xref: /titanic_51/usr/src/uts/common/inet/ip/ip6.c (revision 878f29a18473c53fcfe3807c019cd8868bff5ae5)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 /*
26  * Copyright (c) 1990 Mentat Inc.
27  */
28 
29 #include <sys/types.h>
30 #include <sys/stream.h>
31 #include <sys/dlpi.h>
32 #include <sys/stropts.h>
33 #include <sys/sysmacros.h>
34 #include <sys/strsun.h>
35 #include <sys/strlog.h>
36 #include <sys/strsubr.h>
37 #define	_SUN_TPI_VERSION	2
38 #include <sys/tihdr.h>
39 #include <sys/ddi.h>
40 #include <sys/sunddi.h>
41 #include <sys/cmn_err.h>
42 #include <sys/debug.h>
43 #include <sys/sdt.h>
44 #include <sys/kobj.h>
45 #include <sys/zone.h>
46 #include <sys/neti.h>
47 #include <sys/hook.h>
48 
49 #include <sys/kmem.h>
50 #include <sys/systm.h>
51 #include <sys/param.h>
52 #include <sys/socket.h>
53 #include <sys/vtrace.h>
54 #include <sys/isa_defs.h>
55 #include <sys/atomic.h>
56 #include <sys/iphada.h>
57 #include <sys/policy.h>
58 #include <net/if.h>
59 #include <net/if_types.h>
60 #include <net/route.h>
61 #include <net/if_dl.h>
62 #include <sys/sockio.h>
63 #include <netinet/in.h>
64 #include <netinet/ip6.h>
65 #include <netinet/icmp6.h>
66 #include <netinet/sctp.h>
67 
68 #include <inet/common.h>
69 #include <inet/mi.h>
70 #include <inet/optcom.h>
71 #include <inet/mib2.h>
72 #include <inet/nd.h>
73 #include <inet/arp.h>
74 
75 #include <inet/ip.h>
76 #include <inet/ip_impl.h>
77 #include <inet/ip6.h>
78 #include <inet/ip6_asp.h>
79 #include <inet/tcp.h>
80 #include <inet/tcp_impl.h>
81 #include <inet/udp_impl.h>
82 #include <inet/ipp_common.h>
83 
84 #include <inet/ip_multi.h>
85 #include <inet/ip_if.h>
86 #include <inet/ip_ire.h>
87 #include <inet/ip_rts.h>
88 #include <inet/ip_ndp.h>
89 #include <net/pfkeyv2.h>
90 #include <inet/ipsec_info.h>
91 #include <inet/sadb.h>
92 #include <inet/ipsec_impl.h>
93 #include <inet/tun.h>
94 #include <inet/sctp_ip.h>
95 #include <sys/pattr.h>
96 #include <inet/ipclassifier.h>
97 #include <inet/ipsecah.h>
98 #include <inet/udp_impl.h>
99 #include <inet/rawip_impl.h>
100 #include <inet/rts_impl.h>
101 #include <sys/squeue.h>
102 
103 #include <sys/tsol/label.h>
104 #include <sys/tsol/tnet.h>
105 
106 #include <rpc/pmap_prot.h>
107 
108 /* Temporary; for CR 6451644 work-around */
109 #include <sys/ethernet.h>
110 
111 extern squeue_func_t ip_input_proc;
112 
113 /*
114  * Naming conventions:
115  *      These rules should be judiciously applied
116  *	if there is a need to identify something as IPv6 versus IPv4
117  *	IPv6 funcions will end with _v6 in the ip module.
118  *	IPv6 funcions will end with _ipv6 in the transport modules.
119  *	IPv6 macros:
120  *		Some macros end with _V6; e.g. ILL_FRAG_HASH_V6
121  *		Some macros start with V6_; e.g. V6_OR_V4_INADDR_ANY
122  *		And then there are ..V4_PART_OF_V6.
123  *		The intent is that macros in the ip module end with _V6.
124  *	IPv6 global variables will start with ipv6_
125  *	IPv6 structures will start with ipv6
126  *	IPv6 defined constants should start with IPV6_
127  *		(but then there are NDP_DEFAULT_VERS_PRI_AND_FLOW, etc)
128  */
129 
130 /*
131  * ip6opt_ls is used to enable IPv6 (via /etc/system on TX systems).
132  * We need to do this because we didn't obtain the IP6OPT_LS (0x0a)
133  * from IANA. This mechanism will remain in effect until an official
134  * number is obtained.
135  */
136 uchar_t ip6opt_ls;
137 
138 const in6_addr_t ipv6_all_ones =
139 	{ 0xffffffffU, 0xffffffffU, 0xffffffffU, 0xffffffffU };
140 const in6_addr_t ipv6_all_zeros = { 0, 0, 0, 0 };
141 
142 #ifdef	_BIG_ENDIAN
143 const in6_addr_t ipv6_unspecified_group = { 0xff000000U, 0, 0, 0 };
144 #else	/* _BIG_ENDIAN */
145 const in6_addr_t ipv6_unspecified_group = { 0x000000ffU, 0, 0, 0 };
146 #endif	/* _BIG_ENDIAN */
147 
148 #ifdef	_BIG_ENDIAN
149 const in6_addr_t ipv6_loopback = { 0, 0, 0, 0x00000001U };
150 #else  /* _BIG_ENDIAN */
151 const in6_addr_t ipv6_loopback = { 0, 0, 0, 0x01000000U };
152 #endif /* _BIG_ENDIAN */
153 
154 #ifdef _BIG_ENDIAN
155 const in6_addr_t ipv6_all_hosts_mcast = { 0xff020000U, 0, 0, 0x00000001U };
156 #else  /* _BIG_ENDIAN */
157 const in6_addr_t ipv6_all_hosts_mcast = { 0x000002ffU, 0, 0, 0x01000000U };
158 #endif /* _BIG_ENDIAN */
159 
160 #ifdef _BIG_ENDIAN
161 const in6_addr_t ipv6_all_rtrs_mcast = { 0xff020000U, 0, 0, 0x00000002U };
162 #else  /* _BIG_ENDIAN */
163 const in6_addr_t ipv6_all_rtrs_mcast = { 0x000002ffU, 0, 0, 0x02000000U };
164 #endif /* _BIG_ENDIAN */
165 
166 #ifdef _BIG_ENDIAN
167 const in6_addr_t ipv6_all_v2rtrs_mcast = { 0xff020000U, 0, 0, 0x00000016U };
168 #else  /* _BIG_ENDIAN */
169 const in6_addr_t ipv6_all_v2rtrs_mcast = { 0x000002ffU, 0, 0, 0x16000000U };
170 #endif /* _BIG_ENDIAN */
171 
172 #ifdef _BIG_ENDIAN
173 const in6_addr_t ipv6_solicited_node_mcast =
174 			{ 0xff020000U, 0, 0x00000001U, 0xff000000U };
175 #else  /* _BIG_ENDIAN */
176 const in6_addr_t ipv6_solicited_node_mcast =
177 			{ 0x000002ffU, 0, 0x01000000U, 0x000000ffU };
178 #endif /* _BIG_ENDIAN */
179 
180 /* Leave room for ip_newroute to tack on the src and target addresses */
181 #define	OK_RESOLVER_MP_V6(mp)						\
182 		((mp) && ((mp)->b_wptr - (mp)->b_rptr) >= (2 * IPV6_ADDR_LEN))
183 
184 #define	IP6_MBLK_OK		0
185 #define	IP6_MBLK_HDR_ERR	1
186 #define	IP6_MBLK_LEN_ERR	2
187 
188 static void	icmp_inbound_too_big_v6(queue_t *, mblk_t *, ill_t *ill,
189     boolean_t, zoneid_t);
190 static void	icmp_pkt_v6(queue_t *, mblk_t *, void *, size_t,
191     const in6_addr_t *, boolean_t, zoneid_t, ip_stack_t *);
192 static void	icmp_redirect_v6(queue_t *, mblk_t *, ill_t *ill);
193 static int	ip_bind_connected_v6(conn_t *, mblk_t *, in6_addr_t *,
194     uint16_t, const in6_addr_t *, ip6_pkt_t *, uint16_t,
195     boolean_t, boolean_t, boolean_t, boolean_t);
196 static boolean_t ip_bind_insert_ire_v6(mblk_t *, ire_t *, const in6_addr_t *,
197     iulp_t *, ip_stack_t *);
198 static int	ip_bind_laddr_v6(conn_t *, mblk_t *, const in6_addr_t *,
199     uint16_t, boolean_t, boolean_t, boolean_t);
200 static void	ip_fanout_proto_v6(queue_t *, mblk_t *, ip6_t *, ill_t *,
201     ill_t *, uint8_t, uint_t, uint_t, boolean_t, zoneid_t);
202 static void	ip_fanout_tcp_v6(queue_t *, mblk_t *, ip6_t *, ill_t *,
203     ill_t *, uint_t, uint_t, boolean_t, zoneid_t);
204 static void	ip_fanout_udp_v6(queue_t *, mblk_t *, ip6_t *, uint32_t,
205     ill_t *, ill_t *, uint_t, boolean_t, zoneid_t);
206 static int	ip_process_options_v6(queue_t *, mblk_t *, ip6_t *,
207     uint8_t *, uint_t, uint8_t, ip_stack_t *);
208 static mblk_t	*ip_rput_frag_v6(queue_t *, mblk_t *, ip6_t *,
209     ip6_frag_t *, uint_t, uint_t *, uint32_t *, uint16_t *);
210 static boolean_t	ip_source_routed_v6(ip6_t *, mblk_t *, ip_stack_t *);
211 static void	ip_wput_ire_v6(queue_t *, mblk_t *, ire_t *, int, int,
212     conn_t *, int, int, int, zoneid_t);
213 
214 /*
215  * A template for an IPv6 AR_ENTRY_QUERY
216  */
217 static areq_t	ipv6_areq_template = {
218 	AR_ENTRY_QUERY,				/* cmd */
219 	sizeof (areq_t)+(2*IPV6_ADDR_LEN),	/* name offset */
220 	sizeof (areq_t),	/* name len (filled by ill_arp_alloc) */
221 	IP6_DL_SAP,		/* protocol, from arps perspective */
222 	sizeof (areq_t),	/* target addr offset */
223 	IPV6_ADDR_LEN,		/* target addr_length */
224 	0,			/* flags */
225 	sizeof (areq_t) + IPV6_ADDR_LEN,	/* sender addr offset */
226 	IPV6_ADDR_LEN,		/* sender addr length */
227 	6,			/* xmit_count */
228 	1000,			/* (re)xmit_interval in milliseconds */
229 	4			/* max # of requests to buffer */
230 	/* anything else filled in by the code */
231 };
232 
233 /*
234  * Handle IPv6 ICMP packets sent to us.  Consume the mblk passed in.
235  * The message has already been checksummed and if needed,
236  * a copy has been made to be sent any interested ICMP client (conn)
237  * Note that this is different than icmp_inbound() which does the fanout
238  * to conn's as well as local processing of the ICMP packets.
239  *
240  * All error messages are passed to the matching transport stream.
241  *
242  * Zones notes:
243  * The packet is only processed in the context of the specified zone: typically
244  * only this zone will reply to an echo request. This means that the caller must
245  * call icmp_inbound_v6() for each relevant zone.
246  */
247 static void
248 icmp_inbound_v6(queue_t *q, mblk_t *mp, ill_t *ill, uint_t hdr_length,
249     boolean_t mctl_present, uint_t flags, zoneid_t zoneid, mblk_t *dl_mp)
250 {
251 	icmp6_t		*icmp6;
252 	ip6_t		*ip6h;
253 	boolean_t	interested;
254 	ip6i_t		*ip6i;
255 	in6_addr_t	origsrc;
256 	ire_t		*ire;
257 	mblk_t		*first_mp;
258 	ipsec_in_t	*ii;
259 	ip_stack_t	*ipst = ill->ill_ipst;
260 
261 	ASSERT(ill != NULL);
262 	first_mp = mp;
263 	if (mctl_present) {
264 		mp = first_mp->b_cont;
265 		ASSERT(mp != NULL);
266 
267 		ii = (ipsec_in_t *)first_mp->b_rptr;
268 		ASSERT(ii->ipsec_in_type == IPSEC_IN);
269 	}
270 
271 	ip6h = (ip6_t *)mp->b_rptr;
272 
273 	BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInMsgs);
274 
275 	if ((mp->b_wptr - mp->b_rptr) < (hdr_length + ICMP6_MINLEN)) {
276 		if (!pullupmsg(mp, hdr_length + ICMP6_MINLEN)) {
277 			ip1dbg(("icmp_inbound_v6: pullupmsg failed\n"));
278 			BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInErrors);
279 			freemsg(first_mp);
280 			return;
281 		}
282 		ip6h = (ip6_t *)mp->b_rptr;
283 	}
284 	if (ipst->ips_icmp_accept_clear_messages == 0) {
285 		first_mp = ipsec_check_global_policy(first_mp, NULL,
286 		    NULL, ip6h, mctl_present, ipst->ips_netstack);
287 		if (first_mp == NULL)
288 			return;
289 	}
290 
291 	/*
292 	 * On a labeled system, we have to check whether the zone itself is
293 	 * permitted to receive raw traffic.
294 	 */
295 	if (is_system_labeled()) {
296 		if (zoneid == ALL_ZONES)
297 			zoneid = tsol_packet_to_zoneid(mp);
298 		if (!tsol_can_accept_raw(mp, B_FALSE)) {
299 			ip1dbg(("icmp_inbound_v6: zone %d can't receive raw",
300 			    zoneid));
301 			BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInErrors);
302 			freemsg(first_mp);
303 			return;
304 		}
305 	}
306 
307 	icmp6 = (icmp6_t *)(&mp->b_rptr[hdr_length]);
308 	ip2dbg(("icmp_inbound_v6: type %d code %d\n", icmp6->icmp6_type,
309 	    icmp6->icmp6_code));
310 	interested = !(icmp6->icmp6_type & ICMP6_INFOMSG_MASK);
311 
312 	/* Initiate IPPF processing here */
313 	if (IP6_IN_IPP(flags, ipst)) {
314 
315 		/*
316 		 * If the ifindex changes due to SIOCSLIFINDEX
317 		 * packet may return to IP on the wrong ill.
318 		 */
319 		ip_process(IPP_LOCAL_IN, &mp, ill->ill_phyint->phyint_ifindex);
320 		if (mp == NULL) {
321 			if (mctl_present) {
322 				freeb(first_mp);
323 			}
324 			return;
325 		}
326 	}
327 
328 	switch (icmp6->icmp6_type) {
329 	case ICMP6_DST_UNREACH:
330 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInDestUnreachs);
331 		if (icmp6->icmp6_code == ICMP6_DST_UNREACH_ADMIN)
332 			BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInAdminProhibs);
333 		break;
334 
335 	case ICMP6_TIME_EXCEEDED:
336 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInTimeExcds);
337 		break;
338 
339 	case ICMP6_PARAM_PROB:
340 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInParmProblems);
341 		break;
342 
343 	case ICMP6_PACKET_TOO_BIG:
344 		icmp_inbound_too_big_v6(q, first_mp, ill, mctl_present,
345 		    zoneid);
346 		return;
347 	case ICMP6_ECHO_REQUEST:
348 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInEchos);
349 		if (IN6_IS_ADDR_MULTICAST(&ip6h->ip6_dst) &&
350 		    !ipst->ips_ipv6_resp_echo_mcast)
351 			break;
352 
353 		/*
354 		 * We must have exclusive use of the mblk to convert it to
355 		 * a response.
356 		 * If not, we copy it.
357 		 */
358 		if (mp->b_datap->db_ref > 1) {
359 			mblk_t	*mp1;
360 
361 			mp1 = copymsg(mp);
362 			freemsg(mp);
363 			if (mp1 == NULL) {
364 				BUMP_MIB(ill->ill_icmp6_mib,
365 				    ipv6IfIcmpInErrors);
366 				if (mctl_present)
367 					freeb(first_mp);
368 				return;
369 			}
370 			mp = mp1;
371 			ip6h = (ip6_t *)mp->b_rptr;
372 			icmp6 = (icmp6_t *)(&mp->b_rptr[hdr_length]);
373 			if (mctl_present)
374 				first_mp->b_cont = mp;
375 			else
376 				first_mp = mp;
377 		}
378 
379 		/*
380 		 * Turn the echo into an echo reply.
381 		 * Remove any extension headers (do not reverse a source route)
382 		 * and clear the flow id (keep traffic class for now).
383 		 */
384 		if (hdr_length != IPV6_HDR_LEN) {
385 			int	i;
386 
387 			for (i = 0; i < IPV6_HDR_LEN; i++)
388 				mp->b_rptr[hdr_length - i - 1] =
389 				    mp->b_rptr[IPV6_HDR_LEN - i - 1];
390 			mp->b_rptr += (hdr_length - IPV6_HDR_LEN);
391 			ip6h = (ip6_t *)mp->b_rptr;
392 			ip6h->ip6_nxt = IPPROTO_ICMPV6;
393 			hdr_length = IPV6_HDR_LEN;
394 		}
395 		ip6h->ip6_vcf &= ~IPV6_FLOWINFO_FLOWLABEL;
396 		icmp6->icmp6_type = ICMP6_ECHO_REPLY;
397 
398 		ip6h->ip6_plen =
399 		    htons((uint16_t)(msgdsize(mp) - IPV6_HDR_LEN));
400 		origsrc = ip6h->ip6_src;
401 		/*
402 		 * Reverse the source and destination addresses.
403 		 * If the return address is a multicast, zero out the source
404 		 * (ip_wput_v6 will set an address).
405 		 */
406 		if (IN6_IS_ADDR_MULTICAST(&ip6h->ip6_dst)) {
407 			ip6h->ip6_src = ipv6_all_zeros;
408 			ip6h->ip6_dst = origsrc;
409 		} else {
410 			ip6h->ip6_src = ip6h->ip6_dst;
411 			ip6h->ip6_dst = origsrc;
412 		}
413 
414 		/* set the hop limit */
415 		ip6h->ip6_hops = ipst->ips_ipv6_def_hops;
416 
417 		/*
418 		 * Prepare for checksum by putting icmp length in the icmp
419 		 * checksum field. The checksum is calculated in ip_wput_v6.
420 		 */
421 		icmp6->icmp6_cksum = ip6h->ip6_plen;
422 		/*
423 		 * ICMP echo replies should go out on the same interface
424 		 * the request came on as probes used by in.mpathd for
425 		 * detecting NIC failures are ECHO packets. We turn-off load
426 		 * spreading by allocating a ip6i and setting ip6i_attach_if
427 		 * to B_TRUE which is handled both by ip_wput_v6 and
428 		 * ip_newroute_v6. If we don't turnoff load spreading,
429 		 * the packets might get dropped if there are no
430 		 * non-FAILED/INACTIVE interfaces for it to go out on and
431 		 * in.mpathd would wrongly detect a failure or mis-detect
432 		 * a NIC failure as a link failure. As load spreading can
433 		 * happen only if ill_group is not NULL, we do only for
434 		 * that case and this does not affect the normal case.
435 		 *
436 		 * We force this only on echo packets that came from on-link
437 		 * hosts. We restrict this to link-local addresses which
438 		 * is used by in.mpathd for probing. In the IPv6 case,
439 		 * default routes typically have an ire_ipif pointer and
440 		 * hence a MATCH_IRE_ILL later in ip_newroute_v6/ip_wput_v6
441 		 * might work. As a default route out of this interface
442 		 * may not be present, enforcing this packet to go out in
443 		 * this case may not work.
444 		 */
445 		if (ill->ill_group != NULL &&
446 		    IN6_IS_ADDR_LINKLOCAL(&origsrc)) {
447 			/*
448 			 * If we are sending replies to ourselves, don't
449 			 * set ATTACH_IF as we may not be able to find
450 			 * the IRE_LOCAL on this ill i.e setting ATTACH_IF
451 			 * causes ip_wput_v6 to look for an IRE_LOCAL on
452 			 * "ill" which it may not find and will try to
453 			 * create an IRE_CACHE for our local address. Once
454 			 * we do this, we will try to forward all packets
455 			 * meant to our LOCAL address.
456 			 */
457 			ire = ire_cache_lookup_v6(&ip6h->ip6_dst, ALL_ZONES,
458 			    NULL, ipst);
459 			if (ire == NULL || ire->ire_type != IRE_LOCAL) {
460 				mp = ip_add_info_v6(mp, NULL, &ip6h->ip6_dst);
461 				if (mp == NULL) {
462 					BUMP_MIB(ill->ill_icmp6_mib,
463 					    ipv6IfIcmpInErrors);
464 					if (ire != NULL)
465 						ire_refrele(ire);
466 					if (mctl_present)
467 						freeb(first_mp);
468 					return;
469 				} else if (mctl_present) {
470 					first_mp->b_cont = mp;
471 				} else {
472 					first_mp = mp;
473 				}
474 				ip6i = (ip6i_t *)mp->b_rptr;
475 				ip6i->ip6i_flags = IP6I_ATTACH_IF;
476 				ip6i->ip6i_ifindex =
477 				    ill->ill_phyint->phyint_ifindex;
478 			}
479 			if (ire != NULL)
480 				ire_refrele(ire);
481 		}
482 
483 		if (!mctl_present) {
484 			/*
485 			 * This packet should go out the same way as it
486 			 * came in i.e in clear. To make sure that global
487 			 * policy will not be applied to this in ip_wput,
488 			 * we attach a IPSEC_IN mp and clear ipsec_in_secure.
489 			 */
490 			ASSERT(first_mp == mp);
491 			first_mp = ipsec_in_alloc(B_FALSE, ipst->ips_netstack);
492 			if (first_mp == NULL) {
493 				BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
494 				freemsg(mp);
495 				return;
496 			}
497 			ii = (ipsec_in_t *)first_mp->b_rptr;
498 
499 			/* This is not a secure packet */
500 			ii->ipsec_in_secure = B_FALSE;
501 			first_mp->b_cont = mp;
502 		}
503 		ii->ipsec_in_zoneid = zoneid;
504 		ASSERT(zoneid != ALL_ZONES);
505 		if (!ipsec_in_to_out(first_mp, NULL, ip6h)) {
506 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
507 			return;
508 		}
509 		put(WR(q), first_mp);
510 		return;
511 
512 	case ICMP6_ECHO_REPLY:
513 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInEchoReplies);
514 		break;
515 
516 	case ND_ROUTER_SOLICIT:
517 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInRouterSolicits);
518 		break;
519 
520 	case ND_ROUTER_ADVERT:
521 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInRouterAdvertisements);
522 		break;
523 
524 	case ND_NEIGHBOR_SOLICIT:
525 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInNeighborSolicits);
526 		if (mctl_present)
527 			freeb(first_mp);
528 		/* XXX may wish to pass first_mp up to ndp_input someday. */
529 		ndp_input(ill, mp, dl_mp);
530 		return;
531 
532 	case ND_NEIGHBOR_ADVERT:
533 		BUMP_MIB(ill->ill_icmp6_mib,
534 		    ipv6IfIcmpInNeighborAdvertisements);
535 		if (mctl_present)
536 			freeb(first_mp);
537 		/* XXX may wish to pass first_mp up to ndp_input someday. */
538 		ndp_input(ill, mp, dl_mp);
539 		return;
540 
541 	case ND_REDIRECT: {
542 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInRedirects);
543 
544 		if (ipst->ips_ipv6_ignore_redirect)
545 			break;
546 
547 		/*
548 		 * As there is no upper client to deliver, we don't
549 		 * need the first_mp any more.
550 		 */
551 		if (mctl_present)
552 			freeb(first_mp);
553 		if (!pullupmsg(mp, -1)) {
554 			BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInBadRedirects);
555 			break;
556 		}
557 		icmp_redirect_v6(q, mp, ill);
558 		return;
559 	}
560 
561 	/*
562 	 * The next three icmp messages will be handled by MLD.
563 	 * Pass all valid MLD packets up to any process(es)
564 	 * listening on a raw ICMP socket. MLD messages are
565 	 * freed by mld_input function.
566 	 */
567 	case MLD_LISTENER_QUERY:
568 	case MLD_LISTENER_REPORT:
569 	case MLD_LISTENER_REDUCTION:
570 		if (mctl_present)
571 			freeb(first_mp);
572 		mld_input(q, mp, ill);
573 		return;
574 	default:
575 		break;
576 	}
577 	if (interested) {
578 		icmp_inbound_error_fanout_v6(q, first_mp, ip6h, icmp6, ill,
579 		    mctl_present, zoneid);
580 	} else {
581 		freemsg(first_mp);
582 	}
583 }
584 
585 /*
586  * Process received IPv6 ICMP Packet too big.
587  * After updating any IRE it does the fanout to any matching transport streams.
588  * Assumes the IPv6 plus ICMPv6 headers have been pulled up but nothing else.
589  */
590 /* ARGSUSED */
591 static void
592 icmp_inbound_too_big_v6(queue_t *q, mblk_t *mp, ill_t *ill,
593     boolean_t mctl_present, zoneid_t zoneid)
594 {
595 	ip6_t		*ip6h;
596 	ip6_t		*inner_ip6h;
597 	icmp6_t		*icmp6;
598 	uint16_t	hdr_length;
599 	uint32_t	mtu;
600 	ire_t		*ire, *first_ire;
601 	mblk_t		*first_mp;
602 	ip_stack_t	*ipst = ill->ill_ipst;
603 
604 	first_mp = mp;
605 	if (mctl_present)
606 		mp = first_mp->b_cont;
607 	/*
608 	 * We must have exclusive use of the mblk to update the MTU
609 	 * in the packet.
610 	 * If not, we copy it.
611 	 *
612 	 * If there's an M_CTL present, we know that allocated first_mp
613 	 * earlier in this function, so we know first_mp has refcnt of one.
614 	 */
615 	ASSERT(!mctl_present || first_mp->b_datap->db_ref == 1);
616 	if (mp->b_datap->db_ref > 1) {
617 		mblk_t	*mp1;
618 
619 		mp1 = copymsg(mp);
620 		freemsg(mp);
621 		if (mp1 == NULL) {
622 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
623 			if (mctl_present)
624 				freeb(first_mp);
625 			return;
626 		}
627 		mp = mp1;
628 		if (mctl_present)
629 			first_mp->b_cont = mp;
630 		else
631 			first_mp = mp;
632 	}
633 	ip6h = (ip6_t *)mp->b_rptr;
634 	if (ip6h->ip6_nxt != IPPROTO_ICMPV6)
635 		hdr_length = ip_hdr_length_v6(mp, ip6h);
636 	else
637 		hdr_length = IPV6_HDR_LEN;
638 
639 	icmp6 = (icmp6_t *)(&mp->b_rptr[hdr_length]);
640 	ASSERT((size_t)(mp->b_wptr - mp->b_rptr) >= hdr_length + ICMP6_MINLEN);
641 	inner_ip6h = (ip6_t *)&icmp6[1];	/* Packet in error */
642 	if ((uchar_t *)&inner_ip6h[1] > mp->b_wptr) {
643 		if (!pullupmsg(mp, (uchar_t *)&inner_ip6h[1] - mp->b_rptr)) {
644 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
645 			freemsg(first_mp);
646 			return;
647 		}
648 		ip6h = (ip6_t *)mp->b_rptr;
649 		icmp6 = (icmp6_t *)&mp->b_rptr[hdr_length];
650 		inner_ip6h = (ip6_t *)&icmp6[1];
651 	}
652 
653 	/*
654 	 * For link local destinations matching simply on IRE type is not
655 	 * sufficient. Same link local addresses for different ILL's is
656 	 * possible.
657 	 */
658 
659 	if (IN6_IS_ADDR_LINKLOCAL(&inner_ip6h->ip6_dst)) {
660 		first_ire = ire_ctable_lookup_v6(&inner_ip6h->ip6_dst, NULL,
661 		    IRE_CACHE, ill->ill_ipif, ALL_ZONES, NULL,
662 		    MATCH_IRE_TYPE | MATCH_IRE_ILL_GROUP, ipst);
663 
664 		if (first_ire == NULL) {
665 			if (ip_debug > 2) {
666 				/* ip1dbg */
667 				pr_addr_dbg("icmp_inbound_too_big_v6:"
668 				    "no ire for dst %s\n", AF_INET6,
669 				    &inner_ip6h->ip6_dst);
670 			}
671 			freemsg(first_mp);
672 			return;
673 		}
674 
675 		mtu = ntohl(icmp6->icmp6_mtu);
676 		rw_enter(&first_ire->ire_bucket->irb_lock, RW_READER);
677 		for (ire = first_ire; ire != NULL &&
678 		    IN6_ARE_ADDR_EQUAL(&ire->ire_addr_v6, &inner_ip6h->ip6_dst);
679 		    ire = ire->ire_next) {
680 			mutex_enter(&ire->ire_lock);
681 			if (mtu < IPV6_MIN_MTU) {
682 				ip1dbg(("Received mtu less than IPv6 "
683 				    "min mtu %d: %d\n", IPV6_MIN_MTU, mtu));
684 				mtu = IPV6_MIN_MTU;
685 				/*
686 				 * If an mtu less than IPv6 min mtu is received,
687 				 * we must include a fragment header in
688 				 * subsequent packets.
689 				 */
690 				ire->ire_frag_flag |= IPH_FRAG_HDR;
691 			}
692 			ip1dbg(("Received mtu from router: %d\n", mtu));
693 			ire->ire_max_frag = MIN(ire->ire_max_frag, mtu);
694 			/* Record the new max frag size for the ULP. */
695 			if (ire->ire_frag_flag & IPH_FRAG_HDR) {
696 				/*
697 				 * If we need a fragment header in every packet
698 				 * (above case or multirouting), make sure the
699 				 * ULP takes it into account when computing the
700 				 * payload size.
701 				 */
702 				icmp6->icmp6_mtu = htonl(ire->ire_max_frag -
703 				    sizeof (ip6_frag_t));
704 			} else {
705 				icmp6->icmp6_mtu = htonl(ire->ire_max_frag);
706 			}
707 			mutex_exit(&ire->ire_lock);
708 		}
709 		rw_exit(&first_ire->ire_bucket->irb_lock);
710 		ire_refrele(first_ire);
711 	} else {
712 		irb_t	*irb = NULL;
713 		/*
714 		 * for non-link local destinations we match only on the IRE type
715 		 */
716 		ire = ire_ctable_lookup_v6(&inner_ip6h->ip6_dst, NULL,
717 		    IRE_CACHE, ill->ill_ipif, ALL_ZONES, NULL, MATCH_IRE_TYPE,
718 		    ipst);
719 		if (ire == NULL) {
720 			if (ip_debug > 2) {
721 				/* ip1dbg */
722 				pr_addr_dbg("icmp_inbound_too_big_v6:"
723 				    "no ire for dst %s\n",
724 				    AF_INET6, &inner_ip6h->ip6_dst);
725 			}
726 			freemsg(first_mp);
727 			return;
728 		}
729 		irb = ire->ire_bucket;
730 		ire_refrele(ire);
731 		rw_enter(&irb->irb_lock, RW_READER);
732 		for (ire = irb->irb_ire; ire != NULL; ire = ire->ire_next) {
733 			if (IN6_ARE_ADDR_EQUAL(&ire->ire_addr_v6,
734 			    &inner_ip6h->ip6_dst)) {
735 				mtu = ntohl(icmp6->icmp6_mtu);
736 				mutex_enter(&ire->ire_lock);
737 				if (mtu < IPV6_MIN_MTU) {
738 					ip1dbg(("Received mtu less than IPv6"
739 					    "min mtu %d: %d\n",
740 					    IPV6_MIN_MTU, mtu));
741 					mtu = IPV6_MIN_MTU;
742 					/*
743 					 * If an mtu less than IPv6 min mtu is
744 					 * received, we must include a fragment
745 					 * header in subsequent packets.
746 					 */
747 					ire->ire_frag_flag |= IPH_FRAG_HDR;
748 				}
749 
750 				ip1dbg(("Received mtu from router: %d\n", mtu));
751 				ire->ire_max_frag = MIN(ire->ire_max_frag, mtu);
752 				/* Record the new max frag size for the ULP. */
753 				if (ire->ire_frag_flag & IPH_FRAG_HDR) {
754 					/*
755 					 * If we need a fragment header in
756 					 * every packet (above case or
757 					 * multirouting), make sure the ULP
758 					 * takes it into account when computing
759 					 * the payload size.
760 					 */
761 					icmp6->icmp6_mtu =
762 					    htonl(ire->ire_max_frag -
763 					    sizeof (ip6_frag_t));
764 				} else {
765 					icmp6->icmp6_mtu =
766 					    htonl(ire->ire_max_frag);
767 				}
768 				mutex_exit(&ire->ire_lock);
769 			}
770 		}
771 		rw_exit(&irb->irb_lock);
772 	}
773 	icmp_inbound_error_fanout_v6(q, first_mp, ip6h, icmp6, ill,
774 	    mctl_present, zoneid);
775 }
776 
777 /*
778  * Fanout received ICMPv6 error packets to the transports.
779  * Assumes the IPv6 plus ICMPv6 headers have been pulled up but nothing else.
780  */
781 void
782 icmp_inbound_error_fanout_v6(queue_t *q, mblk_t *mp, ip6_t *ip6h,
783     icmp6_t *icmp6, ill_t *ill, boolean_t mctl_present, zoneid_t zoneid)
784 {
785 	uint16_t *up;	/* Pointer to ports in ULP header */
786 	uint32_t ports;	/* reversed ports for fanout */
787 	ip6_t rip6h;	/* With reversed addresses */
788 	uint16_t	hdr_length;
789 	uint8_t		*nexthdrp;
790 	uint8_t		nexthdr;
791 	mblk_t *first_mp;
792 	ipsec_in_t *ii;
793 	tcpha_t	*tcpha;
794 	conn_t	*connp;
795 	ip_stack_t	*ipst = ill->ill_ipst;
796 
797 	first_mp = mp;
798 	if (mctl_present) {
799 		mp = first_mp->b_cont;
800 		ASSERT(mp != NULL);
801 
802 		ii = (ipsec_in_t *)first_mp->b_rptr;
803 		ASSERT(ii->ipsec_in_type == IPSEC_IN);
804 	} else {
805 		ii = NULL;
806 	}
807 
808 	hdr_length = (uint16_t)((uchar_t *)icmp6 - (uchar_t *)ip6h);
809 	ASSERT((size_t)(mp->b_wptr - (uchar_t *)icmp6) >= ICMP6_MINLEN);
810 
811 	/*
812 	 * Need to pullup everything in order to use
813 	 * ip_hdr_length_nexthdr_v6()
814 	 */
815 	if (mp->b_cont != NULL) {
816 		if (!pullupmsg(mp, -1)) {
817 			ip1dbg(("icmp_inbound_error_fanout_v6: "
818 			    "pullupmsg failed\n"));
819 			goto drop_pkt;
820 		}
821 		ip6h = (ip6_t *)mp->b_rptr;
822 		icmp6 = (icmp6_t *)(&mp->b_rptr[hdr_length]);
823 	}
824 
825 	ip6h = (ip6_t *)&icmp6[1];	/* Packet in error */
826 	if ((uchar_t *)&ip6h[1] > mp->b_wptr)
827 		goto drop_pkt;
828 
829 	if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &hdr_length, &nexthdrp))
830 		goto drop_pkt;
831 	nexthdr = *nexthdrp;
832 
833 	/* Set message type, must be done after pullups */
834 	mp->b_datap->db_type = M_CTL;
835 
836 	/* Try to pass the ICMP message to clients who need it */
837 	switch (nexthdr) {
838 	case IPPROTO_UDP: {
839 		/*
840 		 * Verify we have at least ICMP_MIN_TP_HDR_LEN bytes of
841 		 * UDP header to get the port information.
842 		 */
843 		if ((uchar_t *)ip6h + hdr_length + ICMP_MIN_TP_HDR_LEN >
844 		    mp->b_wptr) {
845 			break;
846 		}
847 		/*
848 		 * Attempt to find a client stream based on port.
849 		 * Note that we do a reverse lookup since the header is
850 		 * in the form we sent it out.
851 		 * The rip6h header is only used for the IPCL_UDP_MATCH_V6
852 		 * and we only set the src and dst addresses and nexthdr.
853 		 */
854 		up = (uint16_t *)((uchar_t *)ip6h + hdr_length);
855 		rip6h.ip6_src = ip6h->ip6_dst;
856 		rip6h.ip6_dst = ip6h->ip6_src;
857 		rip6h.ip6_nxt = nexthdr;
858 		((uint16_t *)&ports)[0] = up[1];
859 		((uint16_t *)&ports)[1] = up[0];
860 
861 		ip_fanout_udp_v6(q, first_mp, &rip6h, ports, ill, ill,
862 		    IP6_NO_IPPOLICY, mctl_present, zoneid);
863 		return;
864 	}
865 	case IPPROTO_TCP: {
866 		/*
867 		 * Verify we have at least ICMP_MIN_TP_HDR_LEN bytes of
868 		 * the TCP header to get the port information.
869 		 */
870 		if ((uchar_t *)ip6h + hdr_length + ICMP_MIN_TP_HDR_LEN >
871 		    mp->b_wptr) {
872 			break;
873 		}
874 
875 		/*
876 		 * Attempt to find a client stream based on port.
877 		 * Note that we do a reverse lookup since the header is
878 		 * in the form we sent it out.
879 		 * The rip6h header is only used for the IP_TCP_*MATCH_V6 and
880 		 * we only set the src and dst addresses and nexthdr.
881 		 */
882 
883 		tcpha = (tcpha_t *)((char *)ip6h + hdr_length);
884 		connp = ipcl_tcp_lookup_reversed_ipv6(ip6h, tcpha,
885 		    TCPS_LISTEN, ill->ill_phyint->phyint_ifindex, ipst);
886 		if (connp == NULL) {
887 			goto drop_pkt;
888 		}
889 
890 		squeue_fill(connp->conn_sqp, first_mp, tcp_input,
891 		    connp, SQTAG_TCP6_INPUT_ICMP_ERR);
892 		return;
893 
894 	}
895 	case IPPROTO_SCTP:
896 		/*
897 		 * Verify we have at least ICMP_MIN_TP_HDR_LEN bytes of
898 		 * the SCTP header to get the port information.
899 		 */
900 		if ((uchar_t *)ip6h + hdr_length + ICMP_MIN_TP_HDR_LEN >
901 		    mp->b_wptr) {
902 			break;
903 		}
904 
905 		up = (uint16_t *)((uchar_t *)ip6h + hdr_length);
906 		((uint16_t *)&ports)[0] = up[1];
907 		((uint16_t *)&ports)[1] = up[0];
908 		ip_fanout_sctp(first_mp, ill, (ipha_t *)ip6h, ports, 0,
909 		    mctl_present, IP6_NO_IPPOLICY, zoneid);
910 		return;
911 	case IPPROTO_ESP:
912 	case IPPROTO_AH: {
913 		int ipsec_rc;
914 		ipsec_stack_t *ipss = ipst->ips_netstack->netstack_ipsec;
915 
916 		/*
917 		 * We need a IPSEC_IN in the front to fanout to AH/ESP.
918 		 * We will re-use the IPSEC_IN if it is already present as
919 		 * AH/ESP will not affect any fields in the IPSEC_IN for
920 		 * ICMP errors. If there is no IPSEC_IN, allocate a new
921 		 * one and attach it in the front.
922 		 */
923 		if (ii != NULL) {
924 			/*
925 			 * ip_fanout_proto_again converts the ICMP errors
926 			 * that come back from AH/ESP to M_DATA so that
927 			 * if it is non-AH/ESP and we do a pullupmsg in
928 			 * this function, it would work. Convert it back
929 			 * to M_CTL before we send up as this is a ICMP
930 			 * error. This could have been generated locally or
931 			 * by some router. Validate the inner IPSEC
932 			 * headers.
933 			 *
934 			 * NOTE : ill_index is used by ip_fanout_proto_again
935 			 * to locate the ill.
936 			 */
937 			ASSERT(ill != NULL);
938 			ii->ipsec_in_ill_index =
939 			    ill->ill_phyint->phyint_ifindex;
940 			ii->ipsec_in_rill_index = ii->ipsec_in_ill_index;
941 			first_mp->b_cont->b_datap->db_type = M_CTL;
942 		} else {
943 			/*
944 			 * IPSEC_IN is not present. We attach a ipsec_in
945 			 * message and send up to IPSEC for validating
946 			 * and removing the IPSEC headers. Clear
947 			 * ipsec_in_secure so that when we return
948 			 * from IPSEC, we don't mistakenly think that this
949 			 * is a secure packet came from the network.
950 			 *
951 			 * NOTE : ill_index is used by ip_fanout_proto_again
952 			 * to locate the ill.
953 			 */
954 			ASSERT(first_mp == mp);
955 			first_mp = ipsec_in_alloc(B_FALSE, ipst->ips_netstack);
956 			ASSERT(ill != NULL);
957 			if (first_mp == NULL) {
958 				freemsg(mp);
959 				BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
960 				return;
961 			}
962 			ii = (ipsec_in_t *)first_mp->b_rptr;
963 
964 			/* This is not a secure packet */
965 			ii->ipsec_in_secure = B_FALSE;
966 			first_mp->b_cont = mp;
967 			mp->b_datap->db_type = M_CTL;
968 			ii->ipsec_in_ill_index =
969 			    ill->ill_phyint->phyint_ifindex;
970 			ii->ipsec_in_rill_index = ii->ipsec_in_ill_index;
971 		}
972 
973 		if (!ipsec_loaded(ipss)) {
974 			ip_proto_not_sup(q, first_mp, 0, zoneid, ipst);
975 			return;
976 		}
977 
978 		if (nexthdr == IPPROTO_ESP)
979 			ipsec_rc = ipsecesp_icmp_error(first_mp);
980 		else
981 			ipsec_rc = ipsecah_icmp_error(first_mp);
982 		if (ipsec_rc == IPSEC_STATUS_FAILED)
983 			return;
984 
985 		ip_fanout_proto_again(first_mp, ill, ill, NULL);
986 		return;
987 	}
988 	case IPPROTO_ENCAP:
989 	case IPPROTO_IPV6:
990 		if ((uint8_t *)ip6h + hdr_length +
991 		    (nexthdr == IPPROTO_ENCAP ? sizeof (ipha_t) :
992 		    sizeof (ip6_t)) > mp->b_wptr) {
993 			goto drop_pkt;
994 		}
995 
996 		if (nexthdr == IPPROTO_ENCAP ||
997 		    !IN6_ARE_ADDR_EQUAL(
998 		    &((ip6_t *)(((uint8_t *)ip6h) + hdr_length))->ip6_src,
999 		    &ip6h->ip6_src) ||
1000 		    !IN6_ARE_ADDR_EQUAL(
1001 		    &((ip6_t *)(((uint8_t *)ip6h) + hdr_length))->ip6_dst,
1002 		    &ip6h->ip6_dst)) {
1003 			/*
1004 			 * For tunnels that have used IPsec protection,
1005 			 * we need to adjust the MTU to take into account
1006 			 * the IPsec overhead.
1007 			 */
1008 			if (ii != NULL)
1009 				icmp6->icmp6_mtu = htonl(
1010 				    ntohl(icmp6->icmp6_mtu) -
1011 				    ipsec_in_extra_length(first_mp));
1012 		} else {
1013 			/*
1014 			 * Self-encapsulated case. As in the ipv4 case,
1015 			 * we need to strip the 2nd IP header. Since mp
1016 			 * is already pulled-up, we can simply bcopy
1017 			 * the 3rd header + data over the 2nd header.
1018 			 */
1019 			uint16_t unused_len;
1020 			ip6_t *inner_ip6h = (ip6_t *)
1021 			    ((uchar_t *)ip6h + hdr_length);
1022 
1023 			/*
1024 			 * Make sure we don't do recursion more than once.
1025 			 */
1026 			if (!ip_hdr_length_nexthdr_v6(mp, inner_ip6h,
1027 			    &unused_len, &nexthdrp) ||
1028 			    *nexthdrp == IPPROTO_IPV6) {
1029 				goto drop_pkt;
1030 			}
1031 
1032 			/*
1033 			 * We are about to modify the packet. Make a copy if
1034 			 * someone else has a reference to it.
1035 			 */
1036 			if (DB_REF(mp) > 1) {
1037 				mblk_t	*mp1;
1038 				uint16_t icmp6_offset;
1039 
1040 				mp1 = copymsg(mp);
1041 				if (mp1 == NULL) {
1042 					goto drop_pkt;
1043 				}
1044 				icmp6_offset = (uint16_t)
1045 				    ((uchar_t *)icmp6 - mp->b_rptr);
1046 				freemsg(mp);
1047 				mp = mp1;
1048 
1049 				icmp6 = (icmp6_t *)(mp->b_rptr + icmp6_offset);
1050 				ip6h = (ip6_t *)&icmp6[1];
1051 				inner_ip6h = (ip6_t *)
1052 				    ((uchar_t *)ip6h + hdr_length);
1053 
1054 				if (mctl_present)
1055 					first_mp->b_cont = mp;
1056 				else
1057 					first_mp = mp;
1058 			}
1059 
1060 			/*
1061 			 * Need to set db_type back to M_DATA before
1062 			 * refeeding mp into this function.
1063 			 */
1064 			DB_TYPE(mp) = M_DATA;
1065 
1066 			/*
1067 			 * Copy the 3rd header + remaining data on top
1068 			 * of the 2nd header.
1069 			 */
1070 			bcopy(inner_ip6h, ip6h,
1071 			    mp->b_wptr - (uchar_t *)inner_ip6h);
1072 
1073 			/*
1074 			 * Subtract length of the 2nd header.
1075 			 */
1076 			mp->b_wptr -= hdr_length;
1077 
1078 			/*
1079 			 * Now recurse, and see what I _really_ should be
1080 			 * doing here.
1081 			 */
1082 			icmp_inbound_error_fanout_v6(q, first_mp,
1083 			    (ip6_t *)mp->b_rptr, icmp6, ill, mctl_present,
1084 			    zoneid);
1085 			return;
1086 		}
1087 		/* FALLTHRU */
1088 	default:
1089 		/*
1090 		 * The rip6h header is only used for the lookup and we
1091 		 * only set the src and dst addresses and nexthdr.
1092 		 */
1093 		rip6h.ip6_src = ip6h->ip6_dst;
1094 		rip6h.ip6_dst = ip6h->ip6_src;
1095 		rip6h.ip6_nxt = nexthdr;
1096 		ip_fanout_proto_v6(q, first_mp, &rip6h, ill, ill, nexthdr, 0,
1097 		    IP6_NO_IPPOLICY, mctl_present, zoneid);
1098 		return;
1099 	}
1100 	/* NOTREACHED */
1101 drop_pkt:
1102 	BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInErrors);
1103 	ip1dbg(("icmp_inbound_error_fanout_v6: drop pkt\n"));
1104 	freemsg(first_mp);
1105 }
1106 
1107 /*
1108  * Process received IPv6 ICMP Redirect messages.
1109  */
1110 /* ARGSUSED */
1111 static void
1112 icmp_redirect_v6(queue_t *q, mblk_t *mp, ill_t *ill)
1113 {
1114 	ip6_t		*ip6h;
1115 	uint16_t	hdr_length;
1116 	nd_redirect_t	*rd;
1117 	ire_t		*ire;
1118 	ire_t		*prev_ire;
1119 	ire_t		*redir_ire;
1120 	in6_addr_t	*src, *dst, *gateway;
1121 	nd_opt_hdr_t	*opt;
1122 	nce_t		*nce;
1123 	int		nce_flags = 0;
1124 	int		err = 0;
1125 	boolean_t	redirect_to_router = B_FALSE;
1126 	int		len;
1127 	int		optlen;
1128 	iulp_t		ulp_info = { 0 };
1129 	ill_t		*prev_ire_ill;
1130 	ipif_t		*ipif;
1131 	ip_stack_t	*ipst = ill->ill_ipst;
1132 
1133 	ip6h = (ip6_t *)mp->b_rptr;
1134 	if (ip6h->ip6_nxt != IPPROTO_ICMPV6)
1135 		hdr_length = ip_hdr_length_v6(mp, ip6h);
1136 	else
1137 		hdr_length = IPV6_HDR_LEN;
1138 
1139 	rd = (nd_redirect_t *)&mp->b_rptr[hdr_length];
1140 	len = mp->b_wptr - mp->b_rptr -  hdr_length;
1141 	src = &ip6h->ip6_src;
1142 	dst = &rd->nd_rd_dst;
1143 	gateway = &rd->nd_rd_target;
1144 
1145 	/* Verify if it is a valid redirect */
1146 	if (!IN6_IS_ADDR_LINKLOCAL(src) ||
1147 	    (ip6h->ip6_hops != IPV6_MAX_HOPS) ||
1148 	    (rd->nd_rd_code != 0) ||
1149 	    (len < sizeof (nd_redirect_t)) ||
1150 	    (IN6_IS_ADDR_V4MAPPED(dst)) ||
1151 	    (IN6_IS_ADDR_MULTICAST(dst))) {
1152 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInBadRedirects);
1153 		freemsg(mp);
1154 		return;
1155 	}
1156 
1157 	if (!(IN6_IS_ADDR_LINKLOCAL(gateway) ||
1158 	    IN6_ARE_ADDR_EQUAL(gateway, dst))) {
1159 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInBadRedirects);
1160 		freemsg(mp);
1161 		return;
1162 	}
1163 
1164 	if (len > sizeof (nd_redirect_t)) {
1165 		if (!ndp_verify_optlen((nd_opt_hdr_t *)&rd[1],
1166 		    len - sizeof (nd_redirect_t))) {
1167 			BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInBadRedirects);
1168 			freemsg(mp);
1169 			return;
1170 		}
1171 	}
1172 
1173 	if (!IN6_ARE_ADDR_EQUAL(gateway, dst)) {
1174 		redirect_to_router = B_TRUE;
1175 		nce_flags |= NCE_F_ISROUTER;
1176 	}
1177 
1178 	/* ipif will be refreleased afterwards */
1179 	ipif = ipif_get_next_ipif(NULL, ill);
1180 	if (ipif == NULL) {
1181 		freemsg(mp);
1182 		return;
1183 	}
1184 
1185 	/*
1186 	 * Verify that the IP source address of the redirect is
1187 	 * the same as the current first-hop router for the specified
1188 	 * ICMP destination address.
1189 	 * Also, Make sure we had a route for the dest in question and
1190 	 * that route was pointing to the old gateway (the source of the
1191 	 * redirect packet.)
1192 	 */
1193 
1194 	prev_ire = ire_route_lookup_v6(dst, 0, src, 0, ipif, NULL,
1195 	    ALL_ZONES, NULL, MATCH_IRE_GW | MATCH_IRE_ILL_GROUP |
1196 	    MATCH_IRE_DEFAULT, ipst);
1197 
1198 	/*
1199 	 * Check that
1200 	 *	the redirect was not from ourselves
1201 	 *	old gateway is still directly reachable
1202 	 */
1203 	if (prev_ire == NULL ||
1204 	    prev_ire->ire_type == IRE_LOCAL) {
1205 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInBadRedirects);
1206 		ipif_refrele(ipif);
1207 		goto fail_redirect;
1208 	}
1209 	prev_ire_ill = ire_to_ill(prev_ire);
1210 	ASSERT(prev_ire_ill != NULL);
1211 	if (prev_ire_ill->ill_flags & ILLF_NONUD)
1212 		nce_flags |= NCE_F_NONUD;
1213 
1214 	/*
1215 	 * Should we use the old ULP info to create the new gateway?  From
1216 	 * a user's perspective, we should inherit the info so that it
1217 	 * is a "smooth" transition.  If we do not do that, then new
1218 	 * connections going thru the new gateway will have no route metrics,
1219 	 * which is counter-intuitive to user.  From a network point of
1220 	 * view, this may or may not make sense even though the new gateway
1221 	 * is still directly connected to us so the route metrics should not
1222 	 * change much.
1223 	 *
1224 	 * But if the old ire_uinfo is not initialized, we do another
1225 	 * recursive lookup on the dest using the new gateway.  There may
1226 	 * be a route to that.  If so, use it to initialize the redirect
1227 	 * route.
1228 	 */
1229 	if (prev_ire->ire_uinfo.iulp_set) {
1230 		bcopy(&prev_ire->ire_uinfo, &ulp_info, sizeof (iulp_t));
1231 	} else if (redirect_to_router) {
1232 		/*
1233 		 * Only do the following if the redirection is really to
1234 		 * a router.
1235 		 */
1236 		ire_t *tmp_ire;
1237 		ire_t *sire;
1238 
1239 		tmp_ire = ire_ftable_lookup_v6(dst, 0, gateway, 0, NULL, &sire,
1240 		    ALL_ZONES, 0, NULL,
1241 		    (MATCH_IRE_RECURSIVE | MATCH_IRE_GW | MATCH_IRE_DEFAULT),
1242 		    ipst);
1243 		if (sire != NULL) {
1244 			bcopy(&sire->ire_uinfo, &ulp_info, sizeof (iulp_t));
1245 			ASSERT(tmp_ire != NULL);
1246 			ire_refrele(tmp_ire);
1247 			ire_refrele(sire);
1248 		} else if (tmp_ire != NULL) {
1249 			bcopy(&tmp_ire->ire_uinfo, &ulp_info,
1250 			    sizeof (iulp_t));
1251 			ire_refrele(tmp_ire);
1252 		}
1253 	}
1254 
1255 	optlen = mp->b_wptr - mp->b_rptr -  hdr_length - sizeof (nd_redirect_t);
1256 	opt = (nd_opt_hdr_t *)&rd[1];
1257 	opt = ndp_get_option(opt, optlen, ND_OPT_TARGET_LINKADDR);
1258 	if (opt != NULL) {
1259 		err = ndp_lookup_then_add_v6(ill,
1260 		    (uchar_t *)&opt[1],		/* Link layer address */
1261 		    gateway,
1262 		    &ipv6_all_ones,		/* prefix mask */
1263 		    &ipv6_all_zeros,		/* Mapping mask */
1264 		    0,
1265 		    nce_flags,
1266 		    ND_STALE,
1267 		    &nce);
1268 		switch (err) {
1269 		case 0:
1270 			NCE_REFRELE(nce);
1271 			break;
1272 		case EEXIST:
1273 			/*
1274 			 * Check to see if link layer address has changed and
1275 			 * process the nce_state accordingly.
1276 			 */
1277 			ndp_process(nce, (uchar_t *)&opt[1], 0, B_FALSE);
1278 			NCE_REFRELE(nce);
1279 			break;
1280 		default:
1281 			ip1dbg(("icmp_redirect_v6: NCE create failed %d\n",
1282 			    err));
1283 			ipif_refrele(ipif);
1284 			goto fail_redirect;
1285 		}
1286 	}
1287 	if (redirect_to_router) {
1288 		/* icmp_redirect_ok_v6() must  have already verified this  */
1289 		ASSERT(IN6_IS_ADDR_LINKLOCAL(gateway));
1290 
1291 		/*
1292 		 * Create a Route Association.  This will allow us to remember
1293 		 * a router told us to use the particular gateway.
1294 		 */
1295 		ire = ire_create_v6(
1296 		    dst,
1297 		    &ipv6_all_ones,		/* mask */
1298 		    &prev_ire->ire_src_addr_v6,	/* source addr */
1299 		    gateway,			/* gateway addr */
1300 		    &prev_ire->ire_max_frag,	/* max frag */
1301 		    NULL,			/* no src nce */
1302 		    NULL, 			/* no rfq */
1303 		    NULL,			/* no stq */
1304 		    IRE_HOST,
1305 		    prev_ire->ire_ipif,
1306 		    NULL,
1307 		    0,
1308 		    0,
1309 		    (RTF_DYNAMIC | RTF_GATEWAY | RTF_HOST),
1310 		    &ulp_info,
1311 		    NULL,
1312 		    NULL,
1313 		    ipst);
1314 	} else {
1315 		queue_t *stq;
1316 
1317 		stq = (ipif->ipif_net_type == IRE_IF_RESOLVER)
1318 		    ? ipif->ipif_rq : ipif->ipif_wq;
1319 
1320 		/*
1321 		 * Just create an on link entry, i.e. interface route.
1322 		 */
1323 		ire = ire_create_v6(
1324 		    dst,				/* gateway == dst */
1325 		    &ipv6_all_ones,			/* mask */
1326 		    &prev_ire->ire_src_addr_v6,		/* source addr */
1327 		    &ipv6_all_zeros,			/* gateway addr */
1328 		    &prev_ire->ire_max_frag,		/* max frag */
1329 		    NULL,				/* no src nce */
1330 		    NULL,				/* ire rfq */
1331 		    stq,				/* ire stq */
1332 		    ipif->ipif_net_type,		/* IF_[NO]RESOLVER */
1333 		    prev_ire->ire_ipif,
1334 		    &ipv6_all_ones,
1335 		    0,
1336 		    0,
1337 		    (RTF_DYNAMIC | RTF_HOST),
1338 		    &ulp_info,
1339 		    NULL,
1340 		    NULL,
1341 		    ipst);
1342 	}
1343 
1344 	/* Release reference from earlier ipif_get_next_ipif() */
1345 	ipif_refrele(ipif);
1346 
1347 	if (ire == NULL)
1348 		goto fail_redirect;
1349 
1350 	if (ire_add(&ire, NULL, NULL, NULL, B_FALSE) == 0) {
1351 
1352 		/* tell routing sockets that we received a redirect */
1353 		ip_rts_change_v6(RTM_REDIRECT,
1354 		    &rd->nd_rd_dst,
1355 		    &rd->nd_rd_target,
1356 		    &ipv6_all_ones, 0, &ire->ire_src_addr_v6,
1357 		    (RTF_DYNAMIC | RTF_GATEWAY | RTF_HOST), 0,
1358 		    (RTA_DST | RTA_GATEWAY | RTA_NETMASK | RTA_AUTHOR), ipst);
1359 
1360 		/*
1361 		 * Delete any existing IRE_HOST type ires for this destination.
1362 		 * This together with the added IRE has the effect of
1363 		 * modifying an existing redirect.
1364 		 */
1365 		redir_ire = ire_ftable_lookup_v6(dst, 0, src, IRE_HOST,
1366 		    ire->ire_ipif, NULL, ALL_ZONES, 0, NULL,
1367 		    (MATCH_IRE_GW | MATCH_IRE_TYPE | MATCH_IRE_ILL_GROUP),
1368 		    ipst);
1369 
1370 		ire_refrele(ire);		/* Held in ire_add_v6 */
1371 
1372 		if (redir_ire != NULL) {
1373 			if (redir_ire->ire_flags & RTF_DYNAMIC)
1374 				ire_delete(redir_ire);
1375 			ire_refrele(redir_ire);
1376 		}
1377 	}
1378 
1379 	if (prev_ire->ire_type == IRE_CACHE)
1380 		ire_delete(prev_ire);
1381 	ire_refrele(prev_ire);
1382 	prev_ire = NULL;
1383 
1384 fail_redirect:
1385 	if (prev_ire != NULL)
1386 		ire_refrele(prev_ire);
1387 	freemsg(mp);
1388 }
1389 
1390 static ill_t *
1391 ip_queue_to_ill_v6(queue_t *q, ip_stack_t *ipst)
1392 {
1393 	ill_t *ill;
1394 
1395 	ASSERT(WR(q) == q);
1396 
1397 	if (q->q_next != NULL) {
1398 		ill = (ill_t *)q->q_ptr;
1399 		if (ILL_CAN_LOOKUP(ill))
1400 			ill_refhold(ill);
1401 		else
1402 			ill = NULL;
1403 	} else {
1404 		ill = ill_lookup_on_name(ipif_loopback_name, B_FALSE, B_TRUE,
1405 		    NULL, NULL, NULL, NULL, NULL, ipst);
1406 	}
1407 	if (ill == NULL)
1408 		ip0dbg(("ip_queue_to_ill_v6: no ill\n"));
1409 	return (ill);
1410 }
1411 
1412 /*
1413  * Assigns an appropriate source address to the packet.
1414  * If origdst is one of our IP addresses that use it as the source.
1415  * If the queue is an ill queue then select a source from that ill.
1416  * Otherwise pick a source based on a route lookup back to the origsrc.
1417  *
1418  * src is the return parameter. Returns a pointer to src or NULL if failure.
1419  */
1420 static in6_addr_t *
1421 icmp_pick_source_v6(queue_t *wq, in6_addr_t *origsrc, in6_addr_t *origdst,
1422     in6_addr_t *src, zoneid_t zoneid, ip_stack_t *ipst)
1423 {
1424 	ill_t	*ill;
1425 	ire_t	*ire;
1426 	ipif_t	*ipif;
1427 
1428 	ASSERT(!(wq->q_flag & QREADR));
1429 	if (wq->q_next != NULL) {
1430 		ill = (ill_t *)wq->q_ptr;
1431 	} else {
1432 		ill = NULL;
1433 	}
1434 
1435 	ire = ire_route_lookup_v6(origdst, 0, 0, (IRE_LOCAL|IRE_LOOPBACK),
1436 	    NULL, NULL, zoneid, NULL, (MATCH_IRE_TYPE|MATCH_IRE_ZONEONLY),
1437 	    ipst);
1438 	if (ire != NULL) {
1439 		/* Destined to one of our addresses */
1440 		*src = *origdst;
1441 		ire_refrele(ire);
1442 		return (src);
1443 	}
1444 	if (ire != NULL) {
1445 		ire_refrele(ire);
1446 		ire = NULL;
1447 	}
1448 	if (ill == NULL) {
1449 		/* What is the route back to the original source? */
1450 		ire = ire_route_lookup_v6(origsrc, 0, 0, 0,
1451 		    NULL, NULL, zoneid, NULL,
1452 		    (MATCH_IRE_DEFAULT|MATCH_IRE_RECURSIVE), ipst);
1453 		if (ire == NULL) {
1454 			BUMP_MIB(&ipst->ips_ip6_mib, ipIfStatsOutNoRoutes);
1455 			return (NULL);
1456 		}
1457 		/*
1458 		 * Does not matter whether we use ire_stq or ire_ipif here.
1459 		 * Just pick an ill for ICMP replies.
1460 		 */
1461 		ASSERT(ire->ire_ipif != NULL);
1462 		ill = ire->ire_ipif->ipif_ill;
1463 		ire_refrele(ire);
1464 	}
1465 	ipif = ipif_select_source_v6(ill, origsrc, RESTRICT_TO_NONE,
1466 	    IPV6_PREFER_SRC_DEFAULT, zoneid);
1467 	if (ipif != NULL) {
1468 		*src = ipif->ipif_v6src_addr;
1469 		ipif_refrele(ipif);
1470 		return (src);
1471 	}
1472 	/*
1473 	 * Unusual case - can't find a usable source address to reach the
1474 	 * original source. Use what in the route to the source.
1475 	 */
1476 	ire = ire_route_lookup_v6(origsrc, 0, 0, 0,
1477 	    NULL, NULL, zoneid, NULL,
1478 	    (MATCH_IRE_DEFAULT|MATCH_IRE_RECURSIVE), ipst);
1479 	if (ire == NULL) {
1480 		BUMP_MIB(&ipst->ips_ip6_mib, ipIfStatsOutNoRoutes);
1481 		return (NULL);
1482 	}
1483 	ASSERT(ire != NULL);
1484 	*src = ire->ire_src_addr_v6;
1485 	ire_refrele(ire);
1486 	return (src);
1487 }
1488 
1489 /*
1490  * Build and ship an IPv6 ICMP message using the packet data in mp,
1491  * and the ICMP header pointed to by "stuff".  (May be called as
1492  * writer.)
1493  * Note: assumes that icmp_pkt_err_ok_v6 has been called to
1494  * verify that an icmp error packet can be sent.
1495  *
1496  * If q is an ill write side queue (which is the case when packets
1497  * arrive from ip_rput) then ip_wput code will ensure that packets to
1498  * link-local destinations are sent out that ill.
1499  *
1500  * If v6src_ptr is set use it as a source. Otherwise select a reasonable
1501  * source address (see above function).
1502  */
1503 static void
1504 icmp_pkt_v6(queue_t *q, mblk_t *mp, void *stuff, size_t len,
1505     const in6_addr_t *v6src_ptr, boolean_t mctl_present, zoneid_t zoneid,
1506     ip_stack_t *ipst)
1507 {
1508 	ip6_t		*ip6h;
1509 	in6_addr_t	v6dst;
1510 	size_t		len_needed;
1511 	size_t		msg_len;
1512 	mblk_t		*mp1;
1513 	icmp6_t		*icmp6;
1514 	ill_t		*ill;
1515 	in6_addr_t	v6src;
1516 	mblk_t *ipsec_mp;
1517 	ipsec_out_t *io;
1518 
1519 	ill = ip_queue_to_ill_v6(q, ipst);
1520 	if (ill == NULL) {
1521 		freemsg(mp);
1522 		return;
1523 	}
1524 
1525 	if (mctl_present) {
1526 		/*
1527 		 * If it is :
1528 		 *
1529 		 * 1) a IPSEC_OUT, then this is caused by outbound
1530 		 *    datagram originating on this host. IPSEC processing
1531 		 *    may or may not have been done. Refer to comments above
1532 		 *    icmp_inbound_error_fanout for details.
1533 		 *
1534 		 * 2) a IPSEC_IN if we are generating a icmp_message
1535 		 *    for an incoming datagram destined for us i.e called
1536 		 *    from ip_fanout_send_icmp.
1537 		 */
1538 		ipsec_info_t *in;
1539 
1540 		ipsec_mp = mp;
1541 		mp = ipsec_mp->b_cont;
1542 
1543 		in = (ipsec_info_t *)ipsec_mp->b_rptr;
1544 		ip6h = (ip6_t *)mp->b_rptr;
1545 
1546 		ASSERT(in->ipsec_info_type == IPSEC_OUT ||
1547 		    in->ipsec_info_type == IPSEC_IN);
1548 
1549 		if (in->ipsec_info_type == IPSEC_IN) {
1550 			/*
1551 			 * Convert the IPSEC_IN to IPSEC_OUT.
1552 			 */
1553 			if (!ipsec_in_to_out(ipsec_mp, NULL, ip6h)) {
1554 				BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
1555 				ill_refrele(ill);
1556 				return;
1557 			}
1558 		} else {
1559 			ASSERT(in->ipsec_info_type == IPSEC_OUT);
1560 			io = (ipsec_out_t *)in;
1561 			/*
1562 			 * Clear out ipsec_out_proc_begin, so we do a fresh
1563 			 * ire lookup.
1564 			 */
1565 			io->ipsec_out_proc_begin = B_FALSE;
1566 		}
1567 	} else {
1568 		/*
1569 		 * This is in clear. The icmp message we are building
1570 		 * here should go out in clear.
1571 		 */
1572 		ipsec_in_t *ii;
1573 		ASSERT(mp->b_datap->db_type == M_DATA);
1574 		ipsec_mp = ipsec_in_alloc(B_FALSE, ipst->ips_netstack);
1575 		if (ipsec_mp == NULL) {
1576 			freemsg(mp);
1577 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
1578 			ill_refrele(ill);
1579 			return;
1580 		}
1581 		ii = (ipsec_in_t *)ipsec_mp->b_rptr;
1582 
1583 		/* This is not a secure packet */
1584 		ii->ipsec_in_secure = B_FALSE;
1585 		/*
1586 		 * For trusted extensions using a shared IP address we can
1587 		 * send using any zoneid.
1588 		 */
1589 		if (zoneid == ALL_ZONES)
1590 			ii->ipsec_in_zoneid = GLOBAL_ZONEID;
1591 		else
1592 			ii->ipsec_in_zoneid = zoneid;
1593 		ipsec_mp->b_cont = mp;
1594 		ip6h = (ip6_t *)mp->b_rptr;
1595 		/*
1596 		 * Convert the IPSEC_IN to IPSEC_OUT.
1597 		 */
1598 		if (!ipsec_in_to_out(ipsec_mp, NULL, ip6h)) {
1599 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
1600 			ill_refrele(ill);
1601 			return;
1602 		}
1603 	}
1604 	io = (ipsec_out_t *)ipsec_mp->b_rptr;
1605 
1606 	if (v6src_ptr != NULL) {
1607 		v6src = *v6src_ptr;
1608 	} else {
1609 		if (icmp_pick_source_v6(q, &ip6h->ip6_src, &ip6h->ip6_dst,
1610 		    &v6src, zoneid, ipst) == NULL) {
1611 			freemsg(ipsec_mp);
1612 			ill_refrele(ill);
1613 			return;
1614 		}
1615 	}
1616 	v6dst = ip6h->ip6_src;
1617 	len_needed = ipst->ips_ipv6_icmp_return - IPV6_HDR_LEN - len;
1618 	msg_len = msgdsize(mp);
1619 	if (msg_len > len_needed) {
1620 		if (!adjmsg(mp, len_needed - msg_len)) {
1621 			BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutErrors);
1622 			freemsg(ipsec_mp);
1623 			ill_refrele(ill);
1624 			return;
1625 		}
1626 		msg_len = len_needed;
1627 	}
1628 	mp1 = allocb_cred(IPV6_HDR_LEN + len, DB_CRED(mp));
1629 	if (mp1 == NULL) {
1630 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutErrors);
1631 		freemsg(ipsec_mp);
1632 		ill_refrele(ill);
1633 		return;
1634 	}
1635 	ill_refrele(ill);
1636 	mp1->b_cont = mp;
1637 	mp = mp1;
1638 	ASSERT(ipsec_mp->b_datap->db_type == M_CTL &&
1639 	    io->ipsec_out_type == IPSEC_OUT);
1640 	ipsec_mp->b_cont = mp;
1641 
1642 	/*
1643 	 * Set ipsec_out_icmp_loopback so we can let the ICMP messages this
1644 	 * node generates be accepted in peace by all on-host destinations.
1645 	 * If we do NOT assume that all on-host destinations trust
1646 	 * self-generated ICMP messages, then rework here, ip.c, and spd.c.
1647 	 * (Look for ipsec_out_icmp_loopback).
1648 	 */
1649 	io->ipsec_out_icmp_loopback = B_TRUE;
1650 
1651 	ip6h = (ip6_t *)mp->b_rptr;
1652 	mp1->b_wptr = (uchar_t *)ip6h + (IPV6_HDR_LEN + len);
1653 
1654 	ip6h->ip6_vcf = IPV6_DEFAULT_VERS_AND_FLOW;
1655 	ip6h->ip6_nxt = IPPROTO_ICMPV6;
1656 	ip6h->ip6_hops = ipst->ips_ipv6_def_hops;
1657 	ip6h->ip6_dst = v6dst;
1658 	ip6h->ip6_src = v6src;
1659 	msg_len += IPV6_HDR_LEN + len;
1660 	if (msg_len > IP_MAXPACKET + IPV6_HDR_LEN) {
1661 		(void) adjmsg(mp, IP_MAXPACKET + IPV6_HDR_LEN - msg_len);
1662 		msg_len = IP_MAXPACKET + IPV6_HDR_LEN;
1663 	}
1664 	ip6h->ip6_plen = htons((uint16_t)(msgdsize(mp) - IPV6_HDR_LEN));
1665 	icmp6 = (icmp6_t *)&ip6h[1];
1666 	bcopy(stuff, (char *)icmp6, len);
1667 	/*
1668 	 * Prepare for checksum by putting icmp length in the icmp
1669 	 * checksum field. The checksum is calculated in ip_wput_v6.
1670 	 */
1671 	icmp6->icmp6_cksum = ip6h->ip6_plen;
1672 	if (icmp6->icmp6_type == ND_REDIRECT) {
1673 		ip6h->ip6_hops = IPV6_MAX_HOPS;
1674 	}
1675 	/* Send to V6 writeside put routine */
1676 	put(q, ipsec_mp);
1677 }
1678 
1679 /*
1680  * Update the output mib when ICMPv6 packets are sent.
1681  */
1682 static void
1683 icmp_update_out_mib_v6(ill_t *ill, icmp6_t *icmp6)
1684 {
1685 	BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutMsgs);
1686 
1687 	switch (icmp6->icmp6_type) {
1688 	case ICMP6_DST_UNREACH:
1689 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutDestUnreachs);
1690 		if (icmp6->icmp6_code == ICMP6_DST_UNREACH_ADMIN)
1691 			BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutAdminProhibs);
1692 		break;
1693 
1694 	case ICMP6_TIME_EXCEEDED:
1695 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutTimeExcds);
1696 		break;
1697 
1698 	case ICMP6_PARAM_PROB:
1699 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutParmProblems);
1700 		break;
1701 
1702 	case ICMP6_PACKET_TOO_BIG:
1703 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutPktTooBigs);
1704 		break;
1705 
1706 	case ICMP6_ECHO_REQUEST:
1707 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutEchos);
1708 		break;
1709 
1710 	case ICMP6_ECHO_REPLY:
1711 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutEchoReplies);
1712 		break;
1713 
1714 	case ND_ROUTER_SOLICIT:
1715 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutRouterSolicits);
1716 		break;
1717 
1718 	case ND_ROUTER_ADVERT:
1719 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutRouterAdvertisements);
1720 		break;
1721 
1722 	case ND_NEIGHBOR_SOLICIT:
1723 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutNeighborSolicits);
1724 		break;
1725 
1726 	case ND_NEIGHBOR_ADVERT:
1727 		BUMP_MIB(ill->ill_icmp6_mib,
1728 		    ipv6IfIcmpOutNeighborAdvertisements);
1729 		break;
1730 
1731 	case ND_REDIRECT:
1732 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutRedirects);
1733 		break;
1734 
1735 	case MLD_LISTENER_QUERY:
1736 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutGroupMembQueries);
1737 		break;
1738 
1739 	case MLD_LISTENER_REPORT:
1740 	case MLD_V2_LISTENER_REPORT:
1741 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutGroupMembResponses);
1742 		break;
1743 
1744 	case MLD_LISTENER_REDUCTION:
1745 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutGroupMembReductions);
1746 		break;
1747 	}
1748 }
1749 
1750 /*
1751  * Check if it is ok to send an ICMPv6 error packet in
1752  * response to the IP packet in mp.
1753  * Free the message and return null if no
1754  * ICMP error packet should be sent.
1755  */
1756 static mblk_t *
1757 icmp_pkt_err_ok_v6(queue_t *q, mblk_t *mp,
1758     boolean_t llbcast, boolean_t mcast_ok, ip_stack_t *ipst)
1759 {
1760 	ip6_t	*ip6h;
1761 
1762 	if (!mp)
1763 		return (NULL);
1764 
1765 	ip6h = (ip6_t *)mp->b_rptr;
1766 
1767 	/* Check if source address uniquely identifies the host */
1768 
1769 	if (IN6_IS_ADDR_MULTICAST(&ip6h->ip6_src) ||
1770 	    IN6_IS_ADDR_V4MAPPED(&ip6h->ip6_src) ||
1771 	    IN6_IS_ADDR_UNSPECIFIED(&ip6h->ip6_src)) {
1772 		freemsg(mp);
1773 		return (NULL);
1774 	}
1775 
1776 	if (ip6h->ip6_nxt == IPPROTO_ICMPV6) {
1777 		size_t	len_needed = IPV6_HDR_LEN + ICMP6_MINLEN;
1778 		icmp6_t		*icmp6;
1779 
1780 		if (mp->b_wptr - mp->b_rptr < len_needed) {
1781 			if (!pullupmsg(mp, len_needed)) {
1782 				ill_t	*ill;
1783 
1784 				ill = ip_queue_to_ill_v6(q, ipst);
1785 				if (ill == NULL) {
1786 					BUMP_MIB(&ipst->ips_icmp6_mib,
1787 					    ipv6IfIcmpInErrors);
1788 				} else {
1789 					BUMP_MIB(ill->ill_icmp6_mib,
1790 					    ipv6IfIcmpInErrors);
1791 					ill_refrele(ill);
1792 				}
1793 				freemsg(mp);
1794 				return (NULL);
1795 			}
1796 			ip6h = (ip6_t *)mp->b_rptr;
1797 		}
1798 		icmp6 = (icmp6_t *)&ip6h[1];
1799 		/* Explicitly do not generate errors in response to redirects */
1800 		if (ICMP6_IS_ERROR(icmp6->icmp6_type) ||
1801 		    icmp6->icmp6_type == ND_REDIRECT) {
1802 			freemsg(mp);
1803 			return (NULL);
1804 		}
1805 	}
1806 	/*
1807 	 * Check that the destination is not multicast and that the packet
1808 	 * was not sent on link layer broadcast or multicast.  (Exception
1809 	 * is Packet too big message as per the draft - when mcast_ok is set.)
1810 	 */
1811 	if (!mcast_ok &&
1812 	    (llbcast || IN6_IS_ADDR_MULTICAST(&ip6h->ip6_dst))) {
1813 		freemsg(mp);
1814 		return (NULL);
1815 	}
1816 	if (icmp_err_rate_limit(ipst)) {
1817 		/*
1818 		 * Only send ICMP error packets every so often.
1819 		 * This should be done on a per port/source basis,
1820 		 * but for now this will suffice.
1821 		 */
1822 		freemsg(mp);
1823 		return (NULL);
1824 	}
1825 	return (mp);
1826 }
1827 
1828 /*
1829  * Generate an ICMPv6 redirect message.
1830  * Include target link layer address option if it exits.
1831  * Always include redirect header.
1832  */
1833 static void
1834 icmp_send_redirect_v6(queue_t *q, mblk_t *mp, in6_addr_t *targetp,
1835     in6_addr_t *dest, ill_t *ill, boolean_t llbcast)
1836 {
1837 	nd_redirect_t	*rd;
1838 	nd_opt_rd_hdr_t	*rdh;
1839 	uchar_t		*buf;
1840 	nce_t		*nce = NULL;
1841 	nd_opt_hdr_t	*opt;
1842 	int		len;
1843 	int		ll_opt_len = 0;
1844 	int		max_redir_hdr_data_len;
1845 	int		pkt_len;
1846 	in6_addr_t	*srcp;
1847 	ip_stack_t	*ipst = ill->ill_ipst;
1848 
1849 	/*
1850 	 * We are called from ip_rput where we could
1851 	 * not have attached an IPSEC_IN.
1852 	 */
1853 	ASSERT(mp->b_datap->db_type == M_DATA);
1854 
1855 	mp = icmp_pkt_err_ok_v6(q, mp, llbcast, B_FALSE, ipst);
1856 	if (mp == NULL)
1857 		return;
1858 	nce = ndp_lookup_v6(ill, targetp, B_FALSE);
1859 	if (nce != NULL && nce->nce_state != ND_INCOMPLETE) {
1860 		ll_opt_len = (sizeof (nd_opt_hdr_t) +
1861 		    ill->ill_phys_addr_length + 7)/8 * 8;
1862 	}
1863 	len = sizeof (nd_redirect_t) + sizeof (nd_opt_rd_hdr_t) + ll_opt_len;
1864 	ASSERT(len % 4 == 0);
1865 	buf = kmem_alloc(len, KM_NOSLEEP);
1866 	if (buf == NULL) {
1867 		if (nce != NULL)
1868 			NCE_REFRELE(nce);
1869 		freemsg(mp);
1870 		return;
1871 	}
1872 
1873 	rd = (nd_redirect_t *)buf;
1874 	rd->nd_rd_type = (uint8_t)ND_REDIRECT;
1875 	rd->nd_rd_code = 0;
1876 	rd->nd_rd_reserved = 0;
1877 	rd->nd_rd_target = *targetp;
1878 	rd->nd_rd_dst = *dest;
1879 
1880 	opt = (nd_opt_hdr_t *)(buf + sizeof (nd_redirect_t));
1881 	if (nce != NULL && ll_opt_len != 0) {
1882 		opt->nd_opt_type = ND_OPT_TARGET_LINKADDR;
1883 		opt->nd_opt_len = ll_opt_len/8;
1884 		bcopy((char *)nce->nce_res_mp->b_rptr +
1885 		    NCE_LL_ADDR_OFFSET(ill), &opt[1],
1886 		    ill->ill_phys_addr_length);
1887 	}
1888 	if (nce != NULL)
1889 		NCE_REFRELE(nce);
1890 	rdh = (nd_opt_rd_hdr_t *)(buf + sizeof (nd_redirect_t) + ll_opt_len);
1891 	rdh->nd_opt_rh_type = (uint8_t)ND_OPT_REDIRECTED_HEADER;
1892 	/* max_redir_hdr_data_len and nd_opt_rh_len must be multiple of 8 */
1893 	max_redir_hdr_data_len =
1894 	    (ipst->ips_ipv6_icmp_return - IPV6_HDR_LEN - len)/8*8;
1895 	pkt_len = msgdsize(mp);
1896 	/* Make sure mp is 8 byte aligned */
1897 	if (pkt_len > max_redir_hdr_data_len) {
1898 		rdh->nd_opt_rh_len = (max_redir_hdr_data_len +
1899 		    sizeof (nd_opt_rd_hdr_t))/8;
1900 		(void) adjmsg(mp, max_redir_hdr_data_len - pkt_len);
1901 	} else {
1902 		rdh->nd_opt_rh_len = (pkt_len + sizeof (nd_opt_rd_hdr_t))/8;
1903 		(void) adjmsg(mp, -(pkt_len % 8));
1904 	}
1905 	rdh->nd_opt_rh_reserved1 = 0;
1906 	rdh->nd_opt_rh_reserved2 = 0;
1907 	/* ipif_v6src_addr contains the link-local source address */
1908 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
1909 	if (ill->ill_group != NULL) {
1910 		/*
1911 		 * The receiver of the redirect will verify whether it
1912 		 * had a route through us (srcp that we will use in
1913 		 * the redirect) or not. As we load spread even link-locals,
1914 		 * we don't know which source address the receiver of
1915 		 * redirect has in its route for communicating with us.
1916 		 * Thus we randomly choose a source here and finally we
1917 		 * should get to the right one and it will eventually
1918 		 * accept the redirect from us. We can't call
1919 		 * ip_lookup_scope_v6 because we don't have the right
1920 		 * link-local address here. Thus we randomly choose one.
1921 		 */
1922 		int cnt = ill->ill_group->illgrp_ill_count;
1923 
1924 		ill = ill->ill_group->illgrp_ill;
1925 		cnt = ++ipst->ips_icmp_redirect_v6_src_index % cnt;
1926 		while (cnt--)
1927 			ill = ill->ill_group_next;
1928 		srcp = &ill->ill_ipif->ipif_v6src_addr;
1929 	} else {
1930 		srcp = &ill->ill_ipif->ipif_v6src_addr;
1931 	}
1932 	rw_exit(&ipst->ips_ill_g_lock);
1933 	/* Redirects sent by router, and router is global zone */
1934 	icmp_pkt_v6(q, mp, buf, len, srcp, B_FALSE, GLOBAL_ZONEID, ipst);
1935 	kmem_free(buf, len);
1936 }
1937 
1938 
1939 /* Generate an ICMP time exceeded message.  (May be called as writer.) */
1940 void
1941 icmp_time_exceeded_v6(queue_t *q, mblk_t *mp, uint8_t code,
1942     boolean_t llbcast, boolean_t mcast_ok, zoneid_t zoneid,
1943     ip_stack_t *ipst)
1944 {
1945 	icmp6_t	icmp6;
1946 	boolean_t mctl_present;
1947 	mblk_t *first_mp;
1948 
1949 	EXTRACT_PKT_MP(mp, first_mp, mctl_present);
1950 
1951 	mp = icmp_pkt_err_ok_v6(q, mp, llbcast, mcast_ok, ipst);
1952 	if (mp == NULL) {
1953 		if (mctl_present)
1954 			freeb(first_mp);
1955 		return;
1956 	}
1957 	bzero(&icmp6, sizeof (icmp6_t));
1958 	icmp6.icmp6_type = ICMP6_TIME_EXCEEDED;
1959 	icmp6.icmp6_code = code;
1960 	icmp_pkt_v6(q, first_mp, &icmp6, sizeof (icmp6_t), NULL, mctl_present,
1961 	    zoneid, ipst);
1962 }
1963 
1964 /*
1965  * Generate an ICMP unreachable message.
1966  */
1967 void
1968 icmp_unreachable_v6(queue_t *q, mblk_t *mp, uint8_t code,
1969     boolean_t llbcast, boolean_t mcast_ok, zoneid_t zoneid,
1970     ip_stack_t *ipst)
1971 {
1972 	icmp6_t	icmp6;
1973 	boolean_t mctl_present;
1974 	mblk_t *first_mp;
1975 
1976 	EXTRACT_PKT_MP(mp, first_mp, mctl_present);
1977 
1978 	mp = icmp_pkt_err_ok_v6(q, mp, llbcast, mcast_ok, ipst);
1979 	if (mp == NULL) {
1980 		if (mctl_present)
1981 			freeb(first_mp);
1982 		return;
1983 	}
1984 	bzero(&icmp6, sizeof (icmp6_t));
1985 	icmp6.icmp6_type = ICMP6_DST_UNREACH;
1986 	icmp6.icmp6_code = code;
1987 	icmp_pkt_v6(q, first_mp, &icmp6, sizeof (icmp6_t), NULL, mctl_present,
1988 	    zoneid, ipst);
1989 }
1990 
1991 /*
1992  * Generate an ICMP pkt too big message.
1993  */
1994 static void
1995 icmp_pkt2big_v6(queue_t *q, mblk_t *mp, uint32_t mtu,
1996     boolean_t llbcast, boolean_t mcast_ok, zoneid_t zoneid, ip_stack_t *ipst)
1997 {
1998 	icmp6_t	icmp6;
1999 	mblk_t *first_mp;
2000 	boolean_t mctl_present;
2001 
2002 	EXTRACT_PKT_MP(mp, first_mp, mctl_present);
2003 
2004 	mp = icmp_pkt_err_ok_v6(q, mp, llbcast, mcast_ok,  ipst);
2005 	if (mp == NULL) {
2006 		if (mctl_present)
2007 			freeb(first_mp);
2008 		return;
2009 	}
2010 	bzero(&icmp6, sizeof (icmp6_t));
2011 	icmp6.icmp6_type = ICMP6_PACKET_TOO_BIG;
2012 	icmp6.icmp6_code = 0;
2013 	icmp6.icmp6_mtu = htonl(mtu);
2014 
2015 	icmp_pkt_v6(q, first_mp, &icmp6, sizeof (icmp6_t), NULL, mctl_present,
2016 	    zoneid, ipst);
2017 }
2018 
2019 /*
2020  * Generate an ICMP parameter problem message. (May be called as writer.)
2021  * 'offset' is the offset from the beginning of the packet in error.
2022  */
2023 static void
2024 icmp_param_problem_v6(queue_t *q, mblk_t *mp, uint8_t code,
2025     uint32_t offset, boolean_t llbcast, boolean_t mcast_ok, zoneid_t zoneid,
2026     ip_stack_t *ipst)
2027 {
2028 	icmp6_t	icmp6;
2029 	boolean_t mctl_present;
2030 	mblk_t *first_mp;
2031 
2032 	EXTRACT_PKT_MP(mp, first_mp, mctl_present);
2033 
2034 	mp = icmp_pkt_err_ok_v6(q, mp, llbcast, mcast_ok, ipst);
2035 	if (mp == NULL) {
2036 		if (mctl_present)
2037 			freeb(first_mp);
2038 		return;
2039 	}
2040 	bzero((char *)&icmp6, sizeof (icmp6_t));
2041 	icmp6.icmp6_type = ICMP6_PARAM_PROB;
2042 	icmp6.icmp6_code = code;
2043 	icmp6.icmp6_pptr = htonl(offset);
2044 	icmp_pkt_v6(q, first_mp, &icmp6, sizeof (icmp6_t), NULL, mctl_present,
2045 	    zoneid, ipst);
2046 }
2047 
2048 /*
2049  * This code will need to take into account the possibility of binding
2050  * to a link local address on a multi-homed host, in which case the
2051  * outgoing interface (from the conn) will need to be used when getting
2052  * an ire for the dst. Going through proper outgoing interface and
2053  * choosing the source address corresponding to the outgoing interface
2054  * is necessary when the destination address is a link-local address and
2055  * IPV6_BOUND_IF or IPV6_PKTINFO or scope_id has been set.
2056  * This can happen when active connection is setup; thus ipp pointer
2057  * is passed here from tcp_connect_*() routines, in non-TCP cases NULL
2058  * pointer is passed as ipp pointer.
2059  */
2060 mblk_t *
2061 ip_bind_v6(queue_t *q, mblk_t *mp, conn_t *connp, ip6_pkt_t *ipp)
2062 {
2063 	ssize_t			len;
2064 	int			protocol;
2065 	struct T_bind_req	*tbr;
2066 	sin6_t			*sin6;
2067 	ipa6_conn_t		*ac6;
2068 	in6_addr_t		*v6srcp;
2069 	in6_addr_t		*v6dstp;
2070 	uint16_t		lport;
2071 	uint16_t		fport;
2072 	uchar_t			*ucp;
2073 	mblk_t			*mp1;
2074 	boolean_t		ire_requested;
2075 	boolean_t		ipsec_policy_set;
2076 	int			error = 0;
2077 	boolean_t		local_bind;
2078 	boolean_t		orig_pkt_isv6 = connp->conn_pkt_isv6;
2079 	ipa6_conn_x_t		*acx6;
2080 	boolean_t		verify_dst;
2081 	ip_stack_t		*ipst = connp->conn_netstack->netstack_ip;
2082 
2083 	ASSERT(connp->conn_af_isv6);
2084 	len = mp->b_wptr - mp->b_rptr;
2085 	if (len < (sizeof (*tbr) + 1)) {
2086 		(void) mi_strlog(q, 1, SL_ERROR|SL_TRACE,
2087 		    "ip_bind_v6: bogus msg, len %ld", len);
2088 		goto bad_addr;
2089 	}
2090 	/* Back up and extract the protocol identifier. */
2091 	mp->b_wptr--;
2092 	tbr = (struct T_bind_req *)mp->b_rptr;
2093 	/* Reset the message type in preparation for shipping it back. */
2094 	mp->b_datap->db_type = M_PCPROTO;
2095 
2096 	protocol = *mp->b_wptr & 0xFF;
2097 	connp->conn_ulp = (uint8_t)protocol;
2098 
2099 	/*
2100 	 * Check for a zero length address.  This is from a protocol that
2101 	 * wants to register to receive all packets of its type.
2102 	 */
2103 	if (tbr->ADDR_length == 0) {
2104 		if ((protocol == IPPROTO_TCP || protocol == IPPROTO_SCTP ||
2105 		    protocol == IPPROTO_ESP || protocol == IPPROTO_AH) &&
2106 		    ipst->ips_ipcl_proto_fanout_v6[protocol].connf_head !=
2107 		    NULL) {
2108 			/*
2109 			 * TCP, SCTP, AH, and ESP have single protocol fanouts.
2110 			 * Do not allow others to bind to these.
2111 			 */
2112 			goto bad_addr;
2113 		}
2114 
2115 		/*
2116 		 *
2117 		 * The udp module never sends down a zero-length address,
2118 		 * and allowing this on a labeled system will break MLP
2119 		 * functionality.
2120 		 */
2121 		if (is_system_labeled() && protocol == IPPROTO_UDP)
2122 			goto bad_addr;
2123 
2124 		/* Allow ipsec plumbing */
2125 		if (connp->conn_mac_exempt && protocol != IPPROTO_AH &&
2126 		    protocol != IPPROTO_ESP)
2127 			goto bad_addr;
2128 
2129 		connp->conn_srcv6 = ipv6_all_zeros;
2130 		ipcl_proto_insert_v6(connp, protocol);
2131 
2132 		tbr->PRIM_type = T_BIND_ACK;
2133 		return (mp);
2134 	}
2135 
2136 	/* Extract the address pointer from the message. */
2137 	ucp = (uchar_t *)mi_offset_param(mp, tbr->ADDR_offset,
2138 	    tbr->ADDR_length);
2139 	if (ucp == NULL) {
2140 		ip1dbg(("ip_bind_v6: no address\n"));
2141 		goto bad_addr;
2142 	}
2143 	if (!OK_32PTR(ucp)) {
2144 		ip1dbg(("ip_bind_v6: unaligned address\n"));
2145 		goto bad_addr;
2146 	}
2147 	mp1 = mp->b_cont;	/* trailing mp if any */
2148 	ire_requested = (mp1 && mp1->b_datap->db_type == IRE_DB_REQ_TYPE);
2149 	ipsec_policy_set = (mp1 && mp1->b_datap->db_type == IPSEC_POLICY_SET);
2150 
2151 	switch (tbr->ADDR_length) {
2152 	default:
2153 		ip1dbg(("ip_bind_v6: bad address length %d\n",
2154 		    (int)tbr->ADDR_length));
2155 		goto bad_addr;
2156 
2157 	case IPV6_ADDR_LEN:
2158 		/* Verification of local address only */
2159 		v6srcp = (in6_addr_t *)ucp;
2160 		lport = 0;
2161 		local_bind = B_TRUE;
2162 		break;
2163 
2164 	case sizeof (sin6_t):
2165 		sin6 = (sin6_t *)ucp;
2166 		v6srcp = &sin6->sin6_addr;
2167 		lport = sin6->sin6_port;
2168 		local_bind = B_TRUE;
2169 		break;
2170 
2171 	case sizeof (ipa6_conn_t):
2172 		/*
2173 		 * Verify that both the source and destination addresses
2174 		 * are valid.
2175 		 * Note that we allow connect to broadcast and multicast
2176 		 * addresses when ire_requested is set. Thus the ULP
2177 		 * has to check for IRE_BROADCAST and multicast.
2178 		 */
2179 		ac6 = (ipa6_conn_t *)ucp;
2180 		v6srcp = &ac6->ac6_laddr;
2181 		v6dstp = &ac6->ac6_faddr;
2182 		fport = ac6->ac6_fport;
2183 		/* For raw socket, the local port is not set. */
2184 		lport = ac6->ac6_lport != 0 ? ac6->ac6_lport :
2185 		    connp->conn_lport;
2186 		local_bind = B_FALSE;
2187 		/* Always verify destination reachability. */
2188 		verify_dst = B_TRUE;
2189 		break;
2190 
2191 	case sizeof (ipa6_conn_x_t):
2192 		/*
2193 		 * Verify that the source address is valid.
2194 		 * Note that we allow connect to broadcast and multicast
2195 		 * addresses when ire_requested is set. Thus the ULP
2196 		 * has to check for IRE_BROADCAST and multicast.
2197 		 */
2198 		acx6 = (ipa6_conn_x_t *)ucp;
2199 		ac6 = &acx6->ac6x_conn;
2200 		v6srcp = &ac6->ac6_laddr;
2201 		v6dstp = &ac6->ac6_faddr;
2202 		fport = ac6->ac6_fport;
2203 		lport = ac6->ac6_lport;
2204 		local_bind = B_FALSE;
2205 		/*
2206 		 * Client that passed ipa6_conn_x_t to us specifies whether to
2207 		 * verify destination reachability.
2208 		 */
2209 		verify_dst = (acx6->ac6x_flags & ACX_VERIFY_DST) != 0;
2210 		break;
2211 	}
2212 	if (local_bind) {
2213 		if (IN6_IS_ADDR_V4MAPPED(v6srcp) && !connp->conn_ipv6_v6only) {
2214 			/* Bind to IPv4 address */
2215 			ipaddr_t v4src;
2216 
2217 			IN6_V4MAPPED_TO_IPADDR(v6srcp, v4src);
2218 
2219 			error = ip_bind_laddr(connp, mp, v4src, lport,
2220 			    ire_requested, ipsec_policy_set,
2221 			    tbr->ADDR_length != IPV6_ADDR_LEN);
2222 			if (error != 0)
2223 				goto bad_addr;
2224 			connp->conn_pkt_isv6 = B_FALSE;
2225 		} else {
2226 			if (IN6_IS_ADDR_V4MAPPED(v6srcp)) {
2227 				error = 0;
2228 				goto bad_addr;
2229 			}
2230 			error = ip_bind_laddr_v6(connp, mp, v6srcp, lport,
2231 			    ire_requested, ipsec_policy_set,
2232 			    (tbr->ADDR_length != IPV6_ADDR_LEN));
2233 			if (error != 0)
2234 				goto bad_addr;
2235 			connp->conn_pkt_isv6 = B_TRUE;
2236 		}
2237 	} else {
2238 		/*
2239 		 * Bind to local and remote address. Local might be
2240 		 * unspecified in which case it will be extracted from
2241 		 * ire_src_addr_v6
2242 		 */
2243 		if (IN6_IS_ADDR_V4MAPPED(v6dstp) && !connp->conn_ipv6_v6only) {
2244 			/* Connect to IPv4 address */
2245 			ipaddr_t v4src;
2246 			ipaddr_t v4dst;
2247 
2248 			/* Is the source unspecified or mapped? */
2249 			if (!IN6_IS_ADDR_V4MAPPED(v6srcp) &&
2250 			    !IN6_IS_ADDR_UNSPECIFIED(v6srcp)) {
2251 				ip1dbg(("ip_bind_v6: "
2252 				    "dst is mapped, but not the src\n"));
2253 				goto bad_addr;
2254 			}
2255 			IN6_V4MAPPED_TO_IPADDR(v6srcp, v4src);
2256 			IN6_V4MAPPED_TO_IPADDR(v6dstp, v4dst);
2257 
2258 			/*
2259 			 * XXX Fix needed. Need to pass ipsec_policy_set
2260 			 * instead of B_FALSE.
2261 			 */
2262 
2263 			/* Always verify destination reachability. */
2264 			error = ip_bind_connected(connp, mp, &v4src, lport,
2265 			    v4dst, fport, ire_requested, ipsec_policy_set,
2266 			    B_TRUE, B_TRUE);
2267 			if (error != 0)
2268 				goto bad_addr;
2269 			IN6_IPADDR_TO_V4MAPPED(v4src, v6srcp);
2270 			connp->conn_pkt_isv6 = B_FALSE;
2271 		} else if (IN6_IS_ADDR_V4MAPPED(v6srcp)) {
2272 			ip1dbg(("ip_bind_v6: "
2273 			    "src is mapped, but not the dst\n"));
2274 			goto bad_addr;
2275 		} else {
2276 			error = ip_bind_connected_v6(connp, mp, v6srcp,
2277 			    lport, v6dstp, ipp, fport, ire_requested,
2278 			    ipsec_policy_set, B_TRUE, verify_dst);
2279 			if (error != 0)
2280 				goto bad_addr;
2281 			connp->conn_pkt_isv6 = B_TRUE;
2282 		}
2283 	}
2284 
2285 	/* Update conn_send and pktversion if v4/v6 changed */
2286 	if (orig_pkt_isv6 != connp->conn_pkt_isv6) {
2287 		ip_setpktversion(connp, connp->conn_pkt_isv6, B_TRUE, ipst);
2288 	}
2289 	/*
2290 	 * Pass the IPSEC headers size in ire_ipsec_overhead.
2291 	 * We can't do this in ip_bind_insert_ire because the policy
2292 	 * may not have been inherited at that point in time and hence
2293 	 * conn_out_enforce_policy may not be set.
2294 	 */
2295 	mp1 = mp->b_cont;
2296 	if (ire_requested && connp->conn_out_enforce_policy &&
2297 	    mp1 != NULL && DB_TYPE(mp1) == IRE_DB_REQ_TYPE) {
2298 		ire_t *ire = (ire_t *)mp1->b_rptr;
2299 		ASSERT(MBLKL(mp1) >= sizeof (ire_t));
2300 		ire->ire_ipsec_overhead = (conn_ipsec_length(connp));
2301 	}
2302 
2303 	/* Send it home. */
2304 	mp->b_datap->db_type = M_PCPROTO;
2305 	tbr->PRIM_type = T_BIND_ACK;
2306 	return (mp);
2307 
2308 bad_addr:
2309 	if (error == EINPROGRESS)
2310 		return (NULL);
2311 	if (error > 0)
2312 		mp = mi_tpi_err_ack_alloc(mp, TSYSERR, error);
2313 	else
2314 		mp = mi_tpi_err_ack_alloc(mp, TBADADDR, 0);
2315 	return (mp);
2316 }
2317 
2318 /*
2319  * Here address is verified to be a valid local address.
2320  * If the IRE_DB_REQ_TYPE mp is present, a multicast
2321  * address is also considered a valid local address.
2322  * In the case of a multicast address, however, the
2323  * upper protocol is expected to reset the src address
2324  * to 0 if it sees an ire with IN6_IS_ADDR_MULTICAST returned so that
2325  * no packets are emitted with multicast address as
2326  * source address.
2327  * The addresses valid for bind are:
2328  *	(1) - in6addr_any
2329  *	(2) - IP address of an UP interface
2330  *	(3) - IP address of a DOWN interface
2331  *	(4) - a multicast address. In this case
2332  *	the conn will only receive packets destined to
2333  *	the specified multicast address. Note: the
2334  *	application still has to issue an
2335  *	IPV6_JOIN_GROUP socket option.
2336  *
2337  * In all the above cases, the bound address must be valid in the current zone.
2338  * When the address is loopback or multicast, there might be many matching IREs
2339  * so bind has to look up based on the zone.
2340  */
2341 static int
2342 ip_bind_laddr_v6(conn_t *connp, mblk_t *mp, const in6_addr_t *v6src,
2343     uint16_t lport, boolean_t ire_requested, boolean_t ipsec_policy_set,
2344     boolean_t fanout_insert)
2345 {
2346 	int		error = 0;
2347 	ire_t		*src_ire = NULL;
2348 	ipif_t		*ipif = NULL;
2349 	mblk_t		*policy_mp;
2350 	zoneid_t	zoneid;
2351 	ip_stack_t	*ipst = connp->conn_netstack->netstack_ip;
2352 
2353 	if (ipsec_policy_set)
2354 		policy_mp = mp->b_cont;
2355 
2356 	/*
2357 	 * If it was previously connected, conn_fully_bound would have
2358 	 * been set.
2359 	 */
2360 	connp->conn_fully_bound = B_FALSE;
2361 
2362 	zoneid = connp->conn_zoneid;
2363 
2364 	if (!IN6_IS_ADDR_UNSPECIFIED(v6src)) {
2365 		src_ire = ire_route_lookup_v6(v6src, 0, 0,
2366 		    0, NULL, NULL, zoneid, NULL, MATCH_IRE_ZONEONLY, ipst);
2367 		/*
2368 		 * If an address other than in6addr_any is requested,
2369 		 * we verify that it is a valid address for bind
2370 		 * Note: Following code is in if-else-if form for
2371 		 * readability compared to a condition check.
2372 		 */
2373 		ASSERT(src_ire == NULL || !(src_ire->ire_type & IRE_BROADCAST));
2374 		if (IRE_IS_LOCAL(src_ire)) {
2375 			/*
2376 			 * (2) Bind to address of local UP interface
2377 			 */
2378 			ipif = src_ire->ire_ipif;
2379 		} else if (IN6_IS_ADDR_MULTICAST(v6src)) {
2380 			ipif_t	*multi_ipif = NULL;
2381 			ire_t	*save_ire;
2382 			/*
2383 			 * (4) bind to multicast address.
2384 			 * Fake out the IRE returned to upper
2385 			 * layer to be a broadcast IRE in
2386 			 * ip_bind_insert_ire_v6().
2387 			 * Pass other information that matches
2388 			 * the ipif (e.g. the source address).
2389 			 * conn_multicast_ill is only used for
2390 			 * IPv6 packets
2391 			 */
2392 			mutex_enter(&connp->conn_lock);
2393 			if (connp->conn_multicast_ill != NULL) {
2394 				(void) ipif_lookup_zoneid(
2395 				    connp->conn_multicast_ill, zoneid, 0,
2396 				    &multi_ipif);
2397 			} else {
2398 				/*
2399 				 * Look for default like
2400 				 * ip_wput_v6
2401 				 */
2402 				multi_ipif = ipif_lookup_group_v6(
2403 				    &ipv6_unspecified_group, zoneid, ipst);
2404 			}
2405 			mutex_exit(&connp->conn_lock);
2406 			save_ire = src_ire;
2407 			src_ire = NULL;
2408 			if (multi_ipif == NULL || !ire_requested ||
2409 			    (src_ire = ipif_to_ire_v6(multi_ipif)) == NULL) {
2410 				src_ire = save_ire;
2411 				error = EADDRNOTAVAIL;
2412 			} else {
2413 				ASSERT(src_ire != NULL);
2414 				if (save_ire != NULL)
2415 					ire_refrele(save_ire);
2416 			}
2417 			if (multi_ipif != NULL)
2418 				ipif_refrele(multi_ipif);
2419 		} else {
2420 			*mp->b_wptr++ = (char)connp->conn_ulp;
2421 			ipif = ipif_lookup_addr_v6(v6src, NULL, zoneid,
2422 			    CONNP_TO_WQ(connp), mp, ip_wput_nondata, &error,
2423 			    ipst);
2424 			if (ipif == NULL) {
2425 				if (error == EINPROGRESS) {
2426 					if (src_ire != NULL)
2427 						ire_refrele(src_ire);
2428 					return (error);
2429 				}
2430 				/*
2431 				 * Not a valid address for bind
2432 				 */
2433 				error = EADDRNOTAVAIL;
2434 			} else {
2435 				ipif_refrele(ipif);
2436 			}
2437 			/*
2438 			 * Just to keep it consistent with the processing in
2439 			 * ip_bind_v6().
2440 			 */
2441 			mp->b_wptr--;
2442 		}
2443 
2444 		if (error != 0) {
2445 			/* Red Alert!  Attempting to be a bogon! */
2446 			if (ip_debug > 2) {
2447 				/* ip1dbg */
2448 				pr_addr_dbg("ip_bind_laddr_v6: bad src"
2449 				    " address %s\n", AF_INET6, v6src);
2450 			}
2451 			goto bad_addr;
2452 		}
2453 	}
2454 
2455 	/*
2456 	 * Allow setting new policies. For example, disconnects come
2457 	 * down as ipa_t bind. As we would have set conn_policy_cached
2458 	 * to B_TRUE before, we should set it to B_FALSE, so that policy
2459 	 * can change after the disconnect.
2460 	 */
2461 	connp->conn_policy_cached = B_FALSE;
2462 
2463 	/* If not fanout_insert this was just an address verification */
2464 	if (fanout_insert) {
2465 		/*
2466 		 * The addresses have been verified. Time to insert in
2467 		 * the correct fanout list.
2468 		 */
2469 		connp->conn_srcv6 = *v6src;
2470 		connp->conn_remv6 = ipv6_all_zeros;
2471 		connp->conn_lport = lport;
2472 		connp->conn_fport = 0;
2473 		error = ipcl_bind_insert_v6(connp, *mp->b_wptr, v6src, lport);
2474 	}
2475 	if (error == 0) {
2476 		if (ire_requested) {
2477 			if (!ip_bind_insert_ire_v6(mp, src_ire, v6src, NULL,
2478 			    ipst)) {
2479 				error = -1;
2480 				goto bad_addr;
2481 			}
2482 		} else if (ipsec_policy_set) {
2483 			if (!ip_bind_ipsec_policy_set(connp, policy_mp)) {
2484 				error = -1;
2485 				goto bad_addr;
2486 			}
2487 		}
2488 	}
2489 bad_addr:
2490 	if (error != 0) {
2491 		if (connp->conn_anon_port) {
2492 			(void) tsol_mlp_anon(crgetzone(connp->conn_cred),
2493 			    connp->conn_mlp_type, connp->conn_ulp, ntohs(lport),
2494 			    B_FALSE);
2495 		}
2496 		connp->conn_mlp_type = mlptSingle;
2497 	}
2498 
2499 	if (src_ire != NULL)
2500 		ire_refrele(src_ire);
2501 
2502 	if (ipsec_policy_set) {
2503 		ASSERT(policy_mp != NULL);
2504 		freeb(policy_mp);
2505 		/*
2506 		 * As of now assume that nothing else accompanies
2507 		 * IPSEC_POLICY_SET.
2508 		 */
2509 		mp->b_cont = NULL;
2510 	}
2511 	return (error);
2512 }
2513 
2514 /* ARGSUSED */
2515 static void
2516 ip_bind_connected_resume_v6(ipsq_t *ipsq, queue_t *q, mblk_t *mp,
2517     void *dummy_arg)
2518 {
2519 	conn_t	*connp = NULL;
2520 	t_scalar_t prim;
2521 
2522 	ASSERT(DB_TYPE(mp) == M_PROTO || DB_TYPE(mp) == M_PCPROTO);
2523 
2524 	if (CONN_Q(q))
2525 		connp = Q_TO_CONN(q);
2526 	ASSERT(connp != NULL);
2527 
2528 	prim = ((union T_primitives *)mp->b_rptr)->type;
2529 	ASSERT(prim == O_T_BIND_REQ || prim == T_BIND_REQ);
2530 
2531 	if (IPCL_IS_TCP(connp)) {
2532 		/* Pass sticky_ipp for scope_id and pktinfo */
2533 		mp = ip_bind_v6(q, mp, connp, &connp->conn_tcp->tcp_sticky_ipp);
2534 	} else {
2535 		/* For UDP and ICMP */
2536 		mp = ip_bind_v6(q, mp, connp, NULL);
2537 	}
2538 	if (mp != NULL) {
2539 		if (IPCL_IS_TCP(connp)) {
2540 			CONN_INC_REF(connp);
2541 			squeue_fill(connp->conn_sqp, mp, ip_resume_tcp_bind,
2542 			    connp, SQTAG_TCP_RPUTOTHER);
2543 		} else if (IPCL_IS_UDP(connp)) {
2544 			udp_resume_bind(connp, mp);
2545 		} else {
2546 			ASSERT(IPCL_IS_RAWIP(connp));
2547 			rawip_resume_bind(connp, mp);
2548 		}
2549 	}
2550 }
2551 
2552 /*
2553  * Verify that both the source and destination addresses
2554  * are valid.  If verify_dst, then destination address must also be reachable,
2555  * i.e. have a route.  Protocols like TCP want this.  Tunnels do not.
2556  * It takes ip6_pkt_t * as one of the arguments to determine correct
2557  * source address when IPV6_PKTINFO or scope_id is set along with a link-local
2558  * destination address. Note that parameter ipp is only useful for TCP connect
2559  * when scope_id is set or IPV6_PKTINFO option is set with an ifindex. For all
2560  * non-TCP cases, it is NULL and for all other tcp cases it is not useful.
2561  *
2562  */
2563 static int
2564 ip_bind_connected_v6(conn_t *connp, mblk_t *mp, in6_addr_t *v6src,
2565     uint16_t lport, const in6_addr_t *v6dst, ip6_pkt_t *ipp, uint16_t fport,
2566     boolean_t ire_requested, boolean_t ipsec_policy_set,
2567     boolean_t fanout_insert, boolean_t verify_dst)
2568 {
2569 	ire_t		*src_ire;
2570 	ire_t		*dst_ire;
2571 	int		error = 0;
2572 	int 		protocol;
2573 	mblk_t		*policy_mp;
2574 	ire_t		*sire = NULL;
2575 	ire_t		*md_dst_ire = NULL;
2576 	ill_t		*md_ill = NULL;
2577 	ill_t 		*dst_ill = NULL;
2578 	ipif_t		*src_ipif = NULL;
2579 	zoneid_t	zoneid;
2580 	boolean_t ill_held = B_FALSE;
2581 	ip_stack_t	*ipst = connp->conn_netstack->netstack_ip;
2582 
2583 	src_ire = dst_ire = NULL;
2584 	/*
2585 	 * NOTE:  The protocol is beyond the wptr because that's how
2586 	 * the undocumented transport<-->IP T_BIND_REQ behavior works.
2587 	 */
2588 	protocol = *mp->b_wptr & 0xFF;
2589 
2590 	/*
2591 	 * If we never got a disconnect before, clear it now.
2592 	 */
2593 	connp->conn_fully_bound = B_FALSE;
2594 
2595 	if (ipsec_policy_set) {
2596 		policy_mp = mp->b_cont;
2597 	}
2598 
2599 	zoneid = connp->conn_zoneid;
2600 
2601 	if (IN6_IS_ADDR_MULTICAST(v6dst)) {
2602 		ipif_t *ipif;
2603 
2604 		/*
2605 		 * Use an "emulated" IRE_BROADCAST to tell the transport it
2606 		 * is a multicast.
2607 		 * Pass other information that matches
2608 		 * the ipif (e.g. the source address).
2609 		 *
2610 		 * conn_multicast_ill is only used for IPv6 packets
2611 		 */
2612 		mutex_enter(&connp->conn_lock);
2613 		if (connp->conn_multicast_ill != NULL) {
2614 			(void) ipif_lookup_zoneid(connp->conn_multicast_ill,
2615 			    zoneid, 0, &ipif);
2616 		} else {
2617 			/* Look for default like ip_wput_v6 */
2618 			ipif = ipif_lookup_group_v6(v6dst, zoneid, ipst);
2619 		}
2620 		mutex_exit(&connp->conn_lock);
2621 		if (ipif == NULL || !ire_requested ||
2622 		    (dst_ire = ipif_to_ire_v6(ipif)) == NULL) {
2623 			if (ipif != NULL)
2624 				ipif_refrele(ipif);
2625 			if (ip_debug > 2) {
2626 				/* ip1dbg */
2627 				pr_addr_dbg("ip_bind_connected_v6: bad "
2628 				    "connected multicast %s\n", AF_INET6,
2629 				    v6dst);
2630 			}
2631 			error = ENETUNREACH;
2632 			goto bad_addr;
2633 		}
2634 		if (ipif != NULL)
2635 			ipif_refrele(ipif);
2636 	} else {
2637 		dst_ire = ire_route_lookup_v6(v6dst, NULL, NULL, 0,
2638 		    NULL, &sire, zoneid, MBLK_GETLABEL(mp),
2639 		    MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT |
2640 		    MATCH_IRE_PARENT | MATCH_IRE_RJ_BHOLE | MATCH_IRE_SECATTR,
2641 		    ipst);
2642 		/*
2643 		 * We also prevent ire's with src address INADDR_ANY to
2644 		 * be used, which are created temporarily for
2645 		 * sending out packets from endpoints that have
2646 		 * conn_unspec_src set.
2647 		 */
2648 		if (dst_ire == NULL ||
2649 		    (dst_ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) ||
2650 		    IN6_IS_ADDR_UNSPECIFIED(&dst_ire->ire_src_addr_v6)) {
2651 			/*
2652 			 * When verifying destination reachability, we always
2653 			 * complain.
2654 			 *
2655 			 * When not verifying destination reachability but we
2656 			 * found an IRE, i.e. the destination is reachable,
2657 			 * then the other tests still apply and we complain.
2658 			 */
2659 			if (verify_dst || (dst_ire != NULL)) {
2660 				if (ip_debug > 2) {
2661 					/* ip1dbg */
2662 					pr_addr_dbg("ip_bind_connected_v6: bad"
2663 					    " connected dst %s\n", AF_INET6,
2664 					    v6dst);
2665 				}
2666 				if (dst_ire == NULL ||
2667 				    !(dst_ire->ire_type & IRE_HOST)) {
2668 					error = ENETUNREACH;
2669 				} else {
2670 					error = EHOSTUNREACH;
2671 				}
2672 				goto bad_addr;
2673 			}
2674 		}
2675 	}
2676 
2677 	/*
2678 	 * We now know that routing will allow us to reach the destination.
2679 	 * Check whether Trusted Solaris policy allows communication with this
2680 	 * host, and pretend that the destination is unreachable if not.
2681 	 *
2682 	 * This is never a problem for TCP, since that transport is known to
2683 	 * compute the label properly as part of the tcp_rput_other T_BIND_ACK
2684 	 * handling.  If the remote is unreachable, it will be detected at that
2685 	 * point, so there's no reason to check it here.
2686 	 *
2687 	 * Note that for sendto (and other datagram-oriented friends), this
2688 	 * check is done as part of the data path label computation instead.
2689 	 * The check here is just to make non-TCP connect() report the right
2690 	 * error.
2691 	 */
2692 	if (dst_ire != NULL && is_system_labeled() &&
2693 	    !IPCL_IS_TCP(connp) &&
2694 	    tsol_compute_label_v6(DB_CREDDEF(mp, connp->conn_cred), v6dst, NULL,
2695 	    connp->conn_mac_exempt, ipst) != 0) {
2696 		error = EHOSTUNREACH;
2697 		if (ip_debug > 2) {
2698 			pr_addr_dbg("ip_bind_connected: no label for dst %s\n",
2699 			    AF_INET6, v6dst);
2700 		}
2701 		goto bad_addr;
2702 	}
2703 
2704 	/*
2705 	 * If the app does a connect(), it means that it will most likely
2706 	 * send more than 1 packet to the destination.  It makes sense
2707 	 * to clear the temporary flag.
2708 	 */
2709 	if (dst_ire != NULL && dst_ire->ire_type == IRE_CACHE &&
2710 	    (dst_ire->ire_marks & IRE_MARK_TEMPORARY)) {
2711 		irb_t *irb = dst_ire->ire_bucket;
2712 
2713 		rw_enter(&irb->irb_lock, RW_WRITER);
2714 		/*
2715 		 * We need to recheck for IRE_MARK_TEMPORARY after acquiring
2716 		 * the lock in order to guarantee irb_tmp_ire_cnt.
2717 		 */
2718 		if (dst_ire->ire_marks & IRE_MARK_TEMPORARY) {
2719 			dst_ire->ire_marks &= ~IRE_MARK_TEMPORARY;
2720 			irb->irb_tmp_ire_cnt--;
2721 		}
2722 		rw_exit(&irb->irb_lock);
2723 	}
2724 
2725 	ASSERT(dst_ire == NULL || dst_ire->ire_ipversion == IPV6_VERSION);
2726 
2727 	/*
2728 	 * See if we should notify ULP about MDT; we do this whether or not
2729 	 * ire_requested is TRUE, in order to handle active connects; MDT
2730 	 * eligibility tests for passive connects are handled separately
2731 	 * through tcp_adapt_ire().  We do this before the source address
2732 	 * selection, because dst_ire may change after a call to
2733 	 * ipif_select_source_v6().  This is a best-effort check, as the
2734 	 * packet for this connection may not actually go through
2735 	 * dst_ire->ire_stq, and the exact IRE can only be known after
2736 	 * calling ip_newroute_v6().  This is why we further check on the
2737 	 * IRE during Multidata packet transmission in tcp_multisend().
2738 	 */
2739 	if (ipst->ips_ip_multidata_outbound && !ipsec_policy_set &&
2740 	    dst_ire != NULL &&
2741 	    !(dst_ire->ire_type & (IRE_LOCAL | IRE_LOOPBACK | IRE_BROADCAST)) &&
2742 	    (md_ill = ire_to_ill(dst_ire), md_ill != NULL) &&
2743 	    ILL_MDT_CAPABLE(md_ill)) {
2744 		md_dst_ire = dst_ire;
2745 		IRE_REFHOLD(md_dst_ire);
2746 	}
2747 
2748 	if (dst_ire != NULL &&
2749 	    dst_ire->ire_type == IRE_LOCAL &&
2750 	    dst_ire->ire_zoneid != zoneid &&
2751 	    dst_ire->ire_zoneid != ALL_ZONES) {
2752 		src_ire = ire_ftable_lookup_v6(v6dst, 0, 0, 0, NULL, NULL,
2753 		    zoneid, 0, NULL,
2754 		    MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT |
2755 		    MATCH_IRE_RJ_BHOLE, ipst);
2756 		if (src_ire == NULL) {
2757 			error = EHOSTUNREACH;
2758 			goto bad_addr;
2759 		} else if (src_ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) {
2760 			if (!(src_ire->ire_type & IRE_HOST))
2761 				error = ENETUNREACH;
2762 			else
2763 				error = EHOSTUNREACH;
2764 			goto bad_addr;
2765 		}
2766 		if (IN6_IS_ADDR_UNSPECIFIED(v6src)) {
2767 			src_ipif = src_ire->ire_ipif;
2768 			ipif_refhold(src_ipif);
2769 			*v6src = src_ipif->ipif_v6lcl_addr;
2770 		}
2771 		ire_refrele(src_ire);
2772 		src_ire = NULL;
2773 	} else if (IN6_IS_ADDR_UNSPECIFIED(v6src) && dst_ire != NULL) {
2774 		if ((sire != NULL) && (sire->ire_flags & RTF_SETSRC)) {
2775 			*v6src = sire->ire_src_addr_v6;
2776 			ire_refrele(dst_ire);
2777 			dst_ire = sire;
2778 			sire = NULL;
2779 		} else if (dst_ire->ire_type == IRE_CACHE &&
2780 		    (dst_ire->ire_flags & RTF_SETSRC)) {
2781 			ASSERT(dst_ire->ire_zoneid == zoneid ||
2782 			    dst_ire->ire_zoneid == ALL_ZONES);
2783 			*v6src = dst_ire->ire_src_addr_v6;
2784 		} else {
2785 			/*
2786 			 * Pick a source address so that a proper inbound load
2787 			 * spreading would happen. Use dst_ill specified by the
2788 			 * app. when socket option or scopeid is set.
2789 			 */
2790 			int  err;
2791 
2792 			if (ipp != NULL && ipp->ipp_ifindex != 0) {
2793 				uint_t	if_index;
2794 
2795 				/*
2796 				 * Scope id or IPV6_PKTINFO
2797 				 */
2798 
2799 				if_index = ipp->ipp_ifindex;
2800 				dst_ill = ill_lookup_on_ifindex(
2801 				    if_index, B_TRUE, NULL, NULL, NULL, NULL,
2802 				    ipst);
2803 				if (dst_ill == NULL) {
2804 					ip1dbg(("ip_bind_connected_v6:"
2805 					    " bad ifindex %d\n", if_index));
2806 					error = EADDRNOTAVAIL;
2807 					goto bad_addr;
2808 				}
2809 				ill_held = B_TRUE;
2810 			} else if (connp->conn_outgoing_ill != NULL) {
2811 				/*
2812 				 * For IPV6_BOUND_IF socket option,
2813 				 * conn_outgoing_ill should be set
2814 				 * already in TCP or UDP/ICMP.
2815 				 */
2816 				dst_ill = conn_get_held_ill(connp,
2817 				    &connp->conn_outgoing_ill, &err);
2818 				if (err == ILL_LOOKUP_FAILED) {
2819 					ip1dbg(("ip_bind_connected_v6:"
2820 					    "no ill for bound_if\n"));
2821 					error = EADDRNOTAVAIL;
2822 					goto bad_addr;
2823 				}
2824 				ill_held = B_TRUE;
2825 			} else if (dst_ire->ire_stq != NULL) {
2826 				/* No need to hold ill here */
2827 				dst_ill = (ill_t *)dst_ire->ire_stq->q_ptr;
2828 			} else {
2829 				/* No need to hold ill here */
2830 				dst_ill = dst_ire->ire_ipif->ipif_ill;
2831 			}
2832 			if (!ip6_asp_can_lookup(ipst)) {
2833 				*mp->b_wptr++ = (char)protocol;
2834 				ip6_asp_pending_op(CONNP_TO_WQ(connp), mp,
2835 				    ip_bind_connected_resume_v6);
2836 				error = EINPROGRESS;
2837 				goto refrele_and_quit;
2838 			}
2839 			src_ipif = ipif_select_source_v6(dst_ill, v6dst,
2840 			    RESTRICT_TO_NONE, connp->conn_src_preferences,
2841 			    zoneid);
2842 			ip6_asp_table_refrele(ipst);
2843 			if (src_ipif == NULL) {
2844 				pr_addr_dbg("ip_bind_connected_v6: "
2845 				    "no usable source address for "
2846 				    "connection to %s\n", AF_INET6, v6dst);
2847 				error = EADDRNOTAVAIL;
2848 				goto bad_addr;
2849 			}
2850 			*v6src = src_ipif->ipif_v6lcl_addr;
2851 		}
2852 	}
2853 
2854 	/*
2855 	 * We do ire_route_lookup_v6() here (and not an interface lookup)
2856 	 * as we assert that v6src should only come from an
2857 	 * UP interface for hard binding.
2858 	 */
2859 	src_ire = ire_route_lookup_v6(v6src, 0, 0, 0, NULL,
2860 	    NULL, zoneid, NULL, MATCH_IRE_ZONEONLY, ipst);
2861 
2862 	/* src_ire must be a local|loopback */
2863 	if (!IRE_IS_LOCAL(src_ire)) {
2864 		if (ip_debug > 2) {
2865 			/* ip1dbg */
2866 			pr_addr_dbg("ip_bind_connected_v6: bad "
2867 			    "connected src %s\n", AF_INET6, v6src);
2868 		}
2869 		error = EADDRNOTAVAIL;
2870 		goto bad_addr;
2871 	}
2872 
2873 	/*
2874 	 * If the source address is a loopback address, the
2875 	 * destination had best be local or multicast.
2876 	 * The transports that can't handle multicast will reject
2877 	 * those addresses.
2878 	 */
2879 	if (src_ire->ire_type == IRE_LOOPBACK &&
2880 	    !(IRE_IS_LOCAL(dst_ire) || IN6_IS_ADDR_MULTICAST(v6dst) ||
2881 	    IN6_IS_ADDR_V4MAPPED_CLASSD(v6dst))) {
2882 		ip1dbg(("ip_bind_connected_v6: bad connected loopback\n"));
2883 		error = -1;
2884 		goto bad_addr;
2885 	}
2886 	/*
2887 	 * Allow setting new policies. For example, disconnects come
2888 	 * down as ipa_t bind. As we would have set conn_policy_cached
2889 	 * to B_TRUE before, we should set it to B_FALSE, so that policy
2890 	 * can change after the disconnect.
2891 	 */
2892 	connp->conn_policy_cached = B_FALSE;
2893 
2894 	/*
2895 	 * The addresses have been verified. Initialize the conn
2896 	 * before calling the policy as they expect the conns
2897 	 * initialized.
2898 	 */
2899 	connp->conn_srcv6 = *v6src;
2900 	connp->conn_remv6 = *v6dst;
2901 	connp->conn_lport = lport;
2902 	connp->conn_fport = fport;
2903 
2904 	ASSERT(!(ipsec_policy_set && ire_requested));
2905 	if (ire_requested) {
2906 		iulp_t *ulp_info = NULL;
2907 
2908 		/*
2909 		 * Note that sire will not be NULL if this is an off-link
2910 		 * connection and there is not cache for that dest yet.
2911 		 *
2912 		 * XXX Because of an existing bug, if there are multiple
2913 		 * default routes, the IRE returned now may not be the actual
2914 		 * default route used (default routes are chosen in a
2915 		 * round robin fashion).  So if the metrics for different
2916 		 * default routes are different, we may return the wrong
2917 		 * metrics.  This will not be a problem if the existing
2918 		 * bug is fixed.
2919 		 */
2920 		if (sire != NULL)
2921 			ulp_info = &(sire->ire_uinfo);
2922 
2923 		if (!ip_bind_insert_ire_v6(mp, dst_ire, v6dst, ulp_info,
2924 		    ipst)) {
2925 			error = -1;
2926 			goto bad_addr;
2927 		}
2928 	} else if (ipsec_policy_set) {
2929 		if (!ip_bind_ipsec_policy_set(connp, policy_mp)) {
2930 			error = -1;
2931 			goto bad_addr;
2932 		}
2933 	}
2934 
2935 	/*
2936 	 * Cache IPsec policy in this conn.  If we have per-socket policy,
2937 	 * we'll cache that.  If we don't, we'll inherit global policy.
2938 	 *
2939 	 * We can't insert until the conn reflects the policy. Note that
2940 	 * conn_policy_cached is set by ipsec_conn_cache_policy() even for
2941 	 * connections where we don't have a policy. This is to prevent
2942 	 * global policy lookups in the inbound path.
2943 	 *
2944 	 * If we insert before we set conn_policy_cached,
2945 	 * CONN_INBOUND_POLICY_PRESENT_V6() check can still evaluate true
2946 	 * because global policy cound be non-empty. We normally call
2947 	 * ipsec_check_policy() for conn_policy_cached connections only if
2948 	 * conn_in_enforce_policy is set. But in this case,
2949 	 * conn_policy_cached can get set anytime since we made the
2950 	 * CONN_INBOUND_POLICY_PRESENT_V6() check and ipsec_check_policy()
2951 	 * is called, which will make the above assumption false.  Thus, we
2952 	 * need to insert after we set conn_policy_cached.
2953 	 */
2954 	if ((error = ipsec_conn_cache_policy(connp, B_FALSE)) != 0)
2955 		goto bad_addr;
2956 
2957 	/* If not fanout_insert this was just an address verification */
2958 	if (fanout_insert) {
2959 		/*
2960 		 * The addresses have been verified. Time to insert in
2961 		 * the correct fanout list.
2962 		 */
2963 		error = ipcl_conn_insert_v6(connp, protocol, v6src, v6dst,
2964 		    connp->conn_ports,
2965 		    IPCL_IS_TCP(connp) ? connp->conn_tcp->tcp_bound_if : 0);
2966 	}
2967 	if (error == 0) {
2968 		connp->conn_fully_bound = B_TRUE;
2969 		/*
2970 		 * Our initial checks for MDT have passed; the IRE is not
2971 		 * LOCAL/LOOPBACK/BROADCAST, and the link layer seems to
2972 		 * be supporting MDT.  Pass the IRE, IPC and ILL into
2973 		 * ip_mdinfo_return(), which performs further checks
2974 		 * against them and upon success, returns the MDT info
2975 		 * mblk which we will attach to the bind acknowledgment.
2976 		 */
2977 		if (md_dst_ire != NULL) {
2978 			mblk_t *mdinfo_mp;
2979 
2980 			ASSERT(md_ill != NULL);
2981 			ASSERT(md_ill->ill_mdt_capab != NULL);
2982 			if ((mdinfo_mp = ip_mdinfo_return(md_dst_ire, connp,
2983 			    md_ill->ill_name, md_ill->ill_mdt_capab)) != NULL)
2984 				linkb(mp, mdinfo_mp);
2985 		}
2986 	}
2987 bad_addr:
2988 	if (ipsec_policy_set) {
2989 		ASSERT(policy_mp != NULL);
2990 		freeb(policy_mp);
2991 		/*
2992 		 * As of now assume that nothing else accompanies
2993 		 * IPSEC_POLICY_SET.
2994 		 */
2995 		mp->b_cont = NULL;
2996 	}
2997 refrele_and_quit:
2998 	if (src_ire != NULL)
2999 		IRE_REFRELE(src_ire);
3000 	if (dst_ire != NULL)
3001 		IRE_REFRELE(dst_ire);
3002 	if (sire != NULL)
3003 		IRE_REFRELE(sire);
3004 	if (src_ipif != NULL)
3005 		ipif_refrele(src_ipif);
3006 	if (md_dst_ire != NULL)
3007 		IRE_REFRELE(md_dst_ire);
3008 	if (ill_held && dst_ill != NULL)
3009 		ill_refrele(dst_ill);
3010 	return (error);
3011 }
3012 
3013 /*
3014  * Insert the ire in b_cont. Returns false if it fails (due to lack of space).
3015  * Makes the IRE be IRE_BROADCAST if dst is a multicast address.
3016  */
3017 /* ARGSUSED4 */
3018 static boolean_t
3019 ip_bind_insert_ire_v6(mblk_t *mp, ire_t *ire, const in6_addr_t *dst,
3020     iulp_t *ulp_info, ip_stack_t *ipst)
3021 {
3022 	mblk_t	*mp1;
3023 	ire_t	*ret_ire;
3024 
3025 	mp1 = mp->b_cont;
3026 	ASSERT(mp1 != NULL);
3027 
3028 	if (ire != NULL) {
3029 		/*
3030 		 * mp1 initialized above to IRE_DB_REQ_TYPE
3031 		 * appended mblk. Its <upper protocol>'s
3032 		 * job to make sure there is room.
3033 		 */
3034 		if ((mp1->b_datap->db_lim - mp1->b_rptr) < sizeof (ire_t))
3035 			return (B_FALSE);
3036 
3037 		mp1->b_datap->db_type = IRE_DB_TYPE;
3038 		mp1->b_wptr = mp1->b_rptr + sizeof (ire_t);
3039 		bcopy(ire, mp1->b_rptr, sizeof (ire_t));
3040 		ret_ire = (ire_t *)mp1->b_rptr;
3041 		if (IN6_IS_ADDR_MULTICAST(dst) ||
3042 		    IN6_IS_ADDR_V4MAPPED_CLASSD(dst)) {
3043 			ret_ire->ire_type = IRE_BROADCAST;
3044 			ret_ire->ire_addr_v6 = *dst;
3045 		}
3046 		if (ulp_info != NULL) {
3047 			bcopy(ulp_info, &(ret_ire->ire_uinfo),
3048 			    sizeof (iulp_t));
3049 		}
3050 		ret_ire->ire_mp = mp1;
3051 	} else {
3052 		/*
3053 		 * No IRE was found. Remove IRE mblk.
3054 		 */
3055 		mp->b_cont = mp1->b_cont;
3056 		freeb(mp1);
3057 	}
3058 	return (B_TRUE);
3059 }
3060 
3061 /*
3062  * Add an ip6i_t header to the front of the mblk.
3063  * Inline if possible else allocate a separate mblk containing only the ip6i_t.
3064  * Returns NULL if allocation fails (and frees original message).
3065  * Used in outgoing path when going through ip_newroute_*v6().
3066  * Used in incoming path to pass ifindex to transports.
3067  */
3068 mblk_t *
3069 ip_add_info_v6(mblk_t *mp, ill_t *ill, const in6_addr_t *dst)
3070 {
3071 	mblk_t *mp1;
3072 	ip6i_t *ip6i;
3073 	ip6_t *ip6h;
3074 
3075 	ip6h = (ip6_t *)mp->b_rptr;
3076 	ip6i = (ip6i_t *)(mp->b_rptr - sizeof (ip6i_t));
3077 	if ((uchar_t *)ip6i < mp->b_datap->db_base ||
3078 	    mp->b_datap->db_ref > 1) {
3079 		mp1 = allocb(sizeof (ip6i_t), BPRI_MED);
3080 		if (mp1 == NULL) {
3081 			freemsg(mp);
3082 			return (NULL);
3083 		}
3084 		mp1->b_wptr = mp1->b_rptr = mp1->b_datap->db_lim;
3085 		mp1->b_cont = mp;
3086 		mp = mp1;
3087 		ip6i = (ip6i_t *)(mp->b_rptr - sizeof (ip6i_t));
3088 	}
3089 	mp->b_rptr = (uchar_t *)ip6i;
3090 	ip6i->ip6i_vcf = ip6h->ip6_vcf;
3091 	ip6i->ip6i_nxt = IPPROTO_RAW;
3092 	if (ill != NULL) {
3093 		ip6i->ip6i_flags = IP6I_IFINDEX;
3094 		ip6i->ip6i_ifindex = ill->ill_phyint->phyint_ifindex;
3095 	} else {
3096 		ip6i->ip6i_flags = 0;
3097 	}
3098 	ip6i->ip6i_nexthop = *dst;
3099 	return (mp);
3100 }
3101 
3102 /*
3103  * Handle protocols with which IP is less intimate.  There
3104  * can be more than one stream bound to a particular
3105  * protocol.  When this is the case, normally each one gets a copy
3106  * of any incoming packets.
3107  * However, if the packet was tunneled and not multicast we only send to it
3108  * the first match.
3109  *
3110  * Zones notes:
3111  * Packets will be distributed to streams in all zones. This is really only
3112  * useful for ICMPv6 as only applications in the global zone can create raw
3113  * sockets for other protocols.
3114  */
3115 static void
3116 ip_fanout_proto_v6(queue_t *q, mblk_t *mp, ip6_t *ip6h, ill_t *ill,
3117     ill_t *inill, uint8_t nexthdr, uint_t nexthdr_offset, uint_t flags,
3118     boolean_t mctl_present, zoneid_t zoneid)
3119 {
3120 	queue_t	*rq;
3121 	mblk_t	*mp1, *first_mp1;
3122 	in6_addr_t dst = ip6h->ip6_dst;
3123 	in6_addr_t src = ip6h->ip6_src;
3124 	boolean_t one_only;
3125 	mblk_t *first_mp = mp;
3126 	boolean_t secure, shared_addr;
3127 	conn_t	*connp, *first_connp, *next_connp;
3128 	connf_t *connfp;
3129 	ip_stack_t	*ipst = inill->ill_ipst;
3130 	ipsec_stack_t	*ipss = ipst->ips_netstack->netstack_ipsec;
3131 
3132 	if (mctl_present) {
3133 		mp = first_mp->b_cont;
3134 		secure = ipsec_in_is_secure(first_mp);
3135 		ASSERT(mp != NULL);
3136 	} else {
3137 		secure = B_FALSE;
3138 	}
3139 
3140 	/*
3141 	 * If the packet was tunneled and not multicast we only send to it
3142 	 * the first match.
3143 	 */
3144 	one_only = ((nexthdr == IPPROTO_ENCAP || nexthdr == IPPROTO_IPV6) &&
3145 	    !IN6_IS_ADDR_MULTICAST(&dst));
3146 
3147 	shared_addr = (zoneid == ALL_ZONES);
3148 	if (shared_addr) {
3149 		/*
3150 		 * We don't allow multilevel ports for raw IP, so no need to
3151 		 * check for that here.
3152 		 */
3153 		zoneid = tsol_packet_to_zoneid(mp);
3154 	}
3155 
3156 	connfp = &ipst->ips_ipcl_proto_fanout_v6[nexthdr];
3157 	mutex_enter(&connfp->connf_lock);
3158 	connp = connfp->connf_head;
3159 	for (connp = connfp->connf_head; connp != NULL;
3160 	    connp = connp->conn_next) {
3161 		if (IPCL_PROTO_MATCH_V6(connp, nexthdr, ip6h, ill, flags,
3162 		    zoneid) &&
3163 		    (!is_system_labeled() ||
3164 		    tsol_receive_local(mp, &dst, IPV6_VERSION, shared_addr,
3165 		    connp)))
3166 			break;
3167 	}
3168 
3169 	if (connp == NULL || connp->conn_upq == NULL) {
3170 		/*
3171 		 * No one bound to this port.  Is
3172 		 * there a client that wants all
3173 		 * unclaimed datagrams?
3174 		 */
3175 		mutex_exit(&connfp->connf_lock);
3176 		if (ip_fanout_send_icmp_v6(q, first_mp, flags,
3177 		    ICMP6_PARAM_PROB, ICMP6_PARAMPROB_NEXTHEADER,
3178 		    nexthdr_offset, mctl_present, zoneid, ipst)) {
3179 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInUnknownProtos);
3180 		}
3181 
3182 		return;
3183 	}
3184 
3185 	CONN_INC_REF(connp);
3186 	first_connp = connp;
3187 
3188 	/*
3189 	 * XXX: Fix the multiple protocol listeners case. We should not
3190 	 * be walking the conn->next list here.
3191 	 */
3192 	if (one_only) {
3193 		/*
3194 		 * Only send message to one tunnel driver by immediately
3195 		 * terminating the loop.
3196 		 */
3197 		connp = NULL;
3198 	} else {
3199 		connp = connp->conn_next;
3200 
3201 	}
3202 	for (;;) {
3203 		while (connp != NULL) {
3204 			if (IPCL_PROTO_MATCH_V6(connp, nexthdr, ip6h, ill,
3205 			    flags, zoneid) &&
3206 			    (!is_system_labeled() ||
3207 			    tsol_receive_local(mp, &dst, IPV6_VERSION,
3208 			    shared_addr, connp)))
3209 				break;
3210 			connp = connp->conn_next;
3211 		}
3212 
3213 		/*
3214 		 * Just copy the data part alone. The mctl part is
3215 		 * needed just for verifying policy and it is never
3216 		 * sent up.
3217 		 */
3218 		if (connp == NULL || connp->conn_upq == NULL ||
3219 		    (((first_mp1 = dupmsg(first_mp)) == NULL) &&
3220 		    ((first_mp1 = ip_copymsg(first_mp)) == NULL))) {
3221 			/*
3222 			 * No more intested clients or memory
3223 			 * allocation failed
3224 			 */
3225 			connp = first_connp;
3226 			break;
3227 		}
3228 		mp1 = mctl_present ? first_mp1->b_cont : first_mp1;
3229 		CONN_INC_REF(connp);
3230 		mutex_exit(&connfp->connf_lock);
3231 		rq = connp->conn_rq;
3232 		/*
3233 		 * For link-local always add ifindex so that transport can set
3234 		 * sin6_scope_id. Avoid it for ICMP error fanout.
3235 		 */
3236 		if ((connp->conn_ip_recvpktinfo ||
3237 		    IN6_IS_ADDR_LINKLOCAL(&src)) &&
3238 		    (flags & IP_FF_IPINFO)) {
3239 			/* Add header */
3240 			mp1 = ip_add_info_v6(mp1, inill, &dst);
3241 		}
3242 		if (mp1 == NULL) {
3243 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
3244 		} else if (!canputnext(rq)) {
3245 			if (flags & IP_FF_RAWIP) {
3246 				BUMP_MIB(ill->ill_ip_mib,
3247 				    rawipIfStatsInOverflows);
3248 			} else {
3249 				BUMP_MIB(ill->ill_icmp6_mib,
3250 				    ipv6IfIcmpInOverflows);
3251 			}
3252 
3253 			freemsg(mp1);
3254 		} else {
3255 			/*
3256 			 * Don't enforce here if we're a tunnel - let "tun" do
3257 			 * it instead.
3258 			 */
3259 			if (!IPCL_IS_IPTUN(connp) &&
3260 			    (CONN_INBOUND_POLICY_PRESENT_V6(connp, ipss) ||
3261 			    secure)) {
3262 				first_mp1 = ipsec_check_inbound_policy
3263 				    (first_mp1, connp, NULL, ip6h,
3264 				    mctl_present);
3265 			}
3266 			if (first_mp1 != NULL) {
3267 				if (mctl_present)
3268 					freeb(first_mp1);
3269 				BUMP_MIB(ill->ill_ip_mib,
3270 				    ipIfStatsHCInDelivers);
3271 				(connp->conn_recv)(connp, mp1, NULL);
3272 			}
3273 		}
3274 		mutex_enter(&connfp->connf_lock);
3275 		/* Follow the next pointer before releasing the conn. */
3276 		next_connp = connp->conn_next;
3277 		CONN_DEC_REF(connp);
3278 		connp = next_connp;
3279 	}
3280 
3281 	/* Last one.  Send it upstream. */
3282 	mutex_exit(&connfp->connf_lock);
3283 
3284 	/* Initiate IPPF processing */
3285 	if (IP6_IN_IPP(flags, ipst)) {
3286 		uint_t ifindex;
3287 
3288 		mutex_enter(&ill->ill_lock);
3289 		ifindex = ill->ill_phyint->phyint_ifindex;
3290 		mutex_exit(&ill->ill_lock);
3291 		ip_process(IPP_LOCAL_IN, &mp, ifindex);
3292 		if (mp == NULL) {
3293 			CONN_DEC_REF(connp);
3294 			if (mctl_present)
3295 				freeb(first_mp);
3296 			return;
3297 		}
3298 	}
3299 
3300 	/*
3301 	 * For link-local always add ifindex so that transport can set
3302 	 * sin6_scope_id. Avoid it for ICMP error fanout.
3303 	 */
3304 	if ((connp->conn_ip_recvpktinfo || IN6_IS_ADDR_LINKLOCAL(&src)) &&
3305 	    (flags & IP_FF_IPINFO)) {
3306 		/* Add header */
3307 		mp = ip_add_info_v6(mp, inill, &dst);
3308 		if (mp == NULL) {
3309 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
3310 			CONN_DEC_REF(connp);
3311 			if (mctl_present)
3312 				freeb(first_mp);
3313 			return;
3314 		} else if (mctl_present) {
3315 			first_mp->b_cont = mp;
3316 		} else {
3317 			first_mp = mp;
3318 		}
3319 	}
3320 
3321 	rq = connp->conn_rq;
3322 	if (!canputnext(rq)) {
3323 		if (flags & IP_FF_RAWIP) {
3324 			BUMP_MIB(ill->ill_ip_mib, rawipIfStatsInOverflows);
3325 		} else {
3326 			BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInOverflows);
3327 		}
3328 
3329 		freemsg(first_mp);
3330 	} else {
3331 		if (IPCL_IS_IPTUN(connp)) {
3332 			/*
3333 			 * Tunneled packet.  We enforce policy in the tunnel
3334 			 * module itself.
3335 			 *
3336 			 * Send the WHOLE packet up (incl. IPSEC_IN) without
3337 			 * a policy check.
3338 			 */
3339 			putnext(rq, first_mp);
3340 			CONN_DEC_REF(connp);
3341 			return;
3342 		}
3343 		/*
3344 		 * Don't enforce here if we're a tunnel - let "tun" do
3345 		 * it instead.
3346 		 */
3347 		if (nexthdr != IPPROTO_ENCAP && nexthdr != IPPROTO_IPV6 &&
3348 		    (CONN_INBOUND_POLICY_PRESENT(connp, ipss) || secure)) {
3349 			first_mp = ipsec_check_inbound_policy(first_mp, connp,
3350 			    NULL, ip6h, mctl_present);
3351 			if (first_mp == NULL) {
3352 				CONN_DEC_REF(connp);
3353 				return;
3354 			}
3355 		}
3356 		BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
3357 		(connp->conn_recv)(connp, mp, NULL);
3358 		if (mctl_present)
3359 			freeb(first_mp);
3360 	}
3361 	CONN_DEC_REF(connp);
3362 }
3363 
3364 /*
3365  * Send an ICMP error after patching up the packet appropriately.  Returns
3366  * non-zero if the appropriate MIB should be bumped; zero otherwise.
3367  */
3368 int
3369 ip_fanout_send_icmp_v6(queue_t *q, mblk_t *mp, uint_t flags,
3370     uint_t icmp_type, uint8_t icmp_code, uint_t nexthdr_offset,
3371     boolean_t mctl_present, zoneid_t zoneid, ip_stack_t *ipst)
3372 {
3373 	ip6_t *ip6h;
3374 	mblk_t *first_mp;
3375 	boolean_t secure;
3376 	unsigned char db_type;
3377 	ipsec_stack_t	*ipss = ipst->ips_netstack->netstack_ipsec;
3378 
3379 	first_mp = mp;
3380 	if (mctl_present) {
3381 		mp = mp->b_cont;
3382 		secure = ipsec_in_is_secure(first_mp);
3383 		ASSERT(mp != NULL);
3384 	} else {
3385 		/*
3386 		 * If this is an ICMP error being reported - which goes
3387 		 * up as M_CTLs, we need to convert them to M_DATA till
3388 		 * we finish checking with global policy because
3389 		 * ipsec_check_global_policy() assumes M_DATA as clear
3390 		 * and M_CTL as secure.
3391 		 */
3392 		db_type = mp->b_datap->db_type;
3393 		mp->b_datap->db_type = M_DATA;
3394 		secure = B_FALSE;
3395 	}
3396 	/*
3397 	 * We are generating an icmp error for some inbound packet.
3398 	 * Called from all ip_fanout_(udp, tcp, proto) functions.
3399 	 * Before we generate an error, check with global policy
3400 	 * to see whether this is allowed to enter the system. As
3401 	 * there is no "conn", we are checking with global policy.
3402 	 */
3403 	ip6h = (ip6_t *)mp->b_rptr;
3404 	if (secure || ipss->ipsec_inbound_v6_policy_present) {
3405 		first_mp = ipsec_check_global_policy(first_mp, NULL,
3406 		    NULL, ip6h, mctl_present, ipst->ips_netstack);
3407 		if (first_mp == NULL)
3408 			return (0);
3409 	}
3410 
3411 	if (!mctl_present)
3412 		mp->b_datap->db_type = db_type;
3413 
3414 	if (flags & IP_FF_SEND_ICMP) {
3415 		if (flags & IP_FF_HDR_COMPLETE) {
3416 			if (ip_hdr_complete_v6(ip6h, zoneid, ipst)) {
3417 				freemsg(first_mp);
3418 				return (1);
3419 			}
3420 		}
3421 		switch (icmp_type) {
3422 		case ICMP6_DST_UNREACH:
3423 			icmp_unreachable_v6(WR(q), first_mp, icmp_code,
3424 			    B_FALSE, B_FALSE, zoneid, ipst);
3425 			break;
3426 		case ICMP6_PARAM_PROB:
3427 			icmp_param_problem_v6(WR(q), first_mp, icmp_code,
3428 			    nexthdr_offset, B_FALSE, B_FALSE, zoneid, ipst);
3429 			break;
3430 		default:
3431 #ifdef DEBUG
3432 			panic("ip_fanout_send_icmp_v6: wrong type");
3433 			/*NOTREACHED*/
3434 #else
3435 			freemsg(first_mp);
3436 			break;
3437 #endif
3438 		}
3439 	} else {
3440 		freemsg(first_mp);
3441 		return (0);
3442 	}
3443 
3444 	return (1);
3445 }
3446 
3447 
3448 /*
3449  * Fanout for TCP packets
3450  * The caller puts <fport, lport> in the ports parameter.
3451  */
3452 static void
3453 ip_fanout_tcp_v6(queue_t *q, mblk_t *mp, ip6_t *ip6h, ill_t *ill, ill_t *inill,
3454     uint_t flags, uint_t hdr_len, boolean_t mctl_present, zoneid_t zoneid)
3455 {
3456 	mblk_t  	*first_mp;
3457 	boolean_t 	secure;
3458 	conn_t		*connp;
3459 	tcph_t		*tcph;
3460 	boolean_t	syn_present = B_FALSE;
3461 	ip_stack_t	*ipst = inill->ill_ipst;
3462 	ipsec_stack_t	*ipss = ipst->ips_netstack->netstack_ipsec;
3463 
3464 	first_mp = mp;
3465 	if (mctl_present) {
3466 		mp = first_mp->b_cont;
3467 		secure = ipsec_in_is_secure(first_mp);
3468 		ASSERT(mp != NULL);
3469 	} else {
3470 		secure = B_FALSE;
3471 	}
3472 
3473 	connp = ipcl_classify_v6(mp, IPPROTO_TCP, hdr_len, zoneid, ipst);
3474 
3475 	if (connp == NULL ||
3476 	    !conn_wantpacket_v6(connp, ill, ip6h, flags, zoneid)) {
3477 		/*
3478 		 * No hard-bound match. Send Reset.
3479 		 */
3480 		dblk_t *dp = mp->b_datap;
3481 		uint32_t ill_index;
3482 
3483 		ASSERT((dp->db_struioflag & STRUIO_IP) == 0);
3484 
3485 		/* Initiate IPPf processing, if needed. */
3486 		if (IPP_ENABLED(IPP_LOCAL_IN, ipst) &&
3487 		    (flags & IP6_NO_IPPOLICY)) {
3488 			ill_index = ill->ill_phyint->phyint_ifindex;
3489 			ip_process(IPP_LOCAL_IN, &first_mp, ill_index);
3490 			if (first_mp == NULL) {
3491 				if (connp != NULL)
3492 					CONN_DEC_REF(connp);
3493 				return;
3494 			}
3495 		}
3496 		BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
3497 		tcp_xmit_listeners_reset(first_mp, hdr_len, zoneid,
3498 		    ipst->ips_netstack->netstack_tcp, connp);
3499 		if (connp != NULL)
3500 			CONN_DEC_REF(connp);
3501 		return;
3502 	}
3503 
3504 	tcph = (tcph_t *)&mp->b_rptr[hdr_len];
3505 	if ((tcph->th_flags[0] & (TH_SYN|TH_ACK|TH_RST|TH_URG)) == TH_SYN) {
3506 		if (connp->conn_flags & IPCL_TCP) {
3507 			squeue_t *sqp;
3508 
3509 			/*
3510 			 * For fused tcp loopback, assign the eager's
3511 			 * squeue to be that of the active connect's.
3512 			 */
3513 			if ((flags & IP_FF_LOOPBACK) && do_tcp_fusion &&
3514 			    !CONN_INBOUND_POLICY_PRESENT_V6(connp, ipss) &&
3515 			    !secure &&
3516 			    !IP6_IN_IPP(flags, ipst)) {
3517 				ASSERT(Q_TO_CONN(q) != NULL);
3518 				sqp = Q_TO_CONN(q)->conn_sqp;
3519 			} else {
3520 				sqp = IP_SQUEUE_GET(lbolt);
3521 			}
3522 
3523 			mp->b_datap->db_struioflag |= STRUIO_EAGER;
3524 			DB_CKSUMSTART(mp) = (intptr_t)sqp;
3525 
3526 			/*
3527 			 * db_cksumstuff is unused in the incoming
3528 			 * path; Thus store the ifindex here. It will
3529 			 * be cleared in tcp_conn_create_v6().
3530 			 */
3531 			DB_CKSUMSTUFF(mp) =
3532 			    (intptr_t)ill->ill_phyint->phyint_ifindex;
3533 			syn_present = B_TRUE;
3534 		}
3535 	}
3536 
3537 	if (IPCL_IS_TCP(connp) && IPCL_IS_BOUND(connp) && !syn_present) {
3538 		uint_t	flags = (unsigned int)tcph->th_flags[0] & 0xFF;
3539 		if ((flags & TH_RST) || (flags & TH_URG)) {
3540 			CONN_DEC_REF(connp);
3541 			freemsg(first_mp);
3542 			return;
3543 		}
3544 		if (flags & TH_ACK) {
3545 			tcp_xmit_listeners_reset(first_mp, hdr_len, zoneid,
3546 			    ipst->ips_netstack->netstack_tcp, connp);
3547 			CONN_DEC_REF(connp);
3548 			return;
3549 		}
3550 
3551 		CONN_DEC_REF(connp);
3552 		freemsg(first_mp);
3553 		return;
3554 	}
3555 
3556 	if (CONN_INBOUND_POLICY_PRESENT_V6(connp, ipss) || secure) {
3557 		first_mp = ipsec_check_inbound_policy(first_mp, connp,
3558 		    NULL, ip6h, mctl_present);
3559 		if (first_mp == NULL) {
3560 			CONN_DEC_REF(connp);
3561 			return;
3562 		}
3563 		if (IPCL_IS_TCP(connp) && IPCL_IS_BOUND(connp)) {
3564 			ASSERT(syn_present);
3565 			if (mctl_present) {
3566 				ASSERT(first_mp != mp);
3567 				first_mp->b_datap->db_struioflag |=
3568 				    STRUIO_POLICY;
3569 			} else {
3570 				ASSERT(first_mp == mp);
3571 				mp->b_datap->db_struioflag &=
3572 				    ~STRUIO_EAGER;
3573 				mp->b_datap->db_struioflag |=
3574 				    STRUIO_POLICY;
3575 			}
3576 		} else {
3577 			/*
3578 			 * Discard first_mp early since we're dealing with a
3579 			 * fully-connected conn_t and tcp doesn't do policy in
3580 			 * this case. Also, if someone is bound to IPPROTO_TCP
3581 			 * over raw IP, they don't expect to see a M_CTL.
3582 			 */
3583 			if (mctl_present) {
3584 				freeb(first_mp);
3585 				mctl_present = B_FALSE;
3586 			}
3587 			first_mp = mp;
3588 		}
3589 	}
3590 
3591 	/* Initiate IPPF processing */
3592 	if (IP6_IN_IPP(flags, ipst)) {
3593 		uint_t	ifindex;
3594 
3595 		mutex_enter(&ill->ill_lock);
3596 		ifindex = ill->ill_phyint->phyint_ifindex;
3597 		mutex_exit(&ill->ill_lock);
3598 		ip_process(IPP_LOCAL_IN, &mp, ifindex);
3599 		if (mp == NULL) {
3600 			CONN_DEC_REF(connp);
3601 			if (mctl_present) {
3602 				freeb(first_mp);
3603 			}
3604 			return;
3605 		} else if (mctl_present) {
3606 			/*
3607 			 * ip_add_info_v6 might return a new mp.
3608 			 */
3609 			ASSERT(first_mp != mp);
3610 			first_mp->b_cont = mp;
3611 		} else {
3612 			first_mp = mp;
3613 		}
3614 	}
3615 
3616 	/*
3617 	 * For link-local always add ifindex so that TCP can bind to that
3618 	 * interface. Avoid it for ICMP error fanout.
3619 	 */
3620 	if (!syn_present && ((connp->conn_ip_recvpktinfo ||
3621 	    IN6_IS_ADDR_LINKLOCAL(&ip6h->ip6_src)) &&
3622 	    (flags & IP_FF_IPINFO))) {
3623 		/* Add header */
3624 		mp = ip_add_info_v6(mp, inill, &ip6h->ip6_dst);
3625 		if (mp == NULL) {
3626 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
3627 			CONN_DEC_REF(connp);
3628 			if (mctl_present)
3629 				freeb(first_mp);
3630 			return;
3631 		} else if (mctl_present) {
3632 			ASSERT(first_mp != mp);
3633 			first_mp->b_cont = mp;
3634 		} else {
3635 			first_mp = mp;
3636 		}
3637 	}
3638 
3639 	BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
3640 	if (IPCL_IS_TCP(connp)) {
3641 		(*ip_input_proc)(connp->conn_sqp, first_mp,
3642 		    connp->conn_recv, connp, SQTAG_IP6_TCP_INPUT);
3643 	} else {
3644 		/* SOCK_RAW, IPPROTO_TCP case */
3645 		(connp->conn_recv)(connp, first_mp, NULL);
3646 		CONN_DEC_REF(connp);
3647 	}
3648 }
3649 
3650 /*
3651  * Fanout for UDP packets.
3652  * The caller puts <fport, lport> in the ports parameter.
3653  * ire_type must be IRE_BROADCAST for multicast and broadcast packets.
3654  *
3655  * If SO_REUSEADDR is set all multicast and broadcast packets
3656  * will be delivered to all streams bound to the same port.
3657  *
3658  * Zones notes:
3659  * Multicast packets will be distributed to streams in all zones.
3660  */
3661 static void
3662 ip_fanout_udp_v6(queue_t *q, mblk_t *mp, ip6_t *ip6h, uint32_t ports,
3663     ill_t *ill, ill_t *inill, uint_t flags, boolean_t mctl_present,
3664     zoneid_t zoneid)
3665 {
3666 	uint32_t	dstport, srcport;
3667 	in6_addr_t	dst;
3668 	mblk_t		*first_mp;
3669 	boolean_t	secure;
3670 	conn_t		*connp;
3671 	connf_t		*connfp;
3672 	conn_t		*first_conn;
3673 	conn_t 		*next_conn;
3674 	mblk_t		*mp1, *first_mp1;
3675 	in6_addr_t	src;
3676 	boolean_t	shared_addr;
3677 	ip_stack_t	*ipst = inill->ill_ipst;
3678 	ipsec_stack_t	*ipss = ipst->ips_netstack->netstack_ipsec;
3679 
3680 	first_mp = mp;
3681 	if (mctl_present) {
3682 		mp = first_mp->b_cont;
3683 		secure = ipsec_in_is_secure(first_mp);
3684 		ASSERT(mp != NULL);
3685 	} else {
3686 		secure = B_FALSE;
3687 	}
3688 
3689 	/* Extract ports in net byte order */
3690 	dstport = htons(ntohl(ports) & 0xFFFF);
3691 	srcport = htons(ntohl(ports) >> 16);
3692 	dst = ip6h->ip6_dst;
3693 	src = ip6h->ip6_src;
3694 
3695 	shared_addr = (zoneid == ALL_ZONES);
3696 	if (shared_addr) {
3697 		/*
3698 		 * No need to handle exclusive-stack zones since ALL_ZONES
3699 		 * only applies to the shared stack.
3700 		 */
3701 		zoneid = tsol_mlp_findzone(IPPROTO_UDP, dstport);
3702 		/*
3703 		 * If no shared MLP is found, tsol_mlp_findzone returns
3704 		 * ALL_ZONES.  In that case, we assume it's SLP, and
3705 		 * search for the zone based on the packet label.
3706 		 * That will also return ALL_ZONES on failure, but
3707 		 * we never allow conn_zoneid to be set to ALL_ZONES.
3708 		 */
3709 		if (zoneid == ALL_ZONES)
3710 			zoneid = tsol_packet_to_zoneid(mp);
3711 	}
3712 
3713 	/* Attempt to find a client stream based on destination port. */
3714 	connfp = &ipst->ips_ipcl_udp_fanout[IPCL_UDP_HASH(dstport, ipst)];
3715 	mutex_enter(&connfp->connf_lock);
3716 	connp = connfp->connf_head;
3717 	if (!IN6_IS_ADDR_MULTICAST(&dst)) {
3718 		/*
3719 		 * Not multicast. Send to the one (first) client we find.
3720 		 */
3721 		while (connp != NULL) {
3722 			if (IPCL_UDP_MATCH_V6(connp, dstport, dst, srcport,
3723 			    src) && IPCL_ZONE_MATCH(connp, zoneid) &&
3724 			    conn_wantpacket_v6(connp, ill, ip6h,
3725 			    flags, zoneid)) {
3726 				break;
3727 			}
3728 			connp = connp->conn_next;
3729 		}
3730 		if (connp == NULL || connp->conn_upq == NULL)
3731 			goto notfound;
3732 
3733 		if (is_system_labeled() &&
3734 		    !tsol_receive_local(mp, &dst, IPV6_VERSION, shared_addr,
3735 		    connp))
3736 			goto notfound;
3737 
3738 		/* Found a client */
3739 		CONN_INC_REF(connp);
3740 		mutex_exit(&connfp->connf_lock);
3741 
3742 		if (CONN_UDP_FLOWCTLD(connp)) {
3743 			freemsg(first_mp);
3744 			CONN_DEC_REF(connp);
3745 			return;
3746 		}
3747 		if (CONN_INBOUND_POLICY_PRESENT_V6(connp, ipss) || secure) {
3748 			first_mp = ipsec_check_inbound_policy(first_mp,
3749 			    connp, NULL, ip6h, mctl_present);
3750 			if (first_mp == NULL) {
3751 				CONN_DEC_REF(connp);
3752 				return;
3753 			}
3754 		}
3755 		/* Initiate IPPF processing */
3756 		if (IP6_IN_IPP(flags, ipst)) {
3757 			uint_t	ifindex;
3758 
3759 			mutex_enter(&ill->ill_lock);
3760 			ifindex = ill->ill_phyint->phyint_ifindex;
3761 			mutex_exit(&ill->ill_lock);
3762 			ip_process(IPP_LOCAL_IN, &mp, ifindex);
3763 			if (mp == NULL) {
3764 				CONN_DEC_REF(connp);
3765 				if (mctl_present)
3766 					freeb(first_mp);
3767 				return;
3768 			}
3769 		}
3770 		/*
3771 		 * For link-local always add ifindex so that
3772 		 * transport can set sin6_scope_id. Avoid it for
3773 		 * ICMP error fanout.
3774 		 */
3775 		if ((connp->conn_ip_recvpktinfo ||
3776 		    IN6_IS_ADDR_LINKLOCAL(&src)) &&
3777 		    (flags & IP_FF_IPINFO)) {
3778 				/* Add header */
3779 			mp = ip_add_info_v6(mp, inill, &dst);
3780 			if (mp == NULL) {
3781 				BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
3782 				CONN_DEC_REF(connp);
3783 				if (mctl_present)
3784 					freeb(first_mp);
3785 				return;
3786 			} else if (mctl_present) {
3787 				first_mp->b_cont = mp;
3788 			} else {
3789 				first_mp = mp;
3790 			}
3791 		}
3792 		BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
3793 
3794 		/* Send it upstream */
3795 		(connp->conn_recv)(connp, mp, NULL);
3796 
3797 		IP6_STAT(ipst, ip6_udp_fannorm);
3798 		CONN_DEC_REF(connp);
3799 		if (mctl_present)
3800 			freeb(first_mp);
3801 		return;
3802 	}
3803 
3804 	while (connp != NULL) {
3805 		if ((IPCL_UDP_MATCH_V6(connp, dstport, dst, srcport, src)) &&
3806 		    conn_wantpacket_v6(connp, ill, ip6h, flags, zoneid) &&
3807 		    (!is_system_labeled() ||
3808 		    tsol_receive_local(mp, &dst, IPV6_VERSION, shared_addr,
3809 		    connp)))
3810 			break;
3811 		connp = connp->conn_next;
3812 	}
3813 
3814 	if (connp == NULL || connp->conn_upq == NULL)
3815 		goto notfound;
3816 
3817 	first_conn = connp;
3818 
3819 	CONN_INC_REF(connp);
3820 	connp = connp->conn_next;
3821 	for (;;) {
3822 		while (connp != NULL) {
3823 			if (IPCL_UDP_MATCH_V6(connp, dstport, dst, srcport,
3824 			    src) && conn_wantpacket_v6(connp, ill, ip6h,
3825 			    flags, zoneid) &&
3826 			    (!is_system_labeled() ||
3827 			    tsol_receive_local(mp, &dst, IPV6_VERSION,
3828 			    shared_addr, connp)))
3829 				break;
3830 			connp = connp->conn_next;
3831 		}
3832 		/*
3833 		 * Just copy the data part alone. The mctl part is
3834 		 * needed just for verifying policy and it is never
3835 		 * sent up.
3836 		 */
3837 		if (connp == NULL ||
3838 		    (((first_mp1 = dupmsg(first_mp)) == NULL) &&
3839 		    ((first_mp1 = ip_copymsg(first_mp)) == NULL))) {
3840 			/*
3841 			 * No more interested clients or memory
3842 			 * allocation failed
3843 			 */
3844 			connp = first_conn;
3845 			break;
3846 		}
3847 		mp1 = mctl_present ? first_mp1->b_cont : first_mp1;
3848 		CONN_INC_REF(connp);
3849 		mutex_exit(&connfp->connf_lock);
3850 		/*
3851 		 * For link-local always add ifindex so that transport
3852 		 * can set sin6_scope_id. Avoid it for ICMP error
3853 		 * fanout.
3854 		 */
3855 		if ((connp->conn_ip_recvpktinfo ||
3856 		    IN6_IS_ADDR_LINKLOCAL(&src)) &&
3857 		    (flags & IP_FF_IPINFO)) {
3858 			/* Add header */
3859 			mp1 = ip_add_info_v6(mp1, inill, &dst);
3860 		}
3861 		/* mp1 could have changed */
3862 		if (mctl_present)
3863 			first_mp1->b_cont = mp1;
3864 		else
3865 			first_mp1 = mp1;
3866 		if (mp1 == NULL) {
3867 			if (mctl_present)
3868 				freeb(first_mp1);
3869 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
3870 			goto next_one;
3871 		}
3872 		if (CONN_UDP_FLOWCTLD(connp)) {
3873 			BUMP_MIB(ill->ill_ip_mib, udpIfStatsInOverflows);
3874 			freemsg(first_mp1);
3875 			goto next_one;
3876 		}
3877 
3878 		if (CONN_INBOUND_POLICY_PRESENT_V6(connp, ipss) || secure) {
3879 			first_mp1 = ipsec_check_inbound_policy
3880 			    (first_mp1, connp, NULL, ip6h,
3881 			    mctl_present);
3882 		}
3883 		if (first_mp1 != NULL) {
3884 			if (mctl_present)
3885 				freeb(first_mp1);
3886 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
3887 
3888 			/* Send it upstream */
3889 			(connp->conn_recv)(connp, mp1, NULL);
3890 		}
3891 next_one:
3892 		mutex_enter(&connfp->connf_lock);
3893 		/* Follow the next pointer before releasing the conn. */
3894 		next_conn = connp->conn_next;
3895 		IP6_STAT(ipst, ip6_udp_fanmb);
3896 		CONN_DEC_REF(connp);
3897 		connp = next_conn;
3898 	}
3899 
3900 	/* Last one.  Send it upstream. */
3901 	mutex_exit(&connfp->connf_lock);
3902 
3903 	/* Initiate IPPF processing */
3904 	if (IP6_IN_IPP(flags, ipst)) {
3905 		uint_t	ifindex;
3906 
3907 		mutex_enter(&ill->ill_lock);
3908 		ifindex = ill->ill_phyint->phyint_ifindex;
3909 		mutex_exit(&ill->ill_lock);
3910 		ip_process(IPP_LOCAL_IN, &mp, ifindex);
3911 		if (mp == NULL) {
3912 			CONN_DEC_REF(connp);
3913 			if (mctl_present) {
3914 				freeb(first_mp);
3915 			}
3916 			return;
3917 		}
3918 	}
3919 
3920 	/*
3921 	 * For link-local always add ifindex so that transport can set
3922 	 * sin6_scope_id. Avoid it for ICMP error fanout.
3923 	 */
3924 	if ((connp->conn_ip_recvpktinfo ||
3925 	    IN6_IS_ADDR_LINKLOCAL(&src)) && (flags & IP_FF_IPINFO)) {
3926 		/* Add header */
3927 		mp = ip_add_info_v6(mp, inill, &dst);
3928 		if (mp == NULL) {
3929 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
3930 			CONN_DEC_REF(connp);
3931 			if (mctl_present)
3932 				freeb(first_mp);
3933 			return;
3934 		} else if (mctl_present) {
3935 			first_mp->b_cont = mp;
3936 		} else {
3937 			first_mp = mp;
3938 		}
3939 	}
3940 	if (CONN_UDP_FLOWCTLD(connp)) {
3941 		BUMP_MIB(ill->ill_ip_mib, udpIfStatsInOverflows);
3942 		freemsg(mp);
3943 	} else {
3944 		if (CONN_INBOUND_POLICY_PRESENT_V6(connp, ipss) || secure) {
3945 			first_mp = ipsec_check_inbound_policy(first_mp,
3946 			    connp, NULL, ip6h, mctl_present);
3947 			if (first_mp == NULL) {
3948 				BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
3949 				CONN_DEC_REF(connp);
3950 				return;
3951 			}
3952 		}
3953 		BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
3954 
3955 		/* Send it upstream */
3956 		(connp->conn_recv)(connp, mp, NULL);
3957 	}
3958 	IP6_STAT(ipst, ip6_udp_fanmb);
3959 	CONN_DEC_REF(connp);
3960 	if (mctl_present)
3961 		freeb(first_mp);
3962 	return;
3963 
3964 notfound:
3965 	mutex_exit(&connfp->connf_lock);
3966 	/*
3967 	 * No one bound to this port.  Is
3968 	 * there a client that wants all
3969 	 * unclaimed datagrams?
3970 	 */
3971 	if (ipst->ips_ipcl_proto_fanout_v6[IPPROTO_UDP].connf_head != NULL) {
3972 		ip_fanout_proto_v6(q, first_mp, ip6h, ill, inill, IPPROTO_UDP,
3973 		    0, flags | IP_FF_RAWIP | IP_FF_IPINFO, mctl_present,
3974 		    zoneid);
3975 	} else {
3976 		if (ip_fanout_send_icmp_v6(q, first_mp, flags,
3977 		    ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_NOPORT, 0,
3978 		    mctl_present, zoneid, ipst)) {
3979 			BUMP_MIB(ill->ill_ip_mib, udpIfStatsNoPorts);
3980 		}
3981 	}
3982 }
3983 
3984 /*
3985  * int ip_find_hdr_v6()
3986  *
3987  * This routine is used by the upper layer protocols and the IP tunnel
3988  * module to:
3989  * - Set extension header pointers to appropriate locations
3990  * - Determine IPv6 header length and return it
3991  * - Return a pointer to the last nexthdr value
3992  *
3993  * The caller must initialize ipp_fields.
3994  *
3995  * NOTE: If multiple extension headers of the same type are present,
3996  * ip_find_hdr_v6() will set the respective extension header pointers
3997  * to the first one that it encounters in the IPv6 header.  It also
3998  * skips fragment headers.  This routine deals with malformed packets
3999  * of various sorts in which case the returned length is up to the
4000  * malformed part.
4001  */
4002 int
4003 ip_find_hdr_v6(mblk_t *mp, ip6_t *ip6h, ip6_pkt_t *ipp, uint8_t *nexthdrp)
4004 {
4005 	uint_t	length, ehdrlen;
4006 	uint8_t nexthdr;
4007 	uint8_t *whereptr, *endptr;
4008 	ip6_dest_t *tmpdstopts;
4009 	ip6_rthdr_t *tmprthdr;
4010 	ip6_hbh_t *tmphopopts;
4011 	ip6_frag_t *tmpfraghdr;
4012 
4013 	length = IPV6_HDR_LEN;
4014 	whereptr = ((uint8_t *)&ip6h[1]); /* point to next hdr */
4015 	endptr = mp->b_wptr;
4016 
4017 	nexthdr = ip6h->ip6_nxt;
4018 	while (whereptr < endptr) {
4019 		/* Is there enough left for len + nexthdr? */
4020 		if (whereptr + MIN_EHDR_LEN > endptr)
4021 			goto done;
4022 
4023 		switch (nexthdr) {
4024 		case IPPROTO_HOPOPTS:
4025 			tmphopopts = (ip6_hbh_t *)whereptr;
4026 			ehdrlen = 8 * (tmphopopts->ip6h_len + 1);
4027 			if ((uchar_t *)tmphopopts +  ehdrlen > endptr)
4028 				goto done;
4029 			nexthdr = tmphopopts->ip6h_nxt;
4030 			/* return only 1st hbh */
4031 			if (!(ipp->ipp_fields & IPPF_HOPOPTS)) {
4032 				ipp->ipp_fields |= IPPF_HOPOPTS;
4033 				ipp->ipp_hopopts = tmphopopts;
4034 				ipp->ipp_hopoptslen = ehdrlen;
4035 			}
4036 			break;
4037 		case IPPROTO_DSTOPTS:
4038 			tmpdstopts = (ip6_dest_t *)whereptr;
4039 			ehdrlen = 8 * (tmpdstopts->ip6d_len + 1);
4040 			if ((uchar_t *)tmpdstopts +  ehdrlen > endptr)
4041 				goto done;
4042 			nexthdr = tmpdstopts->ip6d_nxt;
4043 			/*
4044 			 * ipp_dstopts is set to the destination header after a
4045 			 * routing header.
4046 			 * Assume it is a post-rthdr destination header
4047 			 * and adjust when we find an rthdr.
4048 			 */
4049 			if (!(ipp->ipp_fields & IPPF_DSTOPTS)) {
4050 				ipp->ipp_fields |= IPPF_DSTOPTS;
4051 				ipp->ipp_dstopts = tmpdstopts;
4052 				ipp->ipp_dstoptslen = ehdrlen;
4053 			}
4054 			break;
4055 		case IPPROTO_ROUTING:
4056 			tmprthdr = (ip6_rthdr_t *)whereptr;
4057 			ehdrlen = 8 * (tmprthdr->ip6r_len + 1);
4058 			if ((uchar_t *)tmprthdr +  ehdrlen > endptr)
4059 				goto done;
4060 			nexthdr = tmprthdr->ip6r_nxt;
4061 			/* return only 1st rthdr */
4062 			if (!(ipp->ipp_fields & IPPF_RTHDR)) {
4063 				ipp->ipp_fields |= IPPF_RTHDR;
4064 				ipp->ipp_rthdr = tmprthdr;
4065 				ipp->ipp_rthdrlen = ehdrlen;
4066 			}
4067 			/*
4068 			 * Make any destination header we've seen be a
4069 			 * pre-rthdr destination header.
4070 			 */
4071 			if (ipp->ipp_fields & IPPF_DSTOPTS) {
4072 				ipp->ipp_fields &= ~IPPF_DSTOPTS;
4073 				ipp->ipp_fields |= IPPF_RTDSTOPTS;
4074 				ipp->ipp_rtdstopts = ipp->ipp_dstopts;
4075 				ipp->ipp_dstopts = NULL;
4076 				ipp->ipp_rtdstoptslen = ipp->ipp_dstoptslen;
4077 				ipp->ipp_dstoptslen = 0;
4078 			}
4079 			break;
4080 		case IPPROTO_FRAGMENT:
4081 			tmpfraghdr = (ip6_frag_t *)whereptr;
4082 			ehdrlen = sizeof (ip6_frag_t);
4083 			if ((uchar_t *)tmpfraghdr + ehdrlen > endptr)
4084 				goto done;
4085 			nexthdr = tmpfraghdr->ip6f_nxt;
4086 			if (!(ipp->ipp_fields & IPPF_FRAGHDR)) {
4087 				ipp->ipp_fields |= IPPF_FRAGHDR;
4088 				ipp->ipp_fraghdr = tmpfraghdr;
4089 				ipp->ipp_fraghdrlen = ehdrlen;
4090 			}
4091 			break;
4092 		case IPPROTO_NONE:
4093 		default:
4094 			goto done;
4095 		}
4096 		length += ehdrlen;
4097 		whereptr += ehdrlen;
4098 	}
4099 done:
4100 	if (nexthdrp != NULL)
4101 		*nexthdrp = nexthdr;
4102 	return (length);
4103 }
4104 
4105 int
4106 ip_hdr_complete_v6(ip6_t *ip6h, zoneid_t zoneid, ip_stack_t *ipst)
4107 {
4108 	ire_t *ire;
4109 
4110 	if (IN6_IS_ADDR_UNSPECIFIED(&ip6h->ip6_src)) {
4111 		ire = ire_lookup_local_v6(zoneid, ipst);
4112 		if (ire == NULL) {
4113 			ip1dbg(("ip_hdr_complete_v6: no source IRE\n"));
4114 			return (1);
4115 		}
4116 		ip6h->ip6_src = ire->ire_addr_v6;
4117 		ire_refrele(ire);
4118 	}
4119 	ip6h->ip6_vcf = IPV6_DEFAULT_VERS_AND_FLOW;
4120 	ip6h->ip6_hops = ipst->ips_ipv6_def_hops;
4121 	return (0);
4122 }
4123 
4124 /*
4125  * Try to determine where and what are the IPv6 header length and
4126  * pointer to nexthdr value for the upper layer protocol (or an
4127  * unknown next hdr).
4128  *
4129  * Parameters returns a pointer to the nexthdr value;
4130  * Must handle malformed packets of various sorts.
4131  * Function returns failure for malformed cases.
4132  */
4133 boolean_t
4134 ip_hdr_length_nexthdr_v6(mblk_t *mp, ip6_t *ip6h, uint16_t *hdr_length_ptr,
4135     uint8_t **nexthdrpp)
4136 {
4137 	uint16_t length;
4138 	uint_t	ehdrlen;
4139 	uint8_t	*nexthdrp;
4140 	uint8_t *whereptr;
4141 	uint8_t *endptr;
4142 	ip6_dest_t *desthdr;
4143 	ip6_rthdr_t *rthdr;
4144 	ip6_frag_t *fraghdr;
4145 
4146 	ASSERT((IPH_HDR_VERSION(ip6h) & ~IP_FORWARD_PROG_BIT) == IPV6_VERSION);
4147 	length = IPV6_HDR_LEN;
4148 	whereptr = ((uint8_t *)&ip6h[1]); /* point to next hdr */
4149 	endptr = mp->b_wptr;
4150 
4151 	nexthdrp = &ip6h->ip6_nxt;
4152 	while (whereptr < endptr) {
4153 		/* Is there enough left for len + nexthdr? */
4154 		if (whereptr + MIN_EHDR_LEN > endptr)
4155 			break;
4156 
4157 		switch (*nexthdrp) {
4158 		case IPPROTO_HOPOPTS:
4159 		case IPPROTO_DSTOPTS:
4160 			/* Assumes the headers are identical for hbh and dst */
4161 			desthdr = (ip6_dest_t *)whereptr;
4162 			ehdrlen = 8 * (desthdr->ip6d_len + 1);
4163 			if ((uchar_t *)desthdr +  ehdrlen > endptr)
4164 				return (B_FALSE);
4165 			nexthdrp = &desthdr->ip6d_nxt;
4166 			break;
4167 		case IPPROTO_ROUTING:
4168 			rthdr = (ip6_rthdr_t *)whereptr;
4169 			ehdrlen =  8 * (rthdr->ip6r_len + 1);
4170 			if ((uchar_t *)rthdr +  ehdrlen > endptr)
4171 				return (B_FALSE);
4172 			nexthdrp = &rthdr->ip6r_nxt;
4173 			break;
4174 		case IPPROTO_FRAGMENT:
4175 			fraghdr = (ip6_frag_t *)whereptr;
4176 			ehdrlen = sizeof (ip6_frag_t);
4177 			if ((uchar_t *)&fraghdr[1] > endptr)
4178 				return (B_FALSE);
4179 			nexthdrp = &fraghdr->ip6f_nxt;
4180 			break;
4181 		case IPPROTO_NONE:
4182 			/* No next header means we're finished */
4183 		default:
4184 			*hdr_length_ptr = length;
4185 			*nexthdrpp = nexthdrp;
4186 			return (B_TRUE);
4187 		}
4188 		length += ehdrlen;
4189 		whereptr += ehdrlen;
4190 		*hdr_length_ptr = length;
4191 		*nexthdrpp = nexthdrp;
4192 	}
4193 	switch (*nexthdrp) {
4194 	case IPPROTO_HOPOPTS:
4195 	case IPPROTO_DSTOPTS:
4196 	case IPPROTO_ROUTING:
4197 	case IPPROTO_FRAGMENT:
4198 		/*
4199 		 * If any know extension headers are still to be processed,
4200 		 * the packet's malformed (or at least all the IP header(s) are
4201 		 * not in the same mblk - and that should never happen.
4202 		 */
4203 		return (B_FALSE);
4204 
4205 	default:
4206 		/*
4207 		 * If we get here, we know that all of the IP headers were in
4208 		 * the same mblk, even if the ULP header is in the next mblk.
4209 		 */
4210 		*hdr_length_ptr = length;
4211 		*nexthdrpp = nexthdrp;
4212 		return (B_TRUE);
4213 	}
4214 }
4215 
4216 /*
4217  * Return the length of the IPv6 related headers (including extension headers)
4218  * Returns a length even if the packet is malformed.
4219  */
4220 int
4221 ip_hdr_length_v6(mblk_t *mp, ip6_t *ip6h)
4222 {
4223 	uint16_t hdr_len;
4224 	uint8_t	*nexthdrp;
4225 
4226 	(void) ip_hdr_length_nexthdr_v6(mp, ip6h, &hdr_len, &nexthdrp);
4227 	return (hdr_len);
4228 }
4229 
4230 /*
4231  * Select an ill for the packet by considering load spreading across
4232  * a different ill in the group if dst_ill is part of some group.
4233  */
4234 static ill_t *
4235 ip_newroute_get_dst_ill_v6(ill_t *dst_ill)
4236 {
4237 	ill_t *ill;
4238 
4239 	/*
4240 	 * We schedule irrespective of whether the source address is
4241 	 * INADDR_UNSPECIED or not.
4242 	 */
4243 	ill = illgrp_scheduler(dst_ill);
4244 	if (ill == NULL)
4245 		return (NULL);
4246 
4247 	/*
4248 	 * For groups with names ip_sioctl_groupname ensures that all
4249 	 * ills are of same type. For groups without names, ifgrp_insert
4250 	 * ensures this.
4251 	 */
4252 	ASSERT(dst_ill->ill_type == ill->ill_type);
4253 
4254 	return (ill);
4255 }
4256 
4257 /*
4258  * IPv6 -
4259  * ip_newroute_v6 is called by ip_rput_data_v6 or ip_wput_v6 whenever we need
4260  * to send out a packet to a destination address for which we do not have
4261  * specific routing information.
4262  *
4263  * Handle non-multicast packets. If ill is non-NULL the match is done
4264  * for that ill.
4265  *
4266  * When a specific ill is specified (using IPV6_PKTINFO,
4267  * IPV6_MULTICAST_IF, or IPV6_BOUND_IF) we will only match
4268  * on routing entries (ftable and ctable) that have a matching
4269  * ire->ire_ipif->ipif_ill. Thus this can only be used
4270  * for destinations that are on-link for the specific ill
4271  * and that can appear on multiple links. Thus it is useful
4272  * for multicast destinations, link-local destinations, and
4273  * at some point perhaps for site-local destinations (if the
4274  * node sits at a site boundary).
4275  * We create the cache entries in the regular ctable since
4276  * it can not "confuse" things for other destinations.
4277  * table.
4278  *
4279  * When ill is part of a ill group, we subject the packets
4280  * to load spreading even if the ill is specified by the
4281  * means described above. We disable only for IPV6_BOUND_PIF
4282  * and for the cases where IP6I_ATTACH_IF is set i.e NS/NA/
4283  * Echo replies to link-local destinations have IP6I_ATTACH_IF
4284  * set.
4285  *
4286  * NOTE : These are the scopes of some of the variables that point at IRE,
4287  *	  which needs to be followed while making any future modifications
4288  *	  to avoid memory leaks.
4289  *
4290  *	- ire and sire are the entries looked up initially by
4291  *	  ire_ftable_lookup_v6.
4292  *	- ipif_ire is used to hold the interface ire associated with
4293  *	  the new cache ire. But it's scope is limited, so we always REFRELE
4294  *	  it before branching out to error paths.
4295  *	- save_ire is initialized before ire_create, so that ire returned
4296  *	  by ire_create will not over-write the ire. We REFRELE save_ire
4297  *	  before breaking out of the switch.
4298  *
4299  *	Thus on failures, we have to REFRELE only ire and sire, if they
4300  *	are not NULL.
4301  *
4302  *	v6srcp may be used in the future. Currently unused.
4303  */
4304 /* ARGSUSED */
4305 void
4306 ip_newroute_v6(queue_t *q, mblk_t *mp, const in6_addr_t *v6dstp,
4307     const in6_addr_t *v6srcp, ill_t *ill, zoneid_t zoneid, ip_stack_t *ipst)
4308 {
4309 	in6_addr_t	v6gw;
4310 	in6_addr_t	dst;
4311 	ire_t		*ire = NULL;
4312 	ipif_t		*src_ipif = NULL;
4313 	ill_t		*dst_ill = NULL;
4314 	ire_t		*sire = NULL;
4315 	ire_t		*save_ire;
4316 	ip6_t		*ip6h;
4317 	int		err = 0;
4318 	mblk_t		*first_mp;
4319 	ipsec_out_t	*io;
4320 	ill_t		*attach_ill = NULL;
4321 	ushort_t	ire_marks = 0;
4322 	int		match_flags;
4323 	boolean_t	ip6i_present;
4324 	ire_t		*first_sire = NULL;
4325 	mblk_t		*copy_mp = NULL;
4326 	mblk_t		*xmit_mp = NULL;
4327 	in6_addr_t	save_dst;
4328 	uint32_t	multirt_flags =
4329 	    MULTIRT_CACHEGW | MULTIRT_USESTAMP | MULTIRT_SETSTAMP;
4330 	boolean_t	multirt_is_resolvable;
4331 	boolean_t	multirt_resolve_next;
4332 	boolean_t	need_rele = B_FALSE;
4333 	boolean_t	do_attach_ill = B_FALSE;
4334 	boolean_t	ip6_asp_table_held = B_FALSE;
4335 	tsol_ire_gw_secattr_t *attrp = NULL;
4336 	tsol_gcgrp_t	*gcgrp = NULL;
4337 	tsol_gcgrp_addr_t ga;
4338 
4339 	ASSERT(!IN6_IS_ADDR_MULTICAST(v6dstp));
4340 
4341 	first_mp = mp;
4342 	if (mp->b_datap->db_type == M_CTL) {
4343 		mp = mp->b_cont;
4344 		io = (ipsec_out_t *)first_mp->b_rptr;
4345 		ASSERT(io->ipsec_out_type == IPSEC_OUT);
4346 	} else {
4347 		io = NULL;
4348 	}
4349 
4350 	/*
4351 	 * If this end point is bound to IPIF_NOFAILOVER, set bnf_ill and
4352 	 * bind_to_nofailover B_TRUE. We can't use conn to determine as it
4353 	 * could be NULL.
4354 	 *
4355 	 * This information can appear either in an ip6i_t or an IPSEC_OUT
4356 	 * message.
4357 	 */
4358 	ip6h = (ip6_t *)mp->b_rptr;
4359 	ip6i_present = (ip6h->ip6_nxt == IPPROTO_RAW);
4360 	if (ip6i_present || (io != NULL && io->ipsec_out_attach_if)) {
4361 		if (!ip6i_present ||
4362 		    ((ip6i_t *)ip6h)->ip6i_flags & IP6I_ATTACH_IF) {
4363 			attach_ill = ip_grab_attach_ill(ill, first_mp,
4364 			    (ip6i_present ? ((ip6i_t *)ip6h)->ip6i_ifindex :
4365 			    io->ipsec_out_ill_index), B_TRUE, ipst);
4366 			/* Failure case frees things for us. */
4367 			if (attach_ill == NULL)
4368 				return;
4369 
4370 			/*
4371 			 * Check if we need an ire that will not be
4372 			 * looked up by anybody else i.e. HIDDEN.
4373 			 */
4374 			if (ill_is_probeonly(attach_ill))
4375 				ire_marks = IRE_MARK_HIDDEN;
4376 		}
4377 	}
4378 
4379 	if (IN6_IS_ADDR_LOOPBACK(v6dstp)) {
4380 		ip1dbg(("ip_newroute_v6: dst with loopback addr\n"));
4381 		goto icmp_err_ret;
4382 	} else if ((v6srcp != NULL) && IN6_IS_ADDR_LOOPBACK(v6srcp)) {
4383 		ip1dbg(("ip_newroute_v6: src with loopback addr\n"));
4384 		goto icmp_err_ret;
4385 	}
4386 
4387 	/*
4388 	 * If this IRE is created for forwarding or it is not for
4389 	 * TCP traffic, mark it as temporary.
4390 	 *
4391 	 * Is it sufficient just to check the next header??
4392 	 */
4393 	if (mp->b_prev != NULL || !IP_FLOW_CONTROLLED_ULP(ip6h->ip6_nxt))
4394 		ire_marks |= IRE_MARK_TEMPORARY;
4395 
4396 	/*
4397 	 * Get what we can from ire_ftable_lookup_v6 which will follow an IRE
4398 	 * chain until it gets the most specific information available.
4399 	 * For example, we know that there is no IRE_CACHE for this dest,
4400 	 * but there may be an IRE_OFFSUBNET which specifies a gateway.
4401 	 * ire_ftable_lookup_v6 will look up the gateway, etc.
4402 	 */
4403 
4404 	if (ill == NULL) {
4405 		match_flags = MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT |
4406 		    MATCH_IRE_PARENT | MATCH_IRE_RJ_BHOLE | MATCH_IRE_SECATTR;
4407 		ire = ire_ftable_lookup_v6(v6dstp, 0, 0, 0,
4408 		    NULL, &sire, zoneid, 0, MBLK_GETLABEL(mp),
4409 		    match_flags, ipst);
4410 		/*
4411 		 * ire_add_then_send -> ip_newroute_v6 in the CGTP case passes
4412 		 * in a NULL ill, but the packet could be a neighbor
4413 		 * solicitation/advertisment and could have a valid attach_ill.
4414 		 */
4415 		if (attach_ill != NULL)
4416 			ill_refrele(attach_ill);
4417 	} else {
4418 		if (attach_ill != NULL) {
4419 			/*
4420 			 * attach_ill is set only for communicating with
4421 			 * on-link hosts. So, don't look for DEFAULT.
4422 			 * ip_wput_v6 passes the right ill in this case and
4423 			 * hence we can assert.
4424 			 */
4425 			ASSERT(ill == attach_ill);
4426 			ill_refrele(attach_ill);
4427 			do_attach_ill = B_TRUE;
4428 			match_flags = MATCH_IRE_RJ_BHOLE | MATCH_IRE_ILL;
4429 		} else {
4430 			match_flags = MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT |
4431 			    MATCH_IRE_RJ_BHOLE | MATCH_IRE_ILL_GROUP;
4432 		}
4433 		match_flags |= MATCH_IRE_PARENT | MATCH_IRE_SECATTR;
4434 		ire = ire_ftable_lookup_v6(v6dstp, NULL, NULL, 0, ill->ill_ipif,
4435 		    &sire, zoneid, 0, MBLK_GETLABEL(mp), match_flags, ipst);
4436 	}
4437 
4438 	ip3dbg(("ip_newroute_v6: ire_ftable_lookup_v6() "
4439 	    "returned ire %p, sire %p\n", (void *)ire, (void *)sire));
4440 
4441 	/*
4442 	 * We enter a loop that will be run only once in most cases.
4443 	 * The loop is re-entered in the case where the destination
4444 	 * can be reached through multiple RTF_MULTIRT-flagged routes.
4445 	 * The intention is to compute multiple routes to a single
4446 	 * destination in a single ip_newroute_v6 call.
4447 	 * The information is contained in sire->ire_flags.
4448 	 */
4449 	do {
4450 		multirt_resolve_next = B_FALSE;
4451 
4452 		if (dst_ill != NULL) {
4453 			ill_refrele(dst_ill);
4454 			dst_ill = NULL;
4455 		}
4456 		if (src_ipif != NULL) {
4457 			ipif_refrele(src_ipif);
4458 			src_ipif = NULL;
4459 		}
4460 		if ((sire != NULL) && sire->ire_flags & RTF_MULTIRT) {
4461 			ip3dbg(("ip_newroute_v6: starting new resolution "
4462 			    "with first_mp %p, tag %d\n",
4463 			    (void *)first_mp, MULTIRT_DEBUG_TAGGED(first_mp)));
4464 
4465 			/*
4466 			 * We check if there are trailing unresolved routes for
4467 			 * the destination contained in sire.
4468 			 */
4469 			multirt_is_resolvable = ire_multirt_lookup_v6(&ire,
4470 			    &sire, multirt_flags, MBLK_GETLABEL(mp), ipst);
4471 
4472 			ip3dbg(("ip_newroute_v6: multirt_is_resolvable %d, "
4473 			    "ire %p, sire %p\n",
4474 			    multirt_is_resolvable, (void *)ire, (void *)sire));
4475 
4476 			if (!multirt_is_resolvable) {
4477 				/*
4478 				 * No more multirt routes to resolve; give up
4479 				 * (all routes resolved or no more resolvable
4480 				 * routes).
4481 				 */
4482 				if (ire != NULL) {
4483 					ire_refrele(ire);
4484 					ire = NULL;
4485 				}
4486 			} else {
4487 				ASSERT(sire != NULL);
4488 				ASSERT(ire != NULL);
4489 				/*
4490 				 * We simply use first_sire as a flag that
4491 				 * indicates if a resolvable multirt route has
4492 				 * already been found during the preceding
4493 				 * loops. If it is not the case, we may have
4494 				 * to send an ICMP error to report that the
4495 				 * destination is unreachable. We do not
4496 				 * IRE_REFHOLD first_sire.
4497 				 */
4498 				if (first_sire == NULL) {
4499 					first_sire = sire;
4500 				}
4501 			}
4502 		}
4503 		if ((ire == NULL) || (ire == sire)) {
4504 			/*
4505 			 * either ire == NULL (the destination cannot be
4506 			 * resolved) or ire == sire (the gateway cannot be
4507 			 * resolved). At this point, there are no more routes
4508 			 * to resolve for the destination, thus we exit.
4509 			 */
4510 			if (ip_debug > 3) {
4511 				/* ip2dbg */
4512 				pr_addr_dbg("ip_newroute_v6: "
4513 				    "can't resolve %s\n", AF_INET6, v6dstp);
4514 			}
4515 			ip3dbg(("ip_newroute_v6: "
4516 			    "ire %p, sire %p, first_sire %p\n",
4517 			    (void *)ire, (void *)sire, (void *)first_sire));
4518 
4519 			if (sire != NULL) {
4520 				ire_refrele(sire);
4521 				sire = NULL;
4522 			}
4523 
4524 			if (first_sire != NULL) {
4525 				/*
4526 				 * At least one multirt route has been found
4527 				 * in the same ip_newroute() call; there is no
4528 				 * need to report an ICMP error.
4529 				 * first_sire was not IRE_REFHOLDed.
4530 				 */
4531 				MULTIRT_DEBUG_UNTAG(first_mp);
4532 				freemsg(first_mp);
4533 				return;
4534 			}
4535 			ip_rts_change_v6(RTM_MISS, v6dstp, 0, 0, 0, 0, 0, 0,
4536 			    RTA_DST, ipst);
4537 			goto icmp_err_ret;
4538 		}
4539 
4540 		ASSERT(ire->ire_ipversion == IPV6_VERSION);
4541 
4542 		/*
4543 		 * Verify that the returned IRE does not have either the
4544 		 * RTF_REJECT or RTF_BLACKHOLE flags set and that the IRE is
4545 		 * either an IRE_CACHE, IRE_IF_NORESOLVER or IRE_IF_RESOLVER.
4546 		 */
4547 		if ((ire->ire_flags & (RTF_REJECT | RTF_BLACKHOLE)) ||
4548 		    (ire->ire_type & (IRE_CACHE | IRE_INTERFACE)) == 0)
4549 			goto icmp_err_ret;
4550 
4551 		/*
4552 		 * Increment the ire_ob_pkt_count field for ire if it is an
4553 		 * INTERFACE (IF_RESOLVER or IF_NORESOLVER) IRE type, and
4554 		 * increment the same for the parent IRE, sire, if it is some
4555 		 * sort of prefix IRE (which includes DEFAULT, PREFIX, and HOST)
4556 		 */
4557 		if ((ire->ire_type & IRE_INTERFACE) != 0) {
4558 			UPDATE_OB_PKT_COUNT(ire);
4559 			ire->ire_last_used_time = lbolt;
4560 		}
4561 
4562 		if (sire != NULL) {
4563 			mutex_enter(&sire->ire_lock);
4564 			v6gw = sire->ire_gateway_addr_v6;
4565 			mutex_exit(&sire->ire_lock);
4566 			ASSERT((sire->ire_type & (IRE_CACHETABLE |
4567 			    IRE_INTERFACE)) == 0);
4568 			UPDATE_OB_PKT_COUNT(sire);
4569 			sire->ire_last_used_time = lbolt;
4570 		} else {
4571 			v6gw = ipv6_all_zeros;
4572 		}
4573 
4574 		/*
4575 		 * We have a route to reach the destination.
4576 		 *
4577 		 * 1) If the interface is part of ill group, try to get a new
4578 		 *    ill taking load spreading into account.
4579 		 *
4580 		 * 2) After selecting the ill, get a source address that might
4581 		 *    create good inbound load spreading and that matches the
4582 		 *    right scope. ipif_select_source_v6 does this for us.
4583 		 *
4584 		 * If the application specified the ill (ifindex), we still
4585 		 * load spread. Only if the packets needs to go out specifically
4586 		 * on a given ill e.g. bind to IPIF_NOFAILOVER address,
4587 		 * IPV6_BOUND_PIF we don't try to use a different ill for load
4588 		 * spreading.
4589 		 */
4590 		if (!do_attach_ill) {
4591 			/*
4592 			 * If the interface belongs to an interface group,
4593 			 * make sure the next possible interface in the group
4594 			 * is used.  This encourages load spreading among
4595 			 * peers in an interface group. However, in the case
4596 			 * of multirouting, load spreading is not used, as we
4597 			 * actually want to replicate outgoing packets through
4598 			 * particular interfaces.
4599 			 *
4600 			 * Note: While we pick a dst_ill we are really only
4601 			 * interested in the ill for load spreading.
4602 			 * The source ipif is determined by source address
4603 			 * selection below.
4604 			 */
4605 			if ((sire != NULL) && (sire->ire_flags & RTF_MULTIRT)) {
4606 				dst_ill = ire->ire_ipif->ipif_ill;
4607 				/* For uniformity do a refhold */
4608 				ill_refhold(dst_ill);
4609 			} else {
4610 				/*
4611 				 * If we are here trying to create an IRE_CACHE
4612 				 * for an offlink destination and have the
4613 				 * IRE_CACHE for the next hop and the latter is
4614 				 * using virtual IP source address selection i.e
4615 				 * it's ire->ire_ipif is pointing to a virtual
4616 				 * network interface (vni) then
4617 				 * ip_newroute_get_dst_ll() will return the vni
4618 				 * interface as the dst_ill. Since the vni is
4619 				 * virtual i.e not associated with any physical
4620 				 * interface, it cannot be the dst_ill, hence
4621 				 * in such a case call ip_newroute_get_dst_ll()
4622 				 * with the stq_ill instead of the ire_ipif ILL.
4623 				 * The function returns a refheld ill.
4624 				 */
4625 				if ((ire->ire_type == IRE_CACHE) &&
4626 				    IS_VNI(ire->ire_ipif->ipif_ill))
4627 					dst_ill = ip_newroute_get_dst_ill_v6(
4628 					    ire->ire_stq->q_ptr);
4629 				else
4630 					dst_ill = ip_newroute_get_dst_ill_v6(
4631 					    ire->ire_ipif->ipif_ill);
4632 			}
4633 			if (dst_ill == NULL) {
4634 				if (ip_debug > 2) {
4635 					pr_addr_dbg("ip_newroute_v6 : no dst "
4636 					    "ill for dst %s\n",
4637 					    AF_INET6, v6dstp);
4638 				}
4639 				goto icmp_err_ret;
4640 			} else if (dst_ill->ill_group == NULL && ill != NULL &&
4641 			    dst_ill != ill) {
4642 				/*
4643 				 * If "ill" is not part of any group, we should
4644 				 * have found a route matching "ill" as we
4645 				 * called ire_ftable_lookup_v6 with
4646 				 * MATCH_IRE_ILL_GROUP.
4647 				 * Rather than asserting when there is a
4648 				 * mismatch, we just drop the packet.
4649 				 */
4650 				ip0dbg(("ip_newroute_v6: BOUND_IF failed : "
4651 				    "dst_ill %s ill %s\n",
4652 				    dst_ill->ill_name,
4653 				    ill->ill_name));
4654 				goto icmp_err_ret;
4655 			}
4656 		} else {
4657 			dst_ill = ire->ire_ipif->ipif_ill;
4658 			/* For uniformity do refhold */
4659 			ill_refhold(dst_ill);
4660 			/*
4661 			 * We should have found a route matching ill as we
4662 			 * called ire_ftable_lookup_v6 with MATCH_IRE_ILL.
4663 			 * Rather than asserting, while there is a mismatch,
4664 			 * we just drop the packet.
4665 			 */
4666 			if (dst_ill != ill) {
4667 				ip0dbg(("ip_newroute_v6: Packet dropped as "
4668 				    "IP6I_ATTACH_IF ill is %s, "
4669 				    "ire->ire_ipif->ipif_ill is %s\n",
4670 				    ill->ill_name,
4671 				    dst_ill->ill_name));
4672 				goto icmp_err_ret;
4673 			}
4674 		}
4675 		/*
4676 		 * Pick a source address which matches the scope of the
4677 		 * destination address.
4678 		 * For RTF_SETSRC routes, the source address is imposed by the
4679 		 * parent ire (sire).
4680 		 */
4681 		ASSERT(src_ipif == NULL);
4682 		if (ire->ire_type == IRE_IF_RESOLVER &&
4683 		    !IN6_IS_ADDR_UNSPECIFIED(&v6gw) &&
4684 		    ip6_asp_can_lookup(ipst)) {
4685 			/*
4686 			 * The ire cache entry we're adding is for the
4687 			 * gateway itself.  The source address in this case
4688 			 * is relative to the gateway's address.
4689 			 */
4690 			ip6_asp_table_held = B_TRUE;
4691 			src_ipif = ipif_select_source_v6(dst_ill, &v6gw,
4692 			    RESTRICT_TO_GROUP, IPV6_PREFER_SRC_DEFAULT, zoneid);
4693 			if (src_ipif != NULL)
4694 				ire_marks |= IRE_MARK_USESRC_CHECK;
4695 		} else {
4696 			if ((sire != NULL) && (sire->ire_flags & RTF_SETSRC)) {
4697 				/*
4698 				 * Check that the ipif matching the requested
4699 				 * source address still exists.
4700 				 */
4701 				src_ipif = ipif_lookup_addr_v6(
4702 				    &sire->ire_src_addr_v6, NULL, zoneid,
4703 				    NULL, NULL, NULL, NULL, ipst);
4704 			}
4705 			if (src_ipif == NULL && ip6_asp_can_lookup(ipst)) {
4706 				uint_t restrict_ill = RESTRICT_TO_NONE;
4707 
4708 				if (ip6i_present && ((ip6i_t *)ip6h)->ip6i_flags
4709 				    & IP6I_ATTACH_IF)
4710 					restrict_ill = RESTRICT_TO_ILL;
4711 				ip6_asp_table_held = B_TRUE;
4712 				src_ipif = ipif_select_source_v6(dst_ill,
4713 				    v6dstp, restrict_ill,
4714 				    IPV6_PREFER_SRC_DEFAULT, zoneid);
4715 				if (src_ipif != NULL)
4716 					ire_marks |= IRE_MARK_USESRC_CHECK;
4717 			}
4718 		}
4719 
4720 		if (src_ipif == NULL) {
4721 			if (ip_debug > 2) {
4722 				/* ip1dbg */
4723 				pr_addr_dbg("ip_newroute_v6: no src for "
4724 				    "dst %s\n, ", AF_INET6, v6dstp);
4725 				printf("ip_newroute_v6: interface name %s\n",
4726 				    dst_ill->ill_name);
4727 			}
4728 			goto icmp_err_ret;
4729 		}
4730 
4731 		if (ip_debug > 3) {
4732 			/* ip2dbg */
4733 			pr_addr_dbg("ip_newroute_v6: first hop %s\n",
4734 			    AF_INET6, &v6gw);
4735 		}
4736 		ip2dbg(("\tire type %s (%d)\n",
4737 		    ip_nv_lookup(ire_nv_tbl, ire->ire_type), ire->ire_type));
4738 
4739 		/*
4740 		 * At this point in ip_newroute_v6(), ire is either the
4741 		 * IRE_CACHE of the next-hop gateway for an off-subnet
4742 		 * destination or an IRE_INTERFACE type that should be used
4743 		 * to resolve an on-subnet destination or an on-subnet
4744 		 * next-hop gateway.
4745 		 *
4746 		 * In the IRE_CACHE case, we have the following :
4747 		 *
4748 		 * 1) src_ipif - used for getting a source address.
4749 		 *
4750 		 * 2) dst_ill - from which we derive ire_stq/ire_rfq. This
4751 		 *    means packets using this IRE_CACHE will go out on dst_ill.
4752 		 *
4753 		 * 3) The IRE sire will point to the prefix that is the longest
4754 		 *    matching route for the destination. These prefix types
4755 		 *    include IRE_DEFAULT, IRE_PREFIX, IRE_HOST.
4756 		 *
4757 		 *    The newly created IRE_CACHE entry for the off-subnet
4758 		 *    destination is tied to both the prefix route and the
4759 		 *    interface route used to resolve the next-hop gateway
4760 		 *    via the ire_phandle and ire_ihandle fields, respectively.
4761 		 *
4762 		 * In the IRE_INTERFACE case, we have the following :
4763 		 *
4764 		 * 1) src_ipif - used for getting a source address.
4765 		 *
4766 		 * 2) dst_ill - from which we derive ire_stq/ire_rfq. This
4767 		 *    means packets using the IRE_CACHE that we will build
4768 		 *    here will go out on dst_ill.
4769 		 *
4770 		 * 3) sire may or may not be NULL. But, the IRE_CACHE that is
4771 		 *    to be created will only be tied to the IRE_INTERFACE that
4772 		 *    was derived from the ire_ihandle field.
4773 		 *
4774 		 *    If sire is non-NULL, it means the destination is off-link
4775 		 *    and we will first create the IRE_CACHE for the gateway.
4776 		 *    Next time through ip_newroute_v6, we will create the
4777 		 *    IRE_CACHE for the final destination as described above.
4778 		 */
4779 		save_ire = ire;
4780 		switch (ire->ire_type) {
4781 		case IRE_CACHE: {
4782 			ire_t	*ipif_ire;
4783 
4784 			ASSERT(sire != NULL);
4785 			if (IN6_IS_ADDR_UNSPECIFIED(&v6gw)) {
4786 				mutex_enter(&ire->ire_lock);
4787 				v6gw = ire->ire_gateway_addr_v6;
4788 				mutex_exit(&ire->ire_lock);
4789 			}
4790 			/*
4791 			 * We need 3 ire's to create a new cache ire for an
4792 			 * off-link destination from the cache ire of the
4793 			 * gateway.
4794 			 *
4795 			 *	1. The prefix ire 'sire'
4796 			 *	2. The cache ire of the gateway 'ire'
4797 			 *	3. The interface ire 'ipif_ire'
4798 			 *
4799 			 * We have (1) and (2). We lookup (3) below.
4800 			 *
4801 			 * If there is no interface route to the gateway,
4802 			 * it is a race condition, where we found the cache
4803 			 * but the inteface route has been deleted.
4804 			 */
4805 			ipif_ire = ire_ihandle_lookup_offlink_v6(ire, sire);
4806 			if (ipif_ire == NULL) {
4807 				ip1dbg(("ip_newroute_v6:"
4808 				    "ire_ihandle_lookup_offlink_v6 failed\n"));
4809 				goto icmp_err_ret;
4810 			}
4811 			/*
4812 			 * Assume DL_UNITDATA_REQ is same for all physical
4813 			 * interfaces in the ifgrp.  If it isn't, this code will
4814 			 * have to be seriously rewhacked to allow the
4815 			 * fastpath probing (such that I cache the link
4816 			 * header in the IRE_CACHE) to work over ifgrps.
4817 			 * We have what we need to build an IRE_CACHE.
4818 			 */
4819 			/*
4820 			 * Note: the new ire inherits RTF_SETSRC
4821 			 * and RTF_MULTIRT to propagate these flags from prefix
4822 			 * to cache.
4823 			 */
4824 
4825 			/*
4826 			 * Check cached gateway IRE for any security
4827 			 * attributes; if found, associate the gateway
4828 			 * credentials group to the destination IRE.
4829 			 */
4830 			if ((attrp = save_ire->ire_gw_secattr) != NULL) {
4831 				mutex_enter(&attrp->igsa_lock);
4832 				if ((gcgrp = attrp->igsa_gcgrp) != NULL)
4833 					GCGRP_REFHOLD(gcgrp);
4834 				mutex_exit(&attrp->igsa_lock);
4835 			}
4836 
4837 			ire = ire_create_v6(
4838 			    v6dstp,			/* dest address */
4839 			    &ipv6_all_ones,		/* mask */
4840 			    &src_ipif->ipif_v6src_addr, /* source address */
4841 			    &v6gw,			/* gateway address */
4842 			    &save_ire->ire_max_frag,
4843 			    NULL,			/* src nce */
4844 			    dst_ill->ill_rq,		/* recv-from queue */
4845 			    dst_ill->ill_wq,		/* send-to queue */
4846 			    IRE_CACHE,
4847 			    src_ipif,
4848 			    &sire->ire_mask_v6,		/* Parent mask */
4849 			    sire->ire_phandle,		/* Parent handle */
4850 			    ipif_ire->ire_ihandle,	/* Interface handle */
4851 			    sire->ire_flags &		/* flags if any */
4852 			    (RTF_SETSRC | RTF_MULTIRT),
4853 			    &(sire->ire_uinfo),
4854 			    NULL,
4855 			    gcgrp,
4856 			    ipst);
4857 
4858 			if (ire == NULL) {
4859 				if (gcgrp != NULL) {
4860 					GCGRP_REFRELE(gcgrp);
4861 					gcgrp = NULL;
4862 				}
4863 				ire_refrele(save_ire);
4864 				ire_refrele(ipif_ire);
4865 				break;
4866 			}
4867 
4868 			/* reference now held by IRE */
4869 			gcgrp = NULL;
4870 
4871 			ire->ire_marks |= ire_marks;
4872 
4873 			/*
4874 			 * Prevent sire and ipif_ire from getting deleted. The
4875 			 * newly created ire is tied to both of them via the
4876 			 * phandle and ihandle respectively.
4877 			 */
4878 			IRB_REFHOLD(sire->ire_bucket);
4879 			/* Has it been removed already ? */
4880 			if (sire->ire_marks & IRE_MARK_CONDEMNED) {
4881 				IRB_REFRELE(sire->ire_bucket);
4882 				ire_refrele(ipif_ire);
4883 				ire_refrele(save_ire);
4884 				break;
4885 			}
4886 
4887 			IRB_REFHOLD(ipif_ire->ire_bucket);
4888 			/* Has it been removed already ? */
4889 			if (ipif_ire->ire_marks & IRE_MARK_CONDEMNED) {
4890 				IRB_REFRELE(ipif_ire->ire_bucket);
4891 				IRB_REFRELE(sire->ire_bucket);
4892 				ire_refrele(ipif_ire);
4893 				ire_refrele(save_ire);
4894 				break;
4895 			}
4896 
4897 			xmit_mp = first_mp;
4898 			if (ire->ire_flags & RTF_MULTIRT) {
4899 				copy_mp = copymsg(first_mp);
4900 				if (copy_mp != NULL) {
4901 					xmit_mp = copy_mp;
4902 					MULTIRT_DEBUG_TAG(first_mp);
4903 				}
4904 			}
4905 			ire_add_then_send(q, ire, xmit_mp);
4906 			if (ip6_asp_table_held) {
4907 				ip6_asp_table_refrele(ipst);
4908 				ip6_asp_table_held = B_FALSE;
4909 			}
4910 			ire_refrele(save_ire);
4911 
4912 			/* Assert that sire is not deleted yet. */
4913 			ASSERT(sire->ire_ptpn != NULL);
4914 			IRB_REFRELE(sire->ire_bucket);
4915 
4916 			/* Assert that ipif_ire is not deleted yet. */
4917 			ASSERT(ipif_ire->ire_ptpn != NULL);
4918 			IRB_REFRELE(ipif_ire->ire_bucket);
4919 			ire_refrele(ipif_ire);
4920 
4921 			if (copy_mp != NULL) {
4922 				/*
4923 				 * Search for the next unresolved
4924 				 * multirt route.
4925 				 */
4926 				copy_mp = NULL;
4927 				ipif_ire = NULL;
4928 				ire = NULL;
4929 				/* re-enter the loop */
4930 				multirt_resolve_next = B_TRUE;
4931 				continue;
4932 			}
4933 			ire_refrele(sire);
4934 			ill_refrele(dst_ill);
4935 			ipif_refrele(src_ipif);
4936 			return;
4937 		}
4938 		case IRE_IF_NORESOLVER:
4939 			/*
4940 			 * We have what we need to build an IRE_CACHE.
4941 			 *
4942 			 * handle the Gated case, where we create
4943 			 * a NORESOLVER route for loopback.
4944 			 */
4945 			if (dst_ill->ill_net_type != IRE_IF_NORESOLVER)
4946 				break;
4947 			/*
4948 			 * TSol note: We are creating the ire cache for the
4949 			 * destination 'dst'. If 'dst' is offlink, going
4950 			 * through the first hop 'gw', the security attributes
4951 			 * of 'dst' must be set to point to the gateway
4952 			 * credentials of gateway 'gw'. If 'dst' is onlink, it
4953 			 * is possible that 'dst' is a potential gateway that is
4954 			 * referenced by some route that has some security
4955 			 * attributes. Thus in the former case, we need to do a
4956 			 * gcgrp_lookup of 'gw' while in the latter case we
4957 			 * need to do gcgrp_lookup of 'dst' itself.
4958 			 */
4959 			ga.ga_af = AF_INET6;
4960 			if (!IN6_IS_ADDR_UNSPECIFIED(&v6gw))
4961 				ga.ga_addr = v6gw;
4962 			else
4963 				ga.ga_addr = *v6dstp;
4964 			gcgrp = gcgrp_lookup(&ga, B_FALSE);
4965 
4966 			/*
4967 			 * Note: the new ire inherits sire flags RTF_SETSRC
4968 			 * and RTF_MULTIRT to propagate those rules from prefix
4969 			 * to cache.
4970 			 */
4971 			ire = ire_create_v6(
4972 			    v6dstp,			/* dest address */
4973 			    &ipv6_all_ones,		/* mask */
4974 			    &src_ipif->ipif_v6src_addr, /* source address */
4975 			    &v6gw,			/* gateway address */
4976 			    &save_ire->ire_max_frag,
4977 			    NULL,			/* no src nce */
4978 			    dst_ill->ill_rq,		/* recv-from queue */
4979 			    dst_ill->ill_wq,		/* send-to queue */
4980 			    IRE_CACHE,
4981 			    src_ipif,
4982 			    &save_ire->ire_mask_v6,	/* Parent mask */
4983 			    (sire != NULL) ?		/* Parent handle */
4984 			    sire->ire_phandle : 0,
4985 			    save_ire->ire_ihandle,	/* Interface handle */
4986 			    (sire != NULL) ?		/* flags if any */
4987 			    sire->ire_flags &
4988 			    (RTF_SETSRC | RTF_MULTIRT) : 0,
4989 			    &(save_ire->ire_uinfo),
4990 			    NULL,
4991 			    gcgrp,
4992 			    ipst);
4993 
4994 			if (ire == NULL) {
4995 				if (gcgrp != NULL) {
4996 					GCGRP_REFRELE(gcgrp);
4997 					gcgrp = NULL;
4998 				}
4999 				ire_refrele(save_ire);
5000 				break;
5001 			}
5002 
5003 			/* reference now held by IRE */
5004 			gcgrp = NULL;
5005 
5006 			ire->ire_marks |= ire_marks;
5007 
5008 			if (!IN6_IS_ADDR_UNSPECIFIED(&v6gw))
5009 				dst = v6gw;
5010 			else
5011 				dst = *v6dstp;
5012 			err = ndp_noresolver(dst_ill, &dst);
5013 			if (err != 0) {
5014 				ire_refrele(save_ire);
5015 				break;
5016 			}
5017 
5018 			/* Prevent save_ire from getting deleted */
5019 			IRB_REFHOLD(save_ire->ire_bucket);
5020 			/* Has it been removed already ? */
5021 			if (save_ire->ire_marks & IRE_MARK_CONDEMNED) {
5022 				IRB_REFRELE(save_ire->ire_bucket);
5023 				ire_refrele(save_ire);
5024 				break;
5025 			}
5026 
5027 			xmit_mp = first_mp;
5028 			/*
5029 			 * In case of MULTIRT, a copy of the current packet
5030 			 * to send is made to further re-enter the
5031 			 * loop and attempt another route resolution
5032 			 */
5033 			if ((sire != NULL) && sire->ire_flags & RTF_MULTIRT) {
5034 				copy_mp = copymsg(first_mp);
5035 				if (copy_mp != NULL) {
5036 					xmit_mp = copy_mp;
5037 					MULTIRT_DEBUG_TAG(first_mp);
5038 				}
5039 			}
5040 			ire_add_then_send(q, ire, xmit_mp);
5041 			if (ip6_asp_table_held) {
5042 				ip6_asp_table_refrele(ipst);
5043 				ip6_asp_table_held = B_FALSE;
5044 			}
5045 
5046 			/* Assert that it is not deleted yet. */
5047 			ASSERT(save_ire->ire_ptpn != NULL);
5048 			IRB_REFRELE(save_ire->ire_bucket);
5049 			ire_refrele(save_ire);
5050 
5051 			if (copy_mp != NULL) {
5052 				/*
5053 				 * If we found a (no)resolver, we ignore any
5054 				 * trailing top priority IRE_CACHE in
5055 				 * further loops. This ensures that we do not
5056 				 * omit any (no)resolver despite the priority
5057 				 * in this call.
5058 				 * IRE_CACHE, if any, will be processed
5059 				 * by another thread entering ip_newroute(),
5060 				 * (on resolver response, for example).
5061 				 * We use this to force multiple parallel
5062 				 * resolution as soon as a packet needs to be
5063 				 * sent. The result is, after one packet
5064 				 * emission all reachable routes are generally
5065 				 * resolved.
5066 				 * Otherwise, complete resolution of MULTIRT
5067 				 * routes would require several emissions as
5068 				 * side effect.
5069 				 */
5070 				multirt_flags &= ~MULTIRT_CACHEGW;
5071 
5072 				/*
5073 				 * Search for the next unresolved multirt
5074 				 * route.
5075 				 */
5076 				copy_mp = NULL;
5077 				save_ire = NULL;
5078 				ire = NULL;
5079 				/* re-enter the loop */
5080 				multirt_resolve_next = B_TRUE;
5081 				continue;
5082 			}
5083 
5084 			/* Don't need sire anymore */
5085 			if (sire != NULL)
5086 				ire_refrele(sire);
5087 			ill_refrele(dst_ill);
5088 			ipif_refrele(src_ipif);
5089 			return;
5090 
5091 		case IRE_IF_RESOLVER:
5092 			/*
5093 			 * We can't build an IRE_CACHE yet, but at least we
5094 			 * found a resolver that can help.
5095 			 */
5096 			dst = *v6dstp;
5097 
5098 			/*
5099 			 * To be at this point in the code with a non-zero gw
5100 			 * means that dst is reachable through a gateway that
5101 			 * we have never resolved.  By changing dst to the gw
5102 			 * addr we resolve the gateway first.  When
5103 			 * ire_add_then_send() tries to put the IP dg to dst,
5104 			 * it will reenter ip_newroute() at which time we will
5105 			 * find the IRE_CACHE for the gw and create another
5106 			 * IRE_CACHE above (for dst itself).
5107 			 */
5108 			if (!IN6_IS_ADDR_UNSPECIFIED(&v6gw)) {
5109 				save_dst = dst;
5110 				dst = v6gw;
5111 				v6gw = ipv6_all_zeros;
5112 			}
5113 			if (dst_ill->ill_flags & ILLF_XRESOLV) {
5114 				/*
5115 				 * Ask the external resolver to do its thing.
5116 				 * Make an mblk chain in the following form:
5117 				 * ARQ_REQ_MBLK-->IRE_MBLK-->packet
5118 				 */
5119 				mblk_t		*ire_mp;
5120 				mblk_t		*areq_mp;
5121 				areq_t		*areq;
5122 				in6_addr_t	*addrp;
5123 
5124 				ip1dbg(("ip_newroute_v6:ILLF_XRESOLV\n"));
5125 				if (ip6_asp_table_held) {
5126 					ip6_asp_table_refrele(ipst);
5127 					ip6_asp_table_held = B_FALSE;
5128 				}
5129 				ire = ire_create_mp_v6(
5130 				    &dst,		/* dest address */
5131 				    &ipv6_all_ones,	/* mask */
5132 				    &src_ipif->ipif_v6src_addr,
5133 				    /* source address */
5134 				    &v6gw,		/* gateway address */
5135 				    NULL,		/* no src nce */
5136 				    dst_ill->ill_rq,	/* recv-from queue */
5137 				    dst_ill->ill_wq, 	/* send-to queue */
5138 				    IRE_CACHE,
5139 				    src_ipif,
5140 				    &save_ire->ire_mask_v6, /* Parent mask */
5141 				    0,
5142 				    save_ire->ire_ihandle,
5143 				    /* Interface handle */
5144 				    0,		/* flags if any */
5145 				    &(save_ire->ire_uinfo),
5146 				    NULL,
5147 				    NULL,
5148 				    ipst);
5149 
5150 				ire_refrele(save_ire);
5151 				if (ire == NULL) {
5152 					ip1dbg(("ip_newroute_v6:"
5153 					    "ire is NULL\n"));
5154 					break;
5155 				}
5156 
5157 				if ((sire != NULL) &&
5158 				    (sire->ire_flags & RTF_MULTIRT)) {
5159 					/*
5160 					 * processing a copy of the packet to
5161 					 * send for further resolution loops
5162 					 */
5163 					copy_mp = copymsg(first_mp);
5164 					if (copy_mp != NULL)
5165 						MULTIRT_DEBUG_TAG(copy_mp);
5166 				}
5167 				ire->ire_marks |= ire_marks;
5168 				ire_mp = ire->ire_mp;
5169 				/*
5170 				 * Now create or find an nce for this interface.
5171 				 * The hw addr will need to to be set from
5172 				 * the reply to the AR_ENTRY_QUERY that
5173 				 * we're about to send. This will be done in
5174 				 * ire_add_v6().
5175 				 */
5176 				err = ndp_resolver(dst_ill, &dst, mp, zoneid);
5177 				switch (err) {
5178 				case 0:
5179 					/*
5180 					 * New cache entry created.
5181 					 * Break, then ask the external
5182 					 * resolver.
5183 					 */
5184 					break;
5185 				case EINPROGRESS:
5186 					/*
5187 					 * Resolution in progress;
5188 					 * packet has been queued by
5189 					 * ndp_resolver().
5190 					 */
5191 					ire_delete(ire);
5192 					ire = NULL;
5193 					/*
5194 					 * Check if another multirt
5195 					 * route must be resolved.
5196 					 */
5197 					if (copy_mp != NULL) {
5198 						/*
5199 						 * If we found a resolver, we
5200 						 * ignore any trailing top
5201 						 * priority IRE_CACHE in
5202 						 * further loops. The reason is
5203 						 * the same as for noresolver.
5204 						 */
5205 						multirt_flags &=
5206 						    ~MULTIRT_CACHEGW;
5207 						/*
5208 						 * Search for the next
5209 						 * unresolved multirt route.
5210 						 */
5211 						first_mp = copy_mp;
5212 						copy_mp = NULL;
5213 						mp = first_mp;
5214 						if (mp->b_datap->db_type ==
5215 						    M_CTL) {
5216 							mp = mp->b_cont;
5217 						}
5218 						ASSERT(sire != NULL);
5219 						dst = save_dst;
5220 						/*
5221 						 * re-enter the loop
5222 						 */
5223 						multirt_resolve_next =
5224 						    B_TRUE;
5225 						continue;
5226 					}
5227 
5228 					if (sire != NULL)
5229 						ire_refrele(sire);
5230 					ill_refrele(dst_ill);
5231 					ipif_refrele(src_ipif);
5232 					return;
5233 				default:
5234 					/*
5235 					 * Transient error; packet will be
5236 					 * freed.
5237 					 */
5238 					ire_delete(ire);
5239 					ire = NULL;
5240 					break;
5241 				}
5242 				if (err != 0)
5243 					break;
5244 				/*
5245 				 * Now set up the AR_ENTRY_QUERY and send it.
5246 				 */
5247 				areq_mp = ill_arp_alloc(dst_ill,
5248 				    (uchar_t *)&ipv6_areq_template,
5249 				    (caddr_t)&dst);
5250 				if (areq_mp == NULL) {
5251 					ip1dbg(("ip_newroute_v6:"
5252 					    "areq_mp is NULL\n"));
5253 					freemsg(ire_mp);
5254 					break;
5255 				}
5256 				areq = (areq_t *)areq_mp->b_rptr;
5257 				addrp = (in6_addr_t *)((char *)areq +
5258 				    areq->areq_target_addr_offset);
5259 				*addrp = dst;
5260 				addrp = (in6_addr_t *)((char *)areq +
5261 				    areq->areq_sender_addr_offset);
5262 				*addrp = src_ipif->ipif_v6src_addr;
5263 				/*
5264 				 * link the chain, then send up to the resolver.
5265 				 */
5266 				linkb(areq_mp, ire_mp);
5267 				linkb(areq_mp, mp);
5268 				ip1dbg(("ip_newroute_v6:"
5269 				    "putnext to resolver\n"));
5270 				putnext(dst_ill->ill_rq, areq_mp);
5271 				/*
5272 				 * Check if another multirt route
5273 				 * must be resolved.
5274 				 */
5275 				ire = NULL;
5276 				if (copy_mp != NULL) {
5277 					/*
5278 					 * If we find a resolver, we ignore any
5279 					 * trailing top priority IRE_CACHE in
5280 					 * further loops. The reason is the
5281 					 * same as for noresolver.
5282 					 */
5283 					multirt_flags &= ~MULTIRT_CACHEGW;
5284 					/*
5285 					 * Search for the next unresolved
5286 					 * multirt route.
5287 					 */
5288 					first_mp = copy_mp;
5289 					copy_mp = NULL;
5290 					mp = first_mp;
5291 					if (mp->b_datap->db_type == M_CTL) {
5292 						mp = mp->b_cont;
5293 					}
5294 					ASSERT(sire != NULL);
5295 					dst = save_dst;
5296 					/*
5297 					 * re-enter the loop
5298 					 */
5299 					multirt_resolve_next = B_TRUE;
5300 					continue;
5301 				}
5302 
5303 				if (sire != NULL)
5304 					ire_refrele(sire);
5305 				ill_refrele(dst_ill);
5306 				ipif_refrele(src_ipif);
5307 				return;
5308 			}
5309 			/*
5310 			 * Non-external resolver case.
5311 			 *
5312 			 * TSol note: Please see the note above the
5313 			 * IRE_IF_NORESOLVER case.
5314 			 */
5315 			ga.ga_af = AF_INET6;
5316 			ga.ga_addr = dst;
5317 			gcgrp = gcgrp_lookup(&ga, B_FALSE);
5318 
5319 			ire = ire_create_v6(
5320 			    &dst,			/* dest address */
5321 			    &ipv6_all_ones,		/* mask */
5322 			    &src_ipif->ipif_v6src_addr, /* source address */
5323 			    &v6gw,			/* gateway address */
5324 			    &save_ire->ire_max_frag,
5325 			    NULL,			/* no src nce */
5326 			    dst_ill->ill_rq,		/* recv-from queue */
5327 			    dst_ill->ill_wq,		/* send-to queue */
5328 			    IRE_CACHE,
5329 			    src_ipif,
5330 			    &save_ire->ire_mask_v6,	/* Parent mask */
5331 			    0,
5332 			    save_ire->ire_ihandle,	/* Interface handle */
5333 			    0,				/* flags if any */
5334 			    &(save_ire->ire_uinfo),
5335 			    NULL,
5336 			    gcgrp,
5337 			    ipst);
5338 
5339 			if (ire == NULL) {
5340 				if (gcgrp != NULL) {
5341 					GCGRP_REFRELE(gcgrp);
5342 					gcgrp = NULL;
5343 				}
5344 				ire_refrele(save_ire);
5345 				break;
5346 			}
5347 
5348 			/* reference now held by IRE */
5349 			gcgrp = NULL;
5350 
5351 			if ((sire != NULL) &&
5352 			    (sire->ire_flags & RTF_MULTIRT)) {
5353 				copy_mp = copymsg(first_mp);
5354 				if (copy_mp != NULL)
5355 					MULTIRT_DEBUG_TAG(copy_mp);
5356 			}
5357 
5358 			ire->ire_marks |= ire_marks;
5359 			err = ndp_resolver(dst_ill, &dst, first_mp, zoneid);
5360 			switch (err) {
5361 			case 0:
5362 				/* Prevent save_ire from getting deleted */
5363 				IRB_REFHOLD(save_ire->ire_bucket);
5364 				/* Has it been removed already ? */
5365 				if (save_ire->ire_marks & IRE_MARK_CONDEMNED) {
5366 					IRB_REFRELE(save_ire->ire_bucket);
5367 					ire_refrele(save_ire);
5368 					break;
5369 				}
5370 
5371 				/*
5372 				 * We have a resolved cache entry,
5373 				 * add in the IRE.
5374 				 */
5375 				ire_add_then_send(q, ire, first_mp);
5376 				if (ip6_asp_table_held) {
5377 					ip6_asp_table_refrele(ipst);
5378 					ip6_asp_table_held = B_FALSE;
5379 				}
5380 
5381 				/* Assert that it is not deleted yet. */
5382 				ASSERT(save_ire->ire_ptpn != NULL);
5383 				IRB_REFRELE(save_ire->ire_bucket);
5384 				ire_refrele(save_ire);
5385 				/*
5386 				 * Check if another multirt route
5387 				 * must be resolved.
5388 				 */
5389 				ire = NULL;
5390 				if (copy_mp != NULL) {
5391 					/*
5392 					 * If we find a resolver, we ignore any
5393 					 * trailing top priority IRE_CACHE in
5394 					 * further loops. The reason is the
5395 					 * same as for noresolver.
5396 					 */
5397 					multirt_flags &= ~MULTIRT_CACHEGW;
5398 					/*
5399 					 * Search for the next unresolved
5400 					 * multirt route.
5401 					 */
5402 					first_mp = copy_mp;
5403 					copy_mp = NULL;
5404 					mp = first_mp;
5405 					if (mp->b_datap->db_type == M_CTL) {
5406 						mp = mp->b_cont;
5407 					}
5408 					ASSERT(sire != NULL);
5409 					dst = save_dst;
5410 					/*
5411 					 * re-enter the loop
5412 					 */
5413 					multirt_resolve_next = B_TRUE;
5414 					continue;
5415 				}
5416 
5417 				if (sire != NULL)
5418 					ire_refrele(sire);
5419 				ill_refrele(dst_ill);
5420 				ipif_refrele(src_ipif);
5421 				return;
5422 
5423 			case EINPROGRESS:
5424 				/*
5425 				 * mp was consumed - presumably queued.
5426 				 * No need for ire, presumably resolution is
5427 				 * in progress, and ire will be added when the
5428 				 * address is resolved.
5429 				 */
5430 				if (ip6_asp_table_held) {
5431 					ip6_asp_table_refrele(ipst);
5432 					ip6_asp_table_held = B_FALSE;
5433 				}
5434 				ASSERT(ire->ire_nce == NULL);
5435 				ire_delete(ire);
5436 				ire_refrele(save_ire);
5437 				/*
5438 				 * Check if another multirt route
5439 				 * must be resolved.
5440 				 */
5441 				ire = NULL;
5442 				if (copy_mp != NULL) {
5443 					/*
5444 					 * If we find a resolver, we ignore any
5445 					 * trailing top priority IRE_CACHE in
5446 					 * further loops. The reason is the
5447 					 * same as for noresolver.
5448 					 */
5449 					multirt_flags &= ~MULTIRT_CACHEGW;
5450 					/*
5451 					 * Search for the next unresolved
5452 					 * multirt route.
5453 					 */
5454 					first_mp = copy_mp;
5455 					copy_mp = NULL;
5456 					mp = first_mp;
5457 					if (mp->b_datap->db_type == M_CTL) {
5458 						mp = mp->b_cont;
5459 					}
5460 					ASSERT(sire != NULL);
5461 					dst = save_dst;
5462 					/*
5463 					 * re-enter the loop
5464 					 */
5465 					multirt_resolve_next = B_TRUE;
5466 					continue;
5467 				}
5468 				if (sire != NULL)
5469 					ire_refrele(sire);
5470 				ill_refrele(dst_ill);
5471 				ipif_refrele(src_ipif);
5472 				return;
5473 			default:
5474 				/* Some transient error */
5475 				ASSERT(ire->ire_nce == NULL);
5476 				ire_refrele(save_ire);
5477 				break;
5478 			}
5479 			break;
5480 		default:
5481 			break;
5482 		}
5483 		if (ip6_asp_table_held) {
5484 			ip6_asp_table_refrele(ipst);
5485 			ip6_asp_table_held = B_FALSE;
5486 		}
5487 	} while (multirt_resolve_next);
5488 
5489 err_ret:
5490 	ip1dbg(("ip_newroute_v6: dropped\n"));
5491 	if (src_ipif != NULL)
5492 		ipif_refrele(src_ipif);
5493 	if (dst_ill != NULL) {
5494 		need_rele = B_TRUE;
5495 		ill = dst_ill;
5496 	}
5497 	if (ill != NULL) {
5498 		if (mp->b_prev != NULL) {
5499 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
5500 		} else {
5501 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
5502 		}
5503 
5504 		if (need_rele)
5505 			ill_refrele(ill);
5506 	} else {
5507 		if (mp->b_prev != NULL) {
5508 			BUMP_MIB(&ipst->ips_ip6_mib, ipIfStatsInDiscards);
5509 		} else {
5510 			BUMP_MIB(&ipst->ips_ip6_mib, ipIfStatsOutDiscards);
5511 		}
5512 	}
5513 	/* Did this packet originate externally? */
5514 	if (mp->b_prev) {
5515 		mp->b_next = NULL;
5516 		mp->b_prev = NULL;
5517 	}
5518 	if (copy_mp != NULL) {
5519 		MULTIRT_DEBUG_UNTAG(copy_mp);
5520 		freemsg(copy_mp);
5521 	}
5522 	MULTIRT_DEBUG_UNTAG(first_mp);
5523 	freemsg(first_mp);
5524 	if (ire != NULL)
5525 		ire_refrele(ire);
5526 	if (sire != NULL)
5527 		ire_refrele(sire);
5528 	return;
5529 
5530 icmp_err_ret:
5531 	if (ip6_asp_table_held)
5532 		ip6_asp_table_refrele(ipst);
5533 	if (src_ipif != NULL)
5534 		ipif_refrele(src_ipif);
5535 	if (dst_ill != NULL) {
5536 		need_rele = B_TRUE;
5537 		ill = dst_ill;
5538 	}
5539 	ip1dbg(("ip_newroute_v6: no route\n"));
5540 	if (sire != NULL)
5541 		ire_refrele(sire);
5542 	/*
5543 	 * We need to set sire to NULL to avoid double freeing if we
5544 	 * ever goto err_ret from below.
5545 	 */
5546 	sire = NULL;
5547 	ip6h = (ip6_t *)mp->b_rptr;
5548 	/* Skip ip6i_t header if present */
5549 	if (ip6h->ip6_nxt == IPPROTO_RAW) {
5550 		/* Make sure the IPv6 header is present */
5551 		if ((mp->b_wptr - (uchar_t *)ip6h) <
5552 		    sizeof (ip6i_t) + IPV6_HDR_LEN) {
5553 			if (!pullupmsg(mp, sizeof (ip6i_t) + IPV6_HDR_LEN)) {
5554 				ip1dbg(("ip_newroute_v6: pullupmsg failed\n"));
5555 				goto err_ret;
5556 			}
5557 		}
5558 		mp->b_rptr += sizeof (ip6i_t);
5559 		ip6h = (ip6_t *)mp->b_rptr;
5560 	}
5561 	/* Did this packet originate externally? */
5562 	if (mp->b_prev) {
5563 		if (ill != NULL) {
5564 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInNoRoutes);
5565 		} else {
5566 			BUMP_MIB(&ipst->ips_ip6_mib, ipIfStatsInNoRoutes);
5567 		}
5568 		mp->b_next = NULL;
5569 		mp->b_prev = NULL;
5570 		q = WR(q);
5571 	} else {
5572 		if (ill != NULL) {
5573 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutNoRoutes);
5574 		} else {
5575 			BUMP_MIB(&ipst->ips_ip6_mib, ipIfStatsOutNoRoutes);
5576 		}
5577 		if (ip_hdr_complete_v6(ip6h, zoneid, ipst)) {
5578 			/* Failed */
5579 			if (copy_mp != NULL) {
5580 				MULTIRT_DEBUG_UNTAG(copy_mp);
5581 				freemsg(copy_mp);
5582 			}
5583 			MULTIRT_DEBUG_UNTAG(first_mp);
5584 			freemsg(first_mp);
5585 			if (ire != NULL)
5586 				ire_refrele(ire);
5587 			if (need_rele)
5588 				ill_refrele(ill);
5589 			return;
5590 		}
5591 	}
5592 
5593 	if (need_rele)
5594 		ill_refrele(ill);
5595 
5596 	/*
5597 	 * At this point we will have ire only if RTF_BLACKHOLE
5598 	 * or RTF_REJECT flags are set on the IRE. It will not
5599 	 * generate ICMP6_DST_UNREACH_NOROUTE if RTF_BLACKHOLE is set.
5600 	 */
5601 	if (ire != NULL) {
5602 		if (ire->ire_flags & RTF_BLACKHOLE) {
5603 			ire_refrele(ire);
5604 			if (copy_mp != NULL) {
5605 				MULTIRT_DEBUG_UNTAG(copy_mp);
5606 				freemsg(copy_mp);
5607 			}
5608 			MULTIRT_DEBUG_UNTAG(first_mp);
5609 			freemsg(first_mp);
5610 			return;
5611 		}
5612 		ire_refrele(ire);
5613 	}
5614 	if (ip_debug > 3) {
5615 		/* ip2dbg */
5616 		pr_addr_dbg("ip_newroute_v6: no route to %s\n",
5617 		    AF_INET6, v6dstp);
5618 	}
5619 	icmp_unreachable_v6(WR(q), first_mp, ICMP6_DST_UNREACH_NOROUTE,
5620 	    B_FALSE, B_FALSE, zoneid, ipst);
5621 }
5622 
5623 /*
5624  * ip_newroute_ipif_v6 is called by ip_wput_v6 and ip_wput_ipsec_out_v6 whenever
5625  * we need to send out a packet to a destination address for which we do not
5626  * have specific routing information. It is only used for multicast packets.
5627  *
5628  * If unspec_src we allow creating an IRE with source address zero.
5629  * ire_send_v6() will delete it after the packet is sent.
5630  */
5631 void
5632 ip_newroute_ipif_v6(queue_t *q, mblk_t *mp, ipif_t *ipif,
5633     in6_addr_t v6dst, int unspec_src, zoneid_t zoneid)
5634 {
5635 	ire_t	*ire = NULL;
5636 	ipif_t	*src_ipif = NULL;
5637 	int	err = 0;
5638 	ill_t	*dst_ill = NULL;
5639 	ire_t	*save_ire;
5640 	ushort_t ire_marks = 0;
5641 	ipsec_out_t *io;
5642 	ill_t *attach_ill = NULL;
5643 	ill_t *ill;
5644 	ip6_t *ip6h;
5645 	mblk_t *first_mp;
5646 	boolean_t ip6i_present;
5647 	ire_t *fire = NULL;
5648 	mblk_t  *copy_mp = NULL;
5649 	boolean_t multirt_resolve_next;
5650 	in6_addr_t *v6dstp = &v6dst;
5651 	boolean_t ipif_held = B_FALSE;
5652 	boolean_t ill_held = B_FALSE;
5653 	boolean_t ip6_asp_table_held = B_FALSE;
5654 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
5655 
5656 	/*
5657 	 * This loop is run only once in most cases.
5658 	 * We loop to resolve further routes only when the destination
5659 	 * can be reached through multiple RTF_MULTIRT-flagged ires.
5660 	 */
5661 	do {
5662 		multirt_resolve_next = B_FALSE;
5663 		if (dst_ill != NULL) {
5664 			ill_refrele(dst_ill);
5665 			dst_ill = NULL;
5666 		}
5667 
5668 		if (src_ipif != NULL) {
5669 			ipif_refrele(src_ipif);
5670 			src_ipif = NULL;
5671 		}
5672 		ASSERT(ipif != NULL);
5673 		ill = ipif->ipif_ill;
5674 
5675 		ASSERT(!IN6_IS_ADDR_V4MAPPED(v6dstp));
5676 		if (ip_debug > 2) {
5677 			/* ip1dbg */
5678 			pr_addr_dbg("ip_newroute_ipif_v6: v6dst %s\n",
5679 			    AF_INET6, v6dstp);
5680 			printf("ip_newroute_ipif_v6: if %s, v6 %d\n",
5681 			    ill->ill_name, ipif->ipif_isv6);
5682 		}
5683 
5684 		first_mp = mp;
5685 		if (mp->b_datap->db_type == M_CTL) {
5686 			mp = mp->b_cont;
5687 			io = (ipsec_out_t *)first_mp->b_rptr;
5688 			ASSERT(io->ipsec_out_type == IPSEC_OUT);
5689 		} else {
5690 			io = NULL;
5691 		}
5692 
5693 		/*
5694 		 * If the interface is a pt-pt interface we look for an
5695 		 * IRE_IF_RESOLVER or IRE_IF_NORESOLVER that matches both the
5696 		 * local_address and the pt-pt destination address.
5697 		 * Otherwise we just match the local address.
5698 		 */
5699 		if (!(ill->ill_flags & ILLF_MULTICAST)) {
5700 			goto err_ret;
5701 		}
5702 		/*
5703 		 * If this end point is bound to IPIF_NOFAILOVER, set bnf_ill
5704 		 * and bind_to_nofailover B_TRUE. We can't use conn to determine
5705 		 * as it could be NULL.
5706 		 *
5707 		 * This information can appear either in an ip6i_t or an
5708 		 * IPSEC_OUT message.
5709 		 */
5710 		ip6h = (ip6_t *)mp->b_rptr;
5711 		ip6i_present = (ip6h->ip6_nxt == IPPROTO_RAW);
5712 		if (ip6i_present || (io != NULL && io->ipsec_out_attach_if)) {
5713 			if (!ip6i_present ||
5714 			    ((ip6i_t *)ip6h)->ip6i_flags & IP6I_ATTACH_IF) {
5715 				attach_ill = ip_grab_attach_ill(ill, first_mp,
5716 				    (ip6i_present ?
5717 				    ((ip6i_t *)ip6h)->ip6i_ifindex :
5718 				    io->ipsec_out_ill_index), B_TRUE, ipst);
5719 				/* Failure case frees things for us. */
5720 				if (attach_ill == NULL)
5721 					return;
5722 
5723 				/*
5724 				 * Check if we need an ire that will not be
5725 				 * looked up by anybody else i.e. HIDDEN.
5726 				 */
5727 				if (ill_is_probeonly(attach_ill))
5728 					ire_marks = IRE_MARK_HIDDEN;
5729 			}
5730 		}
5731 
5732 		/*
5733 		 * We check if an IRE_OFFSUBNET for the addr that goes through
5734 		 * ipif exists. We need it to determine if the RTF_SETSRC and/or
5735 		 * RTF_MULTIRT flags must be honored.
5736 		 */
5737 		fire = ipif_lookup_multi_ire_v6(ipif, v6dstp);
5738 		ip2dbg(("ip_newroute_ipif_v6: "
5739 		    "ipif_lookup_multi_ire_v6("
5740 		    "ipif %p, dst %08x) = fire %p\n",
5741 		    (void *)ipif, ntohl(V4_PART_OF_V6((*v6dstp))),
5742 		    (void *)fire));
5743 
5744 		/*
5745 		 * If the application specified the ill (ifindex), we still
5746 		 * load spread. Only if the packets needs to go out specifically
5747 		 * on a given ill e.g. binding to IPIF_NOFAILOVER address or
5748 		 * IPV6_BOUND_PIF, or there is a parent ire entry that specified
5749 		 * multirouting, then we don't try to use a different ill for
5750 		 * load spreading.
5751 		 */
5752 		if (attach_ill == NULL) {
5753 			/*
5754 			 * If the interface belongs to an interface group,
5755 			 * make sure the next possible interface in the group
5756 			 * is used.  This encourages load spreading among peers
5757 			 * in an interface group.
5758 			 *
5759 			 * Note: While we pick a dst_ill we are really only
5760 			 * interested in the ill for load spreading. The source
5761 			 * ipif is determined by source address selection below.
5762 			 */
5763 			if ((fire != NULL) && (fire->ire_flags & RTF_MULTIRT)) {
5764 				dst_ill = ipif->ipif_ill;
5765 				/* For uniformity do a refhold */
5766 				ill_refhold(dst_ill);
5767 			} else {
5768 				/* refheld by ip_newroute_get_dst_ill_v6 */
5769 				dst_ill =
5770 				    ip_newroute_get_dst_ill_v6(ipif->ipif_ill);
5771 			}
5772 			if (dst_ill == NULL) {
5773 				if (ip_debug > 2) {
5774 					pr_addr_dbg("ip_newroute_ipif_v6: "
5775 					    "no dst ill for dst %s\n",
5776 					    AF_INET6, v6dstp);
5777 				}
5778 				goto err_ret;
5779 			}
5780 		} else {
5781 			dst_ill = ipif->ipif_ill;
5782 			/*
5783 			 * ip_wput_v6 passes the right ipif for IPIF_NOFAILOVER
5784 			 * and IPV6_BOUND_PIF case.
5785 			 */
5786 			ASSERT(dst_ill == attach_ill);
5787 			/* attach_ill is already refheld */
5788 		}
5789 		/*
5790 		 * Pick a source address which matches the scope of the
5791 		 * destination address.
5792 		 * For RTF_SETSRC routes, the source address is imposed by the
5793 		 * parent ire (fire).
5794 		 */
5795 		ASSERT(src_ipif == NULL);
5796 		if ((fire != NULL) && (fire->ire_flags & RTF_SETSRC)) {
5797 			/*
5798 			 * Check that the ipif matching the requested source
5799 			 * address still exists.
5800 			 */
5801 			src_ipif =
5802 			    ipif_lookup_addr_v6(&fire->ire_src_addr_v6,
5803 			    NULL, zoneid, NULL, NULL, NULL, NULL, ipst);
5804 		}
5805 		if (src_ipif == NULL && ip6_asp_can_lookup(ipst)) {
5806 			uint_t restrict_ill = RESTRICT_TO_NONE;
5807 
5808 			if (ip6i_present && ((ip6i_t *)ip6h)->ip6i_flags
5809 			    & IP6I_ATTACH_IF)
5810 				restrict_ill = RESTRICT_TO_ILL;
5811 			ip6_asp_table_held = B_TRUE;
5812 			src_ipif = ipif_select_source_v6(dst_ill, v6dstp,
5813 			    restrict_ill, IPV6_PREFER_SRC_DEFAULT, zoneid);
5814 		}
5815 
5816 		if (src_ipif == NULL) {
5817 			if (!unspec_src) {
5818 				if (ip_debug > 2) {
5819 					/* ip1dbg */
5820 					pr_addr_dbg("ip_newroute_ipif_v6: "
5821 					    "no src for dst %s\n,",
5822 					    AF_INET6, v6dstp);
5823 					printf(" through interface %s\n",
5824 					    dst_ill->ill_name);
5825 				}
5826 				goto err_ret;
5827 			}
5828 			src_ipif = ipif;
5829 			ipif_refhold(src_ipif);
5830 		}
5831 		ire = ipif_to_ire_v6(ipif);
5832 		if (ire == NULL) {
5833 			if (ip_debug > 2) {
5834 				/* ip1dbg */
5835 				pr_addr_dbg("ip_newroute_ipif_v6: v6src %s\n",
5836 				    AF_INET6, &ipif->ipif_v6lcl_addr);
5837 				printf("ip_newroute_ipif_v6: "
5838 				    "if %s\n", dst_ill->ill_name);
5839 			}
5840 			goto err_ret;
5841 		}
5842 		if (ire->ire_flags & (RTF_REJECT | RTF_BLACKHOLE))
5843 			goto err_ret;
5844 
5845 		ASSERT(ire->ire_ipversion == IPV6_VERSION);
5846 
5847 		ip1dbg(("ip_newroute_ipif_v6: interface type %s (%d),",
5848 		    ip_nv_lookup(ire_nv_tbl, ire->ire_type), ire->ire_type));
5849 		if (ip_debug > 2) {
5850 			/* ip1dbg */
5851 			pr_addr_dbg(" address %s\n",
5852 			    AF_INET6, &ire->ire_src_addr_v6);
5853 		}
5854 		save_ire = ire;
5855 		ip2dbg(("ip_newroute_ipif: ire %p, ipif %p\n",
5856 		    (void *)ire, (void *)ipif));
5857 
5858 		if ((fire != NULL) && (fire->ire_flags & RTF_MULTIRT)) {
5859 			/*
5860 			 * an IRE_OFFSUBET was looked up
5861 			 * on that interface.
5862 			 * this ire has RTF_MULTIRT flag,
5863 			 * so the resolution loop
5864 			 * will be re-entered to resolve
5865 			 * additional routes on other
5866 			 * interfaces. For that purpose,
5867 			 * a copy of the packet is
5868 			 * made at this point.
5869 			 */
5870 			fire->ire_last_used_time = lbolt;
5871 			copy_mp = copymsg(first_mp);
5872 			if (copy_mp) {
5873 				MULTIRT_DEBUG_TAG(copy_mp);
5874 			}
5875 		}
5876 
5877 		ASSERT((attach_ill == NULL) || (dst_ill == attach_ill));
5878 		switch (ire->ire_type) {
5879 		case IRE_IF_NORESOLVER: {
5880 			/*
5881 			 * We have what we need to build an IRE_CACHE.
5882 			 *
5883 			 * handle the Gated case, where we create
5884 			 * a NORESOLVER route for loopback.
5885 			 */
5886 			if (dst_ill->ill_net_type != IRE_IF_NORESOLVER)
5887 				break;
5888 			/*
5889 			 * The newly created ire will inherit the flags of the
5890 			 * parent ire, if any.
5891 			 */
5892 			ire = ire_create_v6(
5893 			    v6dstp,			/* dest address */
5894 			    &ipv6_all_ones,		/* mask */
5895 			    &src_ipif->ipif_v6src_addr, /* source address */
5896 			    NULL,			/* gateway address */
5897 			    &save_ire->ire_max_frag,
5898 			    NULL,			/* no src nce */
5899 			    dst_ill->ill_rq,		/* recv-from queue */
5900 			    dst_ill->ill_wq,		/* send-to queue */
5901 			    IRE_CACHE,
5902 			    src_ipif,
5903 			    NULL,
5904 			    (fire != NULL) ?		/* Parent handle */
5905 			    fire->ire_phandle : 0,
5906 			    save_ire->ire_ihandle,	/* Interface handle */
5907 			    (fire != NULL) ?
5908 			    (fire->ire_flags & (RTF_SETSRC | RTF_MULTIRT)) :
5909 			    0,
5910 			    &ire_uinfo_null,
5911 			    NULL,
5912 			    NULL,
5913 			    ipst);
5914 
5915 			if (ire == NULL) {
5916 				ire_refrele(save_ire);
5917 				break;
5918 			}
5919 
5920 			ire->ire_marks |= ire_marks;
5921 
5922 			err = ndp_noresolver(dst_ill, v6dstp);
5923 			if (err != 0) {
5924 				ire_refrele(save_ire);
5925 				break;
5926 			}
5927 
5928 			/* Prevent save_ire from getting deleted */
5929 			IRB_REFHOLD(save_ire->ire_bucket);
5930 			/* Has it been removed already ? */
5931 			if (save_ire->ire_marks & IRE_MARK_CONDEMNED) {
5932 				IRB_REFRELE(save_ire->ire_bucket);
5933 				ire_refrele(save_ire);
5934 				break;
5935 			}
5936 
5937 			ire_add_then_send(q, ire, first_mp);
5938 			if (ip6_asp_table_held) {
5939 				ip6_asp_table_refrele(ipst);
5940 				ip6_asp_table_held = B_FALSE;
5941 			}
5942 
5943 			/* Assert that it is not deleted yet. */
5944 			ASSERT(save_ire->ire_ptpn != NULL);
5945 			IRB_REFRELE(save_ire->ire_bucket);
5946 			ire_refrele(save_ire);
5947 			if (fire != NULL) {
5948 				ire_refrele(fire);
5949 				fire = NULL;
5950 			}
5951 
5952 			/*
5953 			 * The resolution loop is re-entered if we
5954 			 * actually are in a multirouting case.
5955 			 */
5956 			if (copy_mp != NULL) {
5957 				boolean_t need_resolve =
5958 				    ire_multirt_need_resolve_v6(v6dstp,
5959 				    MBLK_GETLABEL(copy_mp), ipst);
5960 				if (!need_resolve) {
5961 					MULTIRT_DEBUG_UNTAG(copy_mp);
5962 					freemsg(copy_mp);
5963 					copy_mp = NULL;
5964 				} else {
5965 					/*
5966 					 * ipif_lookup_group_v6() calls
5967 					 * ire_lookup_multi_v6() that uses
5968 					 * ire_ftable_lookup_v6() to find
5969 					 * an IRE_INTERFACE for the group.
5970 					 * In the multirt case,
5971 					 * ire_lookup_multi_v6() then invokes
5972 					 * ire_multirt_lookup_v6() to find
5973 					 * the next resolvable ire.
5974 					 * As a result, we obtain a new
5975 					 * interface, derived from the
5976 					 * next ire.
5977 					 */
5978 					if (ipif_held) {
5979 						ipif_refrele(ipif);
5980 						ipif_held = B_FALSE;
5981 					}
5982 					ipif = ipif_lookup_group_v6(v6dstp,
5983 					    zoneid, ipst);
5984 					ip2dbg(("ip_newroute_ipif: "
5985 					    "multirt dst %08x, ipif %p\n",
5986 					    ntohl(V4_PART_OF_V6((*v6dstp))),
5987 					    (void *)ipif));
5988 					if (ipif != NULL) {
5989 						ipif_held = B_TRUE;
5990 						mp = copy_mp;
5991 						copy_mp = NULL;
5992 						multirt_resolve_next =
5993 						    B_TRUE;
5994 						continue;
5995 					} else {
5996 						freemsg(copy_mp);
5997 					}
5998 				}
5999 			}
6000 			ill_refrele(dst_ill);
6001 			if (ipif_held) {
6002 				ipif_refrele(ipif);
6003 				ipif_held = B_FALSE;
6004 			}
6005 			if (src_ipif != NULL)
6006 				ipif_refrele(src_ipif);
6007 			return;
6008 		}
6009 		case IRE_IF_RESOLVER: {
6010 
6011 			ASSERT(dst_ill->ill_isv6);
6012 
6013 			/*
6014 			 * We obtain a partial IRE_CACHE which we will pass
6015 			 * along with the resolver query.  When the response
6016 			 * comes back it will be there ready for us to add.
6017 			 */
6018 			/*
6019 			 * the newly created ire will inherit the flags of the
6020 			 * parent ire, if any.
6021 			 */
6022 			ire = ire_create_v6(
6023 			    v6dstp,			/* dest address */
6024 			    &ipv6_all_ones,		/* mask */
6025 			    &src_ipif->ipif_v6src_addr, /* source address */
6026 			    NULL,			/* gateway address */
6027 			    &save_ire->ire_max_frag,
6028 			    NULL,			/* src nce */
6029 			    dst_ill->ill_rq,		/* recv-from queue */
6030 			    dst_ill->ill_wq,		/* send-to queue */
6031 			    IRE_CACHE,
6032 			    src_ipif,
6033 			    NULL,
6034 			    (fire != NULL) ?		/* Parent handle */
6035 			    fire->ire_phandle : 0,
6036 			    save_ire->ire_ihandle,	/* Interface handle */
6037 			    (fire != NULL) ?
6038 			    (fire->ire_flags & (RTF_SETSRC | RTF_MULTIRT)) :
6039 			    0,
6040 			    &ire_uinfo_null,
6041 			    NULL,
6042 			    NULL,
6043 			    ipst);
6044 
6045 			if (ire == NULL) {
6046 				ire_refrele(save_ire);
6047 				break;
6048 			}
6049 
6050 			ire->ire_marks |= ire_marks;
6051 
6052 			/* Resolve and add ire to the ctable */
6053 			err = ndp_resolver(dst_ill, v6dstp, first_mp, zoneid);
6054 			switch (err) {
6055 			case 0:
6056 				/* Prevent save_ire from getting deleted */
6057 				IRB_REFHOLD(save_ire->ire_bucket);
6058 				/* Has it been removed already ? */
6059 				if (save_ire->ire_marks & IRE_MARK_CONDEMNED) {
6060 					IRB_REFRELE(save_ire->ire_bucket);
6061 					ire_refrele(save_ire);
6062 					break;
6063 				}
6064 				/*
6065 				 * We have a resolved cache entry,
6066 				 * add in the IRE.
6067 				 */
6068 				ire_add_then_send(q, ire, first_mp);
6069 				if (ip6_asp_table_held) {
6070 					ip6_asp_table_refrele(ipst);
6071 					ip6_asp_table_held = B_FALSE;
6072 				}
6073 
6074 				/* Assert that it is not deleted yet. */
6075 				ASSERT(save_ire->ire_ptpn != NULL);
6076 				IRB_REFRELE(save_ire->ire_bucket);
6077 				ire_refrele(save_ire);
6078 				if (fire != NULL) {
6079 					ire_refrele(fire);
6080 					fire = NULL;
6081 				}
6082 
6083 				/*
6084 				 * The resolution loop is re-entered if we
6085 				 * actually are in a multirouting case.
6086 				 */
6087 				if (copy_mp != NULL) {
6088 					boolean_t need_resolve =
6089 					    ire_multirt_need_resolve_v6(v6dstp,
6090 					    MBLK_GETLABEL(copy_mp), ipst);
6091 					if (!need_resolve) {
6092 						MULTIRT_DEBUG_UNTAG(copy_mp);
6093 						freemsg(copy_mp);
6094 						copy_mp = NULL;
6095 					} else {
6096 						/*
6097 						 * ipif_lookup_group_v6() calls
6098 						 * ire_lookup_multi_v6() that
6099 						 * uses ire_ftable_lookup_v6()
6100 						 * to find an IRE_INTERFACE for
6101 						 * the group. In the multirt
6102 						 * case, ire_lookup_multi_v6()
6103 						 * then invokes
6104 						 * ire_multirt_lookup_v6() to
6105 						 * find the next resolvable ire.
6106 						 * As a result, we obtain a new
6107 						 * interface, derived from the
6108 						 * next ire.
6109 						 */
6110 						if (ipif_held) {
6111 							ipif_refrele(ipif);
6112 							ipif_held = B_FALSE;
6113 						}
6114 						ipif = ipif_lookup_group_v6(
6115 						    v6dstp, zoneid, ipst);
6116 						ip2dbg(("ip_newroute_ipif: "
6117 						    "multirt dst %08x, "
6118 						    "ipif %p\n",
6119 						    ntohl(V4_PART_OF_V6(
6120 						    (*v6dstp))),
6121 						    (void *)ipif));
6122 						if (ipif != NULL) {
6123 							ipif_held = B_TRUE;
6124 							mp = copy_mp;
6125 							copy_mp = NULL;
6126 							multirt_resolve_next =
6127 							    B_TRUE;
6128 							continue;
6129 						} else {
6130 							freemsg(copy_mp);
6131 						}
6132 					}
6133 				}
6134 				ill_refrele(dst_ill);
6135 				if (ipif_held) {
6136 					ipif_refrele(ipif);
6137 					ipif_held = B_FALSE;
6138 				}
6139 				if (src_ipif != NULL)
6140 					ipif_refrele(src_ipif);
6141 				return;
6142 
6143 			case EINPROGRESS:
6144 				/*
6145 				 * mp was consumed - presumably queued.
6146 				 * No need for ire, presumably resolution is
6147 				 * in progress, and ire will be added when the
6148 				 * address is resolved.
6149 				 */
6150 				if (ip6_asp_table_held) {
6151 					ip6_asp_table_refrele(ipst);
6152 					ip6_asp_table_held = B_FALSE;
6153 				}
6154 				ire_delete(ire);
6155 				ire_refrele(save_ire);
6156 				if (fire != NULL) {
6157 					ire_refrele(fire);
6158 					fire = NULL;
6159 				}
6160 
6161 				/*
6162 				 * The resolution loop is re-entered if we
6163 				 * actually are in a multirouting case.
6164 				 */
6165 				if (copy_mp != NULL) {
6166 					boolean_t need_resolve =
6167 					    ire_multirt_need_resolve_v6(v6dstp,
6168 					    MBLK_GETLABEL(copy_mp), ipst);
6169 					if (!need_resolve) {
6170 						MULTIRT_DEBUG_UNTAG(copy_mp);
6171 						freemsg(copy_mp);
6172 						copy_mp = NULL;
6173 					} else {
6174 						/*
6175 						 * ipif_lookup_group_v6() calls
6176 						 * ire_lookup_multi_v6() that
6177 						 * uses ire_ftable_lookup_v6()
6178 						 * to find an IRE_INTERFACE for
6179 						 * the group. In the multirt
6180 						 * case, ire_lookup_multi_v6()
6181 						 * then invokes
6182 						 * ire_multirt_lookup_v6() to
6183 						 * find the next resolvable ire.
6184 						 * As a result, we obtain a new
6185 						 * interface, derived from the
6186 						 * next ire.
6187 						 */
6188 						if (ipif_held) {
6189 							ipif_refrele(ipif);
6190 							ipif_held = B_FALSE;
6191 						}
6192 						ipif = ipif_lookup_group_v6(
6193 						    v6dstp, zoneid, ipst);
6194 						ip2dbg(("ip_newroute_ipif: "
6195 						    "multirt dst %08x, "
6196 						    "ipif %p\n",
6197 						    ntohl(V4_PART_OF_V6(
6198 						    (*v6dstp))),
6199 						    (void *)ipif));
6200 						if (ipif != NULL) {
6201 							ipif_held = B_TRUE;
6202 							mp = copy_mp;
6203 							copy_mp = NULL;
6204 							multirt_resolve_next =
6205 							    B_TRUE;
6206 							continue;
6207 						} else {
6208 							freemsg(copy_mp);
6209 						}
6210 					}
6211 				}
6212 				ill_refrele(dst_ill);
6213 				if (ipif_held) {
6214 					ipif_refrele(ipif);
6215 					ipif_held = B_FALSE;
6216 				}
6217 				if (src_ipif != NULL)
6218 					ipif_refrele(src_ipif);
6219 				return;
6220 			default:
6221 				/* Some transient error */
6222 				ire_refrele(save_ire);
6223 				break;
6224 			}
6225 			break;
6226 		}
6227 		default:
6228 			break;
6229 		}
6230 		if (ip6_asp_table_held) {
6231 			ip6_asp_table_refrele(ipst);
6232 			ip6_asp_table_held = B_FALSE;
6233 		}
6234 	} while (multirt_resolve_next);
6235 
6236 err_ret:
6237 	if (ip6_asp_table_held)
6238 		ip6_asp_table_refrele(ipst);
6239 	if (ire != NULL)
6240 		ire_refrele(ire);
6241 	if (fire != NULL)
6242 		ire_refrele(fire);
6243 	if (ipif != NULL && ipif_held)
6244 		ipif_refrele(ipif);
6245 	if (src_ipif != NULL)
6246 		ipif_refrele(src_ipif);
6247 	/* Multicast - no point in trying to generate ICMP error */
6248 	ASSERT((attach_ill == NULL) || (dst_ill == attach_ill));
6249 	if (dst_ill != NULL) {
6250 		ill = dst_ill;
6251 		ill_held = B_TRUE;
6252 	}
6253 	if (mp->b_prev || mp->b_next) {
6254 		BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
6255 	} else {
6256 		BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
6257 	}
6258 	ip1dbg(("ip_newroute_ipif_v6: dropped\n"));
6259 	mp->b_next = NULL;
6260 	mp->b_prev = NULL;
6261 	freemsg(first_mp);
6262 	if (ill_held)
6263 		ill_refrele(ill);
6264 }
6265 
6266 /*
6267  * Parse and process any hop-by-hop or destination options.
6268  *
6269  * Assumes that q is an ill read queue so that ICMP errors for link-local
6270  * destinations are sent out the correct interface.
6271  *
6272  * Returns -1 if there was an error and mp has been consumed.
6273  * Returns 0 if no special action is needed.
6274  * Returns 1 if the packet contained a router alert option for this node
6275  * which is verified to be "interesting/known" for our implementation.
6276  *
6277  * XXX Note: In future as more hbh or dest options are defined,
6278  * it may be better to have different routines for hbh and dest
6279  * options as opt_type fields other than IP6OPT_PAD1 and IP6OPT_PADN
6280  * may have same value in different namespaces. Or is it same namespace ??
6281  * Current code checks for each opt_type (other than pads) if it is in
6282  * the expected  nexthdr (hbh or dest)
6283  */
6284 static int
6285 ip_process_options_v6(queue_t *q, mblk_t *mp, ip6_t *ip6h,
6286     uint8_t *optptr, uint_t optlen, uint8_t hdr_type, ip_stack_t *ipst)
6287 {
6288 	uint8_t opt_type;
6289 	uint_t optused;
6290 	int ret = 0;
6291 	mblk_t *first_mp;
6292 	const char *errtype;
6293 	zoneid_t zoneid;
6294 	ill_t *ill = q->q_ptr;
6295 	ipif_t *ipif;
6296 
6297 	first_mp = mp;
6298 	if (mp->b_datap->db_type == M_CTL) {
6299 		mp = mp->b_cont;
6300 	}
6301 
6302 	while (optlen != 0) {
6303 		opt_type = *optptr;
6304 		if (opt_type == IP6OPT_PAD1) {
6305 			optused = 1;
6306 		} else {
6307 			if (optlen < 2)
6308 				goto bad_opt;
6309 			errtype = "malformed";
6310 			if (opt_type == ip6opt_ls) {
6311 				optused = 2 + optptr[1];
6312 				if (optused > optlen)
6313 					goto bad_opt;
6314 			} else switch (opt_type) {
6315 			case IP6OPT_PADN:
6316 				/*
6317 				 * Note:We don't verify that (N-2) pad octets
6318 				 * are zero as required by spec. Adhere to
6319 				 * "be liberal in what you accept..." part of
6320 				 * implementation philosophy (RFC791,RFC1122)
6321 				 */
6322 				optused = 2 + optptr[1];
6323 				if (optused > optlen)
6324 					goto bad_opt;
6325 				break;
6326 
6327 			case IP6OPT_JUMBO:
6328 				if (hdr_type != IPPROTO_HOPOPTS)
6329 					goto opt_error;
6330 				goto opt_error; /* XXX Not implemented! */
6331 
6332 			case IP6OPT_ROUTER_ALERT: {
6333 				struct ip6_opt_router *or;
6334 
6335 				if (hdr_type != IPPROTO_HOPOPTS)
6336 					goto opt_error;
6337 				optused = 2 + optptr[1];
6338 				if (optused > optlen)
6339 					goto bad_opt;
6340 				or = (struct ip6_opt_router *)optptr;
6341 				/* Check total length and alignment */
6342 				if (optused != sizeof (*or) ||
6343 				    ((uintptr_t)or->ip6or_value & 0x1) != 0)
6344 					goto opt_error;
6345 				/* Check value */
6346 				switch (*((uint16_t *)or->ip6or_value)) {
6347 				case IP6_ALERT_MLD:
6348 				case IP6_ALERT_RSVP:
6349 					ret = 1;
6350 				}
6351 				break;
6352 			}
6353 			case IP6OPT_HOME_ADDRESS: {
6354 				/*
6355 				 * Minimal support for the home address option
6356 				 * (which is required by all IPv6 nodes).
6357 				 * Implement by just swapping the home address
6358 				 * and source address.
6359 				 * XXX Note: this has IPsec implications since
6360 				 * AH needs to take this into account.
6361 				 * Also, when IPsec is used we need to ensure
6362 				 * that this is only processed once
6363 				 * in the received packet (to avoid swapping
6364 				 * back and forth).
6365 				 * NOTE:This option processing is considered
6366 				 * to be unsafe and prone to a denial of
6367 				 * service attack.
6368 				 * The current processing is not safe even with
6369 				 * IPsec secured IP packets. Since the home
6370 				 * address option processing requirement still
6371 				 * is in the IETF draft and in the process of
6372 				 * being redefined for its usage, it has been
6373 				 * decided to turn off the option by default.
6374 				 * If this section of code needs to be executed,
6375 				 * ndd variable ip6_ignore_home_address_opt
6376 				 * should be set to 0 at the user's own risk.
6377 				 */
6378 				struct ip6_opt_home_address *oh;
6379 				in6_addr_t tmp;
6380 
6381 				if (ipst->ips_ipv6_ignore_home_address_opt)
6382 					goto opt_error;
6383 
6384 				if (hdr_type != IPPROTO_DSTOPTS)
6385 					goto opt_error;
6386 				optused = 2 + optptr[1];
6387 				if (optused > optlen)
6388 					goto bad_opt;
6389 
6390 				/*
6391 				 * We did this dest. opt the first time
6392 				 * around (i.e. before AH processing).
6393 				 * If we've done AH... stop now.
6394 				 */
6395 				if (first_mp != mp) {
6396 					ipsec_in_t *ii;
6397 
6398 					ii = (ipsec_in_t *)first_mp->b_rptr;
6399 					if (ii->ipsec_in_ah_sa != NULL)
6400 						break;
6401 				}
6402 
6403 				oh = (struct ip6_opt_home_address *)optptr;
6404 				/* Check total length and alignment */
6405 				if (optused < sizeof (*oh) ||
6406 				    ((uintptr_t)oh->ip6oh_addr & 0x7) != 0)
6407 					goto opt_error;
6408 				/* Swap ip6_src and the home address */
6409 				tmp = ip6h->ip6_src;
6410 				/* XXX Note: only 8 byte alignment option */
6411 				ip6h->ip6_src = *(in6_addr_t *)oh->ip6oh_addr;
6412 				*(in6_addr_t *)oh->ip6oh_addr = tmp;
6413 				break;
6414 			}
6415 
6416 			case IP6OPT_TUNNEL_LIMIT:
6417 				if (hdr_type != IPPROTO_DSTOPTS) {
6418 					goto opt_error;
6419 				}
6420 				optused = 2 + optptr[1];
6421 				if (optused > optlen) {
6422 					goto bad_opt;
6423 				}
6424 				if (optused != 3) {
6425 					goto opt_error;
6426 				}
6427 				break;
6428 
6429 			default:
6430 				errtype = "unknown";
6431 				/* FALLTHROUGH */
6432 			opt_error:
6433 				/* Determine which zone should send error */
6434 				zoneid = ipif_lookup_addr_zoneid_v6(
6435 				    &ip6h->ip6_dst, ill, ipst);
6436 				switch (IP6OPT_TYPE(opt_type)) {
6437 				case IP6OPT_TYPE_SKIP:
6438 					optused = 2 + optptr[1];
6439 					if (optused > optlen)
6440 						goto bad_opt;
6441 					ip1dbg(("ip_process_options_v6: %s "
6442 					    "opt 0x%x skipped\n",
6443 					    errtype, opt_type));
6444 					break;
6445 				case IP6OPT_TYPE_DISCARD:
6446 					ip1dbg(("ip_process_options_v6: %s "
6447 					    "opt 0x%x; packet dropped\n",
6448 					    errtype, opt_type));
6449 					freemsg(first_mp);
6450 					return (-1);
6451 				case IP6OPT_TYPE_ICMP:
6452 					if (zoneid == ALL_ZONES) {
6453 						freemsg(first_mp);
6454 						return (-1);
6455 					}
6456 					icmp_param_problem_v6(WR(q), first_mp,
6457 					    ICMP6_PARAMPROB_OPTION,
6458 					    (uint32_t)(optptr -
6459 					    (uint8_t *)ip6h),
6460 					    B_FALSE, B_FALSE, zoneid, ipst);
6461 					return (-1);
6462 				case IP6OPT_TYPE_FORCEICMP:
6463 					/*
6464 					 * If we don't have a zone and the dst
6465 					 * addr is multicast, then pick a zone
6466 					 * based on the inbound interface.
6467 					 */
6468 					if (zoneid == ALL_ZONES &&
6469 					    IN6_IS_ADDR_MULTICAST(
6470 					    &ip6h->ip6_dst)) {
6471 						ipif = ipif_select_source_v6(
6472 						    ill, &ip6h->ip6_src,
6473 						    RESTRICT_TO_GROUP,
6474 						    IPV6_PREFER_SRC_DEFAULT,
6475 						    ALL_ZONES);
6476 						if (ipif != NULL) {
6477 							zoneid =
6478 							    ipif->ipif_zoneid;
6479 							ipif_refrele(ipif);
6480 						}
6481 					}
6482 					if (zoneid == ALL_ZONES) {
6483 						freemsg(first_mp);
6484 						return (-1);
6485 					}
6486 					icmp_param_problem_v6(WR(q), first_mp,
6487 					    ICMP6_PARAMPROB_OPTION,
6488 					    (uint32_t)(optptr -
6489 					    (uint8_t *)ip6h),
6490 					    B_FALSE, B_TRUE, zoneid, ipst);
6491 					return (-1);
6492 				default:
6493 					ASSERT(0);
6494 				}
6495 			}
6496 		}
6497 		optlen -= optused;
6498 		optptr += optused;
6499 	}
6500 	return (ret);
6501 
6502 bad_opt:
6503 	/* Determine which zone should send error */
6504 	zoneid = ipif_lookup_addr_zoneid_v6(&ip6h->ip6_dst, ill, ipst);
6505 	if (zoneid == ALL_ZONES) {
6506 		freemsg(first_mp);
6507 	} else {
6508 		icmp_param_problem_v6(WR(q), first_mp, ICMP6_PARAMPROB_OPTION,
6509 		    (uint32_t)(optptr - (uint8_t *)ip6h),
6510 		    B_FALSE, B_FALSE, zoneid, ipst);
6511 	}
6512 	return (-1);
6513 }
6514 
6515 /*
6516  * Process a routing header that is not yet empty.
6517  * Only handles type 0 routing headers.
6518  */
6519 static void
6520 ip_process_rthdr(queue_t *q, mblk_t *mp, ip6_t *ip6h, ip6_rthdr_t *rth,
6521     ill_t *ill, uint_t flags, mblk_t *hada_mp, mblk_t *dl_mp)
6522 {
6523 	ip6_rthdr0_t *rthdr;
6524 	uint_t ehdrlen;
6525 	uint_t numaddr;
6526 	in6_addr_t *addrptr;
6527 	in6_addr_t tmp;
6528 	ip_stack_t	*ipst = ill->ill_ipst;
6529 
6530 	ASSERT(rth->ip6r_segleft != 0);
6531 
6532 	if (!ipst->ips_ipv6_forward_src_routed) {
6533 		/* XXX Check for source routed out same interface? */
6534 		BUMP_MIB(ill->ill_ip_mib, ipIfStatsForwProhibits);
6535 		BUMP_MIB(ill->ill_ip_mib, ipIfStatsInAddrErrors);
6536 		freemsg(hada_mp);
6537 		freemsg(mp);
6538 		return;
6539 	}
6540 
6541 	if (rth->ip6r_type != 0) {
6542 		if (hada_mp != NULL)
6543 			goto hada_drop;
6544 		/* Sent by forwarding path, and router is global zone */
6545 		icmp_param_problem_v6(WR(q), mp,
6546 		    ICMP6_PARAMPROB_HEADER,
6547 		    (uint32_t)((uchar_t *)&rth->ip6r_type - (uchar_t *)ip6h),
6548 		    B_FALSE, B_FALSE, GLOBAL_ZONEID, ipst);
6549 		return;
6550 	}
6551 	rthdr = (ip6_rthdr0_t *)rth;
6552 	ehdrlen = 8 * (rthdr->ip6r0_len + 1);
6553 	ASSERT(mp->b_rptr + ehdrlen <= mp->b_wptr);
6554 	addrptr = (in6_addr_t *)((char *)rthdr + sizeof (*rthdr));
6555 	/* rthdr->ip6r0_len is twice the number of addresses in the header */
6556 	if (rthdr->ip6r0_len & 0x1) {
6557 		/* An odd length is impossible */
6558 		if (hada_mp != NULL)
6559 			goto hada_drop;
6560 		/* Sent by forwarding path, and router is global zone */
6561 		icmp_param_problem_v6(WR(q), mp,
6562 		    ICMP6_PARAMPROB_HEADER,
6563 		    (uint32_t)((uchar_t *)&rthdr->ip6r0_len - (uchar_t *)ip6h),
6564 		    B_FALSE, B_FALSE, GLOBAL_ZONEID, ipst);
6565 		return;
6566 	}
6567 	numaddr = rthdr->ip6r0_len / 2;
6568 	if (rthdr->ip6r0_segleft > numaddr) {
6569 		/* segleft exceeds number of addresses in routing header */
6570 		if (hada_mp != NULL)
6571 			goto hada_drop;
6572 		/* Sent by forwarding path, and router is global zone */
6573 		icmp_param_problem_v6(WR(q), mp,
6574 		    ICMP6_PARAMPROB_HEADER,
6575 		    (uint32_t)((uchar_t *)&rthdr->ip6r0_segleft -
6576 		    (uchar_t *)ip6h),
6577 		    B_FALSE, B_FALSE, GLOBAL_ZONEID, ipst);
6578 		return;
6579 	}
6580 	addrptr += (numaddr - rthdr->ip6r0_segleft);
6581 	if (IN6_IS_ADDR_MULTICAST(&ip6h->ip6_dst) ||
6582 	    IN6_IS_ADDR_MULTICAST(addrptr)) {
6583 		BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
6584 		freemsg(hada_mp);
6585 		freemsg(mp);
6586 		return;
6587 	}
6588 	/* Swap */
6589 	tmp = *addrptr;
6590 	*addrptr = ip6h->ip6_dst;
6591 	ip6h->ip6_dst = tmp;
6592 	rthdr->ip6r0_segleft--;
6593 	/* Don't allow any mapped addresses - ip_wput_v6 can't handle them */
6594 	if (IN6_IS_ADDR_V4MAPPED(&ip6h->ip6_dst)) {
6595 		if (hada_mp != NULL)
6596 			goto hada_drop;
6597 		/* Sent by forwarding path, and router is global zone */
6598 		icmp_unreachable_v6(WR(q), mp, ICMP6_DST_UNREACH_NOROUTE,
6599 		    B_FALSE, B_FALSE, GLOBAL_ZONEID, ipst);
6600 		return;
6601 	}
6602 	if (ip_check_v6_mblk(mp, ill) == IP6_MBLK_OK) {
6603 		ip6h = (ip6_t *)mp->b_rptr;
6604 		ip_rput_data_v6(q, ill, mp, ip6h, flags, hada_mp, dl_mp);
6605 	} else {
6606 		freemsg(mp);
6607 	}
6608 	return;
6609 hada_drop:
6610 	/* IPsec kstats: bean counter? */
6611 	freemsg(hada_mp);
6612 	freemsg(mp);
6613 }
6614 
6615 /*
6616  * Read side put procedure for IPv6 module.
6617  */
6618 void
6619 ip_rput_v6(queue_t *q, mblk_t *mp)
6620 {
6621 	mblk_t		*first_mp;
6622 	mblk_t		*hada_mp = NULL;
6623 	ip6_t		*ip6h;
6624 	boolean_t	ll_multicast = B_FALSE;
6625 	boolean_t	mctl_present = B_FALSE;
6626 	ill_t		*ill;
6627 	struct iocblk	*iocp;
6628 	uint_t 		flags = 0;
6629 	mblk_t		*dl_mp;
6630 	ip_stack_t	*ipst;
6631 	int		check;
6632 
6633 	ill = (ill_t *)q->q_ptr;
6634 	ipst = ill->ill_ipst;
6635 	if (ill->ill_state_flags & ILL_CONDEMNED) {
6636 		union DL_primitives *dl;
6637 
6638 		dl = (union DL_primitives *)mp->b_rptr;
6639 		/*
6640 		 * Things are opening or closing - only accept DLPI
6641 		 * ack messages. If the stream is closing and ip_wsrv
6642 		 * has completed, ip_close is out of the qwait, but has
6643 		 * not yet completed qprocsoff. Don't proceed any further
6644 		 * because the ill has been cleaned up and things hanging
6645 		 * off the ill have been freed.
6646 		 */
6647 		if ((mp->b_datap->db_type != M_PCPROTO) ||
6648 		    (dl->dl_primitive == DL_UNITDATA_IND)) {
6649 			inet_freemsg(mp);
6650 			return;
6651 		}
6652 	}
6653 
6654 	dl_mp = NULL;
6655 	switch (mp->b_datap->db_type) {
6656 	case M_DATA: {
6657 		int hlen;
6658 		uchar_t *ucp;
6659 		struct ether_header *eh;
6660 		dl_unitdata_ind_t *dui;
6661 
6662 		/*
6663 		 * This is a work-around for CR 6451644, a bug in Nemo.  It
6664 		 * should be removed when that problem is fixed.
6665 		 */
6666 		if (ill->ill_mactype == DL_ETHER &&
6667 		    (hlen = MBLKHEAD(mp)) >= sizeof (struct ether_header) &&
6668 		    (ucp = mp->b_rptr)[-1] == (IP6_DL_SAP & 0xFF) &&
6669 		    ucp[-2] == (IP6_DL_SAP >> 8)) {
6670 			if (hlen >= sizeof (struct ether_vlan_header) &&
6671 			    ucp[-5] == 0 && ucp[-6] == 0x81)
6672 				ucp -= sizeof (struct ether_vlan_header);
6673 			else
6674 				ucp -= sizeof (struct ether_header);
6675 			/*
6676 			 * If it's a group address, then fabricate a
6677 			 * DL_UNITDATA_IND message.
6678 			 */
6679 			if ((ll_multicast = (ucp[0] & 1)) != 0 &&
6680 			    (dl_mp = allocb(DL_UNITDATA_IND_SIZE + 16,
6681 			    BPRI_HI)) != NULL) {
6682 				eh = (struct ether_header *)ucp;
6683 				dui = (dl_unitdata_ind_t *)dl_mp->b_rptr;
6684 				DB_TYPE(dl_mp) = M_PROTO;
6685 				dl_mp->b_wptr = (uchar_t *)(dui + 1) + 16;
6686 				dui->dl_primitive = DL_UNITDATA_IND;
6687 				dui->dl_dest_addr_length = 8;
6688 				dui->dl_dest_addr_offset = DL_UNITDATA_IND_SIZE;
6689 				dui->dl_src_addr_length = 8;
6690 				dui->dl_src_addr_offset = DL_UNITDATA_IND_SIZE +
6691 				    8;
6692 				dui->dl_group_address = 1;
6693 				ucp = (uchar_t *)(dui + 1);
6694 				if (ill->ill_sap_length > 0)
6695 					ucp += ill->ill_sap_length;
6696 				bcopy(&eh->ether_dhost, ucp, 6);
6697 				bcopy(&eh->ether_shost, ucp + 8, 6);
6698 				ucp = (uchar_t *)(dui + 1);
6699 				if (ill->ill_sap_length < 0)
6700 					ucp += 8 + ill->ill_sap_length;
6701 				bcopy(&eh->ether_type, ucp, 2);
6702 				bcopy(&eh->ether_type, ucp + 8, 2);
6703 			}
6704 		}
6705 		break;
6706 	}
6707 
6708 	case M_PROTO:
6709 	case M_PCPROTO:
6710 		if (((dl_unitdata_ind_t *)mp->b_rptr)->dl_primitive !=
6711 		    DL_UNITDATA_IND) {
6712 			/* Go handle anything other than data elsewhere. */
6713 			ip_rput_dlpi(q, mp);
6714 			return;
6715 		}
6716 		ll_multicast = ip_get_dlpi_mbcast(ill, mp);
6717 
6718 		/* Save the DLPI header. */
6719 		dl_mp = mp;
6720 		mp = mp->b_cont;
6721 		dl_mp->b_cont = NULL;
6722 		break;
6723 	case M_BREAK:
6724 		panic("ip_rput_v6: got an M_BREAK");
6725 		/*NOTREACHED*/
6726 	case M_IOCACK:
6727 		iocp = (struct iocblk *)mp->b_rptr;
6728 		switch (iocp->ioc_cmd) {
6729 		case DL_IOC_HDR_INFO:
6730 			ill = (ill_t *)q->q_ptr;
6731 			ill_fastpath_ack(ill, mp);
6732 			return;
6733 
6734 		case SIOCGTUNPARAM:
6735 		case OSIOCGTUNPARAM:
6736 			ip_rput_other(NULL, q, mp, NULL);
6737 			return;
6738 
6739 		case SIOCSTUNPARAM:
6740 		case OSIOCSTUNPARAM:
6741 			/* Go through qwriter */
6742 			break;
6743 		default:
6744 			putnext(q, mp);
6745 			return;
6746 		}
6747 		/* FALLTHRU */
6748 	case M_ERROR:
6749 	case M_HANGUP:
6750 		mutex_enter(&ill->ill_lock);
6751 		if (ill->ill_state_flags & ILL_CONDEMNED) {
6752 			mutex_exit(&ill->ill_lock);
6753 			freemsg(mp);
6754 			return;
6755 		}
6756 		ill_refhold_locked(ill);
6757 		mutex_exit(&ill->ill_lock);
6758 		qwriter_ip(ill, q, mp, ip_rput_other, CUR_OP, B_FALSE);
6759 		return;
6760 	case M_CTL:
6761 		if ((MBLKL(mp) > sizeof (int)) &&
6762 		    ((da_ipsec_t *)mp->b_rptr)->da_type == IPHADA_M_CTL) {
6763 			ASSERT(MBLKL(mp) >= sizeof (da_ipsec_t));
6764 			mctl_present = B_TRUE;
6765 			break;
6766 		}
6767 		putnext(q, mp);
6768 		return;
6769 	case M_IOCNAK:
6770 		iocp = (struct iocblk *)mp->b_rptr;
6771 		switch (iocp->ioc_cmd) {
6772 		case DL_IOC_HDR_INFO:
6773 		case SIOCGTUNPARAM:
6774 		case OSIOCGTUNPARAM:
6775 			ip_rput_other(NULL, q, mp, NULL);
6776 			return;
6777 
6778 		case SIOCSTUNPARAM:
6779 		case OSIOCSTUNPARAM:
6780 			mutex_enter(&ill->ill_lock);
6781 			if (ill->ill_state_flags & ILL_CONDEMNED) {
6782 				mutex_exit(&ill->ill_lock);
6783 				freemsg(mp);
6784 				return;
6785 			}
6786 			ill_refhold_locked(ill);
6787 			mutex_exit(&ill->ill_lock);
6788 			qwriter_ip(ill, q, mp, ip_rput_other, CUR_OP, B_FALSE);
6789 			return;
6790 		default:
6791 			break;
6792 		}
6793 		/* FALLTHRU */
6794 	default:
6795 		putnext(q, mp);
6796 		return;
6797 	}
6798 	BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInReceives);
6799 	UPDATE_MIB(ill->ill_ip_mib, ipIfStatsHCInOctets,
6800 	    (mp->b_cont == NULL) ? MBLKL(mp) : msgdsize(mp));
6801 	/*
6802 	 * if db_ref > 1 then copymsg and free original. Packet may be
6803 	 * changed and do not want other entity who has a reference to this
6804 	 * message to trip over the changes. This is a blind change because
6805 	 * trying to catch all places that might change packet is too
6806 	 * difficult (since it may be a module above this one).
6807 	 */
6808 	if (mp->b_datap->db_ref > 1) {
6809 		mblk_t  *mp1;
6810 
6811 		mp1 = copymsg(mp);
6812 		freemsg(mp);
6813 		if (mp1 == NULL) {
6814 			first_mp = NULL;
6815 			goto discard;
6816 		}
6817 		mp = mp1;
6818 	}
6819 	first_mp = mp;
6820 	if (mctl_present) {
6821 		hada_mp = first_mp;
6822 		mp = first_mp->b_cont;
6823 	}
6824 
6825 	if ((check = ip_check_v6_mblk(mp, ill)) == IP6_MBLK_HDR_ERR) {
6826 		freemsg(mp);
6827 		return;
6828 	}
6829 
6830 	ip6h = (ip6_t *)mp->b_rptr;
6831 
6832 	/*
6833 	 * ip:::receive must see ipv6 packets with a full header,
6834 	 * and so is placed after the IP6_MBLK_HDR_ERR check.
6835 	 */
6836 	DTRACE_IP7(receive, mblk_t *, first_mp, conn_t *, NULL, void_ip_t *,
6837 	    ip6h, __dtrace_ipsr_ill_t *, ill, ipha_t *, NULL, ip6_t *, ip6h,
6838 	    int, 0);
6839 
6840 	if (check != IP6_MBLK_OK) {
6841 		freemsg(mp);
6842 		return;
6843 	}
6844 
6845 	DTRACE_PROBE4(ip6__physical__in__start,
6846 	    ill_t *, ill, ill_t *, NULL,
6847 	    ip6_t *, ip6h, mblk_t *, first_mp);
6848 
6849 	FW_HOOKS6(ipst->ips_ip6_physical_in_event,
6850 	    ipst->ips_ipv6firewall_physical_in,
6851 	    ill, NULL, ip6h, first_mp, mp, ll_multicast, ipst);
6852 
6853 	DTRACE_PROBE1(ip6__physical__in__end, mblk_t *, first_mp);
6854 
6855 	if (first_mp == NULL)
6856 		return;
6857 
6858 	if ((ip6h->ip6_vcf & IPV6_VERS_AND_FLOW_MASK) ==
6859 	    IPV6_DEFAULT_VERS_AND_FLOW) {
6860 		/*
6861 		 * It may be a bit too expensive to do this mapped address
6862 		 * check here, but in the interest of robustness, it seems
6863 		 * like the correct place.
6864 		 * TODO: Avoid this check for e.g. connected TCP sockets
6865 		 */
6866 		if (IN6_IS_ADDR_V4MAPPED(&ip6h->ip6_src)) {
6867 			ip1dbg(("ip_rput_v6: pkt with mapped src addr\n"));
6868 			goto discard;
6869 		}
6870 
6871 		if (IN6_IS_ADDR_LOOPBACK(&ip6h->ip6_src)) {
6872 			ip1dbg(("ip_rput_v6: pkt with loopback src"));
6873 			goto discard;
6874 		} else if (IN6_IS_ADDR_LOOPBACK(&ip6h->ip6_dst)) {
6875 			ip1dbg(("ip_rput_v6: pkt with loopback dst"));
6876 			goto discard;
6877 		}
6878 
6879 		flags |= (ll_multicast ? IP6_IN_LLMCAST : 0);
6880 		ip_rput_data_v6(q, ill, mp, ip6h, flags, hada_mp, dl_mp);
6881 	} else {
6882 		BUMP_MIB(ill->ill_ip_mib, ipIfStatsInWrongIPVersion);
6883 		goto discard;
6884 	}
6885 	freemsg(dl_mp);
6886 	return;
6887 
6888 discard:
6889 	if (dl_mp != NULL)
6890 		freeb(dl_mp);
6891 	freemsg(first_mp);
6892 	BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
6893 }
6894 
6895 /*
6896  * Walk through the IPv6 packet in mp and see if there's an AH header
6897  * in it.  See if the AH header needs to get done before other headers in
6898  * the packet.  (Worker function for ipsec_early_ah_v6().)
6899  */
6900 #define	IPSEC_HDR_DONT_PROCESS	0
6901 #define	IPSEC_HDR_PROCESS	1
6902 #define	IPSEC_MEMORY_ERROR	2
6903 static int
6904 ipsec_needs_processing_v6(mblk_t *mp, uint8_t *nexthdr)
6905 {
6906 	uint_t	length;
6907 	uint_t	ehdrlen;
6908 	uint8_t *whereptr;
6909 	uint8_t *endptr;
6910 	uint8_t *nexthdrp;
6911 	ip6_dest_t *desthdr;
6912 	ip6_rthdr_t *rthdr;
6913 	ip6_t	*ip6h;
6914 
6915 	/*
6916 	 * For now just pullup everything.  In general, the less pullups,
6917 	 * the better, but there's so much squirrelling through anyway,
6918 	 * it's just easier this way.
6919 	 */
6920 	if (!pullupmsg(mp, -1)) {
6921 		return (IPSEC_MEMORY_ERROR);
6922 	}
6923 
6924 	ip6h = (ip6_t *)mp->b_rptr;
6925 	length = IPV6_HDR_LEN;
6926 	whereptr = ((uint8_t *)&ip6h[1]); /* point to next hdr */
6927 	endptr = mp->b_wptr;
6928 
6929 	/*
6930 	 * We can't just use the argument nexthdr in the place
6931 	 * of nexthdrp becaue we don't dereference nexthdrp
6932 	 * till we confirm whether it is a valid address.
6933 	 */
6934 	nexthdrp = &ip6h->ip6_nxt;
6935 	while (whereptr < endptr) {
6936 		/* Is there enough left for len + nexthdr? */
6937 		if (whereptr + MIN_EHDR_LEN > endptr)
6938 			return (IPSEC_MEMORY_ERROR);
6939 
6940 		switch (*nexthdrp) {
6941 		case IPPROTO_HOPOPTS:
6942 		case IPPROTO_DSTOPTS:
6943 			/* Assumes the headers are identical for hbh and dst */
6944 			desthdr = (ip6_dest_t *)whereptr;
6945 			ehdrlen = 8 * (desthdr->ip6d_len + 1);
6946 			if ((uchar_t *)desthdr +  ehdrlen > endptr)
6947 				return (IPSEC_MEMORY_ERROR);
6948 			/*
6949 			 * Return DONT_PROCESS because the destination
6950 			 * options header may be for each hop in a
6951 			 * routing-header, and we only want AH if we're
6952 			 * finished with routing headers.
6953 			 */
6954 			if (*nexthdrp == IPPROTO_DSTOPTS)
6955 				return (IPSEC_HDR_DONT_PROCESS);
6956 			nexthdrp = &desthdr->ip6d_nxt;
6957 			break;
6958 		case IPPROTO_ROUTING:
6959 			rthdr = (ip6_rthdr_t *)whereptr;
6960 
6961 			/*
6962 			 * If there's more hops left on the routing header,
6963 			 * return now with DON'T PROCESS.
6964 			 */
6965 			if (rthdr->ip6r_segleft > 0)
6966 				return (IPSEC_HDR_DONT_PROCESS);
6967 
6968 			ehdrlen =  8 * (rthdr->ip6r_len + 1);
6969 			if ((uchar_t *)rthdr +  ehdrlen > endptr)
6970 				return (IPSEC_MEMORY_ERROR);
6971 			nexthdrp = &rthdr->ip6r_nxt;
6972 			break;
6973 		case IPPROTO_FRAGMENT:
6974 			/* Wait for reassembly */
6975 			return (IPSEC_HDR_DONT_PROCESS);
6976 		case IPPROTO_AH:
6977 			*nexthdr = IPPROTO_AH;
6978 			return (IPSEC_HDR_PROCESS);
6979 		case IPPROTO_NONE:
6980 			/* No next header means we're finished */
6981 		default:
6982 			return (IPSEC_HDR_DONT_PROCESS);
6983 		}
6984 		length += ehdrlen;
6985 		whereptr += ehdrlen;
6986 	}
6987 	panic("ipsec_needs_processing_v6");
6988 	/*NOTREACHED*/
6989 }
6990 
6991 /*
6992  * Path for AH if options are present. If this is the first time we are
6993  * sending a datagram to AH, allocate a IPSEC_IN message and prepend it.
6994  * Otherwise, just fanout.  Return value answers the boolean question:
6995  * "Did I consume the mblk you sent me?"
6996  *
6997  * Sometimes AH needs to be done before other IPv6 headers for security
6998  * reasons.  This function (and its ipsec_needs_processing_v6() above)
6999  * indicates if that is so, and fans out to the appropriate IPsec protocol
7000  * for the datagram passed in.
7001  */
7002 static boolean_t
7003 ipsec_early_ah_v6(queue_t *q, mblk_t *first_mp, boolean_t mctl_present,
7004     ill_t *ill, mblk_t *hada_mp, zoneid_t zoneid)
7005 {
7006 	mblk_t *mp;
7007 	uint8_t nexthdr;
7008 	ipsec_in_t *ii = NULL;
7009 	ah_t *ah;
7010 	ipsec_status_t ipsec_rc;
7011 	ip_stack_t	*ipst = ill->ill_ipst;
7012 	netstack_t	*ns = ipst->ips_netstack;
7013 	ipsec_stack_t	*ipss = ns->netstack_ipsec;
7014 
7015 	ASSERT((hada_mp == NULL) || (!mctl_present));
7016 
7017 	switch (ipsec_needs_processing_v6(
7018 	    (mctl_present ? first_mp->b_cont : first_mp), &nexthdr)) {
7019 	case IPSEC_MEMORY_ERROR:
7020 		BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
7021 		freemsg(hada_mp);
7022 		freemsg(first_mp);
7023 		return (B_TRUE);
7024 	case IPSEC_HDR_DONT_PROCESS:
7025 		return (B_FALSE);
7026 	}
7027 
7028 	/* Default means send it to AH! */
7029 	ASSERT(nexthdr == IPPROTO_AH);
7030 	if (!mctl_present) {
7031 		mp = first_mp;
7032 		first_mp = ipsec_in_alloc(B_FALSE, ipst->ips_netstack);
7033 		if (first_mp == NULL) {
7034 			ip1dbg(("ipsec_early_ah_v6: IPSEC_IN "
7035 			    "allocation failure.\n"));
7036 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
7037 			freemsg(hada_mp);
7038 			freemsg(mp);
7039 			return (B_TRUE);
7040 		}
7041 		/*
7042 		 * Store the ill_index so that when we come back
7043 		 * from IPSEC we ride on the same queue.
7044 		 */
7045 		ii = (ipsec_in_t *)first_mp->b_rptr;
7046 		ii->ipsec_in_ill_index = ill->ill_phyint->phyint_ifindex;
7047 		ii->ipsec_in_rill_index = ii->ipsec_in_ill_index;
7048 		first_mp->b_cont = mp;
7049 	}
7050 	/*
7051 	 * Cache hardware acceleration info.
7052 	 */
7053 	if (hada_mp != NULL) {
7054 		ASSERT(ii != NULL);
7055 		IPSECHW_DEBUG(IPSECHW_PKT, ("ipsec_early_ah_v6: "
7056 		    "caching data attr.\n"));
7057 		ii->ipsec_in_accelerated = B_TRUE;
7058 		ii->ipsec_in_da = hada_mp;
7059 	}
7060 
7061 	if (!ipsec_loaded(ipss)) {
7062 		ip_proto_not_sup(q, first_mp, IP_FF_SEND_ICMP, zoneid, ipst);
7063 		return (B_TRUE);
7064 	}
7065 
7066 	ah = ipsec_inbound_ah_sa(first_mp, ns);
7067 	if (ah == NULL)
7068 		return (B_TRUE);
7069 	ASSERT(ii->ipsec_in_ah_sa != NULL);
7070 	ASSERT(ii->ipsec_in_ah_sa->ipsa_input_func != NULL);
7071 	ipsec_rc = ii->ipsec_in_ah_sa->ipsa_input_func(first_mp, ah);
7072 
7073 	switch (ipsec_rc) {
7074 	case IPSEC_STATUS_SUCCESS:
7075 		/* we're done with IPsec processing, send it up */
7076 		ip_fanout_proto_again(first_mp, ill, ill, NULL);
7077 		break;
7078 	case IPSEC_STATUS_FAILED:
7079 		BUMP_MIB(&ipst->ips_ip6_mib, ipIfStatsInDiscards);
7080 		break;
7081 	case IPSEC_STATUS_PENDING:
7082 		/* no action needed */
7083 		break;
7084 	}
7085 	return (B_TRUE);
7086 }
7087 
7088 /*
7089  * Validate the IPv6 mblk for alignment.
7090  */
7091 int
7092 ip_check_v6_mblk(mblk_t *mp, ill_t *ill)
7093 {
7094 	int pkt_len, ip6_len;
7095 	ip6_t *ip6h = (ip6_t *)mp->b_rptr;
7096 
7097 	/* check for alignment and full IPv6 header */
7098 	if (!OK_32PTR((uchar_t *)ip6h) ||
7099 	    (mp->b_wptr - (uchar_t *)ip6h) < IPV6_HDR_LEN) {
7100 		if (!pullupmsg(mp, IPV6_HDR_LEN)) {
7101 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
7102 			ip1dbg(("ip_rput_v6: pullupmsg failed\n"));
7103 			return (IP6_MBLK_HDR_ERR);
7104 		}
7105 		ip6h = (ip6_t *)mp->b_rptr;
7106 	}
7107 
7108 	ASSERT(OK_32PTR((uchar_t *)ip6h) &&
7109 	    (mp->b_wptr - (uchar_t *)ip6h) >= IPV6_HDR_LEN);
7110 
7111 	if (mp->b_cont == NULL)
7112 		pkt_len = mp->b_wptr - mp->b_rptr;
7113 	else
7114 		pkt_len = msgdsize(mp);
7115 	ip6_len = ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN;
7116 
7117 	/*
7118 	 * Check for bogus (too short packet) and packet which
7119 	 * was padded by the link layer.
7120 	 */
7121 	if (ip6_len != pkt_len) {
7122 		ssize_t diff;
7123 
7124 		if (ip6_len > pkt_len) {
7125 			ip1dbg(("ip_rput_data_v6: packet too short %d %d\n",
7126 			    ip6_len, pkt_len));
7127 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInTruncatedPkts);
7128 			return (IP6_MBLK_LEN_ERR);
7129 		}
7130 		diff = (ssize_t)(pkt_len - ip6_len);
7131 
7132 		if (!adjmsg(mp, -diff)) {
7133 			ip1dbg(("ip_rput_data_v6: adjmsg failed\n"));
7134 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
7135 			return (IP6_MBLK_LEN_ERR);
7136 		}
7137 	}
7138 	return (IP6_MBLK_OK);
7139 }
7140 
7141 /*
7142  * ip_rput_data_v6 -- received IPv6 packets in M_DATA messages show up here.
7143  * ip_rput_v6 has already verified alignment, the min length, the version,
7144  * and db_ref = 1.
7145  *
7146  * The ill passed in (the arg named inill) is the ill that the packet
7147  * actually arrived on.  We need to remember this when saving the
7148  * input interface index into potential IPV6_PKTINFO data in
7149  * ip_add_info_v6().
7150  *
7151  * This routine doesn't free dl_mp; that's the caller's responsibility on
7152  * return.  (Note that the callers are complex enough that there's no tail
7153  * recursion here anyway.)
7154  */
7155 void
7156 ip_rput_data_v6(queue_t *q, ill_t *inill, mblk_t *mp, ip6_t *ip6h,
7157     uint_t flags, mblk_t *hada_mp, mblk_t *dl_mp)
7158 {
7159 	ire_t		*ire = NULL;
7160 	ill_t		*ill = inill;
7161 	ill_t		*outill;
7162 	ipif_t		*ipif;
7163 	uint8_t		*whereptr;
7164 	uint8_t		nexthdr;
7165 	uint16_t	remlen;
7166 	uint_t		prev_nexthdr_offset;
7167 	uint_t		used;
7168 	size_t		old_pkt_len;
7169 	size_t		pkt_len;
7170 	uint16_t	ip6_len;
7171 	uint_t		hdr_len;
7172 	boolean_t	mctl_present;
7173 	mblk_t		*first_mp;
7174 	mblk_t		*first_mp1;
7175 	boolean_t	no_forward;
7176 	ip6_hbh_t	*hbhhdr;
7177 	boolean_t	ll_multicast = (flags & IP6_IN_LLMCAST);
7178 	conn_t		*connp;
7179 	ilm_t		*ilm;
7180 	uint32_t	ports;
7181 	zoneid_t	zoneid = GLOBAL_ZONEID;
7182 	uint16_t	hck_flags, reass_hck_flags;
7183 	uint32_t	reass_sum;
7184 	boolean_t	cksum_err;
7185 	mblk_t		*mp1;
7186 	ip_stack_t	*ipst = inill->ill_ipst;
7187 
7188 	EXTRACT_PKT_MP(mp, first_mp, mctl_present);
7189 
7190 	if (hada_mp != NULL) {
7191 		/*
7192 		 * It's an IPsec accelerated packet.
7193 		 * Keep a pointer to the data attributes around until
7194 		 * we allocate the ipsecinfo structure.
7195 		 */
7196 		IPSECHW_DEBUG(IPSECHW_PKT,
7197 		    ("ip_rput_data_v6: inbound HW accelerated IPsec pkt\n"));
7198 		hada_mp->b_cont = NULL;
7199 		/*
7200 		 * Since it is accelerated, it came directly from
7201 		 * the ill.
7202 		 */
7203 		ASSERT(mctl_present == B_FALSE);
7204 		ASSERT(mp->b_datap->db_type != M_CTL);
7205 	}
7206 
7207 	ip6h = (ip6_t *)mp->b_rptr;
7208 	ip6_len = ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN;
7209 	old_pkt_len = pkt_len = ip6_len;
7210 
7211 	if (ILL_HCKSUM_CAPABLE(ill) && !mctl_present && dohwcksum)
7212 		hck_flags = DB_CKSUMFLAGS(mp);
7213 	else
7214 		hck_flags = 0;
7215 
7216 	/* Clear checksum flags in case we need to forward */
7217 	DB_CKSUMFLAGS(mp) = 0;
7218 	reass_sum = reass_hck_flags = 0;
7219 
7220 	nexthdr = ip6h->ip6_nxt;
7221 
7222 	prev_nexthdr_offset = (uint_t)((uchar_t *)&ip6h->ip6_nxt -
7223 	    (uchar_t *)ip6h);
7224 	whereptr = (uint8_t *)&ip6h[1];
7225 	remlen = pkt_len - IPV6_HDR_LEN;	/* Track how much is left */
7226 
7227 	/* Process hop by hop header options */
7228 	if (nexthdr == IPPROTO_HOPOPTS) {
7229 		uint_t ehdrlen;
7230 		uint8_t *optptr;
7231 
7232 		if (remlen < MIN_EHDR_LEN)
7233 			goto pkt_too_short;
7234 		if (mp->b_cont != NULL &&
7235 		    whereptr + MIN_EHDR_LEN > mp->b_wptr) {
7236 			if (!pullupmsg(mp, IPV6_HDR_LEN + MIN_EHDR_LEN)) {
7237 				BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
7238 				freemsg(hada_mp);
7239 				freemsg(first_mp);
7240 				return;
7241 			}
7242 			ip6h = (ip6_t *)mp->b_rptr;
7243 			whereptr = (uint8_t *)ip6h + pkt_len - remlen;
7244 		}
7245 		hbhhdr = (ip6_hbh_t *)whereptr;
7246 		nexthdr = hbhhdr->ip6h_nxt;
7247 		prev_nexthdr_offset = (uint_t)(whereptr - (uint8_t *)ip6h);
7248 		ehdrlen = 8 * (hbhhdr->ip6h_len + 1);
7249 
7250 		if (remlen < ehdrlen)
7251 			goto pkt_too_short;
7252 		if (mp->b_cont != NULL &&
7253 		    whereptr + ehdrlen > mp->b_wptr) {
7254 			if (!pullupmsg(mp, IPV6_HDR_LEN + ehdrlen)) {
7255 				BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
7256 				freemsg(hada_mp);
7257 				freemsg(first_mp);
7258 				return;
7259 			}
7260 			ip6h = (ip6_t *)mp->b_rptr;
7261 			whereptr = (uint8_t *)ip6h + pkt_len - remlen;
7262 			hbhhdr = (ip6_hbh_t *)whereptr;
7263 		}
7264 
7265 		optptr = whereptr + 2;
7266 		whereptr += ehdrlen;
7267 		remlen -= ehdrlen;
7268 		switch (ip_process_options_v6(q, first_mp, ip6h, optptr,
7269 		    ehdrlen - 2, IPPROTO_HOPOPTS, ipst)) {
7270 		case -1:
7271 			/*
7272 			 * Packet has been consumed and any
7273 			 * needed ICMP messages sent.
7274 			 */
7275 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInHdrErrors);
7276 			freemsg(hada_mp);
7277 			return;
7278 		case 0:
7279 			/* no action needed */
7280 			break;
7281 		case 1:
7282 			/* Known router alert */
7283 			goto ipv6forus;
7284 		}
7285 	}
7286 
7287 	/*
7288 	 * Attach any necessary label information to this packet.
7289 	 */
7290 	if (is_system_labeled() && !tsol_get_pkt_label(mp, IPV6_VERSION)) {
7291 		if (ip6opt_ls != 0)
7292 			ip0dbg(("tsol_get_pkt_label v6 failed\n"));
7293 		BUMP_MIB(ill->ill_ip_mib, ipIfStatsInHdrErrors);
7294 		freemsg(hada_mp);
7295 		freemsg(first_mp);
7296 		return;
7297 	}
7298 
7299 	/*
7300 	 * On incoming v6 multicast packets we will bypass the ire table,
7301 	 * and assume that the read queue corresponds to the targetted
7302 	 * interface.
7303 	 *
7304 	 * The effect of this is the same as the IPv4 original code, but is
7305 	 * much cleaner I think.  See ip_rput for how that was done.
7306 	 */
7307 	if (IN6_IS_ADDR_MULTICAST(&ip6h->ip6_dst)) {
7308 		BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInMcastPkts);
7309 		UPDATE_MIB(ill->ill_ip_mib, ipIfStatsHCInMcastOctets, pkt_len);
7310 		/*
7311 		 * XXX TODO Give to mrouted to for multicast forwarding.
7312 		 */
7313 		ILM_WALKER_HOLD(ill);
7314 		ilm = ilm_lookup_ill_v6(ill, &ip6h->ip6_dst, ALL_ZONES);
7315 		ILM_WALKER_RELE(ill);
7316 		if (ilm == NULL) {
7317 			if (ip_debug > 3) {
7318 				/* ip2dbg */
7319 				pr_addr_dbg("ip_rput_data_v6: got mcast packet"
7320 				    "  which is not for us: %s\n", AF_INET6,
7321 				    &ip6h->ip6_dst);
7322 			}
7323 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
7324 			freemsg(hada_mp);
7325 			freemsg(first_mp);
7326 			return;
7327 		}
7328 		if (ip_debug > 3) {
7329 			/* ip2dbg */
7330 			pr_addr_dbg("ip_rput_data_v6: multicast for us: %s\n",
7331 			    AF_INET6, &ip6h->ip6_dst);
7332 		}
7333 		zoneid = GLOBAL_ZONEID;
7334 		goto ipv6forus;
7335 	}
7336 
7337 	ipif = ill->ill_ipif;
7338 
7339 	/*
7340 	 * If a packet was received on an interface that is a 6to4 tunnel,
7341 	 * incoming IPv6 packets, with a 6to4 addressed IPv6 destination, must
7342 	 * be checked to have a 6to4 prefix (2002:V4ADDR::/48) that is equal to
7343 	 * the 6to4 prefix of the address configured on the receiving interface.
7344 	 * Otherwise, the packet was delivered to this interface in error and
7345 	 * the packet must be dropped.
7346 	 */
7347 	if ((ill->ill_is_6to4tun) && IN6_IS_ADDR_6TO4(&ip6h->ip6_dst)) {
7348 
7349 		if (!IN6_ARE_6TO4_PREFIX_EQUAL(&ipif->ipif_v6lcl_addr,
7350 		    &ip6h->ip6_dst)) {
7351 			if (ip_debug > 2) {
7352 				/* ip1dbg */
7353 				pr_addr_dbg("ip_rput_data_v6: received 6to4 "
7354 				    "addressed packet which is not for us: "
7355 				    "%s\n", AF_INET6, &ip6h->ip6_dst);
7356 			}
7357 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
7358 			freemsg(first_mp);
7359 			return;
7360 		}
7361 	}
7362 
7363 	/*
7364 	 * Find an ire that matches destination. For link-local addresses
7365 	 * we have to match the ill.
7366 	 * TBD for site local addresses.
7367 	 */
7368 	if (IN6_IS_ADDR_LINKLOCAL(&ip6h->ip6_dst)) {
7369 		ire = ire_ctable_lookup_v6(&ip6h->ip6_dst, NULL,
7370 		    IRE_CACHE|IRE_LOCAL, ill->ill_ipif, ALL_ZONES, NULL,
7371 		    MATCH_IRE_TYPE | MATCH_IRE_ILL_GROUP, ipst);
7372 	} else {
7373 		ire = ire_cache_lookup_v6(&ip6h->ip6_dst, ALL_ZONES,
7374 		    MBLK_GETLABEL(mp), ipst);
7375 
7376 		if (ire != NULL && ire->ire_stq != NULL &&
7377 		    ire->ire_zoneid != GLOBAL_ZONEID &&
7378 		    ire->ire_zoneid != ALL_ZONES) {
7379 			/*
7380 			 * Should only use IREs that are visible from the
7381 			 * global zone for forwarding.
7382 			 */
7383 			ire_refrele(ire);
7384 			ire = ire_cache_lookup_v6(&ip6h->ip6_dst,
7385 			    GLOBAL_ZONEID, MBLK_GETLABEL(mp), ipst);
7386 		}
7387 	}
7388 
7389 	if (ire == NULL) {
7390 		/*
7391 		 * No matching IRE found.  Mark this packet as having
7392 		 * originated externally.
7393 		 */
7394 		if (!(ill->ill_flags & ILLF_ROUTER) || ll_multicast) {
7395 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsForwProhibits);
7396 			if (!(ill->ill_flags & ILLF_ROUTER)) {
7397 				BUMP_MIB(ill->ill_ip_mib,
7398 				    ipIfStatsInAddrErrors);
7399 			}
7400 			freemsg(hada_mp);
7401 			freemsg(first_mp);
7402 			return;
7403 		}
7404 		if (ip6h->ip6_hops <= 1) {
7405 			if (hada_mp != NULL)
7406 				goto hada_drop;
7407 			/* Sent by forwarding path, and router is global zone */
7408 			icmp_time_exceeded_v6(WR(q), first_mp,
7409 			    ICMP6_TIME_EXCEED_TRANSIT, ll_multicast, B_FALSE,
7410 			    GLOBAL_ZONEID, ipst);
7411 			return;
7412 		}
7413 		/*
7414 		 * Per RFC 3513 section 2.5.2, we must not forward packets with
7415 		 * an unspecified source address.
7416 		 */
7417 		if (IN6_IS_ADDR_UNSPECIFIED(&ip6h->ip6_src)) {
7418 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsForwProhibits);
7419 			freemsg(hada_mp);
7420 			freemsg(first_mp);
7421 			return;
7422 		}
7423 		mp->b_prev = (mblk_t *)(uintptr_t)
7424 		    ill->ill_phyint->phyint_ifindex;
7425 		ip_newroute_v6(q, mp, &ip6h->ip6_dst, &ip6h->ip6_src,
7426 		    IN6_IS_ADDR_LINKLOCAL(&ip6h->ip6_dst) ? ill : NULL,
7427 		    GLOBAL_ZONEID, ipst);
7428 		return;
7429 	}
7430 	/* we have a matching IRE */
7431 	if (ire->ire_stq != NULL) {
7432 		ill_group_t *ill_group;
7433 		ill_group_t *ire_group;
7434 
7435 		/*
7436 		 * To be quicker, we may wish not to chase pointers
7437 		 * (ire->ire_ipif->ipif_ill...) and instead store the
7438 		 * forwarding policy in the ire.  An unfortunate side-
7439 		 * effect of this would be requiring an ire flush whenever
7440 		 * the ILLF_ROUTER flag changes.  For now, chase pointers
7441 		 * once and store in the boolean no_forward.
7442 		 *
7443 		 * This appears twice to keep it out of the non-forwarding,
7444 		 * yes-it's-for-us-on-the-right-interface case.
7445 		 */
7446 		no_forward = ((ill->ill_flags &
7447 		    ire->ire_ipif->ipif_ill->ill_flags & ILLF_ROUTER) == 0);
7448 
7449 
7450 		ASSERT(first_mp == mp);
7451 		/*
7452 		 * This ire has a send-to queue - forward the packet.
7453 		 */
7454 		if (no_forward || ll_multicast || (hada_mp != NULL)) {
7455 			freemsg(hada_mp);
7456 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsForwProhibits);
7457 			if (no_forward) {
7458 				BUMP_MIB(ill->ill_ip_mib,
7459 				    ipIfStatsInAddrErrors);
7460 			}
7461 			freemsg(mp);
7462 			ire_refrele(ire);
7463 			return;
7464 		}
7465 		/*
7466 		 * ipIfStatsHCInForwDatagrams should only be increment if there
7467 		 * will be an attempt to forward the packet, which is why we
7468 		 * increment after the above condition has been checked.
7469 		 */
7470 		BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInForwDatagrams);
7471 		if (ip6h->ip6_hops <= 1) {
7472 			ip1dbg(("ip_rput_data_v6: hop limit expired.\n"));
7473 			/* Sent by forwarding path, and router is global zone */
7474 			icmp_time_exceeded_v6(WR(q), mp,
7475 			    ICMP6_TIME_EXCEED_TRANSIT, ll_multicast, B_FALSE,
7476 			    GLOBAL_ZONEID, ipst);
7477 			ire_refrele(ire);
7478 			return;
7479 		}
7480 		/*
7481 		 * Per RFC 3513 section 2.5.2, we must not forward packets with
7482 		 * an unspecified source address.
7483 		 */
7484 		if (IN6_IS_ADDR_UNSPECIFIED(&ip6h->ip6_src)) {
7485 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsForwProhibits);
7486 			freemsg(mp);
7487 			ire_refrele(ire);
7488 			return;
7489 		}
7490 
7491 		if (is_system_labeled()) {
7492 			mblk_t *mp1;
7493 
7494 			if ((mp1 = tsol_ip_forward(ire, mp)) == NULL) {
7495 				BUMP_MIB(ill->ill_ip_mib,
7496 				    ipIfStatsForwProhibits);
7497 				freemsg(mp);
7498 				ire_refrele(ire);
7499 				return;
7500 			}
7501 			/* Size may have changed */
7502 			mp = mp1;
7503 			ip6h = (ip6_t *)mp->b_rptr;
7504 			pkt_len = msgdsize(mp);
7505 		}
7506 
7507 		if (pkt_len > ire->ire_max_frag) {
7508 			int max_frag = ire->ire_max_frag;
7509 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInTooBigErrors);
7510 			/*
7511 			 * Handle labeled packet resizing.
7512 			 */
7513 			if (is_system_labeled()) {
7514 				max_frag = tsol_pmtu_adjust(mp, max_frag,
7515 				    pkt_len - old_pkt_len, AF_INET6);
7516 			}
7517 
7518 			/* Sent by forwarding path, and router is global zone */
7519 			icmp_pkt2big_v6(WR(q), mp, max_frag,
7520 			    ll_multicast, B_TRUE, GLOBAL_ZONEID, ipst);
7521 			ire_refrele(ire);
7522 			return;
7523 		}
7524 
7525 		/*
7526 		 * Check to see if we're forwarding the packet to a
7527 		 * different link from which it came.  If so, check the
7528 		 * source and destination addresses since routers must not
7529 		 * forward any packets with link-local source or
7530 		 * destination addresses to other links.  Otherwise (if
7531 		 * we're forwarding onto the same link), conditionally send
7532 		 * a redirect message.
7533 		 */
7534 		ill_group = ill->ill_group;
7535 		ire_group = ((ill_t *)(ire->ire_rfq)->q_ptr)->ill_group;
7536 		if (ire->ire_rfq != q && (ill_group == NULL ||
7537 		    ill_group != ire_group)) {
7538 			if (IN6_IS_ADDR_LINKLOCAL(&ip6h->ip6_dst) ||
7539 			    IN6_IS_ADDR_LINKLOCAL(&ip6h->ip6_src)) {
7540 				BUMP_MIB(ill->ill_ip_mib,
7541 				    ipIfStatsInAddrErrors);
7542 				freemsg(mp);
7543 				ire_refrele(ire);
7544 				return;
7545 			}
7546 			/* TBD add site-local check at site boundary? */
7547 		} else if (ipst->ips_ipv6_send_redirects) {
7548 			in6_addr_t	*v6targ;
7549 			in6_addr_t	gw_addr_v6;
7550 			ire_t		*src_ire_v6 = NULL;
7551 
7552 			/*
7553 			 * Don't send a redirect when forwarding a source
7554 			 * routed packet.
7555 			 */
7556 			if (ip_source_routed_v6(ip6h, mp, ipst))
7557 				goto forward;
7558 
7559 			mutex_enter(&ire->ire_lock);
7560 			gw_addr_v6 = ire->ire_gateway_addr_v6;
7561 			mutex_exit(&ire->ire_lock);
7562 			if (!IN6_IS_ADDR_UNSPECIFIED(&gw_addr_v6)) {
7563 				v6targ = &gw_addr_v6;
7564 				/*
7565 				 * We won't send redirects to a router
7566 				 * that doesn't have a link local
7567 				 * address, but will forward.
7568 				 */
7569 				if (!IN6_IS_ADDR_LINKLOCAL(v6targ)) {
7570 					BUMP_MIB(ill->ill_ip_mib,
7571 					    ipIfStatsInAddrErrors);
7572 					goto forward;
7573 				}
7574 			} else {
7575 				v6targ = &ip6h->ip6_dst;
7576 			}
7577 
7578 			src_ire_v6 = ire_ftable_lookup_v6(&ip6h->ip6_src,
7579 			    NULL, NULL, IRE_INTERFACE, ire->ire_ipif, NULL,
7580 			    GLOBAL_ZONEID, 0, NULL,
7581 			    MATCH_IRE_IPIF | MATCH_IRE_TYPE,
7582 			    ipst);
7583 
7584 			if (src_ire_v6 != NULL) {
7585 				/*
7586 				 * The source is directly connected.
7587 				 */
7588 				mp1 = copymsg(mp);
7589 				if (mp1 != NULL) {
7590 					icmp_send_redirect_v6(WR(q),
7591 					    mp1, v6targ, &ip6h->ip6_dst,
7592 					    ill, B_FALSE);
7593 				}
7594 				ire_refrele(src_ire_v6);
7595 			}
7596 		}
7597 
7598 forward:
7599 		/* Hoplimit verified above */
7600 		ip6h->ip6_hops--;
7601 
7602 		outill = ire->ire_ipif->ipif_ill;
7603 
7604 		DTRACE_PROBE4(ip6__forwarding__start,
7605 		    ill_t *, inill, ill_t *, outill,
7606 		    ip6_t *, ip6h, mblk_t *, mp);
7607 
7608 		FW_HOOKS6(ipst->ips_ip6_forwarding_event,
7609 		    ipst->ips_ipv6firewall_forwarding,
7610 		    inill, outill, ip6h, mp, mp, 0, ipst);
7611 
7612 		DTRACE_PROBE1(ip6__forwarding__end, mblk_t *, mp);
7613 
7614 		if (mp != NULL) {
7615 			UPDATE_IB_PKT_COUNT(ire);
7616 			ire->ire_last_used_time = lbolt;
7617 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCOutForwDatagrams);
7618 			ip_xmit_v6(mp, ire, 0, NULL, B_FALSE, NULL);
7619 		}
7620 		IRE_REFRELE(ire);
7621 		return;
7622 	}
7623 
7624 	/*
7625 	 * Need to put on correct queue for reassembly to find it.
7626 	 * No need to use put() since reassembly has its own locks.
7627 	 * Note: multicast packets and packets destined to addresses
7628 	 * assigned to loopback (ire_rfq is NULL) will be reassembled on
7629 	 * the arriving ill. Unlike the IPv4 case, enabling strict
7630 	 * destination multihoming will prevent accepting packets
7631 	 * addressed to an IRE_LOCAL on lo0.
7632 	 */
7633 	if (ire->ire_rfq != q) {
7634 		if ((ire = ip_check_multihome(&ip6h->ip6_dst, ire, ill))
7635 		    == NULL) {
7636 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsForwProhibits);
7637 			freemsg(hada_mp);
7638 			freemsg(first_mp);
7639 			return;
7640 		}
7641 		if (ire->ire_rfq != NULL) {
7642 			q = ire->ire_rfq;
7643 			ill = (ill_t *)q->q_ptr;
7644 			ASSERT(ill != NULL);
7645 		}
7646 	}
7647 
7648 	zoneid = ire->ire_zoneid;
7649 	UPDATE_IB_PKT_COUNT(ire);
7650 	ire->ire_last_used_time = lbolt;
7651 	/* Don't use the ire after this point, we'll NULL it out to be sure. */
7652 	ire_refrele(ire);
7653 	ire = NULL;
7654 ipv6forus:
7655 	/*
7656 	 * Looks like this packet is for us one way or another.
7657 	 * This is where we'll process destination headers etc.
7658 	 */
7659 	for (; ; ) {
7660 		switch (nexthdr) {
7661 		case IPPROTO_TCP: {
7662 			uint16_t	*up;
7663 			uint32_t	sum;
7664 			int		offset;
7665 
7666 			hdr_len = pkt_len - remlen;
7667 
7668 			if (hada_mp != NULL) {
7669 				ip0dbg(("tcp hada drop\n"));
7670 				goto hada_drop;
7671 			}
7672 
7673 
7674 			/* TCP needs all of the TCP header */
7675 			if (remlen < TCP_MIN_HEADER_LENGTH)
7676 				goto pkt_too_short;
7677 			if (mp->b_cont != NULL &&
7678 			    whereptr + TCP_MIN_HEADER_LENGTH > mp->b_wptr) {
7679 				if (!pullupmsg(mp,
7680 				    hdr_len + TCP_MIN_HEADER_LENGTH)) {
7681 					BUMP_MIB(ill->ill_ip_mib,
7682 					    ipIfStatsInDiscards);
7683 					freemsg(first_mp);
7684 					return;
7685 				}
7686 				hck_flags = 0;
7687 				ip6h = (ip6_t *)mp->b_rptr;
7688 				whereptr = (uint8_t *)ip6h + hdr_len;
7689 			}
7690 			/*
7691 			 * Extract the offset field from the TCP header.
7692 			 */
7693 			offset = ((uchar_t *)ip6h)[hdr_len + 12] >> 4;
7694 			if (offset != 5) {
7695 				if (offset < 5) {
7696 					ip1dbg(("ip_rput_data_v6: short "
7697 					    "TCP data offset"));
7698 					BUMP_MIB(ill->ill_ip_mib,
7699 					    ipIfStatsInDiscards);
7700 					freemsg(first_mp);
7701 					return;
7702 				}
7703 				/*
7704 				 * There must be TCP options.
7705 				 * Make sure we can grab them.
7706 				 */
7707 				offset <<= 2;
7708 				if (remlen < offset)
7709 					goto pkt_too_short;
7710 				if (mp->b_cont != NULL &&
7711 				    whereptr + offset > mp->b_wptr) {
7712 					if (!pullupmsg(mp,
7713 					    hdr_len + offset)) {
7714 						BUMP_MIB(ill->ill_ip_mib,
7715 						    ipIfStatsInDiscards);
7716 						freemsg(first_mp);
7717 						return;
7718 					}
7719 					hck_flags = 0;
7720 					ip6h = (ip6_t *)mp->b_rptr;
7721 					whereptr = (uint8_t *)ip6h + hdr_len;
7722 				}
7723 			}
7724 
7725 			up = (uint16_t *)&ip6h->ip6_src;
7726 			/*
7727 			 * TCP checksum calculation.  First sum up the
7728 			 * pseudo-header fields:
7729 			 *  -	Source IPv6 address
7730 			 *  -	Destination IPv6 address
7731 			 *  -	TCP payload length
7732 			 *  -	TCP protocol ID
7733 			 */
7734 			sum = htons(IPPROTO_TCP + remlen) +
7735 			    up[0] + up[1] + up[2] + up[3] +
7736 			    up[4] + up[5] + up[6] + up[7] +
7737 			    up[8] + up[9] + up[10] + up[11] +
7738 			    up[12] + up[13] + up[14] + up[15];
7739 
7740 			/* Fold initial sum */
7741 			sum = (sum & 0xffff) + (sum >> 16);
7742 
7743 			mp1 = mp->b_cont;
7744 
7745 			if ((hck_flags & (HCK_FULLCKSUM|HCK_PARTIALCKSUM)) == 0)
7746 				IP6_STAT(ipst, ip6_in_sw_cksum);
7747 
7748 			IP_CKSUM_RECV(hck_flags, sum, (uchar_t *)
7749 			    ((uchar_t *)mp->b_rptr + DB_CKSUMSTART(mp)),
7750 			    (int32_t)(whereptr - (uchar_t *)mp->b_rptr),
7751 			    mp, mp1, cksum_err);
7752 
7753 			if (cksum_err) {
7754 				BUMP_MIB(ill->ill_ip_mib, tcpIfStatsInErrs);
7755 
7756 				if (hck_flags & HCK_FULLCKSUM) {
7757 					IP6_STAT(ipst,
7758 					    ip6_tcp_in_full_hw_cksum_err);
7759 				} else if (hck_flags & HCK_PARTIALCKSUM) {
7760 					IP6_STAT(ipst,
7761 					    ip6_tcp_in_part_hw_cksum_err);
7762 				} else {
7763 					IP6_STAT(ipst, ip6_tcp_in_sw_cksum_err);
7764 				}
7765 				freemsg(first_mp);
7766 				return;
7767 			}
7768 tcp_fanout:
7769 			ip_fanout_tcp_v6(q, first_mp, ip6h, ill, inill,
7770 			    (flags|IP_FF_SEND_ICMP|IP_FF_SYN_ADDIRE|
7771 			    IP_FF_IPINFO), hdr_len, mctl_present, zoneid);
7772 			return;
7773 		}
7774 		case IPPROTO_SCTP:
7775 		{
7776 			sctp_hdr_t *sctph;
7777 			uint32_t calcsum, pktsum;
7778 			uint_t hdr_len = pkt_len - remlen;
7779 			sctp_stack_t *sctps;
7780 
7781 			sctps = inill->ill_ipst->ips_netstack->netstack_sctp;
7782 
7783 			/* SCTP needs all of the SCTP header */
7784 			if (remlen < sizeof (*sctph)) {
7785 				goto pkt_too_short;
7786 			}
7787 			if (whereptr + sizeof (*sctph) > mp->b_wptr) {
7788 				ASSERT(mp->b_cont != NULL);
7789 				if (!pullupmsg(mp, hdr_len + sizeof (*sctph))) {
7790 					BUMP_MIB(ill->ill_ip_mib,
7791 					    ipIfStatsInDiscards);
7792 					freemsg(mp);
7793 					return;
7794 				}
7795 				ip6h = (ip6_t *)mp->b_rptr;
7796 				whereptr = (uint8_t *)ip6h + hdr_len;
7797 			}
7798 
7799 			sctph = (sctp_hdr_t *)(mp->b_rptr + hdr_len);
7800 			/* checksum */
7801 			pktsum = sctph->sh_chksum;
7802 			sctph->sh_chksum = 0;
7803 			calcsum = sctp_cksum(mp, hdr_len);
7804 			if (calcsum != pktsum) {
7805 				BUMP_MIB(&sctps->sctps_mib, sctpChecksumError);
7806 				freemsg(mp);
7807 				return;
7808 			}
7809 			sctph->sh_chksum = pktsum;
7810 			ports = *(uint32_t *)(mp->b_rptr + hdr_len);
7811 			if ((connp = sctp_fanout(&ip6h->ip6_src, &ip6h->ip6_dst,
7812 			    ports, zoneid, mp, sctps)) == NULL) {
7813 				ip_fanout_sctp_raw(first_mp, ill,
7814 				    (ipha_t *)ip6h, B_FALSE, ports,
7815 				    mctl_present,
7816 				    (flags|IP_FF_SEND_ICMP|IP_FF_IPINFO),
7817 				    B_TRUE, zoneid);
7818 				return;
7819 			}
7820 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
7821 			sctp_input(connp, (ipha_t *)ip6h, mp, first_mp, ill,
7822 			    B_FALSE, mctl_present);
7823 			return;
7824 		}
7825 		case IPPROTO_UDP: {
7826 			uint16_t	*up;
7827 			uint32_t	sum;
7828 
7829 			hdr_len = pkt_len - remlen;
7830 
7831 			if (hada_mp != NULL) {
7832 				ip0dbg(("udp hada drop\n"));
7833 				goto hada_drop;
7834 			}
7835 
7836 			/* Verify that at least the ports are present */
7837 			if (remlen < UDPH_SIZE)
7838 				goto pkt_too_short;
7839 			if (mp->b_cont != NULL &&
7840 			    whereptr + UDPH_SIZE > mp->b_wptr) {
7841 				if (!pullupmsg(mp, hdr_len + UDPH_SIZE)) {
7842 					BUMP_MIB(ill->ill_ip_mib,
7843 					    ipIfStatsInDiscards);
7844 					freemsg(first_mp);
7845 					return;
7846 				}
7847 				hck_flags = 0;
7848 				ip6h = (ip6_t *)mp->b_rptr;
7849 				whereptr = (uint8_t *)ip6h + hdr_len;
7850 			}
7851 
7852 			/*
7853 			 *  Before going through the regular checksum
7854 			 *  calculation, make sure the received checksum
7855 			 *  is non-zero. RFC 2460 says, a 0x0000 checksum
7856 			 *  in a UDP packet (within IPv6 packet) is invalid
7857 			 *  and should be replaced by 0xffff. This makes
7858 			 *  sense as regular checksum calculation will
7859 			 *  pass for both the cases i.e. 0x0000 and 0xffff.
7860 			 *  Removing one of the case makes error detection
7861 			 *  stronger.
7862 			 */
7863 
7864 			if (((udpha_t *)whereptr)->uha_checksum == 0) {
7865 				/* 0x0000 checksum is invalid */
7866 				ip1dbg(("ip_rput_data_v6: Invalid UDP "
7867 				    "checksum value 0x0000\n"));
7868 				BUMP_MIB(ill->ill_ip_mib,
7869 				    udpIfStatsInCksumErrs);
7870 				freemsg(first_mp);
7871 				return;
7872 			}
7873 
7874 			up = (uint16_t *)&ip6h->ip6_src;
7875 
7876 			/*
7877 			 * UDP checksum calculation.  First sum up the
7878 			 * pseudo-header fields:
7879 			 *  -	Source IPv6 address
7880 			 *  -	Destination IPv6 address
7881 			 *  -	UDP payload length
7882 			 *  -	UDP protocol ID
7883 			 */
7884 
7885 			sum = htons(IPPROTO_UDP + remlen) +
7886 			    up[0] + up[1] + up[2] + up[3] +
7887 			    up[4] + up[5] + up[6] + up[7] +
7888 			    up[8] + up[9] + up[10] + up[11] +
7889 			    up[12] + up[13] + up[14] + up[15];
7890 
7891 			/* Fold initial sum */
7892 			sum = (sum & 0xffff) + (sum >> 16);
7893 
7894 			if (reass_hck_flags != 0) {
7895 				hck_flags = reass_hck_flags;
7896 
7897 				IP_CKSUM_RECV_REASS(hck_flags,
7898 				    (int32_t)(whereptr - (uchar_t *)mp->b_rptr),
7899 				    sum, reass_sum, cksum_err);
7900 			} else {
7901 				mp1 = mp->b_cont;
7902 
7903 				IP_CKSUM_RECV(hck_flags, sum, (uchar_t *)
7904 				    ((uchar_t *)mp->b_rptr + DB_CKSUMSTART(mp)),
7905 				    (int32_t)(whereptr - (uchar_t *)mp->b_rptr),
7906 				    mp, mp1, cksum_err);
7907 			}
7908 
7909 			if ((hck_flags & (HCK_FULLCKSUM|HCK_PARTIALCKSUM)) == 0)
7910 				IP6_STAT(ipst, ip6_in_sw_cksum);
7911 
7912 			if (cksum_err) {
7913 				BUMP_MIB(ill->ill_ip_mib,
7914 				    udpIfStatsInCksumErrs);
7915 
7916 				if (hck_flags & HCK_FULLCKSUM)
7917 					IP6_STAT(ipst,
7918 					    ip6_udp_in_full_hw_cksum_err);
7919 				else if (hck_flags & HCK_PARTIALCKSUM)
7920 					IP6_STAT(ipst,
7921 					    ip6_udp_in_part_hw_cksum_err);
7922 				else
7923 					IP6_STAT(ipst, ip6_udp_in_sw_cksum_err);
7924 
7925 				freemsg(first_mp);
7926 				return;
7927 			}
7928 			goto udp_fanout;
7929 		}
7930 		case IPPROTO_ICMPV6: {
7931 			uint16_t	*up;
7932 			uint32_t	sum;
7933 			uint_t		hdr_len = pkt_len - remlen;
7934 
7935 			if (hada_mp != NULL) {
7936 				ip0dbg(("icmp hada drop\n"));
7937 				goto hada_drop;
7938 			}
7939 
7940 			up = (uint16_t *)&ip6h->ip6_src;
7941 			sum = htons(IPPROTO_ICMPV6 + remlen) +
7942 			    up[0] + up[1] + up[2] + up[3] +
7943 			    up[4] + up[5] + up[6] + up[7] +
7944 			    up[8] + up[9] + up[10] + up[11] +
7945 			    up[12] + up[13] + up[14] + up[15];
7946 			sum = (sum & 0xffff) + (sum >> 16);
7947 			sum = IP_CSUM(mp, hdr_len, sum);
7948 			if (sum != 0) {
7949 				/* IPv6 ICMP checksum failed */
7950 				ip1dbg(("ip_rput_data_v6: ICMPv6 checksum "
7951 				    "failed %x\n",
7952 				    sum));
7953 				BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInMsgs);
7954 				BUMP_MIB(ill->ill_icmp6_mib,
7955 				    ipv6IfIcmpInErrors);
7956 				freemsg(first_mp);
7957 				return;
7958 			}
7959 
7960 		icmp_fanout:
7961 			/* Check variable for testing applications */
7962 			if (ipst->ips_ipv6_drop_inbound_icmpv6) {
7963 				freemsg(first_mp);
7964 				return;
7965 			}
7966 			/*
7967 			 * Assume that there is always at least one conn for
7968 			 * ICMPv6 (in.ndpd) i.e. don't optimize the case
7969 			 * where there is no conn.
7970 			 */
7971 			if (IN6_IS_ADDR_MULTICAST(&ip6h->ip6_dst)) {
7972 				ASSERT(!IS_LOOPBACK((ill)));
7973 				/*
7974 				 * In the multicast case, applications may have
7975 				 * joined the group from different zones, so we
7976 				 * need to deliver the packet to each of them.
7977 				 * Loop through the multicast memberships
7978 				 * structures (ilm) on the receive ill and send
7979 				 * a copy of the packet up each matching one.
7980 				 */
7981 				ILM_WALKER_HOLD(ill);
7982 				for (ilm = ill->ill_ilm; ilm != NULL;
7983 				    ilm = ilm->ilm_next) {
7984 					if (ilm->ilm_flags & ILM_DELETED)
7985 						continue;
7986 					if (!IN6_ARE_ADDR_EQUAL(
7987 					    &ilm->ilm_v6addr, &ip6h->ip6_dst))
7988 						continue;
7989 					if (!ipif_lookup_zoneid(ill,
7990 					    ilm->ilm_zoneid, IPIF_UP, NULL))
7991 						continue;
7992 
7993 					first_mp1 = ip_copymsg(first_mp);
7994 					if (first_mp1 == NULL)
7995 						continue;
7996 					icmp_inbound_v6(q, first_mp1, ill,
7997 					    hdr_len, mctl_present, 0,
7998 					    ilm->ilm_zoneid, dl_mp);
7999 				}
8000 				ILM_WALKER_RELE(ill);
8001 			} else {
8002 				first_mp1 = ip_copymsg(first_mp);
8003 				if (first_mp1 != NULL)
8004 					icmp_inbound_v6(q, first_mp1, ill,
8005 					    hdr_len, mctl_present, 0, zoneid,
8006 					    dl_mp);
8007 			}
8008 		}
8009 			/* FALLTHRU */
8010 		default: {
8011 			/*
8012 			 * Handle protocols with which IPv6 is less intimate.
8013 			 */
8014 			uint_t proto_flags = IP_FF_RAWIP|IP_FF_IPINFO;
8015 
8016 			if (hada_mp != NULL) {
8017 				ip0dbg(("default hada drop\n"));
8018 				goto hada_drop;
8019 			}
8020 
8021 			/*
8022 			 * Enable sending ICMP for "Unknown" nexthdr
8023 			 * case. i.e. where we did not FALLTHRU from
8024 			 * IPPROTO_ICMPV6 processing case above.
8025 			 * If we did FALLTHRU, then the packet has already been
8026 			 * processed for IPPF, don't process it again in
8027 			 * ip_fanout_proto_v6; set IP6_NO_IPPOLICY in the
8028 			 * flags
8029 			 */
8030 			if (nexthdr != IPPROTO_ICMPV6)
8031 				proto_flags |= IP_FF_SEND_ICMP;
8032 			else
8033 				proto_flags |= IP6_NO_IPPOLICY;
8034 
8035 			ip_fanout_proto_v6(q, first_mp, ip6h, ill, inill,
8036 			    nexthdr, prev_nexthdr_offset, (flags|proto_flags),
8037 			    mctl_present, zoneid);
8038 			return;
8039 		}
8040 
8041 		case IPPROTO_DSTOPTS: {
8042 			uint_t ehdrlen;
8043 			uint8_t *optptr;
8044 			ip6_dest_t *desthdr;
8045 
8046 			/* Check if AH is present. */
8047 			if (ipsec_early_ah_v6(q, first_mp, mctl_present, ill,
8048 			    hada_mp, zoneid)) {
8049 				ip0dbg(("dst early hada drop\n"));
8050 				return;
8051 			}
8052 
8053 			/*
8054 			 * Reinitialize pointers, as ipsec_early_ah_v6() does
8055 			 * complete pullups.  We don't have to do more pullups
8056 			 * as a result.
8057 			 */
8058 			whereptr = (uint8_t *)((uintptr_t)mp->b_rptr +
8059 			    (uintptr_t)(whereptr - ((uint8_t *)ip6h)));
8060 			ip6h = (ip6_t *)mp->b_rptr;
8061 
8062 			if (remlen < MIN_EHDR_LEN)
8063 				goto pkt_too_short;
8064 
8065 			desthdr = (ip6_dest_t *)whereptr;
8066 			nexthdr = desthdr->ip6d_nxt;
8067 			prev_nexthdr_offset = (uint_t)(whereptr -
8068 			    (uint8_t *)ip6h);
8069 			ehdrlen = 8 * (desthdr->ip6d_len + 1);
8070 			if (remlen < ehdrlen)
8071 				goto pkt_too_short;
8072 			optptr = whereptr + 2;
8073 			/*
8074 			 * Note: XXX This code does not seem to make
8075 			 * distinction between Destination Options Header
8076 			 * being before/after Routing Header which can
8077 			 * happen if we are at the end of source route.
8078 			 * This may become significant in future.
8079 			 * (No real significant Destination Options are
8080 			 * defined/implemented yet ).
8081 			 */
8082 			switch (ip_process_options_v6(q, first_mp, ip6h, optptr,
8083 			    ehdrlen - 2, IPPROTO_DSTOPTS, ipst)) {
8084 			case -1:
8085 				/*
8086 				 * Packet has been consumed and any needed
8087 				 * ICMP errors sent.
8088 				 */
8089 				BUMP_MIB(ill->ill_ip_mib, ipIfStatsInHdrErrors);
8090 				freemsg(hada_mp);
8091 				return;
8092 			case 0:
8093 				/* No action needed  continue */
8094 				break;
8095 			case 1:
8096 				/*
8097 				 * Unnexpected return value
8098 				 * (Router alert is a Hop-by-Hop option)
8099 				 */
8100 #ifdef DEBUG
8101 				panic("ip_rput_data_v6: router "
8102 				    "alert hbh opt indication in dest opt");
8103 				/*NOTREACHED*/
8104 #else
8105 				freemsg(hada_mp);
8106 				freemsg(first_mp);
8107 				BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
8108 				return;
8109 #endif
8110 			}
8111 			used = ehdrlen;
8112 			break;
8113 		}
8114 		case IPPROTO_FRAGMENT: {
8115 			ip6_frag_t *fraghdr;
8116 			size_t no_frag_hdr_len;
8117 
8118 			if (hada_mp != NULL) {
8119 				ip0dbg(("frag hada drop\n"));
8120 				goto hada_drop;
8121 			}
8122 
8123 			ASSERT(first_mp == mp);
8124 			if (remlen < sizeof (ip6_frag_t))
8125 				goto pkt_too_short;
8126 
8127 			if (mp->b_cont != NULL &&
8128 			    whereptr + sizeof (ip6_frag_t) > mp->b_wptr) {
8129 				if (!pullupmsg(mp,
8130 				    pkt_len - remlen + sizeof (ip6_frag_t))) {
8131 					BUMP_MIB(ill->ill_ip_mib,
8132 					    ipIfStatsInDiscards);
8133 					freemsg(mp);
8134 					return;
8135 				}
8136 				hck_flags = 0;
8137 				ip6h = (ip6_t *)mp->b_rptr;
8138 				whereptr = (uint8_t *)ip6h + pkt_len - remlen;
8139 			}
8140 
8141 			fraghdr = (ip6_frag_t *)whereptr;
8142 			used = (uint_t)sizeof (ip6_frag_t);
8143 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsReasmReqds);
8144 
8145 			/*
8146 			 * Invoke the CGTP (multirouting) filtering module to
8147 			 * process the incoming packet. Packets identified as
8148 			 * duplicates must be discarded. Filtering is active
8149 			 * only if the the ip_cgtp_filter ndd variable is
8150 			 * non-zero.
8151 			 */
8152 			if (ipst->ips_ip_cgtp_filter &&
8153 			    ipst->ips_ip_cgtp_filter_ops != NULL) {
8154 				int cgtp_flt_pkt;
8155 				netstackid_t stackid;
8156 
8157 				stackid = ipst->ips_netstack->netstack_stackid;
8158 
8159 				cgtp_flt_pkt =
8160 				    ipst->ips_ip_cgtp_filter_ops->cfo_filter_v6(
8161 				    stackid, inill->ill_phyint->phyint_ifindex,
8162 				    ip6h, fraghdr);
8163 				if (cgtp_flt_pkt == CGTP_IP_PKT_DUPLICATE) {
8164 					freemsg(mp);
8165 					return;
8166 				}
8167 			}
8168 
8169 			/* Restore the flags */
8170 			DB_CKSUMFLAGS(mp) = hck_flags;
8171 
8172 			mp = ip_rput_frag_v6(q, mp, ip6h, fraghdr,
8173 			    remlen - used, &prev_nexthdr_offset,
8174 			    &reass_sum, &reass_hck_flags);
8175 			if (mp == NULL) {
8176 				/* Reassembly is still pending */
8177 				return;
8178 			}
8179 			/* The first mblk are the headers before the frag hdr */
8180 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsReasmOKs);
8181 
8182 			first_mp = mp;	/* mp has most likely changed! */
8183 			no_frag_hdr_len = mp->b_wptr - mp->b_rptr;
8184 			ip6h = (ip6_t *)mp->b_rptr;
8185 			nexthdr = ((char *)ip6h)[prev_nexthdr_offset];
8186 			whereptr = mp->b_rptr + no_frag_hdr_len;
8187 			remlen = ntohs(ip6h->ip6_plen)  +
8188 			    (uint16_t)(IPV6_HDR_LEN - no_frag_hdr_len);
8189 			pkt_len = msgdsize(mp);
8190 			used = 0;
8191 			break;
8192 		}
8193 		case IPPROTO_HOPOPTS: {
8194 			if (hada_mp != NULL) {
8195 				ip0dbg(("hop hada drop\n"));
8196 				goto hada_drop;
8197 			}
8198 			/*
8199 			 * Illegal header sequence.
8200 			 * (Hop-by-hop headers are processed above
8201 			 *  and required to immediately follow IPv6 header)
8202 			 */
8203 			icmp_param_problem_v6(WR(q), first_mp,
8204 			    ICMP6_PARAMPROB_NEXTHEADER,
8205 			    prev_nexthdr_offset,
8206 			    B_FALSE, B_FALSE, zoneid, ipst);
8207 			return;
8208 		}
8209 		case IPPROTO_ROUTING: {
8210 			uint_t ehdrlen;
8211 			ip6_rthdr_t *rthdr;
8212 
8213 			/* Check if AH is present. */
8214 			if (ipsec_early_ah_v6(q, first_mp, mctl_present, ill,
8215 			    hada_mp, zoneid)) {
8216 				ip0dbg(("routing hada drop\n"));
8217 				return;
8218 			}
8219 
8220 			/*
8221 			 * Reinitialize pointers, as ipsec_early_ah_v6() does
8222 			 * complete pullups.  We don't have to do more pullups
8223 			 * as a result.
8224 			 */
8225 			whereptr = (uint8_t *)((uintptr_t)mp->b_rptr +
8226 			    (uintptr_t)(whereptr - ((uint8_t *)ip6h)));
8227 			ip6h = (ip6_t *)mp->b_rptr;
8228 
8229 			if (remlen < MIN_EHDR_LEN)
8230 				goto pkt_too_short;
8231 			rthdr = (ip6_rthdr_t *)whereptr;
8232 			nexthdr = rthdr->ip6r_nxt;
8233 			prev_nexthdr_offset = (uint_t)(whereptr -
8234 			    (uint8_t *)ip6h);
8235 			ehdrlen = 8 * (rthdr->ip6r_len + 1);
8236 			if (remlen < ehdrlen)
8237 				goto pkt_too_short;
8238 			if (rthdr->ip6r_segleft != 0) {
8239 				/* Not end of source route */
8240 				if (ll_multicast) {
8241 					BUMP_MIB(ill->ill_ip_mib,
8242 					    ipIfStatsForwProhibits);
8243 					freemsg(hada_mp);
8244 					freemsg(mp);
8245 					return;
8246 				}
8247 				ip_process_rthdr(q, mp, ip6h, rthdr, ill,
8248 				    flags, hada_mp, dl_mp);
8249 				return;
8250 			}
8251 			used = ehdrlen;
8252 			break;
8253 		}
8254 		case IPPROTO_AH:
8255 		case IPPROTO_ESP: {
8256 			/*
8257 			 * Fast path for AH/ESP. If this is the first time
8258 			 * we are sending a datagram to AH/ESP, allocate
8259 			 * a IPSEC_IN message and prepend it. Otherwise,
8260 			 * just fanout.
8261 			 */
8262 
8263 			ipsec_in_t *ii;
8264 			int ipsec_rc;
8265 			ipsec_stack_t *ipss;
8266 
8267 			ipss = ipst->ips_netstack->netstack_ipsec;
8268 			if (!mctl_present) {
8269 				ASSERT(first_mp == mp);
8270 				first_mp = ipsec_in_alloc(B_FALSE,
8271 				    ipst->ips_netstack);
8272 				if (first_mp == NULL) {
8273 					ip1dbg(("ip_rput_data_v6: IPSEC_IN "
8274 					    "allocation failure.\n"));
8275 					BUMP_MIB(ill->ill_ip_mib,
8276 					    ipIfStatsInDiscards);
8277 					freemsg(mp);
8278 					return;
8279 				}
8280 				/*
8281 				 * Store the ill_index so that when we come back
8282 				 * from IPSEC we ride on the same queue.
8283 				 */
8284 				ii = (ipsec_in_t *)first_mp->b_rptr;
8285 				ii->ipsec_in_ill_index =
8286 				    ill->ill_phyint->phyint_ifindex;
8287 				ii->ipsec_in_rill_index =
8288 				    ii->ipsec_in_ill_index;
8289 				first_mp->b_cont = mp;
8290 				/*
8291 				 * Cache hardware acceleration info.
8292 				 */
8293 				if (hada_mp != NULL) {
8294 					IPSECHW_DEBUG(IPSECHW_PKT,
8295 					    ("ip_rput_data_v6: "
8296 					    "caching data attr.\n"));
8297 					ii->ipsec_in_accelerated = B_TRUE;
8298 					ii->ipsec_in_da = hada_mp;
8299 					hada_mp = NULL;
8300 				}
8301 			} else {
8302 				ii = (ipsec_in_t *)first_mp->b_rptr;
8303 			}
8304 
8305 			if (!ipsec_loaded(ipss)) {
8306 				ip_proto_not_sup(q, first_mp, IP_FF_SEND_ICMP,
8307 				    zoneid, ipst);
8308 				return;
8309 			}
8310 
8311 			/* select inbound SA and have IPsec process the pkt */
8312 			if (nexthdr == IPPROTO_ESP) {
8313 				esph_t *esph = ipsec_inbound_esp_sa(first_mp,
8314 				    ipst->ips_netstack);
8315 				if (esph == NULL)
8316 					return;
8317 				ASSERT(ii->ipsec_in_esp_sa != NULL);
8318 				ASSERT(ii->ipsec_in_esp_sa->ipsa_input_func !=
8319 				    NULL);
8320 				ipsec_rc = ii->ipsec_in_esp_sa->ipsa_input_func(
8321 				    first_mp, esph);
8322 			} else {
8323 				ah_t *ah = ipsec_inbound_ah_sa(first_mp,
8324 				    ipst->ips_netstack);
8325 				if (ah == NULL)
8326 					return;
8327 				ASSERT(ii->ipsec_in_ah_sa != NULL);
8328 				ASSERT(ii->ipsec_in_ah_sa->ipsa_input_func !=
8329 				    NULL);
8330 				ipsec_rc = ii->ipsec_in_ah_sa->ipsa_input_func(
8331 				    first_mp, ah);
8332 			}
8333 
8334 			switch (ipsec_rc) {
8335 			case IPSEC_STATUS_SUCCESS:
8336 				break;
8337 			case IPSEC_STATUS_FAILED:
8338 				BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
8339 				/* FALLTHRU */
8340 			case IPSEC_STATUS_PENDING:
8341 				return;
8342 			}
8343 			/* we're done with IPsec processing, send it up */
8344 			ip_fanout_proto_again(first_mp, ill, inill, NULL);
8345 			return;
8346 		}
8347 		case IPPROTO_NONE:
8348 			/* All processing is done. Count as "delivered". */
8349 			freemsg(hada_mp);
8350 			freemsg(first_mp);
8351 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
8352 			return;
8353 		}
8354 		whereptr += used;
8355 		ASSERT(remlen >= used);
8356 		remlen -= used;
8357 	}
8358 	/* NOTREACHED */
8359 
8360 pkt_too_short:
8361 	ip1dbg(("ip_rput_data_v6: packet too short %d %lu %d\n",
8362 	    ip6_len, pkt_len, remlen));
8363 	BUMP_MIB(ill->ill_ip_mib, ipIfStatsInTruncatedPkts);
8364 	freemsg(hada_mp);
8365 	freemsg(first_mp);
8366 	return;
8367 udp_fanout:
8368 	if (mctl_present || IN6_IS_ADDR_MULTICAST(&ip6h->ip6_dst)) {
8369 		connp = NULL;
8370 	} else {
8371 		connp = ipcl_classify_v6(mp, IPPROTO_UDP, hdr_len, zoneid,
8372 		    ipst);
8373 		if ((connp != NULL) && (connp->conn_upq == NULL)) {
8374 			CONN_DEC_REF(connp);
8375 			connp = NULL;
8376 		}
8377 	}
8378 
8379 	if (connp == NULL) {
8380 		uint32_t	ports;
8381 
8382 		ports = *(uint32_t *)(mp->b_rptr + hdr_len +
8383 		    UDP_PORTS_OFFSET);
8384 		IP6_STAT(ipst, ip6_udp_slow_path);
8385 		ip_fanout_udp_v6(q, first_mp, ip6h, ports, ill, inill,
8386 		    (flags|IP_FF_SEND_ICMP|IP_FF_IPINFO), mctl_present,
8387 		    zoneid);
8388 		return;
8389 	}
8390 
8391 	if (CONN_UDP_FLOWCTLD(connp)) {
8392 		freemsg(first_mp);
8393 		BUMP_MIB(ill->ill_ip_mib, udpIfStatsInOverflows);
8394 		CONN_DEC_REF(connp);
8395 		return;
8396 	}
8397 
8398 	/* Initiate IPPF processing */
8399 	if (IP6_IN_IPP(flags, ipst)) {
8400 		ip_process(IPP_LOCAL_IN, &mp, ill->ill_phyint->phyint_ifindex);
8401 		if (mp == NULL) {
8402 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
8403 			CONN_DEC_REF(connp);
8404 			return;
8405 		}
8406 	}
8407 
8408 	if (connp->conn_ip_recvpktinfo ||
8409 	    IN6_IS_ADDR_LINKLOCAL(&ip6h->ip6_src)) {
8410 		mp = ip_add_info_v6(mp, inill, &ip6h->ip6_dst);
8411 		if (mp == NULL) {
8412 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
8413 			CONN_DEC_REF(connp);
8414 			return;
8415 		}
8416 	}
8417 
8418 	IP6_STAT(ipst, ip6_udp_fast_path);
8419 	BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
8420 
8421 	/* Send it upstream */
8422 	(connp->conn_recv)(connp, mp, NULL);
8423 
8424 	CONN_DEC_REF(connp);
8425 	freemsg(hada_mp);
8426 	return;
8427 
8428 hada_drop:
8429 	ip1dbg(("ip_rput_data_v6: malformed accelerated packet\n"));
8430 	/* IPsec kstats: bump counter here */
8431 	freemsg(hada_mp);
8432 	freemsg(first_mp);
8433 }
8434 
8435 /*
8436  * Reassemble fragment.
8437  * When it returns a completed message the first mblk will only contain
8438  * the headers prior to the fragment header.
8439  *
8440  * prev_nexthdr_offset is an offset indication of where the nexthdr field is
8441  * of the preceding header.  This is needed to patch the previous header's
8442  * nexthdr field when reassembly completes.
8443  */
8444 static mblk_t *
8445 ip_rput_frag_v6(queue_t *q, mblk_t *mp, ip6_t *ip6h,
8446     ip6_frag_t *fraghdr, uint_t remlen, uint_t *prev_nexthdr_offset,
8447     uint32_t *cksum_val, uint16_t *cksum_flags)
8448 {
8449 	ill_t		*ill = (ill_t *)q->q_ptr;
8450 	uint32_t	ident = ntohl(fraghdr->ip6f_ident);
8451 	uint16_t	offset;
8452 	boolean_t	more_frags;
8453 	uint8_t		nexthdr = fraghdr->ip6f_nxt;
8454 	in6_addr_t	*v6dst_ptr;
8455 	in6_addr_t	*v6src_ptr;
8456 	uint_t		end;
8457 	uint_t		hdr_length;
8458 	size_t		count;
8459 	ipf_t		*ipf;
8460 	ipf_t		**ipfp;
8461 	ipfb_t		*ipfb;
8462 	mblk_t		*mp1;
8463 	uint8_t		ecn_info = 0;
8464 	size_t		msg_len;
8465 	mblk_t		*tail_mp;
8466 	mblk_t		*t_mp;
8467 	boolean_t	pruned = B_FALSE;
8468 	uint32_t	sum_val;
8469 	uint16_t	sum_flags;
8470 	ip_stack_t	*ipst = ill->ill_ipst;
8471 
8472 	if (cksum_val != NULL)
8473 		*cksum_val = 0;
8474 	if (cksum_flags != NULL)
8475 		*cksum_flags = 0;
8476 
8477 	/*
8478 	 * We utilize hardware computed checksum info only for UDP since
8479 	 * IP fragmentation is a normal occurence for the protocol.  In
8480 	 * addition, checksum offload support for IP fragments carrying
8481 	 * UDP payload is commonly implemented across network adapters.
8482 	 */
8483 	ASSERT(ill != NULL);
8484 	if (nexthdr == IPPROTO_UDP && dohwcksum && ILL_HCKSUM_CAPABLE(ill) &&
8485 	    (DB_CKSUMFLAGS(mp) & (HCK_FULLCKSUM | HCK_PARTIALCKSUM))) {
8486 		mblk_t *mp1 = mp->b_cont;
8487 		int32_t len;
8488 
8489 		/* Record checksum information from the packet */
8490 		sum_val = (uint32_t)DB_CKSUM16(mp);
8491 		sum_flags = DB_CKSUMFLAGS(mp);
8492 
8493 		/* fragmented payload offset from beginning of mblk */
8494 		offset = (uint16_t)((uchar_t *)&fraghdr[1] - mp->b_rptr);
8495 
8496 		if ((sum_flags & HCK_PARTIALCKSUM) &&
8497 		    (mp1 == NULL || mp1->b_cont == NULL) &&
8498 		    offset >= (uint16_t)DB_CKSUMSTART(mp) &&
8499 		    ((len = offset - (uint16_t)DB_CKSUMSTART(mp)) & 1) == 0) {
8500 			uint32_t adj;
8501 			/*
8502 			 * Partial checksum has been calculated by hardware
8503 			 * and attached to the packet; in addition, any
8504 			 * prepended extraneous data is even byte aligned.
8505 			 * If any such data exists, we adjust the checksum;
8506 			 * this would also handle any postpended data.
8507 			 */
8508 			IP_ADJCKSUM_PARTIAL(mp->b_rptr + DB_CKSUMSTART(mp),
8509 			    mp, mp1, len, adj);
8510 
8511 			/* One's complement subtract extraneous checksum */
8512 			if (adj >= sum_val)
8513 				sum_val = ~(adj - sum_val) & 0xFFFF;
8514 			else
8515 				sum_val -= adj;
8516 		}
8517 	} else {
8518 		sum_val = 0;
8519 		sum_flags = 0;
8520 	}
8521 
8522 	/* Clear hardware checksumming flag */
8523 	DB_CKSUMFLAGS(mp) = 0;
8524 
8525 	/*
8526 	 * Note: Fragment offset in header is in 8-octet units.
8527 	 * Clearing least significant 3 bits not only extracts
8528 	 * it but also gets it in units of octets.
8529 	 */
8530 	offset = ntohs(fraghdr->ip6f_offlg) & ~7;
8531 	more_frags = (fraghdr->ip6f_offlg & IP6F_MORE_FRAG);
8532 
8533 	/*
8534 	 * Is the more frags flag on and the payload length not a multiple
8535 	 * of eight?
8536 	 */
8537 	if (more_frags && (ntohs(ip6h->ip6_plen) & 7)) {
8538 		zoneid_t zoneid;
8539 
8540 		BUMP_MIB(ill->ill_ip_mib, ipIfStatsInHdrErrors);
8541 		zoneid = ipif_lookup_addr_zoneid_v6(&ip6h->ip6_dst, ill, ipst);
8542 		if (zoneid == ALL_ZONES) {
8543 			freemsg(mp);
8544 			return (NULL);
8545 		}
8546 		icmp_param_problem_v6(WR(q), mp, ICMP6_PARAMPROB_HEADER,
8547 		    (uint32_t)((char *)&ip6h->ip6_plen -
8548 		    (char *)ip6h), B_FALSE, B_FALSE, zoneid, ipst);
8549 		return (NULL);
8550 	}
8551 
8552 	v6src_ptr = &ip6h->ip6_src;
8553 	v6dst_ptr = &ip6h->ip6_dst;
8554 	end = remlen;
8555 
8556 	hdr_length = (uint_t)((char *)&fraghdr[1] - (char *)ip6h);
8557 	end += offset;
8558 
8559 	/*
8560 	 * Would fragment cause reassembled packet to have a payload length
8561 	 * greater than IP_MAXPACKET - the max payload size?
8562 	 */
8563 	if (end > IP_MAXPACKET) {
8564 		zoneid_t	zoneid;
8565 
8566 		BUMP_MIB(ill->ill_ip_mib, ipIfStatsInHdrErrors);
8567 		zoneid = ipif_lookup_addr_zoneid_v6(&ip6h->ip6_dst, ill, ipst);
8568 		if (zoneid == ALL_ZONES) {
8569 			freemsg(mp);
8570 			return (NULL);
8571 		}
8572 		icmp_param_problem_v6(WR(q), mp, ICMP6_PARAMPROB_HEADER,
8573 		    (uint32_t)((char *)&fraghdr->ip6f_offlg -
8574 		    (char *)ip6h), B_FALSE, B_FALSE, zoneid, ipst);
8575 		return (NULL);
8576 	}
8577 
8578 	/*
8579 	 * This packet just has one fragment. Reassembly not
8580 	 * needed.
8581 	 */
8582 	if (!more_frags && offset == 0) {
8583 		goto reass_done;
8584 	}
8585 
8586 	/*
8587 	 * Drop the fragmented as early as possible, if
8588 	 * we don't have resource(s) to re-assemble.
8589 	 */
8590 	if (ipst->ips_ip_reass_queue_bytes == 0) {
8591 		freemsg(mp);
8592 		return (NULL);
8593 	}
8594 
8595 	/* Record the ECN field info. */
8596 	ecn_info = (uint8_t)(ntohl(ip6h->ip6_vcf & htonl(~0xFFCFFFFF)) >> 20);
8597 	/*
8598 	 * If this is not the first fragment, dump the unfragmentable
8599 	 * portion of the packet.
8600 	 */
8601 	if (offset)
8602 		mp->b_rptr = (uchar_t *)&fraghdr[1];
8603 
8604 	/*
8605 	 * Fragmentation reassembly.  Each ILL has a hash table for
8606 	 * queueing packets undergoing reassembly for all IPIFs
8607 	 * associated with the ILL.  The hash is based on the packet
8608 	 * IP ident field.  The ILL frag hash table was allocated
8609 	 * as a timer block at the time the ILL was created.  Whenever
8610 	 * there is anything on the reassembly queue, the timer will
8611 	 * be running.
8612 	 */
8613 	msg_len = MBLKSIZE(mp);
8614 	tail_mp = mp;
8615 	while (tail_mp->b_cont != NULL) {
8616 		tail_mp = tail_mp->b_cont;
8617 		msg_len += MBLKSIZE(tail_mp);
8618 	}
8619 	/*
8620 	 * If the reassembly list for this ILL will get too big
8621 	 * prune it.
8622 	 */
8623 
8624 	if ((msg_len + sizeof (*ipf) + ill->ill_frag_count) >=
8625 	    ipst->ips_ip_reass_queue_bytes) {
8626 		ill_frag_prune(ill,
8627 		    (ipst->ips_ip_reass_queue_bytes < msg_len) ? 0 :
8628 		    (ipst->ips_ip_reass_queue_bytes - msg_len));
8629 		pruned = B_TRUE;
8630 	}
8631 
8632 	ipfb = &ill->ill_frag_hash_tbl[ILL_FRAG_HASH_V6(*v6src_ptr, ident)];
8633 	mutex_enter(&ipfb->ipfb_lock);
8634 
8635 	ipfp = &ipfb->ipfb_ipf;
8636 	/* Try to find an existing fragment queue for this packet. */
8637 	for (;;) {
8638 		ipf = ipfp[0];
8639 		if (ipf) {
8640 			/*
8641 			 * It has to match on ident, source address, and
8642 			 * dest address.
8643 			 */
8644 			if (ipf->ipf_ident == ident &&
8645 			    IN6_ARE_ADDR_EQUAL(&ipf->ipf_v6src, v6src_ptr) &&
8646 			    IN6_ARE_ADDR_EQUAL(&ipf->ipf_v6dst, v6dst_ptr)) {
8647 
8648 				/*
8649 				 * If we have received too many
8650 				 * duplicate fragments for this packet
8651 				 * free it.
8652 				 */
8653 				if (ipf->ipf_num_dups > ip_max_frag_dups) {
8654 					ill_frag_free_pkts(ill, ipfb, ipf, 1);
8655 					freemsg(mp);
8656 					mutex_exit(&ipfb->ipfb_lock);
8657 					return (NULL);
8658 				}
8659 
8660 				break;
8661 			}
8662 			ipfp = &ipf->ipf_hash_next;
8663 			continue;
8664 		}
8665 
8666 
8667 		/*
8668 		 * If we pruned the list, do we want to store this new
8669 		 * fragment?. We apply an optimization here based on the
8670 		 * fact that most fragments will be received in order.
8671 		 * So if the offset of this incoming fragment is zero,
8672 		 * it is the first fragment of a new packet. We will
8673 		 * keep it.  Otherwise drop the fragment, as we have
8674 		 * probably pruned the packet already (since the
8675 		 * packet cannot be found).
8676 		 */
8677 
8678 		if (pruned && offset != 0) {
8679 			mutex_exit(&ipfb->ipfb_lock);
8680 			freemsg(mp);
8681 			return (NULL);
8682 		}
8683 
8684 		/* New guy.  Allocate a frag message. */
8685 		mp1 = allocb(sizeof (*ipf), BPRI_MED);
8686 		if (!mp1) {
8687 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
8688 			freemsg(mp);
8689 	partial_reass_done:
8690 			mutex_exit(&ipfb->ipfb_lock);
8691 			return (NULL);
8692 		}
8693 
8694 		if (ipfb->ipfb_frag_pkts >= MAX_FRAG_PKTS(ipst))  {
8695 			/*
8696 			 * Too many fragmented packets in this hash bucket.
8697 			 * Free the oldest.
8698 			 */
8699 			ill_frag_free_pkts(ill, ipfb, ipfb->ipfb_ipf, 1);
8700 		}
8701 
8702 		mp1->b_cont = mp;
8703 
8704 		/* Initialize the fragment header. */
8705 		ipf = (ipf_t *)mp1->b_rptr;
8706 		ipf->ipf_mp = mp1;
8707 		ipf->ipf_ptphn = ipfp;
8708 		ipfp[0] = ipf;
8709 		ipf->ipf_hash_next = NULL;
8710 		ipf->ipf_ident = ident;
8711 		ipf->ipf_v6src = *v6src_ptr;
8712 		ipf->ipf_v6dst = *v6dst_ptr;
8713 		/* Record reassembly start time. */
8714 		ipf->ipf_timestamp = gethrestime_sec();
8715 		/* Record ipf generation and account for frag header */
8716 		ipf->ipf_gen = ill->ill_ipf_gen++;
8717 		ipf->ipf_count = MBLKSIZE(mp1);
8718 		ipf->ipf_protocol = nexthdr;
8719 		ipf->ipf_nf_hdr_len = 0;
8720 		ipf->ipf_prev_nexthdr_offset = 0;
8721 		ipf->ipf_last_frag_seen = B_FALSE;
8722 		ipf->ipf_ecn = ecn_info;
8723 		ipf->ipf_num_dups = 0;
8724 		ipfb->ipfb_frag_pkts++;
8725 		ipf->ipf_checksum = 0;
8726 		ipf->ipf_checksum_flags = 0;
8727 
8728 		/* Store checksum value in fragment header */
8729 		if (sum_flags != 0) {
8730 			sum_val = (sum_val & 0xFFFF) + (sum_val >> 16);
8731 			sum_val = (sum_val & 0xFFFF) + (sum_val >> 16);
8732 			ipf->ipf_checksum = sum_val;
8733 			ipf->ipf_checksum_flags = sum_flags;
8734 		}
8735 
8736 		/*
8737 		 * We handle reassembly two ways.  In the easy case,
8738 		 * where all the fragments show up in order, we do
8739 		 * minimal bookkeeping, and just clip new pieces on
8740 		 * the end.  If we ever see a hole, then we go off
8741 		 * to ip_reassemble which has to mark the pieces and
8742 		 * keep track of the number of holes, etc.  Obviously,
8743 		 * the point of having both mechanisms is so we can
8744 		 * handle the easy case as efficiently as possible.
8745 		 */
8746 		if (offset == 0) {
8747 			/* Easy case, in-order reassembly so far. */
8748 			/* Update the byte count */
8749 			ipf->ipf_count += msg_len;
8750 			ipf->ipf_tail_mp = tail_mp;
8751 			/*
8752 			 * Keep track of next expected offset in
8753 			 * ipf_end.
8754 			 */
8755 			ipf->ipf_end = end;
8756 			ipf->ipf_nf_hdr_len = hdr_length;
8757 			ipf->ipf_prev_nexthdr_offset = *prev_nexthdr_offset;
8758 		} else {
8759 			/* Hard case, hole at the beginning. */
8760 			ipf->ipf_tail_mp = NULL;
8761 			/*
8762 			 * ipf_end == 0 means that we have given up
8763 			 * on easy reassembly.
8764 			 */
8765 			ipf->ipf_end = 0;
8766 
8767 			/* Forget checksum offload from now on */
8768 			ipf->ipf_checksum_flags = 0;
8769 
8770 			/*
8771 			 * ipf_hole_cnt is set by ip_reassemble.
8772 			 * ipf_count is updated by ip_reassemble.
8773 			 * No need to check for return value here
8774 			 * as we don't expect reassembly to complete or
8775 			 * fail for the first fragment itself.
8776 			 */
8777 			(void) ip_reassemble(mp, ipf, offset, more_frags, ill,
8778 			    msg_len);
8779 		}
8780 		/* Update per ipfb and ill byte counts */
8781 		ipfb->ipfb_count += ipf->ipf_count;
8782 		ASSERT(ipfb->ipfb_count > 0);	/* Wraparound */
8783 		atomic_add_32(&ill->ill_frag_count, ipf->ipf_count);
8784 		/* If the frag timer wasn't already going, start it. */
8785 		mutex_enter(&ill->ill_lock);
8786 		ill_frag_timer_start(ill);
8787 		mutex_exit(&ill->ill_lock);
8788 		goto partial_reass_done;
8789 	}
8790 
8791 	/*
8792 	 * If the packet's flag has changed (it could be coming up
8793 	 * from an interface different than the previous, therefore
8794 	 * possibly different checksum capability), then forget about
8795 	 * any stored checksum states.  Otherwise add the value to
8796 	 * the existing one stored in the fragment header.
8797 	 */
8798 	if (sum_flags != 0 && sum_flags == ipf->ipf_checksum_flags) {
8799 		sum_val += ipf->ipf_checksum;
8800 		sum_val = (sum_val & 0xFFFF) + (sum_val >> 16);
8801 		sum_val = (sum_val & 0xFFFF) + (sum_val >> 16);
8802 		ipf->ipf_checksum = sum_val;
8803 	} else if (ipf->ipf_checksum_flags != 0) {
8804 		/* Forget checksum offload from now on */
8805 		ipf->ipf_checksum_flags = 0;
8806 	}
8807 
8808 	/*
8809 	 * We have a new piece of a datagram which is already being
8810 	 * reassembled.  Update the ECN info if all IP fragments
8811 	 * are ECN capable.  If there is one which is not, clear
8812 	 * all the info.  If there is at least one which has CE
8813 	 * code point, IP needs to report that up to transport.
8814 	 */
8815 	if (ecn_info != IPH_ECN_NECT && ipf->ipf_ecn != IPH_ECN_NECT) {
8816 		if (ecn_info == IPH_ECN_CE)
8817 			ipf->ipf_ecn = IPH_ECN_CE;
8818 	} else {
8819 		ipf->ipf_ecn = IPH_ECN_NECT;
8820 	}
8821 
8822 	if (offset && ipf->ipf_end == offset) {
8823 		/* The new fragment fits at the end */
8824 		ipf->ipf_tail_mp->b_cont = mp;
8825 		/* Update the byte count */
8826 		ipf->ipf_count += msg_len;
8827 		/* Update per ipfb and ill byte counts */
8828 		ipfb->ipfb_count += msg_len;
8829 		ASSERT(ipfb->ipfb_count > 0);	/* Wraparound */
8830 		atomic_add_32(&ill->ill_frag_count, msg_len);
8831 		if (more_frags) {
8832 			/* More to come. */
8833 			ipf->ipf_end = end;
8834 			ipf->ipf_tail_mp = tail_mp;
8835 			goto partial_reass_done;
8836 		}
8837 	} else {
8838 		/*
8839 		 * Go do the hard cases.
8840 		 * Call ip_reassemble().
8841 		 */
8842 		int ret;
8843 
8844 		if (offset == 0) {
8845 			if (ipf->ipf_prev_nexthdr_offset == 0) {
8846 				ipf->ipf_nf_hdr_len = hdr_length;
8847 				ipf->ipf_prev_nexthdr_offset =
8848 				    *prev_nexthdr_offset;
8849 			}
8850 		}
8851 		/* Save current byte count */
8852 		count = ipf->ipf_count;
8853 		ret = ip_reassemble(mp, ipf, offset, more_frags, ill, msg_len);
8854 
8855 		/* Count of bytes added and subtracted (freeb()ed) */
8856 		count = ipf->ipf_count - count;
8857 		if (count) {
8858 			/* Update per ipfb and ill byte counts */
8859 			ipfb->ipfb_count += count;
8860 			ASSERT(ipfb->ipfb_count > 0);	/* Wraparound */
8861 			atomic_add_32(&ill->ill_frag_count, count);
8862 		}
8863 		if (ret == IP_REASS_PARTIAL) {
8864 			goto partial_reass_done;
8865 		} else if (ret == IP_REASS_FAILED) {
8866 			/* Reassembly failed. Free up all resources */
8867 			ill_frag_free_pkts(ill, ipfb, ipf, 1);
8868 			for (t_mp = mp; t_mp != NULL; t_mp = t_mp->b_cont) {
8869 				IP_REASS_SET_START(t_mp, 0);
8870 				IP_REASS_SET_END(t_mp, 0);
8871 			}
8872 			freemsg(mp);
8873 			goto partial_reass_done;
8874 		}
8875 
8876 		/* We will reach here iff 'ret' is IP_REASS_COMPLETE */
8877 	}
8878 	/*
8879 	 * We have completed reassembly.  Unhook the frag header from
8880 	 * the reassembly list.
8881 	 *
8882 	 * Grab the unfragmentable header length next header value out
8883 	 * of the first fragment
8884 	 */
8885 	ASSERT(ipf->ipf_nf_hdr_len != 0);
8886 	hdr_length = ipf->ipf_nf_hdr_len;
8887 
8888 	/*
8889 	 * Before we free the frag header, record the ECN info
8890 	 * to report back to the transport.
8891 	 */
8892 	ecn_info = ipf->ipf_ecn;
8893 
8894 	/*
8895 	 * Store the nextheader field in the header preceding the fragment
8896 	 * header
8897 	 */
8898 	nexthdr = ipf->ipf_protocol;
8899 	*prev_nexthdr_offset = ipf->ipf_prev_nexthdr_offset;
8900 	ipfp = ipf->ipf_ptphn;
8901 
8902 	/* We need to supply these to caller */
8903 	if ((sum_flags = ipf->ipf_checksum_flags) != 0)
8904 		sum_val = ipf->ipf_checksum;
8905 	else
8906 		sum_val = 0;
8907 
8908 	mp1 = ipf->ipf_mp;
8909 	count = ipf->ipf_count;
8910 	ipf = ipf->ipf_hash_next;
8911 	if (ipf)
8912 		ipf->ipf_ptphn = ipfp;
8913 	ipfp[0] = ipf;
8914 	atomic_add_32(&ill->ill_frag_count, -count);
8915 	ASSERT(ipfb->ipfb_count >= count);
8916 	ipfb->ipfb_count -= count;
8917 	ipfb->ipfb_frag_pkts--;
8918 	mutex_exit(&ipfb->ipfb_lock);
8919 	/* Ditch the frag header. */
8920 	mp = mp1->b_cont;
8921 	freeb(mp1);
8922 
8923 	/*
8924 	 * Make sure the packet is good by doing some sanity
8925 	 * check. If bad we can silentely drop the packet.
8926 	 */
8927 reass_done:
8928 	if (hdr_length < sizeof (ip6_frag_t)) {
8929 		BUMP_MIB(ill->ill_ip_mib, ipIfStatsInHdrErrors);
8930 		ip1dbg(("ip_rput_frag_v6: bad packet\n"));
8931 		freemsg(mp);
8932 		return (NULL);
8933 	}
8934 
8935 	/*
8936 	 * Remove the fragment header from the initial header by
8937 	 * splitting the mblk into the non-fragmentable header and
8938 	 * everthing after the fragment extension header.  This has the
8939 	 * side effect of putting all the headers that need destination
8940 	 * processing into the b_cont block-- on return this fact is
8941 	 * used in order to avoid having to look at the extensions
8942 	 * already processed.
8943 	 *
8944 	 * Note that this code assumes that the unfragmentable portion
8945 	 * of the header is in the first mblk and increments
8946 	 * the read pointer past it.  If this assumption is broken
8947 	 * this code fails badly.
8948 	 */
8949 	if (mp->b_rptr + hdr_length != mp->b_wptr) {
8950 		mblk_t *nmp;
8951 
8952 		if (!(nmp = dupb(mp))) {
8953 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
8954 			ip1dbg(("ip_rput_frag_v6: dupb failed\n"));
8955 			freemsg(mp);
8956 			return (NULL);
8957 		}
8958 		nmp->b_cont = mp->b_cont;
8959 		mp->b_cont = nmp;
8960 		nmp->b_rptr += hdr_length;
8961 	}
8962 	mp->b_wptr = mp->b_rptr + hdr_length - sizeof (ip6_frag_t);
8963 
8964 	ip6h = (ip6_t *)mp->b_rptr;
8965 	((char *)ip6h)[*prev_nexthdr_offset] = nexthdr;
8966 
8967 	/* Restore original IP length in header. */
8968 	ip6h->ip6_plen = htons((uint16_t)(msgdsize(mp) - IPV6_HDR_LEN));
8969 	/* Record the ECN info. */
8970 	ip6h->ip6_vcf &= htonl(0xFFCFFFFF);
8971 	ip6h->ip6_vcf |= htonl(ecn_info << 20);
8972 
8973 	/* Reassembly is successful; return checksum information if needed */
8974 	if (cksum_val != NULL)
8975 		*cksum_val = sum_val;
8976 	if (cksum_flags != NULL)
8977 		*cksum_flags = sum_flags;
8978 
8979 	return (mp);
8980 }
8981 
8982 /*
8983  * Walk through the options to see if there is a routing header.
8984  * If present get the destination which is the last address of
8985  * the option.
8986  */
8987 in6_addr_t
8988 ip_get_dst_v6(ip6_t *ip6h, boolean_t *is_fragment)
8989 {
8990 	uint8_t nexthdr;
8991 	uint8_t *whereptr;
8992 	ip6_hbh_t *hbhhdr;
8993 	ip6_dest_t *dsthdr;
8994 	ip6_rthdr0_t *rthdr;
8995 	ip6_frag_t *fraghdr;
8996 	int ehdrlen;
8997 	int left;
8998 	in6_addr_t *ap, rv;
8999 
9000 	if (is_fragment != NULL)
9001 		*is_fragment = B_FALSE;
9002 
9003 	rv = ip6h->ip6_dst;
9004 
9005 	nexthdr = ip6h->ip6_nxt;
9006 	whereptr = (uint8_t *)&ip6h[1];
9007 	for (;;) {
9008 
9009 		ASSERT(nexthdr != IPPROTO_RAW);
9010 		switch (nexthdr) {
9011 		case IPPROTO_HOPOPTS:
9012 			hbhhdr = (ip6_hbh_t *)whereptr;
9013 			nexthdr = hbhhdr->ip6h_nxt;
9014 			ehdrlen = 8 * (hbhhdr->ip6h_len + 1);
9015 			break;
9016 		case IPPROTO_DSTOPTS:
9017 			dsthdr = (ip6_dest_t *)whereptr;
9018 			nexthdr = dsthdr->ip6d_nxt;
9019 			ehdrlen = 8 * (dsthdr->ip6d_len + 1);
9020 			break;
9021 		case IPPROTO_ROUTING:
9022 			rthdr = (ip6_rthdr0_t *)whereptr;
9023 			nexthdr = rthdr->ip6r0_nxt;
9024 			ehdrlen = 8 * (rthdr->ip6r0_len + 1);
9025 
9026 			left = rthdr->ip6r0_segleft;
9027 			ap = (in6_addr_t *)((char *)rthdr + sizeof (*rthdr));
9028 			rv = *(ap + left - 1);
9029 			/*
9030 			 * If the caller doesn't care whether the packet
9031 			 * is a fragment or not, we can stop here since
9032 			 * we have our destination.
9033 			 */
9034 			if (is_fragment == NULL)
9035 				goto done;
9036 			break;
9037 		case IPPROTO_FRAGMENT:
9038 			fraghdr = (ip6_frag_t *)whereptr;
9039 			nexthdr = fraghdr->ip6f_nxt;
9040 			ehdrlen = sizeof (ip6_frag_t);
9041 			if (is_fragment != NULL)
9042 				*is_fragment = B_TRUE;
9043 			goto done;
9044 		default :
9045 			goto done;
9046 		}
9047 		whereptr += ehdrlen;
9048 	}
9049 
9050 done:
9051 	return (rv);
9052 }
9053 
9054 /*
9055  * ip_source_routed_v6:
9056  * This function is called by redirect code in ip_rput_data_v6 to
9057  * know whether this packet is source routed through this node i.e
9058  * whether this node (router) is part of the journey. This
9059  * function is called under two cases :
9060  *
9061  * case 1 : Routing header was processed by this node and
9062  *	    ip_process_rthdr replaced ip6_dst with the next hop
9063  *          and we are forwarding the packet to the next hop.
9064  *
9065  * case 2 : Routing header was not processed by this node and we
9066  *	    are just forwarding the packet.
9067  *
9068  * For case (1) we don't want to send redirects. For case(2) we
9069  * want to send redirects.
9070  */
9071 static boolean_t
9072 ip_source_routed_v6(ip6_t *ip6h, mblk_t *mp, ip_stack_t *ipst)
9073 {
9074 	uint8_t		nexthdr;
9075 	in6_addr_t	*addrptr;
9076 	ip6_rthdr0_t	*rthdr;
9077 	uint8_t		numaddr;
9078 	ip6_hbh_t	*hbhhdr;
9079 	uint_t		ehdrlen;
9080 	uint8_t		*byteptr;
9081 
9082 	ip2dbg(("ip_source_routed_v6\n"));
9083 	nexthdr = ip6h->ip6_nxt;
9084 	ehdrlen = IPV6_HDR_LEN;
9085 
9086 	/* if a routing hdr is preceeded by HOPOPT or DSTOPT */
9087 	while (nexthdr == IPPROTO_HOPOPTS ||
9088 	    nexthdr == IPPROTO_DSTOPTS) {
9089 		byteptr = (uint8_t *)ip6h + ehdrlen;
9090 		/*
9091 		 * Check if we have already processed
9092 		 * packets or we are just a forwarding
9093 		 * router which only pulled up msgs up
9094 		 * to IPV6HDR and  one HBH ext header
9095 		 */
9096 		if (byteptr + MIN_EHDR_LEN > mp->b_wptr) {
9097 			ip2dbg(("ip_source_routed_v6: Extension"
9098 			    " headers not processed\n"));
9099 			return (B_FALSE);
9100 		}
9101 		hbhhdr = (ip6_hbh_t *)byteptr;
9102 		nexthdr = hbhhdr->ip6h_nxt;
9103 		ehdrlen = ehdrlen + 8 * (hbhhdr->ip6h_len + 1);
9104 	}
9105 	switch (nexthdr) {
9106 	case IPPROTO_ROUTING:
9107 		byteptr = (uint8_t *)ip6h + ehdrlen;
9108 		/*
9109 		 * If for some reason, we haven't pulled up
9110 		 * the routing hdr data mblk, then we must
9111 		 * not have processed it at all. So for sure
9112 		 * we are not part of the source routed journey.
9113 		 */
9114 		if (byteptr + MIN_EHDR_LEN > mp->b_wptr) {
9115 			ip2dbg(("ip_source_routed_v6: Routing"
9116 			    " header not processed\n"));
9117 			return (B_FALSE);
9118 		}
9119 		rthdr = (ip6_rthdr0_t *)byteptr;
9120 		/*
9121 		 * Either we are an intermediate router or the
9122 		 * last hop before destination and we have
9123 		 * already processed the routing header.
9124 		 * If segment_left is greater than or equal to zero,
9125 		 * then we must be the (numaddr - segleft) entry
9126 		 * of the routing header. Although ip6r0_segleft
9127 		 * is a unit8_t variable, we still check for zero
9128 		 * or greater value, if in case the data type
9129 		 * is changed someday in future.
9130 		 */
9131 		if (rthdr->ip6r0_segleft > 0 ||
9132 		    rthdr->ip6r0_segleft == 0) {
9133 			ire_t 	*ire = NULL;
9134 
9135 			numaddr = rthdr->ip6r0_len / 2;
9136 			addrptr = (in6_addr_t *)((char *)rthdr +
9137 			    sizeof (*rthdr));
9138 			addrptr += (numaddr - (rthdr->ip6r0_segleft + 1));
9139 			if (addrptr != NULL) {
9140 				ire = ire_ctable_lookup_v6(addrptr, NULL,
9141 				    IRE_LOCAL, NULL, ALL_ZONES, NULL,
9142 				    MATCH_IRE_TYPE,
9143 				    ipst);
9144 				if (ire != NULL) {
9145 					ire_refrele(ire);
9146 					return (B_TRUE);
9147 				}
9148 				ip1dbg(("ip_source_routed_v6: No ire found\n"));
9149 			}
9150 		}
9151 	/* FALLTHRU */
9152 	default:
9153 		ip2dbg(("ip_source_routed_v6: Not source routed here\n"));
9154 		return (B_FALSE);
9155 	}
9156 }
9157 
9158 /*
9159  * ip_wput_v6 -- Packets sent down from transport modules show up here.
9160  * Assumes that the following set of headers appear in the first
9161  * mblk:
9162  *	ip6i_t (if present) CAN also appear as a separate mblk.
9163  *	ip6_t
9164  *	Any extension headers
9165  *	TCP/UDP/SCTP header (if present)
9166  * The routine can handle an ICMPv6 header that is not in the first mblk.
9167  *
9168  * The order to determine the outgoing interface is as follows:
9169  * 1. IPV6_BOUND_PIF is set, use that ill (conn_outgoing_pill)
9170  * 2. If conn_nofailover_ill is set then use that ill.
9171  * 3. If an ip6i_t with IP6I_IFINDEX set then use that ill.
9172  * 4. If q is an ill queue and (link local or multicast destination) then
9173  *    use that ill.
9174  * 5. If IPV6_BOUND_IF has been set use that ill.
9175  * 6. For multicast: if IPV6_MULTICAST_IF has been set use it. Otherwise
9176  *    look for the best IRE match for the unspecified group to determine
9177  *    the ill.
9178  * 7. For unicast: Just do an IRE lookup for the best match.
9179  *
9180  * arg2 is always a queue_t *.
9181  * When that queue is an ill_t (i.e. q_next != NULL), then arg must be
9182  * the zoneid.
9183  * When that queue is not an ill_t, then arg must be a conn_t pointer.
9184  */
9185 void
9186 ip_output_v6(void *arg, mblk_t *mp, void *arg2, int caller)
9187 {
9188 	conn_t		*connp = NULL;
9189 	queue_t		*q = (queue_t *)arg2;
9190 	ire_t		*ire = NULL;
9191 	ire_t		*sctp_ire = NULL;
9192 	ip6_t		*ip6h;
9193 	in6_addr_t	*v6dstp;
9194 	ill_t		*ill = NULL;
9195 	ipif_t		*ipif;
9196 	ip6i_t		*ip6i;
9197 	int		cksum_request;	/* -1 => normal. */
9198 			/* 1 => Skip TCP/UDP/SCTP checksum */
9199 			/* Otherwise contains insert offset for checksum */
9200 	int		unspec_src;
9201 	boolean_t	do_outrequests;	/* Increment OutRequests? */
9202 	mib2_ipIfStatsEntry_t	*mibptr;
9203 	int 		match_flags = MATCH_IRE_ILL_GROUP;
9204 	boolean_t	attach_if = B_FALSE;
9205 	mblk_t		*first_mp;
9206 	boolean_t	mctl_present;
9207 	ipsec_out_t	*io;
9208 	boolean_t	drop_if_delayed = B_FALSE;
9209 	boolean_t	multirt_need_resolve = B_FALSE;
9210 	mblk_t		*copy_mp = NULL;
9211 	int		err = 0;
9212 	int		ip6i_flags = 0;
9213 	zoneid_t	zoneid;
9214 	ill_t		*saved_ill = NULL;
9215 	boolean_t	conn_lock_held;
9216 	boolean_t	need_decref = B_FALSE;
9217 	ip_stack_t	*ipst;
9218 
9219 	if (q->q_next != NULL) {
9220 		ill = (ill_t *)q->q_ptr;
9221 		ipst = ill->ill_ipst;
9222 	} else {
9223 		connp = (conn_t *)arg;
9224 		ASSERT(connp != NULL);
9225 		ipst = connp->conn_netstack->netstack_ip;
9226 	}
9227 
9228 	/*
9229 	 * Highest bit in version field is Reachability Confirmation bit
9230 	 * used by NUD in ip_xmit_v6().
9231 	 */
9232 #ifdef	_BIG_ENDIAN
9233 #define	IPVER(ip6h)	((((uint32_t *)ip6h)[0] >> 28) & 0x7)
9234 #else
9235 #define	IPVER(ip6h)	((((uint32_t *)ip6h)[0] >> 4) & 0x7)
9236 #endif
9237 
9238 	/*
9239 	 * M_CTL comes from 6 places
9240 	 *
9241 	 * 1) TCP sends down IPSEC_OUT(M_CTL) for detached connections
9242 	 *    both V4 and V6 datagrams.
9243 	 *
9244 	 * 2) AH/ESP sends down M_CTL after doing their job with both
9245 	 *    V4 and V6 datagrams.
9246 	 *
9247 	 * 3) NDP callbacks when nce is resolved and IPSEC_OUT has been
9248 	 *    attached.
9249 	 *
9250 	 * 4) Notifications from an external resolver (for XRESOLV ifs)
9251 	 *
9252 	 * 5) AH/ESP send down IPSEC_CTL(M_CTL) to be relayed to hardware for
9253 	 *    IPsec hardware acceleration support.
9254 	 *
9255 	 * 6) TUN_HELLO.
9256 	 *
9257 	 * We need to handle (1)'s IPv6 case and (3) here.  For the
9258 	 * IPv4 case in (1), and (2), IPSEC processing has already
9259 	 * started. The code in ip_wput() already knows how to handle
9260 	 * continuing IPSEC processing (for IPv4 and IPv6).  All other
9261 	 * M_CTLs (including case (4)) are passed on to ip_wput_nondata()
9262 	 * for handling.
9263 	 */
9264 	first_mp = mp;
9265 	mctl_present = B_FALSE;
9266 	io = NULL;
9267 
9268 	/* Multidata transmit? */
9269 	if (DB_TYPE(mp) == M_MULTIDATA) {
9270 		/*
9271 		 * We should never get here, since all Multidata messages
9272 		 * originating from tcp should have been directed over to
9273 		 * tcp_multisend() in the first place.
9274 		 */
9275 		BUMP_MIB(&ipst->ips_ip6_mib, ipIfStatsOutDiscards);
9276 		freemsg(mp);
9277 		return;
9278 	} else if (DB_TYPE(mp) == M_CTL) {
9279 		uint32_t mctltype = 0;
9280 		uint32_t mlen = MBLKL(first_mp);
9281 
9282 		mp = mp->b_cont;
9283 		mctl_present = B_TRUE;
9284 		io = (ipsec_out_t *)first_mp->b_rptr;
9285 
9286 		/*
9287 		 * Validate this M_CTL message.  The only three types of
9288 		 * M_CTL messages we expect to see in this code path are
9289 		 * ipsec_out_t or ipsec_in_t structures (allocated as
9290 		 * ipsec_info_t unions), or ipsec_ctl_t structures.
9291 		 * The ipsec_out_type and ipsec_in_type overlap in the two
9292 		 * data structures, and they are either set to IPSEC_OUT
9293 		 * or IPSEC_IN depending on which data structure it is.
9294 		 * ipsec_ctl_t is an IPSEC_CTL.
9295 		 *
9296 		 * All other M_CTL messages are sent to ip_wput_nondata()
9297 		 * for handling.
9298 		 */
9299 		if (mlen >= sizeof (io->ipsec_out_type))
9300 			mctltype = io->ipsec_out_type;
9301 
9302 		if ((mlen == sizeof (ipsec_ctl_t)) &&
9303 		    (mctltype == IPSEC_CTL)) {
9304 			ip_output(arg, first_mp, arg2, caller);
9305 			return;
9306 		}
9307 
9308 		if ((mlen < sizeof (ipsec_info_t)) ||
9309 		    (mctltype != IPSEC_OUT && mctltype != IPSEC_IN) ||
9310 		    mp == NULL) {
9311 			ip_wput_nondata(NULL, q, first_mp, NULL);
9312 			return;
9313 		}
9314 		/* NDP callbacks have q_next non-NULL.  That's case #3. */
9315 		if (q->q_next == NULL) {
9316 			ip6h = (ip6_t *)mp->b_rptr;
9317 			/*
9318 			 * For a freshly-generated TCP dgram that needs IPV6
9319 			 * processing, don't call ip_wput immediately. We can
9320 			 * tell this by the ipsec_out_proc_begin. In-progress
9321 			 * IPSEC_OUT messages have proc_begin set to TRUE,
9322 			 * and we want to send all IPSEC_IN messages to
9323 			 * ip_wput() for IPsec processing or finishing.
9324 			 */
9325 			if (mctltype == IPSEC_IN ||
9326 			    IPVER(ip6h) != IPV6_VERSION ||
9327 			    io->ipsec_out_proc_begin) {
9328 				mibptr = &ipst->ips_ip6_mib;
9329 				goto notv6;
9330 			}
9331 		}
9332 	} else if (DB_TYPE(mp) != M_DATA) {
9333 		ip_wput_nondata(NULL, q, mp, NULL);
9334 		return;
9335 	}
9336 
9337 	ip6h = (ip6_t *)mp->b_rptr;
9338 
9339 	if (IPVER(ip6h) != IPV6_VERSION) {
9340 		mibptr = &ipst->ips_ip6_mib;
9341 		goto notv6;
9342 	}
9343 
9344 	if (is_system_labeled() && DB_TYPE(mp) == M_DATA &&
9345 	    (connp == NULL || !connp->conn_ulp_labeled)) {
9346 		if (connp != NULL) {
9347 			ASSERT(CONN_CRED(connp) != NULL);
9348 			err = tsol_check_label_v6(BEST_CRED(mp, connp),
9349 			    &mp, connp->conn_mac_exempt, ipst);
9350 		} else if (DB_CRED(mp) != NULL) {
9351 			err = tsol_check_label_v6(DB_CRED(mp),
9352 			    &mp, B_FALSE, ipst);
9353 		}
9354 		if (mctl_present)
9355 			first_mp->b_cont = mp;
9356 		else
9357 			first_mp = mp;
9358 		if (err != 0) {
9359 			DTRACE_PROBE3(
9360 			    tsol_ip_log_drop_checklabel_ip6, char *,
9361 			    "conn(1), failed to check/update mp(2)",
9362 			    conn_t, connp, mblk_t, mp);
9363 			freemsg(first_mp);
9364 			return;
9365 		}
9366 		ip6h = (ip6_t *)mp->b_rptr;
9367 	}
9368 	if (q->q_next != NULL) {
9369 		/*
9370 		 * We don't know if this ill will be used for IPv6
9371 		 * until the ILLF_IPV6 flag is set via SIOCSLIFNAME.
9372 		 * ipif_set_values() sets the ill_isv6 flag to true if
9373 		 * ILLF_IPV6 is set.  If the ill_isv6 flag isn't true,
9374 		 * just drop the packet.
9375 		 */
9376 		if (!ill->ill_isv6) {
9377 			ip1dbg(("ip_wput_v6: Received an IPv6 packet before "
9378 			    "ILLF_IPV6 was set\n"));
9379 			freemsg(first_mp);
9380 			return;
9381 		}
9382 		/* For uniformity do a refhold */
9383 		mutex_enter(&ill->ill_lock);
9384 		if (!ILL_CAN_LOOKUP(ill)) {
9385 			mutex_exit(&ill->ill_lock);
9386 			freemsg(first_mp);
9387 			return;
9388 		}
9389 		ill_refhold_locked(ill);
9390 		mutex_exit(&ill->ill_lock);
9391 		mibptr = ill->ill_ip_mib;
9392 
9393 		ASSERT(mibptr != NULL);
9394 		unspec_src = 0;
9395 		BUMP_MIB(mibptr, ipIfStatsHCOutRequests);
9396 		do_outrequests = B_FALSE;
9397 		zoneid = (zoneid_t)(uintptr_t)arg;
9398 	} else {
9399 		ASSERT(connp != NULL);
9400 		zoneid = connp->conn_zoneid;
9401 
9402 		/* is queue flow controlled? */
9403 		if ((q->q_first || connp->conn_draining) &&
9404 		    (caller == IP_WPUT)) {
9405 			/*
9406 			 * 1) TCP sends down M_CTL for detached connections.
9407 			 * 2) AH/ESP sends down M_CTL.
9408 			 *
9409 			 * We don't flow control either of the above. Only
9410 			 * UDP and others are flow controlled for which we
9411 			 * can't have a M_CTL.
9412 			 */
9413 			ASSERT(first_mp == mp);
9414 			(void) putq(q, mp);
9415 			return;
9416 		}
9417 		mibptr = &ipst->ips_ip6_mib;
9418 		unspec_src = connp->conn_unspec_src;
9419 		do_outrequests = B_TRUE;
9420 		if (mp->b_flag & MSGHASREF) {
9421 			mp->b_flag &= ~MSGHASREF;
9422 			ASSERT(connp->conn_ulp == IPPROTO_SCTP);
9423 			SCTP_EXTRACT_IPINFO(mp, sctp_ire);
9424 			need_decref = B_TRUE;
9425 		}
9426 
9427 		/*
9428 		 * If there is a policy, try to attach an ipsec_out in
9429 		 * the front. At the end, first_mp either points to a
9430 		 * M_DATA message or IPSEC_OUT message linked to a
9431 		 * M_DATA message. We have to do it now as we might
9432 		 * lose the "conn" if we go through ip_newroute.
9433 		 */
9434 		if (!mctl_present &&
9435 		    (connp->conn_out_enforce_policy ||
9436 		    connp->conn_latch != NULL)) {
9437 			ASSERT(first_mp == mp);
9438 			/* XXX Any better way to get the protocol fast ? */
9439 			if (((mp = ipsec_attach_ipsec_out(&mp, connp, NULL,
9440 			    connp->conn_ulp, ipst->ips_netstack)) == NULL)) {
9441 				BUMP_MIB(mibptr, ipIfStatsOutDiscards);
9442 				if (need_decref)
9443 					CONN_DEC_REF(connp);
9444 				return;
9445 			} else {
9446 				ASSERT(mp->b_datap->db_type == M_CTL);
9447 				first_mp = mp;
9448 				mp = mp->b_cont;
9449 				mctl_present = B_TRUE;
9450 				io = (ipsec_out_t *)first_mp->b_rptr;
9451 			}
9452 		}
9453 	}
9454 
9455 	/* check for alignment and full IPv6 header */
9456 	if (!OK_32PTR((uchar_t *)ip6h) ||
9457 	    (mp->b_wptr - (uchar_t *)ip6h) < IPV6_HDR_LEN) {
9458 		ip0dbg(("ip_wput_v6: bad alignment or length\n"));
9459 		if (do_outrequests)
9460 			BUMP_MIB(mibptr, ipIfStatsHCOutRequests);
9461 		BUMP_MIB(mibptr, ipIfStatsOutDiscards);
9462 		freemsg(first_mp);
9463 		if (ill != NULL)
9464 			ill_refrele(ill);
9465 		if (need_decref)
9466 			CONN_DEC_REF(connp);
9467 		return;
9468 	}
9469 	v6dstp = &ip6h->ip6_dst;
9470 	cksum_request = -1;
9471 	ip6i = NULL;
9472 
9473 	/*
9474 	 * Once neighbor discovery has completed, ndp_process() will provide
9475 	 * locally generated packets for which processing can be reattempted.
9476 	 * In these cases, connp is NULL and the original zone is part of a
9477 	 * prepended ipsec_out_t.
9478 	 */
9479 	if (io != NULL) {
9480 		/*
9481 		 * When coming from icmp_input_v6, the zoneid might not match
9482 		 * for the loopback case, because inside icmp_input_v6 the
9483 		 * queue_t is a conn queue from the sending side.
9484 		 */
9485 		zoneid = io->ipsec_out_zoneid;
9486 		ASSERT(zoneid != ALL_ZONES);
9487 	}
9488 
9489 	if (ip6h->ip6_nxt == IPPROTO_RAW) {
9490 		/*
9491 		 * This is an ip6i_t header followed by an ip6_hdr.
9492 		 * Check which fields are set.
9493 		 *
9494 		 * When the packet comes from a transport we should have
9495 		 * all needed headers in the first mblk. However, when
9496 		 * going through ip_newroute*_v6 the ip6i might be in
9497 		 * a separate mblk when we return here. In that case
9498 		 * we pullup everything to ensure that extension and transport
9499 		 * headers "stay" in the first mblk.
9500 		 */
9501 		ip6i = (ip6i_t *)ip6h;
9502 		ip6i_flags = ip6i->ip6i_flags;
9503 
9504 		ASSERT((mp->b_wptr - (uchar_t *)ip6i) == sizeof (ip6i_t) ||
9505 		    ((mp->b_wptr - (uchar_t *)ip6i) >=
9506 		    sizeof (ip6i_t) + IPV6_HDR_LEN));
9507 
9508 		if ((mp->b_wptr - (uchar_t *)ip6i) == sizeof (ip6i_t)) {
9509 			if (!pullupmsg(mp, -1)) {
9510 				ip1dbg(("ip_wput_v6: pullupmsg failed\n"));
9511 				if (do_outrequests) {
9512 					BUMP_MIB(mibptr,
9513 					    ipIfStatsHCOutRequests);
9514 				}
9515 				BUMP_MIB(mibptr, ipIfStatsOutDiscards);
9516 				freemsg(first_mp);
9517 				if (ill != NULL)
9518 					ill_refrele(ill);
9519 				if (need_decref)
9520 					CONN_DEC_REF(connp);
9521 				return;
9522 			}
9523 			ip6h = (ip6_t *)mp->b_rptr;
9524 			v6dstp = &ip6h->ip6_dst;
9525 			ip6i = (ip6i_t *)ip6h;
9526 		}
9527 		ip6h = (ip6_t *)&ip6i[1];
9528 
9529 		/*
9530 		 * Advance rptr past the ip6i_t to get ready for
9531 		 * transmitting the packet. However, if the packet gets
9532 		 * passed to ip_newroute*_v6 then rptr is moved back so
9533 		 * that the ip6i_t header can be inspected when the
9534 		 * packet comes back here after passing through
9535 		 * ire_add_then_send.
9536 		 */
9537 		mp->b_rptr = (uchar_t *)ip6h;
9538 
9539 		/*
9540 		 * IP6I_ATTACH_IF is set in this function when we had a
9541 		 * conn and it was either bound to the IPFF_NOFAILOVER address
9542 		 * or IPV6_BOUND_PIF was set. These options override other
9543 		 * options that set the ifindex. We come here with
9544 		 * IP6I_ATTACH_IF set when we can't find the ire and
9545 		 * ip_newroute_v6 is feeding the packet for second time.
9546 		 */
9547 		if ((ip6i->ip6i_flags & IP6I_IFINDEX) ||
9548 		    (ip6i->ip6i_flags & IP6I_ATTACH_IF)) {
9549 			ASSERT(ip6i->ip6i_ifindex != 0);
9550 			if (ill != NULL)
9551 				ill_refrele(ill);
9552 			ill = ill_lookup_on_ifindex(ip6i->ip6i_ifindex, 1,
9553 			    NULL, NULL, NULL, NULL, ipst);
9554 			if (ill == NULL) {
9555 				if (do_outrequests) {
9556 					BUMP_MIB(mibptr,
9557 					    ipIfStatsHCOutRequests);
9558 				}
9559 				BUMP_MIB(mibptr, ipIfStatsOutDiscards);
9560 				ip1dbg(("ip_wput_v6: bad ifindex %d\n",
9561 				    ip6i->ip6i_ifindex));
9562 				if (need_decref)
9563 					CONN_DEC_REF(connp);
9564 				freemsg(first_mp);
9565 				return;
9566 			}
9567 			mibptr = ill->ill_ip_mib;
9568 			if (ip6i->ip6i_flags & IP6I_IFINDEX) {
9569 				/*
9570 				 * Preserve the index so that when we return
9571 				 * from IPSEC processing, we know where to
9572 				 * send the packet.
9573 				 */
9574 				if (mctl_present) {
9575 					ASSERT(io != NULL);
9576 					io->ipsec_out_ill_index =
9577 					    ip6i->ip6i_ifindex;
9578 				}
9579 			}
9580 			if (ip6i->ip6i_flags & IP6I_ATTACH_IF) {
9581 				/*
9582 				 * This is a multipathing probe packet that has
9583 				 * been delayed in ND resolution. Drop the
9584 				 * packet for the reasons mentioned in
9585 				 * nce_queue_mp()
9586 				 */
9587 				if ((ip6i->ip6i_flags & IP6I_DROP_IFDELAYED) &&
9588 				    (ip6i->ip6i_flags & IP6I_ND_DELAYED)) {
9589 					freemsg(first_mp);
9590 					ill_refrele(ill);
9591 					if (need_decref)
9592 						CONN_DEC_REF(connp);
9593 					return;
9594 				}
9595 			}
9596 		}
9597 		if (ip6i->ip6i_flags & IP6I_VERIFY_SRC) {
9598 			cred_t *cr = DB_CREDDEF(mp, GET_QUEUE_CRED(q));
9599 
9600 			ASSERT(!IN6_IS_ADDR_UNSPECIFIED(&ip6h->ip6_src));
9601 			if (secpolicy_net_rawaccess(cr) != 0) {
9602 				/*
9603 				 * Use IPCL_ZONEID to honor SO_ALLZONES.
9604 				 */
9605 				ire = ire_route_lookup_v6(&ip6h->ip6_src,
9606 				    0, 0, (IRE_LOCAL|IRE_LOOPBACK), NULL,
9607 				    NULL, connp != NULL ?
9608 				    IPCL_ZONEID(connp) : zoneid, NULL,
9609 				    MATCH_IRE_TYPE | MATCH_IRE_ZONEONLY, ipst);
9610 				if (ire == NULL) {
9611 					if (do_outrequests)
9612 						BUMP_MIB(mibptr,
9613 						    ipIfStatsHCOutRequests);
9614 					BUMP_MIB(mibptr, ipIfStatsOutDiscards);
9615 					ip1dbg(("ip_wput_v6: bad source "
9616 					    "addr\n"));
9617 					freemsg(first_mp);
9618 					if (ill != NULL)
9619 						ill_refrele(ill);
9620 					if (need_decref)
9621 						CONN_DEC_REF(connp);
9622 					return;
9623 				}
9624 				ire_refrele(ire);
9625 			}
9626 			/* No need to verify again when using ip_newroute */
9627 			ip6i->ip6i_flags &= ~IP6I_VERIFY_SRC;
9628 		}
9629 		if (!(ip6i->ip6i_flags & IP6I_NEXTHOP)) {
9630 			/*
9631 			 * Make sure they match since ip_newroute*_v6 etc might
9632 			 * (unknown to them) inspect ip6i_nexthop when
9633 			 * they think they access ip6_dst.
9634 			 */
9635 			ip6i->ip6i_nexthop = ip6h->ip6_dst;
9636 		}
9637 		if (ip6i->ip6i_flags & IP6I_NO_ULP_CKSUM)
9638 			cksum_request = 1;
9639 		if (ip6i->ip6i_flags & IP6I_RAW_CHECKSUM)
9640 			cksum_request = ip6i->ip6i_checksum_off;
9641 		if (ip6i->ip6i_flags & IP6I_UNSPEC_SRC)
9642 			unspec_src = 1;
9643 
9644 		if (do_outrequests && ill != NULL) {
9645 			BUMP_MIB(mibptr, ipIfStatsHCOutRequests);
9646 			do_outrequests = B_FALSE;
9647 		}
9648 		/*
9649 		 * Store ip6i_t info that we need after we come back
9650 		 * from IPSEC processing.
9651 		 */
9652 		if (mctl_present) {
9653 			ASSERT(io != NULL);
9654 			io->ipsec_out_unspec_src = unspec_src;
9655 		}
9656 	}
9657 	if (connp != NULL && connp->conn_dontroute)
9658 		ip6h->ip6_hops = 1;
9659 
9660 	if (IN6_IS_ADDR_MULTICAST(v6dstp))
9661 		goto ipv6multicast;
9662 
9663 	/* 1. IPV6_BOUND_PIF takes precedence over all the ifindex settings. */
9664 	if (connp != NULL && connp->conn_outgoing_pill != NULL) {
9665 		ill_t	*conn_outgoing_pill;
9666 
9667 		conn_outgoing_pill = conn_get_held_ill(connp,
9668 		    &connp->conn_outgoing_pill, &err);
9669 		if (err == ILL_LOOKUP_FAILED) {
9670 			if (ill != NULL)
9671 				ill_refrele(ill);
9672 			if (need_decref)
9673 				CONN_DEC_REF(connp);
9674 			freemsg(first_mp);
9675 			return;
9676 		}
9677 		if (conn_outgoing_pill != NULL) {
9678 			if (ill != NULL)
9679 				ill_refrele(ill);
9680 			ill = conn_outgoing_pill;
9681 			attach_if = B_TRUE;
9682 			match_flags = MATCH_IRE_ILL;
9683 			mibptr = ill->ill_ip_mib;
9684 
9685 			/*
9686 			 * Check if we need an ire that will not be
9687 			 * looked up by anybody else i.e. HIDDEN.
9688 			 */
9689 			if (ill_is_probeonly(ill))
9690 				match_flags |= MATCH_IRE_MARK_HIDDEN;
9691 			goto send_from_ill;
9692 		}
9693 	}
9694 
9695 	/* 2. If ipc_nofailover_ill is set then use that ill. */
9696 	if (connp != NULL && connp->conn_nofailover_ill != NULL) {
9697 		ill_t	*conn_nofailover_ill;
9698 
9699 		conn_nofailover_ill = conn_get_held_ill(connp,
9700 		    &connp->conn_nofailover_ill, &err);
9701 		if (err == ILL_LOOKUP_FAILED) {
9702 			if (ill != NULL)
9703 				ill_refrele(ill);
9704 			if (need_decref)
9705 				CONN_DEC_REF(connp);
9706 			freemsg(first_mp);
9707 			return;
9708 		}
9709 		if (conn_nofailover_ill != NULL) {
9710 			if (ill != NULL)
9711 				ill_refrele(ill);
9712 			ill = conn_nofailover_ill;
9713 			attach_if = B_TRUE;
9714 			/*
9715 			 * Assumes that ipc_nofailover_ill is used only for
9716 			 * multipathing probe packets. These packets are better
9717 			 * dropped, if they are delayed in ND resolution, for
9718 			 * the reasons described in nce_queue_mp().
9719 			 * IP6I_DROP_IFDELAYED will be set later on in this
9720 			 * function for this packet.
9721 			 */
9722 			drop_if_delayed = B_TRUE;
9723 			match_flags = MATCH_IRE_ILL;
9724 			mibptr = ill->ill_ip_mib;
9725 
9726 			/*
9727 			 * Check if we need an ire that will not be
9728 			 * looked up by anybody else i.e. HIDDEN.
9729 			 */
9730 			if (ill_is_probeonly(ill))
9731 				match_flags |= MATCH_IRE_MARK_HIDDEN;
9732 			goto send_from_ill;
9733 		}
9734 	}
9735 
9736 	/*
9737 	 * Redo 1. If we did not find an IRE_CACHE the first time, we should
9738 	 * have an ip6i_t with IP6I_ATTACH_IF if IPV6_BOUND_PIF or
9739 	 * bind to the IPIF_NOFAILOVER address was used on this endpoint.
9740 	 */
9741 	if (ip6i != NULL && (ip6i->ip6i_flags & IP6I_ATTACH_IF)) {
9742 		ASSERT(ip6i->ip6i_ifindex != 0);
9743 		attach_if = B_TRUE;
9744 		ASSERT(ill != NULL);
9745 		match_flags = MATCH_IRE_ILL;
9746 
9747 		/*
9748 		 * Check if we need an ire that will not be
9749 		 * looked up by anybody else i.e. HIDDEN.
9750 		 */
9751 		if (ill_is_probeonly(ill))
9752 			match_flags |= MATCH_IRE_MARK_HIDDEN;
9753 		goto send_from_ill;
9754 	}
9755 
9756 	/* 3. If an ip6i_t with IP6I_IFINDEX set then use that ill. */
9757 	if (ip6i != NULL && (ip6i->ip6i_flags & IP6I_IFINDEX)) {
9758 		ASSERT(ill != NULL);
9759 		goto send_from_ill;
9760 	}
9761 
9762 	/*
9763 	 * 4. If q is an ill queue and (link local or multicast destination)
9764 	 *    then use that ill.
9765 	 */
9766 	if (ill != NULL && IN6_IS_ADDR_LINKLOCAL(v6dstp)) {
9767 		goto send_from_ill;
9768 	}
9769 
9770 	/* 5. If IPV6_BOUND_IF has been set use that ill. */
9771 	if (connp != NULL && connp->conn_outgoing_ill != NULL) {
9772 		ill_t	*conn_outgoing_ill;
9773 
9774 		conn_outgoing_ill = conn_get_held_ill(connp,
9775 		    &connp->conn_outgoing_ill, &err);
9776 		if (err == ILL_LOOKUP_FAILED) {
9777 			if (ill != NULL)
9778 				ill_refrele(ill);
9779 			if (need_decref)
9780 				CONN_DEC_REF(connp);
9781 			freemsg(first_mp);
9782 			return;
9783 		}
9784 		if (ill != NULL)
9785 			ill_refrele(ill);
9786 		ill = conn_outgoing_ill;
9787 		mibptr = ill->ill_ip_mib;
9788 		goto send_from_ill;
9789 	}
9790 
9791 	/*
9792 	 * 6. For unicast: Just do an IRE lookup for the best match.
9793 	 * If we get here for a link-local address it is rather random
9794 	 * what interface we pick on a multihomed host.
9795 	 * *If* there is an IRE_CACHE (and the link-local address
9796 	 * isn't duplicated on multi links) this will find the IRE_CACHE.
9797 	 * Otherwise it will use one of the matching IRE_INTERFACE routes
9798 	 * for the link-local prefix. Hence, applications
9799 	 * *should* be encouraged to specify an outgoing interface when sending
9800 	 * to a link local address.
9801 	 */
9802 	if (connp == NULL || (IP_FLOW_CONTROLLED_ULP(connp->conn_ulp) &&
9803 	    !connp->conn_fully_bound)) {
9804 		/*
9805 		 * We cache IRE_CACHEs to avoid lookups. We don't do
9806 		 * this for the tcp global queue and listen end point
9807 		 * as it does not really have a real destination to
9808 		 * talk to.
9809 		 */
9810 		ire = ire_cache_lookup_v6(v6dstp, zoneid, MBLK_GETLABEL(mp),
9811 		    ipst);
9812 	} else {
9813 		/*
9814 		 * IRE_MARK_CONDEMNED is marked in ire_delete. We don't
9815 		 * grab a lock here to check for CONDEMNED as it is okay
9816 		 * to send a packet or two with the IRE_CACHE that is going
9817 		 * away.
9818 		 */
9819 		mutex_enter(&connp->conn_lock);
9820 		ire = sctp_ire != NULL ? sctp_ire : connp->conn_ire_cache;
9821 		if (ire != NULL &&
9822 		    IN6_ARE_ADDR_EQUAL(&ire->ire_addr_v6, v6dstp) &&
9823 		    !(ire->ire_marks & IRE_MARK_CONDEMNED)) {
9824 
9825 			IRE_REFHOLD(ire);
9826 			mutex_exit(&connp->conn_lock);
9827 
9828 		} else {
9829 			boolean_t cached = B_FALSE;
9830 
9831 			connp->conn_ire_cache = NULL;
9832 			mutex_exit(&connp->conn_lock);
9833 			/* Release the old ire */
9834 			if (ire != NULL && sctp_ire == NULL)
9835 				IRE_REFRELE_NOTR(ire);
9836 
9837 			ire = ire_cache_lookup_v6(v6dstp, zoneid,
9838 			    MBLK_GETLABEL(mp), ipst);
9839 			if (ire != NULL) {
9840 				IRE_REFHOLD_NOTR(ire);
9841 
9842 				mutex_enter(&connp->conn_lock);
9843 				if (CONN_CACHE_IRE(connp) &&
9844 				    (connp->conn_ire_cache == NULL)) {
9845 					rw_enter(&ire->ire_bucket->irb_lock,
9846 					    RW_READER);
9847 					if (!(ire->ire_marks &
9848 					    IRE_MARK_CONDEMNED)) {
9849 						connp->conn_ire_cache = ire;
9850 						cached = B_TRUE;
9851 					}
9852 					rw_exit(&ire->ire_bucket->irb_lock);
9853 				}
9854 				mutex_exit(&connp->conn_lock);
9855 
9856 				/*
9857 				 * We can continue to use the ire but since it
9858 				 * was not cached, we should drop the extra
9859 				 * reference.
9860 				 */
9861 				if (!cached)
9862 					IRE_REFRELE_NOTR(ire);
9863 			}
9864 		}
9865 	}
9866 
9867 	if (ire != NULL) {
9868 		if (do_outrequests) {
9869 			/* Handle IRE_LOCAL's that might appear here */
9870 			if (ire->ire_type == IRE_CACHE) {
9871 				mibptr = ((ill_t *)ire->ire_stq->q_ptr)->
9872 				    ill_ip_mib;
9873 			} else {
9874 				mibptr = ire->ire_ipif->ipif_ill->ill_ip_mib;
9875 			}
9876 			BUMP_MIB(mibptr, ipIfStatsHCOutRequests);
9877 		}
9878 		ASSERT(!attach_if);
9879 
9880 		/*
9881 		 * Check if the ire has the RTF_MULTIRT flag, inherited
9882 		 * from an IRE_OFFSUBNET ire entry in ip_newroute().
9883 		 */
9884 		if (ire->ire_flags & RTF_MULTIRT) {
9885 			/*
9886 			 * Force hop limit of multirouted packets if required.
9887 			 * The hop limit of such packets is bounded by the
9888 			 * ip_multirt_ttl ndd variable.
9889 			 * NDP packets must have a hop limit of 255; don't
9890 			 * change the hop limit in that case.
9891 			 */
9892 			if ((ipst->ips_ip_multirt_ttl > 0) &&
9893 			    (ip6h->ip6_hops > ipst->ips_ip_multirt_ttl) &&
9894 			    (ip6h->ip6_hops != IPV6_MAX_HOPS)) {
9895 				if (ip_debug > 3) {
9896 					ip2dbg(("ip_wput_v6: forcing multirt "
9897 					    "hop limit to %d (was %d) ",
9898 					    ipst->ips_ip_multirt_ttl,
9899 					    ip6h->ip6_hops));
9900 					pr_addr_dbg("v6dst %s\n", AF_INET6,
9901 					    &ire->ire_addr_v6);
9902 				}
9903 				ip6h->ip6_hops = ipst->ips_ip_multirt_ttl;
9904 			}
9905 
9906 			/*
9907 			 * We look at this point if there are pending
9908 			 * unresolved routes. ire_multirt_need_resolve_v6()
9909 			 * checks in O(n) that all IRE_OFFSUBNET ire
9910 			 * entries for the packet's destination and
9911 			 * flagged RTF_MULTIRT are currently resolved.
9912 			 * If some remain unresolved, we do a copy
9913 			 * of the current message. It will be used
9914 			 * to initiate additional route resolutions.
9915 			 */
9916 			multirt_need_resolve =
9917 			    ire_multirt_need_resolve_v6(&ire->ire_addr_v6,
9918 			    MBLK_GETLABEL(first_mp), ipst);
9919 			ip2dbg(("ip_wput_v6: ire %p, "
9920 			    "multirt_need_resolve %d, first_mp %p\n",
9921 			    (void *)ire, multirt_need_resolve,
9922 			    (void *)first_mp));
9923 			if (multirt_need_resolve) {
9924 				copy_mp = copymsg(first_mp);
9925 				if (copy_mp != NULL) {
9926 					MULTIRT_DEBUG_TAG(copy_mp);
9927 				}
9928 			}
9929 		}
9930 		ip_wput_ire_v6(q, first_mp, ire, unspec_src, cksum_request,
9931 		    connp, caller, 0, ip6i_flags, zoneid);
9932 		if (need_decref) {
9933 			CONN_DEC_REF(connp);
9934 			connp = NULL;
9935 		}
9936 		IRE_REFRELE(ire);
9937 
9938 		/*
9939 		 * Try to resolve another multiroute if
9940 		 * ire_multirt_need_resolve_v6() deemed it necessary.
9941 		 * copy_mp will be consumed (sent or freed) by
9942 		 * ip_newroute_v6().
9943 		 */
9944 		if (copy_mp != NULL) {
9945 			if (mctl_present) {
9946 				ip6h = (ip6_t *)copy_mp->b_cont->b_rptr;
9947 			} else {
9948 				ip6h = (ip6_t *)copy_mp->b_rptr;
9949 			}
9950 			ip_newroute_v6(q, copy_mp, &ip6h->ip6_dst,
9951 			    &ip6h->ip6_src, NULL, zoneid, ipst);
9952 		}
9953 		if (ill != NULL)
9954 			ill_refrele(ill);
9955 		return;
9956 	}
9957 
9958 	/*
9959 	 * No full IRE for this destination.  Send it to
9960 	 * ip_newroute_v6 to see if anything else matches.
9961 	 * Mark this packet as having originated on this
9962 	 * machine.
9963 	 * Update rptr if there was an ip6i_t header.
9964 	 */
9965 	mp->b_prev = NULL;
9966 	mp->b_next = NULL;
9967 	if (ip6i != NULL)
9968 		mp->b_rptr -= sizeof (ip6i_t);
9969 
9970 	if (unspec_src) {
9971 		if (ip6i == NULL) {
9972 			/*
9973 			 * Add ip6i_t header to carry unspec_src
9974 			 * until the packet comes back in ip_wput_v6.
9975 			 */
9976 			mp = ip_add_info_v6(mp, NULL, v6dstp);
9977 			if (mp == NULL) {
9978 				if (do_outrequests)
9979 					BUMP_MIB(mibptr,
9980 					    ipIfStatsHCOutRequests);
9981 				BUMP_MIB(mibptr, ipIfStatsOutDiscards);
9982 				if (mctl_present)
9983 					freeb(first_mp);
9984 				if (ill != NULL)
9985 					ill_refrele(ill);
9986 				if (need_decref)
9987 					CONN_DEC_REF(connp);
9988 				return;
9989 			}
9990 			ip6i = (ip6i_t *)mp->b_rptr;
9991 
9992 			if (mctl_present) {
9993 				ASSERT(first_mp != mp);
9994 				first_mp->b_cont = mp;
9995 			} else {
9996 				first_mp = mp;
9997 			}
9998 
9999 			if ((mp->b_wptr - (uchar_t *)ip6i) ==
10000 			    sizeof (ip6i_t)) {
10001 				/*
10002 				 * ndp_resolver called from ip_newroute_v6
10003 				 * expects pulled up message.
10004 				 */
10005 				if (!pullupmsg(mp, -1)) {
10006 					ip1dbg(("ip_wput_v6: pullupmsg"
10007 					    " failed\n"));
10008 					if (do_outrequests) {
10009 						BUMP_MIB(mibptr,
10010 						    ipIfStatsHCOutRequests);
10011 					}
10012 					BUMP_MIB(mibptr, ipIfStatsOutDiscards);
10013 					freemsg(first_mp);
10014 					if (ill != NULL)
10015 						ill_refrele(ill);
10016 					if (need_decref)
10017 						CONN_DEC_REF(connp);
10018 					return;
10019 				}
10020 				ip6i = (ip6i_t *)mp->b_rptr;
10021 			}
10022 			ip6h = (ip6_t *)&ip6i[1];
10023 			v6dstp = &ip6h->ip6_dst;
10024 		}
10025 		ip6i->ip6i_flags |= IP6I_UNSPEC_SRC;
10026 		if (mctl_present) {
10027 			ASSERT(io != NULL);
10028 			io->ipsec_out_unspec_src = unspec_src;
10029 		}
10030 	}
10031 	if (do_outrequests)
10032 		BUMP_MIB(mibptr, ipIfStatsHCOutRequests);
10033 	if (need_decref)
10034 		CONN_DEC_REF(connp);
10035 	ip_newroute_v6(q, first_mp, v6dstp, &ip6h->ip6_src, NULL, zoneid, ipst);
10036 	if (ill != NULL)
10037 		ill_refrele(ill);
10038 	return;
10039 
10040 
10041 	/*
10042 	 * Handle multicast packets with or without an conn.
10043 	 * Assumes that the transports set ip6_hops taking
10044 	 * IPV6_MULTICAST_HOPS (and the other ways to set the hoplimit)
10045 	 * into account.
10046 	 */
10047 ipv6multicast:
10048 	ip2dbg(("ip_wput_v6: multicast\n"));
10049 
10050 	/*
10051 	 * 1. IPV6_BOUND_PIF takes precedence over all the ifindex settings
10052 	 * 2. If conn_nofailover_ill is set then use that ill.
10053 	 *
10054 	 * Hold the conn_lock till we refhold the ill of interest that is
10055 	 * pointed to from the conn. Since we cannot do an ill/ipif_refrele
10056 	 * while holding any locks, postpone the refrele until after the
10057 	 * conn_lock is dropped.
10058 	 */
10059 	if (connp != NULL) {
10060 		mutex_enter(&connp->conn_lock);
10061 		conn_lock_held = B_TRUE;
10062 	} else {
10063 		conn_lock_held = B_FALSE;
10064 	}
10065 	if (connp != NULL && connp->conn_outgoing_pill != NULL) {
10066 		err = ill_check_and_refhold(connp->conn_outgoing_pill);
10067 		if (err == ILL_LOOKUP_FAILED) {
10068 			ip1dbg(("ip_output_v6: multicast"
10069 			    " conn_outgoing_pill no ipif\n"));
10070 multicast_discard:
10071 			ASSERT(saved_ill == NULL);
10072 			if (conn_lock_held)
10073 				mutex_exit(&connp->conn_lock);
10074 			if (ill != NULL)
10075 				ill_refrele(ill);
10076 			freemsg(first_mp);
10077 			if (do_outrequests)
10078 				BUMP_MIB(mibptr, ipIfStatsOutDiscards);
10079 			if (need_decref)
10080 				CONN_DEC_REF(connp);
10081 			return;
10082 		}
10083 		saved_ill = ill;
10084 		ill = connp->conn_outgoing_pill;
10085 		attach_if = B_TRUE;
10086 		match_flags = MATCH_IRE_ILL;
10087 		mibptr = ill->ill_ip_mib;
10088 
10089 		/*
10090 		 * Check if we need an ire that will not be
10091 		 * looked up by anybody else i.e. HIDDEN.
10092 		 */
10093 		if (ill_is_probeonly(ill))
10094 			match_flags |= MATCH_IRE_MARK_HIDDEN;
10095 	} else if (connp != NULL && connp->conn_nofailover_ill != NULL) {
10096 		err = ill_check_and_refhold(connp->conn_nofailover_ill);
10097 		if (err == ILL_LOOKUP_FAILED) {
10098 			ip1dbg(("ip_output_v6: multicast"
10099 			    " conn_nofailover_ill no ipif\n"));
10100 			goto multicast_discard;
10101 		}
10102 		saved_ill = ill;
10103 		ill = connp->conn_nofailover_ill;
10104 		attach_if = B_TRUE;
10105 		match_flags = MATCH_IRE_ILL;
10106 
10107 		/*
10108 		 * Check if we need an ire that will not be
10109 		 * looked up by anybody else i.e. HIDDEN.
10110 		 */
10111 		if (ill_is_probeonly(ill))
10112 			match_flags |= MATCH_IRE_MARK_HIDDEN;
10113 	} else if (ip6i != NULL && (ip6i->ip6i_flags & IP6I_ATTACH_IF)) {
10114 		/*
10115 		 * Redo 1. If we did not find an IRE_CACHE the first time,
10116 		 * we should have an ip6i_t with IP6I_ATTACH_IF if
10117 		 * IPV6_BOUND_PIF or bind to the IPIF_NOFAILOVER address was
10118 		 * used on this endpoint.
10119 		 */
10120 		ASSERT(ip6i->ip6i_ifindex != 0);
10121 		attach_if = B_TRUE;
10122 		ASSERT(ill != NULL);
10123 		match_flags = MATCH_IRE_ILL;
10124 
10125 		/*
10126 		 * Check if we need an ire that will not be
10127 		 * looked up by anybody else i.e. HIDDEN.
10128 		 */
10129 		if (ill_is_probeonly(ill))
10130 			match_flags |= MATCH_IRE_MARK_HIDDEN;
10131 	} else if (ip6i != NULL && (ip6i->ip6i_flags & IP6I_IFINDEX)) {
10132 		/* 3. If an ip6i_t with IP6I_IFINDEX set then use that ill. */
10133 
10134 		ASSERT(ill != NULL);
10135 	} else if (ill != NULL) {
10136 		/*
10137 		 * 4. If q is an ill queue and (link local or multicast
10138 		 * destination) then use that ill.
10139 		 * We don't need the ipif initialization here.
10140 		 * This useless assert below is just to prevent lint from
10141 		 * reporting a null body if statement.
10142 		 */
10143 		ASSERT(ill != NULL);
10144 	} else if (connp != NULL) {
10145 		/*
10146 		 * 5. If IPV6_BOUND_IF has been set use that ill.
10147 		 *
10148 		 * 6. For multicast: if IPV6_MULTICAST_IF has been set use it.
10149 		 * Otherwise look for the best IRE match for the unspecified
10150 		 * group to determine the ill.
10151 		 *
10152 		 * conn_multicast_ill is used for only IPv6 packets.
10153 		 * conn_multicast_ipif is used for only IPv4 packets.
10154 		 * Thus a PF_INET6 socket send both IPv4 and IPv6
10155 		 * multicast packets using different IP*_MULTICAST_IF
10156 		 * interfaces.
10157 		 */
10158 		if (connp->conn_outgoing_ill != NULL) {
10159 			err = ill_check_and_refhold(connp->conn_outgoing_ill);
10160 			if (err == ILL_LOOKUP_FAILED) {
10161 				ip1dbg(("ip_output_v6: multicast"
10162 				    " conn_outgoing_ill no ipif\n"));
10163 				goto multicast_discard;
10164 			}
10165 			ill = connp->conn_outgoing_ill;
10166 		} else if (connp->conn_multicast_ill != NULL) {
10167 			err = ill_check_and_refhold(connp->conn_multicast_ill);
10168 			if (err == ILL_LOOKUP_FAILED) {
10169 				ip1dbg(("ip_output_v6: multicast"
10170 				    " conn_multicast_ill no ipif\n"));
10171 				goto multicast_discard;
10172 			}
10173 			ill = connp->conn_multicast_ill;
10174 		} else {
10175 			mutex_exit(&connp->conn_lock);
10176 			conn_lock_held = B_FALSE;
10177 			ipif = ipif_lookup_group_v6(v6dstp, zoneid, ipst);
10178 			if (ipif == NULL) {
10179 				ip1dbg(("ip_output_v6: multicast no ipif\n"));
10180 				goto multicast_discard;
10181 			}
10182 			/*
10183 			 * We have a ref to this ipif, so we can safely
10184 			 * access ipif_ill.
10185 			 */
10186 			ill = ipif->ipif_ill;
10187 			mutex_enter(&ill->ill_lock);
10188 			if (!ILL_CAN_LOOKUP(ill)) {
10189 				mutex_exit(&ill->ill_lock);
10190 				ipif_refrele(ipif);
10191 				ill = NULL;
10192 				ip1dbg(("ip_output_v6: multicast no ipif\n"));
10193 				goto multicast_discard;
10194 			}
10195 			ill_refhold_locked(ill);
10196 			mutex_exit(&ill->ill_lock);
10197 			ipif_refrele(ipif);
10198 			/*
10199 			 * Save binding until IPV6_MULTICAST_IF
10200 			 * changes it
10201 			 */
10202 			mutex_enter(&connp->conn_lock);
10203 			connp->conn_multicast_ill = ill;
10204 			connp->conn_orig_multicast_ifindex =
10205 			    ill->ill_phyint->phyint_ifindex;
10206 			mutex_exit(&connp->conn_lock);
10207 		}
10208 	}
10209 	if (conn_lock_held)
10210 		mutex_exit(&connp->conn_lock);
10211 
10212 	if (saved_ill != NULL)
10213 		ill_refrele(saved_ill);
10214 
10215 	ASSERT(ill != NULL);
10216 	/*
10217 	 * For multicast loopback interfaces replace the multicast address
10218 	 * with a unicast address for the ire lookup.
10219 	 */
10220 	if (IS_LOOPBACK(ill))
10221 		v6dstp = &ill->ill_ipif->ipif_v6lcl_addr;
10222 
10223 	mibptr = ill->ill_ip_mib;
10224 	if (do_outrequests) {
10225 		BUMP_MIB(mibptr, ipIfStatsHCOutRequests);
10226 		do_outrequests = B_FALSE;
10227 	}
10228 	BUMP_MIB(mibptr, ipIfStatsHCOutMcastPkts);
10229 	UPDATE_MIB(mibptr, ipIfStatsHCOutMcastOctets,
10230 	    ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN);
10231 
10232 	/*
10233 	 * As we may lose the conn by the time we reach ip_wput_ire_v6
10234 	 * we copy conn_multicast_loop and conn_dontroute on to an
10235 	 * ipsec_out. In case if this datagram goes out secure,
10236 	 * we need the ill_index also. Copy that also into the
10237 	 * ipsec_out.
10238 	 */
10239 	if (mctl_present) {
10240 		io = (ipsec_out_t *)first_mp->b_rptr;
10241 		ASSERT(first_mp->b_datap->db_type == M_CTL);
10242 		ASSERT(io->ipsec_out_type == IPSEC_OUT);
10243 	} else {
10244 		ASSERT(mp == first_mp);
10245 		if ((first_mp = ipsec_alloc_ipsec_out(ipst->ips_netstack)) ==
10246 		    NULL) {
10247 			BUMP_MIB(mibptr, ipIfStatsOutDiscards);
10248 			freemsg(mp);
10249 			if (ill != NULL)
10250 				ill_refrele(ill);
10251 			if (need_decref)
10252 				CONN_DEC_REF(connp);
10253 			return;
10254 		}
10255 		io = (ipsec_out_t *)first_mp->b_rptr;
10256 		/* This is not a secure packet */
10257 		io->ipsec_out_secure = B_FALSE;
10258 		io->ipsec_out_use_global_policy = B_TRUE;
10259 		io->ipsec_out_zoneid =
10260 		    (zoneid != ALL_ZONES ? zoneid : GLOBAL_ZONEID);
10261 		first_mp->b_cont = mp;
10262 		mctl_present = B_TRUE;
10263 	}
10264 	io->ipsec_out_ill_index = ill->ill_phyint->phyint_ifindex;
10265 	io->ipsec_out_unspec_src = unspec_src;
10266 	if (connp != NULL)
10267 		io->ipsec_out_dontroute = connp->conn_dontroute;
10268 
10269 send_from_ill:
10270 	ASSERT(ill != NULL);
10271 	ASSERT(mibptr == ill->ill_ip_mib);
10272 	if (do_outrequests) {
10273 		BUMP_MIB(mibptr, ipIfStatsHCOutRequests);
10274 		do_outrequests = B_FALSE;
10275 	}
10276 
10277 	if (io != NULL)
10278 		io->ipsec_out_ill_index = ill->ill_phyint->phyint_ifindex;
10279 
10280 	/*
10281 	 * When a specific ill is specified (using IPV6_PKTINFO,
10282 	 * IPV6_MULTICAST_IF, or IPV6_BOUND_IF) we will only match
10283 	 * on routing entries (ftable and ctable) that have a matching
10284 	 * ire->ire_ipif->ipif_ill. Thus this can only be used
10285 	 * for destinations that are on-link for the specific ill
10286 	 * and that can appear on multiple links. Thus it is useful
10287 	 * for multicast destinations, link-local destinations, and
10288 	 * at some point perhaps for site-local destinations (if the
10289 	 * node sits at a site boundary).
10290 	 * We create the cache entries in the regular ctable since
10291 	 * it can not "confuse" things for other destinations.
10292 	 * table.
10293 	 *
10294 	 * NOTE : conn_ire_cache is not used for caching ire_ctable_lookups.
10295 	 *	  It is used only when ire_cache_lookup is used above.
10296 	 */
10297 	ire = ire_ctable_lookup_v6(v6dstp, 0, 0, ill->ill_ipif,
10298 	    zoneid, MBLK_GETLABEL(mp), match_flags, ipst);
10299 	if (ire != NULL) {
10300 		/*
10301 		 * Check if the ire has the RTF_MULTIRT flag, inherited
10302 		 * from an IRE_OFFSUBNET ire entry in ip_newroute().
10303 		 */
10304 		if (ire->ire_flags & RTF_MULTIRT) {
10305 			/*
10306 			 * Force hop limit of multirouted packets if required.
10307 			 * The hop limit of such packets is bounded by the
10308 			 * ip_multirt_ttl ndd variable.
10309 			 * NDP packets must have a hop limit of 255; don't
10310 			 * change the hop limit in that case.
10311 			 */
10312 			if ((ipst->ips_ip_multirt_ttl > 0) &&
10313 			    (ip6h->ip6_hops > ipst->ips_ip_multirt_ttl) &&
10314 			    (ip6h->ip6_hops != IPV6_MAX_HOPS)) {
10315 				if (ip_debug > 3) {
10316 					ip2dbg(("ip_wput_v6: forcing multirt "
10317 					    "hop limit to %d (was %d) ",
10318 					    ipst->ips_ip_multirt_ttl,
10319 					    ip6h->ip6_hops));
10320 					pr_addr_dbg("v6dst %s\n", AF_INET6,
10321 					    &ire->ire_addr_v6);
10322 				}
10323 				ip6h->ip6_hops = ipst->ips_ip_multirt_ttl;
10324 			}
10325 
10326 			/*
10327 			 * We look at this point if there are pending
10328 			 * unresolved routes. ire_multirt_need_resolve_v6()
10329 			 * checks in O(n) that all IRE_OFFSUBNET ire
10330 			 * entries for the packet's destination and
10331 			 * flagged RTF_MULTIRT are currently resolved.
10332 			 * If some remain unresolved, we make a copy
10333 			 * of the current message. It will be used
10334 			 * to initiate additional route resolutions.
10335 			 */
10336 			multirt_need_resolve =
10337 			    ire_multirt_need_resolve_v6(&ire->ire_addr_v6,
10338 			    MBLK_GETLABEL(first_mp), ipst);
10339 			ip2dbg(("ip_wput_v6[send_from_ill]: ire %p, "
10340 			    "multirt_need_resolve %d, first_mp %p\n",
10341 			    (void *)ire, multirt_need_resolve,
10342 			    (void *)first_mp));
10343 			if (multirt_need_resolve) {
10344 				copy_mp = copymsg(first_mp);
10345 				if (copy_mp != NULL) {
10346 					MULTIRT_DEBUG_TAG(copy_mp);
10347 				}
10348 			}
10349 		}
10350 
10351 		ip1dbg(("ip_wput_v6: send on %s, ire = %p, ill index = %d\n",
10352 		    ill->ill_name, (void *)ire,
10353 		    ill->ill_phyint->phyint_ifindex));
10354 		ip_wput_ire_v6(q, first_mp, ire, unspec_src, cksum_request,
10355 		    connp, caller,
10356 		    (attach_if ? ill->ill_phyint->phyint_ifindex : 0),
10357 		    ip6i_flags, zoneid);
10358 		ire_refrele(ire);
10359 		if (need_decref) {
10360 			CONN_DEC_REF(connp);
10361 			connp = NULL;
10362 		}
10363 
10364 		/*
10365 		 * Try to resolve another multiroute if
10366 		 * ire_multirt_need_resolve_v6() deemed it necessary.
10367 		 * copy_mp will be consumed (sent or freed) by
10368 		 * ip_newroute_[ipif_]v6().
10369 		 */
10370 		if (copy_mp != NULL) {
10371 			if (mctl_present) {
10372 				ip6h = (ip6_t *)copy_mp->b_cont->b_rptr;
10373 			} else {
10374 				ip6h = (ip6_t *)copy_mp->b_rptr;
10375 			}
10376 			if (IN6_IS_ADDR_MULTICAST(&ip6h->ip6_dst)) {
10377 				ipif = ipif_lookup_group_v6(&ip6h->ip6_dst,
10378 				    zoneid, ipst);
10379 				if (ipif == NULL) {
10380 					ip1dbg(("ip_wput_v6: No ipif for "
10381 					    "multicast\n"));
10382 					MULTIRT_DEBUG_UNTAG(copy_mp);
10383 					freemsg(copy_mp);
10384 					return;
10385 				}
10386 				ip_newroute_ipif_v6(q, copy_mp, ipif,
10387 				    ip6h->ip6_dst, unspec_src, zoneid);
10388 				ipif_refrele(ipif);
10389 			} else {
10390 				ip_newroute_v6(q, copy_mp, &ip6h->ip6_dst,
10391 				    &ip6h->ip6_src, ill, zoneid, ipst);
10392 			}
10393 		}
10394 		ill_refrele(ill);
10395 		return;
10396 	}
10397 	if (need_decref) {
10398 		CONN_DEC_REF(connp);
10399 		connp = NULL;
10400 	}
10401 
10402 	/* Update rptr if there was an ip6i_t header. */
10403 	if (ip6i != NULL)
10404 		mp->b_rptr -= sizeof (ip6i_t);
10405 	if (unspec_src || attach_if) {
10406 		if (ip6i == NULL) {
10407 			/*
10408 			 * Add ip6i_t header to carry unspec_src
10409 			 * or attach_if until the packet comes back in
10410 			 * ip_wput_v6.
10411 			 */
10412 			if (mctl_present) {
10413 				first_mp->b_cont =
10414 				    ip_add_info_v6(mp, NULL, v6dstp);
10415 				mp = first_mp->b_cont;
10416 				if (mp == NULL)
10417 					freeb(first_mp);
10418 			} else {
10419 				first_mp = mp = ip_add_info_v6(mp, NULL,
10420 				    v6dstp);
10421 			}
10422 			if (mp == NULL) {
10423 				BUMP_MIB(mibptr, ipIfStatsOutDiscards);
10424 				ill_refrele(ill);
10425 				return;
10426 			}
10427 			ip6i = (ip6i_t *)mp->b_rptr;
10428 			if ((mp->b_wptr - (uchar_t *)ip6i) ==
10429 			    sizeof (ip6i_t)) {
10430 				/*
10431 				 * ndp_resolver called from ip_newroute_v6
10432 				 * expects a pulled up message.
10433 				 */
10434 				if (!pullupmsg(mp, -1)) {
10435 					ip1dbg(("ip_wput_v6: pullupmsg"
10436 					    " failed\n"));
10437 					BUMP_MIB(mibptr, ipIfStatsOutDiscards);
10438 					freemsg(first_mp);
10439 					return;
10440 				}
10441 				ip6i = (ip6i_t *)mp->b_rptr;
10442 			}
10443 			ip6h = (ip6_t *)&ip6i[1];
10444 			v6dstp = &ip6h->ip6_dst;
10445 		}
10446 		if (unspec_src)
10447 			ip6i->ip6i_flags |= IP6I_UNSPEC_SRC;
10448 		if (attach_if) {
10449 			/*
10450 			 * Bind to nofailover/BOUND_PIF overrides ifindex.
10451 			 */
10452 			ip6i->ip6i_flags |= IP6I_ATTACH_IF;
10453 			ip6i->ip6i_flags &= ~IP6I_IFINDEX;
10454 			ip6i->ip6i_ifindex = ill->ill_phyint->phyint_ifindex;
10455 			if (drop_if_delayed) {
10456 				/* This is a multipathing probe packet */
10457 				ip6i->ip6i_flags |= IP6I_DROP_IFDELAYED;
10458 			}
10459 		}
10460 		if (mctl_present) {
10461 			ASSERT(io != NULL);
10462 			io->ipsec_out_unspec_src = unspec_src;
10463 		}
10464 	}
10465 	if (IN6_IS_ADDR_MULTICAST(v6dstp)) {
10466 		ip_newroute_ipif_v6(q, first_mp, ill->ill_ipif, *v6dstp,
10467 		    unspec_src, zoneid);
10468 	} else {
10469 		ip_newroute_v6(q, first_mp, v6dstp, &ip6h->ip6_src, ill,
10470 		    zoneid, ipst);
10471 	}
10472 	ill_refrele(ill);
10473 	return;
10474 
10475 notv6:
10476 	/* FIXME?: assume the caller calls the right version of ip_output? */
10477 	if (q->q_next == NULL) {
10478 		connp = Q_TO_CONN(q);
10479 
10480 		/*
10481 		 * We can change conn_send for all types of conn, even
10482 		 * though only TCP uses it right now.
10483 		 * FIXME: sctp could use conn_send but doesn't currently.
10484 		 */
10485 		ip_setpktversion(connp, B_FALSE, B_TRUE, ipst);
10486 	}
10487 	BUMP_MIB(mibptr, ipIfStatsOutWrongIPVersion);
10488 	(void) ip_output(arg, first_mp, arg2, caller);
10489 	if (ill != NULL)
10490 		ill_refrele(ill);
10491 }
10492 
10493 /*
10494  * If this is a conn_t queue, then we pass in the conn. This includes the
10495  * zoneid.
10496  * Otherwise, this is a message for an ill_t queue,
10497  * in which case we use the global zoneid since those are all part of
10498  * the global zone.
10499  */
10500 void
10501 ip_wput_v6(queue_t *q, mblk_t *mp)
10502 {
10503 	if (CONN_Q(q))
10504 		ip_output_v6(Q_TO_CONN(q), mp, q, IP_WPUT);
10505 	else
10506 		ip_output_v6(GLOBAL_ZONEID, mp, q, IP_WPUT);
10507 }
10508 
10509 static void
10510 ipsec_out_attach_if(ipsec_out_t *io, int attach_index)
10511 {
10512 	ASSERT(io->ipsec_out_type == IPSEC_OUT);
10513 	io->ipsec_out_attach_if = B_TRUE;
10514 	io->ipsec_out_ill_index = attach_index;
10515 }
10516 
10517 /*
10518  * NULL send-to queue - packet is to be delivered locally.
10519  */
10520 void
10521 ip_wput_local_v6(queue_t *q, ill_t *ill, ip6_t *ip6h, mblk_t *first_mp,
10522     ire_t *ire, int fanout_flags)
10523 {
10524 	uint32_t	ports;
10525 	mblk_t		*mp = first_mp, *first_mp1;
10526 	boolean_t	mctl_present;
10527 	uint8_t		nexthdr;
10528 	uint16_t	hdr_length;
10529 	ipsec_out_t	*io;
10530 	mib2_ipIfStatsEntry_t	*mibptr;
10531 	ilm_t		*ilm;
10532 	uint_t	nexthdr_offset;
10533 	ip_stack_t	*ipst = ill->ill_ipst;
10534 
10535 	if (DB_TYPE(mp) == M_CTL) {
10536 		io = (ipsec_out_t *)mp->b_rptr;
10537 		if (!io->ipsec_out_secure) {
10538 			mp = mp->b_cont;
10539 			freeb(first_mp);
10540 			first_mp = mp;
10541 			mctl_present = B_FALSE;
10542 		} else {
10543 			mctl_present = B_TRUE;
10544 			mp = first_mp->b_cont;
10545 			ipsec_out_to_in(first_mp);
10546 		}
10547 	} else {
10548 		mctl_present = B_FALSE;
10549 	}
10550 
10551 	/*
10552 	 * Remove reachability confirmation bit from version field
10553 	 * before passing the packet on to any firewall hooks or
10554 	 * looping back the packet.
10555 	 */
10556 	if (ip6h->ip6_vcf & IP_FORWARD_PROG)
10557 		ip6h->ip6_vcf &= ~IP_FORWARD_PROG;
10558 
10559 	DTRACE_PROBE4(ip6__loopback__in__start,
10560 	    ill_t *, ill, ill_t *, NULL,
10561 	    ip6_t *, ip6h, mblk_t *, first_mp);
10562 
10563 	FW_HOOKS6(ipst->ips_ip6_loopback_in_event,
10564 	    ipst->ips_ipv6firewall_loopback_in,
10565 	    ill, NULL, ip6h, first_mp, mp, 0, ipst);
10566 
10567 	DTRACE_PROBE1(ip6__loopback__in__end, mblk_t *, first_mp);
10568 
10569 	if (first_mp == NULL)
10570 		return;
10571 
10572 	DTRACE_IP7(receive, mblk_t *, first_mp, conn_t *, NULL, void_ip_t *,
10573 	    ip6h, __dtrace_ipsr_ill_t *, ill, ipha_t *, NULL, ip6_t *, ip6h,
10574 	    int, 1);
10575 
10576 	nexthdr = ip6h->ip6_nxt;
10577 	mibptr = ill->ill_ip_mib;
10578 
10579 	/* Fastpath */
10580 	switch (nexthdr) {
10581 	case IPPROTO_TCP:
10582 	case IPPROTO_UDP:
10583 	case IPPROTO_ICMPV6:
10584 	case IPPROTO_SCTP:
10585 		hdr_length = IPV6_HDR_LEN;
10586 		nexthdr_offset = (uint_t)((uchar_t *)&ip6h->ip6_nxt -
10587 		    (uchar_t *)ip6h);
10588 		break;
10589 	default: {
10590 		uint8_t	*nexthdrp;
10591 
10592 		if (!ip_hdr_length_nexthdr_v6(mp, ip6h,
10593 		    &hdr_length, &nexthdrp)) {
10594 			/* Malformed packet */
10595 			BUMP_MIB(mibptr, ipIfStatsOutDiscards);
10596 			freemsg(first_mp);
10597 			return;
10598 		}
10599 		nexthdr = *nexthdrp;
10600 		nexthdr_offset = nexthdrp - (uint8_t *)ip6h;
10601 		break;
10602 	}
10603 	}
10604 
10605 	UPDATE_OB_PKT_COUNT(ire);
10606 	ire->ire_last_used_time = lbolt;
10607 
10608 	switch (nexthdr) {
10609 		case IPPROTO_TCP:
10610 			if (DB_TYPE(mp) == M_DATA) {
10611 				/*
10612 				 * M_DATA mblk, so init mblk (chain) for
10613 				 * no struio().
10614 				 */
10615 				mblk_t  *mp1 = mp;
10616 
10617 				do {
10618 					mp1->b_datap->db_struioflag = 0;
10619 				} while ((mp1 = mp1->b_cont) != NULL);
10620 			}
10621 			ports = *(uint32_t *)(mp->b_rptr + hdr_length +
10622 			    TCP_PORTS_OFFSET);
10623 			ip_fanout_tcp_v6(q, first_mp, ip6h, ill, ill,
10624 			    fanout_flags|IP_FF_SEND_ICMP|IP_FF_SYN_ADDIRE|
10625 			    IP_FF_IPINFO|IP6_NO_IPPOLICY|IP_FF_LOOPBACK,
10626 			    hdr_length, mctl_present, ire->ire_zoneid);
10627 			return;
10628 
10629 		case IPPROTO_UDP:
10630 			ports = *(uint32_t *)(mp->b_rptr + hdr_length +
10631 			    UDP_PORTS_OFFSET);
10632 			ip_fanout_udp_v6(q, first_mp, ip6h, ports, ill, ill,
10633 			    fanout_flags|IP_FF_SEND_ICMP|IP_FF_IPINFO|
10634 			    IP6_NO_IPPOLICY, mctl_present, ire->ire_zoneid);
10635 			return;
10636 
10637 		case IPPROTO_SCTP:
10638 		{
10639 			ports = *(uint32_t *)(mp->b_rptr + hdr_length);
10640 			ip_fanout_sctp(first_mp, ill, (ipha_t *)ip6h, ports,
10641 			    fanout_flags|IP_FF_SEND_ICMP|IP_FF_IPINFO,
10642 			    mctl_present, IP6_NO_IPPOLICY, ire->ire_zoneid);
10643 			return;
10644 		}
10645 		case IPPROTO_ICMPV6: {
10646 			icmp6_t *icmp6;
10647 
10648 			/* check for full IPv6+ICMPv6 header */
10649 			if ((mp->b_wptr - mp->b_rptr) <
10650 			    (hdr_length + ICMP6_MINLEN)) {
10651 				if (!pullupmsg(mp, hdr_length + ICMP6_MINLEN)) {
10652 					ip1dbg(("ip_wput_v6: ICMP hdr pullupmsg"
10653 					    " failed\n"));
10654 					BUMP_MIB(mibptr, ipIfStatsOutDiscards);
10655 					freemsg(first_mp);
10656 					return;
10657 				}
10658 				ip6h = (ip6_t *)mp->b_rptr;
10659 			}
10660 			icmp6 = (icmp6_t *)((uchar_t *)ip6h + hdr_length);
10661 
10662 			/* Update output mib stats */
10663 			icmp_update_out_mib_v6(ill, icmp6);
10664 
10665 			/* Check variable for testing applications */
10666 			if (ipst->ips_ipv6_drop_inbound_icmpv6) {
10667 				freemsg(first_mp);
10668 				return;
10669 			}
10670 			/*
10671 			 * Assume that there is always at least one conn for
10672 			 * ICMPv6 (in.ndpd) i.e. don't optimize the case
10673 			 * where there is no conn.
10674 			 */
10675 			if (IN6_IS_ADDR_MULTICAST(&ip6h->ip6_dst) &&
10676 			    !IS_LOOPBACK(ill)) {
10677 				/*
10678 				 * In the multicast case, applications may have
10679 				 * joined the group from different zones, so we
10680 				 * need to deliver the packet to each of them.
10681 				 * Loop through the multicast memberships
10682 				 * structures (ilm) on the receive ill and send
10683 				 * a copy of the packet up each matching one.
10684 				 * However, we don't do this for multicasts sent
10685 				 * on the loopback interface (PHYI_LOOPBACK flag
10686 				 * set) as they must stay in the sender's zone.
10687 				 */
10688 				ILM_WALKER_HOLD(ill);
10689 				for (ilm = ill->ill_ilm; ilm != NULL;
10690 				    ilm = ilm->ilm_next) {
10691 					if (ilm->ilm_flags & ILM_DELETED)
10692 						continue;
10693 					if (!IN6_ARE_ADDR_EQUAL(
10694 					    &ilm->ilm_v6addr, &ip6h->ip6_dst))
10695 						continue;
10696 					if ((fanout_flags &
10697 					    IP_FF_NO_MCAST_LOOP) &&
10698 					    ilm->ilm_zoneid == ire->ire_zoneid)
10699 						continue;
10700 					if (!ipif_lookup_zoneid(ill,
10701 					    ilm->ilm_zoneid, IPIF_UP, NULL))
10702 						continue;
10703 
10704 					first_mp1 = ip_copymsg(first_mp);
10705 					if (first_mp1 == NULL)
10706 						continue;
10707 					icmp_inbound_v6(q, first_mp1, ill,
10708 					    hdr_length, mctl_present,
10709 					    IP6_NO_IPPOLICY, ilm->ilm_zoneid,
10710 					    NULL);
10711 				}
10712 				ILM_WALKER_RELE(ill);
10713 			} else {
10714 				first_mp1 = ip_copymsg(first_mp);
10715 				if (first_mp1 != NULL)
10716 					icmp_inbound_v6(q, first_mp1, ill,
10717 					    hdr_length, mctl_present,
10718 					    IP6_NO_IPPOLICY, ire->ire_zoneid,
10719 					    NULL);
10720 			}
10721 		}
10722 		/* FALLTHRU */
10723 		default: {
10724 			/*
10725 			 * Handle protocols with which IPv6 is less intimate.
10726 			 */
10727 			fanout_flags |= IP_FF_RAWIP|IP_FF_IPINFO;
10728 
10729 			/*
10730 			 * Enable sending ICMP for "Unknown" nexthdr
10731 			 * case. i.e. where we did not FALLTHRU from
10732 			 * IPPROTO_ICMPV6 processing case above.
10733 			 */
10734 			if (nexthdr != IPPROTO_ICMPV6)
10735 				fanout_flags |= IP_FF_SEND_ICMP;
10736 			/*
10737 			 * Note: There can be more than one stream bound
10738 			 * to a particular protocol. When this is the case,
10739 			 * each one gets a copy of any incoming packets.
10740 			 */
10741 			ip_fanout_proto_v6(q, first_mp, ip6h, ill, ill, nexthdr,
10742 			    nexthdr_offset, fanout_flags|IP6_NO_IPPOLICY,
10743 			    mctl_present, ire->ire_zoneid);
10744 			return;
10745 		}
10746 	}
10747 }
10748 
10749 /*
10750  * Send packet using IRE.
10751  * Checksumming is controlled by cksum_request:
10752  *	-1 => normal i.e. TCP/UDP/SCTP/ICMPv6 are checksummed and nothing else.
10753  *	1 => Skip TCP/UDP/SCTP checksum
10754  * 	Otherwise => checksum_request contains insert offset for checksum
10755  *
10756  * Assumes that the following set of headers appear in the first
10757  * mblk:
10758  *	ip6_t
10759  *	Any extension headers
10760  *	TCP/UDP/SCTP header (if present)
10761  * The routine can handle an ICMPv6 header that is not in the first mblk.
10762  *
10763  * NOTE : This function does not ire_refrele the ire passed in as the
10764  *	  argument unlike ip_wput_ire where the REFRELE is done.
10765  *	  Refer to ip_wput_ire for more on this.
10766  */
10767 static void
10768 ip_wput_ire_v6(queue_t *q, mblk_t *mp, ire_t *ire, int unspec_src,
10769     int cksum_request, conn_t *connp, int caller, int attach_index, int flags,
10770     zoneid_t zoneid)
10771 {
10772 	ip6_t		*ip6h;
10773 	uint8_t		nexthdr;
10774 	uint16_t	hdr_length;
10775 	uint_t		reachable = 0x0;
10776 	ill_t		*ill;
10777 	mib2_ipIfStatsEntry_t	*mibptr;
10778 	mblk_t		*first_mp;
10779 	boolean_t	mctl_present;
10780 	ipsec_out_t	*io;
10781 	boolean_t	conn_dontroute;	/* conn value for multicast */
10782 	boolean_t	conn_multicast_loop;	/* conn value for multicast */
10783 	boolean_t 	multicast_forward;	/* Should we forward ? */
10784 	int		max_frag;
10785 	ip_stack_t	*ipst = ire->ire_ipst;
10786 	ipsec_stack_t	*ipss = ipst->ips_netstack->netstack_ipsec;
10787 
10788 	ill = ire_to_ill(ire);
10789 	first_mp = mp;
10790 	multicast_forward = B_FALSE;
10791 
10792 	if (mp->b_datap->db_type != M_CTL) {
10793 		ip6h = (ip6_t *)first_mp->b_rptr;
10794 	} else {
10795 		io = (ipsec_out_t *)first_mp->b_rptr;
10796 		ASSERT(io->ipsec_out_type == IPSEC_OUT);
10797 		/*
10798 		 * Grab the zone id now because the M_CTL can be discarded by
10799 		 * ip_wput_ire_parse_ipsec_out() below.
10800 		 */
10801 		ASSERT(zoneid == io->ipsec_out_zoneid);
10802 		ASSERT(zoneid != ALL_ZONES);
10803 		ip6h = (ip6_t *)first_mp->b_cont->b_rptr;
10804 		/*
10805 		 * For the multicast case, ipsec_out carries conn_dontroute and
10806 		 * conn_multicast_loop as conn may not be available here. We
10807 		 * need this for multicast loopback and forwarding which is done
10808 		 * later in the code.
10809 		 */
10810 		if (IN6_IS_ADDR_MULTICAST(&ip6h->ip6_dst)) {
10811 			conn_dontroute = io->ipsec_out_dontroute;
10812 			conn_multicast_loop = io->ipsec_out_multicast_loop;
10813 			/*
10814 			 * If conn_dontroute is not set or conn_multicast_loop
10815 			 * is set, we need to do forwarding/loopback. For
10816 			 * datagrams from ip_wput_multicast, conn_dontroute is
10817 			 * set to B_TRUE and conn_multicast_loop is set to
10818 			 * B_FALSE so that we neither do forwarding nor
10819 			 * loopback.
10820 			 */
10821 			if (!conn_dontroute || conn_multicast_loop)
10822 				multicast_forward = B_TRUE;
10823 		}
10824 	}
10825 
10826 	/*
10827 	 * If the sender didn't supply the hop limit and there is a default
10828 	 * unicast hop limit associated with the output interface, we use
10829 	 * that if the packet is unicast.  Interface specific unicast hop
10830 	 * limits as set via the SIOCSLIFLNKINFO ioctl.
10831 	 */
10832 	if (ill->ill_max_hops != 0 && !(flags & IP6I_HOPLIMIT) &&
10833 	    !(IN6_IS_ADDR_MULTICAST(&ip6h->ip6_dst))) {
10834 		ip6h->ip6_hops = ill->ill_max_hops;
10835 	}
10836 
10837 	if (ire->ire_type == IRE_LOCAL && ire->ire_zoneid != zoneid &&
10838 	    ire->ire_zoneid != ALL_ZONES) {
10839 		/*
10840 		 * When a zone sends a packet to another zone, we try to deliver
10841 		 * the packet under the same conditions as if the destination
10842 		 * was a real node on the network. To do so, we look for a
10843 		 * matching route in the forwarding table.
10844 		 * RTF_REJECT and RTF_BLACKHOLE are handled just like
10845 		 * ip_newroute_v6() does.
10846 		 * Note that IRE_LOCAL are special, since they are used
10847 		 * when the zoneid doesn't match in some cases. This means that
10848 		 * we need to handle ipha_src differently since ire_src_addr
10849 		 * belongs to the receiving zone instead of the sending zone.
10850 		 * When ip_restrict_interzone_loopback is set, then
10851 		 * ire_cache_lookup_v6() ensures that IRE_LOCAL are only used
10852 		 * for loopback between zones when the logical "Ethernet" would
10853 		 * have looped them back.
10854 		 */
10855 		ire_t *src_ire;
10856 
10857 		src_ire = ire_ftable_lookup_v6(&ip6h->ip6_dst, 0, 0, 0,
10858 		    NULL, NULL, zoneid, 0, NULL, (MATCH_IRE_RECURSIVE |
10859 		    MATCH_IRE_DEFAULT | MATCH_IRE_RJ_BHOLE), ipst);
10860 		if (src_ire != NULL &&
10861 		    !(src_ire->ire_flags & (RTF_REJECT | RTF_BLACKHOLE)) &&
10862 		    (!ipst->ips_ip_restrict_interzone_loopback ||
10863 		    ire_local_same_ill_group(ire, src_ire))) {
10864 			if (IN6_IS_ADDR_UNSPECIFIED(&ip6h->ip6_src) &&
10865 			    !unspec_src) {
10866 				ip6h->ip6_src = src_ire->ire_src_addr_v6;
10867 			}
10868 			ire_refrele(src_ire);
10869 		} else {
10870 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutNoRoutes);
10871 			if (src_ire != NULL) {
10872 				if (src_ire->ire_flags & RTF_BLACKHOLE) {
10873 					ire_refrele(src_ire);
10874 					freemsg(first_mp);
10875 					return;
10876 				}
10877 				ire_refrele(src_ire);
10878 			}
10879 			if (ip_hdr_complete_v6(ip6h, zoneid, ipst)) {
10880 				/* Failed */
10881 				freemsg(first_mp);
10882 				return;
10883 			}
10884 			icmp_unreachable_v6(q, first_mp,
10885 			    ICMP6_DST_UNREACH_NOROUTE, B_FALSE, B_FALSE,
10886 			    zoneid, ipst);
10887 			return;
10888 		}
10889 	}
10890 
10891 	if (mp->b_datap->db_type == M_CTL ||
10892 	    ipss->ipsec_outbound_v6_policy_present) {
10893 		mp = ip_wput_ire_parse_ipsec_out(first_mp, NULL, ip6h, ire,
10894 		    connp, unspec_src, zoneid);
10895 		if (mp == NULL) {
10896 			return;
10897 		}
10898 	}
10899 
10900 	first_mp = mp;
10901 	if (mp->b_datap->db_type == M_CTL) {
10902 		io = (ipsec_out_t *)mp->b_rptr;
10903 		ASSERT(io->ipsec_out_type == IPSEC_OUT);
10904 		mp = mp->b_cont;
10905 		mctl_present = B_TRUE;
10906 	} else {
10907 		mctl_present = B_FALSE;
10908 	}
10909 
10910 	ip6h = (ip6_t *)mp->b_rptr;
10911 	nexthdr = ip6h->ip6_nxt;
10912 	mibptr = ill->ill_ip_mib;
10913 
10914 	if (IN6_IS_ADDR_UNSPECIFIED(&ip6h->ip6_src) && !unspec_src) {
10915 		ipif_t *ipif;
10916 
10917 		/*
10918 		 * Select the source address using ipif_select_source_v6.
10919 		 */
10920 		if (attach_index != 0) {
10921 			ipif = ipif_select_source_v6(ill, &ip6h->ip6_dst,
10922 			    RESTRICT_TO_ILL, IPV6_PREFER_SRC_DEFAULT, zoneid);
10923 		} else {
10924 			ipif = ipif_select_source_v6(ill, &ip6h->ip6_dst,
10925 			    RESTRICT_TO_NONE, IPV6_PREFER_SRC_DEFAULT, zoneid);
10926 		}
10927 		if (ipif == NULL) {
10928 			if (ip_debug > 2) {
10929 				/* ip1dbg */
10930 				pr_addr_dbg("ip_wput_ire_v6: no src for "
10931 				    "dst %s\n, ", AF_INET6, &ip6h->ip6_dst);
10932 				printf("ip_wput_ire_v6: interface name %s\n",
10933 				    ill->ill_name);
10934 			}
10935 			freemsg(first_mp);
10936 			return;
10937 		}
10938 		ip6h->ip6_src = ipif->ipif_v6src_addr;
10939 		ipif_refrele(ipif);
10940 	}
10941 	if (IN6_IS_ADDR_MULTICAST(&ip6h->ip6_dst)) {
10942 		if ((connp != NULL && connp->conn_multicast_loop) ||
10943 		    !IS_LOOPBACK(ill)) {
10944 			ilm_t	*ilm;
10945 
10946 			ILM_WALKER_HOLD(ill);
10947 			ilm = ilm_lookup_ill_v6(ill, &ip6h->ip6_dst, ALL_ZONES);
10948 			ILM_WALKER_RELE(ill);
10949 			if (ilm != NULL) {
10950 				mblk_t *nmp;
10951 				int fanout_flags = 0;
10952 
10953 				if (connp != NULL &&
10954 				    !connp->conn_multicast_loop) {
10955 					fanout_flags |= IP_FF_NO_MCAST_LOOP;
10956 				}
10957 				ip1dbg(("ip_wput_ire_v6: "
10958 				    "Loopback multicast\n"));
10959 				nmp = ip_copymsg(first_mp);
10960 				if (nmp != NULL) {
10961 					ip6_t	*nip6h;
10962 					mblk_t	*mp_ip6h;
10963 
10964 					if (mctl_present) {
10965 						nip6h = (ip6_t *)
10966 						    nmp->b_cont->b_rptr;
10967 						mp_ip6h = nmp->b_cont;
10968 					} else {
10969 						nip6h = (ip6_t *)nmp->b_rptr;
10970 						mp_ip6h = nmp;
10971 					}
10972 
10973 					DTRACE_PROBE4(
10974 					    ip6__loopback__out__start,
10975 					    ill_t *, NULL,
10976 					    ill_t *, ill,
10977 					    ip6_t *, nip6h,
10978 					    mblk_t *, nmp);
10979 
10980 					FW_HOOKS6(
10981 					    ipst->ips_ip6_loopback_out_event,
10982 					    ipst->ips_ipv6firewall_loopback_out,
10983 					    NULL, ill, nip6h, nmp, mp_ip6h,
10984 					    0, ipst);
10985 
10986 					DTRACE_PROBE1(
10987 					    ip6__loopback__out__end,
10988 					    mblk_t *, nmp);
10989 
10990 					/*
10991 					 * DTrace this as ip:::send.  A blocked
10992 					 * packet will fire the send probe, but
10993 					 * not the receive probe.
10994 					 */
10995 					DTRACE_IP7(send, mblk_t *, nmp,
10996 					    conn_t *, NULL, void_ip_t *, nip6h,
10997 					    __dtrace_ipsr_ill_t *, ill,
10998 					    ipha_t *, NULL, ip6_t *, nip6h,
10999 					    int, 1);
11000 
11001 					if (nmp != NULL) {
11002 						/*
11003 						 * Deliver locally and to
11004 						 * every local zone, except
11005 						 * the sending zone when
11006 						 * IPV6_MULTICAST_LOOP is
11007 						 * disabled.
11008 						 */
11009 						ip_wput_local_v6(RD(q), ill,
11010 						    nip6h, nmp,
11011 						    ire, fanout_flags);
11012 					}
11013 				} else {
11014 					BUMP_MIB(mibptr, ipIfStatsOutDiscards);
11015 					ip1dbg(("ip_wput_ire_v6: "
11016 					    "copymsg failed\n"));
11017 				}
11018 			}
11019 		}
11020 		if (ip6h->ip6_hops == 0 ||
11021 		    IN6_IS_ADDR_MC_NODELOCAL(&ip6h->ip6_dst) ||
11022 		    IS_LOOPBACK(ill)) {
11023 			/*
11024 			 * Local multicast or just loopback on loopback
11025 			 * interface.
11026 			 */
11027 			BUMP_MIB(mibptr, ipIfStatsHCOutMcastPkts);
11028 			UPDATE_MIB(mibptr, ipIfStatsHCOutMcastOctets,
11029 			    ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN);
11030 			ip1dbg(("ip_wput_ire_v6: local multicast only\n"));
11031 			freemsg(first_mp);
11032 			return;
11033 		}
11034 	}
11035 
11036 	if (ire->ire_stq != NULL) {
11037 		uint32_t	sum;
11038 		uint_t		ill_index =  ((ill_t *)ire->ire_stq->q_ptr)->
11039 		    ill_phyint->phyint_ifindex;
11040 		queue_t		*dev_q = ire->ire_stq->q_next;
11041 
11042 		/*
11043 		 * non-NULL send-to queue - packet is to be sent
11044 		 * out an interface.
11045 		 */
11046 
11047 		/* Driver is flow-controlling? */
11048 		if (!IP_FLOW_CONTROLLED_ULP(nexthdr) &&
11049 		    ((dev_q->q_next || dev_q->q_first) && !canput(dev_q))) {
11050 			/*
11051 			 * Queue packet if we have an conn to give back
11052 			 * pressure.  We can't queue packets intended for
11053 			 * hardware acceleration since we've tossed that
11054 			 * state already.  If the packet is being fed back
11055 			 * from ire_send_v6, we don't know the position in
11056 			 * the queue to enqueue the packet and we discard
11057 			 * the packet.
11058 			 */
11059 			if (ipst->ips_ip_output_queue && connp != NULL &&
11060 			    !mctl_present && caller != IRE_SEND) {
11061 				if (caller == IP_WSRV) {
11062 					connp->conn_did_putbq = 1;
11063 					(void) putbq(connp->conn_wq, mp);
11064 					conn_drain_insert(connp);
11065 					/*
11066 					 * caller == IP_WSRV implies we are
11067 					 * the service thread, and the
11068 					 * queue is already noenabled.
11069 					 * The check for canput and
11070 					 * the putbq is not atomic.
11071 					 * So we need to check again.
11072 					 */
11073 					if (canput(dev_q))
11074 						connp->conn_did_putbq = 0;
11075 				} else {
11076 					(void) putq(connp->conn_wq, mp);
11077 				}
11078 				return;
11079 			}
11080 			BUMP_MIB(mibptr, ipIfStatsOutDiscards);
11081 			freemsg(first_mp);
11082 			return;
11083 		}
11084 
11085 		/*
11086 		 * Look for reachability confirmations from the transport.
11087 		 */
11088 		if (ip6h->ip6_vcf & IP_FORWARD_PROG) {
11089 			reachable |= IPV6_REACHABILITY_CONFIRMATION;
11090 			ip6h->ip6_vcf &= ~IP_FORWARD_PROG;
11091 			if (mctl_present)
11092 				io->ipsec_out_reachable = B_TRUE;
11093 		}
11094 		/* Fastpath */
11095 		switch (nexthdr) {
11096 		case IPPROTO_TCP:
11097 		case IPPROTO_UDP:
11098 		case IPPROTO_ICMPV6:
11099 		case IPPROTO_SCTP:
11100 			hdr_length = IPV6_HDR_LEN;
11101 			break;
11102 		default: {
11103 			uint8_t	*nexthdrp;
11104 
11105 			if (!ip_hdr_length_nexthdr_v6(mp, ip6h,
11106 			    &hdr_length, &nexthdrp)) {
11107 				/* Malformed packet */
11108 				BUMP_MIB(mibptr, ipIfStatsOutDiscards);
11109 				freemsg(first_mp);
11110 				return;
11111 			}
11112 			nexthdr = *nexthdrp;
11113 			break;
11114 		}
11115 		}
11116 
11117 		if (cksum_request != -1 && nexthdr != IPPROTO_ICMPV6) {
11118 			uint16_t	*up;
11119 			uint16_t	*insp;
11120 
11121 			/*
11122 			 * The packet header is processed once for all, even
11123 			 * in the multirouting case. We disable hardware
11124 			 * checksum if the packet is multirouted, as it will be
11125 			 * replicated via several interfaces, and not all of
11126 			 * them may have this capability.
11127 			 */
11128 			if (cksum_request == 1 &&
11129 			    !(ire->ire_flags & RTF_MULTIRT)) {
11130 				/* Skip the transport checksum */
11131 				goto cksum_done;
11132 			}
11133 			/*
11134 			 * Do user-configured raw checksum.
11135 			 * Compute checksum and insert at offset "cksum_request"
11136 			 */
11137 
11138 			/* check for enough headers for checksum */
11139 			cksum_request += hdr_length;	/* offset from rptr */
11140 			if ((mp->b_wptr - mp->b_rptr) <
11141 			    (cksum_request + sizeof (int16_t))) {
11142 				if (!pullupmsg(mp,
11143 				    cksum_request + sizeof (int16_t))) {
11144 					ip1dbg(("ip_wput_v6: ICMP hdr pullupmsg"
11145 					    " failed\n"));
11146 					BUMP_MIB(mibptr, ipIfStatsOutDiscards);
11147 					freemsg(first_mp);
11148 					return;
11149 				}
11150 				ip6h = (ip6_t *)mp->b_rptr;
11151 			}
11152 			insp = (uint16_t *)((uchar_t *)ip6h + cksum_request);
11153 			ASSERT(((uintptr_t)insp & 0x1) == 0);
11154 			up = (uint16_t *)&ip6h->ip6_src;
11155 			/*
11156 			 * icmp has placed length and routing
11157 			 * header adjustment in *insp.
11158 			 */
11159 			sum = htons(nexthdr) +
11160 			    up[0] + up[1] + up[2] + up[3] +
11161 			    up[4] + up[5] + up[6] + up[7] +
11162 			    up[8] + up[9] + up[10] + up[11] +
11163 			    up[12] + up[13] + up[14] + up[15];
11164 			sum = (sum & 0xffff) + (sum >> 16);
11165 			*insp = IP_CSUM(mp, hdr_length, sum);
11166 		} else if (nexthdr == IPPROTO_TCP) {
11167 			uint16_t	*up;
11168 
11169 			/*
11170 			 * Check for full IPv6 header + enough TCP header
11171 			 * to get at the checksum field.
11172 			 */
11173 			if ((mp->b_wptr - mp->b_rptr) <
11174 			    (hdr_length + TCP_CHECKSUM_OFFSET +
11175 			    TCP_CHECKSUM_SIZE)) {
11176 				if (!pullupmsg(mp, hdr_length +
11177 				    TCP_CHECKSUM_OFFSET + TCP_CHECKSUM_SIZE)) {
11178 					ip1dbg(("ip_wput_v6: TCP hdr pullupmsg"
11179 					    " failed\n"));
11180 					BUMP_MIB(mibptr, ipIfStatsOutDiscards);
11181 					freemsg(first_mp);
11182 					return;
11183 				}
11184 				ip6h = (ip6_t *)mp->b_rptr;
11185 			}
11186 
11187 			up = (uint16_t *)&ip6h->ip6_src;
11188 			/*
11189 			 * Note: The TCP module has stored the length value
11190 			 * into the tcp checksum field, so we don't
11191 			 * need to explicitly sum it in here.
11192 			 */
11193 			sum = up[0] + up[1] + up[2] + up[3] +
11194 			    up[4] + up[5] + up[6] + up[7] +
11195 			    up[8] + up[9] + up[10] + up[11] +
11196 			    up[12] + up[13] + up[14] + up[15];
11197 
11198 			/* Fold the initial sum */
11199 			sum = (sum & 0xffff) + (sum >> 16);
11200 
11201 			up = (uint16_t *)(((uchar_t *)ip6h) +
11202 			    hdr_length + TCP_CHECKSUM_OFFSET);
11203 
11204 			IP_CKSUM_XMIT(ill, ire, mp, ip6h, up, IPPROTO_TCP,
11205 			    hdr_length, ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN,
11206 			    ire->ire_max_frag, mctl_present, sum);
11207 
11208 			/* Software checksum? */
11209 			if (DB_CKSUMFLAGS(mp) == 0) {
11210 				IP6_STAT(ipst, ip6_out_sw_cksum);
11211 				IP6_STAT_UPDATE(ipst,
11212 				    ip6_tcp_out_sw_cksum_bytes,
11213 				    (ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN) -
11214 				    hdr_length);
11215 			}
11216 		} else if (nexthdr == IPPROTO_UDP) {
11217 			uint16_t	*up;
11218 
11219 			/*
11220 			 * check for full IPv6 header + enough UDP header
11221 			 * to get at the UDP checksum field
11222 			 */
11223 			if ((mp->b_wptr - mp->b_rptr) < (hdr_length +
11224 			    UDP_CHECKSUM_OFFSET + UDP_CHECKSUM_SIZE)) {
11225 				if (!pullupmsg(mp, hdr_length +
11226 				    UDP_CHECKSUM_OFFSET + UDP_CHECKSUM_SIZE)) {
11227 					ip1dbg(("ip_wput_v6: UDP hdr pullupmsg"
11228 					    " failed\n"));
11229 					BUMP_MIB(mibptr, ipIfStatsOutDiscards);
11230 					freemsg(first_mp);
11231 					return;
11232 				}
11233 				ip6h = (ip6_t *)mp->b_rptr;
11234 			}
11235 			up = (uint16_t *)&ip6h->ip6_src;
11236 			/*
11237 			 * Note: The UDP module has stored the length value
11238 			 * into the udp checksum field, so we don't
11239 			 * need to explicitly sum it in here.
11240 			 */
11241 			sum = up[0] + up[1] + up[2] + up[3] +
11242 			    up[4] + up[5] + up[6] + up[7] +
11243 			    up[8] + up[9] + up[10] + up[11] +
11244 			    up[12] + up[13] + up[14] + up[15];
11245 
11246 			/* Fold the initial sum */
11247 			sum = (sum & 0xffff) + (sum >> 16);
11248 
11249 			up = (uint16_t *)(((uchar_t *)ip6h) +
11250 			    hdr_length + UDP_CHECKSUM_OFFSET);
11251 
11252 			IP_CKSUM_XMIT(ill, ire, mp, ip6h, up, IPPROTO_UDP,
11253 			    hdr_length, ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN,
11254 			    ire->ire_max_frag, mctl_present, sum);
11255 
11256 			/* Software checksum? */
11257 			if (DB_CKSUMFLAGS(mp) == 0) {
11258 				IP6_STAT(ipst, ip6_out_sw_cksum);
11259 				IP6_STAT_UPDATE(ipst,
11260 				    ip6_udp_out_sw_cksum_bytes,
11261 				    (ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN) -
11262 				    hdr_length);
11263 			}
11264 		} else if (nexthdr == IPPROTO_ICMPV6) {
11265 			uint16_t	*up;
11266 			icmp6_t *icmp6;
11267 
11268 			/* check for full IPv6+ICMPv6 header */
11269 			if ((mp->b_wptr - mp->b_rptr) <
11270 			    (hdr_length + ICMP6_MINLEN)) {
11271 				if (!pullupmsg(mp, hdr_length + ICMP6_MINLEN)) {
11272 					ip1dbg(("ip_wput_v6: ICMP hdr pullupmsg"
11273 					    " failed\n"));
11274 					BUMP_MIB(mibptr, ipIfStatsOutDiscards);
11275 					freemsg(first_mp);
11276 					return;
11277 				}
11278 				ip6h = (ip6_t *)mp->b_rptr;
11279 			}
11280 			icmp6 = (icmp6_t *)((uchar_t *)ip6h + hdr_length);
11281 			up = (uint16_t *)&ip6h->ip6_src;
11282 			/*
11283 			 * icmp has placed length and routing
11284 			 * header adjustment in icmp6_cksum.
11285 			 */
11286 			sum = htons(IPPROTO_ICMPV6) +
11287 			    up[0] + up[1] + up[2] + up[3] +
11288 			    up[4] + up[5] + up[6] + up[7] +
11289 			    up[8] + up[9] + up[10] + up[11] +
11290 			    up[12] + up[13] + up[14] + up[15];
11291 			sum = (sum & 0xffff) + (sum >> 16);
11292 			icmp6->icmp6_cksum = IP_CSUM(mp, hdr_length, sum);
11293 
11294 			/* Update output mib stats */
11295 			icmp_update_out_mib_v6(ill, icmp6);
11296 		} else if (nexthdr == IPPROTO_SCTP) {
11297 			sctp_hdr_t *sctph;
11298 
11299 			if (MBLKL(mp) < (hdr_length + sizeof (*sctph))) {
11300 				if (!pullupmsg(mp, hdr_length +
11301 				    sizeof (*sctph))) {
11302 					ip1dbg(("ip_wput_v6: SCTP hdr pullupmsg"
11303 					    " failed\n"));
11304 					BUMP_MIB(ill->ill_ip_mib,
11305 					    ipIfStatsOutDiscards);
11306 					freemsg(mp);
11307 					return;
11308 				}
11309 				ip6h = (ip6_t *)mp->b_rptr;
11310 			}
11311 			sctph = (sctp_hdr_t *)(mp->b_rptr + hdr_length);
11312 			sctph->sh_chksum = 0;
11313 			sctph->sh_chksum = sctp_cksum(mp, hdr_length);
11314 		}
11315 
11316 	cksum_done:
11317 		/*
11318 		 * We force the insertion of a fragment header using the
11319 		 * IPH_FRAG_HDR flag in two cases:
11320 		 * - after reception of an ICMPv6 "packet too big" message
11321 		 *   with a MTU < 1280 (cf. RFC 2460 section 5)
11322 		 * - for multirouted IPv6 packets, so that the receiver can
11323 		 *   discard duplicates according to their fragment identifier
11324 		 *
11325 		 * Two flags modifed from the API can modify this behavior.
11326 		 * The first is IPV6_USE_MIN_MTU.  With this API the user
11327 		 * can specify how to manage PMTUD for unicast and multicast.
11328 		 *
11329 		 * IPV6_DONTFRAG disallows fragmentation.
11330 		 */
11331 		max_frag = ire->ire_max_frag;
11332 		switch (IP6I_USE_MIN_MTU_API(flags)) {
11333 		case IPV6_USE_MIN_MTU_DEFAULT:
11334 		case IPV6_USE_MIN_MTU_UNICAST:
11335 			if (IN6_IS_ADDR_MULTICAST(&ip6h->ip6_dst)) {
11336 				max_frag = IPV6_MIN_MTU;
11337 			}
11338 			break;
11339 
11340 		case IPV6_USE_MIN_MTU_NEVER:
11341 			max_frag = IPV6_MIN_MTU;
11342 			break;
11343 		}
11344 		if (ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN > max_frag ||
11345 		    (ire->ire_frag_flag & IPH_FRAG_HDR)) {
11346 			if (connp != NULL && (flags & IP6I_DONTFRAG)) {
11347 				icmp_pkt2big_v6(ire->ire_stq, first_mp,
11348 				    max_frag, B_FALSE, B_TRUE, zoneid, ipst);
11349 				return;
11350 			}
11351 
11352 			if (ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN !=
11353 			    (mp->b_cont ? msgdsize(mp) :
11354 			    mp->b_wptr - (uchar_t *)ip6h)) {
11355 				ip0dbg(("Packet length mismatch: %d, %ld\n",
11356 				    ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN,
11357 				    msgdsize(mp)));
11358 				freemsg(first_mp);
11359 				return;
11360 			}
11361 			/* Do IPSEC processing first */
11362 			if (mctl_present) {
11363 				if (attach_index != 0)
11364 					ipsec_out_attach_if(io, attach_index);
11365 				ipsec_out_process(q, first_mp, ire, ill_index);
11366 				return;
11367 			}
11368 			ASSERT(mp->b_prev == NULL);
11369 			ip2dbg(("Fragmenting Size = %d, mtu = %d\n",
11370 			    ntohs(ip6h->ip6_plen) +
11371 			    IPV6_HDR_LEN, max_frag));
11372 			ASSERT(mp == first_mp);
11373 			/* Initiate IPPF processing */
11374 			if (IPP_ENABLED(IPP_LOCAL_OUT, ipst)) {
11375 				ip_process(IPP_LOCAL_OUT, &mp, ill_index);
11376 				if (mp == NULL) {
11377 					return;
11378 				}
11379 			}
11380 			ip_wput_frag_v6(mp, ire, reachable, connp,
11381 			    caller, max_frag);
11382 			return;
11383 		}
11384 		/* Do IPSEC processing first */
11385 		if (mctl_present) {
11386 			int extra_len = ipsec_out_extra_length(first_mp);
11387 
11388 			if (ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN + extra_len >
11389 			    max_frag) {
11390 				/*
11391 				 * IPsec headers will push the packet over the
11392 				 * MTU limit.  Issue an ICMPv6 Packet Too Big
11393 				 * message for this packet if the upper-layer
11394 				 * that issued this packet will be able to
11395 				 * react to the icmp_pkt2big_v6() that we'll
11396 				 * generate.
11397 				 */
11398 				icmp_pkt2big_v6(ire->ire_stq, first_mp,
11399 				    max_frag, B_FALSE, B_TRUE, zoneid, ipst);
11400 				return;
11401 			}
11402 			if (attach_index != 0)
11403 				ipsec_out_attach_if(io, attach_index);
11404 			ipsec_out_process(q, first_mp, ire, ill_index);
11405 			return;
11406 		}
11407 		/*
11408 		 * XXX multicast: add ip_mforward_v6() here.
11409 		 * Check conn_dontroute
11410 		 */
11411 #ifdef lint
11412 		/*
11413 		 * XXX The only purpose of this statement is to avoid lint
11414 		 * errors.  See the above "XXX multicast".  When that gets
11415 		 * fixed, remove this whole #ifdef lint section.
11416 		 */
11417 		ip3dbg(("multicast forward is %s.\n",
11418 		    (multicast_forward ? "TRUE" : "FALSE")));
11419 #endif
11420 
11421 		UPDATE_OB_PKT_COUNT(ire);
11422 		ire->ire_last_used_time = lbolt;
11423 		ASSERT(mp == first_mp);
11424 		ip_xmit_v6(mp, ire, reachable, connp, caller, NULL);
11425 	} else {
11426 		/*
11427 		 * DTrace this as ip:::send.  A blocked packet will fire the
11428 		 * send probe, but not the receive probe.
11429 		 */
11430 		DTRACE_IP7(send, mblk_t *, first_mp, conn_t *, NULL,
11431 		    void_ip_t *, ip6h, __dtrace_ipsr_ill_t *, ill, ipha_t *,
11432 		    NULL, ip6_t *, ip6h, int, 1);
11433 		DTRACE_PROBE4(ip6__loopback__out__start,
11434 		    ill_t *, NULL, ill_t *, ill,
11435 		    ip6_t *, ip6h, mblk_t *, first_mp);
11436 		FW_HOOKS6(ipst->ips_ip6_loopback_out_event,
11437 		    ipst->ips_ipv6firewall_loopback_out,
11438 		    NULL, ill, ip6h, first_mp, mp, 0, ipst);
11439 		DTRACE_PROBE1(ip6__loopback__out__end, mblk_t *, first_mp);
11440 		if (first_mp != NULL)
11441 			ip_wput_local_v6(RD(q), ill, ip6h, first_mp, ire, 0);
11442 	}
11443 }
11444 
11445 /*
11446  * Outbound IPv6 fragmentation routine using MDT.
11447  */
11448 static void
11449 ip_wput_frag_mdt_v6(mblk_t *mp, ire_t *ire, size_t max_chunk,
11450     size_t unfragmentable_len, uint8_t nexthdr, uint_t prev_nexthdr_offset)
11451 {
11452 	ip6_t		*ip6h = (ip6_t *)mp->b_rptr;
11453 	uint_t		pkts, wroff, hdr_chunk_len, pbuf_idx;
11454 	mblk_t		*hdr_mp, *md_mp = NULL;
11455 	int		i1;
11456 	multidata_t	*mmd;
11457 	unsigned char	*hdr_ptr, *pld_ptr;
11458 	ip_pdescinfo_t	pdi;
11459 	uint32_t	ident;
11460 	size_t		len;
11461 	uint16_t	offset;
11462 	queue_t		*stq = ire->ire_stq;
11463 	ill_t		*ill = (ill_t *)stq->q_ptr;
11464 	ip_stack_t	*ipst = ill->ill_ipst;
11465 
11466 	ASSERT(DB_TYPE(mp) == M_DATA);
11467 	ASSERT(MBLKL(mp) > unfragmentable_len);
11468 
11469 	/*
11470 	 * Move read ptr past unfragmentable portion, we don't want this part
11471 	 * of the data in our fragments.
11472 	 */
11473 	mp->b_rptr += unfragmentable_len;
11474 
11475 	/* Calculate how many packets we will send out  */
11476 	i1 = (mp->b_cont == NULL) ? MBLKL(mp) : msgsize(mp);
11477 	pkts = (i1 + max_chunk - 1) / max_chunk;
11478 	ASSERT(pkts > 1);
11479 
11480 	/* Allocate a message block which will hold all the IP Headers. */
11481 	wroff = ipst->ips_ip_wroff_extra;
11482 	hdr_chunk_len = wroff + unfragmentable_len + sizeof (ip6_frag_t);
11483 
11484 	i1 = pkts * hdr_chunk_len;
11485 	/*
11486 	 * Create the header buffer, Multidata and destination address
11487 	 * and SAP attribute that should be associated with it.
11488 	 */
11489 	if ((hdr_mp = allocb(i1, BPRI_HI)) == NULL ||
11490 	    ((hdr_mp->b_wptr += i1),
11491 	    (mmd = mmd_alloc(hdr_mp, &md_mp, KM_NOSLEEP)) == NULL) ||
11492 	    !ip_md_addr_attr(mmd, NULL, ire->ire_nce->nce_res_mp)) {
11493 		freemsg(mp);
11494 		if (md_mp == NULL) {
11495 			freemsg(hdr_mp);
11496 		} else {
11497 free_mmd:		IP6_STAT(ipst, ip6_frag_mdt_discarded);
11498 			freemsg(md_mp);
11499 		}
11500 		IP6_STAT(ipst, ip6_frag_mdt_allocfail);
11501 		BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutFragFails);
11502 		return;
11503 	}
11504 	IP6_STAT(ipst, ip6_frag_mdt_allocd);
11505 
11506 	/*
11507 	 * Add a payload buffer to the Multidata; this operation must not
11508 	 * fail, or otherwise our logic in this routine is broken.  There
11509 	 * is no memory allocation done by the routine, so any returned
11510 	 * failure simply tells us that we've done something wrong.
11511 	 *
11512 	 * A failure tells us that either we're adding the same payload
11513 	 * buffer more than once, or we're trying to add more buffers than
11514 	 * allowed.  None of the above cases should happen, and we panic
11515 	 * because either there's horrible heap corruption, and/or
11516 	 * programming mistake.
11517 	 */
11518 	if ((pbuf_idx = mmd_addpldbuf(mmd, mp)) < 0) {
11519 		goto pbuf_panic;
11520 	}
11521 
11522 	hdr_ptr = hdr_mp->b_rptr;
11523 	pld_ptr = mp->b_rptr;
11524 
11525 	pdi.flags = PDESC_HBUF_REF | PDESC_PBUF_REF;
11526 
11527 	ident = htonl(atomic_add_32_nv(&ire->ire_ident, 1));
11528 
11529 	/*
11530 	 * len is the total length of the fragmentable data in this
11531 	 * datagram.  For each fragment sent, we will decrement len
11532 	 * by the amount of fragmentable data sent in that fragment
11533 	 * until len reaches zero.
11534 	 */
11535 	len = ntohs(ip6h->ip6_plen) - (unfragmentable_len - IPV6_HDR_LEN);
11536 
11537 	offset = 0;
11538 	prev_nexthdr_offset += wroff;
11539 
11540 	while (len != 0) {
11541 		size_t		mlen;
11542 		ip6_t		*fip6h;
11543 		ip6_frag_t	*fraghdr;
11544 		int		error;
11545 
11546 		ASSERT((hdr_ptr + hdr_chunk_len) <= hdr_mp->b_wptr);
11547 		mlen = MIN(len, max_chunk);
11548 		len -= mlen;
11549 
11550 		fip6h = (ip6_t *)(hdr_ptr + wroff);
11551 		ASSERT(OK_32PTR(fip6h));
11552 		bcopy(ip6h, fip6h, unfragmentable_len);
11553 		hdr_ptr[prev_nexthdr_offset] = IPPROTO_FRAGMENT;
11554 
11555 		fip6h->ip6_plen = htons((uint16_t)(mlen +
11556 		    unfragmentable_len - IPV6_HDR_LEN + sizeof (ip6_frag_t)));
11557 
11558 		fraghdr = (ip6_frag_t *)((unsigned char *)fip6h +
11559 		    unfragmentable_len);
11560 		fraghdr->ip6f_nxt = nexthdr;
11561 		fraghdr->ip6f_reserved = 0;
11562 		fraghdr->ip6f_offlg = htons(offset) |
11563 		    ((len != 0) ? IP6F_MORE_FRAG : 0);
11564 		fraghdr->ip6f_ident = ident;
11565 
11566 		/*
11567 		 * Record offset and size of header and data of the next packet
11568 		 * in the multidata message.
11569 		 */
11570 		PDESC_HDR_ADD(&pdi, hdr_ptr, wroff,
11571 		    unfragmentable_len + sizeof (ip6_frag_t), 0);
11572 		PDESC_PLD_INIT(&pdi);
11573 		i1 = MIN(mp->b_wptr - pld_ptr, mlen);
11574 		ASSERT(i1 > 0);
11575 		PDESC_PLD_SPAN_ADD(&pdi, pbuf_idx, pld_ptr, i1);
11576 		if (i1 == mlen) {
11577 			pld_ptr += mlen;
11578 		} else {
11579 			i1 = mlen - i1;
11580 			mp = mp->b_cont;
11581 			ASSERT(mp != NULL);
11582 			ASSERT(MBLKL(mp) >= i1);
11583 			/*
11584 			 * Attach the next payload message block to the
11585 			 * multidata message.
11586 			 */
11587 			if ((pbuf_idx = mmd_addpldbuf(mmd, mp)) < 0)
11588 				goto pbuf_panic;
11589 			PDESC_PLD_SPAN_ADD(&pdi, pbuf_idx, mp->b_rptr, i1);
11590 			pld_ptr = mp->b_rptr + i1;
11591 		}
11592 
11593 		if ((mmd_addpdesc(mmd, (pdescinfo_t *)&pdi, &error,
11594 		    KM_NOSLEEP)) == NULL) {
11595 			/*
11596 			 * Any failure other than ENOMEM indicates that we
11597 			 * have passed in invalid pdesc info or parameters
11598 			 * to mmd_addpdesc, which must not happen.
11599 			 *
11600 			 * EINVAL is a result of failure on boundary checks
11601 			 * against the pdesc info contents.  It should not
11602 			 * happen, and we panic because either there's
11603 			 * horrible heap corruption, and/or programming
11604 			 * mistake.
11605 			 */
11606 			if (error != ENOMEM) {
11607 				cmn_err(CE_PANIC, "ip_wput_frag_mdt_v6: "
11608 				    "pdesc logic error detected for "
11609 				    "mmd %p pinfo %p (%d)\n",
11610 				    (void *)mmd, (void *)&pdi, error);
11611 				/* NOTREACHED */
11612 			}
11613 			IP6_STAT(ipst, ip6_frag_mdt_addpdescfail);
11614 			/* Free unattached payload message blocks as well */
11615 			md_mp->b_cont = mp->b_cont;
11616 			goto free_mmd;
11617 		}
11618 
11619 		/* Advance fragment offset. */
11620 		offset += mlen;
11621 
11622 		/* Advance to location for next header in the buffer. */
11623 		hdr_ptr += hdr_chunk_len;
11624 
11625 		/* Did we reach the next payload message block? */
11626 		if (pld_ptr == mp->b_wptr && mp->b_cont != NULL) {
11627 			mp = mp->b_cont;
11628 			/*
11629 			 * Attach the next message block with payload
11630 			 * data to the multidata message.
11631 			 */
11632 			if ((pbuf_idx = mmd_addpldbuf(mmd, mp)) < 0)
11633 				goto pbuf_panic;
11634 			pld_ptr = mp->b_rptr;
11635 		}
11636 	}
11637 
11638 	ASSERT(hdr_mp->b_wptr == hdr_ptr);
11639 	ASSERT(mp->b_wptr == pld_ptr);
11640 
11641 	/* Update IP statistics */
11642 	UPDATE_MIB(ill->ill_ip_mib, ipIfStatsOutFragCreates, pkts);
11643 	BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutFragOKs);
11644 	UPDATE_MIB(ill->ill_ip_mib, ipIfStatsHCOutTransmits, pkts);
11645 	/*
11646 	 * The ipv6 header len is accounted for in unfragmentable_len so
11647 	 * when calculating the fragmentation overhead just add the frag
11648 	 * header len.
11649 	 */
11650 	UPDATE_MIB(ill->ill_ip_mib, ipIfStatsHCOutOctets,
11651 	    (ntohs(ip6h->ip6_plen) - (unfragmentable_len - IPV6_HDR_LEN)) +
11652 	    pkts * (unfragmentable_len + sizeof (ip6_frag_t)));
11653 	IP6_STAT_UPDATE(ipst, ip6_frag_mdt_pkt_out, pkts);
11654 
11655 	ire->ire_ob_pkt_count += pkts;
11656 	if (ire->ire_ipif != NULL)
11657 		atomic_add_32(&ire->ire_ipif->ipif_ob_pkt_count, pkts);
11658 
11659 	ire->ire_last_used_time = lbolt;
11660 	/* Send it down */
11661 	putnext(stq, md_mp);
11662 	return;
11663 
11664 pbuf_panic:
11665 	cmn_err(CE_PANIC, "ip_wput_frag_mdt_v6: payload buffer logic "
11666 	    "error for mmd %p pbuf %p (%d)", (void *)mmd, (void *)mp,
11667 	    pbuf_idx);
11668 	/* NOTREACHED */
11669 }
11670 
11671 /*
11672  * IPv6 fragmentation.  Essentially the same as IPv4 fragmentation.
11673  * We have not optimized this in terms of number of mblks
11674  * allocated. For instance, for each fragment sent we always allocate a
11675  * mblk to hold the IPv6 header and fragment header.
11676  *
11677  * Assumes that all the extension headers are contained in the first mblk.
11678  *
11679  * The fragment header is inserted after an hop-by-hop options header
11680  * and after [an optional destinations header followed by] a routing header.
11681  *
11682  * NOTE : This function does not ire_refrele the ire passed in as
11683  * the argument.
11684  */
11685 void
11686 ip_wput_frag_v6(mblk_t *mp, ire_t *ire, uint_t reachable, conn_t *connp,
11687     int caller, int max_frag)
11688 {
11689 	ip6_t		*ip6h = (ip6_t *)mp->b_rptr;
11690 	ip6_t		*fip6h;
11691 	mblk_t		*hmp;
11692 	mblk_t		*hmp0;
11693 	mblk_t		*dmp;
11694 	ip6_frag_t	*fraghdr;
11695 	size_t		unfragmentable_len;
11696 	size_t		len;
11697 	size_t		mlen;
11698 	size_t		max_chunk;
11699 	uint32_t	ident;
11700 	uint16_t	off_flags;
11701 	uint16_t	offset = 0;
11702 	ill_t		*ill;
11703 	uint8_t		nexthdr;
11704 	uint_t		prev_nexthdr_offset;
11705 	uint8_t		*ptr;
11706 	ip_stack_t	*ipst = ire->ire_ipst;
11707 
11708 	ASSERT(ire->ire_type == IRE_CACHE);
11709 	ill = (ill_t *)ire->ire_stq->q_ptr;
11710 
11711 	if (max_frag <= 0) {
11712 		BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutFragFails);
11713 		freemsg(mp);
11714 		return;
11715 	}
11716 	BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutFragReqds);
11717 
11718 	/*
11719 	 * Determine the length of the unfragmentable portion of this
11720 	 * datagram.  This consists of the IPv6 header, a potential
11721 	 * hop-by-hop options header, a potential pre-routing-header
11722 	 * destination options header, and a potential routing header.
11723 	 */
11724 	nexthdr = ip6h->ip6_nxt;
11725 	prev_nexthdr_offset = (uint8_t *)&ip6h->ip6_nxt - (uint8_t *)ip6h;
11726 	ptr = (uint8_t *)&ip6h[1];
11727 
11728 	if (nexthdr == IPPROTO_HOPOPTS) {
11729 		ip6_hbh_t	*hbh_hdr;
11730 		uint_t		hdr_len;
11731 
11732 		hbh_hdr = (ip6_hbh_t *)ptr;
11733 		hdr_len = 8 * (hbh_hdr->ip6h_len + 1);
11734 		nexthdr = hbh_hdr->ip6h_nxt;
11735 		prev_nexthdr_offset = (uint8_t *)&hbh_hdr->ip6h_nxt
11736 		    - (uint8_t *)ip6h;
11737 		ptr += hdr_len;
11738 	}
11739 	if (nexthdr == IPPROTO_DSTOPTS) {
11740 		ip6_dest_t	*dest_hdr;
11741 		uint_t		hdr_len;
11742 
11743 		dest_hdr = (ip6_dest_t *)ptr;
11744 		if (dest_hdr->ip6d_nxt == IPPROTO_ROUTING) {
11745 			hdr_len = 8 * (dest_hdr->ip6d_len + 1);
11746 			nexthdr = dest_hdr->ip6d_nxt;
11747 			prev_nexthdr_offset = (uint8_t *)&dest_hdr->ip6d_nxt
11748 			    - (uint8_t *)ip6h;
11749 			ptr += hdr_len;
11750 		}
11751 	}
11752 	if (nexthdr == IPPROTO_ROUTING) {
11753 		ip6_rthdr_t	*rthdr;
11754 		uint_t		hdr_len;
11755 
11756 		rthdr = (ip6_rthdr_t *)ptr;
11757 		nexthdr = rthdr->ip6r_nxt;
11758 		prev_nexthdr_offset = (uint8_t *)&rthdr->ip6r_nxt
11759 		    - (uint8_t *)ip6h;
11760 		hdr_len = 8 * (rthdr->ip6r_len + 1);
11761 		ptr += hdr_len;
11762 	}
11763 	unfragmentable_len = (uint_t)(ptr - (uint8_t *)ip6h);
11764 
11765 	max_chunk = (min(max_frag, ire->ire_max_frag) - unfragmentable_len -
11766 	    sizeof (ip6_frag_t)) & ~7;
11767 
11768 	/* Check if we can use MDT to send out the frags. */
11769 	ASSERT(!IRE_IS_LOCAL(ire));
11770 	if (ipst->ips_ip_multidata_outbound && reachable == 0 &&
11771 	    !(ire->ire_flags & RTF_MULTIRT) && ILL_MDT_CAPABLE(ill) &&
11772 	    IP_CAN_FRAG_MDT(mp, unfragmentable_len, max_chunk)) {
11773 		ip_wput_frag_mdt_v6(mp, ire, max_chunk, unfragmentable_len,
11774 		    nexthdr, prev_nexthdr_offset);
11775 		return;
11776 	}
11777 
11778 	/*
11779 	 * Allocate an mblk with enough room for the link-layer
11780 	 * header, the unfragmentable part of the datagram, and the
11781 	 * fragment header.  This (or a copy) will be used as the
11782 	 * first mblk for each fragment we send.
11783 	 */
11784 	hmp = allocb(unfragmentable_len + sizeof (ip6_frag_t) +
11785 	    ipst->ips_ip_wroff_extra, BPRI_HI);
11786 	if (hmp == NULL) {
11787 		BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutFragFails);
11788 		freemsg(mp);
11789 		return;
11790 	}
11791 	hmp->b_rptr += ipst->ips_ip_wroff_extra;
11792 	hmp->b_wptr = hmp->b_rptr + unfragmentable_len + sizeof (ip6_frag_t);
11793 
11794 	fip6h = (ip6_t *)hmp->b_rptr;
11795 	fraghdr = (ip6_frag_t *)(hmp->b_rptr + unfragmentable_len);
11796 
11797 	bcopy(ip6h, fip6h, unfragmentable_len);
11798 	hmp->b_rptr[prev_nexthdr_offset] = IPPROTO_FRAGMENT;
11799 
11800 	ident = atomic_add_32_nv(&ire->ire_ident, 1);
11801 
11802 	fraghdr->ip6f_nxt = nexthdr;
11803 	fraghdr->ip6f_reserved = 0;
11804 	fraghdr->ip6f_offlg = 0;
11805 	fraghdr->ip6f_ident = htonl(ident);
11806 
11807 	/*
11808 	 * len is the total length of the fragmentable data in this
11809 	 * datagram.  For each fragment sent, we will decrement len
11810 	 * by the amount of fragmentable data sent in that fragment
11811 	 * until len reaches zero.
11812 	 */
11813 	len = ntohs(ip6h->ip6_plen) - (unfragmentable_len - IPV6_HDR_LEN);
11814 
11815 	/*
11816 	 * Move read ptr past unfragmentable portion, we don't want this part
11817 	 * of the data in our fragments.
11818 	 */
11819 	mp->b_rptr += unfragmentable_len;
11820 
11821 	while (len != 0) {
11822 		mlen = MIN(len, max_chunk);
11823 		len -= mlen;
11824 		if (len != 0) {
11825 			/* Not last */
11826 			hmp0 = copyb(hmp);
11827 			if (hmp0 == NULL) {
11828 				freeb(hmp);
11829 				freemsg(mp);
11830 				BUMP_MIB(ill->ill_ip_mib,
11831 				    ipIfStatsOutFragFails);
11832 				ip1dbg(("ip_wput_frag_v6: copyb failed\n"));
11833 				return;
11834 			}
11835 			off_flags = IP6F_MORE_FRAG;
11836 		} else {
11837 			/* Last fragment */
11838 			hmp0 = hmp;
11839 			hmp = NULL;
11840 			off_flags = 0;
11841 		}
11842 		fip6h = (ip6_t *)(hmp0->b_rptr);
11843 		fraghdr = (ip6_frag_t *)(hmp0->b_rptr + unfragmentable_len);
11844 
11845 		fip6h->ip6_plen = htons((uint16_t)(mlen +
11846 		    unfragmentable_len - IPV6_HDR_LEN + sizeof (ip6_frag_t)));
11847 		/*
11848 		 * Note: Optimization alert.
11849 		 * In IPv6 (and IPv4) protocol header, Fragment Offset
11850 		 * ("offset") is 13 bits wide and in 8-octet units.
11851 		 * In IPv6 protocol header (unlike IPv4) in a 16 bit field,
11852 		 * it occupies the most significant 13 bits.
11853 		 * (least significant 13 bits in IPv4).
11854 		 * We do not do any shifts here. Not shifting is same effect
11855 		 * as taking offset value in octet units, dividing by 8 and
11856 		 * then shifting 3 bits left to line it up in place in proper
11857 		 * place protocol header.
11858 		 */
11859 		fraghdr->ip6f_offlg = htons(offset) | off_flags;
11860 
11861 		if (!(dmp = ip_carve_mp(&mp, mlen))) {
11862 			/* mp has already been freed by ip_carve_mp() */
11863 			if (hmp != NULL)
11864 				freeb(hmp);
11865 			freeb(hmp0);
11866 			ip1dbg(("ip_carve_mp: failed\n"));
11867 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutFragFails);
11868 			return;
11869 		}
11870 		hmp0->b_cont = dmp;
11871 		/* Get the priority marking, if any */
11872 		hmp0->b_band = dmp->b_band;
11873 		UPDATE_OB_PKT_COUNT(ire);
11874 		ire->ire_last_used_time = lbolt;
11875 		ip_xmit_v6(hmp0, ire, reachable | IP6_NO_IPPOLICY, connp,
11876 		    caller, NULL);
11877 		reachable = 0;	/* No need to redo state machine in loop */
11878 		BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutFragCreates);
11879 		offset += mlen;
11880 	}
11881 	BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutFragOKs);
11882 }
11883 
11884 /*
11885  * Determine if the ill and multicast aspects of that packets
11886  * "matches" the conn.
11887  */
11888 boolean_t
11889 conn_wantpacket_v6(conn_t *connp, ill_t *ill, ip6_t *ip6h, int fanout_flags,
11890     zoneid_t zoneid)
11891 {
11892 	ill_t *in_ill;
11893 	boolean_t wantpacket = B_TRUE;
11894 	in6_addr_t *v6dst_ptr = &ip6h->ip6_dst;
11895 	in6_addr_t *v6src_ptr = &ip6h->ip6_src;
11896 
11897 	/*
11898 	 * conn_incoming_ill is set by IPV6_BOUND_IF which limits
11899 	 * unicast and multicast reception to conn_incoming_ill.
11900 	 * conn_wantpacket_v6 is called both for unicast and
11901 	 * multicast.
11902 	 *
11903 	 * 1) The unicast copy of the packet can come anywhere in
11904 	 *    the ill group if it is part of the group. Thus, we
11905 	 *    need to check to see whether the ill group matches
11906 	 *    if in_ill is part of a group.
11907 	 *
11908 	 * 2) ip_rput does not suppress duplicate multicast packets.
11909 	 *    If there are two interfaces in a ill group and we have
11910 	 *    2 applications (conns) joined a multicast group G on
11911 	 *    both the interfaces, ilm_lookup_ill filter in ip_rput
11912 	 *    will give us two packets because we join G on both the
11913 	 *    interfaces rather than nominating just one interface
11914 	 *    for receiving multicast like broadcast above. So,
11915 	 *    we have to call ilg_lookup_ill to filter out duplicate
11916 	 *    copies, if ill is part of a group, to supress duplicates.
11917 	 */
11918 	in_ill = connp->conn_incoming_ill;
11919 	if (in_ill != NULL) {
11920 		mutex_enter(&connp->conn_lock);
11921 		in_ill = connp->conn_incoming_ill;
11922 		mutex_enter(&ill->ill_lock);
11923 		/*
11924 		 * No IPMP, and the packet did not arrive on conn_incoming_ill
11925 		 * OR, IPMP in use and the packet arrived on an IPMP group
11926 		 * different from the conn_incoming_ill's IPMP group.
11927 		 * Reject the packet.
11928 		 */
11929 		if ((in_ill->ill_group == NULL && in_ill != ill) ||
11930 		    (in_ill->ill_group != NULL &&
11931 		    in_ill->ill_group !=  ill->ill_group)) {
11932 			wantpacket = B_FALSE;
11933 		}
11934 		mutex_exit(&ill->ill_lock);
11935 		mutex_exit(&connp->conn_lock);
11936 		if (!wantpacket)
11937 			return (B_FALSE);
11938 	}
11939 
11940 	if (connp->conn_multi_router)
11941 		return (B_TRUE);
11942 
11943 	if (!IN6_IS_ADDR_MULTICAST(v6dst_ptr) &&
11944 	    !IN6_IS_ADDR_V4MAPPED_CLASSD(v6dst_ptr)) {
11945 		/*
11946 		 * Unicast case: we match the conn only if it's in the specified
11947 		 * zone.
11948 		 */
11949 		return (IPCL_ZONE_MATCH(connp, zoneid));
11950 	}
11951 
11952 	if ((fanout_flags & IP_FF_NO_MCAST_LOOP) &&
11953 	    (connp->conn_zoneid == zoneid || zoneid == ALL_ZONES)) {
11954 		/*
11955 		 * Loopback case: the sending endpoint has IP_MULTICAST_LOOP
11956 		 * disabled, therefore we don't dispatch the multicast packet to
11957 		 * the sending zone.
11958 		 */
11959 		return (B_FALSE);
11960 	}
11961 
11962 	if (IS_LOOPBACK(ill) && connp->conn_zoneid != zoneid &&
11963 	    zoneid != ALL_ZONES) {
11964 		/*
11965 		 * Multicast packet on the loopback interface: we only match
11966 		 * conns who joined the group in the specified zone.
11967 		 */
11968 		return (B_FALSE);
11969 	}
11970 
11971 	mutex_enter(&connp->conn_lock);
11972 	wantpacket =
11973 	    ilg_lookup_ill_withsrc_v6(connp, v6dst_ptr, v6src_ptr, ill) != NULL;
11974 	mutex_exit(&connp->conn_lock);
11975 
11976 	return (wantpacket);
11977 }
11978 
11979 
11980 /*
11981  * Transmit a packet and update any NUD state based on the flags
11982  * XXX need to "recover" any ip6i_t when doing putq!
11983  *
11984  * NOTE : This function does not ire_refrele the ire passed in as the
11985  * argument.
11986  */
11987 void
11988 ip_xmit_v6(mblk_t *mp, ire_t *ire, uint_t flags, conn_t *connp,
11989     int caller, ipsec_out_t *io)
11990 {
11991 	mblk_t		*mp1;
11992 	nce_t		*nce = ire->ire_nce;
11993 	ill_t		*ill;
11994 	ill_t		*out_ill;
11995 	uint64_t	delta;
11996 	ip6_t		*ip6h;
11997 	queue_t		*stq = ire->ire_stq;
11998 	ire_t		*ire1 = NULL;
11999 	ire_t		*save_ire = ire;
12000 	boolean_t	multirt_send = B_FALSE;
12001 	mblk_t		*next_mp = NULL;
12002 	ip_stack_t	*ipst = ire->ire_ipst;
12003 
12004 	ip6h = (ip6_t *)mp->b_rptr;
12005 	ASSERT(!IN6_IS_ADDR_V4MAPPED(&ire->ire_addr_v6));
12006 	ASSERT(ire->ire_ipversion == IPV6_VERSION);
12007 	ASSERT(nce != NULL);
12008 	ASSERT(mp->b_datap->db_type == M_DATA);
12009 	ASSERT(stq != NULL);
12010 
12011 	ill = ire_to_ill(ire);
12012 	if (!ill) {
12013 		ip0dbg(("ip_xmit_v6: ire_to_ill failed\n"));
12014 		freemsg(mp);
12015 		return;
12016 	}
12017 
12018 	/*
12019 	 * If a packet is to be sent out an interface that is a 6to4
12020 	 * tunnel, outgoing IPv6 packets, with a 6to4 addressed IPv6
12021 	 * destination, must be checked to have a 6to4 prefix
12022 	 * (2002:V4ADDR::/48) that is NOT equal to the 6to4 prefix of
12023 	 * address configured on the sending interface.  Otherwise,
12024 	 * the packet was delivered to this interface in error and the
12025 	 * packet must be dropped.
12026 	 */
12027 	if ((ill->ill_is_6to4tun) && IN6_IS_ADDR_6TO4(&ip6h->ip6_dst)) {
12028 		ipif_t *ipif = ill->ill_ipif;
12029 
12030 		if (IN6_ARE_6TO4_PREFIX_EQUAL(&ipif->ipif_v6lcl_addr,
12031 		    &ip6h->ip6_dst)) {
12032 			if (ip_debug > 2) {
12033 				/* ip1dbg */
12034 				pr_addr_dbg("ip_xmit_v6: attempting to "
12035 				    "send 6to4 addressed IPv6 "
12036 				    "destination (%s) out the wrong "
12037 				    "interface.\n", AF_INET6,
12038 				    &ip6h->ip6_dst);
12039 			}
12040 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
12041 			freemsg(mp);
12042 			return;
12043 		}
12044 	}
12045 
12046 	/* Flow-control check has been done in ip_wput_ire_v6 */
12047 	if (IP_FLOW_CONTROLLED_ULP(ip6h->ip6_nxt) || caller == IP_WPUT ||
12048 	    caller == IP_WSRV || canput(stq->q_next)) {
12049 		uint32_t ill_index;
12050 
12051 		/*
12052 		 * In most cases, the emission loop below is entered only
12053 		 * once. Only in the case where the ire holds the
12054 		 * RTF_MULTIRT flag, do we loop to process all RTF_MULTIRT
12055 		 * flagged ires in the bucket, and send the packet
12056 		 * through all crossed RTF_MULTIRT routes.
12057 		 */
12058 		if (ire->ire_flags & RTF_MULTIRT) {
12059 			/*
12060 			 * Multirouting case. The bucket where ire is stored
12061 			 * probably holds other RTF_MULTIRT flagged ires
12062 			 * to the destination. In this call to ip_xmit_v6,
12063 			 * we attempt to send the packet through all
12064 			 * those ires. Thus, we first ensure that ire is the
12065 			 * first RTF_MULTIRT ire in the bucket,
12066 			 * before walking the ire list.
12067 			 */
12068 			ire_t *first_ire;
12069 			irb_t *irb = ire->ire_bucket;
12070 			ASSERT(irb != NULL);
12071 			multirt_send = B_TRUE;
12072 
12073 			/* Make sure we do not omit any multiroute ire. */
12074 			IRB_REFHOLD(irb);
12075 			for (first_ire = irb->irb_ire;
12076 			    first_ire != NULL;
12077 			    first_ire = first_ire->ire_next) {
12078 				if ((first_ire->ire_flags & RTF_MULTIRT) &&
12079 				    (IN6_ARE_ADDR_EQUAL(&first_ire->ire_addr_v6,
12080 				    &ire->ire_addr_v6)) &&
12081 				    !(first_ire->ire_marks &
12082 				    (IRE_MARK_CONDEMNED | IRE_MARK_HIDDEN)))
12083 					break;
12084 			}
12085 
12086 			if ((first_ire != NULL) && (first_ire != ire)) {
12087 				IRE_REFHOLD(first_ire);
12088 				/* ire will be released by the caller */
12089 				ire = first_ire;
12090 				nce = ire->ire_nce;
12091 				stq = ire->ire_stq;
12092 				ill = ire_to_ill(ire);
12093 			}
12094 			IRB_REFRELE(irb);
12095 		} else if (connp != NULL && IPCL_IS_TCP(connp) &&
12096 		    connp->conn_mdt_ok && !connp->conn_tcp->tcp_mdt &&
12097 		    ILL_MDT_USABLE(ill)) {
12098 			/*
12099 			 * This tcp connection was marked as MDT-capable, but
12100 			 * it has been turned off due changes in the interface.
12101 			 * Now that the interface support is back, turn it on
12102 			 * by notifying tcp.  We don't directly modify tcp_mdt,
12103 			 * since we leave all the details to the tcp code that
12104 			 * knows better.
12105 			 */
12106 			mblk_t *mdimp = ip_mdinfo_alloc(ill->ill_mdt_capab);
12107 
12108 			if (mdimp == NULL) {
12109 				ip0dbg(("ip_xmit_v6: can't re-enable MDT for "
12110 				    "connp %p (ENOMEM)\n", (void *)connp));
12111 			} else {
12112 				CONN_INC_REF(connp);
12113 				squeue_fill(connp->conn_sqp, mdimp, tcp_input,
12114 				    connp, SQTAG_TCP_INPUT_MCTL);
12115 			}
12116 		}
12117 
12118 		do {
12119 			mblk_t *mp_ip6h;
12120 
12121 			if (multirt_send) {
12122 				irb_t *irb;
12123 				/*
12124 				 * We are in a multiple send case, need to get
12125 				 * the next ire and make a duplicate of the
12126 				 * packet. ire1 holds here the next ire to
12127 				 * process in the bucket. If multirouting is
12128 				 * expected, any non-RTF_MULTIRT ire that has
12129 				 * the right destination address is ignored.
12130 				 */
12131 				irb = ire->ire_bucket;
12132 				ASSERT(irb != NULL);
12133 
12134 				IRB_REFHOLD(irb);
12135 				for (ire1 = ire->ire_next;
12136 				    ire1 != NULL;
12137 				    ire1 = ire1->ire_next) {
12138 					if (!(ire1->ire_flags & RTF_MULTIRT))
12139 						continue;
12140 					if (!IN6_ARE_ADDR_EQUAL(
12141 					    &ire1->ire_addr_v6,
12142 					    &ire->ire_addr_v6))
12143 						continue;
12144 					if (ire1->ire_marks &
12145 					    (IRE_MARK_CONDEMNED|
12146 					    IRE_MARK_HIDDEN))
12147 						continue;
12148 
12149 					/* Got one */
12150 					if (ire1 != save_ire) {
12151 						IRE_REFHOLD(ire1);
12152 					}
12153 					break;
12154 				}
12155 				IRB_REFRELE(irb);
12156 
12157 				if (ire1 != NULL) {
12158 					next_mp = copyb(mp);
12159 					if ((next_mp == NULL) ||
12160 					    ((mp->b_cont != NULL) &&
12161 					    ((next_mp->b_cont =
12162 					    dupmsg(mp->b_cont)) == NULL))) {
12163 						freemsg(next_mp);
12164 						next_mp = NULL;
12165 						ire_refrele(ire1);
12166 						ire1 = NULL;
12167 					}
12168 				}
12169 
12170 				/* Last multiroute ire; don't loop anymore. */
12171 				if (ire1 == NULL) {
12172 					multirt_send = B_FALSE;
12173 				}
12174 			}
12175 
12176 			ill_index =
12177 			    ((ill_t *)stq->q_ptr)->ill_phyint->phyint_ifindex;
12178 
12179 			/* Initiate IPPF processing */
12180 			if (IP6_OUT_IPP(flags, ipst)) {
12181 				ip_process(IPP_LOCAL_OUT, &mp, ill_index);
12182 				if (mp == NULL) {
12183 					BUMP_MIB(ill->ill_ip_mib,
12184 					    ipIfStatsOutDiscards);
12185 					if (next_mp != NULL)
12186 						freemsg(next_mp);
12187 					if (ire != save_ire) {
12188 						ire_refrele(ire);
12189 					}
12190 					return;
12191 				}
12192 				ip6h = (ip6_t *)mp->b_rptr;
12193 			}
12194 			mp_ip6h = mp;
12195 
12196 			/*
12197 			 * Check for fastpath, we need to hold nce_lock to
12198 			 * prevent fastpath update from chaining nce_fp_mp.
12199 			 */
12200 
12201 			ASSERT(nce->nce_ipversion != IPV4_VERSION);
12202 			mutex_enter(&nce->nce_lock);
12203 			if ((mp1 = nce->nce_fp_mp) != NULL) {
12204 				uint32_t hlen;
12205 				uchar_t	*rptr;
12206 
12207 				hlen = MBLKL(mp1);
12208 				rptr = mp->b_rptr - hlen;
12209 				/*
12210 				 * make sure there is room for the fastpath
12211 				 * datalink header
12212 				 */
12213 				if (rptr < mp->b_datap->db_base) {
12214 					mp1 = copyb(mp1);
12215 					mutex_exit(&nce->nce_lock);
12216 					if (mp1 == NULL) {
12217 						BUMP_MIB(ill->ill_ip_mib,
12218 						    ipIfStatsOutDiscards);
12219 						freemsg(mp);
12220 						if (next_mp != NULL)
12221 							freemsg(next_mp);
12222 						if (ire != save_ire) {
12223 							ire_refrele(ire);
12224 						}
12225 						return;
12226 					}
12227 					mp1->b_cont = mp;
12228 
12229 					/* Get the priority marking, if any */
12230 					mp1->b_band = mp->b_band;
12231 					mp = mp1;
12232 				} else {
12233 					mp->b_rptr = rptr;
12234 					/*
12235 					 * fastpath -  pre-pend datalink
12236 					 * header
12237 					 */
12238 					bcopy(mp1->b_rptr, rptr, hlen);
12239 					mutex_exit(&nce->nce_lock);
12240 				}
12241 			} else {
12242 				/*
12243 				 * Get the DL_UNITDATA_REQ.
12244 				 */
12245 				mp1 = nce->nce_res_mp;
12246 				if (mp1 == NULL) {
12247 					mutex_exit(&nce->nce_lock);
12248 					ip1dbg(("ip_xmit_v6: No resolution "
12249 					    "block ire = %p\n", (void *)ire));
12250 					freemsg(mp);
12251 					if (next_mp != NULL)
12252 						freemsg(next_mp);
12253 					if (ire != save_ire) {
12254 						ire_refrele(ire);
12255 					}
12256 					return;
12257 				}
12258 				/*
12259 				 * Prepend the DL_UNITDATA_REQ.
12260 				 */
12261 				mp1 = copyb(mp1);
12262 				mutex_exit(&nce->nce_lock);
12263 				if (mp1 == NULL) {
12264 					BUMP_MIB(ill->ill_ip_mib,
12265 					    ipIfStatsOutDiscards);
12266 					freemsg(mp);
12267 					if (next_mp != NULL)
12268 						freemsg(next_mp);
12269 					if (ire != save_ire) {
12270 						ire_refrele(ire);
12271 					}
12272 					return;
12273 				}
12274 				mp1->b_cont = mp;
12275 
12276 				/* Get the priority marking, if any */
12277 				mp1->b_band = mp->b_band;
12278 				mp = mp1;
12279 			}
12280 
12281 			out_ill = (ill_t *)stq->q_ptr;
12282 
12283 			DTRACE_PROBE4(ip6__physical__out__start,
12284 			    ill_t *, NULL, ill_t *, out_ill,
12285 			    ip6_t *, ip6h, mblk_t *, mp);
12286 
12287 			FW_HOOKS6(ipst->ips_ip6_physical_out_event,
12288 			    ipst->ips_ipv6firewall_physical_out,
12289 			    NULL, out_ill, ip6h, mp, mp_ip6h, 0, ipst);
12290 
12291 			DTRACE_PROBE1(ip6__physical__out__end, mblk_t *, mp);
12292 
12293 			if (mp == NULL) {
12294 				if (multirt_send) {
12295 					ASSERT(ire1 != NULL);
12296 					if (ire != save_ire) {
12297 						ire_refrele(ire);
12298 					}
12299 					/*
12300 					 * Proceed with the next RTF_MULTIRT
12301 					 * ire, also set up the send-to queue
12302 					 * accordingly.
12303 					 */
12304 					ire = ire1;
12305 					ire1 = NULL;
12306 					stq = ire->ire_stq;
12307 					nce = ire->ire_nce;
12308 					ill = ire_to_ill(ire);
12309 					mp = next_mp;
12310 					next_mp = NULL;
12311 					continue;
12312 				} else {
12313 					ASSERT(next_mp == NULL);
12314 					ASSERT(ire1 == NULL);
12315 					break;
12316 				}
12317 			}
12318 
12319 			/*
12320 			 * Update ire and MIB counters; for save_ire, this has
12321 			 * been done by the caller.
12322 			 */
12323 			if (ire != save_ire) {
12324 				UPDATE_OB_PKT_COUNT(ire);
12325 				ire->ire_last_used_time = lbolt;
12326 
12327 				if (IN6_IS_ADDR_MULTICAST(&ip6h->ip6_dst)) {
12328 					BUMP_MIB(ill->ill_ip_mib,
12329 					    ipIfStatsHCOutMcastPkts);
12330 					UPDATE_MIB(ill->ill_ip_mib,
12331 					    ipIfStatsHCOutMcastOctets,
12332 					    ntohs(ip6h->ip6_plen) +
12333 					    IPV6_HDR_LEN);
12334 				}
12335 			}
12336 
12337 			/*
12338 			 * Send it down.  XXX Do we want to flow control AH/ESP
12339 			 * packets that carry TCP payloads?  We don't flow
12340 			 * control TCP packets, but we should also not
12341 			 * flow-control TCP packets that have been protected.
12342 			 * We don't have an easy way to find out if an AH/ESP
12343 			 * packet was originally TCP or not currently.
12344 			 */
12345 			if (io == NULL) {
12346 				BUMP_MIB(ill->ill_ip_mib,
12347 				    ipIfStatsHCOutTransmits);
12348 				UPDATE_MIB(ill->ill_ip_mib,
12349 				    ipIfStatsHCOutOctets,
12350 				    ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN);
12351 				DTRACE_IP7(send, mblk_t *, mp, conn_t *, NULL,
12352 				    void_ip_t *, ip6h, __dtrace_ipsr_ill_t *,
12353 				    out_ill, ipha_t *, NULL, ip6_t *, ip6h,
12354 				    int, 0);
12355 
12356 				putnext(stq, mp);
12357 			} else {
12358 				/*
12359 				 * Safety Pup says: make sure this is
12360 				 * going to the right interface!
12361 				 */
12362 				if (io->ipsec_out_capab_ill_index !=
12363 				    ill_index) {
12364 					/* IPsec kstats: bump lose counter */
12365 					freemsg(mp1);
12366 				} else {
12367 					BUMP_MIB(ill->ill_ip_mib,
12368 					    ipIfStatsHCOutTransmits);
12369 					UPDATE_MIB(ill->ill_ip_mib,
12370 					    ipIfStatsHCOutOctets,
12371 					    ntohs(ip6h->ip6_plen) +
12372 					    IPV6_HDR_LEN);
12373 					DTRACE_IP7(send, mblk_t *, mp,
12374 					    conn_t *, NULL, void_ip_t *, ip6h,
12375 					    __dtrace_ipsr_ill_t *, out_ill,
12376 					    ipha_t *, NULL, ip6_t *, ip6h, int,
12377 					    0);
12378 					ipsec_hw_putnext(stq, mp);
12379 				}
12380 			}
12381 
12382 			if (nce->nce_flags & (NCE_F_NONUD|NCE_F_PERMANENT)) {
12383 				if (ire != save_ire) {
12384 					ire_refrele(ire);
12385 				}
12386 				if (multirt_send) {
12387 					ASSERT(ire1 != NULL);
12388 					/*
12389 					 * Proceed with the next RTF_MULTIRT
12390 					 * ire, also set up the send-to queue
12391 					 * accordingly.
12392 					 */
12393 					ire = ire1;
12394 					ire1 = NULL;
12395 					stq = ire->ire_stq;
12396 					nce = ire->ire_nce;
12397 					ill = ire_to_ill(ire);
12398 					mp = next_mp;
12399 					next_mp = NULL;
12400 					continue;
12401 				}
12402 				ASSERT(next_mp == NULL);
12403 				ASSERT(ire1 == NULL);
12404 				return;
12405 			}
12406 
12407 			ASSERT(nce->nce_state != ND_INCOMPLETE);
12408 
12409 			/*
12410 			 * Check for upper layer advice
12411 			 */
12412 			if (flags & IPV6_REACHABILITY_CONFIRMATION) {
12413 				/*
12414 				 * It should be o.k. to check the state without
12415 				 * a lock here, at most we lose an advice.
12416 				 */
12417 				nce->nce_last = TICK_TO_MSEC(lbolt64);
12418 				if (nce->nce_state != ND_REACHABLE) {
12419 
12420 					mutex_enter(&nce->nce_lock);
12421 					nce->nce_state = ND_REACHABLE;
12422 					nce->nce_pcnt = ND_MAX_UNICAST_SOLICIT;
12423 					mutex_exit(&nce->nce_lock);
12424 					(void) untimeout(nce->nce_timeout_id);
12425 					if (ip_debug > 2) {
12426 						/* ip1dbg */
12427 						pr_addr_dbg("ip_xmit_v6: state"
12428 						    " for %s changed to"
12429 						    " REACHABLE\n", AF_INET6,
12430 						    &ire->ire_addr_v6);
12431 					}
12432 				}
12433 				if (ire != save_ire) {
12434 					ire_refrele(ire);
12435 				}
12436 				if (multirt_send) {
12437 					ASSERT(ire1 != NULL);
12438 					/*
12439 					 * Proceed with the next RTF_MULTIRT
12440 					 * ire, also set up the send-to queue
12441 					 * accordingly.
12442 					 */
12443 					ire = ire1;
12444 					ire1 = NULL;
12445 					stq = ire->ire_stq;
12446 					nce = ire->ire_nce;
12447 					ill = ire_to_ill(ire);
12448 					mp = next_mp;
12449 					next_mp = NULL;
12450 					continue;
12451 				}
12452 				ASSERT(next_mp == NULL);
12453 				ASSERT(ire1 == NULL);
12454 				return;
12455 			}
12456 
12457 			delta =  TICK_TO_MSEC(lbolt64) - nce->nce_last;
12458 			ip1dbg(("ip_xmit_v6: delta = %" PRId64
12459 			    " ill_reachable_time = %d \n", delta,
12460 			    ill->ill_reachable_time));
12461 			if (delta > (uint64_t)ill->ill_reachable_time) {
12462 				nce = ire->ire_nce;
12463 				mutex_enter(&nce->nce_lock);
12464 				switch (nce->nce_state) {
12465 				case ND_REACHABLE:
12466 				case ND_STALE:
12467 					/*
12468 					 * ND_REACHABLE is identical to
12469 					 * ND_STALE in this specific case. If
12470 					 * reachable time has expired for this
12471 					 * neighbor (delta is greater than
12472 					 * reachable time), conceptually, the
12473 					 * neighbor cache is no longer in
12474 					 * REACHABLE state, but already in
12475 					 * STALE state.  So the correct
12476 					 * transition here is to ND_DELAY.
12477 					 */
12478 					nce->nce_state = ND_DELAY;
12479 					mutex_exit(&nce->nce_lock);
12480 					NDP_RESTART_TIMER(nce,
12481 					    ipst->ips_delay_first_probe_time);
12482 					if (ip_debug > 3) {
12483 						/* ip2dbg */
12484 						pr_addr_dbg("ip_xmit_v6: state"
12485 						    " for %s changed to"
12486 						    " DELAY\n", AF_INET6,
12487 						    &ire->ire_addr_v6);
12488 					}
12489 					break;
12490 				case ND_DELAY:
12491 				case ND_PROBE:
12492 					mutex_exit(&nce->nce_lock);
12493 					/* Timers have already started */
12494 					break;
12495 				case ND_UNREACHABLE:
12496 					/*
12497 					 * ndp timer has detected that this nce
12498 					 * is unreachable and initiated deleting
12499 					 * this nce and all its associated IREs.
12500 					 * This is a race where we found the
12501 					 * ire before it was deleted and have
12502 					 * just sent out a packet using this
12503 					 * unreachable nce.
12504 					 */
12505 					mutex_exit(&nce->nce_lock);
12506 					break;
12507 				default:
12508 					ASSERT(0);
12509 				}
12510 			}
12511 
12512 			if (multirt_send) {
12513 				ASSERT(ire1 != NULL);
12514 				/*
12515 				 * Proceed with the next RTF_MULTIRT ire,
12516 				 * Also set up the send-to queue accordingly.
12517 				 */
12518 				if (ire != save_ire) {
12519 					ire_refrele(ire);
12520 				}
12521 				ire = ire1;
12522 				ire1 = NULL;
12523 				stq = ire->ire_stq;
12524 				nce = ire->ire_nce;
12525 				ill = ire_to_ill(ire);
12526 				mp = next_mp;
12527 				next_mp = NULL;
12528 			}
12529 		} while (multirt_send);
12530 		/*
12531 		 * In the multirouting case, release the last ire used for
12532 		 * emission. save_ire will be released by the caller.
12533 		 */
12534 		if (ire != save_ire) {
12535 			ire_refrele(ire);
12536 		}
12537 	} else {
12538 		/*
12539 		 * Queue packet if we have an conn to give back pressure.
12540 		 * We can't queue packets intended for hardware acceleration
12541 		 * since we've tossed that state already. If the packet is
12542 		 * being fed back from ire_send_v6, we don't know the
12543 		 * position in the queue to enqueue the packet and we discard
12544 		 * the packet.
12545 		 */
12546 		if (ipst->ips_ip_output_queue && (connp != NULL) &&
12547 		    (io == NULL) && (caller != IRE_SEND)) {
12548 			if (caller == IP_WSRV) {
12549 				connp->conn_did_putbq = 1;
12550 				(void) putbq(connp->conn_wq, mp);
12551 				conn_drain_insert(connp);
12552 				/*
12553 				 * caller == IP_WSRV implies we are
12554 				 * the service thread, and the
12555 				 * queue is already noenabled.
12556 				 * The check for canput and
12557 				 * the putbq is not atomic.
12558 				 * So we need to check again.
12559 				 */
12560 				if (canput(stq->q_next))
12561 					connp->conn_did_putbq = 0;
12562 			} else {
12563 				(void) putq(connp->conn_wq, mp);
12564 			}
12565 			return;
12566 		}
12567 		BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
12568 		freemsg(mp);
12569 		return;
12570 	}
12571 }
12572 
12573 /*
12574  * pr_addr_dbg function provides the needed buffer space to call
12575  * inet_ntop() function's 3rd argument. This function should be
12576  * used by any kernel routine which wants to save INET6_ADDRSTRLEN
12577  * stack buffer space in it's own stack frame. This function uses
12578  * a buffer from it's own stack and prints the information.
12579  * Example: pr_addr_dbg("func: no route for %s\n ", AF_INET, addr)
12580  *
12581  * Note:    This function can call inet_ntop() once.
12582  */
12583 void
12584 pr_addr_dbg(char *fmt1, int af, const void *addr)
12585 {
12586 	char	buf[INET6_ADDRSTRLEN];
12587 
12588 	if (fmt1 == NULL) {
12589 		ip0dbg(("pr_addr_dbg: Wrong arguments\n"));
12590 		return;
12591 	}
12592 
12593 	/*
12594 	 * This does not compare debug level and just prints
12595 	 * out. Thus it is the responsibility of the caller
12596 	 * to check the appropriate debug-level before calling
12597 	 * this function.
12598 	 */
12599 	if (ip_debug > 0) {
12600 		printf(fmt1, inet_ntop(af, addr, buf, sizeof (buf)));
12601 	}
12602 
12603 
12604 }
12605 
12606 
12607 /*
12608  * Return the length in bytes of the IPv6 headers (base header, ip6i_t
12609  * if needed and extension headers) that will be needed based on the
12610  * ip6_pkt_t structure passed by the caller.
12611  *
12612  * The returned length does not include the length of the upper level
12613  * protocol (ULP) header.
12614  */
12615 int
12616 ip_total_hdrs_len_v6(ip6_pkt_t *ipp)
12617 {
12618 	int len;
12619 
12620 	len = IPV6_HDR_LEN;
12621 	if (ipp->ipp_fields & IPPF_HAS_IP6I)
12622 		len += sizeof (ip6i_t);
12623 	if (ipp->ipp_fields & IPPF_HOPOPTS) {
12624 		ASSERT(ipp->ipp_hopoptslen != 0);
12625 		len += ipp->ipp_hopoptslen;
12626 	}
12627 	if (ipp->ipp_fields & IPPF_RTHDR) {
12628 		ASSERT(ipp->ipp_rthdrlen != 0);
12629 		len += ipp->ipp_rthdrlen;
12630 	}
12631 	/*
12632 	 * En-route destination options
12633 	 * Only do them if there's a routing header as well
12634 	 */
12635 	if ((ipp->ipp_fields & (IPPF_RTDSTOPTS|IPPF_RTHDR)) ==
12636 	    (IPPF_RTDSTOPTS|IPPF_RTHDR)) {
12637 		ASSERT(ipp->ipp_rtdstoptslen != 0);
12638 		len += ipp->ipp_rtdstoptslen;
12639 	}
12640 	if (ipp->ipp_fields & IPPF_DSTOPTS) {
12641 		ASSERT(ipp->ipp_dstoptslen != 0);
12642 		len += ipp->ipp_dstoptslen;
12643 	}
12644 	return (len);
12645 }
12646 
12647 /*
12648  * All-purpose routine to build a header chain of an IPv6 header
12649  * followed by any required extension headers and a proto header,
12650  * preceeded (where necessary) by an ip6i_t private header.
12651  *
12652  * The fields of the IPv6 header that are derived from the ip6_pkt_t
12653  * will be filled in appropriately.
12654  * Thus the caller must fill in the rest of the IPv6 header, such as
12655  * traffic class/flowid, source address (if not set here), hoplimit (if not
12656  * set here) and destination address.
12657  *
12658  * The extension headers and ip6i_t header will all be fully filled in.
12659  */
12660 void
12661 ip_build_hdrs_v6(uchar_t *ext_hdrs, uint_t ext_hdrs_len,
12662     ip6_pkt_t *ipp, uint8_t protocol)
12663 {
12664 	uint8_t *nxthdr_ptr;
12665 	uint8_t *cp;
12666 	ip6i_t	*ip6i;
12667 	ip6_t	*ip6h = (ip6_t *)ext_hdrs;
12668 
12669 	/*
12670 	 * If sending private ip6i_t header down (checksum info, nexthop,
12671 	 * or ifindex), adjust ip header pointer and set ip6i_t header pointer,
12672 	 * then fill it in. (The checksum info will be filled in by icmp).
12673 	 */
12674 	if (ipp->ipp_fields & IPPF_HAS_IP6I) {
12675 		ip6i = (ip6i_t *)ip6h;
12676 		ip6h = (ip6_t *)&ip6i[1];
12677 
12678 		ip6i->ip6i_flags = 0;
12679 		ip6i->ip6i_vcf = IPV6_DEFAULT_VERS_AND_FLOW;
12680 		if (ipp->ipp_fields & IPPF_IFINDEX ||
12681 		    ipp->ipp_fields & IPPF_SCOPE_ID) {
12682 			ASSERT(ipp->ipp_ifindex != 0);
12683 			ip6i->ip6i_flags |= IP6I_IFINDEX;
12684 			ip6i->ip6i_ifindex = ipp->ipp_ifindex;
12685 		}
12686 		if (ipp->ipp_fields & IPPF_ADDR) {
12687 			/*
12688 			 * Enable per-packet source address verification if
12689 			 * IPV6_PKTINFO specified the source address.
12690 			 * ip6_src is set in the transport's _wput function.
12691 			 */
12692 			ASSERT(!IN6_IS_ADDR_UNSPECIFIED(
12693 			    &ipp->ipp_addr));
12694 			ip6i->ip6i_flags |= IP6I_VERIFY_SRC;
12695 		}
12696 		if (ipp->ipp_fields & IPPF_UNICAST_HOPS) {
12697 			ip6h->ip6_hops = ipp->ipp_unicast_hops;
12698 			/*
12699 			 * We need to set this flag so that IP doesn't
12700 			 * rewrite the IPv6 header's hoplimit with the
12701 			 * current default value.
12702 			 */
12703 			ip6i->ip6i_flags |= IP6I_HOPLIMIT;
12704 		}
12705 		if (ipp->ipp_fields & IPPF_NEXTHOP) {
12706 			ASSERT(!IN6_IS_ADDR_UNSPECIFIED(
12707 			    &ipp->ipp_nexthop));
12708 			ip6i->ip6i_flags |= IP6I_NEXTHOP;
12709 			ip6i->ip6i_nexthop = ipp->ipp_nexthop;
12710 		}
12711 		/*
12712 		 * tell IP this is an ip6i_t private header
12713 		 */
12714 		ip6i->ip6i_nxt = IPPROTO_RAW;
12715 	}
12716 	/* Initialize IPv6 header */
12717 	ip6h->ip6_vcf = IPV6_DEFAULT_VERS_AND_FLOW;
12718 	if (ipp->ipp_fields & IPPF_TCLASS) {
12719 		ip6h->ip6_vcf = (ip6h->ip6_vcf & ~IPV6_FLOWINFO_TCLASS) |
12720 		    (ipp->ipp_tclass << 20);
12721 	}
12722 	if (ipp->ipp_fields & IPPF_ADDR)
12723 		ip6h->ip6_src = ipp->ipp_addr;
12724 
12725 	nxthdr_ptr = (uint8_t *)&ip6h->ip6_nxt;
12726 	cp = (uint8_t *)&ip6h[1];
12727 	/*
12728 	 * Here's where we have to start stringing together
12729 	 * any extension headers in the right order:
12730 	 * Hop-by-hop, destination, routing, and final destination opts.
12731 	 */
12732 	if (ipp->ipp_fields & IPPF_HOPOPTS) {
12733 		/* Hop-by-hop options */
12734 		ip6_hbh_t *hbh = (ip6_hbh_t *)cp;
12735 
12736 		*nxthdr_ptr = IPPROTO_HOPOPTS;
12737 		nxthdr_ptr = &hbh->ip6h_nxt;
12738 
12739 		bcopy(ipp->ipp_hopopts, cp, ipp->ipp_hopoptslen);
12740 		cp += ipp->ipp_hopoptslen;
12741 	}
12742 	/*
12743 	 * En-route destination options
12744 	 * Only do them if there's a routing header as well
12745 	 */
12746 	if ((ipp->ipp_fields & (IPPF_RTDSTOPTS|IPPF_RTHDR)) ==
12747 	    (IPPF_RTDSTOPTS|IPPF_RTHDR)) {
12748 		ip6_dest_t *dst = (ip6_dest_t *)cp;
12749 
12750 		*nxthdr_ptr = IPPROTO_DSTOPTS;
12751 		nxthdr_ptr = &dst->ip6d_nxt;
12752 
12753 		bcopy(ipp->ipp_rtdstopts, cp, ipp->ipp_rtdstoptslen);
12754 		cp += ipp->ipp_rtdstoptslen;
12755 	}
12756 	/*
12757 	 * Routing header next
12758 	 */
12759 	if (ipp->ipp_fields & IPPF_RTHDR) {
12760 		ip6_rthdr_t *rt = (ip6_rthdr_t *)cp;
12761 
12762 		*nxthdr_ptr = IPPROTO_ROUTING;
12763 		nxthdr_ptr = &rt->ip6r_nxt;
12764 
12765 		bcopy(ipp->ipp_rthdr, cp, ipp->ipp_rthdrlen);
12766 		cp += ipp->ipp_rthdrlen;
12767 	}
12768 	/*
12769 	 * Do ultimate destination options
12770 	 */
12771 	if (ipp->ipp_fields & IPPF_DSTOPTS) {
12772 		ip6_dest_t *dest = (ip6_dest_t *)cp;
12773 
12774 		*nxthdr_ptr = IPPROTO_DSTOPTS;
12775 		nxthdr_ptr = &dest->ip6d_nxt;
12776 
12777 		bcopy(ipp->ipp_dstopts, cp, ipp->ipp_dstoptslen);
12778 		cp += ipp->ipp_dstoptslen;
12779 	}
12780 	/*
12781 	 * Now set the last header pointer to the proto passed in
12782 	 */
12783 	*nxthdr_ptr = protocol;
12784 	ASSERT((int)(cp - ext_hdrs) == ext_hdrs_len);
12785 }
12786 
12787 /*
12788  * Return a pointer to the routing header extension header
12789  * in the IPv6 header(s) chain passed in.
12790  * If none found, return NULL
12791  * Assumes that all extension headers are in same mblk as the v6 header
12792  */
12793 ip6_rthdr_t *
12794 ip_find_rthdr_v6(ip6_t *ip6h, uint8_t *endptr)
12795 {
12796 	ip6_dest_t	*desthdr;
12797 	ip6_frag_t	*fraghdr;
12798 	uint_t		hdrlen;
12799 	uint8_t		nexthdr;
12800 	uint8_t		*ptr = (uint8_t *)&ip6h[1];
12801 
12802 	if (ip6h->ip6_nxt == IPPROTO_ROUTING)
12803 		return ((ip6_rthdr_t *)ptr);
12804 
12805 	/*
12806 	 * The routing header will precede all extension headers
12807 	 * other than the hop-by-hop and destination options
12808 	 * extension headers, so if we see anything other than those,
12809 	 * we're done and didn't find it.
12810 	 * We could see a destination options header alone but no
12811 	 * routing header, in which case we'll return NULL as soon as
12812 	 * we see anything after that.
12813 	 * Hop-by-hop and destination option headers are identical,
12814 	 * so we can use either one we want as a template.
12815 	 */
12816 	nexthdr = ip6h->ip6_nxt;
12817 	while (ptr < endptr) {
12818 		/* Is there enough left for len + nexthdr? */
12819 		if (ptr + MIN_EHDR_LEN > endptr)
12820 			return (NULL);
12821 
12822 		switch (nexthdr) {
12823 		case IPPROTO_HOPOPTS:
12824 		case IPPROTO_DSTOPTS:
12825 			/* Assumes the headers are identical for hbh and dst */
12826 			desthdr = (ip6_dest_t *)ptr;
12827 			hdrlen = 8 * (desthdr->ip6d_len + 1);
12828 			nexthdr = desthdr->ip6d_nxt;
12829 			break;
12830 
12831 		case IPPROTO_ROUTING:
12832 			return ((ip6_rthdr_t *)ptr);
12833 
12834 		case IPPROTO_FRAGMENT:
12835 			fraghdr = (ip6_frag_t *)ptr;
12836 			hdrlen = sizeof (ip6_frag_t);
12837 			nexthdr = fraghdr->ip6f_nxt;
12838 			break;
12839 
12840 		default:
12841 			return (NULL);
12842 		}
12843 		ptr += hdrlen;
12844 	}
12845 	return (NULL);
12846 }
12847 
12848 /*
12849  * Called for source-routed packets originating on this node.
12850  * Manipulates the original routing header by moving every entry up
12851  * one slot, placing the first entry in the v6 header's v6_dst field,
12852  * and placing the ultimate destination in the routing header's last
12853  * slot.
12854  *
12855  * Returns the checksum diference between the ultimate destination
12856  * (last hop in the routing header when the packet is sent) and
12857  * the first hop (ip6_dst when the packet is sent)
12858  */
12859 /* ARGSUSED2 */
12860 uint32_t
12861 ip_massage_options_v6(ip6_t *ip6h, ip6_rthdr_t *rth, netstack_t *ns)
12862 {
12863 	uint_t		numaddr;
12864 	uint_t		i;
12865 	in6_addr_t	*addrptr;
12866 	in6_addr_t	tmp;
12867 	ip6_rthdr0_t	*rthdr = (ip6_rthdr0_t *)rth;
12868 	uint32_t	cksm;
12869 	uint32_t	addrsum = 0;
12870 	uint16_t	*ptr;
12871 
12872 	/*
12873 	 * Perform any processing needed for source routing.
12874 	 * We know that all extension headers will be in the same mblk
12875 	 * as the IPv6 header.
12876 	 */
12877 
12878 	/*
12879 	 * If no segments left in header, or the header length field is zero,
12880 	 * don't move hop addresses around;
12881 	 * Checksum difference is zero.
12882 	 */
12883 	if ((rthdr->ip6r0_segleft == 0) || (rthdr->ip6r0_len == 0))
12884 		return (0);
12885 
12886 	ptr = (uint16_t *)&ip6h->ip6_dst;
12887 	cksm = 0;
12888 	for (i = 0; i < (sizeof (in6_addr_t) / sizeof (uint16_t)); i++) {
12889 		cksm += ptr[i];
12890 	}
12891 	cksm = (cksm & 0xFFFF) + (cksm >> 16);
12892 
12893 	/*
12894 	 * Here's where the fun begins - we have to
12895 	 * move all addresses up one spot, take the
12896 	 * first hop and make it our first ip6_dst,
12897 	 * and place the ultimate destination in the
12898 	 * newly-opened last slot.
12899 	 */
12900 	addrptr = (in6_addr_t *)((char *)rthdr + sizeof (*rthdr));
12901 	numaddr = rthdr->ip6r0_len / 2;
12902 	tmp = *addrptr;
12903 	for (i = 0; i < (numaddr - 1); addrptr++, i++) {
12904 		*addrptr = addrptr[1];
12905 	}
12906 	*addrptr = ip6h->ip6_dst;
12907 	ip6h->ip6_dst = tmp;
12908 
12909 	/*
12910 	 * From the checksummed ultimate destination subtract the checksummed
12911 	 * current ip6_dst (the first hop address). Return that number.
12912 	 * (In the v4 case, the second part of this is done in each routine
12913 	 *  that calls ip_massage_options(). We do it all in this one place
12914 	 *  for v6).
12915 	 */
12916 	ptr = (uint16_t *)&ip6h->ip6_dst;
12917 	for (i = 0; i < (sizeof (in6_addr_t) / sizeof (uint16_t)); i++) {
12918 		addrsum += ptr[i];
12919 	}
12920 	cksm -= ((addrsum >> 16) + (addrsum & 0xFFFF));
12921 	if ((int)cksm < 0)
12922 		cksm--;
12923 	cksm = (cksm & 0xFFFF) + (cksm >> 16);
12924 
12925 	return (cksm);
12926 }
12927 
12928 /*
12929  * Propagate a multicast group membership operation (join/leave) (*fn) on
12930  * all interfaces crossed by the related multirt routes.
12931  * The call is considered successful if the operation succeeds
12932  * on at least one interface.
12933  * The function is called if the destination address in the packet to send
12934  * is multirouted.
12935  */
12936 int
12937 ip_multirt_apply_membership_v6(int (*fn)(conn_t *, boolean_t,
12938     const in6_addr_t *, int, mcast_record_t, const in6_addr_t *, mblk_t *),
12939     ire_t *ire, conn_t *connp, boolean_t checkonly, const in6_addr_t *v6grp,
12940     mcast_record_t fmode, const in6_addr_t *v6src, mblk_t *first_mp)
12941 {
12942 	ire_t		*ire_gw;
12943 	irb_t		*irb;
12944 	int		index, error = 0;
12945 	opt_restart_t	*or;
12946 	ip_stack_t	*ipst = ire->ire_ipst;
12947 
12948 	irb = ire->ire_bucket;
12949 	ASSERT(irb != NULL);
12950 
12951 	ASSERT(DB_TYPE(first_mp) == M_CTL);
12952 	or = (opt_restart_t *)first_mp->b_rptr;
12953 
12954 	IRB_REFHOLD(irb);
12955 	for (; ire != NULL; ire = ire->ire_next) {
12956 		if ((ire->ire_flags & RTF_MULTIRT) == 0)
12957 			continue;
12958 		if (!IN6_ARE_ADDR_EQUAL(&ire->ire_addr_v6, v6grp))
12959 			continue;
12960 
12961 		ire_gw = ire_ftable_lookup_v6(&ire->ire_gateway_addr_v6, 0, 0,
12962 		    IRE_INTERFACE, NULL, NULL, ALL_ZONES, 0, NULL,
12963 		    MATCH_IRE_RECURSIVE | MATCH_IRE_TYPE, ipst);
12964 		/* No resolver exists for the gateway; skip this ire. */
12965 		if (ire_gw == NULL)
12966 			continue;
12967 		index = ire_gw->ire_ipif->ipif_ill->ill_phyint->phyint_ifindex;
12968 		/*
12969 		 * A resolver exists: we can get the interface on which we have
12970 		 * to apply the operation.
12971 		 */
12972 		error = fn(connp, checkonly, v6grp, index, fmode, v6src,
12973 		    first_mp);
12974 		if (error == 0)
12975 			or->or_private = CGTP_MCAST_SUCCESS;
12976 
12977 		if (ip_debug > 0) {
12978 			ulong_t	off;
12979 			char	*ksym;
12980 
12981 			ksym = kobj_getsymname((uintptr_t)fn, &off);
12982 			ip2dbg(("ip_multirt_apply_membership_v6: "
12983 			    "called %s, multirt group 0x%08x via itf 0x%08x, "
12984 			    "error %d [success %u]\n",
12985 			    ksym ? ksym : "?",
12986 			    ntohl(V4_PART_OF_V6((*v6grp))),
12987 			    ntohl(V4_PART_OF_V6(ire_gw->ire_src_addr_v6)),
12988 			    error, or->or_private));
12989 		}
12990 
12991 		ire_refrele(ire_gw);
12992 		if (error == EINPROGRESS) {
12993 			IRB_REFRELE(irb);
12994 			return (error);
12995 		}
12996 	}
12997 	IRB_REFRELE(irb);
12998 	/*
12999 	 * Consider the call as successful if we succeeded on at least
13000 	 * one interface. Otherwise, return the last encountered error.
13001 	 */
13002 	return (or->or_private == CGTP_MCAST_SUCCESS ? 0 : error);
13003 }
13004 
13005 void
13006 *ip6_kstat_init(netstackid_t stackid, ip6_stat_t *ip6_statisticsp)
13007 {
13008 	kstat_t *ksp;
13009 
13010 	ip6_stat_t template = {
13011 		{ "ip6_udp_fast_path", 	KSTAT_DATA_UINT64 },
13012 		{ "ip6_udp_slow_path", 	KSTAT_DATA_UINT64 },
13013 		{ "ip6_udp_fannorm", 	KSTAT_DATA_UINT64 },
13014 		{ "ip6_udp_fanmb", 	KSTAT_DATA_UINT64 },
13015 		{ "ip6_out_sw_cksum",			KSTAT_DATA_UINT64 },
13016 		{ "ip6_in_sw_cksum",			KSTAT_DATA_UINT64 },
13017 		{ "ip6_tcp_in_full_hw_cksum_err",	KSTAT_DATA_UINT64 },
13018 		{ "ip6_tcp_in_part_hw_cksum_err",	KSTAT_DATA_UINT64 },
13019 		{ "ip6_tcp_in_sw_cksum_err",		KSTAT_DATA_UINT64 },
13020 		{ "ip6_tcp_out_sw_cksum_bytes",		KSTAT_DATA_UINT64 },
13021 		{ "ip6_udp_in_full_hw_cksum_err",	KSTAT_DATA_UINT64 },
13022 		{ "ip6_udp_in_part_hw_cksum_err",	KSTAT_DATA_UINT64 },
13023 		{ "ip6_udp_in_sw_cksum_err",		KSTAT_DATA_UINT64 },
13024 		{ "ip6_udp_out_sw_cksum_bytes",		KSTAT_DATA_UINT64 },
13025 		{ "ip6_frag_mdt_pkt_out",		KSTAT_DATA_UINT64 },
13026 		{ "ip6_frag_mdt_discarded",		KSTAT_DATA_UINT64 },
13027 		{ "ip6_frag_mdt_allocfail",		KSTAT_DATA_UINT64 },
13028 		{ "ip6_frag_mdt_addpdescfail",		KSTAT_DATA_UINT64 },
13029 		{ "ip6_frag_mdt_allocd",		KSTAT_DATA_UINT64 },
13030 	};
13031 	ksp = kstat_create_netstack("ip", 0, "ip6stat", "net",
13032 	    KSTAT_TYPE_NAMED, sizeof (template) / sizeof (kstat_named_t),
13033 	    KSTAT_FLAG_VIRTUAL, stackid);
13034 
13035 	if (ksp == NULL)
13036 		return (NULL);
13037 
13038 	bcopy(&template, ip6_statisticsp, sizeof (template));
13039 	ksp->ks_data = (void *)ip6_statisticsp;
13040 	ksp->ks_private = (void *)(uintptr_t)stackid;
13041 
13042 	kstat_install(ksp);
13043 	return (ksp);
13044 }
13045 
13046 void
13047 ip6_kstat_fini(netstackid_t stackid, kstat_t *ksp)
13048 {
13049 	if (ksp != NULL) {
13050 		ASSERT(stackid == (netstackid_t)(uintptr_t)ksp->ks_private);
13051 		kstat_delete_netstack(ksp, stackid);
13052 	}
13053 }
13054 
13055 /*
13056  * The following two functions set and get the value for the
13057  * IPV6_SRC_PREFERENCES socket option.
13058  */
13059 int
13060 ip6_set_src_preferences(conn_t *connp, uint32_t prefs)
13061 {
13062 	/*
13063 	 * We only support preferences that are covered by
13064 	 * IPV6_PREFER_SRC_MASK.
13065 	 */
13066 	if (prefs & ~IPV6_PREFER_SRC_MASK)
13067 		return (EINVAL);
13068 
13069 	/*
13070 	 * Look for conflicting preferences or default preferences.  If
13071 	 * both bits of a related pair are clear, the application wants the
13072 	 * system's default value for that pair.  Both bits in a pair can't
13073 	 * be set.
13074 	 */
13075 	if ((prefs & IPV6_PREFER_SRC_MIPMASK) == 0) {
13076 		prefs |= IPV6_PREFER_SRC_MIPDEFAULT;
13077 	} else if ((prefs & IPV6_PREFER_SRC_MIPMASK) ==
13078 	    IPV6_PREFER_SRC_MIPMASK) {
13079 		return (EINVAL);
13080 	}
13081 	if ((prefs & IPV6_PREFER_SRC_TMPMASK) == 0) {
13082 		prefs |= IPV6_PREFER_SRC_TMPDEFAULT;
13083 	} else if ((prefs & IPV6_PREFER_SRC_TMPMASK) ==
13084 	    IPV6_PREFER_SRC_TMPMASK) {
13085 		return (EINVAL);
13086 	}
13087 	if ((prefs & IPV6_PREFER_SRC_CGAMASK) == 0) {
13088 		prefs |= IPV6_PREFER_SRC_CGADEFAULT;
13089 	} else if ((prefs & IPV6_PREFER_SRC_CGAMASK) ==
13090 	    IPV6_PREFER_SRC_CGAMASK) {
13091 		return (EINVAL);
13092 	}
13093 
13094 	connp->conn_src_preferences = prefs;
13095 	return (0);
13096 }
13097 
13098 size_t
13099 ip6_get_src_preferences(conn_t *connp, uint32_t *val)
13100 {
13101 	*val = connp->conn_src_preferences;
13102 	return (sizeof (connp->conn_src_preferences));
13103 }
13104 
13105 int
13106 ip6_set_pktinfo(cred_t *cr, conn_t *connp, struct in6_pktinfo *pkti, mblk_t *mp)
13107 {
13108 	ill_t	*ill;
13109 	ire_t	*ire;
13110 	int	error;
13111 	ip_stack_t	*ipst = connp->conn_netstack->netstack_ip;
13112 
13113 	/*
13114 	 * Verify the source address and ifindex. Privileged users can use
13115 	 * any source address.  For ancillary data the source address is
13116 	 * checked in ip_wput_v6.
13117 	 */
13118 	if (pkti->ipi6_ifindex != 0) {
13119 		ASSERT(connp != NULL);
13120 		ill = ill_lookup_on_ifindex(pkti->ipi6_ifindex, B_TRUE,
13121 		    CONNP_TO_WQ(connp), mp, ip_restart_optmgmt, &error, ipst);
13122 		if (ill == NULL) {
13123 			/*
13124 			 * We just want to know if the interface exists, we
13125 			 * don't really care about the ill pointer itself.
13126 			 */
13127 			if (error != EINPROGRESS)
13128 				return (error);
13129 			error = 0;	/* Ensure we don't use it below */
13130 		} else {
13131 			ill_refrele(ill);
13132 		}
13133 	}
13134 	if (!IN6_IS_ADDR_UNSPECIFIED(&pkti->ipi6_addr) &&
13135 	    secpolicy_net_rawaccess(cr) != 0) {
13136 		ire = ire_route_lookup_v6(&pkti->ipi6_addr, 0, 0,
13137 		    (IRE_LOCAL|IRE_LOOPBACK), NULL, NULL,
13138 		    connp->conn_zoneid, NULL, MATCH_IRE_TYPE, ipst);
13139 		if (ire != NULL)
13140 			ire_refrele(ire);
13141 		else
13142 			return (ENXIO);
13143 	}
13144 	return (0);
13145 }
13146 
13147 /*
13148  * Get the size of the IP options (including the IP headers size)
13149  * without including the AH header's size. If till_ah is B_FALSE,
13150  * and if AH header is present, dest options beyond AH header will
13151  * also be included in the returned size.
13152  */
13153 int
13154 ipsec_ah_get_hdr_size_v6(mblk_t *mp, boolean_t till_ah)
13155 {
13156 	ip6_t *ip6h;
13157 	uint8_t nexthdr;
13158 	uint8_t *whereptr;
13159 	ip6_hbh_t *hbhhdr;
13160 	ip6_dest_t *dsthdr;
13161 	ip6_rthdr_t *rthdr;
13162 	int ehdrlen;
13163 	int size;
13164 	ah_t *ah;
13165 
13166 	ip6h = (ip6_t *)mp->b_rptr;
13167 	size = IPV6_HDR_LEN;
13168 	nexthdr = ip6h->ip6_nxt;
13169 	whereptr = (uint8_t *)&ip6h[1];
13170 	for (;;) {
13171 		/* Assume IP has already stripped it */
13172 		ASSERT(nexthdr != IPPROTO_FRAGMENT && nexthdr != IPPROTO_RAW);
13173 		switch (nexthdr) {
13174 		case IPPROTO_HOPOPTS:
13175 			hbhhdr = (ip6_hbh_t *)whereptr;
13176 			nexthdr = hbhhdr->ip6h_nxt;
13177 			ehdrlen = 8 * (hbhhdr->ip6h_len + 1);
13178 			break;
13179 		case IPPROTO_DSTOPTS:
13180 			dsthdr = (ip6_dest_t *)whereptr;
13181 			nexthdr = dsthdr->ip6d_nxt;
13182 			ehdrlen = 8 * (dsthdr->ip6d_len + 1);
13183 			break;
13184 		case IPPROTO_ROUTING:
13185 			rthdr = (ip6_rthdr_t *)whereptr;
13186 			nexthdr = rthdr->ip6r_nxt;
13187 			ehdrlen = 8 * (rthdr->ip6r_len + 1);
13188 			break;
13189 		default :
13190 			if (till_ah) {
13191 				ASSERT(nexthdr == IPPROTO_AH);
13192 				return (size);
13193 			}
13194 			/*
13195 			 * If we don't have a AH header to traverse,
13196 			 * return now. This happens normally for
13197 			 * outbound datagrams where we have not inserted
13198 			 * the AH header.
13199 			 */
13200 			if (nexthdr != IPPROTO_AH) {
13201 				return (size);
13202 			}
13203 
13204 			/*
13205 			 * We don't include the AH header's size
13206 			 * to be symmetrical with other cases where
13207 			 * we either don't have a AH header (outbound)
13208 			 * or peek into the AH header yet (inbound and
13209 			 * not pulled up yet).
13210 			 */
13211 			ah = (ah_t *)whereptr;
13212 			nexthdr = ah->ah_nexthdr;
13213 			ehdrlen = (ah->ah_length << 2) + 8;
13214 
13215 			if (nexthdr == IPPROTO_DSTOPTS) {
13216 				if (whereptr + ehdrlen >= mp->b_wptr) {
13217 					/*
13218 					 * The destination options header
13219 					 * is not part of the first mblk.
13220 					 */
13221 					whereptr = mp->b_cont->b_rptr;
13222 				} else {
13223 					whereptr += ehdrlen;
13224 				}
13225 
13226 				dsthdr = (ip6_dest_t *)whereptr;
13227 				ehdrlen = 8 * (dsthdr->ip6d_len + 1);
13228 				size += ehdrlen;
13229 			}
13230 			return (size);
13231 		}
13232 		whereptr += ehdrlen;
13233 		size += ehdrlen;
13234 	}
13235 }
13236