xref: /titanic_50/usr/src/uts/common/inet/udp/udp.c (revision adecd3c68045d04dc367d30faf2eb5cac1f45d5a)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 /* Copyright (c) 1990 Mentat Inc. */
26 
27 #pragma ident	"%Z%%M%	%I%	%E% SMI"
28 
29 const char udp_version[] = "%Z%%M%	%I%	%E% SMI";
30 
31 #include <sys/types.h>
32 #include <sys/stream.h>
33 #include <sys/dlpi.h>
34 #include <sys/pattr.h>
35 #include <sys/stropts.h>
36 #include <sys/strlog.h>
37 #include <sys/strsun.h>
38 #include <sys/time.h>
39 #define	_SUN_TPI_VERSION 2
40 #include <sys/tihdr.h>
41 #include <sys/timod.h>
42 #include <sys/ddi.h>
43 #include <sys/sunddi.h>
44 #include <sys/strsubr.h>
45 #include <sys/suntpi.h>
46 #include <sys/xti_inet.h>
47 #include <sys/cmn_err.h>
48 #include <sys/kmem.h>
49 #include <sys/policy.h>
50 #include <sys/ucred.h>
51 #include <sys/zone.h>
52 
53 #include <sys/socket.h>
54 #include <sys/sockio.h>
55 #include <sys/vtrace.h>
56 #include <sys/sdt.h>
57 #include <sys/debug.h>
58 #include <sys/isa_defs.h>
59 #include <sys/random.h>
60 #include <netinet/in.h>
61 #include <netinet/ip6.h>
62 #include <netinet/icmp6.h>
63 #include <netinet/udp.h>
64 #include <net/if.h>
65 #include <net/route.h>
66 
67 #include <inet/common.h>
68 #include <inet/ip.h>
69 #include <inet/ip_impl.h>
70 #include <inet/ip6.h>
71 #include <inet/ip_ire.h>
72 #include <inet/ip_if.h>
73 #include <inet/ip_multi.h>
74 #include <inet/ip_ndp.h>
75 #include <inet/mi.h>
76 #include <inet/mib2.h>
77 #include <inet/nd.h>
78 #include <inet/optcom.h>
79 #include <inet/snmpcom.h>
80 #include <inet/kstatcom.h>
81 #include <inet/udp_impl.h>
82 #include <inet/ipclassifier.h>
83 #include <inet/ipsec_impl.h>
84 #include <inet/ipp_common.h>
85 
86 /*
87  * The ipsec_info.h header file is here since it has the definition for the
88  * M_CTL message types used by IP to convey information to the ULP. The
89  * ipsec_info.h needs the pfkeyv2.h, hence the latter's presence.
90  */
91 #include <net/pfkeyv2.h>
92 #include <inet/ipsec_info.h>
93 
94 #include <sys/tsol/label.h>
95 #include <sys/tsol/tnet.h>
96 #include <rpc/pmap_prot.h>
97 
98 /*
99  * Synchronization notes:
100  *
101  * UDP uses a combination of its internal perimeter, a global lock and
102  * a set of bind hash locks to protect its data structures.  Please see
103  * the note above udp_mode_assertions for details about the internal
104  * perimeter.
105  *
106  * When a UDP endpoint is bound to a local port, it is inserted into
107  * a bind hash list.  The list consists of an array of udp_fanout_t buckets.
108  * The size of the array is controlled by the udp_bind_fanout_size variable.
109  * This variable can be changed in /etc/system if the default value is
110  * not large enough.  Each bind hash bucket is protected by a per bucket
111  * lock.  It protects the udp_bind_hash and udp_ptpbhn fields in the udp_t
112  * structure.  An UDP endpoint is removed from the bind hash list only
113  * when it is being unbound or being closed.  The per bucket lock also
114  * protects a UDP endpoint's state changes.
115  *
116  * Plumbing notes:
117  *
118  * Both udp and ip are merged, but the streams plumbing is kept unchanged
119  * in that udp is always pushed atop /dev/ip.  This is done to preserve
120  * backwards compatibility for certain applications which rely on such
121  * plumbing geometry to do things such as issuing I_POP on the stream
122  * in order to obtain direct access to /dev/ip, etc.
123  *
124  * All UDP processings happen in the /dev/ip instance; the udp module
125  * instance does not possess any state about the endpoint, and merely
126  * acts as a dummy module whose presence is to keep the streams plumbing
127  * appearance unchanged.  At open time /dev/ip allocates a conn_t that
128  * happens to embed a udp_t.  This stays dormant until the time udp is
129  * pushed, which indicates to /dev/ip that it must convert itself from
130  * an IP to a UDP endpoint.
131  *
132  * We only allow for the following plumbing cases:
133  *
134  * Normal:
135  *	/dev/ip is first opened and later udp is pushed directly on top.
136  *	This is the default action that happens when a udp socket or
137  *	/dev/udp is opened.  The conn_t created by /dev/ip instance is
138  *	now shared and is marked with IPCL_UDP.
139  *
140  * SNMP-only:
141  *	udp is pushed on top of a module other than /dev/ip.  When this
142  *	happens it will support only SNMP semantics.  A new conn_t is
143  *	allocated and marked with IPCL_UDPMOD.
144  *
145  * The above cases imply that we don't support any intermediate module to
146  * reside in between /dev/ip and udp -- in fact, we never supported such
147  * scenario in the past as the inter-layer communication semantics have
148  * always been private.  Also note that the normal case allows for SNMP
149  * requests to be processed in addition to the rest of UDP operations.
150  *
151  * The normal case plumbing is depicted by the following diagram:
152  *
153  *	+---------------+---------------+
154  *	|		|		| udp
155  *	|     udp_wq	|    udp_rq	|
156  *	|		|    UDP_RD	|
157  *	|		|		|
158  *	+---------------+---------------+
159  *		|		^
160  *		v		|
161  *	+---------------+---------------+
162  *	|		|		| /dev/ip
163  *	|     ip_wq	|     ip_rq	| conn_t
164  *	|     UDP_WR	|		|
165  *	|		|		|
166  *	+---------------+---------------+
167  *
168  * Messages arriving at udp_wq from above will end up in ip_wq before
169  * it gets processed, i.e. udp write entry points will advance udp_wq
170  * and use its q_next value as ip_wq in order to use the conn_t that
171  * is stored in its q_ptr.  Likewise, messages generated by ip to the
172  * module above udp will appear as if they are originated from udp_rq,
173  * i.e. putnext() calls to the module above udp is done using the
174  * udp_rq instead of ip_rq in order to avoid udp_rput() which does
175  * nothing more than calling putnext().
176  *
177  * The above implies the following rule of thumb:
178  *
179  *   1. udp_t is obtained from conn_t, which is created by the /dev/ip
180  *	instance and is stored in q_ptr of both ip_wq and ip_rq.  There
181  *	is no direct reference to conn_t from either udp_wq or udp_rq.
182  *
183  *   2. Write-side entry points of udp can obtain the conn_t via the
184  *	Q_TO_CONN() macro, using the queue value obtain from UDP_WR().
185  *
186  *   3. While in /dev/ip context, putnext() to the module above udp can
187  *	be done by supplying the queue value obtained from UDP_RD().
188  *
189  */
190 
191 static queue_t *UDP_WR(queue_t *);
192 static queue_t *UDP_RD(queue_t *);
193 
194 udp_stat_t udp_statistics = {
195 	{ "udp_ip_send",		KSTAT_DATA_UINT64 },
196 	{ "udp_ip_ire_send",		KSTAT_DATA_UINT64 },
197 	{ "udp_ire_null",		KSTAT_DATA_UINT64 },
198 	{ "udp_drain",			KSTAT_DATA_UINT64 },
199 	{ "udp_sock_fallback",		KSTAT_DATA_UINT64 },
200 	{ "udp_rrw_busy",		KSTAT_DATA_UINT64 },
201 	{ "udp_rrw_msgcnt",		KSTAT_DATA_UINT64 },
202 	{ "udp_out_sw_cksum",		KSTAT_DATA_UINT64 },
203 	{ "udp_out_sw_cksum_bytes",	KSTAT_DATA_UINT64 },
204 	{ "udp_out_opt",		KSTAT_DATA_UINT64 },
205 	{ "udp_out_err_notconn",	KSTAT_DATA_UINT64 },
206 	{ "udp_out_err_output",		KSTAT_DATA_UINT64 },
207 	{ "udp_out_err_tudr",		KSTAT_DATA_UINT64 },
208 	{ "udp_in_pktinfo",		KSTAT_DATA_UINT64 },
209 	{ "udp_in_recvdstaddr",		KSTAT_DATA_UINT64 },
210 	{ "udp_in_recvopts",		KSTAT_DATA_UINT64 },
211 	{ "udp_in_recvif",		KSTAT_DATA_UINT64 },
212 	{ "udp_in_recvslla",		KSTAT_DATA_UINT64 },
213 	{ "udp_in_recvucred",		KSTAT_DATA_UINT64 },
214 	{ "udp_in_recvttl",		KSTAT_DATA_UINT64 },
215 	{ "udp_in_recvhopopts",		KSTAT_DATA_UINT64 },
216 	{ "udp_in_recvhoplimit",	KSTAT_DATA_UINT64 },
217 	{ "udp_in_recvdstopts",		KSTAT_DATA_UINT64 },
218 	{ "udp_in_recvrtdstopts",	KSTAT_DATA_UINT64 },
219 	{ "udp_in_recvrthdr",		KSTAT_DATA_UINT64 },
220 	{ "udp_in_recvpktinfo",		KSTAT_DATA_UINT64 },
221 	{ "udp_in_recvtclass",		KSTAT_DATA_UINT64 },
222 	{ "udp_in_timestamp",		KSTAT_DATA_UINT64 },
223 #ifdef DEBUG
224 	{ "udp_data_conn",		KSTAT_DATA_UINT64 },
225 	{ "udp_data_notconn",		KSTAT_DATA_UINT64 },
226 #endif
227 };
228 
229 static kstat_t *udp_ksp;
230 struct kmem_cache *udp_cache;
231 
232 /*
233  * Bind hash list size and hash function.  It has to be a power of 2 for
234  * hashing.
235  */
236 #define	UDP_BIND_FANOUT_SIZE	512
237 #define	UDP_BIND_HASH(lport) \
238 	((ntohs((uint16_t)lport)) & (udp_bind_fanout_size - 1))
239 
240 /* UDP bind fanout hash structure. */
241 typedef struct udp_fanout_s {
242 	udp_t *uf_udp;
243 	kmutex_t uf_lock;
244 #if defined(_LP64) || defined(_I32LPx)
245 	char	uf_pad[48];
246 #else
247 	char	uf_pad[56];
248 #endif
249 } udp_fanout_t;
250 
251 uint_t udp_bind_fanout_size = UDP_BIND_FANOUT_SIZE;
252 /* udp_fanout_t *udp_bind_fanout. */
253 static udp_fanout_t *udp_bind_fanout;
254 
255 /*
256  * This controls the rate some ndd info report functions can be used
257  * by non-privileged users.  It stores the last time such info is
258  * requested.  When those report functions are called again, this
259  * is checked with the current time and compare with the ndd param
260  * udp_ndd_get_info_interval.
261  */
262 static clock_t udp_last_ndd_get_info_time;
263 #define	NDD_TOO_QUICK_MSG \
264 	"ndd get info rate too high for non-privileged users, try again " \
265 	"later.\n"
266 #define	NDD_OUT_OF_BUF_MSG	"<< Out of buffer >>\n"
267 
268 /* Option processing attrs */
269 typedef struct udpattrs_s {
270 	ip6_pkt_t	*udpattr_ipp;
271 	mblk_t		*udpattr_mb;
272 	boolean_t	udpattr_credset;
273 } udpattrs_t;
274 
275 static void	udp_addr_req(queue_t *q, mblk_t *mp);
276 static void	udp_bind(queue_t *q, mblk_t *mp);
277 static void	udp_bind_hash_insert(udp_fanout_t *uf, udp_t *udp);
278 static void	udp_bind_hash_remove(udp_t *udp, boolean_t caller_holds_lock);
279 static int	udp_build_hdrs(queue_t *q, udp_t *udp);
280 static void	udp_capability_req(queue_t *q, mblk_t *mp);
281 static int	udp_close(queue_t *q);
282 static void	udp_connect(queue_t *q, mblk_t *mp);
283 static void	udp_disconnect(queue_t *q, mblk_t *mp);
284 static void	udp_err_ack(queue_t *q, mblk_t *mp, t_scalar_t t_error,
285 		    int sys_error);
286 static void	udp_err_ack_prim(queue_t *q, mblk_t *mp, int primitive,
287 		    t_scalar_t tlierr, int unixerr);
288 static int	udp_extra_priv_ports_get(queue_t *q, mblk_t *mp, caddr_t cp,
289 		    cred_t *cr);
290 static int	udp_extra_priv_ports_add(queue_t *q, mblk_t *mp,
291 		    char *value, caddr_t cp, cred_t *cr);
292 static int	udp_extra_priv_ports_del(queue_t *q, mblk_t *mp,
293 		    char *value, caddr_t cp, cred_t *cr);
294 static void	udp_icmp_error(queue_t *q, mblk_t *mp);
295 static void	udp_icmp_error_ipv6(queue_t *q, mblk_t *mp);
296 static void	udp_info_req(queue_t *q, mblk_t *mp);
297 static mblk_t	*udp_ip_bind_mp(udp_t *udp, t_scalar_t bind_prim,
298 		    t_scalar_t addr_length);
299 static int	udp_open(queue_t *q, dev_t *devp, int flag, int sflag,
300 		    cred_t *credp);
301 static  int	udp_unitdata_opt_process(queue_t *q, mblk_t *mp,
302 		    int *errorp, udpattrs_t *udpattrs);
303 static boolean_t udp_opt_allow_udr_set(t_scalar_t level, t_scalar_t name);
304 static int	udp_param_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr);
305 static boolean_t udp_param_register(udpparam_t *udppa, int cnt);
306 static int	udp_param_set(queue_t *q, mblk_t *mp, char *value, caddr_t cp,
307 		    cred_t *cr);
308 static void	udp_report_item(mblk_t *mp, udp_t *udp);
309 static void	udp_rput(queue_t *q, mblk_t *mp);
310 static void	udp_rput_other(queue_t *, mblk_t *);
311 static int	udp_rinfop(queue_t *q, infod_t *dp);
312 static int	udp_rrw(queue_t *q, struiod_t *dp);
313 static	void	udp_rput_bind_ack(queue_t *q, mblk_t *mp);
314 static int	udp_status_report(queue_t *q, mblk_t *mp, caddr_t cp,
315 		    cred_t *cr);
316 static void	udp_send_data(udp_t *udp, queue_t *q, mblk_t *mp, ipha_t *ipha);
317 static void	udp_ud_err(queue_t *q, mblk_t *mp, uchar_t *destaddr,
318 		    t_scalar_t destlen, t_scalar_t err);
319 static void	udp_unbind(queue_t *q, mblk_t *mp);
320 static in_port_t udp_update_next_port(udp_t *udp, in_port_t port,
321     boolean_t random);
322 static void	udp_wput(queue_t *q, mblk_t *mp);
323 static mblk_t	*udp_output_v4(conn_t *, mblk_t *mp, ipaddr_t v4dst,
324 		    uint16_t port, uint_t srcid, int *error);
325 static mblk_t	*udp_output_v6(conn_t *connp, mblk_t *mp, sin6_t *sin6,
326 		    int *error);
327 static void	udp_wput_other(queue_t *q, mblk_t *mp);
328 static void	udp_wput_iocdata(queue_t *q, mblk_t *mp);
329 static void	udp_output(conn_t *connp, mblk_t *mp, struct sockaddr *addr,
330 		    socklen_t addrlen);
331 static size_t	udp_set_rcv_hiwat(udp_t *udp, size_t size);
332 
333 static void	udp_kstat_init(void);
334 static void	udp_kstat_fini(void);
335 static int	udp_kstat_update(kstat_t *kp, int rw);
336 static void	udp_input_wrapper(void *arg, mblk_t *mp, void *arg2);
337 static void	udp_rput_other_wrapper(void *arg, mblk_t *mp, void *arg2);
338 static void	udp_wput_other_wrapper(void *arg, mblk_t *mp, void *arg2);
339 static void	udp_resume_bind_cb(void *arg, mblk_t *mp, void *arg2);
340 
341 static void	udp_rcv_enqueue(queue_t *q, udp_t *udp, mblk_t *mp,
342 		    uint_t pkt_len);
343 static void	udp_rcv_drain(queue_t *q, udp_t *udp, boolean_t closing);
344 static void	udp_enter(conn_t *, mblk_t *, sqproc_t, uint8_t);
345 static void	udp_exit(conn_t *);
346 static void	udp_become_writer(conn_t *, mblk_t *, sqproc_t, uint8_t);
347 #ifdef DEBUG
348 static void	udp_mode_assertions(udp_t *, int);
349 #endif /* DEBUG */
350 
351 major_t UDP6_MAJ;
352 #define	UDP6 "udp6"
353 
354 #define	UDP_RECV_HIWATER	(56 * 1024)
355 #define	UDP_RECV_LOWATER	128
356 #define	UDP_XMIT_HIWATER	(56 * 1024)
357 #define	UDP_XMIT_LOWATER	1024
358 
359 static struct module_info udp_info =  {
360 	UDP_MOD_ID, UDP_MOD_NAME, 1, INFPSZ, UDP_RECV_HIWATER, UDP_RECV_LOWATER
361 };
362 
363 static struct qinit udp_rinit = {
364 	(pfi_t)udp_rput, NULL, udp_open, udp_close, NULL,
365 	&udp_info, NULL, udp_rrw, udp_rinfop, STRUIOT_STANDARD
366 };
367 
368 static struct qinit udp_winit = {
369 	(pfi_t)udp_wput, NULL, NULL, NULL, NULL,
370 	&udp_info, NULL, NULL, NULL, STRUIOT_NONE
371 };
372 
373 static struct qinit winit = {
374 	(pfi_t)putnext, NULL, NULL, NULL, NULL,
375 	&udp_info, NULL, NULL, NULL, STRUIOT_NONE
376 };
377 
378 /* Support for just SNMP if UDP is not pushed directly over device IP */
379 struct qinit udp_snmp_rinit = {
380 	(pfi_t)putnext, NULL, udp_open, ip_snmpmod_close, NULL,
381 	&udp_info, NULL, NULL, NULL, STRUIOT_NONE
382 };
383 
384 struct qinit udp_snmp_winit = {
385 	(pfi_t)ip_snmpmod_wput, NULL, udp_open, ip_snmpmod_close, NULL,
386 	&udp_info, NULL, NULL, NULL, STRUIOT_NONE
387 };
388 
389 struct streamtab udpinfo = {
390 	&udp_rinit, &winit
391 };
392 
393 static	sin_t	sin_null;	/* Zero address for quick clears */
394 static	sin6_t	sin6_null;	/* Zero address for quick clears */
395 
396 /* Hint not protected by any lock */
397 static in_port_t	udp_g_next_port_to_try;
398 
399 /*
400  * Extra privileged ports. In host byte order.
401  */
402 #define	UDP_NUM_EPRIV_PORTS	64
403 static int	udp_g_num_epriv_ports = UDP_NUM_EPRIV_PORTS;
404 static in_port_t udp_g_epriv_ports[UDP_NUM_EPRIV_PORTS] = { 2049, 4045 };
405 
406 /* Only modified during _init and _fini thus no locking is needed. */
407 static IDP	udp_g_nd;	/* Points to table of UDP ND variables. */
408 
409 /* MIB-2 stuff for SNMP */
410 static mib2_udp_t	udp_mib;	/* SNMP fixed size info */
411 static kstat_t		*udp_mibkp;	/* kstat exporting udp_mib data */
412 
413 #define	UDP_MAXPACKET_IPV4 (IP_MAXPACKET - UDPH_SIZE - IP_SIMPLE_HDR_LENGTH)
414 
415 /* Default structure copied into T_INFO_ACK messages */
416 static struct T_info_ack udp_g_t_info_ack_ipv4 = {
417 	T_INFO_ACK,
418 	UDP_MAXPACKET_IPV4,	/* TSDU_size. Excl. headers */
419 	T_INVALID,	/* ETSU_size.  udp does not support expedited data. */
420 	T_INVALID,	/* CDATA_size. udp does not support connect data. */
421 	T_INVALID,	/* DDATA_size. udp does not support disconnect data. */
422 	sizeof (sin_t),	/* ADDR_size. */
423 	0,		/* OPT_size - not initialized here */
424 	UDP_MAXPACKET_IPV4,	/* TIDU_size.  Excl. headers */
425 	T_CLTS,		/* SERV_type.  udp supports connection-less. */
426 	TS_UNBND,	/* CURRENT_state.  This is set from udp_state. */
427 	(XPG4_1|SENDZERO) /* PROVIDER_flag */
428 };
429 
430 #define	UDP_MAXPACKET_IPV6 (IP_MAXPACKET - UDPH_SIZE - IPV6_HDR_LEN)
431 
432 static	struct T_info_ack udp_g_t_info_ack_ipv6 = {
433 	T_INFO_ACK,
434 	UDP_MAXPACKET_IPV6,	/* TSDU_size.  Excl. headers */
435 	T_INVALID,	/* ETSU_size.  udp does not support expedited data. */
436 	T_INVALID,	/* CDATA_size. udp does not support connect data. */
437 	T_INVALID,	/* DDATA_size. udp does not support disconnect data. */
438 	sizeof (sin6_t), /* ADDR_size. */
439 	0,		/* OPT_size - not initialized here */
440 	UDP_MAXPACKET_IPV6,	/* TIDU_size. Excl. headers */
441 	T_CLTS,		/* SERV_type.  udp supports connection-less. */
442 	TS_UNBND,	/* CURRENT_state.  This is set from udp_state. */
443 	(XPG4_1|SENDZERO) /* PROVIDER_flag */
444 };
445 
446 /* largest UDP port number */
447 #define	UDP_MAX_PORT	65535
448 
449 /*
450  * Table of ND variables supported by udp.  These are loaded into udp_g_nd
451  * in udp_open.
452  * All of these are alterable, within the min/max values given, at run time.
453  */
454 /* BEGIN CSTYLED */
455 udpparam_t udp_param_arr[] = {
456  /*min		max		value		name */
457  { 0L,		256,		32,		"udp_wroff_extra" },
458  { 1L,		255,		255,		"udp_ipv4_ttl" },
459  { 0,		IPV6_MAX_HOPS,	IPV6_DEFAULT_HOPS, "udp_ipv6_hoplimit"},
460  { 1024,	(32 * 1024),	1024,		"udp_smallest_nonpriv_port" },
461  { 0,		1,		1,		"udp_do_checksum" },
462  { 1024,	UDP_MAX_PORT,	(32 * 1024),	"udp_smallest_anon_port" },
463  { 1024,	UDP_MAX_PORT,	UDP_MAX_PORT,	"udp_largest_anon_port" },
464  { UDP_XMIT_LOWATER, (1<<30), UDP_XMIT_HIWATER,	"udp_xmit_hiwat"},
465  { 0,		     (1<<30), UDP_XMIT_LOWATER, "udp_xmit_lowat"},
466  { UDP_RECV_LOWATER, (1<<30), UDP_RECV_HIWATER,	"udp_recv_hiwat"},
467  { 65536,	(1<<30),	2*1024*1024,	"udp_max_buf"},
468  { 100,		60000,		1000,		"udp_ndd_get_info_interval"},
469 };
470 /* END CSTYLED */
471 
472 /*
473  * The smallest anonymous port in the privileged port range which UDP
474  * looks for free port.  Use in the option UDP_ANONPRIVBIND.
475  */
476 static in_port_t udp_min_anonpriv_port = 512;
477 
478 /* If set to 0, pick ephemeral port sequentially; otherwise randomly. */
479 uint32_t udp_random_anon_port = 1;
480 
481 /*
482  * Hook functions to enable cluster networking.
483  * On non-clustered systems these vectors must always be NULL
484  */
485 
486 void (*cl_inet_bind)(uchar_t protocol, sa_family_t addr_family,
487     uint8_t *laddrp, in_port_t lport) = NULL;
488 void (*cl_inet_unbind)(uint8_t protocol, sa_family_t addr_family,
489     uint8_t *laddrp, in_port_t lport) = NULL;
490 
491 typedef union T_primitives *t_primp_t;
492 
493 #define	UDP_ENQUEUE_MP(udp, mp, proc, tag) {			\
494 	ASSERT((mp)->b_prev == NULL && (mp)->b_queue == NULL);	\
495 	ASSERT(MUTEX_HELD(&(udp)->udp_connp->conn_lock));	\
496 	(mp)->b_queue = (queue_t *)((uintptr_t)tag);		\
497 	(mp)->b_prev = (mblk_t *)proc;				\
498 	if ((udp)->udp_mphead == NULL)				\
499 		(udp)->udp_mphead = (mp);			\
500 	else							\
501 		(udp)->udp_mptail->b_next = (mp);		\
502 	(udp)->udp_mptail = (mp);				\
503 	(udp)->udp_mpcount++;					\
504 }
505 
506 #define	UDP_READERS_INCREF(udp) {				\
507 	ASSERT(MUTEX_HELD(&(udp)->udp_connp->conn_lock));	\
508 	(udp)->udp_reader_count++;				\
509 }
510 
511 #define	UDP_READERS_DECREF(udp) {				\
512 	ASSERT(MUTEX_HELD(&(udp)->udp_connp->conn_lock));	\
513 	(udp)->udp_reader_count--;				\
514 	if ((udp)->udp_reader_count == 0)			\
515 		cv_broadcast(&(udp)->udp_connp->conn_cv);	\
516 }
517 
518 #define	UDP_SQUEUE_DECREF(udp) {				\
519 	ASSERT(MUTEX_HELD(&(udp)->udp_connp->conn_lock));	\
520 	(udp)->udp_squeue_count--;				\
521 	if ((udp)->udp_squeue_count == 0)			\
522 		cv_broadcast(&(udp)->udp_connp->conn_cv);	\
523 }
524 
525 /*
526  * Notes on UDP endpoint synchronization:
527  *
528  * UDP needs exclusive operation on a per endpoint basis, when executing
529  * functions that modify the endpoint state.  udp_rput_other() deals with
530  * packets with IP options, and processing these packets end up having
531  * to update the endpoint's option related state.  udp_wput_other() deals
532  * with control operations from the top, e.g. connect() that needs to
533  * update the endpoint state.  These could be synchronized using locks,
534  * but the current version uses squeues for this purpose.  squeues may
535  * give performance improvement for certain cases such as connected UDP
536  * sockets; thus the framework allows for using squeues.
537  *
538  * The perimeter routines are described as follows:
539  *
540  * udp_enter():
541  *	Enter the UDP endpoint perimeter.
542  *
543  * udp_become_writer():
544  *	Become exclusive on the UDP endpoint.  Specifies a function
545  *	that will be called exclusively either immediately or later
546  *	when the perimeter is available exclusively.
547  *
548  * udp_exit():
549  *	Exit the UDP perimeter.
550  *
551  * Entering UDP from the top or from the bottom must be done using
552  * udp_enter().  No lock must be held while attempting to enter the UDP
553  * perimeter.  When finished, udp_exit() must be called to get out of
554  * the perimeter.
555  *
556  * UDP operates in either MT_HOT mode or in SQUEUE mode.  In MT_HOT mode,
557  * multiple threads may enter a UDP endpoint concurrently.  This is used
558  * for sending and/or receiving normal data.  Control operations and other
559  * special cases call udp_become_writer() to become exclusive on a per
560  * endpoint basis and this results in transitioning to SQUEUE mode.  squeue
561  * by definition serializes access to the conn_t.  When there are no more
562  * pending messages on the squeue for the UDP connection, the endpoint
563  * reverts to MT_HOT mode.  During the interregnum when not all MT threads
564  * of an endpoint have finished, messages are queued in the UDP endpoint
565  * and the UDP is in UDP_MT_QUEUED mode or UDP_QUEUED_SQUEUE mode.
566  *
567  * These modes have the following analogs:
568  *
569  *	UDP_MT_HOT/udp_reader_count==0		none
570  *	UDP_MT_HOT/udp_reader_count>0		RW_READ_LOCK
571  *	UDP_MT_QUEUED				RW_WRITE_WANTED
572  *	UDP_SQUEUE or UDP_QUEUED_SQUEUE		RW_WRITE_LOCKED
573  *
574  * Stable modes:	UDP_MT_HOT, UDP_SQUEUE
575  * Transient modes:	UDP_MT_QUEUED, UDP_QUEUED_SQUEUE
576  *
577  * While in stable modes, UDP keeps track of the number of threads
578  * operating on the endpoint.  The udp_reader_count variable represents
579  * the number of threads entering the endpoint as readers while it is
580  * in UDP_MT_HOT mode.  Transitioning to UDP_SQUEUE happens when there
581  * is only a single reader, i.e. when this counter drops to 1.  Likewise,
582  * udp_squeue_count represents the number of threads operating on the
583  * endpoint's squeue while it is in UDP_SQUEUE mode.  The mode transition
584  * to UDP_MT_HOT happens after the last thread exits the endpoint, i.e.
585  * when this counter drops to 0.
586  *
587  * The default mode is set to UDP_MT_HOT and UDP alternates between
588  * UDP_MT_HOT and UDP_SQUEUE as shown in the state transition below.
589  *
590  * Mode transition:
591  * ----------------------------------------------------------------
592  * old mode		Event				New mode
593  * ----------------------------------------------------------------
594  * UDP_MT_HOT		Call to udp_become_writer()	UDP_SQUEUE
595  *			and udp_reader_count == 1
596  *
597  * UDP_MT_HOT		Call to udp_become_writer()	UDP_MT_QUEUED
598  *			and udp_reader_count > 1
599  *
600  * UDP_MT_QUEUED	udp_reader_count drops to zero	UDP_QUEUED_SQUEUE
601  *
602  * UDP_QUEUED_SQUEUE	All messages enqueued on the	UDP_SQUEUE
603  *			internal UDP queue successfully
604  *			moved to squeue AND udp_squeue_count != 0
605  *
606  * UDP_QUEUED_SQUEUE	All messages enqueued on the	UDP_MT_HOT
607  *			internal UDP queue successfully
608  *			moved to squeue AND udp_squeue_count
609  *			drops to zero
610  *
611  * UDP_SQUEUE		udp_squeue_count drops to zero	UDP_MT_HOT
612  * ----------------------------------------------------------------
613  */
614 
615 static queue_t *
616 UDP_WR(queue_t *q)
617 {
618 	ASSERT(q->q_ptr == NULL && _OTHERQ(q)->q_ptr == NULL);
619 	ASSERT(WR(q)->q_next != NULL && WR(q)->q_next->q_ptr != NULL);
620 	ASSERT(IPCL_IS_UDP(Q_TO_CONN(WR(q)->q_next)));
621 
622 	return (_WR(q)->q_next);
623 }
624 
625 static queue_t *
626 UDP_RD(queue_t *q)
627 {
628 	ASSERT(q->q_ptr != NULL && _OTHERQ(q)->q_ptr != NULL);
629 	ASSERT(IPCL_IS_UDP(Q_TO_CONN(q)));
630 	ASSERT(RD(q)->q_next != NULL && RD(q)->q_next->q_ptr == NULL);
631 
632 	return (_RD(q)->q_next);
633 }
634 
635 #ifdef DEBUG
636 #define	UDP_MODE_ASSERTIONS(udp, caller) udp_mode_assertions(udp, caller)
637 #else
638 #define	UDP_MODE_ASSERTIONS(udp, caller)
639 #endif
640 
641 /* Invariants */
642 #ifdef DEBUG
643 
644 uint32_t udp_count[4];
645 
646 /* Context of udp_mode_assertions */
647 #define	UDP_ENTER		1
648 #define	UDP_BECOME_WRITER	2
649 #define	UDP_EXIT		3
650 
651 static void
652 udp_mode_assertions(udp_t *udp, int caller)
653 {
654 	ASSERT(MUTEX_HELD(&udp->udp_connp->conn_lock));
655 
656 	switch (udp->udp_mode) {
657 	case UDP_MT_HOT:
658 		/*
659 		 * Messages have not yet been enqueued on the internal queue,
660 		 * otherwise we would have switched to UDP_MT_QUEUED. Likewise
661 		 * by definition, there can't be any messages enqueued on the
662 		 * squeue. The UDP could be quiescent, so udp_reader_count
663 		 * could be zero at entry.
664 		 */
665 		ASSERT(udp->udp_mphead == NULL && udp->udp_mpcount == 0 &&
666 		    udp->udp_squeue_count == 0);
667 		ASSERT(caller == UDP_ENTER || udp->udp_reader_count != 0);
668 		udp_count[0]++;
669 		break;
670 
671 	case UDP_MT_QUEUED:
672 		/*
673 		 * The last MT thread to exit the udp perimeter empties the
674 		 * internal queue and then switches the UDP to
675 		 * UDP_QUEUED_SQUEUE mode. Since we are still in UDP_MT_QUEUED
676 		 * mode, it means there must be at least 1 MT thread still in
677 		 * the perimeter and at least 1 message on the internal queue.
678 		 */
679 		ASSERT(udp->udp_reader_count >= 1 && udp->udp_mphead != NULL &&
680 		    udp->udp_mpcount != 0 && udp->udp_squeue_count == 0);
681 		udp_count[1]++;
682 		break;
683 
684 	case UDP_QUEUED_SQUEUE:
685 		/*
686 		 * The switch has happened from MT to SQUEUE. So there can't
687 		 * any MT threads. Messages could still pile up on the internal
688 		 * queue until the transition is complete and we move to
689 		 * UDP_SQUEUE mode. We can't assert on nonzero udp_squeue_count
690 		 * since the squeue could drain any time.
691 		 */
692 		ASSERT(udp->udp_reader_count == 0);
693 		udp_count[2]++;
694 		break;
695 
696 	case UDP_SQUEUE:
697 		/*
698 		 * The transition is complete. Thre can't be any messages on
699 		 * the internal queue. The udp could be quiescent or the squeue
700 		 * could drain any time, so we can't assert on nonzero
701 		 * udp_squeue_count during entry. Nor can we assert that
702 		 * udp_reader_count is zero, since, a reader thread could have
703 		 * directly become writer in line by calling udp_become_writer
704 		 * without going through the queued states.
705 		 */
706 		ASSERT(udp->udp_mphead == NULL && udp->udp_mpcount == 0);
707 		ASSERT(caller == UDP_ENTER || udp->udp_squeue_count != 0);
708 		udp_count[3]++;
709 		break;
710 	}
711 }
712 #endif
713 
714 #define	_UDP_ENTER(connp, mp, proc, tag) {				\
715 	udp_t *_udp = (connp)->conn_udp;				\
716 									\
717 	mutex_enter(&(connp)->conn_lock);				\
718 	if ((connp)->conn_state_flags & CONN_CLOSING) {			\
719 		mutex_exit(&(connp)->conn_lock);			\
720 		freemsg(mp);						\
721 	} else {							\
722 		UDP_MODE_ASSERTIONS(_udp, UDP_ENTER);			\
723 									\
724 		switch (_udp->udp_mode) {				\
725 		case UDP_MT_HOT:					\
726 			/* We can execute as reader right away. */	\
727 			UDP_READERS_INCREF(_udp);			\
728 			mutex_exit(&(connp)->conn_lock);		\
729 			(*(proc))(connp, mp, (connp)->conn_sqp);	\
730 			break;						\
731 									\
732 		case UDP_SQUEUE:					\
733 			/*						\
734 			 * We are in squeue mode, send the		\
735 			 * packet to the squeue				\
736 			 */						\
737 			_udp->udp_squeue_count++;			\
738 			CONN_INC_REF_LOCKED(connp);			\
739 			mutex_exit(&(connp)->conn_lock);		\
740 			squeue_enter((connp)->conn_sqp, mp, proc,	\
741 			    connp, tag);				\
742 			break;						\
743 									\
744 		case UDP_MT_QUEUED:					\
745 		case UDP_QUEUED_SQUEUE:					\
746 			/*						\
747 			 * Some messages may have been enqueued		\
748 			 * ahead of us.  Enqueue the new message	\
749 			 * at the tail of the internal queue to		\
750 			 * preserve message ordering.			\
751 			 */						\
752 			UDP_ENQUEUE_MP(_udp, mp, proc, tag);		\
753 			mutex_exit(&(connp)->conn_lock);		\
754 			break;						\
755 		}							\
756 	}								\
757 }
758 
759 static void
760 udp_enter(conn_t *connp, mblk_t *mp, sqproc_t proc, uint8_t tag)
761 {
762 	_UDP_ENTER(connp, mp, proc, tag);
763 }
764 
765 static void
766 udp_become_writer(conn_t *connp, mblk_t *mp, sqproc_t proc, uint8_t tag)
767 {
768 	udp_t	*udp;
769 
770 	udp = connp->conn_udp;
771 
772 	mutex_enter(&connp->conn_lock);
773 
774 	UDP_MODE_ASSERTIONS(udp, UDP_BECOME_WRITER);
775 
776 	switch (udp->udp_mode) {
777 	case UDP_MT_HOT:
778 		if (udp->udp_reader_count == 1) {
779 			/*
780 			 * We are the only MT thread. Switch to squeue mode
781 			 * immediately.
782 			 */
783 			udp->udp_mode = UDP_SQUEUE;
784 			udp->udp_squeue_count = 1;
785 			CONN_INC_REF_LOCKED(connp);
786 			mutex_exit(&connp->conn_lock);
787 			squeue_enter(connp->conn_sqp, mp, proc, connp, tag);
788 			return;
789 		}
790 		/* FALLTHRU */
791 
792 	case UDP_MT_QUEUED:
793 		/* Enqueue the packet internally in UDP */
794 		udp->udp_mode = UDP_MT_QUEUED;
795 		UDP_ENQUEUE_MP(udp, mp, proc, tag);
796 		mutex_exit(&connp->conn_lock);
797 		return;
798 
799 	case UDP_SQUEUE:
800 	case UDP_QUEUED_SQUEUE:
801 		/*
802 		 * We are already exclusive. i.e. we are already
803 		 * writer. Simply call the desired function.
804 		 */
805 		udp->udp_squeue_count++;
806 		mutex_exit(&connp->conn_lock);
807 		(*proc)(connp, mp, connp->conn_sqp);
808 		return;
809 	}
810 }
811 
812 /*
813  * Transition from MT mode to SQUEUE mode, when the last MT thread
814  * is exiting the UDP perimeter. Move all messages from the internal
815  * udp queue to the squeue. A better way would be to move all the
816  * messages in one shot, this needs more support from the squeue framework
817  */
818 static void
819 udp_switch_to_squeue(udp_t *udp)
820 {
821 	mblk_t *mp;
822 	mblk_t	*mp_next;
823 	sqproc_t proc;
824 	uint8_t	tag;
825 	conn_t	*connp = udp->udp_connp;
826 
827 	ASSERT(MUTEX_HELD(&connp->conn_lock));
828 	ASSERT(udp->udp_mode == UDP_MT_QUEUED);
829 	while (udp->udp_mphead != NULL) {
830 		mp = udp->udp_mphead;
831 		udp->udp_mphead = NULL;
832 		udp->udp_mptail = NULL;
833 		udp->udp_mpcount = 0;
834 		udp->udp_mode = UDP_QUEUED_SQUEUE;
835 		mutex_exit(&connp->conn_lock);
836 		/*
837 		 * It is best not to hold any locks across the calls
838 		 * to squeue functions. Since we drop the lock we
839 		 * need to go back and check the udp_mphead once again
840 		 * after the squeue_fill and hence the while loop at
841 		 * the top of this function
842 		 */
843 		for (; mp != NULL; mp = mp_next) {
844 			mp_next = mp->b_next;
845 			proc = (sqproc_t)mp->b_prev;
846 			tag = (uint8_t)((uintptr_t)mp->b_queue);
847 			mp->b_next = NULL;
848 			mp->b_prev = NULL;
849 			mp->b_queue = NULL;
850 			CONN_INC_REF(connp);
851 			udp->udp_squeue_count++;
852 			squeue_fill(connp->conn_sqp, mp, proc, connp,
853 			    tag);
854 		}
855 		mutex_enter(&connp->conn_lock);
856 	}
857 	/*
858 	 * udp_squeue_count of zero implies that the squeue has drained
859 	 * even before we arrived here (i.e. after the squeue_fill above)
860 	 */
861 	udp->udp_mode = (udp->udp_squeue_count != 0) ?
862 	    UDP_SQUEUE : UDP_MT_HOT;
863 }
864 
865 #define	_UDP_EXIT(connp) {						\
866 	udp_t *_udp = (connp)->conn_udp;				\
867 									\
868 	mutex_enter(&(connp)->conn_lock);				\
869 	UDP_MODE_ASSERTIONS(_udp, UDP_EXIT);				\
870 									\
871 	switch (_udp->udp_mode) {					\
872 	case UDP_MT_HOT:						\
873 		UDP_READERS_DECREF(_udp);				\
874 		mutex_exit(&(connp)->conn_lock);			\
875 		break;							\
876 									\
877 	case UDP_SQUEUE:						\
878 		UDP_SQUEUE_DECREF(_udp);				\
879 		if (_udp->udp_squeue_count == 0)			\
880 		    _udp->udp_mode = UDP_MT_HOT;			\
881 		mutex_exit(&(connp)->conn_lock);			\
882 		break;							\
883 									\
884 	case UDP_MT_QUEUED:						\
885 		/*							\
886 		 * If this is the last MT thread, we need to		\
887 		 * switch to squeue mode				\
888 		 */							\
889 		UDP_READERS_DECREF(_udp);				\
890 		if (_udp->udp_reader_count == 0)			\
891 			udp_switch_to_squeue(_udp);			\
892 		mutex_exit(&(connp)->conn_lock);			\
893 		break;							\
894 									\
895 	case UDP_QUEUED_SQUEUE:						\
896 		UDP_SQUEUE_DECREF(_udp);				\
897 		/*							\
898 		 * Even if the udp_squeue_count drops to zero, we	\
899 		 * don't want to change udp_mode to UDP_MT_HOT here.	\
900 		 * The thread in udp_switch_to_squeue will take care	\
901 		 * of the transition to UDP_MT_HOT, after emptying	\
902 		 * any more new messages that have been enqueued in	\
903 		 * udp_mphead.						\
904 		 */							\
905 		mutex_exit(&(connp)->conn_lock);			\
906 		break;							\
907 	}								\
908 }
909 
910 static void
911 udp_exit(conn_t *connp)
912 {
913 	_UDP_EXIT(connp);
914 }
915 
916 /*
917  * Return the next anonymous port in the privileged port range for
918  * bind checking.
919  *
920  * Trusted Extension (TX) notes: TX allows administrator to mark or
921  * reserve ports as Multilevel ports (MLP). MLP has special function
922  * on TX systems. Once a port is made MLP, it's not available as
923  * ordinary port. This creates "holes" in the port name space. It
924  * may be necessary to skip the "holes" find a suitable anon port.
925  */
926 static in_port_t
927 udp_get_next_priv_port(udp_t *udp)
928 {
929 	static in_port_t next_priv_port = IPPORT_RESERVED - 1;
930 	in_port_t nextport;
931 	boolean_t restart = B_FALSE;
932 
933 retry:
934 	if (next_priv_port < udp_min_anonpriv_port ||
935 	    next_priv_port >= IPPORT_RESERVED) {
936 		next_priv_port = IPPORT_RESERVED - 1;
937 		if (restart)
938 			return (0);
939 		restart = B_TRUE;
940 	}
941 
942 	if (is_system_labeled() &&
943 	    (nextport = tsol_next_port(crgetzone(udp->udp_connp->conn_cred),
944 	    next_priv_port, IPPROTO_UDP, B_FALSE)) != 0) {
945 		next_priv_port = nextport;
946 		goto retry;
947 	}
948 
949 	return (next_priv_port--);
950 }
951 
952 /* UDP bind hash report triggered via the Named Dispatch mechanism. */
953 /* ARGSUSED */
954 static int
955 udp_bind_hash_report(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr)
956 {
957 	udp_fanout_t	*udpf;
958 	int		i;
959 	zoneid_t	zoneid;
960 	conn_t		*connp;
961 	udp_t		*udp;
962 
963 	connp = Q_TO_CONN(q);
964 	udp = connp->conn_udp;
965 
966 	/* Refer to comments in udp_status_report(). */
967 	if (cr == NULL || secpolicy_net_config(cr, B_TRUE) != 0) {
968 		if (ddi_get_lbolt() - udp_last_ndd_get_info_time <
969 		    drv_usectohz(udp_ndd_get_info_interval * 1000)) {
970 			(void) mi_mpprintf(mp, NDD_TOO_QUICK_MSG);
971 			return (0);
972 		}
973 	}
974 	if ((mp->b_cont = allocb(ND_MAX_BUF_LEN, BPRI_HI)) == NULL) {
975 		/* The following may work even if we cannot get a large buf. */
976 		(void) mi_mpprintf(mp, NDD_OUT_OF_BUF_MSG);
977 		return (0);
978 	}
979 
980 	(void) mi_mpprintf(mp,
981 	    "UDP     " MI_COL_HDRPAD_STR
982 	/*   12345678[89ABCDEF] */
983 	    " zone lport src addr        dest addr       port  state");
984 	/*    1234 12345 xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx 12345 UNBOUND */
985 
986 	zoneid = connp->conn_zoneid;
987 
988 	for (i = 0; i < udp_bind_fanout_size; i++) {
989 		udpf = &udp_bind_fanout[i];
990 		mutex_enter(&udpf->uf_lock);
991 
992 		/* Print the hash index. */
993 		udp = udpf->uf_udp;
994 		if (zoneid != GLOBAL_ZONEID) {
995 			/* skip to first entry in this zone; might be none */
996 			while (udp != NULL &&
997 			    udp->udp_connp->conn_zoneid != zoneid)
998 				udp = udp->udp_bind_hash;
999 		}
1000 		if (udp != NULL) {
1001 			uint_t print_len, buf_len;
1002 
1003 			buf_len = mp->b_cont->b_datap->db_lim -
1004 			    mp->b_cont->b_wptr;
1005 			print_len = snprintf((char *)mp->b_cont->b_wptr,
1006 			    buf_len, "%d\n", i);
1007 			if (print_len < buf_len) {
1008 				mp->b_cont->b_wptr += print_len;
1009 			} else {
1010 				mp->b_cont->b_wptr += buf_len;
1011 			}
1012 			for (; udp != NULL; udp = udp->udp_bind_hash) {
1013 				if (zoneid == GLOBAL_ZONEID ||
1014 				    zoneid == udp->udp_connp->conn_zoneid)
1015 					udp_report_item(mp->b_cont, udp);
1016 			}
1017 		}
1018 		mutex_exit(&udpf->uf_lock);
1019 	}
1020 	udp_last_ndd_get_info_time = ddi_get_lbolt();
1021 	return (0);
1022 }
1023 
1024 /*
1025  * Hash list removal routine for udp_t structures.
1026  */
1027 static void
1028 udp_bind_hash_remove(udp_t *udp, boolean_t caller_holds_lock)
1029 {
1030 	udp_t	*udpnext;
1031 	kmutex_t *lockp;
1032 
1033 	if (udp->udp_ptpbhn == NULL)
1034 		return;
1035 
1036 	/*
1037 	 * Extract the lock pointer in case there are concurrent
1038 	 * hash_remove's for this instance.
1039 	 */
1040 	ASSERT(udp->udp_port != 0);
1041 	if (!caller_holds_lock) {
1042 		lockp = &udp_bind_fanout[UDP_BIND_HASH(udp->udp_port)].uf_lock;
1043 		ASSERT(lockp != NULL);
1044 		mutex_enter(lockp);
1045 	}
1046 	if (udp->udp_ptpbhn != NULL) {
1047 		udpnext = udp->udp_bind_hash;
1048 		if (udpnext != NULL) {
1049 			udpnext->udp_ptpbhn = udp->udp_ptpbhn;
1050 			udp->udp_bind_hash = NULL;
1051 		}
1052 		*udp->udp_ptpbhn = udpnext;
1053 		udp->udp_ptpbhn = NULL;
1054 	}
1055 	if (!caller_holds_lock) {
1056 		mutex_exit(lockp);
1057 	}
1058 }
1059 
1060 static void
1061 udp_bind_hash_insert(udp_fanout_t *uf, udp_t *udp)
1062 {
1063 	udp_t	**udpp;
1064 	udp_t	*udpnext;
1065 
1066 	ASSERT(MUTEX_HELD(&uf->uf_lock));
1067 	if (udp->udp_ptpbhn != NULL) {
1068 		udp_bind_hash_remove(udp, B_TRUE);
1069 	}
1070 	udpp = &uf->uf_udp;
1071 	udpnext = udpp[0];
1072 	if (udpnext != NULL) {
1073 		/*
1074 		 * If the new udp bound to the INADDR_ANY address
1075 		 * and the first one in the list is not bound to
1076 		 * INADDR_ANY we skip all entries until we find the
1077 		 * first one bound to INADDR_ANY.
1078 		 * This makes sure that applications binding to a
1079 		 * specific address get preference over those binding to
1080 		 * INADDR_ANY.
1081 		 */
1082 		if (V6_OR_V4_INADDR_ANY(udp->udp_bound_v6src) &&
1083 		    !V6_OR_V4_INADDR_ANY(udpnext->udp_bound_v6src)) {
1084 			while ((udpnext = udpp[0]) != NULL &&
1085 			    !V6_OR_V4_INADDR_ANY(
1086 			    udpnext->udp_bound_v6src)) {
1087 				udpp = &(udpnext->udp_bind_hash);
1088 			}
1089 			if (udpnext != NULL)
1090 				udpnext->udp_ptpbhn = &udp->udp_bind_hash;
1091 		} else {
1092 			udpnext->udp_ptpbhn = &udp->udp_bind_hash;
1093 		}
1094 	}
1095 	udp->udp_bind_hash = udpnext;
1096 	udp->udp_ptpbhn = udpp;
1097 	udpp[0] = udp;
1098 }
1099 
1100 /*
1101  * This routine is called to handle each O_T_BIND_REQ/T_BIND_REQ message
1102  * passed to udp_wput.
1103  * It associates a port number and local address with the stream.
1104  * The O_T_BIND_REQ/T_BIND_REQ is passed downstream to ip with the UDP
1105  * protocol type (IPPROTO_UDP) placed in the message following the address.
1106  * A T_BIND_ACK message is passed upstream when ip acknowledges the request.
1107  * (Called as writer.)
1108  *
1109  * Note that UDP over IPv4 and IPv6 sockets can use the same port number
1110  * without setting SO_REUSEADDR. This is needed so that they
1111  * can be viewed as two independent transport protocols.
1112  * However, anonymouns ports are allocated from the same range to avoid
1113  * duplicating the udp_g_next_port_to_try.
1114  */
1115 static void
1116 udp_bind(queue_t *q, mblk_t *mp)
1117 {
1118 	sin_t		*sin;
1119 	sin6_t		*sin6;
1120 	mblk_t		*mp1;
1121 	in_port_t	port;		/* Host byte order */
1122 	in_port_t	requested_port;	/* Host byte order */
1123 	struct T_bind_req *tbr;
1124 	int		count;
1125 	in6_addr_t	v6src;
1126 	boolean_t	bind_to_req_port_only;
1127 	int		loopmax;
1128 	udp_fanout_t	*udpf;
1129 	in_port_t	lport;		/* Network byte order */
1130 	zoneid_t	zoneid;
1131 	conn_t		*connp;
1132 	udp_t		*udp;
1133 	boolean_t	is_inaddr_any;
1134 	mlp_type_t	addrtype, mlptype;
1135 
1136 	connp = Q_TO_CONN(q);
1137 	udp = connp->conn_udp;
1138 	if ((mp->b_wptr - mp->b_rptr) < sizeof (*tbr)) {
1139 		(void) mi_strlog(q, 1, SL_ERROR|SL_TRACE,
1140 		    "udp_bind: bad req, len %u",
1141 		    (uint_t)(mp->b_wptr - mp->b_rptr));
1142 		udp_err_ack(q, mp, TPROTO, 0);
1143 		return;
1144 	}
1145 
1146 	if (udp->udp_state != TS_UNBND) {
1147 		(void) mi_strlog(q, 1, SL_ERROR|SL_TRACE,
1148 		    "udp_bind: bad state, %u", udp->udp_state);
1149 		udp_err_ack(q, mp, TOUTSTATE, 0);
1150 		return;
1151 	}
1152 	/*
1153 	 * Reallocate the message to make sure we have enough room for an
1154 	 * address and the protocol type.
1155 	 */
1156 	mp1 = reallocb(mp, sizeof (struct T_bind_ack) + sizeof (sin6_t) + 1, 1);
1157 	if (!mp1) {
1158 		udp_err_ack(q, mp, TSYSERR, ENOMEM);
1159 		return;
1160 	}
1161 
1162 	mp = mp1;
1163 	tbr = (struct T_bind_req *)mp->b_rptr;
1164 	switch (tbr->ADDR_length) {
1165 	case 0:			/* Request for a generic port */
1166 		tbr->ADDR_offset = sizeof (struct T_bind_req);
1167 		if (udp->udp_family == AF_INET) {
1168 			tbr->ADDR_length = sizeof (sin_t);
1169 			sin = (sin_t *)&tbr[1];
1170 			*sin = sin_null;
1171 			sin->sin_family = AF_INET;
1172 			mp->b_wptr = (uchar_t *)&sin[1];
1173 		} else {
1174 			ASSERT(udp->udp_family == AF_INET6);
1175 			tbr->ADDR_length = sizeof (sin6_t);
1176 			sin6 = (sin6_t *)&tbr[1];
1177 			*sin6 = sin6_null;
1178 			sin6->sin6_family = AF_INET6;
1179 			mp->b_wptr = (uchar_t *)&sin6[1];
1180 		}
1181 		port = 0;
1182 		break;
1183 
1184 	case sizeof (sin_t):	/* Complete IPv4 address */
1185 		sin = (sin_t *)mi_offset_param(mp, tbr->ADDR_offset,
1186 		    sizeof (sin_t));
1187 		if (sin == NULL || !OK_32PTR((char *)sin)) {
1188 			udp_err_ack(q, mp, TSYSERR, EINVAL);
1189 			return;
1190 		}
1191 		if (udp->udp_family != AF_INET ||
1192 		    sin->sin_family != AF_INET) {
1193 			udp_err_ack(q, mp, TSYSERR, EAFNOSUPPORT);
1194 			return;
1195 		}
1196 		port = ntohs(sin->sin_port);
1197 		break;
1198 
1199 	case sizeof (sin6_t):	/* complete IPv6 address */
1200 		sin6 = (sin6_t *)mi_offset_param(mp, tbr->ADDR_offset,
1201 		    sizeof (sin6_t));
1202 		if (sin6 == NULL || !OK_32PTR((char *)sin6)) {
1203 			udp_err_ack(q, mp, TSYSERR, EINVAL);
1204 			return;
1205 		}
1206 		if (udp->udp_family != AF_INET6 ||
1207 		    sin6->sin6_family != AF_INET6) {
1208 			udp_err_ack(q, mp, TSYSERR, EAFNOSUPPORT);
1209 			return;
1210 		}
1211 		port = ntohs(sin6->sin6_port);
1212 		break;
1213 
1214 	default:		/* Invalid request */
1215 		(void) mi_strlog(q, 1, SL_ERROR|SL_TRACE,
1216 		    "udp_bind: bad ADDR_length length %u", tbr->ADDR_length);
1217 		udp_err_ack(q, mp, TBADADDR, 0);
1218 		return;
1219 	}
1220 
1221 	requested_port = port;
1222 
1223 	if (requested_port == 0 || tbr->PRIM_type == O_T_BIND_REQ)
1224 		bind_to_req_port_only = B_FALSE;
1225 	else			/* T_BIND_REQ and requested_port != 0 */
1226 		bind_to_req_port_only = B_TRUE;
1227 
1228 	if (requested_port == 0) {
1229 		/*
1230 		 * If the application passed in zero for the port number, it
1231 		 * doesn't care which port number we bind to. Get one in the
1232 		 * valid range.
1233 		 */
1234 		if (udp->udp_anon_priv_bind) {
1235 			port = udp_get_next_priv_port(udp);
1236 		} else {
1237 			port = udp_update_next_port(udp,
1238 			    udp_g_next_port_to_try, B_TRUE);
1239 		}
1240 	} else {
1241 		/*
1242 		 * If the port is in the well-known privileged range,
1243 		 * make sure the caller was privileged.
1244 		 */
1245 		int i;
1246 		boolean_t priv = B_FALSE;
1247 
1248 		if (port < udp_smallest_nonpriv_port) {
1249 			priv = B_TRUE;
1250 		} else {
1251 			for (i = 0; i < udp_g_num_epriv_ports; i++) {
1252 				if (port == udp_g_epriv_ports[i]) {
1253 					priv = B_TRUE;
1254 					break;
1255 				}
1256 			}
1257 		}
1258 
1259 		if (priv) {
1260 			cred_t *cr = DB_CREDDEF(mp, connp->conn_cred);
1261 
1262 			if (secpolicy_net_privaddr(cr, port) != 0) {
1263 				udp_err_ack(q, mp, TACCES, 0);
1264 				return;
1265 			}
1266 		}
1267 	}
1268 
1269 	if (port == 0) {
1270 		udp_err_ack(q, mp, TNOADDR, 0);
1271 		return;
1272 	}
1273 
1274 	/*
1275 	 * Copy the source address into our udp structure. This address
1276 	 * may still be zero; if so, IP will fill in the correct address
1277 	 * each time an outbound packet is passed to it.
1278 	 */
1279 	if (udp->udp_family == AF_INET) {
1280 		ASSERT(sin != NULL);
1281 		ASSERT(udp->udp_ipversion == IPV4_VERSION);
1282 		udp->udp_max_hdr_len = IP_SIMPLE_HDR_LENGTH + UDPH_SIZE +
1283 		    udp->udp_ip_snd_options_len;
1284 		IN6_IPADDR_TO_V4MAPPED(sin->sin_addr.s_addr, &v6src);
1285 	} else {
1286 		ASSERT(sin6 != NULL);
1287 		v6src = sin6->sin6_addr;
1288 		if (IN6_IS_ADDR_V4MAPPED(&v6src)) {
1289 			udp->udp_ipversion = IPV4_VERSION;
1290 			udp->udp_max_hdr_len = IP_SIMPLE_HDR_LENGTH +
1291 			    UDPH_SIZE + udp->udp_ip_snd_options_len;
1292 		} else {
1293 			udp->udp_ipversion = IPV6_VERSION;
1294 			udp->udp_max_hdr_len = udp->udp_sticky_hdrs_len;
1295 		}
1296 	}
1297 
1298 	/*
1299 	 * If udp_reuseaddr is not set, then we have to make sure that
1300 	 * the IP address and port number the application requested
1301 	 * (or we selected for the application) is not being used by
1302 	 * another stream.  If another stream is already using the
1303 	 * requested IP address and port, the behavior depends on
1304 	 * "bind_to_req_port_only". If set the bind fails; otherwise we
1305 	 * search for any an unused port to bind to the the stream.
1306 	 *
1307 	 * As per the BSD semantics, as modified by the Deering multicast
1308 	 * changes, if udp_reuseaddr is set, then we allow multiple binds
1309 	 * to the same port independent of the local IP address.
1310 	 *
1311 	 * This is slightly different than in SunOS 4.X which did not
1312 	 * support IP multicast. Note that the change implemented by the
1313 	 * Deering multicast code effects all binds - not only binding
1314 	 * to IP multicast addresses.
1315 	 *
1316 	 * Note that when binding to port zero we ignore SO_REUSEADDR in
1317 	 * order to guarantee a unique port.
1318 	 */
1319 
1320 	count = 0;
1321 	if (udp->udp_anon_priv_bind) {
1322 		/* loopmax = (IPPORT_RESERVED-1) - udp_min_anonpriv_port + 1 */
1323 		loopmax = IPPORT_RESERVED - udp_min_anonpriv_port;
1324 	} else {
1325 		loopmax = udp_largest_anon_port - udp_smallest_anon_port + 1;
1326 	}
1327 
1328 	is_inaddr_any = V6_OR_V4_INADDR_ANY(v6src);
1329 	zoneid = connp->conn_zoneid;
1330 
1331 	for (;;) {
1332 		udp_t		*udp1;
1333 		boolean_t	found_exclbind = B_FALSE;
1334 
1335 		/*
1336 		 * Walk through the list of udp streams bound to
1337 		 * requested port with the same IP address.
1338 		 */
1339 		lport = htons(port);
1340 		udpf = &udp_bind_fanout[UDP_BIND_HASH(lport)];
1341 		mutex_enter(&udpf->uf_lock);
1342 		for (udp1 = udpf->uf_udp; udp1 != NULL;
1343 		    udp1 = udp1->udp_bind_hash) {
1344 			if (lport != udp1->udp_port)
1345 				continue;
1346 
1347 			/*
1348 			 * On a labeled system, we must treat bindings to ports
1349 			 * on shared IP addresses by sockets with MAC exemption
1350 			 * privilege as being in all zones, as there's
1351 			 * otherwise no way to identify the right receiver.
1352 			 */
1353 			if (zoneid != udp1->udp_connp->conn_zoneid &&
1354 			    !udp->udp_mac_exempt && !udp1->udp_mac_exempt)
1355 				continue;
1356 
1357 			/*
1358 			 * If UDP_EXCLBIND is set for either the bound or
1359 			 * binding endpoint, the semantics of bind
1360 			 * is changed according to the following chart.
1361 			 *
1362 			 * spec = specified address (v4 or v6)
1363 			 * unspec = unspecified address (v4 or v6)
1364 			 * A = specified addresses are different for endpoints
1365 			 *
1366 			 * bound	bind to		allowed?
1367 			 * -------------------------------------
1368 			 * unspec	unspec		no
1369 			 * unspec	spec		no
1370 			 * spec		unspec		no
1371 			 * spec		spec		yes if A
1372 			 *
1373 			 * For labeled systems, SO_MAC_EXEMPT behaves the same
1374 			 * as UDP_EXCLBIND, except that zoneid is ignored.
1375 			 */
1376 			if (udp1->udp_exclbind || udp->udp_exclbind ||
1377 			    udp1->udp_mac_exempt || udp->udp_mac_exempt) {
1378 				if (V6_OR_V4_INADDR_ANY(
1379 				    udp1->udp_bound_v6src) ||
1380 				    is_inaddr_any ||
1381 				    IN6_ARE_ADDR_EQUAL(&udp1->udp_bound_v6src,
1382 				    &v6src)) {
1383 					found_exclbind = B_TRUE;
1384 					break;
1385 				}
1386 				continue;
1387 			}
1388 
1389 			/*
1390 			 * Check ipversion to allow IPv4 and IPv6 sockets to
1391 			 * have disjoint port number spaces.
1392 			 */
1393 			if (udp->udp_ipversion != udp1->udp_ipversion) {
1394 
1395 				/*
1396 				 * On the first time through the loop, if the
1397 				 * the user intentionally specified a
1398 				 * particular port number, then ignore any
1399 				 * bindings of the other protocol that may
1400 				 * conflict. This allows the user to bind IPv6
1401 				 * alone and get both v4 and v6, or bind both
1402 				 * both and get each seperately. On subsequent
1403 				 * times through the loop, we're checking a
1404 				 * port that we chose (not the user) and thus
1405 				 * we do not allow casual duplicate bindings.
1406 				 */
1407 				if (count == 0 && requested_port != 0)
1408 					continue;
1409 			}
1410 
1411 			/*
1412 			 * No difference depending on SO_REUSEADDR.
1413 			 *
1414 			 * If existing port is bound to a
1415 			 * non-wildcard IP address and
1416 			 * the requesting stream is bound to
1417 			 * a distinct different IP addresses
1418 			 * (non-wildcard, also), keep going.
1419 			 */
1420 			if (!is_inaddr_any &&
1421 			    !V6_OR_V4_INADDR_ANY(udp1->udp_bound_v6src) &&
1422 			    !IN6_ARE_ADDR_EQUAL(&udp1->udp_bound_v6src,
1423 			    &v6src)) {
1424 				continue;
1425 			}
1426 			break;
1427 		}
1428 
1429 		if (!found_exclbind &&
1430 		    (udp->udp_reuseaddr && requested_port != 0)) {
1431 			break;
1432 		}
1433 
1434 		if (udp1 == NULL) {
1435 			/*
1436 			 * No other stream has this IP address
1437 			 * and port number. We can use it.
1438 			 */
1439 			break;
1440 		}
1441 		mutex_exit(&udpf->uf_lock);
1442 		if (bind_to_req_port_only) {
1443 			/*
1444 			 * We get here only when requested port
1445 			 * is bound (and only first  of the for()
1446 			 * loop iteration).
1447 			 *
1448 			 * The semantics of this bind request
1449 			 * require it to fail so we return from
1450 			 * the routine (and exit the loop).
1451 			 *
1452 			 */
1453 			udp_err_ack(q, mp, TADDRBUSY, 0);
1454 			return;
1455 		}
1456 
1457 		if (udp->udp_anon_priv_bind) {
1458 			port = udp_get_next_priv_port(udp);
1459 		} else {
1460 			if ((count == 0) && (requested_port != 0)) {
1461 				/*
1462 				 * If the application wants us to find
1463 				 * a port, get one to start with. Set
1464 				 * requested_port to 0, so that we will
1465 				 * update udp_g_next_port_to_try below.
1466 				 */
1467 				port = udp_update_next_port(udp,
1468 				    udp_g_next_port_to_try, B_TRUE);
1469 				requested_port = 0;
1470 			} else {
1471 				port = udp_update_next_port(udp, port + 1,
1472 				    B_FALSE);
1473 			}
1474 		}
1475 
1476 		if (port == 0 || ++count >= loopmax) {
1477 			/*
1478 			 * We've tried every possible port number and
1479 			 * there are none available, so send an error
1480 			 * to the user.
1481 			 */
1482 			udp_err_ack(q, mp, TNOADDR, 0);
1483 			return;
1484 		}
1485 	}
1486 
1487 	/*
1488 	 * Copy the source address into our udp structure.  This address
1489 	 * may still be zero; if so, ip will fill in the correct address
1490 	 * each time an outbound packet is passed to it.
1491 	 * If we are binding to a broadcast or multicast address udp_rput
1492 	 * will clear the source address when it receives the T_BIND_ACK.
1493 	 */
1494 	udp->udp_v6src = udp->udp_bound_v6src = v6src;
1495 	udp->udp_port = lport;
1496 	/*
1497 	 * Now reset the the next anonymous port if the application requested
1498 	 * an anonymous port, or we handed out the next anonymous port.
1499 	 */
1500 	if ((requested_port == 0) && (!udp->udp_anon_priv_bind)) {
1501 		udp_g_next_port_to_try = port + 1;
1502 	}
1503 
1504 	/* Initialize the O_T_BIND_REQ/T_BIND_REQ for ip. */
1505 	if (udp->udp_family == AF_INET) {
1506 		sin->sin_port = udp->udp_port;
1507 	} else {
1508 		int error;
1509 
1510 		sin6->sin6_port = udp->udp_port;
1511 		/* Rebuild the header template */
1512 		error = udp_build_hdrs(q, udp);
1513 		if (error != 0) {
1514 			mutex_exit(&udpf->uf_lock);
1515 			udp_err_ack(q, mp, TSYSERR, error);
1516 			return;
1517 		}
1518 	}
1519 	udp->udp_state = TS_IDLE;
1520 	udp_bind_hash_insert(udpf, udp);
1521 	mutex_exit(&udpf->uf_lock);
1522 
1523 	if (cl_inet_bind) {
1524 		/*
1525 		 * Running in cluster mode - register bind information
1526 		 */
1527 		if (udp->udp_ipversion == IPV4_VERSION) {
1528 			(*cl_inet_bind)(IPPROTO_UDP, AF_INET,
1529 			    (uint8_t *)(&V4_PART_OF_V6(udp->udp_v6src)),
1530 			    (in_port_t)udp->udp_port);
1531 		} else {
1532 			(*cl_inet_bind)(IPPROTO_UDP, AF_INET6,
1533 			    (uint8_t *)&(udp->udp_v6src),
1534 			    (in_port_t)udp->udp_port);
1535 		}
1536 
1537 	}
1538 
1539 	connp->conn_anon_port = (is_system_labeled() && requested_port == 0);
1540 	if (is_system_labeled() && (!connp->conn_anon_port ||
1541 	    connp->conn_anon_mlp)) {
1542 		uint16_t mlpport;
1543 		cred_t *cr = connp->conn_cred;
1544 		zone_t *zone;
1545 
1546 		connp->conn_mlp_type = udp->udp_recvucred ? mlptBoth :
1547 		    mlptSingle;
1548 		addrtype = tsol_mlp_addr_type(zoneid, IPV6_VERSION, &v6src);
1549 		if (addrtype == mlptSingle) {
1550 			udp_err_ack(q, mp, TNOADDR, 0);
1551 			connp->conn_anon_port = B_FALSE;
1552 			connp->conn_mlp_type = mlptSingle;
1553 			return;
1554 		}
1555 		mlpport = connp->conn_anon_port ? PMAPPORT : port;
1556 		zone = crgetzone(cr);
1557 		mlptype = tsol_mlp_port_type(zone, IPPROTO_UDP, mlpport,
1558 		    addrtype);
1559 		if (mlptype != mlptSingle &&
1560 		    (connp->conn_mlp_type == mlptSingle ||
1561 		    secpolicy_net_bindmlp(cr) != 0)) {
1562 			if (udp->udp_debug) {
1563 				(void) strlog(UDP_MOD_ID, 0, 1,
1564 				    SL_ERROR|SL_TRACE,
1565 				    "udp_bind: no priv for multilevel port %d",
1566 				    mlpport);
1567 			}
1568 			udp_err_ack(q, mp, TACCES, 0);
1569 			connp->conn_anon_port = B_FALSE;
1570 			connp->conn_mlp_type = mlptSingle;
1571 			return;
1572 		}
1573 
1574 		/*
1575 		 * If we're specifically binding a shared IP address and the
1576 		 * port is MLP on shared addresses, then check to see if this
1577 		 * zone actually owns the MLP.  Reject if not.
1578 		 */
1579 		if (mlptype == mlptShared && addrtype == mlptShared) {
1580 			zoneid_t mlpzone;
1581 
1582 			mlpzone = tsol_mlp_findzone(IPPROTO_UDP,
1583 			    htons(mlpport));
1584 			if (connp->conn_zoneid != mlpzone) {
1585 				if (udp->udp_debug) {
1586 					(void) strlog(UDP_MOD_ID, 0, 1,
1587 					    SL_ERROR|SL_TRACE,
1588 					    "udp_bind: attempt to bind port "
1589 					    "%d on shared addr in zone %d "
1590 					    "(should be %d)",
1591 					    mlpport, connp->conn_zoneid,
1592 					    mlpzone);
1593 				}
1594 				udp_err_ack(q, mp, TACCES, 0);
1595 				connp->conn_anon_port = B_FALSE;
1596 				connp->conn_mlp_type = mlptSingle;
1597 				return;
1598 			}
1599 		}
1600 		if (connp->conn_anon_port) {
1601 			int error;
1602 
1603 			error = tsol_mlp_anon(zone, mlptype, connp->conn_ulp,
1604 			    port, B_TRUE);
1605 			if (error != 0) {
1606 				if (udp->udp_debug) {
1607 					(void) strlog(UDP_MOD_ID, 0, 1,
1608 					    SL_ERROR|SL_TRACE,
1609 					    "udp_bind: cannot establish anon "
1610 					    "MLP for port %d", port);
1611 				}
1612 				udp_err_ack(q, mp, TACCES, 0);
1613 				connp->conn_anon_port = B_FALSE;
1614 				connp->conn_mlp_type = mlptSingle;
1615 				return;
1616 			}
1617 		}
1618 		connp->conn_mlp_type = mlptype;
1619 	}
1620 
1621 	/* Pass the protocol number in the message following the address. */
1622 	*mp->b_wptr++ = IPPROTO_UDP;
1623 	if (!V6_OR_V4_INADDR_ANY(udp->udp_v6src)) {
1624 		/*
1625 		 * Append a request for an IRE if udp_v6src not
1626 		 * zero (IPv4 - INADDR_ANY, or IPv6 - all-zeroes address).
1627 		 */
1628 		mp->b_cont = allocb(sizeof (ire_t), BPRI_HI);
1629 		if (!mp->b_cont) {
1630 			udp_err_ack(q, mp, TSYSERR, ENOMEM);
1631 			return;
1632 		}
1633 		mp->b_cont->b_wptr += sizeof (ire_t);
1634 		mp->b_cont->b_datap->db_type = IRE_DB_REQ_TYPE;
1635 	}
1636 	if (udp->udp_family == AF_INET6)
1637 		mp = ip_bind_v6(q, mp, connp, NULL);
1638 	else
1639 		mp = ip_bind_v4(q, mp, connp);
1640 
1641 	if (mp != NULL)
1642 		udp_rput_other(_RD(q), mp);
1643 	else
1644 		CONN_INC_REF(connp);
1645 }
1646 
1647 
1648 void
1649 udp_resume_bind(conn_t *connp, mblk_t *mp)
1650 {
1651 	udp_enter(connp, mp, udp_resume_bind_cb, SQTAG_BIND_RETRY);
1652 }
1653 
1654 /*
1655  * This is called from ip_wput_nondata to resume a deferred UDP bind.
1656  */
1657 /* ARGSUSED */
1658 static void
1659 udp_resume_bind_cb(void *arg, mblk_t *mp, void *arg2)
1660 {
1661 	conn_t *connp = arg;
1662 
1663 	ASSERT(connp != NULL && IPCL_IS_UDP(connp));
1664 
1665 	udp_rput_other(connp->conn_rq, mp);
1666 
1667 	CONN_OPER_PENDING_DONE(connp);
1668 	udp_exit(connp);
1669 }
1670 
1671 /*
1672  * This routine handles each T_CONN_REQ message passed to udp.  It
1673  * associates a default destination address with the stream.
1674  *
1675  * This routine sends down a T_BIND_REQ to IP with the following mblks:
1676  *	T_BIND_REQ	- specifying local and remote address/port
1677  *	IRE_DB_REQ_TYPE	- to get an IRE back containing ire_type and src
1678  *	T_OK_ACK	- for the T_CONN_REQ
1679  *	T_CONN_CON	- to keep the TPI user happy
1680  *
1681  * The connect completes in udp_rput.
1682  * When a T_BIND_ACK is received information is extracted from the IRE
1683  * and the two appended messages are sent to the TPI user.
1684  * Should udp_rput receive T_ERROR_ACK for the T_BIND_REQ it will convert
1685  * it to an error ack for the appropriate primitive.
1686  */
1687 static void
1688 udp_connect(queue_t *q, mblk_t *mp)
1689 {
1690 	sin6_t	*sin6;
1691 	sin_t	*sin;
1692 	struct T_conn_req	*tcr;
1693 	in6_addr_t v6dst;
1694 	ipaddr_t v4dst;
1695 	uint16_t dstport;
1696 	uint32_t flowinfo;
1697 	mblk_t	*mp1, *mp2;
1698 	udp_fanout_t	*udpf;
1699 	udp_t	*udp, *udp1;
1700 
1701 	udp = Q_TO_UDP(q);
1702 
1703 	tcr = (struct T_conn_req *)mp->b_rptr;
1704 
1705 	/* A bit of sanity checking */
1706 	if ((mp->b_wptr - mp->b_rptr) < sizeof (struct T_conn_req)) {
1707 		udp_err_ack(q, mp, TPROTO, 0);
1708 		return;
1709 	}
1710 	/*
1711 	 * This UDP must have bound to a port already before doing
1712 	 * a connect.
1713 	 */
1714 	if (udp->udp_state == TS_UNBND) {
1715 		(void) mi_strlog(q, 1, SL_ERROR|SL_TRACE,
1716 		    "udp_connect: bad state, %u", udp->udp_state);
1717 		udp_err_ack(q, mp, TOUTSTATE, 0);
1718 		return;
1719 	}
1720 	ASSERT(udp->udp_port != 0 && udp->udp_ptpbhn != NULL);
1721 
1722 	udpf = &udp_bind_fanout[UDP_BIND_HASH(udp->udp_port)];
1723 
1724 	if (udp->udp_state == TS_DATA_XFER) {
1725 		/* Already connected - clear out state */
1726 		mutex_enter(&udpf->uf_lock);
1727 		udp->udp_v6src = udp->udp_bound_v6src;
1728 		udp->udp_state = TS_IDLE;
1729 		mutex_exit(&udpf->uf_lock);
1730 	}
1731 
1732 	if (tcr->OPT_length != 0) {
1733 		udp_err_ack(q, mp, TBADOPT, 0);
1734 		return;
1735 	}
1736 
1737 	/*
1738 	 * Determine packet type based on type of address passed in
1739 	 * the request should contain an IPv4 or IPv6 address.
1740 	 * Make sure that address family matches the type of
1741 	 * family of the the address passed down
1742 	 */
1743 	switch (tcr->DEST_length) {
1744 	default:
1745 		udp_err_ack(q, mp, TBADADDR, 0);
1746 		return;
1747 
1748 	case sizeof (sin_t):
1749 		sin = (sin_t *)mi_offset_param(mp, tcr->DEST_offset,
1750 		    sizeof (sin_t));
1751 		if (sin == NULL || !OK_32PTR((char *)sin)) {
1752 			udp_err_ack(q, mp, TSYSERR, EINVAL);
1753 			return;
1754 		}
1755 		if (udp->udp_family != AF_INET ||
1756 		    sin->sin_family != AF_INET) {
1757 			udp_err_ack(q, mp, TSYSERR, EAFNOSUPPORT);
1758 			return;
1759 		}
1760 		v4dst = sin->sin_addr.s_addr;
1761 		dstport = sin->sin_port;
1762 		IN6_IPADDR_TO_V4MAPPED(v4dst, &v6dst);
1763 		ASSERT(udp->udp_ipversion == IPV4_VERSION);
1764 		udp->udp_max_hdr_len = IP_SIMPLE_HDR_LENGTH + UDPH_SIZE +
1765 		    udp->udp_ip_snd_options_len;
1766 		break;
1767 
1768 	case sizeof (sin6_t):
1769 		sin6 = (sin6_t *)mi_offset_param(mp, tcr->DEST_offset,
1770 		    sizeof (sin6_t));
1771 		if (sin6 == NULL || !OK_32PTR((char *)sin6)) {
1772 			udp_err_ack(q, mp, TSYSERR, EINVAL);
1773 			return;
1774 		}
1775 		if (udp->udp_family != AF_INET6 ||
1776 		    sin6->sin6_family != AF_INET6) {
1777 			udp_err_ack(q, mp, TSYSERR, EAFNOSUPPORT);
1778 			return;
1779 		}
1780 		v6dst = sin6->sin6_addr;
1781 		if (IN6_IS_ADDR_V4MAPPED(&v6dst)) {
1782 			IN6_V4MAPPED_TO_IPADDR(&v6dst, v4dst);
1783 			udp->udp_ipversion = IPV4_VERSION;
1784 			udp->udp_max_hdr_len = IP_SIMPLE_HDR_LENGTH +
1785 			    UDPH_SIZE + udp->udp_ip_snd_options_len;
1786 			flowinfo = 0;
1787 		} else {
1788 			udp->udp_ipversion = IPV6_VERSION;
1789 			udp->udp_max_hdr_len = udp->udp_sticky_hdrs_len;
1790 			flowinfo = sin6->sin6_flowinfo;
1791 		}
1792 		dstport = sin6->sin6_port;
1793 		break;
1794 	}
1795 	if (dstport == 0) {
1796 		udp_err_ack(q, mp, TBADADDR, 0);
1797 		return;
1798 	}
1799 
1800 	/*
1801 	 * Create a default IP header with no IP options.
1802 	 */
1803 	udp->udp_dstport = dstport;
1804 	if (udp->udp_ipversion == IPV4_VERSION) {
1805 		/*
1806 		 * Interpret a zero destination to mean loopback.
1807 		 * Update the T_CONN_REQ (sin/sin6) since it is used to
1808 		 * generate the T_CONN_CON.
1809 		 */
1810 		if (v4dst == INADDR_ANY) {
1811 			v4dst = htonl(INADDR_LOOPBACK);
1812 			IN6_IPADDR_TO_V4MAPPED(v4dst, &v6dst);
1813 			if (udp->udp_family == AF_INET) {
1814 				sin->sin_addr.s_addr = v4dst;
1815 			} else {
1816 				sin6->sin6_addr = v6dst;
1817 			}
1818 		}
1819 		udp->udp_v6dst = v6dst;
1820 		udp->udp_flowinfo = 0;
1821 
1822 		/*
1823 		 * If the destination address is multicast and
1824 		 * an outgoing multicast interface has been set,
1825 		 * use the address of that interface as our
1826 		 * source address if no source address has been set.
1827 		 */
1828 		if (V4_PART_OF_V6(udp->udp_v6src) == INADDR_ANY &&
1829 		    CLASSD(v4dst) &&
1830 		    udp->udp_multicast_if_addr != INADDR_ANY) {
1831 			IN6_IPADDR_TO_V4MAPPED(udp->udp_multicast_if_addr,
1832 			    &udp->udp_v6src);
1833 		}
1834 	} else {
1835 		ASSERT(udp->udp_ipversion == IPV6_VERSION);
1836 		/*
1837 		 * Interpret a zero destination to mean loopback.
1838 		 * Update the T_CONN_REQ (sin/sin6) since it is used to
1839 		 * generate the T_CONN_CON.
1840 		 */
1841 		if (IN6_IS_ADDR_UNSPECIFIED(&v6dst)) {
1842 			v6dst = ipv6_loopback;
1843 			sin6->sin6_addr = v6dst;
1844 		}
1845 		udp->udp_v6dst = v6dst;
1846 		udp->udp_flowinfo = flowinfo;
1847 		/*
1848 		 * If the destination address is multicast and
1849 		 * an outgoing multicast interface has been set,
1850 		 * then the ip bind logic will pick the correct source
1851 		 * address (i.e. matching the outgoing multicast interface).
1852 		 */
1853 	}
1854 
1855 	/*
1856 	 * Verify that the src/port/dst/port is unique for all
1857 	 * connections in TS_DATA_XFER
1858 	 */
1859 	mutex_enter(&udpf->uf_lock);
1860 	for (udp1 = udpf->uf_udp; udp1 != NULL; udp1 = udp1->udp_bind_hash) {
1861 		if (udp1->udp_state != TS_DATA_XFER)
1862 			continue;
1863 		if (udp->udp_port != udp1->udp_port ||
1864 		    udp->udp_ipversion != udp1->udp_ipversion ||
1865 		    dstport != udp1->udp_dstport ||
1866 		    !IN6_ARE_ADDR_EQUAL(&udp->udp_v6src, &udp1->udp_v6src) ||
1867 		    !IN6_ARE_ADDR_EQUAL(&v6dst, &udp1->udp_v6dst))
1868 			continue;
1869 		mutex_exit(&udpf->uf_lock);
1870 		udp_err_ack(q, mp, TBADADDR, 0);
1871 		return;
1872 	}
1873 	udp->udp_state = TS_DATA_XFER;
1874 	mutex_exit(&udpf->uf_lock);
1875 
1876 	/*
1877 	 * Send down bind to IP to verify that there is a route
1878 	 * and to determine the source address.
1879 	 * This will come back as T_BIND_ACK with an IRE_DB_TYPE in rput.
1880 	 */
1881 	if (udp->udp_family == AF_INET)
1882 		mp1 = udp_ip_bind_mp(udp, O_T_BIND_REQ, sizeof (ipa_conn_t));
1883 	else
1884 		mp1 = udp_ip_bind_mp(udp, O_T_BIND_REQ, sizeof (ipa6_conn_t));
1885 	if (mp1 == NULL) {
1886 		udp_err_ack(q, mp, TSYSERR, ENOMEM);
1887 bind_failed:
1888 		mutex_enter(&udpf->uf_lock);
1889 		udp->udp_state = TS_IDLE;
1890 		mutex_exit(&udpf->uf_lock);
1891 		return;
1892 	}
1893 
1894 	/*
1895 	 * We also have to send a connection confirmation to
1896 	 * keep TLI happy. Prepare it for udp_rput.
1897 	 */
1898 	if (udp->udp_family == AF_INET)
1899 		mp2 = mi_tpi_conn_con(NULL, (char *)sin,
1900 		    sizeof (*sin), NULL, 0);
1901 	else
1902 		mp2 = mi_tpi_conn_con(NULL, (char *)sin6,
1903 		    sizeof (*sin6), NULL, 0);
1904 	if (mp2 == NULL) {
1905 		freemsg(mp1);
1906 		udp_err_ack(q, mp, TSYSERR, ENOMEM);
1907 		goto bind_failed;
1908 	}
1909 
1910 	mp = mi_tpi_ok_ack_alloc(mp);
1911 	if (mp == NULL) {
1912 		/* Unable to reuse the T_CONN_REQ for the ack. */
1913 		freemsg(mp2);
1914 		udp_err_ack_prim(q, mp1, T_CONN_REQ, TSYSERR, ENOMEM);
1915 		goto bind_failed;
1916 	}
1917 
1918 	/* Hang onto the T_OK_ACK and T_CONN_CON for later. */
1919 	linkb(mp1, mp);
1920 	linkb(mp1, mp2);
1921 
1922 	mblk_setcred(mp1, udp->udp_connp->conn_cred);
1923 	if (udp->udp_family == AF_INET)
1924 		mp1 = ip_bind_v4(q, mp1, udp->udp_connp);
1925 	else
1926 		mp1 = ip_bind_v6(q, mp1, udp->udp_connp, NULL);
1927 
1928 	if (mp1 != NULL)
1929 		udp_rput_other(_RD(q), mp1);
1930 	else
1931 		CONN_INC_REF(udp->udp_connp);
1932 }
1933 
1934 static int
1935 udp_close(queue_t *q)
1936 {
1937 	conn_t	*connp = Q_TO_CONN(UDP_WR(q));
1938 	udp_t	*udp;
1939 	queue_t	*ip_rq = RD(UDP_WR(q));
1940 
1941 	ASSERT(connp != NULL && IPCL_IS_UDP(connp));
1942 	udp = connp->conn_udp;
1943 
1944 	ip_quiesce_conn(connp);
1945 	/*
1946 	 * Disable read-side synchronous stream
1947 	 * interface and drain any queued data.
1948 	 */
1949 	udp_rcv_drain(q, udp, B_TRUE);
1950 	ASSERT(!udp->udp_direct_sockfs);
1951 
1952 	qprocsoff(q);
1953 
1954 	/* restore IP module's high and low water marks to default values */
1955 	ip_rq->q_hiwat = ip_rq->q_qinfo->qi_minfo->mi_hiwat;
1956 	WR(ip_rq)->q_hiwat = WR(ip_rq)->q_qinfo->qi_minfo->mi_hiwat;
1957 	WR(ip_rq)->q_lowat = WR(ip_rq)->q_qinfo->qi_minfo->mi_lowat;
1958 
1959 	ASSERT(udp->udp_rcv_cnt == 0);
1960 	ASSERT(udp->udp_rcv_msgcnt == 0);
1961 	ASSERT(udp->udp_rcv_list_head == NULL);
1962 	ASSERT(udp->udp_rcv_list_tail == NULL);
1963 
1964 	udp_close_free(connp);
1965 
1966 	/*
1967 	 * Restore connp as an IP endpoint.
1968 	 * Locking required to prevent a race with udp_snmp_get()/
1969 	 * ipcl_get_next_conn(), which selects conn_t which are
1970 	 * IPCL_UDP and not CONN_CONDEMNED.
1971 	 */
1972 	mutex_enter(&connp->conn_lock);
1973 	connp->conn_flags &= ~IPCL_UDP;
1974 	connp->conn_state_flags &=
1975 	    ~(CONN_CLOSING | CONN_CONDEMNED | CONN_QUIESCED);
1976 	connp->conn_ulp_labeled = B_FALSE;
1977 	mutex_exit(&connp->conn_lock);
1978 
1979 	return (0);
1980 }
1981 
1982 /*
1983  * Called in the close path from IP (ip_quiesce_conn) to quiesce the conn
1984  */
1985 void
1986 udp_quiesce_conn(conn_t *connp)
1987 {
1988 	udp_t	*udp = connp->conn_udp;
1989 
1990 	if (cl_inet_unbind != NULL && udp->udp_state == TS_IDLE) {
1991 		/*
1992 		 * Running in cluster mode - register unbind information
1993 		 */
1994 		if (udp->udp_ipversion == IPV4_VERSION) {
1995 			(*cl_inet_unbind)(IPPROTO_UDP, AF_INET,
1996 			    (uint8_t *)(&(V4_PART_OF_V6(udp->udp_v6src))),
1997 			    (in_port_t)udp->udp_port);
1998 		} else {
1999 			(*cl_inet_unbind)(IPPROTO_UDP, AF_INET6,
2000 			    (uint8_t *)(&(udp->udp_v6src)),
2001 			    (in_port_t)udp->udp_port);
2002 		}
2003 	}
2004 
2005 	udp_bind_hash_remove(udp, B_FALSE);
2006 
2007 	mutex_enter(&connp->conn_lock);
2008 	while (udp->udp_reader_count != 0 || udp->udp_squeue_count != 0 ||
2009 	    udp->udp_mode != UDP_MT_HOT) {
2010 		cv_wait(&connp->conn_cv, &connp->conn_lock);
2011 	}
2012 	mutex_exit(&connp->conn_lock);
2013 }
2014 
2015 void
2016 udp_close_free(conn_t *connp)
2017 {
2018 	udp_t *udp = connp->conn_udp;
2019 
2020 	/* If there are any options associated with the stream, free them. */
2021 	if (udp->udp_ip_snd_options) {
2022 		mi_free((char *)udp->udp_ip_snd_options);
2023 		udp->udp_ip_snd_options = NULL;
2024 	}
2025 
2026 	if (udp->udp_ip_rcv_options) {
2027 		mi_free((char *)udp->udp_ip_rcv_options);
2028 		udp->udp_ip_rcv_options = NULL;
2029 	}
2030 
2031 	/* Free memory associated with sticky options */
2032 	if (udp->udp_sticky_hdrs_len != 0) {
2033 		kmem_free(udp->udp_sticky_hdrs,
2034 		    udp->udp_sticky_hdrs_len);
2035 		udp->udp_sticky_hdrs = NULL;
2036 		udp->udp_sticky_hdrs_len = 0;
2037 	}
2038 
2039 	ip6_pkt_free(&udp->udp_sticky_ipp);
2040 
2041 	udp->udp_connp = NULL;
2042 	connp->conn_udp = NULL;
2043 	kmem_cache_free(udp_cache, udp);
2044 }
2045 
2046 /*
2047  * This routine handles each T_DISCON_REQ message passed to udp
2048  * as an indicating that UDP is no longer connected. This results
2049  * in sending a T_BIND_REQ to IP to restore the binding to just
2050  * the local address/port.
2051  *
2052  * This routine sends down a T_BIND_REQ to IP with the following mblks:
2053  *	T_BIND_REQ	- specifying just the local address/port
2054  *	T_OK_ACK	- for the T_DISCON_REQ
2055  *
2056  * The disconnect completes in udp_rput.
2057  * When a T_BIND_ACK is received the appended T_OK_ACK is sent to the TPI user.
2058  * Should udp_rput receive T_ERROR_ACK for the T_BIND_REQ it will convert
2059  * it to an error ack for the appropriate primitive.
2060  */
2061 static void
2062 udp_disconnect(queue_t *q, mblk_t *mp)
2063 {
2064 	udp_t	*udp = Q_TO_UDP(q);
2065 	mblk_t	*mp1;
2066 	udp_fanout_t *udpf;
2067 
2068 	if (udp->udp_state != TS_DATA_XFER) {
2069 		(void) mi_strlog(q, 1, SL_ERROR|SL_TRACE,
2070 		    "udp_disconnect: bad state, %u", udp->udp_state);
2071 		udp_err_ack(q, mp, TOUTSTATE, 0);
2072 		return;
2073 	}
2074 	udpf = &udp_bind_fanout[UDP_BIND_HASH(udp->udp_port)];
2075 	mutex_enter(&udpf->uf_lock);
2076 	udp->udp_v6src = udp->udp_bound_v6src;
2077 	udp->udp_state = TS_IDLE;
2078 	mutex_exit(&udpf->uf_lock);
2079 
2080 	/*
2081 	 * Send down bind to IP to remove the full binding and revert
2082 	 * to the local address binding.
2083 	 */
2084 	if (udp->udp_family == AF_INET)
2085 		mp1 = udp_ip_bind_mp(udp, O_T_BIND_REQ, sizeof (sin_t));
2086 	else
2087 		mp1 = udp_ip_bind_mp(udp, O_T_BIND_REQ, sizeof (sin6_t));
2088 	if (mp1 == NULL) {
2089 		udp_err_ack(q, mp, TSYSERR, ENOMEM);
2090 		return;
2091 	}
2092 	mp = mi_tpi_ok_ack_alloc(mp);
2093 	if (mp == NULL) {
2094 		/* Unable to reuse the T_DISCON_REQ for the ack. */
2095 		udp_err_ack_prim(q, mp1, T_DISCON_REQ, TSYSERR, ENOMEM);
2096 		return;
2097 	}
2098 
2099 	if (udp->udp_family == AF_INET6) {
2100 		int error;
2101 
2102 		/* Rebuild the header template */
2103 		error = udp_build_hdrs(q, udp);
2104 		if (error != 0) {
2105 			udp_err_ack_prim(q, mp, T_DISCON_REQ, TSYSERR, error);
2106 			freemsg(mp1);
2107 			return;
2108 		}
2109 	}
2110 	mutex_enter(&udpf->uf_lock);
2111 	udp->udp_discon_pending = 1;
2112 	mutex_exit(&udpf->uf_lock);
2113 
2114 	/* Append the T_OK_ACK to the T_BIND_REQ for udp_rput */
2115 	linkb(mp1, mp);
2116 
2117 	if (udp->udp_family == AF_INET6)
2118 		mp1 = ip_bind_v6(q, mp1, udp->udp_connp, NULL);
2119 	else
2120 		mp1 = ip_bind_v4(q, mp1, udp->udp_connp);
2121 
2122 	if (mp1 != NULL)
2123 		udp_rput_other(_RD(q), mp1);
2124 	else
2125 		CONN_INC_REF(udp->udp_connp);
2126 }
2127 
2128 /* This routine creates a T_ERROR_ACK message and passes it upstream. */
2129 static void
2130 udp_err_ack(queue_t *q, mblk_t *mp, t_scalar_t t_error, int sys_error)
2131 {
2132 	if ((mp = mi_tpi_err_ack_alloc(mp, t_error, sys_error)) != NULL)
2133 		putnext(UDP_RD(q), mp);
2134 }
2135 
2136 /* Shorthand to generate and send TPI error acks to our client */
2137 static void
2138 udp_err_ack_prim(queue_t *q, mblk_t *mp, int primitive, t_scalar_t t_error,
2139     int sys_error)
2140 {
2141 	struct T_error_ack	*teackp;
2142 
2143 	if ((mp = tpi_ack_alloc(mp, sizeof (struct T_error_ack),
2144 	    M_PCPROTO, T_ERROR_ACK)) != NULL) {
2145 		teackp = (struct T_error_ack *)mp->b_rptr;
2146 		teackp->ERROR_prim = primitive;
2147 		teackp->TLI_error = t_error;
2148 		teackp->UNIX_error = sys_error;
2149 		putnext(UDP_RD(q), mp);
2150 	}
2151 }
2152 
2153 /*ARGSUSED*/
2154 static int
2155 udp_extra_priv_ports_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr)
2156 {
2157 	int i;
2158 
2159 	for (i = 0; i < udp_g_num_epriv_ports; i++) {
2160 		if (udp_g_epriv_ports[i] != 0)
2161 			(void) mi_mpprintf(mp, "%d ", udp_g_epriv_ports[i]);
2162 	}
2163 	return (0);
2164 }
2165 
2166 /* ARGSUSED */
2167 static int
2168 udp_extra_priv_ports_add(queue_t *q, mblk_t *mp, char *value, caddr_t cp,
2169     cred_t *cr)
2170 {
2171 	long	new_value;
2172 	int	i;
2173 
2174 	/*
2175 	 * Fail the request if the new value does not lie within the
2176 	 * port number limits.
2177 	 */
2178 	if (ddi_strtol(value, NULL, 10, &new_value) != 0 ||
2179 	    new_value <= 0 || new_value >= 65536) {
2180 		return (EINVAL);
2181 	}
2182 
2183 	/* Check if the value is already in the list */
2184 	for (i = 0; i < udp_g_num_epriv_ports; i++) {
2185 		if (new_value == udp_g_epriv_ports[i]) {
2186 			return (EEXIST);
2187 		}
2188 	}
2189 	/* Find an empty slot */
2190 	for (i = 0; i < udp_g_num_epriv_ports; i++) {
2191 		if (udp_g_epriv_ports[i] == 0)
2192 			break;
2193 	}
2194 	if (i == udp_g_num_epriv_ports) {
2195 		return (EOVERFLOW);
2196 	}
2197 
2198 	/* Set the new value */
2199 	udp_g_epriv_ports[i] = (in_port_t)new_value;
2200 	return (0);
2201 }
2202 
2203 /* ARGSUSED */
2204 static int
2205 udp_extra_priv_ports_del(queue_t *q, mblk_t *mp, char *value, caddr_t cp,
2206     cred_t *cr)
2207 {
2208 	long	new_value;
2209 	int	i;
2210 
2211 	/*
2212 	 * Fail the request if the new value does not lie within the
2213 	 * port number limits.
2214 	 */
2215 	if (ddi_strtol(value, NULL, 10, &new_value) != 0 ||
2216 	    new_value <= 0 || new_value >= 65536) {
2217 		return (EINVAL);
2218 	}
2219 
2220 	/* Check that the value is already in the list */
2221 	for (i = 0; i < udp_g_num_epriv_ports; i++) {
2222 		if (udp_g_epriv_ports[i] == new_value)
2223 			break;
2224 	}
2225 	if (i == udp_g_num_epriv_ports) {
2226 		return (ESRCH);
2227 	}
2228 
2229 	/* Clear the value */
2230 	udp_g_epriv_ports[i] = 0;
2231 	return (0);
2232 }
2233 
2234 /* At minimum we need 4 bytes of UDP header */
2235 #define	ICMP_MIN_UDP_HDR	4
2236 
2237 /*
2238  * udp_icmp_error is called by udp_rput to process ICMP msgs. passed up by IP.
2239  * Generates the appropriate T_UDERROR_IND for permanent (non-transient) errors.
2240  * Assumes that IP has pulled up everything up to and including the ICMP header.
2241  * An M_CTL could potentially come here from some other module (i.e. if UDP
2242  * is pushed on some module other than IP). Thus, if we find that the M_CTL
2243  * does not have enough ICMP information , following STREAMS conventions,
2244  * we send it upstream assuming it is an M_CTL we don't understand.
2245  */
2246 static void
2247 udp_icmp_error(queue_t *q, mblk_t *mp)
2248 {
2249 	icmph_t *icmph;
2250 	ipha_t	*ipha;
2251 	int	iph_hdr_length;
2252 	udpha_t	*udpha;
2253 	sin_t	sin;
2254 	sin6_t	sin6;
2255 	mblk_t	*mp1;
2256 	int	error = 0;
2257 	size_t	mp_size = MBLKL(mp);
2258 	udp_t	*udp = Q_TO_UDP(q);
2259 
2260 	/*
2261 	 * Assume IP provides aligned packets - otherwise toss
2262 	 */
2263 	if (!OK_32PTR(mp->b_rptr)) {
2264 		freemsg(mp);
2265 		return;
2266 	}
2267 
2268 	/*
2269 	 * Verify that we have a complete IP header and the application has
2270 	 * asked for errors. If not, send it upstream.
2271 	 */
2272 	if (!udp->udp_dgram_errind || mp_size < sizeof (ipha_t)) {
2273 noticmpv4:
2274 		putnext(UDP_RD(q), mp);
2275 		return;
2276 	}
2277 
2278 	ipha = (ipha_t *)mp->b_rptr;
2279 	/*
2280 	 * Verify IP version. Anything other than IPv4 or IPv6 packet is sent
2281 	 * upstream. ICMPv6  is handled in udp_icmp_error_ipv6.
2282 	 */
2283 	switch (IPH_HDR_VERSION(ipha)) {
2284 	case IPV6_VERSION:
2285 		udp_icmp_error_ipv6(q, mp);
2286 		return;
2287 	case IPV4_VERSION:
2288 		break;
2289 	default:
2290 		goto noticmpv4;
2291 	}
2292 
2293 	/* Skip past the outer IP and ICMP headers */
2294 	iph_hdr_length = IPH_HDR_LENGTH(ipha);
2295 	icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length];
2296 	/*
2297 	 * If we don't have the correct outer IP header length or if the ULP
2298 	 * is not IPPROTO_ICMP or if we don't have a complete inner IP header
2299 	 * send the packet upstream.
2300 	 */
2301 	if (iph_hdr_length < sizeof (ipha_t) ||
2302 	    ipha->ipha_protocol != IPPROTO_ICMP ||
2303 	    (ipha_t *)&icmph[1] + 1 > (ipha_t *)mp->b_wptr) {
2304 		goto noticmpv4;
2305 	}
2306 	ipha = (ipha_t *)&icmph[1];
2307 
2308 	/* Skip past the inner IP and find the ULP header */
2309 	iph_hdr_length = IPH_HDR_LENGTH(ipha);
2310 	udpha = (udpha_t *)((char *)ipha + iph_hdr_length);
2311 	/*
2312 	 * If we don't have the correct inner IP header length or if the ULP
2313 	 * is not IPPROTO_UDP or if we don't have at least ICMP_MIN_UDP_HDR
2314 	 * bytes of UDP header, send it upstream.
2315 	 */
2316 	if (iph_hdr_length < sizeof (ipha_t) ||
2317 	    ipha->ipha_protocol != IPPROTO_UDP ||
2318 	    (uchar_t *)udpha + ICMP_MIN_UDP_HDR > mp->b_wptr) {
2319 		goto noticmpv4;
2320 	}
2321 
2322 	switch (icmph->icmph_type) {
2323 	case ICMP_DEST_UNREACHABLE:
2324 		switch (icmph->icmph_code) {
2325 		case ICMP_FRAGMENTATION_NEEDED:
2326 			/*
2327 			 * IP has already adjusted the path MTU.
2328 			 * XXX Somehow pass MTU indication to application?
2329 			 */
2330 			break;
2331 		case ICMP_PORT_UNREACHABLE:
2332 		case ICMP_PROTOCOL_UNREACHABLE:
2333 			error = ECONNREFUSED;
2334 			break;
2335 		default:
2336 			/* Transient errors */
2337 			break;
2338 		}
2339 		break;
2340 	default:
2341 		/* Transient errors */
2342 		break;
2343 	}
2344 	if (error == 0) {
2345 		freemsg(mp);
2346 		return;
2347 	}
2348 
2349 	switch (udp->udp_family) {
2350 	case AF_INET:
2351 		sin = sin_null;
2352 		sin.sin_family = AF_INET;
2353 		sin.sin_addr.s_addr = ipha->ipha_dst;
2354 		sin.sin_port = udpha->uha_dst_port;
2355 		mp1 = mi_tpi_uderror_ind((char *)&sin, sizeof (sin_t), NULL, 0,
2356 		    error);
2357 		break;
2358 	case AF_INET6:
2359 		sin6 = sin6_null;
2360 		sin6.sin6_family = AF_INET6;
2361 		IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &sin6.sin6_addr);
2362 		sin6.sin6_port = udpha->uha_dst_port;
2363 
2364 		mp1 = mi_tpi_uderror_ind((char *)&sin6, sizeof (sin6_t),
2365 		    NULL, 0, error);
2366 		break;
2367 	}
2368 	if (mp1)
2369 		putnext(UDP_RD(q), mp1);
2370 	freemsg(mp);
2371 }
2372 
2373 /*
2374  * udp_icmp_error_ipv6 is called by udp_icmp_error to process ICMP for IPv6.
2375  * Generates the appropriate T_UDERROR_IND for permanent (non-transient) errors.
2376  * Assumes that IP has pulled up all the extension headers as well as the
2377  * ICMPv6 header.
2378  * An M_CTL could potentially come here from some other module (i.e. if UDP
2379  * is pushed on some module other than IP). Thus, if we find that the M_CTL
2380  * does not have enough ICMP information , following STREAMS conventions,
2381  * we send it upstream assuming it is an M_CTL we don't understand. The reason
2382  * it might get here is if the non-ICMP M_CTL accidently has 6 in the version
2383  * field (when cast to ipha_t in udp_icmp_error).
2384  */
2385 static void
2386 udp_icmp_error_ipv6(queue_t *q, mblk_t *mp)
2387 {
2388 	icmp6_t		*icmp6;
2389 	ip6_t		*ip6h, *outer_ip6h;
2390 	uint16_t	hdr_length;
2391 	uint8_t		*nexthdrp;
2392 	udpha_t		*udpha;
2393 	sin6_t		sin6;
2394 	mblk_t		*mp1;
2395 	int		error = 0;
2396 	size_t		mp_size = MBLKL(mp);
2397 	udp_t		*udp = Q_TO_UDP(q);
2398 
2399 	/*
2400 	 * Verify that we have a complete IP header. If not, send it upstream.
2401 	 */
2402 	if (mp_size < sizeof (ip6_t)) {
2403 noticmpv6:
2404 		putnext(UDP_RD(q), mp);
2405 		return;
2406 	}
2407 
2408 	outer_ip6h = (ip6_t *)mp->b_rptr;
2409 	/*
2410 	 * Verify this is an ICMPV6 packet, else send it upstream
2411 	 */
2412 	if (outer_ip6h->ip6_nxt == IPPROTO_ICMPV6) {
2413 		hdr_length = IPV6_HDR_LEN;
2414 	} else if (!ip_hdr_length_nexthdr_v6(mp, outer_ip6h, &hdr_length,
2415 	    &nexthdrp) ||
2416 	    *nexthdrp != IPPROTO_ICMPV6) {
2417 		goto noticmpv6;
2418 	}
2419 	icmp6 = (icmp6_t *)&mp->b_rptr[hdr_length];
2420 	ip6h = (ip6_t *)&icmp6[1];
2421 	/*
2422 	 * Verify we have a complete ICMP and inner IP header.
2423 	 */
2424 	if ((uchar_t *)&ip6h[1] > mp->b_wptr)
2425 		goto noticmpv6;
2426 
2427 	if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &hdr_length, &nexthdrp))
2428 		goto noticmpv6;
2429 	udpha = (udpha_t *)((char *)ip6h + hdr_length);
2430 	/*
2431 	 * Validate inner header. If the ULP is not IPPROTO_UDP or if we don't
2432 	 * have at least ICMP_MIN_UDP_HDR bytes of  UDP header send the
2433 	 * packet upstream.
2434 	 */
2435 	if ((*nexthdrp != IPPROTO_UDP) ||
2436 	    ((uchar_t *)udpha + ICMP_MIN_UDP_HDR) > mp->b_wptr) {
2437 		goto noticmpv6;
2438 	}
2439 
2440 	switch (icmp6->icmp6_type) {
2441 	case ICMP6_DST_UNREACH:
2442 		switch (icmp6->icmp6_code) {
2443 		case ICMP6_DST_UNREACH_NOPORT:
2444 			error = ECONNREFUSED;
2445 			break;
2446 		case ICMP6_DST_UNREACH_ADMIN:
2447 		case ICMP6_DST_UNREACH_NOROUTE:
2448 		case ICMP6_DST_UNREACH_BEYONDSCOPE:
2449 		case ICMP6_DST_UNREACH_ADDR:
2450 			/* Transient errors */
2451 			break;
2452 		default:
2453 			break;
2454 		}
2455 		break;
2456 	case ICMP6_PACKET_TOO_BIG: {
2457 		struct T_unitdata_ind	*tudi;
2458 		struct T_opthdr		*toh;
2459 		size_t			udi_size;
2460 		mblk_t			*newmp;
2461 		t_scalar_t		opt_length = sizeof (struct T_opthdr) +
2462 		    sizeof (struct ip6_mtuinfo);
2463 		sin6_t			*sin6;
2464 		struct ip6_mtuinfo	*mtuinfo;
2465 
2466 		/*
2467 		 * If the application has requested to receive path mtu
2468 		 * information, send up an empty message containing an
2469 		 * IPV6_PATHMTU ancillary data item.
2470 		 */
2471 		if (!udp->udp_ipv6_recvpathmtu)
2472 			break;
2473 
2474 		udi_size = sizeof (struct T_unitdata_ind) + sizeof (sin6_t) +
2475 		    opt_length;
2476 		if ((newmp = allocb(udi_size, BPRI_MED)) == NULL) {
2477 			BUMP_MIB(&udp_mib, udpInErrors);
2478 			break;
2479 		}
2480 
2481 		/*
2482 		 * newmp->b_cont is left to NULL on purpose.  This is an
2483 		 * empty message containing only ancillary data.
2484 		 */
2485 		newmp->b_datap->db_type = M_PROTO;
2486 		tudi = (struct T_unitdata_ind *)newmp->b_rptr;
2487 		newmp->b_wptr = (uchar_t *)tudi + udi_size;
2488 		tudi->PRIM_type = T_UNITDATA_IND;
2489 		tudi->SRC_length = sizeof (sin6_t);
2490 		tudi->SRC_offset = sizeof (struct T_unitdata_ind);
2491 		tudi->OPT_offset = tudi->SRC_offset + sizeof (sin6_t);
2492 		tudi->OPT_length = opt_length;
2493 
2494 		sin6 = (sin6_t *)&tudi[1];
2495 		bzero(sin6, sizeof (sin6_t));
2496 		sin6->sin6_family = AF_INET6;
2497 		sin6->sin6_addr = udp->udp_v6dst;
2498 
2499 		toh = (struct T_opthdr *)&sin6[1];
2500 		toh->level = IPPROTO_IPV6;
2501 		toh->name = IPV6_PATHMTU;
2502 		toh->len = opt_length;
2503 		toh->status = 0;
2504 
2505 		mtuinfo = (struct ip6_mtuinfo *)&toh[1];
2506 		bzero(mtuinfo, sizeof (struct ip6_mtuinfo));
2507 		mtuinfo->ip6m_addr.sin6_family = AF_INET6;
2508 		mtuinfo->ip6m_addr.sin6_addr = ip6h->ip6_dst;
2509 		mtuinfo->ip6m_mtu = icmp6->icmp6_mtu;
2510 		/*
2511 		 * We've consumed everything we need from the original
2512 		 * message.  Free it, then send our empty message.
2513 		 */
2514 		freemsg(mp);
2515 		putnext(UDP_RD(q), newmp);
2516 		return;
2517 	}
2518 	case ICMP6_TIME_EXCEEDED:
2519 		/* Transient errors */
2520 		break;
2521 	case ICMP6_PARAM_PROB:
2522 		/* If this corresponds to an ICMP_PROTOCOL_UNREACHABLE */
2523 		if (icmp6->icmp6_code == ICMP6_PARAMPROB_NEXTHEADER &&
2524 		    (uchar_t *)ip6h + icmp6->icmp6_pptr ==
2525 		    (uchar_t *)nexthdrp) {
2526 			error = ECONNREFUSED;
2527 			break;
2528 		}
2529 		break;
2530 	}
2531 	if (error == 0) {
2532 		freemsg(mp);
2533 		return;
2534 	}
2535 
2536 	sin6 = sin6_null;
2537 	sin6.sin6_family = AF_INET6;
2538 	sin6.sin6_addr = ip6h->ip6_dst;
2539 	sin6.sin6_port = udpha->uha_dst_port;
2540 	sin6.sin6_flowinfo = ip6h->ip6_vcf & ~IPV6_VERS_AND_FLOW_MASK;
2541 
2542 	mp1 = mi_tpi_uderror_ind((char *)&sin6, sizeof (sin6_t), NULL, 0,
2543 	    error);
2544 	if (mp1)
2545 		putnext(UDP_RD(q), mp1);
2546 	freemsg(mp);
2547 }
2548 
2549 /*
2550  * This routine responds to T_ADDR_REQ messages.  It is called by udp_wput.
2551  * The local address is filled in if endpoint is bound. The remote address
2552  * is filled in if remote address has been precified ("connected endpoint")
2553  * (The concept of connected CLTS sockets is alien to published TPI
2554  *  but we support it anyway).
2555  */
2556 static void
2557 udp_addr_req(queue_t *q, mblk_t *mp)
2558 {
2559 	sin_t	*sin;
2560 	sin6_t	*sin6;
2561 	mblk_t	*ackmp;
2562 	struct T_addr_ack *taa;
2563 	udp_t	*udp = Q_TO_UDP(q);
2564 
2565 	/* Make it large enough for worst case */
2566 	ackmp = reallocb(mp, sizeof (struct T_addr_ack) +
2567 	    2 * sizeof (sin6_t), 1);
2568 	if (ackmp == NULL) {
2569 		udp_err_ack(q, mp, TSYSERR, ENOMEM);
2570 		return;
2571 	}
2572 	taa = (struct T_addr_ack *)ackmp->b_rptr;
2573 
2574 	bzero(taa, sizeof (struct T_addr_ack));
2575 	ackmp->b_wptr = (uchar_t *)&taa[1];
2576 
2577 	taa->PRIM_type = T_ADDR_ACK;
2578 	ackmp->b_datap->db_type = M_PCPROTO;
2579 	/*
2580 	 * Note: Following code assumes 32 bit alignment of basic
2581 	 * data structures like sin_t and struct T_addr_ack.
2582 	 */
2583 	if (udp->udp_state != TS_UNBND) {
2584 		/*
2585 		 * Fill in local address first
2586 		 */
2587 		taa->LOCADDR_offset = sizeof (*taa);
2588 		if (udp->udp_family == AF_INET) {
2589 			taa->LOCADDR_length = sizeof (sin_t);
2590 			sin = (sin_t *)&taa[1];
2591 			/* Fill zeroes and then initialize non-zero fields */
2592 			*sin = sin_null;
2593 			sin->sin_family = AF_INET;
2594 			if (!IN6_IS_ADDR_V4MAPPED_ANY(&udp->udp_v6src) &&
2595 			    !IN6_IS_ADDR_UNSPECIFIED(&udp->udp_v6src)) {
2596 				IN6_V4MAPPED_TO_IPADDR(&udp->udp_v6src,
2597 				    sin->sin_addr.s_addr);
2598 			} else {
2599 				/*
2600 				 * INADDR_ANY
2601 				 * udp_v6src is not set, we might be bound to
2602 				 * broadcast/multicast. Use udp_bound_v6src as
2603 				 * local address instead (that could
2604 				 * also still be INADDR_ANY)
2605 				 */
2606 				IN6_V4MAPPED_TO_IPADDR(&udp->udp_bound_v6src,
2607 				    sin->sin_addr.s_addr);
2608 			}
2609 			sin->sin_port = udp->udp_port;
2610 			ackmp->b_wptr = (uchar_t *)&sin[1];
2611 			if (udp->udp_state == TS_DATA_XFER) {
2612 				/*
2613 				 * connected, fill remote address too
2614 				 */
2615 				taa->REMADDR_length = sizeof (sin_t);
2616 				/* assumed 32-bit alignment */
2617 				taa->REMADDR_offset = taa->LOCADDR_offset +
2618 				    taa->LOCADDR_length;
2619 
2620 				sin = (sin_t *)(ackmp->b_rptr +
2621 				    taa->REMADDR_offset);
2622 				/* initialize */
2623 				*sin = sin_null;
2624 				sin->sin_family = AF_INET;
2625 				sin->sin_addr.s_addr =
2626 				    V4_PART_OF_V6(udp->udp_v6dst);
2627 				sin->sin_port = udp->udp_dstport;
2628 				ackmp->b_wptr = (uchar_t *)&sin[1];
2629 			}
2630 		} else {
2631 			taa->LOCADDR_length = sizeof (sin6_t);
2632 			sin6 = (sin6_t *)&taa[1];
2633 			/* Fill zeroes and then initialize non-zero fields */
2634 			*sin6 = sin6_null;
2635 			sin6->sin6_family = AF_INET6;
2636 			if (!IN6_IS_ADDR_UNSPECIFIED(&udp->udp_v6src)) {
2637 				sin6->sin6_addr = udp->udp_v6src;
2638 			} else {
2639 				/*
2640 				 * UNSPECIFIED
2641 				 * udp_v6src is not set, we might be bound to
2642 				 * broadcast/multicast. Use udp_bound_v6src as
2643 				 * local address instead (that could
2644 				 * also still be UNSPECIFIED)
2645 				 */
2646 				sin6->sin6_addr =
2647 				    udp->udp_bound_v6src;
2648 			}
2649 			sin6->sin6_port = udp->udp_port;
2650 			ackmp->b_wptr = (uchar_t *)&sin6[1];
2651 			if (udp->udp_state == TS_DATA_XFER) {
2652 				/*
2653 				 * connected, fill remote address too
2654 				 */
2655 				taa->REMADDR_length = sizeof (sin6_t);
2656 				/* assumed 32-bit alignment */
2657 				taa->REMADDR_offset = taa->LOCADDR_offset +
2658 				    taa->LOCADDR_length;
2659 
2660 				sin6 = (sin6_t *)(ackmp->b_rptr +
2661 				    taa->REMADDR_offset);
2662 				/* initialize */
2663 				*sin6 = sin6_null;
2664 				sin6->sin6_family = AF_INET6;
2665 				sin6->sin6_addr = udp->udp_v6dst;
2666 				sin6->sin6_port =  udp->udp_dstport;
2667 				ackmp->b_wptr = (uchar_t *)&sin6[1];
2668 			}
2669 			ackmp->b_wptr = (uchar_t *)&sin6[1];
2670 		}
2671 	}
2672 	ASSERT(ackmp->b_wptr <= ackmp->b_datap->db_lim);
2673 	putnext(UDP_RD(q), ackmp);
2674 }
2675 
2676 static void
2677 udp_copy_info(struct T_info_ack *tap, udp_t *udp)
2678 {
2679 	if (udp->udp_family == AF_INET) {
2680 		*tap = udp_g_t_info_ack_ipv4;
2681 	} else {
2682 		*tap = udp_g_t_info_ack_ipv6;
2683 	}
2684 	tap->CURRENT_state = udp->udp_state;
2685 	tap->OPT_size = udp_max_optsize;
2686 }
2687 
2688 /*
2689  * This routine responds to T_CAPABILITY_REQ messages.  It is called by
2690  * udp_wput.  Much of the T_CAPABILITY_ACK information is copied from
2691  * udp_g_t_info_ack.  The current state of the stream is copied from
2692  * udp_state.
2693  */
2694 static void
2695 udp_capability_req(queue_t *q, mblk_t *mp)
2696 {
2697 	t_uscalar_t		cap_bits1;
2698 	struct T_capability_ack	*tcap;
2699 	udp_t	*udp = Q_TO_UDP(q);
2700 
2701 	cap_bits1 = ((struct T_capability_req *)mp->b_rptr)->CAP_bits1;
2702 
2703 	mp = tpi_ack_alloc(mp, sizeof (struct T_capability_ack),
2704 	    mp->b_datap->db_type, T_CAPABILITY_ACK);
2705 	if (!mp)
2706 		return;
2707 
2708 	tcap = (struct T_capability_ack *)mp->b_rptr;
2709 	tcap->CAP_bits1 = 0;
2710 
2711 	if (cap_bits1 & TC1_INFO) {
2712 		udp_copy_info(&tcap->INFO_ack, udp);
2713 		tcap->CAP_bits1 |= TC1_INFO;
2714 	}
2715 
2716 	putnext(UDP_RD(q), mp);
2717 }
2718 
2719 /*
2720  * This routine responds to T_INFO_REQ messages.  It is called by udp_wput.
2721  * Most of the T_INFO_ACK information is copied from udp_g_t_info_ack.
2722  * The current state of the stream is copied from udp_state.
2723  */
2724 static void
2725 udp_info_req(queue_t *q, mblk_t *mp)
2726 {
2727 	udp_t *udp = Q_TO_UDP(q);
2728 
2729 	/* Create a T_INFO_ACK message. */
2730 	mp = tpi_ack_alloc(mp, sizeof (struct T_info_ack), M_PCPROTO,
2731 	    T_INFO_ACK);
2732 	if (!mp)
2733 		return;
2734 	udp_copy_info((struct T_info_ack *)mp->b_rptr, udp);
2735 	putnext(UDP_RD(q), mp);
2736 }
2737 
2738 /*
2739  * IP recognizes seven kinds of bind requests:
2740  *
2741  * - A zero-length address binds only to the protocol number.
2742  *
2743  * - A 4-byte address is treated as a request to
2744  * validate that the address is a valid local IPv4
2745  * address, appropriate for an application to bind to.
2746  * IP does the verification, but does not make any note
2747  * of the address at this time.
2748  *
2749  * - A 16-byte address contains is treated as a request
2750  * to validate a local IPv6 address, as the 4-byte
2751  * address case above.
2752  *
2753  * - A 16-byte sockaddr_in to validate the local IPv4 address and also
2754  * use it for the inbound fanout of packets.
2755  *
2756  * - A 24-byte sockaddr_in6 to validate the local IPv6 address and also
2757  * use it for the inbound fanout of packets.
2758  *
2759  * - A 12-byte address (ipa_conn_t) containing complete IPv4 fanout
2760  * information consisting of local and remote addresses
2761  * and ports.  In this case, the addresses are both
2762  * validated as appropriate for this operation, and, if
2763  * so, the information is retained for use in the
2764  * inbound fanout.
2765  *
2766  * - A 36-byte address address (ipa6_conn_t) containing complete IPv6
2767  * fanout information, like the 12-byte case above.
2768  *
2769  * IP will also fill in the IRE request mblk with information
2770  * regarding our peer.  In all cases, we notify IP of our protocol
2771  * type by appending a single protocol byte to the bind request.
2772  */
2773 static mblk_t *
2774 udp_ip_bind_mp(udp_t *udp, t_scalar_t bind_prim, t_scalar_t addr_length)
2775 {
2776 	char	*cp;
2777 	mblk_t	*mp;
2778 	struct T_bind_req *tbr;
2779 	ipa_conn_t	*ac;
2780 	ipa6_conn_t	*ac6;
2781 	sin_t		*sin;
2782 	sin6_t		*sin6;
2783 
2784 	ASSERT(bind_prim == O_T_BIND_REQ || bind_prim == T_BIND_REQ);
2785 
2786 	mp = allocb(sizeof (*tbr) + addr_length + 1, BPRI_HI);
2787 	if (!mp)
2788 		return (mp);
2789 	mp->b_datap->db_type = M_PROTO;
2790 	tbr = (struct T_bind_req *)mp->b_rptr;
2791 	tbr->PRIM_type = bind_prim;
2792 	tbr->ADDR_offset = sizeof (*tbr);
2793 	tbr->CONIND_number = 0;
2794 	tbr->ADDR_length = addr_length;
2795 	cp = (char *)&tbr[1];
2796 	switch (addr_length) {
2797 	case sizeof (ipa_conn_t):
2798 		ASSERT(udp->udp_family == AF_INET);
2799 		/* Append a request for an IRE */
2800 		mp->b_cont = allocb(sizeof (ire_t), BPRI_HI);
2801 		if (!mp->b_cont) {
2802 			freemsg(mp);
2803 			return (NULL);
2804 		}
2805 		mp->b_cont->b_wptr += sizeof (ire_t);
2806 		mp->b_cont->b_datap->db_type = IRE_DB_REQ_TYPE;
2807 
2808 		/* cp known to be 32 bit aligned */
2809 		ac = (ipa_conn_t *)cp;
2810 		ac->ac_laddr = V4_PART_OF_V6(udp->udp_v6src);
2811 		ac->ac_faddr = V4_PART_OF_V6(udp->udp_v6dst);
2812 		ac->ac_fport = udp->udp_dstport;
2813 		ac->ac_lport = udp->udp_port;
2814 		break;
2815 
2816 	case sizeof (ipa6_conn_t):
2817 		ASSERT(udp->udp_family == AF_INET6);
2818 		/* Append a request for an IRE */
2819 		mp->b_cont = allocb(sizeof (ire_t), BPRI_HI);
2820 		if (!mp->b_cont) {
2821 			freemsg(mp);
2822 			return (NULL);
2823 		}
2824 		mp->b_cont->b_wptr += sizeof (ire_t);
2825 		mp->b_cont->b_datap->db_type = IRE_DB_REQ_TYPE;
2826 
2827 		/* cp known to be 32 bit aligned */
2828 		ac6 = (ipa6_conn_t *)cp;
2829 		ac6->ac6_laddr = udp->udp_v6src;
2830 		ac6->ac6_faddr = udp->udp_v6dst;
2831 		ac6->ac6_fport = udp->udp_dstport;
2832 		ac6->ac6_lport = udp->udp_port;
2833 		break;
2834 
2835 	case sizeof (sin_t):
2836 		ASSERT(udp->udp_family == AF_INET);
2837 		/* Append a request for an IRE */
2838 		mp->b_cont = allocb(sizeof (ire_t), BPRI_HI);
2839 		if (!mp->b_cont) {
2840 			freemsg(mp);
2841 			return (NULL);
2842 		}
2843 		mp->b_cont->b_wptr += sizeof (ire_t);
2844 		mp->b_cont->b_datap->db_type = IRE_DB_REQ_TYPE;
2845 
2846 		sin = (sin_t *)cp;
2847 		*sin = sin_null;
2848 		sin->sin_family = AF_INET;
2849 		sin->sin_addr.s_addr = V4_PART_OF_V6(udp->udp_bound_v6src);
2850 		sin->sin_port = udp->udp_port;
2851 		break;
2852 
2853 	case sizeof (sin6_t):
2854 		ASSERT(udp->udp_family == AF_INET6);
2855 		/* Append a request for an IRE */
2856 		mp->b_cont = allocb(sizeof (ire_t), BPRI_HI);
2857 		if (!mp->b_cont) {
2858 			freemsg(mp);
2859 			return (NULL);
2860 		}
2861 		mp->b_cont->b_wptr += sizeof (ire_t);
2862 		mp->b_cont->b_datap->db_type = IRE_DB_REQ_TYPE;
2863 
2864 		sin6 = (sin6_t *)cp;
2865 		*sin6 = sin6_null;
2866 		sin6->sin6_family = AF_INET6;
2867 		sin6->sin6_addr = udp->udp_bound_v6src;
2868 		sin6->sin6_port = udp->udp_port;
2869 		break;
2870 	}
2871 	/* Add protocol number to end */
2872 	cp[addr_length] = (char)IPPROTO_UDP;
2873 	mp->b_wptr = (uchar_t *)&cp[addr_length + 1];
2874 	return (mp);
2875 }
2876 
2877 /*
2878  * This is the open routine for udp.  It allocates a udp_t structure for
2879  * the stream and, on the first open of the module, creates an ND table.
2880  */
2881 /* ARGSUSED */
2882 static int
2883 udp_open(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp)
2884 {
2885 	int	err;
2886 	udp_t	*udp;
2887 	conn_t *connp;
2888 	zoneid_t zoneid = getzoneid();
2889 	queue_t	*ip_wq;
2890 	char	*name;
2891 
2892 	TRACE_1(TR_FAC_UDP, TR_UDP_OPEN, "udp_open: q %p", q);
2893 
2894 	/* If the stream is already open, return immediately. */
2895 	if (q->q_ptr != NULL)
2896 		return (0);
2897 
2898 	/* If this is not a push of udp as a module, fail. */
2899 	if (sflag != MODOPEN)
2900 		return (EINVAL);
2901 
2902 	q->q_hiwat = udp_recv_hiwat;
2903 	WR(q)->q_hiwat = udp_xmit_hiwat;
2904 	WR(q)->q_lowat = udp_xmit_lowat;
2905 
2906 	/* Insert ourselves in the stream since we're about to walk q_next */
2907 	qprocson(q);
2908 
2909 	udp = kmem_cache_alloc(udp_cache, KM_SLEEP);
2910 	bzero(udp, sizeof (*udp));
2911 
2912 	/*
2913 	 * UDP is supported only as a module and it has to be pushed directly
2914 	 * above the device instance of IP. If UDP is pushed anywhere else
2915 	 * on a stream, it will support just T_SVR4_OPTMGMT_REQ for the
2916 	 * sake of MIB browsers and fail everything else.
2917 	 */
2918 	ip_wq = WR(q)->q_next;
2919 	if (ip_wq->q_next != NULL ||
2920 	    (name = ip_wq->q_qinfo->qi_minfo->mi_idname) == NULL ||
2921 	    strcmp(name, IP_MOD_NAME) != 0 ||
2922 	    ip_wq->q_qinfo->qi_minfo->mi_idnum != IP_MOD_ID) {
2923 		/* Support just SNMP for MIB browsers */
2924 		connp = ipcl_conn_create(IPCL_IPCCONN, KM_SLEEP);
2925 		connp->conn_rq = q;
2926 		connp->conn_wq = WR(q);
2927 		connp->conn_flags |= IPCL_UDPMOD;
2928 		connp->conn_cred = credp;
2929 		connp->conn_zoneid = zoneid;
2930 		connp->conn_udp = udp;
2931 		udp->udp_connp = connp;
2932 		q->q_ptr = WR(q)->q_ptr = connp;
2933 		crhold(credp);
2934 		q->q_qinfo = &udp_snmp_rinit;
2935 		WR(q)->q_qinfo = &udp_snmp_winit;
2936 		return (0);
2937 	}
2938 
2939 	/*
2940 	 * Initialize the udp_t structure for this stream.
2941 	 */
2942 	q = RD(ip_wq);
2943 	connp = Q_TO_CONN(q);
2944 	mutex_enter(&connp->conn_lock);
2945 	connp->conn_proto = IPPROTO_UDP;
2946 	connp->conn_flags |= IPCL_UDP;
2947 	connp->conn_sqp = IP_SQUEUE_GET(lbolt);
2948 	connp->conn_udp = udp;
2949 
2950 	/* Set the initial state of the stream and the privilege status. */
2951 	udp->udp_connp = connp;
2952 	udp->udp_state = TS_UNBND;
2953 	udp->udp_mode = UDP_MT_HOT;
2954 	if (getmajor(*devp) == (major_t)UDP6_MAJ) {
2955 		udp->udp_family = AF_INET6;
2956 		udp->udp_ipversion = IPV6_VERSION;
2957 		udp->udp_max_hdr_len = IPV6_HDR_LEN + UDPH_SIZE;
2958 		udp->udp_ttl = udp_ipv6_hoplimit;
2959 		connp->conn_af_isv6 = B_TRUE;
2960 		connp->conn_flags |= IPCL_ISV6;
2961 	} else {
2962 		udp->udp_family = AF_INET;
2963 		udp->udp_ipversion = IPV4_VERSION;
2964 		udp->udp_max_hdr_len = IP_SIMPLE_HDR_LENGTH + UDPH_SIZE;
2965 		udp->udp_ttl = udp_ipv4_ttl;
2966 		connp->conn_af_isv6 = B_FALSE;
2967 		connp->conn_flags &= ~IPCL_ISV6;
2968 	}
2969 
2970 	udp->udp_multicast_ttl = IP_DEFAULT_MULTICAST_TTL;
2971 	connp->conn_multicast_loop = IP_DEFAULT_MULTICAST_LOOP;
2972 	connp->conn_zoneid = zoneid;
2973 
2974 	/*
2975 	 * If the caller has the process-wide flag set, then default to MAC
2976 	 * exempt mode.  This allows read-down to unlabeled hosts.
2977 	 */
2978 	if (getpflags(NET_MAC_AWARE, credp) != 0)
2979 		udp->udp_mac_exempt = B_TRUE;
2980 
2981 	if (connp->conn_flags & IPCL_SOCKET) {
2982 		udp->udp_issocket = B_TRUE;
2983 		udp->udp_direct_sockfs = B_TRUE;
2984 	}
2985 
2986 	connp->conn_ulp_labeled = is_system_labeled();
2987 
2988 	mutex_exit(&connp->conn_lock);
2989 
2990 	/*
2991 	 * The transmit hiwat/lowat is only looked at on IP's queue.
2992 	 * Store in q_hiwat in order to return on SO_SNDBUF/SO_RCVBUF
2993 	 * getsockopts.
2994 	 */
2995 	q->q_hiwat = udp_recv_hiwat;
2996 	WR(q)->q_hiwat = udp_xmit_hiwat;
2997 	WR(q)->q_lowat = udp_xmit_lowat;
2998 
2999 	if (udp->udp_family == AF_INET6) {
3000 		/* Build initial header template for transmit */
3001 		if ((err = udp_build_hdrs(q, udp)) != 0) {
3002 error:
3003 			qprocsoff(UDP_RD(q));
3004 			udp->udp_connp = NULL;
3005 			connp->conn_udp = NULL;
3006 			kmem_cache_free(udp_cache, udp);
3007 			return (err);
3008 		}
3009 	}
3010 
3011 	/* Set the Stream head write offset and high watermark. */
3012 	(void) mi_set_sth_wroff(UDP_RD(q),
3013 	    udp->udp_max_hdr_len + udp_wroff_extra);
3014 	(void) mi_set_sth_hiwat(UDP_RD(q), udp_set_rcv_hiwat(udp, q->q_hiwat));
3015 
3016 	WR(UDP_RD(q))->q_qinfo = &udp_winit;
3017 
3018 	return (0);
3019 }
3020 
3021 /*
3022  * Which UDP options OK to set through T_UNITDATA_REQ...
3023  */
3024 /* ARGSUSED */
3025 static boolean_t
3026 udp_opt_allow_udr_set(t_scalar_t level, t_scalar_t name)
3027 {
3028 	return (B_TRUE);
3029 }
3030 
3031 /*
3032  * This routine gets default values of certain options whose default
3033  * values are maintained by protcol specific code
3034  */
3035 /* ARGSUSED */
3036 int
3037 udp_opt_default(queue_t	*q, t_scalar_t level, t_scalar_t name, uchar_t *ptr)
3038 {
3039 	int *i1 = (int *)ptr;
3040 
3041 	switch (level) {
3042 	case IPPROTO_IP:
3043 		switch (name) {
3044 		case IP_MULTICAST_TTL:
3045 			*ptr = (uchar_t)IP_DEFAULT_MULTICAST_TTL;
3046 			return (sizeof (uchar_t));
3047 		case IP_MULTICAST_LOOP:
3048 			*ptr = (uchar_t)IP_DEFAULT_MULTICAST_LOOP;
3049 			return (sizeof (uchar_t));
3050 		}
3051 		break;
3052 	case IPPROTO_IPV6:
3053 		switch (name) {
3054 		case IPV6_MULTICAST_HOPS:
3055 			*i1 = IP_DEFAULT_MULTICAST_TTL;
3056 			return (sizeof (int));
3057 		case IPV6_MULTICAST_LOOP:
3058 			*i1 = IP_DEFAULT_MULTICAST_LOOP;
3059 			return (sizeof (int));
3060 		case IPV6_UNICAST_HOPS:
3061 			*i1 = udp_ipv6_hoplimit;
3062 			return (sizeof (int));
3063 		}
3064 		break;
3065 	}
3066 	return (-1);
3067 }
3068 
3069 /*
3070  * This routine retrieves the current status of socket options
3071  * and expects the caller to pass in the queue pointer of the
3072  * upper instance.  It returns the size of the option retrieved.
3073  */
3074 int
3075 udp_opt_get(queue_t *q, t_scalar_t level, t_scalar_t name, uchar_t *ptr)
3076 {
3077 	int	*i1 = (int *)ptr;
3078 	conn_t	*connp;
3079 	udp_t	*udp;
3080 	ip6_pkt_t *ipp;
3081 	int	len;
3082 
3083 	q = UDP_WR(q);
3084 	connp = Q_TO_CONN(q);
3085 	udp = connp->conn_udp;
3086 	ipp = &udp->udp_sticky_ipp;
3087 
3088 	switch (level) {
3089 	case SOL_SOCKET:
3090 		switch (name) {
3091 		case SO_DEBUG:
3092 			*i1 = udp->udp_debug;
3093 			break;	/* goto sizeof (int) option return */
3094 		case SO_REUSEADDR:
3095 			*i1 = udp->udp_reuseaddr;
3096 			break;	/* goto sizeof (int) option return */
3097 		case SO_TYPE:
3098 			*i1 = SOCK_DGRAM;
3099 			break;	/* goto sizeof (int) option return */
3100 
3101 		/*
3102 		 * The following three items are available here,
3103 		 * but are only meaningful to IP.
3104 		 */
3105 		case SO_DONTROUTE:
3106 			*i1 = udp->udp_dontroute;
3107 			break;	/* goto sizeof (int) option return */
3108 		case SO_USELOOPBACK:
3109 			*i1 = udp->udp_useloopback;
3110 			break;	/* goto sizeof (int) option return */
3111 		case SO_BROADCAST:
3112 			*i1 = udp->udp_broadcast;
3113 			break;	/* goto sizeof (int) option return */
3114 
3115 		case SO_SNDBUF:
3116 			*i1 = q->q_hiwat;
3117 			break;	/* goto sizeof (int) option return */
3118 		case SO_RCVBUF:
3119 			*i1 = RD(q)->q_hiwat;
3120 			break;	/* goto sizeof (int) option return */
3121 		case SO_DGRAM_ERRIND:
3122 			*i1 = udp->udp_dgram_errind;
3123 			break;	/* goto sizeof (int) option return */
3124 		case SO_RECVUCRED:
3125 			*i1 = udp->udp_recvucred;
3126 			break;	/* goto sizeof (int) option return */
3127 		case SO_TIMESTAMP:
3128 			*i1 = udp->udp_timestamp;
3129 			break;	/* goto sizeof (int) option return */
3130 		case SO_ANON_MLP:
3131 			*i1 = udp->udp_anon_mlp;
3132 			break;	/* goto sizeof (int) option return */
3133 		case SO_MAC_EXEMPT:
3134 			*i1 = udp->udp_mac_exempt;
3135 			break;	/* goto sizeof (int) option return */
3136 		case SO_ALLZONES:
3137 			*i1 = connp->conn_allzones;
3138 			break;	/* goto sizeof (int) option return */
3139 		case SO_EXCLBIND:
3140 			*i1 = udp->udp_exclbind ? SO_EXCLBIND : 0;
3141 			break;
3142 		default:
3143 			return (-1);
3144 		}
3145 		break;
3146 	case IPPROTO_IP:
3147 		if (udp->udp_family != AF_INET)
3148 			return (-1);
3149 		switch (name) {
3150 		case IP_OPTIONS:
3151 		case T_IP_OPTIONS:
3152 			len = udp->udp_ip_rcv_options_len - udp->udp_label_len;
3153 			if (len > 0) {
3154 				bcopy(udp->udp_ip_rcv_options +
3155 				    udp->udp_label_len, ptr, len);
3156 			}
3157 			return (len);
3158 		case IP_TOS:
3159 		case T_IP_TOS:
3160 			*i1 = (int)udp->udp_type_of_service;
3161 			break;	/* goto sizeof (int) option return */
3162 		case IP_TTL:
3163 			*i1 = (int)udp->udp_ttl;
3164 			break;	/* goto sizeof (int) option return */
3165 		case IP_NEXTHOP:
3166 			/* Handled at IP level */
3167 			return (-EINVAL);
3168 		case IP_MULTICAST_IF:
3169 			/* 0 address if not set */
3170 			*(ipaddr_t *)ptr = udp->udp_multicast_if_addr;
3171 			return (sizeof (ipaddr_t));
3172 		case IP_MULTICAST_TTL:
3173 			*(uchar_t *)ptr = udp->udp_multicast_ttl;
3174 			return (sizeof (uchar_t));
3175 		case IP_MULTICAST_LOOP:
3176 			*ptr = connp->conn_multicast_loop;
3177 			return (sizeof (uint8_t));
3178 		case IP_RECVOPTS:
3179 			*i1 = udp->udp_recvopts;
3180 			break;	/* goto sizeof (int) option return */
3181 		case IP_RECVDSTADDR:
3182 			*i1 = udp->udp_recvdstaddr;
3183 			break;	/* goto sizeof (int) option return */
3184 		case IP_RECVIF:
3185 			*i1 = udp->udp_recvif;
3186 			break;	/* goto sizeof (int) option return */
3187 		case IP_RECVSLLA:
3188 			*i1 = udp->udp_recvslla;
3189 			break;	/* goto sizeof (int) option return */
3190 		case IP_RECVTTL:
3191 			*i1 = udp->udp_recvttl;
3192 			break;	/* goto sizeof (int) option return */
3193 		case IP_ADD_MEMBERSHIP:
3194 		case IP_DROP_MEMBERSHIP:
3195 		case IP_BLOCK_SOURCE:
3196 		case IP_UNBLOCK_SOURCE:
3197 		case IP_ADD_SOURCE_MEMBERSHIP:
3198 		case IP_DROP_SOURCE_MEMBERSHIP:
3199 		case MCAST_JOIN_GROUP:
3200 		case MCAST_LEAVE_GROUP:
3201 		case MCAST_BLOCK_SOURCE:
3202 		case MCAST_UNBLOCK_SOURCE:
3203 		case MCAST_JOIN_SOURCE_GROUP:
3204 		case MCAST_LEAVE_SOURCE_GROUP:
3205 		case IP_DONTFAILOVER_IF:
3206 			/* cannot "get" the value for these */
3207 			return (-1);
3208 		case IP_BOUND_IF:
3209 			/* Zero if not set */
3210 			*i1 = udp->udp_bound_if;
3211 			break;	/* goto sizeof (int) option return */
3212 		case IP_UNSPEC_SRC:
3213 			*i1 = udp->udp_unspec_source;
3214 			break;	/* goto sizeof (int) option return */
3215 		case IP_XMIT_IF:
3216 			*i1 = udp->udp_xmit_if;
3217 			break; /* goto sizeof (int) option return */
3218 		default:
3219 			return (-1);
3220 		}
3221 		break;
3222 	case IPPROTO_IPV6:
3223 		if (udp->udp_family != AF_INET6)
3224 			return (-1);
3225 		switch (name) {
3226 		case IPV6_UNICAST_HOPS:
3227 			*i1 = (unsigned int)udp->udp_ttl;
3228 			break;	/* goto sizeof (int) option return */
3229 		case IPV6_MULTICAST_IF:
3230 			/* 0 index if not set */
3231 			*i1 = udp->udp_multicast_if_index;
3232 			break;	/* goto sizeof (int) option return */
3233 		case IPV6_MULTICAST_HOPS:
3234 			*i1 = udp->udp_multicast_ttl;
3235 			break;	/* goto sizeof (int) option return */
3236 		case IPV6_MULTICAST_LOOP:
3237 			*i1 = connp->conn_multicast_loop;
3238 			break;	/* goto sizeof (int) option return */
3239 		case IPV6_JOIN_GROUP:
3240 		case IPV6_LEAVE_GROUP:
3241 		case MCAST_JOIN_GROUP:
3242 		case MCAST_LEAVE_GROUP:
3243 		case MCAST_BLOCK_SOURCE:
3244 		case MCAST_UNBLOCK_SOURCE:
3245 		case MCAST_JOIN_SOURCE_GROUP:
3246 		case MCAST_LEAVE_SOURCE_GROUP:
3247 			/* cannot "get" the value for these */
3248 			return (-1);
3249 		case IPV6_BOUND_IF:
3250 			/* Zero if not set */
3251 			*i1 = udp->udp_bound_if;
3252 			break;	/* goto sizeof (int) option return */
3253 		case IPV6_UNSPEC_SRC:
3254 			*i1 = udp->udp_unspec_source;
3255 			break;	/* goto sizeof (int) option return */
3256 		case IPV6_RECVPKTINFO:
3257 			*i1 = udp->udp_ipv6_recvpktinfo;
3258 			break;	/* goto sizeof (int) option return */
3259 		case IPV6_RECVTCLASS:
3260 			*i1 = udp->udp_ipv6_recvtclass;
3261 			break;	/* goto sizeof (int) option return */
3262 		case IPV6_RECVPATHMTU:
3263 			*i1 = udp->udp_ipv6_recvpathmtu;
3264 			break;	/* goto sizeof (int) option return */
3265 		case IPV6_RECVHOPLIMIT:
3266 			*i1 = udp->udp_ipv6_recvhoplimit;
3267 			break;	/* goto sizeof (int) option return */
3268 		case IPV6_RECVHOPOPTS:
3269 			*i1 = udp->udp_ipv6_recvhopopts;
3270 			break;	/* goto sizeof (int) option return */
3271 		case IPV6_RECVDSTOPTS:
3272 			*i1 = udp->udp_ipv6_recvdstopts;
3273 			break;	/* goto sizeof (int) option return */
3274 		case _OLD_IPV6_RECVDSTOPTS:
3275 			*i1 = udp->udp_old_ipv6_recvdstopts;
3276 			break;	/* goto sizeof (int) option return */
3277 		case IPV6_RECVRTHDRDSTOPTS:
3278 			*i1 = udp->udp_ipv6_recvrthdrdstopts;
3279 			break;	/* goto sizeof (int) option return */
3280 		case IPV6_RECVRTHDR:
3281 			*i1 = udp->udp_ipv6_recvrthdr;
3282 			break;	/* goto sizeof (int) option return */
3283 		case IPV6_PKTINFO: {
3284 			/* XXX assumes that caller has room for max size! */
3285 			struct in6_pktinfo *pkti;
3286 
3287 			pkti = (struct in6_pktinfo *)ptr;
3288 			if (ipp->ipp_fields & IPPF_IFINDEX)
3289 				pkti->ipi6_ifindex = ipp->ipp_ifindex;
3290 			else
3291 				pkti->ipi6_ifindex = 0;
3292 			if (ipp->ipp_fields & IPPF_ADDR)
3293 				pkti->ipi6_addr = ipp->ipp_addr;
3294 			else
3295 				pkti->ipi6_addr = ipv6_all_zeros;
3296 			return (sizeof (struct in6_pktinfo));
3297 		}
3298 		case IPV6_TCLASS:
3299 			if (ipp->ipp_fields & IPPF_TCLASS)
3300 				*i1 = ipp->ipp_tclass;
3301 			else
3302 				*i1 = IPV6_FLOW_TCLASS(
3303 				    IPV6_DEFAULT_VERS_AND_FLOW);
3304 			break;	/* goto sizeof (int) option return */
3305 		case IPV6_NEXTHOP: {
3306 			sin6_t *sin6 = (sin6_t *)ptr;
3307 
3308 			if (!(ipp->ipp_fields & IPPF_NEXTHOP))
3309 				return (0);
3310 			*sin6 = sin6_null;
3311 			sin6->sin6_family = AF_INET6;
3312 			sin6->sin6_addr = ipp->ipp_nexthop;
3313 			return (sizeof (sin6_t));
3314 		}
3315 		case IPV6_HOPOPTS:
3316 			if (!(ipp->ipp_fields & IPPF_HOPOPTS))
3317 				return (0);
3318 			if (ipp->ipp_hopoptslen <= udp->udp_label_len_v6)
3319 				return (0);
3320 			/*
3321 			 * The cipso/label option is added by kernel.
3322 			 * User is not usually aware of this option.
3323 			 * We copy out the hbh opt after the label option.
3324 			 */
3325 			bcopy((char *)ipp->ipp_hopopts + udp->udp_label_len_v6,
3326 			    ptr, ipp->ipp_hopoptslen - udp->udp_label_len_v6);
3327 			if (udp->udp_label_len_v6 > 0) {
3328 				ptr[0] = ((char *)ipp->ipp_hopopts)[0];
3329 				ptr[1] = (ipp->ipp_hopoptslen -
3330 				    udp->udp_label_len_v6 + 7) / 8 - 1;
3331 			}
3332 			return (ipp->ipp_hopoptslen - udp->udp_label_len_v6);
3333 		case IPV6_RTHDRDSTOPTS:
3334 			if (!(ipp->ipp_fields & IPPF_RTDSTOPTS))
3335 				return (0);
3336 			bcopy(ipp->ipp_rtdstopts, ptr, ipp->ipp_rtdstoptslen);
3337 			return (ipp->ipp_rtdstoptslen);
3338 		case IPV6_RTHDR:
3339 			if (!(ipp->ipp_fields & IPPF_RTHDR))
3340 				return (0);
3341 			bcopy(ipp->ipp_rthdr, ptr, ipp->ipp_rthdrlen);
3342 			return (ipp->ipp_rthdrlen);
3343 		case IPV6_DSTOPTS:
3344 			if (!(ipp->ipp_fields & IPPF_DSTOPTS))
3345 				return (0);
3346 			bcopy(ipp->ipp_dstopts, ptr, ipp->ipp_dstoptslen);
3347 			return (ipp->ipp_dstoptslen);
3348 		case IPV6_PATHMTU:
3349 			return (ip_fill_mtuinfo(&udp->udp_v6dst,
3350 				udp->udp_dstport, (struct ip6_mtuinfo *)ptr));
3351 		default:
3352 			return (-1);
3353 		}
3354 		break;
3355 	case IPPROTO_UDP:
3356 		switch (name) {
3357 		case UDP_ANONPRIVBIND:
3358 			*i1 = udp->udp_anon_priv_bind;
3359 			break;
3360 		case UDP_EXCLBIND:
3361 			*i1 = udp->udp_exclbind ? UDP_EXCLBIND : 0;
3362 			break;
3363 		case UDP_RCVHDR:
3364 			*i1 = udp->udp_rcvhdr ? 1 : 0;
3365 			break;
3366 		default:
3367 			return (-1);
3368 		}
3369 		break;
3370 	default:
3371 		return (-1);
3372 	}
3373 	return (sizeof (int));
3374 }
3375 
3376 /*
3377  * This routine sets socket options; it expects the caller
3378  * to pass in the queue pointer of the upper instance.
3379  */
3380 /* ARGSUSED */
3381 int
3382 udp_opt_set(queue_t *q, uint_t optset_context, int level,
3383     int name, uint_t inlen, uchar_t *invalp, uint_t *outlenp,
3384     uchar_t *outvalp, void *thisdg_attrs, cred_t *cr, mblk_t *mblk)
3385 {
3386 	udpattrs_t *attrs = thisdg_attrs;
3387 	int	*i1 = (int *)invalp;
3388 	boolean_t onoff = (*i1 == 0) ? 0 : 1;
3389 	boolean_t checkonly;
3390 	int	error;
3391 	conn_t	*connp;
3392 	udp_t	*udp;
3393 	uint_t	newlen;
3394 
3395 	q = UDP_WR(q);
3396 	connp = Q_TO_CONN(q);
3397 	udp = connp->conn_udp;
3398 
3399 	switch (optset_context) {
3400 	case SETFN_OPTCOM_CHECKONLY:
3401 		checkonly = B_TRUE;
3402 		/*
3403 		 * Note: Implies T_CHECK semantics for T_OPTCOM_REQ
3404 		 * inlen != 0 implies value supplied and
3405 		 * 	we have to "pretend" to set it.
3406 		 * inlen == 0 implies that there is no
3407 		 * 	value part in T_CHECK request and just validation
3408 		 * done elsewhere should be enough, we just return here.
3409 		 */
3410 		if (inlen == 0) {
3411 			*outlenp = 0;
3412 			return (0);
3413 		}
3414 		break;
3415 	case SETFN_OPTCOM_NEGOTIATE:
3416 		checkonly = B_FALSE;
3417 		break;
3418 	case SETFN_UD_NEGOTIATE:
3419 	case SETFN_CONN_NEGOTIATE:
3420 		checkonly = B_FALSE;
3421 		/*
3422 		 * Negotiating local and "association-related" options
3423 		 * through T_UNITDATA_REQ.
3424 		 *
3425 		 * Following routine can filter out ones we do not
3426 		 * want to be "set" this way.
3427 		 */
3428 		if (!udp_opt_allow_udr_set(level, name)) {
3429 			*outlenp = 0;
3430 			return (EINVAL);
3431 		}
3432 		break;
3433 	default:
3434 		/*
3435 		 * We should never get here
3436 		 */
3437 		*outlenp = 0;
3438 		return (EINVAL);
3439 	}
3440 
3441 	ASSERT((optset_context != SETFN_OPTCOM_CHECKONLY) ||
3442 	    (optset_context == SETFN_OPTCOM_CHECKONLY && inlen != 0));
3443 
3444 	/*
3445 	 * For fixed length options, no sanity check
3446 	 * of passed in length is done. It is assumed *_optcom_req()
3447 	 * routines do the right thing.
3448 	 */
3449 
3450 	switch (level) {
3451 	case SOL_SOCKET:
3452 		switch (name) {
3453 		case SO_REUSEADDR:
3454 			if (!checkonly)
3455 				udp->udp_reuseaddr = onoff;
3456 			break;
3457 		case SO_DEBUG:
3458 			if (!checkonly)
3459 				udp->udp_debug = onoff;
3460 			break;
3461 		/*
3462 		 * The following three items are available here,
3463 		 * but are only meaningful to IP.
3464 		 */
3465 		case SO_DONTROUTE:
3466 			if (!checkonly)
3467 				udp->udp_dontroute = onoff;
3468 			break;
3469 		case SO_USELOOPBACK:
3470 			if (!checkonly)
3471 				udp->udp_useloopback = onoff;
3472 			break;
3473 		case SO_BROADCAST:
3474 			if (!checkonly)
3475 				udp->udp_broadcast = onoff;
3476 			break;
3477 
3478 		case SO_SNDBUF:
3479 			if (*i1 > udp_max_buf) {
3480 				*outlenp = 0;
3481 				return (ENOBUFS);
3482 			}
3483 			if (!checkonly) {
3484 				q->q_hiwat = *i1;
3485 				WR(UDP_RD(q))->q_hiwat = *i1;
3486 			}
3487 			break;
3488 		case SO_RCVBUF:
3489 			if (*i1 > udp_max_buf) {
3490 				*outlenp = 0;
3491 				return (ENOBUFS);
3492 			}
3493 			if (!checkonly) {
3494 				RD(q)->q_hiwat = *i1;
3495 				UDP_RD(q)->q_hiwat = *i1;
3496 				(void) mi_set_sth_hiwat(UDP_RD(q),
3497 				    udp_set_rcv_hiwat(udp, *i1));
3498 			}
3499 			break;
3500 		case SO_DGRAM_ERRIND:
3501 			if (!checkonly)
3502 				udp->udp_dgram_errind = onoff;
3503 			break;
3504 		case SO_RECVUCRED:
3505 			if (!checkonly)
3506 				udp->udp_recvucred = onoff;
3507 			break;
3508 		case SO_ALLZONES:
3509 			/*
3510 			 * "soft" error (negative)
3511 			 * option not handled at this level
3512 			 * Do not modify *outlenp.
3513 			 */
3514 			return (-EINVAL);
3515 		case SO_TIMESTAMP:
3516 			if (!checkonly)
3517 				udp->udp_timestamp = onoff;
3518 			break;
3519 		case SO_ANON_MLP:
3520 			if (!checkonly)
3521 				udp->udp_anon_mlp = onoff;
3522 			break;
3523 		case SO_MAC_EXEMPT:
3524 			if (secpolicy_net_mac_aware(cr) != 0 ||
3525 			    udp->udp_state != TS_UNBND)
3526 				return (EACCES);
3527 			if (!checkonly)
3528 				udp->udp_mac_exempt = onoff;
3529 			break;
3530 		case SCM_UCRED: {
3531 			struct ucred_s *ucr;
3532 			cred_t *cr, *newcr;
3533 			ts_label_t *tsl;
3534 
3535 			/*
3536 			 * Only sockets that have proper privileges and are
3537 			 * bound to MLPs will have any other value here, so
3538 			 * this implicitly tests for privilege to set label.
3539 			 */
3540 			if (connp->conn_mlp_type == mlptSingle)
3541 				break;
3542 			ucr = (struct ucred_s *)invalp;
3543 			if (inlen != ucredsize ||
3544 			    ucr->uc_labeloff < sizeof (*ucr) ||
3545 			    ucr->uc_labeloff + sizeof (bslabel_t) > inlen)
3546 				return (EINVAL);
3547 			if (!checkonly) {
3548 				mblk_t *mb;
3549 
3550 				if (attrs == NULL ||
3551 				    (mb = attrs->udpattr_mb) == NULL)
3552 					return (EINVAL);
3553 				if ((cr = DB_CRED(mb)) == NULL)
3554 					cr = udp->udp_connp->conn_cred;
3555 				ASSERT(cr != NULL);
3556 				if ((tsl = crgetlabel(cr)) == NULL)
3557 					return (EINVAL);
3558 				newcr = copycred_from_bslabel(cr, UCLABEL(ucr),
3559 				    tsl->tsl_doi, KM_NOSLEEP);
3560 				if (newcr == NULL)
3561 					return (ENOSR);
3562 				mblk_setcred(mb, newcr);
3563 				attrs->udpattr_credset = B_TRUE;
3564 				crfree(newcr);
3565 			}
3566 			break;
3567 		}
3568 		case SO_EXCLBIND:
3569 			if (!checkonly)
3570 				udp->udp_exclbind = onoff;
3571 			break;
3572 		default:
3573 			*outlenp = 0;
3574 			return (EINVAL);
3575 		}
3576 		break;
3577 	case IPPROTO_IP:
3578 		if (udp->udp_family != AF_INET) {
3579 			*outlenp = 0;
3580 			return (ENOPROTOOPT);
3581 		}
3582 		switch (name) {
3583 		case IP_OPTIONS:
3584 		case T_IP_OPTIONS:
3585 			/* Save options for use by IP. */
3586 			newlen = inlen + udp->udp_label_len;
3587 			if ((inlen & 0x3) || newlen > IP_MAX_OPT_LENGTH) {
3588 				*outlenp = 0;
3589 				return (EINVAL);
3590 			}
3591 			if (checkonly)
3592 				break;
3593 
3594 			if (!tsol_option_set(&udp->udp_ip_snd_options,
3595 			    &udp->udp_ip_snd_options_len,
3596 			    udp->udp_label_len, invalp, inlen)) {
3597 				*outlenp = 0;
3598 				return (ENOMEM);
3599 			}
3600 
3601 			udp->udp_max_hdr_len = IP_SIMPLE_HDR_LENGTH +
3602 			    UDPH_SIZE + udp->udp_ip_snd_options_len;
3603 			(void) mi_set_sth_wroff(RD(q), udp->udp_max_hdr_len +
3604 			    udp_wroff_extra);
3605 			break;
3606 
3607 		case IP_TTL:
3608 			if (!checkonly) {
3609 				udp->udp_ttl = (uchar_t)*i1;
3610 			}
3611 			break;
3612 		case IP_TOS:
3613 		case T_IP_TOS:
3614 			if (!checkonly) {
3615 				udp->udp_type_of_service = (uchar_t)*i1;
3616 			}
3617 			break;
3618 		case IP_MULTICAST_IF: {
3619 			/*
3620 			 * TODO should check OPTMGMT reply and undo this if
3621 			 * there is an error.
3622 			 */
3623 			struct in_addr *inap = (struct in_addr *)invalp;
3624 			if (!checkonly) {
3625 				udp->udp_multicast_if_addr =
3626 				    inap->s_addr;
3627 			}
3628 			break;
3629 		}
3630 		case IP_MULTICAST_TTL:
3631 			if (!checkonly)
3632 				udp->udp_multicast_ttl = *invalp;
3633 			break;
3634 		case IP_MULTICAST_LOOP:
3635 			if (!checkonly)
3636 				connp->conn_multicast_loop = *invalp;
3637 			break;
3638 		case IP_RECVOPTS:
3639 			if (!checkonly)
3640 				udp->udp_recvopts = onoff;
3641 			break;
3642 		case IP_RECVDSTADDR:
3643 			if (!checkonly)
3644 				udp->udp_recvdstaddr = onoff;
3645 			break;
3646 		case IP_RECVIF:
3647 			if (!checkonly)
3648 				udp->udp_recvif = onoff;
3649 			break;
3650 		case IP_RECVSLLA:
3651 			if (!checkonly)
3652 				udp->udp_recvslla = onoff;
3653 			break;
3654 		case IP_RECVTTL:
3655 			if (!checkonly)
3656 				udp->udp_recvttl = onoff;
3657 			break;
3658 		case IP_ADD_MEMBERSHIP:
3659 		case IP_DROP_MEMBERSHIP:
3660 		case IP_BLOCK_SOURCE:
3661 		case IP_UNBLOCK_SOURCE:
3662 		case IP_ADD_SOURCE_MEMBERSHIP:
3663 		case IP_DROP_SOURCE_MEMBERSHIP:
3664 		case MCAST_JOIN_GROUP:
3665 		case MCAST_LEAVE_GROUP:
3666 		case MCAST_BLOCK_SOURCE:
3667 		case MCAST_UNBLOCK_SOURCE:
3668 		case MCAST_JOIN_SOURCE_GROUP:
3669 		case MCAST_LEAVE_SOURCE_GROUP:
3670 		case IP_SEC_OPT:
3671 		case IP_NEXTHOP:
3672 			/*
3673 			 * "soft" error (negative)
3674 			 * option not handled at this level
3675 			 * Do not modify *outlenp.
3676 			 */
3677 			return (-EINVAL);
3678 		case IP_BOUND_IF:
3679 			if (!checkonly)
3680 				udp->udp_bound_if = *i1;
3681 			break;
3682 		case IP_UNSPEC_SRC:
3683 			if (!checkonly)
3684 				udp->udp_unspec_source = onoff;
3685 			break;
3686 		case IP_XMIT_IF:
3687 			if (!checkonly)
3688 				udp->udp_xmit_if = *i1;
3689 			break;
3690 		default:
3691 			*outlenp = 0;
3692 			return (EINVAL);
3693 		}
3694 		break;
3695 	case IPPROTO_IPV6: {
3696 		ip6_pkt_t		*ipp;
3697 		boolean_t		sticky;
3698 
3699 		if (udp->udp_family != AF_INET6) {
3700 			*outlenp = 0;
3701 			return (ENOPROTOOPT);
3702 		}
3703 		/*
3704 		 * Deal with both sticky options and ancillary data
3705 		 */
3706 		sticky = B_FALSE;
3707 		if (attrs == NULL || (ipp = attrs->udpattr_ipp) == NULL) {
3708 			/* sticky options, or none */
3709 			ipp = &udp->udp_sticky_ipp;
3710 			sticky = B_TRUE;
3711 		}
3712 
3713 		switch (name) {
3714 		case IPV6_MULTICAST_IF:
3715 			if (!checkonly)
3716 				udp->udp_multicast_if_index = *i1;
3717 			break;
3718 		case IPV6_UNICAST_HOPS:
3719 			/* -1 means use default */
3720 			if (*i1 < -1 || *i1 > IPV6_MAX_HOPS) {
3721 				*outlenp = 0;
3722 				return (EINVAL);
3723 			}
3724 			if (!checkonly) {
3725 				if (*i1 == -1) {
3726 					udp->udp_ttl = ipp->ipp_unicast_hops =
3727 					    udp_ipv6_hoplimit;
3728 					ipp->ipp_fields &= ~IPPF_UNICAST_HOPS;
3729 					/* Pass modified value to IP. */
3730 					*i1 = udp->udp_ttl;
3731 				} else {
3732 					udp->udp_ttl = ipp->ipp_unicast_hops =
3733 					    (uint8_t)*i1;
3734 					ipp->ipp_fields |= IPPF_UNICAST_HOPS;
3735 				}
3736 				/* Rebuild the header template */
3737 				error = udp_build_hdrs(q, udp);
3738 				if (error != 0) {
3739 					*outlenp = 0;
3740 					return (error);
3741 				}
3742 			}
3743 			break;
3744 		case IPV6_MULTICAST_HOPS:
3745 			/* -1 means use default */
3746 			if (*i1 < -1 || *i1 > IPV6_MAX_HOPS) {
3747 				*outlenp = 0;
3748 				return (EINVAL);
3749 			}
3750 			if (!checkonly) {
3751 				if (*i1 == -1) {
3752 					udp->udp_multicast_ttl =
3753 					    ipp->ipp_multicast_hops =
3754 					    IP_DEFAULT_MULTICAST_TTL;
3755 					ipp->ipp_fields &= ~IPPF_MULTICAST_HOPS;
3756 					/* Pass modified value to IP. */
3757 					*i1 = udp->udp_multicast_ttl;
3758 				} else {
3759 					udp->udp_multicast_ttl =
3760 					    ipp->ipp_multicast_hops =
3761 					    (uint8_t)*i1;
3762 					ipp->ipp_fields |= IPPF_MULTICAST_HOPS;
3763 				}
3764 			}
3765 			break;
3766 		case IPV6_MULTICAST_LOOP:
3767 			if (*i1 != 0 && *i1 != 1) {
3768 				*outlenp = 0;
3769 				return (EINVAL);
3770 			}
3771 			if (!checkonly)
3772 				connp->conn_multicast_loop = *i1;
3773 			break;
3774 		case IPV6_JOIN_GROUP:
3775 		case IPV6_LEAVE_GROUP:
3776 		case MCAST_JOIN_GROUP:
3777 		case MCAST_LEAVE_GROUP:
3778 		case MCAST_BLOCK_SOURCE:
3779 		case MCAST_UNBLOCK_SOURCE:
3780 		case MCAST_JOIN_SOURCE_GROUP:
3781 		case MCAST_LEAVE_SOURCE_GROUP:
3782 			/*
3783 			 * "soft" error (negative)
3784 			 * option not handled at this level
3785 			 * Note: Do not modify *outlenp
3786 			 */
3787 			return (-EINVAL);
3788 		case IPV6_BOUND_IF:
3789 			if (!checkonly)
3790 				udp->udp_bound_if = *i1;
3791 			break;
3792 		case IPV6_UNSPEC_SRC:
3793 			if (!checkonly)
3794 				udp->udp_unspec_source = onoff;
3795 			break;
3796 		/*
3797 		 * Set boolean switches for ancillary data delivery
3798 		 */
3799 		case IPV6_RECVPKTINFO:
3800 			if (!checkonly)
3801 				udp->udp_ipv6_recvpktinfo = onoff;
3802 			break;
3803 		case IPV6_RECVTCLASS:
3804 			if (!checkonly) {
3805 				udp->udp_ipv6_recvtclass = onoff;
3806 			}
3807 			break;
3808 		case IPV6_RECVPATHMTU:
3809 			if (!checkonly) {
3810 				udp->udp_ipv6_recvpathmtu = onoff;
3811 			}
3812 			break;
3813 		case IPV6_RECVHOPLIMIT:
3814 			if (!checkonly)
3815 				udp->udp_ipv6_recvhoplimit = onoff;
3816 			break;
3817 		case IPV6_RECVHOPOPTS:
3818 			if (!checkonly)
3819 				udp->udp_ipv6_recvhopopts = onoff;
3820 			break;
3821 		case IPV6_RECVDSTOPTS:
3822 			if (!checkonly)
3823 				udp->udp_ipv6_recvdstopts = onoff;
3824 			break;
3825 		case _OLD_IPV6_RECVDSTOPTS:
3826 			if (!checkonly)
3827 				udp->udp_old_ipv6_recvdstopts = onoff;
3828 			break;
3829 		case IPV6_RECVRTHDRDSTOPTS:
3830 			if (!checkonly)
3831 				udp->udp_ipv6_recvrthdrdstopts = onoff;
3832 			break;
3833 		case IPV6_RECVRTHDR:
3834 			if (!checkonly)
3835 				udp->udp_ipv6_recvrthdr = onoff;
3836 			break;
3837 		/*
3838 		 * Set sticky options or ancillary data.
3839 		 * If sticky options, (re)build any extension headers
3840 		 * that might be needed as a result.
3841 		 */
3842 		case IPV6_PKTINFO:
3843 			/*
3844 			 * The source address and ifindex are verified
3845 			 * in ip_opt_set(). For ancillary data the
3846 			 * source address is checked in ip_wput_v6.
3847 			 */
3848 			if (inlen != 0 && inlen != sizeof (struct in6_pktinfo))
3849 				return (EINVAL);
3850 			if (checkonly)
3851 				break;
3852 
3853 			if (inlen == 0) {
3854 				ipp->ipp_fields &= ~(IPPF_IFINDEX|IPPF_ADDR);
3855 				ipp->ipp_sticky_ignored |=
3856 				    (IPPF_IFINDEX|IPPF_ADDR);
3857 			} else {
3858 				struct in6_pktinfo *pkti;
3859 
3860 				pkti = (struct in6_pktinfo *)invalp;
3861 				ipp->ipp_ifindex = pkti->ipi6_ifindex;
3862 				ipp->ipp_addr = pkti->ipi6_addr;
3863 				if (ipp->ipp_ifindex != 0)
3864 					ipp->ipp_fields |= IPPF_IFINDEX;
3865 				else
3866 					ipp->ipp_fields &= ~IPPF_IFINDEX;
3867 				if (!IN6_IS_ADDR_UNSPECIFIED(
3868 				    &ipp->ipp_addr))
3869 					ipp->ipp_fields |= IPPF_ADDR;
3870 				else
3871 					ipp->ipp_fields &= ~IPPF_ADDR;
3872 			}
3873 			if (sticky) {
3874 				error = udp_build_hdrs(q, udp);
3875 				if (error != 0)
3876 					return (error);
3877 			}
3878 			break;
3879 		case IPV6_HOPLIMIT:
3880 			if (sticky)
3881 				return (EINVAL);
3882 			if (inlen != 0 && inlen != sizeof (int))
3883 				return (EINVAL);
3884 			if (checkonly)
3885 				break;
3886 
3887 			if (inlen == 0) {
3888 				ipp->ipp_fields &= ~IPPF_HOPLIMIT;
3889 				ipp->ipp_sticky_ignored |= IPPF_HOPLIMIT;
3890 			} else {
3891 				if (*i1 > 255 || *i1 < -1)
3892 					return (EINVAL);
3893 				if (*i1 == -1)
3894 					ipp->ipp_hoplimit = udp_ipv6_hoplimit;
3895 				else
3896 					ipp->ipp_hoplimit = *i1;
3897 				ipp->ipp_fields |= IPPF_HOPLIMIT;
3898 			}
3899 			break;
3900 		case IPV6_TCLASS:
3901 			if (inlen != 0 && inlen != sizeof (int))
3902 				return (EINVAL);
3903 			if (checkonly)
3904 				break;
3905 
3906 			if (inlen == 0) {
3907 				ipp->ipp_fields &= ~IPPF_TCLASS;
3908 				ipp->ipp_sticky_ignored |= IPPF_TCLASS;
3909 			} else {
3910 				if (*i1 > 255 || *i1 < -1)
3911 					return (EINVAL);
3912 				if (*i1 == -1)
3913 					ipp->ipp_tclass = 0;
3914 				else
3915 					ipp->ipp_tclass = *i1;
3916 				ipp->ipp_fields |= IPPF_TCLASS;
3917 			}
3918 			if (sticky) {
3919 				error = udp_build_hdrs(q, udp);
3920 				if (error != 0)
3921 					return (error);
3922 			}
3923 			break;
3924 		case IPV6_NEXTHOP:
3925 			/*
3926 			 * IP will verify that the nexthop is reachable
3927 			 * and fail for sticky options.
3928 			 */
3929 			if (inlen != 0 && inlen != sizeof (sin6_t))
3930 				return (EINVAL);
3931 			if (checkonly)
3932 				break;
3933 
3934 			if (inlen == 0) {
3935 				ipp->ipp_fields &= ~IPPF_NEXTHOP;
3936 				ipp->ipp_sticky_ignored |= IPPF_NEXTHOP;
3937 			} else {
3938 				sin6_t *sin6 = (sin6_t *)invalp;
3939 
3940 				if (sin6->sin6_family != AF_INET6)
3941 					return (EAFNOSUPPORT);
3942 				if (IN6_IS_ADDR_V4MAPPED(
3943 				    &sin6->sin6_addr))
3944 					return (EADDRNOTAVAIL);
3945 				ipp->ipp_nexthop = sin6->sin6_addr;
3946 				if (!IN6_IS_ADDR_UNSPECIFIED(
3947 				    &ipp->ipp_nexthop))
3948 					ipp->ipp_fields |= IPPF_NEXTHOP;
3949 				else
3950 					ipp->ipp_fields &= ~IPPF_NEXTHOP;
3951 			}
3952 			if (sticky) {
3953 				error = udp_build_hdrs(q, udp);
3954 				if (error != 0)
3955 					return (error);
3956 			}
3957 			break;
3958 		case IPV6_HOPOPTS: {
3959 			ip6_hbh_t *hopts = (ip6_hbh_t *)invalp;
3960 			/*
3961 			 * Sanity checks - minimum size, size a multiple of
3962 			 * eight bytes, and matching size passed in.
3963 			 */
3964 			if (inlen != 0 &&
3965 			    inlen != (8 * (hopts->ip6h_len + 1)))
3966 				return (EINVAL);
3967 
3968 			if (checkonly)
3969 				break;
3970 
3971 			error = optcom_pkt_set(invalp, inlen, sticky,
3972 			    (uchar_t **)&ipp->ipp_hopopts,
3973 			    &ipp->ipp_hopoptslen,
3974 			    sticky ? udp->udp_label_len_v6 : 0);
3975 			if (error != 0)
3976 				return (error);
3977 			if (ipp->ipp_hopoptslen == 0) {
3978 				ipp->ipp_fields &= ~IPPF_HOPOPTS;
3979 				ipp->ipp_sticky_ignored |= IPPF_HOPOPTS;
3980 			} else {
3981 				ipp->ipp_fields |= IPPF_HOPOPTS;
3982 			}
3983 			if (sticky) {
3984 				error = udp_build_hdrs(q, udp);
3985 				if (error != 0)
3986 					return (error);
3987 			}
3988 			break;
3989 		}
3990 		case IPV6_RTHDRDSTOPTS: {
3991 			ip6_dest_t *dopts = (ip6_dest_t *)invalp;
3992 
3993 			/*
3994 			 * Sanity checks - minimum size, size a multiple of
3995 			 * eight bytes, and matching size passed in.
3996 			 */
3997 			if (inlen != 0 &&
3998 			    inlen != (8 * (dopts->ip6d_len + 1)))
3999 				return (EINVAL);
4000 
4001 			if (checkonly)
4002 				break;
4003 
4004 			if (inlen == 0) {
4005 				if (sticky &&
4006 				    (ipp->ipp_fields & IPPF_RTDSTOPTS) != 0) {
4007 					kmem_free(ipp->ipp_rtdstopts,
4008 					    ipp->ipp_rtdstoptslen);
4009 					ipp->ipp_rtdstopts = NULL;
4010 					ipp->ipp_rtdstoptslen = 0;
4011 				}
4012 
4013 				ipp->ipp_fields &= ~IPPF_RTDSTOPTS;
4014 				ipp->ipp_sticky_ignored |= IPPF_RTDSTOPTS;
4015 			} else {
4016 				error = optcom_pkt_set(invalp, inlen, sticky,
4017 				    (uchar_t **)&ipp->ipp_rtdstopts,
4018 				    &ipp->ipp_rtdstoptslen, 0);
4019 				if (error != 0)
4020 					return (error);
4021 				ipp->ipp_fields |= IPPF_RTDSTOPTS;
4022 			}
4023 			if (sticky) {
4024 				error = udp_build_hdrs(q, udp);
4025 				if (error != 0)
4026 					return (error);
4027 			}
4028 			break;
4029 		}
4030 		case IPV6_DSTOPTS: {
4031 			ip6_dest_t *dopts = (ip6_dest_t *)invalp;
4032 
4033 			/*
4034 			 * Sanity checks - minimum size, size a multiple of
4035 			 * eight bytes, and matching size passed in.
4036 			 */
4037 			if (inlen != 0 &&
4038 			    inlen != (8 * (dopts->ip6d_len + 1)))
4039 				return (EINVAL);
4040 
4041 			if (checkonly)
4042 				break;
4043 
4044 			if (inlen == 0) {
4045 				if (sticky &&
4046 				    (ipp->ipp_fields & IPPF_DSTOPTS) != 0) {
4047 					kmem_free(ipp->ipp_dstopts,
4048 					    ipp->ipp_dstoptslen);
4049 					ipp->ipp_dstopts = NULL;
4050 					ipp->ipp_dstoptslen = 0;
4051 				}
4052 				ipp->ipp_fields &= ~IPPF_DSTOPTS;
4053 				ipp->ipp_sticky_ignored |= IPPF_DSTOPTS;
4054 			} else {
4055 				error = optcom_pkt_set(invalp, inlen, sticky,
4056 				    (uchar_t **)&ipp->ipp_dstopts,
4057 				    &ipp->ipp_dstoptslen, 0);
4058 				if (error != 0)
4059 					return (error);
4060 				ipp->ipp_fields |= IPPF_DSTOPTS;
4061 			}
4062 			if (sticky) {
4063 				error = udp_build_hdrs(q, udp);
4064 				if (error != 0)
4065 					return (error);
4066 			}
4067 			break;
4068 		}
4069 		case IPV6_RTHDR: {
4070 			ip6_rthdr_t *rt = (ip6_rthdr_t *)invalp;
4071 
4072 			/*
4073 			 * Sanity checks - minimum size, size a multiple of
4074 			 * eight bytes, and matching size passed in.
4075 			 */
4076 			if (inlen != 0 &&
4077 			    inlen != (8 * (rt->ip6r_len + 1)))
4078 				return (EINVAL);
4079 
4080 			if (checkonly)
4081 				break;
4082 
4083 			if (inlen == 0) {
4084 				if (sticky &&
4085 				    (ipp->ipp_fields & IPPF_RTHDR) != 0) {
4086 					kmem_free(ipp->ipp_rthdr,
4087 					    ipp->ipp_rthdrlen);
4088 					ipp->ipp_rthdr = NULL;
4089 					ipp->ipp_rthdrlen = 0;
4090 				}
4091 				ipp->ipp_fields &= ~IPPF_RTHDR;
4092 				ipp->ipp_sticky_ignored |= IPPF_RTHDR;
4093 			} else {
4094 				error = optcom_pkt_set(invalp, inlen, sticky,
4095 				    (uchar_t **)&ipp->ipp_rthdr,
4096 				    &ipp->ipp_rthdrlen, 0);
4097 				if (error != 0)
4098 					return (error);
4099 				ipp->ipp_fields |= IPPF_RTHDR;
4100 			}
4101 			if (sticky) {
4102 				error = udp_build_hdrs(q, udp);
4103 				if (error != 0)
4104 					return (error);
4105 			}
4106 			break;
4107 		}
4108 
4109 		case IPV6_DONTFRAG:
4110 			if (checkonly)
4111 				break;
4112 
4113 			if (onoff) {
4114 				ipp->ipp_fields |= IPPF_DONTFRAG;
4115 			} else {
4116 				ipp->ipp_fields &= ~IPPF_DONTFRAG;
4117 			}
4118 			break;
4119 
4120 		case IPV6_USE_MIN_MTU:
4121 			if (inlen != sizeof (int))
4122 				return (EINVAL);
4123 
4124 			if (*i1 < -1 || *i1 > 1)
4125 				return (EINVAL);
4126 
4127 			if (checkonly)
4128 				break;
4129 
4130 			ipp->ipp_fields |= IPPF_USE_MIN_MTU;
4131 			ipp->ipp_use_min_mtu = *i1;
4132 			break;
4133 
4134 		case IPV6_BOUND_PIF:
4135 		case IPV6_SEC_OPT:
4136 		case IPV6_DONTFAILOVER_IF:
4137 		case IPV6_SRC_PREFERENCES:
4138 		case IPV6_V6ONLY:
4139 			/* Handled at the IP level */
4140 			return (-EINVAL);
4141 		default:
4142 			*outlenp = 0;
4143 			return (EINVAL);
4144 		}
4145 		break;
4146 		}		/* end IPPROTO_IPV6 */
4147 	case IPPROTO_UDP:
4148 		switch (name) {
4149 		case UDP_ANONPRIVBIND:
4150 			if ((error = secpolicy_net_privaddr(cr, 0)) != 0) {
4151 				*outlenp = 0;
4152 				return (error);
4153 			}
4154 			if (!checkonly) {
4155 				udp->udp_anon_priv_bind = onoff;
4156 			}
4157 			break;
4158 		case UDP_EXCLBIND:
4159 			if (!checkonly)
4160 				udp->udp_exclbind = onoff;
4161 			break;
4162 		case UDP_RCVHDR:
4163 			if (!checkonly)
4164 				udp->udp_rcvhdr = onoff;
4165 			break;
4166 		default:
4167 			*outlenp = 0;
4168 			return (EINVAL);
4169 		}
4170 		break;
4171 	default:
4172 		*outlenp = 0;
4173 		return (EINVAL);
4174 	}
4175 	/*
4176 	 * Common case of OK return with outval same as inval.
4177 	 */
4178 	if (invalp != outvalp) {
4179 		/* don't trust bcopy for identical src/dst */
4180 		(void) bcopy(invalp, outvalp, inlen);
4181 	}
4182 	*outlenp = inlen;
4183 	return (0);
4184 }
4185 
4186 /*
4187  * Update udp_sticky_hdrs based on udp_sticky_ipp, udp_v6src, and udp_ttl.
4188  * The headers include ip6i_t (if needed), ip6_t, any sticky extension
4189  * headers, and the udp header.
4190  * Returns failure if can't allocate memory.
4191  */
4192 static int
4193 udp_build_hdrs(queue_t *q, udp_t *udp)
4194 {
4195 	uchar_t	*hdrs;
4196 	uint_t	hdrs_len;
4197 	ip6_t	*ip6h;
4198 	ip6i_t	*ip6i;
4199 	udpha_t	*udpha;
4200 	ip6_pkt_t *ipp = &udp->udp_sticky_ipp;
4201 
4202 	hdrs_len = ip_total_hdrs_len_v6(ipp) + UDPH_SIZE;
4203 	ASSERT(hdrs_len != 0);
4204 	if (hdrs_len != udp->udp_sticky_hdrs_len) {
4205 		/* Need to reallocate */
4206 		hdrs = kmem_alloc(hdrs_len, KM_NOSLEEP);
4207 		if (hdrs == NULL)
4208 			return (ENOMEM);
4209 
4210 		if (udp->udp_sticky_hdrs_len != 0) {
4211 			kmem_free(udp->udp_sticky_hdrs,
4212 			    udp->udp_sticky_hdrs_len);
4213 		}
4214 		udp->udp_sticky_hdrs = hdrs;
4215 		udp->udp_sticky_hdrs_len = hdrs_len;
4216 	}
4217 	ip_build_hdrs_v6(udp->udp_sticky_hdrs,
4218 	    udp->udp_sticky_hdrs_len - UDPH_SIZE, ipp, IPPROTO_UDP);
4219 
4220 	/* Set header fields not in ipp */
4221 	if (ipp->ipp_fields & IPPF_HAS_IP6I) {
4222 		ip6i = (ip6i_t *)udp->udp_sticky_hdrs;
4223 		ip6h = (ip6_t *)&ip6i[1];
4224 	} else {
4225 		ip6h = (ip6_t *)udp->udp_sticky_hdrs;
4226 	}
4227 
4228 	if (!(ipp->ipp_fields & IPPF_ADDR))
4229 		ip6h->ip6_src = udp->udp_v6src;
4230 
4231 	udpha = (udpha_t *)(udp->udp_sticky_hdrs + hdrs_len - UDPH_SIZE);
4232 	udpha->uha_src_port = udp->udp_port;
4233 
4234 	/* Try to get everything in a single mblk */
4235 	if (hdrs_len > udp->udp_max_hdr_len) {
4236 		udp->udp_max_hdr_len = hdrs_len;
4237 		(void) mi_set_sth_wroff(RD(q), udp->udp_max_hdr_len +
4238 		    udp_wroff_extra);
4239 	}
4240 	return (0);
4241 }
4242 
4243 /*
4244  * This routine retrieves the value of an ND variable in a udpparam_t
4245  * structure.  It is called through nd_getset when a user reads the
4246  * variable.
4247  */
4248 /* ARGSUSED */
4249 static int
4250 udp_param_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr)
4251 {
4252 	udpparam_t *udppa = (udpparam_t *)cp;
4253 
4254 	(void) mi_mpprintf(mp, "%d", udppa->udp_param_value);
4255 	return (0);
4256 }
4257 
4258 /*
4259  * Walk through the param array specified registering each element with the
4260  * named dispatch (ND) handler.
4261  */
4262 static boolean_t
4263 udp_param_register(udpparam_t *udppa, int cnt)
4264 {
4265 	for (; cnt-- > 0; udppa++) {
4266 		if (udppa->udp_param_name && udppa->udp_param_name[0]) {
4267 			if (!nd_load(&udp_g_nd, udppa->udp_param_name,
4268 			    udp_param_get, udp_param_set,
4269 			    (caddr_t)udppa)) {
4270 				nd_free(&udp_g_nd);
4271 				return (B_FALSE);
4272 			}
4273 		}
4274 	}
4275 	if (!nd_load(&udp_g_nd, "udp_extra_priv_ports",
4276 	    udp_extra_priv_ports_get, NULL, NULL)) {
4277 		nd_free(&udp_g_nd);
4278 		return (B_FALSE);
4279 	}
4280 	if (!nd_load(&udp_g_nd, "udp_extra_priv_ports_add",
4281 	    NULL, udp_extra_priv_ports_add, NULL)) {
4282 		nd_free(&udp_g_nd);
4283 		return (B_FALSE);
4284 	}
4285 	if (!nd_load(&udp_g_nd, "udp_extra_priv_ports_del",
4286 	    NULL, udp_extra_priv_ports_del, NULL)) {
4287 		nd_free(&udp_g_nd);
4288 		return (B_FALSE);
4289 	}
4290 	if (!nd_load(&udp_g_nd, "udp_status", udp_status_report, NULL,
4291 	    NULL)) {
4292 		nd_free(&udp_g_nd);
4293 		return (B_FALSE);
4294 	}
4295 	if (!nd_load(&udp_g_nd, "udp_bind_hash", udp_bind_hash_report, NULL,
4296 	    NULL)) {
4297 		nd_free(&udp_g_nd);
4298 		return (B_FALSE);
4299 	}
4300 	return (B_TRUE);
4301 }
4302 
4303 /* This routine sets an ND variable in a udpparam_t structure. */
4304 /* ARGSUSED */
4305 static int
4306 udp_param_set(queue_t *q, mblk_t *mp, char *value, caddr_t cp, cred_t *cr)
4307 {
4308 	long		new_value;
4309 	udpparam_t	*udppa = (udpparam_t *)cp;
4310 
4311 	/*
4312 	 * Fail the request if the new value does not lie within the
4313 	 * required bounds.
4314 	 */
4315 	if (ddi_strtol(value, NULL, 10, &new_value) != 0 ||
4316 	    new_value < udppa->udp_param_min ||
4317 	    new_value > udppa->udp_param_max) {
4318 		return (EINVAL);
4319 	}
4320 
4321 	/* Set the new value */
4322 	udppa->udp_param_value = new_value;
4323 	return (0);
4324 }
4325 
4326 /*
4327  * Copy hop-by-hop option from ipp->ipp_hopopts to the buffer provided (with
4328  * T_opthdr) and return the number of bytes copied.  'dbuf' may be NULL to
4329  * just count the length needed for allocation.  If 'dbuf' is non-NULL,
4330  * then it's assumed to be allocated to be large enough.
4331  *
4332  * Returns zero if trimming of the security option causes all options to go
4333  * away.
4334  */
4335 static size_t
4336 copy_hop_opts(const ip6_pkt_t *ipp, uchar_t *dbuf)
4337 {
4338 	struct T_opthdr *toh;
4339 	size_t hol = ipp->ipp_hopoptslen;
4340 	ip6_hbh_t *dstopt = NULL;
4341 	const ip6_hbh_t *srcopt = ipp->ipp_hopopts;
4342 	size_t tlen, olen, plen;
4343 	boolean_t deleting;
4344 	const struct ip6_opt *sopt, *lastpad;
4345 	struct ip6_opt *dopt;
4346 
4347 	if ((toh = (struct T_opthdr *)dbuf) != NULL) {
4348 		toh->level = IPPROTO_IPV6;
4349 		toh->name = IPV6_HOPOPTS;
4350 		toh->status = 0;
4351 		dstopt = (ip6_hbh_t *)(toh + 1);
4352 	}
4353 
4354 	/*
4355 	 * If labeling is enabled, then skip the label option
4356 	 * but get other options if there are any.
4357 	 */
4358 	if (is_system_labeled()) {
4359 		dopt = NULL;
4360 		if (dstopt != NULL) {
4361 			/* will fill in ip6h_len later */
4362 			dstopt->ip6h_nxt = srcopt->ip6h_nxt;
4363 			dopt = (struct ip6_opt *)(dstopt + 1);
4364 		}
4365 		sopt = (const struct ip6_opt *)(srcopt + 1);
4366 		hol -= sizeof (*srcopt);
4367 		tlen = sizeof (*dstopt);
4368 		lastpad = NULL;
4369 		deleting = B_FALSE;
4370 		/*
4371 		 * This loop finds the first (lastpad pointer) of any number of
4372 		 * pads that preceeds the security option, then treats the
4373 		 * security option as though it were a pad, and then finds the
4374 		 * next non-pad option (or end of list).
4375 		 *
4376 		 * It then treats the entire block as one big pad.  To preserve
4377 		 * alignment of any options that follow, or just the end of the
4378 		 * list, it computes a minimal new padding size that keeps the
4379 		 * same alignment for the next option.
4380 		 *
4381 		 * If it encounters just a sequence of pads with no security
4382 		 * option, those are copied as-is rather than collapsed.
4383 		 *
4384 		 * Note that to handle the end of list case, the code makes one
4385 		 * loop with 'hol' set to zero.
4386 		 */
4387 		for (;;) {
4388 			if (hol > 0) {
4389 				if (sopt->ip6o_type == IP6OPT_PAD1) {
4390 					if (lastpad == NULL)
4391 						lastpad = sopt;
4392 					sopt = (const struct ip6_opt *)
4393 					    &sopt->ip6o_len;
4394 					hol--;
4395 					continue;
4396 				}
4397 				olen = sopt->ip6o_len + sizeof (*sopt);
4398 				if (olen > hol)
4399 					olen = hol;
4400 				if (sopt->ip6o_type == IP6OPT_PADN ||
4401 				    sopt->ip6o_type == ip6opt_ls) {
4402 					if (sopt->ip6o_type == ip6opt_ls)
4403 						deleting = B_TRUE;
4404 					if (lastpad == NULL)
4405 						lastpad = sopt;
4406 					sopt = (const struct ip6_opt *)
4407 					    ((const char *)sopt + olen);
4408 					hol -= olen;
4409 					continue;
4410 				}
4411 			} else {
4412 				/* if nothing was copied at all, then delete */
4413 				if (tlen == sizeof (*dstopt))
4414 					return (0);
4415 				/* last pass; pick up any trailing padding */
4416 				olen = 0;
4417 			}
4418 			if (deleting) {
4419 				/*
4420 				 * compute aligning effect of deleted material
4421 				 * to reproduce with pad.
4422 				 */
4423 				plen = ((const char *)sopt -
4424 				    (const char *)lastpad) & 7;
4425 				tlen += plen;
4426 				if (dopt != NULL) {
4427 					if (plen == 1) {
4428 						dopt->ip6o_type = IP6OPT_PAD1;
4429 					} else if (plen > 1) {
4430 						plen -= sizeof (*dopt);
4431 						dopt->ip6o_type = IP6OPT_PADN;
4432 						dopt->ip6o_len = plen;
4433 						if (plen > 0)
4434 							bzero(dopt + 1, plen);
4435 					}
4436 					dopt = (struct ip6_opt *)
4437 					    ((char *)dopt + plen);
4438 				}
4439 				deleting = B_FALSE;
4440 				lastpad = NULL;
4441 			}
4442 			/* if there's uncopied padding, then copy that now */
4443 			if (lastpad != NULL) {
4444 				olen += (const char *)sopt -
4445 				    (const char *)lastpad;
4446 				sopt = lastpad;
4447 				lastpad = NULL;
4448 			}
4449 			if (dopt != NULL && olen > 0) {
4450 				bcopy(sopt, dopt, olen);
4451 				dopt = (struct ip6_opt *)((char *)dopt + olen);
4452 			}
4453 			if (hol == 0)
4454 				break;
4455 			tlen += olen;
4456 			sopt = (const struct ip6_opt *)
4457 			    ((const char *)sopt + olen);
4458 			hol -= olen;
4459 		}
4460 		/* go back and patch up the length value, rounded upward */
4461 		if (dstopt != NULL)
4462 			dstopt->ip6h_len = (tlen - 1) >> 3;
4463 	} else {
4464 		tlen = hol;
4465 		if (dstopt != NULL)
4466 			bcopy(srcopt, dstopt, hol);
4467 	}
4468 
4469 	tlen += sizeof (*toh);
4470 	if (toh != NULL)
4471 		toh->len = tlen;
4472 
4473 	return (tlen);
4474 }
4475 
4476 static void
4477 udp_input(conn_t *connp, mblk_t *mp)
4478 {
4479 	struct T_unitdata_ind	*tudi;
4480 	uchar_t			*rptr;		/* Pointer to IP header */
4481 	int			hdr_length;	/* Length of IP+UDP headers */
4482 	int			udi_size;	/* Size of T_unitdata_ind */
4483 	int			mp_len;
4484 	udp_t			*udp;
4485 	udpha_t			*udpha;
4486 	int			ipversion;
4487 	ip6_pkt_t		ipp;
4488 	ip6_t			*ip6h;
4489 	ip6i_t			*ip6i;
4490 	mblk_t			*mp1;
4491 	mblk_t			*options_mp = NULL;
4492 	in_pktinfo_t		*pinfo = NULL;
4493 	cred_t			*cr = NULL;
4494 	queue_t			*q = connp->conn_rq;
4495 	pid_t			cpid;
4496 	cred_t			*rcr = connp->conn_cred;
4497 
4498 	TRACE_2(TR_FAC_UDP, TR_UDP_RPUT_START,
4499 	    "udp_rput_start: q %p mp %p", q, mp);
4500 
4501 	udp = connp->conn_udp;
4502 	rptr = mp->b_rptr;
4503 	ASSERT(DB_TYPE(mp) == M_DATA || DB_TYPE(mp) == M_CTL);
4504 	ASSERT(OK_32PTR(rptr));
4505 
4506 	/*
4507 	 * IP should have prepended the options data in an M_CTL
4508 	 * Check M_CTL "type" to make sure are not here bcos of
4509 	 * a valid ICMP message
4510 	 */
4511 	if (DB_TYPE(mp) == M_CTL) {
4512 		if (MBLKL(mp) == sizeof (in_pktinfo_t) &&
4513 		    ((in_pktinfo_t *)mp->b_rptr)->in_pkt_ulp_type ==
4514 		    IN_PKTINFO) {
4515 			/*
4516 			 * IP_RECVIF or IP_RECVSLLA information has been
4517 			 * appended to the packet by IP. We need to
4518 			 * extract the mblk and adjust the rptr
4519 			 */
4520 			pinfo = (in_pktinfo_t *)mp->b_rptr;
4521 			options_mp = mp;
4522 			mp = mp->b_cont;
4523 			rptr = mp->b_rptr;
4524 			UDP_STAT(udp_in_pktinfo);
4525 		} else {
4526 			/*
4527 			 * ICMP messages.
4528 			 */
4529 			udp_icmp_error(q, mp);
4530 			TRACE_2(TR_FAC_UDP, TR_UDP_RPUT_END,
4531 				"udp_rput_end: q %p (%S)", q, "m_ctl");
4532 			return;
4533 		}
4534 	}
4535 
4536 	mp_len = msgdsize(mp);
4537 	/*
4538 	 * This is the inbound data path.
4539 	 * First, we check to make sure the IP version number is correct,
4540 	 * and then pull the IP and UDP headers into the first mblk.
4541 	 * Assume IP provides aligned packets - otherwise toss.
4542 	 * Also, check if we have a complete IP header.
4543 	 */
4544 
4545 	/* Initialize regardless if ipversion is IPv4 or IPv6 */
4546 	ipp.ipp_fields = 0;
4547 
4548 	ipversion = IPH_HDR_VERSION(rptr);
4549 	switch (ipversion) {
4550 	case IPV4_VERSION:
4551 		ASSERT(MBLKL(mp) >= sizeof (ipha_t));
4552 		ASSERT(((ipha_t *)rptr)->ipha_protocol == IPPROTO_UDP);
4553 		hdr_length = IPH_HDR_LENGTH(rptr) + UDPH_SIZE;
4554 		if ((hdr_length > IP_SIMPLE_HDR_LENGTH + UDPH_SIZE) ||
4555 		    (udp->udp_ip_rcv_options_len)) {
4556 			/*
4557 			 * Handle IPv4 packets with options outside of the
4558 			 * main data path. Not needed for AF_INET6 sockets
4559 			 * since they don't support a getsockopt of IP_OPTIONS.
4560 			 */
4561 			if (udp->udp_family == AF_INET6)
4562 				break;
4563 			/*
4564 			 * UDP length check performed for IPv4 packets with
4565 			 * options to check whether UDP length specified in
4566 			 * the header is the same as the physical length of
4567 			 * the packet.
4568 			 */
4569 			udpha = (udpha_t *)(rptr + (hdr_length - UDPH_SIZE));
4570 			if (mp_len != (ntohs(udpha->uha_length) +
4571 			    hdr_length - UDPH_SIZE)) {
4572 				goto tossit;
4573 			}
4574 			/*
4575 			 * Handle the case where the packet has IP options
4576 			 * and the IP_RECVSLLA & IP_RECVIF are set
4577 			 */
4578 			if (pinfo != NULL)
4579 				mp = options_mp;
4580 			udp_become_writer(connp, mp, udp_rput_other_wrapper,
4581 			    SQTAG_UDP_INPUT);
4582 			TRACE_2(TR_FAC_UDP, TR_UDP_RPUT_END,
4583 				"udp_rput_end: q %p (%S)", q, "end");
4584 			return;
4585 		}
4586 
4587 		/* Handle IPV6_RECVHOPLIMIT. */
4588 		if ((udp->udp_family == AF_INET6) && (pinfo != NULL) &&
4589 		    udp->udp_ipv6_recvpktinfo) {
4590 			if (pinfo->in_pkt_flags & IPF_RECVIF) {
4591 				ipp.ipp_fields |= IPPF_IFINDEX;
4592 				ipp.ipp_ifindex = pinfo->in_pkt_ifindex;
4593 			}
4594 		}
4595 		break;
4596 	case IPV6_VERSION:
4597 		/*
4598 		 * IPv6 packets can only be received by applications
4599 		 * that are prepared to receive IPv6 addresses.
4600 		 * The IP fanout must ensure this.
4601 		 */
4602 		ASSERT(udp->udp_family == AF_INET6);
4603 
4604 		ip6h = (ip6_t *)rptr;
4605 		ASSERT((uchar_t *)&ip6h[1] <= mp->b_wptr);
4606 
4607 		if (ip6h->ip6_nxt != IPPROTO_UDP) {
4608 			uint8_t nexthdrp;
4609 			/* Look for ifindex information */
4610 			if (ip6h->ip6_nxt == IPPROTO_RAW) {
4611 				ip6i = (ip6i_t *)ip6h;
4612 				if ((uchar_t *)&ip6i[1] > mp->b_wptr)
4613 					goto tossit;
4614 
4615 				if (ip6i->ip6i_flags & IP6I_IFINDEX) {
4616 					ASSERT(ip6i->ip6i_ifindex != 0);
4617 					ipp.ipp_fields |= IPPF_IFINDEX;
4618 					ipp.ipp_ifindex = ip6i->ip6i_ifindex;
4619 				}
4620 				rptr = (uchar_t *)&ip6i[1];
4621 				mp->b_rptr = rptr;
4622 				if (rptr == mp->b_wptr) {
4623 					mp1 = mp->b_cont;
4624 					freeb(mp);
4625 					mp = mp1;
4626 					rptr = mp->b_rptr;
4627 				}
4628 				if (MBLKL(mp) < (IPV6_HDR_LEN + UDPH_SIZE))
4629 					goto tossit;
4630 				ip6h = (ip6_t *)rptr;
4631 				mp_len = msgdsize(mp);
4632 			}
4633 			/*
4634 			 * Find any potentially interesting extension headers
4635 			 * as well as the length of the IPv6 + extension
4636 			 * headers.
4637 			 */
4638 			hdr_length = ip_find_hdr_v6(mp, ip6h, &ipp, &nexthdrp) +
4639 			    UDPH_SIZE;
4640 			ASSERT(nexthdrp == IPPROTO_UDP);
4641 		} else {
4642 			hdr_length = IPV6_HDR_LEN + UDPH_SIZE;
4643 			ip6i = NULL;
4644 		}
4645 		break;
4646 	default:
4647 		ASSERT(0);
4648 	}
4649 
4650 	/*
4651 	 * IP inspected the UDP header thus all of it must be in the mblk.
4652 	 * UDP length check is performed for IPv6 packets and IPv4 packets
4653 	 * without options to check if the size of the packet as specified
4654 	 * by the header is the same as the physical size of the packet.
4655 	 */
4656 	udpha = (udpha_t *)(rptr + (hdr_length - UDPH_SIZE));
4657 	if ((MBLKL(mp) < hdr_length) ||
4658 	    (mp_len != (ntohs(udpha->uha_length) + hdr_length - UDPH_SIZE))) {
4659 		goto tossit;
4660 	}
4661 
4662 	/* Walk past the headers. */
4663 	if (!udp->udp_rcvhdr) {
4664 		mp->b_rptr = rptr + hdr_length;
4665 		mp_len -= hdr_length;
4666 	}
4667 
4668 	/*
4669 	 * This is the inbound data path.  Packets are passed upstream as
4670 	 * T_UNITDATA_IND messages with full IP headers still attached.
4671 	 */
4672 	if (udp->udp_family == AF_INET) {
4673 		sin_t *sin;
4674 
4675 		ASSERT(IPH_HDR_VERSION((ipha_t *)rptr) == IPV4_VERSION);
4676 
4677 		/*
4678 		 * Normally only send up the address.
4679 		 * If IP_RECVDSTADDR is set we include the destination IP
4680 		 * address as an option. With IP_RECVOPTS we include all
4681 		 * the IP options. Only ip_rput_other() handles packets
4682 		 * that contain IP options.
4683 		 */
4684 		udi_size = sizeof (struct T_unitdata_ind) + sizeof (sin_t);
4685 		if (udp->udp_recvdstaddr) {
4686 			udi_size += sizeof (struct T_opthdr) +
4687 			    sizeof (struct in_addr);
4688 			UDP_STAT(udp_in_recvdstaddr);
4689 		}
4690 
4691 		/*
4692 		 * If the IP_RECVSLLA or the IP_RECVIF is set then allocate
4693 		 * space accordingly
4694 		 */
4695 		if (udp->udp_recvif && (pinfo != NULL) &&
4696 		    (pinfo->in_pkt_flags & IPF_RECVIF)) {
4697 			udi_size += sizeof (struct T_opthdr) + sizeof (uint_t);
4698 			UDP_STAT(udp_in_recvif);
4699 		}
4700 
4701 		if (udp->udp_recvslla && (pinfo != NULL) &&
4702 		    (pinfo->in_pkt_flags & IPF_RECVSLLA)) {
4703 			udi_size += sizeof (struct T_opthdr) +
4704 			    sizeof (struct sockaddr_dl);
4705 			UDP_STAT(udp_in_recvslla);
4706 		}
4707 
4708 		if (udp->udp_recvucred && (cr = DB_CRED(mp)) != NULL) {
4709 			udi_size += sizeof (struct T_opthdr) + ucredsize;
4710 			cpid = DB_CPID(mp);
4711 			UDP_STAT(udp_in_recvucred);
4712 		}
4713 
4714 		/*
4715 		 * If SO_TIMESTAMP is set allocate the appropriate sized
4716 		 * buffer. Since gethrestime() expects a pointer aligned
4717 		 * argument, we allocate space necessary for extra
4718 		 * alignment (even though it might not be used).
4719 		 */
4720 		if (udp->udp_timestamp) {
4721 			udi_size += sizeof (struct T_opthdr) +
4722 			    sizeof (timestruc_t) + _POINTER_ALIGNMENT;
4723 			UDP_STAT(udp_in_timestamp);
4724 		}
4725 
4726 		/*
4727 		 * If IP_RECVTTL is set allocate the appropriate sized buffer
4728 		 */
4729 		if (udp->udp_recvttl) {
4730 			udi_size += sizeof (struct T_opthdr) + sizeof (uint8_t);
4731 			UDP_STAT(udp_in_recvttl);
4732 		}
4733 		ASSERT(IPH_HDR_LENGTH((ipha_t *)rptr) == IP_SIMPLE_HDR_LENGTH);
4734 
4735 		/* Allocate a message block for the T_UNITDATA_IND structure. */
4736 		mp1 = allocb(udi_size, BPRI_MED);
4737 		if (mp1 == NULL) {
4738 			freemsg(mp);
4739 			if (options_mp != NULL)
4740 				freeb(options_mp);
4741 			TRACE_2(TR_FAC_UDP, TR_UDP_RPUT_END,
4742 				"udp_rput_end: q %p (%S)", q, "allocbfail");
4743 			BUMP_MIB(&udp_mib, udpInErrors);
4744 			return;
4745 		}
4746 		mp1->b_cont = mp;
4747 		mp = mp1;
4748 		mp->b_datap->db_type = M_PROTO;
4749 		tudi = (struct T_unitdata_ind *)mp->b_rptr;
4750 		mp->b_wptr = (uchar_t *)tudi + udi_size;
4751 		tudi->PRIM_type = T_UNITDATA_IND;
4752 		tudi->SRC_length = sizeof (sin_t);
4753 		tudi->SRC_offset = sizeof (struct T_unitdata_ind);
4754 		tudi->OPT_offset = sizeof (struct T_unitdata_ind) +
4755 		    sizeof (sin_t);
4756 		udi_size -= (sizeof (struct T_unitdata_ind) + sizeof (sin_t));
4757 		tudi->OPT_length = udi_size;
4758 		sin = (sin_t *)&tudi[1];
4759 		sin->sin_addr.s_addr = ((ipha_t *)rptr)->ipha_src;
4760 		sin->sin_port =	udpha->uha_src_port;
4761 		sin->sin_family = udp->udp_family;
4762 		*(uint32_t *)&sin->sin_zero[0] = 0;
4763 		*(uint32_t *)&sin->sin_zero[4] = 0;
4764 
4765 		/*
4766 		 * Add options if IP_RECVDSTADDR, IP_RECVIF, IP_RECVSLLA or
4767 		 * IP_RECVTTL has been set.
4768 		 */
4769 		if (udi_size != 0) {
4770 			/*
4771 			 * Copy in destination address before options to avoid
4772 			 * any padding issues.
4773 			 */
4774 			char *dstopt;
4775 
4776 			dstopt = (char *)&sin[1];
4777 			if (udp->udp_recvdstaddr) {
4778 				struct T_opthdr *toh;
4779 				ipaddr_t *dstptr;
4780 
4781 				toh = (struct T_opthdr *)dstopt;
4782 				toh->level = IPPROTO_IP;
4783 				toh->name = IP_RECVDSTADDR;
4784 				toh->len = sizeof (struct T_opthdr) +
4785 				    sizeof (ipaddr_t);
4786 				toh->status = 0;
4787 				dstopt += sizeof (struct T_opthdr);
4788 				dstptr = (ipaddr_t *)dstopt;
4789 				*dstptr = ((ipha_t *)rptr)->ipha_dst;
4790 				dstopt = (char *)toh + toh->len;
4791 				udi_size -= toh->len;
4792 			}
4793 
4794 			if (udp->udp_recvslla && (pinfo != NULL) &&
4795 			    (pinfo->in_pkt_flags & IPF_RECVSLLA)) {
4796 
4797 				struct T_opthdr *toh;
4798 				struct sockaddr_dl	*dstptr;
4799 
4800 				toh = (struct T_opthdr *)dstopt;
4801 				toh->level = IPPROTO_IP;
4802 				toh->name = IP_RECVSLLA;
4803 				toh->len = sizeof (struct T_opthdr) +
4804 					sizeof (struct sockaddr_dl);
4805 				toh->status = 0;
4806 				dstopt += sizeof (struct T_opthdr);
4807 				dstptr = (struct sockaddr_dl *)dstopt;
4808 				bcopy(&pinfo->in_pkt_slla, dstptr,
4809 				    sizeof (struct sockaddr_dl));
4810 				dstopt = (char *)toh + toh->len;
4811 				udi_size -= toh->len;
4812 			}
4813 
4814 			if (udp->udp_recvif && (pinfo != NULL) &&
4815 			    (pinfo->in_pkt_flags & IPF_RECVIF)) {
4816 
4817 				struct T_opthdr *toh;
4818 				uint_t		*dstptr;
4819 
4820 				toh = (struct T_opthdr *)dstopt;
4821 				toh->level = IPPROTO_IP;
4822 				toh->name = IP_RECVIF;
4823 				toh->len = sizeof (struct T_opthdr) +
4824 					sizeof (uint_t);
4825 				toh->status = 0;
4826 				dstopt += sizeof (struct T_opthdr);
4827 				dstptr = (uint_t *)dstopt;
4828 				*dstptr = pinfo->in_pkt_ifindex;
4829 				dstopt = (char *)toh + toh->len;
4830 				udi_size -= toh->len;
4831 			}
4832 
4833 			if (cr != NULL) {
4834 				struct T_opthdr *toh;
4835 
4836 				toh = (struct T_opthdr *)dstopt;
4837 				toh->level = SOL_SOCKET;
4838 				toh->name = SCM_UCRED;
4839 				toh->len = sizeof (struct T_opthdr) + ucredsize;
4840 				toh->status = 0;
4841 				(void) cred2ucred(cr, cpid, &toh[1], rcr);
4842 				dstopt = (char *)toh + toh->len;
4843 				udi_size -= toh->len;
4844 			}
4845 
4846 			if (udp->udp_timestamp) {
4847 				struct	T_opthdr *toh;
4848 
4849 				toh = (struct T_opthdr *)dstopt;
4850 				toh->level = SOL_SOCKET;
4851 				toh->name = SCM_TIMESTAMP;
4852 				toh->len = sizeof (struct T_opthdr) +
4853 				    sizeof (timestruc_t) + _POINTER_ALIGNMENT;
4854 				toh->status = 0;
4855 				dstopt += sizeof (struct T_opthdr);
4856 				/* Align for gethrestime() */
4857 				dstopt = (char *)P2ROUNDUP((intptr_t)dstopt,
4858 				    sizeof (intptr_t));
4859 				gethrestime((timestruc_t *)dstopt);
4860 				dstopt = (char *)toh + toh->len;
4861 				udi_size -= toh->len;
4862 			}
4863 
4864 			/*
4865 			 * CAUTION:
4866 			 * Due to aligment issues
4867 			 * Processing of IP_RECVTTL option
4868 			 * should always be the last. Adding
4869 			 * any option processing after this will
4870 			 * cause alignment panic.
4871 			 */
4872 			if (udp->udp_recvttl) {
4873 				struct	T_opthdr *toh;
4874 				uint8_t	*dstptr;
4875 
4876 				toh = (struct T_opthdr *)dstopt;
4877 				toh->level = IPPROTO_IP;
4878 				toh->name = IP_RECVTTL;
4879 				toh->len = sizeof (struct T_opthdr) +
4880 				    sizeof (uint8_t);
4881 				toh->status = 0;
4882 				dstopt += sizeof (struct T_opthdr);
4883 				dstptr = (uint8_t *)dstopt;
4884 				*dstptr = ((ipha_t *)rptr)->ipha_ttl;
4885 				dstopt = (char *)toh + toh->len;
4886 				udi_size -= toh->len;
4887 			}
4888 
4889 			/* Consumed all of allocated space */
4890 			ASSERT(udi_size == 0);
4891 		}
4892 	} else {
4893 		sin6_t *sin6;
4894 
4895 		/*
4896 		 * Handle both IPv4 and IPv6 packets for IPv6 sockets.
4897 		 *
4898 		 * Normally we only send up the address. If receiving of any
4899 		 * optional receive side information is enabled, we also send
4900 		 * that up as options.
4901 		 * [ Only udp_rput_other() handles packets that contain IP
4902 		 * options so code to account for does not appear immediately
4903 		 * below but elsewhere ]
4904 		 */
4905 		udi_size = sizeof (struct T_unitdata_ind) + sizeof (sin6_t);
4906 
4907 		if (ipp.ipp_fields & (IPPF_HOPOPTS|IPPF_DSTOPTS|IPPF_RTDSTOPTS|
4908 		    IPPF_RTHDR|IPPF_IFINDEX)) {
4909 			if (udp->udp_ipv6_recvhopopts &&
4910 			    (ipp.ipp_fields & IPPF_HOPOPTS)) {
4911 				size_t hlen;
4912 
4913 				UDP_STAT(udp_in_recvhopopts);
4914 				hlen = copy_hop_opts(&ipp, NULL);
4915 				if (hlen == 0)
4916 					ipp.ipp_fields &= ~IPPF_HOPOPTS;
4917 				udi_size += hlen;
4918 			}
4919 			if ((udp->udp_ipv6_recvdstopts ||
4920 				udp->udp_old_ipv6_recvdstopts) &&
4921 			    (ipp.ipp_fields & IPPF_DSTOPTS)) {
4922 				udi_size += sizeof (struct T_opthdr) +
4923 				    ipp.ipp_dstoptslen;
4924 				UDP_STAT(udp_in_recvdstopts);
4925 			}
4926 			if (((udp->udp_ipv6_recvdstopts &&
4927 			    udp->udp_ipv6_recvrthdr &&
4928 			    (ipp.ipp_fields & IPPF_RTHDR)) ||
4929 			    udp->udp_ipv6_recvrthdrdstopts) &&
4930 			    (ipp.ipp_fields & IPPF_RTDSTOPTS)) {
4931 				udi_size += sizeof (struct T_opthdr) +
4932 				    ipp.ipp_rtdstoptslen;
4933 				UDP_STAT(udp_in_recvrtdstopts);
4934 			}
4935 			if (udp->udp_ipv6_recvrthdr &&
4936 			    (ipp.ipp_fields & IPPF_RTHDR)) {
4937 				udi_size += sizeof (struct T_opthdr) +
4938 				    ipp.ipp_rthdrlen;
4939 				UDP_STAT(udp_in_recvrthdr);
4940 			}
4941 			if (udp->udp_ipv6_recvpktinfo &&
4942 			    (ipp.ipp_fields & IPPF_IFINDEX)) {
4943 				udi_size += sizeof (struct T_opthdr) +
4944 				    sizeof (struct in6_pktinfo);
4945 				UDP_STAT(udp_in_recvpktinfo);
4946 			}
4947 
4948 		}
4949 		if (udp->udp_recvucred && (cr = DB_CRED(mp)) != NULL) {
4950 			udi_size += sizeof (struct T_opthdr) + ucredsize;
4951 			cpid = DB_CPID(mp);
4952 			UDP_STAT(udp_in_recvucred);
4953 		}
4954 
4955 		if (udp->udp_ipv6_recvhoplimit) {
4956 			udi_size += sizeof (struct T_opthdr) + sizeof (int);
4957 			UDP_STAT(udp_in_recvhoplimit);
4958 		}
4959 
4960 		if (udp->udp_ipv6_recvtclass) {
4961 			udi_size += sizeof (struct T_opthdr) + sizeof (int);
4962 			UDP_STAT(udp_in_recvtclass);
4963 		}
4964 
4965 		mp1 = allocb(udi_size, BPRI_MED);
4966 		if (mp1 == NULL) {
4967 			freemsg(mp);
4968 			if (options_mp != NULL)
4969 				freeb(options_mp);
4970 			TRACE_2(TR_FAC_UDP, TR_UDP_RPUT_END,
4971 				"udp_rput_end: q %p (%S)", q, "allocbfail");
4972 			BUMP_MIB(&udp_mib, udpInErrors);
4973 			return;
4974 		}
4975 		mp1->b_cont = mp;
4976 		mp = mp1;
4977 		mp->b_datap->db_type = M_PROTO;
4978 		tudi = (struct T_unitdata_ind *)mp->b_rptr;
4979 		mp->b_wptr = (uchar_t *)tudi + udi_size;
4980 		tudi->PRIM_type = T_UNITDATA_IND;
4981 		tudi->SRC_length = sizeof (sin6_t);
4982 		tudi->SRC_offset = sizeof (struct T_unitdata_ind);
4983 		tudi->OPT_offset = sizeof (struct T_unitdata_ind) +
4984 		    sizeof (sin6_t);
4985 		udi_size -= (sizeof (struct T_unitdata_ind) + sizeof (sin6_t));
4986 		tudi->OPT_length = udi_size;
4987 		sin6 = (sin6_t *)&tudi[1];
4988 		if (ipversion == IPV4_VERSION) {
4989 			in6_addr_t v6dst;
4990 
4991 			IN6_IPADDR_TO_V4MAPPED(((ipha_t *)rptr)->ipha_src,
4992 			    &sin6->sin6_addr);
4993 			IN6_IPADDR_TO_V4MAPPED(((ipha_t *)rptr)->ipha_dst,
4994 			    &v6dst);
4995 			sin6->sin6_flowinfo = 0;
4996 			sin6->sin6_scope_id = 0;
4997 			sin6->__sin6_src_id = ip_srcid_find_addr(&v6dst,
4998 			    connp->conn_zoneid);
4999 		} else {
5000 			sin6->sin6_addr = ip6h->ip6_src;
5001 			/* No sin6_flowinfo per API */
5002 			sin6->sin6_flowinfo = 0;
5003 			/* For link-scope source pass up scope id */
5004 			if ((ipp.ipp_fields & IPPF_IFINDEX) &&
5005 			    IN6_IS_ADDR_LINKSCOPE(&ip6h->ip6_src))
5006 				sin6->sin6_scope_id = ipp.ipp_ifindex;
5007 			else
5008 				sin6->sin6_scope_id = 0;
5009 			sin6->__sin6_src_id = ip_srcid_find_addr(
5010 			    &ip6h->ip6_dst, connp->conn_zoneid);
5011 		}
5012 		sin6->sin6_port = udpha->uha_src_port;
5013 		sin6->sin6_family = udp->udp_family;
5014 
5015 		if (udi_size != 0) {
5016 			uchar_t *dstopt;
5017 
5018 			dstopt = (uchar_t *)&sin6[1];
5019 			if (udp->udp_ipv6_recvpktinfo &&
5020 			    (ipp.ipp_fields & IPPF_IFINDEX)) {
5021 				struct T_opthdr *toh;
5022 				struct in6_pktinfo *pkti;
5023 
5024 				toh = (struct T_opthdr *)dstopt;
5025 				toh->level = IPPROTO_IPV6;
5026 				toh->name = IPV6_PKTINFO;
5027 				toh->len = sizeof (struct T_opthdr) +
5028 				    sizeof (*pkti);
5029 				toh->status = 0;
5030 				dstopt += sizeof (struct T_opthdr);
5031 				pkti = (struct in6_pktinfo *)dstopt;
5032 				if (ipversion == IPV6_VERSION)
5033 					pkti->ipi6_addr = ip6h->ip6_dst;
5034 				else
5035 					IN6_IPADDR_TO_V4MAPPED(
5036 						((ipha_t *)rptr)->ipha_dst,
5037 						    &pkti->ipi6_addr);
5038 				pkti->ipi6_ifindex = ipp.ipp_ifindex;
5039 				dstopt += sizeof (*pkti);
5040 				udi_size -= toh->len;
5041 			}
5042 			if (udp->udp_ipv6_recvhoplimit) {
5043 				struct T_opthdr *toh;
5044 
5045 				toh = (struct T_opthdr *)dstopt;
5046 				toh->level = IPPROTO_IPV6;
5047 				toh->name = IPV6_HOPLIMIT;
5048 				toh->len = sizeof (struct T_opthdr) +
5049 				    sizeof (uint_t);
5050 				toh->status = 0;
5051 				dstopt += sizeof (struct T_opthdr);
5052 				if (ipversion == IPV6_VERSION)
5053 					*(uint_t *)dstopt = ip6h->ip6_hops;
5054 				else
5055 					*(uint_t *)dstopt =
5056 					    ((ipha_t *)rptr)->ipha_ttl;
5057 				dstopt += sizeof (uint_t);
5058 				udi_size -= toh->len;
5059 			}
5060 			if (udp->udp_ipv6_recvtclass) {
5061 				struct T_opthdr *toh;
5062 
5063 				toh = (struct T_opthdr *)dstopt;
5064 				toh->level = IPPROTO_IPV6;
5065 				toh->name = IPV6_TCLASS;
5066 				toh->len = sizeof (struct T_opthdr) +
5067 				    sizeof (uint_t);
5068 				toh->status = 0;
5069 				dstopt += sizeof (struct T_opthdr);
5070 				if (ipversion == IPV6_VERSION) {
5071 					*(uint_t *)dstopt =
5072 					IPV6_FLOW_TCLASS(ip6h->ip6_flow);
5073 				} else {
5074 					ipha_t *ipha = (ipha_t *)rptr;
5075 					*(uint_t *)dstopt =
5076 					    ipha->ipha_type_of_service;
5077 				}
5078 				dstopt += sizeof (uint_t);
5079 				udi_size -= toh->len;
5080 			}
5081 			if (udp->udp_ipv6_recvhopopts &&
5082 			    (ipp.ipp_fields & IPPF_HOPOPTS)) {
5083 				size_t hlen;
5084 
5085 				hlen = copy_hop_opts(&ipp, dstopt);
5086 				dstopt += hlen;
5087 				udi_size -= hlen;
5088 			}
5089 			if (udp->udp_ipv6_recvdstopts &&
5090 			    udp->udp_ipv6_recvrthdr &&
5091 			    (ipp.ipp_fields & IPPF_RTHDR) &&
5092 			    (ipp.ipp_fields & IPPF_RTDSTOPTS)) {
5093 				struct T_opthdr *toh;
5094 
5095 				toh = (struct T_opthdr *)dstopt;
5096 				toh->level = IPPROTO_IPV6;
5097 				toh->name = IPV6_DSTOPTS;
5098 				toh->len = sizeof (struct T_opthdr) +
5099 				    ipp.ipp_rtdstoptslen;
5100 				toh->status = 0;
5101 				dstopt += sizeof (struct T_opthdr);
5102 				bcopy(ipp.ipp_rtdstopts, dstopt,
5103 				    ipp.ipp_rtdstoptslen);
5104 				dstopt += ipp.ipp_rtdstoptslen;
5105 				udi_size -= toh->len;
5106 			}
5107 			if (udp->udp_ipv6_recvrthdr &&
5108 			    (ipp.ipp_fields & IPPF_RTHDR)) {
5109 				struct T_opthdr *toh;
5110 
5111 				toh = (struct T_opthdr *)dstopt;
5112 				toh->level = IPPROTO_IPV6;
5113 				toh->name = IPV6_RTHDR;
5114 				toh->len = sizeof (struct T_opthdr) +
5115 				    ipp.ipp_rthdrlen;
5116 				toh->status = 0;
5117 				dstopt += sizeof (struct T_opthdr);
5118 				bcopy(ipp.ipp_rthdr, dstopt, ipp.ipp_rthdrlen);
5119 				dstopt += ipp.ipp_rthdrlen;
5120 				udi_size -= toh->len;
5121 			}
5122 			if (udp->udp_ipv6_recvdstopts &&
5123 			    (ipp.ipp_fields & IPPF_DSTOPTS)) {
5124 				struct T_opthdr *toh;
5125 
5126 				toh = (struct T_opthdr *)dstopt;
5127 				toh->level = IPPROTO_IPV6;
5128 				toh->name = IPV6_DSTOPTS;
5129 				toh->len = sizeof (struct T_opthdr) +
5130 				    ipp.ipp_dstoptslen;
5131 				toh->status = 0;
5132 				dstopt += sizeof (struct T_opthdr);
5133 				bcopy(ipp.ipp_dstopts, dstopt,
5134 				    ipp.ipp_dstoptslen);
5135 				dstopt += ipp.ipp_dstoptslen;
5136 				udi_size -= toh->len;
5137 			}
5138 
5139 			if (cr != NULL) {
5140 				struct T_opthdr *toh;
5141 
5142 				toh = (struct T_opthdr *)dstopt;
5143 				toh->level = SOL_SOCKET;
5144 				toh->name = SCM_UCRED;
5145 				toh->len = sizeof (struct T_opthdr) + ucredsize;
5146 				toh->status = 0;
5147 				(void) cred2ucred(cr, cpid, &toh[1], rcr);
5148 				dstopt += toh->len;
5149 				udi_size -= toh->len;
5150 			}
5151 			/* Consumed all of allocated space */
5152 			ASSERT(udi_size == 0);
5153 		}
5154 #undef	sin6
5155 		/* No IP_RECVDSTADDR for IPv6. */
5156 	}
5157 
5158 	BUMP_MIB(&udp_mib, udpInDatagrams);
5159 	TRACE_2(TR_FAC_UDP, TR_UDP_RPUT_END,
5160 		"udp_rput_end: q %p (%S)", q, "end");
5161 	if (options_mp != NULL)
5162 		freeb(options_mp);
5163 
5164 	if (udp->udp_direct_sockfs) {
5165 		/*
5166 		 * There is nothing above us except for the stream head;
5167 		 * use the read-side synchronous stream interface in
5168 		 * order to reduce the time spent in interrupt thread.
5169 		 */
5170 		ASSERT(udp->udp_issocket);
5171 		udp_rcv_enqueue(UDP_RD(q), udp, mp, mp_len);
5172 	} else {
5173 		/*
5174 		 * Use regular STREAMS interface to pass data upstream
5175 		 * if this is not a socket endpoint, or if we have
5176 		 * switched over to the slow mode due to sockmod being
5177 		 * popped or a module being pushed on top of us.
5178 		 */
5179 		putnext(UDP_RD(q), mp);
5180 	}
5181 	return;
5182 
5183 tossit:
5184 	freemsg(mp);
5185 	if (options_mp != NULL)
5186 		freeb(options_mp);
5187 	BUMP_MIB(&udp_mib, udpInErrors);
5188 }
5189 
5190 void
5191 udp_conn_recv(conn_t *connp, mblk_t *mp)
5192 {
5193 	_UDP_ENTER(connp, mp, udp_input_wrapper, SQTAG_UDP_FANOUT);
5194 }
5195 
5196 /* ARGSUSED */
5197 static void
5198 udp_input_wrapper(void *arg, mblk_t *mp, void *arg2)
5199 {
5200 	udp_input((conn_t *)arg, mp);
5201 	_UDP_EXIT((conn_t *)arg);
5202 }
5203 
5204 /*
5205  * Process non-M_DATA messages as well as M_DATA messages that requires
5206  * modifications to udp_ip_rcv_options i.e. IPv4 packets with IP options.
5207  */
5208 static void
5209 udp_rput_other(queue_t *q, mblk_t *mp)
5210 {
5211 	struct T_unitdata_ind	*tudi;
5212 	mblk_t			*mp1;
5213 	uchar_t			*rptr;
5214 	uchar_t			*new_rptr;
5215 	int			hdr_length;
5216 	int			udi_size;	/* Size of T_unitdata_ind */
5217 	int			opt_len;	/* Length of IP options */
5218 	sin_t			*sin;
5219 	struct T_error_ack	*tea;
5220 	mblk_t			*options_mp = NULL;
5221 	in_pktinfo_t		*pinfo;
5222 	boolean_t		recv_on = B_FALSE;
5223 	cred_t			*cr = NULL;
5224 	udp_t			*udp = Q_TO_UDP(q);
5225 	pid_t			cpid;
5226 	cred_t			*rcr = udp->udp_connp->conn_cred;
5227 
5228 	TRACE_2(TR_FAC_UDP, TR_UDP_RPUT_START,
5229 	    "udp_rput_other: q %p mp %p", q, mp);
5230 
5231 	ASSERT(OK_32PTR(mp->b_rptr));
5232 	rptr = mp->b_rptr;
5233 
5234 	switch (mp->b_datap->db_type) {
5235 	case M_CTL:
5236 		/*
5237 		 * We are here only if IP_RECVSLLA and/or IP_RECVIF are set
5238 		 */
5239 		recv_on = B_TRUE;
5240 		options_mp = mp;
5241 		pinfo = (in_pktinfo_t *)options_mp->b_rptr;
5242 
5243 		/*
5244 		 * The actual data is in mp->b_cont
5245 		 */
5246 		mp = mp->b_cont;
5247 		ASSERT(OK_32PTR(mp->b_rptr));
5248 		rptr = mp->b_rptr;
5249 		break;
5250 	case M_DATA:
5251 		/*
5252 		 * M_DATA messages contain IPv4 datagrams.  They are handled
5253 		 * after this switch.
5254 		 */
5255 		break;
5256 	case M_PROTO:
5257 	case M_PCPROTO:
5258 		/* M_PROTO messages contain some type of TPI message. */
5259 		ASSERT((uintptr_t)(mp->b_wptr - rptr) <= (uintptr_t)INT_MAX);
5260 		if (mp->b_wptr - rptr < sizeof (t_scalar_t)) {
5261 			freemsg(mp);
5262 			TRACE_2(TR_FAC_UDP, TR_UDP_RPUT_END,
5263 			    "udp_rput_other_end: q %p (%S)", q, "protoshort");
5264 			return;
5265 		}
5266 		tea = (struct T_error_ack *)rptr;
5267 
5268 		switch (tea->PRIM_type) {
5269 		case T_ERROR_ACK:
5270 			switch (tea->ERROR_prim) {
5271 			case O_T_BIND_REQ:
5272 			case T_BIND_REQ: {
5273 				/*
5274 				 * If our O_T_BIND_REQ/T_BIND_REQ fails,
5275 				 * clear out the associated port and source
5276 				 * address before passing the message
5277 				 * upstream. If this was caused by a T_CONN_REQ
5278 				 * revert back to bound state.
5279 				 */
5280 				udp_fanout_t	*udpf;
5281 
5282 				udpf = &udp_bind_fanout[
5283 				    UDP_BIND_HASH(udp->udp_port)];
5284 				mutex_enter(&udpf->uf_lock);
5285 				if (udp->udp_state == TS_DATA_XFER) {
5286 					/* Connect failed */
5287 					tea->ERROR_prim = T_CONN_REQ;
5288 					/* Revert back to the bound source */
5289 					udp->udp_v6src = udp->udp_bound_v6src;
5290 					udp->udp_state = TS_IDLE;
5291 					mutex_exit(&udpf->uf_lock);
5292 					if (udp->udp_family == AF_INET6)
5293 						(void) udp_build_hdrs(q, udp);
5294 					break;
5295 				}
5296 
5297 				if (udp->udp_discon_pending) {
5298 					tea->ERROR_prim = T_DISCON_REQ;
5299 					udp->udp_discon_pending = 0;
5300 				}
5301 				V6_SET_ZERO(udp->udp_v6src);
5302 				V6_SET_ZERO(udp->udp_bound_v6src);
5303 				udp->udp_state = TS_UNBND;
5304 				udp_bind_hash_remove(udp, B_TRUE);
5305 				udp->udp_port = 0;
5306 				mutex_exit(&udpf->uf_lock);
5307 				if (udp->udp_family == AF_INET6)
5308 					(void) udp_build_hdrs(q, udp);
5309 				break;
5310 			}
5311 			default:
5312 				break;
5313 			}
5314 			break;
5315 		case T_BIND_ACK:
5316 			udp_rput_bind_ack(q, mp);
5317 			return;
5318 
5319 		case T_OPTMGMT_ACK:
5320 		case T_OK_ACK:
5321 			break;
5322 		default:
5323 			freemsg(mp);
5324 			return;
5325 		}
5326 		putnext(UDP_RD(q), mp);
5327 		return;
5328 	}
5329 
5330 	/*
5331 	 * This is the inbound data path.
5332 	 * First, we make sure the data contains both IP and UDP headers.
5333 	 *
5334 	 * This handle IPv4 packets for only AF_INET sockets.
5335 	 * AF_INET6 sockets can never access udp_ip_rcv_options thus there
5336 	 * is no need saving the options.
5337 	 */
5338 	ASSERT(IPH_HDR_VERSION((ipha_t *)rptr) == IPV4_VERSION);
5339 	hdr_length = IPH_HDR_LENGTH(rptr) + UDPH_SIZE;
5340 	if (mp->b_wptr - rptr < hdr_length) {
5341 		if (!pullupmsg(mp, hdr_length)) {
5342 			freemsg(mp);
5343 			if (options_mp != NULL)
5344 				freeb(options_mp);
5345 			BUMP_MIB(&udp_mib, udpInErrors);
5346 			TRACE_2(TR_FAC_UDP, TR_UDP_RPUT_END,
5347 			    "udp_rput_other_end: q %p (%S)", q, "hdrshort");
5348 			BUMP_MIB(&udp_mib, udpInErrors);
5349 			return;
5350 		}
5351 		rptr = mp->b_rptr;
5352 	}
5353 	/* Walk past the headers. */
5354 	new_rptr = rptr + hdr_length;
5355 	if (!udp->udp_rcvhdr)
5356 		mp->b_rptr = new_rptr;
5357 
5358 	/* Save the options if any */
5359 	opt_len = hdr_length - (IP_SIMPLE_HDR_LENGTH + UDPH_SIZE);
5360 	if (opt_len > 0) {
5361 		if (opt_len > udp->udp_ip_rcv_options_len) {
5362 			if (udp->udp_ip_rcv_options_len)
5363 				mi_free((char *)udp->udp_ip_rcv_options);
5364 			udp->udp_ip_rcv_options_len = 0;
5365 			udp->udp_ip_rcv_options =
5366 			    (uchar_t *)mi_alloc(opt_len, BPRI_HI);
5367 			if (udp->udp_ip_rcv_options)
5368 				udp->udp_ip_rcv_options_len = opt_len;
5369 		}
5370 		if (udp->udp_ip_rcv_options_len) {
5371 			bcopy(rptr + IP_SIMPLE_HDR_LENGTH,
5372 			    udp->udp_ip_rcv_options, opt_len);
5373 			/* Adjust length if we are resusing the space */
5374 			udp->udp_ip_rcv_options_len = opt_len;
5375 		}
5376 	} else if (udp->udp_ip_rcv_options_len) {
5377 		mi_free((char *)udp->udp_ip_rcv_options);
5378 		udp->udp_ip_rcv_options = NULL;
5379 		udp->udp_ip_rcv_options_len = 0;
5380 	}
5381 
5382 	/*
5383 	 * Normally only send up the address.
5384 	 * If IP_RECVDSTADDR is set we include the destination IP
5385 	 * address as an option. With IP_RECVOPTS we include all
5386 	 * the IP options.
5387 	 */
5388 	udi_size = sizeof (struct T_unitdata_ind) + sizeof (sin_t);
5389 	if (udp->udp_recvdstaddr) {
5390 		udi_size += sizeof (struct T_opthdr) + sizeof (struct in_addr);
5391 		UDP_STAT(udp_in_recvdstaddr);
5392 	}
5393 	if (udp->udp_recvopts && opt_len > 0) {
5394 		udi_size += sizeof (struct T_opthdr) + opt_len;
5395 		UDP_STAT(udp_in_recvopts);
5396 	}
5397 
5398 	/*
5399 	 * If the IP_RECVSLLA or the IP_RECVIF is set then allocate
5400 	 * space accordingly
5401 	 */
5402 	if (udp->udp_recvif && recv_on &&
5403 	    (pinfo->in_pkt_flags & IPF_RECVIF)) {
5404 		udi_size += sizeof (struct T_opthdr) + sizeof (uint_t);
5405 		UDP_STAT(udp_in_recvif);
5406 	}
5407 
5408 	if (udp->udp_recvslla && recv_on &&
5409 	    (pinfo->in_pkt_flags & IPF_RECVSLLA)) {
5410 		udi_size += sizeof (struct T_opthdr) +
5411 		    sizeof (struct sockaddr_dl);
5412 		UDP_STAT(udp_in_recvslla);
5413 	}
5414 
5415 	if (udp->udp_recvucred && (cr = DB_CRED(mp)) != NULL) {
5416 		udi_size += sizeof (struct T_opthdr) + ucredsize;
5417 		cpid = DB_CPID(mp);
5418 		UDP_STAT(udp_in_recvucred);
5419 	}
5420 	/*
5421 	 * If IP_RECVTTL is set allocate the appropriate sized buffer
5422 	 */
5423 	if (udp->udp_recvttl) {
5424 		udi_size += sizeof (struct T_opthdr) + sizeof (uint8_t);
5425 		UDP_STAT(udp_in_recvttl);
5426 	}
5427 
5428 	/* Allocate a message block for the T_UNITDATA_IND structure. */
5429 	mp1 = allocb(udi_size, BPRI_MED);
5430 	if (mp1 == NULL) {
5431 		freemsg(mp);
5432 		if (options_mp != NULL)
5433 			freeb(options_mp);
5434 		TRACE_2(TR_FAC_UDP, TR_UDP_RPUT_END,
5435 			"udp_rput_other_end: q %p (%S)", q, "allocbfail");
5436 		BUMP_MIB(&udp_mib, udpInErrors);
5437 		return;
5438 	}
5439 	mp1->b_cont = mp;
5440 	mp = mp1;
5441 	mp->b_datap->db_type = M_PROTO;
5442 	tudi = (struct T_unitdata_ind *)mp->b_rptr;
5443 	mp->b_wptr = (uchar_t *)tudi + udi_size;
5444 	tudi->PRIM_type = T_UNITDATA_IND;
5445 	tudi->SRC_length = sizeof (sin_t);
5446 	tudi->SRC_offset = sizeof (struct T_unitdata_ind);
5447 	tudi->OPT_offset = sizeof (struct T_unitdata_ind) + sizeof (sin_t);
5448 	udi_size -= (sizeof (struct T_unitdata_ind) + sizeof (sin_t));
5449 	tudi->OPT_length = udi_size;
5450 
5451 	sin = (sin_t *)&tudi[1];
5452 	sin->sin_addr.s_addr = ((ipha_t *)rptr)->ipha_src;
5453 	sin->sin_port =	((in_port_t *)
5454 	    new_rptr)[-(UDPH_SIZE/sizeof (in_port_t))];
5455 	sin->sin_family = AF_INET;
5456 	*(uint32_t *)&sin->sin_zero[0] = 0;
5457 	*(uint32_t *)&sin->sin_zero[4] = 0;
5458 
5459 	/*
5460 	 * Add options if IP_RECVDSTADDR, IP_RECVIF, IP_RECVSLLA or
5461 	 * IP_RECVTTL has been set.
5462 	 */
5463 	if (udi_size != 0) {
5464 		/*
5465 		 * Copy in destination address before options to avoid any
5466 		 * padding issues.
5467 		 */
5468 		char *dstopt;
5469 
5470 		dstopt = (char *)&sin[1];
5471 		if (udp->udp_recvdstaddr) {
5472 			struct T_opthdr *toh;
5473 			ipaddr_t *dstptr;
5474 
5475 			toh = (struct T_opthdr *)dstopt;
5476 			toh->level = IPPROTO_IP;
5477 			toh->name = IP_RECVDSTADDR;
5478 			toh->len = sizeof (struct T_opthdr) + sizeof (ipaddr_t);
5479 			toh->status = 0;
5480 			dstopt += sizeof (struct T_opthdr);
5481 			dstptr = (ipaddr_t *)dstopt;
5482 			*dstptr = (((ipaddr_t *)rptr)[4]);
5483 			dstopt += sizeof (ipaddr_t);
5484 			udi_size -= toh->len;
5485 		}
5486 		if (udp->udp_recvopts && udi_size != 0) {
5487 			struct T_opthdr *toh;
5488 
5489 			toh = (struct T_opthdr *)dstopt;
5490 			toh->level = IPPROTO_IP;
5491 			toh->name = IP_RECVOPTS;
5492 			toh->len = sizeof (struct T_opthdr) + opt_len;
5493 			toh->status = 0;
5494 			dstopt += sizeof (struct T_opthdr);
5495 			bcopy(rptr + IP_SIMPLE_HDR_LENGTH, dstopt, opt_len);
5496 			dstopt += opt_len;
5497 			udi_size -= toh->len;
5498 		}
5499 
5500 		if (udp->udp_recvslla && recv_on &&
5501 		    (pinfo->in_pkt_flags & IPF_RECVSLLA)) {
5502 
5503 			struct T_opthdr *toh;
5504 			struct sockaddr_dl	*dstptr;
5505 
5506 			toh = (struct T_opthdr *)dstopt;
5507 			toh->level = IPPROTO_IP;
5508 			toh->name = IP_RECVSLLA;
5509 			toh->len = sizeof (struct T_opthdr) +
5510 			    sizeof (struct sockaddr_dl);
5511 			toh->status = 0;
5512 			dstopt += sizeof (struct T_opthdr);
5513 			dstptr = (struct sockaddr_dl *)dstopt;
5514 			bcopy(&pinfo->in_pkt_slla, dstptr,
5515 			    sizeof (struct sockaddr_dl));
5516 			dstopt += sizeof (struct sockaddr_dl);
5517 			udi_size -= toh->len;
5518 		}
5519 
5520 		if (udp->udp_recvif && recv_on &&
5521 		    (pinfo->in_pkt_flags & IPF_RECVIF)) {
5522 
5523 			struct T_opthdr *toh;
5524 			uint_t		*dstptr;
5525 
5526 			toh = (struct T_opthdr *)dstopt;
5527 			toh->level = IPPROTO_IP;
5528 			toh->name = IP_RECVIF;
5529 			toh->len = sizeof (struct T_opthdr) +
5530 			    sizeof (uint_t);
5531 			toh->status = 0;
5532 			dstopt += sizeof (struct T_opthdr);
5533 			dstptr = (uint_t *)dstopt;
5534 			*dstptr = pinfo->in_pkt_ifindex;
5535 			dstopt += sizeof (uint_t);
5536 			udi_size -= toh->len;
5537 		}
5538 
5539 		if (cr != NULL) {
5540 			struct T_opthdr *toh;
5541 
5542 			toh = (struct T_opthdr *)dstopt;
5543 			toh->level = SOL_SOCKET;
5544 			toh->name = SCM_UCRED;
5545 			toh->len = sizeof (struct T_opthdr) + ucredsize;
5546 			toh->status = 0;
5547 			(void) cred2ucred(cr, cpid, &toh[1], rcr);
5548 			dstopt += toh->len;
5549 			udi_size -= toh->len;
5550 		}
5551 
5552 		if (udp->udp_recvttl) {
5553 			struct	T_opthdr *toh;
5554 			uint8_t	*dstptr;
5555 
5556 			toh = (struct T_opthdr *)dstopt;
5557 			toh->level = IPPROTO_IP;
5558 			toh->name = IP_RECVTTL;
5559 			toh->len = sizeof (struct T_opthdr) +
5560 			    sizeof (uint8_t);
5561 			toh->status = 0;
5562 			dstopt += sizeof (struct T_opthdr);
5563 			dstptr = (uint8_t *)dstopt;
5564 			*dstptr = ((ipha_t *)rptr)->ipha_ttl;
5565 			dstopt += sizeof (uint8_t);
5566 			udi_size -= toh->len;
5567 		}
5568 
5569 		ASSERT(udi_size == 0);	/* "Consumed" all of allocated space */
5570 	}
5571 	BUMP_MIB(&udp_mib, udpInDatagrams);
5572 	TRACE_2(TR_FAC_UDP, TR_UDP_RPUT_END,
5573 	    "udp_rput_other_end: q %p (%S)", q, "end");
5574 	if (options_mp != NULL)
5575 		freeb(options_mp);
5576 
5577 	if (udp->udp_direct_sockfs) {
5578 		/*
5579 		 * There is nothing above us except for the stream head;
5580 		 * use the read-side synchronous stream interface in
5581 		 * order to reduce the time spent in interrupt thread.
5582 		 */
5583 		ASSERT(udp->udp_issocket);
5584 		udp_rcv_enqueue(UDP_RD(q), udp, mp, msgdsize(mp));
5585 	} else {
5586 		/*
5587 		 * Use regular STREAMS interface to pass data upstream
5588 		 * if this is not a socket endpoint, or if we have
5589 		 * switched over to the slow mode due to sockmod being
5590 		 * popped or a module being pushed on top of us.
5591 		 */
5592 		putnext(UDP_RD(q), mp);
5593 	}
5594 }
5595 
5596 /* ARGSUSED */
5597 static void
5598 udp_rput_other_wrapper(void *arg, mblk_t *mp, void *arg2)
5599 {
5600 	conn_t *connp = arg;
5601 
5602 	udp_rput_other(connp->conn_rq, mp);
5603 	udp_exit(connp);
5604 }
5605 
5606 /*
5607  * Process a T_BIND_ACK
5608  */
5609 static void
5610 udp_rput_bind_ack(queue_t *q, mblk_t *mp)
5611 {
5612 	udp_t	*udp = Q_TO_UDP(q);
5613 	mblk_t	*mp1;
5614 	ire_t	*ire;
5615 	struct T_bind_ack *tba;
5616 	uchar_t *addrp;
5617 	ipa_conn_t	*ac;
5618 	ipa6_conn_t	*ac6;
5619 
5620 	if (udp->udp_discon_pending)
5621 		udp->udp_discon_pending = 0;
5622 
5623 	/*
5624 	 * If a broadcast/multicast address was bound set
5625 	 * the source address to 0.
5626 	 * This ensures no datagrams with broadcast address
5627 	 * as source address are emitted (which would violate
5628 	 * RFC1122 - Hosts requirements)
5629 	 *
5630 	 * Note that when connecting the returned IRE is
5631 	 * for the destination address and we only perform
5632 	 * the broadcast check for the source address (it
5633 	 * is OK to connect to a broadcast/multicast address.)
5634 	 */
5635 	mp1 = mp->b_cont;
5636 	if (mp1 != NULL && mp1->b_datap->db_type == IRE_DB_TYPE) {
5637 		ire = (ire_t *)mp1->b_rptr;
5638 
5639 		/*
5640 		 * Note: we get IRE_BROADCAST for IPv6 to "mark" a multicast
5641 		 * local address.
5642 		 */
5643 		if (ire->ire_type == IRE_BROADCAST &&
5644 		    udp->udp_state != TS_DATA_XFER) {
5645 			/* This was just a local bind to a broadcast addr */
5646 			V6_SET_ZERO(udp->udp_v6src);
5647 			if (udp->udp_family == AF_INET6)
5648 				(void) udp_build_hdrs(q, udp);
5649 		} else if (V6_OR_V4_INADDR_ANY(udp->udp_v6src)) {
5650 			/*
5651 			 * Local address not yet set - pick it from the
5652 			 * T_bind_ack
5653 			 */
5654 			tba = (struct T_bind_ack *)mp->b_rptr;
5655 			addrp = &mp->b_rptr[tba->ADDR_offset];
5656 			switch (udp->udp_family) {
5657 			case AF_INET:
5658 				if (tba->ADDR_length == sizeof (ipa_conn_t)) {
5659 					ac = (ipa_conn_t *)addrp;
5660 				} else {
5661 					ASSERT(tba->ADDR_length ==
5662 					    sizeof (ipa_conn_x_t));
5663 					ac = &((ipa_conn_x_t *)addrp)->acx_conn;
5664 				}
5665 				IN6_IPADDR_TO_V4MAPPED(ac->ac_laddr,
5666 				    &udp->udp_v6src);
5667 				break;
5668 			case AF_INET6:
5669 				if (tba->ADDR_length == sizeof (ipa6_conn_t)) {
5670 					ac6 = (ipa6_conn_t *)addrp;
5671 				} else {
5672 					ASSERT(tba->ADDR_length ==
5673 					    sizeof (ipa6_conn_x_t));
5674 					ac6 = &((ipa6_conn_x_t *)
5675 					    addrp)->ac6x_conn;
5676 				}
5677 				udp->udp_v6src = ac6->ac6_laddr;
5678 				(void) udp_build_hdrs(q, udp);
5679 				break;
5680 			}
5681 		}
5682 		mp1 = mp1->b_cont;
5683 	}
5684 	/*
5685 	 * Look for one or more appended ACK message added by
5686 	 * udp_connect or udp_disconnect.
5687 	 * If none found just send up the T_BIND_ACK.
5688 	 * udp_connect has appended a T_OK_ACK and a T_CONN_CON.
5689 	 * udp_disconnect has appended a T_OK_ACK.
5690 	 */
5691 	if (mp1 != NULL) {
5692 		if (mp->b_cont == mp1)
5693 			mp->b_cont = NULL;
5694 		else {
5695 			ASSERT(mp->b_cont->b_cont == mp1);
5696 			mp->b_cont->b_cont = NULL;
5697 		}
5698 		freemsg(mp);
5699 		mp = mp1;
5700 		while (mp != NULL) {
5701 			mp1 = mp->b_cont;
5702 			mp->b_cont = NULL;
5703 			putnext(UDP_RD(q), mp);
5704 			mp = mp1;
5705 		}
5706 		return;
5707 	}
5708 	freemsg(mp->b_cont);
5709 	mp->b_cont = NULL;
5710 	putnext(UDP_RD(q), mp);
5711 }
5712 
5713 /*
5714  * return SNMP stuff in buffer in mpdata
5715  */
5716 int
5717 udp_snmp_get(queue_t *q, mblk_t *mpctl)
5718 {
5719 	mblk_t			*mpdata;
5720 	mblk_t			*mp_conn_ctl;
5721 	mblk_t			*mp_attr_ctl;
5722 	mblk_t			*mp6_conn_ctl;
5723 	mblk_t			*mp6_attr_ctl;
5724 	mblk_t			*mp_conn_tail;
5725 	mblk_t			*mp_attr_tail;
5726 	mblk_t			*mp6_conn_tail;
5727 	mblk_t			*mp6_attr_tail;
5728 	struct opthdr		*optp;
5729 	mib2_udpEntry_t		ude;
5730 	mib2_udp6Entry_t	ude6;
5731 	mib2_transportMLPEntry_t mlp;
5732 	int			state;
5733 	zoneid_t		zoneid;
5734 	int			i;
5735 	connf_t			*connfp;
5736 	conn_t			*connp = Q_TO_CONN(q);
5737 	udp_t			*udp = connp->conn_udp;
5738 	int			v4_conn_idx;
5739 	int			v6_conn_idx;
5740 	boolean_t		needattr;
5741 
5742 	mp_conn_ctl = mp_attr_ctl = mp6_conn_ctl = NULL;
5743 	if (mpctl == NULL ||
5744 	    (mpdata = mpctl->b_cont) == NULL ||
5745 	    (mp_conn_ctl = copymsg(mpctl)) == NULL ||
5746 	    (mp_attr_ctl = copymsg(mpctl)) == NULL ||
5747 	    (mp6_conn_ctl = copymsg(mpctl)) == NULL ||
5748 	    (mp6_attr_ctl = copymsg(mpctl)) == NULL) {
5749 		freemsg(mp_conn_ctl);
5750 		freemsg(mp_attr_ctl);
5751 		freemsg(mp6_conn_ctl);
5752 		return (0);
5753 	}
5754 
5755 	zoneid = connp->conn_zoneid;
5756 
5757 	/* fixed length structure for IPv4 and IPv6 counters */
5758 	SET_MIB(udp_mib.udpEntrySize, sizeof (mib2_udpEntry_t));
5759 	SET_MIB(udp_mib.udp6EntrySize, sizeof (mib2_udp6Entry_t));
5760 	optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
5761 	optp->level = MIB2_UDP;
5762 	optp->name = 0;
5763 	(void) snmp_append_data(mpdata, (char *)&udp_mib, sizeof (udp_mib));
5764 	optp->len = msgdsize(mpdata);
5765 	qreply(q, mpctl);
5766 
5767 	mp_conn_tail = mp_attr_tail = mp6_conn_tail = mp6_attr_tail = NULL;
5768 	v4_conn_idx = v6_conn_idx = 0;
5769 
5770 	for (i = 0; i < CONN_G_HASH_SIZE; i++) {
5771 		connfp = &ipcl_globalhash_fanout[i];
5772 		connp = NULL;
5773 
5774 		while ((connp = ipcl_get_next_conn(connfp, connp,
5775 		    IPCL_UDP))) {
5776 			udp = connp->conn_udp;
5777 			if (zoneid != connp->conn_zoneid)
5778 				continue;
5779 
5780 			/*
5781 			 * Note that the port numbers are sent in
5782 			 * host byte order
5783 			 */
5784 
5785 			if (udp->udp_state == TS_UNBND)
5786 				state = MIB2_UDP_unbound;
5787 			else if (udp->udp_state == TS_IDLE)
5788 				state = MIB2_UDP_idle;
5789 			else if (udp->udp_state == TS_DATA_XFER)
5790 				state = MIB2_UDP_connected;
5791 			else
5792 				state = MIB2_UDP_unknown;
5793 
5794 			needattr = B_FALSE;
5795 			bzero(&mlp, sizeof (mlp));
5796 			if (connp->conn_mlp_type != mlptSingle) {
5797 				if (connp->conn_mlp_type == mlptShared ||
5798 				    connp->conn_mlp_type == mlptBoth)
5799 					mlp.tme_flags |= MIB2_TMEF_SHARED;
5800 				if (connp->conn_mlp_type == mlptPrivate ||
5801 				    connp->conn_mlp_type == mlptBoth)
5802 					mlp.tme_flags |= MIB2_TMEF_PRIVATE;
5803 				needattr = B_TRUE;
5804 			}
5805 
5806 			/*
5807 			 * Create an IPv4 table entry for IPv4 entries and also
5808 			 * any IPv6 entries which are bound to in6addr_any
5809 			 * (i.e. anything a IPv4 peer could connect/send to).
5810 			 */
5811 			if (udp->udp_ipversion == IPV4_VERSION ||
5812 			    (udp->udp_state <= TS_IDLE &&
5813 			    IN6_IS_ADDR_UNSPECIFIED(&udp->udp_v6src))) {
5814 				ude.udpEntryInfo.ue_state = state;
5815 				/*
5816 				 * If in6addr_any this will set it to
5817 				 * INADDR_ANY
5818 				 */
5819 				ude.udpLocalAddress =
5820 				    V4_PART_OF_V6(udp->udp_v6src);
5821 				ude.udpLocalPort = ntohs(udp->udp_port);
5822 				if (udp->udp_state == TS_DATA_XFER) {
5823 					/*
5824 					 * Can potentially get here for
5825 					 * v6 socket if another process
5826 					 * (say, ping) has just done a
5827 					 * sendto(), changing the state
5828 					 * from the TS_IDLE above to
5829 					 * TS_DATA_XFER by the time we hit
5830 					 * this part of the code.
5831 					 */
5832 					ude.udpEntryInfo.ue_RemoteAddress =
5833 					    V4_PART_OF_V6(udp->udp_v6dst);
5834 					ude.udpEntryInfo.ue_RemotePort =
5835 					    ntohs(udp->udp_dstport);
5836 				} else {
5837 					ude.udpEntryInfo.ue_RemoteAddress = 0;
5838 					ude.udpEntryInfo.ue_RemotePort = 0;
5839 				}
5840 				(void) snmp_append_data2(mp_conn_ctl->b_cont,
5841 				    &mp_conn_tail, (char *)&ude, sizeof (ude));
5842 				mlp.tme_connidx = v4_conn_idx++;
5843 				if (needattr)
5844 					(void) snmp_append_data2(
5845 					    mp_attr_ctl->b_cont, &mp_attr_tail,
5846 					    (char *)&mlp, sizeof (mlp));
5847 			}
5848 			if (udp->udp_ipversion == IPV6_VERSION) {
5849 				ude6.udp6EntryInfo.ue_state  = state;
5850 				ude6.udp6LocalAddress = udp->udp_v6src;
5851 				ude6.udp6LocalPort = ntohs(udp->udp_port);
5852 				ude6.udp6IfIndex = udp->udp_bound_if;
5853 				if (udp->udp_state == TS_DATA_XFER) {
5854 					ude6.udp6EntryInfo.ue_RemoteAddress =
5855 					    udp->udp_v6dst;
5856 					ude6.udp6EntryInfo.ue_RemotePort =
5857 					    ntohs(udp->udp_dstport);
5858 				} else {
5859 					ude6.udp6EntryInfo.ue_RemoteAddress =
5860 					    sin6_null.sin6_addr;
5861 					ude6.udp6EntryInfo.ue_RemotePort = 0;
5862 				}
5863 				(void) snmp_append_data2(mp6_conn_ctl->b_cont,
5864 				    &mp6_conn_tail, (char *)&ude6,
5865 				    sizeof (ude6));
5866 				mlp.tme_connidx = v6_conn_idx++;
5867 				if (needattr)
5868 					(void) snmp_append_data2(
5869 					    mp6_attr_ctl->b_cont,
5870 					    &mp6_attr_tail, (char *)&mlp,
5871 					    sizeof (mlp));
5872 			}
5873 		}
5874 	}
5875 
5876 	/* IPv4 UDP endpoints */
5877 	optp = (struct opthdr *)&mp_conn_ctl->b_rptr[
5878 	    sizeof (struct T_optmgmt_ack)];
5879 	optp->level = MIB2_UDP;
5880 	optp->name = MIB2_UDP_ENTRY;
5881 	optp->len = msgdsize(mp_conn_ctl->b_cont);
5882 	qreply(q, mp_conn_ctl);
5883 
5884 	/* table of MLP attributes... */
5885 	optp = (struct opthdr *)&mp_attr_ctl->b_rptr[
5886 	    sizeof (struct T_optmgmt_ack)];
5887 	optp->level = MIB2_UDP;
5888 	optp->name = EXPER_XPORT_MLP;
5889 	optp->len = msgdsize(mp_attr_ctl->b_cont);
5890 	if (optp->len == 0)
5891 		freemsg(mp_attr_ctl);
5892 	else
5893 		qreply(q, mp_attr_ctl);
5894 
5895 	/* IPv6 UDP endpoints */
5896 	optp = (struct opthdr *)&mp6_conn_ctl->b_rptr[
5897 	    sizeof (struct T_optmgmt_ack)];
5898 	optp->level = MIB2_UDP6;
5899 	optp->name = MIB2_UDP6_ENTRY;
5900 	optp->len = msgdsize(mp6_conn_ctl->b_cont);
5901 	qreply(q, mp6_conn_ctl);
5902 
5903 	/* table of MLP attributes... */
5904 	optp = (struct opthdr *)&mp6_attr_ctl->b_rptr[
5905 	    sizeof (struct T_optmgmt_ack)];
5906 	optp->level = MIB2_UDP6;
5907 	optp->name = EXPER_XPORT_MLP;
5908 	optp->len = msgdsize(mp6_attr_ctl->b_cont);
5909 	if (optp->len == 0)
5910 		freemsg(mp6_attr_ctl);
5911 	else
5912 		qreply(q, mp6_attr_ctl);
5913 
5914 	return (1);
5915 }
5916 
5917 /*
5918  * Return 0 if invalid set request, 1 otherwise, including non-udp requests.
5919  * NOTE: Per MIB-II, UDP has no writable data.
5920  * TODO:  If this ever actually tries to set anything, it needs to be
5921  * to do the appropriate locking.
5922  */
5923 /* ARGSUSED */
5924 int
5925 udp_snmp_set(queue_t *q, t_scalar_t level, t_scalar_t name,
5926     uchar_t *ptr, int len)
5927 {
5928 	switch (level) {
5929 	case MIB2_UDP:
5930 		return (0);
5931 	default:
5932 		return (1);
5933 	}
5934 }
5935 
5936 static void
5937 udp_report_item(mblk_t *mp, udp_t *udp)
5938 {
5939 	char *state;
5940 	char addrbuf1[INET6_ADDRSTRLEN];
5941 	char addrbuf2[INET6_ADDRSTRLEN];
5942 	uint_t print_len, buf_len;
5943 
5944 	buf_len = mp->b_datap->db_lim - mp->b_wptr;
5945 	ASSERT(buf_len >= 0);
5946 	if (buf_len == 0)
5947 		return;
5948 
5949 	if (udp->udp_state == TS_UNBND)
5950 		state = "UNBOUND";
5951 	else if (udp->udp_state == TS_IDLE)
5952 		state = "IDLE";
5953 	else if (udp->udp_state == TS_DATA_XFER)
5954 		state = "CONNECTED";
5955 	else
5956 		state = "UnkState";
5957 	print_len = snprintf((char *)mp->b_wptr, buf_len,
5958 	    MI_COL_PTRFMT_STR "%4d %5u %s %s %5u %s\n",
5959 	    (void *)udp, udp->udp_connp->conn_zoneid, ntohs(udp->udp_port),
5960 	    inet_ntop(AF_INET6, &udp->udp_v6src,
5961 		addrbuf1, sizeof (addrbuf1)),
5962 	    inet_ntop(AF_INET6, &udp->udp_v6dst,
5963 		addrbuf2, sizeof (addrbuf2)),
5964 	    ntohs(udp->udp_dstport), state);
5965 	if (print_len < buf_len) {
5966 		mp->b_wptr += print_len;
5967 	} else {
5968 		mp->b_wptr += buf_len;
5969 	}
5970 }
5971 
5972 /* Report for ndd "udp_status" */
5973 /* ARGSUSED */
5974 static int
5975 udp_status_report(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr)
5976 {
5977 	zoneid_t zoneid;
5978 	connf_t	*connfp;
5979 	conn_t	*connp = Q_TO_CONN(q);
5980 	udp_t	*udp = connp->conn_udp;
5981 	int	i;
5982 
5983 	/*
5984 	 * Because of the ndd constraint, at most we can have 64K buffer
5985 	 * to put in all UDP info.  So to be more efficient, just
5986 	 * allocate a 64K buffer here, assuming we need that large buffer.
5987 	 * This may be a problem as any user can read udp_status.  Therefore
5988 	 * we limit the rate of doing this using udp_ndd_get_info_interval.
5989 	 * This should be OK as normal users should not do this too often.
5990 	 */
5991 	if (cr == NULL || secpolicy_net_config(cr, B_TRUE) != 0) {
5992 		if (ddi_get_lbolt() - udp_last_ndd_get_info_time <
5993 		    drv_usectohz(udp_ndd_get_info_interval * 1000)) {
5994 			(void) mi_mpprintf(mp, NDD_TOO_QUICK_MSG);
5995 			return (0);
5996 		}
5997 	}
5998 	if ((mp->b_cont = allocb(ND_MAX_BUF_LEN, BPRI_HI)) == NULL) {
5999 		/* The following may work even if we cannot get a large buf. */
6000 		(void) mi_mpprintf(mp, NDD_OUT_OF_BUF_MSG);
6001 		return (0);
6002 	}
6003 	(void) mi_mpprintf(mp,
6004 	    "UDP     " MI_COL_HDRPAD_STR
6005 	/*   12345678[89ABCDEF] */
6006 	    " zone lport src addr        dest addr       port  state");
6007 	/*    1234 12345 xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx 12345 UNBOUND */
6008 
6009 	zoneid = connp->conn_zoneid;
6010 
6011 	for (i = 0; i < CONN_G_HASH_SIZE; i++) {
6012 		connfp = &ipcl_globalhash_fanout[i];
6013 		connp = NULL;
6014 
6015 		while ((connp = ipcl_get_next_conn(connfp, connp,
6016 		    IPCL_UDP))) {
6017 			udp = connp->conn_udp;
6018 			if (zoneid != GLOBAL_ZONEID &&
6019 			    zoneid != connp->conn_zoneid)
6020 				continue;
6021 
6022 			udp_report_item(mp->b_cont, udp);
6023 		}
6024 	}
6025 	udp_last_ndd_get_info_time = ddi_get_lbolt();
6026 	return (0);
6027 }
6028 
6029 /*
6030  * This routine creates a T_UDERROR_IND message and passes it upstream.
6031  * The address and options are copied from the T_UNITDATA_REQ message
6032  * passed in mp.  This message is freed.
6033  */
6034 static void
6035 udp_ud_err(queue_t *q, mblk_t *mp, uchar_t *destaddr, t_scalar_t destlen,
6036     t_scalar_t err)
6037 {
6038 	struct T_unitdata_req *tudr;
6039 	mblk_t	*mp1;
6040 	uchar_t	*optaddr;
6041 	t_scalar_t optlen;
6042 
6043 	if (DB_TYPE(mp) == M_DATA) {
6044 		ASSERT(destaddr != NULL && destlen != 0);
6045 		optaddr = NULL;
6046 		optlen = 0;
6047 	} else {
6048 		if ((mp->b_wptr < mp->b_rptr) ||
6049 		    (MBLKL(mp)) < sizeof (struct T_unitdata_req)) {
6050 			goto done;
6051 		}
6052 		tudr = (struct T_unitdata_req *)mp->b_rptr;
6053 		destaddr = mp->b_rptr + tudr->DEST_offset;
6054 		if (destaddr < mp->b_rptr || destaddr >= mp->b_wptr ||
6055 		    destaddr + tudr->DEST_length < mp->b_rptr ||
6056 		    destaddr + tudr->DEST_length > mp->b_wptr) {
6057 			goto done;
6058 		}
6059 		optaddr = mp->b_rptr + tudr->OPT_offset;
6060 		if (optaddr < mp->b_rptr || optaddr >= mp->b_wptr ||
6061 		    optaddr + tudr->OPT_length < mp->b_rptr ||
6062 		    optaddr + tudr->OPT_length > mp->b_wptr) {
6063 			goto done;
6064 		}
6065 		destlen = tudr->DEST_length;
6066 		optlen = tudr->OPT_length;
6067 	}
6068 
6069 	mp1 = mi_tpi_uderror_ind((char *)destaddr, destlen,
6070 	    (char *)optaddr, optlen, err);
6071 	if (mp1 != NULL)
6072 		putnext(UDP_RD(q), mp1);
6073 
6074 done:
6075 	freemsg(mp);
6076 }
6077 
6078 /*
6079  * This routine removes a port number association from a stream.  It
6080  * is called by udp_wput to handle T_UNBIND_REQ messages.
6081  */
6082 static void
6083 udp_unbind(queue_t *q, mblk_t *mp)
6084 {
6085 	udp_t *udp = Q_TO_UDP(q);
6086 
6087 	/* If a bind has not been done, we can't unbind. */
6088 	if (udp->udp_state == TS_UNBND) {
6089 		udp_err_ack(q, mp, TOUTSTATE, 0);
6090 		return;
6091 	}
6092 	if (cl_inet_unbind != NULL) {
6093 		/*
6094 		 * Running in cluster mode - register unbind information
6095 		 */
6096 		if (udp->udp_ipversion == IPV4_VERSION) {
6097 			(*cl_inet_unbind)(IPPROTO_UDP, AF_INET,
6098 			    (uint8_t *)(&V4_PART_OF_V6(udp->udp_v6src)),
6099 			    (in_port_t)udp->udp_port);
6100 		} else {
6101 			(*cl_inet_unbind)(IPPROTO_UDP, AF_INET6,
6102 			    (uint8_t *)&(udp->udp_v6src),
6103 			    (in_port_t)udp->udp_port);
6104 		}
6105 	}
6106 
6107 	udp_bind_hash_remove(udp, B_FALSE);
6108 	V6_SET_ZERO(udp->udp_v6src);
6109 	V6_SET_ZERO(udp->udp_bound_v6src);
6110 	udp->udp_port = 0;
6111 	udp->udp_state = TS_UNBND;
6112 
6113 	if (udp->udp_family == AF_INET6) {
6114 		int error;
6115 
6116 		/* Rebuild the header template */
6117 		error = udp_build_hdrs(q, udp);
6118 		if (error != 0) {
6119 			udp_err_ack(q, mp, TSYSERR, error);
6120 			return;
6121 		}
6122 	}
6123 	/*
6124 	 * Pass the unbind to IP; T_UNBIND_REQ is larger than T_OK_ACK
6125 	 * and therefore ip_unbind must never return NULL.
6126 	 */
6127 	mp = ip_unbind(q, mp);
6128 	ASSERT(mp != NULL);
6129 	putnext(UDP_RD(q), mp);
6130 }
6131 
6132 /*
6133  * Don't let port fall into the privileged range.
6134  * Since the extra privileged ports can be arbitrary we also
6135  * ensure that we exclude those from consideration.
6136  * udp_g_epriv_ports is not sorted thus we loop over it until
6137  * there are no changes.
6138  */
6139 static in_port_t
6140 udp_update_next_port(udp_t *udp, in_port_t port, boolean_t random)
6141 {
6142 	int i;
6143 	in_port_t nextport;
6144 	boolean_t restart = B_FALSE;
6145 
6146 	if (random && udp_random_anon_port != 0) {
6147 		(void) random_get_pseudo_bytes((uint8_t *)&port,
6148 		    sizeof (in_port_t));
6149 		/*
6150 		 * Unless changed by a sys admin, the smallest anon port
6151 		 * is 32768 and the largest anon port is 65535.  It is
6152 		 * very likely (50%) for the random port to be smaller
6153 		 * than the smallest anon port.  When that happens,
6154 		 * add port % (anon port range) to the smallest anon
6155 		 * port to get the random port.  It should fall into the
6156 		 * valid anon port range.
6157 		 */
6158 		if (port < udp_smallest_anon_port) {
6159 			port = udp_smallest_anon_port +
6160 			    port % (udp_largest_anon_port -
6161 			    udp_smallest_anon_port);
6162 		}
6163 	}
6164 
6165 retry:
6166 	if (port < udp_smallest_anon_port)
6167 		port = udp_smallest_anon_port;
6168 
6169 	if (port > udp_largest_anon_port) {
6170 		port = udp_smallest_anon_port;
6171 		if (restart)
6172 			return (0);
6173 		restart = B_TRUE;
6174 	}
6175 
6176 	if (port < udp_smallest_nonpriv_port)
6177 		port = udp_smallest_nonpriv_port;
6178 
6179 	for (i = 0; i < udp_g_num_epriv_ports; i++) {
6180 		if (port == udp_g_epriv_ports[i]) {
6181 			port++;
6182 			/*
6183 			 * Make sure that the port is in the
6184 			 * valid range.
6185 			 */
6186 			goto retry;
6187 		}
6188 	}
6189 
6190 	if (is_system_labeled() &&
6191 	    (nextport = tsol_next_port(crgetzone(udp->udp_connp->conn_cred),
6192 	    port, IPPROTO_UDP, B_TRUE)) != 0) {
6193 		port = nextport;
6194 		goto retry;
6195 	}
6196 
6197 	return (port);
6198 }
6199 
6200 static int
6201 udp_update_label(queue_t *wq, mblk_t *mp, ipaddr_t dst)
6202 {
6203 	int err;
6204 	uchar_t opt_storage[IP_MAX_OPT_LENGTH];
6205 	udp_t *udp = Q_TO_UDP(wq);
6206 
6207 	err = tsol_compute_label(DB_CREDDEF(mp, udp->udp_connp->conn_cred), dst,
6208 	    opt_storage, udp->udp_mac_exempt);
6209 	if (err == 0) {
6210 		err = tsol_update_options(&udp->udp_ip_snd_options,
6211 		    &udp->udp_ip_snd_options_len, &udp->udp_label_len,
6212 		    opt_storage);
6213 	}
6214 	if (err != 0) {
6215 		DTRACE_PROBE4(
6216 		    tx__ip__log__info__updatelabel__udp,
6217 		    char *, "queue(1) failed to update options(2) on mp(3)",
6218 		    queue_t *, wq, char *, opt_storage, mblk_t *, mp);
6219 	} else {
6220 		IN6_IPADDR_TO_V4MAPPED(dst, &udp->udp_v6lastdst);
6221 	}
6222 	return (err);
6223 }
6224 
6225 static mblk_t *
6226 udp_output_v4(conn_t *connp, mblk_t *mp, ipaddr_t v4dst, uint16_t port,
6227     uint_t srcid, int *error)
6228 {
6229 	udp_t	*udp = connp->conn_udp;
6230 	queue_t	*q = connp->conn_wq;
6231 	mblk_t	*mp1 = mp;
6232 	mblk_t	*mp2;
6233 	ipha_t	*ipha;
6234 	int	ip_hdr_length;
6235 	uint32_t ip_len;
6236 	udpha_t	*udpha;
6237 	udpattrs_t	attrs;
6238 	uchar_t	ip_snd_opt[IP_MAX_OPT_LENGTH];
6239 	uint32_t	ip_snd_opt_len = 0;
6240 
6241 	*error = 0;
6242 
6243 	if (v4dst == INADDR_ANY)
6244 		v4dst = htonl(INADDR_LOOPBACK);
6245 
6246 	/*
6247 	 * If options passed in, feed it for verification and handling
6248 	 */
6249 	attrs.udpattr_credset = B_FALSE;
6250 	if (DB_TYPE(mp) != M_DATA) {
6251 		mp1 = mp->b_cont;
6252 		if (((struct T_unitdata_req *)mp->b_rptr)->OPT_length != 0) {
6253 			attrs.udpattr_ipp = NULL;
6254 			attrs.udpattr_mb = mp;
6255 			if (udp_unitdata_opt_process(q, mp, error, &attrs) < 0)
6256 				goto done;
6257 			/*
6258 			 * Note: success in processing options.
6259 			 * mp option buffer represented by
6260 			 * OPT_length/offset now potentially modified
6261 			 * and contain option setting results
6262 			 */
6263 			ASSERT(*error == 0);
6264 		}
6265 	}
6266 
6267 	/* mp1 points to the M_DATA mblk carrying the packet */
6268 	ASSERT(mp1 != NULL && DB_TYPE(mp1) == M_DATA);
6269 
6270 	/*
6271 	 * Check if our saved options are valid; update if not
6272 	 * TSOL Note: Since we are not in WRITER mode, UDP packets
6273 	 * to different destination may require different labels.
6274 	 * We use conn_lock to ensure that lastdst, ip_snd_options,
6275 	 * and ip_snd_options_len are consistent for the current
6276 	 * destination and are updated atomically.
6277 	 */
6278 	mutex_enter(&connp->conn_lock);
6279 	if (is_system_labeled()) {
6280 		/* Using UDP MLP requires SCM_UCRED from user */
6281 		if (connp->conn_mlp_type != mlptSingle &&
6282 		    !attrs.udpattr_credset) {
6283 			mutex_exit(&connp->conn_lock);
6284 			DTRACE_PROBE4(
6285 			    tx__ip__log__info__output__udp,
6286 			    char *, "MLP mp(1) lacks SCM_UCRED attr(2) on q(3)",
6287 			    mblk_t *, mp1, udpattrs_t *, &attrs, queue_t *, q);
6288 			*error = ECONNREFUSED;
6289 			goto done;
6290 		}
6291 		if ((!IN6_IS_ADDR_V4MAPPED(&udp->udp_v6lastdst) ||
6292 		    V4_PART_OF_V6(udp->udp_v6lastdst) != v4dst) &&
6293 		    (*error = udp_update_label(q, mp, v4dst)) != 0) {
6294 			mutex_exit(&connp->conn_lock);
6295 			goto done;
6296 		}
6297 	}
6298 	if (udp->udp_ip_snd_options_len > 0) {
6299 		ip_snd_opt_len = udp->udp_ip_snd_options_len;
6300 		bcopy(udp->udp_ip_snd_options, ip_snd_opt, ip_snd_opt_len);
6301 	}
6302 	mutex_exit(&connp->conn_lock);
6303 
6304 	/* Add an IP header */
6305 	ip_hdr_length = IP_SIMPLE_HDR_LENGTH + UDPH_SIZE + ip_snd_opt_len;
6306 	ipha = (ipha_t *)&mp1->b_rptr[-ip_hdr_length];
6307 	if (DB_REF(mp1) != 1 || (uchar_t *)ipha < DB_BASE(mp1) ||
6308 	    !OK_32PTR(ipha)) {
6309 		mp2 = allocb(ip_hdr_length + udp_wroff_extra, BPRI_LO);
6310 		if (mp2 == NULL) {
6311 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_END,
6312 			    "udp_wput_end: q %p (%S)", q, "allocbfail2");
6313 			*error = ENOMEM;
6314 			goto done;
6315 		}
6316 		mp2->b_wptr = DB_LIM(mp2);
6317 		mp2->b_cont = mp1;
6318 		mp1 = mp2;
6319 		if (DB_TYPE(mp) != M_DATA)
6320 			mp->b_cont = mp1;
6321 		else
6322 			mp = mp1;
6323 
6324 		ipha = (ipha_t *)(mp1->b_wptr - ip_hdr_length);
6325 	}
6326 	ip_hdr_length -= UDPH_SIZE;
6327 #ifdef	_BIG_ENDIAN
6328 	/* Set version, header length, and tos */
6329 	*(uint16_t *)&ipha->ipha_version_and_hdr_length =
6330 	    ((((IP_VERSION << 4) | (ip_hdr_length>>2)) << 8) |
6331 		udp->udp_type_of_service);
6332 	/* Set ttl and protocol */
6333 	*(uint16_t *)&ipha->ipha_ttl = (udp->udp_ttl << 8) | IPPROTO_UDP;
6334 #else
6335 	/* Set version, header length, and tos */
6336 	*(uint16_t *)&ipha->ipha_version_and_hdr_length =
6337 		((udp->udp_type_of_service << 8) |
6338 		    ((IP_VERSION << 4) | (ip_hdr_length>>2)));
6339 	/* Set ttl and protocol */
6340 	*(uint16_t *)&ipha->ipha_ttl = (IPPROTO_UDP << 8) | udp->udp_ttl;
6341 #endif
6342 	/*
6343 	 * Copy our address into the packet.  If this is zero,
6344 	 * first look at __sin6_src_id for a hint. If we leave the source
6345 	 * as INADDR_ANY then ip will fill in the real source address.
6346 	 */
6347 	IN6_V4MAPPED_TO_IPADDR(&udp->udp_v6src, ipha->ipha_src);
6348 	if (srcid != 0 && ipha->ipha_src == INADDR_ANY) {
6349 		in6_addr_t v6src;
6350 
6351 		ip_srcid_find_id(srcid, &v6src, connp->conn_zoneid);
6352 		IN6_V4MAPPED_TO_IPADDR(&v6src, ipha->ipha_src);
6353 	}
6354 
6355 	ipha->ipha_fragment_offset_and_flags = 0;
6356 	ipha->ipha_ident = 0;
6357 
6358 	mp1->b_rptr = (uchar_t *)ipha;
6359 
6360 	ASSERT((uintptr_t)(mp1->b_wptr - (uchar_t *)ipha) <=
6361 	    (uintptr_t)UINT_MAX);
6362 
6363 	/* Determine length of packet */
6364 	ip_len = (uint32_t)(mp1->b_wptr - (uchar_t *)ipha);
6365 	if ((mp2 = mp1->b_cont) != NULL) {
6366 		do {
6367 			ASSERT((uintptr_t)MBLKL(mp2) <= (uintptr_t)UINT_MAX);
6368 			ip_len += (uint32_t)MBLKL(mp2);
6369 		} while ((mp2 = mp2->b_cont) != NULL);
6370 	}
6371 	/*
6372 	 * If the size of the packet is greater than the maximum allowed by
6373 	 * ip, return an error. Passing this down could cause panics because
6374 	 * the size will have wrapped and be inconsistent with the msg size.
6375 	 */
6376 	if (ip_len > IP_MAXPACKET) {
6377 		TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_END,
6378 		    "udp_wput_end: q %p (%S)", q, "IP length exceeded");
6379 		*error = EMSGSIZE;
6380 		goto done;
6381 	}
6382 	ipha->ipha_length = htons((uint16_t)ip_len);
6383 	ip_len -= ip_hdr_length;
6384 	ip_len = htons((uint16_t)ip_len);
6385 	udpha = (udpha_t *)(((uchar_t *)ipha) + ip_hdr_length);
6386 
6387 	/*
6388 	 * Copy in the destination address
6389 	 */
6390 	ipha->ipha_dst = v4dst;
6391 
6392 	/*
6393 	 * Set ttl based on IP_MULTICAST_TTL to match IPv6 logic.
6394 	 */
6395 	if (CLASSD(v4dst))
6396 		ipha->ipha_ttl = udp->udp_multicast_ttl;
6397 
6398 	udpha->uha_dst_port = port;
6399 	udpha->uha_src_port = udp->udp_port;
6400 
6401 	if (ip_hdr_length > IP_SIMPLE_HDR_LENGTH) {
6402 		uint32_t	cksum;
6403 
6404 		bcopy(ip_snd_opt, &ipha[1], ip_snd_opt_len);
6405 		/*
6406 		 * Massage source route putting first source route in ipha_dst.
6407 		 * Ignore the destination in T_unitdata_req.
6408 		 * Create a checksum adjustment for a source route, if any.
6409 		 */
6410 		cksum = ip_massage_options(ipha);
6411 		cksum = (cksum & 0xFFFF) + (cksum >> 16);
6412 		cksum -= ((ipha->ipha_dst >> 16) & 0xFFFF) +
6413 		    (ipha->ipha_dst & 0xFFFF);
6414 		if ((int)cksum < 0)
6415 			cksum--;
6416 		cksum = (cksum & 0xFFFF) + (cksum >> 16);
6417 		/*
6418 		 * IP does the checksum if uha_checksum is non-zero,
6419 		 * We make it easy for IP to include our pseudo header
6420 		 * by putting our length in uha_checksum.
6421 		 */
6422 		cksum += ip_len;
6423 		cksum = (cksum & 0xFFFF) + (cksum >> 16);
6424 		/* There might be a carry. */
6425 		cksum = (cksum & 0xFFFF) + (cksum >> 16);
6426 #ifdef _LITTLE_ENDIAN
6427 		if (udp_do_checksum)
6428 			ip_len = (cksum << 16) | ip_len;
6429 #else
6430 		if (udp_do_checksum)
6431 			ip_len = (ip_len << 16) | cksum;
6432 		else
6433 			ip_len <<= 16;
6434 #endif
6435 	} else {
6436 		/*
6437 		 * IP does the checksum if uha_checksum is non-zero,
6438 		 * We make it easy for IP to include our pseudo header
6439 		 * by putting our length in uha_checksum.
6440 		 */
6441 		if (udp_do_checksum)
6442 			ip_len |= (ip_len << 16);
6443 #ifndef _LITTLE_ENDIAN
6444 		else
6445 			ip_len <<= 16;
6446 #endif
6447 	}
6448 	/* Set UDP length and checksum */
6449 	*((uint32_t *)&udpha->uha_length) = ip_len;
6450 	if (DB_CRED(mp) != NULL)
6451 		mblk_setcred(mp1, DB_CRED(mp));
6452 
6453 	if (DB_TYPE(mp) != M_DATA) {
6454 		ASSERT(mp != mp1);
6455 		freeb(mp);
6456 	}
6457 
6458 	/* mp has been consumed and we'll return success */
6459 	ASSERT(*error == 0);
6460 	mp = NULL;
6461 
6462 	/* We're done.  Pass the packet to ip. */
6463 	BUMP_MIB(&udp_mib, udpOutDatagrams);
6464 	TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_END,
6465 		"udp_wput_end: q %p (%S)", q, "end");
6466 
6467 	if ((connp->conn_flags & IPCL_CHECK_POLICY) != 0 ||
6468 	    CONN_OUTBOUND_POLICY_PRESENT(connp) ||
6469 	    connp->conn_dontroute || connp->conn_xmit_if_ill != NULL ||
6470 	    connp->conn_nofailover_ill != NULL ||
6471 	    connp->conn_outgoing_ill != NULL ||
6472 	    ipha->ipha_version_and_hdr_length != IP_SIMPLE_HDR_VERSION ||
6473 	    IPP_ENABLED(IPP_LOCAL_OUT) || ip_g_mrouter != NULL) {
6474 		UDP_STAT(udp_ip_send);
6475 		ip_output(connp, mp1, connp->conn_wq, IP_WPUT);
6476 	} else {
6477 		udp_send_data(udp, connp->conn_wq, mp1, ipha);
6478 	}
6479 
6480 done:
6481 	if (*error != 0) {
6482 		ASSERT(mp != NULL);
6483 		BUMP_MIB(&udp_mib, udpOutErrors);
6484 	}
6485 	return (mp);
6486 }
6487 
6488 static void
6489 udp_send_data(udp_t *udp, queue_t *q, mblk_t *mp, ipha_t *ipha)
6490 {
6491 	conn_t	*connp = udp->udp_connp;
6492 	ipaddr_t src, dst;
6493 	ill_t	*ill;
6494 	ire_t	*ire;
6495 	ipif_t	*ipif = NULL;
6496 	mblk_t	*ire_fp_mp;
6497 	uint_t	ire_fp_mp_len;
6498 	uint16_t *up;
6499 	uint32_t cksum, hcksum_txflags;
6500 	queue_t	*dev_q;
6501 	boolean_t retry_caching;
6502 
6503 	dst = ipha->ipha_dst;
6504 	src = ipha->ipha_src;
6505 	ASSERT(ipha->ipha_ident == 0);
6506 
6507 	if (CLASSD(dst)) {
6508 		int err;
6509 
6510 		ipif = conn_get_held_ipif(connp,
6511 		    &connp->conn_multicast_ipif, &err);
6512 
6513 		if (ipif == NULL || ipif->ipif_isv6 ||
6514 		    (ipif->ipif_ill->ill_phyint->phyint_flags &
6515 		    PHYI_LOOPBACK)) {
6516 			if (ipif != NULL)
6517 				ipif_refrele(ipif);
6518 			UDP_STAT(udp_ip_send);
6519 			ip_output(connp, mp, q, IP_WPUT);
6520 			return;
6521 		}
6522 	}
6523 
6524 	retry_caching = B_FALSE;
6525 	mutex_enter(&connp->conn_lock);
6526 	ire = connp->conn_ire_cache;
6527 	ASSERT(!(connp->conn_state_flags & CONN_INCIPIENT));
6528 
6529 	if (ire == NULL || ire->ire_addr != dst ||
6530 	    (ire->ire_marks & IRE_MARK_CONDEMNED)) {
6531 		retry_caching = B_TRUE;
6532 	} else if (CLASSD(dst) && (ire->ire_type & IRE_CACHE)) {
6533 		ill_t *stq_ill = (ill_t *)ire->ire_stq->q_ptr;
6534 
6535 		ASSERT(ipif != NULL);
6536 		if (stq_ill != ipif->ipif_ill && (stq_ill->ill_group == NULL ||
6537 		    stq_ill->ill_group != ipif->ipif_ill->ill_group))
6538 			retry_caching = B_TRUE;
6539 	}
6540 
6541 	if (!retry_caching) {
6542 		ASSERT(ire != NULL);
6543 		IRE_REFHOLD(ire);
6544 		mutex_exit(&connp->conn_lock);
6545 	} else {
6546 		boolean_t cached = B_FALSE;
6547 
6548 		connp->conn_ire_cache = NULL;
6549 		mutex_exit(&connp->conn_lock);
6550 
6551 		/* Release the old ire */
6552 		if (ire != NULL) {
6553 			IRE_REFRELE_NOTR(ire);
6554 			ire = NULL;
6555 		}
6556 
6557 		if (CLASSD(dst)) {
6558 			ASSERT(ipif != NULL);
6559 			ire = ire_ctable_lookup(dst, 0, 0, ipif,
6560 			    connp->conn_zoneid, MBLK_GETLABEL(mp),
6561 			    MATCH_IRE_ILL_GROUP);
6562 		} else {
6563 			ASSERT(ipif == NULL);
6564 			ire = ire_cache_lookup(dst, connp->conn_zoneid,
6565 			    MBLK_GETLABEL(mp));
6566 		}
6567 
6568 		if (ire == NULL) {
6569 			if (ipif != NULL)
6570 				ipif_refrele(ipif);
6571 			UDP_STAT(udp_ire_null);
6572 			ip_output(connp, mp, q, IP_WPUT);
6573 			return;
6574 		}
6575 		IRE_REFHOLD_NOTR(ire);
6576 
6577 		mutex_enter(&connp->conn_lock);
6578 		if (!(connp->conn_state_flags & CONN_CLOSING) &&
6579 		    connp->conn_ire_cache == NULL) {
6580 			rw_enter(&ire->ire_bucket->irb_lock, RW_READER);
6581 			if (!(ire->ire_marks & IRE_MARK_CONDEMNED)) {
6582 				connp->conn_ire_cache = ire;
6583 				cached = B_TRUE;
6584 			}
6585 			rw_exit(&ire->ire_bucket->irb_lock);
6586 		}
6587 		mutex_exit(&connp->conn_lock);
6588 
6589 		/*
6590 		 * We can continue to use the ire but since it was not
6591 		 * cached, we should drop the extra reference.
6592 		 */
6593 		if (!cached)
6594 			IRE_REFRELE_NOTR(ire);
6595 	}
6596 	ASSERT(ire != NULL && ire->ire_ipversion == IPV4_VERSION);
6597 	ASSERT(!CLASSD(dst) || ipif != NULL);
6598 
6599 	/*
6600 	 * Check if we can take the fast-path.
6601 	 * Note that "incomplete" ire's (where the link-layer for next hop
6602 	 * is not resolved, or where the fast-path header in nce_fp_mp is not
6603 	 * available yet) are sent down the legacy (slow) path
6604 	 */
6605 	if ((ire->ire_type & (IRE_BROADCAST|IRE_LOCAL|IRE_LOOPBACK)) ||
6606 	    (ire->ire_flags & RTF_MULTIRT) || (ire->ire_stq == NULL) ||
6607 	    (ire->ire_max_frag < ntohs(ipha->ipha_length)) ||
6608 	    (connp->conn_nexthop_set) ||
6609 	    (ire->ire_nce == NULL) ||
6610 	    ((ire_fp_mp = ire->ire_nce->nce_fp_mp) == NULL) ||
6611 	    ((ire_fp_mp_len = MBLKL(ire_fp_mp)) > MBLKHEAD(mp))) {
6612 		if (ipif != NULL)
6613 			ipif_refrele(ipif);
6614 		UDP_STAT(udp_ip_ire_send);
6615 		IRE_REFRELE(ire);
6616 		ip_output(connp, mp, q, IP_WPUT);
6617 		return;
6618 	}
6619 
6620 	BUMP_MIB(&ip_mib, ipOutRequests);
6621 
6622 	ill = ire_to_ill(ire);
6623 	ASSERT(ill != NULL);
6624 
6625 	dev_q = ire->ire_stq->q_next;
6626 	ASSERT(dev_q != NULL);
6627 	/*
6628 	 * If the service thread is already running, or if the driver
6629 	 * queue is currently flow-controlled, queue this packet.
6630 	 */
6631 	if ((q->q_first != NULL || connp->conn_draining) ||
6632 	    ((dev_q->q_next || dev_q->q_first) && !canput(dev_q))) {
6633 		if (ip_output_queue) {
6634 			(void) putq(q, mp);
6635 		} else {
6636 			BUMP_MIB(&ip_mib, ipOutDiscards);
6637 			freemsg(mp);
6638 		}
6639 		if (ipif != NULL)
6640 			ipif_refrele(ipif);
6641 		IRE_REFRELE(ire);
6642 		return;
6643 	}
6644 
6645 	ipha->ipha_ident = (uint16_t)atomic_add_32_nv(&ire->ire_ident, 1);
6646 #ifndef _BIG_ENDIAN
6647 	ipha->ipha_ident = (ipha->ipha_ident << 8) | (ipha->ipha_ident >> 8);
6648 #endif
6649 
6650 	if (src == INADDR_ANY && !connp->conn_unspec_src) {
6651 		if (CLASSD(dst) && !(ire->ire_flags & RTF_SETSRC))
6652 			src = ipha->ipha_src = ipif->ipif_src_addr;
6653 		else
6654 			src = ipha->ipha_src = ire->ire_src_addr;
6655 	}
6656 
6657 	if (ILL_HCKSUM_CAPABLE(ill) && dohwcksum) {
6658 		ASSERT(ill->ill_hcksum_capab != NULL);
6659 		hcksum_txflags = ill->ill_hcksum_capab->ill_hcksum_txflags;
6660 	} else {
6661 		hcksum_txflags = 0;
6662 	}
6663 
6664 	/* pseudo-header checksum (do it in parts for IP header checksum) */
6665 	cksum = (dst >> 16) + (dst & 0xFFFF) + (src >> 16) + (src & 0xFFFF);
6666 
6667 	ASSERT(ipha->ipha_version_and_hdr_length == IP_SIMPLE_HDR_VERSION);
6668 	up = IPH_UDPH_CHECKSUMP(ipha, IP_SIMPLE_HDR_LENGTH);
6669 	if (*up != 0) {
6670 		IP_CKSUM_XMIT_FAST(ire->ire_ipversion, hcksum_txflags,
6671 		    mp, ipha, up, IPPROTO_UDP, IP_SIMPLE_HDR_LENGTH,
6672 		    ntohs(ipha->ipha_length), cksum);
6673 
6674 		/* Software checksum? */
6675 		if (DB_CKSUMFLAGS(mp) == 0) {
6676 			UDP_STAT(udp_out_sw_cksum);
6677 			UDP_STAT_UPDATE(udp_out_sw_cksum_bytes,
6678 			    ntohs(ipha->ipha_length) - IP_SIMPLE_HDR_LENGTH);
6679 		}
6680 	}
6681 
6682 	ipha->ipha_fragment_offset_and_flags |=
6683 	    (uint32_t)htons(ire->ire_frag_flag);
6684 
6685 	/* Calculate IP header checksum if hardware isn't capable */
6686 	if (!(DB_CKSUMFLAGS(mp) & HCK_IPV4_HDRCKSUM)) {
6687 		IP_HDR_CKSUM(ipha, cksum, ((uint32_t *)ipha)[0],
6688 		    ((uint16_t *)ipha)[4]);
6689 	}
6690 
6691 	if (CLASSD(dst)) {
6692 		ilm_t *ilm;
6693 
6694 		ILM_WALKER_HOLD(ill);
6695 		ilm = ilm_lookup_ill(ill, dst, ALL_ZONES);
6696 		ILM_WALKER_RELE(ill);
6697 		if (ilm != NULL) {
6698 			ip_multicast_loopback(q, ill, mp,
6699 			    connp->conn_multicast_loop ? 0 :
6700 			    IP_FF_NO_MCAST_LOOP, connp->conn_zoneid);
6701 		}
6702 
6703 		/* If multicast TTL is 0 then we are done */
6704 		if (ipha->ipha_ttl == 0) {
6705 			if (ipif != NULL)
6706 				ipif_refrele(ipif);
6707 			freemsg(mp);
6708 			IRE_REFRELE(ire);
6709 			return;
6710 		}
6711 	}
6712 
6713 	ASSERT(DB_TYPE(ire_fp_mp) == M_DATA);
6714 	mp->b_rptr = (uchar_t *)ipha - ire_fp_mp_len;
6715 	bcopy(ire_fp_mp->b_rptr, mp->b_rptr, ire_fp_mp_len);
6716 
6717 	UPDATE_OB_PKT_COUNT(ire);
6718 	ire->ire_last_used_time = lbolt;
6719 
6720 	if (ILL_DLS_CAPABLE(ill)) {
6721 		/*
6722 		 * Send the packet directly to DLD, where it may be queued
6723 		 * depending on the availability of transmit resources at
6724 		 * the media layer.
6725 		 */
6726 		IP_DLS_ILL_TX(ill, ipha, mp);
6727 	} else {
6728 		DTRACE_PROBE4(ip4__physical__out__start,
6729 		    ill_t *, NULL, ill_t *, ill,
6730 		    ipha_t *, ipha, mblk_t *, mp);
6731 		FW_HOOKS(ip4_physical_out_event, ipv4firewall_physical_out,
6732 		    NULL, ill, ipha, mp, mp);
6733 		DTRACE_PROBE1(ip4__physical__out__end, mblk_t *, mp);
6734 		if (mp != NULL)
6735 			putnext(ire->ire_stq, mp);
6736 	}
6737 
6738 	if (ipif != NULL)
6739 		ipif_refrele(ipif);
6740 	IRE_REFRELE(ire);
6741 }
6742 
6743 static boolean_t
6744 udp_update_label_v6(queue_t *wq, mblk_t *mp, in6_addr_t *dst)
6745 {
6746 	udp_t *udp = Q_TO_UDP(wq);
6747 	int err;
6748 	uchar_t opt_storage[TSOL_MAX_IPV6_OPTION];
6749 
6750 	err = tsol_compute_label_v6(DB_CREDDEF(mp, udp->udp_connp->conn_cred),
6751 	    dst, opt_storage, udp->udp_mac_exempt);
6752 	if (err == 0) {
6753 		err = tsol_update_sticky(&udp->udp_sticky_ipp,
6754 		    &udp->udp_label_len_v6, opt_storage);
6755 	}
6756 	if (err != 0) {
6757 		DTRACE_PROBE4(
6758 		    tx__ip__log__drop__updatelabel__udp6,
6759 		    char *, "queue(1) failed to update options(2) on mp(3)",
6760 		    queue_t *, wq, char *, opt_storage, mblk_t *, mp);
6761 	} else {
6762 		udp->udp_v6lastdst = *dst;
6763 	}
6764 	return (err);
6765 }
6766 
6767 /*
6768  * This routine handles all messages passed downstream.  It either
6769  * consumes the message or passes it downstream; it never queues a
6770  * a message.
6771  */
6772 static void
6773 udp_output(conn_t *connp, mblk_t *mp, struct sockaddr *addr, socklen_t addrlen)
6774 {
6775 	sin6_t		*sin6;
6776 	sin_t		*sin;
6777 	ipaddr_t	v4dst;
6778 	uint16_t	port;
6779 	uint_t		srcid;
6780 	queue_t		*q = connp->conn_wq;
6781 	udp_t		*udp = connp->conn_udp;
6782 	int		error = 0;
6783 	struct sockaddr_storage ss;
6784 
6785 	TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_START,
6786 	    "udp_wput_start: connp %p mp %p", connp, mp);
6787 
6788 	/*
6789 	 * We directly handle several cases here: T_UNITDATA_REQ message
6790 	 * coming down as M_PROTO/M_PCPROTO and M_DATA messages for both
6791 	 * connected and non-connected socket.  The latter carries the
6792 	 * address structure along when this routine gets called.
6793 	 */
6794 	switch (DB_TYPE(mp)) {
6795 	case M_DATA:
6796 		if (!udp->udp_direct_sockfs || udp->udp_state != TS_DATA_XFER) {
6797 			if (!udp->udp_direct_sockfs ||
6798 			    addr == NULL || addrlen == 0) {
6799 				/* Not connected; address is required */
6800 				BUMP_MIB(&udp_mib, udpOutErrors);
6801 				UDP_STAT(udp_out_err_notconn);
6802 				freemsg(mp);
6803 				TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_END,
6804 				    "udp_wput_end: connp %p (%S)", connp,
6805 				    "not-connected; address required");
6806 				return;
6807 			}
6808 			ASSERT(udp->udp_issocket);
6809 			UDP_DBGSTAT(udp_data_notconn);
6810 			/* Not connected; do some more checks below */
6811 			break;
6812 		}
6813 		/* M_DATA for connected socket */
6814 		UDP_DBGSTAT(udp_data_conn);
6815 		IN6_V4MAPPED_TO_IPADDR(&udp->udp_v6dst, v4dst);
6816 
6817 		/* Initialize addr and addrlen as if they're passed in */
6818 		if (udp->udp_family == AF_INET) {
6819 			sin = (sin_t *)&ss;
6820 			sin->sin_family = AF_INET;
6821 			sin->sin_port = udp->udp_dstport;
6822 			sin->sin_addr.s_addr = v4dst;
6823 			addr = (struct sockaddr *)sin;
6824 			addrlen = sizeof (*sin);
6825 		} else {
6826 			sin6 = (sin6_t *)&ss;
6827 			sin6->sin6_family = AF_INET6;
6828 			sin6->sin6_port = udp->udp_dstport;
6829 			sin6->sin6_flowinfo = udp->udp_flowinfo;
6830 			sin6->sin6_addr = udp->udp_v6dst;
6831 			sin6->sin6_scope_id = 0;
6832 			sin6->__sin6_src_id = 0;
6833 			addr = (struct sockaddr *)sin6;
6834 			addrlen = sizeof (*sin6);
6835 		}
6836 
6837 		if (udp->udp_family == AF_INET ||
6838 		    IN6_IS_ADDR_V4MAPPED(&udp->udp_v6dst)) {
6839 			/*
6840 			 * Handle both AF_INET and AF_INET6; the latter
6841 			 * for IPV4 mapped destination addresses.  Note
6842 			 * here that both addr and addrlen point to the
6843 			 * corresponding struct depending on the address
6844 			 * family of the socket.
6845 			 */
6846 			mp = udp_output_v4(connp, mp, v4dst,
6847 			    udp->udp_dstport, 0, &error);
6848 		} else {
6849 			mp = udp_output_v6(connp, mp, sin6, &error);
6850 		}
6851 		if (error != 0) {
6852 			ASSERT(addr != NULL && addrlen != 0);
6853 			goto ud_error;
6854 		}
6855 		return;
6856 	case M_PROTO:
6857 	case M_PCPROTO: {
6858 		struct T_unitdata_req *tudr;
6859 
6860 		ASSERT((uintptr_t)MBLKL(mp) <= (uintptr_t)INT_MAX);
6861 		tudr = (struct T_unitdata_req *)mp->b_rptr;
6862 
6863 		/* Handle valid T_UNITDATA_REQ here */
6864 		if (MBLKL(mp) >= sizeof (*tudr) &&
6865 		    ((t_primp_t)mp->b_rptr)->type == T_UNITDATA_REQ) {
6866 			if (mp->b_cont == NULL) {
6867 				TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_END,
6868 				    "udp_wput_end: q %p (%S)", q, "badaddr");
6869 				error = EPROTO;
6870 				goto ud_error;
6871 			}
6872 
6873 			if (!MBLKIN(mp, 0, tudr->DEST_offset +
6874 			    tudr->DEST_length)) {
6875 				TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_END,
6876 				    "udp_wput_end: q %p (%S)", q, "badaddr");
6877 				error = EADDRNOTAVAIL;
6878 				goto ud_error;
6879 			}
6880 			/*
6881 			 * If a port has not been bound to the stream, fail.
6882 			 * This is not a problem when sockfs is directly
6883 			 * above us, because it will ensure that the socket
6884 			 * is first bound before allowing data to be sent.
6885 			 */
6886 			if (udp->udp_state == TS_UNBND) {
6887 				TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_END,
6888 				    "udp_wput_end: q %p (%S)", q, "outstate");
6889 				error = EPROTO;
6890 				goto ud_error;
6891 			}
6892 			addr = (struct sockaddr *)
6893 			    &mp->b_rptr[tudr->DEST_offset];
6894 			addrlen = tudr->DEST_length;
6895 			if (tudr->OPT_length != 0)
6896 				UDP_STAT(udp_out_opt);
6897 			break;
6898 		}
6899 		/* FALLTHRU */
6900 	}
6901 	default:
6902 		udp_become_writer(connp, mp, udp_wput_other_wrapper,
6903 		    SQTAG_UDP_OUTPUT);
6904 		return;
6905 	}
6906 	ASSERT(addr != NULL);
6907 
6908 	switch (udp->udp_family) {
6909 	case AF_INET6:
6910 		sin6 = (sin6_t *)addr;
6911 		if (!OK_32PTR((char *)sin6) || addrlen != sizeof (sin6_t) ||
6912 		    sin6->sin6_family != AF_INET6) {
6913 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_END,
6914 			    "udp_wput_end: q %p (%S)", q, "badaddr");
6915 			error = EADDRNOTAVAIL;
6916 			goto ud_error;
6917 		}
6918 
6919 		if (!IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6920 			/*
6921 			 * Destination is a non-IPv4-compatible IPv6 address.
6922 			 * Send out an IPv6 format packet.
6923 			 */
6924 			mp = udp_output_v6(connp, mp, sin6, &error);
6925 			if (error != 0)
6926 				goto ud_error;
6927 
6928 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_END,
6929 			    "udp_wput_end: q %p (%S)", q, "udp_output_v6");
6930 			return;
6931 		}
6932 		/*
6933 		 * If the local address is not zero or a mapped address
6934 		 * return an error.  It would be possible to send an IPv4
6935 		 * packet but the response would never make it back to the
6936 		 * application since it is bound to a non-mapped address.
6937 		 */
6938 		if (!IN6_IS_ADDR_V4MAPPED(&udp->udp_v6src) &&
6939 		    !IN6_IS_ADDR_UNSPECIFIED(&udp->udp_v6src)) {
6940 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_END,
6941 			    "udp_wput_end: q %p (%S)", q, "badaddr");
6942 			error = EADDRNOTAVAIL;
6943 			goto ud_error;
6944 		}
6945 		/* Send IPv4 packet without modifying udp_ipversion */
6946 		/* Extract port and ipaddr */
6947 		port = sin6->sin6_port;
6948 		IN6_V4MAPPED_TO_IPADDR(&sin6->sin6_addr, v4dst);
6949 		srcid = sin6->__sin6_src_id;
6950 		break;
6951 
6952 	case AF_INET:
6953 		sin = (sin_t *)addr;
6954 		if (!OK_32PTR((char *)sin) || addrlen != sizeof (sin_t) ||
6955 		    sin->sin_family != AF_INET) {
6956 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_END,
6957 			    "udp_wput_end: q %p (%S)", q, "badaddr");
6958 			error = EADDRNOTAVAIL;
6959 			goto ud_error;
6960 		}
6961 		/* Extract port and ipaddr */
6962 		port = sin->sin_port;
6963 		v4dst = sin->sin_addr.s_addr;
6964 		srcid = 0;
6965 		break;
6966 	}
6967 
6968 	mp = udp_output_v4(connp, mp, v4dst, port, srcid, &error);
6969 	if (error != 0) {
6970 ud_error:
6971 		UDP_STAT(udp_out_err_output);
6972 		ASSERT(mp != NULL);
6973 		/* mp is freed by the following routine */
6974 		udp_ud_err(q, mp, (uchar_t *)addr, (t_scalar_t)addrlen,
6975 		    (t_scalar_t)error);
6976 	}
6977 }
6978 
6979 /* ARGSUSED */
6980 static void
6981 udp_output_wrapper(void *arg, mblk_t *mp, void *arg2)
6982 {
6983 	udp_output((conn_t *)arg, mp, NULL, 0);
6984 	_UDP_EXIT((conn_t *)arg);
6985 }
6986 
6987 static void
6988 udp_wput(queue_t *q, mblk_t *mp)
6989 {
6990 	_UDP_ENTER(Q_TO_CONN(UDP_WR(q)), mp, udp_output_wrapper,
6991 	    SQTAG_UDP_WPUT);
6992 }
6993 
6994 /*
6995  * Allocate and prepare a T_UNITDATA_REQ message.
6996  */
6997 static mblk_t *
6998 udp_tudr_alloc(struct sockaddr *addr, socklen_t addrlen)
6999 {
7000 	struct T_unitdata_req *tudr;
7001 	mblk_t *mp;
7002 
7003 	mp = allocb(sizeof (*tudr) + addrlen, BPRI_MED);
7004 	if (mp != NULL) {
7005 		mp->b_wptr += sizeof (*tudr) + addrlen;
7006 		DB_TYPE(mp) = M_PROTO;
7007 
7008 		tudr = (struct T_unitdata_req *)mp->b_rptr;
7009 		tudr->PRIM_type = T_UNITDATA_REQ;
7010 		tudr->DEST_length = addrlen;
7011 		tudr->DEST_offset = (t_scalar_t)sizeof (*tudr);
7012 		tudr->OPT_length = 0;
7013 		tudr->OPT_offset = 0;
7014 		bcopy(addr, tudr+1, addrlen);
7015 	}
7016 	return (mp);
7017 }
7018 
7019 /*
7020  * Entry point for sockfs when udp is in "direct sockfs" mode.  This mode
7021  * is valid when we are directly beneath the stream head, and thus sockfs
7022  * is able to bypass STREAMS and directly call us, passing along the sockaddr
7023  * structure without the cumbersome T_UNITDATA_REQ interface.  Note that
7024  * this is done for both connected and non-connected endpoint.
7025  */
7026 void
7027 udp_wput_data(queue_t *q, mblk_t *mp, struct sockaddr *addr, socklen_t addrlen)
7028 {
7029 	conn_t	*connp;
7030 	udp_t	*udp;
7031 
7032 	q = UDP_WR(q);
7033 	connp = Q_TO_CONN(q);
7034 	udp = connp->conn_udp;
7035 
7036 	/* udpsockfs should only send down M_DATA for this entry point */
7037 	ASSERT(DB_TYPE(mp) == M_DATA);
7038 
7039 	mutex_enter(&connp->conn_lock);
7040 	UDP_MODE_ASSERTIONS(udp, UDP_ENTER);
7041 
7042 	if (udp->udp_mode != UDP_MT_HOT) {
7043 		/*
7044 		 * We can't enter this conn right away because another
7045 		 * thread is currently executing as writer; therefore we
7046 		 * need to deposit the message into the squeue to be
7047 		 * drained later.  If a socket address is present, we
7048 		 * need to create a T_UNITDATA_REQ message as placeholder.
7049 		 */
7050 		if (addr != NULL && addrlen != 0) {
7051 			mblk_t *tudr_mp = udp_tudr_alloc(addr, addrlen);
7052 
7053 			if (tudr_mp == NULL) {
7054 				mutex_exit(&connp->conn_lock);
7055 				BUMP_MIB(&udp_mib, udpOutErrors);
7056 				UDP_STAT(udp_out_err_tudr);
7057 				freemsg(mp);
7058 				return;
7059 			}
7060 			/* Tag the packet with T_UNITDATA_REQ */
7061 			tudr_mp->b_cont = mp;
7062 			mp = tudr_mp;
7063 		}
7064 		mutex_exit(&connp->conn_lock);
7065 		udp_enter(connp, mp, udp_output_wrapper, SQTAG_UDP_WPUT);
7066 		return;
7067 	}
7068 
7069 	/* We can execute as reader right away. */
7070 	UDP_READERS_INCREF(udp);
7071 	mutex_exit(&connp->conn_lock);
7072 
7073 	udp_output(connp, mp, addr, addrlen);
7074 
7075 	udp_exit(connp);
7076 }
7077 
7078 /*
7079  * udp_output_v6():
7080  * Assumes that udp_wput did some sanity checking on the destination
7081  * address.
7082  */
7083 static mblk_t *
7084 udp_output_v6(conn_t *connp, mblk_t *mp, sin6_t *sin6, int *error)
7085 {
7086 	ip6_t		*ip6h;
7087 	ip6i_t		*ip6i;	/* mp1->b_rptr even if no ip6i_t */
7088 	mblk_t		*mp1 = mp;
7089 	mblk_t		*mp2;
7090 	int		udp_ip_hdr_len = IPV6_HDR_LEN + UDPH_SIZE;
7091 	size_t		ip_len;
7092 	udpha_t		*udph;
7093 	udp_t		*udp = connp->conn_udp;
7094 	queue_t		*q = connp->conn_wq;
7095 	ip6_pkt_t	ipp_s;	/* For ancillary data options */
7096 	ip6_pkt_t	*ipp = &ipp_s;
7097 	ip6_pkt_t	*tipp;	/* temporary ipp */
7098 	uint32_t	csum = 0;
7099 	uint_t		ignore = 0;
7100 	uint_t		option_exists = 0, is_sticky = 0;
7101 	uint8_t		*cp;
7102 	uint8_t		*nxthdr_ptr;
7103 	in6_addr_t	ip6_dst;
7104 	udpattrs_t	attrs;
7105 	boolean_t	opt_present;
7106 	ip6_hbh_t	*hopoptsptr = NULL;
7107 	uint_t		hopoptslen = 0;
7108 	boolean_t	is_ancillary = B_FALSE;
7109 
7110 	*error = 0;
7111 
7112 	/*
7113 	 * If the local address is a mapped address return
7114 	 * an error.
7115 	 * It would be possible to send an IPv6 packet but the
7116 	 * response would never make it back to the application
7117 	 * since it is bound to a mapped address.
7118 	 */
7119 	if (IN6_IS_ADDR_V4MAPPED(&udp->udp_v6src)) {
7120 		*error = EADDRNOTAVAIL;
7121 		goto done;
7122 	}
7123 
7124 	ipp->ipp_fields = 0;
7125 	ipp->ipp_sticky_ignored = 0;
7126 
7127 	/*
7128 	 * If TPI options passed in, feed it for verification and handling
7129 	 */
7130 	attrs.udpattr_credset = B_FALSE;
7131 	opt_present = B_FALSE;
7132 	if (DB_TYPE(mp) != M_DATA) {
7133 		mp1 = mp->b_cont;
7134 		if (((struct T_unitdata_req *)mp->b_rptr)->OPT_length != 0) {
7135 			attrs.udpattr_ipp = ipp;
7136 			attrs.udpattr_mb = mp;
7137 			if (udp_unitdata_opt_process(q, mp, error, &attrs) < 0)
7138 				goto done;
7139 			ASSERT(*error == 0);
7140 			opt_present = B_TRUE;
7141 		}
7142 	}
7143 	ignore = ipp->ipp_sticky_ignored;
7144 
7145 	/* mp1 points to the M_DATA mblk carrying the packet */
7146 	ASSERT(mp1 != NULL && DB_TYPE(mp1) == M_DATA);
7147 
7148 	if (sin6->sin6_scope_id != 0 &&
7149 	    IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
7150 		/*
7151 		 * IPPF_SCOPE_ID is special.  It's neither a sticky
7152 		 * option nor ancillary data.  It needs to be
7153 		 * explicitly set in options_exists.
7154 		 */
7155 		option_exists |= IPPF_SCOPE_ID;
7156 	}
7157 
7158 	/*
7159 	 * Compute the destination address
7160 	 */
7161 	ip6_dst = sin6->sin6_addr;
7162 	if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
7163 		ip6_dst = ipv6_loopback;
7164 
7165 	/*
7166 	 * If we're not going to the same destination as last time, then
7167 	 * recompute the label required.  This is done in a separate routine to
7168 	 * avoid blowing up our stack here.
7169 	 *
7170 	 * TSOL Note: Since we are not in WRITER mode, UDP packets
7171 	 * to different destination may require different labels.
7172 	 * We use conn_lock to ensure that lastdst, sticky ipp_hopopts,
7173 	 * and sticky ipp_hopoptslen are consistent for the current
7174 	 * destination and are updated atomically.
7175 	 */
7176 	mutex_enter(&connp->conn_lock);
7177 	if (is_system_labeled()) {
7178 		/* Using UDP MLP requires SCM_UCRED from user */
7179 		if (connp->conn_mlp_type != mlptSingle &&
7180 		    !attrs.udpattr_credset) {
7181 			DTRACE_PROBE4(
7182 			    tx__ip__log__info__output__udp6,
7183 			    char *, "MLP mp(1) lacks SCM_UCRED attr(2) on q(3)",
7184 			    mblk_t *, mp1, udpattrs_t *, &attrs, queue_t *, q);
7185 			*error = ECONNREFUSED;
7186 			mutex_exit(&connp->conn_lock);
7187 			goto done;
7188 		}
7189 		if ((opt_present ||
7190 		    !IN6_ARE_ADDR_EQUAL(&udp->udp_v6lastdst, &ip6_dst)) &&
7191 		    (*error = udp_update_label_v6(q, mp, &ip6_dst)) != 0) {
7192 			mutex_exit(&connp->conn_lock);
7193 			goto done;
7194 		}
7195 	}
7196 
7197 	/*
7198 	 * If there's a security label here, then we ignore any options the
7199 	 * user may try to set.  We keep the peer's label as a hidden sticky
7200 	 * option. We make a private copy of this label before releasing the
7201 	 * lock so that label is kept consistent with the destination addr.
7202 	 */
7203 	if (udp->udp_label_len_v6 > 0) {
7204 		ignore &= ~IPPF_HOPOPTS;
7205 		ipp->ipp_fields &= ~IPPF_HOPOPTS;
7206 	}
7207 
7208 	if ((udp->udp_sticky_ipp.ipp_fields == 0) && (ipp->ipp_fields == 0)) {
7209 		/* No sticky options nor ancillary data. */
7210 		mutex_exit(&connp->conn_lock);
7211 		goto no_options;
7212 	}
7213 
7214 	/*
7215 	 * Go through the options figuring out where each is going to
7216 	 * come from and build two masks.  The first mask indicates if
7217 	 * the option exists at all.  The second mask indicates if the
7218 	 * option is sticky or ancillary.
7219 	 */
7220 	if (!(ignore & IPPF_HOPOPTS)) {
7221 		if (ipp->ipp_fields & IPPF_HOPOPTS) {
7222 			option_exists |= IPPF_HOPOPTS;
7223 			udp_ip_hdr_len += ipp->ipp_hopoptslen;
7224 		} else if (udp->udp_sticky_ipp.ipp_fields & IPPF_HOPOPTS) {
7225 			option_exists |= IPPF_HOPOPTS;
7226 			is_sticky |= IPPF_HOPOPTS;
7227 			ASSERT(udp->udp_sticky_ipp.ipp_hopoptslen != 0);
7228 			hopoptsptr = kmem_alloc(
7229 			    udp->udp_sticky_ipp.ipp_hopoptslen, KM_NOSLEEP);
7230 			if (hopoptsptr == NULL) {
7231 				*error = ENOMEM;
7232 				mutex_exit(&connp->conn_lock);
7233 				goto done;
7234 			}
7235 			hopoptslen = udp->udp_sticky_ipp.ipp_hopoptslen;
7236 			bcopy(udp->udp_sticky_ipp.ipp_hopopts, hopoptsptr,
7237 			    hopoptslen);
7238 			udp_ip_hdr_len += hopoptslen;
7239 		}
7240 	}
7241 	mutex_exit(&connp->conn_lock);
7242 
7243 	if (!(ignore & IPPF_RTHDR)) {
7244 		if (ipp->ipp_fields & IPPF_RTHDR) {
7245 			option_exists |= IPPF_RTHDR;
7246 			udp_ip_hdr_len += ipp->ipp_rthdrlen;
7247 		} else if (udp->udp_sticky_ipp.ipp_fields & IPPF_RTHDR) {
7248 			option_exists |= IPPF_RTHDR;
7249 			is_sticky |= IPPF_RTHDR;
7250 			udp_ip_hdr_len += udp->udp_sticky_ipp.ipp_rthdrlen;
7251 		}
7252 	}
7253 
7254 	if (!(ignore & IPPF_RTDSTOPTS) && (option_exists & IPPF_RTHDR)) {
7255 		if (ipp->ipp_fields & IPPF_RTDSTOPTS) {
7256 			option_exists |= IPPF_RTDSTOPTS;
7257 			udp_ip_hdr_len += ipp->ipp_rtdstoptslen;
7258 		} else if (udp->udp_sticky_ipp.ipp_fields & IPPF_RTDSTOPTS) {
7259 			option_exists |= IPPF_RTDSTOPTS;
7260 			is_sticky |= IPPF_RTDSTOPTS;
7261 			udp_ip_hdr_len += udp->udp_sticky_ipp.ipp_rtdstoptslen;
7262 		}
7263 	}
7264 
7265 	if (!(ignore & IPPF_DSTOPTS)) {
7266 		if (ipp->ipp_fields & IPPF_DSTOPTS) {
7267 			option_exists |= IPPF_DSTOPTS;
7268 			udp_ip_hdr_len += ipp->ipp_dstoptslen;
7269 		} else if (udp->udp_sticky_ipp.ipp_fields & IPPF_DSTOPTS) {
7270 			option_exists |= IPPF_DSTOPTS;
7271 			is_sticky |= IPPF_DSTOPTS;
7272 			udp_ip_hdr_len += udp->udp_sticky_ipp.ipp_dstoptslen;
7273 		}
7274 	}
7275 
7276 	if (!(ignore & IPPF_IFINDEX)) {
7277 		if (ipp->ipp_fields & IPPF_IFINDEX) {
7278 			option_exists |= IPPF_IFINDEX;
7279 		} else if (udp->udp_sticky_ipp.ipp_fields & IPPF_IFINDEX) {
7280 			option_exists |= IPPF_IFINDEX;
7281 			is_sticky |= IPPF_IFINDEX;
7282 		}
7283 	}
7284 
7285 	if (!(ignore & IPPF_ADDR)) {
7286 		if (ipp->ipp_fields & IPPF_ADDR) {
7287 			option_exists |= IPPF_ADDR;
7288 		} else if (udp->udp_sticky_ipp.ipp_fields & IPPF_ADDR) {
7289 			option_exists |= IPPF_ADDR;
7290 			is_sticky |= IPPF_ADDR;
7291 		}
7292 	}
7293 
7294 	if (!(ignore & IPPF_DONTFRAG)) {
7295 		if (ipp->ipp_fields & IPPF_DONTFRAG) {
7296 			option_exists |= IPPF_DONTFRAG;
7297 		} else if (udp->udp_sticky_ipp.ipp_fields & IPPF_DONTFRAG) {
7298 			option_exists |= IPPF_DONTFRAG;
7299 			is_sticky |= IPPF_DONTFRAG;
7300 		}
7301 	}
7302 
7303 	if (!(ignore & IPPF_USE_MIN_MTU)) {
7304 		if (ipp->ipp_fields & IPPF_USE_MIN_MTU) {
7305 			option_exists |= IPPF_USE_MIN_MTU;
7306 		} else if (udp->udp_sticky_ipp.ipp_fields &
7307 		    IPPF_USE_MIN_MTU) {
7308 			option_exists |= IPPF_USE_MIN_MTU;
7309 			is_sticky |= IPPF_USE_MIN_MTU;
7310 		}
7311 	}
7312 
7313 	if (!(ignore & IPPF_HOPLIMIT) && (ipp->ipp_fields & IPPF_HOPLIMIT))
7314 		option_exists |= IPPF_HOPLIMIT;
7315 	/* IPV6_HOPLIMIT can never be sticky */
7316 	ASSERT(!(udp->udp_sticky_ipp.ipp_fields & IPPF_HOPLIMIT));
7317 
7318 	if (!(ignore & IPPF_UNICAST_HOPS) &&
7319 	    (udp->udp_sticky_ipp.ipp_fields & IPPF_UNICAST_HOPS)) {
7320 		option_exists |= IPPF_UNICAST_HOPS;
7321 		is_sticky |= IPPF_UNICAST_HOPS;
7322 	}
7323 
7324 	if (!(ignore & IPPF_MULTICAST_HOPS) &&
7325 	    (udp->udp_sticky_ipp.ipp_fields & IPPF_MULTICAST_HOPS)) {
7326 		option_exists |= IPPF_MULTICAST_HOPS;
7327 		is_sticky |= IPPF_MULTICAST_HOPS;
7328 	}
7329 
7330 	if (!(ignore & IPPF_TCLASS)) {
7331 		if (ipp->ipp_fields & IPPF_TCLASS) {
7332 			option_exists |= IPPF_TCLASS;
7333 		} else if (udp->udp_sticky_ipp.ipp_fields & IPPF_TCLASS) {
7334 			option_exists |= IPPF_TCLASS;
7335 			is_sticky |= IPPF_TCLASS;
7336 		}
7337 	}
7338 
7339 	if (!(ignore & IPPF_NEXTHOP) &&
7340 	    (udp->udp_sticky_ipp.ipp_fields & IPPF_NEXTHOP)) {
7341 		option_exists |= IPPF_NEXTHOP;
7342 		is_sticky |= IPPF_NEXTHOP;
7343 	}
7344 
7345 no_options:
7346 
7347 	/*
7348 	 * If any options carried in the ip6i_t were specified, we
7349 	 * need to account for the ip6i_t in the data we'll be sending
7350 	 * down.
7351 	 */
7352 	if (option_exists & IPPF_HAS_IP6I)
7353 		udp_ip_hdr_len += sizeof (ip6i_t);
7354 
7355 	/* check/fix buffer config, setup pointers into it */
7356 	ip6h = (ip6_t *)&mp1->b_rptr[-udp_ip_hdr_len];
7357 	if (DB_REF(mp1) != 1 || ((unsigned char *)ip6h < DB_BASE(mp1)) ||
7358 	    !OK_32PTR(ip6h)) {
7359 		/* Try to get everything in a single mblk next time */
7360 		if (udp_ip_hdr_len > udp->udp_max_hdr_len) {
7361 			udp->udp_max_hdr_len = udp_ip_hdr_len;
7362 			(void) mi_set_sth_wroff(UDP_RD(q),
7363 			    udp->udp_max_hdr_len + udp_wroff_extra);
7364 		}
7365 		mp2 = allocb(udp_ip_hdr_len + udp_wroff_extra, BPRI_LO);
7366 		if (mp2 == NULL) {
7367 			*error = ENOMEM;
7368 			goto done;
7369 		}
7370 		mp2->b_wptr = DB_LIM(mp2);
7371 		mp2->b_cont = mp1;
7372 		mp1 = mp2;
7373 		if (DB_TYPE(mp) != M_DATA)
7374 			mp->b_cont = mp1;
7375 		else
7376 			mp = mp1;
7377 
7378 		ip6h = (ip6_t *)(mp1->b_wptr - udp_ip_hdr_len);
7379 	}
7380 	mp1->b_rptr = (unsigned char *)ip6h;
7381 	ip6i = (ip6i_t *)ip6h;
7382 
7383 #define	ANCIL_OR_STICKY_PTR(f) ((is_sticky & f) ? &udp->udp_sticky_ipp : ipp)
7384 	if (option_exists & IPPF_HAS_IP6I) {
7385 		ip6h = (ip6_t *)&ip6i[1];
7386 		ip6i->ip6i_flags = 0;
7387 		ip6i->ip6i_vcf = IPV6_DEFAULT_VERS_AND_FLOW;
7388 
7389 		/* sin6_scope_id takes precendence over IPPF_IFINDEX */
7390 		if (option_exists & IPPF_SCOPE_ID) {
7391 			ip6i->ip6i_flags |= IP6I_IFINDEX;
7392 			ip6i->ip6i_ifindex = sin6->sin6_scope_id;
7393 		} else if (option_exists & IPPF_IFINDEX) {
7394 			tipp = ANCIL_OR_STICKY_PTR(IPPF_IFINDEX);
7395 			ASSERT(tipp->ipp_ifindex != 0);
7396 			ip6i->ip6i_flags |= IP6I_IFINDEX;
7397 			ip6i->ip6i_ifindex = tipp->ipp_ifindex;
7398 		}
7399 
7400 		if (option_exists & IPPF_ADDR) {
7401 			/*
7402 			 * Enable per-packet source address verification if
7403 			 * IPV6_PKTINFO specified the source address.
7404 			 * ip6_src is set in the transport's _wput function.
7405 			 */
7406 			ip6i->ip6i_flags |= IP6I_VERIFY_SRC;
7407 		}
7408 
7409 		if (option_exists & IPPF_DONTFRAG) {
7410 			ip6i->ip6i_flags |= IP6I_DONTFRAG;
7411 		}
7412 
7413 		if (option_exists & IPPF_USE_MIN_MTU) {
7414 			ip6i->ip6i_flags = IP6I_API_USE_MIN_MTU(
7415 			    ip6i->ip6i_flags, ipp->ipp_use_min_mtu);
7416 		}
7417 
7418 		if (option_exists & IPPF_NEXTHOP) {
7419 			tipp = ANCIL_OR_STICKY_PTR(IPPF_NEXTHOP);
7420 			ASSERT(!IN6_IS_ADDR_UNSPECIFIED(&tipp->ipp_nexthop));
7421 			ip6i->ip6i_flags |= IP6I_NEXTHOP;
7422 			ip6i->ip6i_nexthop = tipp->ipp_nexthop;
7423 		}
7424 
7425 		/*
7426 		 * tell IP this is an ip6i_t private header
7427 		 */
7428 		ip6i->ip6i_nxt = IPPROTO_RAW;
7429 	}
7430 
7431 	/* Initialize IPv6 header */
7432 	ip6h->ip6_vcf = IPV6_DEFAULT_VERS_AND_FLOW;
7433 	bzero(&ip6h->ip6_src, sizeof (ip6h->ip6_src));
7434 
7435 	/* Set the hoplimit of the outgoing packet. */
7436 	if (option_exists & IPPF_HOPLIMIT) {
7437 		/* IPV6_HOPLIMIT ancillary data overrides all other settings. */
7438 		ip6h->ip6_hops = ipp->ipp_hoplimit;
7439 		ip6i->ip6i_flags |= IP6I_HOPLIMIT;
7440 	} else if (IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
7441 		ip6h->ip6_hops = udp->udp_multicast_ttl;
7442 		if (option_exists & IPPF_MULTICAST_HOPS)
7443 			ip6i->ip6i_flags |= IP6I_HOPLIMIT;
7444 	} else {
7445 		ip6h->ip6_hops = udp->udp_ttl;
7446 		if (option_exists & IPPF_UNICAST_HOPS)
7447 			ip6i->ip6i_flags |= IP6I_HOPLIMIT;
7448 	}
7449 
7450 	if (option_exists & IPPF_ADDR) {
7451 		tipp = ANCIL_OR_STICKY_PTR(IPPF_ADDR);
7452 		ASSERT(!IN6_IS_ADDR_UNSPECIFIED(&tipp->ipp_addr));
7453 		ip6h->ip6_src = tipp->ipp_addr;
7454 	} else {
7455 		/*
7456 		 * The source address was not set using IPV6_PKTINFO.
7457 		 * First look at the bound source.
7458 		 * If unspecified fallback to __sin6_src_id.
7459 		 */
7460 		ip6h->ip6_src = udp->udp_v6src;
7461 		if (sin6->__sin6_src_id != 0 &&
7462 		    IN6_IS_ADDR_UNSPECIFIED(&ip6h->ip6_src)) {
7463 			ip_srcid_find_id(sin6->__sin6_src_id,
7464 			    &ip6h->ip6_src, connp->conn_zoneid);
7465 		}
7466 	}
7467 
7468 	nxthdr_ptr = (uint8_t *)&ip6h->ip6_nxt;
7469 	cp = (uint8_t *)&ip6h[1];
7470 
7471 	/*
7472 	 * Here's where we have to start stringing together
7473 	 * any extension headers in the right order:
7474 	 * Hop-by-hop, destination, routing, and final destination opts.
7475 	 */
7476 	if (option_exists & IPPF_HOPOPTS) {
7477 		/* Hop-by-hop options */
7478 		ip6_hbh_t *hbh = (ip6_hbh_t *)cp;
7479 		tipp = ANCIL_OR_STICKY_PTR(IPPF_HOPOPTS);
7480 		if (hopoptslen == 0) {
7481 			hopoptsptr = tipp->ipp_hopopts;
7482 			hopoptslen = tipp->ipp_hopoptslen;
7483 			is_ancillary = B_TRUE;
7484 		}
7485 
7486 		*nxthdr_ptr = IPPROTO_HOPOPTS;
7487 		nxthdr_ptr = &hbh->ip6h_nxt;
7488 
7489 		bcopy(hopoptsptr, cp, hopoptslen);
7490 		cp += hopoptslen;
7491 
7492 		if (hopoptsptr != NULL && !is_ancillary) {
7493 			kmem_free(hopoptsptr, hopoptslen);
7494 			hopoptsptr = NULL;
7495 			hopoptslen = 0;
7496 		}
7497 	}
7498 	/*
7499 	 * En-route destination options
7500 	 * Only do them if there's a routing header as well
7501 	 */
7502 	if (option_exists & IPPF_RTDSTOPTS) {
7503 		ip6_dest_t *dst = (ip6_dest_t *)cp;
7504 		tipp = ANCIL_OR_STICKY_PTR(IPPF_RTDSTOPTS);
7505 
7506 		*nxthdr_ptr = IPPROTO_DSTOPTS;
7507 		nxthdr_ptr = &dst->ip6d_nxt;
7508 
7509 		bcopy(tipp->ipp_rtdstopts, cp, tipp->ipp_rtdstoptslen);
7510 		cp += tipp->ipp_rtdstoptslen;
7511 	}
7512 	/*
7513 	 * Routing header next
7514 	 */
7515 	if (option_exists & IPPF_RTHDR) {
7516 		ip6_rthdr_t *rt = (ip6_rthdr_t *)cp;
7517 		tipp = ANCIL_OR_STICKY_PTR(IPPF_RTHDR);
7518 
7519 		*nxthdr_ptr = IPPROTO_ROUTING;
7520 		nxthdr_ptr = &rt->ip6r_nxt;
7521 
7522 		bcopy(tipp->ipp_rthdr, cp, tipp->ipp_rthdrlen);
7523 		cp += tipp->ipp_rthdrlen;
7524 	}
7525 	/*
7526 	 * Do ultimate destination options
7527 	 */
7528 	if (option_exists & IPPF_DSTOPTS) {
7529 		ip6_dest_t *dest = (ip6_dest_t *)cp;
7530 		tipp = ANCIL_OR_STICKY_PTR(IPPF_DSTOPTS);
7531 
7532 		*nxthdr_ptr = IPPROTO_DSTOPTS;
7533 		nxthdr_ptr = &dest->ip6d_nxt;
7534 
7535 		bcopy(tipp->ipp_dstopts, cp, tipp->ipp_dstoptslen);
7536 		cp += tipp->ipp_dstoptslen;
7537 	}
7538 	/*
7539 	 * Now set the last header pointer to the proto passed in
7540 	 */
7541 	ASSERT((int)(cp - (uint8_t *)ip6i) == (udp_ip_hdr_len - UDPH_SIZE));
7542 	*nxthdr_ptr = IPPROTO_UDP;
7543 
7544 	/* Update UDP header */
7545 	udph = (udpha_t *)((uchar_t *)ip6i + udp_ip_hdr_len - UDPH_SIZE);
7546 	udph->uha_dst_port = sin6->sin6_port;
7547 	udph->uha_src_port = udp->udp_port;
7548 
7549 	/*
7550 	 * Copy in the destination address
7551 	 */
7552 	ip6h->ip6_dst = ip6_dst;
7553 
7554 	ip6h->ip6_vcf =
7555 	    (IPV6_DEFAULT_VERS_AND_FLOW & IPV6_VERS_AND_FLOW_MASK) |
7556 	    (sin6->sin6_flowinfo & ~IPV6_VERS_AND_FLOW_MASK);
7557 
7558 	if (option_exists & IPPF_TCLASS) {
7559 		tipp = ANCIL_OR_STICKY_PTR(IPPF_TCLASS);
7560 		ip6h->ip6_vcf = IPV6_TCLASS_FLOW(ip6h->ip6_vcf,
7561 		    tipp->ipp_tclass);
7562 	}
7563 
7564 	if (option_exists & IPPF_RTHDR) {
7565 		ip6_rthdr_t	*rth;
7566 
7567 		/*
7568 		 * Perform any processing needed for source routing.
7569 		 * We know that all extension headers will be in the same mblk
7570 		 * as the IPv6 header.
7571 		 */
7572 		rth = ip_find_rthdr_v6(ip6h, mp1->b_wptr);
7573 		if (rth != NULL && rth->ip6r_segleft != 0) {
7574 			if (rth->ip6r_type != IPV6_RTHDR_TYPE_0) {
7575 				/*
7576 				 * Drop packet - only support Type 0 routing.
7577 				 * Notify the application as well.
7578 				 */
7579 				*error = EPROTO;
7580 				goto done;
7581 			}
7582 
7583 			/*
7584 			 * rth->ip6r_len is twice the number of
7585 			 * addresses in the header. Thus it must be even.
7586 			 */
7587 			if (rth->ip6r_len & 0x1) {
7588 				*error = EPROTO;
7589 				goto done;
7590 			}
7591 			/*
7592 			 * Shuffle the routing header and ip6_dst
7593 			 * addresses, and get the checksum difference
7594 			 * between the first hop (in ip6_dst) and
7595 			 * the destination (in the last routing hdr entry).
7596 			 */
7597 			csum = ip_massage_options_v6(ip6h, rth);
7598 			/*
7599 			 * Verify that the first hop isn't a mapped address.
7600 			 * Routers along the path need to do this verification
7601 			 * for subsequent hops.
7602 			 */
7603 			if (IN6_IS_ADDR_V4MAPPED(&ip6h->ip6_dst)) {
7604 				*error = EADDRNOTAVAIL;
7605 				goto done;
7606 			}
7607 
7608 			cp += (rth->ip6r_len + 1)*8;
7609 		}
7610 	}
7611 
7612 	/* count up length of UDP packet */
7613 	ip_len = (mp1->b_wptr - (unsigned char *)ip6h) - IPV6_HDR_LEN;
7614 	if ((mp2 = mp1->b_cont) != NULL) {
7615 		do {
7616 			ASSERT((uintptr_t)MBLKL(mp2) <= (uintptr_t)UINT_MAX);
7617 			ip_len += (uint32_t)MBLKL(mp2);
7618 		} while ((mp2 = mp2->b_cont) != NULL);
7619 	}
7620 
7621 	/*
7622 	 * If the size of the packet is greater than the maximum allowed by
7623 	 * ip, return an error. Passing this down could cause panics because
7624 	 * the size will have wrapped and be inconsistent with the msg size.
7625 	 */
7626 	if (ip_len > IP_MAXPACKET) {
7627 		*error = EMSGSIZE;
7628 		goto done;
7629 	}
7630 
7631 	/* Store the UDP length. Subtract length of extension hdrs */
7632 	udph->uha_length = htons(ip_len + IPV6_HDR_LEN -
7633 	    (int)((uchar_t *)udph - (uchar_t *)ip6h));
7634 
7635 	/*
7636 	 * We make it easy for IP to include our pseudo header
7637 	 * by putting our length in uh_checksum, modified (if
7638 	 * we have a routing header) by the checksum difference
7639 	 * between the ultimate destination and first hop addresses.
7640 	 * Note: UDP over IPv6 must always checksum the packet.
7641 	 */
7642 	csum += udph->uha_length;
7643 	csum = (csum & 0xFFFF) + (csum >> 16);
7644 	udph->uha_checksum = (uint16_t)csum;
7645 
7646 #ifdef _LITTLE_ENDIAN
7647 	ip_len = htons(ip_len);
7648 #endif
7649 	ip6h->ip6_plen = ip_len;
7650 	if (DB_CRED(mp) != NULL)
7651 		mblk_setcred(mp1, DB_CRED(mp));
7652 
7653 	if (DB_TYPE(mp) != M_DATA) {
7654 		ASSERT(mp != mp1);
7655 		freeb(mp);
7656 	}
7657 
7658 	/* mp has been consumed and we'll return success */
7659 	ASSERT(*error == 0);
7660 	mp = NULL;
7661 
7662 	/* We're done. Pass the packet to IP */
7663 	BUMP_MIB(&udp_mib, udpOutDatagrams);
7664 	ip_output_v6(connp, mp1, q, IP_WPUT);
7665 
7666 done:
7667 	if (hopoptsptr != NULL && !is_ancillary) {
7668 		kmem_free(hopoptsptr, hopoptslen);
7669 		hopoptsptr = NULL;
7670 	}
7671 	if (*error != 0) {
7672 		ASSERT(mp != NULL);
7673 		BUMP_MIB(&udp_mib, udpOutErrors);
7674 	}
7675 	return (mp);
7676 }
7677 
7678 static void
7679 udp_wput_other(queue_t *q, mblk_t *mp)
7680 {
7681 	uchar_t	*rptr = mp->b_rptr;
7682 	struct datab *db;
7683 	struct iocblk *iocp;
7684 	cred_t	*cr;
7685 	conn_t	*connp = Q_TO_CONN(q);
7686 	udp_t	*udp = connp->conn_udp;
7687 
7688 	TRACE_1(TR_FAC_UDP, TR_UDP_WPUT_OTHER_START,
7689 		"udp_wput_other_start: q %p", q);
7690 
7691 	db = mp->b_datap;
7692 
7693 	cr = DB_CREDDEF(mp, connp->conn_cred);
7694 
7695 	switch (db->db_type) {
7696 	case M_PROTO:
7697 	case M_PCPROTO:
7698 		if (mp->b_wptr - rptr < sizeof (t_scalar_t)) {
7699 			freemsg(mp);
7700 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
7701 				"udp_wput_other_end: q %p (%S)",
7702 				q, "protoshort");
7703 			return;
7704 		}
7705 		switch (((t_primp_t)rptr)->type) {
7706 		case T_ADDR_REQ:
7707 			udp_addr_req(q, mp);
7708 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
7709 				"udp_wput_other_end: q %p (%S)", q, "addrreq");
7710 			return;
7711 		case O_T_BIND_REQ:
7712 		case T_BIND_REQ:
7713 			udp_bind(q, mp);
7714 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
7715 				"udp_wput_other_end: q %p (%S)", q, "bindreq");
7716 			return;
7717 		case T_CONN_REQ:
7718 			udp_connect(q, mp);
7719 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
7720 				"udp_wput_other_end: q %p (%S)", q, "connreq");
7721 			return;
7722 		case T_CAPABILITY_REQ:
7723 			udp_capability_req(q, mp);
7724 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
7725 				"udp_wput_other_end: q %p (%S)", q, "capabreq");
7726 			return;
7727 		case T_INFO_REQ:
7728 			udp_info_req(q, mp);
7729 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
7730 				"udp_wput_other_end: q %p (%S)", q, "inforeq");
7731 			return;
7732 		case T_UNITDATA_REQ:
7733 			/*
7734 			 * If a T_UNITDATA_REQ gets here, the address must
7735 			 * be bad.  Valid T_UNITDATA_REQs are handled
7736 			 * in udp_wput.
7737 			 */
7738 			udp_ud_err(q, mp, NULL, 0, EADDRNOTAVAIL);
7739 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
7740 				"udp_wput_other_end: q %p (%S)",
7741 				q, "unitdatareq");
7742 			return;
7743 		case T_UNBIND_REQ:
7744 			udp_unbind(q, mp);
7745 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
7746 			    "udp_wput_other_end: q %p (%S)", q, "unbindreq");
7747 			return;
7748 		case T_SVR4_OPTMGMT_REQ:
7749 			if (!snmpcom_req(q, mp, udp_snmp_set, udp_snmp_get, cr))
7750 				/*
7751 				 * Use upper queue for option processing in
7752 				 * case the request is not handled at this
7753 				 * level and needs to be passed down to IP.
7754 				 */
7755 				(void) svr4_optcom_req(_WR(UDP_RD(q)),
7756 				    mp, cr, &udp_opt_obj);
7757 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
7758 			    "udp_wput_other_end: q %p (%S)",
7759 			    q, "optmgmtreq");
7760 			return;
7761 
7762 		case T_OPTMGMT_REQ:
7763 			/*
7764 			 * Use upper queue for option processing in
7765 			 * case the request is not handled at this
7766 			 * level and needs to be passed down to IP.
7767 			 */
7768 			(void) tpi_optcom_req(_WR(UDP_RD(q)),
7769 			    mp, cr, &udp_opt_obj);
7770 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
7771 				"udp_wput_other_end: q %p (%S)",
7772 				q, "optmgmtreq");
7773 			return;
7774 
7775 		case T_DISCON_REQ:
7776 			udp_disconnect(q, mp);
7777 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
7778 				"udp_wput_other_end: q %p (%S)",
7779 				q, "disconreq");
7780 			return;
7781 
7782 		/* The following TPI message is not supported by udp. */
7783 		case O_T_CONN_RES:
7784 		case T_CONN_RES:
7785 			udp_err_ack(q, mp, TNOTSUPPORT, 0);
7786 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
7787 				"udp_wput_other_end: q %p (%S)",
7788 				q, "connres/disconreq");
7789 			return;
7790 
7791 		/* The following 3 TPI messages are illegal for udp. */
7792 		case T_DATA_REQ:
7793 		case T_EXDATA_REQ:
7794 		case T_ORDREL_REQ:
7795 			udp_err_ack(q, mp, TNOTSUPPORT, 0);
7796 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
7797 				"udp_wput_other_end: q %p (%S)",
7798 				q, "data/exdata/ordrel");
7799 			return;
7800 		default:
7801 			break;
7802 		}
7803 		break;
7804 	case M_FLUSH:
7805 		if (*rptr & FLUSHW)
7806 			flushq(q, FLUSHDATA);
7807 		break;
7808 	case M_IOCTL:
7809 		iocp = (struct iocblk *)mp->b_rptr;
7810 		switch (iocp->ioc_cmd) {
7811 		case TI_GETPEERNAME:
7812 			if (udp->udp_state != TS_DATA_XFER) {
7813 				/*
7814 				 * If a default destination address has not
7815 				 * been associated with the stream, then we
7816 				 * don't know the peer's name.
7817 				 */
7818 				iocp->ioc_error = ENOTCONN;
7819 				iocp->ioc_count = 0;
7820 				mp->b_datap->db_type = M_IOCACK;
7821 				putnext(UDP_RD(q), mp);
7822 				TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
7823 					"udp_wput_other_end: q %p (%S)",
7824 					q, "getpeername");
7825 				return;
7826 			}
7827 			/* FALLTHRU */
7828 		case TI_GETMYNAME: {
7829 			/*
7830 			 * For TI_GETPEERNAME and TI_GETMYNAME, we first
7831 			 * need to copyin the user's strbuf structure.
7832 			 * Processing will continue in the M_IOCDATA case
7833 			 * below.
7834 			 */
7835 			mi_copyin(q, mp, NULL,
7836 			    SIZEOF_STRUCT(strbuf, iocp->ioc_flag));
7837 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
7838 				"udp_wput_other_end: q %p (%S)",
7839 				q, "getmyname");
7840 			return;
7841 			}
7842 		case ND_SET:
7843 			/* nd_getset performs the necessary checking */
7844 		case ND_GET:
7845 			if (nd_getset(q, udp_g_nd, mp)) {
7846 				putnext(UDP_RD(q), mp);
7847 				TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
7848 					"udp_wput_other_end: q %p (%S)",
7849 					q, "get");
7850 				return;
7851 			}
7852 			break;
7853 		case _SIOCSOCKFALLBACK:
7854 			/*
7855 			 * Either sockmod is about to be popped and the
7856 			 * socket would now be treated as a plain stream,
7857 			 * or a module is about to be pushed so we could
7858 			 * no longer use read-side synchronous stream.
7859 			 * Drain any queued data and disable direct sockfs
7860 			 * interface from now on.
7861 			 */
7862 			if (!udp->udp_issocket) {
7863 				DB_TYPE(mp) = M_IOCNAK;
7864 				iocp->ioc_error = EINVAL;
7865 			} else {
7866 				udp->udp_issocket = B_FALSE;
7867 				if (udp->udp_direct_sockfs) {
7868 					/*
7869 					 * Disable read-side synchronous
7870 					 * stream interface and drain any
7871 					 * queued data.
7872 					 */
7873 					udp_rcv_drain(UDP_RD(q), udp,
7874 					    B_FALSE);
7875 					ASSERT(!udp->udp_direct_sockfs);
7876 					UDP_STAT(udp_sock_fallback);
7877 				}
7878 				DB_TYPE(mp) = M_IOCACK;
7879 				iocp->ioc_error = 0;
7880 			}
7881 			iocp->ioc_count = 0;
7882 			iocp->ioc_rval = 0;
7883 			putnext(UDP_RD(q), mp);
7884 			return;
7885 		default:
7886 			break;
7887 		}
7888 		break;
7889 	case M_IOCDATA:
7890 		udp_wput_iocdata(q, mp);
7891 		TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
7892 			"udp_wput_other_end: q %p (%S)", q, "iocdata");
7893 		return;
7894 	default:
7895 		/* Unrecognized messages are passed through without change. */
7896 		break;
7897 	}
7898 	TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
7899 		"udp_wput_other_end: q %p (%S)", q, "end");
7900 	ip_output(connp, mp, q, IP_WPUT);
7901 }
7902 
7903 /* ARGSUSED */
7904 static void
7905 udp_wput_other_wrapper(void *arg, mblk_t *mp, void *arg2)
7906 {
7907 	udp_wput_other(((conn_t *)arg)->conn_wq, mp);
7908 	udp_exit((conn_t *)arg);
7909 }
7910 
7911 /*
7912  * udp_wput_iocdata is called by udp_wput_other to handle all M_IOCDATA
7913  * messages.
7914  */
7915 static void
7916 udp_wput_iocdata(queue_t *q, mblk_t *mp)
7917 {
7918 	mblk_t	*mp1;
7919 	STRUCT_HANDLE(strbuf, sb);
7920 	uint16_t port;
7921 	in6_addr_t	v6addr;
7922 	ipaddr_t	v4addr;
7923 	uint32_t	flowinfo = 0;
7924 	int		addrlen;
7925 	udp_t		*udp = Q_TO_UDP(q);
7926 
7927 	/* Make sure it is one of ours. */
7928 	switch (((struct iocblk *)mp->b_rptr)->ioc_cmd) {
7929 	case TI_GETMYNAME:
7930 	case TI_GETPEERNAME:
7931 		break;
7932 	default:
7933 		ip_output(udp->udp_connp, mp, q, IP_WPUT);
7934 		return;
7935 	}
7936 
7937 	q = WR(UDP_RD(q));
7938 	switch (mi_copy_state(q, mp, &mp1)) {
7939 	case -1:
7940 		return;
7941 	case MI_COPY_CASE(MI_COPY_IN, 1):
7942 		break;
7943 	case MI_COPY_CASE(MI_COPY_OUT, 1):
7944 		/*
7945 		 * The address has been copied out, so now
7946 		 * copyout the strbuf.
7947 		 */
7948 		mi_copyout(q, mp);
7949 		return;
7950 	case MI_COPY_CASE(MI_COPY_OUT, 2):
7951 		/*
7952 		 * The address and strbuf have been copied out.
7953 		 * We're done, so just acknowledge the original
7954 		 * M_IOCTL.
7955 		 */
7956 		mi_copy_done(q, mp, 0);
7957 		return;
7958 	default:
7959 		/*
7960 		 * Something strange has happened, so acknowledge
7961 		 * the original M_IOCTL with an EPROTO error.
7962 		 */
7963 		mi_copy_done(q, mp, EPROTO);
7964 		return;
7965 	}
7966 
7967 	/*
7968 	 * Now we have the strbuf structure for TI_GETMYNAME
7969 	 * and TI_GETPEERNAME.  Next we copyout the requested
7970 	 * address and then we'll copyout the strbuf.
7971 	 */
7972 	STRUCT_SET_HANDLE(sb, ((struct iocblk *)mp->b_rptr)->ioc_flag,
7973 	    (void *)mp1->b_rptr);
7974 	if (udp->udp_family == AF_INET)
7975 		addrlen = sizeof (sin_t);
7976 	else
7977 		addrlen = sizeof (sin6_t);
7978 
7979 	if (STRUCT_FGET(sb, maxlen) < addrlen) {
7980 		mi_copy_done(q, mp, EINVAL);
7981 		return;
7982 	}
7983 	switch (((struct iocblk *)mp->b_rptr)->ioc_cmd) {
7984 	case TI_GETMYNAME:
7985 		if (udp->udp_family == AF_INET) {
7986 			ASSERT(udp->udp_ipversion == IPV4_VERSION);
7987 			if (!IN6_IS_ADDR_V4MAPPED_ANY(&udp->udp_v6src) &&
7988 			    !IN6_IS_ADDR_UNSPECIFIED(&udp->udp_v6src)) {
7989 				v4addr = V4_PART_OF_V6(udp->udp_v6src);
7990 			} else {
7991 				/*
7992 				 * INADDR_ANY
7993 				 * udp_v6src is not set, we might be bound to
7994 				 * broadcast/multicast. Use udp_bound_v6src as
7995 				 * local address instead (that could
7996 				 * also still be INADDR_ANY)
7997 				 */
7998 				v4addr = V4_PART_OF_V6(udp->udp_bound_v6src);
7999 			}
8000 		} else {
8001 			/* udp->udp_family == AF_INET6 */
8002 			if (!IN6_IS_ADDR_UNSPECIFIED(&udp->udp_v6src)) {
8003 				v6addr = udp->udp_v6src;
8004 			} else {
8005 				/*
8006 				 * UNSPECIFIED
8007 				 * udp_v6src is not set, we might be bound to
8008 				 * broadcast/multicast. Use udp_bound_v6src as
8009 				 * local address instead (that could
8010 				 * also still be UNSPECIFIED)
8011 				 */
8012 				v6addr = udp->udp_bound_v6src;
8013 			}
8014 		}
8015 		port = udp->udp_port;
8016 		break;
8017 	case TI_GETPEERNAME:
8018 		if (udp->udp_state != TS_DATA_XFER) {
8019 			mi_copy_done(q, mp, ENOTCONN);
8020 			return;
8021 		}
8022 		if (udp->udp_family == AF_INET) {
8023 			ASSERT(udp->udp_ipversion == IPV4_VERSION);
8024 			v4addr = V4_PART_OF_V6(udp->udp_v6dst);
8025 		} else {
8026 			/* udp->udp_family == AF_INET6) */
8027 			v6addr = udp->udp_v6dst;
8028 			flowinfo = udp->udp_flowinfo;
8029 		}
8030 		port = udp->udp_dstport;
8031 		break;
8032 	default:
8033 		mi_copy_done(q, mp, EPROTO);
8034 		return;
8035 	}
8036 	mp1 = mi_copyout_alloc(q, mp, STRUCT_FGETP(sb, buf), addrlen, B_TRUE);
8037 	if (!mp1)
8038 		return;
8039 
8040 	if (udp->udp_family == AF_INET) {
8041 		sin_t *sin;
8042 
8043 		STRUCT_FSET(sb, len, (int)sizeof (sin_t));
8044 		sin = (sin_t *)mp1->b_rptr;
8045 		mp1->b_wptr = (uchar_t *)&sin[1];
8046 		*sin = sin_null;
8047 		sin->sin_family = AF_INET;
8048 		sin->sin_addr.s_addr = v4addr;
8049 		sin->sin_port = port;
8050 	} else {
8051 		/* udp->udp_family == AF_INET6 */
8052 		sin6_t *sin6;
8053 
8054 		STRUCT_FSET(sb, len, (int)sizeof (sin6_t));
8055 		sin6 = (sin6_t *)mp1->b_rptr;
8056 		mp1->b_wptr = (uchar_t *)&sin6[1];
8057 		*sin6 = sin6_null;
8058 		sin6->sin6_family = AF_INET6;
8059 		sin6->sin6_flowinfo = flowinfo;
8060 		sin6->sin6_addr = v6addr;
8061 		sin6->sin6_port = port;
8062 	}
8063 	/* Copy out the address */
8064 	mi_copyout(q, mp);
8065 }
8066 
8067 
8068 static int
8069 udp_unitdata_opt_process(queue_t *q, mblk_t *mp, int *errorp,
8070     udpattrs_t *udpattrs)
8071 {
8072 	struct T_unitdata_req *udreqp;
8073 	int is_absreq_failure;
8074 	cred_t *cr;
8075 	conn_t	*connp = Q_TO_CONN(q);
8076 
8077 	ASSERT(((t_primp_t)mp->b_rptr)->type);
8078 
8079 	cr = DB_CREDDEF(mp, connp->conn_cred);
8080 
8081 	udreqp = (struct T_unitdata_req *)mp->b_rptr;
8082 
8083 	/*
8084 	 * Use upper queue for option processing since the callback
8085 	 * routines expect to be called in UDP instance instead of IP.
8086 	 */
8087 	*errorp = tpi_optcom_buf(_WR(UDP_RD(q)), mp, &udreqp->OPT_length,
8088 	    udreqp->OPT_offset, cr, &udp_opt_obj,
8089 	    udpattrs, &is_absreq_failure);
8090 
8091 	if (*errorp != 0) {
8092 		/*
8093 		 * Note: No special action needed in this
8094 		 * module for "is_absreq_failure"
8095 		 */
8096 		return (-1);		/* failure */
8097 	}
8098 	ASSERT(is_absreq_failure == 0);
8099 	return (0);	/* success */
8100 }
8101 
8102 void
8103 udp_ddi_init(void)
8104 {
8105 	int i;
8106 
8107 	UDP6_MAJ = ddi_name_to_major(UDP6);
8108 
8109 	udp_max_optsize = optcom_max_optsize(udp_opt_obj.odb_opt_des_arr,
8110 	    udp_opt_obj.odb_opt_arr_cnt);
8111 
8112 	if (udp_bind_fanout_size & (udp_bind_fanout_size - 1)) {
8113 		/* Not a power of two. Round up to nearest power of two */
8114 		for (i = 0; i < 31; i++) {
8115 			if (udp_bind_fanout_size < (1 << i))
8116 				break;
8117 		}
8118 		udp_bind_fanout_size = 1 << i;
8119 	}
8120 	udp_bind_fanout = kmem_zalloc(udp_bind_fanout_size *
8121 	    sizeof (udp_fanout_t), KM_SLEEP);
8122 	for (i = 0; i < udp_bind_fanout_size; i++) {
8123 		mutex_init(&udp_bind_fanout[i].uf_lock, NULL, MUTEX_DEFAULT,
8124 		    NULL);
8125 	}
8126 	(void) udp_param_register(udp_param_arr, A_CNT(udp_param_arr));
8127 
8128 	udp_kstat_init();
8129 
8130 	udp_cache = kmem_cache_create("udp_cache", sizeof (udp_t),
8131 	    CACHE_ALIGN_SIZE, NULL, NULL, NULL, NULL, NULL, 0);
8132 }
8133 
8134 void
8135 udp_ddi_destroy(void)
8136 {
8137 	int i;
8138 
8139 	nd_free(&udp_g_nd);
8140 
8141 	for (i = 0; i < udp_bind_fanout_size; i++) {
8142 		mutex_destroy(&udp_bind_fanout[i].uf_lock);
8143 	}
8144 
8145 	kmem_free(udp_bind_fanout, udp_bind_fanout_size *
8146 	    sizeof (udp_fanout_t));
8147 
8148 	udp_kstat_fini();
8149 
8150 	kmem_cache_destroy(udp_cache);
8151 }
8152 
8153 static void
8154 udp_kstat_init(void)
8155 {
8156 	udp_named_kstat_t template = {
8157 		{ "inDatagrams",	KSTAT_DATA_UINT32, 0 },
8158 		{ "inErrors",		KSTAT_DATA_UINT32, 0 },
8159 		{ "outDatagrams",	KSTAT_DATA_UINT32, 0 },
8160 		{ "entrySize",		KSTAT_DATA_INT32, 0 },
8161 		{ "entry6Size",		KSTAT_DATA_INT32, 0 },
8162 		{ "outErrors",		KSTAT_DATA_UINT32, 0 },
8163 	};
8164 
8165 	udp_mibkp = kstat_create(UDP_MOD_NAME, 0, UDP_MOD_NAME,
8166 	    "mib2", KSTAT_TYPE_NAMED, NUM_OF_FIELDS(udp_named_kstat_t), 0);
8167 
8168 	if (udp_mibkp == NULL)
8169 		return;
8170 
8171 	template.entrySize.value.ui32 = sizeof (mib2_udpEntry_t);
8172 	template.entry6Size.value.ui32 = sizeof (mib2_udp6Entry_t);
8173 
8174 	bcopy(&template, udp_mibkp->ks_data, sizeof (template));
8175 
8176 	udp_mibkp->ks_update = udp_kstat_update;
8177 
8178 	kstat_install(udp_mibkp);
8179 
8180 	if ((udp_ksp = kstat_create(UDP_MOD_NAME, 0, "udpstat",
8181 	    "net", KSTAT_TYPE_NAMED,
8182 	    sizeof (udp_statistics) / sizeof (kstat_named_t),
8183 	    KSTAT_FLAG_VIRTUAL)) != NULL) {
8184 		udp_ksp->ks_data = &udp_statistics;
8185 		kstat_install(udp_ksp);
8186 	}
8187 }
8188 
8189 static void
8190 udp_kstat_fini(void)
8191 {
8192 	if (udp_ksp != NULL) {
8193 		kstat_delete(udp_ksp);
8194 		udp_ksp = NULL;
8195 	}
8196 	if (udp_mibkp != NULL) {
8197 		kstat_delete(udp_mibkp);
8198 		udp_mibkp = NULL;
8199 	}
8200 }
8201 
8202 static int
8203 udp_kstat_update(kstat_t *kp, int rw)
8204 {
8205 	udp_named_kstat_t *udpkp;
8206 
8207 	if ((kp == NULL) || (kp->ks_data == NULL))
8208 		return (EIO);
8209 
8210 	if (rw == KSTAT_WRITE)
8211 		return (EACCES);
8212 
8213 	udpkp = (udp_named_kstat_t *)kp->ks_data;
8214 
8215 	udpkp->inDatagrams.value.ui32 =	udp_mib.udpInDatagrams;
8216 	udpkp->inErrors.value.ui32 =	udp_mib.udpInErrors;
8217 	udpkp->outDatagrams.value.ui32 = udp_mib.udpOutDatagrams;
8218 	udpkp->outErrors.value.ui32 =	udp_mib.udpOutErrors;
8219 
8220 	return (0);
8221 }
8222 
8223 /* ARGSUSED */
8224 static void
8225 udp_rput(queue_t *q, mblk_t *mp)
8226 {
8227 	/*
8228 	 * We get here whenever we do qreply() from IP,
8229 	 * i.e as part of handlings ioctls, etc.
8230 	 */
8231 	putnext(q, mp);
8232 }
8233 
8234 /*
8235  * Read-side synchronous stream info entry point, called as a
8236  * result of handling certain STREAMS ioctl operations.
8237  */
8238 static int
8239 udp_rinfop(queue_t *q, infod_t *dp)
8240 {
8241 	mblk_t	*mp;
8242 	uint_t	cmd = dp->d_cmd;
8243 	int	res = 0;
8244 	int	error = 0;
8245 	udp_t	*udp = Q_TO_UDP(RD(UDP_WR(q)));
8246 	struct stdata *stp = STREAM(q);
8247 
8248 	mutex_enter(&udp->udp_drain_lock);
8249 	/* If shutdown on read has happened, return nothing */
8250 	mutex_enter(&stp->sd_lock);
8251 	if (stp->sd_flag & STREOF) {
8252 		mutex_exit(&stp->sd_lock);
8253 		goto done;
8254 	}
8255 	mutex_exit(&stp->sd_lock);
8256 
8257 	if ((mp = udp->udp_rcv_list_head) == NULL)
8258 		goto done;
8259 
8260 	ASSERT(DB_TYPE(mp) != M_DATA && mp->b_cont != NULL);
8261 
8262 	if (cmd & INFOD_COUNT) {
8263 		/*
8264 		 * Return the number of messages.
8265 		 */
8266 		dp->d_count += udp->udp_rcv_msgcnt;
8267 		res |= INFOD_COUNT;
8268 	}
8269 	if (cmd & INFOD_BYTES) {
8270 		/*
8271 		 * Return size of all data messages.
8272 		 */
8273 		dp->d_bytes += udp->udp_rcv_cnt;
8274 		res |= INFOD_BYTES;
8275 	}
8276 	if (cmd & INFOD_FIRSTBYTES) {
8277 		/*
8278 		 * Return size of first data message.
8279 		 */
8280 		dp->d_bytes = msgdsize(mp);
8281 		res |= INFOD_FIRSTBYTES;
8282 		dp->d_cmd &= ~INFOD_FIRSTBYTES;
8283 	}
8284 	if (cmd & INFOD_COPYOUT) {
8285 		mblk_t *mp1 = mp->b_cont;
8286 		int n;
8287 		/*
8288 		 * Return data contents of first message.
8289 		 */
8290 		ASSERT(DB_TYPE(mp1) == M_DATA);
8291 		while (mp1 != NULL && dp->d_uiop->uio_resid > 0) {
8292 			n = MIN(dp->d_uiop->uio_resid, MBLKL(mp1));
8293 			if (n != 0 && (error = uiomove((char *)mp1->b_rptr, n,
8294 			    UIO_READ, dp->d_uiop)) != 0) {
8295 				goto done;
8296 			}
8297 			mp1 = mp1->b_cont;
8298 		}
8299 		res |= INFOD_COPYOUT;
8300 		dp->d_cmd &= ~INFOD_COPYOUT;
8301 	}
8302 done:
8303 	mutex_exit(&udp->udp_drain_lock);
8304 
8305 	dp->d_res |= res;
8306 
8307 	return (error);
8308 }
8309 
8310 /*
8311  * Read-side synchronous stream entry point.  This is called as a result
8312  * of recv/read operation done at sockfs, and is guaranteed to execute
8313  * outside of the interrupt thread context.  It returns a single datagram
8314  * (b_cont chain of T_UNITDATA_IND plus data) to the upper layer.
8315  */
8316 static int
8317 udp_rrw(queue_t *q, struiod_t *dp)
8318 {
8319 	mblk_t	*mp;
8320 	udp_t	*udp = Q_TO_UDP(_RD(UDP_WR(q)));
8321 
8322 	/* We should never get here when we're in SNMP mode */
8323 	ASSERT(!(udp->udp_connp->conn_flags & IPCL_UDPMOD));
8324 
8325 	/*
8326 	 * Dequeue datagram from the head of the list and return
8327 	 * it to caller; also ensure that RSLEEP sd_wakeq flag is
8328 	 * set/cleared depending on whether or not there's data
8329 	 * remaining in the list.
8330 	 */
8331 	mutex_enter(&udp->udp_drain_lock);
8332 	if (!udp->udp_direct_sockfs) {
8333 		mutex_exit(&udp->udp_drain_lock);
8334 		UDP_STAT(udp_rrw_busy);
8335 		return (EBUSY);
8336 	}
8337 	if ((mp = udp->udp_rcv_list_head) != NULL) {
8338 		uint_t size = msgdsize(mp);
8339 
8340 		/* Last datagram in the list? */
8341 		if ((udp->udp_rcv_list_head = mp->b_next) == NULL)
8342 			udp->udp_rcv_list_tail = NULL;
8343 		mp->b_next = NULL;
8344 
8345 		udp->udp_rcv_cnt -= size;
8346 		udp->udp_rcv_msgcnt--;
8347 		UDP_STAT(udp_rrw_msgcnt);
8348 
8349 		/* No longer flow-controlling? */
8350 		if (udp->udp_rcv_cnt < udp->udp_rcv_hiwat &&
8351 		    udp->udp_rcv_msgcnt < udp->udp_rcv_hiwat)
8352 			udp->udp_drain_qfull = B_FALSE;
8353 	}
8354 	if (udp->udp_rcv_list_head == NULL) {
8355 		/*
8356 		 * Either we just dequeued the last datagram or
8357 		 * we get here from sockfs and have nothing to
8358 		 * return; in this case clear RSLEEP.
8359 		 */
8360 		ASSERT(udp->udp_rcv_cnt == 0);
8361 		ASSERT(udp->udp_rcv_msgcnt == 0);
8362 		ASSERT(udp->udp_rcv_list_tail == NULL);
8363 		STR_WAKEUP_CLEAR(STREAM(q));
8364 	} else {
8365 		/*
8366 		 * More data follows; we need udp_rrw() to be
8367 		 * called in future to pick up the rest.
8368 		 */
8369 		STR_WAKEUP_SET(STREAM(q));
8370 	}
8371 	mutex_exit(&udp->udp_drain_lock);
8372 	dp->d_mp = mp;
8373 	return (0);
8374 }
8375 
8376 /*
8377  * Enqueue a completely-built T_UNITDATA_IND message into the receive
8378  * list; this is typically executed within the interrupt thread context
8379  * and so we do things as quickly as possible.
8380  */
8381 static void
8382 udp_rcv_enqueue(queue_t *q, udp_t *udp, mblk_t *mp, uint_t pkt_len)
8383 {
8384 	ASSERT(q == RD(q));
8385 	ASSERT(pkt_len == msgdsize(mp));
8386 	ASSERT(mp->b_next == NULL && mp->b_cont != NULL);
8387 	ASSERT(DB_TYPE(mp) == M_PROTO && DB_TYPE(mp->b_cont) == M_DATA);
8388 	ASSERT(MBLKL(mp) >= sizeof (struct T_unitdata_ind));
8389 
8390 	mutex_enter(&udp->udp_drain_lock);
8391 	/*
8392 	 * Wake up and signal the receiving app; it is okay to do this
8393 	 * before enqueueing the mp because we are holding the drain lock.
8394 	 * One of the advantages of synchronous stream is the ability for
8395 	 * us to find out when the application performs a read on the
8396 	 * socket by way of udp_rrw() entry point being called.  We need
8397 	 * to generate SIGPOLL/SIGIO for each received data in the case
8398 	 * of asynchronous socket just as in the strrput() case.  However,
8399 	 * we only wake the application up when necessary, i.e. during the
8400 	 * first enqueue.  When udp_rrw() is called, we send up a single
8401 	 * datagram upstream and call STR_WAKEUP_SET() again when there
8402 	 * are still data remaining in our receive queue.
8403 	 */
8404 	if (udp->udp_rcv_list_head == NULL) {
8405 		STR_WAKEUP_SET(STREAM(q));
8406 		udp->udp_rcv_list_head = mp;
8407 	} else {
8408 		udp->udp_rcv_list_tail->b_next = mp;
8409 	}
8410 	udp->udp_rcv_list_tail = mp;
8411 	udp->udp_rcv_cnt += pkt_len;
8412 	udp->udp_rcv_msgcnt++;
8413 
8414 	/* Need to flow-control? */
8415 	if (udp->udp_rcv_cnt >= udp->udp_rcv_hiwat ||
8416 	    udp->udp_rcv_msgcnt >= udp->udp_rcv_hiwat)
8417 		udp->udp_drain_qfull = B_TRUE;
8418 
8419 	/* Update poll events and send SIGPOLL/SIGIO if necessary */
8420 	STR_SENDSIG(STREAM(q));
8421 	mutex_exit(&udp->udp_drain_lock);
8422 }
8423 
8424 /*
8425  * Drain the contents of receive list to the module upstream; we do
8426  * this during close or when we fallback to the slow mode due to
8427  * sockmod being popped or a module being pushed on top of us.
8428  */
8429 static void
8430 udp_rcv_drain(queue_t *q, udp_t *udp, boolean_t closing)
8431 {
8432 	mblk_t *mp;
8433 
8434 	ASSERT(q == RD(q));
8435 
8436 	mutex_enter(&udp->udp_drain_lock);
8437 	/*
8438 	 * There is no race with a concurrent udp_input() sending
8439 	 * up packets using putnext() after we have cleared the
8440 	 * udp_direct_sockfs flag but before we have completed
8441 	 * sending up the packets in udp_rcv_list, since we are
8442 	 * either a writer or we have quiesced the conn.
8443 	 */
8444 	udp->udp_direct_sockfs = B_FALSE;
8445 	mutex_exit(&udp->udp_drain_lock);
8446 
8447 	if (udp->udp_rcv_list_head != NULL)
8448 		UDP_STAT(udp_drain);
8449 
8450 	/*
8451 	 * Send up everything via putnext(); note here that we
8452 	 * don't need the udp_drain_lock to protect us since
8453 	 * nothing can enter udp_rrw() and that we currently
8454 	 * have exclusive access to this udp.
8455 	 */
8456 	while ((mp = udp->udp_rcv_list_head) != NULL) {
8457 		udp->udp_rcv_list_head = mp->b_next;
8458 		mp->b_next = NULL;
8459 		udp->udp_rcv_cnt -= msgdsize(mp);
8460 		udp->udp_rcv_msgcnt--;
8461 		if (closing) {
8462 			freemsg(mp);
8463 		} else {
8464 			putnext(q, mp);
8465 		}
8466 	}
8467 	ASSERT(udp->udp_rcv_cnt == 0);
8468 	ASSERT(udp->udp_rcv_msgcnt == 0);
8469 	ASSERT(udp->udp_rcv_list_head == NULL);
8470 	udp->udp_rcv_list_tail = NULL;
8471 	udp->udp_drain_qfull = B_FALSE;
8472 }
8473 
8474 static size_t
8475 udp_set_rcv_hiwat(udp_t *udp, size_t size)
8476 {
8477 	/* We add a bit of extra buffering */
8478 	size += size >> 1;
8479 	if (size > udp_max_buf)
8480 		size = udp_max_buf;
8481 
8482 	udp->udp_rcv_hiwat = size;
8483 	return (size);
8484 }
8485 
8486 /*
8487  * Little helper for IPsec's NAT-T processing.
8488  */
8489 boolean_t
8490 udp_compute_checksum(void)
8491 {
8492 	return (udp_do_checksum);
8493 }
8494