xref: /titanic_51/usr/src/uts/common/inet/udp/udp.c (revision e3c2d6aa3bc760b22fad3c83f876553f0d2c5b66)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 /* Copyright (c) 1990 Mentat Inc. */
26 
27 #pragma ident	"%Z%%M%	%I%	%E% SMI"
28 
29 const char udp_version[] = "%Z%%M%	%I%	%E% SMI";
30 
31 #include <sys/types.h>
32 #include <sys/stream.h>
33 #include <sys/dlpi.h>
34 #include <sys/pattr.h>
35 #include <sys/stropts.h>
36 #include <sys/strlog.h>
37 #include <sys/strsun.h>
38 #include <sys/time.h>
39 #define	_SUN_TPI_VERSION 2
40 #include <sys/tihdr.h>
41 #include <sys/timod.h>
42 #include <sys/ddi.h>
43 #include <sys/sunddi.h>
44 #include <sys/strsubr.h>
45 #include <sys/suntpi.h>
46 #include <sys/xti_inet.h>
47 #include <sys/cmn_err.h>
48 #include <sys/kmem.h>
49 #include <sys/policy.h>
50 #include <sys/ucred.h>
51 #include <sys/zone.h>
52 
53 #include <sys/socket.h>
54 #include <sys/sockio.h>
55 #include <sys/vtrace.h>
56 #include <sys/sdt.h>
57 #include <sys/debug.h>
58 #include <sys/isa_defs.h>
59 #include <sys/random.h>
60 #include <netinet/in.h>
61 #include <netinet/ip6.h>
62 #include <netinet/icmp6.h>
63 #include <netinet/udp.h>
64 #include <net/if.h>
65 #include <net/route.h>
66 
67 #include <inet/common.h>
68 #include <inet/ip.h>
69 #include <inet/ip_impl.h>
70 #include <inet/ip6.h>
71 #include <inet/ip_ire.h>
72 #include <inet/ip_if.h>
73 #include <inet/ip_multi.h>
74 #include <inet/ip_ndp.h>
75 #include <inet/mi.h>
76 #include <inet/mib2.h>
77 #include <inet/nd.h>
78 #include <inet/optcom.h>
79 #include <inet/snmpcom.h>
80 #include <inet/kstatcom.h>
81 #include <inet/udp_impl.h>
82 #include <inet/ipclassifier.h>
83 #include <inet/ipsec_impl.h>
84 #include <inet/ipp_common.h>
85 
86 /*
87  * The ipsec_info.h header file is here since it has the definition for the
88  * M_CTL message types used by IP to convey information to the ULP. The
89  * ipsec_info.h needs the pfkeyv2.h, hence the latter's presence.
90  */
91 #include <net/pfkeyv2.h>
92 #include <inet/ipsec_info.h>
93 
94 #include <sys/tsol/label.h>
95 #include <sys/tsol/tnet.h>
96 #include <rpc/pmap_prot.h>
97 
98 /*
99  * Synchronization notes:
100  *
101  * UDP is MT and uses the usual kernel synchronization primitives. There are 2
102  * locks, the fanout lock (uf_lock) and the udp endpoint lock udp_rwlock.
103  * We also use conn_lock when updating things that affect the IP classifier
104  * lookup.
105  * The lock order is udp_rwlock -> uf_lock and is udp_rwlock -> conn_lock.
106  *
107  * The fanout lock uf_lock:
108  * When a UDP endpoint is bound to a local port, it is inserted into
109  * a bind hash list.  The list consists of an array of udp_fanout_t buckets.
110  * The size of the array is controlled by the udp_bind_fanout_size variable.
111  * This variable can be changed in /etc/system if the default value is
112  * not large enough.  Each bind hash bucket is protected by a per bucket
113  * lock.  It protects the udp_bind_hash and udp_ptpbhn fields in the udp_t
114  * structure and a few other fields in the udp_t. A UDP endpoint is removed
115  * from the bind hash list only when it is being unbound or being closed.
116  * The per bucket lock also protects a UDP endpoint's state changes.
117  *
118  * The udp_rwlock:
119  * This protects most of the other fields in the udp_t. The exact list of
120  * fields which are protected by each of the above locks is documented in
121  * the udp_t structure definition.
122  *
123  * Plumbing notes:
124  * UDP is always a device driver. For compatibility with mibopen() code
125  * it is possible to I_PUSH "udp", but that results in pushing a passthrough
126  * dummy module.
127  *
128  * The above implies that we don't support any intermediate module to
129  * reside in between /dev/ip and udp -- in fact, we never supported such
130  * scenario in the past as the inter-layer communication semantics have
131  * always been private.
132  */
133 
134 /* For /etc/system control */
135 uint_t udp_bind_fanout_size = UDP_BIND_FANOUT_SIZE;
136 
137 #define	NDD_TOO_QUICK_MSG \
138 	"ndd get info rate too high for non-privileged users, try again " \
139 	"later.\n"
140 #define	NDD_OUT_OF_BUF_MSG	"<< Out of buffer >>\n"
141 
142 /* Option processing attrs */
143 typedef struct udpattrs_s {
144 	union {
145 		ip6_pkt_t	*udpattr_ipp6;	/* For V6 */
146 		ip4_pkt_t 	*udpattr_ipp4;	/* For V4 */
147 	} udpattr_ippu;
148 #define	udpattr_ipp6 udpattr_ippu.udpattr_ipp6
149 #define	udpattr_ipp4 udpattr_ippu.udpattr_ipp4
150 	mblk_t		*udpattr_mb;
151 	boolean_t	udpattr_credset;
152 } udpattrs_t;
153 
154 static void	udp_addr_req(queue_t *q, mblk_t *mp);
155 static void	udp_bind(queue_t *q, mblk_t *mp);
156 static void	udp_bind_hash_insert(udp_fanout_t *uf, udp_t *udp);
157 static void	udp_bind_hash_remove(udp_t *udp, boolean_t caller_holds_lock);
158 static void	udp_bind_result(conn_t *, mblk_t *);
159 static void	udp_bind_ack(conn_t *, mblk_t *mp);
160 static void	udp_bind_error(conn_t *, mblk_t *mp);
161 static int	udp_build_hdrs(udp_t *udp);
162 static void	udp_capability_req(queue_t *q, mblk_t *mp);
163 static int	udp_close(queue_t *q);
164 static void	udp_connect(queue_t *q, mblk_t *mp);
165 static void	udp_disconnect(queue_t *q, mblk_t *mp);
166 static void	udp_err_ack(queue_t *q, mblk_t *mp, t_scalar_t t_error,
167 		    int sys_error);
168 static void	udp_err_ack_prim(queue_t *q, mblk_t *mp, int primitive,
169 		    t_scalar_t tlierr, int unixerr);
170 static int	udp_extra_priv_ports_get(queue_t *q, mblk_t *mp, caddr_t cp,
171 		    cred_t *cr);
172 static int	udp_extra_priv_ports_add(queue_t *q, mblk_t *mp,
173 		    char *value, caddr_t cp, cred_t *cr);
174 static int	udp_extra_priv_ports_del(queue_t *q, mblk_t *mp,
175 		    char *value, caddr_t cp, cred_t *cr);
176 static void	udp_icmp_error(queue_t *q, mblk_t *mp);
177 static void	udp_icmp_error_ipv6(queue_t *q, mblk_t *mp);
178 static void	udp_info_req(queue_t *q, mblk_t *mp);
179 static void	udp_input(void *, mblk_t *, void *);
180 static mblk_t	*udp_ip_bind_mp(udp_t *udp, t_scalar_t bind_prim,
181 		    t_scalar_t addr_length);
182 static void	udp_lrput(queue_t *, mblk_t *);
183 static void	udp_lwput(queue_t *, mblk_t *);
184 static int	udp_open(queue_t *q, dev_t *devp, int flag, int sflag,
185 		    cred_t *credp, boolean_t isv6);
186 static int	udp_openv4(queue_t *q, dev_t *devp, int flag, int sflag,
187 		    cred_t *credp);
188 static int	udp_openv6(queue_t *q, dev_t *devp, int flag, int sflag,
189 		    cred_t *credp);
190 static  int	udp_unitdata_opt_process(queue_t *q, mblk_t *mp,
191 		    int *errorp, udpattrs_t *udpattrs);
192 static boolean_t udp_opt_allow_udr_set(t_scalar_t level, t_scalar_t name);
193 static int	udp_param_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr);
194 static boolean_t udp_param_register(IDP *ndp, udpparam_t *udppa, int cnt);
195 static int	udp_param_set(queue_t *q, mblk_t *mp, char *value, caddr_t cp,
196 		    cred_t *cr);
197 static void	udp_report_item(mblk_t *mp, udp_t *udp);
198 static int	udp_rinfop(queue_t *q, infod_t *dp);
199 static int	udp_rrw(queue_t *q, struiod_t *dp);
200 static int	udp_status_report(queue_t *q, mblk_t *mp, caddr_t cp,
201 		    cred_t *cr);
202 static void	udp_send_data(udp_t *, queue_t *, mblk_t *, ipha_t *);
203 static void	udp_ud_err(queue_t *q, mblk_t *mp, uchar_t *destaddr,
204 		    t_scalar_t destlen, t_scalar_t err);
205 static void	udp_unbind(queue_t *q, mblk_t *mp);
206 static in_port_t udp_update_next_port(udp_t *udp, in_port_t port,
207     boolean_t random);
208 static mblk_t	*udp_output_v4(conn_t *, mblk_t *, ipaddr_t, uint16_t, uint_t,
209 		    int *, boolean_t);
210 static mblk_t	*udp_output_v6(conn_t *connp, mblk_t *mp, sin6_t *sin6,
211 		    int *error);
212 static void	udp_wput_other(queue_t *q, mblk_t *mp);
213 static void	udp_wput_iocdata(queue_t *q, mblk_t *mp);
214 static size_t	udp_set_rcv_hiwat(udp_t *udp, size_t size);
215 
216 static void	*udp_stack_init(netstackid_t stackid, netstack_t *ns);
217 static void	udp_stack_fini(netstackid_t stackid, void *arg);
218 
219 static void	*udp_kstat_init(netstackid_t stackid);
220 static void	udp_kstat_fini(netstackid_t stackid, kstat_t *ksp);
221 static void	*udp_kstat2_init(netstackid_t, udp_stat_t *);
222 static void	udp_kstat2_fini(netstackid_t, kstat_t *);
223 static int	udp_kstat_update(kstat_t *kp, int rw);
224 
225 static void	udp_rcv_enqueue(queue_t *q, udp_t *udp, mblk_t *mp,
226 		    uint_t pkt_len);
227 static void	udp_rcv_drain(queue_t *q, udp_t *udp, boolean_t closing);
228 static void	udp_xmit(queue_t *, mblk_t *, ire_t *ire, conn_t *, zoneid_t);
229 
230 #define	UDP_RECV_HIWATER	(56 * 1024)
231 #define	UDP_RECV_LOWATER	128
232 #define	UDP_XMIT_HIWATER	(56 * 1024)
233 #define	UDP_XMIT_LOWATER	1024
234 
235 static struct module_info udp_mod_info =  {
236 	UDP_MOD_ID, UDP_MOD_NAME, 1, INFPSZ, UDP_RECV_HIWATER, UDP_RECV_LOWATER
237 };
238 
239 /*
240  * Entry points for UDP as a device.
241  * We have separate open functions for the /dev/udp and /dev/udp6 devices.
242  */
243 static struct qinit udp_rinitv4 = {
244 	NULL, NULL, udp_openv4, udp_close, NULL,
245 	&udp_mod_info, NULL, udp_rrw, udp_rinfop, STRUIOT_STANDARD
246 };
247 
248 static struct qinit udp_rinitv6 = {
249 	NULL, NULL, udp_openv6, udp_close, NULL,
250 	&udp_mod_info, NULL, udp_rrw, udp_rinfop, STRUIOT_STANDARD
251 };
252 
253 static struct qinit udp_winit = {
254 	(pfi_t)udp_wput, (pfi_t)ip_wsrv, NULL, NULL, NULL,
255 	&udp_mod_info, NULL, NULL, NULL, STRUIOT_NONE
256 };
257 
258 /*
259  * UDP needs to handle I_LINK and I_PLINK since ifconfig
260  * likes to use it as a place to hang the various streams.
261  */
262 static struct qinit udp_lrinit = {
263 	(pfi_t)udp_lrput, NULL, udp_openv4, udp_close, NULL,
264 	&udp_mod_info
265 };
266 
267 static struct qinit udp_lwinit = {
268 	(pfi_t)udp_lwput, NULL, udp_openv4, udp_close, NULL,
269 	&udp_mod_info
270 };
271 
272 /* For AF_INET aka /dev/udp */
273 struct streamtab udpinfov4 = {
274 	&udp_rinitv4, &udp_winit, &udp_lrinit, &udp_lwinit
275 };
276 
277 /* For AF_INET6 aka /dev/udp6 */
278 struct streamtab udpinfov6 = {
279 	&udp_rinitv6, &udp_winit, &udp_lrinit, &udp_lwinit
280 };
281 
282 static	sin_t	sin_null;	/* Zero address for quick clears */
283 static	sin6_t	sin6_null;	/* Zero address for quick clears */
284 
285 #define	UDP_MAXPACKET_IPV4 (IP_MAXPACKET - UDPH_SIZE - IP_SIMPLE_HDR_LENGTH)
286 
287 /* Default structure copied into T_INFO_ACK messages */
288 static struct T_info_ack udp_g_t_info_ack_ipv4 = {
289 	T_INFO_ACK,
290 	UDP_MAXPACKET_IPV4,	/* TSDU_size. Excl. headers */
291 	T_INVALID,	/* ETSU_size.  udp does not support expedited data. */
292 	T_INVALID,	/* CDATA_size. udp does not support connect data. */
293 	T_INVALID,	/* DDATA_size. udp does not support disconnect data. */
294 	sizeof (sin_t),	/* ADDR_size. */
295 	0,		/* OPT_size - not initialized here */
296 	UDP_MAXPACKET_IPV4,	/* TIDU_size.  Excl. headers */
297 	T_CLTS,		/* SERV_type.  udp supports connection-less. */
298 	TS_UNBND,	/* CURRENT_state.  This is set from udp_state. */
299 	(XPG4_1|SENDZERO) /* PROVIDER_flag */
300 };
301 
302 #define	UDP_MAXPACKET_IPV6 (IP_MAXPACKET - UDPH_SIZE - IPV6_HDR_LEN)
303 
304 static	struct T_info_ack udp_g_t_info_ack_ipv6 = {
305 	T_INFO_ACK,
306 	UDP_MAXPACKET_IPV6,	/* TSDU_size.  Excl. headers */
307 	T_INVALID,	/* ETSU_size.  udp does not support expedited data. */
308 	T_INVALID,	/* CDATA_size. udp does not support connect data. */
309 	T_INVALID,	/* DDATA_size. udp does not support disconnect data. */
310 	sizeof (sin6_t), /* ADDR_size. */
311 	0,		/* OPT_size - not initialized here */
312 	UDP_MAXPACKET_IPV6,	/* TIDU_size. Excl. headers */
313 	T_CLTS,		/* SERV_type.  udp supports connection-less. */
314 	TS_UNBND,	/* CURRENT_state.  This is set from udp_state. */
315 	(XPG4_1|SENDZERO) /* PROVIDER_flag */
316 };
317 
318 /* largest UDP port number */
319 #define	UDP_MAX_PORT	65535
320 
321 /*
322  * Table of ND variables supported by udp.  These are loaded into us_nd
323  * in udp_open.
324  * All of these are alterable, within the min/max values given, at run time.
325  */
326 /* BEGIN CSTYLED */
327 udpparam_t udp_param_arr[] = {
328  /*min		max		value		name */
329  { 0L,		256,		32,		"udp_wroff_extra" },
330  { 1L,		255,		255,		"udp_ipv4_ttl" },
331  { 0,		IPV6_MAX_HOPS,	IPV6_DEFAULT_HOPS, "udp_ipv6_hoplimit"},
332  { 1024,	(32 * 1024),	1024,		"udp_smallest_nonpriv_port" },
333  { 0,		1,		1,		"udp_do_checksum" },
334  { 1024,	UDP_MAX_PORT,	(32 * 1024),	"udp_smallest_anon_port" },
335  { 1024,	UDP_MAX_PORT,	UDP_MAX_PORT,	"udp_largest_anon_port" },
336  { UDP_XMIT_LOWATER, (1<<30), UDP_XMIT_HIWATER,	"udp_xmit_hiwat"},
337  { 0,		     (1<<30), UDP_XMIT_LOWATER, "udp_xmit_lowat"},
338  { UDP_RECV_LOWATER, (1<<30), UDP_RECV_HIWATER,	"udp_recv_hiwat"},
339  { 65536,	(1<<30),	2*1024*1024,	"udp_max_buf"},
340  { 100,		60000,		1000,		"udp_ndd_get_info_interval"},
341 };
342 /* END CSTYLED */
343 
344 /* Setable in /etc/system */
345 /* If set to 0, pick ephemeral port sequentially; otherwise randomly. */
346 uint32_t udp_random_anon_port = 1;
347 
348 /*
349  * Hook functions to enable cluster networking.
350  * On non-clustered systems these vectors must always be NULL
351  */
352 
353 void (*cl_inet_bind)(uchar_t protocol, sa_family_t addr_family,
354     uint8_t *laddrp, in_port_t lport) = NULL;
355 void (*cl_inet_unbind)(uint8_t protocol, sa_family_t addr_family,
356     uint8_t *laddrp, in_port_t lport) = NULL;
357 
358 typedef union T_primitives *t_primp_t;
359 
360 /*
361  * Return the next anonymous port in the privileged port range for
362  * bind checking.
363  *
364  * Trusted Extension (TX) notes: TX allows administrator to mark or
365  * reserve ports as Multilevel ports (MLP). MLP has special function
366  * on TX systems. Once a port is made MLP, it's not available as
367  * ordinary port. This creates "holes" in the port name space. It
368  * may be necessary to skip the "holes" find a suitable anon port.
369  */
370 static in_port_t
371 udp_get_next_priv_port(udp_t *udp)
372 {
373 	static in_port_t next_priv_port = IPPORT_RESERVED - 1;
374 	in_port_t nextport;
375 	boolean_t restart = B_FALSE;
376 	udp_stack_t *us = udp->udp_us;
377 
378 retry:
379 	if (next_priv_port < us->us_min_anonpriv_port ||
380 	    next_priv_port >= IPPORT_RESERVED) {
381 		next_priv_port = IPPORT_RESERVED - 1;
382 		if (restart)
383 			return (0);
384 		restart = B_TRUE;
385 	}
386 
387 	if (is_system_labeled() &&
388 	    (nextport = tsol_next_port(crgetzone(udp->udp_connp->conn_cred),
389 	    next_priv_port, IPPROTO_UDP, B_FALSE)) != 0) {
390 		next_priv_port = nextport;
391 		goto retry;
392 	}
393 
394 	return (next_priv_port--);
395 }
396 
397 /* UDP bind hash report triggered via the Named Dispatch mechanism. */
398 /* ARGSUSED */
399 static int
400 udp_bind_hash_report(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr)
401 {
402 	udp_fanout_t	*udpf;
403 	int		i;
404 	zoneid_t	zoneid;
405 	conn_t		*connp;
406 	udp_t		*udp;
407 	udp_stack_t	*us;
408 
409 	connp = Q_TO_CONN(q);
410 	udp = connp->conn_udp;
411 	us = udp->udp_us;
412 
413 	/* Refer to comments in udp_status_report(). */
414 	if (cr == NULL || secpolicy_ip_config(cr, B_TRUE) != 0) {
415 		if (ddi_get_lbolt() - us->us_last_ndd_get_info_time <
416 		    drv_usectohz(us->us_ndd_get_info_interval * 1000)) {
417 			(void) mi_mpprintf(mp, NDD_TOO_QUICK_MSG);
418 			return (0);
419 		}
420 	}
421 	if ((mp->b_cont = allocb(ND_MAX_BUF_LEN, BPRI_HI)) == NULL) {
422 		/* The following may work even if we cannot get a large buf. */
423 		(void) mi_mpprintf(mp, NDD_OUT_OF_BUF_MSG);
424 		return (0);
425 	}
426 
427 	(void) mi_mpprintf(mp,
428 	    "UDP     " MI_COL_HDRPAD_STR
429 	/*   12345678[89ABCDEF] */
430 	    " zone lport src addr        dest addr       port  state");
431 	/*    1234 12345 xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx 12345 UNBOUND */
432 
433 	zoneid = connp->conn_zoneid;
434 
435 	for (i = 0; i < us->us_bind_fanout_size; i++) {
436 		udpf = &us->us_bind_fanout[i];
437 		mutex_enter(&udpf->uf_lock);
438 
439 		/* Print the hash index. */
440 		udp = udpf->uf_udp;
441 		if (zoneid != GLOBAL_ZONEID) {
442 			/* skip to first entry in this zone; might be none */
443 			while (udp != NULL &&
444 			    udp->udp_connp->conn_zoneid != zoneid)
445 				udp = udp->udp_bind_hash;
446 		}
447 		if (udp != NULL) {
448 			uint_t print_len, buf_len;
449 
450 			buf_len = mp->b_cont->b_datap->db_lim -
451 			    mp->b_cont->b_wptr;
452 			print_len = snprintf((char *)mp->b_cont->b_wptr,
453 			    buf_len, "%d\n", i);
454 			if (print_len < buf_len) {
455 				mp->b_cont->b_wptr += print_len;
456 			} else {
457 				mp->b_cont->b_wptr += buf_len;
458 			}
459 			for (; udp != NULL; udp = udp->udp_bind_hash) {
460 				if (zoneid == GLOBAL_ZONEID ||
461 				    zoneid == udp->udp_connp->conn_zoneid)
462 					udp_report_item(mp->b_cont, udp);
463 			}
464 		}
465 		mutex_exit(&udpf->uf_lock);
466 	}
467 	us->us_last_ndd_get_info_time = ddi_get_lbolt();
468 	return (0);
469 }
470 
471 /*
472  * Hash list removal routine for udp_t structures.
473  */
474 static void
475 udp_bind_hash_remove(udp_t *udp, boolean_t caller_holds_lock)
476 {
477 	udp_t	*udpnext;
478 	kmutex_t *lockp;
479 	udp_stack_t *us = udp->udp_us;
480 
481 	if (udp->udp_ptpbhn == NULL)
482 		return;
483 
484 	/*
485 	 * Extract the lock pointer in case there are concurrent
486 	 * hash_remove's for this instance.
487 	 */
488 	ASSERT(udp->udp_port != 0);
489 	if (!caller_holds_lock) {
490 		lockp = &us->us_bind_fanout[UDP_BIND_HASH(udp->udp_port,
491 		    us->us_bind_fanout_size)].uf_lock;
492 		ASSERT(lockp != NULL);
493 		mutex_enter(lockp);
494 	}
495 	if (udp->udp_ptpbhn != NULL) {
496 		udpnext = udp->udp_bind_hash;
497 		if (udpnext != NULL) {
498 			udpnext->udp_ptpbhn = udp->udp_ptpbhn;
499 			udp->udp_bind_hash = NULL;
500 		}
501 		*udp->udp_ptpbhn = udpnext;
502 		udp->udp_ptpbhn = NULL;
503 	}
504 	if (!caller_holds_lock) {
505 		mutex_exit(lockp);
506 	}
507 }
508 
509 static void
510 udp_bind_hash_insert(udp_fanout_t *uf, udp_t *udp)
511 {
512 	udp_t	**udpp;
513 	udp_t	*udpnext;
514 
515 	ASSERT(MUTEX_HELD(&uf->uf_lock));
516 	ASSERT(udp->udp_ptpbhn == NULL);
517 	udpp = &uf->uf_udp;
518 	udpnext = udpp[0];
519 	if (udpnext != NULL) {
520 		/*
521 		 * If the new udp bound to the INADDR_ANY address
522 		 * and the first one in the list is not bound to
523 		 * INADDR_ANY we skip all entries until we find the
524 		 * first one bound to INADDR_ANY.
525 		 * This makes sure that applications binding to a
526 		 * specific address get preference over those binding to
527 		 * INADDR_ANY.
528 		 */
529 		if (V6_OR_V4_INADDR_ANY(udp->udp_bound_v6src) &&
530 		    !V6_OR_V4_INADDR_ANY(udpnext->udp_bound_v6src)) {
531 			while ((udpnext = udpp[0]) != NULL &&
532 			    !V6_OR_V4_INADDR_ANY(
533 			    udpnext->udp_bound_v6src)) {
534 				udpp = &(udpnext->udp_bind_hash);
535 			}
536 			if (udpnext != NULL)
537 				udpnext->udp_ptpbhn = &udp->udp_bind_hash;
538 		} else {
539 			udpnext->udp_ptpbhn = &udp->udp_bind_hash;
540 		}
541 	}
542 	udp->udp_bind_hash = udpnext;
543 	udp->udp_ptpbhn = udpp;
544 	udpp[0] = udp;
545 }
546 
547 /*
548  * This routine is called to handle each O_T_BIND_REQ/T_BIND_REQ message
549  * passed to udp_wput.
550  * It associates a port number and local address with the stream.
551  * The O_T_BIND_REQ/T_BIND_REQ is passed downstream to ip with the UDP
552  * protocol type (IPPROTO_UDP) placed in the message following the address.
553  * A T_BIND_ACK message is passed upstream when ip acknowledges the request.
554  * (Called as writer.)
555  *
556  * Note that UDP over IPv4 and IPv6 sockets can use the same port number
557  * without setting SO_REUSEADDR. This is needed so that they
558  * can be viewed as two independent transport protocols.
559  * However, anonymouns ports are allocated from the same range to avoid
560  * duplicating the us->us_next_port_to_try.
561  */
562 static void
563 udp_bind(queue_t *q, mblk_t *mp)
564 {
565 	sin_t		*sin;
566 	sin6_t		*sin6;
567 	mblk_t		*mp1;
568 	in_port_t	port;		/* Host byte order */
569 	in_port_t	requested_port;	/* Host byte order */
570 	struct T_bind_req *tbr;
571 	int		count;
572 	in6_addr_t	v6src;
573 	boolean_t	bind_to_req_port_only;
574 	int		loopmax;
575 	udp_fanout_t	*udpf;
576 	in_port_t	lport;		/* Network byte order */
577 	zoneid_t	zoneid;
578 	conn_t		*connp;
579 	udp_t		*udp;
580 	boolean_t	is_inaddr_any;
581 	mlp_type_t	addrtype, mlptype;
582 	udp_stack_t	*us;
583 
584 	connp = Q_TO_CONN(q);
585 	udp = connp->conn_udp;
586 	us = udp->udp_us;
587 	if ((mp->b_wptr - mp->b_rptr) < sizeof (*tbr)) {
588 		(void) mi_strlog(q, 1, SL_ERROR|SL_TRACE,
589 		    "udp_bind: bad req, len %u",
590 		    (uint_t)(mp->b_wptr - mp->b_rptr));
591 		udp_err_ack(q, mp, TPROTO, 0);
592 		return;
593 	}
594 	if (udp->udp_state != TS_UNBND) {
595 		(void) mi_strlog(q, 1, SL_ERROR|SL_TRACE,
596 		    "udp_bind: bad state, %u", udp->udp_state);
597 		udp_err_ack(q, mp, TOUTSTATE, 0);
598 		return;
599 	}
600 	/*
601 	 * Reallocate the message to make sure we have enough room for an
602 	 * address and the protocol type.
603 	 */
604 	mp1 = reallocb(mp, sizeof (struct T_bind_ack) + sizeof (sin6_t) + 1, 1);
605 	if (!mp1) {
606 		udp_err_ack(q, mp, TSYSERR, ENOMEM);
607 		return;
608 	}
609 
610 	mp = mp1;
611 	tbr = (struct T_bind_req *)mp->b_rptr;
612 	switch (tbr->ADDR_length) {
613 	case 0:			/* Request for a generic port */
614 		tbr->ADDR_offset = sizeof (struct T_bind_req);
615 		if (udp->udp_family == AF_INET) {
616 			tbr->ADDR_length = sizeof (sin_t);
617 			sin = (sin_t *)&tbr[1];
618 			*sin = sin_null;
619 			sin->sin_family = AF_INET;
620 			mp->b_wptr = (uchar_t *)&sin[1];
621 		} else {
622 			ASSERT(udp->udp_family == AF_INET6);
623 			tbr->ADDR_length = sizeof (sin6_t);
624 			sin6 = (sin6_t *)&tbr[1];
625 			*sin6 = sin6_null;
626 			sin6->sin6_family = AF_INET6;
627 			mp->b_wptr = (uchar_t *)&sin6[1];
628 		}
629 		port = 0;
630 		break;
631 
632 	case sizeof (sin_t):	/* Complete IPv4 address */
633 		sin = (sin_t *)mi_offset_param(mp, tbr->ADDR_offset,
634 		    sizeof (sin_t));
635 		if (sin == NULL || !OK_32PTR((char *)sin)) {
636 			udp_err_ack(q, mp, TSYSERR, EINVAL);
637 			return;
638 		}
639 		if (udp->udp_family != AF_INET ||
640 		    sin->sin_family != AF_INET) {
641 			udp_err_ack(q, mp, TSYSERR, EAFNOSUPPORT);
642 			return;
643 		}
644 		port = ntohs(sin->sin_port);
645 		break;
646 
647 	case sizeof (sin6_t):	/* complete IPv6 address */
648 		sin6 = (sin6_t *)mi_offset_param(mp, tbr->ADDR_offset,
649 		    sizeof (sin6_t));
650 		if (sin6 == NULL || !OK_32PTR((char *)sin6)) {
651 			udp_err_ack(q, mp, TSYSERR, EINVAL);
652 			return;
653 		}
654 		if (udp->udp_family != AF_INET6 ||
655 		    sin6->sin6_family != AF_INET6) {
656 			udp_err_ack(q, mp, TSYSERR, EAFNOSUPPORT);
657 			return;
658 		}
659 		port = ntohs(sin6->sin6_port);
660 		break;
661 
662 	default:		/* Invalid request */
663 		(void) mi_strlog(q, 1, SL_ERROR|SL_TRACE,
664 		    "udp_bind: bad ADDR_length length %u", tbr->ADDR_length);
665 		udp_err_ack(q, mp, TBADADDR, 0);
666 		return;
667 	}
668 
669 	requested_port = port;
670 
671 	if (requested_port == 0 || tbr->PRIM_type == O_T_BIND_REQ)
672 		bind_to_req_port_only = B_FALSE;
673 	else			/* T_BIND_REQ and requested_port != 0 */
674 		bind_to_req_port_only = B_TRUE;
675 
676 	if (requested_port == 0) {
677 		/*
678 		 * If the application passed in zero for the port number, it
679 		 * doesn't care which port number we bind to. Get one in the
680 		 * valid range.
681 		 */
682 		if (udp->udp_anon_priv_bind) {
683 			port = udp_get_next_priv_port(udp);
684 		} else {
685 			port = udp_update_next_port(udp,
686 			    us->us_next_port_to_try, B_TRUE);
687 		}
688 	} else {
689 		/*
690 		 * If the port is in the well-known privileged range,
691 		 * make sure the caller was privileged.
692 		 */
693 		int i;
694 		boolean_t priv = B_FALSE;
695 
696 		if (port < us->us_smallest_nonpriv_port) {
697 			priv = B_TRUE;
698 		} else {
699 			for (i = 0; i < us->us_num_epriv_ports; i++) {
700 				if (port == us->us_epriv_ports[i]) {
701 					priv = B_TRUE;
702 					break;
703 				}
704 			}
705 		}
706 
707 		if (priv) {
708 			cred_t *cr = DB_CREDDEF(mp, connp->conn_cred);
709 
710 			if (secpolicy_net_privaddr(cr, port) != 0) {
711 				udp_err_ack(q, mp, TACCES, 0);
712 				return;
713 			}
714 		}
715 	}
716 
717 	if (port == 0) {
718 		udp_err_ack(q, mp, TNOADDR, 0);
719 		return;
720 	}
721 
722 	/*
723 	 * The state must be TS_UNBND. TPI mandates that users must send
724 	 * TPI primitives only 1 at a time and wait for the response before
725 	 * sending the next primitive.
726 	 */
727 	rw_enter(&udp->udp_rwlock, RW_WRITER);
728 	if (udp->udp_state != TS_UNBND || udp->udp_pending_op != -1) {
729 		rw_exit(&udp->udp_rwlock);
730 		(void) mi_strlog(q, 1, SL_ERROR|SL_TRACE,
731 		    "udp_bind: bad state, %u", udp->udp_state);
732 		udp_err_ack(q, mp, TOUTSTATE, 0);
733 		return;
734 	}
735 	udp->udp_pending_op = tbr->PRIM_type;
736 	/*
737 	 * Copy the source address into our udp structure. This address
738 	 * may still be zero; if so, IP will fill in the correct address
739 	 * each time an outbound packet is passed to it. Since the udp is
740 	 * not yet in the bind hash list, we don't grab the uf_lock to
741 	 * change udp_ipversion
742 	 */
743 	if (udp->udp_family == AF_INET) {
744 		ASSERT(sin != NULL);
745 		ASSERT(udp->udp_ipversion == IPV4_VERSION);
746 		udp->udp_max_hdr_len = IP_SIMPLE_HDR_LENGTH + UDPH_SIZE +
747 		    udp->udp_ip_snd_options_len;
748 		IN6_IPADDR_TO_V4MAPPED(sin->sin_addr.s_addr, &v6src);
749 	} else {
750 		ASSERT(sin6 != NULL);
751 		v6src = sin6->sin6_addr;
752 		if (IN6_IS_ADDR_V4MAPPED(&v6src)) {
753 			/*
754 			 * no need to hold the uf_lock to set the udp_ipversion
755 			 * since we are not yet in the fanout list
756 			 */
757 			udp->udp_ipversion = IPV4_VERSION;
758 			udp->udp_max_hdr_len = IP_SIMPLE_HDR_LENGTH +
759 			    UDPH_SIZE + udp->udp_ip_snd_options_len;
760 		} else {
761 			udp->udp_ipversion = IPV6_VERSION;
762 			udp->udp_max_hdr_len = udp->udp_sticky_hdrs_len;
763 		}
764 	}
765 
766 	/*
767 	 * If udp_reuseaddr is not set, then we have to make sure that
768 	 * the IP address and port number the application requested
769 	 * (or we selected for the application) is not being used by
770 	 * another stream.  If another stream is already using the
771 	 * requested IP address and port, the behavior depends on
772 	 * "bind_to_req_port_only". If set the bind fails; otherwise we
773 	 * search for any an unused port to bind to the the stream.
774 	 *
775 	 * As per the BSD semantics, as modified by the Deering multicast
776 	 * changes, if udp_reuseaddr is set, then we allow multiple binds
777 	 * to the same port independent of the local IP address.
778 	 *
779 	 * This is slightly different than in SunOS 4.X which did not
780 	 * support IP multicast. Note that the change implemented by the
781 	 * Deering multicast code effects all binds - not only binding
782 	 * to IP multicast addresses.
783 	 *
784 	 * Note that when binding to port zero we ignore SO_REUSEADDR in
785 	 * order to guarantee a unique port.
786 	 */
787 
788 	count = 0;
789 	if (udp->udp_anon_priv_bind) {
790 		/*
791 		 * loopmax = (IPPORT_RESERVED-1) -
792 		 *    us->us_min_anonpriv_port + 1
793 		 */
794 		loopmax = IPPORT_RESERVED - us->us_min_anonpriv_port;
795 	} else {
796 		loopmax = us->us_largest_anon_port -
797 		    us->us_smallest_anon_port + 1;
798 	}
799 
800 	is_inaddr_any = V6_OR_V4_INADDR_ANY(v6src);
801 	zoneid = connp->conn_zoneid;
802 
803 	for (;;) {
804 		udp_t		*udp1;
805 		boolean_t	found_exclbind = B_FALSE;
806 
807 		/*
808 		 * Walk through the list of udp streams bound to
809 		 * requested port with the same IP address.
810 		 */
811 		lport = htons(port);
812 		udpf = &us->us_bind_fanout[UDP_BIND_HASH(lport,
813 		    us->us_bind_fanout_size)];
814 		mutex_enter(&udpf->uf_lock);
815 		for (udp1 = udpf->uf_udp; udp1 != NULL;
816 		    udp1 = udp1->udp_bind_hash) {
817 			if (lport != udp1->udp_port)
818 				continue;
819 
820 			/*
821 			 * On a labeled system, we must treat bindings to ports
822 			 * on shared IP addresses by sockets with MAC exemption
823 			 * privilege as being in all zones, as there's
824 			 * otherwise no way to identify the right receiver.
825 			 */
826 			if (!(IPCL_ZONE_MATCH(udp1->udp_connp, zoneid) ||
827 			    IPCL_ZONE_MATCH(connp,
828 			    udp1->udp_connp->conn_zoneid)) &&
829 			    !udp->udp_mac_exempt && !udp1->udp_mac_exempt)
830 				continue;
831 
832 			/*
833 			 * If UDP_EXCLBIND is set for either the bound or
834 			 * binding endpoint, the semantics of bind
835 			 * is changed according to the following chart.
836 			 *
837 			 * spec = specified address (v4 or v6)
838 			 * unspec = unspecified address (v4 or v6)
839 			 * A = specified addresses are different for endpoints
840 			 *
841 			 * bound	bind to		allowed?
842 			 * -------------------------------------
843 			 * unspec	unspec		no
844 			 * unspec	spec		no
845 			 * spec		unspec		no
846 			 * spec		spec		yes if A
847 			 *
848 			 * For labeled systems, SO_MAC_EXEMPT behaves the same
849 			 * as UDP_EXCLBIND, except that zoneid is ignored.
850 			 */
851 			if (udp1->udp_exclbind || udp->udp_exclbind ||
852 			    udp1->udp_mac_exempt || udp->udp_mac_exempt) {
853 				if (V6_OR_V4_INADDR_ANY(
854 				    udp1->udp_bound_v6src) ||
855 				    is_inaddr_any ||
856 				    IN6_ARE_ADDR_EQUAL(&udp1->udp_bound_v6src,
857 				    &v6src)) {
858 					found_exclbind = B_TRUE;
859 					break;
860 				}
861 				continue;
862 			}
863 
864 			/*
865 			 * Check ipversion to allow IPv4 and IPv6 sockets to
866 			 * have disjoint port number spaces.
867 			 */
868 			if (udp->udp_ipversion != udp1->udp_ipversion) {
869 
870 				/*
871 				 * On the first time through the loop, if the
872 				 * the user intentionally specified a
873 				 * particular port number, then ignore any
874 				 * bindings of the other protocol that may
875 				 * conflict. This allows the user to bind IPv6
876 				 * alone and get both v4 and v6, or bind both
877 				 * both and get each seperately. On subsequent
878 				 * times through the loop, we're checking a
879 				 * port that we chose (not the user) and thus
880 				 * we do not allow casual duplicate bindings.
881 				 */
882 				if (count == 0 && requested_port != 0)
883 					continue;
884 			}
885 
886 			/*
887 			 * No difference depending on SO_REUSEADDR.
888 			 *
889 			 * If existing port is bound to a
890 			 * non-wildcard IP address and
891 			 * the requesting stream is bound to
892 			 * a distinct different IP addresses
893 			 * (non-wildcard, also), keep going.
894 			 */
895 			if (!is_inaddr_any &&
896 			    !V6_OR_V4_INADDR_ANY(udp1->udp_bound_v6src) &&
897 			    !IN6_ARE_ADDR_EQUAL(&udp1->udp_bound_v6src,
898 			    &v6src)) {
899 				continue;
900 			}
901 			break;
902 		}
903 
904 		if (!found_exclbind &&
905 		    (udp->udp_reuseaddr && requested_port != 0)) {
906 			break;
907 		}
908 
909 		if (udp1 == NULL) {
910 			/*
911 			 * No other stream has this IP address
912 			 * and port number. We can use it.
913 			 */
914 			break;
915 		}
916 		mutex_exit(&udpf->uf_lock);
917 		if (bind_to_req_port_only) {
918 			/*
919 			 * We get here only when requested port
920 			 * is bound (and only first  of the for()
921 			 * loop iteration).
922 			 *
923 			 * The semantics of this bind request
924 			 * require it to fail so we return from
925 			 * the routine (and exit the loop).
926 			 *
927 			 */
928 			udp->udp_pending_op = -1;
929 			rw_exit(&udp->udp_rwlock);
930 			udp_err_ack(q, mp, TADDRBUSY, 0);
931 			return;
932 		}
933 
934 		if (udp->udp_anon_priv_bind) {
935 			port = udp_get_next_priv_port(udp);
936 		} else {
937 			if ((count == 0) && (requested_port != 0)) {
938 				/*
939 				 * If the application wants us to find
940 				 * a port, get one to start with. Set
941 				 * requested_port to 0, so that we will
942 				 * update us->us_next_port_to_try below.
943 				 */
944 				port = udp_update_next_port(udp,
945 				    us->us_next_port_to_try, B_TRUE);
946 				requested_port = 0;
947 			} else {
948 				port = udp_update_next_port(udp, port + 1,
949 				    B_FALSE);
950 			}
951 		}
952 
953 		if (port == 0 || ++count >= loopmax) {
954 			/*
955 			 * We've tried every possible port number and
956 			 * there are none available, so send an error
957 			 * to the user.
958 			 */
959 			udp->udp_pending_op = -1;
960 			rw_exit(&udp->udp_rwlock);
961 			udp_err_ack(q, mp, TNOADDR, 0);
962 			return;
963 		}
964 	}
965 
966 	/*
967 	 * Copy the source address into our udp structure.  This address
968 	 * may still be zero; if so, ip will fill in the correct address
969 	 * each time an outbound packet is passed to it.
970 	 * If we are binding to a broadcast or multicast address then
971 	 * udp_bind_ack will clear the source address when it receives
972 	 * the T_BIND_ACK.
973 	 */
974 	udp->udp_v6src = udp->udp_bound_v6src = v6src;
975 	udp->udp_port = lport;
976 	/*
977 	 * Now reset the the next anonymous port if the application requested
978 	 * an anonymous port, or we handed out the next anonymous port.
979 	 */
980 	if ((requested_port == 0) && (!udp->udp_anon_priv_bind)) {
981 		us->us_next_port_to_try = port + 1;
982 	}
983 
984 	/* Initialize the O_T_BIND_REQ/T_BIND_REQ for ip. */
985 	if (udp->udp_family == AF_INET) {
986 		sin->sin_port = udp->udp_port;
987 	} else {
988 		int error;
989 
990 		sin6->sin6_port = udp->udp_port;
991 		/* Rebuild the header template */
992 		error = udp_build_hdrs(udp);
993 		if (error != 0) {
994 			udp->udp_pending_op = -1;
995 			rw_exit(&udp->udp_rwlock);
996 			mutex_exit(&udpf->uf_lock);
997 			udp_err_ack(q, mp, TSYSERR, error);
998 			return;
999 		}
1000 	}
1001 	udp->udp_state = TS_IDLE;
1002 	udp_bind_hash_insert(udpf, udp);
1003 	mutex_exit(&udpf->uf_lock);
1004 	rw_exit(&udp->udp_rwlock);
1005 
1006 	if (cl_inet_bind) {
1007 		/*
1008 		 * Running in cluster mode - register bind information
1009 		 */
1010 		if (udp->udp_ipversion == IPV4_VERSION) {
1011 			(*cl_inet_bind)(IPPROTO_UDP, AF_INET,
1012 			    (uint8_t *)(&V4_PART_OF_V6(udp->udp_v6src)),
1013 			    (in_port_t)udp->udp_port);
1014 		} else {
1015 			(*cl_inet_bind)(IPPROTO_UDP, AF_INET6,
1016 			    (uint8_t *)&(udp->udp_v6src),
1017 			    (in_port_t)udp->udp_port);
1018 		}
1019 
1020 	}
1021 
1022 	connp->conn_anon_port = (is_system_labeled() && requested_port == 0);
1023 	if (is_system_labeled() && (!connp->conn_anon_port ||
1024 	    connp->conn_anon_mlp)) {
1025 		uint16_t mlpport;
1026 		cred_t *cr = connp->conn_cred;
1027 		zone_t *zone;
1028 
1029 		zone = crgetzone(cr);
1030 		connp->conn_mlp_type = udp->udp_recvucred ? mlptBoth :
1031 		    mlptSingle;
1032 		addrtype = tsol_mlp_addr_type(zone->zone_id, IPV6_VERSION,
1033 		    &v6src, us->us_netstack->netstack_ip);
1034 		if (addrtype == mlptSingle) {
1035 			rw_enter(&udp->udp_rwlock, RW_WRITER);
1036 			udp->udp_pending_op = -1;
1037 			rw_exit(&udp->udp_rwlock);
1038 			udp_err_ack(q, mp, TNOADDR, 0);
1039 			connp->conn_anon_port = B_FALSE;
1040 			connp->conn_mlp_type = mlptSingle;
1041 			return;
1042 		}
1043 		mlpport = connp->conn_anon_port ? PMAPPORT : port;
1044 		mlptype = tsol_mlp_port_type(zone, IPPROTO_UDP, mlpport,
1045 		    addrtype);
1046 		if (mlptype != mlptSingle &&
1047 		    (connp->conn_mlp_type == mlptSingle ||
1048 		    secpolicy_net_bindmlp(cr) != 0)) {
1049 			if (udp->udp_debug) {
1050 				(void) strlog(UDP_MOD_ID, 0, 1,
1051 				    SL_ERROR|SL_TRACE,
1052 				    "udp_bind: no priv for multilevel port %d",
1053 				    mlpport);
1054 			}
1055 			rw_enter(&udp->udp_rwlock, RW_WRITER);
1056 			udp->udp_pending_op = -1;
1057 			rw_exit(&udp->udp_rwlock);
1058 			udp_err_ack(q, mp, TACCES, 0);
1059 			connp->conn_anon_port = B_FALSE;
1060 			connp->conn_mlp_type = mlptSingle;
1061 			return;
1062 		}
1063 
1064 		/*
1065 		 * If we're specifically binding a shared IP address and the
1066 		 * port is MLP on shared addresses, then check to see if this
1067 		 * zone actually owns the MLP.  Reject if not.
1068 		 */
1069 		if (mlptype == mlptShared && addrtype == mlptShared) {
1070 			/*
1071 			 * No need to handle exclusive-stack zones since
1072 			 * ALL_ZONES only applies to the shared stack.
1073 			 */
1074 			zoneid_t mlpzone;
1075 
1076 			mlpzone = tsol_mlp_findzone(IPPROTO_UDP,
1077 			    htons(mlpport));
1078 			if (connp->conn_zoneid != mlpzone) {
1079 				if (udp->udp_debug) {
1080 					(void) strlog(UDP_MOD_ID, 0, 1,
1081 					    SL_ERROR|SL_TRACE,
1082 					    "udp_bind: attempt to bind port "
1083 					    "%d on shared addr in zone %d "
1084 					    "(should be %d)",
1085 					    mlpport, connp->conn_zoneid,
1086 					    mlpzone);
1087 				}
1088 				rw_enter(&udp->udp_rwlock, RW_WRITER);
1089 				udp->udp_pending_op = -1;
1090 				rw_exit(&udp->udp_rwlock);
1091 				udp_err_ack(q, mp, TACCES, 0);
1092 				connp->conn_anon_port = B_FALSE;
1093 				connp->conn_mlp_type = mlptSingle;
1094 				return;
1095 			}
1096 		}
1097 		if (connp->conn_anon_port) {
1098 			int error;
1099 
1100 			error = tsol_mlp_anon(zone, mlptype, connp->conn_ulp,
1101 			    port, B_TRUE);
1102 			if (error != 0) {
1103 				if (udp->udp_debug) {
1104 					(void) strlog(UDP_MOD_ID, 0, 1,
1105 					    SL_ERROR|SL_TRACE,
1106 					    "udp_bind: cannot establish anon "
1107 					    "MLP for port %d", port);
1108 				}
1109 				rw_enter(&udp->udp_rwlock, RW_WRITER);
1110 				udp->udp_pending_op = -1;
1111 				rw_exit(&udp->udp_rwlock);
1112 				udp_err_ack(q, mp, TACCES, 0);
1113 				connp->conn_anon_port = B_FALSE;
1114 				connp->conn_mlp_type = mlptSingle;
1115 				return;
1116 			}
1117 		}
1118 		connp->conn_mlp_type = mlptype;
1119 	}
1120 
1121 	/* Pass the protocol number in the message following the address. */
1122 	*mp->b_wptr++ = IPPROTO_UDP;
1123 	if (!V6_OR_V4_INADDR_ANY(udp->udp_v6src)) {
1124 		/*
1125 		 * Append a request for an IRE if udp_v6src not
1126 		 * zero (IPv4 - INADDR_ANY, or IPv6 - all-zeroes address).
1127 		 */
1128 		mp->b_cont = allocb(sizeof (ire_t), BPRI_HI);
1129 		if (!mp->b_cont) {
1130 			rw_enter(&udp->udp_rwlock, RW_WRITER);
1131 			udp->udp_pending_op = -1;
1132 			rw_exit(&udp->udp_rwlock);
1133 			udp_err_ack(q, mp, TSYSERR, ENOMEM);
1134 			return;
1135 		}
1136 		mp->b_cont->b_wptr += sizeof (ire_t);
1137 		mp->b_cont->b_datap->db_type = IRE_DB_REQ_TYPE;
1138 	}
1139 	if (udp->udp_family == AF_INET6)
1140 		mp = ip_bind_v6(q, mp, connp, NULL);
1141 	else
1142 		mp = ip_bind_v4(q, mp, connp);
1143 
1144 	/* The above return NULL if the bind needs to be deferred */
1145 	if (mp != NULL)
1146 		udp_bind_result(connp, mp);
1147 	else
1148 		CONN_INC_REF(connp);
1149 }
1150 
1151 /*
1152  * This is called from ip_wput_nondata to handle the results of a
1153  * deferred UDP bind. It is called once the bind has been completed.
1154  */
1155 void
1156 udp_resume_bind(conn_t *connp, mblk_t *mp)
1157 {
1158 	ASSERT(connp != NULL && IPCL_IS_UDP(connp));
1159 
1160 	udp_bind_result(connp, mp);
1161 
1162 	CONN_OPER_PENDING_DONE(connp);
1163 }
1164 
1165 /*
1166  * This routine handles each T_CONN_REQ message passed to udp.  It
1167  * associates a default destination address with the stream.
1168  *
1169  * This routine sends down a T_BIND_REQ to IP with the following mblks:
1170  *	T_BIND_REQ	- specifying local and remote address/port
1171  *	IRE_DB_REQ_TYPE	- to get an IRE back containing ire_type and src
1172  *	T_OK_ACK	- for the T_CONN_REQ
1173  *	T_CONN_CON	- to keep the TPI user happy
1174  *
1175  * The connect completes in udp_bind_result.
1176  * When a T_BIND_ACK is received information is extracted from the IRE
1177  * and the two appended messages are sent to the TPI user.
1178  * Should udp_bind_result receive T_ERROR_ACK for the T_BIND_REQ it will
1179  * convert it to an error ack for the appropriate primitive.
1180  */
1181 static void
1182 udp_connect(queue_t *q, mblk_t *mp)
1183 {
1184 	sin6_t	*sin6;
1185 	sin_t	*sin;
1186 	struct T_conn_req	*tcr;
1187 	in6_addr_t v6dst;
1188 	ipaddr_t v4dst;
1189 	uint16_t dstport;
1190 	uint32_t flowinfo;
1191 	mblk_t	*mp1, *mp2;
1192 	udp_fanout_t	*udpf;
1193 	udp_t	*udp, *udp1;
1194 	ushort_t	ipversion;
1195 	udp_stack_t	*us;
1196 	conn_t		*connp = Q_TO_CONN(q);
1197 
1198 	udp = connp->conn_udp;
1199 	tcr = (struct T_conn_req *)mp->b_rptr;
1200 	us = udp->udp_us;
1201 
1202 	/* A bit of sanity checking */
1203 	if ((mp->b_wptr - mp->b_rptr) < sizeof (struct T_conn_req)) {
1204 		udp_err_ack(q, mp, TPROTO, 0);
1205 		return;
1206 	}
1207 
1208 	if (tcr->OPT_length != 0) {
1209 		udp_err_ack(q, mp, TBADOPT, 0);
1210 		return;
1211 	}
1212 
1213 	/*
1214 	 * Determine packet type based on type of address passed in
1215 	 * the request should contain an IPv4 or IPv6 address.
1216 	 * Make sure that address family matches the type of
1217 	 * family of the the address passed down
1218 	 */
1219 	switch (tcr->DEST_length) {
1220 	default:
1221 		udp_err_ack(q, mp, TBADADDR, 0);
1222 		return;
1223 
1224 	case sizeof (sin_t):
1225 		sin = (sin_t *)mi_offset_param(mp, tcr->DEST_offset,
1226 		    sizeof (sin_t));
1227 		if (sin == NULL || !OK_32PTR((char *)sin)) {
1228 			udp_err_ack(q, mp, TSYSERR, EINVAL);
1229 			return;
1230 		}
1231 		if (udp->udp_family != AF_INET ||
1232 		    sin->sin_family != AF_INET) {
1233 			udp_err_ack(q, mp, TSYSERR, EAFNOSUPPORT);
1234 			return;
1235 		}
1236 		v4dst = sin->sin_addr.s_addr;
1237 		dstport = sin->sin_port;
1238 		IN6_IPADDR_TO_V4MAPPED(v4dst, &v6dst);
1239 		ASSERT(udp->udp_ipversion == IPV4_VERSION);
1240 		ipversion = IPV4_VERSION;
1241 		break;
1242 
1243 	case sizeof (sin6_t):
1244 		sin6 = (sin6_t *)mi_offset_param(mp, tcr->DEST_offset,
1245 		    sizeof (sin6_t));
1246 		if (sin6 == NULL || !OK_32PTR((char *)sin6)) {
1247 			udp_err_ack(q, mp, TSYSERR, EINVAL);
1248 			return;
1249 		}
1250 		if (udp->udp_family != AF_INET6 ||
1251 		    sin6->sin6_family != AF_INET6) {
1252 			udp_err_ack(q, mp, TSYSERR, EAFNOSUPPORT);
1253 			return;
1254 		}
1255 		v6dst = sin6->sin6_addr;
1256 		dstport = sin6->sin6_port;
1257 		if (IN6_IS_ADDR_V4MAPPED(&v6dst)) {
1258 			IN6_V4MAPPED_TO_IPADDR(&v6dst, v4dst);
1259 			ipversion = IPV4_VERSION;
1260 			flowinfo = 0;
1261 		} else {
1262 			ipversion = IPV6_VERSION;
1263 			flowinfo = sin6->sin6_flowinfo;
1264 		}
1265 		break;
1266 	}
1267 	if (dstport == 0) {
1268 		udp_err_ack(q, mp, TBADADDR, 0);
1269 		return;
1270 	}
1271 
1272 	rw_enter(&udp->udp_rwlock, RW_WRITER);
1273 
1274 	/*
1275 	 * This UDP must have bound to a port already before doing a connect.
1276 	 * TPI mandates that users must send TPI primitives only 1 at a time
1277 	 * and wait for the response before sending the next primitive.
1278 	 */
1279 	if (udp->udp_state == TS_UNBND || udp->udp_pending_op != -1) {
1280 		rw_exit(&udp->udp_rwlock);
1281 		(void) mi_strlog(q, 1, SL_ERROR|SL_TRACE,
1282 		    "udp_connect: bad state, %u", udp->udp_state);
1283 		udp_err_ack(q, mp, TOUTSTATE, 0);
1284 		return;
1285 	}
1286 	udp->udp_pending_op = T_CONN_REQ;
1287 	ASSERT(udp->udp_port != 0 && udp->udp_ptpbhn != NULL);
1288 
1289 	if (ipversion == IPV4_VERSION) {
1290 		udp->udp_max_hdr_len = IP_SIMPLE_HDR_LENGTH + UDPH_SIZE +
1291 		    udp->udp_ip_snd_options_len;
1292 	} else {
1293 		udp->udp_max_hdr_len = udp->udp_sticky_hdrs_len;
1294 	}
1295 
1296 	udpf = &us->us_bind_fanout[UDP_BIND_HASH(udp->udp_port,
1297 	    us->us_bind_fanout_size)];
1298 
1299 	mutex_enter(&udpf->uf_lock);
1300 	if (udp->udp_state == TS_DATA_XFER) {
1301 		/* Already connected - clear out state */
1302 		udp->udp_v6src = udp->udp_bound_v6src;
1303 		udp->udp_state = TS_IDLE;
1304 	}
1305 
1306 	/*
1307 	 * Create a default IP header with no IP options.
1308 	 */
1309 	udp->udp_dstport = dstport;
1310 	udp->udp_ipversion = ipversion;
1311 	if (ipversion == IPV4_VERSION) {
1312 		/*
1313 		 * Interpret a zero destination to mean loopback.
1314 		 * Update the T_CONN_REQ (sin/sin6) since it is used to
1315 		 * generate the T_CONN_CON.
1316 		 */
1317 		if (v4dst == INADDR_ANY) {
1318 			v4dst = htonl(INADDR_LOOPBACK);
1319 			IN6_IPADDR_TO_V4MAPPED(v4dst, &v6dst);
1320 			if (udp->udp_family == AF_INET) {
1321 				sin->sin_addr.s_addr = v4dst;
1322 			} else {
1323 				sin6->sin6_addr = v6dst;
1324 			}
1325 		}
1326 		udp->udp_v6dst = v6dst;
1327 		udp->udp_flowinfo = 0;
1328 
1329 		/*
1330 		 * If the destination address is multicast and
1331 		 * an outgoing multicast interface has been set,
1332 		 * use the address of that interface as our
1333 		 * source address if no source address has been set.
1334 		 */
1335 		if (V4_PART_OF_V6(udp->udp_v6src) == INADDR_ANY &&
1336 		    CLASSD(v4dst) &&
1337 		    udp->udp_multicast_if_addr != INADDR_ANY) {
1338 			IN6_IPADDR_TO_V4MAPPED(udp->udp_multicast_if_addr,
1339 			    &udp->udp_v6src);
1340 		}
1341 	} else {
1342 		ASSERT(udp->udp_ipversion == IPV6_VERSION);
1343 		/*
1344 		 * Interpret a zero destination to mean loopback.
1345 		 * Update the T_CONN_REQ (sin/sin6) since it is used to
1346 		 * generate the T_CONN_CON.
1347 		 */
1348 		if (IN6_IS_ADDR_UNSPECIFIED(&v6dst)) {
1349 			v6dst = ipv6_loopback;
1350 			sin6->sin6_addr = v6dst;
1351 		}
1352 		udp->udp_v6dst = v6dst;
1353 		udp->udp_flowinfo = flowinfo;
1354 		/*
1355 		 * If the destination address is multicast and
1356 		 * an outgoing multicast interface has been set,
1357 		 * then the ip bind logic will pick the correct source
1358 		 * address (i.e. matching the outgoing multicast interface).
1359 		 */
1360 	}
1361 
1362 	/*
1363 	 * Verify that the src/port/dst/port is unique for all
1364 	 * connections in TS_DATA_XFER
1365 	 */
1366 	for (udp1 = udpf->uf_udp; udp1 != NULL; udp1 = udp1->udp_bind_hash) {
1367 		if (udp1->udp_state != TS_DATA_XFER)
1368 			continue;
1369 		if (udp->udp_port != udp1->udp_port ||
1370 		    udp->udp_ipversion != udp1->udp_ipversion ||
1371 		    dstport != udp1->udp_dstport ||
1372 		    !IN6_ARE_ADDR_EQUAL(&udp->udp_v6src, &udp1->udp_v6src) ||
1373 		    !IN6_ARE_ADDR_EQUAL(&v6dst, &udp1->udp_v6dst) ||
1374 		    !(IPCL_ZONE_MATCH(udp->udp_connp,
1375 		    udp1->udp_connp->conn_zoneid) ||
1376 		    IPCL_ZONE_MATCH(udp1->udp_connp,
1377 		    udp->udp_connp->conn_zoneid)))
1378 			continue;
1379 		mutex_exit(&udpf->uf_lock);
1380 		udp->udp_pending_op = -1;
1381 		rw_exit(&udp->udp_rwlock);
1382 		udp_err_ack(q, mp, TBADADDR, 0);
1383 		return;
1384 	}
1385 	udp->udp_state = TS_DATA_XFER;
1386 	mutex_exit(&udpf->uf_lock);
1387 
1388 	/*
1389 	 * Send down bind to IP to verify that there is a route
1390 	 * and to determine the source address.
1391 	 * This will come back as T_BIND_ACK with an IRE_DB_TYPE in rput.
1392 	 */
1393 	if (udp->udp_family == AF_INET)
1394 		mp1 = udp_ip_bind_mp(udp, O_T_BIND_REQ, sizeof (ipa_conn_t));
1395 	else
1396 		mp1 = udp_ip_bind_mp(udp, O_T_BIND_REQ, sizeof (ipa6_conn_t));
1397 	if (mp1 == NULL) {
1398 bind_failed:
1399 		mutex_enter(&udpf->uf_lock);
1400 		udp->udp_state = TS_IDLE;
1401 		udp->udp_pending_op = -1;
1402 		mutex_exit(&udpf->uf_lock);
1403 		rw_exit(&udp->udp_rwlock);
1404 		udp_err_ack(q, mp, TSYSERR, ENOMEM);
1405 		return;
1406 	}
1407 
1408 	rw_exit(&udp->udp_rwlock);
1409 	/*
1410 	 * We also have to send a connection confirmation to
1411 	 * keep TLI happy. Prepare it for udp_bind_result.
1412 	 */
1413 	if (udp->udp_family == AF_INET)
1414 		mp2 = mi_tpi_conn_con(NULL, (char *)sin,
1415 		    sizeof (*sin), NULL, 0);
1416 	else
1417 		mp2 = mi_tpi_conn_con(NULL, (char *)sin6,
1418 		    sizeof (*sin6), NULL, 0);
1419 	if (mp2 == NULL) {
1420 		freemsg(mp1);
1421 		rw_enter(&udp->udp_rwlock, RW_WRITER);
1422 		goto bind_failed;
1423 	}
1424 
1425 	mp = mi_tpi_ok_ack_alloc(mp);
1426 	if (mp == NULL) {
1427 		/* Unable to reuse the T_CONN_REQ for the ack. */
1428 		freemsg(mp2);
1429 		rw_enter(&udp->udp_rwlock, RW_WRITER);
1430 		mutex_enter(&udpf->uf_lock);
1431 		udp->udp_state = TS_IDLE;
1432 		udp->udp_pending_op = -1;
1433 		mutex_exit(&udpf->uf_lock);
1434 		rw_exit(&udp->udp_rwlock);
1435 		udp_err_ack_prim(q, mp1, T_CONN_REQ, TSYSERR, ENOMEM);
1436 		return;
1437 	}
1438 
1439 	/* Hang onto the T_OK_ACK and T_CONN_CON for later. */
1440 	linkb(mp1, mp);
1441 	linkb(mp1, mp2);
1442 
1443 	mblk_setcred(mp1, connp->conn_cred);
1444 	if (udp->udp_family == AF_INET)
1445 		mp1 = ip_bind_v4(q, mp1, connp);
1446 	else
1447 		mp1 = ip_bind_v6(q, mp1, connp, NULL);
1448 
1449 	/* The above return NULL if the bind needs to be deferred */
1450 	if (mp1 != NULL)
1451 		udp_bind_result(connp, mp1);
1452 	else
1453 		CONN_INC_REF(connp);
1454 }
1455 
1456 static int
1457 udp_close(queue_t *q)
1458 {
1459 	conn_t	*connp = (conn_t *)q->q_ptr;
1460 	udp_t	*udp;
1461 
1462 	ASSERT(connp != NULL && IPCL_IS_UDP(connp));
1463 	udp = connp->conn_udp;
1464 
1465 	udp_quiesce_conn(connp);
1466 	ip_quiesce_conn(connp);
1467 	/*
1468 	 * Disable read-side synchronous stream
1469 	 * interface and drain any queued data.
1470 	 */
1471 	udp_rcv_drain(q, udp, B_TRUE);
1472 	ASSERT(!udp->udp_direct_sockfs);
1473 
1474 	qprocsoff(q);
1475 
1476 	ASSERT(udp->udp_rcv_cnt == 0);
1477 	ASSERT(udp->udp_rcv_msgcnt == 0);
1478 	ASSERT(udp->udp_rcv_list_head == NULL);
1479 	ASSERT(udp->udp_rcv_list_tail == NULL);
1480 
1481 	udp_close_free(connp);
1482 
1483 	/*
1484 	 * Now we are truly single threaded on this stream, and can
1485 	 * delete the things hanging off the connp, and finally the connp.
1486 	 * We removed this connp from the fanout list, it cannot be
1487 	 * accessed thru the fanouts, and we already waited for the
1488 	 * conn_ref to drop to 0. We are already in close, so
1489 	 * there cannot be any other thread from the top. qprocsoff
1490 	 * has completed, and service has completed or won't run in
1491 	 * future.
1492 	 */
1493 	ASSERT(connp->conn_ref == 1);
1494 
1495 	inet_minor_free(ip_minor_arena, connp->conn_dev);
1496 
1497 	connp->conn_ref--;
1498 	ipcl_conn_destroy(connp);
1499 
1500 	q->q_ptr = WR(q)->q_ptr = NULL;
1501 	return (0);
1502 }
1503 
1504 /*
1505  * Called in the close path to quiesce the conn
1506  */
1507 void
1508 udp_quiesce_conn(conn_t *connp)
1509 {
1510 	udp_t	*udp = connp->conn_udp;
1511 
1512 	if (cl_inet_unbind != NULL && udp->udp_state == TS_IDLE) {
1513 		/*
1514 		 * Running in cluster mode - register unbind information
1515 		 */
1516 		if (udp->udp_ipversion == IPV4_VERSION) {
1517 			(*cl_inet_unbind)(IPPROTO_UDP, AF_INET,
1518 			    (uint8_t *)(&(V4_PART_OF_V6(udp->udp_v6src))),
1519 			    (in_port_t)udp->udp_port);
1520 		} else {
1521 			(*cl_inet_unbind)(IPPROTO_UDP, AF_INET6,
1522 			    (uint8_t *)(&(udp->udp_v6src)),
1523 			    (in_port_t)udp->udp_port);
1524 		}
1525 	}
1526 
1527 	udp_bind_hash_remove(udp, B_FALSE);
1528 
1529 }
1530 
1531 void
1532 udp_close_free(conn_t *connp)
1533 {
1534 	udp_t *udp = connp->conn_udp;
1535 
1536 	/* If there are any options associated with the stream, free them. */
1537 	if (udp->udp_ip_snd_options != NULL) {
1538 		mi_free((char *)udp->udp_ip_snd_options);
1539 		udp->udp_ip_snd_options = NULL;
1540 		udp->udp_ip_snd_options_len = 0;
1541 	}
1542 
1543 	if (udp->udp_ip_rcv_options != NULL) {
1544 		mi_free((char *)udp->udp_ip_rcv_options);
1545 		udp->udp_ip_rcv_options = NULL;
1546 		udp->udp_ip_rcv_options_len = 0;
1547 	}
1548 
1549 	/* Free memory associated with sticky options */
1550 	if (udp->udp_sticky_hdrs_len != 0) {
1551 		kmem_free(udp->udp_sticky_hdrs,
1552 		    udp->udp_sticky_hdrs_len);
1553 		udp->udp_sticky_hdrs = NULL;
1554 		udp->udp_sticky_hdrs_len = 0;
1555 	}
1556 
1557 	ip6_pkt_free(&udp->udp_sticky_ipp);
1558 
1559 	/*
1560 	 * Clear any fields which the kmem_cache constructor clears.
1561 	 * Only udp_connp needs to be preserved.
1562 	 * TBD: We should make this more efficient to avoid clearing
1563 	 * everything.
1564 	 */
1565 	ASSERT(udp->udp_connp == connp);
1566 	bzero(udp, sizeof (udp_t));
1567 	udp->udp_connp = connp;
1568 }
1569 
1570 /*
1571  * This routine handles each T_DISCON_REQ message passed to udp
1572  * as an indicating that UDP is no longer connected. This results
1573  * in sending a T_BIND_REQ to IP to restore the binding to just
1574  * the local address/port.
1575  *
1576  * This routine sends down a T_BIND_REQ to IP with the following mblks:
1577  *	T_BIND_REQ	- specifying just the local address/port
1578  *	T_OK_ACK	- for the T_DISCON_REQ
1579  *
1580  * The disconnect completes in udp_bind_result.
1581  * When a T_BIND_ACK is received the appended T_OK_ACK is sent to the TPI user.
1582  * Should udp_bind_result receive T_ERROR_ACK for the T_BIND_REQ it will
1583  * convert it to an error ack for the appropriate primitive.
1584  */
1585 static void
1586 udp_disconnect(queue_t *q, mblk_t *mp)
1587 {
1588 	udp_t	*udp;
1589 	mblk_t	*mp1;
1590 	udp_fanout_t *udpf;
1591 	udp_stack_t *us;
1592 	conn_t	*connp = Q_TO_CONN(q);
1593 
1594 	udp = connp->conn_udp;
1595 	us = udp->udp_us;
1596 	rw_enter(&udp->udp_rwlock, RW_WRITER);
1597 	if (udp->udp_state != TS_DATA_XFER || udp->udp_pending_op != -1) {
1598 		rw_exit(&udp->udp_rwlock);
1599 		(void) mi_strlog(q, 1, SL_ERROR|SL_TRACE,
1600 		    "udp_disconnect: bad state, %u", udp->udp_state);
1601 		udp_err_ack(q, mp, TOUTSTATE, 0);
1602 		return;
1603 	}
1604 	udp->udp_pending_op = T_DISCON_REQ;
1605 	udpf = &us->us_bind_fanout[UDP_BIND_HASH(udp->udp_port,
1606 	    us->us_bind_fanout_size)];
1607 	mutex_enter(&udpf->uf_lock);
1608 	udp->udp_v6src = udp->udp_bound_v6src;
1609 	udp->udp_state = TS_IDLE;
1610 	mutex_exit(&udpf->uf_lock);
1611 
1612 	/*
1613 	 * Send down bind to IP to remove the full binding and revert
1614 	 * to the local address binding.
1615 	 */
1616 	if (udp->udp_family == AF_INET)
1617 		mp1 = udp_ip_bind_mp(udp, O_T_BIND_REQ, sizeof (sin_t));
1618 	else
1619 		mp1 = udp_ip_bind_mp(udp, O_T_BIND_REQ, sizeof (sin6_t));
1620 	if (mp1 == NULL) {
1621 		udp->udp_pending_op = -1;
1622 		rw_exit(&udp->udp_rwlock);
1623 		udp_err_ack(q, mp, TSYSERR, ENOMEM);
1624 		return;
1625 	}
1626 	mp = mi_tpi_ok_ack_alloc(mp);
1627 	if (mp == NULL) {
1628 		/* Unable to reuse the T_DISCON_REQ for the ack. */
1629 		udp->udp_pending_op = -1;
1630 		rw_exit(&udp->udp_rwlock);
1631 		udp_err_ack_prim(q, mp1, T_DISCON_REQ, TSYSERR, ENOMEM);
1632 		return;
1633 	}
1634 
1635 	if (udp->udp_family == AF_INET6) {
1636 		int error;
1637 
1638 		/* Rebuild the header template */
1639 		error = udp_build_hdrs(udp);
1640 		if (error != 0) {
1641 			udp->udp_pending_op = -1;
1642 			rw_exit(&udp->udp_rwlock);
1643 			udp_err_ack_prim(q, mp, T_DISCON_REQ, TSYSERR, error);
1644 			freemsg(mp1);
1645 			return;
1646 		}
1647 	}
1648 
1649 	rw_exit(&udp->udp_rwlock);
1650 	/* Append the T_OK_ACK to the T_BIND_REQ for udp_bind_ack */
1651 	linkb(mp1, mp);
1652 
1653 	if (udp->udp_family == AF_INET6)
1654 		mp1 = ip_bind_v6(q, mp1, connp, NULL);
1655 	else
1656 		mp1 = ip_bind_v4(q, mp1, connp);
1657 
1658 	/* The above return NULL if the bind needs to be deferred */
1659 	if (mp1 != NULL)
1660 		udp_bind_result(connp, mp1);
1661 	else
1662 		CONN_INC_REF(connp);
1663 }
1664 
1665 /* This routine creates a T_ERROR_ACK message and passes it upstream. */
1666 static void
1667 udp_err_ack(queue_t *q, mblk_t *mp, t_scalar_t t_error, int sys_error)
1668 {
1669 	if ((mp = mi_tpi_err_ack_alloc(mp, t_error, sys_error)) != NULL)
1670 		qreply(q, mp);
1671 }
1672 
1673 /* Shorthand to generate and send TPI error acks to our client */
1674 static void
1675 udp_err_ack_prim(queue_t *q, mblk_t *mp, int primitive, t_scalar_t t_error,
1676     int sys_error)
1677 {
1678 	struct T_error_ack	*teackp;
1679 
1680 	if ((mp = tpi_ack_alloc(mp, sizeof (struct T_error_ack),
1681 	    M_PCPROTO, T_ERROR_ACK)) != NULL) {
1682 		teackp = (struct T_error_ack *)mp->b_rptr;
1683 		teackp->ERROR_prim = primitive;
1684 		teackp->TLI_error = t_error;
1685 		teackp->UNIX_error = sys_error;
1686 		qreply(q, mp);
1687 	}
1688 }
1689 
1690 /*ARGSUSED*/
1691 static int
1692 udp_extra_priv_ports_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr)
1693 {
1694 	int i;
1695 	udp_t		*udp = Q_TO_UDP(q);
1696 	udp_stack_t *us = udp->udp_us;
1697 
1698 	for (i = 0; i < us->us_num_epriv_ports; i++) {
1699 		if (us->us_epriv_ports[i] != 0)
1700 			(void) mi_mpprintf(mp, "%d ", us->us_epriv_ports[i]);
1701 	}
1702 	return (0);
1703 }
1704 
1705 /* ARGSUSED */
1706 static int
1707 udp_extra_priv_ports_add(queue_t *q, mblk_t *mp, char *value, caddr_t cp,
1708     cred_t *cr)
1709 {
1710 	long	new_value;
1711 	int	i;
1712 	udp_t		*udp = Q_TO_UDP(q);
1713 	udp_stack_t *us = udp->udp_us;
1714 
1715 	/*
1716 	 * Fail the request if the new value does not lie within the
1717 	 * port number limits.
1718 	 */
1719 	if (ddi_strtol(value, NULL, 10, &new_value) != 0 ||
1720 	    new_value <= 0 || new_value >= 65536) {
1721 		return (EINVAL);
1722 	}
1723 
1724 	/* Check if the value is already in the list */
1725 	for (i = 0; i < us->us_num_epriv_ports; i++) {
1726 		if (new_value == us->us_epriv_ports[i]) {
1727 			return (EEXIST);
1728 		}
1729 	}
1730 	/* Find an empty slot */
1731 	for (i = 0; i < us->us_num_epriv_ports; i++) {
1732 		if (us->us_epriv_ports[i] == 0)
1733 			break;
1734 	}
1735 	if (i == us->us_num_epriv_ports) {
1736 		return (EOVERFLOW);
1737 	}
1738 
1739 	/* Set the new value */
1740 	us->us_epriv_ports[i] = (in_port_t)new_value;
1741 	return (0);
1742 }
1743 
1744 /* ARGSUSED */
1745 static int
1746 udp_extra_priv_ports_del(queue_t *q, mblk_t *mp, char *value, caddr_t cp,
1747     cred_t *cr)
1748 {
1749 	long	new_value;
1750 	int	i;
1751 	udp_t		*udp = Q_TO_UDP(q);
1752 	udp_stack_t *us = udp->udp_us;
1753 
1754 	/*
1755 	 * Fail the request if the new value does not lie within the
1756 	 * port number limits.
1757 	 */
1758 	if (ddi_strtol(value, NULL, 10, &new_value) != 0 ||
1759 	    new_value <= 0 || new_value >= 65536) {
1760 		return (EINVAL);
1761 	}
1762 
1763 	/* Check that the value is already in the list */
1764 	for (i = 0; i < us->us_num_epriv_ports; i++) {
1765 		if (us->us_epriv_ports[i] == new_value)
1766 			break;
1767 	}
1768 	if (i == us->us_num_epriv_ports) {
1769 		return (ESRCH);
1770 	}
1771 
1772 	/* Clear the value */
1773 	us->us_epriv_ports[i] = 0;
1774 	return (0);
1775 }
1776 
1777 /* At minimum we need 4 bytes of UDP header */
1778 #define	ICMP_MIN_UDP_HDR	4
1779 
1780 /*
1781  * udp_icmp_error is called by udp_input to process ICMP msgs. passed up by IP.
1782  * Generates the appropriate T_UDERROR_IND for permanent (non-transient) errors.
1783  * Assumes that IP has pulled up everything up to and including the ICMP header.
1784  */
1785 static void
1786 udp_icmp_error(queue_t *q, mblk_t *mp)
1787 {
1788 	icmph_t *icmph;
1789 	ipha_t	*ipha;
1790 	int	iph_hdr_length;
1791 	udpha_t	*udpha;
1792 	sin_t	sin;
1793 	sin6_t	sin6;
1794 	mblk_t	*mp1;
1795 	int	error = 0;
1796 	udp_t	*udp = Q_TO_UDP(q);
1797 
1798 	ipha = (ipha_t *)mp->b_rptr;
1799 
1800 	ASSERT(OK_32PTR(mp->b_rptr));
1801 
1802 	if (IPH_HDR_VERSION(ipha) != IPV4_VERSION) {
1803 		ASSERT(IPH_HDR_VERSION(ipha) == IPV6_VERSION);
1804 		udp_icmp_error_ipv6(q, mp);
1805 		return;
1806 	}
1807 	ASSERT(IPH_HDR_VERSION(ipha) == IPV4_VERSION);
1808 
1809 	/* Skip past the outer IP and ICMP headers */
1810 	iph_hdr_length = IPH_HDR_LENGTH(ipha);
1811 	icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length];
1812 	ipha = (ipha_t *)&icmph[1];
1813 
1814 	/* Skip past the inner IP and find the ULP header */
1815 	iph_hdr_length = IPH_HDR_LENGTH(ipha);
1816 	udpha = (udpha_t *)((char *)ipha + iph_hdr_length);
1817 
1818 	switch (icmph->icmph_type) {
1819 	case ICMP_DEST_UNREACHABLE:
1820 		switch (icmph->icmph_code) {
1821 		case ICMP_FRAGMENTATION_NEEDED:
1822 			/*
1823 			 * IP has already adjusted the path MTU.
1824 			 */
1825 			break;
1826 		case ICMP_PORT_UNREACHABLE:
1827 		case ICMP_PROTOCOL_UNREACHABLE:
1828 			error = ECONNREFUSED;
1829 			break;
1830 		default:
1831 			/* Transient errors */
1832 			break;
1833 		}
1834 		break;
1835 	default:
1836 		/* Transient errors */
1837 		break;
1838 	}
1839 	if (error == 0) {
1840 		freemsg(mp);
1841 		return;
1842 	}
1843 
1844 	/*
1845 	 * Deliver T_UDERROR_IND when the application has asked for it.
1846 	 * The socket layer enables this automatically when connected.
1847 	 */
1848 	if (!udp->udp_dgram_errind) {
1849 		freemsg(mp);
1850 		return;
1851 	}
1852 
1853 	switch (udp->udp_family) {
1854 	case AF_INET:
1855 		sin = sin_null;
1856 		sin.sin_family = AF_INET;
1857 		sin.sin_addr.s_addr = ipha->ipha_dst;
1858 		sin.sin_port = udpha->uha_dst_port;
1859 		mp1 = mi_tpi_uderror_ind((char *)&sin, sizeof (sin_t), NULL, 0,
1860 		    error);
1861 		break;
1862 	case AF_INET6:
1863 		sin6 = sin6_null;
1864 		sin6.sin6_family = AF_INET6;
1865 		IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &sin6.sin6_addr);
1866 		sin6.sin6_port = udpha->uha_dst_port;
1867 
1868 		mp1 = mi_tpi_uderror_ind((char *)&sin6, sizeof (sin6_t),
1869 		    NULL, 0, error);
1870 		break;
1871 	}
1872 	if (mp1)
1873 		putnext(q, mp1);
1874 	freemsg(mp);
1875 }
1876 
1877 /*
1878  * udp_icmp_error_ipv6 is called by udp_icmp_error to process ICMP for IPv6.
1879  * Generates the appropriate T_UDERROR_IND for permanent (non-transient) errors.
1880  * Assumes that IP has pulled up all the extension headers as well as the
1881  * ICMPv6 header.
1882  */
1883 static void
1884 udp_icmp_error_ipv6(queue_t *q, mblk_t *mp)
1885 {
1886 	icmp6_t		*icmp6;
1887 	ip6_t		*ip6h, *outer_ip6h;
1888 	uint16_t	iph_hdr_length;
1889 	uint8_t		*nexthdrp;
1890 	udpha_t		*udpha;
1891 	sin6_t		sin6;
1892 	mblk_t		*mp1;
1893 	int		error = 0;
1894 	udp_t		*udp = Q_TO_UDP(q);
1895 	udp_stack_t	*us = udp->udp_us;
1896 
1897 	outer_ip6h = (ip6_t *)mp->b_rptr;
1898 	if (outer_ip6h->ip6_nxt != IPPROTO_ICMPV6)
1899 		iph_hdr_length = ip_hdr_length_v6(mp, outer_ip6h);
1900 	else
1901 		iph_hdr_length = IPV6_HDR_LEN;
1902 	icmp6 = (icmp6_t *)&mp->b_rptr[iph_hdr_length];
1903 	ip6h = (ip6_t *)&icmp6[1];
1904 	if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &iph_hdr_length, &nexthdrp)) {
1905 		freemsg(mp);
1906 		return;
1907 	}
1908 	udpha = (udpha_t *)((char *)ip6h + iph_hdr_length);
1909 
1910 	switch (icmp6->icmp6_type) {
1911 	case ICMP6_DST_UNREACH:
1912 		switch (icmp6->icmp6_code) {
1913 		case ICMP6_DST_UNREACH_NOPORT:
1914 			error = ECONNREFUSED;
1915 			break;
1916 		case ICMP6_DST_UNREACH_ADMIN:
1917 		case ICMP6_DST_UNREACH_NOROUTE:
1918 		case ICMP6_DST_UNREACH_BEYONDSCOPE:
1919 		case ICMP6_DST_UNREACH_ADDR:
1920 			/* Transient errors */
1921 			break;
1922 		default:
1923 			break;
1924 		}
1925 		break;
1926 	case ICMP6_PACKET_TOO_BIG: {
1927 		struct T_unitdata_ind	*tudi;
1928 		struct T_opthdr		*toh;
1929 		size_t			udi_size;
1930 		mblk_t			*newmp;
1931 		t_scalar_t		opt_length = sizeof (struct T_opthdr) +
1932 		    sizeof (struct ip6_mtuinfo);
1933 		sin6_t			*sin6;
1934 		struct ip6_mtuinfo	*mtuinfo;
1935 
1936 		/*
1937 		 * If the application has requested to receive path mtu
1938 		 * information, send up an empty message containing an
1939 		 * IPV6_PATHMTU ancillary data item.
1940 		 */
1941 		if (!udp->udp_ipv6_recvpathmtu)
1942 			break;
1943 
1944 		udi_size = sizeof (struct T_unitdata_ind) + sizeof (sin6_t) +
1945 		    opt_length;
1946 		if ((newmp = allocb(udi_size, BPRI_MED)) == NULL) {
1947 			BUMP_MIB(&us->us_udp_mib, udpInErrors);
1948 			break;
1949 		}
1950 
1951 		/*
1952 		 * newmp->b_cont is left to NULL on purpose.  This is an
1953 		 * empty message containing only ancillary data.
1954 		 */
1955 		newmp->b_datap->db_type = M_PROTO;
1956 		tudi = (struct T_unitdata_ind *)newmp->b_rptr;
1957 		newmp->b_wptr = (uchar_t *)tudi + udi_size;
1958 		tudi->PRIM_type = T_UNITDATA_IND;
1959 		tudi->SRC_length = sizeof (sin6_t);
1960 		tudi->SRC_offset = sizeof (struct T_unitdata_ind);
1961 		tudi->OPT_offset = tudi->SRC_offset + sizeof (sin6_t);
1962 		tudi->OPT_length = opt_length;
1963 
1964 		sin6 = (sin6_t *)&tudi[1];
1965 		bzero(sin6, sizeof (sin6_t));
1966 		sin6->sin6_family = AF_INET6;
1967 		sin6->sin6_addr = udp->udp_v6dst;
1968 
1969 		toh = (struct T_opthdr *)&sin6[1];
1970 		toh->level = IPPROTO_IPV6;
1971 		toh->name = IPV6_PATHMTU;
1972 		toh->len = opt_length;
1973 		toh->status = 0;
1974 
1975 		mtuinfo = (struct ip6_mtuinfo *)&toh[1];
1976 		bzero(mtuinfo, sizeof (struct ip6_mtuinfo));
1977 		mtuinfo->ip6m_addr.sin6_family = AF_INET6;
1978 		mtuinfo->ip6m_addr.sin6_addr = ip6h->ip6_dst;
1979 		mtuinfo->ip6m_mtu = icmp6->icmp6_mtu;
1980 		/*
1981 		 * We've consumed everything we need from the original
1982 		 * message.  Free it, then send our empty message.
1983 		 */
1984 		freemsg(mp);
1985 		putnext(q, newmp);
1986 		return;
1987 	}
1988 	case ICMP6_TIME_EXCEEDED:
1989 		/* Transient errors */
1990 		break;
1991 	case ICMP6_PARAM_PROB:
1992 		/* If this corresponds to an ICMP_PROTOCOL_UNREACHABLE */
1993 		if (icmp6->icmp6_code == ICMP6_PARAMPROB_NEXTHEADER &&
1994 		    (uchar_t *)ip6h + icmp6->icmp6_pptr ==
1995 		    (uchar_t *)nexthdrp) {
1996 			error = ECONNREFUSED;
1997 			break;
1998 		}
1999 		break;
2000 	}
2001 	if (error == 0) {
2002 		freemsg(mp);
2003 		return;
2004 	}
2005 
2006 	/*
2007 	 * Deliver T_UDERROR_IND when the application has asked for it.
2008 	 * The socket layer enables this automatically when connected.
2009 	 */
2010 	if (!udp->udp_dgram_errind) {
2011 		freemsg(mp);
2012 		return;
2013 	}
2014 
2015 	sin6 = sin6_null;
2016 	sin6.sin6_family = AF_INET6;
2017 	sin6.sin6_addr = ip6h->ip6_dst;
2018 	sin6.sin6_port = udpha->uha_dst_port;
2019 	sin6.sin6_flowinfo = ip6h->ip6_vcf & ~IPV6_VERS_AND_FLOW_MASK;
2020 
2021 	mp1 = mi_tpi_uderror_ind((char *)&sin6, sizeof (sin6_t), NULL, 0,
2022 	    error);
2023 	if (mp1)
2024 		putnext(q, mp1);
2025 	freemsg(mp);
2026 }
2027 
2028 /*
2029  * This routine responds to T_ADDR_REQ messages.  It is called by udp_wput.
2030  * The local address is filled in if endpoint is bound. The remote address
2031  * is filled in if remote address has been precified ("connected endpoint")
2032  * (The concept of connected CLTS sockets is alien to published TPI
2033  *  but we support it anyway).
2034  */
2035 static void
2036 udp_addr_req(queue_t *q, mblk_t *mp)
2037 {
2038 	sin_t	*sin;
2039 	sin6_t	*sin6;
2040 	mblk_t	*ackmp;
2041 	struct T_addr_ack *taa;
2042 	udp_t	*udp = Q_TO_UDP(q);
2043 
2044 	/* Make it large enough for worst case */
2045 	ackmp = reallocb(mp, sizeof (struct T_addr_ack) +
2046 	    2 * sizeof (sin6_t), 1);
2047 	if (ackmp == NULL) {
2048 		udp_err_ack(q, mp, TSYSERR, ENOMEM);
2049 		return;
2050 	}
2051 	taa = (struct T_addr_ack *)ackmp->b_rptr;
2052 
2053 	bzero(taa, sizeof (struct T_addr_ack));
2054 	ackmp->b_wptr = (uchar_t *)&taa[1];
2055 
2056 	taa->PRIM_type = T_ADDR_ACK;
2057 	ackmp->b_datap->db_type = M_PCPROTO;
2058 	rw_enter(&udp->udp_rwlock, RW_READER);
2059 	/*
2060 	 * Note: Following code assumes 32 bit alignment of basic
2061 	 * data structures like sin_t and struct T_addr_ack.
2062 	 */
2063 	if (udp->udp_state != TS_UNBND) {
2064 		/*
2065 		 * Fill in local address first
2066 		 */
2067 		taa->LOCADDR_offset = sizeof (*taa);
2068 		if (udp->udp_family == AF_INET) {
2069 			taa->LOCADDR_length = sizeof (sin_t);
2070 			sin = (sin_t *)&taa[1];
2071 			/* Fill zeroes and then initialize non-zero fields */
2072 			*sin = sin_null;
2073 			sin->sin_family = AF_INET;
2074 			if (!IN6_IS_ADDR_V4MAPPED_ANY(&udp->udp_v6src) &&
2075 			    !IN6_IS_ADDR_UNSPECIFIED(&udp->udp_v6src)) {
2076 				IN6_V4MAPPED_TO_IPADDR(&udp->udp_v6src,
2077 				    sin->sin_addr.s_addr);
2078 			} else {
2079 				/*
2080 				 * INADDR_ANY
2081 				 * udp_v6src is not set, we might be bound to
2082 				 * broadcast/multicast. Use udp_bound_v6src as
2083 				 * local address instead (that could
2084 				 * also still be INADDR_ANY)
2085 				 */
2086 				IN6_V4MAPPED_TO_IPADDR(&udp->udp_bound_v6src,
2087 				    sin->sin_addr.s_addr);
2088 			}
2089 			sin->sin_port = udp->udp_port;
2090 			ackmp->b_wptr = (uchar_t *)&sin[1];
2091 			if (udp->udp_state == TS_DATA_XFER) {
2092 				/*
2093 				 * connected, fill remote address too
2094 				 */
2095 				taa->REMADDR_length = sizeof (sin_t);
2096 				/* assumed 32-bit alignment */
2097 				taa->REMADDR_offset = taa->LOCADDR_offset +
2098 				    taa->LOCADDR_length;
2099 
2100 				sin = (sin_t *)(ackmp->b_rptr +
2101 				    taa->REMADDR_offset);
2102 				/* initialize */
2103 				*sin = sin_null;
2104 				sin->sin_family = AF_INET;
2105 				sin->sin_addr.s_addr =
2106 				    V4_PART_OF_V6(udp->udp_v6dst);
2107 				sin->sin_port = udp->udp_dstport;
2108 				ackmp->b_wptr = (uchar_t *)&sin[1];
2109 			}
2110 		} else {
2111 			taa->LOCADDR_length = sizeof (sin6_t);
2112 			sin6 = (sin6_t *)&taa[1];
2113 			/* Fill zeroes and then initialize non-zero fields */
2114 			*sin6 = sin6_null;
2115 			sin6->sin6_family = AF_INET6;
2116 			if (!IN6_IS_ADDR_UNSPECIFIED(&udp->udp_v6src)) {
2117 				sin6->sin6_addr = udp->udp_v6src;
2118 			} else {
2119 				/*
2120 				 * UNSPECIFIED
2121 				 * udp_v6src is not set, we might be bound to
2122 				 * broadcast/multicast. Use udp_bound_v6src as
2123 				 * local address instead (that could
2124 				 * also still be UNSPECIFIED)
2125 				 */
2126 				sin6->sin6_addr =
2127 				    udp->udp_bound_v6src;
2128 			}
2129 			sin6->sin6_port = udp->udp_port;
2130 			ackmp->b_wptr = (uchar_t *)&sin6[1];
2131 			if (udp->udp_state == TS_DATA_XFER) {
2132 				/*
2133 				 * connected, fill remote address too
2134 				 */
2135 				taa->REMADDR_length = sizeof (sin6_t);
2136 				/* assumed 32-bit alignment */
2137 				taa->REMADDR_offset = taa->LOCADDR_offset +
2138 				    taa->LOCADDR_length;
2139 
2140 				sin6 = (sin6_t *)(ackmp->b_rptr +
2141 				    taa->REMADDR_offset);
2142 				/* initialize */
2143 				*sin6 = sin6_null;
2144 				sin6->sin6_family = AF_INET6;
2145 				sin6->sin6_addr = udp->udp_v6dst;
2146 				sin6->sin6_port =  udp->udp_dstport;
2147 				ackmp->b_wptr = (uchar_t *)&sin6[1];
2148 			}
2149 			ackmp->b_wptr = (uchar_t *)&sin6[1];
2150 		}
2151 	}
2152 	rw_exit(&udp->udp_rwlock);
2153 	ASSERT(ackmp->b_wptr <= ackmp->b_datap->db_lim);
2154 	qreply(q, ackmp);
2155 }
2156 
2157 static void
2158 udp_copy_info(struct T_info_ack *tap, udp_t *udp)
2159 {
2160 	if (udp->udp_family == AF_INET) {
2161 		*tap = udp_g_t_info_ack_ipv4;
2162 	} else {
2163 		*tap = udp_g_t_info_ack_ipv6;
2164 	}
2165 	tap->CURRENT_state = udp->udp_state;
2166 	tap->OPT_size = udp_max_optsize;
2167 }
2168 
2169 /*
2170  * This routine responds to T_CAPABILITY_REQ messages.  It is called by
2171  * udp_wput.  Much of the T_CAPABILITY_ACK information is copied from
2172  * udp_g_t_info_ack.  The current state of the stream is copied from
2173  * udp_state.
2174  */
2175 static void
2176 udp_capability_req(queue_t *q, mblk_t *mp)
2177 {
2178 	t_uscalar_t		cap_bits1;
2179 	struct T_capability_ack	*tcap;
2180 	udp_t	*udp = Q_TO_UDP(q);
2181 
2182 	cap_bits1 = ((struct T_capability_req *)mp->b_rptr)->CAP_bits1;
2183 
2184 	mp = tpi_ack_alloc(mp, sizeof (struct T_capability_ack),
2185 	    mp->b_datap->db_type, T_CAPABILITY_ACK);
2186 	if (!mp)
2187 		return;
2188 
2189 	tcap = (struct T_capability_ack *)mp->b_rptr;
2190 	tcap->CAP_bits1 = 0;
2191 
2192 	if (cap_bits1 & TC1_INFO) {
2193 		udp_copy_info(&tcap->INFO_ack, udp);
2194 		tcap->CAP_bits1 |= TC1_INFO;
2195 	}
2196 
2197 	qreply(q, mp);
2198 }
2199 
2200 /*
2201  * This routine responds to T_INFO_REQ messages.  It is called by udp_wput.
2202  * Most of the T_INFO_ACK information is copied from udp_g_t_info_ack.
2203  * The current state of the stream is copied from udp_state.
2204  */
2205 static void
2206 udp_info_req(queue_t *q, mblk_t *mp)
2207 {
2208 	udp_t *udp = Q_TO_UDP(q);
2209 
2210 	/* Create a T_INFO_ACK message. */
2211 	mp = tpi_ack_alloc(mp, sizeof (struct T_info_ack), M_PCPROTO,
2212 	    T_INFO_ACK);
2213 	if (!mp)
2214 		return;
2215 	udp_copy_info((struct T_info_ack *)mp->b_rptr, udp);
2216 	qreply(q, mp);
2217 }
2218 
2219 /*
2220  * IP recognizes seven kinds of bind requests:
2221  *
2222  * - A zero-length address binds only to the protocol number.
2223  *
2224  * - A 4-byte address is treated as a request to
2225  * validate that the address is a valid local IPv4
2226  * address, appropriate for an application to bind to.
2227  * IP does the verification, but does not make any note
2228  * of the address at this time.
2229  *
2230  * - A 16-byte address contains is treated as a request
2231  * to validate a local IPv6 address, as the 4-byte
2232  * address case above.
2233  *
2234  * - A 16-byte sockaddr_in to validate the local IPv4 address and also
2235  * use it for the inbound fanout of packets.
2236  *
2237  * - A 24-byte sockaddr_in6 to validate the local IPv6 address and also
2238  * use it for the inbound fanout of packets.
2239  *
2240  * - A 12-byte address (ipa_conn_t) containing complete IPv4 fanout
2241  * information consisting of local and remote addresses
2242  * and ports.  In this case, the addresses are both
2243  * validated as appropriate for this operation, and, if
2244  * so, the information is retained for use in the
2245  * inbound fanout.
2246  *
2247  * - A 36-byte address address (ipa6_conn_t) containing complete IPv6
2248  * fanout information, like the 12-byte case above.
2249  *
2250  * IP will also fill in the IRE request mblk with information
2251  * regarding our peer.  In all cases, we notify IP of our protocol
2252  * type by appending a single protocol byte to the bind request.
2253  */
2254 static mblk_t *
2255 udp_ip_bind_mp(udp_t *udp, t_scalar_t bind_prim, t_scalar_t addr_length)
2256 {
2257 	char	*cp;
2258 	mblk_t	*mp;
2259 	struct T_bind_req *tbr;
2260 	ipa_conn_t	*ac;
2261 	ipa6_conn_t	*ac6;
2262 	sin_t		*sin;
2263 	sin6_t		*sin6;
2264 
2265 	ASSERT(bind_prim == O_T_BIND_REQ || bind_prim == T_BIND_REQ);
2266 	ASSERT(RW_LOCK_HELD(&udp->udp_rwlock));
2267 	mp = allocb(sizeof (*tbr) + addr_length + 1, BPRI_HI);
2268 	if (!mp)
2269 		return (mp);
2270 	mp->b_datap->db_type = M_PROTO;
2271 	tbr = (struct T_bind_req *)mp->b_rptr;
2272 	tbr->PRIM_type = bind_prim;
2273 	tbr->ADDR_offset = sizeof (*tbr);
2274 	tbr->CONIND_number = 0;
2275 	tbr->ADDR_length = addr_length;
2276 	cp = (char *)&tbr[1];
2277 	switch (addr_length) {
2278 	case sizeof (ipa_conn_t):
2279 		ASSERT(udp->udp_family == AF_INET);
2280 		/* Append a request for an IRE */
2281 		mp->b_cont = allocb(sizeof (ire_t), BPRI_HI);
2282 		if (!mp->b_cont) {
2283 			freemsg(mp);
2284 			return (NULL);
2285 		}
2286 		mp->b_cont->b_wptr += sizeof (ire_t);
2287 		mp->b_cont->b_datap->db_type = IRE_DB_REQ_TYPE;
2288 
2289 		/* cp known to be 32 bit aligned */
2290 		ac = (ipa_conn_t *)cp;
2291 		ac->ac_laddr = V4_PART_OF_V6(udp->udp_v6src);
2292 		ac->ac_faddr = V4_PART_OF_V6(udp->udp_v6dst);
2293 		ac->ac_fport = udp->udp_dstport;
2294 		ac->ac_lport = udp->udp_port;
2295 		break;
2296 
2297 	case sizeof (ipa6_conn_t):
2298 		ASSERT(udp->udp_family == AF_INET6);
2299 		/* Append a request for an IRE */
2300 		mp->b_cont = allocb(sizeof (ire_t), BPRI_HI);
2301 		if (!mp->b_cont) {
2302 			freemsg(mp);
2303 			return (NULL);
2304 		}
2305 		mp->b_cont->b_wptr += sizeof (ire_t);
2306 		mp->b_cont->b_datap->db_type = IRE_DB_REQ_TYPE;
2307 
2308 		/* cp known to be 32 bit aligned */
2309 		ac6 = (ipa6_conn_t *)cp;
2310 		ac6->ac6_laddr = udp->udp_v6src;
2311 		ac6->ac6_faddr = udp->udp_v6dst;
2312 		ac6->ac6_fport = udp->udp_dstport;
2313 		ac6->ac6_lport = udp->udp_port;
2314 		break;
2315 
2316 	case sizeof (sin_t):
2317 		ASSERT(udp->udp_family == AF_INET);
2318 		/* Append a request for an IRE */
2319 		mp->b_cont = allocb(sizeof (ire_t), BPRI_HI);
2320 		if (!mp->b_cont) {
2321 			freemsg(mp);
2322 			return (NULL);
2323 		}
2324 		mp->b_cont->b_wptr += sizeof (ire_t);
2325 		mp->b_cont->b_datap->db_type = IRE_DB_REQ_TYPE;
2326 
2327 		sin = (sin_t *)cp;
2328 		*sin = sin_null;
2329 		sin->sin_family = AF_INET;
2330 		sin->sin_addr.s_addr = V4_PART_OF_V6(udp->udp_bound_v6src);
2331 		sin->sin_port = udp->udp_port;
2332 		break;
2333 
2334 	case sizeof (sin6_t):
2335 		ASSERT(udp->udp_family == AF_INET6);
2336 		/* Append a request for an IRE */
2337 		mp->b_cont = allocb(sizeof (ire_t), BPRI_HI);
2338 		if (!mp->b_cont) {
2339 			freemsg(mp);
2340 			return (NULL);
2341 		}
2342 		mp->b_cont->b_wptr += sizeof (ire_t);
2343 		mp->b_cont->b_datap->db_type = IRE_DB_REQ_TYPE;
2344 
2345 		sin6 = (sin6_t *)cp;
2346 		*sin6 = sin6_null;
2347 		sin6->sin6_family = AF_INET6;
2348 		sin6->sin6_addr = udp->udp_bound_v6src;
2349 		sin6->sin6_port = udp->udp_port;
2350 		break;
2351 	}
2352 	/* Add protocol number to end */
2353 	cp[addr_length] = (char)IPPROTO_UDP;
2354 	mp->b_wptr = (uchar_t *)&cp[addr_length + 1];
2355 	return (mp);
2356 }
2357 
2358 /* For /dev/udp aka AF_INET open */
2359 static int
2360 udp_openv4(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp)
2361 {
2362 	return (udp_open(q, devp, flag, sflag, credp, B_FALSE));
2363 }
2364 
2365 /* For /dev/udp6 aka AF_INET6 open */
2366 static int
2367 udp_openv6(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp)
2368 {
2369 	return (udp_open(q, devp, flag, sflag, credp, B_TRUE));
2370 }
2371 
2372 /*
2373  * This is the open routine for udp.  It allocates a udp_t structure for
2374  * the stream and, on the first open of the module, creates an ND table.
2375  */
2376 /*ARGSUSED2*/
2377 static int
2378 udp_open(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp,
2379     boolean_t isv6)
2380 {
2381 	int	err;
2382 	udp_t	*udp;
2383 	conn_t *connp;
2384 	dev_t	conn_dev;
2385 	zoneid_t zoneid;
2386 	netstack_t *ns;
2387 	udp_stack_t *us;
2388 
2389 	TRACE_1(TR_FAC_UDP, TR_UDP_OPEN, "udp_open: q %p", q);
2390 
2391 	/* If the stream is already open, return immediately. */
2392 	if (q->q_ptr != NULL)
2393 		return (0);
2394 
2395 	if (sflag == MODOPEN)
2396 		return (EINVAL);
2397 
2398 	ns = netstack_find_by_cred(credp);
2399 	ASSERT(ns != NULL);
2400 	us = ns->netstack_udp;
2401 	ASSERT(us != NULL);
2402 
2403 	/*
2404 	 * For exclusive stacks we set the zoneid to zero
2405 	 * to make UDP operate as if in the global zone.
2406 	 */
2407 	if (ns->netstack_stackid != GLOBAL_NETSTACKID)
2408 		zoneid = GLOBAL_ZONEID;
2409 	else
2410 		zoneid = crgetzoneid(credp);
2411 
2412 	if ((conn_dev = inet_minor_alloc(ip_minor_arena)) == 0) {
2413 		netstack_rele(ns);
2414 		return (EBUSY);
2415 	}
2416 	*devp = makedevice(getemajor(*devp), (minor_t)conn_dev);
2417 
2418 	connp = ipcl_conn_create(IPCL_UDPCONN, KM_SLEEP, ns);
2419 	connp->conn_dev = conn_dev;
2420 	udp = connp->conn_udp;
2421 
2422 	/*
2423 	 * ipcl_conn_create did a netstack_hold. Undo the hold that was
2424 	 * done by netstack_find_by_cred()
2425 	 */
2426 	netstack_rele(ns);
2427 
2428 	/*
2429 	 * Initialize the udp_t structure for this stream.
2430 	 */
2431 	q->q_ptr = connp;
2432 	WR(q)->q_ptr = connp;
2433 	connp->conn_rq = q;
2434 	connp->conn_wq = WR(q);
2435 
2436 	rw_enter(&udp->udp_rwlock, RW_WRITER);
2437 	ASSERT(connp->conn_ulp == IPPROTO_UDP);
2438 	ASSERT(connp->conn_udp == udp);
2439 	ASSERT(udp->udp_connp == connp);
2440 
2441 	/* Set the initial state of the stream and the privilege status. */
2442 	udp->udp_state = TS_UNBND;
2443 	if (isv6) {
2444 		udp->udp_family = AF_INET6;
2445 		udp->udp_ipversion = IPV6_VERSION;
2446 		udp->udp_max_hdr_len = IPV6_HDR_LEN + UDPH_SIZE;
2447 		udp->udp_ttl = us->us_ipv6_hoplimit;
2448 		connp->conn_af_isv6 = B_TRUE;
2449 		connp->conn_flags |= IPCL_ISV6;
2450 	} else {
2451 		udp->udp_family = AF_INET;
2452 		udp->udp_ipversion = IPV4_VERSION;
2453 		udp->udp_max_hdr_len = IP_SIMPLE_HDR_LENGTH + UDPH_SIZE;
2454 		udp->udp_ttl = us->us_ipv4_ttl;
2455 		connp->conn_af_isv6 = B_FALSE;
2456 		connp->conn_flags &= ~IPCL_ISV6;
2457 	}
2458 
2459 	udp->udp_multicast_ttl = IP_DEFAULT_MULTICAST_TTL;
2460 	udp->udp_pending_op = -1;
2461 	connp->conn_multicast_loop = IP_DEFAULT_MULTICAST_LOOP;
2462 	connp->conn_zoneid = zoneid;
2463 
2464 	udp->udp_open_time = lbolt64;
2465 	udp->udp_open_pid = curproc->p_pid;
2466 
2467 	/*
2468 	 * If the caller has the process-wide flag set, then default to MAC
2469 	 * exempt mode.  This allows read-down to unlabeled hosts.
2470 	 */
2471 	if (getpflags(NET_MAC_AWARE, credp) != 0)
2472 		udp->udp_mac_exempt = B_TRUE;
2473 
2474 	if (flag & SO_SOCKSTR) {
2475 		connp->conn_flags |= IPCL_SOCKET;
2476 		udp->udp_issocket = B_TRUE;
2477 		udp->udp_direct_sockfs = B_TRUE;
2478 	}
2479 
2480 	connp->conn_ulp_labeled = is_system_labeled();
2481 
2482 	udp->udp_us = us;
2483 
2484 	q->q_hiwat = us->us_recv_hiwat;
2485 	WR(q)->q_hiwat = us->us_xmit_hiwat;
2486 	WR(q)->q_lowat = us->us_xmit_lowat;
2487 
2488 	connp->conn_recv = udp_input;
2489 	crhold(credp);
2490 	connp->conn_cred = credp;
2491 
2492 	mutex_enter(&connp->conn_lock);
2493 	connp->conn_state_flags &= ~CONN_INCIPIENT;
2494 	mutex_exit(&connp->conn_lock);
2495 
2496 	qprocson(q);
2497 
2498 	if (udp->udp_family == AF_INET6) {
2499 		/* Build initial header template for transmit */
2500 		if ((err = udp_build_hdrs(udp)) != 0) {
2501 			rw_exit(&udp->udp_rwlock);
2502 			qprocsoff(q);
2503 			ipcl_conn_destroy(connp);
2504 			return (err);
2505 		}
2506 	}
2507 	rw_exit(&udp->udp_rwlock);
2508 
2509 	/* Set the Stream head write offset and high watermark. */
2510 	(void) mi_set_sth_wroff(q,
2511 	    udp->udp_max_hdr_len + us->us_wroff_extra);
2512 	(void) mi_set_sth_hiwat(q, udp_set_rcv_hiwat(udp, q->q_hiwat));
2513 
2514 	return (0);
2515 }
2516 
2517 /*
2518  * Which UDP options OK to set through T_UNITDATA_REQ...
2519  */
2520 /* ARGSUSED */
2521 static boolean_t
2522 udp_opt_allow_udr_set(t_scalar_t level, t_scalar_t name)
2523 {
2524 	return (B_TRUE);
2525 }
2526 
2527 /*
2528  * This routine gets default values of certain options whose default
2529  * values are maintained by protcol specific code
2530  */
2531 /* ARGSUSED */
2532 int
2533 udp_opt_default(queue_t *q, t_scalar_t level, t_scalar_t name, uchar_t *ptr)
2534 {
2535 	udp_t		*udp = Q_TO_UDP(q);
2536 	udp_stack_t *us = udp->udp_us;
2537 	int *i1 = (int *)ptr;
2538 
2539 	switch (level) {
2540 	case IPPROTO_IP:
2541 		switch (name) {
2542 		case IP_MULTICAST_TTL:
2543 			*ptr = (uchar_t)IP_DEFAULT_MULTICAST_TTL;
2544 			return (sizeof (uchar_t));
2545 		case IP_MULTICAST_LOOP:
2546 			*ptr = (uchar_t)IP_DEFAULT_MULTICAST_LOOP;
2547 			return (sizeof (uchar_t));
2548 		}
2549 		break;
2550 	case IPPROTO_IPV6:
2551 		switch (name) {
2552 		case IPV6_MULTICAST_HOPS:
2553 			*i1 = IP_DEFAULT_MULTICAST_TTL;
2554 			return (sizeof (int));
2555 		case IPV6_MULTICAST_LOOP:
2556 			*i1 = IP_DEFAULT_MULTICAST_LOOP;
2557 			return (sizeof (int));
2558 		case IPV6_UNICAST_HOPS:
2559 			*i1 = us->us_ipv6_hoplimit;
2560 			return (sizeof (int));
2561 		}
2562 		break;
2563 	}
2564 	return (-1);
2565 }
2566 
2567 /*
2568  * This routine retrieves the current status of socket options.
2569  * It returns the size of the option retrieved.
2570  */
2571 int
2572 udp_opt_get_locked(queue_t *q, t_scalar_t level, t_scalar_t name, uchar_t *ptr)
2573 {
2574 	int	*i1 = (int *)ptr;
2575 	conn_t	*connp;
2576 	udp_t	*udp;
2577 	ip6_pkt_t *ipp;
2578 	int	len;
2579 	udp_stack_t	*us;
2580 
2581 	connp = Q_TO_CONN(q);
2582 	udp = connp->conn_udp;
2583 	ipp = &udp->udp_sticky_ipp;
2584 	us = udp->udp_us;
2585 
2586 	switch (level) {
2587 	case SOL_SOCKET:
2588 		switch (name) {
2589 		case SO_DEBUG:
2590 			*i1 = udp->udp_debug;
2591 			break;	/* goto sizeof (int) option return */
2592 		case SO_REUSEADDR:
2593 			*i1 = udp->udp_reuseaddr;
2594 			break;	/* goto sizeof (int) option return */
2595 		case SO_TYPE:
2596 			*i1 = SOCK_DGRAM;
2597 			break;	/* goto sizeof (int) option return */
2598 
2599 		/*
2600 		 * The following three items are available here,
2601 		 * but are only meaningful to IP.
2602 		 */
2603 		case SO_DONTROUTE:
2604 			*i1 = udp->udp_dontroute;
2605 			break;	/* goto sizeof (int) option return */
2606 		case SO_USELOOPBACK:
2607 			*i1 = udp->udp_useloopback;
2608 			break;	/* goto sizeof (int) option return */
2609 		case SO_BROADCAST:
2610 			*i1 = udp->udp_broadcast;
2611 			break;	/* goto sizeof (int) option return */
2612 
2613 		case SO_SNDBUF:
2614 			*i1 = q->q_hiwat;
2615 			break;	/* goto sizeof (int) option return */
2616 		case SO_RCVBUF:
2617 			*i1 = RD(q)->q_hiwat;
2618 			break;	/* goto sizeof (int) option return */
2619 		case SO_DGRAM_ERRIND:
2620 			*i1 = udp->udp_dgram_errind;
2621 			break;	/* goto sizeof (int) option return */
2622 		case SO_RECVUCRED:
2623 			*i1 = udp->udp_recvucred;
2624 			break;	/* goto sizeof (int) option return */
2625 		case SO_TIMESTAMP:
2626 			*i1 = udp->udp_timestamp;
2627 			break;	/* goto sizeof (int) option return */
2628 		case SO_ANON_MLP:
2629 			*i1 = udp->udp_anon_mlp;
2630 			break;	/* goto sizeof (int) option return */
2631 		case SO_MAC_EXEMPT:
2632 			*i1 = udp->udp_mac_exempt;
2633 			break;	/* goto sizeof (int) option return */
2634 		case SO_ALLZONES:
2635 			*i1 = connp->conn_allzones;
2636 			break;	/* goto sizeof (int) option return */
2637 		case SO_EXCLBIND:
2638 			*i1 = udp->udp_exclbind ? SO_EXCLBIND : 0;
2639 			break;
2640 		case SO_PROTOTYPE:
2641 			*i1 = IPPROTO_UDP;
2642 			break;
2643 		case SO_DOMAIN:
2644 			*i1 = udp->udp_family;
2645 			break;
2646 		default:
2647 			return (-1);
2648 		}
2649 		break;
2650 	case IPPROTO_IP:
2651 		if (udp->udp_family != AF_INET)
2652 			return (-1);
2653 		switch (name) {
2654 		case IP_OPTIONS:
2655 		case T_IP_OPTIONS:
2656 			len = udp->udp_ip_rcv_options_len - udp->udp_label_len;
2657 			if (len > 0) {
2658 				bcopy(udp->udp_ip_rcv_options +
2659 				    udp->udp_label_len, ptr, len);
2660 			}
2661 			return (len);
2662 		case IP_TOS:
2663 		case T_IP_TOS:
2664 			*i1 = (int)udp->udp_type_of_service;
2665 			break;	/* goto sizeof (int) option return */
2666 		case IP_TTL:
2667 			*i1 = (int)udp->udp_ttl;
2668 			break;	/* goto sizeof (int) option return */
2669 		case IP_DHCPINIT_IF:
2670 			return (-EINVAL);
2671 		case IP_NEXTHOP:
2672 		case IP_RECVPKTINFO:
2673 			/*
2674 			 * This also handles IP_PKTINFO.
2675 			 * IP_PKTINFO and IP_RECVPKTINFO have the same value.
2676 			 * Differentiation is based on the size of the argument
2677 			 * passed in.
2678 			 * This option is handled in IP which will return an
2679 			 * error for IP_PKTINFO as it's not supported as a
2680 			 * sticky option.
2681 			 */
2682 			return (-EINVAL);
2683 		case IP_MULTICAST_IF:
2684 			/* 0 address if not set */
2685 			*(ipaddr_t *)ptr = udp->udp_multicast_if_addr;
2686 			return (sizeof (ipaddr_t));
2687 		case IP_MULTICAST_TTL:
2688 			*(uchar_t *)ptr = udp->udp_multicast_ttl;
2689 			return (sizeof (uchar_t));
2690 		case IP_MULTICAST_LOOP:
2691 			*ptr = connp->conn_multicast_loop;
2692 			return (sizeof (uint8_t));
2693 		case IP_RECVOPTS:
2694 			*i1 = udp->udp_recvopts;
2695 			break;	/* goto sizeof (int) option return */
2696 		case IP_RECVDSTADDR:
2697 			*i1 = udp->udp_recvdstaddr;
2698 			break;	/* goto sizeof (int) option return */
2699 		case IP_RECVIF:
2700 			*i1 = udp->udp_recvif;
2701 			break;	/* goto sizeof (int) option return */
2702 		case IP_RECVSLLA:
2703 			*i1 = udp->udp_recvslla;
2704 			break;	/* goto sizeof (int) option return */
2705 		case IP_RECVTTL:
2706 			*i1 = udp->udp_recvttl;
2707 			break;	/* goto sizeof (int) option return */
2708 		case IP_ADD_MEMBERSHIP:
2709 		case IP_DROP_MEMBERSHIP:
2710 		case IP_BLOCK_SOURCE:
2711 		case IP_UNBLOCK_SOURCE:
2712 		case IP_ADD_SOURCE_MEMBERSHIP:
2713 		case IP_DROP_SOURCE_MEMBERSHIP:
2714 		case MCAST_JOIN_GROUP:
2715 		case MCAST_LEAVE_GROUP:
2716 		case MCAST_BLOCK_SOURCE:
2717 		case MCAST_UNBLOCK_SOURCE:
2718 		case MCAST_JOIN_SOURCE_GROUP:
2719 		case MCAST_LEAVE_SOURCE_GROUP:
2720 		case IP_DONTFAILOVER_IF:
2721 			/* cannot "get" the value for these */
2722 			return (-1);
2723 		case IP_BOUND_IF:
2724 			/* Zero if not set */
2725 			*i1 = udp->udp_bound_if;
2726 			break;	/* goto sizeof (int) option return */
2727 		case IP_UNSPEC_SRC:
2728 			*i1 = udp->udp_unspec_source;
2729 			break;	/* goto sizeof (int) option return */
2730 		default:
2731 			return (-1);
2732 		}
2733 		break;
2734 	case IPPROTO_IPV6:
2735 		if (udp->udp_family != AF_INET6)
2736 			return (-1);
2737 		switch (name) {
2738 		case IPV6_UNICAST_HOPS:
2739 			*i1 = (unsigned int)udp->udp_ttl;
2740 			break;	/* goto sizeof (int) option return */
2741 		case IPV6_MULTICAST_IF:
2742 			/* 0 index if not set */
2743 			*i1 = udp->udp_multicast_if_index;
2744 			break;	/* goto sizeof (int) option return */
2745 		case IPV6_MULTICAST_HOPS:
2746 			*i1 = udp->udp_multicast_ttl;
2747 			break;	/* goto sizeof (int) option return */
2748 		case IPV6_MULTICAST_LOOP:
2749 			*i1 = connp->conn_multicast_loop;
2750 			break;	/* goto sizeof (int) option return */
2751 		case IPV6_JOIN_GROUP:
2752 		case IPV6_LEAVE_GROUP:
2753 		case MCAST_JOIN_GROUP:
2754 		case MCAST_LEAVE_GROUP:
2755 		case MCAST_BLOCK_SOURCE:
2756 		case MCAST_UNBLOCK_SOURCE:
2757 		case MCAST_JOIN_SOURCE_GROUP:
2758 		case MCAST_LEAVE_SOURCE_GROUP:
2759 			/* cannot "get" the value for these */
2760 			return (-1);
2761 		case IPV6_BOUND_IF:
2762 			/* Zero if not set */
2763 			*i1 = udp->udp_bound_if;
2764 			break;	/* goto sizeof (int) option return */
2765 		case IPV6_UNSPEC_SRC:
2766 			*i1 = udp->udp_unspec_source;
2767 			break;	/* goto sizeof (int) option return */
2768 		case IPV6_RECVPKTINFO:
2769 			*i1 = udp->udp_ip_recvpktinfo;
2770 			break;	/* goto sizeof (int) option return */
2771 		case IPV6_RECVTCLASS:
2772 			*i1 = udp->udp_ipv6_recvtclass;
2773 			break;	/* goto sizeof (int) option return */
2774 		case IPV6_RECVPATHMTU:
2775 			*i1 = udp->udp_ipv6_recvpathmtu;
2776 			break;	/* goto sizeof (int) option return */
2777 		case IPV6_RECVHOPLIMIT:
2778 			*i1 = udp->udp_ipv6_recvhoplimit;
2779 			break;	/* goto sizeof (int) option return */
2780 		case IPV6_RECVHOPOPTS:
2781 			*i1 = udp->udp_ipv6_recvhopopts;
2782 			break;	/* goto sizeof (int) option return */
2783 		case IPV6_RECVDSTOPTS:
2784 			*i1 = udp->udp_ipv6_recvdstopts;
2785 			break;	/* goto sizeof (int) option return */
2786 		case _OLD_IPV6_RECVDSTOPTS:
2787 			*i1 = udp->udp_old_ipv6_recvdstopts;
2788 			break;	/* goto sizeof (int) option return */
2789 		case IPV6_RECVRTHDRDSTOPTS:
2790 			*i1 = udp->udp_ipv6_recvrthdrdstopts;
2791 			break;	/* goto sizeof (int) option return */
2792 		case IPV6_RECVRTHDR:
2793 			*i1 = udp->udp_ipv6_recvrthdr;
2794 			break;	/* goto sizeof (int) option return */
2795 		case IPV6_PKTINFO: {
2796 			/* XXX assumes that caller has room for max size! */
2797 			struct in6_pktinfo *pkti;
2798 
2799 			pkti = (struct in6_pktinfo *)ptr;
2800 			if (ipp->ipp_fields & IPPF_IFINDEX)
2801 				pkti->ipi6_ifindex = ipp->ipp_ifindex;
2802 			else
2803 				pkti->ipi6_ifindex = 0;
2804 			if (ipp->ipp_fields & IPPF_ADDR)
2805 				pkti->ipi6_addr = ipp->ipp_addr;
2806 			else
2807 				pkti->ipi6_addr = ipv6_all_zeros;
2808 			return (sizeof (struct in6_pktinfo));
2809 		}
2810 		case IPV6_TCLASS:
2811 			if (ipp->ipp_fields & IPPF_TCLASS)
2812 				*i1 = ipp->ipp_tclass;
2813 			else
2814 				*i1 = IPV6_FLOW_TCLASS(
2815 				    IPV6_DEFAULT_VERS_AND_FLOW);
2816 			break;	/* goto sizeof (int) option return */
2817 		case IPV6_NEXTHOP: {
2818 			sin6_t *sin6 = (sin6_t *)ptr;
2819 
2820 			if (!(ipp->ipp_fields & IPPF_NEXTHOP))
2821 				return (0);
2822 			*sin6 = sin6_null;
2823 			sin6->sin6_family = AF_INET6;
2824 			sin6->sin6_addr = ipp->ipp_nexthop;
2825 			return (sizeof (sin6_t));
2826 		}
2827 		case IPV6_HOPOPTS:
2828 			if (!(ipp->ipp_fields & IPPF_HOPOPTS))
2829 				return (0);
2830 			if (ipp->ipp_hopoptslen <= udp->udp_label_len_v6)
2831 				return (0);
2832 			/*
2833 			 * The cipso/label option is added by kernel.
2834 			 * User is not usually aware of this option.
2835 			 * We copy out the hbh opt after the label option.
2836 			 */
2837 			bcopy((char *)ipp->ipp_hopopts + udp->udp_label_len_v6,
2838 			    ptr, ipp->ipp_hopoptslen - udp->udp_label_len_v6);
2839 			if (udp->udp_label_len_v6 > 0) {
2840 				ptr[0] = ((char *)ipp->ipp_hopopts)[0];
2841 				ptr[1] = (ipp->ipp_hopoptslen -
2842 				    udp->udp_label_len_v6 + 7) / 8 - 1;
2843 			}
2844 			return (ipp->ipp_hopoptslen - udp->udp_label_len_v6);
2845 		case IPV6_RTHDRDSTOPTS:
2846 			if (!(ipp->ipp_fields & IPPF_RTDSTOPTS))
2847 				return (0);
2848 			bcopy(ipp->ipp_rtdstopts, ptr, ipp->ipp_rtdstoptslen);
2849 			return (ipp->ipp_rtdstoptslen);
2850 		case IPV6_RTHDR:
2851 			if (!(ipp->ipp_fields & IPPF_RTHDR))
2852 				return (0);
2853 			bcopy(ipp->ipp_rthdr, ptr, ipp->ipp_rthdrlen);
2854 			return (ipp->ipp_rthdrlen);
2855 		case IPV6_DSTOPTS:
2856 			if (!(ipp->ipp_fields & IPPF_DSTOPTS))
2857 				return (0);
2858 			bcopy(ipp->ipp_dstopts, ptr, ipp->ipp_dstoptslen);
2859 			return (ipp->ipp_dstoptslen);
2860 		case IPV6_PATHMTU:
2861 			return (ip_fill_mtuinfo(&udp->udp_v6dst,
2862 			    udp->udp_dstport, (struct ip6_mtuinfo *)ptr,
2863 			    us->us_netstack));
2864 		default:
2865 			return (-1);
2866 		}
2867 		break;
2868 	case IPPROTO_UDP:
2869 		switch (name) {
2870 		case UDP_ANONPRIVBIND:
2871 			*i1 = udp->udp_anon_priv_bind;
2872 			break;
2873 		case UDP_EXCLBIND:
2874 			*i1 = udp->udp_exclbind ? UDP_EXCLBIND : 0;
2875 			break;
2876 		case UDP_RCVHDR:
2877 			*i1 = udp->udp_rcvhdr ? 1 : 0;
2878 			break;
2879 		case UDP_NAT_T_ENDPOINT:
2880 			*i1 = udp->udp_nat_t_endpoint;
2881 			break;
2882 		default:
2883 			return (-1);
2884 		}
2885 		break;
2886 	default:
2887 		return (-1);
2888 	}
2889 	return (sizeof (int));
2890 }
2891 
2892 int
2893 udp_opt_get(queue_t *q, t_scalar_t level, t_scalar_t name, uchar_t *ptr)
2894 {
2895 	udp_t	*udp;
2896 	int	err;
2897 
2898 	udp = Q_TO_UDP(q);
2899 
2900 	rw_enter(&udp->udp_rwlock, RW_READER);
2901 	err = udp_opt_get_locked(q, level, name, ptr);
2902 	rw_exit(&udp->udp_rwlock);
2903 	return (err);
2904 }
2905 
2906 /*
2907  * This routine sets socket options.
2908  */
2909 /* ARGSUSED */
2910 int
2911 udp_opt_set_locked(queue_t *q, uint_t optset_context, int level,
2912     int name, uint_t inlen, uchar_t *invalp, uint_t *outlenp,
2913     uchar_t *outvalp, void *thisdg_attrs, cred_t *cr, mblk_t *mblk)
2914 {
2915 	udpattrs_t *attrs = thisdg_attrs;
2916 	int	*i1 = (int *)invalp;
2917 	boolean_t onoff = (*i1 == 0) ? 0 : 1;
2918 	boolean_t checkonly;
2919 	int	error;
2920 	conn_t	*connp;
2921 	udp_t	*udp;
2922 	uint_t	newlen;
2923 	udp_stack_t *us;
2924 	size_t	sth_wroff;
2925 
2926 	connp = Q_TO_CONN(q);
2927 	udp = connp->conn_udp;
2928 	us = udp->udp_us;
2929 
2930 	switch (optset_context) {
2931 	case SETFN_OPTCOM_CHECKONLY:
2932 		checkonly = B_TRUE;
2933 		/*
2934 		 * Note: Implies T_CHECK semantics for T_OPTCOM_REQ
2935 		 * inlen != 0 implies value supplied and
2936 		 * 	we have to "pretend" to set it.
2937 		 * inlen == 0 implies that there is no
2938 		 * 	value part in T_CHECK request and just validation
2939 		 * done elsewhere should be enough, we just return here.
2940 		 */
2941 		if (inlen == 0) {
2942 			*outlenp = 0;
2943 			return (0);
2944 		}
2945 		break;
2946 	case SETFN_OPTCOM_NEGOTIATE:
2947 		checkonly = B_FALSE;
2948 		break;
2949 	case SETFN_UD_NEGOTIATE:
2950 	case SETFN_CONN_NEGOTIATE:
2951 		checkonly = B_FALSE;
2952 		/*
2953 		 * Negotiating local and "association-related" options
2954 		 * through T_UNITDATA_REQ.
2955 		 *
2956 		 * Following routine can filter out ones we do not
2957 		 * want to be "set" this way.
2958 		 */
2959 		if (!udp_opt_allow_udr_set(level, name)) {
2960 			*outlenp = 0;
2961 			return (EINVAL);
2962 		}
2963 		break;
2964 	default:
2965 		/*
2966 		 * We should never get here
2967 		 */
2968 		*outlenp = 0;
2969 		return (EINVAL);
2970 	}
2971 
2972 	ASSERT((optset_context != SETFN_OPTCOM_CHECKONLY) ||
2973 	    (optset_context == SETFN_OPTCOM_CHECKONLY && inlen != 0));
2974 
2975 	/*
2976 	 * For fixed length options, no sanity check
2977 	 * of passed in length is done. It is assumed *_optcom_req()
2978 	 * routines do the right thing.
2979 	 */
2980 
2981 	switch (level) {
2982 	case SOL_SOCKET:
2983 		switch (name) {
2984 		case SO_REUSEADDR:
2985 			if (!checkonly)
2986 				udp->udp_reuseaddr = onoff;
2987 			break;
2988 		case SO_DEBUG:
2989 			if (!checkonly)
2990 				udp->udp_debug = onoff;
2991 			break;
2992 		/*
2993 		 * The following three items are available here,
2994 		 * but are only meaningful to IP.
2995 		 */
2996 		case SO_DONTROUTE:
2997 			if (!checkonly)
2998 				udp->udp_dontroute = onoff;
2999 			break;
3000 		case SO_USELOOPBACK:
3001 			if (!checkonly)
3002 				udp->udp_useloopback = onoff;
3003 			break;
3004 		case SO_BROADCAST:
3005 			if (!checkonly)
3006 				udp->udp_broadcast = onoff;
3007 			break;
3008 
3009 		case SO_SNDBUF:
3010 			if (*i1 > us->us_max_buf) {
3011 				*outlenp = 0;
3012 				return (ENOBUFS);
3013 			}
3014 			if (!checkonly) {
3015 				q->q_hiwat = *i1;
3016 			}
3017 			break;
3018 		case SO_RCVBUF:
3019 			if (*i1 > us->us_max_buf) {
3020 				*outlenp = 0;
3021 				return (ENOBUFS);
3022 			}
3023 			if (!checkonly) {
3024 				RD(q)->q_hiwat = *i1;
3025 				rw_exit(&udp->udp_rwlock);
3026 				(void) mi_set_sth_hiwat(RD(q),
3027 				    udp_set_rcv_hiwat(udp, *i1));
3028 				rw_enter(&udp->udp_rwlock, RW_WRITER);
3029 			}
3030 			break;
3031 		case SO_DGRAM_ERRIND:
3032 			if (!checkonly)
3033 				udp->udp_dgram_errind = onoff;
3034 			break;
3035 		case SO_RECVUCRED:
3036 			if (!checkonly)
3037 				udp->udp_recvucred = onoff;
3038 			break;
3039 		case SO_ALLZONES:
3040 			/*
3041 			 * "soft" error (negative)
3042 			 * option not handled at this level
3043 			 * Do not modify *outlenp.
3044 			 */
3045 			return (-EINVAL);
3046 		case SO_TIMESTAMP:
3047 			if (!checkonly)
3048 				udp->udp_timestamp = onoff;
3049 			break;
3050 		case SO_ANON_MLP:
3051 			if (!checkonly)
3052 				udp->udp_anon_mlp = onoff;
3053 			break;
3054 		case SO_MAC_EXEMPT:
3055 			if (secpolicy_net_mac_aware(cr) != 0 ||
3056 			    udp->udp_state != TS_UNBND)
3057 				return (EACCES);
3058 			if (!checkonly)
3059 				udp->udp_mac_exempt = onoff;
3060 			break;
3061 		case SCM_UCRED: {
3062 			struct ucred_s *ucr;
3063 			cred_t *cr, *newcr;
3064 			ts_label_t *tsl;
3065 
3066 			/*
3067 			 * Only sockets that have proper privileges and are
3068 			 * bound to MLPs will have any other value here, so
3069 			 * this implicitly tests for privilege to set label.
3070 			 */
3071 			if (connp->conn_mlp_type == mlptSingle)
3072 				break;
3073 			ucr = (struct ucred_s *)invalp;
3074 			if (inlen != ucredsize ||
3075 			    ucr->uc_labeloff < sizeof (*ucr) ||
3076 			    ucr->uc_labeloff + sizeof (bslabel_t) > inlen)
3077 				return (EINVAL);
3078 			if (!checkonly) {
3079 				mblk_t *mb;
3080 
3081 				if (attrs == NULL ||
3082 				    (mb = attrs->udpattr_mb) == NULL)
3083 					return (EINVAL);
3084 				if ((cr = DB_CRED(mb)) == NULL)
3085 					cr = udp->udp_connp->conn_cred;
3086 				ASSERT(cr != NULL);
3087 				if ((tsl = crgetlabel(cr)) == NULL)
3088 					return (EINVAL);
3089 				newcr = copycred_from_bslabel(cr, UCLABEL(ucr),
3090 				    tsl->tsl_doi, KM_NOSLEEP);
3091 				if (newcr == NULL)
3092 					return (ENOSR);
3093 				mblk_setcred(mb, newcr);
3094 				attrs->udpattr_credset = B_TRUE;
3095 				crfree(newcr);
3096 			}
3097 			break;
3098 		}
3099 		case SO_EXCLBIND:
3100 			if (!checkonly)
3101 				udp->udp_exclbind = onoff;
3102 			break;
3103 		default:
3104 			*outlenp = 0;
3105 			return (EINVAL);
3106 		}
3107 		break;
3108 	case IPPROTO_IP:
3109 		if (udp->udp_family != AF_INET) {
3110 			*outlenp = 0;
3111 			return (ENOPROTOOPT);
3112 		}
3113 		switch (name) {
3114 		case IP_OPTIONS:
3115 		case T_IP_OPTIONS:
3116 			/* Save options for use by IP. */
3117 			newlen = inlen + udp->udp_label_len;
3118 			if ((inlen & 0x3) || newlen > IP_MAX_OPT_LENGTH) {
3119 				*outlenp = 0;
3120 				return (EINVAL);
3121 			}
3122 			if (checkonly)
3123 				break;
3124 
3125 			/*
3126 			 * Update the stored options taking into account
3127 			 * any CIPSO option which we should not overwrite.
3128 			 */
3129 			if (!tsol_option_set(&udp->udp_ip_snd_options,
3130 			    &udp->udp_ip_snd_options_len,
3131 			    udp->udp_label_len, invalp, inlen)) {
3132 				*outlenp = 0;
3133 				return (ENOMEM);
3134 			}
3135 
3136 			udp->udp_max_hdr_len = IP_SIMPLE_HDR_LENGTH +
3137 			    UDPH_SIZE + udp->udp_ip_snd_options_len;
3138 			sth_wroff = udp->udp_max_hdr_len + us->us_wroff_extra;
3139 			rw_exit(&udp->udp_rwlock);
3140 			(void) mi_set_sth_wroff(RD(q), sth_wroff);
3141 			rw_enter(&udp->udp_rwlock, RW_WRITER);
3142 			break;
3143 
3144 		case IP_TTL:
3145 			if (!checkonly) {
3146 				udp->udp_ttl = (uchar_t)*i1;
3147 			}
3148 			break;
3149 		case IP_TOS:
3150 		case T_IP_TOS:
3151 			if (!checkonly) {
3152 				udp->udp_type_of_service = (uchar_t)*i1;
3153 			}
3154 			break;
3155 		case IP_MULTICAST_IF: {
3156 			/*
3157 			 * TODO should check OPTMGMT reply and undo this if
3158 			 * there is an error.
3159 			 */
3160 			struct in_addr *inap = (struct in_addr *)invalp;
3161 			if (!checkonly) {
3162 				udp->udp_multicast_if_addr =
3163 				    inap->s_addr;
3164 			}
3165 			break;
3166 		}
3167 		case IP_MULTICAST_TTL:
3168 			if (!checkonly)
3169 				udp->udp_multicast_ttl = *invalp;
3170 			break;
3171 		case IP_MULTICAST_LOOP:
3172 			if (!checkonly)
3173 				connp->conn_multicast_loop = *invalp;
3174 			break;
3175 		case IP_RECVOPTS:
3176 			if (!checkonly)
3177 				udp->udp_recvopts = onoff;
3178 			break;
3179 		case IP_RECVDSTADDR:
3180 			if (!checkonly)
3181 				udp->udp_recvdstaddr = onoff;
3182 			break;
3183 		case IP_RECVIF:
3184 			if (!checkonly)
3185 				udp->udp_recvif = onoff;
3186 			break;
3187 		case IP_RECVSLLA:
3188 			if (!checkonly)
3189 				udp->udp_recvslla = onoff;
3190 			break;
3191 		case IP_RECVTTL:
3192 			if (!checkonly)
3193 				udp->udp_recvttl = onoff;
3194 			break;
3195 		case IP_PKTINFO: {
3196 			/*
3197 			 * This also handles IP_RECVPKTINFO.
3198 			 * IP_PKTINFO and IP_RECVPKTINFO have same value.
3199 			 * Differentiation is based on the size of the
3200 			 * argument passed in.
3201 			 */
3202 			struct in_pktinfo *pktinfop;
3203 			ip4_pkt_t *attr_pktinfop;
3204 
3205 			if (checkonly)
3206 				break;
3207 
3208 			if (inlen == sizeof (int)) {
3209 				/*
3210 				 * This is IP_RECVPKTINFO option.
3211 				 * Keep a local copy of whether this option is
3212 				 * set or not and pass it down to IP for
3213 				 * processing.
3214 				 */
3215 
3216 				udp->udp_ip_recvpktinfo = onoff;
3217 				return (-EINVAL);
3218 			}
3219 
3220 			if (attrs == NULL ||
3221 			    (attr_pktinfop = attrs->udpattr_ipp4) == NULL) {
3222 				/*
3223 				 * sticky option or no buffer to return
3224 				 * the results.
3225 				 */
3226 				return (EINVAL);
3227 			}
3228 
3229 			if (inlen != sizeof (struct in_pktinfo))
3230 				return (EINVAL);
3231 
3232 			pktinfop = (struct in_pktinfo *)invalp;
3233 
3234 			/*
3235 			 * At least one of the values should be specified
3236 			 */
3237 			if (pktinfop->ipi_ifindex == 0 &&
3238 			    pktinfop->ipi_spec_dst.s_addr == INADDR_ANY) {
3239 				return (EINVAL);
3240 			}
3241 
3242 			attr_pktinfop->ip4_addr = pktinfop->ipi_spec_dst.s_addr;
3243 			attr_pktinfop->ip4_ill_index = pktinfop->ipi_ifindex;
3244 
3245 			break;
3246 		}
3247 		case IP_ADD_MEMBERSHIP:
3248 		case IP_DROP_MEMBERSHIP:
3249 		case IP_BLOCK_SOURCE:
3250 		case IP_UNBLOCK_SOURCE:
3251 		case IP_ADD_SOURCE_MEMBERSHIP:
3252 		case IP_DROP_SOURCE_MEMBERSHIP:
3253 		case MCAST_JOIN_GROUP:
3254 		case MCAST_LEAVE_GROUP:
3255 		case MCAST_BLOCK_SOURCE:
3256 		case MCAST_UNBLOCK_SOURCE:
3257 		case MCAST_JOIN_SOURCE_GROUP:
3258 		case MCAST_LEAVE_SOURCE_GROUP:
3259 		case IP_SEC_OPT:
3260 		case IP_NEXTHOP:
3261 		case IP_DHCPINIT_IF:
3262 			/*
3263 			 * "soft" error (negative)
3264 			 * option not handled at this level
3265 			 * Do not modify *outlenp.
3266 			 */
3267 			return (-EINVAL);
3268 		case IP_BOUND_IF:
3269 			if (!checkonly)
3270 				udp->udp_bound_if = *i1;
3271 			break;
3272 		case IP_UNSPEC_SRC:
3273 			if (!checkonly)
3274 				udp->udp_unspec_source = onoff;
3275 			break;
3276 		default:
3277 			*outlenp = 0;
3278 			return (EINVAL);
3279 		}
3280 		break;
3281 	case IPPROTO_IPV6: {
3282 		ip6_pkt_t		*ipp;
3283 		boolean_t		sticky;
3284 
3285 		if (udp->udp_family != AF_INET6) {
3286 			*outlenp = 0;
3287 			return (ENOPROTOOPT);
3288 		}
3289 		/*
3290 		 * Deal with both sticky options and ancillary data
3291 		 */
3292 		sticky = B_FALSE;
3293 		if (attrs == NULL || (ipp = attrs->udpattr_ipp6) ==
3294 		    NULL) {
3295 			/* sticky options, or none */
3296 			ipp = &udp->udp_sticky_ipp;
3297 			sticky = B_TRUE;
3298 		}
3299 
3300 		switch (name) {
3301 		case IPV6_MULTICAST_IF:
3302 			if (!checkonly)
3303 				udp->udp_multicast_if_index = *i1;
3304 			break;
3305 		case IPV6_UNICAST_HOPS:
3306 			/* -1 means use default */
3307 			if (*i1 < -1 || *i1 > IPV6_MAX_HOPS) {
3308 				*outlenp = 0;
3309 				return (EINVAL);
3310 			}
3311 			if (!checkonly) {
3312 				if (*i1 == -1) {
3313 					udp->udp_ttl = ipp->ipp_unicast_hops =
3314 					    us->us_ipv6_hoplimit;
3315 					ipp->ipp_fields &= ~IPPF_UNICAST_HOPS;
3316 					/* Pass modified value to IP. */
3317 					*i1 = udp->udp_ttl;
3318 				} else {
3319 					udp->udp_ttl = ipp->ipp_unicast_hops =
3320 					    (uint8_t)*i1;
3321 					ipp->ipp_fields |= IPPF_UNICAST_HOPS;
3322 				}
3323 				/* Rebuild the header template */
3324 				error = udp_build_hdrs(udp);
3325 				if (error != 0) {
3326 					*outlenp = 0;
3327 					return (error);
3328 				}
3329 			}
3330 			break;
3331 		case IPV6_MULTICAST_HOPS:
3332 			/* -1 means use default */
3333 			if (*i1 < -1 || *i1 > IPV6_MAX_HOPS) {
3334 				*outlenp = 0;
3335 				return (EINVAL);
3336 			}
3337 			if (!checkonly) {
3338 				if (*i1 == -1) {
3339 					udp->udp_multicast_ttl =
3340 					    ipp->ipp_multicast_hops =
3341 					    IP_DEFAULT_MULTICAST_TTL;
3342 					ipp->ipp_fields &= ~IPPF_MULTICAST_HOPS;
3343 					/* Pass modified value to IP. */
3344 					*i1 = udp->udp_multicast_ttl;
3345 				} else {
3346 					udp->udp_multicast_ttl =
3347 					    ipp->ipp_multicast_hops =
3348 					    (uint8_t)*i1;
3349 					ipp->ipp_fields |= IPPF_MULTICAST_HOPS;
3350 				}
3351 			}
3352 			break;
3353 		case IPV6_MULTICAST_LOOP:
3354 			if (*i1 != 0 && *i1 != 1) {
3355 				*outlenp = 0;
3356 				return (EINVAL);
3357 			}
3358 			if (!checkonly)
3359 				connp->conn_multicast_loop = *i1;
3360 			break;
3361 		case IPV6_JOIN_GROUP:
3362 		case IPV6_LEAVE_GROUP:
3363 		case MCAST_JOIN_GROUP:
3364 		case MCAST_LEAVE_GROUP:
3365 		case MCAST_BLOCK_SOURCE:
3366 		case MCAST_UNBLOCK_SOURCE:
3367 		case MCAST_JOIN_SOURCE_GROUP:
3368 		case MCAST_LEAVE_SOURCE_GROUP:
3369 			/*
3370 			 * "soft" error (negative)
3371 			 * option not handled at this level
3372 			 * Note: Do not modify *outlenp
3373 			 */
3374 			return (-EINVAL);
3375 		case IPV6_BOUND_IF:
3376 			if (!checkonly)
3377 				udp->udp_bound_if = *i1;
3378 			break;
3379 		case IPV6_UNSPEC_SRC:
3380 			if (!checkonly)
3381 				udp->udp_unspec_source = onoff;
3382 			break;
3383 		/*
3384 		 * Set boolean switches for ancillary data delivery
3385 		 */
3386 		case IPV6_RECVPKTINFO:
3387 			if (!checkonly)
3388 				udp->udp_ip_recvpktinfo = onoff;
3389 			break;
3390 		case IPV6_RECVTCLASS:
3391 			if (!checkonly) {
3392 				udp->udp_ipv6_recvtclass = onoff;
3393 			}
3394 			break;
3395 		case IPV6_RECVPATHMTU:
3396 			if (!checkonly) {
3397 				udp->udp_ipv6_recvpathmtu = onoff;
3398 			}
3399 			break;
3400 		case IPV6_RECVHOPLIMIT:
3401 			if (!checkonly)
3402 				udp->udp_ipv6_recvhoplimit = onoff;
3403 			break;
3404 		case IPV6_RECVHOPOPTS:
3405 			if (!checkonly)
3406 				udp->udp_ipv6_recvhopopts = onoff;
3407 			break;
3408 		case IPV6_RECVDSTOPTS:
3409 			if (!checkonly)
3410 				udp->udp_ipv6_recvdstopts = onoff;
3411 			break;
3412 		case _OLD_IPV6_RECVDSTOPTS:
3413 			if (!checkonly)
3414 				udp->udp_old_ipv6_recvdstopts = onoff;
3415 			break;
3416 		case IPV6_RECVRTHDRDSTOPTS:
3417 			if (!checkonly)
3418 				udp->udp_ipv6_recvrthdrdstopts = onoff;
3419 			break;
3420 		case IPV6_RECVRTHDR:
3421 			if (!checkonly)
3422 				udp->udp_ipv6_recvrthdr = onoff;
3423 			break;
3424 		/*
3425 		 * Set sticky options or ancillary data.
3426 		 * If sticky options, (re)build any extension headers
3427 		 * that might be needed as a result.
3428 		 */
3429 		case IPV6_PKTINFO:
3430 			/*
3431 			 * The source address and ifindex are verified
3432 			 * in ip_opt_set(). For ancillary data the
3433 			 * source address is checked in ip_wput_v6.
3434 			 */
3435 			if (inlen != 0 && inlen != sizeof (struct in6_pktinfo))
3436 				return (EINVAL);
3437 			if (checkonly)
3438 				break;
3439 
3440 			if (inlen == 0) {
3441 				ipp->ipp_fields &= ~(IPPF_IFINDEX|IPPF_ADDR);
3442 				ipp->ipp_sticky_ignored |=
3443 				    (IPPF_IFINDEX|IPPF_ADDR);
3444 			} else {
3445 				struct in6_pktinfo *pkti;
3446 
3447 				pkti = (struct in6_pktinfo *)invalp;
3448 				ipp->ipp_ifindex = pkti->ipi6_ifindex;
3449 				ipp->ipp_addr = pkti->ipi6_addr;
3450 				if (ipp->ipp_ifindex != 0)
3451 					ipp->ipp_fields |= IPPF_IFINDEX;
3452 				else
3453 					ipp->ipp_fields &= ~IPPF_IFINDEX;
3454 				if (!IN6_IS_ADDR_UNSPECIFIED(
3455 				    &ipp->ipp_addr))
3456 					ipp->ipp_fields |= IPPF_ADDR;
3457 				else
3458 					ipp->ipp_fields &= ~IPPF_ADDR;
3459 			}
3460 			if (sticky) {
3461 				error = udp_build_hdrs(udp);
3462 				if (error != 0)
3463 					return (error);
3464 			}
3465 			break;
3466 		case IPV6_HOPLIMIT:
3467 			if (sticky)
3468 				return (EINVAL);
3469 			if (inlen != 0 && inlen != sizeof (int))
3470 				return (EINVAL);
3471 			if (checkonly)
3472 				break;
3473 
3474 			if (inlen == 0) {
3475 				ipp->ipp_fields &= ~IPPF_HOPLIMIT;
3476 				ipp->ipp_sticky_ignored |= IPPF_HOPLIMIT;
3477 			} else {
3478 				if (*i1 > 255 || *i1 < -1)
3479 					return (EINVAL);
3480 				if (*i1 == -1)
3481 					ipp->ipp_hoplimit =
3482 					    us->us_ipv6_hoplimit;
3483 				else
3484 					ipp->ipp_hoplimit = *i1;
3485 				ipp->ipp_fields |= IPPF_HOPLIMIT;
3486 			}
3487 			break;
3488 		case IPV6_TCLASS:
3489 			if (inlen != 0 && inlen != sizeof (int))
3490 				return (EINVAL);
3491 			if (checkonly)
3492 				break;
3493 
3494 			if (inlen == 0) {
3495 				ipp->ipp_fields &= ~IPPF_TCLASS;
3496 				ipp->ipp_sticky_ignored |= IPPF_TCLASS;
3497 			} else {
3498 				if (*i1 > 255 || *i1 < -1)
3499 					return (EINVAL);
3500 				if (*i1 == -1)
3501 					ipp->ipp_tclass = 0;
3502 				else
3503 					ipp->ipp_tclass = *i1;
3504 				ipp->ipp_fields |= IPPF_TCLASS;
3505 			}
3506 			if (sticky) {
3507 				error = udp_build_hdrs(udp);
3508 				if (error != 0)
3509 					return (error);
3510 			}
3511 			break;
3512 		case IPV6_NEXTHOP:
3513 			/*
3514 			 * IP will verify that the nexthop is reachable
3515 			 * and fail for sticky options.
3516 			 */
3517 			if (inlen != 0 && inlen != sizeof (sin6_t))
3518 				return (EINVAL);
3519 			if (checkonly)
3520 				break;
3521 
3522 			if (inlen == 0) {
3523 				ipp->ipp_fields &= ~IPPF_NEXTHOP;
3524 				ipp->ipp_sticky_ignored |= IPPF_NEXTHOP;
3525 			} else {
3526 				sin6_t *sin6 = (sin6_t *)invalp;
3527 
3528 				if (sin6->sin6_family != AF_INET6)
3529 					return (EAFNOSUPPORT);
3530 				if (IN6_IS_ADDR_V4MAPPED(
3531 				    &sin6->sin6_addr))
3532 					return (EADDRNOTAVAIL);
3533 				ipp->ipp_nexthop = sin6->sin6_addr;
3534 				if (!IN6_IS_ADDR_UNSPECIFIED(
3535 				    &ipp->ipp_nexthop))
3536 					ipp->ipp_fields |= IPPF_NEXTHOP;
3537 				else
3538 					ipp->ipp_fields &= ~IPPF_NEXTHOP;
3539 			}
3540 			if (sticky) {
3541 				error = udp_build_hdrs(udp);
3542 				if (error != 0)
3543 					return (error);
3544 			}
3545 			break;
3546 		case IPV6_HOPOPTS: {
3547 			ip6_hbh_t *hopts = (ip6_hbh_t *)invalp;
3548 			/*
3549 			 * Sanity checks - minimum size, size a multiple of
3550 			 * eight bytes, and matching size passed in.
3551 			 */
3552 			if (inlen != 0 &&
3553 			    inlen != (8 * (hopts->ip6h_len + 1)))
3554 				return (EINVAL);
3555 
3556 			if (checkonly)
3557 				break;
3558 
3559 			error = optcom_pkt_set(invalp, inlen, sticky,
3560 			    (uchar_t **)&ipp->ipp_hopopts,
3561 			    &ipp->ipp_hopoptslen,
3562 			    sticky ? udp->udp_label_len_v6 : 0);
3563 			if (error != 0)
3564 				return (error);
3565 			if (ipp->ipp_hopoptslen == 0) {
3566 				ipp->ipp_fields &= ~IPPF_HOPOPTS;
3567 				ipp->ipp_sticky_ignored |= IPPF_HOPOPTS;
3568 			} else {
3569 				ipp->ipp_fields |= IPPF_HOPOPTS;
3570 			}
3571 			if (sticky) {
3572 				error = udp_build_hdrs(udp);
3573 				if (error != 0)
3574 					return (error);
3575 			}
3576 			break;
3577 		}
3578 		case IPV6_RTHDRDSTOPTS: {
3579 			ip6_dest_t *dopts = (ip6_dest_t *)invalp;
3580 
3581 			/*
3582 			 * Sanity checks - minimum size, size a multiple of
3583 			 * eight bytes, and matching size passed in.
3584 			 */
3585 			if (inlen != 0 &&
3586 			    inlen != (8 * (dopts->ip6d_len + 1)))
3587 				return (EINVAL);
3588 
3589 			if (checkonly)
3590 				break;
3591 
3592 			if (inlen == 0) {
3593 				if (sticky &&
3594 				    (ipp->ipp_fields & IPPF_RTDSTOPTS) != 0) {
3595 					kmem_free(ipp->ipp_rtdstopts,
3596 					    ipp->ipp_rtdstoptslen);
3597 					ipp->ipp_rtdstopts = NULL;
3598 					ipp->ipp_rtdstoptslen = 0;
3599 				}
3600 
3601 				ipp->ipp_fields &= ~IPPF_RTDSTOPTS;
3602 				ipp->ipp_sticky_ignored |= IPPF_RTDSTOPTS;
3603 			} else {
3604 				error = optcom_pkt_set(invalp, inlen, sticky,
3605 				    (uchar_t **)&ipp->ipp_rtdstopts,
3606 				    &ipp->ipp_rtdstoptslen, 0);
3607 				if (error != 0)
3608 					return (error);
3609 				ipp->ipp_fields |= IPPF_RTDSTOPTS;
3610 			}
3611 			if (sticky) {
3612 				error = udp_build_hdrs(udp);
3613 				if (error != 0)
3614 					return (error);
3615 			}
3616 			break;
3617 		}
3618 		case IPV6_DSTOPTS: {
3619 			ip6_dest_t *dopts = (ip6_dest_t *)invalp;
3620 
3621 			/*
3622 			 * Sanity checks - minimum size, size a multiple of
3623 			 * eight bytes, and matching size passed in.
3624 			 */
3625 			if (inlen != 0 &&
3626 			    inlen != (8 * (dopts->ip6d_len + 1)))
3627 				return (EINVAL);
3628 
3629 			if (checkonly)
3630 				break;
3631 
3632 			if (inlen == 0) {
3633 				if (sticky &&
3634 				    (ipp->ipp_fields & IPPF_DSTOPTS) != 0) {
3635 					kmem_free(ipp->ipp_dstopts,
3636 					    ipp->ipp_dstoptslen);
3637 					ipp->ipp_dstopts = NULL;
3638 					ipp->ipp_dstoptslen = 0;
3639 				}
3640 				ipp->ipp_fields &= ~IPPF_DSTOPTS;
3641 				ipp->ipp_sticky_ignored |= IPPF_DSTOPTS;
3642 			} else {
3643 				error = optcom_pkt_set(invalp, inlen, sticky,
3644 				    (uchar_t **)&ipp->ipp_dstopts,
3645 				    &ipp->ipp_dstoptslen, 0);
3646 				if (error != 0)
3647 					return (error);
3648 				ipp->ipp_fields |= IPPF_DSTOPTS;
3649 			}
3650 			if (sticky) {
3651 				error = udp_build_hdrs(udp);
3652 				if (error != 0)
3653 					return (error);
3654 			}
3655 			break;
3656 		}
3657 		case IPV6_RTHDR: {
3658 			ip6_rthdr_t *rt = (ip6_rthdr_t *)invalp;
3659 
3660 			/*
3661 			 * Sanity checks - minimum size, size a multiple of
3662 			 * eight bytes, and matching size passed in.
3663 			 */
3664 			if (inlen != 0 &&
3665 			    inlen != (8 * (rt->ip6r_len + 1)))
3666 				return (EINVAL);
3667 
3668 			if (checkonly)
3669 				break;
3670 
3671 			if (inlen == 0) {
3672 				if (sticky &&
3673 				    (ipp->ipp_fields & IPPF_RTHDR) != 0) {
3674 					kmem_free(ipp->ipp_rthdr,
3675 					    ipp->ipp_rthdrlen);
3676 					ipp->ipp_rthdr = NULL;
3677 					ipp->ipp_rthdrlen = 0;
3678 				}
3679 				ipp->ipp_fields &= ~IPPF_RTHDR;
3680 				ipp->ipp_sticky_ignored |= IPPF_RTHDR;
3681 			} else {
3682 				error = optcom_pkt_set(invalp, inlen, sticky,
3683 				    (uchar_t **)&ipp->ipp_rthdr,
3684 				    &ipp->ipp_rthdrlen, 0);
3685 				if (error != 0)
3686 					return (error);
3687 				ipp->ipp_fields |= IPPF_RTHDR;
3688 			}
3689 			if (sticky) {
3690 				error = udp_build_hdrs(udp);
3691 				if (error != 0)
3692 					return (error);
3693 			}
3694 			break;
3695 		}
3696 
3697 		case IPV6_DONTFRAG:
3698 			if (checkonly)
3699 				break;
3700 
3701 			if (onoff) {
3702 				ipp->ipp_fields |= IPPF_DONTFRAG;
3703 			} else {
3704 				ipp->ipp_fields &= ~IPPF_DONTFRAG;
3705 			}
3706 			break;
3707 
3708 		case IPV6_USE_MIN_MTU:
3709 			if (inlen != sizeof (int))
3710 				return (EINVAL);
3711 
3712 			if (*i1 < -1 || *i1 > 1)
3713 				return (EINVAL);
3714 
3715 			if (checkonly)
3716 				break;
3717 
3718 			ipp->ipp_fields |= IPPF_USE_MIN_MTU;
3719 			ipp->ipp_use_min_mtu = *i1;
3720 			break;
3721 
3722 		case IPV6_BOUND_PIF:
3723 		case IPV6_SEC_OPT:
3724 		case IPV6_DONTFAILOVER_IF:
3725 		case IPV6_SRC_PREFERENCES:
3726 		case IPV6_V6ONLY:
3727 			/* Handled at the IP level */
3728 			return (-EINVAL);
3729 		default:
3730 			*outlenp = 0;
3731 			return (EINVAL);
3732 		}
3733 		break;
3734 		}		/* end IPPROTO_IPV6 */
3735 	case IPPROTO_UDP:
3736 		switch (name) {
3737 		case UDP_ANONPRIVBIND:
3738 			if ((error = secpolicy_net_privaddr(cr, 0)) != 0) {
3739 				*outlenp = 0;
3740 				return (error);
3741 			}
3742 			if (!checkonly) {
3743 				udp->udp_anon_priv_bind = onoff;
3744 			}
3745 			break;
3746 		case UDP_EXCLBIND:
3747 			if (!checkonly)
3748 				udp->udp_exclbind = onoff;
3749 			break;
3750 		case UDP_RCVHDR:
3751 			if (!checkonly)
3752 				udp->udp_rcvhdr = onoff;
3753 			break;
3754 		case UDP_NAT_T_ENDPOINT:
3755 			if ((error = secpolicy_ip_config(cr, B_FALSE)) != 0) {
3756 				*outlenp = 0;
3757 				return (error);
3758 			}
3759 
3760 			/*
3761 			 * Use udp_family instead so we can avoid ambiguitites
3762 			 * with AF_INET6 sockets that may switch from IPv4
3763 			 * to IPv6.
3764 			 */
3765 			if (udp->udp_family != AF_INET) {
3766 				*outlenp = 0;
3767 				return (EAFNOSUPPORT);
3768 			}
3769 
3770 			if (!checkonly) {
3771 				udp->udp_nat_t_endpoint = onoff;
3772 
3773 				udp->udp_max_hdr_len = IP_SIMPLE_HDR_LENGTH +
3774 				    UDPH_SIZE + udp->udp_ip_snd_options_len;
3775 
3776 				/* Also, adjust wroff */
3777 				if (onoff) {
3778 					udp->udp_max_hdr_len +=
3779 					    sizeof (uint32_t);
3780 				}
3781 				(void) mi_set_sth_wroff(RD(q),
3782 				    udp->udp_max_hdr_len + us->us_wroff_extra);
3783 			}
3784 			break;
3785 		default:
3786 			*outlenp = 0;
3787 			return (EINVAL);
3788 		}
3789 		break;
3790 	default:
3791 		*outlenp = 0;
3792 		return (EINVAL);
3793 	}
3794 	/*
3795 	 * Common case of OK return with outval same as inval.
3796 	 */
3797 	if (invalp != outvalp) {
3798 		/* don't trust bcopy for identical src/dst */
3799 		(void) bcopy(invalp, outvalp, inlen);
3800 	}
3801 	*outlenp = inlen;
3802 	return (0);
3803 }
3804 
3805 int
3806 udp_opt_set(queue_t *q, uint_t optset_context, int level,
3807     int name, uint_t inlen, uchar_t *invalp, uint_t *outlenp,
3808     uchar_t *outvalp, void *thisdg_attrs, cred_t *cr, mblk_t *mblk)
3809 {
3810 	udp_t	*udp;
3811 	int	err;
3812 
3813 	udp = Q_TO_UDP(q);
3814 
3815 	rw_enter(&udp->udp_rwlock, RW_WRITER);
3816 	err = udp_opt_set_locked(q, optset_context, level, name, inlen, invalp,
3817 	    outlenp, outvalp, thisdg_attrs, cr, mblk);
3818 	rw_exit(&udp->udp_rwlock);
3819 	return (err);
3820 }
3821 
3822 /*
3823  * Update udp_sticky_hdrs based on udp_sticky_ipp, udp_v6src, and udp_ttl.
3824  * The headers include ip6i_t (if needed), ip6_t, any sticky extension
3825  * headers, and the udp header.
3826  * Returns failure if can't allocate memory.
3827  */
3828 static int
3829 udp_build_hdrs(udp_t *udp)
3830 {
3831 	udp_stack_t *us = udp->udp_us;
3832 	uchar_t	*hdrs;
3833 	uint_t	hdrs_len;
3834 	ip6_t	*ip6h;
3835 	ip6i_t	*ip6i;
3836 	udpha_t	*udpha;
3837 	ip6_pkt_t *ipp = &udp->udp_sticky_ipp;
3838 	size_t	sth_wroff;
3839 
3840 	ASSERT(RW_WRITE_HELD(&udp->udp_rwlock));
3841 	hdrs_len = ip_total_hdrs_len_v6(ipp) + UDPH_SIZE;
3842 	ASSERT(hdrs_len != 0);
3843 	if (hdrs_len != udp->udp_sticky_hdrs_len) {
3844 		/* Need to reallocate */
3845 		hdrs = kmem_alloc(hdrs_len, KM_NOSLEEP);
3846 		if (hdrs == NULL)
3847 			return (ENOMEM);
3848 
3849 		if (udp->udp_sticky_hdrs_len != 0) {
3850 			kmem_free(udp->udp_sticky_hdrs,
3851 			    udp->udp_sticky_hdrs_len);
3852 		}
3853 		udp->udp_sticky_hdrs = hdrs;
3854 		udp->udp_sticky_hdrs_len = hdrs_len;
3855 	}
3856 	ip_build_hdrs_v6(udp->udp_sticky_hdrs,
3857 	    udp->udp_sticky_hdrs_len - UDPH_SIZE, ipp, IPPROTO_UDP);
3858 
3859 	/* Set header fields not in ipp */
3860 	if (ipp->ipp_fields & IPPF_HAS_IP6I) {
3861 		ip6i = (ip6i_t *)udp->udp_sticky_hdrs;
3862 		ip6h = (ip6_t *)&ip6i[1];
3863 	} else {
3864 		ip6h = (ip6_t *)udp->udp_sticky_hdrs;
3865 	}
3866 
3867 	if (!(ipp->ipp_fields & IPPF_ADDR))
3868 		ip6h->ip6_src = udp->udp_v6src;
3869 
3870 	udpha = (udpha_t *)(udp->udp_sticky_hdrs + hdrs_len - UDPH_SIZE);
3871 	udpha->uha_src_port = udp->udp_port;
3872 
3873 	/* Try to get everything in a single mblk */
3874 	if (hdrs_len > udp->udp_max_hdr_len) {
3875 		udp->udp_max_hdr_len = hdrs_len;
3876 		sth_wroff = udp->udp_max_hdr_len + us->us_wroff_extra;
3877 		rw_exit(&udp->udp_rwlock);
3878 		(void) mi_set_sth_wroff(udp->udp_connp->conn_rq, sth_wroff);
3879 		rw_enter(&udp->udp_rwlock, RW_WRITER);
3880 	}
3881 	return (0);
3882 }
3883 
3884 /*
3885  * This routine retrieves the value of an ND variable in a udpparam_t
3886  * structure.  It is called through nd_getset when a user reads the
3887  * variable.
3888  */
3889 /* ARGSUSED */
3890 static int
3891 udp_param_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr)
3892 {
3893 	udpparam_t *udppa = (udpparam_t *)cp;
3894 
3895 	(void) mi_mpprintf(mp, "%d", udppa->udp_param_value);
3896 	return (0);
3897 }
3898 
3899 /*
3900  * Walk through the param array specified registering each element with the
3901  * named dispatch (ND) handler.
3902  */
3903 static boolean_t
3904 udp_param_register(IDP *ndp, udpparam_t *udppa, int cnt)
3905 {
3906 	for (; cnt-- > 0; udppa++) {
3907 		if (udppa->udp_param_name && udppa->udp_param_name[0]) {
3908 			if (!nd_load(ndp, udppa->udp_param_name,
3909 			    udp_param_get, udp_param_set,
3910 			    (caddr_t)udppa)) {
3911 				nd_free(ndp);
3912 				return (B_FALSE);
3913 			}
3914 		}
3915 	}
3916 	if (!nd_load(ndp, "udp_extra_priv_ports",
3917 	    udp_extra_priv_ports_get, NULL, NULL)) {
3918 		nd_free(ndp);
3919 		return (B_FALSE);
3920 	}
3921 	if (!nd_load(ndp, "udp_extra_priv_ports_add",
3922 	    NULL, udp_extra_priv_ports_add, NULL)) {
3923 		nd_free(ndp);
3924 		return (B_FALSE);
3925 	}
3926 	if (!nd_load(ndp, "udp_extra_priv_ports_del",
3927 	    NULL, udp_extra_priv_ports_del, NULL)) {
3928 		nd_free(ndp);
3929 		return (B_FALSE);
3930 	}
3931 	if (!nd_load(ndp, "udp_status", udp_status_report, NULL,
3932 	    NULL)) {
3933 		nd_free(ndp);
3934 		return (B_FALSE);
3935 	}
3936 	if (!nd_load(ndp, "udp_bind_hash", udp_bind_hash_report, NULL,
3937 	    NULL)) {
3938 		nd_free(ndp);
3939 		return (B_FALSE);
3940 	}
3941 	return (B_TRUE);
3942 }
3943 
3944 /* This routine sets an ND variable in a udpparam_t structure. */
3945 /* ARGSUSED */
3946 static int
3947 udp_param_set(queue_t *q, mblk_t *mp, char *value, caddr_t cp, cred_t *cr)
3948 {
3949 	long		new_value;
3950 	udpparam_t	*udppa = (udpparam_t *)cp;
3951 
3952 	/*
3953 	 * Fail the request if the new value does not lie within the
3954 	 * required bounds.
3955 	 */
3956 	if (ddi_strtol(value, NULL, 10, &new_value) != 0 ||
3957 	    new_value < udppa->udp_param_min ||
3958 	    new_value > udppa->udp_param_max) {
3959 		return (EINVAL);
3960 	}
3961 
3962 	/* Set the new value */
3963 	udppa->udp_param_value = new_value;
3964 	return (0);
3965 }
3966 
3967 /*
3968  * Copy hop-by-hop option from ipp->ipp_hopopts to the buffer provided (with
3969  * T_opthdr) and return the number of bytes copied.  'dbuf' may be NULL to
3970  * just count the length needed for allocation.  If 'dbuf' is non-NULL,
3971  * then it's assumed to be allocated to be large enough.
3972  *
3973  * Returns zero if trimming of the security option causes all options to go
3974  * away.
3975  */
3976 static size_t
3977 copy_hop_opts(const ip6_pkt_t *ipp, uchar_t *dbuf)
3978 {
3979 	struct T_opthdr *toh;
3980 	size_t hol = ipp->ipp_hopoptslen;
3981 	ip6_hbh_t *dstopt = NULL;
3982 	const ip6_hbh_t *srcopt = ipp->ipp_hopopts;
3983 	size_t tlen, olen, plen;
3984 	boolean_t deleting;
3985 	const struct ip6_opt *sopt, *lastpad;
3986 	struct ip6_opt *dopt;
3987 
3988 	if ((toh = (struct T_opthdr *)dbuf) != NULL) {
3989 		toh->level = IPPROTO_IPV6;
3990 		toh->name = IPV6_HOPOPTS;
3991 		toh->status = 0;
3992 		dstopt = (ip6_hbh_t *)(toh + 1);
3993 	}
3994 
3995 	/*
3996 	 * If labeling is enabled, then skip the label option
3997 	 * but get other options if there are any.
3998 	 */
3999 	if (is_system_labeled()) {
4000 		dopt = NULL;
4001 		if (dstopt != NULL) {
4002 			/* will fill in ip6h_len later */
4003 			dstopt->ip6h_nxt = srcopt->ip6h_nxt;
4004 			dopt = (struct ip6_opt *)(dstopt + 1);
4005 		}
4006 		sopt = (const struct ip6_opt *)(srcopt + 1);
4007 		hol -= sizeof (*srcopt);
4008 		tlen = sizeof (*dstopt);
4009 		lastpad = NULL;
4010 		deleting = B_FALSE;
4011 		/*
4012 		 * This loop finds the first (lastpad pointer) of any number of
4013 		 * pads that preceeds the security option, then treats the
4014 		 * security option as though it were a pad, and then finds the
4015 		 * next non-pad option (or end of list).
4016 		 *
4017 		 * It then treats the entire block as one big pad.  To preserve
4018 		 * alignment of any options that follow, or just the end of the
4019 		 * list, it computes a minimal new padding size that keeps the
4020 		 * same alignment for the next option.
4021 		 *
4022 		 * If it encounters just a sequence of pads with no security
4023 		 * option, those are copied as-is rather than collapsed.
4024 		 *
4025 		 * Note that to handle the end of list case, the code makes one
4026 		 * loop with 'hol' set to zero.
4027 		 */
4028 		for (;;) {
4029 			if (hol > 0) {
4030 				if (sopt->ip6o_type == IP6OPT_PAD1) {
4031 					if (lastpad == NULL)
4032 						lastpad = sopt;
4033 					sopt = (const struct ip6_opt *)
4034 					    &sopt->ip6o_len;
4035 					hol--;
4036 					continue;
4037 				}
4038 				olen = sopt->ip6o_len + sizeof (*sopt);
4039 				if (olen > hol)
4040 					olen = hol;
4041 				if (sopt->ip6o_type == IP6OPT_PADN ||
4042 				    sopt->ip6o_type == ip6opt_ls) {
4043 					if (sopt->ip6o_type == ip6opt_ls)
4044 						deleting = B_TRUE;
4045 					if (lastpad == NULL)
4046 						lastpad = sopt;
4047 					sopt = (const struct ip6_opt *)
4048 					    ((const char *)sopt + olen);
4049 					hol -= olen;
4050 					continue;
4051 				}
4052 			} else {
4053 				/* if nothing was copied at all, then delete */
4054 				if (tlen == sizeof (*dstopt))
4055 					return (0);
4056 				/* last pass; pick up any trailing padding */
4057 				olen = 0;
4058 			}
4059 			if (deleting) {
4060 				/*
4061 				 * compute aligning effect of deleted material
4062 				 * to reproduce with pad.
4063 				 */
4064 				plen = ((const char *)sopt -
4065 				    (const char *)lastpad) & 7;
4066 				tlen += plen;
4067 				if (dopt != NULL) {
4068 					if (plen == 1) {
4069 						dopt->ip6o_type = IP6OPT_PAD1;
4070 					} else if (plen > 1) {
4071 						plen -= sizeof (*dopt);
4072 						dopt->ip6o_type = IP6OPT_PADN;
4073 						dopt->ip6o_len = plen;
4074 						if (plen > 0)
4075 							bzero(dopt + 1, plen);
4076 					}
4077 					dopt = (struct ip6_opt *)
4078 					    ((char *)dopt + plen);
4079 				}
4080 				deleting = B_FALSE;
4081 				lastpad = NULL;
4082 			}
4083 			/* if there's uncopied padding, then copy that now */
4084 			if (lastpad != NULL) {
4085 				olen += (const char *)sopt -
4086 				    (const char *)lastpad;
4087 				sopt = lastpad;
4088 				lastpad = NULL;
4089 			}
4090 			if (dopt != NULL && olen > 0) {
4091 				bcopy(sopt, dopt, olen);
4092 				dopt = (struct ip6_opt *)((char *)dopt + olen);
4093 			}
4094 			if (hol == 0)
4095 				break;
4096 			tlen += olen;
4097 			sopt = (const struct ip6_opt *)
4098 			    ((const char *)sopt + olen);
4099 			hol -= olen;
4100 		}
4101 		/* go back and patch up the length value, rounded upward */
4102 		if (dstopt != NULL)
4103 			dstopt->ip6h_len = (tlen - 1) >> 3;
4104 	} else {
4105 		tlen = hol;
4106 		if (dstopt != NULL)
4107 			bcopy(srcopt, dstopt, hol);
4108 	}
4109 
4110 	tlen += sizeof (*toh);
4111 	if (toh != NULL)
4112 		toh->len = tlen;
4113 
4114 	return (tlen);
4115 }
4116 
4117 /*
4118  * Update udp_rcv_opt_len from the packet.
4119  * Called when options received, and when no options received but
4120  * udp_ip_recv_opt_len has previously recorded options.
4121  */
4122 static void
4123 udp_save_ip_rcv_opt(udp_t *udp, void *opt, int opt_len)
4124 {
4125 	/* Save the options if any */
4126 	if (opt_len > 0) {
4127 		if (opt_len > udp->udp_ip_rcv_options_len) {
4128 			/* Need to allocate larger buffer */
4129 			if (udp->udp_ip_rcv_options_len != 0)
4130 				mi_free((char *)udp->udp_ip_rcv_options);
4131 			udp->udp_ip_rcv_options_len = 0;
4132 			udp->udp_ip_rcv_options =
4133 			    (uchar_t *)mi_alloc(opt_len, BPRI_HI);
4134 			if (udp->udp_ip_rcv_options != NULL)
4135 				udp->udp_ip_rcv_options_len = opt_len;
4136 		}
4137 		if (udp->udp_ip_rcv_options_len != 0) {
4138 			bcopy(opt, udp->udp_ip_rcv_options, opt_len);
4139 			/* Adjust length if we are resusing the space */
4140 			udp->udp_ip_rcv_options_len = opt_len;
4141 		}
4142 	} else if (udp->udp_ip_rcv_options_len != 0) {
4143 		/* Clear out previously recorded options */
4144 		mi_free((char *)udp->udp_ip_rcv_options);
4145 		udp->udp_ip_rcv_options = NULL;
4146 		udp->udp_ip_rcv_options_len = 0;
4147 	}
4148 }
4149 
4150 /* ARGSUSED2 */
4151 static void
4152 udp_input(void *arg1, mblk_t *mp, void *arg2)
4153 {
4154 	conn_t *connp = (conn_t *)arg1;
4155 	struct T_unitdata_ind	*tudi;
4156 	uchar_t			*rptr;		/* Pointer to IP header */
4157 	int			hdr_length;	/* Length of IP+UDP headers */
4158 	int			opt_len;
4159 	int			udi_size;	/* Size of T_unitdata_ind */
4160 	int			mp_len;
4161 	udp_t			*udp;
4162 	udpha_t			*udpha;
4163 	int			ipversion;
4164 	ip6_pkt_t		ipp;
4165 	ip6_t			*ip6h;
4166 	ip6i_t			*ip6i;
4167 	mblk_t			*mp1;
4168 	mblk_t			*options_mp = NULL;
4169 	ip_pktinfo_t		*pinfo = NULL;
4170 	cred_t			*cr = NULL;
4171 	pid_t			cpid;
4172 	uint32_t		udp_ip_rcv_options_len;
4173 	udp_bits_t		udp_bits;
4174 	cred_t			*rcr = connp->conn_cred;
4175 	udp_stack_t *us;
4176 
4177 	ASSERT(connp->conn_flags & IPCL_UDPCONN);
4178 
4179 	udp = connp->conn_udp;
4180 	us = udp->udp_us;
4181 	rptr = mp->b_rptr;
4182 	ASSERT(DB_TYPE(mp) == M_DATA || DB_TYPE(mp) == M_CTL);
4183 	ASSERT(OK_32PTR(rptr));
4184 
4185 	/*
4186 	 * IP should have prepended the options data in an M_CTL
4187 	 * Check M_CTL "type" to make sure are not here bcos of
4188 	 * a valid ICMP message
4189 	 */
4190 	if (DB_TYPE(mp) == M_CTL) {
4191 		if (MBLKL(mp) == sizeof (ip_pktinfo_t) &&
4192 		    ((ip_pktinfo_t *)mp->b_rptr)->ip_pkt_ulp_type ==
4193 		    IN_PKTINFO) {
4194 			/*
4195 			 * IP_RECVIF or IP_RECVSLLA or IPF_RECVADDR information
4196 			 * has been prepended to the packet by IP. We need to
4197 			 * extract the mblk and adjust the rptr
4198 			 */
4199 			pinfo = (ip_pktinfo_t *)mp->b_rptr;
4200 			options_mp = mp;
4201 			mp = mp->b_cont;
4202 			rptr = mp->b_rptr;
4203 			UDP_STAT(us, udp_in_pktinfo);
4204 		} else {
4205 			/*
4206 			 * ICMP messages.
4207 			 */
4208 			udp_icmp_error(connp->conn_rq, mp);
4209 			return;
4210 		}
4211 	}
4212 
4213 	mp_len = msgdsize(mp);
4214 	/*
4215 	 * This is the inbound data path.
4216 	 * First, we check to make sure the IP version number is correct,
4217 	 * and then pull the IP and UDP headers into the first mblk.
4218 	 */
4219 
4220 	/* Initialize regardless if ipversion is IPv4 or IPv6 */
4221 	ipp.ipp_fields = 0;
4222 
4223 	ipversion = IPH_HDR_VERSION(rptr);
4224 
4225 	rw_enter(&udp->udp_rwlock, RW_READER);
4226 	udp_ip_rcv_options_len = udp->udp_ip_rcv_options_len;
4227 	udp_bits = udp->udp_bits;
4228 	rw_exit(&udp->udp_rwlock);
4229 
4230 	switch (ipversion) {
4231 	case IPV4_VERSION:
4232 		ASSERT(MBLKL(mp) >= sizeof (ipha_t));
4233 		ASSERT(((ipha_t *)rptr)->ipha_protocol == IPPROTO_UDP);
4234 		hdr_length = IPH_HDR_LENGTH(rptr) + UDPH_SIZE;
4235 		opt_len = hdr_length - (IP_SIMPLE_HDR_LENGTH + UDPH_SIZE);
4236 		if ((opt_len > 0 || udp_ip_rcv_options_len > 0) &&
4237 		    udp->udp_family == AF_INET) {
4238 			/*
4239 			 * Record/update udp_ip_rcv_options with the lock
4240 			 * held. Not needed for AF_INET6 sockets
4241 			 * since they don't support a getsockopt of IP_OPTIONS.
4242 			 */
4243 			rw_enter(&udp->udp_rwlock, RW_WRITER);
4244 			udp_save_ip_rcv_opt(udp, rptr + IP_SIMPLE_HDR_LENGTH,
4245 			    opt_len);
4246 			rw_exit(&udp->udp_rwlock);
4247 		}
4248 		/* Handle IPV6_RECVPKTINFO even for IPv4 packet. */
4249 		if ((udp->udp_family == AF_INET6) && (pinfo != NULL) &&
4250 		    udp->udp_ip_recvpktinfo) {
4251 			if (pinfo->ip_pkt_flags & IPF_RECVIF) {
4252 				ipp.ipp_fields |= IPPF_IFINDEX;
4253 				ipp.ipp_ifindex = pinfo->ip_pkt_ifindex;
4254 			}
4255 		}
4256 		break;
4257 	case IPV6_VERSION:
4258 		/*
4259 		 * IPv6 packets can only be received by applications
4260 		 * that are prepared to receive IPv6 addresses.
4261 		 * The IP fanout must ensure this.
4262 		 */
4263 		ASSERT(udp->udp_family == AF_INET6);
4264 
4265 		ip6h = (ip6_t *)rptr;
4266 		ASSERT((uchar_t *)&ip6h[1] <= mp->b_wptr);
4267 
4268 		if (ip6h->ip6_nxt != IPPROTO_UDP) {
4269 			uint8_t nexthdrp;
4270 			/* Look for ifindex information */
4271 			if (ip6h->ip6_nxt == IPPROTO_RAW) {
4272 				ip6i = (ip6i_t *)ip6h;
4273 				if ((uchar_t *)&ip6i[1] > mp->b_wptr)
4274 					goto tossit;
4275 
4276 				if (ip6i->ip6i_flags & IP6I_IFINDEX) {
4277 					ASSERT(ip6i->ip6i_ifindex != 0);
4278 					ipp.ipp_fields |= IPPF_IFINDEX;
4279 					ipp.ipp_ifindex = ip6i->ip6i_ifindex;
4280 				}
4281 				rptr = (uchar_t *)&ip6i[1];
4282 				mp->b_rptr = rptr;
4283 				if (rptr == mp->b_wptr) {
4284 					mp1 = mp->b_cont;
4285 					freeb(mp);
4286 					mp = mp1;
4287 					rptr = mp->b_rptr;
4288 				}
4289 				if (MBLKL(mp) < (IPV6_HDR_LEN + UDPH_SIZE))
4290 					goto tossit;
4291 				ip6h = (ip6_t *)rptr;
4292 				mp_len = msgdsize(mp);
4293 			}
4294 			/*
4295 			 * Find any potentially interesting extension headers
4296 			 * as well as the length of the IPv6 + extension
4297 			 * headers.
4298 			 */
4299 			hdr_length = ip_find_hdr_v6(mp, ip6h, &ipp, &nexthdrp) +
4300 			    UDPH_SIZE;
4301 			ASSERT(nexthdrp == IPPROTO_UDP);
4302 		} else {
4303 			hdr_length = IPV6_HDR_LEN + UDPH_SIZE;
4304 			ip6i = NULL;
4305 		}
4306 		break;
4307 	default:
4308 		ASSERT(0);
4309 	}
4310 
4311 	/*
4312 	 * IP inspected the UDP header thus all of it must be in the mblk.
4313 	 * UDP length check is performed for IPv6 packets and IPv4 packets
4314 	 * to check if the size of the packet as specified
4315 	 * by the header is the same as the physical size of the packet.
4316 	 * FIXME? Didn't IP already check this?
4317 	 */
4318 	udpha = (udpha_t *)(rptr + (hdr_length - UDPH_SIZE));
4319 	if ((MBLKL(mp) < hdr_length) ||
4320 	    (mp_len != (ntohs(udpha->uha_length) + hdr_length - UDPH_SIZE))) {
4321 		goto tossit;
4322 	}
4323 
4324 
4325 	/* Walk past the headers unless IP_RECVHDR was set. */
4326 	if (!udp_bits.udpb_rcvhdr) {
4327 		mp->b_rptr = rptr + hdr_length;
4328 		mp_len -= hdr_length;
4329 	}
4330 
4331 	/*
4332 	 * This is the inbound data path.  Packets are passed upstream as
4333 	 * T_UNITDATA_IND messages with full IP headers still attached.
4334 	 */
4335 	if (udp->udp_family == AF_INET) {
4336 		sin_t *sin;
4337 
4338 		ASSERT(IPH_HDR_VERSION((ipha_t *)rptr) == IPV4_VERSION);
4339 
4340 		/*
4341 		 * Normally only send up the source address.
4342 		 * If IP_RECVDSTADDR is set we include the destination IP
4343 		 * address as an option. With IP_RECVOPTS we include all
4344 		 * the IP options.
4345 		 */
4346 		udi_size = sizeof (struct T_unitdata_ind) + sizeof (sin_t);
4347 		if (udp_bits.udpb_recvdstaddr) {
4348 			udi_size += sizeof (struct T_opthdr) +
4349 			    sizeof (struct in_addr);
4350 			UDP_STAT(us, udp_in_recvdstaddr);
4351 		}
4352 
4353 		if (udp_bits.udpb_ip_recvpktinfo && (pinfo != NULL) &&
4354 		    (pinfo->ip_pkt_flags & IPF_RECVADDR)) {
4355 			udi_size += sizeof (struct T_opthdr) +
4356 			    sizeof (struct in_pktinfo);
4357 			UDP_STAT(us, udp_ip_rcvpktinfo);
4358 		}
4359 
4360 		if ((udp_bits.udpb_recvopts) && opt_len > 0) {
4361 			udi_size += sizeof (struct T_opthdr) + opt_len;
4362 			UDP_STAT(us, udp_in_recvopts);
4363 		}
4364 
4365 		/*
4366 		 * If the IP_RECVSLLA or the IP_RECVIF is set then allocate
4367 		 * space accordingly
4368 		 */
4369 		if ((udp_bits.udpb_recvif) && (pinfo != NULL) &&
4370 		    (pinfo->ip_pkt_flags & IPF_RECVIF)) {
4371 			udi_size += sizeof (struct T_opthdr) + sizeof (uint_t);
4372 			UDP_STAT(us, udp_in_recvif);
4373 		}
4374 
4375 		if ((udp_bits.udpb_recvslla) && (pinfo != NULL) &&
4376 		    (pinfo->ip_pkt_flags & IPF_RECVSLLA)) {
4377 			udi_size += sizeof (struct T_opthdr) +
4378 			    sizeof (struct sockaddr_dl);
4379 			UDP_STAT(us, udp_in_recvslla);
4380 		}
4381 
4382 		if ((udp_bits.udpb_recvucred) &&
4383 		    (cr = DB_CRED(mp)) != NULL) {
4384 			udi_size += sizeof (struct T_opthdr) + ucredsize;
4385 			cpid = DB_CPID(mp);
4386 			UDP_STAT(us, udp_in_recvucred);
4387 		}
4388 
4389 		/*
4390 		 * If SO_TIMESTAMP is set allocate the appropriate sized
4391 		 * buffer. Since gethrestime() expects a pointer aligned
4392 		 * argument, we allocate space necessary for extra
4393 		 * alignment (even though it might not be used).
4394 		 */
4395 		if (udp_bits.udpb_timestamp) {
4396 			udi_size += sizeof (struct T_opthdr) +
4397 			    sizeof (timestruc_t) + _POINTER_ALIGNMENT;
4398 			UDP_STAT(us, udp_in_timestamp);
4399 		}
4400 
4401 		/*
4402 		 * If IP_RECVTTL is set allocate the appropriate sized buffer
4403 		 */
4404 		if (udp_bits.udpb_recvttl) {
4405 			udi_size += sizeof (struct T_opthdr) + sizeof (uint8_t);
4406 			UDP_STAT(us, udp_in_recvttl);
4407 		}
4408 
4409 		/* Allocate a message block for the T_UNITDATA_IND structure. */
4410 		mp1 = allocb(udi_size, BPRI_MED);
4411 		if (mp1 == NULL) {
4412 			freemsg(mp);
4413 			if (options_mp != NULL)
4414 				freeb(options_mp);
4415 			BUMP_MIB(&us->us_udp_mib, udpInErrors);
4416 			return;
4417 		}
4418 		mp1->b_cont = mp;
4419 		mp = mp1;
4420 		mp->b_datap->db_type = M_PROTO;
4421 		tudi = (struct T_unitdata_ind *)mp->b_rptr;
4422 		mp->b_wptr = (uchar_t *)tudi + udi_size;
4423 		tudi->PRIM_type = T_UNITDATA_IND;
4424 		tudi->SRC_length = sizeof (sin_t);
4425 		tudi->SRC_offset = sizeof (struct T_unitdata_ind);
4426 		tudi->OPT_offset = sizeof (struct T_unitdata_ind) +
4427 		    sizeof (sin_t);
4428 		udi_size -= (sizeof (struct T_unitdata_ind) + sizeof (sin_t));
4429 		tudi->OPT_length = udi_size;
4430 		sin = (sin_t *)&tudi[1];
4431 		sin->sin_addr.s_addr = ((ipha_t *)rptr)->ipha_src;
4432 		sin->sin_port =	udpha->uha_src_port;
4433 		sin->sin_family = udp->udp_family;
4434 		*(uint32_t *)&sin->sin_zero[0] = 0;
4435 		*(uint32_t *)&sin->sin_zero[4] = 0;
4436 
4437 		/*
4438 		 * Add options if IP_RECVDSTADDR, IP_RECVIF, IP_RECVSLLA or
4439 		 * IP_RECVTTL has been set.
4440 		 */
4441 		if (udi_size != 0) {
4442 			/*
4443 			 * Copy in destination address before options to avoid
4444 			 * any padding issues.
4445 			 */
4446 			char *dstopt;
4447 
4448 			dstopt = (char *)&sin[1];
4449 			if (udp_bits.udpb_recvdstaddr) {
4450 				struct T_opthdr *toh;
4451 				ipaddr_t *dstptr;
4452 
4453 				toh = (struct T_opthdr *)dstopt;
4454 				toh->level = IPPROTO_IP;
4455 				toh->name = IP_RECVDSTADDR;
4456 				toh->len = sizeof (struct T_opthdr) +
4457 				    sizeof (ipaddr_t);
4458 				toh->status = 0;
4459 				dstopt += sizeof (struct T_opthdr);
4460 				dstptr = (ipaddr_t *)dstopt;
4461 				*dstptr = ((ipha_t *)rptr)->ipha_dst;
4462 				dstopt += sizeof (ipaddr_t);
4463 				udi_size -= toh->len;
4464 			}
4465 
4466 			if (udp_bits.udpb_recvopts && opt_len > 0) {
4467 				struct T_opthdr *toh;
4468 
4469 				toh = (struct T_opthdr *)dstopt;
4470 				toh->level = IPPROTO_IP;
4471 				toh->name = IP_RECVOPTS;
4472 				toh->len = sizeof (struct T_opthdr) + opt_len;
4473 				toh->status = 0;
4474 				dstopt += sizeof (struct T_opthdr);
4475 				bcopy(rptr + IP_SIMPLE_HDR_LENGTH, dstopt,
4476 				    opt_len);
4477 				dstopt += opt_len;
4478 				udi_size -= toh->len;
4479 			}
4480 
4481 			if ((udp_bits.udpb_ip_recvpktinfo) && (pinfo != NULL) &&
4482 			    (pinfo->ip_pkt_flags & IPF_RECVADDR)) {
4483 				struct T_opthdr *toh;
4484 				struct in_pktinfo *pktinfop;
4485 
4486 				toh = (struct T_opthdr *)dstopt;
4487 				toh->level = IPPROTO_IP;
4488 				toh->name = IP_PKTINFO;
4489 				toh->len = sizeof (struct T_opthdr) +
4490 				    sizeof (*pktinfop);
4491 				toh->status = 0;
4492 				dstopt += sizeof (struct T_opthdr);
4493 				pktinfop = (struct in_pktinfo *)dstopt;
4494 				pktinfop->ipi_ifindex = pinfo->ip_pkt_ifindex;
4495 				pktinfop->ipi_spec_dst =
4496 				    pinfo->ip_pkt_match_addr;
4497 				pktinfop->ipi_addr.s_addr =
4498 				    ((ipha_t *)rptr)->ipha_dst;
4499 
4500 				dstopt += sizeof (struct in_pktinfo);
4501 				udi_size -= toh->len;
4502 			}
4503 
4504 			if ((udp_bits.udpb_recvslla) && (pinfo != NULL) &&
4505 			    (pinfo->ip_pkt_flags & IPF_RECVSLLA)) {
4506 
4507 				struct T_opthdr *toh;
4508 				struct sockaddr_dl	*dstptr;
4509 
4510 				toh = (struct T_opthdr *)dstopt;
4511 				toh->level = IPPROTO_IP;
4512 				toh->name = IP_RECVSLLA;
4513 				toh->len = sizeof (struct T_opthdr) +
4514 				    sizeof (struct sockaddr_dl);
4515 				toh->status = 0;
4516 				dstopt += sizeof (struct T_opthdr);
4517 				dstptr = (struct sockaddr_dl *)dstopt;
4518 				bcopy(&pinfo->ip_pkt_slla, dstptr,
4519 				    sizeof (struct sockaddr_dl));
4520 				dstopt += sizeof (struct sockaddr_dl);
4521 				udi_size -= toh->len;
4522 			}
4523 
4524 			if ((udp_bits.udpb_recvif) && (pinfo != NULL) &&
4525 			    (pinfo->ip_pkt_flags & IPF_RECVIF)) {
4526 
4527 				struct T_opthdr *toh;
4528 				uint_t		*dstptr;
4529 
4530 				toh = (struct T_opthdr *)dstopt;
4531 				toh->level = IPPROTO_IP;
4532 				toh->name = IP_RECVIF;
4533 				toh->len = sizeof (struct T_opthdr) +
4534 				    sizeof (uint_t);
4535 				toh->status = 0;
4536 				dstopt += sizeof (struct T_opthdr);
4537 				dstptr = (uint_t *)dstopt;
4538 				*dstptr = pinfo->ip_pkt_ifindex;
4539 				dstopt += sizeof (uint_t);
4540 				udi_size -= toh->len;
4541 			}
4542 
4543 			if (cr != NULL) {
4544 				struct T_opthdr *toh;
4545 
4546 				toh = (struct T_opthdr *)dstopt;
4547 				toh->level = SOL_SOCKET;
4548 				toh->name = SCM_UCRED;
4549 				toh->len = sizeof (struct T_opthdr) + ucredsize;
4550 				toh->status = 0;
4551 				dstopt += sizeof (struct T_opthdr);
4552 				(void) cred2ucred(cr, cpid, dstopt, rcr);
4553 				dstopt += ucredsize;
4554 				udi_size -= toh->len;
4555 			}
4556 
4557 			if (udp_bits.udpb_timestamp) {
4558 				struct	T_opthdr *toh;
4559 
4560 				toh = (struct T_opthdr *)dstopt;
4561 				toh->level = SOL_SOCKET;
4562 				toh->name = SCM_TIMESTAMP;
4563 				toh->len = sizeof (struct T_opthdr) +
4564 				    sizeof (timestruc_t) + _POINTER_ALIGNMENT;
4565 				toh->status = 0;
4566 				dstopt += sizeof (struct T_opthdr);
4567 				/* Align for gethrestime() */
4568 				dstopt = (char *)P2ROUNDUP((intptr_t)dstopt,
4569 				    sizeof (intptr_t));
4570 				gethrestime((timestruc_t *)dstopt);
4571 				dstopt = (char *)toh + toh->len;
4572 				udi_size -= toh->len;
4573 			}
4574 
4575 			/*
4576 			 * CAUTION:
4577 			 * Due to aligment issues
4578 			 * Processing of IP_RECVTTL option
4579 			 * should always be the last. Adding
4580 			 * any option processing after this will
4581 			 * cause alignment panic.
4582 			 */
4583 			if (udp_bits.udpb_recvttl) {
4584 				struct	T_opthdr *toh;
4585 				uint8_t	*dstptr;
4586 
4587 				toh = (struct T_opthdr *)dstopt;
4588 				toh->level = IPPROTO_IP;
4589 				toh->name = IP_RECVTTL;
4590 				toh->len = sizeof (struct T_opthdr) +
4591 				    sizeof (uint8_t);
4592 				toh->status = 0;
4593 				dstopt += sizeof (struct T_opthdr);
4594 				dstptr = (uint8_t *)dstopt;
4595 				*dstptr = ((ipha_t *)rptr)->ipha_ttl;
4596 				dstopt += sizeof (uint8_t);
4597 				udi_size -= toh->len;
4598 			}
4599 
4600 			/* Consumed all of allocated space */
4601 			ASSERT(udi_size == 0);
4602 		}
4603 	} else {
4604 		sin6_t *sin6;
4605 
4606 		/*
4607 		 * Handle both IPv4 and IPv6 packets for IPv6 sockets.
4608 		 *
4609 		 * Normally we only send up the address. If receiving of any
4610 		 * optional receive side information is enabled, we also send
4611 		 * that up as options.
4612 		 */
4613 		udi_size = sizeof (struct T_unitdata_ind) + sizeof (sin6_t);
4614 
4615 		if (ipp.ipp_fields & (IPPF_HOPOPTS|IPPF_DSTOPTS|IPPF_RTDSTOPTS|
4616 		    IPPF_RTHDR|IPPF_IFINDEX)) {
4617 			if ((udp_bits.udpb_ipv6_recvhopopts) &&
4618 			    (ipp.ipp_fields & IPPF_HOPOPTS)) {
4619 				size_t hlen;
4620 
4621 				UDP_STAT(us, udp_in_recvhopopts);
4622 				hlen = copy_hop_opts(&ipp, NULL);
4623 				if (hlen == 0)
4624 					ipp.ipp_fields &= ~IPPF_HOPOPTS;
4625 				udi_size += hlen;
4626 			}
4627 			if (((udp_bits.udpb_ipv6_recvdstopts) ||
4628 			    udp_bits.udpb_old_ipv6_recvdstopts) &&
4629 			    (ipp.ipp_fields & IPPF_DSTOPTS)) {
4630 				udi_size += sizeof (struct T_opthdr) +
4631 				    ipp.ipp_dstoptslen;
4632 				UDP_STAT(us, udp_in_recvdstopts);
4633 			}
4634 			if ((((udp_bits.udpb_ipv6_recvdstopts) &&
4635 			    udp_bits.udpb_ipv6_recvrthdr &&
4636 			    (ipp.ipp_fields & IPPF_RTHDR)) ||
4637 			    (udp_bits.udpb_ipv6_recvrthdrdstopts)) &&
4638 			    (ipp.ipp_fields & IPPF_RTDSTOPTS)) {
4639 				udi_size += sizeof (struct T_opthdr) +
4640 				    ipp.ipp_rtdstoptslen;
4641 				UDP_STAT(us, udp_in_recvrtdstopts);
4642 			}
4643 			if ((udp_bits.udpb_ipv6_recvrthdr) &&
4644 			    (ipp.ipp_fields & IPPF_RTHDR)) {
4645 				udi_size += sizeof (struct T_opthdr) +
4646 				    ipp.ipp_rthdrlen;
4647 				UDP_STAT(us, udp_in_recvrthdr);
4648 			}
4649 			if ((udp_bits.udpb_ip_recvpktinfo) &&
4650 			    (ipp.ipp_fields & IPPF_IFINDEX)) {
4651 				udi_size += sizeof (struct T_opthdr) +
4652 				    sizeof (struct in6_pktinfo);
4653 				UDP_STAT(us, udp_in_recvpktinfo);
4654 			}
4655 
4656 		}
4657 		if ((udp_bits.udpb_recvucred) &&
4658 		    (cr = DB_CRED(mp)) != NULL) {
4659 			udi_size += sizeof (struct T_opthdr) + ucredsize;
4660 			cpid = DB_CPID(mp);
4661 			UDP_STAT(us, udp_in_recvucred);
4662 		}
4663 
4664 		/*
4665 		 * If SO_TIMESTAMP is set allocate the appropriate sized
4666 		 * buffer. Since gethrestime() expects a pointer aligned
4667 		 * argument, we allocate space necessary for extra
4668 		 * alignment (even though it might not be used).
4669 		 */
4670 		if (udp_bits.udpb_timestamp) {
4671 			udi_size += sizeof (struct T_opthdr) +
4672 			    sizeof (timestruc_t) + _POINTER_ALIGNMENT;
4673 			UDP_STAT(us, udp_in_timestamp);
4674 		}
4675 
4676 		if (udp_bits.udpb_ipv6_recvhoplimit) {
4677 			udi_size += sizeof (struct T_opthdr) + sizeof (int);
4678 			UDP_STAT(us, udp_in_recvhoplimit);
4679 		}
4680 
4681 		if (udp_bits.udpb_ipv6_recvtclass) {
4682 			udi_size += sizeof (struct T_opthdr) + sizeof (int);
4683 			UDP_STAT(us, udp_in_recvtclass);
4684 		}
4685 
4686 		mp1 = allocb(udi_size, BPRI_MED);
4687 		if (mp1 == NULL) {
4688 			freemsg(mp);
4689 			if (options_mp != NULL)
4690 				freeb(options_mp);
4691 			BUMP_MIB(&us->us_udp_mib, udpInErrors);
4692 			return;
4693 		}
4694 		mp1->b_cont = mp;
4695 		mp = mp1;
4696 		mp->b_datap->db_type = M_PROTO;
4697 		tudi = (struct T_unitdata_ind *)mp->b_rptr;
4698 		mp->b_wptr = (uchar_t *)tudi + udi_size;
4699 		tudi->PRIM_type = T_UNITDATA_IND;
4700 		tudi->SRC_length = sizeof (sin6_t);
4701 		tudi->SRC_offset = sizeof (struct T_unitdata_ind);
4702 		tudi->OPT_offset = sizeof (struct T_unitdata_ind) +
4703 		    sizeof (sin6_t);
4704 		udi_size -= (sizeof (struct T_unitdata_ind) + sizeof (sin6_t));
4705 		tudi->OPT_length = udi_size;
4706 		sin6 = (sin6_t *)&tudi[1];
4707 		if (ipversion == IPV4_VERSION) {
4708 			in6_addr_t v6dst;
4709 
4710 			IN6_IPADDR_TO_V4MAPPED(((ipha_t *)rptr)->ipha_src,
4711 			    &sin6->sin6_addr);
4712 			IN6_IPADDR_TO_V4MAPPED(((ipha_t *)rptr)->ipha_dst,
4713 			    &v6dst);
4714 			sin6->sin6_flowinfo = 0;
4715 			sin6->sin6_scope_id = 0;
4716 			sin6->__sin6_src_id = ip_srcid_find_addr(&v6dst,
4717 			    connp->conn_zoneid, us->us_netstack);
4718 		} else {
4719 			sin6->sin6_addr = ip6h->ip6_src;
4720 			/* No sin6_flowinfo per API */
4721 			sin6->sin6_flowinfo = 0;
4722 			/* For link-scope source pass up scope id */
4723 			if ((ipp.ipp_fields & IPPF_IFINDEX) &&
4724 			    IN6_IS_ADDR_LINKSCOPE(&ip6h->ip6_src))
4725 				sin6->sin6_scope_id = ipp.ipp_ifindex;
4726 			else
4727 				sin6->sin6_scope_id = 0;
4728 			sin6->__sin6_src_id = ip_srcid_find_addr(
4729 			    &ip6h->ip6_dst, connp->conn_zoneid,
4730 			    us->us_netstack);
4731 		}
4732 		sin6->sin6_port = udpha->uha_src_port;
4733 		sin6->sin6_family = udp->udp_family;
4734 
4735 		if (udi_size != 0) {
4736 			uchar_t *dstopt;
4737 
4738 			dstopt = (uchar_t *)&sin6[1];
4739 			if ((udp_bits.udpb_ip_recvpktinfo) &&
4740 			    (ipp.ipp_fields & IPPF_IFINDEX)) {
4741 				struct T_opthdr *toh;
4742 				struct in6_pktinfo *pkti;
4743 
4744 				toh = (struct T_opthdr *)dstopt;
4745 				toh->level = IPPROTO_IPV6;
4746 				toh->name = IPV6_PKTINFO;
4747 				toh->len = sizeof (struct T_opthdr) +
4748 				    sizeof (*pkti);
4749 				toh->status = 0;
4750 				dstopt += sizeof (struct T_opthdr);
4751 				pkti = (struct in6_pktinfo *)dstopt;
4752 				if (ipversion == IPV6_VERSION)
4753 					pkti->ipi6_addr = ip6h->ip6_dst;
4754 				else
4755 					IN6_IPADDR_TO_V4MAPPED(
4756 					    ((ipha_t *)rptr)->ipha_dst,
4757 					    &pkti->ipi6_addr);
4758 				pkti->ipi6_ifindex = ipp.ipp_ifindex;
4759 				dstopt += sizeof (*pkti);
4760 				udi_size -= toh->len;
4761 			}
4762 			if (udp_bits.udpb_ipv6_recvhoplimit) {
4763 				struct T_opthdr *toh;
4764 
4765 				toh = (struct T_opthdr *)dstopt;
4766 				toh->level = IPPROTO_IPV6;
4767 				toh->name = IPV6_HOPLIMIT;
4768 				toh->len = sizeof (struct T_opthdr) +
4769 				    sizeof (uint_t);
4770 				toh->status = 0;
4771 				dstopt += sizeof (struct T_opthdr);
4772 				if (ipversion == IPV6_VERSION)
4773 					*(uint_t *)dstopt = ip6h->ip6_hops;
4774 				else
4775 					*(uint_t *)dstopt =
4776 					    ((ipha_t *)rptr)->ipha_ttl;
4777 				dstopt += sizeof (uint_t);
4778 				udi_size -= toh->len;
4779 			}
4780 			if (udp_bits.udpb_ipv6_recvtclass) {
4781 				struct T_opthdr *toh;
4782 
4783 				toh = (struct T_opthdr *)dstopt;
4784 				toh->level = IPPROTO_IPV6;
4785 				toh->name = IPV6_TCLASS;
4786 				toh->len = sizeof (struct T_opthdr) +
4787 				    sizeof (uint_t);
4788 				toh->status = 0;
4789 				dstopt += sizeof (struct T_opthdr);
4790 				if (ipversion == IPV6_VERSION) {
4791 					*(uint_t *)dstopt =
4792 					    IPV6_FLOW_TCLASS(ip6h->ip6_flow);
4793 				} else {
4794 					ipha_t *ipha = (ipha_t *)rptr;
4795 					*(uint_t *)dstopt =
4796 					    ipha->ipha_type_of_service;
4797 				}
4798 				dstopt += sizeof (uint_t);
4799 				udi_size -= toh->len;
4800 			}
4801 			if ((udp_bits.udpb_ipv6_recvhopopts) &&
4802 			    (ipp.ipp_fields & IPPF_HOPOPTS)) {
4803 				size_t hlen;
4804 
4805 				hlen = copy_hop_opts(&ipp, dstopt);
4806 				dstopt += hlen;
4807 				udi_size -= hlen;
4808 			}
4809 			if ((udp_bits.udpb_ipv6_recvdstopts) &&
4810 			    (udp_bits.udpb_ipv6_recvrthdr) &&
4811 			    (ipp.ipp_fields & IPPF_RTHDR) &&
4812 			    (ipp.ipp_fields & IPPF_RTDSTOPTS)) {
4813 				struct T_opthdr *toh;
4814 
4815 				toh = (struct T_opthdr *)dstopt;
4816 				toh->level = IPPROTO_IPV6;
4817 				toh->name = IPV6_DSTOPTS;
4818 				toh->len = sizeof (struct T_opthdr) +
4819 				    ipp.ipp_rtdstoptslen;
4820 				toh->status = 0;
4821 				dstopt += sizeof (struct T_opthdr);
4822 				bcopy(ipp.ipp_rtdstopts, dstopt,
4823 				    ipp.ipp_rtdstoptslen);
4824 				dstopt += ipp.ipp_rtdstoptslen;
4825 				udi_size -= toh->len;
4826 			}
4827 			if ((udp_bits.udpb_ipv6_recvrthdr) &&
4828 			    (ipp.ipp_fields & IPPF_RTHDR)) {
4829 				struct T_opthdr *toh;
4830 
4831 				toh = (struct T_opthdr *)dstopt;
4832 				toh->level = IPPROTO_IPV6;
4833 				toh->name = IPV6_RTHDR;
4834 				toh->len = sizeof (struct T_opthdr) +
4835 				    ipp.ipp_rthdrlen;
4836 				toh->status = 0;
4837 				dstopt += sizeof (struct T_opthdr);
4838 				bcopy(ipp.ipp_rthdr, dstopt, ipp.ipp_rthdrlen);
4839 				dstopt += ipp.ipp_rthdrlen;
4840 				udi_size -= toh->len;
4841 			}
4842 			if ((udp_bits.udpb_ipv6_recvdstopts) &&
4843 			    (ipp.ipp_fields & IPPF_DSTOPTS)) {
4844 				struct T_opthdr *toh;
4845 
4846 				toh = (struct T_opthdr *)dstopt;
4847 				toh->level = IPPROTO_IPV6;
4848 				toh->name = IPV6_DSTOPTS;
4849 				toh->len = sizeof (struct T_opthdr) +
4850 				    ipp.ipp_dstoptslen;
4851 				toh->status = 0;
4852 				dstopt += sizeof (struct T_opthdr);
4853 				bcopy(ipp.ipp_dstopts, dstopt,
4854 				    ipp.ipp_dstoptslen);
4855 				dstopt += ipp.ipp_dstoptslen;
4856 				udi_size -= toh->len;
4857 			}
4858 
4859 			if (cr != NULL) {
4860 				struct T_opthdr *toh;
4861 
4862 				toh = (struct T_opthdr *)dstopt;
4863 				toh->level = SOL_SOCKET;
4864 				toh->name = SCM_UCRED;
4865 				toh->len = sizeof (struct T_opthdr) + ucredsize;
4866 				toh->status = 0;
4867 				(void) cred2ucred(cr, cpid, &toh[1], rcr);
4868 				dstopt += toh->len;
4869 				udi_size -= toh->len;
4870 			}
4871 			if (udp_bits.udpb_timestamp) {
4872 				struct	T_opthdr *toh;
4873 
4874 				toh = (struct T_opthdr *)dstopt;
4875 				toh->level = SOL_SOCKET;
4876 				toh->name = SCM_TIMESTAMP;
4877 				toh->len = sizeof (struct T_opthdr) +
4878 				    sizeof (timestruc_t) + _POINTER_ALIGNMENT;
4879 				toh->status = 0;
4880 				dstopt += sizeof (struct T_opthdr);
4881 				/* Align for gethrestime() */
4882 				dstopt = (uchar_t *)P2ROUNDUP((intptr_t)dstopt,
4883 				    sizeof (intptr_t));
4884 				gethrestime((timestruc_t *)dstopt);
4885 				dstopt = (uchar_t *)toh + toh->len;
4886 				udi_size -= toh->len;
4887 			}
4888 
4889 			/* Consumed all of allocated space */
4890 			ASSERT(udi_size == 0);
4891 		}
4892 #undef	sin6
4893 		/* No IP_RECVDSTADDR for IPv6. */
4894 	}
4895 
4896 	BUMP_MIB(&us->us_udp_mib, udpHCInDatagrams);
4897 	if (options_mp != NULL)
4898 		freeb(options_mp);
4899 
4900 	if (udp_bits.udpb_direct_sockfs) {
4901 		/*
4902 		 * There is nothing above us except for the stream head;
4903 		 * use the read-side synchronous stream interface in
4904 		 * order to reduce the time spent in interrupt thread.
4905 		 */
4906 		ASSERT(udp->udp_issocket);
4907 		udp_rcv_enqueue(connp->conn_rq, udp, mp, mp_len);
4908 	} else {
4909 		/*
4910 		 * Use regular STREAMS interface to pass data upstream
4911 		 * if this is not a socket endpoint, or if we have
4912 		 * switched over to the slow mode due to sockmod being
4913 		 * popped or a module being pushed on top of us.
4914 		 */
4915 		putnext(connp->conn_rq, mp);
4916 	}
4917 	return;
4918 
4919 tossit:
4920 	freemsg(mp);
4921 	if (options_mp != NULL)
4922 		freeb(options_mp);
4923 	BUMP_MIB(&us->us_udp_mib, udpInErrors);
4924 }
4925 
4926 /*
4927  * Handle the results of a T_BIND_REQ whether deferred by IP or handled
4928  * immediately.
4929  */
4930 static void
4931 udp_bind_result(conn_t *connp, mblk_t *mp)
4932 {
4933 	struct T_error_ack	*tea;
4934 
4935 	switch (mp->b_datap->db_type) {
4936 	case M_PROTO:
4937 	case M_PCPROTO:
4938 		/* M_PROTO messages contain some type of TPI message. */
4939 		ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <=
4940 		    (uintptr_t)INT_MAX);
4941 		if (mp->b_wptr - mp->b_rptr < sizeof (t_scalar_t)) {
4942 			freemsg(mp);
4943 			return;
4944 		}
4945 		tea = (struct T_error_ack *)mp->b_rptr;
4946 
4947 		switch (tea->PRIM_type) {
4948 		case T_ERROR_ACK:
4949 			switch (tea->ERROR_prim) {
4950 			case O_T_BIND_REQ:
4951 			case T_BIND_REQ:
4952 				udp_bind_error(connp, mp);
4953 				return;
4954 			default:
4955 				break;
4956 			}
4957 			ASSERT(0);
4958 			freemsg(mp);
4959 			return;
4960 
4961 		case T_BIND_ACK:
4962 			udp_bind_ack(connp, mp);
4963 			return;
4964 
4965 		default:
4966 			break;
4967 		}
4968 		freemsg(mp);
4969 		return;
4970 	default:
4971 		/* FIXME: other cases? */
4972 		ASSERT(0);
4973 		freemsg(mp);
4974 		return;
4975 	}
4976 }
4977 
4978 /*
4979  * Process a T_BIND_ACK
4980  */
4981 static void
4982 udp_bind_ack(conn_t *connp, mblk_t *mp)
4983 {
4984 	udp_t	*udp = connp->conn_udp;
4985 	mblk_t	*mp1;
4986 	ire_t	*ire;
4987 	struct T_bind_ack *tba;
4988 	uchar_t *addrp;
4989 	ipa_conn_t	*ac;
4990 	ipa6_conn_t	*ac6;
4991 	udp_fanout_t	*udpf;
4992 	udp_stack_t	*us = udp->udp_us;
4993 
4994 	ASSERT(udp->udp_pending_op != -1);
4995 	rw_enter(&udp->udp_rwlock, RW_WRITER);
4996 	/*
4997 	 * If a broadcast/multicast address was bound set
4998 	 * the source address to 0.
4999 	 * This ensures no datagrams with broadcast address
5000 	 * as source address are emitted (which would violate
5001 	 * RFC1122 - Hosts requirements)
5002 	 *
5003 	 * Note that when connecting the returned IRE is
5004 	 * for the destination address and we only perform
5005 	 * the broadcast check for the source address (it
5006 	 * is OK to connect to a broadcast/multicast address.)
5007 	 */
5008 	mp1 = mp->b_cont;
5009 	if (mp1 != NULL && mp1->b_datap->db_type == IRE_DB_TYPE) {
5010 		ire = (ire_t *)mp1->b_rptr;
5011 
5012 		/*
5013 		 * Note: we get IRE_BROADCAST for IPv6 to "mark" a multicast
5014 		 * local address.
5015 		 */
5016 		udpf = &us->us_bind_fanout[UDP_BIND_HASH(udp->udp_port,
5017 		    us->us_bind_fanout_size)];
5018 		if (ire->ire_type == IRE_BROADCAST &&
5019 		    udp->udp_state != TS_DATA_XFER) {
5020 			ASSERT(udp->udp_pending_op == T_BIND_REQ ||
5021 			    udp->udp_pending_op == O_T_BIND_REQ);
5022 			/* This was just a local bind to a broadcast addr */
5023 			mutex_enter(&udpf->uf_lock);
5024 			V6_SET_ZERO(udp->udp_v6src);
5025 			mutex_exit(&udpf->uf_lock);
5026 			if (udp->udp_family == AF_INET6)
5027 				(void) udp_build_hdrs(udp);
5028 		} else if (V6_OR_V4_INADDR_ANY(udp->udp_v6src)) {
5029 			/*
5030 			 * Local address not yet set - pick it from the
5031 			 * T_bind_ack
5032 			 */
5033 			tba = (struct T_bind_ack *)mp->b_rptr;
5034 			addrp = &mp->b_rptr[tba->ADDR_offset];
5035 			switch (udp->udp_family) {
5036 			case AF_INET:
5037 				if (tba->ADDR_length == sizeof (ipa_conn_t)) {
5038 					ac = (ipa_conn_t *)addrp;
5039 				} else {
5040 					ASSERT(tba->ADDR_length ==
5041 					    sizeof (ipa_conn_x_t));
5042 					ac = &((ipa_conn_x_t *)addrp)->acx_conn;
5043 				}
5044 				mutex_enter(&udpf->uf_lock);
5045 				IN6_IPADDR_TO_V4MAPPED(ac->ac_laddr,
5046 				    &udp->udp_v6src);
5047 				mutex_exit(&udpf->uf_lock);
5048 				break;
5049 			case AF_INET6:
5050 				if (tba->ADDR_length == sizeof (ipa6_conn_t)) {
5051 					ac6 = (ipa6_conn_t *)addrp;
5052 				} else {
5053 					ASSERT(tba->ADDR_length ==
5054 					    sizeof (ipa6_conn_x_t));
5055 					ac6 = &((ipa6_conn_x_t *)
5056 					    addrp)->ac6x_conn;
5057 				}
5058 				mutex_enter(&udpf->uf_lock);
5059 				udp->udp_v6src = ac6->ac6_laddr;
5060 				mutex_exit(&udpf->uf_lock);
5061 				(void) udp_build_hdrs(udp);
5062 				break;
5063 			}
5064 		}
5065 		mp1 = mp1->b_cont;
5066 	}
5067 	udp->udp_pending_op = -1;
5068 	rw_exit(&udp->udp_rwlock);
5069 	/*
5070 	 * Look for one or more appended ACK message added by
5071 	 * udp_connect or udp_disconnect.
5072 	 * If none found just send up the T_BIND_ACK.
5073 	 * udp_connect has appended a T_OK_ACK and a T_CONN_CON.
5074 	 * udp_disconnect has appended a T_OK_ACK.
5075 	 */
5076 	if (mp1 != NULL) {
5077 		if (mp->b_cont == mp1)
5078 			mp->b_cont = NULL;
5079 		else {
5080 			ASSERT(mp->b_cont->b_cont == mp1);
5081 			mp->b_cont->b_cont = NULL;
5082 		}
5083 		freemsg(mp);
5084 		mp = mp1;
5085 		while (mp != NULL) {
5086 			mp1 = mp->b_cont;
5087 			mp->b_cont = NULL;
5088 			putnext(connp->conn_rq, mp);
5089 			mp = mp1;
5090 		}
5091 		return;
5092 	}
5093 	freemsg(mp->b_cont);
5094 	mp->b_cont = NULL;
5095 	putnext(connp->conn_rq, mp);
5096 }
5097 
5098 static void
5099 udp_bind_error(conn_t *connp, mblk_t *mp)
5100 {
5101 	udp_t	*udp = connp->conn_udp;
5102 	struct T_error_ack *tea;
5103 	udp_fanout_t	*udpf;
5104 	udp_stack_t	*us = udp->udp_us;
5105 
5106 	tea = (struct T_error_ack *)mp->b_rptr;
5107 
5108 	/*
5109 	 * If our O_T_BIND_REQ/T_BIND_REQ fails,
5110 	 * clear out the associated port and source
5111 	 * address before passing the message
5112 	 * upstream. If this was caused by a T_CONN_REQ
5113 	 * revert back to bound state.
5114 	 */
5115 
5116 	rw_enter(&udp->udp_rwlock, RW_WRITER);
5117 	ASSERT(udp->udp_pending_op != -1);
5118 	tea->ERROR_prim = udp->udp_pending_op;
5119 	udp->udp_pending_op = -1;
5120 	udpf = &us->us_bind_fanout[
5121 	    UDP_BIND_HASH(udp->udp_port,
5122 	    us->us_bind_fanout_size)];
5123 	mutex_enter(&udpf->uf_lock);
5124 
5125 	switch (tea->ERROR_prim) {
5126 	case T_CONN_REQ:
5127 		ASSERT(udp->udp_state == TS_DATA_XFER);
5128 		/* Connect failed */
5129 		/* Revert back to the bound source */
5130 		udp->udp_v6src = udp->udp_bound_v6src;
5131 		udp->udp_state = TS_IDLE;
5132 		mutex_exit(&udpf->uf_lock);
5133 		if (udp->udp_family == AF_INET6)
5134 			(void) udp_build_hdrs(udp);
5135 		rw_exit(&udp->udp_rwlock);
5136 		break;
5137 
5138 	case T_DISCON_REQ:
5139 	case T_BIND_REQ:
5140 	case O_T_BIND_REQ:
5141 		V6_SET_ZERO(udp->udp_v6src);
5142 		V6_SET_ZERO(udp->udp_bound_v6src);
5143 		udp->udp_state = TS_UNBND;
5144 		udp_bind_hash_remove(udp, B_TRUE);
5145 		udp->udp_port = 0;
5146 		mutex_exit(&udpf->uf_lock);
5147 		if (udp->udp_family == AF_INET6)
5148 			(void) udp_build_hdrs(udp);
5149 		rw_exit(&udp->udp_rwlock);
5150 		break;
5151 
5152 	default:
5153 		mutex_exit(&udpf->uf_lock);
5154 		rw_exit(&udp->udp_rwlock);
5155 		(void) mi_strlog(connp->conn_rq, 1,
5156 		    SL_ERROR|SL_TRACE,
5157 		    "udp_input_other: bad ERROR_prim, "
5158 		    "len %d", tea->ERROR_prim);
5159 	}
5160 	putnext(connp->conn_rq, mp);
5161 }
5162 
5163 /*
5164  * return SNMP stuff in buffer in mpdata. We don't hold any lock and report
5165  * information that can be changing beneath us.
5166  */
5167 mblk_t *
5168 udp_snmp_get(queue_t *q, mblk_t *mpctl)
5169 {
5170 	mblk_t			*mpdata;
5171 	mblk_t			*mp_conn_ctl;
5172 	mblk_t			*mp_attr_ctl;
5173 	mblk_t			*mp6_conn_ctl;
5174 	mblk_t			*mp6_attr_ctl;
5175 	mblk_t			*mp_conn_tail;
5176 	mblk_t			*mp_attr_tail;
5177 	mblk_t			*mp6_conn_tail;
5178 	mblk_t			*mp6_attr_tail;
5179 	struct opthdr		*optp;
5180 	mib2_udpEntry_t		ude;
5181 	mib2_udp6Entry_t	ude6;
5182 	mib2_transportMLPEntry_t mlp;
5183 	int			state;
5184 	zoneid_t		zoneid;
5185 	int			i;
5186 	connf_t			*connfp;
5187 	conn_t			*connp = Q_TO_CONN(q);
5188 	int			v4_conn_idx;
5189 	int			v6_conn_idx;
5190 	boolean_t		needattr;
5191 	udp_t			*udp;
5192 	ip_stack_t		*ipst = connp->conn_netstack->netstack_ip;
5193 	udp_stack_t		*us = connp->conn_netstack->netstack_udp;
5194 	mblk_t			*mp2ctl;
5195 
5196 	/*
5197 	 * make a copy of the original message
5198 	 */
5199 	mp2ctl = copymsg(mpctl);
5200 
5201 	mp_conn_ctl = mp_attr_ctl = mp6_conn_ctl = NULL;
5202 	if (mpctl == NULL ||
5203 	    (mpdata = mpctl->b_cont) == NULL ||
5204 	    (mp_conn_ctl = copymsg(mpctl)) == NULL ||
5205 	    (mp_attr_ctl = copymsg(mpctl)) == NULL ||
5206 	    (mp6_conn_ctl = copymsg(mpctl)) == NULL ||
5207 	    (mp6_attr_ctl = copymsg(mpctl)) == NULL) {
5208 		freemsg(mp_conn_ctl);
5209 		freemsg(mp_attr_ctl);
5210 		freemsg(mp6_conn_ctl);
5211 		freemsg(mpctl);
5212 		freemsg(mp2ctl);
5213 		return (0);
5214 	}
5215 
5216 	zoneid = connp->conn_zoneid;
5217 
5218 	/* fixed length structure for IPv4 and IPv6 counters */
5219 	SET_MIB(us->us_udp_mib.udpEntrySize, sizeof (mib2_udpEntry_t));
5220 	SET_MIB(us->us_udp_mib.udp6EntrySize, sizeof (mib2_udp6Entry_t));
5221 	/* synchronize 64- and 32-bit counters */
5222 	SYNC32_MIB(&us->us_udp_mib, udpInDatagrams, udpHCInDatagrams);
5223 	SYNC32_MIB(&us->us_udp_mib, udpOutDatagrams, udpHCOutDatagrams);
5224 
5225 	optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
5226 	optp->level = MIB2_UDP;
5227 	optp->name = 0;
5228 	(void) snmp_append_data(mpdata, (char *)&us->us_udp_mib,
5229 	    sizeof (us->us_udp_mib));
5230 	optp->len = msgdsize(mpdata);
5231 	qreply(q, mpctl);
5232 
5233 	mp_conn_tail = mp_attr_tail = mp6_conn_tail = mp6_attr_tail = NULL;
5234 	v4_conn_idx = v6_conn_idx = 0;
5235 
5236 	for (i = 0; i < CONN_G_HASH_SIZE; i++) {
5237 		connfp = &ipst->ips_ipcl_globalhash_fanout[i];
5238 		connp = NULL;
5239 
5240 		while ((connp = ipcl_get_next_conn(connfp, connp,
5241 		    IPCL_UDPCONN))) {
5242 			udp = connp->conn_udp;
5243 			if (zoneid != connp->conn_zoneid)
5244 				continue;
5245 
5246 			/*
5247 			 * Note that the port numbers are sent in
5248 			 * host byte order
5249 			 */
5250 
5251 			if (udp->udp_state == TS_UNBND)
5252 				state = MIB2_UDP_unbound;
5253 			else if (udp->udp_state == TS_IDLE)
5254 				state = MIB2_UDP_idle;
5255 			else if (udp->udp_state == TS_DATA_XFER)
5256 				state = MIB2_UDP_connected;
5257 			else
5258 				state = MIB2_UDP_unknown;
5259 
5260 			needattr = B_FALSE;
5261 			bzero(&mlp, sizeof (mlp));
5262 			if (connp->conn_mlp_type != mlptSingle) {
5263 				if (connp->conn_mlp_type == mlptShared ||
5264 				    connp->conn_mlp_type == mlptBoth)
5265 					mlp.tme_flags |= MIB2_TMEF_SHARED;
5266 				if (connp->conn_mlp_type == mlptPrivate ||
5267 				    connp->conn_mlp_type == mlptBoth)
5268 					mlp.tme_flags |= MIB2_TMEF_PRIVATE;
5269 				needattr = B_TRUE;
5270 			}
5271 
5272 			/*
5273 			 * Create an IPv4 table entry for IPv4 entries and also
5274 			 * any IPv6 entries which are bound to in6addr_any
5275 			 * (i.e. anything a IPv4 peer could connect/send to).
5276 			 */
5277 			if (udp->udp_ipversion == IPV4_VERSION ||
5278 			    (udp->udp_state <= TS_IDLE &&
5279 			    IN6_IS_ADDR_UNSPECIFIED(&udp->udp_v6src))) {
5280 				ude.udpEntryInfo.ue_state = state;
5281 				/*
5282 				 * If in6addr_any this will set it to
5283 				 * INADDR_ANY
5284 				 */
5285 				ude.udpLocalAddress =
5286 				    V4_PART_OF_V6(udp->udp_v6src);
5287 				ude.udpLocalPort = ntohs(udp->udp_port);
5288 				if (udp->udp_state == TS_DATA_XFER) {
5289 					/*
5290 					 * Can potentially get here for
5291 					 * v6 socket if another process
5292 					 * (say, ping) has just done a
5293 					 * sendto(), changing the state
5294 					 * from the TS_IDLE above to
5295 					 * TS_DATA_XFER by the time we hit
5296 					 * this part of the code.
5297 					 */
5298 					ude.udpEntryInfo.ue_RemoteAddress =
5299 					    V4_PART_OF_V6(udp->udp_v6dst);
5300 					ude.udpEntryInfo.ue_RemotePort =
5301 					    ntohs(udp->udp_dstport);
5302 				} else {
5303 					ude.udpEntryInfo.ue_RemoteAddress = 0;
5304 					ude.udpEntryInfo.ue_RemotePort = 0;
5305 				}
5306 
5307 				/*
5308 				 * We make the assumption that all udp_t
5309 				 * structs will be created within an address
5310 				 * region no larger than 32-bits.
5311 				 */
5312 				ude.udpInstance = (uint32_t)(uintptr_t)udp;
5313 				ude.udpCreationProcess =
5314 				    (udp->udp_open_pid < 0) ?
5315 				    MIB2_UNKNOWN_PROCESS :
5316 				    udp->udp_open_pid;
5317 				ude.udpCreationTime = udp->udp_open_time;
5318 
5319 				(void) snmp_append_data2(mp_conn_ctl->b_cont,
5320 				    &mp_conn_tail, (char *)&ude, sizeof (ude));
5321 				mlp.tme_connidx = v4_conn_idx++;
5322 				if (needattr)
5323 					(void) snmp_append_data2(
5324 					    mp_attr_ctl->b_cont, &mp_attr_tail,
5325 					    (char *)&mlp, sizeof (mlp));
5326 			}
5327 			if (udp->udp_ipversion == IPV6_VERSION) {
5328 				ude6.udp6EntryInfo.ue_state  = state;
5329 				ude6.udp6LocalAddress = udp->udp_v6src;
5330 				ude6.udp6LocalPort = ntohs(udp->udp_port);
5331 				ude6.udp6IfIndex = udp->udp_bound_if;
5332 				if (udp->udp_state == TS_DATA_XFER) {
5333 					ude6.udp6EntryInfo.ue_RemoteAddress =
5334 					    udp->udp_v6dst;
5335 					ude6.udp6EntryInfo.ue_RemotePort =
5336 					    ntohs(udp->udp_dstport);
5337 				} else {
5338 					ude6.udp6EntryInfo.ue_RemoteAddress =
5339 					    sin6_null.sin6_addr;
5340 					ude6.udp6EntryInfo.ue_RemotePort = 0;
5341 				}
5342 				/*
5343 				 * We make the assumption that all udp_t
5344 				 * structs will be created within an address
5345 				 * region no larger than 32-bits.
5346 				 */
5347 				ude6.udp6Instance = (uint32_t)(uintptr_t)udp;
5348 				ude6.udp6CreationProcess =
5349 				    (udp->udp_open_pid < 0) ?
5350 				    MIB2_UNKNOWN_PROCESS :
5351 				    udp->udp_open_pid;
5352 				ude6.udp6CreationTime = udp->udp_open_time;
5353 
5354 				(void) snmp_append_data2(mp6_conn_ctl->b_cont,
5355 				    &mp6_conn_tail, (char *)&ude6,
5356 				    sizeof (ude6));
5357 				mlp.tme_connidx = v6_conn_idx++;
5358 				if (needattr)
5359 					(void) snmp_append_data2(
5360 					    mp6_attr_ctl->b_cont,
5361 					    &mp6_attr_tail, (char *)&mlp,
5362 					    sizeof (mlp));
5363 			}
5364 		}
5365 	}
5366 
5367 	/* IPv4 UDP endpoints */
5368 	optp = (struct opthdr *)&mp_conn_ctl->b_rptr[
5369 	    sizeof (struct T_optmgmt_ack)];
5370 	optp->level = MIB2_UDP;
5371 	optp->name = MIB2_UDP_ENTRY;
5372 	optp->len = msgdsize(mp_conn_ctl->b_cont);
5373 	qreply(q, mp_conn_ctl);
5374 
5375 	/* table of MLP attributes... */
5376 	optp = (struct opthdr *)&mp_attr_ctl->b_rptr[
5377 	    sizeof (struct T_optmgmt_ack)];
5378 	optp->level = MIB2_UDP;
5379 	optp->name = EXPER_XPORT_MLP;
5380 	optp->len = msgdsize(mp_attr_ctl->b_cont);
5381 	if (optp->len == 0)
5382 		freemsg(mp_attr_ctl);
5383 	else
5384 		qreply(q, mp_attr_ctl);
5385 
5386 	/* IPv6 UDP endpoints */
5387 	optp = (struct opthdr *)&mp6_conn_ctl->b_rptr[
5388 	    sizeof (struct T_optmgmt_ack)];
5389 	optp->level = MIB2_UDP6;
5390 	optp->name = MIB2_UDP6_ENTRY;
5391 	optp->len = msgdsize(mp6_conn_ctl->b_cont);
5392 	qreply(q, mp6_conn_ctl);
5393 
5394 	/* table of MLP attributes... */
5395 	optp = (struct opthdr *)&mp6_attr_ctl->b_rptr[
5396 	    sizeof (struct T_optmgmt_ack)];
5397 	optp->level = MIB2_UDP6;
5398 	optp->name = EXPER_XPORT_MLP;
5399 	optp->len = msgdsize(mp6_attr_ctl->b_cont);
5400 	if (optp->len == 0)
5401 		freemsg(mp6_attr_ctl);
5402 	else
5403 		qreply(q, mp6_attr_ctl);
5404 
5405 	return (mp2ctl);
5406 }
5407 
5408 /*
5409  * Return 0 if invalid set request, 1 otherwise, including non-udp requests.
5410  * NOTE: Per MIB-II, UDP has no writable data.
5411  * TODO:  If this ever actually tries to set anything, it needs to be
5412  * to do the appropriate locking.
5413  */
5414 /* ARGSUSED */
5415 int
5416 udp_snmp_set(queue_t *q, t_scalar_t level, t_scalar_t name,
5417     uchar_t *ptr, int len)
5418 {
5419 	switch (level) {
5420 	case MIB2_UDP:
5421 		return (0);
5422 	default:
5423 		return (1);
5424 	}
5425 }
5426 
5427 static void
5428 udp_report_item(mblk_t *mp, udp_t *udp)
5429 {
5430 	char *state;
5431 	char addrbuf1[INET6_ADDRSTRLEN];
5432 	char addrbuf2[INET6_ADDRSTRLEN];
5433 	uint_t print_len, buf_len;
5434 
5435 	buf_len = mp->b_datap->db_lim - mp->b_wptr;
5436 	ASSERT(buf_len >= 0);
5437 	if (buf_len == 0)
5438 		return;
5439 
5440 	if (udp->udp_state == TS_UNBND)
5441 		state = "UNBOUND";
5442 	else if (udp->udp_state == TS_IDLE)
5443 		state = "IDLE";
5444 	else if (udp->udp_state == TS_DATA_XFER)
5445 		state = "CONNECTED";
5446 	else
5447 		state = "UnkState";
5448 	print_len = snprintf((char *)mp->b_wptr, buf_len,
5449 	    MI_COL_PTRFMT_STR "%4d %5u %s %s %5u %s\n",
5450 	    (void *)udp, udp->udp_connp->conn_zoneid, ntohs(udp->udp_port),
5451 	    inet_ntop(AF_INET6, &udp->udp_v6src, addrbuf1, sizeof (addrbuf1)),
5452 	    inet_ntop(AF_INET6, &udp->udp_v6dst, addrbuf2, sizeof (addrbuf2)),
5453 	    ntohs(udp->udp_dstport), state);
5454 	if (print_len < buf_len) {
5455 		mp->b_wptr += print_len;
5456 	} else {
5457 		mp->b_wptr += buf_len;
5458 	}
5459 }
5460 
5461 /* Report for ndd "udp_status" */
5462 /* ARGSUSED */
5463 static int
5464 udp_status_report(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr)
5465 {
5466 	zoneid_t zoneid;
5467 	connf_t	*connfp;
5468 	conn_t	*connp = Q_TO_CONN(q);
5469 	udp_t	*udp = connp->conn_udp;
5470 	int	i;
5471 	udp_stack_t *us = udp->udp_us;
5472 	ip_stack_t *ipst = connp->conn_netstack->netstack_ip;
5473 
5474 	/*
5475 	 * Because of the ndd constraint, at most we can have 64K buffer
5476 	 * to put in all UDP info.  So to be more efficient, just
5477 	 * allocate a 64K buffer here, assuming we need that large buffer.
5478 	 * This may be a problem as any user can read udp_status.  Therefore
5479 	 * we limit the rate of doing this using us_ndd_get_info_interval.
5480 	 * This should be OK as normal users should not do this too often.
5481 	 */
5482 	if (cr == NULL || secpolicy_ip_config(cr, B_TRUE) != 0) {
5483 		if (ddi_get_lbolt() - us->us_last_ndd_get_info_time <
5484 		    drv_usectohz(us->us_ndd_get_info_interval * 1000)) {
5485 			(void) mi_mpprintf(mp, NDD_TOO_QUICK_MSG);
5486 			return (0);
5487 		}
5488 	}
5489 	if ((mp->b_cont = allocb(ND_MAX_BUF_LEN, BPRI_HI)) == NULL) {
5490 		/* The following may work even if we cannot get a large buf. */
5491 		(void) mi_mpprintf(mp, NDD_OUT_OF_BUF_MSG);
5492 		return (0);
5493 	}
5494 	(void) mi_mpprintf(mp,
5495 	    "UDP     " MI_COL_HDRPAD_STR
5496 	/*   12345678[89ABCDEF] */
5497 	    " zone lport src addr        dest addr       port  state");
5498 	/*    1234 12345 xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx 12345 UNBOUND */
5499 
5500 	zoneid = connp->conn_zoneid;
5501 
5502 	for (i = 0; i < CONN_G_HASH_SIZE; i++) {
5503 		connfp = &ipst->ips_ipcl_globalhash_fanout[i];
5504 		connp = NULL;
5505 
5506 		while ((connp = ipcl_get_next_conn(connfp, connp,
5507 		    IPCL_UDPCONN))) {
5508 			udp = connp->conn_udp;
5509 			if (zoneid != GLOBAL_ZONEID &&
5510 			    zoneid != connp->conn_zoneid)
5511 				continue;
5512 
5513 			udp_report_item(mp->b_cont, udp);
5514 		}
5515 	}
5516 	us->us_last_ndd_get_info_time = ddi_get_lbolt();
5517 	return (0);
5518 }
5519 
5520 /*
5521  * This routine creates a T_UDERROR_IND message and passes it upstream.
5522  * The address and options are copied from the T_UNITDATA_REQ message
5523  * passed in mp.  This message is freed.
5524  */
5525 static void
5526 udp_ud_err(queue_t *q, mblk_t *mp, uchar_t *destaddr, t_scalar_t destlen,
5527     t_scalar_t err)
5528 {
5529 	struct T_unitdata_req *tudr;
5530 	mblk_t	*mp1;
5531 	uchar_t	*optaddr;
5532 	t_scalar_t optlen;
5533 
5534 	if (DB_TYPE(mp) == M_DATA) {
5535 		ASSERT(destaddr != NULL && destlen != 0);
5536 		optaddr = NULL;
5537 		optlen = 0;
5538 	} else {
5539 		if ((mp->b_wptr < mp->b_rptr) ||
5540 		    (MBLKL(mp)) < sizeof (struct T_unitdata_req)) {
5541 			goto done;
5542 		}
5543 		tudr = (struct T_unitdata_req *)mp->b_rptr;
5544 		destaddr = mp->b_rptr + tudr->DEST_offset;
5545 		if (destaddr < mp->b_rptr || destaddr >= mp->b_wptr ||
5546 		    destaddr + tudr->DEST_length < mp->b_rptr ||
5547 		    destaddr + tudr->DEST_length > mp->b_wptr) {
5548 			goto done;
5549 		}
5550 		optaddr = mp->b_rptr + tudr->OPT_offset;
5551 		if (optaddr < mp->b_rptr || optaddr >= mp->b_wptr ||
5552 		    optaddr + tudr->OPT_length < mp->b_rptr ||
5553 		    optaddr + tudr->OPT_length > mp->b_wptr) {
5554 			goto done;
5555 		}
5556 		destlen = tudr->DEST_length;
5557 		optlen = tudr->OPT_length;
5558 	}
5559 
5560 	mp1 = mi_tpi_uderror_ind((char *)destaddr, destlen,
5561 	    (char *)optaddr, optlen, err);
5562 	if (mp1 != NULL)
5563 		qreply(q, mp1);
5564 
5565 done:
5566 	freemsg(mp);
5567 }
5568 
5569 /*
5570  * This routine removes a port number association from a stream.  It
5571  * is called by udp_wput to handle T_UNBIND_REQ messages.
5572  */
5573 static void
5574 udp_unbind(queue_t *q, mblk_t *mp)
5575 {
5576 	udp_t *udp = Q_TO_UDP(q);
5577 	udp_fanout_t	*udpf;
5578 	udp_stack_t	*us = udp->udp_us;
5579 
5580 	if (cl_inet_unbind != NULL) {
5581 		/*
5582 		 * Running in cluster mode - register unbind information
5583 		 */
5584 		if (udp->udp_ipversion == IPV4_VERSION) {
5585 			(*cl_inet_unbind)(IPPROTO_UDP, AF_INET,
5586 			    (uint8_t *)(&V4_PART_OF_V6(udp->udp_v6src)),
5587 			    (in_port_t)udp->udp_port);
5588 		} else {
5589 			(*cl_inet_unbind)(IPPROTO_UDP, AF_INET6,
5590 			    (uint8_t *)&(udp->udp_v6src),
5591 			    (in_port_t)udp->udp_port);
5592 		}
5593 	}
5594 
5595 	rw_enter(&udp->udp_rwlock, RW_WRITER);
5596 	if (udp->udp_state == TS_UNBND || udp->udp_pending_op != -1) {
5597 		rw_exit(&udp->udp_rwlock);
5598 		udp_err_ack(q, mp, TOUTSTATE, 0);
5599 		return;
5600 	}
5601 	udp->udp_pending_op = T_UNBIND_REQ;
5602 	rw_exit(&udp->udp_rwlock);
5603 
5604 	/*
5605 	 * Pass the unbind to IP; T_UNBIND_REQ is larger than T_OK_ACK
5606 	 * and therefore ip_unbind must never return NULL.
5607 	 */
5608 	mp = ip_unbind(q, mp);
5609 	ASSERT(mp != NULL);
5610 	ASSERT(((struct T_ok_ack *)mp->b_rptr)->PRIM_type == T_OK_ACK);
5611 
5612 	/*
5613 	 * Once we're unbound from IP, the pending operation may be cleared
5614 	 * here.
5615 	 */
5616 	rw_enter(&udp->udp_rwlock, RW_WRITER);
5617 	udpf = &us->us_bind_fanout[UDP_BIND_HASH(udp->udp_port,
5618 	    us->us_bind_fanout_size)];
5619 	mutex_enter(&udpf->uf_lock);
5620 	udp_bind_hash_remove(udp, B_TRUE);
5621 	V6_SET_ZERO(udp->udp_v6src);
5622 	V6_SET_ZERO(udp->udp_bound_v6src);
5623 	udp->udp_port = 0;
5624 	mutex_exit(&udpf->uf_lock);
5625 
5626 	udp->udp_pending_op = -1;
5627 	udp->udp_state = TS_UNBND;
5628 	if (udp->udp_family == AF_INET6)
5629 		(void) udp_build_hdrs(udp);
5630 	rw_exit(&udp->udp_rwlock);
5631 
5632 	qreply(q, mp);
5633 }
5634 
5635 /*
5636  * Don't let port fall into the privileged range.
5637  * Since the extra privileged ports can be arbitrary we also
5638  * ensure that we exclude those from consideration.
5639  * us->us_epriv_ports is not sorted thus we loop over it until
5640  * there are no changes.
5641  */
5642 static in_port_t
5643 udp_update_next_port(udp_t *udp, in_port_t port, boolean_t random)
5644 {
5645 	int i;
5646 	in_port_t nextport;
5647 	boolean_t restart = B_FALSE;
5648 	udp_stack_t *us = udp->udp_us;
5649 
5650 	if (random && udp_random_anon_port != 0) {
5651 		(void) random_get_pseudo_bytes((uint8_t *)&port,
5652 		    sizeof (in_port_t));
5653 		/*
5654 		 * Unless changed by a sys admin, the smallest anon port
5655 		 * is 32768 and the largest anon port is 65535.  It is
5656 		 * very likely (50%) for the random port to be smaller
5657 		 * than the smallest anon port.  When that happens,
5658 		 * add port % (anon port range) to the smallest anon
5659 		 * port to get the random port.  It should fall into the
5660 		 * valid anon port range.
5661 		 */
5662 		if (port < us->us_smallest_anon_port) {
5663 			port = us->us_smallest_anon_port +
5664 			    port % (us->us_largest_anon_port -
5665 			    us->us_smallest_anon_port);
5666 		}
5667 	}
5668 
5669 retry:
5670 	if (port < us->us_smallest_anon_port)
5671 		port = us->us_smallest_anon_port;
5672 
5673 	if (port > us->us_largest_anon_port) {
5674 		port = us->us_smallest_anon_port;
5675 		if (restart)
5676 			return (0);
5677 		restart = B_TRUE;
5678 	}
5679 
5680 	if (port < us->us_smallest_nonpriv_port)
5681 		port = us->us_smallest_nonpriv_port;
5682 
5683 	for (i = 0; i < us->us_num_epriv_ports; i++) {
5684 		if (port == us->us_epriv_ports[i]) {
5685 			port++;
5686 			/*
5687 			 * Make sure that the port is in the
5688 			 * valid range.
5689 			 */
5690 			goto retry;
5691 		}
5692 	}
5693 
5694 	if (is_system_labeled() &&
5695 	    (nextport = tsol_next_port(crgetzone(udp->udp_connp->conn_cred),
5696 	    port, IPPROTO_UDP, B_TRUE)) != 0) {
5697 		port = nextport;
5698 		goto retry;
5699 	}
5700 
5701 	return (port);
5702 }
5703 
5704 static int
5705 udp_update_label(queue_t *wq, mblk_t *mp, ipaddr_t dst)
5706 {
5707 	int err;
5708 	uchar_t opt_storage[IP_MAX_OPT_LENGTH];
5709 	udp_t *udp = Q_TO_UDP(wq);
5710 	udp_stack_t	*us = udp->udp_us;
5711 
5712 	err = tsol_compute_label(DB_CREDDEF(mp, udp->udp_connp->conn_cred), dst,
5713 	    opt_storage, udp->udp_mac_exempt,
5714 	    us->us_netstack->netstack_ip);
5715 	if (err == 0) {
5716 		err = tsol_update_options(&udp->udp_ip_snd_options,
5717 		    &udp->udp_ip_snd_options_len, &udp->udp_label_len,
5718 		    opt_storage);
5719 	}
5720 	if (err != 0) {
5721 		DTRACE_PROBE4(
5722 		    tx__ip__log__info__updatelabel__udp,
5723 		    char *, "queue(1) failed to update options(2) on mp(3)",
5724 		    queue_t *, wq, char *, opt_storage, mblk_t *, mp);
5725 	} else {
5726 		IN6_IPADDR_TO_V4MAPPED(dst, &udp->udp_v6lastdst);
5727 	}
5728 	return (err);
5729 }
5730 
5731 static mblk_t *
5732 udp_output_v4(conn_t *connp, mblk_t *mp, ipaddr_t v4dst, uint16_t port,
5733     uint_t srcid, int *error, boolean_t insert_spi)
5734 {
5735 	udp_t	*udp = connp->conn_udp;
5736 	queue_t	*q = connp->conn_wq;
5737 	mblk_t	*mp1 = mp;
5738 	mblk_t	*mp2;
5739 	ipha_t	*ipha;
5740 	int	ip_hdr_length;
5741 	uint32_t ip_len;
5742 	udpha_t	*udpha;
5743 	boolean_t lock_held = B_FALSE;
5744 	in_port_t	uha_src_port;
5745 	udpattrs_t	attrs;
5746 	uchar_t	ip_snd_opt[IP_MAX_OPT_LENGTH];
5747 	uint32_t	ip_snd_opt_len = 0;
5748 	ip4_pkt_t  pktinfo;
5749 	ip4_pkt_t  *pktinfop = &pktinfo;
5750 	ip_opt_info_t optinfo;
5751 	ip_stack_t	*ipst = connp->conn_netstack->netstack_ip;
5752 	udp_stack_t	*us = udp->udp_us;
5753 	ipsec_stack_t	*ipss = ipst->ips_netstack->netstack_ipsec;
5754 
5755 
5756 	*error = 0;
5757 	pktinfop->ip4_ill_index = 0;
5758 	pktinfop->ip4_addr = INADDR_ANY;
5759 	optinfo.ip_opt_flags = 0;
5760 	optinfo.ip_opt_ill_index = 0;
5761 
5762 	if (v4dst == INADDR_ANY)
5763 		v4dst = htonl(INADDR_LOOPBACK);
5764 
5765 	/*
5766 	 * If options passed in, feed it for verification and handling
5767 	 */
5768 	attrs.udpattr_credset = B_FALSE;
5769 	if (DB_TYPE(mp) != M_DATA) {
5770 		mp1 = mp->b_cont;
5771 		if (((struct T_unitdata_req *)mp->b_rptr)->OPT_length != 0) {
5772 			attrs.udpattr_ipp4 = pktinfop;
5773 			attrs.udpattr_mb = mp;
5774 			if (udp_unitdata_opt_process(q, mp, error, &attrs) < 0)
5775 				goto done;
5776 			/*
5777 			 * Note: success in processing options.
5778 			 * mp option buffer represented by
5779 			 * OPT_length/offset now potentially modified
5780 			 * and contain option setting results
5781 			 */
5782 			ASSERT(*error == 0);
5783 		}
5784 	}
5785 
5786 	/* mp1 points to the M_DATA mblk carrying the packet */
5787 	ASSERT(mp1 != NULL && DB_TYPE(mp1) == M_DATA);
5788 
5789 	rw_enter(&udp->udp_rwlock, RW_READER);
5790 	lock_held = B_TRUE;
5791 	/*
5792 	 * Check if our saved options are valid; update if not.
5793 	 * TSOL Note: Since we are not in WRITER mode, UDP packets
5794 	 * to different destination may require different labels,
5795 	 * or worse, UDP packets to same IP address may require
5796 	 * different labels due to use of shared all-zones address.
5797 	 * We use conn_lock to ensure that lastdst, ip_snd_options,
5798 	 * and ip_snd_options_len are consistent for the current
5799 	 * destination and are updated atomically.
5800 	 */
5801 	mutex_enter(&connp->conn_lock);
5802 	if (is_system_labeled()) {
5803 		/* Using UDP MLP requires SCM_UCRED from user */
5804 		if (connp->conn_mlp_type != mlptSingle &&
5805 		    !attrs.udpattr_credset) {
5806 			mutex_exit(&connp->conn_lock);
5807 			DTRACE_PROBE4(
5808 			    tx__ip__log__info__output__udp,
5809 			    char *, "MLP mp(1) lacks SCM_UCRED attr(2) on q(3)",
5810 			    mblk_t *, mp1, udpattrs_t *, &attrs, queue_t *, q);
5811 			*error = ECONNREFUSED;
5812 			goto done;
5813 		}
5814 		/*
5815 		 * update label option for this UDP socket if
5816 		 * - the destination has changed, or
5817 		 * - the UDP socket is MLP
5818 		 */
5819 		if ((!IN6_IS_ADDR_V4MAPPED(&udp->udp_v6lastdst) ||
5820 		    V4_PART_OF_V6(udp->udp_v6lastdst) != v4dst ||
5821 		    connp->conn_mlp_type != mlptSingle) &&
5822 		    (*error = udp_update_label(q, mp, v4dst)) != 0) {
5823 			mutex_exit(&connp->conn_lock);
5824 			goto done;
5825 		}
5826 	}
5827 	if (udp->udp_ip_snd_options_len > 0) {
5828 		ip_snd_opt_len = udp->udp_ip_snd_options_len;
5829 		bcopy(udp->udp_ip_snd_options, ip_snd_opt, ip_snd_opt_len);
5830 	}
5831 	mutex_exit(&connp->conn_lock);
5832 
5833 	/* Add an IP header */
5834 	ip_hdr_length = IP_SIMPLE_HDR_LENGTH + UDPH_SIZE + ip_snd_opt_len +
5835 	    (insert_spi ? sizeof (uint32_t) : 0);
5836 	ipha = (ipha_t *)&mp1->b_rptr[-ip_hdr_length];
5837 	if (DB_REF(mp1) != 1 || (uchar_t *)ipha < DB_BASE(mp1) ||
5838 	    !OK_32PTR(ipha)) {
5839 		mp2 = allocb(ip_hdr_length + us->us_wroff_extra, BPRI_LO);
5840 		if (mp2 == NULL) {
5841 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_END,
5842 			    "udp_wput_end: q %p (%S)", q, "allocbfail2");
5843 			*error = ENOMEM;
5844 			goto done;
5845 		}
5846 		mp2->b_wptr = DB_LIM(mp2);
5847 		mp2->b_cont = mp1;
5848 		mp1 = mp2;
5849 		if (DB_TYPE(mp) != M_DATA)
5850 			mp->b_cont = mp1;
5851 		else
5852 			mp = mp1;
5853 
5854 		ipha = (ipha_t *)(mp1->b_wptr - ip_hdr_length);
5855 	}
5856 	ip_hdr_length -= (UDPH_SIZE + (insert_spi ? sizeof (uint32_t) : 0));
5857 #ifdef	_BIG_ENDIAN
5858 	/* Set version, header length, and tos */
5859 	*(uint16_t *)&ipha->ipha_version_and_hdr_length =
5860 	    ((((IP_VERSION << 4) | (ip_hdr_length>>2)) << 8) |
5861 	    udp->udp_type_of_service);
5862 	/* Set ttl and protocol */
5863 	*(uint16_t *)&ipha->ipha_ttl = (udp->udp_ttl << 8) | IPPROTO_UDP;
5864 #else
5865 	/* Set version, header length, and tos */
5866 	*(uint16_t *)&ipha->ipha_version_and_hdr_length =
5867 	    ((udp->udp_type_of_service << 8) |
5868 	    ((IP_VERSION << 4) | (ip_hdr_length>>2)));
5869 	/* Set ttl and protocol */
5870 	*(uint16_t *)&ipha->ipha_ttl = (IPPROTO_UDP << 8) | udp->udp_ttl;
5871 #endif
5872 	if (pktinfop->ip4_addr != INADDR_ANY) {
5873 		ipha->ipha_src = pktinfop->ip4_addr;
5874 		optinfo.ip_opt_flags = IP_VERIFY_SRC;
5875 	} else {
5876 		/*
5877 		 * Copy our address into the packet.  If this is zero,
5878 		 * first look at __sin6_src_id for a hint. If we leave the
5879 		 * source as INADDR_ANY then ip will fill in the real source
5880 		 * address.
5881 		 */
5882 		IN6_V4MAPPED_TO_IPADDR(&udp->udp_v6src, ipha->ipha_src);
5883 		if (srcid != 0 && ipha->ipha_src == INADDR_ANY) {
5884 			in6_addr_t v6src;
5885 
5886 			ip_srcid_find_id(srcid, &v6src, connp->conn_zoneid,
5887 			    us->us_netstack);
5888 			IN6_V4MAPPED_TO_IPADDR(&v6src, ipha->ipha_src);
5889 		}
5890 	}
5891 	uha_src_port = udp->udp_port;
5892 	if (ip_hdr_length == IP_SIMPLE_HDR_LENGTH) {
5893 		rw_exit(&udp->udp_rwlock);
5894 		lock_held = B_FALSE;
5895 	}
5896 
5897 	if (pktinfop->ip4_ill_index != 0) {
5898 		optinfo.ip_opt_ill_index = pktinfop->ip4_ill_index;
5899 	}
5900 
5901 	ipha->ipha_fragment_offset_and_flags = 0;
5902 	ipha->ipha_ident = 0;
5903 
5904 	mp1->b_rptr = (uchar_t *)ipha;
5905 
5906 	ASSERT((uintptr_t)(mp1->b_wptr - (uchar_t *)ipha) <=
5907 	    (uintptr_t)UINT_MAX);
5908 
5909 	/* Determine length of packet */
5910 	ip_len = (uint32_t)(mp1->b_wptr - (uchar_t *)ipha);
5911 	if ((mp2 = mp1->b_cont) != NULL) {
5912 		do {
5913 			ASSERT((uintptr_t)MBLKL(mp2) <= (uintptr_t)UINT_MAX);
5914 			ip_len += (uint32_t)MBLKL(mp2);
5915 		} while ((mp2 = mp2->b_cont) != NULL);
5916 	}
5917 	/*
5918 	 * If the size of the packet is greater than the maximum allowed by
5919 	 * ip, return an error. Passing this down could cause panics because
5920 	 * the size will have wrapped and be inconsistent with the msg size.
5921 	 */
5922 	if (ip_len > IP_MAXPACKET) {
5923 		TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_END,
5924 		    "udp_wput_end: q %p (%S)", q, "IP length exceeded");
5925 		*error = EMSGSIZE;
5926 		goto done;
5927 	}
5928 	ipha->ipha_length = htons((uint16_t)ip_len);
5929 	ip_len -= ip_hdr_length;
5930 	ip_len = htons((uint16_t)ip_len);
5931 	udpha = (udpha_t *)(((uchar_t *)ipha) + ip_hdr_length);
5932 
5933 	/* Insert all-0s SPI now. */
5934 	if (insert_spi)
5935 		*((uint32_t *)(udpha + 1)) = 0;
5936 
5937 	/*
5938 	 * Copy in the destination address
5939 	 */
5940 	ipha->ipha_dst = v4dst;
5941 
5942 	/*
5943 	 * Set ttl based on IP_MULTICAST_TTL to match IPv6 logic.
5944 	 */
5945 	if (CLASSD(v4dst))
5946 		ipha->ipha_ttl = udp->udp_multicast_ttl;
5947 
5948 	udpha->uha_dst_port = port;
5949 	udpha->uha_src_port = uha_src_port;
5950 
5951 	if (ip_snd_opt_len > 0) {
5952 		uint32_t	cksum;
5953 
5954 		bcopy(ip_snd_opt, &ipha[1], ip_snd_opt_len);
5955 		lock_held = B_FALSE;
5956 		rw_exit(&udp->udp_rwlock);
5957 		/*
5958 		 * Massage source route putting first source route in ipha_dst.
5959 		 * Ignore the destination in T_unitdata_req.
5960 		 * Create a checksum adjustment for a source route, if any.
5961 		 */
5962 		cksum = ip_massage_options(ipha, us->us_netstack);
5963 		cksum = (cksum & 0xFFFF) + (cksum >> 16);
5964 		cksum -= ((ipha->ipha_dst >> 16) & 0xFFFF) +
5965 		    (ipha->ipha_dst & 0xFFFF);
5966 		if ((int)cksum < 0)
5967 			cksum--;
5968 		cksum = (cksum & 0xFFFF) + (cksum >> 16);
5969 		/*
5970 		 * IP does the checksum if uha_checksum is non-zero,
5971 		 * We make it easy for IP to include our pseudo header
5972 		 * by putting our length in uha_checksum.
5973 		 */
5974 		cksum += ip_len;
5975 		cksum = (cksum & 0xFFFF) + (cksum >> 16);
5976 		/* There might be a carry. */
5977 		cksum = (cksum & 0xFFFF) + (cksum >> 16);
5978 #ifdef _LITTLE_ENDIAN
5979 		if (us->us_do_checksum)
5980 			ip_len = (cksum << 16) | ip_len;
5981 #else
5982 		if (us->us_do_checksum)
5983 			ip_len = (ip_len << 16) | cksum;
5984 		else
5985 			ip_len <<= 16;
5986 #endif
5987 	} else {
5988 		/*
5989 		 * IP does the checksum if uha_checksum is non-zero,
5990 		 * We make it easy for IP to include our pseudo header
5991 		 * by putting our length in uha_checksum.
5992 		 */
5993 		if (us->us_do_checksum)
5994 			ip_len |= (ip_len << 16);
5995 #ifndef _LITTLE_ENDIAN
5996 		else
5997 			ip_len <<= 16;
5998 #endif
5999 	}
6000 	ASSERT(!lock_held);
6001 	/* Set UDP length and checksum */
6002 	*((uint32_t *)&udpha->uha_length) = ip_len;
6003 	if (DB_CRED(mp) != NULL)
6004 		mblk_setcred(mp1, DB_CRED(mp));
6005 
6006 	if (DB_TYPE(mp) != M_DATA) {
6007 		ASSERT(mp != mp1);
6008 		freeb(mp);
6009 	}
6010 
6011 	/* mp has been consumed and we'll return success */
6012 	ASSERT(*error == 0);
6013 	mp = NULL;
6014 
6015 	/* We're done.  Pass the packet to ip. */
6016 	BUMP_MIB(&us->us_udp_mib, udpHCOutDatagrams);
6017 	TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_END,
6018 	    "udp_wput_end: q %p (%S)", q, "end");
6019 
6020 	if ((connp->conn_flags & IPCL_CHECK_POLICY) != 0 ||
6021 	    CONN_OUTBOUND_POLICY_PRESENT(connp, ipss) ||
6022 	    connp->conn_dontroute ||
6023 	    connp->conn_nofailover_ill != NULL ||
6024 	    connp->conn_outgoing_ill != NULL || optinfo.ip_opt_flags != 0 ||
6025 	    optinfo.ip_opt_ill_index != 0 ||
6026 	    ipha->ipha_version_and_hdr_length != IP_SIMPLE_HDR_VERSION ||
6027 	    IPP_ENABLED(IPP_LOCAL_OUT, ipst) ||
6028 	    ipst->ips_ip_g_mrouter != NULL) {
6029 		UDP_STAT(us, udp_ip_send);
6030 		ip_output_options(connp, mp1, connp->conn_wq, IP_WPUT,
6031 		    &optinfo);
6032 	} else {
6033 		udp_send_data(udp, connp->conn_wq, mp1, ipha);
6034 	}
6035 
6036 done:
6037 	if (lock_held)
6038 		rw_exit(&udp->udp_rwlock);
6039 	if (*error != 0) {
6040 		ASSERT(mp != NULL);
6041 		BUMP_MIB(&us->us_udp_mib, udpOutErrors);
6042 	}
6043 	return (mp);
6044 }
6045 
6046 static void
6047 udp_send_data(udp_t *udp, queue_t *q, mblk_t *mp, ipha_t *ipha)
6048 {
6049 	conn_t	*connp = udp->udp_connp;
6050 	ipaddr_t src, dst;
6051 	ire_t	*ire;
6052 	ipif_t	*ipif = NULL;
6053 	mblk_t	*ire_fp_mp;
6054 	boolean_t retry_caching;
6055 	udp_stack_t *us = udp->udp_us;
6056 	ip_stack_t	*ipst = connp->conn_netstack->netstack_ip;
6057 
6058 	dst = ipha->ipha_dst;
6059 	src = ipha->ipha_src;
6060 	ASSERT(ipha->ipha_ident == 0);
6061 
6062 	if (CLASSD(dst)) {
6063 		int err;
6064 
6065 		ipif = conn_get_held_ipif(connp,
6066 		    &connp->conn_multicast_ipif, &err);
6067 
6068 		if (ipif == NULL || ipif->ipif_isv6 ||
6069 		    (ipif->ipif_ill->ill_phyint->phyint_flags &
6070 		    PHYI_LOOPBACK)) {
6071 			if (ipif != NULL)
6072 				ipif_refrele(ipif);
6073 			UDP_STAT(us, udp_ip_send);
6074 			ip_output(connp, mp, q, IP_WPUT);
6075 			return;
6076 		}
6077 	}
6078 
6079 	retry_caching = B_FALSE;
6080 	mutex_enter(&connp->conn_lock);
6081 	ire = connp->conn_ire_cache;
6082 	ASSERT(!(connp->conn_state_flags & CONN_INCIPIENT));
6083 
6084 	if (ire == NULL || ire->ire_addr != dst ||
6085 	    (ire->ire_marks & IRE_MARK_CONDEMNED)) {
6086 		retry_caching = B_TRUE;
6087 	} else if (CLASSD(dst) && (ire->ire_type & IRE_CACHE)) {
6088 		ill_t *stq_ill = (ill_t *)ire->ire_stq->q_ptr;
6089 
6090 		ASSERT(ipif != NULL);
6091 		if (stq_ill != ipif->ipif_ill && (stq_ill->ill_group == NULL ||
6092 		    stq_ill->ill_group != ipif->ipif_ill->ill_group))
6093 			retry_caching = B_TRUE;
6094 	}
6095 
6096 	if (!retry_caching) {
6097 		ASSERT(ire != NULL);
6098 		IRE_REFHOLD(ire);
6099 		mutex_exit(&connp->conn_lock);
6100 	} else {
6101 		boolean_t cached = B_FALSE;
6102 
6103 		connp->conn_ire_cache = NULL;
6104 		mutex_exit(&connp->conn_lock);
6105 
6106 		/* Release the old ire */
6107 		if (ire != NULL) {
6108 			IRE_REFRELE_NOTR(ire);
6109 			ire = NULL;
6110 		}
6111 
6112 		if (CLASSD(dst)) {
6113 			ASSERT(ipif != NULL);
6114 			ire = ire_ctable_lookup(dst, 0, 0, ipif,
6115 			    connp->conn_zoneid, MBLK_GETLABEL(mp),
6116 			    MATCH_IRE_ILL_GROUP, ipst);
6117 		} else {
6118 			ASSERT(ipif == NULL);
6119 			ire = ire_cache_lookup(dst, connp->conn_zoneid,
6120 			    MBLK_GETLABEL(mp), ipst);
6121 		}
6122 
6123 		if (ire == NULL) {
6124 			if (ipif != NULL)
6125 				ipif_refrele(ipif);
6126 			UDP_STAT(us, udp_ire_null);
6127 			ip_output(connp, mp, q, IP_WPUT);
6128 			return;
6129 		}
6130 		IRE_REFHOLD_NOTR(ire);
6131 
6132 		mutex_enter(&connp->conn_lock);
6133 		if (CONN_CACHE_IRE(connp) && connp->conn_ire_cache == NULL &&
6134 		    !(ire->ire_marks & IRE_MARK_CONDEMNED)) {
6135 			irb_t		*irb = ire->ire_bucket;
6136 
6137 			/*
6138 			 * IRE's created for non-connection oriented transports
6139 			 * are normally initialized with IRE_MARK_TEMPORARY set
6140 			 * in the ire_marks. These IRE's are preferentially
6141 			 * reaped when the hash chain length in the cache
6142 			 * bucket exceeds the maximum value specified in
6143 			 * ip[6]_ire_max_bucket_cnt. This can severely affect
6144 			 * UDP performance if IRE cache entries that we need
6145 			 * to reuse are continually removed. To remedy this,
6146 			 * when we cache the IRE in the conn_t, we remove the
6147 			 * IRE_MARK_TEMPORARY bit from the ire_marks if it was
6148 			 * set.
6149 			 */
6150 			if (ire->ire_marks & IRE_MARK_TEMPORARY) {
6151 				rw_enter(&irb->irb_lock, RW_WRITER);
6152 				if (ire->ire_marks & IRE_MARK_TEMPORARY) {
6153 					ire->ire_marks &= ~IRE_MARK_TEMPORARY;
6154 					irb->irb_tmp_ire_cnt--;
6155 				}
6156 				rw_exit(&irb->irb_lock);
6157 			}
6158 			connp->conn_ire_cache = ire;
6159 			cached = B_TRUE;
6160 		}
6161 		mutex_exit(&connp->conn_lock);
6162 
6163 		/*
6164 		 * We can continue to use the ire but since it was not
6165 		 * cached, we should drop the extra reference.
6166 		 */
6167 		if (!cached)
6168 			IRE_REFRELE_NOTR(ire);
6169 	}
6170 	ASSERT(ire != NULL && ire->ire_ipversion == IPV4_VERSION);
6171 	ASSERT(!CLASSD(dst) || ipif != NULL);
6172 
6173 	/*
6174 	 * Check if we can take the fast-path.
6175 	 * Note that "incomplete" ire's (where the link-layer for next hop
6176 	 * is not resolved, or where the fast-path header in nce_fp_mp is not
6177 	 * available yet) are sent down the legacy (slow) path
6178 	 */
6179 	if ((ire->ire_type & (IRE_BROADCAST|IRE_LOCAL|IRE_LOOPBACK)) ||
6180 	    (ire->ire_flags & RTF_MULTIRT) || (ire->ire_stq == NULL) ||
6181 	    (ire->ire_max_frag < ntohs(ipha->ipha_length)) ||
6182 	    ((ire->ire_nce == NULL) ||
6183 	    ((ire_fp_mp = ire->ire_nce->nce_fp_mp) == NULL)) ||
6184 	    connp->conn_nexthop_set || (MBLKL(ire_fp_mp) > MBLKHEAD(mp))) {
6185 		if (ipif != NULL)
6186 			ipif_refrele(ipif);
6187 		UDP_STAT(us, udp_ip_ire_send);
6188 		IRE_REFRELE(ire);
6189 		ip_output(connp, mp, q, IP_WPUT);
6190 		return;
6191 	}
6192 
6193 	if (src == INADDR_ANY && !connp->conn_unspec_src) {
6194 		if (CLASSD(dst) && !(ire->ire_flags & RTF_SETSRC))
6195 			ipha->ipha_src = ipif->ipif_src_addr;
6196 		else
6197 			ipha->ipha_src = ire->ire_src_addr;
6198 	}
6199 
6200 	if (ipif != NULL)
6201 		ipif_refrele(ipif);
6202 
6203 	udp_xmit(connp->conn_wq, mp, ire, connp, connp->conn_zoneid);
6204 }
6205 
6206 static void
6207 udp_xmit(queue_t *q, mblk_t *mp, ire_t *ire, conn_t *connp, zoneid_t zoneid)
6208 {
6209 	ipaddr_t src, dst;
6210 	ill_t	*ill;
6211 	mblk_t	*ire_fp_mp;
6212 	uint_t	ire_fp_mp_len;
6213 	uint16_t *up;
6214 	uint32_t cksum, hcksum_txflags;
6215 	queue_t	*dev_q;
6216 	udp_t	*udp = connp->conn_udp;
6217 	ipha_t	*ipha = (ipha_t *)mp->b_rptr;
6218 	udp_stack_t	*us = udp->udp_us;
6219 	ip_stack_t	*ipst = connp->conn_netstack->netstack_ip;
6220 
6221 	dev_q = ire->ire_stq->q_next;
6222 	ASSERT(dev_q != NULL);
6223 
6224 
6225 	if (DEV_Q_IS_FLOW_CTLED(dev_q)) {
6226 		BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsHCOutRequests);
6227 		BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsOutDiscards);
6228 		if (ipst->ips_ip_output_queue)
6229 			(void) putq(connp->conn_wq, mp);
6230 		else
6231 			freemsg(mp);
6232 		ire_refrele(ire);
6233 		return;
6234 	}
6235 
6236 	ire_fp_mp = ire->ire_nce->nce_fp_mp;
6237 	ire_fp_mp_len = MBLKL(ire_fp_mp);
6238 	ASSERT(MBLKHEAD(mp) >= ire_fp_mp_len);
6239 
6240 	dst = ipha->ipha_dst;
6241 	src = ipha->ipha_src;
6242 
6243 	ill = ire_to_ill(ire);
6244 	ASSERT(ill != NULL);
6245 
6246 	BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCOutRequests);
6247 
6248 	ipha->ipha_ident = (uint16_t)atomic_add_32_nv(&ire->ire_ident, 1);
6249 #ifndef _BIG_ENDIAN
6250 	ipha->ipha_ident = (ipha->ipha_ident << 8) | (ipha->ipha_ident >> 8);
6251 #endif
6252 
6253 	if (ILL_HCKSUM_CAPABLE(ill) && dohwcksum) {
6254 		ASSERT(ill->ill_hcksum_capab != NULL);
6255 		hcksum_txflags = ill->ill_hcksum_capab->ill_hcksum_txflags;
6256 	} else {
6257 		hcksum_txflags = 0;
6258 	}
6259 
6260 	/* pseudo-header checksum (do it in parts for IP header checksum) */
6261 	cksum = (dst >> 16) + (dst & 0xFFFF) + (src >> 16) + (src & 0xFFFF);
6262 
6263 	ASSERT(ipha->ipha_version_and_hdr_length == IP_SIMPLE_HDR_VERSION);
6264 	up = IPH_UDPH_CHECKSUMP(ipha, IP_SIMPLE_HDR_LENGTH);
6265 	if (*up != 0) {
6266 		IP_CKSUM_XMIT_FAST(ire->ire_ipversion, hcksum_txflags,
6267 		    mp, ipha, up, IPPROTO_UDP, IP_SIMPLE_HDR_LENGTH,
6268 		    ntohs(ipha->ipha_length), cksum);
6269 
6270 		/* Software checksum? */
6271 		if (DB_CKSUMFLAGS(mp) == 0) {
6272 			UDP_STAT(us, udp_out_sw_cksum);
6273 			UDP_STAT_UPDATE(us, udp_out_sw_cksum_bytes,
6274 			    ntohs(ipha->ipha_length) - IP_SIMPLE_HDR_LENGTH);
6275 		}
6276 	}
6277 
6278 	if (!CLASSD(dst)) {
6279 		ipha->ipha_fragment_offset_and_flags |=
6280 		    (uint32_t)htons(ire->ire_frag_flag);
6281 	}
6282 
6283 	/* Calculate IP header checksum if hardware isn't capable */
6284 	if (!(DB_CKSUMFLAGS(mp) & HCK_IPV4_HDRCKSUM)) {
6285 		IP_HDR_CKSUM(ipha, cksum, ((uint32_t *)ipha)[0],
6286 		    ((uint16_t *)ipha)[4]);
6287 	}
6288 
6289 	if (CLASSD(dst)) {
6290 		ilm_t *ilm;
6291 
6292 		ILM_WALKER_HOLD(ill);
6293 		ilm = ilm_lookup_ill(ill, dst, ALL_ZONES);
6294 		ILM_WALKER_RELE(ill);
6295 		if (ilm != NULL) {
6296 			ip_multicast_loopback(q, ill, mp,
6297 			    connp->conn_multicast_loop ? 0 :
6298 			    IP_FF_NO_MCAST_LOOP, zoneid);
6299 		}
6300 
6301 		/* If multicast TTL is 0 then we are done */
6302 		if (ipha->ipha_ttl == 0) {
6303 			freemsg(mp);
6304 			ire_refrele(ire);
6305 			return;
6306 		}
6307 	}
6308 
6309 	ASSERT(DB_TYPE(ire_fp_mp) == M_DATA);
6310 	mp->b_rptr = (uchar_t *)ipha - ire_fp_mp_len;
6311 	bcopy(ire_fp_mp->b_rptr, mp->b_rptr, ire_fp_mp_len);
6312 
6313 	UPDATE_OB_PKT_COUNT(ire);
6314 	ire->ire_last_used_time = lbolt;
6315 
6316 	BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCOutTransmits);
6317 	UPDATE_MIB(ill->ill_ip_mib, ipIfStatsHCOutOctets,
6318 	    ntohs(ipha->ipha_length));
6319 
6320 	if (ILL_DLS_CAPABLE(ill)) {
6321 		/*
6322 		 * Send the packet directly to DLD, where it may be queued
6323 		 * depending on the availability of transmit resources at
6324 		 * the media layer.
6325 		 */
6326 		IP_DLS_ILL_TX(ill, ipha, mp, ipst);
6327 	} else {
6328 		DTRACE_PROBE4(ip4__physical__out__start,
6329 		    ill_t *, NULL, ill_t *, ill,
6330 		    ipha_t *, ipha, mblk_t *, mp);
6331 		FW_HOOKS(ipst->ips_ip4_physical_out_event,
6332 		    ipst->ips_ipv4firewall_physical_out,
6333 		    NULL, ill, ipha, mp, mp, ipst);
6334 		DTRACE_PROBE1(ip4__physical__out__end, mblk_t *, mp);
6335 		if (mp != NULL)
6336 			putnext(ire->ire_stq, mp);
6337 	}
6338 
6339 	IRE_REFRELE(ire);
6340 }
6341 
6342 static boolean_t
6343 udp_update_label_v6(queue_t *wq, mblk_t *mp, in6_addr_t *dst)
6344 {
6345 	udp_t *udp = Q_TO_UDP(wq);
6346 	int err;
6347 	uchar_t opt_storage[TSOL_MAX_IPV6_OPTION];
6348 	udp_stack_t		*us = udp->udp_us;
6349 
6350 	err = tsol_compute_label_v6(DB_CREDDEF(mp, udp->udp_connp->conn_cred),
6351 	    dst, opt_storage, udp->udp_mac_exempt,
6352 	    us->us_netstack->netstack_ip);
6353 	if (err == 0) {
6354 		err = tsol_update_sticky(&udp->udp_sticky_ipp,
6355 		    &udp->udp_label_len_v6, opt_storage);
6356 	}
6357 	if (err != 0) {
6358 		DTRACE_PROBE4(
6359 		    tx__ip__log__drop__updatelabel__udp6,
6360 		    char *, "queue(1) failed to update options(2) on mp(3)",
6361 		    queue_t *, wq, char *, opt_storage, mblk_t *, mp);
6362 	} else {
6363 		udp->udp_v6lastdst = *dst;
6364 	}
6365 	return (err);
6366 }
6367 
6368 void
6369 udp_output_connected(void *arg, mblk_t *mp)
6370 {
6371 	conn_t	*connp = (conn_t *)arg;
6372 	udp_t	*udp = connp->conn_udp;
6373 	udp_stack_t	*us = udp->udp_us;
6374 	ipaddr_t	v4dst;
6375 	in_port_t	dstport;
6376 	boolean_t	mapped_addr;
6377 	struct sockaddr_storage ss;
6378 	sin_t		*sin;
6379 	sin6_t		*sin6;
6380 	struct sockaddr	*addr;
6381 	socklen_t	addrlen;
6382 	int		error;
6383 	boolean_t	insert_spi = udp->udp_nat_t_endpoint;
6384 
6385 	/* M_DATA for connected socket */
6386 
6387 	ASSERT(udp->udp_issocket);
6388 	UDP_DBGSTAT(us, udp_data_conn);
6389 
6390 	mutex_enter(&connp->conn_lock);
6391 	if (udp->udp_state != TS_DATA_XFER) {
6392 		mutex_exit(&connp->conn_lock);
6393 		BUMP_MIB(&us->us_udp_mib, udpOutErrors);
6394 		UDP_STAT(us, udp_out_err_notconn);
6395 		freemsg(mp);
6396 		TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_END,
6397 		    "udp_wput_end: connp %p (%S)", connp,
6398 		    "not-connected; address required");
6399 		return;
6400 	}
6401 
6402 	mapped_addr = IN6_IS_ADDR_V4MAPPED(&udp->udp_v6dst);
6403 	if (mapped_addr)
6404 		IN6_V4MAPPED_TO_IPADDR(&udp->udp_v6dst, v4dst);
6405 
6406 	/* Initialize addr and addrlen as if they're passed in */
6407 	if (udp->udp_family == AF_INET) {
6408 		sin = (sin_t *)&ss;
6409 		sin->sin_family = AF_INET;
6410 		dstport = sin->sin_port = udp->udp_dstport;
6411 		ASSERT(mapped_addr);
6412 		sin->sin_addr.s_addr = v4dst;
6413 		addr = (struct sockaddr *)sin;
6414 		addrlen = sizeof (*sin);
6415 	} else {
6416 		sin6 = (sin6_t *)&ss;
6417 		sin6->sin6_family = AF_INET6;
6418 		dstport = sin6->sin6_port = udp->udp_dstport;
6419 		sin6->sin6_flowinfo = udp->udp_flowinfo;
6420 		sin6->sin6_addr = udp->udp_v6dst;
6421 		sin6->sin6_scope_id = 0;
6422 		sin6->__sin6_src_id = 0;
6423 		addr = (struct sockaddr *)sin6;
6424 		addrlen = sizeof (*sin6);
6425 	}
6426 	mutex_exit(&connp->conn_lock);
6427 
6428 	if (mapped_addr) {
6429 		/*
6430 		 * Handle both AF_INET and AF_INET6; the latter
6431 		 * for IPV4 mapped destination addresses.  Note
6432 		 * here that both addr and addrlen point to the
6433 		 * corresponding struct depending on the address
6434 		 * family of the socket.
6435 		 */
6436 		mp = udp_output_v4(connp, mp, v4dst, dstport, 0, &error,
6437 		    insert_spi);
6438 	} else {
6439 		mp = udp_output_v6(connp, mp, sin6, &error);
6440 	}
6441 	if (error == 0) {
6442 		ASSERT(mp == NULL);
6443 		return;
6444 	}
6445 
6446 	UDP_STAT(us, udp_out_err_output);
6447 	ASSERT(mp != NULL);
6448 	/* mp is freed by the following routine */
6449 	udp_ud_err(connp->conn_wq, mp, (uchar_t *)addr, (t_scalar_t)addrlen,
6450 	    (t_scalar_t)error);
6451 }
6452 
6453 /*
6454  * This routine handles all messages passed downstream.  It either
6455  * consumes the message or passes it downstream; it never queues a
6456  * a message.
6457  *
6458  * Also entry point for sockfs when udp is in "direct sockfs" mode.  This mode
6459  * is valid when we are directly beneath the stream head, and thus sockfs
6460  * is able to bypass STREAMS and directly call us, passing along the sockaddr
6461  * structure without the cumbersome T_UNITDATA_REQ interface for the case of
6462  * connected endpoints.
6463  */
6464 void
6465 udp_wput(queue_t *q, mblk_t *mp)
6466 {
6467 	sin6_t		*sin6;
6468 	sin_t		*sin;
6469 	ipaddr_t	v4dst;
6470 	uint16_t	port;
6471 	uint_t		srcid;
6472 	conn_t		*connp = Q_TO_CONN(q);
6473 	udp_t		*udp = connp->conn_udp;
6474 	int		error = 0;
6475 	struct sockaddr	*addr;
6476 	socklen_t	addrlen;
6477 	udp_stack_t *us = udp->udp_us;
6478 	boolean_t	insert_spi = udp->udp_nat_t_endpoint;
6479 
6480 	TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_START,
6481 	    "udp_wput_start: queue %p mp %p", q, mp);
6482 
6483 	/*
6484 	 * We directly handle several cases here: T_UNITDATA_REQ message
6485 	 * coming down as M_PROTO/M_PCPROTO and M_DATA messages for connected
6486 	 * socket.
6487 	 */
6488 	switch (DB_TYPE(mp)) {
6489 	case M_DATA:
6490 		/*
6491 		 * Quick check for error cases. Checks will be done again
6492 		 * under the lock later on
6493 		 */
6494 		if (!udp->udp_direct_sockfs || udp->udp_state != TS_DATA_XFER) {
6495 			/* Not connected; address is required */
6496 			BUMP_MIB(&us->us_udp_mib, udpOutErrors);
6497 			UDP_STAT(us, udp_out_err_notconn);
6498 			freemsg(mp);
6499 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_END,
6500 			    "udp_wput_end: connp %p (%S)", connp,
6501 			    "not-connected; address required");
6502 			return;
6503 		}
6504 		udp_output_connected(connp, mp);
6505 		return;
6506 
6507 	case M_PROTO:
6508 	case M_PCPROTO: {
6509 		struct T_unitdata_req *tudr;
6510 
6511 		ASSERT((uintptr_t)MBLKL(mp) <= (uintptr_t)INT_MAX);
6512 		tudr = (struct T_unitdata_req *)mp->b_rptr;
6513 
6514 		/* Handle valid T_UNITDATA_REQ here */
6515 		if (MBLKL(mp) >= sizeof (*tudr) &&
6516 		    ((t_primp_t)mp->b_rptr)->type == T_UNITDATA_REQ) {
6517 			if (mp->b_cont == NULL) {
6518 				TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_END,
6519 				    "udp_wput_end: q %p (%S)", q, "badaddr");
6520 				error = EPROTO;
6521 				goto ud_error;
6522 			}
6523 
6524 			if (!MBLKIN(mp, 0, tudr->DEST_offset +
6525 			    tudr->DEST_length)) {
6526 				TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_END,
6527 				    "udp_wput_end: q %p (%S)", q, "badaddr");
6528 				error = EADDRNOTAVAIL;
6529 				goto ud_error;
6530 			}
6531 			/*
6532 			 * If a port has not been bound to the stream, fail.
6533 			 * This is not a problem when sockfs is directly
6534 			 * above us, because it will ensure that the socket
6535 			 * is first bound before allowing data to be sent.
6536 			 */
6537 			if (udp->udp_state == TS_UNBND) {
6538 				TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_END,
6539 				    "udp_wput_end: q %p (%S)", q, "outstate");
6540 				error = EPROTO;
6541 				goto ud_error;
6542 			}
6543 			addr = (struct sockaddr *)
6544 			    &mp->b_rptr[tudr->DEST_offset];
6545 			addrlen = tudr->DEST_length;
6546 			if (tudr->OPT_length != 0)
6547 				UDP_STAT(us, udp_out_opt);
6548 			break;
6549 		}
6550 		/* FALLTHRU */
6551 	}
6552 	default:
6553 		udp_wput_other(q, mp);
6554 		return;
6555 	}
6556 	ASSERT(addr != NULL);
6557 
6558 	switch (udp->udp_family) {
6559 	case AF_INET6:
6560 		sin6 = (sin6_t *)addr;
6561 		if (!OK_32PTR((char *)sin6) || (addrlen != sizeof (sin6_t)) ||
6562 		    (sin6->sin6_family != AF_INET6)) {
6563 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_END,
6564 			    "udp_wput_end: q %p (%S)", q, "badaddr");
6565 			error = EADDRNOTAVAIL;
6566 			goto ud_error;
6567 		}
6568 
6569 		if (!IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6570 			/*
6571 			 * Destination is a non-IPv4-compatible IPv6 address.
6572 			 * Send out an IPv6 format packet.
6573 			 */
6574 			mp = udp_output_v6(connp, mp, sin6, &error);
6575 			if (error != 0)
6576 				goto ud_error;
6577 
6578 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_END,
6579 			    "udp_wput_end: q %p (%S)", q, "udp_output_v6");
6580 			return;
6581 		}
6582 		/*
6583 		 * If the local address is not zero or a mapped address
6584 		 * return an error.  It would be possible to send an IPv4
6585 		 * packet but the response would never make it back to the
6586 		 * application since it is bound to a non-mapped address.
6587 		 */
6588 		if (!IN6_IS_ADDR_V4MAPPED(&udp->udp_v6src) &&
6589 		    !IN6_IS_ADDR_UNSPECIFIED(&udp->udp_v6src)) {
6590 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_END,
6591 			    "udp_wput_end: q %p (%S)", q, "badaddr");
6592 			error = EADDRNOTAVAIL;
6593 			goto ud_error;
6594 		}
6595 		/* Send IPv4 packet without modifying udp_ipversion */
6596 		/* Extract port and ipaddr */
6597 		port = sin6->sin6_port;
6598 		IN6_V4MAPPED_TO_IPADDR(&sin6->sin6_addr, v4dst);
6599 		srcid = sin6->__sin6_src_id;
6600 		break;
6601 
6602 	case AF_INET:
6603 		sin = (sin_t *)addr;
6604 		if ((!OK_32PTR((char *)sin) || addrlen != sizeof (sin_t)) ||
6605 		    (sin->sin_family != AF_INET)) {
6606 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_END,
6607 			    "udp_wput_end: q %p (%S)", q, "badaddr");
6608 			error = EADDRNOTAVAIL;
6609 			goto ud_error;
6610 		}
6611 		/* Extract port and ipaddr */
6612 		port = sin->sin_port;
6613 		v4dst = sin->sin_addr.s_addr;
6614 		srcid = 0;
6615 		break;
6616 	}
6617 
6618 	mp = udp_output_v4(connp, mp, v4dst, port, srcid, &error, insert_spi);
6619 	if (error != 0) {
6620 ud_error:
6621 		UDP_STAT(us, udp_out_err_output);
6622 		ASSERT(mp != NULL);
6623 		/* mp is freed by the following routine */
6624 		udp_ud_err(q, mp, (uchar_t *)addr, (t_scalar_t)addrlen,
6625 		    (t_scalar_t)error);
6626 	}
6627 }
6628 
6629 /*
6630  * udp_output_v6():
6631  * Assumes that udp_wput did some sanity checking on the destination
6632  * address.
6633  */
6634 static mblk_t *
6635 udp_output_v6(conn_t *connp, mblk_t *mp, sin6_t *sin6, int *error)
6636 {
6637 	ip6_t		*ip6h;
6638 	ip6i_t		*ip6i;	/* mp1->b_rptr even if no ip6i_t */
6639 	mblk_t		*mp1 = mp;
6640 	mblk_t		*mp2;
6641 	int		udp_ip_hdr_len = IPV6_HDR_LEN + UDPH_SIZE;
6642 	size_t		ip_len;
6643 	udpha_t		*udph;
6644 	udp_t		*udp = connp->conn_udp;
6645 	queue_t		*q = connp->conn_wq;
6646 	ip6_pkt_t	ipp_s;	/* For ancillary data options */
6647 	ip6_pkt_t	*ipp = &ipp_s;
6648 	ip6_pkt_t	*tipp;	/* temporary ipp */
6649 	uint32_t	csum = 0;
6650 	uint_t		ignore = 0;
6651 	uint_t		option_exists = 0, is_sticky = 0;
6652 	uint8_t		*cp;
6653 	uint8_t		*nxthdr_ptr;
6654 	in6_addr_t	ip6_dst;
6655 	udpattrs_t	attrs;
6656 	boolean_t	opt_present;
6657 	ip6_hbh_t	*hopoptsptr = NULL;
6658 	uint_t		hopoptslen = 0;
6659 	boolean_t	is_ancillary = B_FALSE;
6660 	udp_stack_t	*us = udp->udp_us;
6661 	size_t		sth_wroff = 0;
6662 
6663 	*error = 0;
6664 
6665 	/*
6666 	 * If the local address is a mapped address return
6667 	 * an error.
6668 	 * It would be possible to send an IPv6 packet but the
6669 	 * response would never make it back to the application
6670 	 * since it is bound to a mapped address.
6671 	 */
6672 	if (IN6_IS_ADDR_V4MAPPED(&udp->udp_v6src)) {
6673 		*error = EADDRNOTAVAIL;
6674 		goto done;
6675 	}
6676 
6677 	ipp->ipp_fields = 0;
6678 	ipp->ipp_sticky_ignored = 0;
6679 
6680 	/*
6681 	 * If TPI options passed in, feed it for verification and handling
6682 	 */
6683 	attrs.udpattr_credset = B_FALSE;
6684 	opt_present = B_FALSE;
6685 	if (DB_TYPE(mp) != M_DATA) {
6686 		mp1 = mp->b_cont;
6687 		if (((struct T_unitdata_req *)mp->b_rptr)->OPT_length != 0) {
6688 			attrs.udpattr_ipp6 = ipp;
6689 			attrs.udpattr_mb = mp;
6690 			if (udp_unitdata_opt_process(q, mp, error,
6691 			    &attrs) < 0) {
6692 				goto done;
6693 			}
6694 			ASSERT(*error == 0);
6695 			opt_present = B_TRUE;
6696 		}
6697 	}
6698 	rw_enter(&udp->udp_rwlock, RW_READER);
6699 	ignore = ipp->ipp_sticky_ignored;
6700 
6701 	/* mp1 points to the M_DATA mblk carrying the packet */
6702 	ASSERT(mp1 != NULL && DB_TYPE(mp1) == M_DATA);
6703 
6704 	if (sin6->sin6_scope_id != 0 &&
6705 	    IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
6706 		/*
6707 		 * IPPF_SCOPE_ID is special.  It's neither a sticky
6708 		 * option nor ancillary data.  It needs to be
6709 		 * explicitly set in options_exists.
6710 		 */
6711 		option_exists |= IPPF_SCOPE_ID;
6712 	}
6713 
6714 	/*
6715 	 * Compute the destination address
6716 	 */
6717 	ip6_dst = sin6->sin6_addr;
6718 	if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
6719 		ip6_dst = ipv6_loopback;
6720 
6721 	/*
6722 	 * If we're not going to the same destination as last time, then
6723 	 * recompute the label required.  This is done in a separate routine to
6724 	 * avoid blowing up our stack here.
6725 	 *
6726 	 * TSOL Note: Since we are not in WRITER mode, UDP packets
6727 	 * to different destination may require different labels,
6728 	 * or worse, UDP packets to same IP address may require
6729 	 * different labels due to use of shared all-zones address.
6730 	 * We use conn_lock to ensure that lastdst, sticky ipp_hopopts,
6731 	 * and sticky ipp_hopoptslen are consistent for the current
6732 	 * destination and are updated atomically.
6733 	 */
6734 	mutex_enter(&connp->conn_lock);
6735 	if (is_system_labeled()) {
6736 		/* Using UDP MLP requires SCM_UCRED from user */
6737 		if (connp->conn_mlp_type != mlptSingle &&
6738 		    !attrs.udpattr_credset) {
6739 			DTRACE_PROBE4(
6740 			    tx__ip__log__info__output__udp6,
6741 			    char *, "MLP mp(1) lacks SCM_UCRED attr(2) on q(3)",
6742 			    mblk_t *, mp1, udpattrs_t *, &attrs, queue_t *, q);
6743 			*error = ECONNREFUSED;
6744 			rw_exit(&udp->udp_rwlock);
6745 			mutex_exit(&connp->conn_lock);
6746 			goto done;
6747 		}
6748 		/*
6749 		 * update label option for this UDP socket if
6750 		 * - the destination has changed, or
6751 		 * - the UDP socket is MLP
6752 		 */
6753 		if ((opt_present ||
6754 		    !IN6_ARE_ADDR_EQUAL(&udp->udp_v6lastdst, &ip6_dst) ||
6755 		    connp->conn_mlp_type != mlptSingle) &&
6756 		    (*error = udp_update_label_v6(q, mp, &ip6_dst)) != 0) {
6757 			rw_exit(&udp->udp_rwlock);
6758 			mutex_exit(&connp->conn_lock);
6759 			goto done;
6760 		}
6761 	}
6762 
6763 	/*
6764 	 * If there's a security label here, then we ignore any options the
6765 	 * user may try to set.  We keep the peer's label as a hidden sticky
6766 	 * option. We make a private copy of this label before releasing the
6767 	 * lock so that label is kept consistent with the destination addr.
6768 	 */
6769 	if (udp->udp_label_len_v6 > 0) {
6770 		ignore &= ~IPPF_HOPOPTS;
6771 		ipp->ipp_fields &= ~IPPF_HOPOPTS;
6772 	}
6773 
6774 	if ((udp->udp_sticky_ipp.ipp_fields == 0) && (ipp->ipp_fields == 0)) {
6775 		/* No sticky options nor ancillary data. */
6776 		mutex_exit(&connp->conn_lock);
6777 		goto no_options;
6778 	}
6779 
6780 	/*
6781 	 * Go through the options figuring out where each is going to
6782 	 * come from and build two masks.  The first mask indicates if
6783 	 * the option exists at all.  The second mask indicates if the
6784 	 * option is sticky or ancillary.
6785 	 */
6786 	if (!(ignore & IPPF_HOPOPTS)) {
6787 		if (ipp->ipp_fields & IPPF_HOPOPTS) {
6788 			option_exists |= IPPF_HOPOPTS;
6789 			udp_ip_hdr_len += ipp->ipp_hopoptslen;
6790 		} else if (udp->udp_sticky_ipp.ipp_fields & IPPF_HOPOPTS) {
6791 			option_exists |= IPPF_HOPOPTS;
6792 			is_sticky |= IPPF_HOPOPTS;
6793 			ASSERT(udp->udp_sticky_ipp.ipp_hopoptslen != 0);
6794 			hopoptsptr = kmem_alloc(
6795 			    udp->udp_sticky_ipp.ipp_hopoptslen, KM_NOSLEEP);
6796 			if (hopoptsptr == NULL) {
6797 				*error = ENOMEM;
6798 				mutex_exit(&connp->conn_lock);
6799 				goto done;
6800 			}
6801 			hopoptslen = udp->udp_sticky_ipp.ipp_hopoptslen;
6802 			bcopy(udp->udp_sticky_ipp.ipp_hopopts, hopoptsptr,
6803 			    hopoptslen);
6804 			udp_ip_hdr_len += hopoptslen;
6805 		}
6806 	}
6807 	mutex_exit(&connp->conn_lock);
6808 
6809 	if (!(ignore & IPPF_RTHDR)) {
6810 		if (ipp->ipp_fields & IPPF_RTHDR) {
6811 			option_exists |= IPPF_RTHDR;
6812 			udp_ip_hdr_len += ipp->ipp_rthdrlen;
6813 		} else if (udp->udp_sticky_ipp.ipp_fields & IPPF_RTHDR) {
6814 			option_exists |= IPPF_RTHDR;
6815 			is_sticky |= IPPF_RTHDR;
6816 			udp_ip_hdr_len += udp->udp_sticky_ipp.ipp_rthdrlen;
6817 		}
6818 	}
6819 
6820 	if (!(ignore & IPPF_RTDSTOPTS) && (option_exists & IPPF_RTHDR)) {
6821 		if (ipp->ipp_fields & IPPF_RTDSTOPTS) {
6822 			option_exists |= IPPF_RTDSTOPTS;
6823 			udp_ip_hdr_len += ipp->ipp_rtdstoptslen;
6824 		} else if (udp->udp_sticky_ipp.ipp_fields & IPPF_RTDSTOPTS) {
6825 			option_exists |= IPPF_RTDSTOPTS;
6826 			is_sticky |= IPPF_RTDSTOPTS;
6827 			udp_ip_hdr_len += udp->udp_sticky_ipp.ipp_rtdstoptslen;
6828 		}
6829 	}
6830 
6831 	if (!(ignore & IPPF_DSTOPTS)) {
6832 		if (ipp->ipp_fields & IPPF_DSTOPTS) {
6833 			option_exists |= IPPF_DSTOPTS;
6834 			udp_ip_hdr_len += ipp->ipp_dstoptslen;
6835 		} else if (udp->udp_sticky_ipp.ipp_fields & IPPF_DSTOPTS) {
6836 			option_exists |= IPPF_DSTOPTS;
6837 			is_sticky |= IPPF_DSTOPTS;
6838 			udp_ip_hdr_len += udp->udp_sticky_ipp.ipp_dstoptslen;
6839 		}
6840 	}
6841 
6842 	if (!(ignore & IPPF_IFINDEX)) {
6843 		if (ipp->ipp_fields & IPPF_IFINDEX) {
6844 			option_exists |= IPPF_IFINDEX;
6845 		} else if (udp->udp_sticky_ipp.ipp_fields & IPPF_IFINDEX) {
6846 			option_exists |= IPPF_IFINDEX;
6847 			is_sticky |= IPPF_IFINDEX;
6848 		}
6849 	}
6850 
6851 	if (!(ignore & IPPF_ADDR)) {
6852 		if (ipp->ipp_fields & IPPF_ADDR) {
6853 			option_exists |= IPPF_ADDR;
6854 		} else if (udp->udp_sticky_ipp.ipp_fields & IPPF_ADDR) {
6855 			option_exists |= IPPF_ADDR;
6856 			is_sticky |= IPPF_ADDR;
6857 		}
6858 	}
6859 
6860 	if (!(ignore & IPPF_DONTFRAG)) {
6861 		if (ipp->ipp_fields & IPPF_DONTFRAG) {
6862 			option_exists |= IPPF_DONTFRAG;
6863 		} else if (udp->udp_sticky_ipp.ipp_fields & IPPF_DONTFRAG) {
6864 			option_exists |= IPPF_DONTFRAG;
6865 			is_sticky |= IPPF_DONTFRAG;
6866 		}
6867 	}
6868 
6869 	if (!(ignore & IPPF_USE_MIN_MTU)) {
6870 		if (ipp->ipp_fields & IPPF_USE_MIN_MTU) {
6871 			option_exists |= IPPF_USE_MIN_MTU;
6872 		} else if (udp->udp_sticky_ipp.ipp_fields &
6873 		    IPPF_USE_MIN_MTU) {
6874 			option_exists |= IPPF_USE_MIN_MTU;
6875 			is_sticky |= IPPF_USE_MIN_MTU;
6876 		}
6877 	}
6878 
6879 	if (!(ignore & IPPF_HOPLIMIT) && (ipp->ipp_fields & IPPF_HOPLIMIT))
6880 		option_exists |= IPPF_HOPLIMIT;
6881 	/* IPV6_HOPLIMIT can never be sticky */
6882 	ASSERT(!(udp->udp_sticky_ipp.ipp_fields & IPPF_HOPLIMIT));
6883 
6884 	if (!(ignore & IPPF_UNICAST_HOPS) &&
6885 	    (udp->udp_sticky_ipp.ipp_fields & IPPF_UNICAST_HOPS)) {
6886 		option_exists |= IPPF_UNICAST_HOPS;
6887 		is_sticky |= IPPF_UNICAST_HOPS;
6888 	}
6889 
6890 	if (!(ignore & IPPF_MULTICAST_HOPS) &&
6891 	    (udp->udp_sticky_ipp.ipp_fields & IPPF_MULTICAST_HOPS)) {
6892 		option_exists |= IPPF_MULTICAST_HOPS;
6893 		is_sticky |= IPPF_MULTICAST_HOPS;
6894 	}
6895 
6896 	if (!(ignore & IPPF_TCLASS)) {
6897 		if (ipp->ipp_fields & IPPF_TCLASS) {
6898 			option_exists |= IPPF_TCLASS;
6899 		} else if (udp->udp_sticky_ipp.ipp_fields & IPPF_TCLASS) {
6900 			option_exists |= IPPF_TCLASS;
6901 			is_sticky |= IPPF_TCLASS;
6902 		}
6903 	}
6904 
6905 	if (!(ignore & IPPF_NEXTHOP) &&
6906 	    (udp->udp_sticky_ipp.ipp_fields & IPPF_NEXTHOP)) {
6907 		option_exists |= IPPF_NEXTHOP;
6908 		is_sticky |= IPPF_NEXTHOP;
6909 	}
6910 
6911 no_options:
6912 
6913 	/*
6914 	 * If any options carried in the ip6i_t were specified, we
6915 	 * need to account for the ip6i_t in the data we'll be sending
6916 	 * down.
6917 	 */
6918 	if (option_exists & IPPF_HAS_IP6I)
6919 		udp_ip_hdr_len += sizeof (ip6i_t);
6920 
6921 	/* check/fix buffer config, setup pointers into it */
6922 	ip6h = (ip6_t *)&mp1->b_rptr[-udp_ip_hdr_len];
6923 	if (DB_REF(mp1) != 1 || ((unsigned char *)ip6h < DB_BASE(mp1)) ||
6924 	    !OK_32PTR(ip6h)) {
6925 
6926 		/* Try to get everything in a single mblk next time */
6927 		if (udp_ip_hdr_len > udp->udp_max_hdr_len) {
6928 			udp->udp_max_hdr_len = udp_ip_hdr_len;
6929 			sth_wroff = udp->udp_max_hdr_len + us->us_wroff_extra;
6930 		}
6931 
6932 		mp2 = allocb(udp_ip_hdr_len + us->us_wroff_extra, BPRI_LO);
6933 		if (mp2 == NULL) {
6934 			*error = ENOMEM;
6935 			rw_exit(&udp->udp_rwlock);
6936 			goto done;
6937 		}
6938 		mp2->b_wptr = DB_LIM(mp2);
6939 		mp2->b_cont = mp1;
6940 		mp1 = mp2;
6941 		if (DB_TYPE(mp) != M_DATA)
6942 			mp->b_cont = mp1;
6943 		else
6944 			mp = mp1;
6945 
6946 		ip6h = (ip6_t *)(mp1->b_wptr - udp_ip_hdr_len);
6947 	}
6948 	mp1->b_rptr = (unsigned char *)ip6h;
6949 	ip6i = (ip6i_t *)ip6h;
6950 
6951 #define	ANCIL_OR_STICKY_PTR(f) ((is_sticky & f) ? &udp->udp_sticky_ipp : ipp)
6952 	if (option_exists & IPPF_HAS_IP6I) {
6953 		ip6h = (ip6_t *)&ip6i[1];
6954 		ip6i->ip6i_flags = 0;
6955 		ip6i->ip6i_vcf = IPV6_DEFAULT_VERS_AND_FLOW;
6956 
6957 		/* sin6_scope_id takes precendence over IPPF_IFINDEX */
6958 		if (option_exists & IPPF_SCOPE_ID) {
6959 			ip6i->ip6i_flags |= IP6I_IFINDEX;
6960 			ip6i->ip6i_ifindex = sin6->sin6_scope_id;
6961 		} else if (option_exists & IPPF_IFINDEX) {
6962 			tipp = ANCIL_OR_STICKY_PTR(IPPF_IFINDEX);
6963 			ASSERT(tipp->ipp_ifindex != 0);
6964 			ip6i->ip6i_flags |= IP6I_IFINDEX;
6965 			ip6i->ip6i_ifindex = tipp->ipp_ifindex;
6966 		}
6967 
6968 		if (option_exists & IPPF_ADDR) {
6969 			/*
6970 			 * Enable per-packet source address verification if
6971 			 * IPV6_PKTINFO specified the source address.
6972 			 * ip6_src is set in the transport's _wput function.
6973 			 */
6974 			ip6i->ip6i_flags |= IP6I_VERIFY_SRC;
6975 		}
6976 
6977 		if (option_exists & IPPF_DONTFRAG) {
6978 			ip6i->ip6i_flags |= IP6I_DONTFRAG;
6979 		}
6980 
6981 		if (option_exists & IPPF_USE_MIN_MTU) {
6982 			ip6i->ip6i_flags = IP6I_API_USE_MIN_MTU(
6983 			    ip6i->ip6i_flags, ipp->ipp_use_min_mtu);
6984 		}
6985 
6986 		if (option_exists & IPPF_NEXTHOP) {
6987 			tipp = ANCIL_OR_STICKY_PTR(IPPF_NEXTHOP);
6988 			ASSERT(!IN6_IS_ADDR_UNSPECIFIED(&tipp->ipp_nexthop));
6989 			ip6i->ip6i_flags |= IP6I_NEXTHOP;
6990 			ip6i->ip6i_nexthop = tipp->ipp_nexthop;
6991 		}
6992 
6993 		/*
6994 		 * tell IP this is an ip6i_t private header
6995 		 */
6996 		ip6i->ip6i_nxt = IPPROTO_RAW;
6997 	}
6998 
6999 	/* Initialize IPv6 header */
7000 	ip6h->ip6_vcf = IPV6_DEFAULT_VERS_AND_FLOW;
7001 	bzero(&ip6h->ip6_src, sizeof (ip6h->ip6_src));
7002 
7003 	/* Set the hoplimit of the outgoing packet. */
7004 	if (option_exists & IPPF_HOPLIMIT) {
7005 		/* IPV6_HOPLIMIT ancillary data overrides all other settings. */
7006 		ip6h->ip6_hops = ipp->ipp_hoplimit;
7007 		ip6i->ip6i_flags |= IP6I_HOPLIMIT;
7008 	} else if (IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
7009 		ip6h->ip6_hops = udp->udp_multicast_ttl;
7010 		if (option_exists & IPPF_MULTICAST_HOPS)
7011 			ip6i->ip6i_flags |= IP6I_HOPLIMIT;
7012 	} else {
7013 		ip6h->ip6_hops = udp->udp_ttl;
7014 		if (option_exists & IPPF_UNICAST_HOPS)
7015 			ip6i->ip6i_flags |= IP6I_HOPLIMIT;
7016 	}
7017 
7018 	if (option_exists & IPPF_ADDR) {
7019 		tipp = ANCIL_OR_STICKY_PTR(IPPF_ADDR);
7020 		ASSERT(!IN6_IS_ADDR_UNSPECIFIED(&tipp->ipp_addr));
7021 		ip6h->ip6_src = tipp->ipp_addr;
7022 	} else {
7023 		/*
7024 		 * The source address was not set using IPV6_PKTINFO.
7025 		 * First look at the bound source.
7026 		 * If unspecified fallback to __sin6_src_id.
7027 		 */
7028 		ip6h->ip6_src = udp->udp_v6src;
7029 		if (sin6->__sin6_src_id != 0 &&
7030 		    IN6_IS_ADDR_UNSPECIFIED(&ip6h->ip6_src)) {
7031 			ip_srcid_find_id(sin6->__sin6_src_id,
7032 			    &ip6h->ip6_src, connp->conn_zoneid,
7033 			    us->us_netstack);
7034 		}
7035 	}
7036 
7037 	nxthdr_ptr = (uint8_t *)&ip6h->ip6_nxt;
7038 	cp = (uint8_t *)&ip6h[1];
7039 
7040 	/*
7041 	 * Here's where we have to start stringing together
7042 	 * any extension headers in the right order:
7043 	 * Hop-by-hop, destination, routing, and final destination opts.
7044 	 */
7045 	if (option_exists & IPPF_HOPOPTS) {
7046 		/* Hop-by-hop options */
7047 		ip6_hbh_t *hbh = (ip6_hbh_t *)cp;
7048 		tipp = ANCIL_OR_STICKY_PTR(IPPF_HOPOPTS);
7049 		if (hopoptslen == 0) {
7050 			hopoptsptr = tipp->ipp_hopopts;
7051 			hopoptslen = tipp->ipp_hopoptslen;
7052 			is_ancillary = B_TRUE;
7053 		}
7054 
7055 		*nxthdr_ptr = IPPROTO_HOPOPTS;
7056 		nxthdr_ptr = &hbh->ip6h_nxt;
7057 
7058 		bcopy(hopoptsptr, cp, hopoptslen);
7059 		cp += hopoptslen;
7060 
7061 		if (hopoptsptr != NULL && !is_ancillary) {
7062 			kmem_free(hopoptsptr, hopoptslen);
7063 			hopoptsptr = NULL;
7064 			hopoptslen = 0;
7065 		}
7066 	}
7067 	/*
7068 	 * En-route destination options
7069 	 * Only do them if there's a routing header as well
7070 	 */
7071 	if (option_exists & IPPF_RTDSTOPTS) {
7072 		ip6_dest_t *dst = (ip6_dest_t *)cp;
7073 		tipp = ANCIL_OR_STICKY_PTR(IPPF_RTDSTOPTS);
7074 
7075 		*nxthdr_ptr = IPPROTO_DSTOPTS;
7076 		nxthdr_ptr = &dst->ip6d_nxt;
7077 
7078 		bcopy(tipp->ipp_rtdstopts, cp, tipp->ipp_rtdstoptslen);
7079 		cp += tipp->ipp_rtdstoptslen;
7080 	}
7081 	/*
7082 	 * Routing header next
7083 	 */
7084 	if (option_exists & IPPF_RTHDR) {
7085 		ip6_rthdr_t *rt = (ip6_rthdr_t *)cp;
7086 		tipp = ANCIL_OR_STICKY_PTR(IPPF_RTHDR);
7087 
7088 		*nxthdr_ptr = IPPROTO_ROUTING;
7089 		nxthdr_ptr = &rt->ip6r_nxt;
7090 
7091 		bcopy(tipp->ipp_rthdr, cp, tipp->ipp_rthdrlen);
7092 		cp += tipp->ipp_rthdrlen;
7093 	}
7094 	/*
7095 	 * Do ultimate destination options
7096 	 */
7097 	if (option_exists & IPPF_DSTOPTS) {
7098 		ip6_dest_t *dest = (ip6_dest_t *)cp;
7099 		tipp = ANCIL_OR_STICKY_PTR(IPPF_DSTOPTS);
7100 
7101 		*nxthdr_ptr = IPPROTO_DSTOPTS;
7102 		nxthdr_ptr = &dest->ip6d_nxt;
7103 
7104 		bcopy(tipp->ipp_dstopts, cp, tipp->ipp_dstoptslen);
7105 		cp += tipp->ipp_dstoptslen;
7106 	}
7107 	/*
7108 	 * Now set the last header pointer to the proto passed in
7109 	 */
7110 	ASSERT((int)(cp - (uint8_t *)ip6i) == (udp_ip_hdr_len - UDPH_SIZE));
7111 	*nxthdr_ptr = IPPROTO_UDP;
7112 
7113 	/* Update UDP header */
7114 	udph = (udpha_t *)((uchar_t *)ip6i + udp_ip_hdr_len - UDPH_SIZE);
7115 	udph->uha_dst_port = sin6->sin6_port;
7116 	udph->uha_src_port = udp->udp_port;
7117 
7118 	/*
7119 	 * Copy in the destination address
7120 	 */
7121 	ip6h->ip6_dst = ip6_dst;
7122 
7123 	ip6h->ip6_vcf =
7124 	    (IPV6_DEFAULT_VERS_AND_FLOW & IPV6_VERS_AND_FLOW_MASK) |
7125 	    (sin6->sin6_flowinfo & ~IPV6_VERS_AND_FLOW_MASK);
7126 
7127 	if (option_exists & IPPF_TCLASS) {
7128 		tipp = ANCIL_OR_STICKY_PTR(IPPF_TCLASS);
7129 		ip6h->ip6_vcf = IPV6_TCLASS_FLOW(ip6h->ip6_vcf,
7130 		    tipp->ipp_tclass);
7131 	}
7132 	rw_exit(&udp->udp_rwlock);
7133 
7134 	if (option_exists & IPPF_RTHDR) {
7135 		ip6_rthdr_t	*rth;
7136 
7137 		/*
7138 		 * Perform any processing needed for source routing.
7139 		 * We know that all extension headers will be in the same mblk
7140 		 * as the IPv6 header.
7141 		 */
7142 		rth = ip_find_rthdr_v6(ip6h, mp1->b_wptr);
7143 		if (rth != NULL && rth->ip6r_segleft != 0) {
7144 			if (rth->ip6r_type != IPV6_RTHDR_TYPE_0) {
7145 				/*
7146 				 * Drop packet - only support Type 0 routing.
7147 				 * Notify the application as well.
7148 				 */
7149 				*error = EPROTO;
7150 				goto done;
7151 			}
7152 
7153 			/*
7154 			 * rth->ip6r_len is twice the number of
7155 			 * addresses in the header. Thus it must be even.
7156 			 */
7157 			if (rth->ip6r_len & 0x1) {
7158 				*error = EPROTO;
7159 				goto done;
7160 			}
7161 			/*
7162 			 * Shuffle the routing header and ip6_dst
7163 			 * addresses, and get the checksum difference
7164 			 * between the first hop (in ip6_dst) and
7165 			 * the destination (in the last routing hdr entry).
7166 			 */
7167 			csum = ip_massage_options_v6(ip6h, rth,
7168 			    us->us_netstack);
7169 			/*
7170 			 * Verify that the first hop isn't a mapped address.
7171 			 * Routers along the path need to do this verification
7172 			 * for subsequent hops.
7173 			 */
7174 			if (IN6_IS_ADDR_V4MAPPED(&ip6h->ip6_dst)) {
7175 				*error = EADDRNOTAVAIL;
7176 				goto done;
7177 			}
7178 
7179 			cp += (rth->ip6r_len + 1)*8;
7180 		}
7181 	}
7182 
7183 	/* count up length of UDP packet */
7184 	ip_len = (mp1->b_wptr - (unsigned char *)ip6h) - IPV6_HDR_LEN;
7185 	if ((mp2 = mp1->b_cont) != NULL) {
7186 		do {
7187 			ASSERT((uintptr_t)MBLKL(mp2) <= (uintptr_t)UINT_MAX);
7188 			ip_len += (uint32_t)MBLKL(mp2);
7189 		} while ((mp2 = mp2->b_cont) != NULL);
7190 	}
7191 
7192 	/*
7193 	 * If the size of the packet is greater than the maximum allowed by
7194 	 * ip, return an error. Passing this down could cause panics because
7195 	 * the size will have wrapped and be inconsistent with the msg size.
7196 	 */
7197 	if (ip_len > IP_MAXPACKET) {
7198 		*error = EMSGSIZE;
7199 		goto done;
7200 	}
7201 
7202 	/* Store the UDP length. Subtract length of extension hdrs */
7203 	udph->uha_length = htons(ip_len + IPV6_HDR_LEN -
7204 	    (int)((uchar_t *)udph - (uchar_t *)ip6h));
7205 
7206 	/*
7207 	 * We make it easy for IP to include our pseudo header
7208 	 * by putting our length in uh_checksum, modified (if
7209 	 * we have a routing header) by the checksum difference
7210 	 * between the ultimate destination and first hop addresses.
7211 	 * Note: UDP over IPv6 must always checksum the packet.
7212 	 */
7213 	csum += udph->uha_length;
7214 	csum = (csum & 0xFFFF) + (csum >> 16);
7215 	udph->uha_checksum = (uint16_t)csum;
7216 
7217 #ifdef _LITTLE_ENDIAN
7218 	ip_len = htons(ip_len);
7219 #endif
7220 	ip6h->ip6_plen = ip_len;
7221 	if (DB_CRED(mp) != NULL)
7222 		mblk_setcred(mp1, DB_CRED(mp));
7223 
7224 	if (DB_TYPE(mp) != M_DATA) {
7225 		ASSERT(mp != mp1);
7226 		freeb(mp);
7227 	}
7228 
7229 	/* mp has been consumed and we'll return success */
7230 	ASSERT(*error == 0);
7231 	mp = NULL;
7232 
7233 	/* We're done. Pass the packet to IP */
7234 	BUMP_MIB(&us->us_udp_mib, udpHCOutDatagrams);
7235 	ip_output_v6(connp, mp1, q, IP_WPUT);
7236 
7237 done:
7238 	if (sth_wroff != 0) {
7239 		(void) mi_set_sth_wroff(RD(q),
7240 		    udp->udp_max_hdr_len + us->us_wroff_extra);
7241 	}
7242 	if (hopoptsptr != NULL && !is_ancillary) {
7243 		kmem_free(hopoptsptr, hopoptslen);
7244 		hopoptsptr = NULL;
7245 	}
7246 	if (*error != 0) {
7247 		ASSERT(mp != NULL);
7248 		BUMP_MIB(&us->us_udp_mib, udpOutErrors);
7249 	}
7250 	return (mp);
7251 }
7252 
7253 static void
7254 udp_wput_other(queue_t *q, mblk_t *mp)
7255 {
7256 	uchar_t	*rptr = mp->b_rptr;
7257 	struct datab *db;
7258 	struct iocblk *iocp;
7259 	cred_t	*cr;
7260 	conn_t	*connp = Q_TO_CONN(q);
7261 	udp_t	*udp = connp->conn_udp;
7262 	udp_stack_t *us;
7263 
7264 	TRACE_1(TR_FAC_UDP, TR_UDP_WPUT_OTHER_START,
7265 	    "udp_wput_other_start: q %p", q);
7266 
7267 	us = udp->udp_us;
7268 	db = mp->b_datap;
7269 
7270 	cr = DB_CREDDEF(mp, connp->conn_cred);
7271 
7272 	switch (db->db_type) {
7273 	case M_PROTO:
7274 	case M_PCPROTO:
7275 		if (mp->b_wptr - rptr < sizeof (t_scalar_t)) {
7276 			freemsg(mp);
7277 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
7278 			    "udp_wput_other_end: q %p (%S)", q, "protoshort");
7279 			return;
7280 		}
7281 		switch (((t_primp_t)rptr)->type) {
7282 		case T_ADDR_REQ:
7283 			udp_addr_req(q, mp);
7284 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
7285 			    "udp_wput_other_end: q %p (%S)", q, "addrreq");
7286 			return;
7287 		case O_T_BIND_REQ:
7288 		case T_BIND_REQ:
7289 			udp_bind(q, mp);
7290 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
7291 			    "udp_wput_other_end: q %p (%S)", q, "bindreq");
7292 			return;
7293 		case T_CONN_REQ:
7294 			udp_connect(q, mp);
7295 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
7296 			    "udp_wput_other_end: q %p (%S)", q, "connreq");
7297 			return;
7298 		case T_CAPABILITY_REQ:
7299 			udp_capability_req(q, mp);
7300 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
7301 			    "udp_wput_other_end: q %p (%S)", q, "capabreq");
7302 			return;
7303 		case T_INFO_REQ:
7304 			udp_info_req(q, mp);
7305 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
7306 			    "udp_wput_other_end: q %p (%S)", q, "inforeq");
7307 			return;
7308 		case T_UNITDATA_REQ:
7309 			/*
7310 			 * If a T_UNITDATA_REQ gets here, the address must
7311 			 * be bad.  Valid T_UNITDATA_REQs are handled
7312 			 * in udp_wput.
7313 			 */
7314 			udp_ud_err(q, mp, NULL, 0, EADDRNOTAVAIL);
7315 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
7316 			    "udp_wput_other_end: q %p (%S)", q, "unitdatareq");
7317 			return;
7318 		case T_UNBIND_REQ:
7319 			udp_unbind(q, mp);
7320 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
7321 			    "udp_wput_other_end: q %p (%S)", q, "unbindreq");
7322 			return;
7323 		case T_SVR4_OPTMGMT_REQ:
7324 			if (!snmpcom_req(q, mp, udp_snmp_set, ip_snmp_get,
7325 			    cr)) {
7326 				(void) svr4_optcom_req(q,
7327 				    mp, cr, &udp_opt_obj, B_TRUE);
7328 			}
7329 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
7330 			    "udp_wput_other_end: q %p (%S)", q, "optmgmtreq");
7331 			return;
7332 
7333 		case T_OPTMGMT_REQ:
7334 			(void) tpi_optcom_req(q, mp, cr, &udp_opt_obj, B_TRUE);
7335 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
7336 			    "udp_wput_other_end: q %p (%S)", q, "optmgmtreq");
7337 			return;
7338 
7339 		case T_DISCON_REQ:
7340 			udp_disconnect(q, mp);
7341 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
7342 			    "udp_wput_other_end: q %p (%S)", q, "disconreq");
7343 			return;
7344 
7345 		/* The following TPI message is not supported by udp. */
7346 		case O_T_CONN_RES:
7347 		case T_CONN_RES:
7348 			udp_err_ack(q, mp, TNOTSUPPORT, 0);
7349 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
7350 			    "udp_wput_other_end: q %p (%S)", q,
7351 			    "connres/disconreq");
7352 			return;
7353 
7354 		/* The following 3 TPI messages are illegal for udp. */
7355 		case T_DATA_REQ:
7356 		case T_EXDATA_REQ:
7357 		case T_ORDREL_REQ:
7358 			udp_err_ack(q, mp, TNOTSUPPORT, 0);
7359 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
7360 			    "udp_wput_other_end: q %p (%S)", q,
7361 			    "data/exdata/ordrel");
7362 			return;
7363 		default:
7364 			break;
7365 		}
7366 		break;
7367 	case M_FLUSH:
7368 		if (*rptr & FLUSHW)
7369 			flushq(q, FLUSHDATA);
7370 		break;
7371 	case M_IOCTL:
7372 		iocp = (struct iocblk *)mp->b_rptr;
7373 		switch (iocp->ioc_cmd) {
7374 		case TI_GETPEERNAME:
7375 			if (udp->udp_state != TS_DATA_XFER) {
7376 				/*
7377 				 * If a default destination address has not
7378 				 * been associated with the stream, then we
7379 				 * don't know the peer's name.
7380 				 */
7381 				iocp->ioc_error = ENOTCONN;
7382 				iocp->ioc_count = 0;
7383 				mp->b_datap->db_type = M_IOCACK;
7384 				qreply(q, mp);
7385 				TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
7386 				    "udp_wput_other_end: q %p (%S)", q,
7387 				    "getpeername");
7388 				return;
7389 			}
7390 			/* FALLTHRU */
7391 		case TI_GETMYNAME: {
7392 			/*
7393 			 * For TI_GETPEERNAME and TI_GETMYNAME, we first
7394 			 * need to copyin the user's strbuf structure.
7395 			 * Processing will continue in the M_IOCDATA case
7396 			 * below.
7397 			 */
7398 			mi_copyin(q, mp, NULL,
7399 			    SIZEOF_STRUCT(strbuf, iocp->ioc_flag));
7400 			TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
7401 			    "udp_wput_other_end: q %p (%S)", q, "getmyname");
7402 			return;
7403 			}
7404 		case ND_SET:
7405 			/* nd_getset performs the necessary checking */
7406 		case ND_GET:
7407 			if (nd_getset(q, us->us_nd, mp)) {
7408 				qreply(q, mp);
7409 				TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
7410 				    "udp_wput_other_end: q %p (%S)", q, "get");
7411 				return;
7412 			}
7413 			break;
7414 		case _SIOCSOCKFALLBACK:
7415 			/*
7416 			 * Either sockmod is about to be popped and the
7417 			 * socket would now be treated as a plain stream,
7418 			 * or a module is about to be pushed so we could
7419 			 * no longer use read-side synchronous stream.
7420 			 * Drain any queued data and disable direct sockfs
7421 			 * interface from now on.
7422 			 */
7423 			if (!udp->udp_issocket) {
7424 				DB_TYPE(mp) = M_IOCNAK;
7425 				iocp->ioc_error = EINVAL;
7426 			} else {
7427 				udp->udp_issocket = B_FALSE;
7428 				if (udp->udp_direct_sockfs) {
7429 					/*
7430 					 * Disable read-side synchronous
7431 					 * stream interface and drain any
7432 					 * queued data.
7433 					 */
7434 					udp_rcv_drain(RD(q), udp,
7435 					    B_FALSE);
7436 					ASSERT(!udp->udp_direct_sockfs);
7437 					UDP_STAT(us, udp_sock_fallback);
7438 				}
7439 				DB_TYPE(mp) = M_IOCACK;
7440 				iocp->ioc_error = 0;
7441 			}
7442 			iocp->ioc_count = 0;
7443 			iocp->ioc_rval = 0;
7444 			qreply(q, mp);
7445 			return;
7446 		default:
7447 			break;
7448 		}
7449 		break;
7450 	case M_IOCDATA:
7451 		udp_wput_iocdata(q, mp);
7452 		TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
7453 		    "udp_wput_other_end: q %p (%S)", q, "iocdata");
7454 		return;
7455 	default:
7456 		/* Unrecognized messages are passed through without change. */
7457 		break;
7458 	}
7459 	TRACE_2(TR_FAC_UDP, TR_UDP_WPUT_OTHER_END,
7460 	    "udp_wput_other_end: q %p (%S)", q, "end");
7461 	ip_output(connp, mp, q, IP_WPUT);
7462 }
7463 
7464 /*
7465  * udp_wput_iocdata is called by udp_wput_other to handle all M_IOCDATA
7466  * messages.
7467  */
7468 static void
7469 udp_wput_iocdata(queue_t *q, mblk_t *mp)
7470 {
7471 	mblk_t	*mp1;
7472 	STRUCT_HANDLE(strbuf, sb);
7473 	uint16_t port;
7474 	in6_addr_t	v6addr;
7475 	ipaddr_t	v4addr;
7476 	uint32_t	flowinfo = 0;
7477 	int		addrlen;
7478 	udp_t		*udp = Q_TO_UDP(q);
7479 
7480 	/* Make sure it is one of ours. */
7481 	switch (((struct iocblk *)mp->b_rptr)->ioc_cmd) {
7482 	case TI_GETMYNAME:
7483 	case TI_GETPEERNAME:
7484 		break;
7485 	default:
7486 		ip_output(udp->udp_connp, mp, q, IP_WPUT);
7487 		return;
7488 	}
7489 
7490 	switch (mi_copy_state(q, mp, &mp1)) {
7491 	case -1:
7492 		return;
7493 	case MI_COPY_CASE(MI_COPY_IN, 1):
7494 		break;
7495 	case MI_COPY_CASE(MI_COPY_OUT, 1):
7496 		/*
7497 		 * The address has been copied out, so now
7498 		 * copyout the strbuf.
7499 		 */
7500 		mi_copyout(q, mp);
7501 		return;
7502 	case MI_COPY_CASE(MI_COPY_OUT, 2):
7503 		/*
7504 		 * The address and strbuf have been copied out.
7505 		 * We're done, so just acknowledge the original
7506 		 * M_IOCTL.
7507 		 */
7508 		mi_copy_done(q, mp, 0);
7509 		return;
7510 	default:
7511 		/*
7512 		 * Something strange has happened, so acknowledge
7513 		 * the original M_IOCTL with an EPROTO error.
7514 		 */
7515 		mi_copy_done(q, mp, EPROTO);
7516 		return;
7517 	}
7518 
7519 	/*
7520 	 * Now we have the strbuf structure for TI_GETMYNAME
7521 	 * and TI_GETPEERNAME.  Next we copyout the requested
7522 	 * address and then we'll copyout the strbuf.
7523 	 */
7524 	STRUCT_SET_HANDLE(sb, ((struct iocblk *)mp->b_rptr)->ioc_flag,
7525 	    (void *)mp1->b_rptr);
7526 	if (udp->udp_family == AF_INET)
7527 		addrlen = sizeof (sin_t);
7528 	else
7529 		addrlen = sizeof (sin6_t);
7530 
7531 	if (STRUCT_FGET(sb, maxlen) < addrlen) {
7532 		mi_copy_done(q, mp, EINVAL);
7533 		return;
7534 	}
7535 	switch (((struct iocblk *)mp->b_rptr)->ioc_cmd) {
7536 	case TI_GETMYNAME:
7537 		if (udp->udp_family == AF_INET) {
7538 			ASSERT(udp->udp_ipversion == IPV4_VERSION);
7539 			if (!IN6_IS_ADDR_V4MAPPED_ANY(&udp->udp_v6src) &&
7540 			    !IN6_IS_ADDR_UNSPECIFIED(&udp->udp_v6src)) {
7541 				v4addr = V4_PART_OF_V6(udp->udp_v6src);
7542 			} else {
7543 				/*
7544 				 * INADDR_ANY
7545 				 * udp_v6src is not set, we might be bound to
7546 				 * broadcast/multicast. Use udp_bound_v6src as
7547 				 * local address instead (that could
7548 				 * also still be INADDR_ANY)
7549 				 */
7550 				v4addr = V4_PART_OF_V6(udp->udp_bound_v6src);
7551 			}
7552 		} else {
7553 			/* udp->udp_family == AF_INET6 */
7554 			if (!IN6_IS_ADDR_UNSPECIFIED(&udp->udp_v6src)) {
7555 				v6addr = udp->udp_v6src;
7556 			} else {
7557 				/*
7558 				 * UNSPECIFIED
7559 				 * udp_v6src is not set, we might be bound to
7560 				 * broadcast/multicast. Use udp_bound_v6src as
7561 				 * local address instead (that could
7562 				 * also still be UNSPECIFIED)
7563 				 */
7564 				v6addr = udp->udp_bound_v6src;
7565 			}
7566 		}
7567 		port = udp->udp_port;
7568 		break;
7569 	case TI_GETPEERNAME:
7570 		if (udp->udp_state != TS_DATA_XFER) {
7571 			mi_copy_done(q, mp, ENOTCONN);
7572 			return;
7573 		}
7574 		if (udp->udp_family == AF_INET) {
7575 			ASSERT(udp->udp_ipversion == IPV4_VERSION);
7576 			v4addr = V4_PART_OF_V6(udp->udp_v6dst);
7577 		} else {
7578 			/* udp->udp_family == AF_INET6) */
7579 			v6addr = udp->udp_v6dst;
7580 			flowinfo = udp->udp_flowinfo;
7581 		}
7582 		port = udp->udp_dstport;
7583 		break;
7584 	default:
7585 		mi_copy_done(q, mp, EPROTO);
7586 		return;
7587 	}
7588 	mp1 = mi_copyout_alloc(q, mp, STRUCT_FGETP(sb, buf), addrlen, B_TRUE);
7589 	if (!mp1)
7590 		return;
7591 
7592 	if (udp->udp_family == AF_INET) {
7593 		sin_t *sin;
7594 
7595 		STRUCT_FSET(sb, len, (int)sizeof (sin_t));
7596 		sin = (sin_t *)mp1->b_rptr;
7597 		mp1->b_wptr = (uchar_t *)&sin[1];
7598 		*sin = sin_null;
7599 		sin->sin_family = AF_INET;
7600 		sin->sin_addr.s_addr = v4addr;
7601 		sin->sin_port = port;
7602 	} else {
7603 		/* udp->udp_family == AF_INET6 */
7604 		sin6_t *sin6;
7605 
7606 		STRUCT_FSET(sb, len, (int)sizeof (sin6_t));
7607 		sin6 = (sin6_t *)mp1->b_rptr;
7608 		mp1->b_wptr = (uchar_t *)&sin6[1];
7609 		*sin6 = sin6_null;
7610 		sin6->sin6_family = AF_INET6;
7611 		sin6->sin6_flowinfo = flowinfo;
7612 		sin6->sin6_addr = v6addr;
7613 		sin6->sin6_port = port;
7614 	}
7615 	/* Copy out the address */
7616 	mi_copyout(q, mp);
7617 }
7618 
7619 
7620 static int
7621 udp_unitdata_opt_process(queue_t *q, mblk_t *mp, int *errorp,
7622     udpattrs_t *udpattrs)
7623 {
7624 	struct T_unitdata_req *udreqp;
7625 	int is_absreq_failure;
7626 	cred_t *cr;
7627 	conn_t	*connp = Q_TO_CONN(q);
7628 
7629 	ASSERT(((t_primp_t)mp->b_rptr)->type);
7630 
7631 	cr = DB_CREDDEF(mp, connp->conn_cred);
7632 
7633 	udreqp = (struct T_unitdata_req *)mp->b_rptr;
7634 
7635 	*errorp = tpi_optcom_buf(q, mp, &udreqp->OPT_length,
7636 	    udreqp->OPT_offset, cr, &udp_opt_obj,
7637 	    udpattrs, &is_absreq_failure);
7638 
7639 	if (*errorp != 0) {
7640 		/*
7641 		 * Note: No special action needed in this
7642 		 * module for "is_absreq_failure"
7643 		 */
7644 		return (-1);		/* failure */
7645 	}
7646 	ASSERT(is_absreq_failure == 0);
7647 	return (0);	/* success */
7648 }
7649 
7650 void
7651 udp_ddi_init(void)
7652 {
7653 	udp_max_optsize = optcom_max_optsize(udp_opt_obj.odb_opt_des_arr,
7654 	    udp_opt_obj.odb_opt_arr_cnt);
7655 
7656 	/*
7657 	 * We want to be informed each time a stack is created or
7658 	 * destroyed in the kernel, so we can maintain the
7659 	 * set of udp_stack_t's.
7660 	 */
7661 	netstack_register(NS_UDP, udp_stack_init, NULL, udp_stack_fini);
7662 }
7663 
7664 void
7665 udp_ddi_destroy(void)
7666 {
7667 	netstack_unregister(NS_UDP);
7668 }
7669 
7670 /*
7671  * Initialize the UDP stack instance.
7672  */
7673 static void *
7674 udp_stack_init(netstackid_t stackid, netstack_t *ns)
7675 {
7676 	udp_stack_t	*us;
7677 	udpparam_t	*pa;
7678 	int		i;
7679 
7680 	us = (udp_stack_t *)kmem_zalloc(sizeof (*us), KM_SLEEP);
7681 	us->us_netstack = ns;
7682 
7683 	us->us_num_epriv_ports = UDP_NUM_EPRIV_PORTS;
7684 	us->us_epriv_ports[0] = 2049;
7685 	us->us_epriv_ports[1] = 4045;
7686 
7687 	/*
7688 	 * The smallest anonymous port in the priviledged port range which UDP
7689 	 * looks for free port.  Use in the option UDP_ANONPRIVBIND.
7690 	 */
7691 	us->us_min_anonpriv_port = 512;
7692 
7693 	us->us_bind_fanout_size = udp_bind_fanout_size;
7694 
7695 	/* Roundup variable that might have been modified in /etc/system */
7696 	if (us->us_bind_fanout_size & (us->us_bind_fanout_size - 1)) {
7697 		/* Not a power of two. Round up to nearest power of two */
7698 		for (i = 0; i < 31; i++) {
7699 			if (us->us_bind_fanout_size < (1 << i))
7700 				break;
7701 		}
7702 		us->us_bind_fanout_size = 1 << i;
7703 	}
7704 	us->us_bind_fanout = kmem_zalloc(us->us_bind_fanout_size *
7705 	    sizeof (udp_fanout_t), KM_SLEEP);
7706 	for (i = 0; i < us->us_bind_fanout_size; i++) {
7707 		mutex_init(&us->us_bind_fanout[i].uf_lock, NULL, MUTEX_DEFAULT,
7708 		    NULL);
7709 	}
7710 
7711 	pa = (udpparam_t *)kmem_alloc(sizeof (udp_param_arr), KM_SLEEP);
7712 
7713 	us->us_param_arr = pa;
7714 	bcopy(udp_param_arr, us->us_param_arr, sizeof (udp_param_arr));
7715 
7716 	(void) udp_param_register(&us->us_nd,
7717 	    us->us_param_arr, A_CNT(udp_param_arr));
7718 
7719 	us->us_kstat = udp_kstat2_init(stackid, &us->us_statistics);
7720 	us->us_mibkp = udp_kstat_init(stackid);
7721 	return (us);
7722 }
7723 
7724 /*
7725  * Free the UDP stack instance.
7726  */
7727 static void
7728 udp_stack_fini(netstackid_t stackid, void *arg)
7729 {
7730 	udp_stack_t *us = (udp_stack_t *)arg;
7731 	int i;
7732 
7733 	for (i = 0; i < us->us_bind_fanout_size; i++) {
7734 		mutex_destroy(&us->us_bind_fanout[i].uf_lock);
7735 	}
7736 
7737 	kmem_free(us->us_bind_fanout, us->us_bind_fanout_size *
7738 	    sizeof (udp_fanout_t));
7739 
7740 	us->us_bind_fanout = NULL;
7741 
7742 	nd_free(&us->us_nd);
7743 	kmem_free(us->us_param_arr, sizeof (udp_param_arr));
7744 	us->us_param_arr = NULL;
7745 
7746 	udp_kstat_fini(stackid, us->us_mibkp);
7747 	us->us_mibkp = NULL;
7748 
7749 	udp_kstat2_fini(stackid, us->us_kstat);
7750 	us->us_kstat = NULL;
7751 	bzero(&us->us_statistics, sizeof (us->us_statistics));
7752 	kmem_free(us, sizeof (*us));
7753 }
7754 
7755 static void *
7756 udp_kstat2_init(netstackid_t stackid, udp_stat_t *us_statisticsp)
7757 {
7758 	kstat_t *ksp;
7759 
7760 	udp_stat_t template = {
7761 		{ "udp_ip_send",		KSTAT_DATA_UINT64 },
7762 		{ "udp_ip_ire_send",		KSTAT_DATA_UINT64 },
7763 		{ "udp_ire_null",		KSTAT_DATA_UINT64 },
7764 		{ "udp_drain",			KSTAT_DATA_UINT64 },
7765 		{ "udp_sock_fallback",		KSTAT_DATA_UINT64 },
7766 		{ "udp_rrw_busy",		KSTAT_DATA_UINT64 },
7767 		{ "udp_rrw_msgcnt",		KSTAT_DATA_UINT64 },
7768 		{ "udp_out_sw_cksum",		KSTAT_DATA_UINT64 },
7769 		{ "udp_out_sw_cksum_bytes",	KSTAT_DATA_UINT64 },
7770 		{ "udp_out_opt",		KSTAT_DATA_UINT64 },
7771 		{ "udp_out_err_notconn",	KSTAT_DATA_UINT64 },
7772 		{ "udp_out_err_output",		KSTAT_DATA_UINT64 },
7773 		{ "udp_out_err_tudr",		KSTAT_DATA_UINT64 },
7774 		{ "udp_in_pktinfo",		KSTAT_DATA_UINT64 },
7775 		{ "udp_in_recvdstaddr",		KSTAT_DATA_UINT64 },
7776 		{ "udp_in_recvopts",		KSTAT_DATA_UINT64 },
7777 		{ "udp_in_recvif",		KSTAT_DATA_UINT64 },
7778 		{ "udp_in_recvslla",		KSTAT_DATA_UINT64 },
7779 		{ "udp_in_recvucred",		KSTAT_DATA_UINT64 },
7780 		{ "udp_in_recvttl",		KSTAT_DATA_UINT64 },
7781 		{ "udp_in_recvhopopts",		KSTAT_DATA_UINT64 },
7782 		{ "udp_in_recvhoplimit",	KSTAT_DATA_UINT64 },
7783 		{ "udp_in_recvdstopts",		KSTAT_DATA_UINT64 },
7784 		{ "udp_in_recvrtdstopts",	KSTAT_DATA_UINT64 },
7785 		{ "udp_in_recvrthdr",		KSTAT_DATA_UINT64 },
7786 		{ "udp_in_recvpktinfo",		KSTAT_DATA_UINT64 },
7787 		{ "udp_in_recvtclass",		KSTAT_DATA_UINT64 },
7788 		{ "udp_in_timestamp",		KSTAT_DATA_UINT64 },
7789 #ifdef DEBUG
7790 		{ "udp_data_conn",		KSTAT_DATA_UINT64 },
7791 		{ "udp_data_notconn",		KSTAT_DATA_UINT64 },
7792 #endif
7793 	};
7794 
7795 	ksp = kstat_create_netstack(UDP_MOD_NAME, 0, "udpstat", "net",
7796 	    KSTAT_TYPE_NAMED, sizeof (template) / sizeof (kstat_named_t),
7797 	    KSTAT_FLAG_VIRTUAL, stackid);
7798 
7799 	if (ksp == NULL)
7800 		return (NULL);
7801 
7802 	bcopy(&template, us_statisticsp, sizeof (template));
7803 	ksp->ks_data = (void *)us_statisticsp;
7804 	ksp->ks_private = (void *)(uintptr_t)stackid;
7805 
7806 	kstat_install(ksp);
7807 	return (ksp);
7808 }
7809 
7810 static void
7811 udp_kstat2_fini(netstackid_t stackid, kstat_t *ksp)
7812 {
7813 	if (ksp != NULL) {
7814 		ASSERT(stackid == (netstackid_t)(uintptr_t)ksp->ks_private);
7815 		kstat_delete_netstack(ksp, stackid);
7816 	}
7817 }
7818 
7819 static void *
7820 udp_kstat_init(netstackid_t stackid)
7821 {
7822 	kstat_t	*ksp;
7823 
7824 	udp_named_kstat_t template = {
7825 		{ "inDatagrams",	KSTAT_DATA_UINT64, 0 },
7826 		{ "inErrors",		KSTAT_DATA_UINT32, 0 },
7827 		{ "outDatagrams",	KSTAT_DATA_UINT64, 0 },
7828 		{ "entrySize",		KSTAT_DATA_INT32, 0 },
7829 		{ "entry6Size",		KSTAT_DATA_INT32, 0 },
7830 		{ "outErrors",		KSTAT_DATA_UINT32, 0 },
7831 	};
7832 
7833 	ksp = kstat_create_netstack(UDP_MOD_NAME, 0, UDP_MOD_NAME, "mib2",
7834 	    KSTAT_TYPE_NAMED,
7835 	    NUM_OF_FIELDS(udp_named_kstat_t), 0, stackid);
7836 
7837 	if (ksp == NULL || ksp->ks_data == NULL)
7838 		return (NULL);
7839 
7840 	template.entrySize.value.ui32 = sizeof (mib2_udpEntry_t);
7841 	template.entry6Size.value.ui32 = sizeof (mib2_udp6Entry_t);
7842 
7843 	bcopy(&template, ksp->ks_data, sizeof (template));
7844 	ksp->ks_update = udp_kstat_update;
7845 	ksp->ks_private = (void *)(uintptr_t)stackid;
7846 
7847 	kstat_install(ksp);
7848 	return (ksp);
7849 }
7850 
7851 static void
7852 udp_kstat_fini(netstackid_t stackid, kstat_t *ksp)
7853 {
7854 	if (ksp != NULL) {
7855 		ASSERT(stackid == (netstackid_t)(uintptr_t)ksp->ks_private);
7856 		kstat_delete_netstack(ksp, stackid);
7857 	}
7858 }
7859 
7860 static int
7861 udp_kstat_update(kstat_t *kp, int rw)
7862 {
7863 	udp_named_kstat_t *udpkp;
7864 	netstackid_t	stackid = (netstackid_t)(uintptr_t)kp->ks_private;
7865 	netstack_t	*ns;
7866 	udp_stack_t	*us;
7867 
7868 	if ((kp == NULL) || (kp->ks_data == NULL))
7869 		return (EIO);
7870 
7871 	if (rw == KSTAT_WRITE)
7872 		return (EACCES);
7873 
7874 	ns = netstack_find_by_stackid(stackid);
7875 	if (ns == NULL)
7876 		return (-1);
7877 	us = ns->netstack_udp;
7878 	if (us == NULL) {
7879 		netstack_rele(ns);
7880 		return (-1);
7881 	}
7882 	udpkp = (udp_named_kstat_t *)kp->ks_data;
7883 
7884 	udpkp->inDatagrams.value.ui64 =	us->us_udp_mib.udpHCInDatagrams;
7885 	udpkp->inErrors.value.ui32 =	us->us_udp_mib.udpInErrors;
7886 	udpkp->outDatagrams.value.ui64 = us->us_udp_mib.udpHCOutDatagrams;
7887 	udpkp->outErrors.value.ui32 =	us->us_udp_mib.udpOutErrors;
7888 	netstack_rele(ns);
7889 	return (0);
7890 }
7891 
7892 /*
7893  * Read-side synchronous stream info entry point, called as a
7894  * result of handling certain STREAMS ioctl operations.
7895  */
7896 static int
7897 udp_rinfop(queue_t *q, infod_t *dp)
7898 {
7899 	mblk_t	*mp;
7900 	uint_t	cmd = dp->d_cmd;
7901 	int	res = 0;
7902 	int	error = 0;
7903 	udp_t	*udp = Q_TO_UDP(q);
7904 	struct stdata *stp = STREAM(q);
7905 
7906 	mutex_enter(&udp->udp_drain_lock);
7907 	/* If shutdown on read has happened, return nothing */
7908 	mutex_enter(&stp->sd_lock);
7909 	if (stp->sd_flag & STREOF) {
7910 		mutex_exit(&stp->sd_lock);
7911 		goto done;
7912 	}
7913 	mutex_exit(&stp->sd_lock);
7914 
7915 	if ((mp = udp->udp_rcv_list_head) == NULL)
7916 		goto done;
7917 
7918 	ASSERT(DB_TYPE(mp) != M_DATA && mp->b_cont != NULL);
7919 
7920 	if (cmd & INFOD_COUNT) {
7921 		/*
7922 		 * Return the number of messages.
7923 		 */
7924 		dp->d_count += udp->udp_rcv_msgcnt;
7925 		res |= INFOD_COUNT;
7926 	}
7927 	if (cmd & INFOD_BYTES) {
7928 		/*
7929 		 * Return size of all data messages.
7930 		 */
7931 		dp->d_bytes += udp->udp_rcv_cnt;
7932 		res |= INFOD_BYTES;
7933 	}
7934 	if (cmd & INFOD_FIRSTBYTES) {
7935 		/*
7936 		 * Return size of first data message.
7937 		 */
7938 		dp->d_bytes = msgdsize(mp);
7939 		res |= INFOD_FIRSTBYTES;
7940 		dp->d_cmd &= ~INFOD_FIRSTBYTES;
7941 	}
7942 	if (cmd & INFOD_COPYOUT) {
7943 		mblk_t *mp1 = mp->b_cont;
7944 		int n;
7945 		/*
7946 		 * Return data contents of first message.
7947 		 */
7948 		ASSERT(DB_TYPE(mp1) == M_DATA);
7949 		while (mp1 != NULL && dp->d_uiop->uio_resid > 0) {
7950 			n = MIN(dp->d_uiop->uio_resid, MBLKL(mp1));
7951 			if (n != 0 && (error = uiomove((char *)mp1->b_rptr, n,
7952 			    UIO_READ, dp->d_uiop)) != 0) {
7953 				goto done;
7954 			}
7955 			mp1 = mp1->b_cont;
7956 		}
7957 		res |= INFOD_COPYOUT;
7958 		dp->d_cmd &= ~INFOD_COPYOUT;
7959 	}
7960 done:
7961 	mutex_exit(&udp->udp_drain_lock);
7962 
7963 	dp->d_res |= res;
7964 
7965 	return (error);
7966 }
7967 
7968 /*
7969  * Read-side synchronous stream entry point.  This is called as a result
7970  * of recv/read operation done at sockfs, and is guaranteed to execute
7971  * outside of the interrupt thread context.  It returns a single datagram
7972  * (b_cont chain of T_UNITDATA_IND plus data) to the upper layer.
7973  */
7974 static int
7975 udp_rrw(queue_t *q, struiod_t *dp)
7976 {
7977 	mblk_t	*mp;
7978 	udp_t	*udp = Q_TO_UDP(q);
7979 	udp_stack_t *us = udp->udp_us;
7980 
7981 	/*
7982 	 * Dequeue datagram from the head of the list and return
7983 	 * it to caller; also ensure that RSLEEP sd_wakeq flag is
7984 	 * set/cleared depending on whether or not there's data
7985 	 * remaining in the list.
7986 	 */
7987 	mutex_enter(&udp->udp_drain_lock);
7988 	if (!udp->udp_direct_sockfs) {
7989 		mutex_exit(&udp->udp_drain_lock);
7990 		UDP_STAT(us, udp_rrw_busy);
7991 		return (EBUSY);
7992 	}
7993 	if ((mp = udp->udp_rcv_list_head) != NULL) {
7994 		uint_t size = msgdsize(mp);
7995 
7996 		/* Last datagram in the list? */
7997 		if ((udp->udp_rcv_list_head = mp->b_next) == NULL)
7998 			udp->udp_rcv_list_tail = NULL;
7999 		mp->b_next = NULL;
8000 
8001 		udp->udp_rcv_cnt -= size;
8002 		udp->udp_rcv_msgcnt--;
8003 		UDP_STAT(us, udp_rrw_msgcnt);
8004 
8005 		/* No longer flow-controlling? */
8006 		if (udp->udp_rcv_cnt < udp->udp_rcv_hiwat &&
8007 		    udp->udp_rcv_msgcnt < udp->udp_rcv_hiwat)
8008 			udp->udp_drain_qfull = B_FALSE;
8009 	}
8010 	if (udp->udp_rcv_list_head == NULL) {
8011 		/*
8012 		 * Either we just dequeued the last datagram or
8013 		 * we get here from sockfs and have nothing to
8014 		 * return; in this case clear RSLEEP.
8015 		 */
8016 		ASSERT(udp->udp_rcv_cnt == 0);
8017 		ASSERT(udp->udp_rcv_msgcnt == 0);
8018 		ASSERT(udp->udp_rcv_list_tail == NULL);
8019 		STR_WAKEUP_CLEAR(STREAM(q));
8020 	} else {
8021 		/*
8022 		 * More data follows; we need udp_rrw() to be
8023 		 * called in future to pick up the rest.
8024 		 */
8025 		STR_WAKEUP_SET(STREAM(q));
8026 	}
8027 	mutex_exit(&udp->udp_drain_lock);
8028 	dp->d_mp = mp;
8029 	return (0);
8030 }
8031 
8032 /*
8033  * Enqueue a completely-built T_UNITDATA_IND message into the receive
8034  * list; this is typically executed within the interrupt thread context
8035  * and so we do things as quickly as possible.
8036  */
8037 static void
8038 udp_rcv_enqueue(queue_t *q, udp_t *udp, mblk_t *mp, uint_t pkt_len)
8039 {
8040 	ASSERT(q == RD(q));
8041 	ASSERT(pkt_len == msgdsize(mp));
8042 	ASSERT(mp->b_next == NULL && mp->b_cont != NULL);
8043 	ASSERT(DB_TYPE(mp) == M_PROTO && DB_TYPE(mp->b_cont) == M_DATA);
8044 	ASSERT(MBLKL(mp) >= sizeof (struct T_unitdata_ind));
8045 
8046 	mutex_enter(&udp->udp_drain_lock);
8047 	/*
8048 	 * Wake up and signal the receiving app; it is okay to do this
8049 	 * before enqueueing the mp because we are holding the drain lock.
8050 	 * One of the advantages of synchronous stream is the ability for
8051 	 * us to find out when the application performs a read on the
8052 	 * socket by way of udp_rrw() entry point being called.  We need
8053 	 * to generate SIGPOLL/SIGIO for each received data in the case
8054 	 * of asynchronous socket just as in the strrput() case.  However,
8055 	 * we only wake the application up when necessary, i.e. during the
8056 	 * first enqueue.  When udp_rrw() is called, we send up a single
8057 	 * datagram upstream and call STR_WAKEUP_SET() again when there
8058 	 * are still data remaining in our receive queue.
8059 	 */
8060 	if (udp->udp_rcv_list_head == NULL) {
8061 		STR_WAKEUP_SET(STREAM(q));
8062 		udp->udp_rcv_list_head = mp;
8063 	} else {
8064 		udp->udp_rcv_list_tail->b_next = mp;
8065 	}
8066 	udp->udp_rcv_list_tail = mp;
8067 	udp->udp_rcv_cnt += pkt_len;
8068 	udp->udp_rcv_msgcnt++;
8069 
8070 	/* Need to flow-control? */
8071 	if (udp->udp_rcv_cnt >= udp->udp_rcv_hiwat ||
8072 	    udp->udp_rcv_msgcnt >= udp->udp_rcv_hiwat)
8073 		udp->udp_drain_qfull = B_TRUE;
8074 
8075 	/* Update poll events and send SIGPOLL/SIGIO if necessary */
8076 	STR_SENDSIG(STREAM(q));
8077 	mutex_exit(&udp->udp_drain_lock);
8078 }
8079 
8080 /*
8081  * Drain the contents of receive list to the module upstream; we do
8082  * this during close or when we fallback to the slow mode due to
8083  * sockmod being popped or a module being pushed on top of us.
8084  */
8085 static void
8086 udp_rcv_drain(queue_t *q, udp_t *udp, boolean_t closing)
8087 {
8088 	mblk_t *mp;
8089 	udp_stack_t *us = udp->udp_us;
8090 
8091 	ASSERT(q == RD(q));
8092 
8093 	mutex_enter(&udp->udp_drain_lock);
8094 	/*
8095 	 * There is no race with a concurrent udp_input() sending
8096 	 * up packets using putnext() after we have cleared the
8097 	 * udp_direct_sockfs flag but before we have completed
8098 	 * sending up the packets in udp_rcv_list, since we are
8099 	 * either a writer or we have quiesced the conn.
8100 	 */
8101 	udp->udp_direct_sockfs = B_FALSE;
8102 	mutex_exit(&udp->udp_drain_lock);
8103 
8104 	if (udp->udp_rcv_list_head != NULL)
8105 		UDP_STAT(us, udp_drain);
8106 
8107 	/*
8108 	 * Send up everything via putnext(); note here that we
8109 	 * don't need the udp_drain_lock to protect us since
8110 	 * nothing can enter udp_rrw() and that we currently
8111 	 * have exclusive access to this udp.
8112 	 */
8113 	while ((mp = udp->udp_rcv_list_head) != NULL) {
8114 		udp->udp_rcv_list_head = mp->b_next;
8115 		mp->b_next = NULL;
8116 		udp->udp_rcv_cnt -= msgdsize(mp);
8117 		udp->udp_rcv_msgcnt--;
8118 		if (closing) {
8119 			freemsg(mp);
8120 		} else {
8121 			putnext(q, mp);
8122 		}
8123 	}
8124 	ASSERT(udp->udp_rcv_cnt == 0);
8125 	ASSERT(udp->udp_rcv_msgcnt == 0);
8126 	ASSERT(udp->udp_rcv_list_head == NULL);
8127 	udp->udp_rcv_list_tail = NULL;
8128 	udp->udp_drain_qfull = B_FALSE;
8129 }
8130 
8131 static size_t
8132 udp_set_rcv_hiwat(udp_t *udp, size_t size)
8133 {
8134 	udp_stack_t *us = udp->udp_us;
8135 
8136 	/* We add a bit of extra buffering */
8137 	size += size >> 1;
8138 	if (size > us->us_max_buf)
8139 		size = us->us_max_buf;
8140 
8141 	udp->udp_rcv_hiwat = size;
8142 	return (size);
8143 }
8144 
8145 /*
8146  * For the lower queue so that UDP can be a dummy mux.
8147  * Nobody should be sending
8148  * packets up this stream
8149  */
8150 static void
8151 udp_lrput(queue_t *q, mblk_t *mp)
8152 {
8153 	mblk_t *mp1;
8154 
8155 	switch (mp->b_datap->db_type) {
8156 	case M_FLUSH:
8157 		/* Turn around */
8158 		if (*mp->b_rptr & FLUSHW) {
8159 			*mp->b_rptr &= ~FLUSHR;
8160 			qreply(q, mp);
8161 			return;
8162 		}
8163 		break;
8164 	}
8165 	/* Could receive messages that passed through ar_rput */
8166 	for (mp1 = mp; mp1; mp1 = mp1->b_cont)
8167 		mp1->b_prev = mp1->b_next = NULL;
8168 	freemsg(mp);
8169 }
8170 
8171 /*
8172  * For the lower queue so that UDP can be a dummy mux.
8173  * Nobody should be sending packets down this stream.
8174  */
8175 /* ARGSUSED */
8176 void
8177 udp_lwput(queue_t *q, mblk_t *mp)
8178 {
8179 	freemsg(mp);
8180 }
8181