xref: /titanic_44/usr/src/uts/common/inet/udp/udp.c (revision dd1104fbe0f0f41434502f335b9f0b34999f771c)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 /* Copyright (c) 1990 Mentat Inc. */
26 
27 #include <sys/types.h>
28 #include <sys/stream.h>
29 #include <sys/dlpi.h>
30 #include <sys/pattr.h>
31 #include <sys/stropts.h>
32 #include <sys/strlog.h>
33 #include <sys/strsun.h>
34 #include <sys/time.h>
35 #define	_SUN_TPI_VERSION 2
36 #include <sys/tihdr.h>
37 #include <sys/timod.h>
38 #include <sys/ddi.h>
39 #include <sys/sunddi.h>
40 #include <sys/strsubr.h>
41 #include <sys/suntpi.h>
42 #include <sys/xti_inet.h>
43 #include <sys/kmem.h>
44 #include <sys/policy.h>
45 #include <sys/ucred.h>
46 #include <sys/zone.h>
47 
48 #include <sys/socket.h>
49 #include <sys/socketvar.h>
50 #include <sys/sockio.h>
51 #include <sys/vtrace.h>
52 #include <sys/sdt.h>
53 #include <sys/debug.h>
54 #include <sys/isa_defs.h>
55 #include <sys/random.h>
56 #include <netinet/in.h>
57 #include <netinet/ip6.h>
58 #include <netinet/icmp6.h>
59 #include <netinet/udp.h>
60 #include <net/if.h>
61 #include <net/route.h>
62 
63 #include <inet/common.h>
64 #include <inet/ip.h>
65 #include <inet/ip_impl.h>
66 #include <inet/ip6.h>
67 #include <inet/ip_ire.h>
68 #include <inet/ip_if.h>
69 #include <inet/ip_multi.h>
70 #include <inet/ip_ndp.h>
71 #include <inet/proto_set.h>
72 #include <inet/mib2.h>
73 #include <inet/nd.h>
74 #include <inet/optcom.h>
75 #include <inet/snmpcom.h>
76 #include <inet/kstatcom.h>
77 #include <inet/udp_impl.h>
78 #include <inet/ipclassifier.h>
79 #include <inet/ipsec_impl.h>
80 #include <inet/ipp_common.h>
81 #include <sys/squeue_impl.h>
82 #include <inet/ipnet.h>
83 #include <sys/ethernet.h>
84 
85 /*
86  * The ipsec_info.h header file is here since it has the definition for the
87  * M_CTL message types used by IP to convey information to the ULP. The
88  * ipsec_info.h needs the pfkeyv2.h, hence the latter's presence.
89  */
90 #include <net/pfkeyv2.h>
91 #include <inet/ipsec_info.h>
92 
93 #include <sys/tsol/label.h>
94 #include <sys/tsol/tnet.h>
95 #include <rpc/pmap_prot.h>
96 
97 /*
98  * Synchronization notes:
99  *
100  * UDP is MT and uses the usual kernel synchronization primitives. There are 2
101  * locks, the fanout lock (uf_lock) and the udp endpoint lock udp_rwlock.
102  * We also use conn_lock when updating things that affect the IP classifier
103  * lookup.
104  * The lock order is udp_rwlock -> uf_lock and is udp_rwlock -> conn_lock.
105  *
106  * The fanout lock uf_lock:
107  * When a UDP endpoint is bound to a local port, it is inserted into
108  * a bind hash list.  The list consists of an array of udp_fanout_t buckets.
109  * The size of the array is controlled by the udp_bind_fanout_size variable.
110  * This variable can be changed in /etc/system if the default value is
111  * not large enough.  Each bind hash bucket is protected by a per bucket
112  * lock.  It protects the udp_bind_hash and udp_ptpbhn fields in the udp_t
113  * structure and a few other fields in the udp_t. A UDP endpoint is removed
114  * from the bind hash list only when it is being unbound or being closed.
115  * The per bucket lock also protects a UDP endpoint's state changes.
116  *
117  * The udp_rwlock:
118  * This protects most of the other fields in the udp_t. The exact list of
119  * fields which are protected by each of the above locks is documented in
120  * the udp_t structure definition.
121  *
122  * Plumbing notes:
123  * UDP is always a device driver. For compatibility with mibopen() code
124  * it is possible to I_PUSH "udp", but that results in pushing a passthrough
125  * dummy module.
126  *
127  * The above implies that we don't support any intermediate module to
128  * reside in between /dev/ip and udp -- in fact, we never supported such
129  * scenario in the past as the inter-layer communication semantics have
130  * always been private.
131  */
132 
133 /* For /etc/system control */
134 uint_t udp_bind_fanout_size = UDP_BIND_FANOUT_SIZE;
135 
136 #define	NDD_TOO_QUICK_MSG \
137 	"ndd get info rate too high for non-privileged users, try again " \
138 	"later.\n"
139 #define	NDD_OUT_OF_BUF_MSG	"<< Out of buffer >>\n"
140 
141 /* Option processing attrs */
142 typedef struct udpattrs_s {
143 	union {
144 		ip6_pkt_t	*udpattr_ipp6;	/* For V6 */
145 		ip4_pkt_t 	*udpattr_ipp4;	/* For V4 */
146 	} udpattr_ippu;
147 #define	udpattr_ipp6 udpattr_ippu.udpattr_ipp6
148 #define	udpattr_ipp4 udpattr_ippu.udpattr_ipp4
149 	mblk_t		*udpattr_mb;
150 	boolean_t	udpattr_credset;
151 } udpattrs_t;
152 
153 static void	udp_addr_req(queue_t *q, mblk_t *mp);
154 static void	udp_tpi_bind(queue_t *q, mblk_t *mp);
155 static void	udp_bind_hash_insert(udp_fanout_t *uf, udp_t *udp);
156 static void	udp_bind_hash_remove(udp_t *udp, boolean_t caller_holds_lock);
157 static int	udp_build_hdrs(udp_t *udp);
158 static void	udp_capability_req(queue_t *q, mblk_t *mp);
159 static int	udp_tpi_close(queue_t *q, int flags);
160 static void	udp_tpi_connect(queue_t *q, mblk_t *mp);
161 static void	udp_tpi_disconnect(queue_t *q, mblk_t *mp);
162 static void	udp_err_ack(queue_t *q, mblk_t *mp, t_scalar_t t_error,
163 		    int sys_error);
164 static void	udp_err_ack_prim(queue_t *q, mblk_t *mp, int primitive,
165 		    t_scalar_t tlierr, int unixerr);
166 static int	udp_extra_priv_ports_get(queue_t *q, mblk_t *mp, caddr_t cp,
167 		    cred_t *cr);
168 static int	udp_extra_priv_ports_add(queue_t *q, mblk_t *mp,
169 		    char *value, caddr_t cp, cred_t *cr);
170 static int	udp_extra_priv_ports_del(queue_t *q, mblk_t *mp,
171 		    char *value, caddr_t cp, cred_t *cr);
172 static void	udp_icmp_error(conn_t *, mblk_t *);
173 static void	udp_icmp_error_ipv6(conn_t *, mblk_t *);
174 static void	udp_info_req(queue_t *q, mblk_t *mp);
175 static void	udp_input(void *, mblk_t *, void *);
176 static mblk_t	*udp_ip_bind_mp(udp_t *udp, t_scalar_t bind_prim,
177 		    t_scalar_t addr_length);
178 static void	udp_lrput(queue_t *, mblk_t *);
179 static void	udp_lwput(queue_t *, mblk_t *);
180 static int	udp_open(queue_t *q, dev_t *devp, int flag, int sflag,
181 		    cred_t *credp, boolean_t isv6);
182 static int	udp_openv4(queue_t *q, dev_t *devp, int flag, int sflag,
183 		    cred_t *credp);
184 static int	udp_openv6(queue_t *q, dev_t *devp, int flag, int sflag,
185 		    cred_t *credp);
186 static  int	udp_unitdata_opt_process(queue_t *q, mblk_t *mp,
187 		    int *errorp, udpattrs_t *udpattrs);
188 static boolean_t udp_opt_allow_udr_set(t_scalar_t level, t_scalar_t name);
189 static int	udp_param_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr);
190 static boolean_t udp_param_register(IDP *ndp, udpparam_t *udppa, int cnt);
191 static int	udp_param_set(queue_t *q, mblk_t *mp, char *value, caddr_t cp,
192 		    cred_t *cr);
193 static void	udp_report_item(mblk_t *mp, udp_t *udp);
194 static int	udp_rinfop(queue_t *q, infod_t *dp);
195 static int	udp_rrw(queue_t *q, struiod_t *dp);
196 static int	udp_status_report(queue_t *q, mblk_t *mp, caddr_t cp,
197 		    cred_t *cr);
198 static void	udp_send_data(udp_t *udp, queue_t *q, mblk_t *mp,
199 		    ipha_t *ipha);
200 static void	udp_ud_err(queue_t *q, mblk_t *mp, uchar_t *destaddr,
201 		    t_scalar_t destlen, t_scalar_t err);
202 static void	udp_tpi_unbind(queue_t *q, mblk_t *mp);
203 static in_port_t udp_update_next_port(udp_t *udp, in_port_t port,
204     boolean_t random);
205 static mblk_t	*udp_output_v4(conn_t *, mblk_t *, ipaddr_t, uint16_t, uint_t,
206 		    int *, boolean_t, struct nmsghdr *, cred_t *, pid_t);
207 static mblk_t	*udp_output_v6(conn_t *connp, mblk_t *mp, sin6_t *sin6,
208 		    int *error, struct nmsghdr *msg, cred_t *cr, pid_t pid);
209 static void	udp_wput_other(queue_t *q, mblk_t *mp);
210 static void	udp_wput_iocdata(queue_t *q, mblk_t *mp);
211 static void	udp_wput_fallback(queue_t *q, mblk_t *mp);
212 static size_t	udp_set_rcv_hiwat(udp_t *udp, size_t size);
213 
214 static void	*udp_stack_init(netstackid_t stackid, netstack_t *ns);
215 static void	udp_stack_fini(netstackid_t stackid, void *arg);
216 
217 static void	*udp_kstat_init(netstackid_t stackid);
218 static void	udp_kstat_fini(netstackid_t stackid, kstat_t *ksp);
219 static void	*udp_kstat2_init(netstackid_t, udp_stat_t *);
220 static void	udp_kstat2_fini(netstackid_t, kstat_t *);
221 static int	udp_kstat_update(kstat_t *kp, int rw);
222 
223 static void	udp_rcv_enqueue(queue_t *q, udp_t *udp, mblk_t *mp,
224 		    uint_t pkt_len);
225 static void	udp_rcv_drain(queue_t *q, udp_t *udp, boolean_t closing);
226 static void	udp_xmit(queue_t *, mblk_t *, ire_t *ire, conn_t *, zoneid_t);
227 
228 static int	udp_send_connected(conn_t *, mblk_t *, struct nmsghdr *,
229 		    cred_t *, pid_t);
230 
231 /* Common routine for TPI and socket module */
232 static conn_t	*udp_do_open(cred_t *, boolean_t, int);
233 static void	udp_do_close(conn_t *);
234 static int	udp_do_bind(conn_t *, struct sockaddr *, socklen_t, cred_t *,
235     boolean_t);
236 static int	udp_do_unbind(conn_t *);
237 static int	udp_do_getsockname(udp_t *, struct sockaddr *, uint_t *);
238 static int	udp_do_getpeername(udp_t *, struct sockaddr *, uint_t *);
239 
240 int		udp_getsockname(sock_lower_handle_t,
241     struct sockaddr *, socklen_t *, cred_t *);
242 int		udp_getpeername(sock_lower_handle_t,
243     struct sockaddr *, socklen_t *, cred_t *);
244 static int	udp_do_connect(conn_t *, const struct sockaddr *, socklen_t,
245     cred_t *cr);
246 static int	udp_post_ip_bind_connect(udp_t *, mblk_t *, int);
247 
248 #define	UDP_RECV_HIWATER	(56 * 1024)
249 #define	UDP_RECV_LOWATER	128
250 #define	UDP_XMIT_HIWATER	(56 * 1024)
251 #define	UDP_XMIT_LOWATER	1024
252 
253 /*
254  * The following is defined in tcp.c
255  */
256 extern int	(*cl_inet_connect2)(netstackid_t stack_id,
257 		    uint8_t protocol, boolean_t is_outgoing,
258 		    sa_family_t addr_family,
259 		    uint8_t *laddrp, in_port_t lport,
260 		    uint8_t *faddrp, in_port_t fport, void *args);
261 
262 /*
263  * Checks if the given destination addr/port is allowed out.
264  * If allowed, registers the (dest_addr/port, node_ID) mapping at Cluster.
265  * Called for each connect() and for sendto()/sendmsg() to a different
266  * destination.
267  * For connect(), called in udp_connect().
268  * For sendto()/sendmsg(), called in udp_output_v{4,6}().
269  *
270  * This macro assumes that the cl_inet_connect2 hook is not NULL.
271  * Please check this before calling this macro.
272  *
273  * void
274  * CL_INET_UDP_CONNECT(conn_t cp, udp_t *udp, boolean_t is_outgoing,
275  *     in6_addr_t *faddrp, in_port_t (or uint16_t) fport, int err);
276  */
277 #define	CL_INET_UDP_CONNECT(cp, udp, is_outgoing, faddrp, fport, err) {	\
278 	(err) = 0;							\
279 	/*								\
280 	 * Running in cluster mode - check and register active		\
281 	 * "connection" information					\
282 	 */								\
283 	if ((udp)->udp_ipversion == IPV4_VERSION)			\
284 		(err) = (*cl_inet_connect2)(				\
285 		    (cp)->conn_netstack->netstack_stackid,		\
286 		    IPPROTO_UDP, is_outgoing, AF_INET,			\
287 		    (uint8_t *)&((udp)->udp_v6src._S6_un._S6_u32[3]),	\
288 		    (udp)->udp_port,					\
289 		    (uint8_t *)&((faddrp)->_S6_un._S6_u32[3]),		\
290 		    (in_port_t)(fport), NULL);				\
291 	else								\
292 		(err) = (*cl_inet_connect2)(				\
293 		    (cp)->conn_netstack->netstack_stackid,		\
294 		    IPPROTO_UDP, is_outgoing, AF_INET6,			\
295 		    (uint8_t *)&((udp)->udp_v6src), (udp)->udp_port,	\
296 		    (uint8_t *)(faddrp), (in_port_t)(fport), NULL);	\
297 }
298 
299 static struct module_info udp_mod_info =  {
300 	UDP_MOD_ID, UDP_MOD_NAME, 1, INFPSZ, UDP_RECV_HIWATER, UDP_RECV_LOWATER
301 };
302 
303 /*
304  * Entry points for UDP as a device.
305  * We have separate open functions for the /dev/udp and /dev/udp6 devices.
306  */
307 static struct qinit udp_rinitv4 = {
308 	NULL, NULL, udp_openv4, udp_tpi_close, NULL,
309 	&udp_mod_info, NULL, udp_rrw, udp_rinfop, STRUIOT_STANDARD
310 };
311 
312 static struct qinit udp_rinitv6 = {
313 	NULL, NULL, udp_openv6, udp_tpi_close, NULL,
314 	&udp_mod_info, NULL, udp_rrw, udp_rinfop, STRUIOT_STANDARD
315 };
316 
317 static struct qinit udp_winit = {
318 	(pfi_t)udp_wput, (pfi_t)ip_wsrv, NULL, NULL, NULL,
319 	&udp_mod_info, NULL, NULL, NULL, STRUIOT_NONE
320 };
321 
322 /* UDP entry point during fallback */
323 struct qinit udp_fallback_sock_winit = {
324 	(pfi_t)udp_wput_fallback, NULL, NULL, NULL, NULL, &udp_mod_info
325 };
326 
327 /*
328  * UDP needs to handle I_LINK and I_PLINK since ifconfig
329  * likes to use it as a place to hang the various streams.
330  */
331 static struct qinit udp_lrinit = {
332 	(pfi_t)udp_lrput, NULL, udp_openv4, udp_tpi_close, NULL,
333 	&udp_mod_info
334 };
335 
336 static struct qinit udp_lwinit = {
337 	(pfi_t)udp_lwput, NULL, udp_openv4, udp_tpi_close, NULL,
338 	&udp_mod_info
339 };
340 
341 /* For AF_INET aka /dev/udp */
342 struct streamtab udpinfov4 = {
343 	&udp_rinitv4, &udp_winit, &udp_lrinit, &udp_lwinit
344 };
345 
346 /* For AF_INET6 aka /dev/udp6 */
347 struct streamtab udpinfov6 = {
348 	&udp_rinitv6, &udp_winit, &udp_lrinit, &udp_lwinit
349 };
350 
351 static	sin_t	sin_null;	/* Zero address for quick clears */
352 static	sin6_t	sin6_null;	/* Zero address for quick clears */
353 
354 #define	UDP_MAXPACKET_IPV4 (IP_MAXPACKET - UDPH_SIZE - IP_SIMPLE_HDR_LENGTH)
355 
356 /* Default structure copied into T_INFO_ACK messages */
357 static struct T_info_ack udp_g_t_info_ack_ipv4 = {
358 	T_INFO_ACK,
359 	UDP_MAXPACKET_IPV4,	/* TSDU_size. Excl. headers */
360 	T_INVALID,	/* ETSU_size.  udp does not support expedited data. */
361 	T_INVALID,	/* CDATA_size. udp does not support connect data. */
362 	T_INVALID,	/* DDATA_size. udp does not support disconnect data. */
363 	sizeof (sin_t),	/* ADDR_size. */
364 	0,		/* OPT_size - not initialized here */
365 	UDP_MAXPACKET_IPV4,	/* TIDU_size.  Excl. headers */
366 	T_CLTS,		/* SERV_type.  udp supports connection-less. */
367 	TS_UNBND,	/* CURRENT_state.  This is set from udp_state. */
368 	(XPG4_1|SENDZERO) /* PROVIDER_flag */
369 };
370 
371 #define	UDP_MAXPACKET_IPV6 (IP_MAXPACKET - UDPH_SIZE - IPV6_HDR_LEN)
372 
373 static	struct T_info_ack udp_g_t_info_ack_ipv6 = {
374 	T_INFO_ACK,
375 	UDP_MAXPACKET_IPV6,	/* TSDU_size.  Excl. headers */
376 	T_INVALID,	/* ETSU_size.  udp does not support expedited data. */
377 	T_INVALID,	/* CDATA_size. udp does not support connect data. */
378 	T_INVALID,	/* DDATA_size. udp does not support disconnect data. */
379 	sizeof (sin6_t), /* ADDR_size. */
380 	0,		/* OPT_size - not initialized here */
381 	UDP_MAXPACKET_IPV6,	/* TIDU_size. Excl. headers */
382 	T_CLTS,		/* SERV_type.  udp supports connection-less. */
383 	TS_UNBND,	/* CURRENT_state.  This is set from udp_state. */
384 	(XPG4_1|SENDZERO) /* PROVIDER_flag */
385 };
386 
387 /* largest UDP port number */
388 #define	UDP_MAX_PORT	65535
389 
390 /*
391  * Table of ND variables supported by udp.  These are loaded into us_nd
392  * in udp_open.
393  * All of these are alterable, within the min/max values given, at run time.
394  */
395 /* BEGIN CSTYLED */
396 udpparam_t udp_param_arr[] = {
397  /*min		max		value		name */
398  { 0L,		256,		32,		"udp_wroff_extra" },
399  { 1L,		255,		255,		"udp_ipv4_ttl" },
400  { 0,		IPV6_MAX_HOPS,	IPV6_DEFAULT_HOPS, "udp_ipv6_hoplimit"},
401  { 1024,	(32 * 1024),	1024,		"udp_smallest_nonpriv_port" },
402  { 0,		1,		1,		"udp_do_checksum" },
403  { 1024,	UDP_MAX_PORT,	(32 * 1024),	"udp_smallest_anon_port" },
404  { 1024,	UDP_MAX_PORT,	UDP_MAX_PORT,	"udp_largest_anon_port" },
405  { UDP_XMIT_LOWATER, (1<<30), UDP_XMIT_HIWATER,	"udp_xmit_hiwat"},
406  { 0,		     (1<<30), UDP_XMIT_LOWATER, "udp_xmit_lowat"},
407  { UDP_RECV_LOWATER, (1<<30), UDP_RECV_HIWATER,	"udp_recv_hiwat"},
408  { 65536,	(1<<30),	2*1024*1024,	"udp_max_buf"},
409  { 100,		60000,		1000,		"udp_ndd_get_info_interval"},
410 };
411 /* END CSTYLED */
412 
413 /* Setable in /etc/system */
414 /* If set to 0, pick ephemeral port sequentially; otherwise randomly. */
415 uint32_t udp_random_anon_port = 1;
416 
417 /*
418  * Hook functions to enable cluster networking.
419  * On non-clustered systems these vectors must always be NULL
420  */
421 
422 void (*cl_inet_bind)(netstackid_t stack_id, uchar_t protocol,
423     sa_family_t addr_family, uint8_t *laddrp, in_port_t lport,
424     void *args) = NULL;
425 void (*cl_inet_unbind)(netstackid_t stack_id, uint8_t protocol,
426     sa_family_t addr_family, uint8_t *laddrp, in_port_t lport,
427     void *args) = NULL;
428 
429 typedef union T_primitives *t_primp_t;
430 
431 /*
432  * Return the next anonymous port in the privileged port range for
433  * bind checking.
434  *
435  * Trusted Extension (TX) notes: TX allows administrator to mark or
436  * reserve ports as Multilevel ports (MLP). MLP has special function
437  * on TX systems. Once a port is made MLP, it's not available as
438  * ordinary port. This creates "holes" in the port name space. It
439  * may be necessary to skip the "holes" find a suitable anon port.
440  */
441 static in_port_t
442 udp_get_next_priv_port(udp_t *udp)
443 {
444 	static in_port_t next_priv_port = IPPORT_RESERVED - 1;
445 	in_port_t nextport;
446 	boolean_t restart = B_FALSE;
447 	udp_stack_t *us = udp->udp_us;
448 
449 retry:
450 	if (next_priv_port < us->us_min_anonpriv_port ||
451 	    next_priv_port >= IPPORT_RESERVED) {
452 		next_priv_port = IPPORT_RESERVED - 1;
453 		if (restart)
454 			return (0);
455 		restart = B_TRUE;
456 	}
457 
458 	if (is_system_labeled() &&
459 	    (nextport = tsol_next_port(crgetzone(udp->udp_connp->conn_cred),
460 	    next_priv_port, IPPROTO_UDP, B_FALSE)) != 0) {
461 		next_priv_port = nextport;
462 		goto retry;
463 	}
464 
465 	return (next_priv_port--);
466 }
467 
468 /* UDP bind hash report triggered via the Named Dispatch mechanism. */
469 /* ARGSUSED */
470 static int
471 udp_bind_hash_report(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr)
472 {
473 	udp_fanout_t	*udpf;
474 	int		i;
475 	zoneid_t	zoneid;
476 	conn_t		*connp;
477 	udp_t		*udp;
478 	udp_stack_t	*us;
479 
480 	connp = Q_TO_CONN(q);
481 	udp = connp->conn_udp;
482 	us = udp->udp_us;
483 
484 	/* Refer to comments in udp_status_report(). */
485 	if (cr == NULL || secpolicy_ip_config(cr, B_TRUE) != 0) {
486 		if (ddi_get_lbolt() - us->us_last_ndd_get_info_time <
487 		    drv_usectohz(us->us_ndd_get_info_interval * 1000)) {
488 			(void) mi_mpprintf(mp, NDD_TOO_QUICK_MSG);
489 			return (0);
490 		}
491 	}
492 	if ((mp->b_cont = allocb(ND_MAX_BUF_LEN, BPRI_HI)) == NULL) {
493 		/* The following may work even if we cannot get a large buf. */
494 		(void) mi_mpprintf(mp, NDD_OUT_OF_BUF_MSG);
495 		return (0);
496 	}
497 
498 	(void) mi_mpprintf(mp,
499 	    "UDP     " MI_COL_HDRPAD_STR
500 	/*   12345678[89ABCDEF] */
501 	    " zone lport src addr        dest addr       port  state");
502 	/*    1234 12345 xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx 12345 UNBOUND */
503 
504 	zoneid = connp->conn_zoneid;
505 
506 	for (i = 0; i < us->us_bind_fanout_size; i++) {
507 		udpf = &us->us_bind_fanout[i];
508 		mutex_enter(&udpf->uf_lock);
509 
510 		/* Print the hash index. */
511 		udp = udpf->uf_udp;
512 		if (zoneid != GLOBAL_ZONEID) {
513 			/* skip to first entry in this zone; might be none */
514 			while (udp != NULL &&
515 			    udp->udp_connp->conn_zoneid != zoneid)
516 				udp = udp->udp_bind_hash;
517 		}
518 		if (udp != NULL) {
519 			uint_t print_len, buf_len;
520 
521 			buf_len = mp->b_cont->b_datap->db_lim -
522 			    mp->b_cont->b_wptr;
523 			print_len = snprintf((char *)mp->b_cont->b_wptr,
524 			    buf_len, "%d\n", i);
525 			if (print_len < buf_len) {
526 				mp->b_cont->b_wptr += print_len;
527 			} else {
528 				mp->b_cont->b_wptr += buf_len;
529 			}
530 			for (; udp != NULL; udp = udp->udp_bind_hash) {
531 				if (zoneid == GLOBAL_ZONEID ||
532 				    zoneid == udp->udp_connp->conn_zoneid)
533 					udp_report_item(mp->b_cont, udp);
534 			}
535 		}
536 		mutex_exit(&udpf->uf_lock);
537 	}
538 	us->us_last_ndd_get_info_time = ddi_get_lbolt();
539 	return (0);
540 }
541 
542 /*
543  * Hash list removal routine for udp_t structures.
544  */
545 static void
546 udp_bind_hash_remove(udp_t *udp, boolean_t caller_holds_lock)
547 {
548 	udp_t	*udpnext;
549 	kmutex_t *lockp;
550 	udp_stack_t *us = udp->udp_us;
551 
552 	if (udp->udp_ptpbhn == NULL)
553 		return;
554 
555 	/*
556 	 * Extract the lock pointer in case there are concurrent
557 	 * hash_remove's for this instance.
558 	 */
559 	ASSERT(udp->udp_port != 0);
560 	if (!caller_holds_lock) {
561 		lockp = &us->us_bind_fanout[UDP_BIND_HASH(udp->udp_port,
562 		    us->us_bind_fanout_size)].uf_lock;
563 		ASSERT(lockp != NULL);
564 		mutex_enter(lockp);
565 	}
566 	if (udp->udp_ptpbhn != NULL) {
567 		udpnext = udp->udp_bind_hash;
568 		if (udpnext != NULL) {
569 			udpnext->udp_ptpbhn = udp->udp_ptpbhn;
570 			udp->udp_bind_hash = NULL;
571 		}
572 		*udp->udp_ptpbhn = udpnext;
573 		udp->udp_ptpbhn = NULL;
574 	}
575 	if (!caller_holds_lock) {
576 		mutex_exit(lockp);
577 	}
578 }
579 
580 static void
581 udp_bind_hash_insert(udp_fanout_t *uf, udp_t *udp)
582 {
583 	udp_t	**udpp;
584 	udp_t	*udpnext;
585 
586 	ASSERT(MUTEX_HELD(&uf->uf_lock));
587 	ASSERT(udp->udp_ptpbhn == NULL);
588 	udpp = &uf->uf_udp;
589 	udpnext = udpp[0];
590 	if (udpnext != NULL) {
591 		/*
592 		 * If the new udp bound to the INADDR_ANY address
593 		 * and the first one in the list is not bound to
594 		 * INADDR_ANY we skip all entries until we find the
595 		 * first one bound to INADDR_ANY.
596 		 * This makes sure that applications binding to a
597 		 * specific address get preference over those binding to
598 		 * INADDR_ANY.
599 		 */
600 		if (V6_OR_V4_INADDR_ANY(udp->udp_bound_v6src) &&
601 		    !V6_OR_V4_INADDR_ANY(udpnext->udp_bound_v6src)) {
602 			while ((udpnext = udpp[0]) != NULL &&
603 			    !V6_OR_V4_INADDR_ANY(
604 			    udpnext->udp_bound_v6src)) {
605 				udpp = &(udpnext->udp_bind_hash);
606 			}
607 			if (udpnext != NULL)
608 				udpnext->udp_ptpbhn = &udp->udp_bind_hash;
609 		} else {
610 			udpnext->udp_ptpbhn = &udp->udp_bind_hash;
611 		}
612 	}
613 	udp->udp_bind_hash = udpnext;
614 	udp->udp_ptpbhn = udpp;
615 	udpp[0] = udp;
616 }
617 
618 /*
619  * This routine is called to handle each O_T_BIND_REQ/T_BIND_REQ message
620  * passed to udp_wput.
621  * It associates a port number and local address with the stream.
622  * The O_T_BIND_REQ/T_BIND_REQ is passed downstream to ip with the UDP
623  * protocol type (IPPROTO_UDP) placed in the message following the address.
624  * A T_BIND_ACK message is passed upstream when ip acknowledges the request.
625  * (Called as writer.)
626  *
627  * Note that UDP over IPv4 and IPv6 sockets can use the same port number
628  * without setting SO_REUSEADDR. This is needed so that they
629  * can be viewed as two independent transport protocols.
630  * However, anonymouns ports are allocated from the same range to avoid
631  * duplicating the us->us_next_port_to_try.
632  */
633 static void
634 udp_tpi_bind(queue_t *q, mblk_t *mp)
635 {
636 	sin_t		*sin;
637 	sin6_t		*sin6;
638 	mblk_t		*mp1;
639 	struct T_bind_req *tbr;
640 	conn_t		*connp;
641 	udp_t		*udp;
642 	int		error;
643 	struct sockaddr	*sa;
644 	cred_t		*cr;
645 
646 	/*
647 	 * All Solaris components should pass a db_credp
648 	 * for this TPI message, hence we ASSERT.
649 	 * But in case there is some other M_PROTO that looks
650 	 * like a TPI message sent by some other kernel
651 	 * component, we check and return an error.
652 	 */
653 	cr = msg_getcred(mp, NULL);
654 	ASSERT(cr != NULL);
655 	if (cr == NULL) {
656 		udp_err_ack(q, mp, TSYSERR, EINVAL);
657 		return;
658 	}
659 
660 	connp = Q_TO_CONN(q);
661 	udp = connp->conn_udp;
662 	if ((mp->b_wptr - mp->b_rptr) < sizeof (*tbr)) {
663 		(void) mi_strlog(q, 1, SL_ERROR|SL_TRACE,
664 		    "udp_bind: bad req, len %u",
665 		    (uint_t)(mp->b_wptr - mp->b_rptr));
666 		udp_err_ack(q, mp, TPROTO, 0);
667 		return;
668 	}
669 	if (udp->udp_state != TS_UNBND) {
670 		(void) mi_strlog(q, 1, SL_ERROR|SL_TRACE,
671 		    "udp_bind: bad state, %u", udp->udp_state);
672 		udp_err_ack(q, mp, TOUTSTATE, 0);
673 		return;
674 	}
675 	/*
676 	 * Reallocate the message to make sure we have enough room for an
677 	 * address and the protocol type.
678 	 */
679 	mp1 = reallocb(mp, sizeof (struct T_bind_ack) + sizeof (sin6_t) + 1, 1);
680 	if (!mp1) {
681 		udp_err_ack(q, mp, TSYSERR, ENOMEM);
682 		return;
683 	}
684 
685 	mp = mp1;
686 
687 	/* Reset the message type in preparation for shipping it back. */
688 	DB_TYPE(mp) = M_PCPROTO;
689 
690 	tbr = (struct T_bind_req *)mp->b_rptr;
691 	switch (tbr->ADDR_length) {
692 	case 0:			/* Request for a generic port */
693 		tbr->ADDR_offset = sizeof (struct T_bind_req);
694 		if (udp->udp_family == AF_INET) {
695 			tbr->ADDR_length = sizeof (sin_t);
696 			sin = (sin_t *)&tbr[1];
697 			*sin = sin_null;
698 			sin->sin_family = AF_INET;
699 			mp->b_wptr = (uchar_t *)&sin[1];
700 			sa = (struct sockaddr *)sin;
701 		} else {
702 			ASSERT(udp->udp_family == AF_INET6);
703 			tbr->ADDR_length = sizeof (sin6_t);
704 			sin6 = (sin6_t *)&tbr[1];
705 			*sin6 = sin6_null;
706 			sin6->sin6_family = AF_INET6;
707 			mp->b_wptr = (uchar_t *)&sin6[1];
708 			sa = (struct sockaddr *)sin6;
709 		}
710 		break;
711 
712 	case sizeof (sin_t):	/* Complete IPv4 address */
713 		sa = (struct sockaddr *)mi_offset_param(mp, tbr->ADDR_offset,
714 		    sizeof (sin_t));
715 		if (sa == NULL || !OK_32PTR((char *)sa)) {
716 			udp_err_ack(q, mp, TSYSERR, EINVAL);
717 			return;
718 		}
719 		if (udp->udp_family != AF_INET ||
720 		    sa->sa_family != AF_INET) {
721 			udp_err_ack(q, mp, TSYSERR, EAFNOSUPPORT);
722 			return;
723 		}
724 		break;
725 
726 	case sizeof (sin6_t):	/* complete IPv6 address */
727 		sa = (struct sockaddr *)mi_offset_param(mp, tbr->ADDR_offset,
728 		    sizeof (sin6_t));
729 		if (sa == NULL || !OK_32PTR((char *)sa)) {
730 			udp_err_ack(q, mp, TSYSERR, EINVAL);
731 			return;
732 		}
733 		if (udp->udp_family != AF_INET6 ||
734 		    sa->sa_family != AF_INET6) {
735 			udp_err_ack(q, mp, TSYSERR, EAFNOSUPPORT);
736 			return;
737 		}
738 		break;
739 
740 	default:		/* Invalid request */
741 		(void) mi_strlog(q, 1, SL_ERROR|SL_TRACE,
742 		    "udp_bind: bad ADDR_length length %u", tbr->ADDR_length);
743 		udp_err_ack(q, mp, TBADADDR, 0);
744 		return;
745 	}
746 
747 	error = udp_do_bind(connp, sa, tbr->ADDR_length, cr,
748 	    tbr->PRIM_type != O_T_BIND_REQ);
749 
750 	if (error != 0) {
751 		if (error > 0) {
752 			udp_err_ack(q, mp, TSYSERR, error);
753 		} else {
754 			udp_err_ack(q, mp, -error, 0);
755 		}
756 	} else {
757 		tbr->PRIM_type = T_BIND_ACK;
758 		qreply(q, mp);
759 	}
760 }
761 
762 /*
763  * This routine handles each T_CONN_REQ message passed to udp.  It
764  * associates a default destination address with the stream.
765  *
766  * This routine sends down a T_BIND_REQ to IP with the following mblks:
767  *	T_BIND_REQ	- specifying local and remote address/port
768  *	IRE_DB_REQ_TYPE	- to get an IRE back containing ire_type and src
769  *	T_OK_ACK	- for the T_CONN_REQ
770  *	T_CONN_CON	- to keep the TPI user happy
771  *
772  * The connect completes in udp_do_connect.
773  * When a T_BIND_ACK is received information is extracted from the IRE
774  * and the two appended messages are sent to the TPI user.
775  * Should udp_bind_result receive T_ERROR_ACK for the T_BIND_REQ it will
776  * convert it to an error ack for the appropriate primitive.
777  */
778 static void
779 udp_tpi_connect(queue_t *q, mblk_t *mp)
780 {
781 	mblk_t	*mp1;
782 	udp_t	*udp;
783 	conn_t	*connp = Q_TO_CONN(q);
784 	int	error;
785 	socklen_t	len;
786 	struct sockaddr		*sa;
787 	struct T_conn_req	*tcr;
788 	cred_t		*cr;
789 
790 	/*
791 	 * All Solaris components should pass a db_credp
792 	 * for this TPI message, hence we ASSERT.
793 	 * But in case there is some other M_PROTO that looks
794 	 * like a TPI message sent by some other kernel
795 	 * component, we check and return an error.
796 	 */
797 	cr = msg_getcred(mp, NULL);
798 	ASSERT(cr != NULL);
799 	if (cr == NULL) {
800 		udp_err_ack(q, mp, TSYSERR, EINVAL);
801 		return;
802 	}
803 
804 	udp = connp->conn_udp;
805 	tcr = (struct T_conn_req *)mp->b_rptr;
806 
807 	/* A bit of sanity checking */
808 	if ((mp->b_wptr - mp->b_rptr) < sizeof (struct T_conn_req)) {
809 		udp_err_ack(q, mp, TPROTO, 0);
810 		return;
811 	}
812 
813 	if (tcr->OPT_length != 0) {
814 		udp_err_ack(q, mp, TBADOPT, 0);
815 		return;
816 	}
817 
818 	/*
819 	 * Determine packet type based on type of address passed in
820 	 * the request should contain an IPv4 or IPv6 address.
821 	 * Make sure that address family matches the type of
822 	 * family of the the address passed down
823 	 */
824 	len = tcr->DEST_length;
825 	switch (tcr->DEST_length) {
826 	default:
827 		udp_err_ack(q, mp, TBADADDR, 0);
828 		return;
829 
830 	case sizeof (sin_t):
831 		sa = (struct sockaddr *)mi_offset_param(mp, tcr->DEST_offset,
832 		    sizeof (sin_t));
833 		break;
834 
835 	case sizeof (sin6_t):
836 		sa = (struct sockaddr *)mi_offset_param(mp, tcr->DEST_offset,
837 		    sizeof (sin6_t));
838 		break;
839 	}
840 
841 	error = proto_verify_ip_addr(udp->udp_family, sa, len);
842 	if (error != 0) {
843 		udp_err_ack(q, mp, TSYSERR, error);
844 		return;
845 	}
846 
847 	/*
848 	 * We have to send a connection confirmation to
849 	 * keep TLI happy.
850 	 */
851 	if (udp->udp_family == AF_INET) {
852 		mp1 = mi_tpi_conn_con(NULL, (char *)sa,
853 		    sizeof (sin_t), NULL, 0);
854 	} else {
855 		mp1 = mi_tpi_conn_con(NULL, (char *)sa,
856 		    sizeof (sin6_t), NULL, 0);
857 	}
858 	if (mp1 == NULL) {
859 		udp_err_ack(q, mp, TSYSERR, ENOMEM);
860 		return;
861 	}
862 
863 	/*
864 	 * ok_ack for T_CONN_REQ
865 	 */
866 	mp = mi_tpi_ok_ack_alloc(mp);
867 	if (mp == NULL) {
868 		/* Unable to reuse the T_CONN_REQ for the ack. */
869 		freemsg(mp1);
870 		udp_err_ack_prim(q, mp1, T_CONN_REQ, TSYSERR, ENOMEM);
871 		return;
872 	}
873 
874 	error = udp_do_connect(connp, sa, len, cr);
875 	if (error != 0) {
876 		freeb(mp1);
877 		if (error < 0)
878 			udp_err_ack(q, mp, -error, 0);
879 		else
880 			udp_err_ack(q, mp, TSYSERR, error);
881 	} else {
882 		putnext(connp->conn_rq, mp);
883 		putnext(connp->conn_rq, mp1);
884 	}
885 }
886 
887 static int
888 udp_tpi_close(queue_t *q, int flags)
889 {
890 	conn_t	*connp;
891 
892 	if (flags & SO_FALLBACK) {
893 		/*
894 		 * stream is being closed while in fallback
895 		 * simply free the resources that were allocated
896 		 */
897 		inet_minor_free(WR(q)->q_ptr, (dev_t)(RD(q)->q_ptr));
898 		qprocsoff(q);
899 		goto done;
900 	}
901 
902 	connp = Q_TO_CONN(q);
903 	udp_do_close(connp);
904 done:
905 	q->q_ptr = WR(q)->q_ptr = NULL;
906 	return (0);
907 }
908 
909 /*
910  * Called in the close path to quiesce the conn
911  */
912 void
913 udp_quiesce_conn(conn_t *connp)
914 {
915 	udp_t	*udp = connp->conn_udp;
916 
917 	if (cl_inet_unbind != NULL && udp->udp_state == TS_IDLE) {
918 		/*
919 		 * Running in cluster mode - register unbind information
920 		 */
921 		if (udp->udp_ipversion == IPV4_VERSION) {
922 			(*cl_inet_unbind)(
923 			    connp->conn_netstack->netstack_stackid,
924 			    IPPROTO_UDP, AF_INET,
925 			    (uint8_t *)(&(V4_PART_OF_V6(udp->udp_v6src))),
926 			    (in_port_t)udp->udp_port, NULL);
927 		} else {
928 			(*cl_inet_unbind)(
929 			    connp->conn_netstack->netstack_stackid,
930 			    IPPROTO_UDP, AF_INET6,
931 			    (uint8_t *)(&(udp->udp_v6src)),
932 			    (in_port_t)udp->udp_port, NULL);
933 		}
934 	}
935 
936 	udp_bind_hash_remove(udp, B_FALSE);
937 
938 }
939 
940 void
941 udp_close_free(conn_t *connp)
942 {
943 	udp_t *udp = connp->conn_udp;
944 
945 	/* If there are any options associated with the stream, free them. */
946 	if (udp->udp_ip_snd_options != NULL) {
947 		mi_free((char *)udp->udp_ip_snd_options);
948 		udp->udp_ip_snd_options = NULL;
949 		udp->udp_ip_snd_options_len = 0;
950 	}
951 
952 	if (udp->udp_ip_rcv_options != NULL) {
953 		mi_free((char *)udp->udp_ip_rcv_options);
954 		udp->udp_ip_rcv_options = NULL;
955 		udp->udp_ip_rcv_options_len = 0;
956 	}
957 
958 	/* Free memory associated with sticky options */
959 	if (udp->udp_sticky_hdrs_len != 0) {
960 		kmem_free(udp->udp_sticky_hdrs,
961 		    udp->udp_sticky_hdrs_len);
962 		udp->udp_sticky_hdrs = NULL;
963 		udp->udp_sticky_hdrs_len = 0;
964 	}
965 
966 	ip6_pkt_free(&udp->udp_sticky_ipp);
967 
968 	/*
969 	 * Clear any fields which the kmem_cache constructor clears.
970 	 * Only udp_connp needs to be preserved.
971 	 * TBD: We should make this more efficient to avoid clearing
972 	 * everything.
973 	 */
974 	ASSERT(udp->udp_connp == connp);
975 	bzero(udp, sizeof (udp_t));
976 	udp->udp_connp = connp;
977 }
978 
979 static int
980 udp_do_disconnect(conn_t *connp)
981 {
982 	udp_t	*udp;
983 	mblk_t	*ire_mp;
984 	udp_fanout_t *udpf;
985 	udp_stack_t *us;
986 	int	error;
987 
988 	udp = connp->conn_udp;
989 	us = udp->udp_us;
990 	rw_enter(&udp->udp_rwlock, RW_WRITER);
991 	if (udp->udp_state != TS_DATA_XFER || udp->udp_pending_op != -1) {
992 		rw_exit(&udp->udp_rwlock);
993 		return (-TOUTSTATE);
994 	}
995 	udp->udp_pending_op = T_DISCON_REQ;
996 	udpf = &us->us_bind_fanout[UDP_BIND_HASH(udp->udp_port,
997 	    us->us_bind_fanout_size)];
998 	mutex_enter(&udpf->uf_lock);
999 	udp->udp_v6src = udp->udp_bound_v6src;
1000 	udp->udp_state = TS_IDLE;
1001 	mutex_exit(&udpf->uf_lock);
1002 
1003 	if (udp->udp_family == AF_INET6) {
1004 		/* Rebuild the header template */
1005 		error = udp_build_hdrs(udp);
1006 		if (error != 0) {
1007 			udp->udp_pending_op = -1;
1008 			rw_exit(&udp->udp_rwlock);
1009 			return (error);
1010 		}
1011 	}
1012 
1013 	ire_mp = allocb(sizeof (ire_t), BPRI_HI);
1014 	if (ire_mp == NULL) {
1015 		mutex_enter(&udpf->uf_lock);
1016 		udp->udp_pending_op = -1;
1017 		mutex_exit(&udpf->uf_lock);
1018 		rw_exit(&udp->udp_rwlock);
1019 		return (ENOMEM);
1020 	}
1021 
1022 	rw_exit(&udp->udp_rwlock);
1023 
1024 	if (udp->udp_family == AF_INET6) {
1025 		error = ip_proto_bind_laddr_v6(connp, &ire_mp, IPPROTO_UDP,
1026 		    &udp->udp_bound_v6src, udp->udp_port, B_TRUE);
1027 	} else {
1028 		error = ip_proto_bind_laddr_v4(connp, &ire_mp, IPPROTO_UDP,
1029 		    V4_PART_OF_V6(udp->udp_bound_v6src), udp->udp_port, B_TRUE);
1030 	}
1031 
1032 	return (udp_post_ip_bind_connect(udp, ire_mp, error));
1033 }
1034 
1035 
1036 static void
1037 udp_tpi_disconnect(queue_t *q, mblk_t *mp)
1038 {
1039 	conn_t	*connp = Q_TO_CONN(q);
1040 	int	error;
1041 
1042 	/*
1043 	 * Allocate the largest primitive we need to send back
1044 	 * T_error_ack is > than T_ok_ack
1045 	 */
1046 	mp = reallocb(mp, sizeof (struct T_error_ack), 1);
1047 	if (mp == NULL) {
1048 		/* Unable to reuse the T_DISCON_REQ for the ack. */
1049 		udp_err_ack_prim(q, mp, T_DISCON_REQ, TSYSERR, ENOMEM);
1050 		return;
1051 	}
1052 
1053 	error = udp_do_disconnect(connp);
1054 
1055 	if (error != 0) {
1056 		if (error < 0) {
1057 			udp_err_ack(q, mp, -error, 0);
1058 		} else {
1059 			udp_err_ack(q, mp, TSYSERR, error);
1060 		}
1061 	} else {
1062 		mp = mi_tpi_ok_ack_alloc(mp);
1063 		ASSERT(mp != NULL);
1064 		qreply(q, mp);
1065 	}
1066 }
1067 
1068 int
1069 udp_disconnect(conn_t *connp)
1070 {
1071 	int error;
1072 	udp_t *udp = connp->conn_udp;
1073 
1074 	udp->udp_dgram_errind = B_FALSE;
1075 
1076 	error = udp_do_disconnect(connp);
1077 
1078 	if (error < 0)
1079 		error = proto_tlitosyserr(-error);
1080 
1081 	return (error);
1082 }
1083 
1084 /* This routine creates a T_ERROR_ACK message and passes it upstream. */
1085 static void
1086 udp_err_ack(queue_t *q, mblk_t *mp, t_scalar_t t_error, int sys_error)
1087 {
1088 	if ((mp = mi_tpi_err_ack_alloc(mp, t_error, sys_error)) != NULL)
1089 		qreply(q, mp);
1090 }
1091 
1092 /* Shorthand to generate and send TPI error acks to our client */
1093 static void
1094 udp_err_ack_prim(queue_t *q, mblk_t *mp, int primitive, t_scalar_t t_error,
1095     int sys_error)
1096 {
1097 	struct T_error_ack	*teackp;
1098 
1099 	if ((mp = tpi_ack_alloc(mp, sizeof (struct T_error_ack),
1100 	    M_PCPROTO, T_ERROR_ACK)) != NULL) {
1101 		teackp = (struct T_error_ack *)mp->b_rptr;
1102 		teackp->ERROR_prim = primitive;
1103 		teackp->TLI_error = t_error;
1104 		teackp->UNIX_error = sys_error;
1105 		qreply(q, mp);
1106 	}
1107 }
1108 
1109 /*ARGSUSED*/
1110 static int
1111 udp_extra_priv_ports_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr)
1112 {
1113 	int i;
1114 	udp_t		*udp = Q_TO_UDP(q);
1115 	udp_stack_t *us = udp->udp_us;
1116 
1117 	for (i = 0; i < us->us_num_epriv_ports; i++) {
1118 		if (us->us_epriv_ports[i] != 0)
1119 			(void) mi_mpprintf(mp, "%d ", us->us_epriv_ports[i]);
1120 	}
1121 	return (0);
1122 }
1123 
1124 /* ARGSUSED */
1125 static int
1126 udp_extra_priv_ports_add(queue_t *q, mblk_t *mp, char *value, caddr_t cp,
1127     cred_t *cr)
1128 {
1129 	long	new_value;
1130 	int	i;
1131 	udp_t		*udp = Q_TO_UDP(q);
1132 	udp_stack_t *us = udp->udp_us;
1133 
1134 	/*
1135 	 * Fail the request if the new value does not lie within the
1136 	 * port number limits.
1137 	 */
1138 	if (ddi_strtol(value, NULL, 10, &new_value) != 0 ||
1139 	    new_value <= 0 || new_value >= 65536) {
1140 		return (EINVAL);
1141 	}
1142 
1143 	/* Check if the value is already in the list */
1144 	for (i = 0; i < us->us_num_epriv_ports; i++) {
1145 		if (new_value == us->us_epriv_ports[i]) {
1146 			return (EEXIST);
1147 		}
1148 	}
1149 	/* Find an empty slot */
1150 	for (i = 0; i < us->us_num_epriv_ports; i++) {
1151 		if (us->us_epriv_ports[i] == 0)
1152 			break;
1153 	}
1154 	if (i == us->us_num_epriv_ports) {
1155 		return (EOVERFLOW);
1156 	}
1157 
1158 	/* Set the new value */
1159 	us->us_epriv_ports[i] = (in_port_t)new_value;
1160 	return (0);
1161 }
1162 
1163 /* ARGSUSED */
1164 static int
1165 udp_extra_priv_ports_del(queue_t *q, mblk_t *mp, char *value, caddr_t cp,
1166     cred_t *cr)
1167 {
1168 	long	new_value;
1169 	int	i;
1170 	udp_t		*udp = Q_TO_UDP(q);
1171 	udp_stack_t *us = udp->udp_us;
1172 
1173 	/*
1174 	 * Fail the request if the new value does not lie within the
1175 	 * port number limits.
1176 	 */
1177 	if (ddi_strtol(value, NULL, 10, &new_value) != 0 ||
1178 	    new_value <= 0 || new_value >= 65536) {
1179 		return (EINVAL);
1180 	}
1181 
1182 	/* Check that the value is already in the list */
1183 	for (i = 0; i < us->us_num_epriv_ports; i++) {
1184 		if (us->us_epriv_ports[i] == new_value)
1185 			break;
1186 	}
1187 	if (i == us->us_num_epriv_ports) {
1188 		return (ESRCH);
1189 	}
1190 
1191 	/* Clear the value */
1192 	us->us_epriv_ports[i] = 0;
1193 	return (0);
1194 }
1195 
1196 /* At minimum we need 4 bytes of UDP header */
1197 #define	ICMP_MIN_UDP_HDR	4
1198 
1199 /*
1200  * udp_icmp_error is called by udp_input to process ICMP msgs. passed up by IP.
1201  * Generates the appropriate T_UDERROR_IND for permanent (non-transient) errors.
1202  * Assumes that IP has pulled up everything up to and including the ICMP header.
1203  */
1204 static void
1205 udp_icmp_error(conn_t *connp, mblk_t *mp)
1206 			    {
1207 	icmph_t *icmph;
1208 	ipha_t	*ipha;
1209 	int	iph_hdr_length;
1210 	udpha_t	*udpha;
1211 	sin_t	sin;
1212 	sin6_t	sin6;
1213 	mblk_t	*mp1;
1214 	int	error = 0;
1215 	udp_t	*udp = connp->conn_udp;
1216 
1217 	mp1 = NULL;
1218 	ipha = (ipha_t *)mp->b_rptr;
1219 
1220 	ASSERT(OK_32PTR(mp->b_rptr));
1221 
1222 	if (IPH_HDR_VERSION(ipha) != IPV4_VERSION) {
1223 		ASSERT(IPH_HDR_VERSION(ipha) == IPV6_VERSION);
1224 		udp_icmp_error_ipv6(connp, mp);
1225 		return;
1226 	}
1227 	ASSERT(IPH_HDR_VERSION(ipha) == IPV4_VERSION);
1228 
1229 	/* Skip past the outer IP and ICMP headers */
1230 	iph_hdr_length = IPH_HDR_LENGTH(ipha);
1231 	icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length];
1232 	ipha = (ipha_t *)&icmph[1];
1233 
1234 	/* Skip past the inner IP and find the ULP header */
1235 	iph_hdr_length = IPH_HDR_LENGTH(ipha);
1236 	udpha = (udpha_t *)((char *)ipha + iph_hdr_length);
1237 
1238 	switch (icmph->icmph_type) {
1239 	case ICMP_DEST_UNREACHABLE:
1240 		switch (icmph->icmph_code) {
1241 		case ICMP_FRAGMENTATION_NEEDED:
1242 			/*
1243 			 * IP has already adjusted the path MTU.
1244 			 */
1245 			break;
1246 		case ICMP_PORT_UNREACHABLE:
1247 		case ICMP_PROTOCOL_UNREACHABLE:
1248 			error = ECONNREFUSED;
1249 			break;
1250 		default:
1251 			/* Transient errors */
1252 			break;
1253 		}
1254 		break;
1255 	default:
1256 		/* Transient errors */
1257 		break;
1258 	}
1259 	if (error == 0) {
1260 		freemsg(mp);
1261 		return;
1262 	}
1263 
1264 	/*
1265 	 * Deliver T_UDERROR_IND when the application has asked for it.
1266 	 * The socket layer enables this automatically when connected.
1267 	 */
1268 	if (!udp->udp_dgram_errind) {
1269 		freemsg(mp);
1270 		return;
1271 	}
1272 
1273 
1274 	switch (udp->udp_family) {
1275 	case AF_INET:
1276 		sin = sin_null;
1277 		sin.sin_family = AF_INET;
1278 		sin.sin_addr.s_addr = ipha->ipha_dst;
1279 		sin.sin_port = udpha->uha_dst_port;
1280 		if (IPCL_IS_NONSTR(connp)) {
1281 			rw_enter(&udp->udp_rwlock, RW_WRITER);
1282 			if (udp->udp_state == TS_DATA_XFER) {
1283 				if (sin.sin_port == udp->udp_dstport &&
1284 				    sin.sin_addr.s_addr ==
1285 				    V4_PART_OF_V6(udp->udp_v6dst)) {
1286 
1287 					rw_exit(&udp->udp_rwlock);
1288 					(*connp->conn_upcalls->su_set_error)
1289 					    (connp->conn_upper_handle, error);
1290 					goto done;
1291 				}
1292 			} else {
1293 				udp->udp_delayed_error = error;
1294 				*((sin_t *)&udp->udp_delayed_addr) = sin;
1295 			}
1296 			rw_exit(&udp->udp_rwlock);
1297 		} else {
1298 			mp1 = mi_tpi_uderror_ind((char *)&sin, sizeof (sin_t),
1299 			    NULL, 0, error);
1300 		}
1301 		break;
1302 	case AF_INET6:
1303 		sin6 = sin6_null;
1304 		sin6.sin6_family = AF_INET6;
1305 		IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &sin6.sin6_addr);
1306 		sin6.sin6_port = udpha->uha_dst_port;
1307 		if (IPCL_IS_NONSTR(connp)) {
1308 			rw_enter(&udp->udp_rwlock, RW_WRITER);
1309 			if (udp->udp_state == TS_DATA_XFER) {
1310 				if (sin6.sin6_port == udp->udp_dstport &&
1311 				    IN6_ARE_ADDR_EQUAL(&sin6.sin6_addr,
1312 				    &udp->udp_v6dst)) {
1313 					rw_exit(&udp->udp_rwlock);
1314 					(*connp->conn_upcalls->su_set_error)
1315 					    (connp->conn_upper_handle, error);
1316 					goto done;
1317 				}
1318 			} else {
1319 				udp->udp_delayed_error = error;
1320 				*((sin6_t *)&udp->udp_delayed_addr) = sin6;
1321 			}
1322 			rw_exit(&udp->udp_rwlock);
1323 		} else {
1324 
1325 			mp1 = mi_tpi_uderror_ind((char *)&sin6, sizeof (sin6_t),
1326 			    NULL, 0, error);
1327 		}
1328 		break;
1329 	}
1330 	if (mp1 != NULL)
1331 		putnext(connp->conn_rq, mp1);
1332 done:
1333 	freemsg(mp);
1334 }
1335 
1336 /*
1337  * udp_icmp_error_ipv6 is called by udp_icmp_error to process ICMP for IPv6.
1338  * Generates the appropriate T_UDERROR_IND for permanent (non-transient) errors.
1339  * Assumes that IP has pulled up all the extension headers as well as the
1340  * ICMPv6 header.
1341  */
1342 static void
1343 udp_icmp_error_ipv6(conn_t *connp, mblk_t *mp)
1344 {
1345 	icmp6_t		*icmp6;
1346 	ip6_t		*ip6h, *outer_ip6h;
1347 	uint16_t	iph_hdr_length;
1348 	uint8_t		*nexthdrp;
1349 	udpha_t		*udpha;
1350 	sin6_t		sin6;
1351 	mblk_t		*mp1;
1352 	int		error = 0;
1353 	udp_t		*udp = connp->conn_udp;
1354 	udp_stack_t	*us = udp->udp_us;
1355 
1356 	outer_ip6h = (ip6_t *)mp->b_rptr;
1357 	if (outer_ip6h->ip6_nxt != IPPROTO_ICMPV6)
1358 		iph_hdr_length = ip_hdr_length_v6(mp, outer_ip6h);
1359 	else
1360 		iph_hdr_length = IPV6_HDR_LEN;
1361 	icmp6 = (icmp6_t *)&mp->b_rptr[iph_hdr_length];
1362 	ip6h = (ip6_t *)&icmp6[1];
1363 	if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &iph_hdr_length, &nexthdrp)) {
1364 		freemsg(mp);
1365 		return;
1366 	}
1367 	udpha = (udpha_t *)((char *)ip6h + iph_hdr_length);
1368 
1369 	switch (icmp6->icmp6_type) {
1370 	case ICMP6_DST_UNREACH:
1371 		switch (icmp6->icmp6_code) {
1372 		case ICMP6_DST_UNREACH_NOPORT:
1373 			error = ECONNREFUSED;
1374 			break;
1375 		case ICMP6_DST_UNREACH_ADMIN:
1376 		case ICMP6_DST_UNREACH_NOROUTE:
1377 		case ICMP6_DST_UNREACH_BEYONDSCOPE:
1378 		case ICMP6_DST_UNREACH_ADDR:
1379 			/* Transient errors */
1380 			break;
1381 		default:
1382 			break;
1383 		}
1384 		break;
1385 	case ICMP6_PACKET_TOO_BIG: {
1386 		struct T_unitdata_ind	*tudi;
1387 		struct T_opthdr		*toh;
1388 		size_t			udi_size;
1389 		mblk_t			*newmp;
1390 		t_scalar_t		opt_length = sizeof (struct T_opthdr) +
1391 		    sizeof (struct ip6_mtuinfo);
1392 		sin6_t			*sin6;
1393 		struct ip6_mtuinfo	*mtuinfo;
1394 
1395 		/*
1396 		 * If the application has requested to receive path mtu
1397 		 * information, send up an empty message containing an
1398 		 * IPV6_PATHMTU ancillary data item.
1399 		 */
1400 		if (!udp->udp_ipv6_recvpathmtu)
1401 			break;
1402 
1403 		udi_size = sizeof (struct T_unitdata_ind) + sizeof (sin6_t) +
1404 		    opt_length;
1405 		if ((newmp = allocb(udi_size, BPRI_MED)) == NULL) {
1406 			BUMP_MIB(&us->us_udp_mib, udpInErrors);
1407 			break;
1408 		}
1409 
1410 		/*
1411 		 * newmp->b_cont is left to NULL on purpose.  This is an
1412 		 * empty message containing only ancillary data.
1413 		 */
1414 		newmp->b_datap->db_type = M_PROTO;
1415 		tudi = (struct T_unitdata_ind *)newmp->b_rptr;
1416 		newmp->b_wptr = (uchar_t *)tudi + udi_size;
1417 		tudi->PRIM_type = T_UNITDATA_IND;
1418 		tudi->SRC_length = sizeof (sin6_t);
1419 		tudi->SRC_offset = sizeof (struct T_unitdata_ind);
1420 		tudi->OPT_offset = tudi->SRC_offset + sizeof (sin6_t);
1421 		tudi->OPT_length = opt_length;
1422 
1423 		sin6 = (sin6_t *)&tudi[1];
1424 		bzero(sin6, sizeof (sin6_t));
1425 		sin6->sin6_family = AF_INET6;
1426 		sin6->sin6_addr = udp->udp_v6dst;
1427 
1428 		toh = (struct T_opthdr *)&sin6[1];
1429 		toh->level = IPPROTO_IPV6;
1430 		toh->name = IPV6_PATHMTU;
1431 		toh->len = opt_length;
1432 		toh->status = 0;
1433 
1434 		mtuinfo = (struct ip6_mtuinfo *)&toh[1];
1435 		bzero(mtuinfo, sizeof (struct ip6_mtuinfo));
1436 		mtuinfo->ip6m_addr.sin6_family = AF_INET6;
1437 		mtuinfo->ip6m_addr.sin6_addr = ip6h->ip6_dst;
1438 		mtuinfo->ip6m_mtu = icmp6->icmp6_mtu;
1439 		/*
1440 		 * We've consumed everything we need from the original
1441 		 * message.  Free it, then send our empty message.
1442 		 */
1443 		freemsg(mp);
1444 		if (!IPCL_IS_NONSTR(connp)) {
1445 			putnext(connp->conn_rq, newmp);
1446 		} else {
1447 			(*connp->conn_upcalls->su_recv)
1448 			    (connp->conn_upper_handle, newmp, 0, 0, &error,
1449 			    NULL);
1450 		}
1451 		return;
1452 	}
1453 	case ICMP6_TIME_EXCEEDED:
1454 		/* Transient errors */
1455 		break;
1456 	case ICMP6_PARAM_PROB:
1457 		/* If this corresponds to an ICMP_PROTOCOL_UNREACHABLE */
1458 		if (icmp6->icmp6_code == ICMP6_PARAMPROB_NEXTHEADER &&
1459 		    (uchar_t *)ip6h + icmp6->icmp6_pptr ==
1460 		    (uchar_t *)nexthdrp) {
1461 			error = ECONNREFUSED;
1462 			break;
1463 		}
1464 		break;
1465 	}
1466 	if (error == 0) {
1467 		freemsg(mp);
1468 		return;
1469 	}
1470 
1471 	/*
1472 	 * Deliver T_UDERROR_IND when the application has asked for it.
1473 	 * The socket layer enables this automatically when connected.
1474 	 */
1475 	if (!udp->udp_dgram_errind) {
1476 		freemsg(mp);
1477 		return;
1478 	}
1479 
1480 	sin6 = sin6_null;
1481 	sin6.sin6_family = AF_INET6;
1482 	sin6.sin6_addr = ip6h->ip6_dst;
1483 	sin6.sin6_port = udpha->uha_dst_port;
1484 	sin6.sin6_flowinfo = ip6h->ip6_vcf & ~IPV6_VERS_AND_FLOW_MASK;
1485 
1486 	if (IPCL_IS_NONSTR(connp)) {
1487 		rw_enter(&udp->udp_rwlock, RW_WRITER);
1488 		if (udp->udp_state == TS_DATA_XFER) {
1489 			if (sin6.sin6_port == udp->udp_dstport &&
1490 			    IN6_ARE_ADDR_EQUAL(&sin6.sin6_addr,
1491 			    &udp->udp_v6dst)) {
1492 				rw_exit(&udp->udp_rwlock);
1493 				(*connp->conn_upcalls->su_set_error)
1494 				    (connp->conn_upper_handle, error);
1495 				goto done;
1496 			}
1497 		} else {
1498 			udp->udp_delayed_error = error;
1499 			*((sin6_t *)&udp->udp_delayed_addr) = sin6;
1500 		}
1501 		rw_exit(&udp->udp_rwlock);
1502 	} else {
1503 		mp1 = mi_tpi_uderror_ind((char *)&sin6, sizeof (sin6_t),
1504 		    NULL, 0, error);
1505 		if (mp1 != NULL)
1506 			putnext(connp->conn_rq, mp1);
1507 	}
1508 
1509 done:
1510 	freemsg(mp);
1511 }
1512 
1513 /*
1514  * This routine responds to T_ADDR_REQ messages.  It is called by udp_wput.
1515  * The local address is filled in if endpoint is bound. The remote address
1516  * is filled in if remote address has been precified ("connected endpoint")
1517  * (The concept of connected CLTS sockets is alien to published TPI
1518  *  but we support it anyway).
1519  */
1520 static void
1521 udp_addr_req(queue_t *q, mblk_t *mp)
1522 {
1523 	sin_t	*sin;
1524 	sin6_t	*sin6;
1525 	mblk_t	*ackmp;
1526 	struct T_addr_ack *taa;
1527 	udp_t	*udp = Q_TO_UDP(q);
1528 
1529 	/* Make it large enough for worst case */
1530 	ackmp = reallocb(mp, sizeof (struct T_addr_ack) +
1531 	    2 * sizeof (sin6_t), 1);
1532 	if (ackmp == NULL) {
1533 		udp_err_ack(q, mp, TSYSERR, ENOMEM);
1534 		return;
1535 	}
1536 	taa = (struct T_addr_ack *)ackmp->b_rptr;
1537 
1538 	bzero(taa, sizeof (struct T_addr_ack));
1539 	ackmp->b_wptr = (uchar_t *)&taa[1];
1540 
1541 	taa->PRIM_type = T_ADDR_ACK;
1542 	ackmp->b_datap->db_type = M_PCPROTO;
1543 	rw_enter(&udp->udp_rwlock, RW_READER);
1544 	/*
1545 	 * Note: Following code assumes 32 bit alignment of basic
1546 	 * data structures like sin_t and struct T_addr_ack.
1547 	 */
1548 	if (udp->udp_state != TS_UNBND) {
1549 		/*
1550 		 * Fill in local address first
1551 		 */
1552 		taa->LOCADDR_offset = sizeof (*taa);
1553 		if (udp->udp_family == AF_INET) {
1554 			taa->LOCADDR_length = sizeof (sin_t);
1555 			sin = (sin_t *)&taa[1];
1556 			/* Fill zeroes and then initialize non-zero fields */
1557 			*sin = sin_null;
1558 			sin->sin_family = AF_INET;
1559 			if (!IN6_IS_ADDR_V4MAPPED_ANY(&udp->udp_v6src) &&
1560 			    !IN6_IS_ADDR_UNSPECIFIED(&udp->udp_v6src)) {
1561 				IN6_V4MAPPED_TO_IPADDR(&udp->udp_v6src,
1562 				    sin->sin_addr.s_addr);
1563 			} else {
1564 				/*
1565 				 * INADDR_ANY
1566 				 * udp_v6src is not set, we might be bound to
1567 				 * broadcast/multicast. Use udp_bound_v6src as
1568 				 * local address instead (that could
1569 				 * also still be INADDR_ANY)
1570 				 */
1571 				IN6_V4MAPPED_TO_IPADDR(&udp->udp_bound_v6src,
1572 				    sin->sin_addr.s_addr);
1573 			}
1574 			sin->sin_port = udp->udp_port;
1575 			ackmp->b_wptr = (uchar_t *)&sin[1];
1576 			if (udp->udp_state == TS_DATA_XFER) {
1577 				/*
1578 				 * connected, fill remote address too
1579 				 */
1580 				taa->REMADDR_length = sizeof (sin_t);
1581 				/* assumed 32-bit alignment */
1582 				taa->REMADDR_offset = taa->LOCADDR_offset +
1583 				    taa->LOCADDR_length;
1584 
1585 				sin = (sin_t *)(ackmp->b_rptr +
1586 				    taa->REMADDR_offset);
1587 				/* initialize */
1588 				*sin = sin_null;
1589 				sin->sin_family = AF_INET;
1590 				sin->sin_addr.s_addr =
1591 				    V4_PART_OF_V6(udp->udp_v6dst);
1592 				sin->sin_port = udp->udp_dstport;
1593 				ackmp->b_wptr = (uchar_t *)&sin[1];
1594 			}
1595 		} else {
1596 			taa->LOCADDR_length = sizeof (sin6_t);
1597 			sin6 = (sin6_t *)&taa[1];
1598 			/* Fill zeroes and then initialize non-zero fields */
1599 			*sin6 = sin6_null;
1600 			sin6->sin6_family = AF_INET6;
1601 			if (!IN6_IS_ADDR_UNSPECIFIED(&udp->udp_v6src)) {
1602 				sin6->sin6_addr = udp->udp_v6src;
1603 			} else {
1604 				/*
1605 				 * UNSPECIFIED
1606 				 * udp_v6src is not set, we might be bound to
1607 				 * broadcast/multicast. Use udp_bound_v6src as
1608 				 * local address instead (that could
1609 				 * also still be UNSPECIFIED)
1610 				 */
1611 				sin6->sin6_addr =
1612 				    udp->udp_bound_v6src;
1613 			}
1614 			sin6->sin6_port = udp->udp_port;
1615 			ackmp->b_wptr = (uchar_t *)&sin6[1];
1616 			if (udp->udp_state == TS_DATA_XFER) {
1617 				/*
1618 				 * connected, fill remote address too
1619 				 */
1620 				taa->REMADDR_length = sizeof (sin6_t);
1621 				/* assumed 32-bit alignment */
1622 				taa->REMADDR_offset = taa->LOCADDR_offset +
1623 				    taa->LOCADDR_length;
1624 
1625 				sin6 = (sin6_t *)(ackmp->b_rptr +
1626 				    taa->REMADDR_offset);
1627 				/* initialize */
1628 				*sin6 = sin6_null;
1629 				sin6->sin6_family = AF_INET6;
1630 				sin6->sin6_addr = udp->udp_v6dst;
1631 				sin6->sin6_port =  udp->udp_dstport;
1632 				ackmp->b_wptr = (uchar_t *)&sin6[1];
1633 			}
1634 			ackmp->b_wptr = (uchar_t *)&sin6[1];
1635 		}
1636 	}
1637 	rw_exit(&udp->udp_rwlock);
1638 	ASSERT(ackmp->b_wptr <= ackmp->b_datap->db_lim);
1639 	qreply(q, ackmp);
1640 }
1641 
1642 static void
1643 udp_copy_info(struct T_info_ack *tap, udp_t *udp)
1644 {
1645 	if (udp->udp_family == AF_INET) {
1646 		*tap = udp_g_t_info_ack_ipv4;
1647 	} else {
1648 		*tap = udp_g_t_info_ack_ipv6;
1649 	}
1650 	tap->CURRENT_state = udp->udp_state;
1651 	tap->OPT_size = udp_max_optsize;
1652 }
1653 
1654 static void
1655 udp_do_capability_ack(udp_t *udp, struct T_capability_ack *tcap,
1656     t_uscalar_t cap_bits1)
1657 {
1658 	tcap->CAP_bits1 = 0;
1659 
1660 	if (cap_bits1 & TC1_INFO) {
1661 		udp_copy_info(&tcap->INFO_ack, udp);
1662 		tcap->CAP_bits1 |= TC1_INFO;
1663 	}
1664 }
1665 
1666 /*
1667  * This routine responds to T_CAPABILITY_REQ messages.  It is called by
1668  * udp_wput.  Much of the T_CAPABILITY_ACK information is copied from
1669  * udp_g_t_info_ack.  The current state of the stream is copied from
1670  * udp_state.
1671  */
1672 static void
1673 udp_capability_req(queue_t *q, mblk_t *mp)
1674 {
1675 	t_uscalar_t		cap_bits1;
1676 	struct T_capability_ack	*tcap;
1677 	udp_t	*udp = Q_TO_UDP(q);
1678 
1679 	cap_bits1 = ((struct T_capability_req *)mp->b_rptr)->CAP_bits1;
1680 
1681 	mp = tpi_ack_alloc(mp, sizeof (struct T_capability_ack),
1682 	    mp->b_datap->db_type, T_CAPABILITY_ACK);
1683 	if (!mp)
1684 		return;
1685 
1686 	tcap = (struct T_capability_ack *)mp->b_rptr;
1687 	udp_do_capability_ack(udp, tcap, cap_bits1);
1688 
1689 	qreply(q, mp);
1690 }
1691 
1692 /*
1693  * This routine responds to T_INFO_REQ messages.  It is called by udp_wput.
1694  * Most of the T_INFO_ACK information is copied from udp_g_t_info_ack.
1695  * The current state of the stream is copied from udp_state.
1696  */
1697 static void
1698 udp_info_req(queue_t *q, mblk_t *mp)
1699 {
1700 	udp_t *udp = Q_TO_UDP(q);
1701 
1702 	/* Create a T_INFO_ACK message. */
1703 	mp = tpi_ack_alloc(mp, sizeof (struct T_info_ack), M_PCPROTO,
1704 	    T_INFO_ACK);
1705 	if (!mp)
1706 		return;
1707 	udp_copy_info((struct T_info_ack *)mp->b_rptr, udp);
1708 	qreply(q, mp);
1709 }
1710 
1711 /*
1712  * IP recognizes seven kinds of bind requests:
1713  *
1714  * - A zero-length address binds only to the protocol number.
1715  *
1716  * - A 4-byte address is treated as a request to
1717  * validate that the address is a valid local IPv4
1718  * address, appropriate for an application to bind to.
1719  * IP does the verification, but does not make any note
1720  * of the address at this time.
1721  *
1722  * - A 16-byte address contains is treated as a request
1723  * to validate a local IPv6 address, as the 4-byte
1724  * address case above.
1725  *
1726  * - A 16-byte sockaddr_in to validate the local IPv4 address and also
1727  * use it for the inbound fanout of packets.
1728  *
1729  * - A 24-byte sockaddr_in6 to validate the local IPv6 address and also
1730  * use it for the inbound fanout of packets.
1731  *
1732  * - A 12-byte address (ipa_conn_t) containing complete IPv4 fanout
1733  * information consisting of local and remote addresses
1734  * and ports.  In this case, the addresses are both
1735  * validated as appropriate for this operation, and, if
1736  * so, the information is retained for use in the
1737  * inbound fanout.
1738  *
1739  * - A 36-byte address address (ipa6_conn_t) containing complete IPv6
1740  * fanout information, like the 12-byte case above.
1741  *
1742  * IP will also fill in the IRE request mblk with information
1743  * regarding our peer.  In all cases, we notify IP of our protocol
1744  * type by appending a single protocol byte to the bind request.
1745  */
1746 static mblk_t *
1747 udp_ip_bind_mp(udp_t *udp, t_scalar_t bind_prim, t_scalar_t addr_length)
1748 {
1749 	char	*cp;
1750 	mblk_t	*mp;
1751 	struct T_bind_req *tbr;
1752 	ipa_conn_t	*ac;
1753 	ipa6_conn_t	*ac6;
1754 	sin_t		*sin;
1755 	sin6_t		*sin6;
1756 
1757 	ASSERT(bind_prim == O_T_BIND_REQ || bind_prim == T_BIND_REQ);
1758 	ASSERT(RW_LOCK_HELD(&udp->udp_rwlock));
1759 	mp = allocb(sizeof (*tbr) + addr_length + 1, BPRI_HI);
1760 	if (!mp)
1761 		return (mp);
1762 	mp->b_datap->db_type = M_PROTO;
1763 	tbr = (struct T_bind_req *)mp->b_rptr;
1764 	tbr->PRIM_type = bind_prim;
1765 	tbr->ADDR_offset = sizeof (*tbr);
1766 	tbr->CONIND_number = 0;
1767 	tbr->ADDR_length = addr_length;
1768 	cp = (char *)&tbr[1];
1769 	switch (addr_length) {
1770 	case sizeof (ipa_conn_t):
1771 		ASSERT(udp->udp_family == AF_INET);
1772 		/* Append a request for an IRE */
1773 		mp->b_cont = allocb(sizeof (ire_t), BPRI_HI);
1774 		if (!mp->b_cont) {
1775 			freemsg(mp);
1776 			return (NULL);
1777 		}
1778 		mp->b_cont->b_wptr += sizeof (ire_t);
1779 		mp->b_cont->b_datap->db_type = IRE_DB_REQ_TYPE;
1780 
1781 		/* cp known to be 32 bit aligned */
1782 		ac = (ipa_conn_t *)cp;
1783 		ac->ac_laddr = V4_PART_OF_V6(udp->udp_v6src);
1784 		ac->ac_faddr = V4_PART_OF_V6(udp->udp_v6dst);
1785 		ac->ac_fport = udp->udp_dstport;
1786 		ac->ac_lport = udp->udp_port;
1787 		break;
1788 
1789 	case sizeof (ipa6_conn_t):
1790 		ASSERT(udp->udp_family == AF_INET6);
1791 		/* Append a request for an IRE */
1792 		mp->b_cont = allocb(sizeof (ire_t), BPRI_HI);
1793 		if (!mp->b_cont) {
1794 			freemsg(mp);
1795 			return (NULL);
1796 		}
1797 		mp->b_cont->b_wptr += sizeof (ire_t);
1798 		mp->b_cont->b_datap->db_type = IRE_DB_REQ_TYPE;
1799 
1800 		/* cp known to be 32 bit aligned */
1801 		ac6 = (ipa6_conn_t *)cp;
1802 		ac6->ac6_laddr = udp->udp_v6src;
1803 		ac6->ac6_faddr = udp->udp_v6dst;
1804 		ac6->ac6_fport = udp->udp_dstport;
1805 		ac6->ac6_lport = udp->udp_port;
1806 		break;
1807 
1808 	case sizeof (sin_t):
1809 		ASSERT(udp->udp_family == AF_INET);
1810 		/* Append a request for an IRE */
1811 		mp->b_cont = allocb(sizeof (ire_t), BPRI_HI);
1812 		if (!mp->b_cont) {
1813 			freemsg(mp);
1814 			return (NULL);
1815 		}
1816 		mp->b_cont->b_wptr += sizeof (ire_t);
1817 		mp->b_cont->b_datap->db_type = IRE_DB_REQ_TYPE;
1818 
1819 		sin = (sin_t *)cp;
1820 		*sin = sin_null;
1821 		sin->sin_family = AF_INET;
1822 		sin->sin_addr.s_addr = V4_PART_OF_V6(udp->udp_bound_v6src);
1823 		sin->sin_port = udp->udp_port;
1824 		break;
1825 
1826 	case sizeof (sin6_t):
1827 		ASSERT(udp->udp_family == AF_INET6);
1828 		/* Append a request for an IRE */
1829 		mp->b_cont = allocb(sizeof (ire_t), BPRI_HI);
1830 		if (!mp->b_cont) {
1831 			freemsg(mp);
1832 			return (NULL);
1833 		}
1834 		mp->b_cont->b_wptr += sizeof (ire_t);
1835 		mp->b_cont->b_datap->db_type = IRE_DB_REQ_TYPE;
1836 
1837 		sin6 = (sin6_t *)cp;
1838 		*sin6 = sin6_null;
1839 		sin6->sin6_family = AF_INET6;
1840 		sin6->sin6_addr = udp->udp_bound_v6src;
1841 		sin6->sin6_port = udp->udp_port;
1842 		break;
1843 	}
1844 	/* Add protocol number to end */
1845 	cp[addr_length] = (char)IPPROTO_UDP;
1846 	mp->b_wptr = (uchar_t *)&cp[addr_length + 1];
1847 	return (mp);
1848 }
1849 
1850 /* For /dev/udp aka AF_INET open */
1851 static int
1852 udp_openv4(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp)
1853 {
1854 	return (udp_open(q, devp, flag, sflag, credp, B_FALSE));
1855 }
1856 
1857 /* For /dev/udp6 aka AF_INET6 open */
1858 static int
1859 udp_openv6(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp)
1860 {
1861 	return (udp_open(q, devp, flag, sflag, credp, B_TRUE));
1862 }
1863 
1864 /*
1865  * This is the open routine for udp.  It allocates a udp_t structure for
1866  * the stream and, on the first open of the module, creates an ND table.
1867  */
1868 /*ARGSUSED2*/
1869 static int
1870 udp_open(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp,
1871     boolean_t isv6)
1872 {
1873 	int		error;
1874 	udp_t		*udp;
1875 	conn_t		*connp;
1876 	dev_t		conn_dev;
1877 	udp_stack_t	*us;
1878 	vmem_t		*minor_arena;
1879 
1880 	TRACE_1(TR_FAC_UDP, TR_UDP_OPEN, "udp_open: q %p", q);
1881 
1882 	/* If the stream is already open, return immediately. */
1883 	if (q->q_ptr != NULL)
1884 		return (0);
1885 
1886 	if (sflag == MODOPEN)
1887 		return (EINVAL);
1888 
1889 	if ((ip_minor_arena_la != NULL) && (flag & SO_SOCKSTR) &&
1890 	    ((conn_dev = inet_minor_alloc(ip_minor_arena_la)) != 0)) {
1891 		minor_arena = ip_minor_arena_la;
1892 	} else {
1893 		/*
1894 		 * Either minor numbers in the large arena were exhausted
1895 		 * or a non socket application is doing the open.
1896 		 * Try to allocate from the small arena.
1897 		 */
1898 		if ((conn_dev = inet_minor_alloc(ip_minor_arena_sa)) == 0)
1899 			return (EBUSY);
1900 
1901 		minor_arena = ip_minor_arena_sa;
1902 	}
1903 
1904 	if (flag & SO_FALLBACK) {
1905 		/*
1906 		 * Non streams socket needs a stream to fallback to
1907 		 */
1908 		RD(q)->q_ptr = (void *)conn_dev;
1909 		WR(q)->q_qinfo = &udp_fallback_sock_winit;
1910 		WR(q)->q_ptr = (void *)minor_arena;
1911 		qprocson(q);
1912 		return (0);
1913 	}
1914 
1915 	connp = udp_do_open(credp, isv6, KM_SLEEP);
1916 	if (connp == NULL) {
1917 		inet_minor_free(minor_arena, conn_dev);
1918 		return (ENOMEM);
1919 	}
1920 	udp = connp->conn_udp;
1921 	us = udp->udp_us;
1922 
1923 	*devp = makedevice(getemajor(*devp), (minor_t)conn_dev);
1924 	connp->conn_dev = conn_dev;
1925 	connp->conn_minor_arena = minor_arena;
1926 
1927 	/*
1928 	 * Initialize the udp_t structure for this stream.
1929 	 */
1930 	q->q_ptr = connp;
1931 	WR(q)->q_ptr = connp;
1932 	connp->conn_rq = q;
1933 	connp->conn_wq = WR(q);
1934 
1935 	rw_enter(&udp->udp_rwlock, RW_WRITER);
1936 	ASSERT(connp->conn_ulp == IPPROTO_UDP);
1937 	ASSERT(connp->conn_udp == udp);
1938 	ASSERT(udp->udp_connp == connp);
1939 
1940 	if (flag & SO_SOCKSTR) {
1941 		connp->conn_flags |= IPCL_SOCKET;
1942 		udp->udp_issocket = B_TRUE;
1943 		udp->udp_direct_sockfs = B_TRUE;
1944 	}
1945 
1946 	q->q_hiwat = us->us_recv_hiwat;
1947 	WR(q)->q_hiwat = us->us_xmit_hiwat;
1948 	WR(q)->q_lowat = us->us_xmit_lowat;
1949 
1950 	qprocson(q);
1951 
1952 	if (udp->udp_family == AF_INET6) {
1953 		/* Build initial header template for transmit */
1954 		if ((error = udp_build_hdrs(udp)) != 0) {
1955 			rw_exit(&udp->udp_rwlock);
1956 			qprocsoff(q);
1957 			inet_minor_free(minor_arena, conn_dev);
1958 			ipcl_conn_destroy(connp);
1959 			return (error);
1960 		}
1961 	}
1962 	rw_exit(&udp->udp_rwlock);
1963 
1964 	/* Set the Stream head write offset and high watermark. */
1965 	(void) proto_set_tx_wroff(q, connp,
1966 	    udp->udp_max_hdr_len + us->us_wroff_extra);
1967 	/* XXX udp_set_rcv_hiwat() doesn't hold the lock, is it a bug??? */
1968 	(void) proto_set_rx_hiwat(q, connp, udp_set_rcv_hiwat(udp, q->q_hiwat));
1969 
1970 	mutex_enter(&connp->conn_lock);
1971 	connp->conn_state_flags &= ~CONN_INCIPIENT;
1972 	mutex_exit(&connp->conn_lock);
1973 	return (0);
1974 }
1975 
1976 /*
1977  * Which UDP options OK to set through T_UNITDATA_REQ...
1978  */
1979 /* ARGSUSED */
1980 static boolean_t
1981 udp_opt_allow_udr_set(t_scalar_t level, t_scalar_t name)
1982 {
1983 	return (B_TRUE);
1984 }
1985 
1986 /*
1987  * This routine gets default values of certain options whose default
1988  * values are maintained by protcol specific code
1989  */
1990 /* ARGSUSED */
1991 int
1992 udp_opt_default(queue_t *q, t_scalar_t level, t_scalar_t name, uchar_t *ptr)
1993 {
1994 	udp_t		*udp = Q_TO_UDP(q);
1995 	udp_stack_t *us = udp->udp_us;
1996 	int *i1 = (int *)ptr;
1997 
1998 	switch (level) {
1999 	case IPPROTO_IP:
2000 		switch (name) {
2001 		case IP_MULTICAST_TTL:
2002 			*ptr = (uchar_t)IP_DEFAULT_MULTICAST_TTL;
2003 			return (sizeof (uchar_t));
2004 		case IP_MULTICAST_LOOP:
2005 			*ptr = (uchar_t)IP_DEFAULT_MULTICAST_LOOP;
2006 			return (sizeof (uchar_t));
2007 		}
2008 		break;
2009 	case IPPROTO_IPV6:
2010 		switch (name) {
2011 		case IPV6_MULTICAST_HOPS:
2012 			*i1 = IP_DEFAULT_MULTICAST_TTL;
2013 			return (sizeof (int));
2014 		case IPV6_MULTICAST_LOOP:
2015 			*i1 = IP_DEFAULT_MULTICAST_LOOP;
2016 			return (sizeof (int));
2017 		case IPV6_UNICAST_HOPS:
2018 			*i1 = us->us_ipv6_hoplimit;
2019 			return (sizeof (int));
2020 		}
2021 		break;
2022 	}
2023 	return (-1);
2024 }
2025 
2026 /*
2027  * This routine retrieves the current status of socket options.
2028  * It returns the size of the option retrieved.
2029  */
2030 static int
2031 udp_opt_get(conn_t *connp, int level, int name, uchar_t *ptr)
2032 {
2033 	udp_t		*udp = connp->conn_udp;
2034 	udp_stack_t	*us = udp->udp_us;
2035 	int		*i1 = (int *)ptr;
2036 	ip6_pkt_t 	*ipp = &udp->udp_sticky_ipp;
2037 	int		len;
2038 
2039 	ASSERT(RW_READ_HELD(&udp->udp_rwlock));
2040 	switch (level) {
2041 	case SOL_SOCKET:
2042 		switch (name) {
2043 		case SO_DEBUG:
2044 			*i1 = udp->udp_debug;
2045 			break;	/* goto sizeof (int) option return */
2046 		case SO_REUSEADDR:
2047 			*i1 = udp->udp_reuseaddr;
2048 			break;	/* goto sizeof (int) option return */
2049 		case SO_TYPE:
2050 			*i1 = SOCK_DGRAM;
2051 			break;	/* goto sizeof (int) option return */
2052 
2053 		/*
2054 		 * The following three items are available here,
2055 		 * but are only meaningful to IP.
2056 		 */
2057 		case SO_DONTROUTE:
2058 			*i1 = udp->udp_dontroute;
2059 			break;	/* goto sizeof (int) option return */
2060 		case SO_USELOOPBACK:
2061 			*i1 = udp->udp_useloopback;
2062 			break;	/* goto sizeof (int) option return */
2063 		case SO_BROADCAST:
2064 			*i1 = udp->udp_broadcast;
2065 			break;	/* goto sizeof (int) option return */
2066 
2067 		case SO_SNDBUF:
2068 			*i1 = udp->udp_xmit_hiwat;
2069 			break;	/* goto sizeof (int) option return */
2070 		case SO_RCVBUF:
2071 			*i1 = udp->udp_rcv_disply_hiwat;
2072 			break;	/* goto sizeof (int) option return */
2073 		case SO_DGRAM_ERRIND:
2074 			*i1 = udp->udp_dgram_errind;
2075 			break;	/* goto sizeof (int) option return */
2076 		case SO_RECVUCRED:
2077 			*i1 = udp->udp_recvucred;
2078 			break;	/* goto sizeof (int) option return */
2079 		case SO_TIMESTAMP:
2080 			*i1 = udp->udp_timestamp;
2081 			break;	/* goto sizeof (int) option return */
2082 		case SO_ANON_MLP:
2083 			*i1 = connp->conn_anon_mlp;
2084 			break;	/* goto sizeof (int) option return */
2085 		case SO_MAC_EXEMPT:
2086 			*i1 = connp->conn_mac_exempt;
2087 			break;	/* goto sizeof (int) option return */
2088 		case SO_ALLZONES:
2089 			*i1 = connp->conn_allzones;
2090 			break;	/* goto sizeof (int) option return */
2091 		case SO_EXCLBIND:
2092 			*i1 = udp->udp_exclbind ? SO_EXCLBIND : 0;
2093 			break;
2094 		case SO_PROTOTYPE:
2095 			*i1 = IPPROTO_UDP;
2096 			break;
2097 		case SO_DOMAIN:
2098 			*i1 = udp->udp_family;
2099 			break;
2100 		default:
2101 			return (-1);
2102 		}
2103 		break;
2104 	case IPPROTO_IP:
2105 		if (udp->udp_family != AF_INET)
2106 			return (-1);
2107 		switch (name) {
2108 		case IP_OPTIONS:
2109 		case T_IP_OPTIONS:
2110 			len = udp->udp_ip_rcv_options_len - udp->udp_label_len;
2111 			if (len > 0) {
2112 				bcopy(udp->udp_ip_rcv_options +
2113 				    udp->udp_label_len, ptr, len);
2114 			}
2115 			return (len);
2116 		case IP_TOS:
2117 		case T_IP_TOS:
2118 			*i1 = (int)udp->udp_type_of_service;
2119 			break;	/* goto sizeof (int) option return */
2120 		case IP_TTL:
2121 			*i1 = (int)udp->udp_ttl;
2122 			break;	/* goto sizeof (int) option return */
2123 		case IP_DHCPINIT_IF:
2124 			return (-EINVAL);
2125 		case IP_NEXTHOP:
2126 		case IP_RECVPKTINFO:
2127 			/*
2128 			 * This also handles IP_PKTINFO.
2129 			 * IP_PKTINFO and IP_RECVPKTINFO have the same value.
2130 			 * Differentiation is based on the size of the argument
2131 			 * passed in.
2132 			 * This option is handled in IP which will return an
2133 			 * error for IP_PKTINFO as it's not supported as a
2134 			 * sticky option.
2135 			 */
2136 			return (-EINVAL);
2137 		case IP_MULTICAST_IF:
2138 			/* 0 address if not set */
2139 			*(ipaddr_t *)ptr = udp->udp_multicast_if_addr;
2140 			return (sizeof (ipaddr_t));
2141 		case IP_MULTICAST_TTL:
2142 			*(uchar_t *)ptr = udp->udp_multicast_ttl;
2143 			return (sizeof (uchar_t));
2144 		case IP_MULTICAST_LOOP:
2145 			*ptr = connp->conn_multicast_loop;
2146 			return (sizeof (uint8_t));
2147 		case IP_RECVOPTS:
2148 			*i1 = udp->udp_recvopts;
2149 			break;	/* goto sizeof (int) option return */
2150 		case IP_RECVDSTADDR:
2151 			*i1 = udp->udp_recvdstaddr;
2152 			break;	/* goto sizeof (int) option return */
2153 		case IP_RECVIF:
2154 			*i1 = udp->udp_recvif;
2155 			break;	/* goto sizeof (int) option return */
2156 		case IP_RECVSLLA:
2157 			*i1 = udp->udp_recvslla;
2158 			break;	/* goto sizeof (int) option return */
2159 		case IP_RECVTTL:
2160 			*i1 = udp->udp_recvttl;
2161 			break;	/* goto sizeof (int) option return */
2162 		case IP_ADD_MEMBERSHIP:
2163 		case IP_DROP_MEMBERSHIP:
2164 		case IP_BLOCK_SOURCE:
2165 		case IP_UNBLOCK_SOURCE:
2166 		case IP_ADD_SOURCE_MEMBERSHIP:
2167 		case IP_DROP_SOURCE_MEMBERSHIP:
2168 		case MCAST_JOIN_GROUP:
2169 		case MCAST_LEAVE_GROUP:
2170 		case MCAST_BLOCK_SOURCE:
2171 		case MCAST_UNBLOCK_SOURCE:
2172 		case MCAST_JOIN_SOURCE_GROUP:
2173 		case MCAST_LEAVE_SOURCE_GROUP:
2174 			/* cannot "get" the value for these */
2175 			return (-1);
2176 		case IP_BOUND_IF:
2177 			/* Zero if not set */
2178 			*i1 = udp->udp_bound_if;
2179 			break;	/* goto sizeof (int) option return */
2180 		case IP_UNSPEC_SRC:
2181 			*i1 = udp->udp_unspec_source;
2182 			break;	/* goto sizeof (int) option return */
2183 		case IP_BROADCAST_TTL:
2184 			*(uchar_t *)ptr = connp->conn_broadcast_ttl;
2185 			return (sizeof (uchar_t));
2186 		default:
2187 			return (-1);
2188 		}
2189 		break;
2190 	case IPPROTO_IPV6:
2191 		if (udp->udp_family != AF_INET6)
2192 			return (-1);
2193 		switch (name) {
2194 		case IPV6_UNICAST_HOPS:
2195 			*i1 = (unsigned int)udp->udp_ttl;
2196 			break;	/* goto sizeof (int) option return */
2197 		case IPV6_MULTICAST_IF:
2198 			/* 0 index if not set */
2199 			*i1 = udp->udp_multicast_if_index;
2200 			break;	/* goto sizeof (int) option return */
2201 		case IPV6_MULTICAST_HOPS:
2202 			*i1 = udp->udp_multicast_ttl;
2203 			break;	/* goto sizeof (int) option return */
2204 		case IPV6_MULTICAST_LOOP:
2205 			*i1 = connp->conn_multicast_loop;
2206 			break;	/* goto sizeof (int) option return */
2207 		case IPV6_JOIN_GROUP:
2208 		case IPV6_LEAVE_GROUP:
2209 		case MCAST_JOIN_GROUP:
2210 		case MCAST_LEAVE_GROUP:
2211 		case MCAST_BLOCK_SOURCE:
2212 		case MCAST_UNBLOCK_SOURCE:
2213 		case MCAST_JOIN_SOURCE_GROUP:
2214 		case MCAST_LEAVE_SOURCE_GROUP:
2215 			/* cannot "get" the value for these */
2216 			return (-1);
2217 		case IPV6_BOUND_IF:
2218 			/* Zero if not set */
2219 			*i1 = udp->udp_bound_if;
2220 			break;	/* goto sizeof (int) option return */
2221 		case IPV6_UNSPEC_SRC:
2222 			*i1 = udp->udp_unspec_source;
2223 			break;	/* goto sizeof (int) option return */
2224 		case IPV6_RECVPKTINFO:
2225 			*i1 = udp->udp_ip_recvpktinfo;
2226 			break;	/* goto sizeof (int) option return */
2227 		case IPV6_RECVTCLASS:
2228 			*i1 = udp->udp_ipv6_recvtclass;
2229 			break;	/* goto sizeof (int) option return */
2230 		case IPV6_RECVPATHMTU:
2231 			*i1 = udp->udp_ipv6_recvpathmtu;
2232 			break;	/* goto sizeof (int) option return */
2233 		case IPV6_RECVHOPLIMIT:
2234 			*i1 = udp->udp_ipv6_recvhoplimit;
2235 			break;	/* goto sizeof (int) option return */
2236 		case IPV6_RECVHOPOPTS:
2237 			*i1 = udp->udp_ipv6_recvhopopts;
2238 			break;	/* goto sizeof (int) option return */
2239 		case IPV6_RECVDSTOPTS:
2240 			*i1 = udp->udp_ipv6_recvdstopts;
2241 			break;	/* goto sizeof (int) option return */
2242 		case _OLD_IPV6_RECVDSTOPTS:
2243 			*i1 = udp->udp_old_ipv6_recvdstopts;
2244 			break;	/* goto sizeof (int) option return */
2245 		case IPV6_RECVRTHDRDSTOPTS:
2246 			*i1 = udp->udp_ipv6_recvrthdrdstopts;
2247 			break;	/* goto sizeof (int) option return */
2248 		case IPV6_RECVRTHDR:
2249 			*i1 = udp->udp_ipv6_recvrthdr;
2250 			break;	/* goto sizeof (int) option return */
2251 		case IPV6_PKTINFO: {
2252 			/* XXX assumes that caller has room for max size! */
2253 			struct in6_pktinfo *pkti;
2254 
2255 			pkti = (struct in6_pktinfo *)ptr;
2256 			if (ipp->ipp_fields & IPPF_IFINDEX)
2257 				pkti->ipi6_ifindex = ipp->ipp_ifindex;
2258 			else
2259 				pkti->ipi6_ifindex = 0;
2260 			if (ipp->ipp_fields & IPPF_ADDR)
2261 				pkti->ipi6_addr = ipp->ipp_addr;
2262 			else
2263 				pkti->ipi6_addr = ipv6_all_zeros;
2264 			return (sizeof (struct in6_pktinfo));
2265 		}
2266 		case IPV6_TCLASS:
2267 			if (ipp->ipp_fields & IPPF_TCLASS)
2268 				*i1 = ipp->ipp_tclass;
2269 			else
2270 				*i1 = IPV6_FLOW_TCLASS(
2271 				    IPV6_DEFAULT_VERS_AND_FLOW);
2272 			break;	/* goto sizeof (int) option return */
2273 		case IPV6_NEXTHOP: {
2274 			sin6_t *sin6 = (sin6_t *)ptr;
2275 
2276 			if (!(ipp->ipp_fields & IPPF_NEXTHOP))
2277 				return (0);
2278 			*sin6 = sin6_null;
2279 			sin6->sin6_family = AF_INET6;
2280 			sin6->sin6_addr = ipp->ipp_nexthop;
2281 			return (sizeof (sin6_t));
2282 		}
2283 		case IPV6_HOPOPTS:
2284 			if (!(ipp->ipp_fields & IPPF_HOPOPTS))
2285 				return (0);
2286 			if (ipp->ipp_hopoptslen <= udp->udp_label_len_v6)
2287 				return (0);
2288 			/*
2289 			 * The cipso/label option is added by kernel.
2290 			 * User is not usually aware of this option.
2291 			 * We copy out the hbh opt after the label option.
2292 			 */
2293 			bcopy((char *)ipp->ipp_hopopts + udp->udp_label_len_v6,
2294 			    ptr, ipp->ipp_hopoptslen - udp->udp_label_len_v6);
2295 			if (udp->udp_label_len_v6 > 0) {
2296 				ptr[0] = ((char *)ipp->ipp_hopopts)[0];
2297 				ptr[1] = (ipp->ipp_hopoptslen -
2298 				    udp->udp_label_len_v6 + 7) / 8 - 1;
2299 			}
2300 			return (ipp->ipp_hopoptslen - udp->udp_label_len_v6);
2301 		case IPV6_RTHDRDSTOPTS:
2302 			if (!(ipp->ipp_fields & IPPF_RTDSTOPTS))
2303 				return (0);
2304 			bcopy(ipp->ipp_rtdstopts, ptr, ipp->ipp_rtdstoptslen);
2305 			return (ipp->ipp_rtdstoptslen);
2306 		case IPV6_RTHDR:
2307 			if (!(ipp->ipp_fields & IPPF_RTHDR))
2308 				return (0);
2309 			bcopy(ipp->ipp_rthdr, ptr, ipp->ipp_rthdrlen);
2310 			return (ipp->ipp_rthdrlen);
2311 		case IPV6_DSTOPTS:
2312 			if (!(ipp->ipp_fields & IPPF_DSTOPTS))
2313 				return (0);
2314 			bcopy(ipp->ipp_dstopts, ptr, ipp->ipp_dstoptslen);
2315 			return (ipp->ipp_dstoptslen);
2316 		case IPV6_PATHMTU:
2317 			return (ip_fill_mtuinfo(&udp->udp_v6dst,
2318 			    udp->udp_dstport, (struct ip6_mtuinfo *)ptr,
2319 			    us->us_netstack));
2320 		default:
2321 			return (-1);
2322 		}
2323 		break;
2324 	case IPPROTO_UDP:
2325 		switch (name) {
2326 		case UDP_ANONPRIVBIND:
2327 			*i1 = udp->udp_anon_priv_bind;
2328 			break;
2329 		case UDP_EXCLBIND:
2330 			*i1 = udp->udp_exclbind ? UDP_EXCLBIND : 0;
2331 			break;
2332 		case UDP_RCVHDR:
2333 			*i1 = udp->udp_rcvhdr ? 1 : 0;
2334 			break;
2335 		case UDP_NAT_T_ENDPOINT:
2336 			*i1 = udp->udp_nat_t_endpoint;
2337 			break;
2338 		default:
2339 			return (-1);
2340 		}
2341 		break;
2342 	default:
2343 		return (-1);
2344 	}
2345 	return (sizeof (int));
2346 }
2347 
2348 int
2349 udp_tpi_opt_get(queue_t *q, t_scalar_t level, t_scalar_t name, uchar_t *ptr)
2350 {
2351 	udp_t   *udp;
2352 	int	err;
2353 
2354 	udp = Q_TO_UDP(q);
2355 
2356 	rw_enter(&udp->udp_rwlock, RW_READER);
2357 	err = udp_opt_get(Q_TO_CONN(q), level, name, ptr);
2358 	rw_exit(&udp->udp_rwlock);
2359 	return (err);
2360 }
2361 
2362 /*
2363  * This routine sets socket options.
2364  */
2365 /* ARGSUSED */
2366 static int
2367 udp_do_opt_set(conn_t *connp, int level, int name, uint_t inlen,
2368     uchar_t *invalp, uint_t *outlenp, uchar_t *outvalp, cred_t *cr,
2369     void *thisdg_attrs, boolean_t checkonly)
2370 {
2371 	udpattrs_t *attrs = thisdg_attrs;
2372 	int	*i1 = (int *)invalp;
2373 	boolean_t onoff = (*i1 == 0) ? 0 : 1;
2374 	udp_t	*udp = connp->conn_udp;
2375 	udp_stack_t	*us = udp->udp_us;
2376 	int	error;
2377 	uint_t	newlen;
2378 	size_t	sth_wroff;
2379 
2380 	ASSERT(RW_WRITE_HELD(&udp->udp_rwlock));
2381 	/*
2382 	 * For fixed length options, no sanity check
2383 	 * of passed in length is done. It is assumed *_optcom_req()
2384 	 * routines do the right thing.
2385 	 */
2386 	switch (level) {
2387 	case SOL_SOCKET:
2388 		switch (name) {
2389 		case SO_REUSEADDR:
2390 			if (!checkonly) {
2391 				udp->udp_reuseaddr = onoff;
2392 				PASS_OPT_TO_IP(connp);
2393 			}
2394 			break;
2395 		case SO_DEBUG:
2396 			if (!checkonly)
2397 				udp->udp_debug = onoff;
2398 			break;
2399 		/*
2400 		 * The following three items are available here,
2401 		 * but are only meaningful to IP.
2402 		 */
2403 		case SO_DONTROUTE:
2404 			if (!checkonly) {
2405 				udp->udp_dontroute = onoff;
2406 				PASS_OPT_TO_IP(connp);
2407 			}
2408 			break;
2409 		case SO_USELOOPBACK:
2410 			if (!checkonly) {
2411 				udp->udp_useloopback = onoff;
2412 				PASS_OPT_TO_IP(connp);
2413 			}
2414 			break;
2415 		case SO_BROADCAST:
2416 			if (!checkonly) {
2417 				udp->udp_broadcast = onoff;
2418 				PASS_OPT_TO_IP(connp);
2419 			}
2420 			break;
2421 
2422 		case SO_SNDBUF:
2423 			if (*i1 > us->us_max_buf) {
2424 				*outlenp = 0;
2425 				return (ENOBUFS);
2426 			}
2427 			if (!checkonly) {
2428 				udp->udp_xmit_hiwat = *i1;
2429 				connp->conn_wq->q_hiwat = *i1;
2430 			}
2431 			break;
2432 		case SO_RCVBUF:
2433 			if (*i1 > us->us_max_buf) {
2434 				*outlenp = 0;
2435 				return (ENOBUFS);
2436 			}
2437 			if (!checkonly) {
2438 				int size;
2439 
2440 				udp->udp_rcv_disply_hiwat = *i1;
2441 				size = udp_set_rcv_hiwat(udp, *i1);
2442 				rw_exit(&udp->udp_rwlock);
2443 				(void) proto_set_rx_hiwat(connp->conn_rq, connp,
2444 				    size);
2445 				rw_enter(&udp->udp_rwlock, RW_WRITER);
2446 			}
2447 			break;
2448 		case SO_DGRAM_ERRIND:
2449 			if (!checkonly)
2450 				udp->udp_dgram_errind = onoff;
2451 			break;
2452 		case SO_RECVUCRED:
2453 			if (!checkonly)
2454 				udp->udp_recvucred = onoff;
2455 			break;
2456 		case SO_ALLZONES:
2457 			/*
2458 			 * "soft" error (negative)
2459 			 * option not handled at this level
2460 			 * Do not modify *outlenp.
2461 			 */
2462 			return (-EINVAL);
2463 		case SO_TIMESTAMP:
2464 			if (!checkonly)
2465 				udp->udp_timestamp = onoff;
2466 			break;
2467 		case SO_ANON_MLP:
2468 			if (!checkonly) {
2469 				connp->conn_anon_mlp = onoff;
2470 				PASS_OPT_TO_IP(connp);
2471 			}
2472 			break;
2473 		case SO_MAC_EXEMPT:
2474 			if (secpolicy_net_mac_aware(cr) != 0 ||
2475 			    udp->udp_state != TS_UNBND)
2476 				return (EACCES);
2477 			if (!checkonly) {
2478 				connp->conn_mac_exempt = onoff;
2479 				PASS_OPT_TO_IP(connp);
2480 			}
2481 			break;
2482 		case SCM_UCRED: {
2483 			struct ucred_s *ucr;
2484 			cred_t *cr, *newcr;
2485 			ts_label_t *tsl;
2486 
2487 			/*
2488 			 * Only sockets that have proper privileges and are
2489 			 * bound to MLPs will have any other value here, so
2490 			 * this implicitly tests for privilege to set label.
2491 			 */
2492 			if (connp->conn_mlp_type == mlptSingle)
2493 				break;
2494 			ucr = (struct ucred_s *)invalp;
2495 			if (inlen != ucredsize ||
2496 			    ucr->uc_labeloff < sizeof (*ucr) ||
2497 			    ucr->uc_labeloff + sizeof (bslabel_t) > inlen)
2498 				return (EINVAL);
2499 			if (!checkonly) {
2500 				mblk_t *mb;
2501 				pid_t  cpid;
2502 
2503 				if (attrs == NULL ||
2504 				    (mb = attrs->udpattr_mb) == NULL)
2505 					return (EINVAL);
2506 				if ((cr = msg_getcred(mb, &cpid)) == NULL)
2507 					cr = udp->udp_connp->conn_cred;
2508 				ASSERT(cr != NULL);
2509 				if ((tsl = crgetlabel(cr)) == NULL)
2510 					return (EINVAL);
2511 				newcr = copycred_from_bslabel(cr, UCLABEL(ucr),
2512 				    tsl->tsl_doi, KM_NOSLEEP);
2513 				if (newcr == NULL)
2514 					return (ENOSR);
2515 				mblk_setcred(mb, newcr, cpid);
2516 				attrs->udpattr_credset = B_TRUE;
2517 				crfree(newcr);
2518 			}
2519 			break;
2520 		}
2521 		case SO_EXCLBIND:
2522 			if (!checkonly)
2523 				udp->udp_exclbind = onoff;
2524 			break;
2525 		case SO_RCVTIMEO:
2526 		case SO_SNDTIMEO:
2527 			/*
2528 			 * Pass these two options in order for third part
2529 			 * protocol usage. Here just return directly.
2530 			 */
2531 			return (0);
2532 		default:
2533 			*outlenp = 0;
2534 			return (EINVAL);
2535 		}
2536 		break;
2537 	case IPPROTO_IP:
2538 		if (udp->udp_family != AF_INET) {
2539 			*outlenp = 0;
2540 			return (ENOPROTOOPT);
2541 		}
2542 		switch (name) {
2543 		case IP_OPTIONS:
2544 		case T_IP_OPTIONS:
2545 			/* Save options for use by IP. */
2546 			newlen = inlen + udp->udp_label_len;
2547 			if ((inlen & 0x3) || newlen > IP_MAX_OPT_LENGTH) {
2548 				*outlenp = 0;
2549 				return (EINVAL);
2550 			}
2551 			if (checkonly)
2552 				break;
2553 
2554 			/*
2555 			 * Update the stored options taking into account
2556 			 * any CIPSO option which we should not overwrite.
2557 			 */
2558 			if (!tsol_option_set(&udp->udp_ip_snd_options,
2559 			    &udp->udp_ip_snd_options_len,
2560 			    udp->udp_label_len, invalp, inlen)) {
2561 				*outlenp = 0;
2562 				return (ENOMEM);
2563 			}
2564 
2565 			udp->udp_max_hdr_len = IP_SIMPLE_HDR_LENGTH +
2566 			    UDPH_SIZE + udp->udp_ip_snd_options_len;
2567 			sth_wroff = udp->udp_max_hdr_len + us->us_wroff_extra;
2568 			rw_exit(&udp->udp_rwlock);
2569 			(void) proto_set_tx_wroff(connp->conn_rq, connp,
2570 			    sth_wroff);
2571 			rw_enter(&udp->udp_rwlock, RW_WRITER);
2572 			break;
2573 
2574 		case IP_TTL:
2575 			if (!checkonly) {
2576 				udp->udp_ttl = (uchar_t)*i1;
2577 			}
2578 			break;
2579 		case IP_TOS:
2580 		case T_IP_TOS:
2581 			if (!checkonly) {
2582 				udp->udp_type_of_service = (uchar_t)*i1;
2583 			}
2584 			break;
2585 		case IP_MULTICAST_IF: {
2586 			/*
2587 			 * TODO should check OPTMGMT reply and undo this if
2588 			 * there is an error.
2589 			 */
2590 			struct in_addr *inap = (struct in_addr *)invalp;
2591 			if (!checkonly) {
2592 				udp->udp_multicast_if_addr =
2593 				    inap->s_addr;
2594 				PASS_OPT_TO_IP(connp);
2595 			}
2596 			break;
2597 		}
2598 		case IP_MULTICAST_TTL:
2599 			if (!checkonly)
2600 				udp->udp_multicast_ttl = *invalp;
2601 			break;
2602 		case IP_MULTICAST_LOOP:
2603 			if (!checkonly) {
2604 				connp->conn_multicast_loop = *invalp;
2605 				PASS_OPT_TO_IP(connp);
2606 			}
2607 			break;
2608 		case IP_RECVOPTS:
2609 			if (!checkonly)
2610 				udp->udp_recvopts = onoff;
2611 			break;
2612 		case IP_RECVDSTADDR:
2613 			if (!checkonly)
2614 				udp->udp_recvdstaddr = onoff;
2615 			break;
2616 		case IP_RECVIF:
2617 			if (!checkonly) {
2618 				udp->udp_recvif = onoff;
2619 				PASS_OPT_TO_IP(connp);
2620 			}
2621 			break;
2622 		case IP_RECVSLLA:
2623 			if (!checkonly) {
2624 				udp->udp_recvslla = onoff;
2625 				PASS_OPT_TO_IP(connp);
2626 			}
2627 			break;
2628 		case IP_RECVTTL:
2629 			if (!checkonly)
2630 				udp->udp_recvttl = onoff;
2631 			break;
2632 		case IP_PKTINFO: {
2633 			/*
2634 			 * This also handles IP_RECVPKTINFO.
2635 			 * IP_PKTINFO and IP_RECVPKTINFO have same value.
2636 			 * Differentiation is based on the size of the
2637 			 * argument passed in.
2638 			 */
2639 			struct in_pktinfo *pktinfop;
2640 			ip4_pkt_t *attr_pktinfop;
2641 
2642 			if (checkonly)
2643 				break;
2644 
2645 			if (inlen == sizeof (int)) {
2646 				/*
2647 				 * This is IP_RECVPKTINFO option.
2648 				 * Keep a local copy of whether this option is
2649 				 * set or not and pass it down to IP for
2650 				 * processing.
2651 				 */
2652 
2653 				udp->udp_ip_recvpktinfo = onoff;
2654 				return (-EINVAL);
2655 			}
2656 
2657 			if (attrs == NULL ||
2658 			    (attr_pktinfop = attrs->udpattr_ipp4) == NULL) {
2659 				/*
2660 				 * sticky option or no buffer to return
2661 				 * the results.
2662 				 */
2663 				return (EINVAL);
2664 			}
2665 
2666 			if (inlen != sizeof (struct in_pktinfo))
2667 				return (EINVAL);
2668 
2669 			pktinfop = (struct in_pktinfo *)invalp;
2670 
2671 			/*
2672 			 * At least one of the values should be specified
2673 			 */
2674 			if (pktinfop->ipi_ifindex == 0 &&
2675 			    pktinfop->ipi_spec_dst.s_addr == INADDR_ANY) {
2676 				return (EINVAL);
2677 			}
2678 
2679 			attr_pktinfop->ip4_addr = pktinfop->ipi_spec_dst.s_addr;
2680 			attr_pktinfop->ip4_ill_index = pktinfop->ipi_ifindex;
2681 
2682 			break;
2683 		}
2684 		case IP_ADD_MEMBERSHIP:
2685 		case IP_DROP_MEMBERSHIP:
2686 		case IP_BLOCK_SOURCE:
2687 		case IP_UNBLOCK_SOURCE:
2688 		case IP_ADD_SOURCE_MEMBERSHIP:
2689 		case IP_DROP_SOURCE_MEMBERSHIP:
2690 		case MCAST_JOIN_GROUP:
2691 		case MCAST_LEAVE_GROUP:
2692 		case MCAST_BLOCK_SOURCE:
2693 		case MCAST_UNBLOCK_SOURCE:
2694 		case MCAST_JOIN_SOURCE_GROUP:
2695 		case MCAST_LEAVE_SOURCE_GROUP:
2696 		case IP_SEC_OPT:
2697 		case IP_NEXTHOP:
2698 		case IP_DHCPINIT_IF:
2699 			/*
2700 			 * "soft" error (negative)
2701 			 * option not handled at this level
2702 			 * Do not modify *outlenp.
2703 			 */
2704 			return (-EINVAL);
2705 		case IP_BOUND_IF:
2706 			if (!checkonly) {
2707 				udp->udp_bound_if = *i1;
2708 				PASS_OPT_TO_IP(connp);
2709 			}
2710 			break;
2711 		case IP_UNSPEC_SRC:
2712 			if (!checkonly) {
2713 				udp->udp_unspec_source = onoff;
2714 				PASS_OPT_TO_IP(connp);
2715 			}
2716 			break;
2717 		case IP_BROADCAST_TTL:
2718 			if (!checkonly)
2719 				connp->conn_broadcast_ttl = *invalp;
2720 			break;
2721 		default:
2722 			*outlenp = 0;
2723 			return (EINVAL);
2724 		}
2725 		break;
2726 	case IPPROTO_IPV6: {
2727 		ip6_pkt_t		*ipp;
2728 		boolean_t		sticky;
2729 
2730 		if (udp->udp_family != AF_INET6) {
2731 			*outlenp = 0;
2732 			return (ENOPROTOOPT);
2733 		}
2734 		/*
2735 		 * Deal with both sticky options and ancillary data
2736 		 */
2737 		sticky = B_FALSE;
2738 		if (attrs == NULL || (ipp = attrs->udpattr_ipp6) ==
2739 		    NULL) {
2740 			/* sticky options, or none */
2741 			ipp = &udp->udp_sticky_ipp;
2742 			sticky = B_TRUE;
2743 		}
2744 
2745 		switch (name) {
2746 		case IPV6_MULTICAST_IF:
2747 			if (!checkonly) {
2748 				udp->udp_multicast_if_index = *i1;
2749 				PASS_OPT_TO_IP(connp);
2750 			}
2751 			break;
2752 		case IPV6_UNICAST_HOPS:
2753 			/* -1 means use default */
2754 			if (*i1 < -1 || *i1 > IPV6_MAX_HOPS) {
2755 				*outlenp = 0;
2756 				return (EINVAL);
2757 			}
2758 			if (!checkonly) {
2759 				if (*i1 == -1) {
2760 					udp->udp_ttl = ipp->ipp_unicast_hops =
2761 					    us->us_ipv6_hoplimit;
2762 					ipp->ipp_fields &= ~IPPF_UNICAST_HOPS;
2763 					/* Pass modified value to IP. */
2764 					*i1 = udp->udp_ttl;
2765 				} else {
2766 					udp->udp_ttl = ipp->ipp_unicast_hops =
2767 					    (uint8_t)*i1;
2768 					ipp->ipp_fields |= IPPF_UNICAST_HOPS;
2769 				}
2770 				/* Rebuild the header template */
2771 				error = udp_build_hdrs(udp);
2772 				if (error != 0) {
2773 					*outlenp = 0;
2774 					return (error);
2775 				}
2776 			}
2777 			break;
2778 		case IPV6_MULTICAST_HOPS:
2779 			/* -1 means use default */
2780 			if (*i1 < -1 || *i1 > IPV6_MAX_HOPS) {
2781 				*outlenp = 0;
2782 				return (EINVAL);
2783 			}
2784 			if (!checkonly) {
2785 				if (*i1 == -1) {
2786 					udp->udp_multicast_ttl =
2787 					    ipp->ipp_multicast_hops =
2788 					    IP_DEFAULT_MULTICAST_TTL;
2789 					ipp->ipp_fields &= ~IPPF_MULTICAST_HOPS;
2790 					/* Pass modified value to IP. */
2791 					*i1 = udp->udp_multicast_ttl;
2792 				} else {
2793 					udp->udp_multicast_ttl =
2794 					    ipp->ipp_multicast_hops =
2795 					    (uint8_t)*i1;
2796 					ipp->ipp_fields |= IPPF_MULTICAST_HOPS;
2797 				}
2798 			}
2799 			break;
2800 		case IPV6_MULTICAST_LOOP:
2801 			if (*i1 != 0 && *i1 != 1) {
2802 				*outlenp = 0;
2803 				return (EINVAL);
2804 			}
2805 			if (!checkonly) {
2806 				connp->conn_multicast_loop = *i1;
2807 				PASS_OPT_TO_IP(connp);
2808 			}
2809 			break;
2810 		case IPV6_JOIN_GROUP:
2811 		case IPV6_LEAVE_GROUP:
2812 		case MCAST_JOIN_GROUP:
2813 		case MCAST_LEAVE_GROUP:
2814 		case MCAST_BLOCK_SOURCE:
2815 		case MCAST_UNBLOCK_SOURCE:
2816 		case MCAST_JOIN_SOURCE_GROUP:
2817 		case MCAST_LEAVE_SOURCE_GROUP:
2818 			/*
2819 			 * "soft" error (negative)
2820 			 * option not handled at this level
2821 			 * Note: Do not modify *outlenp
2822 			 */
2823 			return (-EINVAL);
2824 		case IPV6_BOUND_IF:
2825 			if (!checkonly) {
2826 				udp->udp_bound_if = *i1;
2827 				PASS_OPT_TO_IP(connp);
2828 			}
2829 			break;
2830 		case IPV6_UNSPEC_SRC:
2831 			if (!checkonly) {
2832 				udp->udp_unspec_source = onoff;
2833 				PASS_OPT_TO_IP(connp);
2834 			}
2835 			break;
2836 		/*
2837 		 * Set boolean switches for ancillary data delivery
2838 		 */
2839 		case IPV6_RECVPKTINFO:
2840 			if (!checkonly) {
2841 				udp->udp_ip_recvpktinfo = onoff;
2842 				PASS_OPT_TO_IP(connp);
2843 			}
2844 			break;
2845 		case IPV6_RECVTCLASS:
2846 			if (!checkonly) {
2847 				udp->udp_ipv6_recvtclass = onoff;
2848 				PASS_OPT_TO_IP(connp);
2849 			}
2850 			break;
2851 		case IPV6_RECVPATHMTU:
2852 			if (!checkonly) {
2853 				udp->udp_ipv6_recvpathmtu = onoff;
2854 				PASS_OPT_TO_IP(connp);
2855 			}
2856 			break;
2857 		case IPV6_RECVHOPLIMIT:
2858 			if (!checkonly) {
2859 				udp->udp_ipv6_recvhoplimit = onoff;
2860 				PASS_OPT_TO_IP(connp);
2861 			}
2862 			break;
2863 		case IPV6_RECVHOPOPTS:
2864 			if (!checkonly) {
2865 				udp->udp_ipv6_recvhopopts = onoff;
2866 				PASS_OPT_TO_IP(connp);
2867 			}
2868 			break;
2869 		case IPV6_RECVDSTOPTS:
2870 			if (!checkonly) {
2871 				udp->udp_ipv6_recvdstopts = onoff;
2872 				PASS_OPT_TO_IP(connp);
2873 			}
2874 			break;
2875 		case _OLD_IPV6_RECVDSTOPTS:
2876 			if (!checkonly)
2877 				udp->udp_old_ipv6_recvdstopts = onoff;
2878 			break;
2879 		case IPV6_RECVRTHDRDSTOPTS:
2880 			if (!checkonly) {
2881 				udp->udp_ipv6_recvrthdrdstopts = onoff;
2882 				PASS_OPT_TO_IP(connp);
2883 			}
2884 			break;
2885 		case IPV6_RECVRTHDR:
2886 			if (!checkonly) {
2887 				udp->udp_ipv6_recvrthdr = onoff;
2888 				PASS_OPT_TO_IP(connp);
2889 			}
2890 			break;
2891 		/*
2892 		 * Set sticky options or ancillary data.
2893 		 * If sticky options, (re)build any extension headers
2894 		 * that might be needed as a result.
2895 		 */
2896 		case IPV6_PKTINFO:
2897 			/*
2898 			 * The source address and ifindex are verified
2899 			 * in ip_opt_set(). For ancillary data the
2900 			 * source address is checked in ip_wput_v6.
2901 			 */
2902 			if (inlen != 0 && inlen != sizeof (struct in6_pktinfo))
2903 				return (EINVAL);
2904 			if (checkonly)
2905 				break;
2906 
2907 			if (inlen == 0) {
2908 				ipp->ipp_fields &= ~(IPPF_IFINDEX|IPPF_ADDR);
2909 				ipp->ipp_sticky_ignored |=
2910 				    (IPPF_IFINDEX|IPPF_ADDR);
2911 			} else {
2912 				struct in6_pktinfo *pkti;
2913 
2914 				pkti = (struct in6_pktinfo *)invalp;
2915 				ipp->ipp_ifindex = pkti->ipi6_ifindex;
2916 				ipp->ipp_addr = pkti->ipi6_addr;
2917 				if (ipp->ipp_ifindex != 0)
2918 					ipp->ipp_fields |= IPPF_IFINDEX;
2919 				else
2920 					ipp->ipp_fields &= ~IPPF_IFINDEX;
2921 				if (!IN6_IS_ADDR_UNSPECIFIED(
2922 				    &ipp->ipp_addr))
2923 					ipp->ipp_fields |= IPPF_ADDR;
2924 				else
2925 					ipp->ipp_fields &= ~IPPF_ADDR;
2926 			}
2927 			if (sticky) {
2928 				error = udp_build_hdrs(udp);
2929 				if (error != 0)
2930 					return (error);
2931 				PASS_OPT_TO_IP(connp);
2932 			}
2933 			break;
2934 		case IPV6_HOPLIMIT:
2935 			if (sticky)
2936 				return (EINVAL);
2937 			if (inlen != 0 && inlen != sizeof (int))
2938 				return (EINVAL);
2939 			if (checkonly)
2940 				break;
2941 
2942 			if (inlen == 0) {
2943 				ipp->ipp_fields &= ~IPPF_HOPLIMIT;
2944 				ipp->ipp_sticky_ignored |= IPPF_HOPLIMIT;
2945 			} else {
2946 				if (*i1 > 255 || *i1 < -1)
2947 					return (EINVAL);
2948 				if (*i1 == -1)
2949 					ipp->ipp_hoplimit =
2950 					    us->us_ipv6_hoplimit;
2951 				else
2952 					ipp->ipp_hoplimit = *i1;
2953 				ipp->ipp_fields |= IPPF_HOPLIMIT;
2954 			}
2955 			break;
2956 		case IPV6_TCLASS:
2957 			if (inlen != 0 && inlen != sizeof (int))
2958 				return (EINVAL);
2959 			if (checkonly)
2960 				break;
2961 
2962 			if (inlen == 0) {
2963 				ipp->ipp_fields &= ~IPPF_TCLASS;
2964 				ipp->ipp_sticky_ignored |= IPPF_TCLASS;
2965 			} else {
2966 				if (*i1 > 255 || *i1 < -1)
2967 					return (EINVAL);
2968 				if (*i1 == -1)
2969 					ipp->ipp_tclass = 0;
2970 				else
2971 					ipp->ipp_tclass = *i1;
2972 				ipp->ipp_fields |= IPPF_TCLASS;
2973 			}
2974 			if (sticky) {
2975 				error = udp_build_hdrs(udp);
2976 				if (error != 0)
2977 					return (error);
2978 			}
2979 			break;
2980 		case IPV6_NEXTHOP:
2981 			/*
2982 			 * IP will verify that the nexthop is reachable
2983 			 * and fail for sticky options.
2984 			 */
2985 			if (inlen != 0 && inlen != sizeof (sin6_t))
2986 				return (EINVAL);
2987 			if (checkonly)
2988 				break;
2989 
2990 			if (inlen == 0) {
2991 				ipp->ipp_fields &= ~IPPF_NEXTHOP;
2992 				ipp->ipp_sticky_ignored |= IPPF_NEXTHOP;
2993 			} else {
2994 				sin6_t *sin6 = (sin6_t *)invalp;
2995 
2996 				if (sin6->sin6_family != AF_INET6) {
2997 					return (EAFNOSUPPORT);
2998 				}
2999 				if (IN6_IS_ADDR_V4MAPPED(
3000 				    &sin6->sin6_addr))
3001 					return (EADDRNOTAVAIL);
3002 				ipp->ipp_nexthop = sin6->sin6_addr;
3003 				if (!IN6_IS_ADDR_UNSPECIFIED(
3004 				    &ipp->ipp_nexthop))
3005 					ipp->ipp_fields |= IPPF_NEXTHOP;
3006 				else
3007 					ipp->ipp_fields &= ~IPPF_NEXTHOP;
3008 			}
3009 			if (sticky) {
3010 				error = udp_build_hdrs(udp);
3011 				if (error != 0)
3012 					return (error);
3013 				PASS_OPT_TO_IP(connp);
3014 			}
3015 			break;
3016 		case IPV6_HOPOPTS: {
3017 			ip6_hbh_t *hopts = (ip6_hbh_t *)invalp;
3018 			/*
3019 			 * Sanity checks - minimum size, size a multiple of
3020 			 * eight bytes, and matching size passed in.
3021 			 */
3022 			if (inlen != 0 &&
3023 			    inlen != (8 * (hopts->ip6h_len + 1)))
3024 				return (EINVAL);
3025 
3026 			if (checkonly)
3027 				break;
3028 
3029 			error = optcom_pkt_set(invalp, inlen, sticky,
3030 			    (uchar_t **)&ipp->ipp_hopopts,
3031 			    &ipp->ipp_hopoptslen,
3032 			    sticky ? udp->udp_label_len_v6 : 0);
3033 			if (error != 0)
3034 				return (error);
3035 			if (ipp->ipp_hopoptslen == 0) {
3036 				ipp->ipp_fields &= ~IPPF_HOPOPTS;
3037 				ipp->ipp_sticky_ignored |= IPPF_HOPOPTS;
3038 			} else {
3039 				ipp->ipp_fields |= IPPF_HOPOPTS;
3040 			}
3041 			if (sticky) {
3042 				error = udp_build_hdrs(udp);
3043 				if (error != 0)
3044 					return (error);
3045 			}
3046 			break;
3047 		}
3048 		case IPV6_RTHDRDSTOPTS: {
3049 			ip6_dest_t *dopts = (ip6_dest_t *)invalp;
3050 
3051 			/*
3052 			 * Sanity checks - minimum size, size a multiple of
3053 			 * eight bytes, and matching size passed in.
3054 			 */
3055 			if (inlen != 0 &&
3056 			    inlen != (8 * (dopts->ip6d_len + 1)))
3057 				return (EINVAL);
3058 
3059 			if (checkonly)
3060 				break;
3061 
3062 			if (inlen == 0) {
3063 				if (sticky &&
3064 				    (ipp->ipp_fields & IPPF_RTDSTOPTS) != 0) {
3065 					kmem_free(ipp->ipp_rtdstopts,
3066 					    ipp->ipp_rtdstoptslen);
3067 					ipp->ipp_rtdstopts = NULL;
3068 					ipp->ipp_rtdstoptslen = 0;
3069 				}
3070 
3071 				ipp->ipp_fields &= ~IPPF_RTDSTOPTS;
3072 				ipp->ipp_sticky_ignored |= IPPF_RTDSTOPTS;
3073 			} else {
3074 				error = optcom_pkt_set(invalp, inlen, sticky,
3075 				    (uchar_t **)&ipp->ipp_rtdstopts,
3076 				    &ipp->ipp_rtdstoptslen, 0);
3077 				if (error != 0)
3078 					return (error);
3079 				ipp->ipp_fields |= IPPF_RTDSTOPTS;
3080 			}
3081 			if (sticky) {
3082 				error = udp_build_hdrs(udp);
3083 				if (error != 0)
3084 					return (error);
3085 			}
3086 			break;
3087 		}
3088 		case IPV6_DSTOPTS: {
3089 			ip6_dest_t *dopts = (ip6_dest_t *)invalp;
3090 
3091 			/*
3092 			 * Sanity checks - minimum size, size a multiple of
3093 			 * eight bytes, and matching size passed in.
3094 			 */
3095 			if (inlen != 0 &&
3096 			    inlen != (8 * (dopts->ip6d_len + 1)))
3097 				return (EINVAL);
3098 
3099 			if (checkonly)
3100 				break;
3101 
3102 			if (inlen == 0) {
3103 				if (sticky &&
3104 				    (ipp->ipp_fields & IPPF_DSTOPTS) != 0) {
3105 					kmem_free(ipp->ipp_dstopts,
3106 					    ipp->ipp_dstoptslen);
3107 					ipp->ipp_dstopts = NULL;
3108 					ipp->ipp_dstoptslen = 0;
3109 				}
3110 				ipp->ipp_fields &= ~IPPF_DSTOPTS;
3111 				ipp->ipp_sticky_ignored |= IPPF_DSTOPTS;
3112 			} else {
3113 				error = optcom_pkt_set(invalp, inlen, sticky,
3114 				    (uchar_t **)&ipp->ipp_dstopts,
3115 				    &ipp->ipp_dstoptslen, 0);
3116 				if (error != 0)
3117 					return (error);
3118 				ipp->ipp_fields |= IPPF_DSTOPTS;
3119 			}
3120 			if (sticky) {
3121 				error = udp_build_hdrs(udp);
3122 				if (error != 0)
3123 					return (error);
3124 			}
3125 			break;
3126 		}
3127 		case IPV6_RTHDR: {
3128 			ip6_rthdr_t *rt = (ip6_rthdr_t *)invalp;
3129 
3130 			/*
3131 			 * Sanity checks - minimum size, size a multiple of
3132 			 * eight bytes, and matching size passed in.
3133 			 */
3134 			if (inlen != 0 &&
3135 			    inlen != (8 * (rt->ip6r_len + 1)))
3136 				return (EINVAL);
3137 
3138 			if (checkonly)
3139 				break;
3140 
3141 			if (inlen == 0) {
3142 				if (sticky &&
3143 				    (ipp->ipp_fields & IPPF_RTHDR) != 0) {
3144 					kmem_free(ipp->ipp_rthdr,
3145 					    ipp->ipp_rthdrlen);
3146 					ipp->ipp_rthdr = NULL;
3147 					ipp->ipp_rthdrlen = 0;
3148 				}
3149 				ipp->ipp_fields &= ~IPPF_RTHDR;
3150 				ipp->ipp_sticky_ignored |= IPPF_RTHDR;
3151 			} else {
3152 				error = optcom_pkt_set(invalp, inlen, sticky,
3153 				    (uchar_t **)&ipp->ipp_rthdr,
3154 				    &ipp->ipp_rthdrlen, 0);
3155 				if (error != 0)
3156 					return (error);
3157 				ipp->ipp_fields |= IPPF_RTHDR;
3158 			}
3159 			if (sticky) {
3160 				error = udp_build_hdrs(udp);
3161 				if (error != 0)
3162 					return (error);
3163 			}
3164 			break;
3165 		}
3166 
3167 		case IPV6_DONTFRAG:
3168 			if (checkonly)
3169 				break;
3170 
3171 			if (onoff) {
3172 				ipp->ipp_fields |= IPPF_DONTFRAG;
3173 			} else {
3174 				ipp->ipp_fields &= ~IPPF_DONTFRAG;
3175 			}
3176 			break;
3177 
3178 		case IPV6_USE_MIN_MTU:
3179 			if (inlen != sizeof (int))
3180 				return (EINVAL);
3181 
3182 			if (*i1 < -1 || *i1 > 1)
3183 				return (EINVAL);
3184 
3185 			if (checkonly)
3186 				break;
3187 
3188 			ipp->ipp_fields |= IPPF_USE_MIN_MTU;
3189 			ipp->ipp_use_min_mtu = *i1;
3190 			break;
3191 
3192 		case IPV6_SEC_OPT:
3193 		case IPV6_SRC_PREFERENCES:
3194 		case IPV6_V6ONLY:
3195 			/* Handled at the IP level */
3196 			return (-EINVAL);
3197 		default:
3198 			*outlenp = 0;
3199 			return (EINVAL);
3200 		}
3201 		break;
3202 		}		/* end IPPROTO_IPV6 */
3203 	case IPPROTO_UDP:
3204 		switch (name) {
3205 		case UDP_ANONPRIVBIND:
3206 			if ((error = secpolicy_net_privaddr(cr, 0,
3207 			    IPPROTO_UDP)) != 0) {
3208 				*outlenp = 0;
3209 				return (error);
3210 			}
3211 			if (!checkonly) {
3212 				udp->udp_anon_priv_bind = onoff;
3213 			}
3214 			break;
3215 		case UDP_EXCLBIND:
3216 			if (!checkonly)
3217 				udp->udp_exclbind = onoff;
3218 			break;
3219 		case UDP_RCVHDR:
3220 			if (!checkonly)
3221 				udp->udp_rcvhdr = onoff;
3222 			break;
3223 		case UDP_NAT_T_ENDPOINT:
3224 			if ((error = secpolicy_ip_config(cr, B_FALSE)) != 0) {
3225 				*outlenp = 0;
3226 				return (error);
3227 			}
3228 
3229 			/*
3230 			 * Use udp_family instead so we can avoid ambiguitites
3231 			 * with AF_INET6 sockets that may switch from IPv4
3232 			 * to IPv6.
3233 			 */
3234 			if (udp->udp_family != AF_INET) {
3235 				*outlenp = 0;
3236 				return (EAFNOSUPPORT);
3237 			}
3238 
3239 			if (!checkonly) {
3240 				int size;
3241 
3242 				udp->udp_nat_t_endpoint = onoff;
3243 
3244 				udp->udp_max_hdr_len = IP_SIMPLE_HDR_LENGTH +
3245 				    UDPH_SIZE + udp->udp_ip_snd_options_len;
3246 
3247 				/* Also, adjust wroff */
3248 				if (onoff) {
3249 					udp->udp_max_hdr_len +=
3250 					    sizeof (uint32_t);
3251 				}
3252 				size = udp->udp_max_hdr_len +
3253 				    us->us_wroff_extra;
3254 				(void) proto_set_tx_wroff(connp->conn_rq, connp,
3255 				    size);
3256 			}
3257 			break;
3258 		default:
3259 			*outlenp = 0;
3260 			return (EINVAL);
3261 		}
3262 		break;
3263 	default:
3264 		*outlenp = 0;
3265 		return (EINVAL);
3266 	}
3267 	/*
3268 	 * Common case of OK return with outval same as inval.
3269 	 */
3270 	if (invalp != outvalp) {
3271 		/* don't trust bcopy for identical src/dst */
3272 		(void) bcopy(invalp, outvalp, inlen);
3273 	}
3274 	*outlenp = inlen;
3275 	return (0);
3276 }
3277 
3278 int
3279 udp_opt_set(conn_t *connp, uint_t optset_context, int level, int name,
3280     uint_t inlen, uchar_t *invalp, uint_t *outlenp, uchar_t *outvalp,
3281     void *thisdg_attrs, cred_t *cr)
3282 {
3283 	int		error;
3284 	boolean_t	checkonly;
3285 
3286 	error = 0;
3287 	switch (optset_context) {
3288 	case SETFN_OPTCOM_CHECKONLY:
3289 		checkonly = B_TRUE;
3290 		/*
3291 		 * Note: Implies T_CHECK semantics for T_OPTCOM_REQ
3292 		 * inlen != 0 implies value supplied and
3293 		 * 	we have to "pretend" to set it.
3294 		 * inlen == 0 implies that there is no
3295 		 * 	value part in T_CHECK request and just validation
3296 		 * done elsewhere should be enough, we just return here.
3297 		 */
3298 		if (inlen == 0) {
3299 			*outlenp = 0;
3300 			goto done;
3301 		}
3302 		break;
3303 	case SETFN_OPTCOM_NEGOTIATE:
3304 		checkonly = B_FALSE;
3305 		break;
3306 	case SETFN_UD_NEGOTIATE:
3307 	case SETFN_CONN_NEGOTIATE:
3308 		checkonly = B_FALSE;
3309 		/*
3310 		 * Negotiating local and "association-related" options
3311 		 * through T_UNITDATA_REQ.
3312 		 *
3313 		 * Following routine can filter out ones we do not
3314 		 * want to be "set" this way.
3315 		 */
3316 		if (!udp_opt_allow_udr_set(level, name)) {
3317 			*outlenp = 0;
3318 			error = EINVAL;
3319 			goto done;
3320 		}
3321 		break;
3322 	default:
3323 		/*
3324 		 * We should never get here
3325 		 */
3326 		*outlenp = 0;
3327 		error = EINVAL;
3328 		goto done;
3329 	}
3330 
3331 	ASSERT((optset_context != SETFN_OPTCOM_CHECKONLY) ||
3332 	    (optset_context == SETFN_OPTCOM_CHECKONLY && inlen != 0));
3333 
3334 	error = udp_do_opt_set(connp, level, name, inlen, invalp, outlenp,
3335 	    outvalp, cr, thisdg_attrs, checkonly);
3336 done:
3337 	return (error);
3338 }
3339 
3340 /* ARGSUSED */
3341 int
3342 udp_tpi_opt_set(queue_t *q, uint_t optset_context, int level, int name,
3343     uint_t inlen, uchar_t *invalp, uint_t *outlenp, uchar_t *outvalp,
3344     void *thisdg_attrs, cred_t *cr, mblk_t *mblk)
3345 {
3346 	conn_t  *connp =  Q_TO_CONN(q);
3347 	int error;
3348 	udp_t	*udp = connp->conn_udp;
3349 
3350 	rw_enter(&udp->udp_rwlock, RW_WRITER);
3351 	error = udp_opt_set(connp, optset_context, level, name, inlen, invalp,
3352 	    outlenp, outvalp, thisdg_attrs, cr);
3353 	rw_exit(&udp->udp_rwlock);
3354 	return (error);
3355 }
3356 
3357 /*
3358  * Update udp_sticky_hdrs based on udp_sticky_ipp, udp_v6src, and udp_ttl.
3359  * The headers include ip6i_t (if needed), ip6_t, any sticky extension
3360  * headers, and the udp header.
3361  * Returns failure if can't allocate memory.
3362  */
3363 static int
3364 udp_build_hdrs(udp_t *udp)
3365 {
3366 	udp_stack_t *us = udp->udp_us;
3367 	uchar_t	*hdrs;
3368 	uint_t	hdrs_len;
3369 	ip6_t	*ip6h;
3370 	ip6i_t	*ip6i;
3371 	udpha_t	*udpha;
3372 	ip6_pkt_t *ipp = &udp->udp_sticky_ipp;
3373 	size_t	sth_wroff;
3374 	conn_t	*connp = udp->udp_connp;
3375 
3376 	ASSERT(RW_WRITE_HELD(&udp->udp_rwlock));
3377 	ASSERT(connp != NULL);
3378 
3379 	hdrs_len = ip_total_hdrs_len_v6(ipp) + UDPH_SIZE;
3380 	ASSERT(hdrs_len != 0);
3381 	if (hdrs_len != udp->udp_sticky_hdrs_len) {
3382 		/* Need to reallocate */
3383 		hdrs = kmem_alloc(hdrs_len, KM_NOSLEEP);
3384 		if (hdrs == NULL)
3385 			return (ENOMEM);
3386 
3387 		if (udp->udp_sticky_hdrs_len != 0) {
3388 			kmem_free(udp->udp_sticky_hdrs,
3389 			    udp->udp_sticky_hdrs_len);
3390 		}
3391 		udp->udp_sticky_hdrs = hdrs;
3392 		udp->udp_sticky_hdrs_len = hdrs_len;
3393 	}
3394 	ip_build_hdrs_v6(udp->udp_sticky_hdrs,
3395 	    udp->udp_sticky_hdrs_len - UDPH_SIZE, ipp, IPPROTO_UDP);
3396 
3397 	/* Set header fields not in ipp */
3398 	if (ipp->ipp_fields & IPPF_HAS_IP6I) {
3399 		ip6i = (ip6i_t *)udp->udp_sticky_hdrs;
3400 		ip6h = (ip6_t *)&ip6i[1];
3401 	} else {
3402 		ip6h = (ip6_t *)udp->udp_sticky_hdrs;
3403 	}
3404 
3405 	if (!(ipp->ipp_fields & IPPF_ADDR))
3406 		ip6h->ip6_src = udp->udp_v6src;
3407 
3408 	udpha = (udpha_t *)(udp->udp_sticky_hdrs + hdrs_len - UDPH_SIZE);
3409 	udpha->uha_src_port = udp->udp_port;
3410 
3411 	/* Try to get everything in a single mblk */
3412 	if (hdrs_len > udp->udp_max_hdr_len) {
3413 		udp->udp_max_hdr_len = hdrs_len;
3414 		sth_wroff = udp->udp_max_hdr_len + us->us_wroff_extra;
3415 		rw_exit(&udp->udp_rwlock);
3416 		(void) proto_set_tx_wroff(udp->udp_connp->conn_rq,
3417 		    udp->udp_connp, sth_wroff);
3418 		rw_enter(&udp->udp_rwlock, RW_WRITER);
3419 	}
3420 	return (0);
3421 }
3422 
3423 /*
3424  * This routine retrieves the value of an ND variable in a udpparam_t
3425  * structure.  It is called through nd_getset when a user reads the
3426  * variable.
3427  */
3428 /* ARGSUSED */
3429 static int
3430 udp_param_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr)
3431 {
3432 	udpparam_t *udppa = (udpparam_t *)cp;
3433 
3434 	(void) mi_mpprintf(mp, "%d", udppa->udp_param_value);
3435 	return (0);
3436 }
3437 
3438 /*
3439  * Walk through the param array specified registering each element with the
3440  * named dispatch (ND) handler.
3441  */
3442 static boolean_t
3443 udp_param_register(IDP *ndp, udpparam_t *udppa, int cnt)
3444 {
3445 	for (; cnt-- > 0; udppa++) {
3446 		if (udppa->udp_param_name && udppa->udp_param_name[0]) {
3447 			if (!nd_load(ndp, udppa->udp_param_name,
3448 			    udp_param_get, udp_param_set,
3449 			    (caddr_t)udppa)) {
3450 				nd_free(ndp);
3451 				return (B_FALSE);
3452 			}
3453 		}
3454 	}
3455 	if (!nd_load(ndp, "udp_extra_priv_ports",
3456 	    udp_extra_priv_ports_get, NULL, NULL)) {
3457 		nd_free(ndp);
3458 		return (B_FALSE);
3459 	}
3460 	if (!nd_load(ndp, "udp_extra_priv_ports_add",
3461 	    NULL, udp_extra_priv_ports_add, NULL)) {
3462 		nd_free(ndp);
3463 		return (B_FALSE);
3464 	}
3465 	if (!nd_load(ndp, "udp_extra_priv_ports_del",
3466 	    NULL, udp_extra_priv_ports_del, NULL)) {
3467 		nd_free(ndp);
3468 		return (B_FALSE);
3469 	}
3470 	if (!nd_load(ndp, "udp_status", udp_status_report, NULL,
3471 	    NULL)) {
3472 		nd_free(ndp);
3473 		return (B_FALSE);
3474 	}
3475 	if (!nd_load(ndp, "udp_bind_hash", udp_bind_hash_report, NULL,
3476 	    NULL)) {
3477 		nd_free(ndp);
3478 		return (B_FALSE);
3479 	}
3480 	return (B_TRUE);
3481 }
3482 
3483 /* This routine sets an ND variable in a udpparam_t structure. */
3484 /* ARGSUSED */
3485 static int
3486 udp_param_set(queue_t *q, mblk_t *mp, char *value, caddr_t cp, cred_t *cr)
3487 {
3488 	long		new_value;
3489 	udpparam_t	*udppa = (udpparam_t *)cp;
3490 
3491 	/*
3492 	 * Fail the request if the new value does not lie within the
3493 	 * required bounds.
3494 	 */
3495 	if (ddi_strtol(value, NULL, 10, &new_value) != 0 ||
3496 	    new_value < udppa->udp_param_min ||
3497 	    new_value > udppa->udp_param_max) {
3498 		return (EINVAL);
3499 	}
3500 
3501 	/* Set the new value */
3502 	udppa->udp_param_value = new_value;
3503 	return (0);
3504 }
3505 
3506 /*
3507  * Copy hop-by-hop option from ipp->ipp_hopopts to the buffer provided (with
3508  * T_opthdr) and return the number of bytes copied.  'dbuf' may be NULL to
3509  * just count the length needed for allocation.  If 'dbuf' is non-NULL,
3510  * then it's assumed to be allocated to be large enough.
3511  *
3512  * Returns zero if trimming of the security option causes all options to go
3513  * away.
3514  */
3515 static size_t
3516 copy_hop_opts(const ip6_pkt_t *ipp, uchar_t *dbuf)
3517 {
3518 	struct T_opthdr *toh;
3519 	size_t hol = ipp->ipp_hopoptslen;
3520 	ip6_hbh_t *dstopt = NULL;
3521 	const ip6_hbh_t *srcopt = ipp->ipp_hopopts;
3522 	size_t tlen, olen, plen;
3523 	boolean_t deleting;
3524 	const struct ip6_opt *sopt, *lastpad;
3525 	struct ip6_opt *dopt;
3526 
3527 	if ((toh = (struct T_opthdr *)dbuf) != NULL) {
3528 		toh->level = IPPROTO_IPV6;
3529 		toh->name = IPV6_HOPOPTS;
3530 		toh->status = 0;
3531 		dstopt = (ip6_hbh_t *)(toh + 1);
3532 	}
3533 
3534 	/*
3535 	 * If labeling is enabled, then skip the label option
3536 	 * but get other options if there are any.
3537 	 */
3538 	if (is_system_labeled()) {
3539 		dopt = NULL;
3540 		if (dstopt != NULL) {
3541 			/* will fill in ip6h_len later */
3542 			dstopt->ip6h_nxt = srcopt->ip6h_nxt;
3543 			dopt = (struct ip6_opt *)(dstopt + 1);
3544 		}
3545 		sopt = (const struct ip6_opt *)(srcopt + 1);
3546 		hol -= sizeof (*srcopt);
3547 		tlen = sizeof (*dstopt);
3548 		lastpad = NULL;
3549 		deleting = B_FALSE;
3550 		/*
3551 		 * This loop finds the first (lastpad pointer) of any number of
3552 		 * pads that preceeds the security option, then treats the
3553 		 * security option as though it were a pad, and then finds the
3554 		 * next non-pad option (or end of list).
3555 		 *
3556 		 * It then treats the entire block as one big pad.  To preserve
3557 		 * alignment of any options that follow, or just the end of the
3558 		 * list, it computes a minimal new padding size that keeps the
3559 		 * same alignment for the next option.
3560 		 *
3561 		 * If it encounters just a sequence of pads with no security
3562 		 * option, those are copied as-is rather than collapsed.
3563 		 *
3564 		 * Note that to handle the end of list case, the code makes one
3565 		 * loop with 'hol' set to zero.
3566 		 */
3567 		for (;;) {
3568 			if (hol > 0) {
3569 				if (sopt->ip6o_type == IP6OPT_PAD1) {
3570 					if (lastpad == NULL)
3571 						lastpad = sopt;
3572 					sopt = (const struct ip6_opt *)
3573 					    &sopt->ip6o_len;
3574 					hol--;
3575 					continue;
3576 				}
3577 				olen = sopt->ip6o_len + sizeof (*sopt);
3578 				if (olen > hol)
3579 					olen = hol;
3580 				if (sopt->ip6o_type == IP6OPT_PADN ||
3581 				    sopt->ip6o_type == ip6opt_ls) {
3582 					if (sopt->ip6o_type == ip6opt_ls)
3583 						deleting = B_TRUE;
3584 					if (lastpad == NULL)
3585 						lastpad = sopt;
3586 					sopt = (const struct ip6_opt *)
3587 					    ((const char *)sopt + olen);
3588 					hol -= olen;
3589 					continue;
3590 				}
3591 			} else {
3592 				/* if nothing was copied at all, then delete */
3593 				if (tlen == sizeof (*dstopt))
3594 					return (0);
3595 				/* last pass; pick up any trailing padding */
3596 				olen = 0;
3597 			}
3598 			if (deleting) {
3599 				/*
3600 				 * compute aligning effect of deleted material
3601 				 * to reproduce with pad.
3602 				 */
3603 				plen = ((const char *)sopt -
3604 				    (const char *)lastpad) & 7;
3605 				tlen += plen;
3606 				if (dopt != NULL) {
3607 					if (plen == 1) {
3608 						dopt->ip6o_type = IP6OPT_PAD1;
3609 					} else if (plen > 1) {
3610 						plen -= sizeof (*dopt);
3611 						dopt->ip6o_type = IP6OPT_PADN;
3612 						dopt->ip6o_len = plen;
3613 						if (plen > 0)
3614 							bzero(dopt + 1, plen);
3615 					}
3616 					dopt = (struct ip6_opt *)
3617 					    ((char *)dopt + plen);
3618 				}
3619 				deleting = B_FALSE;
3620 				lastpad = NULL;
3621 			}
3622 			/* if there's uncopied padding, then copy that now */
3623 			if (lastpad != NULL) {
3624 				olen += (const char *)sopt -
3625 				    (const char *)lastpad;
3626 				sopt = lastpad;
3627 				lastpad = NULL;
3628 			}
3629 			if (dopt != NULL && olen > 0) {
3630 				bcopy(sopt, dopt, olen);
3631 				dopt = (struct ip6_opt *)((char *)dopt + olen);
3632 			}
3633 			if (hol == 0)
3634 				break;
3635 			tlen += olen;
3636 			sopt = (const struct ip6_opt *)
3637 			    ((const char *)sopt + olen);
3638 			hol -= olen;
3639 		}
3640 		/* go back and patch up the length value, rounded upward */
3641 		if (dstopt != NULL)
3642 			dstopt->ip6h_len = (tlen - 1) >> 3;
3643 	} else {
3644 		tlen = hol;
3645 		if (dstopt != NULL)
3646 			bcopy(srcopt, dstopt, hol);
3647 	}
3648 
3649 	tlen += sizeof (*toh);
3650 	if (toh != NULL)
3651 		toh->len = tlen;
3652 
3653 	return (tlen);
3654 }
3655 
3656 /*
3657  * Update udp_rcv_opt_len from the packet.
3658  * Called when options received, and when no options received but
3659  * udp_ip_recv_opt_len has previously recorded options.
3660  */
3661 static void
3662 udp_save_ip_rcv_opt(udp_t *udp, void *opt, int opt_len)
3663 {
3664 	/* Save the options if any */
3665 	if (opt_len > 0) {
3666 		if (opt_len > udp->udp_ip_rcv_options_len) {
3667 			/* Need to allocate larger buffer */
3668 			if (udp->udp_ip_rcv_options_len != 0)
3669 				mi_free((char *)udp->udp_ip_rcv_options);
3670 			udp->udp_ip_rcv_options_len = 0;
3671 			udp->udp_ip_rcv_options =
3672 			    (uchar_t *)mi_alloc(opt_len, BPRI_HI);
3673 			if (udp->udp_ip_rcv_options != NULL)
3674 				udp->udp_ip_rcv_options_len = opt_len;
3675 		}
3676 		if (udp->udp_ip_rcv_options_len != 0) {
3677 			bcopy(opt, udp->udp_ip_rcv_options, opt_len);
3678 			/* Adjust length if we are resusing the space */
3679 			udp->udp_ip_rcv_options_len = opt_len;
3680 		}
3681 	} else if (udp->udp_ip_rcv_options_len != 0) {
3682 		/* Clear out previously recorded options */
3683 		mi_free((char *)udp->udp_ip_rcv_options);
3684 		udp->udp_ip_rcv_options = NULL;
3685 		udp->udp_ip_rcv_options_len = 0;
3686 	}
3687 }
3688 
3689 static void
3690 udp_queue_fallback(udp_t *udp, mblk_t *mp)
3691 {
3692 	ASSERT(MUTEX_HELD(&udp->udp_recv_lock));
3693 	if (IPCL_IS_NONSTR(udp->udp_connp)) {
3694 		/*
3695 		 * fallback has started but messages have not been moved yet
3696 		 */
3697 		if (udp->udp_fallback_queue_head == NULL) {
3698 			ASSERT(udp->udp_fallback_queue_tail == NULL);
3699 			udp->udp_fallback_queue_head = mp;
3700 			udp->udp_fallback_queue_tail = mp;
3701 		} else {
3702 			ASSERT(udp->udp_fallback_queue_tail != NULL);
3703 			udp->udp_fallback_queue_tail->b_next = mp;
3704 			udp->udp_fallback_queue_tail = mp;
3705 		}
3706 		mutex_exit(&udp->udp_recv_lock);
3707 	} else {
3708 		/*
3709 		 * no more fallbacks possible, ok to drop lock.
3710 		 */
3711 		mutex_exit(&udp->udp_recv_lock);
3712 		putnext(udp->udp_connp->conn_rq, mp);
3713 	}
3714 }
3715 
3716 /* ARGSUSED2 */
3717 static void
3718 udp_input(void *arg1, mblk_t *mp, void *arg2)
3719 {
3720 	conn_t *connp = (conn_t *)arg1;
3721 	struct T_unitdata_ind	*tudi;
3722 	uchar_t			*rptr;		/* Pointer to IP header */
3723 	int			hdr_length;	/* Length of IP+UDP headers */
3724 	int			opt_len;
3725 	int			udi_size;	/* Size of T_unitdata_ind */
3726 	int			mp_len;
3727 	udp_t			*udp;
3728 	udpha_t			*udpha;
3729 	int			ipversion;
3730 	ip6_pkt_t		ipp;
3731 	ip6_t			*ip6h;
3732 	ip6i_t			*ip6i;
3733 	mblk_t			*mp1;
3734 	mblk_t			*options_mp = NULL;
3735 	ip_pktinfo_t		*pinfo = NULL;
3736 	cred_t			*cr = NULL;
3737 	pid_t			cpid;
3738 	uint32_t		udp_ip_rcv_options_len;
3739 	udp_bits_t		udp_bits;
3740 	cred_t			*rcr = connp->conn_cred;
3741 	udp_stack_t *us;
3742 
3743 	ASSERT(connp->conn_flags & IPCL_UDPCONN);
3744 
3745 	udp = connp->conn_udp;
3746 	us = udp->udp_us;
3747 	rptr = mp->b_rptr;
3748 	ASSERT(DB_TYPE(mp) == M_DATA || DB_TYPE(mp) == M_CTL);
3749 	ASSERT(OK_32PTR(rptr));
3750 
3751 	/*
3752 	 * IP should have prepended the options data in an M_CTL
3753 	 * Check M_CTL "type" to make sure are not here bcos of
3754 	 * a valid ICMP message
3755 	 */
3756 	if (DB_TYPE(mp) == M_CTL) {
3757 		if (MBLKL(mp) == sizeof (ip_pktinfo_t) &&
3758 		    ((ip_pktinfo_t *)mp->b_rptr)->ip_pkt_ulp_type ==
3759 		    IN_PKTINFO) {
3760 			/*
3761 			 * IP_RECVIF or IP_RECVSLLA or IPF_RECVADDR information
3762 			 * has been prepended to the packet by IP. We need to
3763 			 * extract the mblk and adjust the rptr
3764 			 */
3765 			pinfo = (ip_pktinfo_t *)mp->b_rptr;
3766 			options_mp = mp;
3767 			mp = mp->b_cont;
3768 			rptr = mp->b_rptr;
3769 			UDP_STAT(us, udp_in_pktinfo);
3770 		} else {
3771 			/*
3772 			 * ICMP messages.
3773 			 */
3774 			udp_icmp_error(connp, mp);
3775 			return;
3776 		}
3777 	}
3778 
3779 	mp_len = msgdsize(mp);
3780 	/*
3781 	 * This is the inbound data path.
3782 	 * First, we check to make sure the IP version number is correct,
3783 	 * and then pull the IP and UDP headers into the first mblk.
3784 	 */
3785 
3786 	/* Initialize regardless if ipversion is IPv4 or IPv6 */
3787 	ipp.ipp_fields = 0;
3788 
3789 	ipversion = IPH_HDR_VERSION(rptr);
3790 
3791 	rw_enter(&udp->udp_rwlock, RW_READER);
3792 	udp_ip_rcv_options_len = udp->udp_ip_rcv_options_len;
3793 	udp_bits = udp->udp_bits;
3794 	rw_exit(&udp->udp_rwlock);
3795 
3796 	switch (ipversion) {
3797 	case IPV4_VERSION:
3798 		ASSERT(MBLKL(mp) >= sizeof (ipha_t));
3799 		ASSERT(((ipha_t *)rptr)->ipha_protocol == IPPROTO_UDP);
3800 		hdr_length = IPH_HDR_LENGTH(rptr) + UDPH_SIZE;
3801 		opt_len = hdr_length - (IP_SIMPLE_HDR_LENGTH + UDPH_SIZE);
3802 		if ((opt_len > 0 || udp_ip_rcv_options_len > 0) &&
3803 		    udp->udp_family == AF_INET) {
3804 			/*
3805 			 * Record/update udp_ip_rcv_options with the lock
3806 			 * held. Not needed for AF_INET6 sockets
3807 			 * since they don't support a getsockopt of IP_OPTIONS.
3808 			 */
3809 			rw_enter(&udp->udp_rwlock, RW_WRITER);
3810 			udp_save_ip_rcv_opt(udp, rptr + IP_SIMPLE_HDR_LENGTH,
3811 			    opt_len);
3812 			rw_exit(&udp->udp_rwlock);
3813 		}
3814 		/* Handle IPV6_RECVPKTINFO even for IPv4 packet. */
3815 		if ((udp->udp_family == AF_INET6) && (pinfo != NULL) &&
3816 		    udp->udp_ip_recvpktinfo) {
3817 			if (pinfo->ip_pkt_flags & IPF_RECVIF) {
3818 				ipp.ipp_fields |= IPPF_IFINDEX;
3819 				ipp.ipp_ifindex = pinfo->ip_pkt_ifindex;
3820 			}
3821 		}
3822 		break;
3823 	case IPV6_VERSION:
3824 		/*
3825 		 * IPv6 packets can only be received by applications
3826 		 * that are prepared to receive IPv6 addresses.
3827 		 * The IP fanout must ensure this.
3828 		 */
3829 		ASSERT(udp->udp_family == AF_INET6);
3830 
3831 		ip6h = (ip6_t *)rptr;
3832 		ASSERT((uchar_t *)&ip6h[1] <= mp->b_wptr);
3833 
3834 		if (ip6h->ip6_nxt != IPPROTO_UDP) {
3835 			uint8_t nexthdrp;
3836 			/* Look for ifindex information */
3837 			if (ip6h->ip6_nxt == IPPROTO_RAW) {
3838 				ip6i = (ip6i_t *)ip6h;
3839 				if ((uchar_t *)&ip6i[1] > mp->b_wptr)
3840 					goto tossit;
3841 
3842 				if (ip6i->ip6i_flags & IP6I_IFINDEX) {
3843 					ASSERT(ip6i->ip6i_ifindex != 0);
3844 					ipp.ipp_fields |= IPPF_IFINDEX;
3845 					ipp.ipp_ifindex = ip6i->ip6i_ifindex;
3846 				}
3847 				rptr = (uchar_t *)&ip6i[1];
3848 				mp->b_rptr = rptr;
3849 				if (rptr == mp->b_wptr) {
3850 					mp1 = mp->b_cont;
3851 					freeb(mp);
3852 					mp = mp1;
3853 					rptr = mp->b_rptr;
3854 				}
3855 				if (MBLKL(mp) < (IPV6_HDR_LEN + UDPH_SIZE))
3856 					goto tossit;
3857 				ip6h = (ip6_t *)rptr;
3858 				mp_len = msgdsize(mp);
3859 			}
3860 			/*
3861 			 * Find any potentially interesting extension headers
3862 			 * as well as the length of the IPv6 + extension
3863 			 * headers.
3864 			 */
3865 			hdr_length = ip_find_hdr_v6(mp, ip6h, &ipp, &nexthdrp) +
3866 			    UDPH_SIZE;
3867 			ASSERT(nexthdrp == IPPROTO_UDP);
3868 		} else {
3869 			hdr_length = IPV6_HDR_LEN + UDPH_SIZE;
3870 			ip6i = NULL;
3871 		}
3872 		break;
3873 	default:
3874 		ASSERT(0);
3875 	}
3876 
3877 	/*
3878 	 * IP inspected the UDP header thus all of it must be in the mblk.
3879 	 * UDP length check is performed for IPv6 packets and IPv4 packets
3880 	 * to check if the size of the packet as specified
3881 	 * by the header is the same as the physical size of the packet.
3882 	 * FIXME? Didn't IP already check this?
3883 	 */
3884 	udpha = (udpha_t *)(rptr + (hdr_length - UDPH_SIZE));
3885 	if ((MBLKL(mp) < hdr_length) ||
3886 	    (mp_len != (ntohs(udpha->uha_length) + hdr_length - UDPH_SIZE))) {
3887 		goto tossit;
3888 	}
3889 
3890 
3891 	/* Walk past the headers unless UDP_RCVHDR was set. */
3892 	if (!udp_bits.udpb_rcvhdr) {
3893 		mp->b_rptr = rptr + hdr_length;
3894 		mp_len -= hdr_length;
3895 	}
3896 
3897 	/*
3898 	 * This is the inbound data path.  Packets are passed upstream as
3899 	 * T_UNITDATA_IND messages with full IP headers still attached.
3900 	 */
3901 	if (udp->udp_family == AF_INET) {
3902 		sin_t *sin;
3903 
3904 		ASSERT(IPH_HDR_VERSION((ipha_t *)rptr) == IPV4_VERSION);
3905 
3906 		/*
3907 		 * Normally only send up the source address.
3908 		 * If IP_RECVDSTADDR is set we include the destination IP
3909 		 * address as an option. With IP_RECVOPTS we include all
3910 		 * the IP options.
3911 		 */
3912 		udi_size = sizeof (struct T_unitdata_ind) + sizeof (sin_t);
3913 		if (udp_bits.udpb_recvdstaddr) {
3914 			udi_size += sizeof (struct T_opthdr) +
3915 			    sizeof (struct in_addr);
3916 			UDP_STAT(us, udp_in_recvdstaddr);
3917 		}
3918 
3919 		if (udp_bits.udpb_ip_recvpktinfo && (pinfo != NULL) &&
3920 		    (pinfo->ip_pkt_flags & IPF_RECVADDR)) {
3921 			udi_size += sizeof (struct T_opthdr) +
3922 			    sizeof (struct in_pktinfo);
3923 			UDP_STAT(us, udp_ip_rcvpktinfo);
3924 		}
3925 
3926 		if ((udp_bits.udpb_recvopts) && opt_len > 0) {
3927 			udi_size += sizeof (struct T_opthdr) + opt_len;
3928 			UDP_STAT(us, udp_in_recvopts);
3929 		}
3930 
3931 		/*
3932 		 * If the IP_RECVSLLA or the IP_RECVIF is set then allocate
3933 		 * space accordingly
3934 		 */
3935 		if ((udp_bits.udpb_recvif) && (pinfo != NULL) &&
3936 		    (pinfo->ip_pkt_flags & IPF_RECVIF)) {
3937 			udi_size += sizeof (struct T_opthdr) + sizeof (uint_t);
3938 			UDP_STAT(us, udp_in_recvif);
3939 		}
3940 
3941 		if ((udp_bits.udpb_recvslla) && (pinfo != NULL) &&
3942 		    (pinfo->ip_pkt_flags & IPF_RECVSLLA)) {
3943 			udi_size += sizeof (struct T_opthdr) +
3944 			    sizeof (struct sockaddr_dl);
3945 			UDP_STAT(us, udp_in_recvslla);
3946 		}
3947 
3948 		if ((udp_bits.udpb_recvucred) &&
3949 		    (cr = msg_getcred(mp, &cpid)) != NULL) {
3950 			udi_size += sizeof (struct T_opthdr) + ucredsize;
3951 			UDP_STAT(us, udp_in_recvucred);
3952 		}
3953 
3954 		/*
3955 		 * If SO_TIMESTAMP is set allocate the appropriate sized
3956 		 * buffer. Since gethrestime() expects a pointer aligned
3957 		 * argument, we allocate space necessary for extra
3958 		 * alignment (even though it might not be used).
3959 		 */
3960 		if (udp_bits.udpb_timestamp) {
3961 			udi_size += sizeof (struct T_opthdr) +
3962 			    sizeof (timestruc_t) + _POINTER_ALIGNMENT;
3963 			UDP_STAT(us, udp_in_timestamp);
3964 		}
3965 
3966 		/*
3967 		 * If IP_RECVTTL is set allocate the appropriate sized buffer
3968 		 */
3969 		if (udp_bits.udpb_recvttl) {
3970 			udi_size += sizeof (struct T_opthdr) + sizeof (uint8_t);
3971 			UDP_STAT(us, udp_in_recvttl);
3972 		}
3973 
3974 		/* Allocate a message block for the T_UNITDATA_IND structure. */
3975 		mp1 = allocb(udi_size, BPRI_MED);
3976 		if (mp1 == NULL) {
3977 			freemsg(mp);
3978 			if (options_mp != NULL)
3979 				freeb(options_mp);
3980 			BUMP_MIB(&us->us_udp_mib, udpInErrors);
3981 			return;
3982 		}
3983 		mp1->b_cont = mp;
3984 		mp = mp1;
3985 		mp->b_datap->db_type = M_PROTO;
3986 		tudi = (struct T_unitdata_ind *)mp->b_rptr;
3987 		mp->b_wptr = (uchar_t *)tudi + udi_size;
3988 		tudi->PRIM_type = T_UNITDATA_IND;
3989 		tudi->SRC_length = sizeof (sin_t);
3990 		tudi->SRC_offset = sizeof (struct T_unitdata_ind);
3991 		tudi->OPT_offset = sizeof (struct T_unitdata_ind) +
3992 		    sizeof (sin_t);
3993 		udi_size -= (sizeof (struct T_unitdata_ind) + sizeof (sin_t));
3994 		tudi->OPT_length = udi_size;
3995 		sin = (sin_t *)&tudi[1];
3996 		sin->sin_addr.s_addr = ((ipha_t *)rptr)->ipha_src;
3997 		sin->sin_port =	udpha->uha_src_port;
3998 		sin->sin_family = udp->udp_family;
3999 		*(uint32_t *)&sin->sin_zero[0] = 0;
4000 		*(uint32_t *)&sin->sin_zero[4] = 0;
4001 
4002 		/*
4003 		 * Add options if IP_RECVDSTADDR, IP_RECVIF, IP_RECVSLLA or
4004 		 * IP_RECVTTL has been set.
4005 		 */
4006 		if (udi_size != 0) {
4007 			/*
4008 			 * Copy in destination address before options to avoid
4009 			 * any padding issues.
4010 			 */
4011 			char *dstopt;
4012 
4013 			dstopt = (char *)&sin[1];
4014 			if (udp_bits.udpb_recvdstaddr) {
4015 				struct T_opthdr *toh;
4016 				ipaddr_t *dstptr;
4017 
4018 				toh = (struct T_opthdr *)dstopt;
4019 				toh->level = IPPROTO_IP;
4020 				toh->name = IP_RECVDSTADDR;
4021 				toh->len = sizeof (struct T_opthdr) +
4022 				    sizeof (ipaddr_t);
4023 				toh->status = 0;
4024 				dstopt += sizeof (struct T_opthdr);
4025 				dstptr = (ipaddr_t *)dstopt;
4026 				*dstptr = ((ipha_t *)rptr)->ipha_dst;
4027 				dstopt += sizeof (ipaddr_t);
4028 				udi_size -= toh->len;
4029 			}
4030 
4031 			if (udp_bits.udpb_recvopts && opt_len > 0) {
4032 				struct T_opthdr *toh;
4033 
4034 				toh = (struct T_opthdr *)dstopt;
4035 				toh->level = IPPROTO_IP;
4036 				toh->name = IP_RECVOPTS;
4037 				toh->len = sizeof (struct T_opthdr) + opt_len;
4038 				toh->status = 0;
4039 				dstopt += sizeof (struct T_opthdr);
4040 				bcopy(rptr + IP_SIMPLE_HDR_LENGTH, dstopt,
4041 				    opt_len);
4042 				dstopt += opt_len;
4043 				udi_size -= toh->len;
4044 			}
4045 
4046 			if ((udp_bits.udpb_ip_recvpktinfo) && (pinfo != NULL) &&
4047 			    (pinfo->ip_pkt_flags & IPF_RECVADDR)) {
4048 				struct T_opthdr *toh;
4049 				struct in_pktinfo *pktinfop;
4050 
4051 				toh = (struct T_opthdr *)dstopt;
4052 				toh->level = IPPROTO_IP;
4053 				toh->name = IP_PKTINFO;
4054 				toh->len = sizeof (struct T_opthdr) +
4055 				    sizeof (*pktinfop);
4056 				toh->status = 0;
4057 				dstopt += sizeof (struct T_opthdr);
4058 				pktinfop = (struct in_pktinfo *)dstopt;
4059 				pktinfop->ipi_ifindex = pinfo->ip_pkt_ifindex;
4060 				pktinfop->ipi_spec_dst =
4061 				    pinfo->ip_pkt_match_addr;
4062 				pktinfop->ipi_addr.s_addr =
4063 				    ((ipha_t *)rptr)->ipha_dst;
4064 
4065 				dstopt += sizeof (struct in_pktinfo);
4066 				udi_size -= toh->len;
4067 			}
4068 
4069 			if ((udp_bits.udpb_recvslla) && (pinfo != NULL) &&
4070 			    (pinfo->ip_pkt_flags & IPF_RECVSLLA)) {
4071 
4072 				struct T_opthdr *toh;
4073 				struct sockaddr_dl	*dstptr;
4074 
4075 				toh = (struct T_opthdr *)dstopt;
4076 				toh->level = IPPROTO_IP;
4077 				toh->name = IP_RECVSLLA;
4078 				toh->len = sizeof (struct T_opthdr) +
4079 				    sizeof (struct sockaddr_dl);
4080 				toh->status = 0;
4081 				dstopt += sizeof (struct T_opthdr);
4082 				dstptr = (struct sockaddr_dl *)dstopt;
4083 				bcopy(&pinfo->ip_pkt_slla, dstptr,
4084 				    sizeof (struct sockaddr_dl));
4085 				dstopt += sizeof (struct sockaddr_dl);
4086 				udi_size -= toh->len;
4087 			}
4088 
4089 			if ((udp_bits.udpb_recvif) && (pinfo != NULL) &&
4090 			    (pinfo->ip_pkt_flags & IPF_RECVIF)) {
4091 
4092 				struct T_opthdr *toh;
4093 				uint_t		*dstptr;
4094 
4095 				toh = (struct T_opthdr *)dstopt;
4096 				toh->level = IPPROTO_IP;
4097 				toh->name = IP_RECVIF;
4098 				toh->len = sizeof (struct T_opthdr) +
4099 				    sizeof (uint_t);
4100 				toh->status = 0;
4101 				dstopt += sizeof (struct T_opthdr);
4102 				dstptr = (uint_t *)dstopt;
4103 				*dstptr = pinfo->ip_pkt_ifindex;
4104 				dstopt += sizeof (uint_t);
4105 				udi_size -= toh->len;
4106 			}
4107 
4108 			if (cr != NULL) {
4109 				struct T_opthdr *toh;
4110 
4111 				toh = (struct T_opthdr *)dstopt;
4112 				toh->level = SOL_SOCKET;
4113 				toh->name = SCM_UCRED;
4114 				toh->len = sizeof (struct T_opthdr) + ucredsize;
4115 				toh->status = 0;
4116 				dstopt += sizeof (struct T_opthdr);
4117 				(void) cred2ucred(cr, cpid, dstopt, rcr);
4118 				dstopt += ucredsize;
4119 				udi_size -= toh->len;
4120 			}
4121 
4122 			if (udp_bits.udpb_timestamp) {
4123 				struct	T_opthdr *toh;
4124 
4125 				toh = (struct T_opthdr *)dstopt;
4126 				toh->level = SOL_SOCKET;
4127 				toh->name = SCM_TIMESTAMP;
4128 				toh->len = sizeof (struct T_opthdr) +
4129 				    sizeof (timestruc_t) + _POINTER_ALIGNMENT;
4130 				toh->status = 0;
4131 				dstopt += sizeof (struct T_opthdr);
4132 				/* Align for gethrestime() */
4133 				dstopt = (char *)P2ROUNDUP((intptr_t)dstopt,
4134 				    sizeof (intptr_t));
4135 				gethrestime((timestruc_t *)dstopt);
4136 				dstopt = (char *)toh + toh->len;
4137 				udi_size -= toh->len;
4138 			}
4139 
4140 			/*
4141 			 * CAUTION:
4142 			 * Due to aligment issues
4143 			 * Processing of IP_RECVTTL option
4144 			 * should always be the last. Adding
4145 			 * any option processing after this will
4146 			 * cause alignment panic.
4147 			 */
4148 			if (udp_bits.udpb_recvttl) {
4149 				struct	T_opthdr *toh;
4150 				uint8_t	*dstptr;
4151 
4152 				toh = (struct T_opthdr *)dstopt;
4153 				toh->level = IPPROTO_IP;
4154 				toh->name = IP_RECVTTL;
4155 				toh->len = sizeof (struct T_opthdr) +
4156 				    sizeof (uint8_t);
4157 				toh->status = 0;
4158 				dstopt += sizeof (struct T_opthdr);
4159 				dstptr = (uint8_t *)dstopt;
4160 				*dstptr = ((ipha_t *)rptr)->ipha_ttl;
4161 				dstopt += sizeof (uint8_t);
4162 				udi_size -= toh->len;
4163 			}
4164 
4165 			/* Consumed all of allocated space */
4166 			ASSERT(udi_size == 0);
4167 		}
4168 	} else {
4169 		sin6_t *sin6;
4170 
4171 		/*
4172 		 * Handle both IPv4 and IPv6 packets for IPv6 sockets.
4173 		 *
4174 		 * Normally we only send up the address. If receiving of any
4175 		 * optional receive side information is enabled, we also send
4176 		 * that up as options.
4177 		 */
4178 		udi_size = sizeof (struct T_unitdata_ind) + sizeof (sin6_t);
4179 
4180 		if (ipp.ipp_fields & (IPPF_HOPOPTS|IPPF_DSTOPTS|IPPF_RTDSTOPTS|
4181 		    IPPF_RTHDR|IPPF_IFINDEX)) {
4182 			if ((udp_bits.udpb_ipv6_recvhopopts) &&
4183 			    (ipp.ipp_fields & IPPF_HOPOPTS)) {
4184 				size_t hlen;
4185 
4186 				UDP_STAT(us, udp_in_recvhopopts);
4187 				hlen = copy_hop_opts(&ipp, NULL);
4188 				if (hlen == 0)
4189 					ipp.ipp_fields &= ~IPPF_HOPOPTS;
4190 				udi_size += hlen;
4191 			}
4192 			if (((udp_bits.udpb_ipv6_recvdstopts) ||
4193 			    udp_bits.udpb_old_ipv6_recvdstopts) &&
4194 			    (ipp.ipp_fields & IPPF_DSTOPTS)) {
4195 				udi_size += sizeof (struct T_opthdr) +
4196 				    ipp.ipp_dstoptslen;
4197 				UDP_STAT(us, udp_in_recvdstopts);
4198 			}
4199 			if ((((udp_bits.udpb_ipv6_recvdstopts) &&
4200 			    udp_bits.udpb_ipv6_recvrthdr &&
4201 			    (ipp.ipp_fields & IPPF_RTHDR)) ||
4202 			    (udp_bits.udpb_ipv6_recvrthdrdstopts)) &&
4203 			    (ipp.ipp_fields & IPPF_RTDSTOPTS)) {
4204 				udi_size += sizeof (struct T_opthdr) +
4205 				    ipp.ipp_rtdstoptslen;
4206 				UDP_STAT(us, udp_in_recvrtdstopts);
4207 			}
4208 			if ((udp_bits.udpb_ipv6_recvrthdr) &&
4209 			    (ipp.ipp_fields & IPPF_RTHDR)) {
4210 				udi_size += sizeof (struct T_opthdr) +
4211 				    ipp.ipp_rthdrlen;
4212 				UDP_STAT(us, udp_in_recvrthdr);
4213 			}
4214 			if ((udp_bits.udpb_ip_recvpktinfo) &&
4215 			    (ipp.ipp_fields & IPPF_IFINDEX)) {
4216 				udi_size += sizeof (struct T_opthdr) +
4217 				    sizeof (struct in6_pktinfo);
4218 				UDP_STAT(us, udp_in_recvpktinfo);
4219 			}
4220 
4221 		}
4222 		if ((udp_bits.udpb_recvucred) &&
4223 		    (cr = msg_getcred(mp, &cpid)) != NULL) {
4224 			udi_size += sizeof (struct T_opthdr) + ucredsize;
4225 			UDP_STAT(us, udp_in_recvucred);
4226 		}
4227 
4228 		/*
4229 		 * If SO_TIMESTAMP is set allocate the appropriate sized
4230 		 * buffer. Since gethrestime() expects a pointer aligned
4231 		 * argument, we allocate space necessary for extra
4232 		 * alignment (even though it might not be used).
4233 		 */
4234 		if (udp_bits.udpb_timestamp) {
4235 			udi_size += sizeof (struct T_opthdr) +
4236 			    sizeof (timestruc_t) + _POINTER_ALIGNMENT;
4237 			UDP_STAT(us, udp_in_timestamp);
4238 		}
4239 
4240 		if (udp_bits.udpb_ipv6_recvhoplimit) {
4241 			udi_size += sizeof (struct T_opthdr) + sizeof (int);
4242 			UDP_STAT(us, udp_in_recvhoplimit);
4243 		}
4244 
4245 		if (udp_bits.udpb_ipv6_recvtclass) {
4246 			udi_size += sizeof (struct T_opthdr) + sizeof (int);
4247 			UDP_STAT(us, udp_in_recvtclass);
4248 		}
4249 
4250 		mp1 = allocb(udi_size, BPRI_MED);
4251 		if (mp1 == NULL) {
4252 			freemsg(mp);
4253 			if (options_mp != NULL)
4254 				freeb(options_mp);
4255 			BUMP_MIB(&us->us_udp_mib, udpInErrors);
4256 			return;
4257 		}
4258 		mp1->b_cont = mp;
4259 		mp = mp1;
4260 		mp->b_datap->db_type = M_PROTO;
4261 		tudi = (struct T_unitdata_ind *)mp->b_rptr;
4262 		mp->b_wptr = (uchar_t *)tudi + udi_size;
4263 		tudi->PRIM_type = T_UNITDATA_IND;
4264 		tudi->SRC_length = sizeof (sin6_t);
4265 		tudi->SRC_offset = sizeof (struct T_unitdata_ind);
4266 		tudi->OPT_offset = sizeof (struct T_unitdata_ind) +
4267 		    sizeof (sin6_t);
4268 		udi_size -= (sizeof (struct T_unitdata_ind) + sizeof (sin6_t));
4269 		tudi->OPT_length = udi_size;
4270 		sin6 = (sin6_t *)&tudi[1];
4271 		if (ipversion == IPV4_VERSION) {
4272 			in6_addr_t v6dst;
4273 
4274 			IN6_IPADDR_TO_V4MAPPED(((ipha_t *)rptr)->ipha_src,
4275 			    &sin6->sin6_addr);
4276 			IN6_IPADDR_TO_V4MAPPED(((ipha_t *)rptr)->ipha_dst,
4277 			    &v6dst);
4278 			sin6->sin6_flowinfo = 0;
4279 			sin6->sin6_scope_id = 0;
4280 			sin6->__sin6_src_id = ip_srcid_find_addr(&v6dst,
4281 			    connp->conn_zoneid, us->us_netstack);
4282 		} else {
4283 			sin6->sin6_addr = ip6h->ip6_src;
4284 			/* No sin6_flowinfo per API */
4285 			sin6->sin6_flowinfo = 0;
4286 			/* For link-scope source pass up scope id */
4287 			if ((ipp.ipp_fields & IPPF_IFINDEX) &&
4288 			    IN6_IS_ADDR_LINKSCOPE(&ip6h->ip6_src))
4289 				sin6->sin6_scope_id = ipp.ipp_ifindex;
4290 			else
4291 				sin6->sin6_scope_id = 0;
4292 			sin6->__sin6_src_id = ip_srcid_find_addr(
4293 			    &ip6h->ip6_dst, connp->conn_zoneid,
4294 			    us->us_netstack);
4295 		}
4296 		sin6->sin6_port = udpha->uha_src_port;
4297 		sin6->sin6_family = udp->udp_family;
4298 
4299 		if (udi_size != 0) {
4300 			uchar_t *dstopt;
4301 
4302 			dstopt = (uchar_t *)&sin6[1];
4303 			if ((udp_bits.udpb_ip_recvpktinfo) &&
4304 			    (ipp.ipp_fields & IPPF_IFINDEX)) {
4305 				struct T_opthdr *toh;
4306 				struct in6_pktinfo *pkti;
4307 
4308 				toh = (struct T_opthdr *)dstopt;
4309 				toh->level = IPPROTO_IPV6;
4310 				toh->name = IPV6_PKTINFO;
4311 				toh->len = sizeof (struct T_opthdr) +
4312 				    sizeof (*pkti);
4313 				toh->status = 0;
4314 				dstopt += sizeof (struct T_opthdr);
4315 				pkti = (struct in6_pktinfo *)dstopt;
4316 				if (ipversion == IPV6_VERSION)
4317 					pkti->ipi6_addr = ip6h->ip6_dst;
4318 				else
4319 					IN6_IPADDR_TO_V4MAPPED(
4320 					    ((ipha_t *)rptr)->ipha_dst,
4321 					    &pkti->ipi6_addr);
4322 				pkti->ipi6_ifindex = ipp.ipp_ifindex;
4323 				dstopt += sizeof (*pkti);
4324 				udi_size -= toh->len;
4325 			}
4326 			if (udp_bits.udpb_ipv6_recvhoplimit) {
4327 				struct T_opthdr *toh;
4328 
4329 				toh = (struct T_opthdr *)dstopt;
4330 				toh->level = IPPROTO_IPV6;
4331 				toh->name = IPV6_HOPLIMIT;
4332 				toh->len = sizeof (struct T_opthdr) +
4333 				    sizeof (uint_t);
4334 				toh->status = 0;
4335 				dstopt += sizeof (struct T_opthdr);
4336 				if (ipversion == IPV6_VERSION)
4337 					*(uint_t *)dstopt = ip6h->ip6_hops;
4338 				else
4339 					*(uint_t *)dstopt =
4340 					    ((ipha_t *)rptr)->ipha_ttl;
4341 				dstopt += sizeof (uint_t);
4342 				udi_size -= toh->len;
4343 			}
4344 			if (udp_bits.udpb_ipv6_recvtclass) {
4345 				struct T_opthdr *toh;
4346 
4347 				toh = (struct T_opthdr *)dstopt;
4348 				toh->level = IPPROTO_IPV6;
4349 				toh->name = IPV6_TCLASS;
4350 				toh->len = sizeof (struct T_opthdr) +
4351 				    sizeof (uint_t);
4352 				toh->status = 0;
4353 				dstopt += sizeof (struct T_opthdr);
4354 				if (ipversion == IPV6_VERSION) {
4355 					*(uint_t *)dstopt =
4356 					    IPV6_FLOW_TCLASS(ip6h->ip6_flow);
4357 				} else {
4358 					ipha_t *ipha = (ipha_t *)rptr;
4359 					*(uint_t *)dstopt =
4360 					    ipha->ipha_type_of_service;
4361 				}
4362 				dstopt += sizeof (uint_t);
4363 				udi_size -= toh->len;
4364 			}
4365 			if ((udp_bits.udpb_ipv6_recvhopopts) &&
4366 			    (ipp.ipp_fields & IPPF_HOPOPTS)) {
4367 				size_t hlen;
4368 
4369 				hlen = copy_hop_opts(&ipp, dstopt);
4370 				dstopt += hlen;
4371 				udi_size -= hlen;
4372 			}
4373 			if ((udp_bits.udpb_ipv6_recvdstopts) &&
4374 			    (udp_bits.udpb_ipv6_recvrthdr) &&
4375 			    (ipp.ipp_fields & IPPF_RTHDR) &&
4376 			    (ipp.ipp_fields & IPPF_RTDSTOPTS)) {
4377 				struct T_opthdr *toh;
4378 
4379 				toh = (struct T_opthdr *)dstopt;
4380 				toh->level = IPPROTO_IPV6;
4381 				toh->name = IPV6_DSTOPTS;
4382 				toh->len = sizeof (struct T_opthdr) +
4383 				    ipp.ipp_rtdstoptslen;
4384 				toh->status = 0;
4385 				dstopt += sizeof (struct T_opthdr);
4386 				bcopy(ipp.ipp_rtdstopts, dstopt,
4387 				    ipp.ipp_rtdstoptslen);
4388 				dstopt += ipp.ipp_rtdstoptslen;
4389 				udi_size -= toh->len;
4390 			}
4391 			if ((udp_bits.udpb_ipv6_recvrthdr) &&
4392 			    (ipp.ipp_fields & IPPF_RTHDR)) {
4393 				struct T_opthdr *toh;
4394 
4395 				toh = (struct T_opthdr *)dstopt;
4396 				toh->level = IPPROTO_IPV6;
4397 				toh->name = IPV6_RTHDR;
4398 				toh->len = sizeof (struct T_opthdr) +
4399 				    ipp.ipp_rthdrlen;
4400 				toh->status = 0;
4401 				dstopt += sizeof (struct T_opthdr);
4402 				bcopy(ipp.ipp_rthdr, dstopt, ipp.ipp_rthdrlen);
4403 				dstopt += ipp.ipp_rthdrlen;
4404 				udi_size -= toh->len;
4405 			}
4406 			if ((udp_bits.udpb_ipv6_recvdstopts) &&
4407 			    (ipp.ipp_fields & IPPF_DSTOPTS)) {
4408 				struct T_opthdr *toh;
4409 
4410 				toh = (struct T_opthdr *)dstopt;
4411 				toh->level = IPPROTO_IPV6;
4412 				toh->name = IPV6_DSTOPTS;
4413 				toh->len = sizeof (struct T_opthdr) +
4414 				    ipp.ipp_dstoptslen;
4415 				toh->status = 0;
4416 				dstopt += sizeof (struct T_opthdr);
4417 				bcopy(ipp.ipp_dstopts, dstopt,
4418 				    ipp.ipp_dstoptslen);
4419 				dstopt += ipp.ipp_dstoptslen;
4420 				udi_size -= toh->len;
4421 			}
4422 			if (cr != NULL) {
4423 				struct T_opthdr *toh;
4424 
4425 				toh = (struct T_opthdr *)dstopt;
4426 				toh->level = SOL_SOCKET;
4427 				toh->name = SCM_UCRED;
4428 				toh->len = sizeof (struct T_opthdr) + ucredsize;
4429 				toh->status = 0;
4430 				(void) cred2ucred(cr, cpid, &toh[1], rcr);
4431 				dstopt += toh->len;
4432 				udi_size -= toh->len;
4433 			}
4434 			if (udp_bits.udpb_timestamp) {
4435 				struct	T_opthdr *toh;
4436 
4437 				toh = (struct T_opthdr *)dstopt;
4438 				toh->level = SOL_SOCKET;
4439 				toh->name = SCM_TIMESTAMP;
4440 				toh->len = sizeof (struct T_opthdr) +
4441 				    sizeof (timestruc_t) + _POINTER_ALIGNMENT;
4442 				toh->status = 0;
4443 				dstopt += sizeof (struct T_opthdr);
4444 				/* Align for gethrestime() */
4445 				dstopt = (uchar_t *)P2ROUNDUP((intptr_t)dstopt,
4446 				    sizeof (intptr_t));
4447 				gethrestime((timestruc_t *)dstopt);
4448 				dstopt = (uchar_t *)toh + toh->len;
4449 				udi_size -= toh->len;
4450 			}
4451 
4452 			/* Consumed all of allocated space */
4453 			ASSERT(udi_size == 0);
4454 		}
4455 #undef	sin6
4456 		/* No IP_RECVDSTADDR for IPv6. */
4457 	}
4458 
4459 	BUMP_MIB(&us->us_udp_mib, udpHCInDatagrams);
4460 	if (options_mp != NULL)
4461 		freeb(options_mp);
4462 
4463 	if (IPCL_IS_NONSTR(connp)) {
4464 		int error;
4465 
4466 		if ((*connp->conn_upcalls->su_recv)
4467 		    (connp->conn_upper_handle, mp, msgdsize(mp), 0, &error,
4468 		    NULL) < 0) {
4469 			mutex_enter(&udp->udp_recv_lock);
4470 			if (error == ENOSPC) {
4471 				/*
4472 				 * let's confirm while holding the lock
4473 				 */
4474 				if ((*connp->conn_upcalls->su_recv)
4475 				    (connp->conn_upper_handle, NULL, 0, 0,
4476 				    &error, NULL) < 0) {
4477 					if (error == ENOSPC) {
4478 						connp->conn_flow_cntrld =
4479 						    B_TRUE;
4480 					} else {
4481 						ASSERT(error == EOPNOTSUPP);
4482 					}
4483 				}
4484 				mutex_exit(&udp->udp_recv_lock);
4485 			} else {
4486 				ASSERT(error == EOPNOTSUPP);
4487 				udp_queue_fallback(udp, mp);
4488 			}
4489 		}
4490 	} else {
4491 		putnext(connp->conn_rq, mp);
4492 	}
4493 	ASSERT(MUTEX_NOT_HELD(&udp->udp_recv_lock));
4494 	return;
4495 
4496 tossit:
4497 	freemsg(mp);
4498 	if (options_mp != NULL)
4499 		freeb(options_mp);
4500 	BUMP_MIB(&us->us_udp_mib, udpInErrors);
4501 }
4502 
4503 /*
4504  * return SNMP stuff in buffer in mpdata. We don't hold any lock and report
4505  * information that can be changing beneath us.
4506  */
4507 mblk_t *
4508 udp_snmp_get(queue_t *q, mblk_t *mpctl)
4509 {
4510 	mblk_t			*mpdata;
4511 	mblk_t			*mp_conn_ctl;
4512 	mblk_t			*mp_attr_ctl;
4513 	mblk_t			*mp6_conn_ctl;
4514 	mblk_t			*mp6_attr_ctl;
4515 	mblk_t			*mp_conn_tail;
4516 	mblk_t			*mp_attr_tail;
4517 	mblk_t			*mp6_conn_tail;
4518 	mblk_t			*mp6_attr_tail;
4519 	struct opthdr		*optp;
4520 	mib2_udpEntry_t		ude;
4521 	mib2_udp6Entry_t	ude6;
4522 	mib2_transportMLPEntry_t mlp;
4523 	int			state;
4524 	zoneid_t		zoneid;
4525 	int			i;
4526 	connf_t			*connfp;
4527 	conn_t			*connp = Q_TO_CONN(q);
4528 	int			v4_conn_idx;
4529 	int			v6_conn_idx;
4530 	boolean_t		needattr;
4531 	udp_t			*udp;
4532 	ip_stack_t		*ipst = connp->conn_netstack->netstack_ip;
4533 	udp_stack_t		*us = connp->conn_netstack->netstack_udp;
4534 	mblk_t			*mp2ctl;
4535 
4536 	/*
4537 	 * make a copy of the original message
4538 	 */
4539 	mp2ctl = copymsg(mpctl);
4540 
4541 	mp_conn_ctl = mp_attr_ctl = mp6_conn_ctl = NULL;
4542 	if (mpctl == NULL ||
4543 	    (mpdata = mpctl->b_cont) == NULL ||
4544 	    (mp_conn_ctl = copymsg(mpctl)) == NULL ||
4545 	    (mp_attr_ctl = copymsg(mpctl)) == NULL ||
4546 	    (mp6_conn_ctl = copymsg(mpctl)) == NULL ||
4547 	    (mp6_attr_ctl = copymsg(mpctl)) == NULL) {
4548 		freemsg(mp_conn_ctl);
4549 		freemsg(mp_attr_ctl);
4550 		freemsg(mp6_conn_ctl);
4551 		freemsg(mpctl);
4552 		freemsg(mp2ctl);
4553 		return (0);
4554 	}
4555 
4556 	zoneid = connp->conn_zoneid;
4557 
4558 	/* fixed length structure for IPv4 and IPv6 counters */
4559 	SET_MIB(us->us_udp_mib.udpEntrySize, sizeof (mib2_udpEntry_t));
4560 	SET_MIB(us->us_udp_mib.udp6EntrySize, sizeof (mib2_udp6Entry_t));
4561 	/* synchronize 64- and 32-bit counters */
4562 	SYNC32_MIB(&us->us_udp_mib, udpInDatagrams, udpHCInDatagrams);
4563 	SYNC32_MIB(&us->us_udp_mib, udpOutDatagrams, udpHCOutDatagrams);
4564 
4565 	optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
4566 	optp->level = MIB2_UDP;
4567 	optp->name = 0;
4568 	(void) snmp_append_data(mpdata, (char *)&us->us_udp_mib,
4569 	    sizeof (us->us_udp_mib));
4570 	optp->len = msgdsize(mpdata);
4571 	qreply(q, mpctl);
4572 
4573 	mp_conn_tail = mp_attr_tail = mp6_conn_tail = mp6_attr_tail = NULL;
4574 	v4_conn_idx = v6_conn_idx = 0;
4575 
4576 	for (i = 0; i < CONN_G_HASH_SIZE; i++) {
4577 		connfp = &ipst->ips_ipcl_globalhash_fanout[i];
4578 		connp = NULL;
4579 
4580 		while ((connp = ipcl_get_next_conn(connfp, connp,
4581 		    IPCL_UDPCONN))) {
4582 			udp = connp->conn_udp;
4583 			if (zoneid != connp->conn_zoneid)
4584 				continue;
4585 
4586 			/*
4587 			 * Note that the port numbers are sent in
4588 			 * host byte order
4589 			 */
4590 
4591 			if (udp->udp_state == TS_UNBND)
4592 				state = MIB2_UDP_unbound;
4593 			else if (udp->udp_state == TS_IDLE)
4594 				state = MIB2_UDP_idle;
4595 			else if (udp->udp_state == TS_DATA_XFER)
4596 				state = MIB2_UDP_connected;
4597 			else
4598 				state = MIB2_UDP_unknown;
4599 
4600 			needattr = B_FALSE;
4601 			bzero(&mlp, sizeof (mlp));
4602 			if (connp->conn_mlp_type != mlptSingle) {
4603 				if (connp->conn_mlp_type == mlptShared ||
4604 				    connp->conn_mlp_type == mlptBoth)
4605 					mlp.tme_flags |= MIB2_TMEF_SHARED;
4606 				if (connp->conn_mlp_type == mlptPrivate ||
4607 				    connp->conn_mlp_type == mlptBoth)
4608 					mlp.tme_flags |= MIB2_TMEF_PRIVATE;
4609 				needattr = B_TRUE;
4610 			}
4611 
4612 			/*
4613 			 * Create an IPv4 table entry for IPv4 entries and also
4614 			 * any IPv6 entries which are bound to in6addr_any
4615 			 * (i.e. anything a IPv4 peer could connect/send to).
4616 			 */
4617 			if (udp->udp_ipversion == IPV4_VERSION ||
4618 			    (udp->udp_state <= TS_IDLE &&
4619 			    IN6_IS_ADDR_UNSPECIFIED(&udp->udp_v6src))) {
4620 				ude.udpEntryInfo.ue_state = state;
4621 				/*
4622 				 * If in6addr_any this will set it to
4623 				 * INADDR_ANY
4624 				 */
4625 				ude.udpLocalAddress =
4626 				    V4_PART_OF_V6(udp->udp_v6src);
4627 				ude.udpLocalPort = ntohs(udp->udp_port);
4628 				if (udp->udp_state == TS_DATA_XFER) {
4629 					/*
4630 					 * Can potentially get here for
4631 					 * v6 socket if another process
4632 					 * (say, ping) has just done a
4633 					 * sendto(), changing the state
4634 					 * from the TS_IDLE above to
4635 					 * TS_DATA_XFER by the time we hit
4636 					 * this part of the code.
4637 					 */
4638 					ude.udpEntryInfo.ue_RemoteAddress =
4639 					    V4_PART_OF_V6(udp->udp_v6dst);
4640 					ude.udpEntryInfo.ue_RemotePort =
4641 					    ntohs(udp->udp_dstport);
4642 				} else {
4643 					ude.udpEntryInfo.ue_RemoteAddress = 0;
4644 					ude.udpEntryInfo.ue_RemotePort = 0;
4645 				}
4646 
4647 				/*
4648 				 * We make the assumption that all udp_t
4649 				 * structs will be created within an address
4650 				 * region no larger than 32-bits.
4651 				 */
4652 				ude.udpInstance = (uint32_t)(uintptr_t)udp;
4653 				ude.udpCreationProcess =
4654 				    (udp->udp_open_pid < 0) ?
4655 				    MIB2_UNKNOWN_PROCESS :
4656 				    udp->udp_open_pid;
4657 				ude.udpCreationTime = udp->udp_open_time;
4658 
4659 				(void) snmp_append_data2(mp_conn_ctl->b_cont,
4660 				    &mp_conn_tail, (char *)&ude, sizeof (ude));
4661 				mlp.tme_connidx = v4_conn_idx++;
4662 				if (needattr)
4663 					(void) snmp_append_data2(
4664 					    mp_attr_ctl->b_cont, &mp_attr_tail,
4665 					    (char *)&mlp, sizeof (mlp));
4666 			}
4667 			if (udp->udp_ipversion == IPV6_VERSION) {
4668 				ude6.udp6EntryInfo.ue_state  = state;
4669 				ude6.udp6LocalAddress = udp->udp_v6src;
4670 				ude6.udp6LocalPort = ntohs(udp->udp_port);
4671 				ude6.udp6IfIndex = udp->udp_bound_if;
4672 				if (udp->udp_state == TS_DATA_XFER) {
4673 					ude6.udp6EntryInfo.ue_RemoteAddress =
4674 					    udp->udp_v6dst;
4675 					ude6.udp6EntryInfo.ue_RemotePort =
4676 					    ntohs(udp->udp_dstport);
4677 				} else {
4678 					ude6.udp6EntryInfo.ue_RemoteAddress =
4679 					    sin6_null.sin6_addr;
4680 					ude6.udp6EntryInfo.ue_RemotePort = 0;
4681 				}
4682 				/*
4683 				 * We make the assumption that all udp_t
4684 				 * structs will be created within an address
4685 				 * region no larger than 32-bits.
4686 				 */
4687 				ude6.udp6Instance = (uint32_t)(uintptr_t)udp;
4688 				ude6.udp6CreationProcess =
4689 				    (udp->udp_open_pid < 0) ?
4690 				    MIB2_UNKNOWN_PROCESS :
4691 				    udp->udp_open_pid;
4692 				ude6.udp6CreationTime = udp->udp_open_time;
4693 
4694 				(void) snmp_append_data2(mp6_conn_ctl->b_cont,
4695 				    &mp6_conn_tail, (char *)&ude6,
4696 				    sizeof (ude6));
4697 				mlp.tme_connidx = v6_conn_idx++;
4698 				if (needattr)
4699 					(void) snmp_append_data2(
4700 					    mp6_attr_ctl->b_cont,
4701 					    &mp6_attr_tail, (char *)&mlp,
4702 					    sizeof (mlp));
4703 			}
4704 		}
4705 	}
4706 
4707 	/* IPv4 UDP endpoints */
4708 	optp = (struct opthdr *)&mp_conn_ctl->b_rptr[
4709 	    sizeof (struct T_optmgmt_ack)];
4710 	optp->level = MIB2_UDP;
4711 	optp->name = MIB2_UDP_ENTRY;
4712 	optp->len = msgdsize(mp_conn_ctl->b_cont);
4713 	qreply(q, mp_conn_ctl);
4714 
4715 	/* table of MLP attributes... */
4716 	optp = (struct opthdr *)&mp_attr_ctl->b_rptr[
4717 	    sizeof (struct T_optmgmt_ack)];
4718 	optp->level = MIB2_UDP;
4719 	optp->name = EXPER_XPORT_MLP;
4720 	optp->len = msgdsize(mp_attr_ctl->b_cont);
4721 	if (optp->len == 0)
4722 		freemsg(mp_attr_ctl);
4723 	else
4724 		qreply(q, mp_attr_ctl);
4725 
4726 	/* IPv6 UDP endpoints */
4727 	optp = (struct opthdr *)&mp6_conn_ctl->b_rptr[
4728 	    sizeof (struct T_optmgmt_ack)];
4729 	optp->level = MIB2_UDP6;
4730 	optp->name = MIB2_UDP6_ENTRY;
4731 	optp->len = msgdsize(mp6_conn_ctl->b_cont);
4732 	qreply(q, mp6_conn_ctl);
4733 
4734 	/* table of MLP attributes... */
4735 	optp = (struct opthdr *)&mp6_attr_ctl->b_rptr[
4736 	    sizeof (struct T_optmgmt_ack)];
4737 	optp->level = MIB2_UDP6;
4738 	optp->name = EXPER_XPORT_MLP;
4739 	optp->len = msgdsize(mp6_attr_ctl->b_cont);
4740 	if (optp->len == 0)
4741 		freemsg(mp6_attr_ctl);
4742 	else
4743 		qreply(q, mp6_attr_ctl);
4744 
4745 	return (mp2ctl);
4746 }
4747 
4748 /*
4749  * Return 0 if invalid set request, 1 otherwise, including non-udp requests.
4750  * NOTE: Per MIB-II, UDP has no writable data.
4751  * TODO:  If this ever actually tries to set anything, it needs to be
4752  * to do the appropriate locking.
4753  */
4754 /* ARGSUSED */
4755 int
4756 udp_snmp_set(queue_t *q, t_scalar_t level, t_scalar_t name,
4757     uchar_t *ptr, int len)
4758 {
4759 	switch (level) {
4760 	case MIB2_UDP:
4761 		return (0);
4762 	default:
4763 		return (1);
4764 	}
4765 }
4766 
4767 static void
4768 udp_report_item(mblk_t *mp, udp_t *udp)
4769 {
4770 	char *state;
4771 	char addrbuf1[INET6_ADDRSTRLEN];
4772 	char addrbuf2[INET6_ADDRSTRLEN];
4773 	uint_t print_len, buf_len;
4774 
4775 	buf_len = mp->b_datap->db_lim - mp->b_wptr;
4776 	ASSERT(buf_len >= 0);
4777 	if (buf_len == 0)
4778 		return;
4779 
4780 	if (udp->udp_state == TS_UNBND)
4781 		state = "UNBOUND";
4782 	else if (udp->udp_state == TS_IDLE)
4783 		state = "IDLE";
4784 	else if (udp->udp_state == TS_DATA_XFER)
4785 		state = "CONNECTED";
4786 	else
4787 		state = "UnkState";
4788 	print_len = snprintf((char *)mp->b_wptr, buf_len,
4789 	    MI_COL_PTRFMT_STR "%4d %5u %s %s %5u %s\n",
4790 	    (void *)udp, udp->udp_connp->conn_zoneid, ntohs(udp->udp_port),
4791 	    inet_ntop(AF_INET6, &udp->udp_v6src, addrbuf1, sizeof (addrbuf1)),
4792 	    inet_ntop(AF_INET6, &udp->udp_v6dst, addrbuf2, sizeof (addrbuf2)),
4793 	    ntohs(udp->udp_dstport), state);
4794 	if (print_len < buf_len) {
4795 		mp->b_wptr += print_len;
4796 	} else {
4797 		mp->b_wptr += buf_len;
4798 	}
4799 }
4800 
4801 /* Report for ndd "udp_status" */
4802 /* ARGSUSED */
4803 static int
4804 udp_status_report(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr)
4805 {
4806 	zoneid_t zoneid;
4807 	connf_t	*connfp;
4808 	conn_t	*connp = Q_TO_CONN(q);
4809 	udp_t	*udp = connp->conn_udp;
4810 	int	i;
4811 	udp_stack_t *us = udp->udp_us;
4812 	ip_stack_t *ipst = connp->conn_netstack->netstack_ip;
4813 
4814 	/*
4815 	 * Because of the ndd constraint, at most we can have 64K buffer
4816 	 * to put in all UDP info.  So to be more efficient, just
4817 	 * allocate a 64K buffer here, assuming we need that large buffer.
4818 	 * This may be a problem as any user can read udp_status.  Therefore
4819 	 * we limit the rate of doing this using us_ndd_get_info_interval.
4820 	 * This should be OK as normal users should not do this too often.
4821 	 */
4822 	if (cr == NULL || secpolicy_ip_config(cr, B_TRUE) != 0) {
4823 		if (ddi_get_lbolt() - us->us_last_ndd_get_info_time <
4824 		    drv_usectohz(us->us_ndd_get_info_interval * 1000)) {
4825 			(void) mi_mpprintf(mp, NDD_TOO_QUICK_MSG);
4826 			return (0);
4827 		}
4828 	}
4829 	if ((mp->b_cont = allocb(ND_MAX_BUF_LEN, BPRI_HI)) == NULL) {
4830 		/* The following may work even if we cannot get a large buf. */
4831 		(void) mi_mpprintf(mp, NDD_OUT_OF_BUF_MSG);
4832 		return (0);
4833 	}
4834 	(void) mi_mpprintf(mp,
4835 	    "UDP     " MI_COL_HDRPAD_STR
4836 	/*   12345678[89ABCDEF] */
4837 	    " zone lport src addr        dest addr       port  state");
4838 	/*    1234 12345 xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx 12345 UNBOUND */
4839 
4840 	zoneid = connp->conn_zoneid;
4841 
4842 	for (i = 0; i < CONN_G_HASH_SIZE; i++) {
4843 		connfp = &ipst->ips_ipcl_globalhash_fanout[i];
4844 		connp = NULL;
4845 
4846 		while ((connp = ipcl_get_next_conn(connfp, connp,
4847 		    IPCL_UDPCONN))) {
4848 			udp = connp->conn_udp;
4849 			if (zoneid != GLOBAL_ZONEID &&
4850 			    zoneid != connp->conn_zoneid)
4851 				continue;
4852 
4853 			udp_report_item(mp->b_cont, udp);
4854 		}
4855 	}
4856 	us->us_last_ndd_get_info_time = ddi_get_lbolt();
4857 	return (0);
4858 }
4859 
4860 /*
4861  * This routine creates a T_UDERROR_IND message and passes it upstream.
4862  * The address and options are copied from the T_UNITDATA_REQ message
4863  * passed in mp.  This message is freed.
4864  */
4865 static void
4866 udp_ud_err(queue_t *q, mblk_t *mp, uchar_t *destaddr, t_scalar_t destlen,
4867     t_scalar_t err)
4868 {
4869 	struct T_unitdata_req *tudr;
4870 	mblk_t	*mp1;
4871 	uchar_t	*optaddr;
4872 	t_scalar_t optlen;
4873 
4874 	if (DB_TYPE(mp) == M_DATA) {
4875 		ASSERT(destaddr != NULL && destlen != 0);
4876 		optaddr = NULL;
4877 		optlen = 0;
4878 	} else {
4879 		if ((mp->b_wptr < mp->b_rptr) ||
4880 		    (MBLKL(mp)) < sizeof (struct T_unitdata_req)) {
4881 			goto done;
4882 		}
4883 		tudr = (struct T_unitdata_req *)mp->b_rptr;
4884 		destaddr = mp->b_rptr + tudr->DEST_offset;
4885 		if (destaddr < mp->b_rptr || destaddr >= mp->b_wptr ||
4886 		    destaddr + tudr->DEST_length < mp->b_rptr ||
4887 		    destaddr + tudr->DEST_length > mp->b_wptr) {
4888 			goto done;
4889 		}
4890 		optaddr = mp->b_rptr + tudr->OPT_offset;
4891 		if (optaddr < mp->b_rptr || optaddr >= mp->b_wptr ||
4892 		    optaddr + tudr->OPT_length < mp->b_rptr ||
4893 		    optaddr + tudr->OPT_length > mp->b_wptr) {
4894 			goto done;
4895 		}
4896 		destlen = tudr->DEST_length;
4897 		optlen = tudr->OPT_length;
4898 	}
4899 
4900 	mp1 = mi_tpi_uderror_ind((char *)destaddr, destlen,
4901 	    (char *)optaddr, optlen, err);
4902 	if (mp1 != NULL)
4903 		qreply(q, mp1);
4904 
4905 done:
4906 	freemsg(mp);
4907 }
4908 
4909 /*
4910  * This routine removes a port number association from a stream.  It
4911  * is called by udp_wput to handle T_UNBIND_REQ messages.
4912  */
4913 static void
4914 udp_tpi_unbind(queue_t *q, mblk_t *mp)
4915 {
4916 	conn_t	*connp = Q_TO_CONN(q);
4917 	int	error;
4918 
4919 	error = udp_do_unbind(connp);
4920 	if (error) {
4921 		if (error < 0)
4922 			udp_err_ack(q, mp, -error, 0);
4923 		else
4924 			udp_err_ack(q, mp, TSYSERR, error);
4925 		return;
4926 	}
4927 
4928 	mp = mi_tpi_ok_ack_alloc(mp);
4929 	ASSERT(mp != NULL);
4930 	ASSERT(((struct T_ok_ack *)mp->b_rptr)->PRIM_type == T_OK_ACK);
4931 	qreply(q, mp);
4932 }
4933 
4934 /*
4935  * Don't let port fall into the privileged range.
4936  * Since the extra privileged ports can be arbitrary we also
4937  * ensure that we exclude those from consideration.
4938  * us->us_epriv_ports is not sorted thus we loop over it until
4939  * there are no changes.
4940  */
4941 static in_port_t
4942 udp_update_next_port(udp_t *udp, in_port_t port, boolean_t random)
4943 {
4944 	int i;
4945 	in_port_t nextport;
4946 	boolean_t restart = B_FALSE;
4947 	udp_stack_t *us = udp->udp_us;
4948 
4949 	if (random && udp_random_anon_port != 0) {
4950 		(void) random_get_pseudo_bytes((uint8_t *)&port,
4951 		    sizeof (in_port_t));
4952 		/*
4953 		 * Unless changed by a sys admin, the smallest anon port
4954 		 * is 32768 and the largest anon port is 65535.  It is
4955 		 * very likely (50%) for the random port to be smaller
4956 		 * than the smallest anon port.  When that happens,
4957 		 * add port % (anon port range) to the smallest anon
4958 		 * port to get the random port.  It should fall into the
4959 		 * valid anon port range.
4960 		 */
4961 		if (port < us->us_smallest_anon_port) {
4962 			port = us->us_smallest_anon_port +
4963 			    port % (us->us_largest_anon_port -
4964 			    us->us_smallest_anon_port);
4965 		}
4966 	}
4967 
4968 retry:
4969 	if (port < us->us_smallest_anon_port)
4970 		port = us->us_smallest_anon_port;
4971 
4972 	if (port > us->us_largest_anon_port) {
4973 		port = us->us_smallest_anon_port;
4974 		if (restart)
4975 			return (0);
4976 		restart = B_TRUE;
4977 	}
4978 
4979 	if (port < us->us_smallest_nonpriv_port)
4980 		port = us->us_smallest_nonpriv_port;
4981 
4982 	for (i = 0; i < us->us_num_epriv_ports; i++) {
4983 		if (port == us->us_epriv_ports[i]) {
4984 			port++;
4985 			/*
4986 			 * Make sure that the port is in the
4987 			 * valid range.
4988 			 */
4989 			goto retry;
4990 		}
4991 	}
4992 
4993 	if (is_system_labeled() &&
4994 	    (nextport = tsol_next_port(crgetzone(udp->udp_connp->conn_cred),
4995 	    port, IPPROTO_UDP, B_TRUE)) != 0) {
4996 		port = nextport;
4997 		goto retry;
4998 	}
4999 
5000 	return (port);
5001 }
5002 
5003 static int
5004 udp_update_label(queue_t *wq, mblk_t *mp, ipaddr_t dst,
5005     boolean_t *update_lastdst)
5006 {
5007 	int err;
5008 	uchar_t opt_storage[IP_MAX_OPT_LENGTH];
5009 	udp_t *udp = Q_TO_UDP(wq);
5010 	udp_stack_t	*us = udp->udp_us;
5011 	cred_t			*cr;
5012 
5013 	/*
5014 	 * All Solaris components should pass a db_credp
5015 	 * for this message, hence we ASSERT.
5016 	 * On production kernels we return an error to be robust against
5017 	 * random streams modules sitting on top of us.
5018 	 */
5019 	cr = msg_getcred(mp, NULL);
5020 	ASSERT(cr != NULL);
5021 	if (cr == NULL)
5022 		return (EINVAL);
5023 
5024 	/* Note that we use the cred/label from the message to handle MLP */
5025 	err = tsol_compute_label(cr, dst,
5026 	    opt_storage, udp->udp_connp->conn_mac_exempt,
5027 	    us->us_netstack->netstack_ip);
5028 	if (err == 0) {
5029 		err = tsol_update_options(&udp->udp_ip_snd_options,
5030 		    &udp->udp_ip_snd_options_len, &udp->udp_label_len,
5031 		    opt_storage);
5032 	}
5033 	if (err != 0) {
5034 		DTRACE_PROBE4(
5035 		    tx__ip__log__info__updatelabel__udp,
5036 		    char *, "queue(1) failed to update options(2) on mp(3)",
5037 		    queue_t *, wq, char *, opt_storage, mblk_t *, mp);
5038 	} else {
5039 		*update_lastdst = B_TRUE;
5040 	}
5041 	return (err);
5042 }
5043 
5044 static mblk_t *
5045 udp_output_v4(conn_t *connp, mblk_t *mp, ipaddr_t v4dst, uint16_t port,
5046     uint_t srcid, int *error, boolean_t insert_spi, struct nmsghdr *msg,
5047     cred_t *cr, pid_t pid)
5048 {
5049 	udp_t		*udp = connp->conn_udp;
5050 	mblk_t		*mp1 = mp;
5051 	mblk_t		*mp2;
5052 	ipha_t		*ipha;
5053 	int		ip_hdr_length;
5054 	uint32_t 	ip_len;
5055 	udpha_t		*udpha;
5056 	boolean_t 	lock_held = B_FALSE;
5057 	in_port_t	uha_src_port;
5058 	udpattrs_t	attrs;
5059 	uchar_t		ip_snd_opt[IP_MAX_OPT_LENGTH];
5060 	uint32_t	ip_snd_opt_len = 0;
5061 	ip4_pkt_t  	pktinfo;
5062 	ip4_pkt_t  	*pktinfop = &pktinfo;
5063 	ip_opt_info_t	optinfo;
5064 	ip_stack_t	*ipst = connp->conn_netstack->netstack_ip;
5065 	udp_stack_t	*us = udp->udp_us;
5066 	ipsec_stack_t	*ipss = ipst->ips_netstack->netstack_ipsec;
5067 	queue_t		*q = connp->conn_wq;
5068 	ire_t		*ire;
5069 	in6_addr_t	v6dst;
5070 	boolean_t	update_lastdst = B_FALSE;
5071 
5072 	*error = 0;
5073 	pktinfop->ip4_ill_index = 0;
5074 	pktinfop->ip4_addr = INADDR_ANY;
5075 	optinfo.ip_opt_flags = 0;
5076 	optinfo.ip_opt_ill_index = 0;
5077 
5078 	if (v4dst == INADDR_ANY)
5079 		v4dst = htonl(INADDR_LOOPBACK);
5080 
5081 	/*
5082 	 * If options passed in, feed it for verification and handling
5083 	 */
5084 	attrs.udpattr_credset = B_FALSE;
5085 	if (IPCL_IS_NONSTR(connp)) {
5086 		if (msg->msg_controllen != 0) {
5087 			attrs.udpattr_ipp4 = pktinfop;
5088 			attrs.udpattr_mb = mp;
5089 
5090 			rw_enter(&udp->udp_rwlock, RW_WRITER);
5091 			*error = process_auxiliary_options(connp,
5092 			    msg->msg_control, msg->msg_controllen,
5093 			    &attrs, &udp_opt_obj, udp_opt_set, cr);
5094 			rw_exit(&udp->udp_rwlock);
5095 			if (*error)
5096 				goto done;
5097 		}
5098 	} else {
5099 		if (DB_TYPE(mp) != M_DATA) {
5100 			mp1 = mp->b_cont;
5101 			if (((struct T_unitdata_req *)
5102 			    mp->b_rptr)->OPT_length != 0) {
5103 				attrs.udpattr_ipp4 = pktinfop;
5104 				attrs.udpattr_mb = mp;
5105 				if (udp_unitdata_opt_process(q, mp, error,
5106 				    &attrs) < 0)
5107 					goto done;
5108 				/*
5109 				 * Note: success in processing options.
5110 				 * mp option buffer represented by
5111 				 * OPT_length/offset now potentially modified
5112 				 * and contain option setting results
5113 				 */
5114 				ASSERT(*error == 0);
5115 			}
5116 		}
5117 	}
5118 
5119 	/* mp1 points to the M_DATA mblk carrying the packet */
5120 	ASSERT(mp1 != NULL && DB_TYPE(mp1) == M_DATA);
5121 
5122 	/*
5123 	 * Determine whether we need to mark the mblk with the user's
5124 	 * credentials.
5125 	 * If labeled then sockfs would have already done this.
5126 	 */
5127 	ASSERT(!is_system_labeled() || msg_getcred(mp, NULL) != NULL);
5128 
5129 	ire = connp->conn_ire_cache;
5130 	if (CLASSD(v4dst) || (ire == NULL) || (ire->ire_addr != v4dst) ||
5131 	    (ire->ire_type & (IRE_BROADCAST | IRE_LOCAL | IRE_LOOPBACK))) {
5132 		if (cr != NULL && msg_getcred(mp, NULL) == NULL)
5133 			mblk_setcred(mp, cr, pid);
5134 	}
5135 
5136 	rw_enter(&udp->udp_rwlock, RW_READER);
5137 	lock_held = B_TRUE;
5138 
5139 	/*
5140 	 * Cluster and TSOL note:
5141 	 *    udp.udp_v6lastdst		is shared by Cluster and TSOL
5142 	 *    udp.udp_lastdstport	is used by Cluster
5143 	 *
5144 	 * Both Cluster and TSOL need to update the dest addr and/or port.
5145 	 * Updating is done after both Cluster and TSOL checks, protected
5146 	 * by conn_lock.
5147 	 */
5148 	mutex_enter(&connp->conn_lock);
5149 
5150 	if (cl_inet_connect2 != NULL &&
5151 	    (!IN6_IS_ADDR_V4MAPPED(&udp->udp_v6lastdst) ||
5152 	    V4_PART_OF_V6(udp->udp_v6lastdst) != v4dst ||
5153 	    udp->udp_lastdstport != port)) {
5154 		mutex_exit(&connp->conn_lock);
5155 		*error = 0;
5156 		IN6_IPADDR_TO_V4MAPPED(v4dst, &v6dst);
5157 		CL_INET_UDP_CONNECT(connp, udp, B_TRUE, &v6dst, port, *error);
5158 		if (*error != 0) {
5159 			*error = EHOSTUNREACH;
5160 			goto done;
5161 		}
5162 		update_lastdst = B_TRUE;
5163 		mutex_enter(&connp->conn_lock);
5164 	}
5165 
5166 	/*
5167 	 * Check if our saved options are valid; update if not.
5168 	 * TSOL Note: Since we are not in WRITER mode, UDP packets
5169 	 * to different destination may require different labels,
5170 	 * or worse, UDP packets to same IP address may require
5171 	 * different labels due to use of shared all-zones address.
5172 	 * We use conn_lock to ensure that lastdst, ip_snd_options,
5173 	 * and ip_snd_options_len are consistent for the current
5174 	 * destination and are updated atomically.
5175 	 */
5176 	if (is_system_labeled()) {
5177 		/* Using UDP MLP requires SCM_UCRED from user */
5178 		if (connp->conn_mlp_type != mlptSingle &&
5179 		    !attrs.udpattr_credset) {
5180 			mutex_exit(&connp->conn_lock);
5181 			DTRACE_PROBE4(
5182 			    tx__ip__log__info__output__udp,
5183 			    char *, "MLP mp(1) lacks SCM_UCRED attr(2) on q(3)",
5184 			    mblk_t *, mp1, udpattrs_t *, &attrs, queue_t *, q);
5185 			*error = ECONNREFUSED;
5186 			goto done;
5187 		}
5188 		/*
5189 		 * update label option for this UDP socket if
5190 		 * - the destination has changed, or
5191 		 * - the UDP socket is MLP
5192 		 */
5193 		if ((!IN6_IS_ADDR_V4MAPPED(&udp->udp_v6lastdst) ||
5194 		    V4_PART_OF_V6(udp->udp_v6lastdst) != v4dst ||
5195 		    connp->conn_mlp_type != mlptSingle) &&
5196 		    (*error = udp_update_label(q, mp, v4dst, &update_lastdst))
5197 		    != 0) {
5198 			mutex_exit(&connp->conn_lock);
5199 			goto done;
5200 		}
5201 	}
5202 	if (update_lastdst) {
5203 		IN6_IPADDR_TO_V4MAPPED(v4dst, &udp->udp_v6lastdst);
5204 		udp->udp_lastdstport = port;
5205 	}
5206 	if (udp->udp_ip_snd_options_len > 0) {
5207 		ip_snd_opt_len = udp->udp_ip_snd_options_len;
5208 		bcopy(udp->udp_ip_snd_options, ip_snd_opt, ip_snd_opt_len);
5209 	}
5210 	mutex_exit(&connp->conn_lock);
5211 
5212 	/* Add an IP header */
5213 	ip_hdr_length = IP_SIMPLE_HDR_LENGTH + UDPH_SIZE + ip_snd_opt_len +
5214 	    (insert_spi ? sizeof (uint32_t) : 0);
5215 	ipha = (ipha_t *)&mp1->b_rptr[-ip_hdr_length];
5216 	if (DB_REF(mp1) != 1 || (uchar_t *)ipha < DB_BASE(mp1) ||
5217 	    !OK_32PTR(ipha)) {
5218 		mp2 = allocb(ip_hdr_length + us->us_wroff_extra, BPRI_LO);
5219 		if (mp2 == NULL) {
5220 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_END,
5221 			    "udp_wput_end: q %p (%S)", q, "allocbfail2");
5222 			*error = ENOMEM;
5223 			goto done;
5224 		}
5225 		mp2->b_wptr = DB_LIM(mp2);
5226 		mp2->b_cont = mp1;
5227 		mp1 = mp2;
5228 		if (DB_TYPE(mp) != M_DATA)
5229 			mp->b_cont = mp1;
5230 		else
5231 			mp = mp1;
5232 
5233 		ipha = (ipha_t *)(mp1->b_wptr - ip_hdr_length);
5234 	}
5235 	ip_hdr_length -= (UDPH_SIZE + (insert_spi ? sizeof (uint32_t) : 0));
5236 #ifdef	_BIG_ENDIAN
5237 	/* Set version, header length, and tos */
5238 	*(uint16_t *)&ipha->ipha_version_and_hdr_length =
5239 	    ((((IP_VERSION << 4) | (ip_hdr_length>>2)) << 8) |
5240 	    udp->udp_type_of_service);
5241 	/* Set ttl and protocol */
5242 	*(uint16_t *)&ipha->ipha_ttl = (udp->udp_ttl << 8) | IPPROTO_UDP;
5243 #else
5244 	/* Set version, header length, and tos */
5245 	*(uint16_t *)&ipha->ipha_version_and_hdr_length =
5246 	    ((udp->udp_type_of_service << 8) |
5247 	    ((IP_VERSION << 4) | (ip_hdr_length>>2)));
5248 	/* Set ttl and protocol */
5249 	*(uint16_t *)&ipha->ipha_ttl = (IPPROTO_UDP << 8) | udp->udp_ttl;
5250 #endif
5251 	if (pktinfop->ip4_addr != INADDR_ANY) {
5252 		ipha->ipha_src = pktinfop->ip4_addr;
5253 		optinfo.ip_opt_flags = IP_VERIFY_SRC;
5254 	} else {
5255 		/*
5256 		 * Copy our address into the packet.  If this is zero,
5257 		 * first look at __sin6_src_id for a hint. If we leave the
5258 		 * source as INADDR_ANY then ip will fill in the real source
5259 		 * address.
5260 		 */
5261 		IN6_V4MAPPED_TO_IPADDR(&udp->udp_v6src, ipha->ipha_src);
5262 		if (srcid != 0 && ipha->ipha_src == INADDR_ANY) {
5263 			in6_addr_t v6src;
5264 
5265 			ip_srcid_find_id(srcid, &v6src, connp->conn_zoneid,
5266 			    us->us_netstack);
5267 			IN6_V4MAPPED_TO_IPADDR(&v6src, ipha->ipha_src);
5268 		}
5269 	}
5270 	uha_src_port = udp->udp_port;
5271 	if (ip_hdr_length == IP_SIMPLE_HDR_LENGTH) {
5272 		rw_exit(&udp->udp_rwlock);
5273 		lock_held = B_FALSE;
5274 	}
5275 
5276 	if (pktinfop->ip4_ill_index != 0) {
5277 		optinfo.ip_opt_ill_index = pktinfop->ip4_ill_index;
5278 	}
5279 
5280 	ipha->ipha_fragment_offset_and_flags = 0;
5281 	ipha->ipha_ident = 0;
5282 
5283 	mp1->b_rptr = (uchar_t *)ipha;
5284 
5285 	ASSERT((uintptr_t)(mp1->b_wptr - (uchar_t *)ipha) <=
5286 	    (uintptr_t)UINT_MAX);
5287 
5288 	/* Determine length of packet */
5289 	ip_len = (uint32_t)(mp1->b_wptr - (uchar_t *)ipha);
5290 	if ((mp2 = mp1->b_cont) != NULL) {
5291 		do {
5292 			ASSERT((uintptr_t)MBLKL(mp2) <= (uintptr_t)UINT_MAX);
5293 			ip_len += (uint32_t)MBLKL(mp2);
5294 		} while ((mp2 = mp2->b_cont) != NULL);
5295 	}
5296 	/*
5297 	 * If the size of the packet is greater than the maximum allowed by
5298 	 * ip, return an error. Passing this down could cause panics because
5299 	 * the size will have wrapped and be inconsistent with the msg size.
5300 	 */
5301 	if (ip_len > IP_MAXPACKET) {
5302 		TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_END,
5303 		    "udp_wput_end: q %p (%S)", q, "IP length exceeded");
5304 		*error = EMSGSIZE;
5305 		goto done;
5306 	}
5307 	ipha->ipha_length = htons((uint16_t)ip_len);
5308 	ip_len -= ip_hdr_length;
5309 	ip_len = htons((uint16_t)ip_len);
5310 	udpha = (udpha_t *)(((uchar_t *)ipha) + ip_hdr_length);
5311 
5312 	/* Insert all-0s SPI now. */
5313 	if (insert_spi)
5314 		*((uint32_t *)(udpha + 1)) = 0;
5315 
5316 	/*
5317 	 * Copy in the destination address
5318 	 */
5319 	ipha->ipha_dst = v4dst;
5320 
5321 	/*
5322 	 * Set ttl based on IP_MULTICAST_TTL to match IPv6 logic.
5323 	 */
5324 	if (CLASSD(v4dst))
5325 		ipha->ipha_ttl = udp->udp_multicast_ttl;
5326 
5327 	udpha->uha_dst_port = port;
5328 	udpha->uha_src_port = uha_src_port;
5329 
5330 	if (ip_snd_opt_len > 0) {
5331 		uint32_t	cksum;
5332 
5333 		bcopy(ip_snd_opt, &ipha[1], ip_snd_opt_len);
5334 		lock_held = B_FALSE;
5335 		rw_exit(&udp->udp_rwlock);
5336 		/*
5337 		 * Massage source route putting first source route in ipha_dst.
5338 		 * Ignore the destination in T_unitdata_req.
5339 		 * Create a checksum adjustment for a source route, if any.
5340 		 */
5341 		cksum = ip_massage_options(ipha, us->us_netstack);
5342 		cksum = (cksum & 0xFFFF) + (cksum >> 16);
5343 		cksum -= ((ipha->ipha_dst >> 16) & 0xFFFF) +
5344 		    (ipha->ipha_dst & 0xFFFF);
5345 		if ((int)cksum < 0)
5346 			cksum--;
5347 		cksum = (cksum & 0xFFFF) + (cksum >> 16);
5348 		/*
5349 		 * IP does the checksum if uha_checksum is non-zero,
5350 		 * We make it easy for IP to include our pseudo header
5351 		 * by putting our length in uha_checksum.
5352 		 */
5353 		cksum += ip_len;
5354 		cksum = (cksum & 0xFFFF) + (cksum >> 16);
5355 		/* There might be a carry. */
5356 		cksum = (cksum & 0xFFFF) + (cksum >> 16);
5357 #ifdef _LITTLE_ENDIAN
5358 		if (us->us_do_checksum)
5359 			ip_len = (cksum << 16) | ip_len;
5360 #else
5361 		if (us->us_do_checksum)
5362 			ip_len = (ip_len << 16) | cksum;
5363 		else
5364 			ip_len <<= 16;
5365 #endif
5366 	} else {
5367 		/*
5368 		 * IP does the checksum if uha_checksum is non-zero,
5369 		 * We make it easy for IP to include our pseudo header
5370 		 * by putting our length in uha_checksum.
5371 		 */
5372 		if (us->us_do_checksum)
5373 			ip_len |= (ip_len << 16);
5374 #ifndef _LITTLE_ENDIAN
5375 		else
5376 			ip_len <<= 16;
5377 #endif
5378 	}
5379 	ASSERT(!lock_held);
5380 	/* Set UDP length and checksum */
5381 	*((uint32_t *)&udpha->uha_length) = ip_len;
5382 
5383 	if (DB_TYPE(mp) != M_DATA) {
5384 		cred_t *cr;
5385 		pid_t cpid;
5386 
5387 		/* Move any cred from the T_UNITDATA_REQ to the packet */
5388 		cr = msg_extractcred(mp, &cpid);
5389 		if (cr != NULL) {
5390 			if (mp1->b_datap->db_credp != NULL)
5391 				crfree(mp1->b_datap->db_credp);
5392 			mp1->b_datap->db_credp = cr;
5393 			mp1->b_datap->db_cpid = cpid;
5394 		}
5395 		ASSERT(mp != mp1);
5396 		freeb(mp);
5397 	}
5398 
5399 	/* mp has been consumed and we'll return success */
5400 	ASSERT(*error == 0);
5401 	mp = NULL;
5402 
5403 	/* We're done.  Pass the packet to ip. */
5404 	BUMP_MIB(&us->us_udp_mib, udpHCOutDatagrams);
5405 	TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_END,
5406 	    "udp_wput_end: q %p (%S)", q, "end");
5407 
5408 	if ((connp->conn_flags & IPCL_CHECK_POLICY) != 0 ||
5409 	    CONN_OUTBOUND_POLICY_PRESENT(connp, ipss) ||
5410 	    connp->conn_dontroute ||
5411 	    connp->conn_outgoing_ill != NULL || optinfo.ip_opt_flags != 0 ||
5412 	    optinfo.ip_opt_ill_index != 0 ||
5413 	    ipha->ipha_version_and_hdr_length != IP_SIMPLE_HDR_VERSION ||
5414 	    IPP_ENABLED(IPP_LOCAL_OUT, ipst) ||
5415 	    ipst->ips_ip_g_mrouter != NULL) {
5416 		UDP_STAT(us, udp_ip_send);
5417 		ip_output_options(connp, mp1, connp->conn_wq, IP_WPUT,
5418 		    &optinfo);
5419 	} else {
5420 		udp_send_data(udp, connp->conn_wq, mp1, ipha);
5421 	}
5422 
5423 done:
5424 	if (lock_held)
5425 		rw_exit(&udp->udp_rwlock);
5426 	if (*error != 0) {
5427 		ASSERT(mp != NULL);
5428 		BUMP_MIB(&us->us_udp_mib, udpOutErrors);
5429 	}
5430 	return (mp);
5431 }
5432 
5433 static void
5434 udp_send_data(udp_t *udp, queue_t *q, mblk_t *mp, ipha_t *ipha)
5435 {
5436 	conn_t	*connp = udp->udp_connp;
5437 	ipaddr_t src, dst;
5438 	ire_t	*ire;
5439 	ipif_t	*ipif = NULL;
5440 	mblk_t	*ire_fp_mp;
5441 	boolean_t retry_caching;
5442 	udp_stack_t *us = udp->udp_us;
5443 	ip_stack_t	*ipst = connp->conn_netstack->netstack_ip;
5444 
5445 	dst = ipha->ipha_dst;
5446 	src = ipha->ipha_src;
5447 	ASSERT(ipha->ipha_ident == 0);
5448 
5449 	if (CLASSD(dst)) {
5450 		int err;
5451 
5452 		ipif = conn_get_held_ipif(connp,
5453 		    &connp->conn_multicast_ipif, &err);
5454 
5455 		if (ipif == NULL || ipif->ipif_isv6 ||
5456 		    (ipif->ipif_ill->ill_phyint->phyint_flags &
5457 		    PHYI_LOOPBACK)) {
5458 			if (ipif != NULL)
5459 				ipif_refrele(ipif);
5460 			UDP_STAT(us, udp_ip_send);
5461 			ip_output(connp, mp, q, IP_WPUT);
5462 			return;
5463 		}
5464 	}
5465 
5466 	retry_caching = B_FALSE;
5467 	mutex_enter(&connp->conn_lock);
5468 	ire = connp->conn_ire_cache;
5469 	ASSERT(!(connp->conn_state_flags & CONN_INCIPIENT));
5470 
5471 	if (ire == NULL || ire->ire_addr != dst ||
5472 	    (ire->ire_marks & IRE_MARK_CONDEMNED)) {
5473 		retry_caching = B_TRUE;
5474 	} else if (CLASSD(dst) && (ire->ire_type & IRE_CACHE)) {
5475 		ill_t *stq_ill = (ill_t *)ire->ire_stq->q_ptr;
5476 
5477 		ASSERT(ipif != NULL);
5478 		if (!IS_ON_SAME_LAN(stq_ill, ipif->ipif_ill))
5479 			retry_caching = B_TRUE;
5480 	}
5481 
5482 	if (!retry_caching) {
5483 		ASSERT(ire != NULL);
5484 		IRE_REFHOLD(ire);
5485 		mutex_exit(&connp->conn_lock);
5486 	} else {
5487 		boolean_t cached = B_FALSE;
5488 
5489 		connp->conn_ire_cache = NULL;
5490 		mutex_exit(&connp->conn_lock);
5491 
5492 		/* Release the old ire */
5493 		if (ire != NULL) {
5494 			IRE_REFRELE_NOTR(ire);
5495 			ire = NULL;
5496 		}
5497 
5498 		if (CLASSD(dst)) {
5499 			ASSERT(ipif != NULL);
5500 			ire = ire_ctable_lookup(dst, 0, 0, ipif,
5501 			    connp->conn_zoneid, msg_getlabel(mp),
5502 			    MATCH_IRE_ILL, ipst);
5503 		} else {
5504 			ASSERT(ipif == NULL);
5505 			ire = ire_cache_lookup(dst, connp->conn_zoneid,
5506 			    msg_getlabel(mp), ipst);
5507 		}
5508 
5509 		if (ire == NULL) {
5510 			if (ipif != NULL)
5511 				ipif_refrele(ipif);
5512 			UDP_STAT(us, udp_ire_null);
5513 			ip_output(connp, mp, q, IP_WPUT);
5514 			return;
5515 		}
5516 		IRE_REFHOLD_NOTR(ire);
5517 
5518 		mutex_enter(&connp->conn_lock);
5519 		if (CONN_CACHE_IRE(connp) && connp->conn_ire_cache == NULL &&
5520 		    !(ire->ire_marks & IRE_MARK_CONDEMNED)) {
5521 			irb_t		*irb = ire->ire_bucket;
5522 
5523 			/*
5524 			 * IRE's created for non-connection oriented transports
5525 			 * are normally initialized with IRE_MARK_TEMPORARY set
5526 			 * in the ire_marks. These IRE's are preferentially
5527 			 * reaped when the hash chain length in the cache
5528 			 * bucket exceeds the maximum value specified in
5529 			 * ip[6]_ire_max_bucket_cnt. This can severely affect
5530 			 * UDP performance if IRE cache entries that we need
5531 			 * to reuse are continually removed. To remedy this,
5532 			 * when we cache the IRE in the conn_t, we remove the
5533 			 * IRE_MARK_TEMPORARY bit from the ire_marks if it was
5534 			 * set.
5535 			 */
5536 			if (ire->ire_marks & IRE_MARK_TEMPORARY) {
5537 				rw_enter(&irb->irb_lock, RW_WRITER);
5538 				if (ire->ire_marks & IRE_MARK_TEMPORARY) {
5539 					ire->ire_marks &= ~IRE_MARK_TEMPORARY;
5540 					irb->irb_tmp_ire_cnt--;
5541 				}
5542 				rw_exit(&irb->irb_lock);
5543 			}
5544 			connp->conn_ire_cache = ire;
5545 			cached = B_TRUE;
5546 		}
5547 		mutex_exit(&connp->conn_lock);
5548 
5549 		/*
5550 		 * We can continue to use the ire but since it was not
5551 		 * cached, we should drop the extra reference.
5552 		 */
5553 		if (!cached)
5554 			IRE_REFRELE_NOTR(ire);
5555 	}
5556 	ASSERT(ire != NULL && ire->ire_ipversion == IPV4_VERSION);
5557 	ASSERT(!CLASSD(dst) || ipif != NULL);
5558 
5559 	/*
5560 	 * Check if we can take the fast-path.
5561 	 * Note that "incomplete" ire's (where the link-layer for next hop
5562 	 * is not resolved, or where the fast-path header in nce_fp_mp is not
5563 	 * available yet) are sent down the legacy (slow) path
5564 	 */
5565 	if ((ire->ire_type & (IRE_BROADCAST|IRE_LOCAL|IRE_LOOPBACK)) ||
5566 	    (ire->ire_flags & RTF_MULTIRT) || (ire->ire_stq == NULL) ||
5567 	    (ire->ire_max_frag < ntohs(ipha->ipha_length)) ||
5568 	    ((ire->ire_nce == NULL) ||
5569 	    ((ire_fp_mp = ire->ire_nce->nce_fp_mp) == NULL)) ||
5570 	    connp->conn_nexthop_set || (MBLKL(ire_fp_mp) > MBLKHEAD(mp))) {
5571 		if (ipif != NULL)
5572 			ipif_refrele(ipif);
5573 		UDP_STAT(us, udp_ip_ire_send);
5574 		IRE_REFRELE(ire);
5575 		ip_output(connp, mp, q, IP_WPUT);
5576 		return;
5577 	}
5578 
5579 	if (src == INADDR_ANY && !connp->conn_unspec_src) {
5580 		if (CLASSD(dst) && !(ire->ire_flags & RTF_SETSRC))
5581 			ipha->ipha_src = ipif->ipif_src_addr;
5582 		else
5583 			ipha->ipha_src = ire->ire_src_addr;
5584 	}
5585 
5586 	if (ipif != NULL)
5587 		ipif_refrele(ipif);
5588 
5589 	udp_xmit(connp->conn_wq, mp, ire, connp, connp->conn_zoneid);
5590 }
5591 
5592 static void
5593 udp_xmit(queue_t *q, mblk_t *mp, ire_t *ire, conn_t *connp, zoneid_t zoneid)
5594 {
5595 	ipaddr_t src, dst;
5596 	ill_t	*ill;
5597 	mblk_t	*ire_fp_mp;
5598 	uint_t	ire_fp_mp_len;
5599 	uint16_t *up;
5600 	uint32_t cksum, hcksum_txflags;
5601 	queue_t	*dev_q;
5602 	udp_t	*udp = connp->conn_udp;
5603 	ipha_t	*ipha = (ipha_t *)mp->b_rptr;
5604 	udp_stack_t	*us = udp->udp_us;
5605 	ip_stack_t	*ipst = connp->conn_netstack->netstack_ip;
5606 	boolean_t	ll_multicast = B_FALSE;
5607 
5608 	dev_q = ire->ire_stq->q_next;
5609 	ASSERT(dev_q != NULL);
5610 
5611 	ill = ire_to_ill(ire);
5612 	ASSERT(ill != NULL);
5613 
5614 	/* is queue flow controlled? */
5615 	if (q->q_first != NULL || connp->conn_draining ||
5616 	    DEV_Q_FLOW_BLOCKED(dev_q)) {
5617 		BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsHCOutRequests);
5618 		BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsOutDiscards);
5619 
5620 		if (ipst->ips_ip_output_queue)
5621 			(void) putq(connp->conn_wq, mp);
5622 		else
5623 			freemsg(mp);
5624 		ire_refrele(ire);
5625 		return;
5626 	}
5627 
5628 	ire_fp_mp = ire->ire_nce->nce_fp_mp;
5629 	ire_fp_mp_len = MBLKL(ire_fp_mp);
5630 	ASSERT(MBLKHEAD(mp) >= ire_fp_mp_len);
5631 
5632 	dst = ipha->ipha_dst;
5633 	src = ipha->ipha_src;
5634 
5635 
5636 	BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCOutRequests);
5637 
5638 	ipha->ipha_ident = (uint16_t)atomic_add_32_nv(&ire->ire_ident, 1);
5639 #ifndef _BIG_ENDIAN
5640 	ipha->ipha_ident = (ipha->ipha_ident << 8) | (ipha->ipha_ident >> 8);
5641 #endif
5642 
5643 	if (ILL_HCKSUM_CAPABLE(ill) && dohwcksum) {
5644 		ASSERT(ill->ill_hcksum_capab != NULL);
5645 		hcksum_txflags = ill->ill_hcksum_capab->ill_hcksum_txflags;
5646 	} else {
5647 		hcksum_txflags = 0;
5648 	}
5649 
5650 	/* pseudo-header checksum (do it in parts for IP header checksum) */
5651 	cksum = (dst >> 16) + (dst & 0xFFFF) + (src >> 16) + (src & 0xFFFF);
5652 
5653 	ASSERT(ipha->ipha_version_and_hdr_length == IP_SIMPLE_HDR_VERSION);
5654 	up = IPH_UDPH_CHECKSUMP(ipha, IP_SIMPLE_HDR_LENGTH);
5655 	if (*up != 0) {
5656 		IP_CKSUM_XMIT_FAST(ire->ire_ipversion, hcksum_txflags,
5657 		    mp, ipha, up, IPPROTO_UDP, IP_SIMPLE_HDR_LENGTH,
5658 		    ntohs(ipha->ipha_length), cksum);
5659 
5660 		/* Software checksum? */
5661 		if (DB_CKSUMFLAGS(mp) == 0) {
5662 			UDP_STAT(us, udp_out_sw_cksum);
5663 			UDP_STAT_UPDATE(us, udp_out_sw_cksum_bytes,
5664 			    ntohs(ipha->ipha_length) - IP_SIMPLE_HDR_LENGTH);
5665 		}
5666 	}
5667 
5668 	if (!CLASSD(dst)) {
5669 		ipha->ipha_fragment_offset_and_flags |=
5670 		    (uint32_t)htons(ire->ire_frag_flag);
5671 	}
5672 
5673 	/* Calculate IP header checksum if hardware isn't capable */
5674 	if (!(DB_CKSUMFLAGS(mp) & HCK_IPV4_HDRCKSUM)) {
5675 		IP_HDR_CKSUM(ipha, cksum, ((uint32_t *)ipha)[0],
5676 		    ((uint16_t *)ipha)[4]);
5677 	}
5678 
5679 	if (CLASSD(dst)) {
5680 		if (ilm_lookup_ill(ill, dst, ALL_ZONES) != NULL) {
5681 			ip_multicast_loopback(q, ill, mp,
5682 			    connp->conn_multicast_loop ? 0 :
5683 			    IP_FF_NO_MCAST_LOOP, zoneid);
5684 		}
5685 
5686 		/* If multicast TTL is 0 then we are done */
5687 		if (ipha->ipha_ttl == 0) {
5688 			freemsg(mp);
5689 			ire_refrele(ire);
5690 			return;
5691 		}
5692 		ll_multicast = B_TRUE;
5693 	}
5694 
5695 	ASSERT(DB_TYPE(ire_fp_mp) == M_DATA);
5696 	mp->b_rptr = (uchar_t *)ipha - ire_fp_mp_len;
5697 	bcopy(ire_fp_mp->b_rptr, mp->b_rptr, ire_fp_mp_len);
5698 
5699 	UPDATE_OB_PKT_COUNT(ire);
5700 	ire->ire_last_used_time = lbolt;
5701 
5702 	BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCOutTransmits);
5703 	UPDATE_MIB(ill->ill_ip_mib, ipIfStatsHCOutOctets,
5704 	    ntohs(ipha->ipha_length));
5705 
5706 	DTRACE_PROBE4(ip4__physical__out__start,
5707 	    ill_t *, NULL, ill_t *, ill, ipha_t *, ipha, mblk_t *, mp);
5708 	FW_HOOKS(ipst->ips_ip4_physical_out_event,
5709 	    ipst->ips_ipv4firewall_physical_out, NULL, ill, ipha, mp, mp,
5710 	    ll_multicast, ipst);
5711 	DTRACE_PROBE1(ip4__physical__out__end, mblk_t *, mp);
5712 	if (ipst->ips_ipobs_enabled && mp != NULL) {
5713 		zoneid_t szone;
5714 
5715 		szone = ip_get_zoneid_v4(ipha->ipha_src, mp,
5716 		    ipst, ALL_ZONES);
5717 		ipobs_hook(mp, IPOBS_HOOK_OUTBOUND, szone,
5718 		    ALL_ZONES, ill, IPV4_VERSION, ire_fp_mp_len, ipst);
5719 	}
5720 
5721 	if (mp != NULL) {
5722 		DTRACE_IP7(send, mblk_t *, mp, conn_t *, NULL,
5723 		    void_ip_t *, ipha, __dtrace_ipsr_ill_t *, ill,
5724 		    ipha_t *, ipha, ip6_t *, NULL, int, 0);
5725 
5726 		if (ILL_DIRECT_CAPABLE(ill)) {
5727 			ill_dld_direct_t *idd = &ill->ill_dld_capab->idc_direct;
5728 
5729 			(void) idd->idd_tx_df(idd->idd_tx_dh, mp,
5730 			    (uintptr_t)connp, 0);
5731 		} else {
5732 			putnext(ire->ire_stq, mp);
5733 		}
5734 	}
5735 	IRE_REFRELE(ire);
5736 }
5737 
5738 static boolean_t
5739 udp_update_label_v6(queue_t *wq, mblk_t *mp, in6_addr_t *dst,
5740     boolean_t *update_lastdst)
5741 {
5742 	udp_t *udp = Q_TO_UDP(wq);
5743 	int err;
5744 	uchar_t opt_storage[TSOL_MAX_IPV6_OPTION];
5745 	udp_stack_t		*us = udp->udp_us;
5746 	cred_t			*cr;
5747 
5748 	/*
5749 	 * All Solaris components should pass a db_credp
5750 	 * for this message, hence we ASSERT.
5751 	 * On production kernels we return an error to be robust against
5752 	 * random streams modules sitting on top of us.
5753 	 */
5754 	cr = msg_getcred(mp, NULL);
5755 	ASSERT(cr != NULL);
5756 	if (cr == NULL)
5757 		return (EINVAL);
5758 
5759 	/* Note that we use the cred/label from the message to handle MLP */
5760 	err = tsol_compute_label_v6(cr,
5761 	    dst, opt_storage, udp->udp_connp->conn_mac_exempt,
5762 	    us->us_netstack->netstack_ip);
5763 	if (err == 0) {
5764 		err = tsol_update_sticky(&udp->udp_sticky_ipp,
5765 		    &udp->udp_label_len_v6, opt_storage);
5766 	}
5767 	if (err != 0) {
5768 		DTRACE_PROBE4(
5769 		    tx__ip__log__drop__updatelabel__udp6,
5770 		    char *, "queue(1) failed to update options(2) on mp(3)",
5771 		    queue_t *, wq, char *, opt_storage, mblk_t *, mp);
5772 	} else {
5773 		*update_lastdst = B_TRUE;
5774 	}
5775 	return (err);
5776 }
5777 
5778 static int
5779 udp_send_connected(conn_t *connp, mblk_t *mp, struct nmsghdr *msg, cred_t *cr,
5780     pid_t pid)
5781 {
5782 	udp_t		*udp = connp->conn_udp;
5783 	udp_stack_t	*us = udp->udp_us;
5784 	ipaddr_t	v4dst;
5785 	in_port_t	dstport;
5786 	boolean_t	mapped_addr;
5787 	struct sockaddr_storage ss;
5788 	sin_t		*sin;
5789 	sin6_t		*sin6;
5790 	struct sockaddr	*addr;
5791 	socklen_t	addrlen;
5792 	int		error;
5793 	boolean_t	insert_spi = udp->udp_nat_t_endpoint;
5794 
5795 	/* M_DATA for connected socket */
5796 
5797 	ASSERT(udp->udp_issocket || IPCL_IS_NONSTR(connp));
5798 	UDP_DBGSTAT(us, udp_data_conn);
5799 
5800 	mutex_enter(&connp->conn_lock);
5801 	if (udp->udp_state != TS_DATA_XFER) {
5802 		mutex_exit(&connp->conn_lock);
5803 		BUMP_MIB(&us->us_udp_mib, udpOutErrors);
5804 		UDP_STAT(us, udp_out_err_notconn);
5805 		freemsg(mp);
5806 		TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_END,
5807 		    "udp_wput_end: connp %p (%S)", connp,
5808 		    "not-connected; address required");
5809 		return (EDESTADDRREQ);
5810 	}
5811 
5812 	mapped_addr = IN6_IS_ADDR_V4MAPPED(&udp->udp_v6dst);
5813 	if (mapped_addr)
5814 		IN6_V4MAPPED_TO_IPADDR(&udp->udp_v6dst, v4dst);
5815 
5816 	/* Initialize addr and addrlen as if they're passed in */
5817 	if (udp->udp_family == AF_INET) {
5818 		sin = (sin_t *)&ss;
5819 		sin->sin_family = AF_INET;
5820 		dstport = sin->sin_port = udp->udp_dstport;
5821 		ASSERT(mapped_addr);
5822 		sin->sin_addr.s_addr = v4dst;
5823 		addr = (struct sockaddr *)sin;
5824 		addrlen = sizeof (*sin);
5825 	} else {
5826 		sin6 = (sin6_t *)&ss;
5827 		sin6->sin6_family = AF_INET6;
5828 		dstport = sin6->sin6_port = udp->udp_dstport;
5829 		sin6->sin6_flowinfo = udp->udp_flowinfo;
5830 		sin6->sin6_addr = udp->udp_v6dst;
5831 		sin6->sin6_scope_id = 0;
5832 		sin6->__sin6_src_id = 0;
5833 		addr = (struct sockaddr *)sin6;
5834 		addrlen = sizeof (*sin6);
5835 	}
5836 	mutex_exit(&connp->conn_lock);
5837 
5838 	if (mapped_addr) {
5839 		/*
5840 		 * Handle both AF_INET and AF_INET6; the latter
5841 		 * for IPV4 mapped destination addresses.  Note
5842 		 * here that both addr and addrlen point to the
5843 		 * corresponding struct depending on the address
5844 		 * family of the socket.
5845 		 */
5846 		mp = udp_output_v4(connp, mp, v4dst, dstport, 0, &error,
5847 		    insert_spi, msg, cr, pid);
5848 	} else {
5849 		mp = udp_output_v6(connp, mp, sin6, &error, msg, cr, pid);
5850 	}
5851 	if (error == 0) {
5852 		ASSERT(mp == NULL);
5853 		return (0);
5854 	}
5855 
5856 	UDP_STAT(us, udp_out_err_output);
5857 	ASSERT(mp != NULL);
5858 	if (IPCL_IS_NONSTR(connp)) {
5859 		freemsg(mp);
5860 		return (error);
5861 	} else {
5862 		/* mp is freed by the following routine */
5863 		udp_ud_err(connp->conn_wq, mp, (uchar_t *)addr,
5864 		    (t_scalar_t)addrlen, (t_scalar_t)error);
5865 		return (0);
5866 	}
5867 }
5868 
5869 /* ARGSUSED */
5870 static int
5871 udp_send_not_connected(conn_t *connp,  mblk_t *mp, struct sockaddr *addr,
5872     socklen_t addrlen, struct nmsghdr *msg, cred_t *cr, pid_t pid)
5873 {
5874 
5875 	udp_t		*udp = connp->conn_udp;
5876 	boolean_t	insert_spi = udp->udp_nat_t_endpoint;
5877 	int		error = 0;
5878 	sin6_t		*sin6;
5879 	sin_t		*sin;
5880 	uint_t		srcid;
5881 	uint16_t	port;
5882 	ipaddr_t	v4dst;
5883 
5884 
5885 	ASSERT(addr != NULL);
5886 
5887 	switch (udp->udp_family) {
5888 	case AF_INET6:
5889 		sin6 = (sin6_t *)addr;
5890 		if (!IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
5891 			/*
5892 			 * Destination is a non-IPv4-compatible IPv6 address.
5893 			 * Send out an IPv6 format packet.
5894 			 */
5895 			mp = udp_output_v6(connp, mp, sin6, &error, msg, cr,
5896 			    pid);
5897 			if (error != 0)
5898 				goto ud_error;
5899 
5900 			return (0);
5901 		}
5902 		/*
5903 		 * If the local address is not zero or a mapped address
5904 		 * return an error.  It would be possible to send an IPv4
5905 		 * packet but the response would never make it back to the
5906 		 * application since it is bound to a non-mapped address.
5907 		 */
5908 		if (!IN6_IS_ADDR_V4MAPPED(&udp->udp_v6src) &&
5909 		    !IN6_IS_ADDR_UNSPECIFIED(&udp->udp_v6src)) {
5910 			error = EADDRNOTAVAIL;
5911 			goto ud_error;
5912 		}
5913 		/* Send IPv4 packet without modifying udp_ipversion */
5914 		/* Extract port and ipaddr */
5915 		port = sin6->sin6_port;
5916 		IN6_V4MAPPED_TO_IPADDR(&sin6->sin6_addr, v4dst);
5917 		srcid = sin6->__sin6_src_id;
5918 		break;
5919 
5920 	case AF_INET:
5921 		sin = (sin_t *)addr;
5922 		/* Extract port and ipaddr */
5923 		port = sin->sin_port;
5924 		v4dst = sin->sin_addr.s_addr;
5925 		srcid = 0;
5926 		break;
5927 	}
5928 
5929 	mp = udp_output_v4(connp, mp, v4dst, port, srcid, &error, insert_spi,
5930 	    msg, cr, pid);
5931 
5932 	if (error == 0) {
5933 		ASSERT(mp == NULL);
5934 		return (0);
5935 	}
5936 
5937 ud_error:
5938 	ASSERT(mp != NULL);
5939 
5940 	return (error);
5941 }
5942 
5943 /*
5944  * This routine handles all messages passed downstream.  It either
5945  * consumes the message or passes it downstream; it never queues a
5946  * a message.
5947  *
5948  * Also entry point for sockfs when udp is in "direct sockfs" mode.  This mode
5949  * is valid when we are directly beneath the stream head, and thus sockfs
5950  * is able to bypass STREAMS and directly call us, passing along the sockaddr
5951  * structure without the cumbersome T_UNITDATA_REQ interface for the case of
5952  * connected endpoints.
5953  */
5954 void
5955 udp_wput(queue_t *q, mblk_t *mp)
5956 {
5957 	conn_t		*connp = Q_TO_CONN(q);
5958 	udp_t		*udp = connp->conn_udp;
5959 	int		error = 0;
5960 	struct sockaddr	*addr;
5961 	socklen_t	addrlen;
5962 	udp_stack_t	*us = udp->udp_us;
5963 
5964 	TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_START,
5965 	    "udp_wput_start: queue %p mp %p", q, mp);
5966 
5967 	/*
5968 	 * We directly handle several cases here: T_UNITDATA_REQ message
5969 	 * coming down as M_PROTO/M_PCPROTO and M_DATA messages for connected
5970 	 * socket.
5971 	 */
5972 	switch (DB_TYPE(mp)) {
5973 	case M_DATA:
5974 		/*
5975 		 * Quick check for error cases. Checks will be done again
5976 		 * under the lock later on
5977 		 */
5978 		if (!udp->udp_direct_sockfs || udp->udp_state != TS_DATA_XFER) {
5979 			/* Not connected; address is required */
5980 			BUMP_MIB(&us->us_udp_mib, udpOutErrors);
5981 			UDP_STAT(us, udp_out_err_notconn);
5982 			freemsg(mp);
5983 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_END,
5984 			    "udp_wput_end: connp %p (%S)", connp,
5985 			    "not-connected; address required");
5986 			return;
5987 		}
5988 		(void) udp_send_connected(connp, mp, NULL, NULL, -1);
5989 		return;
5990 
5991 	case M_PROTO:
5992 	case M_PCPROTO: {
5993 		struct T_unitdata_req *tudr;
5994 
5995 		ASSERT((uintptr_t)MBLKL(mp) <= (uintptr_t)INT_MAX);
5996 		tudr = (struct T_unitdata_req *)mp->b_rptr;
5997 
5998 		/* Handle valid T_UNITDATA_REQ here */
5999 		if (MBLKL(mp) >= sizeof (*tudr) &&
6000 		    ((t_primp_t)mp->b_rptr)->type == T_UNITDATA_REQ) {
6001 			if (mp->b_cont == NULL) {
6002 				TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_END,
6003 				    "udp_wput_end: q %p (%S)", q, "badaddr");
6004 				error = EPROTO;
6005 				goto ud_error;
6006 			}
6007 
6008 			if (!MBLKIN(mp, 0, tudr->DEST_offset +
6009 			    tudr->DEST_length)) {
6010 				TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_END,
6011 				    "udp_wput_end: q %p (%S)", q, "badaddr");
6012 				error = EADDRNOTAVAIL;
6013 				goto ud_error;
6014 			}
6015 			/*
6016 			 * If a port has not been bound to the stream, fail.
6017 			 * This is not a problem when sockfs is directly
6018 			 * above us, because it will ensure that the socket
6019 			 * is first bound before allowing data to be sent.
6020 			 */
6021 			if (udp->udp_state == TS_UNBND) {
6022 				TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_END,
6023 				    "udp_wput_end: q %p (%S)", q, "outstate");
6024 				error = EPROTO;
6025 				goto ud_error;
6026 			}
6027 			addr = (struct sockaddr *)
6028 			    &mp->b_rptr[tudr->DEST_offset];
6029 			addrlen = tudr->DEST_length;
6030 			if (tudr->OPT_length != 0)
6031 				UDP_STAT(us, udp_out_opt);
6032 			break;
6033 		}
6034 		/* FALLTHRU */
6035 	}
6036 	default:
6037 		udp_wput_other(q, mp);
6038 		return;
6039 	}
6040 	ASSERT(addr != NULL);
6041 
6042 	error = udp_send_not_connected(connp,  mp, addr, addrlen, NULL, NULL,
6043 	    -1);
6044 	if (error != 0) {
6045 ud_error:
6046 		UDP_STAT(us, udp_out_err_output);
6047 		ASSERT(mp != NULL);
6048 		/* mp is freed by the following routine */
6049 		udp_ud_err(q, mp, (uchar_t *)addr, (t_scalar_t)addrlen,
6050 		    (t_scalar_t)error);
6051 	}
6052 }
6053 
6054 /* ARGSUSED */
6055 static void
6056 udp_wput_fallback(queue_t *wq, mblk_t *mp)
6057 {
6058 #ifdef DEBUG
6059 	cmn_err(CE_CONT, "udp_wput_fallback: Message in fallback \n");
6060 #endif
6061 	freemsg(mp);
6062 }
6063 
6064 
6065 /*
6066  * udp_output_v6():
6067  * Assumes that udp_wput did some sanity checking on the destination
6068  * address.
6069  */
6070 static mblk_t *
6071 udp_output_v6(conn_t *connp, mblk_t *mp, sin6_t *sin6, int *error,
6072     struct nmsghdr *msg, cred_t *cr, pid_t pid)
6073 {
6074 	ip6_t		*ip6h;
6075 	ip6i_t		*ip6i;	/* mp1->b_rptr even if no ip6i_t */
6076 	mblk_t		*mp1 = mp;
6077 	mblk_t		*mp2;
6078 	int		udp_ip_hdr_len = IPV6_HDR_LEN + UDPH_SIZE;
6079 	size_t		ip_len;
6080 	udpha_t		*udph;
6081 	udp_t		*udp = connp->conn_udp;
6082 	udp_stack_t	*us = udp->udp_us;
6083 	queue_t		*q = connp->conn_wq;
6084 	ip6_pkt_t	ipp_s;	/* For ancillary data options */
6085 	ip6_pkt_t	*ipp = &ipp_s;
6086 	ip6_pkt_t	*tipp;	/* temporary ipp */
6087 	uint32_t	csum = 0;
6088 	uint_t		ignore = 0;
6089 	uint_t		option_exists = 0, is_sticky = 0;
6090 	uint8_t		*cp;
6091 	uint8_t		*nxthdr_ptr;
6092 	in6_addr_t	ip6_dst;
6093 	in_port_t	port;
6094 	udpattrs_t	attrs;
6095 	boolean_t	opt_present;
6096 	ip6_hbh_t	*hopoptsptr = NULL;
6097 	uint_t		hopoptslen = 0;
6098 	boolean_t	is_ancillary = B_FALSE;
6099 	size_t		sth_wroff = 0;
6100 	ire_t		*ire;
6101 	boolean_t	update_lastdst = B_FALSE;
6102 
6103 	*error = 0;
6104 
6105 	/*
6106 	 * If the local address is a mapped address return
6107 	 * an error.
6108 	 * It would be possible to send an IPv6 packet but the
6109 	 * response would never make it back to the application
6110 	 * since it is bound to a mapped address.
6111 	 */
6112 	if (IN6_IS_ADDR_V4MAPPED(&udp->udp_v6src)) {
6113 		*error = EADDRNOTAVAIL;
6114 		goto done;
6115 	}
6116 
6117 	ipp->ipp_fields = 0;
6118 	ipp->ipp_sticky_ignored = 0;
6119 
6120 	/*
6121 	 * If TPI options passed in, feed it for verification and handling
6122 	 */
6123 	attrs.udpattr_credset = B_FALSE;
6124 	opt_present = B_FALSE;
6125 	if (IPCL_IS_NONSTR(connp)) {
6126 		if (msg->msg_controllen != 0) {
6127 			attrs.udpattr_ipp6 = ipp;
6128 			attrs.udpattr_mb = mp;
6129 
6130 			rw_enter(&udp->udp_rwlock, RW_WRITER);
6131 			*error = process_auxiliary_options(connp,
6132 			    msg->msg_control, msg->msg_controllen,
6133 			    &attrs, &udp_opt_obj, udp_opt_set, cr);
6134 			rw_exit(&udp->udp_rwlock);
6135 			if (*error)
6136 				goto done;
6137 			ASSERT(*error == 0);
6138 			opt_present = B_TRUE;
6139 		}
6140 	} else {
6141 		if (DB_TYPE(mp) != M_DATA) {
6142 			mp1 = mp->b_cont;
6143 			if (((struct T_unitdata_req *)
6144 			    mp->b_rptr)->OPT_length != 0) {
6145 				attrs.udpattr_ipp6 = ipp;
6146 				attrs.udpattr_mb = mp;
6147 				if (udp_unitdata_opt_process(q, mp, error,
6148 				    &attrs) < 0) {
6149 					goto done;
6150 				}
6151 				ASSERT(*error == 0);
6152 				opt_present = B_TRUE;
6153 			}
6154 		}
6155 	}
6156 
6157 	/*
6158 	 * Determine whether we need to mark the mblk with the user's
6159 	 * credentials.
6160 	 * If labeled then sockfs would have already done this.
6161 	 */
6162 	ASSERT(!is_system_labeled() || msg_getcred(mp, NULL) != NULL);
6163 	ire = connp->conn_ire_cache;
6164 	if (IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr) || (ire == NULL) ||
6165 	    (!IN6_ARE_ADDR_EQUAL(&ire->ire_addr_v6, &sin6->sin6_addr)) ||
6166 	    (ire->ire_type & (IRE_LOCAL | IRE_LOOPBACK))) {
6167 		if (cr != NULL && msg_getcred(mp, NULL) == NULL)
6168 			mblk_setcred(mp, cr, pid);
6169 	}
6170 
6171 	rw_enter(&udp->udp_rwlock, RW_READER);
6172 	ignore = ipp->ipp_sticky_ignored;
6173 
6174 	/* mp1 points to the M_DATA mblk carrying the packet */
6175 	ASSERT(mp1 != NULL && DB_TYPE(mp1) == M_DATA);
6176 
6177 	if (sin6->sin6_scope_id != 0 &&
6178 	    IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
6179 		/*
6180 		 * IPPF_SCOPE_ID is special.  It's neither a sticky
6181 		 * option nor ancillary data.  It needs to be
6182 		 * explicitly set in options_exists.
6183 		 */
6184 		option_exists |= IPPF_SCOPE_ID;
6185 	}
6186 
6187 	/*
6188 	 * Compute the destination address
6189 	 */
6190 	ip6_dst = sin6->sin6_addr;
6191 	if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
6192 		ip6_dst = ipv6_loopback;
6193 
6194 	port = sin6->sin6_port;
6195 
6196 	/*
6197 	 * Cluster and TSOL notes, Cluster check:
6198 	 * see comments in udp_output_v4().
6199 	 */
6200 	mutex_enter(&connp->conn_lock);
6201 
6202 	if (cl_inet_connect2 != NULL &&
6203 	    (!IN6_ARE_ADDR_EQUAL(&ip6_dst, &udp->udp_v6lastdst) ||
6204 	    port != udp->udp_lastdstport)) {
6205 		mutex_exit(&connp->conn_lock);
6206 		*error = 0;
6207 		CL_INET_UDP_CONNECT(connp, udp, B_TRUE, &ip6_dst, port, *error);
6208 		if (*error != 0) {
6209 			*error = EHOSTUNREACH;
6210 			rw_exit(&udp->udp_rwlock);
6211 			goto done;
6212 		}
6213 		update_lastdst = B_TRUE;
6214 		mutex_enter(&connp->conn_lock);
6215 	}
6216 
6217 	/*
6218 	 * If we're not going to the same destination as last time, then
6219 	 * recompute the label required.  This is done in a separate routine to
6220 	 * avoid blowing up our stack here.
6221 	 *
6222 	 * TSOL Note: Since we are not in WRITER mode, UDP packets
6223 	 * to different destination may require different labels,
6224 	 * or worse, UDP packets to same IP address may require
6225 	 * different labels due to use of shared all-zones address.
6226 	 * We use conn_lock to ensure that lastdst, sticky ipp_hopopts,
6227 	 * and sticky ipp_hopoptslen are consistent for the current
6228 	 * destination and are updated atomically.
6229 	 */
6230 	if (is_system_labeled()) {
6231 		/* Using UDP MLP requires SCM_UCRED from user */
6232 		if (connp->conn_mlp_type != mlptSingle &&
6233 		    !attrs.udpattr_credset) {
6234 			DTRACE_PROBE4(
6235 			    tx__ip__log__info__output__udp6,
6236 			    char *, "MLP mp(1) lacks SCM_UCRED attr(2) on q(3)",
6237 			    mblk_t *, mp1, udpattrs_t *, &attrs, queue_t *, q);
6238 			*error = ECONNREFUSED;
6239 			rw_exit(&udp->udp_rwlock);
6240 			mutex_exit(&connp->conn_lock);
6241 			goto done;
6242 		}
6243 		/*
6244 		 * update label option for this UDP socket if
6245 		 * - the destination has changed, or
6246 		 * - the UDP socket is MLP
6247 		 */
6248 		if ((opt_present ||
6249 		    !IN6_ARE_ADDR_EQUAL(&udp->udp_v6lastdst, &ip6_dst) ||
6250 		    connp->conn_mlp_type != mlptSingle) &&
6251 		    (*error = udp_update_label_v6(q, mp, &ip6_dst,
6252 		    &update_lastdst)) != 0) {
6253 			rw_exit(&udp->udp_rwlock);
6254 			mutex_exit(&connp->conn_lock);
6255 			goto done;
6256 		}
6257 	}
6258 
6259 	if (update_lastdst) {
6260 		udp->udp_v6lastdst = ip6_dst;
6261 		udp->udp_lastdstport = port;
6262 	}
6263 
6264 	/*
6265 	 * If there's a security label here, then we ignore any options the
6266 	 * user may try to set.  We keep the peer's label as a hidden sticky
6267 	 * option. We make a private copy of this label before releasing the
6268 	 * lock so that label is kept consistent with the destination addr.
6269 	 */
6270 	if (udp->udp_label_len_v6 > 0) {
6271 		ignore &= ~IPPF_HOPOPTS;
6272 		ipp->ipp_fields &= ~IPPF_HOPOPTS;
6273 	}
6274 
6275 	if ((udp->udp_sticky_ipp.ipp_fields == 0) && (ipp->ipp_fields == 0)) {
6276 		/* No sticky options nor ancillary data. */
6277 		mutex_exit(&connp->conn_lock);
6278 		goto no_options;
6279 	}
6280 
6281 	/*
6282 	 * Go through the options figuring out where each is going to
6283 	 * come from and build two masks.  The first mask indicates if
6284 	 * the option exists at all.  The second mask indicates if the
6285 	 * option is sticky or ancillary.
6286 	 */
6287 	if (!(ignore & IPPF_HOPOPTS)) {
6288 		if (ipp->ipp_fields & IPPF_HOPOPTS) {
6289 			option_exists |= IPPF_HOPOPTS;
6290 			udp_ip_hdr_len += ipp->ipp_hopoptslen;
6291 		} else if (udp->udp_sticky_ipp.ipp_fields & IPPF_HOPOPTS) {
6292 			option_exists |= IPPF_HOPOPTS;
6293 			is_sticky |= IPPF_HOPOPTS;
6294 			ASSERT(udp->udp_sticky_ipp.ipp_hopoptslen != 0);
6295 			hopoptsptr = kmem_alloc(
6296 			    udp->udp_sticky_ipp.ipp_hopoptslen, KM_NOSLEEP);
6297 			if (hopoptsptr == NULL) {
6298 				*error = ENOMEM;
6299 				mutex_exit(&connp->conn_lock);
6300 				goto done;
6301 			}
6302 			hopoptslen = udp->udp_sticky_ipp.ipp_hopoptslen;
6303 			bcopy(udp->udp_sticky_ipp.ipp_hopopts, hopoptsptr,
6304 			    hopoptslen);
6305 			udp_ip_hdr_len += hopoptslen;
6306 		}
6307 	}
6308 	mutex_exit(&connp->conn_lock);
6309 
6310 	if (!(ignore & IPPF_RTHDR)) {
6311 		if (ipp->ipp_fields & IPPF_RTHDR) {
6312 			option_exists |= IPPF_RTHDR;
6313 			udp_ip_hdr_len += ipp->ipp_rthdrlen;
6314 		} else if (udp->udp_sticky_ipp.ipp_fields & IPPF_RTHDR) {
6315 			option_exists |= IPPF_RTHDR;
6316 			is_sticky |= IPPF_RTHDR;
6317 			udp_ip_hdr_len += udp->udp_sticky_ipp.ipp_rthdrlen;
6318 		}
6319 	}
6320 
6321 	if (!(ignore & IPPF_RTDSTOPTS) && (option_exists & IPPF_RTHDR)) {
6322 		if (ipp->ipp_fields & IPPF_RTDSTOPTS) {
6323 			option_exists |= IPPF_RTDSTOPTS;
6324 			udp_ip_hdr_len += ipp->ipp_rtdstoptslen;
6325 		} else if (udp->udp_sticky_ipp.ipp_fields & IPPF_RTDSTOPTS) {
6326 			option_exists |= IPPF_RTDSTOPTS;
6327 			is_sticky |= IPPF_RTDSTOPTS;
6328 			udp_ip_hdr_len += udp->udp_sticky_ipp.ipp_rtdstoptslen;
6329 		}
6330 	}
6331 
6332 	if (!(ignore & IPPF_DSTOPTS)) {
6333 		if (ipp->ipp_fields & IPPF_DSTOPTS) {
6334 			option_exists |= IPPF_DSTOPTS;
6335 			udp_ip_hdr_len += ipp->ipp_dstoptslen;
6336 		} else if (udp->udp_sticky_ipp.ipp_fields & IPPF_DSTOPTS) {
6337 			option_exists |= IPPF_DSTOPTS;
6338 			is_sticky |= IPPF_DSTOPTS;
6339 			udp_ip_hdr_len += udp->udp_sticky_ipp.ipp_dstoptslen;
6340 		}
6341 	}
6342 
6343 	if (!(ignore & IPPF_IFINDEX)) {
6344 		if (ipp->ipp_fields & IPPF_IFINDEX) {
6345 			option_exists |= IPPF_IFINDEX;
6346 		} else if (udp->udp_sticky_ipp.ipp_fields & IPPF_IFINDEX) {
6347 			option_exists |= IPPF_IFINDEX;
6348 			is_sticky |= IPPF_IFINDEX;
6349 		}
6350 	}
6351 
6352 	if (!(ignore & IPPF_ADDR)) {
6353 		if (ipp->ipp_fields & IPPF_ADDR) {
6354 			option_exists |= IPPF_ADDR;
6355 		} else if (udp->udp_sticky_ipp.ipp_fields & IPPF_ADDR) {
6356 			option_exists |= IPPF_ADDR;
6357 			is_sticky |= IPPF_ADDR;
6358 		}
6359 	}
6360 
6361 	if (!(ignore & IPPF_DONTFRAG)) {
6362 		if (ipp->ipp_fields & IPPF_DONTFRAG) {
6363 			option_exists |= IPPF_DONTFRAG;
6364 		} else if (udp->udp_sticky_ipp.ipp_fields & IPPF_DONTFRAG) {
6365 			option_exists |= IPPF_DONTFRAG;
6366 			is_sticky |= IPPF_DONTFRAG;
6367 		}
6368 	}
6369 
6370 	if (!(ignore & IPPF_USE_MIN_MTU)) {
6371 		if (ipp->ipp_fields & IPPF_USE_MIN_MTU) {
6372 			option_exists |= IPPF_USE_MIN_MTU;
6373 		} else if (udp->udp_sticky_ipp.ipp_fields &
6374 		    IPPF_USE_MIN_MTU) {
6375 			option_exists |= IPPF_USE_MIN_MTU;
6376 			is_sticky |= IPPF_USE_MIN_MTU;
6377 		}
6378 	}
6379 
6380 	if (!(ignore & IPPF_HOPLIMIT) && (ipp->ipp_fields & IPPF_HOPLIMIT))
6381 		option_exists |= IPPF_HOPLIMIT;
6382 	/* IPV6_HOPLIMIT can never be sticky */
6383 	ASSERT(!(udp->udp_sticky_ipp.ipp_fields & IPPF_HOPLIMIT));
6384 
6385 	if (!(ignore & IPPF_UNICAST_HOPS) &&
6386 	    (udp->udp_sticky_ipp.ipp_fields & IPPF_UNICAST_HOPS)) {
6387 		option_exists |= IPPF_UNICAST_HOPS;
6388 		is_sticky |= IPPF_UNICAST_HOPS;
6389 	}
6390 
6391 	if (!(ignore & IPPF_MULTICAST_HOPS) &&
6392 	    (udp->udp_sticky_ipp.ipp_fields & IPPF_MULTICAST_HOPS)) {
6393 		option_exists |= IPPF_MULTICAST_HOPS;
6394 		is_sticky |= IPPF_MULTICAST_HOPS;
6395 	}
6396 
6397 	if (!(ignore & IPPF_TCLASS)) {
6398 		if (ipp->ipp_fields & IPPF_TCLASS) {
6399 			option_exists |= IPPF_TCLASS;
6400 		} else if (udp->udp_sticky_ipp.ipp_fields & IPPF_TCLASS) {
6401 			option_exists |= IPPF_TCLASS;
6402 			is_sticky |= IPPF_TCLASS;
6403 		}
6404 	}
6405 
6406 	if (!(ignore & IPPF_NEXTHOP) &&
6407 	    (udp->udp_sticky_ipp.ipp_fields & IPPF_NEXTHOP)) {
6408 		option_exists |= IPPF_NEXTHOP;
6409 		is_sticky |= IPPF_NEXTHOP;
6410 	}
6411 
6412 no_options:
6413 
6414 	/*
6415 	 * If any options carried in the ip6i_t were specified, we
6416 	 * need to account for the ip6i_t in the data we'll be sending
6417 	 * down.
6418 	 */
6419 	if (option_exists & IPPF_HAS_IP6I)
6420 		udp_ip_hdr_len += sizeof (ip6i_t);
6421 
6422 	/* check/fix buffer config, setup pointers into it */
6423 	ip6h = (ip6_t *)&mp1->b_rptr[-udp_ip_hdr_len];
6424 	if (DB_REF(mp1) != 1 || ((unsigned char *)ip6h < DB_BASE(mp1)) ||
6425 	    !OK_32PTR(ip6h)) {
6426 
6427 		/* Try to get everything in a single mblk next time */
6428 		if (udp_ip_hdr_len > udp->udp_max_hdr_len) {
6429 			udp->udp_max_hdr_len = udp_ip_hdr_len;
6430 			sth_wroff = udp->udp_max_hdr_len + us->us_wroff_extra;
6431 		}
6432 
6433 		mp2 = allocb(udp_ip_hdr_len + us->us_wroff_extra, BPRI_LO);
6434 		if (mp2 == NULL) {
6435 			*error = ENOMEM;
6436 			rw_exit(&udp->udp_rwlock);
6437 			goto done;
6438 		}
6439 		mp2->b_wptr = DB_LIM(mp2);
6440 		mp2->b_cont = mp1;
6441 		mp1 = mp2;
6442 		if (DB_TYPE(mp) != M_DATA)
6443 			mp->b_cont = mp1;
6444 		else
6445 			mp = mp1;
6446 
6447 		ip6h = (ip6_t *)(mp1->b_wptr - udp_ip_hdr_len);
6448 	}
6449 	mp1->b_rptr = (unsigned char *)ip6h;
6450 	ip6i = (ip6i_t *)ip6h;
6451 
6452 #define	ANCIL_OR_STICKY_PTR(f) ((is_sticky & f) ? &udp->udp_sticky_ipp : ipp)
6453 	if (option_exists & IPPF_HAS_IP6I) {
6454 		ip6h = (ip6_t *)&ip6i[1];
6455 		ip6i->ip6i_flags = 0;
6456 		ip6i->ip6i_vcf = IPV6_DEFAULT_VERS_AND_FLOW;
6457 
6458 		/* sin6_scope_id takes precendence over IPPF_IFINDEX */
6459 		if (option_exists & IPPF_SCOPE_ID) {
6460 			ip6i->ip6i_flags |= IP6I_IFINDEX;
6461 			ip6i->ip6i_ifindex = sin6->sin6_scope_id;
6462 		} else if (option_exists & IPPF_IFINDEX) {
6463 			tipp = ANCIL_OR_STICKY_PTR(IPPF_IFINDEX);
6464 			ASSERT(tipp->ipp_ifindex != 0);
6465 			ip6i->ip6i_flags |= IP6I_IFINDEX;
6466 			ip6i->ip6i_ifindex = tipp->ipp_ifindex;
6467 		}
6468 
6469 		if (option_exists & IPPF_ADDR) {
6470 			/*
6471 			 * Enable per-packet source address verification if
6472 			 * IPV6_PKTINFO specified the source address.
6473 			 * ip6_src is set in the transport's _wput function.
6474 			 */
6475 			ip6i->ip6i_flags |= IP6I_VERIFY_SRC;
6476 		}
6477 
6478 		if (option_exists & IPPF_DONTFRAG) {
6479 			ip6i->ip6i_flags |= IP6I_DONTFRAG;
6480 		}
6481 
6482 		if (option_exists & IPPF_USE_MIN_MTU) {
6483 			ip6i->ip6i_flags = IP6I_API_USE_MIN_MTU(
6484 			    ip6i->ip6i_flags, ipp->ipp_use_min_mtu);
6485 		}
6486 
6487 		if (option_exists & IPPF_NEXTHOP) {
6488 			tipp = ANCIL_OR_STICKY_PTR(IPPF_NEXTHOP);
6489 			ASSERT(!IN6_IS_ADDR_UNSPECIFIED(&tipp->ipp_nexthop));
6490 			ip6i->ip6i_flags |= IP6I_NEXTHOP;
6491 			ip6i->ip6i_nexthop = tipp->ipp_nexthop;
6492 		}
6493 
6494 		/*
6495 		 * tell IP this is an ip6i_t private header
6496 		 */
6497 		ip6i->ip6i_nxt = IPPROTO_RAW;
6498 	}
6499 
6500 	/* Initialize IPv6 header */
6501 	ip6h->ip6_vcf = IPV6_DEFAULT_VERS_AND_FLOW;
6502 	bzero(&ip6h->ip6_src, sizeof (ip6h->ip6_src));
6503 
6504 	/* Set the hoplimit of the outgoing packet. */
6505 	if (option_exists & IPPF_HOPLIMIT) {
6506 		/* IPV6_HOPLIMIT ancillary data overrides all other settings. */
6507 		ip6h->ip6_hops = ipp->ipp_hoplimit;
6508 		ip6i->ip6i_flags |= IP6I_HOPLIMIT;
6509 	} else if (IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
6510 		ip6h->ip6_hops = udp->udp_multicast_ttl;
6511 		if (option_exists & IPPF_MULTICAST_HOPS)
6512 			ip6i->ip6i_flags |= IP6I_HOPLIMIT;
6513 	} else {
6514 		ip6h->ip6_hops = udp->udp_ttl;
6515 		if (option_exists & IPPF_UNICAST_HOPS)
6516 			ip6i->ip6i_flags |= IP6I_HOPLIMIT;
6517 	}
6518 
6519 	if (option_exists & IPPF_ADDR) {
6520 		tipp = ANCIL_OR_STICKY_PTR(IPPF_ADDR);
6521 		ASSERT(!IN6_IS_ADDR_UNSPECIFIED(&tipp->ipp_addr));
6522 		ip6h->ip6_src = tipp->ipp_addr;
6523 	} else {
6524 		/*
6525 		 * The source address was not set using IPV6_PKTINFO.
6526 		 * First look at the bound source.
6527 		 * If unspecified fallback to __sin6_src_id.
6528 		 */
6529 		ip6h->ip6_src = udp->udp_v6src;
6530 		if (sin6->__sin6_src_id != 0 &&
6531 		    IN6_IS_ADDR_UNSPECIFIED(&ip6h->ip6_src)) {
6532 			ip_srcid_find_id(sin6->__sin6_src_id,
6533 			    &ip6h->ip6_src, connp->conn_zoneid,
6534 			    us->us_netstack);
6535 		}
6536 	}
6537 
6538 	nxthdr_ptr = (uint8_t *)&ip6h->ip6_nxt;
6539 	cp = (uint8_t *)&ip6h[1];
6540 
6541 	/*
6542 	 * Here's where we have to start stringing together
6543 	 * any extension headers in the right order:
6544 	 * Hop-by-hop, destination, routing, and final destination opts.
6545 	 */
6546 	if (option_exists & IPPF_HOPOPTS) {
6547 		/* Hop-by-hop options */
6548 		ip6_hbh_t *hbh = (ip6_hbh_t *)cp;
6549 		tipp = ANCIL_OR_STICKY_PTR(IPPF_HOPOPTS);
6550 		if (hopoptslen == 0) {
6551 			hopoptsptr = tipp->ipp_hopopts;
6552 			hopoptslen = tipp->ipp_hopoptslen;
6553 			is_ancillary = B_TRUE;
6554 		}
6555 
6556 		*nxthdr_ptr = IPPROTO_HOPOPTS;
6557 		nxthdr_ptr = &hbh->ip6h_nxt;
6558 
6559 		bcopy(hopoptsptr, cp, hopoptslen);
6560 		cp += hopoptslen;
6561 
6562 		if (hopoptsptr != NULL && !is_ancillary) {
6563 			kmem_free(hopoptsptr, hopoptslen);
6564 			hopoptsptr = NULL;
6565 			hopoptslen = 0;
6566 		}
6567 	}
6568 	/*
6569 	 * En-route destination options
6570 	 * Only do them if there's a routing header as well
6571 	 */
6572 	if (option_exists & IPPF_RTDSTOPTS) {
6573 		ip6_dest_t *dst = (ip6_dest_t *)cp;
6574 		tipp = ANCIL_OR_STICKY_PTR(IPPF_RTDSTOPTS);
6575 
6576 		*nxthdr_ptr = IPPROTO_DSTOPTS;
6577 		nxthdr_ptr = &dst->ip6d_nxt;
6578 
6579 		bcopy(tipp->ipp_rtdstopts, cp, tipp->ipp_rtdstoptslen);
6580 		cp += tipp->ipp_rtdstoptslen;
6581 	}
6582 	/*
6583 	 * Routing header next
6584 	 */
6585 	if (option_exists & IPPF_RTHDR) {
6586 		ip6_rthdr_t *rt = (ip6_rthdr_t *)cp;
6587 		tipp = ANCIL_OR_STICKY_PTR(IPPF_RTHDR);
6588 
6589 		*nxthdr_ptr = IPPROTO_ROUTING;
6590 		nxthdr_ptr = &rt->ip6r_nxt;
6591 
6592 		bcopy(tipp->ipp_rthdr, cp, tipp->ipp_rthdrlen);
6593 		cp += tipp->ipp_rthdrlen;
6594 	}
6595 	/*
6596 	 * Do ultimate destination options
6597 	 */
6598 	if (option_exists & IPPF_DSTOPTS) {
6599 		ip6_dest_t *dest = (ip6_dest_t *)cp;
6600 		tipp = ANCIL_OR_STICKY_PTR(IPPF_DSTOPTS);
6601 
6602 		*nxthdr_ptr = IPPROTO_DSTOPTS;
6603 		nxthdr_ptr = &dest->ip6d_nxt;
6604 
6605 		bcopy(tipp->ipp_dstopts, cp, tipp->ipp_dstoptslen);
6606 		cp += tipp->ipp_dstoptslen;
6607 	}
6608 	/*
6609 	 * Now set the last header pointer to the proto passed in
6610 	 */
6611 	ASSERT((int)(cp - (uint8_t *)ip6i) == (udp_ip_hdr_len - UDPH_SIZE));
6612 	*nxthdr_ptr = IPPROTO_UDP;
6613 
6614 	/* Update UDP header */
6615 	udph = (udpha_t *)((uchar_t *)ip6i + udp_ip_hdr_len - UDPH_SIZE);
6616 	udph->uha_dst_port = sin6->sin6_port;
6617 	udph->uha_src_port = udp->udp_port;
6618 
6619 	/*
6620 	 * Copy in the destination address
6621 	 */
6622 	ip6h->ip6_dst = ip6_dst;
6623 
6624 	ip6h->ip6_vcf =
6625 	    (IPV6_DEFAULT_VERS_AND_FLOW & IPV6_VERS_AND_FLOW_MASK) |
6626 	    (sin6->sin6_flowinfo & ~IPV6_VERS_AND_FLOW_MASK);
6627 
6628 	if (option_exists & IPPF_TCLASS) {
6629 		tipp = ANCIL_OR_STICKY_PTR(IPPF_TCLASS);
6630 		ip6h->ip6_vcf = IPV6_TCLASS_FLOW(ip6h->ip6_vcf,
6631 		    tipp->ipp_tclass);
6632 	}
6633 	rw_exit(&udp->udp_rwlock);
6634 
6635 	if (option_exists & IPPF_RTHDR) {
6636 		ip6_rthdr_t	*rth;
6637 
6638 		/*
6639 		 * Perform any processing needed for source routing.
6640 		 * We know that all extension headers will be in the same mblk
6641 		 * as the IPv6 header.
6642 		 */
6643 		rth = ip_find_rthdr_v6(ip6h, mp1->b_wptr);
6644 		if (rth != NULL && rth->ip6r_segleft != 0) {
6645 			if (rth->ip6r_type != IPV6_RTHDR_TYPE_0) {
6646 				/*
6647 				 * Drop packet - only support Type 0 routing.
6648 				 * Notify the application as well.
6649 				 */
6650 				*error = EPROTO;
6651 				goto done;
6652 			}
6653 
6654 			/*
6655 			 * rth->ip6r_len is twice the number of
6656 			 * addresses in the header. Thus it must be even.
6657 			 */
6658 			if (rth->ip6r_len & 0x1) {
6659 				*error = EPROTO;
6660 				goto done;
6661 			}
6662 			/*
6663 			 * Shuffle the routing header and ip6_dst
6664 			 * addresses, and get the checksum difference
6665 			 * between the first hop (in ip6_dst) and
6666 			 * the destination (in the last routing hdr entry).
6667 			 */
6668 			csum = ip_massage_options_v6(ip6h, rth,
6669 			    us->us_netstack);
6670 			/*
6671 			 * Verify that the first hop isn't a mapped address.
6672 			 * Routers along the path need to do this verification
6673 			 * for subsequent hops.
6674 			 */
6675 			if (IN6_IS_ADDR_V4MAPPED(&ip6h->ip6_dst)) {
6676 				*error = EADDRNOTAVAIL;
6677 				goto done;
6678 			}
6679 
6680 			cp += (rth->ip6r_len + 1)*8;
6681 		}
6682 	}
6683 
6684 	/* count up length of UDP packet */
6685 	ip_len = (mp1->b_wptr - (unsigned char *)ip6h) - IPV6_HDR_LEN;
6686 	if ((mp2 = mp1->b_cont) != NULL) {
6687 		do {
6688 			ASSERT((uintptr_t)MBLKL(mp2) <= (uintptr_t)UINT_MAX);
6689 			ip_len += (uint32_t)MBLKL(mp2);
6690 		} while ((mp2 = mp2->b_cont) != NULL);
6691 	}
6692 
6693 	/*
6694 	 * If the size of the packet is greater than the maximum allowed by
6695 	 * ip, return an error. Passing this down could cause panics because
6696 	 * the size will have wrapped and be inconsistent with the msg size.
6697 	 */
6698 	if (ip_len > IP_MAXPACKET) {
6699 		*error = EMSGSIZE;
6700 		goto done;
6701 	}
6702 
6703 	/* Store the UDP length. Subtract length of extension hdrs */
6704 	udph->uha_length = htons(ip_len + IPV6_HDR_LEN -
6705 	    (int)((uchar_t *)udph - (uchar_t *)ip6h));
6706 
6707 	/*
6708 	 * We make it easy for IP to include our pseudo header
6709 	 * by putting our length in uh_checksum, modified (if
6710 	 * we have a routing header) by the checksum difference
6711 	 * between the ultimate destination and first hop addresses.
6712 	 * Note: UDP over IPv6 must always checksum the packet.
6713 	 */
6714 	csum += udph->uha_length;
6715 	csum = (csum & 0xFFFF) + (csum >> 16);
6716 	udph->uha_checksum = (uint16_t)csum;
6717 
6718 #ifdef _LITTLE_ENDIAN
6719 	ip_len = htons(ip_len);
6720 #endif
6721 	ip6h->ip6_plen = ip_len;
6722 
6723 	if (DB_TYPE(mp) != M_DATA) {
6724 		cred_t *cr;
6725 		pid_t cpid;
6726 
6727 		/* Move any cred from the T_UNITDATA_REQ to the packet */
6728 		cr = msg_extractcred(mp, &cpid);
6729 		if (cr != NULL) {
6730 			if (mp1->b_datap->db_credp != NULL)
6731 				crfree(mp1->b_datap->db_credp);
6732 			mp1->b_datap->db_credp = cr;
6733 			mp1->b_datap->db_cpid = cpid;
6734 		}
6735 
6736 		ASSERT(mp != mp1);
6737 		freeb(mp);
6738 	}
6739 
6740 	/* mp has been consumed and we'll return success */
6741 	ASSERT(*error == 0);
6742 	mp = NULL;
6743 
6744 	/* We're done. Pass the packet to IP */
6745 	BUMP_MIB(&us->us_udp_mib, udpHCOutDatagrams);
6746 	ip_output_v6(connp, mp1, q, IP_WPUT);
6747 
6748 done:
6749 	if (sth_wroff != 0) {
6750 		(void) proto_set_tx_wroff(RD(q), connp,
6751 		    udp->udp_max_hdr_len + us->us_wroff_extra);
6752 	}
6753 	if (hopoptsptr != NULL && !is_ancillary) {
6754 		kmem_free(hopoptsptr, hopoptslen);
6755 		hopoptsptr = NULL;
6756 	}
6757 	if (*error != 0) {
6758 		ASSERT(mp != NULL);
6759 		BUMP_MIB(&us->us_udp_mib, udpOutErrors);
6760 	}
6761 	return (mp);
6762 }
6763 
6764 
6765 static int
6766 i_udp_getpeername(udp_t *udp, struct sockaddr *sa, uint_t *salenp)
6767 {
6768 	sin_t *sin = (sin_t *)sa;
6769 	sin6_t *sin6 = (sin6_t *)sa;
6770 
6771 	ASSERT(RW_LOCK_HELD(&udp->udp_rwlock));
6772 
6773 	if (udp->udp_state != TS_DATA_XFER)
6774 		return (ENOTCONN);
6775 
6776 	switch (udp->udp_family) {
6777 	case AF_INET:
6778 		ASSERT(udp->udp_ipversion == IPV4_VERSION);
6779 
6780 		if (*salenp < sizeof (sin_t))
6781 			return (EINVAL);
6782 
6783 		*salenp = sizeof (sin_t);
6784 		*sin = sin_null;
6785 		sin->sin_family = AF_INET;
6786 		sin->sin_port = udp->udp_dstport;
6787 		sin->sin_addr.s_addr = V4_PART_OF_V6(udp->udp_v6dst);
6788 		break;
6789 
6790 	case AF_INET6:
6791 		if (*salenp < sizeof (sin6_t))
6792 			return (EINVAL);
6793 
6794 		*salenp = sizeof (sin6_t);
6795 		*sin6 = sin6_null;
6796 		sin6->sin6_family = AF_INET6;
6797 		sin6->sin6_port = udp->udp_dstport;
6798 		sin6->sin6_addr = udp->udp_v6dst;
6799 		sin6->sin6_flowinfo = udp->udp_flowinfo;
6800 		break;
6801 	}
6802 
6803 	return (0);
6804 }
6805 
6806 static int
6807 udp_getmyname(udp_t *udp, struct sockaddr *sa, uint_t *salenp)
6808 {
6809 	sin_t *sin = (sin_t *)sa;
6810 	sin6_t *sin6 = (sin6_t *)sa;
6811 
6812 	ASSERT(RW_LOCK_HELD(&udp->udp_rwlock));
6813 
6814 	switch (udp->udp_family) {
6815 	case AF_INET:
6816 		ASSERT(udp->udp_ipversion == IPV4_VERSION);
6817 
6818 		if (*salenp < sizeof (sin_t))
6819 			return (EINVAL);
6820 
6821 		*salenp = sizeof (sin_t);
6822 		*sin = sin_null;
6823 		sin->sin_family = AF_INET;
6824 		sin->sin_port = udp->udp_port;
6825 
6826 		/*
6827 		 * If udp_v6src is unspecified, we might be bound to broadcast
6828 		 * / multicast.  Use udp_bound_v6src as local address instead
6829 		 * (that could also still be unspecified).
6830 		 */
6831 		if (!IN6_IS_ADDR_V4MAPPED_ANY(&udp->udp_v6src) &&
6832 		    !IN6_IS_ADDR_UNSPECIFIED(&udp->udp_v6src)) {
6833 			sin->sin_addr.s_addr = V4_PART_OF_V6(udp->udp_v6src);
6834 		} else {
6835 			sin->sin_addr.s_addr =
6836 			    V4_PART_OF_V6(udp->udp_bound_v6src);
6837 		}
6838 		break;
6839 
6840 	case AF_INET6:
6841 		if (*salenp < sizeof (sin6_t))
6842 			return (EINVAL);
6843 
6844 		*salenp = sizeof (sin6_t);
6845 		*sin6 = sin6_null;
6846 		sin6->sin6_family = AF_INET6;
6847 		sin6->sin6_port = udp->udp_port;
6848 		sin6->sin6_flowinfo = udp->udp_flowinfo;
6849 
6850 		/*
6851 		 * If udp_v6src is unspecified, we might be bound to broadcast
6852 		 * / multicast.  Use udp_bound_v6src as local address instead
6853 		 * (that could also still be unspecified).
6854 		 */
6855 		if (!IN6_IS_ADDR_UNSPECIFIED(&udp->udp_v6src))
6856 			sin6->sin6_addr = udp->udp_v6src;
6857 		else
6858 			sin6->sin6_addr = udp->udp_bound_v6src;
6859 		break;
6860 	}
6861 
6862 	return (0);
6863 }
6864 
6865 /*
6866  * Handle special out-of-band ioctl requests (see PSARC/2008/265).
6867  */
6868 static void
6869 udp_wput_cmdblk(queue_t *q, mblk_t *mp)
6870 {
6871 	void	*data;
6872 	mblk_t	*datamp = mp->b_cont;
6873 	udp_t	*udp = Q_TO_UDP(q);
6874 	cmdblk_t *cmdp = (cmdblk_t *)mp->b_rptr;
6875 
6876 	if (datamp == NULL || MBLKL(datamp) < cmdp->cb_len) {
6877 		cmdp->cb_error = EPROTO;
6878 		qreply(q, mp);
6879 		return;
6880 	}
6881 	data = datamp->b_rptr;
6882 
6883 	rw_enter(&udp->udp_rwlock, RW_READER);
6884 	switch (cmdp->cb_cmd) {
6885 	case TI_GETPEERNAME:
6886 		cmdp->cb_error = i_udp_getpeername(udp, data, &cmdp->cb_len);
6887 		break;
6888 	case TI_GETMYNAME:
6889 		cmdp->cb_error = udp_getmyname(udp, data, &cmdp->cb_len);
6890 		break;
6891 	default:
6892 		cmdp->cb_error = EINVAL;
6893 		break;
6894 	}
6895 	rw_exit(&udp->udp_rwlock);
6896 
6897 	qreply(q, mp);
6898 }
6899 
6900 static void
6901 udp_disable_direct_sockfs(udp_t *udp)
6902 {
6903 	udp->udp_issocket = B_FALSE;
6904 	if (udp->udp_direct_sockfs) {
6905 		/*
6906 		 * Disable read-side synchronous stream interface and
6907 		 * drain any queued data.
6908 		 */
6909 		udp_rcv_drain(udp->udp_connp->conn_rq, udp, B_FALSE);
6910 		ASSERT(!udp->udp_direct_sockfs);
6911 		UDP_STAT(udp->udp_us, udp_sock_fallback);
6912 	}
6913 }
6914 
6915 static void
6916 udp_wput_other(queue_t *q, mblk_t *mp)
6917 {
6918 	uchar_t	*rptr = mp->b_rptr;
6919 	struct datab *db;
6920 	struct iocblk *iocp;
6921 	cred_t	*cr;
6922 	conn_t	*connp = Q_TO_CONN(q);
6923 	udp_t	*udp = connp->conn_udp;
6924 	udp_stack_t *us;
6925 
6926 	TRACE_1(TR_FAC_UDP, TR_UDP_WPUT_OTHER_START,
6927 	    "udp_wput_other_start: q %p", q);
6928 
6929 	us = udp->udp_us;
6930 	db = mp->b_datap;
6931 
6932 	switch (db->db_type) {
6933 	case M_CMD:
6934 		udp_wput_cmdblk(q, mp);
6935 		return;
6936 
6937 	case M_PROTO:
6938 	case M_PCPROTO:
6939 		if (mp->b_wptr - rptr < sizeof (t_scalar_t)) {
6940 			freemsg(mp);
6941 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
6942 			    "udp_wput_other_end: q %p (%S)", q, "protoshort");
6943 			return;
6944 		}
6945 		switch (((t_primp_t)rptr)->type) {
6946 		case T_ADDR_REQ:
6947 			udp_addr_req(q, mp);
6948 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
6949 			    "udp_wput_other_end: q %p (%S)", q, "addrreq");
6950 			return;
6951 		case O_T_BIND_REQ:
6952 		case T_BIND_REQ:
6953 			udp_tpi_bind(q, mp);
6954 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
6955 			    "udp_wput_other_end: q %p (%S)", q, "bindreq");
6956 			return;
6957 		case T_CONN_REQ:
6958 			udp_tpi_connect(q, mp);
6959 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
6960 			    "udp_wput_other_end: q %p (%S)", q, "connreq");
6961 			return;
6962 		case T_CAPABILITY_REQ:
6963 			udp_capability_req(q, mp);
6964 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
6965 			    "udp_wput_other_end: q %p (%S)", q, "capabreq");
6966 			return;
6967 		case T_INFO_REQ:
6968 			udp_info_req(q, mp);
6969 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
6970 			    "udp_wput_other_end: q %p (%S)", q, "inforeq");
6971 			return;
6972 		case T_UNITDATA_REQ:
6973 			/*
6974 			 * If a T_UNITDATA_REQ gets here, the address must
6975 			 * be bad.  Valid T_UNITDATA_REQs are handled
6976 			 * in udp_wput.
6977 			 */
6978 			udp_ud_err(q, mp, NULL, 0, EADDRNOTAVAIL);
6979 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
6980 			    "udp_wput_other_end: q %p (%S)", q, "unitdatareq");
6981 			return;
6982 		case T_UNBIND_REQ:
6983 			udp_tpi_unbind(q, mp);
6984 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
6985 			    "udp_wput_other_end: q %p (%S)", q, "unbindreq");
6986 			return;
6987 		case T_SVR4_OPTMGMT_REQ:
6988 			/*
6989 			 * All Solaris components should pass a db_credp
6990 			 * for this TPI message, hence we ASSERT.
6991 			 * But in case there is some other M_PROTO that looks
6992 			 * like a TPI message sent by some other kernel
6993 			 * component, we check and return an error.
6994 			 */
6995 			cr = msg_getcred(mp, NULL);
6996 			ASSERT(cr != NULL);
6997 			if (cr == NULL) {
6998 				udp_err_ack(q, mp, TSYSERR, EINVAL);
6999 				return;
7000 			}
7001 			if (!snmpcom_req(q, mp, udp_snmp_set, ip_snmp_get,
7002 			    cr)) {
7003 				(void) svr4_optcom_req(q,
7004 				    mp, cr, &udp_opt_obj, B_TRUE);
7005 			}
7006 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
7007 			    "udp_wput_other_end: q %p (%S)", q, "optmgmtreq");
7008 			return;
7009 
7010 		case T_OPTMGMT_REQ:
7011 			/*
7012 			 * All Solaris components should pass a db_credp
7013 			 * for this TPI message, hence we ASSERT.
7014 			 * But in case there is some other M_PROTO that looks
7015 			 * like a TPI message sent by some other kernel
7016 			 * component, we check and return an error.
7017 			 */
7018 			cr = msg_getcred(mp, NULL);
7019 			ASSERT(cr != NULL);
7020 			if (cr == NULL) {
7021 				udp_err_ack(q, mp, TSYSERR, EINVAL);
7022 				return;
7023 			}
7024 			(void) tpi_optcom_req(q, mp, cr, &udp_opt_obj, B_TRUE);
7025 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
7026 			    "udp_wput_other_end: q %p (%S)", q, "optmgmtreq");
7027 			return;
7028 
7029 		case T_DISCON_REQ:
7030 			udp_tpi_disconnect(q, mp);
7031 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
7032 			    "udp_wput_other_end: q %p (%S)", q, "disconreq");
7033 			return;
7034 
7035 		/* The following TPI message is not supported by udp. */
7036 		case O_T_CONN_RES:
7037 		case T_CONN_RES:
7038 			udp_err_ack(q, mp, TNOTSUPPORT, 0);
7039 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
7040 			    "udp_wput_other_end: q %p (%S)", q,
7041 			    "connres/disconreq");
7042 			return;
7043 
7044 		/* The following 3 TPI messages are illegal for udp. */
7045 		case T_DATA_REQ:
7046 		case T_EXDATA_REQ:
7047 		case T_ORDREL_REQ:
7048 			udp_err_ack(q, mp, TNOTSUPPORT, 0);
7049 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
7050 			    "udp_wput_other_end: q %p (%S)", q,
7051 			    "data/exdata/ordrel");
7052 			return;
7053 		default:
7054 			break;
7055 		}
7056 		break;
7057 	case M_FLUSH:
7058 		if (*rptr & FLUSHW)
7059 			flushq(q, FLUSHDATA);
7060 		break;
7061 	case M_IOCTL:
7062 		iocp = (struct iocblk *)mp->b_rptr;
7063 		switch (iocp->ioc_cmd) {
7064 		case TI_GETPEERNAME:
7065 			if (udp->udp_state != TS_DATA_XFER) {
7066 				/*
7067 				 * If a default destination address has not
7068 				 * been associated with the stream, then we
7069 				 * don't know the peer's name.
7070 				 */
7071 				iocp->ioc_error = ENOTCONN;
7072 				iocp->ioc_count = 0;
7073 				mp->b_datap->db_type = M_IOCACK;
7074 				qreply(q, mp);
7075 				TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
7076 				    "udp_wput_other_end: q %p (%S)", q,
7077 				    "getpeername");
7078 				return;
7079 			}
7080 			/* FALLTHRU */
7081 		case TI_GETMYNAME: {
7082 			/*
7083 			 * For TI_GETPEERNAME and TI_GETMYNAME, we first
7084 			 * need to copyin the user's strbuf structure.
7085 			 * Processing will continue in the M_IOCDATA case
7086 			 * below.
7087 			 */
7088 			mi_copyin(q, mp, NULL,
7089 			    SIZEOF_STRUCT(strbuf, iocp->ioc_flag));
7090 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
7091 			    "udp_wput_other_end: q %p (%S)", q, "getmyname");
7092 			return;
7093 			}
7094 		case ND_SET:
7095 			/* nd_getset performs the necessary checking */
7096 		case ND_GET:
7097 			if (nd_getset(q, us->us_nd, mp)) {
7098 				qreply(q, mp);
7099 				TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
7100 				    "udp_wput_other_end: q %p (%S)", q, "get");
7101 				return;
7102 			}
7103 			break;
7104 		case _SIOCSOCKFALLBACK:
7105 			/*
7106 			 * Either sockmod is about to be popped and the
7107 			 * socket would now be treated as a plain stream,
7108 			 * or a module is about to be pushed so we could
7109 			 * no longer use read-side synchronous stream.
7110 			 * Drain any queued data and disable direct sockfs
7111 			 * interface from now on.
7112 			 */
7113 			if (!udp->udp_issocket) {
7114 				DB_TYPE(mp) = M_IOCNAK;
7115 				iocp->ioc_error = EINVAL;
7116 			} else {
7117 				udp_disable_direct_sockfs(udp);
7118 
7119 				DB_TYPE(mp) = M_IOCACK;
7120 				iocp->ioc_error = 0;
7121 			}
7122 			iocp->ioc_count = 0;
7123 			iocp->ioc_rval = 0;
7124 			qreply(q, mp);
7125 			return;
7126 		default:
7127 			break;
7128 		}
7129 		break;
7130 	case M_IOCDATA:
7131 		udp_wput_iocdata(q, mp);
7132 		TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
7133 		    "udp_wput_other_end: q %p (%S)", q, "iocdata");
7134 		return;
7135 	default:
7136 		/* Unrecognized messages are passed through without change. */
7137 		break;
7138 	}
7139 	TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
7140 	    "udp_wput_other_end: q %p (%S)", q, "end");
7141 	ip_output(connp, mp, q, IP_WPUT);
7142 }
7143 
7144 /*
7145  * udp_wput_iocdata is called by udp_wput_other to handle all M_IOCDATA
7146  * messages.
7147  */
7148 static void
7149 udp_wput_iocdata(queue_t *q, mblk_t *mp)
7150 {
7151 	mblk_t		*mp1;
7152 	struct	iocblk *iocp = (struct iocblk *)mp->b_rptr;
7153 	STRUCT_HANDLE(strbuf, sb);
7154 	udp_t		*udp = Q_TO_UDP(q);
7155 	int		error;
7156 	uint_t		addrlen;
7157 
7158 	/* Make sure it is one of ours. */
7159 	switch (iocp->ioc_cmd) {
7160 	case TI_GETMYNAME:
7161 	case TI_GETPEERNAME:
7162 		break;
7163 	default:
7164 		ip_output(udp->udp_connp, mp, q, IP_WPUT);
7165 		return;
7166 	}
7167 
7168 	switch (mi_copy_state(q, mp, &mp1)) {
7169 	case -1:
7170 		return;
7171 	case MI_COPY_CASE(MI_COPY_IN, 1):
7172 		break;
7173 	case MI_COPY_CASE(MI_COPY_OUT, 1):
7174 		/*
7175 		 * The address has been copied out, so now
7176 		 * copyout the strbuf.
7177 		 */
7178 		mi_copyout(q, mp);
7179 		return;
7180 	case MI_COPY_CASE(MI_COPY_OUT, 2):
7181 		/*
7182 		 * The address and strbuf have been copied out.
7183 		 * We're done, so just acknowledge the original
7184 		 * M_IOCTL.
7185 		 */
7186 		mi_copy_done(q, mp, 0);
7187 		return;
7188 	default:
7189 		/*
7190 		 * Something strange has happened, so acknowledge
7191 		 * the original M_IOCTL with an EPROTO error.
7192 		 */
7193 		mi_copy_done(q, mp, EPROTO);
7194 		return;
7195 	}
7196 
7197 	/*
7198 	 * Now we have the strbuf structure for TI_GETMYNAME
7199 	 * and TI_GETPEERNAME.  Next we copyout the requested
7200 	 * address and then we'll copyout the strbuf.
7201 	 */
7202 	STRUCT_SET_HANDLE(sb, iocp->ioc_flag, (void *)mp1->b_rptr);
7203 	addrlen = udp->udp_family == AF_INET ? sizeof (sin_t) : sizeof (sin6_t);
7204 	if (STRUCT_FGET(sb, maxlen) < addrlen) {
7205 		mi_copy_done(q, mp, EINVAL);
7206 		return;
7207 	}
7208 
7209 	mp1 = mi_copyout_alloc(q, mp, STRUCT_FGETP(sb, buf), addrlen, B_TRUE);
7210 
7211 	if (mp1 == NULL)
7212 		return;
7213 
7214 	rw_enter(&udp->udp_rwlock, RW_READER);
7215 	switch (iocp->ioc_cmd) {
7216 	case TI_GETMYNAME:
7217 		error = udp_do_getsockname(udp, (void *)mp1->b_rptr, &addrlen);
7218 		break;
7219 	case TI_GETPEERNAME:
7220 		error = udp_do_getpeername(udp, (void *)mp1->b_rptr, &addrlen);
7221 		break;
7222 	}
7223 	rw_exit(&udp->udp_rwlock);
7224 
7225 	if (error != 0) {
7226 		mi_copy_done(q, mp, error);
7227 	} else {
7228 		mp1->b_wptr += addrlen;
7229 		STRUCT_FSET(sb, len, addrlen);
7230 
7231 		/* Copy out the address */
7232 		mi_copyout(q, mp);
7233 	}
7234 }
7235 
7236 static int
7237 udp_unitdata_opt_process(queue_t *q, mblk_t *mp, int *errorp,
7238     udpattrs_t *udpattrs)
7239 {
7240 	struct T_unitdata_req *udreqp;
7241 	int is_absreq_failure;
7242 	cred_t *cr;
7243 
7244 	ASSERT(((t_primp_t)mp->b_rptr)->type);
7245 
7246 	/*
7247 	 * All Solaris components should pass a db_credp
7248 	 * for this TPI message, hence we should ASSERT.
7249 	 * However, RPC (svc_clts_ksend) does this odd thing where it
7250 	 * passes the options from a T_UNITDATA_IND unchanged in a
7251 	 * T_UNITDATA_REQ. While that is the right thing to do for
7252 	 * some options, SCM_UCRED being the key one, this also makes it
7253 	 * pass down IP_RECVDSTADDR. Hence we can't ASSERT here.
7254 	 */
7255 	cr = msg_getcred(mp, NULL);
7256 	if (cr == NULL) {
7257 		cr = Q_TO_CONN(q)->conn_cred;
7258 	}
7259 	udreqp = (struct T_unitdata_req *)mp->b_rptr;
7260 
7261 	*errorp = tpi_optcom_buf(q, mp, &udreqp->OPT_length,
7262 	    udreqp->OPT_offset, cr, &udp_opt_obj,
7263 	    udpattrs, &is_absreq_failure);
7264 
7265 	if (*errorp != 0) {
7266 		/*
7267 		 * Note: No special action needed in this
7268 		 * module for "is_absreq_failure"
7269 		 */
7270 		return (-1);		/* failure */
7271 	}
7272 	ASSERT(is_absreq_failure == 0);
7273 	return (0);	/* success */
7274 }
7275 
7276 void
7277 udp_ddi_g_init(void)
7278 {
7279 	udp_max_optsize = optcom_max_optsize(udp_opt_obj.odb_opt_des_arr,
7280 	    udp_opt_obj.odb_opt_arr_cnt);
7281 
7282 	/*
7283 	 * We want to be informed each time a stack is created or
7284 	 * destroyed in the kernel, so we can maintain the
7285 	 * set of udp_stack_t's.
7286 	 */
7287 	netstack_register(NS_UDP, udp_stack_init, NULL, udp_stack_fini);
7288 }
7289 
7290 void
7291 udp_ddi_g_destroy(void)
7292 {
7293 	netstack_unregister(NS_UDP);
7294 }
7295 
7296 #define	INET_NAME	"ip"
7297 
7298 /*
7299  * Initialize the UDP stack instance.
7300  */
7301 static void *
7302 udp_stack_init(netstackid_t stackid, netstack_t *ns)
7303 {
7304 	udp_stack_t	*us;
7305 	udpparam_t	*pa;
7306 	int		i;
7307 	int		error = 0;
7308 	major_t		major;
7309 
7310 	us = (udp_stack_t *)kmem_zalloc(sizeof (*us), KM_SLEEP);
7311 	us->us_netstack = ns;
7312 
7313 	us->us_num_epriv_ports = UDP_NUM_EPRIV_PORTS;
7314 	us->us_epriv_ports[0] = 2049;
7315 	us->us_epriv_ports[1] = 4045;
7316 
7317 	/*
7318 	 * The smallest anonymous port in the priviledged port range which UDP
7319 	 * looks for free port.  Use in the option UDP_ANONPRIVBIND.
7320 	 */
7321 	us->us_min_anonpriv_port = 512;
7322 
7323 	us->us_bind_fanout_size = udp_bind_fanout_size;
7324 
7325 	/* Roundup variable that might have been modified in /etc/system */
7326 	if (us->us_bind_fanout_size & (us->us_bind_fanout_size - 1)) {
7327 		/* Not a power of two. Round up to nearest power of two */
7328 		for (i = 0; i < 31; i++) {
7329 			if (us->us_bind_fanout_size < (1 << i))
7330 				break;
7331 		}
7332 		us->us_bind_fanout_size = 1 << i;
7333 	}
7334 	us->us_bind_fanout = kmem_zalloc(us->us_bind_fanout_size *
7335 	    sizeof (udp_fanout_t), KM_SLEEP);
7336 	for (i = 0; i < us->us_bind_fanout_size; i++) {
7337 		mutex_init(&us->us_bind_fanout[i].uf_lock, NULL, MUTEX_DEFAULT,
7338 		    NULL);
7339 	}
7340 
7341 	pa = (udpparam_t *)kmem_alloc(sizeof (udp_param_arr), KM_SLEEP);
7342 
7343 	us->us_param_arr = pa;
7344 	bcopy(udp_param_arr, us->us_param_arr, sizeof (udp_param_arr));
7345 
7346 	(void) udp_param_register(&us->us_nd,
7347 	    us->us_param_arr, A_CNT(udp_param_arr));
7348 
7349 	us->us_kstat = udp_kstat2_init(stackid, &us->us_statistics);
7350 	us->us_mibkp = udp_kstat_init(stackid);
7351 
7352 	major = mod_name_to_major(INET_NAME);
7353 	error = ldi_ident_from_major(major, &us->us_ldi_ident);
7354 	ASSERT(error == 0);
7355 	return (us);
7356 }
7357 
7358 /*
7359  * Free the UDP stack instance.
7360  */
7361 static void
7362 udp_stack_fini(netstackid_t stackid, void *arg)
7363 {
7364 	udp_stack_t *us = (udp_stack_t *)arg;
7365 	int i;
7366 
7367 	for (i = 0; i < us->us_bind_fanout_size; i++) {
7368 		mutex_destroy(&us->us_bind_fanout[i].uf_lock);
7369 	}
7370 
7371 	kmem_free(us->us_bind_fanout, us->us_bind_fanout_size *
7372 	    sizeof (udp_fanout_t));
7373 
7374 	us->us_bind_fanout = NULL;
7375 
7376 	nd_free(&us->us_nd);
7377 	kmem_free(us->us_param_arr, sizeof (udp_param_arr));
7378 	us->us_param_arr = NULL;
7379 
7380 	udp_kstat_fini(stackid, us->us_mibkp);
7381 	us->us_mibkp = NULL;
7382 
7383 	udp_kstat2_fini(stackid, us->us_kstat);
7384 	us->us_kstat = NULL;
7385 	bzero(&us->us_statistics, sizeof (us->us_statistics));
7386 
7387 	ldi_ident_release(us->us_ldi_ident);
7388 	kmem_free(us, sizeof (*us));
7389 }
7390 
7391 static void *
7392 udp_kstat2_init(netstackid_t stackid, udp_stat_t *us_statisticsp)
7393 {
7394 	kstat_t *ksp;
7395 
7396 	udp_stat_t template = {
7397 		{ "udp_ip_send",		KSTAT_DATA_UINT64 },
7398 		{ "udp_ip_ire_send",		KSTAT_DATA_UINT64 },
7399 		{ "udp_ire_null",		KSTAT_DATA_UINT64 },
7400 		{ "udp_drain",			KSTAT_DATA_UINT64 },
7401 		{ "udp_sock_fallback",		KSTAT_DATA_UINT64 },
7402 		{ "udp_rrw_busy",		KSTAT_DATA_UINT64 },
7403 		{ "udp_rrw_msgcnt",		KSTAT_DATA_UINT64 },
7404 		{ "udp_out_sw_cksum",		KSTAT_DATA_UINT64 },
7405 		{ "udp_out_sw_cksum_bytes",	KSTAT_DATA_UINT64 },
7406 		{ "udp_out_opt",		KSTAT_DATA_UINT64 },
7407 		{ "udp_out_err_notconn",	KSTAT_DATA_UINT64 },
7408 		{ "udp_out_err_output",		KSTAT_DATA_UINT64 },
7409 		{ "udp_out_err_tudr",		KSTAT_DATA_UINT64 },
7410 		{ "udp_in_pktinfo",		KSTAT_DATA_UINT64 },
7411 		{ "udp_in_recvdstaddr",		KSTAT_DATA_UINT64 },
7412 		{ "udp_in_recvopts",		KSTAT_DATA_UINT64 },
7413 		{ "udp_in_recvif",		KSTAT_DATA_UINT64 },
7414 		{ "udp_in_recvslla",		KSTAT_DATA_UINT64 },
7415 		{ "udp_in_recvucred",		KSTAT_DATA_UINT64 },
7416 		{ "udp_in_recvttl",		KSTAT_DATA_UINT64 },
7417 		{ "udp_in_recvhopopts",		KSTAT_DATA_UINT64 },
7418 		{ "udp_in_recvhoplimit",	KSTAT_DATA_UINT64 },
7419 		{ "udp_in_recvdstopts",		KSTAT_DATA_UINT64 },
7420 		{ "udp_in_recvrtdstopts",	KSTAT_DATA_UINT64 },
7421 		{ "udp_in_recvrthdr",		KSTAT_DATA_UINT64 },
7422 		{ "udp_in_recvpktinfo",		KSTAT_DATA_UINT64 },
7423 		{ "udp_in_recvtclass",		KSTAT_DATA_UINT64 },
7424 		{ "udp_in_timestamp",		KSTAT_DATA_UINT64 },
7425 #ifdef DEBUG
7426 		{ "udp_data_conn",		KSTAT_DATA_UINT64 },
7427 		{ "udp_data_notconn",		KSTAT_DATA_UINT64 },
7428 #endif
7429 	};
7430 
7431 	ksp = kstat_create_netstack(UDP_MOD_NAME, 0, "udpstat", "net",
7432 	    KSTAT_TYPE_NAMED, sizeof (template) / sizeof (kstat_named_t),
7433 	    KSTAT_FLAG_VIRTUAL, stackid);
7434 
7435 	if (ksp == NULL)
7436 		return (NULL);
7437 
7438 	bcopy(&template, us_statisticsp, sizeof (template));
7439 	ksp->ks_data = (void *)us_statisticsp;
7440 	ksp->ks_private = (void *)(uintptr_t)stackid;
7441 
7442 	kstat_install(ksp);
7443 	return (ksp);
7444 }
7445 
7446 static void
7447 udp_kstat2_fini(netstackid_t stackid, kstat_t *ksp)
7448 {
7449 	if (ksp != NULL) {
7450 		ASSERT(stackid == (netstackid_t)(uintptr_t)ksp->ks_private);
7451 		kstat_delete_netstack(ksp, stackid);
7452 	}
7453 }
7454 
7455 static void *
7456 udp_kstat_init(netstackid_t stackid)
7457 {
7458 	kstat_t	*ksp;
7459 
7460 	udp_named_kstat_t template = {
7461 		{ "inDatagrams",	KSTAT_DATA_UINT64, 0 },
7462 		{ "inErrors",		KSTAT_DATA_UINT32, 0 },
7463 		{ "outDatagrams",	KSTAT_DATA_UINT64, 0 },
7464 		{ "entrySize",		KSTAT_DATA_INT32, 0 },
7465 		{ "entry6Size",		KSTAT_DATA_INT32, 0 },
7466 		{ "outErrors",		KSTAT_DATA_UINT32, 0 },
7467 	};
7468 
7469 	ksp = kstat_create_netstack(UDP_MOD_NAME, 0, UDP_MOD_NAME, "mib2",
7470 	    KSTAT_TYPE_NAMED,
7471 	    NUM_OF_FIELDS(udp_named_kstat_t), 0, stackid);
7472 
7473 	if (ksp == NULL || ksp->ks_data == NULL)
7474 		return (NULL);
7475 
7476 	template.entrySize.value.ui32 = sizeof (mib2_udpEntry_t);
7477 	template.entry6Size.value.ui32 = sizeof (mib2_udp6Entry_t);
7478 
7479 	bcopy(&template, ksp->ks_data, sizeof (template));
7480 	ksp->ks_update = udp_kstat_update;
7481 	ksp->ks_private = (void *)(uintptr_t)stackid;
7482 
7483 	kstat_install(ksp);
7484 	return (ksp);
7485 }
7486 
7487 static void
7488 udp_kstat_fini(netstackid_t stackid, kstat_t *ksp)
7489 {
7490 	if (ksp != NULL) {
7491 		ASSERT(stackid == (netstackid_t)(uintptr_t)ksp->ks_private);
7492 		kstat_delete_netstack(ksp, stackid);
7493 	}
7494 }
7495 
7496 static int
7497 udp_kstat_update(kstat_t *kp, int rw)
7498 {
7499 	udp_named_kstat_t *udpkp;
7500 	netstackid_t	stackid = (netstackid_t)(uintptr_t)kp->ks_private;
7501 	netstack_t	*ns;
7502 	udp_stack_t	*us;
7503 
7504 	if ((kp == NULL) || (kp->ks_data == NULL))
7505 		return (EIO);
7506 
7507 	if (rw == KSTAT_WRITE)
7508 		return (EACCES);
7509 
7510 	ns = netstack_find_by_stackid(stackid);
7511 	if (ns == NULL)
7512 		return (-1);
7513 	us = ns->netstack_udp;
7514 	if (us == NULL) {
7515 		netstack_rele(ns);
7516 		return (-1);
7517 	}
7518 	udpkp = (udp_named_kstat_t *)kp->ks_data;
7519 
7520 	udpkp->inDatagrams.value.ui64 =	us->us_udp_mib.udpHCInDatagrams;
7521 	udpkp->inErrors.value.ui32 =	us->us_udp_mib.udpInErrors;
7522 	udpkp->outDatagrams.value.ui64 = us->us_udp_mib.udpHCOutDatagrams;
7523 	udpkp->outErrors.value.ui32 =	us->us_udp_mib.udpOutErrors;
7524 	netstack_rele(ns);
7525 	return (0);
7526 }
7527 
7528 /*
7529  * Read-side synchronous stream info entry point, called as a
7530  * result of handling certain STREAMS ioctl operations.
7531  */
7532 static int
7533 udp_rinfop(queue_t *q, infod_t *dp)
7534 {
7535 	mblk_t	*mp;
7536 	uint_t	cmd = dp->d_cmd;
7537 	int	res = 0;
7538 	int	error = 0;
7539 	udp_t	*udp = Q_TO_UDP(q);
7540 	struct stdata *stp = STREAM(q);
7541 
7542 	mutex_enter(&udp->udp_drain_lock);
7543 	/* If shutdown on read has happened, return nothing */
7544 	mutex_enter(&stp->sd_lock);
7545 	if (stp->sd_flag & STREOF) {
7546 		mutex_exit(&stp->sd_lock);
7547 		goto done;
7548 	}
7549 	mutex_exit(&stp->sd_lock);
7550 
7551 	if ((mp = udp->udp_rcv_list_head) == NULL)
7552 		goto done;
7553 
7554 	ASSERT(DB_TYPE(mp) != M_DATA && mp->b_cont != NULL);
7555 
7556 	if (cmd & INFOD_COUNT) {
7557 		/*
7558 		 * Return the number of messages.
7559 		 */
7560 		dp->d_count += udp->udp_rcv_msgcnt;
7561 		res |= INFOD_COUNT;
7562 	}
7563 	if (cmd & INFOD_BYTES) {
7564 		/*
7565 		 * Return size of all data messages.
7566 		 */
7567 		dp->d_bytes += udp->udp_rcv_cnt;
7568 		res |= INFOD_BYTES;
7569 	}
7570 	if (cmd & INFOD_FIRSTBYTES) {
7571 		/*
7572 		 * Return size of first data message.
7573 		 */
7574 		dp->d_bytes = msgdsize(mp);
7575 		res |= INFOD_FIRSTBYTES;
7576 		dp->d_cmd &= ~INFOD_FIRSTBYTES;
7577 	}
7578 	if (cmd & INFOD_COPYOUT) {
7579 		mblk_t *mp1 = mp->b_cont;
7580 		int n;
7581 		/*
7582 		 * Return data contents of first message.
7583 		 */
7584 		ASSERT(DB_TYPE(mp1) == M_DATA);
7585 		while (mp1 != NULL && dp->d_uiop->uio_resid > 0) {
7586 			n = MIN(dp->d_uiop->uio_resid, MBLKL(mp1));
7587 			if (n != 0 && (error = uiomove((char *)mp1->b_rptr, n,
7588 			    UIO_READ, dp->d_uiop)) != 0) {
7589 				goto done;
7590 			}
7591 			mp1 = mp1->b_cont;
7592 		}
7593 		res |= INFOD_COPYOUT;
7594 		dp->d_cmd &= ~INFOD_COPYOUT;
7595 	}
7596 done:
7597 	mutex_exit(&udp->udp_drain_lock);
7598 
7599 	dp->d_res |= res;
7600 
7601 	return (error);
7602 }
7603 
7604 /*
7605  * Read-side synchronous stream entry point.  This is called as a result
7606  * of recv/read operation done at sockfs, and is guaranteed to execute
7607  * outside of the interrupt thread context.  It returns a single datagram
7608  * (b_cont chain of T_UNITDATA_IND plus data) to the upper layer.
7609  */
7610 static int
7611 udp_rrw(queue_t *q, struiod_t *dp)
7612 {
7613 	mblk_t	*mp;
7614 	udp_t	*udp = Q_TO_UDP(q);
7615 	udp_stack_t *us = udp->udp_us;
7616 
7617 	/*
7618 	 * Dequeue datagram from the head of the list and return
7619 	 * it to caller; also ensure that RSLEEP sd_wakeq flag is
7620 	 * set/cleared depending on whether or not there's data
7621 	 * remaining in the list.
7622 	 */
7623 	mutex_enter(&udp->udp_drain_lock);
7624 	if (!udp->udp_direct_sockfs) {
7625 		mutex_exit(&udp->udp_drain_lock);
7626 		UDP_STAT(us, udp_rrw_busy);
7627 		return (EBUSY);
7628 	}
7629 	if ((mp = udp->udp_rcv_list_head) != NULL) {
7630 		uint_t size = msgdsize(mp);
7631 
7632 		/* Last datagram in the list? */
7633 		if ((udp->udp_rcv_list_head = mp->b_next) == NULL)
7634 			udp->udp_rcv_list_tail = NULL;
7635 		mp->b_next = NULL;
7636 
7637 		udp->udp_rcv_cnt -= size;
7638 		udp->udp_rcv_msgcnt--;
7639 		UDP_STAT(us, udp_rrw_msgcnt);
7640 
7641 		/* No longer flow-controlling? */
7642 		if (udp->udp_rcv_cnt < udp->udp_rcv_hiwat &&
7643 		    udp->udp_rcv_msgcnt < udp->udp_rcv_hiwat)
7644 			udp->udp_drain_qfull = B_FALSE;
7645 	}
7646 	if (udp->udp_rcv_list_head == NULL) {
7647 		/*
7648 		 * Either we just dequeued the last datagram or
7649 		 * we get here from sockfs and have nothing to
7650 		 * return; in this case clear RSLEEP.
7651 		 */
7652 		ASSERT(udp->udp_rcv_cnt == 0);
7653 		ASSERT(udp->udp_rcv_msgcnt == 0);
7654 		ASSERT(udp->udp_rcv_list_tail == NULL);
7655 		STR_WAKEUP_CLEAR(STREAM(q));
7656 	} else {
7657 		/*
7658 		 * More data follows; we need udp_rrw() to be
7659 		 * called in future to pick up the rest.
7660 		 */
7661 		STR_WAKEUP_SET(STREAM(q));
7662 	}
7663 	mutex_exit(&udp->udp_drain_lock);
7664 	dp->d_mp = mp;
7665 	return (0);
7666 }
7667 
7668 /*
7669  * Enqueue a completely-built T_UNITDATA_IND message into the receive
7670  * list; this is typically executed within the interrupt thread context
7671  * and so we do things as quickly as possible.
7672  */
7673 static void
7674 udp_rcv_enqueue(queue_t *q, udp_t *udp, mblk_t *mp, uint_t pkt_len)
7675 {
7676 	ASSERT(q == RD(q));
7677 	ASSERT(pkt_len == msgdsize(mp));
7678 	ASSERT(mp->b_next == NULL && mp->b_cont != NULL);
7679 	ASSERT(DB_TYPE(mp) == M_PROTO && DB_TYPE(mp->b_cont) == M_DATA);
7680 	ASSERT(MBLKL(mp) >= sizeof (struct T_unitdata_ind));
7681 
7682 	mutex_enter(&udp->udp_drain_lock);
7683 	/*
7684 	 * Wake up and signal the receiving app; it is okay to do this
7685 	 * before enqueueing the mp because we are holding the drain lock.
7686 	 * One of the advantages of synchronous stream is the ability for
7687 	 * us to find out when the application performs a read on the
7688 	 * socket by way of udp_rrw() entry point being called.  We need
7689 	 * to generate SIGPOLL/SIGIO for each received data in the case
7690 	 * of asynchronous socket just as in the strrput() case.  However,
7691 	 * we only wake the application up when necessary, i.e. during the
7692 	 * first enqueue.  When udp_rrw() is called, we send up a single
7693 	 * datagram upstream and call STR_WAKEUP_SET() again when there
7694 	 * are still data remaining in our receive queue.
7695 	 */
7696 	STR_WAKEUP_SENDSIG(STREAM(q), udp->udp_rcv_list_head);
7697 	if (udp->udp_rcv_list_head == NULL)
7698 		udp->udp_rcv_list_head = mp;
7699 	else
7700 		udp->udp_rcv_list_tail->b_next = mp;
7701 	udp->udp_rcv_list_tail = mp;
7702 	udp->udp_rcv_cnt += pkt_len;
7703 	udp->udp_rcv_msgcnt++;
7704 
7705 	/* Need to flow-control? */
7706 	if (udp->udp_rcv_cnt >= udp->udp_rcv_hiwat ||
7707 	    udp->udp_rcv_msgcnt >= udp->udp_rcv_hiwat)
7708 		udp->udp_drain_qfull = B_TRUE;
7709 
7710 	mutex_exit(&udp->udp_drain_lock);
7711 }
7712 
7713 /*
7714  * Drain the contents of receive list to the module upstream; we do
7715  * this during close or when we fallback to the slow mode due to
7716  * sockmod being popped or a module being pushed on top of us.
7717  */
7718 static void
7719 udp_rcv_drain(queue_t *q, udp_t *udp, boolean_t closing)
7720 {
7721 	mblk_t *mp;
7722 	udp_stack_t *us = udp->udp_us;
7723 
7724 	mutex_enter(&udp->udp_drain_lock);
7725 	/*
7726 	 * There is no race with a concurrent udp_input() sending
7727 	 * up packets using putnext() after we have cleared the
7728 	 * udp_direct_sockfs flag but before we have completed
7729 	 * sending up the packets in udp_rcv_list, since we are
7730 	 * either a writer or we have quiesced the conn.
7731 	 */
7732 	udp->udp_direct_sockfs = B_FALSE;
7733 	mutex_exit(&udp->udp_drain_lock);
7734 
7735 	if (udp->udp_rcv_list_head != NULL)
7736 		UDP_STAT(us, udp_drain);
7737 
7738 	/*
7739 	 * Send up everything via putnext(); note here that we
7740 	 * don't need the udp_drain_lock to protect us since
7741 	 * nothing can enter udp_rrw() and that we currently
7742 	 * have exclusive access to this udp.
7743 	 */
7744 	while ((mp = udp->udp_rcv_list_head) != NULL) {
7745 		udp->udp_rcv_list_head = mp->b_next;
7746 		mp->b_next = NULL;
7747 		udp->udp_rcv_cnt -= msgdsize(mp);
7748 		udp->udp_rcv_msgcnt--;
7749 		if (closing) {
7750 			freemsg(mp);
7751 		} else {
7752 			ASSERT(q == RD(q));
7753 			putnext(q, mp);
7754 		}
7755 	}
7756 	ASSERT(udp->udp_rcv_cnt == 0);
7757 	ASSERT(udp->udp_rcv_msgcnt == 0);
7758 	ASSERT(udp->udp_rcv_list_head == NULL);
7759 	udp->udp_rcv_list_tail = NULL;
7760 	udp->udp_drain_qfull = B_FALSE;
7761 }
7762 
7763 static size_t
7764 udp_set_rcv_hiwat(udp_t *udp, size_t size)
7765 {
7766 	udp_stack_t *us = udp->udp_us;
7767 
7768 	/* We add a bit of extra buffering */
7769 	size += size >> 1;
7770 	if (size > us->us_max_buf)
7771 		size = us->us_max_buf;
7772 
7773 	udp->udp_rcv_hiwat = size;
7774 	return (size);
7775 }
7776 
7777 /*
7778  * For the lower queue so that UDP can be a dummy mux.
7779  * Nobody should be sending
7780  * packets up this stream
7781  */
7782 static void
7783 udp_lrput(queue_t *q, mblk_t *mp)
7784 {
7785 	mblk_t *mp1;
7786 
7787 	switch (mp->b_datap->db_type) {
7788 	case M_FLUSH:
7789 		/* Turn around */
7790 		if (*mp->b_rptr & FLUSHW) {
7791 			*mp->b_rptr &= ~FLUSHR;
7792 			qreply(q, mp);
7793 			return;
7794 		}
7795 		break;
7796 	}
7797 	/* Could receive messages that passed through ar_rput */
7798 	for (mp1 = mp; mp1; mp1 = mp1->b_cont)
7799 		mp1->b_prev = mp1->b_next = NULL;
7800 	freemsg(mp);
7801 }
7802 
7803 /*
7804  * For the lower queue so that UDP can be a dummy mux.
7805  * Nobody should be sending packets down this stream.
7806  */
7807 /* ARGSUSED */
7808 void
7809 udp_lwput(queue_t *q, mblk_t *mp)
7810 {
7811 	freemsg(mp);
7812 }
7813 
7814 /*
7815  * Below routines for UDP socket module.
7816  */
7817 
7818 static conn_t *
7819 udp_do_open(cred_t *credp, boolean_t isv6, int flags)
7820 {
7821 	udp_t		*udp;
7822 	conn_t		*connp;
7823 	zoneid_t 	zoneid;
7824 	netstack_t 	*ns;
7825 	udp_stack_t 	*us;
7826 
7827 	ns = netstack_find_by_cred(credp);
7828 	ASSERT(ns != NULL);
7829 	us = ns->netstack_udp;
7830 	ASSERT(us != NULL);
7831 
7832 	/*
7833 	 * For exclusive stacks we set the zoneid to zero
7834 	 * to make UDP operate as if in the global zone.
7835 	 */
7836 	if (ns->netstack_stackid != GLOBAL_NETSTACKID)
7837 		zoneid = GLOBAL_ZONEID;
7838 	else
7839 		zoneid = crgetzoneid(credp);
7840 
7841 	ASSERT(flags == KM_SLEEP || flags == KM_NOSLEEP);
7842 
7843 	connp = ipcl_conn_create(IPCL_UDPCONN, flags, ns);
7844 	if (connp == NULL) {
7845 		netstack_rele(ns);
7846 		return (NULL);
7847 	}
7848 	udp = connp->conn_udp;
7849 
7850 	/*
7851 	 * ipcl_conn_create did a netstack_hold. Undo the hold that was
7852 	 * done by netstack_find_by_cred()
7853 	 */
7854 	netstack_rele(ns);
7855 
7856 	rw_enter(&udp->udp_rwlock, RW_WRITER);
7857 	ASSERT(connp->conn_ulp == IPPROTO_UDP);
7858 	ASSERT(connp->conn_udp == udp);
7859 	ASSERT(udp->udp_connp == connp);
7860 
7861 	/* Set the initial state of the stream and the privilege status. */
7862 	udp->udp_state = TS_UNBND;
7863 	if (isv6) {
7864 		udp->udp_family = AF_INET6;
7865 		udp->udp_ipversion = IPV6_VERSION;
7866 		udp->udp_max_hdr_len = IPV6_HDR_LEN + UDPH_SIZE;
7867 		udp->udp_ttl = us->us_ipv6_hoplimit;
7868 		connp->conn_af_isv6 = B_TRUE;
7869 		connp->conn_flags |= IPCL_ISV6;
7870 	} else {
7871 		udp->udp_family = AF_INET;
7872 		udp->udp_ipversion = IPV4_VERSION;
7873 		udp->udp_max_hdr_len = IP_SIMPLE_HDR_LENGTH + UDPH_SIZE;
7874 		udp->udp_ttl = us->us_ipv4_ttl;
7875 		connp->conn_af_isv6 = B_FALSE;
7876 		connp->conn_flags &= ~IPCL_ISV6;
7877 	}
7878 
7879 	udp->udp_multicast_ttl = IP_DEFAULT_MULTICAST_TTL;
7880 	udp->udp_pending_op = -1;
7881 	connp->conn_multicast_loop = IP_DEFAULT_MULTICAST_LOOP;
7882 	connp->conn_zoneid = zoneid;
7883 
7884 	udp->udp_open_time = lbolt64;
7885 	udp->udp_open_pid = curproc->p_pid;
7886 
7887 	/*
7888 	 * If the caller has the process-wide flag set, then default to MAC
7889 	 * exempt mode.  This allows read-down to unlabeled hosts.
7890 	 */
7891 	if (getpflags(NET_MAC_AWARE, credp) != 0)
7892 		connp->conn_mac_exempt = B_TRUE;
7893 
7894 	connp->conn_ulp_labeled = is_system_labeled();
7895 
7896 	udp->udp_us = us;
7897 
7898 	connp->conn_recv = udp_input;
7899 	crhold(credp);
7900 	connp->conn_cred = credp;
7901 
7902 	*((sin6_t *)&udp->udp_delayed_addr) = sin6_null;
7903 
7904 	rw_exit(&udp->udp_rwlock);
7905 
7906 	return (connp);
7907 }
7908 
7909 /* ARGSUSED */
7910 sock_lower_handle_t
7911 udp_create(int family, int type, int proto, sock_downcalls_t **sock_downcalls,
7912     uint_t *smodep, int *errorp, int flags, cred_t *credp)
7913 {
7914 	udp_t		*udp = NULL;
7915 	udp_stack_t	*us;
7916 	conn_t		*connp;
7917 	boolean_t	isv6;
7918 
7919 	if (type != SOCK_DGRAM || (family != AF_INET && family != AF_INET6) ||
7920 	    (proto != 0 && proto != IPPROTO_UDP)) {
7921 		*errorp = EPROTONOSUPPORT;
7922 		return (NULL);
7923 	}
7924 
7925 	if (family == AF_INET6)
7926 		isv6 = B_TRUE;
7927 	else
7928 		isv6 = B_FALSE;
7929 
7930 	connp = udp_do_open(credp, isv6, flags);
7931 	if (connp == NULL) {
7932 		*errorp = ENOMEM;
7933 		return (NULL);
7934 	}
7935 
7936 	udp = connp->conn_udp;
7937 	ASSERT(udp != NULL);
7938 	us = udp->udp_us;
7939 	ASSERT(us != NULL);
7940 
7941 	connp->conn_flags |= IPCL_NONSTR | IPCL_SOCKET;
7942 
7943 	/* Set flow control */
7944 	rw_enter(&udp->udp_rwlock, RW_WRITER);
7945 	(void) udp_set_rcv_hiwat(udp, us->us_recv_hiwat);
7946 	udp->udp_rcv_disply_hiwat = us->us_recv_hiwat;
7947 	udp->udp_rcv_lowat = udp_mod_info.mi_lowat;
7948 	udp->udp_xmit_hiwat = us->us_xmit_hiwat;
7949 	udp->udp_xmit_lowat = us->us_xmit_lowat;
7950 
7951 	if (udp->udp_family == AF_INET6) {
7952 		/* Build initial header template for transmit */
7953 		if ((*errorp = udp_build_hdrs(udp)) != 0) {
7954 			rw_exit(&udp->udp_rwlock);
7955 			ipcl_conn_destroy(connp);
7956 			return (NULL);
7957 		}
7958 	}
7959 	rw_exit(&udp->udp_rwlock);
7960 
7961 	connp->conn_flow_cntrld = B_FALSE;
7962 
7963 	ASSERT(us->us_ldi_ident != NULL);
7964 
7965 	if ((*errorp = ip_create_helper_stream(connp, us->us_ldi_ident)) != 0) {
7966 		ip1dbg(("udp_create: create of IP helper stream failed\n"));
7967 		udp_do_close(connp);
7968 		return (NULL);
7969 	}
7970 
7971 	/* Set the send flow control */
7972 	connp->conn_wq->q_hiwat = us->us_xmit_hiwat;
7973 	connp->conn_wq->q_lowat = us->us_xmit_lowat;
7974 
7975 	mutex_enter(&connp->conn_lock);
7976 	connp->conn_state_flags &= ~CONN_INCIPIENT;
7977 	mutex_exit(&connp->conn_lock);
7978 
7979 	*errorp = 0;
7980 	*smodep = SM_ATOMIC;
7981 	*sock_downcalls = &sock_udp_downcalls;
7982 	return ((sock_lower_handle_t)connp);
7983 }
7984 
7985 /* ARGSUSED */
7986 void
7987 udp_activate(sock_lower_handle_t proto_handle, sock_upper_handle_t sock_handle,
7988     sock_upcalls_t *sock_upcalls, int flags, cred_t *cr)
7989 {
7990 	conn_t 		*connp = (conn_t *)proto_handle;
7991 	udp_t 		*udp = connp->conn_udp;
7992 	udp_stack_t	*us = udp->udp_us;
7993 	struct sock_proto_props sopp;
7994 
7995 	/* All Solaris components should pass a cred for this operation. */
7996 	ASSERT(cr != NULL);
7997 
7998 	connp->conn_upcalls = sock_upcalls;
7999 	connp->conn_upper_handle = sock_handle;
8000 
8001 	sopp.sopp_flags = SOCKOPT_WROFF | SOCKOPT_RCVHIWAT |
8002 	    SOCKOPT_MAXBLK | SOCKOPT_MAXPSZ | SOCKOPT_MINPSZ;
8003 	sopp.sopp_wroff = udp->udp_max_hdr_len + us->us_wroff_extra;
8004 	sopp.sopp_maxblk = INFPSZ;
8005 	sopp.sopp_rxhiwat = udp->udp_rcv_hiwat;
8006 	sopp.sopp_maxaddrlen = sizeof (sin6_t);
8007 	sopp.sopp_maxpsz =
8008 	    (udp->udp_family == AF_INET) ? UDP_MAXPACKET_IPV4 :
8009 	    UDP_MAXPACKET_IPV6;
8010 	sopp.sopp_minpsz = (udp_mod_info.mi_minpsz == 1) ? 0 :
8011 	    udp_mod_info.mi_minpsz;
8012 
8013 	(*connp->conn_upcalls->su_set_proto_props)(connp->conn_upper_handle,
8014 	    &sopp);
8015 }
8016 
8017 static void
8018 udp_do_close(conn_t *connp)
8019 {
8020 	udp_t	*udp;
8021 
8022 	ASSERT(connp != NULL && IPCL_IS_UDP(connp));
8023 	udp = connp->conn_udp;
8024 
8025 	udp_quiesce_conn(connp);
8026 	ip_quiesce_conn(connp);
8027 
8028 	if (!IPCL_IS_NONSTR(connp)) {
8029 		/*
8030 		 * Disable read-side synchronous stream
8031 		 * interface and drain any queued data.
8032 		 */
8033 		ASSERT(connp->conn_wq != NULL);
8034 		udp_rcv_drain(connp->conn_wq, udp, B_TRUE);
8035 		ASSERT(!udp->udp_direct_sockfs);
8036 
8037 		ASSERT(connp->conn_rq != NULL);
8038 		qprocsoff(connp->conn_rq);
8039 	}
8040 
8041 	ASSERT(udp->udp_rcv_cnt == 0);
8042 	ASSERT(udp->udp_rcv_msgcnt == 0);
8043 	ASSERT(udp->udp_rcv_list_head == NULL);
8044 	ASSERT(udp->udp_rcv_list_tail == NULL);
8045 
8046 	udp_close_free(connp);
8047 
8048 	/*
8049 	 * Now we are truly single threaded on this stream, and can
8050 	 * delete the things hanging off the connp, and finally the connp.
8051 	 * We removed this connp from the fanout list, it cannot be
8052 	 * accessed thru the fanouts, and we already waited for the
8053 	 * conn_ref to drop to 0. We are already in close, so
8054 	 * there cannot be any other thread from the top. qprocsoff
8055 	 * has completed, and service has completed or won't run in
8056 	 * future.
8057 	 */
8058 	ASSERT(connp->conn_ref == 1);
8059 	if (!IPCL_IS_NONSTR(connp)) {
8060 		inet_minor_free(connp->conn_minor_arena, connp->conn_dev);
8061 	} else {
8062 		ip_free_helper_stream(connp);
8063 	}
8064 
8065 	connp->conn_ref--;
8066 	ipcl_conn_destroy(connp);
8067 }
8068 
8069 /* ARGSUSED */
8070 int
8071 udp_close(sock_lower_handle_t proto_handle, int flags, cred_t *cr)
8072 {
8073 	conn_t	*connp = (conn_t *)proto_handle;
8074 
8075 	/* All Solaris components should pass a cred for this operation. */
8076 	ASSERT(cr != NULL);
8077 
8078 	udp_do_close(connp);
8079 	return (0);
8080 }
8081 
8082 static int
8083 udp_do_bind(conn_t *connp, struct sockaddr *sa, socklen_t len, cred_t *cr,
8084     boolean_t bind_to_req_port_only)
8085 {
8086 	sin_t		*sin;
8087 	sin6_t		*sin6;
8088 	sin6_t		sin6addr;
8089 	in_port_t	port;		/* Host byte order */
8090 	in_port_t	requested_port;	/* Host byte order */
8091 	int		count;
8092 	in6_addr_t	v6src;
8093 	int		loopmax;
8094 	udp_fanout_t	*udpf;
8095 	in_port_t	lport;		/* Network byte order */
8096 	zoneid_t	zoneid;
8097 	udp_t		*udp;
8098 	boolean_t	is_inaddr_any;
8099 	mlp_type_t	addrtype, mlptype;
8100 	udp_stack_t	*us;
8101 	int		error = 0;
8102 	mblk_t		*mp = NULL;
8103 
8104 	udp = connp->conn_udp;
8105 	us = udp->udp_us;
8106 
8107 	if (udp->udp_state != TS_UNBND) {
8108 		(void) strlog(UDP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE,
8109 		    "udp_bind: bad state, %u", udp->udp_state);
8110 		return (-TOUTSTATE);
8111 	}
8112 
8113 	switch (len) {
8114 	case 0:
8115 		if (udp->udp_family == AF_INET) {
8116 			sin = (sin_t *)&sin6addr;
8117 			*sin = sin_null;
8118 			sin->sin_family = AF_INET;
8119 			sin->sin_addr.s_addr = INADDR_ANY;
8120 			udp->udp_ipversion = IPV4_VERSION;
8121 		} else {
8122 			ASSERT(udp->udp_family == AF_INET6);
8123 			sin6 = (sin6_t *)&sin6addr;
8124 			*sin6 = sin6_null;
8125 			sin6->sin6_family = AF_INET6;
8126 			V6_SET_ZERO(sin6->sin6_addr);
8127 			udp->udp_ipversion = IPV6_VERSION;
8128 		}
8129 		port = 0;
8130 		break;
8131 
8132 	case sizeof (sin_t):	/* Complete IPv4 address */
8133 		sin = (sin_t *)sa;
8134 
8135 		if (sin == NULL || !OK_32PTR((char *)sin))
8136 			return (EINVAL);
8137 
8138 		if (udp->udp_family != AF_INET ||
8139 		    sin->sin_family != AF_INET) {
8140 			return (EAFNOSUPPORT);
8141 		}
8142 		port = ntohs(sin->sin_port);
8143 		break;
8144 
8145 	case sizeof (sin6_t):	/* complete IPv6 address */
8146 		sin6 = (sin6_t *)sa;
8147 
8148 		if (sin6 == NULL || !OK_32PTR((char *)sin6))
8149 			return (EINVAL);
8150 
8151 		if (udp->udp_family != AF_INET6 ||
8152 		    sin6->sin6_family != AF_INET6) {
8153 			return (EAFNOSUPPORT);
8154 		}
8155 		port = ntohs(sin6->sin6_port);
8156 		break;
8157 
8158 	default:		/* Invalid request */
8159 		(void) strlog(UDP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE,
8160 		    "udp_bind: bad ADDR_length length %u", len);
8161 		return (-TBADADDR);
8162 	}
8163 
8164 	requested_port = port;
8165 
8166 	if (requested_port == 0 || !bind_to_req_port_only)
8167 		bind_to_req_port_only = B_FALSE;
8168 	else		/* T_BIND_REQ and requested_port != 0 */
8169 		bind_to_req_port_only = B_TRUE;
8170 
8171 	if (requested_port == 0) {
8172 		/*
8173 		 * If the application passed in zero for the port number, it
8174 		 * doesn't care which port number we bind to. Get one in the
8175 		 * valid range.
8176 		 */
8177 		if (udp->udp_anon_priv_bind) {
8178 			port = udp_get_next_priv_port(udp);
8179 		} else {
8180 			port = udp_update_next_port(udp,
8181 			    us->us_next_port_to_try, B_TRUE);
8182 		}
8183 	} else {
8184 		/*
8185 		 * If the port is in the well-known privileged range,
8186 		 * make sure the caller was privileged.
8187 		 */
8188 		int i;
8189 		boolean_t priv = B_FALSE;
8190 
8191 		if (port < us->us_smallest_nonpriv_port) {
8192 			priv = B_TRUE;
8193 		} else {
8194 			for (i = 0; i < us->us_num_epriv_ports; i++) {
8195 				if (port == us->us_epriv_ports[i]) {
8196 					priv = B_TRUE;
8197 					break;
8198 				}
8199 			}
8200 		}
8201 
8202 		if (priv) {
8203 			if (secpolicy_net_privaddr(cr, port, IPPROTO_UDP) != 0)
8204 				return (-TACCES);
8205 		}
8206 	}
8207 
8208 	if (port == 0)
8209 		return (-TNOADDR);
8210 
8211 	/*
8212 	 * The state must be TS_UNBND. TPI mandates that users must send
8213 	 * TPI primitives only 1 at a time and wait for the response before
8214 	 * sending the next primitive.
8215 	 */
8216 	rw_enter(&udp->udp_rwlock, RW_WRITER);
8217 	if (udp->udp_state != TS_UNBND || udp->udp_pending_op != -1) {
8218 		rw_exit(&udp->udp_rwlock);
8219 		(void) strlog(UDP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE,
8220 		    "udp_bind: bad state, %u", udp->udp_state);
8221 		return (-TOUTSTATE);
8222 	}
8223 	/* XXX how to remove the T_BIND_REQ? Should set it before calling */
8224 	udp->udp_pending_op = T_BIND_REQ;
8225 	/*
8226 	 * Copy the source address into our udp structure. This address
8227 	 * may still be zero; if so, IP will fill in the correct address
8228 	 * each time an outbound packet is passed to it. Since the udp is
8229 	 * not yet in the bind hash list, we don't grab the uf_lock to
8230 	 * change udp_ipversion
8231 	 */
8232 	if (udp->udp_family == AF_INET) {
8233 		ASSERT(sin != NULL);
8234 		ASSERT(udp->udp_ipversion == IPV4_VERSION);
8235 		udp->udp_max_hdr_len = IP_SIMPLE_HDR_LENGTH + UDPH_SIZE +
8236 		    udp->udp_ip_snd_options_len;
8237 		IN6_IPADDR_TO_V4MAPPED(sin->sin_addr.s_addr, &v6src);
8238 	} else {
8239 		ASSERT(sin6 != NULL);
8240 		v6src = sin6->sin6_addr;
8241 		if (IN6_IS_ADDR_V4MAPPED(&v6src)) {
8242 			/*
8243 			 * no need to hold the uf_lock to set the udp_ipversion
8244 			 * since we are not yet in the fanout list
8245 			 */
8246 			udp->udp_ipversion = IPV4_VERSION;
8247 			udp->udp_max_hdr_len = IP_SIMPLE_HDR_LENGTH +
8248 			    UDPH_SIZE + udp->udp_ip_snd_options_len;
8249 		} else {
8250 			udp->udp_ipversion = IPV6_VERSION;
8251 			udp->udp_max_hdr_len = udp->udp_sticky_hdrs_len;
8252 		}
8253 	}
8254 
8255 	/*
8256 	 * If udp_reuseaddr is not set, then we have to make sure that
8257 	 * the IP address and port number the application requested
8258 	 * (or we selected for the application) is not being used by
8259 	 * another stream.  If another stream is already using the
8260 	 * requested IP address and port, the behavior depends on
8261 	 * "bind_to_req_port_only". If set the bind fails; otherwise we
8262 	 * search for any an unused port to bind to the the stream.
8263 	 *
8264 	 * As per the BSD semantics, as modified by the Deering multicast
8265 	 * changes, if udp_reuseaddr is set, then we allow multiple binds
8266 	 * to the same port independent of the local IP address.
8267 	 *
8268 	 * This is slightly different than in SunOS 4.X which did not
8269 	 * support IP multicast. Note that the change implemented by the
8270 	 * Deering multicast code effects all binds - not only binding
8271 	 * to IP multicast addresses.
8272 	 *
8273 	 * Note that when binding to port zero we ignore SO_REUSEADDR in
8274 	 * order to guarantee a unique port.
8275 	 */
8276 
8277 	count = 0;
8278 	if (udp->udp_anon_priv_bind) {
8279 		/*
8280 		 * loopmax = (IPPORT_RESERVED-1) -
8281 		 *    us->us_min_anonpriv_port + 1
8282 		 */
8283 		loopmax = IPPORT_RESERVED - us->us_min_anonpriv_port;
8284 	} else {
8285 		loopmax = us->us_largest_anon_port -
8286 		    us->us_smallest_anon_port + 1;
8287 	}
8288 
8289 	is_inaddr_any = V6_OR_V4_INADDR_ANY(v6src);
8290 	zoneid = connp->conn_zoneid;
8291 
8292 	for (;;) {
8293 		udp_t		*udp1;
8294 		boolean_t	found_exclbind = B_FALSE;
8295 
8296 		/*
8297 		 * Walk through the list of udp streams bound to
8298 		 * requested port with the same IP address.
8299 		 */
8300 		lport = htons(port);
8301 		udpf = &us->us_bind_fanout[UDP_BIND_HASH(lport,
8302 		    us->us_bind_fanout_size)];
8303 		mutex_enter(&udpf->uf_lock);
8304 		for (udp1 = udpf->uf_udp; udp1 != NULL;
8305 		    udp1 = udp1->udp_bind_hash) {
8306 			if (lport != udp1->udp_port)
8307 				continue;
8308 
8309 			/*
8310 			 * On a labeled system, we must treat bindings to ports
8311 			 * on shared IP addresses by sockets with MAC exemption
8312 			 * privilege as being in all zones, as there's
8313 			 * otherwise no way to identify the right receiver.
8314 			 */
8315 			if (!(IPCL_ZONE_MATCH(udp1->udp_connp, zoneid) ||
8316 			    IPCL_ZONE_MATCH(connp,
8317 			    udp1->udp_connp->conn_zoneid)) &&
8318 			    !connp->conn_mac_exempt && \
8319 			    !udp1->udp_connp->conn_mac_exempt)
8320 				continue;
8321 
8322 			/*
8323 			 * If UDP_EXCLBIND is set for either the bound or
8324 			 * binding endpoint, the semantics of bind
8325 			 * is changed according to the following chart.
8326 			 *
8327 			 * spec = specified address (v4 or v6)
8328 			 * unspec = unspecified address (v4 or v6)
8329 			 * A = specified addresses are different for endpoints
8330 			 *
8331 			 * bound	bind to		allowed?
8332 			 * -------------------------------------
8333 			 * unspec	unspec		no
8334 			 * unspec	spec		no
8335 			 * spec		unspec		no
8336 			 * spec		spec		yes if A
8337 			 *
8338 			 * For labeled systems, SO_MAC_EXEMPT behaves the same
8339 			 * as UDP_EXCLBIND, except that zoneid is ignored.
8340 			 */
8341 			if (udp1->udp_exclbind || udp->udp_exclbind ||
8342 			    udp1->udp_connp->conn_mac_exempt ||
8343 			    connp->conn_mac_exempt) {
8344 				if (V6_OR_V4_INADDR_ANY(
8345 				    udp1->udp_bound_v6src) ||
8346 				    is_inaddr_any ||
8347 				    IN6_ARE_ADDR_EQUAL(&udp1->udp_bound_v6src,
8348 				    &v6src)) {
8349 					found_exclbind = B_TRUE;
8350 					break;
8351 				}
8352 				continue;
8353 			}
8354 
8355 			/*
8356 			 * Check ipversion to allow IPv4 and IPv6 sockets to
8357 			 * have disjoint port number spaces.
8358 			 */
8359 			if (udp->udp_ipversion != udp1->udp_ipversion) {
8360 
8361 				/*
8362 				 * On the first time through the loop, if the
8363 				 * the user intentionally specified a
8364 				 * particular port number, then ignore any
8365 				 * bindings of the other protocol that may
8366 				 * conflict. This allows the user to bind IPv6
8367 				 * alone and get both v4 and v6, or bind both
8368 				 * both and get each seperately. On subsequent
8369 				 * times through the loop, we're checking a
8370 				 * port that we chose (not the user) and thus
8371 				 * we do not allow casual duplicate bindings.
8372 				 */
8373 				if (count == 0 && requested_port != 0)
8374 					continue;
8375 			}
8376 
8377 			/*
8378 			 * No difference depending on SO_REUSEADDR.
8379 			 *
8380 			 * If existing port is bound to a
8381 			 * non-wildcard IP address and
8382 			 * the requesting stream is bound to
8383 			 * a distinct different IP addresses
8384 			 * (non-wildcard, also), keep going.
8385 			 */
8386 			if (!is_inaddr_any &&
8387 			    !V6_OR_V4_INADDR_ANY(udp1->udp_bound_v6src) &&
8388 			    !IN6_ARE_ADDR_EQUAL(&udp1->udp_bound_v6src,
8389 			    &v6src)) {
8390 				continue;
8391 			}
8392 			break;
8393 		}
8394 
8395 		if (!found_exclbind &&
8396 		    (udp->udp_reuseaddr && requested_port != 0)) {
8397 			break;
8398 		}
8399 
8400 		if (udp1 == NULL) {
8401 			/*
8402 			 * No other stream has this IP address
8403 			 * and port number. We can use it.
8404 			 */
8405 			break;
8406 		}
8407 		mutex_exit(&udpf->uf_lock);
8408 		if (bind_to_req_port_only) {
8409 			/*
8410 			 * We get here only when requested port
8411 			 * is bound (and only first  of the for()
8412 			 * loop iteration).
8413 			 *
8414 			 * The semantics of this bind request
8415 			 * require it to fail so we return from
8416 			 * the routine (and exit the loop).
8417 			 *
8418 			 */
8419 			udp->udp_pending_op = -1;
8420 			rw_exit(&udp->udp_rwlock);
8421 			return (-TADDRBUSY);
8422 		}
8423 
8424 		if (udp->udp_anon_priv_bind) {
8425 			port = udp_get_next_priv_port(udp);
8426 		} else {
8427 			if ((count == 0) && (requested_port != 0)) {
8428 				/*
8429 				 * If the application wants us to find
8430 				 * a port, get one to start with. Set
8431 				 * requested_port to 0, so that we will
8432 				 * update us->us_next_port_to_try below.
8433 				 */
8434 				port = udp_update_next_port(udp,
8435 				    us->us_next_port_to_try, B_TRUE);
8436 				requested_port = 0;
8437 			} else {
8438 				port = udp_update_next_port(udp, port + 1,
8439 				    B_FALSE);
8440 			}
8441 		}
8442 
8443 		if (port == 0 || ++count >= loopmax) {
8444 			/*
8445 			 * We've tried every possible port number and
8446 			 * there are none available, so send an error
8447 			 * to the user.
8448 			 */
8449 			udp->udp_pending_op = -1;
8450 			rw_exit(&udp->udp_rwlock);
8451 			return (-TNOADDR);
8452 		}
8453 	}
8454 
8455 	/*
8456 	 * Copy the source address into our udp structure.  This address
8457 	 * may still be zero; if so, ip will fill in the correct address
8458 	 * each time an outbound packet is passed to it.
8459 	 * If we are binding to a broadcast or multicast address then
8460 	 * udp_post_ip_bind_connect will clear the source address
8461 	 * when udp_do_bind success.
8462 	 */
8463 	udp->udp_v6src = udp->udp_bound_v6src = v6src;
8464 	udp->udp_port = lport;
8465 	/*
8466 	 * Now reset the the next anonymous port if the application requested
8467 	 * an anonymous port, or we handed out the next anonymous port.
8468 	 */
8469 	if ((requested_port == 0) && (!udp->udp_anon_priv_bind)) {
8470 		us->us_next_port_to_try = port + 1;
8471 	}
8472 
8473 	/* Initialize the O_T_BIND_REQ/T_BIND_REQ for ip. */
8474 	if (udp->udp_family == AF_INET) {
8475 		sin->sin_port = udp->udp_port;
8476 	} else {
8477 		sin6->sin6_port = udp->udp_port;
8478 		/* Rebuild the header template */
8479 		error = udp_build_hdrs(udp);
8480 		if (error != 0) {
8481 			udp->udp_pending_op = -1;
8482 			rw_exit(&udp->udp_rwlock);
8483 			mutex_exit(&udpf->uf_lock);
8484 			return (error);
8485 		}
8486 	}
8487 	udp->udp_state = TS_IDLE;
8488 	udp_bind_hash_insert(udpf, udp);
8489 	mutex_exit(&udpf->uf_lock);
8490 	rw_exit(&udp->udp_rwlock);
8491 
8492 	if (cl_inet_bind) {
8493 		/*
8494 		 * Running in cluster mode - register bind information
8495 		 */
8496 		if (udp->udp_ipversion == IPV4_VERSION) {
8497 			(*cl_inet_bind)(connp->conn_netstack->netstack_stackid,
8498 			    IPPROTO_UDP, AF_INET,
8499 			    (uint8_t *)(&V4_PART_OF_V6(udp->udp_v6src)),
8500 			    (in_port_t)udp->udp_port, NULL);
8501 		} else {
8502 			(*cl_inet_bind)(connp->conn_netstack->netstack_stackid,
8503 			    IPPROTO_UDP, AF_INET6,
8504 			    (uint8_t *)&(udp->udp_v6src),
8505 			    (in_port_t)udp->udp_port, NULL);
8506 		}
8507 	}
8508 
8509 	connp->conn_anon_port = (is_system_labeled() && requested_port == 0);
8510 	if (is_system_labeled() && (!connp->conn_anon_port ||
8511 	    connp->conn_anon_mlp)) {
8512 		uint16_t mlpport;
8513 		zone_t *zone;
8514 
8515 		zone = crgetzone(cr);
8516 		connp->conn_mlp_type = udp->udp_recvucred ? mlptBoth :
8517 		    mlptSingle;
8518 		addrtype = tsol_mlp_addr_type(zone->zone_id, IPV6_VERSION,
8519 		    &v6src, us->us_netstack->netstack_ip);
8520 		if (addrtype == mlptSingle) {
8521 			rw_enter(&udp->udp_rwlock, RW_WRITER);
8522 			udp->udp_pending_op = -1;
8523 			rw_exit(&udp->udp_rwlock);
8524 			connp->conn_anon_port = B_FALSE;
8525 			connp->conn_mlp_type = mlptSingle;
8526 			return (-TNOADDR);
8527 		}
8528 		mlpport = connp->conn_anon_port ? PMAPPORT : port;
8529 		mlptype = tsol_mlp_port_type(zone, IPPROTO_UDP, mlpport,
8530 		    addrtype);
8531 		if (mlptype != mlptSingle &&
8532 		    (connp->conn_mlp_type == mlptSingle ||
8533 		    secpolicy_net_bindmlp(cr) != 0)) {
8534 			if (udp->udp_debug) {
8535 				(void) strlog(UDP_MOD_ID, 0, 1,
8536 				    SL_ERROR|SL_TRACE,
8537 				    "udp_bind: no priv for multilevel port %d",
8538 				    mlpport);
8539 			}
8540 			rw_enter(&udp->udp_rwlock, RW_WRITER);
8541 			udp->udp_pending_op = -1;
8542 			rw_exit(&udp->udp_rwlock);
8543 			connp->conn_anon_port = B_FALSE;
8544 			connp->conn_mlp_type = mlptSingle;
8545 			return (-TACCES);
8546 		}
8547 
8548 		/*
8549 		 * If we're specifically binding a shared IP address and the
8550 		 * port is MLP on shared addresses, then check to see if this
8551 		 * zone actually owns the MLP.  Reject if not.
8552 		 */
8553 		if (mlptype == mlptShared && addrtype == mlptShared) {
8554 			/*
8555 			 * No need to handle exclusive-stack zones since
8556 			 * ALL_ZONES only applies to the shared stack.
8557 			 */
8558 			zoneid_t mlpzone;
8559 
8560 			mlpzone = tsol_mlp_findzone(IPPROTO_UDP,
8561 			    htons(mlpport));
8562 			if (connp->conn_zoneid != mlpzone) {
8563 				if (udp->udp_debug) {
8564 					(void) strlog(UDP_MOD_ID, 0, 1,
8565 					    SL_ERROR|SL_TRACE,
8566 					    "udp_bind: attempt to bind port "
8567 					    "%d on shared addr in zone %d "
8568 					    "(should be %d)",
8569 					    mlpport, connp->conn_zoneid,
8570 					    mlpzone);
8571 				}
8572 				rw_enter(&udp->udp_rwlock, RW_WRITER);
8573 				udp->udp_pending_op = -1;
8574 				rw_exit(&udp->udp_rwlock);
8575 				connp->conn_anon_port = B_FALSE;
8576 				connp->conn_mlp_type = mlptSingle;
8577 				return (-TACCES);
8578 			}
8579 		}
8580 		if (connp->conn_anon_port) {
8581 			error = tsol_mlp_anon(zone, mlptype, connp->conn_ulp,
8582 			    port, B_TRUE);
8583 			if (error != 0) {
8584 				if (udp->udp_debug) {
8585 					(void) strlog(UDP_MOD_ID, 0, 1,
8586 					    SL_ERROR|SL_TRACE,
8587 					    "udp_bind: cannot establish anon "
8588 					    "MLP for port %d", port);
8589 				}
8590 				rw_enter(&udp->udp_rwlock, RW_WRITER);
8591 				udp->udp_pending_op = -1;
8592 				rw_exit(&udp->udp_rwlock);
8593 				connp->conn_anon_port = B_FALSE;
8594 				connp->conn_mlp_type = mlptSingle;
8595 				return (-TACCES);
8596 			}
8597 		}
8598 		connp->conn_mlp_type = mlptype;
8599 	}
8600 
8601 	if (!V6_OR_V4_INADDR_ANY(udp->udp_v6src)) {
8602 		/*
8603 		 * Append a request for an IRE if udp_v6src not
8604 		 * zero (IPv4 - INADDR_ANY, or IPv6 - all-zeroes address).
8605 		 */
8606 		mp = allocb(sizeof (ire_t), BPRI_HI);
8607 		if (!mp) {
8608 			rw_enter(&udp->udp_rwlock, RW_WRITER);
8609 			udp->udp_pending_op = -1;
8610 			rw_exit(&udp->udp_rwlock);
8611 			return (ENOMEM);
8612 		}
8613 		mp->b_wptr += sizeof (ire_t);
8614 		mp->b_datap->db_type = IRE_DB_REQ_TYPE;
8615 	}
8616 	if (udp->udp_family == AF_INET6) {
8617 		ASSERT(udp->udp_connp->conn_af_isv6);
8618 		error = ip_proto_bind_laddr_v6(connp, &mp, IPPROTO_UDP,
8619 		    &udp->udp_bound_v6src, udp->udp_port, B_TRUE);
8620 	} else {
8621 		ASSERT(!udp->udp_connp->conn_af_isv6);
8622 		error = ip_proto_bind_laddr_v4(connp, &mp, IPPROTO_UDP,
8623 		    V4_PART_OF_V6(udp->udp_bound_v6src), udp->udp_port,
8624 		    B_TRUE);
8625 	}
8626 
8627 	(void) udp_post_ip_bind_connect(udp, mp, error);
8628 	return (error);
8629 }
8630 
8631 int
8632 udp_bind(sock_lower_handle_t proto_handle, struct sockaddr *sa,
8633     socklen_t len, cred_t *cr)
8634 {
8635 	int		error;
8636 	conn_t		*connp;
8637 
8638 	/* All Solaris components should pass a cred for this operation. */
8639 	ASSERT(cr != NULL);
8640 
8641 	connp = (conn_t *)proto_handle;
8642 
8643 	if (sa == NULL)
8644 		error = udp_do_unbind(connp);
8645 	else
8646 		error = udp_do_bind(connp, sa, len, cr, B_TRUE);
8647 
8648 	if (error < 0) {
8649 		if (error == -TOUTSTATE)
8650 			error = EINVAL;
8651 		else
8652 			error = proto_tlitosyserr(-error);
8653 	}
8654 
8655 	return (error);
8656 }
8657 
8658 static int
8659 udp_implicit_bind(conn_t *connp, cred_t *cr)
8660 {
8661 	int error;
8662 
8663 	/* All Solaris components should pass a cred for this operation. */
8664 	ASSERT(cr != NULL);
8665 
8666 	error = udp_do_bind(connp, NULL, 0, cr, B_FALSE);
8667 	return ((error < 0) ? proto_tlitosyserr(-error) : error);
8668 }
8669 
8670 /*
8671  * This routine removes a port number association from a stream. It
8672  * is called by udp_unbind and udp_tpi_unbind.
8673  */
8674 static int
8675 udp_do_unbind(conn_t *connp)
8676 {
8677 	udp_t 		*udp = connp->conn_udp;
8678 	udp_fanout_t	*udpf;
8679 	udp_stack_t	*us = udp->udp_us;
8680 
8681 	if (cl_inet_unbind != NULL) {
8682 		/*
8683 		 * Running in cluster mode - register unbind information
8684 		 */
8685 		if (udp->udp_ipversion == IPV4_VERSION) {
8686 			(*cl_inet_unbind)(
8687 			    connp->conn_netstack->netstack_stackid,
8688 			    IPPROTO_UDP, AF_INET,
8689 			    (uint8_t *)(&V4_PART_OF_V6(udp->udp_v6src)),
8690 			    (in_port_t)udp->udp_port, NULL);
8691 		} else {
8692 			(*cl_inet_unbind)(
8693 			    connp->conn_netstack->netstack_stackid,
8694 			    IPPROTO_UDP, AF_INET6,
8695 			    (uint8_t *)&(udp->udp_v6src),
8696 			    (in_port_t)udp->udp_port, NULL);
8697 		}
8698 	}
8699 
8700 	rw_enter(&udp->udp_rwlock, RW_WRITER);
8701 	if (udp->udp_state == TS_UNBND || udp->udp_pending_op != -1) {
8702 		rw_exit(&udp->udp_rwlock);
8703 		return (-TOUTSTATE);
8704 	}
8705 	udp->udp_pending_op = T_UNBIND_REQ;
8706 	rw_exit(&udp->udp_rwlock);
8707 
8708 	/*
8709 	 * Pass the unbind to IP; T_UNBIND_REQ is larger than T_OK_ACK
8710 	 * and therefore ip_unbind must never return NULL.
8711 	 */
8712 	ip_unbind(connp);
8713 
8714 	/*
8715 	 * Once we're unbound from IP, the pending operation may be cleared
8716 	 * here.
8717 	 */
8718 	rw_enter(&udp->udp_rwlock, RW_WRITER);
8719 	udpf = &us->us_bind_fanout[UDP_BIND_HASH(udp->udp_port,
8720 	    us->us_bind_fanout_size)];
8721 
8722 	mutex_enter(&udpf->uf_lock);
8723 	udp_bind_hash_remove(udp, B_TRUE);
8724 	V6_SET_ZERO(udp->udp_v6src);
8725 	V6_SET_ZERO(udp->udp_bound_v6src);
8726 	udp->udp_port = 0;
8727 	mutex_exit(&udpf->uf_lock);
8728 
8729 	udp->udp_pending_op = -1;
8730 	udp->udp_state = TS_UNBND;
8731 	if (udp->udp_family == AF_INET6)
8732 		(void) udp_build_hdrs(udp);
8733 	rw_exit(&udp->udp_rwlock);
8734 
8735 	return (0);
8736 }
8737 
8738 static int
8739 udp_post_ip_bind_connect(udp_t *udp, mblk_t *ire_mp, int error)
8740 {
8741 	ire_t		*ire;
8742 	udp_fanout_t	*udpf;
8743 	udp_stack_t	*us = udp->udp_us;
8744 
8745 	ASSERT(udp->udp_pending_op != -1);
8746 	rw_enter(&udp->udp_rwlock, RW_WRITER);
8747 	if (error == 0) {
8748 		/* For udp_do_connect() success */
8749 		/* udp_do_bind() success will do nothing in here */
8750 		/*
8751 		 * If a broadcast/multicast address was bound, set
8752 		 * the source address to 0.
8753 		 * This ensures no datagrams with broadcast address
8754 		 * as source address are emitted (which would violate
8755 		 * RFC1122 - Hosts requirements)
8756 		 *
8757 		 * Note that when connecting the returned IRE is
8758 		 * for the destination address and we only perform
8759 		 * the broadcast check for the source address (it
8760 		 * is OK to connect to a broadcast/multicast address.)
8761 		 */
8762 		if (ire_mp != NULL && ire_mp->b_datap->db_type == IRE_DB_TYPE) {
8763 			ire = (ire_t *)ire_mp->b_rptr;
8764 
8765 			/*
8766 			 * Note: we get IRE_BROADCAST for IPv6 to "mark" a
8767 			 * multicast local address.
8768 			 */
8769 			udpf = &us->us_bind_fanout[UDP_BIND_HASH(udp->udp_port,
8770 			    us->us_bind_fanout_size)];
8771 			if (ire->ire_type == IRE_BROADCAST &&
8772 			    udp->udp_state != TS_DATA_XFER) {
8773 				ASSERT(udp->udp_pending_op == T_BIND_REQ ||
8774 				    udp->udp_pending_op == O_T_BIND_REQ);
8775 				/*
8776 				 * This was just a local bind to a broadcast
8777 				 * addr.
8778 				 */
8779 				mutex_enter(&udpf->uf_lock);
8780 				V6_SET_ZERO(udp->udp_v6src);
8781 				mutex_exit(&udpf->uf_lock);
8782 				if (udp->udp_family == AF_INET6)
8783 					(void) udp_build_hdrs(udp);
8784 			} else if (V6_OR_V4_INADDR_ANY(udp->udp_v6src)) {
8785 				if (udp->udp_family == AF_INET6)
8786 					(void) udp_build_hdrs(udp);
8787 			}
8788 		}
8789 	} else {
8790 		udpf = &us->us_bind_fanout[UDP_BIND_HASH(udp->udp_port,
8791 		    us->us_bind_fanout_size)];
8792 		mutex_enter(&udpf->uf_lock);
8793 
8794 		if (udp->udp_state == TS_DATA_XFER) {
8795 			/* Connect failed */
8796 			/* Revert back to the bound source */
8797 			udp->udp_v6src = udp->udp_bound_v6src;
8798 			udp->udp_state = TS_IDLE;
8799 		} else {
8800 			/* For udp_do_bind() failed */
8801 			V6_SET_ZERO(udp->udp_v6src);
8802 			V6_SET_ZERO(udp->udp_bound_v6src);
8803 			udp->udp_state = TS_UNBND;
8804 			udp_bind_hash_remove(udp, B_TRUE);
8805 			udp->udp_port = 0;
8806 		}
8807 		mutex_exit(&udpf->uf_lock);
8808 		if (udp->udp_family == AF_INET6)
8809 			(void) udp_build_hdrs(udp);
8810 	}
8811 	udp->udp_pending_op = -1;
8812 	rw_exit(&udp->udp_rwlock);
8813 	if (ire_mp != NULL)
8814 		freeb(ire_mp);
8815 	return (error);
8816 }
8817 
8818 /*
8819  * It associates a default destination address with the stream.
8820  */
8821 static int
8822 udp_do_connect(conn_t *connp, const struct sockaddr *sa, socklen_t len,
8823     cred_t *cr)
8824 {
8825 	sin6_t		*sin6;
8826 	sin_t		*sin;
8827 	in6_addr_t 	v6dst;
8828 	ipaddr_t 	v4dst;
8829 	uint16_t 	dstport;
8830 	uint32_t 	flowinfo;
8831 	mblk_t		*ire_mp;
8832 	udp_fanout_t	*udpf;
8833 	udp_t		*udp, *udp1;
8834 	ushort_t	ipversion;
8835 	udp_stack_t	*us;
8836 	int		error;
8837 
8838 	udp = connp->conn_udp;
8839 	us = udp->udp_us;
8840 
8841 	/*
8842 	 * Address has been verified by the caller
8843 	 */
8844 	switch (len) {
8845 	default:
8846 		/*
8847 		 * Should never happen
8848 		 */
8849 		return (EINVAL);
8850 
8851 	case sizeof (sin_t):
8852 		sin = (sin_t *)sa;
8853 		v4dst = sin->sin_addr.s_addr;
8854 		dstport = sin->sin_port;
8855 		IN6_IPADDR_TO_V4MAPPED(v4dst, &v6dst);
8856 		ASSERT(udp->udp_ipversion == IPV4_VERSION);
8857 		ipversion = IPV4_VERSION;
8858 		break;
8859 
8860 	case sizeof (sin6_t):
8861 		sin6 = (sin6_t *)sa;
8862 		v6dst = sin6->sin6_addr;
8863 		dstport = sin6->sin6_port;
8864 		if (IN6_IS_ADDR_V4MAPPED(&v6dst)) {
8865 			IN6_V4MAPPED_TO_IPADDR(&v6dst, v4dst);
8866 			ipversion = IPV4_VERSION;
8867 			flowinfo = 0;
8868 		} else {
8869 			ipversion = IPV6_VERSION;
8870 			flowinfo = sin6->sin6_flowinfo;
8871 		}
8872 		break;
8873 	}
8874 
8875 	if (dstport == 0)
8876 		return (-TBADADDR);
8877 
8878 	rw_enter(&udp->udp_rwlock, RW_WRITER);
8879 
8880 	/*
8881 	 * This UDP must have bound to a port already before doing a connect.
8882 	 * TPI mandates that users must send TPI primitives only 1 at a time
8883 	 * and wait for the response before sending the next primitive.
8884 	 */
8885 	if (udp->udp_state == TS_UNBND || udp->udp_pending_op != -1) {
8886 		rw_exit(&udp->udp_rwlock);
8887 		(void) strlog(UDP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE,
8888 		    "udp_connect: bad state, %u", udp->udp_state);
8889 		return (-TOUTSTATE);
8890 	}
8891 	udp->udp_pending_op = T_CONN_REQ;
8892 	ASSERT(udp->udp_port != 0 && udp->udp_ptpbhn != NULL);
8893 
8894 	if (ipversion == IPV4_VERSION) {
8895 		udp->udp_max_hdr_len = IP_SIMPLE_HDR_LENGTH + UDPH_SIZE +
8896 		    udp->udp_ip_snd_options_len;
8897 	} else {
8898 		udp->udp_max_hdr_len = udp->udp_sticky_hdrs_len;
8899 	}
8900 
8901 	udpf = &us->us_bind_fanout[UDP_BIND_HASH(udp->udp_port,
8902 	    us->us_bind_fanout_size)];
8903 
8904 	mutex_enter(&udpf->uf_lock);
8905 	if (udp->udp_state == TS_DATA_XFER) {
8906 		/* Already connected - clear out state */
8907 		udp->udp_v6src = udp->udp_bound_v6src;
8908 		udp->udp_state = TS_IDLE;
8909 	}
8910 
8911 	/*
8912 	 * Create a default IP header with no IP options.
8913 	 */
8914 	udp->udp_dstport = dstport;
8915 	udp->udp_ipversion = ipversion;
8916 	if (ipversion == IPV4_VERSION) {
8917 		/*
8918 		 * Interpret a zero destination to mean loopback.
8919 		 * Update the T_CONN_REQ (sin/sin6) since it is used to
8920 		 * generate the T_CONN_CON.
8921 		 */
8922 		if (v4dst == INADDR_ANY) {
8923 			v4dst = htonl(INADDR_LOOPBACK);
8924 			IN6_IPADDR_TO_V4MAPPED(v4dst, &v6dst);
8925 			if (udp->udp_family == AF_INET) {
8926 				sin->sin_addr.s_addr = v4dst;
8927 			} else {
8928 				sin6->sin6_addr = v6dst;
8929 			}
8930 		}
8931 		udp->udp_v6dst = v6dst;
8932 		udp->udp_flowinfo = 0;
8933 
8934 		/*
8935 		 * If the destination address is multicast and
8936 		 * an outgoing multicast interface has been set,
8937 		 * use the address of that interface as our
8938 		 * source address if no source address has been set.
8939 		 */
8940 		if (V4_PART_OF_V6(udp->udp_v6src) == INADDR_ANY &&
8941 		    CLASSD(v4dst) &&
8942 		    udp->udp_multicast_if_addr != INADDR_ANY) {
8943 			IN6_IPADDR_TO_V4MAPPED(udp->udp_multicast_if_addr,
8944 			    &udp->udp_v6src);
8945 		}
8946 	} else {
8947 		ASSERT(udp->udp_ipversion == IPV6_VERSION);
8948 		/*
8949 		 * Interpret a zero destination to mean loopback.
8950 		 * Update the T_CONN_REQ (sin/sin6) since it is used to
8951 		 * generate the T_CONN_CON.
8952 		 */
8953 		if (IN6_IS_ADDR_UNSPECIFIED(&v6dst)) {
8954 			v6dst = ipv6_loopback;
8955 			sin6->sin6_addr = v6dst;
8956 		}
8957 		udp->udp_v6dst = v6dst;
8958 		udp->udp_flowinfo = flowinfo;
8959 		/*
8960 		 * If the destination address is multicast and
8961 		 * an outgoing multicast interface has been set,
8962 		 * then the ip bind logic will pick the correct source
8963 		 * address (i.e. matching the outgoing multicast interface).
8964 		 */
8965 	}
8966 
8967 	/*
8968 	 * Verify that the src/port/dst/port is unique for all
8969 	 * connections in TS_DATA_XFER
8970 	 */
8971 	for (udp1 = udpf->uf_udp; udp1 != NULL; udp1 = udp1->udp_bind_hash) {
8972 		if (udp1->udp_state != TS_DATA_XFER)
8973 			continue;
8974 		if (udp->udp_port != udp1->udp_port ||
8975 		    udp->udp_ipversion != udp1->udp_ipversion ||
8976 		    dstport != udp1->udp_dstport ||
8977 		    !IN6_ARE_ADDR_EQUAL(&udp->udp_v6src, &udp1->udp_v6src) ||
8978 		    !IN6_ARE_ADDR_EQUAL(&v6dst, &udp1->udp_v6dst) ||
8979 		    !(IPCL_ZONE_MATCH(udp->udp_connp,
8980 		    udp1->udp_connp->conn_zoneid) ||
8981 		    IPCL_ZONE_MATCH(udp1->udp_connp,
8982 		    udp->udp_connp->conn_zoneid)))
8983 			continue;
8984 		mutex_exit(&udpf->uf_lock);
8985 		udp->udp_pending_op = -1;
8986 		rw_exit(&udp->udp_rwlock);
8987 		return (-TBADADDR);
8988 	}
8989 
8990 	if (cl_inet_connect2 != NULL) {
8991 		CL_INET_UDP_CONNECT(connp, udp, B_TRUE, &v6dst, dstport, error);
8992 		if (error != 0) {
8993 			mutex_exit(&udpf->uf_lock);
8994 			udp->udp_pending_op = -1;
8995 			rw_exit(&udp->udp_rwlock);
8996 			return (-TBADADDR);
8997 		}
8998 	}
8999 
9000 	udp->udp_state = TS_DATA_XFER;
9001 	mutex_exit(&udpf->uf_lock);
9002 
9003 	ire_mp = allocb(sizeof (ire_t), BPRI_HI);
9004 	if (ire_mp == NULL) {
9005 		mutex_enter(&udpf->uf_lock);
9006 		udp->udp_state = TS_IDLE;
9007 		udp->udp_pending_op = -1;
9008 		mutex_exit(&udpf->uf_lock);
9009 		rw_exit(&udp->udp_rwlock);
9010 		return (ENOMEM);
9011 	}
9012 
9013 	rw_exit(&udp->udp_rwlock);
9014 
9015 	ire_mp->b_wptr += sizeof (ire_t);
9016 	ire_mp->b_datap->db_type = IRE_DB_REQ_TYPE;
9017 
9018 	if (udp->udp_family == AF_INET) {
9019 		error = ip_proto_bind_connected_v4(connp, &ire_mp, IPPROTO_UDP,
9020 		    &V4_PART_OF_V6(udp->udp_v6src), udp->udp_port,
9021 		    V4_PART_OF_V6(udp->udp_v6dst), udp->udp_dstport,
9022 		    B_TRUE, B_TRUE, cr);
9023 	} else {
9024 		error = ip_proto_bind_connected_v6(connp, &ire_mp, IPPROTO_UDP,
9025 		    &udp->udp_v6src, udp->udp_port, &udp->udp_v6dst,
9026 		    &udp->udp_sticky_ipp, udp->udp_dstport, B_TRUE, B_TRUE, cr);
9027 	}
9028 
9029 	return (udp_post_ip_bind_connect(udp, ire_mp, error));
9030 }
9031 
9032 /* ARGSUSED */
9033 static int
9034 udp_connect(sock_lower_handle_t proto_handle, const struct sockaddr *sa,
9035     socklen_t len, sock_connid_t *id, cred_t *cr)
9036 {
9037 	conn_t	*connp = (conn_t *)proto_handle;
9038 	udp_t	*udp = connp->conn_udp;
9039 	int	error;
9040 	boolean_t did_bind = B_FALSE;
9041 
9042 	/* All Solaris components should pass a cred for this operation. */
9043 	ASSERT(cr != NULL);
9044 
9045 	if (sa == NULL) {
9046 		/*
9047 		 * Disconnect
9048 		 * Make sure we are connected
9049 		 */
9050 		if (udp->udp_state != TS_DATA_XFER)
9051 			return (EINVAL);
9052 
9053 		error = udp_disconnect(connp);
9054 		return (error);
9055 	}
9056 
9057 	error = proto_verify_ip_addr(udp->udp_family, sa, len);
9058 	if (error != 0)
9059 		goto done;
9060 
9061 	/* do an implicit bind if necessary */
9062 	if (udp->udp_state == TS_UNBND) {
9063 		error = udp_implicit_bind(connp, cr);
9064 		/*
9065 		 * We could be racing with an actual bind, in which case
9066 		 * we would see EPROTO. We cross our fingers and try
9067 		 * to connect.
9068 		 */
9069 		if (!(error == 0 || error == EPROTO))
9070 			goto done;
9071 		did_bind = B_TRUE;
9072 	}
9073 	/*
9074 	 * set SO_DGRAM_ERRIND
9075 	 */
9076 	udp->udp_dgram_errind = B_TRUE;
9077 
9078 	error = udp_do_connect(connp, sa, len, cr);
9079 
9080 	if (error != 0 && did_bind) {
9081 		int unbind_err;
9082 
9083 		unbind_err = udp_do_unbind(connp);
9084 		ASSERT(unbind_err == 0);
9085 	}
9086 
9087 	if (error == 0) {
9088 		*id = 0;
9089 		(*connp->conn_upcalls->su_connected)
9090 		    (connp->conn_upper_handle, 0, NULL, -1);
9091 	} else if (error < 0) {
9092 		error = proto_tlitosyserr(-error);
9093 	}
9094 
9095 done:
9096 	if (error != 0 && udp->udp_state == TS_DATA_XFER) {
9097 		/*
9098 		 * No need to hold locks to set state
9099 		 * after connect failure socket state is undefined
9100 		 * We set the state only to imitate old sockfs behavior
9101 		 */
9102 		udp->udp_state = TS_IDLE;
9103 	}
9104 	return (error);
9105 }
9106 
9107 /* ARGSUSED */
9108 int
9109 udp_send(sock_lower_handle_t proto_handle, mblk_t *mp, struct nmsghdr *msg,
9110     cred_t *cr)
9111 {
9112 	conn_t		*connp = (conn_t *)proto_handle;
9113 	udp_t		*udp = connp->conn_udp;
9114 	udp_stack_t	*us = udp->udp_us;
9115 	int		error = 0;
9116 
9117 	ASSERT(DB_TYPE(mp) == M_DATA);
9118 
9119 	/* All Solaris components should pass a cred for this operation. */
9120 	ASSERT(cr != NULL);
9121 
9122 	/* If labeled then sockfs should have already set db_credp */
9123 	ASSERT(!is_system_labeled() || msg_getcred(mp, NULL) != NULL);
9124 
9125 	/*
9126 	 * If the socket is connected and no change in destination
9127 	 */
9128 	if (msg->msg_namelen == 0) {
9129 		error = udp_send_connected(connp, mp, msg, cr, curproc->p_pid);
9130 		if (error == EDESTADDRREQ)
9131 			return (error);
9132 		else
9133 			return (udp->udp_dgram_errind ? error : 0);
9134 	}
9135 
9136 	/*
9137 	 * Do an implicit bind if necessary.
9138 	 */
9139 	if (udp->udp_state == TS_UNBND) {
9140 		error = udp_implicit_bind(connp, cr);
9141 		/*
9142 		 * We could be racing with an actual bind, in which case
9143 		 * we would see EPROTO. We cross our fingers and try
9144 		 * to send.
9145 		 */
9146 		if (!(error == 0 || error == EPROTO)) {
9147 			freemsg(mp);
9148 			return (error);
9149 		}
9150 	}
9151 
9152 	rw_enter(&udp->udp_rwlock, RW_WRITER);
9153 
9154 	if (msg->msg_name != NULL && udp->udp_state == TS_DATA_XFER) {
9155 		rw_exit(&udp->udp_rwlock);
9156 		freemsg(mp);
9157 		return (EISCONN);
9158 	}
9159 
9160 
9161 	if (udp->udp_delayed_error != 0) {
9162 		boolean_t	match;
9163 
9164 		error = udp->udp_delayed_error;
9165 		match = B_FALSE;
9166 		udp->udp_delayed_error = 0;
9167 		switch (udp->udp_family) {
9168 		case AF_INET: {
9169 			/* Compare just IP address and port */
9170 			sin_t *sin1 = (sin_t *)msg->msg_name;
9171 			sin_t *sin2 = (sin_t *)&udp->udp_delayed_addr;
9172 
9173 			if (msg->msg_namelen == sizeof (sin_t) &&
9174 			    sin1->sin_port == sin2->sin_port &&
9175 			    sin1->sin_addr.s_addr == sin2->sin_addr.s_addr)
9176 				match = B_TRUE;
9177 
9178 			break;
9179 		}
9180 		case AF_INET6: {
9181 			sin6_t	*sin1 = (sin6_t *)msg->msg_name;
9182 			sin6_t	*sin2 = (sin6_t *)&udp->udp_delayed_addr;
9183 
9184 			if (msg->msg_namelen == sizeof (sin6_t) &&
9185 			    sin1->sin6_port == sin2->sin6_port &&
9186 			    IN6_ARE_ADDR_EQUAL(&sin1->sin6_addr,
9187 			    &sin2->sin6_addr))
9188 				match = B_TRUE;
9189 			break;
9190 		}
9191 		default:
9192 			ASSERT(0);
9193 		}
9194 
9195 		*((sin6_t *)&udp->udp_delayed_addr) = sin6_null;
9196 
9197 		if (match) {
9198 			rw_exit(&udp->udp_rwlock);
9199 			freemsg(mp);
9200 			return (error);
9201 		}
9202 	}
9203 
9204 	error = proto_verify_ip_addr(udp->udp_family,
9205 	    (struct sockaddr *)msg->msg_name, msg->msg_namelen);
9206 	rw_exit(&udp->udp_rwlock);
9207 
9208 	if (error != 0) {
9209 		freemsg(mp);
9210 		return (error);
9211 	}
9212 
9213 	error = udp_send_not_connected(connp, mp,
9214 	    (struct sockaddr  *)msg->msg_name, msg->msg_namelen, msg, cr,
9215 	    curproc->p_pid);
9216 	if (error != 0) {
9217 		UDP_STAT(us, udp_out_err_output);
9218 		freemsg(mp);
9219 	}
9220 	return (udp->udp_dgram_errind ? error : 0);
9221 }
9222 
9223 void
9224 udp_fallback(sock_lower_handle_t proto_handle, queue_t *q,
9225     boolean_t direct_sockfs, so_proto_quiesced_cb_t quiesced_cb)
9226 {
9227 	conn_t 	*connp = (conn_t *)proto_handle;
9228 	udp_t	*udp;
9229 	struct T_capability_ack tca;
9230 	struct sockaddr_in6 laddr, faddr;
9231 	socklen_t laddrlen, faddrlen;
9232 	short opts;
9233 	struct stroptions *stropt;
9234 	mblk_t *stropt_mp;
9235 	int error;
9236 
9237 	udp = connp->conn_udp;
9238 
9239 	stropt_mp = allocb_wait(sizeof (*stropt), BPRI_HI, STR_NOSIG, NULL);
9240 
9241 	/*
9242 	 * setup the fallback stream that was allocated
9243 	 */
9244 	connp->conn_dev = (dev_t)RD(q)->q_ptr;
9245 	connp->conn_minor_arena = WR(q)->q_ptr;
9246 
9247 	RD(q)->q_ptr = WR(q)->q_ptr = connp;
9248 
9249 	WR(q)->q_qinfo = &udp_winit;
9250 
9251 	connp->conn_rq = RD(q);
9252 	connp->conn_wq = WR(q);
9253 
9254 	/* Notify stream head about options before sending up data */
9255 	stropt_mp->b_datap->db_type = M_SETOPTS;
9256 	stropt_mp->b_wptr += sizeof (*stropt);
9257 	stropt = (struct stroptions *)stropt_mp->b_rptr;
9258 	stropt->so_flags = SO_WROFF | SO_HIWAT;
9259 	stropt->so_wroff =
9260 	    (ushort_t)(udp->udp_max_hdr_len + udp->udp_us->us_wroff_extra);
9261 	stropt->so_hiwat = udp->udp_rcv_disply_hiwat;
9262 	putnext(RD(q), stropt_mp);
9263 
9264 	/*
9265 	 * Free the helper stream
9266 	 */
9267 	ip_free_helper_stream(connp);
9268 
9269 	if (!direct_sockfs)
9270 		udp_disable_direct_sockfs(udp);
9271 
9272 	/*
9273 	 * Collect the information needed to sync with the sonode
9274 	 */
9275 	udp_do_capability_ack(udp, &tca, TC1_INFO);
9276 
9277 	laddrlen = faddrlen = sizeof (sin6_t);
9278 	(void) udp_getsockname((sock_lower_handle_t)connp,
9279 	    (struct sockaddr *)&laddr, &laddrlen, CRED());
9280 	error = udp_getpeername((sock_lower_handle_t)connp,
9281 	    (struct sockaddr *)&faddr, &faddrlen, CRED());
9282 	if (error != 0)
9283 		faddrlen = 0;
9284 
9285 	opts = 0;
9286 	if (udp->udp_dgram_errind)
9287 		opts |= SO_DGRAM_ERRIND;
9288 	if (udp->udp_dontroute)
9289 		opts |= SO_DONTROUTE;
9290 
9291 	/*
9292 	 * Once we grab the drain lock, no data will be send up
9293 	 * to the socket. So we notify the socket that the endpoint
9294 	 * is quiescent and it's therefore safe move data from
9295 	 * the socket to the stream head.
9296 	 */
9297 	(*quiesced_cb)(connp->conn_upper_handle, q, &tca,
9298 	    (struct sockaddr *)&laddr, laddrlen,
9299 	    (struct sockaddr *)&faddr, faddrlen, opts);
9300 
9301 	/*
9302 	 * push up any packets that were queued in udp_t
9303 	 */
9304 
9305 	mutex_enter(&udp->udp_recv_lock);
9306 	while (udp->udp_fallback_queue_head != NULL) {
9307 		mblk_t *mp;
9308 		mp = udp->udp_fallback_queue_head;
9309 		udp->udp_fallback_queue_head = mp->b_next;
9310 		mutex_exit(&udp->udp_recv_lock);
9311 		mp->b_next = NULL;
9312 		putnext(RD(q), mp);
9313 		mutex_enter(&udp->udp_recv_lock);
9314 	}
9315 	udp->udp_fallback_queue_tail = udp->udp_fallback_queue_head;
9316 	/*
9317 	 * No longer a streams less socket
9318 	 */
9319 	connp->conn_flags &= ~IPCL_NONSTR;
9320 	mutex_exit(&udp->udp_recv_lock);
9321 
9322 	ASSERT(connp->conn_ref >= 1);
9323 }
9324 
9325 static int
9326 udp_do_getpeername(udp_t *udp, struct sockaddr *sa, uint_t *salenp)
9327 {
9328 	sin_t	*sin = (sin_t *)sa;
9329 	sin6_t	*sin6 = (sin6_t *)sa;
9330 
9331 	ASSERT(RW_LOCK_HELD(&udp->udp_rwlock));
9332 	ASSERT(udp != NULL);
9333 
9334 	if (udp->udp_state != TS_DATA_XFER)
9335 		return (ENOTCONN);
9336 
9337 	switch (udp->udp_family) {
9338 	case AF_INET:
9339 		ASSERT(udp->udp_ipversion == IPV4_VERSION);
9340 
9341 		if (*salenp < sizeof (sin_t))
9342 			return (EINVAL);
9343 
9344 		*salenp = sizeof (sin_t);
9345 		*sin = sin_null;
9346 		sin->sin_family = AF_INET;
9347 		sin->sin_port = udp->udp_dstport;
9348 		sin->sin_addr.s_addr = V4_PART_OF_V6(udp->udp_v6dst);
9349 		break;
9350 	case AF_INET6:
9351 		if (*salenp < sizeof (sin6_t))
9352 			return (EINVAL);
9353 
9354 		*salenp = sizeof (sin6_t);
9355 		*sin6 = sin6_null;
9356 		sin6->sin6_family = AF_INET6;
9357 		sin6->sin6_port = udp->udp_dstport;
9358 		sin6->sin6_addr = udp->udp_v6dst;
9359 		sin6->sin6_flowinfo = udp->udp_flowinfo;
9360 		break;
9361 	}
9362 
9363 	return (0);
9364 }
9365 
9366 /* ARGSUSED */
9367 int
9368 udp_getpeername(sock_lower_handle_t  proto_handle, struct sockaddr *sa,
9369     socklen_t *salenp, cred_t *cr)
9370 {
9371 	conn_t	*connp = (conn_t *)proto_handle;
9372 	udp_t	*udp = connp->conn_udp;
9373 	int error;
9374 
9375 	/* All Solaris components should pass a cred for this operation. */
9376 	ASSERT(cr != NULL);
9377 
9378 	ASSERT(udp != NULL);
9379 
9380 	rw_enter(&udp->udp_rwlock, RW_READER);
9381 
9382 	error = udp_do_getpeername(udp, sa, salenp);
9383 
9384 	rw_exit(&udp->udp_rwlock);
9385 
9386 	return (error);
9387 }
9388 
9389 static int
9390 udp_do_getsockname(udp_t *udp, struct sockaddr *sa, uint_t *salenp)
9391 {
9392 	sin_t	*sin = (sin_t *)sa;
9393 	sin6_t	*sin6 = (sin6_t *)sa;
9394 
9395 	ASSERT(udp != NULL);
9396 	ASSERT(RW_LOCK_HELD(&udp->udp_rwlock));
9397 
9398 	switch (udp->udp_family) {
9399 	case AF_INET:
9400 		ASSERT(udp->udp_ipversion == IPV4_VERSION);
9401 
9402 		if (*salenp < sizeof (sin_t))
9403 			return (EINVAL);
9404 
9405 		*salenp = sizeof (sin_t);
9406 		*sin = sin_null;
9407 		sin->sin_family = AF_INET;
9408 		if (udp->udp_state == TS_UNBND) {
9409 			break;
9410 		}
9411 		sin->sin_port = udp->udp_port;
9412 
9413 		if (!IN6_IS_ADDR_V4MAPPED_ANY(&udp->udp_v6src) &&
9414 		    !IN6_IS_ADDR_UNSPECIFIED(&udp->udp_v6src)) {
9415 			sin->sin_addr.s_addr = V4_PART_OF_V6(udp->udp_v6src);
9416 		} else {
9417 			/*
9418 			 * INADDR_ANY
9419 			 * udp_v6src is not set, we might be bound to
9420 			 * broadcast/multicast. Use udp_bound_v6src as
9421 			 * local address instead (that could
9422 			 * also still be INADDR_ANY)
9423 			 */
9424 			sin->sin_addr.s_addr =
9425 			    V4_PART_OF_V6(udp->udp_bound_v6src);
9426 		}
9427 		break;
9428 
9429 	case AF_INET6:
9430 		if (*salenp < sizeof (sin6_t))
9431 			return (EINVAL);
9432 
9433 		*salenp = sizeof (sin6_t);
9434 		*sin6 = sin6_null;
9435 		sin6->sin6_family = AF_INET6;
9436 		if (udp->udp_state == TS_UNBND) {
9437 			break;
9438 		}
9439 		sin6->sin6_port = udp->udp_port;
9440 
9441 		if (!IN6_IS_ADDR_UNSPECIFIED(&udp->udp_v6src)) {
9442 			sin6->sin6_addr = udp->udp_v6src;
9443 		} else {
9444 			/*
9445 			 * UNSPECIFIED
9446 			 * udp_v6src is not set, we might be bound to
9447 			 * broadcast/multicast. Use udp_bound_v6src as
9448 			 * local address instead (that could
9449 			 * also still be UNSPECIFIED)
9450 			 */
9451 			sin6->sin6_addr = udp->udp_bound_v6src;
9452 		}
9453 	}
9454 	return (0);
9455 }
9456 
9457 /* ARGSUSED */
9458 int
9459 udp_getsockname(sock_lower_handle_t proto_handle, struct sockaddr *sa,
9460     socklen_t *salenp, cred_t *cr)
9461 {
9462 	conn_t	*connp = (conn_t *)proto_handle;
9463 	udp_t	*udp = connp->conn_udp;
9464 	int error;
9465 
9466 	/* All Solaris components should pass a cred for this operation. */
9467 	ASSERT(cr != NULL);
9468 
9469 	ASSERT(udp != NULL);
9470 	rw_enter(&udp->udp_rwlock, RW_READER);
9471 
9472 	error = udp_do_getsockname(udp, sa, salenp);
9473 
9474 	rw_exit(&udp->udp_rwlock);
9475 
9476 	return (error);
9477 }
9478 
9479 int
9480 udp_getsockopt(sock_lower_handle_t proto_handle, int level, int option_name,
9481     void *optvalp, socklen_t *optlen, cred_t *cr)
9482 {
9483 	conn_t		*connp = (conn_t *)proto_handle;
9484 	udp_t		*udp = connp->conn_udp;
9485 	int		error;
9486 	t_uscalar_t	max_optbuf_len;
9487 	void		*optvalp_buf;
9488 	int		len;
9489 
9490 	/* All Solaris components should pass a cred for this operation. */
9491 	ASSERT(cr != NULL);
9492 
9493 	error = proto_opt_check(level, option_name, *optlen, &max_optbuf_len,
9494 	    udp_opt_obj.odb_opt_des_arr,
9495 	    udp_opt_obj.odb_opt_arr_cnt,
9496 	    udp_opt_obj.odb_topmost_tpiprovider,
9497 	    B_FALSE, B_TRUE, cr);
9498 	if (error != 0) {
9499 		if (error < 0)
9500 			error = proto_tlitosyserr(-error);
9501 		return (error);
9502 	}
9503 
9504 	optvalp_buf = kmem_alloc(max_optbuf_len, KM_SLEEP);
9505 	rw_enter(&udp->udp_rwlock, RW_READER);
9506 	len = udp_opt_get(connp, level, option_name, optvalp_buf);
9507 	rw_exit(&udp->udp_rwlock);
9508 
9509 	if (len < 0) {
9510 		/*
9511 		 * Pass on to IP
9512 		 */
9513 		kmem_free(optvalp_buf, max_optbuf_len);
9514 		return (ip_get_options(connp, level, option_name,
9515 		    optvalp, optlen, cr));
9516 	} else {
9517 		/*
9518 		 * update optlen and copy option value
9519 		 */
9520 		t_uscalar_t size = MIN(len, *optlen);
9521 		bcopy(optvalp_buf, optvalp, size);
9522 		bcopy(&size, optlen, sizeof (size));
9523 
9524 		kmem_free(optvalp_buf, max_optbuf_len);
9525 		return (0);
9526 	}
9527 }
9528 
9529 int
9530 udp_setsockopt(sock_lower_handle_t proto_handle, int level, int option_name,
9531     const void *optvalp, socklen_t optlen, cred_t *cr)
9532 {
9533 	conn_t		*connp = (conn_t *)proto_handle;
9534 	udp_t		*udp = connp->conn_udp;
9535 	int		error;
9536 
9537 	/* All Solaris components should pass a cred for this operation. */
9538 	ASSERT(cr != NULL);
9539 
9540 	error = proto_opt_check(level, option_name, optlen, NULL,
9541 	    udp_opt_obj.odb_opt_des_arr,
9542 	    udp_opt_obj.odb_opt_arr_cnt,
9543 	    udp_opt_obj.odb_topmost_tpiprovider,
9544 	    B_TRUE, B_FALSE, cr);
9545 
9546 	if (error != 0) {
9547 		if (error < 0)
9548 			error = proto_tlitosyserr(-error);
9549 		return (error);
9550 	}
9551 
9552 	rw_enter(&udp->udp_rwlock, RW_WRITER);
9553 	error = udp_opt_set(connp, SETFN_OPTCOM_NEGOTIATE, level, option_name,
9554 	    optlen, (uchar_t *)optvalp, (uint_t *)&optlen, (uchar_t *)optvalp,
9555 	    NULL, cr);
9556 	rw_exit(&udp->udp_rwlock);
9557 
9558 	if (error < 0) {
9559 		/*
9560 		 * Pass on to ip
9561 		 */
9562 		error = ip_set_options(connp, level, option_name, optvalp,
9563 		    optlen, cr);
9564 	}
9565 
9566 	return (error);
9567 }
9568 
9569 void
9570 udp_clr_flowctrl(sock_lower_handle_t proto_handle)
9571 {
9572 	conn_t	*connp = (conn_t *)proto_handle;
9573 	udp_t	*udp = connp->conn_udp;
9574 
9575 	mutex_enter(&udp->udp_recv_lock);
9576 	connp->conn_flow_cntrld = B_FALSE;
9577 	mutex_exit(&udp->udp_recv_lock);
9578 }
9579 
9580 /* ARGSUSED */
9581 int
9582 udp_shutdown(sock_lower_handle_t proto_handle, int how, cred_t *cr)
9583 {
9584 	conn_t	*connp = (conn_t *)proto_handle;
9585 
9586 	/* All Solaris components should pass a cred for this operation. */
9587 	ASSERT(cr != NULL);
9588 
9589 	/* shut down the send side */
9590 	if (how != SHUT_RD)
9591 		(*connp->conn_upcalls->su_opctl)(connp->conn_upper_handle,
9592 		    SOCK_OPCTL_SHUT_SEND, 0);
9593 	/* shut down the recv side */
9594 	if (how != SHUT_WR)
9595 		(*connp->conn_upcalls->su_opctl)(connp->conn_upper_handle,
9596 		    SOCK_OPCTL_SHUT_RECV, 0);
9597 	return (0);
9598 }
9599 
9600 int
9601 udp_ioctl(sock_lower_handle_t proto_handle, int cmd, intptr_t arg,
9602     int mode, int32_t *rvalp, cred_t *cr)
9603 {
9604 	conn_t  	*connp = (conn_t *)proto_handle;
9605 	int		error;
9606 
9607 	/* All Solaris components should pass a cred for this operation. */
9608 	ASSERT(cr != NULL);
9609 
9610 	switch (cmd) {
9611 		case ND_SET:
9612 		case ND_GET:
9613 		case _SIOCSOCKFALLBACK:
9614 		case TI_GETPEERNAME:
9615 		case TI_GETMYNAME:
9616 			ip1dbg(("udp_ioctl: cmd 0x%x on non streams socket",
9617 			    cmd));
9618 			error = EINVAL;
9619 			break;
9620 		default:
9621 			/*
9622 			 * Pass on to IP using helper stream
9623 			 */
9624 			error = ldi_ioctl(connp->conn_helper_info->iphs_handle,
9625 			    cmd, arg, mode, cr, rvalp);
9626 			break;
9627 	}
9628 	return (error);
9629 }
9630 
9631 /* ARGSUSED */
9632 int
9633 udp_accept(sock_lower_handle_t lproto_handle,
9634     sock_lower_handle_t eproto_handle, sock_upper_handle_t sock_handle,
9635     cred_t *cr)
9636 {
9637 	return (EOPNOTSUPP);
9638 }
9639 
9640 /* ARGSUSED */
9641 int
9642 udp_listen(sock_lower_handle_t proto_handle, int backlog, cred_t *cr)
9643 {
9644 	return (EOPNOTSUPP);
9645 }
9646 
9647 sock_downcalls_t sock_udp_downcalls = {
9648 	udp_activate,		/* sd_activate */
9649 	udp_accept,		/* sd_accept */
9650 	udp_bind,		/* sd_bind */
9651 	udp_listen,		/* sd_listen */
9652 	udp_connect,		/* sd_connect */
9653 	udp_getpeername,	/* sd_getpeername */
9654 	udp_getsockname,	/* sd_getsockname */
9655 	udp_getsockopt,		/* sd_getsockopt */
9656 	udp_setsockopt,		/* sd_setsockopt */
9657 	udp_send,		/* sd_send */
9658 	NULL,			/* sd_send_uio */
9659 	NULL,			/* sd_recv_uio */
9660 	NULL,			/* sd_poll */
9661 	udp_shutdown,		/* sd_shutdown */
9662 	udp_clr_flowctrl,	/* sd_setflowctrl */
9663 	udp_ioctl,		/* sd_ioctl */
9664 	udp_close		/* sd_close */
9665 };
9666