1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 /*
  22  * Copyright (c) 1991, 2010, Oracle and/or its affiliates. All rights reserved.
  23  * Copyright 2013 Nexenta Systems, Inc.  All rights reserved.
  24  * Copyright 2014, OmniTI Computer Consulting, Inc. All rights reserved.
  25  */
  26 /* Copyright (c) 1990 Mentat Inc. */
  27 
  28 #include <sys/types.h>
  29 #include <sys/stream.h>
  30 #include <sys/stropts.h>
  31 #include <sys/strlog.h>
  32 #include <sys/strsun.h>
  33 #define _SUN_TPI_VERSION 2
  34 #include <sys/tihdr.h>
  35 #include <sys/timod.h>
  36 #include <sys/ddi.h>
  37 #include <sys/sunddi.h>
  38 #include <sys/strsubr.h>
  39 #include <sys/suntpi.h>
  40 #include <sys/xti_inet.h>
  41 #include <sys/kmem.h>
  42 #include <sys/cred_impl.h>
  43 #include <sys/policy.h>
  44 #include <sys/priv.h>
  45 #include <sys/ucred.h>
  46 #include <sys/zone.h>
  47 
  48 #include <sys/socket.h>
  49 #include <sys/socketvar.h>
  50 #include <sys/sockio.h>
  51 #include <sys/vtrace.h>
  52 #include <sys/sdt.h>
  53 #include <sys/debug.h>
  54 #include <sys/isa_defs.h>
  55 #include <sys/random.h>
  56 #include <netinet/in.h>
  57 #include <netinet/ip6.h>
  58 #include <netinet/icmp6.h>
  59 #include <netinet/udp.h>
  60 
  61 #include <inet/common.h>
  62 #include <inet/ip.h>
  63 #include <inet/ip_impl.h>
  64 #include <inet/ipsec_impl.h>
  65 #include <inet/ip6.h>
  66 #include <inet/ip_ire.h>
  67 #include <inet/ip_if.h>
  68 #include <inet/ip_multi.h>
  69 #include <inet/ip_ndp.h>
  70 #include <inet/proto_set.h>
  71 #include <inet/mib2.h>
  72 #include <inet/optcom.h>
  73 #include <inet/snmpcom.h>
  74 #include <inet/kstatcom.h>
  75 #include <inet/ipclassifier.h>
  76 #include <sys/squeue_impl.h>
  77 #include <inet/ipnet.h>
  78 #include <sys/ethernet.h>
  79 
  80 #include <sys/tsol/label.h>
  81 #include <sys/tsol/tnet.h>
  82 #include <rpc/pmap_prot.h>
  83 
  84 #include <inet/udp_impl.h>
  85 
  86 /*
  87  * Synchronization notes:
  88  *
  89  * UDP is MT and uses the usual kernel synchronization primitives. There are 2
  90  * locks, the fanout lock (uf_lock) and conn_lock. conn_lock
  91  * protects the contents of the udp_t. uf_lock protects the address and the
  92  * fanout information.
  93  * The lock order is conn_lock -> uf_lock.
  94  *
  95  * The fanout lock uf_lock:
  96  * When a UDP endpoint is bound to a local port, it is inserted into
  97  * a bind hash list.  The list consists of an array of udp_fanout_t buckets.
  98  * The size of the array is controlled by the udp_bind_fanout_size variable.
  99  * This variable can be changed in /etc/system if the default value is
 100  * not large enough.  Each bind hash bucket is protected by a per bucket
 101  * lock.  It protects the udp_bind_hash and udp_ptpbhn fields in the udp_t
 102  * structure and a few other fields in the udp_t. A UDP endpoint is removed
 103  * from the bind hash list only when it is being unbound or being closed.
 104  * The per bucket lock also protects a UDP endpoint's state changes.
 105  *
 106  * Plumbing notes:
 107  * UDP is always a device driver. For compatibility with mibopen() code
 108  * it is possible to I_PUSH "udp", but that results in pushing a passthrough
 109  * dummy module.
 110  *
 111  * The above implies that we don't support any intermediate module to
 112  * reside in between /dev/ip and udp -- in fact, we never supported such
 113  * scenario in the past as the inter-layer communication semantics have
 114  * always been private.
 115  */
 116 
 117 /* For /etc/system control */
 118 uint_t udp_bind_fanout_size = UDP_BIND_FANOUT_SIZE;
 119 
 120 static void     udp_addr_req(queue_t *q, mblk_t *mp);
 121 static void     udp_tpi_bind(queue_t *q, mblk_t *mp);
 122 static void     udp_bind_hash_insert(udp_fanout_t *uf, udp_t *udp);
 123 static void     udp_bind_hash_remove(udp_t *udp, boolean_t caller_holds_lock);
 124 static int      udp_build_hdr_template(conn_t *, const in6_addr_t *,
 125     const in6_addr_t *, in_port_t, uint32_t);
 126 static void     udp_capability_req(queue_t *q, mblk_t *mp);
 127 static int      udp_tpi_close(queue_t *q, int flags);
 128 static void     udp_close_free(conn_t *);
 129 static void     udp_tpi_connect(queue_t *q, mblk_t *mp);
 130 static void     udp_tpi_disconnect(queue_t *q, mblk_t *mp);
 131 static void     udp_err_ack(queue_t *q, mblk_t *mp, t_scalar_t t_error,
 132     int sys_error);
 133 static void     udp_err_ack_prim(queue_t *q, mblk_t *mp, t_scalar_t primitive,
 134     t_scalar_t tlierr, int sys_error);
 135 static int      udp_extra_priv_ports_get(queue_t *q, mblk_t *mp, caddr_t cp,
 136                     cred_t *cr);
 137 static int      udp_extra_priv_ports_add(queue_t *q, mblk_t *mp,
 138                     char *value, caddr_t cp, cred_t *cr);
 139 static int      udp_extra_priv_ports_del(queue_t *q, mblk_t *mp,
 140                     char *value, caddr_t cp, cred_t *cr);
 141 static void     udp_icmp_input(void *, mblk_t *, void *, ip_recv_attr_t *);
 142 static void     udp_icmp_error_ipv6(conn_t *connp, mblk_t *mp,
 143     ip_recv_attr_t *ira);
 144 static void     udp_info_req(queue_t *q, mblk_t *mp);
 145 static void     udp_input(void *, mblk_t *, void *, ip_recv_attr_t *);
 146 static void     udp_lrput(queue_t *, mblk_t *);
 147 static void     udp_lwput(queue_t *, mblk_t *);
 148 static int      udp_open(queue_t *q, dev_t *devp, int flag, int sflag,
 149                     cred_t *credp, boolean_t isv6);
 150 static int      udp_openv4(queue_t *q, dev_t *devp, int flag, int sflag,
 151                     cred_t *credp);
 152 static int      udp_openv6(queue_t *q, dev_t *devp, int flag, int sflag,
 153                     cred_t *credp);
 154 static boolean_t udp_opt_allow_udr_set(t_scalar_t level, t_scalar_t name);
 155 int             udp_opt_set(conn_t *connp, uint_t optset_context,
 156                     int level, int name, uint_t inlen,
 157                     uchar_t *invalp, uint_t *outlenp, uchar_t *outvalp,
 158                     void *thisdg_attrs, cred_t *cr);
 159 int             udp_opt_get(conn_t *connp, int level, int name,
 160                     uchar_t *ptr);
 161 static int      udp_output_connected(conn_t *connp, mblk_t *mp, cred_t *cr,
 162                     pid_t pid);
 163 static int      udp_output_lastdst(conn_t *connp, mblk_t *mp, cred_t *cr,
 164     pid_t pid, ip_xmit_attr_t *ixa);
 165 static int      udp_output_newdst(conn_t *connp, mblk_t *data_mp, sin_t *sin,
 166                     sin6_t *sin6, ushort_t ipversion, cred_t *cr, pid_t,
 167                     ip_xmit_attr_t *ixa);
 168 static mblk_t   *udp_prepend_hdr(conn_t *, ip_xmit_attr_t *, const ip_pkt_t *,
 169     const in6_addr_t *, const in6_addr_t *, in_port_t, uint32_t, mblk_t *,
 170     int *);
 171 static mblk_t   *udp_prepend_header_template(conn_t *, ip_xmit_attr_t *,
 172     mblk_t *, const in6_addr_t *, in_port_t, uint32_t, int *);
 173 static void     udp_ud_err(queue_t *q, mblk_t *mp, t_scalar_t err);
 174 static void     udp_ud_err_connected(conn_t *, t_scalar_t);
 175 static void     udp_tpi_unbind(queue_t *q, mblk_t *mp);
 176 static in_port_t udp_update_next_port(udp_t *udp, in_port_t port,
 177     boolean_t random);
 178 static void     udp_wput_other(queue_t *q, mblk_t *mp);
 179 static void     udp_wput_iocdata(queue_t *q, mblk_t *mp);
 180 static void     udp_wput_fallback(queue_t *q, mblk_t *mp);
 181 static size_t   udp_set_rcv_hiwat(udp_t *udp, size_t size);
 182 
 183 static void     *udp_stack_init(netstackid_t stackid, netstack_t *ns);
 184 static void     udp_stack_fini(netstackid_t stackid, void *arg);
 185 
 186 /* Common routines for TPI and socket module */
 187 static void     udp_ulp_recv(conn_t *, mblk_t *, uint_t, ip_recv_attr_t *);
 188 
 189 /* Common routine for TPI and socket module */
 190 static conn_t   *udp_do_open(cred_t *, boolean_t, int, int *);
 191 static void     udp_do_close(conn_t *);
 192 static int      udp_do_bind(conn_t *, struct sockaddr *, socklen_t, cred_t *,
 193     boolean_t);
 194 static int      udp_do_unbind(conn_t *);
 195 
 196 int             udp_getsockname(sock_lower_handle_t,
 197     struct sockaddr *, socklen_t *, cred_t *);
 198 int             udp_getpeername(sock_lower_handle_t,
 199     struct sockaddr *, socklen_t *, cred_t *);
 200 static int      udp_do_connect(conn_t *, const struct sockaddr *, socklen_t,
 201     cred_t *, pid_t);
 202 
 203 #pragma inline(udp_output_connected, udp_output_newdst, udp_output_lastdst)
 204 
 205 /*
 206  * Checks if the given destination addr/port is allowed out.
 207  * If allowed, registers the (dest_addr/port, node_ID) mapping at Cluster.
 208  * Called for each connect() and for sendto()/sendmsg() to a different
 209  * destination.
 210  * For connect(), called in udp_connect().
 211  * For sendto()/sendmsg(), called in udp_output_newdst().
 212  *
 213  * This macro assumes that the cl_inet_connect2 hook is not NULL.
 214  * Please check this before calling this macro.
 215  *
 216  * void
 217  * CL_INET_UDP_CONNECT(conn_t cp, udp_t *udp, boolean_t is_outgoing,
 218  *     in6_addr_t *faddrp, in_port_t (or uint16_t) fport, int err);
 219  */
 220 #define CL_INET_UDP_CONNECT(cp, is_outgoing, faddrp, fport, err) {      \
 221         (err) = 0;                                                      \
 222         /*                                                              \
 223          * Running in cluster mode - check and register active          \
 224          * "connection" information                                     \
 225          */                                                             \
 226         if ((cp)->conn_ipversion == IPV4_VERSION)                    \
 227                 (err) = (*cl_inet_connect2)(                            \
 228                     (cp)->conn_netstack->netstack_stackid,                \
 229                     IPPROTO_UDP, is_outgoing, AF_INET,                  \
 230                     (uint8_t *)&((cp)->conn_laddr_v4),                   \
 231                     (cp)->conn_lport,                                        \
 232                     (uint8_t *)&(V4_PART_OF_V6(*faddrp)),           \
 233                     (in_port_t)(fport), NULL);                          \
 234         else                                                            \
 235                 (err) = (*cl_inet_connect2)(                            \
 236                     (cp)->conn_netstack->netstack_stackid,                \
 237                     IPPROTO_UDP, is_outgoing, AF_INET6,                 \
 238                     (uint8_t *)&((cp)->conn_laddr_v6),                   \
 239                     (cp)->conn_lport,                                        \
 240                     (uint8_t *)(faddrp), (in_port_t)(fport), NULL);     \
 241 }
 242 
 243 static struct module_info udp_mod_info =  {
 244         UDP_MOD_ID, UDP_MOD_NAME, 1, INFPSZ, UDP_RECV_HIWATER, UDP_RECV_LOWATER
 245 };
 246 
 247 /*
 248  * Entry points for UDP as a device.
 249  * We have separate open functions for the /dev/udp and /dev/udp6 devices.
 250  */
 251 static struct qinit udp_rinitv4 = {
 252         NULL, NULL, udp_openv4, udp_tpi_close, NULL, &udp_mod_info, NULL
 253 };
 254 
 255 static struct qinit udp_rinitv6 = {
 256         NULL, NULL, udp_openv6, udp_tpi_close, NULL, &udp_mod_info, NULL
 257 };
 258 
 259 static struct qinit udp_winit = {
 260         (pfi_t)udp_wput, (pfi_t)ip_wsrv, NULL, NULL, NULL, &udp_mod_info
 261 };
 262 
 263 /* UDP entry point during fallback */
 264 struct qinit udp_fallback_sock_winit = {
 265         (pfi_t)udp_wput_fallback, NULL, NULL, NULL, NULL, &udp_mod_info
 266 };
 267 
 268 /*
 269  * UDP needs to handle I_LINK and I_PLINK since ifconfig
 270  * likes to use it as a place to hang the various streams.
 271  */
 272 static struct qinit udp_lrinit = {
 273         (pfi_t)udp_lrput, NULL, udp_openv4, udp_tpi_close, NULL, &udp_mod_info
 274 };
 275 
 276 static struct qinit udp_lwinit = {
 277         (pfi_t)udp_lwput, NULL, udp_openv4, udp_tpi_close, NULL, &udp_mod_info
 278 };
 279 
 280 /* For AF_INET aka /dev/udp */
 281 struct streamtab udpinfov4 = {
 282         &udp_rinitv4, &udp_winit, &udp_lrinit, &udp_lwinit
 283 };
 284 
 285 /* For AF_INET6 aka /dev/udp6 */
 286 struct streamtab udpinfov6 = {
 287         &udp_rinitv6, &udp_winit, &udp_lrinit, &udp_lwinit
 288 };
 289 
 290 #define UDP_MAXPACKET_IPV4 (IP_MAXPACKET - UDPH_SIZE - IP_SIMPLE_HDR_LENGTH)
 291 
 292 /* Default structure copied into T_INFO_ACK messages */
 293 static struct T_info_ack udp_g_t_info_ack_ipv4 = {
 294         T_INFO_ACK,
 295         UDP_MAXPACKET_IPV4,     /* TSDU_size. Excl. headers */
 296         T_INVALID,      /* ETSU_size.  udp does not support expedited data. */
 297         T_INVALID,      /* CDATA_size. udp does not support connect data. */
 298         T_INVALID,      /* DDATA_size. udp does not support disconnect data. */
 299         sizeof (sin_t), /* ADDR_size. */
 300         0,              /* OPT_size - not initialized here */
 301         UDP_MAXPACKET_IPV4,     /* TIDU_size.  Excl. headers */
 302         T_CLTS,         /* SERV_type.  udp supports connection-less. */
 303         TS_UNBND,       /* CURRENT_state.  This is set from udp_state. */
 304         (XPG4_1|SENDZERO) /* PROVIDER_flag */
 305 };
 306 
 307 #define UDP_MAXPACKET_IPV6 (IP_MAXPACKET - UDPH_SIZE - IPV6_HDR_LEN)
 308 
 309 static  struct T_info_ack udp_g_t_info_ack_ipv6 = {
 310         T_INFO_ACK,
 311         UDP_MAXPACKET_IPV6,     /* TSDU_size.  Excl. headers */
 312         T_INVALID,      /* ETSU_size.  udp does not support expedited data. */
 313         T_INVALID,      /* CDATA_size. udp does not support connect data. */
 314         T_INVALID,      /* DDATA_size. udp does not support disconnect data. */
 315         sizeof (sin6_t), /* ADDR_size. */
 316         0,              /* OPT_size - not initialized here */
 317         UDP_MAXPACKET_IPV6,     /* TIDU_size. Excl. headers */
 318         T_CLTS,         /* SERV_type.  udp supports connection-less. */
 319         TS_UNBND,       /* CURRENT_state.  This is set from udp_state. */
 320         (XPG4_1|SENDZERO) /* PROVIDER_flag */
 321 };
 322 
 323 /*
 324  * UDP tunables related declarations. Definitions are in udp_tunables.c
 325  */
 326 extern mod_prop_info_t udp_propinfo_tbl[];
 327 extern int udp_propinfo_count;
 328 
 329 /* Setable in /etc/system */
 330 /* If set to 0, pick ephemeral port sequentially; otherwise randomly. */
 331 uint32_t udp_random_anon_port = 1;
 332 
 333 /*
 334  * Hook functions to enable cluster networking.
 335  * On non-clustered systems these vectors must always be NULL
 336  */
 337 
 338 void (*cl_inet_bind)(netstackid_t stack_id, uchar_t protocol,
 339     sa_family_t addr_family, uint8_t *laddrp, in_port_t lport,
 340     void *args) = NULL;
 341 void (*cl_inet_unbind)(netstackid_t stack_id, uint8_t protocol,
 342     sa_family_t addr_family, uint8_t *laddrp, in_port_t lport,
 343     void *args) = NULL;
 344 
 345 typedef union T_primitives *t_primp_t;
 346 
 347 /*
 348  * Return the next anonymous port in the privileged port range for
 349  * bind checking.
 350  *
 351  * Trusted Extension (TX) notes: TX allows administrator to mark or
 352  * reserve ports as Multilevel ports (MLP). MLP has special function
 353  * on TX systems. Once a port is made MLP, it's not available as
 354  * ordinary port. This creates "holes" in the port name space. It
 355  * may be necessary to skip the "holes" find a suitable anon port.
 356  */
 357 static in_port_t
 358 udp_get_next_priv_port(udp_t *udp)
 359 {
 360         static in_port_t next_priv_port = IPPORT_RESERVED - 1;
 361         in_port_t nextport;
 362         boolean_t restart = B_FALSE;
 363         udp_stack_t *us = udp->udp_us;
 364 
 365 retry:
 366         if (next_priv_port < us->us_min_anonpriv_port ||
 367             next_priv_port >= IPPORT_RESERVED) {
 368                 next_priv_port = IPPORT_RESERVED - 1;
 369                 if (restart)
 370                         return (0);
 371                 restart = B_TRUE;
 372         }
 373 
 374         if (is_system_labeled() &&
 375             (nextport = tsol_next_port(crgetzone(udp->udp_connp->conn_cred),
 376             next_priv_port, IPPROTO_UDP, B_FALSE)) != 0) {
 377                 next_priv_port = nextport;
 378                 goto retry;
 379         }
 380 
 381         return (next_priv_port--);
 382 }
 383 
 384 /*
 385  * Hash list removal routine for udp_t structures.
 386  */
 387 static void
 388 udp_bind_hash_remove(udp_t *udp, boolean_t caller_holds_lock)
 389 {
 390         udp_t           *udpnext;
 391         kmutex_t        *lockp;
 392         udp_stack_t     *us = udp->udp_us;
 393         conn_t          *connp = udp->udp_connp;
 394 
 395         if (udp->udp_ptpbhn == NULL)
 396                 return;
 397 
 398         /*
 399          * Extract the lock pointer in case there are concurrent
 400          * hash_remove's for this instance.
 401          */
 402         ASSERT(connp->conn_lport != 0);
 403         if (!caller_holds_lock) {
 404                 lockp = &us->us_bind_fanout[UDP_BIND_HASH(connp->conn_lport,
 405                     us->us_bind_fanout_size)].uf_lock;
 406                 ASSERT(lockp != NULL);
 407                 mutex_enter(lockp);
 408         }
 409         if (udp->udp_ptpbhn != NULL) {
 410                 udpnext = udp->udp_bind_hash;
 411                 if (udpnext != NULL) {
 412                         udpnext->udp_ptpbhn = udp->udp_ptpbhn;
 413                         udp->udp_bind_hash = NULL;
 414                 }
 415                 *udp->udp_ptpbhn = udpnext;
 416                 udp->udp_ptpbhn = NULL;
 417         }
 418         if (!caller_holds_lock) {
 419                 mutex_exit(lockp);
 420         }
 421 }
 422 
 423 static void
 424 udp_bind_hash_insert(udp_fanout_t *uf, udp_t *udp)
 425 {
 426         conn_t  *connp = udp->udp_connp;
 427         udp_t   **udpp;
 428         udp_t   *udpnext;
 429         conn_t  *connext;
 430 
 431         ASSERT(MUTEX_HELD(&uf->uf_lock));
 432         ASSERT(udp->udp_ptpbhn == NULL);
 433         udpp = &uf->uf_udp;
 434         udpnext = udpp[0];
 435         if (udpnext != NULL) {
 436                 /*
 437                  * If the new udp bound to the INADDR_ANY address
 438                  * and the first one in the list is not bound to
 439                  * INADDR_ANY we skip all entries until we find the
 440                  * first one bound to INADDR_ANY.
 441                  * This makes sure that applications binding to a
 442                  * specific address get preference over those binding to
 443                  * INADDR_ANY.
 444                  */
 445                 connext = udpnext->udp_connp;
 446                 if (V6_OR_V4_INADDR_ANY(connp->conn_bound_addr_v6) &&
 447                     !V6_OR_V4_INADDR_ANY(connext->conn_bound_addr_v6)) {
 448                         while ((udpnext = udpp[0]) != NULL &&
 449                             !V6_OR_V4_INADDR_ANY(connext->conn_bound_addr_v6)) {
 450                                 udpp = &(udpnext->udp_bind_hash);
 451                         }
 452                         if (udpnext != NULL)
 453                                 udpnext->udp_ptpbhn = &udp->udp_bind_hash;
 454                 } else {
 455                         udpnext->udp_ptpbhn = &udp->udp_bind_hash;
 456                 }
 457         }
 458         udp->udp_bind_hash = udpnext;
 459         udp->udp_ptpbhn = udpp;
 460         udpp[0] = udp;
 461 }
 462 
 463 /*
 464  * This routine is called to handle each O_T_BIND_REQ/T_BIND_REQ message
 465  * passed to udp_wput.
 466  * It associates a port number and local address with the stream.
 467  * It calls IP to verify the local IP address, and calls IP to insert
 468  * the conn_t in the fanout table.
 469  * If everything is ok it then sends the T_BIND_ACK back up.
 470  *
 471  * Note that UDP over IPv4 and IPv6 sockets can use the same port number
 472  * without setting SO_REUSEADDR. This is needed so that they
 473  * can be viewed as two independent transport protocols.
 474  * However, anonymouns ports are allocated from the same range to avoid
 475  * duplicating the us->us_next_port_to_try.
 476  */
 477 static void
 478 udp_tpi_bind(queue_t *q, mblk_t *mp)
 479 {
 480         sin_t           *sin;
 481         sin6_t          *sin6;
 482         mblk_t          *mp1;
 483         struct T_bind_req *tbr;
 484         conn_t          *connp;
 485         udp_t           *udp;
 486         int             error;
 487         struct sockaddr *sa;
 488         cred_t          *cr;
 489 
 490         /*
 491          * All Solaris components should pass a db_credp
 492          * for this TPI message, hence we ASSERT.
 493          * But in case there is some other M_PROTO that looks
 494          * like a TPI message sent by some other kernel
 495          * component, we check and return an error.
 496          */
 497         cr = msg_getcred(mp, NULL);
 498         ASSERT(cr != NULL);
 499         if (cr == NULL) {
 500                 udp_err_ack(q, mp, TSYSERR, EINVAL);
 501                 return;
 502         }
 503 
 504         connp = Q_TO_CONN(q);
 505         udp = connp->conn_udp;
 506         if ((mp->b_wptr - mp->b_rptr) < sizeof (*tbr)) {
 507                 (void) mi_strlog(q, 1, SL_ERROR|SL_TRACE,
 508                     "udp_bind: bad req, len %u",
 509                     (uint_t)(mp->b_wptr - mp->b_rptr));
 510                 udp_err_ack(q, mp, TPROTO, 0);
 511                 return;
 512         }
 513         if (udp->udp_state != TS_UNBND) {
 514                 (void) mi_strlog(q, 1, SL_ERROR|SL_TRACE,
 515                     "udp_bind: bad state, %u", udp->udp_state);
 516                 udp_err_ack(q, mp, TOUTSTATE, 0);
 517                 return;
 518         }
 519         /*
 520          * Reallocate the message to make sure we have enough room for an
 521          * address.
 522          */
 523         mp1 = reallocb(mp, sizeof (struct T_bind_ack) + sizeof (sin6_t), 1);
 524         if (mp1 == NULL) {
 525                 udp_err_ack(q, mp, TSYSERR, ENOMEM);
 526                 return;
 527         }
 528 
 529         mp = mp1;
 530 
 531         /* Reset the message type in preparation for shipping it back. */
 532         DB_TYPE(mp) = M_PCPROTO;
 533 
 534         tbr = (struct T_bind_req *)mp->b_rptr;
 535         switch (tbr->ADDR_length) {
 536         case 0:                 /* Request for a generic port */
 537                 tbr->ADDR_offset = sizeof (struct T_bind_req);
 538                 if (connp->conn_family == AF_INET) {
 539                         tbr->ADDR_length = sizeof (sin_t);
 540                         sin = (sin_t *)&tbr[1];
 541                         *sin = sin_null;
 542                         sin->sin_family = AF_INET;
 543                         mp->b_wptr = (uchar_t *)&sin[1];
 544                         sa = (struct sockaddr *)sin;
 545                 } else {
 546                         ASSERT(connp->conn_family == AF_INET6);
 547                         tbr->ADDR_length = sizeof (sin6_t);
 548                         sin6 = (sin6_t *)&tbr[1];
 549                         *sin6 = sin6_null;
 550                         sin6->sin6_family = AF_INET6;
 551                         mp->b_wptr = (uchar_t *)&sin6[1];
 552                         sa = (struct sockaddr *)sin6;
 553                 }
 554                 break;
 555 
 556         case sizeof (sin_t):    /* Complete IPv4 address */
 557                 sa = (struct sockaddr *)mi_offset_param(mp, tbr->ADDR_offset,
 558                     sizeof (sin_t));
 559                 if (sa == NULL || !OK_32PTR((char *)sa)) {
 560                         udp_err_ack(q, mp, TSYSERR, EINVAL);
 561                         return;
 562                 }
 563                 if (connp->conn_family != AF_INET ||
 564                     sa->sa_family != AF_INET) {
 565                         udp_err_ack(q, mp, TSYSERR, EAFNOSUPPORT);
 566                         return;
 567                 }
 568                 break;
 569 
 570         case sizeof (sin6_t):   /* complete IPv6 address */
 571                 sa = (struct sockaddr *)mi_offset_param(mp, tbr->ADDR_offset,
 572                     sizeof (sin6_t));
 573                 if (sa == NULL || !OK_32PTR((char *)sa)) {
 574                         udp_err_ack(q, mp, TSYSERR, EINVAL);
 575                         return;
 576                 }
 577                 if (connp->conn_family != AF_INET6 ||
 578                     sa->sa_family != AF_INET6) {
 579                         udp_err_ack(q, mp, TSYSERR, EAFNOSUPPORT);
 580                         return;
 581                 }
 582                 break;
 583 
 584         default:                /* Invalid request */
 585                 (void) mi_strlog(q, 1, SL_ERROR|SL_TRACE,
 586                     "udp_bind: bad ADDR_length length %u", tbr->ADDR_length);
 587                 udp_err_ack(q, mp, TBADADDR, 0);
 588                 return;
 589         }
 590 
 591         error = udp_do_bind(connp, sa, tbr->ADDR_length, cr,
 592             tbr->PRIM_type != O_T_BIND_REQ);
 593 
 594         if (error != 0) {
 595                 if (error > 0) {
 596                         udp_err_ack(q, mp, TSYSERR, error);
 597                 } else {
 598                         udp_err_ack(q, mp, -error, 0);
 599                 }
 600         } else {
 601                 tbr->PRIM_type = T_BIND_ACK;
 602                 qreply(q, mp);
 603         }
 604 }
 605 
 606 /*
 607  * This routine handles each T_CONN_REQ message passed to udp.  It
 608  * associates a default destination address with the stream.
 609  *
 610  * After various error checks are completed, udp_connect() lays
 611  * the target address and port into the composite header template.
 612  * Then we ask IP for information, including a source address if we didn't
 613  * already have one. Finally we send up the T_OK_ACK reply message.
 614  */
 615 static void
 616 udp_tpi_connect(queue_t *q, mblk_t *mp)
 617 {
 618         conn_t  *connp = Q_TO_CONN(q);
 619         int     error;
 620         socklen_t       len;
 621         struct sockaddr         *sa;
 622         struct T_conn_req       *tcr;
 623         cred_t          *cr;
 624         pid_t           pid;
 625         /*
 626          * All Solaris components should pass a db_credp
 627          * for this TPI message, hence we ASSERT.
 628          * But in case there is some other M_PROTO that looks
 629          * like a TPI message sent by some other kernel
 630          * component, we check and return an error.
 631          */
 632         cr = msg_getcred(mp, &pid);
 633         ASSERT(cr != NULL);
 634         if (cr == NULL) {
 635                 udp_err_ack(q, mp, TSYSERR, EINVAL);
 636                 return;
 637         }
 638 
 639         tcr = (struct T_conn_req *)mp->b_rptr;
 640 
 641         /* A bit of sanity checking */
 642         if ((mp->b_wptr - mp->b_rptr) < sizeof (struct T_conn_req)) {
 643                 udp_err_ack(q, mp, TPROTO, 0);
 644                 return;
 645         }
 646 
 647         if (tcr->OPT_length != 0) {
 648                 udp_err_ack(q, mp, TBADOPT, 0);
 649                 return;
 650         }
 651 
 652         /*
 653          * Determine packet type based on type of address passed in
 654          * the request should contain an IPv4 or IPv6 address.
 655          * Make sure that address family matches the type of
 656          * family of the address passed down.
 657          */
 658         len = tcr->DEST_length;
 659         switch (tcr->DEST_length) {
 660         default:
 661                 udp_err_ack(q, mp, TBADADDR, 0);
 662                 return;
 663 
 664         case sizeof (sin_t):
 665                 sa = (struct sockaddr *)mi_offset_param(mp, tcr->DEST_offset,
 666                     sizeof (sin_t));
 667                 break;
 668 
 669         case sizeof (sin6_t):
 670                 sa = (struct sockaddr *)mi_offset_param(mp, tcr->DEST_offset,
 671                     sizeof (sin6_t));
 672                 break;
 673         }
 674 
 675         error = proto_verify_ip_addr(connp->conn_family, sa, len);
 676         if (error != 0) {
 677                 udp_err_ack(q, mp, TSYSERR, error);
 678                 return;
 679         }
 680 
 681         error = udp_do_connect(connp, sa, len, cr, pid);
 682         if (error != 0) {
 683                 if (error < 0)
 684                         udp_err_ack(q, mp, -error, 0);
 685                 else
 686                         udp_err_ack(q, mp, TSYSERR, error);
 687         } else {
 688                 mblk_t  *mp1;
 689                 /*
 690                  * We have to send a connection confirmation to
 691                  * keep TLI happy.
 692                  */
 693                 if (connp->conn_family == AF_INET) {
 694                         mp1 = mi_tpi_conn_con(NULL, (char *)sa,
 695                             sizeof (sin_t), NULL, 0);
 696                 } else {
 697                         mp1 = mi_tpi_conn_con(NULL, (char *)sa,
 698                             sizeof (sin6_t), NULL, 0);
 699                 }
 700                 if (mp1 == NULL) {
 701                         udp_err_ack(q, mp, TSYSERR, ENOMEM);
 702                         return;
 703                 }
 704 
 705                 /*
 706                  * Send ok_ack for T_CONN_REQ
 707                  */
 708                 mp = mi_tpi_ok_ack_alloc(mp);
 709                 if (mp == NULL) {
 710                         /* Unable to reuse the T_CONN_REQ for the ack. */
 711                         udp_err_ack_prim(q, mp1, T_CONN_REQ, TSYSERR, ENOMEM);
 712                         return;
 713                 }
 714 
 715                 putnext(connp->conn_rq, mp);
 716                 putnext(connp->conn_rq, mp1);
 717         }
 718 }
 719 
 720 static int
 721 udp_tpi_close(queue_t *q, int flags)
 722 {
 723         conn_t  *connp;
 724 
 725         if (flags & SO_FALLBACK) {
 726                 /*
 727                  * stream is being closed while in fallback
 728                  * simply free the resources that were allocated
 729                  */
 730                 inet_minor_free(WR(q)->q_ptr, (dev_t)(RD(q)->q_ptr));
 731                 qprocsoff(q);
 732                 goto done;
 733         }
 734 
 735         connp = Q_TO_CONN(q);
 736         udp_do_close(connp);
 737 done:
 738         q->q_ptr = WR(q)->q_ptr = NULL;
 739         return (0);
 740 }
 741 
 742 static void
 743 udp_close_free(conn_t *connp)
 744 {
 745         udp_t *udp = connp->conn_udp;
 746 
 747         /* If there are any options associated with the stream, free them. */
 748         if (udp->udp_recv_ipp.ipp_fields != 0)
 749                 ip_pkt_free(&udp->udp_recv_ipp);
 750 
 751         /*
 752          * Clear any fields which the kmem_cache constructor clears.
 753          * Only udp_connp needs to be preserved.
 754          * TBD: We should make this more efficient to avoid clearing
 755          * everything.
 756          */
 757         ASSERT(udp->udp_connp == connp);
 758         bzero(udp, sizeof (udp_t));
 759         udp->udp_connp = connp;
 760 }
 761 
 762 static int
 763 udp_do_disconnect(conn_t *connp)
 764 {
 765         udp_t   *udp;
 766         udp_fanout_t *udpf;
 767         udp_stack_t *us;
 768         int     error;
 769 
 770         udp = connp->conn_udp;
 771         us = udp->udp_us;
 772         mutex_enter(&connp->conn_lock);
 773         if (udp->udp_state != TS_DATA_XFER) {
 774                 mutex_exit(&connp->conn_lock);
 775                 return (-TOUTSTATE);
 776         }
 777         udpf = &us->us_bind_fanout[UDP_BIND_HASH(connp->conn_lport,
 778             us->us_bind_fanout_size)];
 779         mutex_enter(&udpf->uf_lock);
 780         if (connp->conn_mcbc_bind)
 781                 connp->conn_saddr_v6 = ipv6_all_zeros;
 782         else
 783                 connp->conn_saddr_v6 = connp->conn_bound_addr_v6;
 784         connp->conn_laddr_v6 = connp->conn_bound_addr_v6;
 785         connp->conn_faddr_v6 = ipv6_all_zeros;
 786         connp->conn_fport = 0;
 787         udp->udp_state = TS_IDLE;
 788         mutex_exit(&udpf->uf_lock);
 789 
 790         /* Remove any remnants of mapped address binding */
 791         if (connp->conn_family == AF_INET6)
 792                 connp->conn_ipversion = IPV6_VERSION;
 793 
 794         connp->conn_v6lastdst = ipv6_all_zeros;
 795         error = udp_build_hdr_template(connp, &connp->conn_saddr_v6,
 796             &connp->conn_faddr_v6, connp->conn_fport, connp->conn_flowinfo);
 797         mutex_exit(&connp->conn_lock);
 798         if (error != 0)
 799                 return (error);
 800 
 801         /*
 802          * Tell IP to remove the full binding and revert
 803          * to the local address binding.
 804          */
 805         return (ip_laddr_fanout_insert(connp));
 806 }
 807 
 808 static void
 809 udp_tpi_disconnect(queue_t *q, mblk_t *mp)
 810 {
 811         conn_t  *connp = Q_TO_CONN(q);
 812         int     error;
 813 
 814         /*
 815          * Allocate the largest primitive we need to send back
 816          * T_error_ack is > than T_ok_ack
 817          */
 818         mp = reallocb(mp, sizeof (struct T_error_ack), 1);
 819         if (mp == NULL) {
 820                 /* Unable to reuse the T_DISCON_REQ for the ack. */
 821                 udp_err_ack_prim(q, mp, T_DISCON_REQ, TSYSERR, ENOMEM);
 822                 return;
 823         }
 824 
 825         error = udp_do_disconnect(connp);
 826 
 827         if (error != 0) {
 828                 if (error < 0) {
 829                         udp_err_ack(q, mp, -error, 0);
 830                 } else {
 831                         udp_err_ack(q, mp, TSYSERR, error);
 832                 }
 833         } else {
 834                 mp = mi_tpi_ok_ack_alloc(mp);
 835                 ASSERT(mp != NULL);
 836                 qreply(q, mp);
 837         }
 838 }
 839 
 840 int
 841 udp_disconnect(conn_t *connp)
 842 {
 843         int error;
 844 
 845         connp->conn_dgram_errind = B_FALSE;
 846         error = udp_do_disconnect(connp);
 847         if (error < 0)
 848                 error = proto_tlitosyserr(-error);
 849 
 850         return (error);
 851 }
 852 
 853 /* This routine creates a T_ERROR_ACK message and passes it upstream. */
 854 static void
 855 udp_err_ack(queue_t *q, mblk_t *mp, t_scalar_t t_error, int sys_error)
 856 {
 857         if ((mp = mi_tpi_err_ack_alloc(mp, t_error, sys_error)) != NULL)
 858                 qreply(q, mp);
 859 }
 860 
 861 /* Shorthand to generate and send TPI error acks to our client */
 862 static void
 863 udp_err_ack_prim(queue_t *q, mblk_t *mp, t_scalar_t primitive,
 864     t_scalar_t t_error, int sys_error)
 865 {
 866         struct T_error_ack      *teackp;
 867 
 868         if ((mp = tpi_ack_alloc(mp, sizeof (struct T_error_ack),
 869             M_PCPROTO, T_ERROR_ACK)) != NULL) {
 870                 teackp = (struct T_error_ack *)mp->b_rptr;
 871                 teackp->ERROR_prim = primitive;
 872                 teackp->TLI_error = t_error;
 873                 teackp->UNIX_error = sys_error;
 874                 qreply(q, mp);
 875         }
 876 }
 877 
 878 /* At minimum we need 4 bytes of UDP header */
 879 #define ICMP_MIN_UDP_HDR        4
 880 
 881 /*
 882  * udp_icmp_input is called as conn_recvicmp to process ICMP messages.
 883  * Generates the appropriate T_UDERROR_IND for permanent (non-transient) errors.
 884  * Assumes that IP has pulled up everything up to and including the ICMP header.
 885  */
 886 /* ARGSUSED2 */
 887 static void
 888 udp_icmp_input(void *arg1, mblk_t *mp, void *arg2, ip_recv_attr_t *ira)
 889 {
 890         conn_t          *connp = (conn_t *)arg1;
 891         icmph_t         *icmph;
 892         ipha_t          *ipha;
 893         int             iph_hdr_length;
 894         udpha_t         *udpha;
 895         sin_t           sin;
 896         sin6_t          sin6;
 897         mblk_t          *mp1;
 898         int             error = 0;
 899         udp_t           *udp = connp->conn_udp;
 900 
 901         ipha = (ipha_t *)mp->b_rptr;
 902 
 903         ASSERT(OK_32PTR(mp->b_rptr));
 904 
 905         if (IPH_HDR_VERSION(ipha) != IPV4_VERSION) {
 906                 ASSERT(IPH_HDR_VERSION(ipha) == IPV6_VERSION);
 907                 udp_icmp_error_ipv6(connp, mp, ira);
 908                 return;
 909         }
 910         ASSERT(IPH_HDR_VERSION(ipha) == IPV4_VERSION);
 911 
 912         /* Skip past the outer IP and ICMP headers */
 913         ASSERT(IPH_HDR_LENGTH(ipha) == ira->ira_ip_hdr_length);
 914         iph_hdr_length = ira->ira_ip_hdr_length;
 915         icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length];
 916         ipha = (ipha_t *)&icmph[1]; /* Inner IP header */
 917 
 918         /* Skip past the inner IP and find the ULP header */
 919         iph_hdr_length = IPH_HDR_LENGTH(ipha);
 920         udpha = (udpha_t *)((char *)ipha + iph_hdr_length);
 921 
 922         switch (icmph->icmph_type) {
 923         case ICMP_DEST_UNREACHABLE:
 924                 switch (icmph->icmph_code) {
 925                 case ICMP_FRAGMENTATION_NEEDED: {
 926                         ipha_t          *ipha;
 927                         ip_xmit_attr_t  *ixa;
 928                         /*
 929                          * IP has already adjusted the path MTU.
 930                          * But we need to adjust DF for IPv4.
 931                          */
 932                         if (connp->conn_ipversion != IPV4_VERSION)
 933                                 break;
 934 
 935                         ixa = conn_get_ixa(connp, B_FALSE);
 936                         if (ixa == NULL || ixa->ixa_ire == NULL) {
 937                                 /*
 938                                  * Some other thread holds conn_ixa. We will
 939                                  * redo this on the next ICMP too big.
 940                                  */
 941                                 if (ixa != NULL)
 942                                         ixa_refrele(ixa);
 943                                 break;
 944                         }
 945                         (void) ip_get_pmtu(ixa);
 946 
 947                         mutex_enter(&connp->conn_lock);
 948                         ipha = (ipha_t *)connp->conn_ht_iphc;
 949                         if (ixa->ixa_flags & IXAF_PMTU_IPV4_DF) {
 950                                 ipha->ipha_fragment_offset_and_flags |=
 951                                     IPH_DF_HTONS;
 952                         } else {
 953                                 ipha->ipha_fragment_offset_and_flags &=
 954                                     ~IPH_DF_HTONS;
 955                         }
 956                         mutex_exit(&connp->conn_lock);
 957                         ixa_refrele(ixa);
 958                         break;
 959                 }
 960                 case ICMP_PORT_UNREACHABLE:
 961                 case ICMP_PROTOCOL_UNREACHABLE:
 962                         error = ECONNREFUSED;
 963                         break;
 964                 default:
 965                         /* Transient errors */
 966                         break;
 967                 }
 968                 break;
 969         default:
 970                 /* Transient errors */
 971                 break;
 972         }
 973         if (error == 0) {
 974                 freemsg(mp);
 975                 return;
 976         }
 977 
 978         /*
 979          * Deliver T_UDERROR_IND when the application has asked for it.
 980          * The socket layer enables this automatically when connected.
 981          */
 982         if (!connp->conn_dgram_errind) {
 983                 freemsg(mp);
 984                 return;
 985         }
 986 
 987         switch (connp->conn_family) {
 988         case AF_INET:
 989                 sin = sin_null;
 990                 sin.sin_family = AF_INET;
 991                 sin.sin_addr.s_addr = ipha->ipha_dst;
 992                 sin.sin_port = udpha->uha_dst_port;
 993                 if (IPCL_IS_NONSTR(connp)) {
 994                         mutex_enter(&connp->conn_lock);
 995                         if (udp->udp_state == TS_DATA_XFER) {
 996                                 if (sin.sin_port == connp->conn_fport &&
 997                                     sin.sin_addr.s_addr ==
 998                                     connp->conn_faddr_v4) {
 999                                         mutex_exit(&connp->conn_lock);
1000                                         (*connp->conn_upcalls->su_set_error)
1001                                             (connp->conn_upper_handle, error);
1002                                         goto done;
1003                                 }
1004                         } else {
1005                                 udp->udp_delayed_error = error;
1006                                 *((sin_t *)&udp->udp_delayed_addr) = sin;
1007                         }
1008                         mutex_exit(&connp->conn_lock);
1009                 } else {
1010                         mp1 = mi_tpi_uderror_ind((char *)&sin, sizeof (sin_t),
1011                             NULL, 0, error);
1012                         if (mp1 != NULL)
1013                                 putnext(connp->conn_rq, mp1);
1014                 }
1015                 break;
1016         case AF_INET6:
1017                 sin6 = sin6_null;
1018                 sin6.sin6_family = AF_INET6;
1019                 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &sin6.sin6_addr);
1020                 sin6.sin6_port = udpha->uha_dst_port;
1021                 if (IPCL_IS_NONSTR(connp)) {
1022                         mutex_enter(&connp->conn_lock);
1023                         if (udp->udp_state == TS_DATA_XFER) {
1024                                 if (sin6.sin6_port == connp->conn_fport &&
1025                                     IN6_ARE_ADDR_EQUAL(&sin6.sin6_addr,
1026                                     &connp->conn_faddr_v6)) {
1027                                         mutex_exit(&connp->conn_lock);
1028                                         (*connp->conn_upcalls->su_set_error)
1029                                             (connp->conn_upper_handle, error);
1030                                         goto done;
1031                                 }
1032                         } else {
1033                                 udp->udp_delayed_error = error;
1034                                 *((sin6_t *)&udp->udp_delayed_addr) = sin6;
1035                         }
1036                         mutex_exit(&connp->conn_lock);
1037                 } else {
1038                         mp1 = mi_tpi_uderror_ind((char *)&sin6, sizeof (sin6_t),
1039                             NULL, 0, error);
1040                         if (mp1 != NULL)
1041                                 putnext(connp->conn_rq, mp1);
1042                 }
1043                 break;
1044         }
1045 done:
1046         freemsg(mp);
1047 }
1048 
1049 /*
1050  * udp_icmp_error_ipv6 is called by udp_icmp_error to process ICMP for IPv6.
1051  * Generates the appropriate T_UDERROR_IND for permanent (non-transient) errors.
1052  * Assumes that IP has pulled up all the extension headers as well as the
1053  * ICMPv6 header.
1054  */
1055 static void
1056 udp_icmp_error_ipv6(conn_t *connp, mblk_t *mp, ip_recv_attr_t *ira)
1057 {
1058         icmp6_t         *icmp6;
1059         ip6_t           *ip6h, *outer_ip6h;
1060         uint16_t        iph_hdr_length;
1061         uint8_t         *nexthdrp;
1062         udpha_t         *udpha;
1063         sin6_t          sin6;
1064         mblk_t          *mp1;
1065         int             error = 0;
1066         udp_t           *udp = connp->conn_udp;
1067         udp_stack_t     *us = udp->udp_us;
1068 
1069         outer_ip6h = (ip6_t *)mp->b_rptr;
1070 #ifdef DEBUG
1071         if (outer_ip6h->ip6_nxt != IPPROTO_ICMPV6)
1072                 iph_hdr_length = ip_hdr_length_v6(mp, outer_ip6h);
1073         else
1074                 iph_hdr_length = IPV6_HDR_LEN;
1075         ASSERT(iph_hdr_length == ira->ira_ip_hdr_length);
1076 #endif
1077         /* Skip past the outer IP and ICMP headers */
1078         iph_hdr_length = ira->ira_ip_hdr_length;
1079         icmp6 = (icmp6_t *)&mp->b_rptr[iph_hdr_length];
1080 
1081         /* Skip past the inner IP and find the ULP header */
1082         ip6h = (ip6_t *)&icmp6[1];  /* Inner IP header */
1083         if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &iph_hdr_length, &nexthdrp)) {
1084                 freemsg(mp);
1085                 return;
1086         }
1087         udpha = (udpha_t *)((char *)ip6h + iph_hdr_length);
1088 
1089         switch (icmp6->icmp6_type) {
1090         case ICMP6_DST_UNREACH:
1091                 switch (icmp6->icmp6_code) {
1092                 case ICMP6_DST_UNREACH_NOPORT:
1093                         error = ECONNREFUSED;
1094                         break;
1095                 case ICMP6_DST_UNREACH_ADMIN:
1096                 case ICMP6_DST_UNREACH_NOROUTE:
1097                 case ICMP6_DST_UNREACH_BEYONDSCOPE:
1098                 case ICMP6_DST_UNREACH_ADDR:
1099                         /* Transient errors */
1100                         break;
1101                 default:
1102                         break;
1103                 }
1104                 break;
1105         case ICMP6_PACKET_TOO_BIG: {
1106                 struct T_unitdata_ind   *tudi;
1107                 struct T_opthdr         *toh;
1108                 size_t                  udi_size;
1109                 mblk_t                  *newmp;
1110                 t_scalar_t              opt_length = sizeof (struct T_opthdr) +
1111                     sizeof (struct ip6_mtuinfo);
1112                 sin6_t                  *sin6;
1113                 struct ip6_mtuinfo      *mtuinfo;
1114 
1115                 /*
1116                  * If the application has requested to receive path mtu
1117                  * information, send up an empty message containing an
1118                  * IPV6_PATHMTU ancillary data item.
1119                  */
1120                 if (!connp->conn_ipv6_recvpathmtu)
1121                         break;
1122 
1123                 udi_size = sizeof (struct T_unitdata_ind) + sizeof (sin6_t) +
1124                     opt_length;
1125                 if ((newmp = allocb(udi_size, BPRI_MED)) == NULL) {
1126                         UDPS_BUMP_MIB(us, udpInErrors);
1127                         break;
1128                 }
1129 
1130                 /*
1131                  * newmp->b_cont is left to NULL on purpose.  This is an
1132                  * empty message containing only ancillary data.
1133                  */
1134                 newmp->b_datap->db_type = M_PROTO;
1135                 tudi = (struct T_unitdata_ind *)newmp->b_rptr;
1136                 newmp->b_wptr = (uchar_t *)tudi + udi_size;
1137                 tudi->PRIM_type = T_UNITDATA_IND;
1138                 tudi->SRC_length = sizeof (sin6_t);
1139                 tudi->SRC_offset = sizeof (struct T_unitdata_ind);
1140                 tudi->OPT_offset = tudi->SRC_offset + sizeof (sin6_t);
1141                 tudi->OPT_length = opt_length;
1142 
1143                 sin6 = (sin6_t *)&tudi[1];
1144                 bzero(sin6, sizeof (sin6_t));
1145                 sin6->sin6_family = AF_INET6;
1146                 sin6->sin6_addr = connp->conn_faddr_v6;
1147 
1148                 toh = (struct T_opthdr *)&sin6[1];
1149                 toh->level = IPPROTO_IPV6;
1150                 toh->name = IPV6_PATHMTU;
1151                 toh->len = opt_length;
1152                 toh->status = 0;
1153 
1154                 mtuinfo = (struct ip6_mtuinfo *)&toh[1];
1155                 bzero(mtuinfo, sizeof (struct ip6_mtuinfo));
1156                 mtuinfo->ip6m_addr.sin6_family = AF_INET6;
1157                 mtuinfo->ip6m_addr.sin6_addr = ip6h->ip6_dst;
1158                 mtuinfo->ip6m_mtu = icmp6->icmp6_mtu;
1159                 /*
1160                  * We've consumed everything we need from the original
1161                  * message.  Free it, then send our empty message.
1162                  */
1163                 freemsg(mp);
1164                 udp_ulp_recv(connp, newmp, msgdsize(newmp), ira);
1165                 return;
1166         }
1167         case ICMP6_TIME_EXCEEDED:
1168                 /* Transient errors */
1169                 break;
1170         case ICMP6_PARAM_PROB:
1171                 /* If this corresponds to an ICMP_PROTOCOL_UNREACHABLE */
1172                 if (icmp6->icmp6_code == ICMP6_PARAMPROB_NEXTHEADER &&
1173                     (uchar_t *)ip6h + icmp6->icmp6_pptr ==
1174                     (uchar_t *)nexthdrp) {
1175                         error = ECONNREFUSED;
1176                         break;
1177                 }
1178                 break;
1179         }
1180         if (error == 0) {
1181                 freemsg(mp);
1182                 return;
1183         }
1184 
1185         /*
1186          * Deliver T_UDERROR_IND when the application has asked for it.
1187          * The socket layer enables this automatically when connected.
1188          */
1189         if (!connp->conn_dgram_errind) {
1190                 freemsg(mp);
1191                 return;
1192         }
1193 
1194         sin6 = sin6_null;
1195         sin6.sin6_family = AF_INET6;
1196         sin6.sin6_addr = ip6h->ip6_dst;
1197         sin6.sin6_port = udpha->uha_dst_port;
1198         sin6.sin6_flowinfo = ip6h->ip6_vcf & ~IPV6_VERS_AND_FLOW_MASK;
1199 
1200         if (IPCL_IS_NONSTR(connp)) {
1201                 mutex_enter(&connp->conn_lock);
1202                 if (udp->udp_state == TS_DATA_XFER) {
1203                         if (sin6.sin6_port == connp->conn_fport &&
1204                             IN6_ARE_ADDR_EQUAL(&sin6.sin6_addr,
1205                             &connp->conn_faddr_v6)) {
1206                                 mutex_exit(&connp->conn_lock);
1207                                 (*connp->conn_upcalls->su_set_error)
1208                                     (connp->conn_upper_handle, error);
1209                                 goto done;
1210                         }
1211                 } else {
1212                         udp->udp_delayed_error = error;
1213                         *((sin6_t *)&udp->udp_delayed_addr) = sin6;
1214                 }
1215                 mutex_exit(&connp->conn_lock);
1216         } else {
1217                 mp1 = mi_tpi_uderror_ind((char *)&sin6, sizeof (sin6_t),
1218                     NULL, 0, error);
1219                 if (mp1 != NULL)
1220                         putnext(connp->conn_rq, mp1);
1221         }
1222 done:
1223         freemsg(mp);
1224 }
1225 
1226 /*
1227  * This routine responds to T_ADDR_REQ messages.  It is called by udp_wput.
1228  * The local address is filled in if endpoint is bound. The remote address
1229  * is filled in if remote address has been precified ("connected endpoint")
1230  * (The concept of connected CLTS sockets is alien to published TPI
1231  *  but we support it anyway).
1232  */
1233 static void
1234 udp_addr_req(queue_t *q, mblk_t *mp)
1235 {
1236         struct sockaddr *sa;
1237         mblk_t  *ackmp;
1238         struct T_addr_ack *taa;
1239         udp_t   *udp = Q_TO_UDP(q);
1240         conn_t  *connp = udp->udp_connp;
1241         uint_t  addrlen;
1242 
1243         /* Make it large enough for worst case */
1244         ackmp = reallocb(mp, sizeof (struct T_addr_ack) +
1245             2 * sizeof (sin6_t), 1);
1246         if (ackmp == NULL) {
1247                 udp_err_ack(q, mp, TSYSERR, ENOMEM);
1248                 return;
1249         }
1250         taa = (struct T_addr_ack *)ackmp->b_rptr;
1251 
1252         bzero(taa, sizeof (struct T_addr_ack));
1253         ackmp->b_wptr = (uchar_t *)&taa[1];
1254 
1255         taa->PRIM_type = T_ADDR_ACK;
1256         ackmp->b_datap->db_type = M_PCPROTO;
1257 
1258         if (connp->conn_family == AF_INET)
1259                 addrlen = sizeof (sin_t);
1260         else
1261                 addrlen = sizeof (sin6_t);
1262 
1263         mutex_enter(&connp->conn_lock);
1264         /*
1265          * Note: Following code assumes 32 bit alignment of basic
1266          * data structures like sin_t and struct T_addr_ack.
1267          */
1268         if (udp->udp_state != TS_UNBND) {
1269                 /*
1270                  * Fill in local address first
1271                  */
1272                 taa->LOCADDR_offset = sizeof (*taa);
1273                 taa->LOCADDR_length = addrlen;
1274                 sa = (struct sockaddr *)&taa[1];
1275                 (void) conn_getsockname(connp, sa, &addrlen);
1276                 ackmp->b_wptr += addrlen;
1277         }
1278         if (udp->udp_state == TS_DATA_XFER) {
1279                 /*
1280                  * connected, fill remote address too
1281                  */
1282                 taa->REMADDR_length = addrlen;
1283                 /* assumed 32-bit alignment */
1284                 taa->REMADDR_offset = taa->LOCADDR_offset + taa->LOCADDR_length;
1285                 sa = (struct sockaddr *)(ackmp->b_rptr + taa->REMADDR_offset);
1286                 (void) conn_getpeername(connp, sa, &addrlen);
1287                 ackmp->b_wptr += addrlen;
1288         }
1289         mutex_exit(&connp->conn_lock);
1290         ASSERT(ackmp->b_wptr <= ackmp->b_datap->db_lim);
1291         qreply(q, ackmp);
1292 }
1293 
1294 static void
1295 udp_copy_info(struct T_info_ack *tap, udp_t *udp)
1296 {
1297         conn_t          *connp = udp->udp_connp;
1298 
1299         if (connp->conn_family == AF_INET) {
1300                 *tap = udp_g_t_info_ack_ipv4;
1301         } else {
1302                 *tap = udp_g_t_info_ack_ipv6;
1303         }
1304         tap->CURRENT_state = udp->udp_state;
1305         tap->OPT_size = udp_max_optsize;
1306 }
1307 
1308 static void
1309 udp_do_capability_ack(udp_t *udp, struct T_capability_ack *tcap,
1310     t_uscalar_t cap_bits1)
1311 {
1312         tcap->CAP_bits1 = 0;
1313 
1314         if (cap_bits1 & TC1_INFO) {
1315                 udp_copy_info(&tcap->INFO_ack, udp);
1316                 tcap->CAP_bits1 |= TC1_INFO;
1317         }
1318 }
1319 
1320 /*
1321  * This routine responds to T_CAPABILITY_REQ messages.  It is called by
1322  * udp_wput.  Much of the T_CAPABILITY_ACK information is copied from
1323  * udp_g_t_info_ack.  The current state of the stream is copied from
1324  * udp_state.
1325  */
1326 static void
1327 udp_capability_req(queue_t *q, mblk_t *mp)
1328 {
1329         t_uscalar_t             cap_bits1;
1330         struct T_capability_ack *tcap;
1331         udp_t   *udp = Q_TO_UDP(q);
1332 
1333         cap_bits1 = ((struct T_capability_req *)mp->b_rptr)->CAP_bits1;
1334 
1335         mp = tpi_ack_alloc(mp, sizeof (struct T_capability_ack),
1336             mp->b_datap->db_type, T_CAPABILITY_ACK);
1337         if (!mp)
1338                 return;
1339 
1340         tcap = (struct T_capability_ack *)mp->b_rptr;
1341         udp_do_capability_ack(udp, tcap, cap_bits1);
1342 
1343         qreply(q, mp);
1344 }
1345 
1346 /*
1347  * This routine responds to T_INFO_REQ messages.  It is called by udp_wput.
1348  * Most of the T_INFO_ACK information is copied from udp_g_t_info_ack.
1349  * The current state of the stream is copied from udp_state.
1350  */
1351 static void
1352 udp_info_req(queue_t *q, mblk_t *mp)
1353 {
1354         udp_t *udp = Q_TO_UDP(q);
1355 
1356         /* Create a T_INFO_ACK message. */
1357         mp = tpi_ack_alloc(mp, sizeof (struct T_info_ack), M_PCPROTO,
1358             T_INFO_ACK);
1359         if (!mp)
1360                 return;
1361         udp_copy_info((struct T_info_ack *)mp->b_rptr, udp);
1362         qreply(q, mp);
1363 }
1364 
1365 /* For /dev/udp aka AF_INET open */
1366 static int
1367 udp_openv4(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp)
1368 {
1369         return (udp_open(q, devp, flag, sflag, credp, B_FALSE));
1370 }
1371 
1372 /* For /dev/udp6 aka AF_INET6 open */
1373 static int
1374 udp_openv6(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp)
1375 {
1376         return (udp_open(q, devp, flag, sflag, credp, B_TRUE));
1377 }
1378 
1379 /*
1380  * This is the open routine for udp.  It allocates a udp_t structure for
1381  * the stream and, on the first open of the module, creates an ND table.
1382  */
1383 static int
1384 udp_open(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp,
1385     boolean_t isv6)
1386 {
1387         udp_t           *udp;
1388         conn_t          *connp;
1389         dev_t           conn_dev;
1390         vmem_t          *minor_arena;
1391         int             err;
1392 
1393         /* If the stream is already open, return immediately. */
1394         if (q->q_ptr != NULL)
1395                 return (0);
1396 
1397         if (sflag == MODOPEN)
1398                 return (EINVAL);
1399 
1400         if ((ip_minor_arena_la != NULL) && (flag & SO_SOCKSTR) &&
1401             ((conn_dev = inet_minor_alloc(ip_minor_arena_la)) != 0)) {
1402                 minor_arena = ip_minor_arena_la;
1403         } else {
1404                 /*
1405                  * Either minor numbers in the large arena were exhausted
1406                  * or a non socket application is doing the open.
1407                  * Try to allocate from the small arena.
1408                  */
1409                 if ((conn_dev = inet_minor_alloc(ip_minor_arena_sa)) == 0)
1410                         return (EBUSY);
1411 
1412                 minor_arena = ip_minor_arena_sa;
1413         }
1414 
1415         if (flag & SO_FALLBACK) {
1416                 /*
1417                  * Non streams socket needs a stream to fallback to
1418                  */
1419                 RD(q)->q_ptr = (void *)conn_dev;
1420                 WR(q)->q_qinfo = &udp_fallback_sock_winit;
1421                 WR(q)->q_ptr = (void *)minor_arena;
1422                 qprocson(q);
1423                 return (0);
1424         }
1425 
1426         connp = udp_do_open(credp, isv6, KM_SLEEP, &err);
1427         if (connp == NULL) {
1428                 inet_minor_free(minor_arena, conn_dev);
1429                 return (err);
1430         }
1431         udp = connp->conn_udp;
1432 
1433         *devp = makedevice(getemajor(*devp), (minor_t)conn_dev);
1434         connp->conn_dev = conn_dev;
1435         connp->conn_minor_arena = minor_arena;
1436 
1437         /*
1438          * Initialize the udp_t structure for this stream.
1439          */
1440         q->q_ptr = connp;
1441         WR(q)->q_ptr = connp;
1442         connp->conn_rq = q;
1443         connp->conn_wq = WR(q);
1444 
1445         /*
1446          * Since this conn_t/udp_t is not yet visible to anybody else we don't
1447          * need to lock anything.
1448          */
1449         ASSERT(connp->conn_proto == IPPROTO_UDP);
1450         ASSERT(connp->conn_udp == udp);
1451         ASSERT(udp->udp_connp == connp);
1452 
1453         if (flag & SO_SOCKSTR) {
1454                 udp->udp_issocket = B_TRUE;
1455         }
1456 
1457         WR(q)->q_hiwat = connp->conn_sndbuf;
1458         WR(q)->q_lowat = connp->conn_sndlowat;
1459 
1460         qprocson(q);
1461 
1462         /* Set the Stream head write offset and high watermark. */
1463         (void) proto_set_tx_wroff(q, connp, connp->conn_wroff);
1464         (void) proto_set_rx_hiwat(q, connp,
1465             udp_set_rcv_hiwat(udp, connp->conn_rcvbuf));
1466 
1467         mutex_enter(&connp->conn_lock);
1468         connp->conn_state_flags &= ~CONN_INCIPIENT;
1469         mutex_exit(&connp->conn_lock);
1470         return (0);
1471 }
1472 
1473 /*
1474  * Which UDP options OK to set through T_UNITDATA_REQ...
1475  */
1476 /* ARGSUSED */
1477 static boolean_t
1478 udp_opt_allow_udr_set(t_scalar_t level, t_scalar_t name)
1479 {
1480         return (B_TRUE);
1481 }
1482 
1483 /*
1484  * This routine gets default values of certain options whose default
1485  * values are maintained by protcol specific code
1486  */
1487 int
1488 udp_opt_default(queue_t *q, t_scalar_t level, t_scalar_t name, uchar_t *ptr)
1489 {
1490         udp_t           *udp = Q_TO_UDP(q);
1491         udp_stack_t *us = udp->udp_us;
1492         int *i1 = (int *)ptr;
1493 
1494         switch (level) {
1495         case IPPROTO_IP:
1496                 switch (name) {
1497                 case IP_MULTICAST_TTL:
1498                         *ptr = (uchar_t)IP_DEFAULT_MULTICAST_TTL;
1499                         return (sizeof (uchar_t));
1500                 case IP_MULTICAST_LOOP:
1501                         *ptr = (uchar_t)IP_DEFAULT_MULTICAST_LOOP;
1502                         return (sizeof (uchar_t));
1503                 }
1504                 break;
1505         case IPPROTO_IPV6:
1506                 switch (name) {
1507                 case IPV6_MULTICAST_HOPS:
1508                         *i1 = IP_DEFAULT_MULTICAST_TTL;
1509                         return (sizeof (int));
1510                 case IPV6_MULTICAST_LOOP:
1511                         *i1 = IP_DEFAULT_MULTICAST_LOOP;
1512                         return (sizeof (int));
1513                 case IPV6_UNICAST_HOPS:
1514                         *i1 = us->us_ipv6_hoplimit;
1515                         return (sizeof (int));
1516                 }
1517                 break;
1518         }
1519         return (-1);
1520 }
1521 
1522 /*
1523  * This routine retrieves the current status of socket options.
1524  * It returns the size of the option retrieved, or -1.
1525  */
1526 int
1527 udp_opt_get(conn_t *connp, t_scalar_t level, t_scalar_t name,
1528     uchar_t *ptr)
1529 {
1530         int             *i1 = (int *)ptr;
1531         udp_t           *udp = connp->conn_udp;
1532         int             len;
1533         conn_opt_arg_t  coas;
1534         int             retval;
1535 
1536         coas.coa_connp = connp;
1537         coas.coa_ixa = connp->conn_ixa;
1538         coas.coa_ipp = &connp->conn_xmit_ipp;
1539         coas.coa_ancillary = B_FALSE;
1540         coas.coa_changed = 0;
1541 
1542         /*
1543          * We assume that the optcom framework has checked for the set
1544          * of levels and names that are supported, hence we don't worry
1545          * about rejecting based on that.
1546          * First check for UDP specific handling, then pass to common routine.
1547          */
1548         switch (level) {
1549         case IPPROTO_IP:
1550                 /*
1551                  * Only allow IPv4 option processing on IPv4 sockets.
1552                  */
1553                 if (connp->conn_family != AF_INET)
1554                         return (-1);
1555 
1556                 switch (name) {
1557                 case IP_OPTIONS:
1558                 case T_IP_OPTIONS:
1559                         mutex_enter(&connp->conn_lock);
1560                         if (!(udp->udp_recv_ipp.ipp_fields &
1561                             IPPF_IPV4_OPTIONS)) {
1562                                 mutex_exit(&connp->conn_lock);
1563                                 return (0);
1564                         }
1565 
1566                         len = udp->udp_recv_ipp.ipp_ipv4_options_len;
1567                         ASSERT(len != 0);
1568                         bcopy(udp->udp_recv_ipp.ipp_ipv4_options, ptr, len);
1569                         mutex_exit(&connp->conn_lock);
1570                         return (len);
1571                 }
1572                 break;
1573         case IPPROTO_UDP:
1574                 switch (name) {
1575                 case UDP_NAT_T_ENDPOINT:
1576                         mutex_enter(&connp->conn_lock);
1577                         *i1 = udp->udp_nat_t_endpoint;
1578                         mutex_exit(&connp->conn_lock);
1579                         return (sizeof (int));
1580                 case UDP_RCVHDR:
1581                         mutex_enter(&connp->conn_lock);
1582                         *i1 = udp->udp_rcvhdr ? 1 : 0;
1583                         mutex_exit(&connp->conn_lock);
1584                         return (sizeof (int));
1585                 }
1586         }
1587         mutex_enter(&connp->conn_lock);
1588         retval = conn_opt_get(&coas, level, name, ptr);
1589         mutex_exit(&connp->conn_lock);
1590         return (retval);
1591 }
1592 
1593 /*
1594  * This routine retrieves the current status of socket options.
1595  * It returns the size of the option retrieved, or -1.
1596  */
1597 int
1598 udp_tpi_opt_get(queue_t *q, t_scalar_t level, t_scalar_t name, uchar_t *ptr)
1599 {
1600         conn_t          *connp = Q_TO_CONN(q);
1601         int             err;
1602 
1603         err = udp_opt_get(connp, level, name, ptr);
1604         return (err);
1605 }
1606 
1607 /*
1608  * This routine sets socket options.
1609  */
1610 int
1611 udp_do_opt_set(conn_opt_arg_t *coa, int level, int name,
1612     uint_t inlen, uchar_t *invalp, cred_t *cr, boolean_t checkonly)
1613 {
1614         conn_t          *connp = coa->coa_connp;
1615         ip_xmit_attr_t  *ixa = coa->coa_ixa;
1616         udp_t           *udp = connp->conn_udp;
1617         udp_stack_t     *us = udp->udp_us;
1618         int             *i1 = (int *)invalp;
1619         boolean_t       onoff = (*i1 == 0) ? 0 : 1;
1620         int             error;
1621 
1622         ASSERT(MUTEX_NOT_HELD(&coa->coa_connp->conn_lock));
1623         /*
1624          * First do UDP specific sanity checks and handle UDP specific
1625          * options. Note that some IPPROTO_UDP options are handled
1626          * by conn_opt_set.
1627          */
1628         switch (level) {
1629         case SOL_SOCKET:
1630                 switch (name) {
1631                 case SO_SNDBUF:
1632                         if (*i1 > us->us_max_buf) {
1633                                 return (ENOBUFS);
1634                         }
1635                         break;
1636                 case SO_RCVBUF:
1637                         if (*i1 > us->us_max_buf) {
1638                                 return (ENOBUFS);
1639                         }
1640                         break;
1641 
1642                 case SCM_UCRED: {
1643                         struct ucred_s *ucr;
1644                         cred_t *newcr;
1645                         ts_label_t *tsl;
1646 
1647                         /*
1648                          * Only sockets that have proper privileges and are
1649                          * bound to MLPs will have any other value here, so
1650                          * this implicitly tests for privilege to set label.
1651                          */
1652                         if (connp->conn_mlp_type == mlptSingle)
1653                                 break;
1654 
1655                         ucr = (struct ucred_s *)invalp;
1656                         if (inlen < sizeof (*ucr) + sizeof (bslabel_t) ||
1657                             ucr->uc_labeloff < sizeof (*ucr) ||
1658                             ucr->uc_labeloff + sizeof (bslabel_t) > inlen)
1659                                 return (EINVAL);
1660                         if (!checkonly) {
1661                                 /*
1662                                  * Set ixa_tsl to the new label.
1663                                  * We assume that crgetzoneid doesn't change
1664                                  * as part of the SCM_UCRED.
1665                                  */
1666                                 ASSERT(cr != NULL);
1667                                 if ((tsl = crgetlabel(cr)) == NULL)
1668                                         return (EINVAL);
1669                                 newcr = copycred_from_bslabel(cr, UCLABEL(ucr),
1670                                     tsl->tsl_doi, KM_NOSLEEP);
1671                                 if (newcr == NULL)
1672                                         return (ENOSR);
1673                                 ASSERT(newcr->cr_label != NULL);
1674                                 /*
1675                                  * Move the hold on the cr_label to ixa_tsl by
1676                                  * setting cr_label to NULL. Then release newcr.
1677                                  */
1678                                 ip_xmit_attr_replace_tsl(ixa, newcr->cr_label);
1679                                 ixa->ixa_flags |= IXAF_UCRED_TSL;
1680                                 newcr->cr_label = NULL;
1681                                 crfree(newcr);
1682                                 coa->coa_changed |= COA_HEADER_CHANGED;
1683                                 coa->coa_changed |= COA_WROFF_CHANGED;
1684                         }
1685                         /* Fully handled this option. */
1686                         return (0);
1687                 }
1688                 }
1689                 break;
1690         case IPPROTO_UDP:
1691                 switch (name) {
1692                 case UDP_NAT_T_ENDPOINT:
1693                         if ((error = secpolicy_ip_config(cr, B_FALSE)) != 0) {
1694                                 return (error);
1695                         }
1696 
1697                         /*
1698                          * Use conn_family instead so we can avoid ambiguitites
1699                          * with AF_INET6 sockets that may switch from IPv4
1700                          * to IPv6.
1701                          */
1702                         if (connp->conn_family != AF_INET) {
1703                                 return (EAFNOSUPPORT);
1704                         }
1705 
1706                         if (!checkonly) {
1707                                 mutex_enter(&connp->conn_lock);
1708                                 udp->udp_nat_t_endpoint = onoff;
1709                                 mutex_exit(&connp->conn_lock);
1710                                 coa->coa_changed |= COA_HEADER_CHANGED;
1711                                 coa->coa_changed |= COA_WROFF_CHANGED;
1712                         }
1713                         /* Fully handled this option. */
1714                         return (0);
1715                 case UDP_RCVHDR:
1716                         mutex_enter(&connp->conn_lock);
1717                         udp->udp_rcvhdr = onoff;
1718                         mutex_exit(&connp->conn_lock);
1719                         return (0);
1720                 }
1721                 break;
1722         }
1723         error = conn_opt_set(coa, level, name, inlen, invalp,
1724             checkonly, cr);
1725         return (error);
1726 }
1727 
1728 /*
1729  * This routine sets socket options.
1730  */
1731 int
1732 udp_opt_set(conn_t *connp, uint_t optset_context, int level,
1733     int name, uint_t inlen, uchar_t *invalp, uint_t *outlenp,
1734     uchar_t *outvalp, void *thisdg_attrs, cred_t *cr)
1735 {
1736         udp_t           *udp = connp->conn_udp;
1737         int             err;
1738         conn_opt_arg_t  coas, *coa;
1739         boolean_t       checkonly;
1740         udp_stack_t     *us = udp->udp_us;
1741 
1742         switch (optset_context) {
1743         case SETFN_OPTCOM_CHECKONLY:
1744                 checkonly = B_TRUE;
1745                 /*
1746                  * Note: Implies T_CHECK semantics for T_OPTCOM_REQ
1747                  * inlen != 0 implies value supplied and
1748                  *      we have to "pretend" to set it.
1749                  * inlen == 0 implies that there is no
1750                  *      value part in T_CHECK request and just validation
1751                  * done elsewhere should be enough, we just return here.
1752                  */
1753                 if (inlen == 0) {
1754                         *outlenp = 0;
1755                         return (0);
1756                 }
1757                 break;
1758         case SETFN_OPTCOM_NEGOTIATE:
1759                 checkonly = B_FALSE;
1760                 break;
1761         case SETFN_UD_NEGOTIATE:
1762         case SETFN_CONN_NEGOTIATE:
1763                 checkonly = B_FALSE;
1764                 /*
1765                  * Negotiating local and "association-related" options
1766                  * through T_UNITDATA_REQ.
1767                  *
1768                  * Following routine can filter out ones we do not
1769                  * want to be "set" this way.
1770                  */
1771                 if (!udp_opt_allow_udr_set(level, name)) {
1772                         *outlenp = 0;
1773                         return (EINVAL);
1774                 }
1775                 break;
1776         default:
1777                 /*
1778                  * We should never get here
1779                  */
1780                 *outlenp = 0;
1781                 return (EINVAL);
1782         }
1783 
1784         ASSERT((optset_context != SETFN_OPTCOM_CHECKONLY) ||
1785             (optset_context == SETFN_OPTCOM_CHECKONLY && inlen != 0));
1786 
1787         if (thisdg_attrs != NULL) {
1788                 /* Options from T_UNITDATA_REQ */
1789                 coa = (conn_opt_arg_t *)thisdg_attrs;
1790                 ASSERT(coa->coa_connp == connp);
1791                 ASSERT(coa->coa_ixa != NULL);
1792                 ASSERT(coa->coa_ipp != NULL);
1793                 ASSERT(coa->coa_ancillary);
1794         } else {
1795                 coa = &coas;
1796                 coas.coa_connp = connp;
1797                 /* Get a reference on conn_ixa to prevent concurrent mods */
1798                 coas.coa_ixa = conn_get_ixa(connp, B_TRUE);
1799                 if (coas.coa_ixa == NULL) {
1800                         *outlenp = 0;
1801                         return (ENOMEM);
1802                 }
1803                 coas.coa_ipp = &connp->conn_xmit_ipp;
1804                 coas.coa_ancillary = B_FALSE;
1805                 coas.coa_changed = 0;
1806         }
1807 
1808         err = udp_do_opt_set(coa, level, name, inlen, invalp,
1809             cr, checkonly);
1810         if (err != 0) {
1811 errout:
1812                 if (!coa->coa_ancillary)
1813                         ixa_refrele(coa->coa_ixa);
1814                 *outlenp = 0;
1815                 return (err);
1816         }
1817         /* Handle DHCPINIT here outside of lock */
1818         if (level == IPPROTO_IP && name == IP_DHCPINIT_IF) {
1819                 uint_t  ifindex;
1820                 ill_t   *ill;
1821 
1822                 ifindex = *(uint_t *)invalp;
1823                 if (ifindex == 0) {
1824                         ill = NULL;
1825                 } else {
1826                         ill = ill_lookup_on_ifindex(ifindex, B_FALSE,
1827                             coa->coa_ixa->ixa_ipst);
1828                         if (ill == NULL) {
1829                                 err = ENXIO;
1830                                 goto errout;
1831                         }
1832 
1833                         mutex_enter(&ill->ill_lock);
1834                         if (ill->ill_state_flags & ILL_CONDEMNED) {
1835                                 mutex_exit(&ill->ill_lock);
1836                                 ill_refrele(ill);
1837                                 err = ENXIO;
1838                                 goto errout;
1839                         }
1840                         if (IS_VNI(ill)) {
1841                                 mutex_exit(&ill->ill_lock);
1842                                 ill_refrele(ill);
1843                                 err = EINVAL;
1844                                 goto errout;
1845                         }
1846                 }
1847                 mutex_enter(&connp->conn_lock);
1848 
1849                 if (connp->conn_dhcpinit_ill != NULL) {
1850                         /*
1851                          * We've locked the conn so conn_cleanup_ill()
1852                          * cannot clear conn_dhcpinit_ill -- so it's
1853                          * safe to access the ill.
1854                          */
1855                         ill_t *oill = connp->conn_dhcpinit_ill;
1856 
1857                         ASSERT(oill->ill_dhcpinit != 0);
1858                         atomic_dec_32(&oill->ill_dhcpinit);
1859                         ill_set_inputfn(connp->conn_dhcpinit_ill);
1860                         connp->conn_dhcpinit_ill = NULL;
1861                 }
1862 
1863                 if (ill != NULL) {
1864                         connp->conn_dhcpinit_ill = ill;
1865                         atomic_inc_32(&ill->ill_dhcpinit);
1866                         ill_set_inputfn(ill);
1867                         mutex_exit(&connp->conn_lock);
1868                         mutex_exit(&ill->ill_lock);
1869                         ill_refrele(ill);
1870                 } else {
1871                         mutex_exit(&connp->conn_lock);
1872                 }
1873         }
1874 
1875         /*
1876          * Common case of OK return with outval same as inval.
1877          */
1878         if (invalp != outvalp) {
1879                 /* don't trust bcopy for identical src/dst */
1880                 (void) bcopy(invalp, outvalp, inlen);
1881         }
1882         *outlenp = inlen;
1883 
1884         /*
1885          * If this was not ancillary data, then we rebuild the headers,
1886          * update the IRE/NCE, and IPsec as needed.
1887          * Since the label depends on the destination we go through
1888          * ip_set_destination first.
1889          */
1890         if (coa->coa_ancillary) {
1891                 return (0);
1892         }
1893 
1894         if (coa->coa_changed & COA_ROUTE_CHANGED) {
1895                 in6_addr_t saddr, faddr, nexthop;
1896                 in_port_t fport;
1897 
1898                 /*
1899                  * We clear lastdst to make sure we pick up the change
1900                  * next time sending.
1901                  * If we are connected we re-cache the information.
1902                  * We ignore errors to preserve BSD behavior.
1903                  * Note that we don't redo IPsec policy lookup here
1904                  * since the final destination (or source) didn't change.
1905                  */
1906                 mutex_enter(&connp->conn_lock);
1907                 connp->conn_v6lastdst = ipv6_all_zeros;
1908 
1909                 ip_attr_nexthop(coa->coa_ipp, coa->coa_ixa,
1910                     &connp->conn_faddr_v6, &nexthop);
1911                 saddr = connp->conn_saddr_v6;
1912                 faddr = connp->conn_faddr_v6;
1913                 fport = connp->conn_fport;
1914                 mutex_exit(&connp->conn_lock);
1915 
1916                 if (!IN6_IS_ADDR_UNSPECIFIED(&faddr) &&
1917                     !IN6_IS_ADDR_V4MAPPED_ANY(&faddr)) {
1918                         (void) ip_attr_connect(connp, coa->coa_ixa,
1919                             &saddr, &faddr, &nexthop, fport, NULL, NULL,
1920                             IPDF_ALLOW_MCBC | IPDF_VERIFY_DST);
1921                 }
1922         }
1923 
1924         ixa_refrele(coa->coa_ixa);
1925 
1926         if (coa->coa_changed & COA_HEADER_CHANGED) {
1927                 /*
1928                  * Rebuild the header template if we are connected.
1929                  * Otherwise clear conn_v6lastdst so we rebuild the header
1930                  * in the data path.
1931                  */
1932                 mutex_enter(&connp->conn_lock);
1933                 if (!IN6_IS_ADDR_UNSPECIFIED(&connp->conn_faddr_v6) &&
1934                     !IN6_IS_ADDR_V4MAPPED_ANY(&connp->conn_faddr_v6)) {
1935                         err = udp_build_hdr_template(connp,
1936                             &connp->conn_saddr_v6, &connp->conn_faddr_v6,
1937                             connp->conn_fport, connp->conn_flowinfo);
1938                         if (err != 0) {
1939                                 mutex_exit(&connp->conn_lock);
1940                                 return (err);
1941                         }
1942                 } else {
1943                         connp->conn_v6lastdst = ipv6_all_zeros;
1944                 }
1945                 mutex_exit(&connp->conn_lock);
1946         }
1947         if (coa->coa_changed & COA_RCVBUF_CHANGED) {
1948                 (void) proto_set_rx_hiwat(connp->conn_rq, connp,
1949                     connp->conn_rcvbuf);
1950         }
1951         if ((coa->coa_changed & COA_SNDBUF_CHANGED) && !IPCL_IS_NONSTR(connp)) {
1952                 connp->conn_wq->q_hiwat = connp->conn_sndbuf;
1953         }
1954         if (coa->coa_changed & COA_WROFF_CHANGED) {
1955                 /* Increase wroff if needed */
1956                 uint_t wroff;
1957 
1958                 mutex_enter(&connp->conn_lock);
1959                 wroff = connp->conn_ht_iphc_allocated + us->us_wroff_extra;
1960                 if (udp->udp_nat_t_endpoint)
1961                         wroff += sizeof (uint32_t);
1962                 if (wroff > connp->conn_wroff) {
1963                         connp->conn_wroff = wroff;
1964                         mutex_exit(&connp->conn_lock);
1965                         (void) proto_set_tx_wroff(connp->conn_rq, connp, wroff);
1966                 } else {
1967                         mutex_exit(&connp->conn_lock);
1968                 }
1969         }
1970         return (err);
1971 }
1972 
1973 /* This routine sets socket options. */
1974 int
1975 udp_tpi_opt_set(queue_t *q, uint_t optset_context, int level, int name,
1976     uint_t inlen, uchar_t *invalp, uint_t *outlenp, uchar_t *outvalp,
1977     void *thisdg_attrs, cred_t *cr)
1978 {
1979         conn_t  *connp = Q_TO_CONN(q);
1980         int error;
1981 
1982         error = udp_opt_set(connp, optset_context, level, name, inlen, invalp,
1983             outlenp, outvalp, thisdg_attrs, cr);
1984         return (error);
1985 }
1986 
1987 /*
1988  * Setup IP and UDP headers.
1989  * Returns NULL on allocation failure, in which case data_mp is freed.
1990  */
1991 mblk_t *
1992 udp_prepend_hdr(conn_t *connp, ip_xmit_attr_t *ixa, const ip_pkt_t *ipp,
1993     const in6_addr_t *v6src, const in6_addr_t *v6dst, in_port_t dstport,
1994     uint32_t flowinfo, mblk_t *data_mp, int *errorp)
1995 {
1996         mblk_t          *mp;
1997         udpha_t         *udpha;
1998         udp_stack_t     *us = connp->conn_netstack->netstack_udp;
1999         uint_t          data_len;
2000         uint32_t        cksum;
2001         udp_t           *udp = connp->conn_udp;
2002         boolean_t       insert_spi = udp->udp_nat_t_endpoint;
2003         uint_t          ulp_hdr_len;
2004 
2005         data_len = msgdsize(data_mp);
2006         ulp_hdr_len = UDPH_SIZE;
2007         if (insert_spi)
2008                 ulp_hdr_len += sizeof (uint32_t);
2009 
2010         mp = conn_prepend_hdr(ixa, ipp, v6src, v6dst, IPPROTO_UDP, flowinfo,
2011             ulp_hdr_len, data_mp, data_len, us->us_wroff_extra, &cksum, errorp);
2012         if (mp == NULL) {
2013                 ASSERT(*errorp != 0);
2014                 return (NULL);
2015         }
2016 
2017         data_len += ulp_hdr_len;
2018         ixa->ixa_pktlen = data_len + ixa->ixa_ip_hdr_length;
2019 
2020         udpha = (udpha_t *)(mp->b_rptr + ixa->ixa_ip_hdr_length);
2021         udpha->uha_src_port = connp->conn_lport;
2022         udpha->uha_dst_port = dstport;
2023         udpha->uha_checksum = 0;
2024         udpha->uha_length = htons(data_len);
2025 
2026         /*
2027          * If there was a routing option/header then conn_prepend_hdr
2028          * has massaged it and placed the pseudo-header checksum difference
2029          * in the cksum argument.
2030          *
2031          * Setup header length and prepare for ULP checksum done in IP.
2032          *
2033          * We make it easy for IP to include our pseudo header
2034          * by putting our length in uha_checksum.
2035          * The IP source, destination, and length have already been set by
2036          * conn_prepend_hdr.
2037          */
2038         cksum += data_len;
2039         cksum = (cksum >> 16) + (cksum & 0xFFFF);
2040         ASSERT(cksum < 0x10000);
2041 
2042         if (ixa->ixa_flags & IXAF_IS_IPV4) {
2043                 ipha_t  *ipha = (ipha_t *)mp->b_rptr;
2044 
2045                 ASSERT(ntohs(ipha->ipha_length) == ixa->ixa_pktlen);
2046 
2047                 /* IP does the checksum if uha_checksum is non-zero */
2048                 if (us->us_do_checksum) {
2049                         if (cksum == 0)
2050                                 udpha->uha_checksum = 0xffff;
2051                         else
2052                                 udpha->uha_checksum = htons(cksum);
2053                 } else {
2054                         udpha->uha_checksum = 0;
2055                 }
2056         } else {
2057                 ip6_t *ip6h = (ip6_t *)mp->b_rptr;
2058 
2059                 ASSERT(ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN == ixa->ixa_pktlen);
2060                 if (cksum == 0)
2061                         udpha->uha_checksum = 0xffff;
2062                 else
2063                         udpha->uha_checksum = htons(cksum);
2064         }
2065 
2066         /* Insert all-0s SPI now. */
2067         if (insert_spi)
2068                 *((uint32_t *)(udpha + 1)) = 0;
2069 
2070         return (mp);
2071 }
2072 
2073 static int
2074 udp_build_hdr_template(conn_t *connp, const in6_addr_t *v6src,
2075     const in6_addr_t *v6dst, in_port_t dstport, uint32_t flowinfo)
2076 {
2077         udpha_t         *udpha;
2078         int             error;
2079 
2080         ASSERT(MUTEX_HELD(&connp->conn_lock));
2081         /*
2082          * We clear lastdst to make sure we don't use the lastdst path
2083          * next time sending since we might not have set v6dst yet.
2084          */
2085         connp->conn_v6lastdst = ipv6_all_zeros;
2086 
2087         error = conn_build_hdr_template(connp, UDPH_SIZE, 0, v6src, v6dst,
2088             flowinfo);
2089         if (error != 0)
2090                 return (error);
2091 
2092         /*
2093          * Any routing header/option has been massaged. The checksum difference
2094          * is stored in conn_sum.
2095          */
2096         udpha = (udpha_t *)connp->conn_ht_ulp;
2097         udpha->uha_src_port = connp->conn_lport;
2098         udpha->uha_dst_port = dstport;
2099         udpha->uha_checksum = 0;
2100         udpha->uha_length = htons(UDPH_SIZE);        /* Filled in later */
2101         return (0);
2102 }
2103 
2104 static mblk_t *
2105 udp_queue_fallback(udp_t *udp, mblk_t *mp)
2106 {
2107         ASSERT(MUTEX_HELD(&udp->udp_recv_lock));
2108         if (IPCL_IS_NONSTR(udp->udp_connp)) {
2109                 /*
2110                  * fallback has started but messages have not been moved yet
2111                  */
2112                 if (udp->udp_fallback_queue_head == NULL) {
2113                         ASSERT(udp->udp_fallback_queue_tail == NULL);
2114                         udp->udp_fallback_queue_head = mp;
2115                         udp->udp_fallback_queue_tail = mp;
2116                 } else {
2117                         ASSERT(udp->udp_fallback_queue_tail != NULL);
2118                         udp->udp_fallback_queue_tail->b_next = mp;
2119                         udp->udp_fallback_queue_tail = mp;
2120                 }
2121                 return (NULL);
2122         } else {
2123                 /*
2124                  * Fallback completed, let the caller putnext() the mblk.
2125                  */
2126                 return (mp);
2127         }
2128 }
2129 
2130 /*
2131  * Deliver data to ULP. In case we have a socket, and it's falling back to
2132  * TPI, then we'll queue the mp for later processing.
2133  */
2134 static void
2135 udp_ulp_recv(conn_t *connp, mblk_t *mp, uint_t len, ip_recv_attr_t *ira)
2136 {
2137         if (IPCL_IS_NONSTR(connp)) {
2138                 udp_t *udp = connp->conn_udp;
2139                 int error;
2140 
2141                 ASSERT(len == msgdsize(mp));
2142                 if ((*connp->conn_upcalls->su_recv)
2143                     (connp->conn_upper_handle, mp, len, 0, &error, NULL) < 0) {
2144                         mutex_enter(&udp->udp_recv_lock);
2145                         if (error == ENOSPC) {
2146                                 /*
2147                                  * let's confirm while holding the lock
2148                                  */
2149                                 if ((*connp->conn_upcalls->su_recv)
2150                                     (connp->conn_upper_handle, NULL, 0, 0,
2151                                     &error, NULL) < 0) {
2152                                         ASSERT(error == ENOSPC);
2153                                         if (error == ENOSPC) {
2154                                                 connp->conn_flow_cntrld =
2155                                                     B_TRUE;
2156                                         }
2157                                 }
2158                                 mutex_exit(&udp->udp_recv_lock);
2159                         } else {
2160                                 ASSERT(error == EOPNOTSUPP);
2161                                 mp = udp_queue_fallback(udp, mp);
2162                                 mutex_exit(&udp->udp_recv_lock);
2163                                 if (mp != NULL)
2164                                         putnext(connp->conn_rq, mp);
2165                         }
2166                 }
2167                 ASSERT(MUTEX_NOT_HELD(&udp->udp_recv_lock));
2168         } else {
2169                 if (is_system_labeled()) {
2170                         ASSERT(ira->ira_cred != NULL);
2171                         /*
2172                          * Provide for protocols above UDP such as RPC
2173                          * NOPID leaves db_cpid unchanged.
2174                          */
2175                         mblk_setcred(mp, ira->ira_cred, NOPID);
2176                 }
2177 
2178                 putnext(connp->conn_rq, mp);
2179         }
2180 }
2181 
2182 /*
2183  * This is the inbound data path.
2184  * IP has already pulled up the IP plus UDP headers and verified alignment
2185  * etc.
2186  */
2187 /* ARGSUSED2 */
2188 static void
2189 udp_input(void *arg1, mblk_t *mp, void *arg2, ip_recv_attr_t *ira)
2190 {
2191         conn_t                  *connp = (conn_t *)arg1;
2192         struct T_unitdata_ind   *tudi;
2193         uchar_t                 *rptr;          /* Pointer to IP header */
2194         int                     hdr_length;     /* Length of IP+UDP headers */
2195         int                     udi_size;       /* Size of T_unitdata_ind */
2196         int                     pkt_len;
2197         udp_t                   *udp;
2198         udpha_t                 *udpha;
2199         ip_pkt_t                ipps;
2200         ip6_t                   *ip6h;
2201         mblk_t                  *mp1;
2202         uint32_t                udp_ipv4_options_len;
2203         crb_t                   recv_ancillary;
2204         udp_stack_t             *us;
2205 
2206         ASSERT(connp->conn_flags & IPCL_UDPCONN);
2207 
2208         udp = connp->conn_udp;
2209         us = udp->udp_us;
2210         rptr = mp->b_rptr;
2211 
2212         ASSERT(DB_TYPE(mp) == M_DATA);
2213         ASSERT(OK_32PTR(rptr));
2214         ASSERT(ira->ira_pktlen == msgdsize(mp));
2215         pkt_len = ira->ira_pktlen;
2216 
2217         /*
2218          * Get a snapshot of these and allow other threads to change
2219          * them after that. We need the same recv_ancillary when determining
2220          * the size as when adding the ancillary data items.
2221          */
2222         mutex_enter(&connp->conn_lock);
2223         udp_ipv4_options_len = udp->udp_recv_ipp.ipp_ipv4_options_len;
2224         recv_ancillary = connp->conn_recv_ancillary;
2225         mutex_exit(&connp->conn_lock);
2226 
2227         hdr_length = ira->ira_ip_hdr_length;
2228 
2229         /*
2230          * IP inspected the UDP header thus all of it must be in the mblk.
2231          * UDP length check is performed for IPv6 packets and IPv4 packets
2232          * to check if the size of the packet as specified
2233          * by the UDP header is the same as the length derived from the IP
2234          * header.
2235          */
2236         udpha = (udpha_t *)(rptr + hdr_length);
2237         if (pkt_len != ntohs(udpha->uha_length) + hdr_length)
2238                 goto tossit;
2239 
2240         hdr_length += UDPH_SIZE;
2241         ASSERT(MBLKL(mp) >= hdr_length);     /* IP did a pullup */
2242 
2243         /* Initialize regardless of IP version */
2244         ipps.ipp_fields = 0;
2245 
2246         if (((ira->ira_flags & IRAF_IPV4_OPTIONS) ||
2247             udp_ipv4_options_len > 0) &&
2248             connp->conn_family == AF_INET) {
2249                 int     err;
2250 
2251                 /*
2252                  * Record/update udp_recv_ipp with the lock
2253                  * held. Not needed for AF_INET6 sockets
2254                  * since they don't support a getsockopt of IP_OPTIONS.
2255                  */
2256                 mutex_enter(&connp->conn_lock);
2257                 err = ip_find_hdr_v4((ipha_t *)rptr, &udp->udp_recv_ipp,
2258                     B_TRUE);
2259                 if (err != 0) {
2260                         /* Allocation failed. Drop packet */
2261                         mutex_exit(&connp->conn_lock);
2262                         freemsg(mp);
2263                         UDPS_BUMP_MIB(us, udpInErrors);
2264                         return;
2265                 }
2266                 mutex_exit(&connp->conn_lock);
2267         }
2268 
2269         if (recv_ancillary.crb_all != 0) {
2270                 /*
2271                  * Record packet information in the ip_pkt_t
2272                  */
2273                 if (ira->ira_flags & IRAF_IS_IPV4) {
2274                         ASSERT(IPH_HDR_VERSION(rptr) == IPV4_VERSION);
2275                         ASSERT(MBLKL(mp) >= sizeof (ipha_t));
2276                         ASSERT(((ipha_t *)rptr)->ipha_protocol == IPPROTO_UDP);
2277                         ASSERT(ira->ira_ip_hdr_length == IPH_HDR_LENGTH(rptr));
2278 
2279                         (void) ip_find_hdr_v4((ipha_t *)rptr, &ipps, B_FALSE);
2280                 } else {
2281                         uint8_t nexthdrp;
2282 
2283                         ASSERT(IPH_HDR_VERSION(rptr) == IPV6_VERSION);
2284                         /*
2285                          * IPv6 packets can only be received by applications
2286                          * that are prepared to receive IPv6 addresses.
2287                          * The IP fanout must ensure this.
2288                          */
2289                         ASSERT(connp->conn_family == AF_INET6);
2290 
2291                         ip6h = (ip6_t *)rptr;
2292 
2293                         /* We don't care about the length, but need the ipp */
2294                         hdr_length = ip_find_hdr_v6(mp, ip6h, B_TRUE, &ipps,
2295                             &nexthdrp);
2296                         ASSERT(hdr_length == ira->ira_ip_hdr_length);
2297                         /* Restore */
2298                         hdr_length = ira->ira_ip_hdr_length + UDPH_SIZE;
2299                         ASSERT(nexthdrp == IPPROTO_UDP);
2300                 }
2301         }
2302 
2303         /*
2304          * This is the inbound data path.  Packets are passed upstream as
2305          * T_UNITDATA_IND messages.
2306          */
2307         if (connp->conn_family == AF_INET) {
2308                 sin_t *sin;
2309 
2310                 ASSERT(IPH_HDR_VERSION((ipha_t *)rptr) == IPV4_VERSION);
2311 
2312                 /*
2313                  * Normally only send up the source address.
2314                  * If any ancillary data items are wanted we add those.
2315                  */
2316                 udi_size = sizeof (struct T_unitdata_ind) + sizeof (sin_t);
2317                 if (recv_ancillary.crb_all != 0) {
2318                         udi_size += conn_recvancillary_size(connp,
2319                             recv_ancillary, ira, mp, &ipps);
2320                 }
2321 
2322                 /* Allocate a message block for the T_UNITDATA_IND structure. */
2323                 mp1 = allocb(udi_size, BPRI_MED);
2324                 if (mp1 == NULL) {
2325                         freemsg(mp);
2326                         UDPS_BUMP_MIB(us, udpInErrors);
2327                         return;
2328                 }
2329                 mp1->b_cont = mp;
2330                 mp1->b_datap->db_type = M_PROTO;
2331                 tudi = (struct T_unitdata_ind *)mp1->b_rptr;
2332                 mp1->b_wptr = (uchar_t *)tudi + udi_size;
2333                 tudi->PRIM_type = T_UNITDATA_IND;
2334                 tudi->SRC_length = sizeof (sin_t);
2335                 tudi->SRC_offset = sizeof (struct T_unitdata_ind);
2336                 tudi->OPT_offset = sizeof (struct T_unitdata_ind) +
2337                     sizeof (sin_t);
2338                 udi_size -= (sizeof (struct T_unitdata_ind) + sizeof (sin_t));
2339                 tudi->OPT_length = udi_size;
2340                 sin = (sin_t *)&tudi[1];
2341                 sin->sin_addr.s_addr = ((ipha_t *)rptr)->ipha_src;
2342                 sin->sin_port =      udpha->uha_src_port;
2343                 sin->sin_family = connp->conn_family;
2344                 *(uint32_t *)&sin->sin_zero[0] = 0;
2345                 *(uint32_t *)&sin->sin_zero[4] = 0;
2346 
2347                 /*
2348                  * Add options if IP_RECVDSTADDR, IP_RECVIF, IP_RECVSLLA or
2349                  * IP_RECVTTL has been set.
2350                  */
2351                 if (udi_size != 0) {
2352                         conn_recvancillary_add(connp, recv_ancillary, ira,
2353                             &ipps, (uchar_t *)&sin[1], udi_size);
2354                 }
2355         } else {
2356                 sin6_t *sin6;
2357 
2358                 /*
2359                  * Handle both IPv4 and IPv6 packets for IPv6 sockets.
2360                  *
2361                  * Normally we only send up the address. If receiving of any
2362                  * optional receive side information is enabled, we also send
2363                  * that up as options.
2364                  */
2365                 udi_size = sizeof (struct T_unitdata_ind) + sizeof (sin6_t);
2366 
2367                 if (recv_ancillary.crb_all != 0) {
2368                         udi_size += conn_recvancillary_size(connp,
2369                             recv_ancillary, ira, mp, &ipps);
2370                 }
2371 
2372                 mp1 = allocb(udi_size, BPRI_MED);
2373                 if (mp1 == NULL) {
2374                         freemsg(mp);
2375                         UDPS_BUMP_MIB(us, udpInErrors);
2376                         return;
2377                 }
2378                 mp1->b_cont = mp;
2379                 mp1->b_datap->db_type = M_PROTO;
2380                 tudi = (struct T_unitdata_ind *)mp1->b_rptr;
2381                 mp1->b_wptr = (uchar_t *)tudi + udi_size;
2382                 tudi->PRIM_type = T_UNITDATA_IND;
2383                 tudi->SRC_length = sizeof (sin6_t);
2384                 tudi->SRC_offset = sizeof (struct T_unitdata_ind);
2385                 tudi->OPT_offset = sizeof (struct T_unitdata_ind) +
2386                     sizeof (sin6_t);
2387                 udi_size -= (sizeof (struct T_unitdata_ind) + sizeof (sin6_t));
2388                 tudi->OPT_length = udi_size;
2389                 sin6 = (sin6_t *)&tudi[1];
2390                 if (ira->ira_flags & IRAF_IS_IPV4) {
2391                         in6_addr_t v6dst;
2392 
2393                         IN6_IPADDR_TO_V4MAPPED(((ipha_t *)rptr)->ipha_src,
2394                             &sin6->sin6_addr);
2395                         IN6_IPADDR_TO_V4MAPPED(((ipha_t *)rptr)->ipha_dst,
2396                             &v6dst);
2397                         sin6->sin6_flowinfo = 0;
2398                         sin6->sin6_scope_id = 0;
2399                         sin6->__sin6_src_id = ip_srcid_find_addr(&v6dst,
2400                             IPCL_ZONEID(connp), us->us_netstack);
2401                 } else {
2402                         ip6h = (ip6_t *)rptr;
2403 
2404                         sin6->sin6_addr = ip6h->ip6_src;
2405                         /* No sin6_flowinfo per API */
2406                         sin6->sin6_flowinfo = 0;
2407                         /* For link-scope pass up scope id */
2408                         if (IN6_IS_ADDR_LINKSCOPE(&ip6h->ip6_src))
2409                                 sin6->sin6_scope_id = ira->ira_ruifindex;
2410                         else
2411                                 sin6->sin6_scope_id = 0;
2412                         sin6->__sin6_src_id = ip_srcid_find_addr(
2413                             &ip6h->ip6_dst, IPCL_ZONEID(connp),
2414                             us->us_netstack);
2415                 }
2416                 sin6->sin6_port = udpha->uha_src_port;
2417                 sin6->sin6_family = connp->conn_family;
2418 
2419                 if (udi_size != 0) {
2420                         conn_recvancillary_add(connp, recv_ancillary, ira,
2421                             &ipps, (uchar_t *)&sin6[1], udi_size);
2422                 }
2423         }
2424 
2425         /*
2426          * DTrace this UDP input as udp:::receive (this is for IPv4, IPv6 and
2427          * loopback traffic).
2428          */
2429         DTRACE_UDP5(receive, mblk_t *, NULL, ip_xmit_attr_t *, connp->conn_ixa,
2430             void_ip_t *, rptr, udp_t *, udp, udpha_t *, udpha);
2431 
2432         /* Walk past the headers unless IP_RECVHDR was set. */
2433         if (!udp->udp_rcvhdr) {
2434                 mp->b_rptr = rptr + hdr_length;
2435                 pkt_len -= hdr_length;
2436         }
2437 
2438         UDPS_BUMP_MIB(us, udpHCInDatagrams);
2439         udp_ulp_recv(connp, mp1, pkt_len, ira);
2440         return;
2441 
2442 tossit:
2443         freemsg(mp);
2444         UDPS_BUMP_MIB(us, udpInErrors);
2445 }
2446 
2447 /*
2448  * This routine creates a T_UDERROR_IND message and passes it upstream.
2449  * The address and options are copied from the T_UNITDATA_REQ message
2450  * passed in mp.  This message is freed.
2451  */
2452 static void
2453 udp_ud_err(queue_t *q, mblk_t *mp, t_scalar_t err)
2454 {
2455         struct T_unitdata_req *tudr;
2456         mblk_t  *mp1;
2457         uchar_t *destaddr;
2458         t_scalar_t destlen;
2459         uchar_t *optaddr;
2460         t_scalar_t optlen;
2461 
2462         if ((mp->b_wptr < mp->b_rptr) ||
2463             (MBLKL(mp)) < sizeof (struct T_unitdata_req)) {
2464                 goto done;
2465         }
2466         tudr = (struct T_unitdata_req *)mp->b_rptr;
2467         destaddr = mp->b_rptr + tudr->DEST_offset;
2468         if (destaddr < mp->b_rptr || destaddr >= mp->b_wptr ||
2469             destaddr + tudr->DEST_length < mp->b_rptr ||
2470             destaddr + tudr->DEST_length > mp->b_wptr) {
2471                 goto done;
2472         }
2473         optaddr = mp->b_rptr + tudr->OPT_offset;
2474         if (optaddr < mp->b_rptr || optaddr >= mp->b_wptr ||
2475             optaddr + tudr->OPT_length < mp->b_rptr ||
2476             optaddr + tudr->OPT_length > mp->b_wptr) {
2477                 goto done;
2478         }
2479         destlen = tudr->DEST_length;
2480         optlen = tudr->OPT_length;
2481 
2482         mp1 = mi_tpi_uderror_ind((char *)destaddr, destlen,
2483             (char *)optaddr, optlen, err);
2484         if (mp1 != NULL)
2485                 qreply(q, mp1);
2486 
2487 done:
2488         freemsg(mp);
2489 }
2490 
2491 /*
2492  * This routine removes a port number association from a stream.  It
2493  * is called by udp_wput to handle T_UNBIND_REQ messages.
2494  */
2495 static void
2496 udp_tpi_unbind(queue_t *q, mblk_t *mp)
2497 {
2498         conn_t  *connp = Q_TO_CONN(q);
2499         int     error;
2500 
2501         error = udp_do_unbind(connp);
2502         if (error) {
2503                 if (error < 0)
2504                         udp_err_ack(q, mp, -error, 0);
2505                 else
2506                         udp_err_ack(q, mp, TSYSERR, error);
2507                 return;
2508         }
2509 
2510         mp = mi_tpi_ok_ack_alloc(mp);
2511         ASSERT(mp != NULL);
2512         ASSERT(((struct T_ok_ack *)mp->b_rptr)->PRIM_type == T_OK_ACK);
2513         qreply(q, mp);
2514 }
2515 
2516 /*
2517  * Don't let port fall into the privileged range.
2518  * Since the extra privileged ports can be arbitrary we also
2519  * ensure that we exclude those from consideration.
2520  * us->us_epriv_ports is not sorted thus we loop over it until
2521  * there are no changes.
2522  */
2523 static in_port_t
2524 udp_update_next_port(udp_t *udp, in_port_t port, boolean_t random)
2525 {
2526         int i, bump;
2527         in_port_t nextport;
2528         boolean_t restart = B_FALSE;
2529         udp_stack_t *us = udp->udp_us;
2530 
2531         if (random && udp_random_anon_port != 0) {
2532                 (void) random_get_pseudo_bytes((uint8_t *)&port,
2533                     sizeof (in_port_t));
2534                 /*
2535                  * Unless changed by a sys admin, the smallest anon port
2536                  * is 32768 and the largest anon port is 65535.  It is
2537                  * very likely (50%) for the random port to be smaller
2538                  * than the smallest anon port.  When that happens,
2539                  * add port % (anon port range) to the smallest anon
2540                  * port to get the random port.  It should fall into the
2541                  * valid anon port range.
2542                  */
2543                 if ((port < us->us_smallest_anon_port) ||
2544                     (port > us->us_largest_anon_port)) {
2545                         if (us->us_smallest_anon_port ==
2546                             us->us_largest_anon_port) {
2547                                 bump = 0;
2548                         } else {
2549                                 bump = port % (us->us_largest_anon_port -
2550                                     us->us_smallest_anon_port);
2551                         }
2552 
2553                         port = us->us_smallest_anon_port + bump;
2554                 }
2555         }
2556 
2557 retry:
2558         if (port < us->us_smallest_anon_port)
2559                 port = us->us_smallest_anon_port;
2560 
2561         if (port > us->us_largest_anon_port) {
2562                 port = us->us_smallest_anon_port;
2563                 if (restart)
2564                         return (0);
2565                 restart = B_TRUE;
2566         }
2567 
2568         if (port < us->us_smallest_nonpriv_port)
2569                 port = us->us_smallest_nonpriv_port;
2570 
2571         for (i = 0; i < us->us_num_epriv_ports; i++) {
2572                 if (port == us->us_epriv_ports[i]) {
2573                         port++;
2574                         /*
2575                          * Make sure that the port is in the
2576                          * valid range.
2577                          */
2578                         goto retry;
2579                 }
2580         }
2581 
2582         if (is_system_labeled() &&
2583             (nextport = tsol_next_port(crgetzone(udp->udp_connp->conn_cred),
2584             port, IPPROTO_UDP, B_TRUE)) != 0) {
2585                 port = nextport;
2586                 goto retry;
2587         }
2588 
2589         return (port);
2590 }
2591 
2592 /*
2593  * Handle T_UNITDATA_REQ with options. Both IPv4 and IPv6
2594  * Either tudr_mp or msg is set. If tudr_mp we take ancillary data from
2595  * the TPI options, otherwise we take them from msg_control.
2596  * If both sin and sin6 is set it is a connected socket and we use conn_faddr.
2597  * Always consumes mp; never consumes tudr_mp.
2598  */
2599 static int
2600 udp_output_ancillary(conn_t *connp, sin_t *sin, sin6_t *sin6, mblk_t *mp,
2601     mblk_t *tudr_mp, struct nmsghdr *msg, cred_t *cr, pid_t pid)
2602 {
2603         udp_t           *udp = connp->conn_udp;
2604         udp_stack_t     *us = udp->udp_us;
2605         int             error;
2606         ip_xmit_attr_t  *ixa;
2607         ip_pkt_t        *ipp;
2608         in6_addr_t      v6src;
2609         in6_addr_t      v6dst;
2610         in6_addr_t      v6nexthop;
2611         in_port_t       dstport;
2612         uint32_t        flowinfo;
2613         uint_t          srcid;
2614         int             is_absreq_failure = 0;
2615         conn_opt_arg_t  coas, *coa;
2616 
2617         ASSERT(tudr_mp != NULL || msg != NULL);
2618 
2619         /*
2620          * Get ixa before checking state to handle a disconnect race.
2621          *
2622          * We need an exclusive copy of conn_ixa since the ancillary data
2623          * options might modify it. That copy has no pointers hence we
2624          * need to set them up once we've parsed the ancillary data.
2625          */
2626         ixa = conn_get_ixa_exclusive(connp);
2627         if (ixa == NULL) {
2628                 UDPS_BUMP_MIB(us, udpOutErrors);
2629                 freemsg(mp);
2630                 return (ENOMEM);
2631         }
2632         ASSERT(cr != NULL);
2633         ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
2634         ixa->ixa_cred = cr;
2635         ixa->ixa_cpid = pid;
2636         if (is_system_labeled()) {
2637                 /* We need to restart with a label based on the cred */
2638                 ip_xmit_attr_restore_tsl(ixa, ixa->ixa_cred);
2639         }
2640 
2641         /* In case previous destination was multicast or multirt */
2642         ip_attr_newdst(ixa);
2643 
2644         /* Get a copy of conn_xmit_ipp since the options might change it */
2645         ipp = kmem_zalloc(sizeof (*ipp), KM_NOSLEEP);
2646         if (ipp == NULL) {
2647                 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
2648                 ixa->ixa_cred = connp->conn_cred; /* Restore */
2649                 ixa->ixa_cpid = connp->conn_cpid;
2650                 ixa_refrele(ixa);
2651                 UDPS_BUMP_MIB(us, udpOutErrors);
2652                 freemsg(mp);
2653                 return (ENOMEM);
2654         }
2655         mutex_enter(&connp->conn_lock);
2656         error = ip_pkt_copy(&connp->conn_xmit_ipp, ipp, KM_NOSLEEP);
2657         mutex_exit(&connp->conn_lock);
2658         if (error != 0) {
2659                 UDPS_BUMP_MIB(us, udpOutErrors);
2660                 freemsg(mp);
2661                 goto done;
2662         }
2663 
2664         /*
2665          * Parse the options and update ixa and ipp as a result.
2666          * Note that ixa_tsl can be updated if SCM_UCRED.
2667          * ixa_refrele/ixa_inactivate will release any reference on ixa_tsl.
2668          */
2669 
2670         coa = &coas;
2671         coa->coa_connp = connp;
2672         coa->coa_ixa = ixa;
2673         coa->coa_ipp = ipp;
2674         coa->coa_ancillary = B_TRUE;
2675         coa->coa_changed = 0;
2676 
2677         if (msg != NULL) {
2678                 error = process_auxiliary_options(connp, msg->msg_control,
2679                     msg->msg_controllen, coa, &udp_opt_obj, udp_opt_set, cr);
2680         } else {
2681                 struct T_unitdata_req *tudr;
2682 
2683                 tudr = (struct T_unitdata_req *)tudr_mp->b_rptr;
2684                 ASSERT(tudr->PRIM_type == T_UNITDATA_REQ);
2685                 error = tpi_optcom_buf(connp->conn_wq, tudr_mp,
2686                     &tudr->OPT_length, tudr->OPT_offset, cr, &udp_opt_obj,
2687                     coa, &is_absreq_failure);
2688         }
2689         if (error != 0) {
2690                 /*
2691                  * Note: No special action needed in this
2692                  * module for "is_absreq_failure"
2693                  */
2694                 freemsg(mp);
2695                 UDPS_BUMP_MIB(us, udpOutErrors);
2696                 goto done;
2697         }
2698         ASSERT(is_absreq_failure == 0);
2699 
2700         mutex_enter(&connp->conn_lock);
2701         /*
2702          * If laddr is unspecified then we look at sin6_src_id.
2703          * We will give precedence to a source address set with IPV6_PKTINFO
2704          * (aka IPPF_ADDR) but that is handled in build_hdrs. However, we don't
2705          * want ip_attr_connect to select a source (since it can fail) when
2706          * IPV6_PKTINFO is specified.
2707          * If this doesn't result in a source address then we get a source
2708          * from ip_attr_connect() below.
2709          */
2710         v6src = connp->conn_saddr_v6;
2711         if (sin != NULL) {
2712                 IN6_IPADDR_TO_V4MAPPED(sin->sin_addr.s_addr, &v6dst);
2713                 dstport = sin->sin_port;
2714                 flowinfo = 0;
2715                 ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
2716                 ixa->ixa_flags |= IXAF_IS_IPV4;
2717         } else if (sin6 != NULL) {
2718                 boolean_t v4mapped;
2719 
2720                 v6dst = sin6->sin6_addr;
2721                 dstport = sin6->sin6_port;
2722                 flowinfo = sin6->sin6_flowinfo;
2723                 srcid = sin6->__sin6_src_id;
2724                 if (IN6_IS_ADDR_LINKSCOPE(&v6dst) && sin6->sin6_scope_id != 0) {
2725                         ixa->ixa_scopeid = sin6->sin6_scope_id;
2726                         ixa->ixa_flags |= IXAF_SCOPEID_SET;
2727                 } else {
2728                         ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
2729                 }
2730                 v4mapped = IN6_IS_ADDR_V4MAPPED(&v6dst);
2731                 if (v4mapped)
2732                         ixa->ixa_flags |= IXAF_IS_IPV4;
2733                 else
2734                         ixa->ixa_flags &= ~IXAF_IS_IPV4;
2735                 if (srcid != 0 && IN6_IS_ADDR_UNSPECIFIED(&v6src)) {
2736                         if (!ip_srcid_find_id(srcid, &v6src, IPCL_ZONEID(connp),
2737                             v4mapped, connp->conn_netstack)) {
2738                                 /* Mismatch - v4mapped/v6 specified by srcid. */
2739                                 mutex_exit(&connp->conn_lock);
2740                                 error = EADDRNOTAVAIL;
2741                                 goto failed;    /* Does freemsg() and mib. */
2742                         }
2743                 }
2744         } else {
2745                 /* Connected case */
2746                 v6dst = connp->conn_faddr_v6;
2747                 dstport = connp->conn_fport;
2748                 flowinfo = connp->conn_flowinfo;
2749         }
2750         mutex_exit(&connp->conn_lock);
2751 
2752         /* Handle IP_PKTINFO/IPV6_PKTINFO setting source address. */
2753         if (ipp->ipp_fields & IPPF_ADDR) {
2754                 if (ixa->ixa_flags & IXAF_IS_IPV4) {
2755                         if (IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr))
2756                                 v6src = ipp->ipp_addr;
2757                 } else {
2758                         if (!IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr))
2759                                 v6src = ipp->ipp_addr;
2760                 }
2761         }
2762 
2763         ip_attr_nexthop(ipp, ixa, &v6dst, &v6nexthop);
2764         error = ip_attr_connect(connp, ixa, &v6src, &v6dst, &v6nexthop, dstport,
2765             &v6src, NULL, IPDF_ALLOW_MCBC | IPDF_VERIFY_DST | IPDF_IPSEC);
2766 
2767         switch (error) {
2768         case 0:
2769                 break;
2770         case EADDRNOTAVAIL:
2771                 /*
2772                  * IXAF_VERIFY_SOURCE tells us to pick a better source.
2773                  * Don't have the application see that errno
2774                  */
2775                 error = ENETUNREACH;
2776                 goto failed;
2777         case ENETDOWN:
2778                 /*
2779                  * Have !ipif_addr_ready address; drop packet silently
2780                  * until we can get applications to not send until we
2781                  * are ready.
2782                  */
2783                 error = 0;
2784                 goto failed;
2785         case EHOSTUNREACH:
2786         case ENETUNREACH:
2787                 if (ixa->ixa_ire != NULL) {
2788                         /*
2789                          * Let conn_ip_output/ire_send_noroute return
2790                          * the error and send any local ICMP error.
2791                          */
2792                         error = 0;
2793                         break;
2794                 }
2795                 /* FALLTHRU */
2796         default:
2797         failed:
2798                 freemsg(mp);
2799                 UDPS_BUMP_MIB(us, udpOutErrors);
2800                 goto done;
2801         }
2802 
2803         /*
2804          * We might be going to a different destination than last time,
2805          * thus check that TX allows the communication and compute any
2806          * needed label.
2807          *
2808          * TSOL Note: We have an exclusive ipp and ixa for this thread so we
2809          * don't have to worry about concurrent threads.
2810          */
2811         if (is_system_labeled()) {
2812                 /* Using UDP MLP requires SCM_UCRED from user */
2813                 if (connp->conn_mlp_type != mlptSingle &&
2814                     !((ixa->ixa_flags & IXAF_UCRED_TSL))) {
2815                         UDPS_BUMP_MIB(us, udpOutErrors);
2816                         error = ECONNREFUSED;
2817                         freemsg(mp);
2818                         goto done;
2819                 }
2820                 /*
2821                  * Check whether Trusted Solaris policy allows communication
2822                  * with this host, and pretend that the destination is
2823                  * unreachable if not.
2824                  * Compute any needed label and place it in ipp_label_v4/v6.
2825                  *
2826                  * Later conn_build_hdr_template/conn_prepend_hdr takes
2827                  * ipp_label_v4/v6 to form the packet.
2828                  *
2829                  * Tsol note: We have ipp structure local to this thread so
2830                  * no locking is needed.
2831                  */
2832                 error = conn_update_label(connp, ixa, &v6dst, ipp);
2833                 if (error != 0) {
2834                         freemsg(mp);
2835                         UDPS_BUMP_MIB(us, udpOutErrors);
2836                         goto done;
2837                 }
2838         }
2839         mp = udp_prepend_hdr(connp, ixa, ipp, &v6src, &v6dst, dstport,
2840             flowinfo, mp, &error);
2841         if (mp == NULL) {
2842                 ASSERT(error != 0);
2843                 UDPS_BUMP_MIB(us, udpOutErrors);
2844                 goto done;
2845         }
2846         if (ixa->ixa_pktlen > IP_MAXPACKET) {
2847                 error = EMSGSIZE;
2848                 UDPS_BUMP_MIB(us, udpOutErrors);
2849                 freemsg(mp);
2850                 goto done;
2851         }
2852         /* We're done.  Pass the packet to ip. */
2853         UDPS_BUMP_MIB(us, udpHCOutDatagrams);
2854 
2855         DTRACE_UDP5(send, mblk_t *, NULL, ip_xmit_attr_t *, ixa,
2856             void_ip_t *, mp->b_rptr, udp_t *, udp, udpha_t *,
2857             &mp->b_rptr[ixa->ixa_ip_hdr_length]);
2858 
2859         error = conn_ip_output(mp, ixa);
2860         /* No udpOutErrors if an error since IP increases its error counter */
2861         switch (error) {
2862         case 0:
2863                 break;
2864         case EWOULDBLOCK:
2865                 (void) ixa_check_drain_insert(connp, ixa);
2866                 error = 0;
2867                 break;
2868         case EADDRNOTAVAIL:
2869                 /*
2870                  * IXAF_VERIFY_SOURCE tells us to pick a better source.
2871                  * Don't have the application see that errno
2872                  */
2873                 error = ENETUNREACH;
2874                 /* FALLTHRU */
2875         default:
2876                 mutex_enter(&connp->conn_lock);
2877                 /*
2878                  * Clear the source and v6lastdst so we call ip_attr_connect
2879                  * for the next packet and try to pick a better source.
2880                  */
2881                 if (connp->conn_mcbc_bind)
2882                         connp->conn_saddr_v6 = ipv6_all_zeros;
2883                 else
2884                         connp->conn_saddr_v6 = connp->conn_bound_addr_v6;
2885                 connp->conn_v6lastdst = ipv6_all_zeros;
2886                 mutex_exit(&connp->conn_lock);
2887                 break;
2888         }
2889 done:
2890         ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
2891         ixa->ixa_cred = connp->conn_cred; /* Restore */
2892         ixa->ixa_cpid = connp->conn_cpid;
2893         ixa_refrele(ixa);
2894         ip_pkt_free(ipp);
2895         kmem_free(ipp, sizeof (*ipp));
2896         return (error);
2897 }
2898 
2899 /*
2900  * Handle sending an M_DATA for a connected socket.
2901  * Handles both IPv4 and IPv6.
2902  */
2903 static int
2904 udp_output_connected(conn_t *connp, mblk_t *mp, cred_t *cr, pid_t pid)
2905 {
2906         udp_t           *udp = connp->conn_udp;
2907         udp_stack_t     *us = udp->udp_us;
2908         int             error;
2909         ip_xmit_attr_t  *ixa;
2910 
2911         /*
2912          * If no other thread is using conn_ixa this just gets a reference to
2913          * conn_ixa. Otherwise we get a safe copy of conn_ixa.
2914          */
2915         ixa = conn_get_ixa(connp, B_FALSE);
2916         if (ixa == NULL) {
2917                 UDPS_BUMP_MIB(us, udpOutErrors);
2918                 freemsg(mp);
2919                 return (ENOMEM);
2920         }
2921 
2922         ASSERT(cr != NULL);
2923         ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
2924         ixa->ixa_cred = cr;
2925         ixa->ixa_cpid = pid;
2926 
2927         mutex_enter(&connp->conn_lock);
2928         mp = udp_prepend_header_template(connp, ixa, mp, &connp->conn_saddr_v6,
2929             connp->conn_fport, connp->conn_flowinfo, &error);
2930 
2931         if (mp == NULL) {
2932                 ASSERT(error != 0);
2933                 mutex_exit(&connp->conn_lock);
2934                 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
2935                 ixa->ixa_cred = connp->conn_cred; /* Restore */
2936                 ixa->ixa_cpid = connp->conn_cpid;
2937                 ixa_refrele(ixa);
2938                 UDPS_BUMP_MIB(us, udpOutErrors);
2939                 freemsg(mp);
2940                 return (error);
2941         }
2942 
2943         /*
2944          * In case we got a safe copy of conn_ixa, or if opt_set made us a new
2945          * safe copy, then we need to fill in any pointers in it.
2946          */
2947         if (ixa->ixa_ire == NULL) {
2948                 in6_addr_t      faddr, saddr;
2949                 in6_addr_t      nexthop;
2950                 in_port_t       fport;
2951 
2952                 saddr = connp->conn_saddr_v6;
2953                 faddr = connp->conn_faddr_v6;
2954                 fport = connp->conn_fport;
2955                 ip_attr_nexthop(&connp->conn_xmit_ipp, ixa, &faddr, &nexthop);
2956                 mutex_exit(&connp->conn_lock);
2957 
2958                 error = ip_attr_connect(connp, ixa, &saddr, &faddr, &nexthop,
2959                     fport, NULL, NULL, IPDF_ALLOW_MCBC | IPDF_VERIFY_DST |
2960                     IPDF_IPSEC);
2961                 switch (error) {
2962                 case 0:
2963                         break;
2964                 case EADDRNOTAVAIL:
2965                         /*
2966                          * IXAF_VERIFY_SOURCE tells us to pick a better source.
2967                          * Don't have the application see that errno
2968                          */
2969                         error = ENETUNREACH;
2970                         goto failed;
2971                 case ENETDOWN:
2972                         /*
2973                          * Have !ipif_addr_ready address; drop packet silently
2974                          * until we can get applications to not send until we
2975                          * are ready.
2976                          */
2977                         error = 0;
2978                         goto failed;
2979                 case EHOSTUNREACH:
2980                 case ENETUNREACH:
2981                         if (ixa->ixa_ire != NULL) {
2982                                 /*
2983                                  * Let conn_ip_output/ire_send_noroute return
2984                                  * the error and send any local ICMP error.
2985                                  */
2986                                 error = 0;
2987                                 break;
2988                         }
2989                         /* FALLTHRU */
2990                 default:
2991                 failed:
2992                         ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
2993                         ixa->ixa_cred = connp->conn_cred; /* Restore */
2994                         ixa->ixa_cpid = connp->conn_cpid;
2995                         ixa_refrele(ixa);
2996                         freemsg(mp);
2997                         UDPS_BUMP_MIB(us, udpOutErrors);
2998                         return (error);
2999                 }
3000         } else {
3001                 /* Done with conn_t */
3002                 mutex_exit(&connp->conn_lock);
3003         }
3004         ASSERT(ixa->ixa_ire != NULL);
3005 
3006         /* We're done.  Pass the packet to ip. */
3007         UDPS_BUMP_MIB(us, udpHCOutDatagrams);
3008 
3009         DTRACE_UDP5(send, mblk_t *, NULL, ip_xmit_attr_t *, ixa,
3010             void_ip_t *, mp->b_rptr, udp_t *, udp, udpha_t *,
3011             &mp->b_rptr[ixa->ixa_ip_hdr_length]);
3012 
3013         error = conn_ip_output(mp, ixa);
3014         /* No udpOutErrors if an error since IP increases its error counter */
3015         switch (error) {
3016         case 0:
3017                 break;
3018         case EWOULDBLOCK:
3019                 (void) ixa_check_drain_insert(connp, ixa);
3020                 error = 0;
3021                 break;
3022         case EADDRNOTAVAIL:
3023                 /*
3024                  * IXAF_VERIFY_SOURCE tells us to pick a better source.
3025                  * Don't have the application see that errno
3026                  */
3027                 error = ENETUNREACH;
3028                 break;
3029         }
3030         ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3031         ixa->ixa_cred = connp->conn_cred; /* Restore */
3032         ixa->ixa_cpid = connp->conn_cpid;
3033         ixa_refrele(ixa);
3034         return (error);
3035 }
3036 
3037 /*
3038  * Handle sending an M_DATA to the last destination.
3039  * Handles both IPv4 and IPv6.
3040  *
3041  * NOTE: The caller must hold conn_lock and we drop it here.
3042  */
3043 static int
3044 udp_output_lastdst(conn_t *connp, mblk_t *mp, cred_t *cr, pid_t pid,
3045     ip_xmit_attr_t *ixa)
3046 {
3047         udp_t           *udp = connp->conn_udp;
3048         udp_stack_t     *us = udp->udp_us;
3049         int             error;
3050 
3051         ASSERT(MUTEX_HELD(&connp->conn_lock));
3052         ASSERT(ixa != NULL);
3053 
3054         ASSERT(cr != NULL);
3055         ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3056         ixa->ixa_cred = cr;
3057         ixa->ixa_cpid = pid;
3058 
3059         mp = udp_prepend_header_template(connp, ixa, mp, &connp->conn_v6lastsrc,
3060             connp->conn_lastdstport, connp->conn_lastflowinfo, &error);
3061 
3062         if (mp == NULL) {
3063                 ASSERT(error != 0);
3064                 mutex_exit(&connp->conn_lock);
3065                 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3066                 ixa->ixa_cred = connp->conn_cred; /* Restore */
3067                 ixa->ixa_cpid = connp->conn_cpid;
3068                 ixa_refrele(ixa);
3069                 UDPS_BUMP_MIB(us, udpOutErrors);
3070                 freemsg(mp);
3071                 return (error);
3072         }
3073 
3074         /*
3075          * In case we got a safe copy of conn_ixa, or if opt_set made us a new
3076          * safe copy, then we need to fill in any pointers in it.
3077          */
3078         if (ixa->ixa_ire == NULL) {
3079                 in6_addr_t      lastdst, lastsrc;
3080                 in6_addr_t      nexthop;
3081                 in_port_t       lastport;
3082 
3083                 lastsrc = connp->conn_v6lastsrc;
3084                 lastdst = connp->conn_v6lastdst;
3085                 lastport = connp->conn_lastdstport;
3086                 ip_attr_nexthop(&connp->conn_xmit_ipp, ixa, &lastdst, &nexthop);
3087                 mutex_exit(&connp->conn_lock);
3088 
3089                 error = ip_attr_connect(connp, ixa, &lastsrc, &lastdst,
3090                     &nexthop, lastport, NULL, NULL, IPDF_ALLOW_MCBC |
3091                     IPDF_VERIFY_DST | IPDF_IPSEC);
3092                 switch (error) {
3093                 case 0:
3094                         break;
3095                 case EADDRNOTAVAIL:
3096                         /*
3097                          * IXAF_VERIFY_SOURCE tells us to pick a better source.
3098                          * Don't have the application see that errno
3099                          */
3100                         error = ENETUNREACH;
3101                         goto failed;
3102                 case ENETDOWN:
3103                         /*
3104                          * Have !ipif_addr_ready address; drop packet silently
3105                          * until we can get applications to not send until we
3106                          * are ready.
3107                          */
3108                         error = 0;
3109                         goto failed;
3110                 case EHOSTUNREACH:
3111                 case ENETUNREACH:
3112                         if (ixa->ixa_ire != NULL) {
3113                                 /*
3114                                  * Let conn_ip_output/ire_send_noroute return
3115                                  * the error and send any local ICMP error.
3116                                  */
3117                                 error = 0;
3118                                 break;
3119                         }
3120                         /* FALLTHRU */
3121                 default:
3122                 failed:
3123                         ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3124                         ixa->ixa_cred = connp->conn_cred; /* Restore */
3125                         ixa->ixa_cpid = connp->conn_cpid;
3126                         ixa_refrele(ixa);
3127                         freemsg(mp);
3128                         UDPS_BUMP_MIB(us, udpOutErrors);
3129                         return (error);
3130                 }
3131         } else {
3132                 /* Done with conn_t */
3133                 mutex_exit(&connp->conn_lock);
3134         }
3135 
3136         /* We're done.  Pass the packet to ip. */
3137         UDPS_BUMP_MIB(us, udpHCOutDatagrams);
3138 
3139         DTRACE_UDP5(send, mblk_t *, NULL, ip_xmit_attr_t *, ixa,
3140             void_ip_t *, mp->b_rptr, udp_t *, udp, udpha_t *,
3141             &mp->b_rptr[ixa->ixa_ip_hdr_length]);
3142 
3143         error = conn_ip_output(mp, ixa);
3144         /* No udpOutErrors if an error since IP increases its error counter */
3145         switch (error) {
3146         case 0:
3147                 break;
3148         case EWOULDBLOCK:
3149                 (void) ixa_check_drain_insert(connp, ixa);
3150                 error = 0;
3151                 break;
3152         case EADDRNOTAVAIL:
3153                 /*
3154                  * IXAF_VERIFY_SOURCE tells us to pick a better source.
3155                  * Don't have the application see that errno
3156                  */
3157                 error = ENETUNREACH;
3158                 /* FALLTHRU */
3159         default:
3160                 mutex_enter(&connp->conn_lock);
3161                 /*
3162                  * Clear the source and v6lastdst so we call ip_attr_connect
3163                  * for the next packet and try to pick a better source.
3164                  */
3165                 if (connp->conn_mcbc_bind)
3166                         connp->conn_saddr_v6 = ipv6_all_zeros;
3167                 else
3168                         connp->conn_saddr_v6 = connp->conn_bound_addr_v6;
3169                 connp->conn_v6lastdst = ipv6_all_zeros;
3170                 mutex_exit(&connp->conn_lock);
3171                 break;
3172         }
3173         ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3174         ixa->ixa_cred = connp->conn_cred; /* Restore */
3175         ixa->ixa_cpid = connp->conn_cpid;
3176         ixa_refrele(ixa);
3177         return (error);
3178 }
3179 
3180 
3181 /*
3182  * Prepend the header template and then fill in the source and
3183  * flowinfo. The caller needs to handle the destination address since
3184  * it's setting is different if rthdr or source route.
3185  *
3186  * Returns NULL is allocation failed or if the packet would exceed IP_MAXPACKET.
3187  * When it returns NULL it sets errorp.
3188  */
3189 static mblk_t *
3190 udp_prepend_header_template(conn_t *connp, ip_xmit_attr_t *ixa, mblk_t *mp,
3191     const in6_addr_t *v6src, in_port_t dstport, uint32_t flowinfo, int *errorp)
3192 {
3193         udp_t           *udp = connp->conn_udp;
3194         udp_stack_t     *us = udp->udp_us;
3195         boolean_t       insert_spi = udp->udp_nat_t_endpoint;
3196         uint_t          pktlen;
3197         uint_t          alloclen;
3198         uint_t          copylen;
3199         uint8_t         *iph;
3200         uint_t          ip_hdr_length;
3201         udpha_t         *udpha;
3202         uint32_t        cksum;
3203         ip_pkt_t        *ipp;
3204 
3205         ASSERT(MUTEX_HELD(&connp->conn_lock));
3206 
3207         /*
3208          * Copy the header template and leave space for an SPI
3209          */
3210         copylen = connp->conn_ht_iphc_len;
3211         alloclen = copylen + (insert_spi ? sizeof (uint32_t) : 0);
3212         pktlen = alloclen + msgdsize(mp);
3213         if (pktlen > IP_MAXPACKET) {
3214                 freemsg(mp);
3215                 *errorp = EMSGSIZE;
3216                 return (NULL);
3217         }
3218         ixa->ixa_pktlen = pktlen;
3219 
3220         /* check/fix buffer config, setup pointers into it */
3221         iph = mp->b_rptr - alloclen;
3222         if (DB_REF(mp) != 1 || iph < DB_BASE(mp) || !OK_32PTR(iph)) {
3223                 mblk_t *mp1;
3224 
3225                 mp1 = allocb(alloclen + us->us_wroff_extra, BPRI_MED);
3226                 if (mp1 == NULL) {
3227                         freemsg(mp);
3228                         *errorp = ENOMEM;
3229                         return (NULL);
3230                 }
3231                 mp1->b_wptr = DB_LIM(mp1);
3232                 mp1->b_cont = mp;
3233                 mp = mp1;
3234                 iph = (mp->b_wptr - alloclen);
3235         }
3236         mp->b_rptr = iph;
3237         bcopy(connp->conn_ht_iphc, iph, copylen);
3238         ip_hdr_length = (uint_t)(connp->conn_ht_ulp - connp->conn_ht_iphc);
3239 
3240         ixa->ixa_ip_hdr_length = ip_hdr_length;
3241         udpha = (udpha_t *)(iph + ip_hdr_length);
3242 
3243         /*
3244          * Setup header length and prepare for ULP checksum done in IP.
3245          * udp_build_hdr_template has already massaged any routing header
3246          * and placed the result in conn_sum.
3247          *
3248          * We make it easy for IP to include our pseudo header
3249          * by putting our length in uha_checksum.
3250          */
3251         cksum = pktlen - ip_hdr_length;
3252         udpha->uha_length = htons(cksum);
3253 
3254         cksum += connp->conn_sum;
3255         cksum = (cksum >> 16) + (cksum & 0xFFFF);
3256         ASSERT(cksum < 0x10000);
3257 
3258         ipp = &connp->conn_xmit_ipp;
3259         if (ixa->ixa_flags & IXAF_IS_IPV4) {
3260                 ipha_t  *ipha = (ipha_t *)iph;
3261 
3262                 ipha->ipha_length = htons((uint16_t)pktlen);
3263 
3264                 /* IP does the checksum if uha_checksum is non-zero */
3265                 if (us->us_do_checksum)
3266                         udpha->uha_checksum = htons(cksum);
3267 
3268                 /* if IP_PKTINFO specified an addres it wins over bind() */
3269                 if ((ipp->ipp_fields & IPPF_ADDR) &&
3270                     IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr)) {
3271                         ASSERT(ipp->ipp_addr_v4 != INADDR_ANY);
3272                         ipha->ipha_src = ipp->ipp_addr_v4;
3273                 } else {
3274                         IN6_V4MAPPED_TO_IPADDR(v6src, ipha->ipha_src);
3275                 }
3276         } else {
3277                 ip6_t *ip6h = (ip6_t *)iph;
3278 
3279                 ip6h->ip6_plen =  htons((uint16_t)(pktlen - IPV6_HDR_LEN));
3280                 udpha->uha_checksum = htons(cksum);
3281 
3282                 /* if IP_PKTINFO specified an addres it wins over bind() */
3283                 if ((ipp->ipp_fields & IPPF_ADDR) &&
3284                     !IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr)) {
3285                         ASSERT(!IN6_IS_ADDR_UNSPECIFIED(&ipp->ipp_addr));
3286                         ip6h->ip6_src = ipp->ipp_addr;
3287                 } else {
3288                         ip6h->ip6_src = *v6src;
3289                 }
3290                 ip6h->ip6_vcf =
3291                     (IPV6_DEFAULT_VERS_AND_FLOW & IPV6_VERS_AND_FLOW_MASK) |
3292                     (flowinfo & ~IPV6_VERS_AND_FLOW_MASK);
3293                 if (ipp->ipp_fields & IPPF_TCLASS) {
3294                         /* Overrides the class part of flowinfo */
3295                         ip6h->ip6_vcf = IPV6_TCLASS_FLOW(ip6h->ip6_vcf,
3296                             ipp->ipp_tclass);
3297                 }
3298         }
3299 
3300         /* Insert all-0s SPI now. */
3301         if (insert_spi)
3302                 *((uint32_t *)(udpha + 1)) = 0;
3303 
3304         udpha->uha_dst_port = dstport;
3305         return (mp);
3306 }
3307 
3308 /*
3309  * Send a T_UDERR_IND in response to an M_DATA
3310  */
3311 static void
3312 udp_ud_err_connected(conn_t *connp, t_scalar_t error)
3313 {
3314         struct sockaddr_storage ss;
3315         sin_t           *sin;
3316         sin6_t          *sin6;
3317         struct sockaddr *addr;
3318         socklen_t       addrlen;
3319         mblk_t          *mp1;
3320 
3321         mutex_enter(&connp->conn_lock);
3322         /* Initialize addr and addrlen as if they're passed in */
3323         if (connp->conn_family == AF_INET) {
3324                 sin = (sin_t *)&ss;
3325                 *sin = sin_null;
3326                 sin->sin_family = AF_INET;
3327                 sin->sin_port = connp->conn_fport;
3328                 sin->sin_addr.s_addr = connp->conn_faddr_v4;
3329                 addr = (struct sockaddr *)sin;
3330                 addrlen = sizeof (*sin);
3331         } else {
3332                 sin6 = (sin6_t *)&ss;
3333                 *sin6 = sin6_null;
3334                 sin6->sin6_family = AF_INET6;
3335                 sin6->sin6_port = connp->conn_fport;
3336                 sin6->sin6_flowinfo = connp->conn_flowinfo;
3337                 sin6->sin6_addr = connp->conn_faddr_v6;
3338                 if (IN6_IS_ADDR_LINKSCOPE(&connp->conn_faddr_v6) &&
3339                     (connp->conn_ixa->ixa_flags & IXAF_SCOPEID_SET)) {
3340                         sin6->sin6_scope_id = connp->conn_ixa->ixa_scopeid;
3341                 } else {
3342                         sin6->sin6_scope_id = 0;
3343                 }
3344                 sin6->__sin6_src_id = 0;
3345                 addr = (struct sockaddr *)sin6;
3346                 addrlen = sizeof (*sin6);
3347         }
3348         mutex_exit(&connp->conn_lock);
3349 
3350         mp1 = mi_tpi_uderror_ind((char *)addr, addrlen, NULL, 0, error);
3351         if (mp1 != NULL)
3352                 putnext(connp->conn_rq, mp1);
3353 }
3354 
3355 /*
3356  * This routine handles all messages passed downstream.  It either
3357  * consumes the message or passes it downstream; it never queues a
3358  * a message.
3359  *
3360  * Also entry point for sockfs when udp is in "direct sockfs" mode.  This mode
3361  * is valid when we are directly beneath the stream head, and thus sockfs
3362  * is able to bypass STREAMS and directly call us, passing along the sockaddr
3363  * structure without the cumbersome T_UNITDATA_REQ interface for the case of
3364  * connected endpoints.
3365  */
3366 void
3367 udp_wput(queue_t *q, mblk_t *mp)
3368 {
3369         sin6_t          *sin6;
3370         sin_t           *sin = NULL;
3371         uint_t          srcid;
3372         conn_t          *connp = Q_TO_CONN(q);
3373         udp_t           *udp = connp->conn_udp;
3374         int             error = 0;
3375         struct sockaddr *addr = NULL;
3376         socklen_t       addrlen;
3377         udp_stack_t     *us = udp->udp_us;
3378         struct T_unitdata_req *tudr;
3379         mblk_t          *data_mp;
3380         ushort_t        ipversion;
3381         cred_t          *cr;
3382         pid_t           pid;
3383 
3384         /*
3385          * We directly handle several cases here: T_UNITDATA_REQ message
3386          * coming down as M_PROTO/M_PCPROTO and M_DATA messages for connected
3387          * socket.
3388          */
3389         switch (DB_TYPE(mp)) {
3390         case M_DATA:
3391                 if (!udp->udp_issocket || udp->udp_state != TS_DATA_XFER) {
3392                         /* Not connected; address is required */
3393                         UDPS_BUMP_MIB(us, udpOutErrors);
3394                         UDP_DBGSTAT(us, udp_data_notconn);
3395                         UDP_STAT(us, udp_out_err_notconn);
3396                         freemsg(mp);
3397                         return;
3398                 }
3399                 /*
3400                  * All Solaris components should pass a db_credp
3401                  * for this message, hence we ASSERT.
3402                  * On production kernels we return an error to be robust against
3403                  * random streams modules sitting on top of us.
3404                  */
3405                 cr = msg_getcred(mp, &pid);
3406                 ASSERT(cr != NULL);
3407                 if (cr == NULL) {
3408                         UDPS_BUMP_MIB(us, udpOutErrors);
3409                         freemsg(mp);
3410                         return;
3411                 }
3412                 ASSERT(udp->udp_issocket);
3413                 UDP_DBGSTAT(us, udp_data_conn);
3414                 error = udp_output_connected(connp, mp, cr, pid);
3415                 if (error != 0) {
3416                         UDP_STAT(us, udp_out_err_output);
3417                         if (connp->conn_rq != NULL)
3418                                 udp_ud_err_connected(connp, (t_scalar_t)error);
3419 #ifdef DEBUG
3420                         printf("udp_output_connected returned %d\n", error);
3421 #endif
3422                 }
3423                 return;
3424 
3425         case M_PROTO:
3426         case M_PCPROTO:
3427                 tudr = (struct T_unitdata_req *)mp->b_rptr;
3428                 if (MBLKL(mp) < sizeof (*tudr) ||
3429                     ((t_primp_t)mp->b_rptr)->type != T_UNITDATA_REQ) {
3430                         udp_wput_other(q, mp);
3431                         return;
3432                 }
3433                 break;
3434 
3435         default:
3436                 udp_wput_other(q, mp);
3437                 return;
3438         }
3439 
3440         /* Handle valid T_UNITDATA_REQ here */
3441         data_mp = mp->b_cont;
3442         if (data_mp == NULL) {
3443                 error = EPROTO;
3444                 goto ud_error2;
3445         }
3446         mp->b_cont = NULL;
3447 
3448         if (!MBLKIN(mp, 0, tudr->DEST_offset + tudr->DEST_length)) {
3449                 error = EADDRNOTAVAIL;
3450                 goto ud_error2;
3451         }
3452 
3453         /*
3454          * All Solaris components should pass a db_credp
3455          * for this TPI message, hence we should ASSERT.
3456          * However, RPC (svc_clts_ksend) does this odd thing where it
3457          * passes the options from a T_UNITDATA_IND unchanged in a
3458          * T_UNITDATA_REQ. While that is the right thing to do for
3459          * some options, SCM_UCRED being the key one, this also makes it
3460          * pass down IP_RECVDSTADDR. Hence we can't ASSERT here.
3461          */
3462         cr = msg_getcred(mp, &pid);
3463         if (cr == NULL) {
3464                 cr = connp->conn_cred;
3465                 pid = connp->conn_cpid;
3466         }
3467 
3468         /*
3469          * If a port has not been bound to the stream, fail.
3470          * This is not a problem when sockfs is directly
3471          * above us, because it will ensure that the socket
3472          * is first bound before allowing data to be sent.
3473          */
3474         if (udp->udp_state == TS_UNBND) {
3475                 error = EPROTO;
3476                 goto ud_error2;
3477         }
3478         addr = (struct sockaddr *)&mp->b_rptr[tudr->DEST_offset];
3479         addrlen = tudr->DEST_length;
3480 
3481         switch (connp->conn_family) {
3482         case AF_INET6:
3483                 sin6 = (sin6_t *)addr;
3484                 if (!OK_32PTR((char *)sin6) || (addrlen != sizeof (sin6_t)) ||
3485                     (sin6->sin6_family != AF_INET6)) {
3486                         error = EADDRNOTAVAIL;
3487                         goto ud_error2;
3488                 }
3489 
3490                 srcid = sin6->__sin6_src_id;
3491                 if (!IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
3492                         /*
3493                          * Destination is a non-IPv4-compatible IPv6 address.
3494                          * Send out an IPv6 format packet.
3495                          */
3496 
3497                         /*
3498                          * If the local address is a mapped address return
3499                          * an error.
3500                          * It would be possible to send an IPv6 packet but the
3501                          * response would never make it back to the application
3502                          * since it is bound to a mapped address.
3503                          */
3504                         if (IN6_IS_ADDR_V4MAPPED(&connp->conn_saddr_v6)) {
3505                                 error = EADDRNOTAVAIL;
3506                                 goto ud_error2;
3507                         }
3508 
3509                         UDP_DBGSTAT(us, udp_out_ipv6);
3510 
3511                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
3512                                 sin6->sin6_addr = ipv6_loopback;
3513                         ipversion = IPV6_VERSION;
3514                 } else {
3515                         if (connp->conn_ipv6_v6only) {
3516                                 error = EADDRNOTAVAIL;
3517                                 goto ud_error2;
3518                         }
3519 
3520                         /*
3521                          * If the local address is not zero or a mapped address
3522                          * return an error.  It would be possible to send an
3523                          * IPv4 packet but the response would never make it
3524                          * back to the application since it is bound to a
3525                          * non-mapped address.
3526                          */
3527                         if (!IN6_IS_ADDR_V4MAPPED(&connp->conn_saddr_v6) &&
3528                             !IN6_IS_ADDR_UNSPECIFIED(&connp->conn_saddr_v6)) {
3529                                 error = EADDRNOTAVAIL;
3530                                 goto ud_error2;
3531                         }
3532                         UDP_DBGSTAT(us, udp_out_mapped);
3533 
3534                         if (V4_PART_OF_V6(sin6->sin6_addr) == INADDR_ANY) {
3535                                 V4_PART_OF_V6(sin6->sin6_addr) =
3536                                     htonl(INADDR_LOOPBACK);
3537                         }
3538                         ipversion = IPV4_VERSION;
3539                 }
3540 
3541                 if (tudr->OPT_length != 0) {
3542                         /*
3543                          * If we are connected then the destination needs to be
3544                          * the same as the connected one.
3545                          */
3546                         if (udp->udp_state == TS_DATA_XFER &&
3547                             !conn_same_as_last_v6(connp, sin6)) {
3548                                 error = EISCONN;
3549                                 goto ud_error2;
3550                         }
3551                         UDP_STAT(us, udp_out_opt);
3552                         error = udp_output_ancillary(connp, NULL, sin6,
3553                             data_mp, mp, NULL, cr, pid);
3554                 } else {
3555                         ip_xmit_attr_t *ixa;
3556 
3557                         /*
3558                          * We have to allocate an ip_xmit_attr_t before we grab
3559                          * conn_lock and we need to hold conn_lock once we've
3560                          * checked conn_same_as_last_v6 to handle concurrent
3561                          * send* calls on a socket.
3562                          */
3563                         ixa = conn_get_ixa(connp, B_FALSE);
3564                         if (ixa == NULL) {
3565                                 error = ENOMEM;
3566                                 goto ud_error2;
3567                         }
3568                         mutex_enter(&connp->conn_lock);
3569 
3570                         if (conn_same_as_last_v6(connp, sin6) &&
3571                             connp->conn_lastsrcid == srcid &&
3572                             ipsec_outbound_policy_current(ixa)) {
3573                                 UDP_DBGSTAT(us, udp_out_lastdst);
3574                                 /* udp_output_lastdst drops conn_lock */
3575                                 error = udp_output_lastdst(connp, data_mp, cr,
3576                                     pid, ixa);
3577                         } else {
3578                                 UDP_DBGSTAT(us, udp_out_diffdst);
3579                                 /* udp_output_newdst drops conn_lock */
3580                                 error = udp_output_newdst(connp, data_mp, NULL,
3581                                     sin6, ipversion, cr, pid, ixa);
3582                         }
3583                         ASSERT(MUTEX_NOT_HELD(&connp->conn_lock));
3584                 }
3585                 if (error == 0) {
3586                         freeb(mp);
3587                         return;
3588                 }
3589                 break;
3590 
3591         case AF_INET:
3592                 sin = (sin_t *)addr;
3593                 if ((!OK_32PTR((char *)sin) || addrlen != sizeof (sin_t)) ||
3594                     (sin->sin_family != AF_INET)) {
3595                         error = EADDRNOTAVAIL;
3596                         goto ud_error2;
3597                 }
3598                 UDP_DBGSTAT(us, udp_out_ipv4);
3599                 if (sin->sin_addr.s_addr == INADDR_ANY)
3600                         sin->sin_addr.s_addr = htonl(INADDR_LOOPBACK);
3601                 ipversion = IPV4_VERSION;
3602 
3603                 srcid = 0;
3604                 if (tudr->OPT_length != 0) {
3605                         /*
3606                          * If we are connected then the destination needs to be
3607                          * the same as the connected one.
3608                          */
3609                         if (udp->udp_state == TS_DATA_XFER &&
3610                             !conn_same_as_last_v4(connp, sin)) {
3611                                 error = EISCONN;
3612                                 goto ud_error2;
3613                         }
3614                         UDP_STAT(us, udp_out_opt);
3615                         error = udp_output_ancillary(connp, sin, NULL,
3616                             data_mp, mp, NULL, cr, pid);
3617                 } else {
3618                         ip_xmit_attr_t *ixa;
3619 
3620                         /*
3621                          * We have to allocate an ip_xmit_attr_t before we grab
3622                          * conn_lock and we need to hold conn_lock once we've
3623                          * checked conn_same_as_last_v4 to handle concurrent
3624                          * send* calls on a socket.
3625                          */
3626                         ixa = conn_get_ixa(connp, B_FALSE);
3627                         if (ixa == NULL) {
3628                                 error = ENOMEM;
3629                                 goto ud_error2;
3630                         }
3631                         mutex_enter(&connp->conn_lock);
3632 
3633                         if (conn_same_as_last_v4(connp, sin) &&
3634                             ipsec_outbound_policy_current(ixa)) {
3635                                 UDP_DBGSTAT(us, udp_out_lastdst);
3636                                 /* udp_output_lastdst drops conn_lock */
3637                                 error = udp_output_lastdst(connp, data_mp, cr,
3638                                     pid, ixa);
3639                         } else {
3640                                 UDP_DBGSTAT(us, udp_out_diffdst);
3641                                 /* udp_output_newdst drops conn_lock */
3642                                 error = udp_output_newdst(connp, data_mp, sin,
3643                                     NULL, ipversion, cr, pid, ixa);
3644                         }
3645                         ASSERT(MUTEX_NOT_HELD(&connp->conn_lock));
3646                 }
3647                 if (error == 0) {
3648                         freeb(mp);
3649                         return;
3650                 }
3651                 break;
3652         }
3653         UDP_STAT(us, udp_out_err_output);
3654         ASSERT(mp != NULL);
3655         /* mp is freed by the following routine */
3656         udp_ud_err(q, mp, (t_scalar_t)error);
3657         return;
3658 
3659 ud_error2:
3660         UDPS_BUMP_MIB(us, udpOutErrors);
3661         freemsg(data_mp);
3662         UDP_STAT(us, udp_out_err_output);
3663         ASSERT(mp != NULL);
3664         /* mp is freed by the following routine */
3665         udp_ud_err(q, mp, (t_scalar_t)error);
3666 }
3667 
3668 /*
3669  * Handle the case of the IP address, port, flow label being different
3670  * for both IPv4 and IPv6.
3671  *
3672  * NOTE: The caller must hold conn_lock and we drop it here.
3673  */
3674 static int
3675 udp_output_newdst(conn_t *connp, mblk_t *data_mp, sin_t *sin, sin6_t *sin6,
3676     ushort_t ipversion, cred_t *cr, pid_t pid, ip_xmit_attr_t *ixa)
3677 {
3678         uint_t          srcid;
3679         uint32_t        flowinfo;
3680         udp_t           *udp = connp->conn_udp;
3681         int             error = 0;
3682         ip_xmit_attr_t  *oldixa;
3683         udp_stack_t     *us = udp->udp_us;
3684         in6_addr_t      v6src;
3685         in6_addr_t      v6dst;
3686         in6_addr_t      v6nexthop;
3687         in_port_t       dstport;
3688 
3689         ASSERT(MUTEX_HELD(&connp->conn_lock));
3690         ASSERT(ixa != NULL);
3691         /*
3692          * We hold conn_lock across all the use and modifications of
3693          * the conn_lastdst, conn_ixa, and conn_xmit_ipp to ensure that they
3694          * stay consistent.
3695          */
3696 
3697         ASSERT(cr != NULL);
3698         ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3699         ixa->ixa_cred = cr;
3700         ixa->ixa_cpid = pid;
3701         if (is_system_labeled()) {
3702                 /* We need to restart with a label based on the cred */
3703                 ip_xmit_attr_restore_tsl(ixa, ixa->ixa_cred);
3704         }
3705 
3706         /*
3707          * If we are connected then the destination needs to be the
3708          * same as the connected one, which is not the case here since we
3709          * checked for that above.
3710          */
3711         if (udp->udp_state == TS_DATA_XFER) {
3712                 mutex_exit(&connp->conn_lock);
3713                 error = EISCONN;
3714                 goto ud_error;
3715         }
3716 
3717         /* In case previous destination was multicast or multirt */
3718         ip_attr_newdst(ixa);
3719 
3720         /*
3721          * If laddr is unspecified then we look at sin6_src_id.
3722          * We will give precedence to a source address set with IPV6_PKTINFO
3723          * (aka IPPF_ADDR) but that is handled in build_hdrs. However, we don't
3724          * want ip_attr_connect to select a source (since it can fail) when
3725          * IPV6_PKTINFO is specified.
3726          * If this doesn't result in a source address then we get a source
3727          * from ip_attr_connect() below.
3728          */
3729         v6src = connp->conn_saddr_v6;
3730         if (sin != NULL) {
3731                 IN6_IPADDR_TO_V4MAPPED(sin->sin_addr.s_addr, &v6dst);
3732                 dstport = sin->sin_port;
3733                 flowinfo = 0;
3734                 /* Don't bother with ip_srcid_find_id(), but indicate anyway. */
3735                 srcid = 0;
3736                 ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
3737                 ixa->ixa_flags |= IXAF_IS_IPV4;
3738         } else {
3739                 boolean_t v4mapped;
3740 
3741                 v6dst = sin6->sin6_addr;
3742                 dstport = sin6->sin6_port;
3743                 flowinfo = sin6->sin6_flowinfo;
3744                 srcid = sin6->__sin6_src_id;
3745                 if (IN6_IS_ADDR_LINKSCOPE(&v6dst) && sin6->sin6_scope_id != 0) {
3746                         ixa->ixa_scopeid = sin6->sin6_scope_id;
3747                         ixa->ixa_flags |= IXAF_SCOPEID_SET;
3748                 } else {
3749                         ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
3750                 }
3751                 v4mapped = IN6_IS_ADDR_V4MAPPED(&v6dst);
3752                 if (v4mapped)
3753                         ixa->ixa_flags |= IXAF_IS_IPV4;
3754                 else
3755                         ixa->ixa_flags &= ~IXAF_IS_IPV4;
3756                 if (srcid != 0 && IN6_IS_ADDR_UNSPECIFIED(&v6src)) {
3757                         if (!ip_srcid_find_id(srcid, &v6src, IPCL_ZONEID(connp),
3758                             v4mapped, connp->conn_netstack)) {
3759                                 /* Mismatched v4mapped/v6 specified by srcid. */
3760                                 mutex_exit(&connp->conn_lock);
3761                                 error = EADDRNOTAVAIL;
3762                                 goto ud_error;
3763                         }
3764                 }
3765         }
3766         /* Handle IP_PKTINFO/IPV6_PKTINFO setting source address. */
3767         if (connp->conn_xmit_ipp.ipp_fields & IPPF_ADDR) {
3768                 ip_pkt_t *ipp = &connp->conn_xmit_ipp;
3769 
3770                 if (ixa->ixa_flags & IXAF_IS_IPV4) {
3771                         if (IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr))
3772                                 v6src = ipp->ipp_addr;
3773                 } else {
3774                         if (!IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr))
3775                                 v6src = ipp->ipp_addr;
3776                 }
3777         }
3778 
3779         ip_attr_nexthop(&connp->conn_xmit_ipp, ixa, &v6dst, &v6nexthop);
3780         mutex_exit(&connp->conn_lock);
3781 
3782         error = ip_attr_connect(connp, ixa, &v6src, &v6dst, &v6nexthop, dstport,
3783             &v6src, NULL, IPDF_ALLOW_MCBC | IPDF_VERIFY_DST | IPDF_IPSEC);
3784         switch (error) {
3785         case 0:
3786                 break;
3787         case EADDRNOTAVAIL:
3788                 /*
3789                  * IXAF_VERIFY_SOURCE tells us to pick a better source.
3790                  * Don't have the application see that errno
3791                  */
3792                 error = ENETUNREACH;
3793                 goto failed;
3794         case ENETDOWN:
3795                 /*
3796                  * Have !ipif_addr_ready address; drop packet silently
3797                  * until we can get applications to not send until we
3798                  * are ready.
3799                  */
3800                 error = 0;
3801                 goto failed;
3802         case EHOSTUNREACH:
3803         case ENETUNREACH:
3804                 if (ixa->ixa_ire != NULL) {
3805                         /*
3806                          * Let conn_ip_output/ire_send_noroute return
3807                          * the error and send any local ICMP error.
3808                          */
3809                         error = 0;
3810                         break;
3811                 }
3812                 /* FALLTHRU */
3813         failed:
3814         default:
3815                 goto ud_error;
3816         }
3817 
3818 
3819         /*
3820          * Cluster note: we let the cluster hook know that we are sending to a
3821          * new address and/or port.
3822          */
3823         if (cl_inet_connect2 != NULL) {
3824                 CL_INET_UDP_CONNECT(connp, B_TRUE, &v6dst, dstport, error);
3825                 if (error != 0) {
3826                         error = EHOSTUNREACH;
3827                         goto ud_error;
3828                 }
3829         }
3830 
3831         mutex_enter(&connp->conn_lock);
3832         /*
3833          * While we dropped the lock some other thread might have connected
3834          * this socket. If so we bail out with EISCONN to ensure that the
3835          * connecting thread is the one that updates conn_ixa, conn_ht_*
3836          * and conn_*last*.
3837          */
3838         if (udp->udp_state == TS_DATA_XFER) {
3839                 mutex_exit(&connp->conn_lock);
3840                 error = EISCONN;
3841                 goto ud_error;
3842         }
3843 
3844         /*
3845          * We need to rebuild the headers if
3846          *  - we are labeling packets (could be different for different
3847          *    destinations)
3848          *  - we have a source route (or routing header) since we need to
3849          *    massage that to get the pseudo-header checksum
3850          *  - the IP version is different than the last time
3851          *  - a socket option with COA_HEADER_CHANGED has been set which
3852          *    set conn_v6lastdst to zero.
3853          *
3854          * Otherwise the prepend function will just update the src, dst,
3855          * dstport, and flow label.
3856          */
3857         if (is_system_labeled()) {
3858                 /* TX MLP requires SCM_UCRED and don't have that here */
3859                 if (connp->conn_mlp_type != mlptSingle) {
3860                         mutex_exit(&connp->conn_lock);
3861                         error = ECONNREFUSED;
3862                         goto ud_error;
3863                 }
3864                 /*
3865                  * Check whether Trusted Solaris policy allows communication
3866                  * with this host, and pretend that the destination is
3867                  * unreachable if not.
3868                  * Compute any needed label and place it in ipp_label_v4/v6.
3869                  *
3870                  * Later conn_build_hdr_template/conn_prepend_hdr takes
3871                  * ipp_label_v4/v6 to form the packet.
3872                  *
3873                  * Tsol note: Since we hold conn_lock we know no other
3874                  * thread manipulates conn_xmit_ipp.
3875                  */
3876                 error = conn_update_label(connp, ixa, &v6dst,
3877                     &connp->conn_xmit_ipp);
3878                 if (error != 0) {
3879                         mutex_exit(&connp->conn_lock);
3880                         goto ud_error;
3881                 }
3882                 /* Rebuild the header template */
3883                 error = udp_build_hdr_template(connp, &v6src, &v6dst, dstport,
3884                     flowinfo);
3885                 if (error != 0) {
3886                         mutex_exit(&connp->conn_lock);
3887                         goto ud_error;
3888                 }
3889         } else if ((connp->conn_xmit_ipp.ipp_fields &
3890             (IPPF_IPV4_OPTIONS|IPPF_RTHDR)) ||
3891             ipversion != connp->conn_lastipversion ||
3892             IN6_IS_ADDR_UNSPECIFIED(&connp->conn_v6lastdst)) {
3893                 /* Rebuild the header template */
3894                 error = udp_build_hdr_template(connp, &v6src, &v6dst, dstport,
3895                     flowinfo);
3896                 if (error != 0) {
3897                         mutex_exit(&connp->conn_lock);
3898                         goto ud_error;
3899                 }
3900         } else {
3901                 /* Simply update the destination address if no source route */
3902                 if (ixa->ixa_flags & IXAF_IS_IPV4) {
3903                         ipha_t  *ipha = (ipha_t *)connp->conn_ht_iphc;
3904 
3905                         IN6_V4MAPPED_TO_IPADDR(&v6dst, ipha->ipha_dst);
3906                         if (ixa->ixa_flags & IXAF_PMTU_IPV4_DF) {
3907                                 ipha->ipha_fragment_offset_and_flags |=
3908                                     IPH_DF_HTONS;
3909                         } else {
3910                                 ipha->ipha_fragment_offset_and_flags &=
3911                                     ~IPH_DF_HTONS;
3912                         }
3913                 } else {
3914                         ip6_t *ip6h = (ip6_t *)connp->conn_ht_iphc;
3915                         ip6h->ip6_dst = v6dst;
3916                 }
3917         }
3918 
3919         /*
3920          * Remember the dst/dstport etc which corresponds to the built header
3921          * template and conn_ixa.
3922          */
3923         oldixa = conn_replace_ixa(connp, ixa);
3924         connp->conn_v6lastdst = v6dst;
3925         connp->conn_lastipversion = ipversion;
3926         connp->conn_lastdstport = dstport;
3927         connp->conn_lastflowinfo = flowinfo;
3928         connp->conn_lastscopeid = ixa->ixa_scopeid;
3929         connp->conn_lastsrcid = srcid;
3930         /* Also remember a source to use together with lastdst */
3931         connp->conn_v6lastsrc = v6src;
3932 
3933         data_mp = udp_prepend_header_template(connp, ixa, data_mp, &v6src,
3934             dstport, flowinfo, &error);
3935 
3936         /* Done with conn_t */
3937         mutex_exit(&connp->conn_lock);
3938         ixa_refrele(oldixa);
3939 
3940         if (data_mp == NULL) {
3941                 ASSERT(error != 0);
3942                 goto ud_error;
3943         }
3944 
3945         /* We're done.  Pass the packet to ip. */
3946         UDPS_BUMP_MIB(us, udpHCOutDatagrams);
3947 
3948         DTRACE_UDP5(send, mblk_t *, NULL, ip_xmit_attr_t *, ixa,
3949             void_ip_t *, data_mp->b_rptr, udp_t *, udp, udpha_t *,
3950             &data_mp->b_rptr[ixa->ixa_ip_hdr_length]);
3951 
3952         error = conn_ip_output(data_mp, ixa);
3953         /* No udpOutErrors if an error since IP increases its error counter */
3954         switch (error) {
3955         case 0:
3956                 break;
3957         case EWOULDBLOCK:
3958                 (void) ixa_check_drain_insert(connp, ixa);
3959                 error = 0;
3960                 break;
3961         case EADDRNOTAVAIL:
3962                 /*
3963                  * IXAF_VERIFY_SOURCE tells us to pick a better source.
3964                  * Don't have the application see that errno
3965                  */
3966                 error = ENETUNREACH;
3967                 /* FALLTHRU */
3968         default:
3969                 mutex_enter(&connp->conn_lock);
3970                 /*
3971                  * Clear the source and v6lastdst so we call ip_attr_connect
3972                  * for the next packet and try to pick a better source.
3973                  */
3974                 if (connp->conn_mcbc_bind)
3975                         connp->conn_saddr_v6 = ipv6_all_zeros;
3976                 else
3977                         connp->conn_saddr_v6 = connp->conn_bound_addr_v6;
3978                 connp->conn_v6lastdst = ipv6_all_zeros;
3979                 mutex_exit(&connp->conn_lock);
3980                 break;
3981         }
3982         ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3983         ixa->ixa_cred = connp->conn_cred; /* Restore */
3984         ixa->ixa_cpid = connp->conn_cpid;
3985         ixa_refrele(ixa);
3986         return (error);
3987 
3988 ud_error:
3989         ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3990         ixa->ixa_cred = connp->conn_cred; /* Restore */
3991         ixa->ixa_cpid = connp->conn_cpid;
3992         ixa_refrele(ixa);
3993 
3994         freemsg(data_mp);
3995         UDPS_BUMP_MIB(us, udpOutErrors);
3996         UDP_STAT(us, udp_out_err_output);
3997         return (error);
3998 }
3999 
4000 /* ARGSUSED */
4001 static void
4002 udp_wput_fallback(queue_t *wq, mblk_t *mp)
4003 {
4004 #ifdef DEBUG
4005         cmn_err(CE_CONT, "udp_wput_fallback: Message in fallback \n");
4006 #endif
4007         freemsg(mp);
4008 }
4009 
4010 
4011 /*
4012  * Handle special out-of-band ioctl requests (see PSARC/2008/265).
4013  */
4014 static void
4015 udp_wput_cmdblk(queue_t *q, mblk_t *mp)
4016 {
4017         void    *data;
4018         mblk_t  *datamp = mp->b_cont;
4019         conn_t  *connp = Q_TO_CONN(q);
4020         udp_t   *udp = connp->conn_udp;
4021         cmdblk_t *cmdp = (cmdblk_t *)mp->b_rptr;
4022 
4023         if (datamp == NULL || MBLKL(datamp) < cmdp->cb_len) {
4024                 cmdp->cb_error = EPROTO;
4025                 qreply(q, mp);
4026                 return;
4027         }
4028         data = datamp->b_rptr;
4029 
4030         mutex_enter(&connp->conn_lock);
4031         switch (cmdp->cb_cmd) {
4032         case TI_GETPEERNAME:
4033                 if (udp->udp_state != TS_DATA_XFER)
4034                         cmdp->cb_error = ENOTCONN;
4035                 else
4036                         cmdp->cb_error = conn_getpeername(connp, data,
4037                             &cmdp->cb_len);
4038                 break;
4039         case TI_GETMYNAME:
4040                 cmdp->cb_error = conn_getsockname(connp, data, &cmdp->cb_len);
4041                 break;
4042         default:
4043                 cmdp->cb_error = EINVAL;
4044                 break;
4045         }
4046         mutex_exit(&connp->conn_lock);
4047 
4048         qreply(q, mp);
4049 }
4050 
4051 static void
4052 udp_use_pure_tpi(udp_t *udp)
4053 {
4054         conn_t  *connp = udp->udp_connp;
4055 
4056         mutex_enter(&connp->conn_lock);
4057         udp->udp_issocket = B_FALSE;
4058         mutex_exit(&connp->conn_lock);
4059         UDP_STAT(udp->udp_us, udp_sock_fallback);
4060 }
4061 
4062 static void
4063 udp_wput_other(queue_t *q, mblk_t *mp)
4064 {
4065         uchar_t *rptr = mp->b_rptr;
4066         struct iocblk *iocp;
4067         conn_t  *connp = Q_TO_CONN(q);
4068         udp_t   *udp = connp->conn_udp;
4069         cred_t  *cr;
4070 
4071         switch (mp->b_datap->db_type) {
4072         case M_CMD:
4073                 udp_wput_cmdblk(q, mp);
4074                 return;
4075 
4076         case M_PROTO:
4077         case M_PCPROTO:
4078                 if (mp->b_wptr - rptr < sizeof (t_scalar_t)) {
4079                         /*
4080                          * If the message does not contain a PRIM_type,
4081                          * throw it away.
4082                          */
4083                         freemsg(mp);
4084                         return;
4085                 }
4086                 switch (((t_primp_t)rptr)->type) {
4087                 case T_ADDR_REQ:
4088                         udp_addr_req(q, mp);
4089                         return;
4090                 case O_T_BIND_REQ:
4091                 case T_BIND_REQ:
4092                         udp_tpi_bind(q, mp);
4093                         return;
4094                 case T_CONN_REQ:
4095                         udp_tpi_connect(q, mp);
4096                         return;
4097                 case T_CAPABILITY_REQ:
4098                         udp_capability_req(q, mp);
4099                         return;
4100                 case T_INFO_REQ:
4101                         udp_info_req(q, mp);
4102                         return;
4103                 case T_UNITDATA_REQ:
4104                         /*
4105                          * If a T_UNITDATA_REQ gets here, the address must
4106                          * be bad.  Valid T_UNITDATA_REQs are handled
4107                          * in udp_wput.
4108                          */
4109                         udp_ud_err(q, mp, EADDRNOTAVAIL);
4110                         return;
4111                 case T_UNBIND_REQ:
4112                         udp_tpi_unbind(q, mp);
4113                         return;
4114                 case T_SVR4_OPTMGMT_REQ:
4115                         /*
4116                          * All Solaris components should pass a db_credp
4117                          * for this TPI message, hence we ASSERT.
4118                          * But in case there is some other M_PROTO that looks
4119                          * like a TPI message sent by some other kernel
4120                          * component, we check and return an error.
4121                          */
4122                         cr = msg_getcred(mp, NULL);
4123                         ASSERT(cr != NULL);
4124                         if (cr == NULL) {
4125                                 udp_err_ack(q, mp, TSYSERR, EINVAL);
4126                                 return;
4127                         }
4128                         if (!snmpcom_req(q, mp, udp_snmp_set, ip_snmp_get,
4129                             cr)) {
4130                                 svr4_optcom_req(q, mp, cr, &udp_opt_obj);
4131                         }
4132                         return;
4133 
4134                 case T_OPTMGMT_REQ:
4135                         /*
4136                          * All Solaris components should pass a db_credp
4137                          * for this TPI message, hence we ASSERT.
4138                          * But in case there is some other M_PROTO that looks
4139                          * like a TPI message sent by some other kernel
4140                          * component, we check and return an error.
4141                          */
4142                         cr = msg_getcred(mp, NULL);
4143                         ASSERT(cr != NULL);
4144                         if (cr == NULL) {
4145                                 udp_err_ack(q, mp, TSYSERR, EINVAL);
4146                                 return;
4147                         }
4148                         tpi_optcom_req(q, mp, cr, &udp_opt_obj);
4149                         return;
4150 
4151                 case T_DISCON_REQ:
4152                         udp_tpi_disconnect(q, mp);
4153                         return;
4154 
4155                 /* The following TPI message is not supported by udp. */
4156                 case O_T_CONN_RES:
4157                 case T_CONN_RES:
4158                         udp_err_ack(q, mp, TNOTSUPPORT, 0);
4159                         return;
4160 
4161                 /* The following 3 TPI requests are illegal for udp. */
4162                 case T_DATA_REQ:
4163                 case T_EXDATA_REQ:
4164                 case T_ORDREL_REQ:
4165                         udp_err_ack(q, mp, TNOTSUPPORT, 0);
4166                         return;
4167                 default:
4168                         break;
4169                 }
4170                 break;
4171         case M_FLUSH:
4172                 if (*rptr & FLUSHW)
4173                         flushq(q, FLUSHDATA);
4174                 break;
4175         case M_IOCTL:
4176                 iocp = (struct iocblk *)mp->b_rptr;
4177                 switch (iocp->ioc_cmd) {
4178                 case TI_GETPEERNAME:
4179                         if (udp->udp_state != TS_DATA_XFER) {
4180                                 /*
4181                                  * If a default destination address has not
4182                                  * been associated with the stream, then we
4183                                  * don't know the peer's name.
4184                                  */
4185                                 iocp->ioc_error = ENOTCONN;
4186                                 iocp->ioc_count = 0;
4187                                 mp->b_datap->db_type = M_IOCACK;
4188                                 qreply(q, mp);
4189                                 return;
4190                         }
4191                         /* FALLTHRU */
4192                 case TI_GETMYNAME:
4193                         /*
4194                          * For TI_GETPEERNAME and TI_GETMYNAME, we first
4195                          * need to copyin the user's strbuf structure.
4196                          * Processing will continue in the M_IOCDATA case
4197                          * below.
4198                          */
4199                         mi_copyin(q, mp, NULL,
4200                             SIZEOF_STRUCT(strbuf, iocp->ioc_flag));
4201                         return;
4202                 case _SIOCSOCKFALLBACK:
4203                         /*
4204                          * Either sockmod is about to be popped and the
4205                          * socket would now be treated as a plain stream,
4206                          * or a module is about to be pushed so we have
4207                          * to follow pure TPI semantics.
4208                          */
4209                         if (!udp->udp_issocket) {
4210                                 DB_TYPE(mp) = M_IOCNAK;
4211                                 iocp->ioc_error = EINVAL;
4212                         } else {
4213                                 udp_use_pure_tpi(udp);
4214 
4215                                 DB_TYPE(mp) = M_IOCACK;
4216                                 iocp->ioc_error = 0;
4217                         }
4218                         iocp->ioc_count = 0;
4219                         iocp->ioc_rval = 0;
4220                         qreply(q, mp);
4221                         return;
4222                 default:
4223                         break;
4224                 }
4225                 break;
4226         case M_IOCDATA:
4227                 udp_wput_iocdata(q, mp);
4228                 return;
4229         default:
4230                 /* Unrecognized messages are passed through without change. */
4231                 break;
4232         }
4233         ip_wput_nondata(q, mp);
4234 }
4235 
4236 /*
4237  * udp_wput_iocdata is called by udp_wput_other to handle all M_IOCDATA
4238  * messages.
4239  */
4240 static void
4241 udp_wput_iocdata(queue_t *q, mblk_t *mp)
4242 {
4243         mblk_t          *mp1;
4244         struct  iocblk *iocp = (struct iocblk *)mp->b_rptr;
4245         STRUCT_HANDLE(strbuf, sb);
4246         uint_t          addrlen;
4247         conn_t          *connp = Q_TO_CONN(q);
4248         udp_t           *udp = connp->conn_udp;
4249 
4250         /* Make sure it is one of ours. */
4251         switch (iocp->ioc_cmd) {
4252         case TI_GETMYNAME:
4253         case TI_GETPEERNAME:
4254                 break;
4255         default:
4256                 ip_wput_nondata(q, mp);
4257                 return;
4258         }
4259 
4260         switch (mi_copy_state(q, mp, &mp1)) {
4261         case -1:
4262                 return;
4263         case MI_COPY_CASE(MI_COPY_IN, 1):
4264                 break;
4265         case MI_COPY_CASE(MI_COPY_OUT, 1):
4266                 /*
4267                  * The address has been copied out, so now
4268                  * copyout the strbuf.
4269                  */
4270                 mi_copyout(q, mp);
4271                 return;
4272         case MI_COPY_CASE(MI_COPY_OUT, 2):
4273                 /*
4274                  * The address and strbuf have been copied out.
4275                  * We're done, so just acknowledge the original
4276                  * M_IOCTL.
4277                  */
4278                 mi_copy_done(q, mp, 0);
4279                 return;
4280         default:
4281                 /*
4282                  * Something strange has happened, so acknowledge
4283                  * the original M_IOCTL with an EPROTO error.
4284                  */
4285                 mi_copy_done(q, mp, EPROTO);
4286                 return;
4287         }
4288 
4289         /*
4290          * Now we have the strbuf structure for TI_GETMYNAME
4291          * and TI_GETPEERNAME.  Next we copyout the requested
4292          * address and then we'll copyout the strbuf.
4293          */
4294         STRUCT_SET_HANDLE(sb, iocp->ioc_flag, (void *)mp1->b_rptr);
4295 
4296         if (connp->conn_family == AF_INET)
4297                 addrlen = sizeof (sin_t);
4298         else
4299                 addrlen = sizeof (sin6_t);
4300 
4301         if (STRUCT_FGET(sb, maxlen) < addrlen) {
4302                 mi_copy_done(q, mp, EINVAL);
4303                 return;
4304         }
4305 
4306         switch (iocp->ioc_cmd) {
4307         case TI_GETMYNAME:
4308                 break;
4309         case TI_GETPEERNAME:
4310                 if (udp->udp_state != TS_DATA_XFER) {
4311                         mi_copy_done(q, mp, ENOTCONN);
4312                         return;
4313                 }
4314                 break;
4315         }
4316         mp1 = mi_copyout_alloc(q, mp, STRUCT_FGETP(sb, buf), addrlen, B_TRUE);
4317         if (!mp1)
4318                 return;
4319 
4320         STRUCT_FSET(sb, len, addrlen);
4321         switch (((struct iocblk *)mp->b_rptr)->ioc_cmd) {
4322         case TI_GETMYNAME:
4323                 (void) conn_getsockname(connp, (struct sockaddr *)mp1->b_wptr,
4324                     &addrlen);
4325                 break;
4326         case TI_GETPEERNAME:
4327                 (void) conn_getpeername(connp, (struct sockaddr *)mp1->b_wptr,
4328                     &addrlen);
4329                 break;
4330         }
4331         mp1->b_wptr += addrlen;
4332         /* Copy out the address */
4333         mi_copyout(q, mp);
4334 }
4335 
4336 void
4337 udp_ddi_g_init(void)
4338 {
4339         udp_max_optsize = optcom_max_optsize(udp_opt_obj.odb_opt_des_arr,
4340             udp_opt_obj.odb_opt_arr_cnt);
4341 
4342         /*
4343          * We want to be informed each time a stack is created or
4344          * destroyed in the kernel, so we can maintain the
4345          * set of udp_stack_t's.
4346          */
4347         netstack_register(NS_UDP, udp_stack_init, NULL, udp_stack_fini);
4348 }
4349 
4350 void
4351 udp_ddi_g_destroy(void)
4352 {
4353         netstack_unregister(NS_UDP);
4354 }
4355 
4356 #define INET_NAME       "ip"
4357 
4358 /*
4359  * Initialize the UDP stack instance.
4360  */
4361 static void *
4362 udp_stack_init(netstackid_t stackid, netstack_t *ns)
4363 {
4364         udp_stack_t     *us;
4365         int             i;
4366         int             error = 0;
4367         major_t         major;
4368         size_t          arrsz;
4369 
4370         us = (udp_stack_t *)kmem_zalloc(sizeof (*us), KM_SLEEP);
4371         us->us_netstack = ns;
4372 
4373         mutex_init(&us->us_epriv_port_lock, NULL, MUTEX_DEFAULT, NULL);
4374         us->us_num_epriv_ports = UDP_NUM_EPRIV_PORTS;
4375         us->us_epriv_ports[0] = ULP_DEF_EPRIV_PORT1;
4376         us->us_epriv_ports[1] = ULP_DEF_EPRIV_PORT2;
4377 
4378         /*
4379          * The smallest anonymous port in the priviledged port range which UDP
4380          * looks for free port.  Use in the option UDP_ANONPRIVBIND.
4381          */
4382         us->us_min_anonpriv_port = 512;
4383 
4384         us->us_bind_fanout_size = udp_bind_fanout_size;
4385 
4386         /* Roundup variable that might have been modified in /etc/system */
4387         if (us->us_bind_fanout_size & (us->us_bind_fanout_size - 1)) {
4388                 /* Not a power of two. Round up to nearest power of two */
4389                 for (i = 0; i < 31; i++) {
4390                         if (us->us_bind_fanout_size < (1 << i))
4391                                 break;
4392                 }
4393                 us->us_bind_fanout_size = 1 << i;
4394         }
4395         us->us_bind_fanout = kmem_zalloc(us->us_bind_fanout_size *
4396             sizeof (udp_fanout_t), KM_SLEEP);
4397         for (i = 0; i < us->us_bind_fanout_size; i++) {
4398                 mutex_init(&us->us_bind_fanout[i].uf_lock, NULL, MUTEX_DEFAULT,
4399                     NULL);
4400         }
4401 
4402         arrsz = udp_propinfo_count * sizeof (mod_prop_info_t);
4403         us->us_propinfo_tbl = (mod_prop_info_t *)kmem_alloc(arrsz,
4404             KM_SLEEP);
4405         bcopy(udp_propinfo_tbl, us->us_propinfo_tbl, arrsz);
4406 
4407         /* Allocate the per netstack stats */
4408         mutex_enter(&cpu_lock);
4409         us->us_sc_cnt = MAX(ncpus, boot_ncpus);
4410         mutex_exit(&cpu_lock);
4411         us->us_sc = kmem_zalloc(max_ncpus  * sizeof (udp_stats_cpu_t *),
4412             KM_SLEEP);
4413         for (i = 0; i < us->us_sc_cnt; i++) {
4414                 us->us_sc[i] = kmem_zalloc(sizeof (udp_stats_cpu_t),
4415                     KM_SLEEP);
4416         }
4417 
4418         us->us_kstat = udp_kstat2_init(stackid);
4419         us->us_mibkp = udp_kstat_init(stackid);
4420 
4421         major = mod_name_to_major(INET_NAME);
4422         error = ldi_ident_from_major(major, &us->us_ldi_ident);
4423         ASSERT(error == 0);
4424         return (us);
4425 }
4426 
4427 /*
4428  * Free the UDP stack instance.
4429  */
4430 static void
4431 udp_stack_fini(netstackid_t stackid, void *arg)
4432 {
4433         udp_stack_t *us = (udp_stack_t *)arg;
4434         int i;
4435 
4436         for (i = 0; i < us->us_bind_fanout_size; i++) {
4437                 mutex_destroy(&us->us_bind_fanout[i].uf_lock);
4438         }
4439 
4440         kmem_free(us->us_bind_fanout, us->us_bind_fanout_size *
4441             sizeof (udp_fanout_t));
4442 
4443         us->us_bind_fanout = NULL;
4444 
4445         for (i = 0; i < us->us_sc_cnt; i++)
4446                 kmem_free(us->us_sc[i], sizeof (udp_stats_cpu_t));
4447         kmem_free(us->us_sc, max_ncpus * sizeof (udp_stats_cpu_t *));
4448 
4449         kmem_free(us->us_propinfo_tbl,
4450             udp_propinfo_count * sizeof (mod_prop_info_t));
4451         us->us_propinfo_tbl = NULL;
4452 
4453         udp_kstat_fini(stackid, us->us_mibkp);
4454         us->us_mibkp = NULL;
4455 
4456         udp_kstat2_fini(stackid, us->us_kstat);
4457         us->us_kstat = NULL;
4458 
4459         mutex_destroy(&us->us_epriv_port_lock);
4460         ldi_ident_release(us->us_ldi_ident);
4461         kmem_free(us, sizeof (*us));
4462 }
4463 
4464 static size_t
4465 udp_set_rcv_hiwat(udp_t *udp, size_t size)
4466 {
4467         udp_stack_t *us = udp->udp_us;
4468 
4469         /* We add a bit of extra buffering */
4470         size += size >> 1;
4471         if (size > us->us_max_buf)
4472                 size = us->us_max_buf;
4473 
4474         udp->udp_rcv_hiwat = size;
4475         return (size);
4476 }
4477 
4478 /*
4479  * For the lower queue so that UDP can be a dummy mux.
4480  * Nobody should be sending
4481  * packets up this stream
4482  */
4483 static void
4484 udp_lrput(queue_t *q, mblk_t *mp)
4485 {
4486         switch (mp->b_datap->db_type) {
4487         case M_FLUSH:
4488                 /* Turn around */
4489                 if (*mp->b_rptr & FLUSHW) {
4490                         *mp->b_rptr &= ~FLUSHR;
4491                         qreply(q, mp);
4492                         return;
4493                 }
4494                 break;
4495         }
4496         freemsg(mp);
4497 }
4498 
4499 /*
4500  * For the lower queue so that UDP can be a dummy mux.
4501  * Nobody should be sending packets down this stream.
4502  */
4503 /* ARGSUSED */
4504 void
4505 udp_lwput(queue_t *q, mblk_t *mp)
4506 {
4507         freemsg(mp);
4508 }
4509 
4510 /*
4511  * When a CPU is added, we need to allocate the per CPU stats struct.
4512  */
4513 void
4514 udp_stack_cpu_add(udp_stack_t *us, processorid_t cpu_seqid)
4515 {
4516         int i;
4517 
4518         if (cpu_seqid < us->us_sc_cnt)
4519                 return;
4520         for (i = us->us_sc_cnt; i <= cpu_seqid; i++) {
4521                 ASSERT(us->us_sc[i] == NULL);
4522                 us->us_sc[i] = kmem_zalloc(sizeof (udp_stats_cpu_t),
4523                     KM_SLEEP);
4524         }
4525         membar_producer();
4526         us->us_sc_cnt = cpu_seqid + 1;
4527 }
4528 
4529 /*
4530  * Below routines for UDP socket module.
4531  */
4532 
4533 static conn_t *
4534 udp_do_open(cred_t *credp, boolean_t isv6, int flags, int *errorp)
4535 {
4536         udp_t           *udp;
4537         conn_t          *connp;
4538         zoneid_t        zoneid;
4539         netstack_t      *ns;
4540         udp_stack_t     *us;
4541         int             len;
4542 
4543         ASSERT(errorp != NULL);
4544 
4545         if ((*errorp = secpolicy_basic_net_access(credp)) != 0)
4546                 return (NULL);
4547 
4548         ns = netstack_find_by_cred(credp);
4549         ASSERT(ns != NULL);
4550         us = ns->netstack_udp;
4551         ASSERT(us != NULL);
4552 
4553         /*
4554          * For exclusive stacks we set the zoneid to zero
4555          * to make UDP operate as if in the global zone.
4556          */
4557         if (ns->netstack_stackid != GLOBAL_NETSTACKID)
4558                 zoneid = GLOBAL_ZONEID;
4559         else
4560                 zoneid = crgetzoneid(credp);
4561 
4562         ASSERT(flags == KM_SLEEP || flags == KM_NOSLEEP);
4563 
4564         connp = ipcl_conn_create(IPCL_UDPCONN, flags, ns);
4565         if (connp == NULL) {
4566                 netstack_rele(ns);
4567                 *errorp = ENOMEM;
4568                 return (NULL);
4569         }
4570         udp = connp->conn_udp;
4571 
4572         /*
4573          * ipcl_conn_create did a netstack_hold. Undo the hold that was
4574          * done by netstack_find_by_cred()
4575          */
4576         netstack_rele(ns);
4577 
4578         /*
4579          * Since this conn_t/udp_t is not yet visible to anybody else we don't
4580          * need to lock anything.
4581          */
4582         ASSERT(connp->conn_proto == IPPROTO_UDP);
4583         ASSERT(connp->conn_udp == udp);
4584         ASSERT(udp->udp_connp == connp);
4585 
4586         /* Set the initial state of the stream and the privilege status. */
4587         udp->udp_state = TS_UNBND;
4588         connp->conn_ixa->ixa_flags |= IXAF_VERIFY_SOURCE;
4589         if (isv6) {
4590                 connp->conn_family = AF_INET6;
4591                 connp->conn_ipversion = IPV6_VERSION;
4592                 connp->conn_ixa->ixa_flags &= ~IXAF_IS_IPV4;
4593                 connp->conn_default_ttl = us->us_ipv6_hoplimit;
4594                 len = sizeof (ip6_t) + UDPH_SIZE;
4595         } else {
4596                 connp->conn_family = AF_INET;
4597                 connp->conn_ipversion = IPV4_VERSION;
4598                 connp->conn_ixa->ixa_flags |= IXAF_IS_IPV4;
4599                 connp->conn_default_ttl = us->us_ipv4_ttl;
4600                 len = sizeof (ipha_t) + UDPH_SIZE;
4601         }
4602 
4603         ASSERT(connp->conn_ixa->ixa_protocol == connp->conn_proto);
4604         connp->conn_xmit_ipp.ipp_unicast_hops = connp->conn_default_ttl;
4605 
4606         connp->conn_ixa->ixa_multicast_ttl = IP_DEFAULT_MULTICAST_TTL;
4607         connp->conn_ixa->ixa_flags |= IXAF_MULTICAST_LOOP | IXAF_SET_ULP_CKSUM;
4608         /* conn_allzones can not be set this early, hence no IPCL_ZONEID */
4609         connp->conn_ixa->ixa_zoneid = zoneid;
4610 
4611         connp->conn_zoneid = zoneid;
4612 
4613         /*
4614          * If the caller has the process-wide flag set, then default to MAC
4615          * exempt mode.  This allows read-down to unlabeled hosts.
4616          */
4617         if (getpflags(NET_MAC_AWARE, credp) != 0)
4618                 connp->conn_mac_mode = CONN_MAC_AWARE;
4619 
4620         connp->conn_zone_is_global = (crgetzoneid(credp) == GLOBAL_ZONEID);
4621 
4622         udp->udp_us = us;
4623 
4624         connp->conn_rcvbuf = us->us_recv_hiwat;
4625         connp->conn_sndbuf = us->us_xmit_hiwat;
4626         connp->conn_sndlowat = us->us_xmit_lowat;
4627         connp->conn_rcvlowat = udp_mod_info.mi_lowat;
4628 
4629         connp->conn_wroff = len + us->us_wroff_extra;
4630         connp->conn_so_type = SOCK_DGRAM;
4631 
4632         connp->conn_recv = udp_input;
4633         connp->conn_recvicmp = udp_icmp_input;
4634         crhold(credp);
4635         connp->conn_cred = credp;
4636         connp->conn_cpid = curproc->p_pid;
4637         connp->conn_open_time = ddi_get_lbolt64();
4638         /* Cache things in ixa without an extra refhold */
4639         ASSERT(!(connp->conn_ixa->ixa_free_flags & IXA_FREE_CRED));
4640         connp->conn_ixa->ixa_cred = connp->conn_cred;
4641         connp->conn_ixa->ixa_cpid = connp->conn_cpid;
4642         if (is_system_labeled())
4643                 connp->conn_ixa->ixa_tsl = crgetlabel(connp->conn_cred);
4644 
4645         *((sin6_t *)&udp->udp_delayed_addr) = sin6_null;
4646 
4647         if (us->us_pmtu_discovery)
4648                 connp->conn_ixa->ixa_flags |= IXAF_PMTU_DISCOVERY;
4649 
4650         return (connp);
4651 }
4652 
4653 sock_lower_handle_t
4654 udp_create(int family, int type, int proto, sock_downcalls_t **sock_downcalls,
4655     uint_t *smodep, int *errorp, int flags, cred_t *credp)
4656 {
4657         udp_t           *udp = NULL;
4658         udp_stack_t     *us;
4659         conn_t          *connp;
4660         boolean_t       isv6;
4661 
4662         if (type != SOCK_DGRAM || (family != AF_INET && family != AF_INET6) ||
4663             (proto != 0 && proto != IPPROTO_UDP)) {
4664                 *errorp = EPROTONOSUPPORT;
4665                 return (NULL);
4666         }
4667 
4668         if (family == AF_INET6)
4669                 isv6 = B_TRUE;
4670         else
4671                 isv6 = B_FALSE;
4672 
4673         connp = udp_do_open(credp, isv6, flags, errorp);
4674         if (connp == NULL)
4675                 return (NULL);
4676 
4677         udp = connp->conn_udp;
4678         ASSERT(udp != NULL);
4679         us = udp->udp_us;
4680         ASSERT(us != NULL);
4681 
4682         udp->udp_issocket = B_TRUE;
4683         connp->conn_flags |= IPCL_NONSTR;
4684 
4685         /*
4686          * Set flow control
4687          * Since this conn_t/udp_t is not yet visible to anybody else we don't
4688          * need to lock anything.
4689          */
4690         (void) udp_set_rcv_hiwat(udp, connp->conn_rcvbuf);
4691         udp->udp_rcv_disply_hiwat = connp->conn_rcvbuf;
4692 
4693         connp->conn_flow_cntrld = B_FALSE;
4694 
4695         mutex_enter(&connp->conn_lock);
4696         connp->conn_state_flags &= ~CONN_INCIPIENT;
4697         mutex_exit(&connp->conn_lock);
4698 
4699         *errorp = 0;
4700         *smodep = SM_ATOMIC;
4701         *sock_downcalls = &sock_udp_downcalls;
4702         return ((sock_lower_handle_t)connp);
4703 }
4704 
4705 /* ARGSUSED3 */
4706 void
4707 udp_activate(sock_lower_handle_t proto_handle, sock_upper_handle_t sock_handle,
4708     sock_upcalls_t *sock_upcalls, int flags, cred_t *cr)
4709 {
4710         conn_t          *connp = (conn_t *)proto_handle;
4711         struct sock_proto_props sopp;
4712 
4713         /* All Solaris components should pass a cred for this operation. */
4714         ASSERT(cr != NULL);
4715 
4716         connp->conn_upcalls = sock_upcalls;
4717         connp->conn_upper_handle = sock_handle;
4718 
4719         sopp.sopp_flags = SOCKOPT_WROFF | SOCKOPT_RCVHIWAT | SOCKOPT_RCVLOWAT |
4720             SOCKOPT_MAXBLK | SOCKOPT_MAXPSZ | SOCKOPT_MINPSZ;
4721         sopp.sopp_wroff = connp->conn_wroff;
4722         sopp.sopp_maxblk = INFPSZ;
4723         sopp.sopp_rxhiwat = connp->conn_rcvbuf;
4724         sopp.sopp_rxlowat = connp->conn_rcvlowat;
4725         sopp.sopp_maxaddrlen = sizeof (sin6_t);
4726         sopp.sopp_maxpsz =
4727             (connp->conn_family == AF_INET) ? UDP_MAXPACKET_IPV4 :
4728             UDP_MAXPACKET_IPV6;
4729         sopp.sopp_minpsz = (udp_mod_info.mi_minpsz == 1) ? 0 :
4730             udp_mod_info.mi_minpsz;
4731 
4732         (*connp->conn_upcalls->su_set_proto_props)(connp->conn_upper_handle,
4733             &sopp);
4734 }
4735 
4736 static void
4737 udp_do_close(conn_t *connp)
4738 {
4739         udp_t   *udp;
4740 
4741         ASSERT(connp != NULL && IPCL_IS_UDP(connp));
4742         udp = connp->conn_udp;
4743 
4744         if (cl_inet_unbind != NULL && udp->udp_state == TS_IDLE) {
4745                 /*
4746                  * Running in cluster mode - register unbind information
4747                  */
4748                 if (connp->conn_ipversion == IPV4_VERSION) {
4749                         (*cl_inet_unbind)(
4750                             connp->conn_netstack->netstack_stackid,
4751                             IPPROTO_UDP, AF_INET,
4752                             (uint8_t *)(&V4_PART_OF_V6(connp->conn_laddr_v6)),
4753                             (in_port_t)connp->conn_lport, NULL);
4754                 } else {
4755                         (*cl_inet_unbind)(
4756                             connp->conn_netstack->netstack_stackid,
4757                             IPPROTO_UDP, AF_INET6,
4758                             (uint8_t *)&(connp->conn_laddr_v6),
4759                             (in_port_t)connp->conn_lport, NULL);
4760                 }
4761         }
4762 
4763         udp_bind_hash_remove(udp, B_FALSE);
4764 
4765         ip_quiesce_conn(connp);
4766 
4767         if (!IPCL_IS_NONSTR(connp)) {
4768                 ASSERT(connp->conn_wq != NULL);
4769                 ASSERT(connp->conn_rq != NULL);
4770                 qprocsoff(connp->conn_rq);
4771         }
4772 
4773         udp_close_free(connp);
4774 
4775         /*
4776          * Now we are truly single threaded on this stream, and can
4777          * delete the things hanging off the connp, and finally the connp.
4778          * We removed this connp from the fanout list, it cannot be
4779          * accessed thru the fanouts, and we already waited for the
4780          * conn_ref to drop to 0. We are already in close, so
4781          * there cannot be any other thread from the top. qprocsoff
4782          * has completed, and service has completed or won't run in
4783          * future.
4784          */
4785         ASSERT(connp->conn_ref == 1);
4786 
4787         if (!IPCL_IS_NONSTR(connp)) {
4788                 inet_minor_free(connp->conn_minor_arena, connp->conn_dev);
4789         } else {
4790                 ip_free_helper_stream(connp);
4791         }
4792 
4793         connp->conn_ref--;
4794         ipcl_conn_destroy(connp);
4795 }
4796 
4797 /* ARGSUSED1 */
4798 int
4799 udp_close(sock_lower_handle_t proto_handle, int flags, cred_t *cr)
4800 {
4801         conn_t  *connp = (conn_t *)proto_handle;
4802 
4803         /* All Solaris components should pass a cred for this operation. */
4804         ASSERT(cr != NULL);
4805 
4806         udp_do_close(connp);
4807         return (0);
4808 }
4809 
4810 static int
4811 udp_do_bind(conn_t *connp, struct sockaddr *sa, socklen_t len, cred_t *cr,
4812     boolean_t bind_to_req_port_only)
4813 {
4814         sin_t           *sin;
4815         sin6_t          *sin6;
4816         udp_t           *udp = connp->conn_udp;
4817         int             error = 0;
4818         ip_laddr_t      laddr_type = IPVL_UNICAST_UP;   /* INADDR_ANY */
4819         in_port_t       port;           /* Host byte order */
4820         in_port_t       requested_port; /* Host byte order */
4821         int             count;
4822         ipaddr_t        v4src;          /* Set if AF_INET */
4823         in6_addr_t      v6src;
4824         int             loopmax;
4825         udp_fanout_t    *udpf;
4826         in_port_t       lport;          /* Network byte order */
4827         uint_t          scopeid = 0;
4828         zoneid_t        zoneid = IPCL_ZONEID(connp);
4829         ip_stack_t      *ipst = connp->conn_netstack->netstack_ip;
4830         boolean_t       is_inaddr_any;
4831         mlp_type_t      addrtype, mlptype;
4832         udp_stack_t     *us = udp->udp_us;
4833 
4834         switch (len) {
4835         case sizeof (sin_t):    /* Complete IPv4 address */
4836                 sin = (sin_t *)sa;
4837 
4838                 if (sin == NULL || !OK_32PTR((char *)sin))
4839                         return (EINVAL);
4840 
4841                 if (connp->conn_family != AF_INET ||
4842                     sin->sin_family != AF_INET) {
4843                         return (EAFNOSUPPORT);
4844                 }
4845                 v4src = sin->sin_addr.s_addr;
4846                 IN6_IPADDR_TO_V4MAPPED(v4src, &v6src);
4847                 if (v4src != INADDR_ANY) {
4848                         laddr_type = ip_laddr_verify_v4(v4src, zoneid, ipst,
4849                             B_TRUE);
4850                 }
4851                 port = ntohs(sin->sin_port);
4852                 break;
4853 
4854         case sizeof (sin6_t):   /* complete IPv6 address */
4855                 sin6 = (sin6_t *)sa;
4856 
4857                 if (sin6 == NULL || !OK_32PTR((char *)sin6))
4858                         return (EINVAL);
4859 
4860                 if (connp->conn_family != AF_INET6 ||
4861                     sin6->sin6_family != AF_INET6) {
4862                         return (EAFNOSUPPORT);
4863                 }
4864                 v6src = sin6->sin6_addr;
4865                 if (IN6_IS_ADDR_V4MAPPED(&v6src)) {
4866                         if (connp->conn_ipv6_v6only)
4867                                 return (EADDRNOTAVAIL);
4868 
4869                         IN6_V4MAPPED_TO_IPADDR(&v6src, v4src);
4870                         if (v4src != INADDR_ANY) {
4871                                 laddr_type = ip_laddr_verify_v4(v4src,
4872                                     zoneid, ipst, B_FALSE);
4873                         }
4874                 } else {
4875                         if (!IN6_IS_ADDR_UNSPECIFIED(&v6src)) {
4876                                 if (IN6_IS_ADDR_LINKSCOPE(&v6src))
4877                                         scopeid = sin6->sin6_scope_id;
4878                                 laddr_type = ip_laddr_verify_v6(&v6src,
4879                                     zoneid, ipst, B_TRUE, scopeid);
4880                         }
4881                 }
4882                 port = ntohs(sin6->sin6_port);
4883                 break;
4884 
4885         default:                /* Invalid request */
4886                 (void) strlog(UDP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE,
4887                     "udp_bind: bad ADDR_length length %u", len);
4888                 return (-TBADADDR);
4889         }
4890 
4891         /* Is the local address a valid unicast, multicast, or broadcast? */
4892         if (laddr_type == IPVL_BAD)
4893                 return (EADDRNOTAVAIL);
4894 
4895         requested_port = port;
4896 
4897         if (requested_port == 0 || !bind_to_req_port_only)
4898                 bind_to_req_port_only = B_FALSE;
4899         else            /* T_BIND_REQ and requested_port != 0 */
4900                 bind_to_req_port_only = B_TRUE;
4901 
4902         if (requested_port == 0) {
4903                 /*
4904                  * If the application passed in zero for the port number, it
4905                  * doesn't care which port number we bind to. Get one in the
4906                  * valid range.
4907                  */
4908                 if (connp->conn_anon_priv_bind) {
4909                         port = udp_get_next_priv_port(udp);
4910                 } else {
4911                         port = udp_update_next_port(udp,
4912                             us->us_next_port_to_try, B_TRUE);
4913                 }
4914         } else {
4915                 /*
4916                  * If the port is in the well-known privileged range,
4917                  * make sure the caller was privileged.
4918                  */
4919                 int i;
4920                 boolean_t priv = B_FALSE;
4921 
4922                 if (port < us->us_smallest_nonpriv_port) {
4923                         priv = B_TRUE;
4924                 } else {
4925                         for (i = 0; i < us->us_num_epriv_ports; i++) {
4926                                 if (port == us->us_epriv_ports[i]) {
4927                                         priv = B_TRUE;
4928                                         break;
4929                                 }
4930                         }
4931                 }
4932 
4933                 if (priv) {
4934                         if (secpolicy_net_privaddr(cr, port, IPPROTO_UDP) != 0)
4935                                 return (-TACCES);
4936                 }
4937         }
4938 
4939         if (port == 0)
4940                 return (-TNOADDR);
4941 
4942         /*
4943          * The state must be TS_UNBND. TPI mandates that users must send
4944          * TPI primitives only 1 at a time and wait for the response before
4945          * sending the next primitive.
4946          */
4947         mutex_enter(&connp->conn_lock);
4948         if (udp->udp_state != TS_UNBND) {
4949                 mutex_exit(&connp->conn_lock);
4950                 (void) strlog(UDP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE,
4951                     "udp_bind: bad state, %u", udp->udp_state);
4952                 return (-TOUTSTATE);
4953         }
4954         /*
4955          * Copy the source address into our udp structure. This address
4956          * may still be zero; if so, IP will fill in the correct address
4957          * each time an outbound packet is passed to it. Since the udp is
4958          * not yet in the bind hash list, we don't grab the uf_lock to
4959          * change conn_ipversion
4960          */
4961         if (connp->conn_family == AF_INET) {
4962                 ASSERT(sin != NULL);
4963                 ASSERT(connp->conn_ixa->ixa_flags & IXAF_IS_IPV4);
4964         } else {
4965                 if (IN6_IS_ADDR_V4MAPPED(&v6src)) {
4966                         /*
4967                          * no need to hold the uf_lock to set the conn_ipversion
4968                          * since we are not yet in the fanout list
4969                          */
4970                         connp->conn_ipversion = IPV4_VERSION;
4971                         connp->conn_ixa->ixa_flags |= IXAF_IS_IPV4;
4972                 } else {
4973                         connp->conn_ipversion = IPV6_VERSION;
4974                         connp->conn_ixa->ixa_flags &= ~IXAF_IS_IPV4;
4975                 }
4976         }
4977 
4978         /*
4979          * If conn_reuseaddr is not set, then we have to make sure that
4980          * the IP address and port number the application requested
4981          * (or we selected for the application) is not being used by
4982          * another stream.  If another stream is already using the
4983          * requested IP address and port, the behavior depends on
4984          * "bind_to_req_port_only". If set the bind fails; otherwise we
4985          * search for any an unused port to bind to the stream.
4986          *
4987          * As per the BSD semantics, as modified by the Deering multicast
4988          * changes, if udp_reuseaddr is set, then we allow multiple binds
4989          * to the same port independent of the local IP address.
4990          *
4991          * This is slightly different than in SunOS 4.X which did not
4992          * support IP multicast. Note that the change implemented by the
4993          * Deering multicast code effects all binds - not only binding
4994          * to IP multicast addresses.
4995          *
4996          * Note that when binding to port zero we ignore SO_REUSEADDR in
4997          * order to guarantee a unique port.
4998          */
4999 
5000         count = 0;
5001         if (connp->conn_anon_priv_bind) {
5002                 /*
5003                  * loopmax = (IPPORT_RESERVED-1) -
5004                  *    us->us_min_anonpriv_port + 1
5005                  */
5006                 loopmax = IPPORT_RESERVED - us->us_min_anonpriv_port;
5007         } else {
5008                 loopmax = us->us_largest_anon_port -
5009                     us->us_smallest_anon_port + 1;
5010         }
5011 
5012         is_inaddr_any = V6_OR_V4_INADDR_ANY(v6src);
5013 
5014         for (;;) {
5015                 udp_t           *udp1;
5016                 boolean_t       found_exclbind = B_FALSE;
5017                 conn_t          *connp1;
5018 
5019                 /*
5020                  * Walk through the list of udp streams bound to
5021                  * requested port with the same IP address.
5022                  */
5023                 lport = htons(port);
5024                 udpf = &us->us_bind_fanout[UDP_BIND_HASH(lport,
5025                     us->us_bind_fanout_size)];
5026                 mutex_enter(&udpf->uf_lock);
5027                 for (udp1 = udpf->uf_udp; udp1 != NULL;
5028                     udp1 = udp1->udp_bind_hash) {
5029                         connp1 = udp1->udp_connp;
5030 
5031                         if (lport != connp1->conn_lport)
5032                                 continue;
5033 
5034                         /*
5035                          * On a labeled system, we must treat bindings to ports
5036                          * on shared IP addresses by sockets with MAC exemption
5037                          * privilege as being in all zones, as there's
5038                          * otherwise no way to identify the right receiver.
5039                          */
5040                         if (!IPCL_BIND_ZONE_MATCH(connp1, connp))
5041                                 continue;
5042 
5043                         /*
5044                          * If UDP_EXCLBIND is set for either the bound or
5045                          * binding endpoint, the semantics of bind
5046                          * is changed according to the following chart.
5047                          *
5048                          * spec = specified address (v4 or v6)
5049                          * unspec = unspecified address (v4 or v6)
5050                          * A = specified addresses are different for endpoints
5051                          *
5052                          * bound        bind to         allowed?
5053                          * -------------------------------------
5054                          * unspec       unspec          no
5055                          * unspec       spec            no
5056                          * spec         unspec          no
5057                          * spec         spec            yes if A
5058                          *
5059                          * For labeled systems, SO_MAC_EXEMPT behaves the same
5060                          * as UDP_EXCLBIND, except that zoneid is ignored.
5061                          */
5062                         if (connp1->conn_exclbind || connp->conn_exclbind ||
5063                             IPCL_CONNS_MAC(udp1->udp_connp, connp)) {
5064                                 if (V6_OR_V4_INADDR_ANY(
5065                                     connp1->conn_bound_addr_v6) ||
5066                                     is_inaddr_any ||
5067                                     IN6_ARE_ADDR_EQUAL(
5068                                     &connp1->conn_bound_addr_v6,
5069                                     &v6src)) {
5070                                         found_exclbind = B_TRUE;
5071                                         break;
5072                                 }
5073                                 continue;
5074                         }
5075 
5076                         /*
5077                          * Check ipversion to allow IPv4 and IPv6 sockets to
5078                          * have disjoint port number spaces.
5079                          */
5080                         if (connp->conn_ipversion != connp1->conn_ipversion) {
5081 
5082                                 /*
5083                                  * On the first time through the loop, if the
5084                                  * the user intentionally specified a
5085                                  * particular port number, then ignore any
5086                                  * bindings of the other protocol that may
5087                                  * conflict. This allows the user to bind IPv6
5088                                  * alone and get both v4 and v6, or bind both
5089                                  * both and get each seperately. On subsequent
5090                                  * times through the loop, we're checking a
5091                                  * port that we chose (not the user) and thus
5092                                  * we do not allow casual duplicate bindings.
5093                                  */
5094                                 if (count == 0 && requested_port != 0)
5095                                         continue;
5096                         }
5097 
5098                         /*
5099                          * No difference depending on SO_REUSEADDR.
5100                          *
5101                          * If existing port is bound to a
5102                          * non-wildcard IP address and
5103                          * the requesting stream is bound to
5104                          * a distinct different IP addresses
5105                          * (non-wildcard, also), keep going.
5106                          */
5107                         if (!is_inaddr_any &&
5108                             !V6_OR_V4_INADDR_ANY(connp1->conn_bound_addr_v6) &&
5109                             !IN6_ARE_ADDR_EQUAL(&connp1->conn_laddr_v6,
5110                             &v6src)) {
5111                                 continue;
5112                         }
5113                         break;
5114                 }
5115 
5116                 if (!found_exclbind &&
5117                     (connp->conn_reuseaddr && requested_port != 0)) {
5118                         break;
5119                 }
5120 
5121                 if (udp1 == NULL) {
5122                         /*
5123                          * No other stream has this IP address
5124                          * and port number. We can use it.
5125                          */
5126                         break;
5127                 }
5128                 mutex_exit(&udpf->uf_lock);
5129                 if (bind_to_req_port_only) {
5130                         /*
5131                          * We get here only when requested port
5132                          * is bound (and only first  of the for()
5133                          * loop iteration).
5134                          *
5135                          * The semantics of this bind request
5136                          * require it to fail so we return from
5137                          * the routine (and exit the loop).
5138                          *
5139                          */
5140                         mutex_exit(&connp->conn_lock);
5141                         return (-TADDRBUSY);
5142                 }
5143 
5144                 if (connp->conn_anon_priv_bind) {
5145                         port = udp_get_next_priv_port(udp);
5146                 } else {
5147                         if ((count == 0) && (requested_port != 0)) {
5148                                 /*
5149                                  * If the application wants us to find
5150                                  * a port, get one to start with. Set
5151                                  * requested_port to 0, so that we will
5152                                  * update us->us_next_port_to_try below.
5153                                  */
5154                                 port = udp_update_next_port(udp,
5155                                     us->us_next_port_to_try, B_TRUE);
5156                                 requested_port = 0;
5157                         } else {
5158                                 port = udp_update_next_port(udp, port + 1,
5159                                     B_FALSE);
5160                         }
5161                 }
5162 
5163                 if (port == 0 || ++count >= loopmax) {
5164                         /*
5165                          * We've tried every possible port number and
5166                          * there are none available, so send an error
5167                          * to the user.
5168                          */
5169                         mutex_exit(&connp->conn_lock);
5170                         return (-TNOADDR);
5171                 }
5172         }
5173 
5174         /*
5175          * Copy the source address into our udp structure.  This address
5176          * may still be zero; if so, ip_attr_connect will fill in the correct
5177          * address when a packet is about to be sent.
5178          * If we are binding to a broadcast or multicast address then
5179          * we just set the conn_bound_addr since we don't want to use
5180          * that as the source address when sending.
5181          */
5182         connp->conn_bound_addr_v6 = v6src;
5183         connp->conn_laddr_v6 = v6src;
5184         if (scopeid != 0) {
5185                 connp->conn_ixa->ixa_flags |= IXAF_SCOPEID_SET;
5186                 connp->conn_ixa->ixa_scopeid = scopeid;
5187                 connp->conn_incoming_ifindex = scopeid;
5188         } else {
5189                 connp->conn_ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
5190                 connp->conn_incoming_ifindex = connp->conn_bound_if;
5191         }
5192 
5193         switch (laddr_type) {
5194         case IPVL_UNICAST_UP:
5195         case IPVL_UNICAST_DOWN:
5196                 connp->conn_saddr_v6 = v6src;
5197                 connp->conn_mcbc_bind = B_FALSE;
5198                 break;
5199         case IPVL_MCAST:
5200         case IPVL_BCAST:
5201                 /* ip_set_destination will pick a source address later */
5202                 connp->conn_saddr_v6 = ipv6_all_zeros;
5203                 connp->conn_mcbc_bind = B_TRUE;
5204                 break;
5205         }
5206 
5207         /* Any errors after this point should use late_error */
5208         connp->conn_lport = lport;
5209 
5210         /*
5211          * Now reset the next anonymous port if the application requested
5212          * an anonymous port, or we handed out the next anonymous port.
5213          */
5214         if ((requested_port == 0) && (!connp->conn_anon_priv_bind)) {
5215                 us->us_next_port_to_try = port + 1;
5216         }
5217 
5218         /* Initialize the T_BIND_ACK. */
5219         if (connp->conn_family == AF_INET) {
5220                 sin->sin_port = connp->conn_lport;
5221         } else {
5222                 sin6->sin6_port = connp->conn_lport;
5223         }
5224         udp->udp_state = TS_IDLE;
5225         udp_bind_hash_insert(udpf, udp);
5226         mutex_exit(&udpf->uf_lock);
5227         mutex_exit(&connp->conn_lock);
5228 
5229         if (cl_inet_bind) {
5230                 /*
5231                  * Running in cluster mode - register bind information
5232                  */
5233                 if (connp->conn_ipversion == IPV4_VERSION) {
5234                         (*cl_inet_bind)(connp->conn_netstack->netstack_stackid,
5235                             IPPROTO_UDP, AF_INET, (uint8_t *)&v4src,
5236                             (in_port_t)connp->conn_lport, NULL);
5237                 } else {
5238                         (*cl_inet_bind)(connp->conn_netstack->netstack_stackid,
5239                             IPPROTO_UDP, AF_INET6, (uint8_t *)&v6src,
5240                             (in_port_t)connp->conn_lport, NULL);
5241                 }
5242         }
5243 
5244         mutex_enter(&connp->conn_lock);
5245         connp->conn_anon_port = (is_system_labeled() && requested_port == 0);
5246         if (is_system_labeled() && (!connp->conn_anon_port ||
5247             connp->conn_anon_mlp)) {
5248                 uint16_t mlpport;
5249                 zone_t *zone;
5250 
5251                 zone = crgetzone(cr);
5252                 connp->conn_mlp_type =
5253                     connp->conn_recv_ancillary.crb_recvucred ? mlptBoth :
5254                     mlptSingle;
5255                 addrtype = tsol_mlp_addr_type(
5256                     connp->conn_allzones ? ALL_ZONES : zone->zone_id,
5257                     IPV6_VERSION, &v6src, us->us_netstack->netstack_ip);
5258                 if (addrtype == mlptSingle) {
5259                         error = -TNOADDR;
5260                         mutex_exit(&connp->conn_lock);
5261                         goto late_error;
5262                 }
5263                 mlpport = connp->conn_anon_port ? PMAPPORT : port;
5264                 mlptype = tsol_mlp_port_type(zone, IPPROTO_UDP, mlpport,
5265                     addrtype);
5266 
5267                 /*
5268                  * It is a coding error to attempt to bind an MLP port
5269                  * without first setting SOL_SOCKET/SCM_UCRED.
5270                  */
5271                 if (mlptype != mlptSingle &&
5272                     connp->conn_mlp_type == mlptSingle) {
5273                         error = EINVAL;
5274                         mutex_exit(&connp->conn_lock);
5275                         goto late_error;
5276                 }
5277 
5278                 /*
5279                  * It is an access violation to attempt to bind an MLP port
5280                  * without NET_BINDMLP privilege.
5281                  */
5282                 if (mlptype != mlptSingle &&
5283                     secpolicy_net_bindmlp(cr) != 0) {
5284                         if (connp->conn_debug) {
5285                                 (void) strlog(UDP_MOD_ID, 0, 1,
5286                                     SL_ERROR|SL_TRACE,
5287                                     "udp_bind: no priv for multilevel port %d",
5288                                     mlpport);
5289                         }
5290                         error = -TACCES;
5291                         mutex_exit(&connp->conn_lock);
5292                         goto late_error;
5293                 }
5294 
5295                 /*
5296                  * If we're specifically binding a shared IP address and the
5297                  * port is MLP on shared addresses, then check to see if this
5298                  * zone actually owns the MLP.  Reject if not.
5299                  */
5300                 if (mlptype == mlptShared && addrtype == mlptShared) {
5301                         /*
5302                          * No need to handle exclusive-stack zones since
5303                          * ALL_ZONES only applies to the shared stack.
5304                          */
5305                         zoneid_t mlpzone;
5306 
5307                         mlpzone = tsol_mlp_findzone(IPPROTO_UDP,
5308                             htons(mlpport));
5309                         if (connp->conn_zoneid != mlpzone) {
5310                                 if (connp->conn_debug) {
5311                                         (void) strlog(UDP_MOD_ID, 0, 1,
5312                                             SL_ERROR|SL_TRACE,
5313                                             "udp_bind: attempt to bind port "
5314                                             "%d on shared addr in zone %d "
5315                                             "(should be %d)",
5316                                             mlpport, connp->conn_zoneid,
5317                                             mlpzone);
5318                                 }
5319                                 error = -TACCES;
5320                                 mutex_exit(&connp->conn_lock);
5321                                 goto late_error;
5322                         }
5323                 }
5324                 if (connp->conn_anon_port) {
5325                         error = tsol_mlp_anon(zone, mlptype, connp->conn_proto,
5326                             port, B_TRUE);
5327                         if (error != 0) {
5328                                 if (connp->conn_debug) {
5329                                         (void) strlog(UDP_MOD_ID, 0, 1,
5330                                             SL_ERROR|SL_TRACE,
5331                                             "udp_bind: cannot establish anon "
5332                                             "MLP for port %d", port);
5333                                 }
5334                                 error = -TACCES;
5335                                 mutex_exit(&connp->conn_lock);
5336                                 goto late_error;
5337                         }
5338                 }
5339                 connp->conn_mlp_type = mlptype;
5340         }
5341 
5342         /*
5343          * We create an initial header template here to make a subsequent
5344          * sendto have a starting point. Since conn_last_dst is zero the
5345          * first sendto will always follow the 'dst changed' code path.
5346          * Note that we defer massaging options and the related checksum
5347          * adjustment until we have a destination address.
5348          */
5349         error = udp_build_hdr_template(connp, &connp->conn_saddr_v6,
5350             &connp->conn_faddr_v6, connp->conn_fport, connp->conn_flowinfo);
5351         if (error != 0) {
5352                 mutex_exit(&connp->conn_lock);
5353                 goto late_error;
5354         }
5355         /* Just in case */
5356         connp->conn_faddr_v6 = ipv6_all_zeros;
5357         connp->conn_fport = 0;
5358         connp->conn_v6lastdst = ipv6_all_zeros;
5359         mutex_exit(&connp->conn_lock);
5360 
5361         error = ip_laddr_fanout_insert(connp);
5362         if (error != 0)
5363                 goto late_error;
5364 
5365         /* Bind succeeded */
5366         return (0);
5367 
5368 late_error:
5369         /* We had already picked the port number, and then the bind failed */
5370         mutex_enter(&connp->conn_lock);
5371         udpf = &us->us_bind_fanout[
5372             UDP_BIND_HASH(connp->conn_lport,
5373             us->us_bind_fanout_size)];
5374         mutex_enter(&udpf->uf_lock);
5375         connp->conn_saddr_v6 = ipv6_all_zeros;
5376         connp->conn_bound_addr_v6 = ipv6_all_zeros;
5377         connp->conn_laddr_v6 = ipv6_all_zeros;
5378         if (scopeid != 0) {
5379                 connp->conn_ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
5380                 connp->conn_incoming_ifindex = connp->conn_bound_if;
5381         }
5382         udp->udp_state = TS_UNBND;
5383         udp_bind_hash_remove(udp, B_TRUE);
5384         connp->conn_lport = 0;
5385         mutex_exit(&udpf->uf_lock);
5386         connp->conn_anon_port = B_FALSE;
5387         connp->conn_mlp_type = mlptSingle;
5388 
5389         connp->conn_v6lastdst = ipv6_all_zeros;
5390 
5391         /* Restore the header that was built above - different source address */
5392         (void) udp_build_hdr_template(connp, &connp->conn_saddr_v6,
5393             &connp->conn_faddr_v6, connp->conn_fport, connp->conn_flowinfo);
5394         mutex_exit(&connp->conn_lock);
5395         return (error);
5396 }
5397 
5398 int
5399 udp_bind(sock_lower_handle_t proto_handle, struct sockaddr *sa,
5400     socklen_t len, cred_t *cr)
5401 {
5402         int             error;
5403         conn_t          *connp;
5404 
5405         /* All Solaris components should pass a cred for this operation. */
5406         ASSERT(cr != NULL);
5407 
5408         connp = (conn_t *)proto_handle;
5409 
5410         if (sa == NULL)
5411                 error = udp_do_unbind(connp);
5412         else
5413                 error = udp_do_bind(connp, sa, len, cr, B_TRUE);
5414 
5415         if (error < 0) {
5416                 if (error == -TOUTSTATE)
5417                         error = EINVAL;
5418                 else
5419                         error = proto_tlitosyserr(-error);
5420         }
5421 
5422         return (error);
5423 }
5424 
5425 static int
5426 udp_implicit_bind(conn_t *connp, cred_t *cr)
5427 {
5428         sin6_t sin6addr;
5429         sin_t *sin;
5430         sin6_t *sin6;
5431         socklen_t len;
5432         int error;
5433 
5434         /* All Solaris components should pass a cred for this operation. */
5435         ASSERT(cr != NULL);
5436 
5437         if (connp->conn_family == AF_INET) {
5438                 len = sizeof (struct sockaddr_in);
5439                 sin = (sin_t *)&sin6addr;
5440                 *sin = sin_null;
5441                 sin->sin_family = AF_INET;
5442                 sin->sin_addr.s_addr = INADDR_ANY;
5443         } else {
5444                 ASSERT(connp->conn_family == AF_INET6);
5445                 len = sizeof (sin6_t);
5446                 sin6 = (sin6_t *)&sin6addr;
5447                 *sin6 = sin6_null;
5448                 sin6->sin6_family = AF_INET6;
5449                 V6_SET_ZERO(sin6->sin6_addr);
5450         }
5451 
5452         error = udp_do_bind(connp, (struct sockaddr *)&sin6addr, len,
5453             cr, B_FALSE);
5454         return ((error < 0) ? proto_tlitosyserr(-error) : error);
5455 }
5456 
5457 /*
5458  * This routine removes a port number association from a stream. It
5459  * is called by udp_unbind and udp_tpi_unbind.
5460  */
5461 static int
5462 udp_do_unbind(conn_t *connp)
5463 {
5464         udp_t           *udp = connp->conn_udp;
5465         udp_fanout_t    *udpf;
5466         udp_stack_t     *us = udp->udp_us;
5467 
5468         if (cl_inet_unbind != NULL) {
5469                 /*
5470                  * Running in cluster mode - register unbind information
5471                  */
5472                 if (connp->conn_ipversion == IPV4_VERSION) {
5473                         (*cl_inet_unbind)(
5474                             connp->conn_netstack->netstack_stackid,
5475                             IPPROTO_UDP, AF_INET,
5476                             (uint8_t *)(&V4_PART_OF_V6(connp->conn_laddr_v6)),
5477                             (in_port_t)connp->conn_lport, NULL);
5478                 } else {
5479                         (*cl_inet_unbind)(
5480                             connp->conn_netstack->netstack_stackid,
5481                             IPPROTO_UDP, AF_INET6,
5482                             (uint8_t *)&(connp->conn_laddr_v6),
5483                             (in_port_t)connp->conn_lport, NULL);
5484                 }
5485         }
5486 
5487         mutex_enter(&connp->conn_lock);
5488         /* If a bind has not been done, we can't unbind. */
5489         if (udp->udp_state == TS_UNBND) {
5490                 mutex_exit(&connp->conn_lock);
5491                 return (-TOUTSTATE);
5492         }
5493         udpf = &us->us_bind_fanout[UDP_BIND_HASH(connp->conn_lport,
5494             us->us_bind_fanout_size)];
5495         mutex_enter(&udpf->uf_lock);
5496         udp_bind_hash_remove(udp, B_TRUE);
5497         connp->conn_saddr_v6 = ipv6_all_zeros;
5498         connp->conn_bound_addr_v6 = ipv6_all_zeros;
5499         connp->conn_laddr_v6 = ipv6_all_zeros;
5500         connp->conn_mcbc_bind = B_FALSE;
5501         connp->conn_lport = 0;
5502         /* In case we were also connected */
5503         connp->conn_faddr_v6 = ipv6_all_zeros;
5504         connp->conn_fport = 0;
5505         mutex_exit(&udpf->uf_lock);
5506 
5507         connp->conn_v6lastdst = ipv6_all_zeros;
5508         udp->udp_state = TS_UNBND;
5509 
5510         (void) udp_build_hdr_template(connp, &connp->conn_saddr_v6,
5511             &connp->conn_faddr_v6, connp->conn_fport, connp->conn_flowinfo);
5512         mutex_exit(&connp->conn_lock);
5513 
5514         ip_unbind(connp);
5515 
5516         return (0);
5517 }
5518 
5519 /*
5520  * It associates a default destination address with the stream.
5521  */
5522 static int
5523 udp_do_connect(conn_t *connp, const struct sockaddr *sa, socklen_t len,
5524     cred_t *cr, pid_t pid)
5525 {
5526         sin6_t          *sin6;
5527         sin_t           *sin;
5528         in6_addr_t      v6dst;
5529         ipaddr_t        v4dst;
5530         uint16_t        dstport;
5531         uint32_t        flowinfo;
5532         udp_fanout_t    *udpf;
5533         udp_t           *udp, *udp1;
5534         ushort_t        ipversion;
5535         udp_stack_t     *us;
5536         int             error;
5537         conn_t          *connp1;
5538         ip_xmit_attr_t  *ixa;
5539         ip_xmit_attr_t  *oldixa;
5540         uint_t          scopeid = 0;
5541         uint_t          srcid = 0;
5542         in6_addr_t      v6src = connp->conn_saddr_v6;
5543         boolean_t       v4mapped;
5544 
5545         udp = connp->conn_udp;
5546         us = udp->udp_us;
5547 
5548         /*
5549          * Address has been verified by the caller
5550          */
5551         switch (len) {
5552         default:
5553                 /*
5554                  * Should never happen
5555                  */
5556                 return (EINVAL);
5557 
5558         case sizeof (sin_t):
5559                 sin = (sin_t *)sa;
5560                 v4dst = sin->sin_addr.s_addr;
5561                 dstport = sin->sin_port;
5562                 IN6_IPADDR_TO_V4MAPPED(v4dst, &v6dst);
5563                 ASSERT(connp->conn_ipversion == IPV4_VERSION);
5564                 ipversion = IPV4_VERSION;
5565                 break;
5566 
5567         case sizeof (sin6_t):
5568                 sin6 = (sin6_t *)sa;
5569                 v6dst = sin6->sin6_addr;
5570                 dstport = sin6->sin6_port;
5571                 srcid = sin6->__sin6_src_id;
5572                 v4mapped = IN6_IS_ADDR_V4MAPPED(&v6dst);
5573                 if (srcid != 0 && IN6_IS_ADDR_UNSPECIFIED(&v6src)) {
5574                         if (!ip_srcid_find_id(srcid, &v6src, IPCL_ZONEID(connp),
5575                             v4mapped, connp->conn_netstack)) {
5576                                 /* Mismatch v4mapped/v6 specified by srcid. */
5577                                 return (EADDRNOTAVAIL);
5578                         }
5579                 }
5580                 if (v4mapped) {
5581                         if (connp->conn_ipv6_v6only)
5582                                 return (EADDRNOTAVAIL);
5583 
5584                         /*
5585                          * Destination adress is mapped IPv6 address.
5586                          * Source bound address should be unspecified or
5587                          * IPv6 mapped address as well.
5588                          */
5589                         if (!IN6_IS_ADDR_UNSPECIFIED(
5590                             &connp->conn_bound_addr_v6) &&
5591                             !IN6_IS_ADDR_V4MAPPED(&connp->conn_bound_addr_v6)) {
5592                                 return (EADDRNOTAVAIL);
5593                         }
5594                         IN6_V4MAPPED_TO_IPADDR(&v6dst, v4dst);
5595                         ipversion = IPV4_VERSION;
5596                         flowinfo = 0;
5597                 } else {
5598                         ipversion = IPV6_VERSION;
5599                         flowinfo = sin6->sin6_flowinfo;
5600                         if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
5601                                 scopeid = sin6->sin6_scope_id;
5602                 }
5603                 break;
5604         }
5605 
5606         if (dstport == 0)
5607                 return (-TBADADDR);
5608 
5609         /*
5610          * If there is a different thread using conn_ixa then we get a new
5611          * copy and cut the old one loose from conn_ixa. Otherwise we use
5612          * conn_ixa and prevent any other thread from using/changing it.
5613          * Once connect() is done other threads can use conn_ixa since the
5614          * refcnt will be back at one.
5615          * We defer updating conn_ixa until later to handle any concurrent
5616          * conn_ixa_cleanup thread.
5617          */
5618         ixa = conn_get_ixa(connp, B_FALSE);
5619         if (ixa == NULL)
5620                 return (ENOMEM);
5621 
5622         mutex_enter(&connp->conn_lock);
5623         /*
5624          * This udp_t must have bound to a port already before doing a connect.
5625          * Reject if a connect is in progress (we drop conn_lock during
5626          * udp_do_connect).
5627          */
5628         if (udp->udp_state == TS_UNBND || udp->udp_state == TS_WCON_CREQ) {
5629                 mutex_exit(&connp->conn_lock);
5630                 (void) strlog(UDP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE,
5631                     "udp_connect: bad state, %u", udp->udp_state);
5632                 ixa_refrele(ixa);
5633                 return (-TOUTSTATE);
5634         }
5635         ASSERT(connp->conn_lport != 0 && udp->udp_ptpbhn != NULL);
5636 
5637         udpf = &us->us_bind_fanout[UDP_BIND_HASH(connp->conn_lport,
5638             us->us_bind_fanout_size)];
5639 
5640         mutex_enter(&udpf->uf_lock);
5641         if (udp->udp_state == TS_DATA_XFER) {
5642                 /* Already connected - clear out state */
5643                 if (connp->conn_mcbc_bind)
5644                         connp->conn_saddr_v6 = ipv6_all_zeros;
5645                 else
5646                         connp->conn_saddr_v6 = connp->conn_bound_addr_v6;
5647                 connp->conn_laddr_v6 = connp->conn_bound_addr_v6;
5648                 connp->conn_faddr_v6 = ipv6_all_zeros;
5649                 connp->conn_fport = 0;
5650                 udp->udp_state = TS_IDLE;
5651         }
5652 
5653         connp->conn_fport = dstport;
5654         connp->conn_ipversion = ipversion;
5655         if (ipversion == IPV4_VERSION) {
5656                 /*
5657                  * Interpret a zero destination to mean loopback.
5658                  * Update the T_CONN_REQ (sin/sin6) since it is used to
5659                  * generate the T_CONN_CON.
5660                  */
5661                 if (v4dst == INADDR_ANY) {
5662                         v4dst = htonl(INADDR_LOOPBACK);
5663                         IN6_IPADDR_TO_V4MAPPED(v4dst, &v6dst);
5664                         if (connp->conn_family == AF_INET) {
5665                                 sin->sin_addr.s_addr = v4dst;
5666                         } else {
5667                                 sin6->sin6_addr = v6dst;
5668                         }
5669                 }
5670                 connp->conn_faddr_v6 = v6dst;
5671                 connp->conn_flowinfo = 0;
5672         } else {
5673                 ASSERT(connp->conn_ipversion == IPV6_VERSION);
5674                 /*
5675                  * Interpret a zero destination to mean loopback.
5676                  * Update the T_CONN_REQ (sin/sin6) since it is used to
5677                  * generate the T_CONN_CON.
5678                  */
5679                 if (IN6_IS_ADDR_UNSPECIFIED(&v6dst)) {
5680                         v6dst = ipv6_loopback;
5681                         sin6->sin6_addr = v6dst;
5682                 }
5683                 connp->conn_faddr_v6 = v6dst;
5684                 connp->conn_flowinfo = flowinfo;
5685         }
5686         mutex_exit(&udpf->uf_lock);
5687 
5688         /*
5689          * We update our cred/cpid based on the caller of connect
5690          */
5691         if (connp->conn_cred != cr) {
5692                 crhold(cr);
5693                 crfree(connp->conn_cred);
5694                 connp->conn_cred = cr;
5695         }
5696         connp->conn_cpid = pid;
5697         ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
5698         ixa->ixa_cred = cr;
5699         ixa->ixa_cpid = pid;
5700         if (is_system_labeled()) {
5701                 /* We need to restart with a label based on the cred */
5702                 ip_xmit_attr_restore_tsl(ixa, ixa->ixa_cred);
5703         }
5704 
5705         if (scopeid != 0) {
5706                 ixa->ixa_flags |= IXAF_SCOPEID_SET;
5707                 ixa->ixa_scopeid = scopeid;
5708                 connp->conn_incoming_ifindex = scopeid;
5709         } else {
5710                 ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
5711                 connp->conn_incoming_ifindex = connp->conn_bound_if;
5712         }
5713         /*
5714          * conn_connect will drop conn_lock and reacquire it.
5715          * To prevent a send* from messing with this udp_t while the lock
5716          * is dropped we set udp_state and clear conn_v6lastdst.
5717          * That will make all send* fail with EISCONN.
5718          */
5719         connp->conn_v6lastdst = ipv6_all_zeros;
5720         udp->udp_state = TS_WCON_CREQ;
5721 
5722         error = conn_connect(connp, NULL, IPDF_ALLOW_MCBC);
5723         mutex_exit(&connp->conn_lock);
5724         if (error != 0)
5725                 goto connect_failed;
5726 
5727         /*
5728          * The addresses have been verified. Time to insert in
5729          * the correct fanout list.
5730          */
5731         error = ipcl_conn_insert(connp);
5732         if (error != 0)
5733                 goto connect_failed;
5734 
5735         mutex_enter(&connp->conn_lock);
5736         error = udp_build_hdr_template(connp, &connp->conn_saddr_v6,
5737             &connp->conn_faddr_v6, connp->conn_fport, connp->conn_flowinfo);
5738         if (error != 0) {
5739                 mutex_exit(&connp->conn_lock);
5740                 goto connect_failed;
5741         }
5742 
5743         udp->udp_state = TS_DATA_XFER;
5744         /* Record this as the "last" send even though we haven't sent any */
5745         connp->conn_v6lastdst = connp->conn_faddr_v6;
5746         connp->conn_lastipversion = connp->conn_ipversion;
5747         connp->conn_lastdstport = connp->conn_fport;
5748         connp->conn_lastflowinfo = connp->conn_flowinfo;
5749         connp->conn_lastscopeid = scopeid;
5750         connp->conn_lastsrcid = srcid;
5751         /* Also remember a source to use together with lastdst */
5752         connp->conn_v6lastsrc = v6src;
5753 
5754         oldixa = conn_replace_ixa(connp, ixa);
5755         mutex_exit(&connp->conn_lock);
5756         ixa_refrele(oldixa);
5757 
5758         /*
5759          * We've picked a source address above. Now we can
5760          * verify that the src/port/dst/port is unique for all
5761          * connections in TS_DATA_XFER, skipping ourselves.
5762          */
5763         mutex_enter(&udpf->uf_lock);
5764         for (udp1 = udpf->uf_udp; udp1 != NULL; udp1 = udp1->udp_bind_hash) {
5765                 if (udp1->udp_state != TS_DATA_XFER)
5766                         continue;
5767 
5768                 if (udp1 == udp)
5769                         continue;
5770 
5771                 connp1 = udp1->udp_connp;
5772                 if (connp->conn_lport != connp1->conn_lport ||
5773                     connp->conn_ipversion != connp1->conn_ipversion ||
5774                     dstport != connp1->conn_fport ||
5775                     !IN6_ARE_ADDR_EQUAL(&connp->conn_laddr_v6,
5776                     &connp1->conn_laddr_v6) ||
5777                     !IN6_ARE_ADDR_EQUAL(&v6dst, &connp1->conn_faddr_v6) ||
5778                     !(IPCL_ZONE_MATCH(connp, connp1->conn_zoneid) ||
5779                     IPCL_ZONE_MATCH(connp1, connp->conn_zoneid)))
5780                         continue;
5781                 mutex_exit(&udpf->uf_lock);
5782                 error = -TBADADDR;
5783                 goto connect_failed;
5784         }
5785         if (cl_inet_connect2 != NULL) {
5786                 CL_INET_UDP_CONNECT(connp, B_TRUE, &v6dst, dstport, error);
5787                 if (error != 0) {
5788                         mutex_exit(&udpf->uf_lock);
5789                         error = -TBADADDR;
5790                         goto connect_failed;
5791                 }
5792         }
5793         mutex_exit(&udpf->uf_lock);
5794 
5795         ixa_refrele(ixa);
5796         return (0);
5797 
5798 connect_failed:
5799         if (ixa != NULL)
5800                 ixa_refrele(ixa);
5801         mutex_enter(&connp->conn_lock);
5802         mutex_enter(&udpf->uf_lock);
5803         udp->udp_state = TS_IDLE;
5804         connp->conn_faddr_v6 = ipv6_all_zeros;
5805         connp->conn_fport = 0;
5806         /* In case the source address was set above */
5807         if (connp->conn_mcbc_bind)
5808                 connp->conn_saddr_v6 = ipv6_all_zeros;
5809         else
5810                 connp->conn_saddr_v6 = connp->conn_bound_addr_v6;
5811         connp->conn_laddr_v6 = connp->conn_bound_addr_v6;
5812         mutex_exit(&udpf->uf_lock);
5813 
5814         connp->conn_v6lastdst = ipv6_all_zeros;
5815         connp->conn_flowinfo = 0;
5816 
5817         (void) udp_build_hdr_template(connp, &connp->conn_saddr_v6,
5818             &connp->conn_faddr_v6, connp->conn_fport, connp->conn_flowinfo);
5819         mutex_exit(&connp->conn_lock);
5820         return (error);
5821 }
5822 
5823 static int
5824 udp_connect(sock_lower_handle_t proto_handle, const struct sockaddr *sa,
5825     socklen_t len, sock_connid_t *id, cred_t *cr)
5826 {
5827         conn_t  *connp = (conn_t *)proto_handle;
5828         udp_t   *udp = connp->conn_udp;
5829         int     error;
5830         boolean_t did_bind = B_FALSE;
5831         pid_t   pid = curproc->p_pid;
5832 
5833         /* All Solaris components should pass a cred for this operation. */
5834         ASSERT(cr != NULL);
5835 
5836         if (sa == NULL) {
5837                 /*
5838                  * Disconnect
5839                  * Make sure we are connected
5840                  */
5841                 if (udp->udp_state != TS_DATA_XFER)
5842                         return (EINVAL);
5843 
5844                 error = udp_disconnect(connp);
5845                 return (error);
5846         }
5847 
5848         error = proto_verify_ip_addr(connp->conn_family, sa, len);
5849         if (error != 0)
5850                 goto done;
5851 
5852         /* do an implicit bind if necessary */
5853         if (udp->udp_state == TS_UNBND) {
5854                 error = udp_implicit_bind(connp, cr);
5855                 /*
5856                  * We could be racing with an actual bind, in which case
5857                  * we would see EPROTO. We cross our fingers and try
5858                  * to connect.
5859                  */
5860                 if (!(error == 0 || error == EPROTO))
5861                         goto done;
5862                 did_bind = B_TRUE;
5863         }
5864         /*
5865          * set SO_DGRAM_ERRIND
5866          */
5867         connp->conn_dgram_errind = B_TRUE;
5868 
5869         error = udp_do_connect(connp, sa, len, cr, pid);
5870 
5871         if (error != 0 && did_bind) {
5872                 int unbind_err;
5873 
5874                 unbind_err = udp_do_unbind(connp);
5875                 ASSERT(unbind_err == 0);
5876         }
5877 
5878         if (error == 0) {
5879                 *id = 0;
5880                 (*connp->conn_upcalls->su_connected)
5881                     (connp->conn_upper_handle, 0, NULL, -1);
5882         } else if (error < 0) {
5883                 error = proto_tlitosyserr(-error);
5884         }
5885 
5886 done:
5887         if (error != 0 && udp->udp_state == TS_DATA_XFER) {
5888                 /*
5889                  * No need to hold locks to set state
5890                  * after connect failure socket state is undefined
5891                  * We set the state only to imitate old sockfs behavior
5892                  */
5893                 udp->udp_state = TS_IDLE;
5894         }
5895         return (error);
5896 }
5897 
5898 int
5899 udp_send(sock_lower_handle_t proto_handle, mblk_t *mp, struct nmsghdr *msg,
5900     cred_t *cr)
5901 {
5902         sin6_t          *sin6;
5903         sin_t           *sin = NULL;
5904         uint_t          srcid;
5905         conn_t          *connp = (conn_t *)proto_handle;
5906         udp_t           *udp = connp->conn_udp;
5907         int             error = 0;
5908         udp_stack_t     *us = udp->udp_us;
5909         ushort_t        ipversion;
5910         pid_t           pid = curproc->p_pid;
5911         ip_xmit_attr_t  *ixa;
5912 
5913         ASSERT(DB_TYPE(mp) == M_DATA);
5914 
5915         /* All Solaris components should pass a cred for this operation. */
5916         ASSERT(cr != NULL);
5917 
5918         /* do an implicit bind if necessary */
5919         if (udp->udp_state == TS_UNBND) {
5920                 error = udp_implicit_bind(connp, cr);
5921                 /*
5922                  * We could be racing with an actual bind, in which case
5923                  * we would see EPROTO. We cross our fingers and try
5924                  * to connect.
5925                  */
5926                 if (!(error == 0 || error == EPROTO)) {
5927                         freemsg(mp);
5928                         return (error);
5929                 }
5930         }
5931 
5932         /* Connected? */
5933         if (msg->msg_name == NULL) {
5934                 if (udp->udp_state != TS_DATA_XFER) {
5935                         UDPS_BUMP_MIB(us, udpOutErrors);
5936                         return (EDESTADDRREQ);
5937                 }
5938                 if (msg->msg_controllen != 0) {
5939                         error = udp_output_ancillary(connp, NULL, NULL, mp,
5940                             NULL, msg, cr, pid);
5941                 } else {
5942                         error = udp_output_connected(connp, mp, cr, pid);
5943                 }
5944                 if (us->us_sendto_ignerr)
5945                         return (0);
5946                 else
5947                         return (error);
5948         }
5949         if (udp->udp_state == TS_DATA_XFER) {
5950                 UDPS_BUMP_MIB(us, udpOutErrors);
5951                 return (EISCONN);
5952         }
5953         error = proto_verify_ip_addr(connp->conn_family,
5954             (struct sockaddr *)msg->msg_name, msg->msg_namelen);
5955         if (error != 0) {
5956                 UDPS_BUMP_MIB(us, udpOutErrors);
5957                 return (error);
5958         }
5959         switch (connp->conn_family) {
5960         case AF_INET6:
5961                 sin6 = (sin6_t *)msg->msg_name;
5962 
5963                 srcid = sin6->__sin6_src_id;
5964 
5965                 if (!IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
5966                         /*
5967                          * Destination is a non-IPv4-compatible IPv6 address.
5968                          * Send out an IPv6 format packet.
5969                          */
5970 
5971                         /*
5972                          * If the local address is a mapped address return
5973                          * an error.
5974                          * It would be possible to send an IPv6 packet but the
5975                          * response would never make it back to the application
5976                          * since it is bound to a mapped address.
5977                          */
5978                         if (IN6_IS_ADDR_V4MAPPED(&connp->conn_saddr_v6)) {
5979                                 UDPS_BUMP_MIB(us, udpOutErrors);
5980                                 return (EADDRNOTAVAIL);
5981                         }
5982                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
5983                                 sin6->sin6_addr = ipv6_loopback;
5984                         ipversion = IPV6_VERSION;
5985                 } else {
5986                         if (connp->conn_ipv6_v6only) {
5987                                 UDPS_BUMP_MIB(us, udpOutErrors);
5988                                 return (EADDRNOTAVAIL);
5989                         }
5990 
5991                         /*
5992                          * If the local address is not zero or a mapped address
5993                          * return an error.  It would be possible to send an
5994                          * IPv4 packet but the response would never make it
5995                          * back to the application since it is bound to a
5996                          * non-mapped address.
5997                          */
5998                         if (!IN6_IS_ADDR_V4MAPPED(&connp->conn_saddr_v6) &&
5999                             !IN6_IS_ADDR_UNSPECIFIED(&connp->conn_saddr_v6)) {
6000                                 UDPS_BUMP_MIB(us, udpOutErrors);
6001                                 return (EADDRNOTAVAIL);
6002                         }
6003 
6004                         if (V4_PART_OF_V6(sin6->sin6_addr) == INADDR_ANY) {
6005                                 V4_PART_OF_V6(sin6->sin6_addr) =
6006                                     htonl(INADDR_LOOPBACK);
6007                         }
6008                         ipversion = IPV4_VERSION;
6009                 }
6010 
6011                 /*
6012                  * We have to allocate an ip_xmit_attr_t before we grab
6013                  * conn_lock and we need to hold conn_lock once we've check
6014                  * conn_same_as_last_v6 to handle concurrent send* calls on a
6015                  * socket.
6016                  */
6017                 if (msg->msg_controllen == 0) {
6018                         ixa = conn_get_ixa(connp, B_FALSE);
6019                         if (ixa == NULL) {
6020                                 UDPS_BUMP_MIB(us, udpOutErrors);
6021                                 return (ENOMEM);
6022                         }
6023                 } else {
6024                         ixa = NULL;
6025                 }
6026                 mutex_enter(&connp->conn_lock);
6027                 if (udp->udp_delayed_error != 0) {
6028                         sin6_t  *sin2 = (sin6_t *)&udp->udp_delayed_addr;
6029 
6030                         error = udp->udp_delayed_error;
6031                         udp->udp_delayed_error = 0;
6032 
6033                         /* Compare IP address, port, and family */
6034 
6035                         if (sin6->sin6_port == sin2->sin6_port &&
6036                             IN6_ARE_ADDR_EQUAL(&sin6->sin6_addr,
6037                             &sin2->sin6_addr) &&
6038                             sin6->sin6_family == sin2->sin6_family) {
6039                                 mutex_exit(&connp->conn_lock);
6040                                 UDPS_BUMP_MIB(us, udpOutErrors);
6041                                 if (ixa != NULL)
6042                                         ixa_refrele(ixa);
6043                                 return (error);
6044                         }
6045                 }
6046 
6047                 if (msg->msg_controllen != 0) {
6048                         mutex_exit(&connp->conn_lock);
6049                         ASSERT(ixa == NULL);
6050                         error = udp_output_ancillary(connp, NULL, sin6, mp,
6051                             NULL, msg, cr, pid);
6052                 } else if (conn_same_as_last_v6(connp, sin6) &&
6053                     connp->conn_lastsrcid == srcid &&
6054                     ipsec_outbound_policy_current(ixa)) {
6055                         /* udp_output_lastdst drops conn_lock */
6056                         error = udp_output_lastdst(connp, mp, cr, pid, ixa);
6057                 } else {
6058                         /* udp_output_newdst drops conn_lock */
6059                         error = udp_output_newdst(connp, mp, NULL, sin6,
6060                             ipversion, cr, pid, ixa);
6061                 }
6062                 ASSERT(MUTEX_NOT_HELD(&connp->conn_lock));
6063                 if (us->us_sendto_ignerr)
6064                         return (0);
6065                 else
6066                         return (error);
6067         case AF_INET:
6068                 sin = (sin_t *)msg->msg_name;
6069 
6070                 ipversion = IPV4_VERSION;
6071 
6072                 if (sin->sin_addr.s_addr == INADDR_ANY)
6073                         sin->sin_addr.s_addr = htonl(INADDR_LOOPBACK);
6074 
6075                 /*
6076                  * We have to allocate an ip_xmit_attr_t before we grab
6077                  * conn_lock and we need to hold conn_lock once we've check
6078                  * conn_same_as_last_v6 to handle concurrent send* on a socket.
6079                  */
6080                 if (msg->msg_controllen == 0) {
6081                         ixa = conn_get_ixa(connp, B_FALSE);
6082                         if (ixa == NULL) {
6083                                 UDPS_BUMP_MIB(us, udpOutErrors);
6084                                 return (ENOMEM);
6085                         }
6086                 } else {
6087                         ixa = NULL;
6088                 }
6089                 mutex_enter(&connp->conn_lock);
6090                 if (udp->udp_delayed_error != 0) {
6091                         sin_t  *sin2 = (sin_t *)&udp->udp_delayed_addr;
6092 
6093                         error = udp->udp_delayed_error;
6094                         udp->udp_delayed_error = 0;
6095 
6096                         /* Compare IP address and port */
6097 
6098                         if (sin->sin_port == sin2->sin_port &&
6099                             sin->sin_addr.s_addr == sin2->sin_addr.s_addr) {
6100                                 mutex_exit(&connp->conn_lock);
6101                                 UDPS_BUMP_MIB(us, udpOutErrors);
6102                                 if (ixa != NULL)
6103                                         ixa_refrele(ixa);
6104                                 return (error);
6105                         }
6106                 }
6107                 if (msg->msg_controllen != 0) {
6108                         mutex_exit(&connp->conn_lock);
6109                         ASSERT(ixa == NULL);
6110                         error = udp_output_ancillary(connp, sin, NULL, mp,
6111                             NULL, msg, cr, pid);
6112                 } else if (conn_same_as_last_v4(connp, sin) &&
6113                     ipsec_outbound_policy_current(ixa)) {
6114                         /* udp_output_lastdst drops conn_lock */
6115                         error = udp_output_lastdst(connp, mp, cr, pid, ixa);
6116                 } else {
6117                         /* udp_output_newdst drops conn_lock */
6118                         error = udp_output_newdst(connp, mp, sin, NULL,
6119                             ipversion, cr, pid, ixa);
6120                 }
6121                 ASSERT(MUTEX_NOT_HELD(&connp->conn_lock));
6122                 if (us->us_sendto_ignerr)
6123                         return (0);
6124                 else
6125                         return (error);
6126         default:
6127                 return (EINVAL);
6128         }
6129 }
6130 
6131 int
6132 udp_fallback(sock_lower_handle_t proto_handle, queue_t *q,
6133     boolean_t issocket, so_proto_quiesced_cb_t quiesced_cb,
6134     sock_quiesce_arg_t *arg)
6135 {
6136         conn_t  *connp = (conn_t *)proto_handle;
6137         udp_t   *udp;
6138         struct T_capability_ack tca;
6139         struct sockaddr_in6 laddr, faddr;
6140         socklen_t laddrlen, faddrlen;
6141         short opts;
6142         struct stroptions *stropt;
6143         mblk_t *mp, *stropt_mp;
6144         int error;
6145 
6146         udp = connp->conn_udp;
6147 
6148         stropt_mp = allocb_wait(sizeof (*stropt), BPRI_HI, STR_NOSIG, NULL);
6149 
6150         /*
6151          * setup the fallback stream that was allocated
6152          */
6153         connp->conn_dev = (dev_t)RD(q)->q_ptr;
6154         connp->conn_minor_arena = WR(q)->q_ptr;
6155 
6156         RD(q)->q_ptr = WR(q)->q_ptr = connp;
6157 
6158         WR(q)->q_qinfo = &udp_winit;
6159 
6160         connp->conn_rq = RD(q);
6161         connp->conn_wq = WR(q);
6162 
6163         /* Notify stream head about options before sending up data */
6164         stropt_mp->b_datap->db_type = M_SETOPTS;
6165         stropt_mp->b_wptr += sizeof (*stropt);
6166         stropt = (struct stroptions *)stropt_mp->b_rptr;
6167         stropt->so_flags = SO_WROFF | SO_HIWAT;
6168         stropt->so_wroff = connp->conn_wroff;
6169         stropt->so_hiwat = udp->udp_rcv_disply_hiwat;
6170         putnext(RD(q), stropt_mp);
6171 
6172         /*
6173          * Free the helper stream
6174          */
6175         ip_free_helper_stream(connp);
6176 
6177         if (!issocket)
6178                 udp_use_pure_tpi(udp);
6179 
6180         /*
6181          * Collect the information needed to sync with the sonode
6182          */
6183         udp_do_capability_ack(udp, &tca, TC1_INFO);
6184 
6185         laddrlen = faddrlen = sizeof (sin6_t);
6186         (void) udp_getsockname((sock_lower_handle_t)connp,
6187             (struct sockaddr *)&laddr, &laddrlen, CRED());
6188         error = udp_getpeername((sock_lower_handle_t)connp,
6189             (struct sockaddr *)&faddr, &faddrlen, CRED());
6190         if (error != 0)
6191                 faddrlen = 0;
6192 
6193         opts = 0;
6194         if (connp->conn_dgram_errind)
6195                 opts |= SO_DGRAM_ERRIND;
6196         if (connp->conn_ixa->ixa_flags & IXAF_DONTROUTE)
6197                 opts |= SO_DONTROUTE;
6198 
6199         mp = (*quiesced_cb)(connp->conn_upper_handle, arg, &tca,
6200             (struct sockaddr *)&laddr, laddrlen,
6201             (struct sockaddr *)&faddr, faddrlen, opts);
6202 
6203         mutex_enter(&udp->udp_recv_lock);
6204         /*
6205          * Attempts to send data up during fallback will result in it being
6206          * queued in udp_t. First push up the datagrams obtained from the
6207          * socket, then any packets queued in udp_t.
6208          */
6209         if (mp != NULL) {
6210                 mp->b_next = udp->udp_fallback_queue_head;
6211                 udp->udp_fallback_queue_head = mp;
6212         }
6213         while (udp->udp_fallback_queue_head != NULL) {
6214                 mp = udp->udp_fallback_queue_head;
6215                 udp->udp_fallback_queue_head = mp->b_next;
6216                 mutex_exit(&udp->udp_recv_lock);
6217                 mp->b_next = NULL;
6218                 putnext(RD(q), mp);
6219                 mutex_enter(&udp->udp_recv_lock);
6220         }
6221         udp->udp_fallback_queue_tail = udp->udp_fallback_queue_head;
6222         /*
6223          * No longer a streams less socket
6224          */
6225         mutex_enter(&connp->conn_lock);
6226         connp->conn_flags &= ~IPCL_NONSTR;
6227         mutex_exit(&connp->conn_lock);
6228 
6229         mutex_exit(&udp->udp_recv_lock);
6230 
6231         ASSERT(connp->conn_ref >= 1);
6232 
6233         return (0);
6234 }
6235 
6236 /* ARGSUSED3 */
6237 int
6238 udp_getpeername(sock_lower_handle_t proto_handle, struct sockaddr *sa,
6239     socklen_t *salenp, cred_t *cr)
6240 {
6241         conn_t  *connp = (conn_t *)proto_handle;
6242         udp_t   *udp = connp->conn_udp;
6243         int error;
6244 
6245         /* All Solaris components should pass a cred for this operation. */
6246         ASSERT(cr != NULL);
6247 
6248         mutex_enter(&connp->conn_lock);
6249         if (udp->udp_state != TS_DATA_XFER)
6250                 error = ENOTCONN;
6251         else
6252                 error = conn_getpeername(connp, sa, salenp);
6253         mutex_exit(&connp->conn_lock);
6254         return (error);
6255 }
6256 
6257 /* ARGSUSED3 */
6258 int
6259 udp_getsockname(sock_lower_handle_t proto_handle, struct sockaddr *sa,
6260     socklen_t *salenp, cred_t *cr)
6261 {
6262         conn_t  *connp = (conn_t *)proto_handle;
6263         int error;
6264 
6265         /* All Solaris components should pass a cred for this operation. */
6266         ASSERT(cr != NULL);
6267 
6268         mutex_enter(&connp->conn_lock);
6269         error = conn_getsockname(connp, sa, salenp);
6270         mutex_exit(&connp->conn_lock);
6271         return (error);
6272 }
6273 
6274 int
6275 udp_getsockopt(sock_lower_handle_t proto_handle, int level, int option_name,
6276     void *optvalp, socklen_t *optlen, cred_t *cr)
6277 {
6278         conn_t          *connp = (conn_t *)proto_handle;
6279         int             error;
6280         t_uscalar_t     max_optbuf_len;
6281         void            *optvalp_buf;
6282         int             len;
6283 
6284         /* All Solaris components should pass a cred for this operation. */
6285         ASSERT(cr != NULL);
6286 
6287         error = proto_opt_check(level, option_name, *optlen, &max_optbuf_len,
6288             udp_opt_obj.odb_opt_des_arr,
6289             udp_opt_obj.odb_opt_arr_cnt,
6290             B_FALSE, B_TRUE, cr);
6291         if (error != 0) {
6292                 if (error < 0)
6293                         error = proto_tlitosyserr(-error);
6294                 return (error);
6295         }
6296 
6297         optvalp_buf = kmem_alloc(max_optbuf_len, KM_SLEEP);
6298         len = udp_opt_get(connp, level, option_name, optvalp_buf);
6299         if (len == -1) {
6300                 kmem_free(optvalp_buf, max_optbuf_len);
6301                 return (EINVAL);
6302         }
6303 
6304         /*
6305          * update optlen and copy option value
6306          */
6307         t_uscalar_t size = MIN(len, *optlen);
6308 
6309         bcopy(optvalp_buf, optvalp, size);
6310         bcopy(&size, optlen, sizeof (size));
6311 
6312         kmem_free(optvalp_buf, max_optbuf_len);
6313         return (0);
6314 }
6315 
6316 int
6317 udp_setsockopt(sock_lower_handle_t proto_handle, int level, int option_name,
6318     const void *optvalp, socklen_t optlen, cred_t *cr)
6319 {
6320         conn_t          *connp = (conn_t *)proto_handle;
6321         int             error;
6322 
6323         /* All Solaris components should pass a cred for this operation. */
6324         ASSERT(cr != NULL);
6325 
6326         error = proto_opt_check(level, option_name, optlen, NULL,
6327             udp_opt_obj.odb_opt_des_arr,
6328             udp_opt_obj.odb_opt_arr_cnt,
6329             B_TRUE, B_FALSE, cr);
6330 
6331         if (error != 0) {
6332                 if (error < 0)
6333                         error = proto_tlitosyserr(-error);
6334                 return (error);
6335         }
6336 
6337         error = udp_opt_set(connp, SETFN_OPTCOM_NEGOTIATE, level, option_name,
6338             optlen, (uchar_t *)optvalp, (uint_t *)&optlen, (uchar_t *)optvalp,
6339             NULL, cr);
6340 
6341         ASSERT(error >= 0);
6342 
6343         return (error);
6344 }
6345 
6346 void
6347 udp_clr_flowctrl(sock_lower_handle_t proto_handle)
6348 {
6349         conn_t  *connp = (conn_t *)proto_handle;
6350         udp_t   *udp = connp->conn_udp;
6351 
6352         mutex_enter(&udp->udp_recv_lock);
6353         connp->conn_flow_cntrld = B_FALSE;
6354         mutex_exit(&udp->udp_recv_lock);
6355 }
6356 
6357 /* ARGSUSED2 */
6358 int
6359 udp_shutdown(sock_lower_handle_t proto_handle, int how, cred_t *cr)
6360 {
6361         conn_t  *connp = (conn_t *)proto_handle;
6362 
6363         /* All Solaris components should pass a cred for this operation. */
6364         ASSERT(cr != NULL);
6365 
6366         /* shut down the send side */
6367         if (how != SHUT_RD)
6368                 (*connp->conn_upcalls->su_opctl)(connp->conn_upper_handle,
6369                     SOCK_OPCTL_SHUT_SEND, 0);
6370         /* shut down the recv side */
6371         if (how != SHUT_WR)
6372                 (*connp->conn_upcalls->su_opctl)(connp->conn_upper_handle,
6373                     SOCK_OPCTL_SHUT_RECV, 0);
6374         return (0);
6375 }
6376 
6377 int
6378 udp_ioctl(sock_lower_handle_t proto_handle, int cmd, intptr_t arg,
6379     int mode, int32_t *rvalp, cred_t *cr)
6380 {
6381         conn_t          *connp = (conn_t *)proto_handle;
6382         int             error;
6383 
6384         /* All Solaris components should pass a cred for this operation. */
6385         ASSERT(cr != NULL);
6386 
6387         /*
6388          * If we don't have a helper stream then create one.
6389          * ip_create_helper_stream takes care of locking the conn_t,
6390          * so this check for NULL is just a performance optimization.
6391          */
6392         if (connp->conn_helper_info == NULL) {
6393                 udp_stack_t *us = connp->conn_udp->udp_us;
6394 
6395                 ASSERT(us->us_ldi_ident != NULL);
6396 
6397                 /*
6398                  * Create a helper stream for non-STREAMS socket.
6399                  */
6400                 error = ip_create_helper_stream(connp, us->us_ldi_ident);
6401                 if (error != 0) {
6402                         ip0dbg(("tcp_ioctl: create of IP helper stream "
6403                             "failed %d\n", error));
6404                         return (error);
6405                 }
6406         }
6407 
6408         switch (cmd) {
6409                 case _SIOCSOCKFALLBACK:
6410                 case TI_GETPEERNAME:
6411                 case TI_GETMYNAME:
6412                         ip1dbg(("udp_ioctl: cmd 0x%x on non streams socket",
6413                             cmd));
6414                         error = EINVAL;
6415                         break;
6416                 default:
6417                         /*
6418                          * Pass on to IP using helper stream
6419                          */
6420                         error = ldi_ioctl(connp->conn_helper_info->iphs_handle,
6421                             cmd, arg, mode, cr, rvalp);
6422                         break;
6423         }
6424         return (error);
6425 }
6426 
6427 /* ARGSUSED */
6428 int
6429 udp_accept(sock_lower_handle_t lproto_handle,
6430     sock_lower_handle_t eproto_handle, sock_upper_handle_t sock_handle,
6431     cred_t *cr)
6432 {
6433         return (EOPNOTSUPP);
6434 }
6435 
6436 /* ARGSUSED */
6437 int
6438 udp_listen(sock_lower_handle_t proto_handle, int backlog, cred_t *cr)
6439 {
6440         return (EOPNOTSUPP);
6441 }
6442 
6443 sock_downcalls_t sock_udp_downcalls = {
6444         udp_activate,           /* sd_activate */
6445         udp_accept,             /* sd_accept */
6446         udp_bind,               /* sd_bind */
6447         udp_listen,             /* sd_listen */
6448         udp_connect,            /* sd_connect */
6449         udp_getpeername,        /* sd_getpeername */
6450         udp_getsockname,        /* sd_getsockname */
6451         udp_getsockopt,         /* sd_getsockopt */
6452         udp_setsockopt,         /* sd_setsockopt */
6453         udp_send,               /* sd_send */
6454         NULL,                   /* sd_send_uio */
6455         NULL,                   /* sd_recv_uio */
6456         NULL,                   /* sd_poll */
6457         udp_shutdown,           /* sd_shutdown */
6458         udp_clr_flowctrl,       /* sd_setflowctrl */
6459         udp_ioctl,              /* sd_ioctl */
6460         udp_close               /* sd_close */
6461 };