xref: /titanic_51/usr/src/uts/common/inet/ip/ip.c (revision 1a7c1b724419d3cb5fa6eea75123c6b2060ba31b)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License, Version 1.0 only
6  * (the "License").  You may not use this file except in compliance
7  * with the License.
8  *
9  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10  * or http://www.opensolaris.org/os/licensing.
11  * See the License for the specific language governing permissions
12  * and limitations under the License.
13  *
14  * When distributing Covered Code, include this CDDL HEADER in each
15  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16  * If applicable, add the following below this CDDL HEADER, with the
17  * fields enclosed by brackets "[]" replaced with your own identifying
18  * information: Portions Copyright [yyyy] [name of copyright owner]
19  *
20  * CDDL HEADER END
21  */
22 /*
23  * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 /* Copyright (c) 1990 Mentat Inc. */
27 
28 #pragma ident	"%Z%%M%	%I%	%E% SMI"
29 
30 #include <sys/types.h>
31 #include <sys/stream.h>
32 #include <sys/dlpi.h>
33 #include <sys/stropts.h>
34 #include <sys/sysmacros.h>
35 #include <sys/strsubr.h>
36 #include <sys/strlog.h>
37 #include <sys/strsun.h>
38 #include <sys/zone.h>
39 #define	_SUN_TPI_VERSION 2
40 #include <sys/tihdr.h>
41 #include <sys/xti_inet.h>
42 #include <sys/ddi.h>
43 #include <sys/sunddi.h>
44 #include <sys/cmn_err.h>
45 #include <sys/debug.h>
46 #include <sys/kobj.h>
47 #include <sys/modctl.h>
48 #include <sys/atomic.h>
49 #include <sys/policy.h>
50 
51 #include <sys/systm.h>
52 #include <sys/param.h>
53 #include <sys/kmem.h>
54 #include <sys/socket.h>
55 #include <sys/vtrace.h>
56 #include <sys/isa_defs.h>
57 #include <net/if.h>
58 #include <net/if_arp.h>
59 #include <net/route.h>
60 #include <sys/sockio.h>
61 #include <netinet/in.h>
62 #include <net/if_dl.h>
63 
64 #include <inet/common.h>
65 #include <inet/mi.h>
66 #include <inet/mib2.h>
67 #include <inet/nd.h>
68 #include <inet/arp.h>
69 #include <inet/snmpcom.h>
70 #include <inet/kstatcom.h>
71 
72 #include <netinet/igmp_var.h>
73 #include <netinet/ip6.h>
74 #include <netinet/icmp6.h>
75 #include <netinet/sctp.h>
76 
77 #include <inet/ip.h>
78 #include <inet/ip6.h>
79 #include <inet/ip6_asp.h>
80 #include <inet/tcp.h>
81 #include <inet/ip_multi.h>
82 #include <inet/ip_if.h>
83 #include <inet/ip_ire.h>
84 #include <inet/ip_rts.h>
85 #include <inet/optcom.h>
86 #include <inet/ip_ndp.h>
87 #include <inet/ip_listutils.h>
88 #include <netinet/igmp.h>
89 #include <netinet/ip_mroute.h>
90 #include <inet/ipp_common.h>
91 
92 #include <net/pfkeyv2.h>
93 #include <inet/ipsec_info.h>
94 #include <inet/sadb.h>
95 #include <inet/ipsec_impl.h>
96 #include <sys/iphada.h>
97 #include <inet/tun.h>
98 #include <inet/ipdrop.h>
99 
100 #include <sys/ethernet.h>
101 #include <net/if_types.h>
102 #include <sys/cpuvar.h>
103 
104 #include <ipp/ipp.h>
105 #include <ipp/ipp_impl.h>
106 #include <ipp/ipgpc/ipgpc.h>
107 
108 #include <sys/multidata.h>
109 #include <sys/pattr.h>
110 
111 #include <inet/ipclassifier.h>
112 #include <inet/sctp_ip.h>
113 
114 /*
115  * Values for squeue switch:
116  * IP_SQUEUE_ENTER_NODRAIN: squeue_enter_nodrain
117  * IP_SQUEUE_ENTER: squeue_enter
118  * IP_SQUEUE_FILL: squeue_fill
119  */
120 int ip_squeue_enter = 2;
121 squeue_func_t ip_input_proc;
122 /*
123  * IP statistics.
124  */
125 #define	IP_STAT(x)	(ip_statistics.x.value.ui64++)
126 
127 typedef struct ip_stat {
128 	kstat_named_t	ipsec_fanout_proto;
129 	kstat_named_t	ip_udp_fannorm;
130 	kstat_named_t	ip_udp_fanmb;
131 	kstat_named_t	ip_udp_fanothers;
132 	kstat_named_t	ip_udp_fast_path;
133 	kstat_named_t	ip_udp_slow_path;
134 	kstat_named_t	ip_udp_input_err;
135 	kstat_named_t	ip_tcppullup;
136 	kstat_named_t	ip_tcpoptions;
137 	kstat_named_t	ip_multipkttcp;
138 	kstat_named_t	ip_tcp_fast_path;
139 	kstat_named_t	ip_tcp_slow_path;
140 	kstat_named_t	ip_tcp_input_error;
141 	kstat_named_t	ip_db_ref;
142 	kstat_named_t	ip_notaligned1;
143 	kstat_named_t	ip_notaligned2;
144 	kstat_named_t	ip_multimblk3;
145 	kstat_named_t	ip_multimblk4;
146 	kstat_named_t	ip_ipoptions;
147 	kstat_named_t	ip_classify_fail;
148 	kstat_named_t	ip_opt;
149 	kstat_named_t	ip_udp_rput_local;
150 	kstat_named_t	ipsec_proto_ahesp;
151 	kstat_named_t	ip_conn_flputbq;
152 	kstat_named_t	ip_conn_walk_drain;
153 	kstat_named_t   ip_out_sw_cksum;
154 	kstat_named_t   ip_in_sw_cksum;
155 	kstat_named_t   ip_trash_ire_reclaim_calls;
156 	kstat_named_t   ip_trash_ire_reclaim_success;
157 	kstat_named_t   ip_ire_arp_timer_expired;
158 	kstat_named_t   ip_ire_redirect_timer_expired;
159 	kstat_named_t	ip_ire_pmtu_timer_expired;
160 	kstat_named_t	ip_input_multi_squeue;
161 } ip_stat_t;
162 
163 static ip_stat_t ip_statistics = {
164 	{ "ipsec_fanout_proto", 	KSTAT_DATA_UINT64 },
165 	{ "ip_udp_fannorm", 		KSTAT_DATA_UINT64 },
166 	{ "ip_udp_fanmb", 		KSTAT_DATA_UINT64 },
167 	{ "ip_udp_fanothers", 		KSTAT_DATA_UINT64 },
168 	{ "ip_udp_fast_path", 		KSTAT_DATA_UINT64 },
169 	{ "ip_udp_slow_path", 		KSTAT_DATA_UINT64 },
170 	{ "ip_udp_input_err", 		KSTAT_DATA_UINT64 },
171 	{ "ip_tcppullup", 		KSTAT_DATA_UINT64 },
172 	{ "ip_tcpoptions", 		KSTAT_DATA_UINT64 },
173 	{ "ip_multipkttcp", 		KSTAT_DATA_UINT64 },
174 	{ "ip_tcp_fast_path",		KSTAT_DATA_UINT64 },
175 	{ "ip_tcp_slow_path",		KSTAT_DATA_UINT64 },
176 	{ "ip_tcp_input_error",		KSTAT_DATA_UINT64 },
177 	{ "ip_db_ref",			KSTAT_DATA_UINT64 },
178 	{ "ip_notaligned1",		KSTAT_DATA_UINT64 },
179 	{ "ip_notaligned2",		KSTAT_DATA_UINT64 },
180 	{ "ip_multimblk3",		KSTAT_DATA_UINT64 },
181 	{ "ip_multimblk4",		KSTAT_DATA_UINT64 },
182 	{ "ip_ipoptions",		KSTAT_DATA_UINT64 },
183 	{ "ip_classify_fail",		KSTAT_DATA_UINT64 },
184 	{ "ip_opt",			KSTAT_DATA_UINT64 },
185 	{ "ip_udp_rput_local",		KSTAT_DATA_UINT64 },
186 	{ "ipsec_proto_ahesp",		KSTAT_DATA_UINT64 },
187 	{ "ip_conn_flputbq",		KSTAT_DATA_UINT64 },
188 	{ "ip_conn_walk_drain",		KSTAT_DATA_UINT64 },
189 	{ "ip_out_sw_cksum",		KSTAT_DATA_UINT64 },
190 	{ "ip_in_sw_cksum",		KSTAT_DATA_UINT64 },
191 	{ "ip_trash_ire_reclaim_calls",	KSTAT_DATA_UINT64 },
192 	{ "ip_trash_ire_reclaim_success",	KSTAT_DATA_UINT64 },
193 	{ "ip_ire_arp_timer_expired",	KSTAT_DATA_UINT64 },
194 	{ "ip_ire_redirect_timer_expired",	KSTAT_DATA_UINT64 },
195 	{ "ip_ire_pmtu_timer_expired",	KSTAT_DATA_UINT64 },
196 	{ "ip_input_multi_squeue",	KSTAT_DATA_UINT64 },
197 };
198 
199 static kstat_t *ip_kstat;
200 
201 #define	TCP6 "tcp6"
202 #define	TCP "tcp"
203 #define	SCTP "sctp"
204 #define	SCTP6 "sctp6"
205 
206 major_t TCP6_MAJ;
207 major_t TCP_MAJ;
208 major_t SCTP_MAJ;
209 major_t SCTP6_MAJ;
210 
211 int ip_poll_normal_ms = 100;
212 int ip_poll_normal_ticks = 0;
213 
214 /*
215  * Structure to represent a linked list of msgblks. Used by ip_snmp_ functions.
216  */
217 
218 struct listptr_s {
219 	mblk_t	*lp_head;	/* pointer to the head of the list */
220 	mblk_t	*lp_tail;	/* pointer to the tail of the list */
221 };
222 
223 typedef struct listptr_s listptr_t;
224 
225 /*
226  * Cluster specific hooks. These should be NULL when booted as a non-cluster
227  */
228 
229 /*
230  * Hook functions to enable cluster networking
231  * On non-clustered systems these vectors must always be NULL.
232  *
233  * Hook function to Check ip specified ip address is a shared ip address
234  * in the cluster
235  *
236  */
237 int (*cl_inet_isclusterwide)(uint8_t protocol,
238     sa_family_t addr_family, uint8_t *laddrp) = NULL;
239 
240 /*
241  * Hook function to generate cluster wide ip fragment identifier
242  */
243 uint32_t (*cl_inet_ipident)(uint8_t protocol, sa_family_t addr_family,
244     uint8_t *laddrp, uint8_t *faddrp) = NULL;
245 
246 /*
247  * Synchronization notes:
248  *
249  * IP is a fully D_MP STREAMS module/driver. Thus it does not depend on any
250  * MT level protection given by STREAMS. IP uses a combination of its own
251  * internal serialization mechanism and standard Solaris locking techniques.
252  * The internal serialization is per phyint (no IPMP) or per IPMP group.
253  * This is used to serialize plumbing operations, IPMP operations, certain
254  * multicast operations, most set ioctls, igmp/mld timers etc.
255  *
256  * Plumbing is a long sequence of operations involving message
257  * exchanges between IP, ARP and device drivers. Many set ioctls are typically
258  * involved in plumbing operations. A natural model is to serialize these
259  * ioctls one per ill. For example plumbing of hme0 and qfe0 can go on in
260  * parallel without any interference. But various set ioctls on hme0 are best
261  * serialized. However if the system uses IPMP, the operations are easier if
262  * they are serialized on a per IPMP group basis since IPMP operations
263  * happen across ill's of a group. Thus the lowest common denominator is to
264  * serialize most set ioctls, multicast join/leave operations, IPMP operations
265  * igmp/mld timer operations, and processing of DLPI control messages received
266  * from drivers on a per IPMP group basis. If the system does not employ
267  * IPMP the serialization is on a per phyint basis. This serialization is
268  * provided by the ipsq_t and primitives operating on this. Details can
269  * be found in ip_if.c above the core primitives operating on ipsq_t.
270  *
271  * Lookups of an ipif or ill by a thread return a refheld ipif / ill.
272  * Simiarly lookup of an ire by a thread also returns a refheld ire.
273  * In addition ipif's and ill's referenced by the ire are also indirectly
274  * refheld. Thus no ipif or ill can vanish nor can critical parameters like
275  * the ipif's address or netmask change as long as an ipif is refheld
276  * directly or indirectly. For example an SIOCLIFADDR ioctl that changes the
277  * address of an ipif has to go through the ipsq_t. This ensures that only
278  * 1 such exclusive operation proceeds at any time on the ipif. It then
279  * deletes all ires associated with this ipif, and waits for all refcnts
280  * associated with this ipif to come down to zero. The address is changed
281  * only after the ipif has been quiesced. Then the ipif is brought up again.
282  * More details are described above the comment in ip_sioctl_flags.
283  *
284  * Packet processing is based mostly on IREs and are fully multi-threaded
285  * using standard Solaris MT techniques.
286  *
287  * There are explicit locks in IP to handle:
288  * - The ip_g_head list maintained by mi_open_link() and friends.
289  *
290  * - The reassembly data structures (one lock per hash bucket)
291  *
292  * - conn_lock is meant to protect conn_t fields. The fields actually
293  *   protected by conn_lock are documented in the conn_t definition.
294  *
295  * - ire_lock to protect some of the fields of the ire, IRE tables
296  *   (one lock per hash bucket). Refer to ip_ire.c for details.
297  *
298  * - ndp_g_lock and nce_lock for protecting NCEs.
299  *
300  * - ill_lock protects fields of the ill and ipif. Details in ip.h
301  *
302  * - ill_g_lock: This is a global reader/writer lock. Protects the following
303  *	* The AVL tree based global multi list of all ills.
304  *	* The linked list of all ipifs of an ill
305  *	* The <ill-ipsq> mapping
306  *	* The ipsq->ipsq_phyint_list threaded by phyint_ipsq_next
307  *	* The illgroup list threaded by ill_group_next.
308  *	* <ill-phyint> association
309  *   Insertion/deletion of an ill in the system, insertion/deletion of an ipif
310  *   into an ill, changing the <ill-ipsq> mapping of an ill, insertion/deletion
311  *   of an ill into the illgrp list, changing the <ill-phyint> assoc of an ill
312  *   will all have to hold the ill_g_lock as writer for the actual duration
313  *   of the insertion/deletion/change. More details about the <ill-ipsq> mapping
314  *   may be found in the IPMP section.
315  *
316  * - ill_lock:  This is a per ill mutex.
317  *   It protects some members of the ill and is documented below.
318  *   It also protects the <ill-ipsq> mapping
319  *   It also protects the illgroup list threaded by ill_group_next.
320  *   It also protects the <ill-phyint> assoc.
321  *   It also protects the list of ipifs hanging off the ill.
322  *
323  * - ipsq_lock: This is a per ipsq_t mutex lock.
324  *   This protects all the other members of the ipsq struct except
325  *   ipsq_refs and ipsq_phyint_list which are protected by ill_g_lock
326  *
327  * - illgrp_lock: This is a per ill_group mutex lock.
328  *   The only thing it protects is the illgrp_ill_schednext member of ill_group
329  *   which dictates which is the next ill in an ill_group that is to be chosen
330  *   for sending outgoing packets, through creation of an IRE_CACHE that
331  *   references this ill.
332  *
333  * - phyint_lock: This is a per phyint mutex lock. Protects just the
334  *   phyint_flags
335  *
336  * - ip_g_nd_lock: This is a global reader/writer lock.
337  *   Any call to nd_load to load a new parameter to the ND table must hold the
338  *   lock as writer. ND_GET/ND_SET routines that read the ND table hold the lock
339  *   as reader.
340  *
341  * - ip_addr_avail_lock: This is used to ensure the uniqueness of IP addresses.
342  *   This lock is held in ipif_up_done and the ipif is marked IPIF_UP and the
343  *   uniqueness check also done atomically.
344  *
345  * - ipsec_capab_ills_lock: This readers/writer lock protects the global
346  *   lists of IPsec capable ills (ipsec_capab_ills_{ah,esp}). It is taken
347  *   as a writer when adding or deleting elements from these lists, and
348  *   as a reader when walking these lists to send a SADB update to the
349  *   IPsec capable ills.
350  *
351  * - ill_g_usesrc_lock: This readers/writer lock protects the usesrc
352  *   group list linked by ill_usesrc_grp_next. It also protects the
353  *   ill_usesrc_ifindex field. It is taken as a writer when a member of the
354  *   group is being added or deleted.  This lock is taken as a reader when
355  *   walking the list/group(eg: to get the number of members in a usesrc group).
356  *   Note, it is only necessary to take this lock if the ill_usesrc_grp_next
357  *   field is changing state i.e from NULL to non-NULL or vice-versa. For
358  *   example, it is not necessary to take this lock in the initial portion
359  *   of ip_sioctl_slifusesrc or at all in ip_sioctl_groupname and
360  *   ip_sioctl_flags since the these operations are executed exclusively and
361  *   that ensures that the "usesrc group state" cannot change. The "usesrc
362  *   group state" change can happen only in the latter part of
363  *   ip_sioctl_slifusesrc and in ill_delete.
364  *
365  * Changing <ill-phyint>, <ill-ipsq>, <ill-illgroup> assocications.
366  *
367  * To change the <ill-phyint> association, the ill_g_lock must be held
368  * as writer, and the ill_locks of both the v4 and v6 instance of the ill
369  * must be held.
370  *
371  * To change the <ill-ipsq> association the ill_g_lock must be held as writer
372  * and the ill_lock of the ill in question must be held.
373  *
374  * To change the <ill-illgroup> association the ill_g_lock must be held as
375  * writer and the ill_lock of the ill in question must be held.
376  *
377  * To add or delete an ipif from the list of ipifs hanging off the ill,
378  * ill_g_lock (writer) and ill_lock must be held and the thread must be
379  * a writer on the associated ipsq,.
380  *
381  * To add or delete an ill to the system, the ill_g_lock must be held as
382  * writer and the thread must be a writer on the associated ipsq.
383  *
384  * To add or delete an ilm to an ill, the ill_lock must be held and the thread
385  * must be a writer on the associated ipsq.
386  *
387  * Lock hierarchy
388  *
389  * Some lock hierarchy scenarios are listed below.
390  *
391  * ill_g_lock -> conn_lock -> ill_lock -> ipsq_lock
392  * ill_g_lock -> illgrp_lock -> ill_lock
393  * ill_g_lock -> ill_lock(s) -> phyint_lock
394  * ill_g_lock -> ndp_g_lock -> ill_lock -> nce_lock
395  * ill_g_lock -> ip_addr_avail_lock
396  * conn_lock -> irb_lock -> ill_lock -> ire_lock
397  * ipsa_lock -> ill_g_lock -> ill_lock
398  * ill_g_lock -> ip_g_nd_lock
399  * irb_lock -> ill_lock -> ire_mrtun_lock
400  * irb_lock -> ill_lock -> ire_srcif_table_lock
401  * ipsec_capab_ills_lock -> ill_g_lock -> ill_lock
402  * ipsec_capab_ills_lock -> ipsa_lock
403  * ill_g_usesrc_lock -> ill_g_lock -> ill_lock
404  *
405  * When more than 1 ill lock is needed to be held, all ill lock addresses
406  * are sorted on address and locked starting from highest addressed lock
407  * downward.
408  *
409  * IPSEC notes :
410  *
411  * IP interacts with the IPSEC code (AH/ESP) by tagging a M_CTL message
412  * in front of the actual packet. For outbound datagrams, the M_CTL
413  * contains a ipsec_out_t (defined in ipsec_info.h), which has the
414  * information used by the IPSEC code for applying the right level of
415  * protection. The information initialized by IP in the ipsec_out_t
416  * is determined by the per-socket policy or global policy in the system.
417  * For inbound datagrams, the M_CTL contains a ipsec_in_t (defined in
418  * ipsec_info.h) which starts out with nothing in it. It gets filled
419  * with the right information if it goes through the AH/ESP code, which
420  * happens if the incoming packet is secure. The information initialized
421  * by AH/ESP, is later used by IP(during fanouts to ULP) to see whether
422  * the policy requirements needed by per-socket policy or global policy
423  * is met or not.
424  *
425  * If there is both per-socket policy (set using setsockopt) and there
426  * is also global policy match for the 5 tuples of the socket,
427  * ipsec_override_policy() makes the decision of which one to use.
428  *
429  * For fully connected sockets i.e dst, src [addr, port] is known,
430  * conn_policy_cached is set indicating that policy has been cached.
431  * conn_in_enforce_policy may or may not be set depending on whether
432  * there is a global policy match or per-socket policy match.
433  * Policy inheriting happpens in ip_bind during the ipa_conn_t bind.
434  * Once the right policy is set on the conn_t, policy cannot change for
435  * this socket. This makes life simpler for TCP (UDP ?) where
436  * re-transmissions go out with the same policy. For symmetry, policy
437  * is cached for fully connected UDP sockets also. Thus if policy is cached,
438  * it also implies that policy is latched i.e policy cannot change
439  * on these sockets. As we have the right policy on the conn, we don't
440  * have to lookup global policy for every outbound and inbound datagram
441  * and thus serving as an optimization. Note that a global policy change
442  * does not affect fully connected sockets if they have policy. If fully
443  * connected sockets did not have any policy associated with it, global
444  * policy change may affect them.
445  *
446  * IP Flow control notes:
447  *
448  * Non-TCP streams are flow controlled by IP. On the send side, if the packet
449  * cannot be sent down to the driver by IP, because of a canput failure, IP
450  * does a putq on the conn_wq. This will cause ip_wsrv to run on the conn_wq.
451  * ip_wsrv in turn, inserts the conn in a list of conn's that need to be drained
452  * when the flowcontrol condition subsides. Ultimately STREAMS backenables the
453  * ip_wsrv on the IP module, which in turn does a qenable of the conn_wq of the
454  * first conn in the list of conn's to be drained. ip_wsrv on this conn drains
455  * the queued messages, and removes the conn from the drain list, if all
456  * messages were drained. It also qenables the next conn in the drain list to
457  * continue the drain process.
458  *
459  * In reality the drain list is not a single list, but a configurable number
460  * of lists. The ip_wsrv on the IP module, qenables the first conn in each
461  * list. If the ip_wsrv of the next qenabled conn does not run, because the
462  * stream closes, ip_close takes responsibility to qenable the next conn in
463  * the drain list. The directly called ip_wput path always does a putq, if
464  * it cannot putnext. Thus synchronization problems are handled between
465  * ip_wsrv and ip_close. conn_drain_insert and conn_drain_tail are the only
466  * functions that manipulate this drain list. Furthermore conn_drain_insert
467  * is called only from ip_wsrv, and there can be only 1 instance of ip_wsrv
468  * running on a queue at any time. conn_drain_tail can be simultaneously called
469  * from both ip_wsrv and ip_close.
470  *
471  * IPQOS notes:
472  *
473  * IPQoS Policies are applied to packets using IPPF (IP Policy framework)
474  * and IPQoS modules. IPPF includes hooks in IP at different control points
475  * (callout positions) which direct packets to IPQoS modules for policy
476  * processing. Policies, if present, are global.
477  *
478  * The callout positions are located in the following paths:
479  *		o local_in (packets destined for this host)
480  *		o local_out (packets orginating from this host )
481  *		o fwd_in  (packets forwarded by this m/c - inbound)
482  *		o fwd_out (packets forwarded by this m/c - outbound)
483  * Hooks at these callout points can be enabled/disabled using the ndd variable
484  * ip_policy_mask (a bit mask with the 4 LSB indicating the callout positions).
485  * By default all the callout positions are enabled.
486  *
487  * Outbound (local_out)
488  * Hooks are placed in ip_wput_ire and ipsec_out_process.
489  *
490  * Inbound (local_in)
491  * Hooks are placed in ip_proto_input, icmp_inbound, ip_fanout_proto and
492  * TCP and UDP fanout routines.
493  *
494  * Forwarding (in and out)
495  * Hooks are placed in ip_rput_forward and ip_mrtun_forward.
496  *
497  * IP Policy Framework processing (IPPF processing)
498  * Policy processing for a packet is initiated by ip_process, which ascertains
499  * that the classifier (ipgpc) is loaded and configured, failing which the
500  * packet resumes normal processing in IP. If the clasifier is present, the
501  * packet is acted upon by one or more IPQoS modules (action instances), per
502  * filters configured in ipgpc and resumes normal IP processing thereafter.
503  * An action instance can drop a packet in course of its processing.
504  *
505  * A boolean variable, ip_policy, is used in all the fanout routines that can
506  * invoke ip_process for a packet. This variable indicates if the packet should
507  * to be sent for policy processing. The variable is set to B_TRUE by default,
508  * i.e. when the routines are invoked in the normal ip procesing path for a
509  * packet. The two exceptions being ip_wput_local and icmp_inbound_error_fanout;
510  * ip_policy is set to B_FALSE for all the routines called in these two
511  * functions because, in the former case,  we don't process loopback traffic
512  * currently while in the latter, the packets have already been processed in
513  * icmp_inbound.
514  *
515  * Zones notes:
516  *
517  * The partitioning rules for networking are as follows:
518  * 1) Packets coming from a zone must have a source address belonging to that
519  * zone.
520  * 2) Packets coming from a zone can only be sent on a physical interface on
521  * which the zone has an IP address.
522  * 3) Between two zones on the same machine, packet delivery is only allowed if
523  * there's a matching route for the destination and zone in the forwarding
524  * table.
525  * 4) The TCP and UDP port spaces are per-zone; that is, two processes in
526  * different zones can bind to the same port with the wildcard address
527  * (INADDR_ANY).
528  *
529  * The granularity of interface partitioning is at the logical interface level.
530  * Therefore, every zone has its own IP addresses, and incoming packets can be
531  * attributed to a zone unambiguously. A logical interface is placed into a zone
532  * using the SIOCSLIFZONE ioctl; this sets the ipif_zoneid field in the ipif_t
533  * structure. Rule (1) is implemented by modifying the source address selection
534  * algorithm so that the list of eligible addresses is filtered based on the
535  * sending process zone.
536  *
537  * The Internet Routing Entries (IREs) are either exclusive to a zone or shared
538  * across all zones, depending on their type. Here is the break-up:
539  *
540  * IRE type				Shared/exclusive
541  * --------				----------------
542  * IRE_BROADCAST			Exclusive
543  * IRE_DEFAULT (default routes)		Shared (*)
544  * IRE_LOCAL				Exclusive
545  * IRE_LOOPBACK				Exclusive
546  * IRE_PREFIX (net routes)		Shared (*)
547  * IRE_CACHE				Exclusive
548  * IRE_IF_NORESOLVER (interface routes)	Exclusive
549  * IRE_IF_RESOLVER (interface routes)	Exclusive
550  * IRE_HOST (host routes)		Shared (*)
551  *
552  * (*) A zone can only use a default or off-subnet route if the gateway is
553  * directly reachable from the zone, that is, if the gateway's address matches
554  * one of the zone's logical interfaces.
555  *
556  * Multiple zones can share a common broadcast address; typically all zones
557  * share the 255.255.255.255 address. Incoming as well as locally originated
558  * broadcast packets must be dispatched to all the zones on the broadcast
559  * network. For directed broadcasts (e.g. 10.16.72.255) this is not trivial
560  * since some zones may not be on the 10.16.72/24 network. To handle this, each
561  * zone has its own set of IRE_BROADCAST entries; then, broadcast packets are
562  * sent to every zone that has an IRE_BROADCAST entry for the destination
563  * address on the input ill, see conn_wantpacket().
564  *
565  * Applications in different zones can join the same multicast group address.
566  * For IPv4, group memberships are per-logical interface, so they're already
567  * inherently part of a zone. For IPv6, group memberships are per-physical
568  * interface, so we distinguish IPv6 group memberships based on group address,
569  * interface and zoneid. In both cases, received multicast packets are sent to
570  * every zone for which a group membership entry exists. On IPv6 we need to
571  * check that the target zone still has an address on the receiving physical
572  * interface; it could have been removed since the application issued the
573  * IPV6_JOIN_GROUP.
574  */
575 
576 /*
577  * Squeue Fanout flags:
578  *	0: No fanout.
579  *	1: Fanout across all squeues
580  */
581 boolean_t	ip_squeue_fanout = 0;
582 
583 /*
584  * Maximum dups allowed per packet.
585  */
586 uint_t ip_max_frag_dups = 10;
587 
588 #define	IS_SIMPLE_IPH(ipha)						\
589 	((ipha)->ipha_version_and_hdr_length == IP_SIMPLE_HDR_VERSION)
590 
591 /* RFC1122 Conformance */
592 #define	IP_FORWARD_DEFAULT	IP_FORWARD_NEVER
593 
594 #ifdef	_BIG_ENDIAN
595 #define	IP_HDR_CSUM_TTL_ADJUST	256
596 #define	IP_TCP_CSUM_COMP	IPPROTO_TCP
597 #define	IP_UDP_CSUM_COMP	IPPROTO_UDP
598 #else
599 #define	IP_HDR_CSUM_TTL_ADJUST	1
600 #define	IP_TCP_CSUM_COMP	(IPPROTO_TCP << 8)
601 #define	IP_UDP_CSUM_COMP	(IPPROTO_UDP << 8)
602 #endif
603 
604 #define	TCP_CHECKSUM_OFFSET		16
605 #define	UDP_CHECKSUM_OFFSET		6
606 
607 #define	ILL_MAX_NAMELEN			LIFNAMSIZ
608 
609 #define	UDPH_SIZE	8
610 
611 /* Leave room for ip_newroute to tack on the src and target addresses */
612 #define	OK_RESOLVER_MP(mp)						\
613 	((mp) && ((mp)->b_wptr - (mp)->b_rptr) >= (2 * IP_ADDR_LEN))
614 
615 static ipif_t	*conn_get_held_ipif(conn_t *, ipif_t **, int *);
616 static int	conn_set_held_ipif(conn_t *, ipif_t **, ipif_t *);
617 
618 static mblk_t	*ip_wput_attach_llhdr(mblk_t *, ire_t *, ip_proc_t, uint32_t);
619 static void	ip_ipsec_out_prepend(mblk_t *, mblk_t *, ill_t *);
620 
621 static void	icmp_frag_needed(queue_t *, mblk_t *, int);
622 static void	icmp_inbound(queue_t *, mblk_t *, boolean_t, ill_t *, int,
623     uint32_t, boolean_t, boolean_t, ill_t *, zoneid_t);
624 static boolean_t icmp_inbound_too_big(icmph_t *, ipha_t *);
625 static void	icmp_inbound_error_fanout(queue_t *, ill_t *, mblk_t *,
626 		    icmph_t *, ipha_t *, int, int, boolean_t, boolean_t,
627 		    ill_t *, zoneid_t);
628 static void	icmp_options_update(ipha_t *);
629 static void	icmp_param_problem(queue_t *, mblk_t *, uint8_t);
630 static void	icmp_pkt(queue_t *, mblk_t *, void *, size_t, boolean_t);
631 static mblk_t	*icmp_pkt_err_ok(mblk_t *);
632 static void	icmp_redirect(mblk_t *);
633 static void	icmp_send_redirect(queue_t *, mblk_t *, ipaddr_t);
634 
635 static void	ip_arp_news(queue_t *, mblk_t *);
636 static boolean_t ip_bind_insert_ire(mblk_t *, ire_t *, iulp_t *);
637 mblk_t		*ip_dlpi_alloc(size_t, t_uscalar_t);
638 char		*ip_dot_addr(ipaddr_t, char *);
639 mblk_t		*ip_carve_mp(mblk_t **, ssize_t);
640 int		ip_close(queue_t *, int);
641 static char	*ip_dot_saddr(uchar_t *, char *);
642 static void	ip_fanout_proto(queue_t *, mblk_t *, ill_t *, ipha_t *, uint_t,
643 		    boolean_t, boolean_t, ill_t *, zoneid_t);
644 static void	ip_fanout_tcp(queue_t *, mblk_t *, ill_t *, ipha_t *, uint_t,
645 		    boolean_t, boolean_t, zoneid_t);
646 static void	ip_fanout_udp(queue_t *, mblk_t *, ill_t *, ipha_t *, uint32_t,
647 		    boolean_t, uint_t, boolean_t, boolean_t, ill_t *, zoneid_t);
648 static void	ip_lrput(queue_t *, mblk_t *);
649 ipaddr_t	ip_massage_options(ipha_t *);
650 static void	ip_mrtun_forward(ire_t *, ill_t *, mblk_t *);
651 ipaddr_t	ip_net_mask(ipaddr_t);
652 void		ip_newroute(queue_t *, mblk_t *, ipaddr_t, ill_t *, conn_t *);
653 static void	ip_newroute_ipif(queue_t *, mblk_t *, ipif_t *, ipaddr_t,
654 		    conn_t *, uint32_t);
655 static int	ip_hdr_complete(ipha_t *, zoneid_t);
656 char		*ip_nv_lookup(nv_t *, int);
657 static boolean_t	ip_check_for_ipsec_opt(queue_t *, mblk_t *);
658 static int	ip_param_get(queue_t *, mblk_t *, caddr_t, cred_t *);
659 static int	ip_param_generic_get(queue_t *, mblk_t *, caddr_t, cred_t *);
660 static boolean_t	ip_param_register(ipparam_t *, size_t, ipndp_t *,
661 			    size_t);
662 static int	ip_param_set(queue_t *, mblk_t *, char *, caddr_t, cred_t *);
663 void	ip_rput(queue_t *, mblk_t *);
664 static void	ip_rput_dlpi_writer(ipsq_t *dummy_sq, queue_t *q, mblk_t *mp,
665 		    void *dummy_arg);
666 void	ip_rput_forward(ire_t *, ipha_t *, mblk_t *, ill_t *);
667 static int	ip_rput_forward_options(mblk_t *, ipha_t *, ire_t *);
668 static boolean_t	ip_rput_local_options(queue_t *, mblk_t *, ipha_t *,
669 			    ire_t *);
670 static int	ip_rput_options(queue_t *, mblk_t *, ipha_t *, ipaddr_t *);
671 int		ip_snmp_get(queue_t *, mblk_t *);
672 static mblk_t	*ip_snmp_get_mib2_ip(queue_t *, mblk_t *);
673 static mblk_t	*ip_snmp_get_mib2_ip6(queue_t *, mblk_t *);
674 static mblk_t	*ip_snmp_get_mib2_icmp(queue_t *, mblk_t *);
675 static mblk_t	*ip_snmp_get_mib2_icmp6(queue_t *, mblk_t *);
676 static mblk_t	*ip_snmp_get_mib2_igmp(queue_t *, mblk_t *);
677 static mblk_t	*ip_snmp_get_mib2_multi(queue_t *, mblk_t *);
678 static mblk_t	*ip_snmp_get_mib2_ip_addr(queue_t *, mblk_t *);
679 static mblk_t	*ip_snmp_get_mib2_ip6_addr(queue_t *, mblk_t *);
680 static mblk_t	*ip_snmp_get_mib2_ip_group_mem(queue_t *, mblk_t *);
681 static mblk_t	*ip_snmp_get_mib2_ip6_group_mem(queue_t *, mblk_t *);
682 static mblk_t	*ip_snmp_get_mib2_ip_group_src(queue_t *, mblk_t *);
683 static mblk_t	*ip_snmp_get_mib2_ip6_group_src(queue_t *, mblk_t *);
684 static mblk_t	*ip_snmp_get_mib2_virt_multi(queue_t *, mblk_t *);
685 static mblk_t	*ip_snmp_get_mib2_multi_rtable(queue_t *, mblk_t *);
686 static mblk_t	*ip_snmp_get_mib2_ip_route_media(queue_t *, mblk_t *);
687 static mblk_t	*ip_snmp_get_mib2_ip6_route_media(queue_t *, mblk_t *);
688 static void	ip_snmp_get2_v4(ire_t *, listptr_t []);
689 static void	ip_snmp_get2_v6_route(ire_t *, listptr_t *);
690 static int	ip_snmp_get2_v6_media(nce_t *, listptr_t *);
691 int		ip_snmp_set(queue_t *, int, int, uchar_t *, int);
692 static boolean_t	ip_source_routed(ipha_t *);
693 static boolean_t	ip_source_route_included(ipha_t *);
694 
695 static void	ip_unbind(queue_t *, mblk_t *);
696 static void	ip_wput_frag(ire_t *, mblk_t *, ip_pkt_t, uint32_t, uint32_t);
697 static mblk_t	*ip_wput_frag_copyhdr(uchar_t *, int, int);
698 static void	ip_wput_local_options(ipha_t *);
699 static int	ip_wput_options(queue_t *, mblk_t *, ipha_t *, boolean_t,
700     zoneid_t);
701 
702 static void	conn_drain_init(void);
703 static void	conn_drain_fini(void);
704 static void	conn_drain_tail(conn_t *connp, boolean_t closing);
705 
706 static void	conn_walk_drain(void);
707 static void	conn_walk_fanout_table(connf_t *, uint_t, pfv_t, void *,
708     zoneid_t);
709 
710 static boolean_t	conn_wantpacket(conn_t *, ill_t *, ipha_t *, int,
711     zoneid_t);
712 static void	ip_arp_done(ipsq_t *dummy_sq, queue_t *q, mblk_t *mp,
713     void *dummy_arg);
714 
715 static int	ip_forward_set(queue_t *, mblk_t *, char *, caddr_t, cred_t *);
716 
717 static int	ip_multirt_apply_membership(int (*fn)(conn_t *, boolean_t,
718     ipaddr_t, ipaddr_t, uint_t *, mcast_record_t, ipaddr_t, mblk_t *), ire_t *,
719     conn_t *, boolean_t, ipaddr_t, mcast_record_t, ipaddr_t, mblk_t *);
720 static void	ip_multirt_bad_mtu(ire_t *, uint32_t);
721 
722 static int	ip_cgtp_filter_get(queue_t *, mblk_t *, caddr_t, cred_t *);
723 static int	ip_cgtp_filter_set(queue_t *, mblk_t *, char *,
724     caddr_t, cred_t *);
725 extern int	ip_squeue_bind_set(queue_t *q, mblk_t *mp, char *value,
726     caddr_t cp, cred_t *cr);
727 extern int	ip_squeue_profile_set(queue_t *, mblk_t *, char *, caddr_t,
728     cred_t *);
729 static int	ip_input_proc_set(queue_t *q, mblk_t *mp, char *value,
730     caddr_t cp, cred_t *cr);
731 static int	ip_fanout_set(queue_t *, mblk_t *, char *, caddr_t,
732     cred_t *);
733 static squeue_func_t ip_squeue_switch(int);
734 
735 static void	ip_kstat_init(void);
736 static void	ip_kstat_fini(void);
737 static int	ip_kstat_update(kstat_t *kp, int rw);
738 static void	icmp_kstat_init(void);
739 static void	icmp_kstat_fini(void);
740 static int	icmp_kstat_update(kstat_t *kp, int rw);
741 
742 static int	ip_conn_report(queue_t *, mblk_t *, caddr_t, cred_t *);
743 
744 static boolean_t	ip_no_forward(ipha_t *, ill_t *);
745 static boolean_t	ip_loopback_src_or_dst(ipha_t *, ill_t *);
746 
747 static mblk_t	*ip_tcp_input(mblk_t *, ipha_t *, ill_t *, boolean_t,
748     ire_t *, mblk_t *, uint_t, queue_t *, ill_rx_ring_t *);
749 
750 void	ip_input(ill_t *, ill_rx_ring_t *, mblk_t *, size_t);
751 
752 timeout_id_t ip_ire_expire_id;	/* IRE expiration timer. */
753 static clock_t ip_ire_arp_time_elapsed; /* Time since IRE cache last flushed */
754 static clock_t ip_ire_rd_time_elapsed;	/* ... redirect IREs last flushed */
755 static clock_t ip_ire_pmtu_time_elapsed; /* Time since path mtu increase */
756 
757 uint_t	ip_ire_default_count;	/* Number of IPv4 IRE_DEFAULT entries. */
758 uint_t	ip_ire_default_index;	/* Walking index used to mod in */
759 
760 ipaddr_t	ip_g_all_ones = IP_HOST_MASK;
761 clock_t icmp_pkt_err_last = 0;	/* Time since last icmp_pkt_err */
762 uint_t	icmp_pkt_err_sent = 0;	/* Number of packets sent in burst */
763 
764 /* How long, in seconds, we allow frags to hang around. */
765 #define	IP_FRAG_TIMEOUT	60
766 
767 time_t	ip_g_frag_timeout = IP_FRAG_TIMEOUT;
768 clock_t	ip_g_frag_timo_ms = IP_FRAG_TIMEOUT * 1000;
769 
770 /* Protected by ip_mi_lock */
771 static void	*ip_g_head;		/* Instance Data List Head */
772 kmutex_t	ip_mi_lock;		/* Lock for list of instances */
773 
774 /* Only modified during _init and _fini thus no locking is needed. */
775 caddr_t		ip_g_nd;		/* Named Dispatch List Head */
776 
777 
778 static long ip_rput_pullups;
779 int	dohwcksum = 1;	/* use h/w cksum if supported by the hardware */
780 
781 vmem_t *ip_minor_arena;
782 
783 /*
784  * MIB-2 stuff for SNMP (both IP and ICMP)
785  */
786 mib2_ip_t	ip_mib;
787 mib2_icmp_t	icmp_mib;
788 
789 #ifdef DEBUG
790 uint32_t ipsechw_debug = 0;
791 #endif
792 
793 kstat_t		*ip_mibkp;	/* kstat exporting ip_mib data */
794 kstat_t		*icmp_mibkp;	/* kstat exporting icmp_mib data */
795 
796 uint_t	loopback_packets = 0;
797 
798 /*
799  * Multirouting/CGTP stuff
800  */
801 cgtp_filter_ops_t	*ip_cgtp_filter_ops;	/* CGTP hooks */
802 int	ip_cgtp_filter_rev = CGTP_FILTER_REV;	/* CGTP hooks version */
803 boolean_t	ip_cgtp_filter;		/* Enable/disable CGTP hooks */
804 /* Interval (in ms) between consecutive 'bad MTU' warnings */
805 hrtime_t ip_multirt_log_interval = 1000;
806 /* Time since last warning issued. */
807 static hrtime_t	multirt_bad_mtu_last_time = 0;
808 
809 kmutex_t ip_trash_timer_lock;
810 krwlock_t ip_g_nd_lock;
811 
812 /*
813  * XXX following really should only be in a header. Would need more
814  * header and .c clean up first.
815  */
816 extern optdb_obj_t	ip_opt_obj;
817 
818 ulong_t ip_squeue_enter_unbound = 0;
819 
820 /*
821  * Named Dispatch Parameter Table.
822  * All of these are alterable, within the min/max values given, at run time.
823  */
824 static ipparam_t	lcl_param_arr[] = {
825 	/* min	max	value	name */
826 	{  0,	1,	0,	"ip_respond_to_address_mask_broadcast"},
827 	{  0,	1,	1,	"ip_respond_to_echo_broadcast"},
828 	{  0,	1,	1,	"ip_respond_to_echo_multicast"},
829 	{  0,	1,	0,	"ip_respond_to_timestamp"},
830 	{  0,	1,	0,	"ip_respond_to_timestamp_broadcast"},
831 	{  0,	1,	1,	"ip_send_redirects"},
832 	{  0,	1,	0,	"ip_forward_directed_broadcasts"},
833 	{  0,	10,	0,	"ip_debug"},
834 	{  0,	10,	0,	"ip_mrtdebug"},
835 	{  5000, 999999999,	60000, "ip_ire_timer_interval" },
836 	{  60000, 999999999,	1200000, "ip_ire_arp_interval" },
837 	{  60000, 999999999,	60000, "ip_ire_redirect_interval" },
838 	{  1,	255,	255,	"ip_def_ttl" },
839 	{  0,	1,	0,	"ip_forward_src_routed"},
840 	{  0,	256,	32,	"ip_wroff_extra" },
841 	{  5000, 999999999, 600000, "ip_ire_pathmtu_interval" },
842 	{  8,	65536,  64,	"ip_icmp_return_data_bytes" },
843 	{  0,	1,	1,	"ip_path_mtu_discovery" },
844 	{  0,	240,	30,	"ip_ignore_delete_time" },
845 	{  0,	1,	0,	"ip_ignore_redirect" },
846 	{  0,	1,	1,	"ip_output_queue" },
847 	{  1,	254,	1,	"ip_broadcast_ttl" },
848 	{  0,	99999,	100,	"ip_icmp_err_interval" },
849 	{  1,	99999,	10,	"ip_icmp_err_burst" },
850 	{  0,	999999999,	1000000, "ip_reass_queue_bytes" },
851 	{  0,	1,	0,	"ip_strict_dst_multihoming" },
852 	{  1,	MAX_ADDRS_PER_IF,	256,	"ip_addrs_per_if"},
853 	{  0,	1,	0,	"ipsec_override_persocket_policy" },
854 	{  0,	1,	1,	"icmp_accept_clear_messages" },
855 	{  0,	1,	1,	"igmp_accept_clear_messages" },
856 	{  2,	999999999, ND_DELAY_FIRST_PROBE_TIME,
857 				"ip_ndp_delay_first_probe_time"},
858 	{  1,	999999999, ND_MAX_UNICAST_SOLICIT,
859 				"ip_ndp_max_unicast_solicit"},
860 	{  1,	255,	IPV6_MAX_HOPS,	"ip6_def_hops" },
861 	{  8,	IPV6_MIN_MTU,	IPV6_MIN_MTU, "ip6_icmp_return_data_bytes" },
862 	{  0,	1,	0,	"ip6_forward_src_routed"},
863 	{  0,	1,	1,	"ip6_respond_to_echo_multicast"},
864 	{  0,	1,	1,	"ip6_send_redirects"},
865 	{  0,	1,	0,	"ip6_ignore_redirect" },
866 	{  0,	1,	0,	"ip6_strict_dst_multihoming" },
867 
868 	{  1,	8,	3,	"ip_ire_reclaim_fraction" },
869 
870 	{  0,	999999,	1000,	"ipsec_policy_log_interval" },
871 
872 	{  0,	1,	1,	"pim_accept_clear_messages" },
873 	{  1000, 20000,	2000,	"ip_ndp_unsolicit_interval" },
874 	{  1,	20,	3,	"ip_ndp_unsolicit_count" },
875 	{  0,	1,	1,	"ip6_ignore_home_address_opt" },
876 	{  0,	15,	0,	"ip_policy_mask" },
877 	{  1000, 60000, 1000,	"ip_multirt_resolution_interval" },
878 	{  0,	255,	1,	"ip_multirt_ttl" },
879 	{  0,	1,	1,	"ip_multidata_outbound" },
880 #ifdef DEBUG
881 	{  0,	1,	0,	"ip6_drop_inbound_icmpv6" },
882 #endif
883 };
884 
885 ipparam_t	*ip_param_arr = lcl_param_arr;
886 
887 /* Extended NDP table */
888 static ipndp_t	lcl_ndp_arr[] = {
889 	/* getf			setf		data			name */
890 	{  ip_param_generic_get,	ip_forward_set,	(caddr_t)&ip_g_forward,
891 	    "ip_forwarding" },
892 	{  ip_param_generic_get,	ip_forward_set,	(caddr_t)&ipv6_forward,
893 	    "ip6_forwarding" },
894 	{  ip_ill_report,	NULL,		NULL,
895 	    "ip_ill_status" },
896 	{  ip_ipif_report,	NULL,		NULL,
897 	    "ip_ipif_status" },
898 	{  ip_ire_report,	NULL,		NULL,
899 	    "ipv4_ire_status" },
900 	{  ip_ire_report_mrtun,	NULL,		NULL,
901 	    "ipv4_mrtun_ire_status" },
902 	{  ip_ire_report_srcif,	NULL,		NULL,
903 	    "ipv4_srcif_ire_status" },
904 	{  ip_ire_report_v6,	NULL,		NULL,
905 	    "ipv6_ire_status" },
906 	{  ip_conn_report,	NULL,		NULL,
907 	    "ip_conn_status" },
908 	{  nd_get_long,		nd_set_long,	(caddr_t)&ip_rput_pullups,
909 	    "ip_rput_pullups" },
910 	{  ndp_report,		NULL,		NULL,
911 	    "ip_ndp_cache_report" },
912 	{  ip_srcid_report,	NULL,		NULL,
913 	    "ip_srcid_status" },
914 	{ ip_param_generic_get, ip_squeue_profile_set,
915 	    (caddr_t)&ip_squeue_profile, "ip_squeue_profile" },
916 	{ ip_param_generic_get, ip_squeue_bind_set,
917 	    (caddr_t)&ip_squeue_bind, "ip_squeue_bind" },
918 	{ ip_param_generic_get, ip_input_proc_set,
919 	    (caddr_t)&ip_squeue_enter, "ip_squeue_enter" },
920 	{ ip_param_generic_get, ip_fanout_set,
921 	    (caddr_t)&ip_squeue_fanout, "ip_squeue_fanout" },
922 	{  ip_cgtp_filter_get,	ip_cgtp_filter_set, (caddr_t)&ip_cgtp_filter,
923 	    "ip_cgtp_filter" }
924 };
925 
926 /*
927  * ip_g_forward controls IP forwarding.  It takes two values:
928  *	0: IP_FORWARD_NEVER	Don't forward packets ever.
929  *	1: IP_FORWARD_ALWAYS	Forward packets for elsewhere.
930  *
931  * RFC1122 says there must be a configuration switch to control forwarding,
932  * but that the default MUST be to not forward packets ever.  Implicit
933  * control based on configuration of multiple interfaces MUST NOT be
934  * implemented (Section 3.1).  SunOS 4.1 did provide the "automatic" capability
935  * and, in fact, it was the default.  That capability is now provided in the
936  * /etc/rc2.d/S69inet script.
937  */
938 int ip_g_forward = IP_FORWARD_DEFAULT;
939 
940 /* It also has an IPv6 counterpart. */
941 
942 int ipv6_forward = IP_FORWARD_DEFAULT;
943 
944 /* Following line is external, and in ip.h.  Normally marked with * *. */
945 #define	ip_respond_to_address_mask_broadcast ip_param_arr[0].ip_param_value
946 #define	ip_g_resp_to_echo_bcast		ip_param_arr[1].ip_param_value
947 #define	ip_g_resp_to_echo_mcast		ip_param_arr[2].ip_param_value
948 #define	ip_g_resp_to_timestamp		ip_param_arr[3].ip_param_value
949 #define	ip_g_resp_to_timestamp_bcast	ip_param_arr[4].ip_param_value
950 #define	ip_g_send_redirects		ip_param_arr[5].ip_param_value
951 #define	ip_g_forward_directed_bcast	ip_param_arr[6].ip_param_value
952 #define	ip_debug			ip_param_arr[7].ip_param_value	/* */
953 #define	ip_mrtdebug			ip_param_arr[8].ip_param_value	/* */
954 #define	ip_timer_interval		ip_param_arr[9].ip_param_value	/* */
955 #define	ip_ire_arp_interval		ip_param_arr[10].ip_param_value  /* */
956 #define	ip_ire_redir_interval		ip_param_arr[11].ip_param_value
957 #define	ip_def_ttl			ip_param_arr[12].ip_param_value
958 #define	ip_forward_src_routed		ip_param_arr[13].ip_param_value
959 #define	ip_wroff_extra			ip_param_arr[14].ip_param_value
960 #define	ip_ire_pathmtu_interval		ip_param_arr[15].ip_param_value
961 #define	ip_icmp_return			ip_param_arr[16].ip_param_value
962 #define	ip_path_mtu_discovery		ip_param_arr[17].ip_param_value /* */
963 #define	ip_ignore_delete_time		ip_param_arr[18].ip_param_value /* */
964 #define	ip_ignore_redirect		ip_param_arr[19].ip_param_value
965 #define	ip_output_queue			ip_param_arr[20].ip_param_value
966 #define	ip_broadcast_ttl		ip_param_arr[21].ip_param_value
967 #define	ip_icmp_err_interval		ip_param_arr[22].ip_param_value
968 #define	ip_icmp_err_burst		ip_param_arr[23].ip_param_value
969 #define	ip_reass_queue_bytes		ip_param_arr[24].ip_param_value
970 #define	ip_strict_dst_multihoming	ip_param_arr[25].ip_param_value
971 #define	ip_addrs_per_if			ip_param_arr[26].ip_param_value
972 #define	ipsec_override_persocket_policy	ip_param_arr[27].ip_param_value /* */
973 #define	icmp_accept_clear_messages	ip_param_arr[28].ip_param_value
974 #define	igmp_accept_clear_messages	ip_param_arr[29].ip_param_value
975 
976 /* IPv6 configuration knobs */
977 #define	delay_first_probe_time		ip_param_arr[30].ip_param_value
978 #define	max_unicast_solicit		ip_param_arr[31].ip_param_value
979 #define	ipv6_def_hops			ip_param_arr[32].ip_param_value
980 #define	ipv6_icmp_return		ip_param_arr[33].ip_param_value
981 #define	ipv6_forward_src_routed		ip_param_arr[34].ip_param_value
982 #define	ipv6_resp_echo_mcast		ip_param_arr[35].ip_param_value
983 #define	ipv6_send_redirects		ip_param_arr[36].ip_param_value
984 #define	ipv6_ignore_redirect		ip_param_arr[37].ip_param_value
985 #define	ipv6_strict_dst_multihoming	ip_param_arr[38].ip_param_value
986 #define	ip_ire_reclaim_fraction		ip_param_arr[39].ip_param_value
987 #define	ipsec_policy_log_interval	ip_param_arr[40].ip_param_value
988 #define	pim_accept_clear_messages	ip_param_arr[41].ip_param_value
989 #define	ip_ndp_unsolicit_interval	ip_param_arr[42].ip_param_value
990 #define	ip_ndp_unsolicit_count		ip_param_arr[43].ip_param_value
991 #define	ipv6_ignore_home_address_opt	ip_param_arr[44].ip_param_value
992 #define	ip_policy_mask			ip_param_arr[45].ip_param_value
993 #define	ip_multirt_resolution_interval  ip_param_arr[46].ip_param_value
994 #define	ip_multirt_ttl  		ip_param_arr[47].ip_param_value
995 #define	ip_multidata_outbound		ip_param_arr[48].ip_param_value
996 #ifdef DEBUG
997 #define	ipv6_drop_inbound_icmpv6	ip_param_arr[49].ip_param_value
998 #else
999 #define	ipv6_drop_inbound_icmpv6	0
1000 #endif
1001 
1002 
1003 /*
1004  * Table of IP ioctls encoding the various properties of the ioctl and
1005  * indexed based on the last byte of the ioctl command. Occasionally there
1006  * is a clash, and there is more than 1 ioctl with the same last byte.
1007  * In such a case 1 ioctl is encoded in the ndx table and the remaining
1008  * ioctls are encoded in the misc table. An entry in the ndx table is
1009  * retrieved by indexing on the last byte of the ioctl command and comparing
1010  * the ioctl command with the value in the ndx table. In the event of a
1011  * mismatch the misc table is then searched sequentially for the desired
1012  * ioctl command.
1013  *
1014  * Entry: <command> <copyin_size> <flags> <cmd_type> <function> <restart_func>
1015  */
1016 ip_ioctl_cmd_t ip_ndx_ioctl_table[] = {
1017 	/* 000 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1018 	/* 001 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1019 	/* 002 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1020 	/* 003 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1021 	/* 004 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1022 	/* 005 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1023 	/* 006 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1024 	/* 007 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1025 	/* 008 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1026 	/* 009 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1027 
1028 	/* 010 */ { SIOCADDRT,	sizeof (struct rtentry), IPI_PRIV,
1029 			MISC_CMD, ip_siocaddrt, NULL },
1030 	/* 011 */ { SIOCDELRT,	sizeof (struct rtentry), IPI_PRIV,
1031 			MISC_CMD, ip_siocdelrt, NULL },
1032 
1033 	/* 012 */ { SIOCSIFADDR, sizeof (struct ifreq), IPI_PRIV | IPI_WR,
1034 			IF_CMD, ip_sioctl_addr, ip_sioctl_addr_restart },
1035 	/* 013 */ { SIOCGIFADDR, sizeof (struct ifreq), IPI_GET_CMD | IPI_REPL,
1036 			IF_CMD, ip_sioctl_get_addr, NULL },
1037 
1038 	/* 014 */ { SIOCSIFDSTADDR, sizeof (struct ifreq), IPI_PRIV | IPI_WR,
1039 			IF_CMD, ip_sioctl_dstaddr, ip_sioctl_dstaddr_restart },
1040 	/* 015 */ { SIOCGIFDSTADDR, sizeof (struct ifreq),
1041 			IPI_GET_CMD | IPI_REPL,
1042 			IF_CMD, ip_sioctl_get_dstaddr, NULL },
1043 
1044 	/* 016 */ { SIOCSIFFLAGS, sizeof (struct ifreq),
1045 			IPI_PRIV | IPI_WR | IPI_REPL,
1046 			IF_CMD, ip_sioctl_flags, ip_sioctl_flags_restart },
1047 	/* 017 */ { SIOCGIFFLAGS, sizeof (struct ifreq),
1048 			IPI_MODOK | IPI_GET_CMD | IPI_REPL,
1049 			IF_CMD, ip_sioctl_get_flags, NULL },
1050 
1051 	/* 018 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1052 	/* 019 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1053 
1054 	/* copyin size cannot be coded for SIOCGIFCONF */
1055 	/* 020 */ { O_SIOCGIFCONF, 0, IPI_GET_CMD | IPI_REPL,
1056 			MISC_CMD, ip_sioctl_get_ifconf, NULL },
1057 
1058 	/* 021 */ { SIOCSIFMTU,	sizeof (struct ifreq), IPI_PRIV | IPI_WR,
1059 			IF_CMD, ip_sioctl_mtu, NULL },
1060 	/* 022 */ { SIOCGIFMTU,	sizeof (struct ifreq), IPI_GET_CMD | IPI_REPL,
1061 			IF_CMD, ip_sioctl_get_mtu, NULL },
1062 	/* 023 */ { SIOCGIFBRDADDR, sizeof (struct ifreq),
1063 			IPI_GET_CMD | IPI_REPL,
1064 			IF_CMD, ip_sioctl_get_brdaddr, NULL },
1065 	/* 024 */ { SIOCSIFBRDADDR, sizeof (struct ifreq), IPI_PRIV | IPI_WR,
1066 			IF_CMD, ip_sioctl_brdaddr, NULL },
1067 	/* 025 */ { SIOCGIFNETMASK, sizeof (struct ifreq),
1068 			IPI_GET_CMD | IPI_REPL,
1069 			IF_CMD, ip_sioctl_get_netmask, NULL },
1070 	/* 026 */ { SIOCSIFNETMASK, sizeof (struct ifreq), IPI_PRIV | IPI_WR,
1071 			IF_CMD, ip_sioctl_netmask, ip_sioctl_netmask_restart },
1072 	/* 027 */ { SIOCGIFMETRIC, sizeof (struct ifreq),
1073 			IPI_GET_CMD | IPI_REPL,
1074 			IF_CMD, ip_sioctl_get_metric, NULL },
1075 	/* 028 */ { SIOCSIFMETRIC, sizeof (struct ifreq), IPI_PRIV,
1076 			IF_CMD, ip_sioctl_metric, NULL },
1077 	/* 029 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1078 
1079 	/* See 166-168 below for extended SIOC*XARP ioctls */
1080 	/* 030 */ { SIOCSARP, sizeof (struct arpreq), IPI_PRIV,
1081 			MISC_CMD, ip_sioctl_arp, NULL },
1082 	/* 031 */ { SIOCGARP, sizeof (struct arpreq), IPI_GET_CMD | IPI_REPL,
1083 			MISC_CMD, ip_sioctl_arp, NULL },
1084 	/* 032 */ { SIOCDARP, sizeof (struct arpreq), IPI_PRIV,
1085 			MISC_CMD, ip_sioctl_arp, NULL },
1086 
1087 	/* 033 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1088 	/* 034 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1089 	/* 035 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1090 	/* 036 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1091 	/* 037 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1092 	/* 038 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1093 	/* 039 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1094 	/* 040 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1095 	/* 041 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1096 	/* 042 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1097 	/* 043 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1098 	/* 044 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1099 	/* 045 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1100 	/* 046 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1101 	/* 047 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1102 	/* 048 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1103 	/* 049 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1104 	/* 050 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1105 	/* 051 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1106 	/* 052 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1107 	/* 053 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1108 
1109 	/* 054 */ { IF_UNITSEL,	sizeof (int), IPI_PRIV | IPI_WR | IPI_MODOK,
1110 			MISC_CMD, if_unitsel, if_unitsel_restart },
1111 
1112 	/* 055 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1113 	/* 056 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1114 	/* 057 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1115 	/* 058 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1116 	/* 059 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1117 	/* 060 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1118 	/* 061 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1119 	/* 062 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1120 	/* 063 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1121 	/* 064 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1122 	/* 065 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1123 	/* 066 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1124 	/* 067 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1125 	/* 068 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1126 	/* 069 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1127 	/* 070 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1128 	/* 071 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1129 	/* 072 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1130 
1131 	/* 073 */ { SIOCSIFNAME, sizeof (struct ifreq),
1132 			IPI_PRIV | IPI_WR | IPI_MODOK,
1133 			IF_CMD, ip_sioctl_sifname, NULL },
1134 
1135 	/* 074 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1136 	/* 075 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1137 	/* 076 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1138 	/* 077 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1139 	/* 078 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1140 	/* 079 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1141 	/* 080 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1142 	/* 081 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1143 	/* 082 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1144 	/* 083 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1145 	/* 084 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1146 	/* 085 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1147 	/* 086 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1148 
1149 	/* 087 */ { SIOCGIFNUM, sizeof (int), IPI_GET_CMD | IPI_REPL,
1150 			MISC_CMD, ip_sioctl_get_ifnum, NULL },
1151 	/* 088 */ { SIOCGIFMUXID, sizeof (struct ifreq), IPI_GET_CMD | IPI_REPL,
1152 			IF_CMD, ip_sioctl_get_muxid, NULL },
1153 	/* 089 */ { SIOCSIFMUXID, sizeof (struct ifreq),
1154 			IPI_PRIV | IPI_WR | IPI_REPL,
1155 			IF_CMD, ip_sioctl_muxid, NULL },
1156 
1157 	/* Both if and lif variants share same func */
1158 	/* 090 */ { SIOCGIFINDEX, sizeof (struct ifreq), IPI_GET_CMD | IPI_REPL,
1159 			IF_CMD, ip_sioctl_get_lifindex, NULL },
1160 	/* Both if and lif variants share same func */
1161 	/* 091 */ { SIOCSIFINDEX, sizeof (struct ifreq),
1162 			IPI_PRIV | IPI_WR | IPI_REPL,
1163 			IF_CMD, ip_sioctl_slifindex, NULL },
1164 
1165 	/* copyin size cannot be coded for SIOCGIFCONF */
1166 	/* 092 */ { SIOCGIFCONF, 0, IPI_GET_CMD | IPI_REPL,
1167 			MISC_CMD, ip_sioctl_get_ifconf, NULL },
1168 	/* 093 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1169 	/* 094 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1170 	/* 095 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1171 	/* 096 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1172 	/* 097 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1173 	/* 098 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1174 	/* 099 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1175 	/* 100 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1176 	/* 101 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1177 	/* 102 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1178 	/* 103 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1179 	/* 104 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1180 	/* 105 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1181 	/* 106 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1182 	/* 107 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1183 	/* 108 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1184 	/* 109 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1185 
1186 	/* 110 */ { SIOCLIFREMOVEIF, sizeof (struct lifreq),
1187 			IPI_PRIV | IPI_WR | IPI_REPL,
1188 			LIF_CMD, ip_sioctl_removeif,
1189 			ip_sioctl_removeif_restart },
1190 	/* 111 */ { SIOCLIFADDIF, sizeof (struct lifreq),
1191 			IPI_GET_CMD | IPI_PRIV | IPI_WR | IPI_REPL,
1192 			LIF_CMD, ip_sioctl_addif, NULL },
1193 #define	SIOCLIFADDR_NDX 112
1194 	/* 112 */ { SIOCSLIFADDR, sizeof (struct lifreq), IPI_PRIV | IPI_WR,
1195 			LIF_CMD, ip_sioctl_addr, ip_sioctl_addr_restart },
1196 	/* 113 */ { SIOCGLIFADDR, sizeof (struct lifreq),
1197 			IPI_GET_CMD | IPI_REPL,
1198 			LIF_CMD, ip_sioctl_get_addr, NULL },
1199 	/* 114 */ { SIOCSLIFDSTADDR, sizeof (struct lifreq), IPI_PRIV | IPI_WR,
1200 			LIF_CMD, ip_sioctl_dstaddr, ip_sioctl_dstaddr_restart },
1201 	/* 115 */ { SIOCGLIFDSTADDR, sizeof (struct lifreq),
1202 			IPI_GET_CMD | IPI_REPL,
1203 			LIF_CMD, ip_sioctl_get_dstaddr, NULL },
1204 	/* 116 */ { SIOCSLIFFLAGS, sizeof (struct lifreq),
1205 			IPI_PRIV | IPI_WR | IPI_REPL,
1206 			LIF_CMD, ip_sioctl_flags, ip_sioctl_flags_restart },
1207 	/* 117 */ { SIOCGLIFFLAGS, sizeof (struct lifreq),
1208 			IPI_GET_CMD | IPI_MODOK | IPI_REPL,
1209 			LIF_CMD, ip_sioctl_get_flags, NULL },
1210 
1211 	/* 118 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1212 	/* 119 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1213 
1214 	/* 120 */ { O_SIOCGLIFCONF, 0, IPI_GET_CMD, MISC_CMD | IPI_REPL,
1215 			ip_sioctl_get_lifconf, NULL },
1216 	/* 121 */ { SIOCSLIFMTU, sizeof (struct lifreq), IPI_PRIV | IPI_WR,
1217 			LIF_CMD, ip_sioctl_mtu, NULL },
1218 	/* 122 */ { SIOCGLIFMTU, sizeof (struct lifreq), IPI_GET_CMD | IPI_REPL,
1219 			LIF_CMD, ip_sioctl_get_mtu, NULL },
1220 	/* 123 */ { SIOCGLIFBRDADDR, sizeof (struct lifreq),
1221 			IPI_GET_CMD | IPI_REPL,
1222 			LIF_CMD, ip_sioctl_get_brdaddr, NULL },
1223 	/* 124 */ { SIOCSLIFBRDADDR, sizeof (struct lifreq), IPI_PRIV | IPI_WR,
1224 			LIF_CMD, ip_sioctl_brdaddr, NULL },
1225 	/* 125 */ { SIOCGLIFNETMASK, sizeof (struct lifreq),
1226 			IPI_GET_CMD | IPI_REPL,
1227 			LIF_CMD, ip_sioctl_get_netmask, NULL },
1228 	/* 126 */ { SIOCSLIFNETMASK, sizeof (struct lifreq), IPI_PRIV | IPI_WR,
1229 			LIF_CMD, ip_sioctl_netmask, ip_sioctl_netmask_restart },
1230 	/* 127 */ { SIOCGLIFMETRIC, sizeof (struct lifreq),
1231 			IPI_GET_CMD | IPI_REPL,
1232 			LIF_CMD, ip_sioctl_get_metric, NULL },
1233 	/* 128 */ { SIOCSLIFMETRIC, sizeof (struct lifreq), IPI_PRIV | IPI_WR,
1234 			LIF_CMD, ip_sioctl_metric, NULL },
1235 	/* 129 */ { SIOCSLIFNAME, sizeof (struct lifreq),
1236 			IPI_PRIV | IPI_WR | IPI_MODOK | IPI_REPL,
1237 			LIF_CMD, ip_sioctl_slifname,
1238 			ip_sioctl_slifname_restart },
1239 
1240 	/* 130 */ { SIOCGLIFNUM, sizeof (struct lifnum), IPI_GET_CMD | IPI_REPL,
1241 			MISC_CMD, ip_sioctl_get_lifnum, NULL },
1242 	/* 131 */ { SIOCGLIFMUXID, sizeof (struct lifreq),
1243 			IPI_GET_CMD | IPI_REPL,
1244 			LIF_CMD, ip_sioctl_get_muxid, NULL },
1245 	/* 132 */ { SIOCSLIFMUXID, sizeof (struct lifreq),
1246 			IPI_PRIV | IPI_WR | IPI_REPL,
1247 			LIF_CMD, ip_sioctl_muxid, NULL },
1248 	/* 133 */ { SIOCGLIFINDEX, sizeof (struct lifreq),
1249 			IPI_GET_CMD | IPI_REPL,
1250 			LIF_CMD, ip_sioctl_get_lifindex, 0 },
1251 	/* 134 */ { SIOCSLIFINDEX, sizeof (struct lifreq),
1252 			IPI_PRIV | IPI_WR | IPI_REPL,
1253 			LIF_CMD, ip_sioctl_slifindex, 0 },
1254 	/* 135 */ { SIOCSLIFTOKEN, sizeof (struct lifreq), IPI_PRIV | IPI_WR,
1255 			LIF_CMD, ip_sioctl_token, NULL },
1256 	/* 136 */ { SIOCGLIFTOKEN, sizeof (struct lifreq),
1257 			IPI_GET_CMD | IPI_REPL,
1258 			LIF_CMD, ip_sioctl_get_token, NULL },
1259 	/* 137 */ { SIOCSLIFSUBNET, sizeof (struct lifreq), IPI_PRIV | IPI_WR,
1260 			LIF_CMD, ip_sioctl_subnet, ip_sioctl_subnet_restart },
1261 	/* 138 */ { SIOCGLIFSUBNET, sizeof (struct lifreq),
1262 			IPI_GET_CMD | IPI_REPL,
1263 			LIF_CMD, ip_sioctl_get_subnet, NULL },
1264 	/* 139 */ { SIOCSLIFLNKINFO, sizeof (struct lifreq), IPI_PRIV | IPI_WR,
1265 			LIF_CMD, ip_sioctl_lnkinfo, NULL },
1266 
1267 	/* 140 */ { SIOCGLIFLNKINFO, sizeof (struct lifreq),
1268 			IPI_GET_CMD | IPI_REPL,
1269 			LIF_CMD, ip_sioctl_get_lnkinfo, NULL },
1270 	/* 141 */ { SIOCLIFDELND, sizeof (struct lifreq), IPI_PRIV,
1271 			LIF_CMD, ip_siocdelndp_v6, NULL },
1272 	/* 142 */ { SIOCLIFGETND, sizeof (struct lifreq), IPI_GET_CMD,
1273 			LIF_CMD, ip_siocqueryndp_v6, NULL },
1274 	/* 143 */ { SIOCLIFSETND, sizeof (struct lifreq), IPI_PRIV,
1275 			LIF_CMD, ip_siocsetndp_v6, NULL },
1276 	/* 144 */ { SIOCTMYADDR, sizeof (struct sioc_addrreq), IPI_GET_CMD,
1277 			MISC_CMD, ip_sioctl_tmyaddr, NULL },
1278 	/* 145 */ { SIOCTONLINK, sizeof (struct sioc_addrreq), IPI_GET_CMD,
1279 			MISC_CMD, ip_sioctl_tonlink, NULL },
1280 	/* 146 */ { SIOCTMYSITE, sizeof (struct sioc_addrreq), 0,
1281 			MISC_CMD, ip_sioctl_tmysite, NULL },
1282 	/* 147 */ { SIOCGTUNPARAM, sizeof (struct iftun_req), IPI_REPL,
1283 			TUN_CMD, ip_sioctl_tunparam, NULL },
1284 	/* 148 */ { SIOCSTUNPARAM, sizeof (struct iftun_req),
1285 			IPI_PRIV | IPI_WR,
1286 			TUN_CMD, ip_sioctl_tunparam, NULL },
1287 
1288 	/* IPSECioctls handled in ip_sioctl_copyin_setup itself */
1289 	/* 149 */ { SIOCFIPSECONFIG, 0, IPI_PRIV, MISC_CMD, NULL, NULL },
1290 	/* 150 */ { SIOCSIPSECONFIG, 0, IPI_PRIV, MISC_CMD, NULL, NULL },
1291 	/* 151 */ { SIOCDIPSECONFIG, 0, IPI_PRIV, MISC_CMD, NULL, NULL },
1292 	/* 152 */ { SIOCLIPSECONFIG, 0, IPI_PRIV, MISC_CMD, NULL, NULL },
1293 
1294 	/* 153 */ { SIOCLIFFAILOVER, sizeof (struct lifreq),
1295 			IPI_PRIV | IPI_WR | IPI_REPL,
1296 			LIF_CMD, ip_sioctl_move, ip_sioctl_move },
1297 	/* 154 */ { SIOCLIFFAILBACK, sizeof (struct lifreq),
1298 			IPI_PRIV | IPI_WR | IPI_REPL,
1299 			LIF_CMD, ip_sioctl_move, ip_sioctl_move },
1300 	/* 155 */ { SIOCSLIFGROUPNAME, sizeof (struct lifreq),
1301 			IPI_PRIV | IPI_WR,
1302 			LIF_CMD, ip_sioctl_groupname, ip_sioctl_groupname },
1303 	/* 156 */ { SIOCGLIFGROUPNAME, sizeof (struct lifreq),
1304 			IPI_GET_CMD | IPI_REPL,
1305 			LIF_CMD, ip_sioctl_get_groupname, NULL },
1306 	/* 157 */ { SIOCGLIFOINDEX, sizeof (struct lifreq),
1307 			IPI_GET_CMD | IPI_REPL,
1308 			LIF_CMD, ip_sioctl_get_oindex, NULL },
1309 
1310 	/* Leave 158-160 unused; used to be SIOC*IFARP ioctls */
1311 	/* 158 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1312 	/* 159 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1313 	/* 160 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1314 
1315 	/* 161 */ { SIOCSLIFOINDEX, sizeof (struct lifreq), IPI_PRIV | IPI_WR,
1316 		    LIF_CMD, ip_sioctl_slifoindex, NULL },
1317 
1318 	/* These are handled in ip_sioctl_copyin_setup itself */
1319 	/* 162 */ { SIOCGIP6ADDRPOLICY, 0, IPI_NULL_BCONT,
1320 			MISC_CMD, NULL, NULL },
1321 	/* 163 */ { SIOCSIP6ADDRPOLICY, 0, IPI_PRIV | IPI_NULL_BCONT,
1322 			MISC_CMD, NULL, NULL },
1323 	/* 164 */ { SIOCGDSTINFO, 0, IPI_GET_CMD, MISC_CMD, NULL, NULL },
1324 
1325 	/* 165 */ { SIOCGLIFCONF, 0, IPI_GET_CMD, MISC_CMD | IPI_REPL,
1326 			ip_sioctl_get_lifconf, NULL },
1327 
1328 	/* 166 */ { SIOCSXARP, sizeof (struct xarpreq), IPI_PRIV,
1329 			MISC_CMD, ip_sioctl_xarp, NULL },
1330 	/* 167 */ { SIOCGXARP, sizeof (struct xarpreq), IPI_GET_CMD | IPI_REPL,
1331 			MISC_CMD, ip_sioctl_xarp, NULL },
1332 	/* 168 */ { SIOCDXARP, sizeof (struct xarpreq), IPI_PRIV,
1333 			MISC_CMD, ip_sioctl_xarp, NULL },
1334 
1335 	/* SIOCPOPSOCKFS is not handled by IP */
1336 	/* 169 */ { IPI_DONTCARE /* SIOCPOPSOCKFS */, 0, 0, 0, NULL, NULL },
1337 
1338 	/* 170 */ { SIOCGLIFZONE, sizeof (struct lifreq),
1339 			IPI_GET_CMD | IPI_REPL,
1340 			LIF_CMD, ip_sioctl_get_lifzone, NULL },
1341 	/* 171 */ { SIOCSLIFZONE, sizeof (struct lifreq),
1342 			IPI_PRIV | IPI_WR | IPI_REPL,
1343 			LIF_CMD, ip_sioctl_slifzone,
1344 			ip_sioctl_slifzone_restart },
1345 	/* 172-174 are SCTP ioctls and not handled by IP */
1346 	/* 172 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1347 	/* 173 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1348 	/* 174 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1349 	/* 175 */ { SIOCGLIFUSESRC, sizeof (struct lifreq),
1350 			IPI_GET_CMD, LIF_CMD,
1351 			ip_sioctl_get_lifusesrc, 0 },
1352 	/* 176 */ { SIOCSLIFUSESRC, sizeof (struct lifreq),
1353 			IPI_PRIV | IPI_WR,
1354 			LIF_CMD, ip_sioctl_slifusesrc,
1355 			NULL },
1356 	/* 177 */ { SIOCGLIFSRCOF, 0, IPI_GET_CMD, MISC_CMD,
1357 			ip_sioctl_get_lifsrcof, NULL },
1358 	/* 178 */ { SIOCGMSFILTER, sizeof (struct group_filter), IPI_GET_CMD,
1359 			MISC_CMD, ip_sioctl_msfilter, NULL },
1360 	/* 179 */ { SIOCSMSFILTER, sizeof (struct group_filter), IPI_WR,
1361 			MISC_CMD, ip_sioctl_msfilter, NULL },
1362 	/* 180 */ { SIOCGIPMSFILTER, sizeof (struct ip_msfilter), IPI_GET_CMD,
1363 			MISC_CMD, ip_sioctl_msfilter, NULL },
1364 	/* 181 */ { SIOCSIPMSFILTER, sizeof (struct ip_msfilter), IPI_WR,
1365 			MISC_CMD, ip_sioctl_msfilter, NULL }
1366 };
1367 
1368 int ip_ndx_ioctl_count = sizeof (ip_ndx_ioctl_table) / sizeof (ip_ioctl_cmd_t);
1369 
1370 ip_ioctl_cmd_t ip_misc_ioctl_table[] = {
1371 	{ OSIOCGTUNPARAM, sizeof (struct old_iftun_req),
1372 		IPI_GET_CMD | IPI_REPL, TUN_CMD, ip_sioctl_tunparam, NULL },
1373 	{ OSIOCSTUNPARAM, sizeof (struct old_iftun_req), IPI_PRIV | IPI_WR,
1374 		TUN_CMD, ip_sioctl_tunparam, NULL },
1375 	{ I_LINK,	0, IPI_PRIV | IPI_WR | IPI_PASS_DOWN, 0, NULL, NULL },
1376 	{ I_UNLINK,	0, IPI_PRIV | IPI_WR | IPI_PASS_DOWN, 0, NULL, NULL },
1377 	{ I_PLINK,	0, IPI_PRIV | IPI_WR | IPI_PASS_DOWN, 0, NULL, NULL },
1378 	{ I_PUNLINK,	0, IPI_PRIV | IPI_WR | IPI_PASS_DOWN, 0, NULL, NULL },
1379 	{ ND_GET,	0, IPI_PASS_DOWN, 0, NULL, NULL },
1380 	{ ND_SET,	0, IPI_PRIV | IPI_WR | IPI_PASS_DOWN, 0, NULL, NULL },
1381 	{ IP_IOCTL,	0, 0, 0, NULL, NULL },
1382 	{ SIOCGETVIFCNT, sizeof (struct sioc_vif_req), IPI_REPL | IPI_GET_CMD,
1383 		MISC_CMD, mrt_ioctl},
1384 	{ SIOCGETSGCNT,	sizeof (struct sioc_sg_req), IPI_REPL | IPI_GET_CMD,
1385 		MISC_CMD, mrt_ioctl},
1386 	{ SIOCGETLSGCNT, sizeof (struct sioc_lsg_req), IPI_REPL | IPI_GET_CMD,
1387 		MISC_CMD, mrt_ioctl}
1388 };
1389 
1390 int ip_misc_ioctl_count =
1391     sizeof (ip_misc_ioctl_table) / sizeof (ip_ioctl_cmd_t);
1392 
1393 static  idl_t *conn_drain_list;		/* The array of conn drain lists */
1394 static  uint_t conn_drain_list_cnt;	/* Total count of conn_drain_list */
1395 static  int    conn_drain_list_index;	/* Next drain_list to be used */
1396 int	conn_drain_nthreads;		/* Number of drainers reqd. */
1397 					/* Settable in /etc/system */
1398 
1399 /* Defined in ip_ire.c */
1400 extern uint32_t ip_ire_max_bucket_cnt, ip6_ire_max_bucket_cnt;
1401 extern uint32_t ip_ire_min_bucket_cnt, ip6_ire_min_bucket_cnt;
1402 extern uint32_t ip_ire_mem_ratio, ip_ire_cpu_ratio;
1403 
1404 static nv_t	ire_nv_arr[] = {
1405 	{ IRE_BROADCAST, "BROADCAST" },
1406 	{ IRE_LOCAL, "LOCAL" },
1407 	{ IRE_LOOPBACK, "LOOPBACK" },
1408 	{ IRE_CACHE, "CACHE" },
1409 	{ IRE_DEFAULT, "DEFAULT" },
1410 	{ IRE_PREFIX, "PREFIX" },
1411 	{ IRE_IF_NORESOLVER, "IF_NORESOL" },
1412 	{ IRE_IF_RESOLVER, "IF_RESOLV" },
1413 	{ IRE_HOST, "HOST" },
1414 	{ IRE_HOST_REDIRECT, "HOST_REDIRECT" },
1415 	{ 0 }
1416 };
1417 
1418 nv_t	*ire_nv_tbl = ire_nv_arr;
1419 
1420 /* Defined in ip_if.c, protect the list of IPsec capable ills */
1421 extern krwlock_t ipsec_capab_ills_lock;
1422 
1423 /* Packet dropper for IP IPsec processing failures */
1424 ipdropper_t ip_dropper;
1425 
1426 /* Simple ICMP IP Header Template */
1427 static ipha_t icmp_ipha = {
1428 	IP_SIMPLE_HDR_VERSION, 0, 0, 0, 0, 0, IPPROTO_ICMP
1429 };
1430 
1431 struct module_info ip_mod_info = {
1432 	5701, "ip", 1, INFPSZ, 65536, 1024
1433 };
1434 
1435 static struct qinit rinit = {
1436 	(pfi_t)ip_rput, NULL, ip_open, ip_close, NULL,
1437 	&ip_mod_info
1438 };
1439 
1440 static struct qinit winit = {
1441 	(pfi_t)ip_wput, (pfi_t)ip_wsrv, ip_open, ip_close, NULL,
1442 	&ip_mod_info
1443 };
1444 
1445 static struct qinit lrinit = {
1446 	(pfi_t)ip_lrput, NULL, ip_open, ip_close, NULL,
1447 	&ip_mod_info
1448 };
1449 
1450 static struct qinit lwinit = {
1451 	(pfi_t)ip_lwput, NULL, ip_open, ip_close, NULL,
1452 	&ip_mod_info
1453 };
1454 
1455 struct streamtab ipinfo = {
1456 	&rinit, &winit, &lrinit, &lwinit
1457 };
1458 
1459 #ifdef	DEBUG
1460 static boolean_t skip_sctp_cksum = B_FALSE;
1461 #endif
1462 /*
1463  * Copy an M_CTL-tagged message, preserving reference counts appropriately.
1464  */
1465 mblk_t *
1466 ip_copymsg(mblk_t *mp)
1467 {
1468 	mblk_t *nmp;
1469 	ipsec_info_t *in;
1470 
1471 	if (mp->b_datap->db_type != M_CTL)
1472 		return (copymsg(mp));
1473 
1474 	in = (ipsec_info_t *)mp->b_rptr;
1475 
1476 	/*
1477 	 * Note that M_CTL is also used for delivering ICMP error messages
1478 	 * upstream to transport layers.
1479 	 */
1480 	if (in->ipsec_info_type != IPSEC_OUT &&
1481 	    in->ipsec_info_type != IPSEC_IN)
1482 		return (copymsg(mp));
1483 
1484 	nmp = copymsg(mp->b_cont);
1485 
1486 	if (in->ipsec_info_type == IPSEC_OUT)
1487 		return (ipsec_out_tag(mp, nmp));
1488 	else
1489 		return (ipsec_in_tag(mp, nmp));
1490 }
1491 
1492 /* Generate an ICMP fragmentation needed message. */
1493 static void
1494 icmp_frag_needed(queue_t *q, mblk_t *mp, int mtu)
1495 {
1496 	icmph_t	icmph;
1497 	mblk_t *first_mp;
1498 	boolean_t mctl_present;
1499 
1500 	EXTRACT_PKT_MP(mp, first_mp, mctl_present);
1501 
1502 	if (!(mp = icmp_pkt_err_ok(mp))) {
1503 		if (mctl_present)
1504 			freeb(first_mp);
1505 		return;
1506 	}
1507 
1508 	bzero(&icmph, sizeof (icmph_t));
1509 	icmph.icmph_type = ICMP_DEST_UNREACHABLE;
1510 	icmph.icmph_code = ICMP_FRAGMENTATION_NEEDED;
1511 	icmph.icmph_du_mtu = htons((uint16_t)mtu);
1512 	BUMP_MIB(&icmp_mib, icmpOutFragNeeded);
1513 	BUMP_MIB(&icmp_mib, icmpOutDestUnreachs);
1514 	icmp_pkt(q, first_mp, &icmph, sizeof (icmph_t), mctl_present);
1515 }
1516 
1517 /*
1518  * icmp_inbound deals with ICMP messages in the following ways.
1519  *
1520  * 1) It needs to send a reply back and possibly delivering it
1521  *    to the "interested" upper clients.
1522  * 2) It needs to send it to the upper clients only.
1523  * 3) It needs to change some values in IP only.
1524  * 4) It needs to change some values in IP and upper layers e.g TCP.
1525  *
1526  * We need to accomodate icmp messages coming in clear until we get
1527  * everything secure from the wire. If icmp_accept_clear_messages
1528  * is zero we check with the global policy and act accordingly. If
1529  * it is non-zero, we accept the message without any checks. But
1530  * *this does not mean* that this will be delivered to the upper
1531  * clients. By accepting we might send replies back, change our MTU
1532  * value etc. but delivery to the ULP/clients depends on their policy
1533  * dispositions.
1534  *
1535  * We handle the above 4 cases in the context of IPSEC in the
1536  * following way :
1537  *
1538  * 1) Send the reply back in the same way as the request came in.
1539  *    If it came in encrypted, it goes out encrypted. If it came in
1540  *    clear, it goes out in clear. Thus, this will prevent chosen
1541  *    plain text attack.
1542  * 2) The client may or may not expect things to come in secure.
1543  *    If it comes in secure, the policy constraints are checked
1544  *    before delivering it to the upper layers. If it comes in
1545  *    clear, ipsec_inbound_accept_clear will decide whether to
1546  *    accept this in clear or not. In both the cases, if the returned
1547  *    message (IP header + 8 bytes) that caused the icmp message has
1548  *    AH/ESP headers, it is sent up to AH/ESP for validation before
1549  *    sending up. If there are only 8 bytes of returned message, then
1550  *    upper client will not be notified.
1551  * 3) Check with global policy to see whether it matches the constaints.
1552  *    But this will be done only if icmp_accept_messages_in_clear is
1553  *    zero.
1554  * 4) If we need to change both in IP and ULP, then the decision taken
1555  *    while affecting the values in IP and while delivering up to TCP
1556  *    should be the same.
1557  *
1558  * 	There are two cases.
1559  *
1560  * 	a) If we reject data at the IP layer (ipsec_check_global_policy()
1561  *	   failed), we will not deliver it to the ULP, even though they
1562  *	   are *willing* to accept in *clear*. This is fine as our global
1563  *	   disposition to icmp messages asks us reject the datagram.
1564  *
1565  *	b) If we accept data at the IP layer (ipsec_check_global_policy()
1566  *	   succeeded or icmp_accept_messages_in_clear is 1), and not able
1567  *	   to deliver it to ULP (policy failed), it can lead to
1568  *	   consistency problems. The cases known at this time are
1569  *	   ICMP_DESTINATION_UNREACHABLE  messages with following code
1570  *	   values :
1571  *
1572  *	   - ICMP_FRAGMENTATION_NEEDED : IP adapts to the new value
1573  *	     and Upper layer rejects. Then the communication will
1574  *	     come to a stop. This is solved by making similar decisions
1575  *	     at both levels. Currently, when we are unable to deliver
1576  *	     to the Upper Layer (due to policy failures) while IP has
1577  *	     adjusted ire_max_frag, the next outbound datagram would
1578  *	     generate a local ICMP_FRAGMENTATION_NEEDED message - which
1579  *	     will be with the right level of protection. Thus the right
1580  *	     value will be communicated even if we are not able to
1581  *	     communicate when we get from the wire initially. But this
1582  *	     assumes there would be at least one outbound datagram after
1583  *	     IP has adjusted its ire_max_frag value. To make things
1584  *	     simpler, we accept in clear after the validation of
1585  *	     AH/ESP headers.
1586  *
1587  *	   - Other ICMP ERRORS : We may not be able to deliver it to the
1588  *	     upper layer depending on the level of protection the upper
1589  *	     layer expects and the disposition in ipsec_inbound_accept_clear().
1590  *	     ipsec_inbound_accept_clear() decides whether a given ICMP error
1591  *	     should be accepted in clear when the Upper layer expects secure.
1592  *	     Thus the communication may get aborted by some bad ICMP
1593  *	     packets.
1594  *
1595  * IPQoS Notes:
1596  * The only instance when a packet is sent for processing is when there
1597  * isn't an ICMP client and if we are interested in it.
1598  * If there is a client, IPPF processing will take place in the
1599  * ip_fanout_proto routine.
1600  *
1601  * Zones notes:
1602  * The packet is only processed in the context of the specified zone: typically
1603  * only this zone will reply to an echo request, and only interested clients in
1604  * this zone will receive a copy of the packet. This means that the caller must
1605  * call icmp_inbound() for each relevant zone.
1606  */
1607 static void
1608 icmp_inbound(queue_t *q, mblk_t *mp, boolean_t broadcast, ill_t *ill,
1609     int sum_valid, uint32_t sum, boolean_t mctl_present, boolean_t ip_policy,
1610     ill_t *recv_ill, zoneid_t zoneid)
1611 {
1612 	icmph_t	*icmph;
1613 	ipha_t	*ipha;
1614 	int	iph_hdr_length;
1615 	int	hdr_length;
1616 	boolean_t	interested;
1617 	uint32_t	ts;
1618 	uchar_t	*wptr;
1619 	ipif_t	*ipif;
1620 	mblk_t *first_mp;
1621 	ipsec_in_t *ii;
1622 	ire_t *src_ire;
1623 	boolean_t onlink;
1624 	timestruc_t now;
1625 	uint32_t ill_index;
1626 
1627 	ASSERT(ill != NULL);
1628 
1629 	first_mp = mp;
1630 	if (mctl_present) {
1631 		mp = first_mp->b_cont;
1632 		ASSERT(mp != NULL);
1633 	}
1634 
1635 	ipha = (ipha_t *)mp->b_rptr;
1636 	if (icmp_accept_clear_messages == 0) {
1637 		first_mp = ipsec_check_global_policy(first_mp, NULL,
1638 		    ipha, NULL, mctl_present);
1639 		if (first_mp == NULL)
1640 			return;
1641 	}
1642 	/*
1643 	 * We have accepted the ICMP message. It means that we will
1644 	 * respond to the packet if needed. It may not be delivered
1645 	 * to the upper client depending on the policy constraints
1646 	 * and the disposition in ipsec_inbound_accept_clear.
1647 	 */
1648 
1649 	ASSERT(ill != NULL);
1650 
1651 	BUMP_MIB(&icmp_mib, icmpInMsgs);
1652 	iph_hdr_length = IPH_HDR_LENGTH(ipha);
1653 	if ((mp->b_wptr - mp->b_rptr) < (iph_hdr_length + ICMPH_SIZE)) {
1654 		/* Last chance to get real. */
1655 		if (!pullupmsg(mp, iph_hdr_length + ICMPH_SIZE)) {
1656 			BUMP_MIB(&icmp_mib, icmpInErrors);
1657 			freemsg(first_mp);
1658 			return;
1659 		}
1660 		/* Refresh iph following the pullup. */
1661 		ipha = (ipha_t *)mp->b_rptr;
1662 	}
1663 	/* ICMP header checksum, including checksum field, should be zero. */
1664 	if (sum_valid ? (sum != 0 && sum != 0xFFFF) :
1665 	    IP_CSUM(mp, iph_hdr_length, 0)) {
1666 		BUMP_MIB(&icmp_mib, icmpInCksumErrs);
1667 		freemsg(first_mp);
1668 		return;
1669 	}
1670 	/* The IP header will always be a multiple of four bytes */
1671 	icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length];
1672 	ip2dbg(("icmp_inbound: type %d code %d\n", icmph->icmph_type,
1673 	    icmph->icmph_code));
1674 	wptr = (uchar_t *)icmph + ICMPH_SIZE;
1675 	/* We will set "interested" to "true" if we want a copy */
1676 	interested = B_FALSE;
1677 	switch (icmph->icmph_type) {
1678 	case ICMP_ECHO_REPLY:
1679 		BUMP_MIB(&icmp_mib, icmpInEchoReps);
1680 		break;
1681 	case ICMP_DEST_UNREACHABLE:
1682 		if (icmph->icmph_code == ICMP_FRAGMENTATION_NEEDED)
1683 			BUMP_MIB(&icmp_mib, icmpInFragNeeded);
1684 		interested = B_TRUE;	/* Pass up to transport */
1685 		BUMP_MIB(&icmp_mib, icmpInDestUnreachs);
1686 		break;
1687 	case ICMP_SOURCE_QUENCH:
1688 		interested = B_TRUE;	/* Pass up to transport */
1689 		BUMP_MIB(&icmp_mib, icmpInSrcQuenchs);
1690 		break;
1691 	case ICMP_REDIRECT:
1692 		if (!ip_ignore_redirect)
1693 			interested = B_TRUE;
1694 		BUMP_MIB(&icmp_mib, icmpInRedirects);
1695 		break;
1696 	case ICMP_ECHO_REQUEST:
1697 		/*
1698 		 * Whether to respond to echo requests that come in as IP
1699 		 * broadcasts or as IP multicast is subject to debate
1700 		 * (what isn't?).  We aim to please, you pick it.
1701 		 * Default is do it.
1702 		 */
1703 		if (!broadcast && !CLASSD(ipha->ipha_dst)) {
1704 			/* unicast: always respond */
1705 			interested = B_TRUE;
1706 		} else if (CLASSD(ipha->ipha_dst)) {
1707 			/* multicast: respond based on tunable */
1708 			interested = ip_g_resp_to_echo_mcast;
1709 		} else if (broadcast) {
1710 			/* broadcast: respond based on tunable */
1711 			interested = ip_g_resp_to_echo_bcast;
1712 		}
1713 		BUMP_MIB(&icmp_mib, icmpInEchos);
1714 		break;
1715 	case ICMP_ROUTER_ADVERTISEMENT:
1716 	case ICMP_ROUTER_SOLICITATION:
1717 		break;
1718 	case ICMP_TIME_EXCEEDED:
1719 		interested = B_TRUE;	/* Pass up to transport */
1720 		BUMP_MIB(&icmp_mib, icmpInTimeExcds);
1721 		break;
1722 	case ICMP_PARAM_PROBLEM:
1723 		interested = B_TRUE;	/* Pass up to transport */
1724 		BUMP_MIB(&icmp_mib, icmpInParmProbs);
1725 		break;
1726 	case ICMP_TIME_STAMP_REQUEST:
1727 		/* Response to Time Stamp Requests is local policy. */
1728 		if (ip_g_resp_to_timestamp &&
1729 		    /* So is whether to respond if it was an IP broadcast. */
1730 		    (!broadcast || ip_g_resp_to_timestamp_bcast)) {
1731 			int tstamp_len = 3 * sizeof (uint32_t);
1732 
1733 			if (wptr +  tstamp_len > mp->b_wptr) {
1734 				if (!pullupmsg(mp, wptr + tstamp_len -
1735 				    mp->b_rptr)) {
1736 					BUMP_MIB(&ip_mib, ipInDiscards);
1737 					freemsg(first_mp);
1738 					return;
1739 				}
1740 				/* Refresh ipha following the pullup. */
1741 				ipha = (ipha_t *)mp->b_rptr;
1742 				icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length];
1743 				wptr = (uchar_t *)icmph + ICMPH_SIZE;
1744 			}
1745 			interested = B_TRUE;
1746 		}
1747 		BUMP_MIB(&icmp_mib, icmpInTimestamps);
1748 		break;
1749 	case ICMP_TIME_STAMP_REPLY:
1750 		BUMP_MIB(&icmp_mib, icmpInTimestampReps);
1751 		break;
1752 	case ICMP_INFO_REQUEST:
1753 		/* Per RFC 1122 3.2.2.7, ignore this. */
1754 	case ICMP_INFO_REPLY:
1755 		break;
1756 	case ICMP_ADDRESS_MASK_REQUEST:
1757 		if ((ip_respond_to_address_mask_broadcast || !broadcast) &&
1758 		    /* TODO m_pullup of complete header? */
1759 		    (mp->b_datap->db_lim - wptr) >= IP_ADDR_LEN)
1760 			interested = B_TRUE;
1761 		BUMP_MIB(&icmp_mib, icmpInAddrMasks);
1762 		break;
1763 	case ICMP_ADDRESS_MASK_REPLY:
1764 		BUMP_MIB(&icmp_mib, icmpInAddrMaskReps);
1765 		break;
1766 	default:
1767 		interested = B_TRUE;	/* Pass up to transport */
1768 		BUMP_MIB(&icmp_mib, icmpInUnknowns);
1769 		break;
1770 	}
1771 	/* See if there is an ICMP client. */
1772 	if (ipcl_proto_search(IPPROTO_ICMP) != NULL) {
1773 		/* If there is an ICMP client and we want one too, copy it. */
1774 		mblk_t *first_mp1;
1775 
1776 		if (!interested) {
1777 			ip_fanout_proto(q, first_mp, ill, ipha, 0, mctl_present,
1778 			    ip_policy, recv_ill, zoneid);
1779 			return;
1780 		}
1781 		first_mp1 = ip_copymsg(first_mp);
1782 		if (first_mp1 != NULL) {
1783 			ip_fanout_proto(q, first_mp1, ill, ipha,
1784 			    0, mctl_present, ip_policy, recv_ill, zoneid);
1785 		}
1786 	} else if (!interested) {
1787 		freemsg(first_mp);
1788 		return;
1789 	} else {
1790 		/*
1791 		 * Initiate policy processing for this packet if ip_policy
1792 		 * is true.
1793 		 */
1794 		if (IPP_ENABLED(IPP_LOCAL_IN) && ip_policy) {
1795 			ill_index = ill->ill_phyint->phyint_ifindex;
1796 			ip_process(IPP_LOCAL_IN, &mp, ill_index);
1797 			if (mp == NULL) {
1798 				if (mctl_present) {
1799 					freeb(first_mp);
1800 				}
1801 				BUMP_MIB(&icmp_mib, icmpInErrors);
1802 				return;
1803 			}
1804 		}
1805 	}
1806 	/* We want to do something with it. */
1807 	/* Check db_ref to make sure we can modify the packet. */
1808 	if (mp->b_datap->db_ref > 1) {
1809 		mblk_t	*first_mp1;
1810 
1811 		first_mp1 = ip_copymsg(first_mp);
1812 		freemsg(first_mp);
1813 		if (!first_mp1) {
1814 			BUMP_MIB(&icmp_mib, icmpOutDrops);
1815 			return;
1816 		}
1817 		first_mp = first_mp1;
1818 		if (mctl_present) {
1819 			mp = first_mp->b_cont;
1820 			ASSERT(mp != NULL);
1821 		} else {
1822 			mp = first_mp;
1823 		}
1824 		ipha = (ipha_t *)mp->b_rptr;
1825 		icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length];
1826 		wptr = (uchar_t *)icmph + ICMPH_SIZE;
1827 	}
1828 	switch (icmph->icmph_type) {
1829 	case ICMP_ADDRESS_MASK_REQUEST:
1830 		ipif = ipif_lookup_remote(ill, ipha->ipha_src, zoneid);
1831 		if (ipif == NULL) {
1832 			freemsg(first_mp);
1833 			return;
1834 		}
1835 		/*
1836 		 * outging interface must be IPv4
1837 		 */
1838 		ASSERT(ipif != NULL && !ipif->ipif_isv6);
1839 		icmph->icmph_type = ICMP_ADDRESS_MASK_REPLY;
1840 		bcopy(&ipif->ipif_net_mask, wptr, IP_ADDR_LEN);
1841 		ipif_refrele(ipif);
1842 		BUMP_MIB(&icmp_mib, icmpOutAddrMaskReps);
1843 		break;
1844 	case ICMP_ECHO_REQUEST:
1845 		icmph->icmph_type = ICMP_ECHO_REPLY;
1846 		BUMP_MIB(&icmp_mib, icmpOutEchoReps);
1847 		break;
1848 	case ICMP_TIME_STAMP_REQUEST: {
1849 		uint32_t *tsp;
1850 
1851 		icmph->icmph_type = ICMP_TIME_STAMP_REPLY;
1852 		tsp = (uint32_t *)wptr;
1853 		tsp++;		/* Skip past 'originate time' */
1854 		/* Compute # of milliseconds since midnight */
1855 		gethrestime(&now);
1856 		ts = (now.tv_sec % (24 * 60 * 60)) * 1000 +
1857 		    now.tv_nsec / (NANOSEC / MILLISEC);
1858 		*tsp++ = htonl(ts);	/* Lay in 'receive time' */
1859 		*tsp++ = htonl(ts);	/* Lay in 'send time' */
1860 		BUMP_MIB(&icmp_mib, icmpOutTimestampReps);
1861 		break;
1862 	}
1863 	default:
1864 		ipha = (ipha_t *)&icmph[1];
1865 		if ((uchar_t *)&ipha[1] > mp->b_wptr) {
1866 			if (!pullupmsg(mp, (uchar_t *)&ipha[1] - mp->b_rptr)) {
1867 				BUMP_MIB(&ip_mib, ipInDiscards);
1868 				freemsg(first_mp);
1869 				return;
1870 			}
1871 			icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length];
1872 			ipha = (ipha_t *)&icmph[1];
1873 		}
1874 		if ((IPH_HDR_VERSION(ipha) != IPV4_VERSION)) {
1875 			BUMP_MIB(&ip_mib, ipInDiscards);
1876 			freemsg(first_mp);
1877 			return;
1878 		}
1879 		hdr_length = IPH_HDR_LENGTH(ipha);
1880 		if (hdr_length < sizeof (ipha_t)) {
1881 			BUMP_MIB(&ip_mib, ipInDiscards);
1882 			freemsg(first_mp);
1883 			return;
1884 		}
1885 		if ((uchar_t *)ipha + hdr_length > mp->b_wptr) {
1886 			if (!pullupmsg(mp,
1887 			    (uchar_t *)ipha + hdr_length - mp->b_rptr)) {
1888 				BUMP_MIB(&ip_mib, ipInDiscards);
1889 				freemsg(first_mp);
1890 				return;
1891 			}
1892 			icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length];
1893 			ipha = (ipha_t *)&icmph[1];
1894 		}
1895 		switch (icmph->icmph_type) {
1896 		case ICMP_REDIRECT:
1897 			/*
1898 			 * As there is no upper client to deliver, we don't
1899 			 * need the first_mp any more.
1900 			 */
1901 			if (mctl_present) {
1902 				freeb(first_mp);
1903 			}
1904 			icmp_redirect(mp);
1905 			return;
1906 		case ICMP_DEST_UNREACHABLE:
1907 			if (icmph->icmph_code == ICMP_FRAGMENTATION_NEEDED) {
1908 				if (!icmp_inbound_too_big(icmph, ipha)) {
1909 					freemsg(first_mp);
1910 					return;
1911 				}
1912 			}
1913 			/* FALLTHRU */
1914 		default :
1915 			/*
1916 			 * IPQoS notes: Since we have already done IPQoS
1917 			 * processing we don't want to do it again in
1918 			 * the fanout routines called by
1919 			 * icmp_inbound_error_fanout, hence the last
1920 			 * argument, ip_policy, is B_FALSE.
1921 			 */
1922 			icmp_inbound_error_fanout(q, ill, first_mp, icmph,
1923 			    ipha, iph_hdr_length, hdr_length, mctl_present,
1924 			    B_FALSE, recv_ill, zoneid);
1925 		}
1926 		return;
1927 	}
1928 	/* Send out an ICMP packet */
1929 	icmph->icmph_checksum = 0;
1930 	icmph->icmph_checksum = IP_CSUM(mp, iph_hdr_length, 0);
1931 	if (broadcast || CLASSD(ipha->ipha_dst)) {
1932 		ipif_t	*ipif_chosen;
1933 		/*
1934 		 * Make it look like it was directed to us, so we don't look
1935 		 * like a fool with a broadcast or multicast source address.
1936 		 */
1937 		ipif = ipif_lookup_remote(ill, ipha->ipha_src, zoneid);
1938 		/*
1939 		 * Make sure that we haven't grabbed an interface that's DOWN.
1940 		 */
1941 		if (ipif != NULL) {
1942 			ipif_chosen = ipif_select_source(ipif->ipif_ill,
1943 			    ipha->ipha_src, zoneid);
1944 			if (ipif_chosen != NULL) {
1945 				ipif_refrele(ipif);
1946 				ipif = ipif_chosen;
1947 			}
1948 		}
1949 		if (ipif == NULL) {
1950 			ip0dbg(("icmp_inbound: "
1951 			    "No source for broadcast/multicast:\n"
1952 			    "\tsrc 0x%x dst 0x%x ill %p "
1953 			    "ipif_lcl_addr 0x%x\n",
1954 			    ntohl(ipha->ipha_src), ntohl(ipha->ipha_dst),
1955 			    (void *)ill,
1956 			    ill->ill_ipif->ipif_lcl_addr));
1957 			freemsg(first_mp);
1958 			return;
1959 		}
1960 		ASSERT(ipif != NULL && !ipif->ipif_isv6);
1961 		ipha->ipha_dst = ipif->ipif_src_addr;
1962 		ipif_refrele(ipif);
1963 	}
1964 	/* Reset time to live. */
1965 	ipha->ipha_ttl = ip_def_ttl;
1966 	{
1967 		/* Swap source and destination addresses */
1968 		ipaddr_t tmp;
1969 
1970 		tmp = ipha->ipha_src;
1971 		ipha->ipha_src = ipha->ipha_dst;
1972 		ipha->ipha_dst = tmp;
1973 	}
1974 	ipha->ipha_ident = 0;
1975 	if (!IS_SIMPLE_IPH(ipha))
1976 		icmp_options_update(ipha);
1977 
1978 	/*
1979 	 * ICMP echo replies should go out on the same interface
1980 	 * the request came on as probes used by in.mpathd for detecting
1981 	 * NIC failures are ECHO packets. We turn-off load spreading
1982 	 * by setting ipsec_in_attach_if to B_TRUE, which is copied
1983 	 * to ipsec_out_attach_if by ipsec_in_to_out called later in this
1984 	 * function. This is in turn handled by ip_wput and ip_newroute
1985 	 * to make sure that the packet goes out on the interface it came
1986 	 * in on. If we don't turnoff load spreading, the packets might get
1987 	 * dropped if there are no non-FAILED/INACTIVE interfaces for it
1988 	 * to go out and in.mpathd would wrongly detect a failure or
1989 	 * mis-detect a NIC failure for link failure. As load spreading
1990 	 * can happen only if ill_group is not NULL, we do only for
1991 	 * that case and this does not affect the normal case.
1992 	 *
1993 	 * We turn off load spreading only on echo packets that came from
1994 	 * on-link hosts. If the interface route has been deleted, this will
1995 	 * not be enforced as we can't do much. For off-link hosts, as the
1996 	 * default routes in IPv4 does not typically have an ire_ipif
1997 	 * pointer, we can't force MATCH_IRE_ILL in ip_wput/ip_newroute.
1998 	 * Moreover, expecting a default route through this interface may
1999 	 * not be correct. We use ipha_dst because of the swap above.
2000 	 */
2001 	onlink = B_FALSE;
2002 	if (icmph->icmph_type == ICMP_ECHO_REPLY && ill->ill_group != NULL) {
2003 		/*
2004 		 * First, we need to make sure that it is not one of our
2005 		 * local addresses. If we set onlink when it is one of
2006 		 * our local addresses, we will end up creating IRE_CACHES
2007 		 * for one of our local addresses. Then, we will never
2008 		 * accept packets for them afterwards.
2009 		 */
2010 		src_ire = ire_ctable_lookup(ipha->ipha_dst, 0, IRE_LOCAL,
2011 		    NULL, ALL_ZONES, MATCH_IRE_TYPE);
2012 		if (src_ire == NULL) {
2013 			ipif = ipif_get_next_ipif(NULL, ill);
2014 			if (ipif == NULL) {
2015 				BUMP_MIB(&ip_mib, ipInDiscards);
2016 				freemsg(mp);
2017 				return;
2018 			}
2019 			src_ire = ire_ftable_lookup(ipha->ipha_dst, 0, 0,
2020 			    IRE_INTERFACE, ipif, NULL, ALL_ZONES, 0,
2021 			    MATCH_IRE_ILL | MATCH_IRE_TYPE);
2022 			ipif_refrele(ipif);
2023 			if (src_ire != NULL) {
2024 				onlink = B_TRUE;
2025 				ire_refrele(src_ire);
2026 			}
2027 		} else {
2028 			ire_refrele(src_ire);
2029 		}
2030 	}
2031 	if (!mctl_present) {
2032 		/*
2033 		 * This packet should go out the same way as it
2034 		 * came in i.e in clear. To make sure that global
2035 		 * policy will not be applied to this in ip_wput_ire,
2036 		 * we attach a IPSEC_IN mp and clear ipsec_in_secure.
2037 		 */
2038 		ASSERT(first_mp == mp);
2039 		if ((first_mp = ipsec_in_alloc(B_TRUE)) == NULL) {
2040 			BUMP_MIB(&ip_mib, ipInDiscards);
2041 			freemsg(mp);
2042 			return;
2043 		}
2044 		ii = (ipsec_in_t *)first_mp->b_rptr;
2045 
2046 		/* This is not a secure packet */
2047 		ii->ipsec_in_secure = B_FALSE;
2048 		if (onlink) {
2049 			ii->ipsec_in_attach_if = B_TRUE;
2050 			ii->ipsec_in_ill_index =
2051 			    ill->ill_phyint->phyint_ifindex;
2052 			ii->ipsec_in_rill_index =
2053 			    recv_ill->ill_phyint->phyint_ifindex;
2054 		}
2055 		first_mp->b_cont = mp;
2056 	} else if (onlink) {
2057 		ii = (ipsec_in_t *)first_mp->b_rptr;
2058 		ii->ipsec_in_attach_if = B_TRUE;
2059 		ii->ipsec_in_ill_index = ill->ill_phyint->phyint_ifindex;
2060 		ii->ipsec_in_rill_index = recv_ill->ill_phyint->phyint_ifindex;
2061 	} else {
2062 		ii = (ipsec_in_t *)first_mp->b_rptr;
2063 	}
2064 	ii->ipsec_in_zoneid = zoneid;
2065 	if (!ipsec_in_to_out(first_mp, ipha, NULL)) {
2066 		BUMP_MIB(&ip_mib, ipInDiscards);
2067 		return;
2068 	}
2069 	BUMP_MIB(&icmp_mib, icmpOutMsgs);
2070 	put(WR(q), first_mp);
2071 }
2072 
2073 /* Table from RFC 1191 */
2074 static int icmp_frag_size_table[] =
2075 { 32000, 17914, 8166, 4352, 2002, 1496, 1006, 508, 296, 68 };
2076 
2077 /*
2078  * Process received ICMP Packet too big.
2079  * After updating any IRE it does the fanout to any matching transport streams.
2080  * Assumes the message has been pulled up till the IP header that caused
2081  * the error.
2082  *
2083  * Returns B_FALSE on failure and B_TRUE on success.
2084  */
2085 static boolean_t
2086 icmp_inbound_too_big(icmph_t *icmph, ipha_t *ipha)
2087 {
2088 	ire_t	*ire, *first_ire;
2089 	int	mtu;
2090 	int	hdr_length;
2091 
2092 	ASSERT(icmph->icmph_type == ICMP_DEST_UNREACHABLE &&
2093 	    icmph->icmph_code == ICMP_FRAGMENTATION_NEEDED);
2094 
2095 	hdr_length = IPH_HDR_LENGTH(ipha);
2096 
2097 	first_ire = ire_ctable_lookup(ipha->ipha_dst, 0, IRE_CACHE, NULL,
2098 	    ALL_ZONES, MATCH_IRE_TYPE);
2099 
2100 	if (!first_ire) {
2101 		ip1dbg(("icmp_inbound_too_big: no route for 0x%x\n",
2102 		    ntohl(ipha->ipha_dst)));
2103 		return (B_FALSE);
2104 	}
2105 	/* Drop if the original packet contained a source route */
2106 	if (ip_source_route_included(ipha)) {
2107 		ire_refrele(first_ire);
2108 		return (B_FALSE);
2109 	}
2110 	/* Check for MTU discovery advice as described in RFC 1191 */
2111 	mtu = ntohs(icmph->icmph_du_mtu);
2112 	rw_enter(&first_ire->ire_bucket->irb_lock, RW_READER);
2113 	for (ire = first_ire; ire != NULL && ire->ire_addr == ipha->ipha_dst;
2114 	    ire = ire->ire_next) {
2115 		mutex_enter(&ire->ire_lock);
2116 		if (icmph->icmph_du_zero == 0 && mtu > 68) {
2117 			/* Reduce the IRE max frag value as advised. */
2118 			ire->ire_max_frag = MIN(ire->ire_max_frag, mtu);
2119 			ip1dbg(("Received mtu from router: %d\n", mtu));
2120 		} else {
2121 			uint32_t length;
2122 			int	i;
2123 
2124 			/*
2125 			 * Use the table from RFC 1191 to figure out
2126 			 * the next "plateau" based on the length in
2127 			 * the original IP packet.
2128 			 */
2129 			length = ntohs(ipha->ipha_length);
2130 			if (ire->ire_max_frag <= length &&
2131 			    ire->ire_max_frag >= length - hdr_length) {
2132 				/*
2133 				 * Handle broken BSD 4.2 systems that
2134 				 * return the wrong iph_length in ICMP
2135 				 * errors.
2136 				 */
2137 				ip1dbg(("Wrong mtu: sent %d, ire %d\n",
2138 				    length, ire->ire_max_frag));
2139 				length -= hdr_length;
2140 			}
2141 			for (i = 0; i < A_CNT(icmp_frag_size_table); i++) {
2142 				if (length > icmp_frag_size_table[i])
2143 					break;
2144 			}
2145 			if (i == A_CNT(icmp_frag_size_table)) {
2146 				/* Smaller than 68! */
2147 				ip1dbg(("Too big for packet size %d\n",
2148 				    length));
2149 				ire->ire_max_frag = MIN(ire->ire_max_frag, 576);
2150 				ire->ire_frag_flag = 0;
2151 			} else {
2152 				mtu = icmp_frag_size_table[i];
2153 				ip1dbg(("Calculated mtu %d, packet size %d, "
2154 				    "before %d", mtu, length,
2155 				    ire->ire_max_frag));
2156 				ire->ire_max_frag = MIN(ire->ire_max_frag, mtu);
2157 				ip1dbg((", after %d\n", ire->ire_max_frag));
2158 			}
2159 			/* Record the new max frag size for the ULP. */
2160 			icmph->icmph_du_zero = 0;
2161 			icmph->icmph_du_mtu =
2162 			    htons((uint16_t)ire->ire_max_frag);
2163 		}
2164 		mutex_exit(&ire->ire_lock);
2165 	}
2166 	rw_exit(&first_ire->ire_bucket->irb_lock);
2167 	ire_refrele(first_ire);
2168 	return (B_TRUE);
2169 }
2170 
2171 /*
2172  * If the packet in error is Self-Encapsulated, icmp_inbound_error_fanout
2173  * calls this function.
2174  */
2175 static mblk_t *
2176 icmp_inbound_self_encap_error(mblk_t *mp, int iph_hdr_length, int hdr_length)
2177 {
2178 	ipha_t *ipha;
2179 	icmph_t *icmph;
2180 	ipha_t *in_ipha;
2181 	int length;
2182 
2183 	ASSERT(mp->b_datap->db_type == M_DATA);
2184 
2185 	/*
2186 	 * For Self-encapsulated packets, we added an extra IP header
2187 	 * without the options. Inner IP header is the one from which
2188 	 * the outer IP header was formed. Thus, we need to remove the
2189 	 * outer IP header. To do this, we pullup the whole message
2190 	 * and overlay whatever follows the outer IP header over the
2191 	 * outer IP header.
2192 	 */
2193 
2194 	if (!pullupmsg(mp, -1)) {
2195 		BUMP_MIB(&ip_mib, ipInDiscards);
2196 		return (NULL);
2197 	}
2198 
2199 	icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length];
2200 	ipha = (ipha_t *)&icmph[1];
2201 	in_ipha = (ipha_t *)((uchar_t *)ipha + hdr_length);
2202 
2203 	/*
2204 	 * The length that we want to overlay is following the inner
2205 	 * IP header. Subtracting the IP header + icmp header + outer
2206 	 * IP header's length should give us the length that we want to
2207 	 * overlay.
2208 	 */
2209 	length = msgdsize(mp) - iph_hdr_length - sizeof (icmph_t) -
2210 	    hdr_length;
2211 	/*
2212 	 * Overlay whatever follows the inner header over the
2213 	 * outer header.
2214 	 */
2215 	bcopy((uchar_t *)in_ipha, (uchar_t *)ipha, length);
2216 
2217 	/* Set the wptr to account for the outer header */
2218 	mp->b_wptr -= hdr_length;
2219 	return (mp);
2220 }
2221 
2222 /*
2223  * Try to pass the ICMP message upstream in case the ULP cares.
2224  *
2225  * If the packet that caused the ICMP error is secure, we send
2226  * it to AH/ESP to make sure that the attached packet has a
2227  * valid association. ipha in the code below points to the
2228  * IP header of the packet that caused the error.
2229  *
2230  * We handle ICMP_FRAGMENTATION_NEEDED(IFN) message differently
2231  * in the context of IPSEC. Normally we tell the upper layer
2232  * whenever we send the ire (including ip_bind), the IPSEC header
2233  * length in ire_ipsec_overhead. TCP can deduce the MSS as it
2234  * has both the MTU (ire_max_frag) and the ire_ipsec_overhead.
2235  * Similarly, we pass the new MTU icmph_du_mtu and TCP does the
2236  * same thing. As TCP has the IPSEC options size that needs to be
2237  * adjusted, we just pass the MTU unchanged.
2238  *
2239  * IFN could have been generated locally or by some router.
2240  *
2241  * LOCAL : *ip_wput_ire -> icmp_frag_needed could have generated this.
2242  *	    This happens because IP adjusted its value of MTU on an
2243  *	    earlier IFN message and could not tell the upper layer,
2244  *	    the new adjusted value of MTU e.g. Packet was encrypted
2245  *	    or there was not enough information to fanout to upper
2246  *	    layers. Thus on the next outbound datagram, ip_wput_ire
2247  *	    generates the IFN, where IPSEC processing has *not* been
2248  *	    done.
2249  *
2250  *	   *ip_wput_ire_fragmentit -> ip_wput_frag -> icmp_frag_needed
2251  *	    could have generated this. This happens because ire_max_frag
2252  *	    value in IP was set to a new value, while the IPSEC processing
2253  *	    was being done and after we made the fragmentation check in
2254  *	    ip_wput_ire. Thus on return from IPSEC processing,
2255  *	    ip_wput_ipsec_out finds that the new length is > ire_max_frag
2256  *	    and generates the IFN. As IPSEC processing is over, we fanout
2257  *	    to AH/ESP to remove the header.
2258  *
2259  *	    In both these cases, ipsec_in_loopback will be set indicating
2260  *	    that IFN was generated locally.
2261  *
2262  * ROUTER : IFN could be secure or non-secure.
2263  *
2264  *	    * SECURE : We use the IPSEC_IN to fanout to AH/ESP if the
2265  *	      packet in error has AH/ESP headers to validate the AH/ESP
2266  *	      headers. AH/ESP will verify whether there is a valid SA or
2267  *	      not and send it back. We will fanout again if we have more
2268  *	      data in the packet.
2269  *
2270  *	      If the packet in error does not have AH/ESP, we handle it
2271  *	      like any other case.
2272  *
2273  *	    * NON_SECURE : If the packet in error has AH/ESP headers,
2274  *	      we attach a dummy ipsec_in and send it up to AH/ESP
2275  *	      for validation. AH/ESP will verify whether there is a
2276  *	      valid SA or not and send it back. We will fanout again if
2277  *	      we have more data in the packet.
2278  *
2279  *	      If the packet in error does not have AH/ESP, we handle it
2280  *	      like any other case.
2281  */
2282 static void
2283 icmp_inbound_error_fanout(queue_t *q, ill_t *ill, mblk_t *mp,
2284     icmph_t *icmph, ipha_t *ipha, int iph_hdr_length, int hdr_length,
2285     boolean_t mctl_present, boolean_t ip_policy, ill_t *recv_ill,
2286     zoneid_t zoneid)
2287 {
2288 	uint16_t *up;	/* Pointer to ports in ULP header */
2289 	uint32_t ports;	/* reversed ports for fanout */
2290 	ipha_t ripha;	/* With reversed addresses */
2291 	mblk_t *first_mp;
2292 	ipsec_in_t *ii;
2293 	tcph_t	*tcph;
2294 	conn_t	*connp;
2295 
2296 	first_mp = mp;
2297 	if (mctl_present) {
2298 		mp = first_mp->b_cont;
2299 		ASSERT(mp != NULL);
2300 
2301 		ii = (ipsec_in_t *)first_mp->b_rptr;
2302 		ASSERT(ii->ipsec_in_type == IPSEC_IN);
2303 	} else {
2304 		ii = NULL;
2305 	}
2306 
2307 	switch (ipha->ipha_protocol) {
2308 	case IPPROTO_UDP:
2309 		/*
2310 		 * Verify we have at least ICMP_MIN_TP_HDR_LEN bytes of
2311 		 * transport header.
2312 		 */
2313 		if ((uchar_t *)ipha + hdr_length + ICMP_MIN_TP_HDR_LEN >
2314 		    mp->b_wptr) {
2315 			if (!pullupmsg(mp, (uchar_t *)ipha + hdr_length +
2316 			    ICMP_MIN_TP_HDR_LEN - mp->b_rptr)) {
2317 				BUMP_MIB(&ip_mib, ipInDiscards);
2318 				goto drop_pkt;
2319 			}
2320 			icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length];
2321 			ipha = (ipha_t *)&icmph[1];
2322 		}
2323 		up = (uint16_t *)((uchar_t *)ipha + hdr_length);
2324 
2325 		/*
2326 		 * Attempt to find a client stream based on port.
2327 		 * Note that we do a reverse lookup since the header is
2328 		 * in the form we sent it out.
2329 		 * The ripha header is only used for the IP_UDP_MATCH and we
2330 		 * only set the src and dst addresses and protocol.
2331 		 */
2332 		ripha.ipha_src = ipha->ipha_dst;
2333 		ripha.ipha_dst = ipha->ipha_src;
2334 		ripha.ipha_protocol = ipha->ipha_protocol;
2335 		((uint16_t *)&ports)[0] = up[1];
2336 		((uint16_t *)&ports)[1] = up[0];
2337 		ip2dbg(("icmp_inbound_error: UDP %x:%d to %x:%d: %d/%d\n",
2338 		    ntohl(ipha->ipha_src), ntohs(up[0]),
2339 		    ntohl(ipha->ipha_dst), ntohs(up[1]),
2340 		    icmph->icmph_type, icmph->icmph_code));
2341 
2342 		/* Have to change db_type after any pullupmsg */
2343 		DB_TYPE(mp) = M_CTL;
2344 
2345 		ip_fanout_udp(q, first_mp, ill, &ripha, ports, B_FALSE, 0,
2346 		    mctl_present, ip_policy, recv_ill, zoneid);
2347 		return;
2348 
2349 	case IPPROTO_TCP:
2350 		/*
2351 		 * Verify we have at least ICMP_MIN_TP_HDR_LEN bytes of
2352 		 * transport header.
2353 		 */
2354 		if ((uchar_t *)ipha + hdr_length + ICMP_MIN_TP_HDR_LEN >
2355 		    mp->b_wptr) {
2356 			if (!pullupmsg(mp, (uchar_t *)ipha + hdr_length +
2357 			    ICMP_MIN_TP_HDR_LEN - mp->b_rptr)) {
2358 				BUMP_MIB(&ip_mib, ipInDiscards);
2359 				goto drop_pkt;
2360 			}
2361 			icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length];
2362 			ipha = (ipha_t *)&icmph[1];
2363 		}
2364 		/*
2365 		 * Find a TCP client stream for this packet.
2366 		 * Note that we do a reverse lookup since the header is
2367 		 * in the form we sent it out.
2368 		 */
2369 		tcph = (tcph_t *)((uchar_t *)ipha + hdr_length);
2370 		connp = ipcl_tcp_lookup_reversed_ipv4(ipha, tcph, TCPS_LISTEN);
2371 		if (connp == NULL) {
2372 			BUMP_MIB(&ip_mib, ipInDiscards);
2373 			goto drop_pkt;
2374 		}
2375 
2376 		/* Have to change db_type after any pullupmsg */
2377 		DB_TYPE(mp) = M_CTL;
2378 		squeue_fill(connp->conn_sqp, first_mp, tcp_input,
2379 		    connp, SQTAG_TCP_INPUT_ICMP_ERR);
2380 		return;
2381 
2382 	case IPPROTO_SCTP:
2383 		/*
2384 		 * Verify we have at least ICMP_MIN_TP_HDR_LEN bytes of
2385 		 * transport header.
2386 		 */
2387 		if ((uchar_t *)ipha + hdr_length + ICMP_MIN_TP_HDR_LEN >
2388 		    mp->b_wptr) {
2389 			if (!pullupmsg(mp, (uchar_t *)ipha + hdr_length +
2390 			    ICMP_MIN_TP_HDR_LEN - mp->b_rptr)) {
2391 				BUMP_MIB(&ip_mib, ipInDiscards);
2392 				goto drop_pkt;
2393 			}
2394 			icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length];
2395 			ipha = (ipha_t *)&icmph[1];
2396 		}
2397 		up = (uint16_t *)((uchar_t *)ipha + hdr_length);
2398 		/*
2399 		 * Find a SCTP client stream for this packet.
2400 		 * Note that we do a reverse lookup since the header is
2401 		 * in the form we sent it out.
2402 		 * The ripha header is only used for the matching and we
2403 		 * only set the src and dst addresses, protocol, and version.
2404 		 */
2405 		ripha.ipha_src = ipha->ipha_dst;
2406 		ripha.ipha_dst = ipha->ipha_src;
2407 		ripha.ipha_protocol = ipha->ipha_protocol;
2408 		ripha.ipha_version_and_hdr_length =
2409 		    ipha->ipha_version_and_hdr_length;
2410 		((uint16_t *)&ports)[0] = up[1];
2411 		((uint16_t *)&ports)[1] = up[0];
2412 
2413 		/* Have to change db_type after any pullupmsg */
2414 		DB_TYPE(mp) = M_CTL;
2415 		ip_fanout_sctp(first_mp, recv_ill, &ripha, ports, 0,
2416 		    mctl_present, ip_policy, 0, zoneid);
2417 		return;
2418 
2419 	case IPPROTO_ESP:
2420 	case IPPROTO_AH: {
2421 		int ipsec_rc;
2422 
2423 		/*
2424 		 * We need a IPSEC_IN in the front to fanout to AH/ESP.
2425 		 * We will re-use the IPSEC_IN if it is already present as
2426 		 * AH/ESP will not affect any fields in the IPSEC_IN for
2427 		 * ICMP errors. If there is no IPSEC_IN, allocate a new
2428 		 * one and attach it in the front.
2429 		 */
2430 		if (ii != NULL) {
2431 			/*
2432 			 * ip_fanout_proto_again converts the ICMP errors
2433 			 * that come back from AH/ESP to M_DATA so that
2434 			 * if it is non-AH/ESP and we do a pullupmsg in
2435 			 * this function, it would work. Convert it back
2436 			 * to M_CTL before we send up as this is a ICMP
2437 			 * error. This could have been generated locally or
2438 			 * by some router. Validate the inner IPSEC
2439 			 * headers.
2440 			 *
2441 			 * NOTE : ill_index is used by ip_fanout_proto_again
2442 			 * to locate the ill.
2443 			 */
2444 			ASSERT(ill != NULL);
2445 			ii->ipsec_in_ill_index =
2446 			    ill->ill_phyint->phyint_ifindex;
2447 			ii->ipsec_in_rill_index =
2448 			    recv_ill->ill_phyint->phyint_ifindex;
2449 			DB_TYPE(first_mp->b_cont) = M_CTL;
2450 		} else {
2451 			/*
2452 			 * IPSEC_IN is not present. We attach a ipsec_in
2453 			 * message and send up to IPSEC for validating
2454 			 * and removing the IPSEC headers. Clear
2455 			 * ipsec_in_secure so that when we return
2456 			 * from IPSEC, we don't mistakenly think that this
2457 			 * is a secure packet came from the network.
2458 			 *
2459 			 * NOTE : ill_index is used by ip_fanout_proto_again
2460 			 * to locate the ill.
2461 			 */
2462 			ASSERT(first_mp == mp);
2463 			first_mp = ipsec_in_alloc(B_TRUE);
2464 			if (first_mp == NULL) {
2465 				freemsg(mp);
2466 				BUMP_MIB(&ip_mib, ipInDiscards);
2467 				return;
2468 			}
2469 			ii = (ipsec_in_t *)first_mp->b_rptr;
2470 
2471 			/* This is not a secure packet */
2472 			ii->ipsec_in_secure = B_FALSE;
2473 			first_mp->b_cont = mp;
2474 			DB_TYPE(mp) = M_CTL;
2475 			ASSERT(ill != NULL);
2476 			ii->ipsec_in_ill_index =
2477 			    ill->ill_phyint->phyint_ifindex;
2478 			ii->ipsec_in_rill_index =
2479 			    recv_ill->ill_phyint->phyint_ifindex;
2480 		}
2481 		ip2dbg(("icmp_inbound_error: ipsec\n"));
2482 
2483 		if (!ipsec_loaded()) {
2484 			ip_proto_not_sup(q, first_mp, 0, zoneid);
2485 			return;
2486 		}
2487 
2488 		if (ipha->ipha_protocol == IPPROTO_ESP)
2489 			ipsec_rc = ipsecesp_icmp_error(first_mp);
2490 		else
2491 			ipsec_rc = ipsecah_icmp_error(first_mp);
2492 		if (ipsec_rc == IPSEC_STATUS_FAILED)
2493 			return;
2494 
2495 		ip_fanout_proto_again(first_mp, ill, recv_ill, NULL);
2496 		return;
2497 	}
2498 	default:
2499 		/*
2500 		 * The ripha header is only used for the lookup and we
2501 		 * only set the src and dst addresses and protocol.
2502 		 */
2503 		ripha.ipha_src = ipha->ipha_dst;
2504 		ripha.ipha_dst = ipha->ipha_src;
2505 		ripha.ipha_protocol = ipha->ipha_protocol;
2506 		ip2dbg(("icmp_inbound_error: proto %d %x to %x: %d/%d\n",
2507 		    ripha.ipha_protocol, ntohl(ipha->ipha_src),
2508 		    ntohl(ipha->ipha_dst),
2509 		    icmph->icmph_type, icmph->icmph_code));
2510 		if (ipha->ipha_protocol == IPPROTO_ENCAP) {
2511 			ipha_t *in_ipha;
2512 
2513 			if ((uchar_t *)ipha + hdr_length + sizeof (ipha_t) >
2514 			    mp->b_wptr) {
2515 				if (!pullupmsg(mp, (uchar_t *)ipha +
2516 				    hdr_length + sizeof (ipha_t) -
2517 				    mp->b_rptr)) {
2518 
2519 					BUMP_MIB(&ip_mib, ipInDiscards);
2520 					goto drop_pkt;
2521 				}
2522 				icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length];
2523 				ipha = (ipha_t *)&icmph[1];
2524 			}
2525 			/*
2526 			 * Caller has verified that length has to be
2527 			 * at least the size of IP header.
2528 			 */
2529 			ASSERT(hdr_length >= sizeof (ipha_t));
2530 			/*
2531 			 * Check the sanity of the inner IP header like
2532 			 * we did for the outer header.
2533 			 */
2534 			in_ipha = (ipha_t *)((uchar_t *)ipha + hdr_length);
2535 			if ((IPH_HDR_VERSION(in_ipha) != IPV4_VERSION)) {
2536 				BUMP_MIB(&ip_mib, ipInDiscards);
2537 				goto drop_pkt;
2538 			}
2539 			if (IPH_HDR_LENGTH(in_ipha) < sizeof (ipha_t)) {
2540 				BUMP_MIB(&ip_mib, ipInDiscards);
2541 				goto drop_pkt;
2542 			}
2543 			/* Check for Self-encapsulated tunnels */
2544 			if (in_ipha->ipha_src == ipha->ipha_src &&
2545 			    in_ipha->ipha_dst == ipha->ipha_dst) {
2546 
2547 				mp = icmp_inbound_self_encap_error(mp,
2548 				    iph_hdr_length, hdr_length);
2549 				if (mp == NULL)
2550 					goto drop_pkt;
2551 				icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length];
2552 				ipha = (ipha_t *)&icmph[1];
2553 				hdr_length = IPH_HDR_LENGTH(ipha);
2554 				/*
2555 				 * The packet in error is self-encapsualted.
2556 				 * And we are finding it further encapsulated
2557 				 * which we could not have possibly generated.
2558 				 */
2559 				if (ipha->ipha_protocol == IPPROTO_ENCAP) {
2560 					BUMP_MIB(&ip_mib, ipInDiscards);
2561 					goto drop_pkt;
2562 				}
2563 				icmp_inbound_error_fanout(q, ill, first_mp,
2564 				    icmph, ipha, iph_hdr_length, hdr_length,
2565 				    mctl_present, ip_policy, recv_ill, zoneid);
2566 				return;
2567 			}
2568 		}
2569 		if ((ipha->ipha_protocol == IPPROTO_ENCAP ||
2570 			ipha->ipha_protocol == IPPROTO_IPV6) &&
2571 		    icmph->icmph_code == ICMP_FRAGMENTATION_NEEDED &&
2572 		    ii != NULL &&
2573 		    ii->ipsec_in_loopback &&
2574 		    ii->ipsec_in_secure) {
2575 			/*
2576 			 * For IP tunnels that get a looped-back
2577 			 * ICMP_FRAGMENTATION_NEEDED message, adjust the
2578 			 * reported new MTU to take into account the IPsec
2579 			 * headers protecting this configured tunnel.
2580 			 *
2581 			 * This allows the tunnel module (tun.c) to blindly
2582 			 * accept the MTU reported in an ICMP "too big"
2583 			 * message.
2584 			 *
2585 			 * Non-looped back ICMP messages will just be
2586 			 * handled by the security protocols (if needed),
2587 			 * and the first subsequent packet will hit this
2588 			 * path.
2589 			 */
2590 			icmph->icmph_du_mtu = htons(ntohs(icmph->icmph_du_mtu) -
2591 			    ipsec_in_extra_length(first_mp));
2592 		}
2593 		/* Have to change db_type after any pullupmsg */
2594 		DB_TYPE(mp) = M_CTL;
2595 
2596 		ip_fanout_proto(q, first_mp, ill, &ripha, 0, mctl_present,
2597 		    ip_policy, recv_ill, zoneid);
2598 		return;
2599 	}
2600 	/* NOTREACHED */
2601 drop_pkt:;
2602 	ip1dbg(("icmp_inbound_error_fanout: drop pkt\n"));
2603 	freemsg(first_mp);
2604 }
2605 
2606 /*
2607  * Common IP options parser.
2608  *
2609  * Setup routine: fill in *optp with options-parsing state, then
2610  * tail-call ipoptp_next to return the first option.
2611  */
2612 uint8_t
2613 ipoptp_first(ipoptp_t *optp, ipha_t *ipha)
2614 {
2615 	uint32_t totallen; /* total length of all options */
2616 
2617 	totallen = ipha->ipha_version_and_hdr_length -
2618 	    (uint8_t)((IP_VERSION << 4) + IP_SIMPLE_HDR_LENGTH_IN_WORDS);
2619 	totallen <<= 2;
2620 	optp->ipoptp_next = (uint8_t *)(&ipha[1]);
2621 	optp->ipoptp_end = optp->ipoptp_next + totallen;
2622 	optp->ipoptp_flags = 0;
2623 	return (ipoptp_next(optp));
2624 }
2625 
2626 /*
2627  * Common IP options parser: extract next option.
2628  */
2629 uint8_t
2630 ipoptp_next(ipoptp_t *optp)
2631 {
2632 	uint8_t *end = optp->ipoptp_end;
2633 	uint8_t *cur = optp->ipoptp_next;
2634 	uint8_t opt, len, pointer;
2635 
2636 	/*
2637 	 * If cur > end already, then the ipoptp_end or ipoptp_next pointer
2638 	 * has been corrupted.
2639 	 */
2640 	ASSERT(cur <= end);
2641 
2642 	if (cur == end)
2643 		return (IPOPT_EOL);
2644 
2645 	opt = cur[IPOPT_OPTVAL];
2646 
2647 	/*
2648 	 * Skip any NOP options.
2649 	 */
2650 	while (opt == IPOPT_NOP) {
2651 		cur++;
2652 		if (cur == end)
2653 			return (IPOPT_EOL);
2654 		opt = cur[IPOPT_OPTVAL];
2655 	}
2656 
2657 	if (opt == IPOPT_EOL)
2658 		return (IPOPT_EOL);
2659 
2660 	/*
2661 	 * Option requiring a length.
2662 	 */
2663 	if ((cur + 1) >= end) {
2664 		optp->ipoptp_flags |= IPOPTP_ERROR;
2665 		return (IPOPT_EOL);
2666 	}
2667 	len = cur[IPOPT_OLEN];
2668 	if (len < 2) {
2669 		optp->ipoptp_flags |= IPOPTP_ERROR;
2670 		return (IPOPT_EOL);
2671 	}
2672 	optp->ipoptp_cur = cur;
2673 	optp->ipoptp_len = len;
2674 	optp->ipoptp_next = cur + len;
2675 	if (cur + len > end) {
2676 		optp->ipoptp_flags |= IPOPTP_ERROR;
2677 		return (IPOPT_EOL);
2678 	}
2679 
2680 	/*
2681 	 * For the options which require a pointer field, make sure
2682 	 * its there, and make sure it points to either something
2683 	 * inside this option, or the end of the option.
2684 	 */
2685 	switch (opt) {
2686 	case IPOPT_RR:
2687 	case IPOPT_TS:
2688 	case IPOPT_LSRR:
2689 	case IPOPT_SSRR:
2690 		if (len <= IPOPT_OFFSET) {
2691 			optp->ipoptp_flags |= IPOPTP_ERROR;
2692 			return (opt);
2693 		}
2694 		pointer = cur[IPOPT_OFFSET];
2695 		if (pointer - 1 > len) {
2696 			optp->ipoptp_flags |= IPOPTP_ERROR;
2697 			return (opt);
2698 		}
2699 		break;
2700 	}
2701 
2702 	/*
2703 	 * Sanity check the pointer field based on the type of the
2704 	 * option.
2705 	 */
2706 	switch (opt) {
2707 	case IPOPT_RR:
2708 	case IPOPT_SSRR:
2709 	case IPOPT_LSRR:
2710 		if (pointer < IPOPT_MINOFF_SR)
2711 			optp->ipoptp_flags |= IPOPTP_ERROR;
2712 		break;
2713 	case IPOPT_TS:
2714 		if (pointer < IPOPT_MINOFF_IT)
2715 			optp->ipoptp_flags |= IPOPTP_ERROR;
2716 		/*
2717 		 * Note that the Internet Timestamp option also
2718 		 * contains two four bit fields (the Overflow field,
2719 		 * and the Flag field), which follow the pointer
2720 		 * field.  We don't need to check that these fields
2721 		 * fall within the length of the option because this
2722 		 * was implicitely done above.  We've checked that the
2723 		 * pointer value is at least IPOPT_MINOFF_IT, and that
2724 		 * it falls within the option.  Since IPOPT_MINOFF_IT >
2725 		 * IPOPT_POS_OV_FLG, we don't need the explicit check.
2726 		 */
2727 		ASSERT(len > IPOPT_POS_OV_FLG);
2728 		break;
2729 	}
2730 
2731 	return (opt);
2732 }
2733 
2734 /*
2735  * Update any record route or timestamp options to include this host.
2736  * Reverse any source route option.
2737  * This routine assumes that the options are well formed i.e. that they
2738  * have already been checked.
2739  */
2740 static void
2741 icmp_options_update(ipha_t *ipha)
2742 {
2743 	ipoptp_t	opts;
2744 	uchar_t		*opt;
2745 	uint8_t		optval;
2746 	ipaddr_t	src;		/* Our local address */
2747 	ipaddr_t	dst;
2748 
2749 	ip2dbg(("icmp_options_update\n"));
2750 	src = ipha->ipha_src;
2751 	dst = ipha->ipha_dst;
2752 
2753 	for (optval = ipoptp_first(&opts, ipha);
2754 	    optval != IPOPT_EOL;
2755 	    optval = ipoptp_next(&opts)) {
2756 		ASSERT((opts.ipoptp_flags & IPOPTP_ERROR) == 0);
2757 		opt = opts.ipoptp_cur;
2758 		ip2dbg(("icmp_options_update: opt %d, len %d\n",
2759 		    optval, opts.ipoptp_len));
2760 		switch (optval) {
2761 			int off1, off2;
2762 		case IPOPT_SSRR:
2763 		case IPOPT_LSRR:
2764 			/*
2765 			 * Reverse the source route.  The first entry
2766 			 * should be the next to last one in the current
2767 			 * source route (the last entry is our address).
2768 			 * The last entry should be the final destination.
2769 			 */
2770 			off1 = IPOPT_MINOFF_SR - 1;
2771 			off2 = opt[IPOPT_OFFSET] - IP_ADDR_LEN - 1;
2772 			if (off2 < 0) {
2773 				/* No entries in source route */
2774 				ip1dbg((
2775 				    "icmp_options_update: bad src route\n"));
2776 				break;
2777 			}
2778 			bcopy((char *)opt + off2, &dst, IP_ADDR_LEN);
2779 			bcopy(&ipha->ipha_dst, (char *)opt + off2, IP_ADDR_LEN);
2780 			bcopy(&dst, &ipha->ipha_dst, IP_ADDR_LEN);
2781 			off2 -= IP_ADDR_LEN;
2782 
2783 			while (off1 < off2) {
2784 				bcopy((char *)opt + off1, &src, IP_ADDR_LEN);
2785 				bcopy((char *)opt + off2, (char *)opt + off1,
2786 				    IP_ADDR_LEN);
2787 				bcopy(&src, (char *)opt + off2, IP_ADDR_LEN);
2788 				off1 += IP_ADDR_LEN;
2789 				off2 -= IP_ADDR_LEN;
2790 			}
2791 			opt[IPOPT_OFFSET] = IPOPT_MINOFF_SR;
2792 			break;
2793 		}
2794 	}
2795 }
2796 
2797 /*
2798  * Process received ICMP Redirect messages.
2799  */
2800 /* ARGSUSED */
2801 static void
2802 icmp_redirect(mblk_t *mp)
2803 {
2804 	ipha_t	*ipha;
2805 	int	iph_hdr_length;
2806 	icmph_t	*icmph;
2807 	ipha_t	*ipha_err;
2808 	ire_t	*ire;
2809 	ire_t	*prev_ire;
2810 	ire_t	*save_ire;
2811 	ipaddr_t  src, dst, gateway;
2812 	iulp_t	ulp_info = { 0 };
2813 	int	error;
2814 
2815 	ipha = (ipha_t *)mp->b_rptr;
2816 	iph_hdr_length = IPH_HDR_LENGTH(ipha);
2817 	if (((mp->b_wptr - mp->b_rptr) - iph_hdr_length) <
2818 	    sizeof (icmph_t) + IP_SIMPLE_HDR_LENGTH) {
2819 		BUMP_MIB(&icmp_mib, icmpInErrors);
2820 		freemsg(mp);
2821 		return;
2822 	}
2823 	icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length];
2824 	ipha_err = (ipha_t *)&icmph[1];
2825 	src = ipha->ipha_src;
2826 	dst = ipha_err->ipha_dst;
2827 	gateway = icmph->icmph_rd_gateway;
2828 	/* Make sure the new gateway is reachable somehow. */
2829 	ire = ire_route_lookup(gateway, 0, 0, IRE_INTERFACE, NULL, NULL,
2830 	    ALL_ZONES, MATCH_IRE_TYPE);
2831 	/*
2832 	 * Make sure we had a route for the dest in question and that
2833 	 * that route was pointing to the old gateway (the source of the
2834 	 * redirect packet.)
2835 	 */
2836 	prev_ire = ire_route_lookup(dst, 0, src, 0, NULL, NULL, ALL_ZONES,
2837 	    MATCH_IRE_GW);
2838 	/*
2839 	 * Check that
2840 	 *	the redirect was not from ourselves
2841 	 *	the new gateway and the old gateway are directly reachable
2842 	 */
2843 	if (!prev_ire ||
2844 	    !ire ||
2845 	    ire->ire_type == IRE_LOCAL) {
2846 		BUMP_MIB(&icmp_mib, icmpInBadRedirects);
2847 		freemsg(mp);
2848 		if (ire != NULL)
2849 			ire_refrele(ire);
2850 		if (prev_ire != NULL)
2851 			ire_refrele(prev_ire);
2852 		return;
2853 	}
2854 
2855 	/*
2856 	 * Should we use the old ULP info to create the new gateway?  From
2857 	 * a user's perspective, we should inherit the info so that it
2858 	 * is a "smooth" transition.  If we do not do that, then new
2859 	 * connections going thru the new gateway will have no route metrics,
2860 	 * which is counter-intuitive to user.  From a network point of
2861 	 * view, this may or may not make sense even though the new gateway
2862 	 * is still directly connected to us so the route metrics should not
2863 	 * change much.
2864 	 *
2865 	 * But if the old ire_uinfo is not initialized, we do another
2866 	 * recursive lookup on the dest using the new gateway.  There may
2867 	 * be a route to that.  If so, use it to initialize the redirect
2868 	 * route.
2869 	 */
2870 	if (prev_ire->ire_uinfo.iulp_set) {
2871 		bcopy(&prev_ire->ire_uinfo, &ulp_info, sizeof (iulp_t));
2872 	} else {
2873 		ire_t *tmp_ire;
2874 		ire_t *sire;
2875 
2876 		tmp_ire = ire_ftable_lookup(dst, 0, gateway, 0, NULL, &sire,
2877 		    ALL_ZONES, 0,
2878 		    (MATCH_IRE_RECURSIVE | MATCH_IRE_GW | MATCH_IRE_DEFAULT));
2879 		if (sire != NULL) {
2880 			bcopy(&sire->ire_uinfo, &ulp_info, sizeof (iulp_t));
2881 			/*
2882 			 * If sire != NULL, ire_ftable_lookup() should not
2883 			 * return a NULL value.
2884 			 */
2885 			ASSERT(tmp_ire != NULL);
2886 			ire_refrele(tmp_ire);
2887 			ire_refrele(sire);
2888 		} else if (tmp_ire != NULL) {
2889 			bcopy(&tmp_ire->ire_uinfo, &ulp_info,
2890 			    sizeof (iulp_t));
2891 			ire_refrele(tmp_ire);
2892 		}
2893 	}
2894 	if (prev_ire->ire_type == IRE_CACHE)
2895 		ire_delete(prev_ire);
2896 	ire_refrele(prev_ire);
2897 	/*
2898 	 * TODO: more precise handling for cases 0, 2, 3, the latter two
2899 	 * require TOS routing
2900 	 */
2901 	switch (icmph->icmph_code) {
2902 	case 0:
2903 	case 1:
2904 		/* TODO: TOS specificity for cases 2 and 3 */
2905 	case 2:
2906 	case 3:
2907 		break;
2908 	default:
2909 		freemsg(mp);
2910 		BUMP_MIB(&icmp_mib, icmpInBadRedirects);
2911 		ire_refrele(ire);
2912 		return;
2913 	}
2914 	/*
2915 	 * Create a Route Association.  This will allow us to remember that
2916 	 * someone we believe told us to use the particular gateway.
2917 	 */
2918 	save_ire = ire;
2919 	ire = ire_create(
2920 		(uchar_t *)&dst,			/* dest addr */
2921 		(uchar_t *)&ip_g_all_ones,		/* mask */
2922 		(uchar_t *)&save_ire->ire_src_addr,	/* source addr */
2923 		(uchar_t *)&gateway,			/* gateway addr */
2924 		NULL,					/* no in_srcaddr */
2925 		&save_ire->ire_max_frag,		/* max frag */
2926 		NULL,					/* Fast Path header */
2927 		NULL,					/* no rfq */
2928 		NULL,					/* no stq */
2929 		IRE_HOST_REDIRECT,
2930 		NULL,
2931 		NULL,
2932 		NULL,
2933 		0,
2934 		0,
2935 		0,
2936 		(RTF_DYNAMIC | RTF_GATEWAY | RTF_HOST),
2937 		&ulp_info);
2938 
2939 	if (ire == NULL) {
2940 		freemsg(mp);
2941 		ire_refrele(save_ire);
2942 		return;
2943 	}
2944 	error = ire_add(&ire, NULL, NULL, NULL);
2945 	ire_refrele(save_ire);
2946 	if (error == 0) {
2947 		ire_refrele(ire);		/* Held in ire_add_v4 */
2948 		/* tell routing sockets that we received a redirect */
2949 		ip_rts_change(RTM_REDIRECT, dst, gateway, IP_HOST_MASK, 0, src,
2950 		    (RTF_DYNAMIC | RTF_GATEWAY | RTF_HOST), 0,
2951 		    (RTA_DST | RTA_GATEWAY | RTA_NETMASK | RTA_AUTHOR));
2952 	}
2953 
2954 	/*
2955 	 * Delete any existing IRE_HOST_REDIRECT for this destination.
2956 	 * This together with the added IRE has the effect of
2957 	 * modifying an existing redirect.
2958 	 */
2959 	prev_ire = ire_ftable_lookup(dst, 0, src, IRE_HOST_REDIRECT, NULL, NULL,
2960 	    ALL_ZONES, 0, (MATCH_IRE_GW | MATCH_IRE_TYPE));
2961 	if (prev_ire) {
2962 		ire_delete(prev_ire);
2963 		ire_refrele(prev_ire);
2964 	}
2965 
2966 	freemsg(mp);
2967 }
2968 
2969 /*
2970  * Generate an ICMP parameter problem message.
2971  */
2972 static void
2973 icmp_param_problem(queue_t *q, mblk_t *mp, uint8_t ptr)
2974 {
2975 	icmph_t	icmph;
2976 	boolean_t mctl_present;
2977 	mblk_t *first_mp;
2978 
2979 	EXTRACT_PKT_MP(mp, first_mp, mctl_present);
2980 
2981 	if (!(mp = icmp_pkt_err_ok(mp))) {
2982 		if (mctl_present)
2983 			freeb(first_mp);
2984 		return;
2985 	}
2986 
2987 	bzero(&icmph, sizeof (icmph_t));
2988 	icmph.icmph_type = ICMP_PARAM_PROBLEM;
2989 	icmph.icmph_pp_ptr = ptr;
2990 	BUMP_MIB(&icmp_mib, icmpOutParmProbs);
2991 	icmp_pkt(q, first_mp, &icmph, sizeof (icmph_t), mctl_present);
2992 }
2993 
2994 /*
2995  * Build and ship an IPv4 ICMP message using the packet data in mp, and
2996  * the ICMP header pointed to by "stuff".  (May be called as writer.)
2997  * Note: assumes that icmp_pkt_err_ok has been called to verify that
2998  * an icmp error packet can be sent.
2999  * Assigns an appropriate source address to the packet. If ipha_dst is
3000  * one of our addresses use it for source. Otherwise pick a source based
3001  * on a route lookup back to ipha_src.
3002  * Note that ipha_src must be set here since the
3003  * packet is likely to arrive on an ill queue in ip_wput() which will
3004  * not set a source address.
3005  */
3006 static void
3007 icmp_pkt(queue_t *q, mblk_t *mp, void *stuff, size_t len,
3008     boolean_t mctl_present)
3009 {
3010 	ipaddr_t dst;
3011 	icmph_t	*icmph;
3012 	ipha_t	*ipha;
3013 	uint_t	len_needed;
3014 	size_t	msg_len;
3015 	mblk_t	*mp1;
3016 	ipaddr_t src;
3017 	ire_t	*ire;
3018 	mblk_t *ipsec_mp;
3019 	ipsec_out_t	*io = NULL;
3020 	boolean_t xmit_if_on = B_FALSE;
3021 	zoneid_t	zoneid;
3022 
3023 	if (mctl_present) {
3024 		/*
3025 		 * If it is :
3026 		 *
3027 		 * 1) a IPSEC_OUT, then this is caused by outbound
3028 		 *    datagram originating on this host. IPSEC processing
3029 		 *    may or may not have been done. Refer to comments above
3030 		 *    icmp_inbound_error_fanout for details.
3031 		 *
3032 		 * 2) a IPSEC_IN if we are generating a icmp_message
3033 		 *    for an incoming datagram destined for us i.e called
3034 		 *    from ip_fanout_send_icmp.
3035 		 */
3036 		ipsec_info_t *in;
3037 		ipsec_mp = mp;
3038 		mp = ipsec_mp->b_cont;
3039 
3040 		in = (ipsec_info_t *)ipsec_mp->b_rptr;
3041 		ipha = (ipha_t *)mp->b_rptr;
3042 
3043 		ASSERT(in->ipsec_info_type == IPSEC_OUT ||
3044 		    in->ipsec_info_type == IPSEC_IN);
3045 
3046 		if (in->ipsec_info_type == IPSEC_IN) {
3047 			/*
3048 			 * Convert the IPSEC_IN to IPSEC_OUT.
3049 			 */
3050 			if (!ipsec_in_to_out(ipsec_mp, ipha, NULL)) {
3051 				BUMP_MIB(&ip_mib, ipOutDiscards);
3052 				return;
3053 			}
3054 			io = (ipsec_out_t *)ipsec_mp->b_rptr;
3055 		} else {
3056 			ASSERT(in->ipsec_info_type == IPSEC_OUT);
3057 			io = (ipsec_out_t *)in;
3058 			if (io->ipsec_out_xmit_if)
3059 				xmit_if_on = B_TRUE;
3060 			/*
3061 			 * Clear out ipsec_out_proc_begin, so we do a fresh
3062 			 * ire lookup.
3063 			 */
3064 			io->ipsec_out_proc_begin = B_FALSE;
3065 		}
3066 		zoneid = io->ipsec_out_zoneid;
3067 		ASSERT(zoneid != ALL_ZONES);
3068 	} else {
3069 		/*
3070 		 * This is in clear. The icmp message we are building
3071 		 * here should go out in clear.
3072 		 *
3073 		 * Pardon the convolution of it all, but it's easier to
3074 		 * allocate a "use cleartext" IPSEC_IN message and convert
3075 		 * it than it is to allocate a new one.
3076 		 */
3077 		ipsec_in_t *ii;
3078 		ASSERT(DB_TYPE(mp) == M_DATA);
3079 		if ((ipsec_mp = ipsec_in_alloc(B_TRUE)) == NULL) {
3080 			freemsg(mp);
3081 			BUMP_MIB(&ip_mib, ipOutDiscards);
3082 			return;
3083 		}
3084 		ii = (ipsec_in_t *)ipsec_mp->b_rptr;
3085 
3086 		/* This is not a secure packet */
3087 		ii->ipsec_in_secure = B_FALSE;
3088 		if (CONN_Q(q)) {
3089 			zoneid = Q_TO_CONN(q)->conn_zoneid;
3090 		} else {
3091 			zoneid = GLOBAL_ZONEID;
3092 		}
3093 		ii->ipsec_in_zoneid = zoneid;
3094 		ipsec_mp->b_cont = mp;
3095 		ipha = (ipha_t *)mp->b_rptr;
3096 		/*
3097 		 * Convert the IPSEC_IN to IPSEC_OUT.
3098 		 */
3099 		if (!ipsec_in_to_out(ipsec_mp, ipha, NULL)) {
3100 			BUMP_MIB(&ip_mib, ipOutDiscards);
3101 			return;
3102 		}
3103 		io = (ipsec_out_t *)ipsec_mp->b_rptr;
3104 	}
3105 
3106 	/* Remember our eventual destination */
3107 	dst = ipha->ipha_src;
3108 
3109 	ire = ire_route_lookup(ipha->ipha_dst, 0, 0, (IRE_LOCAL|IRE_LOOPBACK),
3110 	    NULL, NULL, zoneid, MATCH_IRE_TYPE);
3111 	if (ire != NULL && ire->ire_zoneid == zoneid) {
3112 		src = ipha->ipha_dst;
3113 	} else if (!xmit_if_on) {
3114 		if (ire != NULL)
3115 			ire_refrele(ire);
3116 		ire = ire_route_lookup(dst, 0, 0, 0, NULL, NULL, zoneid,
3117 		    (MATCH_IRE_DEFAULT|MATCH_IRE_RECURSIVE|MATCH_IRE_ZONEONLY));
3118 		if (ire == NULL) {
3119 			BUMP_MIB(&ip_mib, ipOutNoRoutes);
3120 			freemsg(ipsec_mp);
3121 			return;
3122 		}
3123 		src = ire->ire_src_addr;
3124 	} else {
3125 		ipif_t	*ipif = NULL;
3126 		ill_t	*ill;
3127 		/*
3128 		 * This must be an ICMP error coming from
3129 		 * ip_mrtun_forward(). The src addr should
3130 		 * be equal to the IP-addr of the outgoing
3131 		 * interface.
3132 		 */
3133 		if (io == NULL) {
3134 			/* This is not a IPSEC_OUT type control msg */
3135 			BUMP_MIB(&ip_mib, ipOutNoRoutes);
3136 			freemsg(ipsec_mp);
3137 			return;
3138 		}
3139 		ill = ill_lookup_on_ifindex(io->ipsec_out_ill_index, B_FALSE,
3140 		    NULL, NULL, NULL, NULL);
3141 		if (ill != NULL) {
3142 			ipif = ipif_get_next_ipif(NULL, ill);
3143 			ill_refrele(ill);
3144 		}
3145 		if (ipif == NULL) {
3146 			BUMP_MIB(&ip_mib, ipOutNoRoutes);
3147 			freemsg(ipsec_mp);
3148 			return;
3149 		}
3150 		src = ipif->ipif_src_addr;
3151 		ipif_refrele(ipif);
3152 	}
3153 
3154 	if (ire != NULL)
3155 		ire_refrele(ire);
3156 
3157 	/*
3158 	 * Check if we can send back more then 8 bytes in addition
3159 	 * to the IP header. We will include as much as 64 bytes.
3160 	 */
3161 	len_needed = IPH_HDR_LENGTH(ipha) + ip_icmp_return;
3162 	msg_len = msgdsize(mp);
3163 	if (msg_len > len_needed) {
3164 		(void) adjmsg(mp, len_needed - msg_len);
3165 		msg_len = len_needed;
3166 	}
3167 	mp1 = allocb(sizeof (icmp_ipha) + len, BPRI_HI);
3168 	if (!mp1) {
3169 		BUMP_MIB(&icmp_mib, icmpOutErrors);
3170 		freemsg(ipsec_mp);
3171 		return;
3172 	}
3173 	mp1->b_cont = mp;
3174 	mp = mp1;
3175 	ASSERT(ipsec_mp->b_datap->db_type == M_CTL &&
3176 	    ipsec_mp->b_rptr == (uint8_t *)io &&
3177 	    io->ipsec_out_type == IPSEC_OUT);
3178 	ipsec_mp->b_cont = mp;
3179 
3180 	/*
3181 	 * Set ipsec_out_icmp_loopback so we can let the ICMP messages this
3182 	 * node generates be accepted in peace by all on-host destinations.
3183 	 * If we do NOT assume that all on-host destinations trust
3184 	 * self-generated ICMP messages, then rework here, ip6.c, and spd.c.
3185 	 * (Look for ipsec_out_icmp_loopback).
3186 	 */
3187 	io->ipsec_out_icmp_loopback = B_TRUE;
3188 
3189 	ipha = (ipha_t *)mp->b_rptr;
3190 	mp1->b_wptr = (uchar_t *)ipha + (sizeof (icmp_ipha) + len);
3191 	*ipha = icmp_ipha;
3192 	ipha->ipha_src = src;
3193 	ipha->ipha_dst = dst;
3194 	ipha->ipha_ttl = ip_def_ttl;
3195 	msg_len += sizeof (icmp_ipha) + len;
3196 	if (msg_len > IP_MAXPACKET) {
3197 		(void) adjmsg(mp, IP_MAXPACKET - msg_len);
3198 		msg_len = IP_MAXPACKET;
3199 	}
3200 	ipha->ipha_length = htons((uint16_t)msg_len);
3201 	icmph = (icmph_t *)&ipha[1];
3202 	bcopy(stuff, icmph, len);
3203 	icmph->icmph_checksum = 0;
3204 	icmph->icmph_checksum = IP_CSUM(mp, (int32_t)sizeof (ipha_t), 0);
3205 	BUMP_MIB(&icmp_mib, icmpOutMsgs);
3206 	put(q, ipsec_mp);
3207 }
3208 
3209 /*
3210  * Determine if an ICMP error packet can be sent given the rate limit.
3211  * The limit consists of an average frequency (icmp_pkt_err_interval measured
3212  * in milliseconds) and a burst size. Burst size number of packets can
3213  * be sent arbitrarely closely spaced.
3214  * The state is tracked using two variables to implement an approximate
3215  * token bucket filter:
3216  *	icmp_pkt_err_last - lbolt value when the last burst started
3217  *	icmp_pkt_err_sent - number of packets sent in current burst
3218  */
3219 boolean_t
3220 icmp_err_rate_limit(void)
3221 {
3222 	clock_t now = TICK_TO_MSEC(lbolt);
3223 	uint_t refilled; /* Number of packets refilled in tbf since last */
3224 	uint_t err_interval = ip_icmp_err_interval; /* Guard against changes */
3225 
3226 	if (err_interval == 0)
3227 		return (B_FALSE);
3228 
3229 	if (icmp_pkt_err_last > now) {
3230 		/* 100HZ lbolt in ms for 32bit arch wraps every 49.7 days */
3231 		icmp_pkt_err_last = 0;
3232 		icmp_pkt_err_sent = 0;
3233 	}
3234 	/*
3235 	 * If we are in a burst update the token bucket filter.
3236 	 * Update the "last" time to be close to "now" but make sure
3237 	 * we don't loose precision.
3238 	 */
3239 	if (icmp_pkt_err_sent != 0) {
3240 		refilled = (now - icmp_pkt_err_last)/err_interval;
3241 		if (refilled > icmp_pkt_err_sent) {
3242 			icmp_pkt_err_sent = 0;
3243 		} else {
3244 			icmp_pkt_err_sent -= refilled;
3245 			icmp_pkt_err_last += refilled * err_interval;
3246 		}
3247 	}
3248 	if (icmp_pkt_err_sent == 0) {
3249 		/* Start of new burst */
3250 		icmp_pkt_err_last = now;
3251 	}
3252 	if (icmp_pkt_err_sent < ip_icmp_err_burst) {
3253 		icmp_pkt_err_sent++;
3254 		ip1dbg(("icmp_err_rate_limit: %d sent in burst\n",
3255 		    icmp_pkt_err_sent));
3256 		return (B_FALSE);
3257 	}
3258 	ip1dbg(("icmp_err_rate_limit: dropped\n"));
3259 	return (B_TRUE);
3260 }
3261 
3262 /*
3263  * Check if it is ok to send an IPv4 ICMP error packet in
3264  * response to the IPv4 packet in mp.
3265  * Free the message and return null if no
3266  * ICMP error packet should be sent.
3267  */
3268 static mblk_t *
3269 icmp_pkt_err_ok(mblk_t *mp)
3270 {
3271 	icmph_t	*icmph;
3272 	ipha_t	*ipha;
3273 	uint_t	len_needed;
3274 	ire_t	*src_ire;
3275 	ire_t	*dst_ire;
3276 
3277 	if (!mp)
3278 		return (NULL);
3279 	ipha = (ipha_t *)mp->b_rptr;
3280 	if (ip_csum_hdr(ipha)) {
3281 		BUMP_MIB(&ip_mib, ipInCksumErrs);
3282 		freemsg(mp);
3283 		return (NULL);
3284 	}
3285 	src_ire = ire_ctable_lookup(ipha->ipha_dst, 0, IRE_BROADCAST,
3286 	    NULL, ALL_ZONES, MATCH_IRE_TYPE);
3287 	dst_ire = ire_ctable_lookup(ipha->ipha_src, 0, IRE_BROADCAST,
3288 	    NULL, ALL_ZONES, MATCH_IRE_TYPE);
3289 	if (src_ire != NULL || dst_ire != NULL ||
3290 	    CLASSD(ipha->ipha_dst) ||
3291 	    CLASSD(ipha->ipha_src) ||
3292 	    (ntohs(ipha->ipha_fragment_offset_and_flags) & IPH_OFFSET)) {
3293 		/* Note: only errors to the fragment with offset 0 */
3294 		BUMP_MIB(&icmp_mib, icmpOutDrops);
3295 		freemsg(mp);
3296 		if (src_ire != NULL)
3297 			ire_refrele(src_ire);
3298 		if (dst_ire != NULL)
3299 			ire_refrele(dst_ire);
3300 		return (NULL);
3301 	}
3302 	if (ipha->ipha_protocol == IPPROTO_ICMP) {
3303 		/*
3304 		 * Check the ICMP type.  RFC 1122 sez:  don't send ICMP
3305 		 * errors in response to any ICMP errors.
3306 		 */
3307 		len_needed = IPH_HDR_LENGTH(ipha) + ICMPH_SIZE;
3308 		if (mp->b_wptr - mp->b_rptr < len_needed) {
3309 			if (!pullupmsg(mp, len_needed)) {
3310 				BUMP_MIB(&icmp_mib, icmpInErrors);
3311 				freemsg(mp);
3312 				return (NULL);
3313 			}
3314 			ipha = (ipha_t *)mp->b_rptr;
3315 		}
3316 		icmph = (icmph_t *)
3317 		    (&((char *)ipha)[IPH_HDR_LENGTH(ipha)]);
3318 		switch (icmph->icmph_type) {
3319 		case ICMP_DEST_UNREACHABLE:
3320 		case ICMP_SOURCE_QUENCH:
3321 		case ICMP_TIME_EXCEEDED:
3322 		case ICMP_PARAM_PROBLEM:
3323 		case ICMP_REDIRECT:
3324 			BUMP_MIB(&icmp_mib, icmpOutDrops);
3325 			freemsg(mp);
3326 			return (NULL);
3327 		default:
3328 			break;
3329 		}
3330 	}
3331 	if (icmp_err_rate_limit()) {
3332 		/*
3333 		 * Only send ICMP error packets every so often.
3334 		 * This should be done on a per port/source basis,
3335 		 * but for now this will suffice.
3336 		 */
3337 		freemsg(mp);
3338 		return (NULL);
3339 	}
3340 	return (mp);
3341 }
3342 
3343 /*
3344  * Generate an ICMP redirect message.
3345  */
3346 static void
3347 icmp_send_redirect(queue_t *q, mblk_t *mp, ipaddr_t gateway)
3348 {
3349 	icmph_t	icmph;
3350 
3351 	/*
3352 	 * We are called from ip_rput where we could
3353 	 * not have attached an IPSEC_IN.
3354 	 */
3355 	ASSERT(mp->b_datap->db_type == M_DATA);
3356 
3357 	if (!(mp = icmp_pkt_err_ok(mp))) {
3358 		return;
3359 	}
3360 
3361 	bzero(&icmph, sizeof (icmph_t));
3362 	icmph.icmph_type = ICMP_REDIRECT;
3363 	icmph.icmph_code = 1;
3364 	icmph.icmph_rd_gateway = gateway;
3365 	BUMP_MIB(&icmp_mib, icmpOutRedirects);
3366 	icmp_pkt(q, mp, &icmph, sizeof (icmph_t), B_FALSE);
3367 }
3368 
3369 /*
3370  * Generate an ICMP time exceeded message.
3371  */
3372 void
3373 icmp_time_exceeded(queue_t *q, mblk_t *mp, uint8_t code)
3374 {
3375 	icmph_t	icmph;
3376 	boolean_t mctl_present;
3377 	mblk_t *first_mp;
3378 
3379 	EXTRACT_PKT_MP(mp, first_mp, mctl_present);
3380 
3381 	if (!(mp = icmp_pkt_err_ok(mp))) {
3382 		if (mctl_present)
3383 			freeb(first_mp);
3384 		return;
3385 	}
3386 
3387 	bzero(&icmph, sizeof (icmph_t));
3388 	icmph.icmph_type = ICMP_TIME_EXCEEDED;
3389 	icmph.icmph_code = code;
3390 	BUMP_MIB(&icmp_mib, icmpOutTimeExcds);
3391 	icmp_pkt(q, first_mp, &icmph, sizeof (icmph_t), mctl_present);
3392 }
3393 
3394 /*
3395  * Generate an ICMP unreachable message.
3396  */
3397 void
3398 icmp_unreachable(queue_t *q, mblk_t *mp, uint8_t code)
3399 {
3400 	icmph_t	icmph;
3401 	mblk_t *first_mp;
3402 	boolean_t mctl_present;
3403 
3404 	EXTRACT_PKT_MP(mp, first_mp, mctl_present);
3405 
3406 	if (!(mp = icmp_pkt_err_ok(mp))) {
3407 		if (mctl_present)
3408 			freeb(first_mp);
3409 		return;
3410 	}
3411 
3412 	bzero(&icmph, sizeof (icmph_t));
3413 	icmph.icmph_type = ICMP_DEST_UNREACHABLE;
3414 	icmph.icmph_code = code;
3415 	BUMP_MIB(&icmp_mib, icmpOutDestUnreachs);
3416 	ip2dbg(("send icmp destination unreachable code %d\n", code));
3417 	icmp_pkt(q, first_mp, (char *)&icmph, sizeof (icmph_t), mctl_present);
3418 }
3419 
3420 /*
3421  * News from ARP.  ARP sends notification of interesting events down
3422  * to its clients using M_CTL messages with the interesting ARP packet
3423  * attached via b_cont.
3424  * The interesting event from a device comes up the corresponding ARP-IP-DEV
3425  * queue as opposed to ARP sending the message to all the clients, i.e. all
3426  * its ARP-IP-DEV instances. Thus, for AR_CN_ANNOUNCE, we must walk the cache
3427  * table if a cache IRE is found to delete all the entries for the address in
3428  * the packet.
3429  */
3430 static void
3431 ip_arp_news(queue_t *q, mblk_t *mp)
3432 {
3433 	arcn_t		*arcn;
3434 	arh_t		*arh;
3435 	char		*cp1;
3436 	uchar_t		*cp2;
3437 	ire_t		*ire = NULL;
3438 	int		i1;
3439 	char		hbuf[128];
3440 	char		sbuf[16];
3441 	ipaddr_t	src;
3442 	in6_addr_t	v6src;
3443 	boolean_t	isv6 = B_FALSE;
3444 
3445 	if ((mp->b_wptr - mp->b_rptr) < sizeof (arcn_t)	|| !mp->b_cont) {
3446 		if (q->q_next) {
3447 			putnext(q, mp);
3448 		} else
3449 			freemsg(mp);
3450 		return;
3451 	}
3452 	arh = (arh_t *)mp->b_cont->b_rptr;
3453 	/* Is it one we are interested in? */
3454 	if (BE16_TO_U16(arh->arh_proto) == IP6_DL_SAP) {
3455 		isv6 = B_TRUE;
3456 		bcopy((char *)&arh[1] + (arh->arh_hlen & 0xFF), &v6src,
3457 		    IPV6_ADDR_LEN);
3458 	} else if (BE16_TO_U16(arh->arh_proto) == IP_ARP_PROTO_TYPE) {
3459 		bcopy((char *)&arh[1] + (arh->arh_hlen & 0xFF), &src,
3460 		    IP_ADDR_LEN);
3461 	} else {
3462 		freemsg(mp);
3463 		return;
3464 	}
3465 
3466 	arcn = (arcn_t *)mp->b_rptr;
3467 	switch (arcn->arcn_code) {
3468 	case AR_CN_BOGON:
3469 		/*
3470 		 * Someone is sending ARP packets with a source protocol
3471 		 * address which we have published.  Either they are
3472 		 * pretending to be us, or we have been asked to proxy
3473 		 * for a machine that can do fine for itself, or two
3474 		 * different machines are providing proxy service for the
3475 		 * same protocol address, or something.  We try and do
3476 		 * something appropriate here.
3477 		 */
3478 		cp2 = (uchar_t *)&arh[1];
3479 		cp1 = hbuf;
3480 		*cp1 = '\0';
3481 		for (i1 = arh->arh_hlen; i1--; cp1 += 3)
3482 			(void) sprintf(cp1, "%02x:", *cp2++ & 0xff);
3483 		if (cp1 != hbuf)
3484 			cp1[-1] = '\0';
3485 		(void) ip_dot_addr(src, sbuf);
3486 		if (isv6)
3487 			ire = ire_cache_lookup_v6(&v6src, ALL_ZONES);
3488 		else
3489 			ire = ire_cache_lookup(src, ALL_ZONES);
3490 
3491 		if (ire != NULL	&& IRE_IS_LOCAL(ire)) {
3492 			cmn_err(CE_WARN,
3493 			    "IP: Hardware address '%s' trying"
3494 			    " to be our address %s!",
3495 			    hbuf, sbuf);
3496 		} else {
3497 			cmn_err(CE_WARN,
3498 			    "IP: Proxy ARP problem?  "
3499 			    "Hardware address '%s' thinks it is %s",
3500 			    hbuf, sbuf);
3501 		}
3502 		if (ire != NULL)
3503 			ire_refrele(ire);
3504 		break;
3505 	case AR_CN_ANNOUNCE:
3506 		if (isv6) {
3507 			/*
3508 			 * For XRESOLV interfaces.
3509 			 * Delete the IRE cache entry and NCE for this
3510 			 * v6 address
3511 			 */
3512 			ip_ire_clookup_and_delete_v6(&v6src);
3513 			/*
3514 			 * If v6src is a non-zero, it's a router address
3515 			 * as below. Do the same sort of thing to clean
3516 			 * out off-net IRE_CACHE entries that go through
3517 			 * the router.
3518 			 */
3519 			if (!IN6_IS_ADDR_UNSPECIFIED(&v6src)) {
3520 				ire_walk_v6(ire_delete_cache_gw_v6,
3521 				    (char *)&v6src, ALL_ZONES);
3522 			}
3523 			break;
3524 		}
3525 		/*
3526 		 * ARP gives us a copy of any broadcast packet with identical
3527 		 * sender and receiver protocol address, in
3528 		 * case we want to intuit something from it.  Such a packet
3529 		 * usually means that a machine has just come up on the net.
3530 		 * If we have an IRE_CACHE, we blow it away.  This way we will
3531 		 * immediately pick up the rare case of a host changing
3532 		 * hardware address. ip_ire_clookup_and_delete achieves this.
3533 		 *
3534 		 * The address in "src" may be an entry for a router.
3535 		 * (Default router, or non-default router.)  If
3536 		 * that's true, then any off-net IRE_CACHE entries
3537 		 * that go through the router with address "src"
3538 		 * must be clobbered.  Use ire_walk to achieve this
3539 		 * goal.
3540 		 *
3541 		 * It should be possible to determine if the address
3542 		 * in src is or is not for a router.  This way,
3543 		 * the ire_walk() isn't called all of the time here.
3544 		 * Do not pass 'src' value of 0 to ire_delete_cache_gw,
3545 		 * as it would remove all IRE_CACHE entries for onlink
3546 		 * destinations. All onlink destinations have
3547 		 * ire_gateway_addr == 0.
3548 		 */
3549 		if ((ip_ire_clookup_and_delete(src, NULL) ||
3550 		    (ire = ire_ftable_lookup(src, 0, 0, 0, NULL, NULL, NULL,
3551 		    0, MATCH_IRE_DSTONLY)) != NULL) && src != 0) {
3552 			ire_walk_v4(ire_delete_cache_gw, (char *)&src,
3553 			    ALL_ZONES);
3554 		}
3555 		/* From ire_ftable_lookup */
3556 		if (ire != NULL)
3557 			ire_refrele(ire);
3558 		break;
3559 	default:
3560 		if (ire != NULL)
3561 			ire_refrele(ire);
3562 		break;
3563 	}
3564 	freemsg(mp);
3565 }
3566 
3567 /*
3568  * Create a mblk suitable for carrying the interface index and/or source link
3569  * address. This mblk is tagged as an M_CTL and is sent to ULP. This is used
3570  * when the IP_RECVIF and/or IP_RECVSLLA socket option is set by the user
3571  * application.
3572  */
3573 mblk_t *
3574 ip_add_info(mblk_t *data_mp, ill_t *ill, uint_t flags)
3575 {
3576 	mblk_t		*mp;
3577 	in_pktinfo_t	*pinfo;
3578 	ipha_t *ipha;
3579 	struct ether_header *pether;
3580 
3581 	mp = allocb(sizeof (in_pktinfo_t), BPRI_MED);
3582 	if (mp == NULL) {
3583 		ip1dbg(("ip_add_info: allocation failure.\n"));
3584 		return (data_mp);
3585 	}
3586 
3587 	ipha	= (ipha_t *)data_mp->b_rptr;
3588 	pinfo = (in_pktinfo_t *)mp->b_rptr;
3589 	bzero(pinfo, sizeof (in_pktinfo_t));
3590 	pinfo->in_pkt_flags = (uchar_t)flags;
3591 	pinfo->in_pkt_ulp_type = IN_PKTINFO;	/* Tell ULP what type of info */
3592 
3593 	if (flags & IPF_RECVIF)
3594 		pinfo->in_pkt_ifindex = ill->ill_phyint->phyint_ifindex;
3595 
3596 	pether = (struct ether_header *)((char *)ipha
3597 	    - sizeof (struct ether_header));
3598 	/*
3599 	 * Make sure the interface is an ethernet type, since this option
3600 	 * is currently supported only on this type of interface. Also make
3601 	 * sure we are pointing correctly above db_base.
3602 	 */
3603 
3604 	if ((flags & IPF_RECVSLLA) &&
3605 	    ((uchar_t *)pether >= data_mp->b_datap->db_base) &&
3606 	    (ill->ill_type == IFT_ETHER) &&
3607 	    (ill->ill_net_type == IRE_IF_RESOLVER)) {
3608 
3609 		pinfo->in_pkt_slla.sdl_type = IFT_ETHER;
3610 		bcopy((uchar_t *)pether->ether_shost.ether_addr_octet,
3611 		    (uchar_t *)pinfo->in_pkt_slla.sdl_data, ETHERADDRL);
3612 	} else {
3613 		/*
3614 		 * Clear the bit. Indicate to upper layer that IP is not
3615 		 * sending this ancillary info.
3616 		 */
3617 		pinfo->in_pkt_flags = pinfo->in_pkt_flags & ~IPF_RECVSLLA;
3618 	}
3619 
3620 	mp->b_datap->db_type = M_CTL;
3621 	mp->b_wptr += sizeof (in_pktinfo_t);
3622 	mp->b_cont = data_mp;
3623 
3624 	return (mp);
3625 }
3626 
3627 /*
3628  * Latch in the IPsec state for a stream based on the ipsec_in_t passed in as
3629  * part of the bind request.
3630  */
3631 
3632 boolean_t
3633 ip_bind_ipsec_policy_set(conn_t *connp, mblk_t *policy_mp)
3634 {
3635 	ipsec_in_t *ii;
3636 
3637 	ASSERT(policy_mp != NULL);
3638 	ASSERT(policy_mp->b_datap->db_type == IPSEC_POLICY_SET);
3639 
3640 	ii = (ipsec_in_t *)policy_mp->b_rptr;
3641 	ASSERT(ii->ipsec_in_type == IPSEC_IN);
3642 
3643 	connp->conn_policy = ii->ipsec_in_policy;
3644 	ii->ipsec_in_policy = NULL;
3645 
3646 	if (ii->ipsec_in_action != NULL) {
3647 		if (connp->conn_latch == NULL) {
3648 			connp->conn_latch = iplatch_create();
3649 			if (connp->conn_latch == NULL)
3650 				return (B_FALSE);
3651 		}
3652 		ipsec_latch_inbound(connp->conn_latch, ii);
3653 	}
3654 	return (B_TRUE);
3655 }
3656 
3657 /*
3658  * Upper level protocols (ULP) pass through bind requests to IP for inspection
3659  * and to arrange for power-fanout assist.  The ULP is identified by
3660  * adding a single byte at the end of the original bind message.
3661  * A ULP other than UDP or TCP that wishes to be recognized passes
3662  * down a bind with a zero length address.
3663  *
3664  * The binding works as follows:
3665  * - A zero byte address means just bind to the protocol.
3666  * - A four byte address is treated as a request to validate
3667  *   that the address is a valid local address, appropriate for
3668  *   an application to bind to. This does not affect any fanout
3669  *   information in IP.
3670  * - A sizeof sin_t byte address is used to bind to only the local address
3671  *   and port.
3672  * - A sizeof ipa_conn_t byte address contains complete fanout information
3673  *   consisting of local and remote addresses and ports.  In
3674  *   this case, the addresses are both validated as appropriate
3675  *   for this operation, and, if so, the information is retained
3676  *   for use in the inbound fanout.
3677  *
3678  * The ULP (except in the zero-length bind) can append an
3679  * additional mblk of db_type IRE_DB_REQ_TYPE or IPSEC_POLICY_SET to the
3680  * T_BIND_REQ/O_T_BIND_REQ. IRE_DB_REQ_TYPE indicates that the ULP wants
3681  * a copy of the source or destination IRE (source for local bind;
3682  * destination for complete bind). IPSEC_POLICY_SET indicates that the
3683  * policy information contained should be copied on to the conn.
3684  *
3685  * NOTE : Only one of IRE_DB_REQ_TYPE or IPSEC_POLICY_SET can be present.
3686  */
3687 mblk_t *
3688 ip_bind_v4(queue_t *q, mblk_t *mp, conn_t *connp)
3689 {
3690 	ssize_t		len;
3691 	struct T_bind_req	*tbr;
3692 	sin_t		*sin;
3693 	ipa_conn_t	*ac;
3694 	uchar_t		*ucp;
3695 	mblk_t		*mp1;
3696 	boolean_t	ire_requested;
3697 	boolean_t	ipsec_policy_set = B_FALSE;
3698 	int		error = 0;
3699 	int		protocol;
3700 	ipa_conn_x_t	*acx;
3701 
3702 	ASSERT(!connp->conn_af_isv6);
3703 	connp->conn_pkt_isv6 = B_FALSE;
3704 
3705 	len = mp->b_wptr - mp->b_rptr;
3706 	if (len < (sizeof (*tbr) + 1)) {
3707 		(void) mi_strlog(q, 1, SL_ERROR|SL_TRACE,
3708 		    "ip_bind: bogus msg, len %ld", len);
3709 		/* XXX: Need to return something better */
3710 		goto bad_addr;
3711 	}
3712 	/* Back up and extract the protocol identifier. */
3713 	mp->b_wptr--;
3714 	protocol = *mp->b_wptr & 0xFF;
3715 	tbr = (struct T_bind_req *)mp->b_rptr;
3716 	/* Reset the message type in preparation for shipping it back. */
3717 	mp->b_datap->db_type = M_PCPROTO;
3718 
3719 	connp->conn_ulp = (uint8_t)protocol;
3720 
3721 	/*
3722 	 * Check for a zero length address.  This is from a protocol that
3723 	 * wants to register to receive all packets of its type.
3724 	 */
3725 	if (tbr->ADDR_length == 0) {
3726 		/*
3727 		 * These protocols are now intercepted in ip_bind_v6().
3728 		 * Reject protocol-level binds here for now.
3729 		 *
3730 		 * For SCTP raw socket, ICMP sends down a bind with sin_t
3731 		 * so that the protocol type cannot be SCTP.
3732 		 */
3733 		if (protocol == IPPROTO_TCP || protocol == IPPROTO_AH ||
3734 		    protocol == IPPROTO_ESP || protocol == IPPROTO_SCTP) {
3735 			goto bad_addr;
3736 		}
3737 
3738 		/* No hash here really.  The table is big enough. */
3739 		connp->conn_srcv6 = ipv6_all_zeros;
3740 
3741 		ipcl_proto_insert(connp, protocol);
3742 
3743 		tbr->PRIM_type = T_BIND_ACK;
3744 		return (mp);
3745 	}
3746 
3747 	/* Extract the address pointer from the message. */
3748 	ucp = (uchar_t *)mi_offset_param(mp, tbr->ADDR_offset,
3749 	    tbr->ADDR_length);
3750 	if (ucp == NULL) {
3751 		ip1dbg(("ip_bind: no address\n"));
3752 		goto bad_addr;
3753 	}
3754 	if (!OK_32PTR(ucp)) {
3755 		ip1dbg(("ip_bind: unaligned address\n"));
3756 		goto bad_addr;
3757 	}
3758 	/*
3759 	 * Check for trailing mps.
3760 	 */
3761 
3762 	mp1 = mp->b_cont;
3763 	ire_requested = (mp1 && mp1->b_datap->db_type == IRE_DB_REQ_TYPE);
3764 	ipsec_policy_set = (mp1 && mp1->b_datap->db_type == IPSEC_POLICY_SET);
3765 
3766 	switch (tbr->ADDR_length) {
3767 	default:
3768 		ip1dbg(("ip_bind: bad address length %d\n",
3769 		    (int)tbr->ADDR_length));
3770 		goto bad_addr;
3771 
3772 	case IP_ADDR_LEN:
3773 		/* Verification of local address only */
3774 		error = ip_bind_laddr(connp, mp, *(ipaddr_t *)ucp, 0,
3775 		    ire_requested, ipsec_policy_set, B_FALSE);
3776 		break;
3777 
3778 	case sizeof (sin_t):
3779 		sin = (sin_t *)ucp;
3780 		error = ip_bind_laddr(connp, mp, sin->sin_addr.s_addr,
3781 		    sin->sin_port, ire_requested, ipsec_policy_set, B_TRUE);
3782 		if (protocol == IPPROTO_TCP)
3783 			connp->conn_recv = tcp_conn_request;
3784 		break;
3785 
3786 	case sizeof (ipa_conn_t):
3787 		ac = (ipa_conn_t *)ucp;
3788 		/* For raw socket, the local port is not set. */
3789 		if (ac->ac_lport == 0)
3790 			ac->ac_lport = connp->conn_lport;
3791 		/* Always verify destination reachability. */
3792 		error = ip_bind_connected(connp, mp, &ac->ac_laddr,
3793 		    ac->ac_lport, ac->ac_faddr, ac->ac_fport, ire_requested,
3794 		    ipsec_policy_set, B_TRUE, B_TRUE);
3795 		if (protocol == IPPROTO_TCP)
3796 			connp->conn_recv = tcp_input;
3797 		break;
3798 
3799 	case sizeof (ipa_conn_x_t):
3800 		acx = (ipa_conn_x_t *)ucp;
3801 		/*
3802 		 * Whether or not to verify destination reachability depends
3803 		 * on the setting of the ACX_VERIFY_DST flag in acx->acx_flags.
3804 		 */
3805 		error = ip_bind_connected(connp, mp, &acx->acx_conn.ac_laddr,
3806 		    acx->acx_conn.ac_lport, acx->acx_conn.ac_faddr,
3807 		    acx->acx_conn.ac_fport, ire_requested, ipsec_policy_set,
3808 		    B_TRUE, (acx->acx_flags & ACX_VERIFY_DST) != 0);
3809 		if (protocol == IPPROTO_TCP)
3810 			connp->conn_recv = tcp_input;
3811 		break;
3812 	}
3813 	if (error == EINPROGRESS)
3814 		return (NULL);
3815 	else if (error != 0)
3816 		goto bad_addr;
3817 	/*
3818 	 * Pass the IPSEC headers size in ire_ipsec_overhead.
3819 	 * We can't do this in ip_bind_insert_ire because the policy
3820 	 * may not have been inherited at that point in time and hence
3821 	 * conn_out_enforce_policy may not be set.
3822 	 */
3823 	mp1 = mp->b_cont;
3824 	if (ire_requested && connp->conn_out_enforce_policy &&
3825 	    mp1 != NULL && DB_TYPE(mp1) == IRE_DB_REQ_TYPE) {
3826 		ire_t *ire = (ire_t *)mp1->b_rptr;
3827 		ASSERT(MBLKL(mp1) >= sizeof (ire_t));
3828 		ire->ire_ipsec_overhead = conn_ipsec_length(connp);
3829 	}
3830 
3831 	/* Send it home. */
3832 	mp->b_datap->db_type = M_PCPROTO;
3833 	tbr->PRIM_type = T_BIND_ACK;
3834 	return (mp);
3835 
3836 bad_addr:
3837 	/*
3838 	 * If error = -1 then we generate a TBADADDR - otherwise error is
3839 	 * a unix errno.
3840 	 */
3841 	if (error > 0)
3842 		mp = mi_tpi_err_ack_alloc(mp, TSYSERR, error);
3843 	else
3844 		mp = mi_tpi_err_ack_alloc(mp, TBADADDR, 0);
3845 	return (mp);
3846 }
3847 
3848 /*
3849  * Here address is verified to be a valid local address.
3850  * If the IRE_DB_REQ_TYPE mp is present, a broadcast/multicast
3851  * address is also considered a valid local address.
3852  * In the case of a broadcast/multicast address, however, the
3853  * upper protocol is expected to reset the src address
3854  * to 0 if it sees a IRE_BROADCAST type returned so that
3855  * no packets are emitted with broadcast/multicast address as
3856  * source address (that violates hosts requirements RFC1122)
3857  * The addresses valid for bind are:
3858  *	(1) - INADDR_ANY (0)
3859  *	(2) - IP address of an UP interface
3860  *	(3) - IP address of a DOWN interface
3861  *	(4) - valid local IP broadcast addresses. In this case
3862  *	the conn will only receive packets destined to
3863  *	the specified broadcast address.
3864  *	(5) - a multicast address. In this case
3865  *	the conn will only receive packets destined to
3866  *	the specified multicast address. Note: the
3867  *	application still has to issue an
3868  *	IP_ADD_MEMBERSHIP socket option.
3869  *
3870  * On error, return -1 for TBADADDR otherwise pass the
3871  * errno with TSYSERR reply.
3872  *
3873  * In all the above cases, the bound address must be valid in the current zone.
3874  * When the address is loopback, multicast or broadcast, there might be many
3875  * matching IREs so bind has to look up based on the zone.
3876  */
3877 int
3878 ip_bind_laddr(conn_t *connp, mblk_t *mp, ipaddr_t src_addr, uint16_t lport,
3879     boolean_t ire_requested, boolean_t ipsec_policy_set,
3880     boolean_t fanout_insert)
3881 {
3882 	int		error = 0;
3883 	ire_t		*src_ire;
3884 	mblk_t		*policy_mp;
3885 	ipif_t		*ipif;
3886 	zoneid_t	zoneid;
3887 
3888 	if (ipsec_policy_set) {
3889 		policy_mp = mp->b_cont;
3890 	}
3891 
3892 	/*
3893 	 * If it was previously connected, conn_fully_bound would have
3894 	 * been set.
3895 	 */
3896 	connp->conn_fully_bound = B_FALSE;
3897 
3898 	src_ire = NULL;
3899 	ipif = NULL;
3900 
3901 	zoneid = connp->conn_zoneid;
3902 
3903 	if (src_addr) {
3904 		src_ire = ire_route_lookup(src_addr, 0, 0, 0,
3905 		    NULL, NULL, zoneid, MATCH_IRE_ZONEONLY);
3906 		/*
3907 		 * If an address other than 0.0.0.0 is requested,
3908 		 * we verify that it is a valid address for bind
3909 		 * Note: Following code is in if-else-if form for
3910 		 * readability compared to a condition check.
3911 		 */
3912 		/* LINTED - statement has no consequent */
3913 		if (IRE_IS_LOCAL(src_ire)) {
3914 			/*
3915 			 * (2) Bind to address of local UP interface
3916 			 */
3917 		} else if (src_ire && src_ire->ire_type == IRE_BROADCAST) {
3918 			/*
3919 			 * (4) Bind to broadcast address
3920 			 * Note: permitted only from transports that
3921 			 * request IRE
3922 			 */
3923 			if (!ire_requested)
3924 				error = EADDRNOTAVAIL;
3925 		} else {
3926 			/*
3927 			 * (3) Bind to address of local DOWN interface
3928 			 * (ipif_lookup_addr() looks up all interfaces
3929 			 * but we do not get here for UP interfaces
3930 			 * - case (2) above)
3931 			 * We put the protocol byte back into the mblk
3932 			 * since we may come back via ip_wput_nondata()
3933 			 * later with this mblk if ipif_lookup_addr chooses
3934 			 * to defer processing.
3935 			 */
3936 			*mp->b_wptr++ = (char)connp->conn_ulp;
3937 			if ((ipif = ipif_lookup_addr(src_addr, NULL, zoneid,
3938 			    CONNP_TO_WQ(connp), mp, ip_wput_nondata,
3939 			    &error)) != NULL) {
3940 				ipif_refrele(ipif);
3941 			} else if (error == EINPROGRESS) {
3942 				if (src_ire != NULL)
3943 					ire_refrele(src_ire);
3944 				return (EINPROGRESS);
3945 			} else if (CLASSD(src_addr)) {
3946 				error = 0;
3947 				if (src_ire != NULL)
3948 					ire_refrele(src_ire);
3949 				/*
3950 				 * (5) bind to multicast address.
3951 				 * Fake out the IRE returned to upper
3952 				 * layer to be a broadcast IRE.
3953 				 */
3954 				src_ire = ire_ctable_lookup(
3955 				    INADDR_BROADCAST, INADDR_ANY,
3956 				    IRE_BROADCAST, NULL, zoneid,
3957 				    (MATCH_IRE_TYPE | MATCH_IRE_ZONEONLY));
3958 				if (src_ire == NULL || !ire_requested)
3959 					error = EADDRNOTAVAIL;
3960 			} else {
3961 				/*
3962 				 * Not a valid address for bind
3963 				 */
3964 				error = EADDRNOTAVAIL;
3965 			}
3966 			/*
3967 			 * Just to keep it consistent with the processing in
3968 			 * ip_bind_v4()
3969 			 */
3970 			mp->b_wptr--;
3971 		}
3972 		if (error) {
3973 			/* Red Alert!  Attempting to be a bogon! */
3974 			ip1dbg(("ip_bind: bad src address 0x%x\n",
3975 			    ntohl(src_addr)));
3976 			goto bad_addr;
3977 		}
3978 	}
3979 
3980 	/*
3981 	 * Allow setting new policies. For example, disconnects come
3982 	 * down as ipa_t bind. As we would have set conn_policy_cached
3983 	 * to B_TRUE before, we should set it to B_FALSE, so that policy
3984 	 * can change after the disconnect.
3985 	 */
3986 	connp->conn_policy_cached = B_FALSE;
3987 
3988 	/*
3989 	 * If not fanout_insert this was just an address verification
3990 	 */
3991 	if (fanout_insert) {
3992 		/*
3993 		 * The addresses have been verified. Time to insert in
3994 		 * the correct fanout list.
3995 		 */
3996 		IN6_IPADDR_TO_V4MAPPED(src_addr, &connp->conn_srcv6);
3997 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &connp->conn_remv6);
3998 		connp->conn_lport = lport;
3999 		connp->conn_fport = 0;
4000 		/*
4001 		 * Do we need to add a check to reject Multicast packets
4002 		 */
4003 		error = ipcl_bind_insert(connp, *mp->b_wptr, src_addr, lport);
4004 	}
4005 done:
4006 	if (error == 0) {
4007 		if (ire_requested) {
4008 			if (!ip_bind_insert_ire(mp, src_ire, NULL)) {
4009 				error = -1;
4010 				/* Falls through to bad_addr */
4011 			}
4012 		} else if (ipsec_policy_set) {
4013 			if (!ip_bind_ipsec_policy_set(connp, policy_mp)) {
4014 				error = -1;
4015 				/* Falls through to bad_addr */
4016 			}
4017 		}
4018 	}
4019 bad_addr:
4020 	if (src_ire != NULL)
4021 		IRE_REFRELE(src_ire);
4022 	if (ipsec_policy_set) {
4023 		ASSERT(policy_mp == mp->b_cont);
4024 		ASSERT(policy_mp != NULL);
4025 		freeb(policy_mp);
4026 		/*
4027 		 * As of now assume that nothing else accompanies
4028 		 * IPSEC_POLICY_SET.
4029 		 */
4030 		mp->b_cont = NULL;
4031 	}
4032 	return (error);
4033 }
4034 
4035 /*
4036  * Verify that both the source and destination addresses
4037  * are valid.  If verify_dst is false, then the destination address may be
4038  * unreachable, i.e. have no route to it.  Protocols like TCP want to verify
4039  * destination reachability, while tunnels do not.
4040  * Note that we allow connect to broadcast and multicast
4041  * addresses when ire_requested is set. Thus the ULP
4042  * has to check for IRE_BROADCAST and multicast.
4043  *
4044  * Returns zero if ok.
4045  * On error: returns -1 to mean TBADADDR otherwise returns an errno
4046  * (for use with TSYSERR reply).
4047  */
4048 int
4049 ip_bind_connected(conn_t *connp, mblk_t *mp, ipaddr_t *src_addrp,
4050     uint16_t lport, ipaddr_t dst_addr, uint16_t fport,
4051     boolean_t ire_requested, boolean_t ipsec_policy_set,
4052     boolean_t fanout_insert, boolean_t verify_dst)
4053 {
4054 	ire_t		*src_ire;
4055 	ire_t		*dst_ire;
4056 	int		error = 0;
4057 	int 		protocol;
4058 	mblk_t		*policy_mp;
4059 	ire_t		*sire = NULL;
4060 	ire_t		*md_dst_ire = NULL;
4061 	ill_t		*md_ill = NULL;
4062 	zoneid_t	zoneid;
4063 	ipaddr_t	src_addr = *src_addrp;
4064 
4065 	src_ire = dst_ire = NULL;
4066 	protocol = *mp->b_wptr & 0xFF;
4067 
4068 	/*
4069 	 * If we never got a disconnect before, clear it now.
4070 	 */
4071 	connp->conn_fully_bound = B_FALSE;
4072 
4073 	if (ipsec_policy_set) {
4074 		policy_mp = mp->b_cont;
4075 	}
4076 
4077 	zoneid = connp->conn_zoneid;
4078 
4079 	if (CLASSD(dst_addr)) {
4080 		/* Pick up an IRE_BROADCAST */
4081 		dst_ire = ire_route_lookup(ip_g_all_ones, 0, 0, 0, NULL,
4082 		    NULL, zoneid, (MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT |
4083 		    MATCH_IRE_RJ_BHOLE));
4084 	} else {
4085 		/*
4086 		 * If conn_dontroute is set, and onlink ipif is not found
4087 		 * set ENETUNREACH error
4088 		 */
4089 		if (connp->conn_dontroute) {
4090 			ipif_t *ipif;
4091 
4092 			ipif = ipif_lookup_onlink_addr(dst_addr, zoneid);
4093 			if (ipif == NULL) {
4094 				error = ENETUNREACH;
4095 				goto bad_addr;
4096 			}
4097 			ipif_refrele(ipif);
4098 		}
4099 		dst_ire = ire_route_lookup(dst_addr, 0, 0, 0, NULL, &sire,
4100 		    zoneid,
4101 		    (MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT |
4102 		    MATCH_IRE_PARENT | MATCH_IRE_RJ_BHOLE));
4103 	}
4104 	/*
4105 	 * dst_ire can't be a broadcast when not ire_requested.
4106 	 * We also prevent ire's with src address INADDR_ANY to
4107 	 * be used, which are created temporarily for
4108 	 * sending out packets from endpoints that have
4109 	 * conn_unspec_src set.  If verify_dst is true, the destination must be
4110 	 * reachable.  If verify_dst is false, the destination needn't be
4111 	 * reachable.
4112 	 *
4113 	 * If we match on a reject or black hole, then we've got a
4114 	 * local failure.  May as well fail out the connect() attempt,
4115 	 * since it's never going to succeed.
4116 	 */
4117 	if (dst_ire == NULL || dst_ire->ire_src_addr == INADDR_ANY ||
4118 	    (dst_ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) ||
4119 	    ((dst_ire->ire_type & IRE_BROADCAST) && !ire_requested)) {
4120 		/*
4121 		 * If we're verifying destination reachability, we always want
4122 		 * to complain here.
4123 		 *
4124 		 * If we're not verifying destination reachability but the
4125 		 * destination has a route, we still want to fail on the
4126 		 * temporary address and broadcast address tests.
4127 		 */
4128 		if (verify_dst || (dst_ire != NULL)) {
4129 			if (ip_debug > 2) {
4130 				pr_addr_dbg("ip_bind_connected: bad connected "
4131 				    "dst %s\n", AF_INET, &dst_addr);
4132 			}
4133 			if (dst_ire == NULL || !(dst_ire->ire_type & IRE_HOST))
4134 				error = ENETUNREACH;
4135 			else
4136 				error = EHOSTUNREACH;
4137 			goto bad_addr;
4138 		}
4139 	}
4140 	/*
4141 	 * If the app does a connect(), it means that it will most likely
4142 	 * send more than 1 packet to the destination.  It makes sense
4143 	 * to clear the temporary flag.
4144 	 */
4145 	if (dst_ire != NULL && dst_ire->ire_type == IRE_CACHE &&
4146 	    (dst_ire->ire_marks & IRE_MARK_TEMPORARY)) {
4147 		irb_t *irb = dst_ire->ire_bucket;
4148 
4149 		rw_enter(&irb->irb_lock, RW_WRITER);
4150 		dst_ire->ire_marks &= ~IRE_MARK_TEMPORARY;
4151 		irb->irb_tmp_ire_cnt--;
4152 		rw_exit(&irb->irb_lock);
4153 	}
4154 
4155 	/*
4156 	 * See if we should notify ULP about MDT; we do this whether or not
4157 	 * ire_requested is TRUE, in order to handle active connects; MDT
4158 	 * eligibility tests for passive connects are handled separately
4159 	 * through tcp_adapt_ire().  We do this before the source address
4160 	 * selection, because dst_ire may change after a call to
4161 	 * ipif_select_source().  This is a best-effort check, as the
4162 	 * packet for this connection may not actually go through
4163 	 * dst_ire->ire_stq, and the exact IRE can only be known after
4164 	 * calling ip_newroute().  This is why we further check on the
4165 	 * IRE during Multidata packet transmission in tcp_multisend().
4166 	 */
4167 	if (ip_multidata_outbound && !ipsec_policy_set && dst_ire != NULL &&
4168 	    !(dst_ire->ire_type & (IRE_LOCAL | IRE_LOOPBACK | IRE_BROADCAST)) &&
4169 	    (md_ill = ire_to_ill(dst_ire), md_ill != NULL) &&
4170 	    (md_ill->ill_capabilities & ILL_CAPAB_MDT)) {
4171 		md_dst_ire = dst_ire;
4172 		IRE_REFHOLD(md_dst_ire);
4173 	}
4174 
4175 	if (dst_ire != NULL &&
4176 	    dst_ire->ire_type == IRE_LOCAL &&
4177 	    dst_ire->ire_zoneid != zoneid) {
4178 		/*
4179 		 * If the IRE belongs to a different zone, look for a matching
4180 		 * route in the forwarding table and use the source address from
4181 		 * that route.
4182 		 */
4183 		src_ire = ire_ftable_lookup(dst_addr, 0, 0, 0, NULL, NULL,
4184 		    zoneid, 0,
4185 		    MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT |
4186 		    MATCH_IRE_RJ_BHOLE);
4187 		if (src_ire == NULL) {
4188 			error = EHOSTUNREACH;
4189 			goto bad_addr;
4190 		} else if (src_ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) {
4191 			if (!(src_ire->ire_type & IRE_HOST))
4192 				error = ENETUNREACH;
4193 			else
4194 				error = EHOSTUNREACH;
4195 			goto bad_addr;
4196 		}
4197 		if (src_addr == INADDR_ANY)
4198 			src_addr = src_ire->ire_src_addr;
4199 		ire_refrele(src_ire);
4200 		src_ire = NULL;
4201 	} else if ((src_addr == INADDR_ANY) && (dst_ire != NULL)) {
4202 		if ((sire != NULL) && (sire->ire_flags & RTF_SETSRC)) {
4203 			src_addr = sire->ire_src_addr;
4204 			ire_refrele(dst_ire);
4205 			dst_ire = sire;
4206 			sire = NULL;
4207 		} else {
4208 			/*
4209 			 * Pick a source address so that a proper inbound
4210 			 * load spreading would happen.
4211 			 */
4212 			ill_t *dst_ill = dst_ire->ire_ipif->ipif_ill;
4213 			ipif_t *src_ipif = NULL;
4214 			ire_t *ipif_ire;
4215 
4216 			/*
4217 			 * Supply a local source address such that inbound
4218 			 * load spreading happens.
4219 			 *
4220 			 * Determine the best source address on this ill for
4221 			 * the destination.
4222 			 *
4223 			 * 1) For broadcast, we should return a broadcast ire
4224 			 *    found above so that upper layers know that the
4225 			 *    destination address is a broadcast address.
4226 			 *
4227 			 * 2) If this is part of a group, select a better
4228 			 *    source address so that better inbound load
4229 			 *    balancing happens. Do the same if the ipif
4230 			 *    is DEPRECATED.
4231 			 *
4232 			 * 3) If the outgoing interface is part of a usesrc
4233 			 *    group, then try selecting a source address from
4234 			 *    the usesrc ILL.
4235 			 */
4236 			if (!(dst_ire->ire_type & IRE_BROADCAST) &&
4237 			    ((dst_ill->ill_group != NULL) ||
4238 			    (dst_ire->ire_ipif->ipif_flags &
4239 			    IPIF_DEPRECATED) ||
4240 			    (dst_ill->ill_usesrc_ifindex != 0))) {
4241 				src_ipif = ipif_select_source(dst_ill,
4242 				    dst_addr, zoneid);
4243 				if (src_ipif != NULL) {
4244 					if (IS_VNI(src_ipif->ipif_ill)) {
4245 						/*
4246 						 * For VNI there is no
4247 						 * interface route
4248 						 */
4249 						src_addr =
4250 						    src_ipif->ipif_src_addr;
4251 					} else {
4252 						ipif_ire =
4253 						    ipif_to_ire(src_ipif);
4254 						if (ipif_ire != NULL) {
4255 							IRE_REFRELE(dst_ire);
4256 							dst_ire = ipif_ire;
4257 						}
4258 						src_addr =
4259 						    dst_ire->ire_src_addr;
4260 					}
4261 					ipif_refrele(src_ipif);
4262 				} else {
4263 					src_addr = dst_ire->ire_src_addr;
4264 				}
4265 			} else {
4266 				src_addr = dst_ire->ire_src_addr;
4267 			}
4268 		}
4269 	}
4270 
4271 	/*
4272 	 * We do ire_route_lookup() here (and not
4273 	 * interface lookup as we assert that
4274 	 * src_addr should only come from an
4275 	 * UP interface for hard binding.
4276 	 */
4277 	ASSERT(src_ire == NULL);
4278 	src_ire = ire_route_lookup(src_addr, 0, 0, 0, NULL,
4279 	    NULL, zoneid, MATCH_IRE_ZONEONLY);
4280 	/* src_ire must be a local|loopback */
4281 	if (!IRE_IS_LOCAL(src_ire)) {
4282 		if (ip_debug > 2) {
4283 			pr_addr_dbg("ip_bind_connected: bad connected "
4284 			    "src %s\n", AF_INET, &src_addr);
4285 		}
4286 		error = EADDRNOTAVAIL;
4287 		goto bad_addr;
4288 	}
4289 
4290 	/*
4291 	 * If the source address is a loopback address, the
4292 	 * destination had best be local or multicast.
4293 	 * The transports that can't handle multicast will reject
4294 	 * those addresses.
4295 	 */
4296 	if (src_ire->ire_type == IRE_LOOPBACK &&
4297 	    !(IRE_IS_LOCAL(dst_ire) || CLASSD(dst_addr))) {
4298 		ip1dbg(("ip_bind_connected: bad connected loopback\n"));
4299 		error = -1;
4300 		goto bad_addr;
4301 	}
4302 
4303 	/*
4304 	 * Allow setting new policies. For example, disconnects come
4305 	 * down as ipa_t bind. As we would have set conn_policy_cached
4306 	 * to B_TRUE before, we should set it to B_FALSE, so that policy
4307 	 * can change after the disconnect.
4308 	 */
4309 	connp->conn_policy_cached = B_FALSE;
4310 
4311 	/*
4312 	 * Set the conn addresses/ports immediately, so the IPsec policy calls
4313 	 * can handle their passed-in conn's.
4314 	 */
4315 
4316 	IN6_IPADDR_TO_V4MAPPED(src_addr, &connp->conn_srcv6);
4317 	IN6_IPADDR_TO_V4MAPPED(dst_addr, &connp->conn_remv6);
4318 	connp->conn_lport = lport;
4319 	connp->conn_fport = fport;
4320 	*src_addrp = src_addr;
4321 
4322 	ASSERT(!(ipsec_policy_set && ire_requested));
4323 	if (ire_requested) {
4324 		iulp_t *ulp_info = NULL;
4325 
4326 		/*
4327 		 * Note that sire will not be NULL if this is an off-link
4328 		 * connection and there is not cache for that dest yet.
4329 		 *
4330 		 * XXX Because of an existing bug, if there are multiple
4331 		 * default routes, the IRE returned now may not be the actual
4332 		 * default route used (default routes are chosen in a
4333 		 * round robin fashion).  So if the metrics for different
4334 		 * default routes are different, we may return the wrong
4335 		 * metrics.  This will not be a problem if the existing
4336 		 * bug is fixed.
4337 		 */
4338 		if (sire != NULL) {
4339 			ulp_info = &(sire->ire_uinfo);
4340 		}
4341 		if (!ip_bind_insert_ire(mp, dst_ire, ulp_info)) {
4342 			error = -1;
4343 			goto bad_addr;
4344 		}
4345 	} else if (ipsec_policy_set) {
4346 		if (!ip_bind_ipsec_policy_set(connp, policy_mp)) {
4347 			error = -1;
4348 			goto bad_addr;
4349 		}
4350 	}
4351 
4352 	/*
4353 	 * Cache IPsec policy in this conn.  If we have per-socket policy,
4354 	 * we'll cache that.  If we don't, we'll inherit global policy.
4355 	 *
4356 	 * We can't insert until the conn reflects the policy. Note that
4357 	 * conn_policy_cached is set by ipsec_conn_cache_policy() even for
4358 	 * connections where we don't have a policy. This is to prevent
4359 	 * global policy lookups in the inbound path.
4360 	 *
4361 	 * If we insert before we set conn_policy_cached,
4362 	 * CONN_INBOUND_POLICY_PRESENT() check can still evaluate true
4363 	 * because global policy cound be non-empty. We normally call
4364 	 * ipsec_check_policy() for conn_policy_cached connections only if
4365 	 * ipc_in_enforce_policy is set. But in this case,
4366 	 * conn_policy_cached can get set anytime since we made the
4367 	 * CONN_INBOUND_POLICY_PRESENT() check and ipsec_check_policy() is
4368 	 * called, which will make the above assumption false.  Thus, we
4369 	 * need to insert after we set conn_policy_cached.
4370 	 */
4371 	if ((error = ipsec_conn_cache_policy(connp, B_TRUE)) != 0)
4372 		goto bad_addr;
4373 
4374 	if (fanout_insert) {
4375 		/*
4376 		 * The addresses have been verified. Time to insert in
4377 		 * the correct fanout list.
4378 		 */
4379 		error = ipcl_conn_insert(connp, protocol, src_addr,
4380 		    dst_addr, connp->conn_ports);
4381 	}
4382 
4383 	if (error == 0) {
4384 		connp->conn_fully_bound = B_TRUE;
4385 		/*
4386 		 * Our initial checks for MDT have passed; the IRE is not
4387 		 * LOCAL/LOOPBACK/BROADCAST, and the link layer seems to
4388 		 * be supporting MDT.  Pass the IRE, IPC and ILL into
4389 		 * ip_mdinfo_return(), which performs further checks
4390 		 * against them and upon success, returns the MDT info
4391 		 * mblk which we will attach to the bind acknowledgment.
4392 		 */
4393 		if (md_dst_ire != NULL) {
4394 			mblk_t *mdinfo_mp;
4395 
4396 			ASSERT(md_ill != NULL);
4397 			ASSERT(md_ill->ill_mdt_capab != NULL);
4398 			if ((mdinfo_mp = ip_mdinfo_return(md_dst_ire, connp,
4399 			    md_ill->ill_name, md_ill->ill_mdt_capab)) != NULL)
4400 				linkb(mp, mdinfo_mp);
4401 		}
4402 	}
4403 bad_addr:
4404 	if (ipsec_policy_set) {
4405 		ASSERT(policy_mp == mp->b_cont);
4406 		ASSERT(policy_mp != NULL);
4407 		freeb(policy_mp);
4408 		/*
4409 		 * As of now assume that nothing else accompanies
4410 		 * IPSEC_POLICY_SET.
4411 		 */
4412 		mp->b_cont = NULL;
4413 	}
4414 	if (src_ire != NULL)
4415 		IRE_REFRELE(src_ire);
4416 	if (dst_ire != NULL)
4417 		IRE_REFRELE(dst_ire);
4418 	if (sire != NULL)
4419 		IRE_REFRELE(sire);
4420 	if (md_dst_ire != NULL)
4421 		IRE_REFRELE(md_dst_ire);
4422 	return (error);
4423 }
4424 
4425 /*
4426  * Insert the ire in b_cont. Returns false if it fails (due to lack of space).
4427  * Prefers dst_ire over src_ire.
4428  */
4429 static boolean_t
4430 ip_bind_insert_ire(mblk_t *mp, ire_t *ire, iulp_t *ulp_info)
4431 {
4432 	mblk_t	*mp1;
4433 	ire_t *ret_ire = NULL;
4434 
4435 	mp1 = mp->b_cont;
4436 	ASSERT(mp1 != NULL);
4437 
4438 	if (ire != NULL) {
4439 		/*
4440 		 * mp1 initialized above to IRE_DB_REQ_TYPE
4441 		 * appended mblk. Its <upper protocol>'s
4442 		 * job to make sure there is room.
4443 		 */
4444 		if ((mp1->b_datap->db_lim - mp1->b_rptr) < sizeof (ire_t))
4445 			return (0);
4446 
4447 		mp1->b_datap->db_type = IRE_DB_TYPE;
4448 		mp1->b_wptr = mp1->b_rptr + sizeof (ire_t);
4449 		bcopy(ire, mp1->b_rptr, sizeof (ire_t));
4450 		ret_ire = (ire_t *)mp1->b_rptr;
4451 		/*
4452 		 * Pass the latest setting of the ip_path_mtu_discovery and
4453 		 * copy the ulp info if any.
4454 		 */
4455 		ret_ire->ire_frag_flag |= (ip_path_mtu_discovery) ?
4456 		    IPH_DF : 0;
4457 		if (ulp_info != NULL) {
4458 			bcopy(ulp_info, &(ret_ire->ire_uinfo),
4459 			    sizeof (iulp_t));
4460 		}
4461 		ret_ire->ire_mp = mp1;
4462 	} else {
4463 		/*
4464 		 * No IRE was found. Remove IRE mblk.
4465 		 */
4466 		mp->b_cont = mp1->b_cont;
4467 		freeb(mp1);
4468 	}
4469 
4470 	return (1);
4471 }
4472 
4473 /*
4474  * Carve "len" bytes out of an mblk chain, consuming any we empty, and duping
4475  * the final piece where we don't.  Return a pointer to the first mblk in the
4476  * result, and update the pointer to the next mblk to chew on.  If anything
4477  * goes wrong (i.e., dupb fails), we waste everything in sight and return a
4478  * NULL pointer.
4479  */
4480 mblk_t *
4481 ip_carve_mp(mblk_t **mpp, ssize_t len)
4482 {
4483 	mblk_t	*mp0;
4484 	mblk_t	*mp1;
4485 	mblk_t	*mp2;
4486 
4487 	if (!len || !mpp || !(mp0 = *mpp))
4488 		return (NULL);
4489 	/* If we aren't going to consume the first mblk, we need a dup. */
4490 	if (mp0->b_wptr - mp0->b_rptr > len) {
4491 		mp1 = dupb(mp0);
4492 		if (mp1) {
4493 			/* Partition the data between the two mblks. */
4494 			mp1->b_wptr = mp1->b_rptr + len;
4495 			mp0->b_rptr = mp1->b_wptr;
4496 			/*
4497 			 * after adjustments if mblk not consumed is now
4498 			 * unaligned, try to align it. If this fails free
4499 			 * all messages and let upper layer recover.
4500 			 */
4501 			if (!OK_32PTR(mp0->b_rptr)) {
4502 				if (!pullupmsg(mp0, -1)) {
4503 					freemsg(mp0);
4504 					freemsg(mp1);
4505 					*mpp = NULL;
4506 					return (NULL);
4507 				}
4508 			}
4509 		}
4510 		return (mp1);
4511 	}
4512 	/* Eat through as many mblks as we need to get len bytes. */
4513 	len -= mp0->b_wptr - mp0->b_rptr;
4514 	for (mp2 = mp1 = mp0; (mp2 = mp2->b_cont) != 0 && len; mp1 = mp2) {
4515 		if (mp2->b_wptr - mp2->b_rptr > len) {
4516 			/*
4517 			 * We won't consume the entire last mblk.  Like
4518 			 * above, dup and partition it.
4519 			 */
4520 			mp1->b_cont = dupb(mp2);
4521 			mp1 = mp1->b_cont;
4522 			if (!mp1) {
4523 				/*
4524 				 * Trouble.  Rather than go to a lot of
4525 				 * trouble to clean up, we free the messages.
4526 				 * This won't be any worse than losing it on
4527 				 * the wire.
4528 				 */
4529 				freemsg(mp0);
4530 				freemsg(mp2);
4531 				*mpp = NULL;
4532 				return (NULL);
4533 			}
4534 			mp1->b_wptr = mp1->b_rptr + len;
4535 			mp2->b_rptr = mp1->b_wptr;
4536 			/*
4537 			 * after adjustments if mblk not consumed is now
4538 			 * unaligned, try to align it. If this fails free
4539 			 * all messages and let upper layer recover.
4540 			 */
4541 			if (!OK_32PTR(mp2->b_rptr)) {
4542 				if (!pullupmsg(mp2, -1)) {
4543 					freemsg(mp0);
4544 					freemsg(mp2);
4545 					*mpp = NULL;
4546 					return (NULL);
4547 				}
4548 			}
4549 			*mpp = mp2;
4550 			return (mp0);
4551 		}
4552 		/* Decrement len by the amount we just got. */
4553 		len -= mp2->b_wptr - mp2->b_rptr;
4554 	}
4555 	/*
4556 	 * len should be reduced to zero now.  If not our caller has
4557 	 * screwed up.
4558 	 */
4559 	if (len) {
4560 		/* Shouldn't happen! */
4561 		freemsg(mp0);
4562 		*mpp = NULL;
4563 		return (NULL);
4564 	}
4565 	/*
4566 	 * We consumed up to exactly the end of an mblk.  Detach the part
4567 	 * we are returning from the rest of the chain.
4568 	 */
4569 	mp1->b_cont = NULL;
4570 	*mpp = mp2;
4571 	return (mp0);
4572 }
4573 
4574 /* The ill stream is being unplumbed. Called from ip_close */
4575 int
4576 ip_modclose(ill_t *ill)
4577 {
4578 
4579 	boolean_t success;
4580 	ipsq_t	*ipsq;
4581 	ipif_t	*ipif;
4582 	queue_t	*q = ill->ill_rq;
4583 
4584 	/*
4585 	 * Forcibly enter the ipsq after some delay. This is to take
4586 	 * care of the case when some ioctl does not complete because
4587 	 * we sent a control message to the driver and it did not
4588 	 * send us a reply. We want to be able to at least unplumb
4589 	 * and replumb rather than force the user to reboot the system.
4590 	 */
4591 	success = ipsq_enter(ill, B_FALSE);
4592 
4593 	/*
4594 	 * Open/close/push/pop is guaranteed to be single threaded
4595 	 * per stream by STREAMS. FS guarantees that all references
4596 	 * from top are gone before close is called. So there can't
4597 	 * be another close thread that has set CONDEMNED on this ill.
4598 	 * and cause ipsq_enter to return failure.
4599 	 */
4600 	ASSERT(success);
4601 	ipsq = ill->ill_phyint->phyint_ipsq;
4602 
4603 	/*
4604 	 * Mark it condemned. No new reference will be made to this ill.
4605 	 * Lookup functions will return an error. Threads that try to
4606 	 * increment the refcnt must check for ILL_CAN_LOOKUP. This ensures
4607 	 * that the refcnt will drop down to zero.
4608 	 */
4609 	mutex_enter(&ill->ill_lock);
4610 	ill->ill_state_flags |= ILL_CONDEMNED;
4611 	for (ipif = ill->ill_ipif; ipif != NULL;
4612 	    ipif = ipif->ipif_next) {
4613 		ipif->ipif_state_flags |= IPIF_CONDEMNED;
4614 	}
4615 	/*
4616 	 * Wake up anybody waiting to enter the ipsq. ipsq_enter
4617 	 * returns  error if ILL_CONDEMNED is set
4618 	 */
4619 	cv_broadcast(&ill->ill_cv);
4620 	mutex_exit(&ill->ill_lock);
4621 
4622 	/*
4623 	 * Shut down fragmentation reassembly.
4624 	 * ill_frag_timer won't start a timer again.
4625 	 * Now cancel any existing timer
4626 	 */
4627 	(void) untimeout(ill->ill_frag_timer_id);
4628 	(void) ill_frag_timeout(ill, 0);
4629 
4630 	/*
4631 	 * If MOVE was in progress, clear the
4632 	 * move_in_progress fields also.
4633 	 */
4634 	if (ill->ill_move_in_progress) {
4635 		ILL_CLEAR_MOVE(ill);
4636 	}
4637 
4638 	/*
4639 	 * Call ill_delete to bring down the ipifs, ilms and ill on
4640 	 * this ill. Then wait for the refcnts to drop to zero.
4641 	 * ill_is_quiescent checks whether the ill is really quiescent.
4642 	 * Then make sure that threads that are waiting to enter the
4643 	 * ipsq have seen the error returned by ipsq_enter and have
4644 	 * gone away. Then we call ill_delete_tail which does the
4645 	 * DL_UNBIND and DL_DETACH with the driver and then qprocsoff.
4646 	 */
4647 	ill_delete(ill);
4648 	mutex_enter(&ill->ill_lock);
4649 	while (!ill_is_quiescent(ill))
4650 		cv_wait(&ill->ill_cv, &ill->ill_lock);
4651 	while (ill->ill_waiters)
4652 		cv_wait(&ill->ill_cv, &ill->ill_lock);
4653 
4654 	mutex_exit(&ill->ill_lock);
4655 
4656 	/* qprocsoff is called in ill_delete_tail */
4657 	ill_delete_tail(ill);
4658 
4659 	/*
4660 	 * Walk through all upper (conn) streams and qenable
4661 	 * those that have queued data.
4662 	 * close synchronization needs this to
4663 	 * be done to ensure that all upper layers blocked
4664 	 * due to flow control to the closing device
4665 	 * get unblocked.
4666 	 */
4667 	ip1dbg(("ip_wsrv: walking\n"));
4668 	conn_walk_drain();
4669 
4670 	mutex_enter(&ip_mi_lock);
4671 	mi_close_unlink(&ip_g_head, (IDP)ill);
4672 	mutex_exit(&ip_mi_lock);
4673 
4674 	/*
4675 	 * credp could be null if the open didn't succeed and ip_modopen
4676 	 * itself calls ip_close.
4677 	 */
4678 	if (ill->ill_credp != NULL)
4679 		crfree(ill->ill_credp);
4680 
4681 	mi_close_free((IDP)ill);
4682 	q->q_ptr = WR(q)->q_ptr = NULL;
4683 
4684 	ipsq_exit(ipsq, B_TRUE, B_TRUE);
4685 
4686 	return (0);
4687 }
4688 
4689 /*
4690  * IP has been configured as _D_QNEXTLESS for the client side i.e the driver
4691  * instance. This implies that
4692  * 1. IP cannot access the read side q_next pointer directly - it must
4693  *    use routines like putnext and canputnext.
4694  * 2. ip_close must ensure that all sources of messages being putnext upstream
4695  *    are gone before qprocsoff is called.
4696  *
4697  * #2 is handled by having ip_close do the ipcl_hash_remove and wait for
4698  * conn_ref to drop to zero before calling qprocsoff.
4699  */
4700 
4701 /* ARGSUSED */
4702 int
4703 ip_close(queue_t *q, int flags)
4704 {
4705 	conn_t		*connp;
4706 	boolean_t	drain_cleanup_reqd = B_FALSE;
4707 	boolean_t	conn_ioctl_cleanup_reqd = B_FALSE;
4708 	boolean_t	ilg_cleanup_reqd = B_FALSE;
4709 
4710 	TRACE_1(TR_FAC_IP, TR_IP_CLOSE, "ip_close: q %p", q);
4711 
4712 	/*
4713 	 * Call the appropriate delete routine depending on whether this is
4714 	 * a module or device.
4715 	 */
4716 	if (WR(q)->q_next != NULL) {
4717 		/* This is a module close */
4718 		return (ip_modclose((ill_t *)q->q_ptr));
4719 	}
4720 
4721 	connp = Q_TO_CONN(q);
4722 	ASSERT(connp->conn_tcp == NULL);
4723 
4724 	/*
4725 	 * We are being closed as /dev/ip or /dev/ip6.
4726 	 *
4727 	 * Mark the conn as closing, and this conn must not be
4728 	 * inserted in future into any list. Eg. conn_drain_insert(),
4729 	 * won't insert this conn into the conn_drain_list.
4730 	 * Similarly ill_pending_mp_add() will not add any mp to
4731 	 * the pending mp list, after this conn has started closing.
4732 	 *
4733 	 * conn_idl, conn_pending_ill, conn_down_pending_ill, conn_ilg
4734 	 * cannot get set henceforth.
4735 	 */
4736 	mutex_enter(&connp->conn_lock);
4737 	connp->conn_state_flags |= CONN_CLOSING;
4738 	if (connp->conn_idl != NULL)
4739 		drain_cleanup_reqd = B_TRUE;
4740 	if (connp->conn_oper_pending_ill != NULL)
4741 		conn_ioctl_cleanup_reqd = B_TRUE;
4742 	if (connp->conn_ilg_inuse != 0)
4743 		ilg_cleanup_reqd = B_TRUE;
4744 	mutex_exit(&connp->conn_lock);
4745 
4746 	if (conn_ioctl_cleanup_reqd)
4747 		conn_ioctl_cleanup(connp);
4748 
4749 	/*
4750 	 * Remove this conn from any fanout list it is on.
4751 	 * Then wait until the number of pending putnexts from
4752 	 * the fanout code drops to zero, before calling qprocsoff.
4753 	 * This is the guarantee a QNEXTLESS driver provides to
4754 	 * STREAMS, and is mentioned at the top of this function.
4755 	 */
4756 
4757 	ipcl_hash_remove(connp);
4758 
4759 	/*
4760 	 * Remove this conn from the drain list, and do
4761 	 * any other cleanup that may be required.
4762 	 * (Only non-tcp streams may have a non-null conn_idl.
4763 	 * TCP streams are never flow controlled, and
4764 	 * conn_idl will be null)
4765 	 */
4766 	if (drain_cleanup_reqd)
4767 		conn_drain_tail(connp, B_TRUE);
4768 
4769 	if (connp->conn_rq == ip_g_mrouter || connp->conn_wq == ip_g_mrouter)
4770 		(void) ip_mrouter_done(NULL);
4771 
4772 	if (ilg_cleanup_reqd)
4773 		ilg_delete_all(connp);
4774 
4775 	conn_delete_ire(connp, NULL);
4776 
4777 
4778 	/*
4779 	 * Now conn refcnt can increase only thru CONN_INC_REF_LOCKED.
4780 	 * callers from write side can't be there now because close
4781 	 * is in progress. The only other caller is ipcl_walk
4782 	 * which checks for the condemned flag.
4783 	 */
4784 	mutex_enter(&connp->conn_lock);
4785 	connp->conn_state_flags |= CONN_CONDEMNED;
4786 	while (connp->conn_ref != 1)
4787 		cv_wait(&connp->conn_cv, &connp->conn_lock);
4788 	mutex_exit(&connp->conn_lock);
4789 
4790 	qprocsoff(q);
4791 
4792 	/*
4793 	 * Now we are truly single threaded on this stream, and can
4794 	 * delete the things hanging off the connp, and finally the connp.
4795 	 * We removed this connp from the fanout list, it cannot be
4796 	 * accessed thru the fanouts, and we already waited for the
4797 	 * conn_ref to drop to 0. We are already in close, so
4798 	 * there cannot be any other thread from the top. qprocsoff
4799 	 * has completed, and service has completed or won't run in
4800 	 * future.
4801 	 */
4802 	if (connp->conn_latch != NULL) {
4803 		IPLATCH_REFRELE(connp->conn_latch);
4804 		connp->conn_latch = NULL;
4805 	}
4806 	if (connp->conn_policy != NULL) {
4807 		IPPH_REFRELE(connp->conn_policy);
4808 		connp->conn_policy = NULL;
4809 	}
4810 	if (connp->conn_ipsec_opt_mp != NULL) {
4811 		freemsg(connp->conn_ipsec_opt_mp);
4812 		connp->conn_ipsec_opt_mp = NULL;
4813 	}
4814 	if (connp->conn_cred != NULL) {
4815 		crfree(connp->conn_cred);
4816 		connp->conn_cred = NULL;
4817 	}
4818 
4819 	inet_minor_free(ip_minor_arena, connp->conn_dev);
4820 
4821 	connp->conn_ref--;
4822 	ipcl_conn_destroy(connp);
4823 
4824 	q->q_ptr = WR(q)->q_ptr = NULL;
4825 	return (0);
4826 }
4827 
4828 /* Return the IP checksum for the IP header at "iph". */
4829 uint16_t
4830 ip_csum_hdr(ipha_t *ipha)
4831 {
4832 	uint16_t	*uph;
4833 	uint32_t	sum;
4834 	int		opt_len;
4835 
4836 	opt_len = (ipha->ipha_version_and_hdr_length & 0xF) -
4837 	    IP_SIMPLE_HDR_LENGTH_IN_WORDS;
4838 	uph = (uint16_t *)ipha;
4839 	sum = uph[0] + uph[1] + uph[2] + uph[3] + uph[4] +
4840 		uph[5] + uph[6] + uph[7] + uph[8] + uph[9];
4841 	if (opt_len > 0) {
4842 		do {
4843 			sum += uph[10];
4844 			sum += uph[11];
4845 			uph += 2;
4846 		} while (--opt_len);
4847 	}
4848 	sum = (sum & 0xFFFF) + (sum >> 16);
4849 	sum = ~(sum + (sum >> 16)) & 0xFFFF;
4850 	if (sum == 0xffff)
4851 		sum = 0;
4852 	return ((uint16_t)sum);
4853 }
4854 
4855 void
4856 ip_ddi_destroy(void)
4857 {
4858 	tcp_ddi_destroy();
4859 	sctp_ddi_destroy();
4860 	ipsec_loader_destroy();
4861 	ipsec_policy_destroy();
4862 	ipsec_kstat_destroy();
4863 	nd_free(&ip_g_nd);
4864 	mutex_destroy(&igmp_timer_lock);
4865 	mutex_destroy(&mld_timer_lock);
4866 	mutex_destroy(&igmp_slowtimeout_lock);
4867 	mutex_destroy(&mld_slowtimeout_lock);
4868 	mutex_destroy(&ip_mi_lock);
4869 	mutex_destroy(&rts_clients.connf_lock);
4870 	ip_ire_fini();
4871 	ip6_asp_free();
4872 	conn_drain_fini();
4873 	ipcl_destroy();
4874 	inet_minor_destroy(ip_minor_arena);
4875 	icmp_kstat_fini();
4876 	ip_kstat_fini();
4877 	rw_destroy(&ipsec_capab_ills_lock);
4878 	rw_destroy(&ill_g_usesrc_lock);
4879 	ip_drop_unregister(&ip_dropper);
4880 }
4881 
4882 
4883 void
4884 ip_ddi_init(void)
4885 {
4886 	TCP6_MAJ = ddi_name_to_major(TCP6);
4887 	TCP_MAJ	= ddi_name_to_major(TCP);
4888 	SCTP_MAJ = ddi_name_to_major(SCTP);
4889 	SCTP6_MAJ = ddi_name_to_major(SCTP6);
4890 
4891 	ip_input_proc = ip_squeue_switch(ip_squeue_enter);
4892 
4893 	/* IP's IPsec code calls the packet dropper */
4894 	ip_drop_register(&ip_dropper, "IP IPsec processing");
4895 
4896 	if (!ip_g_nd) {
4897 		if (!ip_param_register(lcl_param_arr, A_CNT(lcl_param_arr),
4898 		    lcl_ndp_arr, A_CNT(lcl_ndp_arr))) {
4899 			nd_free(&ip_g_nd);
4900 		}
4901 	}
4902 
4903 	ipsec_loader_init();
4904 	ipsec_policy_init();
4905 	ipsec_kstat_init();
4906 	rw_init(&ip_g_nd_lock, NULL, RW_DEFAULT, NULL);
4907 	mutex_init(&igmp_timer_lock, NULL, MUTEX_DEFAULT, NULL);
4908 	mutex_init(&mld_timer_lock, NULL, MUTEX_DEFAULT, NULL);
4909 	mutex_init(&igmp_slowtimeout_lock, NULL, MUTEX_DEFAULT, NULL);
4910 	mutex_init(&mld_slowtimeout_lock, NULL, MUTEX_DEFAULT, NULL);
4911 	mutex_init(&ip_mi_lock, NULL, MUTEX_DEFAULT, NULL);
4912 	mutex_init(&ip_addr_avail_lock, NULL, MUTEX_DEFAULT, NULL);
4913 	rw_init(&ill_g_lock, NULL, RW_DEFAULT, NULL);
4914 	rw_init(&ipsec_capab_ills_lock, NULL, RW_DEFAULT, NULL);
4915 	rw_init(&ill_g_usesrc_lock, NULL, RW_DEFAULT, NULL);
4916 
4917 	/*
4918 	 * For IP and TCP the minor numbers should start from 2 since we have 4
4919 	 * initial devices: ip, ip6, tcp, tcp6.
4920 	 */
4921 	if ((ip_minor_arena = inet_minor_create("ip_minor_arena",
4922 	    INET_MIN_DEV + 2, KM_SLEEP)) == NULL) {
4923 		cmn_err(CE_PANIC,
4924 		    "ip_ddi_init: ip_minor_arena creation failed\n");
4925 	}
4926 
4927 	ipcl_init();
4928 	mutex_init(&rts_clients.connf_lock, NULL, MUTEX_DEFAULT, NULL);
4929 	ip_ire_init();
4930 	ip6_asp_init();
4931 	ipif_init();
4932 	conn_drain_init();
4933 	tcp_ddi_init();
4934 	sctp_ddi_init();
4935 
4936 	ip_poll_normal_ticks = MSEC_TO_TICK_ROUNDUP(ip_poll_normal_ms);
4937 
4938 	if ((ip_kstat = kstat_create("ip", 0, "ipstat",
4939 		"net", KSTAT_TYPE_NAMED,
4940 		sizeof (ip_statistics) / sizeof (kstat_named_t),
4941 		KSTAT_FLAG_VIRTUAL)) != NULL) {
4942 		ip_kstat->ks_data = &ip_statistics;
4943 		kstat_install(ip_kstat);
4944 	}
4945 	ip_kstat_init();
4946 	ip6_kstat_init();
4947 	icmp_kstat_init();
4948 
4949 	ipsec_loader_start();
4950 }
4951 
4952 /*
4953  * Allocate and initialize a DLPI template of the specified length.  (May be
4954  * called as writer.)
4955  */
4956 mblk_t *
4957 ip_dlpi_alloc(size_t len, t_uscalar_t prim)
4958 {
4959 	mblk_t	*mp;
4960 
4961 	mp = allocb(len, BPRI_MED);
4962 	if (!mp)
4963 		return (NULL);
4964 
4965 	/*
4966 	 * DLPIv2 says that DL_INFO_REQ and DL_TOKEN_REQ (the latter
4967 	 * of which we don't seem to use) are sent with M_PCPROTO, and
4968 	 * that other DLPI are M_PROTO.
4969 	 */
4970 	if (prim == DL_INFO_REQ) {
4971 		mp->b_datap->db_type = M_PCPROTO;
4972 	} else {
4973 		mp->b_datap->db_type = M_PROTO;
4974 	}
4975 
4976 	mp->b_wptr = mp->b_rptr + len;
4977 	bzero(mp->b_rptr, len);
4978 	((dl_unitdata_req_t *)mp->b_rptr)->dl_primitive = prim;
4979 	return (mp);
4980 }
4981 
4982 const char *
4983 dlpi_prim_str(int prim)
4984 {
4985 	switch (prim) {
4986 	case DL_INFO_REQ:	return ("DL_INFO_REQ");
4987 	case DL_INFO_ACK:	return ("DL_INFO_ACK");
4988 	case DL_ATTACH_REQ:	return ("DL_ATTACH_REQ");
4989 	case DL_DETACH_REQ:	return ("DL_DETACH_REQ");
4990 	case DL_BIND_REQ:	return ("DL_BIND_REQ");
4991 	case DL_BIND_ACK:	return ("DL_BIND_ACK");
4992 	case DL_UNBIND_REQ:	return ("DL_UNBIND_REQ");
4993 	case DL_OK_ACK:		return ("DL_OK_ACK");
4994 	case DL_ERROR_ACK:	return ("DL_ERROR_ACK");
4995 	case DL_ENABMULTI_REQ:	return ("DL_ENABMULTI_REQ");
4996 	case DL_DISABMULTI_REQ:	return ("DL_DISABMULTI_REQ");
4997 	case DL_PROMISCON_REQ:	return ("DL_PROMISCON_REQ");
4998 	case DL_PROMISCOFF_REQ:	return ("DL_PROMISCOFF_REQ");
4999 	case DL_UNITDATA_REQ:	return ("DL_UNITDATA_REQ");
5000 	case DL_UNITDATA_IND:	return ("DL_UNITDATA_IND");
5001 	case DL_UDERROR_IND:	return ("DL_UDERROR_IND");
5002 	case DL_PHYS_ADDR_REQ:	return ("DL_PHYS_ADDR_REQ");
5003 	case DL_PHYS_ADDR_ACK:	return ("DL_PHYS_ADDR_ACK");
5004 	case DL_SET_PHYS_ADDR_REQ:	return ("DL_SET_PHYS_ADDR_REQ");
5005 	case DL_NOTIFY_REQ:	return ("DL_NOTIFY_REQ");
5006 	case DL_NOTIFY_ACK:	return ("DL_NOTIFY_ACK");
5007 	case DL_NOTIFY_IND:	return ("DL_NOTIFY_IND");
5008 	case DL_CAPABILITY_REQ:	return ("DL_CAPABILITY_REQ");
5009 	case DL_CAPABILITY_ACK:	return ("DL_CAPABILITY_ACK");
5010 	case DL_CONTROL_REQ:	return ("DL_CONTROL_REQ");
5011 	case DL_CONTROL_ACK:	return ("DL_CONTROL_ACK");
5012 	default:		return ("<unknown primitive>");
5013 	}
5014 }
5015 
5016 const char *
5017 dlpi_err_str(int err)
5018 {
5019 	switch (err) {
5020 	case DL_ACCESS:		return ("DL_ACCESS");
5021 	case DL_BADADDR:	return ("DL_BADADDR");
5022 	case DL_BADCORR:	return ("DL_BADCORR");
5023 	case DL_BADDATA:	return ("DL_BADDATA");
5024 	case DL_BADPPA:		return ("DL_BADPPA");
5025 	case DL_BADPRIM:	return ("DL_BADPRIM");
5026 	case DL_BADQOSPARAM:	return ("DL_BADQOSPARAM");
5027 	case DL_BADQOSTYPE:	return ("DL_BADQOSTYPE");
5028 	case DL_BADSAP:		return ("DL_BADSAP");
5029 	case DL_BADTOKEN:	return ("DL_BADTOKEN");
5030 	case DL_BOUND:		return ("DL_BOUND");
5031 	case DL_INITFAILED:	return ("DL_INITFAILED");
5032 	case DL_NOADDR:		return ("DL_NOADDR");
5033 	case DL_NOTINIT:	return ("DL_NOTINIT");
5034 	case DL_OUTSTATE:	return ("DL_OUTSTATE");
5035 	case DL_SYSERR:		return ("DL_SYSERR");
5036 	case DL_UNSUPPORTED:	return ("DL_UNSUPPORTED");
5037 	case DL_UNDELIVERABLE:	return ("DL_UNDELIVERABLE");
5038 	case DL_NOTSUPPORTED :	return ("DL_NOTSUPPORTED ");
5039 	case DL_TOOMANY:	return ("DL_TOOMANY");
5040 	case DL_NOTENAB:	return ("DL_NOTENAB");
5041 	case DL_BUSY:		return ("DL_BUSY");
5042 	case DL_NOAUTO:		return ("DL_NOAUTO");
5043 	case DL_NOXIDAUTO:	return ("DL_NOXIDAUTO");
5044 	case DL_NOTESTAUTO:	return ("DL_NOTESTAUTO");
5045 	case DL_XIDAUTO:	return ("DL_XIDAUTO");
5046 	case DL_TESTAUTO:	return ("DL_TESTAUTO");
5047 	case DL_PENDING:	return ("DL_PENDING");
5048 	default:		return ("<unknown error>");
5049 	}
5050 }
5051 
5052 /*
5053  * Debug formatting routine.  Returns a character string representation of the
5054  * addr in buf, of the form xxx.xxx.xxx.xxx.  This routine takes the address
5055  * in the form of a ipaddr_t and calls ip_dot_saddr with a pointer.
5056  */
5057 char *
5058 ip_dot_addr(ipaddr_t addr, char *buf)
5059 {
5060 	return (ip_dot_saddr((uchar_t *)&addr, buf));
5061 }
5062 
5063 /*
5064  * Debug formatting routine.  Returns a character string representation of the
5065  * addr in buf, of the form xxx.xxx.xxx.xxx.  This routine takes the address
5066  * as a pointer.  The "xxx" parts including left zero padding so the final
5067  * string will fit easily in tables.  It would be nice to take a padding
5068  * length argument instead.
5069  */
5070 static char *
5071 ip_dot_saddr(uchar_t *addr, char *buf)
5072 {
5073 	(void) mi_sprintf(buf, "%03d.%03d.%03d.%03d",
5074 	    addr[0] & 0xFF, addr[1] & 0xFF, addr[2] & 0xFF, addr[3] & 0xFF);
5075 	return (buf);
5076 }
5077 
5078 /*
5079  * Send an ICMP error after patching up the packet appropriately.  Returns
5080  * non-zero if the appropriate MIB should be bumped; zero otherwise.
5081  */
5082 static int
5083 ip_fanout_send_icmp(queue_t *q, mblk_t *mp, uint_t flags,
5084     uint_t icmp_type, uint_t icmp_code, boolean_t mctl_present, zoneid_t zoneid)
5085 {
5086 	ipha_t *ipha;
5087 	mblk_t *first_mp;
5088 	boolean_t secure;
5089 	unsigned char db_type;
5090 
5091 	first_mp = mp;
5092 	if (mctl_present) {
5093 		mp = mp->b_cont;
5094 		secure = ipsec_in_is_secure(first_mp);
5095 		ASSERT(mp != NULL);
5096 	} else {
5097 		/*
5098 		 * If this is an ICMP error being reported - which goes
5099 		 * up as M_CTLs, we need to convert them to M_DATA till
5100 		 * we finish checking with global policy because
5101 		 * ipsec_check_global_policy() assumes M_DATA as clear
5102 		 * and M_CTL as secure.
5103 		 */
5104 		db_type = mp->b_datap->db_type;
5105 		mp->b_datap->db_type = M_DATA;
5106 		secure = B_FALSE;
5107 	}
5108 	/*
5109 	 * We are generating an icmp error for some inbound packet.
5110 	 * Called from all ip_fanout_(udp, tcp, proto) functions.
5111 	 * Before we generate an error, check with global policy
5112 	 * to see whether this is allowed to enter the system. As
5113 	 * there is no "conn", we are checking with global policy.
5114 	 */
5115 	ipha = (ipha_t *)mp->b_rptr;
5116 	if (secure || ipsec_inbound_v4_policy_present) {
5117 		first_mp = ipsec_check_global_policy(first_mp, NULL,
5118 		    ipha, NULL, mctl_present);
5119 		if (first_mp == NULL)
5120 			return (0);
5121 	}
5122 
5123 	if (!mctl_present)
5124 		mp->b_datap->db_type = db_type;
5125 
5126 	if (flags & IP_FF_SEND_ICMP) {
5127 		if (flags & IP_FF_HDR_COMPLETE) {
5128 			if (ip_hdr_complete(ipha, zoneid)) {
5129 				freemsg(first_mp);
5130 				return (1);
5131 			}
5132 		}
5133 		if (flags & IP_FF_CKSUM) {
5134 			/*
5135 			 * Have to correct checksum since
5136 			 * the packet might have been
5137 			 * fragmented and the reassembly code in ip_rput
5138 			 * does not restore the IP checksum.
5139 			 */
5140 			ipha->ipha_hdr_checksum = 0;
5141 			ipha->ipha_hdr_checksum = ip_csum_hdr(ipha);
5142 		}
5143 		switch (icmp_type) {
5144 		case ICMP_DEST_UNREACHABLE:
5145 			icmp_unreachable(WR(q), first_mp, icmp_code);
5146 			break;
5147 		default:
5148 			freemsg(first_mp);
5149 			break;
5150 		}
5151 	} else {
5152 		freemsg(first_mp);
5153 		return (0);
5154 	}
5155 
5156 	return (1);
5157 }
5158 
5159 #ifdef DEBUG
5160 /*
5161  * Copy the header into the IPSEC_IN message.
5162  */
5163 static void
5164 ipsec_inbound_debug_tag(mblk_t *ipsec_mp)
5165 {
5166 	mblk_t *data_mp = ipsec_mp->b_cont;
5167 	ipsec_in_t *ii = (ipsec_in_t *)ipsec_mp->b_rptr;
5168 	ipha_t *ipha;
5169 
5170 	if (ii->ipsec_in_type != IPSEC_IN)
5171 		return;
5172 	ASSERT(data_mp != NULL);
5173 
5174 	ipha = (ipha_t *)data_mp->b_rptr;
5175 	bcopy(ipha, ii->ipsec_in_saved_hdr,
5176 	    (IPH_HDR_VERSION(ipha) == IP_VERSION) ?
5177 	    sizeof (ipha_t) : sizeof (ip6_t));
5178 }
5179 #else
5180 #define	ipsec_inbound_debug_tag(x)	/* NOP */
5181 #endif	/* DEBUG */
5182 
5183 /*
5184  * Used to send an ICMP error message when a packet is received for
5185  * a protocol that is not supported. The mblk passed as argument
5186  * is consumed by this function.
5187  */
5188 void
5189 ip_proto_not_sup(queue_t *q, mblk_t *ipsec_mp, uint_t flags, zoneid_t zoneid)
5190 {
5191 	mblk_t *mp;
5192 	ipha_t *ipha;
5193 	ill_t *ill;
5194 	ipsec_in_t *ii;
5195 
5196 	ii = (ipsec_in_t *)ipsec_mp->b_rptr;
5197 	ASSERT(ii->ipsec_in_type == IPSEC_IN);
5198 
5199 	mp = ipsec_mp->b_cont;
5200 	ipsec_mp->b_cont = NULL;
5201 	ipha = (ipha_t *)mp->b_rptr;
5202 	if (IPH_HDR_VERSION(ipha) == IP_VERSION) {
5203 		if (ip_fanout_send_icmp(q, mp, flags, ICMP_DEST_UNREACHABLE,
5204 		    ICMP_PROTOCOL_UNREACHABLE, B_FALSE, zoneid)) {
5205 			BUMP_MIB(&ip_mib, ipInUnknownProtos);
5206 		}
5207 	} else {
5208 		/* Get ill from index in ipsec_in_t. */
5209 		ill = ill_lookup_on_ifindex(ii->ipsec_in_ill_index,
5210 		    B_TRUE, NULL, NULL, NULL, NULL);
5211 		if (ill != NULL) {
5212 			if (ip_fanout_send_icmp_v6(q, mp, flags,
5213 			    ICMP6_PARAM_PROB, ICMP6_PARAMPROB_NEXTHEADER,
5214 			    0, B_FALSE, zoneid)) {
5215 				BUMP_MIB(ill->ill_ip6_mib, ipv6InUnknownProtos);
5216 			}
5217 
5218 			ill_refrele(ill);
5219 		} else { /* re-link for the freemsg() below. */
5220 			ipsec_mp->b_cont = mp;
5221 		}
5222 	}
5223 
5224 	/* If ICMP delivered, ipsec_mp will be a singleton (b_cont == NULL). */
5225 	freemsg(ipsec_mp);
5226 }
5227 
5228 /*
5229  * See if the inbound datagram has had IPsec processing applied to it.
5230  */
5231 boolean_t
5232 ipsec_in_is_secure(mblk_t *ipsec_mp)
5233 {
5234 	ipsec_in_t *ii;
5235 
5236 	ii = (ipsec_in_t *)ipsec_mp->b_rptr;
5237 	ASSERT(ii->ipsec_in_type == IPSEC_IN);
5238 
5239 	if (ii->ipsec_in_loopback) {
5240 		return (ii->ipsec_in_secure);
5241 	} else {
5242 		return (ii->ipsec_in_ah_sa != NULL ||
5243 		    ii->ipsec_in_esp_sa != NULL ||
5244 		    ii->ipsec_in_decaps);
5245 	}
5246 }
5247 
5248 /*
5249  * Handle protocols with which IP is less intimate.  There
5250  * can be more than one stream bound to a particular
5251  * protocol.  When this is the case, normally each one gets a copy
5252  * of any incoming packets.
5253  *
5254  * IPSEC NOTE :
5255  *
5256  * Don't allow a secure packet going up a non-secure connection.
5257  * We don't allow this because
5258  *
5259  * 1) Reply might go out in clear which will be dropped at
5260  *    the sending side.
5261  * 2) If the reply goes out in clear it will give the
5262  *    adversary enough information for getting the key in
5263  *    most of the cases.
5264  *
5265  * Moreover getting a secure packet when we expect clear
5266  * implies that SA's were added without checking for
5267  * policy on both ends. This should not happen once ISAKMP
5268  * is used to negotiate SAs as SAs will be added only after
5269  * verifying the policy.
5270  *
5271  * NOTE : If the packet was tunneled and not multicast we only send
5272  * to it the first match. Unlike TCP and UDP fanouts this doesn't fall
5273  * back to delivering packets to AF_INET6 raw sockets.
5274  *
5275  * IPQoS Notes:
5276  * Once we have determined the client, invoke IPPF processing.
5277  * Policy processing takes place only if the callout_position, IPP_LOCAL_IN,
5278  * is enabled. If we get here from icmp_inbound_error_fanout or ip_wput_local
5279  * ip_policy will be false.
5280  *
5281  * Zones notes:
5282  * Currently only applications in the global zone can create raw sockets for
5283  * protocols other than ICMP. So unlike the broadcast / multicast case of
5284  * ip_fanout_udp(), we only send a copy of the packet to streams in the
5285  * specified zone. For ICMP, this is handled by the callers of icmp_inbound().
5286  */
5287 static void
5288 ip_fanout_proto(queue_t *q, mblk_t *mp, ill_t *ill, ipha_t *ipha, uint_t flags,
5289     boolean_t mctl_present, boolean_t ip_policy, ill_t *recv_ill,
5290     zoneid_t zoneid)
5291 {
5292 	queue_t	*rq;
5293 	mblk_t	*mp1, *first_mp1;
5294 	uint_t	protocol = ipha->ipha_protocol;
5295 	ipaddr_t dst;
5296 	boolean_t one_only;
5297 	mblk_t *first_mp = mp;
5298 	boolean_t secure;
5299 	uint32_t ill_index;
5300 	conn_t	*connp, *first_connp, *next_connp;
5301 	connf_t	*connfp;
5302 
5303 	if (mctl_present) {
5304 		mp = first_mp->b_cont;
5305 		secure = ipsec_in_is_secure(first_mp);
5306 		ASSERT(mp != NULL);
5307 	} else {
5308 		secure = B_FALSE;
5309 	}
5310 	dst = ipha->ipha_dst;
5311 	/*
5312 	 * If the packet was tunneled and not multicast we only send to it
5313 	 * the first match.
5314 	 */
5315 	one_only = ((protocol == IPPROTO_ENCAP || protocol == IPPROTO_IPV6) &&
5316 	    !CLASSD(dst));
5317 
5318 	connfp = &ipcl_proto_fanout[protocol];
5319 	mutex_enter(&connfp->connf_lock);
5320 	connp = connfp->connf_head;
5321 	for (connp = connfp->connf_head; connp != NULL;
5322 		connp = connp->conn_next) {
5323 		if (IPCL_PROTO_MATCH(connp, protocol, ipha, ill, flags, zoneid))
5324 			break;
5325 	}
5326 
5327 	if (connp == NULL || connp->conn_upq == NULL) {
5328 		/*
5329 		 * No one bound to these addresses.  Is
5330 		 * there a client that wants all
5331 		 * unclaimed datagrams?
5332 		 */
5333 		mutex_exit(&connfp->connf_lock);
5334 		/*
5335 		 * Check for IPPROTO_ENCAP...
5336 		 */
5337 		if (protocol == IPPROTO_ENCAP && ip_g_mrouter) {
5338 			/*
5339 			 * XXX If an IPsec mblk is here on a multicast
5340 			 * tunnel (using ip_mroute stuff), what should
5341 			 * I do?
5342 			 *
5343 			 * For now, just free the IPsec mblk before
5344 			 * passing it up to the multicast routing
5345 			 * stuff.
5346 			 *
5347 			 * BTW,  If I match a configured IP-in-IP
5348 			 * tunnel, ip_mroute_decap will never be
5349 			 * called.
5350 			 */
5351 			if (mp != first_mp)
5352 				freeb(first_mp);
5353 			ip_mroute_decap(q, mp);
5354 		} else {
5355 			/*
5356 			 * Otherwise send an ICMP protocol unreachable.
5357 			 */
5358 			if (ip_fanout_send_icmp(q, first_mp, flags,
5359 			    ICMP_DEST_UNREACHABLE, ICMP_PROTOCOL_UNREACHABLE,
5360 			    mctl_present, zoneid)) {
5361 				BUMP_MIB(&ip_mib, ipInUnknownProtos);
5362 			}
5363 		}
5364 		return;
5365 	}
5366 	CONN_INC_REF(connp);
5367 	first_connp = connp;
5368 
5369 	/*
5370 	 * Only send message to one tunnel driver by immediately
5371 	 * terminating the loop.
5372 	 */
5373 	connp = one_only ? NULL : connp->conn_next;
5374 
5375 	for (;;) {
5376 		while (connp != NULL) {
5377 			if (IPCL_PROTO_MATCH(connp, protocol, ipha, ill,
5378 			    flags, zoneid))
5379 				break;
5380 			connp = connp->conn_next;
5381 		}
5382 
5383 		/*
5384 		 * Copy the packet.
5385 		 */
5386 		if (connp == NULL || connp->conn_upq == NULL ||
5387 		    (((first_mp1 = dupmsg(first_mp)) == NULL) &&
5388 			((first_mp1 = ip_copymsg(first_mp)) == NULL))) {
5389 			/*
5390 			 * No more interested clients or memory
5391 			 * allocation failed
5392 			 */
5393 			connp = first_connp;
5394 			break;
5395 		}
5396 		mp1 = mctl_present ? first_mp1->b_cont : first_mp1;
5397 		CONN_INC_REF(connp);
5398 		mutex_exit(&connfp->connf_lock);
5399 		rq = connp->conn_rq;
5400 		if (!canputnext(rq)) {
5401 			if (flags & IP_FF_RAWIP) {
5402 				BUMP_MIB(&ip_mib, rawipInOverflows);
5403 			} else {
5404 				BUMP_MIB(&icmp_mib, icmpInOverflows);
5405 			}
5406 
5407 			freemsg(first_mp1);
5408 		} else {
5409 			if (CONN_INBOUND_POLICY_PRESENT(connp) || secure) {
5410 				first_mp1 = ipsec_check_inbound_policy
5411 				    (first_mp1, connp, ipha, NULL,
5412 				    mctl_present);
5413 			}
5414 			if (first_mp1 != NULL) {
5415 				/*
5416 				 * ip_fanout_proto also gets called from
5417 				 * icmp_inbound_error_fanout, in which case
5418 				 * the msg type is M_CTL.  Don't add info
5419 				 * in this case for the time being. In future
5420 				 * when there is a need for knowing the
5421 				 * inbound iface index for ICMP error msgs,
5422 				 * then this can be changed.
5423 				 */
5424 				if ((connp->conn_recvif != 0) &&
5425 				    (mp->b_datap->db_type != M_CTL)) {
5426 					/*
5427 					 * the actual data will be
5428 					 * contained in b_cont upon
5429 					 * successful return of the
5430 					 * following call else
5431 					 * original mblk is returned
5432 					 */
5433 					ASSERT(recv_ill != NULL);
5434 					mp1 = ip_add_info(mp1, recv_ill,
5435 						IPF_RECVIF);
5436 				}
5437 				BUMP_MIB(&ip_mib, ipInDelivers);
5438 				if (mctl_present)
5439 					freeb(first_mp1);
5440 				putnext(rq, mp1);
5441 			}
5442 		}
5443 		mutex_enter(&connfp->connf_lock);
5444 		/* Follow the next pointer before releasing the conn. */
5445 		next_connp = connp->conn_next;
5446 		CONN_DEC_REF(connp);
5447 		connp = next_connp;
5448 	}
5449 
5450 	/* Last one.  Send it upstream. */
5451 	mutex_exit(&connfp->connf_lock);
5452 
5453 	/*
5454 	 * If this packet is coming from icmp_inbound_error_fanout ip_policy
5455 	 * will be set to false.
5456 	 */
5457 	if (IPP_ENABLED(IPP_LOCAL_IN) && ip_policy) {
5458 		ill_index = ill->ill_phyint->phyint_ifindex;
5459 		ip_process(IPP_LOCAL_IN, &mp, ill_index);
5460 		if (mp == NULL) {
5461 			CONN_DEC_REF(connp);
5462 			if (mctl_present) {
5463 				freeb(first_mp);
5464 			}
5465 			return;
5466 		}
5467 	}
5468 
5469 	rq = connp->conn_rq;
5470 	if (!canputnext(rq)) {
5471 		if (flags & IP_FF_RAWIP) {
5472 			BUMP_MIB(&ip_mib, rawipInOverflows);
5473 		} else {
5474 			BUMP_MIB(&icmp_mib, icmpInOverflows);
5475 		}
5476 
5477 		freemsg(first_mp);
5478 	} else {
5479 		if (CONN_INBOUND_POLICY_PRESENT(connp) || secure) {
5480 			first_mp = ipsec_check_inbound_policy(first_mp, connp,
5481 			    ipha, NULL, mctl_present);
5482 		}
5483 		if (first_mp != NULL) {
5484 			/*
5485 			 * ip_fanout_proto also gets called
5486 			 * from icmp_inbound_error_fanout, in
5487 			 * which case the msg type is M_CTL.
5488 			 * Don't add info in this case for time
5489 			 * being. In future when there is a
5490 			 * need for knowing the inbound iface
5491 			 * index for ICMP error msgs, then this
5492 			 * can be changed
5493 			 */
5494 			if ((connp->conn_recvif != 0) &&
5495 			    (mp->b_datap->db_type != M_CTL)) {
5496 				/*
5497 				 * the actual data will be contained in
5498 				 * b_cont upon successful return
5499 				 * of the following call else original
5500 				 * mblk is returned
5501 				 */
5502 				ASSERT(recv_ill != NULL);
5503 				mp = ip_add_info(mp, recv_ill, IPF_RECVIF);
5504 			}
5505 			BUMP_MIB(&ip_mib, ipInDelivers);
5506 			putnext(rq, mp);
5507 			if (mctl_present)
5508 				freeb(first_mp);
5509 		}
5510 	}
5511 	CONN_DEC_REF(connp);
5512 }
5513 
5514 /*
5515  * Fanout for TCP packets
5516  * The caller puts <fport, lport> in the ports parameter.
5517  *
5518  * IPQoS Notes
5519  * Before sending it to the client, invoke IPPF processing.
5520  * Policy processing takes place only if the callout_position, IPP_LOCAL_IN,
5521  * is enabled. If we get here from icmp_inbound_error_fanout or ip_wput_local
5522  * ip_policy is false.
5523  */
5524 static void
5525 ip_fanout_tcp(queue_t *q, mblk_t *mp, ill_t *recv_ill, ipha_t *ipha,
5526     uint_t flags, boolean_t mctl_present, boolean_t ip_policy, zoneid_t zoneid)
5527 {
5528 	mblk_t  *first_mp;
5529 	boolean_t secure;
5530 	uint32_t ill_index;
5531 	int	ip_hdr_len;
5532 	tcph_t	*tcph;
5533 	boolean_t syn_present = B_FALSE;
5534 	conn_t	*connp;
5535 
5536 	first_mp = mp;
5537 	if (mctl_present) {
5538 		ASSERT(first_mp->b_datap->db_type == M_CTL);
5539 		mp = first_mp->b_cont;
5540 		secure = ipsec_in_is_secure(first_mp);
5541 		ASSERT(mp != NULL);
5542 	} else {
5543 		secure = B_FALSE;
5544 	}
5545 
5546 	ip_hdr_len = IPH_HDR_LENGTH(mp->b_rptr);
5547 
5548 	if ((connp = ipcl_classify_v4(mp, IPPROTO_TCP, ip_hdr_len, zoneid)) ==
5549 	    NULL) {
5550 		/*
5551 		 * No connected connection or listener. Send a
5552 		 * TH_RST via tcp_xmit_listeners_reset.
5553 		 */
5554 
5555 		/* Initiate IPPf processing, if needed. */
5556 		if (IPP_ENABLED(IPP_LOCAL_IN)) {
5557 			uint32_t ill_index;
5558 			ill_index = recv_ill->ill_phyint->phyint_ifindex;
5559 			ip_process(IPP_LOCAL_IN, &first_mp, ill_index);
5560 			if (first_mp == NULL)
5561 				return;
5562 		}
5563 		BUMP_MIB(&ip_mib, ipInDelivers);
5564 		tcp_xmit_listeners_reset(first_mp, ip_hdr_len);
5565 		return;
5566 	}
5567 
5568 	/*
5569 	 * Allocate the SYN for the TCP connection here itself
5570 	 */
5571 	tcph = (tcph_t *)&mp->b_rptr[ip_hdr_len];
5572 	if ((tcph->th_flags[0] & (TH_SYN|TH_ACK|TH_RST|TH_URG)) == TH_SYN) {
5573 		if (IPCL_IS_TCP(connp)) {
5574 			squeue_t *sqp;
5575 
5576 			/*
5577 			 * For fused tcp loopback, assign the eager's
5578 			 * squeue to be that of the active connect's.
5579 			 * Note that we don't check for IP_FF_LOOPBACK
5580 			 * here since this routine gets called only
5581 			 * for loopback (unlike the IPv6 counterpart).
5582 			 */
5583 			if (do_tcp_fusion &&
5584 			    !CONN_INBOUND_POLICY_PRESENT(connp) && !secure &&
5585 			    !IPP_ENABLED(IPP_LOCAL_IN) && !ip_policy) {
5586 				ASSERT(Q_TO_CONN(q) != NULL);
5587 				sqp = Q_TO_CONN(q)->conn_sqp;
5588 			} else {
5589 				sqp = IP_SQUEUE_GET(lbolt);
5590 			}
5591 
5592 			mp->b_datap->db_struioflag |= STRUIO_EAGER;
5593 			mp->b_datap->db_cksumstart = (intptr_t)sqp;
5594 			syn_present = B_TRUE;
5595 		}
5596 	}
5597 
5598 	if (IPCL_IS_TCP(connp) && IPCL_IS_BOUND(connp) && !syn_present) {
5599 		uint_t	flags = (unsigned int)tcph->th_flags[0] & 0xFF;
5600 		if ((flags & TH_RST) || (flags & TH_URG)) {
5601 			CONN_DEC_REF(connp);
5602 			freemsg(first_mp);
5603 			return;
5604 		}
5605 		if (flags & TH_ACK) {
5606 			tcp_xmit_listeners_reset(first_mp, ip_hdr_len);
5607 			CONN_DEC_REF(connp);
5608 			return;
5609 		}
5610 
5611 		CONN_DEC_REF(connp);
5612 		freemsg(first_mp);
5613 		return;
5614 	}
5615 
5616 	if (CONN_INBOUND_POLICY_PRESENT(connp) || secure) {
5617 		first_mp = ipsec_check_inbound_policy(first_mp, connp, ipha,
5618 		    NULL, mctl_present);
5619 		if (first_mp == NULL) {
5620 			CONN_DEC_REF(connp);
5621 			return;
5622 		}
5623 		if (IPCL_IS_TCP(connp) && IPCL_IS_BOUND(connp)) {
5624 			ASSERT(syn_present);
5625 			if (mctl_present) {
5626 				ASSERT(first_mp != mp);
5627 				first_mp->b_datap->db_struioflag |=
5628 				    STRUIO_POLICY;
5629 			} else {
5630 				ASSERT(first_mp == mp);
5631 				mp->b_datap->db_struioflag &=
5632 				    ~STRUIO_EAGER;
5633 				mp->b_datap->db_struioflag |=
5634 				    STRUIO_POLICY;
5635 			}
5636 		} else {
5637 			/*
5638 			 * Discard first_mp early since we're dealing with a
5639 			 * fully-connected conn_t and tcp doesn't do policy in
5640 			 * this case.
5641 			 */
5642 			if (mctl_present) {
5643 				freeb(first_mp);
5644 				mctl_present = B_FALSE;
5645 			}
5646 			first_mp = mp;
5647 		}
5648 	}
5649 
5650 	/*
5651 	 * Initiate policy processing here if needed. If we get here from
5652 	 * icmp_inbound_error_fanout, ip_policy is false.
5653 	 */
5654 	if (IPP_ENABLED(IPP_LOCAL_IN) && ip_policy) {
5655 		ill_index = recv_ill->ill_phyint->phyint_ifindex;
5656 		ip_process(IPP_LOCAL_IN, &mp, ill_index);
5657 		if (mp == NULL) {
5658 			CONN_DEC_REF(connp);
5659 			if (mctl_present)
5660 				freeb(first_mp);
5661 			return;
5662 		} else if (mctl_present) {
5663 			ASSERT(first_mp != mp);
5664 			first_mp->b_cont = mp;
5665 		} else {
5666 			first_mp = mp;
5667 		}
5668 	}
5669 
5670 
5671 
5672 	/* Handle IPv6 socket options. */
5673 	if (!syn_present &&
5674 	    connp->conn_ipv6_recvpktinfo && (flags & IP_FF_IP6INFO)) {
5675 		/* Add header */
5676 		ASSERT(recv_ill != NULL);
5677 		mp = ip_add_info(mp, recv_ill, IPF_RECVIF);
5678 		if (mp == NULL) {
5679 			CONN_DEC_REF(connp);
5680 			if (mctl_present)
5681 				freeb(first_mp);
5682 			return;
5683 		} else if (mctl_present) {
5684 			/*
5685 			 * ip_add_info might return a new mp.
5686 			 */
5687 			ASSERT(first_mp != mp);
5688 			first_mp->b_cont = mp;
5689 		} else {
5690 			first_mp = mp;
5691 		}
5692 	}
5693 
5694 	BUMP_MIB(&ip_mib, ipInDelivers);
5695 	if (IPCL_IS_TCP(connp)) {
5696 		(*ip_input_proc)(connp->conn_sqp, first_mp,
5697 		    connp->conn_recv, connp, SQTAG_IP_FANOUT_TCP);
5698 	} else {
5699 		putnext(connp->conn_rq, first_mp);
5700 		CONN_DEC_REF(connp);
5701 	}
5702 }
5703 
5704 /*
5705  * Deliver a udp packet to the given conn, possibly applying ipsec policy.
5706  * We are responsible for disposing of mp, such as by freemsg() or putnext()
5707  * Caller is responsible for dropping references to the conn, and freeing
5708  * first_mp.
5709  *
5710  * IPQoS Notes
5711  * Before sending it to the client, invoke IPPF processing. Policy processing
5712  * takes place only if the callout_position, IPP_LOCAL_IN, is enabled and
5713  * ip_policy is true. If we get here from icmp_inbound_error_fanout or
5714  * ip_wput_local, ip_policy is false.
5715  */
5716 static void
5717 ip_fanout_udp_conn(conn_t *connp, mblk_t *first_mp, mblk_t *mp,
5718     boolean_t secure, ipha_t *ipha, uint_t flags, ill_t *recv_ill,
5719     boolean_t ip_policy)
5720 {
5721 	queue_t		*rq = connp->conn_rq;
5722 	boolean_t	mctl_present = (first_mp != NULL);
5723 	uint32_t	in_flags = 0; /* set to IP_RECVSLLA and/or IP_RECVIF */
5724 	uint32_t	ill_index;
5725 
5726 	if (mctl_present)
5727 		first_mp->b_cont = mp;
5728 	else
5729 		first_mp = mp;
5730 
5731 	if (!canputnext(rq)) {
5732 		BUMP_MIB(&ip_mib, udpInOverflows);
5733 		freemsg(first_mp);
5734 		return;
5735 	}
5736 
5737 	if (CONN_INBOUND_POLICY_PRESENT(connp) || secure) {
5738 		first_mp = ipsec_check_inbound_policy(first_mp, connp, ipha,
5739 		    NULL, mctl_present);
5740 		if (first_mp == NULL)
5741 			return;	/* Freed by ipsec_check_inbound_policy(). */
5742 	}
5743 	if (mctl_present)
5744 		freeb(first_mp);
5745 
5746 	if (connp->conn_recvif)
5747 		in_flags = IPF_RECVIF;
5748 	if (connp->conn_recvslla && !(flags & IP_FF_SEND_SLLA))
5749 		in_flags |= IPF_RECVSLLA;
5750 
5751 	/* Handle IPv6 options. */
5752 	if (connp->conn_ipv6_recvpktinfo && (flags & IP_FF_IP6INFO))
5753 		in_flags |= IPF_RECVIF;
5754 
5755 	/*
5756 	 * Initiate IPPF processing here, if needed. Note first_mp won't be
5757 	 * freed if the packet is dropped. The caller will do so.
5758 	 */
5759 	if (IPP_ENABLED(IPP_LOCAL_IN) && ip_policy) {
5760 		ill_index = recv_ill->ill_phyint->phyint_ifindex;
5761 		ip_process(IPP_LOCAL_IN, &mp, ill_index);
5762 		if (mp == NULL) {
5763 			return;
5764 		}
5765 	}
5766 	if ((in_flags != 0) &&
5767 	    (mp->b_datap->db_type != M_CTL)) {
5768 		/*
5769 		 * The actual data will be contained in b_cont
5770 		 * upon successful return of the following call
5771 		 * else original mblk is returned
5772 		 */
5773 		ASSERT(recv_ill != NULL);
5774 		mp = ip_add_info(mp, recv_ill, in_flags);
5775 	}
5776 	BUMP_MIB(&ip_mib, ipInDelivers);
5777 	putnext(rq, mp);
5778 }
5779 
5780 /*
5781  * Fanout for UDP packets.
5782  * The caller puts <fport, lport> in the ports parameter.
5783  *
5784  * If SO_REUSEADDR is set all multicast and broadcast packets
5785  * will be delivered to all streams bound to the same port.
5786  *
5787  * Zones notes:
5788  * Multicast and broadcast packets will be distributed to streams in all zones.
5789  * In the special case where an AF_INET socket binds to 0.0.0.0/<port> and an
5790  * AF_INET6 socket binds to ::/<port>, only the AF_INET socket receives the IPv4
5791  * packets. To maintain this behavior with multiple zones, the conns are grouped
5792  * by zone and the SO_REUSEADDR flag is checked for the first matching conn in
5793  * each zone. If unset, all the following conns in the same zone are skipped.
5794  */
5795 static void
5796 ip_fanout_udp(queue_t *q, mblk_t *mp, ill_t *ill, ipha_t *ipha,
5797     uint32_t ports, boolean_t broadcast, uint_t flags, boolean_t mctl_present,
5798     boolean_t ip_policy, ill_t *recv_ill, zoneid_t zoneid)
5799 {
5800 	uint32_t	dstport, srcport;
5801 	ipaddr_t	dst;
5802 	mblk_t		*first_mp;
5803 	boolean_t	secure;
5804 	in6_addr_t	v6src;
5805 	conn_t		*connp;
5806 	connf_t		*connfp;
5807 	conn_t		*first_connp;
5808 	conn_t		*next_connp;
5809 	mblk_t		*mp1, *first_mp1;
5810 	ipaddr_t	src;
5811 	zoneid_t	last_zoneid;
5812 	boolean_t	reuseaddr;
5813 
5814 	first_mp = mp;
5815 	if (mctl_present) {
5816 		mp = first_mp->b_cont;
5817 		first_mp->b_cont = NULL;
5818 		secure = ipsec_in_is_secure(first_mp);
5819 		ASSERT(mp != NULL);
5820 	} else {
5821 		first_mp = NULL;
5822 		secure = B_FALSE;
5823 	}
5824 
5825 	/* Extract ports in net byte order */
5826 	dstport = htons(ntohl(ports) & 0xFFFF);
5827 	srcport = htons(ntohl(ports) >> 16);
5828 	dst = ipha->ipha_dst;
5829 	src = ipha->ipha_src;
5830 
5831 	connfp = &ipcl_udp_fanout[IPCL_UDP_HASH(dstport)];
5832 	mutex_enter(&connfp->connf_lock);
5833 	connp = connfp->connf_head;
5834 	if (!broadcast && !CLASSD(dst)) {
5835 		/*
5836 		 * Not broadcast or multicast. Send to the one (first)
5837 		 * client we find. No need to check conn_wantpacket()
5838 		 * since IP_BOUND_IF/conn_incoming_ill does not apply to
5839 		 * IPv4 unicast packets.
5840 		 */
5841 		while ((connp != NULL) &&
5842 		    (!IPCL_UDP_MATCH(connp, dstport, dst,
5843 		    srcport, src) || connp->conn_zoneid != zoneid)) {
5844 			connp = connp->conn_next;
5845 		}
5846 
5847 		if (connp == NULL || connp->conn_upq == NULL)
5848 			goto notfound;
5849 		CONN_INC_REF(connp);
5850 		mutex_exit(&connfp->connf_lock);
5851 		ip_fanout_udp_conn(connp, first_mp, mp, secure, ipha, flags,
5852 		    recv_ill, ip_policy);
5853 		IP_STAT(ip_udp_fannorm);
5854 		CONN_DEC_REF(connp);
5855 		return;
5856 	}
5857 
5858 	/*
5859 	 * Broadcast and multicast case
5860 	 *
5861 	 * Need to check conn_wantpacket().
5862 	 * If SO_REUSEADDR has been set on the first we send the
5863 	 * packet to all clients that have joined the group and
5864 	 * match the port.
5865 	 */
5866 
5867 	while (connp != NULL) {
5868 		if ((IPCL_UDP_MATCH(connp, dstport, dst, srcport, src)) &&
5869 		    conn_wantpacket(connp, ill, ipha, flags, zoneid))
5870 			break;
5871 		connp = connp->conn_next;
5872 	}
5873 
5874 	if (connp == NULL || connp->conn_upq == NULL)
5875 		goto notfound;
5876 
5877 	first_connp = connp;
5878 	/*
5879 	 * When SO_REUSEADDR is not set, send the packet only to the first
5880 	 * matching connection in its zone by keeping track of the zoneid.
5881 	 */
5882 	reuseaddr = first_connp->conn_reuseaddr;
5883 	last_zoneid = first_connp->conn_zoneid;
5884 
5885 	CONN_INC_REF(connp);
5886 	connp = connp->conn_next;
5887 	for (;;) {
5888 		while (connp != NULL) {
5889 			if (IPCL_UDP_MATCH(connp, dstport, dst, srcport, src) &&
5890 			    (reuseaddr || connp->conn_zoneid != last_zoneid) &&
5891 			    conn_wantpacket(connp, ill, ipha, flags, zoneid))
5892 				break;
5893 			connp = connp->conn_next;
5894 		}
5895 		/*
5896 		 * Just copy the data part alone. The mctl part is
5897 		 * needed just for verifying policy and it is never
5898 		 * sent up.
5899 		 */
5900 		if (connp == NULL || (((mp1 = dupmsg(mp)) == NULL) &&
5901 		    ((mp1 = copymsg(mp)) == NULL))) {
5902 			/*
5903 			 * No more interested clients or memory
5904 			 * allocation failed
5905 			 */
5906 			connp = first_connp;
5907 			break;
5908 		}
5909 		if (connp->conn_zoneid != last_zoneid) {
5910 			/*
5911 			 * Update the zoneid so that the packet isn't sent to
5912 			 * any more conns in the same zone unless SO_REUSEADDR
5913 			 * is set.
5914 			 */
5915 			reuseaddr = connp->conn_reuseaddr;
5916 			last_zoneid = connp->conn_zoneid;
5917 		}
5918 		if (first_mp != NULL) {
5919 			ASSERT(((ipsec_info_t *)first_mp->b_rptr)->
5920 			    ipsec_info_type == IPSEC_IN);
5921 			first_mp1 = ipsec_in_tag(first_mp, NULL);
5922 			if (first_mp1 == NULL) {
5923 				freemsg(mp1);
5924 				connp = first_connp;
5925 				break;
5926 			}
5927 		} else {
5928 			first_mp1 = NULL;
5929 		}
5930 		CONN_INC_REF(connp);
5931 		mutex_exit(&connfp->connf_lock);
5932 		/*
5933 		 * IPQoS notes: We don't send the packet for policy
5934 		 * processing here, will do it for the last one (below).
5935 		 * i.e. we do it per-packet now, but if we do policy
5936 		 * processing per-conn, then we would need to do it
5937 		 * here too.
5938 		 */
5939 		ip_fanout_udp_conn(connp, first_mp1, mp1, secure,
5940 		    ipha, flags, recv_ill, B_FALSE);
5941 		mutex_enter(&connfp->connf_lock);
5942 		/* Follow the next pointer before releasing the conn. */
5943 		next_connp = connp->conn_next;
5944 		IP_STAT(ip_udp_fanmb);
5945 		CONN_DEC_REF(connp);
5946 		connp = next_connp;
5947 	}
5948 
5949 	/* Last one.  Send it upstream. */
5950 	mutex_exit(&connfp->connf_lock);
5951 	ip_fanout_udp_conn(connp, first_mp, mp, secure, ipha, flags, recv_ill,
5952 	    ip_policy);
5953 	IP_STAT(ip_udp_fanmb);
5954 	CONN_DEC_REF(connp);
5955 	return;
5956 
5957 notfound:
5958 
5959 	mutex_exit(&connfp->connf_lock);
5960 	IP_STAT(ip_udp_fanothers);
5961 	/*
5962 	 * IPv6 endpoints bound to unicast or multicast IPv4-mapped addresses
5963 	 * have already been matched above, since they live in the IPv4
5964 	 * fanout tables. This implies we only need to
5965 	 * check for IPv6 in6addr_any endpoints here.
5966 	 * Thus we compare using ipv6_all_zeros instead of the destination
5967 	 * address, except for the multicast group membership lookup which
5968 	 * uses the IPv4 destination.
5969 	 */
5970 	IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &v6src);
5971 	connfp = &ipcl_udp_fanout[IPCL_UDP_HASH(dstport)];
5972 	mutex_enter(&connfp->connf_lock);
5973 	connp = connfp->connf_head;
5974 	if (!broadcast && !CLASSD(dst)) {
5975 		while (connp != NULL) {
5976 			if (IPCL_UDP_MATCH_V6(connp, dstport, ipv6_all_zeros,
5977 			    srcport, v6src) && connp->conn_zoneid == zoneid &&
5978 			    conn_wantpacket(connp, ill, ipha, flags, zoneid) &&
5979 			    !connp->conn_ipv6_v6only)
5980 				break;
5981 			connp = connp->conn_next;
5982 		}
5983 
5984 		if (connp == NULL || connp->conn_upq == NULL) {
5985 			/*
5986 			 * No one bound to this port.  Is
5987 			 * there a client that wants all
5988 			 * unclaimed datagrams?
5989 			 */
5990 			mutex_exit(&connfp->connf_lock);
5991 
5992 			if (mctl_present)
5993 				first_mp->b_cont = mp;
5994 			else
5995 				first_mp = mp;
5996 			if (ipcl_proto_search(IPPROTO_UDP) != NULL) {
5997 				ip_fanout_proto(q, first_mp, ill, ipha,
5998 				    flags | IP_FF_RAWIP, mctl_present,
5999 				    ip_policy, recv_ill, zoneid);
6000 			} else {
6001 				if (ip_fanout_send_icmp(q, first_mp, flags,
6002 				    ICMP_DEST_UNREACHABLE,
6003 				    ICMP_PORT_UNREACHABLE,
6004 				    mctl_present, zoneid)) {
6005 					BUMP_MIB(&ip_mib, udpNoPorts);
6006 				}
6007 			}
6008 			return;
6009 		}
6010 		CONN_INC_REF(connp);
6011 		mutex_exit(&connfp->connf_lock);
6012 		ip_fanout_udp_conn(connp, first_mp, mp, secure, ipha, flags,
6013 		    recv_ill, ip_policy);
6014 		CONN_DEC_REF(connp);
6015 		return;
6016 	}
6017 	/*
6018 	 * IPv4 multicast packet being delivered to an AF_INET6
6019 	 * in6addr_any endpoint.
6020 	 * Need to check conn_wantpacket(). Note that we use conn_wantpacket()
6021 	 * and not conn_wantpacket_v6() since any multicast membership is
6022 	 * for an IPv4-mapped multicast address.
6023 	 * The packet is sent to all clients in all zones that have joined the
6024 	 * group and match the port.
6025 	 */
6026 	while (connp != NULL) {
6027 		if (IPCL_UDP_MATCH_V6(connp, dstport, ipv6_all_zeros,
6028 		    srcport, v6src) &&
6029 		    conn_wantpacket(connp, ill, ipha, flags, zoneid))
6030 			break;
6031 		connp = connp->conn_next;
6032 	}
6033 
6034 	if (connp == NULL || connp->conn_upq == NULL) {
6035 		/*
6036 		 * No one bound to this port.  Is
6037 		 * there a client that wants all
6038 		 * unclaimed datagrams?
6039 		 */
6040 		mutex_exit(&connfp->connf_lock);
6041 
6042 		if (mctl_present)
6043 			first_mp->b_cont = mp;
6044 		else
6045 			first_mp = mp;
6046 		if (ipcl_proto_search(IPPROTO_UDP) != NULL) {
6047 			ip_fanout_proto(q, first_mp, ill, ipha,
6048 			    flags | IP_FF_RAWIP, mctl_present, ip_policy,
6049 			    recv_ill, zoneid);
6050 		} else {
6051 			/*
6052 			 * We used to attempt to send an icmp error here, but
6053 			 * since this is known to be a multicast packet
6054 			 * and we don't send icmp errors in response to
6055 			 * multicast, just drop the packet and give up sooner.
6056 			 */
6057 			BUMP_MIB(&ip_mib, udpNoPorts);
6058 			freemsg(first_mp);
6059 		}
6060 		return;
6061 	}
6062 
6063 	first_connp = connp;
6064 
6065 	CONN_INC_REF(connp);
6066 	connp = connp->conn_next;
6067 	for (;;) {
6068 		while (connp != NULL) {
6069 			if (IPCL_UDP_MATCH_V6(connp, dstport,
6070 			    ipv6_all_zeros, srcport, v6src) &&
6071 			    conn_wantpacket(connp, ill, ipha, flags, zoneid))
6072 				break;
6073 			connp = connp->conn_next;
6074 		}
6075 		/*
6076 		 * Just copy the data part alone. The mctl part is
6077 		 * needed just for verifying policy and it is never
6078 		 * sent up.
6079 		 */
6080 		if (connp == NULL || (((mp1 = dupmsg(mp)) == NULL) &&
6081 		    ((mp1 = copymsg(mp)) == NULL))) {
6082 			/*
6083 			 * No more intested clients or memory
6084 			 * allocation failed
6085 			 */
6086 			connp = first_connp;
6087 			break;
6088 		}
6089 		if (first_mp != NULL) {
6090 			ASSERT(((ipsec_info_t *)first_mp->b_rptr)->
6091 			    ipsec_info_type == IPSEC_IN);
6092 			first_mp1 = ipsec_in_tag(first_mp, NULL);
6093 			if (first_mp1 == NULL) {
6094 				freemsg(mp1);
6095 				connp = first_connp;
6096 				break;
6097 			}
6098 		} else {
6099 			first_mp1 = NULL;
6100 		}
6101 		CONN_INC_REF(connp);
6102 		mutex_exit(&connfp->connf_lock);
6103 		/*
6104 		 * IPQoS notes: We don't send the packet for policy
6105 		 * processing here, will do it for the last one (below).
6106 		 * i.e. we do it per-packet now, but if we do policy
6107 		 * processing per-conn, then we would need to do it
6108 		 * here too.
6109 		 */
6110 		ip_fanout_udp_conn(connp, first_mp1, mp1, secure,
6111 		    ipha, flags, recv_ill, B_FALSE);
6112 		mutex_enter(&connfp->connf_lock);
6113 		/* Follow the next pointer before releasing the conn. */
6114 		next_connp = connp->conn_next;
6115 		CONN_DEC_REF(connp);
6116 		connp = next_connp;
6117 	}
6118 
6119 	/* Last one.  Send it upstream. */
6120 	mutex_exit(&connfp->connf_lock);
6121 	ip_fanout_udp_conn(connp, first_mp, mp, secure, ipha, flags, recv_ill,
6122 	    ip_policy);
6123 	CONN_DEC_REF(connp);
6124 }
6125 
6126 /*
6127  * Complete the ip_wput header so that it
6128  * is possible to generate ICMP
6129  * errors.
6130  */
6131 static int
6132 ip_hdr_complete(ipha_t *ipha, zoneid_t zoneid)
6133 {
6134 	ire_t *ire;
6135 
6136 	if (ipha->ipha_src == INADDR_ANY) {
6137 		ire = ire_lookup_local(zoneid);
6138 		if (ire == NULL) {
6139 			ip1dbg(("ip_hdr_complete: no source IRE\n"));
6140 			return (1);
6141 		}
6142 		ipha->ipha_src = ire->ire_addr;
6143 		ire_refrele(ire);
6144 	}
6145 	ipha->ipha_ttl = ip_def_ttl;
6146 	ipha->ipha_hdr_checksum = 0;
6147 	ipha->ipha_hdr_checksum = ip_csum_hdr(ipha);
6148 	return (0);
6149 }
6150 
6151 /*
6152  * Nobody should be sending
6153  * packets up this stream
6154  */
6155 static void
6156 ip_lrput(queue_t *q, mblk_t *mp)
6157 {
6158 	mblk_t *mp1;
6159 
6160 	switch (mp->b_datap->db_type) {
6161 	case M_FLUSH:
6162 		/* Turn around */
6163 		if (*mp->b_rptr & FLUSHW) {
6164 			*mp->b_rptr &= ~FLUSHR;
6165 			qreply(q, mp);
6166 			return;
6167 		}
6168 		break;
6169 	}
6170 	/* Could receive messages that passed through ar_rput */
6171 	for (mp1 = mp; mp1; mp1 = mp1->b_cont)
6172 		mp1->b_prev = mp1->b_next = NULL;
6173 	freemsg(mp);
6174 }
6175 
6176 /* Nobody should be sending packets down this stream */
6177 /* ARGSUSED */
6178 void
6179 ip_lwput(queue_t *q, mblk_t *mp)
6180 {
6181 	freemsg(mp);
6182 }
6183 
6184 /*
6185  * Move the first hop in any source route to ipha_dst and remove that part of
6186  * the source route.  Called by other protocols.  Errors in option formatting
6187  * are ignored - will be handled by ip_wput_options Return the final
6188  * destination (either ipha_dst or the last entry in a source route.)
6189  */
6190 ipaddr_t
6191 ip_massage_options(ipha_t *ipha)
6192 {
6193 	ipoptp_t	opts;
6194 	uchar_t		*opt;
6195 	uint8_t		optval;
6196 	uint8_t		optlen;
6197 	ipaddr_t	dst;
6198 	int		i;
6199 	ire_t		*ire;
6200 
6201 	ip2dbg(("ip_massage_options\n"));
6202 	dst = ipha->ipha_dst;
6203 	for (optval = ipoptp_first(&opts, ipha);
6204 	    optval != IPOPT_EOL;
6205 	    optval = ipoptp_next(&opts)) {
6206 		opt = opts.ipoptp_cur;
6207 		switch (optval) {
6208 			uint8_t off;
6209 		case IPOPT_SSRR:
6210 		case IPOPT_LSRR:
6211 			if ((opts.ipoptp_flags & IPOPTP_ERROR) != 0) {
6212 				ip1dbg(("ip_massage_options: bad src route\n"));
6213 				break;
6214 			}
6215 			optlen = opts.ipoptp_len;
6216 			off = opt[IPOPT_OFFSET];
6217 			off--;
6218 		redo_srr:
6219 			if (optlen < IP_ADDR_LEN ||
6220 			    off > optlen - IP_ADDR_LEN) {
6221 				/* End of source route */
6222 				ip1dbg(("ip_massage_options: end of SR\n"));
6223 				break;
6224 			}
6225 			bcopy((char *)opt + off, &dst, IP_ADDR_LEN);
6226 			ip1dbg(("ip_massage_options: next hop 0x%x\n",
6227 			    ntohl(dst)));
6228 			/*
6229 			 * Check if our address is present more than
6230 			 * once as consecutive hops in source route.
6231 			 * XXX verify per-interface ip_forwarding
6232 			 * for source route?
6233 			 */
6234 			ire = ire_ctable_lookup(dst, 0, IRE_LOCAL, NULL,
6235 			    ALL_ZONES, MATCH_IRE_TYPE);
6236 			if (ire != NULL) {
6237 				ire_refrele(ire);
6238 				off += IP_ADDR_LEN;
6239 				goto redo_srr;
6240 			}
6241 			if (dst == htonl(INADDR_LOOPBACK)) {
6242 				ip1dbg(("ip_massage_options: loopback addr in "
6243 				    "source route!\n"));
6244 				break;
6245 			}
6246 			/*
6247 			 * Update ipha_dst to be the first hop and remove the
6248 			 * first hop from the source route (by overwriting
6249 			 * part of the option with NOP options).
6250 			 */
6251 			ipha->ipha_dst = dst;
6252 			/* Put the last entry in dst */
6253 			off = ((optlen - IP_ADDR_LEN - 3) & ~(IP_ADDR_LEN-1)) +
6254 			    3;
6255 			bcopy(&opt[off], &dst, IP_ADDR_LEN);
6256 
6257 			ip1dbg(("ip_massage_options: last hop 0x%x\n",
6258 			    ntohl(dst)));
6259 			/* Move down and overwrite */
6260 			opt[IP_ADDR_LEN] = opt[0];
6261 			opt[IP_ADDR_LEN+1] = opt[IPOPT_OLEN] - IP_ADDR_LEN;
6262 			opt[IP_ADDR_LEN+2] = opt[IPOPT_OFFSET];
6263 			for (i = 0; i < IP_ADDR_LEN; i++)
6264 				opt[i] = IPOPT_NOP;
6265 			break;
6266 		}
6267 	}
6268 	return (dst);
6269 }
6270 
6271 /*
6272  * This function's job is to forward data to the reverse tunnel (FA->HA)
6273  * after doing a few checks. It is assumed that the incoming interface
6274  * of the packet is always different than the outgoing interface and the
6275  * ire_type of the found ire has to be a non-resolver type.
6276  *
6277  * IPQoS notes
6278  * IP policy is invoked twice for a forwarded packet, once on the read side
6279  * and again on the write side if both, IPP_FWD_IN and IPP_FWD_OUT are
6280  * enabled.
6281  */
6282 static void
6283 ip_mrtun_forward(ire_t *ire, ill_t *in_ill, mblk_t *mp)
6284 {
6285 	ipha_t		*ipha;
6286 	queue_t		*q;
6287 	uint32_t 	pkt_len;
6288 #define	rptr    ((uchar_t *)ipha)
6289 	uint32_t 	sum;
6290 	uint32_t 	max_frag;
6291 	mblk_t		*first_mp;
6292 	uint32_t	ill_index;
6293 
6294 	ASSERT(ire != NULL);
6295 	ASSERT(ire->ire_ipif->ipif_net_type == IRE_IF_NORESOLVER);
6296 	ASSERT(ire->ire_stq != NULL);
6297 
6298 	/* Initiate read side IPPF processing */
6299 	if (IPP_ENABLED(IPP_FWD_IN)) {
6300 		ill_index = in_ill->ill_phyint->phyint_ifindex;
6301 		ip_process(IPP_FWD_IN, &mp, ill_index);
6302 		if (mp == NULL) {
6303 			ip2dbg(("ip_mrtun_forward: inbound pkt "
6304 			    "dropped during IPPF processing\n"));
6305 			return;
6306 		}
6307 	}
6308 
6309 	if (((in_ill->ill_flags & ((ill_t *)ire->ire_stq->q_ptr)->ill_flags &
6310 		ILLF_ROUTER) == 0) ||
6311 	    (in_ill == (ill_t *)ire->ire_stq->q_ptr)) {
6312 		BUMP_MIB(&ip_mib, ipForwProhibits);
6313 		ip0dbg(("ip_mrtun_forward: Can't forward :"
6314 		    "forwarding is not turned on\n"));
6315 		goto drop_pkt;
6316 	}
6317 
6318 	/*
6319 	 * Don't forward if the interface is down
6320 	 */
6321 	if (ire->ire_ipif->ipif_ill->ill_ipif_up_count == 0) {
6322 		BUMP_MIB(&ip_mib, ipInDiscards);
6323 		goto drop_pkt;
6324 	}
6325 
6326 	ipha = (ipha_t *)mp->b_rptr;
6327 	pkt_len = ntohs(ipha->ipha_length);
6328 	/* Adjust the checksum to reflect the ttl decrement. */
6329 	sum = (int)ipha->ipha_hdr_checksum + IP_HDR_CSUM_TTL_ADJUST;
6330 	ipha->ipha_hdr_checksum = (uint16_t)(sum + (sum >> 16));
6331 	if (ipha->ipha_ttl-- <= 1) {
6332 		if (ip_csum_hdr(ipha)) {
6333 			BUMP_MIB(&ip_mib, ipInCksumErrs);
6334 			goto drop_pkt;
6335 		}
6336 		q = ire->ire_stq;
6337 		if ((first_mp = allocb(sizeof (ipsec_info_t),
6338 		    BPRI_HI)) == NULL) {
6339 			goto drop_pkt;
6340 		}
6341 		ip_ipsec_out_prepend(first_mp, mp, in_ill);
6342 		icmp_time_exceeded(q, first_mp, ICMP_TTL_EXCEEDED);
6343 
6344 		return;
6345 	}
6346 
6347 	/* Get the ill_index of the ILL */
6348 	ill_index = ire->ire_ipif->ipif_ill->ill_phyint->phyint_ifindex;
6349 
6350 	/*
6351 	 * ip_mrtun_forward is only used by foreign agent to reverse
6352 	 * tunnel the incoming packet. So it does not do any option
6353 	 * processing for source routing.
6354 	 */
6355 	max_frag = ire->ire_max_frag;
6356 	if (pkt_len > max_frag) {
6357 		/*
6358 		 * It needs fragging on its way out.  We haven't
6359 		 * verified the header checksum yet.  Since we
6360 		 * are going to put a surely good checksum in the
6361 		 * outgoing header, we have to make sure that it
6362 		 * was good coming in.
6363 		 */
6364 		if (ip_csum_hdr(ipha)) {
6365 			BUMP_MIB(&ip_mib, ipInCksumErrs);
6366 			goto drop_pkt;
6367 		}
6368 
6369 		/* Initiate write side IPPF processing */
6370 		if (IPP_ENABLED(IPP_FWD_OUT)) {
6371 			ip_process(IPP_FWD_OUT, &mp, ill_index);
6372 			if (mp == NULL) {
6373 				ip2dbg(("ip_mrtun_forward: outbound pkt "\
6374 				    "dropped/deferred during ip policy "\
6375 				    "processing\n"));
6376 				return;
6377 			}
6378 		}
6379 		if ((first_mp = allocb(sizeof (ipsec_info_t),
6380 		    BPRI_HI)) == NULL) {
6381 			goto drop_pkt;
6382 		}
6383 		ip_ipsec_out_prepend(first_mp, mp, in_ill);
6384 		mp = first_mp;
6385 
6386 		ip_wput_frag(ire, mp, IB_PKT, max_frag, 0);
6387 		return;
6388 	}
6389 
6390 	ip2dbg(("ip_mrtun_forward: ire type (%d)\n", ire->ire_type));
6391 
6392 	ASSERT(ire->ire_ipif != NULL);
6393 
6394 	mp = ip_wput_attach_llhdr(mp, ire, IPP_FWD_OUT, ill_index);
6395 	if (mp == NULL) {
6396 		BUMP_MIB(&ip_mib, ipInDiscards);
6397 		return;
6398 	}
6399 
6400 	/* Now send the packet to the tunnel interface */
6401 	q = ire->ire_stq;
6402 	UPDATE_IB_PKT_COUNT(ire);
6403 	ire->ire_last_used_time = lbolt;
6404 	BUMP_MIB(&ip_mib, ipForwDatagrams);
6405 	putnext(q, mp);
6406 	ip2dbg(("ip_mrtun_forward: sent packet to ill %p\n", q->q_ptr));
6407 	return;
6408 
6409 drop_pkt:;
6410 	ip2dbg(("ip_mrtun_forward: dropping pkt\n"));
6411 	freemsg(mp);
6412 #undef	rptr
6413 }
6414 
6415 /*
6416  * Fills the ipsec_out_t data structure with appropriate fields and
6417  * prepends it to mp which contains the IP hdr + data that was meant
6418  * to be forwarded. Please note that ipsec_out_info data structure
6419  * is used here to communicate the outgoing ill path at ip_wput()
6420  * for the ICMP error packet. This has nothing to do with ipsec IP
6421  * security. ipsec_out_t is really used to pass the info to the module
6422  * IP where this information cannot be extracted from conn.
6423  * This functions is called by ip_mrtun_forward().
6424  */
6425 void
6426 ip_ipsec_out_prepend(mblk_t *first_mp, mblk_t *mp, ill_t *xmit_ill)
6427 {
6428 	ipsec_out_t	*io;
6429 
6430 	ASSERT(xmit_ill != NULL);
6431 	first_mp->b_datap->db_type = M_CTL;
6432 	first_mp->b_wptr += sizeof (ipsec_info_t);
6433 	/*
6434 	 * This is to pass info to ip_wput in absence of conn.
6435 	 * ipsec_out_secure will be B_FALSE because of this.
6436 	 * Thus ipsec_out_secure being B_FALSE indicates that
6437 	 * this is not IPSEC security related information.
6438 	 */
6439 	bzero(first_mp->b_rptr, sizeof (ipsec_info_t));
6440 	io = (ipsec_out_t *)first_mp->b_rptr;
6441 	io->ipsec_out_type = IPSEC_OUT;
6442 	io->ipsec_out_len = sizeof (ipsec_out_t);
6443 	first_mp->b_cont = mp;
6444 	io->ipsec_out_ill_index =
6445 	    xmit_ill->ill_phyint->phyint_ifindex;
6446 	io->ipsec_out_xmit_if = B_TRUE;
6447 }
6448 
6449 /*
6450  * Return the network mask
6451  * associated with the specified address.
6452  */
6453 ipaddr_t
6454 ip_net_mask(ipaddr_t addr)
6455 {
6456 	uchar_t	*up = (uchar_t *)&addr;
6457 	ipaddr_t mask = 0;
6458 	uchar_t	*maskp = (uchar_t *)&mask;
6459 
6460 #if defined(__i386) || defined(__amd64)
6461 #define	TOTALLY_BRAIN_DAMAGED_C_COMPILER
6462 #endif
6463 #ifdef  TOTALLY_BRAIN_DAMAGED_C_COMPILER
6464 	maskp[0] = maskp[1] = maskp[2] = maskp[3] = 0;
6465 #endif
6466 	if (CLASSD(addr)) {
6467 		maskp[0] = 0xF0;
6468 		return (mask);
6469 	}
6470 	if (addr == 0)
6471 		return (0);
6472 	maskp[0] = 0xFF;
6473 	if ((up[0] & 0x80) == 0)
6474 		return (mask);
6475 
6476 	maskp[1] = 0xFF;
6477 	if ((up[0] & 0xC0) == 0x80)
6478 		return (mask);
6479 
6480 	maskp[2] = 0xFF;
6481 	if ((up[0] & 0xE0) == 0xC0)
6482 		return (mask);
6483 
6484 	/* Must be experimental or multicast, indicate as much */
6485 	return ((ipaddr_t)0);
6486 }
6487 
6488 /*
6489  * Select an ill for the packet by considering load spreading across
6490  * a different ill in the group if dst_ill is part of some group.
6491  */
6492 static ill_t *
6493 ip_newroute_get_dst_ill(ill_t *dst_ill)
6494 {
6495 	ill_t *ill;
6496 
6497 	/*
6498 	 * We schedule irrespective of whether the source address is
6499 	 * INADDR_ANY or not. illgrp_scheduler returns a held ill.
6500 	 */
6501 	ill = illgrp_scheduler(dst_ill);
6502 	if (ill == NULL)
6503 		return (NULL);
6504 
6505 	/*
6506 	 * For groups with names ip_sioctl_groupname ensures that all
6507 	 * ills are of same type. For groups without names, ifgrp_insert
6508 	 * ensures this.
6509 	 */
6510 	ASSERT(dst_ill->ill_type == ill->ill_type);
6511 
6512 	return (ill);
6513 }
6514 
6515 /*
6516  * Helper function for the IPIF_NOFAILOVER/ATTACH_IF interface attachment case.
6517  */
6518 ill_t *
6519 ip_grab_attach_ill(ill_t *ill, mblk_t *first_mp, int ifindex, boolean_t isv6)
6520 {
6521 	ill_t *ret_ill;
6522 
6523 	ASSERT(ifindex != 0);
6524 	ret_ill = ill_lookup_on_ifindex(ifindex, isv6, NULL, NULL, NULL, NULL);
6525 	if (ret_ill == NULL ||
6526 	    (ret_ill->ill_phyint->phyint_flags & PHYI_OFFLINE)) {
6527 		if (isv6) {
6528 			if (ill != NULL) {
6529 				BUMP_MIB(ill->ill_ip6_mib, ipv6OutDiscards);
6530 			} else {
6531 				BUMP_MIB(&ip6_mib, ipv6OutDiscards);
6532 			}
6533 			ip1dbg(("ip_grab_attach_ill (IPv6): "
6534 			    "bad ifindex %d.\n", ifindex));
6535 		} else {
6536 			BUMP_MIB(&ip_mib, ipOutDiscards);
6537 			ip1dbg(("ip_grab_attach_ill (IPv4): "
6538 			    "bad ifindex %d.\n", ifindex));
6539 		}
6540 		if (ret_ill != NULL)
6541 			ill_refrele(ret_ill);
6542 		freemsg(first_mp);
6543 		return (NULL);
6544 	}
6545 
6546 	return (ret_ill);
6547 }
6548 
6549 /*
6550  * IPv4 -
6551  * ip_newroute is called by ip_rput or ip_wput whenever we need to send
6552  * out a packet to a destination address for which we do not have specific
6553  * (or sufficient) routing information.
6554  *
6555  * NOTE : These are the scopes of some of the variables that point at IRE,
6556  *	  which needs to be followed while making any future modifications
6557  *	  to avoid memory leaks.
6558  *
6559  *	- ire and sire are the entries looked up initially by
6560  *	  ire_ftable_lookup.
6561  *	- ipif_ire is used to hold the interface ire associated with
6562  *	  the new cache ire. But it's scope is limited, so we always REFRELE
6563  *	  it before branching out to error paths.
6564  *	- save_ire is initialized before ire_create, so that ire returned
6565  *	  by ire_create will not over-write the ire. We REFRELE save_ire
6566  *	  before breaking out of the switch.
6567  *
6568  *	Thus on failures, we have to REFRELE only ire and sire, if they
6569  *	are not NULL.
6570  */
6571 void
6572 ip_newroute(queue_t *q, mblk_t *mp, ipaddr_t dst, ill_t *in_ill, conn_t *connp)
6573 {
6574 	areq_t	*areq;
6575 	ipaddr_t gw = 0;
6576 	ire_t	*ire = NULL;
6577 	mblk_t	*res_mp;
6578 	ipaddr_t *addrp;
6579 	ipif_t  *src_ipif = NULL;
6580 	ill_t	*dst_ill = NULL;
6581 	ipha_t  *ipha;
6582 	ire_t	*sire = NULL;
6583 	mblk_t	*first_mp;
6584 	ire_t	*save_ire;
6585 	mblk_t	*dlureq_mp;
6586 	ill_t	*attach_ill = NULL;	/* Bind to IPIF_NOFAILOVER address */
6587 	ushort_t ire_marks = 0;
6588 	boolean_t mctl_present;
6589 	ipsec_out_t *io;
6590 	mblk_t	*saved_mp;
6591 	ire_t	*first_sire = NULL;
6592 	mblk_t	*copy_mp = NULL;
6593 	mblk_t	*xmit_mp = NULL;
6594 	ipaddr_t save_dst;
6595 	uint32_t multirt_flags =
6596 	    MULTIRT_CACHEGW | MULTIRT_USESTAMP | MULTIRT_SETSTAMP;
6597 	boolean_t multirt_is_resolvable;
6598 	boolean_t multirt_resolve_next;
6599 	boolean_t do_attach_ill = B_FALSE;
6600 	zoneid_t zoneid;
6601 
6602 	if (ip_debug > 2) {
6603 		/* ip1dbg */
6604 		pr_addr_dbg("ip_newroute: dst %s\n", AF_INET, &dst);
6605 	}
6606 
6607 	EXTRACT_PKT_MP(mp, first_mp, mctl_present);
6608 	if (mctl_present) {
6609 		io = (ipsec_out_t *)first_mp->b_rptr;
6610 		zoneid = io->ipsec_out_zoneid;
6611 		ASSERT(zoneid != ALL_ZONES);
6612 	} else if (connp != NULL) {
6613 		zoneid = connp->conn_zoneid;
6614 	} else {
6615 		zoneid = GLOBAL_ZONEID;
6616 	}
6617 
6618 	ipha = (ipha_t *)mp->b_rptr;
6619 
6620 	/* All multicast lookups come through ip_newroute_ipif() */
6621 	if (CLASSD(dst)) {
6622 		ip0dbg(("ip_newroute: CLASSD 0x%x (b_prev %p, b_next %p)\n",
6623 		    ntohl(dst), (void *)mp->b_prev, (void *)mp->b_next));
6624 		freemsg(first_mp);
6625 		return;
6626 	}
6627 
6628 	if (ip_loopback_src_or_dst(ipha, NULL)) {
6629 		goto icmp_err_ret;
6630 	}
6631 
6632 	if (mctl_present && io->ipsec_out_attach_if) {
6633 		/* ip_grab_attach_ill returns a held ill */
6634 		attach_ill = ip_grab_attach_ill(NULL, first_mp,
6635 		    io->ipsec_out_ill_index, B_FALSE);
6636 
6637 		/* Failure case frees things for us. */
6638 		if (attach_ill == NULL)
6639 			return;
6640 
6641 		/*
6642 		 * Check if we need an ire that will not be
6643 		 * looked up by anybody else i.e. HIDDEN.
6644 		 */
6645 		if (ill_is_probeonly(attach_ill))
6646 			ire_marks = IRE_MARK_HIDDEN;
6647 	}
6648 	/*
6649 	 * If this IRE is created for forwarding or it is not for
6650 	 * traffic for congestion controlled protocols, mark it as temporary.
6651 	 */
6652 	if (mp->b_prev != NULL || !IP_FLOW_CONTROLLED_ULP(ipha->ipha_protocol))
6653 		ire_marks |= IRE_MARK_TEMPORARY;
6654 
6655 	/*
6656 	 * Get what we can from ire_ftable_lookup which will follow an IRE
6657 	 * chain until it gets the most specific information available.
6658 	 * For example, we know that there is no IRE_CACHE for this dest,
6659 	 * but there may be an IRE_OFFSUBNET which specifies a gateway.
6660 	 * ire_ftable_lookup will look up the gateway, etc.
6661 	 * Check if in_ill != NULL. If it is true, the packet must be
6662 	 * from an incoming interface where RTA_SRCIFP is set.
6663 	 * Otherwise, given ire_ftable_lookup algorithm, only one among routes
6664 	 * to the destination, of equal netmask length in the forward table,
6665 	 * will be recursively explored. If no information is available
6666 	 * for the final gateway of that route, we force the returned ire
6667 	 * to be equal to sire using MATCH_IRE_PARENT.
6668 	 * At least, in this case we have a starting point (in the buckets)
6669 	 * to look for other routes to the destination in the forward table.
6670 	 * This is actually used only for multirouting, where a list
6671 	 * of routes has to be processed in sequence.
6672 	 */
6673 	if (in_ill != NULL) {
6674 		ire = ire_srcif_table_lookup(dst, IRE_IF_RESOLVER, NULL,
6675 		    in_ill, MATCH_IRE_TYPE);
6676 	} else if (attach_ill == NULL) {
6677 		ire = ire_ftable_lookup(dst, 0, 0, 0,
6678 		    NULL, &sire, zoneid, 0,
6679 		    MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT |
6680 		    MATCH_IRE_RJ_BHOLE | MATCH_IRE_PARENT);
6681 	} else {
6682 		/*
6683 		 * attach_ill is set only for communicating with
6684 		 * on-link hosts. So, don't look for DEFAULT.
6685 		 */
6686 		ipif_t	*attach_ipif;
6687 
6688 		attach_ipif = ipif_get_next_ipif(NULL, attach_ill);
6689 		if (attach_ipif == NULL) {
6690 			ill_refrele(attach_ill);
6691 			goto icmp_err_ret;
6692 		}
6693 		ire = ire_ftable_lookup(dst, 0, 0, 0, attach_ipif,
6694 		    &sire, zoneid, 0,
6695 		    MATCH_IRE_RJ_BHOLE | MATCH_IRE_ILL);
6696 		ipif_refrele(attach_ipif);
6697 	}
6698 	ip3dbg(("ip_newroute: ire_ftable_lookup() "
6699 	    "returned ire %p, sire %p\n", (void *)ire, (void *)sire));
6700 
6701 	/*
6702 	 * This loop is run only once in most cases.
6703 	 * We loop to resolve further routes only when the destination
6704 	 * can be reached through multiple RTF_MULTIRT-flagged ires.
6705 	 */
6706 	do {
6707 		/* Clear the previous iteration's values */
6708 		if (src_ipif != NULL) {
6709 			ipif_refrele(src_ipif);
6710 			src_ipif = NULL;
6711 		}
6712 		if (dst_ill != NULL) {
6713 			ill_refrele(dst_ill);
6714 			dst_ill = NULL;
6715 		}
6716 
6717 		multirt_resolve_next = B_FALSE;
6718 		/*
6719 		 * We check if packets have to be multirouted.
6720 		 * In this case, given the current <ire, sire> couple,
6721 		 * we look for the next suitable <ire, sire>.
6722 		 * This check is done in ire_multirt_lookup(),
6723 		 * which applies various criteria to find the next route
6724 		 * to resolve. ire_multirt_lookup() leaves <ire, sire>
6725 		 * unchanged if it detects it has not been tried yet.
6726 		 */
6727 		if ((sire != NULL) && (sire->ire_flags & RTF_MULTIRT)) {
6728 			ip3dbg(("ip_newroute: starting next_resolution "
6729 			    "with first_mp %p, tag %d\n",
6730 			    (void *)first_mp,
6731 			    MULTIRT_DEBUG_TAGGED(first_mp)));
6732 
6733 			ASSERT(sire != NULL);
6734 			multirt_is_resolvable =
6735 			    ire_multirt_lookup(&ire, &sire, multirt_flags);
6736 
6737 			ip3dbg(("ip_newroute: multirt_is_resolvable %d, "
6738 			    "ire %p, sire %p\n",
6739 			    multirt_is_resolvable,
6740 			    (void *)ire, (void *)sire));
6741 
6742 			if (!multirt_is_resolvable) {
6743 				/*
6744 				 * No more multirt route to resolve; give up
6745 				 * (all routes resolved or no more
6746 				 * resolvable routes).
6747 				 */
6748 				if (ire != NULL) {
6749 					ire_refrele(ire);
6750 					ire = NULL;
6751 				}
6752 			} else {
6753 				ASSERT(sire != NULL);
6754 				ASSERT(ire != NULL);
6755 				/*
6756 				 * We simply use first_sire as a flag that
6757 				 * indicates if a resolvable multirt route
6758 				 * has already been found.
6759 				 * If it is not the case, we may have to send
6760 				 * an ICMP error to report that the
6761 				 * destination is unreachable.
6762 				 * We do not IRE_REFHOLD first_sire.
6763 				 */
6764 				if (first_sire == NULL) {
6765 					first_sire = sire;
6766 				}
6767 			}
6768 		}
6769 		if (ire == NULL) {
6770 			if (ip_debug > 3) {
6771 				/* ip2dbg */
6772 				pr_addr_dbg("ip_newroute: "
6773 				    "can't resolve %s\n", AF_INET, &dst);
6774 			}
6775 			ip3dbg(("ip_newroute: "
6776 			    "ire %p, sire %p, first_sire %p\n",
6777 			    (void *)ire, (void *)sire, (void *)first_sire));
6778 
6779 			if (sire != NULL) {
6780 				ire_refrele(sire);
6781 				sire = NULL;
6782 			}
6783 
6784 			if (first_sire != NULL) {
6785 				/*
6786 				 * At least one multirt route has been found
6787 				 * in the same call to ip_newroute();
6788 				 * there is no need to report an ICMP error.
6789 				 * first_sire was not IRE_REFHOLDed.
6790 				 */
6791 				MULTIRT_DEBUG_UNTAG(first_mp);
6792 				freemsg(first_mp);
6793 				return;
6794 			}
6795 			ip_rts_change(RTM_MISS, dst, 0, 0, 0, 0, 0, 0,
6796 			    RTA_DST);
6797 			if (attach_ill != NULL)
6798 				ill_refrele(attach_ill);
6799 			goto icmp_err_ret;
6800 		}
6801 
6802 		/*
6803 		 * When RTA_SRCIFP is used to add a route, then an interface
6804 		 * route is added in the source interface's routing table.
6805 		 * If the outgoing interface of this route is of type
6806 		 * IRE_IF_RESOLVER, then upon creation of the ire,
6807 		 * ire_dlureq_mp is set to NULL. Later, when this route is
6808 		 * first used for forwarding packet, ip_newroute() is called
6809 		 * to resolve the hardware address of the outgoing ipif.
6810 		 * We do not come here for IRE_IF_NORESOLVER entries in the
6811 		 * source interface based table. We only come here if the
6812 		 * outgoing interface is a resolver interface and we don't
6813 		 * have the ire_dlureq_mp information yet.
6814 		 * If in_ill is not null that means it is called from
6815 		 * ip_rput.
6816 		 */
6817 
6818 		ASSERT(ire->ire_in_ill == NULL ||
6819 		    (ire->ire_type == IRE_IF_RESOLVER &&
6820 		    ire->ire_dlureq_mp == NULL));
6821 
6822 		/*
6823 		 * Verify that the returned IRE does not have either
6824 		 * the RTF_REJECT or RTF_BLACKHOLE flags set and that the IRE is
6825 		 * either an IRE_CACHE, IRE_IF_NORESOLVER or IRE_IF_RESOLVER.
6826 		 */
6827 		if ((ire->ire_flags & (RTF_REJECT | RTF_BLACKHOLE)) ||
6828 		    (ire->ire_type & (IRE_CACHE | IRE_INTERFACE)) == 0) {
6829 			if (attach_ill != NULL)
6830 				ill_refrele(attach_ill);
6831 			goto icmp_err_ret;
6832 		}
6833 		/*
6834 		 * Increment the ire_ob_pkt_count field for ire if it is an
6835 		 * INTERFACE (IF_RESOLVER or IF_NORESOLVER) IRE type, and
6836 		 * increment the same for the parent IRE, sire, if it is some
6837 		 * sort of prefix IRE (which includes DEFAULT, PREFIX, HOST
6838 		 * and HOST_REDIRECT).
6839 		 */
6840 		if ((ire->ire_type & IRE_INTERFACE) != 0) {
6841 			UPDATE_OB_PKT_COUNT(ire);
6842 			ire->ire_last_used_time = lbolt;
6843 		}
6844 
6845 		if (sire != NULL) {
6846 			gw = sire->ire_gateway_addr;
6847 			ASSERT((sire->ire_type & (IRE_CACHETABLE |
6848 			    IRE_INTERFACE)) == 0);
6849 			UPDATE_OB_PKT_COUNT(sire);
6850 			sire->ire_last_used_time = lbolt;
6851 		}
6852 		/*
6853 		 * We have a route to reach the destination.
6854 		 *
6855 		 * 1) If the interface is part of ill group, try to get a new
6856 		 *    ill taking load spreading into account.
6857 		 *
6858 		 * 2) After selecting the ill, get a source address that
6859 		 *    might create good inbound load spreading.
6860 		 *    ipif_select_source does this for us.
6861 		 *
6862 		 * If the application specified the ill (ifindex), we still
6863 		 * load spread. Only if the packets needs to go out
6864 		 * specifically on a given ill e.g. binding to
6865 		 * IPIF_NOFAILOVER address, then we don't try to use a
6866 		 * different ill for load spreading.
6867 		 */
6868 		if (attach_ill == NULL) {
6869 			/*
6870 			 * Don't perform outbound load spreading in the
6871 			 * case of an RTF_MULTIRT route, as we actually
6872 			 * typically want to replicate outgoing packets
6873 			 * through particular interfaces.
6874 			 */
6875 			if ((sire != NULL) && (sire->ire_flags & RTF_MULTIRT)) {
6876 				dst_ill = ire->ire_ipif->ipif_ill;
6877 				/* for uniformity */
6878 				ill_refhold(dst_ill);
6879 			} else {
6880 				/*
6881 				 * If we are here trying to create an IRE_CACHE
6882 				 * for an offlink destination and have the
6883 				 * IRE_CACHE for the next hop and the latter is
6884 				 * using virtual IP source address selection i.e
6885 				 * it's ire->ire_ipif is pointing to a virtual
6886 				 * network interface (vni) then
6887 				 * ip_newroute_get_dst_ll() will return the vni
6888 				 * interface as the dst_ill. Since the vni is
6889 				 * virtual i.e not associated with any physical
6890 				 * interface, it cannot be the dst_ill, hence
6891 				 * in such a case call ip_newroute_get_dst_ll()
6892 				 * with the stq_ill instead of the ire_ipif ILL.
6893 				 * The function returns a refheld ill.
6894 				 */
6895 				if ((ire->ire_type == IRE_CACHE) &&
6896 				    IS_VNI(ire->ire_ipif->ipif_ill))
6897 					dst_ill = ip_newroute_get_dst_ill(
6898 						ire->ire_stq->q_ptr);
6899 				else
6900 					dst_ill = ip_newroute_get_dst_ill(
6901 						ire->ire_ipif->ipif_ill);
6902 			}
6903 			if (dst_ill == NULL) {
6904 				if (ip_debug > 2) {
6905 					pr_addr_dbg("ip_newroute: "
6906 					    "no dst ill for dst"
6907 					    " %s\n", AF_INET, &dst);
6908 				}
6909 				goto icmp_err_ret;
6910 			}
6911 		} else {
6912 			dst_ill = ire->ire_ipif->ipif_ill;
6913 			/* for uniformity */
6914 			ill_refhold(dst_ill);
6915 			/*
6916 			 * We should have found a route matching ill as we
6917 			 * called ire_ftable_lookup with MATCH_IRE_ILL.
6918 			 * Rather than asserting, when there is a mismatch,
6919 			 * we just drop the packet.
6920 			 */
6921 			if (dst_ill != attach_ill) {
6922 				ip0dbg(("ip_newroute: Packet dropped as "
6923 				    "IPIF_NOFAILOVER ill is %s, "
6924 				    "ire->ire_ipif->ipif_ill is %s\n",
6925 				    attach_ill->ill_name,
6926 				    dst_ill->ill_name));
6927 				ill_refrele(attach_ill);
6928 				goto icmp_err_ret;
6929 			}
6930 		}
6931 		/* attach_ill can't go in loop. IPMP and CGTP are disjoint */
6932 		if (attach_ill != NULL) {
6933 			ill_refrele(attach_ill);
6934 			attach_ill = NULL;
6935 			do_attach_ill = B_TRUE;
6936 		}
6937 		ASSERT(dst_ill != NULL);
6938 		ip2dbg(("ip_newroute: dst_ill %s\n", dst_ill->ill_name));
6939 
6940 		/*
6941 		 * Pick the best source address from dst_ill.
6942 		 *
6943 		 * 1) If it is part of a multipathing group, we would
6944 		 *    like to spread the inbound packets across different
6945 		 *    interfaces. ipif_select_source picks a random source
6946 		 *    across the different ills in the group.
6947 		 *
6948 		 * 2) If it is not part of a multipathing group, we try
6949 		 *    to pick the source address from the destination
6950 		 *    route. Clustering assumes that when we have multiple
6951 		 *    prefixes hosted on an interface, the prefix of the
6952 		 *    source address matches the prefix of the destination
6953 		 *    route. We do this only if the address is not
6954 		 *    DEPRECATED.
6955 		 *
6956 		 * 3) If the conn is in a different zone than the ire, we
6957 		 *    need to pick a source address from the right zone.
6958 		 *
6959 		 * NOTE : If we hit case (1) above, the prefix of the source
6960 		 *	  address picked may not match the prefix of the
6961 		 *	  destination routes prefix as ipif_select_source
6962 		 *	  does not look at "dst" while picking a source
6963 		 *	  address.
6964 		 *	  If we want the same behavior as (2), we will need
6965 		 *	  to change the behavior of ipif_select_source.
6966 		 */
6967 		ASSERT(src_ipif == NULL);
6968 		if ((sire != NULL) && (sire->ire_flags & RTF_SETSRC)) {
6969 			/*
6970 			 * The RTF_SETSRC flag is set in the parent ire (sire).
6971 			 * Check that the ipif matching the requested source
6972 			 * address still exists.
6973 			 */
6974 			src_ipif = ipif_lookup_addr(sire->ire_src_addr, NULL,
6975 			    zoneid, NULL, NULL, NULL, NULL);
6976 		}
6977 		if (src_ipif == NULL) {
6978 			ire_marks |= IRE_MARK_USESRC_CHECK;
6979 			if ((dst_ill->ill_group != NULL) ||
6980 			    (ire->ire_ipif->ipif_flags & IPIF_DEPRECATED) ||
6981 			    (connp != NULL && ire->ire_zoneid != zoneid) ||
6982 			    (dst_ill->ill_usesrc_ifindex != 0)) {
6983 				src_ipif = ipif_select_source(dst_ill, dst,
6984 				    zoneid);
6985 				if (src_ipif == NULL) {
6986 					if (ip_debug > 2) {
6987 						pr_addr_dbg("ip_newroute: "
6988 						    "no src for dst %s ",
6989 						    AF_INET, &dst);
6990 						printf("through interface %s\n",
6991 						    dst_ill->ill_name);
6992 					}
6993 					goto icmp_err_ret;
6994 				}
6995 			} else {
6996 				src_ipif = ire->ire_ipif;
6997 				ASSERT(src_ipif != NULL);
6998 				/* hold src_ipif for uniformity */
6999 				ipif_refhold(src_ipif);
7000 			}
7001 		}
7002 
7003 		/*
7004 		 * Assign a source address while we have the conn.
7005 		 * We can't have ip_wput_ire pick a source address when the
7006 		 * packet returns from arp since we need to look at
7007 		 * conn_unspec_src and conn_zoneid, and we lose the conn when
7008 		 * going through arp.
7009 		 *
7010 		 * NOTE : ip_newroute_v6 does not have this piece of code as
7011 		 *	  it uses ip6i to store this information.
7012 		 */
7013 		if (ipha->ipha_src == INADDR_ANY &&
7014 		    (connp == NULL || !connp->conn_unspec_src)) {
7015 			ipha->ipha_src = src_ipif->ipif_src_addr;
7016 		}
7017 		if (ip_debug > 3) {
7018 			/* ip2dbg */
7019 			pr_addr_dbg("ip_newroute: first hop %s\n",
7020 			    AF_INET, &gw);
7021 		}
7022 		ip2dbg(("\tire type %s (%d)\n",
7023 		    ip_nv_lookup(ire_nv_tbl, ire->ire_type), ire->ire_type));
7024 
7025 		/*
7026 		 * The TTL of multirouted packets is bounded by the
7027 		 * ip_multirt_ttl ndd variable.
7028 		 */
7029 		if ((sire != NULL) && (sire->ire_flags & RTF_MULTIRT)) {
7030 			/* Force TTL of multirouted packets */
7031 			if ((ip_multirt_ttl > 0) &&
7032 			    (ipha->ipha_ttl > ip_multirt_ttl)) {
7033 				ip2dbg(("ip_newroute: forcing multirt TTL "
7034 				    "to %d (was %d), dst 0x%08x\n",
7035 				    ip_multirt_ttl, ipha->ipha_ttl,
7036 				    ntohl(sire->ire_addr)));
7037 				ipha->ipha_ttl = ip_multirt_ttl;
7038 			}
7039 		}
7040 		/*
7041 		 * At this point in ip_newroute(), ire is either the
7042 		 * IRE_CACHE of the next-hop gateway for an off-subnet
7043 		 * destination or an IRE_INTERFACE type that should be used
7044 		 * to resolve an on-subnet destination or an on-subnet
7045 		 * next-hop gateway.
7046 		 *
7047 		 * In the IRE_CACHE case, we have the following :
7048 		 *
7049 		 * 1) src_ipif - used for getting a source address.
7050 		 *
7051 		 * 2) dst_ill - from which we derive ire_stq/ire_rfq. This
7052 		 *    means packets using this IRE_CACHE will go out on
7053 		 *    dst_ill.
7054 		 *
7055 		 * 3) The IRE sire will point to the prefix that is the
7056 		 *    longest  matching route for the destination. These
7057 		 *    prefix types include IRE_DEFAULT, IRE_PREFIX, IRE_HOST,
7058 		 *    and IRE_HOST_REDIRECT.
7059 		 *
7060 		 *    The newly created IRE_CACHE entry for the off-subnet
7061 		 *    destination is tied to both the prefix route and the
7062 		 *    interface route used to resolve the next-hop gateway
7063 		 *    via the ire_phandle and ire_ihandle fields,
7064 		 *    respectively.
7065 		 *
7066 		 * In the IRE_INTERFACE case, we have the following :
7067 		 *
7068 		 * 1) src_ipif - used for getting a source address.
7069 		 *
7070 		 * 2) dst_ill - from which we derive ire_stq/ire_rfq. This
7071 		 *    means packets using the IRE_CACHE that we will build
7072 		 *    here will go out on dst_ill.
7073 		 *
7074 		 * 3) sire may or may not be NULL. But, the IRE_CACHE that is
7075 		 *    to be created will only be tied to the IRE_INTERFACE
7076 		 *    that was derived from the ire_ihandle field.
7077 		 *
7078 		 *    If sire is non-NULL, it means the destination is
7079 		 *    off-link and we will first create the IRE_CACHE for the
7080 		 *    gateway. Next time through ip_newroute, we will create
7081 		 *    the IRE_CACHE for the final destination as described
7082 		 *    above.
7083 		 *
7084 		 * In both cases, after the current resolution has been
7085 		 * completed (or possibly initialised, in the IRE_INTERFACE
7086 		 * case), the loop may be re-entered to attempt the resolution
7087 		 * of another RTF_MULTIRT route.
7088 		 *
7089 		 * When an IRE_CACHE entry for the off-subnet destination is
7090 		 * created, RTF_SETSRC and RTF_MULTIRT are inherited from sire,
7091 		 * for further processing in emission loops.
7092 		 */
7093 		save_ire = ire;
7094 		switch (ire->ire_type) {
7095 		case IRE_CACHE: {
7096 			ire_t	*ipif_ire;
7097 			mblk_t	*ire_fp_mp;
7098 
7099 			ASSERT(sire != NULL);
7100 			if (gw == 0)
7101 				gw = ire->ire_gateway_addr;
7102 			/*
7103 			 * We need 3 ire's to create a new cache ire for an
7104 			 * off-link destination from the cache ire of the
7105 			 * gateway.
7106 			 *
7107 			 *	1. The prefix ire 'sire'
7108 			 *	2. The cache ire of the gateway 'ire'
7109 			 *	3. The interface ire 'ipif_ire'
7110 			 *
7111 			 * We have (1) and (2). We lookup (3) below.
7112 			 *
7113 			 * If there is no interface route to the gateway,
7114 			 * it is a race condition, where we found the cache
7115 			 * but the inteface route has been deleted.
7116 			 */
7117 			ipif_ire = ire_ihandle_lookup_offlink(ire, sire);
7118 			if (ipif_ire == NULL) {
7119 				ip1dbg(("ip_newroute: "
7120 				    "ire_ihandle_lookup_offlink failed\n"));
7121 				goto icmp_err_ret;
7122 			}
7123 			/*
7124 			 * XXX We are using the same dlureq_mp
7125 			 * (DL_UNITDATA_REQ) though the save_ire is not
7126 			 * pointing at the same ill.
7127 			 * This is incorrect. We need to send it up to the
7128 			 * resolver to get the right dlureq_mp. For ethernets
7129 			 * this may be okay (ill_type == DL_ETHER).
7130 			 */
7131 			dlureq_mp = save_ire->ire_dlureq_mp;
7132 			ire_fp_mp = NULL;
7133 			/*
7134 			 * save_ire's ire_fp_mp can't change since it is
7135 			 * not an IRE_MIPRTUN or IRE_BROADCAST
7136 			 * LOCK_IRE_FP_MP does not do any useful work in
7137 			 * the case of IRE_CACHE. So we don't use it below.
7138 			 */
7139 			if (save_ire->ire_stq == dst_ill->ill_wq)
7140 				ire_fp_mp = save_ire->ire_fp_mp;
7141 
7142 			ire = ire_create(
7143 			    (uchar_t *)&dst,		/* dest address */
7144 			    (uchar_t *)&ip_g_all_ones,	/* mask */
7145 			    (uchar_t *)&src_ipif->ipif_src_addr, /* src addr */
7146 			    (uchar_t *)&gw,		/* gateway address */
7147 			    NULL,
7148 			    &save_ire->ire_max_frag,
7149 			    ire_fp_mp,			/* Fast Path header */
7150 			    dst_ill->ill_rq,		/* recv-from queue */
7151 			    dst_ill->ill_wq,		/* send-to queue */
7152 			    IRE_CACHE,			/* IRE type */
7153 			    save_ire->ire_dlureq_mp,
7154 			    src_ipif,
7155 			    in_ill,			/* incoming ill */
7156 			    sire->ire_mask,		/* Parent mask */
7157 			    sire->ire_phandle,		/* Parent handle */
7158 			    ipif_ire->ire_ihandle,	/* Interface handle */
7159 			    sire->ire_flags &
7160 				(RTF_SETSRC | RTF_MULTIRT), /* flags if any */
7161 			    &(sire->ire_uinfo));
7162 
7163 			if (ire == NULL) {
7164 				ire_refrele(ipif_ire);
7165 				ire_refrele(save_ire);
7166 				break;
7167 			}
7168 
7169 			ire->ire_marks |= ire_marks;
7170 
7171 			/*
7172 			 * Prevent sire and ipif_ire from getting deleted.
7173 			 * The newly created ire is tied to both of them via
7174 			 * the phandle and ihandle respectively.
7175 			 */
7176 			IRB_REFHOLD(sire->ire_bucket);
7177 			/* Has it been removed already ? */
7178 			if (sire->ire_marks & IRE_MARK_CONDEMNED) {
7179 				IRB_REFRELE(sire->ire_bucket);
7180 				ire_refrele(ipif_ire);
7181 				ire_refrele(save_ire);
7182 				break;
7183 			}
7184 
7185 			IRB_REFHOLD(ipif_ire->ire_bucket);
7186 			/* Has it been removed already ? */
7187 			if (ipif_ire->ire_marks & IRE_MARK_CONDEMNED) {
7188 				IRB_REFRELE(ipif_ire->ire_bucket);
7189 				IRB_REFRELE(sire->ire_bucket);
7190 				ire_refrele(ipif_ire);
7191 				ire_refrele(save_ire);
7192 				break;
7193 			}
7194 
7195 			xmit_mp = first_mp;
7196 			/*
7197 			 * In the case of multirouting, a copy
7198 			 * of the packet is done before its sending.
7199 			 * The copy is used to attempt another
7200 			 * route resolution, in a next loop.
7201 			 */
7202 			if (ire->ire_flags & RTF_MULTIRT) {
7203 				copy_mp = copymsg(first_mp);
7204 				if (copy_mp != NULL) {
7205 					xmit_mp = copy_mp;
7206 					MULTIRT_DEBUG_TAG(first_mp);
7207 				}
7208 			}
7209 			ire_add_then_send(q, ire, xmit_mp);
7210 			ire_refrele(save_ire);
7211 
7212 			/* Assert that sire is not deleted yet. */
7213 			ASSERT(sire->ire_ptpn != NULL);
7214 			IRB_REFRELE(sire->ire_bucket);
7215 
7216 			/* Assert that ipif_ire is not deleted yet. */
7217 			ASSERT(ipif_ire->ire_ptpn != NULL);
7218 			IRB_REFRELE(ipif_ire->ire_bucket);
7219 			ire_refrele(ipif_ire);
7220 
7221 			/*
7222 			 * If copy_mp is not NULL, multirouting was
7223 			 * requested. We loop to initiate a next
7224 			 * route resolution attempt, starting from sire.
7225 			 */
7226 			if (copy_mp != NULL) {
7227 				/*
7228 				 * Search for the next unresolved
7229 				 * multirt route.
7230 				 */
7231 				copy_mp = NULL;
7232 				ipif_ire = NULL;
7233 				ire = NULL;
7234 				multirt_resolve_next = B_TRUE;
7235 				continue;
7236 			}
7237 
7238 			ire_refrele(sire);
7239 			ipif_refrele(src_ipif);
7240 			ill_refrele(dst_ill);
7241 			return;
7242 		}
7243 		case IRE_IF_NORESOLVER: {
7244 			/*
7245 			 * We have what we need to build an IRE_CACHE.
7246 			 *
7247 			 * Create a new dlureq_mp with the IP gateway address
7248 			 * in destination address in the DLPI hdr if the
7249 			 * physical length is exactly 4 bytes.
7250 			 */
7251 			if (dst_ill->ill_phys_addr_length == IP_ADDR_LEN) {
7252 				uchar_t *addr;
7253 
7254 				if (gw)
7255 					addr = (uchar_t *)&gw;
7256 				else
7257 					addr = (uchar_t *)&dst;
7258 
7259 				dlureq_mp = ill_dlur_gen(addr,
7260 				    dst_ill->ill_phys_addr_length,
7261 				    dst_ill->ill_sap,
7262 				    dst_ill->ill_sap_length);
7263 			} else {
7264 				dlureq_mp = ire->ire_dlureq_mp;
7265 			}
7266 
7267 			if (dlureq_mp == NULL) {
7268 				ip1dbg(("ip_newroute: dlureq_mp NULL\n"));
7269 				break;
7270 			}
7271 
7272 			ire = ire_create(
7273 			    (uchar_t *)&dst,		/* dest address */
7274 			    (uchar_t *)&ip_g_all_ones,	/* mask */
7275 			    (uchar_t *)&src_ipif->ipif_src_addr, /* src addr */
7276 			    (uchar_t *)&gw,		/* gateway address */
7277 			    NULL,
7278 			    &save_ire->ire_max_frag,
7279 			    NULL,			/* Fast Path header */
7280 			    dst_ill->ill_rq,		/* recv-from queue */
7281 			    dst_ill->ill_wq,		/* send-to queue */
7282 			    IRE_CACHE,
7283 			    dlureq_mp,
7284 			    src_ipif,
7285 			    in_ill,			/* Incoming ill */
7286 			    save_ire->ire_mask,		/* Parent mask */
7287 			    (sire != NULL) ?		/* Parent handle */
7288 				sire->ire_phandle : 0,
7289 			    save_ire->ire_ihandle,	/* Interface handle */
7290 			    (sire != NULL) ? sire->ire_flags &
7291 				(RTF_SETSRC | RTF_MULTIRT) : 0, /* flags */
7292 			    &(save_ire->ire_uinfo));
7293 
7294 			if (dst_ill->ill_phys_addr_length == IP_ADDR_LEN)
7295 				freeb(dlureq_mp);
7296 
7297 			if (ire == NULL) {
7298 				ire_refrele(save_ire);
7299 				break;
7300 			}
7301 
7302 			ire->ire_marks |= ire_marks;
7303 
7304 			/* Prevent save_ire from getting deleted */
7305 			IRB_REFHOLD(save_ire->ire_bucket);
7306 			/* Has it been removed already ? */
7307 			if (save_ire->ire_marks & IRE_MARK_CONDEMNED) {
7308 				IRB_REFRELE(save_ire->ire_bucket);
7309 				ire_refrele(save_ire);
7310 				break;
7311 			}
7312 
7313 			/*
7314 			 * In the case of multirouting, a copy
7315 			 * of the packet is made before it is sent.
7316 			 * The copy is used in the next
7317 			 * loop to attempt another resolution.
7318 			 */
7319 			xmit_mp = first_mp;
7320 			if ((sire != NULL) &&
7321 			    (sire->ire_flags & RTF_MULTIRT)) {
7322 				copy_mp = copymsg(first_mp);
7323 				if (copy_mp != NULL) {
7324 					xmit_mp = copy_mp;
7325 					MULTIRT_DEBUG_TAG(first_mp);
7326 				}
7327 			}
7328 			ire_add_then_send(q, ire, xmit_mp);
7329 
7330 			/* Assert that it is not deleted yet. */
7331 			ASSERT(save_ire->ire_ptpn != NULL);
7332 			IRB_REFRELE(save_ire->ire_bucket);
7333 			ire_refrele(save_ire);
7334 
7335 			if (copy_mp != NULL) {
7336 				/*
7337 				 * If we found a (no)resolver, we ignore any
7338 				 * trailing top priority IRE_CACHE in further
7339 				 * loops. This ensures that we do not omit any
7340 				 * (no)resolver.
7341 				 * This IRE_CACHE, if any, will be processed
7342 				 * by another thread entering ip_newroute().
7343 				 * IRE_CACHE entries, if any, will be processed
7344 				 * by another thread entering ip_newroute(),
7345 				 * (upon resolver response, for instance).
7346 				 * This aims to force parallel multirt
7347 				 * resolutions as soon as a packet must be sent.
7348 				 * In the best case, after the tx of only one
7349 				 * packet, all reachable routes are resolved.
7350 				 * Otherwise, the resolution of all RTF_MULTIRT
7351 				 * routes would require several emissions.
7352 				 */
7353 				multirt_flags &= ~MULTIRT_CACHEGW;
7354 
7355 				/*
7356 				 * Search for the next unresolved multirt
7357 				 * route.
7358 				 */
7359 				copy_mp = NULL;
7360 				save_ire = NULL;
7361 				ire = NULL;
7362 				multirt_resolve_next = B_TRUE;
7363 				continue;
7364 			}
7365 
7366 			/*
7367 			 * Don't need sire anymore
7368 			 */
7369 			if (sire != NULL)
7370 				ire_refrele(sire);
7371 
7372 			ipif_refrele(src_ipif);
7373 			ill_refrele(dst_ill);
7374 			return;
7375 		}
7376 		case IRE_IF_RESOLVER:
7377 			/*
7378 			 * We can't build an IRE_CACHE yet, but at least we
7379 			 * found a resolver that can help.
7380 			 */
7381 			res_mp = dst_ill->ill_resolver_mp;
7382 			if (!OK_RESOLVER_MP(res_mp))
7383 				break;
7384 			/*
7385 			 * To be at this point in the code with a non-zero gw
7386 			 * means that dst is reachable through a gateway that
7387 			 * we have never resolved.  By changing dst to the gw
7388 			 * addr we resolve the gateway first.
7389 			 * When ire_add_then_send() tries to put the IP dg
7390 			 * to dst, it will reenter ip_newroute() at which
7391 			 * time we will find the IRE_CACHE for the gw and
7392 			 * create another IRE_CACHE in case IRE_CACHE above.
7393 			 */
7394 			if (gw != INADDR_ANY) {
7395 				/*
7396 				 * The source ipif that was determined above was
7397 				 * relative to the destination address, not the
7398 				 * gateway's. If src_ipif was not taken out of
7399 				 * the IRE_IF_RESOLVER entry, we'll need to call
7400 				 * ipif_select_source() again.
7401 				 */
7402 				if (src_ipif != ire->ire_ipif) {
7403 					ipif_refrele(src_ipif);
7404 					src_ipif = ipif_select_source(dst_ill,
7405 					    gw, zoneid);
7406 					if (src_ipif == NULL) {
7407 						if (ip_debug > 2) {
7408 							pr_addr_dbg(
7409 							    "ip_newroute: no "
7410 							    "src for gw %s ",
7411 							    AF_INET, &gw);
7412 							printf("through "
7413 							    "interface %s\n",
7414 							    dst_ill->ill_name);
7415 						}
7416 						goto icmp_err_ret;
7417 					}
7418 				}
7419 				save_dst = dst;
7420 				dst = gw;
7421 				gw = INADDR_ANY;
7422 			}
7423 			/*
7424 			 * We obtain a partial IRE_CACHE which we will pass
7425 			 * along with the resolver query.  When the response
7426 			 * comes back it will be there ready for us to add.
7427 			 * The ire_max_frag is atomically set under the
7428 			 * irebucket lock in ire_add_v[46].
7429 			 */
7430 			ire = ire_create_mp(
7431 			    (uchar_t *)&dst,		/* dest address */
7432 			    (uchar_t *)&ip_g_all_ones,	/* mask */
7433 			    (uchar_t *)&src_ipif->ipif_src_addr, /* src addr */
7434 			    (uchar_t *)&gw,		/* gateway address */
7435 			    NULL,			/* no in_src_addr */
7436 			    NULL,			/* ire_max_frag */
7437 			    NULL,			/* Fast Path header */
7438 			    dst_ill->ill_rq,		/* recv-from queue */
7439 			    dst_ill->ill_wq,		/* send-to queue */
7440 			    IRE_CACHE,
7441 			    res_mp,
7442 			    src_ipif,			/* Interface ipif */
7443 			    in_ill,			/* Incoming ILL */
7444 			    save_ire->ire_mask,		/* Parent mask */
7445 			    0,
7446 			    save_ire->ire_ihandle,	/* Interface handle */
7447 			    0,				/* flags if any */
7448 			    &(save_ire->ire_uinfo));
7449 
7450 			if (ire == NULL) {
7451 				ire_refrele(save_ire);
7452 				break;
7453 			}
7454 
7455 			if ((sire != NULL) &&
7456 			    (sire->ire_flags & RTF_MULTIRT)) {
7457 				copy_mp = copymsg(first_mp);
7458 				if (copy_mp != NULL)
7459 					MULTIRT_DEBUG_TAG(copy_mp);
7460 			}
7461 
7462 			ire->ire_marks |= ire_marks;
7463 
7464 			/*
7465 			 * Construct message chain for the resolver
7466 			 * of the form:
7467 			 * 	ARP_REQ_MBLK-->IRE_MBLK-->Packet
7468 			 * Packet could contain a IPSEC_OUT mp.
7469 			 *
7470 			 * NOTE : ire will be added later when the response
7471 			 * comes back from ARP. If the response does not
7472 			 * come back, ARP frees the packet. For this reason,
7473 			 * we can't REFHOLD the bucket of save_ire to prevent
7474 			 * deletions. We may not be able to REFRELE the bucket
7475 			 * if the response never comes back. Thus, before
7476 			 * adding the ire, ire_add_v4 will make sure that the
7477 			 * interface route does not get deleted. This is the
7478 			 * only case unlike ip_newroute_v6, ip_newroute_ipif_v6
7479 			 * where we can always prevent deletions because of
7480 			 * the synchronous nature of adding IRES i.e
7481 			 * ire_add_then_send is called after creating the IRE.
7482 			 */
7483 			ASSERT(ire->ire_mp != NULL);
7484 			ire->ire_mp->b_cont = first_mp;
7485 			/* Have saved_mp handy, for cleanup if canput fails */
7486 			saved_mp = mp;
7487 			mp = ire->ire_dlureq_mp;
7488 			ASSERT(mp != NULL);
7489 			ire->ire_dlureq_mp = NULL;
7490 			linkb(mp, ire->ire_mp);
7491 
7492 
7493 			/*
7494 			 * Fill in the source and dest addrs for the resolver.
7495 			 * NOTE: this depends on memory layouts imposed by
7496 			 * ill_init().
7497 			 */
7498 			areq = (areq_t *)mp->b_rptr;
7499 			addrp = (ipaddr_t *)((char *)areq +
7500 			    areq->areq_sender_addr_offset);
7501 			if (do_attach_ill) {
7502 				/*
7503 				 * This is bind to no failover case.
7504 				 * arp packet also must go out on attach_ill.
7505 				 */
7506 				ASSERT(ipha->ipha_src != NULL);
7507 				*addrp = ipha->ipha_src;
7508 			} else {
7509 				*addrp = save_ire->ire_src_addr;
7510 			}
7511 
7512 			ire_refrele(save_ire);
7513 			addrp = (ipaddr_t *)((char *)areq +
7514 			    areq->areq_target_addr_offset);
7515 			*addrp = dst;
7516 			/* Up to the resolver. */
7517 			if (canputnext(dst_ill->ill_rq)) {
7518 				putnext(dst_ill->ill_rq, mp);
7519 				ire = NULL;
7520 				if (copy_mp != NULL) {
7521 					/*
7522 					 * If we found a resolver, we ignore
7523 					 * any trailing top priority IRE_CACHE
7524 					 * in the further loops. This ensures
7525 					 * that we do not omit any resolver.
7526 					 * IRE_CACHE entries, if any, will be
7527 					 * processed next time we enter
7528 					 * ip_newroute().
7529 					 */
7530 					multirt_flags &= ~MULTIRT_CACHEGW;
7531 					/*
7532 					 * Search for the next unresolved
7533 					 * multirt route.
7534 					 */
7535 					first_mp = copy_mp;
7536 					copy_mp = NULL;
7537 					/* Prepare the next resolution loop. */
7538 					mp = first_mp;
7539 					EXTRACT_PKT_MP(mp, first_mp,
7540 					    mctl_present);
7541 					if (mctl_present)
7542 						io = (ipsec_out_t *)
7543 						    first_mp->b_rptr;
7544 					ipha = (ipha_t *)mp->b_rptr;
7545 
7546 					ASSERT(sire != NULL);
7547 
7548 					dst = save_dst;
7549 					multirt_resolve_next = B_TRUE;
7550 					continue;
7551 				}
7552 
7553 				if (sire != NULL)
7554 					ire_refrele(sire);
7555 
7556 				/*
7557 				 * The response will come back in ip_wput
7558 				 * with db_type IRE_DB_TYPE.
7559 				 */
7560 				ipif_refrele(src_ipif);
7561 				ill_refrele(dst_ill);
7562 				return;
7563 			} else {
7564 				/* Prepare for cleanup */
7565 				ire->ire_dlureq_mp = mp;
7566 				mp->b_cont = NULL;
7567 				ire_delete(ire);
7568 				mp = saved_mp;
7569 				ire = NULL;
7570 				if (copy_mp != NULL) {
7571 					MULTIRT_DEBUG_UNTAG(copy_mp);
7572 					freemsg(copy_mp);
7573 					copy_mp = NULL;
7574 				}
7575 				break;
7576 			}
7577 		default:
7578 			break;
7579 		}
7580 	} while (multirt_resolve_next);
7581 
7582 	ip1dbg(("ip_newroute: dropped\n"));
7583 	/* Did this packet originate externally? */
7584 	if (mp->b_prev) {
7585 		mp->b_next = NULL;
7586 		mp->b_prev = NULL;
7587 		BUMP_MIB(&ip_mib, ipInDiscards);
7588 	} else {
7589 		BUMP_MIB(&ip_mib, ipOutDiscards);
7590 	}
7591 	ASSERT(copy_mp == NULL);
7592 	MULTIRT_DEBUG_UNTAG(first_mp);
7593 	freemsg(first_mp);
7594 	if (ire != NULL)
7595 		ire_refrele(ire);
7596 	if (sire != NULL)
7597 		ire_refrele(sire);
7598 	if (src_ipif != NULL)
7599 		ipif_refrele(src_ipif);
7600 	if (dst_ill != NULL)
7601 		ill_refrele(dst_ill);
7602 	return;
7603 
7604 icmp_err_ret:
7605 	ip1dbg(("ip_newroute: no route\n"));
7606 	if (src_ipif != NULL)
7607 		ipif_refrele(src_ipif);
7608 	if (dst_ill != NULL)
7609 		ill_refrele(dst_ill);
7610 	if (sire != NULL)
7611 		ire_refrele(sire);
7612 	/* Did this packet originate externally? */
7613 	if (mp->b_prev) {
7614 		mp->b_next = NULL;
7615 		mp->b_prev = NULL;
7616 		/* XXX ipInNoRoutes */
7617 		q = WR(q);
7618 	} else {
7619 		/*
7620 		 * Since ip_wput() isn't close to finished, we fill
7621 		 * in enough of the header for credible error reporting.
7622 		 */
7623 		if (ip_hdr_complete(ipha, zoneid)) {
7624 			/* Failed */
7625 			MULTIRT_DEBUG_UNTAG(first_mp);
7626 			freemsg(first_mp);
7627 			if (ire != NULL)
7628 				ire_refrele(ire);
7629 			return;
7630 		}
7631 	}
7632 	BUMP_MIB(&ip_mib, ipOutNoRoutes);
7633 
7634 	/*
7635 	 * At this point we will have ire only if RTF_BLACKHOLE
7636 	 * or RTF_REJECT flags are set on the IRE. It will not
7637 	 * generate ICMP_HOST_UNREACHABLE if RTF_BLACKHOLE is set.
7638 	 */
7639 	if (ire != NULL) {
7640 		if (ire->ire_flags & RTF_BLACKHOLE) {
7641 			ire_refrele(ire);
7642 			MULTIRT_DEBUG_UNTAG(first_mp);
7643 			freemsg(first_mp);
7644 			return;
7645 		}
7646 		ire_refrele(ire);
7647 	}
7648 	if (ip_source_routed(ipha)) {
7649 		icmp_unreachable(q, first_mp, ICMP_SOURCE_ROUTE_FAILED);
7650 		return;
7651 	}
7652 	icmp_unreachable(q, first_mp, ICMP_HOST_UNREACHABLE);
7653 }
7654 
7655 /*
7656  * IPv4 -
7657  * ip_newroute_ipif is called by ip_wput_multicast and
7658  * ip_rput_forward_multicast whenever we need to send
7659  * out a packet to a destination address for which we do not have specific
7660  * routing information. It is used when the packet will be sent out
7661  * on a specific interface. It is also called by ip_wput() when IP_XMIT_IF
7662  * socket option is set or icmp error message wants to go out on a particular
7663  * interface for a unicast packet.
7664  *
7665  * In most cases, the destination address is resolved thanks to the ipif
7666  * intrinsic resolver. However, there are some cases where the call to
7667  * ip_newroute_ipif must take into account the potential presence of
7668  * RTF_SETSRC and/or RTF_MULITRT flags in an IRE_OFFSUBNET ire
7669  * that uses the interface. This is specified through flags,
7670  * which can be a combination of:
7671  * - RTF_SETSRC: if an IRE_OFFSUBNET ire exists that has the RTF_SETSRC
7672  *   flag, the resulting ire will inherit the IRE_OFFSUBNET source address
7673  *   and flags. Additionally, the packet source address has to be set to
7674  *   the specified address. The caller is thus expected to set this flag
7675  *   if the packet has no specific source address yet.
7676  * - RTF_MULTIRT: if an IRE_OFFSUBNET ire exists that has the RTF_MULTIRT
7677  *   flag, the resulting ire will inherit the flag. All unresolved routes
7678  *   to the destination must be explored in the same call to
7679  *   ip_newroute_ipif().
7680  */
7681 static void
7682 ip_newroute_ipif(queue_t *q, mblk_t *mp, ipif_t *ipif, ipaddr_t dst,
7683     conn_t *connp, uint32_t flags)
7684 {
7685 	areq_t	*areq;
7686 	ire_t	*ire = NULL;
7687 	mblk_t	*res_mp;
7688 	ipaddr_t *addrp;
7689 	mblk_t *first_mp;
7690 	ire_t	*save_ire = NULL;
7691 	ill_t	*attach_ill = NULL;		/* Bind to IPIF_NOFAILOVER */
7692 	ipif_t	*src_ipif = NULL;
7693 	ushort_t ire_marks = 0;
7694 	ill_t	*dst_ill = NULL;
7695 	boolean_t mctl_present;
7696 	ipsec_out_t *io;
7697 	ipha_t *ipha;
7698 	int	ihandle = 0;
7699 	mblk_t	*saved_mp;
7700 	ire_t   *fire = NULL;
7701 	mblk_t  *copy_mp = NULL;
7702 	boolean_t multirt_resolve_next;
7703 	ipaddr_t ipha_dst;
7704 	zoneid_t zoneid = (connp != NULL ? connp->conn_zoneid : ALL_ZONES);
7705 
7706 	/*
7707 	 * CGTP goes in a loop which looks up a new ipif, do an ipif_refhold
7708 	 * here for uniformity
7709 	 */
7710 	ipif_refhold(ipif);
7711 
7712 	/*
7713 	 * This loop is run only once in most cases.
7714 	 * We loop to resolve further routes only when the destination
7715 	 * can be reached through multiple RTF_MULTIRT-flagged ires.
7716 	 */
7717 	do {
7718 		if (dst_ill != NULL) {
7719 			ill_refrele(dst_ill);
7720 			dst_ill = NULL;
7721 		}
7722 		if (src_ipif != NULL) {
7723 			ipif_refrele(src_ipif);
7724 			src_ipif = NULL;
7725 		}
7726 		multirt_resolve_next = B_FALSE;
7727 
7728 		ip1dbg(("ip_newroute_ipif: dst 0x%x, if %s\n", ntohl(dst),
7729 		    ipif->ipif_ill->ill_name));
7730 
7731 		EXTRACT_PKT_MP(mp, first_mp, mctl_present);
7732 		if (mctl_present)
7733 			io = (ipsec_out_t *)first_mp->b_rptr;
7734 
7735 		ipha = (ipha_t *)mp->b_rptr;
7736 
7737 		/*
7738 		 * Save the packet destination address, we may need it after
7739 		 * the packet has been consumed.
7740 		 */
7741 		ipha_dst = ipha->ipha_dst;
7742 
7743 		/*
7744 		 * If the interface is a pt-pt interface we look for an
7745 		 * IRE_IF_RESOLVER or IRE_IF_NORESOLVER that matches both the
7746 		 * local_address and the pt-pt destination address. Otherwise
7747 		 * we just match the local address.
7748 		 * NOTE: dst could be different than ipha->ipha_dst in case
7749 		 * of sending igmp multicast packets over a point-to-point
7750 		 * connection.
7751 		 * Thus we must be careful enough to check ipha_dst to be a
7752 		 * multicast address, otherwise it will take xmit_if path for
7753 		 * multicast packets resulting into kernel stack overflow by
7754 		 * repeated calls to ip_newroute_ipif from ire_send().
7755 		 */
7756 		if (CLASSD(ipha_dst) &&
7757 		    !(ipif->ipif_ill->ill_flags & ILLF_MULTICAST)) {
7758 			goto err_ret;
7759 		}
7760 
7761 		/*
7762 		 * We check if an IRE_OFFSUBNET for the addr that goes through
7763 		 * ipif exists. We need it to determine if the RTF_SETSRC and/or
7764 		 * RTF_MULTIRT flags must be honored. This IRE_OFFSUBNET ire may
7765 		 * propagate its flags to the new ire.
7766 		 */
7767 		if (CLASSD(ipha_dst) && (flags & (RTF_MULTIRT | RTF_SETSRC))) {
7768 			fire = ipif_lookup_multi_ire(ipif, ipha_dst);
7769 			ip2dbg(("ip_newroute_ipif: "
7770 			    "ipif_lookup_multi_ire("
7771 			    "ipif %p, dst %08x) = fire %p\n",
7772 			    (void *)ipif, ntohl(dst), (void *)fire));
7773 		}
7774 
7775 		if (mctl_present && io->ipsec_out_attach_if) {
7776 			attach_ill = ip_grab_attach_ill(NULL, first_mp,
7777 			    io->ipsec_out_ill_index, B_FALSE);
7778 
7779 			/* Failure case frees things for us. */
7780 			if (attach_ill == NULL) {
7781 				ipif_refrele(ipif);
7782 				if (fire != NULL)
7783 					ire_refrele(fire);
7784 				return;
7785 			}
7786 
7787 			/*
7788 			 * Check if we need an ire that will not be
7789 			 * looked up by anybody else i.e. HIDDEN.
7790 			 */
7791 			if (ill_is_probeonly(attach_ill)) {
7792 				ire_marks = IRE_MARK_HIDDEN;
7793 			}
7794 			/*
7795 			 * ip_wput passes the right ipif for IPIF_NOFAILOVER
7796 			 * case.
7797 			 */
7798 			dst_ill = ipif->ipif_ill;
7799 			/* attach_ill has been refheld by ip_grab_attach_ill */
7800 			ASSERT(dst_ill == attach_ill);
7801 		} else {
7802 			/*
7803 			 * If this is set by IP_XMIT_IF, then make sure that
7804 			 * ipif is pointing to the same ill as the IP_XMIT_IF
7805 			 * specified ill.
7806 			 */
7807 			ASSERT((connp == NULL) ||
7808 			    (connp->conn_xmit_if_ill == NULL) ||
7809 			    (connp->conn_xmit_if_ill == ipif->ipif_ill));
7810 			/*
7811 			 * If the interface belongs to an interface group,
7812 			 * make sure the next possible interface in the group
7813 			 * is used.  This encourages load spreading among
7814 			 * peers in an interface group.
7815 			 * Note: load spreading is disabled for RTF_MULTIRT
7816 			 * routes.
7817 			 */
7818 			if ((flags & RTF_MULTIRT) && (fire != NULL) &&
7819 			    (fire->ire_flags & RTF_MULTIRT)) {
7820 				/*
7821 				 * Don't perform outbound load spreading
7822 				 * in the case of an RTF_MULTIRT issued route,
7823 				 * we actually typically want to replicate
7824 				 * outgoing packets through particular
7825 				 * interfaces.
7826 				 */
7827 				dst_ill = ipif->ipif_ill;
7828 				ill_refhold(dst_ill);
7829 			} else {
7830 				dst_ill = ip_newroute_get_dst_ill(
7831 				    ipif->ipif_ill);
7832 			}
7833 			if (dst_ill == NULL) {
7834 				if (ip_debug > 2) {
7835 					pr_addr_dbg("ip_newroute_ipif: "
7836 					    "no dst ill for dst %s\n",
7837 					    AF_INET, &dst);
7838 				}
7839 				goto err_ret;
7840 			}
7841 		}
7842 
7843 		/*
7844 		 * Pick a source address preferring non-deprecated ones.
7845 		 * Unlike ip_newroute, we don't do any source address
7846 		 * selection here since for multicast it really does not help
7847 		 * in inbound load spreading as in the unicast case.
7848 		 */
7849 		if ((flags & RTF_SETSRC) && (fire != NULL) &&
7850 		    (fire->ire_flags & RTF_SETSRC)) {
7851 			/*
7852 			 * As requested by flags, an IRE_OFFSUBNET was looked up
7853 			 * on that interface. This ire has RTF_SETSRC flag, so
7854 			 * the source address of the packet must be changed.
7855 			 * Check that the ipif matching the requested source
7856 			 * address still exists.
7857 			 */
7858 			src_ipif = ipif_lookup_addr(fire->ire_src_addr, NULL,
7859 			    zoneid, NULL, NULL, NULL, NULL);
7860 		}
7861 		if (((ipif->ipif_flags & IPIF_DEPRECATED) ||
7862 		    (connp != NULL && ipif->ipif_zoneid != zoneid)) &&
7863 		    (src_ipif == NULL)) {
7864 			src_ipif = ipif_select_source(dst_ill, dst, zoneid);
7865 			if (src_ipif == NULL) {
7866 				if (ip_debug > 2) {
7867 					/* ip1dbg */
7868 					pr_addr_dbg("ip_newroute_ipif: "
7869 					    "no src for dst %s",
7870 					    AF_INET, &dst);
7871 				}
7872 				ip1dbg((" through interface %s\n",
7873 				    dst_ill->ill_name));
7874 				goto err_ret;
7875 			}
7876 			ipif_refrele(ipif);
7877 			ipif = src_ipif;
7878 			ipif_refhold(ipif);
7879 		}
7880 		if (src_ipif == NULL) {
7881 			src_ipif = ipif;
7882 			ipif_refhold(src_ipif);
7883 		}
7884 
7885 		/*
7886 		 * Assign a source address while we have the conn.
7887 		 * We can't have ip_wput_ire pick a source address when the
7888 		 * packet returns from arp since conn_unspec_src might be set
7889 		 * and we loose the conn when going through arp.
7890 		 */
7891 		if (ipha->ipha_src == INADDR_ANY &&
7892 		    (connp == NULL || !connp->conn_unspec_src)) {
7893 			ipha->ipha_src = src_ipif->ipif_src_addr;
7894 		}
7895 
7896 		/*
7897 		 * In case of IP_XMIT_IF, it is possible that the outgoing
7898 		 * interface does not have an interface ire.
7899 		 * Example: Thousands of mobileip PPP interfaces to mobile
7900 		 * nodes. We don't want to create interface ires because
7901 		 * packets from other mobile nodes must not take the route
7902 		 * via interface ires to the visiting mobile node without
7903 		 * going through the home agent, in absence of mobileip
7904 		 * route optimization.
7905 		 */
7906 		if (CLASSD(ipha_dst) && (connp == NULL ||
7907 		    connp->conn_xmit_if_ill == NULL)) {
7908 			/* ipif_to_ire returns an held ire */
7909 			ire = ipif_to_ire(ipif);
7910 			if (ire == NULL)
7911 				goto err_ret;
7912 			if (ire->ire_flags & (RTF_REJECT | RTF_BLACKHOLE))
7913 				goto err_ret;
7914 			/*
7915 			 * ihandle is needed when the ire is added to
7916 			 * cache table.
7917 			 */
7918 			save_ire = ire;
7919 			ihandle = save_ire->ire_ihandle;
7920 
7921 			ip2dbg(("ip_newroute_ipif: ire %p, ipif %p, "
7922 			    "flags %04x\n",
7923 			    (void *)ire, (void *)ipif, flags));
7924 			if ((flags & RTF_MULTIRT) && (fire != NULL) &&
7925 			    (fire->ire_flags & RTF_MULTIRT)) {
7926 				/*
7927 				 * As requested by flags, an IRE_OFFSUBNET was
7928 				 * looked up on that interface. This ire has
7929 				 * RTF_MULTIRT flag, so the resolution loop will
7930 				 * be re-entered to resolve additional routes on
7931 				 * other interfaces. For that purpose, a copy of
7932 				 * the packet is performed at this point.
7933 				 */
7934 				fire->ire_last_used_time = lbolt;
7935 				copy_mp = copymsg(first_mp);
7936 				if (copy_mp) {
7937 					MULTIRT_DEBUG_TAG(copy_mp);
7938 				}
7939 			}
7940 			if ((flags & RTF_SETSRC) && (fire != NULL) &&
7941 			    (fire->ire_flags & RTF_SETSRC)) {
7942 				/*
7943 				 * As requested by flags, an IRE_OFFSUBET was
7944 				 * looked up on that interface. This ire has
7945 				 * RTF_SETSRC flag, so the source address of the
7946 				 * packet must be changed.
7947 				 */
7948 				ipha->ipha_src = fire->ire_src_addr;
7949 			}
7950 		} else {
7951 			ASSERT((connp == NULL) ||
7952 			    (connp->conn_xmit_if_ill != NULL) ||
7953 			    (connp->conn_dontroute));
7954 			/*
7955 			 * The only ways we can come here are:
7956 			 * 1) IP_XMIT_IF socket option is set
7957 			 * 2) ICMP error message generated from
7958 			 *    ip_mrtun_forward() routine and it needs
7959 			 *    to go through the specified ill.
7960 			 * 3) SO_DONTROUTE socket option is set
7961 			 * In all cases, the new ire will not be added
7962 			 * into cache table.
7963 			 */
7964 			ire_marks |= IRE_MARK_NOADD;
7965 		}
7966 
7967 		switch (ipif->ipif_net_type) {
7968 		case IRE_IF_NORESOLVER: {
7969 			/* We have what we need to build an IRE_CACHE. */
7970 			mblk_t	*dlureq_mp;
7971 
7972 			/*
7973 			 * Create a new dlureq_mp with the
7974 			 * IP gateway address as destination address in the
7975 			 * DLPI hdr if the physical length is exactly 4 bytes.
7976 			 */
7977 			if (dst_ill->ill_phys_addr_length == IP_ADDR_LEN) {
7978 				dlureq_mp = ill_dlur_gen((uchar_t *)&dst,
7979 				    dst_ill->ill_phys_addr_length,
7980 				    dst_ill->ill_sap,
7981 				    dst_ill->ill_sap_length);
7982 			} else {
7983 				/* use the value set in ip_ll_subnet_defaults */
7984 				dlureq_mp = ill_dlur_gen(NULL,
7985 				    dst_ill->ill_phys_addr_length,
7986 				    dst_ill->ill_sap,
7987 				    dst_ill->ill_sap_length);
7988 			}
7989 
7990 			if (dlureq_mp == NULL)
7991 				break;
7992 			/*
7993 			 * The new ire inherits the IRE_OFFSUBNET flags
7994 			 * and source address, if this was requested.
7995 			 */
7996 			ire = ire_create(
7997 			    (uchar_t *)&dst,		/* dest address */
7998 			    (uchar_t *)&ip_g_all_ones,	/* mask */
7999 			    (uchar_t *)&src_ipif->ipif_src_addr, /* src addr */
8000 			    NULL,			/* gateway address */
8001 			    NULL,
8002 			    &ipif->ipif_mtu,
8003 			    NULL,			/* Fast Path header */
8004 			    dst_ill->ill_rq,		/* recv-from queue */
8005 			    dst_ill->ill_wq,		/* send-to queue */
8006 			    IRE_CACHE,
8007 			    dlureq_mp,
8008 			    src_ipif,
8009 			    NULL,
8010 			    (save_ire != NULL ? save_ire->ire_mask : 0),
8011 			    (fire != NULL) ?		/* Parent handle */
8012 				fire->ire_phandle : 0,
8013 			    ihandle,			/* Interface handle */
8014 			    (fire != NULL) ?
8015 				(fire->ire_flags &
8016 				(RTF_SETSRC | RTF_MULTIRT)) : 0,
8017 			    (save_ire == NULL ? &ire_uinfo_null :
8018 				&save_ire->ire_uinfo));
8019 
8020 			freeb(dlureq_mp);
8021 
8022 			if (ire == NULL) {
8023 				if (save_ire != NULL)
8024 					ire_refrele(save_ire);
8025 				break;
8026 			}
8027 
8028 			ire->ire_marks |= ire_marks;
8029 
8030 			/* Prevent save_ire from getting deleted */
8031 			if (save_ire != NULL) {
8032 				IRB_REFHOLD(save_ire->ire_bucket);
8033 				/* Has it been removed already ? */
8034 				if (save_ire->ire_marks & IRE_MARK_CONDEMNED) {
8035 					IRB_REFRELE(save_ire->ire_bucket);
8036 					ire_refrele(save_ire);
8037 					break;
8038 				}
8039 			}
8040 
8041 			ire_add_then_send(q, ire, first_mp);
8042 
8043 			/* Assert that save_ire is not deleted yet. */
8044 			if (save_ire != NULL) {
8045 				ASSERT(save_ire->ire_ptpn != NULL);
8046 				IRB_REFRELE(save_ire->ire_bucket);
8047 				ire_refrele(save_ire);
8048 				save_ire = NULL;
8049 			}
8050 			if (fire != NULL) {
8051 				ire_refrele(fire);
8052 				fire = NULL;
8053 			}
8054 
8055 			/*
8056 			 * the resolution loop is re-entered if this
8057 			 * was requested through flags and if we
8058 			 * actually are in a multirouting case.
8059 			 */
8060 			if ((flags & RTF_MULTIRT) && (copy_mp != NULL)) {
8061 				boolean_t need_resolve =
8062 				    ire_multirt_need_resolve(ipha_dst);
8063 				if (!need_resolve) {
8064 					MULTIRT_DEBUG_UNTAG(copy_mp);
8065 					freemsg(copy_mp);
8066 					copy_mp = NULL;
8067 				} else {
8068 					/*
8069 					 * ipif_lookup_group() calls
8070 					 * ire_lookup_multi() that uses
8071 					 * ire_ftable_lookup() to find
8072 					 * an IRE_INTERFACE for the group.
8073 					 * In the multirt case,
8074 					 * ire_lookup_multi() then invokes
8075 					 * ire_multirt_lookup() to find
8076 					 * the next resolvable ire.
8077 					 * As a result, we obtain an new
8078 					 * interface, derived from the
8079 					 * next ire.
8080 					 */
8081 					ipif_refrele(ipif);
8082 					ipif = ipif_lookup_group(ipha_dst,
8083 					    zoneid);
8084 					ip2dbg(("ip_newroute_ipif: "
8085 					    "multirt dst %08x, ipif %p\n",
8086 					    htonl(dst), (void *)ipif));
8087 					if (ipif != NULL) {
8088 						mp = copy_mp;
8089 						copy_mp = NULL;
8090 						multirt_resolve_next = B_TRUE;
8091 						continue;
8092 					} else {
8093 						freemsg(copy_mp);
8094 					}
8095 				}
8096 			}
8097 			if (ipif != NULL)
8098 				ipif_refrele(ipif);
8099 			ill_refrele(dst_ill);
8100 			ipif_refrele(src_ipif);
8101 			return;
8102 		}
8103 		case IRE_IF_RESOLVER:
8104 			/*
8105 			 * We can't build an IRE_CACHE yet, but at least
8106 			 * we found a resolver that can help.
8107 			 */
8108 			res_mp = dst_ill->ill_resolver_mp;
8109 			if (!OK_RESOLVER_MP(res_mp))
8110 				break;
8111 
8112 			/*
8113 			 * We obtain a partial IRE_CACHE which we will pass
8114 			 * along with the resolver query.  When the response
8115 			 * comes back it will be there ready for us to add.
8116 			 * The new ire inherits the IRE_OFFSUBNET flags
8117 			 * and source address, if this was requested.
8118 			 * The ire_max_frag is atomically set under the
8119 			 * irebucket lock in ire_add_v[46]. Only in the
8120 			 * case of IRE_MARK_NOADD, we set it here itself.
8121 			 */
8122 			ire = ire_create_mp(
8123 			    (uchar_t *)&dst,		/* dest address */
8124 			    (uchar_t *)&ip_g_all_ones,	/* mask */
8125 			    (uchar_t *)&src_ipif->ipif_src_addr, /* src addr */
8126 			    NULL,			/* gateway address */
8127 			    NULL,			/* no in_src_addr */
8128 			    (ire_marks & IRE_MARK_NOADD) ?
8129 				ipif->ipif_mtu : 0,	/* max_frag */
8130 			    NULL,			/* Fast path header */
8131 			    dst_ill->ill_rq,		/* recv-from queue */
8132 			    dst_ill->ill_wq,		/* send-to queue */
8133 			    IRE_CACHE,
8134 			    res_mp,
8135 			    src_ipif,
8136 			    NULL,
8137 			    (save_ire != NULL ? save_ire->ire_mask : 0),
8138 			    (fire != NULL) ?		/* Parent handle */
8139 				fire->ire_phandle : 0,
8140 			    ihandle,			/* Interface handle */
8141 			    (fire != NULL) ?		/* flags if any */
8142 				(fire->ire_flags &
8143 				(RTF_SETSRC | RTF_MULTIRT)) : 0,
8144 			    (save_ire == NULL ? &ire_uinfo_null :
8145 				&save_ire->ire_uinfo));
8146 
8147 			if (save_ire != NULL) {
8148 				ire_refrele(save_ire);
8149 				save_ire = NULL;
8150 			}
8151 			if (ire == NULL)
8152 				break;
8153 
8154 			ire->ire_marks |= ire_marks;
8155 			/*
8156 			 * Construct message chain for the resolver of the
8157 			 * form:
8158 			 *	ARP_REQ_MBLK-->IRE_MBLK-->Packet
8159 			 *
8160 			 * NOTE : ire will be added later when the response
8161 			 * comes back from ARP. If the response does not
8162 			 * come back, ARP frees the packet. For this reason,
8163 			 * we can't REFHOLD the bucket of save_ire to prevent
8164 			 * deletions. We may not be able to REFRELE the
8165 			 * bucket if the response never comes back.
8166 			 * Thus, before adding the ire, ire_add_v4 will make
8167 			 * sure that the interface route does not get deleted.
8168 			 * This is the only case unlike ip_newroute_v6,
8169 			 * ip_newroute_ipif_v6 where we can always prevent
8170 			 * deletions because ire_add_then_send is called after
8171 			 * creating the IRE.
8172 			 * If IRE_MARK_NOADD is set, then ire_add_then_send
8173 			 * does not add this IRE into the IRE CACHE.
8174 			 */
8175 			ASSERT(ire->ire_mp != NULL);
8176 			ire->ire_mp->b_cont = first_mp;
8177 			/* Have saved_mp handy, for cleanup if canput fails */
8178 			saved_mp = mp;
8179 			mp = ire->ire_dlureq_mp;
8180 			ASSERT(mp != NULL);
8181 			ire->ire_dlureq_mp = NULL;
8182 			linkb(mp, ire->ire_mp);
8183 
8184 			/*
8185 			 * Fill in the source and dest addrs for the resolver.
8186 			 * NOTE: this depends on memory layouts imposed by
8187 			 * ill_init().
8188 			 */
8189 			areq = (areq_t *)mp->b_rptr;
8190 			addrp = (ipaddr_t *)((char *)areq +
8191 			    areq->areq_sender_addr_offset);
8192 			*addrp = ire->ire_src_addr;
8193 			addrp = (ipaddr_t *)((char *)areq +
8194 			    areq->areq_target_addr_offset);
8195 			*addrp = dst;
8196 			/* Up to the resolver. */
8197 			if (canputnext(dst_ill->ill_rq)) {
8198 				putnext(dst_ill->ill_rq, mp);
8199 				/*
8200 				 * The response will come back in ip_wput
8201 				 * with db_type IRE_DB_TYPE.
8202 				 */
8203 			} else {
8204 				ire->ire_dlureq_mp = mp;
8205 				mp->b_cont = NULL;
8206 				ire_delete(ire);
8207 				saved_mp->b_next = NULL;
8208 				saved_mp->b_prev = NULL;
8209 				freemsg(first_mp);
8210 				ip2dbg(("ip_newroute_ipif: dropped\n"));
8211 			}
8212 
8213 			if (fire != NULL) {
8214 				ire_refrele(fire);
8215 				fire = NULL;
8216 			}
8217 
8218 
8219 			/*
8220 			 * The resolution loop is re-entered if this was
8221 			 * requested through flags and we actually are
8222 			 * in a multirouting case.
8223 			 */
8224 			if ((flags & RTF_MULTIRT) && (copy_mp != NULL)) {
8225 				boolean_t need_resolve =
8226 				    ire_multirt_need_resolve(ipha_dst);
8227 				if (!need_resolve) {
8228 					MULTIRT_DEBUG_UNTAG(copy_mp);
8229 					freemsg(copy_mp);
8230 					copy_mp = NULL;
8231 				} else {
8232 					/*
8233 					 * ipif_lookup_group() calls
8234 					 * ire_lookup_multi() that uses
8235 					 * ire_ftable_lookup() to find
8236 					 * an IRE_INTERFACE for the group.
8237 					 * In the multirt case,
8238 					 * ire_lookup_multi() then invokes
8239 					 * ire_multirt_lookup() to find
8240 					 * the next resolvable ire.
8241 					 * As a result, we obtain an new
8242 					 * interface, derived from the
8243 					 * next ire.
8244 					 */
8245 					ipif_refrele(ipif);
8246 					ipif = ipif_lookup_group(ipha_dst,
8247 					    zoneid);
8248 					if (ipif != NULL) {
8249 						mp = copy_mp;
8250 						copy_mp = NULL;
8251 						multirt_resolve_next = B_TRUE;
8252 						continue;
8253 					} else {
8254 						freemsg(copy_mp);
8255 					}
8256 				}
8257 			}
8258 			if (ipif != NULL)
8259 				ipif_refrele(ipif);
8260 			ill_refrele(dst_ill);
8261 			ipif_refrele(src_ipif);
8262 			return;
8263 		default:
8264 			break;
8265 		}
8266 	} while (multirt_resolve_next);
8267 
8268 err_ret:
8269 	ip2dbg(("ip_newroute_ipif: dropped\n"));
8270 	if (fire != NULL)
8271 		ire_refrele(fire);
8272 	ipif_refrele(ipif);
8273 	/* Did this packet originate externally? */
8274 	if (dst_ill != NULL)
8275 		ill_refrele(dst_ill);
8276 	if (src_ipif != NULL)
8277 		ipif_refrele(src_ipif);
8278 	if (mp->b_prev || mp->b_next) {
8279 		mp->b_next = NULL;
8280 		mp->b_prev = NULL;
8281 	} else {
8282 		/*
8283 		 * Since ip_wput() isn't close to finished, we fill
8284 		 * in enough of the header for credible error reporting.
8285 		 */
8286 		if (ip_hdr_complete((ipha_t *)mp->b_rptr, zoneid)) {
8287 			/* Failed */
8288 			freemsg(first_mp);
8289 			if (ire != NULL)
8290 				ire_refrele(ire);
8291 			return;
8292 		}
8293 	}
8294 	/*
8295 	 * At this point we will have ire only if RTF_BLACKHOLE
8296 	 * or RTF_REJECT flags are set on the IRE. It will not
8297 	 * generate ICMP_HOST_UNREACHABLE if RTF_BLACKHOLE is set.
8298 	 */
8299 	if (ire != NULL) {
8300 		if (ire->ire_flags & RTF_BLACKHOLE) {
8301 			ire_refrele(ire);
8302 			freemsg(first_mp);
8303 			return;
8304 		}
8305 		ire_refrele(ire);
8306 	}
8307 	icmp_unreachable(q, first_mp, ICMP_HOST_UNREACHABLE);
8308 }
8309 
8310 /* Name/Value Table Lookup Routine */
8311 char *
8312 ip_nv_lookup(nv_t *nv, int value)
8313 {
8314 	if (!nv)
8315 		return (NULL);
8316 	for (; nv->nv_name; nv++) {
8317 		if (nv->nv_value == value)
8318 			return (nv->nv_name);
8319 	}
8320 	return ("unknown");
8321 }
8322 
8323 /*
8324  * one day it can be patched to 1 from /etc/system for machines that have few
8325  * fast network interfaces feeding multiple cpus.
8326  */
8327 int ill_stream_putlocks = 0;
8328 
8329 /*
8330  * This is a module open, i.e. this is a control stream for access
8331  * to a DLPI device.  We allocate an ill_t as the instance data in
8332  * this case.
8333  */
8334 int
8335 ip_modopen(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp)
8336 {
8337 	uint32_t mem_cnt;
8338 	uint32_t cpu_cnt;
8339 	uint32_t min_cnt;
8340 	pgcnt_t mem_avail;
8341 	extern uint32_t ip_cache_table_size, ip6_cache_table_size;
8342 	ill_t	*ill;
8343 	int	err;
8344 
8345 	/*
8346 	 * Prevent unprivileged processes from pushing IP so that
8347 	 * they can't send raw IP.
8348 	 */
8349 	if (secpolicy_net_rawaccess(credp) != 0)
8350 		return (EPERM);
8351 
8352 	ill = (ill_t *)mi_open_alloc_sleep(sizeof (ill_t));
8353 	q->q_ptr = WR(q)->q_ptr = ill;
8354 
8355 	/*
8356 	 * ill_init initializes the ill fields and then sends down
8357 	 * down a DL_INFO_REQ after calling qprocson.
8358 	 */
8359 	err = ill_init(q, ill);
8360 	if (err != 0) {
8361 		mi_free(ill);
8362 		q->q_ptr = NULL;
8363 		WR(q)->q_ptr = NULL;
8364 		return (err);
8365 	}
8366 
8367 	/* ill_init initializes the ipsq marking this thread as writer */
8368 	ipsq_exit(ill->ill_phyint->phyint_ipsq, B_TRUE, B_TRUE);
8369 	/* Wait for the DL_INFO_ACK */
8370 	mutex_enter(&ill->ill_lock);
8371 	while (ill->ill_state_flags & ILL_LL_SUBNET_PENDING) {
8372 		/*
8373 		 * Return value of 0 indicates a pending signal.
8374 		 */
8375 		err = cv_wait_sig(&ill->ill_cv, &ill->ill_lock);
8376 		if (err == 0) {
8377 			mutex_exit(&ill->ill_lock);
8378 			(void) ip_close(q, 0);
8379 			return (EINTR);
8380 		}
8381 	}
8382 	mutex_exit(&ill->ill_lock);
8383 
8384 	/*
8385 	 * ip_rput_other could have set an error  in ill_error on
8386 	 * receipt of M_ERROR.
8387 	 */
8388 
8389 	err = ill->ill_error;
8390 	if (err != 0) {
8391 		(void) ip_close(q, 0);
8392 		return (err);
8393 	}
8394 
8395 	/*
8396 	 * ip_ire_max_bucket_cnt is sized below based on the memory
8397 	 * size and the cpu speed of the machine. This is upper
8398 	 * bounded by the compile time value of ip_ire_max_bucket_cnt
8399 	 * and is lower bounded by the compile time value of
8400 	 * ip_ire_min_bucket_cnt.  Similar logic applies to
8401 	 * ip6_ire_max_bucket_cnt.
8402 	 */
8403 	mem_avail = kmem_avail();
8404 	mem_cnt = (mem_avail >> ip_ire_mem_ratio) /
8405 	    ip_cache_table_size / sizeof (ire_t);
8406 	cpu_cnt = CPU->cpu_type_info.pi_clock >> ip_ire_cpu_ratio;
8407 
8408 	min_cnt = MIN(cpu_cnt, mem_cnt);
8409 	if (min_cnt < ip_ire_min_bucket_cnt)
8410 		min_cnt = ip_ire_min_bucket_cnt;
8411 	if (ip_ire_max_bucket_cnt > min_cnt) {
8412 		ip_ire_max_bucket_cnt = min_cnt;
8413 	}
8414 
8415 	mem_cnt = (mem_avail >> ip_ire_mem_ratio) /
8416 	    ip6_cache_table_size / sizeof (ire_t);
8417 	min_cnt = MIN(cpu_cnt, mem_cnt);
8418 	if (min_cnt < ip6_ire_min_bucket_cnt)
8419 		min_cnt = ip6_ire_min_bucket_cnt;
8420 	if (ip6_ire_max_bucket_cnt > min_cnt) {
8421 		ip6_ire_max_bucket_cnt = min_cnt;
8422 	}
8423 
8424 	ill->ill_credp = credp;
8425 	crhold(credp);
8426 
8427 	mutex_enter(&ip_mi_lock);
8428 	err = mi_open_link(&ip_g_head, (IDP)ill, devp, flag, sflag, credp);
8429 	mutex_exit(&ip_mi_lock);
8430 	if (err) {
8431 		(void) ip_close(q, 0);
8432 		return (err);
8433 	}
8434 	return (0);
8435 }
8436 
8437 /* IP open routine. */
8438 int
8439 ip_open(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp)
8440 {
8441 	conn_t 		*connp;
8442 	major_t		maj;
8443 
8444 	TRACE_1(TR_FAC_IP, TR_IP_OPEN, "ip_open: q %p", q);
8445 
8446 	/* Allow reopen. */
8447 	if (q->q_ptr != NULL)
8448 		return (0);
8449 
8450 	if (sflag & MODOPEN) {
8451 		/* This is a module open */
8452 		return (ip_modopen(q, devp, flag, sflag, credp));
8453 	}
8454 
8455 
8456 	/*
8457 	 * We are opening as a device. This is an IP client stream, and we
8458 	 * allocate an conn_t as the instance data.
8459 	 */
8460 	connp = ipcl_conn_create(IPCL_IPCCONN, KM_SLEEP);
8461 	connp->conn_upq = q;
8462 	q->q_ptr = WR(q)->q_ptr = connp;
8463 
8464 	/* Minor tells us which /dev entry was opened */
8465 	if (geteminor(*devp) == IPV6_MINOR) {
8466 		connp->conn_flags |= IPCL_ISV6;
8467 		connp->conn_af_isv6 = B_TRUE;
8468 		ip_setqinfo(q, geteminor(*devp), B_FALSE);
8469 		connp->conn_src_preferences = IPV6_PREFER_SRC_DEFAULT;
8470 	} else {
8471 		connp->conn_af_isv6 = B_FALSE;
8472 		connp->conn_pkt_isv6 = B_FALSE;
8473 	}
8474 
8475 
8476 	if ((connp->conn_dev =
8477 	    inet_minor_alloc(ip_minor_arena)) == 0) {
8478 		q->q_ptr = WR(q)->q_ptr = NULL;
8479 		CONN_DEC_REF(connp);
8480 		return (EBUSY);
8481 	}
8482 
8483 	maj = getemajor(*devp);
8484 	*devp = makedevice(maj, (minor_t)connp->conn_dev);
8485 
8486 	/*
8487 	 * connp->conn_cred is crfree()ed in ip_close().
8488 	 */
8489 	connp->conn_cred = credp;
8490 	crhold(connp->conn_cred);
8491 
8492 	connp->conn_zoneid = getzoneid();
8493 
8494 	/*
8495 	 * This should only happen for ndd, netstat, raw socket or other SCTP
8496 	 * administrative ops.  In these cases, we just need a normal conn_t
8497 	 * with ulp set to IPPROTO_SCTP.  All other ops are trapped and
8498 	 * an error will be returned.
8499 	 */
8500 	if (maj != SCTP_MAJ && maj != SCTP6_MAJ) {
8501 		connp->conn_rq = q;
8502 		connp->conn_wq = WR(q);
8503 	} else {
8504 		connp->conn_ulp = IPPROTO_SCTP;
8505 		connp->conn_rq = connp->conn_wq = NULL;
8506 	}
8507 	/* Non-zero default values */
8508 	connp->conn_multicast_loop = IP_DEFAULT_MULTICAST_LOOP;
8509 
8510 	/*
8511 	 * Make the conn globally visible to walkers
8512 	 */
8513 	mutex_enter(&connp->conn_lock);
8514 	connp->conn_state_flags &= ~CONN_INCIPIENT;
8515 	mutex_exit(&connp->conn_lock);
8516 	ASSERT(connp->conn_ref == 1);
8517 
8518 	qprocson(q);
8519 
8520 	return (0);
8521 }
8522 
8523 /*
8524  * Change q_qinfo based on the value of isv6.
8525  * This can not called on an ill queue.
8526  * Note that there is no race since either q_qinfo works for conn queues - it
8527  * is just an optimization to enter the best wput routine directly.
8528  */
8529 void
8530 ip_setqinfo(queue_t *q, minor_t minor, boolean_t bump_mib)
8531 {
8532 	ASSERT(q->q_flag & QREADR);
8533 	ASSERT(WR(q)->q_next == NULL);
8534 	ASSERT(q->q_ptr != NULL);
8535 
8536 	if (minor == IPV6_MINOR)  {
8537 		if (bump_mib)
8538 			BUMP_MIB(&ip6_mib, ipv6OutSwitchIPv4);
8539 		q->q_qinfo = &rinit_ipv6;
8540 		WR(q)->q_qinfo = &winit_ipv6;
8541 		(Q_TO_CONN(q))->conn_pkt_isv6 = B_TRUE;
8542 	} else {
8543 		if (bump_mib)
8544 			BUMP_MIB(&ip_mib, ipOutSwitchIPv6);
8545 		q->q_qinfo = &rinit;
8546 		WR(q)->q_qinfo = &winit;
8547 		(Q_TO_CONN(q))->conn_pkt_isv6 = B_FALSE;
8548 	}
8549 
8550 }
8551 
8552 /*
8553  * See if IPsec needs loading because of the options in mp.
8554  */
8555 static boolean_t
8556 ipsec_opt_present(mblk_t *mp)
8557 {
8558 	uint8_t *optcp, *next_optcp, *opt_endcp;
8559 	struct opthdr *opt;
8560 	struct T_opthdr *topt;
8561 	int opthdr_len;
8562 	t_uscalar_t optname, optlevel;
8563 	struct T_optmgmt_req *tor = (struct T_optmgmt_req *)mp->b_rptr;
8564 	ipsec_req_t *ipsr;
8565 
8566 	/*
8567 	 * Walk through the mess, and find IP_SEC_OPT.  If it's there,
8568 	 * return TRUE.
8569 	 */
8570 
8571 	optcp = mi_offset_param(mp, tor->OPT_offset, tor->OPT_length);
8572 	opt_endcp = optcp + tor->OPT_length;
8573 	if (tor->PRIM_type == T_OPTMGMT_REQ) {
8574 		opthdr_len = sizeof (struct T_opthdr);
8575 	} else {		/* O_OPTMGMT_REQ */
8576 		ASSERT(tor->PRIM_type == T_SVR4_OPTMGMT_REQ);
8577 		opthdr_len = sizeof (struct opthdr);
8578 	}
8579 	for (; optcp < opt_endcp; optcp = next_optcp) {
8580 		if (optcp + opthdr_len > opt_endcp)
8581 			return (B_FALSE);	/* Not enough option header. */
8582 		if (tor->PRIM_type == T_OPTMGMT_REQ) {
8583 			topt = (struct T_opthdr *)optcp;
8584 			optlevel = topt->level;
8585 			optname = topt->name;
8586 			next_optcp = optcp + _TPI_ALIGN_TOPT(topt->len);
8587 		} else {
8588 			opt = (struct opthdr *)optcp;
8589 			optlevel = opt->level;
8590 			optname = opt->name;
8591 			next_optcp = optcp + opthdr_len +
8592 			    _TPI_ALIGN_OPT(opt->len);
8593 		}
8594 		if ((next_optcp < optcp) || /* wraparound pointer space */
8595 		    ((next_optcp >= opt_endcp) && /* last option bad len */
8596 		    ((next_optcp - opt_endcp) >= __TPI_ALIGN_SIZE)))
8597 			return (B_FALSE); /* bad option buffer */
8598 		if ((optlevel == IPPROTO_IP && optname == IP_SEC_OPT) ||
8599 		    (optlevel == IPPROTO_IPV6 && optname == IPV6_SEC_OPT)) {
8600 			/*
8601 			 * Check to see if it's an all-bypass or all-zeroes
8602 			 * IPsec request.  Don't bother loading IPsec if
8603 			 * the socket doesn't want to use it.  (A good example
8604 			 * is a bypass request.)
8605 			 *
8606 			 * Basically, if any of the non-NEVER bits are set,
8607 			 * load IPsec.
8608 			 */
8609 			ipsr = (ipsec_req_t *)(optcp + opthdr_len);
8610 			if ((ipsr->ipsr_ah_req & ~IPSEC_PREF_NEVER) != 0 ||
8611 			    (ipsr->ipsr_esp_req & ~IPSEC_PREF_NEVER) != 0 ||
8612 			    (ipsr->ipsr_self_encap_req & ~IPSEC_PREF_NEVER)
8613 			    != 0)
8614 				return (B_TRUE);
8615 		}
8616 	}
8617 	return (B_FALSE);
8618 }
8619 
8620 /*
8621  * If conn is is waiting for ipsec to finish loading, kick it.
8622  */
8623 /* ARGSUSED */
8624 static void
8625 conn_restart_ipsec_waiter(conn_t *connp, void *arg)
8626 {
8627 	t_scalar_t	optreq_prim;
8628 	mblk_t		*mp;
8629 	cred_t		*cr;
8630 	int		err = 0;
8631 
8632 	/*
8633 	 * This function is called, after ipsec loading is complete.
8634 	 * Since IP checks exclusively and atomically (i.e it prevents
8635 	 * ipsec load from completing until ip_optcom_req completes)
8636 	 * whether ipsec load is complete, there cannot be a race with IP
8637 	 * trying to set the CONN_IPSEC_LOAD_WAIT flag on any conn now.
8638 	 */
8639 	mutex_enter(&connp->conn_lock);
8640 	if (connp->conn_state_flags & CONN_IPSEC_LOAD_WAIT) {
8641 		ASSERT(connp->conn_ipsec_opt_mp != NULL);
8642 		mp = connp->conn_ipsec_opt_mp;
8643 		connp->conn_ipsec_opt_mp = NULL;
8644 		connp->conn_state_flags  &= ~CONN_IPSEC_LOAD_WAIT;
8645 		cr = DB_CREDDEF(mp, GET_QUEUE_CRED(CONNP_TO_WQ(connp)));
8646 		mutex_exit(&connp->conn_lock);
8647 
8648 		ASSERT(DB_TYPE(mp) == M_PROTO || DB_TYPE(mp) == M_PCPROTO);
8649 
8650 		optreq_prim = ((union T_primitives *)mp->b_rptr)->type;
8651 		if (optreq_prim == T_OPTMGMT_REQ) {
8652 			err = tpi_optcom_req(CONNP_TO_WQ(connp), mp, cr,
8653 			    &ip_opt_obj);
8654 		} else {
8655 			ASSERT(optreq_prim == T_SVR4_OPTMGMT_REQ);
8656 			err = svr4_optcom_req(CONNP_TO_WQ(connp), mp, cr,
8657 			    &ip_opt_obj);
8658 		}
8659 		if (err != EINPROGRESS)
8660 			CONN_OPER_PENDING_DONE(connp);
8661 		return;
8662 	}
8663 	mutex_exit(&connp->conn_lock);
8664 }
8665 
8666 /*
8667  * Called from the ipsec_loader thread, outside any perimeter, to tell
8668  * ip qenable any of the queues waiting for the ipsec loader to
8669  * complete.
8670  *
8671  * Use ip_mi_lock to be safe here: all modifications of the mi lists
8672  * are done with this lock held, so it's guaranteed that none of the
8673  * links will change along the way.
8674  */
8675 void
8676 ip_ipsec_load_complete()
8677 {
8678 	ipcl_walk(conn_restart_ipsec_waiter, NULL);
8679 }
8680 
8681 /*
8682  * Can't be used. Need to call svr4* -> optset directly. the leaf routine
8683  * determines the grp on which it has to become exclusive, queues the mp
8684  * and sq draining restarts the optmgmt
8685  */
8686 static boolean_t
8687 ip_check_for_ipsec_opt(queue_t *q, mblk_t *mp)
8688 {
8689 	conn_t *connp;
8690 
8691 	/*
8692 	 * Take IPsec requests and treat them special.
8693 	 */
8694 	if (ipsec_opt_present(mp)) {
8695 		/* First check if IPsec is loaded. */
8696 		mutex_enter(&ipsec_loader_lock);
8697 		if (ipsec_loader_state != IPSEC_LOADER_WAIT) {
8698 			mutex_exit(&ipsec_loader_lock);
8699 			return (B_FALSE);
8700 		}
8701 		connp = Q_TO_CONN(q);
8702 		mutex_enter(&connp->conn_lock);
8703 		connp->conn_state_flags |= CONN_IPSEC_LOAD_WAIT;
8704 
8705 		ASSERT(connp->conn_ipsec_opt_mp == NULL);
8706 		connp->conn_ipsec_opt_mp = mp;
8707 		mutex_exit(&connp->conn_lock);
8708 		mutex_exit(&ipsec_loader_lock);
8709 
8710 		ipsec_loader_loadnow();
8711 		return (B_TRUE);
8712 	}
8713 	return (B_FALSE);
8714 }
8715 
8716 /*
8717  * Set IPsec policy from an ipsec_req_t. If the req is not "zero" and valid,
8718  * all of them are copied to the conn_t. If the req is "zero", the policy is
8719  * zeroed out. A "zero" policy has zero ipsr_{ah,req,self_encap}_req
8720  * fields.
8721  * We keep only the latest setting of the policy and thus policy setting
8722  * is not incremental/cumulative.
8723  *
8724  * Requests to set policies with multiple alternative actions will
8725  * go through a different API.
8726  */
8727 int
8728 ipsec_set_req(cred_t *cr, conn_t *connp, ipsec_req_t *req)
8729 {
8730 	uint_t ah_req = 0;
8731 	uint_t esp_req = 0;
8732 	uint_t se_req = 0;
8733 	ipsec_selkey_t sel;
8734 	ipsec_act_t *actp = NULL;
8735 	uint_t nact;
8736 	ipsec_policy_t *pin4 = NULL, *pout4 = NULL;
8737 	ipsec_policy_t *pin6 = NULL, *pout6 = NULL;
8738 	ipsec_policy_root_t *pr;
8739 	ipsec_policy_head_t *ph;
8740 	int fam;
8741 	boolean_t is_pol_reset;
8742 	int error = 0;
8743 
8744 #define	REQ_MASK (IPSEC_PREF_REQUIRED|IPSEC_PREF_NEVER)
8745 
8746 	/*
8747 	 * The IP_SEC_OPT option does not allow variable length parameters,
8748 	 * hence a request cannot be NULL.
8749 	 */
8750 	if (req == NULL)
8751 		return (EINVAL);
8752 
8753 	ah_req = req->ipsr_ah_req;
8754 	esp_req = req->ipsr_esp_req;
8755 	se_req = req->ipsr_self_encap_req;
8756 
8757 	/*
8758 	 * Are we dealing with a request to reset the policy (i.e.
8759 	 * zero requests).
8760 	 */
8761 	is_pol_reset = ((ah_req & REQ_MASK) == 0 &&
8762 	    (esp_req & REQ_MASK) == 0 &&
8763 	    (se_req & REQ_MASK) == 0);
8764 
8765 	if (!is_pol_reset) {
8766 		/*
8767 		 * If we couldn't load IPsec, fail with "protocol
8768 		 * not supported".
8769 		 * IPsec may not have been loaded for a request with zero
8770 		 * policies, so we don't fail in this case.
8771 		 */
8772 		mutex_enter(&ipsec_loader_lock);
8773 		if (ipsec_loader_state != IPSEC_LOADER_SUCCEEDED) {
8774 			mutex_exit(&ipsec_loader_lock);
8775 			return (EPROTONOSUPPORT);
8776 		}
8777 		mutex_exit(&ipsec_loader_lock);
8778 
8779 		/*
8780 		 * Test for valid requests. Invalid algorithms
8781 		 * need to be tested by IPSEC code because new
8782 		 * algorithms can be added dynamically.
8783 		 */
8784 		if ((ah_req & ~(REQ_MASK|IPSEC_PREF_UNIQUE)) != 0 ||
8785 		    (esp_req & ~(REQ_MASK|IPSEC_PREF_UNIQUE)) != 0 ||
8786 		    (se_req & ~(REQ_MASK|IPSEC_PREF_UNIQUE)) != 0) {
8787 			return (EINVAL);
8788 		}
8789 
8790 		/*
8791 		 * Only privileged users can issue these
8792 		 * requests.
8793 		 */
8794 		if (((ah_req & IPSEC_PREF_NEVER) ||
8795 		    (esp_req & IPSEC_PREF_NEVER) ||
8796 		    (se_req & IPSEC_PREF_NEVER)) &&
8797 		    secpolicy_net_config(cr, B_FALSE) != 0) {
8798 			return (EPERM);
8799 		}
8800 
8801 		/*
8802 		 * The IPSEC_PREF_REQUIRED and IPSEC_PREF_NEVER
8803 		 * are mutually exclusive.
8804 		 */
8805 		if (((ah_req & REQ_MASK) == REQ_MASK) ||
8806 		    ((esp_req & REQ_MASK) == REQ_MASK) ||
8807 		    ((se_req & REQ_MASK) == REQ_MASK)) {
8808 			/* Both of them are set */
8809 			return (EINVAL);
8810 		}
8811 	}
8812 
8813 	mutex_enter(&connp->conn_lock);
8814 
8815 	/*
8816 	 * If we have already cached policies in ip_bind_connected*(), don't
8817 	 * let them change now. We cache policies for connections
8818 	 * whose src,dst [addr, port] is known.  The exception to this is
8819 	 * tunnels.  Tunnels are allowed to change policies after having
8820 	 * become fully bound.
8821 	 */
8822 	if (connp->conn_policy_cached && !IPCL_IS_IPTUN(connp)) {
8823 		mutex_exit(&connp->conn_lock);
8824 		return (EINVAL);
8825 	}
8826 
8827 	/*
8828 	 * We have a zero policies, reset the connection policy if already
8829 	 * set. This will cause the connection to inherit the
8830 	 * global policy, if any.
8831 	 */
8832 	if (is_pol_reset) {
8833 		if (connp->conn_policy != NULL) {
8834 			IPPH_REFRELE(connp->conn_policy);
8835 			connp->conn_policy = NULL;
8836 		}
8837 		connp->conn_flags &= ~IPCL_CHECK_POLICY;
8838 		connp->conn_in_enforce_policy = B_FALSE;
8839 		connp->conn_out_enforce_policy = B_FALSE;
8840 		mutex_exit(&connp->conn_lock);
8841 		return (0);
8842 	}
8843 
8844 	ph = connp->conn_policy = ipsec_polhead_split(connp->conn_policy);
8845 	if (ph == NULL)
8846 		goto enomem;
8847 
8848 	ipsec_actvec_from_req(req, &actp, &nact);
8849 	if (actp == NULL)
8850 		goto enomem;
8851 
8852 	/*
8853 	 * Always allocate IPv4 policy entries, since they can also
8854 	 * apply to ipv6 sockets being used in ipv4-compat mode.
8855 	 */
8856 	bzero(&sel, sizeof (sel));
8857 	sel.ipsl_valid = IPSL_IPV4;
8858 
8859 	pin4 = ipsec_policy_create(&sel, actp, nact, IPSEC_PRIO_SOCKET);
8860 	if (pin4 == NULL)
8861 		goto enomem;
8862 
8863 	pout4 = ipsec_policy_create(&sel, actp, nact, IPSEC_PRIO_SOCKET);
8864 	if (pout4 == NULL)
8865 		goto enomem;
8866 
8867 	if (connp->conn_pkt_isv6) {
8868 		/*
8869 		 * We're looking at a v6 socket, also allocate the
8870 		 * v6-specific entries...
8871 		 */
8872 		sel.ipsl_valid = IPSL_IPV6;
8873 		pin6 = ipsec_policy_create(&sel, actp, nact,
8874 		    IPSEC_PRIO_SOCKET);
8875 		if (pin6 == NULL)
8876 			goto enomem;
8877 
8878 		pout6 = ipsec_policy_create(&sel, actp, nact,
8879 		    IPSEC_PRIO_SOCKET);
8880 		if (pout6 == NULL)
8881 			goto enomem;
8882 
8883 		/*
8884 		 * .. and file them away in the right place.
8885 		 */
8886 		fam = IPSEC_AF_V6;
8887 		pr = &ph->iph_root[IPSEC_TYPE_INBOUND];
8888 		HASHLIST_INSERT(pin6, ipsp_hash, pr->ipr_nonhash[fam]);
8889 		ipsec_insert_always(&ph->iph_rulebyid, pin6);
8890 		pr = &ph->iph_root[IPSEC_TYPE_OUTBOUND];
8891 		HASHLIST_INSERT(pout6, ipsp_hash, pr->ipr_nonhash[fam]);
8892 		ipsec_insert_always(&ph->iph_rulebyid, pout6);
8893 	}
8894 
8895 	ipsec_actvec_free(actp, nact);
8896 
8897 	/*
8898 	 * File the v4 policies.
8899 	 */
8900 	fam = IPSEC_AF_V4;
8901 	pr = &ph->iph_root[IPSEC_TYPE_INBOUND];
8902 	HASHLIST_INSERT(pin4, ipsp_hash, pr->ipr_nonhash[fam]);
8903 	ipsec_insert_always(&ph->iph_rulebyid, pin4);
8904 
8905 	pr = &ph->iph_root[IPSEC_TYPE_OUTBOUND];
8906 	HASHLIST_INSERT(pout4, ipsp_hash, pr->ipr_nonhash[fam]);
8907 	ipsec_insert_always(&ph->iph_rulebyid, pout4);
8908 
8909 	/*
8910 	 * If the requests need security, set enforce_policy.
8911 	 * If the requests are IPSEC_PREF_NEVER, one should
8912 	 * still set conn_out_enforce_policy so that an ipsec_out
8913 	 * gets attached in ip_wput. This is needed so that
8914 	 * for connections that we don't cache policy in ip_bind,
8915 	 * if global policy matches in ip_wput_attach_policy, we
8916 	 * don't wrongly inherit global policy. Similarly, we need
8917 	 * to set conn_in_enforce_policy also so that we don't verify
8918 	 * policy wrongly.
8919 	 */
8920 	if ((ah_req & REQ_MASK) != 0 ||
8921 	    (esp_req & REQ_MASK) != 0 ||
8922 	    (se_req & REQ_MASK) != 0) {
8923 		connp->conn_in_enforce_policy = B_TRUE;
8924 		connp->conn_out_enforce_policy = B_TRUE;
8925 		connp->conn_flags |= IPCL_CHECK_POLICY;
8926 	}
8927 
8928 	/*
8929 	 * Tunnels are allowed to set policy after having been fully bound.
8930 	 * If that's the case, cache policy here.
8931 	 */
8932 	if (IPCL_IS_IPTUN(connp) && connp->conn_fully_bound)
8933 		error = ipsec_conn_cache_policy(connp, !connp->conn_af_isv6);
8934 
8935 	mutex_exit(&connp->conn_lock);
8936 	return (error);
8937 #undef REQ_MASK
8938 
8939 	/*
8940 	 * Common memory-allocation-failure exit path.
8941 	 */
8942 enomem:
8943 	mutex_exit(&connp->conn_lock);
8944 	if (actp != NULL)
8945 		ipsec_actvec_free(actp, nact);
8946 	if (pin4 != NULL)
8947 		IPPOL_REFRELE(pin4);
8948 	if (pout4 != NULL)
8949 		IPPOL_REFRELE(pout4);
8950 	if (pin6 != NULL)
8951 		IPPOL_REFRELE(pin6);
8952 	if (pout6 != NULL)
8953 		IPPOL_REFRELE(pout6);
8954 	return (ENOMEM);
8955 }
8956 
8957 /*
8958  * Only for options that pass in an IP addr. Currently only V4 options
8959  * pass in an ipif. V6 options always pass an ifindex specifying the ill.
8960  * So this function assumes level is IPPROTO_IP
8961  */
8962 int
8963 ip_opt_set_ipif(conn_t *connp, ipaddr_t addr, boolean_t checkonly, int option,
8964     mblk_t *first_mp)
8965 {
8966 	ipif_t *ipif = NULL;
8967 	int error;
8968 	ill_t *ill;
8969 
8970 	ip2dbg(("ip_opt_set_ipif: ipaddr %X\n", addr));
8971 
8972 	if (addr != INADDR_ANY || checkonly) {
8973 		ASSERT(connp != NULL);
8974 		ipif = ipif_lookup_addr(addr, NULL, connp->conn_zoneid,
8975 		    CONNP_TO_WQ(connp), first_mp, ip_restart_optmgmt, &error);
8976 		if (ipif == NULL) {
8977 			if (error == EINPROGRESS)
8978 				return (error);
8979 			else if (option == IP_MULTICAST_IF)
8980 				return (EHOSTUNREACH);
8981 			else
8982 				return (EINVAL);
8983 		} else if (checkonly) {
8984 			if (option == IP_MULTICAST_IF) {
8985 				ill = ipif->ipif_ill;
8986 				/* not supported by the virtual network iface */
8987 				if (IS_VNI(ill)) {
8988 					ipif_refrele(ipif);
8989 					return (EINVAL);
8990 				}
8991 			}
8992 			ipif_refrele(ipif);
8993 			return (0);
8994 		}
8995 		ill = ipif->ipif_ill;
8996 		mutex_enter(&connp->conn_lock);
8997 		mutex_enter(&ill->ill_lock);
8998 		if ((ill->ill_state_flags & ILL_CONDEMNED) ||
8999 		    (ipif->ipif_state_flags & IPIF_CONDEMNED)) {
9000 			mutex_exit(&ill->ill_lock);
9001 			mutex_exit(&connp->conn_lock);
9002 			ipif_refrele(ipif);
9003 			return (option == IP_MULTICAST_IF ?
9004 			    EHOSTUNREACH : EINVAL);
9005 		}
9006 	} else {
9007 		mutex_enter(&connp->conn_lock);
9008 	}
9009 
9010 	/* None of the options below are supported on the VNI */
9011 	if (ipif != NULL && IS_VNI(ipif->ipif_ill)) {
9012 		mutex_exit(&ill->ill_lock);
9013 		mutex_exit(&connp->conn_lock);
9014 		ipif_refrele(ipif);
9015 		return (EINVAL);
9016 	}
9017 
9018 	switch (option) {
9019 	case IP_DONTFAILOVER_IF:
9020 		/*
9021 		 * This option is used by in.mpathd to ensure
9022 		 * that IPMP probe packets only go out on the
9023 		 * test interfaces. in.mpathd sets this option
9024 		 * on the non-failover interfaces.
9025 		 * For backward compatibility, this option
9026 		 * implicitly sets IP_MULTICAST_IF, as used
9027 		 * be done in bind(), so that ip_wput gets
9028 		 * this ipif to send mcast packets.
9029 		 */
9030 		if (ipif != NULL) {
9031 			ASSERT(addr != INADDR_ANY);
9032 			connp->conn_nofailover_ill = ipif->ipif_ill;
9033 			connp->conn_multicast_ipif = ipif;
9034 		} else {
9035 			ASSERT(addr == INADDR_ANY);
9036 			connp->conn_nofailover_ill = NULL;
9037 			connp->conn_multicast_ipif = NULL;
9038 		}
9039 		break;
9040 
9041 	case IP_MULTICAST_IF:
9042 		connp->conn_multicast_ipif = ipif;
9043 		break;
9044 	}
9045 
9046 	if (ipif != NULL) {
9047 		mutex_exit(&ill->ill_lock);
9048 		mutex_exit(&connp->conn_lock);
9049 		ipif_refrele(ipif);
9050 		return (0);
9051 	}
9052 	mutex_exit(&connp->conn_lock);
9053 	/* We succeded in cleared the option */
9054 	return (0);
9055 }
9056 
9057 /*
9058  * For options that pass in an ifindex specifying the ill. V6 options always
9059  * pass in an ill. Some v4 options also pass in ifindex specifying the ill.
9060  */
9061 int
9062 ip_opt_set_ill(conn_t *connp, int ifindex, boolean_t isv6, boolean_t checkonly,
9063     int level, int option, mblk_t *first_mp)
9064 {
9065 	ill_t *ill = NULL;
9066 	int error = 0;
9067 
9068 	ip2dbg(("ip_opt_set_ill: ifindex %d\n", ifindex));
9069 	if (ifindex != 0) {
9070 		ASSERT(connp != NULL);
9071 		ill = ill_lookup_on_ifindex(ifindex, isv6, CONNP_TO_WQ(connp),
9072 		    first_mp, ip_restart_optmgmt, &error);
9073 		if (ill != NULL) {
9074 			if (checkonly) {
9075 				/* not supported by the virtual network iface */
9076 				if (IS_VNI(ill)) {
9077 					ill_refrele(ill);
9078 					return (EINVAL);
9079 				}
9080 				ill_refrele(ill);
9081 				return (0);
9082 			}
9083 			if (!ipif_lookup_zoneid_group(ill, connp->conn_zoneid,
9084 			    0, NULL)) {
9085 				ill_refrele(ill);
9086 				ill = NULL;
9087 				mutex_enter(&connp->conn_lock);
9088 				goto setit;
9089 			}
9090 			mutex_enter(&connp->conn_lock);
9091 			mutex_enter(&ill->ill_lock);
9092 			if (ill->ill_state_flags & ILL_CONDEMNED) {
9093 				mutex_exit(&ill->ill_lock);
9094 				mutex_exit(&connp->conn_lock);
9095 				ill_refrele(ill);
9096 				ill = NULL;
9097 				mutex_enter(&connp->conn_lock);
9098 			}
9099 			goto setit;
9100 		} else if (error == EINPROGRESS) {
9101 			return (error);
9102 		} else {
9103 			error = 0;
9104 		}
9105 	}
9106 	mutex_enter(&connp->conn_lock);
9107 setit:
9108 	ASSERT((level == IPPROTO_IP || level == IPPROTO_IPV6));
9109 
9110 	/*
9111 	 * The options below assume that the ILL (if any) transmits and/or
9112 	 * receives traffic. Neither of which is true for the virtual network
9113 	 * interface, so fail setting these on a VNI.
9114 	 */
9115 	if (IS_VNI(ill)) {
9116 		ASSERT(ill != NULL);
9117 		mutex_exit(&ill->ill_lock);
9118 		mutex_exit(&connp->conn_lock);
9119 		ill_refrele(ill);
9120 		return (EINVAL);
9121 	}
9122 
9123 	if (level == IPPROTO_IP) {
9124 		switch (option) {
9125 		case IP_BOUND_IF:
9126 			connp->conn_incoming_ill = ill;
9127 			connp->conn_outgoing_ill = ill;
9128 			connp->conn_orig_bound_ifindex = (ill == NULL) ?
9129 			    0 : ifindex;
9130 			break;
9131 
9132 		case IP_XMIT_IF:
9133 			/*
9134 			 * Similar to IP_BOUND_IF, but this only
9135 			 * determines the outgoing interface for
9136 			 * unicast packets. Also no IRE_CACHE entry
9137 			 * is added for the destination of the
9138 			 * outgoing packets. This feature is needed
9139 			 * for mobile IP.
9140 			 */
9141 			connp->conn_xmit_if_ill = ill;
9142 			connp->conn_orig_xmit_ifindex = (ill == NULL) ?
9143 			    0 : ifindex;
9144 			break;
9145 
9146 		case IP_MULTICAST_IF:
9147 			/*
9148 			 * This option is an internal special. The socket
9149 			 * level IP_MULTICAST_IF specifies an 'ipaddr' and
9150 			 * is handled in ip_opt_set_ipif. IPV6_MULTICAST_IF
9151 			 * specifies an ifindex and we try first on V6 ill's.
9152 			 * If we don't find one, we they try using on v4 ill's
9153 			 * intenally and we come here.
9154 			 */
9155 			if (!checkonly && ill != NULL) {
9156 				ipif_t	*ipif;
9157 				ipif = ill->ill_ipif;
9158 
9159 				if (ipif->ipif_state_flags & IPIF_CONDEMNED) {
9160 					mutex_exit(&ill->ill_lock);
9161 					mutex_exit(&connp->conn_lock);
9162 					ill_refrele(ill);
9163 					ill = NULL;
9164 					mutex_enter(&connp->conn_lock);
9165 				} else {
9166 					connp->conn_multicast_ipif = ipif;
9167 				}
9168 			}
9169 			break;
9170 		}
9171 	} else {
9172 		switch (option) {
9173 		case IPV6_BOUND_IF:
9174 			connp->conn_incoming_ill = ill;
9175 			connp->conn_outgoing_ill = ill;
9176 			connp->conn_orig_bound_ifindex = (ill == NULL) ?
9177 			    0 : ifindex;
9178 			break;
9179 
9180 		case IPV6_BOUND_PIF:
9181 			/*
9182 			 * Limit all transmit to this ill.
9183 			 * Unlike IPV6_BOUND_IF, using this option
9184 			 * prevents load spreading and failover from
9185 			 * happening when the interface is part of the
9186 			 * group. That's why we don't need to remember
9187 			 * the ifindex in orig_bound_ifindex as in
9188 			 * IPV6_BOUND_IF.
9189 			 */
9190 			connp->conn_outgoing_pill = ill;
9191 			break;
9192 
9193 		case IPV6_DONTFAILOVER_IF:
9194 			/*
9195 			 * This option is used by in.mpathd to ensure
9196 			 * that IPMP probe packets only go out on the
9197 			 * test interfaces. in.mpathd sets this option
9198 			 * on the non-failover interfaces.
9199 			 */
9200 			connp->conn_nofailover_ill = ill;
9201 			/*
9202 			 * For backward compatibility, this option
9203 			 * implicitly sets ip_multicast_ill as used in
9204 			 * IP_MULTICAST_IF so that ip_wput gets
9205 			 * this ipif to send mcast packets.
9206 			 */
9207 			connp->conn_multicast_ill = ill;
9208 			connp->conn_orig_multicast_ifindex = (ill == NULL) ?
9209 			    0 : ifindex;
9210 			break;
9211 
9212 		case IPV6_MULTICAST_IF:
9213 			/*
9214 			 * Set conn_multicast_ill to be the IPv6 ill.
9215 			 * Set conn_multicast_ipif to be an IPv4 ipif
9216 			 * for ifindex to make IPv4 mapped addresses
9217 			 * on PF_INET6 sockets honor IPV6_MULTICAST_IF.
9218 			 * Even if no IPv6 ill exists for the ifindex
9219 			 * we need to check for an IPv4 ifindex in order
9220 			 * for this to work with mapped addresses. In that
9221 			 * case only set conn_multicast_ipif.
9222 			 */
9223 			if (!checkonly) {
9224 				if (ifindex == 0) {
9225 					connp->conn_multicast_ill = NULL;
9226 					connp->conn_orig_multicast_ifindex = 0;
9227 					connp->conn_multicast_ipif = NULL;
9228 				} else if (ill != NULL) {
9229 					connp->conn_multicast_ill = ill;
9230 					connp->conn_orig_multicast_ifindex =
9231 					    ifindex;
9232 				}
9233 			}
9234 			break;
9235 		}
9236 	}
9237 
9238 	if (ill != NULL) {
9239 		mutex_exit(&ill->ill_lock);
9240 		mutex_exit(&connp->conn_lock);
9241 		ill_refrele(ill);
9242 		return (0);
9243 	}
9244 	mutex_exit(&connp->conn_lock);
9245 	/*
9246 	 * We succeeded in clearing the option (ifindex == 0) or failed to
9247 	 * locate the ill and could not set the option (ifindex != 0)
9248 	 */
9249 	return (ifindex == 0 ? 0 : EINVAL);
9250 }
9251 
9252 /* This routine sets socket options. */
9253 /* ARGSUSED */
9254 int
9255 ip_opt_set(queue_t *q, uint_t optset_context, int level, int name,
9256     uint_t inlen, uchar_t *invalp, uint_t *outlenp, uchar_t *outvalp,
9257     void *dummy, cred_t *cr, mblk_t *first_mp)
9258 {
9259 	int		*i1 = (int *)invalp;
9260 	conn_t		*connp = Q_TO_CONN(q);
9261 	int		error = 0;
9262 	boolean_t	checkonly;
9263 	ire_t		*ire;
9264 	boolean_t	found;
9265 
9266 	switch (optset_context) {
9267 
9268 	case SETFN_OPTCOM_CHECKONLY:
9269 		checkonly = B_TRUE;
9270 		/*
9271 		 * Note: Implies T_CHECK semantics for T_OPTCOM_REQ
9272 		 * inlen != 0 implies value supplied and
9273 		 * 	we have to "pretend" to set it.
9274 		 * inlen == 0 implies that there is no
9275 		 * 	value part in T_CHECK request and just validation
9276 		 * done elsewhere should be enough, we just return here.
9277 		 */
9278 		if (inlen == 0) {
9279 			*outlenp = 0;
9280 			return (0);
9281 		}
9282 		break;
9283 	case SETFN_OPTCOM_NEGOTIATE:
9284 	case SETFN_UD_NEGOTIATE:
9285 	case SETFN_CONN_NEGOTIATE:
9286 		checkonly = B_FALSE;
9287 		break;
9288 	default:
9289 		/*
9290 		 * We should never get here
9291 		 */
9292 		*outlenp = 0;
9293 		return (EINVAL);
9294 	}
9295 
9296 	ASSERT((optset_context != SETFN_OPTCOM_CHECKONLY) ||
9297 	    (optset_context == SETFN_OPTCOM_CHECKONLY && inlen != 0));
9298 
9299 	/*
9300 	 * For fixed length options, no sanity check
9301 	 * of passed in length is done. It is assumed *_optcom_req()
9302 	 * routines do the right thing.
9303 	 */
9304 
9305 	switch (level) {
9306 	case SOL_SOCKET:
9307 		/*
9308 		 * conn_lock protects the bitfields, and is used to
9309 		 * set the fields atomically.
9310 		 */
9311 		switch (name) {
9312 		case SO_BROADCAST:
9313 			if (!checkonly) {
9314 				/* TODO: use value someplace? */
9315 				mutex_enter(&connp->conn_lock);
9316 				connp->conn_broadcast = *i1 ? 1 : 0;
9317 				mutex_exit(&connp->conn_lock);
9318 			}
9319 			break;	/* goto sizeof (int) option return */
9320 		case SO_USELOOPBACK:
9321 			if (!checkonly) {
9322 				/* TODO: use value someplace? */
9323 				mutex_enter(&connp->conn_lock);
9324 				connp->conn_loopback = *i1 ? 1 : 0;
9325 				mutex_exit(&connp->conn_lock);
9326 			}
9327 			break;	/* goto sizeof (int) option return */
9328 		case SO_DONTROUTE:
9329 			if (!checkonly) {
9330 				mutex_enter(&connp->conn_lock);
9331 				connp->conn_dontroute = *i1 ? 1 : 0;
9332 				mutex_exit(&connp->conn_lock);
9333 			}
9334 			break;	/* goto sizeof (int) option return */
9335 		case SO_REUSEADDR:
9336 			if (!checkonly) {
9337 				mutex_enter(&connp->conn_lock);
9338 				connp->conn_reuseaddr = *i1 ? 1 : 0;
9339 				mutex_exit(&connp->conn_lock);
9340 			}
9341 			break;	/* goto sizeof (int) option return */
9342 		case SO_PROTOTYPE:
9343 			if (!checkonly) {
9344 				mutex_enter(&connp->conn_lock);
9345 				connp->conn_proto = *i1;
9346 				mutex_exit(&connp->conn_lock);
9347 			}
9348 			break;	/* goto sizeof (int) option return */
9349 		default:
9350 			/*
9351 			 * "soft" error (negative)
9352 			 * option not handled at this level
9353 			 * Note: Do not modify *outlenp
9354 			 */
9355 			return (-EINVAL);
9356 		}
9357 		break;
9358 	case IPPROTO_IP:
9359 		switch (name) {
9360 		case IP_MULTICAST_IF:
9361 		case IP_DONTFAILOVER_IF: {
9362 			ipaddr_t addr = *i1;
9363 
9364 			error = ip_opt_set_ipif(connp, addr, checkonly, name,
9365 			    first_mp);
9366 			if (error != 0)
9367 				return (error);
9368 			break;	/* goto sizeof (int) option return */
9369 		}
9370 
9371 		case IP_MULTICAST_TTL:
9372 			/* Recorded in transport above IP */
9373 			*outvalp = *invalp;
9374 			*outlenp = sizeof (uchar_t);
9375 			return (0);
9376 		case IP_MULTICAST_LOOP:
9377 			if (!checkonly) {
9378 				mutex_enter(&connp->conn_lock);
9379 				connp->conn_multicast_loop = *invalp ? 1 : 0;
9380 				mutex_exit(&connp->conn_lock);
9381 			}
9382 			*outvalp = *invalp;
9383 			*outlenp = sizeof (uchar_t);
9384 			return (0);
9385 		case IP_ADD_MEMBERSHIP:
9386 		case MCAST_JOIN_GROUP:
9387 		case IP_DROP_MEMBERSHIP:
9388 		case MCAST_LEAVE_GROUP: {
9389 			struct ip_mreq *mreqp;
9390 			struct group_req *greqp;
9391 			ire_t *ire;
9392 			boolean_t done = B_FALSE;
9393 			ipaddr_t group, ifaddr;
9394 			struct sockaddr_in *sin;
9395 			uint32_t *ifindexp;
9396 			boolean_t mcast_opt = B_TRUE;
9397 			mcast_record_t fmode;
9398 			int (*optfn)(conn_t *, boolean_t, ipaddr_t, ipaddr_t,
9399 			    uint_t *, mcast_record_t, ipaddr_t, mblk_t *);
9400 
9401 			switch (name) {
9402 			case IP_ADD_MEMBERSHIP:
9403 				mcast_opt = B_FALSE;
9404 				/* FALLTHRU */
9405 			case MCAST_JOIN_GROUP:
9406 				fmode = MODE_IS_EXCLUDE;
9407 				optfn = ip_opt_add_group;
9408 				break;
9409 
9410 			case IP_DROP_MEMBERSHIP:
9411 				mcast_opt = B_FALSE;
9412 				/* FALLTHRU */
9413 			case MCAST_LEAVE_GROUP:
9414 				fmode = MODE_IS_INCLUDE;
9415 				optfn = ip_opt_delete_group;
9416 				break;
9417 			}
9418 
9419 			if (mcast_opt) {
9420 				greqp = (struct group_req *)i1;
9421 				sin = (struct sockaddr_in *)&greqp->gr_group;
9422 				if (sin->sin_family != AF_INET) {
9423 					*outlenp = 0;
9424 					return (ENOPROTOOPT);
9425 				}
9426 				group = (ipaddr_t)sin->sin_addr.s_addr;
9427 				ifaddr = INADDR_ANY;
9428 				ifindexp = &greqp->gr_interface;
9429 			} else {
9430 				mreqp = (struct ip_mreq *)i1;
9431 				group = (ipaddr_t)mreqp->imr_multiaddr.s_addr;
9432 				ifaddr = (ipaddr_t)mreqp->imr_interface.s_addr;
9433 				ifindexp = NULL;
9434 			}
9435 
9436 			/*
9437 			 * In the multirouting case, we need to replicate
9438 			 * the request on all interfaces that will take part
9439 			 * in replication.  We do so because multirouting is
9440 			 * reflective, thus we will probably receive multi-
9441 			 * casts on those interfaces.
9442 			 * The ip_multirt_apply_membership() succeeds if the
9443 			 * operation succeeds on at least one interface.
9444 			 */
9445 			ire = ire_ftable_lookup(group, IP_HOST_MASK, 0,
9446 			    IRE_HOST, NULL, NULL, ALL_ZONES, 0,
9447 			    MATCH_IRE_MASK | MATCH_IRE_TYPE);
9448 			if (ire != NULL) {
9449 				if (ire->ire_flags & RTF_MULTIRT) {
9450 					error = ip_multirt_apply_membership(
9451 					    optfn, ire, connp, checkonly, group,
9452 					    fmode, INADDR_ANY, first_mp);
9453 					done = B_TRUE;
9454 				}
9455 				ire_refrele(ire);
9456 			}
9457 			if (!done) {
9458 				error = optfn(connp, checkonly, group, ifaddr,
9459 				    ifindexp, fmode, INADDR_ANY, first_mp);
9460 			}
9461 			if (error) {
9462 				/*
9463 				 * EINPROGRESS is a soft error, needs retry
9464 				 * so don't make *outlenp zero.
9465 				 */
9466 				if (error != EINPROGRESS)
9467 					*outlenp = 0;
9468 				return (error);
9469 			}
9470 			/* OK return - copy input buffer into output buffer */
9471 			if (invalp != outvalp) {
9472 				/* don't trust bcopy for identical src/dst */
9473 				bcopy(invalp, outvalp, inlen);
9474 			}
9475 			*outlenp = inlen;
9476 			return (0);
9477 		}
9478 		case IP_BLOCK_SOURCE:
9479 		case IP_UNBLOCK_SOURCE:
9480 		case IP_ADD_SOURCE_MEMBERSHIP:
9481 		case IP_DROP_SOURCE_MEMBERSHIP:
9482 		case MCAST_BLOCK_SOURCE:
9483 		case MCAST_UNBLOCK_SOURCE:
9484 		case MCAST_JOIN_SOURCE_GROUP:
9485 		case MCAST_LEAVE_SOURCE_GROUP: {
9486 			struct ip_mreq_source *imreqp;
9487 			struct group_source_req *gsreqp;
9488 			in_addr_t grp, src, ifaddr = INADDR_ANY;
9489 			uint32_t ifindex = 0;
9490 			mcast_record_t fmode;
9491 			struct sockaddr_in *sin;
9492 			ire_t *ire;
9493 			boolean_t mcast_opt = B_TRUE, done = B_FALSE;
9494 			int (*optfn)(conn_t *, boolean_t, ipaddr_t, ipaddr_t,
9495 			    uint_t *, mcast_record_t, ipaddr_t, mblk_t *);
9496 
9497 			switch (name) {
9498 			case IP_BLOCK_SOURCE:
9499 				mcast_opt = B_FALSE;
9500 				/* FALLTHRU */
9501 			case MCAST_BLOCK_SOURCE:
9502 				fmode = MODE_IS_EXCLUDE;
9503 				optfn = ip_opt_add_group;
9504 				break;
9505 
9506 			case IP_UNBLOCK_SOURCE:
9507 				mcast_opt = B_FALSE;
9508 				/* FALLTHRU */
9509 			case MCAST_UNBLOCK_SOURCE:
9510 				fmode = MODE_IS_EXCLUDE;
9511 				optfn = ip_opt_delete_group;
9512 				break;
9513 
9514 			case IP_ADD_SOURCE_MEMBERSHIP:
9515 				mcast_opt = B_FALSE;
9516 				/* FALLTHRU */
9517 			case MCAST_JOIN_SOURCE_GROUP:
9518 				fmode = MODE_IS_INCLUDE;
9519 				optfn = ip_opt_add_group;
9520 				break;
9521 
9522 			case IP_DROP_SOURCE_MEMBERSHIP:
9523 				mcast_opt = B_FALSE;
9524 				/* FALLTHRU */
9525 			case MCAST_LEAVE_SOURCE_GROUP:
9526 				fmode = MODE_IS_INCLUDE;
9527 				optfn = ip_opt_delete_group;
9528 				break;
9529 			}
9530 
9531 			if (mcast_opt) {
9532 				gsreqp = (struct group_source_req *)i1;
9533 				if (gsreqp->gsr_group.ss_family != AF_INET) {
9534 					*outlenp = 0;
9535 					return (ENOPROTOOPT);
9536 				}
9537 				sin = (struct sockaddr_in *)&gsreqp->gsr_group;
9538 				grp = (ipaddr_t)sin->sin_addr.s_addr;
9539 				sin = (struct sockaddr_in *)&gsreqp->gsr_source;
9540 				src = (ipaddr_t)sin->sin_addr.s_addr;
9541 				ifindex = gsreqp->gsr_interface;
9542 			} else {
9543 				imreqp = (struct ip_mreq_source *)i1;
9544 				grp = (ipaddr_t)imreqp->imr_multiaddr.s_addr;
9545 				src = (ipaddr_t)imreqp->imr_sourceaddr.s_addr;
9546 				ifaddr = (ipaddr_t)imreqp->imr_interface.s_addr;
9547 			}
9548 
9549 			/*
9550 			 * In the multirouting case, we need to replicate
9551 			 * the request as noted in the mcast cases above.
9552 			 */
9553 			ire = ire_ftable_lookup(grp, IP_HOST_MASK, 0,
9554 			    IRE_HOST, NULL, NULL, ALL_ZONES, 0,
9555 			    MATCH_IRE_MASK | MATCH_IRE_TYPE);
9556 			if (ire != NULL) {
9557 				if (ire->ire_flags & RTF_MULTIRT) {
9558 					error = ip_multirt_apply_membership(
9559 					    optfn, ire, connp, checkonly, grp,
9560 					    fmode, src, first_mp);
9561 					done = B_TRUE;
9562 				}
9563 				ire_refrele(ire);
9564 			}
9565 			if (!done) {
9566 				error = optfn(connp, checkonly, grp, ifaddr,
9567 				    &ifindex, fmode, src, first_mp);
9568 			}
9569 			if (error != 0) {
9570 				/*
9571 				 * EINPROGRESS is a soft error, needs retry
9572 				 * so don't make *outlenp zero.
9573 				 */
9574 				if (error != EINPROGRESS)
9575 					*outlenp = 0;
9576 				return (error);
9577 			}
9578 			/* OK return - copy input buffer into output buffer */
9579 			if (invalp != outvalp) {
9580 				bcopy(invalp, outvalp, inlen);
9581 			}
9582 			*outlenp = inlen;
9583 			return (0);
9584 		}
9585 		case IP_SEC_OPT:
9586 			error = ipsec_set_req(cr, connp, (ipsec_req_t *)invalp);
9587 			if (error != 0) {
9588 				*outlenp = 0;
9589 				return (error);
9590 			}
9591 			break;
9592 		case IP_HDRINCL:
9593 		case IP_OPTIONS:
9594 		case T_IP_OPTIONS:
9595 		case IP_TOS:
9596 		case T_IP_TOS:
9597 		case IP_TTL:
9598 		case IP_RECVDSTADDR:
9599 		case IP_RECVOPTS:
9600 			/* OK return - copy input buffer into output buffer */
9601 			if (invalp != outvalp) {
9602 				/* don't trust bcopy for identical src/dst */
9603 				bcopy(invalp, outvalp, inlen);
9604 			}
9605 			*outlenp = inlen;
9606 			return (0);
9607 		case IP_RECVIF:
9608 			/* Retrieve the inbound interface index */
9609 			if (!checkonly) {
9610 				mutex_enter(&connp->conn_lock);
9611 				connp->conn_recvif = *i1 ? 1 : 0;
9612 				mutex_exit(&connp->conn_lock);
9613 			}
9614 			break;	/* goto sizeof (int) option return */
9615 		case IP_RECVSLLA:
9616 			/* Retrieve the source link layer address */
9617 			if (!checkonly) {
9618 				mutex_enter(&connp->conn_lock);
9619 				connp->conn_recvslla = *i1 ? 1 : 0;
9620 				mutex_exit(&connp->conn_lock);
9621 			}
9622 			break;	/* goto sizeof (int) option return */
9623 		case MRT_INIT:
9624 		case MRT_DONE:
9625 		case MRT_ADD_VIF:
9626 		case MRT_DEL_VIF:
9627 		case MRT_ADD_MFC:
9628 		case MRT_DEL_MFC:
9629 		case MRT_ASSERT:
9630 			if ((error = secpolicy_net_config(cr, B_FALSE)) != 0) {
9631 				*outlenp = 0;
9632 				return (error);
9633 			}
9634 			error = ip_mrouter_set((int)name, q, checkonly,
9635 			    (uchar_t *)invalp, inlen, first_mp);
9636 			if (error) {
9637 				*outlenp = 0;
9638 				return (error);
9639 			}
9640 			/* OK return - copy input buffer into output buffer */
9641 			if (invalp != outvalp) {
9642 				/* don't trust bcopy for identical src/dst */
9643 				bcopy(invalp, outvalp, inlen);
9644 			}
9645 			*outlenp = inlen;
9646 			return (0);
9647 		case IP_BOUND_IF:
9648 		case IP_XMIT_IF:
9649 			error = ip_opt_set_ill(connp, *i1, B_FALSE, checkonly,
9650 			    level, name, first_mp);
9651 			if (error != 0)
9652 				return (error);
9653 			break; 		/* goto sizeof (int) option return */
9654 
9655 		case IP_UNSPEC_SRC:
9656 			/* Allow sending with a zero source address */
9657 			if (!checkonly) {
9658 				mutex_enter(&connp->conn_lock);
9659 				connp->conn_unspec_src = *i1 ? 1 : 0;
9660 				mutex_exit(&connp->conn_lock);
9661 			}
9662 			break;	/* goto sizeof (int) option return */
9663 		default:
9664 			/*
9665 			 * "soft" error (negative)
9666 			 * option not handled at this level
9667 			 * Note: Do not modify *outlenp
9668 			 */
9669 			return (-EINVAL);
9670 		}
9671 		break;
9672 	case IPPROTO_IPV6:
9673 		switch (name) {
9674 		case IPV6_BOUND_IF:
9675 		case IPV6_BOUND_PIF:
9676 		case IPV6_DONTFAILOVER_IF:
9677 			error = ip_opt_set_ill(connp, *i1, B_TRUE, checkonly,
9678 			    level, name, first_mp);
9679 			if (error != 0)
9680 				return (error);
9681 			break; 		/* goto sizeof (int) option return */
9682 
9683 		case IPV6_MULTICAST_IF:
9684 			/*
9685 			 * The only possible errors are EINPROGRESS and
9686 			 * EINVAL. EINPROGRESS will be restarted and is not
9687 			 * a hard error. We call this option on both V4 and V6
9688 			 * If both return EINVAL, then this call returns
9689 			 * EINVAL. If at least one of them succeeds we
9690 			 * return success.
9691 			 */
9692 			found = B_FALSE;
9693 			error = ip_opt_set_ill(connp, *i1, B_TRUE, checkonly,
9694 			    level, name, first_mp);
9695 			if (error == EINPROGRESS)
9696 				return (error);
9697 			if (error == 0)
9698 				found = B_TRUE;
9699 			error = ip_opt_set_ill(connp, *i1, B_FALSE, checkonly,
9700 			    IPPROTO_IP, IP_MULTICAST_IF, first_mp);
9701 			if (error == 0)
9702 				found = B_TRUE;
9703 			if (!found)
9704 				return (error);
9705 			break; 		/* goto sizeof (int) option return */
9706 
9707 		case IPV6_MULTICAST_HOPS:
9708 			/* Recorded in transport above IP */
9709 			break;	/* goto sizeof (int) option return */
9710 		case IPV6_MULTICAST_LOOP:
9711 			if (!checkonly) {
9712 				mutex_enter(&connp->conn_lock);
9713 				connp->conn_multicast_loop = *i1;
9714 				mutex_exit(&connp->conn_lock);
9715 			}
9716 			break;	/* goto sizeof (int) option return */
9717 		case IPV6_JOIN_GROUP:
9718 		case MCAST_JOIN_GROUP:
9719 		case IPV6_LEAVE_GROUP:
9720 		case MCAST_LEAVE_GROUP: {
9721 			struct ipv6_mreq *ip_mreqp;
9722 			struct group_req *greqp;
9723 			ire_t *ire;
9724 			boolean_t done = B_FALSE;
9725 			in6_addr_t groupv6;
9726 			uint32_t ifindex;
9727 			boolean_t mcast_opt = B_TRUE;
9728 			mcast_record_t fmode;
9729 			int (*optfn)(conn_t *, boolean_t, const in6_addr_t *,
9730 			    int, mcast_record_t, const in6_addr_t *, mblk_t *);
9731 
9732 			switch (name) {
9733 			case IPV6_JOIN_GROUP:
9734 				mcast_opt = B_FALSE;
9735 				/* FALLTHRU */
9736 			case MCAST_JOIN_GROUP:
9737 				fmode = MODE_IS_EXCLUDE;
9738 				optfn = ip_opt_add_group_v6;
9739 				break;
9740 
9741 			case IPV6_LEAVE_GROUP:
9742 				mcast_opt = B_FALSE;
9743 				/* FALLTHRU */
9744 			case MCAST_LEAVE_GROUP:
9745 				fmode = MODE_IS_INCLUDE;
9746 				optfn = ip_opt_delete_group_v6;
9747 				break;
9748 			}
9749 
9750 			if (mcast_opt) {
9751 				struct sockaddr_in *sin;
9752 				struct sockaddr_in6 *sin6;
9753 				greqp = (struct group_req *)i1;
9754 				if (greqp->gr_group.ss_family == AF_INET) {
9755 					sin = (struct sockaddr_in *)
9756 					    &(greqp->gr_group);
9757 					IN6_INADDR_TO_V4MAPPED(&sin->sin_addr,
9758 					    &groupv6);
9759 				} else {
9760 					sin6 = (struct sockaddr_in6 *)
9761 					    &(greqp->gr_group);
9762 					groupv6 = sin6->sin6_addr;
9763 				}
9764 				ifindex = greqp->gr_interface;
9765 			} else {
9766 				ip_mreqp = (struct ipv6_mreq *)i1;
9767 				groupv6 = ip_mreqp->ipv6mr_multiaddr;
9768 				ifindex = ip_mreqp->ipv6mr_interface;
9769 			}
9770 			/*
9771 			 * In the multirouting case, we need to replicate
9772 			 * the request on all interfaces that will take part
9773 			 * in replication.  We do so because multirouting is
9774 			 * reflective, thus we will probably receive multi-
9775 			 * casts on those interfaces.
9776 			 * The ip_multirt_apply_membership_v6() succeeds if
9777 			 * the operation succeeds on at least one interface.
9778 			 */
9779 			ire = ire_ftable_lookup_v6(&groupv6, &ipv6_all_ones, 0,
9780 			    IRE_HOST, NULL, NULL, ALL_ZONES, 0,
9781 			    MATCH_IRE_MASK | MATCH_IRE_TYPE);
9782 			if (ire != NULL) {
9783 				if (ire->ire_flags & RTF_MULTIRT) {
9784 					error = ip_multirt_apply_membership_v6(
9785 					    optfn, ire, connp, checkonly,
9786 					    &groupv6, fmode, &ipv6_all_zeros,
9787 					    first_mp);
9788 					done = B_TRUE;
9789 				}
9790 				ire_refrele(ire);
9791 			}
9792 			if (!done) {
9793 				error = optfn(connp, checkonly, &groupv6,
9794 				    ifindex, fmode, &ipv6_all_zeros, first_mp);
9795 			}
9796 			if (error) {
9797 				/*
9798 				 * EINPROGRESS is a soft error, needs retry
9799 				 * so don't make *outlenp zero.
9800 				 */
9801 				if (error != EINPROGRESS)
9802 					*outlenp = 0;
9803 				return (error);
9804 			}
9805 			/* OK return - copy input buffer into output buffer */
9806 			if (invalp != outvalp) {
9807 				/* don't trust bcopy for identical src/dst */
9808 				bcopy(invalp, outvalp, inlen);
9809 			}
9810 			*outlenp = inlen;
9811 			return (0);
9812 		}
9813 		case MCAST_BLOCK_SOURCE:
9814 		case MCAST_UNBLOCK_SOURCE:
9815 		case MCAST_JOIN_SOURCE_GROUP:
9816 		case MCAST_LEAVE_SOURCE_GROUP: {
9817 			struct group_source_req *gsreqp;
9818 			in6_addr_t v6grp, v6src;
9819 			uint32_t ifindex;
9820 			mcast_record_t fmode;
9821 			ire_t *ire;
9822 			boolean_t done = B_FALSE;
9823 			int (*optfn)(conn_t *, boolean_t, const in6_addr_t *,
9824 			    int, mcast_record_t, const in6_addr_t *, mblk_t *);
9825 
9826 			switch (name) {
9827 			case MCAST_BLOCK_SOURCE:
9828 				fmode = MODE_IS_EXCLUDE;
9829 				optfn = ip_opt_add_group_v6;
9830 				break;
9831 			case MCAST_UNBLOCK_SOURCE:
9832 				fmode = MODE_IS_EXCLUDE;
9833 				optfn = ip_opt_delete_group_v6;
9834 				break;
9835 			case MCAST_JOIN_SOURCE_GROUP:
9836 				fmode = MODE_IS_INCLUDE;
9837 				optfn = ip_opt_add_group_v6;
9838 				break;
9839 			case MCAST_LEAVE_SOURCE_GROUP:
9840 				fmode = MODE_IS_INCLUDE;
9841 				optfn = ip_opt_delete_group_v6;
9842 				break;
9843 			}
9844 
9845 			gsreqp = (struct group_source_req *)i1;
9846 			ifindex = gsreqp->gsr_interface;
9847 			if (gsreqp->gsr_group.ss_family == AF_INET) {
9848 				struct sockaddr_in *s;
9849 				s = (struct sockaddr_in *)&gsreqp->gsr_group;
9850 				IN6_INADDR_TO_V4MAPPED(&s->sin_addr, &v6grp);
9851 				s = (struct sockaddr_in *)&gsreqp->gsr_source;
9852 				IN6_INADDR_TO_V4MAPPED(&s->sin_addr, &v6src);
9853 			} else {
9854 				struct sockaddr_in6 *s6;
9855 				s6 = (struct sockaddr_in6 *)&gsreqp->gsr_group;
9856 				v6grp = s6->sin6_addr;
9857 				s6 = (struct sockaddr_in6 *)&gsreqp->gsr_source;
9858 				v6src = s6->sin6_addr;
9859 			}
9860 
9861 			/*
9862 			 * In the multirouting case, we need to replicate
9863 			 * the request as noted in the mcast cases above.
9864 			 */
9865 			ire = ire_ftable_lookup_v6(&v6grp, &ipv6_all_ones, 0,
9866 			    IRE_HOST, NULL, NULL, ALL_ZONES, 0,
9867 			    MATCH_IRE_MASK | MATCH_IRE_TYPE);
9868 			if (ire != NULL) {
9869 				if (ire->ire_flags & RTF_MULTIRT) {
9870 					error = ip_multirt_apply_membership_v6(
9871 					    optfn, ire, connp, checkonly,
9872 					    &v6grp, fmode, &v6src, first_mp);
9873 					done = B_TRUE;
9874 				}
9875 				ire_refrele(ire);
9876 			}
9877 			if (!done) {
9878 				error = optfn(connp, checkonly, &v6grp,
9879 				    ifindex, fmode, &v6src, first_mp);
9880 			}
9881 			if (error != 0) {
9882 				/*
9883 				 * EINPROGRESS is a soft error, needs retry
9884 				 * so don't make *outlenp zero.
9885 				 */
9886 				if (error != EINPROGRESS)
9887 					*outlenp = 0;
9888 				return (error);
9889 			}
9890 			/* OK return - copy input buffer into output buffer */
9891 			if (invalp != outvalp) {
9892 				bcopy(invalp, outvalp, inlen);
9893 			}
9894 			*outlenp = inlen;
9895 			return (0);
9896 		}
9897 		case IPV6_UNICAST_HOPS:
9898 			/* Recorded in transport above IP */
9899 			break;	/* goto sizeof (int) option return */
9900 		case IPV6_UNSPEC_SRC:
9901 			/* Allow sending with a zero source address */
9902 			if (!checkonly) {
9903 				mutex_enter(&connp->conn_lock);
9904 				connp->conn_unspec_src = *i1 ? 1 : 0;
9905 				mutex_exit(&connp->conn_lock);
9906 			}
9907 			break;	/* goto sizeof (int) option return */
9908 		case IPV6_RECVPKTINFO:
9909 			if (!checkonly) {
9910 				mutex_enter(&connp->conn_lock);
9911 				connp->conn_ipv6_recvpktinfo = *i1 ? 1 : 0;
9912 				mutex_exit(&connp->conn_lock);
9913 			}
9914 			break;	/* goto sizeof (int) option return */
9915 		case IPV6_RECVTCLASS:
9916 			if (!checkonly) {
9917 				if (*i1 < 0 || *i1 > 1) {
9918 					return (EINVAL);
9919 				}
9920 				mutex_enter(&connp->conn_lock);
9921 				connp->conn_ipv6_recvtclass = *i1;
9922 				mutex_exit(&connp->conn_lock);
9923 			}
9924 			break;
9925 		case IPV6_RECVPATHMTU:
9926 			if (!checkonly) {
9927 				if (*i1 < 0 || *i1 > 1) {
9928 					return (EINVAL);
9929 				}
9930 				mutex_enter(&connp->conn_lock);
9931 				connp->conn_ipv6_recvpathmtu = *i1;
9932 				mutex_exit(&connp->conn_lock);
9933 			}
9934 			break;
9935 		case IPV6_RECVHOPLIMIT:
9936 			if (!checkonly) {
9937 				mutex_enter(&connp->conn_lock);
9938 				connp->conn_ipv6_recvhoplimit = *i1 ? 1 : 0;
9939 				mutex_exit(&connp->conn_lock);
9940 			}
9941 			break;	/* goto sizeof (int) option return */
9942 		case IPV6_RECVHOPOPTS:
9943 			if (!checkonly) {
9944 				mutex_enter(&connp->conn_lock);
9945 				connp->conn_ipv6_recvhopopts = *i1 ? 1 : 0;
9946 				mutex_exit(&connp->conn_lock);
9947 			}
9948 			break;	/* goto sizeof (int) option return */
9949 		case IPV6_RECVDSTOPTS:
9950 			if (!checkonly) {
9951 				mutex_enter(&connp->conn_lock);
9952 				connp->conn_ipv6_recvdstopts = *i1 ? 1 : 0;
9953 				mutex_exit(&connp->conn_lock);
9954 			}
9955 			break;	/* goto sizeof (int) option return */
9956 		case IPV6_RECVRTHDR:
9957 			if (!checkonly) {
9958 				mutex_enter(&connp->conn_lock);
9959 				connp->conn_ipv6_recvrthdr = *i1 ? 1 : 0;
9960 				mutex_exit(&connp->conn_lock);
9961 			}
9962 			break;	/* goto sizeof (int) option return */
9963 		case IPV6_RECVRTHDRDSTOPTS:
9964 			if (!checkonly) {
9965 				mutex_enter(&connp->conn_lock);
9966 				connp->conn_ipv6_recvrtdstopts = *i1 ? 1 : 0;
9967 				mutex_exit(&connp->conn_lock);
9968 			}
9969 			break;	/* goto sizeof (int) option return */
9970 		case IPV6_PKTINFO:
9971 			if (inlen == 0)
9972 				return (-EINVAL);	/* clearing option */
9973 			error = ip6_set_pktinfo(cr, connp,
9974 			    (struct in6_pktinfo *)invalp, first_mp);
9975 			if (error != 0)
9976 				*outlenp = 0;
9977 			else
9978 				*outlenp = inlen;
9979 			return (error);
9980 		case IPV6_NEXTHOP: {
9981 			struct sockaddr_in6 *sin6;
9982 
9983 			/* Verify that the nexthop is reachable */
9984 			if (inlen == 0)
9985 				return (-EINVAL);	/* clearing option */
9986 
9987 			sin6 = (struct sockaddr_in6 *)invalp;
9988 			ire = ire_route_lookup_v6(&sin6->sin6_addr,
9989 			    0, 0, 0, NULL, NULL, connp->conn_zoneid,
9990 			    MATCH_IRE_DEFAULT);
9991 
9992 			if (ire == NULL) {
9993 				*outlenp = 0;
9994 				return (EHOSTUNREACH);
9995 			}
9996 			ire_refrele(ire);
9997 			return (-EINVAL);
9998 		}
9999 		case IPV6_SEC_OPT:
10000 			error = ipsec_set_req(cr, connp, (ipsec_req_t *)invalp);
10001 			if (error != 0) {
10002 				*outlenp = 0;
10003 				return (error);
10004 			}
10005 			break;
10006 		case IPV6_SRC_PREFERENCES: {
10007 			/*
10008 			 * This is implemented strictly in the ip module
10009 			 * (here and in tcp_opt_*() to accomodate tcp
10010 			 * sockets).  Modules above ip pass this option
10011 			 * down here since ip is the only one that needs to
10012 			 * be aware of source address preferences.
10013 			 *
10014 			 * This socket option only affects connected
10015 			 * sockets that haven't already bound to a specific
10016 			 * IPv6 address.  In other words, sockets that
10017 			 * don't call bind() with an address other than the
10018 			 * unspecified address and that call connect().
10019 			 * ip_bind_connected_v6() passes these preferences
10020 			 * to the ipif_select_source_v6() function.
10021 			 */
10022 			if (inlen != sizeof (uint32_t))
10023 				return (EINVAL);
10024 			error = ip6_set_src_preferences(connp,
10025 			    *(uint32_t *)invalp);
10026 			if (error != 0) {
10027 				*outlenp = 0;
10028 				return (error);
10029 			} else {
10030 				*outlenp = sizeof (uint32_t);
10031 			}
10032 			break;
10033 		}
10034 		case IPV6_V6ONLY:
10035 			if (*i1 < 0 || *i1 > 1) {
10036 				return (EINVAL);
10037 			}
10038 			mutex_enter(&connp->conn_lock);
10039 			connp->conn_ipv6_v6only = *i1;
10040 			mutex_exit(&connp->conn_lock);
10041 			break;
10042 		default:
10043 			return (-EINVAL);
10044 		}
10045 		break;
10046 	default:
10047 		/*
10048 		 * "soft" error (negative)
10049 		 * option not handled at this level
10050 		 * Note: Do not modify *outlenp
10051 		 */
10052 		return (-EINVAL);
10053 	}
10054 	/*
10055 	 * Common case of return from an option that is sizeof (int)
10056 	 */
10057 	*(int *)outvalp = *i1;
10058 	*outlenp = sizeof (int);
10059 	return (0);
10060 }
10061 
10062 /*
10063  * This routine gets default values of certain options whose default
10064  * values are maintained by protocol specific code
10065  */
10066 /* ARGSUSED */
10067 int
10068 ip_opt_default(queue_t *q, int level, int name, uchar_t *ptr)
10069 {
10070 	int *i1 = (int *)ptr;
10071 
10072 	switch (level) {
10073 	case IPPROTO_IP:
10074 		switch (name) {
10075 		case IP_MULTICAST_TTL:
10076 			*ptr = (uchar_t)IP_DEFAULT_MULTICAST_TTL;
10077 			return (sizeof (uchar_t));
10078 		case IP_MULTICAST_LOOP:
10079 			*ptr = (uchar_t)IP_DEFAULT_MULTICAST_LOOP;
10080 			return (sizeof (uchar_t));
10081 		default:
10082 			return (-1);
10083 		}
10084 	case IPPROTO_IPV6:
10085 		switch (name) {
10086 		case IPV6_UNICAST_HOPS:
10087 			*i1 = ipv6_def_hops;
10088 			return (sizeof (int));
10089 		case IPV6_MULTICAST_HOPS:
10090 			*i1 = IP_DEFAULT_MULTICAST_TTL;
10091 			return (sizeof (int));
10092 		case IPV6_MULTICAST_LOOP:
10093 			*i1 = IP_DEFAULT_MULTICAST_LOOP;
10094 			return (sizeof (int));
10095 		case IPV6_V6ONLY:
10096 			*i1 = 1;
10097 			return (sizeof (int));
10098 		default:
10099 			return (-1);
10100 		}
10101 	default:
10102 		return (-1);
10103 	}
10104 	/* NOTREACHED */
10105 }
10106 
10107 /*
10108  * Given a destination address and a pointer to where to put the information
10109  * this routine fills in the mtuinfo.
10110  */
10111 int
10112 ip_fill_mtuinfo(struct in6_addr *in6, in_port_t port,
10113     struct ip6_mtuinfo *mtuinfo)
10114 {
10115 	ire_t *ire;
10116 
10117 	if (IN6_IS_ADDR_UNSPECIFIED(in6))
10118 		return (-1);
10119 
10120 	bzero(mtuinfo, sizeof (*mtuinfo));
10121 	mtuinfo->ip6m_addr.sin6_family = AF_INET6;
10122 	mtuinfo->ip6m_addr.sin6_port = port;
10123 	mtuinfo->ip6m_addr.sin6_addr = *in6;
10124 
10125 	ire = ire_cache_lookup_v6(in6, ALL_ZONES);
10126 	if (ire != NULL) {
10127 		mtuinfo->ip6m_mtu = ire->ire_max_frag;
10128 		ire_refrele(ire);
10129 	} else {
10130 		mtuinfo->ip6m_mtu = IPV6_MIN_MTU;
10131 	}
10132 	return (sizeof (struct ip6_mtuinfo));
10133 }
10134 
10135 /*
10136  * This routine gets socket options.  For MRT_VERSION and MRT_ASSERT, error
10137  * checking of GET_QUEUE_CRED(q) and that ip_g_mrouter is set should be done and
10138  * isn't.  This doesn't matter as the error checking is done properly for the
10139  * other MRT options coming in through ip_opt_set.
10140  */
10141 int
10142 ip_opt_get(queue_t *q, int level, int name, uchar_t *ptr)
10143 {
10144 	conn_t		*connp = Q_TO_CONN(q);
10145 	ipsec_req_t	*req = (ipsec_req_t *)ptr;
10146 
10147 	switch (level) {
10148 	case IPPROTO_IP:
10149 		switch (name) {
10150 		case MRT_VERSION:
10151 		case MRT_ASSERT:
10152 			(void) ip_mrouter_get(name, q, ptr);
10153 			return (sizeof (int));
10154 		case IP_SEC_OPT:
10155 			return (ipsec_req_from_conn(connp, req, IPSEC_AF_V4));
10156 		default:
10157 			break;
10158 		}
10159 		break;
10160 	case IPPROTO_IPV6:
10161 		switch (name) {
10162 		case IPV6_SEC_OPT:
10163 			return (ipsec_req_from_conn(connp, req, IPSEC_AF_V6));
10164 		case IPV6_SRC_PREFERENCES: {
10165 			return (ip6_get_src_preferences(connp,
10166 			    (uint32_t *)ptr));
10167 		}
10168 		case IPV6_V6ONLY:
10169 			*(int *)ptr = connp->conn_ipv6_v6only ? 1 : 0;
10170 			return (sizeof (int));
10171 		case IPV6_PATHMTU:
10172 			return (ip_fill_mtuinfo(&connp->conn_remv6, 0,
10173 				(struct ip6_mtuinfo *)ptr));
10174 		default:
10175 			break;
10176 		}
10177 		break;
10178 	default:
10179 		break;
10180 	}
10181 	return (-1);
10182 }
10183 
10184 /* Named Dispatch routine to get a current value out of our parameter table. */
10185 /* ARGSUSED */
10186 static int
10187 ip_param_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *ioc_cr)
10188 {
10189 	ipparam_t *ippa = (ipparam_t *)cp;
10190 
10191 	(void) mi_mpprintf(mp, "%d", ippa->ip_param_value);
10192 	return (0);
10193 }
10194 
10195 /* ARGSUSED */
10196 static int
10197 ip_param_generic_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *ioc_cr)
10198 {
10199 
10200 	(void) mi_mpprintf(mp, "%d", *(int *)cp);
10201 	return (0);
10202 }
10203 
10204 /*
10205  * Set ip{,6}_forwarding values.  This means walking through all of the
10206  * ill's and toggling their forwarding values.
10207  */
10208 /* ARGSUSED */
10209 static int
10210 ip_forward_set(queue_t *q, mblk_t *mp, char *value, caddr_t cp, cred_t *ioc_cr)
10211 {
10212 	long new_value;
10213 	int *forwarding_value = (int *)cp;
10214 	ill_t *walker;
10215 	boolean_t isv6 = (forwarding_value == &ipv6_forward);
10216 	ill_walk_context_t ctx;
10217 
10218 	if (ddi_strtol(value, NULL, 10, &new_value) != 0 ||
10219 	    new_value < 0 || new_value > 1) {
10220 		return (EINVAL);
10221 	}
10222 
10223 	*forwarding_value = new_value;
10224 
10225 	/*
10226 	 * Regardless of the current value of ip_forwarding, set all per-ill
10227 	 * values of ip_forwarding to the value being set.
10228 	 *
10229 	 * Bring all the ill's up to date with the new global value.
10230 	 */
10231 	rw_enter(&ill_g_lock, RW_READER);
10232 
10233 	if (isv6)
10234 		walker = ILL_START_WALK_V6(&ctx);
10235 	else
10236 		walker = ILL_START_WALK_V4(&ctx);
10237 	for (; walker != NULL; walker = ill_next(&ctx, walker)) {
10238 		(void) ill_forward_set(q, mp, (new_value != 0),
10239 		    (caddr_t)walker);
10240 	}
10241 	rw_exit(&ill_g_lock);
10242 
10243 	return (0);
10244 }
10245 
10246 /*
10247  * Walk through the param array specified registering each element with the
10248  * Named Dispatch handler. This is called only during init. So it is ok
10249  * not to acquire any locks
10250  */
10251 static boolean_t
10252 ip_param_register(ipparam_t *ippa, size_t ippa_cnt,
10253     ipndp_t *ipnd, size_t ipnd_cnt)
10254 {
10255 	for (; ippa_cnt-- > 0; ippa++) {
10256 		if (ippa->ip_param_name && ippa->ip_param_name[0]) {
10257 			if (!nd_load(&ip_g_nd, ippa->ip_param_name,
10258 			    ip_param_get, ip_param_set, (caddr_t)ippa)) {
10259 				nd_free(&ip_g_nd);
10260 				return (B_FALSE);
10261 			}
10262 		}
10263 	}
10264 
10265 	for (; ipnd_cnt-- > 0; ipnd++) {
10266 		if (ipnd->ip_ndp_name && ipnd->ip_ndp_name[0]) {
10267 			if (!nd_load(&ip_g_nd, ipnd->ip_ndp_name,
10268 			    ipnd->ip_ndp_getf, ipnd->ip_ndp_setf,
10269 			    ipnd->ip_ndp_data)) {
10270 				nd_free(&ip_g_nd);
10271 				return (B_FALSE);
10272 			}
10273 		}
10274 	}
10275 
10276 	return (B_TRUE);
10277 }
10278 
10279 /* Named Dispatch routine to negotiate a new value for one of our parameters. */
10280 /* ARGSUSED */
10281 static int
10282 ip_param_set(queue_t *q, mblk_t *mp, char *value, caddr_t cp, cred_t *ioc_cr)
10283 {
10284 	long		new_value;
10285 	ipparam_t	*ippa = (ipparam_t *)cp;
10286 
10287 	if (ddi_strtol(value, NULL, 10, &new_value) != 0 ||
10288 	    new_value < ippa->ip_param_min || new_value > ippa->ip_param_max) {
10289 		return (EINVAL);
10290 	}
10291 	ippa->ip_param_value = new_value;
10292 	return (0);
10293 }
10294 
10295 /*
10296  * Handles both IPv4 and IPv6 reassembly - doing the out-of-order cases,
10297  * When an ipf is passed here for the first time, if
10298  * we already have in-order fragments on the queue, we convert from the fast-
10299  * path reassembly scheme to the hard-case scheme.  From then on, additional
10300  * fragments are reassembled here.  We keep track of the start and end offsets
10301  * of each piece, and the number of holes in the chain.  When the hole count
10302  * goes to zero, we are done!
10303  *
10304  * The ipf_count will be updated to account for any mblk(s) added (pointed to
10305  * by mp) or subtracted (freeb()ed dups), upon return the caller must update
10306  * ipfb_count and ill_frag_count by the difference of ipf_count before and
10307  * after the call to ip_reassemble().
10308  */
10309 int
10310 ip_reassemble(mblk_t *mp, ipf_t *ipf, uint_t start, boolean_t more, ill_t *ill,
10311     size_t msg_len)
10312 {
10313 	uint_t	end;
10314 	mblk_t	*next_mp;
10315 	mblk_t	*mp1;
10316 	uint_t	offset;
10317 	boolean_t incr_dups = B_TRUE;
10318 	boolean_t offset_zero_seen = B_FALSE;
10319 	boolean_t pkt_boundary_checked = B_FALSE;
10320 
10321 	/* If start == 0 then ipf_nf_hdr_len has to be set. */
10322 	ASSERT(start != 0 || ipf->ipf_nf_hdr_len != 0);
10323 
10324 	/* Add in byte count */
10325 	ipf->ipf_count += msg_len;
10326 	if (ipf->ipf_end) {
10327 		/*
10328 		 * We were part way through in-order reassembly, but now there
10329 		 * is a hole.  We walk through messages already queued, and
10330 		 * mark them for hard case reassembly.  We know that up till
10331 		 * now they were in order starting from offset zero.
10332 		 */
10333 		offset = 0;
10334 		for (mp1 = ipf->ipf_mp->b_cont; mp1; mp1 = mp1->b_cont) {
10335 			IP_REASS_SET_START(mp1, offset);
10336 			if (offset == 0) {
10337 				ASSERT(ipf->ipf_nf_hdr_len != 0);
10338 				offset = -ipf->ipf_nf_hdr_len;
10339 			}
10340 			offset += mp1->b_wptr - mp1->b_rptr;
10341 			IP_REASS_SET_END(mp1, offset);
10342 		}
10343 		/* One hole at the end. */
10344 		ipf->ipf_hole_cnt = 1;
10345 		/* Brand it as a hard case, forever. */
10346 		ipf->ipf_end = 0;
10347 	}
10348 	/* Walk through all the new pieces. */
10349 	do {
10350 		end = start + (mp->b_wptr - mp->b_rptr);
10351 		/*
10352 		 * If start is 0, decrease 'end' only for the first mblk of
10353 		 * the fragment. Otherwise 'end' can get wrong value in the
10354 		 * second pass of the loop if first mblk is exactly the
10355 		 * size of ipf_nf_hdr_len.
10356 		 */
10357 		if (start == 0 && !offset_zero_seen) {
10358 			/* First segment */
10359 			ASSERT(ipf->ipf_nf_hdr_len != 0);
10360 			end -= ipf->ipf_nf_hdr_len;
10361 			offset_zero_seen = B_TRUE;
10362 		}
10363 		next_mp = mp->b_cont;
10364 		/*
10365 		 * We are checking to see if there is any interesing data
10366 		 * to process.  If there isn't and the mblk isn't the
10367 		 * one which carries the unfragmentable header then we
10368 		 * drop it.  It's possible to have just the unfragmentable
10369 		 * header come through without any data.  That needs to be
10370 		 * saved.
10371 		 *
10372 		 * If the assert at the top of this function holds then the
10373 		 * term "ipf->ipf_nf_hdr_len != 0" isn't needed.  This code
10374 		 * is infrequently traveled enough that the test is left in
10375 		 * to protect against future code changes which break that
10376 		 * invariant.
10377 		 */
10378 		if (start == end && start != 0 && ipf->ipf_nf_hdr_len != 0) {
10379 			/* Empty.  Blast it. */
10380 			IP_REASS_SET_START(mp, 0);
10381 			IP_REASS_SET_END(mp, 0);
10382 			/*
10383 			 * If the ipf points to the mblk we are about to free,
10384 			 * update ipf to point to the next mblk (or NULL
10385 			 * if none).
10386 			 */
10387 			if (ipf->ipf_mp->b_cont == mp)
10388 				ipf->ipf_mp->b_cont = next_mp;
10389 			freeb(mp);
10390 			continue;
10391 		}
10392 		mp->b_cont = NULL;
10393 		IP_REASS_SET_START(mp, start);
10394 		IP_REASS_SET_END(mp, end);
10395 		if (!ipf->ipf_tail_mp) {
10396 			ipf->ipf_tail_mp = mp;
10397 			ipf->ipf_mp->b_cont = mp;
10398 			if (start == 0 || !more) {
10399 				ipf->ipf_hole_cnt = 1;
10400 				/*
10401 				 * if the first fragment comes in more than one
10402 				 * mblk, this loop will be executed for each
10403 				 * mblk. Need to adjust hole count so exiting
10404 				 * this routine will leave hole count at 1.
10405 				 */
10406 				if (next_mp)
10407 					ipf->ipf_hole_cnt++;
10408 			} else
10409 				ipf->ipf_hole_cnt = 2;
10410 			continue;
10411 		} else if (ipf->ipf_last_frag_seen && !more &&
10412 			    !pkt_boundary_checked) {
10413 			/*
10414 			 * We check datagram boundary only if this fragment
10415 			 * claims to be the last fragment and we have seen a
10416 			 * last fragment in the past too. We do this only
10417 			 * once for a given fragment.
10418 			 *
10419 			 * start cannot be 0 here as fragments with start=0
10420 			 * and MF=0 gets handled as a complete packet. These
10421 			 * fragments should not reach here.
10422 			 */
10423 
10424 			if (start + msgdsize(mp) !=
10425 			    IP_REASS_END(ipf->ipf_tail_mp)) {
10426 				/*
10427 				 * We have two fragments both of which claim
10428 				 * to be the last fragment but gives conflicting
10429 				 * information about the whole datagram size.
10430 				 * Something fishy is going on. Drop the
10431 				 * fragment and free up the reassembly list.
10432 				 */
10433 				return (IP_REASS_FAILED);
10434 			}
10435 
10436 			/*
10437 			 * We shouldn't come to this code block again for this
10438 			 * particular fragment.
10439 			 */
10440 			pkt_boundary_checked = B_TRUE;
10441 		}
10442 
10443 		/* New stuff at or beyond tail? */
10444 		offset = IP_REASS_END(ipf->ipf_tail_mp);
10445 		if (start >= offset) {
10446 			if (ipf->ipf_last_frag_seen) {
10447 				/* current fragment is beyond last fragment */
10448 				return (IP_REASS_FAILED);
10449 			}
10450 			/* Link it on end. */
10451 			ipf->ipf_tail_mp->b_cont = mp;
10452 			ipf->ipf_tail_mp = mp;
10453 			if (more) {
10454 				if (start != offset)
10455 					ipf->ipf_hole_cnt++;
10456 			} else if (start == offset && next_mp == NULL)
10457 					ipf->ipf_hole_cnt--;
10458 			continue;
10459 		}
10460 		mp1 = ipf->ipf_mp->b_cont;
10461 		offset = IP_REASS_START(mp1);
10462 		/* New stuff at the front? */
10463 		if (start < offset) {
10464 			if (start == 0) {
10465 				if (end >= offset) {
10466 					/* Nailed the hole at the begining. */
10467 					ipf->ipf_hole_cnt--;
10468 				}
10469 			} else if (end < offset) {
10470 				/*
10471 				 * A hole, stuff, and a hole where there used
10472 				 * to be just a hole.
10473 				 */
10474 				ipf->ipf_hole_cnt++;
10475 			}
10476 			mp->b_cont = mp1;
10477 			/* Check for overlap. */
10478 			while (end > offset) {
10479 				if (end < IP_REASS_END(mp1)) {
10480 					mp->b_wptr -= end - offset;
10481 					IP_REASS_SET_END(mp, offset);
10482 					if (ill->ill_isv6) {
10483 						BUMP_MIB(ill->ill_ip6_mib,
10484 						    ipv6ReasmPartDups);
10485 					} else {
10486 						BUMP_MIB(&ip_mib,
10487 						    ipReasmPartDups);
10488 					}
10489 					break;
10490 				}
10491 				/* Did we cover another hole? */
10492 				if ((mp1->b_cont &&
10493 				    IP_REASS_END(mp1) !=
10494 				    IP_REASS_START(mp1->b_cont) &&
10495 				    end >= IP_REASS_START(mp1->b_cont)) ||
10496 				    (!ipf->ipf_last_frag_seen && !more)) {
10497 					ipf->ipf_hole_cnt--;
10498 				}
10499 				/* Clip out mp1. */
10500 				if ((mp->b_cont = mp1->b_cont) == NULL) {
10501 					/*
10502 					 * After clipping out mp1, this guy
10503 					 * is now hanging off the end.
10504 					 */
10505 					ipf->ipf_tail_mp = mp;
10506 				}
10507 				IP_REASS_SET_START(mp1, 0);
10508 				IP_REASS_SET_END(mp1, 0);
10509 				/* Subtract byte count */
10510 				ipf->ipf_count -= mp1->b_datap->db_lim -
10511 				    mp1->b_datap->db_base;
10512 				freeb(mp1);
10513 				if (ill->ill_isv6) {
10514 					BUMP_MIB(ill->ill_ip6_mib,
10515 					    ipv6ReasmPartDups);
10516 				} else {
10517 					BUMP_MIB(&ip_mib, ipReasmPartDups);
10518 				}
10519 				mp1 = mp->b_cont;
10520 				if (!mp1)
10521 					break;
10522 				offset = IP_REASS_START(mp1);
10523 			}
10524 			ipf->ipf_mp->b_cont = mp;
10525 			continue;
10526 		}
10527 		/*
10528 		 * The new piece starts somewhere between the start of the head
10529 		 * and before the end of the tail.
10530 		 */
10531 		for (; mp1; mp1 = mp1->b_cont) {
10532 			offset = IP_REASS_END(mp1);
10533 			if (start < offset) {
10534 				if (end <= offset) {
10535 					/* Nothing new. */
10536 					IP_REASS_SET_START(mp, 0);
10537 					IP_REASS_SET_END(mp, 0);
10538 					/* Subtract byte count */
10539 					ipf->ipf_count -= mp->b_datap->db_lim -
10540 					    mp->b_datap->db_base;
10541 					if (incr_dups) {
10542 						ipf->ipf_num_dups++;
10543 						incr_dups = B_FALSE;
10544 					}
10545 					freeb(mp);
10546 					if (ill->ill_isv6) {
10547 						BUMP_MIB(ill->ill_ip6_mib,
10548 						    ipv6ReasmDuplicates);
10549 					} else {
10550 						BUMP_MIB(&ip_mib,
10551 						    ipReasmDuplicates);
10552 					}
10553 					break;
10554 				}
10555 				/*
10556 				 * Trim redundant stuff off beginning of new
10557 				 * piece.
10558 				 */
10559 				IP_REASS_SET_START(mp, offset);
10560 				mp->b_rptr += offset - start;
10561 				if (ill->ill_isv6) {
10562 					BUMP_MIB(ill->ill_ip6_mib,
10563 					    ipv6ReasmPartDups);
10564 				} else {
10565 					BUMP_MIB(&ip_mib, ipReasmPartDups);
10566 				}
10567 				start = offset;
10568 				if (!mp1->b_cont) {
10569 					/*
10570 					 * After trimming, this guy is now
10571 					 * hanging off the end.
10572 					 */
10573 					mp1->b_cont = mp;
10574 					ipf->ipf_tail_mp = mp;
10575 					if (!more) {
10576 						ipf->ipf_hole_cnt--;
10577 					}
10578 					break;
10579 				}
10580 			}
10581 			if (start >= IP_REASS_START(mp1->b_cont))
10582 				continue;
10583 			/* Fill a hole */
10584 			if (start > offset)
10585 				ipf->ipf_hole_cnt++;
10586 			mp->b_cont = mp1->b_cont;
10587 			mp1->b_cont = mp;
10588 			mp1 = mp->b_cont;
10589 			offset = IP_REASS_START(mp1);
10590 			if (end >= offset) {
10591 				ipf->ipf_hole_cnt--;
10592 				/* Check for overlap. */
10593 				while (end > offset) {
10594 					if (end < IP_REASS_END(mp1)) {
10595 						mp->b_wptr -= end - offset;
10596 						IP_REASS_SET_END(mp, offset);
10597 						/*
10598 						 * TODO we might bump
10599 						 * this up twice if there is
10600 						 * overlap at both ends.
10601 						 */
10602 						if (ill->ill_isv6) {
10603 							BUMP_MIB(
10604 							    ill->ill_ip6_mib,
10605 							    ipv6ReasmPartDups);
10606 						} else {
10607 							BUMP_MIB(&ip_mib,
10608 							    ipReasmPartDups);
10609 						}
10610 						break;
10611 					}
10612 					/* Did we cover another hole? */
10613 					if ((mp1->b_cont &&
10614 					    IP_REASS_END(mp1)
10615 					    != IP_REASS_START(mp1->b_cont) &&
10616 					    end >=
10617 					    IP_REASS_START(mp1->b_cont)) ||
10618 					    (!ipf->ipf_last_frag_seen &&
10619 					    !more)) {
10620 						ipf->ipf_hole_cnt--;
10621 					}
10622 					/* Clip out mp1. */
10623 					if ((mp->b_cont = mp1->b_cont) ==
10624 					    NULL) {
10625 						/*
10626 						 * After clipping out mp1,
10627 						 * this guy is now hanging
10628 						 * off the end.
10629 						 */
10630 						ipf->ipf_tail_mp = mp;
10631 					}
10632 					IP_REASS_SET_START(mp1, 0);
10633 					IP_REASS_SET_END(mp1, 0);
10634 					/* Subtract byte count */
10635 					ipf->ipf_count -=
10636 					    mp1->b_datap->db_lim -
10637 					    mp1->b_datap->db_base;
10638 					freeb(mp1);
10639 					if (ill->ill_isv6) {
10640 						BUMP_MIB(ill->ill_ip6_mib,
10641 						    ipv6ReasmPartDups);
10642 					} else {
10643 						BUMP_MIB(&ip_mib,
10644 						    ipReasmPartDups);
10645 					}
10646 					mp1 = mp->b_cont;
10647 					if (!mp1)
10648 						break;
10649 					offset = IP_REASS_START(mp1);
10650 				}
10651 			}
10652 			break;
10653 		}
10654 	} while (start = end, mp = next_mp);
10655 
10656 	/* Fragment just processed could be the last one. Remember this fact */
10657 	if (!more)
10658 		ipf->ipf_last_frag_seen = B_TRUE;
10659 
10660 	/* Still got holes? */
10661 	if (ipf->ipf_hole_cnt)
10662 		return (IP_REASS_PARTIAL);
10663 	/* Clean up overloaded fields to avoid upstream disasters. */
10664 	for (mp1 = ipf->ipf_mp->b_cont; mp1; mp1 = mp1->b_cont) {
10665 		IP_REASS_SET_START(mp1, 0);
10666 		IP_REASS_SET_END(mp1, 0);
10667 	}
10668 	return (IP_REASS_COMPLETE);
10669 }
10670 
10671 /*
10672  * ipsec processing for the fast path, used for input UDP Packets
10673  */
10674 static boolean_t
10675 ip_udp_check(queue_t *q, conn_t *connp, ill_t *ill, ipha_t *ipha,
10676     mblk_t **mpp, mblk_t **first_mpp, boolean_t mctl_present)
10677 {
10678 	uint32_t	ill_index;
10679 	uint_t		in_flags;	/* IPF_RECVSLLA and/or IPF_RECVIF */
10680 
10681 	ASSERT(ipha->ipha_protocol == IPPROTO_UDP);
10682 	/* The ill_index of the incoming ILL */
10683 	ill_index = ((ill_t *)q->q_ptr)->ill_phyint->phyint_ifindex;
10684 
10685 	/* pass packet up to the transport */
10686 	if (CONN_INBOUND_POLICY_PRESENT(connp) || mctl_present) {
10687 		*first_mpp = ipsec_check_inbound_policy(*first_mpp, connp, ipha,
10688 		    NULL, mctl_present);
10689 		if (*first_mpp == NULL) {
10690 			return (B_FALSE);
10691 		}
10692 	}
10693 
10694 	/* Initiate IPPF processing for fastpath UDP */
10695 	if (IPP_ENABLED(IPP_LOCAL_IN)) {
10696 		ip_process(IPP_LOCAL_IN, mpp, ill_index);
10697 		if (*mpp == NULL) {
10698 			ip2dbg(("ip_input_ipsec_process: UDP pkt "
10699 			    "deferred/dropped during IPPF processing\n"));
10700 			return (B_FALSE);
10701 		}
10702 	}
10703 	/*
10704 	 * We make the checks as below since we are in the fast path
10705 	 * and want to minimize the number of checks if the IP_RECVIF and/or
10706 	 * IP_RECVSLLA and/or IPV6_RECVPKTINFO options are not set
10707 	 */
10708 	if (connp->conn_recvif || connp->conn_recvslla ||
10709 	    connp->conn_ipv6_recvpktinfo) {
10710 		if (connp->conn_recvif ||
10711 		    connp->conn_ipv6_recvpktinfo) {
10712 			in_flags = IPF_RECVIF;
10713 		}
10714 		if (connp->conn_recvslla) {
10715 			in_flags |= IPF_RECVSLLA;
10716 		}
10717 		/*
10718 		 * since in_flags are being set ill will be
10719 		 * referenced in ip_add_info, so it better not
10720 		 * be NULL.
10721 		 */
10722 		/*
10723 		 * the actual data will be contained in b_cont
10724 		 * upon successful return of the following call.
10725 		 * If the call fails then the original mblk is
10726 		 * returned.
10727 		 */
10728 		*mpp = ip_add_info(*mpp, ill, in_flags);
10729 	}
10730 
10731 	return (B_TRUE);
10732 }
10733 
10734 /*
10735  * Do fragmentation reassembly.
10736  * returns B_TRUE if successful else B_FALSE.
10737  * frees mp on failure.
10738  */
10739 static boolean_t
10740 ip_rput_fragment(queue_t *q, mblk_t **mpp, ipha_t *ipha)
10741 {
10742 	uint32_t	frag_offset_flags;
10743 	ill_t   *ill = (ill_t *)q->q_ptr;
10744 	mblk_t *mp = *mpp;
10745 	mblk_t *t_mp;
10746 	ipaddr_t	dst;
10747 
10748 	/*
10749 	 * Drop the fragmented as early as possible, if
10750 	 * we don't have resource(s) to re-assemble.
10751 	 */
10752 
10753 	if (ip_reass_queue_bytes == 0) {
10754 		freemsg(mp);
10755 		return (B_FALSE);
10756 	}
10757 
10758 	dst = ipha->ipha_dst;
10759 
10760 	/* Clear hardware checksumming flag if set */
10761 	mp->b_datap->db_struioun.cksum.flags = 0;
10762 
10763 	/* Check for fragmentation offset. */
10764 	frag_offset_flags = ntohs(ipha->ipha_fragment_offset_and_flags) &
10765 	    (IPH_MF | IPH_OFFSET);
10766 	if (frag_offset_flags) {
10767 		ipf_t		*ipf;
10768 		ipf_t		**ipfp;
10769 		ipfb_t		*ipfb;
10770 		uint16_t	ident;
10771 		uint32_t	offset;
10772 		ipaddr_t	src;
10773 		uint_t		hdr_length;
10774 		uint32_t	end;
10775 		uint8_t		proto;
10776 		mblk_t		*mp1;
10777 		mblk_t		*tail_mp;
10778 		size_t		count;
10779 		size_t		msg_len;
10780 		uint8_t		ecn_info = 0;
10781 		uint32_t	packet_size;
10782 		boolean_t 	pruned = B_FALSE;
10783 
10784 		ident = ipha->ipha_ident;
10785 		offset = (frag_offset_flags << 3) & 0xFFFF;
10786 		src = ipha->ipha_src;
10787 		hdr_length = IPH_HDR_LENGTH(ipha);
10788 		end = ntohs(ipha->ipha_length) - hdr_length;
10789 
10790 		/*
10791 		 * if end == 0 then we have a packet with no data, so just
10792 		 * free it.
10793 		 */
10794 		if (end == 0) {
10795 			freemsg(mp);
10796 			return (B_FALSE);
10797 		}
10798 		proto = ipha->ipha_protocol;
10799 
10800 		/*
10801 		 * Fragmentation reassembly.  Each ILL has a hash table for
10802 		 * queuing packets undergoing reassembly for all IPIFs
10803 		 * associated with the ILL.  The hash is based on the packet
10804 		 * IP ident field.  The ILL frag hash table was allocated
10805 		 * as a timer block at the time the ILL was created.  Whenever
10806 		 * there is anything on the reassembly queue, the timer will
10807 		 * be running.
10808 		 */
10809 		ASSERT(ill != NULL);
10810 
10811 		/* Record the ECN field info. */
10812 		ecn_info = (ipha->ipha_type_of_service & 0x3);
10813 		if (offset != 0) {
10814 			/*
10815 			 * If this isn't the first piece, strip the header, and
10816 			 * add the offset to the end value.
10817 			 */
10818 			mp->b_rptr += hdr_length;
10819 			end += offset;
10820 		}
10821 
10822 		msg_len = mp->b_datap->db_lim - mp->b_datap->db_base;
10823 		tail_mp = mp;
10824 		while (tail_mp->b_cont != NULL) {
10825 			tail_mp = tail_mp->b_cont;
10826 			msg_len += tail_mp->b_datap->db_lim -
10827 			    tail_mp->b_datap->db_base;
10828 		}
10829 
10830 		/*
10831 		 * If the reassembly list for this ILL will get too big
10832 		 * prune it.
10833 		 */
10834 		if ((msg_len + sizeof (*ipf) + ill->ill_frag_count) >=
10835 		    ip_reass_queue_bytes) {
10836 			ill_frag_prune(ill,
10837 			    (ip_reass_queue_bytes < msg_len) ? 0 :
10838 			    (ip_reass_queue_bytes - msg_len));
10839 			pruned = B_TRUE;
10840 		}
10841 
10842 		ipfb = &ill->ill_frag_hash_tbl[ILL_FRAG_HASH(src, ident)];
10843 		mutex_enter(&ipfb->ipfb_lock);
10844 
10845 		ipfp = &ipfb->ipfb_ipf;
10846 		/* Try to find an existing fragment queue for this packet. */
10847 		for (;;) {
10848 			ipf = ipfp[0];
10849 			if (ipf != NULL) {
10850 				/*
10851 				 * It has to match on ident and src/dst address.
10852 				 */
10853 				if (ipf->ipf_ident == ident &&
10854 				    ipf->ipf_src == src &&
10855 				    ipf->ipf_dst == dst &&
10856 				    ipf->ipf_protocol == proto) {
10857 					/*
10858 					 * If we have received too many
10859 					 * duplicate fragments for this packet
10860 					 * free it.
10861 					 */
10862 					if (ipf->ipf_num_dups >
10863 					    ip_max_frag_dups) {
10864 						ill_frag_free_pkts(ill, ipfb,
10865 						    ipf, 1);
10866 						freemsg(mp);
10867 						mutex_exit(&ipfb->ipfb_lock);
10868 						return (B_FALSE);
10869 					}
10870 					/* Found it. */
10871 					break;
10872 				}
10873 				ipfp = &ipf->ipf_hash_next;
10874 				continue;
10875 			}
10876 
10877 			/*
10878 			 * If we pruned the list, do we want to store this new
10879 			 * fragment?. We apply an optimization here based on the
10880 			 * fact that most fragments will be received in order.
10881 			 * So if the offset of this incoming fragment is zero,
10882 			 * it is the first fragment of a new packet. We will
10883 			 * keep it.  Otherwise drop the fragment, as we have
10884 			 * probably pruned the packet already (since the
10885 			 * packet cannot be found).
10886 			 */
10887 			if (pruned && offset != 0) {
10888 				mutex_exit(&ipfb->ipfb_lock);
10889 				freemsg(mp);
10890 				return (B_FALSE);
10891 			}
10892 
10893 			if (ipfb->ipfb_frag_pkts >= MAX_FRAG_PKTS)  {
10894 				/*
10895 				 * Too many fragmented packets in this hash
10896 				 * bucket. Free the oldest.
10897 				 */
10898 				ill_frag_free_pkts(ill, ipfb, ipfb->ipfb_ipf,
10899 				    1);
10900 			}
10901 
10902 			/* New guy.  Allocate a frag message. */
10903 			mp1 = allocb(sizeof (*ipf), BPRI_MED);
10904 			if (mp1 == NULL) {
10905 				BUMP_MIB(&ip_mib, ipInDiscards);
10906 				freemsg(mp);
10907 reass_done:
10908 				mutex_exit(&ipfb->ipfb_lock);
10909 				return (B_FALSE);
10910 			}
10911 
10912 
10913 			BUMP_MIB(&ip_mib, ipReasmReqds);
10914 			mp1->b_cont = mp;
10915 
10916 			/* Initialize the fragment header. */
10917 			ipf = (ipf_t *)mp1->b_rptr;
10918 			ipf->ipf_mp = mp1;
10919 			ipf->ipf_ptphn = ipfp;
10920 			ipfp[0] = ipf;
10921 			ipf->ipf_hash_next = NULL;
10922 			ipf->ipf_ident = ident;
10923 			ipf->ipf_protocol = proto;
10924 			ipf->ipf_src = src;
10925 			ipf->ipf_dst = dst;
10926 			ipf->ipf_nf_hdr_len = 0;
10927 			/* Record reassembly start time. */
10928 			ipf->ipf_timestamp = gethrestime_sec();
10929 			/* Record ipf generation and account for frag header */
10930 			ipf->ipf_gen = ill->ill_ipf_gen++;
10931 			ipf->ipf_count = mp1->b_datap->db_lim -
10932 			    mp1->b_datap->db_base;
10933 			ipf->ipf_last_frag_seen = B_FALSE;
10934 			ipf->ipf_ecn = ecn_info;
10935 			ipf->ipf_num_dups = 0;
10936 			ipfb->ipfb_frag_pkts++;
10937 
10938 			/*
10939 			 * We handle reassembly two ways.  In the easy case,
10940 			 * where all the fragments show up in order, we do
10941 			 * minimal bookkeeping, and just clip new pieces on
10942 			 * the end.  If we ever see a hole, then we go off
10943 			 * to ip_reassemble which has to mark the pieces and
10944 			 * keep track of the number of holes, etc.  Obviously,
10945 			 * the point of having both mechanisms is so we can
10946 			 * handle the easy case as efficiently as possible.
10947 			 */
10948 			if (offset == 0) {
10949 				/* Easy case, in-order reassembly so far. */
10950 				ipf->ipf_count += msg_len;
10951 				ipf->ipf_tail_mp = tail_mp;
10952 				/*
10953 				 * Keep track of next expected offset in
10954 				 * ipf_end.
10955 				 */
10956 				ipf->ipf_end = end;
10957 				ipf->ipf_nf_hdr_len = hdr_length;
10958 			} else {
10959 				/* Hard case, hole at the beginning. */
10960 				ipf->ipf_tail_mp = NULL;
10961 				/*
10962 				 * ipf_end == 0 means that we have given up
10963 				 * on easy reassembly.
10964 				 */
10965 				ipf->ipf_end = 0;
10966 				/*
10967 				 * ipf_hole_cnt is set by ip_reassemble.
10968 				 * ipf_count is updated by ip_reassemble.
10969 				 * No need to check for return value here
10970 				 * as we don't expect reassembly to complete
10971 				 * or fail for the first fragment itself.
10972 				 */
10973 				(void) ip_reassemble(mp, ipf,
10974 				    (frag_offset_flags & IPH_OFFSET) << 3,
10975 				    (frag_offset_flags & IPH_MF), ill, msg_len);
10976 			}
10977 			/* Update per ipfb and ill byte counts */
10978 			ipfb->ipfb_count += ipf->ipf_count;
10979 			ASSERT(ipfb->ipfb_count > 0);	/* Wraparound */
10980 			ill->ill_frag_count += ipf->ipf_count;
10981 			ASSERT(ill->ill_frag_count > 0); /* Wraparound */
10982 			/* If the frag timer wasn't already going, start it. */
10983 			mutex_enter(&ill->ill_lock);
10984 			ill_frag_timer_start(ill);
10985 			mutex_exit(&ill->ill_lock);
10986 			goto reass_done;
10987 		}
10988 
10989 		/*
10990 		 * We have a new piece of a datagram which is already being
10991 		 * reassembled.  Update the ECN info if all IP fragments
10992 		 * are ECN capable.  If there is one which is not, clear
10993 		 * all the info.  If there is at least one which has CE
10994 		 * code point, IP needs to report that up to transport.
10995 		 */
10996 		if (ecn_info != IPH_ECN_NECT && ipf->ipf_ecn != IPH_ECN_NECT) {
10997 			if (ecn_info == IPH_ECN_CE)
10998 				ipf->ipf_ecn = IPH_ECN_CE;
10999 		} else {
11000 			ipf->ipf_ecn = IPH_ECN_NECT;
11001 		}
11002 		if (offset && ipf->ipf_end == offset) {
11003 			/* The new fragment fits at the end */
11004 			ipf->ipf_tail_mp->b_cont = mp;
11005 			/* Update the byte count */
11006 			ipf->ipf_count += msg_len;
11007 			/* Update per ipfb and ill byte counts */
11008 			ipfb->ipfb_count += msg_len;
11009 			ASSERT(ipfb->ipfb_count > 0);	/* Wraparound */
11010 			ill->ill_frag_count += msg_len;
11011 			ASSERT(ill->ill_frag_count > 0); /* Wraparound */
11012 			if (frag_offset_flags & IPH_MF) {
11013 				/* More to come. */
11014 				ipf->ipf_end = end;
11015 				ipf->ipf_tail_mp = tail_mp;
11016 				goto reass_done;
11017 			}
11018 		} else {
11019 			/* Go do the hard cases. */
11020 			int ret;
11021 
11022 			if (offset == 0)
11023 				ipf->ipf_nf_hdr_len = hdr_length;
11024 
11025 			/* Save current byte count */
11026 			count = ipf->ipf_count;
11027 			ret = ip_reassemble(mp, ipf,
11028 			    (frag_offset_flags & IPH_OFFSET) << 3,
11029 			    (frag_offset_flags & IPH_MF), ill, msg_len);
11030 			/* Count of bytes added and subtracted (freeb()ed) */
11031 			count = ipf->ipf_count - count;
11032 			if (count) {
11033 				/* Update per ipfb and ill byte counts */
11034 				ipfb->ipfb_count += count;
11035 				ASSERT(ipfb->ipfb_count > 0); /* Wraparound */
11036 				ill->ill_frag_count += count;
11037 				ASSERT(ill->ill_frag_count > 0);
11038 			}
11039 			if (ret == IP_REASS_PARTIAL) {
11040 				goto reass_done;
11041 			} else if (ret == IP_REASS_FAILED) {
11042 				/* Reassembly failed. Free up all resources */
11043 				ill_frag_free_pkts(ill, ipfb, ipf, 1);
11044 				for (t_mp = mp; t_mp != NULL;
11045 				    t_mp = t_mp->b_cont) {
11046 					IP_REASS_SET_START(t_mp, 0);
11047 					IP_REASS_SET_END(t_mp, 0);
11048 				}
11049 				freemsg(mp);
11050 				goto reass_done;
11051 			}
11052 			/* We will reach here iff 'ret' is IP_REASS_COMPLETE */
11053 		}
11054 		/*
11055 		 * We have completed reassembly.  Unhook the frag header from
11056 		 * the reassembly list.
11057 		 *
11058 		 * Before we free the frag header, record the ECN info
11059 		 * to report back to the transport.
11060 		 */
11061 		ecn_info = ipf->ipf_ecn;
11062 		BUMP_MIB(&ip_mib, ipReasmOKs);
11063 		ipfp = ipf->ipf_ptphn;
11064 		mp1 = ipf->ipf_mp;
11065 		count = ipf->ipf_count;
11066 		ipf = ipf->ipf_hash_next;
11067 		if (ipf)
11068 			ipf->ipf_ptphn = ipfp;
11069 		ipfp[0] = ipf;
11070 		ill->ill_frag_count -= count;
11071 		ASSERT(ipfb->ipfb_count >= count);
11072 		ipfb->ipfb_count -= count;
11073 		ipfb->ipfb_frag_pkts--;
11074 		mutex_exit(&ipfb->ipfb_lock);
11075 		/* Ditch the frag header. */
11076 		mp = mp1->b_cont;
11077 
11078 		freeb(mp1);
11079 
11080 		/* Restore original IP length in header. */
11081 		packet_size = (uint32_t)msgdsize(mp);
11082 		if (packet_size > IP_MAXPACKET) {
11083 			freemsg(mp);
11084 			BUMP_MIB(&ip_mib, ipInHdrErrors);
11085 			return (B_FALSE);
11086 		}
11087 
11088 		if (mp->b_datap->db_ref > 1) {
11089 			mblk_t *mp2;
11090 
11091 			mp2 = copymsg(mp);
11092 			freemsg(mp);
11093 			if (!mp2) {
11094 				BUMP_MIB(&ip_mib, ipInDiscards);
11095 				return (B_FALSE);
11096 			}
11097 			mp = mp2;
11098 		}
11099 		ipha = (ipha_t *)mp->b_rptr;
11100 
11101 		ipha->ipha_length = htons((uint16_t)packet_size);
11102 		/* We're now complete, zip the frag state */
11103 		ipha->ipha_fragment_offset_and_flags = 0;
11104 		/* Record the ECN info. */
11105 		ipha->ipha_type_of_service &= 0xFC;
11106 		ipha->ipha_type_of_service |= ecn_info;
11107 		*mpp = mp;
11108 
11109 	}
11110 	return (B_TRUE);
11111 }
11112 
11113 /*
11114  * Perform ip header check sum update local options.
11115  * return B_TRUE if all is well, else return B_FALSE and release
11116  * the mp. caller is responsible for decrementing ire ref cnt.
11117  */
11118 static boolean_t
11119 ip_options_cksum(queue_t *q, mblk_t *mp, ipha_t *ipha, ire_t *ire)
11120 {
11121 	mblk_t		*first_mp;
11122 	boolean_t	mctl_present;
11123 	uint16_t	sum;
11124 
11125 	EXTRACT_PKT_MP(mp, first_mp, mctl_present);
11126 	/*
11127 	 * Don't do the checksum if it has gone through AH/ESP
11128 	 * processing.
11129 	 */
11130 	if (!mctl_present) {
11131 		sum = ip_csum_hdr(ipha);
11132 		if (sum != 0) {
11133 			BUMP_MIB(&ip_mib, ipInCksumErrs);
11134 			freemsg(first_mp);
11135 			return (B_FALSE);
11136 		}
11137 	}
11138 
11139 	if (!ip_rput_local_options(q, mp, ipha, ire)) {
11140 		if (mctl_present)
11141 			freeb(first_mp);
11142 		return (B_FALSE);
11143 	}
11144 
11145 	return (B_TRUE);
11146 }
11147 
11148 /*
11149  * All udp packet are delivered to the local host via this routine.
11150  */
11151 void
11152 ip_udp_input(queue_t *q, mblk_t *mp, ipha_t *ipha, ire_t *ire,
11153     ill_t *recv_ill)
11154 {
11155 	uint32_t	sum;
11156 	uint32_t	u1;
11157 	uint32_t	u2;
11158 	boolean_t	mctl_present;
11159 	conn_t		*connp;
11160 	mblk_t		*first_mp;
11161 	mblk_t		*mp1;
11162 	dblk_t		*dp;
11163 	uint16_t	*up;
11164 	ill_t		*ill = (ill_t *)q->q_ptr;
11165 	uint32_t	ports;
11166 	boolean_t	cksum_computed = B_FALSE;
11167 
11168 #define	rptr    ((uchar_t *)ipha)
11169 
11170 	EXTRACT_PKT_MP(mp, first_mp, mctl_present);
11171 	ASSERT(!mctl_present || ipsec_in_is_secure(first_mp));
11172 	ASSERT(ipha->ipha_protocol == IPPROTO_UDP);
11173 
11174 	/*
11175 	 * FAST PATH for udp packets
11176 	 */
11177 
11178 	/* u1 is # words of IP options */
11179 	u1 = ipha->ipha_version_and_hdr_length - (uchar_t)((IP_VERSION << 4) +
11180 	    IP_SIMPLE_HDR_LENGTH_IN_WORDS);
11181 
11182 	/* IP options present */
11183 	if (u1)
11184 		goto ipoptions;
11185 
11186 #define	IS_IPHDR_HWCKSUM(mctl_present, mp, ill)				\
11187 	((!mctl_present) && (mp->b_datap->db_struioun.cksum.flags &	\
11188 	HCK_IPV4_HDRCKSUM) && (ill->ill_capabilities &			\
11189 	ILL_CAPAB_HCKSUM) && dohwcksum)
11190 
11191 	/* Check the IP header checksum.  */
11192 	if (IS_IPHDR_HWCKSUM(mctl_present, mp, ill)) {
11193 		/* Clear the IP header h/w cksum flag */
11194 		mp->b_datap->db_struioun.cksum.flags &=
11195 		    ~HCK_IPV4_HDRCKSUM;
11196 	} else {
11197 #define	uph	((uint16_t *)ipha)
11198 		sum = uph[0] + uph[1] + uph[2] + uph[3] + uph[4] + uph[5] +
11199 		    uph[6] + uph[7] + uph[8] + uph[9];
11200 #undef	uph
11201 		/* finish doing IP checksum */
11202 		sum = (sum & 0xFFFF) + (sum >> 16);
11203 		sum = ~(sum + (sum >> 16)) & 0xFFFF;
11204 		/*
11205 		 * Don't verify header checksum if this packet is coming
11206 		 * back from AH/ESP as we already did it.
11207 		 */
11208 		if (!mctl_present && (sum && sum != 0xFFFF)) {
11209 			BUMP_MIB(&ip_mib, ipInCksumErrs);
11210 			freemsg(first_mp);
11211 			return;
11212 		}
11213 	}
11214 
11215 	/*
11216 	 * Count for SNMP of inbound packets for ire.
11217 	 * if mctl is present this might be a secure packet and
11218 	 * has already been counted for in ip_proto_input().
11219 	 */
11220 	if (!mctl_present) {
11221 		UPDATE_IB_PKT_COUNT(ire);
11222 		ire->ire_last_used_time = lbolt;
11223 	}
11224 
11225 	/* packet part of fragmented IP packet? */
11226 	u1 = ntohs(ipha->ipha_fragment_offset_and_flags);
11227 	if (u1 & (IPH_MF | IPH_OFFSET)) {
11228 		goto fragmented;
11229 	}
11230 
11231 	/* u1 = IP header length (20 bytes) */
11232 	u1 = IP_SIMPLE_HDR_LENGTH;
11233 
11234 	/* packet does not contain complete IP & UDP headers */
11235 	if ((mp->b_wptr - rptr) < (IP_SIMPLE_HDR_LENGTH + UDPH_SIZE))
11236 		goto udppullup;
11237 	/* up points to UDP header */
11238 	up = (uint16_t *)((uchar_t *)ipha + IP_SIMPLE_HDR_LENGTH);
11239 #define	iphs    ((uint16_t *)ipha)
11240 
11241 #define	IP_CKSUM_RECV(len, u1, u2, mp, mp1, error, dp) {		\
11242 	boolean_t	doswcksum = B_TRUE;				\
11243 	uint_t		hcksumflags = 0;				\
11244 									\
11245 	hcksumflags = dp->db_struioun.cksum.flags;			\
11246 									\
11247 	/* Clear the hardware checksum flags; they have been consumed */\
11248 	dp->db_struioun.cksum.flags = 0;				\
11249 	if (hcksumflags && (ill->ill_capabilities & ILL_CAPAB_HCKSUM) &&\
11250 		dohwcksum) {						\
11251 		if (hcksumflags & HCK_FULLCKSUM) {			\
11252 			/* 						\
11253 			 * Full checksum has been computed by the	\
11254 			 * hardware and has been attached. 		\
11255 			 */						\
11256 			doswcksum = B_FALSE;				\
11257 			if (!(hcksumflags & HCK_FULLCKSUM_OK) &&	\
11258 			    (dp->db_cksum16 != 0xffff)) {		\
11259 				ipcsumdbg("full hwcksumerr\n", mp);	\
11260 				goto error;				\
11261 			}						\
11262 		} else if ((hcksumflags & HCK_PARTIALCKSUM) &&		\
11263 		    (((len = (IP_SIMPLE_HDR_LENGTH - dp->db_cksumstart))\
11264 		    & 1) == 0)) {					\
11265 			uint32_t	tot_len = 0;			\
11266 									\
11267 			doswcksum = B_FALSE;				\
11268 			/* Partial checksum computed */			\
11269 			u1 += dp->db_cksum16;				\
11270 			tot_len = mp->b_wptr - mp->b_rptr;		\
11271 			if (!mp1)					\
11272 				mp1 = mp;				\
11273 			else						\
11274 				tot_len += mp1->b_wptr - mp1->b_rptr;	\
11275 			if (len > 0) {					\
11276 				/* 					\
11277 				 * Prepended extraneous data. Adjust	\
11278 				 * checksum.				\
11279 				 */					\
11280 				u2 = IP_BCSUM_PARTIAL((uchar_t *)(rptr +\
11281 				    dp->db_cksumstart),	(int32_t)len, 	\
11282 				    0);					\
11283 			} else						\
11284 				u2 = 0;					\
11285 			if ((len = (dp->db_cksumend - tot_len)) > 0) {	\
11286 				/* 					\
11287 				 * Postpended extraneous data. Adjust	\
11288 				 * checksum.				\
11289 				 */					\
11290 				uint32_t	u3;			\
11291 									\
11292 				u3 = IP_BCSUM_PARTIAL(mp1->b_wptr, 	\
11293 				    (int32_t)len, 0);			\
11294 				if ((uintptr_t)mp1->b_wptr & 1)		\
11295 					/*				\
11296 					 * Postpended extraneous data	\
11297 					 * was odd byte aligned, so 	\
11298 					 * swap resulting checksum 	\
11299 					 * bytes.			\
11300 					 */				\
11301 					u2 += ((u3 << 8) & 0xffff) | 	\
11302 					    (u3 >> 8);			\
11303 				else					\
11304 					u2 += u3;			\
11305 				u2 = (u2 & 0xFFFF) + ((int)(u2) >> 16);	\
11306 			}						\
11307 			/*						\
11308 			 * One's complement subtract extraneous checksum\
11309 			 */						\
11310 			if (u2 >= u1)					\
11311 				u1 = ~(u2 - u1) & 0xFFFF;		\
11312 			else						\
11313 				u1 -= u2;				\
11314 			u1 = (u1 & 0xFFFF) + ((int)u1 >> 16);		\
11315 			if (~(u1) & 0xFFFF) {				\
11316 				ipcsumdbg("partial hwcksumerr\n", mp);	\
11317 				goto error;				\
11318 			}						\
11319 		} 							\
11320 	} 								\
11321 	if (doswcksum) {						\
11322 		IP_STAT(ip_in_sw_cksum);				\
11323 		if ((IP_CSUM(mp, (int32_t)((uchar_t *)up -		\
11324 		    (uchar_t *)ipha), u1)) != 0) {			\
11325 			ipcsumdbg("swcksumerr\n", mp);			\
11326 			goto error;					\
11327 		}							\
11328 	}								\
11329 }
11330 
11331 	dp = mp->b_datap;
11332 	/* if udp hdr cksum != 0, then need to checksum udp packet */
11333 	if (up[3]) {
11334 		cksum_computed = B_TRUE;
11335 		/* multiple mblks of udp data? */
11336 		if ((mp1 = mp->b_cont) != NULL) {
11337 			/* more than two? */
11338 			if (mp1->b_cont)
11339 				goto multipktudp;
11340 		}
11341 
11342 		/* Pseudo-header checksum */
11343 		u1 = IP_UDP_CSUM_COMP + iphs[6] + iphs[7] + iphs[8] +
11344 		    iphs[9] + up[2];
11345 		if (!mctl_present) {
11346 			ssize_t len = 0;
11347 
11348 			IP_CKSUM_RECV(len, u1, u2, mp, mp1, udpcksumerr, dp);
11349 		} else {
11350 multipktudp:
11351 			IP_STAT(ip_in_sw_cksum);
11352 			if ((IP_CSUM(mp, (int32_t)((uchar_t *)up -
11353 			    (uchar_t *)ipha), u1)) != 0) {
11354 udpcksumerr:
11355 				ip1dbg(("ip_udp_input: bad udp checksum\n"));
11356 				BUMP_MIB(&ip_mib, udpInCksumErrs);
11357 				freemsg(first_mp);
11358 				return;
11359 			}
11360 		}
11361 	}
11362 
11363 	/* broadcast IP packet? */
11364 	if (ire->ire_type == IRE_BROADCAST)
11365 		goto udpslowpath;
11366 
11367 	if ((connp = ipcl_classify_v4(mp, IPPROTO_UDP, IP_SIMPLE_HDR_LENGTH,
11368 	    ire->ire_zoneid)) != NULL) {
11369 		ASSERT(connp->conn_upq != NULL);
11370 		IP_STAT(ip_udp_fast_path);
11371 
11372 		if (!canputnext(connp->conn_upq)) {
11373 			freemsg(mp);
11374 			BUMP_MIB(&ip_mib, udpInOverflows);
11375 		} else {
11376 			if (!mctl_present) {
11377 				BUMP_MIB(&ip_mib, ipInDelivers);
11378 			}
11379 			/*
11380 			 * mp and first_mp can change.
11381 			 */
11382 			if (ip_udp_check(q, connp, recv_ill,
11383 			    ipha, &mp, &first_mp, mctl_present)) {
11384 				putnext(connp->conn_upq, mp);
11385 			}
11386 		}
11387 		/*
11388 		 * freeb() cannot deal with null mblk being passed
11389 		 * in and first_mp can be set to null in the call
11390 		 * ipsec_input_fast_proc()->ipsec_check_inbound_policy.
11391 		 */
11392 		if (mctl_present && first_mp != NULL) {
11393 			freeb(first_mp);
11394 		}
11395 		CONN_DEC_REF(connp);
11396 		return;
11397 	}
11398 
11399 	/*
11400 	 * if we got here we know the packet is not fragmented and
11401 	 * has no options. The classifier could not find a conn_t and
11402 	 * most likely its an icmp packet so send it through slow path.
11403 	 */
11404 
11405 	goto udpslowpath;
11406 
11407 ipoptions:
11408 	if (!ip_options_cksum(q, mp, ipha, ire)) {
11409 		goto slow_done;
11410 	}
11411 
11412 	UPDATE_IB_PKT_COUNT(ire);
11413 	ire->ire_last_used_time = lbolt;
11414 	u1 = ntohs(ipha->ipha_fragment_offset_and_flags);
11415 	if (u1 & (IPH_MF | IPH_OFFSET)) {
11416 fragmented:
11417 		if (!ip_rput_fragment(q, &mp, ipha)) {
11418 			goto slow_done;
11419 		}
11420 		/*
11421 		 * Make sure that first_mp points back to mp as
11422 		 * the mp we came in with could have changed in
11423 		 * ip_rput_fragment().
11424 		 */
11425 		ASSERT(!mctl_present);
11426 		ipha = (ipha_t *)mp->b_rptr;
11427 		first_mp = mp;
11428 	}
11429 
11430 	/* Now we have a complete datagram, destined for this machine. */
11431 	u1 = IPH_HDR_LENGTH(ipha);
11432 	/* Pull up the UDP header, if necessary. */
11433 	if ((mp->b_wptr - mp->b_rptr) < (u1 + UDPH_SIZE)) {
11434 udppullup:
11435 		if (!pullupmsg(mp, u1 + UDPH_SIZE)) {
11436 			BUMP_MIB(&ip_mib, ipInDiscards);
11437 			freemsg(first_mp);
11438 			goto slow_done;
11439 		}
11440 		ipha = (ipha_t *)mp->b_rptr;
11441 	}
11442 	/*
11443 	 * Validate the checksum.  This code is a bit funny looking
11444 	 * but may help out the compiler in this crucial spot.
11445 	 */
11446 	up = (uint16_t *)((uchar_t *)ipha + u1 + UDP_PORTS_OFFSET);
11447 	if (!cksum_computed && up[3]) {
11448 		IP_STAT(ip_in_sw_cksum);
11449 		sum = IP_CSUM(mp, (int32_t)((uchar_t *)up - (uchar_t *)ipha),
11450 		    IP_UDP_CSUM_COMP + iphs[6] +
11451 		    iphs[7] + iphs[8] +
11452 		    iphs[9] + up[2]);
11453 		if (sum != 0) {
11454 			ip1dbg(("ip_udp_input: bad udp checksum\n"));
11455 				BUMP_MIB(&ip_mib, udpInCksumErrs);
11456 				freemsg(first_mp);
11457 				goto slow_done;
11458 		}
11459 	}
11460 udpslowpath:
11461 
11462 	ports = *(uint32_t *)up;
11463 	/* Clear hardware checksum flag */
11464 	mp->b_datap->db_struioun.cksum.flags = 0;
11465 	ip_fanout_udp(q, first_mp, ill, ipha, ports,
11466 	    (ire->ire_type == IRE_BROADCAST),
11467 	    IP_FF_SEND_ICMP | IP_FF_CKSUM | IP_FF_IP6INFO,
11468 	    mctl_present, B_TRUE, recv_ill, ire->ire_zoneid);
11469 
11470 slow_done:
11471 	IP_STAT(ip_udp_slow_path);
11472 	return;
11473 
11474 #undef  rptr
11475 }
11476 
11477 /* ARGSUSED */
11478 static mblk_t *
11479 ip_tcp_input(mblk_t *mp, ipha_t *ipha, ill_t *recv_ill, boolean_t mctl_present,
11480     ire_t *ire, mblk_t *first_mp, uint_t flags, queue_t *q,
11481     ill_rx_ring_t *ill_ring)
11482 {
11483 	conn_t		*connp;
11484 	uint32_t	sum;
11485 	uint32_t	u1;
11486 	uint32_t	u2;
11487 	uint16_t	*up;
11488 	int		offset;
11489 	ssize_t		len;
11490 	mblk_t		*mp1;
11491 	dblk_t		*dp;
11492 	boolean_t	syn_present = B_FALSE;
11493 	tcph_t		*tcph;
11494 	uint_t		ip_hdr_len;
11495 	ill_t		*ill = (ill_t *)q->q_ptr;
11496 	zoneid_t	zoneid = ire->ire_zoneid;
11497 
11498 #define	rptr	((uchar_t *)ipha)
11499 
11500 	ASSERT(ipha->ipha_protocol == IPPROTO_TCP);
11501 
11502 	/*
11503 	 * FAST PATH for tcp packets
11504 	 */
11505 
11506 	/* u1 is # words of IP options */
11507 	u1 = ipha->ipha_version_and_hdr_length - (uchar_t)((IP_VERSION << 4)
11508 	    + IP_SIMPLE_HDR_LENGTH_IN_WORDS);
11509 
11510 	/* IP options present */
11511 	if (u1) {
11512 		goto ipoptions;
11513 	} else {
11514 		/* Check the IP header checksum.  */
11515 		if (IS_IPHDR_HWCKSUM(mctl_present, mp, ill)) {
11516 			/* Clear the IP header h/w cksum flag */
11517 			mp->b_datap->db_struioun.cksum.flags &=
11518 			    ~HCK_IPV4_HDRCKSUM;
11519 		} else {
11520 #define	uph	((uint16_t *)ipha)
11521 			sum = uph[0] + uph[1] + uph[2] + uph[3] + uph[4] +
11522 			    uph[5] + uph[6] + uph[7] + uph[8] + uph[9];
11523 #undef	uph
11524 			/* finish doing IP checksum */
11525 			sum = (sum & 0xFFFF) + (sum >> 16);
11526 			sum = ~(sum + (sum >> 16)) & 0xFFFF;
11527 			/*
11528 			 * Don't verify header checksum if this packet
11529 			 * is coming back from AH/ESP as we already did it.
11530 			 */
11531 			if (!mctl_present && (sum != 0) && sum != 0xFFFF) {
11532 				BUMP_MIB(&ip_mib, ipInCksumErrs);
11533 				goto error;
11534 			}
11535 		}
11536 	}
11537 
11538 	if (!mctl_present) {
11539 		UPDATE_IB_PKT_COUNT(ire);
11540 		ire->ire_last_used_time = lbolt;
11541 	}
11542 
11543 	/* packet part of fragmented IP packet? */
11544 	u1 = ntohs(ipha->ipha_fragment_offset_and_flags);
11545 	if (u1 & (IPH_MF | IPH_OFFSET)) {
11546 		goto fragmented;
11547 	}
11548 
11549 	/* u1 = IP header length (20 bytes) */
11550 	u1 = ip_hdr_len = IP_SIMPLE_HDR_LENGTH;
11551 
11552 	/* does packet contain IP+TCP headers? */
11553 	len = mp->b_wptr - rptr;
11554 	if (len < (IP_SIMPLE_HDR_LENGTH + TCP_MIN_HEADER_LENGTH)) {
11555 		IP_STAT(ip_tcppullup);
11556 		goto tcppullup;
11557 	}
11558 
11559 	/* TCP options present? */
11560 	offset = ((uchar_t *)ipha)[IP_SIMPLE_HDR_LENGTH + 12] >> 4;
11561 
11562 	/*
11563 	 * If options need to be pulled up, then goto tcpoptions.
11564 	 * otherwise we are still in the fast path
11565 	 */
11566 	if (len < (offset << 2) + IP_SIMPLE_HDR_LENGTH) {
11567 		IP_STAT(ip_tcpoptions);
11568 		goto tcpoptions;
11569 	}
11570 
11571 	/* multiple mblks of tcp data? */
11572 	if ((mp1 = mp->b_cont) != NULL) {
11573 		/* more then two? */
11574 		if (mp1->b_cont != NULL) {
11575 			IP_STAT(ip_multipkttcp);
11576 			goto multipkttcp;
11577 		}
11578 		len += mp1->b_wptr - mp1->b_rptr;
11579 	}
11580 
11581 	up = (uint16_t *)(rptr + IP_SIMPLE_HDR_LENGTH + TCP_PORTS_OFFSET);
11582 
11583 	/* part of pseudo checksum */
11584 
11585 	/* TCP datagram length */
11586 	u1 = len - IP_SIMPLE_HDR_LENGTH;
11587 
11588 #define	iphs    ((uint16_t *)ipha)
11589 
11590 #ifdef	_BIG_ENDIAN
11591 	u1 += IPPROTO_TCP;
11592 #else
11593 	u1 = ((u1 >> 8) & 0xFF) + (((u1 & 0xFF) + IPPROTO_TCP) << 8);
11594 #endif
11595 	u1 += iphs[6] + iphs[7] + iphs[8] + iphs[9];
11596 
11597 
11598 	/*
11599 	 * If the packet has gone through AH/ESP, do the checksum here
11600 	 * itself.
11601 	 *
11602 	 * If it has not gone through IPSEC processing and not a duped
11603 	 * mblk, then look for driver checksummed mblk. We validate or
11604 	 * postpone the checksum to TCP for single copy checksum.
11605 	 *
11606 	 * Note that we only honor HW cksum in the fastpath.
11607 	 */
11608 	dp = mp->b_datap;
11609 	if (!mctl_present) {
11610 		IP_CKSUM_RECV(len, u1, u2, mp, mp1, tcpcksumerr, dp);
11611 	} else {
11612 		IP_STAT(ip_in_sw_cksum);
11613 		if ((IP_CSUM(mp, (int32_t)((uchar_t *)up - rptr),
11614 		    u1)) != 0) {
11615 tcpcksumerr:
11616 			BUMP_MIB(&ip_mib, tcpInErrs);
11617 			ip1dbg(("ip_tcp_input: bad tcp checksum \n"));
11618 			freemsg(first_mp);
11619 			goto slow_done;
11620 		}
11621 	}
11622 
11623 try_again:
11624 
11625 	if ((connp = ipcl_classify_v4(mp, IPPROTO_TCP, ip_hdr_len, zoneid)) ==
11626 	    NULL) {
11627 		/* Send the TH_RST */
11628 		goto no_conn;
11629 	}
11630 
11631 	/*
11632 	 * TCP FAST PATH for AF_INET socket.
11633 	 *
11634 	 * TCP fast path to avoid extra work. An AF_INET socket type
11635 	 * does not have facility to receive extra information via
11636 	 * ip_process or ip_add_info. Also, when the connection was
11637 	 * established, we made a check if this connection is impacted
11638 	 * by any global IPSec policy or per connection policy (a
11639 	 * policy that comes in effect later will not apply to this
11640 	 * connection). Since all this can be determined at the
11641 	 * connection establishment time, a quick check of flags
11642 	 * can avoid extra work.
11643 	 */
11644 	if (IPCL_IS_TCP4_CONNECTED_NO_POLICY(connp) && !mctl_present &&
11645 	    !IPP_ENABLED(IPP_LOCAL_IN)) {
11646 		ASSERT(first_mp == mp);
11647 		SET_SQUEUE(mp, tcp_rput_data, connp);
11648 		return (mp);
11649 	}
11650 
11651 	tcph = (tcph_t *)&mp->b_rptr[ip_hdr_len];
11652 	if ((tcph->th_flags[0] & (TH_SYN|TH_ACK|TH_RST|TH_URG)) == TH_SYN) {
11653 		if (IPCL_IS_TCP(connp)) {
11654 			mp->b_datap->db_struioflag |= STRUIO_EAGER;
11655 			mp->b_datap->db_cksumstart =
11656 			    (intptr_t)ip_squeue_get(ill_ring);
11657 			if (IPCL_IS_FULLY_BOUND(connp) && !mctl_present &&
11658 			    !CONN_INBOUND_POLICY_PRESENT(connp)) {
11659 				SET_SQUEUE(mp, connp->conn_recv, connp);
11660 				return (mp);
11661 			} else if (IPCL_IS_BOUND(connp) && !mctl_present &&
11662 			    !CONN_INBOUND_POLICY_PRESENT(connp)) {
11663 				ip_squeue_enter_unbound++;
11664 				SET_SQUEUE(mp, tcp_conn_request_unbound,
11665 				    connp);
11666 				return (mp);
11667 			}
11668 			syn_present = B_TRUE;
11669 		}
11670 
11671 	}
11672 
11673 	if (IPCL_IS_TCP(connp) && IPCL_IS_BOUND(connp) && !syn_present) {
11674 		uint_t	flags = (unsigned int)tcph->th_flags[0] & 0xFF;
11675 
11676 		/* No need to send this packet to TCP */
11677 		if ((flags & TH_RST) || (flags & TH_URG)) {
11678 			CONN_DEC_REF(connp);
11679 			freemsg(first_mp);
11680 			return (NULL);
11681 		}
11682 		if (flags & TH_ACK) {
11683 			tcp_xmit_listeners_reset(first_mp, ip_hdr_len);
11684 			CONN_DEC_REF(connp);
11685 			return (NULL);
11686 		}
11687 
11688 		CONN_DEC_REF(connp);
11689 		freemsg(first_mp);
11690 		return (NULL);
11691 	}
11692 
11693 	if (CONN_INBOUND_POLICY_PRESENT(connp) || mctl_present) {
11694 		first_mp = ipsec_check_inbound_policy(first_mp, connp,
11695 		    ipha, NULL, mctl_present);
11696 		if (first_mp == NULL) {
11697 			CONN_DEC_REF(connp);
11698 			return (NULL);
11699 		}
11700 		if (IPCL_IS_TCP(connp) && IPCL_IS_BOUND(connp)) {
11701 			ASSERT(syn_present);
11702 			if (mctl_present) {
11703 				ASSERT(first_mp != mp);
11704 				first_mp->b_datap->db_struioflag |=
11705 				    STRUIO_POLICY;
11706 			} else {
11707 				ASSERT(first_mp == mp);
11708 				mp->b_datap->db_struioflag &= ~STRUIO_EAGER;
11709 				mp->b_datap->db_struioflag |= STRUIO_POLICY;
11710 			}
11711 		} else {
11712 			/*
11713 			 * Discard first_mp early since we're dealing with a
11714 			 * fully-connected conn_t and tcp doesn't do policy in
11715 			 * this case.
11716 			 */
11717 			if (mctl_present) {
11718 				freeb(first_mp);
11719 				mctl_present = B_FALSE;
11720 			}
11721 			first_mp = mp;
11722 		}
11723 	}
11724 
11725 	/* Initiate IPPF processing for fastpath */
11726 	if (IPP_ENABLED(IPP_LOCAL_IN)) {
11727 		uint32_t	ill_index;
11728 
11729 		ill_index = recv_ill->ill_phyint->phyint_ifindex;
11730 		ip_process(IPP_LOCAL_IN, &mp, ill_index);
11731 		if (mp == NULL) {
11732 			ip2dbg(("ip_input_ipsec_process: TCP pkt "
11733 			    "deferred/dropped during IPPF processing\n"));
11734 			CONN_DEC_REF(connp);
11735 			if (mctl_present)
11736 				freeb(first_mp);
11737 			return (NULL);
11738 		} else if (mctl_present) {
11739 			/*
11740 			 * ip_process might return a new mp.
11741 			 */
11742 			ASSERT(first_mp != mp);
11743 			first_mp->b_cont = mp;
11744 		} else {
11745 			first_mp = mp;
11746 		}
11747 
11748 	}
11749 
11750 	if (!syn_present && connp->conn_ipv6_recvpktinfo) {
11751 		mp = ip_add_info(mp, recv_ill, flags);
11752 		if (mp == NULL) {
11753 			CONN_DEC_REF(connp);
11754 			if (mctl_present)
11755 				freeb(first_mp);
11756 			return (NULL);
11757 		} else if (mctl_present) {
11758 			/*
11759 			 * ip_add_info might return a new mp.
11760 			 */
11761 			ASSERT(first_mp != mp);
11762 			first_mp->b_cont = mp;
11763 		} else {
11764 			first_mp = mp;
11765 		}
11766 	}
11767 
11768 	if (IPCL_IS_TCP(connp)) {
11769 		SET_SQUEUE(first_mp, connp->conn_recv, connp);
11770 		return (first_mp);
11771 	} else {
11772 		putnext(connp->conn_rq, first_mp);
11773 		CONN_DEC_REF(connp);
11774 		return (NULL);
11775 	}
11776 
11777 no_conn:
11778 	/* Initiate IPPf processing, if needed. */
11779 	if (IPP_ENABLED(IPP_LOCAL_IN)) {
11780 		uint32_t ill_index;
11781 		ill_index = recv_ill->ill_phyint->phyint_ifindex;
11782 		ip_process(IPP_LOCAL_IN, &first_mp, ill_index);
11783 		if (first_mp == NULL) {
11784 			return (NULL);
11785 		}
11786 	}
11787 	BUMP_MIB(&ip_mib, ipInDelivers);
11788 	tcp_xmit_listeners_reset(first_mp, IPH_HDR_LENGTH(mp->b_rptr));
11789 	return (NULL);
11790 ipoptions:
11791 	if (!ip_options_cksum(q, first_mp, ipha, ire)) {
11792 		goto slow_done;
11793 	}
11794 
11795 	UPDATE_IB_PKT_COUNT(ire);
11796 	ire->ire_last_used_time = lbolt;
11797 
11798 	u1 = ntohs(ipha->ipha_fragment_offset_and_flags);
11799 	if (u1 & (IPH_MF | IPH_OFFSET)) {
11800 fragmented:
11801 		if (!ip_rput_fragment(q, &mp, ipha)) {
11802 			if (mctl_present)
11803 				freeb(first_mp);
11804 			goto slow_done;
11805 		}
11806 		/*
11807 		 * Make sure that first_mp points back to mp as
11808 		 * the mp we came in with could have changed in
11809 		 * ip_rput_fragment().
11810 		 */
11811 		ASSERT(!mctl_present);
11812 		ipha = (ipha_t *)mp->b_rptr;
11813 		first_mp = mp;
11814 	}
11815 
11816 tcp_slow:
11817 	/* Now we have a complete datagram, destined for this machine. */
11818 	u1 = ip_hdr_len = IPH_HDR_LENGTH(ipha);
11819 
11820 	len = mp->b_wptr - mp->b_rptr;
11821 	/* Pull up a minimal TCP header, if necessary. */
11822 	if (len < (u1 + 20)) {
11823 tcppullup:
11824 		if (!pullupmsg(mp, u1 + 20)) {
11825 			BUMP_MIB(&ip_mib, ipInDiscards);
11826 			goto error;
11827 		}
11828 		ipha = (ipha_t *)mp->b_rptr;
11829 		len = mp->b_wptr - mp->b_rptr;
11830 	}
11831 
11832 	/*
11833 	 * Extract the offset field from the TCP header.  As usual, we
11834 	 * try to help the compiler more than the reader.
11835 	 */
11836 	offset = ((uchar_t *)ipha)[u1 + 12] >> 4;
11837 	if (offset != 5) {
11838 tcpoptions:
11839 		if (offset < 5) {
11840 			BUMP_MIB(&ip_mib, ipInDiscards);
11841 			goto error;
11842 		}
11843 		/*
11844 		 * There must be TCP options.
11845 		 * Make sure we can grab them.
11846 		 */
11847 		offset <<= 2;
11848 		offset += u1;
11849 		if (len < offset) {
11850 			if (!pullupmsg(mp, offset)) {
11851 				BUMP_MIB(&ip_mib, ipInDiscards);
11852 				goto error;
11853 			}
11854 			ipha = (ipha_t *)mp->b_rptr;
11855 			len = mp->b_wptr - rptr;
11856 		}
11857 	}
11858 
11859 	/* Get the total packet length in len, including headers. */
11860 	if (mp->b_cont) {
11861 multipkttcp:
11862 		len = msgdsize(mp);
11863 	}
11864 
11865 	/*
11866 	 * Check the TCP checksum by pulling together the pseudo-
11867 	 * header checksum, and passing it to ip_csum to be added in
11868 	 * with the TCP datagram.
11869 	 *
11870 	 * Since we are not using the hwcksum if available we must
11871 	 * clear the flag. We may come here via tcppullup or tcpoptions.
11872 	 * If either of these fails along the way the mblk is freed.
11873 	 * If this logic ever changes and mblk is reused to say send
11874 	 * ICMP's back, then this flag may need to be cleared in
11875 	 * other places as well.
11876 	 */
11877 	mp->b_datap->db_struioun.cksum.flags = 0;
11878 
11879 	up = (uint16_t *)(rptr + u1 + TCP_PORTS_OFFSET);
11880 	u1 = (uint32_t)(len - u1);	/* TCP datagram length. */
11881 #ifdef	_BIG_ENDIAN
11882 	u1 += IPPROTO_TCP;
11883 #else
11884 	u1 = ((u1 >> 8) & 0xFF) + (((u1 & 0xFF) + IPPROTO_TCP) << 8);
11885 #endif
11886 	u1 += iphs[6] + iphs[7] + iphs[8] + iphs[9];
11887 	/*
11888 	 * Not M_DATA mblk or its a dup, so do the checksum now.
11889 	 */
11890 	IP_STAT(ip_in_sw_cksum);
11891 	if (IP_CSUM(mp, (int32_t)((uchar_t *)up - rptr), u1)) {
11892 		BUMP_MIB(&ip_mib, tcpInErrs);
11893 		goto error;
11894 	}
11895 
11896 	IP_STAT(ip_tcp_slow_path);
11897 	goto try_again;
11898 #undef  iphs
11899 #undef  rptr
11900 
11901 error:
11902 	freemsg(first_mp);
11903 slow_done:
11904 	return (NULL);
11905 }
11906 
11907 /* ARGSUSED */
11908 static void
11909 ip_sctp_input(mblk_t *mp, ipha_t *ipha, ill_t *recv_ill, boolean_t mctl_present,
11910     ire_t *ire, mblk_t *first_mp, uint_t flags, queue_t *q, ipaddr_t dst)
11911 {
11912 	conn_t		*connp;
11913 	uint32_t	sum;
11914 	uint32_t	u1;
11915 	ssize_t		len;
11916 	sctp_hdr_t	*sctph;
11917 	zoneid_t	zoneid = ire->ire_zoneid;
11918 	uint32_t	pktsum;
11919 	uint32_t	calcsum;
11920 	uint32_t	ports;
11921 	uint_t		ipif_seqid;
11922 	in6_addr_t	map_src, map_dst;
11923 	ill_t		*ill = (ill_t *)q->q_ptr;
11924 
11925 #define	rptr	((uchar_t *)ipha)
11926 
11927 	ASSERT(ipha->ipha_protocol == IPPROTO_SCTP);
11928 
11929 	/* u1 is # words of IP options */
11930 	u1 = ipha->ipha_version_and_hdr_length - (uchar_t)((IP_VERSION << 4)
11931 	    + IP_SIMPLE_HDR_LENGTH_IN_WORDS);
11932 
11933 	/* IP options present */
11934 	if (u1 > 0) {
11935 		goto ipoptions;
11936 	} else {
11937 		/* Check the IP header checksum.  */
11938 		if (IS_IPHDR_HWCKSUM(mctl_present, mp, ill)) {
11939 			/*
11940 			 * Since there is no SCTP h/w cksum support yet, just
11941 			 * clear the flag.
11942 			 */
11943 			mp->b_datap->db_struioun.cksum.flags = 0;
11944 		} else {
11945 #define	uph	((uint16_t *)ipha)
11946 			sum = uph[0] + uph[1] + uph[2] + uph[3] + uph[4] +
11947 			    uph[5] + uph[6] + uph[7] + uph[8] + uph[9];
11948 #undef	uph
11949 			/* finish doing IP checksum */
11950 			sum = (sum & 0xFFFF) + (sum >> 16);
11951 			sum = ~(sum + (sum >> 16)) & 0xFFFF;
11952 			/*
11953 			 * Don't verify header checksum if this packet
11954 			 * is coming back from AH/ESP as we already did it.
11955 			 */
11956 			if (!mctl_present && (sum != 0) && sum != 0xFFFF) {
11957 				BUMP_MIB(&ip_mib, ipInCksumErrs);
11958 				goto error;
11959 			}
11960 		}
11961 	}
11962 
11963 	/*
11964 	 * Don't verify header checksum if this packet is coming
11965 	 * back from AH/ESP as we already did it.
11966 	 */
11967 	if (!mctl_present) {
11968 		UPDATE_IB_PKT_COUNT(ire);
11969 		ire->ire_last_used_time = lbolt;
11970 	}
11971 
11972 	/* packet part of fragmented IP packet? */
11973 	u1 = ntohs(ipha->ipha_fragment_offset_and_flags);
11974 	if (u1 & (IPH_MF | IPH_OFFSET))
11975 		goto fragmented;
11976 
11977 	/* u1 = IP header length (20 bytes) */
11978 	u1 = IP_SIMPLE_HDR_LENGTH;
11979 
11980 find_sctp_client:
11981 	/* Pullup if we don't have the sctp common header. */
11982 	len = MBLKL(mp);
11983 	if (len < (u1 + SCTP_COMMON_HDR_LENGTH)) {
11984 		if (mp->b_cont == NULL ||
11985 		    !pullupmsg(mp, u1 + SCTP_COMMON_HDR_LENGTH)) {
11986 			BUMP_MIB(&ip_mib, ipInDiscards);
11987 			goto error;
11988 		}
11989 		ipha = (ipha_t *)mp->b_rptr;
11990 		len = MBLKL(mp);
11991 	}
11992 
11993 	sctph = (sctp_hdr_t *)(rptr + u1);
11994 #ifdef	DEBUG
11995 	if (!skip_sctp_cksum) {
11996 #endif
11997 		pktsum = sctph->sh_chksum;
11998 		sctph->sh_chksum = 0;
11999 		calcsum = sctp_cksum(mp, u1);
12000 		if (calcsum != pktsum) {
12001 			BUMP_MIB(&sctp_mib, sctpChecksumError);
12002 			goto error;
12003 		}
12004 		sctph->sh_chksum = pktsum;
12005 #ifdef	DEBUG	/* skip_sctp_cksum */
12006 	}
12007 #endif
12008 	/* get the ports */
12009 	ports = *(uint32_t *)&sctph->sh_sport;
12010 
12011 	ipif_seqid = ire->ire_ipif->ipif_seqid;
12012 	IRE_REFRELE(ire);
12013 	IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &map_dst);
12014 	IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &map_src);
12015 	if ((connp = sctp_find_conn(&map_src, &map_dst, ports, ipif_seqid,
12016 	    zoneid)) == NULL) {
12017 		/* Check for raw socket or OOTB handling */
12018 		goto no_conn;
12019 	}
12020 
12021 	/* Found a client; up it goes */
12022 	BUMP_MIB(&ip_mib, ipInDelivers);
12023 	sctp_input(connp, ipha, mp, first_mp, recv_ill, B_TRUE, mctl_present);
12024 	return;
12025 
12026 no_conn:
12027 	ip_fanout_sctp_raw(first_mp, recv_ill, ipha, B_TRUE,
12028 	    ports, mctl_present, flags, B_TRUE, ipif_seqid, zoneid);
12029 	return;
12030 
12031 ipoptions:
12032 	mp->b_datap->db_struioun.cksum.flags = 0;
12033 	if (!ip_options_cksum(q, first_mp, ipha, ire))
12034 		goto slow_done;
12035 
12036 	UPDATE_IB_PKT_COUNT(ire);
12037 	ire->ire_last_used_time = lbolt;
12038 
12039 	u1 = ntohs(ipha->ipha_fragment_offset_and_flags);
12040 	if (u1 & (IPH_MF | IPH_OFFSET)) {
12041 fragmented:
12042 		if (!ip_rput_fragment(q, &mp, ipha))
12043 			goto slow_done;
12044 		/*
12045 		 * Make sure that first_mp points back to mp as
12046 		 * the mp we came in with could have changed in
12047 		 * ip_rput_fragment().
12048 		 */
12049 		ASSERT(!mctl_present);
12050 		ipha = (ipha_t *)mp->b_rptr;
12051 		first_mp = mp;
12052 	}
12053 
12054 	/* Now we have a complete datagram, destined for this machine. */
12055 	u1 = IPH_HDR_LENGTH(ipha);
12056 	goto find_sctp_client;
12057 #undef  iphs
12058 #undef  rptr
12059 
12060 error:
12061 	freemsg(first_mp);
12062 slow_done:
12063 	IRE_REFRELE(ire);
12064 }
12065 
12066 #define	VER_BITS	0xF0
12067 #define	VERSION_6	0x60
12068 
12069 static boolean_t
12070 ip_rput_multimblk_ipoptions(queue_t *q, mblk_t *mp, ipha_t **iphapp,
12071     ipaddr_t *dstp)
12072 {
12073 	uint_t	opt_len;
12074 	ipha_t *ipha;
12075 	ssize_t len;
12076 	uint_t	pkt_len;
12077 
12078 	IP_STAT(ip_ipoptions);
12079 	ipha = *iphapp;
12080 
12081 #define	rptr    ((uchar_t *)ipha)
12082 	/* Assume no IPv6 packets arrive over the IPv4 queue */
12083 	if (IPH_HDR_VERSION(ipha) == IPV6_VERSION) {
12084 		BUMP_MIB(&ip_mib, ipInIPv6);
12085 		freemsg(mp);
12086 		return (B_FALSE);
12087 	}
12088 
12089 	/* multiple mblk or too short */
12090 	pkt_len = ntohs(ipha->ipha_length);
12091 
12092 	/* Get the number of words of IP options in the IP header. */
12093 	opt_len = ipha->ipha_version_and_hdr_length - IP_SIMPLE_HDR_VERSION;
12094 	if (opt_len) {
12095 		/* IP Options present!  Validate and process. */
12096 		if (opt_len > (15 - IP_SIMPLE_HDR_LENGTH_IN_WORDS)) {
12097 			BUMP_MIB(&ip_mib, ipInHdrErrors);
12098 			goto done;
12099 		}
12100 		/*
12101 		 * Recompute complete header length and make sure we
12102 		 * have access to all of it.
12103 		 */
12104 		len = ((size_t)opt_len + IP_SIMPLE_HDR_LENGTH_IN_WORDS) << 2;
12105 		if (len > (mp->b_wptr - rptr)) {
12106 			if (len > pkt_len) {
12107 				BUMP_MIB(&ip_mib, ipInHdrErrors);
12108 				goto done;
12109 			}
12110 			if (!pullupmsg(mp, len)) {
12111 				BUMP_MIB(&ip_mib, ipInDiscards);
12112 				goto done;
12113 			}
12114 			ipha = (ipha_t *)mp->b_rptr;
12115 		}
12116 		/*
12117 		 * Go off to ip_rput_options which returns the next hop
12118 		 * destination address, which may have been affected
12119 		 * by source routing.
12120 		 */
12121 		IP_STAT(ip_opt);
12122 		if (ip_rput_options(q, mp, ipha, dstp) == -1) {
12123 			return (B_FALSE);
12124 		}
12125 	}
12126 	*iphapp = ipha;
12127 	return (B_TRUE);
12128 done:
12129 	/* clear b_prev - used by ip_mroute_decap */
12130 	mp->b_prev = NULL;
12131 	freemsg(mp);
12132 	return (B_FALSE);
12133 #undef  rptr
12134 }
12135 
12136 /*
12137  * Deal with the fact that there is no ire for the destination.
12138  * The incoming ill (in_ill) is passed in to ip_newroute only
12139  * in the case of packets coming from mobile ip forward tunnel.
12140  * It must be null otherwise.
12141  */
12142 static void
12143 ip_rput_noire(queue_t *q, ill_t *in_ill, mblk_t *mp, int ll_multicast,
12144     ipaddr_t dst)
12145 {
12146 	ipha_t	*ipha;
12147 	ill_t	*ill;
12148 
12149 	ipha = (ipha_t *)mp->b_rptr;
12150 	ill = (ill_t *)q->q_ptr;
12151 
12152 	ASSERT(ill != NULL);
12153 	/*
12154 	 * No IRE for this destination, so it can't be for us.
12155 	 * Unless we are forwarding, drop the packet.
12156 	 * We have to let source routed packets through
12157 	 * since we don't yet know if they are 'ping -l'
12158 	 * packets i.e. if they will go out over the
12159 	 * same interface as they came in on.
12160 	 */
12161 	if (ll_multicast) {
12162 		freemsg(mp);
12163 		return;
12164 	}
12165 	if (!(ill->ill_flags & ILLF_ROUTER) && !ip_source_routed(ipha)) {
12166 		BUMP_MIB(&ip_mib, ipForwProhibits);
12167 		freemsg(mp);
12168 		return;
12169 	}
12170 
12171 	/* Check for Martian addresses */
12172 	if ((in_ill == NULL) && (ip_no_forward(ipha, ill))) {
12173 		freemsg(mp);
12174 		return;
12175 	}
12176 
12177 	/* Mark this packet as having originated externally */
12178 	mp->b_prev = (mblk_t *)(uintptr_t)ill->ill_phyint->phyint_ifindex;
12179 
12180 	/*
12181 	 * Clear the indication that this may have a hardware checksum
12182 	 * as we are not using it
12183 	 */
12184 	mp->b_datap->db_struioun.cksum.flags = 0;
12185 
12186 	/*
12187 	 * Now hand the packet to ip_newroute.
12188 	 */
12189 	ip_newroute(q, mp, dst, in_ill, NULL);
12190 }
12191 
12192 /*
12193  * check ip header length and align it.
12194  */
12195 static boolean_t
12196 ip_check_and_align_header(queue_t *q, mblk_t *mp)
12197 {
12198 	ssize_t len;
12199 	ill_t *ill;
12200 	ipha_t	*ipha;
12201 
12202 	len = MBLKL(mp);
12203 
12204 	if (!OK_32PTR(mp->b_rptr) || len < IP_SIMPLE_HDR_LENGTH) {
12205 		if (!OK_32PTR(mp->b_rptr))
12206 			IP_STAT(ip_notaligned1);
12207 		else
12208 			IP_STAT(ip_notaligned2);
12209 		/* Guard against bogus device drivers */
12210 		if (len < 0) {
12211 			/* clear b_prev - used by ip_mroute_decap */
12212 			mp->b_prev = NULL;
12213 			BUMP_MIB(&ip_mib, ipInHdrErrors);
12214 			freemsg(mp);
12215 			return (B_FALSE);
12216 		}
12217 
12218 		if (ip_rput_pullups++ == 0) {
12219 			ill = (ill_t *)q->q_ptr;
12220 			ipha = (ipha_t *)mp->b_rptr;
12221 			(void) mi_strlog(q, 1, SL_ERROR|SL_TRACE,
12222 			    "ip_check_and_align_header: %s forced us to "
12223 			    " pullup pkt, hdr len %ld, hdr addr %p",
12224 			    ill->ill_name, len, ipha);
12225 		}
12226 		if (!pullupmsg(mp, IP_SIMPLE_HDR_LENGTH)) {
12227 			/* clear b_prev - used by ip_mroute_decap */
12228 			mp->b_prev = NULL;
12229 			BUMP_MIB(&ip_mib, ipInDiscards);
12230 			freemsg(mp);
12231 			return (B_FALSE);
12232 		}
12233 	}
12234 	return (B_TRUE);
12235 }
12236 
12237 static boolean_t
12238 ip_rput_notforus(queue_t **qp, mblk_t *mp, ire_t *ire, ill_t *ill)
12239 {
12240 	ill_group_t	*ill_group;
12241 	ill_group_t	*ire_group;
12242 	queue_t 	*q;
12243 	ill_t		*ire_ill;
12244 	uint_t		ill_ifindex;
12245 
12246 	q = *qp;
12247 	/*
12248 	 * We need to check to make sure the packet came in
12249 	 * on the queue associated with the destination IRE.
12250 	 * Note that for multicast packets and broadcast packets sent to
12251 	 * a broadcast address which is shared between multiple interfaces
12252 	 * we should not do this since we just got a random broadcast ire.
12253 	 */
12254 	if (ire->ire_rfq && ire->ire_type != IRE_BROADCAST) {
12255 		boolean_t check_multi = B_TRUE;
12256 
12257 		/*
12258 		 * This packet came in on an interface other than the
12259 		 * one associated with the destination address.
12260 		 * "Gateway" it to the appropriate interface here.
12261 		 * As long as the ills belong to the same group,
12262 		 * we don't consider them to arriving on the wrong
12263 		 * interface. Thus, when the switch is doing inbound
12264 		 * load spreading, we won't drop packets when we
12265 		 * are doing strict multihoming checks. Note, the
12266 		 * same holds true for 'usesrc groups' where the
12267 		 * destination address may belong to another interface
12268 		 * to allow multipathing to happen
12269 		 */
12270 		ill_group = ill->ill_group;
12271 		ire_ill = (ill_t *)(ire->ire_rfq)->q_ptr;
12272 		ill_ifindex = ill->ill_usesrc_ifindex;
12273 		ire_group = ire_ill->ill_group;
12274 
12275 		/*
12276 		 * If it's part of the same IPMP group, or if it's a legal
12277 		 * address on the 'usesrc' interface, then bypass strict
12278 		 * checks.
12279 		 */
12280 		if (ill_group != NULL && ill_group == ire_group) {
12281 			check_multi = B_FALSE;
12282 		} else if (ill_ifindex != 0 &&
12283 		    ill_ifindex == ire_ill->ill_phyint->phyint_ifindex) {
12284 			check_multi = B_FALSE;
12285 		}
12286 
12287 		if (check_multi &&
12288 		    ip_strict_dst_multihoming &&
12289 		    ((ill->ill_flags &
12290 		    ire->ire_ipif->ipif_ill->ill_flags &
12291 		    ILLF_ROUTER) == 0)) {
12292 			/* Drop packet */
12293 			BUMP_MIB(&ip_mib, ipForwProhibits);
12294 			freemsg(mp);
12295 			ire_refrele(ire);
12296 			return (B_TRUE);
12297 		}
12298 
12299 		/*
12300 		 * Change the queue (for non-virtual destination network
12301 		 * interfaces) and ip_rput_local will be called with the right
12302 		 * queue
12303 		 */
12304 		q = ire->ire_rfq;
12305 	}
12306 	/* Must be broadcast.  We'll take it. */
12307 	*qp = q;
12308 	return (B_FALSE);
12309 }
12310 
12311 static void
12312 ip_rput_process_forward(queue_t *q, mblk_t *mp, ire_t *ire, ipha_t *ipha,
12313     ill_t *ill, int ll_multicast)
12314 {
12315 	ill_group_t	*ill_group;
12316 	ill_group_t	*ire_group;
12317 	queue_t	*dev_q;
12318 
12319 	ASSERT(ire->ire_stq != NULL);
12320 	if (ll_multicast != 0)
12321 		goto drop_pkt;
12322 
12323 	if (ip_no_forward(ipha, ill))
12324 		goto drop_pkt;
12325 
12326 	ill_group = ill->ill_group;
12327 	ire_group = ((ill_t *)(ire->ire_rfq)->q_ptr)->ill_group;
12328 	/*
12329 	 * Check if we want to forward this one at this time.
12330 	 * We allow source routed packets on a host provided that
12331 	 * they go out the same interface or same interface group
12332 	 * as they came in on.
12333 	 *
12334 	 * XXX To be quicker, we may wish to not chase pointers to
12335 	 * get the ILLF_ROUTER flag and instead store the
12336 	 * forwarding policy in the ire.  An unfortunate
12337 	 * side-effect of that would be requiring an ire flush
12338 	 * whenever the ILLF_ROUTER flag changes.
12339 	 */
12340 	if (((ill->ill_flags &
12341 	    ((ill_t *)ire->ire_stq->q_ptr)->ill_flags &
12342 	    ILLF_ROUTER) == 0) &&
12343 	    !(ip_source_routed(ipha) && (ire->ire_rfq == q ||
12344 	    (ill_group != NULL && ill_group == ire_group)))) {
12345 		BUMP_MIB(&ip_mib, ipForwProhibits);
12346 		if (ip_source_routed(ipha)) {
12347 			q = WR(q);
12348 			/*
12349 			 * Clear the indication that this may have
12350 			 * hardware checksum as we are not using it.
12351 			 */
12352 			mp->b_datap->db_struioun.cksum.flags = 0;
12353 			icmp_unreachable(q, mp,
12354 			    ICMP_SOURCE_ROUTE_FAILED);
12355 			ire_refrele(ire);
12356 			return;
12357 		}
12358 		goto drop_pkt;
12359 	}
12360 
12361 	/* Packet is being forwarded. Turning off hwcksum flag. */
12362 	mp->b_datap->db_struioun.cksum.flags = 0;
12363 	if (ip_g_send_redirects) {
12364 		/*
12365 		 * Check whether the incoming interface and outgoing
12366 		 * interface is part of the same group. If so,
12367 		 * send redirects.
12368 		 *
12369 		 * Check the source address to see if it originated
12370 		 * on the same logical subnet it is going back out on.
12371 		 * If so, we should be able to send it a redirect.
12372 		 * Avoid sending a redirect if the destination
12373 		 * is directly connected (gw_addr == 0),
12374 		 * or if the packet was source routed out this
12375 		 * interface.
12376 		 */
12377 		ipaddr_t src;
12378 		mblk_t	*mp1;
12379 		ire_t	*src_ire = NULL;
12380 
12381 		/*
12382 		 * Check whether ire_rfq and q are from the same ill
12383 		 * or if they are not same, they at least belong
12384 		 * to the same group. If so, send redirects.
12385 		 */
12386 		if ((ire->ire_rfq == q ||
12387 		    (ill_group != NULL && ill_group == ire_group)) &&
12388 		    (ire->ire_gateway_addr != 0) &&
12389 		    !ip_source_routed(ipha)) {
12390 
12391 			src = ipha->ipha_src;
12392 			src_ire = ire_ftable_lookup(src, 0, 0,
12393 			    IRE_INTERFACE, ire->ire_ipif, NULL, ALL_ZONES,
12394 			    0, MATCH_IRE_IPIF | MATCH_IRE_TYPE);
12395 
12396 			if (src_ire != NULL) {
12397 				/*
12398 				 * The source is directly connected.
12399 				 * Just copy the ip header (which is
12400 				 * in the first mblk)
12401 				 */
12402 				mp1 = copyb(mp);
12403 				if (mp1 != NULL) {
12404 					icmp_send_redirect(WR(q), mp1,
12405 					    ire->ire_gateway_addr);
12406 				}
12407 				ire_refrele(src_ire);
12408 			}
12409 		}
12410 	}
12411 
12412 	dev_q = ire->ire_stq->q_next;
12413 	if ((dev_q->q_next || dev_q->q_first) && !canput(dev_q)) {
12414 		BUMP_MIB(&ip_mib, ipInDiscards);
12415 		freemsg(mp);
12416 		ire_refrele(ire);
12417 		return;
12418 	}
12419 
12420 	ip_rput_forward(ire, ipha, mp, ill);
12421 	IRE_REFRELE(ire);
12422 	return;
12423 
12424 drop_pkt:
12425 	ire_refrele(ire);
12426 	ip2dbg(("ip_rput_forward: drop pkt\n"));
12427 	freemsg(mp);
12428 }
12429 
12430 static boolean_t
12431 ip_rput_process_broadcast(queue_t **qp, mblk_t *mp, ire_t **irep, ipha_t *ipha,
12432     ill_t *ill, ipaddr_t dst, int cgtp_flt_pkt, int ll_multicast)
12433 {
12434 	queue_t		*q;
12435 	ire_t		*ire;
12436 
12437 	q = *qp;
12438 	ire = *irep;
12439 
12440 	/*
12441 	 * Clear the indication that this may have hardware
12442 	 * checksum as we are not using it.
12443 	 */
12444 	mp->b_datap->db_struioun.cksum.flags = 0;
12445 
12446 	/*
12447 	 * Directed broadcast forwarding: if the packet came in over a
12448 	 * different interface then it is routed out over we can forward it.
12449 	 */
12450 	if (ipha->ipha_protocol == IPPROTO_TCP) {
12451 		ire_refrele(ire);
12452 		freemsg(mp);
12453 		BUMP_MIB(&ip_mib, ipInDiscards);
12454 		return (B_TRUE);
12455 	}
12456 	/*
12457 	 * For multicast we have set dst to be INADDR_BROADCAST
12458 	 * for delivering to all STREAMS. IRE_MARK_NORECV is really
12459 	 * only for broadcast packets.
12460 	 */
12461 	if (!CLASSD(ipha->ipha_dst)) {
12462 		ire_t *new_ire;
12463 		ipif_t *ipif;
12464 		/*
12465 		 * For ill groups, as the switch duplicates broadcasts
12466 		 * across all the ports, we need to filter out and
12467 		 * send up only one copy. There is one copy for every
12468 		 * broadcast address on each ill. Thus, we look for a
12469 		 * specific IRE on this ill and look at IRE_MARK_NORECV
12470 		 * later to see whether this ill is eligible to receive
12471 		 * them or not. ill_nominate_bcast_rcv() nominates only
12472 		 * one set of IREs for receiving.
12473 		 */
12474 
12475 		ipif = ipif_get_next_ipif(NULL, ill);
12476 		if (ipif == NULL) {
12477 			ire_refrele(ire);
12478 			freemsg(mp);
12479 			BUMP_MIB(&ip_mib, ipInDiscards);
12480 			return (B_TRUE);
12481 		}
12482 		new_ire = ire_ctable_lookup(dst, 0, 0,
12483 		    ipif, ALL_ZONES, MATCH_IRE_ILL);
12484 		ipif_refrele(ipif);
12485 
12486 		if (new_ire != NULL) {
12487 			if (new_ire->ire_marks & IRE_MARK_NORECV) {
12488 				ire_refrele(ire);
12489 				ire_refrele(new_ire);
12490 				freemsg(mp);
12491 				BUMP_MIB(&ip_mib, ipInDiscards);
12492 				return (B_TRUE);
12493 			}
12494 			/*
12495 			 * In the special case of multirouted broadcast
12496 			 * packets, we unconditionally need to "gateway"
12497 			 * them to the appropriate interface here.
12498 			 * In the normal case, this cannot happen, because
12499 			 * there is no broadcast IRE tagged with the
12500 			 * RTF_MULTIRT flag.
12501 			 */
12502 			if (new_ire->ire_flags & RTF_MULTIRT) {
12503 				ire_refrele(new_ire);
12504 				if (ire->ire_rfq != NULL) {
12505 					q = ire->ire_rfq;
12506 					*qp = q;
12507 				}
12508 			} else {
12509 				ire_refrele(ire);
12510 				ire = new_ire;
12511 			}
12512 		} else if (cgtp_flt_pkt == CGTP_IP_PKT_NOT_CGTP) {
12513 			if (!ip_g_forward_directed_bcast) {
12514 				/*
12515 				 * Free the message if
12516 				 * ip_g_forward_directed_bcast is turned
12517 				 * off for non-local broadcast.
12518 				 */
12519 				ire_refrele(ire);
12520 				freemsg(mp);
12521 				BUMP_MIB(&ip_mib, ipInDiscards);
12522 				return (B_TRUE);
12523 			}
12524 		} else {
12525 			/*
12526 			 * This CGTP packet successfully passed the
12527 			 * CGTP filter, but the related CGTP
12528 			 * broadcast IRE has not been found,
12529 			 * meaning that the redundant ipif is
12530 			 * probably down. However, if we discarded
12531 			 * this packet, its duplicate would be
12532 			 * filtered out by the CGTP filter so none
12533 			 * of them would get through. So we keep
12534 			 * going with this one.
12535 			 */
12536 			ASSERT(cgtp_flt_pkt == CGTP_IP_PKT_PREMIUM);
12537 			if (ire->ire_rfq != NULL) {
12538 				q = ire->ire_rfq;
12539 				*qp = q;
12540 			}
12541 		}
12542 	}
12543 	if (ip_g_forward_directed_bcast && ll_multicast == 0) {
12544 		/*
12545 		 * Verify that there are not more then one
12546 		 * IRE_BROADCAST with this broadcast address which
12547 		 * has ire_stq set.
12548 		 * TODO: simplify, loop over all IRE's
12549 		 */
12550 		ire_t	*ire1;
12551 		int	num_stq = 0;
12552 		mblk_t	*mp1;
12553 
12554 		/* Find the first one with ire_stq set */
12555 		rw_enter(&ire->ire_bucket->irb_lock, RW_READER);
12556 		for (ire1 = ire; ire1 &&
12557 		    !ire1->ire_stq && ire1->ire_addr == ire->ire_addr;
12558 		    ire1 = ire1->ire_next)
12559 			;
12560 		if (ire1) {
12561 			ire_refrele(ire);
12562 			ire = ire1;
12563 			IRE_REFHOLD(ire);
12564 		}
12565 
12566 		/* Check if there are additional ones with stq set */
12567 		for (ire1 = ire; ire1; ire1 = ire1->ire_next) {
12568 			if (ire->ire_addr != ire1->ire_addr)
12569 				break;
12570 			if (ire1->ire_stq) {
12571 				num_stq++;
12572 				break;
12573 			}
12574 		}
12575 		rw_exit(&ire->ire_bucket->irb_lock);
12576 		if (num_stq == 1 && ire->ire_stq != NULL) {
12577 			ip1dbg(("ip_rput_process_broadcast: directed "
12578 			    "broadcast to 0x%x\n",
12579 			    ntohl(ire->ire_addr)));
12580 			mp1 = copymsg(mp);
12581 			if (mp1) {
12582 				switch (ipha->ipha_protocol) {
12583 				case IPPROTO_UDP:
12584 					ip_udp_input(q, mp1, ipha, ire, ill);
12585 					break;
12586 				default:
12587 					ip_proto_input(q, mp1, ipha, ire, ill);
12588 					break;
12589 				}
12590 			}
12591 			/*
12592 			 * Adjust ttl to 2 (1+1 - the forward engine
12593 			 * will decrement it by one.
12594 			 */
12595 			if (ip_csum_hdr(ipha)) {
12596 				BUMP_MIB(&ip_mib, ipInCksumErrs);
12597 				ip2dbg(("ip_rput_broadcast:drop pkt\n"));
12598 				freemsg(mp);
12599 				ire_refrele(ire);
12600 				return (B_TRUE);
12601 			}
12602 			ipha->ipha_ttl = ip_broadcast_ttl + 1;
12603 			ipha->ipha_hdr_checksum = 0;
12604 			ipha->ipha_hdr_checksum = ip_csum_hdr(ipha);
12605 			ip_rput_process_forward(q, mp, ire, ipha,
12606 			    ill, ll_multicast);
12607 			return (B_TRUE);
12608 		}
12609 		ip1dbg(("ip_rput: NO directed broadcast to 0x%x\n",
12610 		    ntohl(ire->ire_addr)));
12611 	}
12612 
12613 	*irep = ire;
12614 	return (B_FALSE);
12615 }
12616 
12617 /* ARGSUSED */
12618 static boolean_t
12619 ip_rput_process_multicast(queue_t *q, mblk_t *mp, ill_t *ill, ipha_t *ipha,
12620     int *ll_multicast, ipaddr_t *dstp)
12621 {
12622 	/*
12623 	 * Forward packets only if we have joined the allmulti
12624 	 * group on this interface.
12625 	 */
12626 	if (ip_g_mrouter && ill->ill_join_allmulti) {
12627 		int retval;
12628 
12629 		/*
12630 		 * Clear the indication that this may have hardware
12631 		 * checksum as we are not using it.
12632 		 */
12633 		mp->b_datap->db_struioun.cksum.flags = 0;
12634 		retval = ip_mforward(ill, ipha, mp);
12635 		/* ip_mforward updates mib variables if needed */
12636 		/* clear b_prev - used by ip_mroute_decap */
12637 		mp->b_prev = NULL;
12638 
12639 		switch (retval) {
12640 		case 0:
12641 			/*
12642 			 * pkt is okay and arrived on phyint.
12643 			 *
12644 			 * If we are running as a multicast router
12645 			 * we need to see all IGMP and/or PIM packets.
12646 			 */
12647 			if ((ipha->ipha_protocol == IPPROTO_IGMP) ||
12648 			    (ipha->ipha_protocol == IPPROTO_PIM)) {
12649 				goto done;
12650 			}
12651 			break;
12652 		case -1:
12653 			/* pkt is mal-formed, toss it */
12654 			goto drop_pkt;
12655 		case 1:
12656 			/* pkt is okay and arrived on a tunnel */
12657 			/*
12658 			 * If we are running a multicast router
12659 			 *  we need to see all igmp packets.
12660 			 */
12661 			if (ipha->ipha_protocol == IPPROTO_IGMP) {
12662 				*dstp = INADDR_BROADCAST;
12663 				*ll_multicast = 1;
12664 				return (B_FALSE);
12665 			}
12666 
12667 			goto drop_pkt;
12668 		}
12669 	}
12670 
12671 	ILM_WALKER_HOLD(ill);
12672 	if (ilm_lookup_ill(ill, *dstp, ALL_ZONES) == NULL) {
12673 		/*
12674 		 * This might just be caused by the fact that
12675 		 * multiple IP Multicast addresses map to the same
12676 		 * link layer multicast - no need to increment counter!
12677 		 */
12678 		ILM_WALKER_RELE(ill);
12679 		freemsg(mp);
12680 		return (B_TRUE);
12681 	}
12682 	ILM_WALKER_RELE(ill);
12683 done:
12684 	ip2dbg(("ip_rput: multicast for us: 0x%x\n", ntohl(*dstp)));
12685 	/*
12686 	 * This assumes the we deliver to all streams for multicast
12687 	 * and broadcast packets.
12688 	 */
12689 	*dstp = INADDR_BROADCAST;
12690 	*ll_multicast = 1;
12691 	return (B_FALSE);
12692 drop_pkt:
12693 	ip2dbg(("ip_rput: drop pkt\n"));
12694 	freemsg(mp);
12695 	return (B_TRUE);
12696 }
12697 
12698 static boolean_t
12699 ip_rput_process_notdata(queue_t *q, mblk_t **first_mpp, ill_t *ill,
12700     int *ll_multicast, mblk_t **mpp)
12701 {
12702 	mblk_t *mp1, *from_mp, *to_mp, *mp, *first_mp;
12703 	boolean_t must_copy = B_FALSE;
12704 	struct iocblk   *iocp;
12705 	ipha_t		*ipha;
12706 
12707 #define	rptr    ((uchar_t *)ipha)
12708 
12709 	first_mp = *first_mpp;
12710 	mp = *mpp;
12711 
12712 	ASSERT(first_mp == mp);
12713 
12714 	/*
12715 	 * if db_ref > 1 then copymsg and free original. Packet may be
12716 	 * changed and do not want other entity who has a reference to this
12717 	 * message to trip over the changes. This is a blind change because
12718 	 * trying to catch all places that might change packet is too
12719 	 * difficult (since it may be a module above this one)
12720 	 *
12721 	 * This corresponds to the non-fast path case. We walk down the full
12722 	 * chain in this case, and check the db_ref count of all the dblks,
12723 	 * and do a copymsg if required. It is possible that the db_ref counts
12724 	 * of the data blocks in the mblk chain can be different.
12725 	 * For Example, we can get a DL_UNITDATA_IND(M_PROTO) with a db_ref
12726 	 * count of 1, followed by a M_DATA block with a ref count of 2, if
12727 	 * 'snoop' is running.
12728 	 */
12729 	for (mp1 = mp; mp1 != NULL; mp1 = mp1->b_cont) {
12730 		if (mp1->b_datap->db_ref > 1) {
12731 			must_copy = B_TRUE;
12732 			break;
12733 		}
12734 	}
12735 
12736 	if (must_copy) {
12737 		mp1 = copymsg(mp);
12738 		if (mp1 == NULL) {
12739 			for (mp1 = mp; mp1 != NULL;
12740 			    mp1 = mp1->b_cont) {
12741 				mp1->b_next = NULL;
12742 				mp1->b_prev = NULL;
12743 			}
12744 			freemsg(mp);
12745 			BUMP_MIB(&ip_mib, ipInDiscards);
12746 			return (B_TRUE);
12747 		}
12748 		for (from_mp = mp, to_mp = mp1; from_mp != NULL;
12749 		    from_mp = from_mp->b_cont, to_mp = to_mp->b_cont) {
12750 			/* Copy b_next - used in M_BREAK messages */
12751 			to_mp->b_next = from_mp->b_next;
12752 			from_mp->b_next = NULL;
12753 			/* Copy b_prev - used by ip_mroute_decap */
12754 			to_mp->b_prev = from_mp->b_prev;
12755 			from_mp->b_prev = NULL;
12756 		}
12757 		*first_mpp = first_mp = mp1;
12758 		freemsg(mp);
12759 		mp = mp1;
12760 		*mpp = mp1;
12761 	}
12762 
12763 	ipha = (ipha_t *)mp->b_rptr;
12764 
12765 	/*
12766 	 * previous code has a case for M_DATA.
12767 	 * We want to check how that happens.
12768 	 */
12769 	ASSERT(first_mp->b_datap->db_type != M_DATA);
12770 	switch (first_mp->b_datap->db_type) {
12771 	case M_PROTO:
12772 	case M_PCPROTO:
12773 		if (((dl_unitdata_ind_t *)rptr)->dl_primitive !=
12774 		    DL_UNITDATA_IND) {
12775 			/* Go handle anything other than data elsewhere. */
12776 			ip_rput_dlpi(q, mp);
12777 			return (B_TRUE);
12778 		}
12779 		*ll_multicast = ((dl_unitdata_ind_t *)rptr)->dl_group_address;
12780 		/* Ditch the DLPI header. */
12781 		mp1 = mp->b_cont;
12782 		ASSERT(first_mp == mp);
12783 		*first_mpp = mp1;
12784 		freeb(mp);
12785 		*mpp = mp1;
12786 		return (B_FALSE);
12787 	case M_BREAK:
12788 		/*
12789 		 * A packet arrives as M_BREAK following a cycle through
12790 		 * ip_rput, ip_newroute, ... and finally ire_add_then_send.
12791 		 * This is an IP datagram sans lower level header.
12792 		 * M_BREAK are also used to pass back in multicast packets
12793 		 * that are encapsulated with a source route.
12794 		 */
12795 		/* Ditch the M_BREAK mblk */
12796 		mp1 = mp->b_cont;
12797 		ASSERT(first_mp == mp);
12798 		*first_mpp = mp1;
12799 		freeb(mp);
12800 		mp = mp1;
12801 		mp->b_next = NULL;
12802 		*mpp = mp;
12803 		*ll_multicast = 0;
12804 		return (B_FALSE);
12805 	case M_IOCACK:
12806 		ip1dbg(("got iocack "));
12807 		iocp = (struct iocblk *)mp->b_rptr;
12808 		switch (iocp->ioc_cmd) {
12809 		case DL_IOC_HDR_INFO:
12810 			ill = (ill_t *)q->q_ptr;
12811 			ill_fastpath_ack(ill, mp);
12812 			return (B_TRUE);
12813 		case SIOCSTUNPARAM:
12814 		case OSIOCSTUNPARAM:
12815 			/* Go through qwriter_ip */
12816 			break;
12817 		case SIOCGTUNPARAM:
12818 		case OSIOCGTUNPARAM:
12819 			ip_rput_other(NULL, q, mp, NULL);
12820 			return (B_TRUE);
12821 		default:
12822 			putnext(q, mp);
12823 			return (B_TRUE);
12824 		}
12825 		/* FALLTHRU */
12826 	case M_ERROR:
12827 	case M_HANGUP:
12828 		/*
12829 		 * Since this is on the ill stream we unconditionally
12830 		 * bump up the refcount
12831 		 */
12832 		ill_refhold(ill);
12833 		(void) qwriter_ip(NULL, ill, q, mp, ip_rput_other, CUR_OP,
12834 		    B_FALSE);
12835 		return (B_TRUE);
12836 	case M_CTL:
12837 		if ((MBLKL(first_mp) >= sizeof (da_ipsec_t)) &&
12838 		    (((da_ipsec_t *)first_mp->b_rptr)->da_type ==
12839 			IPHADA_M_CTL)) {
12840 			/*
12841 			 * It's an IPsec accelerated packet.
12842 			 * Make sure that the ill from which we received the
12843 			 * packet has enabled IPsec hardware acceleration.
12844 			 */
12845 			if (!(ill->ill_capabilities &
12846 			    (ILL_CAPAB_AH|ILL_CAPAB_ESP))) {
12847 				/* IPsec kstats: bean counter */
12848 				freemsg(mp);
12849 				return (B_TRUE);
12850 			}
12851 
12852 			/*
12853 			 * Make mp point to the mblk following the M_CTL,
12854 			 * then process according to type of mp.
12855 			 * After this processing, first_mp will point to
12856 			 * the data-attributes and mp to the pkt following
12857 			 * the M_CTL.
12858 			 */
12859 			mp = first_mp->b_cont;
12860 			if (mp == NULL) {
12861 				freemsg(first_mp);
12862 				return (B_TRUE);
12863 			}
12864 			/*
12865 			 * A Hardware Accelerated packet can only be M_DATA
12866 			 * ESP or AH packet.
12867 			 */
12868 			if (mp->b_datap->db_type != M_DATA) {
12869 				/* non-M_DATA IPsec accelerated packet */
12870 				IPSECHW_DEBUG(IPSECHW_PKT,
12871 				    ("non-M_DATA IPsec accelerated pkt\n"));
12872 				freemsg(first_mp);
12873 				return (B_TRUE);
12874 			}
12875 			ipha = (ipha_t *)mp->b_rptr;
12876 			if (ipha->ipha_protocol != IPPROTO_AH &&
12877 			    ipha->ipha_protocol != IPPROTO_ESP) {
12878 				IPSECHW_DEBUG(IPSECHW_PKT,
12879 				    ("non-M_DATA IPsec accelerated pkt\n"));
12880 				freemsg(first_mp);
12881 				return (B_TRUE);
12882 			}
12883 			*mpp = mp;
12884 			return (B_FALSE);
12885 		}
12886 		putnext(q, mp);
12887 		return (B_TRUE);
12888 	case M_FLUSH:
12889 		if (*mp->b_rptr & FLUSHW) {
12890 			*mp->b_rptr &= ~FLUSHR;
12891 			qreply(q, mp);
12892 			return (B_TRUE);
12893 		}
12894 		freemsg(mp);
12895 		return (B_TRUE);
12896 	case M_IOCNAK:
12897 		ip1dbg(("got iocnak "));
12898 		iocp = (struct iocblk *)mp->b_rptr;
12899 		switch (iocp->ioc_cmd) {
12900 		case DL_IOC_HDR_INFO:
12901 		case SIOCSTUNPARAM:
12902 		case OSIOCSTUNPARAM:
12903 			/*
12904 			 * Since this is on the ill stream we unconditionally
12905 			 * bump up the refcount
12906 			 */
12907 			ill_refhold(ill);
12908 			(void) qwriter_ip(NULL, ill, q, mp, ip_rput_other,
12909 			    CUR_OP, B_FALSE);
12910 			return (B_TRUE);
12911 		case SIOCGTUNPARAM:
12912 		case OSIOCGTUNPARAM:
12913 			ip_rput_other(NULL, q, mp, NULL);
12914 			return (B_TRUE);
12915 		default:
12916 			break;
12917 		}
12918 		/* FALLTHRU */
12919 	default:
12920 		putnext(q, mp);
12921 		return (B_TRUE);
12922 	}
12923 }
12924 
12925 /* Read side put procedure.  Packets coming from the wire arrive here. */
12926 void
12927 ip_rput(queue_t *q, mblk_t *mp)
12928 {
12929 	ill_t		*ill;
12930 
12931 	TRACE_1(TR_FAC_IP, TR_IP_RPUT_START, "ip_rput_start: q %p", q);
12932 
12933 	ill = (ill_t *)q->q_ptr;
12934 
12935 	if (ill->ill_state_flags & (ILL_CONDEMNED | ILL_LL_SUBNET_PENDING)) {
12936 		union DL_primitives *dl;
12937 
12938 		/*
12939 		 * Things are opening or closing. Only accept DLPI control
12940 		 * messages. In the open case, the ill->ill_ipif has not yet
12941 		 * been created. In the close case, things hanging off the
12942 		 * ill could have been freed already. In either case it
12943 		 * may not be safe to proceed further.
12944 		 */
12945 
12946 		dl = (union DL_primitives *)mp->b_rptr;
12947 		if ((mp->b_datap->db_type != M_PCPROTO) ||
12948 		    (dl->dl_primitive == DL_UNITDATA_IND)) {
12949 			/*
12950 			 * Also SIOC[GS]TUN* ioctls can come here.
12951 			 */
12952 			ip_ioctl_freemsg(mp);
12953 			TRACE_2(TR_FAC_IP, TR_IP_RPUT_END,
12954 			    "ip_input_end: q %p (%S)", q, "uninit");
12955 			return;
12956 		}
12957 	}
12958 
12959 	/*
12960 	 * if db_ref > 1 then copymsg and free original. Packet may be
12961 	 * changed and we do not want the other entity who has a reference to
12962 	 * this message to trip over the changes. This is a blind change because
12963 	 * trying to catch all places that might change the packet is too
12964 	 * difficult.
12965 	 *
12966 	 * This corresponds to the fast path case, where we have a chain of
12967 	 * M_DATA mblks.  We check the db_ref count of only the 1st data block
12968 	 * in the mblk chain. There doesn't seem to be a reason why a device
12969 	 * driver would send up data with varying db_ref counts in the mblk
12970 	 * chain. In any case the Fast path is a private interface, and our
12971 	 * drivers don't do such a thing. Given the above assumption, there is
12972 	 * no need to walk down the entire mblk chain (which could have a
12973 	 * potential performance problem)
12974 	 */
12975 	if (mp->b_datap->db_ref > 1) {
12976 		mblk_t  *mp1;
12977 		boolean_t adjusted = B_FALSE;
12978 		IP_STAT(ip_db_ref);
12979 
12980 		/*
12981 		 * The IP_RECVSLLA option depends on having the link layer
12982 		 * header. First check that:
12983 		 * a> the underlying device is of type ether, since this
12984 		 * option is currently supported only over ethernet.
12985 		 * b> there is enough room to copy over the link layer header.
12986 		 *
12987 		 * Once the checks are done, adjust rptr so that the link layer
12988 		 * header will be copied via copymsg. Note that, IFT_ETHER may
12989 		 * be returned by some non-ethernet drivers but in this case the
12990 		 * second check will fail.
12991 		 */
12992 		if (ill->ill_type == IFT_ETHER &&
12993 		    (mp->b_rptr - mp->b_datap->db_base) >=
12994 		    sizeof (struct ether_header)) {
12995 			mp->b_rptr -= sizeof (struct ether_header);
12996 			adjusted = B_TRUE;
12997 		}
12998 		mp1 = copymsg(mp);
12999 		if (mp1 == NULL) {
13000 			/* Clear b_next - used in M_BREAK messages */
13001 			mp->b_next = NULL;
13002 			/* clear b_prev - used by ip_mroute_decap */
13003 			mp->b_prev = NULL;
13004 			freemsg(mp);
13005 			BUMP_MIB(&ip_mib, ipInDiscards);
13006 			TRACE_2(TR_FAC_IP, TR_IP_RPUT_END,
13007 			    "ip_rput_end: q %p (%S)", q, "copymsg");
13008 			return;
13009 		}
13010 		if (adjusted) {
13011 			/*
13012 			 * Copy is done. Restore the pointer in the _new_ mblk
13013 			 */
13014 			mp1->b_rptr += sizeof (struct ether_header);
13015 		}
13016 		/* Copy b_next - used in M_BREAK messages */
13017 		mp1->b_next = mp->b_next;
13018 		mp->b_next = NULL;
13019 		/* Copy b_prev - used by ip_mroute_decap */
13020 		mp1->b_prev = mp->b_prev;
13021 		mp->b_prev = NULL;
13022 		freemsg(mp);
13023 		mp = mp1;
13024 	}
13025 
13026 	TRACE_2(TR_FAC_IP, TR_IP_RPUT_END,
13027 	    "ip_rput_end: q %p (%S)", q, "end");
13028 
13029 	ip_input(ill, NULL, mp, 0);
13030 }
13031 
13032 /*
13033  * Direct read side procedure capable of dealing with chains. GLDv3 based
13034  * drivers call this function directly with mblk chains while STREAMS
13035  * read side procedure ip_rput() calls this for single packet with ip_ring
13036  * set to NULL to process one packet at a time.
13037  *
13038  * The ill will always be valid if this function is called directly from
13039  * the driver.
13040  */
13041 /*ARGSUSED*/
13042 void
13043 ip_input(ill_t *ill, ill_rx_ring_t *ip_ring, mblk_t *mp_chain, size_t hdrlen)
13044 {
13045 	ipaddr_t		dst;
13046 	ire_t			*ire;
13047 	ipha_t			*ipha;
13048 	uint_t			pkt_len;
13049 	ssize_t			len;
13050 	uint_t			opt_len;
13051 	int			ll_multicast;
13052 	int			cgtp_flt_pkt;
13053 	queue_t			*q = ill->ill_rq;
13054 	squeue_t		*curr_sqp = NULL;
13055 	mblk_t 			*head = NULL;
13056 	mblk_t			*tail = NULL;
13057 	mblk_t			*first_mp;
13058 	mblk_t 			*mp;
13059 	int			cnt = 0;
13060 
13061 	ASSERT(mp_chain != NULL);
13062 	ASSERT(ill != NULL);
13063 
13064 	TRACE_1(TR_FAC_IP, TR_IP_RPUT_START, "ip_input_start: q %p", q);
13065 
13066 #define	rptr	((uchar_t *)ipha)
13067 
13068 	while (mp_chain != NULL) {
13069 		first_mp = mp = mp_chain;
13070 		mp_chain = mp_chain->b_next;
13071 		mp->b_next = NULL;
13072 		ll_multicast = 0;
13073 		ire = NULL;
13074 
13075 		/*
13076 		 * ip_input fast path
13077 		 */
13078 
13079 		/* mblk type is not M_DATA */
13080 		if (mp->b_datap->db_type != M_DATA) {
13081 			if (ip_rput_process_notdata(q, &first_mp, ill,
13082 			    &ll_multicast, &mp))
13083 				continue;
13084 		}
13085 
13086 		ASSERT(mp->b_datap->db_type == M_DATA);
13087 		ASSERT(mp->b_datap->db_ref == 1);
13088 
13089 		/*
13090 		 * Invoke the CGTP (multirouting) filtering module to process
13091 		 * the incoming packet. Packets identified as duplicates
13092 		 * must be discarded. Filtering is active only if the
13093 		 * the ip_cgtp_filter ndd variable is non-zero.
13094 		 */
13095 		cgtp_flt_pkt = CGTP_IP_PKT_NOT_CGTP;
13096 		if (ip_cgtp_filter && (ip_cgtp_filter_ops != NULL)) {
13097 			cgtp_flt_pkt =
13098 			    ip_cgtp_filter_ops->cfo_filter_fp(q, mp);
13099 			if (cgtp_flt_pkt == CGTP_IP_PKT_DUPLICATE) {
13100 				freemsg(first_mp);
13101 				continue;
13102 			}
13103 		}
13104 
13105 		ipha = (ipha_t *)mp->b_rptr;
13106 		len = mp->b_wptr - rptr;
13107 
13108 		BUMP_MIB(&ip_mib, ipInReceives);
13109 
13110 		/*
13111 		 * IP header ptr not aligned?
13112 		 * OR IP header not complete in first mblk
13113 		 */
13114 		if (!OK_32PTR(rptr) || len < IP_SIMPLE_HDR_LENGTH) {
13115 			if (!ip_check_and_align_header(q, mp))
13116 				continue;
13117 			ipha = (ipha_t *)mp->b_rptr;
13118 			len = mp->b_wptr - rptr;
13119 		}
13120 
13121 		/* multiple mblk or too short */
13122 		pkt_len = ntohs(ipha->ipha_length);
13123 		len -= pkt_len;
13124 		if (len != 0) {
13125 			/*
13126 			 * Make sure we have data length consistent
13127 			 * with the IP header.
13128 			 */
13129 			if (mp->b_cont == NULL) {
13130 				if (len < 0 || pkt_len < IP_SIMPLE_HDR_LENGTH) {
13131 					BUMP_MIB(&ip_mib, ipInHdrErrors);
13132 					ip2dbg(("ip_input: drop pkt\n"));
13133 					freemsg(mp);
13134 					continue;
13135 				}
13136 				mp->b_wptr = rptr + pkt_len;
13137 			} else if (len += msgdsize(mp->b_cont)) {
13138 				if (len < 0 || pkt_len < IP_SIMPLE_HDR_LENGTH) {
13139 					BUMP_MIB(&ip_mib, ipInHdrErrors);
13140 					ip2dbg(("ip_input: drop pkt\n"));
13141 					freemsg(mp);
13142 					continue;
13143 				}
13144 				(void) adjmsg(mp, -len);
13145 				IP_STAT(ip_multimblk3);
13146 			}
13147 		}
13148 
13149 		if (ip_loopback_src_or_dst(ipha, ill)) {
13150 			ip2dbg(("ip_input: drop pkt\n"));
13151 			freemsg(mp);
13152 			continue;
13153 		}
13154 
13155 		opt_len = ipha->ipha_version_and_hdr_length -
13156 		    IP_SIMPLE_HDR_VERSION;
13157 		/* IP version bad or there are IP options */
13158 		if (opt_len) {
13159 			if (len != 0)
13160 				IP_STAT(ip_multimblk4);
13161 			else
13162 				IP_STAT(ip_ipoptions);
13163 			if (!ip_rput_multimblk_ipoptions(q, mp, &ipha, &dst))
13164 				continue;
13165 		} else {
13166 			dst = ipha->ipha_dst;
13167 		}
13168 
13169 		/*
13170 		 * If rsvpd is running, let RSVP daemon handle its processing
13171 		 * and forwarding of RSVP multicast/unicast packets.
13172 		 * If rsvpd is not running but mrouted is running, RSVP
13173 		 * multicast packets are forwarded as multicast traffic
13174 		 * and RSVP unicast packets are forwarded by unicast router.
13175 		 * If neither rsvpd nor mrouted is running, RSVP multicast
13176 		 * packets are not forwarded, but the unicast packets are
13177 		 * forwarded like unicast traffic.
13178 		 */
13179 		if (ipha->ipha_protocol == IPPROTO_RSVP &&
13180 		    ipcl_proto_search(IPPROTO_RSVP) != NULL) {
13181 			/* RSVP packet and rsvpd running. Treat as ours */
13182 			ip2dbg(("ip_input: RSVP for us: 0x%x\n", ntohl(dst)));
13183 			/*
13184 			 * This assumes that we deliver to all streams for
13185 			 * multicast and broadcast packets.
13186 			 * We have to force ll_multicast to 1 to handle the
13187 			 * M_DATA messages passed in from ip_mroute_decap.
13188 			 */
13189 			dst = INADDR_BROADCAST;
13190 			ll_multicast = 1;
13191 		} else if (CLASSD(dst)) {
13192 			/* packet is multicast */
13193 			mp->b_next = NULL;
13194 			if (ip_rput_process_multicast(q, mp, ill, ipha,
13195 			    &ll_multicast, &dst))
13196 				continue;
13197 		}
13198 
13199 
13200 		/*
13201 		 * Check if the packet is coming from the Mobile IP
13202 		 * forward tunnel interface
13203 		 */
13204 		if (ill->ill_srcif_refcnt > 0) {
13205 			ire = ire_srcif_table_lookup(dst, IRE_INTERFACE,
13206 			    NULL, ill, MATCH_IRE_TYPE);
13207 			if (ire != NULL && ire->ire_dlureq_mp == NULL &&
13208 			    ire->ire_ipif->ipif_net_type ==
13209 			    IRE_IF_RESOLVER) {
13210 				/* We need to resolve the link layer info */
13211 				ire_refrele(ire);
13212 				ip_rput_noire(q, (ill_t *)q->q_ptr, mp,
13213 				    ll_multicast, dst);
13214 				continue;
13215 			}
13216 		}
13217 
13218 		if (ire == NULL)
13219 			ire = ire_cache_lookup(dst, ALL_ZONES);
13220 
13221 		/*
13222 		 * If mipagent is running and reverse tunnel is created as per
13223 		 * mobile node request, then any packet coming through the
13224 		 * incoming interface from the mobile-node, should be reverse
13225 		 * tunneled to it's home agent except those that are destined
13226 		 * to foreign agent only.
13227 		 * This needs source address based ire lookup. The routing
13228 		 * entries for source address based lookup are only created by
13229 		 * mipagent program only when a reverse tunnel is created.
13230 		 * Reference : RFC2002, RFC2344
13231 		 */
13232 		if (ill->ill_mrtun_refcnt > 0) {
13233 			ipaddr_t	srcaddr;
13234 			ire_t		*tmp_ire;
13235 
13236 			tmp_ire = ire;	/* Save, we might need it later */
13237 			if (ire == NULL || (ire->ire_type != IRE_LOCAL &&
13238 			    ire->ire_type != IRE_BROADCAST)) {
13239 				srcaddr = ipha->ipha_src;
13240 				ire = ire_mrtun_lookup(srcaddr, ill);
13241 				if (ire != NULL) {
13242 					/*
13243 					 * Should not be getting iphada packet
13244 					 * here. we should only get those for
13245 					 * IRE_LOCAL traffic, excluded above.
13246 					 * Fail-safe (drop packet) in the event
13247 					 * hardware is misbehaving.
13248 					 */
13249 					if (first_mp != mp) {
13250 						/* IPsec KSTATS: beancount me */
13251 						freemsg(first_mp);
13252 					} else {
13253 						/*
13254 						 * This packet must be forwarded
13255 						 * to Reverse Tunnel
13256 						 */
13257 						ip_mrtun_forward(ire, ill, mp);
13258 					}
13259 					ire_refrele(ire);
13260 					if (tmp_ire != NULL)
13261 						ire_refrele(tmp_ire);
13262 					TRACE_2(TR_FAC_IP, TR_IP_RPUT_END,
13263 					    "ip_input_end: q %p (%S)",
13264 					    q, "uninit");
13265 					continue;
13266 				}
13267 			}
13268 			/*
13269 			 * If this packet is from a non-mobilenode  or a
13270 			 * mobile-node which does not request reverse
13271 			 * tunnel service
13272 			 */
13273 			ire = tmp_ire;
13274 		}
13275 
13276 
13277 		/*
13278 		 * If we reach here that means the incoming packet satisfies
13279 		 * one of the following conditions:
13280 		 *   - packet is from a mobile node which does not request
13281 		 *	reverse tunnel
13282 		 *   - packet is from a non-mobile node, which is the most
13283 		 *	common case
13284 		 *   - packet is from a reverse tunnel enabled mobile node
13285 		 *	and destined to foreign agent only
13286 		 */
13287 
13288 		if (ire == NULL) {
13289 			/*
13290 			 * No IRE for this destination, so it can't be for us.
13291 			 * Unless we are forwarding, drop the packet.
13292 			 * We have to let source routed packets through
13293 			 * since we don't yet know if they are 'ping -l'
13294 			 * packets i.e. if they will go out over the
13295 			 * same interface as they came in on.
13296 			 */
13297 			ip_rput_noire(q, NULL, mp, ll_multicast, dst);
13298 			continue;
13299 		}
13300 
13301 		/* broadcast? */
13302 		if (ire->ire_type == IRE_BROADCAST) {
13303 			if (ip_rput_process_broadcast(&q, mp, &ire, ipha, ill,
13304 			    dst, cgtp_flt_pkt, ll_multicast)) {
13305 				continue;
13306 			}
13307 		} else if (ire->ire_stq != NULL) {
13308 			/* fowarding? */
13309 			ip_rput_process_forward(q, mp, ire, ipha, ill,
13310 			    ll_multicast);
13311 			continue;
13312 		}
13313 
13314 		/* packet not for us */
13315 		if (ire->ire_rfq != q) {
13316 			if (ip_rput_notforus(&q, mp, ire, ill)) {
13317 				continue;
13318 			}
13319 		}
13320 
13321 		switch (ipha->ipha_protocol) {
13322 		case IPPROTO_TCP:
13323 			ASSERT(first_mp == mp);
13324 			if ((mp = ip_tcp_input(mp, ipha, ill, B_FALSE, ire,
13325 				mp, 0, q, ip_ring)) != NULL) {
13326 				if (curr_sqp == NULL) {
13327 					curr_sqp = GET_SQUEUE(mp);
13328 					ASSERT(cnt == 0);
13329 					cnt++;
13330 					head = tail = mp;
13331 				} else if (curr_sqp == GET_SQUEUE(mp)) {
13332 					ASSERT(tail != NULL);
13333 					cnt++;
13334 					tail->b_next = mp;
13335 					tail = mp;
13336 				} else {
13337 					/*
13338 					 * A different squeue. Send the
13339 					 * chain for the previous squeue on
13340 					 * its way. This shouldn't happen
13341 					 * often unless interrupt binding
13342 					 * changes.
13343 					 */
13344 					IP_STAT(ip_input_multi_squeue);
13345 					squeue_enter_chain(curr_sqp, head,
13346 					    tail, cnt, SQTAG_IP_INPUT);
13347 					curr_sqp = GET_SQUEUE(mp);
13348 					head = mp;
13349 					tail = mp;
13350 					cnt = 1;
13351 				}
13352 			}
13353 			IRE_REFRELE(ire);
13354 			continue;
13355 		case IPPROTO_UDP:
13356 			ASSERT(first_mp == mp);
13357 			ip_udp_input(q, mp, ipha, ire, ill);
13358 			IRE_REFRELE(ire);
13359 			continue;
13360 		case IPPROTO_SCTP:
13361 			ASSERT(first_mp == mp);
13362 			ip_sctp_input(mp, ipha, ill, B_FALSE, ire, mp, 0,
13363 			    q, dst);
13364 			continue;
13365 		default:
13366 			ip_proto_input(q, first_mp, ipha, ire, ill);
13367 			IRE_REFRELE(ire);
13368 			continue;
13369 		}
13370 	}
13371 
13372 	if (head != NULL)
13373 		squeue_enter_chain(curr_sqp, head, tail, cnt, SQTAG_IP_INPUT);
13374 
13375 	/*
13376 	 * This code is there just to make netperf/ttcp look good.
13377 	 *
13378 	 * Its possible that after being in polling mode (and having cleared
13379 	 * the backlog), squeues have turned the interrupt frequency higher
13380 	 * to improve latency at the expense of more CPU utilization (less
13381 	 * packets per interrupts or more number of interrupts). Workloads
13382 	 * like ttcp/netperf do manage to tickle polling once in a while
13383 	 * but for the remaining time, stay in higher interrupt mode since
13384 	 * their packet arrival rate is pretty uniform and this shows up
13385 	 * as higher CPU utilization. Since people care about CPU utilization
13386 	 * while running netperf/ttcp, turn the interrupt frequency back to
13387 	 * normal/default if polling has not been used in ip_poll_normal_ticks.
13388 	 */
13389 	if (ip_ring != NULL && (ip_ring->rr_poll_state & ILL_POLLING)) {
13390 		if (lbolt >= (ip_ring->rr_poll_time + ip_poll_normal_ticks)) {
13391 			ip_ring->rr_poll_state &= ~ILL_POLLING;
13392 			ip_ring->rr_blank(ip_ring->rr_handle,
13393 			    ip_ring->rr_normal_blank_time,
13394 			    ip_ring->rr_normal_pkt_cnt);
13395 		}
13396 	}
13397 
13398 	TRACE_2(TR_FAC_IP, TR_IP_RPUT_END,
13399 	    "ip_input_end: q %p (%S)", q, "end");
13400 #undef	rptr
13401 }
13402 
13403 static void
13404 ip_dlpi_error(ill_t *ill, t_uscalar_t prim, t_uscalar_t dl_err,
13405     t_uscalar_t err)
13406 {
13407 	if (dl_err == DL_SYSERR) {
13408 		(void) mi_strlog(ill->ill_rq, 1, SL_CONSOLE|SL_ERROR|SL_TRACE,
13409 		    "%s: %s failed: DL_SYSERR (errno %u)\n",
13410 		    ill->ill_name, dlpi_prim_str(prim), err);
13411 		return;
13412 	}
13413 
13414 	(void) mi_strlog(ill->ill_rq, 1, SL_CONSOLE|SL_ERROR|SL_TRACE,
13415 	    "%s: %s failed: %s\n", ill->ill_name, dlpi_prim_str(prim),
13416 	    dlpi_err_str(dl_err));
13417 }
13418 
13419 /*
13420  * ip_rput_dlpi is called by ip_rput to handle all DLPI messages other
13421  * than DL_UNITDATA_IND messages. If we need to process this message
13422  * exclusively, we call qwriter_ip, in which case we also need to call
13423  * ill_refhold before that, since qwriter_ip does an ill_refrele.
13424  */
13425 void
13426 ip_rput_dlpi(queue_t *q, mblk_t *mp)
13427 {
13428 	dl_ok_ack_t	*dloa = (dl_ok_ack_t *)mp->b_rptr;
13429 	dl_error_ack_t	*dlea = (dl_error_ack_t *)dloa;
13430 	ill_t		*ill;
13431 
13432 	ip1dbg(("ip_rput_dlpi"));
13433 	ill = (ill_t *)q->q_ptr;
13434 	switch (dloa->dl_primitive) {
13435 	case DL_ERROR_ACK:
13436 		ip2dbg(("ip_rput_dlpi(%s): DL_ERROR_ACK %s (0x%x): "
13437 		    "%s (0x%x), unix %u\n", ill->ill_name,
13438 		    dlpi_prim_str(dlea->dl_error_primitive),
13439 		    dlea->dl_error_primitive,
13440 		    dlpi_err_str(dlea->dl_errno),
13441 		    dlea->dl_errno,
13442 		    dlea->dl_unix_errno));
13443 		switch (dlea->dl_error_primitive) {
13444 		case DL_NOTIFY_REQ:
13445 		case DL_UNBIND_REQ:
13446 		case DL_ATTACH_REQ:
13447 		case DL_DETACH_REQ:
13448 		case DL_INFO_REQ:
13449 		case DL_BIND_REQ:
13450 		case DL_ENABMULTI_REQ:
13451 		case DL_PHYS_ADDR_REQ:
13452 		case DL_CAPABILITY_REQ:
13453 		case DL_CONTROL_REQ:
13454 			/*
13455 			 * Refhold the ill to match qwriter_ip which does a
13456 			 * refrele. Since this is on the ill stream we
13457 			 * unconditionally bump up the refcount without
13458 			 * checking for ILL_CAN_LOOKUP
13459 			 */
13460 			ill_refhold(ill);
13461 			(void) qwriter_ip(NULL, ill, q, mp, ip_rput_dlpi_writer,
13462 			    CUR_OP, B_FALSE);
13463 			return;
13464 		case DL_DISABMULTI_REQ:
13465 			freemsg(mp);	/* Don't want to pass this up */
13466 			return;
13467 		default:
13468 			break;
13469 		}
13470 		ip_dlpi_error(ill, dlea->dl_error_primitive,
13471 		    dlea->dl_errno, dlea->dl_unix_errno);
13472 		freemsg(mp);
13473 		return;
13474 	case DL_INFO_ACK:
13475 	case DL_BIND_ACK:
13476 	case DL_PHYS_ADDR_ACK:
13477 	case DL_NOTIFY_ACK:
13478 	case DL_CAPABILITY_ACK:
13479 	case DL_CONTROL_ACK:
13480 		/*
13481 		 * Refhold the ill to match qwriter_ip which does a refrele
13482 		 * Since this is on the ill stream we unconditionally
13483 		 * bump up the refcount without doing ILL_CAN_LOOKUP.
13484 		 */
13485 		ill_refhold(ill);
13486 		(void) qwriter_ip(NULL, ill, q, mp, ip_rput_dlpi_writer,
13487 		    CUR_OP, B_FALSE);
13488 		return;
13489 	case DL_NOTIFY_IND:
13490 		ill_refhold(ill);
13491 		/*
13492 		 * The DL_NOTIFY_IND is an asynchronous message that has no
13493 		 * relation to the current ioctl in progress (if any). Hence we
13494 		 * pass in NEW_OP in this case.
13495 		 */
13496 		(void) qwriter_ip(NULL, ill, q, mp, ip_rput_dlpi_writer,
13497 		    NEW_OP, B_FALSE);
13498 		return;
13499 	case DL_OK_ACK:
13500 		ip1dbg(("ip_rput: DL_OK_ACK for %s\n",
13501 		    dlpi_prim_str((int)dloa->dl_correct_primitive)));
13502 		switch (dloa->dl_correct_primitive) {
13503 		case DL_UNBIND_REQ:
13504 			mutex_enter(&ill->ill_lock);
13505 			ill->ill_state_flags |= ILL_DL_UNBIND_DONE;
13506 			cv_signal(&ill->ill_cv);
13507 			mutex_exit(&ill->ill_lock);
13508 			/* FALLTHRU */
13509 		case DL_ATTACH_REQ:
13510 		case DL_DETACH_REQ:
13511 			/*
13512 			 * Refhold the ill to match qwriter_ip which does a
13513 			 * refrele. Since this is on the ill stream we
13514 			 * unconditionally bump up the refcount
13515 			 */
13516 			ill_refhold(ill);
13517 			qwriter_ip(NULL, ill, q, mp, ip_rput_dlpi_writer,
13518 			    CUR_OP, B_FALSE);
13519 			return;
13520 		case DL_ENABMULTI_REQ:
13521 			if (ill->ill_dlpi_multicast_state == IDMS_INPROGRESS)
13522 				ill->ill_dlpi_multicast_state = IDMS_OK;
13523 			break;
13524 
13525 		}
13526 		break;
13527 	default:
13528 		break;
13529 	}
13530 	freemsg(mp);
13531 }
13532 
13533 /*
13534  * This function is used to free a message that has gone through
13535  * mi_copyin processing which modifies the M_IOCTL mblk's b_next
13536  * and b_prev pointers. We use this function to set b_next/b_prev
13537  * to NULL and free them.
13538  */
13539 void
13540 ip_ioctl_freemsg(mblk_t *mp)
13541 {
13542 	mblk_t	*bp = mp;
13543 
13544 	for (; bp != NULL; bp = bp->b_cont) {
13545 		bp->b_prev = NULL;
13546 		bp->b_next = NULL;
13547 	}
13548 	freemsg(mp);
13549 }
13550 
13551 /*
13552  * Handling of DLPI messages that require exclusive access to the ipsq.
13553  *
13554  * Need to do ill_pending_mp_release on ioctl completion, which could
13555  * happen here. (along with mi_copy_done)
13556  */
13557 /* ARGSUSED */
13558 static void
13559 ip_rput_dlpi_writer(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg)
13560 {
13561 	dl_ok_ack_t	*dloa = (dl_ok_ack_t *)mp->b_rptr;
13562 	dl_error_ack_t	*dlea = (dl_error_ack_t *)dloa;
13563 	int		err = 0;
13564 	ill_t		*ill;
13565 	ipif_t		*ipif = NULL;
13566 	mblk_t		*mp1 = NULL;
13567 	conn_t		*connp = NULL;
13568 	t_uscalar_t	physaddr_req;
13569 	mblk_t		*mp_hw;
13570 	union DL_primitives *dlp;
13571 	boolean_t	success;
13572 	boolean_t	ioctl_aborted = B_FALSE;
13573 	boolean_t	log = B_TRUE;
13574 
13575 	ip1dbg(("ip_rput_dlpi_writer .."));
13576 	ill = (ill_t *)q->q_ptr;
13577 	ASSERT(ipsq == ill->ill_phyint->phyint_ipsq);
13578 
13579 	ASSERT(IAM_WRITER_ILL(ill));
13580 
13581 	/*
13582 	 * ipsq_pending_mp and ipsq_pending_ipif track each other. i.e.
13583 	 * both are null or non-null. However we can assert that only
13584 	 * after grabbing the ipsq_lock. So we don't make any assertion
13585 	 * here and in other places in the code.
13586 	 */
13587 	ipif = ipsq->ipsq_pending_ipif;
13588 	/*
13589 	 * The current ioctl could have been aborted by the user and a new
13590 	 * ioctl to bring up another ill could have started. We could still
13591 	 * get a response from the driver later.
13592 	 */
13593 	if (ipif != NULL && ipif->ipif_ill != ill)
13594 		ioctl_aborted = B_TRUE;
13595 
13596 	switch (dloa->dl_primitive) {
13597 	case DL_ERROR_ACK:
13598 		switch (dlea->dl_error_primitive) {
13599 		case DL_UNBIND_REQ:
13600 		case DL_ATTACH_REQ:
13601 		case DL_DETACH_REQ:
13602 		case DL_INFO_REQ:
13603 			ill_dlpi_done(ill, dlea->dl_error_primitive);
13604 			break;
13605 		case DL_NOTIFY_REQ:
13606 			ill_dlpi_done(ill, DL_NOTIFY_REQ);
13607 			log = B_FALSE;
13608 			break;
13609 		case DL_PHYS_ADDR_REQ:
13610 			/*
13611 			 * For IPv6 only, there are two additional
13612 			 * phys_addr_req's sent to the driver to get the
13613 			 * IPv6 token and lla. This allows IP to acquire
13614 			 * the hardware address format for a given interface
13615 			 * without having built in knowledge of the hardware
13616 			 * address. ill_phys_addr_pend keeps track of the last
13617 			 * DL_PAR sent so we know which response we are
13618 			 * dealing with. ill_dlpi_done will update
13619 			 * ill_phys_addr_pend when it sends the next req.
13620 			 * We don't complete the IOCTL until all three DL_PARs
13621 			 * have been attempted, so set *_len to 0 and break.
13622 			 */
13623 			physaddr_req = ill->ill_phys_addr_pend;
13624 			ill_dlpi_done(ill, DL_PHYS_ADDR_REQ);
13625 			if (physaddr_req == DL_IPV6_TOKEN) {
13626 				ill->ill_token_length = 0;
13627 				log = B_FALSE;
13628 				break;
13629 			} else if (physaddr_req == DL_IPV6_LINK_LAYER_ADDR) {
13630 				ill->ill_nd_lla_len = 0;
13631 				log = B_FALSE;
13632 				break;
13633 			}
13634 			/*
13635 			 * Something went wrong with the DL_PHYS_ADDR_REQ.
13636 			 * We presumably have an IOCTL hanging out waiting
13637 			 * for completion. Find it and complete the IOCTL
13638 			 * with the error noted.
13639 			 * However, ill_dl_phys was called on an ill queue
13640 			 * (from SIOCSLIFNAME), thus conn_pending_ill is not
13641 			 * set. But the ioctl is known to be pending on ill_wq.
13642 			 */
13643 			if (!ill->ill_ifname_pending)
13644 				break;
13645 			ill->ill_ifname_pending = 0;
13646 			if (!ioctl_aborted)
13647 				mp1 = ipsq_pending_mp_get(ipsq, &connp);
13648 			if (mp1 != NULL) {
13649 				/*
13650 				 * This operation (SIOCSLIFNAME) must have
13651 				 * happened on the ill. Assert there is no conn
13652 				 */
13653 				ASSERT(connp == NULL);
13654 				q = ill->ill_wq;
13655 			}
13656 			break;
13657 		case DL_BIND_REQ:
13658 			ill_dlpi_done(ill, DL_BIND_REQ);
13659 			if (ill->ill_ifname_pending)
13660 				break;
13661 			/*
13662 			 * Something went wrong with the bind.  We presumably
13663 			 * have an IOCTL hanging out waiting for completion.
13664 			 * Find it, take down the interface that was coming
13665 			 * up, and complete the IOCTL with the error noted.
13666 			 */
13667 			if (!ioctl_aborted)
13668 				mp1 = ipsq_pending_mp_get(ipsq, &connp);
13669 			if (mp1 != NULL) {
13670 				/*
13671 				 * This operation (SIOCSLIFFLAGS) must have
13672 				 * happened from a conn.
13673 				 */
13674 				ASSERT(connp != NULL);
13675 				q = CONNP_TO_WQ(connp);
13676 				if (ill->ill_move_in_progress) {
13677 					ILL_CLEAR_MOVE(ill);
13678 				}
13679 				(void) ipif_down(ipif, NULL, NULL);
13680 				/* error is set below the switch */
13681 			}
13682 			break;
13683 		case DL_ENABMULTI_REQ:
13684 			ip1dbg(("DL_ERROR_ACK to enabmulti\n"));
13685 
13686 			if (ill->ill_dlpi_multicast_state == IDMS_INPROGRESS)
13687 				ill->ill_dlpi_multicast_state = IDMS_FAILED;
13688 			if (ill->ill_dlpi_multicast_state == IDMS_FAILED) {
13689 				ipif_t *ipif;
13690 
13691 				log = B_FALSE;
13692 				printf("ip: joining multicasts failed (%d)"
13693 				    " on %s - will use link layer "
13694 				    "broadcasts for multicast\n",
13695 				    dlea->dl_errno, ill->ill_name);
13696 
13697 				/*
13698 				 * Set up the multicast mapping alone.
13699 				 * writer, so ok to access ill->ill_ipif
13700 				 * without any lock.
13701 				 */
13702 				ipif = ill->ill_ipif;
13703 				mutex_enter(&ill->ill_phyint->phyint_lock);
13704 				ill->ill_phyint->phyint_flags |=
13705 				    PHYI_MULTI_BCAST;
13706 				mutex_exit(&ill->ill_phyint->phyint_lock);
13707 
13708 				if (!ill->ill_isv6) {
13709 					(void) ipif_arp_setup_multicast(ipif,
13710 					    NULL);
13711 				} else {
13712 					(void) ipif_ndp_setup_multicast(ipif,
13713 					    NULL);
13714 				}
13715 			}
13716 			freemsg(mp);	/* Don't want to pass this up */
13717 			return;
13718 		case DL_CAPABILITY_REQ:
13719 		case DL_CONTROL_REQ:
13720 			ip1dbg(("ip_rput_dlpi_writer: got DL_ERROR_ACK for "
13721 			    "DL_CAPABILITY/CONTROL REQ\n"));
13722 			ill_dlpi_done(ill, dlea->dl_error_primitive);
13723 			ill->ill_capab_state = IDMS_FAILED;
13724 			freemsg(mp);
13725 			return;
13726 		}
13727 		/*
13728 		 * Note the error for IOCTL completion (mp1 is set when
13729 		 * ready to complete ioctl). If ill_ifname_pending_err is
13730 		 * set, an error occured during plumbing (ill_ifname_pending),
13731 		 * so we want to report that error.
13732 		 *
13733 		 * NOTE: there are two addtional DL_PHYS_ADDR_REQ's
13734 		 * (DL_IPV6_TOKEN and DL_IPV6_LINK_LAYER_ADDR) that are
13735 		 * expected to get errack'd if the driver doesn't support
13736 		 * these flags (e.g. ethernet). log will be set to B_FALSE
13737 		 * if these error conditions are encountered.
13738 		 */
13739 		if (mp1 != NULL) {
13740 			if (ill->ill_ifname_pending_err != 0)  {
13741 				err = ill->ill_ifname_pending_err;
13742 				ill->ill_ifname_pending_err = 0;
13743 			} else {
13744 				err = dlea->dl_unix_errno ?
13745 				    dlea->dl_unix_errno : ENXIO;
13746 			}
13747 		/*
13748 		 * If we're plumbing an interface and an error hasn't already
13749 		 * been saved, set ill_ifname_pending_err to the error passed
13750 		 * up. Ignore the error if log is B_FALSE (see comment above).
13751 		 */
13752 		} else if (log && ill->ill_ifname_pending &&
13753 		    ill->ill_ifname_pending_err == 0) {
13754 			ill->ill_ifname_pending_err = dlea->dl_unix_errno ?
13755 			dlea->dl_unix_errno : ENXIO;
13756 		}
13757 
13758 		if (log)
13759 			ip_dlpi_error(ill, dlea->dl_error_primitive,
13760 			    dlea->dl_errno, dlea->dl_unix_errno);
13761 		break;
13762 	case DL_CAPABILITY_ACK: {
13763 		boolean_t reneg_flag = B_FALSE;
13764 		/* Call a routine to handle this one. */
13765 		ill_dlpi_done(ill, DL_CAPABILITY_REQ);
13766 		/*
13767 		 * Check if the ACK is due to renegotiation case since we
13768 		 * will need to send a new CAPABILITY_REQ later.
13769 		 */
13770 		if (ill->ill_capab_state == IDMS_RENEG) {
13771 			/* This is the ack for a renogiation case */
13772 			reneg_flag = B_TRUE;
13773 			ill->ill_capab_state = IDMS_UNKNOWN;
13774 		}
13775 		ill_capability_ack(ill, mp);
13776 		if (reneg_flag)
13777 			ill_capability_probe(ill);
13778 		break;
13779 	}
13780 	case DL_CONTROL_ACK:
13781 		/* We treat all of these as "fire and forget" */
13782 		ill_dlpi_done(ill, DL_CONTROL_REQ);
13783 		break;
13784 	case DL_INFO_ACK:
13785 		/* Call a routine to handle this one. */
13786 		ill_dlpi_done(ill, DL_INFO_REQ);
13787 		ip_ll_subnet_defaults(ill, mp);
13788 		ASSERT(!MUTEX_HELD(&ill->ill_phyint->phyint_ipsq->ipsq_lock));
13789 		return;
13790 	case DL_BIND_ACK:
13791 		/*
13792 		 * We should have an IOCTL waiting on this unless
13793 		 * sent by ill_dl_phys, in which case just return
13794 		 */
13795 		ill_dlpi_done(ill, DL_BIND_REQ);
13796 		if (ill->ill_ifname_pending)
13797 			break;
13798 
13799 		if (!ioctl_aborted)
13800 			mp1 = ipsq_pending_mp_get(ipsq, &connp);
13801 		if (mp1 == NULL)
13802 			break;
13803 		ASSERT(connp != NULL);
13804 		q = CONNP_TO_WQ(connp);
13805 
13806 		/*
13807 		 * We are exclusive. So nothing can change even after
13808 		 * we get the pending mp. If need be we can put it back
13809 		 * and restart, as in calling ipif_arp_up()  below.
13810 		 */
13811 		ip1dbg(("ip_rput_dlpi: bind_ack %s\n", ill->ill_name));
13812 
13813 		mutex_enter(&ill->ill_lock);
13814 		ill->ill_dl_up = 1;
13815 		mutex_exit(&ill->ill_lock);
13816 
13817 		/*
13818 		 * Now bring up the resolver, when that is
13819 		 * done we'll create IREs and we are done.
13820 		 */
13821 		if (ill->ill_isv6) {
13822 			/*
13823 			 * v6 interfaces.
13824 			 * Unlike ARP which has to do another bind
13825 			 * and attach, once we get here we are
13826 			 * done withh NDP. Except in the case of
13827 			 * ILLF_XRESOLV, in which case we send an
13828 			 * AR_INTERFACE_UP to the external resolver.
13829 			 * If all goes well, the ioctl will complete
13830 			 * in ip_rput(). If there's an error, we
13831 			 * complete it here.
13832 			 */
13833 			err = ipif_ndp_up(ipif, &ipif->ipif_v6lcl_addr,
13834 			    B_FALSE);
13835 			if (err == 0) {
13836 				if (ill->ill_flags & ILLF_XRESOLV) {
13837 					mutex_enter(&connp->conn_lock);
13838 					mutex_enter(&ill->ill_lock);
13839 					success = ipsq_pending_mp_add(
13840 					    connp, ipif, q, mp1, 0);
13841 					mutex_exit(&ill->ill_lock);
13842 					mutex_exit(&connp->conn_lock);
13843 					if (success) {
13844 						err = ipif_resolver_up(ipif,
13845 						    B_FALSE);
13846 						if (err == EINPROGRESS) {
13847 							freemsg(mp);
13848 							return;
13849 						}
13850 						ASSERT(err != 0);
13851 						mp1 = ipsq_pending_mp_get(ipsq,
13852 						    &connp);
13853 						ASSERT(mp1 != NULL);
13854 					} else {
13855 						/* conn has started closing */
13856 						err = EINTR;
13857 					}
13858 				} else { /* Non XRESOLV interface */
13859 					err = ipif_up_done_v6(ipif);
13860 				}
13861 			}
13862 		} else if (ill->ill_net_type == IRE_IF_RESOLVER) {
13863 			/*
13864 			 * ARP and other v4 external resolvers.
13865 			 * Leave the pending mblk intact so that
13866 			 * the ioctl completes in ip_rput().
13867 			 */
13868 			mutex_enter(&connp->conn_lock);
13869 			mutex_enter(&ill->ill_lock);
13870 			success = ipsq_pending_mp_add(connp, ipif, q, mp1, 0);
13871 			mutex_exit(&ill->ill_lock);
13872 			mutex_exit(&connp->conn_lock);
13873 			if (success) {
13874 				err = ipif_resolver_up(ipif, B_FALSE);
13875 				if (err == EINPROGRESS) {
13876 					freemsg(mp);
13877 					return;
13878 				}
13879 				ASSERT(err != 0);
13880 				mp1 = ipsq_pending_mp_get(ipsq, &connp);
13881 			} else {
13882 				/* The conn has started closing */
13883 				err = EINTR;
13884 			}
13885 		} else {
13886 			/*
13887 			 * This one is complete. Reply to pending ioctl.
13888 			 */
13889 			err = ipif_up_done(ipif);
13890 		}
13891 
13892 		if ((err == 0) && (ill->ill_up_ipifs)) {
13893 			err = ill_up_ipifs(ill, q, mp1);
13894 			if (err == EINPROGRESS) {
13895 				freemsg(mp);
13896 				return;
13897 			}
13898 		}
13899 
13900 		if (ill->ill_up_ipifs) {
13901 			ill_group_cleanup(ill);
13902 		}
13903 
13904 		break;
13905 	case DL_NOTIFY_IND: {
13906 		dl_notify_ind_t *notify = (dl_notify_ind_t *)mp->b_rptr;
13907 		ire_t *ire;
13908 		boolean_t need_ire_walk_v4 = B_FALSE;
13909 		boolean_t need_ire_walk_v6 = B_FALSE;
13910 
13911 		/*
13912 		 * Change the address everywhere we need to.
13913 		 * What we're getting here is a link-level addr or phys addr.
13914 		 * The new addr is at notify + notify->dl_addr_offset
13915 		 * The address length is notify->dl_addr_length;
13916 		 */
13917 		switch (notify->dl_notification) {
13918 		case DL_NOTE_PHYS_ADDR:
13919 			mp_hw = copyb(mp);
13920 			if (mp_hw == NULL) {
13921 				err = ENOMEM;
13922 				break;
13923 			}
13924 			dlp = (union DL_primitives *)mp_hw->b_rptr;
13925 			/*
13926 			 * We currently don't support changing
13927 			 * the token via DL_NOTIFY_IND.
13928 			 * When we do support it, we have to consider
13929 			 * what the implications are with respect to
13930 			 * the token and the link local address.
13931 			 */
13932 			mutex_enter(&ill->ill_lock);
13933 			if (dlp->notify_ind.dl_data ==
13934 			    DL_IPV6_LINK_LAYER_ADDR) {
13935 				if (ill->ill_nd_lla_mp != NULL)
13936 					freemsg(ill->ill_nd_lla_mp);
13937 				ill->ill_nd_lla_mp = mp_hw;
13938 				ill->ill_nd_lla = (uchar_t *)mp_hw->b_rptr +
13939 				    dlp->notify_ind.dl_addr_offset;
13940 				ill->ill_nd_lla_len =
13941 				    dlp->notify_ind.dl_addr_length -
13942 				    ABS(ill->ill_sap_length);
13943 				mutex_exit(&ill->ill_lock);
13944 				break;
13945 			} else if (dlp->notify_ind.dl_data ==
13946 			    DL_CURR_PHYS_ADDR) {
13947 				if (ill->ill_phys_addr_mp != NULL)
13948 					freemsg(ill->ill_phys_addr_mp);
13949 				ill->ill_phys_addr_mp = mp_hw;
13950 				ill->ill_phys_addr = (uchar_t *)mp_hw->b_rptr +
13951 				    dlp->notify_ind.dl_addr_offset;
13952 				ill->ill_phys_addr_length =
13953 				    dlp->notify_ind.dl_addr_length -
13954 				    ABS(ill->ill_sap_length);
13955 				if (ill->ill_isv6 &&
13956 				    !(ill->ill_flags & ILLF_XRESOLV)) {
13957 					if (ill->ill_nd_lla_mp != NULL)
13958 						freemsg(ill->ill_nd_lla_mp);
13959 					ill->ill_nd_lla_mp = copyb(mp_hw);
13960 					ill->ill_nd_lla = (uchar_t *)
13961 					    ill->ill_nd_lla_mp->b_rptr +
13962 					    dlp->notify_ind.dl_addr_offset;
13963 					ill->ill_nd_lla_len =
13964 					    ill->ill_phys_addr_length;
13965 				}
13966 			}
13967 			mutex_exit(&ill->ill_lock);
13968 			/*
13969 			 * Send out gratuitous arp request for our new
13970 			 * hardware address.
13971 			 */
13972 			for (ipif = ill->ill_ipif; ipif != NULL;
13973 			    ipif = ipif->ipif_next) {
13974 				if (!(ipif->ipif_flags & IPIF_UP))
13975 					continue;
13976 				if (ill->ill_isv6) {
13977 					ipif_ndp_down(ipif);
13978 					/*
13979 					 * Set B_TRUE to enable
13980 					 * ipif_ndp_up() to send out
13981 					 * unsolicited advertisements.
13982 					 */
13983 					err = ipif_ndp_up(ipif,
13984 					    &ipif->ipif_v6lcl_addr,
13985 					    B_TRUE);
13986 					if (err) {
13987 						ip1dbg((
13988 						    "ip_rput_dlpi_writer: "
13989 						    "Failed to update ndp "
13990 						    "err %d\n", err));
13991 					}
13992 				} else {
13993 					/*
13994 					 * IPv4 ARP case
13995 					 *
13996 					 * Set B_TRUE, as we only want
13997 					 * ipif_resolver_up to send an
13998 					 * AR_ENTRY_ADD request up to
13999 					 * ARP.
14000 					 */
14001 					err = ipif_resolver_up(ipif,
14002 					    B_TRUE);
14003 					if (err) {
14004 						ip1dbg((
14005 						    "ip_rput_dlpi_writer: "
14006 						    "Failed to update arp "
14007 						    "err %d\n", err));
14008 					}
14009 				}
14010 			}
14011 			/*
14012 			 * Allow "fall through" to the DL_NOTE_FASTPATH_FLUSH
14013 			 * case so that all old fastpath information can be
14014 			 * purged from IRE caches.
14015 			 */
14016 		/* FALLTHRU */
14017 		case DL_NOTE_FASTPATH_FLUSH:
14018 			/*
14019 			 * Any fastpath probe sent henceforth will get the
14020 			 * new fp mp. So we first delete any ires that are
14021 			 * waiting for the fastpath. Then walk all ires and
14022 			 * delete the ire or delete the fp mp. In the case of
14023 			 * IRE_MIPRTUN and IRE_BROADCAST it is difficult to
14024 			 * recreate the ire's without going through a complex
14025 			 * ipif up/down dance. So we don't delete the ire
14026 			 * itself, but just the ire_fp_mp for these 2 ire's
14027 			 * In the case of the other ire's we delete the ire's
14028 			 * themselves. Access to ire_fp_mp is completely
14029 			 * protected by ire_lock for IRE_MIPRTUN and
14030 			 * IRE_BROADCAST. Deleting the ire is preferable in the
14031 			 * other cases for performance.
14032 			 */
14033 			if (ill->ill_isv6) {
14034 				nce_fastpath_list_dispatch(ill, NULL, NULL);
14035 				ndp_walk(ill, (pfi_t)ndp_fastpath_flush,
14036 				    NULL);
14037 			} else {
14038 				ire_fastpath_list_dispatch(ill, NULL, NULL);
14039 				ire_walk_ill_v4(MATCH_IRE_WQ | MATCH_IRE_TYPE,
14040 				    IRE_CACHE | IRE_BROADCAST,
14041 				    ire_fastpath_flush, NULL, ill);
14042 				mutex_enter(&ire_mrtun_lock);
14043 				if (ire_mrtun_count != 0) {
14044 					mutex_exit(&ire_mrtun_lock);
14045 					ire_walk_ill_mrtun(MATCH_IRE_WQ,
14046 					    IRE_MIPRTUN, ire_fastpath_flush,
14047 					    NULL, ill);
14048 				} else {
14049 					mutex_exit(&ire_mrtun_lock);
14050 				}
14051 			}
14052 			break;
14053 		case DL_NOTE_SDU_SIZE:
14054 			/*
14055 			 * Change the MTU size of the interface, of all
14056 			 * attached ipif's, and of all relevant ire's.  The
14057 			 * new value's a uint32_t at notify->dl_data.
14058 			 * Mtu change Vs. new ire creation - protocol below.
14059 			 *
14060 			 * a Mark the ipif as IPIF_CHANGING.
14061 			 * b Set the new mtu in the ipif.
14062 			 * c Change the ire_max_frag on all affected ires
14063 			 * d Unmark the IPIF_CHANGING
14064 			 *
14065 			 * To see how the protocol works, assume an interface
14066 			 * route is also being added simultaneously by
14067 			 * ip_rt_add and let 'ipif' be the ipif referenced by
14068 			 * the ire. If the ire is created before step a,
14069 			 * it will be cleaned up by step c. If the ire is
14070 			 * created after step d, it will see the new value of
14071 			 * ipif_mtu. Any attempt to create the ire between
14072 			 * steps a to d will fail because of the IPIF_CHANGING
14073 			 * flag. Note that ire_create() is passed a pointer to
14074 			 * the ipif_mtu, and not the value. During ire_add
14075 			 * under the bucket lock, the ire_max_frag of the
14076 			 * new ire being created is set from the ipif/ire from
14077 			 * which it is being derived.
14078 			 */
14079 			mutex_enter(&ill->ill_lock);
14080 			ill->ill_max_frag = (uint_t)notify->dl_data;
14081 
14082 			/*
14083 			 * If an SIOCSLIFLNKINFO has changed the ill_max_mtu
14084 			 * leave it alone
14085 			 */
14086 			if (ill->ill_mtu_userspecified) {
14087 				mutex_exit(&ill->ill_lock);
14088 				break;
14089 			}
14090 			ill->ill_max_mtu = ill->ill_max_frag;
14091 			if (ill->ill_isv6) {
14092 				if (ill->ill_max_mtu < IPV6_MIN_MTU)
14093 					ill->ill_max_mtu = IPV6_MIN_MTU;
14094 			} else {
14095 				if (ill->ill_max_mtu < IP_MIN_MTU)
14096 					ill->ill_max_mtu = IP_MIN_MTU;
14097 			}
14098 			for (ipif = ill->ill_ipif; ipif != NULL;
14099 			    ipif = ipif->ipif_next) {
14100 				/*
14101 				 * Don't override the mtu if the user
14102 				 * has explicitly set it.
14103 				 */
14104 				if (ipif->ipif_flags & IPIF_FIXEDMTU)
14105 					continue;
14106 				ipif->ipif_mtu = (uint_t)notify->dl_data;
14107 				if (ipif->ipif_isv6)
14108 					ire = ipif_to_ire_v6(ipif);
14109 				else
14110 					ire = ipif_to_ire(ipif);
14111 				if (ire != NULL) {
14112 					ire->ire_max_frag = ipif->ipif_mtu;
14113 					ire_refrele(ire);
14114 				}
14115 				if (ipif->ipif_flags & IPIF_UP) {
14116 					if (ill->ill_isv6)
14117 						need_ire_walk_v6 = B_TRUE;
14118 					else
14119 						need_ire_walk_v4 = B_TRUE;
14120 				}
14121 			}
14122 			mutex_exit(&ill->ill_lock);
14123 			if (need_ire_walk_v4)
14124 				ire_walk_v4(ill_mtu_change, (char *)ill,
14125 				    ALL_ZONES);
14126 			if (need_ire_walk_v6)
14127 				ire_walk_v6(ill_mtu_change, (char *)ill,
14128 				    ALL_ZONES);
14129 			break;
14130 		case DL_NOTE_LINK_UP:
14131 		case DL_NOTE_LINK_DOWN: {
14132 			/*
14133 			 * We are writer. ill / phyint / ipsq assocs stable.
14134 			 * The RUNNING flag reflects the state of the link.
14135 			 */
14136 			phyint_t *phyint = ill->ill_phyint;
14137 			uint64_t new_phyint_flags;
14138 			boolean_t changed = B_FALSE;
14139 
14140 			mutex_enter(&phyint->phyint_lock);
14141 			new_phyint_flags =
14142 			    (notify->dl_notification == DL_NOTE_LINK_UP) ?
14143 			    phyint->phyint_flags | PHYI_RUNNING :
14144 			    phyint->phyint_flags & ~PHYI_RUNNING;
14145 			if (new_phyint_flags != phyint->phyint_flags) {
14146 				phyint->phyint_flags = new_phyint_flags;
14147 				changed = B_TRUE;
14148 			}
14149 			mutex_exit(&phyint->phyint_lock);
14150 			/*
14151 			 * If the flags have changed, send a message to
14152 			 * the routing socket.
14153 			 */
14154 			if (changed) {
14155 				if (phyint->phyint_illv4 != NULL) {
14156 					ip_rts_ifmsg(
14157 					    phyint->phyint_illv4->ill_ipif);
14158 				}
14159 				if (phyint->phyint_illv6 != NULL) {
14160 					ip_rts_ifmsg(
14161 					    phyint->phyint_illv6->ill_ipif);
14162 				}
14163 			}
14164 			break;
14165 		}
14166 		case DL_NOTE_PROMISC_ON_PHYS:
14167 			IPSECHW_DEBUG(IPSECHW_PKT, ("ip_rput_dlpi_writer: "
14168 			    "got a DL_NOTE_PROMISC_ON_PHYS\n"));
14169 			mutex_enter(&ill->ill_lock);
14170 			ill->ill_promisc_on_phys = B_TRUE;
14171 			mutex_exit(&ill->ill_lock);
14172 			break;
14173 		case DL_NOTE_PROMISC_OFF_PHYS:
14174 			IPSECHW_DEBUG(IPSECHW_PKT, ("ip_rput_dlpi_writer: "
14175 			    "got a DL_NOTE_PROMISC_OFF_PHYS\n"));
14176 			mutex_enter(&ill->ill_lock);
14177 			ill->ill_promisc_on_phys = B_FALSE;
14178 			mutex_exit(&ill->ill_lock);
14179 			break;
14180 		case DL_NOTE_CAPAB_RENEG:
14181 			/*
14182 			 * Something changed on the driver side.
14183 			 * It wants us to renegotiate the capabilities
14184 			 * on this ill. The most likely cause is the
14185 			 * aggregation interface under us where a
14186 			 * port got added or went away.
14187 			 *
14188 			 * We reset the capabilities and set the
14189 			 * state to IDMS_RENG so that when the ack
14190 			 * comes back, we can start the
14191 			 * renegotiation process.
14192 			 */
14193 			ill_capability_reset(ill);
14194 			ill->ill_capab_state = IDMS_RENEG;
14195 			break;
14196 		default:
14197 			ip0dbg(("ip_rput_dlpi_writer: unknown notification "
14198 			    "type 0x%x for DL_NOTIFY_IND\n",
14199 			    notify->dl_notification));
14200 			break;
14201 		}
14202 
14203 		/*
14204 		 * As this is an asynchronous operation, we
14205 		 * should not call ill_dlpi_done
14206 		 */
14207 		break;
14208 	}
14209 	case DL_NOTIFY_ACK:
14210 		/*
14211 		 * Don't really need to check for what notifications
14212 		 * are supported; we'll process what gets sent upstream,
14213 		 * and we know it'll be something we support changing
14214 		 * based on our DL_NOTIFY_REQ.
14215 		 */
14216 		ill_dlpi_done(ill, DL_NOTIFY_REQ);
14217 		break;
14218 	case DL_PHYS_ADDR_ACK: {
14219 		/*
14220 		 * We should have an IOCTL waiting on this when request
14221 		 * sent by ill_dl_phys.
14222 		 * However, ill_dl_phys was called on an ill queue (from
14223 		 * SIOCSLIFNAME), thus conn_pending_ill is not set. But the
14224 		 * ioctl is known to be pending on ill_wq.
14225 		 * There are two additional phys_addr_req's sent to the
14226 		 * driver to get the token and lla. ill_phys_addr_pend
14227 		 * keeps track of the last one sent so we know which
14228 		 * response we are dealing with. ill_dlpi_done will
14229 		 * update ill_phys_addr_pend when it sends the next req.
14230 		 * We don't complete the IOCTL until all three DL_PARs
14231 		 * have been attempted.
14232 		 *
14233 		 * We don't need any lock to update ill_nd_lla* fields,
14234 		 * since the ill is not yet up, We grab the lock just
14235 		 * for uniformity with other code that accesses ill_nd_lla.
14236 		 */
14237 		physaddr_req = ill->ill_phys_addr_pend;
14238 		ill_dlpi_done(ill, DL_PHYS_ADDR_REQ);
14239 		if (physaddr_req == DL_IPV6_TOKEN ||
14240 		    physaddr_req == DL_IPV6_LINK_LAYER_ADDR) {
14241 			if (physaddr_req == DL_IPV6_TOKEN) {
14242 				/*
14243 				 * bcopy to low-order bits of ill_token
14244 				 *
14245 				 * XXX Temporary hack - currently,
14246 				 * all known tokens are 64 bits,
14247 				 * so I'll cheat for the moment.
14248 				 */
14249 				dlp = (union DL_primitives *)mp->b_rptr;
14250 
14251 				mutex_enter(&ill->ill_lock);
14252 				bcopy((uchar_t *)(mp->b_rptr +
14253 				dlp->physaddr_ack.dl_addr_offset),
14254 				(void *)&ill->ill_token.s6_addr32[2],
14255 				dlp->physaddr_ack.dl_addr_length);
14256 				ill->ill_token_length =
14257 					dlp->physaddr_ack.dl_addr_length;
14258 				mutex_exit(&ill->ill_lock);
14259 			} else {
14260 				ASSERT(ill->ill_nd_lla_mp == NULL);
14261 				mp_hw = copyb(mp);
14262 				if (mp_hw == NULL) {
14263 					err = ENOMEM;
14264 					break;
14265 				}
14266 				dlp = (union DL_primitives *)mp_hw->b_rptr;
14267 				mutex_enter(&ill->ill_lock);
14268 				ill->ill_nd_lla_mp = mp_hw;
14269 				ill->ill_nd_lla = (uchar_t *)mp_hw->b_rptr +
14270 				dlp->physaddr_ack.dl_addr_offset;
14271 				ill->ill_nd_lla_len =
14272 					dlp->physaddr_ack.dl_addr_length;
14273 				mutex_exit(&ill->ill_lock);
14274 			}
14275 			break;
14276 		}
14277 		ASSERT(physaddr_req == DL_CURR_PHYS_ADDR);
14278 		ASSERT(ill->ill_phys_addr_mp == NULL);
14279 		if (!ill->ill_ifname_pending)
14280 			break;
14281 		ill->ill_ifname_pending = 0;
14282 		if (!ioctl_aborted)
14283 			mp1 = ipsq_pending_mp_get(ipsq, &connp);
14284 		if (mp1 != NULL) {
14285 			ASSERT(connp == NULL);
14286 			q = ill->ill_wq;
14287 		}
14288 		/*
14289 		 * If any error acks received during the plumbing sequence,
14290 		 * ill_ifname_pending_err will be set. Break out and send up
14291 		 * the error to the pending ioctl.
14292 		 */
14293 		if (ill->ill_ifname_pending_err != 0) {
14294 			err = ill->ill_ifname_pending_err;
14295 			ill->ill_ifname_pending_err = 0;
14296 			break;
14297 		}
14298 		/*
14299 		 * Get the interface token.  If the zeroth interface
14300 		 * address is zero then set the address to the link local
14301 		 * address
14302 		 */
14303 		mp_hw = copyb(mp);
14304 		if (mp_hw == NULL) {
14305 			err = ENOMEM;
14306 			break;
14307 		}
14308 		dlp = (union DL_primitives *)mp_hw->b_rptr;
14309 		ill->ill_phys_addr_mp = mp_hw;
14310 		ill->ill_phys_addr = (uchar_t *)mp_hw->b_rptr +
14311 				dlp->physaddr_ack.dl_addr_offset;
14312 		if (dlp->physaddr_ack.dl_addr_length == 0 ||
14313 		    ill->ill_phys_addr_length == 0 ||
14314 		    ill->ill_phys_addr_length == IP_ADDR_LEN) {
14315 			/*
14316 			 * Compatibility: atun driver returns a length of 0.
14317 			 * ipdptp has an ill_phys_addr_length of zero(from
14318 			 * DL_BIND_ACK) but a non-zero length here.
14319 			 * ipd has an ill_phys_addr_length of 4(from
14320 			 * DL_BIND_ACK) but a non-zero length here.
14321 			 */
14322 			ill->ill_phys_addr = NULL;
14323 		} else if (dlp->physaddr_ack.dl_addr_length !=
14324 		    ill->ill_phys_addr_length) {
14325 			ip0dbg(("DL_PHYS_ADDR_ACK: "
14326 			    "Address length mismatch %d %d\n",
14327 			    dlp->physaddr_ack.dl_addr_length,
14328 			    ill->ill_phys_addr_length));
14329 			err = EINVAL;
14330 			break;
14331 		}
14332 		mutex_enter(&ill->ill_lock);
14333 		if (ill->ill_nd_lla_mp == NULL) {
14334 			ill->ill_nd_lla_mp = copyb(mp_hw);
14335 			if (ill->ill_nd_lla_mp == NULL) {
14336 				err = ENOMEM;
14337 				mutex_exit(&ill->ill_lock);
14338 				break;
14339 			}
14340 			ill->ill_nd_lla =
14341 			    (uchar_t *)ill->ill_nd_lla_mp->b_rptr +
14342 			    dlp->physaddr_ack.dl_addr_offset;
14343 			ill->ill_nd_lla_len = ill->ill_phys_addr_length;
14344 		}
14345 		mutex_exit(&ill->ill_lock);
14346 		if (IN6_IS_ADDR_UNSPECIFIED(&ill->ill_token))
14347 			(void) ill_setdefaulttoken(ill);
14348 
14349 		/*
14350 		 * If the ill zero interface has a zero address assign
14351 		 * it the proper link local address.
14352 		 */
14353 		ASSERT(ill->ill_ipif->ipif_id == 0);
14354 		if (ipif != NULL &&
14355 		    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr))
14356 			(void) ipif_setlinklocal(ipif);
14357 		break;
14358 	}
14359 	case DL_OK_ACK:
14360 		ip2dbg(("DL_OK_ACK %s (0x%x)\n",
14361 		    dlpi_prim_str((int)dloa->dl_correct_primitive),
14362 		    dloa->dl_correct_primitive));
14363 		switch (dloa->dl_correct_primitive) {
14364 		case DL_UNBIND_REQ:
14365 		case DL_ATTACH_REQ:
14366 		case DL_DETACH_REQ:
14367 			ill_dlpi_done(ill, dloa->dl_correct_primitive);
14368 			break;
14369 		}
14370 		break;
14371 	default:
14372 		break;
14373 	}
14374 
14375 	freemsg(mp);
14376 	if (mp1) {
14377 		struct iocblk *iocp;
14378 		int mode;
14379 
14380 		/*
14381 		 * Complete the waiting IOCTL. For SIOCLIFADDIF or
14382 		 * SIOCSLIFNAME do a copyout.
14383 		 */
14384 		iocp = (struct iocblk *)mp1->b_rptr;
14385 
14386 		if (iocp->ioc_cmd == SIOCLIFADDIF ||
14387 		    iocp->ioc_cmd == SIOCSLIFNAME)
14388 			mode = COPYOUT;
14389 		else
14390 			mode = NO_COPYOUT;
14391 		/*
14392 		 * The ioctl must complete now without EINPROGRESS
14393 		 * since ipsq_pending_mp_get has removed the ioctl mblk
14394 		 * from ipsq_pending_mp. Otherwise the ioctl will be
14395 		 * stuck for ever in the ipsq.
14396 		 */
14397 		ASSERT(err != EINPROGRESS);
14398 		ip_ioctl_finish(q, mp1, err, mode, ipif, ipsq);
14399 
14400 	}
14401 }
14402 
14403 /*
14404  * ip_rput_other is called by ip_rput to handle messages modifying the global
14405  * state in IP. Normally called as writer. Exception SIOCGTUNPARAM (shared)
14406  */
14407 /* ARGSUSED */
14408 void
14409 ip_rput_other(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg)
14410 {
14411 	ill_t		*ill;
14412 	struct iocblk	*iocp;
14413 	mblk_t		*mp1;
14414 	conn_t		*connp = NULL;
14415 
14416 	ip1dbg(("ip_rput_other "));
14417 	ill = (ill_t *)q->q_ptr;
14418 	/*
14419 	 * This routine is not a writer in the case of SIOCGTUNPARAM
14420 	 * in which case ipsq is NULL.
14421 	 */
14422 	if (ipsq != NULL) {
14423 		ASSERT(IAM_WRITER_IPSQ(ipsq));
14424 		ASSERT(ipsq == ill->ill_phyint->phyint_ipsq);
14425 	}
14426 
14427 	switch (mp->b_datap->db_type) {
14428 	case M_ERROR:
14429 	case M_HANGUP:
14430 		/*
14431 		 * The device has a problem.  We force the ILL down.  It can
14432 		 * be brought up again manually using SIOCSIFFLAGS (via
14433 		 * ifconfig or equivalent).
14434 		 */
14435 		ASSERT(ipsq != NULL);
14436 		if (mp->b_rptr < mp->b_wptr)
14437 			ill->ill_error = (int)(*mp->b_rptr & 0xFF);
14438 		if (ill->ill_error == 0)
14439 			ill->ill_error = ENXIO;
14440 		if (!ill_down_start(q, mp))
14441 			return;
14442 		ipif_all_down_tail(ipsq, q, mp, NULL);
14443 		break;
14444 	case M_IOCACK:
14445 		iocp = (struct iocblk *)mp->b_rptr;
14446 		ASSERT(iocp->ioc_cmd != DL_IOC_HDR_INFO);
14447 		switch (iocp->ioc_cmd) {
14448 		case SIOCSTUNPARAM:
14449 		case OSIOCSTUNPARAM:
14450 			ASSERT(ipsq != NULL);
14451 			/*
14452 			 * Finish socket ioctl passed through to tun.
14453 			 * We should have an IOCTL waiting on this.
14454 			 */
14455 			mp1 = ipsq_pending_mp_get(ipsq, &connp);
14456 			if (ill->ill_isv6) {
14457 				struct iftun_req *ta;
14458 
14459 				/*
14460 				 * if a source or destination is
14461 				 * being set, try and set the link
14462 				 * local address for the tunnel
14463 				 */
14464 				ta = (struct iftun_req *)mp->b_cont->
14465 				    b_cont->b_rptr;
14466 				if (ta->ifta_flags & (IFTUN_SRC | IFTUN_DST)) {
14467 					ipif_set_tun_llink(ill, ta);
14468 				}
14469 
14470 			}
14471 			if (mp1 != NULL) {
14472 				/*
14473 				 * Now copy back the b_next/b_prev used by
14474 				 * mi code for the mi_copy* functions.
14475 				 * See ip_sioctl_tunparam() for the reason.
14476 				 * Also protect against missing b_cont.
14477 				 */
14478 				if (mp->b_cont != NULL) {
14479 					mp->b_cont->b_next =
14480 					    mp1->b_cont->b_next;
14481 					mp->b_cont->b_prev =
14482 					    mp1->b_cont->b_prev;
14483 				}
14484 				ip_ioctl_freemsg(mp1);
14485 				ASSERT(ipsq->ipsq_current_ipif != NULL);
14486 				ASSERT(connp != NULL);
14487 				ip_ioctl_finish(CONNP_TO_WQ(connp), mp,
14488 				    iocp->ioc_error, NO_COPYOUT,
14489 				    ipsq->ipsq_current_ipif, ipsq);
14490 			} else {
14491 				ASSERT(connp == NULL);
14492 				putnext(q, mp);
14493 			}
14494 			break;
14495 		case SIOCGTUNPARAM:
14496 		case OSIOCGTUNPARAM:
14497 			/*
14498 			 * This is really M_IOCDATA from the tunnel driver.
14499 			 * convert back and complete the ioctl.
14500 			 * We should have an IOCTL waiting on this.
14501 			 */
14502 			mp1 = ill_pending_mp_get(ill, &connp, iocp->ioc_id);
14503 			if (mp1) {
14504 				/*
14505 				 * Now copy back the b_next/b_prev used by
14506 				 * mi code for the mi_copy* functions.
14507 				 * See ip_sioctl_tunparam() for the reason.
14508 				 * Also protect against missing b_cont.
14509 				 */
14510 				if (mp->b_cont != NULL) {
14511 					mp->b_cont->b_next =
14512 					    mp1->b_cont->b_next;
14513 					mp->b_cont->b_prev =
14514 					    mp1->b_cont->b_prev;
14515 				}
14516 				ip_ioctl_freemsg(mp1);
14517 				if (iocp->ioc_error == 0)
14518 					mp->b_datap->db_type = M_IOCDATA;
14519 				ASSERT(connp != NULL);
14520 				ip_ioctl_finish(CONNP_TO_WQ(connp), mp,
14521 				    iocp->ioc_error, COPYOUT, NULL, NULL);
14522 			} else {
14523 				ASSERT(connp == NULL);
14524 				putnext(q, mp);
14525 			}
14526 			break;
14527 		default:
14528 			break;
14529 		}
14530 		break;
14531 	case M_IOCNAK:
14532 		iocp = (struct iocblk *)mp->b_rptr;
14533 
14534 		switch (iocp->ioc_cmd) {
14535 		int mode;
14536 		ipif_t	*ipif;
14537 
14538 		case DL_IOC_HDR_INFO:
14539 			/*
14540 			 * If this was the first attempt turn of the
14541 			 * fastpath probing.
14542 			 */
14543 			mutex_enter(&ill->ill_lock);
14544 			if (ill->ill_dlpi_fastpath_state == IDMS_INPROGRESS) {
14545 				ill->ill_dlpi_fastpath_state = IDMS_FAILED;
14546 				mutex_exit(&ill->ill_lock);
14547 				ill_fastpath_nack(ill);
14548 				ip1dbg(("ip_rput: DLPI fastpath off on "
14549 				    "interface %s\n",
14550 				    ill->ill_name));
14551 			} else {
14552 				mutex_exit(&ill->ill_lock);
14553 			}
14554 			freemsg(mp);
14555 			break;
14556 		case SIOCSTUNPARAM:
14557 		case OSIOCSTUNPARAM:
14558 			ASSERT(ipsq != NULL);
14559 			/*
14560 			 * Finish socket ioctl passed through to tun
14561 			 * We should have an IOCTL waiting on this.
14562 			 */
14563 			/* FALLTHRU */
14564 		case SIOCGTUNPARAM:
14565 		case OSIOCGTUNPARAM:
14566 			/*
14567 			 * This is really M_IOCDATA from the tunnel driver.
14568 			 * convert back and complete the ioctl.
14569 			 * We should have an IOCTL waiting on this.
14570 			 */
14571 			if (iocp->ioc_cmd == SIOCGTUNPARAM ||
14572 			    iocp->ioc_cmd == OSIOCGTUNPARAM) {
14573 				mp1 = ill_pending_mp_get(ill, &connp,
14574 				    iocp->ioc_id);
14575 				mode = COPYOUT;
14576 				ipsq = NULL;
14577 				ipif = NULL;
14578 			} else {
14579 				mp1 = ipsq_pending_mp_get(ipsq, &connp);
14580 				mode = NO_COPYOUT;
14581 				ASSERT(ipsq->ipsq_current_ipif != NULL);
14582 				ipif = ipsq->ipsq_current_ipif;
14583 			}
14584 			if (mp1 != NULL) {
14585 				/*
14586 				 * Now copy back the b_next/b_prev used by
14587 				 * mi code for the mi_copy* functions.
14588 				 * See ip_sioctl_tunparam() for the reason.
14589 				 * Also protect against missing b_cont.
14590 				 */
14591 				if (mp->b_cont != NULL) {
14592 					mp->b_cont->b_next =
14593 					    mp1->b_cont->b_next;
14594 					mp->b_cont->b_prev =
14595 					    mp1->b_cont->b_prev;
14596 				}
14597 				ip_ioctl_freemsg(mp1);
14598 				if (iocp->ioc_error == 0)
14599 					iocp->ioc_error = EINVAL;
14600 				ASSERT(connp != NULL);
14601 				ip_ioctl_finish(CONNP_TO_WQ(connp), mp,
14602 				    iocp->ioc_error, mode, ipif, ipsq);
14603 			} else {
14604 				ASSERT(connp == NULL);
14605 				putnext(q, mp);
14606 			}
14607 			break;
14608 		default:
14609 			break;
14610 		}
14611 	default:
14612 		break;
14613 	}
14614 }
14615 
14616 /*
14617  * NOTE : This function does not ire_refrele the ire argument passed in.
14618  *
14619  * IPQoS notes
14620  * IP policy is invoked twice for a forwarded packet, once on the read side
14621  * and again on the write side if both, IPP_FWD_IN and IPP_FWD_OUT are
14622  * enabled. An additional parameter, in_ill, has been added for this purpose.
14623  * Note that in_ill could be NULL when called from ip_rput_forward_multicast
14624  * because ip_mroute drops this information.
14625  *
14626  */
14627 void
14628 ip_rput_forward(ire_t *ire, ipha_t *ipha, mblk_t *mp, ill_t *in_ill)
14629 {
14630 	uint32_t	pkt_len;
14631 	queue_t	*q;
14632 	uint32_t	sum;
14633 #define	rptr	((uchar_t *)ipha)
14634 	uint32_t	max_frag;
14635 	uint32_t	ill_index;
14636 
14637 	/* Get the ill_index of the incoming ILL */
14638 	ill_index = (in_ill != NULL) ? in_ill->ill_phyint->phyint_ifindex : 0;
14639 
14640 	/* Initiate Read side IPPF processing */
14641 	if (IPP_ENABLED(IPP_FWD_IN)) {
14642 		ip_process(IPP_FWD_IN, &mp, ill_index);
14643 		if (mp == NULL) {
14644 			ip2dbg(("ip_rput_forward: pkt dropped/deferred "\
14645 			    "during IPPF processing\n"));
14646 			return;
14647 		}
14648 	}
14649 	pkt_len = ntohs(ipha->ipha_length);
14650 
14651 	/* Adjust the checksum to reflect the ttl decrement. */
14652 	sum = (int)ipha->ipha_hdr_checksum + IP_HDR_CSUM_TTL_ADJUST;
14653 	ipha->ipha_hdr_checksum = (uint16_t)(sum + (sum >> 16));
14654 
14655 	if (ipha->ipha_ttl-- <= 1) {
14656 		if (ip_csum_hdr(ipha)) {
14657 			BUMP_MIB(&ip_mib, ipInCksumErrs);
14658 			goto drop_pkt;
14659 		}
14660 		/*
14661 		 * Note: ire_stq this will be NULL for multicast
14662 		 * datagrams using the long path through arp (the IRE
14663 		 * is not an IRE_CACHE). This should not cause
14664 		 * problems since we don't generate ICMP errors for
14665 		 * multicast packets.
14666 		 */
14667 		q = ire->ire_stq;
14668 		if (q)
14669 			icmp_time_exceeded(q, mp, ICMP_TTL_EXCEEDED);
14670 		else
14671 			freemsg(mp);
14672 		return;
14673 	}
14674 
14675 	/*
14676 	 * Don't forward if the interface is down
14677 	 */
14678 	if (ire->ire_ipif->ipif_ill->ill_ipif_up_count == 0) {
14679 		BUMP_MIB(&ip_mib, ipInDiscards);
14680 		goto drop_pkt;
14681 	}
14682 
14683 	/* Get the ill_index of the outgoing ILL */
14684 	ill_index = ire->ire_ipif->ipif_ill->ill_phyint->phyint_ifindex;
14685 
14686 	/* Check if there are options to update */
14687 	if (!IS_SIMPLE_IPH(ipha)) {
14688 		if (ip_csum_hdr(ipha)) {
14689 			BUMP_MIB(&ip_mib, ipInCksumErrs);
14690 			goto drop_pkt;
14691 		}
14692 		if (ip_rput_forward_options(mp, ipha, ire)) {
14693 			return;
14694 		}
14695 
14696 		ipha->ipha_hdr_checksum = 0;
14697 		ipha->ipha_hdr_checksum = ip_csum_hdr(ipha);
14698 	}
14699 	max_frag = ire->ire_max_frag;
14700 	if (pkt_len > max_frag) {
14701 		/*
14702 		 * It needs fragging on its way out.  We haven't
14703 		 * verified the header checksum yet.  Since we
14704 		 * are going to put a surely good checksum in the
14705 		 * outgoing header, we have to make sure that it
14706 		 * was good coming in.
14707 		 */
14708 		if (ip_csum_hdr(ipha)) {
14709 			BUMP_MIB(&ip_mib, ipInCksumErrs);
14710 			goto drop_pkt;
14711 		}
14712 		/* Initiate Write side IPPF processing */
14713 		if (IPP_ENABLED(IPP_FWD_OUT)) {
14714 			ip_process(IPP_FWD_OUT, &mp, ill_index);
14715 			if (mp == NULL) {
14716 				ip2dbg(("ip_rput_forward: pkt dropped/deferred"\
14717 				    " during IPPF processing\n"));
14718 				return;
14719 			}
14720 		}
14721 		ip_wput_frag(ire, mp, IB_PKT, max_frag, 0);
14722 		return;
14723 	}
14724 
14725 	mp = ip_wput_attach_llhdr(mp, ire, IPP_FWD_OUT, ill_index);
14726 	if (mp == NULL) {
14727 		BUMP_MIB(&ip_mib, ipInDiscards);
14728 		return;
14729 	}
14730 
14731 	q = ire->ire_stq;
14732 	UPDATE_IB_PKT_COUNT(ire);
14733 	ire->ire_last_used_time = lbolt;
14734 	BUMP_MIB(&ip_mib, ipForwDatagrams);
14735 	putnext(q, mp);
14736 	return;
14737 
14738 drop_pkt:;
14739 	ip1dbg(("ip_rput_forward: drop pkt\n"));
14740 	freemsg(mp);
14741 #undef	rptr
14742 }
14743 
14744 void
14745 ip_rput_forward_multicast(ipaddr_t dst, mblk_t *mp, ipif_t *ipif)
14746 {
14747 	ire_t	*ire;
14748 
14749 	ASSERT(!ipif->ipif_isv6);
14750 	/*
14751 	 * Find an IRE which matches the destination and the outgoing
14752 	 * queue in the cache table. All we need is an IRE_CACHE which
14753 	 * is pointing at ipif->ipif_ill. If it is part of some ill group,
14754 	 * then it is enough to have some IRE_CACHE in the group.
14755 	 */
14756 	if (ipif->ipif_flags & IPIF_POINTOPOINT)
14757 		dst = ipif->ipif_pp_dst_addr;
14758 	ire = ire_ctable_lookup(dst, 0, 0, ipif, ALL_ZONES,
14759 	    MATCH_IRE_ILL_GROUP);
14760 	if (!ire) {
14761 		/*
14762 		 * Mark this packet to make it be delivered to
14763 		 * ip_rput_forward after the new ire has been
14764 		 * created.
14765 		 */
14766 		mp->b_prev = NULL;
14767 		mp->b_next = mp;
14768 		ip_newroute_ipif(ipif->ipif_ill->ill_wq, mp, ipif, dst,
14769 		    NULL, 0);
14770 	} else {
14771 		ip_rput_forward(ire, (ipha_t *)mp->b_rptr, mp, NULL);
14772 		IRE_REFRELE(ire);
14773 	}
14774 }
14775 
14776 /* Update any source route, record route or timestamp options */
14777 static int
14778 ip_rput_forward_options(mblk_t *mp, ipha_t *ipha, ire_t *ire)
14779 {
14780 	ipoptp_t	opts;
14781 	uchar_t		*opt;
14782 	uint8_t		optval;
14783 	uint8_t		optlen;
14784 	ipaddr_t	dst;
14785 	uint32_t	ts;
14786 	ire_t		*dst_ire = NULL;
14787 	ire_t		*tmp_ire = NULL;
14788 	timestruc_t	now;
14789 
14790 	ip2dbg(("ip_rput_forward_options\n"));
14791 	dst = ipha->ipha_dst;
14792 	for (optval = ipoptp_first(&opts, ipha);
14793 	    optval != IPOPT_EOL;
14794 	    optval = ipoptp_next(&opts)) {
14795 		ASSERT((opts.ipoptp_flags & IPOPTP_ERROR) == 0);
14796 		opt = opts.ipoptp_cur;
14797 		optlen = opts.ipoptp_len;
14798 		ip2dbg(("ip_rput_forward_options: opt %d, len %d\n",
14799 		    optval, opts.ipoptp_len));
14800 		switch (optval) {
14801 			uint32_t off;
14802 		case IPOPT_SSRR:
14803 		case IPOPT_LSRR:
14804 			/* Check if adminstratively disabled */
14805 			if (!ip_forward_src_routed) {
14806 				BUMP_MIB(&ip_mib, ipForwProhibits);
14807 				if (ire->ire_stq)
14808 					icmp_unreachable(ire->ire_stq, mp,
14809 					    ICMP_SOURCE_ROUTE_FAILED);
14810 				else {
14811 					ip0dbg(("ip_rput_forward_options: "
14812 					    "unable to send unreach\n"));
14813 					freemsg(mp);
14814 				}
14815 				return (-1);
14816 			}
14817 
14818 			dst_ire = ire_ctable_lookup(dst, 0, IRE_LOCAL,
14819 			    NULL, ALL_ZONES, MATCH_IRE_TYPE);
14820 			if (dst_ire == NULL) {
14821 				/*
14822 				 * Must be partial since ip_rput_options
14823 				 * checked for strict.
14824 				 */
14825 				break;
14826 			}
14827 			off = opt[IPOPT_OFFSET];
14828 			off--;
14829 		redo_srr:
14830 			if (optlen < IP_ADDR_LEN ||
14831 			    off > optlen - IP_ADDR_LEN) {
14832 				/* End of source route */
14833 				ip1dbg((
14834 				    "ip_rput_forward_options: end of SR\n"));
14835 				ire_refrele(dst_ire);
14836 				break;
14837 			}
14838 			bcopy((char *)opt + off, &dst, IP_ADDR_LEN);
14839 			bcopy(&ire->ire_src_addr, (char *)opt + off,
14840 			    IP_ADDR_LEN);
14841 			ip1dbg(("ip_rput_forward_options: next hop 0x%x\n",
14842 			    ntohl(dst)));
14843 
14844 			/*
14845 			 * Check if our address is present more than
14846 			 * once as consecutive hops in source route.
14847 			 */
14848 			tmp_ire = ire_ctable_lookup(dst, 0, IRE_LOCAL,
14849 			    NULL, ALL_ZONES, MATCH_IRE_TYPE);
14850 			if (tmp_ire != NULL) {
14851 				ire_refrele(tmp_ire);
14852 				off += IP_ADDR_LEN;
14853 				opt[IPOPT_OFFSET] += IP_ADDR_LEN;
14854 				goto redo_srr;
14855 			}
14856 			ipha->ipha_dst = dst;
14857 			opt[IPOPT_OFFSET] += IP_ADDR_LEN;
14858 			ire_refrele(dst_ire);
14859 			break;
14860 		case IPOPT_RR:
14861 			off = opt[IPOPT_OFFSET];
14862 			off--;
14863 			if (optlen < IP_ADDR_LEN ||
14864 			    off > optlen - IP_ADDR_LEN) {
14865 				/* No more room - ignore */
14866 				ip1dbg((
14867 				    "ip_rput_forward_options: end of RR\n"));
14868 				break;
14869 			}
14870 			bcopy(&ire->ire_src_addr, (char *)opt + off,
14871 			    IP_ADDR_LEN);
14872 			opt[IPOPT_OFFSET] += IP_ADDR_LEN;
14873 			break;
14874 		case IPOPT_TS:
14875 			/* Insert timestamp if there is room */
14876 			switch (opt[IPOPT_POS_OV_FLG] & 0x0F) {
14877 			case IPOPT_TS_TSONLY:
14878 				off = IPOPT_TS_TIMELEN;
14879 				break;
14880 			case IPOPT_TS_PRESPEC:
14881 			case IPOPT_TS_PRESPEC_RFC791:
14882 				/* Verify that the address matched */
14883 				off = opt[IPOPT_OFFSET] - 1;
14884 				bcopy((char *)opt + off, &dst, IP_ADDR_LEN);
14885 				dst_ire = ire_ctable_lookup(dst, 0,
14886 				    IRE_LOCAL, NULL, ALL_ZONES, MATCH_IRE_TYPE);
14887 				if (dst_ire == NULL) {
14888 					/* Not for us */
14889 					break;
14890 				}
14891 				ire_refrele(dst_ire);
14892 				/* FALLTHRU */
14893 			case IPOPT_TS_TSANDADDR:
14894 				off = IP_ADDR_LEN + IPOPT_TS_TIMELEN;
14895 				break;
14896 			default:
14897 				/*
14898 				 * ip_*put_options should have already
14899 				 * dropped this packet.
14900 				 */
14901 				cmn_err(CE_PANIC, "ip_rput_forward_options: "
14902 				    "unknown IT - bug in ip_rput_options?\n");
14903 				return (0);	/* Keep "lint" happy */
14904 			}
14905 			if (opt[IPOPT_OFFSET] - 1 + off > optlen) {
14906 				/* Increase overflow counter */
14907 				off = (opt[IPOPT_POS_OV_FLG] >> 4) + 1;
14908 				opt[IPOPT_POS_OV_FLG] =
14909 				    (uint8_t)((opt[IPOPT_POS_OV_FLG] & 0x0F) |
14910 				    (off << 4));
14911 				break;
14912 			}
14913 			off = opt[IPOPT_OFFSET] - 1;
14914 			switch (opt[IPOPT_POS_OV_FLG] & 0x0F) {
14915 			case IPOPT_TS_PRESPEC:
14916 			case IPOPT_TS_PRESPEC_RFC791:
14917 			case IPOPT_TS_TSANDADDR:
14918 				bcopy(&ire->ire_src_addr,
14919 				    (char *)opt + off, IP_ADDR_LEN);
14920 				opt[IPOPT_OFFSET] += IP_ADDR_LEN;
14921 				/* FALLTHRU */
14922 			case IPOPT_TS_TSONLY:
14923 				off = opt[IPOPT_OFFSET] - 1;
14924 				/* Compute # of milliseconds since midnight */
14925 				gethrestime(&now);
14926 				ts = (now.tv_sec % (24 * 60 * 60)) * 1000 +
14927 				    now.tv_nsec / (NANOSEC / MILLISEC);
14928 				bcopy(&ts, (char *)opt + off, IPOPT_TS_TIMELEN);
14929 				opt[IPOPT_OFFSET] += IPOPT_TS_TIMELEN;
14930 				break;
14931 			}
14932 			break;
14933 		}
14934 	}
14935 	return (0);
14936 }
14937 
14938 /*
14939  * This is called after processing at least one of AH/ESP headers.
14940  *
14941  * NOTE: the ill corresponding to ipsec_in_ill_index may not be
14942  * the actual, physical interface on which the packet was received,
14943  * but, when ip_strict_dst_multihoming is set to 1, could be the
14944  * interface which had the ipha_dst configured when the packet went
14945  * through ip_rput. The ill_index corresponding to the recv_ill
14946  * is saved in ipsec_in_rill_index
14947  */
14948 void
14949 ip_fanout_proto_again(mblk_t *ipsec_mp, ill_t *ill, ill_t *recv_ill, ire_t *ire)
14950 {
14951 	mblk_t *mp;
14952 	ipaddr_t dst;
14953 	in6_addr_t *v6dstp;
14954 	ipha_t *ipha;
14955 	ip6_t *ip6h;
14956 	ipsec_in_t *ii;
14957 	boolean_t ill_need_rele = B_FALSE;
14958 	boolean_t rill_need_rele = B_FALSE;
14959 	boolean_t ire_need_rele = B_FALSE;
14960 
14961 	ii = (ipsec_in_t *)ipsec_mp->b_rptr;
14962 	ASSERT(ii->ipsec_in_ill_index != 0);
14963 
14964 	mp = ipsec_mp->b_cont;
14965 	ASSERT(mp != NULL);
14966 
14967 
14968 	if (ill == NULL) {
14969 		ASSERT(recv_ill == NULL);
14970 		/*
14971 		 * We need to get the original queue on which ip_rput_local
14972 		 * or ip_rput_data_v6 was called.
14973 		 */
14974 		ill = ill_lookup_on_ifindex(ii->ipsec_in_ill_index,
14975 		    !ii->ipsec_in_v4, NULL, NULL, NULL, NULL);
14976 		ill_need_rele = B_TRUE;
14977 
14978 		if (ii->ipsec_in_ill_index != ii->ipsec_in_rill_index) {
14979 			recv_ill = ill_lookup_on_ifindex(
14980 			    ii->ipsec_in_rill_index, !ii->ipsec_in_v4,
14981 			    NULL, NULL, NULL, NULL);
14982 			rill_need_rele = B_TRUE;
14983 		} else {
14984 			recv_ill = ill;
14985 		}
14986 
14987 		if ((ill == NULL) || (recv_ill == NULL)) {
14988 			ip0dbg(("ip_fanout_proto_again: interface "
14989 			    "disappeared\n"));
14990 			if (ill != NULL)
14991 				ill_refrele(ill);
14992 			if (recv_ill != NULL)
14993 				ill_refrele(recv_ill);
14994 			freemsg(ipsec_mp);
14995 			return;
14996 		}
14997 	}
14998 
14999 	ASSERT(ill != NULL && recv_ill != NULL);
15000 
15001 	if (mp->b_datap->db_type == M_CTL) {
15002 		/*
15003 		 * AH/ESP is returning the ICMP message after
15004 		 * removing their headers. Fanout again till
15005 		 * it gets to the right protocol.
15006 		 */
15007 		if (ii->ipsec_in_v4) {
15008 			icmph_t *icmph;
15009 			int iph_hdr_length;
15010 			int hdr_length;
15011 
15012 			ipha = (ipha_t *)mp->b_rptr;
15013 			iph_hdr_length = IPH_HDR_LENGTH(ipha);
15014 			icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length];
15015 			ipha = (ipha_t *)&icmph[1];
15016 			hdr_length = IPH_HDR_LENGTH(ipha);
15017 			/*
15018 			 * icmp_inbound_error_fanout may need to do pullupmsg.
15019 			 * Reset the type to M_DATA.
15020 			 */
15021 			mp->b_datap->db_type = M_DATA;
15022 			icmp_inbound_error_fanout(ill->ill_rq, ill, ipsec_mp,
15023 			    icmph, ipha, iph_hdr_length, hdr_length, B_TRUE,
15024 			    B_FALSE, ill, ii->ipsec_in_zoneid);
15025 		} else {
15026 			icmp6_t *icmp6;
15027 			int hdr_length;
15028 
15029 			ip6h = (ip6_t *)mp->b_rptr;
15030 			/* Don't call hdr_length_v6() unless you have to. */
15031 			if (ip6h->ip6_nxt != IPPROTO_ICMPV6)
15032 				hdr_length = ip_hdr_length_v6(mp, ip6h);
15033 			else
15034 				hdr_length = IPV6_HDR_LEN;
15035 
15036 			icmp6 = (icmp6_t *)(&mp->b_rptr[hdr_length]);
15037 			/*
15038 			 * icmp_inbound_error_fanout_v6 may need to do
15039 			 * pullupmsg.  Reset the type to M_DATA.
15040 			 */
15041 			mp->b_datap->db_type = M_DATA;
15042 			icmp_inbound_error_fanout_v6(ill->ill_rq, ipsec_mp,
15043 			    ip6h, icmp6, ill, B_TRUE, ii->ipsec_in_zoneid);
15044 		}
15045 		if (ill_need_rele)
15046 			ill_refrele(ill);
15047 		if (rill_need_rele)
15048 			ill_refrele(recv_ill);
15049 		return;
15050 	}
15051 
15052 	if (ii->ipsec_in_v4) {
15053 		ipha = (ipha_t *)mp->b_rptr;
15054 		dst = ipha->ipha_dst;
15055 		if (CLASSD(dst)) {
15056 			/*
15057 			 * Multicast has to be delivered to all streams.
15058 			 */
15059 			dst = INADDR_BROADCAST;
15060 		}
15061 
15062 		if (ire == NULL) {
15063 			ire = ire_cache_lookup(dst, ii->ipsec_in_zoneid);
15064 			if (ire == NULL) {
15065 				if (ill_need_rele)
15066 					ill_refrele(ill);
15067 				if (rill_need_rele)
15068 					ill_refrele(recv_ill);
15069 				ip1dbg(("ip_fanout_proto_again: "
15070 				    "IRE not found"));
15071 				freemsg(ipsec_mp);
15072 				return;
15073 			}
15074 			ire_need_rele = B_TRUE;
15075 		}
15076 
15077 		switch (ipha->ipha_protocol) {
15078 			case IPPROTO_UDP:
15079 				ip_udp_input(ill->ill_rq, ipsec_mp, ipha, ire,
15080 				    recv_ill);
15081 				if (ire_need_rele)
15082 					ire_refrele(ire);
15083 				break;
15084 			case IPPROTO_TCP:
15085 				if (!ire_need_rele)
15086 					IRE_REFHOLD(ire);
15087 				mp = ip_tcp_input(mp, ipha, ill, B_TRUE,
15088 				    ire, ipsec_mp, 0, ill->ill_rq, NULL);
15089 				IRE_REFRELE(ire);
15090 				if (mp != NULL)
15091 					squeue_enter_chain(GET_SQUEUE(mp), mp,
15092 					    mp, 1, SQTAG_IP_PROTO_AGAIN);
15093 				break;
15094 			case IPPROTO_SCTP:
15095 				if (!ire_need_rele)
15096 					IRE_REFHOLD(ire);
15097 				ip_sctp_input(mp, ipha, ill, B_TRUE, ire,
15098 				    ipsec_mp, 0, ill->ill_rq, dst);
15099 				break;
15100 			default:
15101 				ip_proto_input(ill->ill_rq, ipsec_mp, ipha, ire,
15102 				    recv_ill);
15103 				if (ire_need_rele)
15104 					ire_refrele(ire);
15105 				break;
15106 		}
15107 	} else {
15108 		uint32_t rput_flags = 0;
15109 
15110 		ip6h = (ip6_t *)mp->b_rptr;
15111 		v6dstp = &ip6h->ip6_dst;
15112 		/*
15113 		 * XXX Assumes ip_rput_v6 sets ll_multicast  only for multicast
15114 		 * address.
15115 		 *
15116 		 * Currently, we don't store that state in the IPSEC_IN
15117 		 * message, and we may need to.
15118 		 */
15119 		rput_flags |= (IN6_IS_ADDR_MULTICAST(v6dstp) ?
15120 		    IP6_IN_LLMCAST : 0);
15121 		ip_rput_data_v6(ill->ill_rq, ill, ipsec_mp, ip6h, rput_flags,
15122 		    NULL);
15123 	}
15124 	if (ill_need_rele)
15125 		ill_refrele(ill);
15126 	if (rill_need_rele)
15127 		ill_refrele(recv_ill);
15128 }
15129 
15130 /*
15131  * Call ill_frag_timeout to do garbage collection. ill_frag_timeout
15132  * returns 'true' if there are still fragments left on the queue, in
15133  * which case we restart the timer.
15134  */
15135 void
15136 ill_frag_timer(void *arg)
15137 {
15138 	ill_t	*ill = (ill_t *)arg;
15139 	boolean_t frag_pending;
15140 
15141 	mutex_enter(&ill->ill_lock);
15142 	ASSERT(!ill->ill_fragtimer_executing);
15143 	if (ill->ill_state_flags & ILL_CONDEMNED) {
15144 		ill->ill_frag_timer_id = 0;
15145 		mutex_exit(&ill->ill_lock);
15146 		return;
15147 	}
15148 	ill->ill_fragtimer_executing = 1;
15149 	mutex_exit(&ill->ill_lock);
15150 
15151 	frag_pending = ill_frag_timeout(ill, ip_g_frag_timeout);
15152 
15153 	/*
15154 	 * Restart the timer, if we have fragments pending or if someone
15155 	 * wanted us to be scheduled again.
15156 	 */
15157 	mutex_enter(&ill->ill_lock);
15158 	ill->ill_fragtimer_executing = 0;
15159 	ill->ill_frag_timer_id = 0;
15160 	if (frag_pending || ill->ill_fragtimer_needrestart)
15161 		ill_frag_timer_start(ill);
15162 	mutex_exit(&ill->ill_lock);
15163 }
15164 
15165 void
15166 ill_frag_timer_start(ill_t *ill)
15167 {
15168 	ASSERT(MUTEX_HELD(&ill->ill_lock));
15169 
15170 	/* If the ill is closing or opening don't proceed */
15171 	if (ill->ill_state_flags & ILL_CONDEMNED)
15172 		return;
15173 
15174 	if (ill->ill_fragtimer_executing) {
15175 		/*
15176 		 * ill_frag_timer is currently executing. Just record the
15177 		 * the fact that we want the timer to be restarted.
15178 		 * ill_frag_timer will post a timeout before it returns,
15179 		 * ensuring it will be called again.
15180 		 */
15181 		ill->ill_fragtimer_needrestart = 1;
15182 		return;
15183 	}
15184 
15185 	if (ill->ill_frag_timer_id == 0) {
15186 		/*
15187 		 * The timer is neither running nor is the timeout handler
15188 		 * executing. Post a timeout so that ill_frag_timer will be
15189 		 * called
15190 		 */
15191 		ill->ill_frag_timer_id = timeout(ill_frag_timer, ill,
15192 		    MSEC_TO_TICK(ip_g_frag_timo_ms >> 1));
15193 		ill->ill_fragtimer_needrestart = 0;
15194 	}
15195 }
15196 
15197 /*
15198  * This routine is needed for loopback when forwarding multicasts.
15199  *
15200  * IPQoS Notes:
15201  * IPPF processing is done in fanout routines.
15202  * Policy processing is done only if IPP_lOCAL_IN is enabled. Further,
15203  * processing for IPSec packets is done when it comes back in clear.
15204  * NOTE : The callers of this function need to do the ire_refrele for the
15205  *	  ire that is being passed in.
15206  */
15207 void
15208 ip_proto_input(queue_t *q, mblk_t *mp, ipha_t *ipha, ire_t *ire,
15209     ill_t *recv_ill)
15210 {
15211 	ill_t	*ill = (ill_t *)q->q_ptr;
15212 	uint32_t	sum;
15213 	uint32_t	u1;
15214 	uint32_t	u2;
15215 	int		hdr_length;
15216 	boolean_t	mctl_present;
15217 	mblk_t		*first_mp = mp;
15218 	mblk_t		*hada_mp = NULL;
15219 	ipha_t		*inner_ipha;
15220 
15221 	TRACE_1(TR_FAC_IP, TR_IP_RPUT_LOCL_START,
15222 	    "ip_rput_locl_start: q %p", q);
15223 
15224 	ASSERT(ire->ire_ipversion == IPV4_VERSION);
15225 
15226 
15227 #define	rptr	((uchar_t *)ipha)
15228 #define	iphs	((uint16_t *)ipha)
15229 
15230 	/*
15231 	 * no UDP or TCP packet should come here anymore.
15232 	 */
15233 	ASSERT((ipha->ipha_protocol != IPPROTO_TCP) &&
15234 	    (ipha->ipha_protocol != IPPROTO_UDP));
15235 
15236 	EXTRACT_PKT_MP(mp, first_mp, mctl_present);
15237 	if (mctl_present &&
15238 	    ((da_ipsec_t *)first_mp->b_rptr)->da_type == IPHADA_M_CTL) {
15239 		ASSERT(MBLKL(first_mp) >= sizeof (da_ipsec_t));
15240 
15241 		/*
15242 		 * It's an IPsec accelerated packet.
15243 		 * Keep a pointer to the data attributes around until
15244 		 * we allocate the ipsec_info_t.
15245 		 */
15246 		IPSECHW_DEBUG(IPSECHW_PKT,
15247 		    ("ip_rput_local: inbound HW accelerated IPsec pkt\n"));
15248 		hada_mp = first_mp;
15249 		hada_mp->b_cont = NULL;
15250 		/*
15251 		 * Since it is accelerated, it comes directly from
15252 		 * the ill and the data attributes is followed by
15253 		 * the packet data.
15254 		 */
15255 		ASSERT(mp->b_datap->db_type != M_CTL);
15256 		first_mp = mp;
15257 		mctl_present = B_FALSE;
15258 	}
15259 
15260 	/*
15261 	 * IF M_CTL is not present, then ipsec_in_is_secure
15262 	 * should return B_TRUE. There is a case where loopback
15263 	 * packets has an M_CTL in the front with all the
15264 	 * IPSEC options set to IPSEC_PREF_NEVER - which means
15265 	 * ipsec_in_is_secure will return B_FALSE. As loopback
15266 	 * packets never comes here, it is safe to ASSERT the
15267 	 * following.
15268 	 */
15269 	ASSERT(!mctl_present || ipsec_in_is_secure(first_mp));
15270 
15271 
15272 	/* u1 is # words of IP options */
15273 	u1 = ipha->ipha_version_and_hdr_length - (uchar_t)((IP_VERSION << 4)
15274 	    + IP_SIMPLE_HDR_LENGTH_IN_WORDS);
15275 
15276 	if (u1) {
15277 		if (!ip_options_cksum(q, mp, ipha, ire)) {
15278 			if (hada_mp != NULL)
15279 				freemsg(hada_mp);
15280 			return;
15281 		}
15282 	} else {
15283 		/* Check the IP header checksum.  */
15284 #define	uph	((uint16_t *)ipha)
15285 		sum = uph[0] + uph[1] + uph[2] + uph[3] + uph[4] + uph[5] +
15286 		    uph[6] + uph[7] + uph[8] + uph[9];
15287 #undef  uph
15288 		/* finish doing IP checksum */
15289 		sum = (sum & 0xFFFF) + (sum >> 16);
15290 		sum = ~(sum + (sum >> 16)) & 0xFFFF;
15291 		/*
15292 		 * Don't verify header checksum if this packet is coming
15293 		 * back from AH/ESP as we already did it.
15294 		 */
15295 		if (!mctl_present && (sum && sum != 0xFFFF)) {
15296 			BUMP_MIB(&ip_mib, ipInCksumErrs);
15297 			goto drop_pkt;
15298 		}
15299 	}
15300 
15301 	/*
15302 	 * Count for SNMP of inbound packets for ire. As ip_proto_input
15303 	 * might be called more than once for secure packets, count only
15304 	 * the first time.
15305 	 */
15306 	if (!mctl_present) {
15307 		UPDATE_IB_PKT_COUNT(ire);
15308 		ire->ire_last_used_time = lbolt;
15309 	}
15310 
15311 	/* Check for fragmentation offset. */
15312 	u2 = ntohs(ipha->ipha_fragment_offset_and_flags);
15313 	u1 = u2 & (IPH_MF | IPH_OFFSET);
15314 	if (u1) {
15315 		/*
15316 		 * We re-assemble fragments before we do the AH/ESP
15317 		 * processing. Thus, M_CTL should not be present
15318 		 * while we are re-assembling.
15319 		 */
15320 		ASSERT(!mctl_present);
15321 		ASSERT(first_mp == mp);
15322 		if (!ip_rput_fragment(q, &mp, ipha)) {
15323 			return;
15324 		}
15325 		/*
15326 		 * Make sure that first_mp points back to mp as
15327 		 * the mp we came in with could have changed in
15328 		 * ip_rput_fragment().
15329 		 */
15330 		ipha = (ipha_t *)mp->b_rptr;
15331 		first_mp = mp;
15332 	}
15333 
15334 	/*
15335 	 * Clear hardware checksumming flag as it is currently only
15336 	 * used by TCP and UDP.
15337 	 */
15338 	mp->b_datap->db_struioun.cksum.flags = 0;
15339 
15340 	/* Now we have a complete datagram, destined for this machine. */
15341 	u1 = IPH_HDR_LENGTH(ipha);
15342 	switch (ipha->ipha_protocol) {
15343 	case IPPROTO_ICMP: {
15344 		ire_t		*ire_zone;
15345 		ilm_t		*ilm;
15346 		mblk_t		*mp1;
15347 		zoneid_t	last_zoneid;
15348 
15349 		if (CLASSD(ipha->ipha_dst) &&
15350 		    !(recv_ill->ill_phyint->phyint_flags & PHYI_LOOPBACK)) {
15351 			ASSERT(ire->ire_type == IRE_BROADCAST);
15352 			/*
15353 			 * In the multicast case, applications may have joined
15354 			 * the group from different zones, so we need to deliver
15355 			 * the packet to each of them. Loop through the
15356 			 * multicast memberships structures (ilm) on the receive
15357 			 * ill and send a copy of the packet up each matching
15358 			 * one. However, we don't do this for multicasts sent on
15359 			 * the loopback interface (PHYI_LOOPBACK flag set) as
15360 			 * they must stay in the sender's zone.
15361 			 *
15362 			 * ilm_add_v6() ensures that ilms in the same zone are
15363 			 * contiguous in the ill_ilm list. We use this property
15364 			 * to avoid sending duplicates needed when two
15365 			 * applications in the same zone join the same group on
15366 			 * different logical interfaces: we ignore the ilm if
15367 			 * its zoneid is the same as the last matching one.
15368 			 * In addition, the sending of the packet for
15369 			 * ire_zoneid is delayed until all of the other ilms
15370 			 * have been exhausted.
15371 			 */
15372 			last_zoneid = -1;
15373 			ILM_WALKER_HOLD(recv_ill);
15374 			for (ilm = recv_ill->ill_ilm; ilm != NULL;
15375 			    ilm = ilm->ilm_next) {
15376 				if ((ilm->ilm_flags & ILM_DELETED) ||
15377 				    ipha->ipha_dst != ilm->ilm_addr ||
15378 				    ilm->ilm_zoneid == last_zoneid ||
15379 				    ilm->ilm_zoneid == ire->ire_zoneid ||
15380 				    !(ilm->ilm_ipif->ipif_flags & IPIF_UP))
15381 					continue;
15382 				mp1 = ip_copymsg(first_mp);
15383 				if (mp1 == NULL)
15384 					continue;
15385 				icmp_inbound(q, mp1, B_TRUE, ill,
15386 				    0, sum, mctl_present, B_TRUE,
15387 				    recv_ill, ilm->ilm_zoneid);
15388 				last_zoneid = ilm->ilm_zoneid;
15389 			}
15390 			ILM_WALKER_RELE(recv_ill);
15391 		} else if (ire->ire_type == IRE_BROADCAST) {
15392 			/*
15393 			 * In the broadcast case, there may be many zones
15394 			 * which need a copy of the packet delivered to them.
15395 			 * There is one IRE_BROADCAST per broadcast address
15396 			 * and per zone; we walk those using a helper function.
15397 			 * In addition, the sending of the packet for ire is
15398 			 * delayed until all of the other ires have been
15399 			 * processed.
15400 			 */
15401 			IRB_REFHOLD(ire->ire_bucket);
15402 			ire_zone = NULL;
15403 			while ((ire_zone = ire_get_next_bcast_ire(ire_zone,
15404 			    ire)) != NULL) {
15405 				mp1 = ip_copymsg(first_mp);
15406 				if (mp1 == NULL)
15407 					continue;
15408 
15409 				UPDATE_IB_PKT_COUNT(ire_zone);
15410 				ire_zone->ire_last_used_time = lbolt;
15411 				icmp_inbound(q, mp1, B_TRUE, ill,
15412 				    0, sum, mctl_present, B_TRUE,
15413 				    recv_ill, ire_zone->ire_zoneid);
15414 			}
15415 			IRB_REFRELE(ire->ire_bucket);
15416 		}
15417 		icmp_inbound(q, first_mp, (ire->ire_type == IRE_BROADCAST),
15418 		    ill, 0, sum, mctl_present, B_TRUE, recv_ill,
15419 		    ire->ire_zoneid);
15420 		TRACE_2(TR_FAC_IP, TR_IP_RPUT_LOCL_END,
15421 		    "ip_rput_locl_end: q %p (%S)", q, "icmp");
15422 		return;
15423 	}
15424 	case IPPROTO_IGMP:
15425 		/*
15426 		 * If we are not willing to accept IGMP packets in clear,
15427 		 * then check with global policy.
15428 		 */
15429 		if (igmp_accept_clear_messages == 0) {
15430 			first_mp = ipsec_check_global_policy(first_mp, NULL,
15431 			    ipha, NULL, mctl_present);
15432 			if (first_mp == NULL)
15433 				return;
15434 		}
15435 		if (igmp_input(q, mp, ill)) {
15436 			/* Bad packet - discarded by igmp_input */
15437 			TRACE_2(TR_FAC_IP, TR_IP_RPUT_LOCL_END,
15438 			    "ip_rput_locl_end: q %p (%S)", q, "igmp");
15439 			if (mctl_present)
15440 				freeb(first_mp);
15441 			return;
15442 		}
15443 		/*
15444 		 * igmp_input() may have pulled up the message so ipha needs to
15445 		 * be reinitialized.
15446 		 */
15447 		ipha = (ipha_t *)mp->b_rptr;
15448 		if (ipcl_proto_search(ipha->ipha_protocol) == NULL) {
15449 			/* No user-level listener for IGMP packets */
15450 			goto drop_pkt;
15451 		}
15452 		/* deliver to local raw users */
15453 		break;
15454 	case IPPROTO_PIM:
15455 		/*
15456 		 * If we are not willing to accept PIM packets in clear,
15457 		 * then check with global policy.
15458 		 */
15459 		if (pim_accept_clear_messages == 0) {
15460 			first_mp = ipsec_check_global_policy(first_mp, NULL,
15461 			    ipha, NULL, mctl_present);
15462 			if (first_mp == NULL)
15463 				return;
15464 		}
15465 		if (pim_input(q, mp) != 0) {
15466 			/* Bad packet - discarded by pim_input */
15467 			TRACE_2(TR_FAC_IP, TR_IP_RPUT_LOCL_END,
15468 			    "ip_rput_locl_end: q %p (%S)", q, "pim");
15469 			if (mctl_present)
15470 				freeb(first_mp);
15471 			return;
15472 		}
15473 
15474 		/*
15475 		 * pim_input() may have pulled up the message so ipha needs to
15476 		 * be reinitialized.
15477 		 */
15478 		ipha = (ipha_t *)mp->b_rptr;
15479 		if (ipcl_proto_search(ipha->ipha_protocol) == NULL) {
15480 			/* No user-level listener for PIM packets */
15481 			goto drop_pkt;
15482 		}
15483 		/* deliver to local raw users */
15484 		break;
15485 	case IPPROTO_ENCAP:
15486 		/*
15487 		 * Handle self-encapsulated packets (IP-in-IP where
15488 		 * the inner addresses == the outer addresses).
15489 		 */
15490 		hdr_length = IPH_HDR_LENGTH(ipha);
15491 		if ((uchar_t *)ipha + hdr_length + sizeof (ipha_t) >
15492 		    mp->b_wptr) {
15493 			if (!pullupmsg(mp, (uchar_t *)ipha + hdr_length +
15494 			    sizeof (ipha_t) - mp->b_rptr)) {
15495 				BUMP_MIB(&ip_mib, ipInDiscards);
15496 				freemsg(first_mp);
15497 				return;
15498 			}
15499 			ipha = (ipha_t *)mp->b_rptr;
15500 		}
15501 		inner_ipha = (ipha_t *)((uchar_t *)ipha + hdr_length);
15502 		/*
15503 		 * Check the sanity of the inner IP header.
15504 		 */
15505 		if ((IPH_HDR_VERSION(inner_ipha) != IPV4_VERSION)) {
15506 			BUMP_MIB(&ip_mib, ipInDiscards);
15507 			freemsg(first_mp);
15508 			return;
15509 		}
15510 		if (IPH_HDR_LENGTH(inner_ipha) < sizeof (ipha_t)) {
15511 			BUMP_MIB(&ip_mib, ipInDiscards);
15512 			freemsg(first_mp);
15513 			return;
15514 		}
15515 		if (inner_ipha->ipha_src == ipha->ipha_src &&
15516 		    inner_ipha->ipha_dst == ipha->ipha_dst) {
15517 			ipsec_in_t *ii;
15518 
15519 			/*
15520 			 * Self-encapsulated tunnel packet. Remove
15521 			 * the outer IP header and fanout again.
15522 			 * We also need to make sure that the inner
15523 			 * header is pulled up until options.
15524 			 */
15525 			mp->b_rptr = (uchar_t *)inner_ipha;
15526 			ipha = inner_ipha;
15527 			hdr_length = IPH_HDR_LENGTH(ipha);
15528 			if ((uchar_t *)ipha + hdr_length > mp->b_wptr) {
15529 				if (!pullupmsg(mp, (uchar_t *)ipha +
15530 				    + hdr_length - mp->b_rptr)) {
15531 					freemsg(first_mp);
15532 					return;
15533 				}
15534 				ipha = (ipha_t *)mp->b_rptr;
15535 			}
15536 			if (!mctl_present) {
15537 				ASSERT(first_mp == mp);
15538 				/*
15539 				 * This means that somebody is sending
15540 				 * Self-encapsualted packets without AH/ESP.
15541 				 * If AH/ESP was present, we would have already
15542 				 * allocated the first_mp.
15543 				 */
15544 				if ((first_mp = ipsec_in_alloc(B_TRUE)) ==
15545 				    NULL) {
15546 					ip1dbg(("ip_proto_input: IPSEC_IN "
15547 					    "allocation failure.\n"));
15548 					BUMP_MIB(&ip_mib, ipInDiscards);
15549 					freemsg(mp);
15550 					return;
15551 				}
15552 				first_mp->b_cont = mp;
15553 			}
15554 			/*
15555 			 * We generally store the ill_index if we need to
15556 			 * do IPSEC processing as we lose the ill queue when
15557 			 * we come back. But in this case, we never should
15558 			 * have to store the ill_index here as it should have
15559 			 * been stored previously when we processed the
15560 			 * AH/ESP header in this routine or for non-ipsec
15561 			 * cases, we still have the queue. But for some bad
15562 			 * packets from the wire, we can get to IPSEC after
15563 			 * this and we better store the index for that case.
15564 			 */
15565 			ill = (ill_t *)q->q_ptr;
15566 			ii = (ipsec_in_t *)first_mp->b_rptr;
15567 			ii->ipsec_in_ill_index =
15568 			    ill->ill_phyint->phyint_ifindex;
15569 			ii->ipsec_in_rill_index =
15570 			    recv_ill->ill_phyint->phyint_ifindex;
15571 			if (ii->ipsec_in_decaps) {
15572 				/*
15573 				 * This packet is self-encapsulated multiple
15574 				 * times. We don't want to recurse infinitely.
15575 				 * To keep it simple, drop the packet.
15576 				 */
15577 				BUMP_MIB(&ip_mib, ipInDiscards);
15578 				freemsg(first_mp);
15579 				return;
15580 			}
15581 			ii->ipsec_in_decaps = B_TRUE;
15582 			ip_proto_input(q, first_mp, ipha, ire, recv_ill);
15583 			return;
15584 		}
15585 		break;
15586 	case IPPROTO_AH:
15587 	case IPPROTO_ESP: {
15588 		/*
15589 		 * Fast path for AH/ESP. If this is the first time
15590 		 * we are sending a datagram to AH/ESP, allocate
15591 		 * a IPSEC_IN message and prepend it. Otherwise,
15592 		 * just fanout.
15593 		 */
15594 
15595 		int ipsec_rc;
15596 		ipsec_in_t *ii;
15597 
15598 		IP_STAT(ipsec_proto_ahesp);
15599 		if (!mctl_present) {
15600 			ASSERT(first_mp == mp);
15601 			if ((first_mp = ipsec_in_alloc(B_TRUE)) == NULL) {
15602 				ip1dbg(("ip_proto_input: IPSEC_IN "
15603 				    "allocation failure.\n"));
15604 				freemsg(hada_mp); /* okay ifnull */
15605 				BUMP_MIB(&ip_mib, ipInDiscards);
15606 				freemsg(mp);
15607 				return;
15608 			}
15609 			/*
15610 			 * Store the ill_index so that when we come back
15611 			 * from IPSEC we ride on the same queue.
15612 			 */
15613 			ill = (ill_t *)q->q_ptr;
15614 			ii = (ipsec_in_t *)first_mp->b_rptr;
15615 			ii->ipsec_in_ill_index =
15616 			    ill->ill_phyint->phyint_ifindex;
15617 			ii->ipsec_in_rill_index =
15618 			    recv_ill->ill_phyint->phyint_ifindex;
15619 			first_mp->b_cont = mp;
15620 			/*
15621 			 * Cache hardware acceleration info.
15622 			 */
15623 			if (hada_mp != NULL) {
15624 				IPSECHW_DEBUG(IPSECHW_PKT,
15625 				    ("ip_rput_local: caching data attr.\n"));
15626 				ii->ipsec_in_accelerated = B_TRUE;
15627 				ii->ipsec_in_da = hada_mp;
15628 				hada_mp = NULL;
15629 			}
15630 		} else {
15631 			ii = (ipsec_in_t *)first_mp->b_rptr;
15632 		}
15633 
15634 		if (!ipsec_loaded()) {
15635 			ip_proto_not_sup(q, first_mp, IP_FF_SEND_ICMP,
15636 			    ire->ire_zoneid);
15637 			return;
15638 		}
15639 
15640 		/* select inbound SA and have IPsec process the pkt */
15641 		if (ipha->ipha_protocol == IPPROTO_ESP) {
15642 			esph_t *esph = ipsec_inbound_esp_sa(first_mp);
15643 			if (esph == NULL)
15644 				return;
15645 			ASSERT(ii->ipsec_in_esp_sa != NULL);
15646 			ASSERT(ii->ipsec_in_esp_sa->ipsa_input_func != NULL);
15647 			ipsec_rc = ii->ipsec_in_esp_sa->ipsa_input_func(
15648 			    first_mp, esph);
15649 		} else {
15650 			ah_t *ah = ipsec_inbound_ah_sa(first_mp);
15651 			if (ah == NULL)
15652 				return;
15653 			ASSERT(ii->ipsec_in_ah_sa != NULL);
15654 			ASSERT(ii->ipsec_in_ah_sa->ipsa_input_func != NULL);
15655 			ipsec_rc = ii->ipsec_in_ah_sa->ipsa_input_func(
15656 			    first_mp, ah);
15657 		}
15658 
15659 		switch (ipsec_rc) {
15660 		case IPSEC_STATUS_SUCCESS:
15661 			break;
15662 		case IPSEC_STATUS_FAILED:
15663 			BUMP_MIB(&ip_mib, ipInDiscards);
15664 			/* FALLTHRU */
15665 		case IPSEC_STATUS_PENDING:
15666 			return;
15667 		}
15668 		/* we're done with IPsec processing, send it up */
15669 		ip_fanout_proto_again(first_mp, ill, recv_ill, ire);
15670 		return;
15671 	}
15672 	default:
15673 		break;
15674 	}
15675 	/*
15676 	 * Handle protocols with which IP is less intimate.  There
15677 	 * can be more than one stream bound to a particular
15678 	 * protocol.  When this is the case, each one gets a copy
15679 	 * of any incoming packets.
15680 	 */
15681 	ip_fanout_proto(q, first_mp, ill, ipha,
15682 	    IP_FF_SEND_ICMP | IP_FF_CKSUM | IP_FF_RAWIP, mctl_present,
15683 	    B_TRUE, recv_ill, ire->ire_zoneid);
15684 	TRACE_2(TR_FAC_IP, TR_IP_RPUT_LOCL_END,
15685 	    "ip_rput_locl_end: q %p (%S)", q, "ip_fanout_proto");
15686 	return;
15687 
15688 drop_pkt:
15689 	freemsg(first_mp);
15690 	if (hada_mp != NULL)
15691 		freeb(hada_mp);
15692 	TRACE_2(TR_FAC_IP, TR_IP_RPUT_LOCL_END,
15693 	    "ip_rput_locl_end: q %p (%S)", q, "droppkt");
15694 #undef	rptr
15695 #undef  iphs
15696 
15697 }
15698 
15699 /*
15700  * Update any source route, record route or timestamp options.
15701  * Check that we are at end of strict source route.
15702  * The options have already been checked for sanity in ip_rput_options().
15703  */
15704 static boolean_t
15705 ip_rput_local_options(queue_t *q, mblk_t *mp, ipha_t *ipha, ire_t *ire)
15706 {
15707 	ipoptp_t	opts;
15708 	uchar_t		*opt;
15709 	uint8_t		optval;
15710 	uint8_t		optlen;
15711 	ipaddr_t	dst;
15712 	uint32_t	ts;
15713 	ire_t		*dst_ire;
15714 	timestruc_t	now;
15715 
15716 	ASSERT(ire->ire_ipversion == IPV4_VERSION);
15717 
15718 	ip2dbg(("ip_rput_local_options\n"));
15719 
15720 	for (optval = ipoptp_first(&opts, ipha);
15721 	    optval != IPOPT_EOL;
15722 	    optval = ipoptp_next(&opts)) {
15723 		ASSERT((opts.ipoptp_flags & IPOPTP_ERROR) == 0);
15724 		opt = opts.ipoptp_cur;
15725 		optlen = opts.ipoptp_len;
15726 		ip2dbg(("ip_rput_local_options: opt %d, len %d\n",
15727 		    optval, optlen));
15728 		switch (optval) {
15729 			uint32_t off;
15730 		case IPOPT_SSRR:
15731 		case IPOPT_LSRR:
15732 			off = opt[IPOPT_OFFSET];
15733 			off--;
15734 			if (optlen < IP_ADDR_LEN ||
15735 			    off > optlen - IP_ADDR_LEN) {
15736 				/* End of source route */
15737 				ip1dbg(("ip_rput_local_options: end of SR\n"));
15738 				break;
15739 			}
15740 			/*
15741 			 * This will only happen if two consecutive entries
15742 			 * in the source route contains our address or if
15743 			 * it is a packet with a loose source route which
15744 			 * reaches us before consuming the whole source route
15745 			 */
15746 			ip1dbg(("ip_rput_local_options: not end of SR\n"));
15747 			if (optval == IPOPT_SSRR) {
15748 				goto bad_src_route;
15749 			}
15750 			/*
15751 			 * Hack: instead of dropping the packet truncate the
15752 			 * source route to what has been used by filling the
15753 			 * rest with IPOPT_NOP.
15754 			 */
15755 			opt[IPOPT_OLEN] = (uint8_t)off;
15756 			while (off < optlen) {
15757 				opt[off++] = IPOPT_NOP;
15758 			}
15759 			break;
15760 		case IPOPT_RR:
15761 			off = opt[IPOPT_OFFSET];
15762 			off--;
15763 			if (optlen < IP_ADDR_LEN ||
15764 			    off > optlen - IP_ADDR_LEN) {
15765 				/* No more room - ignore */
15766 				ip1dbg((
15767 				    "ip_rput_local_options: end of RR\n"));
15768 				break;
15769 			}
15770 			bcopy(&ire->ire_src_addr, (char *)opt + off,
15771 			    IP_ADDR_LEN);
15772 			opt[IPOPT_OFFSET] += IP_ADDR_LEN;
15773 			break;
15774 		case IPOPT_TS:
15775 			/* Insert timestamp if there is romm */
15776 			switch (opt[IPOPT_POS_OV_FLG] & 0x0F) {
15777 			case IPOPT_TS_TSONLY:
15778 				off = IPOPT_TS_TIMELEN;
15779 				break;
15780 			case IPOPT_TS_PRESPEC:
15781 			case IPOPT_TS_PRESPEC_RFC791:
15782 				/* Verify that the address matched */
15783 				off = opt[IPOPT_OFFSET] - 1;
15784 				bcopy((char *)opt + off, &dst, IP_ADDR_LEN);
15785 				dst_ire = ire_ctable_lookup(dst, 0, IRE_LOCAL,
15786 				    NULL, ALL_ZONES, MATCH_IRE_TYPE);
15787 				if (dst_ire == NULL) {
15788 					/* Not for us */
15789 					break;
15790 				}
15791 				ire_refrele(dst_ire);
15792 				/* FALLTHRU */
15793 			case IPOPT_TS_TSANDADDR:
15794 				off = IP_ADDR_LEN + IPOPT_TS_TIMELEN;
15795 				break;
15796 			default:
15797 				/*
15798 				 * ip_*put_options should have already
15799 				 * dropped this packet.
15800 				 */
15801 				cmn_err(CE_PANIC, "ip_rput_local_options: "
15802 				    "unknown IT - bug in ip_rput_options?\n");
15803 				return (B_TRUE);	/* Keep "lint" happy */
15804 			}
15805 			if (opt[IPOPT_OFFSET] - 1 + off > optlen) {
15806 				/* Increase overflow counter */
15807 				off = (opt[IPOPT_POS_OV_FLG] >> 4) + 1;
15808 				opt[IPOPT_POS_OV_FLG] =
15809 				    (uint8_t)((opt[IPOPT_POS_OV_FLG] & 0x0F) |
15810 				    (off << 4));
15811 				break;
15812 			}
15813 			off = opt[IPOPT_OFFSET] - 1;
15814 			switch (opt[IPOPT_POS_OV_FLG] & 0x0F) {
15815 			case IPOPT_TS_PRESPEC:
15816 			case IPOPT_TS_PRESPEC_RFC791:
15817 			case IPOPT_TS_TSANDADDR:
15818 				bcopy(&ire->ire_src_addr, (char *)opt + off,
15819 				    IP_ADDR_LEN);
15820 				opt[IPOPT_OFFSET] += IP_ADDR_LEN;
15821 				/* FALLTHRU */
15822 			case IPOPT_TS_TSONLY:
15823 				off = opt[IPOPT_OFFSET] - 1;
15824 				/* Compute # of milliseconds since midnight */
15825 				gethrestime(&now);
15826 				ts = (now.tv_sec % (24 * 60 * 60)) * 1000 +
15827 				    now.tv_nsec / (NANOSEC / MILLISEC);
15828 				bcopy(&ts, (char *)opt + off, IPOPT_TS_TIMELEN);
15829 				opt[IPOPT_OFFSET] += IPOPT_TS_TIMELEN;
15830 				break;
15831 			}
15832 			break;
15833 		}
15834 	}
15835 	return (B_TRUE);
15836 
15837 bad_src_route:
15838 	q = WR(q);
15839 	/* make sure we clear any indication of a hardware checksum */
15840 	mp->b_datap->db_struioun.cksum.flags = 0;
15841 	icmp_unreachable(q, mp, ICMP_SOURCE_ROUTE_FAILED);
15842 	return (B_FALSE);
15843 
15844 }
15845 
15846 /*
15847  * Process IP options in an inbound packet.  If an option affects the
15848  * effective destination address, return the next hop address via dstp.
15849  * Returns -1 if something fails in which case an ICMP error has been sent
15850  * and mp freed.
15851  */
15852 static int
15853 ip_rput_options(queue_t *q, mblk_t *mp, ipha_t *ipha, ipaddr_t *dstp)
15854 {
15855 	ipoptp_t	opts;
15856 	uchar_t		*opt;
15857 	uint8_t		optval;
15858 	uint8_t		optlen;
15859 	ipaddr_t	dst;
15860 	intptr_t	code = 0;
15861 	ire_t		*ire = NULL;
15862 
15863 	ip2dbg(("ip_rput_options\n"));
15864 	dst = ipha->ipha_dst;
15865 	for (optval = ipoptp_first(&opts, ipha);
15866 	    optval != IPOPT_EOL;
15867 	    optval = ipoptp_next(&opts)) {
15868 		opt = opts.ipoptp_cur;
15869 		optlen = opts.ipoptp_len;
15870 		ip2dbg(("ip_rput_options: opt %d, len %d\n",
15871 		    optval, optlen));
15872 		/*
15873 		 * Note: we need to verify the checksum before we
15874 		 * modify anything thus this routine only extracts the next
15875 		 * hop dst from any source route.
15876 		 */
15877 		switch (optval) {
15878 			uint32_t off;
15879 		case IPOPT_SSRR:
15880 		case IPOPT_LSRR:
15881 			ire = ire_ctable_lookup(dst, 0, IRE_LOCAL, NULL,
15882 			    ALL_ZONES, MATCH_IRE_TYPE);
15883 			if (ire == NULL) {
15884 				if (optval == IPOPT_SSRR) {
15885 					ip1dbg(("ip_rput_options: not next"
15886 					    " strict source route 0x%x\n",
15887 					    ntohl(dst)));
15888 					code = (char *)&ipha->ipha_dst -
15889 					    (char *)ipha;
15890 					goto param_prob; /* RouterReq's */
15891 				}
15892 				ip2dbg(("ip_rput_options: "
15893 				    "not next source route 0x%x\n",
15894 				    ntohl(dst)));
15895 				break;
15896 			}
15897 			ire_refrele(ire);
15898 
15899 			if ((opts.ipoptp_flags & IPOPTP_ERROR) != 0) {
15900 				ip1dbg((
15901 				    "ip_rput_options: bad option offset\n"));
15902 				code = (char *)&opt[IPOPT_OLEN] -
15903 				    (char *)ipha;
15904 				goto param_prob;
15905 			}
15906 			off = opt[IPOPT_OFFSET];
15907 			off--;
15908 		redo_srr:
15909 			if (optlen < IP_ADDR_LEN ||
15910 			    off > optlen - IP_ADDR_LEN) {
15911 				/* End of source route */
15912 				ip1dbg(("ip_rput_options: end of SR\n"));
15913 				break;
15914 			}
15915 			bcopy((char *)opt + off, &dst, IP_ADDR_LEN);
15916 			ip1dbg(("ip_rput_options: next hop 0x%x\n",
15917 			    ntohl(dst)));
15918 
15919 			/*
15920 			 * Check if our address is present more than
15921 			 * once as consecutive hops in source route.
15922 			 * XXX verify per-interface ip_forwarding
15923 			 * for source route?
15924 			 */
15925 			ire = ire_ctable_lookup(dst, 0, IRE_LOCAL, NULL,
15926 			    ALL_ZONES, MATCH_IRE_TYPE);
15927 
15928 			if (ire != NULL) {
15929 				ire_refrele(ire);
15930 				off += IP_ADDR_LEN;
15931 				goto redo_srr;
15932 			}
15933 
15934 			if (dst == htonl(INADDR_LOOPBACK)) {
15935 				ip1dbg(("ip_rput_options: loopback addr in "
15936 				    "source route!\n"));
15937 				goto bad_src_route;
15938 			}
15939 			/*
15940 			 * For strict: verify that dst is directly
15941 			 * reachable.
15942 			 */
15943 			if (optval == IPOPT_SSRR) {
15944 				ire = ire_ftable_lookup(dst, 0, 0,
15945 				    IRE_INTERFACE, NULL, NULL, ALL_ZONES, 0,
15946 				    MATCH_IRE_TYPE);
15947 				if (ire == NULL) {
15948 					ip1dbg(("ip_rput_options: SSRR not "
15949 					    "directly reachable: 0x%x\n",
15950 					    ntohl(dst)));
15951 					goto bad_src_route;
15952 				}
15953 				ire_refrele(ire);
15954 			}
15955 			/*
15956 			 * Defer update of the offset and the record route
15957 			 * until the packet is forwarded.
15958 			 */
15959 			break;
15960 		case IPOPT_RR:
15961 			if ((opts.ipoptp_flags & IPOPTP_ERROR) != 0) {
15962 				ip1dbg((
15963 				    "ip_rput_options: bad option offset\n"));
15964 				code = (char *)&opt[IPOPT_OLEN] -
15965 				    (char *)ipha;
15966 				goto param_prob;
15967 			}
15968 			break;
15969 		case IPOPT_TS:
15970 			/*
15971 			 * Verify that length >= 5 and that there is either
15972 			 * room for another timestamp or that the overflow
15973 			 * counter is not maxed out.
15974 			 */
15975 			code = (char *)&opt[IPOPT_OLEN] - (char *)ipha;
15976 			if (optlen < IPOPT_MINLEN_IT) {
15977 				goto param_prob;
15978 			}
15979 			if ((opts.ipoptp_flags & IPOPTP_ERROR) != 0) {
15980 				ip1dbg((
15981 				    "ip_rput_options: bad option offset\n"));
15982 				code = (char *)&opt[IPOPT_OFFSET] -
15983 				    (char *)ipha;
15984 				goto param_prob;
15985 			}
15986 			switch (opt[IPOPT_POS_OV_FLG] & 0x0F) {
15987 			case IPOPT_TS_TSONLY:
15988 				off = IPOPT_TS_TIMELEN;
15989 				break;
15990 			case IPOPT_TS_TSANDADDR:
15991 			case IPOPT_TS_PRESPEC:
15992 			case IPOPT_TS_PRESPEC_RFC791:
15993 				off = IP_ADDR_LEN + IPOPT_TS_TIMELEN;
15994 				break;
15995 			default:
15996 				code = (char *)&opt[IPOPT_POS_OV_FLG] -
15997 				    (char *)ipha;
15998 				goto param_prob;
15999 			}
16000 			if (opt[IPOPT_OFFSET] - 1 + off > optlen &&
16001 			    (opt[IPOPT_POS_OV_FLG] & 0xF0) == 0xF0) {
16002 				/*
16003 				 * No room and the overflow counter is 15
16004 				 * already.
16005 				 */
16006 				goto param_prob;
16007 			}
16008 			break;
16009 		}
16010 	}
16011 
16012 	if ((opts.ipoptp_flags & IPOPTP_ERROR) == 0) {
16013 		*dstp = dst;
16014 		return (0);
16015 	}
16016 
16017 	ip1dbg(("ip_rput_options: error processing IP options."));
16018 	code = (char *)&opt[IPOPT_OFFSET] - (char *)ipha;
16019 
16020 param_prob:
16021 	q = WR(q);
16022 	/* make sure we clear any indication of a hardware checksum */
16023 	mp->b_datap->db_struioun.cksum.flags = 0;
16024 	icmp_param_problem(q, mp, (uint8_t)code);
16025 	return (-1);
16026 
16027 bad_src_route:
16028 	q = WR(q);
16029 	/* make sure we clear any indication of a hardware checksum */
16030 	mp->b_datap->db_struioun.cksum.flags = 0;
16031 	icmp_unreachable(q, mp, ICMP_SOURCE_ROUTE_FAILED);
16032 	return (-1);
16033 }
16034 
16035 /*
16036  * IP & ICMP info in >=14 msg's ...
16037  *  - ip fixed part (mib2_ip_t)
16038  *  - icmp fixed part (mib2_icmp_t)
16039  *  - ipAddrEntryTable (ip 20)		all IPv4 ipifs
16040  *  - ipRouteEntryTable (ip 21)		all IPv4 IREs
16041  *  - ipNetToMediaEntryTable (ip 22)	IPv4 IREs for on-link destinations
16042  *  - ip multicast membership (ip_member_t)
16043  *  - ip multicast source filtering (ip_grpsrc_t)
16044  *  - igmp fixed part (struct igmpstat)
16045  *  - multicast routing stats (struct mrtstat)
16046  *  - multicast routing vifs (array of struct vifctl)
16047  *  - multicast routing routes (array of struct mfcctl)
16048  *  - ip6 fixed part (mib2_ipv6IfStatsEntry_t)
16049  *					One per ill plus one generic
16050  *  - icmp6 fixed part (mib2_ipv6IfIcmpEntry_t)
16051  *					One per ill plus one generic
16052  *  - ipv6RouteEntry			all IPv6 IREs
16053  *  - ipv6NetToMediaEntry		all Neighbor Cache entries
16054  *  - ipv6AddrEntry			all IPv6 ipifs
16055  *  - ipv6 multicast membership (ipv6_member_t)
16056  *  - ipv6 multicast source filtering (ipv6_grpsrc_t)
16057  *
16058  * IP_ROUTE and IP_MEDIA are augmented in arp to include arp cache entries not
16059  * already present.
16060  * NOTE: original mpctl is copied for msg's 2..N, since its ctl part
16061  * already filled in by caller.
16062  * Return value of 0 indicates that no messages were sent and caller
16063  * should free mpctl.
16064  */
16065 int
16066 ip_snmp_get(queue_t *q, mblk_t *mpctl)
16067 {
16068 
16069 	if (mpctl == NULL || mpctl->b_cont == NULL) {
16070 		return (0);
16071 	}
16072 
16073 	if ((mpctl = ip_snmp_get_mib2_ip(q, mpctl)) == NULL) {
16074 		return (1);
16075 	}
16076 
16077 	if ((mpctl = ip_snmp_get_mib2_ip6(q, mpctl)) == NULL) {
16078 		return (1);
16079 	}
16080 
16081 	if ((mpctl = ip_snmp_get_mib2_icmp(q, mpctl)) == NULL) {
16082 		return (1);
16083 	}
16084 
16085 	if ((mpctl = ip_snmp_get_mib2_icmp6(q, mpctl)) == NULL) {
16086 		return (1);
16087 	}
16088 
16089 	if ((mpctl = ip_snmp_get_mib2_igmp(q, mpctl)) == NULL) {
16090 		return (1);
16091 	}
16092 
16093 	if ((mpctl = ip_snmp_get_mib2_multi(q, mpctl)) == NULL) {
16094 		return (1);
16095 	}
16096 
16097 	if ((mpctl = ip_snmp_get_mib2_ip_addr(q, mpctl)) == NULL) {
16098 		return (1);
16099 	}
16100 
16101 	if ((mpctl = ip_snmp_get_mib2_ip6_addr(q, mpctl)) == NULL) {
16102 		return (1);
16103 	}
16104 
16105 	if ((mpctl = ip_snmp_get_mib2_ip_group_mem(q, mpctl)) == NULL) {
16106 		return (1);
16107 	}
16108 
16109 	if ((mpctl = ip_snmp_get_mib2_ip6_group_mem(q, mpctl)) == NULL) {
16110 		return (1);
16111 	}
16112 
16113 	if ((mpctl = ip_snmp_get_mib2_ip_group_src(q, mpctl)) == NULL) {
16114 		return (1);
16115 	}
16116 
16117 	if ((mpctl = ip_snmp_get_mib2_ip6_group_src(q, mpctl)) == NULL) {
16118 		return (1);
16119 	}
16120 
16121 	if ((mpctl = ip_snmp_get_mib2_virt_multi(q, mpctl)) == NULL) {
16122 		return (1);
16123 	}
16124 
16125 	if ((mpctl = ip_snmp_get_mib2_multi_rtable(q, mpctl)) == NULL) {
16126 		return (1);
16127 	}
16128 
16129 	if ((mpctl = ip_snmp_get_mib2_ip_route_media(q, mpctl)) == NULL) {
16130 		return (1);
16131 	}
16132 
16133 	if ((mpctl = ip_snmp_get_mib2_ip6_route_media(q, mpctl)) == NULL) {
16134 		return (1);
16135 	}
16136 
16137 	if ((mpctl = sctp_snmp_get_mib2(q, mpctl)) == NULL) {
16138 		return (1);
16139 	}
16140 	freemsg(mpctl);
16141 	return (1);
16142 }
16143 
16144 
16145 /* Get global IPv4 statistics */
16146 static mblk_t *
16147 ip_snmp_get_mib2_ip(queue_t *q, mblk_t *mpctl)
16148 {
16149 	struct opthdr		*optp;
16150 	mblk_t			*mp2ctl;
16151 
16152 	/*
16153 	 * make a copy of the original message
16154 	 */
16155 	mp2ctl = copymsg(mpctl);
16156 
16157 	/* fixed length IP structure... */
16158 	optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
16159 	optp->level = MIB2_IP;
16160 	optp->name = 0;
16161 	SET_MIB(ip_mib.ipForwarding,
16162 	    (WE_ARE_FORWARDING ? 1 : 2));
16163 	SET_MIB(ip_mib.ipDefaultTTL,
16164 	    (uint32_t)ip_def_ttl);
16165 	SET_MIB(ip_mib.ipReasmTimeout,
16166 	    ip_g_frag_timeout);
16167 	SET_MIB(ip_mib.ipAddrEntrySize,
16168 	    sizeof (mib2_ipAddrEntry_t));
16169 	SET_MIB(ip_mib.ipRouteEntrySize,
16170 	    sizeof (mib2_ipRouteEntry_t));
16171 	SET_MIB(ip_mib.ipNetToMediaEntrySize,
16172 	    sizeof (mib2_ipNetToMediaEntry_t));
16173 	SET_MIB(ip_mib.ipMemberEntrySize, sizeof (ip_member_t));
16174 	SET_MIB(ip_mib.ipGroupSourceEntrySize, sizeof (ip_grpsrc_t));
16175 	if (!snmp_append_data(mpctl->b_cont, (char *)&ip_mib,
16176 	    (int)sizeof (ip_mib))) {
16177 		ip1dbg(("ip_snmp_get_mib2_ip: failed to allocate %u bytes\n",
16178 		    (uint_t)sizeof (ip_mib)));
16179 	}
16180 
16181 	optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont);
16182 	ip3dbg(("ip_snmp_get_mib2_ip: level %d, name %d, len %d\n",
16183 	    (int)optp->level, (int)optp->name, (int)optp->len));
16184 	qreply(q, mpctl);
16185 	return (mp2ctl);
16186 }
16187 
16188 /* Global IPv4 ICMP statistics */
16189 static mblk_t *
16190 ip_snmp_get_mib2_icmp(queue_t *q, mblk_t *mpctl)
16191 {
16192 	struct opthdr		*optp;
16193 	mblk_t			*mp2ctl;
16194 
16195 	/*
16196 	 * Make a copy of the original message
16197 	 */
16198 	mp2ctl = copymsg(mpctl);
16199 
16200 	optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
16201 	optp->level = MIB2_ICMP;
16202 	optp->name = 0;
16203 	if (!snmp_append_data(mpctl->b_cont, (char *)&icmp_mib,
16204 	    (int)sizeof (icmp_mib))) {
16205 		ip1dbg(("ip_snmp_get_mib2_icmp: failed to allocate %u bytes\n",
16206 		    (uint_t)sizeof (icmp_mib)));
16207 	}
16208 	optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont);
16209 	ip3dbg(("ip_snmp_get_mib2_icmp: level %d, name %d, len %d\n",
16210 	    (int)optp->level, (int)optp->name, (int)optp->len));
16211 	qreply(q, mpctl);
16212 	return (mp2ctl);
16213 }
16214 
16215 /* Global IPv4 IGMP statistics */
16216 static mblk_t *
16217 ip_snmp_get_mib2_igmp(queue_t *q, mblk_t *mpctl)
16218 {
16219 	struct opthdr		*optp;
16220 	mblk_t			*mp2ctl;
16221 
16222 	/*
16223 	 * make a copy of the original message
16224 	 */
16225 	mp2ctl = copymsg(mpctl);
16226 
16227 	optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
16228 	optp->level = EXPER_IGMP;
16229 	optp->name = 0;
16230 	if (!snmp_append_data(mpctl->b_cont, (char *)&igmpstat,
16231 	    (int)sizeof (igmpstat))) {
16232 		ip1dbg(("ip_snmp_get_mib2_igmp: failed to allocate %u bytes\n",
16233 		    (uint_t)sizeof (igmpstat)));
16234 	}
16235 	optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont);
16236 	ip3dbg(("ip_snmp_get_mib2_igmp: level %d, name %d, len %d\n",
16237 	    (int)optp->level, (int)optp->name, (int)optp->len));
16238 	qreply(q, mpctl);
16239 	return (mp2ctl);
16240 }
16241 
16242 /* Global IPv4 Multicast Routing statistics */
16243 static mblk_t *
16244 ip_snmp_get_mib2_multi(queue_t *q, mblk_t *mpctl)
16245 {
16246 	struct opthdr		*optp;
16247 	mblk_t			*mp2ctl;
16248 
16249 	/*
16250 	 * make a copy of the original message
16251 	 */
16252 	mp2ctl = copymsg(mpctl);
16253 
16254 	optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
16255 	optp->level = EXPER_DVMRP;
16256 	optp->name = 0;
16257 	if (!ip_mroute_stats(mpctl->b_cont)) {
16258 		ip0dbg(("ip_mroute_stats: failed\n"));
16259 	}
16260 	optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont);
16261 	ip3dbg(("ip_snmp_get_mib2_multi: level %d, name %d, len %d\n",
16262 	    (int)optp->level, (int)optp->name, (int)optp->len));
16263 	qreply(q, mpctl);
16264 	return (mp2ctl);
16265 }
16266 
16267 /* IPv4 address information */
16268 static mblk_t *
16269 ip_snmp_get_mib2_ip_addr(queue_t *q, mblk_t *mpctl)
16270 {
16271 	struct opthdr		*optp;
16272 	mblk_t			*mp2ctl;
16273 	mblk_t			*mp_tail = NULL;
16274 	ill_t			*ill;
16275 	ipif_t			*ipif;
16276 	uint_t			bitval;
16277 	mib2_ipAddrEntry_t	mae;
16278 	zoneid_t		zoneid;
16279 	ill_walk_context_t ctx;
16280 
16281 	/*
16282 	 * make a copy of the original message
16283 	 */
16284 	mp2ctl = copymsg(mpctl);
16285 
16286 	/* ipAddrEntryTable */
16287 
16288 	optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
16289 	optp->level = MIB2_IP;
16290 	optp->name = MIB2_IP_ADDR;
16291 	zoneid = Q_TO_CONN(q)->conn_zoneid;
16292 
16293 	rw_enter(&ill_g_lock, RW_READER);
16294 	ill = ILL_START_WALK_V4(&ctx);
16295 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
16296 		for (ipif = ill->ill_ipif; ipif != NULL;
16297 		    ipif = ipif->ipif_next) {
16298 			if (ipif->ipif_zoneid != zoneid)
16299 				continue;
16300 			mae.ipAdEntInfo.ae_ibcnt = ipif->ipif_ib_pkt_count;
16301 			mae.ipAdEntInfo.ae_obcnt = ipif->ipif_ob_pkt_count;
16302 			mae.ipAdEntInfo.ae_focnt = ipif->ipif_fo_pkt_count;
16303 
16304 			(void) ipif_get_name(ipif,
16305 			    mae.ipAdEntIfIndex.o_bytes,
16306 			    OCTET_LENGTH);
16307 			mae.ipAdEntIfIndex.o_length =
16308 			    mi_strlen(mae.ipAdEntIfIndex.o_bytes);
16309 			mae.ipAdEntAddr = ipif->ipif_lcl_addr;
16310 			mae.ipAdEntNetMask = ipif->ipif_net_mask;
16311 			mae.ipAdEntInfo.ae_subnet = ipif->ipif_subnet;
16312 			mae.ipAdEntInfo.ae_subnet_len =
16313 			    ip_mask_to_plen(ipif->ipif_net_mask);
16314 			mae.ipAdEntInfo.ae_src_addr = ipif->ipif_src_addr;
16315 			for (bitval = 1;
16316 			    bitval &&
16317 			    !(bitval & ipif->ipif_brd_addr);
16318 			    bitval <<= 1)
16319 				noop;
16320 			mae.ipAdEntBcastAddr = bitval;
16321 			mae.ipAdEntReasmMaxSize = 65535;
16322 			mae.ipAdEntInfo.ae_mtu = ipif->ipif_mtu;
16323 			mae.ipAdEntInfo.ae_metric  = ipif->ipif_metric;
16324 			mae.ipAdEntInfo.ae_broadcast_addr =
16325 			    ipif->ipif_brd_addr;
16326 			mae.ipAdEntInfo.ae_pp_dst_addr =
16327 			    ipif->ipif_pp_dst_addr;
16328 			    mae.ipAdEntInfo.ae_flags = ipif->ipif_flags |
16329 			    ill->ill_flags | ill->ill_phyint->phyint_flags;
16330 
16331 			if (!snmp_append_data2(mpctl->b_cont, &mp_tail,
16332 			    (char *)&mae, (int)sizeof (mib2_ipAddrEntry_t))) {
16333 				ip1dbg(("ip_snmp_get_mib2_ip_addr: failed to "
16334 				    "allocate %u bytes\n",
16335 				    (uint_t)sizeof (mib2_ipAddrEntry_t)));
16336 			}
16337 		}
16338 	}
16339 	rw_exit(&ill_g_lock);
16340 
16341 	optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont);
16342 	ip3dbg(("ip_snmp_get_mib2_ip_addr: level %d, name %d, len %d\n",
16343 	    (int)optp->level, (int)optp->name, (int)optp->len));
16344 	qreply(q, mpctl);
16345 	return (mp2ctl);
16346 }
16347 
16348 /* IPv6 address information */
16349 static mblk_t *
16350 ip_snmp_get_mib2_ip6_addr(queue_t *q, mblk_t *mpctl)
16351 {
16352 	struct opthdr		*optp;
16353 	mblk_t			*mp2ctl;
16354 	mblk_t			*mp_tail = NULL;
16355 	ill_t			*ill;
16356 	ipif_t			*ipif;
16357 	mib2_ipv6AddrEntry_t	mae6;
16358 	zoneid_t		zoneid;
16359 	ill_walk_context_t	ctx;
16360 
16361 	/*
16362 	 * make a copy of the original message
16363 	 */
16364 	mp2ctl = copymsg(mpctl);
16365 
16366 	/* ipv6AddrEntryTable */
16367 
16368 	optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
16369 	optp->level = MIB2_IP6;
16370 	optp->name = MIB2_IP6_ADDR;
16371 	zoneid = Q_TO_CONN(q)->conn_zoneid;
16372 
16373 	rw_enter(&ill_g_lock, RW_READER);
16374 	ill = ILL_START_WALK_V6(&ctx);
16375 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
16376 		for (ipif = ill->ill_ipif; ipif; ipif = ipif->ipif_next) {
16377 			if (ipif->ipif_zoneid != zoneid)
16378 				continue;
16379 			mae6.ipv6AddrInfo.ae_ibcnt = ipif->ipif_ib_pkt_count;
16380 			mae6.ipv6AddrInfo.ae_obcnt = ipif->ipif_ob_pkt_count;
16381 			mae6.ipv6AddrInfo.ae_focnt = ipif->ipif_fo_pkt_count;
16382 
16383 			(void) ipif_get_name(ipif,
16384 			    mae6.ipv6AddrIfIndex.o_bytes,
16385 			    OCTET_LENGTH);
16386 			mae6.ipv6AddrIfIndex.o_length =
16387 			    mi_strlen(mae6.ipv6AddrIfIndex.o_bytes);
16388 			mae6.ipv6AddrAddress = ipif->ipif_v6lcl_addr;
16389 			mae6.ipv6AddrPfxLength =
16390 			    ip_mask_to_plen_v6(&ipif->ipif_v6net_mask);
16391 			mae6.ipv6AddrInfo.ae_subnet = ipif->ipif_v6subnet;
16392 			mae6.ipv6AddrInfo.ae_subnet_len =
16393 			    mae6.ipv6AddrPfxLength;
16394 			mae6.ipv6AddrInfo.ae_src_addr = ipif->ipif_v6src_addr;
16395 
16396 			/* Type: stateless(1), stateful(2), unknown(3) */
16397 			if (ipif->ipif_flags & IPIF_ADDRCONF)
16398 				mae6.ipv6AddrType = 1;
16399 			else
16400 				mae6.ipv6AddrType = 2;
16401 			/* Anycast: true(1), false(2) */
16402 			if (ipif->ipif_flags & IPIF_ANYCAST)
16403 				mae6.ipv6AddrAnycastFlag = 1;
16404 			else
16405 				mae6.ipv6AddrAnycastFlag = 2;
16406 
16407 			/*
16408 			 * Address status: preferred(1), deprecated(2),
16409 			 * invalid(3), inaccessible(4), unknown(5)
16410 			 */
16411 			if (ipif->ipif_flags & IPIF_NOLOCAL)
16412 				mae6.ipv6AddrStatus = 3;
16413 			else if (ipif->ipif_flags & IPIF_DEPRECATED)
16414 				mae6.ipv6AddrStatus = 2;
16415 			else
16416 				mae6.ipv6AddrStatus = 1;
16417 			mae6.ipv6AddrInfo.ae_mtu = ipif->ipif_mtu;
16418 			mae6.ipv6AddrInfo.ae_metric  = ipif->ipif_metric;
16419 			mae6.ipv6AddrInfo.ae_pp_dst_addr =
16420 						ipif->ipif_v6pp_dst_addr;
16421 			mae6.ipv6AddrInfo.ae_flags = ipif->ipif_flags |
16422 			    ill->ill_flags | ill->ill_phyint->phyint_flags;
16423 			if (!snmp_append_data2(mpctl->b_cont, &mp_tail,
16424 				(char *)&mae6,
16425 				(int)sizeof (mib2_ipv6AddrEntry_t))) {
16426 				ip1dbg(("ip_snmp_get_mib2_ip6_addr: failed to "
16427 				    "allocate %u bytes\n",
16428 				    (uint_t)sizeof (mib2_ipv6AddrEntry_t)));
16429 			}
16430 		}
16431 	}
16432 	rw_exit(&ill_g_lock);
16433 
16434 	optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont);
16435 	ip3dbg(("ip_snmp_get_mib2_ip6_addr: level %d, name %d, len %d\n",
16436 	    (int)optp->level, (int)optp->name, (int)optp->len));
16437 	qreply(q, mpctl);
16438 	return (mp2ctl);
16439 }
16440 
16441 /* IPv4 multicast group membership. */
16442 static mblk_t *
16443 ip_snmp_get_mib2_ip_group_mem(queue_t *q, mblk_t *mpctl)
16444 {
16445 	struct opthdr		*optp;
16446 	mblk_t			*mp2ctl;
16447 	ill_t			*ill;
16448 	ipif_t			*ipif;
16449 	ilm_t			*ilm;
16450 	ip_member_t		ipm;
16451 	mblk_t			*mp_tail = NULL;
16452 	ill_walk_context_t	ctx;
16453 	zoneid_t		zoneid;
16454 
16455 	/*
16456 	 * make a copy of the original message
16457 	 */
16458 	mp2ctl = copymsg(mpctl);
16459 	zoneid = Q_TO_CONN(q)->conn_zoneid;
16460 
16461 	/* ipGroupMember table */
16462 	optp = (struct opthdr *)&mpctl->b_rptr[
16463 	    sizeof (struct T_optmgmt_ack)];
16464 	optp->level = MIB2_IP;
16465 	optp->name = EXPER_IP_GROUP_MEMBERSHIP;
16466 
16467 	rw_enter(&ill_g_lock, RW_READER);
16468 	ill = ILL_START_WALK_V4(&ctx);
16469 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
16470 		ILM_WALKER_HOLD(ill);
16471 		for (ipif = ill->ill_ipif; ipif != NULL;
16472 		    ipif = ipif->ipif_next) {
16473 			if (ipif->ipif_zoneid != zoneid)
16474 				continue;	/* not this zone */
16475 			(void) ipif_get_name(ipif,
16476 			    ipm.ipGroupMemberIfIndex.o_bytes,
16477 			    OCTET_LENGTH);
16478 			ipm.ipGroupMemberIfIndex.o_length =
16479 			    mi_strlen(ipm.ipGroupMemberIfIndex.o_bytes);
16480 			for (ilm = ill->ill_ilm; ilm; ilm = ilm->ilm_next) {
16481 				ASSERT(ilm->ilm_ipif != NULL);
16482 				ASSERT(ilm->ilm_ill == NULL);
16483 				if (ilm->ilm_ipif != ipif)
16484 					continue;
16485 				ipm.ipGroupMemberAddress = ilm->ilm_addr;
16486 				ipm.ipGroupMemberRefCnt = ilm->ilm_refcnt;
16487 				ipm.ipGroupMemberFilterMode = ilm->ilm_fmode;
16488 				if (!snmp_append_data2(mpctl->b_cont, &mp_tail,
16489 				    (char *)&ipm, (int)sizeof (ipm))) {
16490 					ip1dbg(("ip_snmp_get_mib2_ip_group: "
16491 					    "failed to allocate %u bytes\n",
16492 						(uint_t)sizeof (ipm)));
16493 				}
16494 			}
16495 		}
16496 		ILM_WALKER_RELE(ill);
16497 	}
16498 	rw_exit(&ill_g_lock);
16499 	optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont);
16500 	ip3dbg(("ip_snmp_get: level %d, name %d, len %d\n",
16501 	    (int)optp->level, (int)optp->name, (int)optp->len));
16502 	qreply(q, mpctl);
16503 	return (mp2ctl);
16504 }
16505 
16506 /* IPv6 multicast group membership. */
16507 static mblk_t *
16508 ip_snmp_get_mib2_ip6_group_mem(queue_t *q, mblk_t *mpctl)
16509 {
16510 	struct opthdr		*optp;
16511 	mblk_t			*mp2ctl;
16512 	ill_t			*ill;
16513 	ilm_t			*ilm;
16514 	ipv6_member_t		ipm6;
16515 	mblk_t			*mp_tail = NULL;
16516 	ill_walk_context_t	ctx;
16517 	zoneid_t		zoneid;
16518 
16519 	/*
16520 	 * make a copy of the original message
16521 	 */
16522 	mp2ctl = copymsg(mpctl);
16523 	zoneid = Q_TO_CONN(q)->conn_zoneid;
16524 
16525 	/* ip6GroupMember table */
16526 	optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
16527 	optp->level = MIB2_IP6;
16528 	optp->name = EXPER_IP6_GROUP_MEMBERSHIP;
16529 
16530 	rw_enter(&ill_g_lock, RW_READER);
16531 	ill = ILL_START_WALK_V6(&ctx);
16532 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
16533 		ILM_WALKER_HOLD(ill);
16534 		ipm6.ipv6GroupMemberIfIndex = ill->ill_phyint->phyint_ifindex;
16535 		for (ilm = ill->ill_ilm; ilm; ilm = ilm->ilm_next) {
16536 			ASSERT(ilm->ilm_ipif == NULL);
16537 			ASSERT(ilm->ilm_ill != NULL);
16538 			if (ilm->ilm_zoneid != zoneid)
16539 				continue;	/* not this zone */
16540 			ipm6.ipv6GroupMemberAddress = ilm->ilm_v6addr;
16541 			ipm6.ipv6GroupMemberRefCnt = ilm->ilm_refcnt;
16542 			ipm6.ipv6GroupMemberFilterMode = ilm->ilm_fmode;
16543 			if (!snmp_append_data2(mpctl->b_cont,
16544 			    &mp_tail,
16545 			    (char *)&ipm6, (int)sizeof (ipm6))) {
16546 				ip1dbg(("ip_snmp_get_mib2_ip6_group: "
16547 				    "failed to allocate %u bytes\n",
16548 				    (uint_t)sizeof (ipm6)));
16549 			}
16550 		}
16551 		ILM_WALKER_RELE(ill);
16552 	}
16553 	rw_exit(&ill_g_lock);
16554 
16555 	optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont);
16556 	ip3dbg(("ip_snmp_get: level %d, name %d, len %d\n",
16557 	    (int)optp->level, (int)optp->name, (int)optp->len));
16558 	qreply(q, mpctl);
16559 	return (mp2ctl);
16560 }
16561 
16562 /* IP multicast filtered sources */
16563 static mblk_t *
16564 ip_snmp_get_mib2_ip_group_src(queue_t *q, mblk_t *mpctl)
16565 {
16566 	struct opthdr		*optp;
16567 	mblk_t			*mp2ctl;
16568 	ill_t			*ill;
16569 	ipif_t			*ipif;
16570 	ilm_t			*ilm;
16571 	ip_grpsrc_t		ips;
16572 	mblk_t			*mp_tail = NULL;
16573 	ill_walk_context_t	ctx;
16574 	zoneid_t		zoneid;
16575 	int			i;
16576 	slist_t			*sl;
16577 
16578 	/*
16579 	 * make a copy of the original message
16580 	 */
16581 	mp2ctl = copymsg(mpctl);
16582 	zoneid = Q_TO_CONN(q)->conn_zoneid;
16583 
16584 	/* ipGroupSource table */
16585 	optp = (struct opthdr *)&mpctl->b_rptr[
16586 	    sizeof (struct T_optmgmt_ack)];
16587 	optp->level = MIB2_IP;
16588 	optp->name = EXPER_IP_GROUP_SOURCES;
16589 
16590 	rw_enter(&ill_g_lock, RW_READER);
16591 	ill = ILL_START_WALK_V4(&ctx);
16592 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
16593 		ILM_WALKER_HOLD(ill);
16594 		for (ipif = ill->ill_ipif; ipif != NULL;
16595 		    ipif = ipif->ipif_next) {
16596 			if (ipif->ipif_zoneid != zoneid)
16597 				continue;	/* not this zone */
16598 			(void) ipif_get_name(ipif,
16599 			    ips.ipGroupSourceIfIndex.o_bytes,
16600 			    OCTET_LENGTH);
16601 			ips.ipGroupSourceIfIndex.o_length =
16602 			    mi_strlen(ips.ipGroupSourceIfIndex.o_bytes);
16603 			for (ilm = ill->ill_ilm; ilm; ilm = ilm->ilm_next) {
16604 				ASSERT(ilm->ilm_ipif != NULL);
16605 				ASSERT(ilm->ilm_ill == NULL);
16606 				sl = ilm->ilm_filter;
16607 				if (ilm->ilm_ipif != ipif || SLIST_IS_EMPTY(sl))
16608 					continue;
16609 				ips.ipGroupSourceGroup = ilm->ilm_addr;
16610 				for (i = 0; i < sl->sl_numsrc; i++) {
16611 					if (!IN6_IS_ADDR_V4MAPPED(
16612 					    &sl->sl_addr[i]))
16613 						continue;
16614 					IN6_V4MAPPED_TO_IPADDR(&sl->sl_addr[i],
16615 					    ips.ipGroupSourceAddress);
16616 					if (snmp_append_data2(mpctl->b_cont,
16617 					    &mp_tail, (char *)&ips,
16618 					    (int)sizeof (ips)) == 0) {
16619 						ip1dbg(("ip_snmp_get_mib2_"
16620 						    "ip_group_src: failed to "
16621 						    "allocate %u bytes\n",
16622 						    (uint_t)sizeof (ips)));
16623 					}
16624 				}
16625 			}
16626 		}
16627 		ILM_WALKER_RELE(ill);
16628 	}
16629 	rw_exit(&ill_g_lock);
16630 	optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont);
16631 	ip3dbg(("ip_snmp_get: level %d, name %d, len %d\n",
16632 	    (int)optp->level, (int)optp->name, (int)optp->len));
16633 	qreply(q, mpctl);
16634 	return (mp2ctl);
16635 }
16636 
16637 /* IPv6 multicast filtered sources. */
16638 static mblk_t *
16639 ip_snmp_get_mib2_ip6_group_src(queue_t *q, mblk_t *mpctl)
16640 {
16641 	struct opthdr		*optp;
16642 	mblk_t			*mp2ctl;
16643 	ill_t			*ill;
16644 	ilm_t			*ilm;
16645 	ipv6_grpsrc_t		ips6;
16646 	mblk_t			*mp_tail = NULL;
16647 	ill_walk_context_t	ctx;
16648 	zoneid_t		zoneid;
16649 	int			i;
16650 	slist_t			*sl;
16651 
16652 	/*
16653 	 * make a copy of the original message
16654 	 */
16655 	mp2ctl = copymsg(mpctl);
16656 	zoneid = Q_TO_CONN(q)->conn_zoneid;
16657 
16658 	/* ip6GroupMember table */
16659 	optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
16660 	optp->level = MIB2_IP6;
16661 	optp->name = EXPER_IP6_GROUP_SOURCES;
16662 
16663 	rw_enter(&ill_g_lock, RW_READER);
16664 	ill = ILL_START_WALK_V6(&ctx);
16665 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
16666 		ILM_WALKER_HOLD(ill);
16667 		ips6.ipv6GroupSourceIfIndex = ill->ill_phyint->phyint_ifindex;
16668 		for (ilm = ill->ill_ilm; ilm; ilm = ilm->ilm_next) {
16669 			ASSERT(ilm->ilm_ipif == NULL);
16670 			ASSERT(ilm->ilm_ill != NULL);
16671 			sl = ilm->ilm_filter;
16672 			if (ilm->ilm_zoneid != zoneid || SLIST_IS_EMPTY(sl))
16673 				continue;
16674 			ips6.ipv6GroupSourceGroup = ilm->ilm_v6addr;
16675 			for (i = 0; i < sl->sl_numsrc; i++) {
16676 				ips6.ipv6GroupSourceAddress = sl->sl_addr[i];
16677 				if (!snmp_append_data2(mpctl->b_cont, &mp_tail,
16678 				    (char *)&ips6, (int)sizeof (ips6))) {
16679 					ip1dbg(("ip_snmp_get_mib2_ip6_"
16680 					    "group_src: failed to allocate "
16681 					    "%u bytes\n",
16682 					    (uint_t)sizeof (ips6)));
16683 				}
16684 			}
16685 		}
16686 		ILM_WALKER_RELE(ill);
16687 	}
16688 	rw_exit(&ill_g_lock);
16689 
16690 	optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont);
16691 	ip3dbg(("ip_snmp_get: level %d, name %d, len %d\n",
16692 	    (int)optp->level, (int)optp->name, (int)optp->len));
16693 	qreply(q, mpctl);
16694 	return (mp2ctl);
16695 }
16696 
16697 /* Multicast routing virtual interface table. */
16698 static mblk_t *
16699 ip_snmp_get_mib2_virt_multi(queue_t *q, mblk_t *mpctl)
16700 {
16701 	struct opthdr		*optp;
16702 	mblk_t			*mp2ctl;
16703 
16704 	/*
16705 	 * make a copy of the original message
16706 	 */
16707 	mp2ctl = copymsg(mpctl);
16708 
16709 	optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
16710 	optp->level = EXPER_DVMRP;
16711 	optp->name = EXPER_DVMRP_VIF;
16712 	if (!ip_mroute_vif(mpctl->b_cont)) {
16713 		ip0dbg(("ip_mroute_vif: failed\n"));
16714 	}
16715 	optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont);
16716 	ip3dbg(("ip_snmp_get_mib2_virt_multi: level %d, name %d, len %d\n",
16717 	    (int)optp->level, (int)optp->name, (int)optp->len));
16718 	qreply(q, mpctl);
16719 	return (mp2ctl);
16720 }
16721 
16722 /* Multicast routing table. */
16723 static mblk_t *
16724 ip_snmp_get_mib2_multi_rtable(queue_t *q, mblk_t *mpctl)
16725 {
16726 	struct opthdr		*optp;
16727 	mblk_t			*mp2ctl;
16728 
16729 	/*
16730 	 * make a copy of the original message
16731 	 */
16732 	mp2ctl = copymsg(mpctl);
16733 
16734 	optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
16735 	optp->level = EXPER_DVMRP;
16736 	optp->name = EXPER_DVMRP_MRT;
16737 	if (!ip_mroute_mrt(mpctl->b_cont)) {
16738 		ip0dbg(("ip_mroute_mrt: failed\n"));
16739 	}
16740 	optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont);
16741 	ip3dbg(("ip_snmp_get_mib2_multi_rtable: level %d, name %d, len %d\n",
16742 	    (int)optp->level, (int)optp->name, (int)optp->len));
16743 	qreply(q, mpctl);
16744 	return (mp2ctl);
16745 }
16746 
16747 /*
16748  * Return both ipRouteEntryTable, and ipNetToMediaEntryTable
16749  * in one IRE walk.
16750  */
16751 static mblk_t *
16752 ip_snmp_get_mib2_ip_route_media(queue_t *q, mblk_t *mpctl)
16753 {
16754 	struct opthdr		*optp;
16755 	mblk_t			*mp2ctl;	/* Returned */
16756 	mblk_t			*mp3ctl;	/* nettomedia */
16757 	/*
16758 	 * We need two listptrs, for ipRouteEntryTable and
16759 	 * ipNetToMediaEntryTable to pass to ip_snmp_get2_v4()
16760 	 */
16761 	listptr_t		re_ntme_v4[2];
16762 	zoneid_t		zoneid;
16763 
16764 	/*
16765 	 * make a copy of the original message
16766 	 */
16767 	mp2ctl = copymsg(mpctl);
16768 	mp3ctl = copymsg(mpctl);
16769 	if (mp3ctl == NULL) {
16770 		freemsg(mp2ctl);
16771 		freemsg(mpctl);
16772 		return (NULL);
16773 	}
16774 
16775 	re_ntme_v4[0].lp_head = mpctl->b_cont;	/* ipRouteEntryTable */
16776 	re_ntme_v4[1].lp_head = mp3ctl->b_cont;	/* ipNetToMediaEntryTable */
16777 	/*
16778 	 * We assign NULL to tail ptrs as snmp_append_data2() will assign
16779 	 * proper values when called.
16780 	 */
16781 	re_ntme_v4[0].lp_tail = NULL;
16782 	re_ntme_v4[1].lp_tail = NULL;
16783 
16784 	zoneid = Q_TO_CONN(q)->conn_zoneid;
16785 	ire_walk_v4(ip_snmp_get2_v4, (char *)re_ntme_v4, zoneid);
16786 	if (zoneid == GLOBAL_ZONEID) {
16787 		/*
16788 		 * Those IREs are used by Mobile-IP; since mipagent(1M) requires
16789 		 * the sys_net_config privilege, it can only run in the global
16790 		 * zone, so we don't display these IREs in the other zones.
16791 		 */
16792 		ire_walk_srcif_table_v4(ip_snmp_get2_v4, (char *)re_ntme_v4);
16793 		ire_walk_ill_mrtun(0, 0, ip_snmp_get2_v4, (char *)re_ntme_v4,
16794 		    NULL);
16795 	}
16796 
16797 	/* ipRouteEntryTable in mpctl */
16798 	optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
16799 	optp->level = MIB2_IP;
16800 	optp->name = MIB2_IP_ROUTE;
16801 	optp->len = (t_uscalar_t)msgdsize(re_ntme_v4[0].lp_head);
16802 	ip3dbg(("ip_snmp_get_mib2_ip_route_media: level %d, name %d, len %d\n",
16803 	    (int)optp->level, (int)optp->name, (int)optp->len));
16804 	qreply(q, mpctl);
16805 
16806 	/* ipNetToMediaEntryTable in mp3ctl */
16807 	optp = (struct opthdr *)&mp3ctl->b_rptr[sizeof (struct T_optmgmt_ack)];
16808 	optp->level = MIB2_IP;
16809 	optp->name = MIB2_IP_MEDIA;
16810 	optp->len = (t_uscalar_t)msgdsize(re_ntme_v4[1].lp_head);
16811 	ip3dbg(("ip_snmp_get_mib2_ip_route_media: level %d, name %d, len %d\n",
16812 	    (int)optp->level, (int)optp->name, (int)optp->len));
16813 	qreply(q, mp3ctl);
16814 	return (mp2ctl);
16815 }
16816 
16817 /*
16818  * Return both ipv6RouteEntryTable, and ipv6NetToMediaEntryTable
16819  * in one IRE walk.
16820  */
16821 static mblk_t *
16822 ip_snmp_get_mib2_ip6_route_media(queue_t *q, mblk_t *mpctl)
16823 {
16824 	struct opthdr		*optp;
16825 	mblk_t			*mp2ctl;	/* Returned */
16826 	mblk_t			*mp3ctl;	/* nettomedia */
16827 	listptr_t		re_ntme_v6;
16828 	zoneid_t		zoneid;
16829 
16830 	/*
16831 	 * make a copy of the original message
16832 	 */
16833 	mp2ctl = copymsg(mpctl);
16834 	mp3ctl = copymsg(mpctl);
16835 	if (mp3ctl == NULL) {
16836 		freemsg(mp2ctl);
16837 		freemsg(mpctl);
16838 		return (NULL);
16839 	}
16840 
16841 	/*
16842 	 * We assign NULL to tail ptrs as snmp_append_data2() will assign
16843 	 * proper values when called.  ipv6RouteEntryTable in is placed
16844 	 * in mpctl.
16845 	 */
16846 	re_ntme_v6.lp_head = mpctl->b_cont;	/* ip6RouteEntryTable */
16847 	re_ntme_v6.lp_tail = NULL;
16848 	zoneid = Q_TO_CONN(q)->conn_zoneid;
16849 	ire_walk_v6(ip_snmp_get2_v6_route, (char *)&re_ntme_v6, zoneid);
16850 
16851 	optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
16852 	optp->level = MIB2_IP6;
16853 	optp->name = MIB2_IP6_ROUTE;
16854 	optp->len = (t_uscalar_t)msgdsize(re_ntme_v6.lp_head);
16855 	ip3dbg(("ip_snmp_get_mib2_ip6_route_media: level %d, name %d, len %d\n",
16856 	    (int)optp->level, (int)optp->name, (int)optp->len));
16857 	qreply(q, mpctl);
16858 
16859 	/* ipv6NetToMediaEntryTable in mp3ctl */
16860 	re_ntme_v6.lp_head = mp3ctl->b_cont;	/* ip6NetToMediaEntryTable */
16861 	re_ntme_v6.lp_tail = NULL;
16862 	ndp_walk(NULL, ip_snmp_get2_v6_media, (uchar_t *)&re_ntme_v6);
16863 
16864 	optp = (struct opthdr *)&mp3ctl->b_rptr[sizeof (struct T_optmgmt_ack)];
16865 	optp->level = MIB2_IP6;
16866 	optp->name = MIB2_IP6_MEDIA;
16867 	optp->len = (t_uscalar_t)msgdsize(re_ntme_v6.lp_head);
16868 	ip3dbg(("ip_snmp_get_mib2_ip6_route_media: level %d, name %d, len %d\n",
16869 	    (int)optp->level, (int)optp->name, (int)optp->len));
16870 	qreply(q, mp3ctl);
16871 	return (mp2ctl);
16872 }
16873 
16874 /*
16875  * ICMPv6 mib: One per ill
16876  */
16877 static mblk_t *
16878 ip_snmp_get_mib2_ip6(queue_t *q, mblk_t *mpctl)
16879 {
16880 	struct opthdr		*optp;
16881 	mblk_t			*mp2ctl;
16882 	ill_t			*ill;
16883 	ill_walk_context_t	ctx;
16884 	mblk_t			*mp_tail = NULL;
16885 
16886 	/*
16887 	 * Make a copy of the original message
16888 	 */
16889 	mp2ctl = copymsg(mpctl);
16890 
16891 	/* fixed length IPv6 structure ... */
16892 
16893 	optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
16894 	optp->level = MIB2_IP6;
16895 	optp->name = 0;
16896 	/* Include "unknown interface" ip6_mib */
16897 	ip6_mib.ipv6IfIndex = 0;	/* Flag to netstat */
16898 	SET_MIB(ip6_mib.ipv6Forwarding, ipv6_forward ? 1 : 2);
16899 	SET_MIB(ip6_mib.ipv6DefaultHopLimit, ipv6_def_hops);
16900 	SET_MIB(ip6_mib.ipv6IfStatsEntrySize,
16901 	    sizeof (mib2_ipv6IfStatsEntry_t));
16902 	SET_MIB(ip6_mib.ipv6AddrEntrySize, sizeof (mib2_ipv6AddrEntry_t));
16903 	SET_MIB(ip6_mib.ipv6RouteEntrySize, sizeof (mib2_ipv6RouteEntry_t));
16904 	SET_MIB(ip6_mib.ipv6NetToMediaEntrySize,
16905 	    sizeof (mib2_ipv6NetToMediaEntry_t));
16906 	SET_MIB(ip6_mib.ipv6MemberEntrySize, sizeof (ipv6_member_t));
16907 	SET_MIB(ip6_mib.ipv6GroupSourceEntrySize, sizeof (ipv6_grpsrc_t));
16908 	if (!snmp_append_data2(mpctl->b_cont, &mp_tail, (char *)&ip6_mib,
16909 	    (int)sizeof (ip6_mib))) {
16910 		ip1dbg(("ip_snmp_get_mib2_ip6: failed to allocate %u bytes\n",
16911 		    (uint_t)sizeof (ip6_mib)));
16912 	}
16913 
16914 	rw_enter(&ill_g_lock, RW_READER);
16915 	ill = ILL_START_WALK_V6(&ctx);
16916 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
16917 		ill->ill_ip6_mib->ipv6IfIndex =
16918 		    ill->ill_phyint->phyint_ifindex;
16919 		SET_MIB(ill->ill_ip6_mib->ipv6Forwarding,
16920 		    ipv6_forward ? 1 : 2);
16921 		SET_MIB(ill->ill_ip6_mib->ipv6DefaultHopLimit,
16922 		    ill->ill_max_hops);
16923 		SET_MIB(ill->ill_ip6_mib->ipv6IfStatsEntrySize,
16924 		    sizeof (mib2_ipv6IfStatsEntry_t));
16925 		SET_MIB(ill->ill_ip6_mib->ipv6AddrEntrySize,
16926 		    sizeof (mib2_ipv6AddrEntry_t));
16927 		SET_MIB(ill->ill_ip6_mib->ipv6RouteEntrySize,
16928 		    sizeof (mib2_ipv6RouteEntry_t));
16929 		SET_MIB(ill->ill_ip6_mib->ipv6NetToMediaEntrySize,
16930 		    sizeof (mib2_ipv6NetToMediaEntry_t));
16931 		SET_MIB(ill->ill_ip6_mib->ipv6MemberEntrySize,
16932 		    sizeof (ipv6_member_t));
16933 
16934 		if (!snmp_append_data2(mpctl->b_cont, &mp_tail,
16935 		    (char *)ill->ill_ip6_mib,
16936 		    (int)sizeof (*ill->ill_ip6_mib))) {
16937 			ip1dbg(("ip_snmp_get_mib2_ip6: failed to allocate "
16938 				"%u bytes\n",
16939 				(uint_t)sizeof (*ill->ill_ip6_mib)));
16940 		}
16941 	}
16942 	rw_exit(&ill_g_lock);
16943 
16944 	optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont);
16945 	ip3dbg(("ip_snmp_get_mib2_ip6: level %d, name %d, len %d\n",
16946 	    (int)optp->level, (int)optp->name, (int)optp->len));
16947 	qreply(q, mpctl);
16948 	return (mp2ctl);
16949 }
16950 
16951 /*
16952  * ICMPv6 mib: One per ill
16953  */
16954 static mblk_t *
16955 ip_snmp_get_mib2_icmp6(queue_t *q, mblk_t *mpctl)
16956 {
16957 	struct opthdr		*optp;
16958 	mblk_t			*mp2ctl;
16959 	ill_t			*ill;
16960 	ill_walk_context_t	ctx;
16961 	mblk_t			*mp_tail = NULL;
16962 	/*
16963 	 * Make a copy of the original message
16964 	 */
16965 	mp2ctl = copymsg(mpctl);
16966 
16967 	/* fixed length ICMPv6 structure ... */
16968 
16969 	optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
16970 	optp->level = MIB2_ICMP6;
16971 	optp->name = 0;
16972 	/* Include "unknown interface" icmp6_mib */
16973 	icmp6_mib.ipv6IfIcmpIfIndex = 0;	/* Flag to netstat */
16974 	icmp6_mib.ipv6IfIcmpEntrySize = sizeof (mib2_ipv6IfIcmpEntry_t);
16975 	if (!snmp_append_data2(mpctl->b_cont, &mp_tail, (char *)&icmp6_mib,
16976 	    (int)sizeof (icmp6_mib))) {
16977 		ip1dbg(("ip_snmp_get_mib2_icmp6: failed to allocate %u bytes\n",
16978 		    (uint_t)sizeof (icmp6_mib)));
16979 	}
16980 
16981 	rw_enter(&ill_g_lock, RW_READER);
16982 	ill = ILL_START_WALK_V6(&ctx);
16983 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
16984 		ill->ill_icmp6_mib->ipv6IfIcmpIfIndex =
16985 		    ill->ill_phyint->phyint_ifindex;
16986 		ill->ill_icmp6_mib->ipv6IfIcmpEntrySize =
16987 		    sizeof (mib2_ipv6IfIcmpEntry_t);
16988 		if (!snmp_append_data2(mpctl->b_cont, &mp_tail,
16989 		    (char *)ill->ill_icmp6_mib,
16990 		    (int)sizeof (*ill->ill_icmp6_mib))) {
16991 			ip1dbg(("ip_snmp_get_mib2_icmp6: failed to allocate "
16992 			    "%u bytes\n",
16993 			    (uint_t)sizeof (*ill->ill_icmp6_mib)));
16994 		}
16995 	}
16996 	rw_exit(&ill_g_lock);
16997 
16998 	optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont);
16999 	ip3dbg(("ip_snmp_get_mib2_icmp6: level %d, name %d, len %d\n",
17000 	    (int)optp->level, (int)optp->name, (int)optp->len));
17001 	qreply(q, mpctl);
17002 	return (mp2ctl);
17003 }
17004 
17005 /*
17006  * ire_walk routine to create both ipRouteEntryTable and
17007  * ipNetToMediaEntryTable in one IRE walk
17008  */
17009 static void
17010 ip_snmp_get2_v4(ire_t *ire, listptr_t re_ntme[])
17011 {
17012 	ill_t				*ill;
17013 	ipif_t				*ipif;
17014 	mblk_t				*llmp;
17015 	dl_unitdata_req_t		*dlup;
17016 	mib2_ipRouteEntry_t		re;
17017 	mib2_ipNetToMediaEntry_t	ntme;
17018 	ipaddr_t			gw_addr;
17019 
17020 	ASSERT(ire->ire_ipversion == IPV4_VERSION);
17021 
17022 	/*
17023 	 * Return all IRE types for route table... let caller pick and choose
17024 	 */
17025 	re.ipRouteDest = ire->ire_addr;
17026 	ipif = ire->ire_ipif;
17027 	re.ipRouteIfIndex.o_length = 0;
17028 	if (ire->ire_type == IRE_CACHE) {
17029 		ill = (ill_t *)ire->ire_stq->q_ptr;
17030 		re.ipRouteIfIndex.o_length =
17031 		    ill->ill_name_length == 0 ? 0 :
17032 		    MIN(OCTET_LENGTH, ill->ill_name_length - 1);
17033 		bcopy(ill->ill_name, re.ipRouteIfIndex.o_bytes,
17034 		    re.ipRouteIfIndex.o_length);
17035 	} else if (ipif != NULL) {
17036 		(void) ipif_get_name(ipif, re.ipRouteIfIndex.o_bytes,
17037 		    OCTET_LENGTH);
17038 		re.ipRouteIfIndex.o_length =
17039 		    mi_strlen(re.ipRouteIfIndex.o_bytes);
17040 	}
17041 	re.ipRouteMetric1 = -1;
17042 	re.ipRouteMetric2 = -1;
17043 	re.ipRouteMetric3 = -1;
17044 	re.ipRouteMetric4 = -1;
17045 
17046 	gw_addr = ire->ire_gateway_addr;
17047 
17048 	if (ire->ire_type & (IRE_INTERFACE|IRE_LOOPBACK|IRE_BROADCAST))
17049 		re.ipRouteNextHop = ire->ire_src_addr;
17050 	else
17051 		re.ipRouteNextHop = gw_addr;
17052 	/* indirect(4), direct(3), or invalid(2) */
17053 	if (ire->ire_flags & (RTF_REJECT | RTF_BLACKHOLE))
17054 		re.ipRouteType = 2;
17055 	else
17056 		re.ipRouteType = (gw_addr != 0) ? 4 : 3;
17057 	re.ipRouteProto = -1;
17058 	re.ipRouteAge = gethrestime_sec() - ire->ire_create_time;
17059 	re.ipRouteMask = ire->ire_mask;
17060 	re.ipRouteMetric5 = -1;
17061 	re.ipRouteInfo.re_max_frag  = ire->ire_max_frag;
17062 	re.ipRouteInfo.re_frag_flag = ire->ire_frag_flag;
17063 	re.ipRouteInfo.re_rtt	    = ire->ire_uinfo.iulp_rtt;
17064 	llmp = ire->ire_dlureq_mp;
17065 	re.ipRouteInfo.re_ref	    = ire->ire_refcnt;
17066 	re.ipRouteInfo.re_src_addr  = ire->ire_src_addr;
17067 	re.ipRouteInfo.re_ire_type  = ire->ire_type;
17068 	re.ipRouteInfo.re_obpkt	    = ire->ire_ob_pkt_count;
17069 	re.ipRouteInfo.re_ibpkt	    = ire->ire_ib_pkt_count;
17070 	re.ipRouteInfo.re_flags	    = ire->ire_flags;
17071 	re.ipRouteInfo.re_in_ill.o_length = 0;
17072 	if (ire->ire_in_ill != NULL) {
17073 		re.ipRouteInfo.re_in_ill.o_length =
17074 		    ire->ire_in_ill->ill_name_length == 0 ? 0 :
17075 		    MIN(OCTET_LENGTH, ire->ire_in_ill->ill_name_length - 1);
17076 		bcopy(ire->ire_in_ill->ill_name,
17077 		    re.ipRouteInfo.re_in_ill.o_bytes,
17078 		    re.ipRouteInfo.re_in_ill.o_length);
17079 	}
17080 	re.ipRouteInfo.re_in_src_addr = ire->ire_in_src_addr;
17081 	if (!snmp_append_data2(re_ntme[0].lp_head, &(re_ntme[0].lp_tail),
17082 	    (char *)&re, (int)sizeof (re))) {
17083 		ip1dbg(("ip_snmp_get2_v4: failed to allocate %u bytes\n",
17084 		    (uint_t)sizeof (re)));
17085 	}
17086 
17087 	if (ire->ire_type != IRE_CACHE || gw_addr != 0)
17088 		return;
17089 	/*
17090 	 * only IRE_CACHE entries that are for a directly connected subnet
17091 	 * get appended to net -> phys addr table
17092 	 * (others in arp)
17093 	 */
17094 	ntme.ipNetToMediaIfIndex.o_length = 0;
17095 	ill = ire_to_ill(ire);
17096 	ASSERT(ill != NULL);
17097 	ntme.ipNetToMediaIfIndex.o_length =
17098 	    ill->ill_name_length == 0 ? 0 :
17099 	    MIN(OCTET_LENGTH, ill->ill_name_length - 1);
17100 	bcopy(ill->ill_name, ntme.ipNetToMediaIfIndex.o_bytes,
17101 		    ntme.ipNetToMediaIfIndex.o_length);
17102 
17103 	ntme.ipNetToMediaPhysAddress.o_length = 0;
17104 	if (llmp) {
17105 		uchar_t *addr;
17106 
17107 		dlup = (dl_unitdata_req_t *)llmp->b_rptr;
17108 		/* Remove sap from  address */
17109 		if (ill->ill_sap_length < 0)
17110 			addr = llmp->b_rptr + dlup->dl_dest_addr_offset;
17111 		else
17112 			addr = llmp->b_rptr + dlup->dl_dest_addr_offset +
17113 			    ill->ill_sap_length;
17114 
17115 		ntme.ipNetToMediaPhysAddress.o_length =
17116 		    MIN(OCTET_LENGTH, ill->ill_phys_addr_length);
17117 		bcopy(addr, ntme.ipNetToMediaPhysAddress.o_bytes,
17118 		    ntme.ipNetToMediaPhysAddress.o_length);
17119 	}
17120 	ntme.ipNetToMediaNetAddress = ire->ire_addr;
17121 	/* assume dynamic (may be changed in arp) */
17122 	ntme.ipNetToMediaType = 3;
17123 	ntme.ipNetToMediaInfo.ntm_mask.o_length = sizeof (uint32_t);
17124 	bcopy(&ire->ire_mask, ntme.ipNetToMediaInfo.ntm_mask.o_bytes,
17125 	    ntme.ipNetToMediaInfo.ntm_mask.o_length);
17126 	ntme.ipNetToMediaInfo.ntm_flags = ACE_F_RESOLVED;
17127 	if (!snmp_append_data2(re_ntme[1].lp_head, &(re_ntme[1].lp_tail),
17128 	    (char *)&ntme, (int)sizeof (ntme))) {
17129 		ip1dbg(("ip_snmp_get2_v4: failed to allocate %u bytes\n",
17130 		    (uint_t)sizeof (ntme)));
17131 	}
17132 }
17133 
17134 /*
17135  * ire_walk routine to create ipv6RouteEntryTable.
17136  */
17137 static void
17138 ip_snmp_get2_v6_route(ire_t *ire, listptr_t *re_ntme)
17139 {
17140 	ill_t				*ill;
17141 	ipif_t				*ipif;
17142 	mib2_ipv6RouteEntry_t		re;
17143 	in6_addr_t			gw_addr_v6;
17144 
17145 	ASSERT(ire->ire_ipversion == IPV6_VERSION);
17146 
17147 	/*
17148 	 * Return all IRE types for route table... let caller pick and choose
17149 	 */
17150 	re.ipv6RouteDest = ire->ire_addr_v6;
17151 	re.ipv6RoutePfxLength = ip_mask_to_plen_v6(&ire->ire_mask_v6);
17152 	re.ipv6RouteIndex = 0;	/* Unique when multiple with same dest/plen */
17153 	re.ipv6RouteIfIndex.o_length = 0;
17154 	ipif = ire->ire_ipif;
17155 	if (ire->ire_type == IRE_CACHE) {
17156 		ill = (ill_t *)ire->ire_stq->q_ptr;
17157 		re.ipv6RouteIfIndex.o_length =
17158 		    ill->ill_name_length == 0 ? 0 :
17159 		    MIN(OCTET_LENGTH, ill->ill_name_length - 1);
17160 		bcopy(ill->ill_name, re.ipv6RouteIfIndex.o_bytes,
17161 		    re.ipv6RouteIfIndex.o_length);
17162 	} else if (ipif != NULL) {
17163 		(void) ipif_get_name(ipif, re.ipv6RouteIfIndex.o_bytes,
17164 		    OCTET_LENGTH);
17165 		re.ipv6RouteIfIndex.o_length =
17166 		    mi_strlen(re.ipv6RouteIfIndex.o_bytes);
17167 	}
17168 
17169 	ASSERT(!(ire->ire_type & IRE_BROADCAST));
17170 
17171 	mutex_enter(&ire->ire_lock);
17172 	gw_addr_v6 = ire->ire_gateway_addr_v6;
17173 	mutex_exit(&ire->ire_lock);
17174 
17175 	if (ire->ire_type & (IRE_INTERFACE|IRE_LOOPBACK))
17176 		re.ipv6RouteNextHop = ire->ire_src_addr_v6;
17177 	else
17178 		re.ipv6RouteNextHop = gw_addr_v6;
17179 
17180 	/* remote(4), local(3), or discard(2) */
17181 	if (ire->ire_flags & (RTF_REJECT | RTF_BLACKHOLE))
17182 		re.ipv6RouteType = 2;
17183 	else if (IN6_IS_ADDR_UNSPECIFIED(&gw_addr_v6))
17184 		re.ipv6RouteType = 3;
17185 	else
17186 		re.ipv6RouteType = 4;
17187 
17188 	re.ipv6RouteProtocol		= -1;
17189 	re.ipv6RoutePolicy		= 0;
17190 	re.ipv6RouteAge		= gethrestime_sec() - ire->ire_create_time;
17191 	re.ipv6RouteNextHopRDI		= 0;
17192 	re.ipv6RouteWeight		= 0;
17193 	re.ipv6RouteMetric		= 0;
17194 	re.ipv6RouteInfo.re_max_frag	= ire->ire_max_frag;
17195 	re.ipv6RouteInfo.re_frag_flag	= ire->ire_frag_flag;
17196 	re.ipv6RouteInfo.re_rtt		= ire->ire_uinfo.iulp_rtt;
17197 	re.ipv6RouteInfo.re_src_addr	= ire->ire_src_addr_v6;
17198 	re.ipv6RouteInfo.re_ire_type	= ire->ire_type;
17199 	re.ipv6RouteInfo.re_obpkt	= ire->ire_ob_pkt_count;
17200 	re.ipv6RouteInfo.re_ibpkt	= ire->ire_ib_pkt_count;
17201 	re.ipv6RouteInfo.re_ref		= ire->ire_refcnt;
17202 	re.ipv6RouteInfo.re_flags	= ire->ire_flags;
17203 
17204 	if (!snmp_append_data2(re_ntme->lp_head, &(re_ntme->lp_tail),
17205 	    (char *)&re, (int)sizeof (re))) {
17206 		ip1dbg(("ip_snmp_get2_v6: failed to allocate %u bytes\n",
17207 		    (uint_t)sizeof (re)));
17208 	}
17209 }
17210 
17211 /*
17212  * ndp_walk routine to create ipv6NetToMediaEntryTable
17213  */
17214 static int
17215 ip_snmp_get2_v6_media(nce_t *nce, listptr_t *re_ntme)
17216 {
17217 	ill_t				*ill;
17218 	mib2_ipv6NetToMediaEntry_t	ntme;
17219 	dl_unitdata_req_t		*dl;
17220 
17221 	ill = nce->nce_ill;
17222 	ASSERT(ill->ill_isv6);
17223 
17224 	/*
17225 	 * Neighbor cache entry attached to IRE with on-link
17226 	 * destination.
17227 	 */
17228 	ntme.ipv6NetToMediaIfIndex = ill->ill_phyint->phyint_ifindex;
17229 	ntme.ipv6NetToMediaNetAddress = nce->nce_addr;
17230 	if ((ill->ill_flags & ILLF_XRESOLV) &&
17231 	    (nce->nce_res_mp != NULL)) {
17232 		dl = (dl_unitdata_req_t *)(nce->nce_res_mp->b_rptr);
17233 		ntme.ipv6NetToMediaPhysAddress.o_length =
17234 		    dl->dl_dest_addr_length;
17235 	} else {
17236 		ntme.ipv6NetToMediaPhysAddress.o_length =
17237 		    ill->ill_phys_addr_length;
17238 	}
17239 	if (nce->nce_res_mp != NULL) {
17240 		bcopy((char *)nce->nce_res_mp->b_rptr +
17241 		    NCE_LL_ADDR_OFFSET(ill),
17242 		    ntme.ipv6NetToMediaPhysAddress.o_bytes,
17243 		    ntme.ipv6NetToMediaPhysAddress.o_length);
17244 	} else {
17245 		bzero(ntme.ipv6NetToMediaPhysAddress.o_bytes,
17246 		    ill->ill_phys_addr_length);
17247 	}
17248 	/*
17249 	 * Note: Returns ND_* states. Should be:
17250 	 * reachable(1), stale(2), delay(3), probe(4),
17251 	 * invalid(5), unknown(6)
17252 	 */
17253 	ntme.ipv6NetToMediaState = nce->nce_state;
17254 	ntme.ipv6NetToMediaLastUpdated = 0;
17255 
17256 	/* other(1), dynamic(2), static(3), local(4) */
17257 	if (IN6_IS_ADDR_LOOPBACK(&nce->nce_addr)) {
17258 		ntme.ipv6NetToMediaType = 4;
17259 	} else if (IN6_IS_ADDR_MULTICAST(&nce->nce_addr)) {
17260 		ntme.ipv6NetToMediaType = 1;
17261 	} else {
17262 		ntme.ipv6NetToMediaType = 2;
17263 	}
17264 
17265 	if (!snmp_append_data2(re_ntme->lp_head,
17266 	    &(re_ntme->lp_tail), (char *)&ntme, (int)sizeof (ntme))) {
17267 		ip1dbg(("ip_snmp_get2_v6_media: failed to allocate %u bytes\n",
17268 		    (uint_t)sizeof (ntme)));
17269 	}
17270 	return (0);
17271 }
17272 
17273 /*
17274  * return (0) if invalid set request, 1 otherwise, including non-tcp requests
17275  */
17276 /* ARGSUSED */
17277 int
17278 ip_snmp_set(queue_t *q, int level, int name, uchar_t *ptr, int len)
17279 {
17280 	switch (level) {
17281 	case MIB2_IP:
17282 	case MIB2_ICMP:
17283 		switch (name) {
17284 		default:
17285 			break;
17286 		}
17287 		return (1);
17288 	default:
17289 		return (1);
17290 	}
17291 }
17292 
17293 /*
17294  * Called before the options are updated to check if this packet will
17295  * be source routed from here.
17296  * This routine assumes that the options are well formed i.e. that they
17297  * have already been checked.
17298  */
17299 static boolean_t
17300 ip_source_routed(ipha_t *ipha)
17301 {
17302 	ipoptp_t	opts;
17303 	uchar_t		*opt;
17304 	uint8_t		optval;
17305 	uint8_t		optlen;
17306 	ipaddr_t	dst;
17307 	ire_t		*ire;
17308 
17309 	if (IS_SIMPLE_IPH(ipha)) {
17310 		ip2dbg(("not source routed\n"));
17311 		return (B_FALSE);
17312 	}
17313 	dst = ipha->ipha_dst;
17314 	for (optval = ipoptp_first(&opts, ipha);
17315 	    optval != IPOPT_EOL;
17316 	    optval = ipoptp_next(&opts)) {
17317 		ASSERT((opts.ipoptp_flags & IPOPTP_ERROR) == 0);
17318 		opt = opts.ipoptp_cur;
17319 		optlen = opts.ipoptp_len;
17320 		ip2dbg(("ip_source_routed: opt %d, len %d\n",
17321 		    optval, optlen));
17322 		switch (optval) {
17323 			uint32_t off;
17324 		case IPOPT_SSRR:
17325 		case IPOPT_LSRR:
17326 			/*
17327 			 * If dst is one of our addresses and there are some
17328 			 * entries left in the source route return (true).
17329 			 */
17330 			ire = ire_ctable_lookup(dst, 0, IRE_LOCAL, NULL,
17331 			    ALL_ZONES, MATCH_IRE_TYPE);
17332 			if (ire == NULL) {
17333 				ip2dbg(("ip_source_routed: not next"
17334 				    " source route 0x%x\n",
17335 				    ntohl(dst)));
17336 				return (B_FALSE);
17337 			}
17338 			ire_refrele(ire);
17339 			off = opt[IPOPT_OFFSET];
17340 			off--;
17341 			if (optlen < IP_ADDR_LEN ||
17342 			    off > optlen - IP_ADDR_LEN) {
17343 				/* End of source route */
17344 				ip1dbg(("ip_source_routed: end of SR\n"));
17345 				return (B_FALSE);
17346 			}
17347 			return (B_TRUE);
17348 		}
17349 	}
17350 	ip2dbg(("not source routed\n"));
17351 	return (B_FALSE);
17352 }
17353 
17354 /*
17355  * Check if the packet contains any source route.
17356  */
17357 static boolean_t
17358 ip_source_route_included(ipha_t *ipha)
17359 {
17360 	ipoptp_t	opts;
17361 	uint8_t		optval;
17362 
17363 	if (IS_SIMPLE_IPH(ipha))
17364 		return (B_FALSE);
17365 	for (optval = ipoptp_first(&opts, ipha);
17366 	    optval != IPOPT_EOL;
17367 	    optval = ipoptp_next(&opts)) {
17368 		switch (optval) {
17369 		case IPOPT_SSRR:
17370 		case IPOPT_LSRR:
17371 			return (B_TRUE);
17372 		}
17373 	}
17374 	return (B_FALSE);
17375 }
17376 
17377 /*
17378  * Called when the IRE expiration timer fires.
17379  */
17380 /* ARGSUSED */
17381 void
17382 ip_trash_timer_expire(void *args)
17383 {
17384 	int	flush_flag = 0;
17385 
17386 	/*
17387 	 * ip_ire_expire_id is protected by ip_trash_timer_lock.
17388 	 * This lock makes sure that a new invocation of this function
17389 	 * that occurs due to an almost immediate timer firing will not
17390 	 * progress beyond this point until the current invocation is done
17391 	 */
17392 	mutex_enter(&ip_trash_timer_lock);
17393 	ip_ire_expire_id = 0;
17394 	mutex_exit(&ip_trash_timer_lock);
17395 
17396 	/* Periodic timer */
17397 	if (ip_ire_arp_time_elapsed >= ip_ire_arp_interval) {
17398 		/*
17399 		 * Remove all IRE_CACHE entries since they might
17400 		 * contain arp information.
17401 		 */
17402 		flush_flag |= FLUSH_ARP_TIME;
17403 		ip_ire_arp_time_elapsed = 0;
17404 		IP_STAT(ip_ire_arp_timer_expired);
17405 	}
17406 	if (ip_ire_rd_time_elapsed >= ip_ire_redir_interval) {
17407 		/* Remove all redirects */
17408 		flush_flag |= FLUSH_REDIRECT_TIME;
17409 		ip_ire_rd_time_elapsed = 0;
17410 		IP_STAT(ip_ire_redirect_timer_expired);
17411 	}
17412 	if (ip_ire_pmtu_time_elapsed >= ip_ire_pathmtu_interval) {
17413 		/* Increase path mtu */
17414 		flush_flag |= FLUSH_MTU_TIME;
17415 		ip_ire_pmtu_time_elapsed = 0;
17416 		IP_STAT(ip_ire_pmtu_timer_expired);
17417 	}
17418 	if (flush_flag != 0) {
17419 		/* Walk all IPv4 IRE's and update them */
17420 		ire_walk_v4(ire_expire, (char *)(uintptr_t)flush_flag,
17421 		    ALL_ZONES);
17422 	}
17423 	if (flush_flag & FLUSH_MTU_TIME) {
17424 		/*
17425 		 * Walk all IPv6 IRE's and update them
17426 		 * Note that ARP and redirect timers are not
17427 		 * needed since NUD handles stale entries.
17428 		 */
17429 		flush_flag = FLUSH_MTU_TIME;
17430 		ire_walk_v6(ire_expire, (char *)(uintptr_t)flush_flag,
17431 		    ALL_ZONES);
17432 	}
17433 
17434 	ip_ire_arp_time_elapsed += ip_timer_interval;
17435 	ip_ire_rd_time_elapsed += ip_timer_interval;
17436 	ip_ire_pmtu_time_elapsed += ip_timer_interval;
17437 
17438 	/*
17439 	 * Hold the lock to serialize timeout calls and prevent
17440 	 * stale values in ip_ire_expire_id. Otherwise it is possible
17441 	 * for the timer to fire and a new invocation of this function
17442 	 * to start before the return value of timeout has been stored
17443 	 * in ip_ire_expire_id by the current invocation.
17444 	 */
17445 	mutex_enter(&ip_trash_timer_lock);
17446 	ip_ire_expire_id = timeout(ip_trash_timer_expire, NULL,
17447 	    MSEC_TO_TICK(ip_timer_interval));
17448 	mutex_exit(&ip_trash_timer_lock);
17449 }
17450 
17451 /*
17452  * Called by the memory allocator subsystem directly, when the system
17453  * is running low on memory.
17454  */
17455 /* ARGSUSED */
17456 void
17457 ip_trash_ire_reclaim(void *args)
17458 {
17459 	ire_cache_count_t icc;
17460 	ire_cache_reclaim_t icr;
17461 	ncc_cache_count_t ncc;
17462 	nce_cache_reclaim_t ncr;
17463 	uint_t delete_cnt;
17464 	/*
17465 	 * Memory reclaim call back.
17466 	 * Count unused, offlink, pmtu, and onlink IRE_CACHE entries.
17467 	 * Then, with a target of freeing 1/Nth of IRE_CACHE
17468 	 * entries, determine what fraction to free for
17469 	 * each category of IRE_CACHE entries giving absolute priority
17470 	 * in the order of onlink, pmtu, offlink, unused (e.g. no pmtu
17471 	 * entry will be freed unless all offlink entries are freed).
17472 	 */
17473 	icc.icc_total = 0;
17474 	icc.icc_unused = 0;
17475 	icc.icc_offlink = 0;
17476 	icc.icc_pmtu = 0;
17477 	icc.icc_onlink = 0;
17478 	ire_walk(ire_cache_count, (char *)&icc);
17479 
17480 	/*
17481 	 * Free NCEs for IPv6 like the onlink ires.
17482 	 */
17483 	ncc.ncc_total = 0;
17484 	ncc.ncc_host = 0;
17485 	ndp_walk(NULL, (pfi_t)ndp_cache_count, (uchar_t *)&ncc);
17486 
17487 	ASSERT(icc.icc_total == icc.icc_unused + icc.icc_offlink +
17488 	    icc.icc_pmtu + icc.icc_onlink);
17489 	delete_cnt = icc.icc_total/ip_ire_reclaim_fraction;
17490 	IP_STAT(ip_trash_ire_reclaim_calls);
17491 	if (delete_cnt == 0)
17492 		return;
17493 	IP_STAT(ip_trash_ire_reclaim_success);
17494 	/* Always delete all unused offlink entries */
17495 	icr.icr_unused = 1;
17496 	if (delete_cnt <= icc.icc_unused) {
17497 		/*
17498 		 * Only need to free unused entries.  In other words,
17499 		 * there are enough unused entries to free to meet our
17500 		 * target number of freed ire cache entries.
17501 		 */
17502 		icr.icr_offlink = icr.icr_pmtu = icr.icr_onlink = 0;
17503 		ncr.ncr_host = 0;
17504 	} else if (delete_cnt <= icc.icc_unused + icc.icc_offlink) {
17505 		/*
17506 		 * Only need to free unused entries, plus a fraction of offlink
17507 		 * entries.  It follows from the first if statement that
17508 		 * icc_offlink is non-zero, and that delete_cnt != icc_unused.
17509 		 */
17510 		delete_cnt -= icc.icc_unused;
17511 		/* Round up # deleted by truncating fraction */
17512 		icr.icr_offlink = icc.icc_offlink / delete_cnt;
17513 		icr.icr_pmtu = icr.icr_onlink = 0;
17514 		ncr.ncr_host = 0;
17515 	} else if (delete_cnt <=
17516 	    icc.icc_unused + icc.icc_offlink + icc.icc_pmtu) {
17517 		/*
17518 		 * Free all unused and offlink entries, plus a fraction of
17519 		 * pmtu entries.  It follows from the previous if statement
17520 		 * that icc_pmtu is non-zero, and that
17521 		 * delete_cnt != icc_unused + icc_offlink.
17522 		 */
17523 		icr.icr_offlink = 1;
17524 		delete_cnt -= icc.icc_unused + icc.icc_offlink;
17525 		/* Round up # deleted by truncating fraction */
17526 		icr.icr_pmtu = icc.icc_pmtu / delete_cnt;
17527 		icr.icr_onlink = 0;
17528 		ncr.ncr_host = 0;
17529 	} else {
17530 		/*
17531 		 * Free all unused, offlink, and pmtu entries, plus a fraction
17532 		 * of onlink entries.  If we're here, then we know that
17533 		 * icc_onlink is non-zero, and that
17534 		 * delete_cnt != icc_unused + icc_offlink + icc_pmtu.
17535 		 */
17536 		icr.icr_offlink = icr.icr_pmtu = 1;
17537 		delete_cnt -= icc.icc_unused + icc.icc_offlink +
17538 		    icc.icc_pmtu;
17539 		/* Round up # deleted by truncating fraction */
17540 		icr.icr_onlink = icc.icc_onlink / delete_cnt;
17541 		/* Using the same delete fraction as for onlink IREs */
17542 		ncr.ncr_host = ncc.ncc_host / delete_cnt;
17543 	}
17544 #ifdef DEBUG
17545 	ip1dbg(("IP reclaim: target %d out of %d current %d/%d/%d/%d "
17546 	    "fractions %d/%d/%d/%d\n",
17547 	    icc.icc_total/ip_ire_reclaim_fraction, icc.icc_total,
17548 	    icc.icc_unused, icc.icc_offlink,
17549 	    icc.icc_pmtu, icc.icc_onlink,
17550 	    icr.icr_unused, icr.icr_offlink,
17551 	    icr.icr_pmtu, icr.icr_onlink));
17552 #endif
17553 	ire_walk(ire_cache_reclaim, (char *)&icr);
17554 	if (ncr.ncr_host != 0)
17555 		ndp_walk(NULL, (pfi_t)ndp_cache_reclaim,
17556 		    (uchar_t *)&ncr);
17557 #ifdef DEBUG
17558 	icc.icc_total = 0; icc.icc_unused = 0; icc.icc_offlink = 0;
17559 	icc.icc_pmtu = 0; icc.icc_onlink = 0;
17560 	ire_walk(ire_cache_count, (char *)&icc);
17561 	ip1dbg(("IP reclaim: result total %d %d/%d/%d/%d\n",
17562 	    icc.icc_total, icc.icc_unused, icc.icc_offlink,
17563 	    icc.icc_pmtu, icc.icc_onlink));
17564 #endif
17565 }
17566 
17567 /*
17568  * ip_unbind is called when a copy of an unbind request is received from the
17569  * upper level protocol.  We remove this conn from any fanout hash list it is
17570  * on, and zero out the bind information.  No reply is expected up above.
17571  */
17572 static void
17573 ip_unbind(queue_t *q, mblk_t *mp)
17574 {
17575 	conn_t	*connp = Q_TO_CONN(q);
17576 
17577 	ASSERT(!MUTEX_HELD(&connp->conn_lock));
17578 
17579 	ipcl_hash_remove(connp);
17580 
17581 	ASSERT(mp->b_cont == NULL);
17582 	/*
17583 	 * Convert mp into a T_OK_ACK
17584 	 */
17585 	mp = mi_tpi_ok_ack_alloc(mp);
17586 
17587 	/*
17588 	 * should not happen in practice... T_OK_ACK is smaller than the
17589 	 * original message.
17590 	 */
17591 	if (mp == NULL)
17592 		return;
17593 
17594 	/*
17595 	 * Don't bzero the ports if its TCP since TCP still needs the
17596 	 * lport to remove it from its own bind hash. TCP will do the
17597 	 * cleanup.
17598 	 */
17599 	if (!IPCL_IS_TCP(connp))
17600 		bzero(&connp->u_port, sizeof (connp->u_port));
17601 
17602 	qreply(q, mp);
17603 }
17604 
17605 /*
17606  * Write side put procedure.  Outbound data, IOCTLs, responses from
17607  * resolvers, etc, come down through here.
17608  */
17609 void
17610 ip_output(void *arg, mblk_t *mp, void *arg2, int caller)
17611 {
17612 	conn_t		*connp = NULL;
17613 	queue_t		*q = (queue_t *)arg2;
17614 	ipha_t		*ipha;
17615 #define	rptr	((uchar_t *)ipha)
17616 	ire_t		*ire = NULL;
17617 	ire_t		*sctp_ire = NULL;
17618 	uint32_t	v_hlen_tos_len;
17619 	ipaddr_t	dst;
17620 	mblk_t		*first_mp = NULL;
17621 	boolean_t	mctl_present;
17622 	ipsec_out_t	*io;
17623 	int		match_flags;
17624 	ill_t		*attach_ill = NULL;
17625 					/* Bind to IPIF_NOFAILOVER ill etc. */
17626 	ill_t		*xmit_ill = NULL;	/* IP_XMIT_IF etc. */
17627 	ipif_t		*dst_ipif;
17628 	boolean_t	multirt_need_resolve = B_FALSE;
17629 	mblk_t		*copy_mp = NULL;
17630 	int		err;
17631 	zoneid_t	zoneid;
17632 	boolean_t	need_decref = B_FALSE;
17633 	boolean_t	ignore_dontroute = B_FALSE;
17634 
17635 #ifdef	_BIG_ENDIAN
17636 #define	V_HLEN	(v_hlen_tos_len >> 24)
17637 #else
17638 #define	V_HLEN	(v_hlen_tos_len & 0xFF)
17639 #endif
17640 
17641 	TRACE_1(TR_FAC_IP, TR_IP_WPUT_START,
17642 	    "ip_wput_start: q %p", q);
17643 
17644 	/*
17645 	 * ip_wput fast path
17646 	 */
17647 
17648 	/* is packet from ARP ? */
17649 	if (q->q_next != NULL)
17650 		goto qnext;
17651 
17652 	connp = (conn_t *)arg;
17653 	zoneid = (connp != NULL ? connp->conn_zoneid : ALL_ZONES);
17654 
17655 	/* is queue flow controlled? */
17656 	if ((q->q_first != NULL || connp->conn_draining) &&
17657 	    (caller == IP_WPUT)) {
17658 		goto doputq;
17659 	}
17660 
17661 	/* Multidata transmit? */
17662 	if (DB_TYPE(mp) == M_MULTIDATA) {
17663 		/*
17664 		 * We should never get here, since all Multidata messages
17665 		 * originating from tcp should have been directed over to
17666 		 * tcp_multisend() in the first place.
17667 		 */
17668 		BUMP_MIB(&ip_mib, ipOutDiscards);
17669 		freemsg(mp);
17670 		return;
17671 	} else if (DB_TYPE(mp) != M_DATA)
17672 		goto notdata;
17673 	if (mp->b_flag & MSGHASREF) {
17674 		ASSERT(connp->conn_ulp == IPPROTO_SCTP);
17675 		mp->b_flag &= ~MSGHASREF;
17676 		SCTP_EXTRACT_IPINFO(mp, sctp_ire);
17677 		need_decref = B_TRUE;
17678 	}
17679 	ipha = (ipha_t *)mp->b_rptr;
17680 
17681 	/* is IP header non-aligned or mblk smaller than basic IP header */
17682 #ifndef SAFETY_BEFORE_SPEED
17683 	if (!OK_32PTR(rptr) ||
17684 	    (mp->b_wptr - rptr) < IP_SIMPLE_HDR_LENGTH)
17685 		goto hdrtoosmall;
17686 #endif
17687 
17688 	/*
17689 	 * If there is a policy, try to attach an ipsec_out in
17690 	 * the front. At the end, first_mp either points to a
17691 	 * M_DATA message or IPSEC_OUT message linked to a
17692 	 * M_DATA message. We have to do it now as we might
17693 	 * lose the "conn" if we go through ip_newroute.
17694 	 */
17695 	if (connp->conn_out_enforce_policy || (connp->conn_latch != NULL)) {
17696 		if (((mp = ipsec_attach_ipsec_out(mp, connp, NULL,
17697 		    ipha->ipha_protocol)) == NULL)) {
17698 			if (need_decref)
17699 				CONN_DEC_REF(connp);
17700 			return;
17701 		} else {
17702 			ASSERT(mp->b_datap->db_type == M_CTL);
17703 			first_mp = mp;
17704 			mp = mp->b_cont;
17705 			mctl_present = B_TRUE;
17706 		}
17707 	} else {
17708 		first_mp = mp;
17709 		mctl_present = B_FALSE;
17710 	}
17711 
17712 	v_hlen_tos_len = ((uint32_t *)ipha)[0];
17713 
17714 	/* is wrong version or IP options present */
17715 	if (V_HLEN != IP_SIMPLE_HDR_VERSION)
17716 		goto version_hdrlen_check;
17717 	dst = ipha->ipha_dst;
17718 
17719 	if (connp->conn_nofailover_ill != NULL) {
17720 		attach_ill = conn_get_held_ill(connp,
17721 		    &connp->conn_nofailover_ill, &err);
17722 		if (err == ILL_LOOKUP_FAILED) {
17723 			if (need_decref)
17724 				CONN_DEC_REF(connp);
17725 			freemsg(first_mp);
17726 			return;
17727 		}
17728 	}
17729 
17730 	/* is packet multicast? */
17731 	if (CLASSD(dst))
17732 		goto multicast;
17733 
17734 	if ((connp->conn_dontroute) || (connp->conn_xmit_if_ill != NULL)) {
17735 		/*
17736 		 * If the destination is a broadcast or a loopback
17737 		 * address, both SO_DONTROUTE and IP_XMIT_IF go
17738 		 * through the standard path. But in the case of local
17739 		 * destination only SO_DONTROUTE goes through the
17740 		 * standard path not IP_XMIT_IF.
17741 		 */
17742 		ire = ire_cache_lookup(dst, zoneid);
17743 		if ((ire == NULL) || ((ire->ire_type != IRE_BROADCAST) &&
17744 		    (ire->ire_type != IRE_LOOPBACK))) {
17745 
17746 			if ((connp->conn_dontroute) && (ire != NULL) &&
17747 				(ire->ire_type == IRE_LOCAL))
17748 				goto standard_path;
17749 
17750 			if (ire != NULL) {
17751 				ire_refrele(ire);
17752 				/* No more access to ire */
17753 				ire = NULL;
17754 			}
17755 			/*
17756 			 * bypass routing checks and go directly to
17757 			 * interface.
17758 			 */
17759 			if (connp->conn_dontroute)
17760 				goto dontroute;
17761 
17762 			/*
17763 			 * If IP_XMIT_IF socket option is set,
17764 			 * then we allow unicast and multicast
17765 			 * packets to go through the ill. It is
17766 			 * quite possible that the destination
17767 			 * is not in the ire cache table and we
17768 			 * do not want to go to ip_newroute()
17769 			 * instead we call ip_newroute_ipif.
17770 			 */
17771 			xmit_ill = conn_get_held_ill(connp,
17772 			    &connp->conn_xmit_if_ill, &err);
17773 			if (err == ILL_LOOKUP_FAILED) {
17774 				if (attach_ill != NULL)
17775 					ill_refrele(attach_ill);
17776 				if (need_decref)
17777 					CONN_DEC_REF(connp);
17778 				freemsg(first_mp);
17779 				return;
17780 			}
17781 			goto send_from_ill;
17782 		}
17783 standard_path:
17784 		/* Must be a broadcast, a loopback or a local ire */
17785 		if (ire != NULL) {
17786 			ire_refrele(ire);
17787 			/* No more access to ire */
17788 			ire = NULL;
17789 		}
17790 	}
17791 
17792 	if (attach_ill != NULL)
17793 		goto send_from_ill;
17794 
17795 	/*
17796 	 * We cache IRE_CACHEs to avoid lookups. We don't do
17797 	 * this for the tcp global queue and listen end point
17798 	 * as it does not really have a real destination to
17799 	 * talk to.  This is also true for SCTP.
17800 	 */
17801 	if (IP_FLOW_CONTROLLED_ULP(connp->conn_ulp) &&
17802 	    !connp->conn_fully_bound) {
17803 		ire = ire_cache_lookup(dst, zoneid);
17804 		if (ire == NULL)
17805 			goto noirefound;
17806 		TRACE_2(TR_FAC_IP, TR_IP_WPUT_END,
17807 		    "ip_wput_end: q %p (%S)", q, "end");
17808 
17809 		/*
17810 		 * Check if the ire has the RTF_MULTIRT flag, inherited
17811 		 * from an IRE_OFFSUBNET ire entry in ip_newroute().
17812 		 */
17813 		if (ire->ire_flags & RTF_MULTIRT) {
17814 
17815 			/*
17816 			 * Force the TTL of multirouted packets if required.
17817 			 * The TTL of such packets is bounded by the
17818 			 * ip_multirt_ttl ndd variable.
17819 			 */
17820 			if ((ip_multirt_ttl > 0) &&
17821 			    (ipha->ipha_ttl > ip_multirt_ttl)) {
17822 				ip2dbg(("ip_wput: forcing multirt TTL to %d "
17823 				    "(was %d), dst 0x%08x\n",
17824 				    ip_multirt_ttl, ipha->ipha_ttl,
17825 				    ntohl(ire->ire_addr)));
17826 				ipha->ipha_ttl = ip_multirt_ttl;
17827 			}
17828 			/*
17829 			 * We look at this point if there are pending
17830 			 * unresolved routes. ire_multirt_resolvable()
17831 			 * checks in O(n) that all IRE_OFFSUBNET ire
17832 			 * entries for the packet's destination and
17833 			 * flagged RTF_MULTIRT are currently resolved.
17834 			 * If some remain unresolved, we make a copy
17835 			 * of the current message. It will be used
17836 			 * to initiate additional route resolutions.
17837 			 */
17838 			multirt_need_resolve =
17839 			    ire_multirt_need_resolve(ire->ire_addr);
17840 			ip2dbg(("ip_wput[TCP]: ire %p, "
17841 			    "multirt_need_resolve %d, first_mp %p\n",
17842 			    (void *)ire, multirt_need_resolve,
17843 			    (void *)first_mp));
17844 			if (multirt_need_resolve) {
17845 				copy_mp = copymsg(first_mp);
17846 				if (copy_mp != NULL) {
17847 					MULTIRT_DEBUG_TAG(copy_mp);
17848 				}
17849 			}
17850 		}
17851 
17852 		ip_wput_ire(q, first_mp, ire, connp, caller);
17853 
17854 		/*
17855 		 * Try to resolve another multiroute if
17856 		 * ire_multirt_need_resolve() deemed it necessary.
17857 		 */
17858 		if (copy_mp != NULL) {
17859 			ip_newroute(q, copy_mp, dst, NULL, connp);
17860 		}
17861 		if (need_decref)
17862 			CONN_DEC_REF(connp);
17863 		return;
17864 	}
17865 
17866 	/*
17867 	 * Access to conn_ire_cache. (protected by conn_lock)
17868 	 *
17869 	 * IRE_MARK_CONDEMNED is marked in ire_delete. We don't grab
17870 	 * the ire bucket lock here to check for CONDEMNED as it is okay to
17871 	 * send a packet or two with the IRE_CACHE that is going away.
17872 	 * Access to the ire requires an ire refhold on the ire prior to
17873 	 * its use since an interface unplumb thread may delete the cached
17874 	 * ire and release the refhold at any time.
17875 	 *
17876 	 * Caching an ire in the conn_ire_cache
17877 	 *
17878 	 * o Caching an ire pointer in the conn requires a strict check for
17879 	 * IRE_MARK_CONDEMNED. An interface unplumb thread deletes all relevant
17880 	 * ires  before cleaning up the conns. So the caching of an ire pointer
17881 	 * in the conn is done after making sure under the bucket lock that the
17882 	 * ire has not yet been marked CONDEMNED. Otherwise we will end up
17883 	 * caching an ire after the unplumb thread has cleaned up the conn.
17884 	 * If the conn does not send a packet subsequently the unplumb thread
17885 	 * will be hanging waiting for the ire count to drop to zero.
17886 	 *
17887 	 * o We also need to atomically test for a null conn_ire_cache and
17888 	 * set the conn_ire_cache under the the protection of the conn_lock
17889 	 * to avoid races among concurrent threads trying to simultaneously
17890 	 * cache an ire in the conn_ire_cache.
17891 	 */
17892 	mutex_enter(&connp->conn_lock);
17893 	ire = sctp_ire != NULL ? sctp_ire : connp->conn_ire_cache;
17894 
17895 	if (ire != NULL && ire->ire_addr == dst &&
17896 	    !(ire->ire_marks & IRE_MARK_CONDEMNED)) {
17897 
17898 		IRE_REFHOLD(ire);
17899 		mutex_exit(&connp->conn_lock);
17900 
17901 	} else {
17902 		boolean_t cached = B_FALSE;
17903 		connp->conn_ire_cache = NULL;
17904 		mutex_exit(&connp->conn_lock);
17905 		/* Release the old ire */
17906 		if (ire != NULL && sctp_ire == NULL)
17907 			IRE_REFRELE_NOTR(ire);
17908 
17909 		ire = (ire_t *)ire_cache_lookup(dst, zoneid);
17910 		if (ire == NULL)
17911 			goto noirefound;
17912 		IRE_REFHOLD_NOTR(ire);
17913 
17914 		mutex_enter(&connp->conn_lock);
17915 		if (!(connp->conn_state_flags & CONN_CLOSING) &&
17916 		    connp->conn_ire_cache == NULL) {
17917 			rw_enter(&ire->ire_bucket->irb_lock, RW_READER);
17918 			if (!(ire->ire_marks & IRE_MARK_CONDEMNED)) {
17919 				connp->conn_ire_cache = ire;
17920 				cached = B_TRUE;
17921 			}
17922 			rw_exit(&ire->ire_bucket->irb_lock);
17923 		}
17924 		mutex_exit(&connp->conn_lock);
17925 
17926 		/*
17927 		 * We can continue to use the ire but since it was
17928 		 * not cached, we should drop the extra reference.
17929 		 */
17930 		if (!cached)
17931 			IRE_REFRELE_NOTR(ire);
17932 	}
17933 
17934 
17935 	TRACE_2(TR_FAC_IP, TR_IP_WPUT_END,
17936 	    "ip_wput_end: q %p (%S)", q, "end");
17937 
17938 	/*
17939 	 * Check if the ire has the RTF_MULTIRT flag, inherited
17940 	 * from an IRE_OFFSUBNET ire entry in ip_newroute().
17941 	 */
17942 	if (ire->ire_flags & RTF_MULTIRT) {
17943 
17944 		/*
17945 		 * Force the TTL of multirouted packets if required.
17946 		 * The TTL of such packets is bounded by the
17947 		 * ip_multirt_ttl ndd variable.
17948 		 */
17949 		if ((ip_multirt_ttl > 0) &&
17950 		    (ipha->ipha_ttl > ip_multirt_ttl)) {
17951 			ip2dbg(("ip_wput: forcing multirt TTL to %d "
17952 			    "(was %d), dst 0x%08x\n",
17953 			    ip_multirt_ttl, ipha->ipha_ttl,
17954 			    ntohl(ire->ire_addr)));
17955 			ipha->ipha_ttl = ip_multirt_ttl;
17956 		}
17957 
17958 		/*
17959 		 * At this point, we check to see if there are any pending
17960 		 * unresolved routes. ire_multirt_resolvable()
17961 		 * checks in O(n) that all IRE_OFFSUBNET ire
17962 		 * entries for the packet's destination and
17963 		 * flagged RTF_MULTIRT are currently resolved.
17964 		 * If some remain unresolved, we make a copy
17965 		 * of the current message. It will be used
17966 		 * to initiate additional route resolutions.
17967 		 */
17968 		multirt_need_resolve = ire_multirt_need_resolve(ire->ire_addr);
17969 		ip2dbg(("ip_wput[not TCP]: ire %p, "
17970 		    "multirt_need_resolve %d, first_mp %p\n",
17971 		    (void *)ire, multirt_need_resolve, (void *)first_mp));
17972 		if (multirt_need_resolve) {
17973 			copy_mp = copymsg(first_mp);
17974 			if (copy_mp != NULL) {
17975 				MULTIRT_DEBUG_TAG(copy_mp);
17976 			}
17977 		}
17978 	}
17979 
17980 	ip_wput_ire(q, first_mp, ire, connp, caller);
17981 
17982 	/*
17983 	 * Try to resolve another multiroute if
17984 	 * ire_multirt_resolvable() deemed it necessary
17985 	 */
17986 	if (copy_mp != NULL) {
17987 		ip_newroute(q, copy_mp, dst, NULL, connp);
17988 	}
17989 	if (need_decref)
17990 		CONN_DEC_REF(connp);
17991 	return;
17992 
17993 doputq:
17994 	ASSERT(!need_decref);
17995 	(void) putq(q, mp);
17996 	return;
17997 
17998 qnext:
17999 	/*
18000 	 * Upper Level Protocols pass down complete IP datagrams
18001 	 * as M_DATA messages.	Everything else is a sideshow.
18002 	 *
18003 	 * 1) We could be re-entering ip_wput because of ip_neworute
18004 	 *    in which case we could have a IPSEC_OUT message. We
18005 	 *    need to pass through ip_wput like other datagrams and
18006 	 *    hence cannot branch to ip_wput_nondata.
18007 	 *
18008 	 * 2) ARP, AH, ESP, and other clients who are on the module
18009 	 *    instance of IP stream, give us something to deal with.
18010 	 *    We will handle AH and ESP here and rest in ip_wput_nondata.
18011 	 *
18012 	 * 3) ICMP replies also could come here.
18013 	 */
18014 	if (DB_TYPE(mp) != M_DATA) {
18015 	    notdata:
18016 		if (DB_TYPE(mp) == M_CTL) {
18017 			/*
18018 			 * M_CTL messages are used by ARP, AH and ESP to
18019 			 * communicate with IP. We deal with IPSEC_IN and
18020 			 * IPSEC_OUT here. ip_wput_nondata handles other
18021 			 * cases.
18022 			 */
18023 			ipsec_info_t *ii = (ipsec_info_t *)mp->b_rptr;
18024 			if (mp->b_cont && (mp->b_cont->b_flag & MSGHASREF)) {
18025 				first_mp = mp->b_cont;
18026 				first_mp->b_flag &= ~MSGHASREF;
18027 				ASSERT(connp->conn_ulp == IPPROTO_SCTP);
18028 				SCTP_EXTRACT_IPINFO(first_mp, sctp_ire);
18029 				CONN_DEC_REF(connp);
18030 				connp = NULL;
18031 			}
18032 			if (ii->ipsec_info_type == IPSEC_IN) {
18033 				/*
18034 				 * Either this message goes back to
18035 				 * IPSEC for further processing or to
18036 				 * ULP after policy checks.
18037 				 */
18038 				ip_fanout_proto_again(mp, NULL, NULL, NULL);
18039 				return;
18040 			} else if (ii->ipsec_info_type == IPSEC_OUT) {
18041 				io = (ipsec_out_t *)ii;
18042 				if (io->ipsec_out_proc_begin) {
18043 					/*
18044 					 * IPSEC processing has already started.
18045 					 * Complete it.
18046 					 * IPQoS notes: We don't care what is
18047 					 * in ipsec_out_ill_index since this
18048 					 * won't be processed for IPQoS policies
18049 					 * in ipsec_out_process.
18050 					 */
18051 					ipsec_out_process(q, mp, NULL,
18052 					    io->ipsec_out_ill_index);
18053 					return;
18054 				} else {
18055 					connp = (q->q_next != NULL) ?
18056 					    NULL : Q_TO_CONN(q);
18057 					first_mp = mp;
18058 					mp = mp->b_cont;
18059 					mctl_present = B_TRUE;
18060 				}
18061 				zoneid = io->ipsec_out_zoneid;
18062 				ASSERT(zoneid != ALL_ZONES);
18063 			} else if (ii->ipsec_info_type == IPSEC_CTL) {
18064 				/*
18065 				 * It's an IPsec control message requesting
18066 				 * an SADB update to be sent to the IPsec
18067 				 * hardware acceleration capable ills.
18068 				 */
18069 				ipsec_ctl_t *ipsec_ctl =
18070 				    (ipsec_ctl_t *)mp->b_rptr;
18071 				ipsa_t *sa = (ipsa_t *)ipsec_ctl->ipsec_ctl_sa;
18072 				uint_t satype = ipsec_ctl->ipsec_ctl_sa_type;
18073 				mblk_t *cmp = mp->b_cont;
18074 
18075 				ASSERT(MBLKL(mp) >= sizeof (ipsec_ctl_t));
18076 				ASSERT(cmp != NULL);
18077 
18078 				freeb(mp);
18079 				ill_ipsec_capab_send_all(satype, cmp, sa);
18080 				return;
18081 			} else {
18082 				/*
18083 				 * This must be ARP.
18084 				 */
18085 				ip_wput_nondata(NULL, q, mp, NULL);
18086 				TRACE_2(TR_FAC_IP, TR_IP_WPUT_END,
18087 				    "ip_wput_end: q %p (%S)", q, "nondata");
18088 				return;
18089 			}
18090 		} else {
18091 			/*
18092 			 * This must be non-(ARP/AH/ESP) messages.
18093 			 */
18094 			ASSERT(!need_decref);
18095 			ip_wput_nondata(NULL, q, mp, NULL);
18096 			TRACE_2(TR_FAC_IP, TR_IP_WPUT_END,
18097 			    "ip_wput_end: q %p (%S)", q, "nondata");
18098 			return;
18099 		}
18100 	} else {
18101 		first_mp = mp;
18102 		mctl_present = B_FALSE;
18103 	}
18104 
18105 	ASSERT(first_mp != NULL);
18106 	/*
18107 	 * ICMP echo replies attach an ipsec_out and set ipsec_out_attach_if
18108 	 * to make sure that this packet goes out on the same interface it
18109 	 * came in. We handle that here.
18110 	 */
18111 	if (mctl_present) {
18112 		uint_t ifindex;
18113 
18114 		io = (ipsec_out_t *)first_mp->b_rptr;
18115 		if (io->ipsec_out_attach_if ||
18116 		    io->ipsec_out_xmit_if) {
18117 			ill_t	*ill;
18118 
18119 			ASSERT(io->ipsec_out_ill_index != 0);
18120 			ifindex = io->ipsec_out_ill_index;
18121 			ill = ill_lookup_on_ifindex(ifindex, B_FALSE,
18122 			    NULL, NULL, NULL, NULL);
18123 			/*
18124 			 * ipsec_out_xmit_if bit is used to tell
18125 			 * ip_wput to use the ill to send outgoing data
18126 			 * as we have no conn when data comes from ICMP
18127 			 * error msg routines. Currently this feature is
18128 			 * only used by ip_mrtun_forward routine.
18129 			 */
18130 			if (io->ipsec_out_xmit_if) {
18131 				xmit_ill = ill;
18132 				if (xmit_ill == NULL) {
18133 					ip1dbg(("ip_wput: bad ifindex for"
18134 					    "xmit_ill %d\n", ifindex));
18135 					freemsg(first_mp);
18136 					BUMP_MIB(&ip_mib, ipOutDiscards);
18137 					ASSERT(!need_decref);
18138 					return;
18139 				}
18140 				/* Free up the ipsec_out_t mblk */
18141 				ASSERT(first_mp->b_cont == mp);
18142 				first_mp->b_cont = NULL;
18143 				freeb(first_mp);
18144 				/* Just send the IP header+ICMP+data */
18145 				first_mp = mp;
18146 				ipha = (ipha_t *)mp->b_rptr;
18147 				dst = ipha->ipha_dst;
18148 				goto send_from_ill;
18149 
18150 			} else {
18151 				attach_ill = ill;
18152 			}
18153 
18154 			if (attach_ill == NULL) {
18155 				ASSERT(xmit_ill == NULL);
18156 				ip1dbg(("ip_wput : bad ifindex for "
18157 				    "(BIND TO IPIF_NOFAILOVER) %d\n", ifindex));
18158 				freemsg(first_mp);
18159 				BUMP_MIB(&ip_mib, ipOutDiscards);
18160 				ASSERT(!need_decref);
18161 				return;
18162 			}
18163 		}
18164 	}
18165 
18166 	ASSERT(xmit_ill == NULL);
18167 
18168 	/* We have a complete IP datagram heading outbound. */
18169 	ipha = (ipha_t *)mp->b_rptr;
18170 
18171 #ifndef SPEED_BEFORE_SAFETY
18172 	/*
18173 	 * Make sure we have a full-word aligned message and that at least
18174 	 * a simple IP header is accessible in the first message.  If not,
18175 	 * try a pullup.
18176 	 */
18177 	if (!OK_32PTR(rptr) ||
18178 	    (mp->b_wptr - rptr) < IP_SIMPLE_HDR_LENGTH) {
18179 	    hdrtoosmall:
18180 		if (!pullupmsg(mp, IP_SIMPLE_HDR_LENGTH)) {
18181 			BUMP_MIB(&ip_mib, ipOutDiscards);
18182 			TRACE_2(TR_FAC_IP, TR_IP_WPUT_END,
18183 			    "ip_wput_end: q %p (%S)", q, "pullupfailed");
18184 			if (first_mp == NULL)
18185 				first_mp = mp;
18186 			goto drop_pkt;
18187 		}
18188 		ipha = (ipha_t *)mp->b_rptr;
18189 		if (first_mp == NULL) {
18190 			ASSERT(attach_ill == NULL && xmit_ill == NULL);
18191 			/*
18192 			 * If we got here because of "goto hdrtoosmall"
18193 			 * We need to attach a IPSEC_OUT.
18194 			 */
18195 			if (connp->conn_out_enforce_policy) {
18196 				if (((mp = ipsec_attach_ipsec_out(mp, connp,
18197 				    NULL, ipha->ipha_protocol)) == NULL)) {
18198 					if (need_decref)
18199 						CONN_DEC_REF(connp);
18200 					return;
18201 				} else {
18202 					ASSERT(mp->b_datap->db_type == M_CTL);
18203 					first_mp = mp;
18204 					mp = mp->b_cont;
18205 					mctl_present = B_TRUE;
18206 				}
18207 			} else {
18208 				first_mp = mp;
18209 				mctl_present = B_FALSE;
18210 			}
18211 		}
18212 	}
18213 #endif
18214 
18215 	/* Most of the code below is written for speed, not readability */
18216 	v_hlen_tos_len = ((uint32_t *)ipha)[0];
18217 
18218 	/*
18219 	 * If ip_newroute() fails, we're going to need a full
18220 	 * header for the icmp wraparound.
18221 	 */
18222 	if (V_HLEN != IP_SIMPLE_HDR_VERSION) {
18223 		uint_t	v_hlen;
18224 	    version_hdrlen_check:
18225 		ASSERT(first_mp != NULL);
18226 		v_hlen = V_HLEN;
18227 		/*
18228 		 * siphon off IPv6 packets coming down from transport
18229 		 * layer modules here.
18230 		 * Note: high-order bit carries NUD reachability confirmation
18231 		 */
18232 		if (((v_hlen >> 4) & 0x7) == IPV6_VERSION) {
18233 			/*
18234 			 * XXX implement a IPv4 and IPv6 packet counter per
18235 			 * conn and switch when ratio exceeds e.g. 10:1
18236 			 */
18237 #ifdef notyet
18238 			if (q->q_next == NULL) /* Avoid ill queue */
18239 				ip_setqinfo(RD(q), B_TRUE, B_TRUE);
18240 #endif
18241 			BUMP_MIB(&ip_mib, ipOutIPv6);
18242 			ASSERT(xmit_ill == NULL);
18243 			if (attach_ill != NULL)
18244 				ill_refrele(attach_ill);
18245 			if (need_decref)
18246 				mp->b_flag |= MSGHASREF;
18247 			(void) ip_output_v6(connp, first_mp, q, caller);
18248 			return;
18249 		}
18250 
18251 		if ((v_hlen >> 4) != IP_VERSION) {
18252 			BUMP_MIB(&ip_mib, ipOutDiscards);
18253 			TRACE_2(TR_FAC_IP, TR_IP_WPUT_END,
18254 			    "ip_wput_end: q %p (%S)", q, "badvers");
18255 			goto drop_pkt;
18256 		}
18257 		/*
18258 		 * Is the header length at least 20 bytes?
18259 		 *
18260 		 * Are there enough bytes accessible in the header?  If
18261 		 * not, try a pullup.
18262 		 */
18263 		v_hlen &= 0xF;
18264 		v_hlen <<= 2;
18265 		if (v_hlen < IP_SIMPLE_HDR_LENGTH) {
18266 			BUMP_MIB(&ip_mib, ipOutDiscards);
18267 			TRACE_2(TR_FAC_IP, TR_IP_WPUT_END,
18268 			    "ip_wput_end: q %p (%S)", q, "badlen");
18269 			goto drop_pkt;
18270 		}
18271 		if (v_hlen > (mp->b_wptr - rptr)) {
18272 			if (!pullupmsg(mp, v_hlen)) {
18273 				BUMP_MIB(&ip_mib, ipOutDiscards);
18274 				TRACE_2(TR_FAC_IP, TR_IP_WPUT_END,
18275 				    "ip_wput_end: q %p (%S)", q, "badpullup2");
18276 				goto drop_pkt;
18277 			}
18278 			ipha = (ipha_t *)mp->b_rptr;
18279 		}
18280 		/*
18281 		 * Move first entry from any source route into ipha_dst and
18282 		 * verify the options
18283 		 */
18284 		if (ip_wput_options(q, first_mp, ipha, mctl_present, zoneid)) {
18285 			ASSERT(xmit_ill == NULL);
18286 			if (attach_ill != NULL)
18287 				ill_refrele(attach_ill);
18288 			TRACE_2(TR_FAC_IP, TR_IP_WPUT_END,
18289 			    "ip_wput_end: q %p (%S)", q, "badopts");
18290 			if (need_decref)
18291 				CONN_DEC_REF(connp);
18292 			return;
18293 		}
18294 	}
18295 	dst = ipha->ipha_dst;
18296 
18297 	/*
18298 	 * Try to get an IRE_CACHE for the destination address.	 If we can't,
18299 	 * we have to run the packet through ip_newroute which will take
18300 	 * the appropriate action to arrange for an IRE_CACHE, such as querying
18301 	 * a resolver, or assigning a default gateway, etc.
18302 	 */
18303 	if (CLASSD(dst)) {
18304 		ipif_t	*ipif;
18305 		uint32_t setsrc = 0;
18306 
18307 	    multicast:
18308 		ASSERT(first_mp != NULL);
18309 		ASSERT(xmit_ill == NULL);
18310 		ip2dbg(("ip_wput: CLASSD\n"));
18311 		if (connp == NULL) {
18312 			/*
18313 			 * Use the first good ipif on the ill.
18314 			 * XXX Should this ever happen? (Appears
18315 			 * to show up with just ppp and no ethernet due
18316 			 * to in.rdisc.)
18317 			 * However, ire_send should be able to
18318 			 * call ip_wput_ire directly.
18319 			 *
18320 			 * XXX Also, this can happen for ICMP and other packets
18321 			 * with multicast source addresses.  Perhaps we should
18322 			 * fix things so that we drop the packet in question,
18323 			 * but for now, just run with it.
18324 			 */
18325 			ill_t *ill = (ill_t *)q->q_ptr;
18326 
18327 			/*
18328 			 * Don't honor attach_if for this case. If ill
18329 			 * is part of the group, ipif could belong to
18330 			 * any ill and we cannot maintain attach_ill
18331 			 * and ipif_ill same anymore and the assert
18332 			 * below would fail.
18333 			 */
18334 			if (mctl_present) {
18335 				io->ipsec_out_ill_index = 0;
18336 				io->ipsec_out_attach_if = B_FALSE;
18337 				ASSERT(attach_ill != NULL);
18338 				ill_refrele(attach_ill);
18339 				attach_ill = NULL;
18340 			}
18341 
18342 			ASSERT(attach_ill == NULL);
18343 			ipif = ipif_select_source(ill, dst, GLOBAL_ZONEID);
18344 			if (ipif == NULL) {
18345 				if (need_decref)
18346 					CONN_DEC_REF(connp);
18347 				freemsg(first_mp);
18348 				return;
18349 			}
18350 			ip1dbg(("ip_wput: CLASSD no CONN: dst 0x%x on %s\n",
18351 			    ntohl(dst), ill->ill_name));
18352 		} else {
18353 			/*
18354 			 * If both IP_MULTICAST_IF and IP_XMIT_IF are set,
18355 			 * IP_XMIT_IF is honoured.
18356 			 * Block comment above this function explains the
18357 			 * locking mechanism used here
18358 			 */
18359 			xmit_ill = conn_get_held_ill(connp,
18360 			    &connp->conn_xmit_if_ill, &err);
18361 			if (err == ILL_LOOKUP_FAILED) {
18362 				ip1dbg(("ip_wput: No ill for IP_XMIT_IF\n"));
18363 				goto drop_pkt;
18364 			}
18365 			if (xmit_ill == NULL) {
18366 				ipif = conn_get_held_ipif(connp,
18367 				    &connp->conn_multicast_ipif, &err);
18368 				if (err == IPIF_LOOKUP_FAILED) {
18369 					ip1dbg(("ip_wput: No ipif for "
18370 					    "multicast\n"));
18371 					BUMP_MIB(&ip_mib, ipOutNoRoutes);
18372 					goto drop_pkt;
18373 				}
18374 			}
18375 			if (xmit_ill != NULL) {
18376 				ipif = ipif_get_next_ipif(NULL, xmit_ill);
18377 				if (ipif == NULL) {
18378 					ip1dbg(("ip_wput: No ipif for "
18379 					    "IP_XMIT_IF\n"));
18380 					BUMP_MIB(&ip_mib, ipOutNoRoutes);
18381 					goto drop_pkt;
18382 				}
18383 			} else if (ipif == NULL || ipif->ipif_isv6) {
18384 				/*
18385 				 * We must do this ipif determination here
18386 				 * else we could pass through ip_newroute
18387 				 * and come back here without the conn context.
18388 				 *
18389 				 * Note: we do late binding i.e. we bind to
18390 				 * the interface when the first packet is sent.
18391 				 * For performance reasons we do not rebind on
18392 				 * each packet but keep the binding until the
18393 				 * next IP_MULTICAST_IF option.
18394 				 *
18395 				 * conn_multicast_{ipif,ill} are shared between
18396 				 * IPv4 and IPv6 and AF_INET6 sockets can
18397 				 * send both IPv4 and IPv6 packets. Hence
18398 				 * we have to check that "isv6" matches above.
18399 				 */
18400 				if (ipif != NULL)
18401 					ipif_refrele(ipif);
18402 				ipif = ipif_lookup_group(dst, zoneid);
18403 				if (ipif == NULL) {
18404 					ip1dbg(("ip_wput: No ipif for "
18405 					    "multicast\n"));
18406 					BUMP_MIB(&ip_mib, ipOutNoRoutes);
18407 					goto drop_pkt;
18408 				}
18409 				err = conn_set_held_ipif(connp,
18410 				    &connp->conn_multicast_ipif, ipif);
18411 				if (err == IPIF_LOOKUP_FAILED) {
18412 					ipif_refrele(ipif);
18413 					ip1dbg(("ip_wput: No ipif for "
18414 					    "multicast\n"));
18415 					BUMP_MIB(&ip_mib, ipOutNoRoutes);
18416 					goto drop_pkt;
18417 				}
18418 			}
18419 		}
18420 		ASSERT(!ipif->ipif_isv6);
18421 		/*
18422 		 * As we may lose the conn by the time we reach ip_wput_ire,
18423 		 * we copy conn_multicast_loop and conn_dontroute on to an
18424 		 * ipsec_out. In case if this datagram goes out secure,
18425 		 * we need the ill_index also. Copy that also into the
18426 		 * ipsec_out.
18427 		 */
18428 		if (mctl_present) {
18429 			io = (ipsec_out_t *)first_mp->b_rptr;
18430 			ASSERT(first_mp->b_datap->db_type == M_CTL);
18431 			ASSERT(io->ipsec_out_type == IPSEC_OUT);
18432 		} else {
18433 			ASSERT(mp == first_mp);
18434 			if ((first_mp = allocb(sizeof (ipsec_info_t),
18435 			    BPRI_HI)) == NULL) {
18436 				ipif_refrele(ipif);
18437 				first_mp = mp;
18438 				goto drop_pkt;
18439 			}
18440 			first_mp->b_datap->db_type = M_CTL;
18441 			first_mp->b_wptr += sizeof (ipsec_info_t);
18442 			/* ipsec_out_secure is B_FALSE now */
18443 			bzero(first_mp->b_rptr, sizeof (ipsec_info_t));
18444 			io = (ipsec_out_t *)first_mp->b_rptr;
18445 			io->ipsec_out_type = IPSEC_OUT;
18446 			io->ipsec_out_len = sizeof (ipsec_out_t);
18447 			io->ipsec_out_use_global_policy = B_TRUE;
18448 			first_mp->b_cont = mp;
18449 			mctl_present = B_TRUE;
18450 		}
18451 		if (attach_ill != NULL) {
18452 			ASSERT(attach_ill == ipif->ipif_ill);
18453 			match_flags = MATCH_IRE_ILL;
18454 
18455 			/*
18456 			 * Check if we need an ire that will not be
18457 			 * looked up by anybody else i.e. HIDDEN.
18458 			 */
18459 			if (ill_is_probeonly(attach_ill)) {
18460 				match_flags |= MATCH_IRE_MARK_HIDDEN;
18461 			}
18462 			io->ipsec_out_ill_index =
18463 			    attach_ill->ill_phyint->phyint_ifindex;
18464 			io->ipsec_out_attach_if = B_TRUE;
18465 		} else {
18466 			match_flags = MATCH_IRE_ILL_GROUP;
18467 			io->ipsec_out_ill_index =
18468 			    ipif->ipif_ill->ill_phyint->phyint_ifindex;
18469 		}
18470 		if (connp != NULL) {
18471 			io->ipsec_out_multicast_loop =
18472 			    connp->conn_multicast_loop;
18473 			io->ipsec_out_dontroute = connp->conn_dontroute;
18474 			io->ipsec_out_zoneid = connp->conn_zoneid;
18475 		}
18476 		/*
18477 		 * If the application uses IP_MULTICAST_IF with
18478 		 * different logical addresses of the same ILL, we
18479 		 * need to make sure that the soruce address of
18480 		 * the packet matches the logical IP address used
18481 		 * in the option. We do it by initializing ipha_src
18482 		 * here. This should keep IPSEC also happy as
18483 		 * when we return from IPSEC processing, we don't
18484 		 * have to worry about getting the right address on
18485 		 * the packet. Thus it is sufficient to look for
18486 		 * IRE_CACHE using MATCH_IRE_ILL rathen than
18487 		 * MATCH_IRE_IPIF.
18488 		 *
18489 		 * NOTE : We need to do it for non-secure case also as
18490 		 * this might go out secure if there is a global policy
18491 		 * match in ip_wput_ire. For bind to IPIF_NOFAILOVER
18492 		 * address, the source should be initialized already and
18493 		 * hence we won't be initializing here.
18494 		 *
18495 		 * As we do not have the ire yet, it is possible that
18496 		 * we set the source address here and then later discover
18497 		 * that the ire implies the source address to be assigned
18498 		 * through the RTF_SETSRC flag.
18499 		 * In that case, the setsrc variable will remind us
18500 		 * that overwritting the source address by the one
18501 		 * of the RTF_SETSRC-flagged ire is allowed.
18502 		 */
18503 		if (ipha->ipha_src == INADDR_ANY &&
18504 		    (connp == NULL || !connp->conn_unspec_src)) {
18505 			ipha->ipha_src = ipif->ipif_src_addr;
18506 			setsrc = RTF_SETSRC;
18507 		}
18508 		/*
18509 		 * Find an IRE which matches the destination and the outgoing
18510 		 * queue (i.e. the outgoing interface.)
18511 		 * For loopback use a unicast IP address for
18512 		 * the ire lookup.
18513 		 */
18514 		if (ipif->ipif_ill->ill_phyint->phyint_flags &
18515 		    PHYI_LOOPBACK) {
18516 			dst = ipif->ipif_lcl_addr;
18517 		}
18518 		/*
18519 		 * If IP_XMIT_IF is set, we branch out to ip_newroute_ipif.
18520 		 * We don't need to lookup ire in ctable as the packet
18521 		 * needs to be sent to the destination through the specified
18522 		 * ill irrespective of ires in the cache table.
18523 		 */
18524 		ire = NULL;
18525 		if (xmit_ill == NULL) {
18526 			ire = ire_ctable_lookup(dst, 0, 0, ipif,
18527 			    zoneid, match_flags);
18528 		}
18529 
18530 		/*
18531 		 * refrele attach_ill as its not needed anymore.
18532 		 */
18533 		if (attach_ill != NULL) {
18534 			ill_refrele(attach_ill);
18535 			attach_ill = NULL;
18536 		}
18537 
18538 		if (ire == NULL) {
18539 			/*
18540 			 * Multicast loopback and multicast forwarding is
18541 			 * done in ip_wput_ire.
18542 			 *
18543 			 * Mark this packet to make it be delivered to
18544 			 * ip_wput_ire after the new ire has been
18545 			 * created.
18546 			 *
18547 			 * The call to ip_newroute_ipif takes into account
18548 			 * the setsrc reminder. In any case, we take care
18549 			 * of the RTF_MULTIRT flag.
18550 			 */
18551 			mp->b_prev = mp->b_next = NULL;
18552 			if (xmit_ill == NULL ||
18553 			    xmit_ill->ill_ipif_up_count > 0) {
18554 				ip_newroute_ipif(q, first_mp, ipif, dst, connp,
18555 				    setsrc | RTF_MULTIRT);
18556 				TRACE_2(TR_FAC_IP, TR_IP_WPUT_END,
18557 				    "ip_wput_end: q %p (%S)", q, "noire");
18558 			} else {
18559 				freemsg(first_mp);
18560 			}
18561 			ipif_refrele(ipif);
18562 			if (xmit_ill != NULL)
18563 				ill_refrele(xmit_ill);
18564 			if (need_decref)
18565 				CONN_DEC_REF(connp);
18566 			return;
18567 		}
18568 
18569 		ipif_refrele(ipif);
18570 		ipif = NULL;
18571 		ASSERT(xmit_ill == NULL);
18572 
18573 		/*
18574 		 * Honor the RTF_SETSRC flag for multicast packets,
18575 		 * if allowed by the setsrc reminder.
18576 		 */
18577 		if ((ire->ire_flags & RTF_SETSRC) && setsrc) {
18578 			ipha->ipha_src = ire->ire_src_addr;
18579 		}
18580 
18581 		/*
18582 		 * Unconditionally force the TTL to 1 for
18583 		 * multirouted multicast packets:
18584 		 * multirouted multicast should not cross
18585 		 * multicast routers.
18586 		 */
18587 		if (ire->ire_flags & RTF_MULTIRT) {
18588 			if (ipha->ipha_ttl > 1) {
18589 				ip2dbg(("ip_wput: forcing multicast "
18590 				    "multirt TTL to 1 (was %d), dst 0x%08x\n",
18591 				    ipha->ipha_ttl, ntohl(ire->ire_addr)));
18592 				ipha->ipha_ttl = 1;
18593 			}
18594 		}
18595 	} else {
18596 		ire = ire_cache_lookup(dst, zoneid);
18597 		if ((ire != NULL) && (ire->ire_type &
18598 		    (IRE_BROADCAST | IRE_LOCAL | IRE_LOOPBACK))) {
18599 			ignore_dontroute = B_TRUE;
18600 		}
18601 		if (ire != NULL) {
18602 			ire_refrele(ire);
18603 			ire = NULL;
18604 		}
18605 		/*
18606 		 * Guard against coming in from arp in which case conn is NULL.
18607 		 * Also guard against non M_DATA with dontroute set but
18608 		 * destined to local, loopback or broadcast addresses.
18609 		 */
18610 		if (connp != NULL && connp->conn_dontroute &&
18611 		    !ignore_dontroute) {
18612 dontroute:
18613 			/*
18614 			 * Set TTL to 1 if SO_DONTROUTE is set to prevent
18615 			 * routing protocols from seeing false direct
18616 			 * connectivity.
18617 			 */
18618 			ipha->ipha_ttl = 1;
18619 			/*
18620 			 * If IP_XMIT_IF is also set (conn_xmit_if_ill != NULL)
18621 			 * along with SO_DONTROUTE, higher precedence is
18622 			 * given to IP_XMIT_IF and the IP_XMIT_IF ipif is used.
18623 			 */
18624 			if (connp->conn_xmit_if_ill == NULL) {
18625 				/* If suitable ipif not found, drop packet */
18626 				dst_ipif = ipif_lookup_onlink_addr(dst, zoneid);
18627 				if (dst_ipif == NULL) {
18628 					ip1dbg(("ip_wput: no route for "
18629 					    "dst using SO_DONTROUTE\n"));
18630 					BUMP_MIB(&ip_mib, ipOutNoRoutes);
18631 					mp->b_prev = mp->b_next = NULL;
18632 					if (first_mp == NULL)
18633 						first_mp = mp;
18634 					goto drop_pkt;
18635 				} else {
18636 					/*
18637 					 * If suitable ipif has been found, set
18638 					 * xmit_ill to the corresponding
18639 					 * ipif_ill because we'll be following
18640 					 * the IP_XMIT_IF logic.
18641 					 */
18642 					ASSERT(xmit_ill == NULL);
18643 					xmit_ill = dst_ipif->ipif_ill;
18644 					mutex_enter(&xmit_ill->ill_lock);
18645 					if (!ILL_CAN_LOOKUP(xmit_ill)) {
18646 						mutex_exit(&xmit_ill->ill_lock);
18647 						xmit_ill = NULL;
18648 						ipif_refrele(dst_ipif);
18649 						ip1dbg(("ip_wput: no route for"
18650 						    " dst using"
18651 						    " SO_DONTROUTE\n"));
18652 						BUMP_MIB(&ip_mib,
18653 						    ipOutNoRoutes);
18654 						mp->b_prev = mp->b_next = NULL;
18655 						if (first_mp == NULL)
18656 							first_mp = mp;
18657 						goto drop_pkt;
18658 					}
18659 					ill_refhold_locked(xmit_ill);
18660 					mutex_exit(&xmit_ill->ill_lock);
18661 					ipif_refrele(dst_ipif);
18662 				}
18663 			}
18664 
18665 		}
18666 		/*
18667 		 * If we are bound to IPIF_NOFAILOVER address, look for
18668 		 * an IRE_CACHE matching the ill.
18669 		 */
18670 send_from_ill:
18671 		if (attach_ill != NULL) {
18672 			ipif_t	*attach_ipif;
18673 
18674 			match_flags = MATCH_IRE_ILL;
18675 
18676 			/*
18677 			 * Check if we need an ire that will not be
18678 			 * looked up by anybody else i.e. HIDDEN.
18679 			 */
18680 			if (ill_is_probeonly(attach_ill)) {
18681 				match_flags |= MATCH_IRE_MARK_HIDDEN;
18682 			}
18683 
18684 			attach_ipif = ipif_get_next_ipif(NULL, attach_ill);
18685 			if (attach_ipif == NULL) {
18686 				ip1dbg(("ip_wput: No ipif for attach_ill\n"));
18687 				goto drop_pkt;
18688 			}
18689 			ire = ire_ctable_lookup(dst, 0, 0, attach_ipif,
18690 			    zoneid, match_flags);
18691 			ipif_refrele(attach_ipif);
18692 		} else if (xmit_ill != NULL || (connp != NULL &&
18693 			    connp->conn_xmit_if_ill != NULL)) {
18694 			/*
18695 			 * Mark this packet as originated locally
18696 			 */
18697 			mp->b_prev = mp->b_next = NULL;
18698 			/*
18699 			 * xmit_ill could be NULL if SO_DONTROUTE
18700 			 * is also set.
18701 			 */
18702 			if (xmit_ill == NULL) {
18703 				xmit_ill = conn_get_held_ill(connp,
18704 				    &connp->conn_xmit_if_ill, &err);
18705 				if (err == ILL_LOOKUP_FAILED) {
18706 					if (need_decref)
18707 						CONN_DEC_REF(connp);
18708 					freemsg(first_mp);
18709 					return;
18710 				}
18711 				if (xmit_ill == NULL) {
18712 					if (connp->conn_dontroute)
18713 						goto dontroute;
18714 					goto send_from_ill;
18715 				}
18716 			}
18717 			/*
18718 			 * could be SO_DONTROUTE case also.
18719 			 * check at least one interface is UP as
18720 			 * spcified by this ILL, and then call
18721 			 * ip_newroute_ipif()
18722 			 */
18723 			if (xmit_ill->ill_ipif_up_count > 0) {
18724 				ipif_t *ipif;
18725 
18726 				ipif = ipif_get_next_ipif(NULL, xmit_ill);
18727 				if (ipif != NULL) {
18728 					ip_newroute_ipif(q, first_mp, ipif,
18729 					    dst, connp, 0);
18730 					ipif_refrele(ipif);
18731 					ip1dbg(("ip_wput: ip_unicast_if\n"));
18732 				}
18733 			} else {
18734 				freemsg(first_mp);
18735 			}
18736 			ill_refrele(xmit_ill);
18737 			TRACE_2(TR_FAC_IP, TR_IP_WPUT_END,
18738 			    "ip_wput_end: q %p (%S)", q, "unicast_if");
18739 			if (need_decref)
18740 				CONN_DEC_REF(connp);
18741 			return;
18742 		} else {
18743 			ire = ire_cache_lookup(dst, zoneid);
18744 		}
18745 		if (!ire) {
18746 			/*
18747 			 * Make sure we don't load spread if this
18748 			 * is IPIF_NOFAILOVER case.
18749 			 */
18750 			if (attach_ill != NULL) {
18751 				if (mctl_present) {
18752 					io = (ipsec_out_t *)first_mp->b_rptr;
18753 					ASSERT(first_mp->b_datap->db_type ==
18754 					    M_CTL);
18755 					ASSERT(io->ipsec_out_type == IPSEC_OUT);
18756 				} else {
18757 					ASSERT(mp == first_mp);
18758 					first_mp = allocb(
18759 					    sizeof (ipsec_info_t), BPRI_HI);
18760 					if (first_mp == NULL) {
18761 						first_mp = mp;
18762 						goto drop_pkt;
18763 					}
18764 					first_mp->b_datap->db_type = M_CTL;
18765 					first_mp->b_wptr +=
18766 					    sizeof (ipsec_info_t);
18767 					/* ipsec_out_secure is B_FALSE now */
18768 					bzero(first_mp->b_rptr,
18769 					    sizeof (ipsec_info_t));
18770 					io = (ipsec_out_t *)first_mp->b_rptr;
18771 					io->ipsec_out_type = IPSEC_OUT;
18772 					io->ipsec_out_len =
18773 					    sizeof (ipsec_out_t);
18774 					io->ipsec_out_use_global_policy =
18775 					    B_TRUE;
18776 					first_mp->b_cont = mp;
18777 					mctl_present = B_TRUE;
18778 				}
18779 				io->ipsec_out_ill_index = attach_ill->
18780 				    ill_phyint->phyint_ifindex;
18781 				io->ipsec_out_attach_if = B_TRUE;
18782 			}
18783 noirefound:
18784 			/*
18785 			 * Mark this packet as having originated on
18786 			 * this machine.  This will be noted in
18787 			 * ire_add_then_send, which needs to know
18788 			 * whether to run it back through ip_wput or
18789 			 * ip_rput following successful resolution.
18790 			 */
18791 			mp->b_prev = NULL;
18792 			mp->b_next = NULL;
18793 			ip_newroute(q, first_mp, dst, NULL, connp);
18794 			TRACE_2(TR_FAC_IP, TR_IP_WPUT_END,
18795 			    "ip_wput_end: q %p (%S)", q, "newroute");
18796 			if (attach_ill != NULL)
18797 				ill_refrele(attach_ill);
18798 			if (xmit_ill != NULL)
18799 				ill_refrele(xmit_ill);
18800 			if (need_decref)
18801 				CONN_DEC_REF(connp);
18802 			return;
18803 		}
18804 	}
18805 
18806 	/* We now know where we are going with it. */
18807 
18808 	TRACE_2(TR_FAC_IP, TR_IP_WPUT_END,
18809 	    "ip_wput_end: q %p (%S)", q, "end");
18810 
18811 	/*
18812 	 * Check if the ire has the RTF_MULTIRT flag, inherited
18813 	 * from an IRE_OFFSUBNET ire entry in ip_newroute.
18814 	 */
18815 	if (ire->ire_flags & RTF_MULTIRT) {
18816 		/*
18817 		 * Force the TTL of multirouted packets if required.
18818 		 * The TTL of such packets is bounded by the
18819 		 * ip_multirt_ttl ndd variable.
18820 		 */
18821 		if ((ip_multirt_ttl > 0) &&
18822 		    (ipha->ipha_ttl > ip_multirt_ttl)) {
18823 			ip2dbg(("ip_wput: forcing multirt TTL to %d "
18824 			    "(was %d), dst 0x%08x\n",
18825 			    ip_multirt_ttl, ipha->ipha_ttl,
18826 			    ntohl(ire->ire_addr)));
18827 			ipha->ipha_ttl = ip_multirt_ttl;
18828 		}
18829 		/*
18830 		 * At this point, we check to see if there are any pending
18831 		 * unresolved routes. ire_multirt_resolvable()
18832 		 * checks in O(n) that all IRE_OFFSUBNET ire
18833 		 * entries for the packet's destination and
18834 		 * flagged RTF_MULTIRT are currently resolved.
18835 		 * If some remain unresolved, we make a copy
18836 		 * of the current message. It will be used
18837 		 * to initiate additional route resolutions.
18838 		 */
18839 		multirt_need_resolve = ire_multirt_need_resolve(ire->ire_addr);
18840 		ip2dbg(("ip_wput[noirefound]: ire %p, "
18841 		    "multirt_need_resolve %d, first_mp %p\n",
18842 		    (void *)ire, multirt_need_resolve, (void *)first_mp));
18843 		if (multirt_need_resolve) {
18844 			copy_mp = copymsg(first_mp);
18845 			if (copy_mp != NULL) {
18846 				MULTIRT_DEBUG_TAG(copy_mp);
18847 			}
18848 		}
18849 	}
18850 
18851 	ip_wput_ire(q, first_mp, ire, connp, caller);
18852 	/*
18853 	 * Try to resolve another multiroute if
18854 	 * ire_multirt_resolvable() deemed it necessary.
18855 	 * At this point, we need to distinguish
18856 	 * multicasts from other packets. For multicasts,
18857 	 * we call ip_newroute_ipif() and request that both
18858 	 * multirouting and setsrc flags are checked.
18859 	 */
18860 	if (copy_mp != NULL) {
18861 		if (CLASSD(dst)) {
18862 			ipif_t *ipif = ipif_lookup_group(dst, zoneid);
18863 			if (ipif) {
18864 				ip_newroute_ipif(q, copy_mp, ipif, dst, connp,
18865 				    RTF_SETSRC | RTF_MULTIRT);
18866 				ipif_refrele(ipif);
18867 			} else {
18868 				MULTIRT_DEBUG_UNTAG(copy_mp);
18869 				freemsg(copy_mp);
18870 				copy_mp = NULL;
18871 			}
18872 		} else {
18873 			ip_newroute(q, copy_mp, dst, NULL, connp);
18874 		}
18875 	}
18876 	if (attach_ill != NULL)
18877 		ill_refrele(attach_ill);
18878 	if (xmit_ill != NULL)
18879 		ill_refrele(xmit_ill);
18880 	if (need_decref)
18881 		CONN_DEC_REF(connp);
18882 	return;
18883 
18884 drop_pkt:
18885 	ip1dbg(("ip_wput: dropped packet\n"));
18886 	if (ire != NULL)
18887 		ire_refrele(ire);
18888 	if (need_decref)
18889 		CONN_DEC_REF(connp);
18890 	freemsg(first_mp);
18891 	if (attach_ill != NULL)
18892 		ill_refrele(attach_ill);
18893 	if (xmit_ill != NULL)
18894 		ill_refrele(xmit_ill);
18895 	TRACE_2(TR_FAC_IP, TR_IP_WPUT_END,
18896 	    "ip_wput_end: q %p (%S)", q, "droppkt");
18897 }
18898 
18899 void
18900 ip_wput(queue_t *q, mblk_t *mp)
18901 {
18902 	ip_output(Q_TO_CONN(q), mp, q, IP_WPUT);
18903 }
18904 
18905 /*
18906  *
18907  * The following rules must be observed when accessing any ipif or ill
18908  * that has been cached in the conn. Typically conn_nofailover_ill,
18909  * conn_xmit_if_ill, conn_multicast_ipif and conn_multicast_ill.
18910  *
18911  * Access: The ipif or ill pointed to from the conn can be accessed under
18912  * the protection of the conn_lock or after it has been refheld under the
18913  * protection of the conn lock. In addition the IPIF_CAN_LOOKUP or
18914  * ILL_CAN_LOOKUP macros must be used before actually doing the refhold.
18915  * The reason for this is that a concurrent unplumb could actually be
18916  * cleaning up these cached pointers by walking the conns and might have
18917  * finished cleaning up the conn in question. The macros check that an
18918  * unplumb has not yet started on the ipif or ill.
18919  *
18920  * Caching: An ipif or ill pointer may be cached in the conn only after
18921  * making sure that an unplumb has not started. So the caching is done
18922  * while holding both the conn_lock and the ill_lock and after using the
18923  * ILL_CAN_LOOKUP/IPIF_CAN_LOOKUP macro. An unplumb will set the ILL_CONDEMNED
18924  * flag before starting the cleanup of conns.
18925  *
18926  * The list of ipifs hanging off the ill is protected by ill_g_lock and ill_lock
18927  * On the other hand to access ipif->ipif_ill, we need one of either ill_g_lock
18928  * or a reference to the ipif or a reference to an ire that references the
18929  * ipif. An ipif does not change its ill except for failover/failback. Since
18930  * failover/failback happens only after bringing down the ipif and making sure
18931  * the ipif refcnt has gone to zero and holding the ill_g_lock and ill_lock
18932  * the above holds.
18933  */
18934 static ipif_t *
18935 conn_get_held_ipif(conn_t *connp, ipif_t **ipifp, int *err)
18936 {
18937 	ipif_t	*ipif;
18938 	ill_t	*ill;
18939 
18940 	*err = 0;
18941 	rw_enter(&ill_g_lock, RW_READER);
18942 	mutex_enter(&connp->conn_lock);
18943 	ipif = *ipifp;
18944 	if (ipif != NULL) {
18945 		ill = ipif->ipif_ill;
18946 		mutex_enter(&ill->ill_lock);
18947 		if (IPIF_CAN_LOOKUP(ipif)) {
18948 			ipif_refhold_locked(ipif);
18949 			mutex_exit(&ill->ill_lock);
18950 			mutex_exit(&connp->conn_lock);
18951 			rw_exit(&ill_g_lock);
18952 			return (ipif);
18953 		} else {
18954 			*err = IPIF_LOOKUP_FAILED;
18955 		}
18956 		mutex_exit(&ill->ill_lock);
18957 	}
18958 	mutex_exit(&connp->conn_lock);
18959 	rw_exit(&ill_g_lock);
18960 	return (NULL);
18961 }
18962 
18963 ill_t *
18964 conn_get_held_ill(conn_t *connp, ill_t **illp, int *err)
18965 {
18966 	ill_t	*ill;
18967 
18968 	*err = 0;
18969 	mutex_enter(&connp->conn_lock);
18970 	ill = *illp;
18971 	if (ill != NULL) {
18972 		mutex_enter(&ill->ill_lock);
18973 		if (ILL_CAN_LOOKUP(ill)) {
18974 			ill_refhold_locked(ill);
18975 			mutex_exit(&ill->ill_lock);
18976 			mutex_exit(&connp->conn_lock);
18977 			return (ill);
18978 		} else {
18979 			*err = ILL_LOOKUP_FAILED;
18980 		}
18981 		mutex_exit(&ill->ill_lock);
18982 	}
18983 	mutex_exit(&connp->conn_lock);
18984 	return (NULL);
18985 }
18986 
18987 static int
18988 conn_set_held_ipif(conn_t *connp, ipif_t **ipifp, ipif_t *ipif)
18989 {
18990 	ill_t	*ill;
18991 
18992 	ill = ipif->ipif_ill;
18993 	mutex_enter(&connp->conn_lock);
18994 	mutex_enter(&ill->ill_lock);
18995 	if (IPIF_CAN_LOOKUP(ipif)) {
18996 		*ipifp = ipif;
18997 		mutex_exit(&ill->ill_lock);
18998 		mutex_exit(&connp->conn_lock);
18999 		return (0);
19000 	}
19001 	mutex_exit(&ill->ill_lock);
19002 	mutex_exit(&connp->conn_lock);
19003 	return (IPIF_LOOKUP_FAILED);
19004 }
19005 
19006 /*
19007  * This is called if the outbound datagram needs fragmentation.
19008  *
19009  * NOTE : This function does not ire_refrele the ire argument passed in.
19010  */
19011 static void
19012 ip_wput_ire_fragmentit(mblk_t *ipsec_mp, ire_t *ire)
19013 {
19014 	ipha_t		*ipha;
19015 	mblk_t		*mp;
19016 	uint32_t	v_hlen_tos_len;
19017 	uint32_t	max_frag;
19018 	uint32_t	frag_flag;
19019 	boolean_t	dont_use;
19020 
19021 	if (ipsec_mp->b_datap->db_type == M_CTL) {
19022 		mp = ipsec_mp->b_cont;
19023 	} else {
19024 		mp = ipsec_mp;
19025 	}
19026 
19027 	ipha = (ipha_t *)mp->b_rptr;
19028 	v_hlen_tos_len = ((uint32_t *)ipha)[0];
19029 
19030 #ifdef	_BIG_ENDIAN
19031 #define	V_HLEN	(v_hlen_tos_len >> 24)
19032 #define	LENGTH	(v_hlen_tos_len & 0xFFFF)
19033 #else
19034 #define	V_HLEN	(v_hlen_tos_len & 0xFF)
19035 #define	LENGTH	((v_hlen_tos_len >> 24) | ((v_hlen_tos_len >> 8) & 0xFF00))
19036 #endif
19037 
19038 #ifndef SPEED_BEFORE_SAFETY
19039 	/*
19040 	 * Check that ipha_length is consistent with
19041 	 * the mblk length
19042 	 */
19043 	if (LENGTH != (mp->b_cont ? msgdsize(mp) : mp->b_wptr - rptr)) {
19044 		ip0dbg(("Packet length mismatch: %d, %ld\n",
19045 		    LENGTH, msgdsize(mp)));
19046 		freemsg(ipsec_mp);
19047 		TRACE_2(TR_FAC_IP, TR_IP_WPUT_IRE_END,
19048 		    "ip_wput_ire_fragmentit: mp %p (%S)", mp,
19049 		    "packet length mismatch");
19050 		return;
19051 	}
19052 #endif
19053 	/*
19054 	 * Don't use frag_flag if pre-built packet or source
19055 	 * routed or if multicast (since multicast packets do not solicit
19056 	 * ICMP "packet too big" messages). Get the values of
19057 	 * max_frag and frag_flag atomically by acquiring the
19058 	 * ire_lock.
19059 	 */
19060 	mutex_enter(&ire->ire_lock);
19061 	max_frag = ire->ire_max_frag;
19062 	frag_flag = ire->ire_frag_flag;
19063 	mutex_exit(&ire->ire_lock);
19064 
19065 	dont_use = ((ipha->ipha_ident == IP_HDR_INCLUDED) ||
19066 	    (V_HLEN != IP_SIMPLE_HDR_VERSION &&
19067 	    ip_source_route_included(ipha)) || CLASSD(ipha->ipha_dst));
19068 
19069 	ip_wput_frag(ire, ipsec_mp, OB_PKT, max_frag,
19070 	    (dont_use ? 0 : frag_flag));
19071 }
19072 
19073 /*
19074  * Used for deciding the MSS size for the upper layer. Thus
19075  * we need to check the outbound policy values in the conn.
19076  */
19077 int
19078 conn_ipsec_length(conn_t *connp)
19079 {
19080 	ipsec_latch_t *ipl;
19081 
19082 	ipl = connp->conn_latch;
19083 	if (ipl == NULL)
19084 		return (0);
19085 
19086 	if (ipl->ipl_out_policy == NULL)
19087 		return (0);
19088 
19089 	return (ipl->ipl_out_policy->ipsp_act->ipa_ovhd);
19090 }
19091 
19092 /*
19093  * Returns an estimate of the IPSEC headers size. This is used if
19094  * we don't want to call into IPSEC to get the exact size.
19095  */
19096 int
19097 ipsec_out_extra_length(mblk_t *ipsec_mp)
19098 {
19099 	ipsec_out_t *io = (ipsec_out_t *)ipsec_mp->b_rptr;
19100 	ipsec_action_t *a;
19101 
19102 	ASSERT(io->ipsec_out_type == IPSEC_OUT);
19103 	if (!io->ipsec_out_secure)
19104 		return (0);
19105 
19106 	a = io->ipsec_out_act;
19107 
19108 	if (a == NULL) {
19109 		ASSERT(io->ipsec_out_policy != NULL);
19110 		a = io->ipsec_out_policy->ipsp_act;
19111 	}
19112 	ASSERT(a != NULL);
19113 
19114 	return (a->ipa_ovhd);
19115 }
19116 
19117 /*
19118  * Returns an estimate of the IPSEC headers size. This is used if
19119  * we don't want to call into IPSEC to get the exact size.
19120  */
19121 int
19122 ipsec_in_extra_length(mblk_t *ipsec_mp)
19123 {
19124 	ipsec_in_t *ii = (ipsec_in_t *)ipsec_mp->b_rptr;
19125 	ipsec_action_t *a;
19126 
19127 	ASSERT(ii->ipsec_in_type == IPSEC_IN);
19128 
19129 	a = ii->ipsec_in_action;
19130 	return (a == NULL ? 0 : a->ipa_ovhd);
19131 }
19132 
19133 /*
19134  * If there are any source route options, return the true final
19135  * destination. Otherwise, return the destination.
19136  */
19137 ipaddr_t
19138 ip_get_dst(ipha_t *ipha)
19139 {
19140 	ipoptp_t	opts;
19141 	uchar_t		*opt;
19142 	uint8_t		optval;
19143 	uint8_t		optlen;
19144 	ipaddr_t	dst;
19145 	uint32_t off;
19146 
19147 	dst = ipha->ipha_dst;
19148 
19149 	if (IS_SIMPLE_IPH(ipha))
19150 		return (dst);
19151 
19152 	for (optval = ipoptp_first(&opts, ipha);
19153 	    optval != IPOPT_EOL;
19154 	    optval = ipoptp_next(&opts)) {
19155 		opt = opts.ipoptp_cur;
19156 		optlen = opts.ipoptp_len;
19157 		ASSERT((opts.ipoptp_flags & IPOPTP_ERROR) == 0);
19158 		switch (optval) {
19159 		case IPOPT_SSRR:
19160 		case IPOPT_LSRR:
19161 			off = opt[IPOPT_OFFSET];
19162 			/*
19163 			 * If one of the conditions is true, it means
19164 			 * end of options and dst already has the right
19165 			 * value.
19166 			 */
19167 			if (!(optlen < IP_ADDR_LEN || off > optlen - 3)) {
19168 				off = optlen - IP_ADDR_LEN;
19169 				bcopy(&opt[off], &dst, IP_ADDR_LEN);
19170 			}
19171 			return (dst);
19172 		default:
19173 			break;
19174 		}
19175 	}
19176 
19177 	return (dst);
19178 }
19179 
19180 mblk_t *
19181 ip_wput_ire_parse_ipsec_out(mblk_t *mp, ipha_t *ipha, ip6_t *ip6h, ire_t *ire,
19182     conn_t *connp, boolean_t unspec_src)
19183 {
19184 	ipsec_out_t	*io;
19185 	mblk_t		*first_mp;
19186 	boolean_t policy_present;
19187 
19188 	first_mp = mp;
19189 	if (mp->b_datap->db_type == M_CTL) {
19190 		io = (ipsec_out_t *)first_mp->b_rptr;
19191 		/*
19192 		 * ip_wput[_v6] attaches an IPSEC_OUT in two cases.
19193 		 *
19194 		 * 1) There is per-socket policy (including cached global
19195 		 *    policy).
19196 		 * 2) There is no per-socket policy, but it is
19197 		 *    a multicast packet that needs to go out
19198 		 *    on a specific interface. This is the case
19199 		 *    where (ip_wput and ip_wput_multicast) attaches
19200 		 *    an IPSEC_OUT and sets ipsec_out_secure B_FALSE.
19201 		 *
19202 		 * In case (2) we check with global policy to
19203 		 * see if there is a match and set the ill_index
19204 		 * appropriately so that we can lookup the ire
19205 		 * properly in ip_wput_ipsec_out.
19206 		 */
19207 
19208 		/*
19209 		 * ipsec_out_use_global_policy is set to B_FALSE
19210 		 * in ipsec_in_to_out(). Refer to that function for
19211 		 * details.
19212 		 */
19213 		if ((io->ipsec_out_latch == NULL) &&
19214 		    (io->ipsec_out_use_global_policy)) {
19215 			return (ip_wput_attach_policy(first_mp, ipha, ip6h,
19216 			    ire, connp, unspec_src));
19217 		}
19218 		if (!io->ipsec_out_secure) {
19219 			/*
19220 			 * If this is not a secure packet, drop
19221 			 * the IPSEC_OUT mp and treat it as a clear
19222 			 * packet. This happens when we are sending
19223 			 * a ICMP reply back to a clear packet. See
19224 			 * ipsec_in_to_out() for details.
19225 			 */
19226 			mp = first_mp->b_cont;
19227 			freeb(first_mp);
19228 		}
19229 		return (mp);
19230 	}
19231 	/*
19232 	 * See whether we need to attach a global policy here. We
19233 	 * don't depend on the conn (as it could be null) for deciding
19234 	 * what policy this datagram should go through because it
19235 	 * should have happened in ip_wput if there was some
19236 	 * policy. This normally happens for connections which are not
19237 	 * fully bound preventing us from caching policies in
19238 	 * ip_bind. Packets coming from the TCP listener/global queue
19239 	 * - which are non-hard_bound - could also be affected by
19240 	 * applying policy here.
19241 	 *
19242 	 * If this packet is coming from tcp global queue or listener,
19243 	 * we will be applying policy here.  This may not be *right*
19244 	 * if these packets are coming from the detached connection as
19245 	 * it could have gone in clear before. This happens only if a
19246 	 * TCP connection started when there is no policy and somebody
19247 	 * added policy before it became detached. Thus packets of the
19248 	 * detached connection could go out secure and the other end
19249 	 * would drop it because it will be expecting in clear. The
19250 	 * converse is not true i.e if somebody starts a TCP
19251 	 * connection and deletes the policy, all the packets will
19252 	 * still go out with the policy that existed before deleting
19253 	 * because ip_unbind sends up policy information which is used
19254 	 * by TCP on subsequent ip_wputs. The right solution is to fix
19255 	 * TCP to attach a dummy IPSEC_OUT and set
19256 	 * ipsec_out_use_global_policy to B_FALSE. As this might
19257 	 * affect performance for normal cases, we are not doing it.
19258 	 * Thus, set policy before starting any TCP connections.
19259 	 *
19260 	 * NOTE - We might apply policy even for a hard bound connection
19261 	 * - for which we cached policy in ip_bind - if somebody added
19262 	 * global policy after we inherited the policy in ip_bind.
19263 	 * This means that the packets that were going out in clear
19264 	 * previously would start going secure and hence get dropped
19265 	 * on the other side. To fix this, TCP attaches a dummy
19266 	 * ipsec_out and make sure that we don't apply global policy.
19267 	 */
19268 	if (ipha != NULL)
19269 		policy_present = ipsec_outbound_v4_policy_present;
19270 	else
19271 		policy_present = ipsec_outbound_v6_policy_present;
19272 	if (!policy_present)
19273 		return (mp);
19274 
19275 	return (ip_wput_attach_policy(mp, ipha, ip6h, ire, connp, unspec_src));
19276 }
19277 
19278 ire_t *
19279 conn_set_outgoing_ill(conn_t *connp, ire_t *ire, ill_t **conn_outgoing_ill)
19280 {
19281 	ipaddr_t addr;
19282 	ire_t *save_ire;
19283 	irb_t *irb;
19284 	ill_group_t *illgrp;
19285 	int	err;
19286 
19287 	save_ire = ire;
19288 	addr = ire->ire_addr;
19289 
19290 	ASSERT(ire->ire_type == IRE_BROADCAST);
19291 
19292 	illgrp = connp->conn_outgoing_ill->ill_group;
19293 	if (illgrp == NULL) {
19294 		*conn_outgoing_ill = conn_get_held_ill(connp,
19295 		    &connp->conn_outgoing_ill, &err);
19296 		if (err == ILL_LOOKUP_FAILED) {
19297 			ire_refrele(save_ire);
19298 			return (NULL);
19299 		}
19300 		return (save_ire);
19301 	}
19302 	/*
19303 	 * If IP_BOUND_IF has been done, conn_outgoing_ill will be set.
19304 	 * If it is part of the group, we need to send on the ire
19305 	 * that has been cleared of IRE_MARK_NORECV and that belongs
19306 	 * to this group. This is okay as IP_BOUND_IF really means
19307 	 * any ill in the group. We depend on the fact that the
19308 	 * first ire in the group is always cleared of IRE_MARK_NORECV
19309 	 * if such an ire exists. This is possible only if you have
19310 	 * at least one ill in the group that has not failed.
19311 	 *
19312 	 * First get to the ire that matches the address and group.
19313 	 *
19314 	 * We don't look for an ire with a matching zoneid because a given zone
19315 	 * won't always have broadcast ires on all ills in the group.
19316 	 */
19317 	irb = ire->ire_bucket;
19318 	rw_enter(&irb->irb_lock, RW_READER);
19319 	if (ire->ire_marks & IRE_MARK_NORECV) {
19320 		/*
19321 		 * If the current zone only has an ire broadcast for this
19322 		 * address marked NORECV, the ire we want is ahead in the
19323 		 * bucket, so we look it up deliberately ignoring the zoneid.
19324 		 */
19325 		for (ire = irb->irb_ire; ire != NULL; ire = ire->ire_next) {
19326 			if (ire->ire_addr != addr)
19327 				continue;
19328 			/* skip over deleted ires */
19329 			if (ire->ire_marks & IRE_MARK_CONDEMNED)
19330 				continue;
19331 		}
19332 	}
19333 	while (ire != NULL) {
19334 		/*
19335 		 * If a new interface is coming up, we could end up
19336 		 * seeing the loopback ire and the non-loopback ire
19337 		 * may not have been added yet. So check for ire_stq
19338 		 */
19339 		if (ire->ire_stq != NULL && (ire->ire_addr != addr ||
19340 		    ire->ire_ipif->ipif_ill->ill_group == illgrp)) {
19341 			break;
19342 		}
19343 		ire = ire->ire_next;
19344 	}
19345 	if (ire != NULL && ire->ire_addr == addr &&
19346 	    ire->ire_ipif->ipif_ill->ill_group == illgrp) {
19347 		IRE_REFHOLD(ire);
19348 		rw_exit(&irb->irb_lock);
19349 		ire_refrele(save_ire);
19350 		*conn_outgoing_ill = ire_to_ill(ire);
19351 		/*
19352 		 * Refhold the ill to make the conn_outgoing_ill
19353 		 * independent of the ire. ip_wput_ire goes in a loop
19354 		 * and may refrele the ire. Since we have an ire at this
19355 		 * point we don't need to use ILL_CAN_LOOKUP on the ill.
19356 		 */
19357 		ill_refhold(*conn_outgoing_ill);
19358 		return (ire);
19359 	}
19360 	rw_exit(&irb->irb_lock);
19361 	ip1dbg(("conn_set_outgoing_ill: No matching ire\n"));
19362 	/*
19363 	 * If we can't find a suitable ire, return the original ire.
19364 	 */
19365 	return (save_ire);
19366 }
19367 
19368 /*
19369  * This function does the ire_refrele of the ire passed in as the
19370  * argument. As this function looks up more ires i.e broadcast ires,
19371  * it needs to REFRELE them. Currently, for simplicity we don't
19372  * differentiate the one passed in and looked up here. We always
19373  * REFRELE.
19374  * IPQoS Notes:
19375  * IP policy is invoked if IPP_LOCAL_OUT is enabled. Processing for
19376  * IPSec packets are done in ipsec_out_process.
19377  *
19378  */
19379 void
19380 ip_wput_ire(queue_t *q, mblk_t *mp, ire_t *ire, conn_t *connp, int caller)
19381 {
19382 	ipha_t		*ipha;
19383 #define	rptr	((uchar_t *)ipha)
19384 	mblk_t		*mp1;
19385 	queue_t		*stq;
19386 #define	Q_TO_INDEX(stq)	(((ill_t *)stq->q_ptr)->ill_phyint->phyint_ifindex)
19387 	uint32_t	v_hlen_tos_len;
19388 	uint32_t	ttl_protocol;
19389 	ipaddr_t	src;
19390 	ipaddr_t	dst;
19391 	uint32_t	cksum;
19392 	ipaddr_t	orig_src;
19393 	ire_t		*ire1;
19394 	mblk_t		*next_mp;
19395 	uint_t		hlen;
19396 	uint16_t	*up;
19397 	uint32_t	max_frag = ire->ire_max_frag;
19398 	ill_t		*ill = ire_to_ill(ire);
19399 	int		clusterwide;
19400 	uint16_t	ip_hdr_included; /* IP header included by ULP? */
19401 	int		ipsec_len;
19402 	mblk_t		*first_mp;
19403 	ipsec_out_t	*io;
19404 	boolean_t	conn_dontroute;		/* conn value for multicast */
19405 	boolean_t	conn_multicast_loop;	/* conn value for multicast */
19406 	boolean_t	multicast_forward;	/* Should we forward ? */
19407 	boolean_t	unspec_src;
19408 	ill_t		*conn_outgoing_ill = NULL;
19409 	ill_t		*ire_ill;
19410 	ill_t		*ire1_ill;
19411 	uint32_t 	ill_index = 0;
19412 	boolean_t	multirt_send = B_FALSE;
19413 	int		err;
19414 	zoneid_t	zoneid;
19415 	boolean_t	iphdrhwcksum = B_FALSE;
19416 
19417 	TRACE_1(TR_FAC_IP, TR_IP_WPUT_IRE_START,
19418 	    "ip_wput_ire_start: q %p", q);
19419 
19420 	multicast_forward = B_FALSE;
19421 	unspec_src = (connp != NULL && connp->conn_unspec_src);
19422 
19423 	if (ire->ire_flags & RTF_MULTIRT) {
19424 		/*
19425 		 * Multirouting case. The bucket where ire is stored
19426 		 * probably holds other RTF_MULTIRT flagged ire
19427 		 * to the destination. In this call to ip_wput_ire,
19428 		 * we attempt to send the packet through all
19429 		 * those ires. Thus, we first ensure that ire is the
19430 		 * first RTF_MULTIRT ire in the bucket,
19431 		 * before walking the ire list.
19432 		 */
19433 		ire_t *first_ire;
19434 		irb_t *irb = ire->ire_bucket;
19435 		ASSERT(irb != NULL);
19436 
19437 		/* Make sure we do not omit any multiroute ire. */
19438 		IRB_REFHOLD(irb);
19439 		for (first_ire = irb->irb_ire;
19440 		    first_ire != NULL;
19441 		    first_ire = first_ire->ire_next) {
19442 			if ((first_ire->ire_flags & RTF_MULTIRT) &&
19443 			    (first_ire->ire_addr == ire->ire_addr) &&
19444 			    !(first_ire->ire_marks &
19445 				(IRE_MARK_CONDEMNED | IRE_MARK_HIDDEN)))
19446 				break;
19447 		}
19448 
19449 		if ((first_ire != NULL) && (first_ire != ire)) {
19450 			IRE_REFHOLD(first_ire);
19451 			ire_refrele(ire);
19452 			ire = first_ire;
19453 			ill = ire_to_ill(ire);
19454 		}
19455 		IRB_REFRELE(irb);
19456 	}
19457 
19458 	/*
19459 	 * conn_outgoing_ill is used only in the broadcast loop.
19460 	 * for performance we don't grab the mutexs in the fastpath
19461 	 */
19462 	if ((connp != NULL) &&
19463 	    (connp->conn_xmit_if_ill == NULL) &&
19464 	    (ire->ire_type == IRE_BROADCAST) &&
19465 	    ((connp->conn_nofailover_ill != NULL) ||
19466 	    (connp->conn_outgoing_ill != NULL))) {
19467 		/*
19468 		 * Bind to IPIF_NOFAILOVER address overrides IP_BOUND_IF
19469 		 * option. So, see if this endpoint is bound to a
19470 		 * IPIF_NOFAILOVER address. If so, honor it. This implies
19471 		 * that if the interface is failed, we will still send
19472 		 * the packet on the same ill which is what we want.
19473 		 */
19474 		conn_outgoing_ill = conn_get_held_ill(connp,
19475 		    &connp->conn_nofailover_ill, &err);
19476 		if (err == ILL_LOOKUP_FAILED) {
19477 			ire_refrele(ire);
19478 			freemsg(mp);
19479 			return;
19480 		}
19481 		if (conn_outgoing_ill == NULL) {
19482 			/*
19483 			 * Choose a good ill in the group to send the
19484 			 * packets on.
19485 			 */
19486 			ire = conn_set_outgoing_ill(connp, ire,
19487 			    &conn_outgoing_ill);
19488 			if (ire == NULL) {
19489 				freemsg(mp);
19490 				return;
19491 			}
19492 		}
19493 	}
19494 
19495 	if (mp->b_datap->db_type != M_CTL) {
19496 		ipha = (ipha_t *)mp->b_rptr;
19497 		zoneid = (connp != NULL ? connp->conn_zoneid : ALL_ZONES);
19498 	} else {
19499 		io = (ipsec_out_t *)mp->b_rptr;
19500 		ASSERT(io->ipsec_out_type == IPSEC_OUT);
19501 		zoneid = io->ipsec_out_zoneid;
19502 		ASSERT(zoneid != ALL_ZONES);
19503 		ipha = (ipha_t *)mp->b_cont->b_rptr;
19504 		dst = ipha->ipha_dst;
19505 		/*
19506 		 * For the multicast case, ipsec_out carries conn_dontroute and
19507 		 * conn_multicast_loop as conn may not be available here. We
19508 		 * need this for multicast loopback and forwarding which is done
19509 		 * later in the code.
19510 		 */
19511 		if (CLASSD(dst)) {
19512 			conn_dontroute = io->ipsec_out_dontroute;
19513 			conn_multicast_loop = io->ipsec_out_multicast_loop;
19514 			/*
19515 			 * If conn_dontroute is not set or conn_multicast_loop
19516 			 * is set, we need to do forwarding/loopback. For
19517 			 * datagrams from ip_wput_multicast, conn_dontroute is
19518 			 * set to B_TRUE and conn_multicast_loop is set to
19519 			 * B_FALSE so that we neither do forwarding nor
19520 			 * loopback.
19521 			 */
19522 			if (!conn_dontroute || conn_multicast_loop)
19523 				multicast_forward = B_TRUE;
19524 		}
19525 	}
19526 
19527 	if (ire->ire_type == IRE_LOCAL && ire->ire_zoneid != zoneid) {
19528 		/*
19529 		 * When a zone sends a packet to another zone, we try to deliver
19530 		 * the packet under the same conditions as if the destination
19531 		 * was a real node on the network. To do so, we look for a
19532 		 * matching route in the forwarding table.
19533 		 * RTF_REJECT and RTF_BLACKHOLE are handled just like
19534 		 * ip_newroute() does.
19535 		 */
19536 		ire_t *src_ire = ire_ftable_lookup(ipha->ipha_dst, 0, 0, 0,
19537 		    NULL, NULL, zoneid, 0, (MATCH_IRE_RECURSIVE |
19538 		    MATCH_IRE_DEFAULT | MATCH_IRE_RJ_BHOLE));
19539 		if (src_ire != NULL &&
19540 		    !(src_ire->ire_flags & (RTF_REJECT | RTF_BLACKHOLE))) {
19541 			if (ipha->ipha_src == INADDR_ANY && !unspec_src)
19542 				ipha->ipha_src = src_ire->ire_src_addr;
19543 			ire_refrele(src_ire);
19544 		} else {
19545 			ire_refrele(ire);
19546 			if (conn_outgoing_ill != NULL)
19547 				ill_refrele(conn_outgoing_ill);
19548 			BUMP_MIB(&ip_mib, ipOutNoRoutes);
19549 			if (src_ire != NULL) {
19550 				if (src_ire->ire_flags & RTF_BLACKHOLE) {
19551 					ire_refrele(src_ire);
19552 					freemsg(mp);
19553 					return;
19554 				}
19555 				ire_refrele(src_ire);
19556 			}
19557 			if (ip_hdr_complete(ipha, zoneid)) {
19558 				/* Failed */
19559 				freemsg(mp);
19560 				return;
19561 			}
19562 			icmp_unreachable(q, mp, ICMP_HOST_UNREACHABLE);
19563 			return;
19564 		}
19565 	}
19566 
19567 	if (mp->b_datap->db_type == M_CTL ||
19568 	    ipsec_outbound_v4_policy_present) {
19569 		mp = ip_wput_ire_parse_ipsec_out(mp, ipha, NULL, ire, connp,
19570 		    unspec_src);
19571 		if (mp == NULL) {
19572 			ire_refrele(ire);
19573 			if (conn_outgoing_ill != NULL)
19574 				ill_refrele(conn_outgoing_ill);
19575 			return;
19576 		}
19577 	}
19578 
19579 	first_mp = mp;
19580 	ipsec_len = 0;
19581 
19582 	if (first_mp->b_datap->db_type == M_CTL) {
19583 		io = (ipsec_out_t *)first_mp->b_rptr;
19584 		ASSERT(io->ipsec_out_type == IPSEC_OUT);
19585 		mp = first_mp->b_cont;
19586 		ipsec_len = ipsec_out_extra_length(first_mp);
19587 		ASSERT(ipsec_len >= 0);
19588 		zoneid = io->ipsec_out_zoneid;
19589 		ASSERT(zoneid != ALL_ZONES);
19590 
19591 		/*
19592 		 * Drop M_CTL here if IPsec processing is not needed.
19593 		 * (Non-IPsec use of M_CTL extracted any information it
19594 		 * needed above).
19595 		 */
19596 		if (ipsec_len == 0) {
19597 			freeb(first_mp);
19598 			first_mp = mp;
19599 		}
19600 	}
19601 
19602 	/*
19603 	 * Fast path for ip_wput_ire
19604 	 */
19605 
19606 	ipha = (ipha_t *)mp->b_rptr;
19607 	v_hlen_tos_len = ((uint32_t *)ipha)[0];
19608 	dst = ipha->ipha_dst;
19609 
19610 	/*
19611 	 * ICMP(RAWIP) module should set the ipha_ident to IP_HDR_INCLUDED
19612 	 * if the socket is a SOCK_RAW type. The transport checksum should
19613 	 * be provided in the pre-built packet, so we don't need to compute it.
19614 	 * Also, other application set flags, like DF, should not be altered.
19615 	 * Other transport MUST pass down zero.
19616 	 */
19617 	ip_hdr_included = ipha->ipha_ident;
19618 	ASSERT(ipha->ipha_ident == 0 || ipha->ipha_ident == IP_HDR_INCLUDED);
19619 
19620 	if (CLASSD(dst)) {
19621 		ip1dbg(("ip_wput_ire: to 0x%x ire %s addr 0x%x\n",
19622 		    ntohl(dst),
19623 		    ip_nv_lookup(ire_nv_tbl, ire->ire_type),
19624 		    ntohl(ire->ire_addr)));
19625 	}
19626 
19627 /* Macros to extract header fields from data already in registers */
19628 #ifdef	_BIG_ENDIAN
19629 #define	V_HLEN	(v_hlen_tos_len >> 24)
19630 #define	LENGTH	(v_hlen_tos_len & 0xFFFF)
19631 #define	PROTO	(ttl_protocol & 0xFF)
19632 #else
19633 #define	V_HLEN	(v_hlen_tos_len & 0xFF)
19634 #define	LENGTH	((v_hlen_tos_len >> 24) | ((v_hlen_tos_len >> 8) & 0xFF00))
19635 #define	PROTO	(ttl_protocol >> 8)
19636 #endif
19637 
19638 
19639 	orig_src = src = ipha->ipha_src;
19640 	/* (The loop back to "another" is explained down below.) */
19641 another:;
19642 	/*
19643 	 * Assign an ident value for this packet.  We assign idents on
19644 	 * a per destination basis out of the IRE.  There could be
19645 	 * other threads targeting the same destination, so we have to
19646 	 * arrange for a atomic increment.  Note that we use a 32-bit
19647 	 * atomic add because it has better performance than its
19648 	 * 16-bit sibling.
19649 	 *
19650 	 * If running in cluster mode and if the source address
19651 	 * belongs to a replicated service then vector through
19652 	 * cl_inet_ipident vector to allocate ip identifier
19653 	 * NOTE: This is a contract private interface with the
19654 	 * clustering group.
19655 	 */
19656 	clusterwide = 0;
19657 	if (cl_inet_ipident) {
19658 		ASSERT(cl_inet_isclusterwide);
19659 		if ((*cl_inet_isclusterwide)(IPPROTO_IP,
19660 		    AF_INET, (uint8_t *)(uintptr_t)src)) {
19661 			ipha->ipha_ident = (*cl_inet_ipident)(IPPROTO_IP,
19662 			    AF_INET, (uint8_t *)(uintptr_t)src,
19663 			    (uint8_t *)(uintptr_t)dst);
19664 			clusterwide = 1;
19665 		}
19666 	}
19667 	if (!clusterwide) {
19668 		ipha->ipha_ident =
19669 		    (uint16_t)atomic_add_32_nv(&ire->ire_ident, 1);
19670 	}
19671 
19672 #ifndef _BIG_ENDIAN
19673 	ipha->ipha_ident = (ipha->ipha_ident << 8) | (ipha->ipha_ident >> 8);
19674 #endif
19675 
19676 	/*
19677 	 * Set source address unless sent on an ill or conn_unspec_src is set.
19678 	 * This is needed to obey conn_unspec_src when packets go through
19679 	 * ip_newroute + arp.
19680 	 * Assumes ip_newroute{,_multi} sets the source address as well.
19681 	 */
19682 	if (src == INADDR_ANY && !unspec_src) {
19683 		/*
19684 		 * Assign the appropriate source address from the IRE if none
19685 		 * was specified.
19686 		 */
19687 		ASSERT(ire->ire_ipversion == IPV4_VERSION);
19688 
19689 		/*
19690 		 * With IP multipathing, broadcast packets are sent on the ire
19691 		 * that has been cleared of IRE_MARK_NORECV and that belongs to
19692 		 * the group. However, this ire might not be in the same zone so
19693 		 * we can't always use its source address. We look for a
19694 		 * broadcast ire in the same group and in the right zone.
19695 		 */
19696 		if (ire->ire_type == IRE_BROADCAST &&
19697 		    ire->ire_zoneid != zoneid) {
19698 			ire_t *src_ire = ire_ctable_lookup(dst, 0,
19699 			    IRE_BROADCAST, ire->ire_ipif, zoneid,
19700 			    (MATCH_IRE_TYPE | MATCH_IRE_ILL_GROUP));
19701 			if (src_ire != NULL) {
19702 				src = src_ire->ire_src_addr;
19703 				ire_refrele(src_ire);
19704 			} else {
19705 				ire_refrele(ire);
19706 				if (conn_outgoing_ill != NULL)
19707 					ill_refrele(conn_outgoing_ill);
19708 				freemsg(first_mp);
19709 				BUMP_MIB(&ip_mib, ipOutDiscards);
19710 				return;
19711 			}
19712 		} else {
19713 			src = ire->ire_src_addr;
19714 		}
19715 
19716 		if (connp == NULL) {
19717 			ip1dbg(("ip_wput_ire: no connp and no src "
19718 			    "address for dst 0x%x, using src 0x%x\n",
19719 			    ntohl(dst),
19720 			    ntohl(src)));
19721 		}
19722 		ipha->ipha_src = src;
19723 	}
19724 	stq = ire->ire_stq;
19725 
19726 	/*
19727 	 * We only allow ire chains for broadcasts since there will
19728 	 * be multiple IRE_CACHE entries for the same multicast
19729 	 * address (one per ipif).
19730 	 */
19731 	next_mp = NULL;
19732 
19733 	/* broadcast packet */
19734 	if (ire->ire_type == IRE_BROADCAST)
19735 		goto broadcast;
19736 
19737 	/* loopback ? */
19738 	if (stq == NULL)
19739 		goto nullstq;
19740 
19741 	/* The ill_index for outbound ILL */
19742 	ill_index = Q_TO_INDEX(stq);
19743 
19744 	BUMP_MIB(&ip_mib, ipOutRequests);
19745 	ttl_protocol = ((uint16_t *)ipha)[4];
19746 
19747 	/* pseudo checksum (do it in parts for IP header checksum) */
19748 	cksum = (dst >> 16) + (dst & 0xFFFF) + (src >> 16) + (src & 0xFFFF);
19749 
19750 #define	FRAGMENT_NEEDED(mtu, size)	\
19751 	(((mtu) < (unsigned int)(size)) ? B_TRUE : B_FALSE)
19752 
19753 #define	IS_FASTPATH(ire, bp) 					\
19754 	((ire)->ire_fp_mp != NULL &&				\
19755 	(MBLKHEAD((bp)) >= (MBLKL((ire)->ire_fp_mp))))		\
19756 
19757 #define	IPH_UDPH_CHECKSUMP(ipha, hlen) \
19758 	((uint16_t *)(((uchar_t *)ipha)+(hlen + UDP_CHECKSUM_OFFSET)))
19759 #define	IPH_TCPH_CHECKSUMP(ipha, hlen) \
19760 	    ((uint16_t *)(((uchar_t *)ipha)+(hlen+TCP_CHECKSUM_OFFSET)))
19761 
19762 #define	IP_CKSUM_XMIT(ill, ire, mp, up, proto, hlen, max_frag,		\
19763 	    ipsec_len) { 						\
19764 	uint32_t	sum;						\
19765 	uint32_t	xmit_capab = HCKSUM_INET_FULL_V4 |		\
19766 			    HCKSUM_INET_PARTIAL | HCKSUM_IPHDRCKSUM;	\
19767 	boolean_t	cksum_offload = B_FALSE;			\
19768 									\
19769 	/*								\
19770 	 * The ire fp mp can change due to the arrival of a		\
19771 	 * DL_NOTE_FASTPATH_FLUSH in the case of IRE_BROADCAST		\
19772 	 * and IRE_MIPRTUN. Hence the ire_fp_mp has to be accessed	\
19773 	 * only under the ire_lock in such cases.			\
19774 	 */								\
19775 	LOCK_IRE_FP_MP(ire);						\
19776 	if ((ill) && (ill->ill_capabilities & ILL_CAPAB_HCKSUM) &&	\
19777 	    (ill->ill_hcksum_capab->ill_hcksum_txflags &		\
19778 	    xmit_capab) && (!FRAGMENT_NEEDED(max_frag, 			\
19779 	    (LENGTH + ipsec_len))) && (!(ire->ire_flags & 		\
19780 	    RTF_MULTIRT)) && (ipsec_len == 0) && 			\
19781 	    IS_FASTPATH((ire), (mp)) &&	(dohwcksum)) { 			\
19782 		/*							\
19783 		 * Underlying interface supports hardware checksumming.	\
19784 		 * So postpone the checksum to the interface driver	\
19785 		 */							\
19786 									\
19787 		if ((hlen) == IP_SIMPLE_HDR_LENGTH) {			       \
19788 			if (ill->ill_hcksum_capab->ill_hcksum_txflags &        \
19789 			    HCKSUM_IPHDRCKSUM) {			       \
19790 				mp->b_datap->db_struioun.cksum.flags |=	       \
19791 				    HCK_IPV4_HDRCKSUM;			       \
19792 				/* seed the cksum field to 0 */		       \
19793 				ipha->ipha_hdr_checksum = 0;		       \
19794 				iphdrhwcksum = B_TRUE;			       \
19795 			}						       \
19796 			/*						       \
19797 			 * If underlying h/w supports full h/w checksumming    \
19798 			 * and no IP options are present, then offload	       \
19799 			 * full checksumming to the hardware.		       \
19800 			 *						       \
19801 			 * If h/w can do partial checksumming then offload     \
19802 			 * unless the startpoint offset, including mac-header, \
19803 			 * is too big for the interface to some of our	       \
19804 			 * hardware (CE and ERI) which have 6 bit fields.      \
19805 			 * Sigh.					       \
19806 			 * Unhappily we don't have the mac-header size here    \
19807 			 * so punt for any options.			       \
19808 			 */						       \
19809 			if (ill->ill_hcksum_capab->ill_hcksum_txflags &        \
19810 			    HCKSUM_INET_FULL_V4) {			       \
19811 				UNLOCK_IRE_FP_MP(ire);			       \
19812 				/* Seed the checksum field to 0 */	       \
19813 				*up = 0;				       \
19814 				mp->b_datap->db_struioun.cksum.flags |=	       \
19815 				    HCK_FULLCKSUM;			       \
19816 				cksum_offload = B_TRUE;			       \
19817 			} else if (ill->ill_hcksum_capab->ill_hcksum_txflags & \
19818 			    HCKSUM_INET_PARTIAL) {			       \
19819 				UNLOCK_IRE_FP_MP(ire);			       \
19820 				sum = *up + cksum + proto;		       \
19821 				sum = (sum & 0xFFFF) + (sum >> 16);	       \
19822 				*up = (sum & 0xFFFF) + (sum >> 16);	       \
19823 				/*					       \
19824 				 * All offsets are relative to the beginning   \
19825 				 * of the IP header.			       \
19826 				 */					       \
19827 				mp->b_datap->db_cksumstart = hlen;	       \
19828 				mp->b_datap->db_cksumstuff = 		       \
19829 				    (PROTO == IPPROTO_UDP) ?		       \
19830 				    (hlen) + UDP_CHECKSUM_OFFSET :	       \
19831 				    (hlen) + TCP_CHECKSUM_OFFSET;	       \
19832 				mp->b_datap->db_cksumend = ipha->ipha_length;  \
19833 				mp->b_datap->db_struioun.cksum.flags |=	       \
19834 				    HCK_PARTIALCKSUM;			       \
19835 				cksum_offload = B_TRUE;			       \
19836 			}						       \
19837 		}							\
19838 	} 								\
19839 	if (!cksum_offload) {						\
19840 		UNLOCK_IRE_FP_MP(ire);					\
19841 		IP_STAT(ip_out_sw_cksum);				\
19842 		(sum) = IP_CSUM((mp), (hlen), cksum + proto);		\
19843 		*(up) = (uint16_t)((sum) ? (sum) : ~(sum));		\
19844 	}								\
19845 }
19846 	if (!IP_FLOW_CONTROLLED_ULP(PROTO)) {
19847 		queue_t *dev_q = stq->q_next;
19848 
19849 		/* flow controlled */
19850 		if ((dev_q->q_next || dev_q->q_first) &&
19851 		    !canput(dev_q))
19852 			goto blocked;
19853 		if ((PROTO == IPPROTO_UDP) &&
19854 		    (ip_hdr_included != IP_HDR_INCLUDED)) {
19855 			hlen = (V_HLEN & 0xF) << 2;
19856 			up = IPH_UDPH_CHECKSUMP(ipha, hlen);
19857 			if (*up) {
19858 				IP_CKSUM_XMIT(ill, ire, mp, up,
19859 				    IP_UDP_CSUM_COMP, hlen, max_frag,
19860 				    ipsec_len);
19861 			}
19862 		}
19863 	} else if (ip_hdr_included != IP_HDR_INCLUDED) {
19864 		hlen = (V_HLEN & 0xF) << 2;
19865 		if (PROTO == IPPROTO_TCP) {
19866 			up = IPH_TCPH_CHECKSUMP(ipha, hlen);
19867 			/*
19868 			 * The packet header is processed once and for all, even
19869 			 * in the multirouting case. We disable hardware
19870 			 * checksum if the packet is multirouted, as it will be
19871 			 * replicated via several interfaces, and not all of
19872 			 * them may have this capability.
19873 			 */
19874 			IP_CKSUM_XMIT(ill, ire, mp, up,
19875 			    IP_TCP_CSUM_COMP, hlen, max_frag, ipsec_len);
19876 		} else {
19877 			sctp_hdr_t	*sctph;
19878 
19879 			ASSERT(PROTO == IPPROTO_SCTP);
19880 			ASSERT(MBLKL(mp) >= (hlen + sizeof (*sctph)));
19881 			sctph = (sctp_hdr_t *)(mp->b_rptr + hlen);
19882 			/*
19883 			 * Zero out the checksum field to ensure proper
19884 			 * checksum calculation.
19885 			 */
19886 			sctph->sh_chksum = 0;
19887 #ifdef	DEBUG
19888 			if (!skip_sctp_cksum)
19889 #endif
19890 				sctph->sh_chksum = sctp_cksum(mp, hlen);
19891 		}
19892 	}
19893 
19894 	/*
19895 	 * If this is a multicast packet and originated from ip_wput
19896 	 * we need to do loopback and forwarding checks. If it comes
19897 	 * from ip_wput_multicast, we SHOULD not do this.
19898 	 */
19899 	if (CLASSD(ipha->ipha_dst) && multicast_forward) goto multi_loopback;
19900 
19901 	/* checksum */
19902 	cksum += ttl_protocol;
19903 
19904 	/* fragment the packet */
19905 	if (FRAGMENT_NEEDED(max_frag, (LENGTH + ipsec_len)))
19906 		goto fragmentit;
19907 	/*
19908 	 * Don't use frag_flag if packet is pre-built or source
19909 	 * routed or if multicast (since multicast packets do
19910 	 * not solicit ICMP "packet too big" messages).
19911 	 */
19912 	if ((ip_hdr_included != IP_HDR_INCLUDED) &&
19913 	    (V_HLEN == IP_SIMPLE_HDR_VERSION ||
19914 	    !ip_source_route_included(ipha)) &&
19915 	    !CLASSD(ipha->ipha_dst))
19916 		ipha->ipha_fragment_offset_and_flags |=
19917 		    htons(ire->ire_frag_flag);
19918 
19919 	if (!iphdrhwcksum) {
19920 		/* checksum */
19921 		cksum += ipha->ipha_ident;
19922 		cksum += (v_hlen_tos_len >> 16)+(v_hlen_tos_len & 0xFFFF);
19923 		cksum += ipha->ipha_fragment_offset_and_flags;
19924 
19925 		/* IP options present */
19926 		hlen = (V_HLEN & 0xF) - IP_SIMPLE_HDR_LENGTH_IN_WORDS;
19927 		if (hlen)
19928 			goto checksumoptions;
19929 
19930 		/* calculate hdr checksum */
19931 		cksum = ((cksum & 0xFFFF) + (cksum >> 16));
19932 		cksum = ~(cksum + (cksum >> 16));
19933 		ipha->ipha_hdr_checksum = (uint16_t)cksum;
19934 	}
19935 	if (ipsec_len != 0) {
19936 		/*
19937 		 * We will do the rest of the processing after
19938 		 * we come back from IPSEC in ip_wput_ipsec_out().
19939 		 */
19940 		ASSERT(MBLKL(first_mp) >= sizeof (ipsec_out_t));
19941 
19942 		io = (ipsec_out_t *)first_mp->b_rptr;
19943 		io->ipsec_out_ill_index = ((ill_t *)stq->q_ptr)->
19944 				ill_phyint->phyint_ifindex;
19945 
19946 		ipsec_out_process(q, first_mp, ire, ill_index);
19947 		ire_refrele(ire);
19948 		if (conn_outgoing_ill != NULL)
19949 			ill_refrele(conn_outgoing_ill);
19950 		return;
19951 	}
19952 
19953 	/*
19954 	 * In most cases, the emission loop below is entered only
19955 	 * once. Only in the case where the ire holds the
19956 	 * RTF_MULTIRT flag, do we loop to process all RTF_MULTIRT
19957 	 * flagged ires in the bucket, and send the packet
19958 	 * through all crossed RTF_MULTIRT routes.
19959 	 */
19960 	if (ire->ire_flags & RTF_MULTIRT) {
19961 		multirt_send = B_TRUE;
19962 	}
19963 	do {
19964 		if (multirt_send) {
19965 			irb_t *irb;
19966 			/*
19967 			 * We are in a multiple send case, need to get
19968 			 * the next ire and make a duplicate of the packet.
19969 			 * ire1 holds here the next ire to process in the
19970 			 * bucket. If multirouting is expected,
19971 			 * any non-RTF_MULTIRT ire that has the
19972 			 * right destination address is ignored.
19973 			 */
19974 			irb = ire->ire_bucket;
19975 			ASSERT(irb != NULL);
19976 
19977 			IRB_REFHOLD(irb);
19978 			for (ire1 = ire->ire_next;
19979 			    ire1 != NULL;
19980 			    ire1 = ire1->ire_next) {
19981 				if ((ire1->ire_flags & RTF_MULTIRT) == 0)
19982 					continue;
19983 				if (ire1->ire_addr != ire->ire_addr)
19984 					continue;
19985 				if (ire1->ire_marks &
19986 				    (IRE_MARK_CONDEMNED | IRE_MARK_HIDDEN))
19987 					continue;
19988 
19989 				/* Got one */
19990 				IRE_REFHOLD(ire1);
19991 				break;
19992 			}
19993 			IRB_REFRELE(irb);
19994 
19995 			if (ire1 != NULL) {
19996 				next_mp = copyb(mp);
19997 				if ((next_mp == NULL) ||
19998 				    ((mp->b_cont != NULL) &&
19999 				    ((next_mp->b_cont =
20000 				    dupmsg(mp->b_cont)) == NULL))) {
20001 					freemsg(next_mp);
20002 					next_mp = NULL;
20003 					ire_refrele(ire1);
20004 					ire1 = NULL;
20005 				}
20006 			}
20007 
20008 			/* Last multiroute ire; don't loop anymore. */
20009 			if (ire1 == NULL) {
20010 				multirt_send = B_FALSE;
20011 			}
20012 		}
20013 		mp = ip_wput_attach_llhdr(mp, ire, IPP_LOCAL_OUT, ill_index);
20014 		if (mp == NULL) {
20015 			BUMP_MIB(&ip_mib, ipOutDiscards);
20016 			ip2dbg(("ip_wput_ire: fastpath wput pkt dropped "\
20017 			    "during IPPF processing\n"));
20018 			ire_refrele(ire);
20019 			if (next_mp != NULL) {
20020 				freemsg(next_mp);
20021 				ire_refrele(ire1);
20022 			}
20023 			if (conn_outgoing_ill != NULL)
20024 				ill_refrele(conn_outgoing_ill);
20025 			return;
20026 		}
20027 		UPDATE_OB_PKT_COUNT(ire);
20028 		ire->ire_last_used_time = lbolt;
20029 
20030 		TRACE_2(TR_FAC_IP, TR_IP_WPUT_IRE_END,
20031 		    "ip_wput_ire_end: q %p (%S)",
20032 		    q, "last copy out");
20033 		putnext(stq, mp);
20034 		IRE_REFRELE(ire);
20035 
20036 		if (multirt_send) {
20037 			ASSERT(ire1);
20038 			/*
20039 			 * Proceed with the next RTF_MULTIRT ire,
20040 			 * Also set up the send-to queue accordingly.
20041 			 */
20042 			ire = ire1;
20043 			ire1 = NULL;
20044 			stq = ire->ire_stq;
20045 			mp = next_mp;
20046 			next_mp = NULL;
20047 			ipha = (ipha_t *)mp->b_rptr;
20048 			ill_index = Q_TO_INDEX(stq);
20049 		}
20050 	} while (multirt_send);
20051 	if (conn_outgoing_ill != NULL)
20052 		ill_refrele(conn_outgoing_ill);
20053 	return;
20054 
20055 	/*
20056 	 * ire->ire_type == IRE_BROADCAST (minimize diffs)
20057 	 */
20058 broadcast:
20059 	{
20060 		/*
20061 		 * Avoid broadcast storms by setting the ttl to 1
20062 		 * for broadcasts. This parameter can be set
20063 		 * via ndd, so make sure that for the SO_DONTROUTE
20064 		 * case that ipha_ttl is always set to 1.
20065 		 * In the event that we are replying to incoming
20066 		 * ICMP packets, conn could be NULL.
20067 		 */
20068 		if ((connp != NULL) && connp->conn_dontroute)
20069 			ipha->ipha_ttl = 1;
20070 		else
20071 			ipha->ipha_ttl = ip_broadcast_ttl;
20072 
20073 		/*
20074 		 * Note that we are not doing a IRB_REFHOLD here.
20075 		 * Actually we don't care if the list changes i.e
20076 		 * if somebody deletes an IRE from the list while
20077 		 * we drop the lock, the next time we come around
20078 		 * ire_next will be NULL and hence we won't send
20079 		 * out multiple copies which is fine.
20080 		 */
20081 		rw_enter(&ire->ire_bucket->irb_lock, RW_READER);
20082 		ire1 = ire->ire_next;
20083 		if (conn_outgoing_ill != NULL) {
20084 			while (ire->ire_ipif->ipif_ill != conn_outgoing_ill) {
20085 				ASSERT(ire1 == ire->ire_next);
20086 				if (ire1 != NULL && ire1->ire_addr == dst) {
20087 					ire_refrele(ire);
20088 					ire = ire1;
20089 					IRE_REFHOLD(ire);
20090 					ire1 = ire->ire_next;
20091 					continue;
20092 				}
20093 				rw_exit(&ire->ire_bucket->irb_lock);
20094 				/* Did not find a matching ill */
20095 				ip1dbg(("ip_wput_ire: broadcast with no "
20096 				    "matching IP_BOUND_IF ill %s\n",
20097 				    conn_outgoing_ill->ill_name));
20098 				freemsg(first_mp);
20099 				if (ire != NULL)
20100 					ire_refrele(ire);
20101 				ill_refrele(conn_outgoing_ill);
20102 				return;
20103 			}
20104 		} else if (ire1 != NULL && ire1->ire_addr == dst) {
20105 			/*
20106 			 * If the next IRE has the same address and is not one
20107 			 * of the two copies that we need to send, try to see
20108 			 * whether this copy should be sent at all. This
20109 			 * assumes that we insert loopbacks first and then
20110 			 * non-loopbacks. This is acheived by inserting the
20111 			 * loopback always before non-loopback.
20112 			 * This is used to send a single copy of a broadcast
20113 			 * packet out all physical interfaces that have an
20114 			 * matching IRE_BROADCAST while also looping
20115 			 * back one copy (to ip_wput_local) for each
20116 			 * matching physical interface. However, we avoid
20117 			 * sending packets out different logical that match by
20118 			 * having ipif_up/ipif_down supress duplicate
20119 			 * IRE_BROADCASTS.
20120 			 *
20121 			 * This feature is currently used to get broadcasts
20122 			 * sent to multiple interfaces, when the broadcast
20123 			 * address being used applies to multiple interfaces.
20124 			 * For example, a whole net broadcast will be
20125 			 * replicated on every connected subnet of
20126 			 * the target net.
20127 			 *
20128 			 * Each zone has its own set of IRE_BROADCASTs, so that
20129 			 * we're able to distribute inbound packets to multiple
20130 			 * zones who share a broadcast address. We avoid looping
20131 			 * back outbound packets in different zones but on the
20132 			 * same ill, as the application would see duplicates.
20133 			 *
20134 			 * If the interfaces are part of the same group,
20135 			 * we would want to send only one copy out for
20136 			 * whole group.
20137 			 *
20138 			 * This logic assumes that ire_add_v4() groups the
20139 			 * IRE_BROADCAST entries so that those with the same
20140 			 * ire_addr and ill_group are kept together.
20141 			 */
20142 			ire_ill = ire->ire_ipif->ipif_ill;
20143 			if (ire->ire_stq == NULL && ire1->ire_stq != NULL) {
20144 				if (ire_ill->ill_group != NULL &&
20145 				    (ire->ire_marks & IRE_MARK_NORECV)) {
20146 					/*
20147 					 * If the current zone only has an ire
20148 					 * broadcast for this address marked
20149 					 * NORECV, the ire we want is ahead in
20150 					 * the bucket, so we look it up
20151 					 * deliberately ignoring the zoneid.
20152 					 */
20153 					for (ire1 = ire->ire_bucket->irb_ire;
20154 					    ire1 != NULL;
20155 					    ire1 = ire1->ire_next) {
20156 						ire1_ill =
20157 						    ire1->ire_ipif->ipif_ill;
20158 						if (ire1->ire_addr != dst)
20159 							continue;
20160 						/* skip over the current ire */
20161 						if (ire1 == ire)
20162 							continue;
20163 						/* skip over deleted ires */
20164 						if (ire1->ire_marks &
20165 						    IRE_MARK_CONDEMNED)
20166 							continue;
20167 						/*
20168 						 * non-loopback ire in our
20169 						 * group: use it for the next
20170 						 * pass in the loop
20171 						 */
20172 						if (ire1->ire_stq != NULL &&
20173 						    ire1_ill->ill_group ==
20174 						    ire_ill->ill_group)
20175 							break;
20176 					}
20177 				}
20178 			} else {
20179 				while (ire1 != NULL && ire1->ire_addr == dst) {
20180 					ire1_ill = ire1->ire_ipif->ipif_ill;
20181 					/*
20182 					 * We can have two broadcast ires on the
20183 					 * same ill in different zones; here
20184 					 * we'll send a copy of the packet on
20185 					 * each ill and the fanout code will
20186 					 * call conn_wantpacket() to check that
20187 					 * the zone has the broadcast address
20188 					 * configured on the ill. If the two
20189 					 * ires are in the same group we only
20190 					 * send one copy up.
20191 					 */
20192 					if (ire1_ill != ire_ill &&
20193 					    (ire1_ill->ill_group == NULL ||
20194 					    ire_ill->ill_group == NULL ||
20195 					    ire1_ill->ill_group !=
20196 					    ire_ill->ill_group)) {
20197 						break;
20198 					}
20199 					ire1 = ire1->ire_next;
20200 				}
20201 			}
20202 		}
20203 		ASSERT(multirt_send == B_FALSE);
20204 		if (ire1 != NULL && ire1->ire_addr == dst) {
20205 			if ((ire->ire_flags & RTF_MULTIRT) &&
20206 			    (ire1->ire_flags & RTF_MULTIRT)) {
20207 				/*
20208 				 * We are in the multirouting case.
20209 				 * The message must be sent at least
20210 				 * on both ires. These ires have been
20211 				 * inserted AFTER the standard ones
20212 				 * in ip_rt_add(). There are thus no
20213 				 * other ire entries for the destination
20214 				 * address in the rest of the bucket
20215 				 * that do not have the RTF_MULTIRT
20216 				 * flag. We don't process a copy
20217 				 * of the message here. This will be
20218 				 * done in the final sending loop.
20219 				 */
20220 				multirt_send = B_TRUE;
20221 			} else {
20222 				next_mp = ip_copymsg(first_mp);
20223 				if (next_mp != NULL)
20224 					IRE_REFHOLD(ire1);
20225 			}
20226 		}
20227 		rw_exit(&ire->ire_bucket->irb_lock);
20228 	}
20229 
20230 	if (stq) {
20231 		/*
20232 		 * A non-NULL send-to queue means this packet is going
20233 		 * out of this machine.
20234 		 */
20235 
20236 		BUMP_MIB(&ip_mib, ipOutRequests);
20237 		ttl_protocol = ((uint16_t *)ipha)[4];
20238 		/*
20239 		 * We accumulate the pseudo header checksum in cksum.
20240 		 * This is pretty hairy code, so watch close.  One
20241 		 * thing to keep in mind is that UDP and TCP have
20242 		 * stored their respective datagram lengths in their
20243 		 * checksum fields.  This lines things up real nice.
20244 		 */
20245 		cksum = (dst >> 16) + (dst & 0xFFFF) +
20246 		    (src >> 16) + (src & 0xFFFF);
20247 		/*
20248 		 * We assume the udp checksum field contains the
20249 		 * length, so to compute the pseudo header checksum,
20250 		 * all we need is the protocol number and src/dst.
20251 		 */
20252 		/* Provide the checksums for UDP and TCP. */
20253 		if ((PROTO == IPPROTO_TCP) &&
20254 		    (ip_hdr_included != IP_HDR_INCLUDED)) {
20255 			/* hlen gets the number of uchar_ts in the IP header */
20256 			hlen = (V_HLEN & 0xF) << 2;
20257 			up = IPH_TCPH_CHECKSUMP(ipha, hlen);
20258 			IP_STAT(ip_out_sw_cksum);
20259 			*up = IP_CSUM(mp, hlen, cksum + IP_TCP_CSUM_COMP);
20260 		} else if (PROTO == IPPROTO_SCTP &&
20261 		    (ip_hdr_included != IP_HDR_INCLUDED)) {
20262 			sctp_hdr_t	*sctph;
20263 
20264 			hlen = (V_HLEN & 0xF) << 2;
20265 			ASSERT(MBLKL(mp) >= (hlen + sizeof (*sctph)));
20266 			sctph = (sctp_hdr_t *)(mp->b_rptr + hlen);
20267 			sctph->sh_chksum = 0;
20268 #ifdef	DEBUG
20269 			if (!skip_sctp_cksum)
20270 #endif
20271 				sctph->sh_chksum = sctp_cksum(mp, hlen);
20272 		} else {
20273 			queue_t *dev_q = stq->q_next;
20274 
20275 			if ((dev_q->q_next || dev_q->q_first) &&
20276 			    !canput(dev_q)) {
20277 			    blocked:
20278 				ipha->ipha_ident = ip_hdr_included;
20279 				/*
20280 				 * If we don't have a conn to apply
20281 				 * backpressure, free the message.
20282 				 * In the ire_send path, we don't know
20283 				 * the position to requeue the packet. Rather
20284 				 * than reorder packets, we just drop this
20285 				 * packet.
20286 				 */
20287 				if (ip_output_queue && connp != NULL &&
20288 				    caller != IRE_SEND) {
20289 					if (caller == IP_WSRV) {
20290 						connp->conn_did_putbq = 1;
20291 						(void) putbq(connp->conn_wq,
20292 						    first_mp);
20293 						conn_drain_insert(connp);
20294 						/*
20295 						 * This is the service thread,
20296 						 * and the queue is already
20297 						 * noenabled. The check for
20298 						 * canput and the putbq is not
20299 						 * atomic. So we need to check
20300 						 * again.
20301 						 */
20302 						if (canput(stq->q_next))
20303 							connp->conn_did_putbq
20304 							    = 0;
20305 						IP_STAT(ip_conn_flputbq);
20306 					} else {
20307 						/*
20308 						 * We are not the service proc.
20309 						 * ip_wsrv will be scheduled or
20310 						 * is already running.
20311 						 */
20312 						(void) putq(connp->conn_wq,
20313 						    first_mp);
20314 					}
20315 				} else {
20316 					BUMP_MIB(&ip_mib, ipOutDiscards);
20317 					freemsg(first_mp);
20318 					TRACE_2(TR_FAC_IP, TR_IP_WPUT_IRE_END,
20319 					    "ip_wput_ire_end: q %p (%S)",
20320 					    q, "discard");
20321 				}
20322 				ire_refrele(ire);
20323 				if (next_mp) {
20324 					ire_refrele(ire1);
20325 					freemsg(next_mp);
20326 				}
20327 				if (conn_outgoing_ill != NULL)
20328 					ill_refrele(conn_outgoing_ill);
20329 				return;
20330 			}
20331 			if ((PROTO == IPPROTO_UDP) &&
20332 			    (ip_hdr_included != IP_HDR_INCLUDED)) {
20333 				/*
20334 				 * hlen gets the number of uchar_ts in the
20335 				 * IP header
20336 				 */
20337 				hlen = (V_HLEN & 0xF) << 2;
20338 				up = IPH_UDPH_CHECKSUMP(ipha, hlen);
20339 				if (*up) {
20340 					uint_t	sum;
20341 
20342 					/*
20343 					 * NOTE: watch out for compiler high
20344 					 * bits
20345 					 */
20346 					IP_STAT(ip_out_sw_cksum);
20347 					sum = IP_CSUM(mp, hlen,
20348 					    cksum + IP_UDP_CSUM_COMP);
20349 					*up = (uint16_t)(sum ? sum : ~sum);
20350 				}
20351 			}
20352 		}
20353 		/*
20354 		 * Need to do this even when fragmenting. The local
20355 		 * loopback can be done without computing checksums
20356 		 * but forwarding out other interface must be done
20357 		 * after the IP checksum (and ULP checksums) have been
20358 		 * computed.
20359 		 *
20360 		 * NOTE : multicast_forward is set only if this packet
20361 		 * originated from ip_wput. For packets originating from
20362 		 * ip_wput_multicast, it is not set.
20363 		 */
20364 		if (CLASSD(ipha->ipha_dst) && multicast_forward) {
20365 		    multi_loopback:
20366 			ip2dbg(("ip_wput: multicast, loop %d\n",
20367 			    conn_multicast_loop));
20368 
20369 			/*  Forget header checksum offload */
20370 			mp->b_datap->db_struioun.cksum.flags &=
20371 			    ~HCK_IPV4_HDRCKSUM;
20372 			iphdrhwcksum = B_FALSE;
20373 
20374 			/*
20375 			 * Local loopback of multicasts?  Check the
20376 			 * ill.
20377 			 *
20378 			 * Note that the loopback function will not come
20379 			 * in through ip_rput - it will only do the
20380 			 * client fanout thus we need to do an mforward
20381 			 * as well.  The is different from the BSD
20382 			 * logic.
20383 			 */
20384 			if (ill != NULL) {
20385 				ilm_t	*ilm;
20386 
20387 				ILM_WALKER_HOLD(ill);
20388 				ilm = ilm_lookup_ill(ill, ipha->ipha_dst,
20389 				    ALL_ZONES);
20390 				ILM_WALKER_RELE(ill);
20391 				if (ilm != NULL) {
20392 					/*
20393 					 * Pass along the virtual output q.
20394 					 * ip_wput_local() will distribute the
20395 					 * packet to all the matching zones,
20396 					 * except the sending zone when
20397 					 * IP_MULTICAST_LOOP is false.
20398 					 */
20399 					ip_multicast_loopback(q, ill, first_mp,
20400 					    conn_multicast_loop ? 0 :
20401 					    IP_FF_NO_MCAST_LOOP, zoneid);
20402 				}
20403 			}
20404 			if (ipha->ipha_ttl == 0) {
20405 				/*
20406 				 * 0 => only to this host i.e. we are
20407 				 * done. We are also done if this was the
20408 				 * loopback interface since it is sufficient
20409 				 * to loopback one copy of a multicast packet.
20410 				 */
20411 				freemsg(first_mp);
20412 				TRACE_2(TR_FAC_IP, TR_IP_WPUT_IRE_END,
20413 				    "ip_wput_ire_end: q %p (%S)",
20414 				    q, "loopback");
20415 				ire_refrele(ire);
20416 				if (conn_outgoing_ill != NULL)
20417 					ill_refrele(conn_outgoing_ill);
20418 				return;
20419 			}
20420 			/*
20421 			 * ILLF_MULTICAST is checked in ip_newroute
20422 			 * i.e. we don't need to check it here since
20423 			 * all IRE_CACHEs come from ip_newroute.
20424 			 * For multicast traffic, SO_DONTROUTE is interpreted
20425 			 * to mean only send the packet out the interface
20426 			 * (optionally specified with IP_MULTICAST_IF)
20427 			 * and do not forward it out additional interfaces.
20428 			 * RSVP and the rsvp daemon is an example of a
20429 			 * protocol and user level process that
20430 			 * handles it's own routing. Hence, it uses the
20431 			 * SO_DONTROUTE option to accomplish this.
20432 			 */
20433 
20434 			if (ip_g_mrouter && !conn_dontroute && ill != NULL) {
20435 				/* Unconditionally redo the checksum */
20436 				ipha->ipha_hdr_checksum = 0;
20437 				ipha->ipha_hdr_checksum = ip_csum_hdr(ipha);
20438 
20439 				/*
20440 				 * If this needs to go out secure, we need
20441 				 * to wait till we finish the IPSEC
20442 				 * processing.
20443 				 */
20444 				if (ipsec_len == 0 &&
20445 				    ip_mforward(ill, ipha, mp)) {
20446 					freemsg(first_mp);
20447 					ip1dbg(("ip_wput: mforward failed\n"));
20448 					TRACE_2(TR_FAC_IP, TR_IP_WPUT_IRE_END,
20449 					    "ip_wput_ire_end: q %p (%S)",
20450 					    q, "mforward failed");
20451 					ire_refrele(ire);
20452 					if (conn_outgoing_ill != NULL)
20453 						ill_refrele(conn_outgoing_ill);
20454 					return;
20455 				}
20456 			}
20457 		}
20458 		max_frag = ire->ire_max_frag;
20459 		cksum += ttl_protocol;
20460 		if (!FRAGMENT_NEEDED(max_frag, (LENGTH + ipsec_len))) {
20461 			/* No fragmentation required for this one. */
20462 			/* Complete the IP header checksum. */
20463 			cksum += ipha->ipha_ident;
20464 			/*
20465 			 * Don't use frag_flag if packet is pre-built or source
20466 			 * routed or if multicast (since multicast packets do
20467 			 * not solicit ICMP "packet too big" messages).
20468 			 */
20469 			if ((ip_hdr_included != IP_HDR_INCLUDED) &&
20470 			    (V_HLEN == IP_SIMPLE_HDR_VERSION ||
20471 			    !ip_source_route_included(ipha)) &&
20472 			    !CLASSD(ipha->ipha_dst))
20473 				ipha->ipha_fragment_offset_and_flags |=
20474 				    htons(ire->ire_frag_flag);
20475 
20476 			cksum += (v_hlen_tos_len >> 16)+
20477 			    (v_hlen_tos_len & 0xFFFF);
20478 			cksum += ipha->ipha_fragment_offset_and_flags;
20479 			hlen = (V_HLEN & 0xF) - IP_SIMPLE_HDR_LENGTH_IN_WORDS;
20480 			if (hlen) {
20481 			    checksumoptions:
20482 				/*
20483 				 * Account for the IP Options in the IP
20484 				 * header checksum.
20485 				 */
20486 				up = (uint16_t *)(rptr+IP_SIMPLE_HDR_LENGTH);
20487 				do {
20488 					cksum += up[0];
20489 					cksum += up[1];
20490 					up += 2;
20491 				} while (--hlen);
20492 			}
20493 			cksum = ((cksum & 0xFFFF) + (cksum >> 16));
20494 			cksum = ~(cksum + (cksum >> 16));
20495 			ipha->ipha_hdr_checksum = (uint16_t)cksum;
20496 			if (ipsec_len != 0) {
20497 				ipsec_out_process(q, first_mp, ire, ill_index);
20498 				if (!next_mp) {
20499 					ire_refrele(ire);
20500 					if (conn_outgoing_ill != NULL)
20501 						ill_refrele(conn_outgoing_ill);
20502 					return;
20503 				}
20504 				goto next;
20505 			}
20506 
20507 			/*
20508 			 * multirt_send has already been handled
20509 			 * for broadcast, but not yet for multicast
20510 			 * or IP options.
20511 			 */
20512 			if (next_mp == NULL) {
20513 				if (ire->ire_flags & RTF_MULTIRT) {
20514 					multirt_send = B_TRUE;
20515 				}
20516 			}
20517 
20518 			/*
20519 			 * In most cases, the emission loop below is
20520 			 * entered only once. Only in the case where
20521 			 * the ire holds the RTF_MULTIRT flag, do we loop
20522 			 * to process all RTF_MULTIRT ires in the bucket,
20523 			 * and send the packet through all crossed
20524 			 * RTF_MULTIRT routes.
20525 			 */
20526 			do {
20527 				if (multirt_send) {
20528 					irb_t *irb;
20529 
20530 					irb = ire->ire_bucket;
20531 					ASSERT(irb != NULL);
20532 					/*
20533 					 * We are in a multiple send case,
20534 					 * need to get the next IRE and make
20535 					 * a duplicate of the packet.
20536 					 */
20537 					IRB_REFHOLD(irb);
20538 					for (ire1 = ire->ire_next;
20539 					    ire1 != NULL;
20540 					    ire1 = ire1->ire_next) {
20541 						if (!(ire1->ire_flags &
20542 						    RTF_MULTIRT))
20543 							continue;
20544 						if (ire1->ire_addr !=
20545 						    ire->ire_addr)
20546 							continue;
20547 						if (ire1->ire_marks &
20548 						    (IRE_MARK_CONDEMNED|
20549 							IRE_MARK_HIDDEN))
20550 							continue;
20551 
20552 						/* Got one */
20553 						IRE_REFHOLD(ire1);
20554 						break;
20555 					}
20556 					IRB_REFRELE(irb);
20557 
20558 					if (ire1 != NULL) {
20559 						next_mp = copyb(mp);
20560 						if ((next_mp == NULL) ||
20561 						    ((mp->b_cont != NULL) &&
20562 						    ((next_mp->b_cont =
20563 						    dupmsg(mp->b_cont))
20564 						    == NULL))) {
20565 							freemsg(next_mp);
20566 							next_mp = NULL;
20567 							ire_refrele(ire1);
20568 							ire1 = NULL;
20569 						}
20570 					}
20571 
20572 					/*
20573 					 * Last multiroute ire; don't loop
20574 					 * anymore. The emission is over
20575 					 * and next_mp is NULL.
20576 					 */
20577 					if (ire1 == NULL) {
20578 						multirt_send = B_FALSE;
20579 					}
20580 				}
20581 
20582 			noprepend:
20583 				ASSERT(ipsec_len == 0);
20584 				mp1 = ip_wput_attach_llhdr(mp, ire,
20585 				    IPP_LOCAL_OUT, ill_index);
20586 				if (mp1 == NULL) {
20587 					BUMP_MIB(&ip_mib, ipOutDiscards);
20588 					if (next_mp) {
20589 						freemsg(next_mp);
20590 						ire_refrele(ire1);
20591 					}
20592 					ire_refrele(ire);
20593 					TRACE_2(TR_FAC_IP, TR_IP_WPUT_IRE_END,
20594 					    "ip_wput_ire_end: q %p (%S)",
20595 					    q, "discard MDATA");
20596 					if (conn_outgoing_ill != NULL)
20597 						ill_refrele(conn_outgoing_ill);
20598 					return;
20599 				}
20600 				UPDATE_OB_PKT_COUNT(ire);
20601 				ire->ire_last_used_time = lbolt;
20602 
20603 				if (multirt_send) {
20604 					/*
20605 					 * We are in a multiple send case,
20606 					 * need to re-enter the sending loop
20607 					 * using the next ire.
20608 					 */
20609 					putnext(stq, mp1);
20610 					ire_refrele(ire);
20611 					ire = ire1;
20612 					stq = ire->ire_stq;
20613 					mp = next_mp;
20614 					next_mp = NULL;
20615 					ipha = (ipha_t *)mp->b_rptr;
20616 					ill_index = Q_TO_INDEX(stq);
20617 				}
20618 			} while (multirt_send);
20619 
20620 			if (!next_mp) {
20621 				/*
20622 				 * Last copy going out (the ultra-common
20623 				 * case).  Note that we intentionally replicate
20624 				 * the putnext rather than calling it before
20625 				 * the next_mp check in hopes of a little
20626 				 * tail-call action out of the compiler.
20627 				 */
20628 				TRACE_2(TR_FAC_IP, TR_IP_WPUT_IRE_END,
20629 				    "ip_wput_ire_end: q %p (%S)",
20630 				    q, "last copy out(1)");
20631 				putnext(stq, mp1);
20632 				ire_refrele(ire);
20633 				if (conn_outgoing_ill != NULL)
20634 					ill_refrele(conn_outgoing_ill);
20635 				return;
20636 			}
20637 			/* More copies going out below. */
20638 			putnext(stq, mp1);
20639 		} else {
20640 			int offset;
20641 		    fragmentit:
20642 			offset = ntohs(ipha->ipha_fragment_offset_and_flags);
20643 			/*
20644 			 * If this would generate a icmp_frag_needed message,
20645 			 * we need to handle it before we do the IPSEC
20646 			 * processing. Otherwise, we need to strip the IPSEC
20647 			 * headers before we send up the message to the ULPs
20648 			 * which becomes messy and difficult.
20649 			 */
20650 			if (ipsec_len != 0) {
20651 				if ((max_frag < (unsigned int)(LENGTH +
20652 				    ipsec_len)) && (offset & IPH_DF)) {
20653 
20654 					BUMP_MIB(&ip_mib, ipFragFails);
20655 					ipha->ipha_hdr_checksum = 0;
20656 					ipha->ipha_hdr_checksum =
20657 					    (uint16_t)ip_csum_hdr(ipha);
20658 					icmp_frag_needed(ire->ire_stq, first_mp,
20659 					    max_frag);
20660 					if (!next_mp) {
20661 						ire_refrele(ire);
20662 						if (conn_outgoing_ill != NULL) {
20663 							ill_refrele(
20664 							    conn_outgoing_ill);
20665 						}
20666 						return;
20667 					}
20668 				} else {
20669 					/*
20670 					 * This won't cause a icmp_frag_needed
20671 					 * message. to be gnerated. Send it on
20672 					 * the wire. Note that this could still
20673 					 * cause fragmentation and all we
20674 					 * do is the generation of the message
20675 					 * to the ULP if needed before IPSEC.
20676 					 */
20677 					if (!next_mp) {
20678 						ipsec_out_process(q, first_mp,
20679 						    ire, ill_index);
20680 						TRACE_2(TR_FAC_IP,
20681 						    TR_IP_WPUT_IRE_END,
20682 						    "ip_wput_ire_end: q %p "
20683 						    "(%S)", q,
20684 						    "last ipsec_out_process");
20685 						ire_refrele(ire);
20686 						if (conn_outgoing_ill != NULL) {
20687 							ill_refrele(
20688 							    conn_outgoing_ill);
20689 						}
20690 						return;
20691 					}
20692 					ipsec_out_process(q, first_mp,
20693 					    ire, ill_index);
20694 				}
20695 			} else {
20696 				/* Initiate IPPF processing */
20697 				if (IPP_ENABLED(IPP_LOCAL_OUT)) {
20698 					ip_process(IPP_LOCAL_OUT, &mp,
20699 					    ill_index);
20700 					if (mp == NULL) {
20701 						BUMP_MIB(&ip_mib,
20702 						    ipOutDiscards);
20703 						if (next_mp != NULL) {
20704 							freemsg(next_mp);
20705 							ire_refrele(ire1);
20706 						}
20707 						ire_refrele(ire);
20708 						TRACE_2(TR_FAC_IP,
20709 						    TR_IP_WPUT_IRE_END,
20710 						    "ip_wput_ire: q %p (%S)",
20711 						    q, "discard MDATA");
20712 						if (conn_outgoing_ill != NULL) {
20713 							ill_refrele(
20714 							    conn_outgoing_ill);
20715 						}
20716 						return;
20717 					}
20718 				}
20719 				if (!next_mp) {
20720 					TRACE_2(TR_FAC_IP, TR_IP_WPUT_IRE_END,
20721 					    "ip_wput_ire_end: q %p (%S)",
20722 					    q, "last fragmentation");
20723 					ip_wput_ire_fragmentit(mp, ire);
20724 					ire_refrele(ire);
20725 					if (conn_outgoing_ill != NULL)
20726 						ill_refrele(conn_outgoing_ill);
20727 					return;
20728 				}
20729 				ip_wput_ire_fragmentit(mp, ire);
20730 			}
20731 		}
20732 	} else {
20733 	    nullstq:
20734 		/* A NULL stq means the destination address is local. */
20735 		UPDATE_OB_PKT_COUNT(ire);
20736 		ire->ire_last_used_time = lbolt;
20737 		ASSERT(ire->ire_ipif != NULL);
20738 		if (!next_mp) {
20739 			TRACE_2(TR_FAC_IP, TR_IP_WPUT_IRE_END,
20740 			    "ip_wput_ire_end: q %p (%S)",
20741 			    q, "local address");
20742 			ip_wput_local(q, ire->ire_ipif->ipif_ill, ipha,
20743 			    first_mp, ire, 0, ire->ire_zoneid);
20744 			ire_refrele(ire);
20745 			if (conn_outgoing_ill != NULL)
20746 				ill_refrele(conn_outgoing_ill);
20747 			return;
20748 		}
20749 		ip_wput_local(q, ire->ire_ipif->ipif_ill, ipha, first_mp,
20750 		    ire, 0, ire->ire_zoneid);
20751 	}
20752 next:
20753 	/*
20754 	 * More copies going out to additional interfaces.
20755 	 * ire1 has already been held. We don't need the
20756 	 * "ire" anymore.
20757 	 */
20758 	ire_refrele(ire);
20759 	ire = ire1;
20760 	ASSERT(ire != NULL && ire->ire_refcnt >= 1 && next_mp != NULL);
20761 	mp = next_mp;
20762 	ASSERT(ire->ire_ipversion == IPV4_VERSION);
20763 	ill = ire_to_ill(ire);
20764 	first_mp = mp;
20765 	if (ipsec_len != 0) {
20766 		ASSERT(first_mp->b_datap->db_type == M_CTL);
20767 		mp = mp->b_cont;
20768 	}
20769 	dst = ire->ire_addr;
20770 	ipha = (ipha_t *)mp->b_rptr;
20771 	/*
20772 	 * Restore src so that we will pick up ire->ire_src_addr if src was 0.
20773 	 * Restore ipha_ident "no checksum" flag.
20774 	 */
20775 	src = orig_src;
20776 	ipha->ipha_ident = ip_hdr_included;
20777 	goto another;
20778 
20779 #undef	rptr
20780 #undef	Q_TO_INDEX
20781 }
20782 
20783 /*
20784  * Routine to allocate a message that is used to notify the ULP about MDT.
20785  * The caller may provide a pointer to the link-layer MDT capabilities,
20786  * or NULL if MDT is to be disabled on the stream.
20787  */
20788 mblk_t *
20789 ip_mdinfo_alloc(ill_mdt_capab_t *isrc)
20790 {
20791 	mblk_t *mp;
20792 	ip_mdt_info_t *mdti;
20793 	ill_mdt_capab_t *idst;
20794 
20795 	if ((mp = allocb(sizeof (*mdti), BPRI_HI)) != NULL) {
20796 		DB_TYPE(mp) = M_CTL;
20797 		mp->b_wptr = mp->b_rptr + sizeof (*mdti);
20798 		mdti = (ip_mdt_info_t *)mp->b_rptr;
20799 		mdti->mdt_info_id = MDT_IOC_INFO_UPDATE;
20800 		idst = &(mdti->mdt_capab);
20801 
20802 		/*
20803 		 * If the caller provides us with the capability, copy
20804 		 * it over into our notification message; otherwise
20805 		 * we zero out the capability portion.
20806 		 */
20807 		if (isrc != NULL)
20808 			bcopy((caddr_t)isrc, (caddr_t)idst, sizeof (*idst));
20809 		else
20810 			bzero((caddr_t)idst, sizeof (*idst));
20811 	}
20812 	return (mp);
20813 }
20814 
20815 /*
20816  * Routine which determines whether MDT can be enabled on the destination
20817  * IRE and IPC combination, and if so, allocates and returns the MDT
20818  * notification mblk that may be used by ULP.  We also check if we need to
20819  * turn MDT back to 'on' when certain restrictions prohibiting us to allow
20820  * MDT usage in the past have been lifted.  This gets called during IP
20821  * and ULP binding.
20822  */
20823 mblk_t *
20824 ip_mdinfo_return(ire_t *dst_ire, conn_t *connp, char *ill_name,
20825     ill_mdt_capab_t *mdt_cap)
20826 {
20827 	mblk_t *mp;
20828 	boolean_t rc = B_FALSE;
20829 
20830 	ASSERT(dst_ire != NULL);
20831 	ASSERT(connp != NULL);
20832 	ASSERT(mdt_cap != NULL);
20833 
20834 	/*
20835 	 * Currently, we only support simple TCP/{IPv4,IPv6} with
20836 	 * Multidata, which is handled in tcp_multisend().  This
20837 	 * is the reason why we do all these checks here, to ensure
20838 	 * that we don't enable Multidata for the cases which we
20839 	 * can't handle at the moment.
20840 	 */
20841 	do {
20842 		/* Only do TCP at the moment */
20843 		if (connp->conn_ulp != IPPROTO_TCP)
20844 			break;
20845 
20846 		/*
20847 		 * IPSEC outbound policy present?  Note that we get here
20848 		 * after calling ipsec_conn_cache_policy() where the global
20849 		 * policy checking is performed.  conn_latch will be
20850 		 * non-NULL as long as there's a policy defined,
20851 		 * i.e. conn_out_enforce_policy may be NULL in such case
20852 		 * when the connection is non-secure, and hence we check
20853 		 * further if the latch refers to an outbound policy.
20854 		 */
20855 		if (CONN_IPSEC_OUT_ENCAPSULATED(connp))
20856 			break;
20857 
20858 		/* CGTP (multiroute) is enabled? */
20859 		if (dst_ire->ire_flags & RTF_MULTIRT)
20860 			break;
20861 
20862 		/* Outbound IPQoS enabled? */
20863 		if (IPP_ENABLED(IPP_LOCAL_OUT)) {
20864 			/*
20865 			 * In this case, we disable MDT for this and all
20866 			 * future connections going over the interface.
20867 			 */
20868 			mdt_cap->ill_mdt_on = 0;
20869 			break;
20870 		}
20871 
20872 		/* socket option(s) present? */
20873 		if (!CONN_IS_MD_FASTPATH(connp))
20874 			break;
20875 
20876 		rc = B_TRUE;
20877 	/* CONSTCOND */
20878 	} while (0);
20879 
20880 	/* Remember the result */
20881 	connp->conn_mdt_ok = rc;
20882 
20883 	if (!rc)
20884 		return (NULL);
20885 	else if (!mdt_cap->ill_mdt_on) {
20886 		/*
20887 		 * If MDT has been previously turned off in the past, and we
20888 		 * currently can do MDT (due to IPQoS policy removal, etc.)
20889 		 * then enable it for this interface.
20890 		 */
20891 		mdt_cap->ill_mdt_on = 1;
20892 		ip1dbg(("ip_mdinfo_return: reenabling MDT for "
20893 		    "interface %s\n", ill_name));
20894 	}
20895 
20896 	/* Allocate the MDT info mblk */
20897 	if ((mp = ip_mdinfo_alloc(mdt_cap)) == NULL) {
20898 		ip0dbg(("ip_mdinfo_return: can't enable Multidata for "
20899 		    "conn %p on %s (ENOMEM)\n", (void *)connp, ill_name));
20900 		return (NULL);
20901 	}
20902 	return (mp);
20903 }
20904 
20905 /*
20906  * Create destination address attribute, and fill it with the physical
20907  * destination address and SAP taken from the template DL_UNITDATA_REQ
20908  * message block.
20909  */
20910 boolean_t
20911 ip_md_addr_attr(multidata_t *mmd, pdesc_t *pd, const mblk_t *dlmp)
20912 {
20913 	dl_unitdata_req_t *dlurp;
20914 	pattr_t *pa;
20915 	pattrinfo_t pa_info;
20916 	pattr_addr_t **das = (pattr_addr_t **)&pa_info.buf;
20917 	uint_t das_len, das_off;
20918 
20919 	ASSERT(dlmp != NULL);
20920 
20921 	dlurp = (dl_unitdata_req_t *)dlmp->b_rptr;
20922 	das_len = dlurp->dl_dest_addr_length;
20923 	das_off = dlurp->dl_dest_addr_offset;
20924 
20925 	pa_info.type = PATTR_DSTADDRSAP;
20926 	pa_info.len = sizeof (**das) + das_len - 1;
20927 
20928 	/* create and associate the attribute */
20929 	pa = mmd_addpattr(mmd, pd, &pa_info, B_TRUE, KM_NOSLEEP);
20930 	if (pa != NULL) {
20931 		ASSERT(*das != NULL);
20932 		(*das)->addr_is_group = 0;
20933 		(*das)->addr_len = (uint8_t)das_len;
20934 		bcopy((caddr_t)dlurp + das_off, (*das)->addr, das_len);
20935 	}
20936 
20937 	return (pa != NULL);
20938 }
20939 
20940 /*
20941  * Create hardware checksum attribute and fill it with the values passed.
20942  */
20943 boolean_t
20944 ip_md_hcksum_attr(multidata_t *mmd, pdesc_t *pd, uint32_t start_offset,
20945     uint32_t stuff_offset, uint32_t end_offset, uint32_t flags)
20946 {
20947 	pattr_t *pa;
20948 	pattrinfo_t pa_info;
20949 
20950 	ASSERT(mmd != NULL);
20951 
20952 	pa_info.type = PATTR_HCKSUM;
20953 	pa_info.len = sizeof (pattr_hcksum_t);
20954 
20955 	/* create and associate the attribute */
20956 	pa = mmd_addpattr(mmd, pd, &pa_info, B_TRUE, KM_NOSLEEP);
20957 	if (pa != NULL) {
20958 		pattr_hcksum_t *hck = (pattr_hcksum_t *)pa_info.buf;
20959 
20960 		hck->hcksum_start_offset = start_offset;
20961 		hck->hcksum_stuff_offset = stuff_offset;
20962 		hck->hcksum_end_offset = end_offset;
20963 		hck->hcksum_flags = flags;
20964 	}
20965 	return (pa != NULL);
20966 }
20967 
20968 /*
20969  * Create zerocopy attribute and fill it with the specified flags
20970  */
20971 boolean_t
20972 ip_md_zcopy_attr(multidata_t *mmd, pdesc_t *pd, uint_t flags)
20973 {
20974 	pattr_t *pa;
20975 	pattrinfo_t pa_info;
20976 
20977 	ASSERT(mmd != NULL);
20978 	pa_info.type = PATTR_ZCOPY;
20979 	pa_info.len = sizeof (pattr_zcopy_t);
20980 
20981 	/* create and associate the attribute */
20982 	pa = mmd_addpattr(mmd, pd, &pa_info, B_TRUE, KM_NOSLEEP);
20983 	if (pa != NULL) {
20984 		pattr_zcopy_t *zcopy = (pattr_zcopy_t *)pa_info.buf;
20985 
20986 		zcopy->zcopy_flags = flags;
20987 	}
20988 	return (pa != NULL);
20989 }
20990 
20991 /*
20992  * Outbound IP fragmentation routine.
20993  *
20994  * NOTE : This routine does not ire_refrele the ire that is passed in
20995  * as the argument.
20996  */
20997 static void
20998 ip_wput_frag(ire_t *ire, mblk_t *mp_orig, ip_pkt_t pkt_type, uint32_t max_frag,
20999     uint32_t frag_flag)
21000 {
21001 	int	i1;
21002 	mblk_t	*ll_hdr_mp;
21003 	int 	ll_hdr_len;
21004 	int	hdr_len;
21005 	mblk_t	*hdr_mp;
21006 	ipha_t	*ipha;
21007 	int	ip_data_end;
21008 	int	len;
21009 	mblk_t	*mp = mp_orig;
21010 	int	offset;
21011 	queue_t	*q;
21012 	uint32_t	v_hlen_tos_len;
21013 	mblk_t	*first_mp;
21014 	boolean_t mctl_present;
21015 	mblk_t	*xmit_mp;
21016 	mblk_t	*carve_mp;
21017 	ire_t   *ire1 = NULL;
21018 	ire_t   *save_ire = NULL;
21019 	mblk_t  *next_mp = NULL;
21020 	boolean_t last_frag = B_FALSE;
21021 	boolean_t multirt_send = B_FALSE;
21022 	ire_t *first_ire = NULL;
21023 	irb_t *irb = NULL;
21024 
21025 	TRACE_0(TR_FAC_IP, TR_IP_WPUT_FRAG_START,
21026 	    "ip_wput_frag_start:");
21027 
21028 	if (mp->b_datap->db_type == M_CTL) {
21029 		first_mp = mp;
21030 		mp_orig = mp = mp->b_cont;
21031 		mctl_present = B_TRUE;
21032 	} else {
21033 		first_mp = mp;
21034 		mctl_present = B_FALSE;
21035 	}
21036 
21037 	ipha = (ipha_t *)mp->b_rptr;
21038 
21039 	/*
21040 	 * If the Don't Fragment flag is on, generate an ICMP destination
21041 	 * unreachable, fragmentation needed.
21042 	 */
21043 	offset = ntohs(ipha->ipha_fragment_offset_and_flags);
21044 	if (offset & IPH_DF) {
21045 		BUMP_MIB(&ip_mib, ipFragFails);
21046 		/*
21047 		 * Need to compute hdr checksum if called from ip_wput_ire.
21048 		 * Note that ip_rput_forward verifies the checksum before
21049 		 * calling this routine so in that case this is a noop.
21050 		 */
21051 		ipha->ipha_hdr_checksum = 0;
21052 		ipha->ipha_hdr_checksum = ip_csum_hdr(ipha);
21053 		icmp_frag_needed(ire->ire_stq, first_mp, max_frag);
21054 		TRACE_1(TR_FAC_IP, TR_IP_WPUT_FRAG_END,
21055 		    "ip_wput_frag_end:(%S)",
21056 		    "don't fragment");
21057 		return;
21058 	}
21059 	if (mctl_present)
21060 		freeb(first_mp);
21061 	/*
21062 	 * Establish the starting offset.  May not be zero if we are fragging
21063 	 * a fragment that is being forwarded.
21064 	 */
21065 	offset = offset & IPH_OFFSET;
21066 
21067 	/* TODO why is this test needed? */
21068 	v_hlen_tos_len = ((uint32_t *)ipha)[0];
21069 	if (((max_frag - LENGTH) & ~7) < 8) {
21070 		/* TODO: notify ulp somehow */
21071 		BUMP_MIB(&ip_mib, ipFragFails);
21072 		freemsg(mp);
21073 		TRACE_1(TR_FAC_IP, TR_IP_WPUT_FRAG_END,
21074 		    "ip_wput_frag_end:(%S)",
21075 		    "len < 8");
21076 		return;
21077 	}
21078 
21079 	hdr_len = (V_HLEN & 0xF) << 2;
21080 	ipha->ipha_hdr_checksum = 0;
21081 
21082 	/* Get a copy of the header for the trailing frags */
21083 	hdr_mp = ip_wput_frag_copyhdr((uchar_t *)ipha, hdr_len, offset);
21084 	if (!hdr_mp) {
21085 		BUMP_MIB(&ip_mib, ipOutDiscards);
21086 		freemsg(mp);
21087 		TRACE_1(TR_FAC_IP, TR_IP_WPUT_FRAG_END,
21088 		    "ip_wput_frag_end:(%S)",
21089 		    "couldn't copy hdr");
21090 		return;
21091 	}
21092 
21093 	/* Store the starting offset, with the MoreFrags flag. */
21094 	i1 = offset | IPH_MF | frag_flag;
21095 	ipha->ipha_fragment_offset_and_flags = htons((uint16_t)i1);
21096 
21097 	/* Establish the ending byte offset, based on the starting offset. */
21098 	offset <<= 3;
21099 	ip_data_end = offset + ntohs(ipha->ipha_length) - hdr_len;
21100 
21101 	/*
21102 	 * Establish the number of bytes maximum per frag, after putting
21103 	 * in the header.
21104 	 */
21105 	len = (max_frag - hdr_len) & ~7;
21106 
21107 	/* Store the length of the first fragment in the IP header. */
21108 	i1 = len + hdr_len;
21109 	ASSERT(i1 <= IP_MAXPACKET);
21110 	ipha->ipha_length = htons((uint16_t)i1);
21111 
21112 	/*
21113 	 * Compute the IP header checksum for the first frag.  We have to
21114 	 * watch out that we stop at the end of the header.
21115 	 */
21116 	ipha->ipha_hdr_checksum = ip_csum_hdr(ipha);
21117 
21118 	/*
21119 	 * Now carve off the first frag.  Note that this will include the
21120 	 * original IP header.
21121 	 */
21122 	if (!(mp = ip_carve_mp(&mp_orig, i1))) {
21123 		BUMP_MIB(&ip_mib, ipOutDiscards);
21124 		freeb(hdr_mp);
21125 		freemsg(mp_orig);
21126 		TRACE_1(TR_FAC_IP, TR_IP_WPUT_FRAG_END,
21127 		    "ip_wput_frag_end:(%S)",
21128 		    "couldn't carve first");
21129 		return;
21130 	}
21131 
21132 	/*
21133 	 * Multirouting case. Each fragment is replicated
21134 	 * via all non-condemned RTF_MULTIRT routes
21135 	 * currently resolved.
21136 	 * We ensure that first_ire is the first RTF_MULTIRT
21137 	 * ire in the bucket.
21138 	 */
21139 	if (ire->ire_flags & RTF_MULTIRT) {
21140 		irb = ire->ire_bucket;
21141 		ASSERT(irb != NULL);
21142 
21143 		multirt_send = B_TRUE;
21144 
21145 		/* Make sure we do not omit any multiroute ire. */
21146 		IRB_REFHOLD(irb);
21147 		for (first_ire = irb->irb_ire;
21148 		    first_ire != NULL;
21149 		    first_ire = first_ire->ire_next) {
21150 			if ((first_ire->ire_flags & RTF_MULTIRT) &&
21151 			    (first_ire->ire_addr == ire->ire_addr) &&
21152 			    !(first_ire->ire_marks &
21153 				(IRE_MARK_CONDEMNED | IRE_MARK_HIDDEN)))
21154 				break;
21155 		}
21156 
21157 		if (first_ire != NULL) {
21158 			if (first_ire != ire) {
21159 				IRE_REFHOLD(first_ire);
21160 				/*
21161 				 * Do not release the ire passed in
21162 				 * as the argument.
21163 				 */
21164 				ire = first_ire;
21165 			} else {
21166 				first_ire = NULL;
21167 			}
21168 		}
21169 		IRB_REFRELE(irb);
21170 
21171 		/*
21172 		 * Save the first ire; we will need to restore it
21173 		 * for the trailing frags.
21174 		 * We REFHOLD save_ire, as each iterated ire will be
21175 		 * REFRELEd.
21176 		 */
21177 		save_ire = ire;
21178 		IRE_REFHOLD(save_ire);
21179 	}
21180 
21181 	/*
21182 	 * First fragment emission loop.
21183 	 * In most cases, the emission loop below is entered only
21184 	 * once. Only in the case where the ire holds the RTF_MULTIRT
21185 	 * flag, do we loop to process all RTF_MULTIRT ires in the
21186 	 * bucket, and send the fragment through all crossed
21187 	 * RTF_MULTIRT routes.
21188 	 */
21189 	do {
21190 		if (ire->ire_flags & RTF_MULTIRT) {
21191 			/*
21192 			 * We are in a multiple send case, need to get
21193 			 * the next ire and make a copy of the packet.
21194 			 * ire1 holds here the next ire to process in the
21195 			 * bucket. If multirouting is expected,
21196 			 * any non-RTF_MULTIRT ire that has the
21197 			 * right destination address is ignored.
21198 			 *
21199 			 * We have to take into account the MTU of
21200 			 * each walked ire. max_frag is set by the
21201 			 * the caller and generally refers to
21202 			 * the primary ire entry. Here we ensure that
21203 			 * no route with a lower MTU will be used, as
21204 			 * fragments are carved once for all ires,
21205 			 * then replicated.
21206 			 */
21207 			ASSERT(irb != NULL);
21208 			IRB_REFHOLD(irb);
21209 			for (ire1 = ire->ire_next;
21210 			    ire1 != NULL;
21211 			    ire1 = ire1->ire_next) {
21212 				if ((ire1->ire_flags & RTF_MULTIRT) == 0)
21213 					continue;
21214 				if (ire1->ire_addr != ire->ire_addr)
21215 					continue;
21216 				if (ire1->ire_marks &
21217 				    (IRE_MARK_CONDEMNED | IRE_MARK_HIDDEN))
21218 					continue;
21219 				/*
21220 				 * Ensure we do not exceed the MTU
21221 				 * of the next route.
21222 				 */
21223 				if (ire1->ire_max_frag < max_frag) {
21224 					ip_multirt_bad_mtu(ire1, max_frag);
21225 					continue;
21226 				}
21227 
21228 				/* Got one. */
21229 				IRE_REFHOLD(ire1);
21230 				break;
21231 			}
21232 			IRB_REFRELE(irb);
21233 
21234 			if (ire1 != NULL) {
21235 				next_mp = copyb(mp);
21236 				if ((next_mp == NULL) ||
21237 				    ((mp->b_cont != NULL) &&
21238 				    ((next_mp->b_cont =
21239 				    dupmsg(mp->b_cont)) == NULL))) {
21240 					freemsg(next_mp);
21241 					next_mp = NULL;
21242 					ire_refrele(ire1);
21243 					ire1 = NULL;
21244 				}
21245 			}
21246 
21247 			/* Last multiroute ire; don't loop anymore. */
21248 			if (ire1 == NULL) {
21249 				multirt_send = B_FALSE;
21250 			}
21251 		}
21252 
21253 		ll_hdr_len = 0;
21254 		LOCK_IRE_FP_MP(ire);
21255 		ll_hdr_mp = ire->ire_fp_mp;
21256 		if (ll_hdr_mp != NULL) {
21257 			ASSERT(ll_hdr_mp->b_datap->db_type == M_DATA);
21258 			ll_hdr_len = ll_hdr_mp->b_wptr - ll_hdr_mp->b_rptr;
21259 		} else {
21260 			ll_hdr_mp = ire->ire_dlureq_mp;
21261 		}
21262 
21263 		/* If there is a transmit header, get a copy for this frag. */
21264 		/*
21265 		 * TODO: should check db_ref before calling ip_carve_mp since
21266 		 * it might give us a dup.
21267 		 */
21268 		if (!ll_hdr_mp) {
21269 			/* No xmit header. */
21270 			xmit_mp = mp;
21271 		} else if (mp->b_datap->db_ref == 1 &&
21272 		    ll_hdr_len != 0 &&
21273 		    ll_hdr_len <= mp->b_rptr - mp->b_datap->db_base) {
21274 			/* M_DATA fastpath */
21275 			mp->b_rptr -= ll_hdr_len;
21276 			bcopy(ll_hdr_mp->b_rptr, mp->b_rptr, ll_hdr_len);
21277 			xmit_mp = mp;
21278 		} else if (!(xmit_mp = copyb(ll_hdr_mp))) {
21279 			UNLOCK_IRE_FP_MP(ire);
21280 			BUMP_MIB(&ip_mib, ipOutDiscards);
21281 			freeb(hdr_mp);
21282 			freemsg(mp);
21283 			freemsg(mp_orig);
21284 			TRACE_1(TR_FAC_IP, TR_IP_WPUT_FRAG_END,
21285 			    "ip_wput_frag_end:(%S)",
21286 			    "discard");
21287 
21288 			if (multirt_send) {
21289 				ASSERT(ire1);
21290 				ASSERT(next_mp);
21291 
21292 				freemsg(next_mp);
21293 				ire_refrele(ire1);
21294 			}
21295 			if (save_ire != NULL)
21296 				IRE_REFRELE(save_ire);
21297 
21298 			if (first_ire != NULL)
21299 				ire_refrele(first_ire);
21300 			return;
21301 		} else {
21302 			xmit_mp->b_cont = mp;
21303 			/* Get priority marking, if any. */
21304 			if (DB_TYPE(xmit_mp) == M_DATA)
21305 				xmit_mp->b_band = mp->b_band;
21306 		}
21307 		UNLOCK_IRE_FP_MP(ire);
21308 		q = ire->ire_stq;
21309 		BUMP_MIB(&ip_mib, ipFragCreates);
21310 		putnext(q, xmit_mp);
21311 		if (pkt_type != OB_PKT) {
21312 			/*
21313 			 * Update the packet count of trailing
21314 			 * RTF_MULTIRT ires.
21315 			 */
21316 			UPDATE_OB_PKT_COUNT(ire);
21317 		}
21318 
21319 		if (multirt_send) {
21320 			/*
21321 			 * We are in a multiple send case; look for
21322 			 * the next ire and re-enter the loop.
21323 			 */
21324 			ASSERT(ire1);
21325 			ASSERT(next_mp);
21326 			/* REFRELE the current ire before looping */
21327 			ire_refrele(ire);
21328 			ire = ire1;
21329 			ire1 = NULL;
21330 			mp = next_mp;
21331 			next_mp = NULL;
21332 		}
21333 	} while (multirt_send);
21334 
21335 	ASSERT(ire1 == NULL);
21336 
21337 	/* Restore the original ire; we need it for the trailing frags */
21338 	if (save_ire != NULL) {
21339 		/* REFRELE the last iterated ire */
21340 		ire_refrele(ire);
21341 		/* save_ire has been REFHOLDed */
21342 		ire = save_ire;
21343 		save_ire = NULL;
21344 		q = ire->ire_stq;
21345 	}
21346 
21347 	if (pkt_type == OB_PKT) {
21348 		UPDATE_OB_PKT_COUNT(ire);
21349 	} else {
21350 		UPDATE_IB_PKT_COUNT(ire);
21351 	}
21352 
21353 	/* Advance the offset to the second frag starting point. */
21354 	offset += len;
21355 	/*
21356 	 * Update hdr_len from the copied header - there might be less options
21357 	 * in the later fragments.
21358 	 */
21359 	hdr_len = IPH_HDR_LENGTH(hdr_mp->b_rptr);
21360 	/* Loop until done. */
21361 	for (;;) {
21362 		uint16_t	offset_and_flags;
21363 		uint16_t	ip_len;
21364 
21365 		if (ip_data_end - offset > len) {
21366 			/*
21367 			 * Carve off the appropriate amount from the original
21368 			 * datagram.
21369 			 */
21370 			if (!(carve_mp = ip_carve_mp(&mp_orig, len))) {
21371 				mp = NULL;
21372 				break;
21373 			}
21374 			/*
21375 			 * More frags after this one.  Get another copy
21376 			 * of the header.
21377 			 */
21378 			if (carve_mp->b_datap->db_ref == 1 &&
21379 			    hdr_mp->b_wptr - hdr_mp->b_rptr <
21380 			    carve_mp->b_rptr - carve_mp->b_datap->db_base) {
21381 				/* Inline IP header */
21382 				carve_mp->b_rptr -= hdr_mp->b_wptr -
21383 				    hdr_mp->b_rptr;
21384 				bcopy(hdr_mp->b_rptr, carve_mp->b_rptr,
21385 				    hdr_mp->b_wptr - hdr_mp->b_rptr);
21386 				mp = carve_mp;
21387 			} else {
21388 				if (!(mp = copyb(hdr_mp))) {
21389 					freemsg(carve_mp);
21390 					break;
21391 				}
21392 				/* Get priority marking, if any. */
21393 				mp->b_band = carve_mp->b_band;
21394 				mp->b_cont = carve_mp;
21395 			}
21396 			ipha = (ipha_t *)mp->b_rptr;
21397 			offset_and_flags = IPH_MF;
21398 		} else {
21399 			/*
21400 			 * Last frag.  Consume the header. Set len to
21401 			 * the length of this last piece.
21402 			 */
21403 			len = ip_data_end - offset;
21404 
21405 			/*
21406 			 * Carve off the appropriate amount from the original
21407 			 * datagram.
21408 			 */
21409 			if (!(carve_mp = ip_carve_mp(&mp_orig, len))) {
21410 				mp = NULL;
21411 				break;
21412 			}
21413 			if (carve_mp->b_datap->db_ref == 1 &&
21414 			    hdr_mp->b_wptr - hdr_mp->b_rptr <
21415 			    carve_mp->b_rptr - carve_mp->b_datap->db_base) {
21416 				/* Inline IP header */
21417 				carve_mp->b_rptr -= hdr_mp->b_wptr -
21418 				    hdr_mp->b_rptr;
21419 				bcopy(hdr_mp->b_rptr, carve_mp->b_rptr,
21420 				    hdr_mp->b_wptr - hdr_mp->b_rptr);
21421 				mp = carve_mp;
21422 				freeb(hdr_mp);
21423 				hdr_mp = mp;
21424 			} else {
21425 				mp = hdr_mp;
21426 				/* Get priority marking, if any. */
21427 				mp->b_band = carve_mp->b_band;
21428 				mp->b_cont = carve_mp;
21429 			}
21430 			ipha = (ipha_t *)mp->b_rptr;
21431 			/* A frag of a frag might have IPH_MF non-zero */
21432 			offset_and_flags =
21433 			    ntohs(ipha->ipha_fragment_offset_and_flags) &
21434 			    IPH_MF;
21435 		}
21436 		offset_and_flags |= (uint16_t)(offset >> 3);
21437 		offset_and_flags |= (uint16_t)frag_flag;
21438 		/* Store the offset and flags in the IP header. */
21439 		ipha->ipha_fragment_offset_and_flags = htons(offset_and_flags);
21440 
21441 		/* Store the length in the IP header. */
21442 		ip_len = (uint16_t)(len + hdr_len);
21443 		ipha->ipha_length = htons(ip_len);
21444 
21445 		/*
21446 		 * Set the IP header checksum.	Note that mp is just
21447 		 * the header, so this is easy to pass to ip_csum.
21448 		 */
21449 		ipha->ipha_hdr_checksum = ip_csum_hdr(ipha);
21450 
21451 		/* Attach a transmit header, if any, and ship it. */
21452 		if (pkt_type == OB_PKT) {
21453 			UPDATE_OB_PKT_COUNT(ire);
21454 		} else {
21455 			UPDATE_IB_PKT_COUNT(ire);
21456 		}
21457 
21458 		if (ire->ire_flags & RTF_MULTIRT) {
21459 			irb = ire->ire_bucket;
21460 			ASSERT(irb != NULL);
21461 
21462 			multirt_send = B_TRUE;
21463 
21464 			/*
21465 			 * Save the original ire; we will need to restore it
21466 			 * for the tailing frags.
21467 			 */
21468 			save_ire = ire;
21469 			IRE_REFHOLD(save_ire);
21470 		}
21471 		/*
21472 		 * Emission loop for this fragment, similar
21473 		 * to what is done for the first fragment.
21474 		 */
21475 		do {
21476 			if (multirt_send) {
21477 				/*
21478 				 * We are in a multiple send case, need to get
21479 				 * the next ire and make a copy of the packet.
21480 				 */
21481 				ASSERT(irb != NULL);
21482 				IRB_REFHOLD(irb);
21483 				for (ire1 = ire->ire_next;
21484 				    ire1 != NULL;
21485 				    ire1 = ire1->ire_next) {
21486 					if (!(ire1->ire_flags & RTF_MULTIRT))
21487 						continue;
21488 					if (ire1->ire_addr != ire->ire_addr)
21489 						continue;
21490 					if (ire1->ire_marks &
21491 					    (IRE_MARK_CONDEMNED|
21492 						IRE_MARK_HIDDEN))
21493 						continue;
21494 					/*
21495 					 * Ensure we do not exceed the MTU
21496 					 * of the next route.
21497 					 */
21498 					if (ire1->ire_max_frag < max_frag) {
21499 						ip_multirt_bad_mtu(ire1,
21500 						    max_frag);
21501 						continue;
21502 					}
21503 
21504 					/* Got one. */
21505 					IRE_REFHOLD(ire1);
21506 					break;
21507 				}
21508 				IRB_REFRELE(irb);
21509 
21510 				if (ire1 != NULL) {
21511 					next_mp = copyb(mp);
21512 					if ((next_mp == NULL) ||
21513 					    ((mp->b_cont != NULL) &&
21514 					    ((next_mp->b_cont =
21515 					    dupmsg(mp->b_cont)) == NULL))) {
21516 						freemsg(next_mp);
21517 						next_mp = NULL;
21518 						ire_refrele(ire1);
21519 						ire1 = NULL;
21520 					}
21521 				}
21522 
21523 				/* Last multiroute ire; don't loop anymore. */
21524 				if (ire1 == NULL) {
21525 					multirt_send = B_FALSE;
21526 				}
21527 			}
21528 
21529 			/* Update transmit header */
21530 			ll_hdr_len = 0;
21531 			LOCK_IRE_FP_MP(ire);
21532 			ll_hdr_mp = ire->ire_fp_mp;
21533 			if (ll_hdr_mp != NULL) {
21534 				ASSERT(ll_hdr_mp->b_datap->db_type == M_DATA);
21535 				ll_hdr_len = MBLKL(ll_hdr_mp);
21536 			} else {
21537 				ll_hdr_mp = ire->ire_dlureq_mp;
21538 			}
21539 
21540 			if (!ll_hdr_mp) {
21541 				xmit_mp = mp;
21542 			} else if (mp->b_datap->db_ref == 1 &&
21543 			    ll_hdr_len != 0 &&
21544 			    ll_hdr_len <= mp->b_rptr - mp->b_datap->db_base) {
21545 				/* M_DATA fastpath */
21546 				mp->b_rptr -= ll_hdr_len;
21547 				bcopy(ll_hdr_mp->b_rptr, mp->b_rptr,
21548 				    ll_hdr_len);
21549 				xmit_mp = mp;
21550 			} else if ((xmit_mp = copyb(ll_hdr_mp)) != NULL) {
21551 				xmit_mp->b_cont = mp;
21552 				/* Get priority marking, if any. */
21553 				if (DB_TYPE(xmit_mp) == M_DATA)
21554 					xmit_mp->b_band = mp->b_band;
21555 			} else {
21556 				/*
21557 				 * Exit both the replication and
21558 				 * fragmentation loops.
21559 				 */
21560 				UNLOCK_IRE_FP_MP(ire);
21561 				goto drop_pkt;
21562 			}
21563 			UNLOCK_IRE_FP_MP(ire);
21564 			BUMP_MIB(&ip_mib, ipFragCreates);
21565 			putnext(q, xmit_mp);
21566 
21567 			if (pkt_type != OB_PKT) {
21568 				/*
21569 				 * Update the packet count of trailing
21570 				 * RTF_MULTIRT ires.
21571 				 */
21572 				UPDATE_OB_PKT_COUNT(ire);
21573 			}
21574 
21575 			/* All done if we just consumed the hdr_mp. */
21576 			if (mp == hdr_mp) {
21577 				last_frag = B_TRUE;
21578 			}
21579 
21580 			if (multirt_send) {
21581 				/*
21582 				 * We are in a multiple send case; look for
21583 				 * the next ire and re-enter the loop.
21584 				 */
21585 				ASSERT(ire1);
21586 				ASSERT(next_mp);
21587 				/* REFRELE the current ire before looping */
21588 				ire_refrele(ire);
21589 				ire = ire1;
21590 				ire1 = NULL;
21591 				q = ire->ire_stq;
21592 				mp = next_mp;
21593 				next_mp = NULL;
21594 			}
21595 		} while (multirt_send);
21596 		/*
21597 		 * Restore the original ire; we need it for the
21598 		 * trailing frags
21599 		 */
21600 		if (save_ire != NULL) {
21601 			ASSERT(ire1 == NULL);
21602 			/* REFRELE the last iterated ire */
21603 			ire_refrele(ire);
21604 			/* save_ire has been REFHOLDed */
21605 			ire = save_ire;
21606 			q = ire->ire_stq;
21607 			save_ire = NULL;
21608 		}
21609 
21610 		if (last_frag) {
21611 			BUMP_MIB(&ip_mib, ipFragOKs);
21612 			TRACE_1(TR_FAC_IP, TR_IP_WPUT_FRAG_END,
21613 			    "ip_wput_frag_end:(%S)",
21614 			    "consumed hdr_mp");
21615 
21616 			if (first_ire != NULL)
21617 				ire_refrele(first_ire);
21618 			return;
21619 		}
21620 		/* Otherwise, advance and loop. */
21621 		offset += len;
21622 	}
21623 
21624 drop_pkt:
21625 	/* Clean up following allocation failure. */
21626 	BUMP_MIB(&ip_mib, ipOutDiscards);
21627 	freemsg(mp);
21628 	if (mp != hdr_mp)
21629 		freeb(hdr_mp);
21630 	if (mp != mp_orig)
21631 		freemsg(mp_orig);
21632 
21633 	if (save_ire != NULL)
21634 		IRE_REFRELE(save_ire);
21635 	if (first_ire != NULL)
21636 		ire_refrele(first_ire);
21637 
21638 	TRACE_1(TR_FAC_IP, TR_IP_WPUT_FRAG_END,
21639 	    "ip_wput_frag_end:(%S)",
21640 	    "end--alloc failure");
21641 }
21642 
21643 /*
21644  * Copy the header plus those options which have the copy bit set
21645  */
21646 static mblk_t *
21647 ip_wput_frag_copyhdr(uchar_t *rptr, int hdr_len, int offset)
21648 {
21649 	mblk_t	*mp;
21650 	uchar_t	*up;
21651 
21652 	/*
21653 	 * Quick check if we need to look for options without the copy bit
21654 	 * set
21655 	 */
21656 	mp = allocb(ip_wroff_extra + hdr_len, BPRI_HI);
21657 	if (!mp)
21658 		return (mp);
21659 	mp->b_rptr += ip_wroff_extra;
21660 	if (hdr_len == IP_SIMPLE_HDR_LENGTH || offset != 0) {
21661 		bcopy(rptr, mp->b_rptr, hdr_len);
21662 		mp->b_wptr += hdr_len + ip_wroff_extra;
21663 		return (mp);
21664 	}
21665 	up  = mp->b_rptr;
21666 	bcopy(rptr, up, IP_SIMPLE_HDR_LENGTH);
21667 	up += IP_SIMPLE_HDR_LENGTH;
21668 	rptr += IP_SIMPLE_HDR_LENGTH;
21669 	hdr_len -= IP_SIMPLE_HDR_LENGTH;
21670 	while (hdr_len > 0) {
21671 		uint32_t optval;
21672 		uint32_t optlen;
21673 
21674 		optval = *rptr;
21675 		if (optval == IPOPT_EOL)
21676 			break;
21677 		if (optval == IPOPT_NOP)
21678 			optlen = 1;
21679 		else
21680 			optlen = rptr[1];
21681 		if (optval & IPOPT_COPY) {
21682 			bcopy(rptr, up, optlen);
21683 			up += optlen;
21684 		}
21685 		rptr += optlen;
21686 		hdr_len -= optlen;
21687 	}
21688 	/*
21689 	 * Make sure that we drop an even number of words by filling
21690 	 * with EOL to the next word boundary.
21691 	 */
21692 	for (hdr_len = up - (mp->b_rptr + IP_SIMPLE_HDR_LENGTH);
21693 	    hdr_len & 0x3; hdr_len++)
21694 		*up++ = IPOPT_EOL;
21695 	mp->b_wptr = up;
21696 	/* Update header length */
21697 	mp->b_rptr[0] = (uint8_t)((IP_VERSION << 4) | ((up - mp->b_rptr) >> 2));
21698 	return (mp);
21699 }
21700 
21701 /*
21702  * Delivery to local recipients including fanout to multiple recipients.
21703  * Does not do checksumming of UDP/TCP.
21704  * Note: q should be the read side queue for either the ill or conn.
21705  * Note: rq should be the read side q for the lower (ill) stream.
21706  * We don't send packets to IPPF processing, thus the last argument
21707  * to all the fanout calls are B_FALSE.
21708  */
21709 void
21710 ip_wput_local(queue_t *q, ill_t *ill, ipha_t *ipha, mblk_t *mp, ire_t *ire,
21711     int fanout_flags, zoneid_t zoneid)
21712 {
21713 	uint32_t	protocol;
21714 	mblk_t		*first_mp;
21715 	boolean_t	mctl_present;
21716 	int		ire_type;
21717 #define	rptr	((uchar_t *)ipha)
21718 
21719 	TRACE_1(TR_FAC_IP, TR_IP_WPUT_LOCAL_START,
21720 	    "ip_wput_local_start: q %p", q);
21721 
21722 	if (ire != NULL) {
21723 		ire_type = ire->ire_type;
21724 	} else {
21725 		/*
21726 		 * Only ip_multicast_loopback() calls us with a NULL ire. If the
21727 		 * packet is not multicast, we can't tell the ire type.
21728 		 */
21729 		ASSERT(CLASSD(ipha->ipha_dst));
21730 		ire_type = IRE_BROADCAST;
21731 	}
21732 
21733 	first_mp = mp;
21734 	if (first_mp->b_datap->db_type == M_CTL) {
21735 		ipsec_out_t *io = (ipsec_out_t *)first_mp->b_rptr;
21736 		if (!io->ipsec_out_secure) {
21737 			/*
21738 			 * This ipsec_out_t was allocated in ip_wput
21739 			 * for multicast packets to store the ill_index.
21740 			 * As this is being delivered locally, we don't
21741 			 * need this anymore.
21742 			 */
21743 			mp = first_mp->b_cont;
21744 			freeb(first_mp);
21745 			first_mp = mp;
21746 			mctl_present = B_FALSE;
21747 		} else {
21748 			mctl_present = B_TRUE;
21749 			mp = first_mp->b_cont;
21750 			ASSERT(mp != NULL);
21751 			ipsec_out_to_in(first_mp);
21752 		}
21753 	} else {
21754 		mctl_present = B_FALSE;
21755 	}
21756 
21757 	loopback_packets++;
21758 
21759 	ip2dbg(("ip_wput_local: from 0x%x to 0x%x in zone %d\n",
21760 	    ntohl(ipha->ipha_src), ntohl(ipha->ipha_dst), zoneid));
21761 	if (!IS_SIMPLE_IPH(ipha)) {
21762 		ip_wput_local_options(ipha);
21763 	}
21764 
21765 	protocol = ipha->ipha_protocol;
21766 	switch (protocol) {
21767 	case IPPROTO_ICMP: {
21768 		ire_t		*ire_zone;
21769 		ilm_t		*ilm;
21770 		mblk_t		*mp1;
21771 		zoneid_t	last_zoneid;
21772 
21773 		if (CLASSD(ipha->ipha_dst) &&
21774 		    !(ill->ill_phyint->phyint_flags & PHYI_LOOPBACK)) {
21775 			ASSERT(ire_type == IRE_BROADCAST);
21776 			/*
21777 			 * In the multicast case, applications may have joined
21778 			 * the group from different zones, so we need to deliver
21779 			 * the packet to each of them. Loop through the
21780 			 * multicast memberships structures (ilm) on the receive
21781 			 * ill and send a copy of the packet up each matching
21782 			 * one. However, we don't do this for multicasts sent on
21783 			 * the loopback interface (PHYI_LOOPBACK flag set) as
21784 			 * they must stay in the sender's zone.
21785 			 *
21786 			 * ilm_add_v6() ensures that ilms in the same zone are
21787 			 * contiguous in the ill_ilm list. We use this property
21788 			 * to avoid sending duplicates needed when two
21789 			 * applications in the same zone join the same group on
21790 			 * different logical interfaces: we ignore the ilm if
21791 			 * its zoneid is the same as the last matching one.
21792 			 * In addition, the sending of the packet for
21793 			 * ire_zoneid is delayed until all of the other ilms
21794 			 * have been exhausted.
21795 			 */
21796 			last_zoneid = -1;
21797 			ILM_WALKER_HOLD(ill);
21798 			for (ilm = ill->ill_ilm; ilm != NULL;
21799 			    ilm = ilm->ilm_next) {
21800 				if ((ilm->ilm_flags & ILM_DELETED) ||
21801 				    ipha->ipha_dst != ilm->ilm_addr ||
21802 				    ilm->ilm_zoneid == last_zoneid ||
21803 				    ilm->ilm_zoneid == zoneid ||
21804 				    !(ilm->ilm_ipif->ipif_flags & IPIF_UP))
21805 					continue;
21806 				mp1 = ip_copymsg(first_mp);
21807 				if (mp1 == NULL)
21808 					continue;
21809 				icmp_inbound(q, mp1, B_TRUE, ill, 0, 0,
21810 				    mctl_present, B_FALSE, ill,
21811 				    ilm->ilm_zoneid);
21812 				last_zoneid = ilm->ilm_zoneid;
21813 			}
21814 			ILM_WALKER_RELE(ill);
21815 			/*
21816 			 * Loopback case: the sending endpoint has
21817 			 * IP_MULTICAST_LOOP disabled, therefore we don't
21818 			 * dispatch the multicast packet to the sending zone.
21819 			 */
21820 			if (fanout_flags & IP_FF_NO_MCAST_LOOP) {
21821 				freemsg(first_mp);
21822 				return;
21823 			}
21824 		} else if (ire_type == IRE_BROADCAST) {
21825 			/*
21826 			 * In the broadcast case, there may be many zones
21827 			 * which need a copy of the packet delivered to them.
21828 			 * There is one IRE_BROADCAST per broadcast address
21829 			 * and per zone; we walk those using a helper function.
21830 			 * In addition, the sending of the packet for zoneid is
21831 			 * delayed until all of the other ires have been
21832 			 * processed.
21833 			 */
21834 			IRB_REFHOLD(ire->ire_bucket);
21835 			ire_zone = NULL;
21836 			while ((ire_zone = ire_get_next_bcast_ire(ire_zone,
21837 			    ire)) != NULL) {
21838 				mp1 = ip_copymsg(first_mp);
21839 				if (mp1 == NULL)
21840 					continue;
21841 
21842 				UPDATE_IB_PKT_COUNT(ire_zone);
21843 				ire_zone->ire_last_used_time = lbolt;
21844 				icmp_inbound(q, mp1, B_TRUE, ill, 0, 0,
21845 				    mctl_present, B_FALSE, ill,
21846 				    ire_zone->ire_zoneid);
21847 			}
21848 			IRB_REFRELE(ire->ire_bucket);
21849 		}
21850 		icmp_inbound(q, first_mp, (ire_type == IRE_BROADCAST), ill, 0,
21851 		    0, mctl_present, B_FALSE, ill, zoneid);
21852 		TRACE_2(TR_FAC_IP, TR_IP_WPUT_LOCAL_END,
21853 		    "ip_wput_local_end: q %p (%S)",
21854 		    q, "icmp");
21855 		return;
21856 	}
21857 	case IPPROTO_IGMP:
21858 		if (igmp_input(q, mp, ill)) {
21859 			/* Bad packet - discarded by igmp_input */
21860 			TRACE_2(TR_FAC_IP, TR_IP_WPUT_LOCAL_END,
21861 			    "ip_wput_local_end: q %p (%S)",
21862 			    q, "igmp_input--bad packet");
21863 			if (mctl_present)
21864 				freeb(first_mp);
21865 			return;
21866 		}
21867 		/*
21868 		 * igmp_input() may have pulled up the message so ipha needs to
21869 		 * be reinitialized.
21870 		 */
21871 		ipha = (ipha_t *)mp->b_rptr;
21872 		/* deliver to local raw users */
21873 		break;
21874 	case IPPROTO_ENCAP:
21875 		/*
21876 		 * This case is covered by either ip_fanout_proto, or by
21877 		 * the above security processing for self-tunneled packets.
21878 		 */
21879 		break;
21880 	case IPPROTO_UDP: {
21881 		uint16_t	*up;
21882 		uint32_t	ports;
21883 
21884 		up = (uint16_t *)(rptr + IPH_HDR_LENGTH(ipha) +
21885 		    UDP_PORTS_OFFSET);
21886 		/* Force a 'valid' checksum. */
21887 		up[3] = 0;
21888 
21889 		ports = *(uint32_t *)up;
21890 		ip_fanout_udp(q, first_mp, ill, ipha, ports,
21891 		    (ire_type == IRE_BROADCAST),
21892 		    fanout_flags | IP_FF_SEND_ICMP | IP_FF_HDR_COMPLETE |
21893 		    IP_FF_SEND_SLLA | IP_FF_IP6INFO, mctl_present, B_FALSE,
21894 		    ill, zoneid);
21895 		TRACE_2(TR_FAC_IP, TR_IP_WPUT_LOCAL_END,
21896 		    "ip_wput_local_end: q %p (%S)", q, "ip_fanout_udp");
21897 		return;
21898 	}
21899 	case IPPROTO_TCP: {
21900 
21901 		/*
21902 		 * For TCP, discard broadcast packets.
21903 		 */
21904 		if ((ushort_t)ire_type == IRE_BROADCAST) {
21905 			freemsg(first_mp);
21906 			BUMP_MIB(&ip_mib, ipInDiscards);
21907 			return;
21908 		}
21909 
21910 		if (mp->b_datap->db_type == M_DATA) {
21911 			/*
21912 			 * M_DATA mblk, so init mblk (chain) for no struio().
21913 			 */
21914 			mblk_t	*mp1 = mp;
21915 
21916 			do
21917 				mp1->b_datap->db_struioflag = 0;
21918 			while ((mp1 = mp1->b_cont) != NULL);
21919 		}
21920 		ASSERT((rptr + IPH_HDR_LENGTH(ipha) + TCP_PORTS_OFFSET + 4)
21921 		    <= mp->b_wptr);
21922 		ip_fanout_tcp(q, first_mp, ill, ipha,
21923 		    fanout_flags | IP_FF_SEND_ICMP | IP_FF_HDR_COMPLETE |
21924 		    IP_FF_SYN_ADDIRE | IP_FF_IP6INFO,
21925 		    mctl_present, B_FALSE, zoneid);
21926 		TRACE_2(TR_FAC_IP, TR_IP_WPUT_LOCAL_END,
21927 		    "ip_wput_local_end: q %p (%S)", q, "ip_fanout_tcp");
21928 		return;
21929 	}
21930 	case IPPROTO_SCTP:
21931 	{
21932 		uint32_t	ports;
21933 
21934 		bcopy(rptr + IPH_HDR_LENGTH(ipha), &ports, sizeof (ports));
21935 		ip_fanout_sctp(first_mp, ill, ipha, ports,
21936 		    fanout_flags | IP_FF_SEND_ICMP | IP_FF_HDR_COMPLETE |
21937 		    IP_FF_IP6INFO,
21938 		    mctl_present, B_FALSE, 0, zoneid);
21939 		return;
21940 	}
21941 
21942 	default:
21943 		break;
21944 	}
21945 	/*
21946 	 * Find a client for some other protocol.  We give
21947 	 * copies to multiple clients, if more than one is
21948 	 * bound.
21949 	 */
21950 	ip_fanout_proto(q, first_mp, ill, ipha,
21951 	    fanout_flags | IP_FF_SEND_ICMP | IP_FF_HDR_COMPLETE | IP_FF_RAWIP,
21952 	    mctl_present, B_FALSE, ill, zoneid);
21953 	TRACE_2(TR_FAC_IP, TR_IP_WPUT_LOCAL_END,
21954 	    "ip_wput_local_end: q %p (%S)", q, "ip_fanout_proto");
21955 #undef	rptr
21956 }
21957 
21958 /*
21959  * Update any source route, record route, or timestamp options.
21960  * Check that we are at end of strict source route.
21961  * The options have been sanity checked by ip_wput_options().
21962  */
21963 static void
21964 ip_wput_local_options(ipha_t *ipha)
21965 {
21966 	ipoptp_t	opts;
21967 	uchar_t		*opt;
21968 	uint8_t		optval;
21969 	uint8_t		optlen;
21970 	ipaddr_t	dst;
21971 	uint32_t	ts;
21972 	ire_t		*ire;
21973 	timestruc_t	now;
21974 
21975 	ip2dbg(("ip_wput_local_options\n"));
21976 	for (optval = ipoptp_first(&opts, ipha);
21977 	    optval != IPOPT_EOL;
21978 	    optval = ipoptp_next(&opts)) {
21979 		opt = opts.ipoptp_cur;
21980 		optlen = opts.ipoptp_len;
21981 		ASSERT((opts.ipoptp_flags & IPOPTP_ERROR) == 0);
21982 		switch (optval) {
21983 			uint32_t off;
21984 		case IPOPT_SSRR:
21985 		case IPOPT_LSRR:
21986 			off = opt[IPOPT_OFFSET];
21987 			off--;
21988 			if (optlen < IP_ADDR_LEN ||
21989 			    off > optlen - IP_ADDR_LEN) {
21990 				/* End of source route */
21991 				break;
21992 			}
21993 			/*
21994 			 * This will only happen if two consecutive entries
21995 			 * in the source route contains our address or if
21996 			 * it is a packet with a loose source route which
21997 			 * reaches us before consuming the whole source route
21998 			 */
21999 			ip1dbg(("ip_wput_local_options: not end of SR\n"));
22000 			if (optval == IPOPT_SSRR) {
22001 				return;
22002 			}
22003 			/*
22004 			 * Hack: instead of dropping the packet truncate the
22005 			 * source route to what has been used by filling the
22006 			 * rest with IPOPT_NOP.
22007 			 */
22008 			opt[IPOPT_OLEN] = (uint8_t)off;
22009 			while (off < optlen) {
22010 				opt[off++] = IPOPT_NOP;
22011 			}
22012 			break;
22013 		case IPOPT_RR:
22014 			off = opt[IPOPT_OFFSET];
22015 			off--;
22016 			if (optlen < IP_ADDR_LEN ||
22017 			    off > optlen - IP_ADDR_LEN) {
22018 				/* No more room - ignore */
22019 				ip1dbg((
22020 				    "ip_wput_forward_options: end of RR\n"));
22021 				break;
22022 			}
22023 			dst = htonl(INADDR_LOOPBACK);
22024 			bcopy(&dst, (char *)opt + off, IP_ADDR_LEN);
22025 			opt[IPOPT_OFFSET] += IP_ADDR_LEN;
22026 			break;
22027 		case IPOPT_TS:
22028 			/* Insert timestamp if there is romm */
22029 			switch (opt[IPOPT_POS_OV_FLG] & 0x0F) {
22030 			case IPOPT_TS_TSONLY:
22031 				off = IPOPT_TS_TIMELEN;
22032 				break;
22033 			case IPOPT_TS_PRESPEC:
22034 			case IPOPT_TS_PRESPEC_RFC791:
22035 				/* Verify that the address matched */
22036 				off = opt[IPOPT_OFFSET] - 1;
22037 				bcopy((char *)opt + off, &dst, IP_ADDR_LEN);
22038 				ire = ire_ctable_lookup(dst, 0, IRE_LOCAL,
22039 				    NULL, ALL_ZONES, MATCH_IRE_TYPE);
22040 				if (ire == NULL) {
22041 					/* Not for us */
22042 					break;
22043 				}
22044 				ire_refrele(ire);
22045 				/* FALLTHRU */
22046 			case IPOPT_TS_TSANDADDR:
22047 				off = IP_ADDR_LEN + IPOPT_TS_TIMELEN;
22048 				break;
22049 			default:
22050 				/*
22051 				 * ip_*put_options should have already
22052 				 * dropped this packet.
22053 				 */
22054 				cmn_err(CE_PANIC, "ip_wput_local_options: "
22055 				    "unknown IT - bug in ip_wput_options?\n");
22056 				return;	/* Keep "lint" happy */
22057 			}
22058 			if (opt[IPOPT_OFFSET] - 1 + off > optlen) {
22059 				/* Increase overflow counter */
22060 				off = (opt[IPOPT_POS_OV_FLG] >> 4) + 1;
22061 				opt[IPOPT_POS_OV_FLG] = (uint8_t)
22062 				    (opt[IPOPT_POS_OV_FLG] & 0x0F) |
22063 				    (off << 4);
22064 				break;
22065 			}
22066 			off = opt[IPOPT_OFFSET] - 1;
22067 			switch (opt[IPOPT_POS_OV_FLG] & 0x0F) {
22068 			case IPOPT_TS_PRESPEC:
22069 			case IPOPT_TS_PRESPEC_RFC791:
22070 			case IPOPT_TS_TSANDADDR:
22071 				dst = htonl(INADDR_LOOPBACK);
22072 				bcopy(&dst, (char *)opt + off, IP_ADDR_LEN);
22073 				opt[IPOPT_OFFSET] += IP_ADDR_LEN;
22074 				/* FALLTHRU */
22075 			case IPOPT_TS_TSONLY:
22076 				off = opt[IPOPT_OFFSET] - 1;
22077 				/* Compute # of milliseconds since midnight */
22078 				gethrestime(&now);
22079 				ts = (now.tv_sec % (24 * 60 * 60)) * 1000 +
22080 				    now.tv_nsec / (NANOSEC / MILLISEC);
22081 				bcopy(&ts, (char *)opt + off, IPOPT_TS_TIMELEN);
22082 				opt[IPOPT_OFFSET] += IPOPT_TS_TIMELEN;
22083 				break;
22084 			}
22085 			break;
22086 		}
22087 	}
22088 }
22089 
22090 /*
22091  * Send out a multicast packet on interface ipif.
22092  * The sender does not have an conn.
22093  * Caller verifies that this isn't a PHYI_LOOPBACK.
22094  */
22095 void
22096 ip_wput_multicast(queue_t *q, mblk_t *mp, ipif_t *ipif)
22097 {
22098 	ipha_t	*ipha;
22099 	ire_t	*ire;
22100 	ipaddr_t	dst;
22101 	mblk_t		*first_mp;
22102 
22103 	/* igmp_sendpkt always allocates a ipsec_out_t */
22104 	ASSERT(mp->b_datap->db_type == M_CTL);
22105 	ASSERT(!ipif->ipif_isv6);
22106 	ASSERT(!(ipif->ipif_ill->ill_phyint->phyint_flags & PHYI_LOOPBACK));
22107 
22108 	first_mp = mp;
22109 	mp = first_mp->b_cont;
22110 	ASSERT(mp->b_datap->db_type == M_DATA);
22111 	ipha = (ipha_t *)mp->b_rptr;
22112 
22113 	/*
22114 	 * Find an IRE which matches the destination and the outgoing
22115 	 * queue (i.e. the outgoing interface.)
22116 	 */
22117 	if (ipif->ipif_flags & IPIF_POINTOPOINT)
22118 		dst = ipif->ipif_pp_dst_addr;
22119 	else
22120 		dst = ipha->ipha_dst;
22121 	/*
22122 	 * The source address has already been initialized by the
22123 	 * caller and hence matching on ILL (MATCH_IRE_ILL) would
22124 	 * be sufficient rather than MATCH_IRE_IPIF.
22125 	 *
22126 	 * This function is used for sending IGMP packets. We need
22127 	 * to make sure that we send the packet out of the interface
22128 	 * (ipif->ipif_ill) where we joined the group. This is to
22129 	 * prevent from switches doing IGMP snooping to send us multicast
22130 	 * packets for a given group on the interface we have joined.
22131 	 * If we can't find an ire, igmp_sendpkt has already initialized
22132 	 * ipsec_out_attach_if so that this will not be load spread in
22133 	 * ip_newroute_ipif.
22134 	 */
22135 	ire = ire_ctable_lookup(dst, 0, 0, ipif, ALL_ZONES, MATCH_IRE_ILL);
22136 	if (!ire) {
22137 		/*
22138 		 * Mark this packet to make it be delivered to
22139 		 * ip_wput_ire after the new ire has been
22140 		 * created.
22141 		 */
22142 		mp->b_prev = NULL;
22143 		mp->b_next = NULL;
22144 		ip_newroute_ipif(q, first_mp, ipif, dst, NULL, RTF_SETSRC);
22145 		return;
22146 	}
22147 
22148 	/*
22149 	 * Honor the RTF_SETSRC flag; this is the only case
22150 	 * where we force this addr whatever the current src addr is,
22151 	 * because this address is set by igmp_sendpkt(), and
22152 	 * cannot be specified by any user.
22153 	 */
22154 	if (ire->ire_flags & RTF_SETSRC) {
22155 		ipha->ipha_src = ire->ire_src_addr;
22156 	}
22157 
22158 	ip_wput_ire(q, first_mp, ire, NULL, B_FALSE);
22159 }
22160 
22161 /*
22162  * NOTE : This function does not ire_refrele the ire argument passed in.
22163  *
22164  * Copy the link layer header and do IPQoS if needed. Frees the mblk on
22165  * failure. The ire_fp_mp can vanish any time in the case of IRE_MIPRTUN
22166  * and IRE_BROADCAST due to DL_NOTE_FASTPATH_FLUSH. Hence we have to hold
22167  * the ire_lock to access the ire_fp_mp in this case.
22168  * IPQoS assumes that the first M_DATA contains the IP header. So, if we are
22169  * prepending a fastpath message IPQoS processing must precede it, we also set
22170  * the b_band of the fastpath message to that of the  mblk returned by IPQoS
22171  * (IPQoS might have set the b_band for CoS marking).
22172  * However, if we are prepending DL_UNITDATA_REQ message, IPQoS processing
22173  * must follow it so that IPQoS can mark the dl_priority field for CoS
22174  * marking, if needed.
22175  */
22176 static mblk_t *
22177 ip_wput_attach_llhdr(mblk_t *mp, ire_t *ire, ip_proc_t proc, uint32_t ill_index)
22178 {
22179 	uint_t	hlen;
22180 	ipha_t *ipha;
22181 	mblk_t *mp1;
22182 	boolean_t qos_done = B_FALSE;
22183 	uchar_t	*ll_hdr;
22184 
22185 #define	rptr	((uchar_t *)ipha)
22186 
22187 	ipha = (ipha_t *)mp->b_rptr;
22188 	hlen = 0;
22189 	LOCK_IRE_FP_MP(ire);
22190 	if ((mp1 = ire->ire_fp_mp) != NULL) {
22191 		ASSERT(DB_TYPE(mp1) == M_DATA);
22192 		/* Initiate IPPF processing */
22193 		if ((proc != 0) && IPP_ENABLED(proc)) {
22194 			UNLOCK_IRE_FP_MP(ire);
22195 			ip_process(proc, &mp, ill_index);
22196 			if (mp == NULL)
22197 				return (NULL);
22198 
22199 			ipha = (ipha_t *)mp->b_rptr;
22200 			LOCK_IRE_FP_MP(ire);
22201 			if ((mp1 = ire->ire_fp_mp) == NULL) {
22202 				qos_done = B_TRUE;
22203 				goto no_fp_mp;
22204 			}
22205 			ASSERT(DB_TYPE(mp1) == M_DATA);
22206 		}
22207 		hlen = MBLKL(mp1);
22208 		/*
22209 		 * Check if we have enough room to prepend fastpath
22210 		 * header
22211 		 */
22212 		if (hlen != 0 && (rptr - mp->b_datap->db_base) >= hlen) {
22213 			ll_hdr = rptr - hlen;
22214 			bcopy(mp1->b_rptr, ll_hdr, hlen);
22215 			/* XXX ipha is not aligned here */
22216 			ipha = (ipha_t *)(rptr - hlen);
22217 			/*
22218 			 * Set the b_rptr to the start of the link layer
22219 			 * header
22220 			 */
22221 			mp->b_rptr = rptr;
22222 			mp1 = mp;
22223 		} else {
22224 			mp1 = copyb(mp1);
22225 			if (mp1 == NULL)
22226 				goto unlock_err;
22227 			mp1->b_band = mp->b_band;
22228 			mp1->b_cont = mp;
22229 			/*
22230 			 * XXX disable ICK_VALID and compute checksum
22231 			 * here; can happen if ire_fp_mp changes and
22232 			 * it can't be copied now due to insufficient
22233 			 * space. (unlikely, fp mp can change, but it
22234 			 * does not increase in length)
22235 			 */
22236 		}
22237 		UNLOCK_IRE_FP_MP(ire);
22238 	} else {
22239 no_fp_mp:
22240 		mp1 = copyb(ire->ire_dlureq_mp);
22241 		if (mp1 == NULL) {
22242 unlock_err:
22243 			UNLOCK_IRE_FP_MP(ire);
22244 			freemsg(mp);
22245 			return (NULL);
22246 		}
22247 		UNLOCK_IRE_FP_MP(ire);
22248 		mp1->b_cont = mp;
22249 		if (!qos_done && (proc != 0) && IPP_ENABLED(proc)) {
22250 			ip_process(proc, &mp1, ill_index);
22251 			if (mp1 == NULL)
22252 				return (NULL);
22253 		}
22254 	}
22255 	return (mp1);
22256 #undef rptr
22257 }
22258 
22259 /*
22260  * Finish the outbound IPsec processing for an IPv6 packet. This function
22261  * is called from ipsec_out_process() if the IPsec packet was processed
22262  * synchronously, or from {ah,esp}_kcf_callback() if it was processed
22263  * asynchronously.
22264  */
22265 void
22266 ip_wput_ipsec_out_v6(queue_t *q, mblk_t *ipsec_mp, ip6_t *ip6h, ill_t *ill,
22267     ire_t *ire_arg)
22268 {
22269 	in6_addr_t *v6dstp;
22270 	ire_t *ire;
22271 	mblk_t *mp;
22272 	uint_t	ill_index;
22273 	ipsec_out_t *io;
22274 	boolean_t attach_if, hwaccel;
22275 	uint32_t flags = IP6_NO_IPPOLICY;
22276 	int match_flags;
22277 	zoneid_t zoneid;
22278 	boolean_t ill_need_rele = B_FALSE;
22279 	boolean_t ire_need_rele = B_FALSE;
22280 
22281 	mp = ipsec_mp->b_cont;
22282 	io = (ipsec_out_t *)ipsec_mp->b_rptr;
22283 	ill_index = io->ipsec_out_ill_index;
22284 	if (io->ipsec_out_reachable) {
22285 		flags |= IPV6_REACHABILITY_CONFIRMATION;
22286 	}
22287 	attach_if = io->ipsec_out_attach_if;
22288 	hwaccel = io->ipsec_out_accelerated;
22289 	zoneid = io->ipsec_out_zoneid;
22290 	ASSERT(zoneid != ALL_ZONES);
22291 	match_flags = MATCH_IRE_ILL_GROUP;
22292 	/* Multicast addresses should have non-zero ill_index. */
22293 	v6dstp = &ip6h->ip6_dst;
22294 	ASSERT(ip6h->ip6_nxt != IPPROTO_RAW);
22295 	ASSERT(!IN6_IS_ADDR_MULTICAST(v6dstp) || ill_index != 0);
22296 	ASSERT(!attach_if || ill_index != 0);
22297 	if (ill_index != 0) {
22298 		if (ill == NULL) {
22299 			ill = ip_grab_attach_ill(NULL, ipsec_mp, ill_index,
22300 			    B_TRUE);
22301 
22302 			/* Failure case frees things for us. */
22303 			if (ill == NULL)
22304 				return;
22305 
22306 			ill_need_rele = B_TRUE;
22307 		}
22308 		/*
22309 		 * If this packet needs to go out on a particular interface
22310 		 * honor it.
22311 		 */
22312 		if (attach_if) {
22313 			match_flags = MATCH_IRE_ILL;
22314 
22315 			/*
22316 			 * Check if we need an ire that will not be
22317 			 * looked up by anybody else i.e. HIDDEN.
22318 			 */
22319 			if (ill_is_probeonly(ill)) {
22320 				match_flags |= MATCH_IRE_MARK_HIDDEN;
22321 			}
22322 		}
22323 	}
22324 	ASSERT(mp != NULL);
22325 
22326 	if (IN6_IS_ADDR_MULTICAST(v6dstp)) {
22327 		boolean_t unspec_src;
22328 		ipif_t	*ipif;
22329 
22330 		/*
22331 		 * Use the ill_index to get the right ill.
22332 		 */
22333 		unspec_src = io->ipsec_out_unspec_src;
22334 		(void) ipif_lookup_zoneid(ill, zoneid, 0, &ipif);
22335 		if (ipif == NULL) {
22336 			if (ill_need_rele)
22337 				ill_refrele(ill);
22338 			freemsg(ipsec_mp);
22339 			return;
22340 		}
22341 
22342 		if (ire_arg != NULL) {
22343 			ire = ire_arg;
22344 		} else {
22345 			ire = ire_ctable_lookup_v6(v6dstp, 0, 0, ipif,
22346 			    zoneid, match_flags);
22347 			ire_need_rele = B_TRUE;
22348 		}
22349 		if (ire != NULL) {
22350 			ipif_refrele(ipif);
22351 			/*
22352 			 * XXX Do the multicast forwarding now, as the IPSEC
22353 			 * processing has been done.
22354 			 */
22355 			goto send;
22356 		}
22357 
22358 		ip0dbg(("ip_wput_ipsec_out_v6: multicast: IRE disappeared\n"));
22359 		mp->b_prev = NULL;
22360 		mp->b_next = NULL;
22361 
22362 		/*
22363 		 * If the IPsec packet was processed asynchronously,
22364 		 * drop it now.
22365 		 */
22366 		if (q == NULL) {
22367 			if (ill_need_rele)
22368 				ill_refrele(ill);
22369 			freemsg(ipsec_mp);
22370 			return;
22371 		}
22372 
22373 		ip_newroute_ipif_v6(q, ipsec_mp, ipif, *v6dstp,
22374 		    unspec_src, zoneid);
22375 		ipif_refrele(ipif);
22376 	} else {
22377 		if (attach_if) {
22378 			ipif_t	*ipif;
22379 
22380 			ipif = ipif_get_next_ipif(NULL, ill);
22381 			if (ipif == NULL) {
22382 				if (ill_need_rele)
22383 					ill_refrele(ill);
22384 				freemsg(ipsec_mp);
22385 				return;
22386 			}
22387 			ire = ire_ctable_lookup_v6(v6dstp, 0, 0, ipif,
22388 			    zoneid, match_flags);
22389 			ire_need_rele = B_TRUE;
22390 			ipif_refrele(ipif);
22391 		} else {
22392 			if (ire_arg != NULL) {
22393 				ire = ire_arg;
22394 			} else {
22395 				ire = ire_cache_lookup_v6(v6dstp, zoneid);
22396 				ire_need_rele = B_TRUE;
22397 			}
22398 		}
22399 		if (ire != NULL)
22400 			goto send;
22401 		/*
22402 		 * ire disappeared underneath.
22403 		 *
22404 		 * What we need to do here is the ip_newroute
22405 		 * logic to get the ire without doing the IPSEC
22406 		 * processing. Follow the same old path. But this
22407 		 * time, ip_wput or ire_add_then_send will call us
22408 		 * directly as all the IPSEC operations are done.
22409 		 */
22410 		ip1dbg(("ip_wput_ipsec_out_v6: IRE disappeared\n"));
22411 		mp->b_prev = NULL;
22412 		mp->b_next = NULL;
22413 
22414 		/*
22415 		 * If the IPsec packet was processed asynchronously,
22416 		 * drop it now.
22417 		 */
22418 		if (q == NULL) {
22419 			if (ill_need_rele)
22420 				ill_refrele(ill);
22421 			freemsg(ipsec_mp);
22422 			return;
22423 		}
22424 
22425 		ip_newroute_v6(q, ipsec_mp, v6dstp, &ip6h->ip6_src, ill,
22426 		    zoneid);
22427 	}
22428 	if (ill != NULL && ill_need_rele)
22429 		ill_refrele(ill);
22430 	return;
22431 send:
22432 	if (ill != NULL && ill_need_rele)
22433 		ill_refrele(ill);
22434 
22435 	/* Local delivery */
22436 	if (ire->ire_stq == NULL) {
22437 		ASSERT(q != NULL);
22438 		ip_wput_local_v6(RD(q), ire->ire_ipif->ipif_ill, ip6h, ipsec_mp,
22439 		    ire, 0);
22440 		if (ire_need_rele)
22441 			ire_refrele(ire);
22442 		return;
22443 	}
22444 	/*
22445 	 * Everything is done. Send it out on the wire.
22446 	 * We force the insertion of a fragment header using the
22447 	 * IPH_FRAG_HDR flag in two cases:
22448 	 * - after reception of an ICMPv6 "packet too big" message
22449 	 *   with a MTU < 1280 (cf. RFC 2460 section 5)
22450 	 * - for multirouted IPv6 packets, so that the receiver can
22451 	 *   discard duplicates according to their fragment identifier
22452 	 */
22453 	/* XXX fix flow control problems. */
22454 	if (ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN > ire->ire_max_frag ||
22455 	    (ire->ire_frag_flag & IPH_FRAG_HDR)) {
22456 		if (hwaccel) {
22457 			/*
22458 			 * hardware acceleration does not handle these
22459 			 * "slow path" cases.
22460 			 */
22461 			/* IPsec KSTATS: should bump bean counter here. */
22462 			if (ire_need_rele)
22463 				ire_refrele(ire);
22464 			freemsg(ipsec_mp);
22465 			return;
22466 		}
22467 		if (ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN !=
22468 		    (mp->b_cont ? msgdsize(mp) :
22469 		    mp->b_wptr - (uchar_t *)ip6h)) {
22470 			/* IPsec KSTATS: should bump bean counter here. */
22471 			ip0dbg(("Packet length mismatch: %d, %ld\n",
22472 			    ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN,
22473 			    msgdsize(mp)));
22474 			if (ire_need_rele)
22475 				ire_refrele(ire);
22476 			freemsg(ipsec_mp);
22477 			return;
22478 		}
22479 		ASSERT(mp->b_prev == NULL);
22480 		ip2dbg(("Fragmenting Size = %d, mtu = %d\n",
22481 		    ntohs(ip6h->ip6_plen) +
22482 		    IPV6_HDR_LEN, ire->ire_max_frag));
22483 		ip_wput_frag_v6(mp, ire, flags, NULL, B_FALSE,
22484 		    ire->ire_max_frag);
22485 	} else {
22486 		UPDATE_OB_PKT_COUNT(ire);
22487 		ire->ire_last_used_time = lbolt;
22488 		ip_xmit_v6(mp, ire, flags, NULL, B_FALSE, hwaccel ? io : NULL);
22489 	}
22490 	if (ire_need_rele)
22491 		ire_refrele(ire);
22492 	freeb(ipsec_mp);
22493 }
22494 
22495 void
22496 ipsec_hw_putnext(queue_t *q, mblk_t *mp)
22497 {
22498 	mblk_t *hada_mp;	/* attributes M_CTL mblk */
22499 	da_ipsec_t *hada;	/* data attributes */
22500 	ill_t *ill = (ill_t *)q->q_ptr;
22501 
22502 	IPSECHW_DEBUG(IPSECHW_PKT, ("ipsec_hw_putnext: accelerated packet\n"));
22503 
22504 	if ((ill->ill_capabilities & (ILL_CAPAB_AH | ILL_CAPAB_ESP)) == 0) {
22505 		/* IPsec KSTATS: Bump lose counter here! */
22506 		freemsg(mp);
22507 		return;
22508 	}
22509 
22510 	/*
22511 	 * It's an IPsec packet that must be
22512 	 * accelerated by the Provider, and the
22513 	 * outbound ill is IPsec acceleration capable.
22514 	 * Prepends the mblk with an IPHADA_M_CTL, and ship it
22515 	 * to the ill.
22516 	 * IPsec KSTATS: should bump packet counter here.
22517 	 */
22518 
22519 	hada_mp = allocb(sizeof (da_ipsec_t), BPRI_HI);
22520 	if (hada_mp == NULL) {
22521 		/* IPsec KSTATS: should bump packet counter here. */
22522 		freemsg(mp);
22523 		return;
22524 	}
22525 
22526 	hada_mp->b_datap->db_type = M_CTL;
22527 	hada_mp->b_wptr = hada_mp->b_rptr + sizeof (*hada);
22528 	hada_mp->b_cont = mp;
22529 
22530 	hada = (da_ipsec_t *)hada_mp->b_rptr;
22531 	bzero(hada, sizeof (da_ipsec_t));
22532 	hada->da_type = IPHADA_M_CTL;
22533 
22534 	putnext(q, hada_mp);
22535 }
22536 
22537 /*
22538  * Finish the outbound IPsec processing. This function is called from
22539  * ipsec_out_process() if the IPsec packet was processed
22540  * synchronously, or from {ah,esp}_kcf_callback() if it was processed
22541  * asynchronously.
22542  */
22543 void
22544 ip_wput_ipsec_out(queue_t *q, mblk_t *ipsec_mp, ipha_t *ipha, ill_t *ill,
22545     ire_t *ire_arg)
22546 {
22547 	uint32_t v_hlen_tos_len;
22548 	ipaddr_t	dst;
22549 	ipif_t	*ipif = NULL;
22550 	ire_t *ire;
22551 	ire_t *ire1 = NULL;
22552 	mblk_t *next_mp = NULL;
22553 	uint32_t max_frag;
22554 	boolean_t multirt_send = B_FALSE;
22555 	mblk_t *mp;
22556 	mblk_t *mp1;
22557 	uint_t	ill_index;
22558 	ipsec_out_t *io;
22559 	boolean_t attach_if;
22560 	int match_flags, offset;
22561 	irb_t *irb = NULL;
22562 	boolean_t ill_need_rele = B_FALSE, ire_need_rele = B_TRUE;
22563 	zoneid_t zoneid;
22564 	uint32_t cksum;
22565 	uint16_t *up;
22566 	/* Hack until the UDP merge into IP happens. */
22567 	extern boolean_t udp_compute_checksum(void);
22568 #ifdef	_BIG_ENDIAN
22569 #define	LENGTH	(v_hlen_tos_len & 0xFFFF)
22570 #else
22571 #define	LENGTH	((v_hlen_tos_len >> 24) | ((v_hlen_tos_len >> 8) & 0xFF00))
22572 #endif
22573 
22574 	mp = ipsec_mp->b_cont;
22575 	ASSERT(mp != NULL);
22576 	v_hlen_tos_len = ((uint32_t *)ipha)[0];
22577 	dst = ipha->ipha_dst;
22578 
22579 	io = (ipsec_out_t *)ipsec_mp->b_rptr;
22580 	ill_index = io->ipsec_out_ill_index;
22581 	attach_if = io->ipsec_out_attach_if;
22582 	zoneid = io->ipsec_out_zoneid;
22583 	ASSERT(zoneid != ALL_ZONES);
22584 	match_flags = MATCH_IRE_ILL_GROUP;
22585 	if (ill_index != 0) {
22586 		if (ill == NULL) {
22587 			ill = ip_grab_attach_ill(NULL, ipsec_mp,
22588 			    ill_index, B_FALSE);
22589 
22590 			/* Failure case frees things for us. */
22591 			if (ill == NULL)
22592 				return;
22593 
22594 			ill_need_rele = B_TRUE;
22595 		}
22596 		/*
22597 		 * If this packet needs to go out on a particular interface
22598 		 * honor it.
22599 		 */
22600 		if (attach_if) {
22601 			match_flags = MATCH_IRE_ILL;
22602 
22603 			/*
22604 			 * Check if we need an ire that will not be
22605 			 * looked up by anybody else i.e. HIDDEN.
22606 			 */
22607 			if (ill_is_probeonly(ill)) {
22608 				match_flags |= MATCH_IRE_MARK_HIDDEN;
22609 			}
22610 		}
22611 	}
22612 
22613 	if (CLASSD(dst)) {
22614 		boolean_t conn_dontroute;
22615 		/*
22616 		 * Use the ill_index to get the right ipif.
22617 		 */
22618 		conn_dontroute = io->ipsec_out_dontroute;
22619 		if (ill_index == 0)
22620 			ipif = ipif_lookup_group(dst, zoneid);
22621 		else
22622 			(void) ipif_lookup_zoneid(ill, zoneid, 0, &ipif);
22623 		if (ipif == NULL) {
22624 			ip1dbg(("ip_wput_ipsec_out: No ipif for"
22625 			    " multicast\n"));
22626 			BUMP_MIB(&ip_mib, ipOutNoRoutes);
22627 			freemsg(ipsec_mp);
22628 			goto done;
22629 		}
22630 		/*
22631 		 * ipha_src has already been intialized with the
22632 		 * value of the ipif in ip_wput. All we need now is
22633 		 * an ire to send this downstream.
22634 		 */
22635 		ire = ire_ctable_lookup(dst, 0, 0, ipif, zoneid, match_flags);
22636 		if (ire != NULL) {
22637 			ill_t *ill1;
22638 			/*
22639 			 * Do the multicast forwarding now, as the IPSEC
22640 			 * processing has been done.
22641 			 */
22642 			if (ip_g_mrouter && !conn_dontroute &&
22643 			    (ill1 = ire_to_ill(ire))) {
22644 				if (ip_mforward(ill1, ipha, mp)) {
22645 					freemsg(ipsec_mp);
22646 					ip1dbg(("ip_wput_ipsec_out: mforward "
22647 					    "failed\n"));
22648 					ire_refrele(ire);
22649 					goto done;
22650 				}
22651 			}
22652 			goto send;
22653 		}
22654 
22655 		ip0dbg(("ip_wput_ipsec_out: multicast: IRE disappeared\n"));
22656 		mp->b_prev = NULL;
22657 		mp->b_next = NULL;
22658 
22659 		/*
22660 		 * If the IPsec packet was processed asynchronously,
22661 		 * drop it now.
22662 		 */
22663 		if (q == NULL) {
22664 			freemsg(ipsec_mp);
22665 			goto done;
22666 		}
22667 
22668 		/*
22669 		 * We may be using a wrong ipif to create the ire.
22670 		 * But it is okay as the source address is assigned
22671 		 * for the packet already. Next outbound packet would
22672 		 * create the IRE with the right IPIF in ip_wput.
22673 		 *
22674 		 * Also handle RTF_MULTIRT routes.
22675 		 */
22676 		ip_newroute_ipif(q, ipsec_mp, ipif, dst, NULL, RTF_MULTIRT);
22677 	} else {
22678 		if (attach_if) {
22679 			ire = ire_ctable_lookup(dst, 0, 0, ill->ill_ipif,
22680 			    zoneid, match_flags);
22681 		} else {
22682 			if (ire_arg != NULL) {
22683 				ire = ire_arg;
22684 				ire_need_rele = B_FALSE;
22685 			} else {
22686 				ire = ire_cache_lookup(dst, zoneid);
22687 			}
22688 		}
22689 		if (ire != NULL) {
22690 			goto send;
22691 		}
22692 
22693 		/*
22694 		 * ire disappeared underneath.
22695 		 *
22696 		 * What we need to do here is the ip_newroute
22697 		 * logic to get the ire without doing the IPSEC
22698 		 * processing. Follow the same old path. But this
22699 		 * time, ip_wput or ire_add_then_put will call us
22700 		 * directly as all the IPSEC operations are done.
22701 		 */
22702 		ip1dbg(("ip_wput_ipsec_out: IRE disappeared\n"));
22703 		mp->b_prev = NULL;
22704 		mp->b_next = NULL;
22705 
22706 		/*
22707 		 * If the IPsec packet was processed asynchronously,
22708 		 * drop it now.
22709 		 */
22710 		if (q == NULL) {
22711 			freemsg(ipsec_mp);
22712 			goto done;
22713 		}
22714 
22715 		/*
22716 		 * Since we're going through ip_newroute() again, we
22717 		 * need to make sure we don't:
22718 		 *
22719 		 *	1.) Trigger the ASSERT() with the ipha_ident
22720 		 *	    overloading.
22721 		 *	2.) Redo transport-layer checksumming, since we've
22722 		 *	    already done all that to get this far.
22723 		 *
22724 		 * The easiest way not do either of the above is to set
22725 		 * the ipha_ident field to IP_HDR_INCLUDED.
22726 		 */
22727 		ipha->ipha_ident = IP_HDR_INCLUDED;
22728 		ip_newroute(q, ipsec_mp, dst, NULL,
22729 		    (CONN_Q(q) ? Q_TO_CONN(q) : NULL));
22730 	}
22731 	goto done;
22732 send:
22733 	if (ipha->ipha_protocol == IPPROTO_UDP && udp_compute_checksum()) {
22734 		/*
22735 		 * ESP NAT-Traversal packet.
22736 		 *
22737 		 * Just do software checksum for now.
22738 		 */
22739 
22740 		offset = IP_SIMPLE_HDR_LENGTH + UDP_CHECKSUM_OFFSET;
22741 		IP_STAT(ip_out_sw_cksum);
22742 #define	iphs	((uint16_t *)ipha)
22743 		cksum = IP_UDP_CSUM_COMP + iphs[6] + iphs[7] + iphs[8] +
22744 		    iphs[9] + ntohs(htons(ipha->ipha_length) -
22745 		    IP_SIMPLE_HDR_LENGTH);
22746 #undef iphs
22747 		if ((cksum = IP_CSUM(mp, IP_SIMPLE_HDR_LENGTH, cksum)) == 0)
22748 			cksum = 0xFFFF;
22749 		for (mp1 = mp; mp1 != NULL; mp1 = mp1->b_cont)
22750 			if (mp1->b_wptr - mp1->b_rptr >=
22751 			    offset + sizeof (uint16_t)) {
22752 				up = (uint16_t *)(mp1->b_rptr + offset);
22753 				*up = cksum;
22754 				break;	/* out of for loop */
22755 			} else {
22756 				offset -= (mp->b_wptr - mp->b_rptr);
22757 			}
22758 	} /* Otherwise, just keep the all-zero checksum. */
22759 
22760 	if (ire->ire_stq == NULL) {
22761 		/*
22762 		 * Loopbacks go through ip_wput_local except for one case.
22763 		 * We come here if we generate a icmp_frag_needed message
22764 		 * after IPSEC processing is over. When this function calls
22765 		 * ip_wput_ire_fragmentit, ip_wput_frag might end up calling
22766 		 * icmp_frag_needed. The message generated comes back here
22767 		 * through icmp_frag_needed -> icmp_pkt -> ip_wput ->
22768 		 * ipsec_out_process -> ip_wput_ipsec_out. We need to set the
22769 		 * source address as it is usually set in ip_wput_ire. As
22770 		 * ipsec_out_proc_begin is set, ip_wput calls ipsec_out_process
22771 		 * and we end up here. We can't enter ip_wput_ire once the
22772 		 * IPSEC processing is over and hence we need to do it here.
22773 		 */
22774 		ASSERT(q != NULL);
22775 		UPDATE_OB_PKT_COUNT(ire);
22776 		ire->ire_last_used_time = lbolt;
22777 		if (ipha->ipha_src == 0)
22778 			ipha->ipha_src = ire->ire_src_addr;
22779 		ip_wput_local(RD(q), ire->ire_ipif->ipif_ill, ipha, ipsec_mp,
22780 		    ire, 0, zoneid);
22781 		if (ire_need_rele)
22782 			ire_refrele(ire);
22783 		goto done;
22784 	}
22785 
22786 	if (ire->ire_max_frag < (unsigned int)LENGTH) {
22787 		/*
22788 		 * We are through with IPSEC processing.
22789 		 * Fragment this and send it on the wire.
22790 		 */
22791 		if (io->ipsec_out_accelerated) {
22792 			/*
22793 			 * The packet has been accelerated but must
22794 			 * be fragmented. This should not happen
22795 			 * since AH and ESP must not accelerate
22796 			 * packets that need fragmentation, however
22797 			 * the configuration could have changed
22798 			 * since the AH or ESP processing.
22799 			 * Drop packet.
22800 			 * IPsec KSTATS: bump bean counter here.
22801 			 */
22802 			IPSECHW_DEBUG(IPSECHW_PKT, ("ipsec_wput_ipsec_out: "
22803 			    "fragmented accelerated packet!\n"));
22804 			freemsg(ipsec_mp);
22805 		} else {
22806 			ip_wput_ire_fragmentit(ipsec_mp, ire);
22807 		}
22808 		if (ire_need_rele)
22809 			ire_refrele(ire);
22810 		goto done;
22811 	}
22812 
22813 	ip2dbg(("ip_wput_ipsec_out: ipsec_mp %p, ire %p, ire_ipif %p, "
22814 	    "ipif %p\n", (void *)ipsec_mp, (void *)ire,
22815 	    (void *)ire->ire_ipif, (void *)ipif));
22816 
22817 	/*
22818 	 * Multiroute the secured packet, unless IPsec really
22819 	 * requires the packet to go out only through a particular
22820 	 * interface.
22821 	 */
22822 	if ((ire->ire_flags & RTF_MULTIRT) && !attach_if) {
22823 		ire_t *first_ire;
22824 		irb = ire->ire_bucket;
22825 		ASSERT(irb != NULL);
22826 		/*
22827 		 * This ire has been looked up as the one that
22828 		 * goes through the given ipif;
22829 		 * make sure we do not omit any other multiroute ire
22830 		 * that may be present in the bucket before this one.
22831 		 */
22832 		IRB_REFHOLD(irb);
22833 		for (first_ire = irb->irb_ire;
22834 		    first_ire != NULL;
22835 		    first_ire = first_ire->ire_next) {
22836 			if ((first_ire->ire_flags & RTF_MULTIRT) &&
22837 			    (first_ire->ire_addr == ire->ire_addr) &&
22838 			    !(first_ire->ire_marks &
22839 				(IRE_MARK_CONDEMNED | IRE_MARK_HIDDEN)))
22840 				break;
22841 		}
22842 
22843 		if ((first_ire != NULL) && (first_ire != ire)) {
22844 			/*
22845 			 * Don't change the ire if the packet must
22846 			 * be fragmented if sent via this new one.
22847 			 */
22848 			if (first_ire->ire_max_frag >= (unsigned int)LENGTH) {
22849 				IRE_REFHOLD(first_ire);
22850 				if (ire_need_rele)
22851 					ire_refrele(ire);
22852 				else
22853 					ire_need_rele = B_TRUE;
22854 				ire = first_ire;
22855 			}
22856 		}
22857 		IRB_REFRELE(irb);
22858 
22859 		multirt_send = B_TRUE;
22860 		max_frag = ire->ire_max_frag;
22861 	} else {
22862 		if ((ire->ire_flags & RTF_MULTIRT) && attach_if) {
22863 			ip1dbg(("ip_wput_ipsec_out: ignoring multirouting "
22864 			    "flag, attach_if %d\n", attach_if));
22865 		}
22866 	}
22867 
22868 	/*
22869 	 * In most cases, the emission loop below is entered only once.
22870 	 * Only in the case where the ire holds the RTF_MULTIRT
22871 	 * flag, we loop to process all RTF_MULTIRT ires in the
22872 	 * bucket, and send the packet through all crossed
22873 	 * RTF_MULTIRT routes.
22874 	 */
22875 	do {
22876 		if (multirt_send) {
22877 			/*
22878 			 * ire1 holds here the next ire to process in the
22879 			 * bucket. If multirouting is expected,
22880 			 * any non-RTF_MULTIRT ire that has the
22881 			 * right destination address is ignored.
22882 			 */
22883 			ASSERT(irb != NULL);
22884 			IRB_REFHOLD(irb);
22885 			for (ire1 = ire->ire_next;
22886 			    ire1 != NULL;
22887 			    ire1 = ire1->ire_next) {
22888 				if ((ire1->ire_flags & RTF_MULTIRT) == 0)
22889 					continue;
22890 				if (ire1->ire_addr != ire->ire_addr)
22891 					continue;
22892 				if (ire1->ire_marks &
22893 				    (IRE_MARK_CONDEMNED | IRE_MARK_HIDDEN))
22894 					continue;
22895 				/* No loopback here */
22896 				if (ire1->ire_stq == NULL)
22897 					continue;
22898 				/*
22899 				 * Ensure we do not exceed the MTU
22900 				 * of the next route.
22901 				 */
22902 				if (ire1->ire_max_frag < (unsigned int)LENGTH) {
22903 					ip_multirt_bad_mtu(ire1, max_frag);
22904 					continue;
22905 				}
22906 
22907 				IRE_REFHOLD(ire1);
22908 				break;
22909 			}
22910 			IRB_REFRELE(irb);
22911 			if (ire1 != NULL) {
22912 				/*
22913 				 * We are in a multiple send case, need to
22914 				 * make a copy of the packet.
22915 				 */
22916 				next_mp = copymsg(ipsec_mp);
22917 				if (next_mp == NULL) {
22918 					ire_refrele(ire1);
22919 					ire1 = NULL;
22920 				}
22921 			}
22922 		}
22923 
22924 		/* Everything is done. Send it out on the wire */
22925 		mp1 = ip_wput_attach_llhdr(mp, ire, 0, 0);
22926 		if (mp1 == NULL) {
22927 			BUMP_MIB(&ip_mib, ipOutDiscards);
22928 			freemsg(ipsec_mp);
22929 			if (ire_need_rele)
22930 				ire_refrele(ire);
22931 			if (ire1 != NULL) {
22932 				ire_refrele(ire1);
22933 				freemsg(next_mp);
22934 			}
22935 			goto done;
22936 		}
22937 		UPDATE_OB_PKT_COUNT(ire);
22938 		ire->ire_last_used_time = lbolt;
22939 		if (!io->ipsec_out_accelerated) {
22940 			putnext(ire->ire_stq, mp1);
22941 		} else {
22942 			/*
22943 			 * Safety Pup says: make sure this is going to
22944 			 * the right interface!
22945 			 */
22946 			ill_t *ill1 = (ill_t *)ire->ire_stq->q_ptr;
22947 			int ifindex = ill1->ill_phyint->phyint_ifindex;
22948 
22949 			if (ifindex != io->ipsec_out_capab_ill_index) {
22950 				/* IPsec kstats: bump lose counter */
22951 				freemsg(mp1);
22952 			} else {
22953 				ipsec_hw_putnext(ire->ire_stq, mp1);
22954 			}
22955 		}
22956 
22957 		freeb(ipsec_mp);
22958 		if (ire_need_rele)
22959 			ire_refrele(ire);
22960 
22961 		if (ire1 != NULL) {
22962 			ire = ire1;
22963 			ire_need_rele = B_TRUE;
22964 			ASSERT(next_mp);
22965 			ipsec_mp = next_mp;
22966 			mp = ipsec_mp->b_cont;
22967 			ire1 = NULL;
22968 			next_mp = NULL;
22969 			io = (ipsec_out_t *)ipsec_mp->b_rptr;
22970 		} else {
22971 			multirt_send = B_FALSE;
22972 		}
22973 	} while (multirt_send);
22974 done:
22975 	if (ill != NULL && ill_need_rele)
22976 		ill_refrele(ill);
22977 	if (ipif != NULL)
22978 		ipif_refrele(ipif);
22979 }
22980 
22981 /*
22982  * Get the ill corresponding to the specified ire, and compare its
22983  * capabilities with the protocol and algorithms specified by the
22984  * the SA obtained from ipsec_out. If they match, annotate the
22985  * ipsec_out structure to indicate that the packet needs acceleration.
22986  *
22987  *
22988  * A packet is eligible for outbound hardware acceleration if the
22989  * following conditions are satisfied:
22990  *
22991  * 1. the packet will not be fragmented
22992  * 2. the provider supports the algorithm
22993  * 3. there is no pending control message being exchanged
22994  * 4. snoop is not attached
22995  * 5. the destination address is not a broadcast or multicast address.
22996  *
22997  * Rationale:
22998  *	- Hardware drivers do not support fragmentation with
22999  *	  the current interface.
23000  *	- snoop, multicast, and broadcast may result in exposure of
23001  *	  a cleartext datagram.
23002  * We check all five of these conditions here.
23003  *
23004  * XXX would like to nuke "ire_t *" parameter here; problem is that
23005  * IRE is only way to figure out if a v4 address is a broadcast and
23006  * thus ineligible for acceleration...
23007  */
23008 static void
23009 ipsec_out_is_accelerated(mblk_t *ipsec_mp, ipsa_t *sa, ill_t *ill, ire_t *ire)
23010 {
23011 	ipsec_out_t *io;
23012 	mblk_t *data_mp;
23013 	uint_t plen, overhead;
23014 
23015 	if ((sa->ipsa_flags & IPSA_F_HW) == 0)
23016 		return;
23017 
23018 	if (ill == NULL)
23019 		return;
23020 
23021 	/*
23022 	 * Destination address is a broadcast or multicast.  Punt.
23023 	 */
23024 	if ((ire != NULL) && (ire->ire_type & (IRE_BROADCAST|IRE_LOOPBACK|
23025 	    IRE_LOCAL)))
23026 		return;
23027 
23028 	data_mp = ipsec_mp->b_cont;
23029 
23030 	if (ill->ill_isv6) {
23031 		ip6_t *ip6h = (ip6_t *)data_mp->b_rptr;
23032 
23033 		if (IN6_IS_ADDR_MULTICAST(&ip6h->ip6_dst))
23034 			return;
23035 
23036 		plen = ip6h->ip6_plen;
23037 	} else {
23038 		ipha_t *ipha = (ipha_t *)data_mp->b_rptr;
23039 
23040 		if (CLASSD(ipha->ipha_dst))
23041 			return;
23042 
23043 		plen = ipha->ipha_length;
23044 	}
23045 	/*
23046 	 * Is there a pending DLPI control message being exchanged
23047 	 * between IP/IPsec and the DLS Provider? If there is, it
23048 	 * could be a SADB update, and the state of the DLS Provider
23049 	 * SADB might not be in sync with the SADB maintained by
23050 	 * IPsec. To avoid dropping packets or using the wrong keying
23051 	 * material, we do not accelerate this packet.
23052 	 */
23053 	if (ill->ill_dlpi_pending != DL_PRIM_INVAL) {
23054 		IPSECHW_DEBUG(IPSECHW_PKT, ("ipsec_out_check_is_accelerated: "
23055 		    "ill_dlpi_pending! don't accelerate packet\n"));
23056 		return;
23057 	}
23058 
23059 	/*
23060 	 * Is the Provider in promiscous mode? If it does, we don't
23061 	 * accelerate the packet since it will bounce back up to the
23062 	 * listeners in the clear.
23063 	 */
23064 	if (ill->ill_promisc_on_phys) {
23065 		IPSECHW_DEBUG(IPSECHW_PKT, ("ipsec_out_check_is_accelerated: "
23066 		    "ill in promiscous mode, don't accelerate packet\n"));
23067 		return;
23068 	}
23069 
23070 	/*
23071 	 * Will the packet require fragmentation?
23072 	 */
23073 
23074 	/*
23075 	 * IPsec ESP note: this is a pessimistic estimate, but the same
23076 	 * as is used elsewhere.
23077 	 * SPI + sequence + MAC + IV(blocksize) + padding(blocksize-1)
23078 	 *	+ 2-byte trailer
23079 	 */
23080 	overhead = (sa->ipsa_type == SADB_SATYPE_AH) ? IPSEC_MAX_AH_HDR_SIZE :
23081 	    IPSEC_BASE_ESP_HDR_SIZE(sa);
23082 
23083 	if ((plen + overhead) > ill->ill_max_mtu)
23084 		return;
23085 
23086 	io = (ipsec_out_t *)ipsec_mp->b_rptr;
23087 
23088 	/*
23089 	 * Can the ill accelerate this IPsec protocol and algorithm
23090 	 * specified by the SA?
23091 	 */
23092 	if (!ipsec_capab_match(ill, io->ipsec_out_capab_ill_index,
23093 	    ill->ill_isv6, sa)) {
23094 		return;
23095 	}
23096 
23097 	/*
23098 	 * Tell AH or ESP that the outbound ill is capable of
23099 	 * accelerating this packet.
23100 	 */
23101 	io->ipsec_out_is_capab_ill = B_TRUE;
23102 }
23103 
23104 /*
23105  * Select which AH & ESP SA's to use (if any) for the outbound packet.
23106  *
23107  * If this function returns B_TRUE, the requested SA's have been filled
23108  * into the ipsec_out_*_sa pointers.
23109  *
23110  * If the function returns B_FALSE, the packet has been "consumed", most
23111  * likely by an ACQUIRE sent up via PF_KEY to a key management daemon.
23112  *
23113  * The SA references created by the protocol-specific "select"
23114  * function will be released when the ipsec_mp is freed, thanks to the
23115  * ipsec_out_free destructor -- see spd.c.
23116  */
23117 static boolean_t
23118 ipsec_out_select_sa(mblk_t *ipsec_mp)
23119 {
23120 	boolean_t need_ah_acquire = B_FALSE, need_esp_acquire = B_FALSE;
23121 	ipsec_out_t *io;
23122 	ipsec_policy_t *pp;
23123 	ipsec_action_t *ap;
23124 	io = (ipsec_out_t *)ipsec_mp->b_rptr;
23125 	ASSERT(io->ipsec_out_type == IPSEC_OUT);
23126 	ASSERT(io->ipsec_out_len == sizeof (ipsec_out_t));
23127 
23128 	if (!io->ipsec_out_secure) {
23129 		/*
23130 		 * We came here by mistake.
23131 		 * Don't bother with ipsec processing
23132 		 * We should "discourage" this path in the future.
23133 		 */
23134 		ASSERT(io->ipsec_out_proc_begin == B_FALSE);
23135 		return (B_FALSE);
23136 	}
23137 	ASSERT(io->ipsec_out_need_policy == B_FALSE);
23138 	ASSERT((io->ipsec_out_policy != NULL) ||
23139 	    (io->ipsec_out_act != NULL));
23140 
23141 	ASSERT(io->ipsec_out_failed == B_FALSE);
23142 
23143 	/*
23144 	 * IPSEC processing has started.
23145 	 */
23146 	io->ipsec_out_proc_begin = B_TRUE;
23147 	ap = io->ipsec_out_act;
23148 	if (ap == NULL) {
23149 		pp = io->ipsec_out_policy;
23150 		ASSERT(pp != NULL);
23151 		ap = pp->ipsp_act;
23152 		ASSERT(ap != NULL);
23153 	}
23154 
23155 	/*
23156 	 * We have an action.  now, let's select SA's.
23157 	 * (In the future, we can cache this in the conn_t..)
23158 	 */
23159 	if (ap->ipa_want_esp) {
23160 		if (io->ipsec_out_esp_sa == NULL) {
23161 			need_esp_acquire = !ipsec_outbound_sa(ipsec_mp,
23162 			    IPPROTO_ESP);
23163 		}
23164 		ASSERT(need_esp_acquire || io->ipsec_out_esp_sa != NULL);
23165 	}
23166 
23167 	if (ap->ipa_want_ah) {
23168 		if (io->ipsec_out_ah_sa == NULL) {
23169 			need_ah_acquire = !ipsec_outbound_sa(ipsec_mp,
23170 			    IPPROTO_AH);
23171 		}
23172 		ASSERT(need_ah_acquire || io->ipsec_out_ah_sa != NULL);
23173 		/*
23174 		 * The ESP and AH processing order needs to be preserved
23175 		 * when both protocols are required (ESP should be applied
23176 		 * before AH for an outbound packet). Force an ESP ACQUIRE
23177 		 * when both ESP and AH are required, and an AH ACQUIRE
23178 		 * is needed.
23179 		 */
23180 		if (ap->ipa_want_esp && need_ah_acquire)
23181 			need_esp_acquire = B_TRUE;
23182 	}
23183 
23184 	/*
23185 	 * Send an ACQUIRE (extended, regular, or both) if we need one.
23186 	 * Release SAs that got referenced, but will not be used until we
23187 	 * acquire _all_ of the SAs we need.
23188 	 */
23189 	if (need_ah_acquire || need_esp_acquire) {
23190 		if (io->ipsec_out_ah_sa != NULL) {
23191 			IPSA_REFRELE(io->ipsec_out_ah_sa);
23192 			io->ipsec_out_ah_sa = NULL;
23193 		}
23194 		if (io->ipsec_out_esp_sa != NULL) {
23195 			IPSA_REFRELE(io->ipsec_out_esp_sa);
23196 			io->ipsec_out_esp_sa = NULL;
23197 		}
23198 
23199 		sadb_acquire(ipsec_mp, io, need_ah_acquire, need_esp_acquire);
23200 		return (B_FALSE);
23201 	}
23202 
23203 	return (B_TRUE);
23204 }
23205 
23206 /*
23207  * Process an IPSEC_OUT message and see what you can
23208  * do with it.
23209  * IPQoS Notes:
23210  * We do IPPF processing if IPP_LOCAL_OUT is enabled before processing for
23211  * IPSec.
23212  * XXX would like to nuke ire_t.
23213  * XXX ill_index better be "real"
23214  */
23215 void
23216 ipsec_out_process(queue_t *q, mblk_t *ipsec_mp, ire_t *ire, uint_t ill_index)
23217 {
23218 	ipsec_out_t *io;
23219 	ipsec_policy_t *pp;
23220 	ipsec_action_t *ap;
23221 	ipha_t *ipha;
23222 	ip6_t *ip6h;
23223 	mblk_t *mp;
23224 	ill_t *ill;
23225 	zoneid_t zoneid;
23226 	ipsec_status_t ipsec_rc;
23227 	boolean_t ill_need_rele = B_FALSE;
23228 
23229 	io = (ipsec_out_t *)ipsec_mp->b_rptr;
23230 	ASSERT(io->ipsec_out_type == IPSEC_OUT);
23231 	ASSERT(io->ipsec_out_len == sizeof (ipsec_out_t));
23232 	mp = ipsec_mp->b_cont;
23233 
23234 	/*
23235 	 * Initiate IPPF processing. We do it here to account for packets
23236 	 * coming here that don't have any policy (i.e. !io->ipsec_out_secure).
23237 	 * We can check for ipsec_out_proc_begin even for such packets, as
23238 	 * they will always be false (asserted below).
23239 	 */
23240 	if (IPP_ENABLED(IPP_LOCAL_OUT) && !io->ipsec_out_proc_begin) {
23241 		ip_process(IPP_LOCAL_OUT, &mp, io->ipsec_out_ill_index != 0 ?
23242 		    io->ipsec_out_ill_index : ill_index);
23243 		if (mp == NULL) {
23244 			ip2dbg(("ipsec_out_process: packet dropped "\
23245 			    "during IPPF processing\n"));
23246 			freeb(ipsec_mp);
23247 			BUMP_MIB(&ip_mib, ipOutDiscards);
23248 			return;
23249 		}
23250 	}
23251 
23252 	if (!io->ipsec_out_secure) {
23253 		/*
23254 		 * We came here by mistake.
23255 		 * Don't bother with ipsec processing
23256 		 * Should "discourage" this path in the future.
23257 		 */
23258 		ASSERT(io->ipsec_out_proc_begin == B_FALSE);
23259 		goto done;
23260 	}
23261 	ASSERT(io->ipsec_out_need_policy == B_FALSE);
23262 	ASSERT((io->ipsec_out_policy != NULL) ||
23263 	    (io->ipsec_out_act != NULL));
23264 	ASSERT(io->ipsec_out_failed == B_FALSE);
23265 
23266 	if (!ipsec_loaded()) {
23267 		ipha = (ipha_t *)ipsec_mp->b_cont->b_rptr;
23268 		if (IPH_HDR_VERSION(ipha) == IP_VERSION) {
23269 			BUMP_MIB(&ip_mib, ipOutDiscards);
23270 		} else {
23271 			BUMP_MIB(&ip6_mib, ipv6OutDiscards);
23272 		}
23273 		ip_drop_packet(ipsec_mp, B_FALSE, NULL, ire,
23274 		    &ipdrops_ip_ipsec_not_loaded, &ip_dropper);
23275 		return;
23276 	}
23277 
23278 	/*
23279 	 * IPSEC processing has started.
23280 	 */
23281 	io->ipsec_out_proc_begin = B_TRUE;
23282 	ap = io->ipsec_out_act;
23283 	if (ap == NULL) {
23284 		pp = io->ipsec_out_policy;
23285 		ASSERT(pp != NULL);
23286 		ap = pp->ipsp_act;
23287 		ASSERT(ap != NULL);
23288 	}
23289 
23290 	/*
23291 	 * Save the outbound ill index. When the packet comes back
23292 	 * from IPsec, we make sure the ill hasn't changed or disappeared
23293 	 * before sending it the accelerated packet.
23294 	 */
23295 	if ((ire != NULL) && (io->ipsec_out_capab_ill_index == 0)) {
23296 		int ifindex;
23297 		ill = ire_to_ill(ire);
23298 		ifindex = ill->ill_phyint->phyint_ifindex;
23299 		io->ipsec_out_capab_ill_index = ifindex;
23300 	}
23301 
23302 	/*
23303 	 * The order of processing is first insert a IP header if needed.
23304 	 * Then insert the ESP header and then the AH header.
23305 	 */
23306 	if ((io->ipsec_out_se_done == B_FALSE) &&
23307 	    (ap->ipa_want_se)) {
23308 		/*
23309 		 * First get the outer IP header before sending
23310 		 * it to ESP.
23311 		 */
23312 		ipha_t *oipha, *iipha;
23313 		mblk_t *outer_mp, *inner_mp;
23314 
23315 		if ((outer_mp = allocb(sizeof (ipha_t), BPRI_HI)) == NULL) {
23316 			(void) mi_strlog(q, 0, SL_ERROR|SL_TRACE|SL_CONSOLE,
23317 			    "ipsec_out_process: "
23318 			    "Self-Encapsulation failed: Out of memory\n");
23319 			freemsg(ipsec_mp);
23320 			BUMP_MIB(&ip_mib, ipOutDiscards);
23321 			return;
23322 		}
23323 		inner_mp = ipsec_mp->b_cont;
23324 		ASSERT(inner_mp->b_datap->db_type == M_DATA);
23325 		oipha = (ipha_t *)outer_mp->b_rptr;
23326 		iipha = (ipha_t *)inner_mp->b_rptr;
23327 		*oipha = *iipha;
23328 		outer_mp->b_wptr += sizeof (ipha_t);
23329 		oipha->ipha_length = htons(ntohs(iipha->ipha_length) +
23330 		    sizeof (ipha_t));
23331 		oipha->ipha_protocol = IPPROTO_ENCAP;
23332 		oipha->ipha_version_and_hdr_length =
23333 		    IP_SIMPLE_HDR_VERSION;
23334 		oipha->ipha_hdr_checksum = 0;
23335 		oipha->ipha_hdr_checksum = ip_csum_hdr(oipha);
23336 		outer_mp->b_cont = inner_mp;
23337 		ipsec_mp->b_cont = outer_mp;
23338 
23339 		io->ipsec_out_se_done = B_TRUE;
23340 		io->ipsec_out_encaps = B_TRUE;
23341 	}
23342 
23343 	if (((ap->ipa_want_ah && (io->ipsec_out_ah_sa == NULL)) ||
23344 	    (ap->ipa_want_esp && (io->ipsec_out_esp_sa == NULL))) &&
23345 	    !ipsec_out_select_sa(ipsec_mp))
23346 		return;
23347 
23348 	/*
23349 	 * By now, we know what SA's to use.  Toss over to ESP & AH
23350 	 * to do the heavy lifting.
23351 	 */
23352 	zoneid = io->ipsec_out_zoneid;
23353 	ASSERT(zoneid != ALL_ZONES);
23354 	if ((io->ipsec_out_esp_done == B_FALSE) && (ap->ipa_want_esp)) {
23355 		ASSERT(io->ipsec_out_esp_sa != NULL);
23356 		io->ipsec_out_esp_done = B_TRUE;
23357 		/*
23358 		 * Note that since hw accel can only apply one transform,
23359 		 * not two, we skip hw accel for ESP if we also have AH
23360 		 * This is an design limitation of the interface
23361 		 * which should be revisited.
23362 		 */
23363 		ASSERT(ire != NULL);
23364 		if (io->ipsec_out_ah_sa == NULL) {
23365 			ill = (ill_t *)ire->ire_stq->q_ptr;
23366 			ipsec_out_is_accelerated(ipsec_mp,
23367 			    io->ipsec_out_esp_sa, ill, ire);
23368 		}
23369 
23370 		ipsec_rc = io->ipsec_out_esp_sa->ipsa_output_func(ipsec_mp);
23371 		switch (ipsec_rc) {
23372 		case IPSEC_STATUS_SUCCESS:
23373 			break;
23374 		case IPSEC_STATUS_FAILED:
23375 			BUMP_MIB(&ip_mib, ipOutDiscards);
23376 			/* FALLTHRU */
23377 		case IPSEC_STATUS_PENDING:
23378 			return;
23379 		}
23380 	}
23381 
23382 	if ((io->ipsec_out_ah_done == B_FALSE) && (ap->ipa_want_ah)) {
23383 		ASSERT(io->ipsec_out_ah_sa != NULL);
23384 		io->ipsec_out_ah_done = B_TRUE;
23385 		if (ire == NULL) {
23386 			int idx = io->ipsec_out_capab_ill_index;
23387 			ill = ill_lookup_on_ifindex(idx, B_FALSE,
23388 			    NULL, NULL, NULL, NULL);
23389 			ill_need_rele = B_TRUE;
23390 		} else {
23391 			ill = (ill_t *)ire->ire_stq->q_ptr;
23392 		}
23393 		ipsec_out_is_accelerated(ipsec_mp, io->ipsec_out_ah_sa, ill,
23394 		    ire);
23395 
23396 		ipsec_rc = io->ipsec_out_ah_sa->ipsa_output_func(ipsec_mp);
23397 		switch (ipsec_rc) {
23398 		case IPSEC_STATUS_SUCCESS:
23399 			break;
23400 		case IPSEC_STATUS_FAILED:
23401 			BUMP_MIB(&ip_mib, ipOutDiscards);
23402 			/* FALLTHRU */
23403 		case IPSEC_STATUS_PENDING:
23404 			if (ill != NULL && ill_need_rele)
23405 				ill_refrele(ill);
23406 			return;
23407 		}
23408 	}
23409 	/*
23410 	 * We are done with IPSEC processing. Send it over
23411 	 * the wire.
23412 	 */
23413 done:
23414 	mp = ipsec_mp->b_cont;
23415 	ipha = (ipha_t *)mp->b_rptr;
23416 	if (IPH_HDR_VERSION(ipha) == IP_VERSION) {
23417 		ip_wput_ipsec_out(q, ipsec_mp, ipha, ill, ire);
23418 	} else {
23419 		ip6h = (ip6_t *)ipha;
23420 		ip_wput_ipsec_out_v6(q, ipsec_mp, ip6h, ill, ire);
23421 	}
23422 	if (ill != NULL && ill_need_rele)
23423 		ill_refrele(ill);
23424 }
23425 
23426 /* ARGSUSED */
23427 void
23428 ip_restart_optmgmt(ipsq_t *dummy_sq, queue_t *q, mblk_t *first_mp, void *dummy)
23429 {
23430 	opt_restart_t	*or;
23431 	int	err;
23432 	conn_t	*connp;
23433 
23434 	ASSERT(CONN_Q(q));
23435 	connp = Q_TO_CONN(q);
23436 
23437 	ASSERT(first_mp->b_datap->db_type == M_CTL);
23438 	or = (opt_restart_t *)first_mp->b_rptr;
23439 	/*
23440 	 * We don't need to pass any credentials here since this is just
23441 	 * a restart. The credentials are passed in when svr4_optcom_req
23442 	 * is called the first time (from ip_wput_nondata).
23443 	 */
23444 	if (or->or_type == T_SVR4_OPTMGMT_REQ) {
23445 		err = svr4_optcom_req(q, first_mp, NULL,
23446 		    &ip_opt_obj);
23447 	} else {
23448 		ASSERT(or->or_type == T_OPTMGMT_REQ);
23449 		err = tpi_optcom_req(q, first_mp, NULL,
23450 		    &ip_opt_obj);
23451 	}
23452 	if (err != EINPROGRESS) {
23453 		/* operation is done */
23454 		CONN_OPER_PENDING_DONE(connp);
23455 	}
23456 }
23457 
23458 /*
23459  * ioctls that go through a down/up sequence may need to wait for the down
23460  * to complete. This involves waiting for the ire and ipif refcnts to go down
23461  * to zero. Subsequently the ioctl is restarted from ipif_ill_refrele_tail.
23462  */
23463 /* ARGSUSED */
23464 void
23465 ip_reprocess_ioctl(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg)
23466 {
23467 	struct iocblk *iocp;
23468 	mblk_t *mp1;
23469 	ipif_t	*ipif;
23470 	ip_ioctl_cmd_t *ipip;
23471 	int err;
23472 	sin_t	*sin;
23473 	struct lifreq *lifr;
23474 	struct ifreq *ifr;
23475 
23476 	iocp = (struct iocblk *)mp->b_rptr;
23477 	ASSERT(ipsq != NULL);
23478 	/* Existence of mp1 verified in ip_wput_nondata */
23479 	mp1 = mp->b_cont->b_cont;
23480 	ipip = ip_sioctl_lookup(iocp->ioc_cmd);
23481 	if (ipip->ipi_cmd == SIOCSLIFNAME || ipip->ipi_cmd == IF_UNITSEL) {
23482 		ill_t *ill;
23483 		/*
23484 		 * Special case where ipsq_current_ipif may not be set.
23485 		 * ill_phyint_reinit merged the v4 and v6 into a single ipsq.
23486 		 * ill could also have become part of a ipmp group in the
23487 		 * process, we are here as were not able to complete the
23488 		 * operation in ipif_set_values because we could not become
23489 		 * exclusive on the new ipsq, In such a case ipsq_current_ipif
23490 		 * will not be set so we need to set it.
23491 		 */
23492 		ill = (ill_t *)q->q_ptr;
23493 		ipsq->ipsq_current_ipif = ill->ill_ipif;
23494 		ipsq->ipsq_last_cmd = ipip->ipi_cmd;
23495 	}
23496 
23497 	ipif = ipsq->ipsq_current_ipif;
23498 	ASSERT(ipif != NULL);
23499 	if (ipip->ipi_cmd_type == IF_CMD) {
23500 		/* This a old style SIOC[GS]IF* command */
23501 		ifr = (struct ifreq *)mp1->b_rptr;
23502 		sin = (sin_t *)&ifr->ifr_addr;
23503 	} else if (ipip->ipi_cmd_type == LIF_CMD) {
23504 		/* This a new style SIOC[GS]LIF* command */
23505 		lifr = (struct lifreq *)mp1->b_rptr;
23506 		sin = (sin_t *)&lifr->lifr_addr;
23507 	} else {
23508 		sin = NULL;
23509 	}
23510 
23511 	err = (*ipip->ipi_func_restart)(ipif, sin, q, mp, ipip,
23512 	    (void *)mp1->b_rptr);
23513 
23514 	/* SIOCLIFREMOVEIF could have removed the ipif */
23515 	ip_ioctl_finish(q, mp, err,
23516 	    ipip->ipi_flags & IPI_GET_CMD ? COPYOUT : NO_COPYOUT,
23517 	    ipip->ipi_cmd == SIOCLIFREMOVEIF ? NULL : ipif, ipsq);
23518 }
23519 
23520 /*
23521  * ioctl processing
23522  *
23523  * ioctl processing starts with ip_sioctl_copyin_setup which looks up
23524  * the ioctl command in the ioctl tables and determines the copyin data size
23525  * from the ioctl property ipi_copyin_size, and does an mi_copyin() of that
23526  * size.
23527  *
23528  * ioctl processing then continues when the M_IOCDATA makes its way down.
23529  * Now the ioctl is looked up again in the ioctl table, and its properties are
23530  * extracted. The associated 'conn' is then refheld till the end of the ioctl
23531  * and the general ioctl processing function ip_process_ioctl is called.
23532  * ip_process_ioctl determines if the ioctl needs to be serialized, and if
23533  * so goes thru the serialization primitive ipsq_try_enter. Then the
23534  * appropriate function to handle the ioctl is called based on the entry in
23535  * the ioctl table. ioctl completion is encapsulated in ip_ioctl_finish
23536  * which also refreleases the 'conn' that was refheld at the start of the
23537  * ioctl. Finally ipsq_exit is called if needed to exit the ipsq.
23538  * ip_extract_lifreq_cmn extracts the interface name from the lifreq/ifreq
23539  * struct and looks up the ipif. ip_extract_tunreq handles the case of tunnel.
23540  *
23541  * Many exclusive ioctls go thru an internal down up sequence as part of
23542  * the operation. For example an attempt to change the IP address of an
23543  * ipif entails ipif_down, set address, ipif_up. Bringing down the interface
23544  * does all the cleanup such as deleting all ires that use this address.
23545  * Then we need to wait till all references to the interface go away.
23546  */
23547 void
23548 ip_process_ioctl(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *arg)
23549 {
23550 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
23551 	ip_ioctl_cmd_t *ipip = (ip_ioctl_cmd_t *)arg;
23552 	cmd_info_t ci;
23553 	int err;
23554 	boolean_t entered_ipsq = B_FALSE;
23555 
23556 	ip3dbg(("ip_process_ioctl: ioctl %X\n", iocp->ioc_cmd));
23557 
23558 	if (ipip == NULL)
23559 		ipip = ip_sioctl_lookup(iocp->ioc_cmd);
23560 
23561 	/*
23562 	 * SIOCLIFADDIF needs to go thru a special path since the
23563 	 * ill may not exist yet. This happens in the case of lo0
23564 	 * which is created using this ioctl.
23565 	 */
23566 	if (ipip->ipi_cmd == SIOCLIFADDIF) {
23567 		err = ip_sioctl_addif(NULL, NULL, q, mp, NULL, NULL);
23568 		ip_ioctl_finish(q, mp, err,
23569 		    ipip->ipi_flags & IPI_GET_CMD ? COPYOUT : NO_COPYOUT,
23570 		    NULL, NULL);
23571 		return;
23572 	}
23573 
23574 	ci.ci_ipif = NULL;
23575 	switch (ipip->ipi_cmd_type) {
23576 	case IF_CMD:
23577 	case LIF_CMD:
23578 		/*
23579 		 * ioctls that pass in a [l]ifreq appear here.
23580 		 * ip_extract_lifreq_cmn returns a refheld ipif in
23581 		 * ci.ci_ipif
23582 		 */
23583 		err = ip_extract_lifreq_cmn(q, mp, ipip->ipi_cmd_type,
23584 		    ipip->ipi_flags, &ci, ip_process_ioctl);
23585 		if (err != 0) {
23586 			ip_ioctl_finish(q, mp, err,
23587 			    ipip->ipi_flags & IPI_GET_CMD ?
23588 			    COPYOUT : NO_COPYOUT, NULL, NULL);
23589 			return;
23590 		}
23591 		ASSERT(ci.ci_ipif != NULL);
23592 		break;
23593 
23594 	case TUN_CMD:
23595 		/*
23596 		 * SIOC[GS]TUNPARAM appear here. ip_extract_tunreq returns
23597 		 * a refheld ipif in ci.ci_ipif
23598 		 */
23599 		err = ip_extract_tunreq(q, mp, &ci.ci_ipif, ip_process_ioctl);
23600 		if (err != 0) {
23601 			ip_ioctl_finish(q, mp, err,
23602 			    ipip->ipi_flags & IPI_GET_CMD ?
23603 			    COPYOUT : NO_COPYOUT, NULL, NULL);
23604 			return;
23605 		}
23606 		ASSERT(ci.ci_ipif != NULL);
23607 		break;
23608 
23609 	case MISC_CMD:
23610 		/*
23611 		 * ioctls that neither pass in [l]ifreq or iftun_req come here
23612 		 * For eg. SIOCGLIFCONF will appear here.
23613 		 */
23614 		switch (ipip->ipi_cmd) {
23615 		case IF_UNITSEL:
23616 			/* ioctl comes down the ill */
23617 			ci.ci_ipif = ((ill_t *)q->q_ptr)->ill_ipif;
23618 			ipif_refhold(ci.ci_ipif);
23619 			break;
23620 		case SIOCGMSFILTER:
23621 		case SIOCSMSFILTER:
23622 		case SIOCGIPMSFILTER:
23623 		case SIOCSIPMSFILTER:
23624 			err = ip_extract_msfilter(q, mp, &ci.ci_ipif,
23625 			    ip_process_ioctl);
23626 			if (err != 0) {
23627 				ip_ioctl_finish(q, mp, err,
23628 				    ipip->ipi_flags & IPI_GET_CMD ?
23629 				    COPYOUT : NO_COPYOUT, NULL, NULL);
23630 				return;
23631 			}
23632 			break;
23633 		}
23634 		err = 0;
23635 		ci.ci_sin = NULL;
23636 		ci.ci_sin6 = NULL;
23637 		ci.ci_lifr = NULL;
23638 		break;
23639 	}
23640 
23641 	/*
23642 	 * If ipsq is non-null, we are already being called exclusively
23643 	 */
23644 	ASSERT(ipsq == NULL || IAM_WRITER_IPSQ(ipsq));
23645 	if (!(ipip->ipi_flags & IPI_WR)) {
23646 		/*
23647 		 * A return value of EINPROGRESS means the ioctl is
23648 		 * either queued and waiting for some reason or has
23649 		 * already completed.
23650 		 */
23651 		err = (*ipip->ipi_func)(ci.ci_ipif, ci.ci_sin, q, mp, ipip,
23652 		    ci.ci_lifr);
23653 		if (ci.ci_ipif != NULL)
23654 			ipif_refrele(ci.ci_ipif);
23655 		ip_ioctl_finish(q, mp, err,
23656 		    ipip->ipi_flags & IPI_GET_CMD ? COPYOUT : NO_COPYOUT,
23657 		    NULL, NULL);
23658 		return;
23659 	}
23660 
23661 	ASSERT(ci.ci_ipif != NULL);
23662 
23663 	if (ipsq == NULL) {
23664 		ipsq = ipsq_try_enter(ci.ci_ipif, NULL, q, mp,
23665 		    ip_process_ioctl, NEW_OP, B_TRUE);
23666 		entered_ipsq = B_TRUE;
23667 	}
23668 	/*
23669 	 * Release the ipif so that ipif_down and friends that wait for
23670 	 * references to go away are not misled about the current ipif_refcnt
23671 	 * values. We are writer so we can access the ipif even after releasing
23672 	 * the ipif.
23673 	 */
23674 	ipif_refrele(ci.ci_ipif);
23675 	if (ipsq == NULL)
23676 		return;
23677 
23678 	mutex_enter(&ipsq->ipsq_lock);
23679 	ASSERT(ipsq->ipsq_current_ipif == NULL);
23680 	ipsq->ipsq_current_ipif = ci.ci_ipif;
23681 	ipsq->ipsq_last_cmd = ipip->ipi_cmd;
23682 	mutex_exit(&ipsq->ipsq_lock);
23683 	mutex_enter(&(ci.ci_ipif)->ipif_ill->ill_lock);
23684 	/*
23685 	 * For most set ioctls that come here, this serves as a single point
23686 	 * where we set the IPIF_CHANGING flag. This ensures that there won't
23687 	 * be any new references to the ipif. This helps functions that go
23688 	 * through this path and end up trying to wait for the refcnts
23689 	 * associated with the ipif to go down to zero. Some exceptions are
23690 	 * Failover, Failback, and Groupname commands that operate on more than
23691 	 * just the ci.ci_ipif. These commands internally determine the
23692 	 * set of ipif's they operate on and set and clear the IPIF_CHANGING
23693 	 * flags on that set. Another exception is the Removeif command that
23694 	 * sets the IPIF_CONDEMNED flag internally after identifying the right
23695 	 * ipif to operate on.
23696 	 */
23697 	if (ipip->ipi_cmd != SIOCLIFREMOVEIF &&
23698 	    ipip->ipi_cmd != SIOCLIFFAILOVER &&
23699 	    ipip->ipi_cmd != SIOCLIFFAILBACK &&
23700 	    ipip->ipi_cmd != SIOCSLIFGROUPNAME)
23701 		(ci.ci_ipif)->ipif_state_flags |= IPIF_CHANGING;
23702 	mutex_exit(&(ci.ci_ipif)->ipif_ill->ill_lock);
23703 
23704 	/*
23705 	 * A return value of EINPROGRESS means the ioctl is
23706 	 * either queued and waiting for some reason or has
23707 	 * already completed.
23708 	 */
23709 	err = (*ipip->ipi_func)(ci.ci_ipif, ci.ci_sin, q, mp, ipip,
23710 	    ci.ci_lifr);
23711 
23712 	/* SIOCLIFREMOVEIF could have removed the ipif */
23713 	ip_ioctl_finish(q, mp, err,
23714 	    ipip->ipi_flags & IPI_GET_CMD ? COPYOUT : NO_COPYOUT,
23715 	    ipip->ipi_cmd == SIOCLIFREMOVEIF ? NULL : ci.ci_ipif, ipsq);
23716 
23717 	if (entered_ipsq)
23718 		ipsq_exit(ipsq, B_TRUE, B_TRUE);
23719 }
23720 
23721 /*
23722  * Complete the ioctl. Typically ioctls use the mi package and need to
23723  * do mi_copyout/mi_copy_done.
23724  */
23725 void
23726 ip_ioctl_finish(queue_t *q, mblk_t *mp, int err, int mode,
23727     ipif_t *ipif, ipsq_t *ipsq)
23728 {
23729 	conn_t	*connp = NULL;
23730 
23731 	if (err == EINPROGRESS)
23732 		return;
23733 
23734 	if (CONN_Q(q)) {
23735 		connp = Q_TO_CONN(q);
23736 		ASSERT(connp->conn_ref >= 2);
23737 	}
23738 
23739 	switch (mode) {
23740 	case COPYOUT:
23741 		if (err == 0)
23742 			mi_copyout(q, mp);
23743 		else
23744 			mi_copy_done(q, mp, err);
23745 		break;
23746 
23747 	case NO_COPYOUT:
23748 		mi_copy_done(q, mp, err);
23749 		break;
23750 
23751 	default:
23752 		/* An ioctl aborted through a conn close would take this path */
23753 		break;
23754 	}
23755 
23756 	/*
23757 	 * The refhold placed at the start of the ioctl is released here.
23758 	 */
23759 	if (connp != NULL)
23760 		CONN_OPER_PENDING_DONE(connp);
23761 
23762 	/*
23763 	 * If the ioctl were an exclusive ioctl it would have set
23764 	 * IPIF_CHANGING at the start of the ioctl which is undone here.
23765 	 */
23766 	if (ipif != NULL) {
23767 		mutex_enter(&(ipif)->ipif_ill->ill_lock);
23768 		ipif->ipif_state_flags &= ~IPIF_CHANGING;
23769 		mutex_exit(&(ipif)->ipif_ill->ill_lock);
23770 	}
23771 
23772 	/*
23773 	 * Clear the current ipif in the ipsq at the completion of the ioctl.
23774 	 * Note that a non-null ipsq_current_ipif prevents new ioctls from
23775 	 * entering the ipsq
23776 	 */
23777 	if (ipsq != NULL) {
23778 		mutex_enter(&ipsq->ipsq_lock);
23779 		ipsq->ipsq_current_ipif = NULL;
23780 		mutex_exit(&ipsq->ipsq_lock);
23781 	}
23782 }
23783 
23784 /*
23785  * This is called from ip_wput_nondata to resume a deferred TCP bind.
23786  */
23787 /* ARGSUSED */
23788 void
23789 ip_resume_tcp_bind(void *arg, mblk_t *mp, void *arg2)
23790 {
23791 	conn_t *connp = (conn_t *)arg;
23792 	tcp_t	*tcp;
23793 
23794 	ASSERT(connp != NULL && connp->conn_tcp != NULL);
23795 	tcp = connp->conn_tcp;
23796 
23797 	if (connp->conn_tcp->tcp_state == TCPS_CLOSED)
23798 		freemsg(mp);
23799 	else
23800 		tcp_rput_other(tcp, mp);
23801 	CONN_OPER_PENDING_DONE(connp);
23802 
23803 }
23804 
23805 /* Called from ip_wput for all non data messages */
23806 /* ARGSUSED */
23807 void
23808 ip_wput_nondata(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg)
23809 {
23810 	mblk_t		*mp1;
23811 	ire_t		*ire;
23812 	ill_t		*ill;
23813 	struct iocblk	*iocp;
23814 	ip_ioctl_cmd_t	*ipip;
23815 	cred_t		*cr;
23816 	conn_t		*connp = NULL;
23817 	int		cmd, err;
23818 
23819 	if (CONN_Q(q))
23820 		connp = Q_TO_CONN(q);
23821 
23822 	cr = DB_CREDDEF(mp, GET_QUEUE_CRED(q));
23823 
23824 	/* Check if it is a queue to /dev/sctp. */
23825 	if (connp != NULL && connp->conn_ulp == IPPROTO_SCTP &&
23826 	    connp->conn_rq == NULL) {
23827 		sctp_wput(q, mp);
23828 		return;
23829 	}
23830 
23831 	switch (DB_TYPE(mp)) {
23832 	case M_IOCTL:
23833 		/*
23834 		 * IOCTL processing begins in ip_sioctl_copyin_setup which
23835 		 * will arrange to copy in associated control structures.
23836 		 */
23837 		ip_sioctl_copyin_setup(q, mp);
23838 		return;
23839 	case M_IOCDATA:
23840 		/*
23841 		 * Ensure that this is associated with one of our trans-
23842 		 * parent ioctls.  If it's not ours, discard it if we're
23843 		 * running as a driver, or pass it on if we're a module.
23844 		 */
23845 		iocp = (struct iocblk *)mp->b_rptr;
23846 		ipip = ip_sioctl_lookup(iocp->ioc_cmd);
23847 		if (ipip == NULL) {
23848 			if (q->q_next == NULL) {
23849 				goto nak;
23850 			} else {
23851 				putnext(q, mp);
23852 			}
23853 			return;
23854 		} else if ((q->q_next != NULL) &&
23855 		    !(ipip->ipi_flags & IPI_MODOK)) {
23856 			/*
23857 			 * the ioctl is one we recognise, but is not
23858 			 * consumed by IP as a module, pass M_IOCDATA
23859 			 * for processing downstream, but only for
23860 			 * common Streams ioctls.
23861 			 */
23862 			if (ipip->ipi_flags & IPI_PASS_DOWN) {
23863 				putnext(q, mp);
23864 				return;
23865 			} else {
23866 				goto nak;
23867 			}
23868 		}
23869 
23870 		/* IOCTL continuation following copyin or copyout. */
23871 		if (mi_copy_state(q, mp, NULL) == -1) {
23872 			/*
23873 			 * The copy operation failed.  mi_copy_state already
23874 			 * cleaned up, so we're out of here.
23875 			 */
23876 			return;
23877 		}
23878 		/*
23879 		 * If we just completed a copy in, we become writer and
23880 		 * continue processing in ip_sioctl_copyin_done.  If it
23881 		 * was a copy out, we call mi_copyout again.  If there is
23882 		 * nothing more to copy out, it will complete the IOCTL.
23883 		 */
23884 		if (MI_COPY_DIRECTION(mp) == MI_COPY_IN) {
23885 			if (!(mp1 = mp->b_cont) || !(mp1 = mp1->b_cont)) {
23886 				mi_copy_done(q, mp, EPROTO);
23887 				return;
23888 			}
23889 			/*
23890 			 * Check for cases that need more copying.  A return
23891 			 * value of 0 means a second copyin has been started,
23892 			 * so we return; a return value of 1 means no more
23893 			 * copying is needed, so we continue.
23894 			 */
23895 			cmd = iocp->ioc_cmd;
23896 			if ((cmd == SIOCGMSFILTER || cmd == SIOCSMSFILTER ||
23897 			    cmd == SIOCGIPMSFILTER || cmd == SIOCSIPMSFILTER) &&
23898 			    MI_COPY_COUNT(mp) == 1) {
23899 				if (ip_copyin_msfilter(q, mp) == 0)
23900 					return;
23901 			}
23902 			/*
23903 			 * Refhold the conn, till the ioctl completes. This is
23904 			 * needed in case the ioctl ends up in the pending mp
23905 			 * list. Every mp in the ill_pending_mp list and
23906 			 * the ipsq_pending_mp must have a refhold on the conn
23907 			 * to resume processing. The refhold is released when
23908 			 * the ioctl completes. (normally or abnormally)
23909 			 * In all cases ip_ioctl_finish is called to finish
23910 			 * the ioctl.
23911 			 */
23912 			if (connp != NULL) {
23913 				/* This is not a reentry */
23914 				ASSERT(ipsq == NULL);
23915 				CONN_INC_REF(connp);
23916 			} else {
23917 				if (!(ipip->ipi_flags & IPI_MODOK)) {
23918 					mi_copy_done(q, mp, EINVAL);
23919 					return;
23920 				}
23921 			}
23922 
23923 			ip_process_ioctl(ipsq, q, mp, ipip);
23924 
23925 		} else {
23926 			mi_copyout(q, mp);
23927 		}
23928 		return;
23929 nak:
23930 		iocp->ioc_error = EINVAL;
23931 		mp->b_datap->db_type = M_IOCNAK;
23932 		iocp->ioc_count = 0;
23933 		qreply(q, mp);
23934 		return;
23935 
23936 	case M_IOCNAK:
23937 		/*
23938 		 * The only way we could get here is if a resolver didn't like
23939 		 * an IOCTL we sent it.	 This shouldn't happen.
23940 		 */
23941 		(void) mi_strlog(q, 1, SL_ERROR|SL_TRACE,
23942 		    "ip_wput: unexpected M_IOCNAK, ioc_cmd 0x%x",
23943 		    ((struct iocblk *)mp->b_rptr)->ioc_cmd);
23944 		freemsg(mp);
23945 		return;
23946 	case M_IOCACK:
23947 		/* Finish socket ioctls passed through to ARP. */
23948 		ip_sioctl_iocack(q, mp);
23949 		return;
23950 	case M_FLUSH:
23951 		if (*mp->b_rptr & FLUSHW)
23952 			flushq(q, FLUSHALL);
23953 		if (q->q_next) {
23954 			/*
23955 			 * M_FLUSH is sent up to IP by some drivers during
23956 			 * unbind. ip_rput has already replied to it. We are
23957 			 * here for the M_FLUSH that we originated in IP
23958 			 * before sending the unbind request to the driver.
23959 			 * Just free it as we don't queue packets in IP
23960 			 * on the write side of the device instance.
23961 			 */
23962 			freemsg(mp);
23963 			return;
23964 		}
23965 		if (*mp->b_rptr & FLUSHR) {
23966 			*mp->b_rptr &= ~FLUSHW;
23967 			qreply(q, mp);
23968 			return;
23969 		}
23970 		freemsg(mp);
23971 		return;
23972 	case IRE_DB_REQ_TYPE:
23973 		/* An Upper Level Protocol wants a copy of an IRE. */
23974 		ip_ire_req(q, mp);
23975 		return;
23976 	case M_CTL:
23977 		/* M_CTL messages are used by ARP to tell us things. */
23978 		if ((mp->b_wptr - mp->b_rptr) < sizeof (arc_t))
23979 			break;
23980 		switch (((arc_t *)mp->b_rptr)->arc_cmd) {
23981 		case AR_ENTRY_SQUERY:
23982 			ip_wput_ctl(q, mp);
23983 			return;
23984 		case AR_CLIENT_NOTIFY:
23985 			ip_arp_news(q, mp);
23986 			return;
23987 		case AR_DLPIOP_DONE:
23988 			ASSERT(q->q_next != NULL);
23989 			ill = (ill_t *)q->q_ptr;
23990 			/* qwriter_ip releases the refhold */
23991 			/* refhold on ill stream is ok without ILL_CAN_LOOKUP */
23992 			ill_refhold(ill);
23993 			(void) qwriter_ip(NULL, ill, q, mp, ip_arp_done,
23994 			    CUR_OP, B_FALSE);
23995 			return;
23996 		case AR_ARP_CLOSING:
23997 			/*
23998 			 * ARP (above us) is closing. If no ARP bringup is
23999 			 * currently pending, ack the message so that ARP
24000 			 * can complete its close. Also mark ill_arp_closing
24001 			 * so that new ARP bringups will fail. If any
24002 			 * ARP bringup is currently in progress, we will
24003 			 * ack this when the current ARP bringup completes.
24004 			 */
24005 			ASSERT(q->q_next != NULL);
24006 			ill = (ill_t *)q->q_ptr;
24007 			mutex_enter(&ill->ill_lock);
24008 			ill->ill_arp_closing = 1;
24009 			if (!ill->ill_arp_bringup_pending) {
24010 				mutex_exit(&ill->ill_lock);
24011 				qreply(q, mp);
24012 			} else {
24013 				mutex_exit(&ill->ill_lock);
24014 				freemsg(mp);
24015 			}
24016 			return;
24017 		default:
24018 			break;
24019 		}
24020 		break;
24021 	case M_PROTO:
24022 	case M_PCPROTO:
24023 		/*
24024 		 * The only PROTO messages we expect are ULP binds and
24025 		 * copies of option negotiation acknowledgements.
24026 		 */
24027 		switch (((union T_primitives *)mp->b_rptr)->type) {
24028 		case O_T_BIND_REQ:
24029 		case T_BIND_REQ: {
24030 			/* Request can get queued in bind */
24031 			ASSERT(connp != NULL);
24032 			/* Don't increment refcnt if this is a re-entry */
24033 			if (ipsq == NULL)
24034 				CONN_INC_REF(connp);
24035 			mp = connp->conn_af_isv6 ?
24036 			    ip_bind_v6(q, mp, connp, NULL) :
24037 				ip_bind_v4(q, mp, connp);
24038 			if (mp != NULL) {
24039 				tcp_t	*tcp;
24040 
24041 				tcp = connp->conn_tcp;
24042 				if (tcp != NULL) {
24043 					if (ipsq == NULL) {
24044 						tcp_rput_other(tcp, mp);
24045 					} else {
24046 						CONN_INC_REF(connp);
24047 						squeue_fill(connp->conn_sqp, mp,
24048 						    ip_resume_tcp_bind,
24049 						    connp, SQTAG_TCP_RPUTOTHER);
24050 						return;
24051 					}
24052 				} else {
24053 					qreply(q, mp);
24054 				}
24055 				CONN_OPER_PENDING_DONE(connp);
24056 			}
24057 			return;
24058 		}
24059 		case T_SVR4_OPTMGMT_REQ:
24060 			ip2dbg(("ip_wput: T_SVR4_OPTMGMT_REQ flags %x\n",
24061 			    ((struct T_optmgmt_req *)mp->b_rptr)->MGMT_flags));
24062 
24063 			ASSERT(connp != NULL);
24064 			if (!snmpcom_req(q, mp, ip_snmp_set,
24065 			    ip_snmp_get, cr)) {
24066 				/*
24067 				 * Call svr4_optcom_req so that it can
24068 				 * generate the ack. We don't come here
24069 				 * if this operation is being restarted.
24070 				 * ip_restart_optmgmt will drop the conn ref.
24071 				 * In the case of ipsec option after the ipsec
24072 				 * load is complete conn_restart_ipsec_waiter
24073 				 * drops the conn ref.
24074 				 */
24075 				ASSERT(ipsq == NULL);
24076 				CONN_INC_REF(connp);
24077 				if (ip_check_for_ipsec_opt(q, mp))
24078 					return;
24079 				err = svr4_optcom_req(q, mp, cr, &ip_opt_obj);
24080 				if (err != EINPROGRESS) {
24081 					/* Operation is done */
24082 					CONN_OPER_PENDING_DONE(connp);
24083 				}
24084 			}
24085 			return;
24086 		case T_OPTMGMT_REQ:
24087 			ip2dbg(("ip_wput: T_OPTMGMT_REQ\n"));
24088 			/*
24089 			 * Note: No snmpcom_req support through new
24090 			 * T_OPTMGMT_REQ.
24091 			 * Call tpi_optcom_req so that it can
24092 			 * generate the ack.
24093 			 */
24094 			ASSERT(connp != NULL);
24095 			ASSERT(ipsq == NULL);
24096 			/*
24097 			 * We don't come here for restart. ip_restart_optmgmt
24098 			 * will drop the conn ref. In the case of ipsec option
24099 			 * after the ipsec load is complete
24100 			 * conn_restart_ipsec_waiter drops the conn ref.
24101 			 */
24102 			CONN_INC_REF(connp);
24103 			if (ip_check_for_ipsec_opt(q, mp))
24104 				return;
24105 			err = tpi_optcom_req(q, mp, cr, &ip_opt_obj);
24106 			if (err != EINPROGRESS) {
24107 				/* Operation is done */
24108 				CONN_OPER_PENDING_DONE(connp);
24109 			}
24110 			return;
24111 		case T_UNBIND_REQ:
24112 			ip_unbind(q, mp);
24113 			return;
24114 		default:
24115 			/*
24116 			 * Have to drop any DLPI messages coming down from
24117 			 * arp (such as an info_req which would cause ip
24118 			 * to receive an extra info_ack if it was passed
24119 			 * through.
24120 			 */
24121 			ip1dbg(("ip_wput_nondata: dropping M_PROTO %d\n",
24122 			    (int)*(uint_t *)mp->b_rptr));
24123 			freemsg(mp);
24124 			return;
24125 		}
24126 		/* NOTREACHED */
24127 	case IRE_DB_TYPE: {
24128 		nce_t		*nce;
24129 		ill_t		*ill;
24130 		in6_addr_t	gw_addr_v6;
24131 
24132 
24133 		/*
24134 		 * This is a response back from a resolver.  It
24135 		 * consists of a message chain containing:
24136 		 *	IRE_MBLK-->LL_HDR_MBLK->pkt
24137 		 * The IRE_MBLK is the one we allocated in ip_newroute.
24138 		 * The LL_HDR_MBLK is the DLPI header to use to get
24139 		 * the attached packet, and subsequent ones for the
24140 		 * same destination, transmitted.
24141 		 */
24142 		if ((mp->b_wptr - mp->b_rptr) != sizeof (ire_t))    /* ire */
24143 			break;
24144 		/*
24145 		 * First, check to make sure the resolution succeeded.
24146 		 * If it failed, the second mblk will be empty.
24147 		 * If it is, free the chain, dropping the packet.
24148 		 * (We must ire_delete the ire; that frees the ire mblk)
24149 		 * We're doing this now to support PVCs for ATM; it's
24150 		 * a partial xresolv implementation. When we fully implement
24151 		 * xresolv interfaces, instead of freeing everything here
24152 		 * we'll initiate neighbor discovery.
24153 		 *
24154 		 * For v4 (ARP and other external resolvers) the resolver
24155 		 * frees the message, so no check is needed. This check
24156 		 * is required, though, for a full xresolve implementation.
24157 		 * Including this code here now both shows how external
24158 		 * resolvers can NACK a resolution request using an
24159 		 * existing design that has no specific provisions for NACKs,
24160 		 * and also takes into account that the current non-ARP
24161 		 * external resolver has been coded to use this method of
24162 		 * NACKing for all IPv6 (xresolv) cases,
24163 		 * whether our xresolv implementation is complete or not.
24164 		 *
24165 		 */
24166 		ire = (ire_t *)mp->b_rptr;
24167 		ill = ire_to_ill(ire);
24168 		mp1 = mp->b_cont;		/* dl_unitdata_req */
24169 		if (mp1->b_rptr == mp1->b_wptr) {
24170 			if (ire->ire_ipversion == IPV6_VERSION) {
24171 				/*
24172 				 * XRESOLV interface.
24173 				 */
24174 				ASSERT(ill->ill_flags & ILLF_XRESOLV);
24175 				mutex_enter(&ire->ire_lock);
24176 				gw_addr_v6 = ire->ire_gateway_addr_v6;
24177 				mutex_exit(&ire->ire_lock);
24178 				if (IN6_IS_ADDR_UNSPECIFIED(&gw_addr_v6)) {
24179 					nce = ndp_lookup(ill,
24180 					    &ire->ire_addr_v6, B_FALSE);
24181 				} else {
24182 					nce = ndp_lookup(ill, &gw_addr_v6,
24183 					    B_FALSE);
24184 				}
24185 				if (nce != NULL) {
24186 					nce_resolv_failed(nce);
24187 					ndp_delete(nce);
24188 					NCE_REFRELE(nce);
24189 				}
24190 			}
24191 			mp->b_cont = NULL;
24192 			freemsg(mp1);		/* frees the pkt as well */
24193 			ire_delete((ire_t *)mp->b_rptr);
24194 			return;
24195 		}
24196 		/*
24197 		 * Split them into IRE_MBLK and pkt and feed it into
24198 		 * ire_add_then_send. Then in ire_add_then_send
24199 		 * the IRE will be added, and then the packet will be
24200 		 * run back through ip_wput. This time it will make
24201 		 * it to the wire.
24202 		 */
24203 		mp->b_cont = NULL;
24204 		mp = mp1->b_cont;		/* now, mp points to pkt */
24205 		mp1->b_cont = NULL;
24206 		ip1dbg(("ip_wput_nondata: reply from external resolver \n"));
24207 		if (ire->ire_ipversion == IPV6_VERSION) {
24208 			/*
24209 			 * XRESOLV interface. Find the nce and put a copy
24210 			 * of the dl_unitdata_req in nce_res_mp
24211 			 */
24212 			ASSERT(ill->ill_flags & ILLF_XRESOLV);
24213 			mutex_enter(&ire->ire_lock);
24214 			gw_addr_v6 = ire->ire_gateway_addr_v6;
24215 			mutex_exit(&ire->ire_lock);
24216 			if (IN6_IS_ADDR_UNSPECIFIED(&gw_addr_v6)) {
24217 				nce = ndp_lookup(ill, &ire->ire_addr_v6,
24218 				    B_FALSE);
24219 			} else {
24220 				nce = ndp_lookup(ill, &gw_addr_v6, B_FALSE);
24221 			}
24222 			if (nce != NULL) {
24223 				/*
24224 				 * We have to protect nce_res_mp here
24225 				 * from being accessed by other threads
24226 				 * while we change the mblk pointer.
24227 				 * Other functions will also lock the nce when
24228 				 * accessing nce_res_mp.
24229 				 *
24230 				 * The reason we change the mblk pointer
24231 				 * here rather than copying the resolved address
24232 				 * into the template is that, unlike with
24233 				 * ethernet, we have no guarantee that the
24234 				 * resolved address length will be
24235 				 * smaller than or equal to the lla length
24236 				 * with which the template was allocated,
24237 				 * (for ethernet, they're equal)
24238 				 * so we have to use the actual resolved
24239 				 * address mblk - which holds the real
24240 				 * dl_unitdata_req with the resolved address.
24241 				 *
24242 				 * Doing this is the same behavior as was
24243 				 * previously used in the v4 ARP case.
24244 				 */
24245 				mutex_enter(&nce->nce_lock);
24246 				if (nce->nce_res_mp != NULL)
24247 					freemsg(nce->nce_res_mp);
24248 				nce->nce_res_mp = mp1;
24249 				mutex_exit(&nce->nce_lock);
24250 				/*
24251 				 * We do a fastpath probe here because
24252 				 * we have resolved the address without
24253 				 * using Neighbor Discovery.
24254 				 * In the non-XRESOLV v6 case, the fastpath
24255 				 * probe is done right after neighbor
24256 				 * discovery completes.
24257 				 */
24258 				if (nce->nce_res_mp != NULL) {
24259 					int res;
24260 					nce_fastpath_list_add(nce);
24261 					res = ill_fastpath_probe(ill,
24262 					    nce->nce_res_mp);
24263 					if (res != 0 && res != EAGAIN)
24264 						nce_fastpath_list_delete(nce);
24265 				}
24266 
24267 				ire_add_then_send(q, ire, mp);
24268 				/*
24269 				 * Now we have to clean out any packets
24270 				 * that may have been queued on the nce
24271 				 * while it was waiting for address resolution
24272 				 * to complete.
24273 				 */
24274 				mutex_enter(&nce->nce_lock);
24275 				mp1 = nce->nce_qd_mp;
24276 				nce->nce_qd_mp = NULL;
24277 				mutex_exit(&nce->nce_lock);
24278 				while (mp1 != NULL) {
24279 					mblk_t *nxt_mp;
24280 					queue_t *fwdq = NULL;
24281 					ill_t   *inbound_ill;
24282 					uint_t ifindex;
24283 
24284 					nxt_mp = mp1->b_next;
24285 					mp1->b_next = NULL;
24286 					/*
24287 					 * Retrieve ifindex stored in
24288 					 * ip_rput_data_v6()
24289 					 */
24290 					ifindex =
24291 					    (uint_t)(uintptr_t)mp1->b_prev;
24292 					inbound_ill =
24293 						ill_lookup_on_ifindex(ifindex,
24294 						    B_TRUE, NULL, NULL, NULL,
24295 						    NULL);
24296 					mp1->b_prev = NULL;
24297 					if (inbound_ill != NULL)
24298 						fwdq = inbound_ill->ill_rq;
24299 
24300 					if (fwdq != NULL) {
24301 						put(fwdq, mp1);
24302 						ill_refrele(inbound_ill);
24303 					} else
24304 						put(WR(ill->ill_rq), mp1);
24305 					mp1 = nxt_mp;
24306 				}
24307 				NCE_REFRELE(nce);
24308 			} else {	/* nce is NULL; clean up */
24309 				ire_delete(ire);
24310 				freemsg(mp);
24311 				freemsg(mp1);
24312 				return;
24313 			}
24314 		} else {
24315 			ire->ire_dlureq_mp = mp1;
24316 			ire_add_then_send(q, ire, mp);
24317 		}
24318 		return;	/* All is well, the packet has been sent. */
24319 	}
24320 	default:
24321 		break;
24322 	}
24323 	if (q->q_next) {
24324 		putnext(q, mp);
24325 	} else
24326 		freemsg(mp);
24327 }
24328 
24329 /*
24330  * Process IP options in an outbound packet.  Modify the destination if there
24331  * is a source route option.
24332  * Returns non-zero if something fails in which case an ICMP error has been
24333  * sent and mp freed.
24334  */
24335 static int
24336 ip_wput_options(queue_t *q, mblk_t *ipsec_mp, ipha_t *ipha,
24337     boolean_t mctl_present, zoneid_t zoneid)
24338 {
24339 	ipoptp_t	opts;
24340 	uchar_t		*opt;
24341 	uint8_t		optval;
24342 	uint8_t		optlen;
24343 	ipaddr_t	dst;
24344 	intptr_t	code = 0;
24345 	mblk_t		*mp;
24346 	ire_t		*ire = NULL;
24347 
24348 	ip2dbg(("ip_wput_options\n"));
24349 	mp = ipsec_mp;
24350 	if (mctl_present) {
24351 		mp = ipsec_mp->b_cont;
24352 	}
24353 
24354 	dst = ipha->ipha_dst;
24355 	for (optval = ipoptp_first(&opts, ipha);
24356 	    optval != IPOPT_EOL;
24357 	    optval = ipoptp_next(&opts)) {
24358 		opt = opts.ipoptp_cur;
24359 		optlen = opts.ipoptp_len;
24360 		ip2dbg(("ip_wput_options: opt %d, len %d\n",
24361 		    optval, optlen));
24362 		switch (optval) {
24363 			uint32_t off;
24364 		case IPOPT_SSRR:
24365 		case IPOPT_LSRR:
24366 			if ((opts.ipoptp_flags & IPOPTP_ERROR) != 0) {
24367 				ip1dbg((
24368 				    "ip_wput_options: bad option offset\n"));
24369 				code = (char *)&opt[IPOPT_OLEN] -
24370 				    (char *)ipha;
24371 				goto param_prob;
24372 			}
24373 			off = opt[IPOPT_OFFSET];
24374 			ip1dbg(("ip_wput_options: next hop 0x%x\n",
24375 			    ntohl(dst)));
24376 			/*
24377 			 * For strict: verify that dst is directly
24378 			 * reachable.
24379 			 */
24380 			if (optval == IPOPT_SSRR) {
24381 				ire = ire_ftable_lookup(dst, 0, 0,
24382 				    IRE_INTERFACE, NULL, NULL, ALL_ZONES, 0,
24383 				    MATCH_IRE_TYPE);
24384 				if (ire == NULL) {
24385 					ip1dbg(("ip_wput_options: SSRR not"
24386 					    " directly reachable: 0x%x\n",
24387 					    ntohl(dst)));
24388 					goto bad_src_route;
24389 				}
24390 				ire_refrele(ire);
24391 			}
24392 			break;
24393 		case IPOPT_RR:
24394 			if ((opts.ipoptp_flags & IPOPTP_ERROR) != 0) {
24395 				ip1dbg((
24396 				    "ip_wput_options: bad option offset\n"));
24397 				code = (char *)&opt[IPOPT_OLEN] -
24398 				    (char *)ipha;
24399 				goto param_prob;
24400 			}
24401 			break;
24402 		case IPOPT_TS:
24403 			/*
24404 			 * Verify that length >=5 and that there is either
24405 			 * room for another timestamp or that the overflow
24406 			 * counter is not maxed out.
24407 			 */
24408 			code = (char *)&opt[IPOPT_OLEN] - (char *)ipha;
24409 			if (optlen < IPOPT_MINLEN_IT) {
24410 				goto param_prob;
24411 			}
24412 			if ((opts.ipoptp_flags & IPOPTP_ERROR) != 0) {
24413 				ip1dbg((
24414 				    "ip_wput_options: bad option offset\n"));
24415 				code = (char *)&opt[IPOPT_OFFSET] -
24416 				    (char *)ipha;
24417 				goto param_prob;
24418 			}
24419 			switch (opt[IPOPT_POS_OV_FLG] & 0x0F) {
24420 			case IPOPT_TS_TSONLY:
24421 				off = IPOPT_TS_TIMELEN;
24422 				break;
24423 			case IPOPT_TS_TSANDADDR:
24424 			case IPOPT_TS_PRESPEC:
24425 			case IPOPT_TS_PRESPEC_RFC791:
24426 				off = IP_ADDR_LEN + IPOPT_TS_TIMELEN;
24427 				break;
24428 			default:
24429 				code = (char *)&opt[IPOPT_POS_OV_FLG] -
24430 				    (char *)ipha;
24431 				goto param_prob;
24432 			}
24433 			if (opt[IPOPT_OFFSET] - 1 + off > optlen &&
24434 			    (opt[IPOPT_POS_OV_FLG] & 0xF0) == 0xF0) {
24435 				/*
24436 				 * No room and the overflow counter is 15
24437 				 * already.
24438 				 */
24439 				goto param_prob;
24440 			}
24441 			break;
24442 		}
24443 	}
24444 
24445 	if ((opts.ipoptp_flags & IPOPTP_ERROR) == 0)
24446 		return (0);
24447 
24448 	ip1dbg(("ip_wput_options: error processing IP options."));
24449 	code = (char *)&opt[IPOPT_OFFSET] - (char *)ipha;
24450 
24451 param_prob:
24452 	/*
24453 	 * Since ip_wput() isn't close to finished, we fill
24454 	 * in enough of the header for credible error reporting.
24455 	 */
24456 	if (ip_hdr_complete((ipha_t *)mp->b_rptr, zoneid)) {
24457 		/* Failed */
24458 		freemsg(ipsec_mp);
24459 		return (-1);
24460 	}
24461 	icmp_param_problem(q, ipsec_mp, (uint8_t)code);
24462 	return (-1);
24463 
24464 bad_src_route:
24465 	/*
24466 	 * Since ip_wput() isn't close to finished, we fill
24467 	 * in enough of the header for credible error reporting.
24468 	 */
24469 	if (ip_hdr_complete((ipha_t *)mp->b_rptr, zoneid)) {
24470 		/* Failed */
24471 		freemsg(ipsec_mp);
24472 		return (-1);
24473 	}
24474 	icmp_unreachable(q, ipsec_mp, ICMP_SOURCE_ROUTE_FAILED);
24475 	return (-1);
24476 }
24477 
24478 /*
24479  * The maximum value of conn_drain_list_cnt is CONN_MAXDRAINCNT.
24480  * conn_drain_list_cnt can be changed by setting conn_drain_nthreads
24481  * thru /etc/system.
24482  */
24483 #define	CONN_MAXDRAINCNT	64
24484 
24485 static void
24486 conn_drain_init(void)
24487 {
24488 	int i;
24489 
24490 	conn_drain_list_cnt = conn_drain_nthreads;
24491 
24492 	if ((conn_drain_list_cnt == 0) ||
24493 	    (conn_drain_list_cnt > CONN_MAXDRAINCNT)) {
24494 		/*
24495 		 * Default value of the number of drainers is the
24496 		 * number of cpus, subject to maximum of 8 drainers.
24497 		 */
24498 		if (boot_max_ncpus != -1)
24499 			conn_drain_list_cnt = MIN(boot_max_ncpus, 8);
24500 		else
24501 			conn_drain_list_cnt = MIN(max_ncpus, 8);
24502 	}
24503 
24504 	conn_drain_list = kmem_zalloc(conn_drain_list_cnt * sizeof (idl_t),
24505 	    KM_SLEEP);
24506 
24507 	for (i = 0; i < conn_drain_list_cnt; i++) {
24508 		mutex_init(&conn_drain_list[i].idl_lock, NULL,
24509 		    MUTEX_DEFAULT, NULL);
24510 	}
24511 }
24512 
24513 static void
24514 conn_drain_fini(void)
24515 {
24516 	int i;
24517 
24518 	for (i = 0; i < conn_drain_list_cnt; i++)
24519 		mutex_destroy(&conn_drain_list[i].idl_lock);
24520 	kmem_free(conn_drain_list, conn_drain_list_cnt * sizeof (idl_t));
24521 	conn_drain_list = NULL;
24522 }
24523 
24524 /*
24525  * Note: For an overview of how flowcontrol is handled in IP please see the
24526  * IP Flowcontrol notes at the top of this file.
24527  *
24528  * Flow control has blocked us from proceeding. Insert the given conn in one
24529  * of the conn drain lists. These conn wq's will be qenabled later on when
24530  * STREAMS flow control does a backenable. conn_walk_drain will enable
24531  * the first conn in each of these drain lists. Each of these qenabled conns
24532  * in turn enables the next in the list, after it runs, or when it closes,
24533  * thus sustaining the drain process.
24534  *
24535  * The only possible calling sequence is ip_wsrv (on conn) -> ip_wput ->
24536  * conn_drain_insert. Thus there can be only 1 instance of conn_drain_insert
24537  * running at any time, on a given conn, since there can be only 1 service proc
24538  * running on a queue at any time.
24539  */
24540 void
24541 conn_drain_insert(conn_t *connp)
24542 {
24543 	idl_t	*idl;
24544 	uint_t	index;
24545 
24546 	mutex_enter(&connp->conn_lock);
24547 	if (connp->conn_state_flags & CONN_CLOSING) {
24548 		/*
24549 		 * The conn is closing as a result of which CONN_CLOSING
24550 		 * is set. Return.
24551 		 */
24552 		mutex_exit(&connp->conn_lock);
24553 		return;
24554 	} else if (connp->conn_idl == NULL) {
24555 		/*
24556 		 * Assign the next drain list round robin. We dont' use
24557 		 * a lock, and thus it may not be strictly round robin.
24558 		 * Atomicity of load/stores is enough to make sure that
24559 		 * conn_drain_list_index is always within bounds.
24560 		 */
24561 		index = conn_drain_list_index;
24562 		ASSERT(index < conn_drain_list_cnt);
24563 		connp->conn_idl = &conn_drain_list[index];
24564 		index++;
24565 		if (index == conn_drain_list_cnt)
24566 			index = 0;
24567 		conn_drain_list_index = index;
24568 	}
24569 	mutex_exit(&connp->conn_lock);
24570 
24571 	mutex_enter(CONN_DRAIN_LIST_LOCK(connp));
24572 	if ((connp->conn_drain_prev != NULL) ||
24573 	    (connp->conn_state_flags & CONN_CLOSING)) {
24574 		/*
24575 		 * The conn is already in the drain list, OR
24576 		 * the conn is closing. We need to check again for
24577 		 * the closing case again since close can happen
24578 		 * after we drop the conn_lock, and before we
24579 		 * acquire the CONN_DRAIN_LIST_LOCK.
24580 		 */
24581 		mutex_exit(CONN_DRAIN_LIST_LOCK(connp));
24582 		return;
24583 	} else {
24584 		idl = connp->conn_idl;
24585 	}
24586 
24587 	/*
24588 	 * The conn is not in the drain list. Insert it at the
24589 	 * tail of the drain list. The drain list is circular
24590 	 * and doubly linked. idl_conn points to the 1st element
24591 	 * in the list.
24592 	 */
24593 	if (idl->idl_conn == NULL) {
24594 		idl->idl_conn = connp;
24595 		connp->conn_drain_next = connp;
24596 		connp->conn_drain_prev = connp;
24597 	} else {
24598 		conn_t *head = idl->idl_conn;
24599 
24600 		connp->conn_drain_next = head;
24601 		connp->conn_drain_prev = head->conn_drain_prev;
24602 		head->conn_drain_prev->conn_drain_next = connp;
24603 		head->conn_drain_prev = connp;
24604 	}
24605 	mutex_exit(CONN_DRAIN_LIST_LOCK(connp));
24606 }
24607 
24608 /*
24609  * This conn is closing, and we are called from ip_close. OR
24610  * This conn has been serviced by ip_wsrv, and we need to do the tail
24611  * processing.
24612  * If this conn is part of the drain list, we may need to sustain the drain
24613  * process by qenabling the next conn in the drain list. We may also need to
24614  * remove this conn from the list, if it is done.
24615  */
24616 static void
24617 conn_drain_tail(conn_t *connp, boolean_t closing)
24618 {
24619 	idl_t *idl;
24620 
24621 	/*
24622 	 * connp->conn_idl is stable at this point, and no lock is needed
24623 	 * to check it. If we are called from ip_close, close has already
24624 	 * set CONN_CLOSING, thus freezing the value of conn_idl, and
24625 	 * called us only because conn_idl is non-null. If we are called thru
24626 	 * service, conn_idl could be null, but it cannot change because
24627 	 * service is single-threaded per queue, and there cannot be another
24628 	 * instance of service trying to call conn_drain_insert on this conn
24629 	 * now.
24630 	 */
24631 	ASSERT(!closing || (connp->conn_idl != NULL));
24632 
24633 	/*
24634 	 * If connp->conn_idl is null, the conn has not been inserted into any
24635 	 * drain list even once since creation of the conn. Just return.
24636 	 */
24637 	if (connp->conn_idl == NULL)
24638 		return;
24639 
24640 	mutex_enter(CONN_DRAIN_LIST_LOCK(connp));
24641 
24642 	if (connp->conn_drain_prev == NULL) {
24643 		/* This conn is currently not in the drain list.  */
24644 		mutex_exit(CONN_DRAIN_LIST_LOCK(connp));
24645 		return;
24646 	}
24647 	idl = connp->conn_idl;
24648 	if (idl->idl_conn_draining == connp) {
24649 		/*
24650 		 * This conn is the current drainer. If this is the last conn
24651 		 * in the drain list, we need to do more checks, in the 'if'
24652 		 * below. Otherwwise we need to just qenable the next conn,
24653 		 * to sustain the draining, and is handled in the 'else'
24654 		 * below.
24655 		 */
24656 		if (connp->conn_drain_next == idl->idl_conn) {
24657 			/*
24658 			 * This conn is the last in this list. This round
24659 			 * of draining is complete. If idl_repeat is set,
24660 			 * it means another flow enabling has happened from
24661 			 * the driver/streams and we need to another round
24662 			 * of draining.
24663 			 * If there are more than 2 conns in the drain list,
24664 			 * do a left rotate by 1, so that all conns except the
24665 			 * conn at the head move towards the head by 1, and the
24666 			 * the conn at the head goes to the tail. This attempts
24667 			 * a more even share for all queues that are being
24668 			 * drained.
24669 			 */
24670 			if ((connp->conn_drain_next != connp) &&
24671 			    (idl->idl_conn->conn_drain_next != connp)) {
24672 				idl->idl_conn = idl->idl_conn->conn_drain_next;
24673 			}
24674 			if (idl->idl_repeat) {
24675 				qenable(idl->idl_conn->conn_wq);
24676 				idl->idl_conn_draining = idl->idl_conn;
24677 				idl->idl_repeat = 0;
24678 			} else {
24679 				idl->idl_conn_draining = NULL;
24680 			}
24681 		} else {
24682 			/*
24683 			 * If the next queue that we are now qenable'ing,
24684 			 * is closing, it will remove itself from this list
24685 			 * and qenable the subsequent queue in ip_close().
24686 			 * Serialization is acheived thru idl_lock.
24687 			 */
24688 			qenable(connp->conn_drain_next->conn_wq);
24689 			idl->idl_conn_draining = connp->conn_drain_next;
24690 		}
24691 	}
24692 	if (!connp->conn_did_putbq || closing) {
24693 		/*
24694 		 * Remove ourself from the drain list, if we did not do
24695 		 * a putbq, or if the conn is closing.
24696 		 * Note: It is possible that q->q_first is non-null. It means
24697 		 * that these messages landed after we did a enableok() in
24698 		 * ip_wsrv. Thus STREAMS will call ip_wsrv once again to
24699 		 * service them.
24700 		 */
24701 		if (connp->conn_drain_next == connp) {
24702 			/* Singleton in the list */
24703 			ASSERT(connp->conn_drain_prev == connp);
24704 			idl->idl_conn = NULL;
24705 			idl->idl_conn_draining = NULL;
24706 		} else {
24707 			connp->conn_drain_prev->conn_drain_next =
24708 			    connp->conn_drain_next;
24709 			connp->conn_drain_next->conn_drain_prev =
24710 			    connp->conn_drain_prev;
24711 			if (idl->idl_conn == connp)
24712 				idl->idl_conn = connp->conn_drain_next;
24713 			ASSERT(idl->idl_conn_draining != connp);
24714 
24715 		}
24716 		connp->conn_drain_next = NULL;
24717 		connp->conn_drain_prev = NULL;
24718 	}
24719 	mutex_exit(CONN_DRAIN_LIST_LOCK(connp));
24720 }
24721 
24722 /*
24723  * Write service routine. Shared perimeter entry point.
24724  * ip_wsrv can be called in any of the following ways.
24725  * 1. The device queue's messages has fallen below the low water mark
24726  *    and STREAMS has backenabled the ill_wq. We walk thru all the
24727  *    the drain lists and backenable the first conn in each list.
24728  * 2. The above causes STREAMS to run ip_wsrv on the conn_wq of the
24729  *    qenabled non-tcp upper layers. We start dequeing messages and call
24730  *    ip_wput for each message.
24731  */
24732 
24733 void
24734 ip_wsrv(queue_t *q)
24735 {
24736 	conn_t	*connp;
24737 	ill_t	*ill;
24738 	mblk_t	*mp;
24739 
24740 	if (q->q_next) {
24741 		ill = (ill_t *)q->q_ptr;
24742 		if (ill->ill_state_flags == 0) {
24743 			/*
24744 			 * The device flow control has opened up.
24745 			 * Walk through conn drain lists and qenable the
24746 			 * first conn in each list. This makes sense only
24747 			 * if the stream is fully plumbed and setup.
24748 			 * Hence the if check above.
24749 			 */
24750 			ip1dbg(("ip_wsrv: walking\n"));
24751 			conn_walk_drain();
24752 		}
24753 		return;
24754 	}
24755 
24756 	connp = Q_TO_CONN(q);
24757 	ip1dbg(("ip_wsrv: %p %p\n", (void *)q, (void *)connp));
24758 
24759 	/*
24760 	 * 1. Set conn_draining flag to signal that service is active.
24761 	 *
24762 	 * 2. ip_output determines whether it has been called from service,
24763 	 *    based on the last parameter. If it is IP_WSRV it concludes it
24764 	 *    has been called from service.
24765 	 *
24766 	 * 3. Message ordering is preserved by the following logic.
24767 	 *    i. A directly called ip_output (i.e. not thru service) will queue
24768 	 *    the message at the tail, if conn_draining is set (i.e. service
24769 	 *    is running) or if q->q_first is non-null.
24770 	 *
24771 	 *    ii. If ip_output is called from service, and if ip_output cannot
24772 	 *    putnext due to flow control, it does a putbq.
24773 	 *
24774 	 * 4. noenable the queue so that a putbq from ip_wsrv does not reenable
24775 	 *    (causing an infinite loop).
24776 	 */
24777 	ASSERT(!connp->conn_did_putbq);
24778 	while ((q->q_first != NULL) && !connp->conn_did_putbq) {
24779 		connp->conn_draining = 1;
24780 		noenable(q);
24781 		while ((mp = getq(q)) != NULL) {
24782 			ip_output(Q_TO_CONN(q), mp, q, IP_WSRV);
24783 			if (connp->conn_did_putbq) {
24784 				/* ip_wput did a putbq */
24785 				break;
24786 			}
24787 		}
24788 		/*
24789 		 * At this point, a thread coming down from top, calling
24790 		 * ip_wput, may end up queueing the message. We have not yet
24791 		 * enabled the queue, so ip_wsrv won't be called again.
24792 		 * To avoid this race, check q->q_first again (in the loop)
24793 		 * If the other thread queued the message before we call
24794 		 * enableok(), we will catch it in the q->q_first check.
24795 		 * If the other thread queues the message after we call
24796 		 * enableok(), ip_wsrv will be called again by STREAMS.
24797 		 */
24798 		connp->conn_draining = 0;
24799 		enableok(q);
24800 	}
24801 
24802 	/* Enable the next conn for draining */
24803 	conn_drain_tail(connp, B_FALSE);
24804 
24805 	connp->conn_did_putbq = 0;
24806 }
24807 
24808 /*
24809  * Walk the list of all conn's calling the function provided with the
24810  * specified argument for each.	 Note that this only walks conn's that
24811  * have been bound.
24812  * Applies to both IPv4 and IPv6.
24813  */
24814 static void
24815 conn_walk_fanout(pfv_t func, void *arg, zoneid_t zoneid)
24816 {
24817 	conn_walk_fanout_table(ipcl_udp_fanout, ipcl_udp_fanout_size,
24818 	    func, arg, zoneid);
24819 	conn_walk_fanout_table(ipcl_conn_fanout, ipcl_conn_fanout_size,
24820 	    func, arg, zoneid);
24821 	conn_walk_fanout_table(ipcl_bind_fanout, ipcl_bind_fanout_size,
24822 	    func, arg, zoneid);
24823 	conn_walk_fanout_table(ipcl_proto_fanout,
24824 	    A_CNT(ipcl_proto_fanout), func, arg, zoneid);
24825 	conn_walk_fanout_table(ipcl_proto_fanout_v6,
24826 	    A_CNT(ipcl_proto_fanout_v6), func, arg, zoneid);
24827 }
24828 
24829 /*
24830  * Flowcontrol has relieved, and STREAMS has backenabled us. For each list
24831  * of conns that need to be drained, check if drain is already in progress.
24832  * If so set the idl_repeat bit, indicating that the last conn in the list
24833  * needs to reinitiate the drain once again, for the list. If drain is not
24834  * in progress for the list, initiate the draining, by qenabling the 1st
24835  * conn in the list. The drain is self-sustaining, each qenabled conn will
24836  * in turn qenable the next conn, when it is done/blocked/closing.
24837  */
24838 static void
24839 conn_walk_drain(void)
24840 {
24841 	int i;
24842 	idl_t *idl;
24843 
24844 	IP_STAT(ip_conn_walk_drain);
24845 
24846 	for (i = 0; i < conn_drain_list_cnt; i++) {
24847 		idl = &conn_drain_list[i];
24848 		mutex_enter(&idl->idl_lock);
24849 		if (idl->idl_conn == NULL) {
24850 			mutex_exit(&idl->idl_lock);
24851 			continue;
24852 		}
24853 		/*
24854 		 * If this list is not being drained currently by
24855 		 * an ip_wsrv thread, start the process.
24856 		 */
24857 		if (idl->idl_conn_draining == NULL) {
24858 			ASSERT(idl->idl_repeat == 0);
24859 			qenable(idl->idl_conn->conn_wq);
24860 			idl->idl_conn_draining = idl->idl_conn;
24861 		} else {
24862 			idl->idl_repeat = 1;
24863 		}
24864 		mutex_exit(&idl->idl_lock);
24865 	}
24866 }
24867 
24868 /*
24869  * Walk an conn hash table of `count' buckets, calling func for each entry.
24870  */
24871 static void
24872 conn_walk_fanout_table(connf_t *connfp, uint_t count, pfv_t func, void *arg,
24873     zoneid_t zoneid)
24874 {
24875 	conn_t	*connp;
24876 
24877 	while (count-- > 0) {
24878 		mutex_enter(&connfp->connf_lock);
24879 		for (connp = connfp->connf_head; connp != NULL;
24880 		    connp = connp->conn_next) {
24881 			if (zoneid == GLOBAL_ZONEID ||
24882 			    zoneid == connp->conn_zoneid) {
24883 				CONN_INC_REF(connp);
24884 				mutex_exit(&connfp->connf_lock);
24885 				(*func)(connp, arg);
24886 				mutex_enter(&connfp->connf_lock);
24887 				CONN_DEC_REF(connp);
24888 			}
24889 		}
24890 		mutex_exit(&connfp->connf_lock);
24891 		connfp++;
24892 	}
24893 }
24894 
24895 /* ipcl_walk routine invoked for ip_conn_report for each conn. */
24896 static void
24897 conn_report1(conn_t *connp, void *mp)
24898 {
24899 	char	buf1[INET6_ADDRSTRLEN];
24900 	char	buf2[INET6_ADDRSTRLEN];
24901 	uint_t	print_len, buf_len;
24902 
24903 	ASSERT(connp != NULL);
24904 
24905 	buf_len = ((mblk_t *)mp)->b_datap->db_lim - ((mblk_t *)mp)->b_wptr;
24906 	if (buf_len <= 0)
24907 		return;
24908 	(void) inet_ntop(AF_INET6, &connp->conn_srcv6, buf1, sizeof (buf1)),
24909 	(void) inet_ntop(AF_INET6, &connp->conn_remv6, buf2, sizeof (buf2)),
24910 	print_len = snprintf((char *)((mblk_t *)mp)->b_wptr, buf_len,
24911 	    MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR
24912 	    "%5d %s/%05d %s/%05d\n",
24913 	    (void *)connp, (void *)CONNP_TO_RQ(connp),
24914 	    (void *)CONNP_TO_WQ(connp), connp->conn_zoneid,
24915 	    buf1, connp->conn_lport,
24916 	    buf2, connp->conn_fport);
24917 	if (print_len < buf_len) {
24918 		((mblk_t *)mp)->b_wptr += print_len;
24919 	} else {
24920 		((mblk_t *)mp)->b_wptr += buf_len;
24921 	}
24922 }
24923 
24924 /*
24925  * Named Dispatch routine to produce a formatted report on all conns
24926  * that are listed in one of the fanout tables.
24927  * This report is accessed by using the ndd utility to "get" ND variable
24928  * "ip_conn_status".
24929  */
24930 /* ARGSUSED */
24931 static int
24932 ip_conn_report(queue_t *q, mblk_t *mp, caddr_t arg, cred_t *ioc_cr)
24933 {
24934 	(void) mi_mpprintf(mp,
24935 	    "CONN      " MI_COL_HDRPAD_STR
24936 	    "rfq      " MI_COL_HDRPAD_STR
24937 	    "stq      " MI_COL_HDRPAD_STR
24938 	    " zone local                 remote");
24939 
24940 	/*
24941 	 * Because of the ndd constraint, at most we can have 64K buffer
24942 	 * to put in all conn info.  So to be more efficient, just
24943 	 * allocate a 64K buffer here, assuming we need that large buffer.
24944 	 * This should be OK as only privileged processes can do ndd /dev/ip.
24945 	 */
24946 	if ((mp->b_cont = allocb(ND_MAX_BUF_LEN, BPRI_HI)) == NULL) {
24947 		/* The following may work even if we cannot get a large buf. */
24948 		(void) mi_mpprintf(mp, "<< Out of buffer >>\n");
24949 		return (0);
24950 	}
24951 
24952 	conn_walk_fanout(conn_report1, mp->b_cont, Q_TO_CONN(q)->conn_zoneid);
24953 	return (0);
24954 }
24955 
24956 /*
24957  * Determine if the ill and multicast aspects of that packets
24958  * "matches" the conn.
24959  */
24960 boolean_t
24961 conn_wantpacket(conn_t *connp, ill_t *ill, ipha_t *ipha, int fanout_flags,
24962     zoneid_t zoneid)
24963 {
24964 	ill_t *in_ill;
24965 	boolean_t found;
24966 	ipif_t *ipif;
24967 	ire_t *ire;
24968 	ipaddr_t dst, src;
24969 
24970 	dst = ipha->ipha_dst;
24971 	src = ipha->ipha_src;
24972 
24973 	/*
24974 	 * conn_incoming_ill is set by IP_BOUND_IF which limits
24975 	 * unicast, broadcast and multicast reception to
24976 	 * conn_incoming_ill. conn_wantpacket itself is called
24977 	 * only for BROADCAST and multicast.
24978 	 *
24979 	 * 1) ip_rput supresses duplicate broadcasts if the ill
24980 	 *    is part of a group. Hence, we should be receiving
24981 	 *    just one copy of broadcast for the whole group.
24982 	 *    Thus, if it is part of the group the packet could
24983 	 *    come on any ill of the group and hence we need a
24984 	 *    match on the group. Otherwise, match on ill should
24985 	 *    be sufficient.
24986 	 *
24987 	 * 2) ip_rput does not suppress duplicate multicast packets.
24988 	 *    If there are two interfaces in a ill group and we have
24989 	 *    2 applications (conns) joined a multicast group G on
24990 	 *    both the interfaces, ilm_lookup_ill filter in ip_rput
24991 	 *    will give us two packets because we join G on both the
24992 	 *    interfaces rather than nominating just one interface
24993 	 *    for receiving multicast like broadcast above. So,
24994 	 *    we have to call ilg_lookup_ill to filter out duplicate
24995 	 *    copies, if ill is part of a group.
24996 	 */
24997 	in_ill = connp->conn_incoming_ill;
24998 	if (in_ill != NULL) {
24999 		if (in_ill->ill_group == NULL) {
25000 			if (in_ill != ill)
25001 				return (B_FALSE);
25002 		} else if (in_ill->ill_group != ill->ill_group) {
25003 			return (B_FALSE);
25004 		}
25005 	}
25006 
25007 	if (!CLASSD(dst)) {
25008 		if (connp->conn_zoneid == zoneid)
25009 			return (B_TRUE);
25010 		/*
25011 		 * The conn is in a different zone; we need to check that this
25012 		 * broadcast address is configured in the application's zone and
25013 		 * on one ill in the group.
25014 		 */
25015 		ipif = ipif_get_next_ipif(NULL, ill);
25016 		if (ipif == NULL)
25017 			return (B_FALSE);
25018 		ire = ire_ctable_lookup(dst, 0, IRE_BROADCAST, ipif,
25019 		    connp->conn_zoneid, (MATCH_IRE_TYPE | MATCH_IRE_ILL_GROUP));
25020 		ipif_refrele(ipif);
25021 		if (ire != NULL) {
25022 			ire_refrele(ire);
25023 			return (B_TRUE);
25024 		} else {
25025 			return (B_FALSE);
25026 		}
25027 	}
25028 
25029 	if ((fanout_flags & IP_FF_NO_MCAST_LOOP) &&
25030 	    connp->conn_zoneid == zoneid) {
25031 		/*
25032 		 * Loopback case: the sending endpoint has IP_MULTICAST_LOOP
25033 		 * disabled, therefore we don't dispatch the multicast packet to
25034 		 * the sending zone.
25035 		 */
25036 		return (B_FALSE);
25037 	}
25038 
25039 	if ((ill->ill_phyint->phyint_flags & PHYI_LOOPBACK) &&
25040 	    connp->conn_zoneid != zoneid) {
25041 		/*
25042 		 * Multicast packet on the loopback interface: we only match
25043 		 * conns who joined the group in the specified zone.
25044 		 */
25045 		return (B_FALSE);
25046 	}
25047 
25048 	if (connp->conn_multi_router) {
25049 		/* multicast packet and multicast router socket: send up */
25050 		return (B_TRUE);
25051 	}
25052 
25053 	mutex_enter(&connp->conn_lock);
25054 	found = (ilg_lookup_ill_withsrc(connp, dst, src, ill) != NULL);
25055 	mutex_exit(&connp->conn_lock);
25056 	return (found);
25057 }
25058 
25059 /*
25060  * Finish processing of "arp_up" when AR_DLPIOP_DONE is received from arp.
25061  */
25062 /* ARGSUSED */
25063 static void
25064 ip_arp_done(ipsq_t *dummy_sq, queue_t *q, mblk_t *mp, void *dummy_arg)
25065 {
25066 	ill_t *ill = (ill_t *)q->q_ptr;
25067 	mblk_t	*mp1, *mp2;
25068 	ipif_t  *ipif;
25069 	int err = 0;
25070 	conn_t *connp = NULL;
25071 	ipsq_t	*ipsq;
25072 	arc_t	*arc;
25073 
25074 	ip1dbg(("ip_arp_done(%s)\n", ill->ill_name));
25075 
25076 	ASSERT((mp->b_wptr - mp->b_rptr) >= sizeof (arc_t));
25077 	ASSERT(((arc_t *)mp->b_rptr)->arc_cmd == AR_DLPIOP_DONE);
25078 
25079 	ASSERT(IAM_WRITER_ILL(ill));
25080 	mp2 = mp->b_cont;
25081 	mp->b_cont = NULL;
25082 
25083 	/*
25084 	 * We have now received the arp bringup completion message
25085 	 * from ARP. Mark the arp bringup as done. Also if the arp
25086 	 * stream has already started closing, send up the AR_ARP_CLOSING
25087 	 * ack now since ARP is waiting in close for this ack.
25088 	 */
25089 	mutex_enter(&ill->ill_lock);
25090 	ill->ill_arp_bringup_pending = 0;
25091 	if (ill->ill_arp_closing) {
25092 		mutex_exit(&ill->ill_lock);
25093 		/* Let's reuse the mp for sending the ack */
25094 		arc = (arc_t *)mp->b_rptr;
25095 		mp->b_wptr = mp->b_rptr + sizeof (arc_t);
25096 		arc->arc_cmd = AR_ARP_CLOSING;
25097 		qreply(q, mp);
25098 	} else {
25099 		mutex_exit(&ill->ill_lock);
25100 		freeb(mp);
25101 	}
25102 
25103 	/* We should have an IOCTL waiting on this. */
25104 	ipsq = ill->ill_phyint->phyint_ipsq;
25105 	ipif = ipsq->ipsq_pending_ipif;
25106 	mp1 = ipsq_pending_mp_get(ipsq, &connp);
25107 	ASSERT(!((mp1 != NULL)  ^ (ipif != NULL)));
25108 	if (mp1 == NULL) {
25109 		/* bringup was aborted by the user */
25110 		freemsg(mp2);
25111 		return;
25112 	}
25113 	ASSERT(connp != NULL);
25114 	q = CONNP_TO_WQ(connp);
25115 	/*
25116 	 * If the DL_BIND_REQ fails, it is noted
25117 	 * in arc_name_offset.
25118 	 */
25119 	err = *((int *)mp2->b_rptr);
25120 	if (err == 0) {
25121 		if (ipif->ipif_isv6) {
25122 			if ((err = ipif_up_done_v6(ipif)) != 0)
25123 				ip0dbg(("ip_arp_done: init failed\n"));
25124 		} else {
25125 			if ((err = ipif_up_done(ipif)) != 0)
25126 				ip0dbg(("ip_arp_done: init failed\n"));
25127 		}
25128 	} else {
25129 		ip0dbg(("ip_arp_done: DL_BIND_REQ failed\n"));
25130 	}
25131 
25132 	freemsg(mp2);
25133 
25134 	if ((err == 0) && (ill->ill_up_ipifs)) {
25135 		err = ill_up_ipifs(ill, q, mp1);
25136 		if (err == EINPROGRESS)
25137 			return;
25138 	}
25139 
25140 	if (ill->ill_up_ipifs) {
25141 		ill_group_cleanup(ill);
25142 	}
25143 
25144 	/*
25145 	 * The ioctl must complete now without EINPROGRESS
25146 	 * since ipsq_pending_mp_get has removed the ioctl mblk
25147 	 * from ipsq_pending_mp. Otherwise the ioctl will be
25148 	 * stuck for ever in the ipsq.
25149 	 */
25150 	ASSERT(err != EINPROGRESS);
25151 	ip_ioctl_finish(q, mp1, err, NO_COPYOUT, ipif, ipsq);
25152 }
25153 
25154 /* Allocate the private structure */
25155 static int
25156 ip_priv_alloc(void **bufp)
25157 {
25158 	void	*buf;
25159 
25160 	if ((buf = kmem_alloc(sizeof (ip_priv_t), KM_NOSLEEP)) == NULL)
25161 		return (ENOMEM);
25162 
25163 	*bufp = buf;
25164 	return (0);
25165 }
25166 
25167 /* Function to delete the private structure */
25168 void
25169 ip_priv_free(void *buf)
25170 {
25171 	ASSERT(buf != NULL);
25172 	kmem_free(buf, sizeof (ip_priv_t));
25173 }
25174 
25175 /*
25176  * The entry point for IPPF processing.
25177  * If the classifier (IPGPC_CLASSIFY) is not loaded and configured, the
25178  * routine just returns.
25179  *
25180  * When called, ip_process generates an ipp_packet_t structure
25181  * which holds the state information for this packet and invokes the
25182  * the classifier (via ipp_packet_process). The classification, depending on
25183  * configured filters, results in a list of actions for this packet. Invoking
25184  * an action may cause the packet to be dropped, in which case the resulting
25185  * mblk (*mpp) is NULL. proc indicates the callout position for
25186  * this packet and ill_index is the interface this packet on or will leave
25187  * on (inbound and outbound resp.).
25188  */
25189 void
25190 ip_process(ip_proc_t proc, mblk_t **mpp, uint32_t ill_index)
25191 {
25192 	mblk_t		*mp;
25193 	ip_priv_t	*priv;
25194 	ipp_action_id_t	aid;
25195 	int		rc = 0;
25196 	ipp_packet_t	*pp;
25197 #define	IP_CLASS	"ip"
25198 
25199 	/* If the classifier is not loaded, return  */
25200 	if ((aid = ipp_action_lookup(IPGPC_CLASSIFY)) == IPP_ACTION_INVAL) {
25201 		return;
25202 	}
25203 
25204 	mp = *mpp;
25205 	ASSERT(mp != NULL);
25206 
25207 	/* Allocate the packet structure */
25208 	rc = ipp_packet_alloc(&pp, IP_CLASS, aid);
25209 	if (rc != 0) {
25210 		*mpp = NULL;
25211 		freemsg(mp);
25212 		return;
25213 	}
25214 
25215 	/* Allocate the private structure */
25216 	rc = ip_priv_alloc((void **)&priv);
25217 	if (rc != 0) {
25218 		*mpp = NULL;
25219 		freemsg(mp);
25220 		ipp_packet_free(pp);
25221 		return;
25222 	}
25223 	priv->proc = proc;
25224 	priv->ill_index = ill_index;
25225 	ipp_packet_set_private(pp, priv, ip_priv_free);
25226 	ipp_packet_set_data(pp, mp);
25227 
25228 	/* Invoke the classifier */
25229 	rc = ipp_packet_process(&pp);
25230 	if (pp != NULL) {
25231 		mp = ipp_packet_get_data(pp);
25232 		ipp_packet_free(pp);
25233 		if (rc != 0) {
25234 			freemsg(mp);
25235 			*mpp = NULL;
25236 		}
25237 	} else {
25238 		*mpp = NULL;
25239 	}
25240 #undef	IP_CLASS
25241 }
25242 
25243 /*
25244  * Propagate a multicast group membership operation (add/drop) on
25245  * all the interfaces crossed by the related multirt routes.
25246  * The call is considered successful if the operation succeeds
25247  * on at least one interface.
25248  */
25249 static int
25250 ip_multirt_apply_membership(int (*fn)(conn_t *, boolean_t, ipaddr_t, ipaddr_t,
25251     uint_t *, mcast_record_t, ipaddr_t, mblk_t *), ire_t *ire, conn_t *connp,
25252     boolean_t checkonly, ipaddr_t group, mcast_record_t fmode, ipaddr_t src,
25253     mblk_t *first_mp)
25254 {
25255 	ire_t		*ire_gw;
25256 	irb_t		*irb;
25257 	int		error = 0;
25258 	opt_restart_t	*or;
25259 
25260 	irb = ire->ire_bucket;
25261 	ASSERT(irb != NULL);
25262 
25263 	ASSERT(DB_TYPE(first_mp) == M_CTL);
25264 
25265 	or = (opt_restart_t *)first_mp->b_rptr;
25266 	IRB_REFHOLD(irb);
25267 	for (; ire != NULL; ire = ire->ire_next) {
25268 		if ((ire->ire_flags & RTF_MULTIRT) == 0)
25269 			continue;
25270 		if (ire->ire_addr != group)
25271 			continue;
25272 
25273 		ire_gw = ire_ftable_lookup(ire->ire_gateway_addr, 0, 0,
25274 		    IRE_INTERFACE, NULL, NULL, ALL_ZONES, 0,
25275 		    MATCH_IRE_RECURSIVE | MATCH_IRE_TYPE);
25276 		/* No resolver exists for the gateway; skip this ire. */
25277 		if (ire_gw == NULL)
25278 			continue;
25279 
25280 		/*
25281 		 * This function can return EINPROGRESS. If so the operation
25282 		 * will be restarted from ip_restart_optmgmt which will
25283 		 * call ip_opt_set and option processing will restart for
25284 		 * this option. So we may end up calling 'fn' more than once.
25285 		 * This requires that 'fn' is idempotent except for the
25286 		 * return value. The operation is considered a success if
25287 		 * it succeeds at least once on any one interface.
25288 		 */
25289 		error = fn(connp, checkonly, group, ire_gw->ire_src_addr,
25290 		    NULL, fmode, src, first_mp);
25291 		if (error == 0)
25292 			or->or_private = CGTP_MCAST_SUCCESS;
25293 
25294 		if (ip_debug > 0) {
25295 			ulong_t	off;
25296 			char	*ksym;
25297 			ksym = kobj_getsymname((uintptr_t)fn, &off);
25298 			ip2dbg(("ip_multirt_apply_membership: "
25299 			    "called %s, multirt group 0x%08x via itf 0x%08x, "
25300 			    "error %d [success %u]\n",
25301 			    ksym ? ksym : "?",
25302 			    ntohl(group), ntohl(ire_gw->ire_src_addr),
25303 			    error, or->or_private));
25304 		}
25305 
25306 		ire_refrele(ire_gw);
25307 		if (error == EINPROGRESS) {
25308 			IRB_REFRELE(irb);
25309 			return (error);
25310 		}
25311 	}
25312 	IRB_REFRELE(irb);
25313 	/*
25314 	 * Consider the call as successful if we succeeded on at least
25315 	 * one interface. Otherwise, return the last encountered error.
25316 	 */
25317 	return (or->or_private == CGTP_MCAST_SUCCESS ? 0 : error);
25318 }
25319 
25320 
25321 /*
25322  * Issue a warning regarding a route crossing an interface with an
25323  * incorrect MTU. Only one message every 'ip_multirt_log_interval'
25324  * amount of time is logged.
25325  */
25326 static void
25327 ip_multirt_bad_mtu(ire_t *ire, uint32_t max_frag)
25328 {
25329 	hrtime_t	current = gethrtime();
25330 	char		buf[16];
25331 
25332 	/* Convert interval in ms to hrtime in ns */
25333 	if (multirt_bad_mtu_last_time +
25334 	    ((hrtime_t)ip_multirt_log_interval * (hrtime_t)1000000) <=
25335 	    current) {
25336 		cmn_err(CE_WARN, "ip: ignoring multiroute "
25337 		    "to %s, incorrect MTU %u (expected %u)\n",
25338 		    ip_dot_addr(ire->ire_addr, buf),
25339 		    ire->ire_max_frag, max_frag);
25340 
25341 		multirt_bad_mtu_last_time = current;
25342 	}
25343 }
25344 
25345 
25346 /*
25347  * Get the CGTP (multirouting) filtering status.
25348  * If 0, the CGTP hooks are transparent.
25349  */
25350 /* ARGSUSED */
25351 static int
25352 ip_cgtp_filter_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *ioc_cr)
25353 {
25354 	boolean_t	*ip_cgtp_filter_value = (boolean_t *)cp;
25355 
25356 	(void) mi_mpprintf(mp, "%d", (int)*ip_cgtp_filter_value);
25357 	return (0);
25358 }
25359 
25360 
25361 /*
25362  * Set the CGTP (multirouting) filtering status.
25363  * If the status is changed from active to transparent
25364  * or from transparent to active, forward the new status
25365  * to the filtering module (if loaded).
25366  */
25367 /* ARGSUSED */
25368 static int
25369 ip_cgtp_filter_set(queue_t *q, mblk_t *mp, char *value, caddr_t cp,
25370     cred_t *ioc_cr)
25371 {
25372 	long		new_value;
25373 	boolean_t	*ip_cgtp_filter_value = (boolean_t *)cp;
25374 
25375 	if (ddi_strtol(value, NULL, 10, &new_value) != 0 ||
25376 	    new_value < 0 || new_value > 1) {
25377 		return (EINVAL);
25378 	}
25379 
25380 	/*
25381 	 * Do not enable CGTP filtering - thus preventing the hooks
25382 	 * from being invoked - if the version number of the
25383 	 * filtering module hooks does not match.
25384 	 */
25385 	if ((ip_cgtp_filter_ops != NULL) &&
25386 	    (ip_cgtp_filter_ops->cfo_filter_rev != CGTP_FILTER_REV)) {
25387 		cmn_err(CE_WARN, "IP: CGTP filtering version mismatch "
25388 		    "(module hooks version %d, expecting %d)\n",
25389 		    ip_cgtp_filter_ops->cfo_filter_rev, CGTP_FILTER_REV);
25390 		return (ENOTSUP);
25391 	}
25392 
25393 	if ((!*ip_cgtp_filter_value) && new_value) {
25394 		cmn_err(CE_NOTE, "IP: enabling CGTP filtering%s",
25395 		    ip_cgtp_filter_ops == NULL ?
25396 		    " (module not loaded)" : "");
25397 	}
25398 	if (*ip_cgtp_filter_value && (!new_value)) {
25399 		cmn_err(CE_NOTE, "IP: disabling CGTP filtering%s",
25400 		    ip_cgtp_filter_ops == NULL ?
25401 		    " (module not loaded)" : "");
25402 	}
25403 
25404 	if (ip_cgtp_filter_ops != NULL) {
25405 		int	res;
25406 		if ((res = ip_cgtp_filter_ops->cfo_change_state(new_value))) {
25407 			return (res);
25408 		}
25409 	}
25410 
25411 	*ip_cgtp_filter_value = (boolean_t)new_value;
25412 
25413 	return (0);
25414 }
25415 
25416 
25417 /*
25418  * Return the expected CGTP hooks version number.
25419  */
25420 int
25421 ip_cgtp_filter_supported(void)
25422 {
25423 	return (ip_cgtp_filter_rev);
25424 }
25425 
25426 
25427 /*
25428  * CGTP hooks can be registered by directly touching ip_cgtp_filter_ops
25429  * or by invoking this function. In the first case, the version number
25430  * of the registered structure is checked at hooks activation time
25431  * in ip_cgtp_filter_set().
25432  */
25433 int
25434 ip_cgtp_filter_register(cgtp_filter_ops_t *ops)
25435 {
25436 	if (ops->cfo_filter_rev != CGTP_FILTER_REV)
25437 		return (ENOTSUP);
25438 
25439 	ip_cgtp_filter_ops = ops;
25440 	return (0);
25441 }
25442 
25443 static squeue_func_t
25444 ip_squeue_switch(int val)
25445 {
25446 	squeue_func_t rval = squeue_fill;
25447 
25448 	switch (val) {
25449 	case IP_SQUEUE_ENTER_NODRAIN:
25450 		rval = squeue_enter_nodrain;
25451 		break;
25452 	case IP_SQUEUE_ENTER:
25453 		rval = squeue_enter;
25454 		break;
25455 	default:
25456 		break;
25457 	}
25458 	return (rval);
25459 }
25460 
25461 /* ARGSUSED */
25462 static int
25463 ip_input_proc_set(queue_t *q, mblk_t *mp, char *value,
25464     caddr_t addr, cred_t *cr)
25465 {
25466 	int *v = (int *)addr;
25467 	long new_value;
25468 
25469 	if (ddi_strtol(value, NULL, 10, &new_value) != 0)
25470 		return (EINVAL);
25471 
25472 	ip_input_proc = ip_squeue_switch(new_value);
25473 	*v = new_value;
25474 	return (0);
25475 }
25476 
25477 /* ARGSUSED */
25478 static int
25479 ip_fanout_set(queue_t *q, mblk_t *mp, char *value,
25480     caddr_t addr, cred_t *cr)
25481 {
25482 	int *v = (int *)addr;
25483 	long new_value;
25484 
25485 	if (ddi_strtol(value, NULL, 10, &new_value) != 0)
25486 		return (EINVAL);
25487 
25488 	*v = new_value;
25489 	return (0);
25490 }
25491 
25492 
25493 static void
25494 ip_kstat_init(void)
25495 {
25496 	ip_named_kstat_t template = {
25497 		{ "forwarding",		KSTAT_DATA_UINT32, 0 },
25498 		{ "defaultTTL",		KSTAT_DATA_UINT32, 0 },
25499 		{ "inReceives",		KSTAT_DATA_UINT32, 0 },
25500 		{ "inHdrErrors",	KSTAT_DATA_UINT32, 0 },
25501 		{ "inAddrErrors",	KSTAT_DATA_UINT32, 0 },
25502 		{ "forwDatagrams",	KSTAT_DATA_UINT32, 0 },
25503 		{ "inUnknownProtos",	KSTAT_DATA_UINT32, 0 },
25504 		{ "inDiscards",		KSTAT_DATA_UINT32, 0 },
25505 		{ "inDelivers",		KSTAT_DATA_UINT32, 0 },
25506 		{ "outRequests",	KSTAT_DATA_UINT32, 0 },
25507 		{ "outDiscards",	KSTAT_DATA_UINT32, 0 },
25508 		{ "outNoRoutes",	KSTAT_DATA_UINT32, 0 },
25509 		{ "reasmTimeout",	KSTAT_DATA_UINT32, 0 },
25510 		{ "reasmReqds",		KSTAT_DATA_UINT32, 0 },
25511 		{ "reasmOKs",		KSTAT_DATA_UINT32, 0 },
25512 		{ "reasmFails",		KSTAT_DATA_UINT32, 0 },
25513 		{ "fragOKs",		KSTAT_DATA_UINT32, 0 },
25514 		{ "fragFails",		KSTAT_DATA_UINT32, 0 },
25515 		{ "fragCreates",	KSTAT_DATA_UINT32, 0 },
25516 		{ "addrEntrySize",	KSTAT_DATA_INT32, 0 },
25517 		{ "routeEntrySize",	KSTAT_DATA_INT32, 0 },
25518 		{ "netToMediaEntrySize",	KSTAT_DATA_INT32, 0 },
25519 		{ "routingDiscards",	KSTAT_DATA_UINT32, 0 },
25520 		{ "inErrs",		KSTAT_DATA_UINT32, 0 },
25521 		{ "noPorts",		KSTAT_DATA_UINT32, 0 },
25522 		{ "inCksumErrs",	KSTAT_DATA_UINT32, 0 },
25523 		{ "reasmDuplicates",	KSTAT_DATA_UINT32, 0 },
25524 		{ "reasmPartDups",	KSTAT_DATA_UINT32, 0 },
25525 		{ "forwProhibits",	KSTAT_DATA_UINT32, 0 },
25526 		{ "udpInCksumErrs",	KSTAT_DATA_UINT32, 0 },
25527 		{ "udpInOverflows",	KSTAT_DATA_UINT32, 0 },
25528 		{ "rawipInOverflows",	KSTAT_DATA_UINT32, 0 },
25529 		{ "ipsecInSucceeded",	KSTAT_DATA_UINT32, 0 },
25530 		{ "ipsecInFailed",	KSTAT_DATA_INT32, 0 },
25531 		{ "memberEntrySize",	KSTAT_DATA_INT32, 0 },
25532 		{ "inIPv6",		KSTAT_DATA_UINT32, 0 },
25533 		{ "outIPv6",		KSTAT_DATA_UINT32, 0 },
25534 		{ "outSwitchIPv6",	KSTAT_DATA_UINT32, 0 },
25535 	};
25536 
25537 	ip_mibkp = kstat_create("ip", 0, "ip", "mib2", KSTAT_TYPE_NAMED,
25538 					NUM_OF_FIELDS(ip_named_kstat_t),
25539 					0);
25540 	if (!ip_mibkp)
25541 		return;
25542 
25543 	template.forwarding.value.ui32 = WE_ARE_FORWARDING ? 1:2;
25544 	template.defaultTTL.value.ui32 = (uint32_t)ip_def_ttl;
25545 	template.reasmTimeout.value.ui32 = ip_g_frag_timeout;
25546 	template.addrEntrySize.value.i32 = sizeof (mib2_ipAddrEntry_t);
25547 	template.routeEntrySize.value.i32 = sizeof (mib2_ipRouteEntry_t);
25548 
25549 	template.netToMediaEntrySize.value.i32 =
25550 		sizeof (mib2_ipNetToMediaEntry_t);
25551 
25552 	template.memberEntrySize.value.i32 = sizeof (ipv6_member_t);
25553 
25554 	bcopy(&template, ip_mibkp->ks_data, sizeof (template));
25555 
25556 	ip_mibkp->ks_update = ip_kstat_update;
25557 
25558 	kstat_install(ip_mibkp);
25559 }
25560 
25561 static void
25562 ip_kstat_fini(void)
25563 {
25564 
25565 	if (ip_mibkp != NULL) {
25566 		kstat_delete(ip_mibkp);
25567 		ip_mibkp = NULL;
25568 	}
25569 }
25570 
25571 static int
25572 ip_kstat_update(kstat_t *kp, int rw)
25573 {
25574 	ip_named_kstat_t *ipkp;
25575 
25576 	if (!kp || !kp->ks_data)
25577 		return (EIO);
25578 
25579 	if (rw == KSTAT_WRITE)
25580 		return (EACCES);
25581 
25582 	ipkp = (ip_named_kstat_t *)kp->ks_data;
25583 
25584 	ipkp->forwarding.value.ui32 =		ip_mib.ipForwarding;
25585 	ipkp->defaultTTL.value.ui32 =		ip_mib.ipDefaultTTL;
25586 	ipkp->inReceives.value.ui32 =		ip_mib.ipInReceives;
25587 	ipkp->inHdrErrors.value.ui32 =		ip_mib.ipInHdrErrors;
25588 	ipkp->inAddrErrors.value.ui32 =		ip_mib.ipInAddrErrors;
25589 	ipkp->forwDatagrams.value.ui32 =	ip_mib.ipForwDatagrams;
25590 	ipkp->inUnknownProtos.value.ui32 =	ip_mib.ipInUnknownProtos;
25591 	ipkp->inDiscards.value.ui32 =		ip_mib.ipInDiscards;
25592 	ipkp->inDelivers.value.ui32 =		ip_mib.ipInDelivers;
25593 	ipkp->outRequests.value.ui32 =		ip_mib.ipOutRequests;
25594 	ipkp->outDiscards.value.ui32 =		ip_mib.ipOutDiscards;
25595 	ipkp->outNoRoutes.value.ui32 =		ip_mib.ipOutNoRoutes;
25596 	ipkp->reasmTimeout.value.ui32 =		ip_mib.ipReasmTimeout;
25597 	ipkp->reasmReqds.value.ui32 =		ip_mib.ipReasmReqds;
25598 	ipkp->reasmOKs.value.ui32 =		ip_mib.ipReasmOKs;
25599 	ipkp->reasmFails.value.ui32 =		ip_mib.ipReasmFails;
25600 	ipkp->fragOKs.value.ui32 =		ip_mib.ipFragOKs;
25601 	ipkp->fragFails.value.ui32 =		ip_mib.ipFragFails;
25602 	ipkp->fragCreates.value.ui32 =		ip_mib.ipFragCreates;
25603 
25604 	ipkp->routingDiscards.value.ui32 =	ip_mib.ipRoutingDiscards;
25605 	ipkp->inErrs.value.ui32 =		ip_mib.tcpInErrs;
25606 	ipkp->noPorts.value.ui32 =		ip_mib.udpNoPorts;
25607 	ipkp->inCksumErrs.value.ui32 =		ip_mib.ipInCksumErrs;
25608 	ipkp->reasmDuplicates.value.ui32 =	ip_mib.ipReasmDuplicates;
25609 	ipkp->reasmPartDups.value.ui32 =	ip_mib.ipReasmPartDups;
25610 	ipkp->forwProhibits.value.ui32 =	ip_mib.ipForwProhibits;
25611 	ipkp->udpInCksumErrs.value.ui32 =	ip_mib.udpInCksumErrs;
25612 	ipkp->udpInOverflows.value.ui32 =	ip_mib.udpInOverflows;
25613 	ipkp->rawipInOverflows.value.ui32 =	ip_mib.rawipInOverflows;
25614 	ipkp->ipsecInSucceeded.value.ui32 =	ip_mib.ipsecInSucceeded;
25615 	ipkp->ipsecInFailed.value.i32 =		ip_mib.ipsecInFailed;
25616 
25617 	ipkp->inIPv6.value.ui32 =		ip_mib.ipInIPv6;
25618 	ipkp->outIPv6.value.ui32 =		ip_mib.ipOutIPv6;
25619 	ipkp->outSwitchIPv6.value.ui32 =	ip_mib.ipOutSwitchIPv6;
25620 
25621 	return (0);
25622 }
25623 
25624 static void
25625 icmp_kstat_init(void)
25626 {
25627 	icmp_named_kstat_t template = {
25628 		{ "inMsgs",		KSTAT_DATA_UINT32 },
25629 		{ "inErrors",		KSTAT_DATA_UINT32 },
25630 		{ "inDestUnreachs",	KSTAT_DATA_UINT32 },
25631 		{ "inTimeExcds",	KSTAT_DATA_UINT32 },
25632 		{ "inParmProbs",	KSTAT_DATA_UINT32 },
25633 		{ "inSrcQuenchs",	KSTAT_DATA_UINT32 },
25634 		{ "inRedirects",	KSTAT_DATA_UINT32 },
25635 		{ "inEchos",		KSTAT_DATA_UINT32 },
25636 		{ "inEchoReps",		KSTAT_DATA_UINT32 },
25637 		{ "inTimestamps",	KSTAT_DATA_UINT32 },
25638 		{ "inTimestampReps",	KSTAT_DATA_UINT32 },
25639 		{ "inAddrMasks",	KSTAT_DATA_UINT32 },
25640 		{ "inAddrMaskReps",	KSTAT_DATA_UINT32 },
25641 		{ "outMsgs",		KSTAT_DATA_UINT32 },
25642 		{ "outErrors",		KSTAT_DATA_UINT32 },
25643 		{ "outDestUnreachs",	KSTAT_DATA_UINT32 },
25644 		{ "outTimeExcds",	KSTAT_DATA_UINT32 },
25645 		{ "outParmProbs",	KSTAT_DATA_UINT32 },
25646 		{ "outSrcQuenchs",	KSTAT_DATA_UINT32 },
25647 		{ "outRedirects",	KSTAT_DATA_UINT32 },
25648 		{ "outEchos",		KSTAT_DATA_UINT32 },
25649 		{ "outEchoReps",	KSTAT_DATA_UINT32 },
25650 		{ "outTimestamps",	KSTAT_DATA_UINT32 },
25651 		{ "outTimestampReps",	KSTAT_DATA_UINT32 },
25652 		{ "outAddrMasks",	KSTAT_DATA_UINT32 },
25653 		{ "outAddrMaskReps",	KSTAT_DATA_UINT32 },
25654 		{ "inChksumErrs",	KSTAT_DATA_UINT32 },
25655 		{ "inUnknowns",		KSTAT_DATA_UINT32 },
25656 		{ "inFragNeeded",	KSTAT_DATA_UINT32 },
25657 		{ "outFragNeeded",	KSTAT_DATA_UINT32 },
25658 		{ "outDrops",		KSTAT_DATA_UINT32 },
25659 		{ "inOverFlows",	KSTAT_DATA_UINT32 },
25660 		{ "inBadRedirects",	KSTAT_DATA_UINT32 },
25661 	};
25662 
25663 	icmp_mibkp = kstat_create("ip", 0, "icmp", "mib2", KSTAT_TYPE_NAMED,
25664 					NUM_OF_FIELDS(icmp_named_kstat_t),
25665 					0);
25666 	if (icmp_mibkp == NULL)
25667 		return;
25668 
25669 	bcopy(&template, icmp_mibkp->ks_data, sizeof (template));
25670 
25671 	icmp_mibkp->ks_update = icmp_kstat_update;
25672 
25673 	kstat_install(icmp_mibkp);
25674 }
25675 
25676 static void
25677 icmp_kstat_fini(void)
25678 {
25679 
25680 	if (icmp_mibkp != NULL) {
25681 		kstat_delete(icmp_mibkp);
25682 		icmp_mibkp = NULL;
25683 	}
25684 }
25685 
25686 static int
25687 icmp_kstat_update(kstat_t *kp, int rw)
25688 {
25689 	icmp_named_kstat_t *icmpkp;
25690 
25691 	if ((kp == NULL) || (kp->ks_data == NULL))
25692 		return (EIO);
25693 
25694 	if (rw == KSTAT_WRITE)
25695 		return (EACCES);
25696 
25697 	icmpkp = (icmp_named_kstat_t *)kp->ks_data;
25698 
25699 	icmpkp->inMsgs.value.ui32 =		icmp_mib.icmpInMsgs;
25700 	icmpkp->inErrors.value.ui32 =		icmp_mib.icmpInErrors;
25701 	icmpkp->inDestUnreachs.value.ui32 =	icmp_mib.icmpInDestUnreachs;
25702 	icmpkp->inTimeExcds.value.ui32 =	icmp_mib.icmpInTimeExcds;
25703 	icmpkp->inParmProbs.value.ui32 =	icmp_mib.icmpInParmProbs;
25704 	icmpkp->inSrcQuenchs.value.ui32 =	icmp_mib.icmpInSrcQuenchs;
25705 	icmpkp->inRedirects.value.ui32 =	icmp_mib.icmpInRedirects;
25706 	icmpkp->inEchos.value.ui32 =		icmp_mib.icmpInEchos;
25707 	icmpkp->inEchoReps.value.ui32 =		icmp_mib.icmpInEchoReps;
25708 	icmpkp->inTimestamps.value.ui32 =	icmp_mib.icmpInTimestamps;
25709 	icmpkp->inTimestampReps.value.ui32 =	icmp_mib.icmpInTimestampReps;
25710 	icmpkp->inAddrMasks.value.ui32 =	icmp_mib.icmpInAddrMasks;
25711 	icmpkp->inAddrMaskReps.value.ui32 =	icmp_mib.icmpInAddrMaskReps;
25712 	icmpkp->outMsgs.value.ui32 =		icmp_mib.icmpOutMsgs;
25713 	icmpkp->outErrors.value.ui32 =		icmp_mib.icmpOutErrors;
25714 	icmpkp->outDestUnreachs.value.ui32 =	icmp_mib.icmpOutDestUnreachs;
25715 	icmpkp->outTimeExcds.value.ui32 =	icmp_mib.icmpOutTimeExcds;
25716 	icmpkp->outParmProbs.value.ui32 =	icmp_mib.icmpOutParmProbs;
25717 	icmpkp->outSrcQuenchs.value.ui32 =	icmp_mib.icmpOutSrcQuenchs;
25718 	icmpkp->outRedirects.value.ui32 =	icmp_mib.icmpOutRedirects;
25719 	icmpkp->outEchos.value.ui32 =		icmp_mib.icmpOutEchos;
25720 	icmpkp->outEchoReps.value.ui32 =	icmp_mib.icmpOutEchoReps;
25721 	icmpkp->outTimestamps.value.ui32 =	icmp_mib.icmpOutTimestamps;
25722 	icmpkp->outTimestampReps.value.ui32 =	icmp_mib.icmpOutTimestampReps;
25723 	icmpkp->outAddrMasks.value.ui32 =	icmp_mib.icmpOutAddrMasks;
25724 	icmpkp->outAddrMaskReps.value.ui32 =	icmp_mib.icmpOutAddrMaskReps;
25725 	icmpkp->inCksumErrs.value.ui32 =	icmp_mib.icmpInCksumErrs;
25726 	icmpkp->inUnknowns.value.ui32 =		icmp_mib.icmpInUnknowns;
25727 	icmpkp->inFragNeeded.value.ui32 =	icmp_mib.icmpInFragNeeded;
25728 	icmpkp->outFragNeeded.value.ui32 =	icmp_mib.icmpOutFragNeeded;
25729 	icmpkp->outDrops.value.ui32 =		icmp_mib.icmpOutDrops;
25730 	icmpkp->inOverflows.value.ui32 =	icmp_mib.icmpInOverflows;
25731 	icmpkp->inBadRedirects.value.ui32 =	icmp_mib.icmpInBadRedirects;
25732 
25733 	return (0);
25734 }
25735 
25736 /*
25737  * This is the fanout function for raw socket opened for SCTP.  Note
25738  * that it is called after SCTP checks that there is no socket which
25739  * wants a packet.  Then before SCTP handles this out of the blue packet,
25740  * this function is called to see if there is any raw socket for SCTP.
25741  * If there is and it is bound to the correct address, the packet will
25742  * be sent to that socket.  Note that only one raw socket can be bound to
25743  * a port.  This is assured in ipcl_sctp_hash_insert();
25744  */
25745 void
25746 ip_fanout_sctp_raw(mblk_t *mp, ill_t *recv_ill, ipha_t *ipha, boolean_t isv4,
25747     uint32_t ports, boolean_t mctl_present, uint_t flags, boolean_t ip_policy,
25748     uint_t ipif_seqid, zoneid_t zoneid)
25749 {
25750 	conn_t		*connp;
25751 	queue_t		*rq;
25752 	mblk_t		*first_mp;
25753 	boolean_t	secure;
25754 	ip6_t		*ip6h;
25755 
25756 	first_mp = mp;
25757 	if (mctl_present) {
25758 		mp = first_mp->b_cont;
25759 		secure = ipsec_in_is_secure(first_mp);
25760 		ASSERT(mp != NULL);
25761 	} else {
25762 		secure = B_FALSE;
25763 	}
25764 	ip6h = (isv4) ? NULL : (ip6_t *)ipha;
25765 
25766 	connp = ipcl_classify_raw(IPPROTO_SCTP, zoneid, ports, ipha);
25767 	if (connp == NULL) {
25768 		sctp_ootb_input(first_mp, recv_ill, ipif_seqid, zoneid,
25769 		    mctl_present);
25770 		return;
25771 	}
25772 	rq = connp->conn_rq;
25773 	if (!canputnext(rq)) {
25774 		CONN_DEC_REF(connp);
25775 		BUMP_MIB(&ip_mib, rawipInOverflows);
25776 		freemsg(first_mp);
25777 		return;
25778 	}
25779 	if ((isv4 ? CONN_INBOUND_POLICY_PRESENT(connp) :
25780 	    CONN_INBOUND_POLICY_PRESENT_V6(connp)) || secure) {
25781 		first_mp = ipsec_check_inbound_policy(first_mp, connp,
25782 		    (isv4 ? ipha : NULL), ip6h, mctl_present);
25783 		if (first_mp == NULL) {
25784 			CONN_DEC_REF(connp);
25785 			return;
25786 		}
25787 	}
25788 	/*
25789 	 * We probably should not send M_CTL message up to
25790 	 * raw socket.
25791 	 */
25792 	if (mctl_present)
25793 		freeb(first_mp);
25794 
25795 	/* Initiate IPPF processing here if needed. */
25796 	if ((isv4 && IPP_ENABLED(IPP_LOCAL_IN) && ip_policy) ||
25797 	    (!isv4 && IP6_IN_IPP(flags))) {
25798 		ip_process(IPP_LOCAL_IN, &mp,
25799 		    recv_ill->ill_phyint->phyint_ifindex);
25800 		if (mp == NULL) {
25801 			CONN_DEC_REF(connp);
25802 			return;
25803 		}
25804 	}
25805 
25806 	if (connp->conn_recvif || connp->conn_recvslla ||
25807 	    ((connp->conn_ipv6_recvpktinfo ||
25808 	    (!isv4 && IN6_IS_ADDR_LINKLOCAL(&ip6h->ip6_src))) &&
25809 	    (flags & IP_FF_IP6INFO))) {
25810 		int in_flags = 0;
25811 
25812 		if (connp->conn_recvif || connp->conn_ipv6_recvpktinfo) {
25813 			in_flags = IPF_RECVIF;
25814 		}
25815 		if (connp->conn_recvslla) {
25816 			in_flags |= IPF_RECVSLLA;
25817 		}
25818 		if (isv4) {
25819 			mp = ip_add_info(mp, recv_ill, in_flags);
25820 		} else {
25821 			mp = ip_add_info_v6(mp, recv_ill, &ip6h->ip6_dst);
25822 			if (mp == NULL) {
25823 				CONN_DEC_REF(connp);
25824 				return;
25825 			}
25826 		}
25827 	}
25828 
25829 	BUMP_MIB(&ip_mib, ipInDelivers);
25830 	/*
25831 	 * We are sending the IPSEC_IN message also up. Refer
25832 	 * to comments above this function.
25833 	 */
25834 	putnext(rq, mp);
25835 	CONN_DEC_REF(connp);
25836 }
25837 
25838 /*
25839  * Martian Address Filtering [RFC 1812, Section 5.3.7]
25840  */
25841 static boolean_t
25842 ip_no_forward(ipha_t *ipha, ill_t *ill)
25843 {
25844 	ipaddr_t ip_src, ip_dst;
25845 	ire_t *src_ire = NULL;
25846 
25847 	ip_src = ntohl(ipha->ipha_src);
25848 	ip_dst = ntohl(ipha->ipha_dst);
25849 
25850 	if (ip_dst == INADDR_ANY)
25851 		goto dont_forward;
25852 
25853 	if (IN_CLASSD(ip_src))
25854 		goto dont_forward;
25855 
25856 	if ((ip_src >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET)
25857 		goto dont_forward;
25858 
25859 	if (IN_BADCLASS(ip_dst))
25860 		goto dont_forward;
25861 
25862 	src_ire = ire_ctable_lookup(ipha->ipha_src, 0, IRE_BROADCAST, NULL,
25863 	    ALL_ZONES, MATCH_IRE_TYPE);
25864 	if (src_ire != NULL) {
25865 		ire_refrele(src_ire);
25866 		goto dont_forward;
25867 	}
25868 
25869 	return (B_FALSE);
25870 
25871 dont_forward:
25872 	if (ip_debug > 2) {
25873 		printf("ip_no_forward: dropping packet received on %s\n",
25874 		    ill->ill_name);
25875 		pr_addr_dbg("ip_no_forward: from src %s\n",
25876 		    AF_INET, &ipha->ipha_src);
25877 		pr_addr_dbg("ip_no_forward: to dst %s\n",
25878 		    AF_INET, &ipha->ipha_dst);
25879 	}
25880 	BUMP_MIB(&ip_mib, ipForwProhibits);
25881 	return (B_TRUE);
25882 }
25883 
25884 static boolean_t
25885 ip_loopback_src_or_dst(ipha_t *ipha, ill_t *ill)
25886 {
25887 	if (((ntohl(ipha->ipha_src) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET) ||
25888 	    ((ntohl(ipha->ipha_dst) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET)) {
25889 		if (ip_debug > 2) {
25890 			if (ill != NULL) {
25891 				printf("ip_loopback_src_or_dst: "
25892 				    "dropping packet received on %s\n",
25893 				    ill->ill_name);
25894 			} else {
25895 				printf("ip_loopback_src_or_dst: "
25896 				    "dropping packet\n");
25897 			}
25898 
25899 			pr_addr_dbg(
25900 			    "ip_loopback_src_or_dst: from src %s\n",
25901 			    AF_INET, &ipha->ipha_src);
25902 			pr_addr_dbg(
25903 			    "ip_loopback_src_or_dst: to dst %s\n",
25904 			    AF_INET, &ipha->ipha_dst);
25905 		}
25906 
25907 		BUMP_MIB(&ip_mib, ipInAddrErrors);
25908 		return (B_TRUE);
25909 	}
25910 	return (B_FALSE);
25911 }
25912