--- old/usr/src/lib/libipsecutil/common/ipsec_util.c	Thu Jan 15 15:12:01 2015
+++ new/usr/src/lib/libipsecutil/common/ipsec_util.c	Thu Jan 15 15:12:01 2015
@@ -1779,6 +1779,7 @@
 	case SADB_SASTATE_DEAD:
 		(void) fprintf(file, dgettext(TEXT_DOMAIN, "DEAD"));
 		break;
+#if 0	/* DEPRECATED */
 	case SADB_X_SASTATE_ACTIVE_ELSEWHERE:
 		(void) fprintf(file, dgettext(TEXT_DOMAIN,
 		    "ACTIVE_ELSEWHERE"));
@@ -1786,6 +1787,7 @@
 	case SADB_X_SASTATE_IDLE:
 		(void) fprintf(file, dgettext(TEXT_DOMAIN, "IDLE"));
 		break;
+#endif
 	default:
 		(void) fprintf(file, dgettext(TEXT_DOMAIN,
 		    "<unknown %u>"), assoc->sadb_sa_state);
--- old/usr/src/uts/common/inet/ip/ip_sadb.c	Thu Jan 15 15:12:01 2015
+++ new/usr/src/uts/common/inet/ip/ip_sadb.c	Thu Jan 15 15:12:01 2015
@@ -729,8 +729,7 @@
 	assoc = ipsec_getassocbyspi(hptr, ah->ah_spi, src_ptr, dst_ptr, af);
 	mutex_exit(&hptr->isaf_lock);
 
-	if (assoc == NULL || assoc->ipsa_state == IPSA_STATE_DEAD ||
-	    assoc->ipsa_state == IPSA_STATE_ACTIVE_ELSEWHERE) {
+	if (assoc == NULL || assoc->ipsa_state == IPSA_STATE_DEAD) {
 		IP_AH_BUMP_STAT(ipss, lookup_failure);
 		IP_AH_BUMP_STAT(ipss, in_discards);
 		ipsecah_in_assocfailure(mp, 0,
@@ -871,8 +870,7 @@
 	    af);
 	mutex_exit(&bucket->isaf_lock);
 
-	if (ipsa == NULL || ipsa->ipsa_state == IPSA_STATE_DEAD ||
-	    ipsa->ipsa_state == IPSA_STATE_ACTIVE_ELSEWHERE) {
+	if (ipsa == NULL || ipsa->ipsa_state == IPSA_STATE_DEAD) {
 		/*  This is a loggable error!  AUDIT ME! */
 		IP_ESP_BUMP_STAT(ipss, lookup_failure);
 		IP_ESP_BUMP_STAT(ipss, in_discards);
--- old/usr/src/uts/common/inet/ip/ipsecah.c	Thu Jan 15 15:12:02 2015
+++ new/usr/src/uts/common/inet/ip/ipsecah.c	Thu Jan 15 15:12:02 2015
@@ -1087,8 +1087,7 @@
 	/* Sundry ADD-specific reality checks. */
 	/* XXX STATS : Logging/stats here? */
 
-	if ((assoc->sadb_sa_state != SADB_SASTATE_MATURE) &&
-	    (assoc->sadb_sa_state != SADB_X_SASTATE_ACTIVE_ELSEWHERE)) {
+	if (assoc->sadb_sa_state != SADB_SASTATE_MATURE) {
 		*diagnostic = SADB_X_DIAGNOSTIC_BAD_SASTATE;
 		return (EINVAL);
 	}
@@ -1166,11 +1165,8 @@
 ah_update_sa(mblk_t *mp, keysock_in_t *ksi, int *diagnostic,
     ipsecah_stack_t *ahstack, uint8_t sadb_msg_type)
 {
-	sadb_sa_t *assoc = (sadb_sa_t *)ksi->ks_in_extv[SADB_EXT_SA];
 	sadb_address_t *dstext =
 	    (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_DST];
-	mblk_t	*buf_pkt;
-	int rcode;
 
 	if (dstext == NULL) {
 		*diagnostic = SADB_X_DIAGNOSTIC_MISSING_DST;
@@ -1177,19 +1173,9 @@
 		return (EINVAL);
 	}
 
-	rcode = sadb_update_sa(mp, ksi, &buf_pkt, &ahstack->ah_sadb,
-	    diagnostic, ahstack->ah_pfkey_q, ah_add_sa,
-	    ahstack->ipsecah_netstack, sadb_msg_type);
-
-	if ((assoc->sadb_sa_state != SADB_X_SASTATE_ACTIVE) ||
-	    (rcode != 0)) {
-		return (rcode);
-	}
-
-	HANDLE_BUF_PKT(ah_taskq, ahstack->ipsecah_netstack->netstack_ipsec,
-	    ahstack->ah_dropper, buf_pkt);
-
-	return (rcode);
+	return (sadb_update_sa(mp, ksi, &ahstack->ah_sadb, diagnostic,
+	    ahstack->ah_pfkey_q, ah_add_sa, ahstack->ipsecah_netstack,
+	    sadb_msg_type));
 }
 
 /* Refactor me */
@@ -1336,7 +1322,6 @@
 		break;
 	case SADB_DELETE:
 	case SADB_X_DELPAIR:
-	case SADB_X_DELPAIR_STATE:
 		error = ah_del_sa(mp, ksi, &diagnostic, ahstack,
 		    samsg->sadb_msg_type);
 		if (error != 0) {
@@ -1910,7 +1895,7 @@
 	 */
 	(void) random_get_pseudo_bytes((uint8_t *)&newspi, sizeof (uint32_t));
 	newbie = sadb_getspi(ksi, newspi, &diagnostic,
-	    ahstack->ipsecah_netstack, IPPROTO_AH);
+	    ahstack->ipsecah_netstack);
 
 	if (newbie == NULL) {
 		sadb_pfkey_error(ahstack->ah_pfkey_q, mp, ENOMEM, diagnostic,
@@ -3834,15 +3819,6 @@
 		}
 	}
 
-	if (assoc->ipsa_state == IPSA_STATE_IDLE) {
-		/*
-		 * Cluster buffering case.  Tell caller that we're
-		 * handling the packet.
-		 */
-		sadb_buf_pkt(assoc, mp, ira);
-		return (NULL);
-	}
-
 	return (mp);
 
 ah_in_discard:
--- old/usr/src/uts/common/inet/ip/ipsecesp.c	Thu Jan 15 15:12:02 2015
+++ new/usr/src/uts/common/inet/ip/ipsecesp.c	Thu Jan 15 15:12:02 2015
@@ -1375,7 +1375,7 @@
 	 */
 	(void) random_get_pseudo_bytes((uint8_t *)&newspi, sizeof (uint32_t));
 	newbie = sadb_getspi(ksi, newspi, &diagnostic,
-	    espstack->ipsecesp_netstack, IPPROTO_ESP);
+	    espstack->ipsecesp_netstack);
 
 	if (newbie == NULL) {
 		sadb_pfkey_error(espstack->esp_pfkey_q, mp, ENOMEM, diagnostic,
@@ -1568,13 +1568,12 @@
 esp_port_freshness(uint32_t ports, ipsa_t *assoc)
 {
 	uint16_t remote = FIRST_16(ports);
-	uint16_t local = NEXT_16(ports);
 	ipsa_t *outbound_peer;
 	isaf_t *bucket;
 	ipsecesp_stack_t *espstack = assoc->ipsa_netstack->netstack_ipsecesp;
 
 	/* We found a conn_t, therefore local != 0. */
-	ASSERT(local != 0);
+	ASSERT(NEXT_16(ports) != 0);
 	/* Assume an IPv4 SA. */
 	ASSERT(assoc->ipsa_addrfam == AF_INET);
 
@@ -1753,15 +1752,6 @@
 		if (is_natt)
 			return (esp_fix_natt_checksums(data_mp, assoc));
 
-		if (assoc->ipsa_state == IPSA_STATE_IDLE) {
-			/*
-			 * Cluster buffering case.  Tell caller that we're
-			 * handling the packet.
-			 */
-			sadb_buf_pkt(assoc, data_mp, ira);
-			return (NULL);
-		}
-
 		return (data_mp);
 	}
 
@@ -3620,8 +3610,7 @@
 	/* Sundry ADD-specific reality checks. */
 	/* XXX STATS :  Logging/stats here? */
 
-	if ((assoc->sadb_sa_state != SADB_SASTATE_MATURE) &&
-	    (assoc->sadb_sa_state != SADB_X_SASTATE_ACTIVE_ELSEWHERE)) {
+	if (assoc->sadb_sa_state != SADB_SASTATE_MATURE) {
 		*diagnostic = SADB_X_DIAGNOSTIC_BAD_SASTATE;
 		return (EINVAL);
 	}
@@ -3790,10 +3779,6 @@
 esp_update_sa(mblk_t *mp, keysock_in_t *ksi, int *diagnostic,
     ipsecesp_stack_t *espstack, uint8_t sadb_msg_type)
 {
-	sadb_sa_t *assoc = (sadb_sa_t *)ksi->ks_in_extv[SADB_EXT_SA];
-	mblk_t    *buf_pkt;
-	int rcode;
-
 	sadb_address_t *dstext =
 	    (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_DST];
 
@@ -3802,19 +3787,9 @@
 		return (EINVAL);
 	}
 
-	rcode = sadb_update_sa(mp, ksi, &buf_pkt, &espstack->esp_sadb,
-	    diagnostic, espstack->esp_pfkey_q, esp_add_sa,
-	    espstack->ipsecesp_netstack, sadb_msg_type);
-
-	if ((assoc->sadb_sa_state != SADB_X_SASTATE_ACTIVE) ||
-	    (rcode != 0)) {
-		return (rcode);
-	}
-
-	HANDLE_BUF_PKT(esp_taskq, espstack->ipsecesp_netstack->netstack_ipsec,
-	    espstack->esp_dropper, buf_pkt);
-
-	return (rcode);
+	return (sadb_update_sa(mp, ksi, &espstack->esp_sadb, diagnostic,
+	    espstack->esp_pfkey_q, esp_add_sa, espstack->ipsecesp_netstack,
+	    sadb_msg_type));
 }
 
 /* XXX refactor me */
@@ -3955,7 +3930,6 @@
 		break;
 	case SADB_DELETE:
 	case SADB_X_DELPAIR:
-	case SADB_X_DELPAIR_STATE:
 		error = esp_del_sa(mp, ksi, &diagnostic, espstack,
 		    samsg->sadb_msg_type);
 		if (error != 0) {
--- old/usr/src/uts/common/inet/ip/keysock.c	Thu Jan 15 15:12:02 2015
+++ new/usr/src/uts/common/inet/ip/keysock.c	Thu Jan 15 15:12:02 2015
@@ -1568,29 +1568,6 @@
 	atomic_inc_32(&keystack->keystack_num_extended);
 }
 
-static void
-keysock_delpair_all(keysock_t *ks, mblk_t *mp, sadb_ext_t *extv[])
-{
-	int i, start, finish;
-	mblk_t *mp1 = NULL;
-	keysock_stack_t *keystack = ks->keysock_keystack;
-
-	start = 0;
-	finish = KEYSOCK_MAX_CONSUMERS - 1;
-
-	for (i = start; i <= finish; i++) {
-		if (keystack->keystack_consumers[i] != NULL) {
-			mp1 = copymsg(mp);
-			if (mp1 == NULL) {
-				keysock_error(ks, mp, ENOMEM,
-				    SADB_X_DIAGNOSTIC_NONE);
-				return;
-			}
-			keysock_passdown(ks, mp1, i, extv, B_FALSE);
-		}
-	}
-}
-
 /*
  * Handle PF_KEY messages.
  */
@@ -1712,14 +1689,6 @@
 		else keysock_error(ks, mp, EINVAL,
 		    SADB_X_DIAGNOSTIC_SATYPE_NEEDED);
 		return;
-	case SADB_X_DELPAIR_STATE:
-		if (samsg->sadb_msg_satype == SADB_SATYPE_UNSPEC) {
-			keysock_delpair_all(ks, mp, extv);
-		} else {
-			keysock_passdown(ks, mp, samsg->sadb_msg_satype, extv,
-			    B_FALSE);
-		}
-		return;
 	case SADB_ACQUIRE:
 		/*
 		 * If I _receive_ an acquire, this means I should spread it
@@ -1774,6 +1743,7 @@
 		 */
 		break;
 	case SADB_FLUSH:
+	case SADB_DUMP:	 /* not used by normal applications */
 		/*
 		 * Nuke all SAs.
 		 *
@@ -1796,17 +1766,6 @@
 		/* Passing down of DUMP/FLUSH messages are special. */
 		qwriter(q, mp, keysock_do_flushdump, PERIM_INNER);
 		return;
-	case SADB_DUMP:	 /* not used by normal applications */
-		if ((extv[0] != NULL) &&
-		    ((msgsize >
-		    (sizeof (sadb_msg_t) + sizeof (sadb_x_edump_t))) ||
-		    (extv[SADB_X_EXT_EDUMP] == NULL))) {
-				keysock_error(ks, mp, EINVAL,
-				    SADB_X_DIAGNOSTIC_NO_EXT);
-				return;
-		}
-		qwriter(q, mp, keysock_do_flushdump, PERIM_INNER);
-		return;
 	case SADB_X_PROMISC:
 		/*
 		 * Promiscuous processing message.
--- old/usr/src/uts/common/inet/ip/sadb.c	Thu Jan 15 15:12:02 2015
+++ new/usr/src/uts/common/inet/ip/sadb.c	Thu Jan 15 15:12:02 2015
@@ -577,13 +577,12 @@
  */
 static int
 sadb_dump_fanout(queue_t *pfkey_q, mblk_t *mp, minor_t serial, isaf_t *fanout,
-    int num_entries, boolean_t do_peers, time_t active_time)
+    int num_entries, boolean_t do_peers)
 {
 	int i, error = 0;
 	mblk_t *original_answer;
 	ipsa_t *walker;
 	sadb_msg_t *samsg;
-	time_t	current;
 
 	/*
 	 * For each IPSA hash bucket do:
@@ -597,7 +596,6 @@
 	if (original_answer == NULL)
 		return (ENOMEM);
 
-	current = gethrestime_sec();
 	for (i = 0; i < num_entries; i++) {
 		mutex_enter(&fanout[i].isaf_lock);
 		for (walker = fanout[i].isaf_ipsa; walker != NULL;
@@ -604,9 +602,6 @@
 		    walker = walker->ipsa_next) {
 			if (!do_peers && walker->ipsa_haspeer)
 				continue;
-			if ((active_time != 0) &&
-			    ((current - walker->ipsa_lastuse) > active_time))
-				continue;
 			error = sadb_dump_deliver(pfkey_q, original_answer,
 			    walker, samsg);
 			if (error == ENOBUFS) {
@@ -643,23 +638,16 @@
 sadb_dump(queue_t *pfkey_q, mblk_t *mp, keysock_in_t *ksi, sadb_t *sp)
 {
 	int error;
-	time_t	active_time = 0;
-	sadb_x_edump_t	*edump =
-	    (sadb_x_edump_t *)ksi->ks_in_extv[SADB_X_EXT_EDUMP];
 
-	if (edump != NULL) {
-		active_time = edump->sadb_x_edump_timeout;
-	}
-
 	/* Dump outbound */
 	error = sadb_dump_fanout(pfkey_q, mp, ksi->ks_in_serial, sp->sdb_of,
-	    sp->sdb_hashsize, B_TRUE, active_time);
+	    sp->sdb_hashsize, B_TRUE);
 	if (error)
 		return (error);
 
 	/* Dump inbound */
-	return sadb_dump_fanout(pfkey_q, mp, ksi->ks_in_serial, sp->sdb_if,
-	    sp->sdb_hashsize, B_FALSE, active_time);
+	return (sadb_dump_fanout(pfkey_q, mp, ksi->ks_in_serial, sp->sdb_if,
+	    sp->sdb_hashsize, B_FALSE));
 }
 
 /*
@@ -698,11 +686,10 @@
  * Call me to free up a security association fanout.  Use the forever
  * variable to indicate freeing up the SAs (forever == B_FALSE, e.g.
  * an SADB_FLUSH message), or destroying everything (forever == B_TRUE,
- * when a module is unloaded).
+ * when a netstack is destroyed or a module is unloaded).
  */
 static void
-sadb_destroyer(isaf_t **tablep, uint_t numentries, boolean_t forever,
-    boolean_t inbound)
+sadb_destroyer(isaf_t **tablep, uint_t numentries, boolean_t forever)
 {
 	int i;
 	isaf_t *table = *tablep;
@@ -740,8 +727,8 @@
 	 * heels of a flush.  With keysock's enforcement, however, this
 	 * makes ESP's job easy.
 	 */
-	sadb_destroyer(&sp->sdb_of, sp->sdb_hashsize, B_FALSE, B_FALSE);
-	sadb_destroyer(&sp->sdb_if, sp->sdb_hashsize, B_FALSE, B_TRUE);
+	sadb_destroyer(&sp->sdb_of, sp->sdb_hashsize, B_FALSE);
+	sadb_destroyer(&sp->sdb_if, sp->sdb_hashsize, B_FALSE);
 
 	/* For each acquire, destroy it; leave the bucket mutex alone. */
 	sadb_destroy_acqlist(&sp->sdb_acq, sp->sdb_hashsize, B_FALSE, ns);
@@ -750,8 +737,8 @@
 static void
 sadb_destroy(sadb_t *sp, netstack_t *ns)
 {
-	sadb_destroyer(&sp->sdb_of, sp->sdb_hashsize, B_TRUE, B_FALSE);
-	sadb_destroyer(&sp->sdb_if, sp->sdb_hashsize, B_TRUE, B_TRUE);
+	sadb_destroyer(&sp->sdb_of, sp->sdb_hashsize, B_TRUE);
+	sadb_destroyer(&sp->sdb_if, sp->sdb_hashsize, B_TRUE);
 
 	/* For each acquire, destroy it, including the bucket mutex. */
 	sadb_destroy_acqlist(&sp->sdb_acq, sp->sdb_hashsize, B_TRUE, ns);
@@ -1493,7 +1480,6 @@
 	while ((uint8_t *)ext < msgend) {
 		if (ext->sadb_ext_type == SADB_EXT_RESERVED ||
 		    ext->sadb_ext_type == SADB_EXT_KEY_AUTH ||
-		    ext->sadb_ext_type == SADB_X_EXT_EDUMP ||
 		    ext->sadb_ext_type == SADB_EXT_KEY_ENCRYPT) {
 			/*
 			 * Aha!	 I found a header to be erased.
@@ -1610,7 +1596,6 @@
 	case SADB_ADD:
 	case SADB_UPDATE:
 	case SADB_X_UPDATEPAIR:
-	case SADB_X_DELPAIR_STATE:
 	case SADB_FLUSH:
 	case SADB_DUMP:
 		/*
@@ -1622,9 +1607,10 @@
 		 * message.
 		 */
 	justecho:
+		ASSERT(samsg->sadb_msg_type != SADB_DUMP ||
+		    samsg->sadb_msg_len == SADB_8TO64(sizeof (sadb_msg_t)));
 		if (ksi->ks_in_extv[SADB_EXT_KEY_AUTH] != NULL ||
-		    ksi->ks_in_extv[SADB_EXT_KEY_ENCRYPT] != NULL ||
-		    ksi->ks_in_extv[SADB_X_EXT_EDUMP] != NULL) {
+		    ksi->ks_in_extv[SADB_EXT_KEY_ENCRYPT] != NULL) {
 			sadb_strip(samsg);
 			/* Assume PF_KEY message is contiguous. */
 			ASSERT(mp->b_cont->b_cont == NULL);
@@ -2367,17 +2353,10 @@
  * Conveniently, and not coincidentally, this is both what sadb_walker
  * gives us and also what sadb_unlinkassoc expects.
  */
-struct sadb_purge_state
-{
-	ipsa_query_t sq;
-	boolean_t inbnd;
-	uint8_t sadb_sa_state;
-};
-
 static void
 sadb_purge_cb(isaf_t *head, ipsa_t *entry, void *cookie)
 {
-	struct sadb_purge_state *ps = (struct sadb_purge_state *)cookie;
+	ipsa_query_t *query = (ipsa_query_t *)cookie;
 
 	ASSERT(MUTEX_HELD(&head->isaf_lock));
 
@@ -2384,7 +2363,7 @@
 	mutex_enter(&entry->ipsa_lock);
 
 	if (entry->ipsa_state == IPSA_STATE_LARVAL ||
-	    !sadb_match_query(&ps->sq, entry)) {
+	    !sadb_match_query(query, entry)) {
 		mutex_exit(&entry->ipsa_lock);
 		return;
 	}
@@ -2401,10 +2380,10 @@
 sadb_purge_sa(mblk_t *mp, keysock_in_t *ksi, sadb_t *sp,
 	int *diagnostic, queue_t *pfkey_q)
 {
-	struct sadb_purge_state ps;
+	ipsa_query_t query;
 	int error = sadb_form_query(ksi, 0,
 	    IPSA_Q_SRC|IPSA_Q_DST|IPSA_Q_SRCID|IPSA_Q_DSTID|IPSA_Q_KMC,
-	    &ps.sq, diagnostic);
+	    &query, diagnostic);
 
 	if (error != 0)
 		return (error);
@@ -2417,10 +2396,8 @@
 	 * - if we get a dst address, we can hash based on dst addr to find
 	 * the correct bucket in the outbound table.
 	 */
-	ps.inbnd = B_TRUE;
-	sadb_walker(sp->sdb_if, sp->sdb_hashsize, sadb_purge_cb, &ps);
-	ps.inbnd = B_FALSE;
-	sadb_walker(sp->sdb_of, sp->sdb_hashsize, sadb_purge_cb, &ps);
+	sadb_walker(sp->sdb_if, sp->sdb_hashsize, sadb_purge_cb, &query);
+	sadb_walker(sp->sdb_of, sp->sdb_hashsize, sadb_purge_cb, &query);
 
 	ASSERT(mp->b_cont != NULL);
 	sadb_pfkey_echo(pfkey_q, mp, (sadb_msg_t *)mp->b_cont->b_rptr, ksi,
@@ -2428,84 +2405,6 @@
 	return (0);
 }
 
-static void
-sadb_delpair_state_one(isaf_t *head, ipsa_t *entry, void *cookie)
-{
-	struct sadb_purge_state *ps = (struct sadb_purge_state *)cookie;
-	isaf_t  *inbound_bucket;
-	ipsa_t *peer_assoc;
-	ipsa_query_t *sq = &ps->sq;
-
-	ASSERT(MUTEX_HELD(&head->isaf_lock));
-
-	mutex_enter(&entry->ipsa_lock);
-
-	if ((entry->ipsa_state != ps->sadb_sa_state) ||
-	    ((sq->srcaddr != NULL) &&
-	    !IPSA_ARE_ADDR_EQUAL(entry->ipsa_srcaddr, sq->srcaddr, sq->af))) {
-		mutex_exit(&entry->ipsa_lock);
-		return;
-	}
-
-	/*
-	 * The isaf_t *, which is passed in , is always an outbound bucket,
-	 * and we are preserving the outbound-then-inbound hash-bucket lock
-	 * ordering. The sadb_walker() which triggers this function is called
-	 * only on the outbound fanout, and the corresponding inbound bucket
-	 * lock is safe to acquire here.
-	 */
-
-	if (entry->ipsa_haspeer) {
-		inbound_bucket = INBOUND_BUCKET(sq->sp, entry->ipsa_spi);
-		mutex_enter(&inbound_bucket->isaf_lock);
-		peer_assoc = ipsec_getassocbyspi(inbound_bucket,
-		    entry->ipsa_spi, entry->ipsa_srcaddr,
-		    entry->ipsa_dstaddr, entry->ipsa_addrfam);
-	} else {
-		inbound_bucket = INBOUND_BUCKET(sq->sp, entry->ipsa_otherspi);
-		mutex_enter(&inbound_bucket->isaf_lock);
-		peer_assoc = ipsec_getassocbyspi(inbound_bucket,
-		    entry->ipsa_otherspi, entry->ipsa_dstaddr,
-		    entry->ipsa_srcaddr, entry->ipsa_addrfam);
-	}
-
-	entry->ipsa_state = IPSA_STATE_DEAD;
-	(void) sadb_torch_assoc(head, entry);
-	if (peer_assoc != NULL) {
-		mutex_enter(&peer_assoc->ipsa_lock);
-		peer_assoc->ipsa_state = IPSA_STATE_DEAD;
-		(void) sadb_torch_assoc(inbound_bucket, peer_assoc);
-	}
-	mutex_exit(&inbound_bucket->isaf_lock);
-}
-
-static int
-sadb_delpair_state(mblk_t *mp, keysock_in_t *ksi, sadbp_t *spp,
-    int *diagnostic, queue_t *pfkey_q)
-{
-	sadb_sa_t *assoc = (sadb_sa_t *)ksi->ks_in_extv[SADB_EXT_SA];
-	struct sadb_purge_state ps;
-	int error;
-
-	ps.sq.spp = spp;		/* XXX param */
-
-	error = sadb_form_query(ksi, IPSA_Q_DST|IPSA_Q_SRC,
-	    IPSA_Q_SRC|IPSA_Q_DST|IPSA_Q_SRCID|IPSA_Q_DSTID|IPSA_Q_KMC,
-	    &ps.sq, diagnostic);
-	if (error != 0)
-		return (error);
-
-	ps.inbnd = B_FALSE;
-	ps.sadb_sa_state = assoc->sadb_sa_state;
-	sadb_walker(ps.sq.sp->sdb_of, ps.sq.sp->sdb_hashsize,
-	    sadb_delpair_state_one, &ps);
-
-	ASSERT(mp->b_cont != NULL);
-	sadb_pfkey_echo(pfkey_q, mp, (sadb_msg_t *)mp->b_cont->b_rptr,
-	    ksi, NULL);
-	return (0);
-}
-
 /*
  * Common code to delete/get an SA.
  */
@@ -2518,9 +2417,6 @@
 	ipsap_t ipsapp;
 	uint_t	error = 0;
 
-	if (sadb_msg_type == SADB_X_DELPAIR_STATE)
-		return (sadb_delpair_state(mp, ksi, spp, diagnostic, pfkey_q));
-
 	sq.spp = spp;		/* XXX param */
 	error = sadb_form_query(ksi, IPSA_Q_DST|IPSA_Q_SA,
 	    IPSA_Q_SRC|IPSA_Q_DST|IPSA_Q_SA|IPSA_Q_INBOUND|IPSA_Q_OUTBOUND,
@@ -3043,8 +2939,7 @@
 
 	newbie->ipsa_type = samsg->sadb_msg_satype;
 
-	ASSERT((assoc->sadb_sa_state == SADB_SASTATE_MATURE) ||
-	    (assoc->sadb_sa_state == SADB_X_SASTATE_ACTIVE_ELSEWHERE));
+	ASSERT(assoc->sadb_sa_state == SADB_SASTATE_MATURE);
 	newbie->ipsa_auth_alg = assoc->sadb_sa_auth;
 	newbie->ipsa_encr_alg = assoc->sadb_sa_encrypt;
 
@@ -3951,11 +3846,11 @@
 
 	mutex_enter(&assoc->ipsa_lock);
 
-	if (((assoc->ipsa_state == IPSA_STATE_LARVAL) ||
-	    ((assoc->ipsa_state == IPSA_STATE_IDLE) ||
-	    (assoc->ipsa_state == IPSA_STATE_ACTIVE_ELSEWHERE) &&
-	    (assoc->ipsa_hardexpiretime != 0))) &&
-	    (assoc->ipsa_hardexpiretime <= current)) {
+	/*
+	 * Be aggressive in reaping expired LARVAL SAs.
+	 */
+	if (assoc->ipsa_state == IPSA_STATE_LARVAL &&
+	    assoc->ipsa_hardexpiretime <= current) {
 		assoc->ipsa_state = IPSA_STATE_DEAD;
 		return (sadb_torch_assoc(head, assoc));
 	}
@@ -4020,13 +3915,7 @@
 		sadb_expire_assoc(pfkey_q, assoc);
 	} else if (assoc->ipsa_idletime != 0 &&
 	    assoc->ipsa_idleexpiretime <= current) {
-		if (assoc->ipsa_state == IPSA_STATE_ACTIVE_ELSEWHERE) {
-			assoc->ipsa_state = IPSA_STATE_IDLE;
-		}
-
-		/*
-		 * Need to handle Mature case
-		 */
+		/* Only issue an IDLE expiration if we're in mature state. */
 		if (assoc->ipsa_state == IPSA_STATE_MATURE) {
 			sadb_expire_assoc(pfkey_q, assoc);
 		}
@@ -4321,61 +4210,6 @@
 	mutex_exit(&assoc->ipsa_lock);
 }
 
-static int
-sadb_update_state(ipsa_t *assoc, uint_t new_state, mblk_t **ipkt_lst)
-{
-	int rcode = 0;
-	time_t current = gethrestime_sec();
-
-	mutex_enter(&assoc->ipsa_lock);
-
-	switch (new_state) {
-	case SADB_X_SASTATE_ACTIVE_ELSEWHERE:
-		if (assoc->ipsa_state == SADB_X_SASTATE_IDLE) {
-			assoc->ipsa_state = IPSA_STATE_ACTIVE_ELSEWHERE;
-			assoc->ipsa_idleexpiretime =
-			    current + assoc->ipsa_idletime;
-		}
-		break;
-	case SADB_X_SASTATE_IDLE:
-		if (assoc->ipsa_state == SADB_X_SASTATE_ACTIVE_ELSEWHERE) {
-			assoc->ipsa_state = IPSA_STATE_IDLE;
-			assoc->ipsa_idleexpiretime =
-			    current + assoc->ipsa_idletime;
-		} else {
-			rcode = EINVAL;
-		}
-		break;
-
-	case SADB_X_SASTATE_ACTIVE:
-		if (assoc->ipsa_state != SADB_X_SASTATE_IDLE) {
-			rcode = EINVAL;
-			break;
-		}
-		assoc->ipsa_state = IPSA_STATE_MATURE;
-		assoc->ipsa_idleexpiretime = current + assoc->ipsa_idletime;
-
-		if (ipkt_lst == NULL) {
-			break;
-		}
-
-		if (assoc->ipsa_bpkt_head != NULL) {
-			*ipkt_lst = assoc->ipsa_bpkt_head;
-			assoc->ipsa_bpkt_head = assoc->ipsa_bpkt_tail = NULL;
-			assoc->ipsa_mblkcnt = 0;
-		} else {
-			*ipkt_lst = NULL;
-		}
-		break;
-	default:
-		rcode = EINVAL;
-		break;
-	}
-
-	mutex_exit(&assoc->ipsa_lock);
-	return (rcode);
-}
-
 /*
  * Check a proposed KMC update for sanity.
  */
@@ -4424,7 +4258,7 @@
  */
 
 int
-sadb_update_sa(mblk_t *mp, keysock_in_t *ksi, mblk_t **ipkt_lst,
+sadb_update_sa(mblk_t *mp, keysock_in_t *ksi,
     sadbp_t *spp, int *diagnostic, queue_t *pfkey_q,
     int (*add_sa_func)(mblk_t *, keysock_in_t *, int *, netstack_t *),
     netstack_t *ns, uint8_t sadb_msg_type)
@@ -4431,8 +4265,6 @@
 {
 	sadb_key_t *akey = (sadb_key_t *)ksi->ks_in_extv[SADB_EXT_KEY_AUTH];
 	sadb_key_t *ekey = (sadb_key_t *)ksi->ks_in_extv[SADB_EXT_KEY_ENCRYPT];
-	sadb_x_replay_ctr_t *replext =
-	    (sadb_x_replay_ctr_t *)ksi->ks_in_extv[SADB_X_EXT_REPLAY_VALUE];
 	sadb_lifetime_t *soft =
 	    (sadb_lifetime_t *)ksi->ks_in_extv[SADB_EXT_LIFETIME_SOFT];
 	sadb_lifetime_t *hard =
@@ -4444,7 +4276,6 @@
 	ipsa_t *echo_target = NULL;
 	ipsap_t ipsapp;
 	ipsa_query_t sq;
-	time_t current = gethrestime_sec();
 
 	sq.spp = spp;		/* XXX param */
 	int error = sadb_form_query(ksi, IPSA_Q_SRC|IPSA_Q_DST|IPSA_Q_SA,
@@ -4484,50 +4315,6 @@
 		goto bail;
 	}
 
-	if (sq.assoc->sadb_sa_state == SADB_X_SASTATE_ACTIVE_ELSEWHERE) {
-		if (ipsapp.ipsap_sa_ptr != NULL &&
-		    ipsapp.ipsap_sa_ptr->ipsa_state == IPSA_STATE_IDLE) {
-			if ((error = sadb_update_state(ipsapp.ipsap_sa_ptr,
-			    sq.assoc->sadb_sa_state, NULL)) != 0) {
-				*diagnostic = SADB_X_DIAGNOSTIC_BAD_SASTATE;
-				goto bail;
-			}
-		}
-		if (ipsapp.ipsap_psa_ptr != NULL &&
-		    ipsapp.ipsap_psa_ptr->ipsa_state == IPSA_STATE_IDLE) {
-			if ((error = sadb_update_state(ipsapp.ipsap_psa_ptr,
-			    sq.assoc->sadb_sa_state, NULL)) != 0) {
-				*diagnostic = SADB_X_DIAGNOSTIC_BAD_SASTATE;
-				goto bail;
-			}
-		}
-	}
-	if (sq.assoc->sadb_sa_state == SADB_X_SASTATE_ACTIVE) {
-		if (ipsapp.ipsap_sa_ptr != NULL) {
-			error = sadb_update_state(ipsapp.ipsap_sa_ptr,
-			    sq.assoc->sadb_sa_state,
-			    (ipsapp.ipsap_sa_ptr->ipsa_flags &
-			    IPSA_F_INBOUND) ? ipkt_lst : NULL);
-			if (error) {
-				*diagnostic = SADB_X_DIAGNOSTIC_BAD_SASTATE;
-				goto bail;
-			}
-		}
-		if (ipsapp.ipsap_psa_ptr != NULL) {
-			error = sadb_update_state(ipsapp.ipsap_psa_ptr,
-			    sq.assoc->sadb_sa_state,
-			    (ipsapp.ipsap_psa_ptr->ipsa_flags &
-			    IPSA_F_INBOUND) ? ipkt_lst : NULL);
-			if (error) {
-				*diagnostic = SADB_X_DIAGNOSTIC_BAD_SASTATE;
-				goto bail;
-			}
-		}
-		sadb_pfkey_echo(pfkey_q, mp, (sadb_msg_t *)mp->b_cont->b_rptr,
-		    ksi, echo_target);
-		goto bail;
-	}
-
 	/*
 	 * Reality checks for updates of active associations.
 	 * Sundry first-pass UPDATE-specific reality checks.
@@ -4535,8 +4322,7 @@
 	 * XXX STATS : logging/stats here?
 	 */
 
-	if (!((sq.assoc->sadb_sa_state == SADB_SASTATE_MATURE) ||
-	    (sq.assoc->sadb_sa_state == SADB_X_SASTATE_ACTIVE_ELSEWHERE))) {
+	if (sq.assoc->sadb_sa_state != SADB_SASTATE_MATURE) {
 		*diagnostic = SADB_X_DIAGNOSTIC_BAD_SASTATE;
 		error = EINVAL;
 		goto bail;
@@ -4568,55 +4354,10 @@
 	if (error != 0)
 		goto bail;
 
-
 	if (ipsapp.ipsap_sa_ptr != NULL) {
-		/*
-		 * Do not allow replay value change for MATURE or LARVAL SA.
-		 */
-
-		if ((replext != NULL) &&
-		    ((ipsapp.ipsap_sa_ptr->ipsa_state == IPSA_STATE_LARVAL) ||
-		    (ipsapp.ipsap_sa_ptr->ipsa_state == IPSA_STATE_MATURE))) {
-			*diagnostic = SADB_X_DIAGNOSTIC_BAD_SASTATE;
-			error = EINVAL;
-			goto bail;
-		}
-	}
-
-
-	if (ipsapp.ipsap_sa_ptr != NULL) {
 		sadb_update_lifetimes(ipsapp.ipsap_sa_ptr, hard, soft,
 		    idle, B_TRUE);
 		sadb_update_kmc(&sq, ipsapp.ipsap_sa_ptr);
-		if ((replext != NULL) &&
-		    (ipsapp.ipsap_sa_ptr->ipsa_replay_wsize != 0)) {
-			/*
-			 * If an inbound SA, update the replay counter
-			 * and check off all the other sequence number
-			 */
-			if (ksi->ks_in_dsttype == KS_IN_ADDR_ME) {
-				if (!sadb_replay_check(ipsapp.ipsap_sa_ptr,
-				    replext->sadb_x_rc_replay32)) {
-					*diagnostic =
-					    SADB_X_DIAGNOSTIC_INVALID_REPLAY;
-					error = EINVAL;
-					goto bail;
-				}
-				mutex_enter(&ipsapp.ipsap_sa_ptr->ipsa_lock);
-				ipsapp.ipsap_sa_ptr->ipsa_idleexpiretime =
-				    current +
-				    ipsapp.ipsap_sa_ptr->ipsa_idletime;
-				mutex_exit(&ipsapp.ipsap_sa_ptr->ipsa_lock);
-			} else {
-				mutex_enter(&ipsapp.ipsap_sa_ptr->ipsa_lock);
-				ipsapp.ipsap_sa_ptr->ipsa_replay =
-				    replext->sadb_x_rc_replay32;
-				ipsapp.ipsap_sa_ptr->ipsa_idleexpiretime =
-				    current +
-				    ipsapp.ipsap_sa_ptr->ipsa_idletime;
-				mutex_exit(&ipsapp.ipsap_sa_ptr->ipsa_lock);
-			}
-		}
 	}
 
 	if (sadb_msg_type == SADB_X_UPDATEPAIR) {
@@ -5821,7 +5562,7 @@
  */
 ipsa_t *
 sadb_getspi(keysock_in_t *ksi, uint32_t master_spi, int *diagnostic,
-    netstack_t *ns, uint_t sa_type)
+    netstack_t *ns)
 {
 	sadb_address_t *src =
 	    (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_SRC],
@@ -6904,54 +6645,6 @@
 }
 
 /*
- * Buffer a packet that's in IDLE state as set by Solaris Clustering.
- */
-void
-sadb_buf_pkt(ipsa_t *ipsa, mblk_t *bpkt, ip_recv_attr_t *ira)
-{
-	netstack_t	*ns = ira->ira_ill->ill_ipst->ips_netstack;
-	ipsec_stack_t   *ipss = ns->netstack_ipsec;
-
-	ASSERT(ipsa->ipsa_state == IPSA_STATE_IDLE);
-
-	ip_drop_packet(bpkt, B_TRUE, ira->ira_ill,
-	    DROPPER(ipss, ipds_sadb_inidle_overflow),
-	    &ipss->ipsec_sadb_dropper);
-	return;
-}
-
-/*
- * Stub function that taskq_dispatch() invokes to take the mblk (in arg)
- * and put into STREAMS again.
- */
-void
-sadb_clear_buf_pkt(void *ipkt)
-{
-	mblk_t	*tmp, *buf_pkt;
-	ip_recv_attr_t	iras;
-
-	buf_pkt = (mblk_t *)ipkt;
-
-	while (buf_pkt != NULL) {
-		mblk_t *data_mp;
-
-		tmp = buf_pkt->b_next;
-		buf_pkt->b_next = NULL;
-
-		data_mp = buf_pkt->b_cont;
-		buf_pkt->b_cont = NULL;
-		if (!ip_recv_attr_from_mblk(buf_pkt, &iras)) {
-			/* The ill or ip_stack_t disappeared on us. */
-			ip_drop_input("ip_recv_attr_from_mblk", data_mp, NULL);
-			freemsg(data_mp);
-		} else {
-			ip_input_post_ipsec(data_mp, &iras);
-		}
-		ira_cleanup(&iras, B_TRUE);
-		buf_pkt = tmp;
-	}
-}
-/*
  * Walker callback used by sadb_alg_update() to free/create crypto
  * context template when a crypto software provider is removed or
  * added.
--- old/usr/src/uts/common/inet/sadb.h	Thu Jan 15 15:12:03 2015
+++ new/usr/src/uts/common/inet/sadb.h	Thu Jan 15 15:12:03 2015
@@ -146,10 +146,6 @@
 	struct ipsid_s *ipsa_src_cid;	/* Source certificate identity */
 	struct ipsid_s *ipsa_dst_cid;	/* Destination certificate identity */
 	mblk_t	*ipsa_lpkt;	/* Packet received while larval (CAS me) */
-	mblk_t	*ipsa_bpkt_head;	/* Packets received while idle */
-	mblk_t	*ipsa_bpkt_tail;
-#define	SADB_MAX_IDLEPKTS	100
-	uint8_t	ipsa_mblkcnt;	/* Number of packets received while idle */
 
 	/*
 	 * PF_KEYv2 supports a replay window size of 255.  Hence there is a
@@ -451,8 +447,9 @@
 #define	IPSA_STATE_MATURE		SADB_SASTATE_MATURE
 #define	IPSA_STATE_DYING		SADB_SASTATE_DYING
 #define	IPSA_STATE_DEAD			SADB_SASTATE_DEAD
-#define	IPSA_STATE_IDLE			SADB_X_SASTATE_IDLE
-#define	IPSA_STATE_ACTIVE_ELSEWHERE	SADB_X_SASTATE_ACTIVE_ELSEWHERE
+/* Deprecated */
+/* #define	IPSA_STATE_IDLE			SADB_X_SASTATE_IDLE */
+/* #define	IPSA_STATE_ACTIVE_ELSEWHERE SADB_X_SASTATE_ACTIVE_ELSEWHERE */
 
 /*
  * NOTE:  If the document authors do things right in defining algorithms, we'll
@@ -759,7 +756,7 @@
     netstack_t *, sadbp_t *);
 void sadb_set_usetime(ipsa_t *);
 boolean_t sadb_age_bytes(queue_t *, ipsa_t *, uint64_t, boolean_t);
-int sadb_update_sa(mblk_t *, keysock_in_t *, mblk_t **, sadbp_t *,
+int sadb_update_sa(mblk_t *, keysock_in_t *, sadbp_t *,
     int *, queue_t *, int (*)(mblk_t *, keysock_in_t *, int *, netstack_t *),
     netstack_t *, uint8_t);
 void sadb_acquire(mblk_t *, ip_xmit_attr_t *, boolean_t, boolean_t);
@@ -773,7 +770,7 @@
 void sadb_destroy_acquire(ipsacq_t *, netstack_t *);
 struct ipsec_stack;
 mblk_t *sadb_setup_acquire(ipsacq_t *, uint8_t, struct ipsec_stack *);
-ipsa_t *sadb_getspi(keysock_in_t *, uint32_t, int *, netstack_t *, uint_t);
+ipsa_t *sadb_getspi(keysock_in_t *, uint32_t, int *, netstack_t *);
 void sadb_in_acquire(sadb_msg_t *, sadbp_t *, queue_t *, netstack_t *);
 boolean_t sadb_replay_check(ipsa_t *, uint32_t);
 boolean_t sadb_replay_peek(ipsa_t *, uint32_t);
@@ -786,31 +783,7 @@
 void sadb_sa_refrele(void *target);
 mblk_t *sadb_set_lpkt(ipsa_t *, mblk_t *, ip_recv_attr_t *);
 mblk_t *sadb_clear_lpkt(ipsa_t *);
-void sadb_buf_pkt(ipsa_t *, mblk_t *, ip_recv_attr_t *);
-void sadb_clear_buf_pkt(void *ipkt);
 
-/* Note that buf_pkt is the product of ip_recv_attr_to_mblk() */
-#define	HANDLE_BUF_PKT(taskq, stack, dropper, buf_pkt)			\
-{									\
-	if (buf_pkt != NULL) {						\
-		if (taskq_dispatch(taskq, sadb_clear_buf_pkt,		\
-		    (void *) buf_pkt, TQ_NOSLEEP) == 0) {		\
-		    /* Dispatch was unsuccessful drop the packets. */	\
-			mblk_t		*tmp;				\
-			while (buf_pkt != NULL) {			\
-				tmp = buf_pkt->b_next;			\
-				buf_pkt->b_next = NULL;			\
-				buf_pkt = ip_recv_attr_free_mblk(buf_pkt); \
-				ip_drop_packet(buf_pkt, B_TRUE, NULL,	\
-				    DROPPER(stack,			\
-				    ipds_sadb_inidle_timeout),		\
-				    &dropper);				\
-				buf_pkt = tmp;				\
-			}						\
-		}							\
-	}								\
-}									\
-
 /*
  * Two IPsec rate-limiting routines.
  */
--- old/usr/src/uts/common/net/pfkeyv2.h	Thu Jan 15 15:12:03 2015
+++ new/usr/src/uts/common/net/pfkeyv2.h	Thu Jan 15 15:12:03 2015
@@ -511,18 +511,6 @@
 } sadb_x_replay_ctr_t;
 
 /*
- * For extended DUMP request. Dumps the SAs which were idle for
- * longer than the timeout specified.
- */
-
-typedef struct sadb_x_edump {
-	uint16_t sadb_x_edump_len;
-	uint16_t sadb_x_edump_exttype;
-	uint32_t sadb_x_edump_reserved;
-	uint64_t sadb_x_edump_timeout;
-} sadb_x_edump_t;
-
-/*
  * Base message types.
  */
 
@@ -541,7 +529,7 @@
 #define	SADB_X_INVERSE_ACQUIRE	12
 #define	SADB_X_UPDATEPAIR	13
 #define	SADB_X_DELPAIR		14
-#define	SADB_X_DELPAIR_STATE	15
+/* #define	SADB_X_DELPAIR_STATE	15 */ /* Deprecated */
 #define	SADB_MAX		15
 
 /*
@@ -583,9 +571,9 @@
 #define	SADB_SASTATE_MATURE		1
 #define	SADB_SASTATE_DYING		2
 #define	SADB_SASTATE_DEAD		3
-#define	SADB_X_SASTATE_ACTIVE_ELSEWHERE	4
-#define	SADB_X_SASTATE_IDLE		5
-#define	SADB_X_SASTATE_ACTIVE		6
+/* #define	SADB_X_SASTATE_ACTIVE_ELSEWHERE	4 */ /* Deprecated */
+/* #define	SADB_X_SASTATE_IDLE		5 */ /* Deprecated */
+/* #define	SADB_X_SASTATE_ACTIVE		6 */ /* Deprecated */
 
 #define	SADB_SASTATE_MAX		6
 
@@ -669,7 +657,7 @@
 #define	SADB_X_EXT_ADDRESS_INNER_DST	22
 #define	SADB_X_EXT_PAIR			23
 #define	SADB_X_EXT_REPLAY_VALUE		24
-#define	SADB_X_EXT_EDUMP		25
+/* #define	SADB_X_EXT_EDUMP		25 */ /* Deprecated */
 #define	SADB_X_EXT_LIFETIME_IDLE	26
 #define	SADB_X_EXT_OUTER_SENS		27
 
