1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 /*
  22  * Copyright (c) 1991, 2010, Oracle and/or its affiliates. All rights reserved.
  23  * Copyright 2013 Nexenta Systems, Inc.  All rights reserved.
  24  * Copyright 2014, OmniTI Computer Consulting, Inc. All rights reserved.
  25  */
  26 /* Copyright (c) 1990 Mentat Inc. */
  27 
  28 #include <sys/sysmacros.h>
  29 #include <sys/types.h>
  30 #include <sys/stream.h>
  31 #include <sys/stropts.h>
  32 #include <sys/strlog.h>
  33 #include <sys/strsun.h>
  34 #define _SUN_TPI_VERSION 2
  35 #include <sys/tihdr.h>
  36 #include <sys/timod.h>
  37 #include <sys/ddi.h>
  38 #include <sys/sunddi.h>
  39 #include <sys/strsubr.h>
  40 #include <sys/suntpi.h>
  41 #include <sys/xti_inet.h>
  42 #include <sys/kmem.h>
  43 #include <sys/cred_impl.h>
  44 #include <sys/policy.h>
  45 #include <sys/priv.h>
  46 #include <sys/ucred.h>
  47 #include <sys/zone.h>
  48 
  49 #include <sys/socket.h>
  50 #include <sys/socketvar.h>
  51 #include <sys/sockio.h>
  52 #include <sys/vtrace.h>
  53 #include <sys/sdt.h>
  54 #include <sys/debug.h>
  55 #include <sys/isa_defs.h>
  56 #include <sys/random.h>
  57 #include <netinet/in.h>
  58 #include <netinet/ip6.h>
  59 #include <netinet/icmp6.h>
  60 #include <netinet/udp.h>
  61 
  62 #include <inet/common.h>
  63 #include <inet/ip.h>
  64 #include <inet/ip_impl.h>
  65 #include <inet/ipsec_impl.h>
  66 #include <inet/ip6.h>
  67 #include <inet/ip_ire.h>
  68 #include <inet/ip_if.h>
  69 #include <inet/ip_multi.h>
  70 #include <inet/ip_ndp.h>
  71 #include <inet/proto_set.h>
  72 #include <inet/mib2.h>
  73 #include <inet/optcom.h>
  74 #include <inet/snmpcom.h>
  75 #include <inet/kstatcom.h>
  76 #include <inet/ipclassifier.h>
  77 #include <sys/squeue_impl.h>
  78 #include <inet/ipnet.h>
  79 #include <sys/ethernet.h>
  80 
  81 #include <sys/tsol/label.h>
  82 #include <sys/tsol/tnet.h>
  83 #include <rpc/pmap_prot.h>
  84 
  85 #include <inet/udp_impl.h>
  86 
  87 /*
  88  * Synchronization notes:
  89  *
  90  * UDP is MT and uses the usual kernel synchronization primitives. There are 2
  91  * locks, the fanout lock (uf_lock) and conn_lock. conn_lock
  92  * protects the contents of the udp_t. uf_lock protects the address and the
  93  * fanout information.
  94  * The lock order is conn_lock -> uf_lock.
  95  *
  96  * The fanout lock uf_lock:
  97  * When a UDP endpoint is bound to a local port, it is inserted into
  98  * a bind hash list.  The list consists of an array of udp_fanout_t buckets.
  99  * The size of the array is controlled by the udp_bind_fanout_size variable.
 100  * This variable can be changed in /etc/system if the default value is
 101  * not large enough.  Each bind hash bucket is protected by a per bucket
 102  * lock.  It protects the udp_bind_hash and udp_ptpbhn fields in the udp_t
 103  * structure and a few other fields in the udp_t. A UDP endpoint is removed
 104  * from the bind hash list only when it is being unbound or being closed.
 105  * The per bucket lock also protects a UDP endpoint's state changes.
 106  *
 107  * Plumbing notes:
 108  * UDP is always a device driver. For compatibility with mibopen() code
 109  * it is possible to I_PUSH "udp", but that results in pushing a passthrough
 110  * dummy module.
 111  *
 112  * The above implies that we don't support any intermediate module to
 113  * reside in between /dev/ip and udp -- in fact, we never supported such
 114  * scenario in the past as the inter-layer communication semantics have
 115  * always been private.
 116  */
 117 
 118 /* For /etc/system control */
 119 uint_t udp_bind_fanout_size = UDP_BIND_FANOUT_SIZE;
 120 
 121 static void     udp_addr_req(queue_t *q, mblk_t *mp);
 122 static void     udp_tpi_bind(queue_t *q, mblk_t *mp);
 123 static void     udp_bind_hash_insert(udp_fanout_t *uf, udp_t *udp);
 124 static void     udp_bind_hash_remove(udp_t *udp, boolean_t caller_holds_lock);
 125 static int      udp_build_hdr_template(conn_t *, const in6_addr_t *,
 126     const in6_addr_t *, in_port_t, uint32_t);
 127 static void     udp_capability_req(queue_t *q, mblk_t *mp);
 128 static int      udp_tpi_close(queue_t *q, int flags);
 129 static void     udp_close_free(conn_t *);
 130 static void     udp_tpi_connect(queue_t *q, mblk_t *mp);
 131 static void     udp_tpi_disconnect(queue_t *q, mblk_t *mp);
 132 static void     udp_err_ack(queue_t *q, mblk_t *mp, t_scalar_t t_error,
 133     int sys_error);
 134 static void     udp_err_ack_prim(queue_t *q, mblk_t *mp, t_scalar_t primitive,
 135     t_scalar_t tlierr, int sys_error);
 136 static int      udp_extra_priv_ports_get(queue_t *q, mblk_t *mp, caddr_t cp,
 137                     cred_t *cr);
 138 static int      udp_extra_priv_ports_add(queue_t *q, mblk_t *mp,
 139                     char *value, caddr_t cp, cred_t *cr);
 140 static int      udp_extra_priv_ports_del(queue_t *q, mblk_t *mp,
 141                     char *value, caddr_t cp, cred_t *cr);
 142 static void     udp_icmp_input(void *, mblk_t *, void *, ip_recv_attr_t *);
 143 static void     udp_icmp_error_ipv6(conn_t *connp, mblk_t *mp,
 144     ip_recv_attr_t *ira);
 145 static void     udp_info_req(queue_t *q, mblk_t *mp);
 146 static void     udp_input(void *, mblk_t *, void *, ip_recv_attr_t *);
 147 static void     udp_lrput(queue_t *, mblk_t *);
 148 static void     udp_lwput(queue_t *, mblk_t *);
 149 static int      udp_open(queue_t *q, dev_t *devp, int flag, int sflag,
 150                     cred_t *credp, boolean_t isv6);
 151 static int      udp_openv4(queue_t *q, dev_t *devp, int flag, int sflag,
 152                     cred_t *credp);
 153 static int      udp_openv6(queue_t *q, dev_t *devp, int flag, int sflag,
 154                     cred_t *credp);
 155 static boolean_t udp_opt_allow_udr_set(t_scalar_t level, t_scalar_t name);
 156 int             udp_opt_set(conn_t *connp, uint_t optset_context,
 157                     int level, int name, uint_t inlen,
 158                     uchar_t *invalp, uint_t *outlenp, uchar_t *outvalp,
 159                     void *thisdg_attrs, cred_t *cr);
 160 int             udp_opt_get(conn_t *connp, int level, int name,
 161                     uchar_t *ptr);
 162 static int      udp_output_connected(conn_t *connp, mblk_t *mp, cred_t *cr,
 163                     pid_t pid);
 164 static int      udp_output_lastdst(conn_t *connp, mblk_t *mp, cred_t *cr,
 165     pid_t pid, ip_xmit_attr_t *ixa);
 166 static int      udp_output_newdst(conn_t *connp, mblk_t *data_mp, sin_t *sin,
 167                     sin6_t *sin6, ushort_t ipversion, cred_t *cr, pid_t,
 168                     ip_xmit_attr_t *ixa);
 169 static mblk_t   *udp_prepend_hdr(conn_t *, ip_xmit_attr_t *, const ip_pkt_t *,
 170     const in6_addr_t *, const in6_addr_t *, in_port_t, uint32_t, mblk_t *,
 171     int *);
 172 static mblk_t   *udp_prepend_header_template(conn_t *, ip_xmit_attr_t *,
 173     mblk_t *, const in6_addr_t *, in_port_t, uint32_t, int *);
 174 static void     udp_ud_err(queue_t *q, mblk_t *mp, t_scalar_t err);
 175 static void     udp_ud_err_connected(conn_t *, t_scalar_t);
 176 static void     udp_tpi_unbind(queue_t *q, mblk_t *mp);
 177 static in_port_t udp_update_next_port(udp_t *udp, in_port_t port,
 178     boolean_t random);
 179 static void     udp_wput_other(queue_t *q, mblk_t *mp);
 180 static void     udp_wput_iocdata(queue_t *q, mblk_t *mp);
 181 static void     udp_wput_fallback(queue_t *q, mblk_t *mp);
 182 static size_t   udp_set_rcv_hiwat(udp_t *udp, size_t size);
 183 
 184 static void     *udp_stack_init(netstackid_t stackid, netstack_t *ns);
 185 static void     udp_stack_fini(netstackid_t stackid, void *arg);
 186 
 187 /* Common routines for TPI and socket module */
 188 static void     udp_ulp_recv(conn_t *, mblk_t *, uint_t, ip_recv_attr_t *);
 189 
 190 /* Common routine for TPI and socket module */
 191 static conn_t   *udp_do_open(cred_t *, boolean_t, int, int *);
 192 static void     udp_do_close(conn_t *);
 193 static int      udp_do_bind(conn_t *, struct sockaddr *, socklen_t, cred_t *,
 194     boolean_t);
 195 static int      udp_do_unbind(conn_t *);
 196 
 197 int             udp_getsockname(sock_lower_handle_t,
 198     struct sockaddr *, socklen_t *, cred_t *);
 199 int             udp_getpeername(sock_lower_handle_t,
 200     struct sockaddr *, socklen_t *, cred_t *);
 201 static int      udp_do_connect(conn_t *, const struct sockaddr *, socklen_t,
 202     cred_t *, pid_t);
 203 
 204 #pragma inline(udp_output_connected, udp_output_newdst, udp_output_lastdst)
 205 
 206 /*
 207  * Checks if the given destination addr/port is allowed out.
 208  * If allowed, registers the (dest_addr/port, node_ID) mapping at Cluster.
 209  * Called for each connect() and for sendto()/sendmsg() to a different
 210  * destination.
 211  * For connect(), called in udp_connect().
 212  * For sendto()/sendmsg(), called in udp_output_newdst().
 213  *
 214  * This macro assumes that the cl_inet_connect2 hook is not NULL.
 215  * Please check this before calling this macro.
 216  *
 217  * void
 218  * CL_INET_UDP_CONNECT(conn_t cp, udp_t *udp, boolean_t is_outgoing,
 219  *     in6_addr_t *faddrp, in_port_t (or uint16_t) fport, int err);
 220  */
 221 #define CL_INET_UDP_CONNECT(cp, is_outgoing, faddrp, fport, err) {      \
 222         (err) = 0;                                                      \
 223         /*                                                              \
 224          * Running in cluster mode - check and register active          \
 225          * "connection" information                                     \
 226          */                                                             \
 227         if ((cp)->conn_ipversion == IPV4_VERSION)                    \
 228                 (err) = (*cl_inet_connect2)(                            \
 229                     (cp)->conn_netstack->netstack_stackid,                \
 230                     IPPROTO_UDP, is_outgoing, AF_INET,                  \
 231                     (uint8_t *)&((cp)->conn_laddr_v4),                   \
 232                     (cp)->conn_lport,                                        \
 233                     (uint8_t *)&(V4_PART_OF_V6(*faddrp)),           \
 234                     (in_port_t)(fport), NULL);                          \
 235         else                                                            \
 236                 (err) = (*cl_inet_connect2)(                            \
 237                     (cp)->conn_netstack->netstack_stackid,                \
 238                     IPPROTO_UDP, is_outgoing, AF_INET6,                 \
 239                     (uint8_t *)&((cp)->conn_laddr_v6),                   \
 240                     (cp)->conn_lport,                                        \
 241                     (uint8_t *)(faddrp), (in_port_t)(fport), NULL);     \
 242 }
 243 
 244 static struct module_info udp_mod_info =  {
 245         UDP_MOD_ID, UDP_MOD_NAME, 1, INFPSZ, UDP_RECV_HIWATER, UDP_RECV_LOWATER
 246 };
 247 
 248 /*
 249  * Entry points for UDP as a device.
 250  * We have separate open functions for the /dev/udp and /dev/udp6 devices.
 251  */
 252 static struct qinit udp_rinitv4 = {
 253         NULL, NULL, udp_openv4, udp_tpi_close, NULL, &udp_mod_info, NULL
 254 };
 255 
 256 static struct qinit udp_rinitv6 = {
 257         NULL, NULL, udp_openv6, udp_tpi_close, NULL, &udp_mod_info, NULL
 258 };
 259 
 260 static struct qinit udp_winit = {
 261         (pfi_t)udp_wput, (pfi_t)ip_wsrv, NULL, NULL, NULL, &udp_mod_info
 262 };
 263 
 264 /* UDP entry point during fallback */
 265 struct qinit udp_fallback_sock_winit = {
 266         (pfi_t)udp_wput_fallback, NULL, NULL, NULL, NULL, &udp_mod_info
 267 };
 268 
 269 /*
 270  * UDP needs to handle I_LINK and I_PLINK since ifconfig
 271  * likes to use it as a place to hang the various streams.
 272  */
 273 static struct qinit udp_lrinit = {
 274         (pfi_t)udp_lrput, NULL, udp_openv4, udp_tpi_close, NULL, &udp_mod_info
 275 };
 276 
 277 static struct qinit udp_lwinit = {
 278         (pfi_t)udp_lwput, NULL, udp_openv4, udp_tpi_close, NULL, &udp_mod_info
 279 };
 280 
 281 /* For AF_INET aka /dev/udp */
 282 struct streamtab udpinfov4 = {
 283         &udp_rinitv4, &udp_winit, &udp_lrinit, &udp_lwinit
 284 };
 285 
 286 /* For AF_INET6 aka /dev/udp6 */
 287 struct streamtab udpinfov6 = {
 288         &udp_rinitv6, &udp_winit, &udp_lrinit, &udp_lwinit
 289 };
 290 
 291 #define UDP_MAXPACKET_IPV4 (IP_MAXPACKET - UDPH_SIZE - IP_SIMPLE_HDR_LENGTH)
 292 
 293 /* Default structure copied into T_INFO_ACK messages */
 294 static struct T_info_ack udp_g_t_info_ack_ipv4 = {
 295         T_INFO_ACK,
 296         UDP_MAXPACKET_IPV4,     /* TSDU_size. Excl. headers */
 297         T_INVALID,      /* ETSU_size.  udp does not support expedited data. */
 298         T_INVALID,      /* CDATA_size. udp does not support connect data. */
 299         T_INVALID,      /* DDATA_size. udp does not support disconnect data. */
 300         sizeof (sin_t), /* ADDR_size. */
 301         0,              /* OPT_size - not initialized here */
 302         UDP_MAXPACKET_IPV4,     /* TIDU_size.  Excl. headers */
 303         T_CLTS,         /* SERV_type.  udp supports connection-less. */
 304         TS_UNBND,       /* CURRENT_state.  This is set from udp_state. */
 305         (XPG4_1|SENDZERO) /* PROVIDER_flag */
 306 };
 307 
 308 #define UDP_MAXPACKET_IPV6 (IP_MAXPACKET - UDPH_SIZE - IPV6_HDR_LEN)
 309 
 310 static  struct T_info_ack udp_g_t_info_ack_ipv6 = {
 311         T_INFO_ACK,
 312         UDP_MAXPACKET_IPV6,     /* TSDU_size.  Excl. headers */
 313         T_INVALID,      /* ETSU_size.  udp does not support expedited data. */
 314         T_INVALID,      /* CDATA_size. udp does not support connect data. */
 315         T_INVALID,      /* DDATA_size. udp does not support disconnect data. */
 316         sizeof (sin6_t), /* ADDR_size. */
 317         0,              /* OPT_size - not initialized here */
 318         UDP_MAXPACKET_IPV6,     /* TIDU_size. Excl. headers */
 319         T_CLTS,         /* SERV_type.  udp supports connection-less. */
 320         TS_UNBND,       /* CURRENT_state.  This is set from udp_state. */
 321         (XPG4_1|SENDZERO) /* PROVIDER_flag */
 322 };
 323 
 324 /*
 325  * UDP tunables related declarations. Definitions are in udp_tunables.c
 326  */
 327 extern mod_prop_info_t udp_propinfo_tbl[];
 328 extern int udp_propinfo_count;
 329 
 330 /* Setable in /etc/system */
 331 /* If set to 0, pick ephemeral port sequentially; otherwise randomly. */
 332 uint32_t udp_random_anon_port = 1;
 333 
 334 /*
 335  * Hook functions to enable cluster networking.
 336  * On non-clustered systems these vectors must always be NULL
 337  */
 338 
 339 void (*cl_inet_bind)(netstackid_t stack_id, uchar_t protocol,
 340     sa_family_t addr_family, uint8_t *laddrp, in_port_t lport,
 341     void *args) = NULL;
 342 void (*cl_inet_unbind)(netstackid_t stack_id, uint8_t protocol,
 343     sa_family_t addr_family, uint8_t *laddrp, in_port_t lport,
 344     void *args) = NULL;
 345 
 346 typedef union T_primitives *t_primp_t;
 347 
 348 /*
 349  * Return the next anonymous port in the privileged port range for
 350  * bind checking.
 351  *
 352  * Trusted Extension (TX) notes: TX allows administrator to mark or
 353  * reserve ports as Multilevel ports (MLP). MLP has special function
 354  * on TX systems. Once a port is made MLP, it's not available as
 355  * ordinary port. This creates "holes" in the port name space. It
 356  * may be necessary to skip the "holes" find a suitable anon port.
 357  */
 358 static in_port_t
 359 udp_get_next_priv_port(udp_t *udp)
 360 {
 361         static in_port_t next_priv_port = IPPORT_RESERVED - 1;
 362         in_port_t nextport;
 363         boolean_t restart = B_FALSE;
 364         udp_stack_t *us = udp->udp_us;
 365 
 366 retry:
 367         if (next_priv_port < us->us_min_anonpriv_port ||
 368             next_priv_port >= IPPORT_RESERVED) {
 369                 next_priv_port = IPPORT_RESERVED - 1;
 370                 if (restart)
 371                         return (0);
 372                 restart = B_TRUE;
 373         }
 374 
 375         if (is_system_labeled() &&
 376             (nextport = tsol_next_port(crgetzone(udp->udp_connp->conn_cred),
 377             next_priv_port, IPPROTO_UDP, B_FALSE)) != 0) {
 378                 next_priv_port = nextport;
 379                 goto retry;
 380         }
 381 
 382         return (next_priv_port--);
 383 }
 384 
 385 /*
 386  * Hash list removal routine for udp_t structures.
 387  */
 388 static void
 389 udp_bind_hash_remove(udp_t *udp, boolean_t caller_holds_lock)
 390 {
 391         udp_t           *udpnext;
 392         kmutex_t        *lockp;
 393         udp_stack_t     *us = udp->udp_us;
 394         conn_t          *connp = udp->udp_connp;
 395 
 396         if (udp->udp_ptpbhn == NULL)
 397                 return;
 398 
 399         /*
 400          * Extract the lock pointer in case there are concurrent
 401          * hash_remove's for this instance.
 402          */
 403         ASSERT(connp->conn_lport != 0);
 404         if (!caller_holds_lock) {
 405                 lockp = &us->us_bind_fanout[UDP_BIND_HASH(connp->conn_lport,
 406                     us->us_bind_fanout_size)].uf_lock;
 407                 ASSERT(lockp != NULL);
 408                 mutex_enter(lockp);
 409         }
 410         if (udp->udp_ptpbhn != NULL) {
 411                 udpnext = udp->udp_bind_hash;
 412                 if (udpnext != NULL) {
 413                         udpnext->udp_ptpbhn = udp->udp_ptpbhn;
 414                         udp->udp_bind_hash = NULL;
 415                 }
 416                 *udp->udp_ptpbhn = udpnext;
 417                 udp->udp_ptpbhn = NULL;
 418         }
 419         if (!caller_holds_lock) {
 420                 mutex_exit(lockp);
 421         }
 422 }
 423 
 424 static void
 425 udp_bind_hash_insert(udp_fanout_t *uf, udp_t *udp)
 426 {
 427         conn_t  *connp = udp->udp_connp;
 428         udp_t   **udpp;
 429         udp_t   *udpnext;
 430         conn_t  *connext;
 431 
 432         ASSERT(MUTEX_HELD(&uf->uf_lock));
 433         ASSERT(udp->udp_ptpbhn == NULL);
 434         udpp = &uf->uf_udp;
 435         udpnext = udpp[0];
 436         if (udpnext != NULL) {
 437                 /*
 438                  * If the new udp bound to the INADDR_ANY address
 439                  * and the first one in the list is not bound to
 440                  * INADDR_ANY we skip all entries until we find the
 441                  * first one bound to INADDR_ANY.
 442                  * This makes sure that applications binding to a
 443                  * specific address get preference over those binding to
 444                  * INADDR_ANY.
 445                  */
 446                 connext = udpnext->udp_connp;
 447                 if (V6_OR_V4_INADDR_ANY(connp->conn_bound_addr_v6) &&
 448                     !V6_OR_V4_INADDR_ANY(connext->conn_bound_addr_v6)) {
 449                         while ((udpnext = udpp[0]) != NULL &&
 450                             !V6_OR_V4_INADDR_ANY(connext->conn_bound_addr_v6)) {
 451                                 udpp = &(udpnext->udp_bind_hash);
 452                         }
 453                         if (udpnext != NULL)
 454                                 udpnext->udp_ptpbhn = &udp->udp_bind_hash;
 455                 } else {
 456                         udpnext->udp_ptpbhn = &udp->udp_bind_hash;
 457                 }
 458         }
 459         udp->udp_bind_hash = udpnext;
 460         udp->udp_ptpbhn = udpp;
 461         udpp[0] = udp;
 462 }
 463 
 464 /*
 465  * This routine is called to handle each O_T_BIND_REQ/T_BIND_REQ message
 466  * passed to udp_wput.
 467  * It associates a port number and local address with the stream.
 468  * It calls IP to verify the local IP address, and calls IP to insert
 469  * the conn_t in the fanout table.
 470  * If everything is ok it then sends the T_BIND_ACK back up.
 471  *
 472  * Note that UDP over IPv4 and IPv6 sockets can use the same port number
 473  * without setting SO_REUSEADDR. This is needed so that they
 474  * can be viewed as two independent transport protocols.
 475  * However, anonymouns ports are allocated from the same range to avoid
 476  * duplicating the us->us_next_port_to_try.
 477  */
 478 static void
 479 udp_tpi_bind(queue_t *q, mblk_t *mp)
 480 {
 481         sin_t           *sin;
 482         sin6_t          *sin6;
 483         mblk_t          *mp1;
 484         struct T_bind_req *tbr;
 485         conn_t          *connp;
 486         udp_t           *udp;
 487         int             error;
 488         struct sockaddr *sa;
 489         cred_t          *cr;
 490 
 491         /*
 492          * All Solaris components should pass a db_credp
 493          * for this TPI message, hence we ASSERT.
 494          * But in case there is some other M_PROTO that looks
 495          * like a TPI message sent by some other kernel
 496          * component, we check and return an error.
 497          */
 498         cr = msg_getcred(mp, NULL);
 499         ASSERT(cr != NULL);
 500         if (cr == NULL) {
 501                 udp_err_ack(q, mp, TSYSERR, EINVAL);
 502                 return;
 503         }
 504 
 505         connp = Q_TO_CONN(q);
 506         udp = connp->conn_udp;
 507         if ((mp->b_wptr - mp->b_rptr) < sizeof (*tbr)) {
 508                 (void) mi_strlog(q, 1, SL_ERROR|SL_TRACE,
 509                     "udp_bind: bad req, len %u",
 510                     (uint_t)(mp->b_wptr - mp->b_rptr));
 511                 udp_err_ack(q, mp, TPROTO, 0);
 512                 return;
 513         }
 514         if (udp->udp_state != TS_UNBND) {
 515                 (void) mi_strlog(q, 1, SL_ERROR|SL_TRACE,
 516                     "udp_bind: bad state, %u", udp->udp_state);
 517                 udp_err_ack(q, mp, TOUTSTATE, 0);
 518                 return;
 519         }
 520         /*
 521          * Reallocate the message to make sure we have enough room for an
 522          * address.
 523          */
 524         mp1 = reallocb(mp, sizeof (struct T_bind_ack) + sizeof (sin6_t), 1);
 525         if (mp1 == NULL) {
 526                 udp_err_ack(q, mp, TSYSERR, ENOMEM);
 527                 return;
 528         }
 529 
 530         mp = mp1;
 531 
 532         /* Reset the message type in preparation for shipping it back. */
 533         DB_TYPE(mp) = M_PCPROTO;
 534 
 535         tbr = (struct T_bind_req *)mp->b_rptr;
 536         switch (tbr->ADDR_length) {
 537         case 0:                 /* Request for a generic port */
 538                 tbr->ADDR_offset = sizeof (struct T_bind_req);
 539                 if (connp->conn_family == AF_INET) {
 540                         tbr->ADDR_length = sizeof (sin_t);
 541                         sin = (sin_t *)&tbr[1];
 542                         *sin = sin_null;
 543                         sin->sin_family = AF_INET;
 544                         mp->b_wptr = (uchar_t *)&sin[1];
 545                         sa = (struct sockaddr *)sin;
 546                 } else {
 547                         ASSERT(connp->conn_family == AF_INET6);
 548                         tbr->ADDR_length = sizeof (sin6_t);
 549                         sin6 = (sin6_t *)&tbr[1];
 550                         *sin6 = sin6_null;
 551                         sin6->sin6_family = AF_INET6;
 552                         mp->b_wptr = (uchar_t *)&sin6[1];
 553                         sa = (struct sockaddr *)sin6;
 554                 }
 555                 break;
 556 
 557         case sizeof (sin_t):    /* Complete IPv4 address */
 558                 sa = (struct sockaddr *)mi_offset_param(mp, tbr->ADDR_offset,
 559                     sizeof (sin_t));
 560                 if (sa == NULL || !OK_32PTR((char *)sa)) {
 561                         udp_err_ack(q, mp, TSYSERR, EINVAL);
 562                         return;
 563                 }
 564                 if (connp->conn_family != AF_INET ||
 565                     sa->sa_family != AF_INET) {
 566                         udp_err_ack(q, mp, TSYSERR, EAFNOSUPPORT);
 567                         return;
 568                 }
 569                 break;
 570 
 571         case sizeof (sin6_t):   /* complete IPv6 address */
 572                 sa = (struct sockaddr *)mi_offset_param(mp, tbr->ADDR_offset,
 573                     sizeof (sin6_t));
 574                 if (sa == NULL || !OK_32PTR((char *)sa)) {
 575                         udp_err_ack(q, mp, TSYSERR, EINVAL);
 576                         return;
 577                 }
 578                 if (connp->conn_family != AF_INET6 ||
 579                     sa->sa_family != AF_INET6) {
 580                         udp_err_ack(q, mp, TSYSERR, EAFNOSUPPORT);
 581                         return;
 582                 }
 583                 break;
 584 
 585         default:                /* Invalid request */
 586                 (void) mi_strlog(q, 1, SL_ERROR|SL_TRACE,
 587                     "udp_bind: bad ADDR_length length %u", tbr->ADDR_length);
 588                 udp_err_ack(q, mp, TBADADDR, 0);
 589                 return;
 590         }
 591 
 592         error = udp_do_bind(connp, sa, tbr->ADDR_length, cr,
 593             tbr->PRIM_type != O_T_BIND_REQ);
 594 
 595         if (error != 0) {
 596                 if (error > 0) {
 597                         udp_err_ack(q, mp, TSYSERR, error);
 598                 } else {
 599                         udp_err_ack(q, mp, -error, 0);
 600                 }
 601         } else {
 602                 tbr->PRIM_type = T_BIND_ACK;
 603                 qreply(q, mp);
 604         }
 605 }
 606 
 607 /*
 608  * This routine handles each T_CONN_REQ message passed to udp.  It
 609  * associates a default destination address with the stream.
 610  *
 611  * After various error checks are completed, udp_connect() lays
 612  * the target address and port into the composite header template.
 613  * Then we ask IP for information, including a source address if we didn't
 614  * already have one. Finally we send up the T_OK_ACK reply message.
 615  */
 616 static void
 617 udp_tpi_connect(queue_t *q, mblk_t *mp)
 618 {
 619         conn_t  *connp = Q_TO_CONN(q);
 620         int     error;
 621         socklen_t       len;
 622         struct sockaddr         *sa;
 623         struct T_conn_req       *tcr;
 624         cred_t          *cr;
 625         pid_t           pid;
 626         /*
 627          * All Solaris components should pass a db_credp
 628          * for this TPI message, hence we ASSERT.
 629          * But in case there is some other M_PROTO that looks
 630          * like a TPI message sent by some other kernel
 631          * component, we check and return an error.
 632          */
 633         cr = msg_getcred(mp, &pid);
 634         ASSERT(cr != NULL);
 635         if (cr == NULL) {
 636                 udp_err_ack(q, mp, TSYSERR, EINVAL);
 637                 return;
 638         }
 639 
 640         tcr = (struct T_conn_req *)mp->b_rptr;
 641 
 642         /* A bit of sanity checking */
 643         if ((mp->b_wptr - mp->b_rptr) < sizeof (struct T_conn_req)) {
 644                 udp_err_ack(q, mp, TPROTO, 0);
 645                 return;
 646         }
 647 
 648         if (tcr->OPT_length != 0) {
 649                 udp_err_ack(q, mp, TBADOPT, 0);
 650                 return;
 651         }
 652 
 653         /*
 654          * Determine packet type based on type of address passed in
 655          * the request should contain an IPv4 or IPv6 address.
 656          * Make sure that address family matches the type of
 657          * family of the address passed down.
 658          */
 659         len = tcr->DEST_length;
 660         switch (tcr->DEST_length) {
 661         default:
 662                 udp_err_ack(q, mp, TBADADDR, 0);
 663                 return;
 664 
 665         case sizeof (sin_t):
 666                 sa = (struct sockaddr *)mi_offset_param(mp, tcr->DEST_offset,
 667                     sizeof (sin_t));
 668                 break;
 669 
 670         case sizeof (sin6_t):
 671                 sa = (struct sockaddr *)mi_offset_param(mp, tcr->DEST_offset,
 672                     sizeof (sin6_t));
 673                 break;
 674         }
 675 
 676         error = proto_verify_ip_addr(connp->conn_family, sa, len);
 677         if (error != 0) {
 678                 udp_err_ack(q, mp, TSYSERR, error);
 679                 return;
 680         }
 681 
 682         error = udp_do_connect(connp, sa, len, cr, pid);
 683         if (error != 0) {
 684                 if (error < 0)
 685                         udp_err_ack(q, mp, -error, 0);
 686                 else
 687                         udp_err_ack(q, mp, TSYSERR, error);
 688         } else {
 689                 mblk_t  *mp1;
 690                 /*
 691                  * We have to send a connection confirmation to
 692                  * keep TLI happy.
 693                  */
 694                 if (connp->conn_family == AF_INET) {
 695                         mp1 = mi_tpi_conn_con(NULL, (char *)sa,
 696                             sizeof (sin_t), NULL, 0);
 697                 } else {
 698                         mp1 = mi_tpi_conn_con(NULL, (char *)sa,
 699                             sizeof (sin6_t), NULL, 0);
 700                 }
 701                 if (mp1 == NULL) {
 702                         udp_err_ack(q, mp, TSYSERR, ENOMEM);
 703                         return;
 704                 }
 705 
 706                 /*
 707                  * Send ok_ack for T_CONN_REQ
 708                  */
 709                 mp = mi_tpi_ok_ack_alloc(mp);
 710                 if (mp == NULL) {
 711                         /* Unable to reuse the T_CONN_REQ for the ack. */
 712                         udp_err_ack_prim(q, mp1, T_CONN_REQ, TSYSERR, ENOMEM);
 713                         return;
 714                 }
 715 
 716                 putnext(connp->conn_rq, mp);
 717                 putnext(connp->conn_rq, mp1);
 718         }
 719 }
 720 
 721 static int
 722 udp_tpi_close(queue_t *q, int flags)
 723 {
 724         conn_t  *connp;
 725 
 726         if (flags & SO_FALLBACK) {
 727                 /*
 728                  * stream is being closed while in fallback
 729                  * simply free the resources that were allocated
 730                  */
 731                 inet_minor_free(WR(q)->q_ptr, (dev_t)(RD(q)->q_ptr));
 732                 qprocsoff(q);
 733                 goto done;
 734         }
 735 
 736         connp = Q_TO_CONN(q);
 737         udp_do_close(connp);
 738 done:
 739         q->q_ptr = WR(q)->q_ptr = NULL;
 740         return (0);
 741 }
 742 
 743 static void
 744 udp_close_free(conn_t *connp)
 745 {
 746         udp_t *udp = connp->conn_udp;
 747 
 748         /* If there are any options associated with the stream, free them. */
 749         if (udp->udp_recv_ipp.ipp_fields != 0)
 750                 ip_pkt_free(&udp->udp_recv_ipp);
 751 
 752         /*
 753          * Clear any fields which the kmem_cache constructor clears.
 754          * Only udp_connp needs to be preserved.
 755          * TBD: We should make this more efficient to avoid clearing
 756          * everything.
 757          */
 758         ASSERT(udp->udp_connp == connp);
 759         bzero(udp, sizeof (udp_t));
 760         udp->udp_connp = connp;
 761 }
 762 
 763 static int
 764 udp_do_disconnect(conn_t *connp)
 765 {
 766         udp_t   *udp;
 767         udp_fanout_t *udpf;
 768         udp_stack_t *us;
 769         int     error;
 770 
 771         udp = connp->conn_udp;
 772         us = udp->udp_us;
 773         mutex_enter(&connp->conn_lock);
 774         if (udp->udp_state != TS_DATA_XFER) {
 775                 mutex_exit(&connp->conn_lock);
 776                 return (-TOUTSTATE);
 777         }
 778         udpf = &us->us_bind_fanout[UDP_BIND_HASH(connp->conn_lport,
 779             us->us_bind_fanout_size)];
 780         mutex_enter(&udpf->uf_lock);
 781         if (connp->conn_mcbc_bind)
 782                 connp->conn_saddr_v6 = ipv6_all_zeros;
 783         else
 784                 connp->conn_saddr_v6 = connp->conn_bound_addr_v6;
 785         connp->conn_laddr_v6 = connp->conn_bound_addr_v6;
 786         connp->conn_faddr_v6 = ipv6_all_zeros;
 787         connp->conn_fport = 0;
 788         udp->udp_state = TS_IDLE;
 789         mutex_exit(&udpf->uf_lock);
 790 
 791         /* Remove any remnants of mapped address binding */
 792         if (connp->conn_family == AF_INET6)
 793                 connp->conn_ipversion = IPV6_VERSION;
 794 
 795         connp->conn_v6lastdst = ipv6_all_zeros;
 796         error = udp_build_hdr_template(connp, &connp->conn_saddr_v6,
 797             &connp->conn_faddr_v6, connp->conn_fport, connp->conn_flowinfo);
 798         mutex_exit(&connp->conn_lock);
 799         if (error != 0)
 800                 return (error);
 801 
 802         /*
 803          * Tell IP to remove the full binding and revert
 804          * to the local address binding.
 805          */
 806         return (ip_laddr_fanout_insert(connp));
 807 }
 808 
 809 static void
 810 udp_tpi_disconnect(queue_t *q, mblk_t *mp)
 811 {
 812         conn_t  *connp = Q_TO_CONN(q);
 813         int     error;
 814 
 815         /*
 816          * Allocate the largest primitive we need to send back
 817          * T_error_ack is > than T_ok_ack
 818          */
 819         mp = reallocb(mp, sizeof (struct T_error_ack), 1);
 820         if (mp == NULL) {
 821                 /* Unable to reuse the T_DISCON_REQ for the ack. */
 822                 udp_err_ack_prim(q, mp, T_DISCON_REQ, TSYSERR, ENOMEM);
 823                 return;
 824         }
 825 
 826         error = udp_do_disconnect(connp);
 827 
 828         if (error != 0) {
 829                 if (error < 0) {
 830                         udp_err_ack(q, mp, -error, 0);
 831                 } else {
 832                         udp_err_ack(q, mp, TSYSERR, error);
 833                 }
 834         } else {
 835                 mp = mi_tpi_ok_ack_alloc(mp);
 836                 ASSERT(mp != NULL);
 837                 qreply(q, mp);
 838         }
 839 }
 840 
 841 int
 842 udp_disconnect(conn_t *connp)
 843 {
 844         int error;
 845 
 846         connp->conn_dgram_errind = B_FALSE;
 847         error = udp_do_disconnect(connp);
 848         if (error < 0)
 849                 error = proto_tlitosyserr(-error);
 850 
 851         return (error);
 852 }
 853 
 854 /* This routine creates a T_ERROR_ACK message and passes it upstream. */
 855 static void
 856 udp_err_ack(queue_t *q, mblk_t *mp, t_scalar_t t_error, int sys_error)
 857 {
 858         if ((mp = mi_tpi_err_ack_alloc(mp, t_error, sys_error)) != NULL)
 859                 qreply(q, mp);
 860 }
 861 
 862 /* Shorthand to generate and send TPI error acks to our client */
 863 static void
 864 udp_err_ack_prim(queue_t *q, mblk_t *mp, t_scalar_t primitive,
 865     t_scalar_t t_error, int sys_error)
 866 {
 867         struct T_error_ack      *teackp;
 868 
 869         if ((mp = tpi_ack_alloc(mp, sizeof (struct T_error_ack),
 870             M_PCPROTO, T_ERROR_ACK)) != NULL) {
 871                 teackp = (struct T_error_ack *)mp->b_rptr;
 872                 teackp->ERROR_prim = primitive;
 873                 teackp->TLI_error = t_error;
 874                 teackp->UNIX_error = sys_error;
 875                 qreply(q, mp);
 876         }
 877 }
 878 
 879 /* At minimum we need 4 bytes of UDP header */
 880 #define ICMP_MIN_UDP_HDR        4
 881 
 882 /*
 883  * udp_icmp_input is called as conn_recvicmp to process ICMP messages.
 884  * Generates the appropriate T_UDERROR_IND for permanent (non-transient) errors.
 885  * Assumes that IP has pulled up everything up to and including the ICMP header.
 886  */
 887 /* ARGSUSED2 */
 888 static void
 889 udp_icmp_input(void *arg1, mblk_t *mp, void *arg2, ip_recv_attr_t *ira)
 890 {
 891         conn_t          *connp = (conn_t *)arg1;
 892         icmph_t         *icmph;
 893         ipha_t          *ipha;
 894         int             iph_hdr_length;
 895         udpha_t         *udpha;
 896         sin_t           sin;
 897         sin6_t          sin6;
 898         mblk_t          *mp1;
 899         int             error = 0;
 900         udp_t           *udp = connp->conn_udp;
 901 
 902         ipha = (ipha_t *)mp->b_rptr;
 903 
 904         ASSERT(OK_32PTR(mp->b_rptr));
 905 
 906         if (IPH_HDR_VERSION(ipha) != IPV4_VERSION) {
 907                 ASSERT(IPH_HDR_VERSION(ipha) == IPV6_VERSION);
 908                 udp_icmp_error_ipv6(connp, mp, ira);
 909                 return;
 910         }
 911         ASSERT(IPH_HDR_VERSION(ipha) == IPV4_VERSION);
 912 
 913         /* Skip past the outer IP and ICMP headers */
 914         ASSERT(IPH_HDR_LENGTH(ipha) == ira->ira_ip_hdr_length);
 915         iph_hdr_length = ira->ira_ip_hdr_length;
 916         icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length];
 917         ipha = (ipha_t *)&icmph[1]; /* Inner IP header */
 918 
 919         /* Skip past the inner IP and find the ULP header */
 920         iph_hdr_length = IPH_HDR_LENGTH(ipha);
 921         udpha = (udpha_t *)((char *)ipha + iph_hdr_length);
 922 
 923         switch (icmph->icmph_type) {
 924         case ICMP_DEST_UNREACHABLE:
 925                 switch (icmph->icmph_code) {
 926                 case ICMP_FRAGMENTATION_NEEDED: {
 927                         ipha_t          *ipha;
 928                         ip_xmit_attr_t  *ixa;
 929                         /*
 930                          * IP has already adjusted the path MTU.
 931                          * But we need to adjust DF for IPv4.
 932                          */
 933                         if (connp->conn_ipversion != IPV4_VERSION)
 934                                 break;
 935 
 936                         ixa = conn_get_ixa(connp, B_FALSE);
 937                         if (ixa == NULL || ixa->ixa_ire == NULL) {
 938                                 /*
 939                                  * Some other thread holds conn_ixa. We will
 940                                  * redo this on the next ICMP too big.
 941                                  */
 942                                 if (ixa != NULL)
 943                                         ixa_refrele(ixa);
 944                                 break;
 945                         }
 946                         (void) ip_get_pmtu(ixa);
 947 
 948                         mutex_enter(&connp->conn_lock);
 949                         ipha = (ipha_t *)connp->conn_ht_iphc;
 950                         if (ixa->ixa_flags & IXAF_PMTU_IPV4_DF) {
 951                                 ipha->ipha_fragment_offset_and_flags |=
 952                                     IPH_DF_HTONS;
 953                         } else {
 954                                 ipha->ipha_fragment_offset_and_flags &=
 955                                     ~IPH_DF_HTONS;
 956                         }
 957                         mutex_exit(&connp->conn_lock);
 958                         ixa_refrele(ixa);
 959                         break;
 960                 }
 961                 case ICMP_PORT_UNREACHABLE:
 962                 case ICMP_PROTOCOL_UNREACHABLE:
 963                         error = ECONNREFUSED;
 964                         break;
 965                 default:
 966                         /* Transient errors */
 967                         break;
 968                 }
 969                 break;
 970         default:
 971                 /* Transient errors */
 972                 break;
 973         }
 974         if (error == 0) {
 975                 freemsg(mp);
 976                 return;
 977         }
 978 
 979         /*
 980          * Deliver T_UDERROR_IND when the application has asked for it.
 981          * The socket layer enables this automatically when connected.
 982          */
 983         if (!connp->conn_dgram_errind) {
 984                 freemsg(mp);
 985                 return;
 986         }
 987 
 988         switch (connp->conn_family) {
 989         case AF_INET:
 990                 sin = sin_null;
 991                 sin.sin_family = AF_INET;
 992                 sin.sin_addr.s_addr = ipha->ipha_dst;
 993                 sin.sin_port = udpha->uha_dst_port;
 994                 if (IPCL_IS_NONSTR(connp)) {
 995                         mutex_enter(&connp->conn_lock);
 996                         if (udp->udp_state == TS_DATA_XFER) {
 997                                 if (sin.sin_port == connp->conn_fport &&
 998                                     sin.sin_addr.s_addr ==
 999                                     connp->conn_faddr_v4) {
1000                                         mutex_exit(&connp->conn_lock);
1001                                         (*connp->conn_upcalls->su_set_error)
1002                                             (connp->conn_upper_handle, error);
1003                                         goto done;
1004                                 }
1005                         } else {
1006                                 udp->udp_delayed_error = error;
1007                                 *((sin_t *)&udp->udp_delayed_addr) = sin;
1008                         }
1009                         mutex_exit(&connp->conn_lock);
1010                 } else {
1011                         mp1 = mi_tpi_uderror_ind((char *)&sin, sizeof (sin_t),
1012                             NULL, 0, error);
1013                         if (mp1 != NULL)
1014                                 putnext(connp->conn_rq, mp1);
1015                 }
1016                 break;
1017         case AF_INET6:
1018                 sin6 = sin6_null;
1019                 sin6.sin6_family = AF_INET6;
1020                 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &sin6.sin6_addr);
1021                 sin6.sin6_port = udpha->uha_dst_port;
1022                 if (IPCL_IS_NONSTR(connp)) {
1023                         mutex_enter(&connp->conn_lock);
1024                         if (udp->udp_state == TS_DATA_XFER) {
1025                                 if (sin6.sin6_port == connp->conn_fport &&
1026                                     IN6_ARE_ADDR_EQUAL(&sin6.sin6_addr,
1027                                     &connp->conn_faddr_v6)) {
1028                                         mutex_exit(&connp->conn_lock);
1029                                         (*connp->conn_upcalls->su_set_error)
1030                                             (connp->conn_upper_handle, error);
1031                                         goto done;
1032                                 }
1033                         } else {
1034                                 udp->udp_delayed_error = error;
1035                                 *((sin6_t *)&udp->udp_delayed_addr) = sin6;
1036                         }
1037                         mutex_exit(&connp->conn_lock);
1038                 } else {
1039                         mp1 = mi_tpi_uderror_ind((char *)&sin6, sizeof (sin6_t),
1040                             NULL, 0, error);
1041                         if (mp1 != NULL)
1042                                 putnext(connp->conn_rq, mp1);
1043                 }
1044                 break;
1045         }
1046 done:
1047         freemsg(mp);
1048 }
1049 
1050 /*
1051  * udp_icmp_error_ipv6 is called by udp_icmp_error to process ICMP for IPv6.
1052  * Generates the appropriate T_UDERROR_IND for permanent (non-transient) errors.
1053  * Assumes that IP has pulled up all the extension headers as well as the
1054  * ICMPv6 header.
1055  */
1056 static void
1057 udp_icmp_error_ipv6(conn_t *connp, mblk_t *mp, ip_recv_attr_t *ira)
1058 {
1059         icmp6_t         *icmp6;
1060         ip6_t           *ip6h, *outer_ip6h;
1061         uint16_t        iph_hdr_length;
1062         uint8_t         *nexthdrp;
1063         udpha_t         *udpha;
1064         sin6_t          sin6;
1065         mblk_t          *mp1;
1066         int             error = 0;
1067         udp_t           *udp = connp->conn_udp;
1068         udp_stack_t     *us = udp->udp_us;
1069 
1070         outer_ip6h = (ip6_t *)mp->b_rptr;
1071 #ifdef DEBUG
1072         if (outer_ip6h->ip6_nxt != IPPROTO_ICMPV6)
1073                 iph_hdr_length = ip_hdr_length_v6(mp, outer_ip6h);
1074         else
1075                 iph_hdr_length = IPV6_HDR_LEN;
1076         ASSERT(iph_hdr_length == ira->ira_ip_hdr_length);
1077 #endif
1078         /* Skip past the outer IP and ICMP headers */
1079         iph_hdr_length = ira->ira_ip_hdr_length;
1080         icmp6 = (icmp6_t *)&mp->b_rptr[iph_hdr_length];
1081 
1082         /* Skip past the inner IP and find the ULP header */
1083         ip6h = (ip6_t *)&icmp6[1];  /* Inner IP header */
1084         if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &iph_hdr_length, &nexthdrp)) {
1085                 freemsg(mp);
1086                 return;
1087         }
1088         udpha = (udpha_t *)((char *)ip6h + iph_hdr_length);
1089 
1090         switch (icmp6->icmp6_type) {
1091         case ICMP6_DST_UNREACH:
1092                 switch (icmp6->icmp6_code) {
1093                 case ICMP6_DST_UNREACH_NOPORT:
1094                         error = ECONNREFUSED;
1095                         break;
1096                 case ICMP6_DST_UNREACH_ADMIN:
1097                 case ICMP6_DST_UNREACH_NOROUTE:
1098                 case ICMP6_DST_UNREACH_BEYONDSCOPE:
1099                 case ICMP6_DST_UNREACH_ADDR:
1100                         /* Transient errors */
1101                         break;
1102                 default:
1103                         break;
1104                 }
1105                 break;
1106         case ICMP6_PACKET_TOO_BIG: {
1107                 struct T_unitdata_ind   *tudi;
1108                 struct T_opthdr         *toh;
1109                 size_t                  udi_size;
1110                 mblk_t                  *newmp;
1111                 t_scalar_t              opt_length = sizeof (struct T_opthdr) +
1112                     sizeof (struct ip6_mtuinfo);
1113                 sin6_t                  *sin6;
1114                 struct ip6_mtuinfo      *mtuinfo;
1115 
1116                 /*
1117                  * If the application has requested to receive path mtu
1118                  * information, send up an empty message containing an
1119                  * IPV6_PATHMTU ancillary data item.
1120                  */
1121                 if (!connp->conn_ipv6_recvpathmtu)
1122                         break;
1123 
1124                 udi_size = sizeof (struct T_unitdata_ind) + sizeof (sin6_t) +
1125                     opt_length;
1126                 if ((newmp = allocb(udi_size, BPRI_MED)) == NULL) {
1127                         UDPS_BUMP_MIB(us, udpInErrors);
1128                         break;
1129                 }
1130 
1131                 /*
1132                  * newmp->b_cont is left to NULL on purpose.  This is an
1133                  * empty message containing only ancillary data.
1134                  */
1135                 newmp->b_datap->db_type = M_PROTO;
1136                 tudi = (struct T_unitdata_ind *)newmp->b_rptr;
1137                 newmp->b_wptr = (uchar_t *)tudi + udi_size;
1138                 tudi->PRIM_type = T_UNITDATA_IND;
1139                 tudi->SRC_length = sizeof (sin6_t);
1140                 tudi->SRC_offset = sizeof (struct T_unitdata_ind);
1141                 tudi->OPT_offset = tudi->SRC_offset + sizeof (sin6_t);
1142                 tudi->OPT_length = opt_length;
1143 
1144                 sin6 = (sin6_t *)&tudi[1];
1145                 bzero(sin6, sizeof (sin6_t));
1146                 sin6->sin6_family = AF_INET6;
1147                 sin6->sin6_addr = connp->conn_faddr_v6;
1148 
1149                 toh = (struct T_opthdr *)&sin6[1];
1150                 toh->level = IPPROTO_IPV6;
1151                 toh->name = IPV6_PATHMTU;
1152                 toh->len = opt_length;
1153                 toh->status = 0;
1154 
1155                 mtuinfo = (struct ip6_mtuinfo *)&toh[1];
1156                 bzero(mtuinfo, sizeof (struct ip6_mtuinfo));
1157                 mtuinfo->ip6m_addr.sin6_family = AF_INET6;
1158                 mtuinfo->ip6m_addr.sin6_addr = ip6h->ip6_dst;
1159                 mtuinfo->ip6m_mtu = icmp6->icmp6_mtu;
1160                 /*
1161                  * We've consumed everything we need from the original
1162                  * message.  Free it, then send our empty message.
1163                  */
1164                 freemsg(mp);
1165                 udp_ulp_recv(connp, newmp, msgdsize(newmp), ira);
1166                 return;
1167         }
1168         case ICMP6_TIME_EXCEEDED:
1169                 /* Transient errors */
1170                 break;
1171         case ICMP6_PARAM_PROB:
1172                 /* If this corresponds to an ICMP_PROTOCOL_UNREACHABLE */
1173                 if (icmp6->icmp6_code == ICMP6_PARAMPROB_NEXTHEADER &&
1174                     (uchar_t *)ip6h + icmp6->icmp6_pptr ==
1175                     (uchar_t *)nexthdrp) {
1176                         error = ECONNREFUSED;
1177                         break;
1178                 }
1179                 break;
1180         }
1181         if (error == 0) {
1182                 freemsg(mp);
1183                 return;
1184         }
1185 
1186         /*
1187          * Deliver T_UDERROR_IND when the application has asked for it.
1188          * The socket layer enables this automatically when connected.
1189          */
1190         if (!connp->conn_dgram_errind) {
1191                 freemsg(mp);
1192                 return;
1193         }
1194 
1195         sin6 = sin6_null;
1196         sin6.sin6_family = AF_INET6;
1197         sin6.sin6_addr = ip6h->ip6_dst;
1198         sin6.sin6_port = udpha->uha_dst_port;
1199         sin6.sin6_flowinfo = ip6h->ip6_vcf & ~IPV6_VERS_AND_FLOW_MASK;
1200 
1201         if (IPCL_IS_NONSTR(connp)) {
1202                 mutex_enter(&connp->conn_lock);
1203                 if (udp->udp_state == TS_DATA_XFER) {
1204                         if (sin6.sin6_port == connp->conn_fport &&
1205                             IN6_ARE_ADDR_EQUAL(&sin6.sin6_addr,
1206                             &connp->conn_faddr_v6)) {
1207                                 mutex_exit(&connp->conn_lock);
1208                                 (*connp->conn_upcalls->su_set_error)
1209                                     (connp->conn_upper_handle, error);
1210                                 goto done;
1211                         }
1212                 } else {
1213                         udp->udp_delayed_error = error;
1214                         *((sin6_t *)&udp->udp_delayed_addr) = sin6;
1215                 }
1216                 mutex_exit(&connp->conn_lock);
1217         } else {
1218                 mp1 = mi_tpi_uderror_ind((char *)&sin6, sizeof (sin6_t),
1219                     NULL, 0, error);
1220                 if (mp1 != NULL)
1221                         putnext(connp->conn_rq, mp1);
1222         }
1223 done:
1224         freemsg(mp);
1225 }
1226 
1227 /*
1228  * This routine responds to T_ADDR_REQ messages.  It is called by udp_wput.
1229  * The local address is filled in if endpoint is bound. The remote address
1230  * is filled in if remote address has been precified ("connected endpoint")
1231  * (The concept of connected CLTS sockets is alien to published TPI
1232  *  but we support it anyway).
1233  */
1234 static void
1235 udp_addr_req(queue_t *q, mblk_t *mp)
1236 {
1237         struct sockaddr *sa;
1238         mblk_t  *ackmp;
1239         struct T_addr_ack *taa;
1240         udp_t   *udp = Q_TO_UDP(q);
1241         conn_t  *connp = udp->udp_connp;
1242         uint_t  addrlen;
1243 
1244         /* Make it large enough for worst case */
1245         ackmp = reallocb(mp, sizeof (struct T_addr_ack) +
1246             2 * sizeof (sin6_t), 1);
1247         if (ackmp == NULL) {
1248                 udp_err_ack(q, mp, TSYSERR, ENOMEM);
1249                 return;
1250         }
1251         taa = (struct T_addr_ack *)ackmp->b_rptr;
1252 
1253         bzero(taa, sizeof (struct T_addr_ack));
1254         ackmp->b_wptr = (uchar_t *)&taa[1];
1255 
1256         taa->PRIM_type = T_ADDR_ACK;
1257         ackmp->b_datap->db_type = M_PCPROTO;
1258 
1259         if (connp->conn_family == AF_INET)
1260                 addrlen = sizeof (sin_t);
1261         else
1262                 addrlen = sizeof (sin6_t);
1263 
1264         mutex_enter(&connp->conn_lock);
1265         /*
1266          * Note: Following code assumes 32 bit alignment of basic
1267          * data structures like sin_t and struct T_addr_ack.
1268          */
1269         if (udp->udp_state != TS_UNBND) {
1270                 /*
1271                  * Fill in local address first
1272                  */
1273                 taa->LOCADDR_offset = sizeof (*taa);
1274                 taa->LOCADDR_length = addrlen;
1275                 sa = (struct sockaddr *)&taa[1];
1276                 (void) conn_getsockname(connp, sa, &addrlen);
1277                 ackmp->b_wptr += addrlen;
1278         }
1279         if (udp->udp_state == TS_DATA_XFER) {
1280                 /*
1281                  * connected, fill remote address too
1282                  */
1283                 taa->REMADDR_length = addrlen;
1284                 /* assumed 32-bit alignment */
1285                 taa->REMADDR_offset = taa->LOCADDR_offset + taa->LOCADDR_length;
1286                 sa = (struct sockaddr *)(ackmp->b_rptr + taa->REMADDR_offset);
1287                 (void) conn_getpeername(connp, sa, &addrlen);
1288                 ackmp->b_wptr += addrlen;
1289         }
1290         mutex_exit(&connp->conn_lock);
1291         ASSERT(ackmp->b_wptr <= ackmp->b_datap->db_lim);
1292         qreply(q, ackmp);
1293 }
1294 
1295 static void
1296 udp_copy_info(struct T_info_ack *tap, udp_t *udp)
1297 {
1298         conn_t          *connp = udp->udp_connp;
1299 
1300         if (connp->conn_family == AF_INET) {
1301                 *tap = udp_g_t_info_ack_ipv4;
1302         } else {
1303                 *tap = udp_g_t_info_ack_ipv6;
1304         }
1305         tap->CURRENT_state = udp->udp_state;
1306         tap->OPT_size = udp_max_optsize;
1307 }
1308 
1309 static void
1310 udp_do_capability_ack(udp_t *udp, struct T_capability_ack *tcap,
1311     t_uscalar_t cap_bits1)
1312 {
1313         tcap->CAP_bits1 = 0;
1314 
1315         if (cap_bits1 & TC1_INFO) {
1316                 udp_copy_info(&tcap->INFO_ack, udp);
1317                 tcap->CAP_bits1 |= TC1_INFO;
1318         }
1319 }
1320 
1321 /*
1322  * This routine responds to T_CAPABILITY_REQ messages.  It is called by
1323  * udp_wput.  Much of the T_CAPABILITY_ACK information is copied from
1324  * udp_g_t_info_ack.  The current state of the stream is copied from
1325  * udp_state.
1326  */
1327 static void
1328 udp_capability_req(queue_t *q, mblk_t *mp)
1329 {
1330         t_uscalar_t             cap_bits1;
1331         struct T_capability_ack *tcap;
1332         udp_t   *udp = Q_TO_UDP(q);
1333 
1334         cap_bits1 = ((struct T_capability_req *)mp->b_rptr)->CAP_bits1;
1335 
1336         mp = tpi_ack_alloc(mp, sizeof (struct T_capability_ack),
1337             mp->b_datap->db_type, T_CAPABILITY_ACK);
1338         if (!mp)
1339                 return;
1340 
1341         tcap = (struct T_capability_ack *)mp->b_rptr;
1342         udp_do_capability_ack(udp, tcap, cap_bits1);
1343 
1344         qreply(q, mp);
1345 }
1346 
1347 /*
1348  * This routine responds to T_INFO_REQ messages.  It is called by udp_wput.
1349  * Most of the T_INFO_ACK information is copied from udp_g_t_info_ack.
1350  * The current state of the stream is copied from udp_state.
1351  */
1352 static void
1353 udp_info_req(queue_t *q, mblk_t *mp)
1354 {
1355         udp_t *udp = Q_TO_UDP(q);
1356 
1357         /* Create a T_INFO_ACK message. */
1358         mp = tpi_ack_alloc(mp, sizeof (struct T_info_ack), M_PCPROTO,
1359             T_INFO_ACK);
1360         if (!mp)
1361                 return;
1362         udp_copy_info((struct T_info_ack *)mp->b_rptr, udp);
1363         qreply(q, mp);
1364 }
1365 
1366 /* For /dev/udp aka AF_INET open */
1367 static int
1368 udp_openv4(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp)
1369 {
1370         return (udp_open(q, devp, flag, sflag, credp, B_FALSE));
1371 }
1372 
1373 /* For /dev/udp6 aka AF_INET6 open */
1374 static int
1375 udp_openv6(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp)
1376 {
1377         return (udp_open(q, devp, flag, sflag, credp, B_TRUE));
1378 }
1379 
1380 /*
1381  * This is the open routine for udp.  It allocates a udp_t structure for
1382  * the stream and, on the first open of the module, creates an ND table.
1383  */
1384 static int
1385 udp_open(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp,
1386     boolean_t isv6)
1387 {
1388         udp_t           *udp;
1389         conn_t          *connp;
1390         dev_t           conn_dev;
1391         vmem_t          *minor_arena;
1392         int             err;
1393 
1394         /* If the stream is already open, return immediately. */
1395         if (q->q_ptr != NULL)
1396                 return (0);
1397 
1398         if (sflag == MODOPEN)
1399                 return (EINVAL);
1400 
1401         if ((ip_minor_arena_la != NULL) && (flag & SO_SOCKSTR) &&
1402             ((conn_dev = inet_minor_alloc(ip_minor_arena_la)) != 0)) {
1403                 minor_arena = ip_minor_arena_la;
1404         } else {
1405                 /*
1406                  * Either minor numbers in the large arena were exhausted
1407                  * or a non socket application is doing the open.
1408                  * Try to allocate from the small arena.
1409                  */
1410                 if ((conn_dev = inet_minor_alloc(ip_minor_arena_sa)) == 0)
1411                         return (EBUSY);
1412 
1413                 minor_arena = ip_minor_arena_sa;
1414         }
1415 
1416         if (flag & SO_FALLBACK) {
1417                 /*
1418                  * Non streams socket needs a stream to fallback to
1419                  */
1420                 RD(q)->q_ptr = (void *)conn_dev;
1421                 WR(q)->q_qinfo = &udp_fallback_sock_winit;
1422                 WR(q)->q_ptr = (void *)minor_arena;
1423                 qprocson(q);
1424                 return (0);
1425         }
1426 
1427         connp = udp_do_open(credp, isv6, KM_SLEEP, &err);
1428         if (connp == NULL) {
1429                 inet_minor_free(minor_arena, conn_dev);
1430                 return (err);
1431         }
1432         udp = connp->conn_udp;
1433 
1434         *devp = makedevice(getemajor(*devp), (minor_t)conn_dev);
1435         connp->conn_dev = conn_dev;
1436         connp->conn_minor_arena = minor_arena;
1437 
1438         /*
1439          * Initialize the udp_t structure for this stream.
1440          */
1441         q->q_ptr = connp;
1442         WR(q)->q_ptr = connp;
1443         connp->conn_rq = q;
1444         connp->conn_wq = WR(q);
1445 
1446         /*
1447          * Since this conn_t/udp_t is not yet visible to anybody else we don't
1448          * need to lock anything.
1449          */
1450         ASSERT(connp->conn_proto == IPPROTO_UDP);
1451         ASSERT(connp->conn_udp == udp);
1452         ASSERT(udp->udp_connp == connp);
1453 
1454         if (flag & SO_SOCKSTR) {
1455                 udp->udp_issocket = B_TRUE;
1456         }
1457 
1458         WR(q)->q_hiwat = connp->conn_sndbuf;
1459         WR(q)->q_lowat = connp->conn_sndlowat;
1460 
1461         qprocson(q);
1462 
1463         /* Set the Stream head write offset and high watermark. */
1464         (void) proto_set_tx_wroff(q, connp, connp->conn_wroff);
1465         (void) proto_set_rx_hiwat(q, connp,
1466             udp_set_rcv_hiwat(udp, connp->conn_rcvbuf));
1467 
1468         mutex_enter(&connp->conn_lock);
1469         connp->conn_state_flags &= ~CONN_INCIPIENT;
1470         mutex_exit(&connp->conn_lock);
1471         return (0);
1472 }
1473 
1474 /*
1475  * Which UDP options OK to set through T_UNITDATA_REQ...
1476  */
1477 /* ARGSUSED */
1478 static boolean_t
1479 udp_opt_allow_udr_set(t_scalar_t level, t_scalar_t name)
1480 {
1481         return (B_TRUE);
1482 }
1483 
1484 /*
1485  * This routine gets default values of certain options whose default
1486  * values are maintained by protcol specific code
1487  */
1488 int
1489 udp_opt_default(queue_t *q, t_scalar_t level, t_scalar_t name, uchar_t *ptr)
1490 {
1491         udp_t           *udp = Q_TO_UDP(q);
1492         udp_stack_t *us = udp->udp_us;
1493         int *i1 = (int *)ptr;
1494 
1495         switch (level) {
1496         case IPPROTO_IP:
1497                 switch (name) {
1498                 case IP_MULTICAST_TTL:
1499                         *ptr = (uchar_t)IP_DEFAULT_MULTICAST_TTL;
1500                         return (sizeof (uchar_t));
1501                 case IP_MULTICAST_LOOP:
1502                         *ptr = (uchar_t)IP_DEFAULT_MULTICAST_LOOP;
1503                         return (sizeof (uchar_t));
1504                 }
1505                 break;
1506         case IPPROTO_IPV6:
1507                 switch (name) {
1508                 case IPV6_MULTICAST_HOPS:
1509                         *i1 = IP_DEFAULT_MULTICAST_TTL;
1510                         return (sizeof (int));
1511                 case IPV6_MULTICAST_LOOP:
1512                         *i1 = IP_DEFAULT_MULTICAST_LOOP;
1513                         return (sizeof (int));
1514                 case IPV6_UNICAST_HOPS:
1515                         *i1 = us->us_ipv6_hoplimit;
1516                         return (sizeof (int));
1517                 }
1518                 break;
1519         }
1520         return (-1);
1521 }
1522 
1523 /*
1524  * This routine retrieves the current status of socket options.
1525  * It returns the size of the option retrieved, or -1.
1526  */
1527 int
1528 udp_opt_get(conn_t *connp, t_scalar_t level, t_scalar_t name,
1529     uchar_t *ptr)
1530 {
1531         int             *i1 = (int *)ptr;
1532         udp_t           *udp = connp->conn_udp;
1533         int             len;
1534         conn_opt_arg_t  coas;
1535         int             retval;
1536 
1537         coas.coa_connp = connp;
1538         coas.coa_ixa = connp->conn_ixa;
1539         coas.coa_ipp = &connp->conn_xmit_ipp;
1540         coas.coa_ancillary = B_FALSE;
1541         coas.coa_changed = 0;
1542 
1543         /*
1544          * We assume that the optcom framework has checked for the set
1545          * of levels and names that are supported, hence we don't worry
1546          * about rejecting based on that.
1547          * First check for UDP specific handling, then pass to common routine.
1548          */
1549         switch (level) {
1550         case IPPROTO_IP:
1551                 /*
1552                  * Only allow IPv4 option processing on IPv4 sockets.
1553                  */
1554                 if (connp->conn_family != AF_INET)
1555                         return (-1);
1556 
1557                 switch (name) {
1558                 case IP_OPTIONS:
1559                 case T_IP_OPTIONS:
1560                         mutex_enter(&connp->conn_lock);
1561                         if (!(udp->udp_recv_ipp.ipp_fields &
1562                             IPPF_IPV4_OPTIONS)) {
1563                                 mutex_exit(&connp->conn_lock);
1564                                 return (0);
1565                         }
1566 
1567                         len = udp->udp_recv_ipp.ipp_ipv4_options_len;
1568                         ASSERT(len != 0);
1569                         bcopy(udp->udp_recv_ipp.ipp_ipv4_options, ptr, len);
1570                         mutex_exit(&connp->conn_lock);
1571                         return (len);
1572                 }
1573                 break;
1574         case IPPROTO_UDP:
1575                 switch (name) {
1576                 case UDP_NAT_T_ENDPOINT:
1577                         mutex_enter(&connp->conn_lock);
1578                         *i1 = udp->udp_nat_t_endpoint;
1579                         mutex_exit(&connp->conn_lock);
1580                         return (sizeof (int));
1581                 case UDP_RCVHDR:
1582                         mutex_enter(&connp->conn_lock);
1583                         *i1 = udp->udp_rcvhdr ? 1 : 0;
1584                         mutex_exit(&connp->conn_lock);
1585                         return (sizeof (int));
1586                 }
1587         }
1588         mutex_enter(&connp->conn_lock);
1589         retval = conn_opt_get(&coas, level, name, ptr);
1590         mutex_exit(&connp->conn_lock);
1591         return (retval);
1592 }
1593 
1594 /*
1595  * This routine retrieves the current status of socket options.
1596  * It returns the size of the option retrieved, or -1.
1597  */
1598 int
1599 udp_tpi_opt_get(queue_t *q, t_scalar_t level, t_scalar_t name, uchar_t *ptr)
1600 {
1601         conn_t          *connp = Q_TO_CONN(q);
1602         int             err;
1603 
1604         err = udp_opt_get(connp, level, name, ptr);
1605         return (err);
1606 }
1607 
1608 /*
1609  * This routine sets socket options.
1610  */
1611 int
1612 udp_do_opt_set(conn_opt_arg_t *coa, int level, int name,
1613     uint_t inlen, uchar_t *invalp, cred_t *cr, boolean_t checkonly)
1614 {
1615         conn_t          *connp = coa->coa_connp;
1616         ip_xmit_attr_t  *ixa = coa->coa_ixa;
1617         udp_t           *udp = connp->conn_udp;
1618         udp_stack_t     *us = udp->udp_us;
1619         int             *i1 = (int *)invalp;
1620         boolean_t       onoff = (*i1 == 0) ? 0 : 1;
1621         int             error;
1622 
1623         ASSERT(MUTEX_NOT_HELD(&coa->coa_connp->conn_lock));
1624         /*
1625          * First do UDP specific sanity checks and handle UDP specific
1626          * options. Note that some IPPROTO_UDP options are handled
1627          * by conn_opt_set.
1628          */
1629         switch (level) {
1630         case SOL_SOCKET:
1631                 switch (name) {
1632                 case SO_SNDBUF:
1633                         if (*i1 > us->us_max_buf) {
1634                                 return (ENOBUFS);
1635                         }
1636                         break;
1637                 case SO_RCVBUF:
1638                         if (*i1 > us->us_max_buf) {
1639                                 return (ENOBUFS);
1640                         }
1641                         break;
1642 
1643                 case SCM_UCRED: {
1644                         struct ucred_s *ucr;
1645                         cred_t *newcr;
1646                         ts_label_t *tsl;
1647 
1648                         /*
1649                          * Only sockets that have proper privileges and are
1650                          * bound to MLPs will have any other value here, so
1651                          * this implicitly tests for privilege to set label.
1652                          */
1653                         if (connp->conn_mlp_type == mlptSingle)
1654                                 break;
1655 
1656                         ucr = (struct ucred_s *)invalp;
1657                         if (inlen < sizeof (*ucr) + sizeof (bslabel_t) ||
1658                             ucr->uc_labeloff < sizeof (*ucr) ||
1659                             ucr->uc_labeloff + sizeof (bslabel_t) > inlen)
1660                                 return (EINVAL);
1661                         if (!checkonly) {
1662                                 /*
1663                                  * Set ixa_tsl to the new label.
1664                                  * We assume that crgetzoneid doesn't change
1665                                  * as part of the SCM_UCRED.
1666                                  */
1667                                 ASSERT(cr != NULL);
1668                                 if ((tsl = crgetlabel(cr)) == NULL)
1669                                         return (EINVAL);
1670                                 newcr = copycred_from_bslabel(cr, UCLABEL(ucr),
1671                                     tsl->tsl_doi, KM_NOSLEEP);
1672                                 if (newcr == NULL)
1673                                         return (ENOSR);
1674                                 ASSERT(newcr->cr_label != NULL);
1675                                 /*
1676                                  * Move the hold on the cr_label to ixa_tsl by
1677                                  * setting cr_label to NULL. Then release newcr.
1678                                  */
1679                                 ip_xmit_attr_replace_tsl(ixa, newcr->cr_label);
1680                                 ixa->ixa_flags |= IXAF_UCRED_TSL;
1681                                 newcr->cr_label = NULL;
1682                                 crfree(newcr);
1683                                 coa->coa_changed |= COA_HEADER_CHANGED;
1684                                 coa->coa_changed |= COA_WROFF_CHANGED;
1685                         }
1686                         /* Fully handled this option. */
1687                         return (0);
1688                 }
1689                 }
1690                 break;
1691         case IPPROTO_UDP:
1692                 switch (name) {
1693                 case UDP_NAT_T_ENDPOINT:
1694                         if ((error = secpolicy_ip_config(cr, B_FALSE)) != 0) {
1695                                 return (error);
1696                         }
1697 
1698                         /*
1699                          * Use conn_family instead so we can avoid ambiguitites
1700                          * with AF_INET6 sockets that may switch from IPv4
1701                          * to IPv6.
1702                          */
1703                         if (connp->conn_family != AF_INET) {
1704                                 return (EAFNOSUPPORT);
1705                         }
1706 
1707                         if (!checkonly) {
1708                                 mutex_enter(&connp->conn_lock);
1709                                 udp->udp_nat_t_endpoint = onoff;
1710                                 mutex_exit(&connp->conn_lock);
1711                                 coa->coa_changed |= COA_HEADER_CHANGED;
1712                                 coa->coa_changed |= COA_WROFF_CHANGED;
1713                         }
1714                         /* Fully handled this option. */
1715                         return (0);
1716                 case UDP_RCVHDR:
1717                         mutex_enter(&connp->conn_lock);
1718                         udp->udp_rcvhdr = onoff;
1719                         mutex_exit(&connp->conn_lock);
1720                         return (0);
1721                 }
1722                 break;
1723         }
1724         error = conn_opt_set(coa, level, name, inlen, invalp,
1725             checkonly, cr);
1726         return (error);
1727 }
1728 
1729 /*
1730  * This routine sets socket options.
1731  */
1732 int
1733 udp_opt_set(conn_t *connp, uint_t optset_context, int level,
1734     int name, uint_t inlen, uchar_t *invalp, uint_t *outlenp,
1735     uchar_t *outvalp, void *thisdg_attrs, cred_t *cr)
1736 {
1737         udp_t           *udp = connp->conn_udp;
1738         int             err;
1739         conn_opt_arg_t  coas, *coa;
1740         boolean_t       checkonly;
1741         udp_stack_t     *us = udp->udp_us;
1742 
1743         switch (optset_context) {
1744         case SETFN_OPTCOM_CHECKONLY:
1745                 checkonly = B_TRUE;
1746                 /*
1747                  * Note: Implies T_CHECK semantics for T_OPTCOM_REQ
1748                  * inlen != 0 implies value supplied and
1749                  *      we have to "pretend" to set it.
1750                  * inlen == 0 implies that there is no
1751                  *      value part in T_CHECK request and just validation
1752                  * done elsewhere should be enough, we just return here.
1753                  */
1754                 if (inlen == 0) {
1755                         *outlenp = 0;
1756                         return (0);
1757                 }
1758                 break;
1759         case SETFN_OPTCOM_NEGOTIATE:
1760                 checkonly = B_FALSE;
1761                 break;
1762         case SETFN_UD_NEGOTIATE:
1763         case SETFN_CONN_NEGOTIATE:
1764                 checkonly = B_FALSE;
1765                 /*
1766                  * Negotiating local and "association-related" options
1767                  * through T_UNITDATA_REQ.
1768                  *
1769                  * Following routine can filter out ones we do not
1770                  * want to be "set" this way.
1771                  */
1772                 if (!udp_opt_allow_udr_set(level, name)) {
1773                         *outlenp = 0;
1774                         return (EINVAL);
1775                 }
1776                 break;
1777         default:
1778                 /*
1779                  * We should never get here
1780                  */
1781                 *outlenp = 0;
1782                 return (EINVAL);
1783         }
1784 
1785         ASSERT((optset_context != SETFN_OPTCOM_CHECKONLY) ||
1786             (optset_context == SETFN_OPTCOM_CHECKONLY && inlen != 0));
1787 
1788         if (thisdg_attrs != NULL) {
1789                 /* Options from T_UNITDATA_REQ */
1790                 coa = (conn_opt_arg_t *)thisdg_attrs;
1791                 ASSERT(coa->coa_connp == connp);
1792                 ASSERT(coa->coa_ixa != NULL);
1793                 ASSERT(coa->coa_ipp != NULL);
1794                 ASSERT(coa->coa_ancillary);
1795         } else {
1796                 coa = &coas;
1797                 coas.coa_connp = connp;
1798                 /* Get a reference on conn_ixa to prevent concurrent mods */
1799                 coas.coa_ixa = conn_get_ixa(connp, B_TRUE);
1800                 if (coas.coa_ixa == NULL) {
1801                         *outlenp = 0;
1802                         return (ENOMEM);
1803                 }
1804                 coas.coa_ipp = &connp->conn_xmit_ipp;
1805                 coas.coa_ancillary = B_FALSE;
1806                 coas.coa_changed = 0;
1807         }
1808 
1809         err = udp_do_opt_set(coa, level, name, inlen, invalp,
1810             cr, checkonly);
1811         if (err != 0) {
1812 errout:
1813                 if (!coa->coa_ancillary)
1814                         ixa_refrele(coa->coa_ixa);
1815                 *outlenp = 0;
1816                 return (err);
1817         }
1818         /* Handle DHCPINIT here outside of lock */
1819         if (level == IPPROTO_IP && name == IP_DHCPINIT_IF) {
1820                 uint_t  ifindex;
1821                 ill_t   *ill;
1822 
1823                 ifindex = *(uint_t *)invalp;
1824                 if (ifindex == 0) {
1825                         ill = NULL;
1826                 } else {
1827                         ill = ill_lookup_on_ifindex(ifindex, B_FALSE,
1828                             coa->coa_ixa->ixa_ipst);
1829                         if (ill == NULL) {
1830                                 err = ENXIO;
1831                                 goto errout;
1832                         }
1833 
1834                         mutex_enter(&ill->ill_lock);
1835                         if (ill->ill_state_flags & ILL_CONDEMNED) {
1836                                 mutex_exit(&ill->ill_lock);
1837                                 ill_refrele(ill);
1838                                 err = ENXIO;
1839                                 goto errout;
1840                         }
1841                         if (IS_VNI(ill)) {
1842                                 mutex_exit(&ill->ill_lock);
1843                                 ill_refrele(ill);
1844                                 err = EINVAL;
1845                                 goto errout;
1846                         }
1847                 }
1848                 mutex_enter(&connp->conn_lock);
1849 
1850                 if (connp->conn_dhcpinit_ill != NULL) {
1851                         /*
1852                          * We've locked the conn so conn_cleanup_ill()
1853                          * cannot clear conn_dhcpinit_ill -- so it's
1854                          * safe to access the ill.
1855                          */
1856                         ill_t *oill = connp->conn_dhcpinit_ill;
1857 
1858                         ASSERT(oill->ill_dhcpinit != 0);
1859                         atomic_dec_32(&oill->ill_dhcpinit);
1860                         ill_set_inputfn(connp->conn_dhcpinit_ill);
1861                         connp->conn_dhcpinit_ill = NULL;
1862                 }
1863 
1864                 if (ill != NULL) {
1865                         connp->conn_dhcpinit_ill = ill;
1866                         atomic_inc_32(&ill->ill_dhcpinit);
1867                         ill_set_inputfn(ill);
1868                         mutex_exit(&connp->conn_lock);
1869                         mutex_exit(&ill->ill_lock);
1870                         ill_refrele(ill);
1871                 } else {
1872                         mutex_exit(&connp->conn_lock);
1873                 }
1874         }
1875 
1876         /*
1877          * Common case of OK return with outval same as inval.
1878          */
1879         if (invalp != outvalp) {
1880                 /* don't trust bcopy for identical src/dst */
1881                 (void) bcopy(invalp, outvalp, inlen);
1882         }
1883         *outlenp = inlen;
1884 
1885         /*
1886          * If this was not ancillary data, then we rebuild the headers,
1887          * update the IRE/NCE, and IPsec as needed.
1888          * Since the label depends on the destination we go through
1889          * ip_set_destination first.
1890          */
1891         if (coa->coa_ancillary) {
1892                 return (0);
1893         }
1894 
1895         if (coa->coa_changed & COA_ROUTE_CHANGED) {
1896                 in6_addr_t saddr, faddr, nexthop;
1897                 in_port_t fport;
1898 
1899                 /*
1900                  * We clear lastdst to make sure we pick up the change
1901                  * next time sending.
1902                  * If we are connected we re-cache the information.
1903                  * We ignore errors to preserve BSD behavior.
1904                  * Note that we don't redo IPsec policy lookup here
1905                  * since the final destination (or source) didn't change.
1906                  */
1907                 mutex_enter(&connp->conn_lock);
1908                 connp->conn_v6lastdst = ipv6_all_zeros;
1909 
1910                 ip_attr_nexthop(coa->coa_ipp, coa->coa_ixa,
1911                     &connp->conn_faddr_v6, &nexthop);
1912                 saddr = connp->conn_saddr_v6;
1913                 faddr = connp->conn_faddr_v6;
1914                 fport = connp->conn_fport;
1915                 mutex_exit(&connp->conn_lock);
1916 
1917                 if (!IN6_IS_ADDR_UNSPECIFIED(&faddr) &&
1918                     !IN6_IS_ADDR_V4MAPPED_ANY(&faddr)) {
1919                         (void) ip_attr_connect(connp, coa->coa_ixa,
1920                             &saddr, &faddr, &nexthop, fport, NULL, NULL,
1921                             IPDF_ALLOW_MCBC | IPDF_VERIFY_DST);
1922                 }
1923         }
1924 
1925         ixa_refrele(coa->coa_ixa);
1926 
1927         if (coa->coa_changed & COA_HEADER_CHANGED) {
1928                 /*
1929                  * Rebuild the header template if we are connected.
1930                  * Otherwise clear conn_v6lastdst so we rebuild the header
1931                  * in the data path.
1932                  */
1933                 mutex_enter(&connp->conn_lock);
1934                 if (!IN6_IS_ADDR_UNSPECIFIED(&connp->conn_faddr_v6) &&
1935                     !IN6_IS_ADDR_V4MAPPED_ANY(&connp->conn_faddr_v6)) {
1936                         err = udp_build_hdr_template(connp,
1937                             &connp->conn_saddr_v6, &connp->conn_faddr_v6,
1938                             connp->conn_fport, connp->conn_flowinfo);
1939                         if (err != 0) {
1940                                 mutex_exit(&connp->conn_lock);
1941                                 return (err);
1942                         }
1943                 } else {
1944                         connp->conn_v6lastdst = ipv6_all_zeros;
1945                 }
1946                 mutex_exit(&connp->conn_lock);
1947         }
1948         if (coa->coa_changed & COA_RCVBUF_CHANGED) {
1949                 (void) proto_set_rx_hiwat(connp->conn_rq, connp,
1950                     connp->conn_rcvbuf);
1951         }
1952         if ((coa->coa_changed & COA_SNDBUF_CHANGED) && !IPCL_IS_NONSTR(connp)) {
1953                 connp->conn_wq->q_hiwat = connp->conn_sndbuf;
1954         }
1955         if (coa->coa_changed & COA_WROFF_CHANGED) {
1956                 /* Increase wroff if needed */
1957                 uint_t wroff;
1958 
1959                 mutex_enter(&connp->conn_lock);
1960                 wroff = connp->conn_ht_iphc_allocated + us->us_wroff_extra;
1961                 if (udp->udp_nat_t_endpoint)
1962                         wroff += sizeof (uint32_t);
1963                 if (wroff > connp->conn_wroff) {
1964                         connp->conn_wroff = wroff;
1965                         mutex_exit(&connp->conn_lock);
1966                         (void) proto_set_tx_wroff(connp->conn_rq, connp, wroff);
1967                 } else {
1968                         mutex_exit(&connp->conn_lock);
1969                 }
1970         }
1971         return (err);
1972 }
1973 
1974 /* This routine sets socket options. */
1975 int
1976 udp_tpi_opt_set(queue_t *q, uint_t optset_context, int level, int name,
1977     uint_t inlen, uchar_t *invalp, uint_t *outlenp, uchar_t *outvalp,
1978     void *thisdg_attrs, cred_t *cr)
1979 {
1980         conn_t  *connp = Q_TO_CONN(q);
1981         int error;
1982 
1983         error = udp_opt_set(connp, optset_context, level, name, inlen, invalp,
1984             outlenp, outvalp, thisdg_attrs, cr);
1985         return (error);
1986 }
1987 
1988 /*
1989  * Setup IP and UDP headers.
1990  * Returns NULL on allocation failure, in which case data_mp is freed.
1991  */
1992 mblk_t *
1993 udp_prepend_hdr(conn_t *connp, ip_xmit_attr_t *ixa, const ip_pkt_t *ipp,
1994     const in6_addr_t *v6src, const in6_addr_t *v6dst, in_port_t dstport,
1995     uint32_t flowinfo, mblk_t *data_mp, int *errorp)
1996 {
1997         mblk_t          *mp;
1998         udpha_t         *udpha;
1999         udp_stack_t     *us = connp->conn_netstack->netstack_udp;
2000         uint_t          data_len;
2001         uint32_t        cksum;
2002         udp_t           *udp = connp->conn_udp;
2003         boolean_t       insert_spi = udp->udp_nat_t_endpoint;
2004         uint_t          ulp_hdr_len;
2005 
2006         data_len = msgdsize(data_mp);
2007         ulp_hdr_len = UDPH_SIZE;
2008         if (insert_spi)
2009                 ulp_hdr_len += sizeof (uint32_t);
2010 
2011         mp = conn_prepend_hdr(ixa, ipp, v6src, v6dst, IPPROTO_UDP, flowinfo,
2012             ulp_hdr_len, data_mp, data_len, us->us_wroff_extra, &cksum, errorp);
2013         if (mp == NULL) {
2014                 ASSERT(*errorp != 0);
2015                 return (NULL);
2016         }
2017 
2018         data_len += ulp_hdr_len;
2019         ixa->ixa_pktlen = data_len + ixa->ixa_ip_hdr_length;
2020 
2021         udpha = (udpha_t *)(mp->b_rptr + ixa->ixa_ip_hdr_length);
2022         udpha->uha_src_port = connp->conn_lport;
2023         udpha->uha_dst_port = dstport;
2024         udpha->uha_checksum = 0;
2025         udpha->uha_length = htons(data_len);
2026 
2027         /*
2028          * If there was a routing option/header then conn_prepend_hdr
2029          * has massaged it and placed the pseudo-header checksum difference
2030          * in the cksum argument.
2031          *
2032          * Setup header length and prepare for ULP checksum done in IP.
2033          *
2034          * We make it easy for IP to include our pseudo header
2035          * by putting our length in uha_checksum.
2036          * The IP source, destination, and length have already been set by
2037          * conn_prepend_hdr.
2038          */
2039         cksum += data_len;
2040         cksum = (cksum >> 16) + (cksum & 0xFFFF);
2041         ASSERT(cksum < 0x10000);
2042 
2043         if (ixa->ixa_flags & IXAF_IS_IPV4) {
2044                 ipha_t  *ipha = (ipha_t *)mp->b_rptr;
2045 
2046                 ASSERT(ntohs(ipha->ipha_length) == ixa->ixa_pktlen);
2047 
2048                 /* IP does the checksum if uha_checksum is non-zero */
2049                 if (us->us_do_checksum) {
2050                         if (cksum == 0)
2051                                 udpha->uha_checksum = 0xffff;
2052                         else
2053                                 udpha->uha_checksum = htons(cksum);
2054                 } else {
2055                         udpha->uha_checksum = 0;
2056                 }
2057         } else {
2058                 ip6_t *ip6h = (ip6_t *)mp->b_rptr;
2059 
2060                 ASSERT(ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN == ixa->ixa_pktlen);
2061                 if (cksum == 0)
2062                         udpha->uha_checksum = 0xffff;
2063                 else
2064                         udpha->uha_checksum = htons(cksum);
2065         }
2066 
2067         /* Insert all-0s SPI now. */
2068         if (insert_spi)
2069                 *((uint32_t *)(udpha + 1)) = 0;
2070 
2071         return (mp);
2072 }
2073 
2074 static int
2075 udp_build_hdr_template(conn_t *connp, const in6_addr_t *v6src,
2076     const in6_addr_t *v6dst, in_port_t dstport, uint32_t flowinfo)
2077 {
2078         udpha_t         *udpha;
2079         int             error;
2080 
2081         ASSERT(MUTEX_HELD(&connp->conn_lock));
2082         /*
2083          * We clear lastdst to make sure we don't use the lastdst path
2084          * next time sending since we might not have set v6dst yet.
2085          */
2086         connp->conn_v6lastdst = ipv6_all_zeros;
2087 
2088         error = conn_build_hdr_template(connp, UDPH_SIZE, 0, v6src, v6dst,
2089             flowinfo);
2090         if (error != 0)
2091                 return (error);
2092 
2093         /*
2094          * Any routing header/option has been massaged. The checksum difference
2095          * is stored in conn_sum.
2096          */
2097         udpha = (udpha_t *)connp->conn_ht_ulp;
2098         udpha->uha_src_port = connp->conn_lport;
2099         udpha->uha_dst_port = dstport;
2100         udpha->uha_checksum = 0;
2101         udpha->uha_length = htons(UDPH_SIZE);        /* Filled in later */
2102         return (0);
2103 }
2104 
2105 static mblk_t *
2106 udp_queue_fallback(udp_t *udp, mblk_t *mp)
2107 {
2108         ASSERT(MUTEX_HELD(&udp->udp_recv_lock));
2109         if (IPCL_IS_NONSTR(udp->udp_connp)) {
2110                 /*
2111                  * fallback has started but messages have not been moved yet
2112                  */
2113                 if (udp->udp_fallback_queue_head == NULL) {
2114                         ASSERT(udp->udp_fallback_queue_tail == NULL);
2115                         udp->udp_fallback_queue_head = mp;
2116                         udp->udp_fallback_queue_tail = mp;
2117                 } else {
2118                         ASSERT(udp->udp_fallback_queue_tail != NULL);
2119                         udp->udp_fallback_queue_tail->b_next = mp;
2120                         udp->udp_fallback_queue_tail = mp;
2121                 }
2122                 return (NULL);
2123         } else {
2124                 /*
2125                  * Fallback completed, let the caller putnext() the mblk.
2126                  */
2127                 return (mp);
2128         }
2129 }
2130 
2131 /*
2132  * Deliver data to ULP. In case we have a socket, and it's falling back to
2133  * TPI, then we'll queue the mp for later processing.
2134  */
2135 static void
2136 udp_ulp_recv(conn_t *connp, mblk_t *mp, uint_t len, ip_recv_attr_t *ira)
2137 {
2138         if (IPCL_IS_NONSTR(connp)) {
2139                 udp_t *udp = connp->conn_udp;
2140                 int error;
2141 
2142                 ASSERT(len == msgdsize(mp));
2143                 if ((*connp->conn_upcalls->su_recv)
2144                     (connp->conn_upper_handle, mp, len, 0, &error, NULL) < 0) {
2145                         mutex_enter(&udp->udp_recv_lock);
2146                         if (error == ENOSPC) {
2147                                 /*
2148                                  * let's confirm while holding the lock
2149                                  */
2150                                 if ((*connp->conn_upcalls->su_recv)
2151                                     (connp->conn_upper_handle, NULL, 0, 0,
2152                                     &error, NULL) < 0) {
2153                                         ASSERT(error == ENOSPC);
2154                                         if (error == ENOSPC) {
2155                                                 connp->conn_flow_cntrld =
2156                                                     B_TRUE;
2157                                         }
2158                                 }
2159                                 mutex_exit(&udp->udp_recv_lock);
2160                         } else {
2161                                 ASSERT(error == EOPNOTSUPP);
2162                                 mp = udp_queue_fallback(udp, mp);
2163                                 mutex_exit(&udp->udp_recv_lock);
2164                                 if (mp != NULL)
2165                                         putnext(connp->conn_rq, mp);
2166                         }
2167                 }
2168                 ASSERT(MUTEX_NOT_HELD(&udp->udp_recv_lock));
2169         } else {
2170                 if (is_system_labeled()) {
2171                         ASSERT(ira->ira_cred != NULL);
2172                         /*
2173                          * Provide for protocols above UDP such as RPC
2174                          * NOPID leaves db_cpid unchanged.
2175                          */
2176                         mblk_setcred(mp, ira->ira_cred, NOPID);
2177                 }
2178 
2179                 putnext(connp->conn_rq, mp);
2180         }
2181 }
2182 
2183 /*
2184  * This is the inbound data path.
2185  * IP has already pulled up the IP plus UDP headers and verified alignment
2186  * etc.
2187  */
2188 /* ARGSUSED2 */
2189 static void
2190 udp_input(void *arg1, mblk_t *mp, void *arg2, ip_recv_attr_t *ira)
2191 {
2192         conn_t                  *connp = (conn_t *)arg1;
2193         struct T_unitdata_ind   *tudi;
2194         uchar_t                 *rptr;          /* Pointer to IP header */
2195         int                     hdr_length;     /* Length of IP+UDP headers */
2196         int                     udi_size;       /* Size of T_unitdata_ind */
2197         int                     pkt_len;
2198         udp_t                   *udp;
2199         udpha_t                 *udpha;
2200         ip_pkt_t                ipps;
2201         ip6_t                   *ip6h;
2202         mblk_t                  *mp1;
2203         uint32_t                udp_ipv4_options_len;
2204         crb_t                   recv_ancillary;
2205         udp_stack_t             *us;
2206 
2207         ASSERT(connp->conn_flags & IPCL_UDPCONN);
2208 
2209         udp = connp->conn_udp;
2210         us = udp->udp_us;
2211         rptr = mp->b_rptr;
2212 
2213         ASSERT(DB_TYPE(mp) == M_DATA);
2214         ASSERT(OK_32PTR(rptr));
2215         ASSERT(ira->ira_pktlen == msgdsize(mp));
2216         pkt_len = ira->ira_pktlen;
2217 
2218         /*
2219          * Get a snapshot of these and allow other threads to change
2220          * them after that. We need the same recv_ancillary when determining
2221          * the size as when adding the ancillary data items.
2222          */
2223         mutex_enter(&connp->conn_lock);
2224         udp_ipv4_options_len = udp->udp_recv_ipp.ipp_ipv4_options_len;
2225         recv_ancillary = connp->conn_recv_ancillary;
2226         mutex_exit(&connp->conn_lock);
2227 
2228         hdr_length = ira->ira_ip_hdr_length;
2229 
2230         /*
2231          * IP inspected the UDP header thus all of it must be in the mblk.
2232          * UDP length check is performed for IPv6 packets and IPv4 packets
2233          * to check if the size of the packet as specified
2234          * by the UDP header is the same as the length derived from the IP
2235          * header.
2236          */
2237         udpha = (udpha_t *)(rptr + hdr_length);
2238         if (pkt_len != ntohs(udpha->uha_length) + hdr_length)
2239                 goto tossit;
2240 
2241         hdr_length += UDPH_SIZE;
2242         ASSERT(MBLKL(mp) >= hdr_length);     /* IP did a pullup */
2243 
2244         /* Initialize regardless of IP version */
2245         ipps.ipp_fields = 0;
2246 
2247         if (((ira->ira_flags & IRAF_IPV4_OPTIONS) ||
2248             udp_ipv4_options_len > 0) &&
2249             connp->conn_family == AF_INET) {
2250                 int     err;
2251 
2252                 /*
2253                  * Record/update udp_recv_ipp with the lock
2254                  * held. Not needed for AF_INET6 sockets
2255                  * since they don't support a getsockopt of IP_OPTIONS.
2256                  */
2257                 mutex_enter(&connp->conn_lock);
2258                 err = ip_find_hdr_v4((ipha_t *)rptr, &udp->udp_recv_ipp,
2259                     B_TRUE);
2260                 if (err != 0) {
2261                         /* Allocation failed. Drop packet */
2262                         mutex_exit(&connp->conn_lock);
2263                         freemsg(mp);
2264                         UDPS_BUMP_MIB(us, udpInErrors);
2265                         return;
2266                 }
2267                 mutex_exit(&connp->conn_lock);
2268         }
2269 
2270         if (recv_ancillary.crb_all != 0) {
2271                 /*
2272                  * Record packet information in the ip_pkt_t
2273                  */
2274                 if (ira->ira_flags & IRAF_IS_IPV4) {
2275                         ASSERT(IPH_HDR_VERSION(rptr) == IPV4_VERSION);
2276                         ASSERT(MBLKL(mp) >= sizeof (ipha_t));
2277                         ASSERT(((ipha_t *)rptr)->ipha_protocol == IPPROTO_UDP);
2278                         ASSERT(ira->ira_ip_hdr_length == IPH_HDR_LENGTH(rptr));
2279 
2280                         (void) ip_find_hdr_v4((ipha_t *)rptr, &ipps, B_FALSE);
2281                 } else {
2282                         uint8_t nexthdrp;
2283 
2284                         ASSERT(IPH_HDR_VERSION(rptr) == IPV6_VERSION);
2285                         /*
2286                          * IPv6 packets can only be received by applications
2287                          * that are prepared to receive IPv6 addresses.
2288                          * The IP fanout must ensure this.
2289                          */
2290                         ASSERT(connp->conn_family == AF_INET6);
2291 
2292                         ip6h = (ip6_t *)rptr;
2293 
2294                         /* We don't care about the length, but need the ipp */
2295                         hdr_length = ip_find_hdr_v6(mp, ip6h, B_TRUE, &ipps,
2296                             &nexthdrp);
2297                         ASSERT(hdr_length == ira->ira_ip_hdr_length);
2298                         /* Restore */
2299                         hdr_length = ira->ira_ip_hdr_length + UDPH_SIZE;
2300                         ASSERT(nexthdrp == IPPROTO_UDP);
2301                 }
2302         }
2303 
2304         /*
2305          * This is the inbound data path.  Packets are passed upstream as
2306          * T_UNITDATA_IND messages.
2307          */
2308         if (connp->conn_family == AF_INET) {
2309                 sin_t *sin;
2310 
2311                 ASSERT(IPH_HDR_VERSION((ipha_t *)rptr) == IPV4_VERSION);
2312 
2313                 /*
2314                  * Normally only send up the source address.
2315                  * If any ancillary data items are wanted we add those.
2316                  */
2317                 udi_size = sizeof (struct T_unitdata_ind) + sizeof (sin_t);
2318                 if (recv_ancillary.crb_all != 0) {
2319                         udi_size += conn_recvancillary_size(connp,
2320                             recv_ancillary, ira, mp, &ipps);
2321                 }
2322 
2323                 /* Allocate a message block for the T_UNITDATA_IND structure. */
2324                 mp1 = allocb(udi_size, BPRI_MED);
2325                 if (mp1 == NULL) {
2326                         freemsg(mp);
2327                         UDPS_BUMP_MIB(us, udpInErrors);
2328                         return;
2329                 }
2330                 mp1->b_cont = mp;
2331                 mp1->b_datap->db_type = M_PROTO;
2332                 tudi = (struct T_unitdata_ind *)mp1->b_rptr;
2333                 mp1->b_wptr = (uchar_t *)tudi + udi_size;
2334                 tudi->PRIM_type = T_UNITDATA_IND;
2335                 tudi->SRC_length = sizeof (sin_t);
2336                 tudi->SRC_offset = sizeof (struct T_unitdata_ind);
2337                 tudi->OPT_offset = sizeof (struct T_unitdata_ind) +
2338                     sizeof (sin_t);
2339                 udi_size -= (sizeof (struct T_unitdata_ind) + sizeof (sin_t));
2340                 tudi->OPT_length = udi_size;
2341                 sin = (sin_t *)&tudi[1];
2342                 sin->sin_addr.s_addr = ((ipha_t *)rptr)->ipha_src;
2343                 sin->sin_port =      udpha->uha_src_port;
2344                 sin->sin_family = connp->conn_family;
2345                 *(uint32_t *)&sin->sin_zero[0] = 0;
2346                 *(uint32_t *)&sin->sin_zero[4] = 0;
2347 
2348                 /*
2349                  * Add options if IP_RECVDSTADDR, IP_RECVIF, IP_RECVSLLA or
2350                  * IP_RECVTTL has been set.
2351                  */
2352                 if (udi_size != 0) {
2353                         conn_recvancillary_add(connp, recv_ancillary, ira,
2354                             &ipps, (uchar_t *)&sin[1], udi_size);
2355                 }
2356         } else {
2357                 sin6_t *sin6;
2358 
2359                 /*
2360                  * Handle both IPv4 and IPv6 packets for IPv6 sockets.
2361                  *
2362                  * Normally we only send up the address. If receiving of any
2363                  * optional receive side information is enabled, we also send
2364                  * that up as options.
2365                  */
2366                 udi_size = sizeof (struct T_unitdata_ind) + sizeof (sin6_t);
2367 
2368                 if (recv_ancillary.crb_all != 0) {
2369                         udi_size += conn_recvancillary_size(connp,
2370                             recv_ancillary, ira, mp, &ipps);
2371                 }
2372 
2373                 mp1 = allocb(udi_size, BPRI_MED);
2374                 if (mp1 == NULL) {
2375                         freemsg(mp);
2376                         UDPS_BUMP_MIB(us, udpInErrors);
2377                         return;
2378                 }
2379                 mp1->b_cont = mp;
2380                 mp1->b_datap->db_type = M_PROTO;
2381                 tudi = (struct T_unitdata_ind *)mp1->b_rptr;
2382                 mp1->b_wptr = (uchar_t *)tudi + udi_size;
2383                 tudi->PRIM_type = T_UNITDATA_IND;
2384                 tudi->SRC_length = sizeof (sin6_t);
2385                 tudi->SRC_offset = sizeof (struct T_unitdata_ind);
2386                 tudi->OPT_offset = sizeof (struct T_unitdata_ind) +
2387                     sizeof (sin6_t);
2388                 udi_size -= (sizeof (struct T_unitdata_ind) + sizeof (sin6_t));
2389                 tudi->OPT_length = udi_size;
2390                 sin6 = (sin6_t *)&tudi[1];
2391                 if (ira->ira_flags & IRAF_IS_IPV4) {
2392                         in6_addr_t v6dst;
2393 
2394                         IN6_IPADDR_TO_V4MAPPED(((ipha_t *)rptr)->ipha_src,
2395                             &sin6->sin6_addr);
2396                         IN6_IPADDR_TO_V4MAPPED(((ipha_t *)rptr)->ipha_dst,
2397                             &v6dst);
2398                         sin6->sin6_flowinfo = 0;
2399                         sin6->sin6_scope_id = 0;
2400                         sin6->__sin6_src_id = ip_srcid_find_addr(&v6dst,
2401                             IPCL_ZONEID(connp), us->us_netstack);
2402                 } else {
2403                         ip6h = (ip6_t *)rptr;
2404 
2405                         sin6->sin6_addr = ip6h->ip6_src;
2406                         /* No sin6_flowinfo per API */
2407                         sin6->sin6_flowinfo = 0;
2408                         /* For link-scope pass up scope id */
2409                         if (IN6_IS_ADDR_LINKSCOPE(&ip6h->ip6_src))
2410                                 sin6->sin6_scope_id = ira->ira_ruifindex;
2411                         else
2412                                 sin6->sin6_scope_id = 0;
2413                         sin6->__sin6_src_id = ip_srcid_find_addr(
2414                             &ip6h->ip6_dst, IPCL_ZONEID(connp),
2415                             us->us_netstack);
2416                 }
2417                 sin6->sin6_port = udpha->uha_src_port;
2418                 sin6->sin6_family = connp->conn_family;
2419 
2420                 if (udi_size != 0) {
2421                         conn_recvancillary_add(connp, recv_ancillary, ira,
2422                             &ipps, (uchar_t *)&sin6[1], udi_size);
2423                 }
2424         }
2425 
2426         /*
2427          * DTrace this UDP input as udp:::receive (this is for IPv4, IPv6 and
2428          * loopback traffic).
2429          */
2430         DTRACE_UDP5(receive, mblk_t *, NULL, ip_xmit_attr_t *, connp->conn_ixa,
2431             void_ip_t *, rptr, udp_t *, udp, udpha_t *, udpha);
2432 
2433         /* Walk past the headers unless IP_RECVHDR was set. */
2434         if (!udp->udp_rcvhdr) {
2435                 mp->b_rptr = rptr + hdr_length;
2436                 pkt_len -= hdr_length;
2437         }
2438 
2439         UDPS_BUMP_MIB(us, udpHCInDatagrams);
2440         udp_ulp_recv(connp, mp1, pkt_len, ira);
2441         return;
2442 
2443 tossit:
2444         freemsg(mp);
2445         UDPS_BUMP_MIB(us, udpInErrors);
2446 }
2447 
2448 /*
2449  * This routine creates a T_UDERROR_IND message and passes it upstream.
2450  * The address and options are copied from the T_UNITDATA_REQ message
2451  * passed in mp.  This message is freed.
2452  */
2453 static void
2454 udp_ud_err(queue_t *q, mblk_t *mp, t_scalar_t err)
2455 {
2456         struct T_unitdata_req *tudr;
2457         mblk_t  *mp1;
2458         uchar_t *destaddr;
2459         t_scalar_t destlen;
2460         uchar_t *optaddr;
2461         t_scalar_t optlen;
2462 
2463         if ((mp->b_wptr < mp->b_rptr) ||
2464             (MBLKL(mp)) < sizeof (struct T_unitdata_req)) {
2465                 goto done;
2466         }
2467         tudr = (struct T_unitdata_req *)mp->b_rptr;
2468         destaddr = mp->b_rptr + tudr->DEST_offset;
2469         if (destaddr < mp->b_rptr || destaddr >= mp->b_wptr ||
2470             destaddr + tudr->DEST_length < mp->b_rptr ||
2471             destaddr + tudr->DEST_length > mp->b_wptr) {
2472                 goto done;
2473         }
2474         optaddr = mp->b_rptr + tudr->OPT_offset;
2475         if (optaddr < mp->b_rptr || optaddr >= mp->b_wptr ||
2476             optaddr + tudr->OPT_length < mp->b_rptr ||
2477             optaddr + tudr->OPT_length > mp->b_wptr) {
2478                 goto done;
2479         }
2480         destlen = tudr->DEST_length;
2481         optlen = tudr->OPT_length;
2482 
2483         mp1 = mi_tpi_uderror_ind((char *)destaddr, destlen,
2484             (char *)optaddr, optlen, err);
2485         if (mp1 != NULL)
2486                 qreply(q, mp1);
2487 
2488 done:
2489         freemsg(mp);
2490 }
2491 
2492 /*
2493  * This routine removes a port number association from a stream.  It
2494  * is called by udp_wput to handle T_UNBIND_REQ messages.
2495  */
2496 static void
2497 udp_tpi_unbind(queue_t *q, mblk_t *mp)
2498 {
2499         conn_t  *connp = Q_TO_CONN(q);
2500         int     error;
2501 
2502         error = udp_do_unbind(connp);
2503         if (error) {
2504                 if (error < 0)
2505                         udp_err_ack(q, mp, -error, 0);
2506                 else
2507                         udp_err_ack(q, mp, TSYSERR, error);
2508                 return;
2509         }
2510 
2511         mp = mi_tpi_ok_ack_alloc(mp);
2512         ASSERT(mp != NULL);
2513         ASSERT(((struct T_ok_ack *)mp->b_rptr)->PRIM_type == T_OK_ACK);
2514         qreply(q, mp);
2515 }
2516 
2517 /*
2518  * Don't let port fall into the privileged range.
2519  * Since the extra privileged ports can be arbitrary we also
2520  * ensure that we exclude those from consideration.
2521  * us->us_epriv_ports is not sorted thus we loop over it until
2522  * there are no changes.
2523  */
2524 static in_port_t
2525 udp_update_next_port(udp_t *udp, in_port_t port, boolean_t random)
2526 {
2527         int i, bump;
2528         in_port_t nextport;
2529         boolean_t restart = B_FALSE;
2530         udp_stack_t *us = udp->udp_us;
2531 
2532         if (random && udp_random_anon_port != 0) {
2533                 (void) random_get_pseudo_bytes((uint8_t *)&port,
2534                     sizeof (in_port_t));
2535                 /*
2536                  * Unless changed by a sys admin, the smallest anon port
2537                  * is 32768 and the largest anon port is 65535.  It is
2538                  * very likely (50%) for the random port to be smaller
2539                  * than the smallest anon port.  When that happens,
2540                  * add port % (anon port range) to the smallest anon
2541                  * port to get the random port.  It should fall into the
2542                  * valid anon port range.
2543                  */
2544                 if ((port < us->us_smallest_anon_port) ||
2545                     (port > us->us_largest_anon_port)) {
2546                         if (us->us_smallest_anon_port ==
2547                             us->us_largest_anon_port) {
2548                                 bump = 0;
2549                         } else {
2550                                 bump = port % (us->us_largest_anon_port -
2551                                     us->us_smallest_anon_port);
2552                         }
2553 
2554                         port = us->us_smallest_anon_port + bump;
2555                 }
2556         }
2557 
2558 retry:
2559         if (port < us->us_smallest_anon_port)
2560                 port = us->us_smallest_anon_port;
2561 
2562         if (port > us->us_largest_anon_port) {
2563                 port = us->us_smallest_anon_port;
2564                 if (restart)
2565                         return (0);
2566                 restart = B_TRUE;
2567         }
2568 
2569         if (port < us->us_smallest_nonpriv_port)
2570                 port = us->us_smallest_nonpriv_port;
2571 
2572         for (i = 0; i < us->us_num_epriv_ports; i++) {
2573                 if (port == us->us_epriv_ports[i]) {
2574                         port++;
2575                         /*
2576                          * Make sure that the port is in the
2577                          * valid range.
2578                          */
2579                         goto retry;
2580                 }
2581         }
2582 
2583         if (is_system_labeled() &&
2584             (nextport = tsol_next_port(crgetzone(udp->udp_connp->conn_cred),
2585             port, IPPROTO_UDP, B_TRUE)) != 0) {
2586                 port = nextport;
2587                 goto retry;
2588         }
2589 
2590         return (port);
2591 }
2592 
2593 /*
2594  * Handle T_UNITDATA_REQ with options. Both IPv4 and IPv6
2595  * Either tudr_mp or msg is set. If tudr_mp we take ancillary data from
2596  * the TPI options, otherwise we take them from msg_control.
2597  * If both sin and sin6 is set it is a connected socket and we use conn_faddr.
2598  * Always consumes mp; never consumes tudr_mp.
2599  */
2600 static int
2601 udp_output_ancillary(conn_t *connp, sin_t *sin, sin6_t *sin6, mblk_t *mp,
2602     mblk_t *tudr_mp, struct nmsghdr *msg, cred_t *cr, pid_t pid)
2603 {
2604         udp_t           *udp = connp->conn_udp;
2605         udp_stack_t     *us = udp->udp_us;
2606         int             error;
2607         ip_xmit_attr_t  *ixa;
2608         ip_pkt_t        *ipp;
2609         in6_addr_t      v6src;
2610         in6_addr_t      v6dst;
2611         in6_addr_t      v6nexthop;
2612         in_port_t       dstport;
2613         uint32_t        flowinfo;
2614         uint_t          srcid;
2615         int             is_absreq_failure = 0;
2616         conn_opt_arg_t  coas, *coa;
2617 
2618         ASSERT(tudr_mp != NULL || msg != NULL);
2619 
2620         /*
2621          * Get ixa before checking state to handle a disconnect race.
2622          *
2623          * We need an exclusive copy of conn_ixa since the ancillary data
2624          * options might modify it. That copy has no pointers hence we
2625          * need to set them up once we've parsed the ancillary data.
2626          */
2627         ixa = conn_get_ixa_exclusive(connp);
2628         if (ixa == NULL) {
2629                 UDPS_BUMP_MIB(us, udpOutErrors);
2630                 freemsg(mp);
2631                 return (ENOMEM);
2632         }
2633         ASSERT(cr != NULL);
2634         ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
2635         ixa->ixa_cred = cr;
2636         ixa->ixa_cpid = pid;
2637         if (is_system_labeled()) {
2638                 /* We need to restart with a label based on the cred */
2639                 ip_xmit_attr_restore_tsl(ixa, ixa->ixa_cred);
2640         }
2641 
2642         /* In case previous destination was multicast or multirt */
2643         ip_attr_newdst(ixa);
2644 
2645         /* Get a copy of conn_xmit_ipp since the options might change it */
2646         ipp = kmem_zalloc(sizeof (*ipp), KM_NOSLEEP);
2647         if (ipp == NULL) {
2648                 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
2649                 ixa->ixa_cred = connp->conn_cred; /* Restore */
2650                 ixa->ixa_cpid = connp->conn_cpid;
2651                 ixa_refrele(ixa);
2652                 UDPS_BUMP_MIB(us, udpOutErrors);
2653                 freemsg(mp);
2654                 return (ENOMEM);
2655         }
2656         mutex_enter(&connp->conn_lock);
2657         error = ip_pkt_copy(&connp->conn_xmit_ipp, ipp, KM_NOSLEEP);
2658         mutex_exit(&connp->conn_lock);
2659         if (error != 0) {
2660                 UDPS_BUMP_MIB(us, udpOutErrors);
2661                 freemsg(mp);
2662                 goto done;
2663         }
2664 
2665         /*
2666          * Parse the options and update ixa and ipp as a result.
2667          * Note that ixa_tsl can be updated if SCM_UCRED.
2668          * ixa_refrele/ixa_inactivate will release any reference on ixa_tsl.
2669          */
2670 
2671         coa = &coas;
2672         coa->coa_connp = connp;
2673         coa->coa_ixa = ixa;
2674         coa->coa_ipp = ipp;
2675         coa->coa_ancillary = B_TRUE;
2676         coa->coa_changed = 0;
2677 
2678         if (msg != NULL) {
2679                 error = process_auxiliary_options(connp, msg->msg_control,
2680                     msg->msg_controllen, coa, &udp_opt_obj, udp_opt_set, cr);
2681         } else {
2682                 struct T_unitdata_req *tudr;
2683 
2684                 tudr = (struct T_unitdata_req *)tudr_mp->b_rptr;
2685                 ASSERT(tudr->PRIM_type == T_UNITDATA_REQ);
2686                 error = tpi_optcom_buf(connp->conn_wq, tudr_mp,
2687                     &tudr->OPT_length, tudr->OPT_offset, cr, &udp_opt_obj,
2688                     coa, &is_absreq_failure);
2689         }
2690         if (error != 0) {
2691                 /*
2692                  * Note: No special action needed in this
2693                  * module for "is_absreq_failure"
2694                  */
2695                 freemsg(mp);
2696                 UDPS_BUMP_MIB(us, udpOutErrors);
2697                 goto done;
2698         }
2699         ASSERT(is_absreq_failure == 0);
2700 
2701         mutex_enter(&connp->conn_lock);
2702         /*
2703          * If laddr is unspecified then we look at sin6_src_id.
2704          * We will give precedence to a source address set with IPV6_PKTINFO
2705          * (aka IPPF_ADDR) but that is handled in build_hdrs. However, we don't
2706          * want ip_attr_connect to select a source (since it can fail) when
2707          * IPV6_PKTINFO is specified.
2708          * If this doesn't result in a source address then we get a source
2709          * from ip_attr_connect() below.
2710          */
2711         v6src = connp->conn_saddr_v6;
2712         if (sin != NULL) {
2713                 IN6_IPADDR_TO_V4MAPPED(sin->sin_addr.s_addr, &v6dst);
2714                 dstport = sin->sin_port;
2715                 flowinfo = 0;
2716                 ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
2717                 ixa->ixa_flags |= IXAF_IS_IPV4;
2718         } else if (sin6 != NULL) {
2719                 boolean_t v4mapped;
2720 
2721                 v6dst = sin6->sin6_addr;
2722                 dstport = sin6->sin6_port;
2723                 flowinfo = sin6->sin6_flowinfo;
2724                 srcid = sin6->__sin6_src_id;
2725                 if (IN6_IS_ADDR_LINKSCOPE(&v6dst) && sin6->sin6_scope_id != 0) {
2726                         ixa->ixa_scopeid = sin6->sin6_scope_id;
2727                         ixa->ixa_flags |= IXAF_SCOPEID_SET;
2728                 } else {
2729                         ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
2730                 }
2731                 v4mapped = IN6_IS_ADDR_V4MAPPED(&v6dst);
2732                 if (v4mapped)
2733                         ixa->ixa_flags |= IXAF_IS_IPV4;
2734                 else
2735                         ixa->ixa_flags &= ~IXAF_IS_IPV4;
2736                 if (srcid != 0 && IN6_IS_ADDR_UNSPECIFIED(&v6src)) {
2737                         if (!ip_srcid_find_id(srcid, &v6src, IPCL_ZONEID(connp),
2738                             v4mapped, connp->conn_netstack)) {
2739                                 /* Mismatch - v4mapped/v6 specified by srcid. */
2740                                 mutex_exit(&connp->conn_lock);
2741                                 error = EADDRNOTAVAIL;
2742                                 goto failed;    /* Does freemsg() and mib. */
2743                         }
2744                 }
2745         } else {
2746                 /* Connected case */
2747                 v6dst = connp->conn_faddr_v6;
2748                 dstport = connp->conn_fport;
2749                 flowinfo = connp->conn_flowinfo;
2750         }
2751         mutex_exit(&connp->conn_lock);
2752 
2753         /* Handle IP_PKTINFO/IPV6_PKTINFO setting source address. */
2754         if (ipp->ipp_fields & IPPF_ADDR) {
2755                 if (ixa->ixa_flags & IXAF_IS_IPV4) {
2756                         if (IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr))
2757                                 v6src = ipp->ipp_addr;
2758                 } else {
2759                         if (!IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr))
2760                                 v6src = ipp->ipp_addr;
2761                 }
2762         }
2763 
2764         ip_attr_nexthop(ipp, ixa, &v6dst, &v6nexthop);
2765         error = ip_attr_connect(connp, ixa, &v6src, &v6dst, &v6nexthop, dstport,
2766             &v6src, NULL, IPDF_ALLOW_MCBC | IPDF_VERIFY_DST | IPDF_IPSEC);
2767 
2768         switch (error) {
2769         case 0:
2770                 break;
2771         case EADDRNOTAVAIL:
2772                 /*
2773                  * IXAF_VERIFY_SOURCE tells us to pick a better source.
2774                  * Don't have the application see that errno
2775                  */
2776                 error = ENETUNREACH;
2777                 goto failed;
2778         case ENETDOWN:
2779                 /*
2780                  * Have !ipif_addr_ready address; drop packet silently
2781                  * until we can get applications to not send until we
2782                  * are ready.
2783                  */
2784                 error = 0;
2785                 goto failed;
2786         case EHOSTUNREACH:
2787         case ENETUNREACH:
2788                 if (ixa->ixa_ire != NULL) {
2789                         /*
2790                          * Let conn_ip_output/ire_send_noroute return
2791                          * the error and send any local ICMP error.
2792                          */
2793                         error = 0;
2794                         break;
2795                 }
2796                 /* FALLTHRU */
2797         default:
2798         failed:
2799                 freemsg(mp);
2800                 UDPS_BUMP_MIB(us, udpOutErrors);
2801                 goto done;
2802         }
2803 
2804         /*
2805          * We might be going to a different destination than last time,
2806          * thus check that TX allows the communication and compute any
2807          * needed label.
2808          *
2809          * TSOL Note: We have an exclusive ipp and ixa for this thread so we
2810          * don't have to worry about concurrent threads.
2811          */
2812         if (is_system_labeled()) {
2813                 /* Using UDP MLP requires SCM_UCRED from user */
2814                 if (connp->conn_mlp_type != mlptSingle &&
2815                     !((ixa->ixa_flags & IXAF_UCRED_TSL))) {
2816                         UDPS_BUMP_MIB(us, udpOutErrors);
2817                         error = ECONNREFUSED;
2818                         freemsg(mp);
2819                         goto done;
2820                 }
2821                 /*
2822                  * Check whether Trusted Solaris policy allows communication
2823                  * with this host, and pretend that the destination is
2824                  * unreachable if not.
2825                  * Compute any needed label and place it in ipp_label_v4/v6.
2826                  *
2827                  * Later conn_build_hdr_template/conn_prepend_hdr takes
2828                  * ipp_label_v4/v6 to form the packet.
2829                  *
2830                  * Tsol note: We have ipp structure local to this thread so
2831                  * no locking is needed.
2832                  */
2833                 error = conn_update_label(connp, ixa, &v6dst, ipp);
2834                 if (error != 0) {
2835                         freemsg(mp);
2836                         UDPS_BUMP_MIB(us, udpOutErrors);
2837                         goto done;
2838                 }
2839         }
2840         mp = udp_prepend_hdr(connp, ixa, ipp, &v6src, &v6dst, dstport,
2841             flowinfo, mp, &error);
2842         if (mp == NULL) {
2843                 ASSERT(error != 0);
2844                 UDPS_BUMP_MIB(us, udpOutErrors);
2845                 goto done;
2846         }
2847         if (ixa->ixa_pktlen > IP_MAXPACKET) {
2848                 error = EMSGSIZE;
2849                 UDPS_BUMP_MIB(us, udpOutErrors);
2850                 freemsg(mp);
2851                 goto done;
2852         }
2853         /* We're done.  Pass the packet to ip. */
2854         UDPS_BUMP_MIB(us, udpHCOutDatagrams);
2855 
2856         DTRACE_UDP5(send, mblk_t *, NULL, ip_xmit_attr_t *, ixa,
2857             void_ip_t *, mp->b_rptr, udp_t *, udp, udpha_t *,
2858             &mp->b_rptr[ixa->ixa_ip_hdr_length]);
2859 
2860         error = conn_ip_output(mp, ixa);
2861         /* No udpOutErrors if an error since IP increases its error counter */
2862         switch (error) {
2863         case 0:
2864                 break;
2865         case EWOULDBLOCK:
2866                 (void) ixa_check_drain_insert(connp, ixa);
2867                 error = 0;
2868                 break;
2869         case EADDRNOTAVAIL:
2870                 /*
2871                  * IXAF_VERIFY_SOURCE tells us to pick a better source.
2872                  * Don't have the application see that errno
2873                  */
2874                 error = ENETUNREACH;
2875                 /* FALLTHRU */
2876         default:
2877                 mutex_enter(&connp->conn_lock);
2878                 /*
2879                  * Clear the source and v6lastdst so we call ip_attr_connect
2880                  * for the next packet and try to pick a better source.
2881                  */
2882                 if (connp->conn_mcbc_bind)
2883                         connp->conn_saddr_v6 = ipv6_all_zeros;
2884                 else
2885                         connp->conn_saddr_v6 = connp->conn_bound_addr_v6;
2886                 connp->conn_v6lastdst = ipv6_all_zeros;
2887                 mutex_exit(&connp->conn_lock);
2888                 break;
2889         }
2890 done:
2891         ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
2892         ixa->ixa_cred = connp->conn_cred; /* Restore */
2893         ixa->ixa_cpid = connp->conn_cpid;
2894         ixa_refrele(ixa);
2895         ip_pkt_free(ipp);
2896         kmem_free(ipp, sizeof (*ipp));
2897         return (error);
2898 }
2899 
2900 /*
2901  * Handle sending an M_DATA for a connected socket.
2902  * Handles both IPv4 and IPv6.
2903  */
2904 static int
2905 udp_output_connected(conn_t *connp, mblk_t *mp, cred_t *cr, pid_t pid)
2906 {
2907         udp_t           *udp = connp->conn_udp;
2908         udp_stack_t     *us = udp->udp_us;
2909         int             error;
2910         ip_xmit_attr_t  *ixa;
2911 
2912         /*
2913          * If no other thread is using conn_ixa this just gets a reference to
2914          * conn_ixa. Otherwise we get a safe copy of conn_ixa.
2915          */
2916         ixa = conn_get_ixa(connp, B_FALSE);
2917         if (ixa == NULL) {
2918                 UDPS_BUMP_MIB(us, udpOutErrors);
2919                 freemsg(mp);
2920                 return (ENOMEM);
2921         }
2922 
2923         ASSERT(cr != NULL);
2924         ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
2925         ixa->ixa_cred = cr;
2926         ixa->ixa_cpid = pid;
2927 
2928         mutex_enter(&connp->conn_lock);
2929         mp = udp_prepend_header_template(connp, ixa, mp, &connp->conn_saddr_v6,
2930             connp->conn_fport, connp->conn_flowinfo, &error);
2931 
2932         if (mp == NULL) {
2933                 ASSERT(error != 0);
2934                 mutex_exit(&connp->conn_lock);
2935                 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
2936                 ixa->ixa_cred = connp->conn_cred; /* Restore */
2937                 ixa->ixa_cpid = connp->conn_cpid;
2938                 ixa_refrele(ixa);
2939                 UDPS_BUMP_MIB(us, udpOutErrors);
2940                 freemsg(mp);
2941                 return (error);
2942         }
2943 
2944         /*
2945          * In case we got a safe copy of conn_ixa, or if opt_set made us a new
2946          * safe copy, then we need to fill in any pointers in it.
2947          */
2948         if (ixa->ixa_ire == NULL) {
2949                 in6_addr_t      faddr, saddr;
2950                 in6_addr_t      nexthop;
2951                 in_port_t       fport;
2952 
2953                 saddr = connp->conn_saddr_v6;
2954                 faddr = connp->conn_faddr_v6;
2955                 fport = connp->conn_fport;
2956                 ip_attr_nexthop(&connp->conn_xmit_ipp, ixa, &faddr, &nexthop);
2957                 mutex_exit(&connp->conn_lock);
2958 
2959                 error = ip_attr_connect(connp, ixa, &saddr, &faddr, &nexthop,
2960                     fport, NULL, NULL, IPDF_ALLOW_MCBC | IPDF_VERIFY_DST |
2961                     IPDF_IPSEC);
2962                 switch (error) {
2963                 case 0:
2964                         break;
2965                 case EADDRNOTAVAIL:
2966                         /*
2967                          * IXAF_VERIFY_SOURCE tells us to pick a better source.
2968                          * Don't have the application see that errno
2969                          */
2970                         error = ENETUNREACH;
2971                         goto failed;
2972                 case ENETDOWN:
2973                         /*
2974                          * Have !ipif_addr_ready address; drop packet silently
2975                          * until we can get applications to not send until we
2976                          * are ready.
2977                          */
2978                         error = 0;
2979                         goto failed;
2980                 case EHOSTUNREACH:
2981                 case ENETUNREACH:
2982                         if (ixa->ixa_ire != NULL) {
2983                                 /*
2984                                  * Let conn_ip_output/ire_send_noroute return
2985                                  * the error and send any local ICMP error.
2986                                  */
2987                                 error = 0;
2988                                 break;
2989                         }
2990                         /* FALLTHRU */
2991                 default:
2992                 failed:
2993                         ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
2994                         ixa->ixa_cred = connp->conn_cred; /* Restore */
2995                         ixa->ixa_cpid = connp->conn_cpid;
2996                         ixa_refrele(ixa);
2997                         freemsg(mp);
2998                         UDPS_BUMP_MIB(us, udpOutErrors);
2999                         return (error);
3000                 }
3001         } else {
3002                 /* Done with conn_t */
3003                 mutex_exit(&connp->conn_lock);
3004         }
3005         ASSERT(ixa->ixa_ire != NULL);
3006 
3007         /* We're done.  Pass the packet to ip. */
3008         UDPS_BUMP_MIB(us, udpHCOutDatagrams);
3009 
3010         DTRACE_UDP5(send, mblk_t *, NULL, ip_xmit_attr_t *, ixa,
3011             void_ip_t *, mp->b_rptr, udp_t *, udp, udpha_t *,
3012             &mp->b_rptr[ixa->ixa_ip_hdr_length]);
3013 
3014         error = conn_ip_output(mp, ixa);
3015         /* No udpOutErrors if an error since IP increases its error counter */
3016         switch (error) {
3017         case 0:
3018                 break;
3019         case EWOULDBLOCK:
3020                 (void) ixa_check_drain_insert(connp, ixa);
3021                 error = 0;
3022                 break;
3023         case EADDRNOTAVAIL:
3024                 /*
3025                  * IXAF_VERIFY_SOURCE tells us to pick a better source.
3026                  * Don't have the application see that errno
3027                  */
3028                 error = ENETUNREACH;
3029                 break;
3030         }
3031         ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3032         ixa->ixa_cred = connp->conn_cred; /* Restore */
3033         ixa->ixa_cpid = connp->conn_cpid;
3034         ixa_refrele(ixa);
3035         return (error);
3036 }
3037 
3038 /*
3039  * Handle sending an M_DATA to the last destination.
3040  * Handles both IPv4 and IPv6.
3041  *
3042  * NOTE: The caller must hold conn_lock and we drop it here.
3043  */
3044 static int
3045 udp_output_lastdst(conn_t *connp, mblk_t *mp, cred_t *cr, pid_t pid,
3046     ip_xmit_attr_t *ixa)
3047 {
3048         udp_t           *udp = connp->conn_udp;
3049         udp_stack_t     *us = udp->udp_us;
3050         int             error;
3051 
3052         ASSERT(MUTEX_HELD(&connp->conn_lock));
3053         ASSERT(ixa != NULL);
3054 
3055         ASSERT(cr != NULL);
3056         ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3057         ixa->ixa_cred = cr;
3058         ixa->ixa_cpid = pid;
3059 
3060         mp = udp_prepend_header_template(connp, ixa, mp, &connp->conn_v6lastsrc,
3061             connp->conn_lastdstport, connp->conn_lastflowinfo, &error);
3062 
3063         if (mp == NULL) {
3064                 ASSERT(error != 0);
3065                 mutex_exit(&connp->conn_lock);
3066                 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3067                 ixa->ixa_cred = connp->conn_cred; /* Restore */
3068                 ixa->ixa_cpid = connp->conn_cpid;
3069                 ixa_refrele(ixa);
3070                 UDPS_BUMP_MIB(us, udpOutErrors);
3071                 freemsg(mp);
3072                 return (error);
3073         }
3074 
3075         /*
3076          * In case we got a safe copy of conn_ixa, or if opt_set made us a new
3077          * safe copy, then we need to fill in any pointers in it.
3078          */
3079         if (ixa->ixa_ire == NULL) {
3080                 in6_addr_t      lastdst, lastsrc;
3081                 in6_addr_t      nexthop;
3082                 in_port_t       lastport;
3083 
3084                 lastsrc = connp->conn_v6lastsrc;
3085                 lastdst = connp->conn_v6lastdst;
3086                 lastport = connp->conn_lastdstport;
3087                 ip_attr_nexthop(&connp->conn_xmit_ipp, ixa, &lastdst, &nexthop);
3088                 mutex_exit(&connp->conn_lock);
3089 
3090                 error = ip_attr_connect(connp, ixa, &lastsrc, &lastdst,
3091                     &nexthop, lastport, NULL, NULL, IPDF_ALLOW_MCBC |
3092                     IPDF_VERIFY_DST | IPDF_IPSEC);
3093                 switch (error) {
3094                 case 0:
3095                         break;
3096                 case EADDRNOTAVAIL:
3097                         /*
3098                          * IXAF_VERIFY_SOURCE tells us to pick a better source.
3099                          * Don't have the application see that errno
3100                          */
3101                         error = ENETUNREACH;
3102                         goto failed;
3103                 case ENETDOWN:
3104                         /*
3105                          * Have !ipif_addr_ready address; drop packet silently
3106                          * until we can get applications to not send until we
3107                          * are ready.
3108                          */
3109                         error = 0;
3110                         goto failed;
3111                 case EHOSTUNREACH:
3112                 case ENETUNREACH:
3113                         if (ixa->ixa_ire != NULL) {
3114                                 /*
3115                                  * Let conn_ip_output/ire_send_noroute return
3116                                  * the error and send any local ICMP error.
3117                                  */
3118                                 error = 0;
3119                                 break;
3120                         }
3121                         /* FALLTHRU */
3122                 default:
3123                 failed:
3124                         ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3125                         ixa->ixa_cred = connp->conn_cred; /* Restore */
3126                         ixa->ixa_cpid = connp->conn_cpid;
3127                         ixa_refrele(ixa);
3128                         freemsg(mp);
3129                         UDPS_BUMP_MIB(us, udpOutErrors);
3130                         return (error);
3131                 }
3132         } else {
3133                 /* Done with conn_t */
3134                 mutex_exit(&connp->conn_lock);
3135         }
3136 
3137         /* We're done.  Pass the packet to ip. */
3138         UDPS_BUMP_MIB(us, udpHCOutDatagrams);
3139 
3140         DTRACE_UDP5(send, mblk_t *, NULL, ip_xmit_attr_t *, ixa,
3141             void_ip_t *, mp->b_rptr, udp_t *, udp, udpha_t *,
3142             &mp->b_rptr[ixa->ixa_ip_hdr_length]);
3143 
3144         error = conn_ip_output(mp, ixa);
3145         /* No udpOutErrors if an error since IP increases its error counter */
3146         switch (error) {
3147         case 0:
3148                 break;
3149         case EWOULDBLOCK:
3150                 (void) ixa_check_drain_insert(connp, ixa);
3151                 error = 0;
3152                 break;
3153         case EADDRNOTAVAIL:
3154                 /*
3155                  * IXAF_VERIFY_SOURCE tells us to pick a better source.
3156                  * Don't have the application see that errno
3157                  */
3158                 error = ENETUNREACH;
3159                 /* FALLTHRU */
3160         default:
3161                 mutex_enter(&connp->conn_lock);
3162                 /*
3163                  * Clear the source and v6lastdst so we call ip_attr_connect
3164                  * for the next packet and try to pick a better source.
3165                  */
3166                 if (connp->conn_mcbc_bind)
3167                         connp->conn_saddr_v6 = ipv6_all_zeros;
3168                 else
3169                         connp->conn_saddr_v6 = connp->conn_bound_addr_v6;
3170                 connp->conn_v6lastdst = ipv6_all_zeros;
3171                 mutex_exit(&connp->conn_lock);
3172                 break;
3173         }
3174         ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3175         ixa->ixa_cred = connp->conn_cred; /* Restore */
3176         ixa->ixa_cpid = connp->conn_cpid;
3177         ixa_refrele(ixa);
3178         return (error);
3179 }
3180 
3181 
3182 /*
3183  * Prepend the header template and then fill in the source and
3184  * flowinfo. The caller needs to handle the destination address since
3185  * it's setting is different if rthdr or source route.
3186  *
3187  * Returns NULL is allocation failed or if the packet would exceed IP_MAXPACKET.
3188  * When it returns NULL it sets errorp.
3189  */
3190 static mblk_t *
3191 udp_prepend_header_template(conn_t *connp, ip_xmit_attr_t *ixa, mblk_t *mp,
3192     const in6_addr_t *v6src, in_port_t dstport, uint32_t flowinfo, int *errorp)
3193 {
3194         udp_t           *udp = connp->conn_udp;
3195         udp_stack_t     *us = udp->udp_us;
3196         boolean_t       insert_spi = udp->udp_nat_t_endpoint;
3197         uint_t          pktlen;
3198         uint_t          alloclen;
3199         uint_t          copylen;
3200         uint8_t         *iph;
3201         uint_t          ip_hdr_length;
3202         udpha_t         *udpha;
3203         uint32_t        cksum;
3204         ip_pkt_t        *ipp;
3205 
3206         ASSERT(MUTEX_HELD(&connp->conn_lock));
3207 
3208         /*
3209          * Copy the header template and leave space for an SPI
3210          */
3211         copylen = connp->conn_ht_iphc_len;
3212         alloclen = copylen + (insert_spi ? sizeof (uint32_t) : 0);
3213         pktlen = alloclen + msgdsize(mp);
3214         if (pktlen > IP_MAXPACKET) {
3215                 freemsg(mp);
3216                 *errorp = EMSGSIZE;
3217                 return (NULL);
3218         }
3219         ixa->ixa_pktlen = pktlen;
3220 
3221         /* check/fix buffer config, setup pointers into it */
3222         iph = mp->b_rptr - alloclen;
3223         if (DB_REF(mp) != 1 || iph < DB_BASE(mp) || !OK_32PTR(iph)) {
3224                 mblk_t *mp1;
3225 
3226                 mp1 = allocb(alloclen + us->us_wroff_extra, BPRI_MED);
3227                 if (mp1 == NULL) {
3228                         freemsg(mp);
3229                         *errorp = ENOMEM;
3230                         return (NULL);
3231                 }
3232                 mp1->b_wptr = DB_LIM(mp1);
3233                 mp1->b_cont = mp;
3234                 mp = mp1;
3235                 iph = (mp->b_wptr - alloclen);
3236         }
3237         mp->b_rptr = iph;
3238         bcopy(connp->conn_ht_iphc, iph, copylen);
3239         ip_hdr_length = (uint_t)(connp->conn_ht_ulp - connp->conn_ht_iphc);
3240 
3241         ixa->ixa_ip_hdr_length = ip_hdr_length;
3242         udpha = (udpha_t *)(iph + ip_hdr_length);
3243 
3244         /*
3245          * Setup header length and prepare for ULP checksum done in IP.
3246          * udp_build_hdr_template has already massaged any routing header
3247          * and placed the result in conn_sum.
3248          *
3249          * We make it easy for IP to include our pseudo header
3250          * by putting our length in uha_checksum.
3251          */
3252         cksum = pktlen - ip_hdr_length;
3253         udpha->uha_length = htons(cksum);
3254 
3255         cksum += connp->conn_sum;
3256         cksum = (cksum >> 16) + (cksum & 0xFFFF);
3257         ASSERT(cksum < 0x10000);
3258 
3259         ipp = &connp->conn_xmit_ipp;
3260         if (ixa->ixa_flags & IXAF_IS_IPV4) {
3261                 ipha_t  *ipha = (ipha_t *)iph;
3262 
3263                 ipha->ipha_length = htons((uint16_t)pktlen);
3264 
3265                 /* IP does the checksum if uha_checksum is non-zero */
3266                 if (us->us_do_checksum)
3267                         udpha->uha_checksum = htons(cksum);
3268 
3269                 /* if IP_PKTINFO specified an addres it wins over bind() */
3270                 if ((ipp->ipp_fields & IPPF_ADDR) &&
3271                     IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr)) {
3272                         ASSERT(ipp->ipp_addr_v4 != INADDR_ANY);
3273                         ipha->ipha_src = ipp->ipp_addr_v4;
3274                 } else {
3275                         IN6_V4MAPPED_TO_IPADDR(v6src, ipha->ipha_src);
3276                 }
3277         } else {
3278                 ip6_t *ip6h = (ip6_t *)iph;
3279 
3280                 ip6h->ip6_plen =  htons((uint16_t)(pktlen - IPV6_HDR_LEN));
3281                 udpha->uha_checksum = htons(cksum);
3282 
3283                 /* if IP_PKTINFO specified an addres it wins over bind() */
3284                 if ((ipp->ipp_fields & IPPF_ADDR) &&
3285                     !IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr)) {
3286                         ASSERT(!IN6_IS_ADDR_UNSPECIFIED(&ipp->ipp_addr));
3287                         ip6h->ip6_src = ipp->ipp_addr;
3288                 } else {
3289                         ip6h->ip6_src = *v6src;
3290                 }
3291                 ip6h->ip6_vcf =
3292                     (IPV6_DEFAULT_VERS_AND_FLOW & IPV6_VERS_AND_FLOW_MASK) |
3293                     (flowinfo & ~IPV6_VERS_AND_FLOW_MASK);
3294                 if (ipp->ipp_fields & IPPF_TCLASS) {
3295                         /* Overrides the class part of flowinfo */
3296                         ip6h->ip6_vcf = IPV6_TCLASS_FLOW(ip6h->ip6_vcf,
3297                             ipp->ipp_tclass);
3298                 }
3299         }
3300 
3301         /* Insert all-0s SPI now. */
3302         if (insert_spi)
3303                 *((uint32_t *)(udpha + 1)) = 0;
3304 
3305         udpha->uha_dst_port = dstport;
3306         return (mp);
3307 }
3308 
3309 /*
3310  * Send a T_UDERR_IND in response to an M_DATA
3311  */
3312 static void
3313 udp_ud_err_connected(conn_t *connp, t_scalar_t error)
3314 {
3315         struct sockaddr_storage ss;
3316         sin_t           *sin;
3317         sin6_t          *sin6;
3318         struct sockaddr *addr;
3319         socklen_t       addrlen;
3320         mblk_t          *mp1;
3321 
3322         mutex_enter(&connp->conn_lock);
3323         /* Initialize addr and addrlen as if they're passed in */
3324         if (connp->conn_family == AF_INET) {
3325                 sin = (sin_t *)&ss;
3326                 *sin = sin_null;
3327                 sin->sin_family = AF_INET;
3328                 sin->sin_port = connp->conn_fport;
3329                 sin->sin_addr.s_addr = connp->conn_faddr_v4;
3330                 addr = (struct sockaddr *)sin;
3331                 addrlen = sizeof (*sin);
3332         } else {
3333                 sin6 = (sin6_t *)&ss;
3334                 *sin6 = sin6_null;
3335                 sin6->sin6_family = AF_INET6;
3336                 sin6->sin6_port = connp->conn_fport;
3337                 sin6->sin6_flowinfo = connp->conn_flowinfo;
3338                 sin6->sin6_addr = connp->conn_faddr_v6;
3339                 if (IN6_IS_ADDR_LINKSCOPE(&connp->conn_faddr_v6) &&
3340                     (connp->conn_ixa->ixa_flags & IXAF_SCOPEID_SET)) {
3341                         sin6->sin6_scope_id = connp->conn_ixa->ixa_scopeid;
3342                 } else {
3343                         sin6->sin6_scope_id = 0;
3344                 }
3345                 sin6->__sin6_src_id = 0;
3346                 addr = (struct sockaddr *)sin6;
3347                 addrlen = sizeof (*sin6);
3348         }
3349         mutex_exit(&connp->conn_lock);
3350 
3351         mp1 = mi_tpi_uderror_ind((char *)addr, addrlen, NULL, 0, error);
3352         if (mp1 != NULL)
3353                 putnext(connp->conn_rq, mp1);
3354 }
3355 
3356 /*
3357  * This routine handles all messages passed downstream.  It either
3358  * consumes the message or passes it downstream; it never queues a
3359  * a message.
3360  *
3361  * Also entry point for sockfs when udp is in "direct sockfs" mode.  This mode
3362  * is valid when we are directly beneath the stream head, and thus sockfs
3363  * is able to bypass STREAMS and directly call us, passing along the sockaddr
3364  * structure without the cumbersome T_UNITDATA_REQ interface for the case of
3365  * connected endpoints.
3366  */
3367 void
3368 udp_wput(queue_t *q, mblk_t *mp)
3369 {
3370         sin6_t          *sin6;
3371         sin_t           *sin = NULL;
3372         uint_t          srcid;
3373         conn_t          *connp = Q_TO_CONN(q);
3374         udp_t           *udp = connp->conn_udp;
3375         int             error = 0;
3376         struct sockaddr *addr = NULL;
3377         socklen_t       addrlen;
3378         udp_stack_t     *us = udp->udp_us;
3379         struct T_unitdata_req *tudr;
3380         mblk_t          *data_mp;
3381         ushort_t        ipversion;
3382         cred_t          *cr;
3383         pid_t           pid;
3384 
3385         /*
3386          * We directly handle several cases here: T_UNITDATA_REQ message
3387          * coming down as M_PROTO/M_PCPROTO and M_DATA messages for connected
3388          * socket.
3389          */
3390         switch (DB_TYPE(mp)) {
3391         case M_DATA:
3392                 if (!udp->udp_issocket || udp->udp_state != TS_DATA_XFER) {
3393                         /* Not connected; address is required */
3394                         UDPS_BUMP_MIB(us, udpOutErrors);
3395                         UDP_DBGSTAT(us, udp_data_notconn);
3396                         UDP_STAT(us, udp_out_err_notconn);
3397                         freemsg(mp);
3398                         return;
3399                 }
3400                 /*
3401                  * All Solaris components should pass a db_credp
3402                  * for this message, hence we ASSERT.
3403                  * On production kernels we return an error to be robust against
3404                  * random streams modules sitting on top of us.
3405                  */
3406                 cr = msg_getcred(mp, &pid);
3407                 ASSERT(cr != NULL);
3408                 if (cr == NULL) {
3409                         UDPS_BUMP_MIB(us, udpOutErrors);
3410                         freemsg(mp);
3411                         return;
3412                 }
3413                 ASSERT(udp->udp_issocket);
3414                 UDP_DBGSTAT(us, udp_data_conn);
3415                 error = udp_output_connected(connp, mp, cr, pid);
3416                 if (error != 0) {
3417                         UDP_STAT(us, udp_out_err_output);
3418                         if (connp->conn_rq != NULL)
3419                                 udp_ud_err_connected(connp, (t_scalar_t)error);
3420 #ifdef DEBUG
3421                         printf("udp_output_connected returned %d\n", error);
3422 #endif
3423                 }
3424                 return;
3425 
3426         case M_PROTO:
3427         case M_PCPROTO:
3428                 tudr = (struct T_unitdata_req *)mp->b_rptr;
3429                 if (MBLKL(mp) < sizeof (*tudr) ||
3430                     ((t_primp_t)mp->b_rptr)->type != T_UNITDATA_REQ) {
3431                         udp_wput_other(q, mp);
3432                         return;
3433                 }
3434                 break;
3435 
3436         default:
3437                 udp_wput_other(q, mp);
3438                 return;
3439         }
3440 
3441         /* Handle valid T_UNITDATA_REQ here */
3442         data_mp = mp->b_cont;
3443         if (data_mp == NULL) {
3444                 error = EPROTO;
3445                 goto ud_error2;
3446         }
3447         mp->b_cont = NULL;
3448 
3449         if (!MBLKIN(mp, 0, tudr->DEST_offset + tudr->DEST_length)) {
3450                 error = EADDRNOTAVAIL;
3451                 goto ud_error2;
3452         }
3453 
3454         /*
3455          * All Solaris components should pass a db_credp
3456          * for this TPI message, hence we should ASSERT.
3457          * However, RPC (svc_clts_ksend) does this odd thing where it
3458          * passes the options from a T_UNITDATA_IND unchanged in a
3459          * T_UNITDATA_REQ. While that is the right thing to do for
3460          * some options, SCM_UCRED being the key one, this also makes it
3461          * pass down IP_RECVDSTADDR. Hence we can't ASSERT here.
3462          */
3463         cr = msg_getcred(mp, &pid);
3464         if (cr == NULL) {
3465                 cr = connp->conn_cred;
3466                 pid = connp->conn_cpid;
3467         }
3468 
3469         /*
3470          * If a port has not been bound to the stream, fail.
3471          * This is not a problem when sockfs is directly
3472          * above us, because it will ensure that the socket
3473          * is first bound before allowing data to be sent.
3474          */
3475         if (udp->udp_state == TS_UNBND) {
3476                 error = EPROTO;
3477                 goto ud_error2;
3478         }
3479         addr = (struct sockaddr *)&mp->b_rptr[tudr->DEST_offset];
3480         addrlen = tudr->DEST_length;
3481 
3482         switch (connp->conn_family) {
3483         case AF_INET6:
3484                 sin6 = (sin6_t *)addr;
3485                 if (!OK_32PTR((char *)sin6) || (addrlen != sizeof (sin6_t)) ||
3486                     (sin6->sin6_family != AF_INET6)) {
3487                         error = EADDRNOTAVAIL;
3488                         goto ud_error2;
3489                 }
3490 
3491                 srcid = sin6->__sin6_src_id;
3492                 if (!IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
3493                         /*
3494                          * Destination is a non-IPv4-compatible IPv6 address.
3495                          * Send out an IPv6 format packet.
3496                          */
3497 
3498                         /*
3499                          * If the local address is a mapped address return
3500                          * an error.
3501                          * It would be possible to send an IPv6 packet but the
3502                          * response would never make it back to the application
3503                          * since it is bound to a mapped address.
3504                          */
3505                         if (IN6_IS_ADDR_V4MAPPED(&connp->conn_saddr_v6)) {
3506                                 error = EADDRNOTAVAIL;
3507                                 goto ud_error2;
3508                         }
3509 
3510                         UDP_DBGSTAT(us, udp_out_ipv6);
3511 
3512                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
3513                                 sin6->sin6_addr = ipv6_loopback;
3514                         ipversion = IPV6_VERSION;
3515                 } else {
3516                         if (connp->conn_ipv6_v6only) {
3517                                 error = EADDRNOTAVAIL;
3518                                 goto ud_error2;
3519                         }
3520 
3521                         /*
3522                          * If the local address is not zero or a mapped address
3523                          * return an error.  It would be possible to send an
3524                          * IPv4 packet but the response would never make it
3525                          * back to the application since it is bound to a
3526                          * non-mapped address.
3527                          */
3528                         if (!IN6_IS_ADDR_V4MAPPED(&connp->conn_saddr_v6) &&
3529                             !IN6_IS_ADDR_UNSPECIFIED(&connp->conn_saddr_v6)) {
3530                                 error = EADDRNOTAVAIL;
3531                                 goto ud_error2;
3532                         }
3533                         UDP_DBGSTAT(us, udp_out_mapped);
3534 
3535                         if (V4_PART_OF_V6(sin6->sin6_addr) == INADDR_ANY) {
3536                                 V4_PART_OF_V6(sin6->sin6_addr) =
3537                                     htonl(INADDR_LOOPBACK);
3538                         }
3539                         ipversion = IPV4_VERSION;
3540                 }
3541 
3542                 if (tudr->OPT_length != 0) {
3543                         /*
3544                          * If we are connected then the destination needs to be
3545                          * the same as the connected one.
3546                          */
3547                         if (udp->udp_state == TS_DATA_XFER &&
3548                             !conn_same_as_last_v6(connp, sin6)) {
3549                                 error = EISCONN;
3550                                 goto ud_error2;
3551                         }
3552                         UDP_STAT(us, udp_out_opt);
3553                         error = udp_output_ancillary(connp, NULL, sin6,
3554                             data_mp, mp, NULL, cr, pid);
3555                 } else {
3556                         ip_xmit_attr_t *ixa;
3557 
3558                         /*
3559                          * We have to allocate an ip_xmit_attr_t before we grab
3560                          * conn_lock and we need to hold conn_lock once we've
3561                          * checked conn_same_as_last_v6 to handle concurrent
3562                          * send* calls on a socket.
3563                          */
3564                         ixa = conn_get_ixa(connp, B_FALSE);
3565                         if (ixa == NULL) {
3566                                 error = ENOMEM;
3567                                 goto ud_error2;
3568                         }
3569                         mutex_enter(&connp->conn_lock);
3570 
3571                         if (conn_same_as_last_v6(connp, sin6) &&
3572                             connp->conn_lastsrcid == srcid &&
3573                             ipsec_outbound_policy_current(ixa)) {
3574                                 UDP_DBGSTAT(us, udp_out_lastdst);
3575                                 /* udp_output_lastdst drops conn_lock */
3576                                 error = udp_output_lastdst(connp, data_mp, cr,
3577                                     pid, ixa);
3578                         } else {
3579                                 UDP_DBGSTAT(us, udp_out_diffdst);
3580                                 /* udp_output_newdst drops conn_lock */
3581                                 error = udp_output_newdst(connp, data_mp, NULL,
3582                                     sin6, ipversion, cr, pid, ixa);
3583                         }
3584                         ASSERT(MUTEX_NOT_HELD(&connp->conn_lock));
3585                 }
3586                 if (error == 0) {
3587                         freeb(mp);
3588                         return;
3589                 }
3590                 break;
3591 
3592         case AF_INET:
3593                 sin = (sin_t *)addr;
3594                 if ((!OK_32PTR((char *)sin) || addrlen != sizeof (sin_t)) ||
3595                     (sin->sin_family != AF_INET)) {
3596                         error = EADDRNOTAVAIL;
3597                         goto ud_error2;
3598                 }
3599                 UDP_DBGSTAT(us, udp_out_ipv4);
3600                 if (sin->sin_addr.s_addr == INADDR_ANY)
3601                         sin->sin_addr.s_addr = htonl(INADDR_LOOPBACK);
3602                 ipversion = IPV4_VERSION;
3603 
3604                 srcid = 0;
3605                 if (tudr->OPT_length != 0) {
3606                         /*
3607                          * If we are connected then the destination needs to be
3608                          * the same as the connected one.
3609                          */
3610                         if (udp->udp_state == TS_DATA_XFER &&
3611                             !conn_same_as_last_v4(connp, sin)) {
3612                                 error = EISCONN;
3613                                 goto ud_error2;
3614                         }
3615                         UDP_STAT(us, udp_out_opt);
3616                         error = udp_output_ancillary(connp, sin, NULL,
3617                             data_mp, mp, NULL, cr, pid);
3618                 } else {
3619                         ip_xmit_attr_t *ixa;
3620 
3621                         /*
3622                          * We have to allocate an ip_xmit_attr_t before we grab
3623                          * conn_lock and we need to hold conn_lock once we've
3624                          * checked conn_same_as_last_v4 to handle concurrent
3625                          * send* calls on a socket.
3626                          */
3627                         ixa = conn_get_ixa(connp, B_FALSE);
3628                         if (ixa == NULL) {
3629                                 error = ENOMEM;
3630                                 goto ud_error2;
3631                         }
3632                         mutex_enter(&connp->conn_lock);
3633 
3634                         if (conn_same_as_last_v4(connp, sin) &&
3635                             ipsec_outbound_policy_current(ixa)) {
3636                                 UDP_DBGSTAT(us, udp_out_lastdst);
3637                                 /* udp_output_lastdst drops conn_lock */
3638                                 error = udp_output_lastdst(connp, data_mp, cr,
3639                                     pid, ixa);
3640                         } else {
3641                                 UDP_DBGSTAT(us, udp_out_diffdst);
3642                                 /* udp_output_newdst drops conn_lock */
3643                                 error = udp_output_newdst(connp, data_mp, sin,
3644                                     NULL, ipversion, cr, pid, ixa);
3645                         }
3646                         ASSERT(MUTEX_NOT_HELD(&connp->conn_lock));
3647                 }
3648                 if (error == 0) {
3649                         freeb(mp);
3650                         return;
3651                 }
3652                 break;
3653         }
3654         UDP_STAT(us, udp_out_err_output);
3655         ASSERT(mp != NULL);
3656         /* mp is freed by the following routine */
3657         udp_ud_err(q, mp, (t_scalar_t)error);
3658         return;
3659 
3660 ud_error2:
3661         UDPS_BUMP_MIB(us, udpOutErrors);
3662         freemsg(data_mp);
3663         UDP_STAT(us, udp_out_err_output);
3664         ASSERT(mp != NULL);
3665         /* mp is freed by the following routine */
3666         udp_ud_err(q, mp, (t_scalar_t)error);
3667 }
3668 
3669 /*
3670  * Handle the case of the IP address, port, flow label being different
3671  * for both IPv4 and IPv6.
3672  *
3673  * NOTE: The caller must hold conn_lock and we drop it here.
3674  */
3675 static int
3676 udp_output_newdst(conn_t *connp, mblk_t *data_mp, sin_t *sin, sin6_t *sin6,
3677     ushort_t ipversion, cred_t *cr, pid_t pid, ip_xmit_attr_t *ixa)
3678 {
3679         uint_t          srcid;
3680         uint32_t        flowinfo;
3681         udp_t           *udp = connp->conn_udp;
3682         int             error = 0;
3683         ip_xmit_attr_t  *oldixa;
3684         udp_stack_t     *us = udp->udp_us;
3685         in6_addr_t      v6src;
3686         in6_addr_t      v6dst;
3687         in6_addr_t      v6nexthop;
3688         in_port_t       dstport;
3689 
3690         ASSERT(MUTEX_HELD(&connp->conn_lock));
3691         ASSERT(ixa != NULL);
3692         /*
3693          * We hold conn_lock across all the use and modifications of
3694          * the conn_lastdst, conn_ixa, and conn_xmit_ipp to ensure that they
3695          * stay consistent.
3696          */
3697 
3698         ASSERT(cr != NULL);
3699         ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3700         ixa->ixa_cred = cr;
3701         ixa->ixa_cpid = pid;
3702         if (is_system_labeled()) {
3703                 /* We need to restart with a label based on the cred */
3704                 ip_xmit_attr_restore_tsl(ixa, ixa->ixa_cred);
3705         }
3706 
3707         /*
3708          * If we are connected then the destination needs to be the
3709          * same as the connected one, which is not the case here since we
3710          * checked for that above.
3711          */
3712         if (udp->udp_state == TS_DATA_XFER) {
3713                 mutex_exit(&connp->conn_lock);
3714                 error = EISCONN;
3715                 goto ud_error;
3716         }
3717 
3718         /* In case previous destination was multicast or multirt */
3719         ip_attr_newdst(ixa);
3720 
3721         /*
3722          * If laddr is unspecified then we look at sin6_src_id.
3723          * We will give precedence to a source address set with IPV6_PKTINFO
3724          * (aka IPPF_ADDR) but that is handled in build_hdrs. However, we don't
3725          * want ip_attr_connect to select a source (since it can fail) when
3726          * IPV6_PKTINFO is specified.
3727          * If this doesn't result in a source address then we get a source
3728          * from ip_attr_connect() below.
3729          */
3730         v6src = connp->conn_saddr_v6;
3731         if (sin != NULL) {
3732                 IN6_IPADDR_TO_V4MAPPED(sin->sin_addr.s_addr, &v6dst);
3733                 dstport = sin->sin_port;
3734                 flowinfo = 0;
3735                 /* Don't bother with ip_srcid_find_id(), but indicate anyway. */
3736                 srcid = 0;
3737                 ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
3738                 ixa->ixa_flags |= IXAF_IS_IPV4;
3739         } else {
3740                 boolean_t v4mapped;
3741 
3742                 v6dst = sin6->sin6_addr;
3743                 dstport = sin6->sin6_port;
3744                 flowinfo = sin6->sin6_flowinfo;
3745                 srcid = sin6->__sin6_src_id;
3746                 if (IN6_IS_ADDR_LINKSCOPE(&v6dst) && sin6->sin6_scope_id != 0) {
3747                         ixa->ixa_scopeid = sin6->sin6_scope_id;
3748                         ixa->ixa_flags |= IXAF_SCOPEID_SET;
3749                 } else {
3750                         ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
3751                 }
3752                 v4mapped = IN6_IS_ADDR_V4MAPPED(&v6dst);
3753                 if (v4mapped)
3754                         ixa->ixa_flags |= IXAF_IS_IPV4;
3755                 else
3756                         ixa->ixa_flags &= ~IXAF_IS_IPV4;
3757                 if (srcid != 0 && IN6_IS_ADDR_UNSPECIFIED(&v6src)) {
3758                         if (!ip_srcid_find_id(srcid, &v6src, IPCL_ZONEID(connp),
3759                             v4mapped, connp->conn_netstack)) {
3760                                 /* Mismatched v4mapped/v6 specified by srcid. */
3761                                 mutex_exit(&connp->conn_lock);
3762                                 error = EADDRNOTAVAIL;
3763                                 goto ud_error;
3764                         }
3765                 }
3766         }
3767         /* Handle IP_PKTINFO/IPV6_PKTINFO setting source address. */
3768         if (connp->conn_xmit_ipp.ipp_fields & IPPF_ADDR) {
3769                 ip_pkt_t *ipp = &connp->conn_xmit_ipp;
3770 
3771                 if (ixa->ixa_flags & IXAF_IS_IPV4) {
3772                         if (IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr))
3773                                 v6src = ipp->ipp_addr;
3774                 } else {
3775                         if (!IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr))
3776                                 v6src = ipp->ipp_addr;
3777                 }
3778         }
3779 
3780         ip_attr_nexthop(&connp->conn_xmit_ipp, ixa, &v6dst, &v6nexthop);
3781         mutex_exit(&connp->conn_lock);
3782 
3783         error = ip_attr_connect(connp, ixa, &v6src, &v6dst, &v6nexthop, dstport,
3784             &v6src, NULL, IPDF_ALLOW_MCBC | IPDF_VERIFY_DST | IPDF_IPSEC);
3785         switch (error) {
3786         case 0:
3787                 break;
3788         case EADDRNOTAVAIL:
3789                 /*
3790                  * IXAF_VERIFY_SOURCE tells us to pick a better source.
3791                  * Don't have the application see that errno
3792                  */
3793                 error = ENETUNREACH;
3794                 goto failed;
3795         case ENETDOWN:
3796                 /*
3797                  * Have !ipif_addr_ready address; drop packet silently
3798                  * until we can get applications to not send until we
3799                  * are ready.
3800                  */
3801                 error = 0;
3802                 goto failed;
3803         case EHOSTUNREACH:
3804         case ENETUNREACH:
3805                 if (ixa->ixa_ire != NULL) {
3806                         /*
3807                          * Let conn_ip_output/ire_send_noroute return
3808                          * the error and send any local ICMP error.
3809                          */
3810                         error = 0;
3811                         break;
3812                 }
3813                 /* FALLTHRU */
3814         failed:
3815         default:
3816                 goto ud_error;
3817         }
3818 
3819 
3820         /*
3821          * Cluster note: we let the cluster hook know that we are sending to a
3822          * new address and/or port.
3823          */
3824         if (cl_inet_connect2 != NULL) {
3825                 CL_INET_UDP_CONNECT(connp, B_TRUE, &v6dst, dstport, error);
3826                 if (error != 0) {
3827                         error = EHOSTUNREACH;
3828                         goto ud_error;
3829                 }
3830         }
3831 
3832         mutex_enter(&connp->conn_lock);
3833         /*
3834          * While we dropped the lock some other thread might have connected
3835          * this socket. If so we bail out with EISCONN to ensure that the
3836          * connecting thread is the one that updates conn_ixa, conn_ht_*
3837          * and conn_*last*.
3838          */
3839         if (udp->udp_state == TS_DATA_XFER) {
3840                 mutex_exit(&connp->conn_lock);
3841                 error = EISCONN;
3842                 goto ud_error;
3843         }
3844 
3845         /*
3846          * We need to rebuild the headers if
3847          *  - we are labeling packets (could be different for different
3848          *    destinations)
3849          *  - we have a source route (or routing header) since we need to
3850          *    massage that to get the pseudo-header checksum
3851          *  - the IP version is different than the last time
3852          *  - a socket option with COA_HEADER_CHANGED has been set which
3853          *    set conn_v6lastdst to zero.
3854          *
3855          * Otherwise the prepend function will just update the src, dst,
3856          * dstport, and flow label.
3857          */
3858         if (is_system_labeled()) {
3859                 /* TX MLP requires SCM_UCRED and don't have that here */
3860                 if (connp->conn_mlp_type != mlptSingle) {
3861                         mutex_exit(&connp->conn_lock);
3862                         error = ECONNREFUSED;
3863                         goto ud_error;
3864                 }
3865                 /*
3866                  * Check whether Trusted Solaris policy allows communication
3867                  * with this host, and pretend that the destination is
3868                  * unreachable if not.
3869                  * Compute any needed label and place it in ipp_label_v4/v6.
3870                  *
3871                  * Later conn_build_hdr_template/conn_prepend_hdr takes
3872                  * ipp_label_v4/v6 to form the packet.
3873                  *
3874                  * Tsol note: Since we hold conn_lock we know no other
3875                  * thread manipulates conn_xmit_ipp.
3876                  */
3877                 error = conn_update_label(connp, ixa, &v6dst,
3878                     &connp->conn_xmit_ipp);
3879                 if (error != 0) {
3880                         mutex_exit(&connp->conn_lock);
3881                         goto ud_error;
3882                 }
3883                 /* Rebuild the header template */
3884                 error = udp_build_hdr_template(connp, &v6src, &v6dst, dstport,
3885                     flowinfo);
3886                 if (error != 0) {
3887                         mutex_exit(&connp->conn_lock);
3888                         goto ud_error;
3889                 }
3890         } else if ((connp->conn_xmit_ipp.ipp_fields &
3891             (IPPF_IPV4_OPTIONS|IPPF_RTHDR)) ||
3892             ipversion != connp->conn_lastipversion ||
3893             IN6_IS_ADDR_UNSPECIFIED(&connp->conn_v6lastdst)) {
3894                 /* Rebuild the header template */
3895                 error = udp_build_hdr_template(connp, &v6src, &v6dst, dstport,
3896                     flowinfo);
3897                 if (error != 0) {
3898                         mutex_exit(&connp->conn_lock);
3899                         goto ud_error;
3900                 }
3901         } else {
3902                 /* Simply update the destination address if no source route */
3903                 if (ixa->ixa_flags & IXAF_IS_IPV4) {
3904                         ipha_t  *ipha = (ipha_t *)connp->conn_ht_iphc;
3905 
3906                         IN6_V4MAPPED_TO_IPADDR(&v6dst, ipha->ipha_dst);
3907                         if (ixa->ixa_flags & IXAF_PMTU_IPV4_DF) {
3908                                 ipha->ipha_fragment_offset_and_flags |=
3909                                     IPH_DF_HTONS;
3910                         } else {
3911                                 ipha->ipha_fragment_offset_and_flags &=
3912                                     ~IPH_DF_HTONS;
3913                         }
3914                 } else {
3915                         ip6_t *ip6h = (ip6_t *)connp->conn_ht_iphc;
3916                         ip6h->ip6_dst = v6dst;
3917                 }
3918         }
3919 
3920         /*
3921          * Remember the dst/dstport etc which corresponds to the built header
3922          * template and conn_ixa.
3923          */
3924         oldixa = conn_replace_ixa(connp, ixa);
3925         connp->conn_v6lastdst = v6dst;
3926         connp->conn_lastipversion = ipversion;
3927         connp->conn_lastdstport = dstport;
3928         connp->conn_lastflowinfo = flowinfo;
3929         connp->conn_lastscopeid = ixa->ixa_scopeid;
3930         connp->conn_lastsrcid = srcid;
3931         /* Also remember a source to use together with lastdst */
3932         connp->conn_v6lastsrc = v6src;
3933 
3934         data_mp = udp_prepend_header_template(connp, ixa, data_mp, &v6src,
3935             dstport, flowinfo, &error);
3936 
3937         /* Done with conn_t */
3938         mutex_exit(&connp->conn_lock);
3939         ixa_refrele(oldixa);
3940 
3941         if (data_mp == NULL) {
3942                 ASSERT(error != 0);
3943                 goto ud_error;
3944         }
3945 
3946         /* We're done.  Pass the packet to ip. */
3947         UDPS_BUMP_MIB(us, udpHCOutDatagrams);
3948 
3949         DTRACE_UDP5(send, mblk_t *, NULL, ip_xmit_attr_t *, ixa,
3950             void_ip_t *, data_mp->b_rptr, udp_t *, udp, udpha_t *,
3951             &data_mp->b_rptr[ixa->ixa_ip_hdr_length]);
3952 
3953         error = conn_ip_output(data_mp, ixa);
3954         /* No udpOutErrors if an error since IP increases its error counter */
3955         switch (error) {
3956         case 0:
3957                 break;
3958         case EWOULDBLOCK:
3959                 (void) ixa_check_drain_insert(connp, ixa);
3960                 error = 0;
3961                 break;
3962         case EADDRNOTAVAIL:
3963                 /*
3964                  * IXAF_VERIFY_SOURCE tells us to pick a better source.
3965                  * Don't have the application see that errno
3966                  */
3967                 error = ENETUNREACH;
3968                 /* FALLTHRU */
3969         default:
3970                 mutex_enter(&connp->conn_lock);
3971                 /*
3972                  * Clear the source and v6lastdst so we call ip_attr_connect
3973                  * for the next packet and try to pick a better source.
3974                  */
3975                 if (connp->conn_mcbc_bind)
3976                         connp->conn_saddr_v6 = ipv6_all_zeros;
3977                 else
3978                         connp->conn_saddr_v6 = connp->conn_bound_addr_v6;
3979                 connp->conn_v6lastdst = ipv6_all_zeros;
3980                 mutex_exit(&connp->conn_lock);
3981                 break;
3982         }
3983         ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3984         ixa->ixa_cred = connp->conn_cred; /* Restore */
3985         ixa->ixa_cpid = connp->conn_cpid;
3986         ixa_refrele(ixa);
3987         return (error);
3988 
3989 ud_error:
3990         ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3991         ixa->ixa_cred = connp->conn_cred; /* Restore */
3992         ixa->ixa_cpid = connp->conn_cpid;
3993         ixa_refrele(ixa);
3994 
3995         freemsg(data_mp);
3996         UDPS_BUMP_MIB(us, udpOutErrors);
3997         UDP_STAT(us, udp_out_err_output);
3998         return (error);
3999 }
4000 
4001 /* ARGSUSED */
4002 static void
4003 udp_wput_fallback(queue_t *wq, mblk_t *mp)
4004 {
4005 #ifdef DEBUG
4006         cmn_err(CE_CONT, "udp_wput_fallback: Message in fallback \n");
4007 #endif
4008         freemsg(mp);
4009 }
4010 
4011 
4012 /*
4013  * Handle special out-of-band ioctl requests (see PSARC/2008/265).
4014  */
4015 static void
4016 udp_wput_cmdblk(queue_t *q, mblk_t *mp)
4017 {
4018         void    *data;
4019         mblk_t  *datamp = mp->b_cont;
4020         conn_t  *connp = Q_TO_CONN(q);
4021         udp_t   *udp = connp->conn_udp;
4022         cmdblk_t *cmdp = (cmdblk_t *)mp->b_rptr;
4023 
4024         if (datamp == NULL || MBLKL(datamp) < cmdp->cb_len) {
4025                 cmdp->cb_error = EPROTO;
4026                 qreply(q, mp);
4027                 return;
4028         }
4029         data = datamp->b_rptr;
4030 
4031         mutex_enter(&connp->conn_lock);
4032         switch (cmdp->cb_cmd) {
4033         case TI_GETPEERNAME:
4034                 if (udp->udp_state != TS_DATA_XFER)
4035                         cmdp->cb_error = ENOTCONN;
4036                 else
4037                         cmdp->cb_error = conn_getpeername(connp, data,
4038                             &cmdp->cb_len);
4039                 break;
4040         case TI_GETMYNAME:
4041                 cmdp->cb_error = conn_getsockname(connp, data, &cmdp->cb_len);
4042                 break;
4043         default:
4044                 cmdp->cb_error = EINVAL;
4045                 break;
4046         }
4047         mutex_exit(&connp->conn_lock);
4048 
4049         qreply(q, mp);
4050 }
4051 
4052 static void
4053 udp_use_pure_tpi(udp_t *udp)
4054 {
4055         conn_t  *connp = udp->udp_connp;
4056 
4057         mutex_enter(&connp->conn_lock);
4058         udp->udp_issocket = B_FALSE;
4059         mutex_exit(&connp->conn_lock);
4060         UDP_STAT(udp->udp_us, udp_sock_fallback);
4061 }
4062 
4063 static void
4064 udp_wput_other(queue_t *q, mblk_t *mp)
4065 {
4066         uchar_t *rptr = mp->b_rptr;
4067         struct iocblk *iocp;
4068         conn_t  *connp = Q_TO_CONN(q);
4069         udp_t   *udp = connp->conn_udp;
4070         cred_t  *cr;
4071 
4072         switch (mp->b_datap->db_type) {
4073         case M_CMD:
4074                 udp_wput_cmdblk(q, mp);
4075                 return;
4076 
4077         case M_PROTO:
4078         case M_PCPROTO:
4079                 if (mp->b_wptr - rptr < sizeof (t_scalar_t)) {
4080                         /*
4081                          * If the message does not contain a PRIM_type,
4082                          * throw it away.
4083                          */
4084                         freemsg(mp);
4085                         return;
4086                 }
4087                 switch (((t_primp_t)rptr)->type) {
4088                 case T_ADDR_REQ:
4089                         udp_addr_req(q, mp);
4090                         return;
4091                 case O_T_BIND_REQ:
4092                 case T_BIND_REQ:
4093                         udp_tpi_bind(q, mp);
4094                         return;
4095                 case T_CONN_REQ:
4096                         udp_tpi_connect(q, mp);
4097                         return;
4098                 case T_CAPABILITY_REQ:
4099                         udp_capability_req(q, mp);
4100                         return;
4101                 case T_INFO_REQ:
4102                         udp_info_req(q, mp);
4103                         return;
4104                 case T_UNITDATA_REQ:
4105                         /*
4106                          * If a T_UNITDATA_REQ gets here, the address must
4107                          * be bad.  Valid T_UNITDATA_REQs are handled
4108                          * in udp_wput.
4109                          */
4110                         udp_ud_err(q, mp, EADDRNOTAVAIL);
4111                         return;
4112                 case T_UNBIND_REQ:
4113                         udp_tpi_unbind(q, mp);
4114                         return;
4115                 case T_SVR4_OPTMGMT_REQ:
4116                         /*
4117                          * All Solaris components should pass a db_credp
4118                          * for this TPI message, hence we ASSERT.
4119                          * But in case there is some other M_PROTO that looks
4120                          * like a TPI message sent by some other kernel
4121                          * component, we check and return an error.
4122                          */
4123                         cr = msg_getcred(mp, NULL);
4124                         ASSERT(cr != NULL);
4125                         if (cr == NULL) {
4126                                 udp_err_ack(q, mp, TSYSERR, EINVAL);
4127                                 return;
4128                         }
4129                         if (!snmpcom_req(q, mp, udp_snmp_set, ip_snmp_get,
4130                             cr)) {
4131                                 svr4_optcom_req(q, mp, cr, &udp_opt_obj);
4132                         }
4133                         return;
4134 
4135                 case T_OPTMGMT_REQ:
4136                         /*
4137                          * All Solaris components should pass a db_credp
4138                          * for this TPI message, hence we ASSERT.
4139                          * But in case there is some other M_PROTO that looks
4140                          * like a TPI message sent by some other kernel
4141                          * component, we check and return an error.
4142                          */
4143                         cr = msg_getcred(mp, NULL);
4144                         ASSERT(cr != NULL);
4145                         if (cr == NULL) {
4146                                 udp_err_ack(q, mp, TSYSERR, EINVAL);
4147                                 return;
4148                         }
4149                         tpi_optcom_req(q, mp, cr, &udp_opt_obj);
4150                         return;
4151 
4152                 case T_DISCON_REQ:
4153                         udp_tpi_disconnect(q, mp);
4154                         return;
4155 
4156                 /* The following TPI message is not supported by udp. */
4157                 case O_T_CONN_RES:
4158                 case T_CONN_RES:
4159                         udp_err_ack(q, mp, TNOTSUPPORT, 0);
4160                         return;
4161 
4162                 /* The following 3 TPI requests are illegal for udp. */
4163                 case T_DATA_REQ:
4164                 case T_EXDATA_REQ:
4165                 case T_ORDREL_REQ:
4166                         udp_err_ack(q, mp, TNOTSUPPORT, 0);
4167                         return;
4168                 default:
4169                         break;
4170                 }
4171                 break;
4172         case M_FLUSH:
4173                 if (*rptr & FLUSHW)
4174                         flushq(q, FLUSHDATA);
4175                 break;
4176         case M_IOCTL:
4177                 iocp = (struct iocblk *)mp->b_rptr;
4178                 switch (iocp->ioc_cmd) {
4179                 case TI_GETPEERNAME:
4180                         if (udp->udp_state != TS_DATA_XFER) {
4181                                 /*
4182                                  * If a default destination address has not
4183                                  * been associated with the stream, then we
4184                                  * don't know the peer's name.
4185                                  */
4186                                 iocp->ioc_error = ENOTCONN;
4187                                 iocp->ioc_count = 0;
4188                                 mp->b_datap->db_type = M_IOCACK;
4189                                 qreply(q, mp);
4190                                 return;
4191                         }
4192                         /* FALLTHRU */
4193                 case TI_GETMYNAME:
4194                         /*
4195                          * For TI_GETPEERNAME and TI_GETMYNAME, we first
4196                          * need to copyin the user's strbuf structure.
4197                          * Processing will continue in the M_IOCDATA case
4198                          * below.
4199                          */
4200                         mi_copyin(q, mp, NULL,
4201                             SIZEOF_STRUCT(strbuf, iocp->ioc_flag));
4202                         return;
4203                 case _SIOCSOCKFALLBACK:
4204                         /*
4205                          * Either sockmod is about to be popped and the
4206                          * socket would now be treated as a plain stream,
4207                          * or a module is about to be pushed so we have
4208                          * to follow pure TPI semantics.
4209                          */
4210                         if (!udp->udp_issocket) {
4211                                 DB_TYPE(mp) = M_IOCNAK;
4212                                 iocp->ioc_error = EINVAL;
4213                         } else {
4214                                 udp_use_pure_tpi(udp);
4215 
4216                                 DB_TYPE(mp) = M_IOCACK;
4217                                 iocp->ioc_error = 0;
4218                         }
4219                         iocp->ioc_count = 0;
4220                         iocp->ioc_rval = 0;
4221                         qreply(q, mp);
4222                         return;
4223                 default:
4224                         break;
4225                 }
4226                 break;
4227         case M_IOCDATA:
4228                 udp_wput_iocdata(q, mp);
4229                 return;
4230         default:
4231                 /* Unrecognized messages are passed through without change. */
4232                 break;
4233         }
4234         ip_wput_nondata(q, mp);
4235 }
4236 
4237 /*
4238  * udp_wput_iocdata is called by udp_wput_other to handle all M_IOCDATA
4239  * messages.
4240  */
4241 static void
4242 udp_wput_iocdata(queue_t *q, mblk_t *mp)
4243 {
4244         mblk_t          *mp1;
4245         struct  iocblk *iocp = (struct iocblk *)mp->b_rptr;
4246         STRUCT_HANDLE(strbuf, sb);
4247         uint_t          addrlen;
4248         conn_t          *connp = Q_TO_CONN(q);
4249         udp_t           *udp = connp->conn_udp;
4250 
4251         /* Make sure it is one of ours. */
4252         switch (iocp->ioc_cmd) {
4253         case TI_GETMYNAME:
4254         case TI_GETPEERNAME:
4255                 break;
4256         default:
4257                 ip_wput_nondata(q, mp);
4258                 return;
4259         }
4260 
4261         switch (mi_copy_state(q, mp, &mp1)) {
4262         case -1:
4263                 return;
4264         case MI_COPY_CASE(MI_COPY_IN, 1):
4265                 break;
4266         case MI_COPY_CASE(MI_COPY_OUT, 1):
4267                 /*
4268                  * The address has been copied out, so now
4269                  * copyout the strbuf.
4270                  */
4271                 mi_copyout(q, mp);
4272                 return;
4273         case MI_COPY_CASE(MI_COPY_OUT, 2):
4274                 /*
4275                  * The address and strbuf have been copied out.
4276                  * We're done, so just acknowledge the original
4277                  * M_IOCTL.
4278                  */
4279                 mi_copy_done(q, mp, 0);
4280                 return;
4281         default:
4282                 /*
4283                  * Something strange has happened, so acknowledge
4284                  * the original M_IOCTL with an EPROTO error.
4285                  */
4286                 mi_copy_done(q, mp, EPROTO);
4287                 return;
4288         }
4289 
4290         /*
4291          * Now we have the strbuf structure for TI_GETMYNAME
4292          * and TI_GETPEERNAME.  Next we copyout the requested
4293          * address and then we'll copyout the strbuf.
4294          */
4295         STRUCT_SET_HANDLE(sb, iocp->ioc_flag, (void *)mp1->b_rptr);
4296 
4297         if (connp->conn_family == AF_INET)
4298                 addrlen = sizeof (sin_t);
4299         else
4300                 addrlen = sizeof (sin6_t);
4301 
4302         if (STRUCT_FGET(sb, maxlen) < addrlen) {
4303                 mi_copy_done(q, mp, EINVAL);
4304                 return;
4305         }
4306 
4307         switch (iocp->ioc_cmd) {
4308         case TI_GETMYNAME:
4309                 break;
4310         case TI_GETPEERNAME:
4311                 if (udp->udp_state != TS_DATA_XFER) {
4312                         mi_copy_done(q, mp, ENOTCONN);
4313                         return;
4314                 }
4315                 break;
4316         }
4317         mp1 = mi_copyout_alloc(q, mp, STRUCT_FGETP(sb, buf), addrlen, B_TRUE);
4318         if (!mp1)
4319                 return;
4320 
4321         STRUCT_FSET(sb, len, addrlen);
4322         switch (((struct iocblk *)mp->b_rptr)->ioc_cmd) {
4323         case TI_GETMYNAME:
4324                 (void) conn_getsockname(connp, (struct sockaddr *)mp1->b_wptr,
4325                     &addrlen);
4326                 break;
4327         case TI_GETPEERNAME:
4328                 (void) conn_getpeername(connp, (struct sockaddr *)mp1->b_wptr,
4329                     &addrlen);
4330                 break;
4331         }
4332         mp1->b_wptr += addrlen;
4333         /* Copy out the address */
4334         mi_copyout(q, mp);
4335 }
4336 
4337 void
4338 udp_ddi_g_init(void)
4339 {
4340         udp_max_optsize = optcom_max_optsize(udp_opt_obj.odb_opt_des_arr,
4341             udp_opt_obj.odb_opt_arr_cnt);
4342 
4343         /*
4344          * We want to be informed each time a stack is created or
4345          * destroyed in the kernel, so we can maintain the
4346          * set of udp_stack_t's.
4347          */
4348         netstack_register(NS_UDP, udp_stack_init, NULL, udp_stack_fini);
4349 }
4350 
4351 void
4352 udp_ddi_g_destroy(void)
4353 {
4354         netstack_unregister(NS_UDP);
4355 }
4356 
4357 #define INET_NAME       "ip"
4358 
4359 /*
4360  * Initialize the UDP stack instance.
4361  */
4362 static void *
4363 udp_stack_init(netstackid_t stackid, netstack_t *ns)
4364 {
4365         udp_stack_t     *us;
4366         int             i;
4367         int             error = 0;
4368         major_t         major;
4369         size_t          arrsz;
4370 
4371         us = (udp_stack_t *)kmem_zalloc(sizeof (*us), KM_SLEEP);
4372         us->us_netstack = ns;
4373 
4374         mutex_init(&us->us_epriv_port_lock, NULL, MUTEX_DEFAULT, NULL);
4375         us->us_num_epriv_ports = UDP_NUM_EPRIV_PORTS;
4376         us->us_epriv_ports[0] = ULP_DEF_EPRIV_PORT1;
4377         us->us_epriv_ports[1] = ULP_DEF_EPRIV_PORT2;
4378 
4379         /*
4380          * The smallest anonymous port in the priviledged port range which UDP
4381          * looks for free port.  Use in the option UDP_ANONPRIVBIND.
4382          */
4383         us->us_min_anonpriv_port = 512;
4384 
4385         us->us_bind_fanout_size = udp_bind_fanout_size;
4386 
4387         /* Roundup variable that might have been modified in /etc/system */
4388         if (!ISP2(us->us_bind_fanout_size)) {
4389                 /* Not a power of two. Round up to nearest power of two */
4390                 for (i = 0; i < 31; i++) {
4391                         if (us->us_bind_fanout_size < (1 << i))
4392                                 break;
4393                 }
4394                 us->us_bind_fanout_size = 1 << i;
4395         }
4396         us->us_bind_fanout = kmem_zalloc(us->us_bind_fanout_size *
4397             sizeof (udp_fanout_t), KM_SLEEP);
4398         for (i = 0; i < us->us_bind_fanout_size; i++) {
4399                 mutex_init(&us->us_bind_fanout[i].uf_lock, NULL, MUTEX_DEFAULT,
4400                     NULL);
4401         }
4402 
4403         arrsz = udp_propinfo_count * sizeof (mod_prop_info_t);
4404         us->us_propinfo_tbl = (mod_prop_info_t *)kmem_alloc(arrsz,
4405             KM_SLEEP);
4406         bcopy(udp_propinfo_tbl, us->us_propinfo_tbl, arrsz);
4407 
4408         /* Allocate the per netstack stats */
4409         mutex_enter(&cpu_lock);
4410         us->us_sc_cnt = MAX(ncpus, boot_ncpus);
4411         mutex_exit(&cpu_lock);
4412         us->us_sc = kmem_zalloc(max_ncpus  * sizeof (udp_stats_cpu_t *),
4413             KM_SLEEP);
4414         for (i = 0; i < us->us_sc_cnt; i++) {
4415                 us->us_sc[i] = kmem_zalloc(sizeof (udp_stats_cpu_t),
4416                     KM_SLEEP);
4417         }
4418 
4419         us->us_kstat = udp_kstat2_init(stackid);
4420         us->us_mibkp = udp_kstat_init(stackid);
4421 
4422         major = mod_name_to_major(INET_NAME);
4423         error = ldi_ident_from_major(major, &us->us_ldi_ident);
4424         ASSERT(error == 0);
4425         return (us);
4426 }
4427 
4428 /*
4429  * Free the UDP stack instance.
4430  */
4431 static void
4432 udp_stack_fini(netstackid_t stackid, void *arg)
4433 {
4434         udp_stack_t *us = (udp_stack_t *)arg;
4435         int i;
4436 
4437         for (i = 0; i < us->us_bind_fanout_size; i++) {
4438                 mutex_destroy(&us->us_bind_fanout[i].uf_lock);
4439         }
4440 
4441         kmem_free(us->us_bind_fanout, us->us_bind_fanout_size *
4442             sizeof (udp_fanout_t));
4443 
4444         us->us_bind_fanout = NULL;
4445 
4446         for (i = 0; i < us->us_sc_cnt; i++)
4447                 kmem_free(us->us_sc[i], sizeof (udp_stats_cpu_t));
4448         kmem_free(us->us_sc, max_ncpus * sizeof (udp_stats_cpu_t *));
4449 
4450         kmem_free(us->us_propinfo_tbl,
4451             udp_propinfo_count * sizeof (mod_prop_info_t));
4452         us->us_propinfo_tbl = NULL;
4453 
4454         udp_kstat_fini(stackid, us->us_mibkp);
4455         us->us_mibkp = NULL;
4456 
4457         udp_kstat2_fini(stackid, us->us_kstat);
4458         us->us_kstat = NULL;
4459 
4460         mutex_destroy(&us->us_epriv_port_lock);
4461         ldi_ident_release(us->us_ldi_ident);
4462         kmem_free(us, sizeof (*us));
4463 }
4464 
4465 static size_t
4466 udp_set_rcv_hiwat(udp_t *udp, size_t size)
4467 {
4468         udp_stack_t *us = udp->udp_us;
4469 
4470         /* We add a bit of extra buffering */
4471         size += size >> 1;
4472         if (size > us->us_max_buf)
4473                 size = us->us_max_buf;
4474 
4475         udp->udp_rcv_hiwat = size;
4476         return (size);
4477 }
4478 
4479 /*
4480  * For the lower queue so that UDP can be a dummy mux.
4481  * Nobody should be sending
4482  * packets up this stream
4483  */
4484 static void
4485 udp_lrput(queue_t *q, mblk_t *mp)
4486 {
4487         switch (mp->b_datap->db_type) {
4488         case M_FLUSH:
4489                 /* Turn around */
4490                 if (*mp->b_rptr & FLUSHW) {
4491                         *mp->b_rptr &= ~FLUSHR;
4492                         qreply(q, mp);
4493                         return;
4494                 }
4495                 break;
4496         }
4497         freemsg(mp);
4498 }
4499 
4500 /*
4501  * For the lower queue so that UDP can be a dummy mux.
4502  * Nobody should be sending packets down this stream.
4503  */
4504 /* ARGSUSED */
4505 void
4506 udp_lwput(queue_t *q, mblk_t *mp)
4507 {
4508         freemsg(mp);
4509 }
4510 
4511 /*
4512  * When a CPU is added, we need to allocate the per CPU stats struct.
4513  */
4514 void
4515 udp_stack_cpu_add(udp_stack_t *us, processorid_t cpu_seqid)
4516 {
4517         int i;
4518 
4519         if (cpu_seqid < us->us_sc_cnt)
4520                 return;
4521         for (i = us->us_sc_cnt; i <= cpu_seqid; i++) {
4522                 ASSERT(us->us_sc[i] == NULL);
4523                 us->us_sc[i] = kmem_zalloc(sizeof (udp_stats_cpu_t),
4524                     KM_SLEEP);
4525         }
4526         membar_producer();
4527         us->us_sc_cnt = cpu_seqid + 1;
4528 }
4529 
4530 /*
4531  * Below routines for UDP socket module.
4532  */
4533 
4534 static conn_t *
4535 udp_do_open(cred_t *credp, boolean_t isv6, int flags, int *errorp)
4536 {
4537         udp_t           *udp;
4538         conn_t          *connp;
4539         zoneid_t        zoneid;
4540         netstack_t      *ns;
4541         udp_stack_t     *us;
4542         int             len;
4543 
4544         ASSERT(errorp != NULL);
4545 
4546         if ((*errorp = secpolicy_basic_net_access(credp)) != 0)
4547                 return (NULL);
4548 
4549         ns = netstack_find_by_cred(credp);
4550         ASSERT(ns != NULL);
4551         us = ns->netstack_udp;
4552         ASSERT(us != NULL);
4553 
4554         /*
4555          * For exclusive stacks we set the zoneid to zero
4556          * to make UDP operate as if in the global zone.
4557          */
4558         if (ns->netstack_stackid != GLOBAL_NETSTACKID)
4559                 zoneid = GLOBAL_ZONEID;
4560         else
4561                 zoneid = crgetzoneid(credp);
4562 
4563         ASSERT(flags == KM_SLEEP || flags == KM_NOSLEEP);
4564 
4565         connp = ipcl_conn_create(IPCL_UDPCONN, flags, ns);
4566         if (connp == NULL) {
4567                 netstack_rele(ns);
4568                 *errorp = ENOMEM;
4569                 return (NULL);
4570         }
4571         udp = connp->conn_udp;
4572 
4573         /*
4574          * ipcl_conn_create did a netstack_hold. Undo the hold that was
4575          * done by netstack_find_by_cred()
4576          */
4577         netstack_rele(ns);
4578 
4579         /*
4580          * Since this conn_t/udp_t is not yet visible to anybody else we don't
4581          * need to lock anything.
4582          */
4583         ASSERT(connp->conn_proto == IPPROTO_UDP);
4584         ASSERT(connp->conn_udp == udp);
4585         ASSERT(udp->udp_connp == connp);
4586 
4587         /* Set the initial state of the stream and the privilege status. */
4588         udp->udp_state = TS_UNBND;
4589         connp->conn_ixa->ixa_flags |= IXAF_VERIFY_SOURCE;
4590         if (isv6) {
4591                 connp->conn_family = AF_INET6;
4592                 connp->conn_ipversion = IPV6_VERSION;
4593                 connp->conn_ixa->ixa_flags &= ~IXAF_IS_IPV4;
4594                 connp->conn_default_ttl = us->us_ipv6_hoplimit;
4595                 len = sizeof (ip6_t) + UDPH_SIZE;
4596         } else {
4597                 connp->conn_family = AF_INET;
4598                 connp->conn_ipversion = IPV4_VERSION;
4599                 connp->conn_ixa->ixa_flags |= IXAF_IS_IPV4;
4600                 connp->conn_default_ttl = us->us_ipv4_ttl;
4601                 len = sizeof (ipha_t) + UDPH_SIZE;
4602         }
4603 
4604         ASSERT(connp->conn_ixa->ixa_protocol == connp->conn_proto);
4605         connp->conn_xmit_ipp.ipp_unicast_hops = connp->conn_default_ttl;
4606 
4607         connp->conn_ixa->ixa_multicast_ttl = IP_DEFAULT_MULTICAST_TTL;
4608         connp->conn_ixa->ixa_flags |= IXAF_MULTICAST_LOOP | IXAF_SET_ULP_CKSUM;
4609         /* conn_allzones can not be set this early, hence no IPCL_ZONEID */
4610         connp->conn_ixa->ixa_zoneid = zoneid;
4611 
4612         connp->conn_zoneid = zoneid;
4613 
4614         /*
4615          * If the caller has the process-wide flag set, then default to MAC
4616          * exempt mode.  This allows read-down to unlabeled hosts.
4617          */
4618         if (getpflags(NET_MAC_AWARE, credp) != 0)
4619                 connp->conn_mac_mode = CONN_MAC_AWARE;
4620 
4621         connp->conn_zone_is_global = (crgetzoneid(credp) == GLOBAL_ZONEID);
4622 
4623         udp->udp_us = us;
4624 
4625         connp->conn_rcvbuf = us->us_recv_hiwat;
4626         connp->conn_sndbuf = us->us_xmit_hiwat;
4627         connp->conn_sndlowat = us->us_xmit_lowat;
4628         connp->conn_rcvlowat = udp_mod_info.mi_lowat;
4629 
4630         connp->conn_wroff = len + us->us_wroff_extra;
4631         connp->conn_so_type = SOCK_DGRAM;
4632 
4633         connp->conn_recv = udp_input;
4634         connp->conn_recvicmp = udp_icmp_input;
4635         crhold(credp);
4636         connp->conn_cred = credp;
4637         connp->conn_cpid = curproc->p_pid;
4638         connp->conn_open_time = ddi_get_lbolt64();
4639         /* Cache things in ixa without an extra refhold */
4640         ASSERT(!(connp->conn_ixa->ixa_free_flags & IXA_FREE_CRED));
4641         connp->conn_ixa->ixa_cred = connp->conn_cred;
4642         connp->conn_ixa->ixa_cpid = connp->conn_cpid;
4643         if (is_system_labeled())
4644                 connp->conn_ixa->ixa_tsl = crgetlabel(connp->conn_cred);
4645 
4646         *((sin6_t *)&udp->udp_delayed_addr) = sin6_null;
4647 
4648         if (us->us_pmtu_discovery)
4649                 connp->conn_ixa->ixa_flags |= IXAF_PMTU_DISCOVERY;
4650 
4651         return (connp);
4652 }
4653 
4654 sock_lower_handle_t
4655 udp_create(int family, int type, int proto, sock_downcalls_t **sock_downcalls,
4656     uint_t *smodep, int *errorp, int flags, cred_t *credp)
4657 {
4658         udp_t           *udp = NULL;
4659         udp_stack_t     *us;
4660         conn_t          *connp;
4661         boolean_t       isv6;
4662 
4663         if (type != SOCK_DGRAM || (family != AF_INET && family != AF_INET6) ||
4664             (proto != 0 && proto != IPPROTO_UDP)) {
4665                 *errorp = EPROTONOSUPPORT;
4666                 return (NULL);
4667         }
4668 
4669         if (family == AF_INET6)
4670                 isv6 = B_TRUE;
4671         else
4672                 isv6 = B_FALSE;
4673 
4674         connp = udp_do_open(credp, isv6, flags, errorp);
4675         if (connp == NULL)
4676                 return (NULL);
4677 
4678         udp = connp->conn_udp;
4679         ASSERT(udp != NULL);
4680         us = udp->udp_us;
4681         ASSERT(us != NULL);
4682 
4683         udp->udp_issocket = B_TRUE;
4684         connp->conn_flags |= IPCL_NONSTR;
4685 
4686         /*
4687          * Set flow control
4688          * Since this conn_t/udp_t is not yet visible to anybody else we don't
4689          * need to lock anything.
4690          */
4691         (void) udp_set_rcv_hiwat(udp, connp->conn_rcvbuf);
4692         udp->udp_rcv_disply_hiwat = connp->conn_rcvbuf;
4693 
4694         connp->conn_flow_cntrld = B_FALSE;
4695 
4696         mutex_enter(&connp->conn_lock);
4697         connp->conn_state_flags &= ~CONN_INCIPIENT;
4698         mutex_exit(&connp->conn_lock);
4699 
4700         *errorp = 0;
4701         *smodep = SM_ATOMIC;
4702         *sock_downcalls = &sock_udp_downcalls;
4703         return ((sock_lower_handle_t)connp);
4704 }
4705 
4706 /* ARGSUSED3 */
4707 void
4708 udp_activate(sock_lower_handle_t proto_handle, sock_upper_handle_t sock_handle,
4709     sock_upcalls_t *sock_upcalls, int flags, cred_t *cr)
4710 {
4711         conn_t          *connp = (conn_t *)proto_handle;
4712         struct sock_proto_props sopp;
4713 
4714         /* All Solaris components should pass a cred for this operation. */
4715         ASSERT(cr != NULL);
4716 
4717         connp->conn_upcalls = sock_upcalls;
4718         connp->conn_upper_handle = sock_handle;
4719 
4720         sopp.sopp_flags = SOCKOPT_WROFF | SOCKOPT_RCVHIWAT | SOCKOPT_RCVLOWAT |
4721             SOCKOPT_MAXBLK | SOCKOPT_MAXPSZ | SOCKOPT_MINPSZ;
4722         sopp.sopp_wroff = connp->conn_wroff;
4723         sopp.sopp_maxblk = INFPSZ;
4724         sopp.sopp_rxhiwat = connp->conn_rcvbuf;
4725         sopp.sopp_rxlowat = connp->conn_rcvlowat;
4726         sopp.sopp_maxaddrlen = sizeof (sin6_t);
4727         sopp.sopp_maxpsz =
4728             (connp->conn_family == AF_INET) ? UDP_MAXPACKET_IPV4 :
4729             UDP_MAXPACKET_IPV6;
4730         sopp.sopp_minpsz = (udp_mod_info.mi_minpsz == 1) ? 0 :
4731             udp_mod_info.mi_minpsz;
4732 
4733         (*connp->conn_upcalls->su_set_proto_props)(connp->conn_upper_handle,
4734             &sopp);
4735 }
4736 
4737 static void
4738 udp_do_close(conn_t *connp)
4739 {
4740         udp_t   *udp;
4741 
4742         ASSERT(connp != NULL && IPCL_IS_UDP(connp));
4743         udp = connp->conn_udp;
4744 
4745         if (cl_inet_unbind != NULL && udp->udp_state == TS_IDLE) {
4746                 /*
4747                  * Running in cluster mode - register unbind information
4748                  */
4749                 if (connp->conn_ipversion == IPV4_VERSION) {
4750                         (*cl_inet_unbind)(
4751                             connp->conn_netstack->netstack_stackid,
4752                             IPPROTO_UDP, AF_INET,
4753                             (uint8_t *)(&V4_PART_OF_V6(connp->conn_laddr_v6)),
4754                             (in_port_t)connp->conn_lport, NULL);
4755                 } else {
4756                         (*cl_inet_unbind)(
4757                             connp->conn_netstack->netstack_stackid,
4758                             IPPROTO_UDP, AF_INET6,
4759                             (uint8_t *)&(connp->conn_laddr_v6),
4760                             (in_port_t)connp->conn_lport, NULL);
4761                 }
4762         }
4763 
4764         udp_bind_hash_remove(udp, B_FALSE);
4765 
4766         ip_quiesce_conn(connp);
4767 
4768         if (!IPCL_IS_NONSTR(connp)) {
4769                 ASSERT(connp->conn_wq != NULL);
4770                 ASSERT(connp->conn_rq != NULL);
4771                 qprocsoff(connp->conn_rq);
4772         }
4773 
4774         udp_close_free(connp);
4775 
4776         /*
4777          * Now we are truly single threaded on this stream, and can
4778          * delete the things hanging off the connp, and finally the connp.
4779          * We removed this connp from the fanout list, it cannot be
4780          * accessed thru the fanouts, and we already waited for the
4781          * conn_ref to drop to 0. We are already in close, so
4782          * there cannot be any other thread from the top. qprocsoff
4783          * has completed, and service has completed or won't run in
4784          * future.
4785          */
4786         ASSERT(connp->conn_ref == 1);
4787 
4788         if (!IPCL_IS_NONSTR(connp)) {
4789                 inet_minor_free(connp->conn_minor_arena, connp->conn_dev);
4790         } else {
4791                 ip_free_helper_stream(connp);
4792         }
4793 
4794         connp->conn_ref--;
4795         ipcl_conn_destroy(connp);
4796 }
4797 
4798 /* ARGSUSED1 */
4799 int
4800 udp_close(sock_lower_handle_t proto_handle, int flags, cred_t *cr)
4801 {
4802         conn_t  *connp = (conn_t *)proto_handle;
4803 
4804         /* All Solaris components should pass a cred for this operation. */
4805         ASSERT(cr != NULL);
4806 
4807         udp_do_close(connp);
4808         return (0);
4809 }
4810 
4811 static int
4812 udp_do_bind(conn_t *connp, struct sockaddr *sa, socklen_t len, cred_t *cr,
4813     boolean_t bind_to_req_port_only)
4814 {
4815         sin_t           *sin;
4816         sin6_t          *sin6;
4817         udp_t           *udp = connp->conn_udp;
4818         int             error = 0;
4819         ip_laddr_t      laddr_type = IPVL_UNICAST_UP;   /* INADDR_ANY */
4820         in_port_t       port;           /* Host byte order */
4821         in_port_t       requested_port; /* Host byte order */
4822         int             count;
4823         ipaddr_t        v4src;          /* Set if AF_INET */
4824         in6_addr_t      v6src;
4825         int             loopmax;
4826         udp_fanout_t    *udpf;
4827         in_port_t       lport;          /* Network byte order */
4828         uint_t          scopeid = 0;
4829         zoneid_t        zoneid = IPCL_ZONEID(connp);
4830         ip_stack_t      *ipst = connp->conn_netstack->netstack_ip;
4831         boolean_t       is_inaddr_any;
4832         mlp_type_t      addrtype, mlptype;
4833         udp_stack_t     *us = udp->udp_us;
4834 
4835         switch (len) {
4836         case sizeof (sin_t):    /* Complete IPv4 address */
4837                 sin = (sin_t *)sa;
4838 
4839                 if (sin == NULL || !OK_32PTR((char *)sin))
4840                         return (EINVAL);
4841 
4842                 if (connp->conn_family != AF_INET ||
4843                     sin->sin_family != AF_INET) {
4844                         return (EAFNOSUPPORT);
4845                 }
4846                 v4src = sin->sin_addr.s_addr;
4847                 IN6_IPADDR_TO_V4MAPPED(v4src, &v6src);
4848                 if (v4src != INADDR_ANY) {
4849                         laddr_type = ip_laddr_verify_v4(v4src, zoneid, ipst,
4850                             B_TRUE);
4851                 }
4852                 port = ntohs(sin->sin_port);
4853                 break;
4854 
4855         case sizeof (sin6_t):   /* complete IPv6 address */
4856                 sin6 = (sin6_t *)sa;
4857 
4858                 if (sin6 == NULL || !OK_32PTR((char *)sin6))
4859                         return (EINVAL);
4860 
4861                 if (connp->conn_family != AF_INET6 ||
4862                     sin6->sin6_family != AF_INET6) {
4863                         return (EAFNOSUPPORT);
4864                 }
4865                 v6src = sin6->sin6_addr;
4866                 if (IN6_IS_ADDR_V4MAPPED(&v6src)) {
4867                         if (connp->conn_ipv6_v6only)
4868                                 return (EADDRNOTAVAIL);
4869 
4870                         IN6_V4MAPPED_TO_IPADDR(&v6src, v4src);
4871                         if (v4src != INADDR_ANY) {
4872                                 laddr_type = ip_laddr_verify_v4(v4src,
4873                                     zoneid, ipst, B_FALSE);
4874                         }
4875                 } else {
4876                         if (!IN6_IS_ADDR_UNSPECIFIED(&v6src)) {
4877                                 if (IN6_IS_ADDR_LINKSCOPE(&v6src))
4878                                         scopeid = sin6->sin6_scope_id;
4879                                 laddr_type = ip_laddr_verify_v6(&v6src,
4880                                     zoneid, ipst, B_TRUE, scopeid);
4881                         }
4882                 }
4883                 port = ntohs(sin6->sin6_port);
4884                 break;
4885 
4886         default:                /* Invalid request */
4887                 (void) strlog(UDP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE,
4888                     "udp_bind: bad ADDR_length length %u", len);
4889                 return (-TBADADDR);
4890         }
4891 
4892         /* Is the local address a valid unicast, multicast, or broadcast? */
4893         if (laddr_type == IPVL_BAD)
4894                 return (EADDRNOTAVAIL);
4895 
4896         requested_port = port;
4897 
4898         if (requested_port == 0 || !bind_to_req_port_only)
4899                 bind_to_req_port_only = B_FALSE;
4900         else            /* T_BIND_REQ and requested_port != 0 */
4901                 bind_to_req_port_only = B_TRUE;
4902 
4903         if (requested_port == 0) {
4904                 /*
4905                  * If the application passed in zero for the port number, it
4906                  * doesn't care which port number we bind to. Get one in the
4907                  * valid range.
4908                  */
4909                 if (connp->conn_anon_priv_bind) {
4910                         port = udp_get_next_priv_port(udp);
4911                 } else {
4912                         port = udp_update_next_port(udp,
4913                             us->us_next_port_to_try, B_TRUE);
4914                 }
4915         } else {
4916                 /*
4917                  * If the port is in the well-known privileged range,
4918                  * make sure the caller was privileged.
4919                  */
4920                 int i;
4921                 boolean_t priv = B_FALSE;
4922 
4923                 if (port < us->us_smallest_nonpriv_port) {
4924                         priv = B_TRUE;
4925                 } else {
4926                         for (i = 0; i < us->us_num_epriv_ports; i++) {
4927                                 if (port == us->us_epriv_ports[i]) {
4928                                         priv = B_TRUE;
4929                                         break;
4930                                 }
4931                         }
4932                 }
4933 
4934                 if (priv) {
4935                         if (secpolicy_net_privaddr(cr, port, IPPROTO_UDP) != 0)
4936                                 return (-TACCES);
4937                 }
4938         }
4939 
4940         if (port == 0)
4941                 return (-TNOADDR);
4942 
4943         /*
4944          * The state must be TS_UNBND. TPI mandates that users must send
4945          * TPI primitives only 1 at a time and wait for the response before
4946          * sending the next primitive.
4947          */
4948         mutex_enter(&connp->conn_lock);
4949         if (udp->udp_state != TS_UNBND) {
4950                 mutex_exit(&connp->conn_lock);
4951                 (void) strlog(UDP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE,
4952                     "udp_bind: bad state, %u", udp->udp_state);
4953                 return (-TOUTSTATE);
4954         }
4955         /*
4956          * Copy the source address into our udp structure. This address
4957          * may still be zero; if so, IP will fill in the correct address
4958          * each time an outbound packet is passed to it. Since the udp is
4959          * not yet in the bind hash list, we don't grab the uf_lock to
4960          * change conn_ipversion
4961          */
4962         if (connp->conn_family == AF_INET) {
4963                 ASSERT(sin != NULL);
4964                 ASSERT(connp->conn_ixa->ixa_flags & IXAF_IS_IPV4);
4965         } else {
4966                 if (IN6_IS_ADDR_V4MAPPED(&v6src)) {
4967                         /*
4968                          * no need to hold the uf_lock to set the conn_ipversion
4969                          * since we are not yet in the fanout list
4970                          */
4971                         connp->conn_ipversion = IPV4_VERSION;
4972                         connp->conn_ixa->ixa_flags |= IXAF_IS_IPV4;
4973                 } else {
4974                         connp->conn_ipversion = IPV6_VERSION;
4975                         connp->conn_ixa->ixa_flags &= ~IXAF_IS_IPV4;
4976                 }
4977         }
4978 
4979         /*
4980          * If conn_reuseaddr is not set, then we have to make sure that
4981          * the IP address and port number the application requested
4982          * (or we selected for the application) is not being used by
4983          * another stream.  If another stream is already using the
4984          * requested IP address and port, the behavior depends on
4985          * "bind_to_req_port_only". If set the bind fails; otherwise we
4986          * search for any an unused port to bind to the stream.
4987          *
4988          * As per the BSD semantics, as modified by the Deering multicast
4989          * changes, if udp_reuseaddr is set, then we allow multiple binds
4990          * to the same port independent of the local IP address.
4991          *
4992          * This is slightly different than in SunOS 4.X which did not
4993          * support IP multicast. Note that the change implemented by the
4994          * Deering multicast code effects all binds - not only binding
4995          * to IP multicast addresses.
4996          *
4997          * Note that when binding to port zero we ignore SO_REUSEADDR in
4998          * order to guarantee a unique port.
4999          */
5000 
5001         count = 0;
5002         if (connp->conn_anon_priv_bind) {
5003                 /*
5004                  * loopmax = (IPPORT_RESERVED-1) -
5005                  *    us->us_min_anonpriv_port + 1
5006                  */
5007                 loopmax = IPPORT_RESERVED - us->us_min_anonpriv_port;
5008         } else {
5009                 loopmax = us->us_largest_anon_port -
5010                     us->us_smallest_anon_port + 1;
5011         }
5012 
5013         is_inaddr_any = V6_OR_V4_INADDR_ANY(v6src);
5014 
5015         for (;;) {
5016                 udp_t           *udp1;
5017                 boolean_t       found_exclbind = B_FALSE;
5018                 conn_t          *connp1;
5019 
5020                 /*
5021                  * Walk through the list of udp streams bound to
5022                  * requested port with the same IP address.
5023                  */
5024                 lport = htons(port);
5025                 udpf = &us->us_bind_fanout[UDP_BIND_HASH(lport,
5026                     us->us_bind_fanout_size)];
5027                 mutex_enter(&udpf->uf_lock);
5028                 for (udp1 = udpf->uf_udp; udp1 != NULL;
5029                     udp1 = udp1->udp_bind_hash) {
5030                         connp1 = udp1->udp_connp;
5031 
5032                         if (lport != connp1->conn_lport)
5033                                 continue;
5034 
5035                         /*
5036                          * On a labeled system, we must treat bindings to ports
5037                          * on shared IP addresses by sockets with MAC exemption
5038                          * privilege as being in all zones, as there's
5039                          * otherwise no way to identify the right receiver.
5040                          */
5041                         if (!IPCL_BIND_ZONE_MATCH(connp1, connp))
5042                                 continue;
5043 
5044                         /*
5045                          * If UDP_EXCLBIND is set for either the bound or
5046                          * binding endpoint, the semantics of bind
5047                          * is changed according to the following chart.
5048                          *
5049                          * spec = specified address (v4 or v6)
5050                          * unspec = unspecified address (v4 or v6)
5051                          * A = specified addresses are different for endpoints
5052                          *
5053                          * bound        bind to         allowed?
5054                          * -------------------------------------
5055                          * unspec       unspec          no
5056                          * unspec       spec            no
5057                          * spec         unspec          no
5058                          * spec         spec            yes if A
5059                          *
5060                          * For labeled systems, SO_MAC_EXEMPT behaves the same
5061                          * as UDP_EXCLBIND, except that zoneid is ignored.
5062                          */
5063                         if (connp1->conn_exclbind || connp->conn_exclbind ||
5064                             IPCL_CONNS_MAC(udp1->udp_connp, connp)) {
5065                                 if (V6_OR_V4_INADDR_ANY(
5066                                     connp1->conn_bound_addr_v6) ||
5067                                     is_inaddr_any ||
5068                                     IN6_ARE_ADDR_EQUAL(
5069                                     &connp1->conn_bound_addr_v6,
5070                                     &v6src)) {
5071                                         found_exclbind = B_TRUE;
5072                                         break;
5073                                 }
5074                                 continue;
5075                         }
5076 
5077                         /*
5078                          * Check ipversion to allow IPv4 and IPv6 sockets to
5079                          * have disjoint port number spaces.
5080                          */
5081                         if (connp->conn_ipversion != connp1->conn_ipversion) {
5082 
5083                                 /*
5084                                  * On the first time through the loop, if the
5085                                  * the user intentionally specified a
5086                                  * particular port number, then ignore any
5087                                  * bindings of the other protocol that may
5088                                  * conflict. This allows the user to bind IPv6
5089                                  * alone and get both v4 and v6, or bind both
5090                                  * both and get each seperately. On subsequent
5091                                  * times through the loop, we're checking a
5092                                  * port that we chose (not the user) and thus
5093                                  * we do not allow casual duplicate bindings.
5094                                  */
5095                                 if (count == 0 && requested_port != 0)
5096                                         continue;
5097                         }
5098 
5099                         /*
5100                          * No difference depending on SO_REUSEADDR.
5101                          *
5102                          * If existing port is bound to a
5103                          * non-wildcard IP address and
5104                          * the requesting stream is bound to
5105                          * a distinct different IP addresses
5106                          * (non-wildcard, also), keep going.
5107                          */
5108                         if (!is_inaddr_any &&
5109                             !V6_OR_V4_INADDR_ANY(connp1->conn_bound_addr_v6) &&
5110                             !IN6_ARE_ADDR_EQUAL(&connp1->conn_laddr_v6,
5111                             &v6src)) {
5112                                 continue;
5113                         }
5114                         break;
5115                 }
5116 
5117                 if (!found_exclbind &&
5118                     (connp->conn_reuseaddr && requested_port != 0)) {
5119                         break;
5120                 }
5121 
5122                 if (udp1 == NULL) {
5123                         /*
5124                          * No other stream has this IP address
5125                          * and port number. We can use it.
5126                          */
5127                         break;
5128                 }
5129                 mutex_exit(&udpf->uf_lock);
5130                 if (bind_to_req_port_only) {
5131                         /*
5132                          * We get here only when requested port
5133                          * is bound (and only first  of the for()
5134                          * loop iteration).
5135                          *
5136                          * The semantics of this bind request
5137                          * require it to fail so we return from
5138                          * the routine (and exit the loop).
5139                          *
5140                          */
5141                         mutex_exit(&connp->conn_lock);
5142                         return (-TADDRBUSY);
5143                 }
5144 
5145                 if (connp->conn_anon_priv_bind) {
5146                         port = udp_get_next_priv_port(udp);
5147                 } else {
5148                         if ((count == 0) && (requested_port != 0)) {
5149                                 /*
5150                                  * If the application wants us to find
5151                                  * a port, get one to start with. Set
5152                                  * requested_port to 0, so that we will
5153                                  * update us->us_next_port_to_try below.
5154                                  */
5155                                 port = udp_update_next_port(udp,
5156                                     us->us_next_port_to_try, B_TRUE);
5157                                 requested_port = 0;
5158                         } else {
5159                                 port = udp_update_next_port(udp, port + 1,
5160                                     B_FALSE);
5161                         }
5162                 }
5163 
5164                 if (port == 0 || ++count >= loopmax) {
5165                         /*
5166                          * We've tried every possible port number and
5167                          * there are none available, so send an error
5168                          * to the user.
5169                          */
5170                         mutex_exit(&connp->conn_lock);
5171                         return (-TNOADDR);
5172                 }
5173         }
5174 
5175         /*
5176          * Copy the source address into our udp structure.  This address
5177          * may still be zero; if so, ip_attr_connect will fill in the correct
5178          * address when a packet is about to be sent.
5179          * If we are binding to a broadcast or multicast address then
5180          * we just set the conn_bound_addr since we don't want to use
5181          * that as the source address when sending.
5182          */
5183         connp->conn_bound_addr_v6 = v6src;
5184         connp->conn_laddr_v6 = v6src;
5185         if (scopeid != 0) {
5186                 connp->conn_ixa->ixa_flags |= IXAF_SCOPEID_SET;
5187                 connp->conn_ixa->ixa_scopeid = scopeid;
5188                 connp->conn_incoming_ifindex = scopeid;
5189         } else {
5190                 connp->conn_ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
5191                 connp->conn_incoming_ifindex = connp->conn_bound_if;
5192         }
5193 
5194         switch (laddr_type) {
5195         case IPVL_UNICAST_UP:
5196         case IPVL_UNICAST_DOWN:
5197                 connp->conn_saddr_v6 = v6src;
5198                 connp->conn_mcbc_bind = B_FALSE;
5199                 break;
5200         case IPVL_MCAST:
5201         case IPVL_BCAST:
5202                 /* ip_set_destination will pick a source address later */
5203                 connp->conn_saddr_v6 = ipv6_all_zeros;
5204                 connp->conn_mcbc_bind = B_TRUE;
5205                 break;
5206         }
5207 
5208         /* Any errors after this point should use late_error */
5209         connp->conn_lport = lport;
5210 
5211         /*
5212          * Now reset the next anonymous port if the application requested
5213          * an anonymous port, or we handed out the next anonymous port.
5214          */
5215         if ((requested_port == 0) && (!connp->conn_anon_priv_bind)) {
5216                 us->us_next_port_to_try = port + 1;
5217         }
5218 
5219         /* Initialize the T_BIND_ACK. */
5220         if (connp->conn_family == AF_INET) {
5221                 sin->sin_port = connp->conn_lport;
5222         } else {
5223                 sin6->sin6_port = connp->conn_lport;
5224         }
5225         udp->udp_state = TS_IDLE;
5226         udp_bind_hash_insert(udpf, udp);
5227         mutex_exit(&udpf->uf_lock);
5228         mutex_exit(&connp->conn_lock);
5229 
5230         if (cl_inet_bind) {
5231                 /*
5232                  * Running in cluster mode - register bind information
5233                  */
5234                 if (connp->conn_ipversion == IPV4_VERSION) {
5235                         (*cl_inet_bind)(connp->conn_netstack->netstack_stackid,
5236                             IPPROTO_UDP, AF_INET, (uint8_t *)&v4src,
5237                             (in_port_t)connp->conn_lport, NULL);
5238                 } else {
5239                         (*cl_inet_bind)(connp->conn_netstack->netstack_stackid,
5240                             IPPROTO_UDP, AF_INET6, (uint8_t *)&v6src,
5241                             (in_port_t)connp->conn_lport, NULL);
5242                 }
5243         }
5244 
5245         mutex_enter(&connp->conn_lock);
5246         connp->conn_anon_port = (is_system_labeled() && requested_port == 0);
5247         if (is_system_labeled() && (!connp->conn_anon_port ||
5248             connp->conn_anon_mlp)) {
5249                 uint16_t mlpport;
5250                 zone_t *zone;
5251 
5252                 zone = crgetzone(cr);
5253                 connp->conn_mlp_type =
5254                     connp->conn_recv_ancillary.crb_recvucred ? mlptBoth :
5255                     mlptSingle;
5256                 addrtype = tsol_mlp_addr_type(
5257                     connp->conn_allzones ? ALL_ZONES : zone->zone_id,
5258                     IPV6_VERSION, &v6src, us->us_netstack->netstack_ip);
5259                 if (addrtype == mlptSingle) {
5260                         error = -TNOADDR;
5261                         mutex_exit(&connp->conn_lock);
5262                         goto late_error;
5263                 }
5264                 mlpport = connp->conn_anon_port ? PMAPPORT : port;
5265                 mlptype = tsol_mlp_port_type(zone, IPPROTO_UDP, mlpport,
5266                     addrtype);
5267 
5268                 /*
5269                  * It is a coding error to attempt to bind an MLP port
5270                  * without first setting SOL_SOCKET/SCM_UCRED.
5271                  */
5272                 if (mlptype != mlptSingle &&
5273                     connp->conn_mlp_type == mlptSingle) {
5274                         error = EINVAL;
5275                         mutex_exit(&connp->conn_lock);
5276                         goto late_error;
5277                 }
5278 
5279                 /*
5280                  * It is an access violation to attempt to bind an MLP port
5281                  * without NET_BINDMLP privilege.
5282                  */
5283                 if (mlptype != mlptSingle &&
5284                     secpolicy_net_bindmlp(cr) != 0) {
5285                         if (connp->conn_debug) {
5286                                 (void) strlog(UDP_MOD_ID, 0, 1,
5287                                     SL_ERROR|SL_TRACE,
5288                                     "udp_bind: no priv for multilevel port %d",
5289                                     mlpport);
5290                         }
5291                         error = -TACCES;
5292                         mutex_exit(&connp->conn_lock);
5293                         goto late_error;
5294                 }
5295 
5296                 /*
5297                  * If we're specifically binding a shared IP address and the
5298                  * port is MLP on shared addresses, then check to see if this
5299                  * zone actually owns the MLP.  Reject if not.
5300                  */
5301                 if (mlptype == mlptShared && addrtype == mlptShared) {
5302                         /*
5303                          * No need to handle exclusive-stack zones since
5304                          * ALL_ZONES only applies to the shared stack.
5305                          */
5306                         zoneid_t mlpzone;
5307 
5308                         mlpzone = tsol_mlp_findzone(IPPROTO_UDP,
5309                             htons(mlpport));
5310                         if (connp->conn_zoneid != mlpzone) {
5311                                 if (connp->conn_debug) {
5312                                         (void) strlog(UDP_MOD_ID, 0, 1,
5313                                             SL_ERROR|SL_TRACE,
5314                                             "udp_bind: attempt to bind port "
5315                                             "%d on shared addr in zone %d "
5316                                             "(should be %d)",
5317                                             mlpport, connp->conn_zoneid,
5318                                             mlpzone);
5319                                 }
5320                                 error = -TACCES;
5321                                 mutex_exit(&connp->conn_lock);
5322                                 goto late_error;
5323                         }
5324                 }
5325                 if (connp->conn_anon_port) {
5326                         error = tsol_mlp_anon(zone, mlptype, connp->conn_proto,
5327                             port, B_TRUE);
5328                         if (error != 0) {
5329                                 if (connp->conn_debug) {
5330                                         (void) strlog(UDP_MOD_ID, 0, 1,
5331                                             SL_ERROR|SL_TRACE,
5332                                             "udp_bind: cannot establish anon "
5333                                             "MLP for port %d", port);
5334                                 }
5335                                 error = -TACCES;
5336                                 mutex_exit(&connp->conn_lock);
5337                                 goto late_error;
5338                         }
5339                 }
5340                 connp->conn_mlp_type = mlptype;
5341         }
5342 
5343         /*
5344          * We create an initial header template here to make a subsequent
5345          * sendto have a starting point. Since conn_last_dst is zero the
5346          * first sendto will always follow the 'dst changed' code path.
5347          * Note that we defer massaging options and the related checksum
5348          * adjustment until we have a destination address.
5349          */
5350         error = udp_build_hdr_template(connp, &connp->conn_saddr_v6,
5351             &connp->conn_faddr_v6, connp->conn_fport, connp->conn_flowinfo);
5352         if (error != 0) {
5353                 mutex_exit(&connp->conn_lock);
5354                 goto late_error;
5355         }
5356         /* Just in case */
5357         connp->conn_faddr_v6 = ipv6_all_zeros;
5358         connp->conn_fport = 0;
5359         connp->conn_v6lastdst = ipv6_all_zeros;
5360         mutex_exit(&connp->conn_lock);
5361 
5362         error = ip_laddr_fanout_insert(connp);
5363         if (error != 0)
5364                 goto late_error;
5365 
5366         /* Bind succeeded */
5367         return (0);
5368 
5369 late_error:
5370         /* We had already picked the port number, and then the bind failed */
5371         mutex_enter(&connp->conn_lock);
5372         udpf = &us->us_bind_fanout[
5373             UDP_BIND_HASH(connp->conn_lport,
5374             us->us_bind_fanout_size)];
5375         mutex_enter(&udpf->uf_lock);
5376         connp->conn_saddr_v6 = ipv6_all_zeros;
5377         connp->conn_bound_addr_v6 = ipv6_all_zeros;
5378         connp->conn_laddr_v6 = ipv6_all_zeros;
5379         if (scopeid != 0) {
5380                 connp->conn_ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
5381                 connp->conn_incoming_ifindex = connp->conn_bound_if;
5382         }
5383         udp->udp_state = TS_UNBND;
5384         udp_bind_hash_remove(udp, B_TRUE);
5385         connp->conn_lport = 0;
5386         mutex_exit(&udpf->uf_lock);
5387         connp->conn_anon_port = B_FALSE;
5388         connp->conn_mlp_type = mlptSingle;
5389 
5390         connp->conn_v6lastdst = ipv6_all_zeros;
5391 
5392         /* Restore the header that was built above - different source address */
5393         (void) udp_build_hdr_template(connp, &connp->conn_saddr_v6,
5394             &connp->conn_faddr_v6, connp->conn_fport, connp->conn_flowinfo);
5395         mutex_exit(&connp->conn_lock);
5396         return (error);
5397 }
5398 
5399 int
5400 udp_bind(sock_lower_handle_t proto_handle, struct sockaddr *sa,
5401     socklen_t len, cred_t *cr)
5402 {
5403         int             error;
5404         conn_t          *connp;
5405 
5406         /* All Solaris components should pass a cred for this operation. */
5407         ASSERT(cr != NULL);
5408 
5409         connp = (conn_t *)proto_handle;
5410 
5411         if (sa == NULL)
5412                 error = udp_do_unbind(connp);
5413         else
5414                 error = udp_do_bind(connp, sa, len, cr, B_TRUE);
5415 
5416         if (error < 0) {
5417                 if (error == -TOUTSTATE)
5418                         error = EINVAL;
5419                 else
5420                         error = proto_tlitosyserr(-error);
5421         }
5422 
5423         return (error);
5424 }
5425 
5426 static int
5427 udp_implicit_bind(conn_t *connp, cred_t *cr)
5428 {
5429         sin6_t sin6addr;
5430         sin_t *sin;
5431         sin6_t *sin6;
5432         socklen_t len;
5433         int error;
5434 
5435         /* All Solaris components should pass a cred for this operation. */
5436         ASSERT(cr != NULL);
5437 
5438         if (connp->conn_family == AF_INET) {
5439                 len = sizeof (struct sockaddr_in);
5440                 sin = (sin_t *)&sin6addr;
5441                 *sin = sin_null;
5442                 sin->sin_family = AF_INET;
5443                 sin->sin_addr.s_addr = INADDR_ANY;
5444         } else {
5445                 ASSERT(connp->conn_family == AF_INET6);
5446                 len = sizeof (sin6_t);
5447                 sin6 = (sin6_t *)&sin6addr;
5448                 *sin6 = sin6_null;
5449                 sin6->sin6_family = AF_INET6;
5450                 V6_SET_ZERO(sin6->sin6_addr);
5451         }
5452 
5453         error = udp_do_bind(connp, (struct sockaddr *)&sin6addr, len,
5454             cr, B_FALSE);
5455         return ((error < 0) ? proto_tlitosyserr(-error) : error);
5456 }
5457 
5458 /*
5459  * This routine removes a port number association from a stream. It
5460  * is called by udp_unbind and udp_tpi_unbind.
5461  */
5462 static int
5463 udp_do_unbind(conn_t *connp)
5464 {
5465         udp_t           *udp = connp->conn_udp;
5466         udp_fanout_t    *udpf;
5467         udp_stack_t     *us = udp->udp_us;
5468 
5469         if (cl_inet_unbind != NULL) {
5470                 /*
5471                  * Running in cluster mode - register unbind information
5472                  */
5473                 if (connp->conn_ipversion == IPV4_VERSION) {
5474                         (*cl_inet_unbind)(
5475                             connp->conn_netstack->netstack_stackid,
5476                             IPPROTO_UDP, AF_INET,
5477                             (uint8_t *)(&V4_PART_OF_V6(connp->conn_laddr_v6)),
5478                             (in_port_t)connp->conn_lport, NULL);
5479                 } else {
5480                         (*cl_inet_unbind)(
5481                             connp->conn_netstack->netstack_stackid,
5482                             IPPROTO_UDP, AF_INET6,
5483                             (uint8_t *)&(connp->conn_laddr_v6),
5484                             (in_port_t)connp->conn_lport, NULL);
5485                 }
5486         }
5487 
5488         mutex_enter(&connp->conn_lock);
5489         /* If a bind has not been done, we can't unbind. */
5490         if (udp->udp_state == TS_UNBND) {
5491                 mutex_exit(&connp->conn_lock);
5492                 return (-TOUTSTATE);
5493         }
5494         udpf = &us->us_bind_fanout[UDP_BIND_HASH(connp->conn_lport,
5495             us->us_bind_fanout_size)];
5496         mutex_enter(&udpf->uf_lock);
5497         udp_bind_hash_remove(udp, B_TRUE);
5498         connp->conn_saddr_v6 = ipv6_all_zeros;
5499         connp->conn_bound_addr_v6 = ipv6_all_zeros;
5500         connp->conn_laddr_v6 = ipv6_all_zeros;
5501         connp->conn_mcbc_bind = B_FALSE;
5502         connp->conn_lport = 0;
5503         /* In case we were also connected */
5504         connp->conn_faddr_v6 = ipv6_all_zeros;
5505         connp->conn_fport = 0;
5506         mutex_exit(&udpf->uf_lock);
5507 
5508         connp->conn_v6lastdst = ipv6_all_zeros;
5509         udp->udp_state = TS_UNBND;
5510 
5511         (void) udp_build_hdr_template(connp, &connp->conn_saddr_v6,
5512             &connp->conn_faddr_v6, connp->conn_fport, connp->conn_flowinfo);
5513         mutex_exit(&connp->conn_lock);
5514 
5515         ip_unbind(connp);
5516 
5517         return (0);
5518 }
5519 
5520 /*
5521  * It associates a default destination address with the stream.
5522  */
5523 static int
5524 udp_do_connect(conn_t *connp, const struct sockaddr *sa, socklen_t len,
5525     cred_t *cr, pid_t pid)
5526 {
5527         sin6_t          *sin6;
5528         sin_t           *sin;
5529         in6_addr_t      v6dst;
5530         ipaddr_t        v4dst;
5531         uint16_t        dstport;
5532         uint32_t        flowinfo;
5533         udp_fanout_t    *udpf;
5534         udp_t           *udp, *udp1;
5535         ushort_t        ipversion;
5536         udp_stack_t     *us;
5537         int             error;
5538         conn_t          *connp1;
5539         ip_xmit_attr_t  *ixa;
5540         ip_xmit_attr_t  *oldixa;
5541         uint_t          scopeid = 0;
5542         uint_t          srcid = 0;
5543         in6_addr_t      v6src = connp->conn_saddr_v6;
5544         boolean_t       v4mapped;
5545 
5546         udp = connp->conn_udp;
5547         us = udp->udp_us;
5548 
5549         /*
5550          * Address has been verified by the caller
5551          */
5552         switch (len) {
5553         default:
5554                 /*
5555                  * Should never happen
5556                  */
5557                 return (EINVAL);
5558 
5559         case sizeof (sin_t):
5560                 sin = (sin_t *)sa;
5561                 v4dst = sin->sin_addr.s_addr;
5562                 dstport = sin->sin_port;
5563                 IN6_IPADDR_TO_V4MAPPED(v4dst, &v6dst);
5564                 ASSERT(connp->conn_ipversion == IPV4_VERSION);
5565                 ipversion = IPV4_VERSION;
5566                 break;
5567 
5568         case sizeof (sin6_t):
5569                 sin6 = (sin6_t *)sa;
5570                 v6dst = sin6->sin6_addr;
5571                 dstport = sin6->sin6_port;
5572                 srcid = sin6->__sin6_src_id;
5573                 v4mapped = IN6_IS_ADDR_V4MAPPED(&v6dst);
5574                 if (srcid != 0 && IN6_IS_ADDR_UNSPECIFIED(&v6src)) {
5575                         if (!ip_srcid_find_id(srcid, &v6src, IPCL_ZONEID(connp),
5576                             v4mapped, connp->conn_netstack)) {
5577                                 /* Mismatch v4mapped/v6 specified by srcid. */
5578                                 return (EADDRNOTAVAIL);
5579                         }
5580                 }
5581                 if (v4mapped) {
5582                         if (connp->conn_ipv6_v6only)
5583                                 return (EADDRNOTAVAIL);
5584 
5585                         /*
5586                          * Destination adress is mapped IPv6 address.
5587                          * Source bound address should be unspecified or
5588                          * IPv6 mapped address as well.
5589                          */
5590                         if (!IN6_IS_ADDR_UNSPECIFIED(
5591                             &connp->conn_bound_addr_v6) &&
5592                             !IN6_IS_ADDR_V4MAPPED(&connp->conn_bound_addr_v6)) {
5593                                 return (EADDRNOTAVAIL);
5594                         }
5595                         IN6_V4MAPPED_TO_IPADDR(&v6dst, v4dst);
5596                         ipversion = IPV4_VERSION;
5597                         flowinfo = 0;
5598                 } else {
5599                         ipversion = IPV6_VERSION;
5600                         flowinfo = sin6->sin6_flowinfo;
5601                         if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
5602                                 scopeid = sin6->sin6_scope_id;
5603                 }
5604                 break;
5605         }
5606 
5607         if (dstport == 0)
5608                 return (-TBADADDR);
5609 
5610         /*
5611          * If there is a different thread using conn_ixa then we get a new
5612          * copy and cut the old one loose from conn_ixa. Otherwise we use
5613          * conn_ixa and prevent any other thread from using/changing it.
5614          * Once connect() is done other threads can use conn_ixa since the
5615          * refcnt will be back at one.
5616          * We defer updating conn_ixa until later to handle any concurrent
5617          * conn_ixa_cleanup thread.
5618          */
5619         ixa = conn_get_ixa(connp, B_FALSE);
5620         if (ixa == NULL)
5621                 return (ENOMEM);
5622 
5623         mutex_enter(&connp->conn_lock);
5624         /*
5625          * This udp_t must have bound to a port already before doing a connect.
5626          * Reject if a connect is in progress (we drop conn_lock during
5627          * udp_do_connect).
5628          */
5629         if (udp->udp_state == TS_UNBND || udp->udp_state == TS_WCON_CREQ) {
5630                 mutex_exit(&connp->conn_lock);
5631                 (void) strlog(UDP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE,
5632                     "udp_connect: bad state, %u", udp->udp_state);
5633                 ixa_refrele(ixa);
5634                 return (-TOUTSTATE);
5635         }
5636         ASSERT(connp->conn_lport != 0 && udp->udp_ptpbhn != NULL);
5637 
5638         udpf = &us->us_bind_fanout[UDP_BIND_HASH(connp->conn_lport,
5639             us->us_bind_fanout_size)];
5640 
5641         mutex_enter(&udpf->uf_lock);
5642         if (udp->udp_state == TS_DATA_XFER) {
5643                 /* Already connected - clear out state */
5644                 if (connp->conn_mcbc_bind)
5645                         connp->conn_saddr_v6 = ipv6_all_zeros;
5646                 else
5647                         connp->conn_saddr_v6 = connp->conn_bound_addr_v6;
5648                 connp->conn_laddr_v6 = connp->conn_bound_addr_v6;
5649                 connp->conn_faddr_v6 = ipv6_all_zeros;
5650                 connp->conn_fport = 0;
5651                 udp->udp_state = TS_IDLE;
5652         }
5653 
5654         connp->conn_fport = dstport;
5655         connp->conn_ipversion = ipversion;
5656         if (ipversion == IPV4_VERSION) {
5657                 /*
5658                  * Interpret a zero destination to mean loopback.
5659                  * Update the T_CONN_REQ (sin/sin6) since it is used to
5660                  * generate the T_CONN_CON.
5661                  */
5662                 if (v4dst == INADDR_ANY) {
5663                         v4dst = htonl(INADDR_LOOPBACK);
5664                         IN6_IPADDR_TO_V4MAPPED(v4dst, &v6dst);
5665                         if (connp->conn_family == AF_INET) {
5666                                 sin->sin_addr.s_addr = v4dst;
5667                         } else {
5668                                 sin6->sin6_addr = v6dst;
5669                         }
5670                 }
5671                 connp->conn_faddr_v6 = v6dst;
5672                 connp->conn_flowinfo = 0;
5673         } else {
5674                 ASSERT(connp->conn_ipversion == IPV6_VERSION);
5675                 /*
5676                  * Interpret a zero destination to mean loopback.
5677                  * Update the T_CONN_REQ (sin/sin6) since it is used to
5678                  * generate the T_CONN_CON.
5679                  */
5680                 if (IN6_IS_ADDR_UNSPECIFIED(&v6dst)) {
5681                         v6dst = ipv6_loopback;
5682                         sin6->sin6_addr = v6dst;
5683                 }
5684                 connp->conn_faddr_v6 = v6dst;
5685                 connp->conn_flowinfo = flowinfo;
5686         }
5687         mutex_exit(&udpf->uf_lock);
5688 
5689         /*
5690          * We update our cred/cpid based on the caller of connect
5691          */
5692         if (connp->conn_cred != cr) {
5693                 crhold(cr);
5694                 crfree(connp->conn_cred);
5695                 connp->conn_cred = cr;
5696         }
5697         connp->conn_cpid = pid;
5698         ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
5699         ixa->ixa_cred = cr;
5700         ixa->ixa_cpid = pid;
5701         if (is_system_labeled()) {
5702                 /* We need to restart with a label based on the cred */
5703                 ip_xmit_attr_restore_tsl(ixa, ixa->ixa_cred);
5704         }
5705 
5706         if (scopeid != 0) {
5707                 ixa->ixa_flags |= IXAF_SCOPEID_SET;
5708                 ixa->ixa_scopeid = scopeid;
5709                 connp->conn_incoming_ifindex = scopeid;
5710         } else {
5711                 ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
5712                 connp->conn_incoming_ifindex = connp->conn_bound_if;
5713         }
5714         /*
5715          * conn_connect will drop conn_lock and reacquire it.
5716          * To prevent a send* from messing with this udp_t while the lock
5717          * is dropped we set udp_state and clear conn_v6lastdst.
5718          * That will make all send* fail with EISCONN.
5719          */
5720         connp->conn_v6lastdst = ipv6_all_zeros;
5721         udp->udp_state = TS_WCON_CREQ;
5722 
5723         error = conn_connect(connp, NULL, IPDF_ALLOW_MCBC);
5724         mutex_exit(&connp->conn_lock);
5725         if (error != 0)
5726                 goto connect_failed;
5727 
5728         /*
5729          * The addresses have been verified. Time to insert in
5730          * the correct fanout list.
5731          */
5732         error = ipcl_conn_insert(connp);
5733         if (error != 0)
5734                 goto connect_failed;
5735 
5736         mutex_enter(&connp->conn_lock);
5737         error = udp_build_hdr_template(connp, &connp->conn_saddr_v6,
5738             &connp->conn_faddr_v6, connp->conn_fport, connp->conn_flowinfo);
5739         if (error != 0) {
5740                 mutex_exit(&connp->conn_lock);
5741                 goto connect_failed;
5742         }
5743 
5744         udp->udp_state = TS_DATA_XFER;
5745         /* Record this as the "last" send even though we haven't sent any */
5746         connp->conn_v6lastdst = connp->conn_faddr_v6;
5747         connp->conn_lastipversion = connp->conn_ipversion;
5748         connp->conn_lastdstport = connp->conn_fport;
5749         connp->conn_lastflowinfo = connp->conn_flowinfo;
5750         connp->conn_lastscopeid = scopeid;
5751         connp->conn_lastsrcid = srcid;
5752         /* Also remember a source to use together with lastdst */
5753         connp->conn_v6lastsrc = v6src;
5754 
5755         oldixa = conn_replace_ixa(connp, ixa);
5756         mutex_exit(&connp->conn_lock);
5757         ixa_refrele(oldixa);
5758 
5759         /*
5760          * We've picked a source address above. Now we can
5761          * verify that the src/port/dst/port is unique for all
5762          * connections in TS_DATA_XFER, skipping ourselves.
5763          */
5764         mutex_enter(&udpf->uf_lock);
5765         for (udp1 = udpf->uf_udp; udp1 != NULL; udp1 = udp1->udp_bind_hash) {
5766                 if (udp1->udp_state != TS_DATA_XFER)
5767                         continue;
5768 
5769                 if (udp1 == udp)
5770                         continue;
5771 
5772                 connp1 = udp1->udp_connp;
5773                 if (connp->conn_lport != connp1->conn_lport ||
5774                     connp->conn_ipversion != connp1->conn_ipversion ||
5775                     dstport != connp1->conn_fport ||
5776                     !IN6_ARE_ADDR_EQUAL(&connp->conn_laddr_v6,
5777                     &connp1->conn_laddr_v6) ||
5778                     !IN6_ARE_ADDR_EQUAL(&v6dst, &connp1->conn_faddr_v6) ||
5779                     !(IPCL_ZONE_MATCH(connp, connp1->conn_zoneid) ||
5780                     IPCL_ZONE_MATCH(connp1, connp->conn_zoneid)))
5781                         continue;
5782                 mutex_exit(&udpf->uf_lock);
5783                 error = -TBADADDR;
5784                 goto connect_failed;
5785         }
5786         if (cl_inet_connect2 != NULL) {
5787                 CL_INET_UDP_CONNECT(connp, B_TRUE, &v6dst, dstport, error);
5788                 if (error != 0) {
5789                         mutex_exit(&udpf->uf_lock);
5790                         error = -TBADADDR;
5791                         goto connect_failed;
5792                 }
5793         }
5794         mutex_exit(&udpf->uf_lock);
5795 
5796         ixa_refrele(ixa);
5797         return (0);
5798 
5799 connect_failed:
5800         if (ixa != NULL)
5801                 ixa_refrele(ixa);
5802         mutex_enter(&connp->conn_lock);
5803         mutex_enter(&udpf->uf_lock);
5804         udp->udp_state = TS_IDLE;
5805         connp->conn_faddr_v6 = ipv6_all_zeros;
5806         connp->conn_fport = 0;
5807         /* In case the source address was set above */
5808         if (connp->conn_mcbc_bind)
5809                 connp->conn_saddr_v6 = ipv6_all_zeros;
5810         else
5811                 connp->conn_saddr_v6 = connp->conn_bound_addr_v6;
5812         connp->conn_laddr_v6 = connp->conn_bound_addr_v6;
5813         mutex_exit(&udpf->uf_lock);
5814 
5815         connp->conn_v6lastdst = ipv6_all_zeros;
5816         connp->conn_flowinfo = 0;
5817 
5818         (void) udp_build_hdr_template(connp, &connp->conn_saddr_v6,
5819             &connp->conn_faddr_v6, connp->conn_fport, connp->conn_flowinfo);
5820         mutex_exit(&connp->conn_lock);
5821         return (error);
5822 }
5823 
5824 static int
5825 udp_connect(sock_lower_handle_t proto_handle, const struct sockaddr *sa,
5826     socklen_t len, sock_connid_t *id, cred_t *cr)
5827 {
5828         conn_t  *connp = (conn_t *)proto_handle;
5829         udp_t   *udp = connp->conn_udp;
5830         int     error;
5831         boolean_t did_bind = B_FALSE;
5832         pid_t   pid = curproc->p_pid;
5833 
5834         /* All Solaris components should pass a cred for this operation. */
5835         ASSERT(cr != NULL);
5836 
5837         if (sa == NULL) {
5838                 /*
5839                  * Disconnect
5840                  * Make sure we are connected
5841                  */
5842                 if (udp->udp_state != TS_DATA_XFER)
5843                         return (EINVAL);
5844 
5845                 error = udp_disconnect(connp);
5846                 return (error);
5847         }
5848 
5849         error = proto_verify_ip_addr(connp->conn_family, sa, len);
5850         if (error != 0)
5851                 goto done;
5852 
5853         /* do an implicit bind if necessary */
5854         if (udp->udp_state == TS_UNBND) {
5855                 error = udp_implicit_bind(connp, cr);
5856                 /*
5857                  * We could be racing with an actual bind, in which case
5858                  * we would see EPROTO. We cross our fingers and try
5859                  * to connect.
5860                  */
5861                 if (!(error == 0 || error == EPROTO))
5862                         goto done;
5863                 did_bind = B_TRUE;
5864         }
5865         /*
5866          * set SO_DGRAM_ERRIND
5867          */
5868         connp->conn_dgram_errind = B_TRUE;
5869 
5870         error = udp_do_connect(connp, sa, len, cr, pid);
5871 
5872         if (error != 0 && did_bind) {
5873                 int unbind_err;
5874 
5875                 unbind_err = udp_do_unbind(connp);
5876                 ASSERT(unbind_err == 0);
5877         }
5878 
5879         if (error == 0) {
5880                 *id = 0;
5881                 (*connp->conn_upcalls->su_connected)
5882                     (connp->conn_upper_handle, 0, NULL, -1);
5883         } else if (error < 0) {
5884                 error = proto_tlitosyserr(-error);
5885         }
5886 
5887 done:
5888         if (error != 0 && udp->udp_state == TS_DATA_XFER) {
5889                 /*
5890                  * No need to hold locks to set state
5891                  * after connect failure socket state is undefined
5892                  * We set the state only to imitate old sockfs behavior
5893                  */
5894                 udp->udp_state = TS_IDLE;
5895         }
5896         return (error);
5897 }
5898 
5899 int
5900 udp_send(sock_lower_handle_t proto_handle, mblk_t *mp, struct nmsghdr *msg,
5901     cred_t *cr)
5902 {
5903         sin6_t          *sin6;
5904         sin_t           *sin = NULL;
5905         uint_t          srcid;
5906         conn_t          *connp = (conn_t *)proto_handle;
5907         udp_t           *udp = connp->conn_udp;
5908         int             error = 0;
5909         udp_stack_t     *us = udp->udp_us;
5910         ushort_t        ipversion;
5911         pid_t           pid = curproc->p_pid;
5912         ip_xmit_attr_t  *ixa;
5913 
5914         ASSERT(DB_TYPE(mp) == M_DATA);
5915 
5916         /* All Solaris components should pass a cred for this operation. */
5917         ASSERT(cr != NULL);
5918 
5919         /* do an implicit bind if necessary */
5920         if (udp->udp_state == TS_UNBND) {
5921                 error = udp_implicit_bind(connp, cr);
5922                 /*
5923                  * We could be racing with an actual bind, in which case
5924                  * we would see EPROTO. We cross our fingers and try
5925                  * to connect.
5926                  */
5927                 if (!(error == 0 || error == EPROTO)) {
5928                         freemsg(mp);
5929                         return (error);
5930                 }
5931         }
5932 
5933         /* Connected? */
5934         if (msg->msg_name == NULL) {
5935                 if (udp->udp_state != TS_DATA_XFER) {
5936                         UDPS_BUMP_MIB(us, udpOutErrors);
5937                         return (EDESTADDRREQ);
5938                 }
5939                 if (msg->msg_controllen != 0) {
5940                         error = udp_output_ancillary(connp, NULL, NULL, mp,
5941                             NULL, msg, cr, pid);
5942                 } else {
5943                         error = udp_output_connected(connp, mp, cr, pid);
5944                 }
5945                 if (us->us_sendto_ignerr)
5946                         return (0);
5947                 else
5948                         return (error);
5949         }
5950         if (udp->udp_state == TS_DATA_XFER) {
5951                 UDPS_BUMP_MIB(us, udpOutErrors);
5952                 return (EISCONN);
5953         }
5954         error = proto_verify_ip_addr(connp->conn_family,
5955             (struct sockaddr *)msg->msg_name, msg->msg_namelen);
5956         if (error != 0) {
5957                 UDPS_BUMP_MIB(us, udpOutErrors);
5958                 return (error);
5959         }
5960         switch (connp->conn_family) {
5961         case AF_INET6:
5962                 sin6 = (sin6_t *)msg->msg_name;
5963 
5964                 srcid = sin6->__sin6_src_id;
5965 
5966                 if (!IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
5967                         /*
5968                          * Destination is a non-IPv4-compatible IPv6 address.
5969                          * Send out an IPv6 format packet.
5970                          */
5971 
5972                         /*
5973                          * If the local address is a mapped address return
5974                          * an error.
5975                          * It would be possible to send an IPv6 packet but the
5976                          * response would never make it back to the application
5977                          * since it is bound to a mapped address.
5978                          */
5979                         if (IN6_IS_ADDR_V4MAPPED(&connp->conn_saddr_v6)) {
5980                                 UDPS_BUMP_MIB(us, udpOutErrors);
5981                                 return (EADDRNOTAVAIL);
5982                         }
5983                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
5984                                 sin6->sin6_addr = ipv6_loopback;
5985                         ipversion = IPV6_VERSION;
5986                 } else {
5987                         if (connp->conn_ipv6_v6only) {
5988                                 UDPS_BUMP_MIB(us, udpOutErrors);
5989                                 return (EADDRNOTAVAIL);
5990                         }
5991 
5992                         /*
5993                          * If the local address is not zero or a mapped address
5994                          * return an error.  It would be possible to send an
5995                          * IPv4 packet but the response would never make it
5996                          * back to the application since it is bound to a
5997                          * non-mapped address.
5998                          */
5999                         if (!IN6_IS_ADDR_V4MAPPED(&connp->conn_saddr_v6) &&
6000                             !IN6_IS_ADDR_UNSPECIFIED(&connp->conn_saddr_v6)) {
6001                                 UDPS_BUMP_MIB(us, udpOutErrors);
6002                                 return (EADDRNOTAVAIL);
6003                         }
6004 
6005                         if (V4_PART_OF_V6(sin6->sin6_addr) == INADDR_ANY) {
6006                                 V4_PART_OF_V6(sin6->sin6_addr) =
6007                                     htonl(INADDR_LOOPBACK);
6008                         }
6009                         ipversion = IPV4_VERSION;
6010                 }
6011 
6012                 /*
6013                  * We have to allocate an ip_xmit_attr_t before we grab
6014                  * conn_lock and we need to hold conn_lock once we've check
6015                  * conn_same_as_last_v6 to handle concurrent send* calls on a
6016                  * socket.
6017                  */
6018                 if (msg->msg_controllen == 0) {
6019                         ixa = conn_get_ixa(connp, B_FALSE);
6020                         if (ixa == NULL) {
6021                                 UDPS_BUMP_MIB(us, udpOutErrors);
6022                                 return (ENOMEM);
6023                         }
6024                 } else {
6025                         ixa = NULL;
6026                 }
6027                 mutex_enter(&connp->conn_lock);
6028                 if (udp->udp_delayed_error != 0) {
6029                         sin6_t  *sin2 = (sin6_t *)&udp->udp_delayed_addr;
6030 
6031                         error = udp->udp_delayed_error;
6032                         udp->udp_delayed_error = 0;
6033 
6034                         /* Compare IP address, port, and family */
6035 
6036                         if (sin6->sin6_port == sin2->sin6_port &&
6037                             IN6_ARE_ADDR_EQUAL(&sin6->sin6_addr,
6038                             &sin2->sin6_addr) &&
6039                             sin6->sin6_family == sin2->sin6_family) {
6040                                 mutex_exit(&connp->conn_lock);
6041                                 UDPS_BUMP_MIB(us, udpOutErrors);
6042                                 if (ixa != NULL)
6043                                         ixa_refrele(ixa);
6044                                 return (error);
6045                         }
6046                 }
6047 
6048                 if (msg->msg_controllen != 0) {
6049                         mutex_exit(&connp->conn_lock);
6050                         ASSERT(ixa == NULL);
6051                         error = udp_output_ancillary(connp, NULL, sin6, mp,
6052                             NULL, msg, cr, pid);
6053                 } else if (conn_same_as_last_v6(connp, sin6) &&
6054                     connp->conn_lastsrcid == srcid &&
6055                     ipsec_outbound_policy_current(ixa)) {
6056                         /* udp_output_lastdst drops conn_lock */
6057                         error = udp_output_lastdst(connp, mp, cr, pid, ixa);
6058                 } else {
6059                         /* udp_output_newdst drops conn_lock */
6060                         error = udp_output_newdst(connp, mp, NULL, sin6,
6061                             ipversion, cr, pid, ixa);
6062                 }
6063                 ASSERT(MUTEX_NOT_HELD(&connp->conn_lock));
6064                 if (us->us_sendto_ignerr)
6065                         return (0);
6066                 else
6067                         return (error);
6068         case AF_INET:
6069                 sin = (sin_t *)msg->msg_name;
6070 
6071                 ipversion = IPV4_VERSION;
6072 
6073                 if (sin->sin_addr.s_addr == INADDR_ANY)
6074                         sin->sin_addr.s_addr = htonl(INADDR_LOOPBACK);
6075 
6076                 /*
6077                  * We have to allocate an ip_xmit_attr_t before we grab
6078                  * conn_lock and we need to hold conn_lock once we've check
6079                  * conn_same_as_last_v6 to handle concurrent send* on a socket.
6080                  */
6081                 if (msg->msg_controllen == 0) {
6082                         ixa = conn_get_ixa(connp, B_FALSE);
6083                         if (ixa == NULL) {
6084                                 UDPS_BUMP_MIB(us, udpOutErrors);
6085                                 return (ENOMEM);
6086                         }
6087                 } else {
6088                         ixa = NULL;
6089                 }
6090                 mutex_enter(&connp->conn_lock);
6091                 if (udp->udp_delayed_error != 0) {
6092                         sin_t  *sin2 = (sin_t *)&udp->udp_delayed_addr;
6093 
6094                         error = udp->udp_delayed_error;
6095                         udp->udp_delayed_error = 0;
6096 
6097                         /* Compare IP address and port */
6098 
6099                         if (sin->sin_port == sin2->sin_port &&
6100                             sin->sin_addr.s_addr == sin2->sin_addr.s_addr) {
6101                                 mutex_exit(&connp->conn_lock);
6102                                 UDPS_BUMP_MIB(us, udpOutErrors);
6103                                 if (ixa != NULL)
6104                                         ixa_refrele(ixa);
6105                                 return (error);
6106                         }
6107                 }
6108                 if (msg->msg_controllen != 0) {
6109                         mutex_exit(&connp->conn_lock);
6110                         ASSERT(ixa == NULL);
6111                         error = udp_output_ancillary(connp, sin, NULL, mp,
6112                             NULL, msg, cr, pid);
6113                 } else if (conn_same_as_last_v4(connp, sin) &&
6114                     ipsec_outbound_policy_current(ixa)) {
6115                         /* udp_output_lastdst drops conn_lock */
6116                         error = udp_output_lastdst(connp, mp, cr, pid, ixa);
6117                 } else {
6118                         /* udp_output_newdst drops conn_lock */
6119                         error = udp_output_newdst(connp, mp, sin, NULL,
6120                             ipversion, cr, pid, ixa);
6121                 }
6122                 ASSERT(MUTEX_NOT_HELD(&connp->conn_lock));
6123                 if (us->us_sendto_ignerr)
6124                         return (0);
6125                 else
6126                         return (error);
6127         default:
6128                 return (EINVAL);
6129         }
6130 }
6131 
6132 int
6133 udp_fallback(sock_lower_handle_t proto_handle, queue_t *q,
6134     boolean_t issocket, so_proto_quiesced_cb_t quiesced_cb,
6135     sock_quiesce_arg_t *arg)
6136 {
6137         conn_t  *connp = (conn_t *)proto_handle;
6138         udp_t   *udp;
6139         struct T_capability_ack tca;
6140         struct sockaddr_in6 laddr, faddr;
6141         socklen_t laddrlen, faddrlen;
6142         short opts;
6143         struct stroptions *stropt;
6144         mblk_t *mp, *stropt_mp;
6145         int error;
6146 
6147         udp = connp->conn_udp;
6148 
6149         stropt_mp = allocb_wait(sizeof (*stropt), BPRI_HI, STR_NOSIG, NULL);
6150 
6151         /*
6152          * setup the fallback stream that was allocated
6153          */
6154         connp->conn_dev = (dev_t)RD(q)->q_ptr;
6155         connp->conn_minor_arena = WR(q)->q_ptr;
6156 
6157         RD(q)->q_ptr = WR(q)->q_ptr = connp;
6158 
6159         WR(q)->q_qinfo = &udp_winit;
6160 
6161         connp->conn_rq = RD(q);
6162         connp->conn_wq = WR(q);
6163 
6164         /* Notify stream head about options before sending up data */
6165         stropt_mp->b_datap->db_type = M_SETOPTS;
6166         stropt_mp->b_wptr += sizeof (*stropt);
6167         stropt = (struct stroptions *)stropt_mp->b_rptr;
6168         stropt->so_flags = SO_WROFF | SO_HIWAT;
6169         stropt->so_wroff = connp->conn_wroff;
6170         stropt->so_hiwat = udp->udp_rcv_disply_hiwat;
6171         putnext(RD(q), stropt_mp);
6172 
6173         /*
6174          * Free the helper stream
6175          */
6176         ip_free_helper_stream(connp);
6177 
6178         if (!issocket)
6179                 udp_use_pure_tpi(udp);
6180 
6181         /*
6182          * Collect the information needed to sync with the sonode
6183          */
6184         udp_do_capability_ack(udp, &tca, TC1_INFO);
6185 
6186         laddrlen = faddrlen = sizeof (sin6_t);
6187         (void) udp_getsockname((sock_lower_handle_t)connp,
6188             (struct sockaddr *)&laddr, &laddrlen, CRED());
6189         error = udp_getpeername((sock_lower_handle_t)connp,
6190             (struct sockaddr *)&faddr, &faddrlen, CRED());
6191         if (error != 0)
6192                 faddrlen = 0;
6193 
6194         opts = 0;
6195         if (connp->conn_dgram_errind)
6196                 opts |= SO_DGRAM_ERRIND;
6197         if (connp->conn_ixa->ixa_flags & IXAF_DONTROUTE)
6198                 opts |= SO_DONTROUTE;
6199 
6200         mp = (*quiesced_cb)(connp->conn_upper_handle, arg, &tca,
6201             (struct sockaddr *)&laddr, laddrlen,
6202             (struct sockaddr *)&faddr, faddrlen, opts);
6203 
6204         mutex_enter(&udp->udp_recv_lock);
6205         /*
6206          * Attempts to send data up during fallback will result in it being
6207          * queued in udp_t. First push up the datagrams obtained from the
6208          * socket, then any packets queued in udp_t.
6209          */
6210         if (mp != NULL) {
6211                 mp->b_next = udp->udp_fallback_queue_head;
6212                 udp->udp_fallback_queue_head = mp;
6213         }
6214         while (udp->udp_fallback_queue_head != NULL) {
6215                 mp = udp->udp_fallback_queue_head;
6216                 udp->udp_fallback_queue_head = mp->b_next;
6217                 mutex_exit(&udp->udp_recv_lock);
6218                 mp->b_next = NULL;
6219                 putnext(RD(q), mp);
6220                 mutex_enter(&udp->udp_recv_lock);
6221         }
6222         udp->udp_fallback_queue_tail = udp->udp_fallback_queue_head;
6223         /*
6224          * No longer a streams less socket
6225          */
6226         mutex_enter(&connp->conn_lock);
6227         connp->conn_flags &= ~IPCL_NONSTR;
6228         mutex_exit(&connp->conn_lock);
6229 
6230         mutex_exit(&udp->udp_recv_lock);
6231 
6232         ASSERT(connp->conn_ref >= 1);
6233 
6234         return (0);
6235 }
6236 
6237 /* ARGSUSED3 */
6238 int
6239 udp_getpeername(sock_lower_handle_t proto_handle, struct sockaddr *sa,
6240     socklen_t *salenp, cred_t *cr)
6241 {
6242         conn_t  *connp = (conn_t *)proto_handle;
6243         udp_t   *udp = connp->conn_udp;
6244         int error;
6245 
6246         /* All Solaris components should pass a cred for this operation. */
6247         ASSERT(cr != NULL);
6248 
6249         mutex_enter(&connp->conn_lock);
6250         if (udp->udp_state != TS_DATA_XFER)
6251                 error = ENOTCONN;
6252         else
6253                 error = conn_getpeername(connp, sa, salenp);
6254         mutex_exit(&connp->conn_lock);
6255         return (error);
6256 }
6257 
6258 /* ARGSUSED3 */
6259 int
6260 udp_getsockname(sock_lower_handle_t proto_handle, struct sockaddr *sa,
6261     socklen_t *salenp, cred_t *cr)
6262 {
6263         conn_t  *connp = (conn_t *)proto_handle;
6264         int error;
6265 
6266         /* All Solaris components should pass a cred for this operation. */
6267         ASSERT(cr != NULL);
6268 
6269         mutex_enter(&connp->conn_lock);
6270         error = conn_getsockname(connp, sa, salenp);
6271         mutex_exit(&connp->conn_lock);
6272         return (error);
6273 }
6274 
6275 int
6276 udp_getsockopt(sock_lower_handle_t proto_handle, int level, int option_name,
6277     void *optvalp, socklen_t *optlen, cred_t *cr)
6278 {
6279         conn_t          *connp = (conn_t *)proto_handle;
6280         int             error;
6281         t_uscalar_t     max_optbuf_len;
6282         void            *optvalp_buf;
6283         int             len;
6284 
6285         /* All Solaris components should pass a cred for this operation. */
6286         ASSERT(cr != NULL);
6287 
6288         error = proto_opt_check(level, option_name, *optlen, &max_optbuf_len,
6289             udp_opt_obj.odb_opt_des_arr,
6290             udp_opt_obj.odb_opt_arr_cnt,
6291             B_FALSE, B_TRUE, cr);
6292         if (error != 0) {
6293                 if (error < 0)
6294                         error = proto_tlitosyserr(-error);
6295                 return (error);
6296         }
6297 
6298         optvalp_buf = kmem_alloc(max_optbuf_len, KM_SLEEP);
6299         len = udp_opt_get(connp, level, option_name, optvalp_buf);
6300         if (len == -1) {
6301                 kmem_free(optvalp_buf, max_optbuf_len);
6302                 return (EINVAL);
6303         }
6304 
6305         /*
6306          * update optlen and copy option value
6307          */
6308         t_uscalar_t size = MIN(len, *optlen);
6309 
6310         bcopy(optvalp_buf, optvalp, size);
6311         bcopy(&size, optlen, sizeof (size));
6312 
6313         kmem_free(optvalp_buf, max_optbuf_len);
6314         return (0);
6315 }
6316 
6317 int
6318 udp_setsockopt(sock_lower_handle_t proto_handle, int level, int option_name,
6319     const void *optvalp, socklen_t optlen, cred_t *cr)
6320 {
6321         conn_t          *connp = (conn_t *)proto_handle;
6322         int             error;
6323 
6324         /* All Solaris components should pass a cred for this operation. */
6325         ASSERT(cr != NULL);
6326 
6327         error = proto_opt_check(level, option_name, optlen, NULL,
6328             udp_opt_obj.odb_opt_des_arr,
6329             udp_opt_obj.odb_opt_arr_cnt,
6330             B_TRUE, B_FALSE, cr);
6331 
6332         if (error != 0) {
6333                 if (error < 0)
6334                         error = proto_tlitosyserr(-error);
6335                 return (error);
6336         }
6337 
6338         error = udp_opt_set(connp, SETFN_OPTCOM_NEGOTIATE, level, option_name,
6339             optlen, (uchar_t *)optvalp, (uint_t *)&optlen, (uchar_t *)optvalp,
6340             NULL, cr);
6341 
6342         ASSERT(error >= 0);
6343 
6344         return (error);
6345 }
6346 
6347 void
6348 udp_clr_flowctrl(sock_lower_handle_t proto_handle)
6349 {
6350         conn_t  *connp = (conn_t *)proto_handle;
6351         udp_t   *udp = connp->conn_udp;
6352 
6353         mutex_enter(&udp->udp_recv_lock);
6354         connp->conn_flow_cntrld = B_FALSE;
6355         mutex_exit(&udp->udp_recv_lock);
6356 }
6357 
6358 /* ARGSUSED2 */
6359 int
6360 udp_shutdown(sock_lower_handle_t proto_handle, int how, cred_t *cr)
6361 {
6362         conn_t  *connp = (conn_t *)proto_handle;
6363 
6364         /* All Solaris components should pass a cred for this operation. */
6365         ASSERT(cr != NULL);
6366 
6367         /* shut down the send side */
6368         if (how != SHUT_RD)
6369                 (*connp->conn_upcalls->su_opctl)(connp->conn_upper_handle,
6370                     SOCK_OPCTL_SHUT_SEND, 0);
6371         /* shut down the recv side */
6372         if (how != SHUT_WR)
6373                 (*connp->conn_upcalls->su_opctl)(connp->conn_upper_handle,
6374                     SOCK_OPCTL_SHUT_RECV, 0);
6375         return (0);
6376 }
6377 
6378 int
6379 udp_ioctl(sock_lower_handle_t proto_handle, int cmd, intptr_t arg,
6380     int mode, int32_t *rvalp, cred_t *cr)
6381 {
6382         conn_t          *connp = (conn_t *)proto_handle;
6383         int             error;
6384 
6385         /* All Solaris components should pass a cred for this operation. */
6386         ASSERT(cr != NULL);
6387 
6388         /*
6389          * If we don't have a helper stream then create one.
6390          * ip_create_helper_stream takes care of locking the conn_t,
6391          * so this check for NULL is just a performance optimization.
6392          */
6393         if (connp->conn_helper_info == NULL) {
6394                 udp_stack_t *us = connp->conn_udp->udp_us;
6395 
6396                 ASSERT(us->us_ldi_ident != NULL);
6397 
6398                 /*
6399                  * Create a helper stream for non-STREAMS socket.
6400                  */
6401                 error = ip_create_helper_stream(connp, us->us_ldi_ident);
6402                 if (error != 0) {
6403                         ip0dbg(("tcp_ioctl: create of IP helper stream "
6404                             "failed %d\n", error));
6405                         return (error);
6406                 }
6407         }
6408 
6409         switch (cmd) {
6410                 case _SIOCSOCKFALLBACK:
6411                 case TI_GETPEERNAME:
6412                 case TI_GETMYNAME:
6413                         ip1dbg(("udp_ioctl: cmd 0x%x on non streams socket",
6414                             cmd));
6415                         error = EINVAL;
6416                         break;
6417                 default:
6418                         /*
6419                          * Pass on to IP using helper stream
6420                          */
6421                         error = ldi_ioctl(connp->conn_helper_info->iphs_handle,
6422                             cmd, arg, mode, cr, rvalp);
6423                         break;
6424         }
6425         return (error);
6426 }
6427 
6428 /* ARGSUSED */
6429 int
6430 udp_accept(sock_lower_handle_t lproto_handle,
6431     sock_lower_handle_t eproto_handle, sock_upper_handle_t sock_handle,
6432     cred_t *cr)
6433 {
6434         return (EOPNOTSUPP);
6435 }
6436 
6437 /* ARGSUSED */
6438 int
6439 udp_listen(sock_lower_handle_t proto_handle, int backlog, cred_t *cr)
6440 {
6441         return (EOPNOTSUPP);
6442 }
6443 
6444 sock_downcalls_t sock_udp_downcalls = {
6445         udp_activate,           /* sd_activate */
6446         udp_accept,             /* sd_accept */
6447         udp_bind,               /* sd_bind */
6448         udp_listen,             /* sd_listen */
6449         udp_connect,            /* sd_connect */
6450         udp_getpeername,        /* sd_getpeername */
6451         udp_getsockname,        /* sd_getsockname */
6452         udp_getsockopt,         /* sd_getsockopt */
6453         udp_setsockopt,         /* sd_setsockopt */
6454         udp_send,               /* sd_send */
6455         NULL,                   /* sd_send_uio */
6456         NULL,                   /* sd_recv_uio */
6457         NULL,                   /* sd_poll */
6458         udp_shutdown,           /* sd_shutdown */
6459         udp_clr_flowctrl,       /* sd_setflowctrl */
6460         udp_ioctl,              /* sd_ioctl */
6461         udp_close               /* sd_close */
6462 };