xref: /illumos-gate/usr/src/uts/common/inet/ip/ip6.c (revision 03831d35)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 /*
26  * Copyright (c) 1990 Mentat Inc.
27  */
28 
29 #pragma ident	"%Z%%M%	%I%	%E% SMI"
30 
31 #include <sys/types.h>
32 #include <sys/stream.h>
33 #include <sys/dlpi.h>
34 #include <sys/stropts.h>
35 #include <sys/sysmacros.h>
36 #include <sys/strsun.h>
37 #include <sys/strlog.h>
38 #include <sys/strsubr.h>
39 #define	_SUN_TPI_VERSION	2
40 #include <sys/tihdr.h>
41 #include <sys/ddi.h>
42 #include <sys/sunddi.h>
43 #include <sys/cmn_err.h>
44 #include <sys/debug.h>
45 #include <sys/kobj.h>
46 #include <sys/zone.h>
47 
48 #include <sys/kmem.h>
49 #include <sys/systm.h>
50 #include <sys/param.h>
51 #include <sys/socket.h>
52 #include <sys/vtrace.h>
53 #include <sys/isa_defs.h>
54 #include <sys/atomic.h>
55 #include <sys/iphada.h>
56 #include <sys/policy.h>
57 #include <net/if.h>
58 #include <net/if_types.h>
59 #include <net/route.h>
60 #include <net/if_dl.h>
61 #include <sys/sockio.h>
62 #include <netinet/in.h>
63 #include <netinet/ip6.h>
64 #include <netinet/icmp6.h>
65 #include <netinet/sctp.h>
66 
67 #include <inet/common.h>
68 #include <inet/mi.h>
69 #include <inet/mib2.h>
70 #include <inet/nd.h>
71 #include <inet/arp.h>
72 
73 #include <inet/ip.h>
74 #include <inet/ip_impl.h>
75 #include <inet/ip6.h>
76 #include <inet/ip6_asp.h>
77 #include <inet/tcp.h>
78 #include <inet/tcp_impl.h>
79 #include <inet/udp_impl.h>
80 #include <inet/ipp_common.h>
81 
82 #include <inet/ip_multi.h>
83 #include <inet/ip_if.h>
84 #include <inet/ip_ire.h>
85 #include <inet/ip_rts.h>
86 #include <inet/optcom.h>
87 #include <inet/ip_ndp.h>
88 #include <net/pfkeyv2.h>
89 #include <inet/ipsec_info.h>
90 #include <inet/sadb.h>
91 #include <inet/ipsec_impl.h>
92 #include <inet/tun.h>
93 #include <inet/sctp_ip.h>
94 #include <sys/pattr.h>
95 #include <inet/ipclassifier.h>
96 #include <inet/ipsecah.h>
97 #include <inet/udp_impl.h>
98 #include <sys/squeue.h>
99 
100 #include <sys/tsol/label.h>
101 #include <sys/tsol/tnet.h>
102 
103 #include <rpc/pmap_prot.h>
104 
105 extern squeue_func_t ip_input_proc;
106 
107 /*
108  * IP statistics.
109  */
110 #define	IP6_STAT(x)		(ip6_statistics.x.value.ui64++)
111 #define	IP6_STAT_UPDATE(x, n)	(ip6_statistics.x.value.ui64 += (n))
112 
113 typedef struct ip6_stat {
114 	kstat_named_t	ip6_udp_fast_path;
115 	kstat_named_t	ip6_udp_slow_path;
116 	kstat_named_t	ip6_udp_fannorm;
117 	kstat_named_t	ip6_udp_fanmb;
118 	kstat_named_t   ip6_out_sw_cksum;
119 	kstat_named_t   ip6_in_sw_cksum;
120 	kstat_named_t	ip6_tcp_in_full_hw_cksum_err;
121 	kstat_named_t	ip6_tcp_in_part_hw_cksum_err;
122 	kstat_named_t	ip6_tcp_in_sw_cksum_err;
123 	kstat_named_t	ip6_tcp_out_sw_cksum_bytes;
124 	kstat_named_t	ip6_udp_in_full_hw_cksum_err;
125 	kstat_named_t	ip6_udp_in_part_hw_cksum_err;
126 	kstat_named_t	ip6_udp_in_sw_cksum_err;
127 	kstat_named_t	ip6_udp_out_sw_cksum_bytes;
128 	kstat_named_t	ip6_frag_mdt_pkt_out;
129 	kstat_named_t	ip6_frag_mdt_discarded;
130 	kstat_named_t	ip6_frag_mdt_allocfail;
131 	kstat_named_t	ip6_frag_mdt_addpdescfail;
132 	kstat_named_t	ip6_frag_mdt_allocd;
133 } ip6_stat_t;
134 
135 static ip6_stat_t ip6_statistics = {
136 	{ "ip6_udp_fast_path",			KSTAT_DATA_UINT64 },
137 	{ "ip6_udp_slow_path",			KSTAT_DATA_UINT64 },
138 	{ "ip6_udp_fannorm",			KSTAT_DATA_UINT64 },
139 	{ "ip6_udp_fanmb",			KSTAT_DATA_UINT64 },
140 	{ "ip6_out_sw_cksum",			KSTAT_DATA_UINT64 },
141 	{ "ip6_in_sw_cksum",			KSTAT_DATA_UINT64 },
142 	{ "ip6_tcp_in_full_hw_cksum_err",	KSTAT_DATA_UINT64 },
143 	{ "ip6_tcp_in_part_hw_cksum_err",	KSTAT_DATA_UINT64 },
144 	{ "ip6_tcp_in_sw_cksum_err",		KSTAT_DATA_UINT64 },
145 	{ "ip6_tcp_out_sw_cksum_bytes",		KSTAT_DATA_UINT64 },
146 	{ "ip6_udp_in_full_hw_cksum_err",	KSTAT_DATA_UINT64 },
147 	{ "ip6_udp_in_part_hw_cksum_err",	KSTAT_DATA_UINT64 },
148 	{ "ip6_udp_in_sw_cksum_err",		KSTAT_DATA_UINT64 },
149 	{ "ip6_udp_out_sw_cksum_bytes",		KSTAT_DATA_UINT64 },
150 	{ "ip6_frag_mdt_pkt_out",		KSTAT_DATA_UINT64 },
151 	{ "ip6_frag_mdt_discarded",		KSTAT_DATA_UINT64 },
152 	{ "ip6_frag_mdt_allocfail",		KSTAT_DATA_UINT64 },
153 	{ "ip6_frag_mdt_addpdescfail",		KSTAT_DATA_UINT64 },
154 	{ "ip6_frag_mdt_allocd",		KSTAT_DATA_UINT64 },
155 };
156 
157 static kstat_t *ip6_kstat;
158 
159 /*
160  * Naming conventions:
161  *      These rules should be judiciously applied
162  *	if there is a need to identify something as IPv6 versus IPv4
163  *	IPv6 funcions will end with _v6 in the ip module.
164  *	IPv6 funcions will end with _ipv6 in the transport modules.
165  *	IPv6 macros:
166  *		Some macros end with _V6; e.g. ILL_FRAG_HASH_V6
167  *		Some macros start with V6_; e.g. V6_OR_V4_INADDR_ANY
168  *		And then there are ..V4_PART_OF_V6.
169  *		The intent is that macros in the ip module end with _V6.
170  *	IPv6 global variables will start with ipv6_
171  *	IPv6 structures will start with ipv6
172  *	IPv6 defined constants should start with IPV6_
173  *		(but then there are NDP_DEFAULT_VERS_PRI_AND_FLOW, etc)
174  */
175 
176 /*
177  * IPv6 mibs when the interface (ill) is not known.
178  * When the ill is known the per-interface mib in the ill is used.
179  */
180 mib2_ipv6IfStatsEntry_t	ip6_mib;
181 mib2_ipv6IfIcmpEntry_t	icmp6_mib;
182 
183 /*
184  * ip6opt_ls is used to enable IPv6 (via /etc/system on TX systems).
185  * We need to do this because we didn't obtain the IP6OPT_LS (0x0a)
186  * from IANA. This mechanism will remain in effect until an official
187  * number is obtained.
188  */
189 uchar_t ip6opt_ls;
190 
191 uint_t ipv6_ire_default_count;	/* Number of IPv6 IRE_DEFAULT entries */
192 uint_t ipv6_ire_default_index;	/* Walking IPv6 index used to mod in */
193 
194 const in6_addr_t ipv6_all_ones =
195 	{ 0xffffffffU, 0xffffffffU, 0xffffffffU, 0xffffffffU };
196 const in6_addr_t ipv6_all_zeros = { 0, 0, 0, 0 };
197 
198 #ifdef	_BIG_ENDIAN
199 const in6_addr_t ipv6_unspecified_group = { 0xff000000U, 0, 0, 0 };
200 #else	/* _BIG_ENDIAN */
201 const in6_addr_t ipv6_unspecified_group = { 0x000000ffU, 0, 0, 0 };
202 #endif	/* _BIG_ENDIAN */
203 
204 #ifdef	_BIG_ENDIAN
205 const in6_addr_t ipv6_loopback = { 0, 0, 0, 0x00000001U };
206 #else  /* _BIG_ENDIAN */
207 const in6_addr_t ipv6_loopback = { 0, 0, 0, 0x01000000U };
208 #endif /* _BIG_ENDIAN */
209 
210 #ifdef _BIG_ENDIAN
211 const in6_addr_t ipv6_all_hosts_mcast = { 0xff020000U, 0, 0, 0x00000001U };
212 #else  /* _BIG_ENDIAN */
213 const in6_addr_t ipv6_all_hosts_mcast = { 0x000002ffU, 0, 0, 0x01000000U };
214 #endif /* _BIG_ENDIAN */
215 
216 #ifdef _BIG_ENDIAN
217 const in6_addr_t ipv6_all_rtrs_mcast = { 0xff020000U, 0, 0, 0x00000002U };
218 #else  /* _BIG_ENDIAN */
219 const in6_addr_t ipv6_all_rtrs_mcast = { 0x000002ffU, 0, 0, 0x02000000U };
220 #endif /* _BIG_ENDIAN */
221 
222 #ifdef _BIG_ENDIAN
223 const in6_addr_t ipv6_all_v2rtrs_mcast = { 0xff020000U, 0, 0, 0x00000016U };
224 #else  /* _BIG_ENDIAN */
225 const in6_addr_t ipv6_all_v2rtrs_mcast = { 0x000002ffU, 0, 0, 0x16000000U };
226 #endif /* _BIG_ENDIAN */
227 
228 #ifdef _BIG_ENDIAN
229 const in6_addr_t ipv6_solicited_node_mcast =
230 			{ 0xff020000U, 0, 0x00000001U, 0xff000000U };
231 #else  /* _BIG_ENDIAN */
232 const in6_addr_t ipv6_solicited_node_mcast =
233 			{ 0x000002ffU, 0, 0x01000000U, 0x000000ffU };
234 #endif /* _BIG_ENDIAN */
235 
236 /*
237  * Used by icmp_send_redirect_v6 for picking random src.
238  */
239 uint_t	icmp_redirect_v6_src_index;
240 
241 /* Leave room for ip_newroute to tack on the src and target addresses */
242 #define	OK_RESOLVER_MP_V6(mp)						\
243 		((mp) && ((mp)->b_wptr - (mp)->b_rptr) >= (2 * IPV6_ADDR_LEN))
244 
245 static void	icmp_inbound_too_big_v6(queue_t *, mblk_t *, ill_t *ill,
246     boolean_t, zoneid_t);
247 static void	icmp_pkt_v6(queue_t *, mblk_t *, void *, size_t,
248     const in6_addr_t *, boolean_t);
249 static void	icmp_redirect_v6(queue_t *, mblk_t *, ill_t *ill);
250 static boolean_t	icmp_redirect_ok_v6(ill_t *ill, mblk_t *mp);
251 static int	ip_bind_connected_v6(conn_t *, mblk_t *, in6_addr_t *,
252     uint16_t, const in6_addr_t *, ip6_pkt_t *, uint16_t,
253     boolean_t, boolean_t, boolean_t, boolean_t);
254 static boolean_t ip_bind_insert_ire_v6(mblk_t *, ire_t *, const in6_addr_t *,
255     iulp_t *);
256 static int	ip_bind_laddr_v6(conn_t *, mblk_t *, const in6_addr_t *,
257     uint16_t, boolean_t, boolean_t, boolean_t);
258 static void	ip_fanout_proto_v6(queue_t *, mblk_t *, ip6_t *, ill_t *,
259     ill_t *, uint8_t, uint_t, uint_t, boolean_t, zoneid_t);
260 static void	ip_fanout_tcp_v6(queue_t *, mblk_t *, ip6_t *, ill_t *,
261     ill_t *, uint_t, uint_t, boolean_t, zoneid_t);
262 static void	ip_fanout_udp_v6(queue_t *, mblk_t *, ip6_t *, uint32_t,
263     ill_t *, ill_t *, uint_t, boolean_t, zoneid_t);
264 static int	ip_process_options_v6(queue_t *, mblk_t *, ip6_t *,
265     uint8_t *, uint_t, uint8_t);
266 static mblk_t	*ip_rput_frag_v6(queue_t *, mblk_t *, ip6_t *,
267     ip6_frag_t *, uint_t, uint_t *, uint32_t *, uint16_t *);
268 static boolean_t	ip_source_routed_v6(ip6_t *, mblk_t *);
269 static void	ip_wput_ire_v6(queue_t *, mblk_t *, ire_t *, int, int,
270     conn_t *, int, int, int);
271 static boolean_t ip_ulp_cando_pkt2big(int);
272 
273 static void ip_rput_v6(queue_t *, mblk_t *);
274 static void ip_wput_v6(queue_t *, mblk_t *);
275 
276 /*
277  * A template for an IPv6 AR_ENTRY_QUERY
278  */
279 static areq_t	ipv6_areq_template = {
280 	AR_ENTRY_QUERY,				/* cmd */
281 	sizeof (areq_t)+(2*IPV6_ADDR_LEN),	/* name offset */
282 	sizeof (areq_t),	/* name len (filled by ill_arp_alloc) */
283 	IP6_DL_SAP,		/* protocol, from arps perspective */
284 	sizeof (areq_t),	/* target addr offset */
285 	IPV6_ADDR_LEN,		/* target addr_length */
286 	0,			/* flags */
287 	sizeof (areq_t) + IPV6_ADDR_LEN,	/* sender addr offset */
288 	IPV6_ADDR_LEN,		/* sender addr length */
289 	6,			/* xmit_count */
290 	1000,			/* (re)xmit_interval in milliseconds */
291 	4			/* max # of requests to buffer */
292 	/* anything else filled in by the code */
293 };
294 
295 struct qinit rinit_ipv6 = {
296 	(pfi_t)ip_rput_v6,
297 	NULL,
298 	ip_open,
299 	ip_close,
300 	NULL,
301 	&ip_mod_info
302 };
303 
304 struct qinit winit_ipv6 = {
305 	(pfi_t)ip_wput_v6,
306 	(pfi_t)ip_wsrv,
307 	ip_open,
308 	ip_close,
309 	NULL,
310 	&ip_mod_info
311 };
312 
313 /*
314  * Handle IPv6 ICMP packets sent to us.  Consume the mblk passed in.
315  * The message has already been checksummed and if needed,
316  * a copy has been made to be sent any interested ICMP client (conn)
317  * Note that this is different than icmp_inbound() which does the fanout
318  * to conn's as well as local processing of the ICMP packets.
319  *
320  * All error messages are passed to the matching transport stream.
321  *
322  * Zones notes:
323  * The packet is only processed in the context of the specified zone: typically
324  * only this zone will reply to an echo request. This means that the caller must
325  * call icmp_inbound_v6() for each relevant zone.
326  */
327 static void
328 icmp_inbound_v6(queue_t *q, mblk_t *mp, ill_t *ill, uint_t hdr_length,
329     boolean_t mctl_present, uint_t flags, zoneid_t zoneid)
330 {
331 	icmp6_t		*icmp6;
332 	ip6_t		*ip6h;
333 	boolean_t	interested;
334 	ip6i_t		*ip6i;
335 	in6_addr_t	origsrc;
336 	ire_t		*ire;
337 	mblk_t		*first_mp;
338 	ipsec_in_t	*ii;
339 
340 	ASSERT(ill != NULL);
341 	first_mp = mp;
342 	if (mctl_present) {
343 		mp = first_mp->b_cont;
344 		ASSERT(mp != NULL);
345 
346 		ii = (ipsec_in_t *)first_mp->b_rptr;
347 		ASSERT(ii->ipsec_in_type == IPSEC_IN);
348 	}
349 
350 	ip6h = (ip6_t *)mp->b_rptr;
351 
352 	BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInMsgs);
353 
354 	if ((mp->b_wptr - mp->b_rptr) < (hdr_length + ICMP6_MINLEN)) {
355 		if (!pullupmsg(mp, hdr_length + ICMP6_MINLEN)) {
356 			ip1dbg(("icmp_inbound_v6: pullupmsg failed\n"));
357 			BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInErrors);
358 			freemsg(first_mp);
359 			return;
360 		}
361 		ip6h = (ip6_t *)mp->b_rptr;
362 	}
363 	if (icmp_accept_clear_messages == 0) {
364 		first_mp = ipsec_check_global_policy(first_mp, NULL,
365 		    NULL, ip6h, mctl_present);
366 		if (first_mp == NULL)
367 			return;
368 	}
369 
370 	/*
371 	 * On a labeled system, we have to check whether the zone itself is
372 	 * permitted to receive raw traffic.
373 	 */
374 	if (is_system_labeled()) {
375 		if (zoneid == ALL_ZONES)
376 			zoneid = tsol_packet_to_zoneid(mp);
377 		if (!tsol_can_accept_raw(mp, B_FALSE)) {
378 			ip1dbg(("icmp_inbound_v6: zone %d can't receive raw",
379 			    zoneid));
380 			BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInErrors);
381 			freemsg(first_mp);
382 			return;
383 		}
384 	}
385 
386 	icmp6 = (icmp6_t *)(&mp->b_rptr[hdr_length]);
387 	ip2dbg(("icmp_inbound_v6: type %d code %d\n", icmp6->icmp6_type,
388 	    icmp6->icmp6_code));
389 	interested = !(icmp6->icmp6_type & ICMP6_INFOMSG_MASK);
390 
391 	/* Initiate IPPF processing here */
392 	if (IP6_IN_IPP(flags)) {
393 
394 		/*
395 		 * If the ifindex changes due to SIOCSLIFINDEX
396 		 * packet may return to IP on the wrong ill.
397 		 */
398 		ip_process(IPP_LOCAL_IN, &mp, ill->ill_phyint->phyint_ifindex);
399 		if (mp == NULL) {
400 			if (mctl_present) {
401 				freeb(first_mp);
402 			}
403 			return;
404 		}
405 	}
406 
407 	switch (icmp6->icmp6_type) {
408 	case ICMP6_DST_UNREACH:
409 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInDestUnreachs);
410 		if (icmp6->icmp6_code == ICMP6_DST_UNREACH_ADMIN)
411 			BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInAdminProhibs);
412 		break;
413 
414 	case ICMP6_TIME_EXCEEDED:
415 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInTimeExcds);
416 		break;
417 
418 	case ICMP6_PARAM_PROB:
419 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInParmProblems);
420 		break;
421 
422 	case ICMP6_PACKET_TOO_BIG:
423 		icmp_inbound_too_big_v6(q, first_mp, ill, mctl_present,
424 		    zoneid);
425 		return;
426 	case ICMP6_ECHO_REQUEST:
427 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInEchos);
428 		if (IN6_IS_ADDR_MULTICAST(&ip6h->ip6_dst) &&
429 		    !ipv6_resp_echo_mcast)
430 			break;
431 
432 		/*
433 		 * We must have exclusive use of the mblk to convert it to
434 		 * a response.
435 		 * If not, we copy it.
436 		 */
437 		if (mp->b_datap->db_ref > 1) {
438 			mblk_t	*mp1;
439 
440 			mp1 = copymsg(mp);
441 			freemsg(mp);
442 			if (mp1 == NULL) {
443 				BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
444 				if (mctl_present)
445 					freeb(first_mp);
446 				return;
447 			}
448 			mp = mp1;
449 			ip6h = (ip6_t *)mp->b_rptr;
450 			icmp6 = (icmp6_t *)(&mp->b_rptr[hdr_length]);
451 			if (mctl_present)
452 				first_mp->b_cont = mp;
453 			else
454 				first_mp = mp;
455 		}
456 
457 		/*
458 		 * Turn the echo into an echo reply.
459 		 * Remove any extension headers (do not reverse a source route)
460 		 * and clear the flow id (keep traffic class for now).
461 		 */
462 		if (hdr_length != IPV6_HDR_LEN) {
463 			int	i;
464 
465 			for (i = 0; i < IPV6_HDR_LEN; i++)
466 				mp->b_rptr[hdr_length - i - 1] =
467 				    mp->b_rptr[IPV6_HDR_LEN - i - 1];
468 			mp->b_rptr += (hdr_length - IPV6_HDR_LEN);
469 			ip6h = (ip6_t *)mp->b_rptr;
470 			ip6h->ip6_nxt = IPPROTO_ICMPV6;
471 			hdr_length = IPV6_HDR_LEN;
472 		}
473 		ip6h->ip6_vcf &= ~IPV6_FLOWINFO_FLOWLABEL;
474 		icmp6->icmp6_type = ICMP6_ECHO_REPLY;
475 
476 		ip6h->ip6_plen =
477 		    htons((uint16_t)(msgdsize(mp) - IPV6_HDR_LEN));
478 		origsrc = ip6h->ip6_src;
479 		/*
480 		 * Reverse the source and destination addresses.
481 		 * If the return address is a multicast, zero out the source
482 		 * (ip_wput_v6 will set an address).
483 		 */
484 		if (IN6_IS_ADDR_MULTICAST(&ip6h->ip6_dst)) {
485 			ip6h->ip6_src = ipv6_all_zeros;
486 			ip6h->ip6_dst = origsrc;
487 		} else {
488 			ip6h->ip6_src = ip6h->ip6_dst;
489 			ip6h->ip6_dst = origsrc;
490 		}
491 
492 		/* set the hop limit */
493 		ip6h->ip6_hops = ipv6_def_hops;
494 
495 		/*
496 		 * Prepare for checksum by putting icmp length in the icmp
497 		 * checksum field. The checksum is calculated in ip_wput_v6.
498 		 */
499 		icmp6->icmp6_cksum = ip6h->ip6_plen;
500 		/*
501 		 * ICMP echo replies should go out on the same interface
502 		 * the request came on as probes used by in.mpathd for
503 		 * detecting NIC failures are ECHO packets. We turn-off load
504 		 * spreading by allocating a ip6i and setting ip6i_attach_if
505 		 * to B_TRUE which is handled both by ip_wput_v6 and
506 		 * ip_newroute_v6. If we don't turnoff load spreading,
507 		 * the packets might get dropped if there are no
508 		 * non-FAILED/INACTIVE interfaces for it to go out on and
509 		 * in.mpathd would wrongly detect a failure or mis-detect
510 		 * a NIC failure as a link failure. As load spreading can
511 		 * happen only if ill_group is not NULL, we do only for
512 		 * that case and this does not affect the normal case.
513 		 *
514 		 * We force this only on echo packets that came from on-link
515 		 * hosts. We restrict this to link-local addresses which
516 		 * is used by in.mpathd for probing. In the IPv6 case,
517 		 * default routes typically have an ire_ipif pointer and
518 		 * hence a MATCH_IRE_ILL later in ip_newroute_v6/ip_wput_v6
519 		 * might work. As a default route out of this interface
520 		 * may not be present, enforcing this packet to go out in
521 		 * this case may not work.
522 		 */
523 		if (ill->ill_group != NULL &&
524 		    IN6_IS_ADDR_LINKLOCAL(&origsrc)) {
525 			/*
526 			 * If we are sending replies to ourselves, don't
527 			 * set ATTACH_IF as we may not be able to find
528 			 * the IRE_LOCAL on this ill i.e setting ATTACH_IF
529 			 * causes ip_wput_v6 to look for an IRE_LOCAL on
530 			 * "ill" which it may not find and will try to
531 			 * create an IRE_CACHE for our local address. Once
532 			 * we do this, we will try to forward all packets
533 			 * meant to our LOCAL address.
534 			 */
535 			ire = ire_cache_lookup_v6(&ip6h->ip6_dst, ALL_ZONES,
536 			    NULL);
537 			if (ire == NULL || ire->ire_type != IRE_LOCAL) {
538 				mp = ip_add_info_v6(mp, NULL, &ip6h->ip6_dst);
539 				if (mp == NULL) {
540 					BUMP_MIB(ill->ill_icmp6_mib,
541 					    ipv6IfIcmpInErrors);
542 					if (ire != NULL)
543 						ire_refrele(ire);
544 					if (mctl_present)
545 						freeb(first_mp);
546 					return;
547 				} else if (mctl_present) {
548 					first_mp->b_cont = mp;
549 				} else {
550 					first_mp = mp;
551 				}
552 				ip6i = (ip6i_t *)mp->b_rptr;
553 				ip6i->ip6i_flags = IP6I_ATTACH_IF;
554 				ip6i->ip6i_ifindex =
555 				    ill->ill_phyint->phyint_ifindex;
556 			}
557 			if (ire != NULL)
558 				ire_refrele(ire);
559 		}
560 
561 		if (!mctl_present) {
562 			/*
563 			 * This packet should go out the same way as it
564 			 * came in i.e in clear. To make sure that global
565 			 * policy will not be applied to this in ip_wput,
566 			 * we attach a IPSEC_IN mp and clear ipsec_in_secure.
567 			 */
568 			ASSERT(first_mp == mp);
569 			if ((first_mp = ipsec_in_alloc(B_FALSE)) == NULL) {
570 				BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
571 				freemsg(mp);
572 				return;
573 			}
574 			ii = (ipsec_in_t *)first_mp->b_rptr;
575 
576 			/* This is not a secure packet */
577 			ii->ipsec_in_secure = B_FALSE;
578 			first_mp->b_cont = mp;
579 		}
580 		ii->ipsec_in_zoneid = zoneid;
581 		ASSERT(zoneid != ALL_ZONES);
582 		if (!ipsec_in_to_out(first_mp, NULL, ip6h)) {
583 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
584 			return;
585 		}
586 		put(WR(q), first_mp);
587 		return;
588 
589 	case ICMP6_ECHO_REPLY:
590 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInEchoReplies);
591 		break;
592 
593 	case ND_ROUTER_SOLICIT:
594 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInRouterSolicits);
595 		break;
596 
597 	case ND_ROUTER_ADVERT:
598 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInRouterAdvertisements);
599 		break;
600 
601 	case ND_NEIGHBOR_SOLICIT:
602 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInNeighborSolicits);
603 		if (mctl_present)
604 			freeb(first_mp);
605 		/* XXX may wish to pass first_mp up to ndp_input someday. */
606 		ndp_input(ill, mp);
607 		return;
608 
609 	case ND_NEIGHBOR_ADVERT:
610 		BUMP_MIB(ill->ill_icmp6_mib,
611 		    ipv6IfIcmpInNeighborAdvertisements);
612 		if (mctl_present)
613 			freeb(first_mp);
614 		/* XXX may wish to pass first_mp up to ndp_input someday. */
615 		ndp_input(ill, mp);
616 		return;
617 
618 	case ND_REDIRECT: {
619 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInRedirects);
620 
621 		if (ipv6_ignore_redirect)
622 			break;
623 
624 		/*
625 		 * As there is no upper client to deliver, we don't
626 		 * need the first_mp any more.
627 		 */
628 		if (mctl_present)
629 			freeb(first_mp);
630 		if (!pullupmsg(mp, -1) ||
631 		    !icmp_redirect_ok_v6(ill, mp)) {
632 			BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInBadRedirects);
633 			break;
634 		}
635 		icmp_redirect_v6(q, mp, ill);
636 		return;
637 	}
638 
639 	/*
640 	 * The next three icmp messages will be handled by MLD.
641 	 * Pass all valid MLD packets up to any process(es)
642 	 * listening on a raw ICMP socket. MLD messages are
643 	 * freed by mld_input function.
644 	 */
645 	case MLD_LISTENER_QUERY:
646 	case MLD_LISTENER_REPORT:
647 	case MLD_LISTENER_REDUCTION:
648 		if (mctl_present)
649 			freeb(first_mp);
650 		mld_input(q, mp, ill);
651 		return;
652 	default:
653 		break;
654 	}
655 	if (interested) {
656 		icmp_inbound_error_fanout_v6(q, first_mp, ip6h, icmp6, ill,
657 		    mctl_present, zoneid);
658 	} else {
659 		freemsg(first_mp);
660 	}
661 }
662 
663 /*
664  * Process received IPv6 ICMP Packet too big.
665  * After updating any IRE it does the fanout to any matching transport streams.
666  * Assumes the IPv6 plus ICMPv6 headers have been pulled up but nothing else.
667  */
668 /* ARGSUSED */
669 static void
670 icmp_inbound_too_big_v6(queue_t *q, mblk_t *mp, ill_t *ill,
671     boolean_t mctl_present, zoneid_t zoneid)
672 {
673 	ip6_t		*ip6h;
674 	ip6_t		*inner_ip6h;
675 	icmp6_t		*icmp6;
676 	uint16_t	hdr_length;
677 	uint32_t	mtu;
678 	ire_t		*ire, *first_ire;
679 	mblk_t		*first_mp;
680 
681 	first_mp = mp;
682 	if (mctl_present)
683 		mp = first_mp->b_cont;
684 	/*
685 	 * We must have exclusive use of the mblk to update the MTU
686 	 * in the packet.
687 	 * If not, we copy it.
688 	 *
689 	 * If there's an M_CTL present, we know that allocated first_mp
690 	 * earlier in this function, so we know first_mp has refcnt of one.
691 	 */
692 	ASSERT(!mctl_present || first_mp->b_datap->db_ref == 1);
693 	if (mp->b_datap->db_ref > 1) {
694 		mblk_t	*mp1;
695 
696 		mp1 = copymsg(mp);
697 		freemsg(mp);
698 		if (mp1 == NULL) {
699 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
700 			if (mctl_present)
701 				freeb(first_mp);
702 			return;
703 		}
704 		mp = mp1;
705 		if (mctl_present)
706 			first_mp->b_cont = mp;
707 		else
708 			first_mp = mp;
709 	}
710 	ip6h = (ip6_t *)mp->b_rptr;
711 	if (ip6h->ip6_nxt != IPPROTO_ICMPV6)
712 		hdr_length = ip_hdr_length_v6(mp, ip6h);
713 	else
714 		hdr_length = IPV6_HDR_LEN;
715 
716 	icmp6 = (icmp6_t *)(&mp->b_rptr[hdr_length]);
717 	ASSERT((size_t)(mp->b_wptr - mp->b_rptr) >= hdr_length + ICMP6_MINLEN);
718 	inner_ip6h = (ip6_t *)&icmp6[1];	/* Packet in error */
719 	if ((uchar_t *)&inner_ip6h[1] > mp->b_wptr) {
720 		if (!pullupmsg(mp, (uchar_t *)&inner_ip6h[1] - mp->b_rptr)) {
721 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
722 			freemsg(first_mp);
723 			return;
724 		}
725 		ip6h = (ip6_t *)mp->b_rptr;
726 		icmp6 = (icmp6_t *)&mp->b_rptr[hdr_length];
727 		inner_ip6h = (ip6_t *)&icmp6[1];
728 	}
729 
730 	/*
731 	 * For link local destinations matching simply on IRE type is not
732 	 * sufficient. Same link local addresses for different ILL's is
733 	 * possible.
734 	 */
735 
736 	if (IN6_IS_ADDR_LINKLOCAL(&inner_ip6h->ip6_dst)) {
737 		first_ire = ire_ctable_lookup_v6(&inner_ip6h->ip6_dst, NULL,
738 		    IRE_CACHE, ill->ill_ipif, ALL_ZONES, NULL,
739 		    MATCH_IRE_TYPE | MATCH_IRE_ILL_GROUP);
740 
741 		if (first_ire == NULL) {
742 			if (ip_debug > 2) {
743 				/* ip1dbg */
744 				pr_addr_dbg("icmp_inbound_too_big_v6:"
745 				    "no ire for dst %s\n", AF_INET6,
746 				    &inner_ip6h->ip6_dst);
747 			}
748 			freemsg(first_mp);
749 			return;
750 		}
751 
752 		mtu = ntohl(icmp6->icmp6_mtu);
753 		rw_enter(&first_ire->ire_bucket->irb_lock, RW_READER);
754 		for (ire = first_ire; ire != NULL &&
755 		    IN6_ARE_ADDR_EQUAL(&ire->ire_addr_v6, &inner_ip6h->ip6_dst);
756 		    ire = ire->ire_next) {
757 			mutex_enter(&ire->ire_lock);
758 			if (mtu < IPV6_MIN_MTU) {
759 				ip1dbg(("Received mtu less than IPv6 "
760 				    "min mtu %d: %d\n", IPV6_MIN_MTU, mtu));
761 				mtu = IPV6_MIN_MTU;
762 				/*
763 				 * If an mtu less than IPv6 min mtu is received,
764 				 * we must include a fragment header in
765 				 * subsequent packets.
766 				 */
767 				ire->ire_frag_flag |= IPH_FRAG_HDR;
768 			}
769 			ip1dbg(("Received mtu from router: %d\n", mtu));
770 			ire->ire_max_frag = MIN(ire->ire_max_frag, mtu);
771 			/* Record the new max frag size for the ULP. */
772 			if (ire->ire_frag_flag & IPH_FRAG_HDR) {
773 				/*
774 				 * If we need a fragment header in every packet
775 				 * (above case or multirouting), make sure the
776 				 * ULP takes it into account when computing the
777 				 * payload size.
778 				 */
779 				icmp6->icmp6_mtu = htonl(ire->ire_max_frag -
780 				    sizeof (ip6_frag_t));
781 			} else {
782 				icmp6->icmp6_mtu = htonl(ire->ire_max_frag);
783 			}
784 			mutex_exit(&ire->ire_lock);
785 		}
786 		rw_exit(&first_ire->ire_bucket->irb_lock);
787 		ire_refrele(first_ire);
788 	} else {
789 		irb_t	*irb = NULL;
790 		/*
791 		 * for non-link local destinations we match only on the IRE type
792 		 */
793 		ire = ire_ctable_lookup_v6(&inner_ip6h->ip6_dst, NULL,
794 		    IRE_CACHE, ill->ill_ipif, ALL_ZONES, NULL, MATCH_IRE_TYPE);
795 		if (ire == NULL) {
796 			if (ip_debug > 2) {
797 				/* ip1dbg */
798 				pr_addr_dbg("icmp_inbound_too_big_v6:"
799 				    "no ire for dst %s\n",
800 				    AF_INET6, &inner_ip6h->ip6_dst);
801 			}
802 			freemsg(first_mp);
803 			return;
804 		}
805 		irb = ire->ire_bucket;
806 		ire_refrele(ire);
807 		rw_enter(&irb->irb_lock, RW_READER);
808 		for (ire = irb->irb_ire; ire != NULL; ire = ire->ire_next) {
809 			if (IN6_ARE_ADDR_EQUAL(&ire->ire_addr_v6,
810 				&inner_ip6h->ip6_dst)) {
811 				mtu = ntohl(icmp6->icmp6_mtu);
812 				mutex_enter(&ire->ire_lock);
813 				if (mtu < IPV6_MIN_MTU) {
814 					ip1dbg(("Received mtu less than IPv6"
815 						"min mtu %d: %d\n",
816 						IPV6_MIN_MTU, mtu));
817 					mtu = IPV6_MIN_MTU;
818 					/*
819 					 * If an mtu less than IPv6 min mtu is
820 					 * received, we must include a fragment
821 					 * header in subsequent packets.
822 					 */
823 					ire->ire_frag_flag |= IPH_FRAG_HDR;
824 				}
825 
826 				ip1dbg(("Received mtu from router: %d\n", mtu));
827 				ire->ire_max_frag = MIN(ire->ire_max_frag, mtu);
828 				/* Record the new max frag size for the ULP. */
829 				if (ire->ire_frag_flag & IPH_FRAG_HDR) {
830 					/*
831 					 * If we need a fragment header in
832 					 * every packet (above case or
833 					 * multirouting), make sure the ULP
834 					 * takes it into account when computing
835 					 * the payload size.
836 					 */
837 					icmp6->icmp6_mtu =
838 					    htonl(ire->ire_max_frag -
839 					    sizeof (ip6_frag_t));
840 				} else {
841 					icmp6->icmp6_mtu =
842 					    htonl(ire->ire_max_frag);
843 				}
844 				mutex_exit(&ire->ire_lock);
845 			}
846 		}
847 		rw_exit(&irb->irb_lock);
848 	}
849 	icmp_inbound_error_fanout_v6(q, first_mp, ip6h, icmp6, ill,
850 	    mctl_present, zoneid);
851 }
852 
853 static void
854 pkt_too_big(conn_t *connp, void *arg)
855 {
856 	mblk_t *mp;
857 
858 	if (!connp->conn_ipv6_recvpathmtu)
859 		return;
860 
861 	/* create message and drop it on this connections read queue */
862 	if ((mp = dupb((mblk_t *)arg)) == NULL) {
863 		return;
864 	}
865 	mp->b_datap->db_type = M_CTL;
866 
867 	putnext(connp->conn_rq, mp);
868 }
869 
870 /*
871  * Fanout received ICMPv6 error packets to the transports.
872  * Assumes the IPv6 plus ICMPv6 headers have been pulled up but nothing else.
873  */
874 void
875 icmp_inbound_error_fanout_v6(queue_t *q, mblk_t *mp, ip6_t *ip6h,
876     icmp6_t *icmp6, ill_t *ill, boolean_t mctl_present, zoneid_t zoneid)
877 {
878 	uint16_t *up;	/* Pointer to ports in ULP header */
879 	uint32_t ports;	/* reversed ports for fanout */
880 	ip6_t rip6h;	/* With reversed addresses */
881 	uint16_t	hdr_length;
882 	uint8_t		*nexthdrp;
883 	uint8_t		nexthdr;
884 	mblk_t *first_mp;
885 	ipsec_in_t *ii;
886 	tcpha_t	*tcpha;
887 	conn_t	*connp;
888 
889 	first_mp = mp;
890 	if (mctl_present) {
891 		mp = first_mp->b_cont;
892 		ASSERT(mp != NULL);
893 
894 		ii = (ipsec_in_t *)first_mp->b_rptr;
895 		ASSERT(ii->ipsec_in_type == IPSEC_IN);
896 	} else {
897 		ii = NULL;
898 	}
899 
900 	hdr_length = (uint16_t)((uchar_t *)icmp6 - (uchar_t *)ip6h);
901 	ASSERT((size_t)(mp->b_wptr - (uchar_t *)icmp6) >= ICMP6_MINLEN);
902 
903 	/*
904 	 * Need to pullup everything in order to use
905 	 * ip_hdr_length_nexthdr_v6()
906 	 */
907 	if (mp->b_cont != NULL) {
908 		if (!pullupmsg(mp, -1)) {
909 			ip1dbg(("icmp_inbound_error_fanout_v6: "
910 			    "pullupmsg failed\n"));
911 			goto drop_pkt;
912 		}
913 		ip6h = (ip6_t *)mp->b_rptr;
914 		icmp6 = (icmp6_t *)(&mp->b_rptr[hdr_length]);
915 	}
916 
917 	ip6h = (ip6_t *)&icmp6[1];	/* Packet in error */
918 	if ((uchar_t *)&ip6h[1] > mp->b_wptr)
919 		goto drop_pkt;
920 
921 	if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &hdr_length, &nexthdrp))
922 		goto drop_pkt;
923 	nexthdr = *nexthdrp;
924 
925 	/* Set message type, must be done after pullups */
926 	mp->b_datap->db_type = M_CTL;
927 
928 	if (icmp6->icmp6_type == ICMP6_PACKET_TOO_BIG) {
929 		/*
930 		 * Deliver indication of ICMP6_PACKET_TOO_BIG to interested
931 		 * sockets.
932 		 *
933 		 * Note I don't like walking every connection to deliver
934 		 * this information to a set of listeners.  A separate
935 		 * list could be kept to keep the cost of this down.
936 		 */
937 		ipcl_walk(pkt_too_big, (void *)mp);
938 	}
939 
940 	/* Try to pass the ICMP message to clients who need it */
941 	switch (nexthdr) {
942 	case IPPROTO_UDP: {
943 		/*
944 		 * Verify we have at least ICMP_MIN_TP_HDR_LEN bytes of
945 		 * UDP header to get the port information.
946 		 */
947 		if ((uchar_t *)ip6h + hdr_length + ICMP_MIN_TP_HDR_LEN >
948 		    mp->b_wptr) {
949 			break;
950 		}
951 		/*
952 		 * Attempt to find a client stream based on port.
953 		 * Note that we do a reverse lookup since the header is
954 		 * in the form we sent it out.
955 		 * The rip6h header is only used for the IPCL_UDP_MATCH_V6
956 		 * and we only set the src and dst addresses and nexthdr.
957 		 */
958 		up = (uint16_t *)((uchar_t *)ip6h + hdr_length);
959 		rip6h.ip6_src = ip6h->ip6_dst;
960 		rip6h.ip6_dst = ip6h->ip6_src;
961 		rip6h.ip6_nxt = nexthdr;
962 		((uint16_t *)&ports)[0] = up[1];
963 		((uint16_t *)&ports)[1] = up[0];
964 
965 		ip_fanout_udp_v6(q, first_mp, &rip6h, ports, ill, ill,
966 		    IP6_NO_IPPOLICY, mctl_present, zoneid);
967 		return;
968 	}
969 	case IPPROTO_TCP: {
970 		/*
971 		 * Verify we have at least ICMP_MIN_TP_HDR_LEN bytes of
972 		 * the TCP header to get the port information.
973 		 */
974 		if ((uchar_t *)ip6h + hdr_length + ICMP_MIN_TP_HDR_LEN >
975 		    mp->b_wptr) {
976 			break;
977 		}
978 
979 		/*
980 		 * Attempt to find a client stream based on port.
981 		 * Note that we do a reverse lookup since the header is
982 		 * in the form we sent it out.
983 		 * The rip6h header is only used for the IP_TCP_*MATCH_V6 and
984 		 * we only set the src and dst addresses and nexthdr.
985 		 */
986 
987 		tcpha = (tcpha_t *)((char *)ip6h + hdr_length);
988 		connp = ipcl_tcp_lookup_reversed_ipv6(ip6h, tcpha,
989 		    TCPS_LISTEN, ill->ill_phyint->phyint_ifindex);
990 		if (connp == NULL) {
991 			goto drop_pkt;
992 		}
993 
994 		squeue_fill(connp->conn_sqp, first_mp, tcp_input,
995 		    connp, SQTAG_TCP6_INPUT_ICMP_ERR);
996 		return;
997 
998 	}
999 	case IPPROTO_SCTP:
1000 		/*
1001 		 * Verify we have at least ICMP_MIN_TP_HDR_LEN bytes of
1002 		 * the SCTP header to get the port information.
1003 		 */
1004 		if ((uchar_t *)ip6h + hdr_length + ICMP_MIN_TP_HDR_LEN >
1005 		    mp->b_wptr) {
1006 			break;
1007 		}
1008 
1009 		up = (uint16_t *)((uchar_t *)ip6h + hdr_length);
1010 		((uint16_t *)&ports)[0] = up[1];
1011 		((uint16_t *)&ports)[1] = up[0];
1012 		ip_fanout_sctp(mp, ill, (ipha_t *)ip6h, ports, 0, mctl_present,
1013 		    IP6_NO_IPPOLICY, 0, zoneid);
1014 		return;
1015 	case IPPROTO_ESP:
1016 	case IPPROTO_AH: {
1017 		int ipsec_rc;
1018 
1019 		/*
1020 		 * We need a IPSEC_IN in the front to fanout to AH/ESP.
1021 		 * We will re-use the IPSEC_IN if it is already present as
1022 		 * AH/ESP will not affect any fields in the IPSEC_IN for
1023 		 * ICMP errors. If there is no IPSEC_IN, allocate a new
1024 		 * one and attach it in the front.
1025 		 */
1026 		if (ii != NULL) {
1027 			/*
1028 			 * ip_fanout_proto_again converts the ICMP errors
1029 			 * that come back from AH/ESP to M_DATA so that
1030 			 * if it is non-AH/ESP and we do a pullupmsg in
1031 			 * this function, it would work. Convert it back
1032 			 * to M_CTL before we send up as this is a ICMP
1033 			 * error. This could have been generated locally or
1034 			 * by some router. Validate the inner IPSEC
1035 			 * headers.
1036 			 *
1037 			 * NOTE : ill_index is used by ip_fanout_proto_again
1038 			 * to locate the ill.
1039 			 */
1040 			ASSERT(ill != NULL);
1041 			ii->ipsec_in_ill_index =
1042 			    ill->ill_phyint->phyint_ifindex;
1043 			ii->ipsec_in_rill_index = ii->ipsec_in_ill_index;
1044 			first_mp->b_cont->b_datap->db_type = M_CTL;
1045 		} else {
1046 			/*
1047 			 * IPSEC_IN is not present. We attach a ipsec_in
1048 			 * message and send up to IPSEC for validating
1049 			 * and removing the IPSEC headers. Clear
1050 			 * ipsec_in_secure so that when we return
1051 			 * from IPSEC, we don't mistakenly think that this
1052 			 * is a secure packet came from the network.
1053 			 *
1054 			 * NOTE : ill_index is used by ip_fanout_proto_again
1055 			 * to locate the ill.
1056 			 */
1057 			ASSERT(first_mp == mp);
1058 			first_mp = ipsec_in_alloc(B_FALSE);
1059 			if (first_mp == NULL) {
1060 				freemsg(mp);
1061 				BUMP_MIB(&ip_mib, ipInDiscards);
1062 				return;
1063 			}
1064 			ii = (ipsec_in_t *)first_mp->b_rptr;
1065 
1066 			/* This is not a secure packet */
1067 			ii->ipsec_in_secure = B_FALSE;
1068 			first_mp->b_cont = mp;
1069 			mp->b_datap->db_type = M_CTL;
1070 			ASSERT(ill != NULL);
1071 			ii->ipsec_in_ill_index =
1072 			    ill->ill_phyint->phyint_ifindex;
1073 			ii->ipsec_in_rill_index = ii->ipsec_in_ill_index;
1074 		}
1075 
1076 		if (!ipsec_loaded()) {
1077 			ip_proto_not_sup(q, first_mp, 0, zoneid);
1078 			return;
1079 		}
1080 
1081 		if (nexthdr == IPPROTO_ESP)
1082 			ipsec_rc = ipsecesp_icmp_error(first_mp);
1083 		else
1084 			ipsec_rc = ipsecah_icmp_error(first_mp);
1085 		if (ipsec_rc == IPSEC_STATUS_FAILED)
1086 			return;
1087 
1088 		ip_fanout_proto_again(first_mp, ill, ill, NULL);
1089 		return;
1090 	}
1091 	case IPPROTO_ENCAP:
1092 	case IPPROTO_IPV6:
1093 		if ((uint8_t *)ip6h + hdr_length +
1094 		    (nexthdr == IPPROTO_ENCAP ? sizeof (ipha_t) :
1095 			sizeof (ip6_t)) > mp->b_wptr)
1096 			goto drop_pkt;
1097 
1098 		if (nexthdr == IPPROTO_ENCAP ||
1099 		    !IN6_ARE_ADDR_EQUAL(
1100 			&((ip6_t *)(((uint8_t *)ip6h) + hdr_length))->ip6_src,
1101 			&ip6h->ip6_src) ||
1102 		    !IN6_ARE_ADDR_EQUAL(
1103 			&((ip6_t *)(((uint8_t *)ip6h) + hdr_length))->ip6_dst,
1104 			&ip6h->ip6_dst)) {
1105 			/*
1106 			 * For tunnels that have used IPsec protection,
1107 			 * we need to adjust the MTU to take into account
1108 			 * the IPsec overhead.
1109 			 */
1110 			if (ii != NULL)
1111 				icmp6->icmp6_mtu = htons(
1112 				    ntohs(icmp6->icmp6_mtu) -
1113 					ipsec_in_extra_length(first_mp));
1114 		} else {
1115 			/*
1116 			 * Self-encapsulated case. As in the ipv4 case,
1117 			 * we need to strip the 2nd IP header. Since mp
1118 			 * is already pulled-up, we can simply bcopy
1119 			 * the 3rd header + data over the 2nd header.
1120 			 */
1121 			uint16_t unused_len;
1122 			ip6_t *inner_ip6h = (ip6_t *)
1123 			    ((uchar_t *)ip6h + hdr_length);
1124 
1125 			/*
1126 			 * Make sure we don't do recursion more than once.
1127 			 */
1128 			if (!ip_hdr_length_nexthdr_v6(mp, inner_ip6h,
1129 			    &unused_len, &nexthdrp) ||
1130 			    *nexthdrp == IPPROTO_IPV6) {
1131 				goto drop_pkt;
1132 			}
1133 
1134 			/*
1135 			 * We are about to modify the packet. Make a copy if
1136 			 * someone else has a reference to it.
1137 			 */
1138 			if (DB_REF(mp) > 1) {
1139 				mblk_t	*mp1;
1140 				uint16_t icmp6_offset;
1141 
1142 				mp1 = copymsg(mp);
1143 				if (mp1 == NULL) {
1144 					goto drop_pkt;
1145 				}
1146 				icmp6_offset = (uint16_t)
1147 				    ((uchar_t *)icmp6 - mp->b_rptr);
1148 				freemsg(mp);
1149 				mp = mp1;
1150 
1151 				icmp6 = (icmp6_t *)(mp->b_rptr + icmp6_offset);
1152 				ip6h = (ip6_t *)&icmp6[1];
1153 				inner_ip6h = (ip6_t *)
1154 				    ((uchar_t *)ip6h + hdr_length);
1155 
1156 				if (mctl_present)
1157 					first_mp->b_cont = mp;
1158 				else
1159 					first_mp = mp;
1160 			}
1161 
1162 			/*
1163 			 * Need to set db_type back to M_DATA before
1164 			 * refeeding mp into this function.
1165 			 */
1166 			DB_TYPE(mp) = M_DATA;
1167 
1168 			/*
1169 			 * Copy the 3rd header + remaining data on top
1170 			 * of the 2nd header.
1171 			 */
1172 			bcopy(inner_ip6h, ip6h,
1173 			    mp->b_wptr - (uchar_t *)inner_ip6h);
1174 
1175 			/*
1176 			 * Subtract length of the 2nd header.
1177 			 */
1178 			mp->b_wptr -= hdr_length;
1179 
1180 			/*
1181 			 * Now recurse, and see what I _really_ should be
1182 			 * doing here.
1183 			 */
1184 			icmp_inbound_error_fanout_v6(q, first_mp,
1185 			    (ip6_t *)mp->b_rptr, icmp6, ill, mctl_present,
1186 			    zoneid);
1187 			return;
1188 		}
1189 		/* FALLTHRU */
1190 	default:
1191 		/*
1192 		 * The rip6h header is only used for the lookup and we
1193 		 * only set the src and dst addresses and nexthdr.
1194 		 */
1195 		rip6h.ip6_src = ip6h->ip6_dst;
1196 		rip6h.ip6_dst = ip6h->ip6_src;
1197 		rip6h.ip6_nxt = nexthdr;
1198 		ip_fanout_proto_v6(q, first_mp, &rip6h, ill, ill, nexthdr, 0,
1199 		    IP6_NO_IPPOLICY, mctl_present, zoneid);
1200 		return;
1201 	}
1202 	/* NOTREACHED */
1203 drop_pkt:
1204 	BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInErrors);
1205 	ip1dbg(("icmp_inbound_error_fanout_v6: drop pkt\n"));
1206 	freemsg(first_mp);
1207 }
1208 
1209 /*
1210  * Validate the incoming redirect message,  if valid redirect
1211  * processing is done later.  This is separated from the actual
1212  * redirect processing to avoid becoming single threaded when not
1213  * necessary. (i.e invalid packet)
1214  * Assumes that any AH or ESP headers have already been removed.
1215  * The mp has already been pulled up.
1216  */
1217 boolean_t
1218 icmp_redirect_ok_v6(ill_t *ill, mblk_t *mp)
1219 {
1220 	ip6_t		*ip6h = (ip6_t *)mp->b_rptr;
1221 	nd_redirect_t	*rd;
1222 	ire_t		*ire;
1223 	uint16_t	len;
1224 	uint16_t	hdr_length;
1225 
1226 	ASSERT(mp->b_cont == NULL);
1227 	if (ip6h->ip6_nxt != IPPROTO_ICMPV6)
1228 		hdr_length = ip_hdr_length_v6(mp, ip6h);
1229 	else
1230 		hdr_length = IPV6_HDR_LEN;
1231 	rd = (nd_redirect_t *)&mp->b_rptr[hdr_length];
1232 	len = mp->b_wptr - mp->b_rptr -  hdr_length;
1233 	if (!IN6_IS_ADDR_LINKLOCAL(&ip6h->ip6_src) ||
1234 	    (ip6h->ip6_hops != IPV6_MAX_HOPS) ||
1235 	    (rd->nd_rd_code != 0) ||
1236 	    (len < sizeof (nd_redirect_t)) ||
1237 	    (IN6_IS_ADDR_V4MAPPED(&rd->nd_rd_dst)) ||
1238 	    (IN6_IS_ADDR_MULTICAST(&rd->nd_rd_dst))) {
1239 		return (B_FALSE);
1240 	}
1241 	if (!(IN6_IS_ADDR_LINKLOCAL(&rd->nd_rd_target) ||
1242 	    IN6_ARE_ADDR_EQUAL(&rd->nd_rd_target, &rd->nd_rd_dst))) {
1243 		return (B_FALSE);
1244 	}
1245 
1246 	/*
1247 	 * Verify that the IP source address of the redirect is
1248 	 * the same as the current first-hop router for the specified
1249 	 * ICMP destination address.  Just to be cautious, this test
1250 	 * will be done again before we add the redirect, in case
1251 	 * router goes away between now and then.
1252 	 */
1253 	ire = ire_route_lookup_v6(&rd->nd_rd_dst, 0,
1254 	    &ip6h->ip6_src, 0, ill->ill_ipif, NULL, ALL_ZONES, NULL,
1255 	    MATCH_IRE_GW | MATCH_IRE_ILL_GROUP);
1256 	if (ire == NULL)
1257 		return (B_FALSE);
1258 	ire_refrele(ire);
1259 	if (len > sizeof (nd_redirect_t)) {
1260 		if (!ndp_verify_optlen((nd_opt_hdr_t *)&rd[1],
1261 		    len - sizeof (nd_redirect_t)))
1262 			return (B_FALSE);
1263 	}
1264 	return (B_TRUE);
1265 }
1266 
1267 /*
1268  * Process received IPv6 ICMP Redirect messages.
1269  * Assumes that the icmp packet has already been verfied to be
1270  * valid, aligned and in a single mblk all done in icmp_redirect_ok_v6().
1271  */
1272 /* ARGSUSED */
1273 static void
1274 icmp_redirect_v6(queue_t *q, mblk_t *mp, ill_t *ill)
1275 {
1276 	ip6_t		*ip6h;
1277 	uint16_t	hdr_length;
1278 	nd_redirect_t	*rd;
1279 	ire_t		*ire;
1280 	ire_t		*prev_ire;
1281 	ire_t		*redir_ire;
1282 	in6_addr_t	*src, *dst, *gateway;
1283 	nd_opt_hdr_t	*opt;
1284 	nce_t		*nce;
1285 	int		nce_flags = 0;
1286 	int		err = 0;
1287 	boolean_t	redirect_to_router = B_FALSE;
1288 	int		len;
1289 	iulp_t		ulp_info = { 0 };
1290 	ill_t		*prev_ire_ill;
1291 	ipif_t		*ipif;
1292 
1293 	ip6h = (ip6_t *)mp->b_rptr;
1294 	if (ip6h->ip6_nxt != IPPROTO_ICMPV6)
1295 		hdr_length = ip_hdr_length_v6(mp, ip6h);
1296 	else
1297 		hdr_length = IPV6_HDR_LEN;
1298 
1299 	rd = (nd_redirect_t *)&mp->b_rptr[hdr_length];
1300 	src = &ip6h->ip6_src;
1301 	dst = &rd->nd_rd_dst;
1302 	gateway = &rd->nd_rd_target;
1303 	if (!IN6_ARE_ADDR_EQUAL(gateway, dst)) {
1304 		redirect_to_router = B_TRUE;
1305 		nce_flags |= NCE_F_ISROUTER;
1306 	}
1307 	/*
1308 	 * Make sure we had a route for the dest in question and that
1309 	 * route was pointing to the old gateway (the source of the
1310 	 * redirect packet.)
1311 	 */
1312 	ipif = ipif_get_next_ipif(NULL, ill);
1313 	if (ipif == NULL) {
1314 		freemsg(mp);
1315 		return;
1316 	}
1317 	prev_ire = ire_route_lookup_v6(dst, 0, src, 0, ipif, NULL,
1318 	    ALL_ZONES, NULL, MATCH_IRE_GW | MATCH_IRE_ILL_GROUP);
1319 	ipif_refrele(ipif);
1320 	/*
1321 	 * Check that
1322 	 *	the redirect was not from ourselves
1323 	 *	old gateway is still directly reachable
1324 	 */
1325 	if (prev_ire == NULL ||
1326 	    prev_ire->ire_type == IRE_LOCAL) {
1327 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInBadRedirects);
1328 		goto fail_redirect;
1329 	}
1330 	prev_ire_ill = ire_to_ill(prev_ire);
1331 	ASSERT(prev_ire_ill != NULL);
1332 	if (prev_ire_ill->ill_flags & ILLF_NONUD)
1333 		nce_flags |= NCE_F_NONUD;
1334 
1335 	/*
1336 	 * Should we use the old ULP info to create the new gateway?  From
1337 	 * a user's perspective, we should inherit the info so that it
1338 	 * is a "smooth" transition.  If we do not do that, then new
1339 	 * connections going thru the new gateway will have no route metrics,
1340 	 * which is counter-intuitive to user.  From a network point of
1341 	 * view, this may or may not make sense even though the new gateway
1342 	 * is still directly connected to us so the route metrics should not
1343 	 * change much.
1344 	 *
1345 	 * But if the old ire_uinfo is not initialized, we do another
1346 	 * recursive lookup on the dest using the new gateway.  There may
1347 	 * be a route to that.  If so, use it to initialize the redirect
1348 	 * route.
1349 	 */
1350 	if (prev_ire->ire_uinfo.iulp_set) {
1351 		bcopy(&prev_ire->ire_uinfo, &ulp_info, sizeof (iulp_t));
1352 	} else if (redirect_to_router) {
1353 		/*
1354 		 * Only do the following if the redirection is really to
1355 		 * a router.
1356 		 */
1357 		ire_t *tmp_ire;
1358 		ire_t *sire;
1359 
1360 		tmp_ire = ire_ftable_lookup_v6(dst, 0, gateway, 0, NULL, &sire,
1361 		    ALL_ZONES, 0, NULL,
1362 		    (MATCH_IRE_RECURSIVE | MATCH_IRE_GW | MATCH_IRE_DEFAULT));
1363 		if (sire != NULL) {
1364 			bcopy(&sire->ire_uinfo, &ulp_info, sizeof (iulp_t));
1365 			ASSERT(tmp_ire != NULL);
1366 			ire_refrele(tmp_ire);
1367 			ire_refrele(sire);
1368 		} else if (tmp_ire != NULL) {
1369 			bcopy(&tmp_ire->ire_uinfo, &ulp_info,
1370 			    sizeof (iulp_t));
1371 			ire_refrele(tmp_ire);
1372 		}
1373 	}
1374 
1375 	len = mp->b_wptr - mp->b_rptr -  hdr_length - sizeof (nd_redirect_t);
1376 	opt = (nd_opt_hdr_t *)&rd[1];
1377 	opt = ndp_get_option(opt, len, ND_OPT_TARGET_LINKADDR);
1378 	if (opt != NULL) {
1379 		err = ndp_lookup_then_add(ill,
1380 		    (uchar_t *)&opt[1],		/* Link layer address */
1381 		    gateway,
1382 		    &ipv6_all_ones,		/* prefix mask */
1383 		    &ipv6_all_zeros,		/* Mapping mask */
1384 		    0,
1385 		    nce_flags,
1386 		    ND_STALE,
1387 		    &nce);
1388 		switch (err) {
1389 		case 0:
1390 			NCE_REFRELE(nce);
1391 			break;
1392 		case EEXIST:
1393 			/*
1394 			 * Check to see if link layer address has changed and
1395 			 * process the nce_state accordingly.
1396 			 */
1397 			ndp_process(nce, (uchar_t *)&opt[1], 0, B_FALSE);
1398 			NCE_REFRELE(nce);
1399 			break;
1400 		default:
1401 			ip1dbg(("icmp_redirect_v6: NCE create failed %d\n",
1402 			    err));
1403 			goto fail_redirect;
1404 		}
1405 	}
1406 	if (redirect_to_router) {
1407 		/* icmp_redirect_ok_v6() must  have already verified this  */
1408 		ASSERT(IN6_IS_ADDR_LINKLOCAL(gateway));
1409 
1410 		/*
1411 		 * Create a Route Association.  This will allow us to remember
1412 		 * a router told us to use the particular gateway.
1413 		 */
1414 		ire = ire_create_v6(
1415 		    dst,
1416 		    &ipv6_all_ones,		/* mask */
1417 		    &prev_ire->ire_src_addr_v6,	/* source addr */
1418 		    gateway,			/* gateway addr */
1419 		    &prev_ire->ire_max_frag,	/* max frag */
1420 		    NULL,			/* Fast Path header */
1421 		    NULL, 			/* no rfq */
1422 		    NULL,			/* no stq */
1423 		    IRE_HOST_REDIRECT,
1424 		    NULL,
1425 		    prev_ire->ire_ipif,
1426 		    NULL,
1427 		    0,
1428 		    0,
1429 		    (RTF_DYNAMIC | RTF_GATEWAY | RTF_HOST),
1430 		    &ulp_info,
1431 		    NULL,
1432 		    NULL);
1433 	} else {
1434 		/*
1435 		 * Just create an on link entry, may or may not be a router
1436 		 * If there is no link layer address option ire_add() won't
1437 		 * add this.
1438 		 */
1439 		ire = ire_create_v6(
1440 		    dst,				/* gateway == dst */
1441 		    &ipv6_all_ones,			/* mask */
1442 		    &prev_ire->ire_src_addr_v6,		/* source addr */
1443 		    &ipv6_all_zeros,			/* gateway addr */
1444 		    &prev_ire->ire_max_frag,		/* max frag */
1445 		    NULL,				/* Fast Path header */
1446 		    prev_ire->ire_rfq,			/* ire rfq */
1447 		    prev_ire->ire_stq,			/* ire stq */
1448 		    IRE_CACHE,
1449 		    NULL,
1450 		    prev_ire->ire_ipif,
1451 		    &ipv6_all_ones,
1452 		    0,
1453 		    0,
1454 		    0,
1455 		    &ulp_info,
1456 		    NULL,
1457 		    NULL);
1458 	}
1459 	if (ire == NULL)
1460 		goto fail_redirect;
1461 
1462 	/*
1463 	 * XXX If there is no nce i.e there is no target link layer address
1464 	 * option with the redirect message, ire_add will fail. In that
1465 	 * case we never add the IRE_CACHE/IRE_HOST_REDIRECT. We need
1466 	 * to fix this.
1467 	 */
1468 	if (ire_add(&ire, NULL, NULL, NULL) == 0) {
1469 
1470 		/* tell routing sockets that we received a redirect */
1471 		ip_rts_change_v6(RTM_REDIRECT,
1472 		    &rd->nd_rd_dst,
1473 		    &rd->nd_rd_target,
1474 		    &ipv6_all_ones, 0, &ire->ire_src_addr_v6,
1475 		    (RTF_DYNAMIC | RTF_GATEWAY | RTF_HOST), 0,
1476 		    (RTA_DST | RTA_GATEWAY | RTA_NETMASK | RTA_AUTHOR));
1477 
1478 		/*
1479 		 * Delete any existing IRE_HOST_REDIRECT for this destination.
1480 		 * This together with the added IRE has the effect of
1481 		 * modifying an existing redirect.
1482 		 */
1483 		redir_ire = ire_ftable_lookup_v6(dst, 0, src, IRE_HOST_REDIRECT,
1484 		    ire->ire_ipif, NULL, ALL_ZONES, 0, NULL,
1485 		    (MATCH_IRE_GW | MATCH_IRE_TYPE | MATCH_IRE_ILL_GROUP));
1486 
1487 		ire_refrele(ire);		/* Held in ire_add_v6 */
1488 
1489 		if (redir_ire != NULL) {
1490 			ire_delete(redir_ire);
1491 			ire_refrele(redir_ire);
1492 		}
1493 	}
1494 
1495 	if (prev_ire->ire_type == IRE_CACHE)
1496 		ire_delete(prev_ire);
1497 	ire_refrele(prev_ire);
1498 	prev_ire = NULL;
1499 
1500 fail_redirect:
1501 	if (prev_ire != NULL)
1502 		ire_refrele(prev_ire);
1503 	freemsg(mp);
1504 }
1505 
1506 static ill_t *
1507 ip_queue_to_ill_v6(queue_t *q)
1508 {
1509 	ill_t *ill;
1510 
1511 	ASSERT(WR(q) == q);
1512 
1513 	if (q->q_next != NULL) {
1514 		ill = (ill_t *)q->q_ptr;
1515 		if (ILL_CAN_LOOKUP(ill))
1516 			ill_refhold(ill);
1517 		else
1518 			ill = NULL;
1519 	} else {
1520 		ill = ill_lookup_on_name(ipif_loopback_name, B_FALSE, B_TRUE,
1521 		    NULL, NULL, NULL, NULL, NULL);
1522 	}
1523 	if (ill == NULL)
1524 		ip0dbg(("ip_queue_to_ill_v6: no ill\n"));
1525 	return (ill);
1526 }
1527 
1528 /*
1529  * Assigns an appropriate source address to the packet.
1530  * If origdst is one of our IP addresses that use it as the source.
1531  * If the queue is an ill queue then select a source from that ill.
1532  * Otherwise pick a source based on a route lookup back to the origsrc.
1533  *
1534  * src is the return parameter. Returns a pointer to src or NULL if failure.
1535  */
1536 static in6_addr_t *
1537 icmp_pick_source_v6(queue_t *wq, in6_addr_t *origsrc, in6_addr_t *origdst,
1538     in6_addr_t *src)
1539 {
1540 	ill_t	*ill;
1541 	ire_t	*ire;
1542 	ipif_t	*ipif;
1543 	zoneid_t	zoneid;
1544 
1545 	ASSERT(!(wq->q_flag & QREADR));
1546 	if (wq->q_next != NULL) {
1547 		ill = (ill_t *)wq->q_ptr;
1548 		zoneid = GLOBAL_ZONEID;
1549 	} else {
1550 		ill = NULL;
1551 		zoneid = Q_TO_CONN(wq)->conn_zoneid;
1552 	}
1553 
1554 	ire = ire_route_lookup_v6(origdst, 0, 0, (IRE_LOCAL|IRE_LOOPBACK),
1555 	    NULL, NULL, zoneid, NULL, (MATCH_IRE_TYPE|MATCH_IRE_ZONEONLY));
1556 	if (ire != NULL) {
1557 		/* Destined to one of our addresses */
1558 		*src = *origdst;
1559 		ire_refrele(ire);
1560 		return (src);
1561 	}
1562 	if (ire != NULL) {
1563 		ire_refrele(ire);
1564 		ire = NULL;
1565 	}
1566 	if (ill == NULL) {
1567 		/* What is the route back to the original source? */
1568 		ire = ire_route_lookup_v6(origsrc, 0, 0, 0,
1569 		    NULL, NULL, zoneid, NULL,
1570 		    (MATCH_IRE_DEFAULT|MATCH_IRE_RECURSIVE));
1571 		if (ire == NULL) {
1572 			BUMP_MIB(&ip6_mib, ipv6OutNoRoutes);
1573 			return (NULL);
1574 		}
1575 		/*
1576 		 * Does not matter whether we use ire_stq or ire_ipif here.
1577 		 * Just pick an ill for ICMP replies.
1578 		 */
1579 		ASSERT(ire->ire_ipif != NULL);
1580 		ill = ire->ire_ipif->ipif_ill;
1581 		ire_refrele(ire);
1582 	}
1583 	ipif = ipif_select_source_v6(ill, origsrc, B_FALSE,
1584 	    IPV6_PREFER_SRC_DEFAULT, zoneid);
1585 	if (ipif != NULL) {
1586 		*src = ipif->ipif_v6src_addr;
1587 		ipif_refrele(ipif);
1588 		return (src);
1589 	}
1590 	/*
1591 	 * Unusual case - can't find a usable source address to reach the
1592 	 * original source. Use what in the route to the source.
1593 	 */
1594 	ire = ire_route_lookup_v6(origsrc, 0, 0, 0,
1595 	    NULL, NULL, zoneid, NULL,
1596 	    (MATCH_IRE_DEFAULT|MATCH_IRE_RECURSIVE));
1597 	if (ire == NULL) {
1598 		BUMP_MIB(&ip6_mib, ipv6OutNoRoutes);
1599 		return (NULL);
1600 	}
1601 	ASSERT(ire != NULL);
1602 	*src = ire->ire_src_addr_v6;
1603 	ire_refrele(ire);
1604 	return (src);
1605 }
1606 
1607 /*
1608  * Build and ship an IPv6 ICMP message using the packet data in mp,
1609  * and the ICMP header pointed to by "stuff".  (May be called as
1610  * writer.)
1611  * Note: assumes that icmp_pkt_err_ok_v6 has been called to
1612  * verify that an icmp error packet can be sent.
1613  *
1614  * If q is an ill write side queue (which is the case when packets
1615  * arrive from ip_rput) then ip_wput code will ensure that packets to
1616  * link-local destinations are sent out that ill.
1617  *
1618  * If v6src_ptr is set use it as a source. Otherwise select a reasonable
1619  * source address (see above function).
1620  */
1621 static void
1622 icmp_pkt_v6(queue_t *q, mblk_t *mp, void *stuff, size_t len,
1623     const in6_addr_t *v6src_ptr, boolean_t mctl_present)
1624 {
1625 	ip6_t		*ip6h;
1626 	in6_addr_t	v6dst;
1627 	size_t		len_needed;
1628 	size_t		msg_len;
1629 	mblk_t		*mp1;
1630 	icmp6_t		*icmp6;
1631 	ill_t		*ill;
1632 	in6_addr_t	v6src;
1633 	mblk_t *ipsec_mp;
1634 	ipsec_out_t *io;
1635 
1636 	ill = ip_queue_to_ill_v6(q);
1637 	if (ill == NULL) {
1638 		freemsg(mp);
1639 		return;
1640 	}
1641 
1642 	if (mctl_present) {
1643 		/*
1644 		 * If it is :
1645 		 *
1646 		 * 1) a IPSEC_OUT, then this is caused by outbound
1647 		 *    datagram originating on this host. IPSEC processing
1648 		 *    may or may not have been done. Refer to comments above
1649 		 *    icmp_inbound_error_fanout for details.
1650 		 *
1651 		 * 2) a IPSEC_IN if we are generating a icmp_message
1652 		 *    for an incoming datagram destined for us i.e called
1653 		 *    from ip_fanout_send_icmp.
1654 		 */
1655 		ipsec_info_t *in;
1656 
1657 		ipsec_mp = mp;
1658 		mp = ipsec_mp->b_cont;
1659 
1660 		in = (ipsec_info_t *)ipsec_mp->b_rptr;
1661 		ip6h = (ip6_t *)mp->b_rptr;
1662 
1663 		ASSERT(in->ipsec_info_type == IPSEC_OUT ||
1664 		    in->ipsec_info_type == IPSEC_IN);
1665 
1666 		if (in->ipsec_info_type == IPSEC_IN) {
1667 			/*
1668 			 * Convert the IPSEC_IN to IPSEC_OUT.
1669 			 */
1670 			if (!ipsec_in_to_out(ipsec_mp, NULL, ip6h)) {
1671 				BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
1672 				ill_refrele(ill);
1673 				return;
1674 			}
1675 		} else {
1676 			ASSERT(in->ipsec_info_type == IPSEC_OUT);
1677 			io = (ipsec_out_t *)in;
1678 			/*
1679 			 * Clear out ipsec_out_proc_begin, so we do a fresh
1680 			 * ire lookup.
1681 			 */
1682 			io->ipsec_out_proc_begin = B_FALSE;
1683 		}
1684 	} else {
1685 		/*
1686 		 * This is in clear. The icmp message we are building
1687 		 * here should go out in clear.
1688 		 */
1689 		ipsec_in_t *ii;
1690 		ASSERT(mp->b_datap->db_type == M_DATA);
1691 		if ((ipsec_mp = ipsec_in_alloc(B_FALSE)) == NULL) {
1692 			freemsg(mp);
1693 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
1694 			ill_refrele(ill);
1695 			return;
1696 		}
1697 		ii = (ipsec_in_t *)ipsec_mp->b_rptr;
1698 
1699 		/* This is not a secure packet */
1700 		ii->ipsec_in_secure = B_FALSE;
1701 		ipsec_mp->b_cont = mp;
1702 		ip6h = (ip6_t *)mp->b_rptr;
1703 		/*
1704 		 * Convert the IPSEC_IN to IPSEC_OUT.
1705 		 */
1706 		if (!ipsec_in_to_out(ipsec_mp, NULL, ip6h)) {
1707 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
1708 			ill_refrele(ill);
1709 			return;
1710 		}
1711 	}
1712 	io = (ipsec_out_t *)ipsec_mp->b_rptr;
1713 
1714 	if (v6src_ptr != NULL) {
1715 		v6src = *v6src_ptr;
1716 	} else {
1717 		if (icmp_pick_source_v6(q, &ip6h->ip6_src, &ip6h->ip6_dst,
1718 		    &v6src) == NULL) {
1719 			freemsg(ipsec_mp);
1720 			ill_refrele(ill);
1721 			return;
1722 		}
1723 	}
1724 	v6dst = ip6h->ip6_src;
1725 	len_needed = ipv6_icmp_return - IPV6_HDR_LEN - len;
1726 	msg_len = msgdsize(mp);
1727 	if (msg_len > len_needed) {
1728 		if (!adjmsg(mp, len_needed - msg_len)) {
1729 			BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutErrors);
1730 			freemsg(ipsec_mp);
1731 			ill_refrele(ill);
1732 			return;
1733 		}
1734 		msg_len = len_needed;
1735 	}
1736 	mp1 = allocb(IPV6_HDR_LEN + len, BPRI_HI);
1737 	if (mp1 == NULL) {
1738 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutErrors);
1739 		freemsg(ipsec_mp);
1740 		ill_refrele(ill);
1741 		return;
1742 	}
1743 	ill_refrele(ill);
1744 	mp1->b_cont = mp;
1745 	mp = mp1;
1746 	ASSERT(ipsec_mp->b_datap->db_type == M_CTL &&
1747 	    io->ipsec_out_type == IPSEC_OUT);
1748 	ipsec_mp->b_cont = mp;
1749 
1750 	/*
1751 	 * Set ipsec_out_icmp_loopback so we can let the ICMP messages this
1752 	 * node generates be accepted in peace by all on-host destinations.
1753 	 * If we do NOT assume that all on-host destinations trust
1754 	 * self-generated ICMP messages, then rework here, ip.c, and spd.c.
1755 	 * (Look for ipsec_out_icmp_loopback).
1756 	 */
1757 	io->ipsec_out_icmp_loopback = B_TRUE;
1758 
1759 	ip6h = (ip6_t *)mp->b_rptr;
1760 	mp1->b_wptr = (uchar_t *)ip6h + (IPV6_HDR_LEN + len);
1761 
1762 	ip6h->ip6_vcf = IPV6_DEFAULT_VERS_AND_FLOW;
1763 	ip6h->ip6_nxt = IPPROTO_ICMPV6;
1764 	ip6h->ip6_hops = ipv6_def_hops;
1765 	ip6h->ip6_dst = v6dst;
1766 	ip6h->ip6_src = v6src;
1767 	msg_len += IPV6_HDR_LEN + len;
1768 	if (msg_len > IP_MAXPACKET + IPV6_HDR_LEN) {
1769 		(void) adjmsg(mp, IP_MAXPACKET + IPV6_HDR_LEN - msg_len);
1770 		msg_len = IP_MAXPACKET + IPV6_HDR_LEN;
1771 	}
1772 	ip6h->ip6_plen = htons((uint16_t)(msgdsize(mp) - IPV6_HDR_LEN));
1773 	icmp6 = (icmp6_t *)&ip6h[1];
1774 	bcopy(stuff, (char *)icmp6, len);
1775 	/*
1776 	 * Prepare for checksum by putting icmp length in the icmp
1777 	 * checksum field. The checksum is calculated in ip_wput_v6.
1778 	 */
1779 	icmp6->icmp6_cksum = ip6h->ip6_plen;
1780 	if (icmp6->icmp6_type == ND_REDIRECT) {
1781 		ip6h->ip6_hops = IPV6_MAX_HOPS;
1782 	}
1783 	/* Send to V6 writeside put routine */
1784 	put(q, ipsec_mp);
1785 }
1786 
1787 /*
1788  * Update the output mib when ICMPv6 packets are sent.
1789  */
1790 static void
1791 icmp_update_out_mib_v6(ill_t *ill, icmp6_t *icmp6)
1792 {
1793 	BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutMsgs);
1794 
1795 	switch (icmp6->icmp6_type) {
1796 	case ICMP6_DST_UNREACH:
1797 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutDestUnreachs);
1798 		if (icmp6->icmp6_code == ICMP6_DST_UNREACH_ADMIN)
1799 			BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutAdminProhibs);
1800 		break;
1801 
1802 	case ICMP6_TIME_EXCEEDED:
1803 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutTimeExcds);
1804 		break;
1805 
1806 	case ICMP6_PARAM_PROB:
1807 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutParmProblems);
1808 		break;
1809 
1810 	case ICMP6_PACKET_TOO_BIG:
1811 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutPktTooBigs);
1812 		break;
1813 
1814 	case ICMP6_ECHO_REQUEST:
1815 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutEchos);
1816 		break;
1817 
1818 	case ICMP6_ECHO_REPLY:
1819 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutEchoReplies);
1820 		break;
1821 
1822 	case ND_ROUTER_SOLICIT:
1823 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutRouterSolicits);
1824 		break;
1825 
1826 	case ND_ROUTER_ADVERT:
1827 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutRouterAdvertisements);
1828 		break;
1829 
1830 	case ND_NEIGHBOR_SOLICIT:
1831 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutNeighborSolicits);
1832 		break;
1833 
1834 	case ND_NEIGHBOR_ADVERT:
1835 		BUMP_MIB(ill->ill_icmp6_mib,
1836 		    ipv6IfIcmpOutNeighborAdvertisements);
1837 		break;
1838 
1839 	case ND_REDIRECT:
1840 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutRedirects);
1841 		break;
1842 
1843 	case MLD_LISTENER_QUERY:
1844 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutGroupMembQueries);
1845 		break;
1846 
1847 	case MLD_LISTENER_REPORT:
1848 	case MLD_V2_LISTENER_REPORT:
1849 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutGroupMembResponses);
1850 		break;
1851 
1852 	case MLD_LISTENER_REDUCTION:
1853 		BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpOutGroupMembReductions);
1854 		break;
1855 	}
1856 }
1857 
1858 /*
1859  * Check if it is ok to send an ICMPv6 error packet in
1860  * response to the IP packet in mp.
1861  * Free the message and return null if no
1862  * ICMP error packet should be sent.
1863  */
1864 static mblk_t *
1865 icmp_pkt_err_ok_v6(queue_t *q, mblk_t *mp,
1866     boolean_t llbcast, boolean_t mcast_ok)
1867 {
1868 	ip6_t	*ip6h;
1869 
1870 	if (!mp)
1871 		return (NULL);
1872 
1873 	ip6h = (ip6_t *)mp->b_rptr;
1874 
1875 	/* Check if source address uniquely identifies the host */
1876 
1877 	if (IN6_IS_ADDR_MULTICAST(&ip6h->ip6_src) ||
1878 	    IN6_IS_ADDR_V4MAPPED(&ip6h->ip6_src) ||
1879 	    IN6_IS_ADDR_UNSPECIFIED(&ip6h->ip6_src)) {
1880 		freemsg(mp);
1881 		return (NULL);
1882 	}
1883 
1884 	if (ip6h->ip6_nxt == IPPROTO_ICMPV6) {
1885 		size_t	len_needed = IPV6_HDR_LEN + ICMP6_MINLEN;
1886 		icmp6_t		*icmp6;
1887 
1888 		if (mp->b_wptr - mp->b_rptr < len_needed) {
1889 			if (!pullupmsg(mp, len_needed)) {
1890 				ill_t	*ill;
1891 
1892 				ill = ip_queue_to_ill_v6(q);
1893 				if (ill == NULL) {
1894 					BUMP_MIB(&icmp6_mib,
1895 					    ipv6IfIcmpInErrors);
1896 				} else {
1897 					BUMP_MIB(ill->ill_icmp6_mib,
1898 					    ipv6IfIcmpInErrors);
1899 					ill_refrele(ill);
1900 				}
1901 				freemsg(mp);
1902 				return (NULL);
1903 			}
1904 			ip6h = (ip6_t *)mp->b_rptr;
1905 		}
1906 		icmp6 = (icmp6_t *)&ip6h[1];
1907 		/* Explicitly do not generate errors in response to redirects */
1908 		if (ICMP6_IS_ERROR(icmp6->icmp6_type) ||
1909 		    icmp6->icmp6_type == ND_REDIRECT) {
1910 			freemsg(mp);
1911 			return (NULL);
1912 		}
1913 	}
1914 	/*
1915 	 * Check that the destination is not multicast and that the packet
1916 	 * was not sent on link layer broadcast or multicast.  (Exception
1917 	 * is Packet too big message as per the draft - when mcast_ok is set.)
1918 	 */
1919 	if (!mcast_ok &&
1920 	    (llbcast || IN6_IS_ADDR_MULTICAST(&ip6h->ip6_dst))) {
1921 		freemsg(mp);
1922 		return (NULL);
1923 	}
1924 	if (icmp_err_rate_limit()) {
1925 		/*
1926 		 * Only send ICMP error packets every so often.
1927 		 * This should be done on a per port/source basis,
1928 		 * but for now this will suffice.
1929 		 */
1930 		freemsg(mp);
1931 		return (NULL);
1932 	}
1933 	return (mp);
1934 }
1935 
1936 /*
1937  * Generate an ICMPv6 redirect message.
1938  * Include target link layer address option if it exits.
1939  * Always include redirect header.
1940  */
1941 static void
1942 icmp_send_redirect_v6(queue_t *q, mblk_t *mp, in6_addr_t *targetp,
1943     in6_addr_t *dest, ill_t *ill, boolean_t llbcast)
1944 {
1945 	nd_redirect_t	*rd;
1946 	nd_opt_rd_hdr_t	*rdh;
1947 	uchar_t		*buf;
1948 	nce_t		*nce = NULL;
1949 	nd_opt_hdr_t	*opt;
1950 	int		len;
1951 	int		ll_opt_len = 0;
1952 	int		max_redir_hdr_data_len;
1953 	int		pkt_len;
1954 	in6_addr_t	*srcp;
1955 
1956 	/*
1957 	 * We are called from ip_rput where we could
1958 	 * not have attached an IPSEC_IN.
1959 	 */
1960 	ASSERT(mp->b_datap->db_type == M_DATA);
1961 
1962 	mp = icmp_pkt_err_ok_v6(q, mp, llbcast, B_FALSE);
1963 	if (mp == NULL)
1964 		return;
1965 	nce = ndp_lookup(ill, targetp, B_FALSE);
1966 	if (nce != NULL && nce->nce_state != ND_INCOMPLETE) {
1967 		ll_opt_len = (sizeof (nd_opt_hdr_t) +
1968 		    ill->ill_phys_addr_length + 7)/8 * 8;
1969 	}
1970 	len = sizeof (nd_redirect_t) + sizeof (nd_opt_rd_hdr_t) + ll_opt_len;
1971 	ASSERT(len % 4 == 0);
1972 	buf = kmem_alloc(len, KM_NOSLEEP);
1973 	if (buf == NULL) {
1974 		if (nce != NULL)
1975 			NCE_REFRELE(nce);
1976 		freemsg(mp);
1977 		return;
1978 	}
1979 
1980 	rd = (nd_redirect_t *)buf;
1981 	rd->nd_rd_type = (uint8_t)ND_REDIRECT;
1982 	rd->nd_rd_code = 0;
1983 	rd->nd_rd_reserved = 0;
1984 	rd->nd_rd_target = *targetp;
1985 	rd->nd_rd_dst = *dest;
1986 
1987 	opt = (nd_opt_hdr_t *)(buf + sizeof (nd_redirect_t));
1988 	if (nce != NULL && ll_opt_len != 0) {
1989 		opt->nd_opt_type = ND_OPT_TARGET_LINKADDR;
1990 		opt->nd_opt_len = ll_opt_len/8;
1991 		bcopy((char *)nce->nce_res_mp->b_rptr +
1992 		    NCE_LL_ADDR_OFFSET(ill), &opt[1],
1993 		    ill->ill_phys_addr_length);
1994 	}
1995 	if (nce != NULL)
1996 		NCE_REFRELE(nce);
1997 	rdh = (nd_opt_rd_hdr_t *)(buf + sizeof (nd_redirect_t) + ll_opt_len);
1998 	rdh->nd_opt_rh_type = (uint8_t)ND_OPT_REDIRECTED_HEADER;
1999 	/* max_redir_hdr_data_len and nd_opt_rh_len must be multiple of 8 */
2000 	max_redir_hdr_data_len = (ipv6_icmp_return - IPV6_HDR_LEN - len)/8*8;
2001 	pkt_len = msgdsize(mp);
2002 	/* Make sure mp is 8 byte aligned */
2003 	if (pkt_len > max_redir_hdr_data_len) {
2004 		rdh->nd_opt_rh_len = (max_redir_hdr_data_len +
2005 		    sizeof (nd_opt_rd_hdr_t))/8;
2006 		(void) adjmsg(mp, max_redir_hdr_data_len - pkt_len);
2007 	} else {
2008 		rdh->nd_opt_rh_len = (pkt_len + sizeof (nd_opt_rd_hdr_t))/8;
2009 		(void) adjmsg(mp, -(pkt_len % 8));
2010 	}
2011 	rdh->nd_opt_rh_reserved1 = 0;
2012 	rdh->nd_opt_rh_reserved2 = 0;
2013 	/* ipif_v6src_addr contains the link-local source address */
2014 	rw_enter(&ill_g_lock, RW_READER);
2015 	if (ill->ill_group != NULL) {
2016 		/*
2017 		 * The receiver of the redirect will verify whether it
2018 		 * had a route through us (srcp that we will use in
2019 		 * the redirect) or not. As we load spread even link-locals,
2020 		 * we don't know which source address the receiver of
2021 		 * redirect has in its route for communicating with us.
2022 		 * Thus we randomly choose a source here and finally we
2023 		 * should get to the right one and it will eventually
2024 		 * accept the redirect from us. We can't call
2025 		 * ip_lookup_scope_v6 because we don't have the right
2026 		 * link-local address here. Thus we randomly choose one.
2027 		 */
2028 		int cnt = ill->ill_group->illgrp_ill_count;
2029 
2030 		ill = ill->ill_group->illgrp_ill;
2031 		cnt = ++icmp_redirect_v6_src_index % cnt;
2032 		while (cnt--)
2033 			ill = ill->ill_group_next;
2034 		srcp = &ill->ill_ipif->ipif_v6src_addr;
2035 	} else {
2036 		srcp = &ill->ill_ipif->ipif_v6src_addr;
2037 	}
2038 	rw_exit(&ill_g_lock);
2039 	icmp_pkt_v6(q, mp, buf, len, srcp, B_FALSE);
2040 	kmem_free(buf, len);
2041 }
2042 
2043 
2044 /* Generate an ICMP time exceeded message.  (May be called as writer.) */
2045 void
2046 icmp_time_exceeded_v6(queue_t *q, mblk_t *mp, uint8_t code,
2047     boolean_t llbcast, boolean_t mcast_ok)
2048 {
2049 	icmp6_t	icmp6;
2050 	boolean_t mctl_present;
2051 	mblk_t *first_mp;
2052 
2053 	EXTRACT_PKT_MP(mp, first_mp, mctl_present);
2054 
2055 	mp = icmp_pkt_err_ok_v6(q, mp, llbcast, mcast_ok);
2056 	if (mp == NULL) {
2057 		if (mctl_present)
2058 			freeb(first_mp);
2059 		return;
2060 	}
2061 	bzero(&icmp6, sizeof (icmp6_t));
2062 	icmp6.icmp6_type = ICMP6_TIME_EXCEEDED;
2063 	icmp6.icmp6_code = code;
2064 	icmp_pkt_v6(q, first_mp, &icmp6, sizeof (icmp6_t), NULL, mctl_present);
2065 }
2066 
2067 /*
2068  * Generate an ICMP unreachable message.
2069  */
2070 void
2071 icmp_unreachable_v6(queue_t *q, mblk_t *mp, uint8_t code,
2072     boolean_t llbcast, boolean_t mcast_ok)
2073 {
2074 	icmp6_t	icmp6;
2075 	boolean_t mctl_present;
2076 	mblk_t *first_mp;
2077 
2078 	EXTRACT_PKT_MP(mp, first_mp, mctl_present);
2079 
2080 	mp = icmp_pkt_err_ok_v6(q, mp, llbcast, mcast_ok);
2081 	if (mp == NULL) {
2082 		if (mctl_present)
2083 			freeb(first_mp);
2084 		return;
2085 	}
2086 	bzero(&icmp6, sizeof (icmp6_t));
2087 	icmp6.icmp6_type = ICMP6_DST_UNREACH;
2088 	icmp6.icmp6_code = code;
2089 	icmp_pkt_v6(q, first_mp, &icmp6, sizeof (icmp6_t), NULL, mctl_present);
2090 }
2091 
2092 /*
2093  * Generate an ICMP pkt too big message.
2094  */
2095 static void
2096 icmp_pkt2big_v6(queue_t *q, mblk_t *mp, uint32_t mtu,
2097     boolean_t llbcast, boolean_t mcast_ok)
2098 {
2099 	icmp6_t	icmp6;
2100 	mblk_t *first_mp;
2101 	boolean_t mctl_present;
2102 
2103 	EXTRACT_PKT_MP(mp, first_mp, mctl_present);
2104 
2105 	mp = icmp_pkt_err_ok_v6(q, mp, llbcast, mcast_ok);
2106 	if (mp == NULL) {
2107 		if (mctl_present)
2108 			freeb(first_mp);
2109 		return;
2110 	}
2111 	bzero(&icmp6, sizeof (icmp6_t));
2112 	icmp6.icmp6_type = ICMP6_PACKET_TOO_BIG;
2113 	icmp6.icmp6_code = 0;
2114 	icmp6.icmp6_mtu = htonl(mtu);
2115 
2116 	icmp_pkt_v6(q, first_mp, &icmp6, sizeof (icmp6_t), NULL, mctl_present);
2117 }
2118 
2119 /*
2120  * Generate an ICMP parameter problem message. (May be called as writer.)
2121  * 'offset' is the offset from the beginning of the packet in error.
2122  */
2123 static void
2124 icmp_param_problem_v6(queue_t *q, mblk_t *mp, uint8_t code,
2125     uint32_t offset, boolean_t llbcast, boolean_t mcast_ok)
2126 {
2127 	icmp6_t	icmp6;
2128 	boolean_t mctl_present;
2129 	mblk_t *first_mp;
2130 
2131 	EXTRACT_PKT_MP(mp, first_mp, mctl_present);
2132 
2133 	mp = icmp_pkt_err_ok_v6(q, mp, llbcast, mcast_ok);
2134 	if (mp == NULL) {
2135 		if (mctl_present)
2136 			freeb(first_mp);
2137 		return;
2138 	}
2139 	bzero((char *)&icmp6, sizeof (icmp6_t));
2140 	icmp6.icmp6_type = ICMP6_PARAM_PROB;
2141 	icmp6.icmp6_code = code;
2142 	icmp6.icmp6_pptr = htonl(offset);
2143 	icmp_pkt_v6(q, first_mp, &icmp6, sizeof (icmp6_t), NULL, mctl_present);
2144 }
2145 
2146 /*
2147  * This code will need to take into account the possibility of binding
2148  * to a link local address on a multi-homed host, in which case the
2149  * outgoing interface (from the conn) will need to be used when getting
2150  * an ire for the dst. Going through proper outgoing interface and
2151  * choosing the source address corresponding to the outgoing interface
2152  * is necessary when the destination address is a link-local address and
2153  * IPV6_BOUND_IF or IPV6_PKTINFO or scope_id has been set.
2154  * This can happen when active connection is setup; thus ipp pointer
2155  * is passed here from tcp_connect_*() routines, in non-TCP cases NULL
2156  * pointer is passed as ipp pointer.
2157  */
2158 mblk_t *
2159 ip_bind_v6(queue_t *q, mblk_t *mp, conn_t *connp, ip6_pkt_t *ipp)
2160 {
2161 	ssize_t			len;
2162 	int			protocol;
2163 	struct T_bind_req	*tbr;
2164 	sin6_t			*sin6;
2165 	ipa6_conn_t		*ac6;
2166 	in6_addr_t		*v6srcp;
2167 	in6_addr_t		*v6dstp;
2168 	uint16_t		lport;
2169 	uint16_t		fport;
2170 	uchar_t			*ucp;
2171 	mblk_t			*mp1;
2172 	boolean_t		ire_requested;
2173 	boolean_t		ipsec_policy_set;
2174 	int			error = 0;
2175 	boolean_t		local_bind;
2176 	boolean_t		orig_pkt_isv6 = connp->conn_pkt_isv6;
2177 	ipa6_conn_x_t		*acx6;
2178 	boolean_t		verify_dst;
2179 
2180 	ASSERT(connp->conn_af_isv6);
2181 	len = mp->b_wptr - mp->b_rptr;
2182 	if (len < (sizeof (*tbr) + 1)) {
2183 		(void) mi_strlog(q, 1, SL_ERROR|SL_TRACE,
2184 		    "ip_bind_v6: bogus msg, len %ld", len);
2185 		goto bad_addr;
2186 	}
2187 	/* Back up and extract the protocol identifier. */
2188 	mp->b_wptr--;
2189 	tbr = (struct T_bind_req *)mp->b_rptr;
2190 	/* Reset the message type in preparation for shipping it back. */
2191 	mp->b_datap->db_type = M_PCPROTO;
2192 
2193 	protocol = *mp->b_wptr & 0xFF;
2194 	connp->conn_ulp = (uint8_t)protocol;
2195 
2196 	/*
2197 	 * Check for a zero length address.  This is from a protocol that
2198 	 * wants to register to receive all packets of its type.
2199 	 */
2200 	if (tbr->ADDR_length == 0) {
2201 		if ((protocol == IPPROTO_TCP || protocol == IPPROTO_SCTP ||
2202 		    protocol == IPPROTO_ESP || protocol == IPPROTO_AH) &&
2203 		    ipcl_proto_fanout_v6[protocol].connf_head != NULL) {
2204 			/*
2205 			 * TCP, SCTP, AH, and ESP have single protocol fanouts.
2206 			 * Do not allow others to bind to these.
2207 			 */
2208 			goto bad_addr;
2209 		}
2210 
2211 		/*
2212 		 *
2213 		 * The udp module never sends down a zero-length address,
2214 		 * and allowing this on a labeled system will break MLP
2215 		 * functionality.
2216 		 */
2217 		if (is_system_labeled() && protocol == IPPROTO_UDP)
2218 			goto bad_addr;
2219 
2220 		/* Allow ipsec plumbing */
2221 		if (connp->conn_mac_exempt && protocol != IPPROTO_AH &&
2222 		    protocol != IPPROTO_ESP)
2223 			goto bad_addr;
2224 
2225 		connp->conn_srcv6 = ipv6_all_zeros;
2226 		ipcl_proto_insert_v6(connp, protocol);
2227 
2228 		tbr->PRIM_type = T_BIND_ACK;
2229 		return (mp);
2230 	}
2231 
2232 	/* Extract the address pointer from the message. */
2233 	ucp = (uchar_t *)mi_offset_param(mp, tbr->ADDR_offset,
2234 	    tbr->ADDR_length);
2235 	if (ucp == NULL) {
2236 		ip1dbg(("ip_bind_v6: no address\n"));
2237 		goto bad_addr;
2238 	}
2239 	if (!OK_32PTR(ucp)) {
2240 		ip1dbg(("ip_bind_v6: unaligned address\n"));
2241 		goto bad_addr;
2242 	}
2243 	mp1 = mp->b_cont;	/* trailing mp if any */
2244 	ire_requested = (mp1 && mp1->b_datap->db_type == IRE_DB_REQ_TYPE);
2245 	ipsec_policy_set = (mp1 && mp1->b_datap->db_type == IPSEC_POLICY_SET);
2246 
2247 	switch (tbr->ADDR_length) {
2248 	default:
2249 		ip1dbg(("ip_bind_v6: bad address length %d\n",
2250 		    (int)tbr->ADDR_length));
2251 		goto bad_addr;
2252 
2253 	case IPV6_ADDR_LEN:
2254 		/* Verification of local address only */
2255 		v6srcp = (in6_addr_t *)ucp;
2256 		lport = 0;
2257 		local_bind = B_TRUE;
2258 		break;
2259 
2260 	case sizeof (sin6_t):
2261 		sin6 = (sin6_t *)ucp;
2262 		v6srcp = &sin6->sin6_addr;
2263 		lport = sin6->sin6_port;
2264 		local_bind = B_TRUE;
2265 		break;
2266 
2267 	case sizeof (ipa6_conn_t):
2268 		/*
2269 		 * Verify that both the source and destination addresses
2270 		 * are valid.
2271 		 * Note that we allow connect to broadcast and multicast
2272 		 * addresses when ire_requested is set. Thus the ULP
2273 		 * has to check for IRE_BROADCAST and multicast.
2274 		 */
2275 		ac6 = (ipa6_conn_t *)ucp;
2276 		v6srcp = &ac6->ac6_laddr;
2277 		v6dstp = &ac6->ac6_faddr;
2278 		fport = ac6->ac6_fport;
2279 		/* For raw socket, the local port is not set. */
2280 		lport = ac6->ac6_lport != 0 ? ac6->ac6_lport :
2281 		    connp->conn_lport;
2282 		local_bind = B_FALSE;
2283 		/* Always verify destination reachability. */
2284 		verify_dst = B_TRUE;
2285 		break;
2286 
2287 	case sizeof (ipa6_conn_x_t):
2288 		/*
2289 		 * Verify that the source address is valid.
2290 		 * Note that we allow connect to broadcast and multicast
2291 		 * addresses when ire_requested is set. Thus the ULP
2292 		 * has to check for IRE_BROADCAST and multicast.
2293 		 */
2294 		acx6 = (ipa6_conn_x_t *)ucp;
2295 		ac6 = &acx6->ac6x_conn;
2296 		v6srcp = &ac6->ac6_laddr;
2297 		v6dstp = &ac6->ac6_faddr;
2298 		fport = ac6->ac6_fport;
2299 		lport = ac6->ac6_lport;
2300 		local_bind = B_FALSE;
2301 		/*
2302 		 * Client that passed ipa6_conn_x_t to us specifies whether to
2303 		 * verify destination reachability.
2304 		 */
2305 		verify_dst = (acx6->ac6x_flags & ACX_VERIFY_DST) != 0;
2306 		break;
2307 	}
2308 	if (local_bind) {
2309 		if (IN6_IS_ADDR_V4MAPPED(v6srcp) && !connp->conn_ipv6_v6only) {
2310 			/* Bind to IPv4 address */
2311 			ipaddr_t v4src;
2312 
2313 			IN6_V4MAPPED_TO_IPADDR(v6srcp, v4src);
2314 
2315 			error = ip_bind_laddr(connp, mp, v4src, lport,
2316 			    ire_requested, ipsec_policy_set,
2317 			    tbr->ADDR_length != IPV6_ADDR_LEN);
2318 			if (error != 0)
2319 				goto bad_addr;
2320 			connp->conn_pkt_isv6 = B_FALSE;
2321 		} else {
2322 			if (IN6_IS_ADDR_V4MAPPED(v6srcp)) {
2323 				error = 0;
2324 				goto bad_addr;
2325 			}
2326 			error = ip_bind_laddr_v6(connp, mp, v6srcp, lport,
2327 			    ire_requested, ipsec_policy_set,
2328 			    (tbr->ADDR_length != IPV6_ADDR_LEN));
2329 			if (error != 0)
2330 				goto bad_addr;
2331 			connp->conn_pkt_isv6 = B_TRUE;
2332 		}
2333 		if (protocol == IPPROTO_TCP)
2334 			connp->conn_recv = tcp_conn_request;
2335 	} else {
2336 		/*
2337 		 * Bind to local and remote address. Local might be
2338 		 * unspecified in which case it will be extracted from
2339 		 * ire_src_addr_v6
2340 		 */
2341 		if (IN6_IS_ADDR_V4MAPPED(v6dstp) && !connp->conn_ipv6_v6only) {
2342 			/* Connect to IPv4 address */
2343 			ipaddr_t v4src;
2344 			ipaddr_t v4dst;
2345 
2346 			/* Is the source unspecified or mapped? */
2347 			if (!IN6_IS_ADDR_V4MAPPED(v6srcp) &&
2348 			    !IN6_IS_ADDR_UNSPECIFIED(v6srcp)) {
2349 				ip1dbg(("ip_bind_v6: "
2350 				    "dst is mapped, but not the src\n"));
2351 				goto bad_addr;
2352 			}
2353 			IN6_V4MAPPED_TO_IPADDR(v6srcp, v4src);
2354 			IN6_V4MAPPED_TO_IPADDR(v6dstp, v4dst);
2355 
2356 			/*
2357 			 * XXX Fix needed. Need to pass ipsec_policy_set
2358 			 * instead of B_FALSE.
2359 			 */
2360 
2361 			/* Always verify destination reachability. */
2362 			error = ip_bind_connected(connp, mp, &v4src, lport,
2363 			    v4dst, fport, ire_requested, ipsec_policy_set,
2364 			    B_TRUE, B_TRUE);
2365 			if (error != 0)
2366 				goto bad_addr;
2367 			IN6_IPADDR_TO_V4MAPPED(v4src, v6srcp);
2368 			connp->conn_pkt_isv6 = B_FALSE;
2369 		} else if (IN6_IS_ADDR_V4MAPPED(v6srcp)) {
2370 			ip1dbg(("ip_bind_v6: "
2371 			    "src is mapped, but not the dst\n"));
2372 			goto bad_addr;
2373 		} else {
2374 			error = ip_bind_connected_v6(connp, mp, v6srcp,
2375 			    lport, v6dstp, ipp, fport, ire_requested,
2376 			    ipsec_policy_set, B_TRUE, verify_dst);
2377 			if (error != 0)
2378 				goto bad_addr;
2379 			connp->conn_pkt_isv6 = B_TRUE;
2380 		}
2381 		if (protocol == IPPROTO_TCP)
2382 			connp->conn_recv = tcp_input;
2383 	}
2384 	/* Update qinfo if v4/v6 changed */
2385 	if ((orig_pkt_isv6 != connp->conn_pkt_isv6) &&
2386 	    !(IPCL_IS_TCP(connp) || IPCL_IS_UDP(connp))) {
2387 		if (connp->conn_pkt_isv6)
2388 			ip_setqinfo(RD(q), IPV6_MINOR, B_TRUE);
2389 		else
2390 			ip_setqinfo(RD(q), IPV4_MINOR, B_TRUE);
2391 	}
2392 
2393 	/*
2394 	 * Pass the IPSEC headers size in ire_ipsec_overhead.
2395 	 * We can't do this in ip_bind_insert_ire because the policy
2396 	 * may not have been inherited at that point in time and hence
2397 	 * conn_out_enforce_policy may not be set.
2398 	 */
2399 	mp1 = mp->b_cont;
2400 	if (ire_requested && connp->conn_out_enforce_policy &&
2401 	    mp1 != NULL && DB_TYPE(mp1) == IRE_DB_REQ_TYPE) {
2402 		ire_t *ire = (ire_t *)mp1->b_rptr;
2403 		ASSERT(MBLKL(mp1) >= sizeof (ire_t));
2404 		ire->ire_ipsec_overhead = (conn_ipsec_length(connp));
2405 	}
2406 
2407 	/* Send it home. */
2408 	mp->b_datap->db_type = M_PCPROTO;
2409 	tbr->PRIM_type = T_BIND_ACK;
2410 	return (mp);
2411 
2412 bad_addr:
2413 	if (error == EINPROGRESS)
2414 		return (NULL);
2415 	if (error > 0)
2416 		mp = mi_tpi_err_ack_alloc(mp, TSYSERR, error);
2417 	else
2418 		mp = mi_tpi_err_ack_alloc(mp, TBADADDR, 0);
2419 	return (mp);
2420 }
2421 
2422 /*
2423  * Here address is verified to be a valid local address.
2424  * If the IRE_DB_REQ_TYPE mp is present, a multicast
2425  * address is also considered a valid local address.
2426  * In the case of a multicast address, however, the
2427  * upper protocol is expected to reset the src address
2428  * to 0 if it sees an ire with IN6_IS_ADDR_MULTICAST returned so that
2429  * no packets are emitted with multicast address as
2430  * source address.
2431  * The addresses valid for bind are:
2432  *	(1) - in6addr_any
2433  *	(2) - IP address of an UP interface
2434  *	(3) - IP address of a DOWN interface
2435  *	(4) - a multicast address. In this case
2436  *	the conn will only receive packets destined to
2437  *	the specified multicast address. Note: the
2438  *	application still has to issue an
2439  *	IPV6_JOIN_GROUP socket option.
2440  *
2441  * In all the above cases, the bound address must be valid in the current zone.
2442  * When the address is loopback or multicast, there might be many matching IREs
2443  * so bind has to look up based on the zone.
2444  */
2445 static int
2446 ip_bind_laddr_v6(conn_t *connp, mblk_t *mp, const in6_addr_t *v6src,
2447     uint16_t lport, boolean_t ire_requested, boolean_t ipsec_policy_set,
2448     boolean_t fanout_insert)
2449 {
2450 	int		error = 0;
2451 	ire_t		*src_ire = NULL;
2452 	ipif_t		*ipif = NULL;
2453 	mblk_t		*policy_mp;
2454 	zoneid_t	zoneid;
2455 
2456 	if (ipsec_policy_set)
2457 		policy_mp = mp->b_cont;
2458 
2459 	/*
2460 	 * If it was previously connected, conn_fully_bound would have
2461 	 * been set.
2462 	 */
2463 	connp->conn_fully_bound = B_FALSE;
2464 
2465 	zoneid = connp->conn_zoneid;
2466 
2467 	if (!IN6_IS_ADDR_UNSPECIFIED(v6src)) {
2468 		src_ire = ire_route_lookup_v6(v6src, 0, 0,
2469 		    0, NULL, NULL, zoneid, NULL, MATCH_IRE_ZONEONLY);
2470 		/*
2471 		 * If an address other than in6addr_any is requested,
2472 		 * we verify that it is a valid address for bind
2473 		 * Note: Following code is in if-else-if form for
2474 		 * readability compared to a condition check.
2475 		 */
2476 		ASSERT(src_ire == NULL || !(src_ire->ire_type & IRE_BROADCAST));
2477 		if (IRE_IS_LOCAL(src_ire)) {
2478 			/*
2479 			 * (2) Bind to address of local UP interface
2480 			 */
2481 			ipif = src_ire->ire_ipif;
2482 		} else if (IN6_IS_ADDR_MULTICAST(v6src)) {
2483 			ipif_t	*multi_ipif = NULL;
2484 			ire_t	*save_ire;
2485 			/*
2486 			 * (4) bind to multicast address.
2487 			 * Fake out the IRE returned to upper
2488 			 * layer to be a broadcast IRE in
2489 			 * ip_bind_insert_ire_v6().
2490 			 * Pass other information that matches
2491 			 * the ipif (e.g. the source address).
2492 			 * conn_multicast_ill is only used for
2493 			 * IPv6 packets
2494 			 */
2495 			mutex_enter(&connp->conn_lock);
2496 			if (connp->conn_multicast_ill != NULL) {
2497 				(void) ipif_lookup_zoneid(
2498 				    connp->conn_multicast_ill, zoneid, 0,
2499 				    &multi_ipif);
2500 			} else {
2501 				/*
2502 				 * Look for default like
2503 				 * ip_wput_v6
2504 				 */
2505 				multi_ipif = ipif_lookup_group_v6(
2506 				    &ipv6_unspecified_group, zoneid);
2507 			}
2508 			mutex_exit(&connp->conn_lock);
2509 			save_ire = src_ire;
2510 			src_ire = NULL;
2511 			if (multi_ipif == NULL || !ire_requested ||
2512 			    (src_ire = ipif_to_ire_v6(multi_ipif)) == NULL) {
2513 				src_ire = save_ire;
2514 				error = EADDRNOTAVAIL;
2515 			} else {
2516 				ASSERT(src_ire != NULL);
2517 				if (save_ire != NULL)
2518 					ire_refrele(save_ire);
2519 			}
2520 			if (multi_ipif != NULL)
2521 				ipif_refrele(multi_ipif);
2522 		} else {
2523 			*mp->b_wptr++ = (char)connp->conn_ulp;
2524 			ipif = ipif_lookup_addr_v6(v6src, NULL, zoneid,
2525 			    CONNP_TO_WQ(connp), mp, ip_wput_nondata, &error);
2526 			if (ipif == NULL) {
2527 				if (error == EINPROGRESS) {
2528 					if (src_ire != NULL)
2529 						ire_refrele(src_ire);
2530 					return (error);
2531 				}
2532 				/*
2533 				 * Not a valid address for bind
2534 				 */
2535 				error = EADDRNOTAVAIL;
2536 			} else {
2537 				ipif_refrele(ipif);
2538 			}
2539 			/*
2540 			 * Just to keep it consistent with the processing in
2541 			 * ip_bind_v6().
2542 			 */
2543 			mp->b_wptr--;
2544 		}
2545 
2546 		if (error != 0) {
2547 			/* Red Alert!  Attempting to be a bogon! */
2548 			if (ip_debug > 2) {
2549 				/* ip1dbg */
2550 				pr_addr_dbg("ip_bind_laddr_v6: bad src"
2551 				    " address %s\n", AF_INET6, v6src);
2552 			}
2553 			goto bad_addr;
2554 		}
2555 	}
2556 
2557 	/*
2558 	 * Allow setting new policies. For example, disconnects come
2559 	 * down as ipa_t bind. As we would have set conn_policy_cached
2560 	 * to B_TRUE before, we should set it to B_FALSE, so that policy
2561 	 * can change after the disconnect.
2562 	 */
2563 	connp->conn_policy_cached = B_FALSE;
2564 
2565 	/* If not fanout_insert this was just an address verification */
2566 	if (fanout_insert) {
2567 		/*
2568 		 * The addresses have been verified. Time to insert in
2569 		 * the correct fanout list.
2570 		 */
2571 		connp->conn_srcv6 = *v6src;
2572 		connp->conn_remv6 = ipv6_all_zeros;
2573 		connp->conn_lport = lport;
2574 		connp->conn_fport = 0;
2575 		error = ipcl_bind_insert_v6(connp, *mp->b_wptr, v6src, lport);
2576 	}
2577 	if (error == 0) {
2578 		if (ire_requested) {
2579 			if (!ip_bind_insert_ire_v6(mp, src_ire, v6src, NULL)) {
2580 				error = -1;
2581 				goto bad_addr;
2582 			}
2583 		} else if (ipsec_policy_set) {
2584 			if (!ip_bind_ipsec_policy_set(connp, policy_mp)) {
2585 				error = -1;
2586 				goto bad_addr;
2587 			}
2588 		}
2589 	}
2590 bad_addr:
2591 	if (error != 0) {
2592 		if (connp->conn_anon_port) {
2593 			(void) tsol_mlp_anon(crgetzone(connp->conn_cred),
2594 			    connp->conn_mlp_type, connp->conn_ulp, ntohs(lport),
2595 			    B_FALSE);
2596 		}
2597 		connp->conn_mlp_type = mlptSingle;
2598 	}
2599 
2600 	if (src_ire != NULL)
2601 		ire_refrele(src_ire);
2602 
2603 	if (ipsec_policy_set) {
2604 		ASSERT(policy_mp != NULL);
2605 		freeb(policy_mp);
2606 		/*
2607 		 * As of now assume that nothing else accompanies
2608 		 * IPSEC_POLICY_SET.
2609 		 */
2610 		mp->b_cont = NULL;
2611 	}
2612 	return (error);
2613 }
2614 
2615 /* ARGSUSED */
2616 static void
2617 ip_bind_connected_resume_v6(ipsq_t *ipsq, queue_t *q, mblk_t *mp,
2618     void *dummy_arg)
2619 {
2620 	conn_t	*connp = NULL;
2621 	t_scalar_t prim;
2622 
2623 	ASSERT(DB_TYPE(mp) == M_PROTO || DB_TYPE(mp) == M_PCPROTO);
2624 
2625 	if (CONN_Q(q))
2626 		connp = Q_TO_CONN(q);
2627 	ASSERT(connp != NULL);
2628 
2629 	prim = ((union T_primitives *)mp->b_rptr)->type;
2630 	ASSERT(prim == O_T_BIND_REQ || prim == T_BIND_REQ);
2631 
2632 	if (IPCL_IS_TCP(connp)) {
2633 		/* Pass sticky_ipp for scope_id and pktinfo */
2634 		mp = ip_bind_v6(q, mp, connp, &connp->conn_tcp->tcp_sticky_ipp);
2635 	} else {
2636 		/* For UDP and ICMP */
2637 		mp = ip_bind_v6(q, mp, connp, NULL);
2638 	}
2639 	if (mp != NULL) {
2640 		if (IPCL_IS_TCP(connp)) {
2641 			CONN_INC_REF(connp);
2642 			squeue_fill(connp->conn_sqp, mp, ip_resume_tcp_bind,
2643 			    connp, SQTAG_TCP_RPUTOTHER);
2644 		} else if (IPCL_IS_UDP(connp)) {
2645 			udp_resume_bind(connp, mp);
2646 		} else {
2647 			qreply(q, mp);
2648 			CONN_OPER_PENDING_DONE(connp);
2649 		}
2650 	}
2651 }
2652 
2653 /*
2654  * Verify that both the source and destination addresses
2655  * are valid.  If verify_dst, then destination address must also be reachable,
2656  * i.e. have a route.  Protocols like TCP want this.  Tunnels do not.
2657  * It takes ip6_pkt_t * as one of the arguments to determine correct
2658  * source address when IPV6_PKTINFO or scope_id is set along with a link-local
2659  * destination address. Note that parameter ipp is only useful for TCP connect
2660  * when scope_id is set or IPV6_PKTINFO option is set with an ifindex. For all
2661  * non-TCP cases, it is NULL and for all other tcp cases it is not useful.
2662  *
2663  */
2664 static int
2665 ip_bind_connected_v6(conn_t *connp, mblk_t *mp, in6_addr_t *v6src,
2666     uint16_t lport, const in6_addr_t *v6dst, ip6_pkt_t *ipp, uint16_t fport,
2667     boolean_t ire_requested, boolean_t ipsec_policy_set,
2668     boolean_t fanout_insert, boolean_t verify_dst)
2669 {
2670 	ire_t		*src_ire;
2671 	ire_t		*dst_ire;
2672 	int		error = 0;
2673 	int 		protocol;
2674 	mblk_t		*policy_mp;
2675 	ire_t		*sire = NULL;
2676 	ire_t		*md_dst_ire = NULL;
2677 	ill_t		*md_ill = NULL;
2678 	ill_t 		*dst_ill = NULL;
2679 	ipif_t		*src_ipif = NULL;
2680 	zoneid_t	zoneid;
2681 	boolean_t ill_held = B_FALSE;
2682 
2683 	src_ire = dst_ire = NULL;
2684 	/*
2685 	 * NOTE:  The protocol is beyond the wptr because that's how
2686 	 * the undocumented transport<-->IP T_BIND_REQ behavior works.
2687 	 */
2688 	protocol = *mp->b_wptr & 0xFF;
2689 
2690 	/*
2691 	 * If we never got a disconnect before, clear it now.
2692 	 */
2693 	connp->conn_fully_bound = B_FALSE;
2694 
2695 	if (ipsec_policy_set) {
2696 		policy_mp = mp->b_cont;
2697 	}
2698 
2699 	zoneid = connp->conn_zoneid;
2700 
2701 	if (IN6_IS_ADDR_MULTICAST(v6dst)) {
2702 		ipif_t *ipif;
2703 
2704 		/*
2705 		 * Use an "emulated" IRE_BROADCAST to tell the transport it
2706 		 * is a multicast.
2707 		 * Pass other information that matches
2708 		 * the ipif (e.g. the source address).
2709 		 *
2710 		 * conn_multicast_ill is only used for IPv6 packets
2711 		 */
2712 		mutex_enter(&connp->conn_lock);
2713 		if (connp->conn_multicast_ill != NULL) {
2714 			(void) ipif_lookup_zoneid(connp->conn_multicast_ill,
2715 			    zoneid, 0, &ipif);
2716 		} else {
2717 			/* Look for default like ip_wput_v6 */
2718 			ipif = ipif_lookup_group_v6(v6dst, zoneid);
2719 		}
2720 		mutex_exit(&connp->conn_lock);
2721 		if (ipif == NULL || !ire_requested ||
2722 		    (dst_ire = ipif_to_ire_v6(ipif)) == NULL) {
2723 			if (ipif != NULL)
2724 				ipif_refrele(ipif);
2725 			if (ip_debug > 2) {
2726 				/* ip1dbg */
2727 				pr_addr_dbg("ip_bind_connected_v6: bad "
2728 				    "connected multicast %s\n", AF_INET6,
2729 				    v6dst);
2730 			}
2731 			error = ENETUNREACH;
2732 			goto bad_addr;
2733 		}
2734 		if (ipif != NULL)
2735 			ipif_refrele(ipif);
2736 	} else {
2737 		dst_ire = ire_route_lookup_v6(v6dst, NULL, NULL, 0,
2738 		    NULL, &sire, zoneid, MBLK_GETLABEL(mp),
2739 		    MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT |
2740 		    MATCH_IRE_PARENT | MATCH_IRE_RJ_BHOLE | MATCH_IRE_SECATTR);
2741 		/*
2742 		 * We also prevent ire's with src address INADDR_ANY to
2743 		 * be used, which are created temporarily for
2744 		 * sending out packets from endpoints that have
2745 		 * conn_unspec_src set.
2746 		 */
2747 		if (dst_ire == NULL ||
2748 		    (dst_ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) ||
2749 		    IN6_IS_ADDR_UNSPECIFIED(&dst_ire->ire_src_addr_v6)) {
2750 			/*
2751 			 * When verifying destination reachability, we always
2752 			 * complain.
2753 			 *
2754 			 * When not verifying destination reachability but we
2755 			 * found an IRE, i.e. the destination is reachable,
2756 			 * then the other tests still apply and we complain.
2757 			 */
2758 			if (verify_dst || (dst_ire != NULL)) {
2759 				if (ip_debug > 2) {
2760 					/* ip1dbg */
2761 					pr_addr_dbg("ip_bind_connected_v6: bad"
2762 					    " connected dst %s\n", AF_INET6,
2763 					    v6dst);
2764 				}
2765 				if (dst_ire == NULL ||
2766 				    !(dst_ire->ire_type & IRE_HOST)) {
2767 					error = ENETUNREACH;
2768 				} else {
2769 					error = EHOSTUNREACH;
2770 				}
2771 				goto bad_addr;
2772 			}
2773 		}
2774 	}
2775 
2776 	/*
2777 	 * We now know that routing will allow us to reach the destination.
2778 	 * Check whether Trusted Solaris policy allows communication with this
2779 	 * host, and pretend that the destination is unreachable if not.
2780 	 *
2781 	 * This is never a problem for TCP, since that transport is known to
2782 	 * compute the label properly as part of the tcp_rput_other T_BIND_ACK
2783 	 * handling.  If the remote is unreachable, it will be detected at that
2784 	 * point, so there's no reason to check it here.
2785 	 *
2786 	 * Note that for sendto (and other datagram-oriented friends), this
2787 	 * check is done as part of the data path label computation instead.
2788 	 * The check here is just to make non-TCP connect() report the right
2789 	 * error.
2790 	 */
2791 	if (dst_ire != NULL && is_system_labeled() &&
2792 	    !IPCL_IS_TCP(connp) &&
2793 	    tsol_compute_label_v6(DB_CREDDEF(mp, connp->conn_cred), v6dst, NULL,
2794 	    connp->conn_mac_exempt) != 0) {
2795 		error = EHOSTUNREACH;
2796 		if (ip_debug > 2) {
2797 			pr_addr_dbg("ip_bind_connected: no label for dst %s\n",
2798 			    AF_INET6, v6dst);
2799 		}
2800 		goto bad_addr;
2801 	}
2802 
2803 	/*
2804 	 * If the app does a connect(), it means that it will most likely
2805 	 * send more than 1 packet to the destination.  It makes sense
2806 	 * to clear the temporary flag.
2807 	 */
2808 	if (dst_ire != NULL && dst_ire->ire_type == IRE_CACHE &&
2809 	    (dst_ire->ire_marks & IRE_MARK_TEMPORARY)) {
2810 		irb_t *irb = dst_ire->ire_bucket;
2811 
2812 		rw_enter(&irb->irb_lock, RW_WRITER);
2813 		dst_ire->ire_marks &= ~IRE_MARK_TEMPORARY;
2814 		irb->irb_tmp_ire_cnt--;
2815 		rw_exit(&irb->irb_lock);
2816 	}
2817 
2818 	ASSERT(dst_ire == NULL || dst_ire->ire_ipversion == IPV6_VERSION);
2819 
2820 	/*
2821 	 * See if we should notify ULP about MDT; we do this whether or not
2822 	 * ire_requested is TRUE, in order to handle active connects; MDT
2823 	 * eligibility tests for passive connects are handled separately
2824 	 * through tcp_adapt_ire().  We do this before the source address
2825 	 * selection, because dst_ire may change after a call to
2826 	 * ipif_select_source_v6().  This is a best-effort check, as the
2827 	 * packet for this connection may not actually go through
2828 	 * dst_ire->ire_stq, and the exact IRE can only be known after
2829 	 * calling ip_newroute_v6().  This is why we further check on the
2830 	 * IRE during Multidata packet transmission in tcp_multisend().
2831 	 */
2832 	if (ip_multidata_outbound && !ipsec_policy_set && dst_ire != NULL &&
2833 	    !(dst_ire->ire_type & (IRE_LOCAL | IRE_LOOPBACK | IRE_BROADCAST)) &&
2834 	    (md_ill = ire_to_ill(dst_ire), md_ill != NULL) &&
2835 	    ILL_MDT_CAPABLE(md_ill)) {
2836 		md_dst_ire = dst_ire;
2837 		IRE_REFHOLD(md_dst_ire);
2838 	}
2839 
2840 	if (dst_ire != NULL &&
2841 	    dst_ire->ire_type == IRE_LOCAL &&
2842 	    dst_ire->ire_zoneid != zoneid &&
2843 	    dst_ire->ire_zoneid != ALL_ZONES) {
2844 		src_ire = ire_ftable_lookup_v6(v6dst, 0, 0, 0, NULL, NULL,
2845 		    zoneid, 0, NULL,
2846 		    MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT |
2847 		    MATCH_IRE_RJ_BHOLE);
2848 		if (src_ire == NULL) {
2849 			error = EHOSTUNREACH;
2850 			goto bad_addr;
2851 		} else if (src_ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) {
2852 			if (!(src_ire->ire_type & IRE_HOST))
2853 				error = ENETUNREACH;
2854 			else
2855 				error = EHOSTUNREACH;
2856 			goto bad_addr;
2857 		}
2858 		if (IN6_IS_ADDR_UNSPECIFIED(v6src)) {
2859 			src_ipif = src_ire->ire_ipif;
2860 			ipif_refhold(src_ipif);
2861 			*v6src = src_ipif->ipif_v6lcl_addr;
2862 		}
2863 		ire_refrele(src_ire);
2864 		src_ire = NULL;
2865 	} else if (IN6_IS_ADDR_UNSPECIFIED(v6src) && dst_ire != NULL) {
2866 		if ((sire != NULL) && (sire->ire_flags & RTF_SETSRC)) {
2867 			*v6src = sire->ire_src_addr_v6;
2868 			ire_refrele(dst_ire);
2869 			dst_ire = sire;
2870 			sire = NULL;
2871 		} else if (dst_ire->ire_type == IRE_CACHE &&
2872 		    (dst_ire->ire_flags & RTF_SETSRC)) {
2873 			ASSERT(dst_ire->ire_zoneid == zoneid ||
2874 			    dst_ire->ire_zoneid == ALL_ZONES);
2875 			*v6src = dst_ire->ire_src_addr_v6;
2876 		} else {
2877 			/*
2878 			 * Pick a source address so that a proper inbound load
2879 			 * spreading would happen. Use dst_ill specified by the
2880 			 * app. when socket option or scopeid is set.
2881 			 */
2882 			int  err;
2883 
2884 			if (ipp != NULL && ipp->ipp_ifindex != 0) {
2885 				uint_t	if_index;
2886 
2887 				/*
2888 				 * Scope id or IPV6_PKTINFO
2889 				 */
2890 
2891 				if_index = ipp->ipp_ifindex;
2892 				dst_ill = ill_lookup_on_ifindex(
2893 				    if_index, B_TRUE, NULL, NULL, NULL, NULL);
2894 				if (dst_ill == NULL) {
2895 					ip1dbg(("ip_bind_connected_v6:"
2896 					    " bad ifindex %d\n", if_index));
2897 					error = EADDRNOTAVAIL;
2898 					goto bad_addr;
2899 				}
2900 				ill_held = B_TRUE;
2901 			} else if (connp->conn_outgoing_ill != NULL) {
2902 				/*
2903 				 * For IPV6_BOUND_IF socket option,
2904 				 * conn_outgoing_ill should be set
2905 				 * already in TCP or UDP/ICMP.
2906 				 */
2907 				dst_ill = conn_get_held_ill(connp,
2908 				    &connp->conn_outgoing_ill, &err);
2909 				if (err == ILL_LOOKUP_FAILED) {
2910 					ip1dbg(("ip_bind_connected_v6:"
2911 					    "no ill for bound_if\n"));
2912 					error = EADDRNOTAVAIL;
2913 					goto bad_addr;
2914 				}
2915 				ill_held = B_TRUE;
2916 			} else if (dst_ire->ire_stq != NULL) {
2917 				/* No need to hold ill here */
2918 				dst_ill = (ill_t *)dst_ire->ire_stq->q_ptr;
2919 			} else {
2920 				/* No need to hold ill here */
2921 				dst_ill = dst_ire->ire_ipif->ipif_ill;
2922 			}
2923 			if (!ip6_asp_can_lookup()) {
2924 				*mp->b_wptr++ = (char)protocol;
2925 				ip6_asp_pending_op(CONNP_TO_WQ(connp), mp,
2926 				    ip_bind_connected_resume_v6);
2927 				error = EINPROGRESS;
2928 				goto refrele_and_quit;
2929 			}
2930 			src_ipif = ipif_select_source_v6(dst_ill, v6dst,
2931 			    B_FALSE, connp->conn_src_preferences, zoneid);
2932 			ip6_asp_table_refrele();
2933 			if (src_ipif == NULL) {
2934 				pr_addr_dbg("ip_bind_connected_v6: "
2935 				    "no usable source address for "
2936 				    "connection to %s\n", AF_INET6, v6dst);
2937 				error = EADDRNOTAVAIL;
2938 				goto bad_addr;
2939 			}
2940 			*v6src = src_ipif->ipif_v6lcl_addr;
2941 		}
2942 	}
2943 
2944 	/*
2945 	 * We do ire_route_lookup_v6() here (and not an interface lookup)
2946 	 * as we assert that v6src should only come from an
2947 	 * UP interface for hard binding.
2948 	 */
2949 	src_ire = ire_route_lookup_v6(v6src, 0, 0, 0, NULL,
2950 	    NULL, zoneid, NULL, MATCH_IRE_ZONEONLY);
2951 
2952 	/* src_ire must be a local|loopback */
2953 	if (!IRE_IS_LOCAL(src_ire)) {
2954 		if (ip_debug > 2) {
2955 			/* ip1dbg */
2956 			pr_addr_dbg("ip_bind_connected_v6: bad "
2957 			    "connected src %s\n", AF_INET6, v6src);
2958 		}
2959 		error = EADDRNOTAVAIL;
2960 		goto bad_addr;
2961 	}
2962 
2963 	/*
2964 	 * If the source address is a loopback address, the
2965 	 * destination had best be local or multicast.
2966 	 * The transports that can't handle multicast will reject
2967 	 * those addresses.
2968 	 */
2969 	if (src_ire->ire_type == IRE_LOOPBACK &&
2970 	    !(IRE_IS_LOCAL(dst_ire) || IN6_IS_ADDR_MULTICAST(v6dst) ||
2971 	    IN6_IS_ADDR_V4MAPPED_CLASSD(v6dst))) {
2972 		ip1dbg(("ip_bind_connected_v6: bad connected loopback\n"));
2973 		error = -1;
2974 		goto bad_addr;
2975 	}
2976 	/*
2977 	 * Allow setting new policies. For example, disconnects come
2978 	 * down as ipa_t bind. As we would have set conn_policy_cached
2979 	 * to B_TRUE before, we should set it to B_FALSE, so that policy
2980 	 * can change after the disconnect.
2981 	 */
2982 	connp->conn_policy_cached = B_FALSE;
2983 
2984 	/*
2985 	 * The addresses have been verified. Initialize the conn
2986 	 * before calling the policy as they expect the conns
2987 	 * initialized.
2988 	 */
2989 	connp->conn_srcv6 = *v6src;
2990 	connp->conn_remv6 = *v6dst;
2991 	connp->conn_lport = lport;
2992 	connp->conn_fport = fport;
2993 
2994 	ASSERT(!(ipsec_policy_set && ire_requested));
2995 	if (ire_requested) {
2996 		iulp_t *ulp_info = NULL;
2997 
2998 		/*
2999 		 * Note that sire will not be NULL if this is an off-link
3000 		 * connection and there is not cache for that dest yet.
3001 		 *
3002 		 * XXX Because of an existing bug, if there are multiple
3003 		 * default routes, the IRE returned now may not be the actual
3004 		 * default route used (default routes are chosen in a
3005 		 * round robin fashion).  So if the metrics for different
3006 		 * default routes are different, we may return the wrong
3007 		 * metrics.  This will not be a problem if the existing
3008 		 * bug is fixed.
3009 		 */
3010 		if (sire != NULL)
3011 			ulp_info = &(sire->ire_uinfo);
3012 
3013 		if (!ip_bind_insert_ire_v6(mp, dst_ire, v6dst, ulp_info)) {
3014 			error = -1;
3015 			goto bad_addr;
3016 		}
3017 	} else if (ipsec_policy_set) {
3018 		if (!ip_bind_ipsec_policy_set(connp, policy_mp)) {
3019 			error = -1;
3020 			goto bad_addr;
3021 		}
3022 	}
3023 
3024 	/*
3025 	 * Cache IPsec policy in this conn.  If we have per-socket policy,
3026 	 * we'll cache that.  If we don't, we'll inherit global policy.
3027 	 *
3028 	 * We can't insert until the conn reflects the policy. Note that
3029 	 * conn_policy_cached is set by ipsec_conn_cache_policy() even for
3030 	 * connections where we don't have a policy. This is to prevent
3031 	 * global policy lookups in the inbound path.
3032 	 *
3033 	 * If we insert before we set conn_policy_cached,
3034 	 * CONN_INBOUND_POLICY_PRESENT_V6() check can still evaluate true
3035 	 * because global policy cound be non-empty. We normally call
3036 	 * ipsec_check_policy() for conn_policy_cached connections only if
3037 	 * conn_in_enforce_policy is set. But in this case,
3038 	 * conn_policy_cached can get set anytime since we made the
3039 	 * CONN_INBOUND_POLICY_PRESENT_V6() check and ipsec_check_policy()
3040 	 * is called, which will make the above assumption false.  Thus, we
3041 	 * need to insert after we set conn_policy_cached.
3042 	 */
3043 	if ((error = ipsec_conn_cache_policy(connp, B_FALSE)) != 0)
3044 		goto bad_addr;
3045 
3046 	/* If not fanout_insert this was just an address verification */
3047 	if (fanout_insert) {
3048 		/*
3049 		 * The addresses have been verified. Time to insert in
3050 		 * the correct fanout list.
3051 		 */
3052 		error = ipcl_conn_insert_v6(connp, protocol, v6src, v6dst,
3053 		    connp->conn_ports,
3054 		    IPCL_IS_TCP(connp) ? connp->conn_tcp->tcp_bound_if : 0);
3055 	}
3056 	if (error == 0) {
3057 		connp->conn_fully_bound = B_TRUE;
3058 		/*
3059 		 * Our initial checks for MDT have passed; the IRE is not
3060 		 * LOCAL/LOOPBACK/BROADCAST, and the link layer seems to
3061 		 * be supporting MDT.  Pass the IRE, IPC and ILL into
3062 		 * ip_mdinfo_return(), which performs further checks
3063 		 * against them and upon success, returns the MDT info
3064 		 * mblk which we will attach to the bind acknowledgment.
3065 		 */
3066 		if (md_dst_ire != NULL) {
3067 			mblk_t *mdinfo_mp;
3068 
3069 			ASSERT(md_ill != NULL);
3070 			ASSERT(md_ill->ill_mdt_capab != NULL);
3071 			if ((mdinfo_mp = ip_mdinfo_return(md_dst_ire, connp,
3072 			    md_ill->ill_name, md_ill->ill_mdt_capab)) != NULL)
3073 				linkb(mp, mdinfo_mp);
3074 		}
3075 	}
3076 bad_addr:
3077 	if (ipsec_policy_set) {
3078 		ASSERT(policy_mp != NULL);
3079 		freeb(policy_mp);
3080 		/*
3081 		 * As of now assume that nothing else accompanies
3082 		 * IPSEC_POLICY_SET.
3083 		 */
3084 		mp->b_cont = NULL;
3085 	}
3086 refrele_and_quit:
3087 	if (src_ire != NULL)
3088 		IRE_REFRELE(src_ire);
3089 	if (dst_ire != NULL)
3090 		IRE_REFRELE(dst_ire);
3091 	if (sire != NULL)
3092 		IRE_REFRELE(sire);
3093 	if (src_ipif != NULL)
3094 		ipif_refrele(src_ipif);
3095 	if (md_dst_ire != NULL)
3096 		IRE_REFRELE(md_dst_ire);
3097 	if (ill_held && dst_ill != NULL)
3098 		ill_refrele(dst_ill);
3099 	return (error);
3100 }
3101 
3102 /*
3103  * Insert the ire in b_cont. Returns false if it fails (due to lack of space).
3104  * Makes the IRE be IRE_BROADCAST if dst is a multicast address.
3105  */
3106 static boolean_t
3107 ip_bind_insert_ire_v6(mblk_t *mp, ire_t *ire, const in6_addr_t *dst,
3108     iulp_t *ulp_info)
3109 {
3110 	mblk_t	*mp1;
3111 	ire_t	*ret_ire;
3112 
3113 	mp1 = mp->b_cont;
3114 	ASSERT(mp1 != NULL);
3115 
3116 	if (ire != NULL) {
3117 		/*
3118 		 * mp1 initialized above to IRE_DB_REQ_TYPE
3119 		 * appended mblk. Its <upper protocol>'s
3120 		 * job to make sure there is room.
3121 		 */
3122 		if ((mp1->b_datap->db_lim - mp1->b_rptr) < sizeof (ire_t))
3123 			return (B_FALSE);
3124 
3125 		mp1->b_datap->db_type = IRE_DB_TYPE;
3126 		mp1->b_wptr = mp1->b_rptr + sizeof (ire_t);
3127 		bcopy(ire, mp1->b_rptr, sizeof (ire_t));
3128 		ret_ire = (ire_t *)mp1->b_rptr;
3129 		if (IN6_IS_ADDR_MULTICAST(dst) ||
3130 		    IN6_IS_ADDR_V4MAPPED_CLASSD(dst)) {
3131 			ret_ire->ire_type = IRE_BROADCAST;
3132 			ret_ire->ire_addr_v6 = *dst;
3133 		}
3134 		if (ulp_info != NULL) {
3135 			bcopy(ulp_info, &(ret_ire->ire_uinfo),
3136 			    sizeof (iulp_t));
3137 		}
3138 		ret_ire->ire_mp = mp1;
3139 	} else {
3140 		/*
3141 		 * No IRE was found. Remove IRE mblk.
3142 		 */
3143 		mp->b_cont = mp1->b_cont;
3144 		freeb(mp1);
3145 	}
3146 	return (B_TRUE);
3147 }
3148 
3149 /*
3150  * Add an ip6i_t header to the front of the mblk.
3151  * Inline if possible else allocate a separate mblk containing only the ip6i_t.
3152  * Returns NULL if allocation fails (and frees original message).
3153  * Used in outgoing path when going through ip_newroute_*v6().
3154  * Used in incoming path to pass ifindex to transports.
3155  */
3156 mblk_t *
3157 ip_add_info_v6(mblk_t *mp, ill_t *ill, const in6_addr_t *dst)
3158 {
3159 	mblk_t *mp1;
3160 	ip6i_t *ip6i;
3161 	ip6_t *ip6h;
3162 
3163 	ip6h = (ip6_t *)mp->b_rptr;
3164 	ip6i = (ip6i_t *)(mp->b_rptr - sizeof (ip6i_t));
3165 	if ((uchar_t *)ip6i < mp->b_datap->db_base ||
3166 	    mp->b_datap->db_ref > 1) {
3167 		mp1 = allocb(sizeof (ip6i_t), BPRI_MED);
3168 		if (mp1 == NULL) {
3169 			freemsg(mp);
3170 			return (NULL);
3171 		}
3172 		mp1->b_wptr = mp1->b_rptr = mp1->b_datap->db_lim;
3173 		mp1->b_cont = mp;
3174 		mp = mp1;
3175 		ip6i = (ip6i_t *)(mp->b_rptr - sizeof (ip6i_t));
3176 	}
3177 	mp->b_rptr = (uchar_t *)ip6i;
3178 	ip6i->ip6i_vcf = ip6h->ip6_vcf;
3179 	ip6i->ip6i_nxt = IPPROTO_RAW;
3180 	if (ill != NULL) {
3181 		ip6i->ip6i_flags = IP6I_IFINDEX;
3182 		ip6i->ip6i_ifindex = ill->ill_phyint->phyint_ifindex;
3183 	} else {
3184 		ip6i->ip6i_flags = 0;
3185 	}
3186 	ip6i->ip6i_nexthop = *dst;
3187 	return (mp);
3188 }
3189 
3190 /*
3191  * Handle protocols with which IP is less intimate.  There
3192  * can be more than one stream bound to a particular
3193  * protocol.  When this is the case, normally each one gets a copy
3194  * of any incoming packets.
3195  * However, if the packet was tunneled and not multicast we only send to it
3196  * the first match.
3197  *
3198  * Zones notes:
3199  * Packets will be distributed to streams in all zones. This is really only
3200  * useful for ICMPv6 as only applications in the global zone can create raw
3201  * sockets for other protocols.
3202  */
3203 static void
3204 ip_fanout_proto_v6(queue_t *q, mblk_t *mp, ip6_t *ip6h, ill_t *ill,
3205     ill_t *inill, uint8_t nexthdr, uint_t nexthdr_offset, uint_t flags,
3206     boolean_t mctl_present, zoneid_t zoneid)
3207 {
3208 	queue_t	*rq;
3209 	mblk_t	*mp1, *first_mp1;
3210 	in6_addr_t dst = ip6h->ip6_dst;
3211 	in6_addr_t src = ip6h->ip6_src;
3212 	boolean_t one_only;
3213 	mblk_t *first_mp = mp;
3214 	boolean_t secure, shared_addr;
3215 	conn_t	*connp, *first_connp, *next_connp;
3216 	connf_t *connfp;
3217 
3218 	if (mctl_present) {
3219 		mp = first_mp->b_cont;
3220 		secure = ipsec_in_is_secure(first_mp);
3221 		ASSERT(mp != NULL);
3222 	} else {
3223 		secure = B_FALSE;
3224 	}
3225 
3226 	/*
3227 	 * If the packet was tunneled and not multicast we only send to it
3228 	 * the first match.
3229 	 */
3230 	one_only = ((nexthdr == IPPROTO_ENCAP || nexthdr == IPPROTO_IPV6) &&
3231 	    !IN6_IS_ADDR_MULTICAST(&dst));
3232 
3233 	shared_addr = (zoneid == ALL_ZONES);
3234 	if (shared_addr) {
3235 		/*
3236 		 * We don't allow multilevel ports for raw IP, so no need to
3237 		 * check for that here.
3238 		 */
3239 		zoneid = tsol_packet_to_zoneid(mp);
3240 	}
3241 
3242 	connfp = &ipcl_proto_fanout_v6[nexthdr];
3243 	mutex_enter(&connfp->connf_lock);
3244 	connp = connfp->connf_head;
3245 	for (connp = connfp->connf_head; connp != NULL;
3246 		connp = connp->conn_next) {
3247 		if (IPCL_PROTO_MATCH_V6(connp, nexthdr, ip6h, ill, flags,
3248 		    zoneid) &&
3249 		    (!is_system_labeled() ||
3250 		    tsol_receive_local(mp, &dst, IPV6_VERSION, shared_addr,
3251 		    connp)))
3252 			break;
3253 	}
3254 
3255 	if (connp == NULL || connp->conn_upq == NULL) {
3256 		/*
3257 		 * No one bound to this port.  Is
3258 		 * there a client that wants all
3259 		 * unclaimed datagrams?
3260 		 */
3261 		mutex_exit(&connfp->connf_lock);
3262 		if (ip_fanout_send_icmp_v6(q, first_mp, flags,
3263 		    ICMP6_PARAM_PROB, ICMP6_PARAMPROB_NEXTHEADER,
3264 		    nexthdr_offset, mctl_present, zoneid)) {
3265 			BUMP_MIB(ill->ill_ip6_mib, ipv6InUnknownProtos);
3266 		}
3267 
3268 		return;
3269 	}
3270 
3271 	CONN_INC_REF(connp);
3272 	first_connp = connp;
3273 
3274 	/*
3275 	 * XXX: Fix the multiple protocol listeners case. We should not
3276 	 * be walking the conn->next list here.
3277 	 */
3278 	if (one_only) {
3279 		/*
3280 		 * Only send message to one tunnel driver by immediately
3281 		 * terminating the loop.
3282 		 */
3283 		connp = NULL;
3284 	} else {
3285 		connp = connp->conn_next;
3286 
3287 	}
3288 	for (;;) {
3289 		while (connp != NULL) {
3290 			if (IPCL_PROTO_MATCH_V6(connp, nexthdr, ip6h, ill,
3291 			    flags, zoneid) &&
3292 			    (!is_system_labeled() ||
3293 			    tsol_receive_local(mp, &dst, IPV6_VERSION,
3294 			    shared_addr, connp)))
3295 				break;
3296 			connp = connp->conn_next;
3297 		}
3298 
3299 		/*
3300 		 * Just copy the data part alone. The mctl part is
3301 		 * needed just for verifying policy and it is never
3302 		 * sent up.
3303 		 */
3304 		if (connp == NULL || connp->conn_upq == NULL ||
3305 		    (((first_mp1 = dupmsg(first_mp)) == NULL) &&
3306 		    ((first_mp1 = ip_copymsg(first_mp)) == NULL))) {
3307 			/*
3308 			 * No more intested clients or memory
3309 			 * allocation failed
3310 			 */
3311 			connp = first_connp;
3312 			break;
3313 		}
3314 		mp1 = mctl_present ? first_mp1->b_cont : first_mp1;
3315 		CONN_INC_REF(connp);
3316 		mutex_exit(&connfp->connf_lock);
3317 		rq = connp->conn_rq;
3318 		/*
3319 		 * For link-local always add ifindex so that transport can set
3320 		 * sin6_scope_id. Avoid it for ICMP error fanout.
3321 		 */
3322 		if ((connp->conn_ipv6_recvpktinfo ||
3323 		    IN6_IS_ADDR_LINKLOCAL(&src)) &&
3324 		    (flags & IP_FF_IP6INFO)) {
3325 			/* Add header */
3326 			mp1 = ip_add_info_v6(mp1, inill, &dst);
3327 		}
3328 		if (mp1 == NULL) {
3329 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
3330 		} else if (!canputnext(rq)) {
3331 			if (flags & IP_FF_RAWIP) {
3332 				BUMP_MIB(ill->ill_ip6_mib, rawipInOverflows);
3333 			} else {
3334 				BUMP_MIB(ill->ill_icmp6_mib,
3335 				    ipv6IfIcmpInOverflows);
3336 			}
3337 
3338 			freemsg(mp1);
3339 		} else {
3340 			if (CONN_INBOUND_POLICY_PRESENT_V6(connp) || secure) {
3341 				first_mp1 = ipsec_check_inbound_policy
3342 				    (first_mp1, connp, NULL, ip6h,
3343 				    mctl_present);
3344 			}
3345 			if (first_mp1 != NULL) {
3346 				if (mctl_present)
3347 					freeb(first_mp1);
3348 				BUMP_MIB(ill->ill_ip6_mib, ipv6InDelivers);
3349 				putnext(rq, mp1);
3350 			}
3351 		}
3352 		mutex_enter(&connfp->connf_lock);
3353 		/* Follow the next pointer before releasing the conn. */
3354 		next_connp = connp->conn_next;
3355 		CONN_DEC_REF(connp);
3356 		connp = next_connp;
3357 	}
3358 
3359 	/* Last one.  Send it upstream. */
3360 	mutex_exit(&connfp->connf_lock);
3361 
3362 	/* Initiate IPPF processing */
3363 	if (IP6_IN_IPP(flags)) {
3364 		uint_t ifindex;
3365 
3366 		mutex_enter(&ill->ill_lock);
3367 		ifindex = ill->ill_phyint->phyint_ifindex;
3368 		mutex_exit(&ill->ill_lock);
3369 		ip_process(IPP_LOCAL_IN, &mp, ifindex);
3370 		if (mp == NULL) {
3371 			CONN_DEC_REF(connp);
3372 			if (mctl_present)
3373 				freeb(first_mp);
3374 			return;
3375 		}
3376 	}
3377 
3378 	/*
3379 	 * For link-local always add ifindex so that transport can set
3380 	 * sin6_scope_id. Avoid it for ICMP error fanout.
3381 	 */
3382 	if ((connp->conn_ipv6_recvpktinfo || IN6_IS_ADDR_LINKLOCAL(&src)) &&
3383 	    (flags & IP_FF_IP6INFO)) {
3384 		/* Add header */
3385 		mp = ip_add_info_v6(mp, inill, &dst);
3386 		if (mp == NULL) {
3387 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
3388 			CONN_DEC_REF(connp);
3389 			if (mctl_present)
3390 				freeb(first_mp);
3391 			return;
3392 		} else if (mctl_present) {
3393 			first_mp->b_cont = mp;
3394 		} else {
3395 			first_mp = mp;
3396 		}
3397 	}
3398 
3399 	rq = connp->conn_rq;
3400 	if (!canputnext(rq)) {
3401 		if (flags & IP_FF_RAWIP) {
3402 			BUMP_MIB(ill->ill_ip6_mib, rawipInOverflows);
3403 		} else {
3404 			BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInOverflows);
3405 		}
3406 
3407 		freemsg(first_mp);
3408 	} else {
3409 		if (CONN_INBOUND_POLICY_PRESENT_V6(connp) || secure) {
3410 			first_mp = ipsec_check_inbound_policy(first_mp, connp,
3411 			    NULL, ip6h, mctl_present);
3412 			if (first_mp == NULL) {
3413 				CONN_DEC_REF(connp);
3414 				return;
3415 			}
3416 		}
3417 		BUMP_MIB(ill->ill_ip6_mib, ipv6InDelivers);
3418 		putnext(rq, mp);
3419 		if (mctl_present)
3420 			freeb(first_mp);
3421 	}
3422 	CONN_DEC_REF(connp);
3423 }
3424 
3425 /*
3426  * Send an ICMP error after patching up the packet appropriately.  Returns
3427  * non-zero if the appropriate MIB should be bumped; zero otherwise.
3428  */
3429 int
3430 ip_fanout_send_icmp_v6(queue_t *q, mblk_t *mp, uint_t flags,
3431     uint_t icmp_type, uint8_t icmp_code, uint_t nexthdr_offset,
3432     boolean_t mctl_present, zoneid_t zoneid)
3433 {
3434 	ip6_t *ip6h;
3435 	mblk_t *first_mp;
3436 	boolean_t secure;
3437 	unsigned char db_type;
3438 
3439 	first_mp = mp;
3440 	if (mctl_present) {
3441 		mp = mp->b_cont;
3442 		secure = ipsec_in_is_secure(first_mp);
3443 		ASSERT(mp != NULL);
3444 	} else {
3445 		/*
3446 		 * If this is an ICMP error being reported - which goes
3447 		 * up as M_CTLs, we need to convert them to M_DATA till
3448 		 * we finish checking with global policy because
3449 		 * ipsec_check_global_policy() assumes M_DATA as clear
3450 		 * and M_CTL as secure.
3451 		 */
3452 		db_type = mp->b_datap->db_type;
3453 		mp->b_datap->db_type = M_DATA;
3454 		secure = B_FALSE;
3455 	}
3456 	/*
3457 	 * We are generating an icmp error for some inbound packet.
3458 	 * Called from all ip_fanout_(udp, tcp, proto) functions.
3459 	 * Before we generate an error, check with global policy
3460 	 * to see whether this is allowed to enter the system. As
3461 	 * there is no "conn", we are checking with global policy.
3462 	 */
3463 	ip6h = (ip6_t *)mp->b_rptr;
3464 	if (secure || ipsec_inbound_v6_policy_present) {
3465 		first_mp = ipsec_check_global_policy(first_mp, NULL,
3466 		    NULL, ip6h, mctl_present);
3467 		if (first_mp == NULL)
3468 			return (0);
3469 	}
3470 
3471 	if (!mctl_present)
3472 		mp->b_datap->db_type = db_type;
3473 
3474 	if (flags & IP_FF_SEND_ICMP) {
3475 		if (flags & IP_FF_HDR_COMPLETE) {
3476 			if (ip_hdr_complete_v6(ip6h, zoneid)) {
3477 				freemsg(first_mp);
3478 				return (1);
3479 			}
3480 		}
3481 		switch (icmp_type) {
3482 		case ICMP6_DST_UNREACH:
3483 			icmp_unreachable_v6(WR(q), first_mp, icmp_code,
3484 			    B_FALSE, B_FALSE);
3485 			break;
3486 		case ICMP6_PARAM_PROB:
3487 			icmp_param_problem_v6(WR(q), first_mp, icmp_code,
3488 			    nexthdr_offset, B_FALSE, B_FALSE);
3489 			break;
3490 		default:
3491 #ifdef DEBUG
3492 			panic("ip_fanout_send_icmp_v6: wrong type");
3493 			/*NOTREACHED*/
3494 #else
3495 			freemsg(first_mp);
3496 			break;
3497 #endif
3498 		}
3499 	} else {
3500 		freemsg(first_mp);
3501 		return (0);
3502 	}
3503 
3504 	return (1);
3505 }
3506 
3507 
3508 /*
3509  * Fanout for TCP packets
3510  * The caller puts <fport, lport> in the ports parameter.
3511  */
3512 static void
3513 ip_fanout_tcp_v6(queue_t *q, mblk_t *mp, ip6_t *ip6h, ill_t *ill, ill_t *inill,
3514     uint_t flags, uint_t hdr_len, boolean_t mctl_present, zoneid_t zoneid)
3515 {
3516 	mblk_t  	*first_mp;
3517 	boolean_t 	secure;
3518 	conn_t		*connp;
3519 	tcph_t		*tcph;
3520 	boolean_t	syn_present = B_FALSE;
3521 
3522 	first_mp = mp;
3523 	if (mctl_present) {
3524 		mp = first_mp->b_cont;
3525 		secure = ipsec_in_is_secure(first_mp);
3526 		ASSERT(mp != NULL);
3527 	} else {
3528 		secure = B_FALSE;
3529 	}
3530 
3531 	connp = ipcl_classify_v6(mp, IPPROTO_TCP, hdr_len, zoneid);
3532 
3533 	if (connp == NULL ||
3534 	    !conn_wantpacket_v6(connp, ill, ip6h, flags, zoneid)) {
3535 		/*
3536 		 * No hard-bound match. Send Reset.
3537 		 */
3538 		dblk_t *dp = mp->b_datap;
3539 		uint32_t ill_index;
3540 
3541 		ASSERT((dp->db_struioflag & STRUIO_IP) == 0);
3542 
3543 		/* Initiate IPPf processing, if needed. */
3544 		if (IPP_ENABLED(IPP_LOCAL_IN) && (flags & IP6_NO_IPPOLICY)) {
3545 			ill_index = ill->ill_phyint->phyint_ifindex;
3546 			ip_process(IPP_LOCAL_IN, &first_mp, ill_index);
3547 			if (first_mp == NULL) {
3548 				if (connp != NULL)
3549 					CONN_DEC_REF(connp);
3550 				return;
3551 			}
3552 		}
3553 		BUMP_MIB(ill->ill_ip6_mib, ipv6InDelivers);
3554 		tcp_xmit_listeners_reset(first_mp, hdr_len);
3555 		if (connp != NULL)
3556 			CONN_DEC_REF(connp);
3557 		return;
3558 	}
3559 
3560 	tcph = (tcph_t *)&mp->b_rptr[hdr_len];
3561 	if ((tcph->th_flags[0] & (TH_SYN|TH_ACK|TH_RST|TH_URG)) == TH_SYN) {
3562 		if (connp->conn_flags & IPCL_TCP) {
3563 			squeue_t *sqp;
3564 
3565 			/*
3566 			 * For fused tcp loopback, assign the eager's
3567 			 * squeue to be that of the active connect's.
3568 			 */
3569 			if ((flags & IP_FF_LOOPBACK) && do_tcp_fusion &&
3570 			    !CONN_INBOUND_POLICY_PRESENT_V6(connp) && !secure &&
3571 			    !IP6_IN_IPP(flags)) {
3572 				ASSERT(Q_TO_CONN(q) != NULL);
3573 				sqp = Q_TO_CONN(q)->conn_sqp;
3574 			} else {
3575 				sqp = IP_SQUEUE_GET(lbolt);
3576 			}
3577 
3578 			mp->b_datap->db_struioflag |= STRUIO_EAGER;
3579 			DB_CKSUMSTART(mp) = (intptr_t)sqp;
3580 
3581 			/*
3582 			 * db_cksumstuff is unused in the incoming
3583 			 * path; Thus store the ifindex here. It will
3584 			 * be cleared in tcp_conn_create_v6().
3585 			 */
3586 			DB_CKSUMSTUFF(mp) =
3587 			    (intptr_t)ill->ill_phyint->phyint_ifindex;
3588 			syn_present = B_TRUE;
3589 		}
3590 	}
3591 
3592 	if (IPCL_IS_TCP(connp) && IPCL_IS_BOUND(connp) && !syn_present) {
3593 		uint_t	flags = (unsigned int)tcph->th_flags[0] & 0xFF;
3594 		if ((flags & TH_RST) || (flags & TH_URG)) {
3595 			CONN_DEC_REF(connp);
3596 			freemsg(first_mp);
3597 			return;
3598 		}
3599 		if (flags & TH_ACK) {
3600 			tcp_xmit_listeners_reset(first_mp, hdr_len);
3601 			CONN_DEC_REF(connp);
3602 			return;
3603 		}
3604 
3605 		CONN_DEC_REF(connp);
3606 		freemsg(first_mp);
3607 		return;
3608 	}
3609 
3610 	if (CONN_INBOUND_POLICY_PRESENT_V6(connp) || secure) {
3611 		first_mp = ipsec_check_inbound_policy(first_mp, connp,
3612 		    NULL, ip6h, mctl_present);
3613 		if (first_mp == NULL) {
3614 			CONN_DEC_REF(connp);
3615 			return;
3616 		}
3617 		if (IPCL_IS_TCP(connp) && IPCL_IS_BOUND(connp)) {
3618 			ASSERT(syn_present);
3619 			if (mctl_present) {
3620 				ASSERT(first_mp != mp);
3621 				first_mp->b_datap->db_struioflag |=
3622 				    STRUIO_POLICY;
3623 			} else {
3624 				ASSERT(first_mp == mp);
3625 				mp->b_datap->db_struioflag &=
3626 				    ~STRUIO_EAGER;
3627 				mp->b_datap->db_struioflag |=
3628 				    STRUIO_POLICY;
3629 			}
3630 		} else {
3631 			/*
3632 			 * Discard first_mp early since we're dealing with a
3633 			 * fully-connected conn_t and tcp doesn't do policy in
3634 			 * this case. Also, if someone is bound to IPPROTO_TCP
3635 			 * over raw IP, they don't expect to see a M_CTL.
3636 			 */
3637 			if (mctl_present) {
3638 				freeb(first_mp);
3639 				mctl_present = B_FALSE;
3640 			}
3641 			first_mp = mp;
3642 		}
3643 	}
3644 
3645 	/* Initiate IPPF processing */
3646 	if (IP6_IN_IPP(flags)) {
3647 		uint_t	ifindex;
3648 
3649 		mutex_enter(&ill->ill_lock);
3650 		ifindex = ill->ill_phyint->phyint_ifindex;
3651 		mutex_exit(&ill->ill_lock);
3652 		ip_process(IPP_LOCAL_IN, &mp, ifindex);
3653 		if (mp == NULL) {
3654 			CONN_DEC_REF(connp);
3655 			if (mctl_present) {
3656 				freeb(first_mp);
3657 			}
3658 			return;
3659 		} else if (mctl_present) {
3660 			/*
3661 			 * ip_add_info_v6 might return a new mp.
3662 			 */
3663 			ASSERT(first_mp != mp);
3664 			first_mp->b_cont = mp;
3665 		} else {
3666 			first_mp = mp;
3667 		}
3668 	}
3669 
3670 	/*
3671 	 * For link-local always add ifindex so that TCP can bind to that
3672 	 * interface. Avoid it for ICMP error fanout.
3673 	 */
3674 	if (!syn_present && ((connp->conn_ipv6_recvpktinfo ||
3675 	    IN6_IS_ADDR_LINKLOCAL(&ip6h->ip6_src)) &&
3676 	    (flags & IP_FF_IP6INFO))) {
3677 		/* Add header */
3678 		mp = ip_add_info_v6(mp, inill, &ip6h->ip6_dst);
3679 		if (mp == NULL) {
3680 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
3681 			CONN_DEC_REF(connp);
3682 			if (mctl_present)
3683 				freeb(first_mp);
3684 			return;
3685 		} else if (mctl_present) {
3686 			ASSERT(first_mp != mp);
3687 			first_mp->b_cont = mp;
3688 		} else {
3689 			first_mp = mp;
3690 		}
3691 	}
3692 
3693 	BUMP_MIB(ill->ill_ip6_mib, ipv6InDelivers);
3694 	if (IPCL_IS_TCP(connp)) {
3695 		(*ip_input_proc)(connp->conn_sqp, first_mp,
3696 		    connp->conn_recv, connp, SQTAG_IP6_TCP_INPUT);
3697 	} else {
3698 		putnext(connp->conn_rq, first_mp);
3699 		CONN_DEC_REF(connp);
3700 	}
3701 }
3702 
3703 /*
3704  * Fanout for UDP packets.
3705  * The caller puts <fport, lport> in the ports parameter.
3706  * ire_type must be IRE_BROADCAST for multicast and broadcast packets.
3707  *
3708  * If SO_REUSEADDR is set all multicast and broadcast packets
3709  * will be delivered to all streams bound to the same port.
3710  *
3711  * Zones notes:
3712  * Multicast packets will be distributed to streams in all zones.
3713  */
3714 static void
3715 ip_fanout_udp_v6(queue_t *q, mblk_t *mp, ip6_t *ip6h, uint32_t ports,
3716     ill_t *ill, ill_t *inill, uint_t flags, boolean_t mctl_present,
3717     zoneid_t zoneid)
3718 {
3719 	uint32_t	dstport, srcport;
3720 	in6_addr_t	dst;
3721 	mblk_t		*first_mp;
3722 	boolean_t	secure;
3723 	conn_t		*connp;
3724 	connf_t		*connfp;
3725 	conn_t		*first_conn;
3726 	conn_t 		*next_conn;
3727 	mblk_t		*mp1, *first_mp1;
3728 	in6_addr_t	src;
3729 	boolean_t	shared_addr;
3730 
3731 	first_mp = mp;
3732 	if (mctl_present) {
3733 		mp = first_mp->b_cont;
3734 		secure = ipsec_in_is_secure(first_mp);
3735 		ASSERT(mp != NULL);
3736 	} else {
3737 		secure = B_FALSE;
3738 	}
3739 
3740 	/* Extract ports in net byte order */
3741 	dstport = htons(ntohl(ports) & 0xFFFF);
3742 	srcport = htons(ntohl(ports) >> 16);
3743 	dst = ip6h->ip6_dst;
3744 	src = ip6h->ip6_src;
3745 
3746 	shared_addr = (zoneid == ALL_ZONES);
3747 	if (shared_addr) {
3748 		zoneid = tsol_mlp_findzone(IPPROTO_UDP, dstport);
3749 		/*
3750 		 * If no shared MLP is found, tsol_mlp_findzone returns
3751 		 * ALL_ZONES.  In that case, we assume it's SLP, and
3752 		 * search for the zone based on the packet label.
3753 		 * That will also return ALL_ZONES on failure, but
3754 		 * we never allow conn_zoneid to be set to ALL_ZONES.
3755 		 */
3756 		if (zoneid == ALL_ZONES)
3757 			zoneid = tsol_packet_to_zoneid(mp);
3758 	}
3759 
3760 	/* Attempt to find a client stream based on destination port. */
3761 	connfp = &ipcl_udp_fanout[IPCL_UDP_HASH(dstport)];
3762 	mutex_enter(&connfp->connf_lock);
3763 	connp = connfp->connf_head;
3764 	if (!IN6_IS_ADDR_MULTICAST(&dst)) {
3765 		/*
3766 		 * Not multicast. Send to the one (first) client we find.
3767 		 */
3768 		while (connp != NULL) {
3769 			if (IPCL_UDP_MATCH_V6(connp, dstport, dst, srcport,
3770 			    src) && connp->conn_zoneid == zoneid &&
3771 			    conn_wantpacket_v6(connp, ill, ip6h,
3772 			    flags, zoneid)) {
3773 				break;
3774 			}
3775 			connp = connp->conn_next;
3776 		}
3777 		if (connp == NULL || connp->conn_upq == NULL)
3778 			goto notfound;
3779 
3780 		if (is_system_labeled() &&
3781 		    !tsol_receive_local(mp, &dst, IPV6_VERSION, shared_addr,
3782 		    connp))
3783 			goto notfound;
3784 
3785 		/* Found a client */
3786 		CONN_INC_REF(connp);
3787 		mutex_exit(&connfp->connf_lock);
3788 
3789 		if (CONN_UDP_FLOWCTLD(connp)) {
3790 			freemsg(first_mp);
3791 			CONN_DEC_REF(connp);
3792 			return;
3793 		}
3794 		if (CONN_INBOUND_POLICY_PRESENT_V6(connp) || secure) {
3795 			first_mp = ipsec_check_inbound_policy(first_mp,
3796 			    connp, NULL, ip6h, mctl_present);
3797 			if (first_mp == NULL) {
3798 				CONN_DEC_REF(connp);
3799 				return;
3800 			}
3801 		}
3802 		/* Initiate IPPF processing */
3803 		if (IP6_IN_IPP(flags)) {
3804 			uint_t	ifindex;
3805 
3806 			mutex_enter(&ill->ill_lock);
3807 			ifindex = ill->ill_phyint->phyint_ifindex;
3808 			mutex_exit(&ill->ill_lock);
3809 			ip_process(IPP_LOCAL_IN, &mp, ifindex);
3810 			if (mp == NULL) {
3811 				CONN_DEC_REF(connp);
3812 				if (mctl_present)
3813 					freeb(first_mp);
3814 				return;
3815 			}
3816 		}
3817 		/*
3818 		 * For link-local always add ifindex so that
3819 		 * transport can set sin6_scope_id. Avoid it for
3820 		 * ICMP error fanout.
3821 		 */
3822 		if ((connp->conn_ipv6_recvpktinfo ||
3823 		    IN6_IS_ADDR_LINKLOCAL(&src)) &&
3824 		    (flags & IP_FF_IP6INFO)) {
3825 				/* Add header */
3826 			mp = ip_add_info_v6(mp, inill, &dst);
3827 			if (mp == NULL) {
3828 				BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
3829 				CONN_DEC_REF(connp);
3830 				if (mctl_present)
3831 					freeb(first_mp);
3832 				return;
3833 			} else if (mctl_present) {
3834 				first_mp->b_cont = mp;
3835 			} else {
3836 				first_mp = mp;
3837 			}
3838 		}
3839 		BUMP_MIB(ill->ill_ip6_mib, ipv6InDelivers);
3840 
3841 		/* Send it upstream */
3842 		CONN_UDP_RECV(connp, mp);
3843 
3844 		IP6_STAT(ip6_udp_fannorm);
3845 		CONN_DEC_REF(connp);
3846 		if (mctl_present)
3847 			freeb(first_mp);
3848 		return;
3849 	}
3850 
3851 	while (connp != NULL) {
3852 		if ((IPCL_UDP_MATCH_V6(connp, dstport, dst, srcport, src)) &&
3853 		    conn_wantpacket_v6(connp, ill, ip6h, flags, zoneid) &&
3854 		    (!is_system_labeled() ||
3855 		    tsol_receive_local(mp, &dst, IPV6_VERSION, shared_addr,
3856 		    connp)))
3857 			break;
3858 		connp = connp->conn_next;
3859 	}
3860 
3861 	if (connp == NULL || connp->conn_upq == NULL)
3862 		goto notfound;
3863 
3864 	first_conn = connp;
3865 
3866 	CONN_INC_REF(connp);
3867 	connp = connp->conn_next;
3868 	for (;;) {
3869 		while (connp != NULL) {
3870 			if (IPCL_UDP_MATCH_V6(connp, dstport, dst, srcport,
3871 			    src) && conn_wantpacket_v6(connp, ill, ip6h,
3872 			    flags, zoneid) &&
3873 			    (!is_system_labeled() ||
3874 			    tsol_receive_local(mp, &dst, IPV6_VERSION,
3875 			    shared_addr, connp)))
3876 				break;
3877 			connp = connp->conn_next;
3878 		}
3879 		/*
3880 		 * Just copy the data part alone. The mctl part is
3881 		 * needed just for verifying policy and it is never
3882 		 * sent up.
3883 		 */
3884 		if (connp == NULL ||
3885 		    (((first_mp1 = dupmsg(first_mp)) == NULL) &&
3886 			((first_mp1 = ip_copymsg(first_mp))
3887 			    == NULL))) {
3888 			/*
3889 			 * No more interested clients or memory
3890 			 * allocation failed
3891 			 */
3892 			connp = first_conn;
3893 			break;
3894 		}
3895 		mp1 = mctl_present ? first_mp1->b_cont : first_mp1;
3896 		CONN_INC_REF(connp);
3897 		mutex_exit(&connfp->connf_lock);
3898 		/*
3899 		 * For link-local always add ifindex so that transport
3900 		 * can set sin6_scope_id. Avoid it for ICMP error
3901 		 * fanout.
3902 		 */
3903 		if ((connp->conn_ipv6_recvpktinfo ||
3904 		    IN6_IS_ADDR_LINKLOCAL(&src)) &&
3905 		    (flags & IP_FF_IP6INFO)) {
3906 			/* Add header */
3907 			mp1 = ip_add_info_v6(mp1, inill, &dst);
3908 		}
3909 		/* mp1 could have changed */
3910 		if (mctl_present)
3911 			first_mp1->b_cont = mp1;
3912 		else
3913 			first_mp1 = mp1;
3914 		if (mp1 == NULL) {
3915 			if (mctl_present)
3916 				freeb(first_mp1);
3917 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
3918 			goto next_one;
3919 		}
3920 		if (CONN_UDP_FLOWCTLD(connp)) {
3921 			BUMP_MIB(ill->ill_ip6_mib, udpInOverflows);
3922 			freemsg(first_mp1);
3923 			goto next_one;
3924 		}
3925 
3926 		if (CONN_INBOUND_POLICY_PRESENT_V6(connp) ||
3927 		    secure) {
3928 			first_mp1 = ipsec_check_inbound_policy
3929 			    (first_mp1, connp, NULL, ip6h,
3930 			    mctl_present);
3931 		}
3932 		if (first_mp1 != NULL) {
3933 			if (mctl_present)
3934 				freeb(first_mp1);
3935 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDelivers);
3936 
3937 			/* Send it upstream */
3938 			CONN_UDP_RECV(connp, mp1);
3939 		}
3940 next_one:
3941 		mutex_enter(&connfp->connf_lock);
3942 		/* Follow the next pointer before releasing the conn. */
3943 		next_conn = connp->conn_next;
3944 		IP6_STAT(ip6_udp_fanmb);
3945 		CONN_DEC_REF(connp);
3946 		connp = next_conn;
3947 	}
3948 
3949 	/* Last one.  Send it upstream. */
3950 	mutex_exit(&connfp->connf_lock);
3951 
3952 	/* Initiate IPPF processing */
3953 	if (IP6_IN_IPP(flags)) {
3954 		uint_t	ifindex;
3955 
3956 		mutex_enter(&ill->ill_lock);
3957 		ifindex = ill->ill_phyint->phyint_ifindex;
3958 		mutex_exit(&ill->ill_lock);
3959 		ip_process(IPP_LOCAL_IN, &mp, ifindex);
3960 		if (mp == NULL) {
3961 			CONN_DEC_REF(connp);
3962 			if (mctl_present) {
3963 				freeb(first_mp);
3964 			}
3965 			return;
3966 		}
3967 	}
3968 
3969 	/*
3970 	 * For link-local always add ifindex so that transport can set
3971 	 * sin6_scope_id. Avoid it for ICMP error fanout.
3972 	 */
3973 	if ((connp->conn_ipv6_recvpktinfo ||
3974 	    IN6_IS_ADDR_LINKLOCAL(&src)) && (flags & IP_FF_IP6INFO)) {
3975 		/* Add header */
3976 		mp = ip_add_info_v6(mp, inill, &dst);
3977 		if (mp == NULL) {
3978 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
3979 			CONN_DEC_REF(connp);
3980 			if (mctl_present)
3981 				freeb(first_mp);
3982 			return;
3983 		} else if (mctl_present) {
3984 			first_mp->b_cont = mp;
3985 		} else {
3986 			first_mp = mp;
3987 		}
3988 	}
3989 	if (CONN_UDP_FLOWCTLD(connp)) {
3990 		BUMP_MIB(ill->ill_ip6_mib, udpInOverflows);
3991 		freemsg(mp);
3992 	} else {
3993 		if (CONN_INBOUND_POLICY_PRESENT_V6(connp) || secure) {
3994 			first_mp = ipsec_check_inbound_policy(first_mp,
3995 			    connp, NULL, ip6h, mctl_present);
3996 			if (first_mp == NULL) {
3997 				BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
3998 				CONN_DEC_REF(connp);
3999 				return;
4000 			}
4001 		}
4002 		BUMP_MIB(ill->ill_ip6_mib, ipv6InDelivers);
4003 
4004 		/* Send it upstream */
4005 		CONN_UDP_RECV(connp, mp);
4006 	}
4007 	IP6_STAT(ip6_udp_fanmb);
4008 	CONN_DEC_REF(connp);
4009 	if (mctl_present)
4010 		freeb(first_mp);
4011 	return;
4012 
4013 notfound:
4014 	mutex_exit(&connfp->connf_lock);
4015 	/*
4016 	 * No one bound to this port.  Is
4017 	 * there a client that wants all
4018 	 * unclaimed datagrams?
4019 	 */
4020 	if (ipcl_proto_fanout_v6[IPPROTO_UDP].connf_head != NULL) {
4021 		ip_fanout_proto_v6(q, first_mp, ip6h, ill, inill, IPPROTO_UDP,
4022 		    0, flags | IP_FF_RAWIP | IP_FF_IP6INFO, mctl_present,
4023 		    zoneid);
4024 	} else {
4025 		if (ip_fanout_send_icmp_v6(q, first_mp, flags,
4026 		    ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_NOPORT, 0,
4027 		    mctl_present, zoneid)) {
4028 			BUMP_MIB(&ip_mib, udpNoPorts);
4029 		}
4030 	}
4031 }
4032 
4033 /*
4034  * int ip_find_hdr_v6()
4035  *
4036  * This routine is used by the upper layer protocols and the IP tunnel
4037  * module to:
4038  * - Set extension header pointers to appropriate locations
4039  * - Determine IPv6 header length and return it
4040  * - Return a pointer to the last nexthdr value
4041  *
4042  * The caller must initialize ipp_fields.
4043  *
4044  * NOTE: If multiple extension headers of the same type are present,
4045  * ip_find_hdr_v6() will set the respective extension header pointers
4046  * to the first one that it encounters in the IPv6 header.  It also
4047  * skips fragment headers.  This routine deals with malformed packets
4048  * of various sorts in which case the returned length is up to the
4049  * malformed part.
4050  */
4051 int
4052 ip_find_hdr_v6(mblk_t *mp, ip6_t *ip6h, ip6_pkt_t *ipp, uint8_t *nexthdrp)
4053 {
4054 	uint_t	length, ehdrlen;
4055 	uint8_t nexthdr;
4056 	uint8_t *whereptr, *endptr;
4057 	ip6_dest_t *tmpdstopts;
4058 	ip6_rthdr_t *tmprthdr;
4059 	ip6_hbh_t *tmphopopts;
4060 	ip6_frag_t *tmpfraghdr;
4061 
4062 	length = IPV6_HDR_LEN;
4063 	whereptr = ((uint8_t *)&ip6h[1]); /* point to next hdr */
4064 	endptr = mp->b_wptr;
4065 
4066 	nexthdr = ip6h->ip6_nxt;
4067 	while (whereptr < endptr) {
4068 		/* Is there enough left for len + nexthdr? */
4069 		if (whereptr + MIN_EHDR_LEN > endptr)
4070 			goto done;
4071 
4072 		switch (nexthdr) {
4073 		case IPPROTO_HOPOPTS:
4074 			tmphopopts = (ip6_hbh_t *)whereptr;
4075 			ehdrlen = 8 * (tmphopopts->ip6h_len + 1);
4076 			if ((uchar_t *)tmphopopts +  ehdrlen > endptr)
4077 				goto done;
4078 			nexthdr = tmphopopts->ip6h_nxt;
4079 			/* return only 1st hbh */
4080 			if (!(ipp->ipp_fields & IPPF_HOPOPTS)) {
4081 				ipp->ipp_fields |= IPPF_HOPOPTS;
4082 				ipp->ipp_hopopts = tmphopopts;
4083 				ipp->ipp_hopoptslen = ehdrlen;
4084 			}
4085 			break;
4086 		case IPPROTO_DSTOPTS:
4087 			tmpdstopts = (ip6_dest_t *)whereptr;
4088 			ehdrlen = 8 * (tmpdstopts->ip6d_len + 1);
4089 			if ((uchar_t *)tmpdstopts +  ehdrlen > endptr)
4090 				goto done;
4091 			nexthdr = tmpdstopts->ip6d_nxt;
4092 			/*
4093 			 * ipp_dstopts is set to the destination header after a
4094 			 * routing header.
4095 			 * Assume it is a post-rthdr destination header
4096 			 * and adjust when we find an rthdr.
4097 			 */
4098 			if (!(ipp->ipp_fields & IPPF_DSTOPTS)) {
4099 				ipp->ipp_fields |= IPPF_DSTOPTS;
4100 				ipp->ipp_dstopts = tmpdstopts;
4101 				ipp->ipp_dstoptslen = ehdrlen;
4102 			}
4103 			break;
4104 		case IPPROTO_ROUTING:
4105 			tmprthdr = (ip6_rthdr_t *)whereptr;
4106 			ehdrlen = 8 * (tmprthdr->ip6r_len + 1);
4107 			if ((uchar_t *)tmprthdr +  ehdrlen > endptr)
4108 				goto done;
4109 			nexthdr = tmprthdr->ip6r_nxt;
4110 			/* return only 1st rthdr */
4111 			if (!(ipp->ipp_fields & IPPF_RTHDR)) {
4112 				ipp->ipp_fields |= IPPF_RTHDR;
4113 				ipp->ipp_rthdr = tmprthdr;
4114 				ipp->ipp_rthdrlen = ehdrlen;
4115 			}
4116 			/*
4117 			 * Make any destination header we've seen be a
4118 			 * pre-rthdr destination header.
4119 			 */
4120 			if (ipp->ipp_fields & IPPF_DSTOPTS) {
4121 				ipp->ipp_fields &= ~IPPF_DSTOPTS;
4122 				ipp->ipp_fields |= IPPF_RTDSTOPTS;
4123 				ipp->ipp_rtdstopts = ipp->ipp_dstopts;
4124 				ipp->ipp_dstopts = NULL;
4125 				ipp->ipp_rtdstoptslen = ipp->ipp_dstoptslen;
4126 				ipp->ipp_dstoptslen = 0;
4127 			}
4128 			break;
4129 		case IPPROTO_FRAGMENT:
4130 			/*
4131 			 * Fragment headers are skipped.  Currently, only
4132 			 * IP cares for their existence.  If anyone other
4133 			 * than IP ever has the need to know about the
4134 			 * location of fragment headers, support can be
4135 			 * added to the ip6_pkt_t at that time.
4136 			 */
4137 			tmpfraghdr = (ip6_frag_t *)whereptr;
4138 			ehdrlen = sizeof (ip6_frag_t);
4139 			if ((uchar_t *)tmpfraghdr + ehdrlen > endptr)
4140 				goto done;
4141 			nexthdr = tmpfraghdr->ip6f_nxt;
4142 			break;
4143 		case IPPROTO_NONE:
4144 		default:
4145 			goto done;
4146 		}
4147 		length += ehdrlen;
4148 		whereptr += ehdrlen;
4149 	}
4150 done:
4151 	if (nexthdrp != NULL)
4152 		*nexthdrp = nexthdr;
4153 	return (length);
4154 }
4155 
4156 int
4157 ip_hdr_complete_v6(ip6_t *ip6h, zoneid_t zoneid)
4158 {
4159 	ire_t *ire;
4160 
4161 	if (IN6_IS_ADDR_UNSPECIFIED(&ip6h->ip6_src)) {
4162 		ire = ire_lookup_local_v6(zoneid);
4163 		if (ire == NULL) {
4164 			ip1dbg(("ip_hdr_complete_v6: no source IRE\n"));
4165 			return (1);
4166 		}
4167 		ip6h->ip6_src = ire->ire_addr_v6;
4168 		ire_refrele(ire);
4169 	}
4170 	ip6h->ip6_vcf = IPV6_DEFAULT_VERS_AND_FLOW;
4171 	ip6h->ip6_hops = ipv6_def_hops;
4172 	return (0);
4173 }
4174 
4175 /*
4176  * Try to determine where and what are the IPv6 header length and
4177  * pointer to nexthdr value for the upper layer protocol (or an
4178  * unknown next hdr).
4179  *
4180  * Parameters returns a pointer to the nexthdr value;
4181  * Must handle malformed packets of various sorts.
4182  * Function returns failure for malformed cases.
4183  */
4184 boolean_t
4185 ip_hdr_length_nexthdr_v6(mblk_t *mp, ip6_t *ip6h, uint16_t *hdr_length_ptr,
4186     uint8_t **nexthdrpp)
4187 {
4188 	uint16_t length;
4189 	uint_t	ehdrlen;
4190 	uint8_t	*nexthdrp;
4191 	uint8_t *whereptr;
4192 	uint8_t *endptr;
4193 	ip6_dest_t *desthdr;
4194 	ip6_rthdr_t *rthdr;
4195 	ip6_frag_t *fraghdr;
4196 
4197 	length = IPV6_HDR_LEN;
4198 	whereptr = ((uint8_t *)&ip6h[1]); /* point to next hdr */
4199 	endptr = mp->b_wptr;
4200 
4201 	nexthdrp = &ip6h->ip6_nxt;
4202 	while (whereptr < endptr) {
4203 		/* Is there enough left for len + nexthdr? */
4204 		if (whereptr + MIN_EHDR_LEN > endptr)
4205 			break;
4206 
4207 		switch (*nexthdrp) {
4208 		case IPPROTO_HOPOPTS:
4209 		case IPPROTO_DSTOPTS:
4210 			/* Assumes the headers are identical for hbh and dst */
4211 			desthdr = (ip6_dest_t *)whereptr;
4212 			ehdrlen = 8 * (desthdr->ip6d_len + 1);
4213 			if ((uchar_t *)desthdr +  ehdrlen > endptr)
4214 				return (B_FALSE);
4215 			nexthdrp = &desthdr->ip6d_nxt;
4216 			break;
4217 		case IPPROTO_ROUTING:
4218 			rthdr = (ip6_rthdr_t *)whereptr;
4219 			ehdrlen =  8 * (rthdr->ip6r_len + 1);
4220 			if ((uchar_t *)rthdr +  ehdrlen > endptr)
4221 				return (B_FALSE);
4222 			nexthdrp = &rthdr->ip6r_nxt;
4223 			break;
4224 		case IPPROTO_FRAGMENT:
4225 			fraghdr = (ip6_frag_t *)whereptr;
4226 			ehdrlen = sizeof (ip6_frag_t);
4227 			if ((uchar_t *)&fraghdr[1] > endptr)
4228 				return (B_FALSE);
4229 			nexthdrp = &fraghdr->ip6f_nxt;
4230 			break;
4231 		case IPPROTO_NONE:
4232 			/* No next header means we're finished */
4233 		default:
4234 			*hdr_length_ptr = length;
4235 			*nexthdrpp = nexthdrp;
4236 			return (B_TRUE);
4237 		}
4238 		length += ehdrlen;
4239 		whereptr += ehdrlen;
4240 		*hdr_length_ptr = length;
4241 		*nexthdrpp = nexthdrp;
4242 	}
4243 	switch (*nexthdrp) {
4244 	case IPPROTO_HOPOPTS:
4245 	case IPPROTO_DSTOPTS:
4246 	case IPPROTO_ROUTING:
4247 	case IPPROTO_FRAGMENT:
4248 		/*
4249 		 * If any know extension headers are still to be processed,
4250 		 * the packet's malformed (or at least all the IP header(s) are
4251 		 * not in the same mblk - and that should never happen.
4252 		 */
4253 		return (B_FALSE);
4254 
4255 	default:
4256 		/*
4257 		 * If we get here, we know that all of the IP headers were in
4258 		 * the same mblk, even if the ULP header is in the next mblk.
4259 		 */
4260 		*hdr_length_ptr = length;
4261 		*nexthdrpp = nexthdrp;
4262 		return (B_TRUE);
4263 	}
4264 }
4265 
4266 /*
4267  * Return the length of the IPv6 related headers (including extension headers)
4268  * Returns a length even if the packet is malformed.
4269  */
4270 int
4271 ip_hdr_length_v6(mblk_t *mp, ip6_t *ip6h)
4272 {
4273 	uint16_t hdr_len;
4274 	uint8_t	*nexthdrp;
4275 
4276 	(void) ip_hdr_length_nexthdr_v6(mp, ip6h, &hdr_len, &nexthdrp);
4277 	return (hdr_len);
4278 }
4279 
4280 /*
4281  * Select an ill for the packet by considering load spreading across
4282  * a different ill in the group if dst_ill is part of some group.
4283  */
4284 static ill_t *
4285 ip_newroute_get_dst_ill_v6(ill_t *dst_ill)
4286 {
4287 	ill_t *ill;
4288 
4289 	/*
4290 	 * We schedule irrespective of whether the source address is
4291 	 * INADDR_UNSPECIED or not.
4292 	 */
4293 	ill = illgrp_scheduler(dst_ill);
4294 	if (ill == NULL)
4295 		return (NULL);
4296 
4297 	/*
4298 	 * For groups with names ip_sioctl_groupname ensures that all
4299 	 * ills are of same type. For groups without names, ifgrp_insert
4300 	 * ensures this.
4301 	 */
4302 	ASSERT(dst_ill->ill_type == ill->ill_type);
4303 
4304 	return (ill);
4305 }
4306 
4307 /*
4308  * IPv6 -
4309  * ip_newroute_v6 is called by ip_rput_data_v6 or ip_wput_v6 whenever we need
4310  * to send out a packet to a destination address for which we do not have
4311  * specific routing information.
4312  *
4313  * Handle non-multicast packets. If ill is non-NULL the match is done
4314  * for that ill.
4315  *
4316  * When a specific ill is specified (using IPV6_PKTINFO,
4317  * IPV6_MULTICAST_IF, or IPV6_BOUND_IF) we will only match
4318  * on routing entries (ftable and ctable) that have a matching
4319  * ire->ire_ipif->ipif_ill. Thus this can only be used
4320  * for destinations that are on-link for the specific ill
4321  * and that can appear on multiple links. Thus it is useful
4322  * for multicast destinations, link-local destinations, and
4323  * at some point perhaps for site-local destinations (if the
4324  * node sits at a site boundary).
4325  * We create the cache entries in the regular ctable since
4326  * it can not "confuse" things for other destinations.
4327  * table.
4328  *
4329  * When ill is part of a ill group, we subject the packets
4330  * to load spreading even if the ill is specified by the
4331  * means described above. We disable only for IPV6_BOUND_PIF
4332  * and for the cases where IP6I_ATTACH_IF is set i.e NS/NA/
4333  * Echo replies to link-local destinations have IP6I_ATTACH_IF
4334  * set.
4335  *
4336  * NOTE : These are the scopes of some of the variables that point at IRE,
4337  *	  which needs to be followed while making any future modifications
4338  *	  to avoid memory leaks.
4339  *
4340  *	- ire and sire are the entries looked up initially by
4341  *	  ire_ftable_lookup_v6.
4342  *	- ipif_ire is used to hold the interface ire associated with
4343  *	  the new cache ire. But it's scope is limited, so we always REFRELE
4344  *	  it before branching out to error paths.
4345  *	- save_ire is initialized before ire_create, so that ire returned
4346  *	  by ire_create will not over-write the ire. We REFRELE save_ire
4347  *	  before breaking out of the switch.
4348  *
4349  *	Thus on failures, we have to REFRELE only ire and sire, if they
4350  *	are not NULL.
4351  *
4352  *	v6srcp may be used in the future. Currently unused.
4353  */
4354 /* ARGSUSED */
4355 void
4356 ip_newroute_v6(queue_t *q, mblk_t *mp, const in6_addr_t *v6dstp,
4357     const in6_addr_t *v6srcp, ill_t *ill, zoneid_t zoneid)
4358 {
4359 	in6_addr_t	v6gw;
4360 	in6_addr_t	dst;
4361 	ire_t		*ire = NULL;
4362 	ipif_t		*src_ipif = NULL;
4363 	ill_t		*dst_ill = NULL;
4364 	ire_t		*sire = NULL;
4365 	ire_t		*save_ire;
4366 	mblk_t		*dlureq_mp;
4367 	ip6_t		*ip6h;
4368 	int		err = 0;
4369 	mblk_t		*first_mp;
4370 	ipsec_out_t	*io;
4371 	ill_t		*attach_ill = NULL;
4372 	ushort_t	ire_marks = 0;
4373 	int		match_flags;
4374 	boolean_t	ip6i_present;
4375 	ire_t		*first_sire = NULL;
4376 	mblk_t		*copy_mp = NULL;
4377 	mblk_t		*xmit_mp = NULL;
4378 	in6_addr_t	save_dst;
4379 	uint32_t	multirt_flags =
4380 	    MULTIRT_CACHEGW | MULTIRT_USESTAMP | MULTIRT_SETSTAMP;
4381 	boolean_t	multirt_is_resolvable;
4382 	boolean_t	multirt_resolve_next;
4383 	boolean_t	need_rele = B_FALSE;
4384 	boolean_t	do_attach_ill = B_FALSE;
4385 	boolean_t	ip6_asp_table_held = B_FALSE;
4386 	tsol_ire_gw_secattr_t *attrp = NULL;
4387 	tsol_gcgrp_t	*gcgrp = NULL;
4388 	tsol_gcgrp_addr_t ga;
4389 
4390 	ASSERT(!IN6_IS_ADDR_MULTICAST(v6dstp));
4391 
4392 	first_mp = mp;
4393 	if (mp->b_datap->db_type == M_CTL) {
4394 		mp = mp->b_cont;
4395 		io = (ipsec_out_t *)first_mp->b_rptr;
4396 		ASSERT(io->ipsec_out_type == IPSEC_OUT);
4397 	} else {
4398 		io = NULL;
4399 	}
4400 
4401 	/*
4402 	 * If this end point is bound to IPIF_NOFAILOVER, set bnf_ill and
4403 	 * bind_to_nofailover B_TRUE. We can't use conn to determine as it
4404 	 * could be NULL.
4405 	 *
4406 	 * This information can appear either in an ip6i_t or an IPSEC_OUT
4407 	 * message.
4408 	 */
4409 	ip6h = (ip6_t *)mp->b_rptr;
4410 	ip6i_present = (ip6h->ip6_nxt == IPPROTO_RAW);
4411 	if (ip6i_present || (io != NULL && io->ipsec_out_attach_if)) {
4412 		if (!ip6i_present ||
4413 		    ((ip6i_t *)ip6h)->ip6i_flags & IP6I_ATTACH_IF) {
4414 			attach_ill = ip_grab_attach_ill(ill, first_mp,
4415 			    (ip6i_present ? ((ip6i_t *)ip6h)->ip6i_ifindex :
4416 				io->ipsec_out_ill_index), B_TRUE);
4417 			/* Failure case frees things for us. */
4418 			if (attach_ill == NULL)
4419 				return;
4420 
4421 			/*
4422 			 * Check if we need an ire that will not be
4423 			 * looked up by anybody else i.e. HIDDEN.
4424 			 */
4425 			if (ill_is_probeonly(attach_ill))
4426 				ire_marks = IRE_MARK_HIDDEN;
4427 		}
4428 	}
4429 
4430 	if (IN6_IS_ADDR_LOOPBACK(v6dstp)) {
4431 		ip1dbg(("ip_newroute_v6: dst with loopback addr\n"));
4432 		goto icmp_err_ret;
4433 	} else if ((v6srcp != NULL) && IN6_IS_ADDR_LOOPBACK(v6srcp)) {
4434 		ip1dbg(("ip_newroute_v6: src with loopback addr\n"));
4435 		goto icmp_err_ret;
4436 	}
4437 
4438 	/*
4439 	 * If this IRE is created for forwarding or it is not for
4440 	 * TCP traffic, mark it as temporary.
4441 	 *
4442 	 * Is it sufficient just to check the next header??
4443 	 */
4444 	if (mp->b_prev != NULL || !IP_FLOW_CONTROLLED_ULP(ip6h->ip6_nxt))
4445 		ire_marks |= IRE_MARK_TEMPORARY;
4446 
4447 	/*
4448 	 * Get what we can from ire_ftable_lookup_v6 which will follow an IRE
4449 	 * chain until it gets the most specific information available.
4450 	 * For example, we know that there is no IRE_CACHE for this dest,
4451 	 * but there may be an IRE_OFFSUBNET which specifies a gateway.
4452 	 * ire_ftable_lookup_v6 will look up the gateway, etc.
4453 	 */
4454 
4455 	if (ill == NULL) {
4456 		match_flags = MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT |
4457 		    MATCH_IRE_PARENT | MATCH_IRE_RJ_BHOLE | MATCH_IRE_SECATTR;
4458 		ire = ire_ftable_lookup_v6(v6dstp, 0, 0, 0,
4459 		    NULL, &sire, zoneid, 0, MBLK_GETLABEL(mp),
4460 		    match_flags);
4461 		/*
4462 		 * ire_add_then_send -> ip_newroute_v6 in the CGTP case passes
4463 		 * in a NULL ill, but the packet could be a neighbor
4464 		 * solicitation/advertisment and could have a valid attach_ill.
4465 		 */
4466 		if (attach_ill != NULL)
4467 			ill_refrele(attach_ill);
4468 	} else {
4469 		if (attach_ill != NULL) {
4470 			/*
4471 			 * attach_ill is set only for communicating with
4472 			 * on-link hosts. So, don't look for DEFAULT.
4473 			 * ip_wput_v6 passes the right ill in this case and
4474 			 * hence we can assert.
4475 			 */
4476 			ASSERT(ill == attach_ill);
4477 			ill_refrele(attach_ill);
4478 			do_attach_ill = B_TRUE;
4479 			match_flags = MATCH_IRE_RJ_BHOLE | MATCH_IRE_ILL;
4480 		} else {
4481 			match_flags = MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT |
4482 			    MATCH_IRE_RJ_BHOLE | MATCH_IRE_ILL_GROUP;
4483 		}
4484 		match_flags |= MATCH_IRE_PARENT | MATCH_IRE_SECATTR;
4485 		ire = ire_ftable_lookup_v6(v6dstp, NULL, NULL, 0, ill->ill_ipif,
4486 		    &sire, zoneid, 0, MBLK_GETLABEL(mp), match_flags);
4487 	}
4488 
4489 	ip3dbg(("ip_newroute_v6: ire_ftable_lookup_v6() "
4490 	    "returned ire %p, sire %p\n", (void *)ire, (void *)sire));
4491 
4492 	if (zoneid == ALL_ZONES && ire != NULL) {
4493 		/*
4494 		 * In the forwarding case, we can use a route from any zone
4495 		 * since we won't change the source address. We can easily
4496 		 * assert that the source address is already set when there's no
4497 		 * ip6_info header - otherwise we'd have to call pullupmsg().
4498 		 */
4499 		ASSERT(ip6i_present ||
4500 		    !IN6_IS_ADDR_UNSPECIFIED(&ip6h->ip6_src));
4501 		zoneid = ire->ire_zoneid;
4502 	}
4503 
4504 	/*
4505 	 * We enter a loop that will be run only once in most cases.
4506 	 * The loop is re-entered in the case where the destination
4507 	 * can be reached through multiple RTF_MULTIRT-flagged routes.
4508 	 * The intention is to compute multiple routes to a single
4509 	 * destination in a single ip_newroute_v6 call.
4510 	 * The information is contained in sire->ire_flags.
4511 	 */
4512 	do {
4513 		multirt_resolve_next = B_FALSE;
4514 
4515 		if (dst_ill != NULL) {
4516 			ill_refrele(dst_ill);
4517 			dst_ill = NULL;
4518 		}
4519 		if (src_ipif != NULL) {
4520 			ipif_refrele(src_ipif);
4521 			src_ipif = NULL;
4522 		}
4523 		if ((sire != NULL) && sire->ire_flags & RTF_MULTIRT) {
4524 			ip3dbg(("ip_newroute_v6: starting new resolution "
4525 			    "with first_mp %p, tag %d\n",
4526 			    (void *)first_mp, MULTIRT_DEBUG_TAGGED(first_mp)));
4527 
4528 			/*
4529 			 * We check if there are trailing unresolved routes for
4530 			 * the destination contained in sire.
4531 			 */
4532 			multirt_is_resolvable = ire_multirt_lookup_v6(&ire,
4533 			    &sire, multirt_flags, MBLK_GETLABEL(mp));
4534 
4535 			ip3dbg(("ip_newroute_v6: multirt_is_resolvable %d, "
4536 			    "ire %p, sire %p\n",
4537 			    multirt_is_resolvable, (void *)ire, (void *)sire));
4538 
4539 			if (!multirt_is_resolvable) {
4540 				/*
4541 				 * No more multirt routes to resolve; give up
4542 				 * (all routes resolved or no more resolvable
4543 				 * routes).
4544 				 */
4545 				if (ire != NULL) {
4546 					ire_refrele(ire);
4547 					ire = NULL;
4548 				}
4549 			} else {
4550 				ASSERT(sire != NULL);
4551 				ASSERT(ire != NULL);
4552 				/*
4553 				 * We simply use first_sire as a flag that
4554 				 * indicates if a resolvable multirt route has
4555 				 * already been found during the preceding
4556 				 * loops. If it is not the case, we may have
4557 				 * to send an ICMP error to report that the
4558 				 * destination is unreachable. We do not
4559 				 * IRE_REFHOLD first_sire.
4560 				 */
4561 				if (first_sire == NULL) {
4562 					first_sire = sire;
4563 				}
4564 			}
4565 		}
4566 		if ((ire == NULL) || (ire == sire)) {
4567 			/*
4568 			 * either ire == NULL (the destination cannot be
4569 			 * resolved) or ire == sire (the gateway cannot be
4570 			 * resolved). At this point, there are no more routes
4571 			 * to resolve for the destination, thus we exit.
4572 			 */
4573 			if (ip_debug > 3) {
4574 				/* ip2dbg */
4575 				pr_addr_dbg("ip_newroute_v6: "
4576 				    "can't resolve %s\n", AF_INET6, v6dstp);
4577 			}
4578 			ip3dbg(("ip_newroute_v6: "
4579 			    "ire %p, sire %p, first_sire %p\n",
4580 			    (void *)ire, (void *)sire, (void *)first_sire));
4581 
4582 			if (sire != NULL) {
4583 				ire_refrele(sire);
4584 				sire = NULL;
4585 			}
4586 
4587 			if (first_sire != NULL) {
4588 				/*
4589 				 * At least one multirt route has been found
4590 				 * in the same ip_newroute() call; there is no
4591 				 * need to report an ICMP error.
4592 				 * first_sire was not IRE_REFHOLDed.
4593 				 */
4594 				MULTIRT_DEBUG_UNTAG(first_mp);
4595 				freemsg(first_mp);
4596 				return;
4597 			}
4598 			ip_rts_change_v6(RTM_MISS, v6dstp, 0, 0, 0, 0, 0, 0,
4599 			    RTA_DST);
4600 			goto icmp_err_ret;
4601 		}
4602 
4603 		ASSERT(ire->ire_ipversion == IPV6_VERSION);
4604 
4605 		/*
4606 		 * Verify that the returned IRE does not have either the
4607 		 * RTF_REJECT or RTF_BLACKHOLE flags set and that the IRE is
4608 		 * either an IRE_CACHE, IRE_IF_NORESOLVER or IRE_IF_RESOLVER.
4609 		 */
4610 		if ((ire->ire_flags & (RTF_REJECT | RTF_BLACKHOLE)) ||
4611 		    (ire->ire_type & (IRE_CACHE | IRE_INTERFACE)) == 0)
4612 			goto icmp_err_ret;
4613 
4614 		/*
4615 		 * Increment the ire_ob_pkt_count field for ire if it is an
4616 		 * INTERFACE (IF_RESOLVER or IF_NORESOLVER) IRE type, and
4617 		 * increment the same for the parent IRE, sire, if it is some
4618 		 * sort of prefix IRE (which includes DEFAULT, PREFIX, HOST
4619 		 * and HOST_REDIRECT).
4620 		 */
4621 		if ((ire->ire_type & IRE_INTERFACE) != 0) {
4622 			UPDATE_OB_PKT_COUNT(ire);
4623 			ire->ire_last_used_time = lbolt;
4624 		}
4625 
4626 		if (sire != NULL) {
4627 			mutex_enter(&sire->ire_lock);
4628 			v6gw = sire->ire_gateway_addr_v6;
4629 			mutex_exit(&sire->ire_lock);
4630 			ASSERT((sire->ire_type & (IRE_CACHETABLE |
4631 			    IRE_INTERFACE)) == 0);
4632 			UPDATE_OB_PKT_COUNT(sire);
4633 			sire->ire_last_used_time = lbolt;
4634 		} else {
4635 			v6gw = ipv6_all_zeros;
4636 		}
4637 
4638 		/*
4639 		 * We have a route to reach the destination.
4640 		 *
4641 		 * 1) If the interface is part of ill group, try to get a new
4642 		 *    ill taking load spreading into account.
4643 		 *
4644 		 * 2) After selecting the ill, get a source address that might
4645 		 *    create good inbound load spreading and that matches the
4646 		 *    right scope. ipif_select_source_v6 does this for us.
4647 		 *
4648 		 * If the application specified the ill (ifindex), we still
4649 		 * load spread. Only if the packets needs to go out specifically
4650 		 * on a given ill e.g. bind to IPIF_NOFAILOVER address,
4651 		 * IPV6_BOUND_PIF we don't try to use a different ill for load
4652 		 * spreading.
4653 		 */
4654 		if (!do_attach_ill) {
4655 			/*
4656 			 * If the interface belongs to an interface group,
4657 			 * make sure the next possible interface in the group
4658 			 * is used.  This encourages load spreading among
4659 			 * peers in an interface group. However, in the case
4660 			 * of multirouting, load spreading is not used, as we
4661 			 * actually want to replicate outgoing packets through
4662 			 * particular interfaces.
4663 			 *
4664 			 * Note: While we pick a dst_ill we are really only
4665 			 * interested in the ill for load spreading.
4666 			 * The source ipif is determined by source address
4667 			 * selection below.
4668 			 */
4669 			if ((sire != NULL) && (sire->ire_flags & RTF_MULTIRT)) {
4670 				dst_ill = ire->ire_ipif->ipif_ill;
4671 				/* For uniformity do a refhold */
4672 				ill_refhold(dst_ill);
4673 			} else {
4674 				/*
4675 				 * If we are here trying to create an IRE_CACHE
4676 				 * for an offlink destination and have the
4677 				 * IRE_CACHE for the next hop and the latter is
4678 				 * using virtual IP source address selection i.e
4679 				 * it's ire->ire_ipif is pointing to a virtual
4680 				 * network interface (vni) then
4681 				 * ip_newroute_get_dst_ll() will return the vni
4682 				 * interface as the dst_ill. Since the vni is
4683 				 * virtual i.e not associated with any physical
4684 				 * interface, it cannot be the dst_ill, hence
4685 				 * in such a case call ip_newroute_get_dst_ll()
4686 				 * with the stq_ill instead of the ire_ipif ILL.
4687 				 * The function returns a refheld ill.
4688 				 */
4689 				if ((ire->ire_type == IRE_CACHE) &&
4690 				    IS_VNI(ire->ire_ipif->ipif_ill))
4691 					dst_ill = ip_newroute_get_dst_ill_v6(
4692 						ire->ire_stq->q_ptr);
4693 				else
4694 					dst_ill = ip_newroute_get_dst_ill_v6(
4695 						ire->ire_ipif->ipif_ill);
4696 			}
4697 			if (dst_ill == NULL) {
4698 				if (ip_debug > 2) {
4699 					pr_addr_dbg("ip_newroute_v6 : no dst "
4700 					    "ill for dst %s\n",
4701 					    AF_INET6, v6dstp);
4702 				}
4703 				goto icmp_err_ret;
4704 			} else if (dst_ill->ill_group == NULL && ill != NULL &&
4705 			    dst_ill != ill) {
4706 				/*
4707 				 * If "ill" is not part of any group, we should
4708 				 * have found a route matching "ill" as we
4709 				 * called ire_ftable_lookup_v6 with
4710 				 * MATCH_IRE_ILL_GROUP.
4711 				 * Rather than asserting when there is a
4712 				 * mismatch, we just drop the packet.
4713 				 */
4714 				ip0dbg(("ip_newroute_v6: BOUND_IF failed : "
4715 				    "dst_ill %s ill %s\n",
4716 				    dst_ill->ill_name,
4717 				    ill->ill_name));
4718 				goto icmp_err_ret;
4719 			}
4720 		} else {
4721 			dst_ill = ire->ire_ipif->ipif_ill;
4722 			/* For uniformity do refhold */
4723 			ill_refhold(dst_ill);
4724 			/*
4725 			 * We should have found a route matching ill as we
4726 			 * called ire_ftable_lookup_v6 with MATCH_IRE_ILL.
4727 			 * Rather than asserting, while there is a mismatch,
4728 			 * we just drop the packet.
4729 			 */
4730 			if (dst_ill != ill) {
4731 				ip0dbg(("ip_newroute_v6: Packet dropped as "
4732 				    "IP6I_ATTACH_IF ill is %s, "
4733 				    "ire->ire_ipif->ipif_ill is %s\n",
4734 				    ill->ill_name,
4735 				    dst_ill->ill_name));
4736 				goto icmp_err_ret;
4737 			}
4738 		}
4739 		/*
4740 		 * Pick a source address which matches the scope of the
4741 		 * destination address.
4742 		 * For RTF_SETSRC routes, the source address is imposed by the
4743 		 * parent ire (sire).
4744 		 */
4745 		ASSERT(src_ipif == NULL);
4746 		if (ire->ire_type == IRE_IF_RESOLVER &&
4747 		    !IN6_IS_ADDR_UNSPECIFIED(&v6gw) &&
4748 		    ip6_asp_can_lookup()) {
4749 			/*
4750 			 * The ire cache entry we're adding is for the
4751 			 * gateway itself.  The source address in this case
4752 			 * is relative to the gateway's address.
4753 			 */
4754 			ip6_asp_table_held = B_TRUE;
4755 			src_ipif = ipif_select_source_v6(dst_ill, &v6gw,
4756 			    B_TRUE, IPV6_PREFER_SRC_DEFAULT, zoneid);
4757 			if (src_ipif != NULL)
4758 				ire_marks |= IRE_MARK_USESRC_CHECK;
4759 		} else {
4760 			if ((sire != NULL) && (sire->ire_flags & RTF_SETSRC)) {
4761 				/*
4762 				 * Check that the ipif matching the requested
4763 				 * source address still exists.
4764 				 */
4765 				src_ipif = ipif_lookup_addr_v6(
4766 				    &sire->ire_src_addr_v6, NULL, zoneid,
4767 					NULL, NULL, NULL, NULL);
4768 			}
4769 			if (src_ipif == NULL && ip6_asp_can_lookup()) {
4770 				ip6_asp_table_held = B_TRUE;
4771 				src_ipif = ipif_select_source_v6(dst_ill,
4772 				    v6dstp, B_FALSE, IPV6_PREFER_SRC_DEFAULT,
4773 				    zoneid);
4774 				if (src_ipif != NULL)
4775 					ire_marks |= IRE_MARK_USESRC_CHECK;
4776 			}
4777 		}
4778 
4779 		if (src_ipif == NULL) {
4780 			if (ip_debug > 2) {
4781 				/* ip1dbg */
4782 				pr_addr_dbg("ip_newroute_v6: no src for "
4783 				    "dst %s\n, ", AF_INET6, v6dstp);
4784 				printf("ip_newroute_v6: interface name %s\n",
4785 				    dst_ill->ill_name);
4786 			}
4787 			goto icmp_err_ret;
4788 		}
4789 
4790 		if (ip_debug > 3) {
4791 			/* ip2dbg */
4792 			pr_addr_dbg("ip_newroute_v6: first hop %s\n",
4793 			    AF_INET6, &v6gw);
4794 		}
4795 		ip2dbg(("\tire type %s (%d)\n",
4796 		    ip_nv_lookup(ire_nv_tbl, ire->ire_type), ire->ire_type));
4797 
4798 		/*
4799 		 * At this point in ip_newroute_v6(), ire is either the
4800 		 * IRE_CACHE of the next-hop gateway for an off-subnet
4801 		 * destination or an IRE_INTERFACE type that should be used
4802 		 * to resolve an on-subnet destination or an on-subnet
4803 		 * next-hop gateway.
4804 		 *
4805 		 * In the IRE_CACHE case, we have the following :
4806 		 *
4807 		 * 1) src_ipif - used for getting a source address.
4808 		 *
4809 		 * 2) dst_ill - from which we derive ire_stq/ire_rfq. This
4810 		 *    means packets using this IRE_CACHE will go out on dst_ill.
4811 		 *
4812 		 * 3) The IRE sire will point to the prefix that is the longest
4813 		 *    matching route for the destination. These prefix types
4814 		 *    include IRE_DEFAULT, IRE_PREFIX, IRE_HOST, and
4815 		 *    IRE_HOST_REDIRECT.
4816 		 *
4817 		 *    The newly created IRE_CACHE entry for the off-subnet
4818 		 *    destination is tied to both the prefix route and the
4819 		 *    interface route used to resolve the next-hop gateway
4820 		 *    via the ire_phandle and ire_ihandle fields, respectively.
4821 		 *
4822 		 * In the IRE_INTERFACE case, we have the following :
4823 		 *
4824 		 * 1) src_ipif - used for getting a source address.
4825 		 *
4826 		 * 2) dst_ill - from which we derive ire_stq/ire_rfq. This
4827 		 *    means packets using the IRE_CACHE that we will build
4828 		 *    here will go out on dst_ill.
4829 		 *
4830 		 * 3) sire may or may not be NULL. But, the IRE_CACHE that is
4831 		 *    to be created will only be tied to the IRE_INTERFACE that
4832 		 *    was derived from the ire_ihandle field.
4833 		 *
4834 		 *    If sire is non-NULL, it means the destination is off-link
4835 		 *    and we will first create the IRE_CACHE for the gateway.
4836 		 *    Next time through ip_newroute_v6, we will create the
4837 		 *    IRE_CACHE for the final destination as described above.
4838 		 */
4839 		save_ire = ire;
4840 		switch (ire->ire_type) {
4841 		case IRE_CACHE: {
4842 			ire_t	*ipif_ire;
4843 
4844 			ASSERT(sire != NULL);
4845 			if (IN6_IS_ADDR_UNSPECIFIED(&v6gw)) {
4846 				mutex_enter(&ire->ire_lock);
4847 				v6gw = ire->ire_gateway_addr_v6;
4848 				mutex_exit(&ire->ire_lock);
4849 			}
4850 			/*
4851 			 * We need 3 ire's to create a new cache ire for an
4852 			 * off-link destination from the cache ire of the
4853 			 * gateway.
4854 			 *
4855 			 *	1. The prefix ire 'sire'
4856 			 *	2. The cache ire of the gateway 'ire'
4857 			 *	3. The interface ire 'ipif_ire'
4858 			 *
4859 			 * We have (1) and (2). We lookup (3) below.
4860 			 *
4861 			 * If there is no interface route to the gateway,
4862 			 * it is a race condition, where we found the cache
4863 			 * but the inteface route has been deleted.
4864 			 */
4865 			ipif_ire = ire_ihandle_lookup_offlink_v6(ire, sire);
4866 			if (ipif_ire == NULL) {
4867 				ip1dbg(("ip_newroute_v6:"
4868 				    "ire_ihandle_lookup_offlink_v6 failed\n"));
4869 				goto icmp_err_ret;
4870 			}
4871 			/*
4872 			 * Assume DL_UNITDATA_REQ is same for all physical
4873 			 * interfaces in the ifgrp.  If it isn't, this code will
4874 			 * have to be seriously rewhacked to allow the
4875 			 * fastpath probing (such that I cache the link
4876 			 * header in the IRE_CACHE) to work over ifgrps.
4877 			 * We have what we need to build an IRE_CACHE.
4878 			 */
4879 			/*
4880 			 * Note: the new ire inherits RTF_SETSRC
4881 			 * and RTF_MULTIRT to propagate these flags from prefix
4882 			 * to cache.
4883 			 */
4884 
4885 			/*
4886 			 * Check cached gateway IRE for any security
4887 			 * attributes; if found, associate the gateway
4888 			 * credentials group to the destination IRE.
4889 			 */
4890 			if ((attrp = save_ire->ire_gw_secattr) != NULL) {
4891 				mutex_enter(&attrp->igsa_lock);
4892 				if ((gcgrp = attrp->igsa_gcgrp) != NULL)
4893 					GCGRP_REFHOLD(gcgrp);
4894 				mutex_exit(&attrp->igsa_lock);
4895 			}
4896 
4897 			ire = ire_create_v6(
4898 				v6dstp,			/* dest address */
4899 				&ipv6_all_ones,		/* mask */
4900 				&src_ipif->ipif_v6src_addr, /* source address */
4901 				&v6gw,			/* gateway address */
4902 				&save_ire->ire_max_frag,
4903 				NULL,			/* Fast Path header */
4904 				dst_ill->ill_rq,	/* recv-from queue */
4905 				dst_ill->ill_wq,	/* send-to queue */
4906 				IRE_CACHE,
4907 				NULL,
4908 				src_ipif,
4909 				&sire->ire_mask_v6,	/* Parent mask */
4910 				sire->ire_phandle,	/* Parent handle */
4911 				ipif_ire->ire_ihandle,	/* Interface handle */
4912 				sire->ire_flags &	/* flags if any */
4913 				    (RTF_SETSRC | RTF_MULTIRT),
4914 				&(sire->ire_uinfo),
4915 				NULL,
4916 				gcgrp);
4917 
4918 			if (ire == NULL) {
4919 				if (gcgrp != NULL) {
4920 					GCGRP_REFRELE(gcgrp);
4921 					gcgrp = NULL;
4922 				}
4923 				ire_refrele(save_ire);
4924 				ire_refrele(ipif_ire);
4925 				break;
4926 			}
4927 
4928 			/* reference now held by IRE */
4929 			gcgrp = NULL;
4930 
4931 			ire->ire_marks |= ire_marks;
4932 
4933 			/*
4934 			 * Prevent sire and ipif_ire from getting deleted. The
4935 			 * newly created ire is tied to both of them via the
4936 			 * phandle and ihandle respectively.
4937 			 */
4938 			IRB_REFHOLD(sire->ire_bucket);
4939 			/* Has it been removed already ? */
4940 			if (sire->ire_marks & IRE_MARK_CONDEMNED) {
4941 				IRB_REFRELE(sire->ire_bucket);
4942 				ire_refrele(ipif_ire);
4943 				ire_refrele(save_ire);
4944 				break;
4945 			}
4946 
4947 			IRB_REFHOLD(ipif_ire->ire_bucket);
4948 			/* Has it been removed already ? */
4949 			if (ipif_ire->ire_marks & IRE_MARK_CONDEMNED) {
4950 				IRB_REFRELE(ipif_ire->ire_bucket);
4951 				IRB_REFRELE(sire->ire_bucket);
4952 				ire_refrele(ipif_ire);
4953 				ire_refrele(save_ire);
4954 				break;
4955 			}
4956 
4957 			xmit_mp = first_mp;
4958 			if (ire->ire_flags & RTF_MULTIRT) {
4959 				copy_mp = copymsg(first_mp);
4960 				if (copy_mp != NULL) {
4961 					xmit_mp = copy_mp;
4962 					MULTIRT_DEBUG_TAG(first_mp);
4963 				}
4964 			}
4965 			ire_add_then_send(q, ire, xmit_mp);
4966 			if (ip6_asp_table_held) {
4967 				ip6_asp_table_refrele();
4968 				ip6_asp_table_held = B_FALSE;
4969 			}
4970 			ire_refrele(save_ire);
4971 
4972 			/* Assert that sire is not deleted yet. */
4973 			ASSERT(sire->ire_ptpn != NULL);
4974 			IRB_REFRELE(sire->ire_bucket);
4975 
4976 			/* Assert that ipif_ire is not deleted yet. */
4977 			ASSERT(ipif_ire->ire_ptpn != NULL);
4978 			IRB_REFRELE(ipif_ire->ire_bucket);
4979 			ire_refrele(ipif_ire);
4980 
4981 			if (copy_mp != NULL) {
4982 				/*
4983 				 * Search for the next unresolved
4984 				 * multirt route.
4985 				 */
4986 				copy_mp = NULL;
4987 				ipif_ire = NULL;
4988 				ire = NULL;
4989 				/* re-enter the loop */
4990 				multirt_resolve_next = B_TRUE;
4991 				continue;
4992 			}
4993 			ire_refrele(sire);
4994 			ill_refrele(dst_ill);
4995 			ipif_refrele(src_ipif);
4996 			return;
4997 		}
4998 		case IRE_IF_NORESOLVER:
4999 			/*
5000 			 * We have what we need to build an IRE_CACHE.
5001 			 *
5002 			 * Create a new dlureq_mp with the IPv6 gateway
5003 			 * address in destination address in the DLPI hdr
5004 			 * if the physical length is exactly 16 bytes.
5005 			 */
5006 			if (dst_ill->ill_phys_addr_length == IPV6_ADDR_LEN) {
5007 				const in6_addr_t *addr;
5008 
5009 				if (!IN6_IS_ADDR_UNSPECIFIED(&v6gw))
5010 					addr = &v6gw;
5011 				else
5012 					addr = v6dstp;
5013 
5014 				dlureq_mp = ill_dlur_gen((uchar_t *)addr,
5015 				    dst_ill->ill_phys_addr_length,
5016 				    dst_ill->ill_sap,
5017 				    dst_ill->ill_sap_length);
5018 			} else {
5019 				dlureq_mp = ire->ire_dlureq_mp;
5020 			}
5021 			if (dlureq_mp == NULL)
5022 				break;
5023 			/*
5024 			 * TSol note: We are creating the ire cache for the
5025 			 * destination 'dst'. If 'dst' is offlink, going
5026 			 * through the first hop 'gw', the security attributes
5027 			 * of 'dst' must be set to point to the gateway
5028 			 * credentials of gateway 'gw'. If 'dst' is onlink, it
5029 			 * is possible that 'dst' is a potential gateway that is
5030 			 * referenced by some route that has some security
5031 			 * attributes. Thus in the former case, we need to do a
5032 			 * gcgrp_lookup of 'gw' while in the latter case we
5033 			 * need to do gcgrp_lookup of 'dst' itself.
5034 			 */
5035 			ga.ga_af = AF_INET6;
5036 			if (!IN6_IS_ADDR_UNSPECIFIED(&v6gw))
5037 				ga.ga_addr = v6gw;
5038 			else
5039 				ga.ga_addr = *v6dstp;
5040 			gcgrp = gcgrp_lookup(&ga, B_FALSE);
5041 
5042 			/*
5043 			 * Note: the new ire inherits sire flags RTF_SETSRC
5044 			 * and RTF_MULTIRT to propagate those rules from prefix
5045 			 * to cache.
5046 			 */
5047 			ire = ire_create_v6(
5048 				v6dstp,			/* dest address */
5049 				&ipv6_all_ones,		/* mask */
5050 				&src_ipif->ipif_v6src_addr, /* source address */
5051 				&v6gw,			/* gateway address */
5052 				&save_ire->ire_max_frag,
5053 				NULL,			/* Fast Path header */
5054 				dst_ill->ill_rq,	/* recv-from queue */
5055 				dst_ill->ill_wq,	/* send-to queue */
5056 				IRE_CACHE,
5057 				dlureq_mp,
5058 				src_ipif,
5059 				&save_ire->ire_mask_v6,	/* Parent mask */
5060 				(sire != NULL) ?	/* Parent handle */
5061 				    sire->ire_phandle : 0,
5062 				save_ire->ire_ihandle,	/* Interface handle */
5063 				(sire != NULL) ?	/* flags if any */
5064 				    sire->ire_flags &
5065 				    (RTF_SETSRC | RTF_MULTIRT) : 0,
5066 				&(save_ire->ire_uinfo),
5067 				NULL,
5068 				gcgrp);
5069 
5070 			if (dst_ill->ill_phys_addr_length == IPV6_ADDR_LEN)
5071 				freeb(dlureq_mp);
5072 
5073 			if (ire == NULL) {
5074 				if (gcgrp != NULL) {
5075 					GCGRP_REFRELE(gcgrp);
5076 					gcgrp = NULL;
5077 				}
5078 				ire_refrele(save_ire);
5079 				break;
5080 			}
5081 
5082 			/* reference now held by IRE */
5083 			gcgrp = NULL;
5084 
5085 			ire->ire_marks |= ire_marks;
5086 
5087 			if (!IN6_IS_ADDR_UNSPECIFIED(&v6gw))
5088 				dst = v6gw;
5089 			else
5090 				dst = *v6dstp;
5091 			err = ndp_noresolver(dst_ill, &dst);
5092 			if (err != 0) {
5093 				ire_refrele(save_ire);
5094 				break;
5095 			}
5096 
5097 			/* Prevent save_ire from getting deleted */
5098 			IRB_REFHOLD(save_ire->ire_bucket);
5099 			/* Has it been removed already ? */
5100 			if (save_ire->ire_marks & IRE_MARK_CONDEMNED) {
5101 				IRB_REFRELE(save_ire->ire_bucket);
5102 				ire_refrele(save_ire);
5103 				break;
5104 			}
5105 
5106 			xmit_mp = first_mp;
5107 			/*
5108 			 * In case of MULTIRT, a copy of the current packet
5109 			 * to send is made to further re-enter the
5110 			 * loop and attempt another route resolution
5111 			 */
5112 			if ((sire != NULL) && sire->ire_flags & RTF_MULTIRT) {
5113 				copy_mp = copymsg(first_mp);
5114 				if (copy_mp != NULL) {
5115 					xmit_mp = copy_mp;
5116 					MULTIRT_DEBUG_TAG(first_mp);
5117 				}
5118 			}
5119 			ire_add_then_send(q, ire, xmit_mp);
5120 			if (ip6_asp_table_held) {
5121 				ip6_asp_table_refrele();
5122 				ip6_asp_table_held = B_FALSE;
5123 			}
5124 
5125 			/* Assert that it is not deleted yet. */
5126 			ASSERT(save_ire->ire_ptpn != NULL);
5127 			IRB_REFRELE(save_ire->ire_bucket);
5128 			ire_refrele(save_ire);
5129 
5130 			if (copy_mp != NULL) {
5131 				/*
5132 				 * If we found a (no)resolver, we ignore any
5133 				 * trailing top priority IRE_CACHE in
5134 				 * further loops. This ensures that we do not
5135 				 * omit any (no)resolver despite the priority
5136 				 * in this call.
5137 				 * IRE_CACHE, if any, will be processed
5138 				 * by another thread entering ip_newroute(),
5139 				 * (on resolver response, for example).
5140 				 * We use this to force multiple parallel
5141 				 * resolution as soon as a packet needs to be
5142 				 * sent. The result is, after one packet
5143 				 * emission all reachable routes are generally
5144 				 * resolved.
5145 				 * Otherwise, complete resolution of MULTIRT
5146 				 * routes would require several emissions as
5147 				 * side effect.
5148 				 */
5149 				multirt_flags &= ~MULTIRT_CACHEGW;
5150 
5151 				/*
5152 				 * Search for the next unresolved multirt
5153 				 * route.
5154 				 */
5155 				copy_mp = NULL;
5156 				save_ire = NULL;
5157 				ire = NULL;
5158 				/* re-enter the loop */
5159 				multirt_resolve_next = B_TRUE;
5160 				continue;
5161 			}
5162 
5163 			/* Don't need sire anymore */
5164 			if (sire != NULL)
5165 				ire_refrele(sire);
5166 			ill_refrele(dst_ill);
5167 			ipif_refrele(src_ipif);
5168 			return;
5169 
5170 		case IRE_IF_RESOLVER:
5171 			/*
5172 			 * We can't build an IRE_CACHE yet, but at least we
5173 			 * found a resolver that can help.
5174 			 */
5175 			dst = *v6dstp;
5176 
5177 			/*
5178 			 * To be at this point in the code with a non-zero gw
5179 			 * means that dst is reachable through a gateway that
5180 			 * we have never resolved.  By changing dst to the gw
5181 			 * addr we resolve the gateway first.  When
5182 			 * ire_add_then_send() tries to put the IP dg to dst,
5183 			 * it will reenter ip_newroute() at which time we will
5184 			 * find the IRE_CACHE for the gw and create another
5185 			 * IRE_CACHE above (for dst itself).
5186 			 */
5187 			if (!IN6_IS_ADDR_UNSPECIFIED(&v6gw)) {
5188 				save_dst = dst;
5189 				dst = v6gw;
5190 				v6gw = ipv6_all_zeros;
5191 			}
5192 			/*
5193 			 * TSol note: Please see the note above the
5194 			 * IRE_IF_NORESOLVER case.
5195 			 */
5196 			ga.ga_af = AF_INET6;
5197 			ga.ga_addr = dst;
5198 			gcgrp = gcgrp_lookup(&ga, B_FALSE);
5199 			if (dst_ill->ill_flags & ILLF_XRESOLV) {
5200 				/*
5201 				 * Ask the external resolver to do its thing.
5202 				 * Make an mblk chain in the following form:
5203 				 * ARQ_REQ_MBLK-->IRE_MBLK-->packet
5204 				 */
5205 				mblk_t		*ire_mp;
5206 				mblk_t		*areq_mp;
5207 				areq_t		*areq;
5208 				in6_addr_t	*addrp;
5209 
5210 				ip1dbg(("ip_newroute_v6:ILLF_XRESOLV\n"));
5211 				if (ip6_asp_table_held) {
5212 					ip6_asp_table_refrele();
5213 					ip6_asp_table_held = B_FALSE;
5214 				}
5215 				ire = ire_create_mp_v6(
5216 					&dst,		/* dest address */
5217 					&ipv6_all_ones,	/* mask */
5218 					&src_ipif->ipif_v6src_addr,
5219 							/* source address */
5220 					&v6gw,		/* gateway address */
5221 					NULL,		/* Fast Path header */
5222 					dst_ill->ill_rq, /* recv-from queue */
5223 					dst_ill->ill_wq, /* send-to queue */
5224 					IRE_CACHE,
5225 					NULL,
5226 					src_ipif,
5227 					&save_ire->ire_mask_v6,
5228 							/* Parent mask */
5229 					0,
5230 					save_ire->ire_ihandle,
5231 							/* Interface handle */
5232 					0,		/* flags if any */
5233 					&(save_ire->ire_uinfo),
5234 					NULL,
5235 					gcgrp);
5236 
5237 				ire_refrele(save_ire);
5238 				if (ire == NULL) {
5239 					if (gcgrp != NULL) {
5240 						GCGRP_REFRELE(gcgrp);
5241 						gcgrp = NULL;
5242 					}
5243 					ip1dbg(("ip_newroute_v6:"
5244 					    "ire is NULL\n"));
5245 					break;
5246 				}
5247 
5248 				/* reference now held by IRE */
5249 				gcgrp = NULL;
5250 
5251 				if ((sire != NULL) &&
5252 				    (sire->ire_flags & RTF_MULTIRT)) {
5253 					/*
5254 					 * processing a copy of the packet to
5255 					 * send for further resolution loops
5256 					 */
5257 					copy_mp = copymsg(first_mp);
5258 					if (copy_mp != NULL)
5259 						MULTIRT_DEBUG_TAG(copy_mp);
5260 				}
5261 				ire->ire_marks |= ire_marks;
5262 				ire_mp = ire->ire_mp;
5263 				/*
5264 				 * Now create or find an nce for this interface.
5265 				 * The hw addr will need to to be set from
5266 				 * the reply to the AR_ENTRY_QUERY that
5267 				 * we're about to send. This will be done in
5268 				 * ire_add_v6().
5269 				 */
5270 				err = ndp_resolver(dst_ill, &dst, mp, zoneid);
5271 				switch (err) {
5272 				case 0:
5273 					/*
5274 					 * New cache entry created.
5275 					 * Break, then ask the external
5276 					 * resolver.
5277 					 */
5278 					break;
5279 				case EINPROGRESS:
5280 					/*
5281 					 * Resolution in progress;
5282 					 * packet has been queued by
5283 					 * ndp_resolver().
5284 					 */
5285 					ire_delete(ire);
5286 					ire = NULL;
5287 					/*
5288 					 * Check if another multirt
5289 					 * route must be resolved.
5290 					 */
5291 					if (copy_mp != NULL) {
5292 						/*
5293 						 * If we found a resolver, we
5294 						 * ignore any trailing top
5295 						 * priority IRE_CACHE in
5296 						 * further loops. The reason is
5297 						 * the same as for noresolver.
5298 						 */
5299 						multirt_flags &=
5300 						    ~MULTIRT_CACHEGW;
5301 						/*
5302 						 * Search for the next
5303 						 * unresolved multirt route.
5304 						 */
5305 						first_mp = copy_mp;
5306 						copy_mp = NULL;
5307 						mp = first_mp;
5308 						if (mp->b_datap->db_type ==
5309 						    M_CTL) {
5310 							mp = mp->b_cont;
5311 						}
5312 						ASSERT(sire != NULL);
5313 						dst = save_dst;
5314 						/*
5315 						 * re-enter the loop
5316 						 */
5317 						multirt_resolve_next =
5318 						    B_TRUE;
5319 						continue;
5320 					}
5321 
5322 					if (sire != NULL)
5323 						ire_refrele(sire);
5324 					ill_refrele(dst_ill);
5325 					ipif_refrele(src_ipif);
5326 					return;
5327 				default:
5328 					/*
5329 					 * Transient error; packet will be
5330 					 * freed.
5331 					 */
5332 					ire_delete(ire);
5333 					ire = NULL;
5334 					break;
5335 				}
5336 				if (err != 0)
5337 					break;
5338 				/*
5339 				 * Now set up the AR_ENTRY_QUERY and send it.
5340 				 */
5341 				areq_mp = ill_arp_alloc(dst_ill,
5342 				    (uchar_t *)&ipv6_areq_template,
5343 				    (caddr_t)&dst);
5344 				if (areq_mp == NULL) {
5345 					ip1dbg(("ip_newroute_v6:"
5346 					    "areq_mp is NULL\n"));
5347 					freemsg(ire_mp);
5348 					break;
5349 				}
5350 				areq = (areq_t *)areq_mp->b_rptr;
5351 				addrp = (in6_addr_t *)((char *)areq +
5352 				    areq->areq_target_addr_offset);
5353 				*addrp = dst;
5354 				addrp = (in6_addr_t *)((char *)areq +
5355 				    areq->areq_sender_addr_offset);
5356 				*addrp = src_ipif->ipif_v6src_addr;
5357 				/*
5358 				 * link the chain, then send up to the resolver.
5359 				 */
5360 				linkb(areq_mp, ire_mp);
5361 				linkb(areq_mp, mp);
5362 				ip1dbg(("ip_newroute_v6:"
5363 				    "putnext to resolver\n"));
5364 				putnext(dst_ill->ill_rq, areq_mp);
5365 				/*
5366 				 * Check if another multirt route
5367 				 * must be resolved.
5368 				 */
5369 				ire = NULL;
5370 				if (copy_mp != NULL) {
5371 					/*
5372 					 * If we find a resolver, we ignore any
5373 					 * trailing top priority IRE_CACHE in
5374 					 * further loops. The reason is the
5375 					 * same as for noresolver.
5376 					 */
5377 					multirt_flags &= ~MULTIRT_CACHEGW;
5378 					/*
5379 					 * Search for the next unresolved
5380 					 * multirt route.
5381 					 */
5382 					first_mp = copy_mp;
5383 					copy_mp = NULL;
5384 					mp = first_mp;
5385 					if (mp->b_datap->db_type == M_CTL) {
5386 						mp = mp->b_cont;
5387 					}
5388 					ASSERT(sire != NULL);
5389 					dst = save_dst;
5390 					/*
5391 					 * re-enter the loop
5392 					 */
5393 					multirt_resolve_next = B_TRUE;
5394 					continue;
5395 				}
5396 
5397 				if (sire != NULL)
5398 					ire_refrele(sire);
5399 				ill_refrele(dst_ill);
5400 				ipif_refrele(src_ipif);
5401 				return;
5402 			}
5403 			/*
5404 			 * Non-external resolver case.
5405 			 */
5406 			ire = ire_create_v6(
5407 				&dst,			/* dest address */
5408 				&ipv6_all_ones,		/* mask */
5409 				&src_ipif->ipif_v6src_addr, /* source address */
5410 				&v6gw,			/* gateway address */
5411 				&save_ire->ire_max_frag,
5412 				NULL,			/* Fast Path header */
5413 				dst_ill->ill_rq,	/* recv-from queue */
5414 				dst_ill->ill_wq,	/* send-to queue */
5415 				IRE_CACHE,
5416 				NULL,
5417 				src_ipif,
5418 				&save_ire->ire_mask_v6,	/* Parent mask */
5419 				0,
5420 				save_ire->ire_ihandle,	/* Interface handle */
5421 				0,			/* flags if any */
5422 				&(save_ire->ire_uinfo),
5423 				NULL,
5424 				gcgrp);
5425 
5426 			if (ire == NULL) {
5427 				if (gcgrp != NULL) {
5428 					GCGRP_REFRELE(gcgrp);
5429 					gcgrp = NULL;
5430 				}
5431 				ire_refrele(save_ire);
5432 				break;
5433 			}
5434 
5435 			/* reference now held by IRE */
5436 			gcgrp = NULL;
5437 
5438 			if ((sire != NULL) &&
5439 			    (sire->ire_flags & RTF_MULTIRT)) {
5440 				copy_mp = copymsg(first_mp);
5441 				if (copy_mp != NULL)
5442 					MULTIRT_DEBUG_TAG(copy_mp);
5443 			}
5444 
5445 			ire->ire_marks |= ire_marks;
5446 			err = ndp_resolver(dst_ill, &dst, first_mp, zoneid);
5447 			switch (err) {
5448 			case 0:
5449 				/* Prevent save_ire from getting deleted */
5450 				IRB_REFHOLD(save_ire->ire_bucket);
5451 				/* Has it been removed already ? */
5452 				if (save_ire->ire_marks & IRE_MARK_CONDEMNED) {
5453 					IRB_REFRELE(save_ire->ire_bucket);
5454 					ire_refrele(save_ire);
5455 					break;
5456 				}
5457 
5458 				/*
5459 				 * We have a resolved cache entry,
5460 				 * add in the IRE.
5461 				 */
5462 				ire_add_then_send(q, ire, first_mp);
5463 				if (ip6_asp_table_held) {
5464 					ip6_asp_table_refrele();
5465 					ip6_asp_table_held = B_FALSE;
5466 				}
5467 
5468 				/* Assert that it is not deleted yet. */
5469 				ASSERT(save_ire->ire_ptpn != NULL);
5470 				IRB_REFRELE(save_ire->ire_bucket);
5471 				ire_refrele(save_ire);
5472 				/*
5473 				 * Check if another multirt route
5474 				 * must be resolved.
5475 				 */
5476 				ire = NULL;
5477 				if (copy_mp != NULL) {
5478 					/*
5479 					 * If we find a resolver, we ignore any
5480 					 * trailing top priority IRE_CACHE in
5481 					 * further loops. The reason is the
5482 					 * same as for noresolver.
5483 					 */
5484 					multirt_flags &= ~MULTIRT_CACHEGW;
5485 					/*
5486 					 * Search for the next unresolved
5487 					 * multirt route.
5488 					 */
5489 					first_mp = copy_mp;
5490 					copy_mp = NULL;
5491 					mp = first_mp;
5492 					if (mp->b_datap->db_type == M_CTL) {
5493 						mp = mp->b_cont;
5494 					}
5495 					ASSERT(sire != NULL);
5496 					dst = save_dst;
5497 					/*
5498 					 * re-enter the loop
5499 					 */
5500 					multirt_resolve_next = B_TRUE;
5501 					continue;
5502 				}
5503 
5504 				if (sire != NULL)
5505 					ire_refrele(sire);
5506 				ill_refrele(dst_ill);
5507 				ipif_refrele(src_ipif);
5508 				return;
5509 
5510 			case EINPROGRESS:
5511 				/*
5512 				 * mp was consumed - presumably queued.
5513 				 * No need for ire, presumably resolution is
5514 				 * in progress, and ire will be added when the
5515 				 * address is resolved.
5516 				 */
5517 				if (ip6_asp_table_held) {
5518 					ip6_asp_table_refrele();
5519 					ip6_asp_table_held = B_FALSE;
5520 				}
5521 				ASSERT(ire->ire_nce == NULL);
5522 				ire_delete(ire);
5523 				ire_refrele(save_ire);
5524 				/*
5525 				 * Check if another multirt route
5526 				 * must be resolved.
5527 				 */
5528 				ire = NULL;
5529 				if (copy_mp != NULL) {
5530 					/*
5531 					 * If we find a resolver, we ignore any
5532 					 * trailing top priority IRE_CACHE in
5533 					 * further loops. The reason is the
5534 					 * same as for noresolver.
5535 					 */
5536 					multirt_flags &= ~MULTIRT_CACHEGW;
5537 					/*
5538 					 * Search for the next unresolved
5539 					 * multirt route.
5540 					 */
5541 					first_mp = copy_mp;
5542 					copy_mp = NULL;
5543 					mp = first_mp;
5544 					if (mp->b_datap->db_type == M_CTL) {
5545 						mp = mp->b_cont;
5546 					}
5547 					ASSERT(sire != NULL);
5548 					dst = save_dst;
5549 					/*
5550 					 * re-enter the loop
5551 					 */
5552 					multirt_resolve_next = B_TRUE;
5553 					continue;
5554 				}
5555 				if (sire != NULL)
5556 					ire_refrele(sire);
5557 				ill_refrele(dst_ill);
5558 				ipif_refrele(src_ipif);
5559 				return;
5560 			default:
5561 				/* Some transient error */
5562 				ASSERT(ire->ire_nce == NULL);
5563 				ire_refrele(save_ire);
5564 				break;
5565 			}
5566 			break;
5567 		default:
5568 			break;
5569 		}
5570 		if (ip6_asp_table_held) {
5571 			ip6_asp_table_refrele();
5572 			ip6_asp_table_held = B_FALSE;
5573 		}
5574 	} while (multirt_resolve_next);
5575 
5576 err_ret:
5577 	ip1dbg(("ip_newroute_v6: dropped\n"));
5578 	if (src_ipif != NULL)
5579 		ipif_refrele(src_ipif);
5580 	if (dst_ill != NULL) {
5581 		need_rele = B_TRUE;
5582 		ill = dst_ill;
5583 	}
5584 	if (ill != NULL) {
5585 		if (mp->b_prev != NULL) {
5586 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
5587 		} else {
5588 			BUMP_MIB(ill->ill_ip6_mib, ipv6OutDiscards);
5589 		}
5590 
5591 		if (need_rele)
5592 			ill_refrele(ill);
5593 	} else {
5594 		if (mp->b_prev != NULL) {
5595 			BUMP_MIB(&ip6_mib, ipv6InDiscards);
5596 		} else {
5597 			BUMP_MIB(&ip6_mib, ipv6OutDiscards);
5598 		}
5599 	}
5600 	/* Did this packet originate externally? */
5601 	if (mp->b_prev) {
5602 		mp->b_next = NULL;
5603 		mp->b_prev = NULL;
5604 	}
5605 	if (copy_mp != NULL) {
5606 		MULTIRT_DEBUG_UNTAG(copy_mp);
5607 		freemsg(copy_mp);
5608 	}
5609 	MULTIRT_DEBUG_UNTAG(first_mp);
5610 	freemsg(first_mp);
5611 	if (ire != NULL)
5612 		ire_refrele(ire);
5613 	if (sire != NULL)
5614 		ire_refrele(sire);
5615 	return;
5616 
5617 icmp_err_ret:
5618 	if (ip6_asp_table_held)
5619 		ip6_asp_table_refrele();
5620 	if (src_ipif != NULL)
5621 		ipif_refrele(src_ipif);
5622 	if (dst_ill != NULL) {
5623 		need_rele = B_TRUE;
5624 		ill = dst_ill;
5625 	}
5626 	ip1dbg(("ip_newroute_v6: no route\n"));
5627 	if (sire != NULL)
5628 		ire_refrele(sire);
5629 	/*
5630 	 * We need to set sire to NULL to avoid double freeing if we
5631 	 * ever goto err_ret from below.
5632 	 */
5633 	sire = NULL;
5634 	ip6h = (ip6_t *)mp->b_rptr;
5635 	/* Skip ip6i_t header if present */
5636 	if (ip6h->ip6_nxt == IPPROTO_RAW) {
5637 		/* Make sure the IPv6 header is present */
5638 		if ((mp->b_wptr - (uchar_t *)ip6h) <
5639 		    sizeof (ip6i_t) + IPV6_HDR_LEN) {
5640 			if (!pullupmsg(mp, sizeof (ip6i_t) + IPV6_HDR_LEN)) {
5641 				ip1dbg(("ip_newroute_v6: pullupmsg failed\n"));
5642 				goto err_ret;
5643 			}
5644 		}
5645 		mp->b_rptr += sizeof (ip6i_t);
5646 		ip6h = (ip6_t *)mp->b_rptr;
5647 	}
5648 	/* Did this packet originate externally? */
5649 	if (mp->b_prev) {
5650 		if (ill != NULL) {
5651 			BUMP_MIB(ill->ill_ip6_mib, ipv6InNoRoutes);
5652 		} else {
5653 			BUMP_MIB(&ip6_mib, ipv6InNoRoutes);
5654 		}
5655 		mp->b_next = NULL;
5656 		mp->b_prev = NULL;
5657 		q = WR(q);
5658 	} else {
5659 		if (ill != NULL) {
5660 			BUMP_MIB(ill->ill_ip6_mib, ipv6OutNoRoutes);
5661 		} else {
5662 			BUMP_MIB(&ip6_mib, ipv6OutNoRoutes);
5663 		}
5664 		if (ip_hdr_complete_v6(ip6h, zoneid)) {
5665 			/* Failed */
5666 			if (copy_mp != NULL) {
5667 				MULTIRT_DEBUG_UNTAG(copy_mp);
5668 				freemsg(copy_mp);
5669 			}
5670 			MULTIRT_DEBUG_UNTAG(first_mp);
5671 			freemsg(first_mp);
5672 			if (ire != NULL)
5673 				ire_refrele(ire);
5674 			if (need_rele)
5675 				ill_refrele(ill);
5676 			return;
5677 		}
5678 	}
5679 
5680 	if (need_rele)
5681 		ill_refrele(ill);
5682 
5683 	/*
5684 	 * At this point we will have ire only if RTF_BLACKHOLE
5685 	 * or RTF_REJECT flags are set on the IRE. It will not
5686 	 * generate ICMP6_DST_UNREACH_NOROUTE if RTF_BLACKHOLE is set.
5687 	 */
5688 	if (ire != NULL) {
5689 		if (ire->ire_flags & RTF_BLACKHOLE) {
5690 			ire_refrele(ire);
5691 			if (copy_mp != NULL) {
5692 				MULTIRT_DEBUG_UNTAG(copy_mp);
5693 				freemsg(copy_mp);
5694 			}
5695 			MULTIRT_DEBUG_UNTAG(first_mp);
5696 			freemsg(first_mp);
5697 			return;
5698 		}
5699 		ire_refrele(ire);
5700 	}
5701 	if (ip_debug > 3) {
5702 		/* ip2dbg */
5703 		pr_addr_dbg("ip_newroute_v6: no route to %s\n",
5704 		    AF_INET6, v6dstp);
5705 	}
5706 	icmp_unreachable_v6(WR(q), first_mp, ICMP6_DST_UNREACH_NOROUTE,
5707 	    B_FALSE, B_FALSE);
5708 }
5709 
5710 /*
5711  * ip_newroute_ipif_v6 is called by ip_wput_v6 and ip_wput_ipsec_out_v6 whenever
5712  * we need to send out a packet to a destination address for which we do not
5713  * have specific routing information. It is only used for multicast packets.
5714  *
5715  * If unspec_src we allow creating an IRE with source address zero.
5716  * ire_send_v6() will delete it after the packet is sent.
5717  */
5718 void
5719 ip_newroute_ipif_v6(queue_t *q, mblk_t *mp, ipif_t *ipif,
5720     in6_addr_t v6dst, int unspec_src, zoneid_t zoneid)
5721 {
5722 	ire_t	*ire = NULL;
5723 	ipif_t	*src_ipif = NULL;
5724 	int	err = 0;
5725 	ill_t	*dst_ill = NULL;
5726 	ire_t	*save_ire;
5727 	ushort_t ire_marks = 0;
5728 	ipsec_out_t *io;
5729 	ill_t *attach_ill = NULL;
5730 	ill_t *ill;
5731 	ip6_t *ip6h;
5732 	mblk_t *first_mp;
5733 	boolean_t ip6i_present;
5734 	ire_t *fire = NULL;
5735 	mblk_t  *copy_mp = NULL;
5736 	boolean_t multirt_resolve_next;
5737 	in6_addr_t *v6dstp = &v6dst;
5738 	boolean_t ipif_held = B_FALSE;
5739 	boolean_t ill_held = B_FALSE;
5740 	boolean_t ip6_asp_table_held = B_FALSE;
5741 
5742 	/*
5743 	 * This loop is run only once in most cases.
5744 	 * We loop to resolve further routes only when the destination
5745 	 * can be reached through multiple RTF_MULTIRT-flagged ires.
5746 	 */
5747 	do {
5748 		multirt_resolve_next = B_FALSE;
5749 		if (dst_ill != NULL) {
5750 			ill_refrele(dst_ill);
5751 			dst_ill = NULL;
5752 		}
5753 
5754 		if (src_ipif != NULL) {
5755 			ipif_refrele(src_ipif);
5756 			src_ipif = NULL;
5757 		}
5758 		ASSERT(ipif != NULL);
5759 		ill = ipif->ipif_ill;
5760 
5761 		ASSERT(!IN6_IS_ADDR_V4MAPPED(v6dstp));
5762 		if (ip_debug > 2) {
5763 			/* ip1dbg */
5764 			pr_addr_dbg("ip_newroute_ipif_v6: v6dst %s\n",
5765 			    AF_INET6, v6dstp);
5766 			printf("ip_newroute_ipif_v6: if %s, v6 %d\n",
5767 			    ill->ill_name, ipif->ipif_isv6);
5768 		}
5769 
5770 		first_mp = mp;
5771 		if (mp->b_datap->db_type == M_CTL) {
5772 			mp = mp->b_cont;
5773 			io = (ipsec_out_t *)first_mp->b_rptr;
5774 			ASSERT(io->ipsec_out_type == IPSEC_OUT);
5775 		} else {
5776 			io = NULL;
5777 		}
5778 
5779 		/*
5780 		 * If the interface is a pt-pt interface we look for an
5781 		 * IRE_IF_RESOLVER or IRE_IF_NORESOLVER that matches both the
5782 		 * local_address and the pt-pt destination address.
5783 		 * Otherwise we just match the local address.
5784 		 */
5785 		if (!(ill->ill_flags & ILLF_MULTICAST)) {
5786 			goto err_ret;
5787 		}
5788 		/*
5789 		 * If this end point is bound to IPIF_NOFAILOVER, set bnf_ill
5790 		 * and bind_to_nofailover B_TRUE. We can't use conn to determine
5791 		 * as it could be NULL.
5792 		 *
5793 		 * This information can appear either in an ip6i_t or an
5794 		 * IPSEC_OUT message.
5795 		 */
5796 		ip6h = (ip6_t *)mp->b_rptr;
5797 		ip6i_present = (ip6h->ip6_nxt == IPPROTO_RAW);
5798 		if (ip6i_present || (io != NULL && io->ipsec_out_attach_if)) {
5799 			if (!ip6i_present ||
5800 			    ((ip6i_t *)ip6h)->ip6i_flags & IP6I_ATTACH_IF) {
5801 				attach_ill = ip_grab_attach_ill(ill, first_mp,
5802 				    (ip6i_present ?
5803 					((ip6i_t *)ip6h)->ip6i_ifindex :
5804 					io->ipsec_out_ill_index), B_TRUE);
5805 				/* Failure case frees things for us. */
5806 				if (attach_ill == NULL)
5807 					return;
5808 
5809 				/*
5810 				 * Check if we need an ire that will not be
5811 				 * looked up by anybody else i.e. HIDDEN.
5812 				 */
5813 				if (ill_is_probeonly(attach_ill))
5814 					ire_marks = IRE_MARK_HIDDEN;
5815 			}
5816 		}
5817 
5818 		/*
5819 		 * We check if an IRE_OFFSUBNET for the addr that goes through
5820 		 * ipif exists. We need it to determine if the RTF_SETSRC and/or
5821 		 * RTF_MULTIRT flags must be honored.
5822 		 */
5823 		fire = ipif_lookup_multi_ire_v6(ipif, v6dstp);
5824 		ip2dbg(("ip_newroute_ipif_v6: "
5825 			"ipif_lookup_multi_ire_v6("
5826 			"ipif %p, dst %08x) = fire %p\n",
5827 			(void *)ipif, ntohl(V4_PART_OF_V6((*v6dstp))),
5828 			(void *)fire));
5829 
5830 		/*
5831 		 * If the application specified the ill (ifindex), we still
5832 		 * load spread. Only if the packets needs to go out specifically
5833 		 * on a given ill e.g. binding to IPIF_NOFAILOVER address or
5834 		 * IPV6_BOUND_PIF, or there is a parent ire entry that specified
5835 		 * multirouting, then we don't try to use a different ill for
5836 		 * load spreading.
5837 		 */
5838 		if (attach_ill == NULL) {
5839 			/*
5840 			 * If the interface belongs to an interface group,
5841 			 * make sure the next possible interface in the group
5842 			 * is used.  This encourages load spreading among peers
5843 			 * in an interface group.
5844 			 *
5845 			 * Note: While we pick a dst_ill we are really only
5846 			 * interested in the ill for load spreading. The source
5847 			 * ipif is determined by source address selection below.
5848 			 */
5849 			if ((fire != NULL) && (fire->ire_flags & RTF_MULTIRT)) {
5850 				dst_ill = ipif->ipif_ill;
5851 				/* For uniformity do a refhold */
5852 				ill_refhold(dst_ill);
5853 			} else {
5854 				/* refheld by ip_newroute_get_dst_ill_v6 */
5855 				dst_ill =
5856 				    ip_newroute_get_dst_ill_v6(ipif->ipif_ill);
5857 			}
5858 			if (dst_ill == NULL) {
5859 				if (ip_debug > 2) {
5860 					pr_addr_dbg("ip_newroute_ipif_v6: "
5861 					    "no dst ill for dst %s\n",
5862 					    AF_INET6, v6dstp);
5863 				}
5864 				goto err_ret;
5865 			}
5866 		} else {
5867 			dst_ill = ipif->ipif_ill;
5868 			/*
5869 			 * ip_wput_v6 passes the right ipif for IPIF_NOFAILOVER
5870 			 * and IPV6_BOUND_PIF case.
5871 			 */
5872 			ASSERT(dst_ill == attach_ill);
5873 			/* attach_ill is already refheld */
5874 		}
5875 		/*
5876 		 * Pick a source address which matches the scope of the
5877 		 * destination address.
5878 		 * For RTF_SETSRC routes, the source address is imposed by the
5879 		 * parent ire (fire).
5880 		 */
5881 		ASSERT(src_ipif == NULL);
5882 		if ((fire != NULL) && (fire->ire_flags & RTF_SETSRC)) {
5883 			/*
5884 			 * Check that the ipif matching the requested source
5885 			 * address still exists.
5886 			 */
5887 			src_ipif =
5888 			    ipif_lookup_addr_v6(&fire->ire_src_addr_v6,
5889 				NULL, zoneid, NULL, NULL, NULL, NULL);
5890 		}
5891 		if (src_ipif == NULL && ip6_asp_can_lookup()) {
5892 			ip6_asp_table_held = B_TRUE;
5893 			src_ipif = ipif_select_source_v6(dst_ill, v6dstp,
5894 			    B_FALSE, IPV6_PREFER_SRC_DEFAULT, zoneid);
5895 		}
5896 
5897 		if (src_ipif == NULL) {
5898 			if (!unspec_src) {
5899 				if (ip_debug > 2) {
5900 					/* ip1dbg */
5901 					pr_addr_dbg("ip_newroute_ipif_v6: "
5902 					    "no src for dst %s\n,",
5903 					    AF_INET6, v6dstp);
5904 					printf(" through interface %s\n",
5905 					    dst_ill->ill_name);
5906 				}
5907 				goto err_ret;
5908 			}
5909 			/* Use any ipif for source */
5910 			for (src_ipif = dst_ill->ill_ipif; src_ipif != NULL;
5911 			    src_ipif = src_ipif->ipif_next) {
5912 				if ((src_ipif->ipif_flags & IPIF_UP) &&
5913 				    IN6_IS_ADDR_UNSPECIFIED(
5914 				    &src_ipif->ipif_v6src_addr))
5915 					break;
5916 			}
5917 			if (src_ipif == NULL) {
5918 				if (ip_debug > 2) {
5919 					/* ip1dbg */
5920 					pr_addr_dbg("ip_newroute_ipif_v6: "
5921 					    "no src for dst %s\n ",
5922 					    AF_INET6, v6dstp);
5923 					printf("ip_newroute_ipif_v6: if %s"
5924 					    "(UNSPEC_SRC)\n",
5925 					    dst_ill->ill_name);
5926 				}
5927 				goto err_ret;
5928 			}
5929 			src_ipif = ipif;
5930 			ipif_refhold(src_ipif);
5931 		}
5932 		ire = ipif_to_ire_v6(ipif);
5933 		if (ire == NULL) {
5934 			if (ip_debug > 2) {
5935 				/* ip1dbg */
5936 				pr_addr_dbg("ip_newroute_ipif_v6: v6src %s\n",
5937 				    AF_INET6, &ipif->ipif_v6lcl_addr);
5938 				printf("ip_newroute_ipif_v6: "
5939 				    "if %s\n", dst_ill->ill_name);
5940 			}
5941 			goto err_ret;
5942 		}
5943 		if (ire->ire_flags & (RTF_REJECT | RTF_BLACKHOLE))
5944 			goto err_ret;
5945 
5946 		ASSERT(ire->ire_ipversion == IPV6_VERSION);
5947 
5948 		ip1dbg(("ip_newroute_ipif_v6: interface type %s (%d),",
5949 		    ip_nv_lookup(ire_nv_tbl, ire->ire_type), ire->ire_type));
5950 		if (ip_debug > 2) {
5951 			/* ip1dbg */
5952 			pr_addr_dbg(" address %s\n",
5953 			    AF_INET6, &ire->ire_src_addr_v6);
5954 		}
5955 		save_ire = ire;
5956 		ip2dbg(("ip_newroute_ipif: ire %p, ipif %p\n",
5957 			(void *)ire, (void *)ipif));
5958 
5959 		if ((fire != NULL) && (fire->ire_flags & RTF_MULTIRT)) {
5960 			/*
5961 			 * an IRE_OFFSUBET was looked up
5962 			 * on that interface.
5963 			 * this ire has RTF_MULTIRT flag,
5964 			 * so the resolution loop
5965 			 * will be re-entered to resolve
5966 			 * additional routes on other
5967 			 * interfaces. For that purpose,
5968 			 * a copy of the packet is
5969 			 * made at this point.
5970 			 */
5971 			fire->ire_last_used_time = lbolt;
5972 			copy_mp = copymsg(first_mp);
5973 			if (copy_mp) {
5974 				MULTIRT_DEBUG_TAG(copy_mp);
5975 			}
5976 		}
5977 
5978 		ASSERT((attach_ill == NULL) || (dst_ill == attach_ill));
5979 		switch (ire->ire_type) {
5980 		case IRE_IF_NORESOLVER: {
5981 			/* We have what we need to build an IRE_CACHE. */
5982 			mblk_t	*dlureq_mp;
5983 
5984 			/*
5985 			 * Create a new dlureq_mp with the
5986 			 * IPv6 gateway address in destination address in the
5987 			 * DLPI hdr if the physical length is exactly 16 bytes.
5988 			 */
5989 			ASSERT(dst_ill->ill_isv6);
5990 			if (dst_ill->ill_phys_addr_length == IPV6_ADDR_LEN) {
5991 				dlureq_mp = ill_dlur_gen((uchar_t *)v6dstp,
5992 				    dst_ill->ill_phys_addr_length,
5993 				    dst_ill->ill_sap,
5994 				    dst_ill->ill_sap_length);
5995 			} else {
5996 				dlureq_mp = ire->ire_dlureq_mp;
5997 			}
5998 
5999 			if (dlureq_mp == NULL)
6000 				break;
6001 			/*
6002 			 * The newly created ire will inherit the flags of the
6003 			 * parent ire, if any.
6004 			 */
6005 			ire = ire_create_v6(
6006 				v6dstp,			/* dest address */
6007 				&ipv6_all_ones,		/* mask */
6008 				&src_ipif->ipif_v6src_addr, /* source address */
6009 				NULL,			/* gateway address */
6010 				&save_ire->ire_max_frag,
6011 				NULL,			/* Fast Path header */
6012 				dst_ill->ill_rq,	/* recv-from queue */
6013 				dst_ill->ill_wq,	/* send-to queue */
6014 				IRE_CACHE,
6015 				dlureq_mp,
6016 				src_ipif,
6017 				NULL,
6018 				(fire != NULL) ?	/* Parent handle */
6019 				    fire->ire_phandle : 0,
6020 				save_ire->ire_ihandle,	/* Interface handle */
6021 				(fire != NULL) ?
6022 				(fire->ire_flags & (RTF_SETSRC | RTF_MULTIRT)) :
6023 				0,
6024 				&ire_uinfo_null,
6025 				NULL,
6026 				NULL);
6027 
6028 			if (dst_ill->ill_phys_addr_length == IPV6_ADDR_LEN)
6029 				freeb(dlureq_mp);
6030 
6031 			if (ire == NULL) {
6032 				ire_refrele(save_ire);
6033 				break;
6034 			}
6035 
6036 			ire->ire_marks |= ire_marks;
6037 
6038 			err = ndp_noresolver(dst_ill, v6dstp);
6039 			if (err != 0) {
6040 				ire_refrele(save_ire);
6041 				break;
6042 			}
6043 
6044 			/* Prevent save_ire from getting deleted */
6045 			IRB_REFHOLD(save_ire->ire_bucket);
6046 			/* Has it been removed already ? */
6047 			if (save_ire->ire_marks & IRE_MARK_CONDEMNED) {
6048 				IRB_REFRELE(save_ire->ire_bucket);
6049 				ire_refrele(save_ire);
6050 				break;
6051 			}
6052 
6053 			ire_add_then_send(q, ire, first_mp);
6054 			if (ip6_asp_table_held) {
6055 				ip6_asp_table_refrele();
6056 				ip6_asp_table_held = B_FALSE;
6057 			}
6058 
6059 			/* Assert that it is not deleted yet. */
6060 			ASSERT(save_ire->ire_ptpn != NULL);
6061 			IRB_REFRELE(save_ire->ire_bucket);
6062 			ire_refrele(save_ire);
6063 			if (fire != NULL) {
6064 				ire_refrele(fire);
6065 				fire = NULL;
6066 			}
6067 
6068 			/*
6069 			 * The resolution loop is re-entered if we
6070 			 * actually are in a multirouting case.
6071 			 */
6072 			if (copy_mp != NULL) {
6073 				boolean_t need_resolve =
6074 				    ire_multirt_need_resolve_v6(v6dstp,
6075 					MBLK_GETLABEL(copy_mp));
6076 				if (!need_resolve) {
6077 					MULTIRT_DEBUG_UNTAG(copy_mp);
6078 					freemsg(copy_mp);
6079 					copy_mp = NULL;
6080 				} else {
6081 					/*
6082 					 * ipif_lookup_group_v6() calls
6083 					 * ire_lookup_multi_v6() that uses
6084 					 * ire_ftable_lookup_v6() to find
6085 					 * an IRE_INTERFACE for the group.
6086 					 * In the multirt case,
6087 					 * ire_lookup_multi_v6() then invokes
6088 					 * ire_multirt_lookup_v6() to find
6089 					 * the next resolvable ire.
6090 					 * As a result, we obtain a new
6091 					 * interface, derived from the
6092 					 * next ire.
6093 					 */
6094 					if (ipif_held) {
6095 						ipif_refrele(ipif);
6096 						ipif_held = B_FALSE;
6097 					}
6098 					ipif = ipif_lookup_group_v6(v6dstp,
6099 					    zoneid);
6100 					ip2dbg(("ip_newroute_ipif: "
6101 						"multirt dst %08x, ipif %p\n",
6102 						ntohl(V4_PART_OF_V6((*v6dstp))),
6103 						(void *)ipif));
6104 					if (ipif != NULL) {
6105 						ipif_held = B_TRUE;
6106 						mp = copy_mp;
6107 						copy_mp = NULL;
6108 						multirt_resolve_next =
6109 						    B_TRUE;
6110 						continue;
6111 					} else {
6112 						freemsg(copy_mp);
6113 					}
6114 				}
6115 			}
6116 			ill_refrele(dst_ill);
6117 			if (ipif_held) {
6118 				ipif_refrele(ipif);
6119 				ipif_held = B_FALSE;
6120 			}
6121 			if (src_ipif != NULL)
6122 				ipif_refrele(src_ipif);
6123 			return;
6124 		}
6125 		case IRE_IF_RESOLVER: {
6126 
6127 			ASSERT(dst_ill->ill_isv6);
6128 
6129 			/*
6130 			 * We obtain a partial IRE_CACHE which we will pass
6131 			 * along with the resolver query.  When the response
6132 			 * comes back it will be there ready for us to add.
6133 			 */
6134 			/*
6135 			 * the newly created ire will inherit the flags of the
6136 			 * parent ire, if any.
6137 			 */
6138 			ire = ire_create_v6(
6139 				v6dstp,			/* dest address */
6140 				&ipv6_all_ones,		/* mask */
6141 				&src_ipif->ipif_v6src_addr, /* source address */
6142 				NULL,			/* gateway address */
6143 				&save_ire->ire_max_frag,
6144 				NULL,			/* Fast Path header */
6145 				dst_ill->ill_rq,	/* recv-from queue */
6146 				dst_ill->ill_wq,	/* send-to queue */
6147 				IRE_CACHE,
6148 				NULL,
6149 				src_ipif,
6150 				NULL,
6151 				(fire != NULL) ?	/* Parent handle */
6152 				    fire->ire_phandle : 0,
6153 				save_ire->ire_ihandle,	/* Interface handle */
6154 				(fire != NULL) ?
6155 				(fire->ire_flags & (RTF_SETSRC | RTF_MULTIRT)) :
6156 				0,
6157 				&ire_uinfo_null,
6158 				NULL,
6159 				NULL);
6160 
6161 			if (ire == NULL) {
6162 				ire_refrele(save_ire);
6163 				break;
6164 			}
6165 
6166 			ire->ire_marks |= ire_marks;
6167 
6168 			/* Resolve and add ire to the ctable */
6169 			err = ndp_resolver(dst_ill, v6dstp, first_mp, zoneid);
6170 			switch (err) {
6171 			case 0:
6172 				/* Prevent save_ire from getting deleted */
6173 				IRB_REFHOLD(save_ire->ire_bucket);
6174 				/* Has it been removed already ? */
6175 				if (save_ire->ire_marks & IRE_MARK_CONDEMNED) {
6176 					IRB_REFRELE(save_ire->ire_bucket);
6177 					ire_refrele(save_ire);
6178 					break;
6179 				}
6180 				/*
6181 				 * We have a resolved cache entry,
6182 				 * add in the IRE.
6183 				 */
6184 				ire_add_then_send(q, ire, first_mp);
6185 				if (ip6_asp_table_held) {
6186 					ip6_asp_table_refrele();
6187 					ip6_asp_table_held = B_FALSE;
6188 				}
6189 
6190 				/* Assert that it is not deleted yet. */
6191 				ASSERT(save_ire->ire_ptpn != NULL);
6192 				IRB_REFRELE(save_ire->ire_bucket);
6193 				ire_refrele(save_ire);
6194 				if (fire != NULL) {
6195 					ire_refrele(fire);
6196 					fire = NULL;
6197 				}
6198 
6199 				/*
6200 				 * The resolution loop is re-entered if we
6201 				 * actually are in a multirouting case.
6202 				 */
6203 				if (copy_mp != NULL) {
6204 					boolean_t need_resolve =
6205 					    ire_multirt_need_resolve_v6(v6dstp,
6206 						MBLK_GETLABEL(copy_mp));
6207 					if (!need_resolve) {
6208 						MULTIRT_DEBUG_UNTAG(copy_mp);
6209 						freemsg(copy_mp);
6210 						copy_mp = NULL;
6211 					} else {
6212 						/*
6213 						 * ipif_lookup_group_v6() calls
6214 						 * ire_lookup_multi_v6() that
6215 						 * uses ire_ftable_lookup_v6()
6216 						 * to find an IRE_INTERFACE for
6217 						 * the group. In the multirt
6218 						 * case, ire_lookup_multi_v6()
6219 						 * then invokes
6220 						 * ire_multirt_lookup_v6() to
6221 						 * find the next resolvable ire.
6222 						 * As a result, we obtain a new
6223 						 * interface, derived from the
6224 						 * next ire.
6225 						 */
6226 						if (ipif_held) {
6227 							ipif_refrele(ipif);
6228 							ipif_held = B_FALSE;
6229 						}
6230 						ipif = ipif_lookup_group_v6(
6231 						    v6dstp, zoneid);
6232 						ip2dbg(("ip_newroute_ipif: "
6233 						    "multirt dst %08x, "
6234 						    "ipif %p\n",
6235 						    ntohl(V4_PART_OF_V6(
6236 							(*v6dstp))),
6237 						    (void *)ipif));
6238 						if (ipif != NULL) {
6239 							ipif_held = B_TRUE;
6240 							mp = copy_mp;
6241 							copy_mp = NULL;
6242 							multirt_resolve_next =
6243 							    B_TRUE;
6244 							continue;
6245 						} else {
6246 							freemsg(copy_mp);
6247 						}
6248 					}
6249 				}
6250 				ill_refrele(dst_ill);
6251 				if (ipif_held) {
6252 					ipif_refrele(ipif);
6253 					ipif_held = B_FALSE;
6254 				}
6255 				if (src_ipif != NULL)
6256 					ipif_refrele(src_ipif);
6257 				return;
6258 
6259 			case EINPROGRESS:
6260 				/*
6261 				 * mp was consumed - presumably queued.
6262 				 * No need for ire, presumably resolution is
6263 				 * in progress, and ire will be added when the
6264 				 * address is resolved.
6265 				 */
6266 				if (ip6_asp_table_held) {
6267 					ip6_asp_table_refrele();
6268 					ip6_asp_table_held = B_FALSE;
6269 				}
6270 				ire_delete(ire);
6271 				ire_refrele(save_ire);
6272 				if (fire != NULL) {
6273 					ire_refrele(fire);
6274 					fire = NULL;
6275 				}
6276 
6277 				/*
6278 				 * The resolution loop is re-entered if we
6279 				 * actually are in a multirouting case.
6280 				 */
6281 				if (copy_mp != NULL) {
6282 					boolean_t need_resolve =
6283 					    ire_multirt_need_resolve_v6(v6dstp,
6284 						MBLK_GETLABEL(copy_mp));
6285 					if (!need_resolve) {
6286 						MULTIRT_DEBUG_UNTAG(copy_mp);
6287 						freemsg(copy_mp);
6288 						copy_mp = NULL;
6289 					} else {
6290 						/*
6291 						 * ipif_lookup_group_v6() calls
6292 						 * ire_lookup_multi_v6() that
6293 						 * uses ire_ftable_lookup_v6()
6294 						 * to find an IRE_INTERFACE for
6295 						 * the group. In the multirt
6296 						 * case, ire_lookup_multi_v6()
6297 						 * then invokes
6298 						 * ire_multirt_lookup_v6() to
6299 						 * find the next resolvable ire.
6300 						 * As a result, we obtain a new
6301 						 * interface, derived from the
6302 						 * next ire.
6303 						 */
6304 						if (ipif_held) {
6305 							ipif_refrele(ipif);
6306 							ipif_held = B_FALSE;
6307 						}
6308 						ipif = ipif_lookup_group_v6(
6309 						    v6dstp, zoneid);
6310 						ip2dbg(("ip_newroute_ipif: "
6311 						    "multirt dst %08x, "
6312 						    "ipif %p\n",
6313 						    ntohl(V4_PART_OF_V6(
6314 							(*v6dstp))),
6315 						    (void *)ipif));
6316 						if (ipif != NULL) {
6317 							ipif_held = B_TRUE;
6318 							mp = copy_mp;
6319 							copy_mp = NULL;
6320 							multirt_resolve_next =
6321 							    B_TRUE;
6322 							continue;
6323 						} else {
6324 							freemsg(copy_mp);
6325 						}
6326 					}
6327 				}
6328 				ill_refrele(dst_ill);
6329 				if (ipif_held) {
6330 					ipif_refrele(ipif);
6331 					ipif_held = B_FALSE;
6332 				}
6333 				if (src_ipif != NULL)
6334 					ipif_refrele(src_ipif);
6335 				return;
6336 			default:
6337 				/* Some transient error */
6338 				ire_refrele(save_ire);
6339 				break;
6340 			}
6341 			break;
6342 		}
6343 		default:
6344 			break;
6345 		}
6346 		if (ip6_asp_table_held) {
6347 			ip6_asp_table_refrele();
6348 			ip6_asp_table_held = B_FALSE;
6349 		}
6350 	} while (multirt_resolve_next);
6351 
6352 err_ret:
6353 	if (ip6_asp_table_held)
6354 		ip6_asp_table_refrele();
6355 	if (ire != NULL)
6356 		ire_refrele(ire);
6357 	if (fire != NULL)
6358 		ire_refrele(fire);
6359 	if (ipif != NULL && ipif_held)
6360 		ipif_refrele(ipif);
6361 	if (src_ipif != NULL)
6362 		ipif_refrele(src_ipif);
6363 	/* Multicast - no point in trying to generate ICMP error */
6364 	ASSERT((attach_ill == NULL) || (dst_ill == attach_ill));
6365 	if (dst_ill != NULL) {
6366 		ill = dst_ill;
6367 		ill_held = B_TRUE;
6368 	}
6369 	if (mp->b_prev || mp->b_next) {
6370 		BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
6371 	} else {
6372 		BUMP_MIB(ill->ill_ip6_mib, ipv6OutDiscards);
6373 	}
6374 	ip1dbg(("ip_newroute_ipif_v6: dropped\n"));
6375 	mp->b_next = NULL;
6376 	mp->b_prev = NULL;
6377 	freemsg(first_mp);
6378 	if (ill_held)
6379 		ill_refrele(ill);
6380 }
6381 
6382 /*
6383  * Parse and process any hop-by-hop or destination options.
6384  *
6385  * Assumes that q is an ill read queue so that ICMP errors for link-local
6386  * destinations are sent out the correct interface.
6387  *
6388  * Returns -1 if there was an error and mp has been consumed.
6389  * Returns 0 if no special action is needed.
6390  * Returns 1 if the packet contained a router alert option for this node
6391  * which is verified to be "interesting/known" for our implementation.
6392  *
6393  * XXX Note: In future as more hbh or dest options are defined,
6394  * it may be better to have different routines for hbh and dest
6395  * options as opt_type fields other than IP6OPT_PAD1 and IP6OPT_PADN
6396  * may have same value in different namespaces. Or is it same namespace ??
6397  * Current code checks for each opt_type (other than pads) if it is in
6398  * the expected  nexthdr (hbh or dest)
6399  */
6400 static int
6401 ip_process_options_v6(queue_t *q, mblk_t *mp, ip6_t *ip6h,
6402     uint8_t *optptr, uint_t optlen, uint8_t hdr_type)
6403 {
6404 	uint8_t opt_type;
6405 	uint_t optused;
6406 	int ret = 0;
6407 	mblk_t *first_mp;
6408 	const char *errtype;
6409 
6410 	first_mp = mp;
6411 	if (mp->b_datap->db_type == M_CTL) {
6412 		mp = mp->b_cont;
6413 	}
6414 
6415 	while (optlen != 0) {
6416 		opt_type = *optptr;
6417 		if (opt_type == IP6OPT_PAD1) {
6418 			optused = 1;
6419 		} else {
6420 			if (optlen < 2)
6421 				goto bad_opt;
6422 			errtype = "malformed";
6423 			if (opt_type == ip6opt_ls) {
6424 				optused = 2 + optptr[1];
6425 				if (optused > optlen)
6426 					goto bad_opt;
6427 			} else switch (opt_type) {
6428 			case IP6OPT_PADN:
6429 				/*
6430 				 * Note:We don't verify that (N-2) pad octets
6431 				 * are zero as required by spec. Adhere to
6432 				 * "be liberal in what you accept..." part of
6433 				 * implementation philosophy (RFC791,RFC1122)
6434 				 */
6435 				optused = 2 + optptr[1];
6436 				if (optused > optlen)
6437 					goto bad_opt;
6438 				break;
6439 
6440 			case IP6OPT_JUMBO:
6441 				if (hdr_type != IPPROTO_HOPOPTS)
6442 					goto opt_error;
6443 				goto opt_error; /* XXX Not implemented! */
6444 
6445 			case IP6OPT_ROUTER_ALERT: {
6446 				struct ip6_opt_router *or;
6447 
6448 				if (hdr_type != IPPROTO_HOPOPTS)
6449 					goto opt_error;
6450 				optused = 2 + optptr[1];
6451 				if (optused > optlen)
6452 					goto bad_opt;
6453 				or = (struct ip6_opt_router *)optptr;
6454 				/* Check total length and alignment */
6455 				if (optused != sizeof (*or) ||
6456 				    ((uintptr_t)or->ip6or_value & 0x1) != 0)
6457 					goto opt_error;
6458 				/* Check value */
6459 				switch (*((uint16_t *)or->ip6or_value)) {
6460 				case IP6_ALERT_MLD:
6461 				case IP6_ALERT_RSVP:
6462 					ret = 1;
6463 				}
6464 				break;
6465 			}
6466 			case IP6OPT_HOME_ADDRESS: {
6467 				/*
6468 				 * Minimal support for the home address option
6469 				 * (which is required by all IPv6 nodes).
6470 				 * Implement by just swapping the home address
6471 				 * and source address.
6472 				 * XXX Note: this has IPsec implications since
6473 				 * AH needs to take this into account.
6474 				 * Also, when IPsec is used we need to ensure
6475 				 * that this is only processed once
6476 				 * in the received packet (to avoid swapping
6477 				 * back and forth).
6478 				 * NOTE:This option processing is considered
6479 				 * to be unsafe and prone to a denial of
6480 				 * service attack.
6481 				 * The current processing is not safe even with
6482 				 * IPsec secured IP packets. Since the home
6483 				 * address option processing requirement still
6484 				 * is in the IETF draft and in the process of
6485 				 * being redefined for its usage, it has been
6486 				 * decided to turn off the option by default.
6487 				 * If this section of code needs to be executed,
6488 				 * ndd variable ip6_ignore_home_address_opt
6489 				 * should be set to 0 at the user's own risk.
6490 				 */
6491 				struct ip6_opt_home_address *oh;
6492 				in6_addr_t tmp;
6493 
6494 				if (ipv6_ignore_home_address_opt)
6495 					goto opt_error;
6496 
6497 				if (hdr_type != IPPROTO_DSTOPTS)
6498 					goto opt_error;
6499 				optused = 2 + optptr[1];
6500 				if (optused > optlen)
6501 					goto bad_opt;
6502 
6503 				/*
6504 				 * We did this dest. opt the first time
6505 				 * around (i.e. before AH processing).
6506 				 * If we've done AH... stop now.
6507 				 */
6508 				if (first_mp != mp) {
6509 					ipsec_in_t *ii;
6510 
6511 					ii = (ipsec_in_t *)first_mp->b_rptr;
6512 					if (ii->ipsec_in_ah_sa != NULL)
6513 						break;
6514 				}
6515 
6516 				oh = (struct ip6_opt_home_address *)optptr;
6517 				/* Check total length and alignment */
6518 				if (optused < sizeof (*oh) ||
6519 				    ((uintptr_t)oh->ip6oh_addr & 0x7) != 0)
6520 					goto opt_error;
6521 				/* Swap ip6_src and the home address */
6522 				tmp = ip6h->ip6_src;
6523 				/* XXX Note: only 8 byte alignment option */
6524 				ip6h->ip6_src = *(in6_addr_t *)oh->ip6oh_addr;
6525 				*(in6_addr_t *)oh->ip6oh_addr = tmp;
6526 				break;
6527 			}
6528 
6529 			case IP6OPT_TUNNEL_LIMIT:
6530 				if (hdr_type != IPPROTO_DSTOPTS) {
6531 					goto opt_error;
6532 				}
6533 				optused = 2 + optptr[1];
6534 				if (optused > optlen) {
6535 					goto bad_opt;
6536 				}
6537 				if (optused != 3) {
6538 					goto opt_error;
6539 				}
6540 				break;
6541 
6542 			default:
6543 				errtype = "unknown";
6544 				/* FALLTHROUGH */
6545 			opt_error:
6546 				switch (IP6OPT_TYPE(opt_type)) {
6547 				case IP6OPT_TYPE_SKIP:
6548 					optused = 2 + optptr[1];
6549 					if (optused > optlen)
6550 						goto bad_opt;
6551 					ip1dbg(("ip_process_options_v6: %s "
6552 					    "opt 0x%x skipped\n",
6553 					    errtype, opt_type));
6554 					break;
6555 				case IP6OPT_TYPE_DISCARD:
6556 					ip1dbg(("ip_process_options_v6: %s "
6557 					    "opt 0x%x; packet dropped\n",
6558 					    errtype, opt_type));
6559 					freemsg(first_mp);
6560 					return (-1);
6561 				case IP6OPT_TYPE_ICMP:
6562 					icmp_param_problem_v6(WR(q), first_mp,
6563 					    ICMP6_PARAMPROB_OPTION,
6564 					    (uint32_t)(optptr -
6565 					    (uint8_t *)ip6h),
6566 					    B_FALSE, B_FALSE);
6567 					return (-1);
6568 				case IP6OPT_TYPE_FORCEICMP:
6569 					icmp_param_problem_v6(WR(q), first_mp,
6570 					    ICMP6_PARAMPROB_OPTION,
6571 					    (uint32_t)(optptr -
6572 					    (uint8_t *)ip6h),
6573 					    B_FALSE, B_TRUE);
6574 					return (-1);
6575 				default:
6576 					ASSERT(0);
6577 				}
6578 			}
6579 		}
6580 		optlen -= optused;
6581 		optptr += optused;
6582 	}
6583 	return (ret);
6584 
6585 bad_opt:
6586 	icmp_param_problem_v6(WR(q), first_mp, ICMP6_PARAMPROB_OPTION,
6587 	    (uint32_t)(optptr - (uint8_t *)ip6h),
6588 	    B_FALSE, B_FALSE);
6589 	return (-1);
6590 }
6591 
6592 /*
6593  * Process a routing header that is not yet empty.
6594  * Only handles type 0 routing headers.
6595  */
6596 static void
6597 ip_process_rthdr(queue_t *q, mblk_t *mp, ip6_t *ip6h, ip6_rthdr_t *rth,
6598     ill_t *ill, uint_t flags, mblk_t *hada_mp)
6599 {
6600 	ip6_rthdr0_t *rthdr;
6601 	uint_t ehdrlen;
6602 	uint_t numaddr;
6603 	in6_addr_t *addrptr;
6604 	in6_addr_t tmp;
6605 
6606 	ASSERT(rth->ip6r_segleft != 0);
6607 
6608 	if (!ipv6_forward_src_routed) {
6609 		/* XXX Check for source routed out same interface? */
6610 		BUMP_MIB(ill->ill_ip6_mib, ipv6ForwProhibits);
6611 		BUMP_MIB(ill->ill_ip6_mib, ipv6InAddrErrors);
6612 		freemsg(hada_mp);
6613 		freemsg(mp);
6614 		return;
6615 	}
6616 
6617 	if (rth->ip6r_type != 0) {
6618 		if (hada_mp != NULL)
6619 			goto hada_drop;
6620 		icmp_param_problem_v6(WR(q), mp,
6621 		    ICMP6_PARAMPROB_HEADER,
6622 		    (uint32_t)((uchar_t *)&rth->ip6r_type - (uchar_t *)ip6h),
6623 		    B_FALSE, B_FALSE);
6624 		return;
6625 	}
6626 	rthdr = (ip6_rthdr0_t *)rth;
6627 	ehdrlen = 8 * (rthdr->ip6r0_len + 1);
6628 	ASSERT(mp->b_rptr + ehdrlen <= mp->b_wptr);
6629 	addrptr = (in6_addr_t *)((char *)rthdr + sizeof (*rthdr));
6630 	/* rthdr->ip6r0_len is twice the number of addresses in the header */
6631 	if (rthdr->ip6r0_len & 0x1) {
6632 		/* An odd length is impossible */
6633 		if (hada_mp != NULL)
6634 			goto hada_drop;
6635 		icmp_param_problem_v6(WR(q), mp,
6636 		    ICMP6_PARAMPROB_HEADER,
6637 		    (uint32_t)((uchar_t *)&rthdr->ip6r0_len - (uchar_t *)ip6h),
6638 		    B_FALSE, B_FALSE);
6639 		return;
6640 	}
6641 	numaddr = rthdr->ip6r0_len / 2;
6642 	if (rthdr->ip6r0_segleft > numaddr) {
6643 		/* segleft exceeds number of addresses in routing header */
6644 		if (hada_mp != NULL)
6645 			goto hada_drop;
6646 		icmp_param_problem_v6(WR(q), mp,
6647 		    ICMP6_PARAMPROB_HEADER,
6648 		    (uint32_t)((uchar_t *)&rthdr->ip6r0_segleft -
6649 			(uchar_t *)ip6h),
6650 		    B_FALSE, B_FALSE);
6651 		return;
6652 	}
6653 	addrptr += (numaddr - rthdr->ip6r0_segleft);
6654 	if (IN6_IS_ADDR_MULTICAST(&ip6h->ip6_dst) ||
6655 	    IN6_IS_ADDR_MULTICAST(addrptr)) {
6656 		BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
6657 		freemsg(hada_mp);
6658 		freemsg(mp);
6659 		return;
6660 	}
6661 	/* Swap */
6662 	tmp = *addrptr;
6663 	*addrptr = ip6h->ip6_dst;
6664 	ip6h->ip6_dst = tmp;
6665 	rthdr->ip6r0_segleft--;
6666 	/* Don't allow any mapped addresses - ip_wput_v6 can't handle them */
6667 	if (IN6_IS_ADDR_V4MAPPED(&ip6h->ip6_dst)) {
6668 		if (hada_mp != NULL)
6669 			goto hada_drop;
6670 		icmp_unreachable_v6(WR(q), mp, ICMP6_DST_UNREACH_NOROUTE,
6671 		    B_FALSE, B_FALSE);
6672 		return;
6673 	}
6674 	ip_rput_data_v6(q, ill, mp, ip6h, flags, hada_mp);
6675 	return;
6676 hada_drop:
6677 	/* IPsec kstats: bean counter? */
6678 	freemsg(hada_mp);
6679 	freemsg(mp);
6680 }
6681 
6682 /*
6683  * Read side put procedure for IPv6 module.
6684  */
6685 static void
6686 ip_rput_v6(queue_t *q, mblk_t *mp)
6687 {
6688 	mblk_t		*mp1, *first_mp, *hada_mp = NULL;
6689 	ip6_t		*ip6h;
6690 	boolean_t	ll_multicast = B_FALSE, mctl_present = B_FALSE;
6691 	ill_t		*ill;
6692 	struct iocblk	*iocp;
6693 	uint_t 		flags = 0;
6694 
6695 	ill = (ill_t *)q->q_ptr;
6696 	if (ill->ill_state_flags & ILL_CONDEMNED) {
6697 		union DL_primitives *dl;
6698 
6699 		dl = (union DL_primitives *)mp->b_rptr;
6700 		/*
6701 		 * Things are opening or closing - only accept DLPI
6702 		 * ack messages. If the stream is closing and ip_wsrv
6703 		 * has completed, ip_close is out of the qwait, but has
6704 		 * not yet completed qprocsoff. Don't proceed any further
6705 		 * because the ill has been cleaned up and things hanging
6706 		 * off the ill have been freed.
6707 		 */
6708 		if ((mp->b_datap->db_type != M_PCPROTO) ||
6709 		    (dl->dl_primitive == DL_UNITDATA_IND)) {
6710 			inet_freemsg(mp);
6711 			return;
6712 		}
6713 	}
6714 
6715 	switch (mp->b_datap->db_type) {
6716 	case M_DATA:
6717 		break;
6718 
6719 	case M_PROTO:
6720 	case M_PCPROTO:
6721 		if (((dl_unitdata_ind_t *)mp->b_rptr)->dl_primitive !=
6722 		    DL_UNITDATA_IND) {
6723 			/* Go handle anything other than data elsewhere. */
6724 			ip_rput_dlpi(q, mp);
6725 			return;
6726 		}
6727 #define	dlur	((dl_unitdata_ind_t *)mp->b_rptr)
6728 		ll_multicast = dlur->dl_group_address;
6729 #undef	dlur
6730 		/* Ditch the DLPI header. */
6731 		mp1 = mp;
6732 		mp = mp->b_cont;
6733 		freeb(mp1);
6734 		break;
6735 	case M_BREAK:
6736 		panic("ip_rput_v6: got an M_BREAK");
6737 		/*NOTREACHED*/
6738 	case M_IOCACK:
6739 		iocp = (struct iocblk *)mp->b_rptr;
6740 		switch (iocp->ioc_cmd) {
6741 		case DL_IOC_HDR_INFO:
6742 			ill = (ill_t *)q->q_ptr;
6743 			ill_fastpath_ack(ill, mp);
6744 			return;
6745 		case SIOCSTUNPARAM:
6746 		case SIOCGTUNPARAM:
6747 		case OSIOCSTUNPARAM:
6748 		case OSIOCGTUNPARAM:
6749 			/* Go through qwriter */
6750 			break;
6751 		default:
6752 			putnext(q, mp);
6753 			return;
6754 		}
6755 		/* FALLTHRU */
6756 	case M_ERROR:
6757 	case M_HANGUP:
6758 		mutex_enter(&ill->ill_lock);
6759 		if (ill->ill_state_flags & ILL_CONDEMNED) {
6760 			mutex_exit(&ill->ill_lock);
6761 			freemsg(mp);
6762 			return;
6763 		}
6764 		ill_refhold_locked(ill);
6765 		mutex_exit(&ill->ill_lock);
6766 		qwriter_ip(NULL, ill, q, mp, ip_rput_other, CUR_OP, B_FALSE);
6767 		return;
6768 	case M_CTL: {
6769 		if ((MBLKL(mp) > sizeof (int)) &&
6770 		    ((da_ipsec_t *)mp->b_rptr)->da_type == IPHADA_M_CTL) {
6771 			ASSERT(MBLKL(mp) >= sizeof (da_ipsec_t));
6772 			mctl_present = B_TRUE;
6773 			break;
6774 		}
6775 		putnext(q, mp);
6776 		return;
6777 	}
6778 	case M_IOCNAK:
6779 		iocp = (struct iocblk *)mp->b_rptr;
6780 		switch (iocp->ioc_cmd) {
6781 		case DL_IOC_HDR_INFO:
6782 		case SIOCSTUNPARAM:
6783 		case SIOCGTUNPARAM:
6784 		case OSIOCSTUNPARAM:
6785 		case OSIOCGTUNPARAM:
6786 			mutex_enter(&ill->ill_lock);
6787 			if (ill->ill_state_flags & ILL_CONDEMNED) {
6788 				mutex_exit(&ill->ill_lock);
6789 				freemsg(mp);
6790 				return;
6791 			}
6792 			ill_refhold_locked(ill);
6793 			mutex_exit(&ill->ill_lock);
6794 			qwriter_ip(NULL, ill, q, mp, ip_rput_other, CUR_OP,
6795 			    B_FALSE);
6796 			return;
6797 		default:
6798 			break;
6799 		}
6800 		/* FALLTHRU */
6801 	default:
6802 		putnext(q, mp);
6803 		return;
6804 	}
6805 
6806 	BUMP_MIB(ill->ill_ip6_mib, ipv6InReceives);
6807 	/*
6808 	 * if db_ref > 1 then copymsg and free original. Packet may be
6809 	 * changed and do not want other entity who has a reference to this
6810 	 * message to trip over the changes. This is a blind change because
6811 	 * trying to catch all places that might change packet is too
6812 	 * difficult (since it may be a module above this one).
6813 	 */
6814 	if (mp->b_datap->db_ref > 1) {
6815 		mblk_t  *mp1;
6816 
6817 		mp1 = copymsg(mp);
6818 		freemsg(mp);
6819 		if (mp1 == NULL) {
6820 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
6821 			return;
6822 		}
6823 		mp = mp1;
6824 	}
6825 	first_mp = mp;
6826 	if (mctl_present) {
6827 		hada_mp = first_mp;
6828 		mp = first_mp->b_cont;
6829 	}
6830 
6831 	ip6h = (ip6_t *)mp->b_rptr;
6832 
6833 	/* check for alignment and full IPv6 header */
6834 	if (!OK_32PTR((uchar_t *)ip6h) ||
6835 	    (mp->b_wptr - (uchar_t *)ip6h) < IPV6_HDR_LEN) {
6836 		if (!pullupmsg(mp, IPV6_HDR_LEN)) {
6837 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
6838 			ip1dbg(("ip_rput_v6: pullupmsg failed\n"));
6839 			freemsg(first_mp);
6840 			return;
6841 		}
6842 		ip6h = (ip6_t *)mp->b_rptr;
6843 	}
6844 	if ((ip6h->ip6_vcf & IPV6_VERS_AND_FLOW_MASK) ==
6845 	    IPV6_DEFAULT_VERS_AND_FLOW) {
6846 		/*
6847 		 * It may be a bit too expensive to do this mapped address
6848 		 * check here, but in the interest of robustness, it seems
6849 		 * like the correct place.
6850 		 * TODO: Avoid this check for e.g. connected TCP sockets
6851 		 */
6852 		if (IN6_IS_ADDR_V4MAPPED(&ip6h->ip6_src)) {
6853 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
6854 			ip1dbg(("ip_rput_v6: pkt with mapped src addr\n"));
6855 			freemsg(first_mp);
6856 			return;
6857 		}
6858 
6859 		if (IN6_IS_ADDR_LOOPBACK(&ip6h->ip6_src)) {
6860 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
6861 			ip1dbg(("ip_rput_v6: pkt with loopback src"));
6862 			freemsg(first_mp);
6863 			return;
6864 		} else if (IN6_IS_ADDR_LOOPBACK(&ip6h->ip6_dst)) {
6865 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
6866 			ip1dbg(("ip_rput_v6: pkt with loopback dst"));
6867 			freemsg(first_mp);
6868 			return;
6869 		}
6870 
6871 		flags |= (ll_multicast ? IP6_IN_LLMCAST : 0);
6872 		ip_rput_data_v6(q, ill, mp, ip6h, flags, hada_mp);
6873 	} else {
6874 		BUMP_MIB(ill->ill_ip6_mib, ipv6InIPv4);
6875 		BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
6876 		freemsg(first_mp);
6877 	}
6878 }
6879 
6880 /*
6881  * Walk through the IPv6 packet in mp and see if there's an AH header
6882  * in it.  See if the AH header needs to get done before other headers in
6883  * the packet.  (Worker function for ipsec_early_ah_v6().)
6884  */
6885 #define	IPSEC_HDR_DONT_PROCESS	0
6886 #define	IPSEC_HDR_PROCESS	1
6887 #define	IPSEC_MEMORY_ERROR	2
6888 static int
6889 ipsec_needs_processing_v6(mblk_t *mp, uint8_t *nexthdr)
6890 {
6891 	uint_t	length;
6892 	uint_t	ehdrlen;
6893 	uint8_t *whereptr;
6894 	uint8_t *endptr;
6895 	uint8_t *nexthdrp;
6896 	ip6_dest_t *desthdr;
6897 	ip6_rthdr_t *rthdr;
6898 	ip6_t	*ip6h;
6899 
6900 	/*
6901 	 * For now just pullup everything.  In general, the less pullups,
6902 	 * the better, but there's so much squirrelling through anyway,
6903 	 * it's just easier this way.
6904 	 */
6905 	if (!pullupmsg(mp, -1)) {
6906 		return (IPSEC_MEMORY_ERROR);
6907 	}
6908 
6909 	ip6h = (ip6_t *)mp->b_rptr;
6910 	length = IPV6_HDR_LEN;
6911 	whereptr = ((uint8_t *)&ip6h[1]); /* point to next hdr */
6912 	endptr = mp->b_wptr;
6913 
6914 	/*
6915 	 * We can't just use the argument nexthdr in the place
6916 	 * of nexthdrp becaue we don't dereference nexthdrp
6917 	 * till we confirm whether it is a valid address.
6918 	 */
6919 	nexthdrp = &ip6h->ip6_nxt;
6920 	while (whereptr < endptr) {
6921 		/* Is there enough left for len + nexthdr? */
6922 		if (whereptr + MIN_EHDR_LEN > endptr)
6923 			return (IPSEC_MEMORY_ERROR);
6924 
6925 		switch (*nexthdrp) {
6926 		case IPPROTO_HOPOPTS:
6927 		case IPPROTO_DSTOPTS:
6928 			/* Assumes the headers are identical for hbh and dst */
6929 			desthdr = (ip6_dest_t *)whereptr;
6930 			ehdrlen = 8 * (desthdr->ip6d_len + 1);
6931 			if ((uchar_t *)desthdr +  ehdrlen > endptr)
6932 				return (IPSEC_MEMORY_ERROR);
6933 			/*
6934 			 * Return DONT_PROCESS because of potential Mobile IPv6
6935 			 * cruft for destination options.
6936 			 */
6937 			if (*nexthdrp == IPPROTO_DSTOPTS)
6938 				return (IPSEC_HDR_DONT_PROCESS);
6939 			nexthdrp = &desthdr->ip6d_nxt;
6940 			break;
6941 		case IPPROTO_ROUTING:
6942 			rthdr = (ip6_rthdr_t *)whereptr;
6943 
6944 			/*
6945 			 * If there's more hops left on the routing header,
6946 			 * return now with DON'T PROCESS.
6947 			 */
6948 			if (rthdr->ip6r_segleft > 0)
6949 				return (IPSEC_HDR_DONT_PROCESS);
6950 
6951 			ehdrlen =  8 * (rthdr->ip6r_len + 1);
6952 			if ((uchar_t *)rthdr +  ehdrlen > endptr)
6953 				return (IPSEC_MEMORY_ERROR);
6954 			nexthdrp = &rthdr->ip6r_nxt;
6955 			break;
6956 		case IPPROTO_FRAGMENT:
6957 			/* Wait for reassembly */
6958 			return (IPSEC_HDR_DONT_PROCESS);
6959 		case IPPROTO_AH:
6960 			*nexthdr = IPPROTO_AH;
6961 			return (IPSEC_HDR_PROCESS);
6962 		case IPPROTO_NONE:
6963 			/* No next header means we're finished */
6964 		default:
6965 			return (IPSEC_HDR_DONT_PROCESS);
6966 		}
6967 		length += ehdrlen;
6968 		whereptr += ehdrlen;
6969 	}
6970 	panic("ipsec_needs_processing_v6");
6971 	/*NOTREACHED*/
6972 }
6973 
6974 /*
6975  * Path for AH if options are present. If this is the first time we are
6976  * sending a datagram to AH, allocate a IPSEC_IN message and prepend it.
6977  * Otherwise, just fanout.  Return value answers the boolean question:
6978  * "Did I consume the mblk you sent me?"
6979  *
6980  * Sometimes AH needs to be done before other IPv6 headers for security
6981  * reasons.  This function (and its ipsec_needs_processing_v6() above)
6982  * indicates if that is so, and fans out to the appropriate IPsec protocol
6983  * for the datagram passed in.
6984  */
6985 static boolean_t
6986 ipsec_early_ah_v6(queue_t *q, mblk_t *first_mp, boolean_t mctl_present,
6987     ill_t *ill, ire_t *ire, mblk_t *hada_mp, zoneid_t zoneid)
6988 {
6989 	mblk_t *mp;
6990 	uint8_t nexthdr;
6991 	ipsec_in_t *ii = NULL;
6992 	ah_t *ah;
6993 	ipsec_status_t ipsec_rc;
6994 
6995 	ASSERT((hada_mp == NULL) || (!mctl_present));
6996 
6997 	switch (ipsec_needs_processing_v6(
6998 	    (mctl_present ? first_mp->b_cont : first_mp), &nexthdr)) {
6999 	case IPSEC_MEMORY_ERROR:
7000 		BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
7001 		freemsg(hada_mp);
7002 		freemsg(first_mp);
7003 		return (B_TRUE);
7004 	case IPSEC_HDR_DONT_PROCESS:
7005 		return (B_FALSE);
7006 	}
7007 
7008 	/* Default means send it to AH! */
7009 	ASSERT(nexthdr == IPPROTO_AH);
7010 	if (!mctl_present) {
7011 		mp = first_mp;
7012 		if ((first_mp = ipsec_in_alloc(B_FALSE)) == NULL) {
7013 			ip1dbg(("ipsec_early_ah_v6: IPSEC_IN "
7014 			    "allocation failure.\n"));
7015 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
7016 			freemsg(hada_mp);
7017 			freemsg(mp);
7018 			return (B_TRUE);
7019 		}
7020 		/*
7021 		 * Store the ill_index so that when we come back
7022 		 * from IPSEC we ride on the same queue.
7023 		 */
7024 		ii = (ipsec_in_t *)first_mp->b_rptr;
7025 		ii->ipsec_in_ill_index = ill->ill_phyint->phyint_ifindex;
7026 		ii->ipsec_in_rill_index = ii->ipsec_in_ill_index;
7027 		first_mp->b_cont = mp;
7028 	}
7029 	/*
7030 	 * Cache hardware acceleration info.
7031 	 */
7032 	if (hada_mp != NULL) {
7033 		ASSERT(ii != NULL);
7034 		IPSECHW_DEBUG(IPSECHW_PKT, ("ipsec_early_ah_v6: "
7035 		    "caching data attr.\n"));
7036 		ii->ipsec_in_accelerated = B_TRUE;
7037 		ii->ipsec_in_da = hada_mp;
7038 	}
7039 
7040 	if (!ipsec_loaded()) {
7041 		ip_proto_not_sup(q, first_mp, IP_FF_SEND_ICMP, zoneid);
7042 		return (B_TRUE);
7043 	}
7044 
7045 	ah = ipsec_inbound_ah_sa(first_mp);
7046 	if (ah == NULL)
7047 		return (B_TRUE);
7048 	ASSERT(ii->ipsec_in_ah_sa != NULL);
7049 	ASSERT(ii->ipsec_in_ah_sa->ipsa_input_func != NULL);
7050 	ipsec_rc = ii->ipsec_in_ah_sa->ipsa_input_func(first_mp, ah);
7051 
7052 	switch (ipsec_rc) {
7053 	case IPSEC_STATUS_SUCCESS:
7054 		/* we're done with IPsec processing, send it up */
7055 		ip_fanout_proto_again(first_mp, ill, ill, ire);
7056 		break;
7057 	case IPSEC_STATUS_FAILED:
7058 		BUMP_MIB(&ip6_mib, ipv6InDiscards);
7059 		break;
7060 	case IPSEC_STATUS_PENDING:
7061 		/* no action needed */
7062 		break;
7063 	}
7064 	return (B_TRUE);
7065 }
7066 
7067 /*
7068  * ip_rput_data_v6 -- received IPv6 packets in M_DATA messages show up here.
7069  * ip_rput_v6 has already verified alignment, the min length, the version,
7070  * and db_ref = 1.
7071  *
7072  * The ill passed in (the arg named inill) is the ill that the packet
7073  * actually arrived on.  We need to remember this when saving the
7074  * input interface index into potential IPV6_PKTINFO data in
7075  * ip_add_info_v6().
7076  */
7077 void
7078 ip_rput_data_v6(queue_t *q, ill_t *inill, mblk_t *mp, ip6_t *ip6h,
7079     uint_t flags, mblk_t *hada_mp)
7080 {
7081 	ire_t		*ire = NULL;
7082 	queue_t		*rq;
7083 	ill_t		*ill = inill;
7084 	ipif_t		*ipif;
7085 	uint8_t		*whereptr;
7086 	uint8_t		nexthdr;
7087 	uint16_t	remlen;
7088 	uint_t		prev_nexthdr_offset;
7089 	uint_t		used;
7090 	size_t		pkt_len;
7091 	uint16_t	ip6_len;
7092 	uint_t		hdr_len;
7093 	boolean_t	mctl_present;
7094 	mblk_t		*first_mp;
7095 	mblk_t		*first_mp1;
7096 	boolean_t	no_forward;
7097 	ip6_hbh_t	*hbhhdr;
7098 	boolean_t	ll_multicast = (flags & IP6_IN_LLMCAST);
7099 	conn_t		*connp;
7100 	ilm_t		*ilm;
7101 	uint32_t	ports;
7102 	uint_t		ipif_id = 0;
7103 	zoneid_t	zoneid = GLOBAL_ZONEID;
7104 	uint16_t	hck_flags, reass_hck_flags;
7105 	uint32_t	reass_sum;
7106 	boolean_t	cksum_err;
7107 	mblk_t		*mp1;
7108 
7109 	EXTRACT_PKT_MP(mp, first_mp, mctl_present);
7110 
7111 	if (hada_mp != NULL) {
7112 		/*
7113 		 * It's an IPsec accelerated packet.
7114 		 * Keep a pointer to the data attributes around until
7115 		 * we allocate the ipsecinfo structure.
7116 		 */
7117 		IPSECHW_DEBUG(IPSECHW_PKT,
7118 		    ("ip_rput_data_v6: inbound HW accelerated IPsec pkt\n"));
7119 		hada_mp->b_cont = NULL;
7120 		/*
7121 		 * Since it is accelerated, it came directly from
7122 		 * the ill.
7123 		 */
7124 		ASSERT(mctl_present == B_FALSE);
7125 		ASSERT(mp->b_datap->db_type != M_CTL);
7126 	}
7127 
7128 	ASSERT(OK_32PTR((uchar_t *)ip6h) &&
7129 	    (mp->b_wptr - (uchar_t *)ip6h) >= IPV6_HDR_LEN);
7130 
7131 	if (mp->b_cont == NULL)
7132 		pkt_len = mp->b_wptr - mp->b_rptr;
7133 	else
7134 		pkt_len = msgdsize(mp);
7135 	ip6_len = ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN;
7136 
7137 	/*
7138 	 * Check for bogus (too short packet) and packet which
7139 	 * was padded by the link layer.
7140 	 */
7141 	if (ip6_len != pkt_len) {
7142 		ssize_t diff;
7143 
7144 		if (ip6_len > pkt_len) {
7145 			ip1dbg(("ip_rput_data_v6: packet too short %d %lu\n",
7146 			    ip6_len, pkt_len));
7147 			BUMP_MIB(ill->ill_ip6_mib, ipv6InTruncatedPkts);
7148 			freemsg(hada_mp);
7149 			freemsg(first_mp);
7150 			return;
7151 		}
7152 		diff = (ssize_t)(pkt_len - ip6_len);
7153 
7154 		if (!adjmsg(mp, -diff)) {
7155 			ip1dbg(("ip_rput_data_v6: adjmsg failed\n"));
7156 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
7157 			freemsg(hada_mp);
7158 			freemsg(first_mp);
7159 			return;
7160 		}
7161 		pkt_len -= diff;
7162 	}
7163 
7164 	if (ILL_HCKSUM_CAPABLE(ill) && !mctl_present && dohwcksum)
7165 		hck_flags = DB_CKSUMFLAGS(mp);
7166 	else
7167 		hck_flags = 0;
7168 
7169 	/* Clear checksum flags in case we need to forward */
7170 	DB_CKSUMFLAGS(mp) = 0;
7171 	reass_sum = reass_hck_flags = 0;
7172 
7173 	nexthdr = ip6h->ip6_nxt;
7174 
7175 	prev_nexthdr_offset = (uint_t)((uchar_t *)&ip6h->ip6_nxt -
7176 	    (uchar_t *)ip6h);
7177 	whereptr = (uint8_t *)&ip6h[1];
7178 	remlen = pkt_len - IPV6_HDR_LEN;	/* Track how much is left */
7179 
7180 	/* Process hop by hop header options */
7181 	if (nexthdr == IPPROTO_HOPOPTS) {
7182 		uint_t ehdrlen;
7183 		uint8_t *optptr;
7184 
7185 		if (remlen < MIN_EHDR_LEN)
7186 			goto pkt_too_short;
7187 		if (mp->b_cont != NULL &&
7188 		    whereptr + MIN_EHDR_LEN > mp->b_wptr) {
7189 			if (!pullupmsg(mp, IPV6_HDR_LEN + MIN_EHDR_LEN)) {
7190 				BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
7191 				freemsg(hada_mp);
7192 				freemsg(first_mp);
7193 				return;
7194 			}
7195 			ip6h = (ip6_t *)mp->b_rptr;
7196 			whereptr = (uint8_t *)ip6h + pkt_len - remlen;
7197 		}
7198 		hbhhdr = (ip6_hbh_t *)whereptr;
7199 		nexthdr = hbhhdr->ip6h_nxt;
7200 		prev_nexthdr_offset = (uint_t)(whereptr - (uint8_t *)ip6h);
7201 		ehdrlen = 8 * (hbhhdr->ip6h_len + 1);
7202 
7203 		if (remlen < ehdrlen)
7204 			goto pkt_too_short;
7205 		if (mp->b_cont != NULL &&
7206 		    whereptr + ehdrlen > mp->b_wptr) {
7207 			if (!pullupmsg(mp, IPV6_HDR_LEN + ehdrlen)) {
7208 				BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
7209 				freemsg(hada_mp);
7210 				freemsg(first_mp);
7211 				return;
7212 			}
7213 			ip6h = (ip6_t *)mp->b_rptr;
7214 			whereptr = (uint8_t *)ip6h + pkt_len - remlen;
7215 			hbhhdr = (ip6_hbh_t *)whereptr;
7216 		}
7217 
7218 		optptr = whereptr + 2;
7219 		whereptr += ehdrlen;
7220 		remlen -= ehdrlen;
7221 		switch (ip_process_options_v6(q, first_mp, ip6h, optptr,
7222 		    ehdrlen - 2, IPPROTO_HOPOPTS)) {
7223 		case -1:
7224 			/*
7225 			 * Packet has been consumed and any
7226 			 * needed ICMP messages sent.
7227 			 */
7228 			BUMP_MIB(ill->ill_ip6_mib, ipv6InHdrErrors);
7229 			freemsg(hada_mp);
7230 			return;
7231 		case 0:
7232 			/* no action needed */
7233 			break;
7234 		case 1:
7235 			/* Known router alert */
7236 			goto ipv6forus;
7237 		}
7238 	}
7239 
7240 	/*
7241 	 * Attach any necessary label information to this packet.
7242 	 */
7243 	if (is_system_labeled() && !tsol_get_pkt_label(mp, IPV6_VERSION)) {
7244 		if (ip6opt_ls != 0)
7245 			ip0dbg(("tsol_get_pkt_label v6 failed\n"));
7246 		BUMP_MIB(ill->ill_ip6_mib, ipv6InHdrErrors);
7247 		freemsg(hada_mp);
7248 		freemsg(first_mp);
7249 		return;
7250 	}
7251 
7252 	/*
7253 	 * On incoming v6 multicast packets we will bypass the ire table,
7254 	 * and assume that the read queue corresponds to the targetted
7255 	 * interface.
7256 	 *
7257 	 * The effect of this is the same as the IPv4 original code, but is
7258 	 * much cleaner I think.  See ip_rput for how that was done.
7259 	 */
7260 	if (IN6_IS_ADDR_MULTICAST(&ip6h->ip6_dst)) {
7261 		BUMP_MIB(ill->ill_ip6_mib, ipv6InMcastPkts);
7262 		/*
7263 		 * XXX TODO Give to mrouted to for multicast forwarding.
7264 		 */
7265 		ILM_WALKER_HOLD(ill);
7266 		ilm = ilm_lookup_ill_v6(ill, &ip6h->ip6_dst, ALL_ZONES);
7267 		ILM_WALKER_RELE(ill);
7268 		if (ilm == NULL) {
7269 			if (ip_debug > 3) {
7270 				/* ip2dbg */
7271 				pr_addr_dbg("ip_rput_data_v6: got mcast packet"
7272 				    "  which is not for us: %s\n", AF_INET6,
7273 				    &ip6h->ip6_dst);
7274 			}
7275 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
7276 			freemsg(hada_mp);
7277 			freemsg(first_mp);
7278 			return;
7279 		}
7280 		if (ip_debug > 3) {
7281 			/* ip2dbg */
7282 			pr_addr_dbg("ip_rput_data_v6: multicast for us: %s\n",
7283 			    AF_INET6, &ip6h->ip6_dst);
7284 		}
7285 		rq = ill->ill_rq;
7286 		zoneid = GLOBAL_ZONEID;
7287 		goto ipv6forus;
7288 	}
7289 
7290 	ipif = ill->ill_ipif;
7291 
7292 	/*
7293 	 * If a packet was received on an interface that is a 6to4 tunnel,
7294 	 * incoming IPv6 packets, with a 6to4 addressed IPv6 destination, must
7295 	 * be checked to have a 6to4 prefix (2002:V4ADDR::/48) that is equal to
7296 	 * the 6to4 prefix of the address configured on the receiving interface.
7297 	 * Otherwise, the packet was delivered to this interface in error and
7298 	 * the packet must be dropped.
7299 	 */
7300 	if ((ill->ill_is_6to4tun) && IN6_IS_ADDR_6TO4(&ip6h->ip6_dst)) {
7301 
7302 		if (!IN6_ARE_6TO4_PREFIX_EQUAL(&ipif->ipif_v6lcl_addr,
7303 		    &ip6h->ip6_dst)) {
7304 			if (ip_debug > 2) {
7305 				/* ip1dbg */
7306 				pr_addr_dbg("ip_rput_data_v6: received 6to4 "
7307 				    "addressed packet which is not for us: "
7308 				    "%s\n", AF_INET6, &ip6h->ip6_dst);
7309 			}
7310 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
7311 			freemsg(first_mp);
7312 			return;
7313 		}
7314 	}
7315 
7316 	/*
7317 	 * Find an ire that matches destination. For link-local addresses
7318 	 * we have to match the ill.
7319 	 * TBD for site local addresses.
7320 	 */
7321 	if (IN6_IS_ADDR_LINKLOCAL(&ip6h->ip6_dst)) {
7322 		ire = ire_ctable_lookup_v6(&ip6h->ip6_dst, NULL,
7323 		    IRE_CACHE|IRE_LOCAL, ill->ill_ipif, ALL_ZONES, NULL,
7324 		    MATCH_IRE_TYPE | MATCH_IRE_ILL_GROUP);
7325 	} else {
7326 		ire = ire_cache_lookup_v6(&ip6h->ip6_dst, ALL_ZONES,
7327 		    MBLK_GETLABEL(mp));
7328 	}
7329 	if (ire == NULL) {
7330 		/*
7331 		 * No matching IRE found.  Mark this packet as having
7332 		 * originated externally.
7333 		 */
7334 		if (!(ill->ill_flags & ILLF_ROUTER) || ll_multicast) {
7335 			BUMP_MIB(ill->ill_ip6_mib, ipv6ForwProhibits);
7336 			if (!(ill->ill_flags & ILLF_ROUTER))
7337 				BUMP_MIB(ill->ill_ip6_mib, ipv6InAddrErrors);
7338 			freemsg(hada_mp);
7339 			freemsg(first_mp);
7340 			return;
7341 		}
7342 		if (ip6h->ip6_hops <= 1) {
7343 			if (hada_mp != NULL)
7344 				goto hada_drop;
7345 			icmp_time_exceeded_v6(WR(q), first_mp,
7346 			    ICMP6_TIME_EXCEED_TRANSIT, ll_multicast, B_FALSE);
7347 			return;
7348 		}
7349 		/*
7350 		 * Per RFC 3513 section 2.5.2, we must not forward packets with
7351 		 * an unspecified source address.
7352 		 */
7353 		if (IN6_IS_ADDR_UNSPECIFIED(&ip6h->ip6_src)) {
7354 			BUMP_MIB(ill->ill_ip6_mib, ipv6ForwProhibits);
7355 			freemsg(hada_mp);
7356 			freemsg(first_mp);
7357 			return;
7358 		}
7359 		mp->b_prev = (mblk_t *)(uintptr_t)
7360 		    ill->ill_phyint->phyint_ifindex;
7361 		ip_newroute_v6(q, mp, &ip6h->ip6_dst, &ip6h->ip6_src,
7362 		    IN6_IS_ADDR_LINKLOCAL(&ip6h->ip6_dst) ? ill : NULL,
7363 		    ALL_ZONES);
7364 		return;
7365 	}
7366 	ipif_id = ire->ire_ipif->ipif_seqid;
7367 	/* we have a matching IRE */
7368 	if (ire->ire_stq != NULL) {
7369 		ill_group_t *ill_group;
7370 		ill_group_t *ire_group;
7371 
7372 		/*
7373 		 * To be quicker, we may wish not to chase pointers
7374 		 * (ire->ire_ipif->ipif_ill...) and instead store the
7375 		 * forwarding policy in the ire.  An unfortunate side-
7376 		 * effect of this would be requiring an ire flush whenever
7377 		 * the ILLF_ROUTER flag changes.  For now, chase pointers
7378 		 * once and store in the boolean no_forward.
7379 		 *
7380 		 * This appears twice to keep it out of the non-forwarding,
7381 		 * yes-it's-for-us-on-the-right-interface case.
7382 		 */
7383 		no_forward = ((ill->ill_flags &
7384 		    ire->ire_ipif->ipif_ill->ill_flags & ILLF_ROUTER) == 0);
7385 
7386 
7387 		ASSERT(first_mp == mp);
7388 		/*
7389 		 * This ire has a send-to queue - forward the packet.
7390 		 */
7391 		if (no_forward || ll_multicast || (hada_mp != NULL)) {
7392 			freemsg(hada_mp);
7393 			BUMP_MIB(ill->ill_ip6_mib, ipv6ForwProhibits);
7394 			if (no_forward)
7395 				BUMP_MIB(ill->ill_ip6_mib, ipv6InAddrErrors);
7396 			freemsg(mp);
7397 			ire_refrele(ire);
7398 			return;
7399 		}
7400 		if (ip6h->ip6_hops <= 1) {
7401 			ip1dbg(("ip_rput_data_v6: hop limit expired.\n"));
7402 			icmp_time_exceeded_v6(WR(q), mp,
7403 			    ICMP6_TIME_EXCEED_TRANSIT, ll_multicast, B_FALSE);
7404 			ire_refrele(ire);
7405 			return;
7406 		}
7407 		/*
7408 		 * Per RFC 3513 section 2.5.2, we must not forward packets with
7409 		 * an unspecified source address.
7410 		 */
7411 		if (IN6_IS_ADDR_UNSPECIFIED(&ip6h->ip6_src)) {
7412 			BUMP_MIB(ill->ill_ip6_mib, ipv6ForwProhibits);
7413 			freemsg(mp);
7414 			ire_refrele(ire);
7415 			return;
7416 		}
7417 
7418 		if (is_system_labeled()) {
7419 			mblk_t *mp1;
7420 
7421 			if ((mp1 = tsol_ip_forward(ire, mp)) == NULL) {
7422 				BUMP_MIB(ill->ill_ip6_mib, ipv6ForwProhibits);
7423 				freemsg(mp);
7424 				ire_refrele(ire);
7425 				return;
7426 			}
7427 			/* Size may have changed */
7428 			mp = mp1;
7429 			ip6h = (ip6_t *)mp->b_rptr;
7430 			pkt_len = msgdsize(mp);
7431 		}
7432 
7433 		if (pkt_len > ire->ire_max_frag) {
7434 			BUMP_MIB(ill->ill_ip6_mib, ipv6InTooBigErrors);
7435 			icmp_pkt2big_v6(WR(q), mp, ire->ire_max_frag,
7436 			    ll_multicast, B_TRUE);
7437 			ire_refrele(ire);
7438 			return;
7439 		}
7440 
7441 		/*
7442 		 * Check to see if we're forwarding the packet to a
7443 		 * different link from which it came.  If so, check the
7444 		 * source and destination addresses since routers must not
7445 		 * forward any packets with link-local source or
7446 		 * destination addresses to other links.  Otherwise (if
7447 		 * we're forwarding onto the same link), conditionally send
7448 		 * a redirect message.
7449 		 */
7450 		ill_group = ill->ill_group;
7451 		ire_group = ((ill_t *)(ire->ire_rfq)->q_ptr)->ill_group;
7452 		if (ire->ire_rfq != q && (ill_group == NULL ||
7453 		    ill_group != ire_group)) {
7454 			if (IN6_IS_ADDR_LINKLOCAL(&ip6h->ip6_dst) ||
7455 			    IN6_IS_ADDR_LINKLOCAL(&ip6h->ip6_src)) {
7456 				BUMP_MIB(ill->ill_ip6_mib, ipv6InAddrErrors);
7457 				freemsg(mp);
7458 				ire_refrele(ire);
7459 				return;
7460 			}
7461 			/* TBD add site-local check at site boundary? */
7462 		} else if (ipv6_send_redirects) {
7463 			in6_addr_t	*v6targ;
7464 			in6_addr_t	gw_addr_v6;
7465 			ire_t		*src_ire_v6 = NULL;
7466 
7467 			/*
7468 			 * Don't send a redirect when forwarding a source
7469 			 * routed packet.
7470 			 */
7471 			if (ip_source_routed_v6(ip6h, mp))
7472 				goto forward;
7473 
7474 			mutex_enter(&ire->ire_lock);
7475 			gw_addr_v6 = ire->ire_gateway_addr_v6;
7476 			mutex_exit(&ire->ire_lock);
7477 			if (!IN6_IS_ADDR_UNSPECIFIED(&gw_addr_v6)) {
7478 				v6targ = &gw_addr_v6;
7479 				/*
7480 				 * We won't send redirects to a router
7481 				 * that doesn't have a link local
7482 				 * address, but will forward.
7483 				 */
7484 				if (!IN6_IS_ADDR_LINKLOCAL(v6targ)) {
7485 					BUMP_MIB(ill->ill_ip6_mib,
7486 					    ipv6InAddrErrors);
7487 					goto forward;
7488 				}
7489 			} else {
7490 				v6targ = &ip6h->ip6_dst;
7491 			}
7492 
7493 			src_ire_v6 = ire_ftable_lookup_v6(&ip6h->ip6_src,
7494 			    NULL, NULL, IRE_INTERFACE, ire->ire_ipif, NULL,
7495 			    ALL_ZONES, 0, NULL,
7496 			    MATCH_IRE_IPIF | MATCH_IRE_TYPE);
7497 
7498 			if (src_ire_v6 != NULL) {
7499 				/*
7500 				 * The source is directly connected.
7501 				 */
7502 				mp1 = copymsg(mp);
7503 				if (mp1 != NULL) {
7504 					icmp_send_redirect_v6(WR(q),
7505 					    mp1, v6targ, &ip6h->ip6_dst,
7506 					    ill, B_FALSE);
7507 				}
7508 				ire_refrele(src_ire_v6);
7509 			}
7510 		}
7511 
7512 forward:
7513 		/* Hoplimit verified above */
7514 		ip6h->ip6_hops--;
7515 		UPDATE_IB_PKT_COUNT(ire);
7516 		ire->ire_last_used_time = lbolt;
7517 		BUMP_MIB(ill->ill_ip6_mib, ipv6OutForwDatagrams);
7518 		ip_xmit_v6(mp, ire, 0, NULL, B_FALSE, NULL);
7519 		IRE_REFRELE(ire);
7520 		return;
7521 	}
7522 	rq = ire->ire_rfq;
7523 
7524 	/*
7525 	 * Need to put on correct queue for reassembly to find it.
7526 	 * No need to use put() since reassembly has its own locks.
7527 	 * Note: multicast packets and packets destined to addresses
7528 	 * assigned to loopback (ire_rfq is NULL) will be reassembled on
7529 	 * the arriving ill.
7530 	 */
7531 	if (rq != q) {
7532 		boolean_t check_multi = B_TRUE;
7533 		ill_group_t *ill_group = NULL;
7534 		ill_group_t *ire_group = NULL;
7535 		ill_t	*ire_ill = NULL;
7536 		uint_t	ill_ifindex = ill->ill_usesrc_ifindex;
7537 
7538 		/*
7539 		 * To be quicker, we may wish not to chase pointers
7540 		 * (ire->ire_ipif->ipif_ill...) and instead store the
7541 		 * forwarding policy in the ire.  An unfortunate side-
7542 		 * effect of this would be requiring an ire flush whenever
7543 		 * the ILLF_ROUTER flag changes.  For now, chase pointers
7544 		 * once and store in the boolean no_forward.
7545 		 */
7546 		no_forward = ((ill->ill_flags &
7547 		    ire->ire_ipif->ipif_ill->ill_flags & ILLF_ROUTER) == 0);
7548 
7549 		ill_group = ill->ill_group;
7550 		if (rq != NULL) {
7551 			ire_ill = (ill_t *)(rq->q_ptr);
7552 			ire_group = ire_ill->ill_group;
7553 		}
7554 
7555 		/*
7556 		 * If it's part of the same IPMP group, or if it's a legal
7557 		 * address on the 'usesrc' interface, then bypass strict
7558 		 * checks.
7559 		 */
7560 		if (ill_group != NULL && ill_group == ire_group) {
7561 			check_multi = B_FALSE;
7562 		} else if (ill_ifindex != 0 && ire_ill != NULL &&
7563 		    ill_ifindex == ire_ill->ill_phyint->phyint_ifindex) {
7564 			check_multi = B_FALSE;
7565 		}
7566 
7567 		ASSERT(!IN6_IS_ADDR_MULTICAST(&ip6h->ip6_dst));
7568 		if (check_multi && ipv6_strict_dst_multihoming && no_forward) {
7569 			/*
7570 			 * This packet came in on an interface other than the
7571 			 * one associated with the destination address
7572 			 * and we are strict about matches.
7573 			 *
7574 			 * As long as the ills belong to the same group,
7575 			 * we don't consider them to arriving on the wrong
7576 			 * interface. Thus, when the switch is doing inbound
7577 			 * load spreading, we won't drop packets when we
7578 			 * are doing strict multihoming checks.
7579 			 */
7580 			BUMP_MIB(ill->ill_ip6_mib, ipv6ForwProhibits);
7581 			freemsg(hada_mp);
7582 			freemsg(first_mp);
7583 			ire_refrele(ire);
7584 			return;
7585 		}
7586 
7587 		if (rq != NULL)
7588 			q = rq;
7589 
7590 		ill = (ill_t *)q->q_ptr;
7591 		ASSERT(ill);
7592 	}
7593 
7594 	zoneid = ire->ire_zoneid;
7595 	UPDATE_IB_PKT_COUNT(ire);
7596 	ire->ire_last_used_time = lbolt;
7597 	/* Don't use the ire after this point. */
7598 	ire_refrele(ire);
7599 ipv6forus:
7600 	/*
7601 	 * Looks like this packet is for us one way or another.
7602 	 * This is where we'll process destination headers etc.
7603 	 */
7604 	for (; ; ) {
7605 		switch (nexthdr) {
7606 		case IPPROTO_TCP: {
7607 			uint16_t	*up;
7608 			uint32_t	sum;
7609 			int		offset;
7610 
7611 			hdr_len = pkt_len - remlen;
7612 
7613 			if (hada_mp != NULL) {
7614 				ip0dbg(("tcp hada drop\n"));
7615 				goto hada_drop;
7616 			}
7617 
7618 
7619 			/* TCP needs all of the TCP header */
7620 			if (remlen < TCP_MIN_HEADER_LENGTH)
7621 				goto pkt_too_short;
7622 			if (mp->b_cont != NULL &&
7623 			    whereptr + TCP_MIN_HEADER_LENGTH > mp->b_wptr) {
7624 				if (!pullupmsg(mp,
7625 				    hdr_len + TCP_MIN_HEADER_LENGTH)) {
7626 					BUMP_MIB(ill->ill_ip6_mib,
7627 					    ipv6InDiscards);
7628 					freemsg(first_mp);
7629 					return;
7630 				}
7631 				hck_flags = 0;
7632 				ip6h = (ip6_t *)mp->b_rptr;
7633 				whereptr = (uint8_t *)ip6h + hdr_len;
7634 			}
7635 			/*
7636 			 * Extract the offset field from the TCP header.
7637 			 */
7638 			offset = ((uchar_t *)ip6h)[hdr_len + 12] >> 4;
7639 			if (offset != 5) {
7640 				if (offset < 5) {
7641 					ip1dbg(("ip_rput_data_v6: short "
7642 					    "TCP data offset"));
7643 					BUMP_MIB(ill->ill_ip6_mib,
7644 					    ipv6InDiscards);
7645 					freemsg(first_mp);
7646 					return;
7647 				}
7648 				/*
7649 				 * There must be TCP options.
7650 				 * Make sure we can grab them.
7651 				 */
7652 				offset <<= 2;
7653 				if (remlen < offset)
7654 					goto pkt_too_short;
7655 				if (mp->b_cont != NULL &&
7656 				    whereptr + offset > mp->b_wptr) {
7657 					if (!pullupmsg(mp,
7658 					    hdr_len + offset)) {
7659 						BUMP_MIB(ill->ill_ip6_mib,
7660 						    ipv6InDiscards);
7661 						freemsg(first_mp);
7662 						return;
7663 					}
7664 					hck_flags = 0;
7665 					ip6h = (ip6_t *)mp->b_rptr;
7666 					whereptr = (uint8_t *)ip6h + hdr_len;
7667 				}
7668 			}
7669 
7670 			up = (uint16_t *)&ip6h->ip6_src;
7671 			/*
7672 			 * TCP checksum calculation.  First sum up the
7673 			 * pseudo-header fields:
7674 			 *  -	Source IPv6 address
7675 			 *  -	Destination IPv6 address
7676 			 *  -	TCP payload length
7677 			 *  -	TCP protocol ID
7678 			 */
7679 			sum = htons(IPPROTO_TCP + remlen) +
7680 			    up[0] + up[1] + up[2] + up[3] +
7681 			    up[4] + up[5] + up[6] + up[7] +
7682 			    up[8] + up[9] + up[10] + up[11] +
7683 			    up[12] + up[13] + up[14] + up[15];
7684 
7685 			/* Fold initial sum */
7686 			sum = (sum & 0xffff) + (sum >> 16);
7687 
7688 			mp1 = mp->b_cont;
7689 
7690 			if ((hck_flags & (HCK_FULLCKSUM|HCK_PARTIALCKSUM)) == 0)
7691 				IP6_STAT(ip6_in_sw_cksum);
7692 
7693 			IP_CKSUM_RECV(hck_flags, sum, (uchar_t *)
7694 			    ((uchar_t *)mp->b_rptr + DB_CKSUMSTART(mp)),
7695 			    (int32_t)(whereptr - (uchar_t *)mp->b_rptr),
7696 			    mp, mp1, cksum_err);
7697 
7698 			if (cksum_err) {
7699 				BUMP_MIB(&ip_mib, tcpInErrs);
7700 
7701 				if (hck_flags & HCK_FULLCKSUM)
7702 					IP6_STAT(ip6_tcp_in_full_hw_cksum_err);
7703 				else if (hck_flags & HCK_PARTIALCKSUM)
7704 					IP6_STAT(ip6_tcp_in_part_hw_cksum_err);
7705 				else
7706 					IP6_STAT(ip6_tcp_in_sw_cksum_err);
7707 
7708 				freemsg(first_mp);
7709 				return;
7710 			}
7711 tcp_fanout:
7712 			ip_fanout_tcp_v6(q, first_mp, ip6h, ill, inill,
7713 			    (flags|IP_FF_SEND_ICMP|IP_FF_SYN_ADDIRE|
7714 			    IP_FF_IP6INFO), hdr_len, mctl_present, zoneid);
7715 			return;
7716 		}
7717 		case IPPROTO_SCTP:
7718 		{
7719 			sctp_hdr_t *sctph;
7720 			uint32_t calcsum, pktsum;
7721 			uint_t hdr_len = pkt_len - remlen;
7722 
7723 			/* SCTP needs all of the SCTP header */
7724 			if (remlen < sizeof (*sctph)) {
7725 				goto pkt_too_short;
7726 			}
7727 			if (whereptr + sizeof (*sctph) > mp->b_wptr) {
7728 				ASSERT(mp->b_cont != NULL);
7729 				if (!pullupmsg(mp, hdr_len + sizeof (*sctph))) {
7730 					BUMP_MIB(ill->ill_ip6_mib,
7731 					    ipv6InDiscards);
7732 					freemsg(mp);
7733 					return;
7734 				}
7735 				ip6h = (ip6_t *)mp->b_rptr;
7736 				whereptr = (uint8_t *)ip6h + hdr_len;
7737 			}
7738 
7739 			sctph = (sctp_hdr_t *)(mp->b_rptr + hdr_len);
7740 			/* checksum */
7741 			pktsum = sctph->sh_chksum;
7742 			sctph->sh_chksum = 0;
7743 			calcsum = sctp_cksum(mp, hdr_len);
7744 			if (calcsum != pktsum) {
7745 				BUMP_MIB(&sctp_mib, sctpChecksumError);
7746 				freemsg(mp);
7747 				return;
7748 			}
7749 			sctph->sh_chksum = pktsum;
7750 			ports = *(uint32_t *)(mp->b_rptr + hdr_len);
7751 			if ((connp = sctp_fanout(&ip6h->ip6_src, &ip6h->ip6_dst,
7752 			    ports, ipif_id, zoneid, mp)) == NULL) {
7753 				ip_fanout_sctp_raw(first_mp, ill,
7754 				    (ipha_t *)ip6h, B_FALSE, ports,
7755 				    mctl_present,
7756 				    (flags|IP_FF_SEND_ICMP|IP_FF_IP6INFO),
7757 				    B_TRUE, ipif_id, zoneid);
7758 				return;
7759 			}
7760 			BUMP_MIB(&ip_mib, ipInDelivers);
7761 			sctp_input(connp, (ipha_t *)ip6h, mp, first_mp, ill,
7762 			    B_FALSE, mctl_present);
7763 			return;
7764 		}
7765 		case IPPROTO_UDP: {
7766 			uint16_t	*up;
7767 			uint32_t	sum;
7768 
7769 			hdr_len = pkt_len - remlen;
7770 
7771 			if (hada_mp != NULL) {
7772 				ip0dbg(("udp hada drop\n"));
7773 				goto hada_drop;
7774 			}
7775 
7776 			/* Verify that at least the ports are present */
7777 			if (remlen < UDPH_SIZE)
7778 				goto pkt_too_short;
7779 			if (mp->b_cont != NULL &&
7780 			    whereptr + UDPH_SIZE > mp->b_wptr) {
7781 				if (!pullupmsg(mp, hdr_len + UDPH_SIZE)) {
7782 					BUMP_MIB(ill->ill_ip6_mib,
7783 					    ipv6InDiscards);
7784 					freemsg(first_mp);
7785 					return;
7786 				}
7787 				hck_flags = 0;
7788 				ip6h = (ip6_t *)mp->b_rptr;
7789 				whereptr = (uint8_t *)ip6h + hdr_len;
7790 			}
7791 
7792 			/*
7793 			 *  Before going through the regular checksum
7794 			 *  calculation, make sure the received checksum
7795 			 *  is non-zero. RFC 2460 says, a 0x0000 checksum
7796 			 *  in a UDP packet (within IPv6 packet) is invalid
7797 			 *  and should be replaced by 0xffff. This makes
7798 			 *  sense as regular checksum calculation will
7799 			 *  pass for both the cases i.e. 0x0000 and 0xffff.
7800 			 *  Removing one of the case makes error detection
7801 			 *  stronger.
7802 			 */
7803 
7804 			if (((udpha_t *)whereptr)->uha_checksum == 0) {
7805 				/* 0x0000 checksum is invalid */
7806 				ip1dbg(("ip_rput_data_v6: Invalid UDP "
7807 				    "checksum value 0x0000\n"));
7808 				BUMP_MIB(ill->ill_ip6_mib, udpInCksumErrs);
7809 				freemsg(first_mp);
7810 				return;
7811 			}
7812 
7813 			up = (uint16_t *)&ip6h->ip6_src;
7814 
7815 			/*
7816 			 * UDP checksum calculation.  First sum up the
7817 			 * pseudo-header fields:
7818 			 *  -	Source IPv6 address
7819 			 *  -	Destination IPv6 address
7820 			 *  -	UDP payload length
7821 			 *  -	UDP protocol ID
7822 			 */
7823 
7824 			sum = htons(IPPROTO_UDP + remlen) +
7825 			    up[0] + up[1] + up[2] + up[3] +
7826 			    up[4] + up[5] + up[6] + up[7] +
7827 			    up[8] + up[9] + up[10] + up[11] +
7828 			    up[12] + up[13] + up[14] + up[15];
7829 
7830 			/* Fold initial sum */
7831 			sum = (sum & 0xffff) + (sum >> 16);
7832 
7833 			if (reass_hck_flags != 0) {
7834 				hck_flags = reass_hck_flags;
7835 
7836 				IP_CKSUM_RECV_REASS(hck_flags,
7837 				    (int32_t)(whereptr - (uchar_t *)mp->b_rptr),
7838 				    sum, reass_sum, cksum_err);
7839 			} else {
7840 				mp1 = mp->b_cont;
7841 
7842 				IP_CKSUM_RECV(hck_flags, sum, (uchar_t *)
7843 				    ((uchar_t *)mp->b_rptr + DB_CKSUMSTART(mp)),
7844 				    (int32_t)(whereptr - (uchar_t *)mp->b_rptr),
7845 				    mp, mp1, cksum_err);
7846 			}
7847 
7848 			if ((hck_flags & (HCK_FULLCKSUM|HCK_PARTIALCKSUM)) == 0)
7849 				IP6_STAT(ip6_in_sw_cksum);
7850 
7851 			if (cksum_err) {
7852 				BUMP_MIB(ill->ill_ip6_mib, udpInCksumErrs);
7853 
7854 				if (hck_flags & HCK_FULLCKSUM)
7855 					IP6_STAT(ip6_udp_in_full_hw_cksum_err);
7856 				else if (hck_flags & HCK_PARTIALCKSUM)
7857 					IP6_STAT(ip6_udp_in_part_hw_cksum_err);
7858 				else
7859 					IP6_STAT(ip6_udp_in_sw_cksum_err);
7860 
7861 				freemsg(first_mp);
7862 				return;
7863 			}
7864 			goto udp_fanout;
7865 		}
7866 		case IPPROTO_ICMPV6: {
7867 			uint16_t	*up;
7868 			uint32_t	sum;
7869 			uint_t		hdr_len = pkt_len - remlen;
7870 
7871 			if (hada_mp != NULL) {
7872 				ip0dbg(("icmp hada drop\n"));
7873 				goto hada_drop;
7874 			}
7875 
7876 			up = (uint16_t *)&ip6h->ip6_src;
7877 			sum = htons(IPPROTO_ICMPV6 + remlen) +
7878 			    up[0] + up[1] + up[2] + up[3] +
7879 			    up[4] + up[5] + up[6] + up[7] +
7880 			    up[8] + up[9] + up[10] + up[11] +
7881 			    up[12] + up[13] + up[14] + up[15];
7882 			sum = (sum & 0xffff) + (sum >> 16);
7883 			sum = IP_CSUM(mp, hdr_len, sum);
7884 			if (sum != 0) {
7885 				/* IPv6 ICMP checksum failed */
7886 				ip1dbg(("ip_rput_data_v6: ICMPv6 checksum "
7887 				    "failed %x\n",
7888 				    sum));
7889 				BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInMsgs);
7890 				BUMP_MIB(ill->ill_icmp6_mib,
7891 				    ipv6IfIcmpInErrors);
7892 				freemsg(first_mp);
7893 				return;
7894 			}
7895 
7896 		icmp_fanout:
7897 			/* Check variable for testing applications */
7898 			if (ipv6_drop_inbound_icmpv6) {
7899 				freemsg(first_mp);
7900 				return;
7901 			}
7902 			/*
7903 			 * Assume that there is always at least one conn for
7904 			 * ICMPv6 (in.ndpd) i.e. don't optimize the case
7905 			 * where there is no conn.
7906 			 */
7907 			if (IN6_IS_ADDR_MULTICAST(&ip6h->ip6_dst)) {
7908 				ASSERT(!(ill->ill_phyint->phyint_flags &
7909 				    PHYI_LOOPBACK));
7910 				/*
7911 				 * In the multicast case, applications may have
7912 				 * joined the group from different zones, so we
7913 				 * need to deliver the packet to each of them.
7914 				 * Loop through the multicast memberships
7915 				 * structures (ilm) on the receive ill and send
7916 				 * a copy of the packet up each matching one.
7917 				 */
7918 				ILM_WALKER_HOLD(ill);
7919 				for (ilm = ill->ill_ilm; ilm != NULL;
7920 				    ilm = ilm->ilm_next) {
7921 					if (ilm->ilm_flags & ILM_DELETED)
7922 						continue;
7923 					if (!IN6_ARE_ADDR_EQUAL(
7924 					    &ilm->ilm_v6addr, &ip6h->ip6_dst))
7925 						continue;
7926 					if (!ipif_lookup_zoneid(ill,
7927 					    ilm->ilm_zoneid, IPIF_UP, NULL))
7928 						continue;
7929 
7930 					first_mp1 = ip_copymsg(first_mp);
7931 					if (first_mp1 == NULL)
7932 						continue;
7933 					icmp_inbound_v6(q, first_mp1, ill,
7934 					    hdr_len, mctl_present, 0,
7935 					    ilm->ilm_zoneid);
7936 				}
7937 				ILM_WALKER_RELE(ill);
7938 			} else {
7939 				first_mp1 = ip_copymsg(first_mp);
7940 				if (first_mp1 != NULL)
7941 					icmp_inbound_v6(q, first_mp1, ill,
7942 					    hdr_len, mctl_present, 0, zoneid);
7943 			}
7944 		}
7945 			/* FALLTHRU */
7946 		default: {
7947 			/*
7948 			 * Handle protocols with which IPv6 is less intimate.
7949 			 */
7950 			uint_t proto_flags = IP_FF_RAWIP|IP_FF_IP6INFO;
7951 
7952 			if (hada_mp != NULL) {
7953 				ip0dbg(("default hada drop\n"));
7954 				goto hada_drop;
7955 			}
7956 
7957 			/*
7958 			 * Enable sending ICMP for "Unknown" nexthdr
7959 			 * case. i.e. where we did not FALLTHRU from
7960 			 * IPPROTO_ICMPV6 processing case above.
7961 			 * If we did FALLTHRU, then the packet has already been
7962 			 * processed for IPPF, don't process it again in
7963 			 * ip_fanout_proto_v6; set IP6_NO_IPPOLICY in the
7964 			 * flags
7965 			 */
7966 			if (nexthdr != IPPROTO_ICMPV6)
7967 				proto_flags |= IP_FF_SEND_ICMP;
7968 			else
7969 				proto_flags |= IP6_NO_IPPOLICY;
7970 
7971 			ip_fanout_proto_v6(q, first_mp, ip6h, ill, inill,
7972 			    nexthdr, prev_nexthdr_offset, (flags|proto_flags),
7973 			    mctl_present, zoneid);
7974 			return;
7975 		}
7976 
7977 		case IPPROTO_DSTOPTS: {
7978 			uint_t ehdrlen;
7979 			uint8_t *optptr;
7980 			ip6_dest_t *desthdr;
7981 
7982 			/* Check if AH is present. */
7983 			if (ipsec_early_ah_v6(q, first_mp, mctl_present, ill,
7984 			    ire, hada_mp, zoneid)) {
7985 				ip0dbg(("dst early hada drop\n"));
7986 				return;
7987 			}
7988 
7989 			/*
7990 			 * Reinitialize pointers, as ipsec_early_ah_v6() does
7991 			 * complete pullups.  We don't have to do more pullups
7992 			 * as a result.
7993 			 */
7994 			whereptr = (uint8_t *)((uintptr_t)mp->b_rptr +
7995 			    (uintptr_t)(whereptr - ((uint8_t *)ip6h)));
7996 			ip6h = (ip6_t *)mp->b_rptr;
7997 
7998 			if (remlen < MIN_EHDR_LEN)
7999 				goto pkt_too_short;
8000 
8001 			desthdr = (ip6_dest_t *)whereptr;
8002 			nexthdr = desthdr->ip6d_nxt;
8003 			prev_nexthdr_offset = (uint_t)(whereptr -
8004 			    (uint8_t *)ip6h);
8005 			ehdrlen = 8 * (desthdr->ip6d_len + 1);
8006 			if (remlen < ehdrlen)
8007 				goto pkt_too_short;
8008 			optptr = whereptr + 2;
8009 			/*
8010 			 * Note: XXX This code does not seem to make
8011 			 * distinction between Destination Options Header
8012 			 * being before/after Routing Header which can
8013 			 * happen if we are at the end of source route.
8014 			 * This may become significant in future.
8015 			 * (No real significant Destination Options are
8016 			 * defined/implemented yet ).
8017 			 */
8018 			switch (ip_process_options_v6(q, first_mp, ip6h, optptr,
8019 			    ehdrlen - 2, IPPROTO_DSTOPTS)) {
8020 			case -1:
8021 				/*
8022 				 * Packet has been consumed and any needed
8023 				 * ICMP errors sent.
8024 				 */
8025 				BUMP_MIB(ill->ill_ip6_mib, ipv6InHdrErrors);
8026 				freemsg(hada_mp);
8027 				return;
8028 			case 0:
8029 				/* No action needed  continue */
8030 				break;
8031 			case 1:
8032 				/*
8033 				 * Unnexpected return value
8034 				 * (Router alert is a Hop-by-Hop option)
8035 				 */
8036 #ifdef DEBUG
8037 				panic("ip_rput_data_v6: router "
8038 				    "alert hbh opt indication in dest opt");
8039 				/*NOTREACHED*/
8040 #else
8041 				freemsg(hada_mp);
8042 				freemsg(first_mp);
8043 				BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
8044 				return;
8045 #endif
8046 			}
8047 			used = ehdrlen;
8048 			break;
8049 		}
8050 		case IPPROTO_FRAGMENT: {
8051 			ip6_frag_t *fraghdr;
8052 			size_t no_frag_hdr_len;
8053 
8054 			if (hada_mp != NULL) {
8055 				ip0dbg(("frag hada drop\n"));
8056 				goto hada_drop;
8057 			}
8058 
8059 			ASSERT(first_mp == mp);
8060 			if (remlen < sizeof (ip6_frag_t))
8061 				goto pkt_too_short;
8062 
8063 			if (mp->b_cont != NULL &&
8064 			    whereptr + sizeof (ip6_frag_t) > mp->b_wptr) {
8065 				if (!pullupmsg(mp,
8066 				    pkt_len - remlen + sizeof (ip6_frag_t))) {
8067 					BUMP_MIB(ill->ill_ip6_mib,
8068 					    ipv6InDiscards);
8069 					freemsg(mp);
8070 					return;
8071 				}
8072 				hck_flags = 0;
8073 				ip6h = (ip6_t *)mp->b_rptr;
8074 				whereptr = (uint8_t *)ip6h + pkt_len - remlen;
8075 			}
8076 
8077 			fraghdr = (ip6_frag_t *)whereptr;
8078 			used = (uint_t)sizeof (ip6_frag_t);
8079 			BUMP_MIB(ill->ill_ip6_mib, ipv6ReasmReqds);
8080 
8081 			/*
8082 			 * Invoke the CGTP (multirouting) filtering module to
8083 			 * process the incoming packet. Packets identified as
8084 			 * duplicates must be discarded. Filtering is active
8085 			 * only if the the ip_cgtp_filter ndd variable is
8086 			 * non-zero.
8087 			 */
8088 			if (ip_cgtp_filter && (ip_cgtp_filter_ops != NULL)) {
8089 				int cgtp_flt_pkt =
8090 				    ip_cgtp_filter_ops->cfo_filter_v6(
8091 				    inill->ill_rq, ip6h, fraghdr);
8092 				if (cgtp_flt_pkt == CGTP_IP_PKT_DUPLICATE) {
8093 					freemsg(mp);
8094 					return;
8095 				}
8096 			}
8097 
8098 			/* Restore the flags */
8099 			DB_CKSUMFLAGS(mp) = hck_flags;
8100 
8101 			mp = ip_rput_frag_v6(q, mp, ip6h, fraghdr,
8102 			    remlen - used, &prev_nexthdr_offset,
8103 			    &reass_sum, &reass_hck_flags);
8104 			if (mp == NULL) {
8105 				/* Reassembly is still pending */
8106 				return;
8107 			}
8108 			/* The first mblk are the headers before the frag hdr */
8109 			BUMP_MIB(ill->ill_ip6_mib, ipv6ReasmOKs);
8110 
8111 			first_mp = mp;	/* mp has most likely changed! */
8112 			no_frag_hdr_len = mp->b_wptr - mp->b_rptr;
8113 			ip6h = (ip6_t *)mp->b_rptr;
8114 			nexthdr = ((char *)ip6h)[prev_nexthdr_offset];
8115 			whereptr = mp->b_rptr + no_frag_hdr_len;
8116 			remlen = ntohs(ip6h->ip6_plen)  +
8117 			    (uint16_t)(IPV6_HDR_LEN - no_frag_hdr_len);
8118 			pkt_len = msgdsize(mp);
8119 			used = 0;
8120 			break;
8121 		}
8122 		case IPPROTO_HOPOPTS:
8123 			if (hada_mp != NULL) {
8124 				ip0dbg(("hop hada drop\n"));
8125 				goto hada_drop;
8126 			}
8127 			/*
8128 			 * Illegal header sequence.
8129 			 * (Hop-by-hop headers are processed above
8130 			 *  and required to immediately follow IPv6 header)
8131 			 */
8132 			icmp_param_problem_v6(WR(q), first_mp,
8133 			    ICMP6_PARAMPROB_NEXTHEADER,
8134 			    prev_nexthdr_offset,
8135 			    B_FALSE, B_FALSE);
8136 			return;
8137 
8138 		case IPPROTO_ROUTING: {
8139 			uint_t ehdrlen;
8140 			ip6_rthdr_t *rthdr;
8141 
8142 			/* Check if AH is present. */
8143 			if (ipsec_early_ah_v6(q, first_mp, mctl_present, ill,
8144 			    ire, hada_mp, zoneid)) {
8145 				ip0dbg(("routing hada drop\n"));
8146 				return;
8147 			}
8148 
8149 			/*
8150 			 * Reinitialize pointers, as ipsec_early_ah_v6() does
8151 			 * complete pullups.  We don't have to do more pullups
8152 			 * as a result.
8153 			 */
8154 			whereptr = (uint8_t *)((uintptr_t)mp->b_rptr +
8155 			    (uintptr_t)(whereptr - ((uint8_t *)ip6h)));
8156 			ip6h = (ip6_t *)mp->b_rptr;
8157 
8158 			if (remlen < MIN_EHDR_LEN)
8159 				goto pkt_too_short;
8160 			rthdr = (ip6_rthdr_t *)whereptr;
8161 			nexthdr = rthdr->ip6r_nxt;
8162 			prev_nexthdr_offset = (uint_t)(whereptr -
8163 			    (uint8_t *)ip6h);
8164 			ehdrlen = 8 * (rthdr->ip6r_len + 1);
8165 			if (remlen < ehdrlen)
8166 				goto pkt_too_short;
8167 			if (rthdr->ip6r_segleft != 0) {
8168 				/* Not end of source route */
8169 				if (ll_multicast) {
8170 					BUMP_MIB(ill->ill_ip6_mib,
8171 					    ipv6ForwProhibits);
8172 					freemsg(hada_mp);
8173 					freemsg(mp);
8174 					return;
8175 				}
8176 				ip_process_rthdr(q, mp, ip6h, rthdr, ill,
8177 				    flags, hada_mp);
8178 				return;
8179 			}
8180 			used = ehdrlen;
8181 			break;
8182 		}
8183 		case IPPROTO_AH:
8184 		case IPPROTO_ESP: {
8185 			/*
8186 			 * Fast path for AH/ESP. If this is the first time
8187 			 * we are sending a datagram to AH/ESP, allocate
8188 			 * a IPSEC_IN message and prepend it. Otherwise,
8189 			 * just fanout.
8190 			 */
8191 
8192 			ipsec_in_t *ii;
8193 			int ipsec_rc;
8194 
8195 			if (!mctl_present) {
8196 				ASSERT(first_mp == mp);
8197 				if ((first_mp = ipsec_in_alloc(B_FALSE)) ==
8198 				    NULL) {
8199 					ip1dbg(("ip_rput_data_v6: IPSEC_IN "
8200 					    "allocation failure.\n"));
8201 					BUMP_MIB(ill->ill_ip6_mib,
8202 					    ipv6InDiscards);
8203 					freemsg(mp);
8204 					return;
8205 				}
8206 				/*
8207 				 * Store the ill_index so that when we come back
8208 				 * from IPSEC we ride on the same queue.
8209 				 */
8210 				ii = (ipsec_in_t *)first_mp->b_rptr;
8211 				ii->ipsec_in_ill_index =
8212 				    ill->ill_phyint->phyint_ifindex;
8213 				ii->ipsec_in_rill_index =
8214 				    ii->ipsec_in_ill_index;
8215 				first_mp->b_cont = mp;
8216 				/*
8217 				 * Cache hardware acceleration info.
8218 				 */
8219 				if (hada_mp != NULL) {
8220 					IPSECHW_DEBUG(IPSECHW_PKT,
8221 					    ("ip_rput_data_v6: "
8222 						"caching data attr.\n"));
8223 					ii->ipsec_in_accelerated = B_TRUE;
8224 					ii->ipsec_in_da = hada_mp;
8225 					hada_mp = NULL;
8226 				}
8227 			} else {
8228 				ii = (ipsec_in_t *)first_mp->b_rptr;
8229 			}
8230 
8231 			if (!ipsec_loaded()) {
8232 				ip_proto_not_sup(q, first_mp, IP_FF_SEND_ICMP,
8233 				    ire->ire_zoneid);
8234 				return;
8235 			}
8236 
8237 			/* select inbound SA and have IPsec process the pkt */
8238 			if (nexthdr == IPPROTO_ESP) {
8239 				esph_t *esph = ipsec_inbound_esp_sa(first_mp);
8240 				if (esph == NULL)
8241 					return;
8242 				ASSERT(ii->ipsec_in_esp_sa != NULL);
8243 				ASSERT(ii->ipsec_in_esp_sa->ipsa_input_func !=
8244 				    NULL);
8245 				ipsec_rc = ii->ipsec_in_esp_sa->ipsa_input_func(
8246 				    first_mp, esph);
8247 			} else {
8248 				ah_t *ah = ipsec_inbound_ah_sa(first_mp);
8249 				if (ah == NULL)
8250 					return;
8251 				ASSERT(ii->ipsec_in_ah_sa != NULL);
8252 				ASSERT(ii->ipsec_in_ah_sa->ipsa_input_func !=
8253 				    NULL);
8254 				ipsec_rc = ii->ipsec_in_ah_sa->ipsa_input_func(
8255 				    first_mp, ah);
8256 			}
8257 
8258 			switch (ipsec_rc) {
8259 			case IPSEC_STATUS_SUCCESS:
8260 				break;
8261 			case IPSEC_STATUS_FAILED:
8262 				BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
8263 				/* FALLTHRU */
8264 			case IPSEC_STATUS_PENDING:
8265 				return;
8266 			}
8267 			/* we're done with IPsec processing, send it up */
8268 			ip_fanout_proto_again(first_mp, ill, inill, ire);
8269 			return;
8270 		}
8271 		case IPPROTO_NONE:
8272 			/* All processing is done. Count as "delivered". */
8273 			freemsg(hada_mp);
8274 			freemsg(first_mp);
8275 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDelivers);
8276 			return;
8277 		}
8278 		whereptr += used;
8279 		ASSERT(remlen >= used);
8280 		remlen -= used;
8281 	}
8282 	/* NOTREACHED */
8283 
8284 pkt_too_short:
8285 	ip1dbg(("ip_rput_data_v6: packet too short %d %lu %d\n",
8286 	    ip6_len, pkt_len, remlen));
8287 	BUMP_MIB(ill->ill_ip6_mib, ipv6InTruncatedPkts);
8288 	freemsg(hada_mp);
8289 	freemsg(first_mp);
8290 	return;
8291 udp_fanout:
8292 	if (mctl_present || IN6_IS_ADDR_MULTICAST(&ip6h->ip6_dst)) {
8293 		connp = NULL;
8294 	} else {
8295 		connp = ipcl_classify_v6(mp, IPPROTO_UDP, hdr_len, zoneid);
8296 		if ((connp != NULL) && (connp->conn_upq == NULL)) {
8297 			CONN_DEC_REF(connp);
8298 			connp = NULL;
8299 		}
8300 	}
8301 
8302 	if (connp == NULL) {
8303 		uint32_t	ports;
8304 
8305 		ports = *(uint32_t *)(mp->b_rptr + hdr_len +
8306 		    UDP_PORTS_OFFSET);
8307 		IP6_STAT(ip6_udp_slow_path);
8308 		ip_fanout_udp_v6(q, first_mp, ip6h, ports, ill, inill,
8309 		    (flags|IP_FF_SEND_ICMP|IP_FF_IP6INFO), mctl_present,
8310 		    zoneid);
8311 		return;
8312 	}
8313 
8314 	if (CONN_UDP_FLOWCTLD(connp)) {
8315 		freemsg(first_mp);
8316 		BUMP_MIB(ill->ill_ip6_mib, udpInOverflows);
8317 		CONN_DEC_REF(connp);
8318 		return;
8319 	}
8320 
8321 	/* Initiate IPPF processing */
8322 	if (IP6_IN_IPP(flags)) {
8323 		ip_process(IPP_LOCAL_IN, &mp, ill->ill_phyint->phyint_ifindex);
8324 		if (mp == NULL) {
8325 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
8326 			CONN_DEC_REF(connp);
8327 			return;
8328 		}
8329 	}
8330 
8331 	if (connp->conn_ipv6_recvpktinfo ||
8332 	    IN6_IS_ADDR_LINKLOCAL(&ip6h->ip6_src)) {
8333 		mp = ip_add_info_v6(mp, inill, &ip6h->ip6_dst);
8334 		if (mp == NULL) {
8335 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
8336 			CONN_DEC_REF(connp);
8337 			return;
8338 		}
8339 	}
8340 
8341 	IP6_STAT(ip6_udp_fast_path);
8342 	BUMP_MIB(ill->ill_ip6_mib, ipv6InReceives);
8343 	BUMP_MIB(ill->ill_ip6_mib, ipv6InDelivers);
8344 
8345 	/* Send it upstream */
8346 	CONN_UDP_RECV(connp, mp);
8347 
8348 	CONN_DEC_REF(connp);
8349 	freemsg(hada_mp);
8350 	return;
8351 
8352 hada_drop:
8353 	ip1dbg(("ip_rput_data_v6: malformed accelerated packet\n"));
8354 	/* IPsec kstats: bump counter here */
8355 	freemsg(hada_mp);
8356 	freemsg(first_mp);
8357 }
8358 
8359 /*
8360  * Reassemble fragment.
8361  * When it returns a completed message the first mblk will only contain
8362  * the headers prior to the fragment header.
8363  *
8364  * prev_nexthdr_offset is an offset indication of where the nexthdr field is
8365  * of the preceding header.  This is needed to patch the previous header's
8366  * nexthdr field when reassembly completes.
8367  */
8368 static mblk_t *
8369 ip_rput_frag_v6(queue_t *q, mblk_t *mp, ip6_t *ip6h,
8370     ip6_frag_t *fraghdr, uint_t remlen, uint_t *prev_nexthdr_offset,
8371     uint32_t *cksum_val, uint16_t *cksum_flags)
8372 {
8373 	ill_t		*ill = (ill_t *)q->q_ptr;
8374 	uint32_t	ident = ntohl(fraghdr->ip6f_ident);
8375 	uint16_t	offset;
8376 	boolean_t	more_frags;
8377 	uint8_t		nexthdr = fraghdr->ip6f_nxt;
8378 	in6_addr_t	*v6dst_ptr;
8379 	in6_addr_t	*v6src_ptr;
8380 	uint_t		end;
8381 	uint_t		hdr_length;
8382 	size_t		count;
8383 	ipf_t		*ipf;
8384 	ipf_t		**ipfp;
8385 	ipfb_t		*ipfb;
8386 	mblk_t		*mp1;
8387 	uint8_t		ecn_info = 0;
8388 	size_t		msg_len;
8389 	mblk_t		*tail_mp;
8390 	mblk_t		*t_mp;
8391 	boolean_t	pruned = B_FALSE;
8392 	uint32_t	sum_val;
8393 	uint16_t	sum_flags;
8394 
8395 
8396 	if (cksum_val != NULL)
8397 		*cksum_val = 0;
8398 	if (cksum_flags != NULL)
8399 		*cksum_flags = 0;
8400 
8401 	/*
8402 	 * We utilize hardware computed checksum info only for UDP since
8403 	 * IP fragmentation is a normal occurence for the protocol.  In
8404 	 * addition, checksum offload support for IP fragments carrying
8405 	 * UDP payload is commonly implemented across network adapters.
8406 	 */
8407 	ASSERT(ill != NULL);
8408 	if (nexthdr == IPPROTO_UDP && dohwcksum && ILL_HCKSUM_CAPABLE(ill) &&
8409 	    (DB_CKSUMFLAGS(mp) & (HCK_FULLCKSUM | HCK_PARTIALCKSUM))) {
8410 		mblk_t *mp1 = mp->b_cont;
8411 		int32_t len;
8412 
8413 		/* Record checksum information from the packet */
8414 		sum_val = (uint32_t)DB_CKSUM16(mp);
8415 		sum_flags = DB_CKSUMFLAGS(mp);
8416 
8417 		/* fragmented payload offset from beginning of mblk */
8418 		offset = (uint16_t)((uchar_t *)&fraghdr[1] - mp->b_rptr);
8419 
8420 		if ((sum_flags & HCK_PARTIALCKSUM) &&
8421 		    (mp1 == NULL || mp1->b_cont == NULL) &&
8422 		    offset >= (uint16_t)DB_CKSUMSTART(mp) &&
8423 		    ((len = offset - (uint16_t)DB_CKSUMSTART(mp)) & 1) == 0) {
8424 			uint32_t adj;
8425 			/*
8426 			 * Partial checksum has been calculated by hardware
8427 			 * and attached to the packet; in addition, any
8428 			 * prepended extraneous data is even byte aligned.
8429 			 * If any such data exists, we adjust the checksum;
8430 			 * this would also handle any postpended data.
8431 			 */
8432 			IP_ADJCKSUM_PARTIAL(mp->b_rptr + DB_CKSUMSTART(mp),
8433 			    mp, mp1, len, adj);
8434 
8435 			/* One's complement subtract extraneous checksum */
8436 			if (adj >= sum_val)
8437 				sum_val = ~(adj - sum_val) & 0xFFFF;
8438 			else
8439 				sum_val -= adj;
8440 		}
8441 	} else {
8442 		sum_val = 0;
8443 		sum_flags = 0;
8444 	}
8445 
8446 	/* Clear hardware checksumming flag */
8447 	DB_CKSUMFLAGS(mp) = 0;
8448 
8449 	/*
8450 	 * Note: Fragment offset in header is in 8-octet units.
8451 	 * Clearing least significant 3 bits not only extracts
8452 	 * it but also gets it in units of octets.
8453 	 */
8454 	offset = ntohs(fraghdr->ip6f_offlg) & ~7;
8455 	more_frags = (fraghdr->ip6f_offlg & IP6F_MORE_FRAG);
8456 
8457 	/*
8458 	 * Is the more frags flag on and the payload length not a multiple
8459 	 * of eight?
8460 	 */
8461 	if (more_frags && (ntohs(ip6h->ip6_plen) & 7)) {
8462 		BUMP_MIB(ill->ill_ip6_mib, ipv6InHdrErrors);
8463 		icmp_param_problem_v6(WR(q), mp, ICMP6_PARAMPROB_HEADER,
8464 		    (uint32_t)((char *)&ip6h->ip6_plen -
8465 		    (char *)ip6h), B_FALSE, B_FALSE);
8466 		return (NULL);
8467 	}
8468 
8469 	v6src_ptr = &ip6h->ip6_src;
8470 	v6dst_ptr = &ip6h->ip6_dst;
8471 	end = remlen;
8472 
8473 	hdr_length = (uint_t)((char *)&fraghdr[1] - (char *)ip6h);
8474 	end += offset;
8475 
8476 	/*
8477 	 * Would fragment cause reassembled packet to have a payload length
8478 	 * greater than IP_MAXPACKET - the max payload size?
8479 	 */
8480 	if (end > IP_MAXPACKET) {
8481 		BUMP_MIB(ill->ill_ip6_mib, ipv6InHdrErrors);
8482 		icmp_param_problem_v6(WR(q), mp, ICMP6_PARAMPROB_HEADER,
8483 		    (uint32_t)((char *)&fraghdr->ip6f_offlg -
8484 		    (char *)ip6h), B_FALSE, B_FALSE);
8485 		return (NULL);
8486 	}
8487 
8488 	/*
8489 	 * This packet just has one fragment. Reassembly not
8490 	 * needed.
8491 	 */
8492 	if (!more_frags && offset == 0) {
8493 		goto reass_done;
8494 	}
8495 
8496 	/*
8497 	 * Drop the fragmented as early as possible, if
8498 	 * we don't have resource(s) to re-assemble.
8499 	 */
8500 	if (ip_reass_queue_bytes == 0) {
8501 		freemsg(mp);
8502 		return (NULL);
8503 	}
8504 
8505 	/* Record the ECN field info. */
8506 	ecn_info = (uint8_t)(ntohl(ip6h->ip6_vcf & htonl(~0xFFCFFFFF)) >> 20);
8507 	/*
8508 	 * If this is not the first fragment, dump the unfragmentable
8509 	 * portion of the packet.
8510 	 */
8511 	if (offset)
8512 		mp->b_rptr = (uchar_t *)&fraghdr[1];
8513 
8514 	/*
8515 	 * Fragmentation reassembly.  Each ILL has a hash table for
8516 	 * queueing packets undergoing reassembly for all IPIFs
8517 	 * associated with the ILL.  The hash is based on the packet
8518 	 * IP ident field.  The ILL frag hash table was allocated
8519 	 * as a timer block at the time the ILL was created.  Whenever
8520 	 * there is anything on the reassembly queue, the timer will
8521 	 * be running.
8522 	 */
8523 	msg_len = MBLKSIZE(mp);
8524 	tail_mp = mp;
8525 	while (tail_mp->b_cont != NULL) {
8526 		tail_mp = tail_mp->b_cont;
8527 		msg_len += MBLKSIZE(tail_mp);
8528 	}
8529 	/*
8530 	 * If the reassembly list for this ILL will get too big
8531 	 * prune it.
8532 	 */
8533 
8534 	if ((msg_len + sizeof (*ipf) + ill->ill_frag_count) >=
8535 	    ip_reass_queue_bytes) {
8536 		ill_frag_prune(ill, (ip_reass_queue_bytes < msg_len) ? 0
8537 		    : (ip_reass_queue_bytes - msg_len));
8538 		pruned = B_TRUE;
8539 	}
8540 
8541 	ipfb = &ill->ill_frag_hash_tbl[ILL_FRAG_HASH_V6(*v6src_ptr, ident)];
8542 	mutex_enter(&ipfb->ipfb_lock);
8543 
8544 	ipfp = &ipfb->ipfb_ipf;
8545 	/* Try to find an existing fragment queue for this packet. */
8546 	for (;;) {
8547 		ipf = ipfp[0];
8548 		if (ipf) {
8549 			/*
8550 			 * It has to match on ident, source address, and
8551 			 * dest address.
8552 			 */
8553 			if (ipf->ipf_ident == ident &&
8554 			    IN6_ARE_ADDR_EQUAL(&ipf->ipf_v6src, v6src_ptr) &&
8555 			    IN6_ARE_ADDR_EQUAL(&ipf->ipf_v6dst, v6dst_ptr)) {
8556 
8557 				/*
8558 				 * If we have received too many
8559 				 * duplicate fragments for this packet
8560 				 * free it.
8561 				 */
8562 				if (ipf->ipf_num_dups > ip_max_frag_dups) {
8563 					ill_frag_free_pkts(ill, ipfb, ipf, 1);
8564 					freemsg(mp);
8565 					mutex_exit(&ipfb->ipfb_lock);
8566 					return (NULL);
8567 				}
8568 
8569 				break;
8570 			}
8571 			ipfp = &ipf->ipf_hash_next;
8572 			continue;
8573 		}
8574 
8575 
8576 		/*
8577 		 * If we pruned the list, do we want to store this new
8578 		 * fragment?. We apply an optimization here based on the
8579 		 * fact that most fragments will be received in order.
8580 		 * So if the offset of this incoming fragment is zero,
8581 		 * it is the first fragment of a new packet. We will
8582 		 * keep it.  Otherwise drop the fragment, as we have
8583 		 * probably pruned the packet already (since the
8584 		 * packet cannot be found).
8585 		 */
8586 
8587 		if (pruned && offset != 0) {
8588 			mutex_exit(&ipfb->ipfb_lock);
8589 			freemsg(mp);
8590 			return (NULL);
8591 		}
8592 
8593 		/* New guy.  Allocate a frag message. */
8594 		mp1 = allocb(sizeof (*ipf), BPRI_MED);
8595 		if (!mp1) {
8596 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
8597 			freemsg(mp);
8598 	partial_reass_done:
8599 			mutex_exit(&ipfb->ipfb_lock);
8600 			return (NULL);
8601 		}
8602 
8603 		if (ipfb->ipfb_frag_pkts >= MAX_FRAG_PKTS)  {
8604 			/*
8605 			 * Too many fragmented packets in this hash bucket.
8606 			 * Free the oldest.
8607 			 */
8608 			ill_frag_free_pkts(ill, ipfb, ipfb->ipfb_ipf, 1);
8609 		}
8610 
8611 		mp1->b_cont = mp;
8612 
8613 		/* Initialize the fragment header. */
8614 		ipf = (ipf_t *)mp1->b_rptr;
8615 		ipf->ipf_mp = mp1;
8616 		ipf->ipf_ptphn = ipfp;
8617 		ipfp[0] = ipf;
8618 		ipf->ipf_hash_next = NULL;
8619 		ipf->ipf_ident = ident;
8620 		ipf->ipf_v6src = *v6src_ptr;
8621 		ipf->ipf_v6dst = *v6dst_ptr;
8622 		/* Record reassembly start time. */
8623 		ipf->ipf_timestamp = gethrestime_sec();
8624 		/* Record ipf generation and account for frag header */
8625 		ipf->ipf_gen = ill->ill_ipf_gen++;
8626 		ipf->ipf_count = MBLKSIZE(mp1);
8627 		ipf->ipf_protocol = nexthdr;
8628 		ipf->ipf_nf_hdr_len = 0;
8629 		ipf->ipf_prev_nexthdr_offset = 0;
8630 		ipf->ipf_last_frag_seen = B_FALSE;
8631 		ipf->ipf_ecn = ecn_info;
8632 		ipf->ipf_num_dups = 0;
8633 		ipfb->ipfb_frag_pkts++;
8634 		ipf->ipf_checksum = 0;
8635 		ipf->ipf_checksum_flags = 0;
8636 
8637 		/* Store checksum value in fragment header */
8638 		if (sum_flags != 0) {
8639 			sum_val = (sum_val & 0xFFFF) + (sum_val >> 16);
8640 			sum_val = (sum_val & 0xFFFF) + (sum_val >> 16);
8641 			ipf->ipf_checksum = sum_val;
8642 			ipf->ipf_checksum_flags = sum_flags;
8643 		}
8644 
8645 		/*
8646 		 * We handle reassembly two ways.  In the easy case,
8647 		 * where all the fragments show up in order, we do
8648 		 * minimal bookkeeping, and just clip new pieces on
8649 		 * the end.  If we ever see a hole, then we go off
8650 		 * to ip_reassemble which has to mark the pieces and
8651 		 * keep track of the number of holes, etc.  Obviously,
8652 		 * the point of having both mechanisms is so we can
8653 		 * handle the easy case as efficiently as possible.
8654 		 */
8655 		if (offset == 0) {
8656 			/* Easy case, in-order reassembly so far. */
8657 			/* Update the byte count */
8658 			ipf->ipf_count += msg_len;
8659 			ipf->ipf_tail_mp = tail_mp;
8660 			/*
8661 			 * Keep track of next expected offset in
8662 			 * ipf_end.
8663 			 */
8664 			ipf->ipf_end = end;
8665 			ipf->ipf_nf_hdr_len = hdr_length;
8666 			ipf->ipf_prev_nexthdr_offset = *prev_nexthdr_offset;
8667 		} else {
8668 			/* Hard case, hole at the beginning. */
8669 			ipf->ipf_tail_mp = NULL;
8670 			/*
8671 			 * ipf_end == 0 means that we have given up
8672 			 * on easy reassembly.
8673 			 */
8674 			ipf->ipf_end = 0;
8675 
8676 			/* Forget checksum offload from now on */
8677 			ipf->ipf_checksum_flags = 0;
8678 
8679 			/*
8680 			 * ipf_hole_cnt is set by ip_reassemble.
8681 			 * ipf_count is updated by ip_reassemble.
8682 			 * No need to check for return value here
8683 			 * as we don't expect reassembly to complete or
8684 			 * fail for the first fragment itself.
8685 			 */
8686 			(void) ip_reassemble(mp, ipf, offset, more_frags, ill,
8687 			    msg_len);
8688 		}
8689 		/* Update per ipfb and ill byte counts */
8690 		ipfb->ipfb_count += ipf->ipf_count;
8691 		ASSERT(ipfb->ipfb_count > 0);	/* Wraparound */
8692 		ill->ill_frag_count += ipf->ipf_count;
8693 		ASSERT(ill->ill_frag_count > 0);	/* Wraparound */
8694 		/* If the frag timer wasn't already going, start it. */
8695 		mutex_enter(&ill->ill_lock);
8696 		ill_frag_timer_start(ill);
8697 		mutex_exit(&ill->ill_lock);
8698 		goto partial_reass_done;
8699 	}
8700 
8701 	/*
8702 	 * If the packet's flag has changed (it could be coming up
8703 	 * from an interface different than the previous, therefore
8704 	 * possibly different checksum capability), then forget about
8705 	 * any stored checksum states.  Otherwise add the value to
8706 	 * the existing one stored in the fragment header.
8707 	 */
8708 	if (sum_flags != 0 && sum_flags == ipf->ipf_checksum_flags) {
8709 		sum_val += ipf->ipf_checksum;
8710 		sum_val = (sum_val & 0xFFFF) + (sum_val >> 16);
8711 		sum_val = (sum_val & 0xFFFF) + (sum_val >> 16);
8712 		ipf->ipf_checksum = sum_val;
8713 	} else if (ipf->ipf_checksum_flags != 0) {
8714 		/* Forget checksum offload from now on */
8715 		ipf->ipf_checksum_flags = 0;
8716 	}
8717 
8718 	/*
8719 	 * We have a new piece of a datagram which is already being
8720 	 * reassembled.  Update the ECN info if all IP fragments
8721 	 * are ECN capable.  If there is one which is not, clear
8722 	 * all the info.  If there is at least one which has CE
8723 	 * code point, IP needs to report that up to transport.
8724 	 */
8725 	if (ecn_info != IPH_ECN_NECT && ipf->ipf_ecn != IPH_ECN_NECT) {
8726 		if (ecn_info == IPH_ECN_CE)
8727 			ipf->ipf_ecn = IPH_ECN_CE;
8728 	} else {
8729 		ipf->ipf_ecn = IPH_ECN_NECT;
8730 	}
8731 
8732 	if (offset && ipf->ipf_end == offset) {
8733 		/* The new fragment fits at the end */
8734 		ipf->ipf_tail_mp->b_cont = mp;
8735 		/* Update the byte count */
8736 		ipf->ipf_count += msg_len;
8737 		/* Update per ipfb and ill byte counts */
8738 		ipfb->ipfb_count += msg_len;
8739 		ASSERT(ipfb->ipfb_count > 0);	/* Wraparound */
8740 		ill->ill_frag_count += msg_len;
8741 		ASSERT(ill->ill_frag_count > 0);	/* Wraparound */
8742 		if (more_frags) {
8743 			/* More to come. */
8744 			ipf->ipf_end = end;
8745 			ipf->ipf_tail_mp = tail_mp;
8746 			goto partial_reass_done;
8747 		}
8748 	} else {
8749 		/*
8750 		 * Go do the hard cases.
8751 		 * Call ip_reassemble().
8752 		 */
8753 		int ret;
8754 
8755 		if (offset == 0) {
8756 			if (ipf->ipf_prev_nexthdr_offset == 0) {
8757 				ipf->ipf_nf_hdr_len = hdr_length;
8758 				ipf->ipf_prev_nexthdr_offset =
8759 				    *prev_nexthdr_offset;
8760 			}
8761 		}
8762 		/* Save current byte count */
8763 		count = ipf->ipf_count;
8764 		ret = ip_reassemble(mp, ipf, offset, more_frags, ill, msg_len);
8765 
8766 		/* Count of bytes added and subtracted (freeb()ed) */
8767 		count = ipf->ipf_count - count;
8768 		if (count) {
8769 			/* Update per ipfb and ill byte counts */
8770 			ipfb->ipfb_count += count;
8771 			ASSERT(ipfb->ipfb_count > 0);	/* Wraparound */
8772 			ill->ill_frag_count += count;
8773 			ASSERT(ill->ill_frag_count > 0); /* Wraparound */
8774 		}
8775 		if (ret == IP_REASS_PARTIAL) {
8776 			goto partial_reass_done;
8777 		} else if (ret == IP_REASS_FAILED) {
8778 			/* Reassembly failed. Free up all resources */
8779 			ill_frag_free_pkts(ill, ipfb, ipf, 1);
8780 			for (t_mp = mp; t_mp != NULL; t_mp = t_mp->b_cont) {
8781 				IP_REASS_SET_START(t_mp, 0);
8782 				IP_REASS_SET_END(t_mp, 0);
8783 			}
8784 			freemsg(mp);
8785 			goto partial_reass_done;
8786 		}
8787 
8788 		/* We will reach here iff 'ret' is IP_REASS_COMPLETE */
8789 	}
8790 	/*
8791 	 * We have completed reassembly.  Unhook the frag header from
8792 	 * the reassembly list.
8793 	 *
8794 	 * Grab the unfragmentable header length next header value out
8795 	 * of the first fragment
8796 	 */
8797 	ASSERT(ipf->ipf_nf_hdr_len != 0);
8798 	hdr_length = ipf->ipf_nf_hdr_len;
8799 
8800 	/*
8801 	 * Before we free the frag header, record the ECN info
8802 	 * to report back to the transport.
8803 	 */
8804 	ecn_info = ipf->ipf_ecn;
8805 
8806 	/*
8807 	 * Store the nextheader field in the header preceding the fragment
8808 	 * header
8809 	 */
8810 	nexthdr = ipf->ipf_protocol;
8811 	*prev_nexthdr_offset = ipf->ipf_prev_nexthdr_offset;
8812 	ipfp = ipf->ipf_ptphn;
8813 
8814 	/* We need to supply these to caller */
8815 	if ((sum_flags = ipf->ipf_checksum_flags) != 0)
8816 		sum_val = ipf->ipf_checksum;
8817 	else
8818 		sum_val = 0;
8819 
8820 	mp1 = ipf->ipf_mp;
8821 	count = ipf->ipf_count;
8822 	ipf = ipf->ipf_hash_next;
8823 	if (ipf)
8824 		ipf->ipf_ptphn = ipfp;
8825 	ipfp[0] = ipf;
8826 	ill->ill_frag_count -= count;
8827 	ASSERT(ipfb->ipfb_count >= count);
8828 	ipfb->ipfb_count -= count;
8829 	ipfb->ipfb_frag_pkts--;
8830 	mutex_exit(&ipfb->ipfb_lock);
8831 	/* Ditch the frag header. */
8832 	mp = mp1->b_cont;
8833 	freeb(mp1);
8834 
8835 	/*
8836 	 * Make sure the packet is good by doing some sanity
8837 	 * check. If bad we can silentely drop the packet.
8838 	 */
8839 reass_done:
8840 	if (hdr_length < sizeof (ip6_frag_t)) {
8841 		BUMP_MIB(ill->ill_ip6_mib, ipv6InHdrErrors);
8842 		ip1dbg(("ip_rput_frag_v6: bad packet\n"));
8843 		freemsg(mp);
8844 		return (NULL);
8845 	}
8846 
8847 	/*
8848 	 * Remove the fragment header from the initial header by
8849 	 * splitting the mblk into the non-fragmentable header and
8850 	 * everthing after the fragment extension header.  This has the
8851 	 * side effect of putting all the headers that need destination
8852 	 * processing into the b_cont block-- on return this fact is
8853 	 * used in order to avoid having to look at the extensions
8854 	 * already processed.
8855 	 *
8856 	 * Note that this code assumes that the unfragmentable portion
8857 	 * of the header is in the first mblk and increments
8858 	 * the read pointer past it.  If this assumption is broken
8859 	 * this code fails badly.
8860 	 */
8861 	if (mp->b_rptr + hdr_length != mp->b_wptr) {
8862 		mblk_t *nmp;
8863 
8864 		if (!(nmp = dupb(mp))) {
8865 			BUMP_MIB(ill->ill_ip6_mib, ipv6InDiscards);
8866 			ip1dbg(("ip_rput_frag_v6: dupb failed\n"));
8867 			freemsg(mp);
8868 			return (NULL);
8869 		}
8870 		nmp->b_cont = mp->b_cont;
8871 		mp->b_cont = nmp;
8872 		nmp->b_rptr += hdr_length;
8873 	}
8874 	mp->b_wptr = mp->b_rptr + hdr_length - sizeof (ip6_frag_t);
8875 
8876 	ip6h = (ip6_t *)mp->b_rptr;
8877 	((char *)ip6h)[*prev_nexthdr_offset] = nexthdr;
8878 
8879 	/* Restore original IP length in header. */
8880 	ip6h->ip6_plen = htons((uint16_t)(msgdsize(mp) - IPV6_HDR_LEN));
8881 	/* Record the ECN info. */
8882 	ip6h->ip6_vcf &= htonl(0xFFCFFFFF);
8883 	ip6h->ip6_vcf |= htonl(ecn_info << 20);
8884 
8885 	/* Reassembly is successful; return checksum information if needed */
8886 	if (cksum_val != NULL)
8887 		*cksum_val = sum_val;
8888 	if (cksum_flags != NULL)
8889 		*cksum_flags = sum_flags;
8890 
8891 	return (mp);
8892 }
8893 
8894 /*
8895  * Walk through the options to see if there is a routing header.
8896  * If present get the destination which is the last address of
8897  * the option.
8898  */
8899 in6_addr_t
8900 ip_get_dst_v6(ip6_t *ip6h, boolean_t *is_fragment)
8901 {
8902 	uint8_t nexthdr;
8903 	uint8_t *whereptr;
8904 	ip6_hbh_t *hbhhdr;
8905 	ip6_dest_t *dsthdr;
8906 	ip6_rthdr0_t *rthdr;
8907 	ip6_frag_t *fraghdr;
8908 	int ehdrlen;
8909 	int left;
8910 	in6_addr_t *ap, rv;
8911 
8912 	if (is_fragment != NULL)
8913 		*is_fragment = B_FALSE;
8914 
8915 	rv = ip6h->ip6_dst;
8916 
8917 	nexthdr = ip6h->ip6_nxt;
8918 	whereptr = (uint8_t *)&ip6h[1];
8919 	for (;;) {
8920 
8921 		ASSERT(nexthdr != IPPROTO_RAW);
8922 		switch (nexthdr) {
8923 		case IPPROTO_HOPOPTS:
8924 			hbhhdr = (ip6_hbh_t *)whereptr;
8925 			nexthdr = hbhhdr->ip6h_nxt;
8926 			ehdrlen = 8 * (hbhhdr->ip6h_len + 1);
8927 			break;
8928 		case IPPROTO_DSTOPTS:
8929 			dsthdr = (ip6_dest_t *)whereptr;
8930 			nexthdr = dsthdr->ip6d_nxt;
8931 			ehdrlen = 8 * (dsthdr->ip6d_len + 1);
8932 			break;
8933 		case IPPROTO_ROUTING:
8934 			rthdr = (ip6_rthdr0_t *)whereptr;
8935 			nexthdr = rthdr->ip6r0_nxt;
8936 			ehdrlen = 8 * (rthdr->ip6r0_len + 1);
8937 
8938 			left = rthdr->ip6r0_segleft;
8939 			ap = (in6_addr_t *)((char *)rthdr + sizeof (*rthdr));
8940 			rv = *(ap + left - 1);
8941 			/*
8942 			 * If the caller doesn't care whether the packet
8943 			 * is a fragment or not, we can stop here since
8944 			 * we have our destination.
8945 			 */
8946 			if (is_fragment == NULL)
8947 				goto done;
8948 			break;
8949 		case IPPROTO_FRAGMENT:
8950 			fraghdr = (ip6_frag_t *)whereptr;
8951 			nexthdr = fraghdr->ip6f_nxt;
8952 			ehdrlen = sizeof (ip6_frag_t);
8953 			if (is_fragment != NULL)
8954 				*is_fragment = B_TRUE;
8955 			goto done;
8956 		default :
8957 			goto done;
8958 		}
8959 		whereptr += ehdrlen;
8960 	}
8961 
8962 done:
8963 	return (rv);
8964 }
8965 
8966 /*
8967  * ip_source_routed_v6:
8968  * This function is called by redirect code in ip_rput_data_v6 to
8969  * know whether this packet is source routed through this node i.e
8970  * whether this node (router) is part of the journey. This
8971  * function is called under two cases :
8972  *
8973  * case 1 : Routing header was processed by this node and
8974  *	    ip_process_rthdr replaced ip6_dst with the next hop
8975  *          and we are forwarding the packet to the next hop.
8976  *
8977  * case 2 : Routing header was not processed by this node and we
8978  *	    are just forwarding the packet.
8979  *
8980  * For case (1) we don't want to send redirects. For case(2) we
8981  * want to send redirects.
8982  */
8983 static boolean_t
8984 ip_source_routed_v6(ip6_t *ip6h, mblk_t *mp)
8985 {
8986 	uint8_t		nexthdr;
8987 	in6_addr_t	*addrptr;
8988 	ip6_rthdr0_t	*rthdr;
8989 	uint8_t		numaddr;
8990 	ip6_hbh_t	*hbhhdr;
8991 	uint_t		ehdrlen;
8992 	uint8_t		*byteptr;
8993 
8994 	ip2dbg(("ip_source_routed_v6\n"));
8995 	nexthdr = ip6h->ip6_nxt;
8996 	ehdrlen = IPV6_HDR_LEN;
8997 
8998 	/* if a routing hdr is preceeded by HOPOPT or DSTOPT */
8999 	while (nexthdr == IPPROTO_HOPOPTS ||
9000 	    nexthdr == IPPROTO_DSTOPTS) {
9001 		byteptr = (uint8_t *)ip6h + ehdrlen;
9002 		/*
9003 		 * Check if we have already processed
9004 		 * packets or we are just a forwarding
9005 		 * router which only pulled up msgs up
9006 		 * to IPV6HDR and  one HBH ext header
9007 		 */
9008 		if (byteptr + MIN_EHDR_LEN > mp->b_wptr) {
9009 			ip2dbg(("ip_source_routed_v6: Extension"
9010 			    " headers not processed\n"));
9011 			return (B_FALSE);
9012 		}
9013 		hbhhdr = (ip6_hbh_t *)byteptr;
9014 		nexthdr = hbhhdr->ip6h_nxt;
9015 		ehdrlen = ehdrlen + 8 * (hbhhdr->ip6h_len + 1);
9016 	}
9017 	switch (nexthdr) {
9018 	case IPPROTO_ROUTING:
9019 		byteptr = (uint8_t *)ip6h + ehdrlen;
9020 		/*
9021 		 * If for some reason, we haven't pulled up
9022 		 * the routing hdr data mblk, then we must
9023 		 * not have processed it at all. So for sure
9024 		 * we are not part of the source routed journey.
9025 		 */
9026 		if (byteptr + MIN_EHDR_LEN > mp->b_wptr) {
9027 			ip2dbg(("ip_source_routed_v6: Routing"
9028 			    " header not processed\n"));
9029 			return (B_FALSE);
9030 		}
9031 		rthdr = (ip6_rthdr0_t *)byteptr;
9032 		/*
9033 		 * Either we are an intermediate router or the
9034 		 * last hop before destination and we have
9035 		 * already processed the routing header.
9036 		 * If segment_left is greater than or equal to zero,
9037 		 * then we must be the (numaddr - segleft) entry
9038 		 * of the routing header. Although ip6r0_segleft
9039 		 * is a unit8_t variable, we still check for zero
9040 		 * or greater value, if in case the data type
9041 		 * is changed someday in future.
9042 		 */
9043 		if (rthdr->ip6r0_segleft > 0 ||
9044 		    rthdr->ip6r0_segleft == 0) {
9045 			ire_t 	*ire = NULL;
9046 
9047 			numaddr = rthdr->ip6r0_len / 2;
9048 			addrptr = (in6_addr_t *)((char *)rthdr +
9049 			    sizeof (*rthdr));
9050 			addrptr += (numaddr - (rthdr->ip6r0_segleft + 1));
9051 			if (addrptr != NULL) {
9052 				ire = ire_ctable_lookup_v6(addrptr, NULL,
9053 				    IRE_LOCAL, NULL, ALL_ZONES, NULL,
9054 				    MATCH_IRE_TYPE);
9055 				if (ire != NULL) {
9056 					ire_refrele(ire);
9057 					return (B_TRUE);
9058 				}
9059 				ip1dbg(("ip_source_routed_v6: No ire found\n"));
9060 			}
9061 		}
9062 	/* FALLTHRU */
9063 	default:
9064 		ip2dbg(("ip_source_routed_v6: Not source routed here\n"));
9065 		return (B_FALSE);
9066 	}
9067 }
9068 
9069 /*
9070  * ip_wput_v6 -- Packets sent down from transport modules show up here.
9071  * Assumes that the following set of headers appear in the first
9072  * mblk:
9073  *	ip6i_t (if present) CAN also appear as a separate mblk.
9074  *	ip6_t
9075  *	Any extension headers
9076  *	TCP/UDP/SCTP header (if present)
9077  * The routine can handle an ICMPv6 header that is not in the first mblk.
9078  *
9079  * The order to determine the outgoing interface is as follows:
9080  * 1. IPV6_BOUND_PIF is set, use that ill (conn_outgoing_pill)
9081  * 2. If conn_nofailover_ill is set then use that ill.
9082  * 3. If an ip6i_t with IP6I_IFINDEX set then use that ill.
9083  * 4. If q is an ill queue and (link local or multicast destination) then
9084  *    use that ill.
9085  * 5. If IPV6_BOUND_IF has been set use that ill.
9086  * 6. For multicast: if IPV6_MULTICAST_IF has been set use it. Otherwise
9087  *    look for the best IRE match for the unspecified group to determine
9088  *    the ill.
9089  * 7. For unicast: Just do an IRE lookup for the best match.
9090  */
9091 void
9092 ip_output_v6(void *arg, mblk_t *mp, void *arg2, int caller)
9093 {
9094 	conn_t		*connp = NULL;
9095 	queue_t		*q = (queue_t *)arg2;
9096 	ire_t		*ire = NULL;
9097 	ire_t		*sctp_ire = NULL;
9098 	ip6_t		*ip6h;
9099 	in6_addr_t	*v6dstp;
9100 	ill_t		*ill = NULL;
9101 	ipif_t		*ipif;
9102 	ip6i_t		*ip6i;
9103 	int		cksum_request;	/* -1 => normal. */
9104 			/* 1 => Skip TCP/UDP/SCTP checksum */
9105 			/* Otherwise contains insert offset for checksum */
9106 	int		unspec_src;
9107 	boolean_t	do_outrequests;	/* Increment OutRequests? */
9108 	mib2_ipv6IfStatsEntry_t	*mibptr;
9109 	int 		match_flags = MATCH_IRE_ILL_GROUP;
9110 	boolean_t	attach_if = B_FALSE;
9111 	mblk_t		*first_mp;
9112 	boolean_t	mctl_present;
9113 	ipsec_out_t	*io;
9114 	boolean_t	drop_if_delayed = B_FALSE;
9115 	boolean_t	multirt_need_resolve = B_FALSE;
9116 	mblk_t		*copy_mp = NULL;
9117 	int		err;
9118 	int		ip6i_flags = 0;
9119 	zoneid_t	zoneid;
9120 	ill_t		*saved_ill = NULL;
9121 	boolean_t	conn_lock_held;
9122 	boolean_t	need_decref = B_FALSE;
9123 
9124 	/*
9125 	 * Highest bit in version field is Reachability Confirmation bit
9126 	 * used by NUD in ip_xmit_v6().
9127 	 */
9128 #ifdef	_BIG_ENDIAN
9129 #define	IPVER(ip6h)	((((uint32_t *)ip6h)[0] >> 28) & 0x7)
9130 #else
9131 #define	IPVER(ip6h)	((((uint32_t *)ip6h)[0] >> 4) & 0x7)
9132 #endif
9133 
9134 	/*
9135 	 * M_CTL comes from 5 places
9136 	 *
9137 	 * 1) TCP sends down IPSEC_OUT(M_CTL) for detached connections
9138 	 *    both V4 and V6 datagrams.
9139 	 *
9140 	 * 2) AH/ESP sends down M_CTL after doing their job with both
9141 	 *    V4 and V6 datagrams.
9142 	 *
9143 	 * 3) NDP callbacks when nce is resolved and IPSEC_OUT has been
9144 	 *    attached.
9145 	 *
9146 	 * 4) Notifications from an external resolver (for XRESOLV ifs)
9147 	 *
9148 	 * 5) AH/ESP send down IPSEC_CTL(M_CTL) to be relayed to hardware for
9149 	 *    IPsec hardware acceleration support.
9150 	 *
9151 	 * We need to handle (1)'s IPv6 case and (3) here.  For the
9152 	 * IPv4 case in (1), and (2), IPSEC processing has already
9153 	 * started. The code in ip_wput() already knows how to handle
9154 	 * continuing IPSEC processing (for IPv4 and IPv6).  All other
9155 	 * M_CTLs (including case (4)) are passed on to ip_wput_nondata()
9156 	 * for handling.
9157 	 */
9158 	first_mp = mp;
9159 	mctl_present = B_FALSE;
9160 	io = NULL;
9161 
9162 	/* Multidata transmit? */
9163 	if (DB_TYPE(mp) == M_MULTIDATA) {
9164 		/*
9165 		 * We should never get here, since all Multidata messages
9166 		 * originating from tcp should have been directed over to
9167 		 * tcp_multisend() in the first place.
9168 		 */
9169 		BUMP_MIB(&ip6_mib, ipv6OutDiscards);
9170 		freemsg(mp);
9171 		return;
9172 	} else if (DB_TYPE(mp) == M_CTL) {
9173 		uint32_t mctltype = 0;
9174 		uint32_t mlen = MBLKL(first_mp);
9175 
9176 		mp = mp->b_cont;
9177 		mctl_present = B_TRUE;
9178 		io = (ipsec_out_t *)first_mp->b_rptr;
9179 
9180 		/*
9181 		 * Validate this M_CTL message.  The only three types of
9182 		 * M_CTL messages we expect to see in this code path are
9183 		 * ipsec_out_t or ipsec_in_t structures (allocated as
9184 		 * ipsec_info_t unions), or ipsec_ctl_t structures.
9185 		 * The ipsec_out_type and ipsec_in_type overlap in the two
9186 		 * data structures, and they are either set to IPSEC_OUT
9187 		 * or IPSEC_IN depending on which data structure it is.
9188 		 * ipsec_ctl_t is an IPSEC_CTL.
9189 		 *
9190 		 * All other M_CTL messages are sent to ip_wput_nondata()
9191 		 * for handling.
9192 		 */
9193 		if (mlen >= sizeof (io->ipsec_out_type))
9194 			mctltype = io->ipsec_out_type;
9195 
9196 		if ((mlen == sizeof (ipsec_ctl_t)) &&
9197 		    (mctltype == IPSEC_CTL)) {
9198 			ip_output(Q_TO_CONN(q), first_mp, q, caller);
9199 			return;
9200 		}
9201 
9202 		if ((mlen < sizeof (ipsec_info_t)) ||
9203 		    (mctltype != IPSEC_OUT && mctltype != IPSEC_IN) ||
9204 		    mp == NULL) {
9205 			ip_wput_nondata(NULL, q, first_mp, NULL);
9206 			return;
9207 		}
9208 		/* NDP callbacks have q_next non-NULL.  That's case #3. */
9209 		if (q->q_next == NULL) {
9210 			ip6h = (ip6_t *)mp->b_rptr;
9211 			/*
9212 			 * For a freshly-generated TCP dgram that needs IPV6
9213 			 * processing, don't call ip_wput immediately. We can
9214 			 * tell this by the ipsec_out_proc_begin. In-progress
9215 			 * IPSEC_OUT messages have proc_begin set to TRUE,
9216 			 * and we want to send all IPSEC_IN messages to
9217 			 * ip_wput() for IPsec processing or finishing.
9218 			 */
9219 			if (mctltype == IPSEC_IN ||
9220 			    IPVER(ip6h) != IPV6_VERSION ||
9221 			    io->ipsec_out_proc_begin) {
9222 				mibptr = &ip6_mib;
9223 				goto notv6;
9224 			}
9225 		}
9226 	} else if (DB_TYPE(mp) != M_DATA) {
9227 		ip_wput_nondata(NULL, q, mp, NULL);
9228 		return;
9229 	}
9230 
9231 	ip6h = (ip6_t *)mp->b_rptr;
9232 
9233 	if (IPVER(ip6h) != IPV6_VERSION) {
9234 		mibptr = &ip6_mib;
9235 		goto notv6;
9236 	}
9237 
9238 	if (q->q_next != NULL) {
9239 		ill = (ill_t *)q->q_ptr;
9240 		/*
9241 		 * We don't know if this ill will be used for IPv6
9242 		 * until the ILLF_IPV6 flag is set via SIOCSLIFNAME.
9243 		 * ipif_set_values() sets the ill_isv6 flag to true if
9244 		 * ILLF_IPV6 is set.  If the ill_isv6 flag isn't true,
9245 		 * just drop the packet.
9246 		 */
9247 		if (!ill->ill_isv6) {
9248 			ip1dbg(("ip_wput_v6: Received an IPv6 packet before "
9249 			    "ILLF_IPV6 was set\n"));
9250 			freemsg(first_mp);
9251 			return;
9252 		}
9253 		/* For uniformity do a refhold */
9254 		mutex_enter(&ill->ill_lock);
9255 		if (!ILL_CAN_LOOKUP(ill)) {
9256 			mutex_exit(&ill->ill_lock);
9257 			freemsg(first_mp);
9258 			return;
9259 		}
9260 		ill_refhold_locked(ill);
9261 		mutex_exit(&ill->ill_lock);
9262 		mibptr = ill->ill_ip6_mib;
9263 		/*
9264 		 * ill_ip6_mib is allocated by ipif_set_values() when
9265 		 * ill_isv6 is set.  Thus if ill_isv6 is true,
9266 		 * ill_ip6_mib had better not be NULL.
9267 		 */
9268 		ASSERT(mibptr != NULL);
9269 		unspec_src = 0;
9270 		BUMP_MIB(mibptr, ipv6OutRequests);
9271 		do_outrequests = B_FALSE;
9272 	} else {
9273 		connp = (conn_t *)arg;
9274 		ASSERT(connp != NULL);
9275 
9276 		/* is queue flow controlled? */
9277 		if ((q->q_first || connp->conn_draining) &&
9278 		    (caller == IP_WPUT)) {
9279 			/*
9280 			 * 1) TCP sends down M_CTL for detached connections.
9281 			 * 2) AH/ESP sends down M_CTL.
9282 			 *
9283 			 * We don't flow control either of the above. Only
9284 			 * UDP and others are flow controlled for which we
9285 			 * can't have a M_CTL.
9286 			 */
9287 			ASSERT(first_mp == mp);
9288 			(void) putq(q, mp);
9289 			return;
9290 		}
9291 		mibptr = &ip6_mib;
9292 		unspec_src = connp->conn_unspec_src;
9293 		do_outrequests = B_TRUE;
9294 		if (mp->b_flag & MSGHASREF) {
9295 			mp->b_flag &= ~MSGHASREF;
9296 			ASSERT(connp->conn_ulp == IPPROTO_SCTP);
9297 			SCTP_EXTRACT_IPINFO(mp, sctp_ire);
9298 			need_decref = B_TRUE;
9299 		}
9300 
9301 		/*
9302 		 * If there is a policy, try to attach an ipsec_out in
9303 		 * the front. At the end, first_mp either points to a
9304 		 * M_DATA message or IPSEC_OUT message linked to a
9305 		 * M_DATA message. We have to do it now as we might
9306 		 * lose the "conn" if we go through ip_newroute.
9307 		 */
9308 		if (!mctl_present &&
9309 		    (connp->conn_out_enforce_policy ||
9310 		    connp->conn_latch != NULL)) {
9311 			ASSERT(first_mp == mp);
9312 			/* XXX Any better way to get the protocol fast ? */
9313 			if (((mp = ipsec_attach_ipsec_out(mp, connp, NULL,
9314 			    connp->conn_ulp)) == NULL)) {
9315 				if (need_decref)
9316 					CONN_DEC_REF(connp);
9317 				return;
9318 			} else {
9319 				ASSERT(mp->b_datap->db_type == M_CTL);
9320 				first_mp = mp;
9321 				mp = mp->b_cont;
9322 				mctl_present = B_TRUE;
9323 				io = (ipsec_out_t *)first_mp->b_rptr;
9324 			}
9325 		}
9326 	}
9327 
9328 	/* check for alignment and full IPv6 header */
9329 	if (!OK_32PTR((uchar_t *)ip6h) ||
9330 	    (mp->b_wptr - (uchar_t *)ip6h) < IPV6_HDR_LEN) {
9331 		ip0dbg(("ip_wput_v6: bad alignment or length\n"));
9332 		if (do_outrequests)
9333 			BUMP_MIB(mibptr, ipv6OutRequests);
9334 		BUMP_MIB(mibptr, ipv6OutDiscards);
9335 		freemsg(first_mp);
9336 		if (ill != NULL)
9337 			ill_refrele(ill);
9338 		if (need_decref)
9339 			CONN_DEC_REF(connp);
9340 		return;
9341 	}
9342 	v6dstp = &ip6h->ip6_dst;
9343 	cksum_request = -1;
9344 	ip6i = NULL;
9345 
9346 	/*
9347 	 * Once neighbor discovery has completed, ndp_process() will provide
9348 	 * locally generated packets for which processing can be reattempted.
9349 	 * In these cases, connp is NULL and the original zone is part of a
9350 	 * prepended ipsec_out_t.
9351 	 */
9352 	if (io != NULL) {
9353 		zoneid = io->ipsec_out_zoneid;
9354 		ASSERT(zoneid != ALL_ZONES);
9355 	} else {
9356 		zoneid = (connp != NULL ? connp->conn_zoneid : ALL_ZONES);
9357 	}
9358 
9359 	if (ip6h->ip6_nxt == IPPROTO_RAW) {
9360 		/*
9361 		 * This is an ip6i_t header followed by an ip6_hdr.
9362 		 * Check which fields are set.
9363 		 *
9364 		 * When the packet comes from a transport we should have
9365 		 * all needed headers in the first mblk. However, when
9366 		 * going through ip_newroute*_v6 the ip6i might be in
9367 		 * a separate mblk when we return here. In that case
9368 		 * we pullup everything to ensure that extension and transport
9369 		 * headers "stay" in the first mblk.
9370 		 */
9371 		ip6i = (ip6i_t *)ip6h;
9372 		ip6i_flags = ip6i->ip6i_flags;
9373 
9374 		ASSERT((mp->b_wptr - (uchar_t *)ip6i) == sizeof (ip6i_t) ||
9375 		    ((mp->b_wptr - (uchar_t *)ip6i) >=
9376 		    sizeof (ip6i_t) + IPV6_HDR_LEN));
9377 
9378 		if ((mp->b_wptr - (uchar_t *)ip6i) == sizeof (ip6i_t)) {
9379 			if (!pullupmsg(mp, -1)) {
9380 				ip1dbg(("ip_wput_v6: pullupmsg failed\n"));
9381 				if (do_outrequests)
9382 					BUMP_MIB(mibptr, ipv6OutRequests);
9383 				BUMP_MIB(mibptr, ipv6OutDiscards);
9384 				freemsg(first_mp);
9385 				if (ill != NULL)
9386 					ill_refrele(ill);
9387 				if (need_decref)
9388 					CONN_DEC_REF(connp);
9389 				return;
9390 			}
9391 			ip6h = (ip6_t *)mp->b_rptr;
9392 			v6dstp = &ip6h->ip6_dst;
9393 			ip6i = (ip6i_t *)ip6h;
9394 		}
9395 		ip6h = (ip6_t *)&ip6i[1];
9396 
9397 		/*
9398 		 * Advance rptr past the ip6i_t to get ready for
9399 		 * transmitting the packet. However, if the packet gets
9400 		 * passed to ip_newroute*_v6 then rptr is moved back so
9401 		 * that the ip6i_t header can be inspected when the
9402 		 * packet comes back here after passing through
9403 		 * ire_add_then_send.
9404 		 */
9405 		mp->b_rptr = (uchar_t *)ip6h;
9406 
9407 		/*
9408 		 * IP6I_ATTACH_IF is set in this function when we had a
9409 		 * conn and it was either bound to the IPFF_NOFAILOVER address
9410 		 * or IPV6_BOUND_PIF was set. These options override other
9411 		 * options that set the ifindex. We come here with
9412 		 * IP6I_ATTACH_IF set when we can't find the ire and
9413 		 * ip_newroute_v6 is feeding the packet for second time.
9414 		 */
9415 		if ((ip6i->ip6i_flags & IP6I_IFINDEX) ||
9416 		    (ip6i->ip6i_flags & IP6I_ATTACH_IF)) {
9417 			ASSERT(ip6i->ip6i_ifindex != 0);
9418 			if (ill != NULL)
9419 				ill_refrele(ill);
9420 			ill = ill_lookup_on_ifindex(ip6i->ip6i_ifindex, 1,
9421 			    NULL, NULL, NULL, NULL);
9422 			if (ill == NULL) {
9423 				if (do_outrequests)
9424 					BUMP_MIB(mibptr, ipv6OutRequests);
9425 				BUMP_MIB(mibptr, ipv6OutDiscards);
9426 				ip1dbg(("ip_wput_v6: bad ifindex %d\n",
9427 				    ip6i->ip6i_ifindex));
9428 				if (need_decref)
9429 					CONN_DEC_REF(connp);
9430 				freemsg(first_mp);
9431 				return;
9432 			}
9433 			mibptr = ill->ill_ip6_mib;
9434 			if (ip6i->ip6i_flags & IP6I_IFINDEX) {
9435 				/*
9436 				 * Preserve the index so that when we return
9437 				 * from IPSEC processing, we know where to
9438 				 * send the packet.
9439 				 */
9440 				if (mctl_present) {
9441 					ASSERT(io != NULL);
9442 					io->ipsec_out_ill_index =
9443 					    ip6i->ip6i_ifindex;
9444 				}
9445 			}
9446 			if (ip6i->ip6i_flags & IP6I_ATTACH_IF) {
9447 				/*
9448 				 * This is a multipathing probe packet that has
9449 				 * been delayed in ND resolution. Drop the
9450 				 * packet for the reasons mentioned in
9451 				 * nce_queue_mp()
9452 				 */
9453 				if ((ip6i->ip6i_flags & IP6I_DROP_IFDELAYED) &&
9454 				    (ip6i->ip6i_flags & IP6I_ND_DELAYED)) {
9455 					freemsg(first_mp);
9456 					ill_refrele(ill);
9457 					if (need_decref)
9458 						CONN_DEC_REF(connp);
9459 					return;
9460 				}
9461 			}
9462 		}
9463 		if (ip6i->ip6i_flags & IP6I_VERIFY_SRC) {
9464 			cred_t *cr = DB_CREDDEF(mp, GET_QUEUE_CRED(q));
9465 
9466 			ASSERT(!IN6_IS_ADDR_UNSPECIFIED(&ip6h->ip6_src));
9467 			if (secpolicy_net_rawaccess(cr) != 0) {
9468 				ire = ire_route_lookup_v6(&ip6h->ip6_src,
9469 				    0, 0, (IRE_LOCAL|IRE_LOOPBACK), NULL,
9470 				    NULL, zoneid, NULL,
9471 				    MATCH_IRE_TYPE | MATCH_IRE_ZONEONLY);
9472 				if (ire == NULL) {
9473 					if (do_outrequests)
9474 						BUMP_MIB(mibptr,
9475 						    ipv6OutRequests);
9476 					BUMP_MIB(mibptr, ipv6OutDiscards);
9477 					ip1dbg(("ip_wput_v6: bad source "
9478 					    "addr\n"));
9479 					freemsg(first_mp);
9480 					if (ill != NULL)
9481 						ill_refrele(ill);
9482 					if (need_decref)
9483 						CONN_DEC_REF(connp);
9484 					return;
9485 				}
9486 				ire_refrele(ire);
9487 			}
9488 			/* No need to verify again when using ip_newroute */
9489 			ip6i->ip6i_flags &= ~IP6I_VERIFY_SRC;
9490 		}
9491 		if (!(ip6i->ip6i_flags & IP6I_NEXTHOP)) {
9492 			/*
9493 			 * Make sure they match since ip_newroute*_v6 etc might
9494 			 * (unknown to them) inspect ip6i_nexthop when
9495 			 * they think they access ip6_dst.
9496 			 */
9497 			ip6i->ip6i_nexthop = ip6h->ip6_dst;
9498 		}
9499 		if (ip6i->ip6i_flags & IP6I_NO_ULP_CKSUM)
9500 			cksum_request = 1;
9501 		if (ip6i->ip6i_flags & IP6I_RAW_CHECKSUM)
9502 			cksum_request = ip6i->ip6i_checksum_off;
9503 		if (ip6i->ip6i_flags & IP6I_UNSPEC_SRC)
9504 			unspec_src = 1;
9505 
9506 		if (do_outrequests && ill != NULL) {
9507 			BUMP_MIB(mibptr, ipv6OutRequests);
9508 			do_outrequests = B_FALSE;
9509 		}
9510 		/*
9511 		 * Store ip6i_t info that we need after we come back
9512 		 * from IPSEC processing.
9513 		 */
9514 		if (mctl_present) {
9515 			ASSERT(io != NULL);
9516 			io->ipsec_out_unspec_src = unspec_src;
9517 		}
9518 	}
9519 	if (connp != NULL && connp->conn_dontroute)
9520 		ip6h->ip6_hops = 1;
9521 
9522 	if (IN6_IS_ADDR_MULTICAST(v6dstp))
9523 		goto ipv6multicast;
9524 
9525 	/* 1. IPV6_BOUND_PIF takes precedence over all the ifindex settings. */
9526 	if (connp != NULL && connp->conn_outgoing_pill != NULL) {
9527 		ill_t	*conn_outgoing_pill;
9528 
9529 		conn_outgoing_pill = conn_get_held_ill(connp,
9530 		    &connp->conn_outgoing_pill, &err);
9531 		if (err == ILL_LOOKUP_FAILED) {
9532 			if (ill != NULL)
9533 				ill_refrele(ill);
9534 			if (need_decref)
9535 				CONN_DEC_REF(connp);
9536 			freemsg(first_mp);
9537 			return;
9538 		}
9539 		if (conn_outgoing_pill != NULL) {
9540 			if (ill != NULL)
9541 				ill_refrele(ill);
9542 			ill = conn_outgoing_pill;
9543 			attach_if = B_TRUE;
9544 			match_flags = MATCH_IRE_ILL;
9545 			mibptr = ill->ill_ip6_mib;
9546 
9547 			/*
9548 			 * Check if we need an ire that will not be
9549 			 * looked up by anybody else i.e. HIDDEN.
9550 			 */
9551 			if (ill_is_probeonly(ill))
9552 				match_flags |= MATCH_IRE_MARK_HIDDEN;
9553 			goto send_from_ill;
9554 		}
9555 	}
9556 
9557 	/* 2. If ipc_nofailover_ill is set then use that ill. */
9558 	if (connp != NULL && connp->conn_nofailover_ill != NULL) {
9559 		ill_t	*conn_nofailover_ill;
9560 
9561 		conn_nofailover_ill = conn_get_held_ill(connp,
9562 		    &connp->conn_nofailover_ill, &err);
9563 		if (err == ILL_LOOKUP_FAILED) {
9564 			if (ill != NULL)
9565 				ill_refrele(ill);
9566 			if (need_decref)
9567 				CONN_DEC_REF(connp);
9568 			freemsg(first_mp);
9569 			return;
9570 		}
9571 		if (conn_nofailover_ill != NULL) {
9572 			if (ill != NULL)
9573 				ill_refrele(ill);
9574 			ill = conn_nofailover_ill;
9575 			attach_if = B_TRUE;
9576 			/*
9577 			 * Assumes that ipc_nofailover_ill is used only for
9578 			 * multipathing probe packets. These packets are better
9579 			 * dropped, if they are delayed in ND resolution, for
9580 			 * the reasons described in nce_queue_mp().
9581 			 * IP6I_DROP_IFDELAYED will be set later on in this
9582 			 * function for this packet.
9583 			 */
9584 			drop_if_delayed = B_TRUE;
9585 			match_flags = MATCH_IRE_ILL;
9586 			mibptr = ill->ill_ip6_mib;
9587 
9588 			/*
9589 			 * Check if we need an ire that will not be
9590 			 * looked up by anybody else i.e. HIDDEN.
9591 			 */
9592 			if (ill_is_probeonly(ill))
9593 				match_flags |= MATCH_IRE_MARK_HIDDEN;
9594 			goto send_from_ill;
9595 		}
9596 	}
9597 
9598 	/*
9599 	 * Redo 1. If we did not find an IRE_CACHE the first time, we should
9600 	 * have an ip6i_t with IP6I_ATTACH_IF if IPV6_BOUND_PIF or
9601 	 * bind to the IPIF_NOFAILOVER address was used on this endpoint.
9602 	 */
9603 	if (ip6i != NULL && (ip6i->ip6i_flags & IP6I_ATTACH_IF)) {
9604 		ASSERT(ip6i->ip6i_ifindex != 0);
9605 		attach_if = B_TRUE;
9606 		ASSERT(ill != NULL);
9607 		match_flags = MATCH_IRE_ILL;
9608 
9609 		/*
9610 		 * Check if we need an ire that will not be
9611 		 * looked up by anybody else i.e. HIDDEN.
9612 		 */
9613 		if (ill_is_probeonly(ill))
9614 			match_flags |= MATCH_IRE_MARK_HIDDEN;
9615 		goto send_from_ill;
9616 	}
9617 
9618 	/* 3. If an ip6i_t with IP6I_IFINDEX set then use that ill. */
9619 	if (ip6i != NULL && (ip6i->ip6i_flags & IP6I_IFINDEX)) {
9620 		ASSERT(ill != NULL);
9621 		goto send_from_ill;
9622 	}
9623 
9624 	/*
9625 	 * 4. If q is an ill queue and (link local or multicast destination)
9626 	 *    then use that ill.
9627 	 */
9628 	if (ill != NULL && IN6_IS_ADDR_LINKLOCAL(v6dstp)) {
9629 		goto send_from_ill;
9630 	}
9631 
9632 	/* 5. If IPV6_BOUND_IF has been set use that ill. */
9633 	if (connp != NULL && connp->conn_outgoing_ill != NULL) {
9634 		ill_t	*conn_outgoing_ill;
9635 
9636 		conn_outgoing_ill = conn_get_held_ill(connp,
9637 		    &connp->conn_outgoing_ill, &err);
9638 		if (err == ILL_LOOKUP_FAILED) {
9639 			if (ill != NULL)
9640 				ill_refrele(ill);
9641 			if (need_decref)
9642 				CONN_DEC_REF(connp);
9643 			freemsg(first_mp);
9644 			return;
9645 		}
9646 		if (ill != NULL)
9647 			ill_refrele(ill);
9648 		ill = conn_outgoing_ill;
9649 		mibptr = ill->ill_ip6_mib;
9650 		goto send_from_ill;
9651 	}
9652 
9653 	/*
9654 	 * 6. For unicast: Just do an IRE lookup for the best match.
9655 	 * If we get here for a link-local address it is rather random
9656 	 * what interface we pick on a multihomed host.
9657 	 * *If* there is an IRE_CACHE (and the link-local address
9658 	 * isn't duplicated on multi links) this will find the IRE_CACHE.
9659 	 * Otherwise it will use one of the matching IRE_INTERFACE routes
9660 	 * for the link-local prefix. Hence, applications
9661 	 * *should* be encouraged to specify an outgoing interface when sending
9662 	 * to a link local address.
9663 	 */
9664 	if (connp == NULL || (IP_FLOW_CONTROLLED_ULP(connp->conn_ulp) &&
9665 	    !connp->conn_fully_bound)) {
9666 		/*
9667 		 * We cache IRE_CACHEs to avoid lookups. We don't do
9668 		 * this for the tcp global queue and listen end point
9669 		 * as it does not really have a real destination to
9670 		 * talk to.
9671 		 */
9672 		ire = ire_cache_lookup_v6(v6dstp, zoneid, MBLK_GETLABEL(mp));
9673 	} else {
9674 		/*
9675 		 * IRE_MARK_CONDEMNED is marked in ire_delete. We don't
9676 		 * grab a lock here to check for CONDEMNED as it is okay
9677 		 * to send a packet or two with the IRE_CACHE that is going
9678 		 * away.
9679 		 */
9680 		mutex_enter(&connp->conn_lock);
9681 		ire = sctp_ire != NULL ? sctp_ire : connp->conn_ire_cache;
9682 		if (ire != NULL &&
9683 		    IN6_ARE_ADDR_EQUAL(&ire->ire_addr_v6, v6dstp) &&
9684 		    !(ire->ire_marks & IRE_MARK_CONDEMNED)) {
9685 
9686 			IRE_REFHOLD(ire);
9687 			mutex_exit(&connp->conn_lock);
9688 
9689 		} else {
9690 			boolean_t cached = B_FALSE;
9691 
9692 			connp->conn_ire_cache = NULL;
9693 			mutex_exit(&connp->conn_lock);
9694 			/* Release the old ire */
9695 			if (ire != NULL && sctp_ire == NULL)
9696 				IRE_REFRELE_NOTR(ire);
9697 
9698 			ire = ire_cache_lookup_v6(v6dstp, zoneid,
9699 			    MBLK_GETLABEL(mp));
9700 			if (ire != NULL) {
9701 				IRE_REFHOLD_NOTR(ire);
9702 
9703 				mutex_enter(&connp->conn_lock);
9704 				if (!(connp->conn_state_flags & CONN_CLOSING) &&
9705 				    (connp->conn_ire_cache == NULL)) {
9706 					rw_enter(&ire->ire_bucket->irb_lock,
9707 					    RW_READER);
9708 					if (!(ire->ire_marks &
9709 					    IRE_MARK_CONDEMNED)) {
9710 						connp->conn_ire_cache = ire;
9711 						cached = B_TRUE;
9712 					}
9713 					rw_exit(&ire->ire_bucket->irb_lock);
9714 				}
9715 				mutex_exit(&connp->conn_lock);
9716 
9717 				/*
9718 				 * We can continue to use the ire but since it
9719 				 * was not cached, we should drop the extra
9720 				 * reference.
9721 				 */
9722 				if (!cached)
9723 					IRE_REFRELE_NOTR(ire);
9724 			}
9725 		}
9726 	}
9727 
9728 	if (ire != NULL) {
9729 		if (do_outrequests) {
9730 			/* Handle IRE_LOCAL's that might appear here */
9731 			if (ire->ire_type == IRE_CACHE) {
9732 				mibptr = ((ill_t *)ire->ire_stq->q_ptr)->
9733 				    ill_ip6_mib;
9734 			} else {
9735 				mibptr = ire->ire_ipif->ipif_ill->ill_ip6_mib;
9736 			}
9737 			BUMP_MIB(mibptr, ipv6OutRequests);
9738 		}
9739 		ASSERT(!attach_if);
9740 
9741 		/*
9742 		 * Check if the ire has the RTF_MULTIRT flag, inherited
9743 		 * from an IRE_OFFSUBNET ire entry in ip_newroute().
9744 		 */
9745 		if (ire->ire_flags & RTF_MULTIRT) {
9746 			/*
9747 			 * Force hop limit of multirouted packets if required.
9748 			 * The hop limit of such packets is bounded by the
9749 			 * ip_multirt_ttl ndd variable.
9750 			 * NDP packets must have a hop limit of 255; don't
9751 			 * change the hop limit in that case.
9752 			 */
9753 			if ((ip_multirt_ttl > 0) &&
9754 			    (ip6h->ip6_hops > ip_multirt_ttl) &&
9755 			    (ip6h->ip6_hops != IPV6_MAX_HOPS)) {
9756 				if (ip_debug > 3) {
9757 					ip2dbg(("ip_wput_v6: forcing multirt "
9758 					    "hop limit to %d (was %d) ",
9759 					    ip_multirt_ttl, ip6h->ip6_hops));
9760 					pr_addr_dbg("v6dst %s\n", AF_INET6,
9761 					    &ire->ire_addr_v6);
9762 				}
9763 				ip6h->ip6_hops = ip_multirt_ttl;
9764 			}
9765 
9766 			/*
9767 			 * We look at this point if there are pending
9768 			 * unresolved routes. ire_multirt_need_resolve_v6()
9769 			 * checks in O(n) that all IRE_OFFSUBNET ire
9770 			 * entries for the packet's destination and
9771 			 * flagged RTF_MULTIRT are currently resolved.
9772 			 * If some remain unresolved, we do a copy
9773 			 * of the current message. It will be used
9774 			 * to initiate additional route resolutions.
9775 			 */
9776 			multirt_need_resolve =
9777 			    ire_multirt_need_resolve_v6(&ire->ire_addr_v6,
9778 				MBLK_GETLABEL(first_mp));
9779 			ip2dbg(("ip_wput_v6: ire %p, "
9780 			    "multirt_need_resolve %d, first_mp %p\n",
9781 			    (void *)ire, multirt_need_resolve,
9782 			    (void *)first_mp));
9783 			if (multirt_need_resolve) {
9784 				copy_mp = copymsg(first_mp);
9785 				if (copy_mp != NULL) {
9786 					MULTIRT_DEBUG_TAG(copy_mp);
9787 				}
9788 			}
9789 		}
9790 		ip_wput_ire_v6(q, first_mp, ire, unspec_src, cksum_request,
9791 		    connp, caller, 0, ip6i_flags);
9792 		if (need_decref) {
9793 			CONN_DEC_REF(connp);
9794 			connp = NULL;
9795 		}
9796 		IRE_REFRELE(ire);
9797 
9798 		/*
9799 		 * Try to resolve another multiroute if
9800 		 * ire_multirt_need_resolve_v6() deemed it necessary.
9801 		 * copy_mp will be consumed (sent or freed) by
9802 		 * ip_newroute_v6().
9803 		 */
9804 		if (copy_mp != NULL) {
9805 			if (mctl_present) {
9806 				ip6h = (ip6_t *)copy_mp->b_cont->b_rptr;
9807 			} else {
9808 				ip6h = (ip6_t *)copy_mp->b_rptr;
9809 			}
9810 			ip_newroute_v6(q, copy_mp, &ip6h->ip6_dst,
9811 			    &ip6h->ip6_src, NULL, zoneid);
9812 		}
9813 		if (ill != NULL)
9814 			ill_refrele(ill);
9815 		return;
9816 	}
9817 
9818 	/*
9819 	 * No full IRE for this destination.  Send it to
9820 	 * ip_newroute_v6 to see if anything else matches.
9821 	 * Mark this packet as having originated on this
9822 	 * machine.
9823 	 * Update rptr if there was an ip6i_t header.
9824 	 */
9825 	mp->b_prev = NULL;
9826 	mp->b_next = NULL;
9827 	if (ip6i != NULL)
9828 		mp->b_rptr -= sizeof (ip6i_t);
9829 
9830 	if (unspec_src) {
9831 		if (ip6i == NULL) {
9832 			/*
9833 			 * Add ip6i_t header to carry unspec_src
9834 			 * until the packet comes back in ip_wput_v6.
9835 			 */
9836 			mp = ip_add_info_v6(mp, NULL, v6dstp);
9837 			if (mp == NULL) {
9838 				if (do_outrequests)
9839 					BUMP_MIB(mibptr, ipv6OutRequests);
9840 				BUMP_MIB(mibptr, ipv6OutDiscards);
9841 				if (mctl_present)
9842 					freeb(first_mp);
9843 				if (ill != NULL)
9844 					ill_refrele(ill);
9845 				if (need_decref)
9846 					CONN_DEC_REF(connp);
9847 				return;
9848 			}
9849 			ip6i = (ip6i_t *)mp->b_rptr;
9850 
9851 			if (mctl_present) {
9852 				ASSERT(first_mp != mp);
9853 				first_mp->b_cont = mp;
9854 			} else {
9855 				first_mp = mp;
9856 			}
9857 
9858 			if ((mp->b_wptr - (uchar_t *)ip6i) ==
9859 			    sizeof (ip6i_t)) {
9860 				/*
9861 				 * ndp_resolver called from ip_newroute_v6
9862 				 * expects pulled up message.
9863 				 */
9864 				if (!pullupmsg(mp, -1)) {
9865 					ip1dbg(("ip_wput_v6: pullupmsg"
9866 					    " failed\n"));
9867 					if (do_outrequests) {
9868 						BUMP_MIB(mibptr,
9869 						    ipv6OutRequests);
9870 					}
9871 					BUMP_MIB(mibptr, ipv6OutDiscards);
9872 					freemsg(first_mp);
9873 					if (ill != NULL)
9874 						ill_refrele(ill);
9875 					if (need_decref)
9876 						CONN_DEC_REF(connp);
9877 					return;
9878 				}
9879 				ip6i = (ip6i_t *)mp->b_rptr;
9880 			}
9881 			ip6h = (ip6_t *)&ip6i[1];
9882 			v6dstp = &ip6h->ip6_dst;
9883 		}
9884 		ip6i->ip6i_flags |= IP6I_UNSPEC_SRC;
9885 		if (mctl_present) {
9886 			ASSERT(io != NULL);
9887 			io->ipsec_out_unspec_src = unspec_src;
9888 		}
9889 	}
9890 	if (do_outrequests)
9891 		BUMP_MIB(mibptr, ipv6OutRequests);
9892 	if (need_decref)
9893 		CONN_DEC_REF(connp);
9894 	ip_newroute_v6(q, first_mp, v6dstp, &ip6h->ip6_src, NULL, zoneid);
9895 	if (ill != NULL)
9896 		ill_refrele(ill);
9897 	return;
9898 
9899 
9900 	/*
9901 	 * Handle multicast packets with or without an conn.
9902 	 * Assumes that the transports set ip6_hops taking
9903 	 * IPV6_MULTICAST_HOPS (and the other ways to set the hoplimit)
9904 	 * into account.
9905 	 */
9906 ipv6multicast:
9907 	ip2dbg(("ip_wput_v6: multicast\n"));
9908 
9909 	/*
9910 	 * 1. IPV6_BOUND_PIF takes precedence over all the ifindex settings
9911 	 * 2. If conn_nofailover_ill is set then use that ill.
9912 	 *
9913 	 * Hold the conn_lock till we refhold the ill of interest that is
9914 	 * pointed to from the conn. Since we cannot do an ill/ipif_refrele
9915 	 * while holding any locks, postpone the refrele until after the
9916 	 * conn_lock is dropped.
9917 	 */
9918 	if (connp != NULL) {
9919 		mutex_enter(&connp->conn_lock);
9920 		conn_lock_held = B_TRUE;
9921 	} else {
9922 		conn_lock_held = B_FALSE;
9923 	}
9924 	if (connp != NULL && connp->conn_outgoing_pill != NULL) {
9925 		err = ill_check_and_refhold(connp->conn_outgoing_pill);
9926 		if (err == ILL_LOOKUP_FAILED) {
9927 			ip1dbg(("ip_output_v6: multicast"
9928 			    " conn_outgoing_pill no ipif\n"));
9929 multicast_discard:
9930 			ASSERT(saved_ill == NULL);
9931 			if (conn_lock_held)
9932 				mutex_exit(&connp->conn_lock);
9933 			if (ill != NULL)
9934 				ill_refrele(ill);
9935 			freemsg(first_mp);
9936 			if (do_outrequests)
9937 				BUMP_MIB(mibptr, ipv6OutDiscards);
9938 			if (need_decref)
9939 				CONN_DEC_REF(connp);
9940 			return;
9941 		}
9942 		saved_ill = ill;
9943 		ill = connp->conn_outgoing_pill;
9944 		attach_if = B_TRUE;
9945 		match_flags = MATCH_IRE_ILL;
9946 		mibptr = ill->ill_ip6_mib;
9947 
9948 		/*
9949 		 * Check if we need an ire that will not be
9950 		 * looked up by anybody else i.e. HIDDEN.
9951 		 */
9952 		if (ill_is_probeonly(ill))
9953 			match_flags |= MATCH_IRE_MARK_HIDDEN;
9954 	} else if (connp != NULL && connp->conn_nofailover_ill != NULL) {
9955 		err = ill_check_and_refhold(connp->conn_nofailover_ill);
9956 		if (err == ILL_LOOKUP_FAILED) {
9957 			ip1dbg(("ip_output_v6: multicast"
9958 			    " conn_nofailover_ill no ipif\n"));
9959 			goto multicast_discard;
9960 		}
9961 		saved_ill = ill;
9962 		ill = connp->conn_nofailover_ill;
9963 		attach_if = B_TRUE;
9964 		match_flags = MATCH_IRE_ILL;
9965 
9966 		/*
9967 		 * Check if we need an ire that will not be
9968 		 * looked up by anybody else i.e. HIDDEN.
9969 		 */
9970 		if (ill_is_probeonly(ill))
9971 			match_flags |= MATCH_IRE_MARK_HIDDEN;
9972 	} else if (ip6i != NULL && (ip6i->ip6i_flags & IP6I_ATTACH_IF)) {
9973 		/*
9974 		 * Redo 1. If we did not find an IRE_CACHE the first time,
9975 		 * we should have an ip6i_t with IP6I_ATTACH_IF if
9976 		 * IPV6_BOUND_PIF or bind to the IPIF_NOFAILOVER address was
9977 		 * used on this endpoint.
9978 		 */
9979 		ASSERT(ip6i->ip6i_ifindex != 0);
9980 		attach_if = B_TRUE;
9981 		ASSERT(ill != NULL);
9982 		match_flags = MATCH_IRE_ILL;
9983 
9984 		/*
9985 		 * Check if we need an ire that will not be
9986 		 * looked up by anybody else i.e. HIDDEN.
9987 		 */
9988 		if (ill_is_probeonly(ill))
9989 			match_flags |= MATCH_IRE_MARK_HIDDEN;
9990 	} else if (ip6i != NULL && (ip6i->ip6i_flags & IP6I_IFINDEX)) {
9991 		/* 3. If an ip6i_t with IP6I_IFINDEX set then use that ill. */
9992 
9993 		ASSERT(ill != NULL);
9994 	} else if (ill != NULL) {
9995 		/*
9996 		 * 4. If q is an ill queue and (link local or multicast
9997 		 * destination) then use that ill.
9998 		 * We don't need the ipif initialization here.
9999 		 * This useless assert below is just to prevent lint from
10000 		 * reporting a null body if statement.
10001 		 */
10002 		ASSERT(ill != NULL);
10003 	} else if (connp != NULL) {
10004 		/*
10005 		 * 5. If IPV6_BOUND_IF has been set use that ill.
10006 		 *
10007 		 * 6. For multicast: if IPV6_MULTICAST_IF has been set use it.
10008 		 * Otherwise look for the best IRE match for the unspecified
10009 		 * group to determine the ill.
10010 		 *
10011 		 * conn_multicast_ill is used for only IPv6 packets.
10012 		 * conn_multicast_ipif is used for only IPv4 packets.
10013 		 * Thus a PF_INET6 socket send both IPv4 and IPv6
10014 		 * multicast packets using different IP*_MULTICAST_IF
10015 		 * interfaces.
10016 		 */
10017 		if (connp->conn_outgoing_ill != NULL) {
10018 			err = ill_check_and_refhold(connp->conn_outgoing_ill);
10019 			if (err == ILL_LOOKUP_FAILED) {
10020 				ip1dbg(("ip_output_v6: multicast"
10021 				    " conn_outgoing_ill no ipif\n"));
10022 				goto multicast_discard;
10023 			}
10024 			ill = connp->conn_outgoing_ill;
10025 		} else if (connp->conn_multicast_ill != NULL) {
10026 			err = ill_check_and_refhold(connp->conn_multicast_ill);
10027 			if (err == ILL_LOOKUP_FAILED) {
10028 				ip1dbg(("ip_output_v6: multicast"
10029 				    " conn_multicast_ill no ipif\n"));
10030 				goto multicast_discard;
10031 			}
10032 			ill = connp->conn_multicast_ill;
10033 		} else {
10034 			mutex_exit(&connp->conn_lock);
10035 			conn_lock_held = B_FALSE;
10036 			ipif = ipif_lookup_group_v6(v6dstp, zoneid);
10037 			if (ipif == NULL) {
10038 				ip1dbg(("ip_output_v6: multicast no ipif\n"));
10039 				goto multicast_discard;
10040 			}
10041 			/*
10042 			 * We have a ref to this ipif, so we can safely
10043 			 * access ipif_ill.
10044 			 */
10045 			ill = ipif->ipif_ill;
10046 			mutex_enter(&ill->ill_lock);
10047 			if (!ILL_CAN_LOOKUP(ill)) {
10048 				mutex_exit(&ill->ill_lock);
10049 				ipif_refrele(ipif);
10050 				ill = NULL;
10051 				ip1dbg(("ip_output_v6: multicast no ipif\n"));
10052 				goto multicast_discard;
10053 			}
10054 			ill_refhold_locked(ill);
10055 			mutex_exit(&ill->ill_lock);
10056 			ipif_refrele(ipif);
10057 			/*
10058 			 * Save binding until IPV6_MULTICAST_IF
10059 			 * changes it
10060 			 */
10061 			mutex_enter(&connp->conn_lock);
10062 			connp->conn_multicast_ill = ill;
10063 			connp->conn_orig_multicast_ifindex =
10064 			    ill->ill_phyint->phyint_ifindex;
10065 			mutex_exit(&connp->conn_lock);
10066 		}
10067 	}
10068 	if (conn_lock_held)
10069 		mutex_exit(&connp->conn_lock);
10070 
10071 	if (saved_ill != NULL)
10072 		ill_refrele(saved_ill);
10073 
10074 	ASSERT(ill != NULL);
10075 	/*
10076 	 * For multicast loopback interfaces replace the multicast address
10077 	 * with a unicast address for the ire lookup.
10078 	 */
10079 	if (ill->ill_phyint->phyint_flags & PHYI_LOOPBACK)
10080 		v6dstp = &ill->ill_ipif->ipif_v6lcl_addr;
10081 
10082 	mibptr = ill->ill_ip6_mib;
10083 	if (do_outrequests) {
10084 		BUMP_MIB(mibptr, ipv6OutRequests);
10085 		do_outrequests = B_FALSE;
10086 	}
10087 	BUMP_MIB(mibptr, ipv6OutMcastPkts);
10088 
10089 	/*
10090 	 * As we may lose the conn by the time we reach ip_wput_ire_v6
10091 	 * we copy conn_multicast_loop and conn_dontroute on to an
10092 	 * ipsec_out. In case if this datagram goes out secure,
10093 	 * we need the ill_index also. Copy that also into the
10094 	 * ipsec_out.
10095 	 */
10096 	if (mctl_present) {
10097 		io = (ipsec_out_t *)first_mp->b_rptr;
10098 		ASSERT(first_mp->b_datap->db_type == M_CTL);
10099 		ASSERT(io->ipsec_out_type == IPSEC_OUT);
10100 	} else {
10101 		ASSERT(mp == first_mp);
10102 		if ((first_mp = ipsec_alloc_ipsec_out()) == NULL) {
10103 			BUMP_MIB(mibptr, ipv6OutDiscards);
10104 			freemsg(mp);
10105 			if (ill != NULL)
10106 				ill_refrele(ill);
10107 			if (need_decref)
10108 				CONN_DEC_REF(connp);
10109 			return;
10110 		}
10111 		io = (ipsec_out_t *)first_mp->b_rptr;
10112 		/* This is not a secure packet */
10113 		io->ipsec_out_secure = B_FALSE;
10114 		io->ipsec_out_use_global_policy = B_TRUE;
10115 		io->ipsec_out_zoneid =
10116 		    (zoneid != ALL_ZONES ? zoneid : GLOBAL_ZONEID);
10117 		first_mp->b_cont = mp;
10118 		mctl_present = B_TRUE;
10119 	}
10120 	io->ipsec_out_ill_index = ill->ill_phyint->phyint_ifindex;
10121 	io->ipsec_out_unspec_src = unspec_src;
10122 	if (connp != NULL)
10123 		io->ipsec_out_dontroute = connp->conn_dontroute;
10124 
10125 send_from_ill:
10126 	ASSERT(ill != NULL);
10127 	ASSERT(mibptr == ill->ill_ip6_mib);
10128 	if (do_outrequests) {
10129 		BUMP_MIB(mibptr, ipv6OutRequests);
10130 		do_outrequests = B_FALSE;
10131 	}
10132 
10133 	if (io != NULL)
10134 		io->ipsec_out_ill_index = ill->ill_phyint->phyint_ifindex;
10135 
10136 	/*
10137 	 * When a specific ill is specified (using IPV6_PKTINFO,
10138 	 * IPV6_MULTICAST_IF, or IPV6_BOUND_IF) we will only match
10139 	 * on routing entries (ftable and ctable) that have a matching
10140 	 * ire->ire_ipif->ipif_ill. Thus this can only be used
10141 	 * for destinations that are on-link for the specific ill
10142 	 * and that can appear on multiple links. Thus it is useful
10143 	 * for multicast destinations, link-local destinations, and
10144 	 * at some point perhaps for site-local destinations (if the
10145 	 * node sits at a site boundary).
10146 	 * We create the cache entries in the regular ctable since
10147 	 * it can not "confuse" things for other destinations.
10148 	 * table.
10149 	 *
10150 	 * NOTE : conn_ire_cache is not used for caching ire_ctable_lookups.
10151 	 *	  It is used only when ire_cache_lookup is used above.
10152 	 */
10153 	ire = ire_ctable_lookup_v6(v6dstp, 0, 0, ill->ill_ipif,
10154 	    zoneid, MBLK_GETLABEL(mp), match_flags);
10155 	if (ire != NULL) {
10156 		/*
10157 		 * Check if the ire has the RTF_MULTIRT flag, inherited
10158 		 * from an IRE_OFFSUBNET ire entry in ip_newroute().
10159 		 */
10160 		if (ire->ire_flags & RTF_MULTIRT) {
10161 			/*
10162 			 * Force hop limit of multirouted packets if required.
10163 			 * The hop limit of such packets is bounded by the
10164 			 * ip_multirt_ttl ndd variable.
10165 			 * NDP packets must have a hop limit of 255; don't
10166 			 * change the hop limit in that case.
10167 			 */
10168 			if ((ip_multirt_ttl > 0) &&
10169 			    (ip6h->ip6_hops > ip_multirt_ttl) &&
10170 			    (ip6h->ip6_hops != IPV6_MAX_HOPS)) {
10171 				if (ip_debug > 3) {
10172 					ip2dbg(("ip_wput_v6: forcing multirt "
10173 					    "hop limit to %d (was %d) ",
10174 					    ip_multirt_ttl, ip6h->ip6_hops));
10175 					pr_addr_dbg("v6dst %s\n", AF_INET6,
10176 					    &ire->ire_addr_v6);
10177 				}
10178 				ip6h->ip6_hops = ip_multirt_ttl;
10179 			}
10180 
10181 			/*
10182 			 * We look at this point if there are pending
10183 			 * unresolved routes. ire_multirt_need_resolve_v6()
10184 			 * checks in O(n) that all IRE_OFFSUBNET ire
10185 			 * entries for the packet's destination and
10186 			 * flagged RTF_MULTIRT are currently resolved.
10187 			 * If some remain unresolved, we make a copy
10188 			 * of the current message. It will be used
10189 			 * to initiate additional route resolutions.
10190 			 */
10191 			multirt_need_resolve =
10192 			    ire_multirt_need_resolve_v6(&ire->ire_addr_v6,
10193 				MBLK_GETLABEL(first_mp));
10194 			ip2dbg(("ip_wput_v6[send_from_ill]: ire %p, "
10195 			    "multirt_need_resolve %d, first_mp %p\n",
10196 			    (void *)ire, multirt_need_resolve,
10197 			    (void *)first_mp));
10198 			if (multirt_need_resolve) {
10199 				copy_mp = copymsg(first_mp);
10200 				if (copy_mp != NULL) {
10201 					MULTIRT_DEBUG_TAG(copy_mp);
10202 				}
10203 			}
10204 		}
10205 
10206 		ip1dbg(("ip_wput_v6: send on %s, ire = %p, ill index = %d\n",
10207 		    ill->ill_name, (void *)ire,
10208 		    ill->ill_phyint->phyint_ifindex));
10209 		ip_wput_ire_v6(q, first_mp, ire, unspec_src, cksum_request,
10210 		    connp, caller,
10211 		    (attach_if ? ill->ill_phyint->phyint_ifindex : 0),
10212 		    ip6i_flags);
10213 		ire_refrele(ire);
10214 		if (need_decref) {
10215 			CONN_DEC_REF(connp);
10216 			connp = NULL;
10217 		}
10218 
10219 		/*
10220 		 * Try to resolve another multiroute if
10221 		 * ire_multirt_need_resolve_v6() deemed it necessary.
10222 		 * copy_mp will be consumed (sent or freed) by
10223 		 * ip_newroute_[ipif_]v6().
10224 		 */
10225 		if (copy_mp != NULL) {
10226 			if (mctl_present) {
10227 				ip6h = (ip6_t *)copy_mp->b_cont->b_rptr;
10228 			} else {
10229 				ip6h = (ip6_t *)copy_mp->b_rptr;
10230 			}
10231 			if (IN6_IS_ADDR_MULTICAST(&ip6h->ip6_dst)) {
10232 				ipif = ipif_lookup_group_v6(&ip6h->ip6_dst,
10233 				    zoneid);
10234 				if (ipif == NULL) {
10235 					ip1dbg(("ip_wput_v6: No ipif for "
10236 					    "multicast\n"));
10237 					MULTIRT_DEBUG_UNTAG(copy_mp);
10238 					freemsg(copy_mp);
10239 					return;
10240 				}
10241 				ip_newroute_ipif_v6(q, copy_mp, ipif,
10242 				    ip6h->ip6_dst, unspec_src, zoneid);
10243 				ipif_refrele(ipif);
10244 			} else {
10245 				ip_newroute_v6(q, copy_mp, &ip6h->ip6_dst,
10246 				    &ip6h->ip6_src, ill, zoneid);
10247 			}
10248 		}
10249 		if (ill != NULL)
10250 			ill_refrele(ill);
10251 		return;
10252 	}
10253 	if (need_decref) {
10254 		CONN_DEC_REF(connp);
10255 		connp = NULL;
10256 	}
10257 
10258 	/* Update rptr if there was an ip6i_t header. */
10259 	if (ip6i != NULL)
10260 		mp->b_rptr -= sizeof (ip6i_t);
10261 	if (unspec_src || attach_if) {
10262 		if (ip6i == NULL) {
10263 			/*
10264 			 * Add ip6i_t header to carry unspec_src
10265 			 * or attach_if until the packet comes back in
10266 			 * ip_wput_v6.
10267 			 */
10268 			if (mctl_present) {
10269 				first_mp->b_cont =
10270 				    ip_add_info_v6(mp, NULL, v6dstp);
10271 				mp = first_mp->b_cont;
10272 				if (mp == NULL)
10273 					freeb(first_mp);
10274 			} else {
10275 				first_mp = mp = ip_add_info_v6(mp, NULL,
10276 				    v6dstp);
10277 			}
10278 			if (mp == NULL) {
10279 				BUMP_MIB(mibptr, ipv6OutDiscards);
10280 				if (ill != NULL)
10281 					ill_refrele(ill);
10282 				return;
10283 			}
10284 			ip6i = (ip6i_t *)mp->b_rptr;
10285 			if ((mp->b_wptr - (uchar_t *)ip6i) ==
10286 			    sizeof (ip6i_t)) {
10287 				/*
10288 				 * ndp_resolver called from ip_newroute_v6
10289 				 * expects a pulled up message.
10290 				 */
10291 				if (!pullupmsg(mp, -1)) {
10292 					ip1dbg(("ip_wput_v6: pullupmsg"
10293 					    " failed\n"));
10294 					BUMP_MIB(mibptr, ipv6OutDiscards);
10295 					freemsg(first_mp);
10296 					return;
10297 				}
10298 				ip6i = (ip6i_t *)mp->b_rptr;
10299 			}
10300 			ip6h = (ip6_t *)&ip6i[1];
10301 			v6dstp = &ip6h->ip6_dst;
10302 		}
10303 		if (unspec_src)
10304 			ip6i->ip6i_flags |= IP6I_UNSPEC_SRC;
10305 		if (attach_if) {
10306 			/*
10307 			 * Bind to nofailover/BOUND_PIF overrides ifindex.
10308 			 */
10309 			ip6i->ip6i_flags |= IP6I_ATTACH_IF;
10310 			ip6i->ip6i_flags &= ~IP6I_IFINDEX;
10311 			ip6i->ip6i_ifindex = ill->ill_phyint->phyint_ifindex;
10312 			if (drop_if_delayed) {
10313 				/* This is a multipathing probe packet */
10314 				ip6i->ip6i_flags |= IP6I_DROP_IFDELAYED;
10315 			}
10316 		}
10317 		if (mctl_present) {
10318 			ASSERT(io != NULL);
10319 			io->ipsec_out_unspec_src = unspec_src;
10320 		}
10321 	}
10322 	if (IN6_IS_ADDR_MULTICAST(v6dstp)) {
10323 		ip_newroute_ipif_v6(q, first_mp, ill->ill_ipif, *v6dstp,
10324 		    unspec_src, zoneid);
10325 	} else {
10326 		ip_newroute_v6(q, first_mp, v6dstp, &ip6h->ip6_src, ill,
10327 		    zoneid);
10328 	}
10329 	if (ill != NULL)
10330 		ill_refrele(ill);
10331 	return;
10332 
10333 notv6:
10334 	/*
10335 	 * XXX implement a IPv4 and IPv6 packet counter per conn and
10336 	 * switch when ratio exceeds e.g. 10:1
10337 	 */
10338 	if (q->q_next == NULL) {
10339 		connp = Q_TO_CONN(q);
10340 
10341 		if (IPCL_IS_TCP(connp)) {
10342 			/* change conn_send for the tcp_v4_connections */
10343 			connp->conn_send = ip_output;
10344 		} else if (connp->conn_ulp == IPPROTO_SCTP) {
10345 			/* The 'q' is the default SCTP queue */
10346 			connp = (conn_t *)arg;
10347 		} else {
10348 			ip_setqinfo(RD(q), IPV4_MINOR, B_TRUE);
10349 		}
10350 	}
10351 	BUMP_MIB(mibptr, ipv6OutIPv4);
10352 	(void) ip_output(connp, first_mp, q, caller);
10353 	if (ill != NULL)
10354 		ill_refrele(ill);
10355 }
10356 
10357 static void
10358 ip_wput_v6(queue_t *q, mblk_t *mp)
10359 {
10360 	ip_output_v6(Q_TO_CONN(q), mp, q, IP_WPUT);
10361 }
10362 
10363 static void
10364 ipsec_out_attach_if(ipsec_out_t *io, int attach_index)
10365 {
10366 	ASSERT(io->ipsec_out_type == IPSEC_OUT);
10367 	io->ipsec_out_attach_if = B_TRUE;
10368 	io->ipsec_out_ill_index = attach_index;
10369 }
10370 
10371 /*
10372  * NULL send-to queue - packet is to be delivered locally.
10373  */
10374 void
10375 ip_wput_local_v6(queue_t *q, ill_t *ill, ip6_t *ip6h, mblk_t *first_mp,
10376     ire_t *ire, int fanout_flags)
10377 {
10378 	uint32_t	ports;
10379 	mblk_t		*mp = first_mp, *first_mp1;
10380 	boolean_t	mctl_present;
10381 	uint8_t		nexthdr;
10382 	uint16_t	hdr_length;
10383 	ipsec_out_t	*io;
10384 	mib2_ipv6IfStatsEntry_t	*mibptr;
10385 	ilm_t		*ilm;
10386 	uint_t	nexthdr_offset;
10387 
10388 	if (DB_TYPE(mp) == M_CTL) {
10389 		io = (ipsec_out_t *)mp->b_rptr;
10390 		if (!io->ipsec_out_secure) {
10391 			mp = mp->b_cont;
10392 			freeb(first_mp);
10393 			first_mp = mp;
10394 			mctl_present = B_FALSE;
10395 		} else {
10396 			mctl_present = B_TRUE;
10397 			mp = first_mp->b_cont;
10398 			ipsec_out_to_in(first_mp);
10399 		}
10400 	} else {
10401 		mctl_present = B_FALSE;
10402 	}
10403 
10404 	nexthdr = ip6h->ip6_nxt;
10405 	mibptr = ill->ill_ip6_mib;
10406 
10407 	/* Fastpath */
10408 	switch (nexthdr) {
10409 	case IPPROTO_TCP:
10410 	case IPPROTO_UDP:
10411 	case IPPROTO_ICMPV6:
10412 	case IPPROTO_SCTP:
10413 		hdr_length = IPV6_HDR_LEN;
10414 		nexthdr_offset = (uint_t)((uchar_t *)&ip6h->ip6_nxt -
10415 		    (uchar_t *)ip6h);
10416 		break;
10417 	default: {
10418 		uint8_t	*nexthdrp;
10419 
10420 		if (!ip_hdr_length_nexthdr_v6(mp, ip6h,
10421 		    &hdr_length, &nexthdrp)) {
10422 			/* Malformed packet */
10423 			BUMP_MIB(mibptr, ipv6OutDiscards);
10424 			freemsg(first_mp);
10425 			return;
10426 		}
10427 		nexthdr = *nexthdrp;
10428 		nexthdr_offset = nexthdrp - (uint8_t *)ip6h;
10429 		break;
10430 	}
10431 	}
10432 
10433 
10434 	UPDATE_OB_PKT_COUNT(ire);
10435 	ire->ire_last_used_time = lbolt;
10436 
10437 	/*
10438 	 * Remove reacability confirmation bit from version field
10439 	 * before looping back the packet.
10440 	 */
10441 	if (ip6h->ip6_vcf & IP_FORWARD_PROG) {
10442 		ip6h->ip6_vcf &= ~IP_FORWARD_PROG;
10443 	}
10444 
10445 	switch (nexthdr) {
10446 		case IPPROTO_TCP:
10447 			if (DB_TYPE(mp) == M_DATA) {
10448 				/*
10449 				 * M_DATA mblk, so init mblk (chain) for
10450 				 * no struio().
10451 				 */
10452 				mblk_t  *mp1 = mp;
10453 
10454 				do {
10455 					mp1->b_datap->db_struioflag = 0;
10456 				} while ((mp1 = mp1->b_cont) != NULL);
10457 			}
10458 			ports = *(uint32_t *)(mp->b_rptr + hdr_length +
10459 			    TCP_PORTS_OFFSET);
10460 			ip_fanout_tcp_v6(q, first_mp, ip6h, ill, ill,
10461 			    fanout_flags|IP_FF_SEND_ICMP|IP_FF_SYN_ADDIRE|
10462 			    IP_FF_IP6INFO|IP6_NO_IPPOLICY|IP_FF_LOOPBACK,
10463 			    hdr_length, mctl_present, ire->ire_zoneid);
10464 			return;
10465 
10466 		case IPPROTO_UDP:
10467 			ports = *(uint32_t *)(mp->b_rptr + hdr_length +
10468 			    UDP_PORTS_OFFSET);
10469 			ip_fanout_udp_v6(q, first_mp, ip6h, ports, ill, ill,
10470 			    fanout_flags|IP_FF_SEND_ICMP|IP_FF_IP6INFO|
10471 			    IP6_NO_IPPOLICY, mctl_present, ire->ire_zoneid);
10472 			return;
10473 
10474 		case IPPROTO_SCTP:
10475 		{
10476 			uint_t	ipif_seqid = ire->ire_ipif->ipif_seqid;
10477 
10478 			ports = *(uint32_t *)(mp->b_rptr + hdr_length);
10479 			ip_fanout_sctp(mp, ill, (ipha_t *)ip6h, ports,
10480 			    fanout_flags|IP_FF_SEND_ICMP|IP_FF_IP6INFO,
10481 			    mctl_present, IP6_NO_IPPOLICY, ipif_seqid,
10482 			    ire->ire_zoneid);
10483 			return;
10484 		}
10485 		case IPPROTO_ICMPV6: {
10486 			icmp6_t *icmp6;
10487 
10488 			/* check for full IPv6+ICMPv6 header */
10489 			if ((mp->b_wptr - mp->b_rptr) <
10490 			    (hdr_length + ICMP6_MINLEN)) {
10491 				if (!pullupmsg(mp, hdr_length + ICMP6_MINLEN)) {
10492 					ip1dbg(("ip_wput_v6: ICMP hdr pullupmsg"
10493 					    " failed\n"));
10494 					BUMP_MIB(mibptr, ipv6OutDiscards);
10495 					freemsg(first_mp);
10496 					return;
10497 				}
10498 				ip6h = (ip6_t *)mp->b_rptr;
10499 			}
10500 			icmp6 = (icmp6_t *)((uchar_t *)ip6h + hdr_length);
10501 
10502 			/* Update output mib stats */
10503 			icmp_update_out_mib_v6(ill, icmp6);
10504 
10505 			/* Check variable for testing applications */
10506 			if (ipv6_drop_inbound_icmpv6) {
10507 				freemsg(first_mp);
10508 				return;
10509 			}
10510 			/*
10511 			 * Assume that there is always at least one conn for
10512 			 * ICMPv6 (in.ndpd) i.e. don't optimize the case
10513 			 * where there is no conn.
10514 			 */
10515 			if (IN6_IS_ADDR_MULTICAST(&ip6h->ip6_dst) &&
10516 			    !(ill->ill_phyint->phyint_flags & PHYI_LOOPBACK)) {
10517 				/*
10518 				 * In the multicast case, applications may have
10519 				 * joined the group from different zones, so we
10520 				 * need to deliver the packet to each of them.
10521 				 * Loop through the multicast memberships
10522 				 * structures (ilm) on the receive ill and send
10523 				 * a copy of the packet up each matching one.
10524 				 * However, we don't do this for multicasts sent
10525 				 * on the loopback interface (PHYI_LOOPBACK flag
10526 				 * set) as they must stay in the sender's zone.
10527 				 */
10528 				ILM_WALKER_HOLD(ill);
10529 				for (ilm = ill->ill_ilm; ilm != NULL;
10530 				    ilm = ilm->ilm_next) {
10531 					if (ilm->ilm_flags & ILM_DELETED)
10532 						continue;
10533 					if (!IN6_ARE_ADDR_EQUAL(
10534 					    &ilm->ilm_v6addr, &ip6h->ip6_dst))
10535 						continue;
10536 					if ((fanout_flags &
10537 					    IP_FF_NO_MCAST_LOOP) &&
10538 					    ilm->ilm_zoneid == ire->ire_zoneid)
10539 						continue;
10540 					if (!ipif_lookup_zoneid(ill,
10541 					    ilm->ilm_zoneid, IPIF_UP, NULL))
10542 						continue;
10543 
10544 					first_mp1 = ip_copymsg(first_mp);
10545 					if (first_mp1 == NULL)
10546 						continue;
10547 					icmp_inbound_v6(q, first_mp1, ill,
10548 					    hdr_length, mctl_present,
10549 					    IP6_NO_IPPOLICY, ilm->ilm_zoneid);
10550 				}
10551 				ILM_WALKER_RELE(ill);
10552 			} else {
10553 				first_mp1 = ip_copymsg(first_mp);
10554 				if (first_mp1 != NULL)
10555 					icmp_inbound_v6(q, first_mp1, ill,
10556 					    hdr_length, mctl_present,
10557 					    IP6_NO_IPPOLICY, ire->ire_zoneid);
10558 			}
10559 		}
10560 		/* FALLTHRU */
10561 		default: {
10562 			/*
10563 			 * Handle protocols with which IPv6 is less intimate.
10564 			 */
10565 			fanout_flags |= IP_FF_RAWIP|IP_FF_IP6INFO;
10566 
10567 			/*
10568 			 * Enable sending ICMP for "Unknown" nexthdr
10569 			 * case. i.e. where we did not FALLTHRU from
10570 			 * IPPROTO_ICMPV6 processing case above.
10571 			 */
10572 			if (nexthdr != IPPROTO_ICMPV6)
10573 				fanout_flags |= IP_FF_SEND_ICMP;
10574 			/*
10575 			 * Note: There can be more than one stream bound
10576 			 * to a particular protocol. When this is the case,
10577 			 * each one gets a copy of any incoming packets.
10578 			 */
10579 			ip_fanout_proto_v6(q, first_mp, ip6h, ill, ill, nexthdr,
10580 			    nexthdr_offset, fanout_flags|IP6_NO_IPPOLICY,
10581 			    mctl_present, ire->ire_zoneid);
10582 			return;
10583 		}
10584 	}
10585 }
10586 
10587 /*
10588  * Send packet using IRE.
10589  * Checksumming is controlled by cksum_request:
10590  *	-1 => normal i.e. TCP/UDP/SCTP/ICMPv6 are checksummed and nothing else.
10591  *	1 => Skip TCP/UDP/SCTP checksum
10592  * 	Otherwise => checksum_request contains insert offset for checksum
10593  *
10594  * Assumes that the following set of headers appear in the first
10595  * mblk:
10596  *	ip6_t
10597  *	Any extension headers
10598  *	TCP/UDP/SCTP header (if present)
10599  * The routine can handle an ICMPv6 header that is not in the first mblk.
10600  *
10601  * NOTE : This function does not ire_refrele the ire passed in as the
10602  *	  argument unlike ip_wput_ire where the REFRELE is done.
10603  *	  Refer to ip_wput_ire for more on this.
10604  */
10605 static void
10606 ip_wput_ire_v6(queue_t *q, mblk_t *mp, ire_t *ire, int unspec_src,
10607     int cksum_request, conn_t *connp, int caller, int attach_index, int flags)
10608 {
10609 	ip6_t		*ip6h;
10610 	uint8_t		nexthdr;
10611 	uint16_t	hdr_length;
10612 	uint_t		reachable = 0x0;
10613 	ill_t		*ill;
10614 	mib2_ipv6IfStatsEntry_t	*mibptr;
10615 	mblk_t		*first_mp;
10616 	boolean_t	mctl_present;
10617 	ipsec_out_t	*io;
10618 	boolean_t	conn_dontroute;	/* conn value for multicast */
10619 	boolean_t	conn_multicast_loop;	/* conn value for multicast */
10620 	boolean_t 	multicast_forward;	/* Should we forward ? */
10621 	int		max_frag;
10622 	zoneid_t	zoneid;
10623 
10624 	zoneid = (connp != NULL ? connp->conn_zoneid : ALL_ZONES);
10625 	ill = ire_to_ill(ire);
10626 	first_mp = mp;
10627 	multicast_forward = B_FALSE;
10628 
10629 	if (mp->b_datap->db_type != M_CTL) {
10630 		ip6h = (ip6_t *)first_mp->b_rptr;
10631 	} else {
10632 		io = (ipsec_out_t *)first_mp->b_rptr;
10633 		ASSERT(io->ipsec_out_type == IPSEC_OUT);
10634 		/*
10635 		 * Grab the zone id now because the M_CTL can be discarded by
10636 		 * ip_wput_ire_parse_ipsec_out() below.
10637 		 */
10638 		zoneid = io->ipsec_out_zoneid;
10639 		ASSERT(zoneid != ALL_ZONES);
10640 		ip6h = (ip6_t *)first_mp->b_cont->b_rptr;
10641 		/*
10642 		 * For the multicast case, ipsec_out carries conn_dontroute and
10643 		 * conn_multicast_loop as conn may not be available here. We
10644 		 * need this for multicast loopback and forwarding which is done
10645 		 * later in the code.
10646 		 */
10647 		if (IN6_IS_ADDR_MULTICAST(&ip6h->ip6_dst)) {
10648 			conn_dontroute = io->ipsec_out_dontroute;
10649 			conn_multicast_loop = io->ipsec_out_multicast_loop;
10650 			/*
10651 			 * If conn_dontroute is not set or conn_multicast_loop
10652 			 * is set, we need to do forwarding/loopback. For
10653 			 * datagrams from ip_wput_multicast, conn_dontroute is
10654 			 * set to B_TRUE and conn_multicast_loop is set to
10655 			 * B_FALSE so that we neither do forwarding nor
10656 			 * loopback.
10657 			 */
10658 			if (!conn_dontroute || conn_multicast_loop)
10659 				multicast_forward = B_TRUE;
10660 		}
10661 	}
10662 
10663 	/*
10664 	 * If the sender didn't supply the hop limit and there is a default
10665 	 * unicast hop limit associated with the output interface, we use
10666 	 * that if the packet is unicast.  Interface specific unicast hop
10667 	 * limits as set via the SIOCSLIFLNKINFO ioctl.
10668 	 */
10669 	if (ill->ill_max_hops != 0 && !(flags & IP6I_HOPLIMIT) &&
10670 	    !(IN6_IS_ADDR_MULTICAST(&ip6h->ip6_dst))) {
10671 		ip6h->ip6_hops = ill->ill_max_hops;
10672 	}
10673 
10674 	if (ire->ire_type == IRE_LOCAL && ire->ire_zoneid != zoneid &&
10675 	    ire->ire_zoneid != ALL_ZONES) {
10676 		/*
10677 		 * When a zone sends a packet to another zone, we try to deliver
10678 		 * the packet under the same conditions as if the destination
10679 		 * was a real node on the network. To do so, we look for a
10680 		 * matching route in the forwarding table.
10681 		 * RTF_REJECT and RTF_BLACKHOLE are handled just like
10682 		 * ip_newroute_v6() does.
10683 		 */
10684 		ire_t *src_ire = ire_ftable_lookup_v6(&ip6h->ip6_dst, 0, 0, 0,
10685 		    NULL, NULL, zoneid, 0, NULL, (MATCH_IRE_RECURSIVE |
10686 		    MATCH_IRE_DEFAULT | MATCH_IRE_RJ_BHOLE));
10687 		if (src_ire != NULL &&
10688 		    !(src_ire->ire_flags & (RTF_REJECT | RTF_BLACKHOLE))) {
10689 			if (IN6_IS_ADDR_UNSPECIFIED(&ip6h->ip6_src) &&
10690 			    !unspec_src) {
10691 				ip6h->ip6_src = src_ire->ire_src_addr_v6;
10692 			}
10693 			ire_refrele(src_ire);
10694 		} else {
10695 			BUMP_MIB(ill->ill_ip6_mib, ipv6OutNoRoutes);
10696 			if (src_ire != NULL) {
10697 				if (src_ire->ire_flags & RTF_BLACKHOLE) {
10698 					ire_refrele(src_ire);
10699 					freemsg(first_mp);
10700 					return;
10701 				}
10702 				ire_refrele(src_ire);
10703 			}
10704 			if (ip_hdr_complete_v6(ip6h, zoneid)) {
10705 				/* Failed */
10706 				freemsg(first_mp);
10707 				return;
10708 			}
10709 			icmp_unreachable_v6(q, first_mp,
10710 			    ICMP6_DST_UNREACH_NOROUTE, B_FALSE, B_FALSE);
10711 			return;
10712 		}
10713 	}
10714 
10715 	if (mp->b_datap->db_type == M_CTL || ipsec_outbound_v6_policy_present) {
10716 		mp = ip_wput_ire_parse_ipsec_out(first_mp, NULL, ip6h, ire,
10717 		    connp, unspec_src);
10718 		if (mp == NULL) {
10719 			return;
10720 		}
10721 	}
10722 
10723 	first_mp = mp;
10724 	if (mp->b_datap->db_type == M_CTL) {
10725 		io = (ipsec_out_t *)mp->b_rptr;
10726 		ASSERT(io->ipsec_out_type == IPSEC_OUT);
10727 		mp = mp->b_cont;
10728 		mctl_present = B_TRUE;
10729 	} else {
10730 		mctl_present = B_FALSE;
10731 	}
10732 
10733 	ip6h = (ip6_t *)mp->b_rptr;
10734 	nexthdr = ip6h->ip6_nxt;
10735 	mibptr = ill->ill_ip6_mib;
10736 
10737 	if (IN6_IS_ADDR_UNSPECIFIED(&ip6h->ip6_src) && !unspec_src) {
10738 		/*
10739 		 * The ire_src_addr_v6 always contains a useable source address
10740 		 * for the destination (based on source address selection rules
10741 		 * with respect to address scope as well as deprecated vs.
10742 		 * preferred addresses).
10743 		 */
10744 		ip6h->ip6_src = ire->ire_src_addr_v6;
10745 	}
10746 	if (IN6_IS_ADDR_MULTICAST(&ip6h->ip6_dst)) {
10747 		if ((connp != NULL && connp->conn_multicast_loop) ||
10748 		    !(ill->ill_phyint->phyint_flags & PHYI_LOOPBACK)) {
10749 			ilm_t	*ilm;
10750 
10751 			ILM_WALKER_HOLD(ill);
10752 			ilm = ilm_lookup_ill_v6(ill, &ip6h->ip6_dst, ALL_ZONES);
10753 			ILM_WALKER_RELE(ill);
10754 			if (ilm != NULL) {
10755 				mblk_t *nmp;
10756 				int fanout_flags = 0;
10757 
10758 				if (connp != NULL &&
10759 				    !connp->conn_multicast_loop) {
10760 					fanout_flags |= IP_FF_NO_MCAST_LOOP;
10761 				}
10762 				ip1dbg(("ip_wput_ire_v6: "
10763 				    "Loopback multicast\n"));
10764 				nmp = ip_copymsg(first_mp);
10765 				if (nmp != NULL) {
10766 					ip6_t	*nip6h;
10767 
10768 					if (mctl_present) {
10769 						nip6h = (ip6_t *)
10770 						    nmp->b_cont->b_rptr;
10771 					} else {
10772 						nip6h = (ip6_t *)nmp->b_rptr;
10773 					}
10774 					/*
10775 					 * Deliver locally and to every local
10776 					 * zone, except the sending zone when
10777 					 * IPV6_MULTICAST_LOOP is disabled.
10778 					 */
10779 					ip_wput_local_v6(RD(q), ill, nip6h, nmp,
10780 					    ire, fanout_flags);
10781 				} else {
10782 					BUMP_MIB(mibptr, ipv6OutDiscards);
10783 					ip1dbg(("ip_wput_ire_v6: "
10784 					    "copymsg failed\n"));
10785 				}
10786 			}
10787 		}
10788 		if (ip6h->ip6_hops == 0 ||
10789 		    IN6_IS_ADDR_MC_NODELOCAL(&ip6h->ip6_dst) ||
10790 		    (ill->ill_phyint->phyint_flags & PHYI_LOOPBACK)) {
10791 			/*
10792 			 * Local multicast or just loopback on loopback
10793 			 * interface.
10794 			 */
10795 			BUMP_MIB(mibptr, ipv6OutMcastPkts);
10796 			ip1dbg(("ip_wput_ire_v6: local multicast only\n"));
10797 			freemsg(first_mp);
10798 			return;
10799 		}
10800 	}
10801 
10802 	if (ire->ire_stq != NULL) {
10803 		uint32_t	sum;
10804 		uint_t		ill_index =  ((ill_t *)ire->ire_stq->q_ptr)->
10805 		    ill_phyint->phyint_ifindex;
10806 		queue_t		*dev_q = ire->ire_stq->q_next;
10807 
10808 		/*
10809 		 * non-NULL send-to queue - packet is to be sent
10810 		 * out an interface.
10811 		 */
10812 
10813 		/* Driver is flow-controlling? */
10814 		if (!IP_FLOW_CONTROLLED_ULP(nexthdr) &&
10815 		    ((dev_q->q_next || dev_q->q_first) && !canput(dev_q))) {
10816 			/*
10817 			 * Queue packet if we have an conn to give back
10818 			 * pressure.  We can't queue packets intended for
10819 			 * hardware acceleration since we've tossed that
10820 			 * state already.  If the packet is being fed back
10821 			 * from ire_send_v6, we don't know the position in
10822 			 * the queue to enqueue the packet and we discard
10823 			 * the packet.
10824 			 */
10825 			if (ip_output_queue && connp != NULL &&
10826 			    !mctl_present && caller != IRE_SEND) {
10827 				if (caller == IP_WSRV) {
10828 					connp->conn_did_putbq = 1;
10829 					(void) putbq(connp->conn_wq, mp);
10830 					conn_drain_insert(connp);
10831 					/*
10832 					 * caller == IP_WSRV implies we are
10833 					 * the service thread, and the
10834 					 * queue is already noenabled.
10835 					 * The check for canput and
10836 					 * the putbq is not atomic.
10837 					 * So we need to check again.
10838 					 */
10839 					if (canput(dev_q))
10840 						connp->conn_did_putbq = 0;
10841 				} else {
10842 					(void) putq(connp->conn_wq, mp);
10843 				}
10844 				return;
10845 			}
10846 			BUMP_MIB(mibptr, ipv6OutDiscards);
10847 			freemsg(first_mp);
10848 			return;
10849 		}
10850 
10851 		/*
10852 		 * Look for reachability confirmations from the transport.
10853 		 */
10854 		if (ip6h->ip6_vcf & IP_FORWARD_PROG) {
10855 			reachable |= IPV6_REACHABILITY_CONFIRMATION;
10856 			ip6h->ip6_vcf &= ~IP_FORWARD_PROG;
10857 			if (mctl_present)
10858 				io->ipsec_out_reachable = B_TRUE;
10859 		}
10860 		/* Fastpath */
10861 		switch (nexthdr) {
10862 		case IPPROTO_TCP:
10863 		case IPPROTO_UDP:
10864 		case IPPROTO_ICMPV6:
10865 		case IPPROTO_SCTP:
10866 			hdr_length = IPV6_HDR_LEN;
10867 			break;
10868 		default: {
10869 			uint8_t	*nexthdrp;
10870 
10871 			if (!ip_hdr_length_nexthdr_v6(mp, ip6h,
10872 			    &hdr_length, &nexthdrp)) {
10873 				/* Malformed packet */
10874 				BUMP_MIB(mibptr, ipv6OutDiscards);
10875 				freemsg(first_mp);
10876 				return;
10877 			}
10878 			nexthdr = *nexthdrp;
10879 			break;
10880 		}
10881 		}
10882 
10883 		if (cksum_request != -1 && nexthdr != IPPROTO_ICMPV6) {
10884 			uint16_t	*up;
10885 			uint16_t	*insp;
10886 
10887 			/*
10888 			 * The packet header is processed once for all, even
10889 			 * in the multirouting case. We disable hardware
10890 			 * checksum if the packet is multirouted, as it will be
10891 			 * replicated via several interfaces, and not all of
10892 			 * them may have this capability.
10893 			 */
10894 			if (cksum_request == 1 &&
10895 			    !(ire->ire_flags & RTF_MULTIRT)) {
10896 				/* Skip the transport checksum */
10897 				goto cksum_done;
10898 			}
10899 			/*
10900 			 * Do user-configured raw checksum.
10901 			 * Compute checksum and insert at offset "cksum_request"
10902 			 */
10903 
10904 			/* check for enough headers for checksum */
10905 			cksum_request += hdr_length;	/* offset from rptr */
10906 			if ((mp->b_wptr - mp->b_rptr) <
10907 			    (cksum_request + sizeof (int16_t))) {
10908 				if (!pullupmsg(mp,
10909 				    cksum_request + sizeof (int16_t))) {
10910 					ip1dbg(("ip_wput_v6: ICMP hdr pullupmsg"
10911 					    " failed\n"));
10912 					BUMP_MIB(mibptr, ipv6OutDiscards);
10913 					freemsg(first_mp);
10914 					return;
10915 				}
10916 				ip6h = (ip6_t *)mp->b_rptr;
10917 			}
10918 			insp = (uint16_t *)((uchar_t *)ip6h + cksum_request);
10919 			ASSERT(((uintptr_t)insp & 0x1) == 0);
10920 			up = (uint16_t *)&ip6h->ip6_src;
10921 			/*
10922 			 * icmp has placed length and routing
10923 			 * header adjustment in *insp.
10924 			 */
10925 			sum = htons(nexthdr) +
10926 			    up[0] + up[1] + up[2] + up[3] +
10927 			    up[4] + up[5] + up[6] + up[7] +
10928 			    up[8] + up[9] + up[10] + up[11] +
10929 			    up[12] + up[13] + up[14] + up[15];
10930 			sum = (sum & 0xffff) + (sum >> 16);
10931 			*insp = IP_CSUM(mp, hdr_length, sum);
10932 			if (*insp == 0)
10933 				*insp = 0xFFFF;
10934 		} else if (nexthdr == IPPROTO_TCP) {
10935 			uint16_t	*up;
10936 
10937 			/*
10938 			 * Check for full IPv6 header + enough TCP header
10939 			 * to get at the checksum field.
10940 			 */
10941 			if ((mp->b_wptr - mp->b_rptr) <
10942 			    (hdr_length + TCP_CHECKSUM_OFFSET +
10943 			    TCP_CHECKSUM_SIZE)) {
10944 				if (!pullupmsg(mp, hdr_length +
10945 				    TCP_CHECKSUM_OFFSET + TCP_CHECKSUM_SIZE)) {
10946 					ip1dbg(("ip_wput_v6: TCP hdr pullupmsg"
10947 					    " failed\n"));
10948 					BUMP_MIB(mibptr, ipv6OutDiscards);
10949 					freemsg(first_mp);
10950 					return;
10951 				}
10952 				ip6h = (ip6_t *)mp->b_rptr;
10953 			}
10954 
10955 			up = (uint16_t *)&ip6h->ip6_src;
10956 			/*
10957 			 * Note: The TCP module has stored the length value
10958 			 * into the tcp checksum field, so we don't
10959 			 * need to explicitly sum it in here.
10960 			 */
10961 			sum = up[0] + up[1] + up[2] + up[3] +
10962 			    up[4] + up[5] + up[6] + up[7] +
10963 			    up[8] + up[9] + up[10] + up[11] +
10964 			    up[12] + up[13] + up[14] + up[15];
10965 
10966 			/* Fold the initial sum */
10967 			sum = (sum & 0xffff) + (sum >> 16);
10968 
10969 			up = (uint16_t *)(((uchar_t *)ip6h) +
10970 			    hdr_length + TCP_CHECKSUM_OFFSET);
10971 
10972 			IP_CKSUM_XMIT(ill, ire, mp, ip6h, up, IPPROTO_TCP,
10973 			    hdr_length, ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN,
10974 			    ire->ire_max_frag, mctl_present, sum);
10975 
10976 			/* Software checksum? */
10977 			if (DB_CKSUMFLAGS(mp) == 0) {
10978 				IP6_STAT(ip6_out_sw_cksum);
10979 				IP6_STAT_UPDATE(ip6_tcp_out_sw_cksum_bytes,
10980 				    (ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN) -
10981 				    hdr_length);
10982 			}
10983 		} else if (nexthdr == IPPROTO_UDP) {
10984 			uint16_t	*up;
10985 
10986 			/*
10987 			 * check for full IPv6 header + enough UDP header
10988 			 * to get at the UDP checksum field
10989 			 */
10990 			if ((mp->b_wptr - mp->b_rptr) < (hdr_length +
10991 			    UDP_CHECKSUM_OFFSET + UDP_CHECKSUM_SIZE)) {
10992 				if (!pullupmsg(mp, hdr_length +
10993 				    UDP_CHECKSUM_OFFSET + UDP_CHECKSUM_SIZE)) {
10994 					ip1dbg(("ip_wput_v6: UDP hdr pullupmsg"
10995 					    " failed\n"));
10996 					BUMP_MIB(mibptr, ipv6OutDiscards);
10997 					freemsg(first_mp);
10998 					return;
10999 				}
11000 				ip6h = (ip6_t *)mp->b_rptr;
11001 			}
11002 			up = (uint16_t *)&ip6h->ip6_src;
11003 			/*
11004 			 * Note: The UDP module has stored the length value
11005 			 * into the udp checksum field, so we don't
11006 			 * need to explicitly sum it in here.
11007 			 */
11008 			sum = up[0] + up[1] + up[2] + up[3] +
11009 			    up[4] + up[5] + up[6] + up[7] +
11010 			    up[8] + up[9] + up[10] + up[11] +
11011 			    up[12] + up[13] + up[14] + up[15];
11012 
11013 			/* Fold the initial sum */
11014 			sum = (sum & 0xffff) + (sum >> 16);
11015 
11016 			up = (uint16_t *)(((uchar_t *)ip6h) +
11017 			    hdr_length + UDP_CHECKSUM_OFFSET);
11018 
11019 			IP_CKSUM_XMIT(ill, ire, mp, ip6h, up, IPPROTO_UDP,
11020 			    hdr_length, ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN,
11021 			    ire->ire_max_frag, mctl_present, sum);
11022 
11023 			/* Software checksum? */
11024 			if (DB_CKSUMFLAGS(mp) == 0) {
11025 				IP6_STAT(ip6_out_sw_cksum);
11026 				IP6_STAT_UPDATE(ip6_udp_out_sw_cksum_bytes,
11027 				    (ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN) -
11028 				    hdr_length);
11029 			}
11030 		} else if (nexthdr == IPPROTO_ICMPV6) {
11031 			uint16_t	*up;
11032 			icmp6_t *icmp6;
11033 
11034 			/* check for full IPv6+ICMPv6 header */
11035 			if ((mp->b_wptr - mp->b_rptr) <
11036 			    (hdr_length + ICMP6_MINLEN)) {
11037 				if (!pullupmsg(mp, hdr_length + ICMP6_MINLEN)) {
11038 					ip1dbg(("ip_wput_v6: ICMP hdr pullupmsg"
11039 					    " failed\n"));
11040 					BUMP_MIB(mibptr, ipv6OutDiscards);
11041 					freemsg(first_mp);
11042 					return;
11043 				}
11044 				ip6h = (ip6_t *)mp->b_rptr;
11045 			}
11046 			icmp6 = (icmp6_t *)((uchar_t *)ip6h + hdr_length);
11047 			up = (uint16_t *)&ip6h->ip6_src;
11048 			/*
11049 			 * icmp has placed length and routing
11050 			 * header adjustment in icmp6_cksum.
11051 			 */
11052 			sum = htons(IPPROTO_ICMPV6) +
11053 			    up[0] + up[1] + up[2] + up[3] +
11054 			    up[4] + up[5] + up[6] + up[7] +
11055 			    up[8] + up[9] + up[10] + up[11] +
11056 			    up[12] + up[13] + up[14] + up[15];
11057 			sum = (sum & 0xffff) + (sum >> 16);
11058 			icmp6->icmp6_cksum = IP_CSUM(mp, hdr_length, sum);
11059 			if (icmp6->icmp6_cksum == 0)
11060 				icmp6->icmp6_cksum = 0xFFFF;
11061 
11062 			/* Update output mib stats */
11063 			icmp_update_out_mib_v6(ill, icmp6);
11064 		} else if (nexthdr == IPPROTO_SCTP) {
11065 			sctp_hdr_t *sctph;
11066 
11067 			if (MBLKL(mp) < (hdr_length + sizeof (*sctph))) {
11068 				if (!pullupmsg(mp, hdr_length +
11069 				    sizeof (*sctph))) {
11070 					ip1dbg(("ip_wput_v6: SCTP hdr pullupmsg"
11071 					    " failed\n"));
11072 					BUMP_MIB(ill->ill_ip6_mib,
11073 					    ipv6OutDiscards);
11074 					freemsg(mp);
11075 					return;
11076 				}
11077 				ip6h = (ip6_t *)mp->b_rptr;
11078 			}
11079 			sctph = (sctp_hdr_t *)(mp->b_rptr + hdr_length);
11080 			sctph->sh_chksum = 0;
11081 			sctph->sh_chksum = sctp_cksum(mp, hdr_length);
11082 		}
11083 
11084 	cksum_done:
11085 		/*
11086 		 * We force the insertion of a fragment header using the
11087 		 * IPH_FRAG_HDR flag in two cases:
11088 		 * - after reception of an ICMPv6 "packet too big" message
11089 		 *   with a MTU < 1280 (cf. RFC 2460 section 5)
11090 		 * - for multirouted IPv6 packets, so that the receiver can
11091 		 *   discard duplicates according to their fragment identifier
11092 		 *
11093 		 * Two flags modifed from the API can modify this behavior.
11094 		 * The first is IPV6_USE_MIN_MTU.  With this API the user
11095 		 * can specify how to manage PMTUD for unicast and multicast.
11096 		 *
11097 		 * IPV6_DONTFRAG disallows fragmentation.
11098 		 */
11099 		max_frag = ire->ire_max_frag;
11100 		switch (IP6I_USE_MIN_MTU_API(flags)) {
11101 		case IPV6_USE_MIN_MTU_DEFAULT:
11102 		case IPV6_USE_MIN_MTU_UNICAST:
11103 			if (IN6_IS_ADDR_MULTICAST(&ip6h->ip6_dst)) {
11104 				max_frag = IPV6_MIN_MTU;
11105 			}
11106 			break;
11107 
11108 		case IPV6_USE_MIN_MTU_NEVER:
11109 			max_frag = IPV6_MIN_MTU;
11110 			break;
11111 		}
11112 		if (ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN > max_frag ||
11113 		    (ire->ire_frag_flag & IPH_FRAG_HDR)) {
11114 			if (connp != NULL && (flags & IP6I_DONTFRAG)) {
11115 				icmp_pkt2big_v6(ire->ire_stq, first_mp,
11116 				    max_frag, B_FALSE, B_TRUE);
11117 				return;
11118 			}
11119 
11120 			if (ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN !=
11121 			    (mp->b_cont ? msgdsize(mp) :
11122 			    mp->b_wptr - (uchar_t *)ip6h)) {
11123 				ip0dbg(("Packet length mismatch: %d, %ld\n",
11124 				    ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN,
11125 				    msgdsize(mp)));
11126 				freemsg(first_mp);
11127 				return;
11128 			}
11129 			/* Do IPSEC processing first */
11130 			if (mctl_present) {
11131 				if (attach_index != 0)
11132 					ipsec_out_attach_if(io, attach_index);
11133 				ipsec_out_process(q, first_mp, ire, ill_index);
11134 				return;
11135 			}
11136 			ASSERT(mp->b_prev == NULL);
11137 			ip2dbg(("Fragmenting Size = %d, mtu = %d\n",
11138 			    ntohs(ip6h->ip6_plen) +
11139 			    IPV6_HDR_LEN, max_frag));
11140 			ASSERT(mp == first_mp);
11141 			/* Initiate IPPF processing */
11142 			if (IPP_ENABLED(IPP_LOCAL_OUT)) {
11143 				ip_process(IPP_LOCAL_OUT, &mp, ill_index);
11144 				if (mp == NULL) {
11145 					return;
11146 				}
11147 			}
11148 			ip_wput_frag_v6(mp, ire, reachable, connp,
11149 			    caller, max_frag);
11150 			return;
11151 		}
11152 		/* Do IPSEC processing first */
11153 		if (mctl_present) {
11154 			int extra_len = ipsec_out_extra_length(first_mp);
11155 
11156 			if (ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN + extra_len >
11157 			    max_frag && ip_ulp_cando_pkt2big(nexthdr)) {
11158 				/*
11159 				 * IPsec headers will push the packet over the
11160 				 * MTU limit.  Issue an ICMPv6 Packet Too Big
11161 				 * message for this packet if the upper-layer
11162 				 * that issued this packet will be able to
11163 				 * react to the icmp_pkt2big_v6() that we'll
11164 				 * generate.
11165 				 */
11166 				icmp_pkt2big_v6(ire->ire_stq, first_mp,
11167 				    max_frag, B_FALSE, B_TRUE);
11168 				return;
11169 			}
11170 			if (attach_index != 0)
11171 				ipsec_out_attach_if(io, attach_index);
11172 			ipsec_out_process(q, first_mp, ire, ill_index);
11173 			return;
11174 		}
11175 		/*
11176 		 * XXX multicast: add ip_mforward_v6() here.
11177 		 * Check conn_dontroute
11178 		 */
11179 #ifdef lint
11180 		/*
11181 		 * XXX The only purpose of this statement is to avoid lint
11182 		 * errors.  See the above "XXX multicast".  When that gets
11183 		 * fixed, remove this whole #ifdef lint section.
11184 		 */
11185 		ip3dbg(("multicast forward is %s.\n",
11186 		    (multicast_forward ? "TRUE" : "FALSE")));
11187 #endif
11188 
11189 		UPDATE_OB_PKT_COUNT(ire);
11190 		ire->ire_last_used_time = lbolt;
11191 		ASSERT(mp == first_mp);
11192 		ip_xmit_v6(mp, ire, reachable, connp, caller, NULL);
11193 	} else {
11194 		ip_wput_local_v6(RD(q), ill, ip6h, first_mp, ire, 0);
11195 	}
11196 }
11197 
11198 /*
11199  * Outbound IPv6 fragmentation routine using MDT.
11200  */
11201 static void
11202 ip_wput_frag_mdt_v6(mblk_t *mp, ire_t *ire, size_t max_chunk,
11203     size_t unfragmentable_len, uint8_t nexthdr, uint_t prev_nexthdr_offset)
11204 {
11205 	ip6_t		*ip6h = (ip6_t *)mp->b_rptr;
11206 	uint_t		pkts, wroff, hdr_chunk_len, pbuf_idx;
11207 	mblk_t		*hdr_mp, *md_mp = NULL;
11208 	int		i1;
11209 	multidata_t	*mmd;
11210 	unsigned char	*hdr_ptr, *pld_ptr;
11211 	ip_pdescinfo_t	pdi;
11212 	uint32_t	ident;
11213 	size_t		len;
11214 	uint16_t	offset;
11215 	queue_t		*stq = ire->ire_stq;
11216 	ill_t		*ill = (ill_t *)stq->q_ptr;
11217 
11218 	ASSERT(DB_TYPE(mp) == M_DATA);
11219 	ASSERT(MBLKL(mp) > unfragmentable_len);
11220 
11221 	/*
11222 	 * Move read ptr past unfragmentable portion, we don't want this part
11223 	 * of the data in our fragments.
11224 	 */
11225 	mp->b_rptr += unfragmentable_len;
11226 
11227 	/* Calculate how many packets we will send out  */
11228 	i1 = (mp->b_cont == NULL) ? MBLKL(mp) : msgsize(mp);
11229 	pkts = (i1 + max_chunk - 1) / max_chunk;
11230 	ASSERT(pkts > 1);
11231 
11232 	/* Allocate a message block which will hold all the IP Headers. */
11233 	wroff = ip_wroff_extra;
11234 	hdr_chunk_len = wroff + unfragmentable_len + sizeof (ip6_frag_t);
11235 
11236 	i1 = pkts * hdr_chunk_len;
11237 	/*
11238 	 * Create the header buffer, Multidata and destination address
11239 	 * and SAP attribute that should be associated with it.
11240 	 */
11241 	if ((hdr_mp = allocb(i1, BPRI_HI)) == NULL ||
11242 	    ((hdr_mp->b_wptr += i1),
11243 	    (mmd = mmd_alloc(hdr_mp, &md_mp, KM_NOSLEEP)) == NULL) ||
11244 	    !ip_md_addr_attr(mmd, NULL, ire->ire_nce->nce_res_mp)) {
11245 		freemsg(mp);
11246 		if (md_mp == NULL) {
11247 			freemsg(hdr_mp);
11248 		} else {
11249 free_mmd:		IP6_STAT(ip6_frag_mdt_discarded);
11250 			freemsg(md_mp);
11251 		}
11252 		IP6_STAT(ip6_frag_mdt_allocfail);
11253 		BUMP_MIB(ill->ill_ip6_mib, ipv6OutFragFails);
11254 		UPDATE_MIB(ill->ill_ip6_mib, ipv6OutDiscards, pkts);
11255 		return;
11256 	}
11257 	IP6_STAT(ip6_frag_mdt_allocd);
11258 
11259 	/*
11260 	 * Add a payload buffer to the Multidata; this operation must not
11261 	 * fail, or otherwise our logic in this routine is broken.  There
11262 	 * is no memory allocation done by the routine, so any returned
11263 	 * failure simply tells us that we've done something wrong.
11264 	 *
11265 	 * A failure tells us that either we're adding the same payload
11266 	 * buffer more than once, or we're trying to add more buffers than
11267 	 * allowed.  None of the above cases should happen, and we panic
11268 	 * because either there's horrible heap corruption, and/or
11269 	 * programming mistake.
11270 	 */
11271 	if ((pbuf_idx = mmd_addpldbuf(mmd, mp)) < 0) {
11272 		goto pbuf_panic;
11273 	}
11274 
11275 	hdr_ptr = hdr_mp->b_rptr;
11276 	pld_ptr = mp->b_rptr;
11277 
11278 	pdi.flags = PDESC_HBUF_REF | PDESC_PBUF_REF;
11279 
11280 	ident = htonl(atomic_add_32_nv(&ire->ire_ident, 1));
11281 
11282 	/*
11283 	 * len is the total length of the fragmentable data in this
11284 	 * datagram.  For each fragment sent, we will decrement len
11285 	 * by the amount of fragmentable data sent in that fragment
11286 	 * until len reaches zero.
11287 	 */
11288 	len = ntohs(ip6h->ip6_plen) - (unfragmentable_len - IPV6_HDR_LEN);
11289 
11290 	offset = 0;
11291 	prev_nexthdr_offset += wroff;
11292 
11293 	while (len != 0) {
11294 		size_t		mlen;
11295 		ip6_t		*fip6h;
11296 		ip6_frag_t	*fraghdr;
11297 		int		error;
11298 
11299 		ASSERT((hdr_ptr + hdr_chunk_len) <= hdr_mp->b_wptr);
11300 		mlen = MIN(len, max_chunk);
11301 		len -= mlen;
11302 
11303 		fip6h = (ip6_t *)(hdr_ptr + wroff);
11304 		ASSERT(OK_32PTR(fip6h));
11305 		bcopy(ip6h, fip6h, unfragmentable_len);
11306 		hdr_ptr[prev_nexthdr_offset] = IPPROTO_FRAGMENT;
11307 
11308 		fip6h->ip6_plen = htons((uint16_t)(mlen +
11309 		    unfragmentable_len - IPV6_HDR_LEN + sizeof (ip6_frag_t)));
11310 
11311 		fraghdr = (ip6_frag_t *)((unsigned char *)fip6h +
11312 		    unfragmentable_len);
11313 		fraghdr->ip6f_nxt = nexthdr;
11314 		fraghdr->ip6f_reserved = 0;
11315 		fraghdr->ip6f_offlg = htons(offset) |
11316 		    ((len != 0) ? IP6F_MORE_FRAG : 0);
11317 		fraghdr->ip6f_ident = ident;
11318 
11319 		/*
11320 		 * Record offset and size of header and data of the next packet
11321 		 * in the multidata message.
11322 		 */
11323 		PDESC_HDR_ADD(&pdi, hdr_ptr, wroff,
11324 		    unfragmentable_len + sizeof (ip6_frag_t), 0);
11325 		PDESC_PLD_INIT(&pdi);
11326 		i1 = MIN(mp->b_wptr - pld_ptr, mlen);
11327 		ASSERT(i1 > 0);
11328 		PDESC_PLD_SPAN_ADD(&pdi, pbuf_idx, pld_ptr, i1);
11329 		if (i1 == mlen) {
11330 			pld_ptr += mlen;
11331 		} else {
11332 			i1 = mlen - i1;
11333 			mp = mp->b_cont;
11334 			ASSERT(mp != NULL);
11335 			ASSERT(MBLKL(mp) >= i1);
11336 			/*
11337 			 * Attach the next payload message block to the
11338 			 * multidata message.
11339 			 */
11340 			if ((pbuf_idx = mmd_addpldbuf(mmd, mp)) < 0)
11341 				goto pbuf_panic;
11342 			PDESC_PLD_SPAN_ADD(&pdi, pbuf_idx, mp->b_rptr, i1);
11343 			pld_ptr = mp->b_rptr + i1;
11344 		}
11345 
11346 		if ((mmd_addpdesc(mmd, (pdescinfo_t *)&pdi, &error,
11347 		    KM_NOSLEEP)) == NULL) {
11348 			/*
11349 			 * Any failure other than ENOMEM indicates that we
11350 			 * have passed in invalid pdesc info or parameters
11351 			 * to mmd_addpdesc, which must not happen.
11352 			 *
11353 			 * EINVAL is a result of failure on boundary checks
11354 			 * against the pdesc info contents.  It should not
11355 			 * happen, and we panic because either there's
11356 			 * horrible heap corruption, and/or programming
11357 			 * mistake.
11358 			 */
11359 			if (error != ENOMEM) {
11360 				cmn_err(CE_PANIC, "ip_wput_frag_mdt_v6: "
11361 				    "pdesc logic error detected for "
11362 				    "mmd %p pinfo %p (%d)\n",
11363 				    (void *)mmd, (void *)&pdi, error);
11364 				/* NOTREACHED */
11365 			}
11366 			IP6_STAT(ip6_frag_mdt_addpdescfail);
11367 			/* Free unattached payload message blocks as well */
11368 			md_mp->b_cont = mp->b_cont;
11369 			goto free_mmd;
11370 		}
11371 
11372 		/* Advance fragment offset. */
11373 		offset += mlen;
11374 
11375 		/* Advance to location for next header in the buffer. */
11376 		hdr_ptr += hdr_chunk_len;
11377 
11378 		/* Did we reach the next payload message block? */
11379 		if (pld_ptr == mp->b_wptr && mp->b_cont != NULL) {
11380 			mp = mp->b_cont;
11381 			/*
11382 			 * Attach the next message block with payload
11383 			 * data to the multidata message.
11384 			 */
11385 			if ((pbuf_idx = mmd_addpldbuf(mmd, mp)) < 0)
11386 				goto pbuf_panic;
11387 			pld_ptr = mp->b_rptr;
11388 		}
11389 	}
11390 
11391 	ASSERT(hdr_mp->b_wptr == hdr_ptr);
11392 	ASSERT(mp->b_wptr == pld_ptr);
11393 
11394 	/* Update IP statistics */
11395 	UPDATE_MIB(ill->ill_ip6_mib, ipv6OutFragCreates, pkts);
11396 	BUMP_MIB(ill->ill_ip6_mib, ipv6OutFragOKs);
11397 	IP6_STAT_UPDATE(ip6_frag_mdt_pkt_out, pkts);
11398 
11399 	ire->ire_ob_pkt_count += pkts;
11400 	if (ire->ire_ipif != NULL)
11401 		atomic_add_32(&ire->ire_ipif->ipif_ob_pkt_count, pkts);
11402 
11403 	ire->ire_last_used_time = lbolt;
11404 	/* Send it down */
11405 	putnext(stq, md_mp);
11406 	return;
11407 
11408 pbuf_panic:
11409 	cmn_err(CE_PANIC, "ip_wput_frag_mdt_v6: payload buffer logic "
11410 	    "error for mmd %p pbuf %p (%d)", (void *)mmd, (void *)mp,
11411 	    pbuf_idx);
11412 	/* NOTREACHED */
11413 }
11414 
11415 /*
11416  * IPv6 fragmentation.  Essentially the same as IPv4 fragmentation.
11417  * We have not optimized this in terms of number of mblks
11418  * allocated. For instance, for each fragment sent we always allocate a
11419  * mblk to hold the IPv6 header and fragment header.
11420  *
11421  * Assumes that all the extension headers are contained in the first mblk.
11422  *
11423  * The fragment header is inserted after an hop-by-hop options header
11424  * and after [an optional destinations header followed by] a routing header.
11425  *
11426  * NOTE : This function does not ire_refrele the ire passed in as
11427  * the argument.
11428  */
11429 void
11430 ip_wput_frag_v6(mblk_t *mp, ire_t *ire, uint_t reachable, conn_t *connp,
11431     int caller, int max_frag)
11432 {
11433 	ip6_t		*ip6h = (ip6_t *)mp->b_rptr;
11434 	ip6_t		*fip6h;
11435 	mblk_t		*hmp;
11436 	mblk_t		*hmp0;
11437 	mblk_t		*dmp;
11438 	ip6_frag_t	*fraghdr;
11439 	size_t		unfragmentable_len;
11440 	size_t		len;
11441 	size_t		mlen;
11442 	size_t		max_chunk;
11443 	uint32_t	ident;
11444 	uint16_t	off_flags;
11445 	uint16_t	offset = 0;
11446 	ill_t		*ill;
11447 	uint8_t		nexthdr;
11448 	uint_t		prev_nexthdr_offset;
11449 	uint8_t		*ptr;
11450 
11451 	ASSERT(ire->ire_type == IRE_CACHE);
11452 	ill = (ill_t *)ire->ire_stq->q_ptr;
11453 
11454 	/*
11455 	 * Determine the length of the unfragmentable portion of this
11456 	 * datagram.  This consists of the IPv6 header, a potential
11457 	 * hop-by-hop options header, a potential pre-routing-header
11458 	 * destination options header, and a potential routing header.
11459 	 */
11460 	nexthdr = ip6h->ip6_nxt;
11461 	prev_nexthdr_offset = (uint8_t *)&ip6h->ip6_nxt - (uint8_t *)ip6h;
11462 	ptr = (uint8_t *)&ip6h[1];
11463 
11464 	if (nexthdr == IPPROTO_HOPOPTS) {
11465 		ip6_hbh_t	*hbh_hdr;
11466 		uint_t		hdr_len;
11467 
11468 		hbh_hdr = (ip6_hbh_t *)ptr;
11469 		hdr_len = 8 * (hbh_hdr->ip6h_len + 1);
11470 		nexthdr = hbh_hdr->ip6h_nxt;
11471 		prev_nexthdr_offset = (uint8_t *)&hbh_hdr->ip6h_nxt
11472 		    - (uint8_t *)ip6h;
11473 		ptr += hdr_len;
11474 	}
11475 	if (nexthdr == IPPROTO_DSTOPTS) {
11476 		ip6_dest_t	*dest_hdr;
11477 		uint_t		hdr_len;
11478 
11479 		dest_hdr = (ip6_dest_t *)ptr;
11480 		if (dest_hdr->ip6d_nxt == IPPROTO_ROUTING) {
11481 			hdr_len = 8 * (dest_hdr->ip6d_len + 1);
11482 			nexthdr = dest_hdr->ip6d_nxt;
11483 			prev_nexthdr_offset = (uint8_t *)&dest_hdr->ip6d_nxt
11484 			    - (uint8_t *)ip6h;
11485 			ptr += hdr_len;
11486 		}
11487 	}
11488 	if (nexthdr == IPPROTO_ROUTING) {
11489 		ip6_rthdr_t	*rthdr;
11490 		uint_t		hdr_len;
11491 
11492 		rthdr = (ip6_rthdr_t *)ptr;
11493 		nexthdr = rthdr->ip6r_nxt;
11494 		prev_nexthdr_offset = (uint8_t *)&rthdr->ip6r_nxt
11495 		    - (uint8_t *)ip6h;
11496 		hdr_len = 8 * (rthdr->ip6r_len + 1);
11497 		ptr += hdr_len;
11498 	}
11499 	unfragmentable_len = (uint_t)(ptr - (uint8_t *)ip6h);
11500 
11501 	max_chunk = (min(max_frag, ire->ire_max_frag) - unfragmentable_len -
11502 	    sizeof (ip6_frag_t)) & ~7;
11503 
11504 	/* Check if we can use MDT to send out the frags. */
11505 	ASSERT(!IRE_IS_LOCAL(ire));
11506 	if (ip_multidata_outbound && reachable == 0 &&
11507 	    !(ire->ire_flags & RTF_MULTIRT) && ILL_MDT_CAPABLE(ill) &&
11508 	    IP_CAN_FRAG_MDT(mp, unfragmentable_len, max_chunk)) {
11509 		ip_wput_frag_mdt_v6(mp, ire, max_chunk, unfragmentable_len,
11510 		    nexthdr, prev_nexthdr_offset);
11511 		return;
11512 	}
11513 
11514 	/*
11515 	 * Allocate an mblk with enough room for the link-layer
11516 	 * header, the unfragmentable part of the datagram, and the
11517 	 * fragment header.  This (or a copy) will be used as the
11518 	 * first mblk for each fragment we send.
11519 	 */
11520 	hmp = allocb(unfragmentable_len + sizeof (ip6_frag_t) + ip_wroff_extra,
11521 	    BPRI_HI);
11522 	if (hmp == NULL) {
11523 		BUMP_MIB(ill->ill_ip6_mib, ipv6OutFragFails);
11524 		freemsg(mp);
11525 		return;
11526 	}
11527 	hmp->b_rptr += ip_wroff_extra;
11528 	hmp->b_wptr = hmp->b_rptr + unfragmentable_len + sizeof (ip6_frag_t);
11529 
11530 	fip6h = (ip6_t *)hmp->b_rptr;
11531 	fraghdr = (ip6_frag_t *)(hmp->b_rptr + unfragmentable_len);
11532 
11533 	bcopy(ip6h, fip6h, unfragmentable_len);
11534 	hmp->b_rptr[prev_nexthdr_offset] = IPPROTO_FRAGMENT;
11535 
11536 	ident = atomic_add_32_nv(&ire->ire_ident, 1);
11537 
11538 	fraghdr->ip6f_nxt = nexthdr;
11539 	fraghdr->ip6f_reserved = 0;
11540 	fraghdr->ip6f_offlg = 0;
11541 	fraghdr->ip6f_ident = htonl(ident);
11542 
11543 	/*
11544 	 * len is the total length of the fragmentable data in this
11545 	 * datagram.  For each fragment sent, we will decrement len
11546 	 * by the amount of fragmentable data sent in that fragment
11547 	 * until len reaches zero.
11548 	 */
11549 	len = ntohs(ip6h->ip6_plen) - (unfragmentable_len - IPV6_HDR_LEN);
11550 
11551 	/*
11552 	 * Move read ptr past unfragmentable portion, we don't want this part
11553 	 * of the data in our fragments.
11554 	 */
11555 	mp->b_rptr += unfragmentable_len;
11556 
11557 	while (len != 0) {
11558 		mlen = MIN(len, max_chunk);
11559 		len -= mlen;
11560 		if (len != 0) {
11561 			/* Not last */
11562 			hmp0 = copyb(hmp);
11563 			if (hmp0 == NULL) {
11564 				freeb(hmp);
11565 				freemsg(mp);
11566 				BUMP_MIB(ill->ill_ip6_mib, ipv6OutFragFails);
11567 				ip1dbg(("ip_wput_frag_v6: copyb failed\n"));
11568 				return;
11569 			}
11570 			off_flags = IP6F_MORE_FRAG;
11571 		} else {
11572 			/* Last fragment */
11573 			hmp0 = hmp;
11574 			hmp = NULL;
11575 			off_flags = 0;
11576 		}
11577 		fip6h = (ip6_t *)(hmp0->b_rptr);
11578 		fraghdr = (ip6_frag_t *)(hmp0->b_rptr + unfragmentable_len);
11579 
11580 		fip6h->ip6_plen = htons((uint16_t)(mlen +
11581 		    unfragmentable_len - IPV6_HDR_LEN + sizeof (ip6_frag_t)));
11582 		/*
11583 		 * Note: Optimization alert.
11584 		 * In IPv6 (and IPv4) protocol header, Fragment Offset
11585 		 * ("offset") is 13 bits wide and in 8-octet units.
11586 		 * In IPv6 protocol header (unlike IPv4) in a 16 bit field,
11587 		 * it occupies the most significant 13 bits.
11588 		 * (least significant 13 bits in IPv4).
11589 		 * We do not do any shifts here. Not shifting is same effect
11590 		 * as taking offset value in octet units, dividing by 8 and
11591 		 * then shifting 3 bits left to line it up in place in proper
11592 		 * place protocol header.
11593 		 */
11594 		fraghdr->ip6f_offlg = htons(offset) | off_flags;
11595 
11596 		if (!(dmp = ip_carve_mp(&mp, mlen))) {
11597 			/* mp has already been freed by ip_carve_mp() */
11598 			if (hmp != NULL)
11599 				freeb(hmp);
11600 			freeb(hmp0);
11601 			ip1dbg(("ip_carve_mp: failed\n"));
11602 			BUMP_MIB(ill->ill_ip6_mib, ipv6OutFragFails);
11603 			return;
11604 		}
11605 		hmp0->b_cont = dmp;
11606 		/* Get the priority marking, if any */
11607 		hmp0->b_band = dmp->b_band;
11608 		UPDATE_OB_PKT_COUNT(ire);
11609 		ire->ire_last_used_time = lbolt;
11610 		ip_xmit_v6(hmp0, ire, reachable | IP6_NO_IPPOLICY, connp,
11611 		    caller, NULL);
11612 		reachable = 0;	/* No need to redo state machine in loop */
11613 		BUMP_MIB(ill->ill_ip6_mib, ipv6OutFragCreates);
11614 		offset += mlen;
11615 	}
11616 	BUMP_MIB(ill->ill_ip6_mib, ipv6OutFragOKs);
11617 }
11618 
11619 /*
11620  * Determine if the ill and multicast aspects of that packets
11621  * "matches" the conn.
11622  */
11623 boolean_t
11624 conn_wantpacket_v6(conn_t *connp, ill_t *ill, ip6_t *ip6h, int fanout_flags,
11625     zoneid_t zoneid)
11626 {
11627 	ill_t *in_ill;
11628 	boolean_t wantpacket = B_TRUE;
11629 	in6_addr_t *v6dst_ptr = &ip6h->ip6_dst;
11630 	in6_addr_t *v6src_ptr = &ip6h->ip6_src;
11631 
11632 	/*
11633 	 * conn_incoming_ill is set by IPV6_BOUND_IF which limits
11634 	 * unicast and multicast reception to conn_incoming_ill.
11635 	 * conn_wantpacket_v6 is called both for unicast and
11636 	 * multicast.
11637 	 *
11638 	 * 1) The unicast copy of the packet can come anywhere in
11639 	 *    the ill group if it is part of the group. Thus, we
11640 	 *    need to check to see whether the ill group matches
11641 	 *    if in_ill is part of a group.
11642 	 *
11643 	 * 2) ip_rput does not suppress duplicate multicast packets.
11644 	 *    If there are two interfaces in a ill group and we have
11645 	 *    2 applications (conns) joined a multicast group G on
11646 	 *    both the interfaces, ilm_lookup_ill filter in ip_rput
11647 	 *    will give us two packets because we join G on both the
11648 	 *    interfaces rather than nominating just one interface
11649 	 *    for receiving multicast like broadcast above. So,
11650 	 *    we have to call ilg_lookup_ill to filter out duplicate
11651 	 *    copies, if ill is part of a group, to supress duplicates.
11652 	 */
11653 	in_ill = connp->conn_incoming_ill;
11654 	if (in_ill != NULL) {
11655 		mutex_enter(&connp->conn_lock);
11656 		in_ill = connp->conn_incoming_ill;
11657 		mutex_enter(&ill->ill_lock);
11658 		/*
11659 		 * No IPMP, and the packet did not arrive on conn_incoming_ill
11660 		 * OR, IPMP in use and the packet arrived on an IPMP group
11661 		 * different from the conn_incoming_ill's IPMP group.
11662 		 * Reject the packet.
11663 		 */
11664 		if ((in_ill->ill_group == NULL && in_ill != ill) ||
11665 		    (in_ill->ill_group != NULL &&
11666 		    in_ill->ill_group !=  ill->ill_group)) {
11667 			wantpacket = B_FALSE;
11668 		}
11669 		mutex_exit(&ill->ill_lock);
11670 		mutex_exit(&connp->conn_lock);
11671 		if (!wantpacket)
11672 			return (B_FALSE);
11673 	}
11674 
11675 	if (connp->conn_multi_router)
11676 		return (B_TRUE);
11677 
11678 	if (!IN6_IS_ADDR_MULTICAST(v6dst_ptr) &&
11679 	    !IN6_IS_ADDR_V4MAPPED_CLASSD(v6dst_ptr)) {
11680 		/*
11681 		 * Unicast case: we match the conn only if it's in the specified
11682 		 * zone.
11683 		 */
11684 		return (connp->conn_zoneid == zoneid || zoneid == ALL_ZONES);
11685 	}
11686 
11687 	if ((fanout_flags & IP_FF_NO_MCAST_LOOP) &&
11688 	    (connp->conn_zoneid == zoneid || zoneid == ALL_ZONES)) {
11689 		/*
11690 		 * Loopback case: the sending endpoint has IP_MULTICAST_LOOP
11691 		 * disabled, therefore we don't dispatch the multicast packet to
11692 		 * the sending zone.
11693 		 */
11694 		return (B_FALSE);
11695 	}
11696 
11697 	if ((ill->ill_phyint->phyint_flags & PHYI_LOOPBACK) &&
11698 	    connp->conn_zoneid != zoneid && zoneid != ALL_ZONES) {
11699 		/*
11700 		 * Multicast packet on the loopback interface: we only match
11701 		 * conns who joined the group in the specified zone.
11702 		 */
11703 		return (B_FALSE);
11704 	}
11705 
11706 	mutex_enter(&connp->conn_lock);
11707 	wantpacket =
11708 	    ilg_lookup_ill_withsrc_v6(connp, v6dst_ptr, v6src_ptr, ill) != NULL;
11709 	mutex_exit(&connp->conn_lock);
11710 
11711 	return (wantpacket);
11712 }
11713 
11714 
11715 /*
11716  * Transmit a packet and update any NUD state based on the flags
11717  * XXX need to "recover" any ip6i_t when doing putq!
11718  *
11719  * NOTE : This function does not ire_refrele the ire passed in as the
11720  * argument.
11721  */
11722 void
11723 ip_xmit_v6(mblk_t *mp, ire_t *ire, uint_t flags, conn_t *connp,
11724     int caller, ipsec_out_t *io)
11725 {
11726 	mblk_t		*mp1;
11727 	nce_t		*nce = ire->ire_nce;
11728 	ill_t		*ill;
11729 	uint64_t	delta;
11730 	ip6_t		*ip6h;
11731 	queue_t		*stq = ire->ire_stq;
11732 	ire_t		*ire1 = NULL;
11733 	ire_t		*save_ire = ire;
11734 	boolean_t	multirt_send = B_FALSE;
11735 	mblk_t		*next_mp = NULL;
11736 
11737 	ip6h = (ip6_t *)mp->b_rptr;
11738 	ASSERT(!IN6_IS_ADDR_V4MAPPED(&ire->ire_addr_v6));
11739 	ASSERT(ire->ire_ipversion == IPV6_VERSION);
11740 	ASSERT(nce != NULL);
11741 	ASSERT(mp->b_datap->db_type == M_DATA);
11742 	ASSERT(stq != NULL);
11743 
11744 	ill = ire_to_ill(ire);
11745 	if (!ill) {
11746 		ip0dbg(("ip_xmit_v6: ire_to_ill failed\n"));
11747 		freemsg(mp);
11748 		return;
11749 	}
11750 
11751 	/*
11752 	 * If a packet is to be sent out an interface that is a 6to4
11753 	 * tunnel, outgoing IPv6 packets, with a 6to4 addressed IPv6
11754 	 * destination, must be checked to have a 6to4 prefix
11755 	 * (2002:V4ADDR::/48) that is NOT equal to the 6to4 prefix of
11756 	 * address configured on the sending interface.  Otherwise,
11757 	 * the packet was delivered to this interface in error and the
11758 	 * packet must be dropped.
11759 	 */
11760 	if ((ill->ill_is_6to4tun) && IN6_IS_ADDR_6TO4(&ip6h->ip6_dst)) {
11761 		ipif_t *ipif = ill->ill_ipif;
11762 
11763 		if (IN6_ARE_6TO4_PREFIX_EQUAL(&ipif->ipif_v6lcl_addr,
11764 		    &ip6h->ip6_dst)) {
11765 			if (ip_debug > 2) {
11766 				/* ip1dbg */
11767 				pr_addr_dbg("ip_xmit_v6: attempting to "
11768 				    "send 6to4 addressed IPv6 "
11769 				    "destination (%s) out the wrong "
11770 				    "interface.\n", AF_INET6,
11771 				    &ip6h->ip6_dst);
11772 			}
11773 			BUMP_MIB(ill->ill_ip6_mib, ipv6OutDiscards);
11774 			freemsg(mp);
11775 			return;
11776 		}
11777 	}
11778 
11779 	/* Flow-control check has been done in ip_wput_ire_v6 */
11780 	if (IP_FLOW_CONTROLLED_ULP(ip6h->ip6_nxt) || caller == IP_WPUT ||
11781 	    caller == IP_WSRV || canput(stq->q_next)) {
11782 		uint32_t ill_index;
11783 
11784 		/*
11785 		 * In most cases, the emission loop below is entered only
11786 		 * once. Only in the case where the ire holds the
11787 		 * RTF_MULTIRT flag, do we loop to process all RTF_MULTIRT
11788 		 * flagged ires in the bucket, and send the packet
11789 		 * through all crossed RTF_MULTIRT routes.
11790 		 */
11791 		if (ire->ire_flags & RTF_MULTIRT) {
11792 			/*
11793 			 * Multirouting case. The bucket where ire is stored
11794 			 * probably holds other RTF_MULTIRT flagged ires
11795 			 * to the destination. In this call to ip_xmit_v6,
11796 			 * we attempt to send the packet through all
11797 			 * those ires. Thus, we first ensure that ire is the
11798 			 * first RTF_MULTIRT ire in the bucket,
11799 			 * before walking the ire list.
11800 			 */
11801 			ire_t *first_ire;
11802 			irb_t *irb = ire->ire_bucket;
11803 			ASSERT(irb != NULL);
11804 			multirt_send = B_TRUE;
11805 
11806 			/* Make sure we do not omit any multiroute ire. */
11807 			IRB_REFHOLD(irb);
11808 			for (first_ire = irb->irb_ire;
11809 			    first_ire != NULL;
11810 			    first_ire = first_ire->ire_next) {
11811 				if ((first_ire->ire_flags & RTF_MULTIRT) &&
11812 				    (IN6_ARE_ADDR_EQUAL(&first_ire->ire_addr_v6,
11813 				    &ire->ire_addr_v6)) &&
11814 				    !(first_ire->ire_marks &
11815 					(IRE_MARK_CONDEMNED | IRE_MARK_HIDDEN)))
11816 					break;
11817 			}
11818 
11819 			if ((first_ire != NULL) && (first_ire != ire)) {
11820 				IRE_REFHOLD(first_ire);
11821 				/* ire will be released by the caller */
11822 				ire = first_ire;
11823 				nce = ire->ire_nce;
11824 				stq = ire->ire_stq;
11825 				ill = ire_to_ill(ire);
11826 			}
11827 			IRB_REFRELE(irb);
11828 		} else if (connp != NULL && IPCL_IS_TCP(connp) &&
11829 		    connp->conn_mdt_ok && !connp->conn_tcp->tcp_mdt &&
11830 		    ILL_MDT_USABLE(ill)) {
11831 			/*
11832 			 * This tcp connection was marked as MDT-capable, but
11833 			 * it has been turned off due changes in the interface.
11834 			 * Now that the interface support is back, turn it on
11835 			 * by notifying tcp.  We don't directly modify tcp_mdt,
11836 			 * since we leave all the details to the tcp code that
11837 			 * knows better.
11838 			 */
11839 			mblk_t *mdimp = ip_mdinfo_alloc(ill->ill_mdt_capab);
11840 
11841 			if (mdimp == NULL) {
11842 				ip0dbg(("ip_xmit_v6: can't re-enable MDT for "
11843 				    "connp %p (ENOMEM)\n", (void *)connp));
11844 			} else {
11845 				CONN_INC_REF(connp);
11846 				squeue_fill(connp->conn_sqp, mdimp, tcp_input,
11847 				    connp, SQTAG_TCP_INPUT_MCTL);
11848 			}
11849 		}
11850 
11851 		do {
11852 			boolean_t	qos_done = B_FALSE;
11853 
11854 			if (multirt_send) {
11855 				irb_t *irb;
11856 				/*
11857 				 * We are in a multiple send case, need to get
11858 				 * the next ire and make a duplicate of the
11859 				 * packet. ire1 holds here the next ire to
11860 				 * process in the bucket. If multirouting is
11861 				 * expected, any non-RTF_MULTIRT ire that has
11862 				 * the right destination address is ignored.
11863 				 */
11864 				irb = ire->ire_bucket;
11865 				ASSERT(irb != NULL);
11866 
11867 				IRB_REFHOLD(irb);
11868 				for (ire1 = ire->ire_next;
11869 				    ire1 != NULL;
11870 				    ire1 = ire1->ire_next) {
11871 					if (!(ire1->ire_flags & RTF_MULTIRT))
11872 						continue;
11873 					if (!IN6_ARE_ADDR_EQUAL(
11874 					    &ire1->ire_addr_v6,
11875 					    &ire->ire_addr_v6))
11876 						continue;
11877 					if (ire1->ire_marks &
11878 					    (IRE_MARK_CONDEMNED|
11879 					    IRE_MARK_HIDDEN))
11880 						continue;
11881 
11882 					/* Got one */
11883 					if (ire1 != save_ire) {
11884 						IRE_REFHOLD(ire1);
11885 					}
11886 					break;
11887 				}
11888 				IRB_REFRELE(irb);
11889 
11890 				if (ire1 != NULL) {
11891 					next_mp = copyb(mp);
11892 					if ((next_mp == NULL) ||
11893 					    ((mp->b_cont != NULL) &&
11894 						((next_mp->b_cont =
11895 						    dupmsg(mp->b_cont)) ==
11896 						    NULL))) {
11897 						freemsg(next_mp);
11898 						next_mp = NULL;
11899 						ire_refrele(ire1);
11900 						ire1 = NULL;
11901 					}
11902 				}
11903 
11904 				/* Last multiroute ire; don't loop anymore. */
11905 				if (ire1 == NULL) {
11906 					multirt_send = B_FALSE;
11907 				}
11908 			}
11909 
11910 			ill_index =
11911 			    ((ill_t *)stq->q_ptr)->ill_phyint->phyint_ifindex;
11912 
11913 			/*
11914 			 * Check for fastpath, we need to hold nce_lock to
11915 			 * prevent fastpath update from chaining nce_fp_mp.
11916 			 */
11917 			mutex_enter(&nce->nce_lock);
11918 			if ((mp1 = nce->nce_fp_mp) != NULL) {
11919 				uint32_t hlen;
11920 				uchar_t	*rptr;
11921 
11922 				/* Initiate IPPF processing */
11923 				if (IP6_OUT_IPP(flags)) {
11924 					/*
11925 					 * We have to release the nce lock since
11926 					 * IPPF components use
11927 					 * ill_lookup_on_ifindex(),
11928 					 * which takes the ill_g_lock and the
11929 					 * ill_lock locks.
11930 					 */
11931 					mutex_exit(&nce->nce_lock);
11932 					ip_process(IPP_LOCAL_OUT, &mp,
11933 					    ill_index);
11934 					if (mp == NULL) {
11935 						BUMP_MIB(
11936 						    ill->ill_ip6_mib,
11937 						    ipv6OutDiscards);
11938 						if (next_mp != NULL)
11939 							freemsg(next_mp);
11940 						if (ire != save_ire) {
11941 							ire_refrele(ire);
11942 						}
11943 						return;
11944 					}
11945 					mutex_enter(&nce->nce_lock);
11946 					if ((mp1 = nce->nce_fp_mp) == NULL) {
11947 						/*
11948 						 * Probably disappeared during
11949 						 * IPQoS processing.
11950 						 */
11951 						qos_done = B_TRUE;
11952 						goto prepend_unitdata;
11953 					}
11954 				}
11955 				hlen = MBLKL(mp1);
11956 				rptr = mp->b_rptr - hlen;
11957 				/*
11958 				 * make sure there is room for the fastpath
11959 				 * datalink header
11960 				 */
11961 				if (rptr < mp->b_datap->db_base) {
11962 					mp1 = copyb(mp1);
11963 					if (mp1 == NULL) {
11964 						mutex_exit(&nce->nce_lock);
11965 						BUMP_MIB(ill->ill_ip6_mib,
11966 						    ipv6OutDiscards);
11967 						freemsg(mp);
11968 						if (next_mp != NULL)
11969 							freemsg(next_mp);
11970 						if (ire != save_ire) {
11971 							ire_refrele(ire);
11972 						}
11973 						return;
11974 					}
11975 					mp1->b_cont = mp;
11976 
11977 					/* Get the priority marking, if any */
11978 					mp1->b_band = mp->b_band;
11979 					mp = mp1;
11980 				} else {
11981 					mp->b_rptr = rptr;
11982 					/*
11983 					 * fastpath -  pre-pend datalink
11984 					 * header
11985 					 */
11986 					bcopy(mp1->b_rptr, rptr, hlen);
11987 				}
11988 
11989 				mutex_exit(&nce->nce_lock);
11990 
11991 			} else {
11992 		prepend_unitdata:
11993 				mutex_exit(&nce->nce_lock);
11994 				mp1 = nce->nce_res_mp;
11995 				if (mp1 == NULL) {
11996 					ip1dbg(("ip_xmit_v6: No resolution "
11997 					    "block ire = %p\n", (void *)ire));
11998 					freemsg(mp);
11999 					if (next_mp != NULL)
12000 						freemsg(next_mp);
12001 					if (ire != save_ire) {
12002 						ire_refrele(ire);
12003 					}
12004 					return;
12005 				}
12006 				/*
12007 				 * Prepend the DL_UNITDATA_REQ.
12008 				 */
12009 				mp1 = copyb(mp1);
12010 				if (mp1 == NULL) {
12011 					BUMP_MIB(ill->ill_ip6_mib,
12012 					    ipv6OutDiscards);
12013 					freemsg(mp);
12014 					if (next_mp != NULL)
12015 						freemsg(next_mp);
12016 					if (ire != save_ire) {
12017 						ire_refrele(ire);
12018 					}
12019 					return;
12020 				}
12021 				mp1->b_cont = mp;
12022 				mp = mp1;
12023 				/*
12024 				 * Initiate IPPF processing, if it is
12025 				 * already done, bypass.
12026 				 */
12027 				if (!qos_done && IP6_OUT_IPP(flags)) {
12028 					ip_process(IPP_LOCAL_OUT, &mp,
12029 					    ill_index);
12030 					if (mp == NULL) {
12031 						BUMP_MIB(ill->ill_ip6_mib,
12032 						    ipv6OutDiscards);
12033 						if (next_mp != NULL)
12034 							freemsg(next_mp);
12035 						if (ire != save_ire) {
12036 							ire_refrele(ire);
12037 						}
12038 						return;
12039 					}
12040 				}
12041 			}
12042 
12043 			/*
12044 			 * Update ire counters; for save_ire, this has been
12045 			 * done by the caller.
12046 			 */
12047 			if (ire != save_ire) {
12048 				UPDATE_OB_PKT_COUNT(ire);
12049 				ire->ire_last_used_time = lbolt;
12050 			}
12051 
12052 			/*
12053 			 * Send it down.  XXX Do we want to flow control AH/ESP
12054 			 * packets that carry TCP payloads?  We don't flow
12055 			 * control TCP packets, but we should also not
12056 			 * flow-control TCP packets that have been protected.
12057 			 * We don't have an easy way to find out if an AH/ESP
12058 			 * packet was originally TCP or not currently.
12059 			 */
12060 			if (io == NULL) {
12061 				putnext(stq, mp);
12062 			} else {
12063 				/*
12064 				 * Safety Pup says: make sure this is
12065 				 * going to the right interface!
12066 				 */
12067 				if (io->ipsec_out_capab_ill_index !=
12068 				    ill_index) {
12069 					/* IPsec kstats: bump lose counter */
12070 					freemsg(mp1);
12071 				} else {
12072 					ipsec_hw_putnext(stq, mp);
12073 				}
12074 			}
12075 
12076 			if (nce->nce_flags & (NCE_F_NONUD|NCE_F_PERMANENT)) {
12077 				if (ire != save_ire) {
12078 					ire_refrele(ire);
12079 				}
12080 				if (multirt_send) {
12081 					ASSERT(ire1 != NULL);
12082 					/*
12083 					 * Proceed with the next RTF_MULTIRT
12084 					 * ire, also set up the send-to queue
12085 					 * accordingly.
12086 					 */
12087 					ire = ire1;
12088 					ire1 = NULL;
12089 					stq = ire->ire_stq;
12090 					nce = ire->ire_nce;
12091 					ill = ire_to_ill(ire);
12092 					mp = next_mp;
12093 					next_mp = NULL;
12094 					continue;
12095 				}
12096 				ASSERT(next_mp == NULL);
12097 				ASSERT(ire1 == NULL);
12098 				return;
12099 			}
12100 
12101 			ASSERT(nce->nce_state != ND_INCOMPLETE);
12102 
12103 			/*
12104 			 * Check for upper layer advice
12105 			 */
12106 			if (flags & IPV6_REACHABILITY_CONFIRMATION) {
12107 				/*
12108 				 * It should be o.k. to check the state without
12109 				 * a lock here, at most we lose an advice.
12110 				 */
12111 				nce->nce_last = TICK_TO_MSEC(lbolt64);
12112 				if (nce->nce_state != ND_REACHABLE) {
12113 
12114 					mutex_enter(&nce->nce_lock);
12115 					nce->nce_state = ND_REACHABLE;
12116 					nce->nce_pcnt = ND_MAX_UNICAST_SOLICIT;
12117 					mutex_exit(&nce->nce_lock);
12118 					(void) untimeout(nce->nce_timeout_id);
12119 					if (ip_debug > 2) {
12120 						/* ip1dbg */
12121 						pr_addr_dbg("ip_xmit_v6: state"
12122 						    " for %s changed to"
12123 						    " REACHABLE\n", AF_INET6,
12124 						    &ire->ire_addr_v6);
12125 					}
12126 				}
12127 				if (ire != save_ire) {
12128 					ire_refrele(ire);
12129 				}
12130 				if (multirt_send) {
12131 					ASSERT(ire1 != NULL);
12132 					/*
12133 					 * Proceed with the next RTF_MULTIRT
12134 					 * ire, also set up the send-to queue
12135 					 * accordingly.
12136 					 */
12137 					ire = ire1;
12138 					ire1 = NULL;
12139 					stq = ire->ire_stq;
12140 					nce = ire->ire_nce;
12141 					ill = ire_to_ill(ire);
12142 					mp = next_mp;
12143 					next_mp = NULL;
12144 					continue;
12145 				}
12146 				ASSERT(next_mp == NULL);
12147 				ASSERT(ire1 == NULL);
12148 				return;
12149 			}
12150 
12151 			delta =  TICK_TO_MSEC(lbolt64) - nce->nce_last;
12152 			ip1dbg(("ip_xmit_v6: delta = %" PRId64
12153 			    " ill_reachable_time = %d \n", delta,
12154 			    ill->ill_reachable_time));
12155 			if (delta > (uint64_t)ill->ill_reachable_time) {
12156 				nce = ire->ire_nce;
12157 				mutex_enter(&nce->nce_lock);
12158 				switch (nce->nce_state) {
12159 				case ND_REACHABLE:
12160 				case ND_STALE:
12161 					/*
12162 					 * ND_REACHABLE is identical to
12163 					 * ND_STALE in this specific case. If
12164 					 * reachable time has expired for this
12165 					 * neighbor (delta is greater than
12166 					 * reachable time), conceptually, the
12167 					 * neighbor cache is no longer in
12168 					 * REACHABLE state, but already in
12169 					 * STALE state.  So the correct
12170 					 * transition here is to ND_DELAY.
12171 					 */
12172 					nce->nce_state = ND_DELAY;
12173 					mutex_exit(&nce->nce_lock);
12174 					NDP_RESTART_TIMER(nce,
12175 					    delay_first_probe_time);
12176 					if (ip_debug > 3) {
12177 						/* ip2dbg */
12178 						pr_addr_dbg("ip_xmit_v6: state"
12179 						    " for %s changed to"
12180 						    " DELAY\n", AF_INET6,
12181 						    &ire->ire_addr_v6);
12182 					}
12183 					break;
12184 				case ND_DELAY:
12185 				case ND_PROBE:
12186 					mutex_exit(&nce->nce_lock);
12187 					/* Timers have already started */
12188 					break;
12189 				case ND_UNREACHABLE:
12190 					/*
12191 					 * ndp timer has detected that this nce
12192 					 * is unreachable and initiated deleting
12193 					 * this nce and all its associated IREs.
12194 					 * This is a race where we found the
12195 					 * ire before it was deleted and have
12196 					 * just sent out a packet using this
12197 					 * unreachable nce.
12198 					 */
12199 					mutex_exit(&nce->nce_lock);
12200 					break;
12201 				default:
12202 					ASSERT(0);
12203 				}
12204 			}
12205 
12206 			if (multirt_send) {
12207 				ASSERT(ire1 != NULL);
12208 				/*
12209 				 * Proceed with the next RTF_MULTIRT ire,
12210 				 * Also set up the send-to queue accordingly.
12211 				 */
12212 				if (ire != save_ire) {
12213 					ire_refrele(ire);
12214 				}
12215 				ire = ire1;
12216 				ire1 = NULL;
12217 				stq = ire->ire_stq;
12218 				nce = ire->ire_nce;
12219 				ill = ire_to_ill(ire);
12220 				mp = next_mp;
12221 				next_mp = NULL;
12222 			}
12223 		} while (multirt_send);
12224 		/*
12225 		 * In the multirouting case, release the last ire used for
12226 		 * emission. save_ire will be released by the caller.
12227 		 */
12228 		if (ire != save_ire) {
12229 			ire_refrele(ire);
12230 		}
12231 	} else {
12232 		/*
12233 		 * Queue packet if we have an conn to give back pressure.
12234 		 * We can't queue packets intended for hardware acceleration
12235 		 * since we've tossed that state already. If the packet is
12236 		 * being fed back from ire_send_v6, we don't know the
12237 		 * position in the queue to enqueue the packet and we discard
12238 		 * the packet.
12239 		 */
12240 		if (ip_output_queue && (connp != NULL) && (io == NULL) &&
12241 		    (caller != IRE_SEND)) {
12242 			if (caller == IP_WSRV) {
12243 				connp->conn_did_putbq = 1;
12244 				(void) putbq(connp->conn_wq, mp);
12245 				conn_drain_insert(connp);
12246 				/*
12247 				 * caller == IP_WSRV implies we are
12248 				 * the service thread, and the
12249 				 * queue is already noenabled.
12250 				 * The check for canput and
12251 				 * the putbq is not atomic.
12252 				 * So we need to check again.
12253 				 */
12254 				if (canput(stq->q_next))
12255 					connp->conn_did_putbq = 0;
12256 			} else {
12257 				(void) putq(connp->conn_wq, mp);
12258 			}
12259 			return;
12260 		}
12261 		BUMP_MIB(ill->ill_ip6_mib, ipv6OutDiscards);
12262 		freemsg(mp);
12263 		return;
12264 	}
12265 }
12266 
12267 /*
12268  * pr_addr_dbg function provides the needed buffer space to call
12269  * inet_ntop() function's 3rd argument. This function should be
12270  * used by any kernel routine which wants to save INET6_ADDRSTRLEN
12271  * stack buffer space in it's own stack frame. This function uses
12272  * a buffer from it's own stack and prints the information.
12273  * Example: pr_addr_dbg("func: no route for %s\n ", AF_INET, addr)
12274  *
12275  * Note:    This function can call inet_ntop() once.
12276  */
12277 void
12278 pr_addr_dbg(char *fmt1, int af, const void *addr)
12279 {
12280 	char	buf[INET6_ADDRSTRLEN];
12281 
12282 	if (fmt1 == NULL) {
12283 		ip0dbg(("pr_addr_dbg: Wrong arguments\n"));
12284 		return;
12285 	}
12286 
12287 	/*
12288 	 * This does not compare debug level and just prints
12289 	 * out. Thus it is the responsibility of the caller
12290 	 * to check the appropriate debug-level before calling
12291 	 * this function.
12292 	 */
12293 	if (ip_debug > 0) {
12294 		printf(fmt1, inet_ntop(af, addr, buf, sizeof (buf)));
12295 	}
12296 
12297 
12298 }
12299 
12300 
12301 /*
12302  * Return the length in bytes of the IPv6 headers (base header, ip6i_t
12303  * if needed and extension headers) that will be needed based on the
12304  * ip6_pkt_t structure passed by the caller.
12305  *
12306  * The returned length does not include the length of the upper level
12307  * protocol (ULP) header.
12308  */
12309 int
12310 ip_total_hdrs_len_v6(ip6_pkt_t *ipp)
12311 {
12312 	int len;
12313 
12314 	len = IPV6_HDR_LEN;
12315 	if (ipp->ipp_fields & IPPF_HAS_IP6I)
12316 		len += sizeof (ip6i_t);
12317 	if (ipp->ipp_fields & IPPF_HOPOPTS) {
12318 		ASSERT(ipp->ipp_hopoptslen != 0);
12319 		len += ipp->ipp_hopoptslen;
12320 	}
12321 	if (ipp->ipp_fields & IPPF_RTHDR) {
12322 		ASSERT(ipp->ipp_rthdrlen != 0);
12323 		len += ipp->ipp_rthdrlen;
12324 	}
12325 	/*
12326 	 * En-route destination options
12327 	 * Only do them if there's a routing header as well
12328 	 */
12329 	if ((ipp->ipp_fields & (IPPF_RTDSTOPTS|IPPF_RTHDR)) ==
12330 	    (IPPF_RTDSTOPTS|IPPF_RTHDR)) {
12331 		ASSERT(ipp->ipp_rtdstoptslen != 0);
12332 		len += ipp->ipp_rtdstoptslen;
12333 	}
12334 	if (ipp->ipp_fields & IPPF_DSTOPTS) {
12335 		ASSERT(ipp->ipp_dstoptslen != 0);
12336 		len += ipp->ipp_dstoptslen;
12337 	}
12338 	return (len);
12339 }
12340 
12341 /*
12342  * All-purpose routine to build a header chain of an IPv6 header
12343  * followed by any required extension headers and a proto header,
12344  * preceeded (where necessary) by an ip6i_t private header.
12345  *
12346  * The fields of the IPv6 header that are derived from the ip6_pkt_t
12347  * will be filled in appropriately.
12348  * Thus the caller must fill in the rest of the IPv6 header, such as
12349  * traffic class/flowid, source address (if not set here), hoplimit (if not
12350  * set here) and destination address.
12351  *
12352  * The extension headers and ip6i_t header will all be fully filled in.
12353  */
12354 void
12355 ip_build_hdrs_v6(uchar_t *ext_hdrs, uint_t ext_hdrs_len,
12356     ip6_pkt_t *ipp, uint8_t protocol)
12357 {
12358 	uint8_t *nxthdr_ptr;
12359 	uint8_t *cp;
12360 	ip6i_t	*ip6i;
12361 	ip6_t	*ip6h = (ip6_t *)ext_hdrs;
12362 
12363 	/*
12364 	 * If sending private ip6i_t header down (checksum info, nexthop,
12365 	 * or ifindex), adjust ip header pointer and set ip6i_t header pointer,
12366 	 * then fill it in. (The checksum info will be filled in by icmp).
12367 	 */
12368 	if (ipp->ipp_fields & IPPF_HAS_IP6I) {
12369 		ip6i = (ip6i_t *)ip6h;
12370 		ip6h = (ip6_t *)&ip6i[1];
12371 
12372 		ip6i->ip6i_flags = 0;
12373 		ip6i->ip6i_vcf = IPV6_DEFAULT_VERS_AND_FLOW;
12374 		if (ipp->ipp_fields & IPPF_IFINDEX ||
12375 		    ipp->ipp_fields & IPPF_SCOPE_ID) {
12376 			ASSERT(ipp->ipp_ifindex != 0);
12377 			ip6i->ip6i_flags |= IP6I_IFINDEX;
12378 			ip6i->ip6i_ifindex = ipp->ipp_ifindex;
12379 		}
12380 		if (ipp->ipp_fields & IPPF_ADDR) {
12381 			/*
12382 			 * Enable per-packet source address verification if
12383 			 * IPV6_PKTINFO specified the source address.
12384 			 * ip6_src is set in the transport's _wput function.
12385 			 */
12386 			ASSERT(!IN6_IS_ADDR_UNSPECIFIED(
12387 			    &ipp->ipp_addr));
12388 			ip6i->ip6i_flags |= IP6I_VERIFY_SRC;
12389 		}
12390 		if (ipp->ipp_fields & IPPF_UNICAST_HOPS) {
12391 			ip6h->ip6_hops = ipp->ipp_unicast_hops;
12392 			/*
12393 			 * We need to set this flag so that IP doesn't
12394 			 * rewrite the IPv6 header's hoplimit with the
12395 			 * current default value.
12396 			 */
12397 			ip6i->ip6i_flags |= IP6I_HOPLIMIT;
12398 		}
12399 		if (ipp->ipp_fields & IPPF_NEXTHOP) {
12400 			ASSERT(!IN6_IS_ADDR_UNSPECIFIED(
12401 			    &ipp->ipp_nexthop));
12402 			ip6i->ip6i_flags |= IP6I_NEXTHOP;
12403 			ip6i->ip6i_nexthop = ipp->ipp_nexthop;
12404 		}
12405 		/*
12406 		 * tell IP this is an ip6i_t private header
12407 		 */
12408 		ip6i->ip6i_nxt = IPPROTO_RAW;
12409 	}
12410 	/* Initialize IPv6 header */
12411 	ip6h->ip6_vcf = IPV6_DEFAULT_VERS_AND_FLOW;
12412 	if (ipp->ipp_fields & IPPF_TCLASS) {
12413 		ip6h->ip6_vcf = (ip6h->ip6_vcf & ~IPV6_FLOWINFO_TCLASS) |
12414 		    (ipp->ipp_tclass << 20);
12415 	}
12416 	if (ipp->ipp_fields & IPPF_ADDR)
12417 		ip6h->ip6_src = ipp->ipp_addr;
12418 
12419 	nxthdr_ptr = (uint8_t *)&ip6h->ip6_nxt;
12420 	cp = (uint8_t *)&ip6h[1];
12421 	/*
12422 	 * Here's where we have to start stringing together
12423 	 * any extension headers in the right order:
12424 	 * Hop-by-hop, destination, routing, and final destination opts.
12425 	 */
12426 	if (ipp->ipp_fields & IPPF_HOPOPTS) {
12427 		/* Hop-by-hop options */
12428 		ip6_hbh_t *hbh = (ip6_hbh_t *)cp;
12429 
12430 		*nxthdr_ptr = IPPROTO_HOPOPTS;
12431 		nxthdr_ptr = &hbh->ip6h_nxt;
12432 
12433 		bcopy(ipp->ipp_hopopts, cp, ipp->ipp_hopoptslen);
12434 		cp += ipp->ipp_hopoptslen;
12435 	}
12436 	/*
12437 	 * En-route destination options
12438 	 * Only do them if there's a routing header as well
12439 	 */
12440 	if ((ipp->ipp_fields & (IPPF_RTDSTOPTS|IPPF_RTHDR)) ==
12441 	    (IPPF_RTDSTOPTS|IPPF_RTHDR)) {
12442 		ip6_dest_t *dst = (ip6_dest_t *)cp;
12443 
12444 		*nxthdr_ptr = IPPROTO_DSTOPTS;
12445 		nxthdr_ptr = &dst->ip6d_nxt;
12446 
12447 		bcopy(ipp->ipp_rtdstopts, cp, ipp->ipp_rtdstoptslen);
12448 		cp += ipp->ipp_rtdstoptslen;
12449 	}
12450 	/*
12451 	 * Routing header next
12452 	 */
12453 	if (ipp->ipp_fields & IPPF_RTHDR) {
12454 		ip6_rthdr_t *rt = (ip6_rthdr_t *)cp;
12455 
12456 		*nxthdr_ptr = IPPROTO_ROUTING;
12457 		nxthdr_ptr = &rt->ip6r_nxt;
12458 
12459 		bcopy(ipp->ipp_rthdr, cp, ipp->ipp_rthdrlen);
12460 		cp += ipp->ipp_rthdrlen;
12461 	}
12462 	/*
12463 	 * Do ultimate destination options
12464 	 */
12465 	if (ipp->ipp_fields & IPPF_DSTOPTS) {
12466 		ip6_dest_t *dest = (ip6_dest_t *)cp;
12467 
12468 		*nxthdr_ptr = IPPROTO_DSTOPTS;
12469 		nxthdr_ptr = &dest->ip6d_nxt;
12470 
12471 		bcopy(ipp->ipp_dstopts, cp, ipp->ipp_dstoptslen);
12472 		cp += ipp->ipp_dstoptslen;
12473 	}
12474 	/*
12475 	 * Now set the last header pointer to the proto passed in
12476 	 */
12477 	*nxthdr_ptr = protocol;
12478 	ASSERT((int)(cp - ext_hdrs) == ext_hdrs_len);
12479 }
12480 
12481 /*
12482  * Return a pointer to the routing header extension header
12483  * in the IPv6 header(s) chain passed in.
12484  * If none found, return NULL
12485  * Assumes that all extension headers are in same mblk as the v6 header
12486  */
12487 ip6_rthdr_t *
12488 ip_find_rthdr_v6(ip6_t *ip6h, uint8_t *endptr)
12489 {
12490 	ip6_dest_t	*desthdr;
12491 	ip6_frag_t	*fraghdr;
12492 	uint_t		hdrlen;
12493 	uint8_t		nexthdr;
12494 	uint8_t		*ptr = (uint8_t *)&ip6h[1];
12495 
12496 	if (ip6h->ip6_nxt == IPPROTO_ROUTING)
12497 		return ((ip6_rthdr_t *)ptr);
12498 
12499 	/*
12500 	 * The routing header will precede all extension headers
12501 	 * other than the hop-by-hop and destination options
12502 	 * extension headers, so if we see anything other than those,
12503 	 * we're done and didn't find it.
12504 	 * We could see a destination options header alone but no
12505 	 * routing header, in which case we'll return NULL as soon as
12506 	 * we see anything after that.
12507 	 * Hop-by-hop and destination option headers are identical,
12508 	 * so we can use either one we want as a template.
12509 	 */
12510 	nexthdr = ip6h->ip6_nxt;
12511 	while (ptr < endptr) {
12512 		/* Is there enough left for len + nexthdr? */
12513 		if (ptr + MIN_EHDR_LEN > endptr)
12514 			return (NULL);
12515 
12516 		switch (nexthdr) {
12517 		case IPPROTO_HOPOPTS:
12518 		case IPPROTO_DSTOPTS:
12519 			/* Assumes the headers are identical for hbh and dst */
12520 			desthdr = (ip6_dest_t *)ptr;
12521 			hdrlen = 8 * (desthdr->ip6d_len + 1);
12522 			nexthdr = desthdr->ip6d_nxt;
12523 			break;
12524 
12525 		case IPPROTO_ROUTING:
12526 			return ((ip6_rthdr_t *)ptr);
12527 
12528 		case IPPROTO_FRAGMENT:
12529 			fraghdr = (ip6_frag_t *)ptr;
12530 			hdrlen = sizeof (ip6_frag_t);
12531 			nexthdr = fraghdr->ip6f_nxt;
12532 			break;
12533 
12534 		default:
12535 			return (NULL);
12536 		}
12537 		ptr += hdrlen;
12538 	}
12539 	return (NULL);
12540 }
12541 
12542 /*
12543  * Called for source-routed packets originating on this node.
12544  * Manipulates the original routing header by moving every entry up
12545  * one slot, placing the first entry in the v6 header's v6_dst field,
12546  * and placing the ultimate destination in the routing header's last
12547  * slot.
12548  *
12549  * Returns the checksum diference between the ultimate destination
12550  * (last hop in the routing header when the packet is sent) and
12551  * the first hop (ip6_dst when the packet is sent)
12552  */
12553 uint32_t
12554 ip_massage_options_v6(ip6_t *ip6h, ip6_rthdr_t *rth)
12555 {
12556 	uint_t		numaddr;
12557 	uint_t		i;
12558 	in6_addr_t	*addrptr;
12559 	in6_addr_t	tmp;
12560 	ip6_rthdr0_t	*rthdr = (ip6_rthdr0_t *)rth;
12561 	uint32_t	cksm;
12562 	uint32_t	addrsum = 0;
12563 	uint16_t	*ptr;
12564 
12565 	/*
12566 	 * Perform any processing needed for source routing.
12567 	 * We know that all extension headers will be in the same mblk
12568 	 * as the IPv6 header.
12569 	 */
12570 
12571 	/*
12572 	 * If no segments left in header, or the header length field is zero,
12573 	 * don't move hop addresses around;
12574 	 * Checksum difference is zero.
12575 	 */
12576 	if ((rthdr->ip6r0_segleft == 0) || (rthdr->ip6r0_len == 0))
12577 		return (0);
12578 
12579 	ptr = (uint16_t *)&ip6h->ip6_dst;
12580 	cksm = 0;
12581 	for (i = 0; i < (sizeof (in6_addr_t) / sizeof (uint16_t)); i++) {
12582 		cksm += ptr[i];
12583 	}
12584 	cksm = (cksm & 0xFFFF) + (cksm >> 16);
12585 
12586 	/*
12587 	 * Here's where the fun begins - we have to
12588 	 * move all addresses up one spot, take the
12589 	 * first hop and make it our first ip6_dst,
12590 	 * and place the ultimate destination in the
12591 	 * newly-opened last slot.
12592 	 */
12593 	addrptr = (in6_addr_t *)((char *)rthdr + sizeof (*rthdr));
12594 	numaddr = rthdr->ip6r0_len / 2;
12595 	tmp = *addrptr;
12596 	for (i = 0; i < (numaddr - 1); addrptr++, i++) {
12597 		*addrptr = addrptr[1];
12598 	}
12599 	*addrptr = ip6h->ip6_dst;
12600 	ip6h->ip6_dst = tmp;
12601 
12602 	/*
12603 	 * From the checksummed ultimate destination subtract the checksummed
12604 	 * current ip6_dst (the first hop address). Return that number.
12605 	 * (In the v4 case, the second part of this is done in each routine
12606 	 *  that calls ip_massage_options(). We do it all in this one place
12607 	 *  for v6).
12608 	 */
12609 	ptr = (uint16_t *)&ip6h->ip6_dst;
12610 	for (i = 0; i < (sizeof (in6_addr_t) / sizeof (uint16_t)); i++) {
12611 		addrsum += ptr[i];
12612 	}
12613 	cksm -= ((addrsum >> 16) + (addrsum & 0xFFFF));
12614 	if ((int)cksm < 0)
12615 		cksm--;
12616 	cksm = (cksm & 0xFFFF) + (cksm >> 16);
12617 
12618 	return (cksm);
12619 }
12620 
12621 /*
12622  * See if the upper-level protocol indicated by 'proto' will be able
12623  * to do something with an ICMP_FRAGMENTATION_NEEDED (IPv4) or
12624  * ICMP6_PACKET_TOO_BIG (IPv6).
12625  */
12626 static boolean_t
12627 ip_ulp_cando_pkt2big(int proto)
12628 {
12629 	/*
12630 	 * For now, only TCP can handle this.
12631 	 * Tunnels may be able to also, but since tun isn't working over
12632 	 * IPv6 yet, don't worry about it for now.
12633 	 */
12634 	return (proto == IPPROTO_TCP);
12635 }
12636 
12637 
12638 /*
12639  * Propagate a multicast group membership operation (join/leave) (*fn) on
12640  * all interfaces crossed by the related multirt routes.
12641  * The call is considered successful if the operation succeeds
12642  * on at least one interface.
12643  * The function is called if the destination address in the packet to send
12644  * is multirouted.
12645  */
12646 int
12647 ip_multirt_apply_membership_v6(int (*fn)(conn_t *, boolean_t,
12648     const in6_addr_t *, int, mcast_record_t, const in6_addr_t *, mblk_t *),
12649     ire_t *ire, conn_t *connp, boolean_t checkonly, const in6_addr_t *v6grp,
12650     mcast_record_t fmode, const in6_addr_t *v6src, mblk_t *first_mp)
12651 {
12652 	ire_t		*ire_gw;
12653 	irb_t		*irb;
12654 	int		index, error = 0;
12655 	opt_restart_t	*or;
12656 
12657 	irb = ire->ire_bucket;
12658 	ASSERT(irb != NULL);
12659 
12660 	ASSERT(DB_TYPE(first_mp) == M_CTL);
12661 	or = (opt_restart_t *)first_mp->b_rptr;
12662 
12663 	IRB_REFHOLD(irb);
12664 	for (; ire != NULL; ire = ire->ire_next) {
12665 		if ((ire->ire_flags & RTF_MULTIRT) == 0)
12666 			continue;
12667 		if (!IN6_ARE_ADDR_EQUAL(&ire->ire_addr_v6, v6grp))
12668 			continue;
12669 
12670 		ire_gw = ire_ftable_lookup_v6(&ire->ire_gateway_addr_v6, 0, 0,
12671 		    IRE_INTERFACE, NULL, NULL, ALL_ZONES, 0, NULL,
12672 		    MATCH_IRE_RECURSIVE | MATCH_IRE_TYPE);
12673 		/* No resolver exists for the gateway; skip this ire. */
12674 		if (ire_gw == NULL)
12675 			continue;
12676 		index = ire_gw->ire_ipif->ipif_ill->ill_phyint->phyint_ifindex;
12677 		/*
12678 		 * A resolver exists: we can get the interface on which we have
12679 		 * to apply the operation.
12680 		 */
12681 		error = fn(connp, checkonly, v6grp, index, fmode, v6src,
12682 		    first_mp);
12683 		if (error == 0)
12684 			or->or_private = CGTP_MCAST_SUCCESS;
12685 
12686 		if (ip_debug > 0) {
12687 			ulong_t	off;
12688 			char	*ksym;
12689 
12690 			ksym = kobj_getsymname((uintptr_t)fn, &off);
12691 			ip2dbg(("ip_multirt_apply_membership_v6: "
12692 			    "called %s, multirt group 0x%08x via itf 0x%08x, "
12693 			    "error %d [success %u]\n",
12694 			    ksym ? ksym : "?",
12695 			    ntohl(V4_PART_OF_V6((*v6grp))),
12696 			    ntohl(V4_PART_OF_V6(ire_gw->ire_src_addr_v6)),
12697 			    error, or->or_private));
12698 		}
12699 
12700 		ire_refrele(ire_gw);
12701 		if (error == EINPROGRESS) {
12702 			IRB_REFRELE(irb);
12703 			return (error);
12704 		}
12705 	}
12706 	IRB_REFRELE(irb);
12707 	/*
12708 	 * Consider the call as successful if we succeeded on at least
12709 	 * one interface. Otherwise, return the last encountered error.
12710 	 */
12711 	return (or->or_private == CGTP_MCAST_SUCCESS ? 0 : error);
12712 }
12713 
12714 void
12715 ip6_kstat_init(void)
12716 {
12717 	if ((ip6_kstat = kstat_create("ip", 0, "ip6stat",
12718 		"net", KSTAT_TYPE_NAMED,
12719 		sizeof (ip6_statistics) / sizeof (kstat_named_t),
12720 		KSTAT_FLAG_VIRTUAL)) != NULL) {
12721 		ip6_kstat->ks_data = &ip6_statistics;
12722 		kstat_install(ip6_kstat);
12723 	}
12724 }
12725 
12726 /*
12727  * The following two functions set and get the value for the
12728  * IPV6_SRC_PREFERENCES socket option.
12729  */
12730 int
12731 ip6_set_src_preferences(conn_t *connp, uint32_t prefs)
12732 {
12733 	/*
12734 	 * We only support preferences that are covered by
12735 	 * IPV6_PREFER_SRC_MASK.
12736 	 */
12737 	if (prefs & ~IPV6_PREFER_SRC_MASK)
12738 		return (EINVAL);
12739 
12740 	/*
12741 	 * Look for conflicting preferences or default preferences.  If
12742 	 * both bits of a related pair are clear, the application wants the
12743 	 * system's default value for that pair.  Both bits in a pair can't
12744 	 * be set.
12745 	 */
12746 	if ((prefs & IPV6_PREFER_SRC_MIPMASK) == 0) {
12747 		prefs |= IPV6_PREFER_SRC_MIPDEFAULT;
12748 	} else if ((prefs & IPV6_PREFER_SRC_MIPMASK) ==
12749 	    IPV6_PREFER_SRC_MIPMASK) {
12750 		return (EINVAL);
12751 	}
12752 	if ((prefs & IPV6_PREFER_SRC_TMPMASK) == 0) {
12753 		prefs |= IPV6_PREFER_SRC_TMPDEFAULT;
12754 	} else if ((prefs & IPV6_PREFER_SRC_TMPMASK) ==
12755 	    IPV6_PREFER_SRC_TMPMASK) {
12756 		return (EINVAL);
12757 	}
12758 	if ((prefs & IPV6_PREFER_SRC_CGAMASK) == 0) {
12759 		prefs |= IPV6_PREFER_SRC_CGADEFAULT;
12760 	} else if ((prefs & IPV6_PREFER_SRC_CGAMASK) ==
12761 	    IPV6_PREFER_SRC_CGAMASK) {
12762 		return (EINVAL);
12763 	}
12764 
12765 	connp->conn_src_preferences = prefs;
12766 	return (0);
12767 }
12768 
12769 size_t
12770 ip6_get_src_preferences(conn_t *connp, uint32_t *val)
12771 {
12772 	*val = connp->conn_src_preferences;
12773 	return (sizeof (connp->conn_src_preferences));
12774 }
12775 
12776 int
12777 ip6_set_pktinfo(cred_t *cr, conn_t *connp, struct in6_pktinfo *pkti, mblk_t *mp)
12778 {
12779 	ill_t	*ill;
12780 	ire_t	*ire;
12781 	int	error;
12782 
12783 	/*
12784 	 * Verify the source address and ifindex. Privileged users can use
12785 	 * any source address.  For ancillary data the source address is
12786 	 * checked in ip_wput_v6.
12787 	 */
12788 	if (pkti->ipi6_ifindex != 0) {
12789 		ASSERT(connp != NULL);
12790 		ill = ill_lookup_on_ifindex(pkti->ipi6_ifindex, B_TRUE,
12791 		    CONNP_TO_WQ(connp), mp, ip_restart_optmgmt, &error);
12792 		if (ill == NULL) {
12793 			/*
12794 			 * We just want to know if the interface exists, we
12795 			 * don't really care about the ill pointer itself.
12796 			 */
12797 			if (error != EINPROGRESS)
12798 				return (error);
12799 			error = 0;	/* Ensure we don't use it below */
12800 		} else {
12801 			ill_refrele(ill);
12802 		}
12803 	}
12804 	if (!IN6_IS_ADDR_UNSPECIFIED(&pkti->ipi6_addr) &&
12805 	    secpolicy_net_rawaccess(cr) != 0) {
12806 		ire = ire_route_lookup_v6(&pkti->ipi6_addr, 0, 0,
12807 		    (IRE_LOCAL|IRE_LOOPBACK), NULL, NULL,
12808 		    connp->conn_zoneid, NULL, MATCH_IRE_TYPE);
12809 		if (ire != NULL)
12810 			ire_refrele(ire);
12811 		else
12812 			return (ENXIO);
12813 	}
12814 	return (0);
12815 }
12816 
12817 /*
12818  * Get the size of the IP options (including the IP headers size)
12819  * without including the AH header's size. If till_ah is B_FALSE,
12820  * and if AH header is present, dest options beyond AH header will
12821  * also be included in the returned size.
12822  */
12823 int
12824 ipsec_ah_get_hdr_size_v6(mblk_t *mp, boolean_t till_ah)
12825 {
12826 	ip6_t *ip6h;
12827 	uint8_t nexthdr;
12828 	uint8_t *whereptr;
12829 	ip6_hbh_t *hbhhdr;
12830 	ip6_dest_t *dsthdr;
12831 	ip6_rthdr_t *rthdr;
12832 	int ehdrlen;
12833 	int size;
12834 	ah_t *ah;
12835 
12836 	ip6h = (ip6_t *)mp->b_rptr;
12837 	size = IPV6_HDR_LEN;
12838 	nexthdr = ip6h->ip6_nxt;
12839 	whereptr = (uint8_t *)&ip6h[1];
12840 	for (;;) {
12841 		/* Assume IP has already stripped it */
12842 		ASSERT(nexthdr != IPPROTO_FRAGMENT && nexthdr != IPPROTO_RAW);
12843 		switch (nexthdr) {
12844 		case IPPROTO_HOPOPTS:
12845 			hbhhdr = (ip6_hbh_t *)whereptr;
12846 			nexthdr = hbhhdr->ip6h_nxt;
12847 			ehdrlen = 8 * (hbhhdr->ip6h_len + 1);
12848 			break;
12849 		case IPPROTO_DSTOPTS:
12850 			dsthdr = (ip6_dest_t *)whereptr;
12851 			nexthdr = dsthdr->ip6d_nxt;
12852 			ehdrlen = 8 * (dsthdr->ip6d_len + 1);
12853 			break;
12854 		case IPPROTO_ROUTING:
12855 			rthdr = (ip6_rthdr_t *)whereptr;
12856 			nexthdr = rthdr->ip6r_nxt;
12857 			ehdrlen = 8 * (rthdr->ip6r_len + 1);
12858 			break;
12859 		default :
12860 			if (till_ah) {
12861 				ASSERT(nexthdr == IPPROTO_AH);
12862 				return (size);
12863 			}
12864 			/*
12865 			 * If we don't have a AH header to traverse,
12866 			 * return now. This happens normally for
12867 			 * outbound datagrams where we have not inserted
12868 			 * the AH header.
12869 			 */
12870 			if (nexthdr != IPPROTO_AH) {
12871 				return (size);
12872 			}
12873 
12874 			/*
12875 			 * We don't include the AH header's size
12876 			 * to be symmetrical with other cases where
12877 			 * we either don't have a AH header (outbound)
12878 			 * or peek into the AH header yet (inbound and
12879 			 * not pulled up yet).
12880 			 */
12881 			ah = (ah_t *)whereptr;
12882 			nexthdr = ah->ah_nexthdr;
12883 			ehdrlen = (ah->ah_length << 2) + 8;
12884 
12885 			if (nexthdr == IPPROTO_DSTOPTS) {
12886 				if (whereptr + ehdrlen >= mp->b_wptr) {
12887 					/*
12888 					 * The destination options header
12889 					 * is not part of the first mblk.
12890 					 */
12891 					whereptr = mp->b_cont->b_rptr;
12892 				} else {
12893 					whereptr += ehdrlen;
12894 				}
12895 
12896 				dsthdr = (ip6_dest_t *)whereptr;
12897 				ehdrlen = 8 * (dsthdr->ip6d_len + 1);
12898 				size += ehdrlen;
12899 			}
12900 			return (size);
12901 		}
12902 		whereptr += ehdrlen;
12903 		size += ehdrlen;
12904 	}
12905 }
12906