xref: /freebsd/sys/netinet6/in6.c (revision d2387d42b8da231a5b95cbc313825fb2aadf26f6)
1 /*	$FreeBSD$	*/
2 /*	$KAME: in6.c,v 1.259 2002/01/21 11:37:50 keiichi Exp $	*/
3 
4 /*
5  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. Neither the name of the project nor the names of its contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  */
32 
33 /*
34  * Copyright (c) 1982, 1986, 1991, 1993
35  *	The Regents of the University of California.  All rights reserved.
36  *
37  * Redistribution and use in source and binary forms, with or without
38  * modification, are permitted provided that the following conditions
39  * are met:
40  * 1. Redistributions of source code must retain the above copyright
41  *    notice, this list of conditions and the following disclaimer.
42  * 2. Redistributions in binary form must reproduce the above copyright
43  *    notice, this list of conditions and the following disclaimer in the
44  *    documentation and/or other materials provided with the distribution.
45  * 3. All advertising materials mentioning features or use of this software
46  *    must display the following acknowledgement:
47  *	This product includes software developed by the University of
48  *	California, Berkeley and its contributors.
49  * 4. Neither the name of the University nor the names of its contributors
50  *    may be used to endorse or promote products derived from this software
51  *    without specific prior written permission.
52  *
53  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
54  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
55  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
56  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
57  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
58  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
59  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
60  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
61  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
62  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
63  * SUCH DAMAGE.
64  *
65  *	@(#)in.c	8.2 (Berkeley) 11/15/93
66  */
67 
68 #include "opt_inet.h"
69 #include "opt_inet6.h"
70 
71 #include <sys/param.h>
72 #include <sys/errno.h>
73 #include <sys/malloc.h>
74 #include <sys/socket.h>
75 #include <sys/socketvar.h>
76 #include <sys/sockio.h>
77 #include <sys/systm.h>
78 #include <sys/proc.h>
79 #include <sys/time.h>
80 #include <sys/kernel.h>
81 #include <sys/syslog.h>
82 
83 #include <net/if.h>
84 #include <net/if_types.h>
85 #include <net/route.h>
86 #include <net/if_dl.h>
87 
88 #include <netinet/in.h>
89 #include <netinet/in_var.h>
90 #include <netinet/if_ether.h>
91 #include <netinet/in_systm.h>
92 #include <netinet/ip.h>
93 #include <netinet/in_pcb.h>
94 
95 #include <netinet/ip6.h>
96 #include <netinet6/ip6_var.h>
97 #include <netinet6/nd6.h>
98 #include <netinet6/mld6_var.h>
99 #include <netinet6/ip6_mroute.h>
100 #include <netinet6/in6_ifattach.h>
101 #include <netinet6/scope6_var.h>
102 #include <netinet6/in6_pcb.h>
103 
104 #include <net/net_osdep.h>
105 
106 MALLOC_DEFINE(M_IPMADDR, "in6_multi", "internet multicast address");
107 
108 /*
109  * Definitions of some costant IP6 addresses.
110  */
111 const struct in6_addr in6addr_any = IN6ADDR_ANY_INIT;
112 const struct in6_addr in6addr_loopback = IN6ADDR_LOOPBACK_INIT;
113 const struct in6_addr in6addr_nodelocal_allnodes =
114 	IN6ADDR_NODELOCAL_ALLNODES_INIT;
115 const struct in6_addr in6addr_linklocal_allnodes =
116 	IN6ADDR_LINKLOCAL_ALLNODES_INIT;
117 const struct in6_addr in6addr_linklocal_allrouters =
118 	IN6ADDR_LINKLOCAL_ALLROUTERS_INIT;
119 
120 const struct in6_addr in6mask0 = IN6MASK0;
121 const struct in6_addr in6mask32 = IN6MASK32;
122 const struct in6_addr in6mask64 = IN6MASK64;
123 const struct in6_addr in6mask96 = IN6MASK96;
124 const struct in6_addr in6mask128 = IN6MASK128;
125 
126 const struct sockaddr_in6 sa6_any =
127 	{ sizeof(sa6_any), AF_INET6, 0, 0, IN6ADDR_ANY_INIT, 0 };
128 
129 static int in6_lifaddr_ioctl __P((struct socket *, u_long, caddr_t,
130 	struct ifnet *, struct thread *));
131 static int in6_ifinit __P((struct ifnet *, struct in6_ifaddr *,
132 	struct sockaddr_in6 *, int));
133 static void in6_unlink_ifa __P((struct in6_ifaddr *, struct ifnet *));
134 
135 struct in6_multihead in6_multihead;	/* XXX BSS initialization */
136 int	(*faithprefix_p)(struct in6_addr *);
137 
138 /*
139  * Subroutine for in6_ifaddloop() and in6_ifremloop().
140  * This routine does actual work.
141  */
142 static void
143 in6_ifloop_request(int cmd, struct ifaddr *ifa)
144 {
145 	struct sockaddr_in6 all1_sa;
146 	struct rtentry *nrt = NULL;
147 	int e;
148 
149 	bzero(&all1_sa, sizeof(all1_sa));
150 	all1_sa.sin6_family = AF_INET6;
151 	all1_sa.sin6_len = sizeof(struct sockaddr_in6);
152 	all1_sa.sin6_addr = in6mask128;
153 
154 	/*
155 	 * We specify the address itself as the gateway, and set the
156 	 * RTF_LLINFO flag, so that the corresponding host route would have
157 	 * the flag, and thus applications that assume traditional behavior
158 	 * would be happy.  Note that we assume the caller of the function
159 	 * (probably implicitly) set nd6_rtrequest() to ifa->ifa_rtrequest,
160 	 * which changes the outgoing interface to the loopback interface.
161 	 */
162 	e = rtrequest(cmd, ifa->ifa_addr, ifa->ifa_addr,
163 	    (struct sockaddr *)&all1_sa, RTF_UP|RTF_HOST|RTF_LLINFO, &nrt);
164 	if (e != 0) {
165 		/* XXX need more descriptive message */
166 		log(LOG_ERR, "in6_ifloop_request: "
167 		    "%s operation failed for %s (errno=%d)\n",
168 		    cmd == RTM_ADD ? "ADD" : "DELETE",
169 		    ip6_sprintf(&((struct in6_ifaddr *)ifa)->ia_addr.sin6_addr),
170 		    e);
171 	}
172 
173 	if (nrt) {
174 		RT_LOCK(nrt);
175 		/*
176 		 * Make sure rt_ifa be equal to IFA, the second argument of
177 		 * the function.  We need this because when we refer to
178 		 * rt_ifa->ia6_flags in ip6_input, we assume that the rt_ifa
179 		 * points to the address instead of the loopback address.
180 		 */
181 		if (cmd == RTM_ADD && ifa != nrt->rt_ifa) {
182 			IFAFREE(nrt->rt_ifa);
183 			IFAREF(ifa);
184 			nrt->rt_ifa = ifa;
185 		}
186 
187 		/*
188 		 * Report the addition/removal of the address to the routing
189 		 * socket.
190 		 *
191 		 * XXX: since we called rtinit for a p2p interface with a
192 		 *      destination, we end up reporting twice in such a case.
193 		 *      Should we rather omit the second report?
194 		 */
195 		rt_newaddrmsg(cmd, ifa, e, nrt);
196 		if (cmd == RTM_DELETE) {
197 			rtfree(nrt);
198 		} else {
199 			/* the cmd must be RTM_ADD here */
200 			RT_REMREF(nrt);
201 			RT_UNLOCK(nrt);
202 		}
203 	}
204 }
205 
206 /*
207  * Add ownaddr as loopback rtentry.  We previously add the route only if
208  * necessary (ex. on a p2p link).  However, since we now manage addresses
209  * separately from prefixes, we should always add the route.  We can't
210  * rely on the cloning mechanism from the corresponding interface route
211  * any more.
212  */
213 static void
214 in6_ifaddloop(struct ifaddr *ifa)
215 {
216 	struct rtentry *rt;
217 	int need_loop;
218 
219 	/* If there is no loopback entry, allocate one. */
220 	rt = rtalloc1(ifa->ifa_addr, 0, 0);
221 	need_loop = (rt == NULL || (rt->rt_flags & RTF_HOST) == 0 ||
222 	    (rt->rt_ifp->if_flags & IFF_LOOPBACK) == 0);
223 	if (rt)
224 		rtfree(rt);
225 	if (need_loop)
226 		in6_ifloop_request(RTM_ADD, ifa);
227 }
228 
229 /*
230  * Remove loopback rtentry of ownaddr generated by in6_ifaddloop(),
231  * if it exists.
232  */
233 static void
234 in6_ifremloop(struct ifaddr *ifa)
235 {
236 	struct in6_ifaddr *ia;
237 	struct rtentry *rt;
238 	int ia_count = 0;
239 
240 	/*
241 	 * Some of BSD variants do not remove cloned routes
242 	 * from an interface direct route, when removing the direct route
243 	 * (see comments in net/net_osdep.h).  Even for variants that do remove
244 	 * cloned routes, they could fail to remove the cloned routes when
245 	 * we handle multple addresses that share a common prefix.
246 	 * So, we should remove the route corresponding to the deleted address
247 	 * regardless of the result of in6_is_ifloop_auto().
248 	 */
249 
250 	/*
251 	 * Delete the entry only if exact one ifa exists.  More than one ifa
252 	 * can exist if we assign a same single address to multiple
253 	 * (probably p2p) interfaces.
254 	 * XXX: we should avoid such a configuration in IPv6...
255 	 */
256 	for (ia = in6_ifaddr; ia; ia = ia->ia_next) {
257 		if (IN6_ARE_ADDR_EQUAL(IFA_IN6(ifa), &ia->ia_addr.sin6_addr)) {
258 			ia_count++;
259 			if (ia_count > 1)
260 				break;
261 		}
262 	}
263 
264 	if (ia_count == 1) {
265 		/*
266 		 * Before deleting, check if a corresponding loopbacked host
267 		 * route surely exists.  With this check, we can avoid to
268 		 * delete an interface direct route whose destination is same
269 		 * as the address being removed.  This can happen when removing
270 		 * a subnet-router anycast address on an interface attahced
271 		 * to a shared medium.
272 		 */
273 		rt = rtalloc1(ifa->ifa_addr, 0, 0);
274 		if (rt != NULL) {
275 			if ((rt->rt_flags & RTF_HOST) != 0 &&
276 			    (rt->rt_ifp->if_flags & IFF_LOOPBACK) != 0) {
277 				rtfree(rt);
278 				in6_ifloop_request(RTM_DELETE, ifa);
279 			} else
280 				RT_UNLOCK(rt);
281 		}
282 	}
283 }
284 
285 int
286 in6_mask2len(mask, lim0)
287 	struct in6_addr *mask;
288 	u_char *lim0;
289 {
290 	int x = 0, y;
291 	u_char *lim = lim0, *p;
292 
293 	/* ignore the scope_id part */
294 	if (lim0 == NULL || lim0 - (u_char *)mask > sizeof(*mask))
295 		lim = (u_char *)mask + sizeof(*mask);
296 	for (p = (u_char *)mask; p < lim; x++, p++) {
297 		if (*p != 0xff)
298 			break;
299 	}
300 	y = 0;
301 	if (p < lim) {
302 		for (y = 0; y < 8; y++) {
303 			if ((*p & (0x80 >> y)) == 0)
304 				break;
305 		}
306 	}
307 
308 	/*
309 	 * when the limit pointer is given, do a stricter check on the
310 	 * remaining bits.
311 	 */
312 	if (p < lim) {
313 		if (y != 0 && (*p & (0x00ff >> y)) != 0)
314 			return (-1);
315 		for (p = p + 1; p < lim; p++)
316 			if (*p != 0)
317 				return (-1);
318 	}
319 
320 	return x * 8 + y;
321 }
322 
323 #define ifa2ia6(ifa)	((struct in6_ifaddr *)(ifa))
324 #define ia62ifa(ia6)	(&((ia6)->ia_ifa))
325 
326 int
327 in6_control(so, cmd, data, ifp, td)
328 	struct	socket *so;
329 	u_long cmd;
330 	caddr_t	data;
331 	struct ifnet *ifp;
332 	struct thread *td;
333 {
334 	struct	in6_ifreq *ifr = (struct in6_ifreq *)data;
335 	struct	in6_ifaddr *ia = NULL;
336 	struct	in6_aliasreq *ifra = (struct in6_aliasreq *)data;
337 	int privileged;
338 
339 	privileged = 0;
340 	if (td == NULL || !suser(td))
341 		privileged++;
342 
343 	switch (cmd) {
344 	case SIOCGETSGCNT_IN6:
345 	case SIOCGETMIFCNT_IN6:
346 		return (mrt6_ioctl(cmd, data));
347 	}
348 
349 	switch(cmd) {
350 	case SIOCAADDRCTL_POLICY:
351 	case SIOCDADDRCTL_POLICY:
352 		if (!privileged)
353 			return (EPERM);
354 		return (in6_src_ioctl(cmd, data));
355 	}
356 
357 	if (ifp == NULL)
358 		return (EOPNOTSUPP);
359 
360 	switch (cmd) {
361 	case SIOCSNDFLUSH_IN6:
362 	case SIOCSPFXFLUSH_IN6:
363 	case SIOCSRTRFLUSH_IN6:
364 	case SIOCSDEFIFACE_IN6:
365 	case SIOCSIFINFO_FLAGS:
366 		if (!privileged)
367 			return (EPERM);
368 		/* FALLTHROUGH */
369 	case OSIOCGIFINFO_IN6:
370 	case SIOCGIFINFO_IN6:
371 	case SIOCGDRLST_IN6:
372 	case SIOCGPRLST_IN6:
373 	case SIOCGNBRINFO_IN6:
374 	case SIOCGDEFIFACE_IN6:
375 		return (nd6_ioctl(cmd, data, ifp));
376 	}
377 
378 	switch (cmd) {
379 	case SIOCSIFPREFIX_IN6:
380 	case SIOCDIFPREFIX_IN6:
381 	case SIOCAIFPREFIX_IN6:
382 	case SIOCCIFPREFIX_IN6:
383 	case SIOCSGIFPREFIX_IN6:
384 	case SIOCGIFPREFIX_IN6:
385 		log(LOG_NOTICE,
386 		    "prefix ioctls are now invalidated. "
387 		    "please use ifconfig.\n");
388 		return (EOPNOTSUPP);
389 	}
390 
391 	switch (cmd) {
392 	case SIOCSSCOPE6:
393 		if (!privileged)
394 			return (EPERM);
395 		return (scope6_set(ifp,
396 		    (struct scope6_id *)ifr->ifr_ifru.ifru_scope_id));
397 	case SIOCGSCOPE6:
398 		return (scope6_get(ifp,
399 		    (struct scope6_id *)ifr->ifr_ifru.ifru_scope_id));
400 	case SIOCGSCOPE6DEF:
401 		return (scope6_get_default((struct scope6_id *)
402 		    ifr->ifr_ifru.ifru_scope_id));
403 	}
404 
405 	switch (cmd) {
406 	case SIOCALIFADDR:
407 	case SIOCDLIFADDR:
408 		if (!privileged)
409 			return (EPERM);
410 		/* FALLTHROUGH */
411 	case SIOCGLIFADDR:
412 		return in6_lifaddr_ioctl(so, cmd, data, ifp, td);
413 	}
414 
415 	/*
416 	 * Find address for this interface, if it exists.
417 	 */
418 	if (ifra->ifra_addr.sin6_family == AF_INET6) { /* XXX */
419 		struct sockaddr_in6 *sa6 =
420 			(struct sockaddr_in6 *)&ifra->ifra_addr;
421 
422 		if (IN6_IS_ADDR_LINKLOCAL(&sa6->sin6_addr)) {
423 			if (sa6->sin6_addr.s6_addr16[1] == 0) {
424 				/* link ID is not embedded by the user */
425 				sa6->sin6_addr.s6_addr16[1] =
426 				    htons(ifp->if_index);
427 			} else if (sa6->sin6_addr.s6_addr16[1] !=
428 			    htons(ifp->if_index)) {
429 				return (EINVAL);	/* link ID contradicts */
430 			}
431 			if (sa6->sin6_scope_id) {
432 				if (sa6->sin6_scope_id !=
433 				    (u_int32_t)ifp->if_index)
434 					return (EINVAL);
435 				sa6->sin6_scope_id = 0; /* XXX: good way? */
436 			}
437 		}
438 		ia = in6ifa_ifpwithaddr(ifp, &ifra->ifra_addr.sin6_addr);
439 	}
440 
441 	switch (cmd) {
442 	case SIOCSIFADDR_IN6:
443 	case SIOCSIFDSTADDR_IN6:
444 	case SIOCSIFNETMASK_IN6:
445 		/*
446 		 * Since IPv6 allows a node to assign multiple addresses
447 		 * on a single interface, SIOCSIFxxx ioctls are not suitable
448 		 * and should be unused.
449 		 */
450 		/* we decided to obsolete this command (20000704) */
451 		return (EINVAL);
452 
453 	case SIOCDIFADDR_IN6:
454 		/*
455 		 * for IPv4, we look for existing in_ifaddr here to allow
456 		 * "ifconfig if0 delete" to remove first IPv4 address on the
457 		 * interface.  For IPv6, as the spec allow multiple interface
458 		 * address from the day one, we consider "remove the first one"
459 		 * semantics to be not preferable.
460 		 */
461 		if (ia == NULL)
462 			return (EADDRNOTAVAIL);
463 		/* FALLTHROUGH */
464 	case SIOCAIFADDR_IN6:
465 		/*
466 		 * We always require users to specify a valid IPv6 address for
467 		 * the corresponding operation.
468 		 */
469 		if (ifra->ifra_addr.sin6_family != AF_INET6 ||
470 		    ifra->ifra_addr.sin6_len != sizeof(struct sockaddr_in6))
471 			return (EAFNOSUPPORT);
472 		if (!privileged)
473 			return (EPERM);
474 
475 		break;
476 
477 	case SIOCGIFADDR_IN6:
478 		/* This interface is basically deprecated. use SIOCGIFCONF. */
479 		/* FALLTHROUGH */
480 	case SIOCGIFAFLAG_IN6:
481 	case SIOCGIFNETMASK_IN6:
482 	case SIOCGIFDSTADDR_IN6:
483 	case SIOCGIFALIFETIME_IN6:
484 		/* must think again about its semantics */
485 		if (ia == NULL)
486 			return (EADDRNOTAVAIL);
487 		break;
488 	case SIOCSIFALIFETIME_IN6:
489 	    {
490 		struct in6_addrlifetime *lt;
491 
492 		if (!privileged)
493 			return (EPERM);
494 		if (ia == NULL)
495 			return (EADDRNOTAVAIL);
496 		/* sanity for overflow - beware unsigned */
497 		lt = &ifr->ifr_ifru.ifru_lifetime;
498 		if (lt->ia6t_vltime != ND6_INFINITE_LIFETIME &&
499 		    lt->ia6t_vltime + time_second < time_second) {
500 			return EINVAL;
501 		}
502 		if (lt->ia6t_pltime != ND6_INFINITE_LIFETIME &&
503 		    lt->ia6t_pltime + time_second < time_second) {
504 			return EINVAL;
505 		}
506 		break;
507 	    }
508 	}
509 
510 	switch (cmd) {
511 
512 	case SIOCGIFADDR_IN6:
513 		ifr->ifr_addr = ia->ia_addr;
514 		break;
515 
516 	case SIOCGIFDSTADDR_IN6:
517 		if ((ifp->if_flags & IFF_POINTOPOINT) == 0)
518 			return (EINVAL);
519 		/*
520 		 * XXX: should we check if ifa_dstaddr is NULL and return
521 		 * an error?
522 		 */
523 		ifr->ifr_dstaddr = ia->ia_dstaddr;
524 		break;
525 
526 	case SIOCGIFNETMASK_IN6:
527 		ifr->ifr_addr = ia->ia_prefixmask;
528 		break;
529 
530 	case SIOCGIFAFLAG_IN6:
531 		ifr->ifr_ifru.ifru_flags6 = ia->ia6_flags;
532 		break;
533 
534 	case SIOCGIFSTAT_IN6:
535 		if (ifp == NULL)
536 			return EINVAL;
537 		bzero(&ifr->ifr_ifru.ifru_stat,
538 		    sizeof(ifr->ifr_ifru.ifru_stat));
539 		ifr->ifr_ifru.ifru_stat =
540 		    *((struct in6_ifextra *)ifp->if_afdata[AF_INET6])->in6_ifstat;
541 		break;
542 
543 	case SIOCGIFSTAT_ICMP6:
544 		if (ifp == NULL)
545 			return EINVAL;
546 		bzero(&ifr->ifr_ifru.ifru_stat,
547 		    sizeof(ifr->ifr_ifru.ifru_icmp6stat));
548 		ifr->ifr_ifru.ifru_icmp6stat =
549 		    *((struct in6_ifextra *)ifp->if_afdata[AF_INET6])->icmp6_ifstat;
550 		break;
551 
552 	case SIOCGIFALIFETIME_IN6:
553 		ifr->ifr_ifru.ifru_lifetime = ia->ia6_lifetime;
554 		break;
555 
556 	case SIOCSIFALIFETIME_IN6:
557 		ia->ia6_lifetime = ifr->ifr_ifru.ifru_lifetime;
558 		/* for sanity */
559 		if (ia->ia6_lifetime.ia6t_vltime != ND6_INFINITE_LIFETIME) {
560 			ia->ia6_lifetime.ia6t_expire =
561 				time_second + ia->ia6_lifetime.ia6t_vltime;
562 		} else
563 			ia->ia6_lifetime.ia6t_expire = 0;
564 		if (ia->ia6_lifetime.ia6t_pltime != ND6_INFINITE_LIFETIME) {
565 			ia->ia6_lifetime.ia6t_preferred =
566 				time_second + ia->ia6_lifetime.ia6t_pltime;
567 		} else
568 			ia->ia6_lifetime.ia6t_preferred = 0;
569 		break;
570 
571 	case SIOCAIFADDR_IN6:
572 	{
573 		int i, error = 0;
574 		struct nd_prefix pr0, *pr;
575 
576 		/*
577 		 * first, make or update the interface address structure,
578 		 * and link it to the list.
579 		 */
580 		if ((error = in6_update_ifa(ifp, ifra, ia)) != 0)
581 			return (error);
582 
583 		/*
584 		 * then, make the prefix on-link on the interface.
585 		 * XXX: we'd rather create the prefix before the address, but
586 		 * we need at least one address to install the corresponding
587 		 * interface route, so we configure the address first.
588 		 */
589 
590 		/*
591 		 * convert mask to prefix length (prefixmask has already
592 		 * been validated in in6_update_ifa().
593 		 */
594 		bzero(&pr0, sizeof(pr0));
595 		pr0.ndpr_ifp = ifp;
596 		pr0.ndpr_plen = in6_mask2len(&ifra->ifra_prefixmask.sin6_addr,
597 		    NULL);
598 		if (pr0.ndpr_plen == 128) {
599 			break;	/* we don't need to install a host route. */
600 		}
601 		pr0.ndpr_prefix = ifra->ifra_addr;
602 		pr0.ndpr_mask = ifra->ifra_prefixmask.sin6_addr;
603 		/* apply the mask for safety. */
604 		for (i = 0; i < 4; i++) {
605 			pr0.ndpr_prefix.sin6_addr.s6_addr32[i] &=
606 			    ifra->ifra_prefixmask.sin6_addr.s6_addr32[i];
607 		}
608 		/*
609 		 * XXX: since we don't have an API to set prefix (not address)
610 		 * lifetimes, we just use the same lifetimes as addresses.
611 		 * The (temporarily) installed lifetimes can be overridden by
612 		 * later advertised RAs (when accept_rtadv is non 0), which is
613 		 * an intended behavior.
614 		 */
615 		pr0.ndpr_raf_onlink = 1; /* should be configurable? */
616 		pr0.ndpr_raf_auto =
617 		    ((ifra->ifra_flags & IN6_IFF_AUTOCONF) != 0);
618 		pr0.ndpr_vltime = ifra->ifra_lifetime.ia6t_vltime;
619 		pr0.ndpr_pltime = ifra->ifra_lifetime.ia6t_pltime;
620 
621 		/* add the prefix if not yet. */
622 		if ((pr = nd6_prefix_lookup(&pr0)) == NULL) {
623 			/*
624 			 * nd6_prelist_add will install the corresponding
625 			 * interface route.
626 			 */
627 			if ((error = nd6_prelist_add(&pr0, NULL, &pr)) != 0)
628 				return (error);
629 			if (pr == NULL) {
630 				log(LOG_ERR, "nd6_prelist_add succeeded but "
631 				    "no prefix\n");
632 				return (EINVAL); /* XXX panic here? */
633 			}
634 		}
635 		if ((ia = in6ifa_ifpwithaddr(ifp, &ifra->ifra_addr.sin6_addr))
636 		    == NULL) {
637 		    	/* XXX: this should not happen! */
638 			log(LOG_ERR, "in6_control: addition succeeded, but"
639 			    " no ifaddr\n");
640 		} else {
641 			if ((ia->ia6_flags & IN6_IFF_AUTOCONF) != 0 &&
642 			    ia->ia6_ndpr == NULL) { /* new autoconfed addr */
643 				ia->ia6_ndpr = pr;
644 				pr->ndpr_refcnt++;
645 
646 				/*
647 				 * If this is the first autoconf address from
648 				 * the prefix, create a temporary address
649 				 * as well (when specified).
650 				 */
651 				if (ip6_use_tempaddr &&
652 				    pr->ndpr_refcnt == 1) {
653 					int e;
654 					if ((e = in6_tmpifadd(ia, 1)) != 0) {
655 						log(LOG_NOTICE, "in6_control: "
656 						    "failed to create a "
657 						    "temporary address, "
658 						    "errno=%d\n", e);
659 					}
660 				}
661 			}
662 
663 			/*
664 			 * this might affect the status of autoconfigured
665 			 * addresses, that is, this address might make
666 			 * other addresses detached.
667 			 */
668 			pfxlist_onlink_check();
669 		}
670 		if (error == 0 && ia)
671 			EVENTHANDLER_INVOKE(ifaddr_event, ifp);
672 		break;
673 	}
674 
675 	case SIOCDIFADDR_IN6:
676 	{
677 		int i = 0;
678 		struct nd_prefix pr0, *pr;
679 
680 		/*
681 		 * If the address being deleted is the only one that owns
682 		 * the corresponding prefix, expire the prefix as well.
683 		 * XXX: theoretically, we don't have to worry about such
684 		 * relationship, since we separate the address management
685 		 * and the prefix management.  We do this, however, to provide
686 		 * as much backward compatibility as possible in terms of
687 		 * the ioctl operation.
688 		 */
689 		bzero(&pr0, sizeof(pr0));
690 		pr0.ndpr_ifp = ifp;
691 		pr0.ndpr_plen = in6_mask2len(&ia->ia_prefixmask.sin6_addr,
692 					     NULL);
693 		if (pr0.ndpr_plen == 128)
694 			goto purgeaddr;
695 		pr0.ndpr_prefix = ia->ia_addr;
696 		pr0.ndpr_mask = ia->ia_prefixmask.sin6_addr;
697 		for (i = 0; i < 4; i++) {
698 			pr0.ndpr_prefix.sin6_addr.s6_addr32[i] &=
699 				ia->ia_prefixmask.sin6_addr.s6_addr32[i];
700 		}
701 		/*
702 		 * The logic of the following condition is a bit complicated.
703 		 * We expire the prefix when
704 		 * 1. the address obeys autoconfiguration and it is the
705 		 *    only owner of the associated prefix, or
706 		 * 2. the address does not obey autoconf and there is no
707 		 *    other owner of the prefix.
708 		 */
709 		if ((pr = nd6_prefix_lookup(&pr0)) != NULL &&
710 		    (((ia->ia6_flags & IN6_IFF_AUTOCONF) != 0 &&
711 		      pr->ndpr_refcnt == 1) ||
712 		     ((ia->ia6_flags & IN6_IFF_AUTOCONF) == 0 &&
713 		      pr->ndpr_refcnt == 0))) {
714 			pr->ndpr_expire = 1; /* XXX: just for expiration */
715 		}
716 
717 	  purgeaddr:
718 		in6_purgeaddr(&ia->ia_ifa);
719 		EVENTHANDLER_INVOKE(ifaddr_event, ifp);
720 		break;
721 	}
722 
723 	default:
724 		if (ifp == NULL || ifp->if_ioctl == 0)
725 			return (EOPNOTSUPP);
726 		return ((*ifp->if_ioctl)(ifp, cmd, data));
727 	}
728 
729 	return (0);
730 }
731 
732 /*
733  * Update parameters of an IPv6 interface address.
734  * If necessary, a new entry is created and linked into address chains.
735  * This function is separated from in6_control().
736  * XXX: should this be performed under splnet()?
737  */
738 int
739 in6_update_ifa(ifp, ifra, ia)
740 	struct ifnet *ifp;
741 	struct in6_aliasreq *ifra;
742 	struct in6_ifaddr *ia;
743 {
744 	int error = 0, hostIsNew = 0, plen = -1;
745 	struct in6_ifaddr *oia;
746 	struct sockaddr_in6 dst6;
747 	struct in6_addrlifetime *lt;
748 
749 	/* Validate parameters */
750 	if (ifp == NULL || ifra == NULL) /* this maybe redundant */
751 		return (EINVAL);
752 
753 	/*
754 	 * The destination address for a p2p link must have a family
755 	 * of AF_UNSPEC or AF_INET6.
756 	 */
757 	if ((ifp->if_flags & IFF_POINTOPOINT) != 0 &&
758 	    ifra->ifra_dstaddr.sin6_family != AF_INET6 &&
759 	    ifra->ifra_dstaddr.sin6_family != AF_UNSPEC)
760 		return (EAFNOSUPPORT);
761 	/*
762 	 * validate ifra_prefixmask.  don't check sin6_family, netmask
763 	 * does not carry fields other than sin6_len.
764 	 */
765 	if (ifra->ifra_prefixmask.sin6_len > sizeof(struct sockaddr_in6))
766 		return (EINVAL);
767 	/*
768 	 * Because the IPv6 address architecture is classless, we require
769 	 * users to specify a (non 0) prefix length (mask) for a new address.
770 	 * We also require the prefix (when specified) mask is valid, and thus
771 	 * reject a non-consecutive mask.
772 	 */
773 	if (ia == NULL && ifra->ifra_prefixmask.sin6_len == 0)
774 		return (EINVAL);
775 	if (ifra->ifra_prefixmask.sin6_len != 0) {
776 		plen = in6_mask2len(&ifra->ifra_prefixmask.sin6_addr,
777 		    (u_char *)&ifra->ifra_prefixmask +
778 		    ifra->ifra_prefixmask.sin6_len);
779 		if (plen <= 0)
780 			return (EINVAL);
781 	} else {
782 		/*
783 		 * In this case, ia must not be NULL.  We just use its prefix
784 		 * length.
785 		 */
786 		plen = in6_mask2len(&ia->ia_prefixmask.sin6_addr, NULL);
787 	}
788 	/*
789 	 * If the destination address on a p2p interface is specified,
790 	 * and the address is a scoped one, validate/set the scope
791 	 * zone identifier.
792 	 */
793 	dst6 = ifra->ifra_dstaddr;
794 	if ((ifp->if_flags & (IFF_POINTOPOINT|IFF_LOOPBACK)) != 0 &&
795 	    (dst6.sin6_family == AF_INET6)) {
796 		u_int32_t zoneid;
797 
798 		if ((error = in6_recoverscope(&dst6,
799 		    &ifra->ifra_dstaddr.sin6_addr, ifp)) != 0)
800 			return (error);
801 		if (in6_addr2zoneid(ifp, &dst6.sin6_addr, &zoneid))
802 			return (EINVAL);
803 		if (dst6.sin6_scope_id == 0) /* user omit to specify the ID. */
804 			dst6.sin6_scope_id = zoneid;
805 		else if (dst6.sin6_scope_id != zoneid)
806 			return (EINVAL); /* scope ID mismatch. */
807 		if ((error = in6_embedscope(&dst6.sin6_addr, &dst6, NULL, NULL))
808 		    != 0)
809 			return (error);
810 		dst6.sin6_scope_id = 0; /* XXX */
811 	}
812 	/*
813 	 * The destination address can be specified only for a p2p or a
814 	 * loopback interface.  If specified, the corresponding prefix length
815 	 * must be 128.
816 	 */
817 	if (ifra->ifra_dstaddr.sin6_family == AF_INET6) {
818 		if ((ifp->if_flags & (IFF_POINTOPOINT|IFF_LOOPBACK)) == 0) {
819 			/* XXX: noisy message */
820 			nd6log((LOG_INFO, "in6_update_ifa: a destination can "
821 			    "be specified for a p2p or a loopback IF only\n"));
822 			return (EINVAL);
823 		}
824 		if (plen != 128) {
825 			nd6log((LOG_INFO, "in6_update_ifa: prefixlen should "
826 			    "be 128 when dstaddr is specified\n"));
827 			return (EINVAL);
828 		}
829 	}
830 	/* lifetime consistency check */
831 	lt = &ifra->ifra_lifetime;
832 	if (lt->ia6t_vltime != ND6_INFINITE_LIFETIME
833 	    && lt->ia6t_vltime + time_second < time_second) {
834 		return EINVAL;
835 	}
836 	if (lt->ia6t_vltime == 0) {
837 		/*
838 		 * the following log might be noisy, but this is a typical
839 		 * configuration mistake or a tool's bug.
840 		 */
841 		nd6log((LOG_INFO,
842 		    "in6_update_ifa: valid lifetime is 0 for %s\n",
843 		    ip6_sprintf(&ifra->ifra_addr.sin6_addr)));
844 	}
845 	if (lt->ia6t_pltime != ND6_INFINITE_LIFETIME
846 	    && lt->ia6t_pltime + time_second < time_second) {
847 		return EINVAL;
848 	}
849 
850 	/*
851 	 * If this is a new address, allocate a new ifaddr and link it
852 	 * into chains.
853 	 */
854 	if (ia == NULL) {
855 		hostIsNew = 1;
856 		/*
857 		 * When in6_update_ifa() is called in a process of a received
858 		 * RA, it is called under an interrupt context.  So, we should
859 		 * call malloc with M_NOWAIT.
860 		 */
861 		ia = (struct in6_ifaddr *) malloc(sizeof(*ia), M_IFADDR,
862 		    M_NOWAIT);
863 		if (ia == NULL)
864 			return (ENOBUFS);
865 		bzero((caddr_t)ia, sizeof(*ia));
866 		/* Initialize the address and masks */
867 		IFA_LOCK_INIT(&ia->ia_ifa);
868 		ia->ia_ifa.ifa_addr = (struct sockaddr *)&ia->ia_addr;
869 		ia->ia_addr.sin6_family = AF_INET6;
870 		ia->ia_addr.sin6_len = sizeof(ia->ia_addr);
871 		if ((ifp->if_flags & (IFF_POINTOPOINT | IFF_LOOPBACK)) != 0) {
872 			/*
873 			 * XXX: some functions expect that ifa_dstaddr is not
874 			 * NULL for p2p interfaces.
875 			 */
876 			ia->ia_ifa.ifa_dstaddr =
877 			    (struct sockaddr *)&ia->ia_dstaddr;
878 		} else {
879 			ia->ia_ifa.ifa_dstaddr = NULL;
880 		}
881 		ia->ia_ifa.ifa_netmask = (struct sockaddr *)&ia->ia_prefixmask;
882 
883 		ia->ia_ifp = ifp;
884 		if ((oia = in6_ifaddr) != NULL) {
885 			for ( ; oia->ia_next; oia = oia->ia_next)
886 				continue;
887 			oia->ia_next = ia;
888 		} else
889 			in6_ifaddr = ia;
890 
891 		ia->ia_ifa.ifa_refcnt = 1;
892 		TAILQ_INSERT_TAIL(&ifp->if_addrlist, &ia->ia_ifa, ifa_list);
893 	}
894 
895 	/* set prefix mask */
896 	if (ifra->ifra_prefixmask.sin6_len) {
897 		/*
898 		 * We prohibit changing the prefix length of an existing
899 		 * address, because
900 		 * + such an operation should be rare in IPv6, and
901 		 * + the operation would confuse prefix management.
902 		 */
903 		if (ia->ia_prefixmask.sin6_len &&
904 		    in6_mask2len(&ia->ia_prefixmask.sin6_addr, NULL) != plen) {
905 			nd6log((LOG_INFO, "in6_update_ifa: the prefix length of an"
906 			    " existing (%s) address should not be changed\n",
907 			    ip6_sprintf(&ia->ia_addr.sin6_addr)));
908 			error = EINVAL;
909 			goto unlink;
910 		}
911 		ia->ia_prefixmask = ifra->ifra_prefixmask;
912 	}
913 
914 	/*
915 	 * If a new destination address is specified, scrub the old one and
916 	 * install the new destination.  Note that the interface must be
917 	 * p2p or loopback (see the check above.)
918 	 */
919 	if (dst6.sin6_family == AF_INET6 &&
920 	    !IN6_ARE_ADDR_EQUAL(&dst6.sin6_addr, &ia->ia_dstaddr.sin6_addr)) {
921 		int e;
922 
923 		if ((ia->ia_flags & IFA_ROUTE) != 0 &&
924 		    (e = rtinit(&(ia->ia_ifa), (int)RTM_DELETE, RTF_HOST)) != 0) {
925 			nd6log((LOG_ERR, "in6_update_ifa: failed to remove "
926 			    "a route to the old destination: %s\n",
927 			    ip6_sprintf(&ia->ia_addr.sin6_addr)));
928 			/* proceed anyway... */
929 		} else
930 			ia->ia_flags &= ~IFA_ROUTE;
931 		ia->ia_dstaddr = dst6;
932 	}
933 
934 	/* reset the interface and routing table appropriately. */
935 	if ((error = in6_ifinit(ifp, ia, &ifra->ifra_addr, hostIsNew)) != 0)
936 		goto unlink;
937 
938 	/*
939 	 * Beyond this point, we should call in6_purgeaddr upon an error,
940 	 * not just go to unlink.
941 	 */
942 
943 	if ((ifp->if_flags & IFF_MULTICAST) != 0) {
944 		struct sockaddr_in6 mltaddr, mltmask;
945 		struct in6_multi *in6m;
946 
947 		if (hostIsNew) {
948 			/* join solicited multicast addr for new host id */
949 			struct in6_addr llsol;
950 
951 			bzero(&llsol, sizeof(struct in6_addr));
952 			llsol.s6_addr16[0] = htons(0xff02);
953 			llsol.s6_addr16[1] = htons(ifp->if_index);
954 			llsol.s6_addr32[1] = 0;
955 			llsol.s6_addr32[2] = htonl(1);
956 			llsol.s6_addr32[3] =
957 				ifra->ifra_addr.sin6_addr.s6_addr32[3];
958 			llsol.s6_addr8[12] = 0xff;
959 			(void)in6_addmulti(&llsol, ifp, &error);
960 			if (error != 0) {
961 				nd6log((LOG_WARNING,
962 				    "in6_update_ifa: addmulti failed for "
963 				    "%s on %s (errno=%d)\n",
964 				    ip6_sprintf(&llsol), if_name(ifp),
965 				    error));
966 				in6_purgeaddr((struct ifaddr *)ia);
967 				return (error);
968 			}
969 		}
970 
971 		bzero(&mltmask, sizeof(mltmask));
972 		mltmask.sin6_len = sizeof(struct sockaddr_in6);
973 		mltmask.sin6_family = AF_INET6;
974 		mltmask.sin6_addr = in6mask32;
975 
976 		/*
977 		 * join link-local all-nodes address
978 		 */
979 		bzero(&mltaddr, sizeof(mltaddr));
980 		mltaddr.sin6_len = sizeof(struct sockaddr_in6);
981 		mltaddr.sin6_family = AF_INET6;
982 		mltaddr.sin6_addr = in6addr_linklocal_allnodes;
983 		mltaddr.sin6_addr.s6_addr16[1] = htons(ifp->if_index);
984 
985 		IN6_LOOKUP_MULTI(mltaddr.sin6_addr, ifp, in6m);
986 		if (in6m == NULL) {
987 			rtrequest(RTM_ADD,
988 				  (struct sockaddr *)&mltaddr,
989 				  (struct sockaddr *)&ia->ia_addr,
990 				  (struct sockaddr *)&mltmask,
991 				  RTF_UP|RTF_CLONING,  /* xxx */
992 				  (struct rtentry **)0);
993 			(void)in6_addmulti(&mltaddr.sin6_addr, ifp, &error);
994 			if (error != 0) {
995 				nd6log((LOG_WARNING,
996 				    "in6_update_ifa: addmulti failed for "
997 				    "%s on %s (errno=%d)\n",
998 				    ip6_sprintf(&mltaddr.sin6_addr),
999 				    if_name(ifp), error));
1000 			}
1001 		}
1002 
1003 		/*
1004 		 * join node information group address
1005 		 */
1006 #define hostnamelen	strlen(hostname)
1007 		if (in6_nigroup(ifp, hostname, hostnamelen, &mltaddr.sin6_addr)
1008 		    == 0) {
1009 			IN6_LOOKUP_MULTI(mltaddr.sin6_addr, ifp, in6m);
1010 			if (in6m == NULL && ia != NULL) {
1011 				(void)in6_addmulti(&mltaddr.sin6_addr,
1012 				    ifp, &error);
1013 				if (error != 0) {
1014 					nd6log((LOG_WARNING, "in6_update_ifa: "
1015 					    "addmulti failed for "
1016 					    "%s on %s (errno=%d)\n",
1017 					    ip6_sprintf(&mltaddr.sin6_addr),
1018 					    if_name(ifp), error));
1019 				}
1020 			}
1021 		}
1022 #undef hostnamelen
1023 
1024 		/*
1025 		 * join node-local all-nodes address, on loopback.
1026 		 * XXX: since "node-local" is obsoleted by interface-local,
1027 		 *      we have to join the group on every interface with
1028 		 *      some interface-boundary restriction.
1029 		 */
1030 		if (ifp->if_flags & IFF_LOOPBACK) {
1031 			struct in6_ifaddr *ia_loop;
1032 
1033 			struct in6_addr loop6 = in6addr_loopback;
1034 			ia_loop = in6ifa_ifpwithaddr(ifp, &loop6);
1035 
1036 			mltaddr.sin6_addr = in6addr_nodelocal_allnodes;
1037 
1038 			IN6_LOOKUP_MULTI(mltaddr.sin6_addr, ifp, in6m);
1039 			if (in6m == NULL && ia_loop != NULL) {
1040 				rtrequest(RTM_ADD,
1041 					  (struct sockaddr *)&mltaddr,
1042 					  (struct sockaddr *)&ia_loop->ia_addr,
1043 					  (struct sockaddr *)&mltmask,
1044 					  RTF_UP,
1045 					  (struct rtentry **)0);
1046 				(void)in6_addmulti(&mltaddr.sin6_addr, ifp,
1047 						   &error);
1048 				if (error != 0) {
1049 					nd6log((LOG_WARNING, "in6_update_ifa: "
1050 					    "addmulti failed for %s on %s "
1051 					    "(errno=%d)\n",
1052 					    ip6_sprintf(&mltaddr.sin6_addr),
1053 					    if_name(ifp), error));
1054 				}
1055 			}
1056 		}
1057 	}
1058 
1059 	ia->ia6_flags = ifra->ifra_flags;
1060 	ia->ia6_flags &= ~IN6_IFF_DUPLICATED;	/*safety*/
1061 	ia->ia6_flags &= ~IN6_IFF_NODAD;	/* Mobile IPv6 */
1062 
1063 	ia->ia6_lifetime = ifra->ifra_lifetime;
1064 	/* for sanity */
1065 	if (ia->ia6_lifetime.ia6t_vltime != ND6_INFINITE_LIFETIME) {
1066 		ia->ia6_lifetime.ia6t_expire =
1067 			time_second + ia->ia6_lifetime.ia6t_vltime;
1068 	} else
1069 		ia->ia6_lifetime.ia6t_expire = 0;
1070 	if (ia->ia6_lifetime.ia6t_pltime != ND6_INFINITE_LIFETIME) {
1071 		ia->ia6_lifetime.ia6t_preferred =
1072 			time_second + ia->ia6_lifetime.ia6t_pltime;
1073 	} else
1074 		ia->ia6_lifetime.ia6t_preferred = 0;
1075 
1076 	/*
1077 	 * Perform DAD, if needed.
1078 	 * XXX It may be of use, if we can administratively
1079 	 * disable DAD.
1080 	 */
1081 	if (in6if_do_dad(ifp) && (ifra->ifra_flags & IN6_IFF_NODAD) == 0) {
1082 		ia->ia6_flags |= IN6_IFF_TENTATIVE;
1083 		nd6_dad_start((struct ifaddr *)ia, NULL);
1084 	}
1085 
1086 	return (error);
1087 
1088   unlink:
1089 	/*
1090 	 * XXX: if a change of an existing address failed, keep the entry
1091 	 * anyway.
1092 	 */
1093 	if (hostIsNew)
1094 		in6_unlink_ifa(ia, ifp);
1095 	return (error);
1096 }
1097 
1098 void
1099 in6_purgeaddr(ifa)
1100 	struct ifaddr *ifa;
1101 {
1102 	struct ifnet *ifp = ifa->ifa_ifp;
1103 	struct in6_ifaddr *ia = (struct in6_ifaddr *) ifa;
1104 
1105 	/* stop DAD processing */
1106 	nd6_dad_stop(ifa);
1107 
1108 	/*
1109 	 * delete route to the destination of the address being purged.
1110 	 * The interface must be p2p or loopback in this case.
1111 	 */
1112 	if ((ia->ia_flags & IFA_ROUTE) != 0 && ia->ia_dstaddr.sin6_len != 0) {
1113 		int e;
1114 
1115 		if ((e = rtinit(&(ia->ia_ifa), (int)RTM_DELETE, RTF_HOST))
1116 		    != 0) {
1117 			log(LOG_ERR, "in6_purgeaddr: failed to remove "
1118 			    "a route to the p2p destination: %s on %s, "
1119 			    "errno=%d\n",
1120 			    ip6_sprintf(&ia->ia_addr.sin6_addr), if_name(ifp),
1121 			    e);
1122 			/* proceed anyway... */
1123 		} else
1124 			ia->ia_flags &= ~IFA_ROUTE;
1125 	}
1126 
1127 	/* Remove ownaddr's loopback rtentry, if it exists. */
1128 	in6_ifremloop(&(ia->ia_ifa));
1129 
1130 	if (ifp->if_flags & IFF_MULTICAST) {
1131 		/*
1132 		 * delete solicited multicast addr for deleting host id
1133 		 */
1134 		struct in6_multi *in6m;
1135 		struct in6_addr llsol;
1136 		bzero(&llsol, sizeof(struct in6_addr));
1137 		llsol.s6_addr16[0] = htons(0xff02);
1138 		llsol.s6_addr16[1] = htons(ifp->if_index);
1139 		llsol.s6_addr32[1] = 0;
1140 		llsol.s6_addr32[2] = htonl(1);
1141 		llsol.s6_addr32[3] =
1142 			ia->ia_addr.sin6_addr.s6_addr32[3];
1143 		llsol.s6_addr8[12] = 0xff;
1144 
1145 		IN6_LOOKUP_MULTI(llsol, ifp, in6m);
1146 		if (in6m)
1147 			in6_delmulti(in6m);
1148 	}
1149 
1150 	in6_unlink_ifa(ia, ifp);
1151 }
1152 
1153 static void
1154 in6_unlink_ifa(ia, ifp)
1155 	struct in6_ifaddr *ia;
1156 	struct ifnet *ifp;
1157 {
1158 	int plen, iilen;
1159 	struct in6_ifaddr *oia;
1160 	int	s = splnet();
1161 
1162 	TAILQ_REMOVE(&ifp->if_addrlist, &ia->ia_ifa, ifa_list);
1163 
1164 	oia = ia;
1165 	if (oia == (ia = in6_ifaddr))
1166 		in6_ifaddr = ia->ia_next;
1167 	else {
1168 		while (ia->ia_next && (ia->ia_next != oia))
1169 			ia = ia->ia_next;
1170 		if (ia->ia_next)
1171 			ia->ia_next = oia->ia_next;
1172 		else {
1173 			/* search failed */
1174 			printf("Couldn't unlink in6_ifaddr from in6_ifaddr\n");
1175 		}
1176 	}
1177 
1178 	if (oia->ia6_ifpr) {	/* check for safety */
1179 		plen = in6_mask2len(&oia->ia_prefixmask.sin6_addr, NULL);
1180 		iilen = (sizeof(oia->ia_prefixmask.sin6_addr) << 3) - plen;
1181 		in6_prefix_remove_ifid(iilen, oia);
1182 	}
1183 
1184 	/*
1185 	 * When an autoconfigured address is being removed, release the
1186 	 * reference to the base prefix.  Also, since the release might
1187 	 * affect the status of other (detached) addresses, call
1188 	 * pfxlist_onlink_check().
1189 	 */
1190 	if ((oia->ia6_flags & IN6_IFF_AUTOCONF) != 0) {
1191 		if (oia->ia6_ndpr == NULL) {
1192 			nd6log((LOG_NOTICE, "in6_unlink_ifa: autoconf'ed address "
1193 			    "%p has no prefix\n", oia));
1194 		} else {
1195 			oia->ia6_ndpr->ndpr_refcnt--;
1196 			oia->ia6_flags &= ~IN6_IFF_AUTOCONF;
1197 			oia->ia6_ndpr = NULL;
1198 		}
1199 
1200 		pfxlist_onlink_check();
1201 	}
1202 
1203 	/*
1204 	 * release another refcnt for the link from in6_ifaddr.
1205 	 * Note that we should decrement the refcnt at least once for all *BSD.
1206 	 */
1207 	IFAFREE(&oia->ia_ifa);
1208 
1209 	splx(s);
1210 }
1211 
1212 void
1213 in6_purgeif(ifp)
1214 	struct ifnet *ifp;
1215 {
1216 	struct ifaddr *ifa, *nifa;
1217 
1218 	for (ifa = TAILQ_FIRST(&ifp->if_addrlist); ifa != NULL; ifa = nifa) {
1219 		nifa = TAILQ_NEXT(ifa, ifa_list);
1220 		if (ifa->ifa_addr->sa_family != AF_INET6)
1221 			continue;
1222 		in6_purgeaddr(ifa);
1223 	}
1224 
1225 	in6_ifdetach(ifp);
1226 }
1227 
1228 /*
1229  * SIOC[GAD]LIFADDR.
1230  *	SIOCGLIFADDR: get first address. (?)
1231  *	SIOCGLIFADDR with IFLR_PREFIX:
1232  *		get first address that matches the specified prefix.
1233  *	SIOCALIFADDR: add the specified address.
1234  *	SIOCALIFADDR with IFLR_PREFIX:
1235  *		add the specified prefix, filling hostid part from
1236  *		the first link-local address.  prefixlen must be <= 64.
1237  *	SIOCDLIFADDR: delete the specified address.
1238  *	SIOCDLIFADDR with IFLR_PREFIX:
1239  *		delete the first address that matches the specified prefix.
1240  * return values:
1241  *	EINVAL on invalid parameters
1242  *	EADDRNOTAVAIL on prefix match failed/specified address not found
1243  *	other values may be returned from in6_ioctl()
1244  *
1245  * NOTE: SIOCALIFADDR(with IFLR_PREFIX set) allows prefixlen less than 64.
1246  * this is to accomodate address naming scheme other than RFC2374,
1247  * in the future.
1248  * RFC2373 defines interface id to be 64bit, but it allows non-RFC2374
1249  * address encoding scheme. (see figure on page 8)
1250  */
1251 static int
1252 in6_lifaddr_ioctl(so, cmd, data, ifp, td)
1253 	struct socket *so;
1254 	u_long cmd;
1255 	caddr_t	data;
1256 	struct ifnet *ifp;
1257 	struct thread *td;
1258 {
1259 	struct if_laddrreq *iflr = (struct if_laddrreq *)data;
1260 	struct ifaddr *ifa;
1261 	struct sockaddr *sa;
1262 
1263 	/* sanity checks */
1264 	if (!data || !ifp) {
1265 		panic("invalid argument to in6_lifaddr_ioctl");
1266 		/* NOTREACHED */
1267 	}
1268 
1269 	switch (cmd) {
1270 	case SIOCGLIFADDR:
1271 		/* address must be specified on GET with IFLR_PREFIX */
1272 		if ((iflr->flags & IFLR_PREFIX) == 0)
1273 			break;
1274 		/* FALLTHROUGH */
1275 	case SIOCALIFADDR:
1276 	case SIOCDLIFADDR:
1277 		/* address must be specified on ADD and DELETE */
1278 		sa = (struct sockaddr *)&iflr->addr;
1279 		if (sa->sa_family != AF_INET6)
1280 			return EINVAL;
1281 		if (sa->sa_len != sizeof(struct sockaddr_in6))
1282 			return EINVAL;
1283 		/* XXX need improvement */
1284 		sa = (struct sockaddr *)&iflr->dstaddr;
1285 		if (sa->sa_family && sa->sa_family != AF_INET6)
1286 			return EINVAL;
1287 		if (sa->sa_len && sa->sa_len != sizeof(struct sockaddr_in6))
1288 			return EINVAL;
1289 		break;
1290 	default: /* shouldn't happen */
1291 #if 0
1292 		panic("invalid cmd to in6_lifaddr_ioctl");
1293 		/* NOTREACHED */
1294 #else
1295 		return EOPNOTSUPP;
1296 #endif
1297 	}
1298 	if (sizeof(struct in6_addr) * 8 < iflr->prefixlen)
1299 		return EINVAL;
1300 
1301 	switch (cmd) {
1302 	case SIOCALIFADDR:
1303 	    {
1304 		struct in6_aliasreq ifra;
1305 		struct in6_addr *hostid = NULL;
1306 		int prefixlen;
1307 
1308 		if ((iflr->flags & IFLR_PREFIX) != 0) {
1309 			struct sockaddr_in6 *sin6;
1310 
1311 			/*
1312 			 * hostid is to fill in the hostid part of the
1313 			 * address.  hostid points to the first link-local
1314 			 * address attached to the interface.
1315 			 */
1316 			ifa = (struct ifaddr *)in6ifa_ifpforlinklocal(ifp, 0);
1317 			if (!ifa)
1318 				return EADDRNOTAVAIL;
1319 			hostid = IFA_IN6(ifa);
1320 
1321 		 	/* prefixlen must be <= 64. */
1322 			if (64 < iflr->prefixlen)
1323 				return EINVAL;
1324 			prefixlen = iflr->prefixlen;
1325 
1326 			/* hostid part must be zero. */
1327 			sin6 = (struct sockaddr_in6 *)&iflr->addr;
1328 			if (sin6->sin6_addr.s6_addr32[2] != 0 ||
1329 			    sin6->sin6_addr.s6_addr32[3] != 0) {
1330 				return EINVAL;
1331 			}
1332 		} else
1333 			prefixlen = iflr->prefixlen;
1334 
1335 		/* copy args to in6_aliasreq, perform ioctl(SIOCAIFADDR_IN6). */
1336 		bzero(&ifra, sizeof(ifra));
1337 		bcopy(iflr->iflr_name, ifra.ifra_name, sizeof(ifra.ifra_name));
1338 
1339 		bcopy(&iflr->addr, &ifra.ifra_addr,
1340 		    ((struct sockaddr *)&iflr->addr)->sa_len);
1341 		if (hostid) {
1342 			/* fill in hostid part */
1343 			ifra.ifra_addr.sin6_addr.s6_addr32[2] =
1344 			    hostid->s6_addr32[2];
1345 			ifra.ifra_addr.sin6_addr.s6_addr32[3] =
1346 			    hostid->s6_addr32[3];
1347 		}
1348 
1349 		if (((struct sockaddr *)&iflr->dstaddr)->sa_family) { /* XXX */
1350 			bcopy(&iflr->dstaddr, &ifra.ifra_dstaddr,
1351 			    ((struct sockaddr *)&iflr->dstaddr)->sa_len);
1352 			if (hostid) {
1353 				ifra.ifra_dstaddr.sin6_addr.s6_addr32[2] =
1354 				    hostid->s6_addr32[2];
1355 				ifra.ifra_dstaddr.sin6_addr.s6_addr32[3] =
1356 				    hostid->s6_addr32[3];
1357 			}
1358 		}
1359 
1360 		ifra.ifra_prefixmask.sin6_len = sizeof(struct sockaddr_in6);
1361 		in6_prefixlen2mask(&ifra.ifra_prefixmask.sin6_addr, prefixlen);
1362 
1363 		ifra.ifra_flags = iflr->flags & ~IFLR_PREFIX;
1364 		return in6_control(so, SIOCAIFADDR_IN6, (caddr_t)&ifra, ifp, td);
1365 	    }
1366 	case SIOCGLIFADDR:
1367 	case SIOCDLIFADDR:
1368 	    {
1369 		struct in6_ifaddr *ia;
1370 		struct in6_addr mask, candidate, match;
1371 		struct sockaddr_in6 *sin6;
1372 		int cmp;
1373 
1374 		bzero(&mask, sizeof(mask));
1375 		if (iflr->flags & IFLR_PREFIX) {
1376 			/* lookup a prefix rather than address. */
1377 			in6_prefixlen2mask(&mask, iflr->prefixlen);
1378 
1379 			sin6 = (struct sockaddr_in6 *)&iflr->addr;
1380 			bcopy(&sin6->sin6_addr, &match, sizeof(match));
1381 			match.s6_addr32[0] &= mask.s6_addr32[0];
1382 			match.s6_addr32[1] &= mask.s6_addr32[1];
1383 			match.s6_addr32[2] &= mask.s6_addr32[2];
1384 			match.s6_addr32[3] &= mask.s6_addr32[3];
1385 
1386 			/* if you set extra bits, that's wrong */
1387 			if (bcmp(&match, &sin6->sin6_addr, sizeof(match)))
1388 				return EINVAL;
1389 
1390 			cmp = 1;
1391 		} else {
1392 			if (cmd == SIOCGLIFADDR) {
1393 				/* on getting an address, take the 1st match */
1394 				cmp = 0;	/* XXX */
1395 			} else {
1396 				/* on deleting an address, do exact match */
1397 				in6_prefixlen2mask(&mask, 128);
1398 				sin6 = (struct sockaddr_in6 *)&iflr->addr;
1399 				bcopy(&sin6->sin6_addr, &match, sizeof(match));
1400 
1401 				cmp = 1;
1402 			}
1403 		}
1404 
1405 		TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) {
1406 			if (ifa->ifa_addr->sa_family != AF_INET6)
1407 				continue;
1408 			if (!cmp)
1409 				break;
1410 
1411 			bcopy(IFA_IN6(ifa), &candidate, sizeof(candidate));
1412 			/*
1413 			 * XXX: this is adhoc, but is necessary to allow
1414 			 * a user to specify fe80::/64 (not /10) for a
1415 			 * link-local address.
1416 			 */
1417 			if (IN6_IS_ADDR_LINKLOCAL(&candidate))
1418 				candidate.s6_addr16[1] = 0;
1419 			candidate.s6_addr32[0] &= mask.s6_addr32[0];
1420 			candidate.s6_addr32[1] &= mask.s6_addr32[1];
1421 			candidate.s6_addr32[2] &= mask.s6_addr32[2];
1422 			candidate.s6_addr32[3] &= mask.s6_addr32[3];
1423 			if (IN6_ARE_ADDR_EQUAL(&candidate, &match))
1424 				break;
1425 		}
1426 		if (!ifa)
1427 			return EADDRNOTAVAIL;
1428 		ia = ifa2ia6(ifa);
1429 
1430 		if (cmd == SIOCGLIFADDR) {
1431 			struct sockaddr_in6 *s6;
1432 
1433 			/* fill in the if_laddrreq structure */
1434 			bcopy(&ia->ia_addr, &iflr->addr, ia->ia_addr.sin6_len);
1435 			s6 = (struct sockaddr_in6 *)&iflr->addr;
1436 			if (IN6_IS_ADDR_LINKLOCAL(&s6->sin6_addr)) {
1437 				s6->sin6_addr.s6_addr16[1] = 0;
1438 				if (in6_addr2zoneid(ifp, &s6->sin6_addr,
1439 				    &s6->sin6_scope_id))
1440 					return (EINVAL);	/* XXX */
1441 			}
1442 			if ((ifp->if_flags & IFF_POINTOPOINT) != 0) {
1443 				bcopy(&ia->ia_dstaddr, &iflr->dstaddr,
1444 				    ia->ia_dstaddr.sin6_len);
1445 				s6 = (struct sockaddr_in6 *)&iflr->dstaddr;
1446 				if (IN6_IS_ADDR_LINKLOCAL(&s6->sin6_addr)) {
1447 					s6->sin6_addr.s6_addr16[1] = 0;
1448 					if (in6_addr2zoneid(ifp,
1449 					    &s6->sin6_addr, &s6->sin6_scope_id))
1450 						return (EINVAL); /* EINVAL */
1451 				}
1452 			} else
1453 				bzero(&iflr->dstaddr, sizeof(iflr->dstaddr));
1454 
1455 			iflr->prefixlen =
1456 			    in6_mask2len(&ia->ia_prefixmask.sin6_addr, NULL);
1457 
1458 			iflr->flags = ia->ia6_flags;	/* XXX */
1459 
1460 			return 0;
1461 		} else {
1462 			struct in6_aliasreq ifra;
1463 
1464 			/* fill in6_aliasreq and do ioctl(SIOCDIFADDR_IN6) */
1465 			bzero(&ifra, sizeof(ifra));
1466 			bcopy(iflr->iflr_name, ifra.ifra_name,
1467 			    sizeof(ifra.ifra_name));
1468 
1469 			bcopy(&ia->ia_addr, &ifra.ifra_addr,
1470 			    ia->ia_addr.sin6_len);
1471 			if ((ifp->if_flags & IFF_POINTOPOINT) != 0) {
1472 				bcopy(&ia->ia_dstaddr, &ifra.ifra_dstaddr,
1473 				    ia->ia_dstaddr.sin6_len);
1474 			} else {
1475 				bzero(&ifra.ifra_dstaddr,
1476 				    sizeof(ifra.ifra_dstaddr));
1477 			}
1478 			bcopy(&ia->ia_prefixmask, &ifra.ifra_dstaddr,
1479 			    ia->ia_prefixmask.sin6_len);
1480 
1481 			ifra.ifra_flags = ia->ia6_flags;
1482 			return in6_control(so, SIOCDIFADDR_IN6, (caddr_t)&ifra,
1483 			    ifp, td);
1484 		}
1485 	    }
1486 	}
1487 
1488 	return EOPNOTSUPP;	/* just for safety */
1489 }
1490 
1491 /*
1492  * Initialize an interface's intetnet6 address
1493  * and routing table entry.
1494  */
1495 static int
1496 in6_ifinit(ifp, ia, sin6, newhost)
1497 	struct ifnet *ifp;
1498 	struct in6_ifaddr *ia;
1499 	struct sockaddr_in6 *sin6;
1500 	int newhost;
1501 {
1502 	int	error = 0, plen, ifacount = 0;
1503 	int	s = splimp();
1504 	struct ifaddr *ifa;
1505 
1506 	/*
1507 	 * Give the interface a chance to initialize
1508 	 * if this is its first address,
1509 	 * and to validate the address if necessary.
1510 	 */
1511 	TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) {
1512 		if (ifa->ifa_addr == NULL)
1513 			continue;	/* just for safety */
1514 		if (ifa->ifa_addr->sa_family != AF_INET6)
1515 			continue;
1516 		ifacount++;
1517 	}
1518 
1519 	ia->ia_addr = *sin6;
1520 
1521 	if (ifacount <= 1 && ifp->if_ioctl &&
1522 	    (error = (*ifp->if_ioctl)(ifp, SIOCSIFADDR, (caddr_t)ia))) {
1523 		splx(s);
1524 		return (error);
1525 	}
1526 	splx(s);
1527 
1528 	ia->ia_ifa.ifa_metric = ifp->if_metric;
1529 
1530 	/* we could do in(6)_socktrim here, but just omit it at this moment. */
1531 
1532 	/*
1533 	 * Special case:
1534 	 * If a new destination address is specified for a point-to-point
1535 	 * interface, install a route to the destination as an interface
1536 	 * direct route.
1537 	 * XXX: the logic below rejects assigning multiple addresses on a p2p
1538 	 * interface that share a same destination.
1539 	 */
1540 	plen = in6_mask2len(&ia->ia_prefixmask.sin6_addr, NULL); /* XXX */
1541 	if (!(ia->ia_flags & IFA_ROUTE) && plen == 128 &&
1542 	    ia->ia_dstaddr.sin6_family == AF_INET6) {
1543 		if ((error = rtinit(&(ia->ia_ifa), (int)RTM_ADD,
1544 				    RTF_UP | RTF_HOST)) != 0)
1545 			return (error);
1546 		ia->ia_flags |= IFA_ROUTE;
1547 	}
1548 	if (plen < 128) {
1549 		/*
1550 		 * The RTF_CLONING flag is necessary for in6_is_ifloop_auto().
1551 		 */
1552 		ia->ia_ifa.ifa_flags |= RTF_CLONING;
1553 	}
1554 
1555 	/* Add ownaddr as loopback rtentry, if necessary (ex. on p2p link). */
1556 	if (newhost) {
1557 		/* set the rtrequest function to create llinfo */
1558 		ia->ia_ifa.ifa_rtrequest = nd6_rtrequest;
1559 		in6_ifaddloop(&(ia->ia_ifa));
1560 	}
1561 
1562 	return (error);
1563 }
1564 
1565 /*
1566  * Find an IPv6 interface link-local address specific to an interface.
1567  */
1568 struct in6_ifaddr *
1569 in6ifa_ifpforlinklocal(ifp, ignoreflags)
1570 	struct ifnet *ifp;
1571 	int ignoreflags;
1572 {
1573 	struct ifaddr *ifa;
1574 
1575 	TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) {
1576 		if (ifa->ifa_addr == NULL)
1577 			continue;	/* just for safety */
1578 		if (ifa->ifa_addr->sa_family != AF_INET6)
1579 			continue;
1580 		if (IN6_IS_ADDR_LINKLOCAL(IFA_IN6(ifa))) {
1581 			if ((((struct in6_ifaddr *)ifa)->ia6_flags &
1582 			     ignoreflags) != 0)
1583 				continue;
1584 			break;
1585 		}
1586 	}
1587 
1588 	return ((struct in6_ifaddr *)ifa);
1589 }
1590 
1591 
1592 /*
1593  * find the internet address corresponding to a given interface and address.
1594  */
1595 struct in6_ifaddr *
1596 in6ifa_ifpwithaddr(ifp, addr)
1597 	struct ifnet *ifp;
1598 	struct in6_addr *addr;
1599 {
1600 	struct ifaddr *ifa;
1601 
1602 	TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) {
1603 		if (ifa->ifa_addr == NULL)
1604 			continue;	/* just for safety */
1605 		if (ifa->ifa_addr->sa_family != AF_INET6)
1606 			continue;
1607 		if (IN6_ARE_ADDR_EQUAL(addr, IFA_IN6(ifa)))
1608 			break;
1609 	}
1610 
1611 	return ((struct in6_ifaddr *)ifa);
1612 }
1613 
1614 /*
1615  * Convert IP6 address to printable (loggable) representation.
1616  */
1617 static char digits[] = "0123456789abcdef";
1618 static int ip6round = 0;
1619 char *
1620 ip6_sprintf(addr)
1621 	const struct in6_addr *addr;
1622 {
1623 	static char ip6buf[8][48];
1624 	int i;
1625 	char *cp;
1626 	const u_int16_t *a = (const u_int16_t *)addr;
1627 	const u_int8_t *d;
1628 	int dcolon = 0;
1629 
1630 	ip6round = (ip6round + 1) & 7;
1631 	cp = ip6buf[ip6round];
1632 
1633 	for (i = 0; i < 8; i++) {
1634 		if (dcolon == 1) {
1635 			if (*a == 0) {
1636 				if (i == 7)
1637 					*cp++ = ':';
1638 				a++;
1639 				continue;
1640 			} else
1641 				dcolon = 2;
1642 		}
1643 		if (*a == 0) {
1644 			if (dcolon == 0 && *(a + 1) == 0) {
1645 				if (i == 0)
1646 					*cp++ = ':';
1647 				*cp++ = ':';
1648 				dcolon = 1;
1649 			} else {
1650 				*cp++ = '0';
1651 				*cp++ = ':';
1652 			}
1653 			a++;
1654 			continue;
1655 		}
1656 		d = (const u_char *)a;
1657 		*cp++ = digits[*d >> 4];
1658 		*cp++ = digits[*d++ & 0xf];
1659 		*cp++ = digits[*d >> 4];
1660 		*cp++ = digits[*d & 0xf];
1661 		*cp++ = ':';
1662 		a++;
1663 	}
1664 	*--cp = 0;
1665 	return (ip6buf[ip6round]);
1666 }
1667 
1668 int
1669 in6_localaddr(in6)
1670 	struct in6_addr *in6;
1671 {
1672 	struct in6_ifaddr *ia;
1673 
1674 	if (IN6_IS_ADDR_LOOPBACK(in6) || IN6_IS_ADDR_LINKLOCAL(in6))
1675 		return 1;
1676 
1677 	for (ia = in6_ifaddr; ia; ia = ia->ia_next) {
1678 		if (IN6_ARE_MASKED_ADDR_EQUAL(in6, &ia->ia_addr.sin6_addr,
1679 		    &ia->ia_prefixmask.sin6_addr)) {
1680 			return 1;
1681 		}
1682 	}
1683 
1684 	return (0);
1685 }
1686 
1687 int
1688 in6_is_addr_deprecated(sa6)
1689 	struct sockaddr_in6 *sa6;
1690 {
1691 	struct in6_ifaddr *ia;
1692 
1693 	for (ia = in6_ifaddr; ia; ia = ia->ia_next) {
1694 		if (IN6_ARE_ADDR_EQUAL(&ia->ia_addr.sin6_addr,
1695 				       &sa6->sin6_addr) &&
1696 		    (ia->ia6_flags & IN6_IFF_DEPRECATED) != 0)
1697 			return (1); /* true */
1698 
1699 		/* XXX: do we still have to go thru the rest of the list? */
1700 	}
1701 
1702 	return (0);		/* false */
1703 }
1704 
1705 /*
1706  * return length of part which dst and src are equal
1707  * hard coding...
1708  */
1709 int
1710 in6_matchlen(src, dst)
1711 struct in6_addr *src, *dst;
1712 {
1713 	int match = 0;
1714 	u_char *s = (u_char *)src, *d = (u_char *)dst;
1715 	u_char *lim = s + 16, r;
1716 
1717 	while (s < lim)
1718 		if ((r = (*d++ ^ *s++)) != 0) {
1719 			while (r < 128) {
1720 				match++;
1721 				r <<= 1;
1722 			}
1723 			break;
1724 		} else
1725 			match += 8;
1726 	return match;
1727 }
1728 
1729 /* XXX: to be scope conscious */
1730 int
1731 in6_are_prefix_equal(p1, p2, len)
1732 	struct in6_addr *p1, *p2;
1733 	int len;
1734 {
1735 	int bytelen, bitlen;
1736 
1737 	/* sanity check */
1738 	if (0 > len || len > 128) {
1739 		log(LOG_ERR, "in6_are_prefix_equal: invalid prefix length(%d)\n",
1740 		    len);
1741 		return (0);
1742 	}
1743 
1744 	bytelen = len / 8;
1745 	bitlen = len % 8;
1746 
1747 	if (bcmp(&p1->s6_addr, &p2->s6_addr, bytelen))
1748 		return (0);
1749 	if (bitlen != 0 &&
1750 	    p1->s6_addr[bytelen] >> (8 - bitlen) !=
1751 	    p2->s6_addr[bytelen] >> (8 - bitlen))
1752 		return (0);
1753 
1754 	return (1);
1755 }
1756 
1757 void
1758 in6_prefixlen2mask(maskp, len)
1759 	struct in6_addr *maskp;
1760 	int len;
1761 {
1762 	u_char maskarray[8] = {0x80, 0xc0, 0xe0, 0xf0, 0xf8, 0xfc, 0xfe, 0xff};
1763 	int bytelen, bitlen, i;
1764 
1765 	/* sanity check */
1766 	if (0 > len || len > 128) {
1767 		log(LOG_ERR, "in6_prefixlen2mask: invalid prefix length(%d)\n",
1768 		    len);
1769 		return;
1770 	}
1771 
1772 	bzero(maskp, sizeof(*maskp));
1773 	bytelen = len / 8;
1774 	bitlen = len % 8;
1775 	for (i = 0; i < bytelen; i++)
1776 		maskp->s6_addr[i] = 0xff;
1777 	if (bitlen)
1778 		maskp->s6_addr[bytelen] = maskarray[bitlen - 1];
1779 }
1780 
1781 /*
1782  * return the best address out of the same scope. if no address was
1783  * found, return the first valid address from designated IF.
1784  */
1785 struct in6_ifaddr *
1786 in6_ifawithifp(ifp, dst)
1787 	struct ifnet *ifp;
1788 	struct in6_addr *dst;
1789 {
1790 	int dst_scope =	in6_addrscope(dst), blen = -1, tlen;
1791 	struct ifaddr *ifa;
1792 	struct in6_ifaddr *besta = 0;
1793 	struct in6_ifaddr *dep[2];	/* last-resort: deprecated */
1794 
1795 	dep[0] = dep[1] = NULL;
1796 
1797 	/*
1798 	 * We first look for addresses in the same scope.
1799 	 * If there is one, return it.
1800 	 * If two or more, return one which matches the dst longest.
1801 	 * If none, return one of global addresses assigned other ifs.
1802 	 */
1803 	TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) {
1804 		if (ifa->ifa_addr->sa_family != AF_INET6)
1805 			continue;
1806 		if (((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_ANYCAST)
1807 			continue; /* XXX: is there any case to allow anycast? */
1808 		if (((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_NOTREADY)
1809 			continue; /* don't use this interface */
1810 		if (((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_DETACHED)
1811 			continue;
1812 		if (((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_DEPRECATED) {
1813 			if (ip6_use_deprecated)
1814 				dep[0] = (struct in6_ifaddr *)ifa;
1815 			continue;
1816 		}
1817 
1818 		if (dst_scope == in6_addrscope(IFA_IN6(ifa))) {
1819 			/*
1820 			 * call in6_matchlen() as few as possible
1821 			 */
1822 			if (besta) {
1823 				if (blen == -1)
1824 					blen = in6_matchlen(&besta->ia_addr.sin6_addr, dst);
1825 				tlen = in6_matchlen(IFA_IN6(ifa), dst);
1826 				if (tlen > blen) {
1827 					blen = tlen;
1828 					besta = (struct in6_ifaddr *)ifa;
1829 				}
1830 			} else
1831 				besta = (struct in6_ifaddr *)ifa;
1832 		}
1833 	}
1834 	if (besta)
1835 		return (besta);
1836 
1837 	TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) {
1838 		if (ifa->ifa_addr->sa_family != AF_INET6)
1839 			continue;
1840 		if (((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_ANYCAST)
1841 			continue; /* XXX: is there any case to allow anycast? */
1842 		if (((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_NOTREADY)
1843 			continue; /* don't use this interface */
1844 		if (((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_DETACHED)
1845 			continue;
1846 		if (((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_DEPRECATED) {
1847 			if (ip6_use_deprecated)
1848 				dep[1] = (struct in6_ifaddr *)ifa;
1849 			continue;
1850 		}
1851 
1852 		return (struct in6_ifaddr *)ifa;
1853 	}
1854 
1855 	/* use the last-resort values, that are, deprecated addresses */
1856 	if (dep[0])
1857 		return dep[0];
1858 	if (dep[1])
1859 		return dep[1];
1860 
1861 	return NULL;
1862 }
1863 
1864 /*
1865  * perform DAD when interface becomes IFF_UP.
1866  */
1867 void
1868 in6_if_up(ifp)
1869 	struct ifnet *ifp;
1870 {
1871 	struct ifaddr *ifa;
1872 	struct in6_ifaddr *ia;
1873 	int dad_delay;		/* delay ticks before DAD output */
1874 
1875 	/*
1876 	 * special cases, like 6to4, are handled in in6_ifattach
1877 	 */
1878 	in6_ifattach(ifp, NULL);
1879 
1880 	dad_delay = 0;
1881 	TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) {
1882 		if (ifa->ifa_addr->sa_family != AF_INET6)
1883 			continue;
1884 		ia = (struct in6_ifaddr *)ifa;
1885 		if (ia->ia6_flags & IN6_IFF_TENTATIVE)
1886 			nd6_dad_start(ifa, &dad_delay);
1887 	}
1888 }
1889 
1890 int
1891 in6if_do_dad(ifp)
1892 	struct ifnet *ifp;
1893 {
1894 	if ((ifp->if_flags & IFF_LOOPBACK) != 0)
1895 		return (0);
1896 
1897 	switch (ifp->if_type) {
1898 #ifdef IFT_DUMMY
1899 	case IFT_DUMMY:
1900 #endif
1901 	case IFT_FAITH:
1902 		/*
1903 		 * These interfaces do not have the IFF_LOOPBACK flag,
1904 		 * but loop packets back.  We do not have to do DAD on such
1905 		 * interfaces.  We should even omit it, because loop-backed
1906 		 * NS would confuse the DAD procedure.
1907 		 */
1908 		return (0);
1909 	default:
1910 		/*
1911 		 * Our DAD routine requires the interface up and running.
1912 		 * However, some interfaces can be up before the RUNNING
1913 		 * status.  Additionaly, users may try to assign addresses
1914 		 * before the interface becomes up (or running).
1915 		 * We simply skip DAD in such a case as a work around.
1916 		 * XXX: we should rather mark "tentative" on such addresses,
1917 		 * and do DAD after the interface becomes ready.
1918 		 */
1919 		if ((ifp->if_flags & (IFF_UP|IFF_RUNNING)) !=
1920 		    (IFF_UP|IFF_RUNNING))
1921 			return (0);
1922 
1923 		return (1);
1924 	}
1925 }
1926 
1927 /*
1928  * Calculate max IPv6 MTU through all the interfaces and store it
1929  * to in6_maxmtu.
1930  */
1931 void
1932 in6_setmaxmtu()
1933 {
1934 	unsigned long maxmtu = 0;
1935 	struct ifnet *ifp;
1936 
1937 	IFNET_RLOCK();
1938 	for (ifp = TAILQ_FIRST(&ifnet); ifp; ifp = TAILQ_NEXT(ifp, if_list)) {
1939 		/* this function can be called during ifnet initialization */
1940 		if (!ifp->if_afdata[AF_INET6])
1941 			continue;
1942 		if ((ifp->if_flags & IFF_LOOPBACK) == 0 &&
1943 		    IN6_LINKMTU(ifp) > maxmtu)
1944 			maxmtu = IN6_LINKMTU(ifp);
1945 	}
1946 	IFNET_RUNLOCK();
1947 	if (maxmtu)	     /* update only when maxmtu is positive */
1948 		in6_maxmtu = maxmtu;
1949 }
1950 
1951 void *
1952 in6_domifattach(ifp)
1953 	struct ifnet *ifp;
1954 {
1955 	struct in6_ifextra *ext;
1956 
1957 	ext = (struct in6_ifextra *)malloc(sizeof(*ext), M_IFADDR, M_WAITOK);
1958 	bzero(ext, sizeof(*ext));
1959 
1960 	ext->in6_ifstat = (struct in6_ifstat *)malloc(sizeof(struct in6_ifstat),
1961 	    M_IFADDR, M_WAITOK);
1962 	bzero(ext->in6_ifstat, sizeof(*ext->in6_ifstat));
1963 
1964 	ext->icmp6_ifstat =
1965 	    (struct icmp6_ifstat *)malloc(sizeof(struct icmp6_ifstat),
1966 	    M_IFADDR, M_WAITOK);
1967 	bzero(ext->icmp6_ifstat, sizeof(*ext->icmp6_ifstat));
1968 
1969 	ext->nd_ifinfo = nd6_ifattach(ifp);
1970 	ext->scope6_id = scope6_ifattach(ifp);
1971 	return ext;
1972 }
1973 
1974 void
1975 in6_domifdetach(ifp, aux)
1976 	struct ifnet *ifp;
1977 	void *aux;
1978 {
1979 	struct in6_ifextra *ext = (struct in6_ifextra *)aux;
1980 
1981 	scope6_ifdetach(ext->scope6_id);
1982 	nd6_ifdetach(ext->nd_ifinfo);
1983 	free(ext->in6_ifstat, M_IFADDR);
1984 	free(ext->icmp6_ifstat, M_IFADDR);
1985 	free(ext, M_IFADDR);
1986 }
1987 
1988 /*
1989  * Convert sockaddr_in6 to sockaddr_in.  Original sockaddr_in6 must be
1990  * v4 mapped addr or v4 compat addr
1991  */
1992 void
1993 in6_sin6_2_sin(struct sockaddr_in *sin, struct sockaddr_in6 *sin6)
1994 {
1995 	bzero(sin, sizeof(*sin));
1996 	sin->sin_len = sizeof(struct sockaddr_in);
1997 	sin->sin_family = AF_INET;
1998 	sin->sin_port = sin6->sin6_port;
1999 	sin->sin_addr.s_addr = sin6->sin6_addr.s6_addr32[3];
2000 }
2001 
2002 /* Convert sockaddr_in to sockaddr_in6 in v4 mapped addr format. */
2003 void
2004 in6_sin_2_v4mapsin6(struct sockaddr_in *sin, struct sockaddr_in6 *sin6)
2005 {
2006 	bzero(sin6, sizeof(*sin6));
2007 	sin6->sin6_len = sizeof(struct sockaddr_in6);
2008 	sin6->sin6_family = AF_INET6;
2009 	sin6->sin6_port = sin->sin_port;
2010 	sin6->sin6_addr.s6_addr32[0] = 0;
2011 	sin6->sin6_addr.s6_addr32[1] = 0;
2012 	sin6->sin6_addr.s6_addr32[2] = IPV6_ADDR_INT32_SMP;
2013 	sin6->sin6_addr.s6_addr32[3] = sin->sin_addr.s_addr;
2014 }
2015 
2016 /* Convert sockaddr_in6 into sockaddr_in. */
2017 void
2018 in6_sin6_2_sin_in_sock(struct sockaddr *nam)
2019 {
2020 	struct sockaddr_in *sin_p;
2021 	struct sockaddr_in6 sin6;
2022 
2023 	/*
2024 	 * Save original sockaddr_in6 addr and convert it
2025 	 * to sockaddr_in.
2026 	 */
2027 	sin6 = *(struct sockaddr_in6 *)nam;
2028 	sin_p = (struct sockaddr_in *)nam;
2029 	in6_sin6_2_sin(sin_p, &sin6);
2030 }
2031 
2032 /* Convert sockaddr_in into sockaddr_in6 in v4 mapped addr format. */
2033 void
2034 in6_sin_2_v4mapsin6_in_sock(struct sockaddr **nam)
2035 {
2036 	struct sockaddr_in *sin_p;
2037 	struct sockaddr_in6 *sin6_p;
2038 
2039 	MALLOC(sin6_p, struct sockaddr_in6 *, sizeof *sin6_p, M_SONAME,
2040 	       M_WAITOK);
2041 	sin_p = (struct sockaddr_in *)*nam;
2042 	in6_sin_2_v4mapsin6(sin_p, sin6_p);
2043 	FREE(*nam, M_SONAME);
2044 	*nam = (struct sockaddr *)sin6_p;
2045 }
2046