--- old/usr/src/cmd/cmd-inet/usr.sbin/socket-filter-kssl.xml	Sat Nov 22 13:16:57 2014
+++ new/usr/src/cmd/cmd-inet/usr.sbin/socket-filter-kssl.xml	Sat Nov 22 13:16:57 2014
@@ -2,6 +2,7 @@
 <!DOCTYPE service_bundle SYSTEM "/usr/share/lib/xml/dtd/service_bundle.dtd.1">
 <!--
 	Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
+	Copyright 2012, Nexenta Systems, Inc. All rights reserved.
 
  CDDL HEADER START
 
@@ -81,6 +82,104 @@
 				<manpage title='ksslcfg' section='1M'
 				    manpath='/usr/share/man' />
 			</documentation>
+		</template>
+	</instance>
+
+	<instance name='http' enabled='true'>
+		<dependency
+		    name='http-filter-filesystem-root'
+		    grouping='require_all'
+		    restart_on='none'
+		    type='service'>
+			<service_fmri value='svc:/system/filesystem/root' />
+		</dependency>
+
+		<exec_method
+			type='method'
+			name='start'
+			exec='/lib/svc/method/svc-sockfilter start'
+			timeout_seconds='60' />
+
+		<exec_method
+			type='method'
+			name='stop'
+			exec='/lib/svc/method/svc-sockfilter stop'
+			timeout_seconds='60' />
+
+		<property_group name='startd' type='framework'>
+			<propval name='duration' type='astring'
+				value='transient' />
+		</property_group>
+
+		<property_group name='socket-filter' type='framework'>
+			<propval name='name' type='astring' value='httpfilt' />
+			<propval name='module_name' type='astring'
+				value='httpfilt' />
+			<propval name='attach_semantics' type='astring'
+				value='prog' />
+			<propval name='socket_tuples' type='astring'
+				value='2:2:0,2:2:6,26:2:0,26:2:6' />
+		</property_group>
+
+		<template>
+			<common_name>
+				<loctext xml:lang='C'>
+				kernel inbound HTTP request socket filter
+				</loctext>
+			</common_name>
+			<documentation>
+				<manpage title='httpfilt' section='7M'
+				    manpath='/usr/share/man' />
+			</documentation>
+		</template>
+	</instance>
+
+	<instance name='data' enabled='true'>
+		<dependency
+		    name='data-filter-filesystem-root'
+		    grouping='require_all'
+		    restart_on='none'
+		    type='service'>
+			<service_fmri value='svc:/system/filesystem/root' />
+		</dependency>
+
+		<exec_method
+			type='method'
+			name='start'
+			exec='/lib/svc/method/svc-sockfilter start'
+			timeout_seconds='60' />
+
+		<exec_method
+			type='method'
+			name='stop'
+			exec='/lib/svc/method/svc-sockfilter stop'
+			timeout_seconds='60' />
+
+		<property_group name='startd' type='framework'>
+			<propval name='duration' type='astring'
+				value='transient' />
+		</property_group>
+
+		<property_group name='socket-filter' type='framework'>
+			<propval name='name' type='astring' value='datafilt' />
+			<propval name='module_name' type='astring'
+				value='datafilt' />
+			<propval name='attach_semantics' type='astring'
+				value='prog' />
+			<propval name='socket_tuples' type='astring'
+				value='2:2:0,2:2:6,26:2:0,26:2:6' />
+		</property_group>
+
+		<template>
+			<common_name>
+				<loctext xml:lang='C'>
+				TCP inbound data socket filter
+				</loctext>
+			</common_name>
+			<documentation>
+				<manpage title='datafilt' section='7M'
+				    manpath='/usr/share/man' />
+			</documentation>
 		</template>
 	</instance>
 
--- old/usr/src/man/man7/Intro.7	Sat Nov 22 13:16:58 2014
+++ new/usr/src/man/man7/Intro.7	Sat Nov 22 13:16:58 2014
@@ -1,14 +1,14 @@
 '\" te
+.\" Copyright 2014 Ryan Zezeski
 .\" Copyright (c) 1999, Sun Microsystems, Inc.  All Rights Reserved.
 .\" Copyright 1989 AT&T
 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License.
 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.  See the License for the specific language governing permissions and limitations under the License.
 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE.  If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
-.TH INTRO 7 "Sep 29, 1994"
+.TH INTRO 7 "Nov 20, 2014"
 .SH NAME
 Intro, intro \- introduction to special files
 .SH DESCRIPTION
-.sp
 .LP
 This section describes various device and network interfaces  available on the
 system.  The types of interfaces described  include character and block
@@ -94,11 +94,12 @@
 \fB(7M)\fR
 .ad
 .RS 9n
-This section describes  \fBSTREAMS\fR modules.  Note that  \fBSTREAMS\fR
-drivers are discussed in section 7D. \fBstreamio\fR(7I) contains a list of
-ioctl requests used to manipulate \fBSTREAMS\fR modules and interface with the
-\fBSTREAMS\fR framework.  Ioctl requests specific to a  \fBSTREAMS\fR module
-will be discussed on the man page for that module.
+This section describes \fBSTREAMS\fR and socket filter modules. Note
+that \fBSTREAMS\fR drivers are discussed in section 7D.
+\fBstreamio\fR(7I) contains a list of ioctl requests used to
+manipulate \fBSTREAMS\fR modules and interface with the \fBSTREAMS\fR
+framework. Ioctl requests specific to a \fBSTREAMS\fR module will be
+discussed on the man page for that module.
 .RE
 
 .sp
@@ -156,8 +157,6 @@
 .RE
 
 .SH SEE ALSO
-.sp
-.LP
 \fBadd_drv\fR(1M), \fBrem_drv\fR(1M), \fBIntro\fR(3), \fBioctl\fR(2),
 \fBsocket\fR(3SOCKET), \fBdriver.conf\fR(4), \fBarp\fR(7P), \fBicmp\fR(7P),
 \fBinet\fR(7P), \fBip\fR(7P), \fBmtio\fR(7I), \fBst\fR(7D), \fBstreamio\fR(7I),
--- /dev/null	Sat Nov 22 13:16:58 2014
+++ new/usr/src/man/man7m/datafilt.7m	Sat Nov 22 13:16:58 2014
@@ -0,0 +1,46 @@
+.\"
+.\" This file and its contents are supplied under the terms of the
+.\" Common Development and Distribution License ("CDDL"), version 1.0.
+.\" You may only use this file in accordance with the terms of version
+.\" 1.0 of the CDDL.
+.\"
+.\" A full copy of the text of the CDDL should have accompanied this
+.\" source.  A copy of the CDDL is also available via the Internet at
+.\" http://www.illumos.org/license/CDDL.
+.\"
+.\"
+.\" Copyright 2014 Ryan Zezeski
+.\"
+.Dd Nov 20, 2014
+.Dt DATAFILT 7M
+.Os
+.Sh NAME
+.Nm datafilt
+.Nd socket filter module for deferred TCP connections
+.Sh DESCRIPTION
+The
+.Nm datafilt
+socket filter provides deferment of
+.Xr accept 3SOCKET
+for TCP connections. The accept call will not return until at least
+one byte has been buffered by the kernel. Deferment assures the
+application that the first call to
+.Xr read 2 or
+.Xr recv 3SOCKET
+will not block. It reduces unnecessary switching between user and
+kernel.
+.Sh EXAMPLES
+.Ss Example 1
+Enable deferment on the listening socket.
+.Bd -literal
+    setsockopt(lsock, SOL_FILTER, FIL_ATTACH, "datafilt", 8);
+.Ed
+.Ss Example 2
+Disable deferment on the listening socket.
+.Bd -literal
+    char filt[] = "datafilt";
+    setsockopt(lsock, SOL_FILTER, FIL_DETACH, filt, strlen(filt) + 1);
+.Ed
+.Sh SEE ALSO
+.Xr setsockopt 3SOCKET ,
+.Xr httpfilt 7M
--- /dev/null	Sat Nov 22 13:16:58 2014
+++ new/usr/src/man/man7m/httpfilt.7m	Sat Nov 22 13:16:58 2014
@@ -0,0 +1,65 @@
+.\"
+.\" This file and its contents are supplied under the terms of the
+.\" Common Development and Distribution License ("CDDL"), version 1.0.
+.\" You may only use this file in accordance with the terms of version
+.\" 1.0 of the CDDL.
+.\"
+.\" A full copy of the text of the CDDL should have accompanied this
+.\" source.  A copy of the CDDL is also available via the Internet at
+.\" http://www.illumos.org/license/CDDL.
+.\"
+.\"
+.\" Copyright 2014 Ryan Zezeski
+.\"
+.Dd Nov 20, 2014
+.Dt HTTPFILT 7M
+.Os
+.Sh NAME
+.Nm httpfilt
+.Nd socket filter module for deferred HTTP connections
+.Sh DESCRIPTION
+The
+.Nm httpfilt
+socket filter provides deferment of
+.Xr accept 3SOCKET
+for HTTP connections. The accept call will not return until the CRLF
+line that designates the end of the headers has been seen, or until 8K
+has been buffered. Deferment assures the application that the first
+call to
+.Xr read 2 or
+.Xr recv 3SOCKET
+will not block. It reduces unnecessary switching between user and
+kernel.
+.Sh IMPLEMENTATION NOTES
+It's important to understand that this filter only defers HTTP
+requests, it doesn't parse them. It's not meant to be an in-kernel
+HTTP server, rejecting or accepting requests. That's still the job of
+the application. It simply does its best to buffer data until the HTTP
+request is complete, sans the body.
+.Pp
+As the filter does not implement a complete HTTP request parser it can
+be fooled. It is possible to create bogus requests which keep the
+socket deferred in the kernel indefinitely. These deferred sockets are
+allowed to stay open until the socketfilter system feels pressure and
+starts closing them.
+.Pp
+If you want to avoid indefinite deferral then
+.Xr datafilt 7M
+may be used instead. It defers the connection until at least one byte
+arrives.
+.Sh EXAMPLES
+.Ss Example 1
+Enable HTTP deferment on the listening socket.
+.Bd -literal
+    char filt[] = "httpfilt";
+    setsockopt(lsock, SOL_FILTER, FIL_ATTACH, filt, strlen(filt) + 1);
+.Ed
+.Ss Example 2
+Disable HTTP deferment on the listening socket.
+.Bd -literal
+    char filt[] = "httpfilt";
+    setsockopt(lsock, SOL_FILTER, FIL_DETACH, filt, strlen(filt) + 1);
+.Ed
+.Sh SEE ALSO
+.Xr setsockopt 3SOCKET ,
+.Xr datafilt 7M
--- old/usr/src/pkg/manifests/system-kernel.mf	Sat Nov 22 13:16:58 2014
+++ new/usr/src/pkg/manifests/system-kernel.mf	Sat Nov 22 13:16:58 2014
@@ -21,6 +21,7 @@
 
 #
 # Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
+# Copyright 2012, Nexenta Systems, Inc. All rights reserved.
 #
 
 #
@@ -752,9 +753,13 @@
 $(i386_ONLY)file path=kernel/sched/SDC group=sys mode=0755
 $(i386_ONLY)file path=kernel/sched/TS group=sys mode=0755
 $(i386_ONLY)file path=kernel/sched/TS_DPTBL group=sys mode=0755
+file path=kernel/socketmod/$(ARCH64)/datafilt group=sys mode=0755
+file path=kernel/socketmod/$(ARCH64)/httpfilt group=sys mode=0755
 file path=kernel/socketmod/$(ARCH64)/ksslf group=sys mode=0755
 file path=kernel/socketmod/$(ARCH64)/socksctp group=sys mode=0755
 file path=kernel/socketmod/$(ARCH64)/trill group=sys mode=0755
+$(i386_ONLY)file path=kernel/socketmod/datafilt group=sys mode=0755
+$(i386_ONLY)file path=kernel/socketmod/httpfilt group=sys mode=0755
 $(i386_ONLY)file path=kernel/socketmod/ksslf group=sys mode=0755
 $(i386_ONLY)file path=kernel/socketmod/socksctp group=sys mode=0755
 $(i386_ONLY)file path=kernel/socketmod/trill group=sys mode=0755
--- old/usr/src/pkg/manifests/system-test-ostest.mf	Sat Nov 22 13:16:58 2014
+++ new/usr/src/pkg/manifests/system-test-ostest.mf	Sat Nov 22 13:16:58 2014
@@ -12,6 +12,7 @@
 #
 # Copyright (c) 2012 by Delphix. All rights reserved.
 # Copyright 2014, OmniTI Computer Consulting, Inc. All rights reserved.
+# Copyright 2014, Ryan Zezeski. All rights reserved.
 #
 
 set name=pkg.fmri value=pkg:/system/test/ostest@$(PKGVERS)
@@ -30,6 +31,7 @@
 file path=opt/os-tests/runfiles/delphix.run mode=0444
 file path=opt/os-tests/runfiles/omnios.run mode=0444
 file path=opt/os-tests/runfiles/openindiana.run mode=0444
+file path=opt/os-tests/tests/defer_test mode=0555
 file path=opt/os-tests/tests/poll_test mode=0555
 file path=opt/os-tests/tests/sigqueue/sigqueue_queue_size mode=0555
 license cr_Sun license=cr_Sun
--- old/usr/src/test/os-tests/runfiles/delphix.run	Sat Nov 22 13:16:58 2014
+++ new/usr/src/test/os-tests/runfiles/delphix.run	Sat Nov 22 13:16:58 2014
@@ -21,6 +21,8 @@
 post =
 outputdir = /var/tmp/test_results
 
+[/opt/os-tests/tests/defer_test]
+
 [/opt/os-tests/tests/poll_test]
 user = root
 
--- old/usr/src/test/os-tests/runfiles/omnios.run	Sat Nov 22 13:16:58 2014
+++ new/usr/src/test/os-tests/runfiles/omnios.run	Sat Nov 22 13:16:58 2014
@@ -21,6 +21,8 @@
 post =
 outputdir = /var/tmp/test_results
 
+[/opt/os-tests/tests/defer_test]
+
 [/opt/os-tests/tests/poll_test]
 user = root
 
--- old/usr/src/test/os-tests/runfiles/openindiana.run	Sat Nov 22 13:16:58 2014
+++ new/usr/src/test/os-tests/runfiles/openindiana.run	Sat Nov 22 13:16:58 2014
@@ -21,6 +21,8 @@
 post =
 outputdir = /var/tmp/test_results
 
+[/opt/os-tests/tests/defer_test]
+
 [/opt/os-tests/tests/poll_test]
 user = root
 
--- old/usr/src/test/os-tests/tests/Makefile	Sat Nov 22 13:16:58 2014
+++ new/usr/src/test/os-tests/tests/Makefile	Sat Nov 22 13:16:58 2014
@@ -13,6 +13,6 @@
 # Copyright (c) 2012 by Delphix. All rights reserved.
 #
 
-SUBDIRS = poll sigqueue
+SUBDIRS = poll sigqueue tcpdefer
 
 include $(SRC)/test/Makefile.com
--- /dev/null	Sat Nov 22 13:16:58 2014
+++ new/usr/src/test/os-tests/tests/tcpdefer/Makefile	Sat Nov 22 13:16:58 2014
@@ -0,0 +1,57 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Ryan Zezeski. All rights reserved.
+#
+
+include $(SRC)/cmd/Makefile.cmd
+include $(SRC)/test/Makefile.com
+
+PROG = defer_test
+OBJS = $(PROG:%=%.o)
+SRCS = $(OBJS:%.o=%.c)
+
+LDLIBS += -lsocket -lnsl -lkstat
+C99MODE = -xc99=%all
+
+ROOTOPTPKG = $(ROOT)/opt/os-tests
+TESTDIR = $(ROOTOPTPKG)/tests
+
+CMDS = $(PROG:%=$(TESTDIR)/%)
+$(CMDS) := FILEMODE = 0555
+
+all: $(PROG)
+
+$(PROG): $(OBJS)
+	$(LINK.c) $(OBJS) -o $@ $(LDLIBS)
+	$(POST_PROCESS)
+
+%.o: ../%.c
+	$(COMPILE.c) $<
+
+install: all $(CMDS)
+
+lint: lint_SRCS
+
+clobber: clean
+	-$(RM) $(PROG)
+
+clean:
+	-$(RM) $(OBJS)
+
+$(CMDS): $(TESTDIR) $(PROG)
+
+$(TESTDIR):
+	$(INS.dir)
+
+$(TESTDIR)/%: %
+	$(INS.file)
--- /dev/null	Sat Nov 22 13:16:58 2014
+++ new/usr/src/test/os-tests/tests/tcpdefer/defer_test.c	Sat Nov 22 13:16:58 2014
@@ -0,0 +1,556 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2014 Ryan Zezeski
+ */
+
+/*
+ * Test TCP deferred accept(). Specifically, test the data/httpfilt
+ * socket filter modules. Deferred accept() allows the kernel to defer
+ * the return of accept() on behalf of the application for the purpose
+ * of making sure data is ready so that the first read() call does not
+ * block or return EAGAIN. This test exercises the code path from the
+ * application level, i.e. entire stack is included.
+ *
+ * datafilt - This module is generic TCP deferment. It assures 1 byte
+ * is ready before accept() returns.
+ *
+ * httpfilt - This module is for HTTP/TCP deferment. It guesses if a
+ * request is valid HTTP and defers accept() until the entire request
+ * is ready, sans the body.
+ */
+#include <arpa/inet.h>
+#include <errno.h>
+#include <kstat.h>
+#include <netinet/in.h>
+#include <signal.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <strings.h>
+#include <sys/socket.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <unistd.h>
+
+#define	BUFSIZE			1024
+#define	COMMON_HEAD				       \
+	"Accept: */*\r\n"			       \
+	"Host: test.com\r\n"			       \
+	"User-Agent: test\r\n"			       \
+	"\r\n"
+#define	DATAFILT		"datafilt"
+#define	HTTPFILT		"httpfilt"
+#define	NUM_TESTS		12
+#define	PORT			9876
+
+/*
+ * Values used to indicate client/server state to each other.
+ */
+enum State {
+	/* client states */
+	CLIENT_CONNECTED,
+	CLIENT_SENT_ALL,
+	CLIENT_SENT_SOME,
+
+	/* server states */
+	SERVER_LISTENING,
+	SERVER_NO_ACCEPT
+};
+
+/*
+ * Each test is defined as a tdata structure in the test_data array.
+ * Adding a new test is a matter of making a new tdata structure and
+ * bumping NUM_TESTS.
+ *
+ * td_type	The filter to use: HTTPFILT | DATAFILT.
+ *
+ * td_name	The name of the test, written to stdout.
+ *
+ * td_msgs	An array of data msgs that will be sent by the client()
+ *		process.
+ *
+ * td_num_msgs	The number of msgs in td_msgs.
+ */
+struct tdata {
+	char *td_type;
+	char *td_name;
+	char *td_msgs[2];
+	int td_num_msgs;
+};
+
+static struct tdata test_data[NUM_TESTS] = {
+	{
+		HTTPFILT,
+		"httpfilt_GET",
+		{"GET /test HTTP/1.1\r\n", COMMON_HEAD},
+		2
+	},
+	{
+		HTTPFILT,
+		"httpfilt_GET_LF_only",
+		{"GET /test HTTP/1.1\n",
+			"Accept: */*\n"				       \
+			"Host: test.com\n"			       \
+			"User-Agent: test\n"			       \
+			"\n"},
+		2
+	},
+	{
+		HTTPFILT,
+		"httpfilt_PUT",
+		{"PUT /test HTTP/1.1\r\n", COMMON_HEAD},
+		2
+	},
+	{
+		HTTPFILT,
+		"httpfilt_POST",
+		{"POST /test HTTP/1.1\r\n", COMMON_HEAD},
+		2
+	},
+	{
+		HTTPFILT,
+		"httpfilt_HEAD",
+		{"HEAD /test HTTP/1.1\r\n", COMMON_HEAD},
+		2
+	},
+	{
+		HTTPFILT,
+		"httpfilt_OPTIONS",
+		{"OPTIONS /test HTTP/1.1\r\n", COMMON_HEAD},
+		2
+	},
+	{
+		HTTPFILT,
+		"httpfilt_TRACE",
+		{"TRACE /test HTTP/1.1\r\n", COMMON_HEAD},
+		2
+	},
+	{
+		HTTPFILT,
+		"httpfilt_CONNECT",
+		{"CONNECT /test HTTP/1.1\r\n", COMMON_HEAD},
+		2
+	},
+	{
+		HTTPFILT,
+		"httpfilt_VERSION-CONTROL",
+		{"VERSION-CONTROL /test HTTP/1.1\r\n", COMMON_HEAD},
+		2
+	},
+	{
+		/*
+		 * Verify that a starting space (non-HTTP) is not
+		 * deferred.
+		 */
+		HTTPFILT,
+		"httpfilt_space",
+		{" some data..."},
+		1
+	},
+	{
+		/* Verify that a bad method is not deferred. */
+		HTTPFILT,
+		"httpfilt_bad_method",
+		{"badmethod /test HTTP/1.1\r\n"},
+		1
+	},
+	{
+		DATAFILT,
+		"datafilt_one_byte",
+		{"X"},
+		1
+	}
+};
+
+static int	debug = 0;
+
+static int	client(int fd, char **msgs, int num_msgs);
+static int	server(int fd, char *td_type, char **msgs, int num_msgs);
+
+static void	dbg(const char *format, ...);
+static int	msgscmp(char *data, char **msgs, int num_msgs);
+static int	run(struct tdata tdata);
+static int	sendstate(int fd, enum State state);
+static int	waitforstate(int fd, enum State state);
+
+int
+main(int argc, char **argv)
+{
+	int c, rc = 0;
+
+	while ((c = getopt(argc, argv, "d")) != -1) {
+		switch (c) {
+		case 'd':
+			debug = 1;
+			break;
+		default:
+			break;
+		}
+	}
+
+	for (int i = 0; i < NUM_TESTS; i++)
+		rc += run(test_data[i]);
+
+	return (rc);
+}
+
+/*
+ * This test is made up of two cooperating processes which share state
+ * updates over a pipe. The sequence diagram below shows the actions
+ * taken on each side of the socket as well as the state messages. The
+ * numbers represent the order, two steps with the same number happen
+ * concurrently. The state messages act as synchronization points; a
+ * process will block until it receives the expected message. Notice
+ * that a server may accept multiple times before the socket is
+ * created, this proves deferment. A non-deferred socket will accept
+ * on the first try.
+ *
+ * CLI SOCK	CLIENT				SERVER	SERVER SOCK
+ *                |                                |
+ *                |                                |    (1) listen()
+ *                |<--------SERVER_LISTENING-------+
+ * (2) connect()  |                                |
+ *                +---------CLIENT_CONNECTED------>|
+ *                |                                |    (3) accept()
+ *                |<--------SERVER_NO_ACCEPT-------+
+ * (4.x) send()   |                                |
+ *                +---------CLIENT_SENT_SOME------>|
+ *                |                                |    (5.x) accept()
+ *                |<--------SERVER_NO_ACCEPT-------+
+ *                |                                |
+ *                +---------CLIENT_SENT_ALL------->|
+ * (6) close()    |                                |    (6) accept()
+ *                |                                |    (7) recv()
+ *                |                                |    (8) close()
+ *                |                                |
+ *                =                                =
+ *
+ */
+static int
+run(struct tdata tdata)
+{
+	int fd[2], rc;
+	pid_t child;
+
+	(void) printf("TEST STARTING: %s\n", tdata.td_name);
+
+	if (pipe(fd) != 0) {
+		perror("failed to create pipe");
+		return (1);
+	}
+
+	child = fork();
+	if (child == 0) {
+		exit(client(fd[1], tdata.td_msgs, tdata.td_num_msgs));
+	} else if (child > 0) {
+		rc = server(fd[0], tdata.td_type, tdata.td_msgs,
+		    tdata.td_num_msgs);
+		if (rc != 0)
+			(void) printf("TEST FAILED: %s\n", tdata.td_name);
+		else
+			(void) printf("TEST PASSED: %s\n", tdata.td_name);
+
+		(void) close(fd[0]);
+		(void) close(fd[1]);
+		(void) kill(child, SIGKILL);
+	} else {
+		perror("problem with fork()\n");
+		(void) printf("TEST FAILED: %s\n", tdata.td_name);
+		rc = 1;
+	}
+
+	return (rc);
+}
+
+static int
+server(int fd, char *filt, char **msgs, int num_msgs)
+{
+	int			csock, lsock, ndeferred, status;
+	char			buf[BUFSIZE];
+	kstat_ctl_t		*kc;
+	kstat_named_t		*kn;
+	kstat_t			*ks;
+	struct sockaddr_in	addr, cliaddr;
+	socklen_t		clilen;
+
+	lsock = socket(PF_INET, SOCK_STREAM | SOCK_NONBLOCK, 0);
+
+	if (setsockopt(lsock, SOL_FILTER, FIL_ATTACH, filt, strlen(filt) + 1) <
+	    0) {
+		perror("couldn't set filter");
+		return (1);
+	}
+
+	if (lsock == -1) {
+		perror("socket");
+		return (1);
+	}
+
+	bzero(&addr, sizeof (addr));
+	addr.sin_family = AF_INET;
+	addr.sin_addr.s_addr = htonl(INADDR_ANY);
+	addr.sin_port = htons(PORT);
+	if (bind(lsock, (struct sockaddr *)&addr, sizeof (addr)) < 0) {
+		perror("server failed to bind");
+		return (1);
+	}
+
+	if (listen(lsock, 2) < 0) {
+		perror("listen failed");
+		return (1);
+	}
+
+	dbg("(1) [server] listen()\n");
+
+	char filter_name[1024] = "filter_";
+	(void) strcat(filter_name, filt);
+	kc = kstat_open();
+	ks = kstat_lookup(kc, "sockfs", 0, filter_name);
+	(void) kstat_read(kc, ks, NULL);
+	kn = kstat_data_lookup(ks, "ndeferred");
+	ndeferred = kn->value.ui64;
+
+	if (ndeferred != 0) {
+		(void) fprintf(stderr, "expected 0 deferred conns but got %d\n",
+		    ndeferred);
+		return (1);
+	}
+
+	if (sendstate(fd, SERVER_LISTENING) != 0)
+		return (1);
+
+	dbg("---SERVER_LISTENING----->\n");
+
+	if (waitforstate(fd, CLIENT_CONNECTED) != 0)
+		return (1);
+
+	clilen = sizeof (cliaddr);
+	csock = accept(lsock, (struct sockaddr *)&cliaddr, &clilen);
+	if ((csock == -1) && (errno != EAGAIN)) {
+		perror("problem accepting");
+		return (1);
+	} else if (csock != -1) {
+		(void) fprintf(stderr,
+		    "server accpeted before any data sent\n");
+		return (1);
+	}
+
+	dbg("(3) [server] accept()\n");
+
+	(void) kstat_chain_update(kc);
+	(void) kstat_read(kc, ks, NULL);
+	kn = kstat_data_lookup(ks, "ndeferred");
+	ndeferred = kn->value.ui64;
+	if (ndeferred != 1) {
+		(void) fprintf(stderr, "expected 1 deferred conns but got %d\n",
+		    ndeferred);
+		return (1);
+	}
+
+	if (sendstate(fd, SERVER_NO_ACCEPT) != 0)
+		return (1);
+
+	dbg("---SERVER_NO_ACCEPT--->\n");
+
+	/* The last msg is the final msg. */
+	for (int i = 0; i < num_msgs - 1; i++) {
+		if (waitforstate(fd, CLIENT_SENT_SOME) != 0)
+			return (1);
+
+		csock = accept(lsock, (struct sockaddr *)&cliaddr, &clilen);
+		if ((csock == -1) && (errno != EAGAIN)) {
+			perror("problem accepting");
+			return (1);
+		} else if (csock != -1) {
+			(void) fprintf(stderr,
+			    "server accpeted after some data sent\n");
+			return (1);
+		}
+
+		dbg("(5.%d) [server] accept()\n", i);
+
+		if (sendstate(fd, SERVER_NO_ACCEPT) != 0)
+			return (1);
+
+		dbg("---SERVER_NO_ACCEPT--->\n");
+
+	}
+
+	if (waitforstate(fd, CLIENT_SENT_ALL) != 0)
+		return (1);
+
+	csock = accept(lsock, (struct sockaddr *)&cliaddr, &clilen);
+	if (csock == -1) {
+		perror("problem accepting");
+		return (1);
+	}
+
+	dbg("(6) [server] accept()\n");
+
+	bzero(&buf, BUFSIZE);
+	if (recv(csock, buf, BUFSIZE, 0) == -1) {
+		perror("problemn receiving data");
+		return (1);
+	}
+
+	dbg("(7) [server] recv()\n");
+
+	if (msgscmp(buf, msgs, num_msgs) != 0) {
+		(void) fprintf(stderr, "data modified\n");
+		return (1);
+	}
+
+	(void) close(csock);
+	(void) close(lsock);
+
+	dbg("(8) [server] close()\n");
+
+	(void) wait(&status);
+	return (status);
+}
+
+static int
+client(int fd, char **msgs, int num_msgs)
+{
+	int			sock;
+	size_t			sz;
+	struct sockaddr_in	addr;
+
+	if (waitforstate(fd, SERVER_LISTENING) != 0)
+		return (1);
+
+	bzero(&addr, sizeof (addr));
+	addr.sin_family = AF_INET;
+	addr.sin_addr.s_addr = inet_addr("127.0.0.1");
+	addr.sin_port = htons(PORT);
+
+	sock = socket(AF_INET, SOCK_STREAM, 0);
+	if (sock < 0) {
+		perror("cannot create client socket");
+		return (1);
+	}
+
+	if (connect(sock, (struct sockaddr *)&addr, sizeof (addr)) < 0) {
+		(void) printf("failed to connect: %d\n", errno);
+		perror("cannot connect to server");
+		return (1);
+	}
+
+	dbg("(2) [client] connect()\n");
+
+	if (sendstate(fd, CLIENT_CONNECTED) != 0)
+		return (1);
+
+	dbg("<---CLIENT_CONNECTED-----\n");
+
+	if (waitforstate(fd, SERVER_NO_ACCEPT) != 0)
+		return (1);
+
+	for (int i = 0; i < num_msgs; i++) {
+		size_t len = strlen(msgs[i]);
+		sz = send(sock, msgs[i], len, 0);
+		if (sz != len) {
+			(void) fprintf(stderr,
+			    "client sent %zu bytes, but should have sent %zu\n",
+			    sz, len);
+			return (1);
+		}
+
+		dbg("(4.%d) [client] send()\n", i);
+
+		if (i == num_msgs - 1)
+			break;
+
+		if (sendstate(fd, CLIENT_SENT_SOME) != 0)
+			return (1);
+
+		dbg("<---CLIENT_SENT_SOME-----\n");
+
+		if (waitforstate(fd, SERVER_NO_ACCEPT) != 0)
+			return (1);
+	}
+
+	if (sendstate(fd, CLIENT_SENT_ALL) != 0)
+		return (1);
+
+	dbg("<---CLIENT_SENT_ALL-----\n");
+	(void) close(sock);
+	dbg("(6) [client] close()\n");
+
+	return (0);
+}
+
+/* Send a debug msg to stdout. */
+static void
+dbg(const char *format, ...)
+{
+	va_list	args;
+
+	if (!debug) {
+		return;
+	}
+
+	va_start(args, format);
+	(void) vprintf(format, args);
+	va_end(args);
+	(void) fflush(stdout);
+}
+
+/*
+ * Test for byte-for-byte equality between data and msgs. Return 0 if
+ * equal, 1 otherwise.
+ */
+static int
+msgscmp(char *data, char **msgs, int num_msgs)
+{
+	for (int i = 0, offset = 0; i < num_msgs; i++) {
+		int len = strlen(msgs[i]);
+		if (memcmp(&data[offset], msgs[i], len) != 0)
+			return (1);
+
+		offset += len;
+	}
+
+	return (0);
+}
+
+/* Send a state across the pipe. */
+static int sendstate(int fd, enum State state)
+{
+	size_t sz;
+
+	sz = write(fd, &state, sizeof (int));
+	return ((sz == sizeof (int)) ? 0 : 1);
+}
+
+/* Block on the given state. */
+static int waitforstate(int fd, enum State state)
+{
+	int i;
+	size_t sz;
+
+	sz = read(fd, &i, sizeof (int));
+	if (sz != sizeof (int)) {
+		(void) fprintf(stderr, "couldn't read int\n");
+		return (1);
+	}
+
+	if (i != state) {
+		(void) fprintf(stderr,
+		    "saw state %d but expected %d\n", i, state);
+		return (1);
+	}
+
+	return (0);
+}
--- old/usr/src/uts/common/Makefile.files	Sat Nov 22 13:16:58 2014
+++ new/usr/src/uts/common/Makefile.files	Sat Nov 22 13:16:58 2014
@@ -576,6 +576,10 @@
 
 IPSECAH_OBJS +=	ipsecahddi.o ipsecah.o sadb.o
 
+DATAFILT_OBJS += datafilt.o
+
+HTTPFILT_OBJS += httpfilt.o
+
 SPPP_OBJS +=	sppp.o sppp_dlpi.o sppp_mod.o s_common.o
 
 SPPPTUN_OBJS +=	sppptun.o sppptun_mod.o
--- /dev/null	Sat Nov 22 13:16:58 2014
+++ new/usr/src/uts/common/inet/sockmods/datafilt.c	Sat Nov 22 13:16:58 2014
@@ -0,0 +1,111 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2012, OmniTI Computer Consulting, Inc. All rights reserved.
+ */
+
+/*
+ * This file implements a socketfilter used to deter TCP connections.
+ * To defer a connection means to delay the return of accept(3SOCKET)
+ * until at least one byte is ready to be read(2). This filter may be
+ * applied automatically or programmatically through the use of
+ * soconfig(1M) and setsockopt(3SOCKET).
+ */
+
+#include <sys/kmem.h>
+#include <sys/systm.h>
+#include <sys/stropts.h>
+#include <sys/strsun.h>
+#include <sys/socketvar.h>
+#include <sys/sockfilter.h>
+#include <sys/note.h>
+#include <sys/taskq.h>
+
+#define	DATAFILT_MODULE "datafilt"
+
+static struct modlmisc dataf_modlmisc = {
+	&mod_miscops,
+	"Kernel data-ready socket filter"
+};
+
+static struct modlinkage dataf_modlinkage = {
+	MODREV_1,
+	&dataf_modlmisc,
+	NULL
+};
+
+static sof_rval_t
+dataf_attach_passive_cb(sof_handle_t handle, sof_handle_t ph,
+    void *parg, struct sockaddr *laddr, socklen_t laddrlen,
+    struct sockaddr *faddr, socklen_t faddrlen, void **cookiep)
+{
+	_NOTE(ARGUNUSED(handle, ph, parg, laddr, laddrlen, faddr, faddrlen,
+	cookiep));
+	return (SOF_RVAL_DEFER);
+}
+
+static void
+dataf_detach_cb(sof_handle_t handle, void *cookie, cred_t *cr)
+{
+	_NOTE(ARGUNUSED(handle, cookie, cr));
+}
+
+static mblk_t *
+dataf_data_in_cb(sof_handle_t handle, void *cookie, mblk_t *mp, int flags,
+    size_t *lenp)
+{
+	_NOTE(ARGUNUSED(handle, cookie, mp, flags, lenp));
+
+	if (mp != NULL && MBLKL(mp) > 0) {
+		sof_newconn_ready(handle);
+		sof_bypass(handle);
+	}
+
+	return (mp);
+}
+
+static sof_ops_t dataf_ops = {
+	.sofop_attach_passive = dataf_attach_passive_cb,
+	.sofop_detach = dataf_detach_cb,
+	.sofop_data_in = dataf_data_in_cb
+};
+
+int
+_init(void)
+{
+	int err;
+
+	err = sof_register(SOF_VERSION, DATAFILT_MODULE, &dataf_ops, 0);
+	if (err != 0)
+		return (err);
+	if ((err = mod_install(&dataf_modlinkage)) != 0)
+		(void) sof_unregister(DATAFILT_MODULE);
+
+	return (err);
+}
+
+int
+_fini(void)
+{
+	int err;
+
+	if ((err = sof_unregister(DATAFILT_MODULE)) != 0)
+		return (err);
+
+	return (mod_remove(&dataf_modlinkage));
+}
+
+int
+_info(struct modinfo *modinfop)
+{
+	return (mod_info(&dataf_modlinkage, modinfop));
+}
--- /dev/null	Sat Nov 22 13:16:58 2014
+++ new/usr/src/uts/common/inet/sockmods/httpfilt.c	Sat Nov 22 13:16:58 2014
@@ -0,0 +1,280 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2012, OmniTI Computer Consulting, Inc. All rights reserved.
+ * Copyright 2014 Ryan Zezeski
+ */
+
+/*
+ * This file implements a socketfilter used to defer HTTP connections.
+ * To defer a connection means to delay the return of accept(3SOCKET)
+ * until the entire HTTP request is ready (or majority in case of PUT
+ * and POST). This filter may be applied automatically or
+ * programmatically through the use of soconfig(1M) and
+ * setsockopt(3SOCKET).
+ *
+ * The point of this filter is to defer connections, not parse them.
+ * It is up to the webserver to service the request. This filter
+ * accepts both valid an invalid HTTP requests. A valid HTTP request
+ * is deferred until the CRLF sequence that separates the headers from
+ * the optional body is seen. An invalid request is one that doesn't
+ * start with a valid HTTP verb. In either case the connection will be
+ * accepted once MAX_DEFERRED_BYTES have been seen.
+ *
+ * This filter does its best to be accommodating to non-standard HTTP
+ * verbs, instead of restricting deferment to a small subset of verbs.
+ * It accepts a subset of the BNF specified in RFC2616: any sequence
+ * of capital ASCII letters, hyphen, or underscore.
+ *
+ * [A-Z_-]+
+ *
+ * This means that the filter can be tricked into thinking a request
+ * is HTTP when it is not. E.g. a request of 'GET ...' where <...>
+ * contains no LFCR or LFLF sequence. In this case, if the max bytes
+ * are never reached, the connection will stay deferred until either
+ * the client closes or the socketfilter system feels pressure and
+ * schedules this connection for close (see so_newconn() and
+ * sof_sonode_drop_deferred()).
+ *
+ * Note that req_fsm() looks for a sequence of LFCR or LFLF to
+ * indicate a complete request. This is a deliberate deviation from
+ * strict CRLFCRLF. Not all clients respect RFC2616. Popular
+ * webservers, such as nginx, will accept just LF, with no need for
+ * CR. The sequences LFCR and LFLF accept strict and non-strict
+ * clients.
+ */
+
+#include <sys/kmem.h>
+#include <sys/systm.h>
+#include <sys/stropts.h>
+#include <sys/strsun.h>
+#include <sys/socketvar.h>
+#include <sys/sockfilter.h>
+#include <sys/note.h>
+#include <sys/taskq.h>
+
+#define	HTTPFILT_MODULE		"httpfilt"
+#define	MAX_DEFERRED_BYTES	8192
+
+enum req_state { REQS_START, REQS_VERB, REQS_HEAD, REQS_CRLF, REQS_END };
+
+/*
+ * This structure is created during initialization and then passed to
+ * all callbacks so that state may be kept as message blocks arrive.
+ * This information determines when a connection will be accepted at
+ * the user socket level.
+ */
+typedef struct httpf {
+	size_t		httpf_bytes_in;	/* bytes read */
+	enum req_state	httpf_rs;	/* request state */
+} httpf_t;
+
+static struct modlmisc httpf_modlmisc = {
+	&mod_miscops,
+	"Kernel HTTP socket filter"
+};
+
+static struct modlinkage httpf_modlinkage = {
+	MODREV_1,
+	&httpf_modlmisc,
+	NULL
+};
+
+/*
+ * An FSM to determine how long the socket shall remain deferred.
+ * Given the current state and char, return the next state. The
+ * REQS_END indicates that the socket should be accepted.
+ *
+ *
+ *     +------------+           A request must start with an HTTP verb.
+ *  +--|    START   |   	This FSM will accept any verb consisting
+ *  |  +------------+		of all capital ASCII letters, hyphen, and
+ *  |        | [A-Z_-]          underscore. Any violation will move the
+ *  |        |                  FSM into the END state.
+ *  |        |    [A-Z_-]
+ *  |        |    +----+
+ * [^A-Z_-]  V    V    |
+ *  |  +------------+  |
+ *  +--|    VERB    |--+
+ *  |  +------------+
+ *  |   |
+ *  |   | ' '     [^\n]
+ *  |   |         +----+
+ *  |   V         V    |
+ *  |  +------------+  |       	This state transverses the rest of the
+ *  |  |    HEAD    |--+	the request line and all the headers.
+ *  |  +------------+		A line feed potentially indicates the
+ *  |   |          ^		end of the headers and thus the CRLF
+ *  |   | \n       | [^\r\n]	state is entered.
+ *  |   |          |
+ *  |   V          |
+ *  |  +------------+           If an LFCR or LFLF sequence is seen then
+ *  |  |    CRLF    |		all headers have been seen and the
+ *  |  +------------+		end of the request has been reached (the
+ *  |   |			optional body is not considered for
+ *  |   | [\r\n]		deferment). If the end of the request
+ *  |   |			has not been reached then return to
+ *  |   V			HEAD.
+ *  |  +------------+
+ *  +->|    END     |		Either the end of the request has been
+ *     +------------+		reached or it's not an HTTP request at
+ *				all. In any case the connection is
+ *                              accepted.
+ */
+static int
+req_fsm(enum req_state s, char ch)
+{
+	switch (s) {
+	case REQS_START:
+		if ((ch >= 'A' && ch <= 'Z') || ch == '-' || ch == '_')
+			return (REQS_VERB);
+		else
+			return (REQS_END);
+
+	case REQS_VERB:
+		if ((ch >= 'A' && ch <= 'Z') || ch == '-' || ch == '_')
+			return (REQS_VERB);
+		else if (ch == ' ')
+			return (REQS_HEAD);
+		else
+			return (REQS_END);
+
+	case REQS_HEAD:
+		return (ch == '\n' ? REQS_CRLF : REQS_HEAD);
+
+	case REQS_CRLF:
+		return ((ch == '\r' || ch == '\n') ? REQS_END : REQS_HEAD);
+
+	case REQS_END:
+		/*
+		 * Should never get here, make the compiler happy.
+		 */
+		return (REQS_END);
+	}
+
+	/* Make the compiler happy. */
+	return (REQS_END);
+}
+
+/*
+ * Return 0 to continue processing, 1 to accept the connection.
+ */
+static int
+httpf_process_input(httpf_t *httpf, mblk_t *mp)
+{
+	int i, dlen = MBLKL(mp);
+
+	for (i = 0; i < dlen; i++, httpf->httpf_bytes_in++) {
+		httpf->httpf_rs = req_fsm(httpf->httpf_rs, mp->b_rptr[i]);
+		if (httpf->httpf_rs == REQS_END)
+			return (1);
+	}
+
+	if (httpf->httpf_bytes_in >= MAX_DEFERRED_BYTES)
+		return (1);
+
+	return (0);
+}
+
+static sof_rval_t
+httpf_attach_passive_cb(sof_handle_t handle, sof_handle_t ph,
+    void *parg, struct sockaddr *laddr, socklen_t laddrlen,
+    struct sockaddr *faddr, socklen_t faddrlen, void **cookiep)
+{
+	httpf_t *new;
+
+	_NOTE(ARGUNUSED(handle, ph, parg, faddr, faddrlen, laddr, laddrlen));
+
+	new = kmem_zalloc(sizeof (httpf_t), KM_NOSLEEP | KM_NORMALPRI);
+	if (new == NULL)
+		return (SOF_RVAL_ENOMEM);
+
+	new->httpf_bytes_in = 0;
+	new->httpf_rs = REQS_START;
+	*cookiep = new;
+
+	return (SOF_RVAL_DEFER);
+}
+
+static void
+httpf_detach_cb(sof_handle_t handle, void *cookie, cred_t *cr)
+{
+	httpf_t *httpf = (httpf_t *)cookie;
+
+	_NOTE(ARGUNUSED(handle, cr));
+
+	if (httpf == NULL)
+		return;
+
+	kmem_free(httpf, sizeof (httpf_t));
+}
+
+static mblk_t *
+httpf_data_in_cb(sof_handle_t handle, void *cookie, mblk_t *mp, int flags,
+    size_t *lenp)
+{
+	httpf_t	*httpf = cookie;
+
+	_NOTE(ARGUNUSED(flags, lenp));
+
+	if (httpf == NULL) {
+		sof_bypass(handle);
+		return (mp);
+	}
+
+	if (mp == NULL)
+		return (mp);
+
+	if (httpf_process_input(httpf, mp) == 1) {
+		sof_newconn_ready(handle);
+		sof_bypass(handle);
+	}
+
+	return (mp);
+}
+
+static sof_ops_t httpf_ops = {
+	.sofop_attach_passive = httpf_attach_passive_cb,
+	.sofop_detach = httpf_detach_cb,
+	.sofop_data_in = httpf_data_in_cb,
+};
+
+int
+_init(void)
+{
+	int err;
+
+	err = sof_register(SOF_VERSION, HTTPFILT_MODULE, &httpf_ops, 0);
+	if (err != 0)
+		return (err);
+	if ((err = mod_install(&httpf_modlinkage)) != 0)
+		(void) sof_unregister(HTTPFILT_MODULE);
+
+	return (err);
+}
+
+int
+_fini(void)
+{
+	int error;
+
+	if ((error = sof_unregister(HTTPFILT_MODULE)) != 0)
+		return (error);
+
+	return (mod_remove(&httpf_modlinkage));
+}
+
+int
+_info(struct modinfo *modinfop)
+{
+	return (mod_info(&httpf_modlinkage, modinfop));
+}
--- old/usr/src/uts/intel/Makefile.intel	Sat Nov 22 13:16:59 2014
+++ new/usr/src/uts/intel/Makefile.intel	Sat Nov 22 13:16:59 2014
@@ -703,6 +703,8 @@
 SOCKET_KMODS    += socksdp
 SOCKET_KMODS	+= sockrds
 SOCKET_KMODS	+= ksslf
+SOCKET_KMODS	+= httpfilt
+SOCKET_KMODS	+= datafilt
 
 #
 #	kiconv modules (/kernel/kiconv):
--- /dev/null	Sat Nov 22 13:16:59 2014
+++ new/usr/src/uts/intel/datafilt/Makefile	Sat Nov 22 13:16:59 2014
@@ -0,0 +1,74 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2011, OmniTI Computer Consulting, Inc. All rights reserved.
+# Copyright 2012, Nexenta Systems, Inc. All rights reserved.
+#
+
+
+#
+#	Path to the base of the uts directory tree (usually /usr/src/uts).
+#
+UTSBASE	= ../..
+
+#
+#	Define the module and object file sets.
+#
+MODULE		= datafilt
+OBJECTS		= $(DATAFILT_OBJS:%=$(OBJS_DIR)/%)
+LINTS		= $(DATAFILT_OBJS:%.o=$(LINTS_DIR)/%.ln)
+ROOTMODULE	= $(ROOT_SOCK_DIR)/$(MODULE)
+
+#
+#	Include common rules.
+#
+include $(UTSBASE)/intel/Makefile.intel
+
+#
+#	Define targets
+#
+ALL_TARGET	= $(BINARY)
+LINT_TARGET	= $(MODULE).lint
+INSTALL_TARGET	= $(BINARY) $(ROOTMODULE)
+
+#
+# lint pass one enforcement and OS version
+#
+CFLAGS += $(CCVERBOSE)
+
+LDFLAGS += -dy -Nfs/sockfs -Ndrv/ip
+
+#
+#	Default build targets.
+#
+.KEEP_STATE:
+
+def:		$(DEF_DEPS)
+
+all:		$(ALL_DEPS)
+
+clean:		$(CLEAN_DEPS)
+
+clobber:	$(CLOBBER_DEPS)
+
+lint:		$(LINT_DEPS)
+
+modlintlib:	$(MODLINTLIB_DEPS)
+
+clean.lint:	$(CLEAN_LINT_DEPS)
+
+install:	$(INSTALL_DEPS)
+
+#
+#	Include common targets.
+#
+include $(UTSBASE)/intel/Makefile.targ
--- /dev/null	Sat Nov 22 13:16:59 2014
+++ new/usr/src/uts/intel/httpfilt/Makefile	Sat Nov 22 13:16:59 2014
@@ -0,0 +1,73 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2011, OmniTI Computer Consulting, Inc. All rights reserved.
+# Copyright 2012, Nexenta Systems, Inc. All rights reserved.
+#
+
+#
+#	Path to the base of the uts directory tree (usually /usr/src/uts).
+#
+UTSBASE	= ../..
+
+#
+#	Define the module and object file sets.
+#
+MODULE		= httpfilt
+OBJECTS		= $(HTTPFILT_OBJS:%=$(OBJS_DIR)/%)
+LINTS		= $(HTTPFILT_OBJS:%.o=$(LINTS_DIR)/%.ln)
+ROOTMODULE	= $(ROOT_SOCK_DIR)/$(MODULE)
+
+#
+#	Include common rules.
+#
+include $(UTSBASE)/intel/Makefile.intel
+
+#
+#	Define targets
+#
+ALL_TARGET	= $(BINARY)
+LINT_TARGET	= $(MODULE).lint
+INSTALL_TARGET	= $(BINARY) $(ROOTMODULE)
+
+#
+# lint pass one enforcement and OS version
+#
+CFLAGS += $(CCVERBOSE)
+
+LDFLAGS += -dy -Nfs/sockfs -Ndrv/ip
+
+#
+#	Default build targets.
+#
+.KEEP_STATE:
+
+def:		$(DEF_DEPS)
+
+all:		$(ALL_DEPS)
+
+clean:		$(CLEAN_DEPS)
+
+clobber:	$(CLOBBER_DEPS)
+
+lint:		$(LINT_DEPS)
+
+modlintlib:	$(MODLINTLIB_DEPS)
+
+clean.lint:	$(CLEAN_LINT_DEPS)
+
+install:	$(INSTALL_DEPS)
+
+#
+#	Include common targets.
+#
+include $(UTSBASE)/intel/Makefile.targ
--- old/usr/src/uts/sparc/Makefile.sparc	Sat Nov 22 13:16:59 2014
+++ new/usr/src/uts/sparc/Makefile.sparc	Sat Nov 22 13:16:59 2014
@@ -20,6 +20,7 @@
 #
 
 # Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
+# Copyright 2012, Nexenta Systems, Inc. All rights reserved.
 # Copyright (c) 2013 Andrew Stormont.  All rights reserved.
 
 
@@ -488,6 +489,8 @@
 SOCKET_KMODS	+= socksdp
 SOCKET_KMODS	+= sockrds
 SOCKET_KMODS	+= ksslf
+SOCKET_KMODS	+= httpfilt
+SOCKET_KMODS	+= datafilt
 
 #
 #	kiconv modules (/kernel/kiconv):
--- /dev/null	Sat Nov 22 13:16:59 2014
+++ new/usr/src/uts/sparc/datafilt/Makefile	Sat Nov 22 13:16:59 2014
@@ -0,0 +1,73 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2011, OmniTI Computer Consulting, Inc. All rights reserved.
+# Copyright 2012, Nexenta Systems, Inc. All rights reserved.
+#
+
+#
+#	Path to the base of the uts directory tree (usually /usr/src/uts).
+#
+UTSBASE	= ../..
+
+#
+#	Define the module and object file sets.
+#
+MODULE		= datafilt
+OBJECTS		= $(DATAFILT_OBJS:%=$(OBJS_DIR)/%)
+LINTS		= $(DATAFILT_OBJS:%.o=$(LINTS_DIR)/%.ln)
+ROOTMODULE	= $(ROOT_SOCK_DIR)/$(MODULE)
+
+#
+#	Include common rules.
+#
+include $(UTSBASE)/sparc/Makefile.sparc
+
+#
+#	Define targets
+#
+ALL_TARGET	= $(BINARY)
+LINT_TARGET	= $(MODULE).lint
+INSTALL_TARGET	= $(BINARY) $(ROOTMODULE)
+
+#
+# lint pass one enforcement and OS version
+#
+CFLAGS += $(CCVERBOSE)
+
+LDFLAGS += -dy -Nfs/sockfs -Ndrv/ip
+
+#
+#	Default build targets.
+#
+.KEEP_STATE:
+
+def:		$(DEF_DEPS)
+
+all:		$(ALL_DEPS)
+
+clean:		$(CLEAN_DEPS)
+
+clobber:	$(CLOBBER_DEPS)
+
+lint:		$(LINT_DEPS)
+
+modlintlib:	$(MODLINTLIB_DEPS)
+
+clean.lint:	$(CLEAN_LINT_DEPS)
+
+install:	$(INSTALL_DEPS)
+
+#
+#	Include common targets.
+#
+include $(UTSBASE)/sparc/Makefile.targ
--- /dev/null	Sat Nov 22 13:16:59 2014
+++ new/usr/src/uts/sparc/httpfilt/Makefile	Sat Nov 22 13:16:59 2014
@@ -0,0 +1,73 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2011, OmniTI Computer Consulting, Inc. All rights reserved.
+# Copyright 2012, Nexenta Systems, Inc. All rights reserved.
+#
+
+#
+#	Path to the base of the uts directory tree (usually /usr/src/uts).
+#
+UTSBASE	= ../..
+
+#
+#	Define the module and object file sets.
+#
+MODULE		= httpfilt
+OBJECTS		= $(HTTPFILT_OBJS:%=$(OBJS_DIR)/%)
+LINTS		= $(HTTPFILT_OBJS:%.o=$(LINTS_DIR)/%.ln)
+ROOTMODULE	= $(ROOT_SOCK_DIR)/$(MODULE)
+
+#
+#	Include common rules.
+#
+include $(UTSBASE)/sparc/Makefile.sparc
+
+#
+#	Define targets
+#
+ALL_TARGET	= $(BINARY)
+LINT_TARGET	= $(MODULE).lint
+INSTALL_TARGET	= $(BINARY) $(ROOTMODULE)
+
+#
+# lint pass one enforcement and OS version
+#
+CFLAGS += $(CCVERBOSE)
+
+LDFLAGS += -dy -Nfs/sockfs -Ndrv/ip
+
+#
+#	Default build targets.
+#
+.KEEP_STATE:
+
+def:		$(DEF_DEPS)
+
+all:		$(ALL_DEPS)
+
+clean:		$(CLEAN_DEPS)
+
+clobber:	$(CLOBBER_DEPS)
+
+lint:		$(LINT_DEPS)
+
+modlintlib:	$(MODLINTLIB_DEPS)
+
+clean.lint:	$(CLEAN_LINT_DEPS)
+
+install:	$(INSTALL_DEPS)
+
+#
+#	Include common targets.
+#
+include $(UTSBASE)/sparc/Makefile.targ
