ipv6OutDiscards);
10866 			freemsg(first_mp);
10867 			return;
10868 		}
10869 
10870 		/*
10871 		 * Look for reachability confirmations from the transport.
10872 		 */
10873 		if (ip6h->ip6_vcf & IP_FORWARD_PROG) {
10874 			reachable |= IPV6_REACHABILITY_CONFIRMATION;
10875 			ip6h->ip6_vcf &= ~IP_FORWARD_PROG;
10876 			if (mctl_present)
10877 				io->ipsec_out_reachable = B_TRUE;
10878 		}
10879 		/* Fastpath */
10880 		switch (nexthdr) {
10881 		case IPPROTO_TCP:
10882 		case IPPROTO_UDP:
10883 		case IPPROTO_ICMPV6:
10884 		case IPPROTO_SCTP:
10885 			hdr_length = IPV6_HDR_LEN;
10886 			break;
10887 		default: {
10888 			uint8_t	*nexthdrp;
10889 
10890 			if (!ip_hdr_length_nexthdr_v6(mp, ip6h,
10891 			    &hdr_length, &nexthdrp)) {
10892 				/* Malformed packet */
10893 				BUMP_MIB(mibptr, ipv6OutDiscards);
10894 				freemsg(first_mp);
10895 				return;
10896 			}
10897 			nexthdr = *nexthdrp;
10898 			break;
10899 		}
10900 		}
10901 
10902 		if (cksum_request != -1 && nexthdr != IPPROTO_ICMPV6) {
10903 			uint16_t	*up;
10904 			uint16_t	*insp;
10905 
10906 			/*
10907 			 * The packet header is processed once for all, even
10908 			 * in the multirouting case. We disable hardware
10909 			 * checksum if the packet is multirouted, as it will be
10910 			 * replicated via several interfaces, and not all of
10911 			 * them may have this capability.
10912 			 */
10913 			if (cksum_request == 1 &&
10914 			    !(ire->ire_flags & RTF_MULTIRT)) {
10915 				/* Skip the transport checksum */
10916 				goto cksum_done;
10917 			}
10918 			/*
10919 			 * Do user-configured raw checksum.
10920 			 * Compute checksum and insert at offset "cksum_request"
10921 			 */
10922 
10923 			/* check for enough headers for checksum */
10924 			cksum_request += hdr_length;	/* offset from rptr */
10925 			if ((mp->b_wptr - mp->b_rptr) <
10926 			    (cksum_request + sizeof (int16_t))) {
10927 				if (!pullupmsg(mp,
10928 				    cksum_request + sizeof (int16_t))) {
10929 					ip1dbg(("ip_wput_v6: ICMP hdr pullupmsg"
10930 					    " failed\n"));
10931 					BUMP_MIB(mibptr, ipv6OutDiscards);
10932 					freemsg(first_mp);
10933 					return;
10934 				}
10935 				ip6h = (ip6_t *)mp->b_rptr;
10936 			}
10937 			insp = (uint16_t *)((uchar_t *)ip6h + cksum_request);
10938 			ASSERT(((uintptr_t)insp & 0x1) == 0);
10939 			up = (uint16_t *)&ip6h->ip6_src;
10940 			/*
10941 			 * icmp has placed length and routing
10942 			 * header adjustment in *insp.
10943 			 */
10944 			sum = htons(nexthdr) +
10945 			    up[0] + up[1] + up[2] + up[3] +
10946 			    up[4] + up[5] + up[6] + up[7] +
10947 			    up[8] + up[9] + up[10] + up[11] +
10948 			    up[12] + up[13] + up[14] + up[15];
10949 			sum = (sum & 0xffff) + (sum >> 16);
10950 			*insp = IP_CSUM(mp, hdr_length, sum);
10951 			if (*insp == 0)
10952 				*insp = 0xFFFF;
10953 		} else if (nexthdr == IPPROTO_TCP) {
10954 			uint16_t	*up;
10955 
10956 			/*
10957 			 * Check for full IPv6 header + enough TCP header
10958 			 * to get at the checksum field.
10959 			 */
10960 			if ((mp->b_wptr - mp->b_rptr) <
10961 			    (hdr_length + TCP_CHECKSUM_OFFSET +
10962 			    TCP_CHECKSUM_SIZE)) {
10963 				if (!pullupmsg(mp, hdr_length +
10964 				    TCP_CHECKSUM_OFFSET + TCP_CHECKSUM_SIZE)) {
10965 					ip1dbg(("ip_wput_v6: TCP hdr pullupmsg"
10966 					    " failed\n"));
10967 					BUMP_MIB(mibptr, ipv6OutDiscards);
10968 					freemsg(first_mp);
10969 					return;
10970 				}
10971 				ip6h = (ip6_t *)mp->b_rptr;
10972 			}
10973 
10974 			up = (uint16_t *)&ip6h->ip6_src;
10975 			/*
10976 			 * Note: The TCP module has stored the length value
10977 			 * into the tcp checksum field, so we don't
10978 			 * need to explicitly sum it in here.
10979 			 */
10980 			sum = up[0] + up[1] + up[2] + up[3] +
10981 			    up[4] + up[5] + up[6] + up[7] +
10982 			    up[8] + up[9] + up[10] + up[11] +
10983 			    up[12] + up[13] + up[14] + up[15];
10984 
10985 			/* Fold the initial sum */
10986 			sum = (sum & 0xffff) + (sum >> 16);
10987 
10988 			up = (uint16_t *)(((uchar_t *)ip6h) +
10989 			    hdr_length + TCP_CHECKSUM_OFFSET);
10990 
10991 			IP_CKSUM_XMIT(ill, ire, mp, ip6h, up, IPPROTO_TCP,
10992 			    hdr_length, ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN,
10993 			    ire->ire_max_frag, mctl_present, sum);
10994 
10995 			/* Software checksum? */
10996 			if (DB_CKSUMFLAGS(mp) == 0) {
10997 				IP6_STAT(ip6_out_sw_cksum);
10998 				IP6_STAT_UPDATE(ip6_tcp_out_sw_cksum_bytes,
10999 				    (ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN) -
11000 				    hdr_length);
11001 			}
11002 		} else if (nexthdr == IPPROTO_UDP) {
11003 			uint16_t	*up;
11004 
11005 			/*
11006 			 * check for full IPv6 header + enough UDP header
11007 			 * to get at the UDP checksum field
11008 			 */
11009 			if ((mp->b_wptr - mp->b_rptr) < (hdr_length +
11010 			    UDP_CHECKSUM_OFFSET + UDP_CHECKSUM_SIZE)) {
11011 				if (!pullupmsg(mp, hdr_length +
11012 				    UDP_CHECKSUM_OFFSET + UDP_CHECKSUM_SIZE)) {
11013 					ip1dbg(("ip_wput_v6: UDP hdr pullupmsg"
11014 					    " failed\n"));
11015 					BUMP_MIB(mibptr, ipv6OutDiscards);
11016 					freemsg(first_mp);
11017 					return;
11018 				}
11019 				ip6h = (ip6_t *)mp->b_rptr;
11020 			}
11021 			up = (uint16_t *)&ip6h->ip6_src;
11022 			/*
11023 			 * Note: The UDP module has stored the length value
11024 			 * into the udp checksum field, so we don't
11025 			 * need to explicitly sum it in here.
11026 			 */
11027 			sum = up[0] + up[1] + up[2] + up[3] +
11028 			    up[4] + up[5] + up[6] + up[7] +
11029 			    up[8] + up[9] + up[10] + up[11] +
11030 			    up[12] + up[13] + up[14] + up[15];
11031 
11032 			/* Fold the initial sum */
11033 			sum = (sum & 0xffff) + (sum >> 16);
11034 
11035 			up = (uint16_t *)(((uchar_t *)ip6h) +
11036 			    hdr_length + UDP_CHECKSUM_OFFSET);
11037 
11038 			IP_CKSUM_XMIT(ill, ire, mp, ip6h, up, IPPROTO_UDP,
11039 			    hdr_length, ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN,
11040 			    ire->ire_max_frag, mctl_present, sum);
11041 
11042 			/* Software checksum? */
11043 			if (DB_CKSUMFLAGS(mp) == 0) {
11044 				IP6_STAT(ip6_out_sw_cksum);
11045 				IP6_STAT_UPDATE(ip6_udp_out_sw_cksum_bytes,
11046 				    (ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN) -
11047 				    hdr_length);
11048 			}
11049 		} else if (nexthdr == IPPROTO_ICMPV6) {
11050 			uint16_t	*up;
11051 			icmp6_t *icmp6;
11052 
11053 			/* check for full IPv6+ICMPv6 header */
11054 			if ((mp->b_wptr - mp->b_rptr) <
11055 			    (hdr_length + ICMP6_MINLEN)) {
11056 				if (!pullupmsg(mp, hdr_length + ICMP6_MINLEN)) {
11057 					ip1dbg(("ip_wput_v6: ICMP hdr pullupmsg"
11058 					    " failed\n"));
11059 					BUMP_MIB(mibptr, ipv6OutDiscards);
11060 					freemsg(first_mp);
11061 					return;
11062 				}
11063 				ip6h = (ip6_t *)mp->b_rptr;
11064 			}
11065 			icmp6 = (icmp6_t *)((uchar_t *)ip6h + hdr_length);
11066 			up = (uint16_t *)&ip6h->ip6_src;
11067 			/*
11068 			 * icmp has placed length and routing
11069 			 * header adjustment in icmp6_cksum.
11070 			 */
11071 			sum = htons(IPPROTO_ICMPV6) +
11072 			    up[0] + up[1] + up[2] + up[3] +
11073 			    up[4] + up[5] + up[6] + up[7] +
11074 			    up[8] + up[9] + up[10] + up[11] +
11075 			    up[12] + up[13] + up[14] + up[15];
11076 			sum = (sum & 0xffff) + (sum >> 16);
11077 			icmp6->icmp6_cksum = IP_CSUM(mp, hdr_length, sum);
11078 			if (icmp6->icmp6_cksum == 0)
11079 				icmp6->icmp6_cksum = 0xFFFF;
11080 
11081 			/* Update output mib stats */
11082 			icmp_update_out_mib_v6(ill, icmp6);
11083 		} else if (nexthdr == IPPROTO_SCTP) {
11084 			sctp_hdr_t *sctph;
11085 
11086 			if (MBLKL(mp) < (hdr_length + sizeof (*sctph))) {
11087 				if (!pullupmsg(mp, hdr_length +
11088 				    sizeof (*sctph))) {
11089 					ip1dbg(("ip_wput_v6: SCTP hdr pullupmsg"
11090 					    " failed\n"));
11091 					BUMP_MIB(ill->ill_ip6_mib,
11092 					    ipv6OutDiscards);
11093 					freemsg(mp);
11094 					return;
11095 				}
11096 				ip6h = (ip6_t *)mp->b_rptr;
11097 			}
11098 			sctph = (sctp_hdr_t *)(mp->b_rptr + hdr_length);
11099 			sctph->sh_chksum = 0;
11100 			sctph->sh_chksum = sctp_cksum(mp, hdr_length);
11101 		}
11102 
11103 	cksum_done:
11104 		/*
11105 		 * We force the insertion of a fragment header using the
11106 		 * IPH_FRAG_HDR flag in two cases:
11107 		 * - after reception of an ICMPv6 "packet too big" message
11108 		 *   with a MTU < 1280 (cf. RFC 2460 section 5)
11109 		 * - for multirouted IPv6 packets, so that the receiver can
11110 		 *   discard duplicates according to their fragment identifier
11111 		 *
11112 		 * Two flags modifed from the API can modify this behavior.
11113 		 * The first is IPV6_USE_MIN_MTU.  With this API the user
11114 		 * can specify how to manage PMTUD for unicast and multicast.
11115 		 *
11116 		 * IPV6_DONTFRAG disallows fragmentation.
11117 		 */
11118 		max_frag = ire->ire_max_frag;
11119 		switch (IP6I_USE_MIN_MTU_API(flags)) {
11120 		case IPV6_USE_MIN_MTU_DEFAULT:
11121 		case IPV6_USE_MIN_MTU_UNICAST:
11122 			if (IN6_IS_ADDR_MULTICAST(&ip6h->ip6_dst)) {
11123 				max_frag = IPV6_MIN_MTU;
11124 			}
11125 			break;
11126 
11127 		case IPV6_USE_MIN_MTU_NEVER:
11128 			max_frag = IPV6_MIN_MTU;
11129 			break;
11130 		}
11131 		if (ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN > max_frag ||
11132 		    (ire->ire_frag_flag & IPH_FRAG_HDR)) {
11133 			if (connp != NULL && (flags & IP6I_DONTFRAG)) {
11134 				icmp_pkt2big_v6(ire->ire_stq, first_mp,
11135 				    max_frag, B_FALSE, B_TRUE);
11136 				return;
11137 			}
11138 
11139 			if (ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN !=
11140 			    (mp->b_cont ? msgdsize(mp) :
11141 			    mp->b_wptr - (uchar_t *)ip6h)) {
11142 				ip0dbg(("Packet length mismatch: %d, %ld\n",
11143 				    ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN,
11144 				    msgdsize(mp)));
11145 				freemsg(first_mp);
11146 				return;
11147 			}
11148 			/* Do IPSEC processing first */
11149 			if (mctl_present) {
11150 				if (attach_index != 0)
11151 					ipsec_out_attach_if(io, attach_index);
11152 				ipsec_out_process(q, first_mp, ire, ill_index);
11153 				return;
11154 			}
11155 			ASSERT(mp->b_prev == NULL);
11156 			ip2dbg(("Fragmenting Size = %d, mtu = %d\n",
11157 			    ntohs(ip6h->ip6_plen) +
11158 			    IPV6_HDR_LEN, max_frag));
11159 			ASSERT(mp == first_mp);
11160 			/* Initiate IPPF processing */
11161 			if (IPP_ENABLED(IPP_LOCAL_OUT)) {
11162 				ip_process(IPP_LOCAL_OUT, &mp, ill_index);
11163 				if (mp == NULL) {
11164 					return;
11165 				}
11166 			}
11167 			ip_wput_frag_v6(mp, ire, reachable, connp,
11168 			    caller, max_frag);
11169 			return;
11170 		}
11171 		/* Do IPSEC processing first */
11172 		if (mctl_present) {
11173 			int extra_len = ipsec_out_extra_length(first_mp);
11174 
11175 			if (ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN + extra_len >
11176 			    max_frag && ip_ulp_cando_pkt2big(nexthdr)) {
11177 				/*
11178 				 * IPsec headers will push the packet over the
11179 				 * MTU limit.  Issue an ICMPv6 Packet Too Big
11180 				 * message for this packet if the upper-layer
11181 				 * that issued this packet will be able to
11182 				 * react to the icmp_pkt2big_v6() that we'll
11183 				 * generate.
11184 				 */
11185 				icmp_pkt2big_v6(ire->ire_stq, first_mp,
11186 				    max_frag, B_FALSE, B_TRUE);
11187 				return;
11188 			}
11189 			if (attach_index != 0)
11190 				ipsec_out_attach_if(io, attach_index);
11191 			ipsec_out_process(q, first_mp, ire, ill_index);
11192 			return;
11193 		}
11194 		/*
11195 		 * XXX multicast: add ip_mforward_v6() here.
11196 		 * Check conn_dontroute
11197 		 */
11198 #ifdef lint
11199 		/*
11200 		 * XXX The only purpose of this statement is to avoid lint
11201 		 * errors.  See the above "XXX multicast".  When that gets
11202 		 * fixed, remove this whole #ifdef lint section.
11203 		 */
11204 		ip3dbg(("multicast forward is %s.\n",
11205 		    (multicast_forward ? "TRUE" : "FALSE")));
11206 #endif
11207 
11208 		UPDATE_OB_PKT_COUNT(ire);
11209 		ire->ire_last_used_time = lbolt;
11210 		ASSERT(mp == first_mp);
11211 		ip_xmit_v6(mp, ire, reachable, connp, caller, NULL);
11212 	} else {
11213 		ip_wput_local_v6(RD(q), ill, ip6h, first_mp, ire, 0);
11214 	}
11215 }
11216 
11217 /*
11218  * Outbound IPv6 fragmentation routine using MDT.
11219  */
11220 static void
11221 ip_wput_frag_mdt_v6(mblk_t *mp, ire_t *ire, size_t max_chunk,
11222     size_t unfragmentable_len, uint8_t nexthdr, uint_t prev_nexthdr_offset)
11223 {
11224 	ip6_t		*ip6h = (ip6_t *)mp->b_rptr;
11225 	uint_t		pkts, wroff, hdr_chunk_len, pbuf_idx;
11226 	mblk_t		*hdr_mp, *md_mp = NULL;
11227 	int		i1;
11228 	multidata_t	*mmd;
11229 	unsigned char	*hdr_ptr, *pld_ptr;
11230 	ip_pdescinfo_t	pdi;
11231 	uint32_t	ident;
11232 	size_t		len;
11233 	uint16_t	offset;
11234 	queue_t		*stq = ire->ire_stq;
11235 	ill_t		*ill = (ill_t *)stq->q_ptr;
11236 
11237 	ASSERT(DB_TYPE(mp) == M_DATA);
11238 	ASSERT(MBLKL(mp) > unfragmentable_len);
11239 
11240 	/*
11241 	 * Move read ptr past unfragmentable portion, we don't want this part
11242 	 * of the data in our fragments.
11243 	 */
11244 	mp->b_rptr += unfragmentable_len;
11245 
11246 	/* Calculate how many packets we will send out  */
11247 	i1 = (mp->b_cont == NULL) ? MBLKL(mp) : msgsize(mp);
11248 	pkts = (i1 + max_chunk - 1) / max_chunk;
11249 	ASSERT(pkts > 1);
11250 
11251 	/* Allocate a message block which will hold all the IP Headers. */
11252 	wroff = ip_wroff_extra;
11253 	hdr_chunk_len = wroff + unfragmentable_len + sizeof (ip6_frag_t);
11254 
11255 	i1 = pkts * hdr_chunk_len;
11256 	/*
11257 	 * Create the header buffer, Multidata and destination address
11258 	 * and SAP attribute that should be associated with it.
11259 	 */
11260 	if ((hdr_mp = allocb(i1, BPRI_HI)) == NULL ||
11261 	    ((hdr_mp->b_wptr += i1),
11262 	    (mmd = mmd_alloc(hdr_mp, &md_mp, KM_NOSLEEP)) == NULL) ||
11263 	    !ip_md_addr_attr(mmd, NULL, ire->ire_nce->nce_res_mp)) {
11264 		freemsg(mp);
11265 		if (md_mp == NULL) {
11266 			freemsg(hdr_mp);
11267 		} else {
11268 free_mmd:		IP6_STAT(ip6_frag_mdt_discarded);
11269 			freemsg(md_mp);
11270 		}
11271 		IP6_STAT(ip6_frag_mdt_allocfail);
11272 		BUMP_MIB(ill->ill_ip6_mib, ipv6OutFragFails);
11273 		UPDATE_MIB(ill->ill_ip6_mib, ipv6OutDiscards, pkts);
11274 		return;
11275 	}
11276 	IP6_STAT(ip6_frag_mdt_allocd);
11277 
11278 	/*
11279 	 * Add a payload buffer to the Multidata; this operation must not
11280 	 * fail, or otherwise our logic in this routine is broken.  There
11281 	 * is no memory allocation done by the routine, so any returned
11282 	 * failure simply tells us that we've done something wrong.
11283 	 *
11284 	 * A failure tells us that either we're adding the same payload
11285 	 * buffer more than once, or we're trying to add more buffers than
11286 	 * allowed.  None of the above cases should happen, and we panic
11287 	 * because either there's horrible heap corruption, and/or
11288 	 * programming mistake.
11289 	 */
11290 	if ((pbuf_idx = mmd_addpldbuf(mmd, mp)) < 0) {
11291 		goto pbuf_panic;
11292 	}
11293 
11294 	hdr_ptr = hdr_mp->b_rptr;
11295 	pld_ptr = mp->b_rptr;
11296 
11297 	pdi.flags = PDESC_HBUF_REF | PDESC_PBUF_REF;
11298 
11299 	ident = htonl(atomic_add_32_nv(&ire->ire_ident, 1));
11300 
11301 	/*
11302 	 * len is the total length of the fragmentable data in this
11303 	 * datagram.  For each fragment sent, we will decrement len
11304 	 * by the amount of fragmentable data sent in that fragment
11305 	 * until len reaches zero.
11306 	 */
11307 	len = ntohs(ip6h->ip6_plen) - (unfragmentable_len - IPV6_HDR_LEN);
11308 
11309 	offset = 0;
11310 	prev_nexthdr_offset += wroff;
11311 
11312 	while (len != 0) {
11313 		size_t		mlen;
11314 		ip6_t		*fip6h;
11315 		ip6_frag_t	*fraghdr;
11316 		int		error;
11317 
11318 		ASSERT((hdr_ptr + hdr_chunk_len) <= hdr_mp->b_wptr);
11319 		mlen = MIN(len, max_chunk);
11320 		len -= mlen;
11321 
11322 		fip6h = (ip6_t *)(hdr_ptr + wroff);
11323 		ASSERT(OK_32PTR(fip6h));
11324 		bcopy(ip6h, fip6h, unfragmentable_len);
11325 		hdr_ptr[prev_nexthdr_offset] = IPPROTO_FRAGMENT;
11326 
11327 		fip6h->ip6_plen = htons((uint16_t)(mlen +
11328 		    unfragmentable_len - IPV6_HDR_LEN + sizeof (ip6_frag_t)));
11329 
11330 		fraghdr = (ip6_frag_t *)((unsigned char *)fip6h +
11331 		    unfragmentable_len);
11332 		fraghdr->ip6f_nxt = nexthdr;
11333 		fraghdr->ip6f_reserved = 0;
11334 		fraghdr->ip6f_offlg = htons(offset) |
11335 		    ((len != 0) ? IP6F_MORE_FRAG : 0);
11336 		fraghdr->ip6f_ident = ident;
11337 
11338 		/*
11339 		 * Record offset and size of header and data of the next packet
11340 		 * in the multidata message.
11341 		 */
11342 		PDESC_HDR_ADD(&pdi, hdr_ptr, wroff,
11343 		    unfragmentable_len + sizeof (ip6_frag_t), 0);
11344 		PDESC_PLD_INIT(&pdi);
11345 		i1 = MIN(mp->b_wptr - pld_ptr, mlen);
11346 		ASSERT(i1 > 0);
11347 		PDESC_PLD_SPAN_ADD(&pdi, pbuf_idx, pld_ptr, i1);
11348 		if (i1 == mlen) {
11349 			pld_ptr += mlen;
11350 		} else {
11351 			i1 = mlen - i1;
11352 			mp = mp->b_cont;
11353 			ASSERT(mp != NULL);
11354 			ASSERT(MBLKL(mp) >= i1);
11355 			/*
11356 			 * Attach the next payload message block to the
11357 			 * multidata message.
11358 			 */
11359 			if ((pbuf_idx = mmd_addpldbuf(mmd, mp)) < 0)
11360 				goto pbuf_panic;
11361 			PDESC_PLD_SPAN_ADD(&pdi, pbuf_idx, mp->b_rptr, i1);
11362 			pld_ptr = mp->b_rptr + i1;
11363 		}
11364 
11365 		if ((mmd_addpdesc(mmd, (pdescinfo_t *)&pdi, &error,
11366 		    KM_NOSLEEP)) == NULL) {
11367 			/*
11368 			 * Any failure other than ENOMEM indicates that we
11369 			 * have passed in invalid pdesc info or parameters
11370 			 * to mmd_addpdesc, which must not happen.
11371 			 *
11372 			 * EINVAL is a result of failure on boundary checks
11373 			 * against the pdesc info contents.  It should not
11374 			 * happen, and we panic because either there's
11375 			 * horrible heap corruption, and/or programming
11376 			 * mistake.
11377 			 */
11378 			if (error != ENOMEM) {
11379 				cmn_err(CE_PANIC, "ip_wput_frag_mdt_v6: "
11380 				    "pdesc logic error detected for "
11381 				    "mmd %p pinfo %p (%d)\n",
11382 				    (void *)mmd, (void *)&pdi, error);
11383 				/* NOTREACHED */
11384 			}
11385 			IP6_STAT(ip6_frag_mdt_addpdescfail);
11386 			/* Free unattached payload message blocks as well */
11387 			md_mp->b_cont = mp->b_cont;
11388 			goto free_mmd;
11389 		}
11390 
11391 		/* Advance fragment offset. */
11392 		offset += mlen;
11393 
11394 		/* Advance to location for next header in the buffer. */
11395 		hdr_ptr += hdr_chunk_len;
11396 
11397 		/* Did we reach the next payload message block? */
11398 		if (pld_ptr == mp->b_wptr && mp->b_cont != NULL) {
11399 			mp = mp->b_cont;
11400 			/*
11401 			 * Attach the next message block with payload
11402 			 * data to the multidata message.
11403 			 */
11404 			if ((pbuf_idx = mmd_addpldbuf(mmd, mp)) < 0)
11405 				goto pbuf_panic;
11406 			pld_ptr = mp->b_rptr;
11407 		}
11408 	}
11409 
11410 	ASSERT(hdr_mp->b_wptr == hdr_ptr);
11411 	ASSERT(mp->b_wptr == pld_ptr);
11412 
11413 	/* Update IP statistics */
11414 	UPDATE_MIB(ill->ill_ip6_mib, ipv6OutFragCreates, pkts);
11415 	BUMP_MIB(ill->ill_ip6_mib, ipv6OutFragOKs);
11416 	IP6_STAT_UPDATE(ip6_frag_mdt_pkt_out, pkts);
11417 
11418 	ire->ire_ob_pkt_count += pkts;
11419 	if (ire->ire_ipif != NULL)
11420 		atomic_add_32(&ire->ire_ipif->ipif_ob_pkt_count, pkts);
11421 
11422 	ire->ire_last_used_time = lbolt;
11423 	/* Send it down */
11424 	putnext(stq, md_mp);
11425 	return;
11426 
11427 pbuf_panic:
11428 	cmn_err(CE_PANIC, "ip_wput_frag_mdt_v6: payload buffer logic "
11429 	    "error for mmd %p pbuf %p (%d)", (void *)mmd, (void *)mp,
11430 	    pbuf_idx);
11431 	/* NOTREACHED */
11432 }
11433 
11434 /*
11435  * IPv6 fragmentation.  Essentially the same as IPv4 fragmentation.
11436  * We have not optimized this in terms of number of mblks
11437  * allocated. For instance, for each fragment sent we always allocate a
11438  * mblk to hold the IPv6 header and fragment header.
11439  *
11440  * Assumes that all the extension headers are contained in the first mblk.
11441  *
11442  * The fragment header is inserted after an hop-by-hop options header
11443  * and after [an optional destinations header followed by] a routing header.
11444  *
11445  * NOTE : This function does not ire_refrele the ire passed in as
11446  * the argument.
11447  */
11448 void
11449 ip_wput_frag_v6(mblk_t *mp, ire_t *ire, uint_t reachable, conn_t *connp,
11450     int caller, int max_frag)
11451 {
11452 	ip6_t		*ip6h = (ip6_t *)mp->b_rptr;
11453 	ip6_t		*fip6h;
11454 	mblk_t		*hmp;
11455 	mblk_t		*hmp0;
11456 	mblk_t		*dmp;
11457 	ip6_frag_t	*fraghdr;
11458 	size_t		unfragmentable_len;
11459 	size_t		len;
11460 	size_t		mlen;
11461 	size_t		max_chunk;
11462 	uint32_t	ident;
11463 	uint16_t	off_flags;
11464 	uint16_t	offset = 0;
11465 	ill_t		*ill;
11466 	uint8_t		nexthdr;
11467 	uint_t		prev_nexthdr_offset;
11468 	uint8_t		*ptr;
11469 
11470 	ASSERT(ire->ire_type == IRE_CACHE);
11471 	ill = (ill_t *)ire->ire_stq->q_ptr;
11472 
11473 	/*
11474 	 * Determine the length of the unfragmentable portion of this
11475 	 * datagram.  This consists of the IPv6 header, a potential
11476 	 * hop-by-hop options header, a potential pre-routing-header
11477 	 * destination options header, and a potential routing header.
11478 	 */
11479 	nexthdr = ip6h->ip6_nxt;
11480 	prev_nexthdr_offset = (uint8_t *)&ip6h->ip6_nxt - (uint8_t *)ip6h;
11481 	ptr = (uint8_t *)&ip6h[1];
11482 
11483 	if (nexthdr == IPPROTO_HOPOPTS) {
11484 		ip6_hbh_t	*hbh_hdr;
11485 		uint_t		hdr_len;
11486 
11487 		hbh_hdr = (ip6_hbh_t *)ptr;
11488 		hdr_len = 8 * (hbh_hdr->ip6h_len + 1);
11489 		nexthdr = hbh_hdr->ip6h_nxt;
11490 		prev_nexthdr_offset = (uint8_t *)&hbh_hdr->ip6h_nxt
11491 		    - (uint8_t *)ip6h;
11492 		ptr += hdr_len;
11493 	}
11494 	if (nexthdr == IPPROTO_DSTOPTS) {
11495 		ip6_dest_t	*dest_hdr;
11496 		uint_t		hdr_len;
11497 
11498 		dest_hdr = (ip6_dest_t *)ptr;
11499 		if (dest_hdr->ip6d_nxt == IPPROTO_ROUTING) {
11500 			hdr_len = 8 * (dest_hdr->ip6d_len + 1);
11501 			nexthdr = dest_hdr->ip6d_nxt;
11502 			prev_nexthdr_offset = (uint8_t *)&dest_hdr->ip6d_nxt
11503 			    - (uint8_t *)ip6h;
11504 			ptr += hdr_len;
11505 		}
11506 	}
11507 	if (nexthdr == IPPROTO_ROUTING) {
11508 		ip6_rthdr_t	*rthdr;
11509 		uint_t		hdr_len;
11510 
11511 		rthdr = (ip6_rthdr_t *)ptr;
11512 		nexthdr = rthdr->ip6r_nxt;
11513 		prev_nexthdr_offset = (uint8_t *)&rthdr->ip6r_nxt
11514 		    - (uint8_t *)ip6h;
11515 		hdr_len = 8 * (rthdr->ip6r_len + 1);
11516 		ptr += hdr_len;
11517 	}
11518 	unfragmentable_len = (uint_t)(ptr - (uint8_t *)ip6h);
11519 
11520 	max_chunk = (min(max_frag, ire->ire_max_frag) - unfragmentable_len -
11521 	    sizeof (ip6_frag_t)) & ~7;
11522 
11523 	/* Check if we can use MDT to send out the frags. */
11524 	ASSERT(!IRE_IS_LOCAL(ire));
11525 	if (ip_multidata_outbound && reachable == 0 &&
11526 	    !(ire->ire_flags & RTF_MULTIRT) && ILL_MDT_CAPABLE(ill) &&
11527 	    IP_CAN_FRAG_MDT(mp, unfragmentable_len, max_chunk)) {
11528 		ip_wput_frag_mdt_v6(mp, ire, max_chunk, unfragmentable_len,
11529 		    nexthdr, prev_nexthdr_offset);
11530 		return;
11531 	}
11532 
11533 	/*
11534 	 * Allocate an mblk with enough room for the link-layer
11535 	 * header, the unfragmentable part of the datagram, and the
11536 	 * fragment header.  This (or a copy) will be used as the
11537 	 * first mblk for each fragment we send.
11538 	 */
11539 	hmp = allocb(unfragmentable_len + sizeof (ip6_frag_t) + ip_wroff_extra,
11540 	    BPRI_HI);
11541 	if (hmp == NULL) {
11542 		BUMP_MIB(ill->ill_ip6_mib, ipv6OutFragFails);
11543 		freemsg(mp);
11544 		return;
11545 	}
11546 	hmp->b_rptr += ip_wroff_extra;
11547 	hmp->b_wptr = hmp->b_rptr + unfragmentable_len + sizeof (ip6_frag_t);
11548 
11549 	fip6h = (ip6_t *)hmp->b_rptr;
11550 	fraghdr = (ip6_frag_t *)(hmp->b_rptr + unfragmentable_len);
11551 
11552 	bcopy(ip6h, fip6h, unfragmentable_len);
11553 	hmp->b_rptr[prev_nexthdr_offset] = IPPROTO_FRAGMENT;
11554 
11555 	ident = atomic_add_32_nv(&ire->ire_ident, 1);
11556 
11557 	fraghdr->ip6f_nxt = nexthdr;
11558 	fraghdr->ip6f_reserved = 0;
11559 	fraghdr->ip6f_offlg = 0;
11560 	fraghdr->ip6f_ident = htonl(ident);
11561 
11562 	/*
11563 	 * len is the total length of the fragmentable data in this
11564 	 * datagram.  For each fragment sent, we will decrement len
11565 	 * by the amount of fragmentable data sent in that fragment
11566 	 * until len reaches zero.
11567 	 */
11568 	len = ntohs(ip6h->ip6_plen) - (unfragmentable_len - IPV6_HDR_LEN);
11569 
11570 	/*
11571 	 * Move read ptr past unfragmentable portion, we don't want this part
11572 	 * of the data in our fragments.
11573 	 */
11574 	mp->b_rptr += unfragmentable_len;
11575 
11576 	while (len != 0) {
11577 		mlen = MIN(len, max_chunk);
11578 		len -= mlen;
11579 		if (len != 0) {
11580 			/* Not last */
11581 			hmp0 = copyb(hmp);
11582 			if (hmp0 == NULL) {
11583 				freeb(hmp);
11584 				freemsg(mp);
11585 				BUMP_MIB(ill->ill_ip6_mib, ipv6OutFragFails);
11586 				ip1dbg(("ip_wput_frag_v6: copyb failed\n"));
11587 				return;
11588 			}
11589 			off_flags = IP6F_MORE_FRAG;
11590 		} else {
11591 			/* Last fragment */
11592 			hmp0 = hmp;
11593 			hmp = NULL;
11594 			off_flags = 0;
11595 		}
11596 		fip6h = (ip6_t *)(hmp0->b_rptr);
11597 		fraghdr = (ip6_frag_t *)(hmp0->b_rptr + unfragmentable_len);
11598 
11599 		fip6h->ip6_plen = htons((uint16_t)(mlen +
11600 		    unfragmentable_len - IPV6_HDR_LEN + sizeof (ip6_frag_t)));
11601 		/*
11602 		 * Note: Optimization alert.
11603 		 * In IPv6 (and IPv4) protocol header, Fragment Offset
11604 		 * ("offset") is 13 bits wide and in 8-octet units.
11605 		 * In IPv6 protocol header (unlike IPv4) in a 16 bit field,
11606 		 * it occupies the most significant 13 bits.
11607 		 * (least significant 13 bits in IPv4).
11608 		 * We do not do any shifts here. Not shifting is same effect
11609 		 * as taking offset value in octet units, dividing by 8 and
11610 		 * then shifting 3 bits left to line it up in place in proper
11611 		 * place protocol header.
11612 		 */
11613 		fraghdr->ip6f_offlg = htons(offset) | off_flags;
11614 
11615 		if (!(dmp = ip_carve_mp(&mp, mlen))) {
11616 			/* mp has already been freed by ip_carve_mp() */
11617 			if (hmp != NULL)
11618 				freeb(hmp);
11619 			freeb(hmp0);
11620 			ip1dbg(("ip_carve_mp: failed\n"));
11621 			BUMP_MIB(ill->ill_ip6_mib, ipv6OutFragFails);
11622 			return;
11623 		}
11624 		hmp0->b_cont = dmp;
11625 		/* Get the priority marking, if any */
11626 		hmp0->b_band = dmp->b_band;
11627 		UPDATE_OB_PKT_COUNT(ire);
11628 		ire->ire_last_used_time = lbolt;
11629 		ip_xmit_v6(hmp0, ire, reachable | IP6_NO_IPPOLICY, connp,
11630 		    caller, NULL);
11631 		reachable = 0;	/* No need to redo state machine in loop */
11632 		BUMP_MIB(ill->ill_ip6_mib, ipv6OutFragCreates);
11633 		offset += mlen;
11634 	}
11635 	BUMP_MIB(ill->ill_ip6_mib, ipv6OutFragOKs);
11636 }
11637 
11638 /*
11639  * Determine if the ill and multicast aspects of that packets
11640  * "matches" the conn.
11641  */
11642 boolean_t
11643 conn_wantpacket_v6(conn_t *connp, ill_t *ill, ip6_t *ip6h, int fanout_flags,
11644     zoneid_t zoneid)
11645 {
11646 	ill_t *in_ill;
11647 	boolean_t wantpacket = B_TRUE;
11648 	in6_addr_t *v6dst_ptr = &ip6h->ip6_dst;
11649 	in6_addr_t *v6src_ptr = &ip6h->ip6_src;
11650 
11651 	/*
11652 	 * conn_incoming_ill is set by IPV6_BOUND_IF which limits
11653 	 * unicast and multicast reception to conn_incoming_ill.
11654 	 * conn_wantpacket_v6 is called both for unicast and
11655 	 * multicast.
11656 	 *
11657 	 * 1) The unicast copy of the packet can come anywhere in
11658 	 *    the ill group if it is part of the group. Thus, we
11659 	 *    need to check to see whether the ill group matches
11660 	 *    if in_ill is part of a group.
11661 	 *
11662 	 * 2) ip_rput does not suppress duplicate multicast packets.
11663 	 *    If there are two interfaces in a ill group and we have
11664 	 *    2 applications (conns) joined a multicast group G on
11665 	 *    both the interfaces, ilm_lookup_ill filter in ip_rput
11666 	 *    will give us two packets because we join G on both the
11667 	 *    interfaces rather than nominating just one interface
11668 	 *    for receiving multicast like broadcast above. So,
11669 	 *    we have to call ilg_lookup_ill to filter out duplicate
11670 	 *    copies, if ill is part of a group, to supress duplicates.
11671 	 */
11672 	in_ill = connp->conn_incoming_ill;
11673 	if (in_ill != NULL) {
11674 		mutex_enter(&connp->conn_lock);
11675 		in_ill = connp->conn_incoming_ill;
11676 		mutex_enter(&ill->ill_lock);
11677 		/*
11678 		 * No IPMP, and the packet did not arrive on conn_incoming_ill
11679 		 * OR, IPMP in use and the packet arrived on an IPMP group
11680 		 * different from the conn_incoming_ill's IPMP group.
11681 		 * Reject the packet.
11682 		 */
11683 		if ((in_ill->ill_group == NULL && in_ill != ill) ||
11684 		    (in_ill->ill_group != NULL &&
11685 		    in_ill->ill_group !=  ill->ill_group)) {
11686 			wantpacket = B_FALSE;
11687 		}
11688 		mutex_exit(&ill->ill_lock);
11689 		mutex_exit(&connp->conn_lock);
11690 		if (!wantpacket)
11691 			return (B_FALSE);
11692 	}
11693 
11694 	if (connp->conn_multi_router)
11695 		return (B_TRUE);
11696 
11697 	if (!IN6_IS_ADDR_MULTICAST(v6dst_ptr) &&
11698 	    !IN6_IS_ADDR_V4MAPPED_CLASSD(v6dst_ptr)) {
11699 		/*
11700 		 * Unicast case: we match the conn only if it's in the specified
11701 		 * zone.
11702 		 */
11703 		return (connp->conn_zoneid == zoneid || zoneid == ALL_ZONES);
11704 	}
11705 
11706 	if ((fanout_flags & IP_FF_NO_MCAST_LOOP) &&
11707 	    (connp->conn_zoneid == zoneid || zoneid == ALL_ZONES)) {
11708 		/*
11709 		 * Loopback case: the sending endpoint has IP_MULTICAST_LOOP
11710 		 * disabled, therefore we don't dispatch the multicast packet to
11711 		 * the sending zone.
11712 		 */
11713 		return (B_FALSE);
11714 	}
11715 
11716 	if ((ill->ill_phyint->phyint_flags & PHYI_LOOPBACK) &&
11717 	    connp->conn_zoneid != zoneid && zoneid != ALL_ZONES) {
11718 		/*
11719 		 * Multicast packet on the loopback interface: we only match
11720 		 * conns who joined the group in the specified zone.
11721 		 */
11722 		return (B_FALSE);
11723 	}
11724 
11725 	mutex_enter(&connp->conn_lock);
11726 	wantpacket =
11727 	    ilg_lookup_ill_withsrc_v6(connp, v6dst_ptr, v6src_ptr, ill) != NULL;
11728 	mutex_exit(&connp->conn_lock);
11729 
11730 	return (wantpacket);
11731 }
11732 
11733 
11734 /*
11735  * Transmit a packet and update any NUD state based on the flags
11736  * XXX need to "recover" any ip6i_t when doing putq!
11737  *
11738  * NOTE : This function does not ire_refrele the ire passed in as the
11739  * argument.
11740  */
11741 void
11742 ip_xmit_v6(mblk_t *mp, ire_t *ire, uint_t flags, conn_t *connp,
11743     int caller, ipsec_out_t *io)
11744 {
11745 	mblk_t		*mp1;
11746 	nce_t		*nce = ire->ire_nce;
11747 	ill_t		*ill;
11748 	uint64_t	delta;
11749 	ip6_t		*ip6h;
11750 	queue_t		*stq = ire->ire_stq;
11751 	ire_t		*ire1 = NULL;
11752 	ire_t		*save_ire = ire;
11753 	boolean_t	multirt_send = B_FALSE;
11754 	mblk_t		*next_mp = NULL;
11755 
11756 	ip6h = (ip6_t *)mp->b_rptr;
11757 	ASSERT(!IN6_IS_ADDR_V4MAPPED(&ire->ire_addr_v6));
11758 	ASSERT(ire->ire_ipversion == IPV6_VERSION);
11759 	ASSERT(nce != NULL);
11760 	ASSERT(mp->b_datap->db_type == M_DATA);
11761 	ASSERT(stq != NULL);
11762 
11763 	ill = ire_to_ill(ire);
11764 	if (!ill) {
11765 		ip0dbg(("ip_xmit_v6: ire_to_ill failed\n"));
11766 		freemsg(mp);
11767 		return;
11768 	}
11769 
11770 	/*
11771 	 * If a packet is to be sent out an interface that is a 6to4
11772 	 * tunnel, outgoing IPv6 packets, with a 6to4 addressed IPv6
11773 	 * destination, must be checked to have a 6to4 prefix
11774 	 * (2002:V4ADDR::/48) that is NOT equal to the 6to4 prefix of
11775 	 * address configured on the sending interface.  Otherwise,
11776 	 * the packet was delivered to this interface in error and the
11777 	 * packet must be dropped.
11778 	 */
11779 	if ((ill->ill_is_6to4tun) && IN6_IS_ADDR_6TO4(&ip6h->ip6_dst)) {
11780 		ipif_t *ipif = ill->ill_ipif;
11781 
11782 		if (IN6_ARE_6TO4_PREFIX_EQUAL(&ipif->ipif_v6lcl_addr,
11783 		    &ip6h->ip6_dst)) {
11784 			if (ip_debug > 2) {
11785 				/* ip1dbg */
11786 				pr_addr_dbg("ip_xmit_v6: attempting to "
11787 				    "send 6to4 addressed IPv6 "
11788 				    "destination (%s) out the wrong "
11789 				    "interface.\n", AF_INET6,
11790 				    &ip6h->ip6_dst);
11791 			}
11792 			BUMP_MIB(ill->ill_ip6_mib, ipv6OutDiscards);
11793 			freemsg(mp);
11794 			return;
11795 		}
11796 	}
11797 
11798 	/* Flow-control check has been done in ip_wput_ire_v6 */
11799 	if (IP_FLOW_CONTROLLED_ULP(ip6h->ip6_nxt) || caller == IP_WPUT ||
11800 	    caller == IP_WSRV || canput(stq->q_next)) {
11801 		uint32_t ill_index;
11802 
11803 		/*
11804 		 * In most cases, the emission loop below is entered only
11805 		 * once. Only in the case where the ire holds the
11806 		 * RTF_MULTIRT flag, do we loop to process all RTF_MULTIRT
11807 		 * flagged ires in the bucket, and send the packet
11808 		 * through all crossed RTF_MULTIRT routes.
11809 		 */
11810 		if (ire->ire_flags & RTF_MULTIRT) {
11811 			/*
11812 			 * Multirouting case. The bucket where ire is stored
11813 			 * probably holds other RTF_MULTIRT flagged ires
11814 			 * to the destination. In this call to ip_xmit_v6,
11815 			 * we attempt to send the packet through all
11816 			 * those ires. Thus, we first ensure that ire is the
11817 			 * first RTF_MULTIRT ire in the bucket,
11818 			 * before walking the ire list.
11819 			 */
11820 			ire_t *first_ire;
11821 			irb_t *irb = ire->ire_bucket;
11822 			ASSERT(irb != NULL);
11823 			multirt_send = B_TRUE;
11824 
11825 			/* Make sure we do not omit any multiroute ire. */
11826 			IRB_REFHOLD(irb);
11827 			for (first_ire = irb->irb_ire;
11828 			    first_ire != NULL;
11829 			    first_ire = first_ire->ire_next) {
11830 				if ((first_ire->ire_flags & RTF_MULTIRT) &&
11831 				    (IN6_ARE_ADDR_EQUAL(&first_ire->ire_addr_v6,
11832 				    &ire->ire_addr_v6)) &&
11833 				    !(first_ire->ire_marks &
11834 					(IRE_MARK_CONDEMNED | IRE_MARK_HIDDEN)))
11835 					break;
11836 			}
11837 
11838 			if ((first_ire != NULL) && (first_ire != ire)) {
11839 				IRE_REFHOLD(first_ire);
11840 				/* ire will be released by the caller */
11841 				ire = first_ire;
11842 				nce = ire->ire_nce;
11843 				stq = ire->ire_stq;
11844 				ill = ire_to_ill(ire);
11845 			}
11846 			IRB_REFRELE(irb);
11847 		} else if (connp != NULL && IPCL_IS_TCP(connp) &&
11848 		    connp->conn_mdt_ok && !connp->conn_tcp->tcp_mdt &&
11849 		    ILL_MDT_USABLE(ill)) {
11850 			/*
11851 			 * This tcp connection was marked as MDT-capable, but
11852 			 * it has been turned off due changes in the interface.
11853 			 * Now that the interface support is back, turn it on
11854 			 * by notifying tcp.  We don't directly modify tcp_mdt,
11855 			 * since we leave all the details to the tcp code that
11856 			 * knows better.
11857 			 */
11858 			mblk_t *mdimp = ip_mdinfo_alloc(ill->ill_mdt_capab);
11859 
11860 			if (mdimp == NULL) {
11861 				ip0dbg(("ip_xmit_v6: can't re-enable MDT for "
11862 				    "connp %p (ENOMEM)\n", (void *)connp));
11863 			} else {
11864 				CONN_INC_REF(connp);
11865 				squeue_fill(connp->conn_sqp, mdimp, tcp_input,
11866 				    connp, SQTAG_TCP_INPUT_MCTL);
11867 			}
11868 		}
11869 
11870 		do {
11871 			boolean_t	qos_done = B_FALSE;
11872 
11873 			if (multirt_send) {
11874 				irb_t *irb;
11875 				/*
11876 				 * We are in a multiple send case, need to get
11877 				 * the next ire and make a duplicate of the
11878 				 * packet. ire1 holds here the next ire to
11879 				 * process in the bucket. If multirouting is
11880 				 * expected, any non-RTF_MULTIRT ire that has
11881 				 * the right destination address is ignored.
11882 				 */
11883 				irb = ire->ire_bucket;
11884 				ASSERT(irb != NULL);
11885 
11886 				IRB_REFHOLD(irb);
11887 				for (ire1 = ire->ire_next;
11888 				    ire1 != NULL;
11889 				    ire1 = ire1->ire_next) {
11890 					if (!(ire1->ire_flags & RTF_MULTIRT))
11891 						continue;
11892 					if (!IN6_ARE_ADDR_EQUAL(
11893 					    &ire1->ire_addr_v6,
11894 					    &ire->ire_addr_v6))
11895 						continue;
11896 					if (ire1->ire_marks &
11897 					    (IRE_MARK_CONDEMNED|
11898 					    IRE_MARK_HIDDEN))
11899 						continue;
11900 
11901 					/* Got one */
11902 					if (ire1 != save_ire) {
11903 						IRE_REFHOLD(ire1);
11904 					}
11905 					break;
11906 				}
11907 				IRB_REFRELE(irb);
11908 
11909 				if (ire1 != NULL) {
11910 					next_mp = copyb(mp);
11911 					if ((next_mp == NULL) ||
11912 					    ((mp->b_cont != NULL) &&
11913 						((next_mp->b_cont =
11914 						    dupmsg(mp->b_cont)) ==
11915 						    NULL))) {
11916 						freemsg(next_mp);
11917 						next_mp = NULL;
11918 						ire_refrele(ire1);
11919 						ire1 = NULL;
11920 					}
11921 				}
11922 
11923 				/* Last multiroute ire; don't loop anymore. */
11924 				if (ire1 == NULL) {
11925 					multirt_send = B_FALSE;
11926 				}
11927 			}
11928 
11929 			ill_index =
11930 			    ((ill_t *)stq->q_ptr)->ill_phyint->phyint_ifindex;
11931 
11932 			/*
11933 			 * Check for fastpath, we need to hold nce_lock to
11934 			 * prevent fastpath update from chaining nce_fp_mp.
11935 			 */
11936 			mutex_enter(&nce->nce_lock);
11937 			if ((mp1 = nce->nce_fp_mp) != NULL) {
11938 				uint32_t hlen;
11939 				uchar_t	*rptr;
11940 
11941 				/* Initiate IPPF processing */
11942 				if (IP6_OUT_IPP(flags)) {
11943 					/*
11944 					 * We have to release the nce lock since
11945 					 * IPPF components use
11946 					 * ill_lookup_on_ifindex(),
11947 					 * which takes the ill_g_lock and the
11948 					 * ill_lock locks.
11949 					 */
11950 					mutex_exit(&nce->nce_lock);
11951 					ip_process(IPP_LOCAL_OUT, &mp,
11952 					    ill_index);
11953 					if (mp == NULL) {
11954 						BUMP_MIB(
11955 						    ill->ill_ip6_mib,
11956 						    ipv6OutDiscards);
11957 						if (next_mp != NULL)
11958 							freemsg(next_mp);
11959 						if (ire != save_ire) {
11960 							ire_refrele(ire);
11961 						}
11962 						return;
11963 					}
11964 					mutex_enter(&nce->nce_lock);
11965 					if ((mp1 = nce->nce_fp_mp) == NULL) {
11966 						/*
11967 						 * Probably disappeared during
11968 						 * IPQoS processing.
11969 						 */
11970 						qos_done = B_TRUE;
11971 						goto prepend_unitdata;
11972 					}
11973 				}
11974 				hlen = MBLKL(mp1);
11975 				rptr = mp->b_rptr - hlen;
11976 				/*
11977 				 * make sure there is room for the fastpath
11978 				 * datalink header
11979 				 */
11980 				if (rptr < mp->b_datap->db_base) {
11981 					mp1 = copyb(mp1);
11982 					if (mp1 == NULL) {
11983 						mutex_exit(&nce->nce_lock);
11984 						BUMP_MIB(ill->ill_ip6_mib,
11985 						    ipv6OutDiscards);
11986 						freemsg(mp);
11987 						if (next_mp != NULL)
11988 							freemsg(next_mp);
11989 						if (ire != save_ire) {
11990 							ire_refrele(ire);
11991 						}
11992 						return;
11993 					}
11994 					mp1->b_cont = mp;
11995 
11996 					/* Get the priority marking, if any */
11997 					mp1->b_band = mp->b_band;
11998 					mp = mp1;
11999 				} else {
12000 					mp->b_rptr = rptr;
12001 					/*
12002 					 * fastpath -  pre-pend datalink
12003 					 * header
12004 					 */
12005 					bcopy(mp1->b_rptr, rptr, hlen);
12006 				}
12007 
12008 				mutex_exit(&nce->nce_lock);
12009 
12010 			} else {
12011 		prepend_unitdata:
12012 				mutex_exit(&nce->nce_lock);
12013 				mp1 = nce->nce_res_mp;
12014 				if (mp1 == NULL) {
12015 					ip1dbg(("ip_xmit_v6: No resolution "
12016 					    "block ire = %p\n", (void *)ire));
12017 					freemsg(mp);
12018 					if (next_mp != NULL)
12019 						freemsg(next_mp);
12020 					if (ire != save_ire) {
12021 						ire_refrele(ire);
12022 					}
12023 					return;
12024 				}
12025 				/*
12026 				 * Prepend the DL_UNITDATA_REQ.
12027 				 */
12028 				mp1 = copyb(mp1);
12029 				if (mp1 == NULL) {
12030 					BUMP_MIB(ill->ill_ip6_mib,
12031 					    ipv6OutDiscards);
12032 					freemsg(mp);
12033 					if (next_mp != NULL)
12034 						freemsg(next_mp);
12035 					if (ire != save_ire) {
12036 						ire_refrele(ire);
12037 					}
12038 					return;
12039 				}
12040 				mp1->b_cont = mp;
12041 				mp = mp1;
12042 				/*
12043 				 * Initiate IPPF processing, if it is
12044 				 * already done, bypass.
12045 				 */
12046 				if (!qos_done && IP6_OUT_IPP(flags)) {
12047 					ip_process(IPP_LOCAL_OUT, &mp,
12048 					    ill_index);
12049 					if (mp == NULL) {
12050 						BUMP_MIB(ill->ill_ip6_mib,
12051 						    ipv6OutDiscards);
12052 						if (next_mp != NULL)
12053 							freemsg(next_mp);
12054 						if (ire != save_ire) {
12055 							ire_refrele(ire);
12056 						}
12057 						return;
12058 					}
12059 				}
12060 			}
12061 
12062 			/*
12063 			 * Update ire counters; for save_ire, this has been
12064 			 * done by the caller.
12065 			 */
12066 			if (ire != save_ire) {
12067 				UPDATE_OB_PKT_COUNT(ire);
12068 				ire->ire_last_used_time = lbolt;
12069 			}
12070 
12071 			/*
12072 			 * Send it down.  XXX Do we want to flow control AH/ESP
12073 			 * packets that carry TCP payloads?  We don't flow
12074 			 * control TCP packets, but we should also not
12075 			 * flow-control TCP packets that have been protected.
12076 			 * We don't have an easy way to find out if an AH/ESP
12077 			 * packet was originally TCP or not currently.
12078 			 */
12079 			if (io == NULL) {
12080 				putnext(stq, mp);
12081 			} else {
12082 				/*
12083 				 * Safety Pup says: make sure this is
12084 				 * going to the right interface!
12085 				 */
12086 				if (io->ipsec_out_capab_ill_index !=
12087 				    ill_index) {
12088 					/* IPsec kstats: bump lose counter */
12089 					freemsg(mp1);
12090 				} else {
12091 					ipsec_hw_putnext(stq, mp);
12092 				}
12093 			}
12094 
12095 			if (nce->nce_flags & (NCE_F_NONUD|NCE_F_PERMANENT)) {
12096 				if (ire != save_ire) {
12097 					ire_refrele(ire);
12098 				}
12099 				if (multirt_send) {
12100 					ASSERT(ire1 != NULL);
12101 					/*
12102 					 * Proceed with the next RTF_MULTIRT
12103 					 * ire, also set up the send-to queue
12104 					 * accordingly.
12105 					 */
12106 					ire = ire1;
12107 					ire1 = NULL;
12108 					stq = ire->ire_stq;
12109 					nce = ire->ire_nce;
12110 					ill = ire_to_ill(ire);
12111 					mp = next_mp;
12112 					next_mp = NULL;
12113 					continue;
12114 				}
12115 				ASSERT(next_mp == NULL);
12116 				ASSERT(ire1 == NULL);
12117 				return;
12118 			}
12119 
12120 			ASSERT(nce->nce_state != ND_INCOMPLETE);
12121 
12122 			/*
12123 			 * Check for upper layer advice
12124 			 */
12125 			if (flags & IPV6_REACHABILITY_CONFIRMATION) {
12126 				/*
12127 				 * It should be o.k. to check the state without
12128 				 * a lock here, at most we lose an advice.
12129 				 */
12130 				nce->nce_last = TICK_TO_MSEC(lbolt64);
12131 				if (nce->nce_state != ND_REACHABLE) {
12132 
12133 					mutex_enter(&nce->nce_lock);
12134 					nce->nce_state = ND_REACHABLE;
12135 					nce->nce_pcnt = ND_MAX_UNICAST_SOLICIT;
12136 					mutex_exit(&nce->nce_lock);
12137 					(void) untimeout(nce->nce_timeout_id);
12138 					if (ip_debug > 2) {
12139 						/* ip1dbg */
12140 						pr_addr_dbg("ip_xmit_v6: state"
12141 						    " for %s changed to"
12142 						    " REACHABLE\n", AF_INET6,
12143 						    &ire->ire_addr_v6);
12144 					}
12145 				}
12146 				if (ire != save_ire) {
12147 					ire_refrele(ire);
12148 				}
12149 				if (multirt_send) {
12150 					ASSERT(ire1 != NULL);
12151 					/*
12152 					 * Proceed with the next RTF_MULTIRT
12153 					 * ire, also set up the send-to queue
12154 					 * accordingly.
12155 					 */
12156 					ire = ire1;
12157 					ire1 = NULL;
12158 					stq = ire->ire_stq;
12159 					nce = ire->ire_nce;
12160 					ill = ire_to_ill(ire);
12161 					mp = next_mp;
12162 					next_mp = NULL;
12163 					continue;
12164 				}
12165 				ASSERT(next_mp == NULL);
12166 				ASSERT(ire1 == NULL);
12167 				return;
12168 			}
12169 
12170 			delta =  TICK_TO_MSEC(lbolt64) - nce->nce_last;
12171 			ip1dbg(("ip_xmit_v6: delta = %" PRId64
12172 			    " ill_reachable_time = %d \n", delta,
12173 			    ill->ill_reachable_time));
12174 			if (delta > (uint64_t)ill->ill_reachable_time) {
12175 				nce = ire->ire_nce;
12176 				mutex_enter(&nce->nce_lock);
12177 				switch (nce->nce_state) {
12178 				case ND_REACHABLE:
12179 				case ND_STALE:
12180 					/*
12181 					 * ND_REACHABLE is identical to
12182 					 * ND_STALE in this specific case. If
12183 					 * reachable time has expired for this
12184 					 * neighbor (delta is greater than
12185 					 * reachable time), conceptually, the
12186 					 * neighbor cache is no longer in
12187 					 * REACHABLE state, but already in
12188 					 * STALE state.  So the correct
12189 					 * transition here is to ND_DELAY.
12190 					 */
12191 					nce->nce_state = ND_DELAY;
12192 					mutex_exit(&nce->nce_lock);
12193 					NDP_RESTART_TIMER(nce,
12194 					    delay_first_probe_time);
12195 					if (ip_debug > 3) {
12196 						/* ip2dbg */
12197 						pr_addr_dbg("ip_xmit_v6: state"
12198 						    " for %s changed to"
12199 						    " DELAY\n", AF_INET6,
12200 						    &ire->ire_addr_v6);
12201 					}
12202 					break;
12203 				case ND_DELAY:
12204 				case ND_PROBE:
12205 					mutex_exit(&nce->nce_lock);
12206 					/* Timers have already started */
12207 					break;
12208 				case ND_UNREACHABLE:
12209 					/*
12210 					 * ndp timer has detected that this nce
12211 					 * is unreachable and initiated deleting
12212 					 * this nce and all its associated IREs.
12213 					 * This is a race where we found the
12214 					 * ire before it was deleted and have
12215 					 * just sent out a packet using this
12216 					 * unreachable nce.
12217 					 */
12218 					mutex_exit(&nce->nce_lock);
12219 					break;
12220 				default:
12221 					ASSERT(0);
12222 				}
12223 			}
12224 
12225 			if (multirt_send) {
12226 				ASSERT(ire1 != NULL);
12227 				/*
12228 				 * Proceed with the next RTF_MULTIRT ire,
12229 				 * Also set up the send-to queue accordingly.
12230 				 */
12231 				if (ire != save_ire) {
12232 					ire_refrele(ire);
12233 				}
12234 				ire = ire1;
12235 				ire1 = NULL;
12236 				stq = ire->ire_stq;
12237 				nce = ire->ire_nce;
12238 				ill = ire_to_ill(ire);
12239 				mp = next_mp;
12240 				next_mp = NULL;
12241 			}
12242 		} while (multirt_send);
12243 		/*
12244 		 * In the multirouting case, release the last ire used for
12245 		 * emission. save_ire will be released by the caller.
12246 		 */
12247 		if (ire != save_ire) {
12248 			ire_refrele(ire);
12249 		}
12250 	} else {
12251 		/*
12252 		 * Queue packet if we have an conn to give back pressure.
12253 		 * We can't queue packets intended for hardware acceleration
12254 		 * since we've tossed that state already. If the packet is
12255 		 * being fed back from ire_send_v6, we don't know the
12256 		 * position in the queue to enqueue the packet and we discard
12257 		 * the packet.
12258 		 */
12259 		if (ip_output_queue && (connp != NULL) && (io == NULL) &&
12260 		    (caller != IRE_SEND)) {
12261 			if (caller == IP_WSRV) {
12262 				connp->conn_did_putbq = 1;
12263 				(void) putbq(connp->conn_wq, mp);
12264 				conn_drain_insert(connp);
12265 				/*
12266 				 * caller == IP_WSRV implies we are
12267 				 * the service thread, and the
12268 				 * queue is already noenabled.
12269 				 * The check for canput and
12270 				 * the putbq is not atomic.
12271 				 * So we need to check again.
12272 				 */
12273 				if (canput(stq->q_next))
12274 					connp->conn_did_putbq = 0;
12275 			} else {
12276 				(void) putq(connp->conn_wq, mp);
12277 			}
12278 			return;
12279 		}
12280 		BUMP_MIB(ill->ill_ip6_mib, ipv6OutDiscards);
12281 		freemsg(mp);
12282 		return;
12283 	}
12284 }
12285 
12286 /*
12287  * pr_addr_dbg function provides the needed buffer space to call
12288  * inet_ntop() function's 3rd argument. This function should be
12289  * used by any kernel routine which wants to save INET6_ADDRSTRLEN
12290  * stack buffer space in it's own stack frame. This function uses
12291  * a buffer from it's own stack and prints the information.
12292  * Example: pr_addr_dbg("func: no route for %s\n ", AF_INET, addr)
12293  *
12294  * Note:    This function can call inet_ntop() once.
12295  */
12296 void
12297 pr_addr_dbg(char *fmt1, int af, const void *addr)
12298 {
12299 	char	buf[INET6_ADDRSTRLEN];
12300 
12301 	if (fmt1 == NULL) {
12302 		ip0dbg(("pr_addr_dbg: Wrong arguments\n"));
12303 		return;
12304 	}
12305 
12306 	/*
12307 	 * This does not compare debug level and just prints
12308 	 * out. Thus it is the responsibility of the caller
12309 	 * to check the appropriate debug-level before calling
12310 	 * this function.
12311 	 */
12312 	if (ip_debug > 0) {
12313 		printf(fmt1, inet_ntop(af, addr, buf, sizeof (buf)));
12314 	}
12315 
12316 
12317 }
12318 
12319 
12320 /*
12321  * Return the length in bytes of the IPv6 headers (base header, ip6i_t
12322  * if needed and extension headers) that will be needed based on the
12323  * ip6_pkt_t structure passed by the caller.
12324  *
12325  * The returned length does not include the length of the upper level
12326  * protocol (ULP) header.
12327  */
12328 int
12329 ip_total_hdrs_len_v6(ip6_pkt_t *ipp)
12330 {
12331 	int len;
12332 
12333 	len = IPV6_HDR_LEN;
12334 	if (ipp->ipp_fields & IPPF_HAS_IP6I)
12335 		len += sizeof (ip6i_t);
12336 	if (ipp->ipp_fields & IPPF_HOPOPTS) {
12337 		ASSERT(ipp->ipp_hopoptslen != 0);
12338 		len += ipp->ipp_hopoptslen;
12339 	}
12340 	if (ipp->ipp_fields & IPPF_RTHDR) {
12341 		ASSERT(ipp->ipp_rthdrlen != 0);
12342 		len += ipp->ipp_rthdrlen;
12343 	}
12344 	/*
12345 	 * En-route destination options
12346 	 * Only do them if there's a routing header as well
12347 	 */
12348 	if ((ipp->ipp_fields & (IPPF_RTDSTOPTS|IPPF_RTHDR)) ==
12349 	    (IPPF_RTDSTOPTS|IPPF_RTHDR)) {
12350 		ASSERT(ipp->ipp_rtdstoptslen != 0);
12351 		len += ipp->ipp_rtdstoptslen;
12352 	}
12353 	if (ipp->ipp_fields & IPPF_DSTOPTS) {
12354 		ASSERT(ipp->ipp_dstoptslen != 0);
12355 		len += ipp->ipp_dstoptslen;
12356 	}
12357 	return (len);
12358 }
12359 
12360 /*
12361  * All-purpose routine to build a header chain of an IPv6 header
12362  * followed by any required extension headers and a proto header,
12363  * preceeded (where necessary) by an ip6i_t private header.
12364  *
12365  * The fields of the IPv6 header that are derived from the ip6_pkt_t
12366  * will be filled in appropriately.
12367  * Thus the caller must fill in the rest of the IPv6 header, such as
12368  * traffic class/flowid, source address (if not set here), hoplimit (if not
12369  * set here) and destination address.
12370  *
12371  * The extension headers and ip6i_t header will all be fully filled in.
12372  */
12373 void
12374 ip_build_hdrs_v6(uchar_t *ext_hdrs, uint_t ext_hdrs_len,
12375     ip6_pkt_t *ipp, uint8_t protocol)
12376 {
12377 	uint8_t *nxthdr_ptr;
12378 	uint8_t *cp;
12379 	ip6i_t	*ip6i;
12380 	ip6_t	*ip6h = (ip6_t *)ext_hdrs;
12381 
12382 	/*
12383 	 * If sending private ip6i_t header down (checksum info, nexthop,
12384 	 * or ifindex), adjust ip header pointer and set ip6i_t header pointer,
12385 	 * then fill it in. (The checksum info will be filled in by icmp).
12386 	 */
12387 	if (ipp->ipp_fields & IPPF_HAS_IP6I) {
12388 		ip6i = (ip6i_t *)ip6h;
12389 		ip6h = (ip6_t *)&ip6i[1];
12390 
12391 		ip6i->ip6i_flags = 0;
12392 		ip6i->ip6i_vcf = IPV6_DEFAULT_VERS_AND_FLOW;
12393 		if (ipp->ipp_fields & IPPF_IFINDEX ||
12394 		    ipp->ipp_fields & IPPF_SCOPE_ID) {
12395 			ASSERT(ipp->ipp_ifindex != 0);
12396 			ip6i->ip6i_flags |= IP6I_IFINDEX;
12397 			ip6i->ip6i_ifindex = ipp->ipp_ifindex;
12398 		}
12399 		if (ipp->ipp_fields & IPPF_ADDR) {
12400 			/*
12401 			 * Enable per-packet source address verification if
12402 			 * IPV6_PKTINFO specified the source address.
12403 			 * ip6_src is set in the transport's _wput function.
12404 			 */
12405 			ASSERT(!IN6_IS_ADDR_UNSPECIFIED(
12406 			    &ipp->ipp_addr));
12407 			ip6i->ip6i_flags |= IP6I_VERIFY_SRC;
12408 		}
12409 		if (ipp->ipp_fields & IPPF_UNICAST_HOPS) {
12410 			ip6h->ip6_hops = ipp->ipp_unicast_hops;
12411 			/*
12412 			 * We need to set this flag so that IP doesn't
12413 			 * rewrite the IPv6 header's hoplimit with the
12414 			 * current default value.
12415 			 */
12416 			ip6i->ip6i_flags |= IP6I_HOPLIMIT;
12417 		}
12418 		if (ipp->ipp_fields & IPPF_NEXTHOP) {
12419 			ASSERT(!IN6_IS_ADDR_UNSPECIFIED(
12420 			    &ipp->ipp_nexthop));
12421 			ip6i->ip6i_flags |= IP6I_NEXTHOP;
12422 			ip6i->ip6i_nexthop = ipp->ipp_nexthop;
12423 		}
12424 		/*
12425 		 * tell IP this is an ip6i_t private header
12426 		 */
12427 		ip6i->ip6i_nxt = IPPROTO_RAW;
12428 	}
12429 	/* Initialize IPv6 header */
12430 	ip6h->ip6_vcf = IPV6_DEFAULT_VERS_AND_FLOW;
12431 	if (ipp->ipp_fields & IPPF_TCLASS) {
12432 		ip6h->ip6_vcf = (ip6h->ip6_vcf & ~IPV6_FLOWINFO_TCLASS) |
12433 		    (ipp->ipp_tclass << 20);
12434 	}
12435 	if (ipp->ipp_fields & IPPF_ADDR)
12436 		ip6h->ip6_src = ipp->ipp_addr;
12437 
12438 	nxthdr_ptr = (uint8_t *)&ip6h->ip6_nxt;
12439 	cp = (uint8_t *)&ip6h[1];
12440 	/*
12441 	 * Here's where we have to start stringing together
12442 	 * any extension headers in the right order:
12443 	 * Hop-by-hop, destination, routing, and final destination opts.
12444 	 */
12445 	if (ipp->ipp_fields & IPPF_HOPOPTS) {
12446 		/* Hop-by-hop options */
12447 		ip6_hbh_t *hbh = (ip6_hbh_t *)cp;
12448 
12449 		*nxthdr_ptr = IPPROTO_HOPOPTS;
12450 		nxthdr_ptr = &hbh->ip6h_nxt;
12451 
12452 		bcopy(ipp->ipp_hopopts, cp, ipp->ipp_hopoptslen);
12453 		cp += ipp->ipp_hopoptslen;
12454 	}
12455 	/*
12456 	 * En-route destination options
12457 	 * Only do them if there's a routing header as well
12458 	 */
12459 	if ((ipp->ipp_fields & (IPPF_RTDSTOPTS|IPPF_RTHDR)) ==
12460 	    (IPPF_RTDSTOPTS|IPPF_RTHDR)) {
12461 		ip6_dest_t *dst = (ip6_dest_t *)cp;
12462 
12463 		*nxthdr_ptr = IPPROTO_DSTOPTS;
12464 		nxthdr_ptr = &dst->ip6d_nxt;
12465 
12466 		bcopy(ipp->ipp_rtdstopts, cp, ipp->ipp_rtdstoptslen);
12467 		cp += ipp->ipp_rtdstoptslen;
12468 	}
12469 	/*
12470 	 * Routing header next
12471 	 */
12472 	if (ipp->ipp_fields & IPPF_RTHDR) {
12473 		ip6_rthdr_t *rt = (ip6_rthdr_t *)cp;
12474 
12475 		*nxthdr_ptr = IPPROTO_ROUTING;
12476 		nxthdr_ptr = &rt->ip6r_nxt;
12477 
12478 		bcopy(ipp->ipp_rthdr, cp, ipp->ipp_rthdrlen);
12479 		cp += ipp->ipp_rthdrlen;
12480 	}
12481 	/*
12482 	 * Do ultimate destination options
12483 	 */
12484 	if (ipp->ipp_fields & IPPF_DSTOPTS) {
12485 		ip6_dest_t *dest = (ip6_dest_t *)cp;
12486 
12487 		*nxthdr_ptr = IPPROTO_DSTOPTS;
12488 		nxthdr_ptr = &dest->ip6d_nxt;
12489 
12490 		bcopy(ipp->ipp_dstopts, cp, ipp->ipp_dstoptslen);
12491 		cp += ipp->ipp_dstoptslen;
12492 	}
12493 	/*
12494 	 * Now set the last header pointer to the proto passed in
12495 	 */
12496 	*nxthdr_ptr = protocol;
12497 	ASSERT((int)(cp - ext_hdrs) == ext_hdrs_len);
12498 }
12499 
12500 /*
12501  * Return a pointer to the routing header extension header
12502  * in the IPv6 header(s) chain passed in.
12503  * If none found, return NULL
12504  * Assumes that all extension headers are in same mblk as the v6 header
12505  */
12506 ip6_rthdr_t *
12507 ip_find_rthdr_v6(ip6_t *ip6h, uint8_t *endptr)
12508 {
12509 	ip6_dest_t	*desthdr;
12510 	ip6_frag_t	*fraghdr;
12511 	uint_t		hdrlen;
12512 	uint8_t		nexthdr;
12513 	uint8_t		*ptr = (uint8_t *)&ip6h[1];
12514 
12515 	if (ip6h->ip6_nxt == IPPROTO_ROUTING)
12516 		return ((ip6_rthdr_t *)ptr);
12517 
12518 	/*
12519 	 * The routing header will precede all extension headers
12520 	 * other than the hop-by-hop and destination options
12521 	 * extension headers, so if we see anything other than those,
12522 	 * we're done and didn't find it.
12523 	 * We could see a destination options header alone but no
12524 	 * routing header, in which case we'll return NULL as soon as
12525 	 * we see anything after that.
12526 	 * Hop-by-hop and destination option headers are identical,
12527 	 * so we can use either one we want as a template.
12528 	 */
12529 	nexthdr = ip6h->ip6_nxt;
12530 	while (ptr < endptr) {
12531 		/* Is there enough left for len + nexthdr? */
12532 		if (ptr + MIN_EHDR_LEN > endptr)
12533 			return (NULL);
12534 
12535 		switch (nexthdr) {
12536 		case IPPROTO_HOPOPTS:
12537 		case IPPROTO_DSTOPTS:
12538 			/* Assumes the headers are identical for hbh and dst */
12539 			desthdr = (ip6_dest_t *)ptr;
12540 			hdrlen = 8 * (desthdr->ip6d_len + 1);
12541 			nexthdr = desthdr->ip6d_nxt;
12542 			break;
12543 
12544 		case IPPROTO_ROUTING:
12545 			return ((ip6_rthdr_t *)ptr);
12546 
12547 		case IPPROTO_FRAGMENT:
12548 			fraghdr = (ip6_frag_t *)ptr;
12549 			hdrlen = sizeof (ip6_frag_t);
12550 			nexthdr = fraghdr->ip6f_nxt;
12551 			break;
12552 
12553 		default:
12554 			return (NULL);
12555 		}
12556 		ptr += hdrlen;
12557 	}
12558 	return (NULL);
12559 }
12560 
12561 /*
12562  * Called for source-routed packets originating on this node.
12563  * Manipulates the original routing header by moving every entry up
12564  * one slot, placing the first entry in the v6 header's v6_dst field,
12565  * and placing the ultimate destination in the routing header's last
12566  * slot.
12567  *
12568  * Returns the checksum diference between the ultimate destination
12569  * (last hop in the routing header when the packet is sent) and
12570  * the first hop (ip6_dst when the packet is sent)
12571  */
12572 uint32_t
12573 ip_massage_options_v6(ip6_t *ip6h, ip6_rthdr_t *rth)
12574 {
12575 	uint_t		numaddr;
12576 	uint_t		i;
12577 	in6_addr_t	*addrptr;
12578 	in6_addr_t	tmp;
12579 	ip6_rthdr0_t	*rthdr = (ip6_rthdr0_t *)rth;
12580 	uint32_t	cksm;
12581 	uint32_t	addrsum = 0;
12582 	uint16_t	*ptr;
12583 
12584 	/*
12585 	 * Perform any processing needed for source routing.
12586 	 * We know that all extension headers will be in the same mblk
12587 	 * as the IPv6 header.
12588 	 */
12589 
12590 	/*
12591 	 * If no segments left in header, or the header length field is zero,
12592 	 * don't move hop addresses around;
12593 	 * Checksum difference is zero.
12594 	 */
12595 	if ((rthdr->ip6r0_segleft == 0) || (rthdr->ip6r0_len == 0))
12596 		return (0);
12597 
12598 	ptr = (uint16_t *)&ip6h->ip6_dst;
12599 	cksm = 0;
12600 	for (i = 0; i < (sizeof (in6_addr_t) / sizeof (uint16_t)); i++) {
12601 		cksm += ptr[i];
12602 	}
12603 	cksm = (cksm & 0xFFFF) + (cksm >> 16);
12604 
12605 	/*
12606 	 * Here's where the fun begins - we have to
12607 	 * move all addresses up one spot, take the
12608 	 * first hop and make it our first ip6_dst,
12609 	 * and place the ultimate destination in the
12610 	 * newly-opened last slot.
12611 	 */
12612 	addrptr = (in6_addr_t *)((char *)rthdr + sizeof (*rthdr));
12613 	numaddr = rthdr->ip6r0_len / 2;
12614 	tmp = *addrptr;
12615 	for (i = 0; i < (numaddr - 1); addrptr++, i++) {
12616 		*addrptr = addrptr[1];
12617 	}
12618 	*addrptr = ip6h->ip6_dst;
12619 	ip6h->ip6_dst = tmp;
12620 
12621 	/*
12622 	 * From the checksummed ultimate destination subtract the checksummed
12623 	 * current ip6_dst (the first hop address). Return that number.
12624 	 * (In the v4 case, the second part of this is done in each routine
12625 	 *  that calls ip_massage_options(). We do it all in this one place
12626 	 *  for v6).
12627 	 */
12628 	ptr = (uint16_t *)&ip6h->ip6_dst;
12629 	for (i = 0; i < (sizeof (in6_addr_t) / sizeof (uint16_t)); i++) {
12630 		addrsum += ptr[i];
12631 	}
12632 	cksm -= ((addrsum >> 16) + (addrsum & 0xFFFF));
12633 	if ((int)cksm < 0)
12634 		cksm--;
12635 	cksm = (cksm & 0xFFFF) + (cksm >> 16);
12636 
12637 	return (cksm);
12638 }
12639 
12640 /*
12641  * See if the upper-level protocol indicated by 'proto' will be able
12642  * to do something with an ICMP_FRAGMENTATION_NEEDED (IPv4) or
12643  * ICMP6_PACKET_TOO_BIG (IPv6).
12644  */
12645 static boolean_t
12646 ip_ulp_cando_pkt2big(int proto)
12647 {
12648 	/*
12649 	 * For now, only TCP can handle this.
12650 	 * Tunnels may be able to also, but since tun isn't working over
12651 	 * IPv6 yet, don't worry about it for now.
12652 	 */
12653 	return (proto == IPPROTO_TCP);
12654 }
12655 
12656 
12657 /*
12658  * Propagate a multicast group membership operation (join/leave) (*fn) on
12659  * all interfaces crossed by the related multirt routes.
12660  * The call is considered successful if the operation succeeds
12661  * on at least one interface.
12662  * The function is called if the destination address in the packet to send
12663  * is multirouted.
12664  */
12665 int
12666 ip_multirt_apply_membership_v6(int (*fn)(conn_t *, boolean_t,
12667     const in6_addr_t *, int, mcast_record_t, const in6_addr_t *, mblk_t *),
12668     ire_t *ire, conn_t *connp, boolean_t checkonly, const in6_addr_t *v6grp,
12669     mcast_record_t fmode, const in6_addr_t *v6src, mblk_t *first_mp)
12670 {
12671 	ire_t		*ire_gw;
12672 	irb_t		*irb;
12673 	int		index, error = 0;
12674 	opt_restart_t	*or;
12675 
12676 	irb = ire->ire_bucket;
12677 	ASSERT(irb != NULL);
12678 
12679 	ASSERT(DB_TYPE(first_mp) == M_CTL);
12680 	or = (opt_restart_t *)first_mp->b_rptr;
12681 
12682 	IRB_REFHOLD(irb);
12683 	for (; ire != NULL; ire = ire->ire_next) {
12684 		if ((ire->ire_flags & RTF_MULTIRT) == 0)
12685 			continue;
12686 		if (!IN6_ARE_ADDR_EQUAL(&ire->ire_addr_v6, v6grp))
12687 			continue;
12688 
12689 		ire_gw = ire_ftable_lookup_v6(&ire->ire_gateway_addr_v6, 0, 0,
12690 		    IRE_INTERFACE, NULL, NULL, ALL_ZONES, 0, NULL,
12691 		    MATCH_IRE_RECURSIVE | MATCH_IRE_TYPE);
12692 		/* No resolver exists for the gateway; skip this ire. */
12693 		if (ire_gw == NULL)
12694 			continue;
12695 		index = ire_gw->ire_ipif->ipif_ill->ill_phyint->phyint_ifindex;
12696 		/*
12697 		 * A resolver exists: we can get the interface on which we have
12698 		 * to apply the operation.
12699 		 */
12700 		error = fn(connp, checkonly, v6grp, index, fmode, v6src,
12701 		    first_mp);
12702 		if (error == 0)
12703 			or->or_private = CGTP_MCAST_SUCCESS;
12704 
12705 		if (ip_debug > 0) {
12706 			ulong_t	off;
12707 			char	*ksym;
12708 
12709 			ksym = kobj_getsymname((uintptr_t)fn, &off);
12710 			ip2dbg(("ip_multirt_apply_membership_v6: "
12711 			    "called %s, multirt group 0x%08x via itf 0x%08x, "
12712 			    "error %d [success %u]\n",
12713 			    ksym ? ksym : "?",
12714 			    ntohl(V4_PART_OF_V6((*v6grp))),
12715 			    ntohl(V4_PART_OF_V6(ire_gw->ire_src_addr_v6)),
12716 			    error, or->or_private));
12717 		}
12718 
12719 		ire_refrele(ire_gw);
12720 		if (error == EINPROGRESS) {
12721 			IRB_REFRELE(irb);
12722 			return (error);
12723 		}
12724 	}
12725 	IRB_REFRELE(irb);
12726 	/*
12727 	 * Consider the call as successful if we succeeded on at least
12728 	 * one interface. Otherwise, return the last encountered error.
12729 	 */
12730 	return (or->or_private == CGTP_MCAST_SUCCESS ? 0 : error);
12731 }
12732 
12733 void
12734 ip6_kstat_init(void)
12735 {
12736 	if ((ip6_kstat = kstat_create("ip", 0, "ip6stat",
12737 		"net", KSTAT_TYPE_NAMED,
12738 		sizeof (ip6_statistics) / sizeof (kstat_named_t),
12739 		KSTAT_FLAG_VIRTUAL)) != NULL) {
12740 		ip6_kstat->ks_data = &ip6_statistics;
12741 		kstat_install(ip6_kstat);
12742 	}
12743 }
12744 
12745 /*
12746  * The following two functions set and get the value for the
12747  * IPV6_SRC_PREFERENCES socket option.
12748  */
12749 int
12750 ip6_set_src_preferences(conn_t *connp, uint32_t prefs)
12751 {
12752 	/*
12753 	 * We only support preferences that are covered by
12754 	 * IPV6_PREFER_SRC_MASK.
12755 	 */
12756 	if (prefs & ~IPV6_PREFER_SRC_MASK)
12757 		return (EINVAL);
12758 
12759 	/*
12760 	 * Look for conflicting preferences or default preferences.  If
12761 	 * both bits of a related pair are clear, the application wants the
12762 	 * system's default value for that pair.  Both bits in a pair can't
12763 	 * be set.
12764 	 */
12765 	if ((prefs & IPV6_PREFER_SRC_MIPMASK) == 0) {
12766 		prefs |= IPV6_PREFER_SRC_MIPDEFAULT;
12767 	} else if ((prefs & IPV6_PREFER_SRC_MIPMASK) ==
12768 	    IPV6_PREFER_SRC_MIPMASK) {
12769 		return (EINVAL);
12770 	}
12771 	if ((prefs & IPV6_PREFER_SRC_TMPMASK) == 0) {
12772 		prefs |= IPV6_PREFER_SRC_TMPDEFAULT;
12773 	} else if ((prefs & IPV6_PREFER_SRC_TMPMASK) ==
12774 	    IPV6_PREFER_SRC_TMPMASK) {
12775 		return (EINVAL);
12776 	}
12777 	if ((prefs & IPV6_PREFER_SRC_CGAMASK) == 0) {
12778 		prefs |= IPV6_PREFER_SRC_CGADEFAULT;
12779 	} else if ((prefs & IPV6_PREFER_SRC_CGAMASK) ==
12780 	    IPV6_PREFER_SRC_CGAMASK) {
12781 		return (EINVAL);
12782 	}
12783 
12784 	connp->conn_src_preferences = prefs;
12785 	return (0);
12786 }
12787 
12788 size_t
12789 ip6_get_src_preferences(conn_t *connp, uint32_t *val)
12790 {
12791 	*val = connp->conn_src_preferences;
12792 	return (sizeof (connp->conn_src_preferences));
12793 }
12794 
12795 int
12796 ip6_set_pktinfo(cred_t *cr, conn_t *connp, struct in6_pktinfo *pkti, mblk_t *mp)
12797 {
12798 	ill_t	*ill;
12799 	ire_t	*ire;
12800 	int	error;
12801 
12802 	/*
12803 	 * Verify the source address and ifindex. Privileged users can use
12804 	 * any source address.  For ancillary data the source address is
12805 	 * checked in ip_wput_v6.
12806 	 */
12807 	if (pkti->ipi6_ifindex != 0) {
12808 		ASSERT(connp != NULL);
12809 		ill = ill_lookup_on_ifindex(pkti->ipi6_ifindex, B_TRUE,
12810 		    CONNP_TO_WQ(connp), mp, ip_restart_optmgmt, &error);
12811 		if (ill == NULL) {
12812 			/*
12813 			 * We just want to know if the interface exists, we
12814 			 * don't really care about the ill pointer itself.
12815 			 */
12816 			if (error != EINPROGRESS)
12817 				return (error);
12818 			error = 0;	/* Ensure we don't use it below */
12819 		} else {
12820 			ill_refrele(ill);
12821 		}
12822 	}
12823 	if (!IN6_IS_ADDR_UNSPECIFIED(&pkti->ipi6_addr) &&
12824 	    secpolicy_net_rawaccess(cr) != 0) {
12825 		ire = ire_route_lookup_v6(&pkti->ipi6_addr, 0, 0,
12826 		    (IRE_LOCAL|IRE_LOOPBACK), NULL, NULL,
12827 		    connp->conn_zoneid, NULL, MATCH_IRE_TYPE);
12828 		if (ire != NULL)
12829 			ire_refrele(ire);
12830 		else
12831 			return (ENXIO);
12832 	}
12833 	return (0);
12834 }
12835 
12836 /*
12837  * Get the size of the IP options (including the IP headers size)
12838  * without including the AH header's size. If till_ah is B_FALSE,
12839  * and if AH header is present, dest options beyond AH header will
12840  * also be included in the returned size.
12841  */
12842 int
12843 ipsec_ah_get_hdr_size_v6(mblk_t *mp, boolean_t till_ah)
12844 {
12845 	ip6_t *ip6h;
12846 	uint8_t nexthdr;
12847 	uint8_t *whereptr;
12848 	ip6_hbh_t *hbhhdr;
12849 	ip6_dest_t *dsthdr;
12850 	ip6_rthdr_t *rthdr;
12851 	int ehdrlen;
12852 	int size;
12853 	ah_t *ah;
12854 
12855 	ip6h = (ip6_t *)mp->b_rptr;
12856 	size = IPV6_HDR_LEN;
12857 	nexthdr = ip6h->ip6_nxt;
12858 	whereptr = (uint8_t *)&ip6h[1];
12859 	for (;;) {
12860 		/* Assume IP has already stripped it */
12861 		ASSERT(nexthdr != IPPROTO_FRAGMENT && nexthdr != IPPROTO_RAW);
12862 		switch (nexthdr) {
12863 		case IPPROTO_HOPOPTS:
12864 			hbhhdr = (ip6_hbh_t *)whereptr;
12865 			nexthdr = hbhhdr->ip6h_nxt;
12866 			ehdrlen = 8 * (hbhhdr->ip6h_len + 1);
12867 			break;
12868 		case IPPROTO_DSTOPTS:
12869 			dsthdr = (ip6_dest_t *)whereptr;
12870 			nexthdr = dsthdr->ip6d_nxt;
12871 			ehdrlen = 8 * (dsthdr->ip6d_len + 1);
12872 			break;
12873 		case IPPROTO_ROUTING:
12874 			rthdr = (ip6_rthdr_t *)whereptr;
12875 			nexthdr = rthdr->ip6r_nxt;
12876 			ehdrlen = 8 * (rthdr->ip6r_len + 1);
12877 			break;
12878 		default :
12879 			if (till_ah) {
12880 				ASSERT(nexthdr == IPPROTO_AH);
12881 				return (size);
12882 			}
12883 			/*
12884 			 * If we don't have a AH header to traverse,
12885 			 * return now. This happens normally for
12886 			 * outbound datagrams where we have not inserted
12887 			 * the AH header.
12888 			 */
12889 			if (nexthdr != IPPROTO_AH) {
12890 				return (size);
12891 			}
12892 
12893 			/*
12894 			 * We don't include the AH header's size
12895 			 * to be symmetrical with other cases where
12896 			 * we either don't have a AH header (outbound)
12897 			 * or peek into the AH header yet (inbound and
12898 			 * not pulled up yet).
12899 			 */
12900 			ah = (ah_t *)whereptr;
12901 			nexthdr = ah->ah_nexthdr;
12902 			ehdrlen = (ah->ah_length << 2) + 8;
12903 
12904 			if (nexthdr == IPPROTO_DSTOPTS) {
12905 				if (whereptr + ehdrlen >= mp->b_wptr) {
12906 					/*
12907 					 * The destination options header
12908 					 * is not part of the first mblk.
12909 					 */
12910 					whereptr = mp->b_cont->b_rptr;
12911 				} else {
12912 					whereptr += ehdrlen;
12913 				}
12914 
12915 				dsthdr = (ip6_dest_t *)whereptr;
12916 				ehdrlen = 8 * (dsthdr->ip6d_len + 1);
12917 				size += ehdrlen;
12918 			}
12919 			return (size);
12920 		}
12921 		whereptr += ehdrlen;
12922 		size += ehdrlen;
12923 	}
12924 }
12925