xref: /illumos-gate/usr/src/uts/common/inet/ip/ip6_if.c (revision 5d0bc3ededb82d77f7c33d8f58e517a837ba5140)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 /*
26  * Copyright (c) 1990 Mentat Inc.
27  */
28 
29 #pragma ident	"%Z%%M%	%I%	%E% SMI"
30 
31 /*
32  * This file contains the interface control functions for IPv6.
33  */
34 
35 #include <sys/types.h>
36 #include <sys/sysmacros.h>
37 #include <sys/stream.h>
38 #include <sys/dlpi.h>
39 #include <sys/stropts.h>
40 #include <sys/ddi.h>
41 #include <sys/cmn_err.h>
42 #include <sys/kstat.h>
43 #include <sys/debug.h>
44 #include <sys/zone.h>
45 
46 #include <sys/systm.h>
47 #include <sys/param.h>
48 #include <sys/socket.h>
49 #include <sys/isa_defs.h>
50 #include <net/if.h>
51 #include <net/if_dl.h>
52 #include <net/route.h>
53 #include <netinet/in.h>
54 #include <netinet/igmp_var.h>
55 #include <netinet/ip6.h>
56 #include <netinet/icmp6.h>
57 #include <netinet/in.h>
58 
59 #include <inet/common.h>
60 #include <inet/nd.h>
61 #include <inet/mib2.h>
62 #include <inet/ip.h>
63 #include <inet/ip6.h>
64 #include <inet/ip_multi.h>
65 #include <inet/ip_ire.h>
66 #include <inet/ip_rts.h>
67 #include <inet/ip_ndp.h>
68 #include <inet/ip_if.h>
69 #include <inet/ip6_asp.h>
70 #include <inet/tun.h>
71 #include <inet/ipclassifier.h>
72 #include <inet/sctp_ip.h>
73 
74 #include <sys/tsol/tndb.h>
75 #include <sys/tsol/tnet.h>
76 
77 static in6_addr_t	ipv6_ll_template =
78 			{(uint32_t)V6_LINKLOCAL, 0x0, 0x0, 0x0};
79 
80 static ipif_t *
81 ipif_lookup_interface_v6(const in6_addr_t *if_addr, const in6_addr_t *dst,
82     queue_t *q, mblk_t *mp, ipsq_func_t func, int *error);
83 
84 /*
85  * ipif_lookup_group_v6
86  */
87 ipif_t *
88 ipif_lookup_group_v6(const in6_addr_t *group, zoneid_t zoneid)
89 {
90 	ire_t	*ire;
91 	ipif_t	*ipif;
92 
93 	ire = ire_lookup_multi_v6(group, zoneid);
94 	if (ire == NULL)
95 		return (NULL);
96 	ipif = ire->ire_ipif;
97 	ipif_refhold(ipif);
98 	ire_refrele(ire);
99 	return (ipif);
100 }
101 
102 /*
103  * ill_lookup_group_v6
104  */
105 ill_t *
106 ill_lookup_group_v6(const in6_addr_t *group, zoneid_t zoneid)
107 {
108 	ire_t	*ire;
109 	ill_t	*ill;
110 
111 	ire = ire_lookup_multi_v6(group, zoneid);
112 	if (ire == NULL)
113 		return (NULL);
114 	ill = ire->ire_ipif->ipif_ill;
115 	ill_refhold(ill);
116 	ire_refrele(ire);
117 	return (ill);
118 }
119 
120 /*
121  * Look for an ipif with the specified interface address and destination.
122  * The destination address is used only for matching point-to-point interfaces.
123  */
124 static ipif_t *
125 ipif_lookup_interface_v6(const in6_addr_t *if_addr, const in6_addr_t *dst,
126     queue_t *q, mblk_t *mp, ipsq_func_t func, int *error)
127 {
128 	ipif_t	*ipif;
129 	ill_t	*ill;
130 	ipsq_t	*ipsq;
131 	ill_walk_context_t ctx;
132 
133 	if (error != NULL)
134 		*error = 0;
135 
136 	/*
137 	 * First match all the point-to-point interfaces
138 	 * before looking at non-point-to-point interfaces.
139 	 * This is done to avoid returning non-point-to-point
140 	 * ipif instead of unnumbered point-to-point ipif.
141 	 */
142 	rw_enter(&ill_g_lock, RW_READER);
143 	ill = ILL_START_WALK_V6(&ctx);
144 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
145 		GRAB_CONN_LOCK(q);
146 		mutex_enter(&ill->ill_lock);
147 		for (ipif = ill->ill_ipif; ipif; ipif = ipif->ipif_next) {
148 			/* Allow the ipif to be down */
149 			if ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
150 			    (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr,
151 			    if_addr)) &&
152 			    (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr,
153 			    dst))) {
154 				if (IPIF_CAN_LOOKUP(ipif)) {
155 					ipif_refhold_locked(ipif);
156 					mutex_exit(&ill->ill_lock);
157 					RELEASE_CONN_LOCK(q);
158 					rw_exit(&ill_g_lock);
159 					return (ipif);
160 				} else if (IPIF_CAN_WAIT(ipif, q)) {
161 					ipsq = ill->ill_phyint->phyint_ipsq;
162 					mutex_enter(&ipsq->ipsq_lock);
163 					mutex_exit(&ill->ill_lock);
164 					rw_exit(&ill_g_lock);
165 					ipsq_enq(ipsq, q, mp, func, NEW_OP,
166 						ill);
167 					mutex_exit(&ipsq->ipsq_lock);
168 					RELEASE_CONN_LOCK(q);
169 					*error = EINPROGRESS;
170 					return (NULL);
171 				}
172 			}
173 		}
174 		mutex_exit(&ill->ill_lock);
175 		RELEASE_CONN_LOCK(q);
176 	}
177 	rw_exit(&ill_g_lock);
178 	/* lookup the ipif based on interface address */
179 	ipif = ipif_lookup_addr_v6(if_addr, NULL, ALL_ZONES, q, mp, func,
180 	    error);
181 	ASSERT(ipif == NULL || ipif->ipif_isv6);
182 	return (ipif);
183 }
184 
185 /*
186  * Look for an ipif with the specified address. For point-point links
187  * we look for matches on either the destination address and the local
188  * address, but we ignore the check on the local address if IPIF_UNNUMBERED
189  * is set.
190  * Matches on a specific ill if match_ill is set.
191  */
192 /* ARGSUSED */
193 ipif_t *
194 ipif_lookup_addr_v6(const in6_addr_t *addr, ill_t *match_ill, zoneid_t zoneid,
195     queue_t *q, mblk_t *mp, ipsq_func_t func, int *error)
196 {
197 	ipif_t	*ipif;
198 	ill_t	*ill;
199 	boolean_t  ptp = B_FALSE;
200 	ipsq_t	*ipsq;
201 	ill_walk_context_t ctx;
202 
203 	if (error != NULL)
204 		*error = 0;
205 
206 	rw_enter(&ill_g_lock, RW_READER);
207 	/*
208 	 * Repeat twice, first based on local addresses and
209 	 * next time for pointopoint.
210 	 */
211 repeat:
212 	ill = ILL_START_WALK_V6(&ctx);
213 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
214 		if (match_ill != NULL && ill != match_ill) {
215 			continue;
216 		}
217 		GRAB_CONN_LOCK(q);
218 		mutex_enter(&ill->ill_lock);
219 		for (ipif = ill->ill_ipif; ipif; ipif = ipif->ipif_next) {
220 			if (zoneid != ALL_ZONES &&
221 			    ipif->ipif_zoneid != zoneid &&
222 			    ipif->ipif_zoneid != ALL_ZONES)
223 				continue;
224 			/* Allow the ipif to be down */
225 			if ((!ptp && (IN6_ARE_ADDR_EQUAL(
226 			    &ipif->ipif_v6lcl_addr, addr) &&
227 			    (ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) ||
228 			    (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) &&
229 			    IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr,
230 			    addr))) {
231 				if (IPIF_CAN_LOOKUP(ipif)) {
232 					ipif_refhold_locked(ipif);
233 					mutex_exit(&ill->ill_lock);
234 					RELEASE_CONN_LOCK(q);
235 					rw_exit(&ill_g_lock);
236 					return (ipif);
237 				} else if (IPIF_CAN_WAIT(ipif, q)) {
238 					ipsq = ill->ill_phyint->phyint_ipsq;
239 					mutex_enter(&ipsq->ipsq_lock);
240 					mutex_exit(&ill->ill_lock);
241 					rw_exit(&ill_g_lock);
242 					ipsq_enq(ipsq, q, mp, func, NEW_OP,
243 						ill);
244 					mutex_exit(&ipsq->ipsq_lock);
245 					RELEASE_CONN_LOCK(q);
246 					*error = EINPROGRESS;
247 					return (NULL);
248 				}
249 			}
250 		}
251 		mutex_exit(&ill->ill_lock);
252 		RELEASE_CONN_LOCK(q);
253 	}
254 
255 	/* Repeat once more if needed */
256 	if (ptp) {
257 		rw_exit(&ill_g_lock);
258 		if (error != NULL)
259 			*error = ENXIO;
260 		return (NULL);
261 	}
262 	ptp = B_TRUE;
263 	goto repeat;
264 }
265 
266 /*
267  * Perform various checks to verify that an address would make sense as a local
268  * interface address.  This is currently only called when an attempt is made
269  * to set a local address.
270  *
271  * Does not allow a v4-mapped address, an address that equals the subnet
272  * anycast address, ... a multicast address, ...
273  */
274 boolean_t
275 ip_local_addr_ok_v6(const in6_addr_t *addr, const in6_addr_t *subnet_mask)
276 {
277 	in6_addr_t subnet;
278 
279 	if (IN6_IS_ADDR_UNSPECIFIED(addr))
280 		return (B_TRUE);	/* Allow all zeros */
281 
282 	/*
283 	 * Don't allow all zeroes or host part, but allow
284 	 * all ones netmask.
285 	 */
286 	V6_MASK_COPY(*addr, *subnet_mask, subnet);
287 	if (IN6_IS_ADDR_V4MAPPED(addr) ||
288 	    (IN6_ARE_ADDR_EQUAL(addr, &subnet) &&
289 	    !IN6_ARE_ADDR_EQUAL(subnet_mask, &ipv6_all_ones)) ||
290 	    (IN6_IS_ADDR_V4COMPAT(addr) && CLASSD(V4_PART_OF_V6((*addr)))) ||
291 	    IN6_IS_ADDR_MULTICAST(addr))
292 		return (B_FALSE);
293 
294 	return (B_TRUE);
295 }
296 
297 /*
298  * Perform various checks to verify that an address would make sense as a
299  * remote/subnet interface address.
300  */
301 boolean_t
302 ip_remote_addr_ok_v6(const in6_addr_t *addr, const in6_addr_t *subnet_mask)
303 {
304 	in6_addr_t subnet;
305 
306 	if (IN6_IS_ADDR_UNSPECIFIED(addr))
307 		return (B_TRUE);	/* Allow all zeros */
308 
309 	V6_MASK_COPY(*addr, *subnet_mask, subnet);
310 	if (IN6_IS_ADDR_V4MAPPED(addr) ||
311 	    (IN6_ARE_ADDR_EQUAL(addr, &subnet) &&
312 	    !IN6_ARE_ADDR_EQUAL(subnet_mask, &ipv6_all_ones)) ||
313 	    IN6_IS_ADDR_MULTICAST(addr) ||
314 	    (IN6_IS_ADDR_V4COMPAT(addr) && CLASSD(V4_PART_OF_V6((*addr)))))
315 		return (B_FALSE);
316 
317 	return (B_TRUE);
318 }
319 
320 /*
321  * ip_rt_add_v6 is called to add an IPv6 route to the forwarding table.
322  * ipif_arg is passed in to associate it with the correct interface
323  * (for link-local destinations and gateways).
324  */
325 /* ARGSUSED1 */
326 int
327 ip_rt_add_v6(const in6_addr_t *dst_addr, const in6_addr_t *mask,
328     const in6_addr_t *gw_addr, const in6_addr_t *src_addr, int flags,
329     ipif_t *ipif_arg, ire_t **ire_arg, queue_t *q, mblk_t *mp, ipsq_func_t func,
330     struct rtsa_s *sp)
331 {
332 	ire_t	*ire;
333 	ire_t	*gw_ire = NULL;
334 	ipif_t	*ipif;
335 	boolean_t ipif_refheld = B_FALSE;
336 	uint_t	type;
337 	int	match_flags = MATCH_IRE_TYPE;
338 	int	error;
339 	tsol_gc_t *gc = NULL;
340 	tsol_gcgrp_t *gcgrp = NULL;
341 	boolean_t gcgrp_xtraref = B_FALSE;
342 
343 	if (ire_arg != NULL)
344 		*ire_arg = NULL;
345 
346 	/*
347 	 * Prevent routes with a zero gateway from being created (since
348 	 * interfaces can currently be plumbed and brought up with no assigned
349 	 * address).
350 	 */
351 	if (IN6_IS_ADDR_UNSPECIFIED(gw_addr))
352 		return (ENETUNREACH);
353 
354 	/*
355 	 * If this is the case of RTF_HOST being set, then we set the netmask
356 	 * to all ones (regardless if one was supplied).
357 	 */
358 	if (flags & RTF_HOST)
359 		mask = &ipv6_all_ones;
360 
361 	/*
362 	 * Get the ipif, if any, corresponding to the gw_addr
363 	 */
364 	ipif = ipif_lookup_interface_v6(gw_addr, dst_addr, q, mp, func,
365 	    &error);
366 	if (ipif != NULL)
367 		ipif_refheld = B_TRUE;
368 	else if (error == EINPROGRESS) {
369 		ip1dbg(("ip_rt_add_v6: null and EINPROGRESS"));
370 		return (error);
371 	}
372 
373 	/*
374 	 * GateD will attempt to create routes with a loopback interface
375 	 * address as the gateway and with RTF_GATEWAY set.  We allow
376 	 * these routes to be added, but create them as interface routes
377 	 * since the gateway is an interface address.
378 	 */
379 	if ((ipif != NULL) && (ipif->ipif_ire_type == IRE_LOOPBACK)) {
380 		flags &= ~RTF_GATEWAY;
381 		if (IN6_ARE_ADDR_EQUAL(gw_addr, &ipv6_loopback) &&
382 		    IN6_ARE_ADDR_EQUAL(dst_addr, &ipv6_loopback) &&
383 		    IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones)) {
384 			ire = ire_ctable_lookup_v6(dst_addr, 0, IRE_LOOPBACK,
385 			    ipif, ALL_ZONES, NULL, match_flags);
386 			if (ire != NULL) {
387 				ire_refrele(ire);
388 				if (ipif_refheld)
389 					ipif_refrele(ipif);
390 				return (EEXIST);
391 			}
392 			ip1dbg(("ipif_up_done: 0x%p creating IRE 0x%x"
393 			    "for 0x%x\n", (void *)ipif,
394 			    ipif->ipif_ire_type,
395 			    ntohl(ipif->ipif_lcl_addr)));
396 			ire = ire_create_v6(
397 			    dst_addr,
398 			    mask,
399 			    &ipif->ipif_v6src_addr,
400 			    NULL,
401 			    &ipif->ipif_mtu,
402 			    NULL,
403 			    NULL,
404 			    NULL,
405 			    ipif->ipif_net_type,
406 			    ipif->ipif_resolver_mp,
407 			    ipif,
408 			    NULL,
409 			    0,
410 			    0,
411 			    flags,
412 			    &ire_uinfo_null,
413 			    NULL,
414 			    NULL);
415 			if (ire == NULL) {
416 				if (ipif_refheld)
417 					ipif_refrele(ipif);
418 				return (ENOMEM);
419 			}
420 			error = ire_add(&ire, q, mp, func);
421 			if (error == 0)
422 				goto save_ire;
423 			/*
424 			 * In the result of failure, ire_add() will have already
425 			 * deleted the ire in question, so there is no need to
426 			 * do that here.
427 			 */
428 			if (ipif_refheld)
429 				ipif_refrele(ipif);
430 			return (error);
431 		}
432 	}
433 
434 	/*
435 	 * Traditionally, interface routes are ones where RTF_GATEWAY isn't set
436 	 * and the gateway address provided is one of the system's interface
437 	 * addresses.  By using the routing socket interface and supplying an
438 	 * RTA_IFP sockaddr with an interface index, an alternate method of
439 	 * specifying an interface route to be created is available which uses
440 	 * the interface index that specifies the outgoing interface rather than
441 	 * the address of an outgoing interface (which may not be able to
442 	 * uniquely identify an interface).  When coupled with the RTF_GATEWAY
443 	 * flag, routes can be specified which not only specify the next-hop to
444 	 * be used when routing to a certain prefix, but also which outgoing
445 	 * interface should be used.
446 	 *
447 	 * Previously, interfaces would have unique addresses assigned to them
448 	 * and so the address assigned to a particular interface could be used
449 	 * to identify a particular interface.  One exception to this was the
450 	 * case of an unnumbered interface (where IPIF_UNNUMBERED was set).
451 	 *
452 	 * With the advent of IPv6 and its link-local addresses, this
453 	 * restriction was relaxed and interfaces could share addresses between
454 	 * themselves.  In fact, typically all of the link-local interfaces on
455 	 * an IPv6 node or router will have the same link-local address.  In
456 	 * order to differentiate between these interfaces, the use of an
457 	 * interface index is necessary and this index can be carried inside a
458 	 * RTA_IFP sockaddr (which is actually a sockaddr_dl).  One restriction
459 	 * of using the interface index, however, is that all of the ipif's that
460 	 * are part of an ill have the same index and so the RTA_IFP sockaddr
461 	 * cannot be used to differentiate between ipif's (or logical
462 	 * interfaces) that belong to the same ill (physical interface).
463 	 *
464 	 * For example, in the following case involving IPv4 interfaces and
465 	 * logical interfaces
466 	 *
467 	 *	192.0.2.32	255.255.255.224	192.0.2.33	U	if0
468 	 *	192.0.2.32	255.255.255.224	192.0.2.34	U	if0:1
469 	 *	192.0.2.32	255.255.255.224	192.0.2.35	U	if0:2
470 	 *
471 	 * the ipif's corresponding to each of these interface routes can be
472 	 * uniquely identified by the "gateway" (actually interface address).
473 	 *
474 	 * In this case involving multiple IPv6 default routes to a particular
475 	 * link-local gateway, the use of RTA_IFP is necessary to specify which
476 	 * default route is of interest:
477 	 *
478 	 *	default		fe80::123:4567:89ab:cdef	U	if0
479 	 *	default		fe80::123:4567:89ab:cdef	U	if1
480 	 */
481 
482 	/* RTF_GATEWAY not set */
483 	if (!(flags & RTF_GATEWAY)) {
484 		queue_t	*stq;
485 
486 		if (sp != NULL) {
487 			ip2dbg(("ip_rt_add_v6: gateway security attributes "
488 			    "cannot be set with interface route\n"));
489 			if (ipif_refheld)
490 				ipif_refrele(ipif);
491 			return (EINVAL);
492 		}
493 
494 		/*
495 		 * As the interface index specified with the RTA_IFP sockaddr is
496 		 * the same for all ipif's off of an ill, the matching logic
497 		 * below uses MATCH_IRE_ILL if such an index was specified.
498 		 * This means that routes sharing the same prefix when added
499 		 * using a RTA_IFP sockaddr must have distinct interface
500 		 * indices (namely, they must be on distinct ill's).
501 		 *
502 		 * On the other hand, since the gateway address will usually be
503 		 * different for each ipif on the system, the matching logic
504 		 * uses MATCH_IRE_IPIF in the case of a traditional interface
505 		 * route.  This means that interface routes for the same prefix
506 		 * can be created if they belong to distinct ipif's and if a
507 		 * RTA_IFP sockaddr is not present.
508 		 */
509 		if (ipif_arg != NULL) {
510 			if (ipif_refheld) {
511 				ipif_refrele(ipif);
512 				ipif_refheld = B_FALSE;
513 			}
514 			ipif = ipif_arg;
515 			match_flags |= MATCH_IRE_ILL;
516 		} else {
517 			/*
518 			 * Check the ipif corresponding to the gw_addr
519 			 */
520 			if (ipif == NULL)
521 				return (ENETUNREACH);
522 			match_flags |= MATCH_IRE_IPIF;
523 		}
524 
525 		ASSERT(ipif != NULL);
526 		/*
527 		 * We check for an existing entry at this point.
528 		 */
529 		match_flags |= MATCH_IRE_MASK;
530 		ire = ire_ftable_lookup_v6(dst_addr, mask, 0, IRE_INTERFACE,
531 		    ipif, NULL, ALL_ZONES, 0, NULL, match_flags);
532 		if (ire != NULL) {
533 			ire_refrele(ire);
534 			if (ipif_refheld)
535 				ipif_refrele(ipif);
536 			return (EEXIST);
537 		}
538 
539 		stq = (ipif->ipif_net_type == IRE_IF_RESOLVER)
540 		    ? ipif->ipif_rq : ipif->ipif_wq;
541 
542 		/*
543 		 * Create a copy of the IRE_LOOPBACK, IRE_IF_NORESOLVER or
544 		 * IRE_IF_RESOLVER with the modified address and netmask.
545 		 */
546 		ire = ire_create_v6(
547 		    dst_addr,
548 		    mask,
549 		    &ipif->ipif_v6src_addr,
550 		    NULL,
551 		    &ipif->ipif_mtu,
552 		    NULL,
553 		    NULL,
554 		    stq,
555 		    ipif->ipif_net_type,
556 		    ipif->ipif_resolver_mp,
557 		    ipif,
558 		    NULL,
559 		    0,
560 		    0,
561 		    flags,
562 		    &ire_uinfo_null,
563 		    NULL,
564 		    NULL);
565 		if (ire == NULL) {
566 			if (ipif_refheld)
567 				ipif_refrele(ipif);
568 			return (ENOMEM);
569 		}
570 
571 		/*
572 		 * Some software (for example, GateD and Sun Cluster) attempts
573 		 * to create (what amount to) IRE_PREFIX routes with the
574 		 * loopback address as the gateway.  This is primarily done to
575 		 * set up prefixes with the RTF_REJECT flag set (for example,
576 		 * when generating aggregate routes.)
577 		 *
578 		 * If the IRE type (as defined by ipif->ipif_net_type) is
579 		 * IRE_LOOPBACK, then we map the request into a
580 		 * IRE_IF_NORESOLVER.
581 		 *
582 		 * Needless to say, the real IRE_LOOPBACK is NOT created by this
583 		 * routine, but rather using ire_create_v6() directly.
584 		 */
585 		if (ipif->ipif_net_type == IRE_LOOPBACK)
586 			ire->ire_type = IRE_IF_NORESOLVER;
587 		error = ire_add(&ire, q, mp, func);
588 		if (error == 0)
589 			goto save_ire;
590 		/*
591 		 * In the result of failure, ire_add() will have already
592 		 * deleted the ire in question, so there is no need to
593 		 * do that here.
594 		 */
595 		if (ipif_refheld)
596 			ipif_refrele(ipif);
597 		return (error);
598 	}
599 	if (ipif_refheld) {
600 		ipif_refrele(ipif);
601 		ipif_refheld = B_FALSE;
602 	}
603 
604 	/*
605 	 * Get an interface IRE for the specified gateway.
606 	 * If we don't have an IRE_IF_NORESOLVER or IRE_IF_RESOLVER for the
607 	 * gateway, it is currently unreachable and we fail the request
608 	 * accordingly.
609 	 */
610 	ipif = ipif_arg;
611 	if (ipif_arg != NULL)
612 		match_flags |= MATCH_IRE_ILL;
613 	gw_ire = ire_ftable_lookup_v6(gw_addr, 0, 0, IRE_INTERFACE, ipif_arg,
614 	    NULL, ALL_ZONES, 0, NULL, match_flags);
615 	if (gw_ire == NULL)
616 		return (ENETUNREACH);
617 
618 	/*
619 	 * We create one of three types of IREs as a result of this request
620 	 * based on the netmask.  A netmask of all ones (which is automatically
621 	 * assumed when RTF_HOST is set) results in an IRE_HOST being created.
622 	 * An all zeroes netmask implies a default route so an IRE_DEFAULT is
623 	 * created.  Otherwise, an IRE_PREFIX route is created for the
624 	 * destination prefix.
625 	 */
626 	if (IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones))
627 		type = IRE_HOST;
628 	else if (IN6_IS_ADDR_UNSPECIFIED(mask))
629 		type = IRE_DEFAULT;
630 	else
631 		type = IRE_PREFIX;
632 
633 	/* check for a duplicate entry */
634 	ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr, type, ipif_arg,
635 	    NULL, ALL_ZONES, 0, NULL,
636 	    match_flags | MATCH_IRE_MASK | MATCH_IRE_GW);
637 	if (ire != NULL) {
638 		ire_refrele(gw_ire);
639 		ire_refrele(ire);
640 		return (EEXIST);
641 	}
642 
643 	/* Security attribute exists */
644 	if (sp != NULL) {
645 		tsol_gcgrp_addr_t ga;
646 
647 		/* find or create the gateway credentials group */
648 		ga.ga_af = AF_INET6;
649 		ga.ga_addr = *gw_addr;
650 
651 		/* we hold reference to it upon success */
652 		gcgrp = gcgrp_lookup(&ga, B_TRUE);
653 		if (gcgrp == NULL) {
654 			ire_refrele(gw_ire);
655 			return (ENOMEM);
656 		}
657 
658 		/*
659 		 * Create and add the security attribute to the group; a
660 		 * reference to the group is made upon allocating a new
661 		 * entry successfully.  If it finds an already-existing
662 		 * entry for the security attribute in the group, it simply
663 		 * returns it and no new reference is made to the group.
664 		 */
665 		gc = gc_create(sp, gcgrp, &gcgrp_xtraref);
666 		if (gc == NULL) {
667 			/* release reference held by gcgrp_lookup */
668 			GCGRP_REFRELE(gcgrp);
669 			ire_refrele(gw_ire);
670 			return (ENOMEM);
671 		}
672 	}
673 
674 	/* Create the IRE. */
675 	ire = ire_create_v6(
676 	    dst_addr,				/* dest address */
677 	    mask,				/* mask */
678 	    /* src address assigned by the caller? */
679 	    (((flags & RTF_SETSRC) && !IN6_IS_ADDR_UNSPECIFIED(src_addr)) ?
680 		src_addr : NULL),
681 	    gw_addr,				/* gateway address */
682 	    &gw_ire->ire_max_frag,
683 	    NULL,				/* no Fast Path header */
684 	    NULL,				/* no recv-from queue */
685 	    NULL,				/* no send-to queue */
686 	    (ushort_t)type,			/* IRE type */
687 	    NULL,
688 	    ipif_arg,
689 	    NULL,
690 	    0,
691 	    0,
692 	    flags,
693 	    &gw_ire->ire_uinfo,			/* Inherit ULP info from gw */
694 	    gc,					/* security attribute */
695 	    NULL);
696 	/*
697 	 * The ire holds a reference to the 'gc' and the 'gc' holds a
698 	 * reference to the 'gcgrp'. We can now release the extra reference
699 	 * the 'gcgrp' acquired in the gcgrp_lookup, if it was not used.
700 	 */
701 	if (gcgrp_xtraref)
702 		GCGRP_REFRELE(gcgrp);
703 	if (ire == NULL) {
704 		if (gc != NULL)
705 			GC_REFRELE(gc);
706 		ire_refrele(gw_ire);
707 		return (ENOMEM);
708 	}
709 
710 	/*
711 	 * POLICY: should we allow an RTF_HOST with address INADDR_ANY?
712 	 * SUN/OS socket stuff does but do we really want to allow ::0 ?
713 	 */
714 
715 	/* Add the new IRE. */
716 	error = ire_add(&ire, q, mp, func);
717 	/*
718 	 * In the result of failure, ire_add() will have already
719 	 * deleted the ire in question, so there is no need to
720 	 * do that here.
721 	 */
722 	if (error != 0) {
723 		ire_refrele(gw_ire);
724 		return (error);
725 	}
726 
727 	if (flags & RTF_MULTIRT) {
728 		/*
729 		 * Invoke the CGTP (multirouting) filtering module
730 		 * to add the dst address in the filtering database.
731 		 * Replicated inbound packets coming from that address
732 		 * will be filtered to discard the duplicates.
733 		 * It is not necessary to call the CGTP filter hook
734 		 * when the dst address is a multicast, because an
735 		 * IP source address cannot be a multicast.
736 		 */
737 		if ((ip_cgtp_filter_ops != NULL) &&
738 		    !IN6_IS_ADDR_MULTICAST(&(ire->ire_addr_v6))) {
739 			int res = ip_cgtp_filter_ops->cfo_add_dest_v6(
740 			    &ire->ire_addr_v6,
741 			    &ire->ire_gateway_addr_v6,
742 			    &ire->ire_src_addr_v6,
743 			    &gw_ire->ire_src_addr_v6);
744 			if (res != 0) {
745 				ire_refrele(gw_ire);
746 				ire_delete(ire);
747 				return (res);
748 			}
749 		}
750 	}
751 
752 	/*
753 	 * Now that the prefix IRE entry has been created, delete any
754 	 * existing gateway IRE cache entries as well as any IRE caches
755 	 * using the gateway, and force them to be created through
756 	 * ip_newroute_v6.
757 	 */
758 	if (gc != NULL) {
759 		ASSERT(gcgrp != NULL);
760 		ire_clookup_delete_cache_gw_v6(gw_addr, ALL_ZONES);
761 	}
762 
763 save_ire:
764 	if (gw_ire != NULL) {
765 		ire_refrele(gw_ire);
766 	}
767 	if (ipif != NULL) {
768 		mblk_t	*save_mp;
769 
770 		/*
771 		 * Save enough information so that we can recreate the IRE if
772 		 * the interface goes down and then up.  The metrics associated
773 		 * with the route will be saved as well when rts_setmetrics() is
774 		 * called after the IRE has been created.  In the case where
775 		 * memory cannot be allocated, none of this information will be
776 		 * saved.
777 		 */
778 		save_mp = allocb(sizeof (ifrt_t), BPRI_MED);
779 		if (save_mp != NULL) {
780 			ifrt_t	*ifrt;
781 
782 			save_mp->b_wptr += sizeof (ifrt_t);
783 			ifrt = (ifrt_t *)save_mp->b_rptr;
784 			bzero(ifrt, sizeof (ifrt_t));
785 			ifrt->ifrt_type = ire->ire_type;
786 			ifrt->ifrt_v6addr = ire->ire_addr_v6;
787 			mutex_enter(&ire->ire_lock);
788 			ifrt->ifrt_v6gateway_addr = ire->ire_gateway_addr_v6;
789 			ifrt->ifrt_v6src_addr = ire->ire_src_addr_v6;
790 			mutex_exit(&ire->ire_lock);
791 			ifrt->ifrt_v6mask = ire->ire_mask_v6;
792 			ifrt->ifrt_flags = ire->ire_flags;
793 			ifrt->ifrt_max_frag = ire->ire_max_frag;
794 			mutex_enter(&ipif->ipif_saved_ire_lock);
795 			save_mp->b_cont = ipif->ipif_saved_ire_mp;
796 			ipif->ipif_saved_ire_mp = save_mp;
797 			ipif->ipif_saved_ire_cnt++;
798 			mutex_exit(&ipif->ipif_saved_ire_lock);
799 		}
800 	}
801 	if (ire_arg != NULL) {
802 		/*
803 		 * Store the ire that was successfully added into where ire_arg
804 		 * points to so that callers don't have to look it up
805 		 * themselves (but they are responsible for ire_refrele()ing
806 		 * the ire when they are finished with it).
807 		 */
808 		*ire_arg = ire;
809 	} else {
810 		ire_refrele(ire);		/* Held in ire_add */
811 	}
812 	if (ipif_refheld)
813 		ipif_refrele(ipif);
814 	return (0);
815 }
816 
817 /*
818  * ip_rt_delete_v6 is called to delete an IPv6 route.
819  * ipif_arg is passed in to associate it with the correct interface
820  * (for link-local destinations and gateways).
821  */
822 /* ARGSUSED4 */
823 int
824 ip_rt_delete_v6(const in6_addr_t *dst_addr, const in6_addr_t *mask,
825     const in6_addr_t *gw_addr, uint_t rtm_addrs, int flags, ipif_t *ipif_arg,
826     queue_t *q, mblk_t *mp, ipsq_func_t func)
827 {
828 	ire_t	*ire = NULL;
829 	ipif_t	*ipif;
830 	uint_t	type;
831 	uint_t	match_flags = MATCH_IRE_TYPE;
832 	int	err = 0;
833 	boolean_t	ipif_refheld = B_FALSE;
834 
835 	/*
836 	 * If this is the case of RTF_HOST being set, then we set the netmask
837 	 * to all ones.  Otherwise, we use the netmask if one was supplied.
838 	 */
839 	if (flags & RTF_HOST) {
840 		mask = &ipv6_all_ones;
841 		match_flags |= MATCH_IRE_MASK;
842 	} else if (rtm_addrs & RTA_NETMASK) {
843 		match_flags |= MATCH_IRE_MASK;
844 	}
845 
846 	/*
847 	 * Note that RTF_GATEWAY is never set on a delete, therefore
848 	 * we check if the gateway address is one of our interfaces first,
849 	 * and fall back on RTF_GATEWAY routes.
850 	 *
851 	 * This makes it possible to delete an original
852 	 * IRE_IF_NORESOLVER/IRE_IF_RESOLVER - consistent with SunOS 4.1.
853 	 *
854 	 * As the interface index specified with the RTA_IFP sockaddr is the
855 	 * same for all ipif's off of an ill, the matching logic below uses
856 	 * MATCH_IRE_ILL if such an index was specified.  This means a route
857 	 * sharing the same prefix and interface index as the the route
858 	 * intended to be deleted might be deleted instead if a RTA_IFP sockaddr
859 	 * is specified in the request.
860 	 *
861 	 * On the other hand, since the gateway address will usually be
862 	 * different for each ipif on the system, the matching logic
863 	 * uses MATCH_IRE_IPIF in the case of a traditional interface
864 	 * route.  This means that interface routes for the same prefix can be
865 	 * uniquely identified if they belong to distinct ipif's and if a
866 	 * RTA_IFP sockaddr is not present.
867 	 *
868 	 * For more detail on specifying routes by gateway address and by
869 	 * interface index, see the comments in ip_rt_add_v6().
870 	 */
871 	ipif = ipif_lookup_interface_v6(gw_addr, dst_addr, q, mp, func, &err);
872 	if (ipif != NULL) {
873 		ipif_refheld = B_TRUE;
874 		if (ipif_arg != NULL) {
875 			ipif_refrele(ipif);
876 			ipif_refheld = B_FALSE;
877 			ipif = ipif_arg;
878 			match_flags |= MATCH_IRE_ILL;
879 		} else {
880 			match_flags |= MATCH_IRE_IPIF;
881 		}
882 
883 		if (ipif->ipif_ire_type == IRE_LOOPBACK)
884 			ire = ire_ctable_lookup_v6(dst_addr, 0, IRE_LOOPBACK,
885 			    ipif, ALL_ZONES, NULL, match_flags);
886 		if (ire == NULL)
887 			ire = ire_ftable_lookup_v6(dst_addr, mask, 0,
888 			    IRE_INTERFACE, ipif, NULL, ALL_ZONES, 0, NULL,
889 			    match_flags);
890 	} else if (err == EINPROGRESS) {
891 		return (err);
892 	} else {
893 		err = 0;
894 	}
895 	if (ire == NULL) {
896 		/*
897 		 * At this point, the gateway address is not one of our own
898 		 * addresses or a matching interface route was not found.  We
899 		 * set the IRE type to lookup based on whether
900 		 * this is a host route, a default route or just a prefix.
901 		 *
902 		 * If an ipif_arg was passed in, then the lookup is based on an
903 		 * interface index so MATCH_IRE_ILL is added to match_flags.
904 		 * In any case, MATCH_IRE_IPIF is cleared and MATCH_IRE_GW is
905 		 * set as the route being looked up is not a traditional
906 		 * interface route.
907 		 */
908 		match_flags &= ~MATCH_IRE_IPIF;
909 		match_flags |= MATCH_IRE_GW;
910 		if (ipif_arg != NULL)
911 			match_flags |= MATCH_IRE_ILL;
912 		if (IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones))
913 			type = IRE_HOST;
914 		else if (IN6_IS_ADDR_UNSPECIFIED(mask))
915 			type = IRE_DEFAULT;
916 		else
917 			type = IRE_PREFIX;
918 		ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr, type,
919 		    ipif_arg, NULL, ALL_ZONES, 0, NULL, match_flags);
920 		if (ire == NULL && type == IRE_HOST) {
921 			ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr,
922 			    IRE_HOST_REDIRECT, ipif_arg, NULL, ALL_ZONES, 0,
923 			    NULL, match_flags);
924 		}
925 	}
926 
927 	if (ipif_refheld) {
928 		ipif_refrele(ipif);
929 		ipif_refheld = B_FALSE;
930 	}
931 	if (ire == NULL)
932 		return (ESRCH);
933 
934 	if (ire->ire_flags & RTF_MULTIRT) {
935 		/*
936 		 * Invoke the CGTP (multirouting) filtering module
937 		 * to remove the dst address from the filtering database.
938 		 * Packets coming from that address will no longer be
939 		 * filtered to remove duplicates.
940 		 */
941 		if (ip_cgtp_filter_ops != NULL) {
942 			err = ip_cgtp_filter_ops->cfo_del_dest_v6(
943 			    &ire->ire_addr_v6, &ire->ire_gateway_addr_v6);
944 		}
945 	}
946 
947 	ipif = ire->ire_ipif;
948 	if (ipif != NULL) {
949 		mblk_t		**mpp;
950 		mblk_t		*mp;
951 		ifrt_t		*ifrt;
952 		in6_addr_t	gw_addr_v6;
953 
954 		/* Remove from ipif_saved_ire_mp list if it is there */
955 		mutex_enter(&ire->ire_lock);
956 		gw_addr_v6 = ire->ire_gateway_addr_v6;
957 		mutex_exit(&ire->ire_lock);
958 		mutex_enter(&ipif->ipif_saved_ire_lock);
959 		for (mpp = &ipif->ipif_saved_ire_mp; *mpp != NULL;
960 		    mpp = &(*mpp)->b_cont) {
961 			/*
962 			 * On a given ipif, the triple of address, gateway and
963 			 * mask is unique for each saved IRE (in the case of
964 			 * ordinary interface routes, the gateway address is
965 			 * all-zeroes).
966 			 */
967 			mp = *mpp;
968 			ifrt = (ifrt_t *)mp->b_rptr;
969 			if (IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6addr,
970 			    &ire->ire_addr_v6) &&
971 			    IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6gateway_addr,
972 			    &gw_addr_v6) &&
973 			    IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6mask,
974 			    &ire->ire_mask_v6)) {
975 				*mpp = mp->b_cont;
976 				ipif->ipif_saved_ire_cnt--;
977 				freeb(mp);
978 				break;
979 			}
980 		}
981 		mutex_exit(&ipif->ipif_saved_ire_lock);
982 	}
983 	ire_delete(ire);
984 	ire_refrele(ire);
985 	return (err);
986 }
987 
988 /*
989  * Derive a token from the link layer address.
990  */
991 boolean_t
992 ill_setdefaulttoken(ill_t *ill)
993 {
994 	int 		i;
995 	in6_addr_t	v6addr, v6mask;
996 
997 	/*
998 	 * Though we execute on the ipsq, we need to hold the ill_lock
999 	 * to prevent readers from seeing partially updated values
1000 	 * while we do the update.
1001 	 */
1002 	mutex_enter(&ill->ill_lock);
1003 	if (!MEDIA_V6INTFID(ill->ill_media, ill->ill_phys_addr_length,
1004 	    ill->ill_phys_addr, &v6addr)) {
1005 		mutex_exit(&ill->ill_lock);
1006 		return (B_FALSE);
1007 	}
1008 
1009 	(void) ip_plen_to_mask_v6(IPV6_TOKEN_LEN, &v6mask);
1010 
1011 	for (i = 0; i < 4; i++)
1012 		v6mask.s6_addr32[i] = v6mask.s6_addr32[i] ^
1013 		    (uint32_t)0xffffffff;
1014 
1015 	V6_MASK_COPY(v6addr, v6mask, ill->ill_token);
1016 	ill->ill_token_length = IPV6_TOKEN_LEN;
1017 	mutex_exit(&ill->ill_lock);
1018 	return (B_TRUE);
1019 }
1020 
1021 /*
1022  * Create a link-local address from a token.
1023  */
1024 static void
1025 ipif_get_linklocal(in6_addr_t *dest, const in6_addr_t *token)
1026 {
1027 	int i;
1028 
1029 	for (i = 0; i < 4; i++) {
1030 		dest->s6_addr32[i] =
1031 		    token->s6_addr32[i] | ipv6_ll_template.s6_addr32[i];
1032 	}
1033 }
1034 
1035 /*
1036  * Set a nice default address for either automatic tunnels tsrc/96 or
1037  * 6to4 tunnels 2002:<tsrc>::1/64
1038  */
1039 static void
1040 ipif_set_tun_auto_addr(ipif_t *ipif, struct iftun_req *ta)
1041 {
1042 	sin6_t	sin6;
1043 	sin_t	*sin;
1044 	ill_t 	*ill = ipif->ipif_ill;
1045 	tun_t *tp = (tun_t *)ill->ill_wq->q_next->q_ptr;
1046 
1047 	if (ta->ifta_saddr.ss_family != AF_INET ||
1048 	    (ipif->ipif_flags & IPIF_UP) || !ipif->ipif_isv6 ||
1049 	    (ta->ifta_flags & IFTUN_SRC) == 0)
1050 		return;
1051 
1052 	/*
1053 	 * Check the tunnel type by examining q_next->q_ptr
1054 	 */
1055 	if (tp->tun_flags & TUN_AUTOMATIC) {
1056 		/* this is an automatic tunnel */
1057 		(void) ip_plen_to_mask_v6(IPV6_ABITS - IP_ABITS,
1058 		    &ipif->ipif_v6net_mask);
1059 		bzero(&sin6, sizeof (sin6_t));
1060 		sin = (sin_t *)&ta->ifta_saddr;
1061 		V4_PART_OF_V6(sin6.sin6_addr) = sin->sin_addr.s_addr;
1062 		sin6.sin6_family = AF_INET6;
1063 		(void) ip_sioctl_addr(ipif, (sin_t *)&sin6,
1064 		    NULL, NULL, NULL, NULL);
1065 	} else if (tp->tun_flags & TUN_6TO4) {
1066 		/* this is a 6to4 tunnel */
1067 		(void) ip_plen_to_mask_v6(IPV6_PREFIX_LEN,
1068 		    &ipif->ipif_v6net_mask);
1069 		sin = (sin_t *)&ta->ifta_saddr;
1070 		/* create a 6to4 address from the IPv4 tsrc */
1071 		IN6_V4ADDR_TO_6TO4(&sin->sin_addr, &sin6.sin6_addr);
1072 		sin6.sin6_family = AF_INET6;
1073 		(void) ip_sioctl_addr(ipif, (sin_t *)&sin6,
1074 		    NULL, NULL, NULL, NULL);
1075 	} else {
1076 		ip1dbg(("ipif_set_tun_auto_addr: Unknown tunnel type"));
1077 		return;
1078 	}
1079 }
1080 
1081 /*
1082  * Set link local for ipif_id 0 of a configured tunnel based on the
1083  * tsrc or tdst parameter
1084  * For tunnels over IPv4 use the IPv4 address prepended with 32 zeros as
1085  * the token.
1086  * For tunnels over IPv6 use the low-order 64 bits of the "inner" IPv6 address
1087  * as the token for the "outer" link.
1088  */
1089 void
1090 ipif_set_tun_llink(ill_t *ill, struct iftun_req *ta)
1091 {
1092 	ipif_t		*ipif;
1093 	sin_t		*sin;
1094 	in6_addr_t	*s6addr;
1095 
1096 	ASSERT(IAM_WRITER_ILL(ill));
1097 
1098 	/* The first ipif must be id zero. */
1099 	ipif = ill->ill_ipif;
1100 	ASSERT(ipif->ipif_id == 0);
1101 
1102 	/* no link local for automatic tunnels */
1103 	if (!(ipif->ipif_flags & IPIF_POINTOPOINT)) {
1104 		ipif_set_tun_auto_addr(ipif, ta);
1105 		return;
1106 	}
1107 
1108 	if ((ta->ifta_flags & IFTUN_DST) &&
1109 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6pp_dst_addr)) {
1110 		sin6_t	sin6;
1111 
1112 		ASSERT(!(ipif->ipif_flags & IPIF_UP));
1113 		bzero(&sin6, sizeof (sin6_t));
1114 		if ((ta->ifta_saddr.ss_family == AF_INET)) {
1115 			sin = (sin_t *)&ta->ifta_daddr;
1116 			V4_PART_OF_V6(sin6.sin6_addr) =
1117 			    sin->sin_addr.s_addr;
1118 		} else {
1119 			s6addr =
1120 			    &((sin6_t *)&ta->ifta_daddr)->sin6_addr;
1121 			sin6.sin6_addr.s6_addr32[3] = s6addr->s6_addr32[3];
1122 			sin6.sin6_addr.s6_addr32[2] = s6addr->s6_addr32[2];
1123 		}
1124 		ipif_get_linklocal(&ipif->ipif_v6pp_dst_addr,
1125 		    &sin6.sin6_addr);
1126 		ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr;
1127 	}
1128 	if ((ta->ifta_flags & IFTUN_SRC)) {
1129 		ASSERT(!(ipif->ipif_flags & IPIF_UP));
1130 
1131 		/* Set the token if it isn't already set */
1132 		if (IN6_IS_ADDR_UNSPECIFIED(&ill->ill_token)) {
1133 			if ((ta->ifta_saddr.ss_family == AF_INET)) {
1134 				sin = (sin_t *)&ta->ifta_saddr;
1135 				V4_PART_OF_V6(ill->ill_token) =
1136 				    sin->sin_addr.s_addr;
1137 			} else {
1138 				s6addr =
1139 				    &((sin6_t *)&ta->ifta_saddr)->sin6_addr;
1140 				ill->ill_token.s6_addr32[3] =
1141 				    s6addr->s6_addr32[3];
1142 				ill->ill_token.s6_addr32[2] =
1143 				    s6addr->s6_addr32[2];
1144 			}
1145 			ill->ill_token_length = IPV6_TOKEN_LEN;
1146 		}
1147 		/*
1148 		 * Attempt to set the link local address if it isn't set.
1149 		 */
1150 		if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr))
1151 			(void) ipif_setlinklocal(ipif);
1152 	}
1153 }
1154 
1155 /*
1156  * Is it not possible to set the link local address?
1157  * The address can be set if the token is set, and the token
1158  * isn't too long.
1159  * Return B_TRUE if the address can't be set, or B_FALSE if it can.
1160  */
1161 boolean_t
1162 ipif_cant_setlinklocal(ipif_t *ipif)
1163 {
1164 	ill_t *ill = ipif->ipif_ill;
1165 
1166 	if (IN6_IS_ADDR_UNSPECIFIED(&ill->ill_token) ||
1167 	    ill->ill_token_length > IPV6_ABITS - IPV6_LL_PREFIXLEN)
1168 		return (B_TRUE);
1169 
1170 	return (B_FALSE);
1171 }
1172 
1173 /*
1174  * Generate a link-local address from the token.
1175  * Return zero if the address was set, or non-zero if it couldn't be set.
1176  */
1177 int
1178 ipif_setlinklocal(ipif_t *ipif)
1179 {
1180 	ill_t *ill = ipif->ipif_ill;
1181 
1182 	ASSERT(IAM_WRITER_ILL(ill));
1183 
1184 	if (ipif_cant_setlinklocal(ipif))
1185 		return (-1);
1186 
1187 	ipif_get_linklocal(&ipif->ipif_v6lcl_addr, &ill->ill_token);
1188 	(void) ip_plen_to_mask_v6(IPV6_LL_PREFIXLEN, &ipif->ipif_v6net_mask);
1189 	V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
1190 	    ipif->ipif_v6subnet);
1191 
1192 	if (ipif->ipif_flags & IPIF_NOLOCAL) {
1193 		ipif->ipif_v6src_addr = ipv6_all_zeros;
1194 	} else {
1195 		ipif->ipif_v6src_addr = ipif->ipif_v6lcl_addr;
1196 	}
1197 	return (0);
1198 }
1199 
1200 /*
1201  * This function sets up the multicast mappings in NDP.
1202  * Unlike ARP, there are no mapping_mps here. We delete the
1203  * mapping nces and add a new one.
1204  *
1205  * Returns non-zero on error and 0 on success.
1206  */
1207 int
1208 ipif_ndp_setup_multicast(ipif_t *ipif, nce_t **ret_nce)
1209 {
1210 	ill_t		*ill = ipif->ipif_ill;
1211 	in6_addr_t	v6_mcast_addr = {(uint32_t)V6_MCAST, 0, 0, 0};
1212 	in6_addr_t	v6_mcast_mask = {(uint32_t)V6_MCAST, 0, 0, 0};
1213 	in6_addr_t	v6_extract_mask;
1214 	uchar_t		*phys_addr, *bphys_addr, *alloc_phys;
1215 	nce_t		*mnce = NULL;
1216 	int		err = 0;
1217 	phyint_t	*phyi = ill->ill_phyint;
1218 	uint32_t	hw_extract_start;
1219 	dl_unitdata_req_t *dlur;
1220 
1221 	if (ret_nce != NULL)
1222 		*ret_nce = NULL;
1223 	/*
1224 	 * Delete the mapping nce. Normally these should not exist
1225 	 * as a previous ipif_down -> ipif_ndp_down should have deleted
1226 	 * all the nces. But they can exist if ip_rput_dlpi_writer
1227 	 * calls this when PHYI_MULTI_BCAST is set.
1228 	 */
1229 	mnce = ndp_lookup(ill, &v6_mcast_addr, B_FALSE);
1230 	if (mnce != NULL) {
1231 		ndp_delete(mnce);
1232 		NCE_REFRELE(mnce);
1233 		mnce = NULL;
1234 	}
1235 
1236 	/*
1237 	 * Get media specific v6 mapping information. Note that
1238 	 * nd_lla_len can be 0 for tunnels.
1239 	 */
1240 	alloc_phys = kmem_alloc(ill->ill_nd_lla_len, KM_NOSLEEP);
1241 	if ((alloc_phys == NULL) && (ill->ill_nd_lla_len != 0))
1242 		return (ENOMEM);
1243 	/*
1244 	 * Determine the broadcast address.
1245 	 */
1246 	dlur = (dl_unitdata_req_t *)ill->ill_bcast_mp->b_rptr;
1247 	if (ill->ill_sap_length < 0)
1248 		bphys_addr = (uchar_t *)dlur + dlur->dl_dest_addr_offset;
1249 	else
1250 		bphys_addr = (uchar_t *)dlur +
1251 		    dlur->dl_dest_addr_offset + ill->ill_sap_length;
1252 
1253 	/*
1254 	 * Check PHYI_MULTI_BCAST and possible length of physical
1255 	 * address to determine if we use the mapping or the
1256 	 * broadcast address.
1257 	 */
1258 	if ((phyi->phyint_flags & PHYI_MULTI_BCAST) ||
1259 	    (!MEDIA_V6MINFO(ill->ill_media, ill->ill_nd_lla_len,
1260 	    bphys_addr, alloc_phys, &hw_extract_start,
1261 	    &v6_extract_mask))) {
1262 		if (ill->ill_phys_addr_length > IP_MAX_HW_LEN) {
1263 			kmem_free(alloc_phys, ill->ill_nd_lla_len);
1264 			return (E2BIG);
1265 		}
1266 		/* Use the link-layer broadcast address for MULTI_BCAST */
1267 		phys_addr = bphys_addr;
1268 		bzero(&v6_extract_mask, sizeof (v6_extract_mask));
1269 		hw_extract_start = ill->ill_nd_lla_len;
1270 	} else {
1271 		phys_addr = alloc_phys;
1272 	}
1273 	if ((ipif->ipif_flags & IPIF_BROADCAST) ||
1274 	    (ill->ill_flags & ILLF_MULTICAST) ||
1275 	    (phyi->phyint_flags & PHYI_MULTI_BCAST)) {
1276 		mutex_enter(&ndp_g_lock);
1277 		err = ndp_add(ill,
1278 		    phys_addr,
1279 		    &v6_mcast_addr,	/* v6 address */
1280 		    &v6_mcast_mask,	/* v6 mask */
1281 		    &v6_extract_mask,
1282 		    hw_extract_start,
1283 		    NCE_F_MAPPING | NCE_F_PERMANENT | NCE_F_NONUD,
1284 		    ND_REACHABLE,
1285 		    &mnce);
1286 		mutex_exit(&ndp_g_lock);
1287 		if (err == 0) {
1288 			if (ret_nce != NULL) {
1289 				*ret_nce = mnce;
1290 			} else {
1291 				NCE_REFRELE(mnce);
1292 			}
1293 		}
1294 	}
1295 	kmem_free(alloc_phys, ill->ill_nd_lla_len);
1296 	return (err);
1297 }
1298 
1299 /*
1300  * Get the resolver set up for a new interface address.  (Always called
1301  * as writer.)
1302  */
1303 int
1304 ipif_ndp_up(ipif_t *ipif, const in6_addr_t *addr, boolean_t macaddr_change)
1305 {
1306 	ill_t		*ill = ipif->ipif_ill;
1307 	int		err = 0;
1308 	nce_t		*nce = NULL;
1309 	nce_t		*mnce = NULL;
1310 
1311 	ip1dbg(("ipif_ndp_up(%s:%u)\n",
1312 		ipif->ipif_ill->ill_name, ipif->ipif_id));
1313 
1314 	/*
1315 	 * ND not supported on XRESOLV interfaces. If ND support (multicast)
1316 	 * added later, take out this check.
1317 	 */
1318 	if (ill->ill_flags & ILLF_XRESOLV)
1319 		return (0);
1320 
1321 	if (IN6_IS_ADDR_UNSPECIFIED(addr) ||
1322 	    (!(ill->ill_net_type & IRE_INTERFACE)))
1323 		return (0);
1324 
1325 	/*
1326 	 * Need to setup multicast mapping only when the first
1327 	 * interface is coming UP.
1328 	 */
1329 	if (ill->ill_ipif_up_count == 0 &&
1330 	    (ill->ill_flags & ILLF_MULTICAST)) {
1331 		/*
1332 		 * We set the multicast before setting up the mapping for
1333 		 * local address because ipif_ndp_setup_multicast does
1334 		 * ndp_walk to delete nces which will delete the mapping
1335 		 * for local address also if we added the mapping for
1336 		 * local address first.
1337 		 */
1338 		err = ipif_ndp_setup_multicast(ipif, &mnce);
1339 		if (err != 0)
1340 			return (err);
1341 	}
1342 
1343 	if ((ipif->ipif_flags & (IPIF_UNNUMBERED|IPIF_NOLOCAL)) == 0) {
1344 		uint16_t	flags;
1345 		uchar_t	*hw_addr = NULL;
1346 
1347 		/* Permanent entries don't need NUD */
1348 		flags = NCE_F_PERMANENT;
1349 		flags |= NCE_F_NONUD;
1350 		if (ill->ill_flags & ILLF_ROUTER)
1351 			flags |= NCE_F_ISROUTER;
1352 
1353 		if (ipif->ipif_flags & IPIF_ANYCAST)
1354 			flags |= NCE_F_ANYCAST;
1355 
1356 		if (ill->ill_net_type == IRE_IF_RESOLVER) {
1357 			hw_addr = ill->ill_nd_lla;
1358 
1359 			if (ill->ill_move_in_progress || macaddr_change) {
1360 				/*
1361 				 * Addresses are failing over to this ill.
1362 				 * Don't wait for NUD to see this change.
1363 				 * Publish our new link-layer address.
1364 				 */
1365 				flags |= NCE_F_UNSOL_ADV;
1366 			}
1367 		}
1368 		err = ndp_lookup_then_add(ill,
1369 		    hw_addr,
1370 		    addr,
1371 		    &ipv6_all_ones,
1372 		    &ipv6_all_zeros,
1373 		    0,
1374 		    flags,
1375 		    ND_REACHABLE,
1376 		    &nce);
1377 		switch (err) {
1378 		case 0:
1379 			ip1dbg(("ipif_ndp_up: NCE created for %s\n",
1380 			    ill->ill_name));
1381 			break;
1382 		case EEXIST:
1383 			NCE_REFRELE(nce);
1384 			ip1dbg(("ipif_ndp_up: NCE already exists for %s\n",
1385 			    ill->ill_name));
1386 			if (mnce != NULL) {
1387 				ndp_delete(mnce);
1388 				NCE_REFRELE(mnce);
1389 			}
1390 			return (err);
1391 		default:
1392 			ip1dbg(("ipif_ndp_up: NCE creation failed %s\n",
1393 			    ill->ill_name));
1394 			if (mnce != NULL) {
1395 				ndp_delete(mnce);
1396 				NCE_REFRELE(mnce);
1397 			}
1398 			return (err);
1399 		}
1400 	}
1401 	if (nce != NULL)
1402 		NCE_REFRELE(nce);
1403 	if (mnce != NULL)
1404 		NCE_REFRELE(mnce);
1405 	return (0);
1406 }
1407 
1408 /* Remove all cache entries for this logical interface */
1409 void
1410 ipif_ndp_down(ipif_t *ipif)
1411 {
1412 	nce_t	*nce;
1413 
1414 	nce = ndp_lookup(ipif->ipif_ill, &ipif->ipif_v6lcl_addr, B_FALSE);
1415 	if (nce != NULL) {
1416 		ndp_delete(nce);
1417 		NCE_REFRELE(nce);
1418 	}
1419 	/*
1420 	 * Remove mapping and all other nces dependent on this ill
1421 	 * when the last ipif is going away.
1422 	 */
1423 	if (ipif->ipif_ill->ill_ipif_up_count == 0) {
1424 		ndp_walk(ipif->ipif_ill, (pfi_t)ndp_delete_per_ill,
1425 		    (uchar_t *)ipif->ipif_ill);
1426 	}
1427 }
1428 
1429 /*
1430  * Used when an interface comes up to recreate any extra routes on this
1431  * interface.
1432  */
1433 static ire_t **
1434 ipif_recover_ire_v6(ipif_t *ipif)
1435 {
1436 	mblk_t	*mp;
1437 	ire_t   **ipif_saved_irep;
1438 	ire_t   **irep;
1439 
1440 	ip1dbg(("ipif_recover_ire_v6(%s:%u)", ipif->ipif_ill->ill_name,
1441 	    ipif->ipif_id));
1442 
1443 	ASSERT(ipif->ipif_isv6);
1444 
1445 	mutex_enter(&ipif->ipif_saved_ire_lock);
1446 	ipif_saved_irep = (ire_t **)kmem_zalloc(sizeof (ire_t *) *
1447 	    ipif->ipif_saved_ire_cnt, KM_NOSLEEP);
1448 	if (ipif_saved_irep == NULL) {
1449 		mutex_exit(&ipif->ipif_saved_ire_lock);
1450 		return (NULL);
1451 	}
1452 
1453 	irep = ipif_saved_irep;
1454 
1455 	for (mp = ipif->ipif_saved_ire_mp; mp != NULL; mp = mp->b_cont) {
1456 		ire_t		*ire;
1457 		queue_t		*rfq;
1458 		queue_t		*stq;
1459 		ifrt_t		*ifrt;
1460 		in6_addr_t	*src_addr;
1461 		in6_addr_t	*gateway_addr;
1462 		mblk_t		*resolver_mp;
1463 		char		buf[INET6_ADDRSTRLEN];
1464 		ushort_t	type;
1465 
1466 		/*
1467 		 * When the ire was initially created and then added in
1468 		 * ip_rt_add_v6(), it was created either using
1469 		 * ipif->ipif_net_type in the case of a traditional interface
1470 		 * route, or as one of the IRE_OFFSUBNET types (with the
1471 		 * exception of IRE_HOST_REDIRECT which is created by
1472 		 * icmp_redirect_v6() and which we don't need to save or
1473 		 * recover).  In the case where ipif->ipif_net_type was
1474 		 * IRE_LOOPBACK, ip_rt_add_v6() will update the ire_type to
1475 		 * IRE_IF_NORESOLVER before calling ire_add_v6() to satisfy
1476 		 * software like GateD and Sun Cluster which creates routes
1477 		 * using the the loopback interface's address as a gateway.
1478 		 *
1479 		 * As ifrt->ifrt_type reflects the already updated ire_type and
1480 		 * since ire_create_v6() expects that IRE_IF_NORESOLVER will
1481 		 * have a valid ire_dlureq_mp field (which doesn't make sense
1482 		 * for a IRE_LOOPBACK), ire_create_v6() will be called in the
1483 		 * same way here as in ip_rt_add_v6(), namely using
1484 		 * ipif->ipif_net_type when the route looks like a traditional
1485 		 * interface route (where ifrt->ifrt_type & IRE_INTERFACE is
1486 		 * true) and otherwise using the saved ifrt->ifrt_type.  This
1487 		 * means that in the case where ipif->ipif_net_type is
1488 		 * IRE_LOOPBACK, the ire created by ire_create_v6() will be an
1489 		 * IRE_LOOPBACK, it will then be turned into an
1490 		 * IRE_IF_NORESOLVER and then added by ire_add_v6().
1491 		 */
1492 		ifrt = (ifrt_t *)mp->b_rptr;
1493 		if (ifrt->ifrt_type & IRE_INTERFACE) {
1494 			rfq = NULL;
1495 			stq = (ipif->ipif_net_type == IRE_IF_RESOLVER)
1496 			    ? ipif->ipif_rq : ipif->ipif_wq;
1497 			src_addr = (ifrt->ifrt_flags & RTF_SETSRC)
1498 			    ? &ifrt->ifrt_v6src_addr
1499 			    : &ipif->ipif_v6src_addr;
1500 			gateway_addr = NULL;
1501 			resolver_mp = ipif->ipif_resolver_mp;
1502 			type = ipif->ipif_net_type;
1503 		} else {
1504 			rfq = NULL;
1505 			stq = NULL;
1506 			src_addr = (ifrt->ifrt_flags & RTF_SETSRC)
1507 			    ? &ifrt->ifrt_v6src_addr : NULL;
1508 			gateway_addr = &ifrt->ifrt_v6gateway_addr;
1509 			resolver_mp = NULL;
1510 			type = ifrt->ifrt_type;
1511 		}
1512 
1513 		/*
1514 		 * Create a copy of the IRE with the saved address and netmask.
1515 		 */
1516 		ip1dbg(("ipif_recover_ire_v6: creating IRE %s (%d) for %s/%d\n",
1517 		    ip_nv_lookup(ire_nv_tbl, ifrt->ifrt_type), ifrt->ifrt_type,
1518 		    inet_ntop(AF_INET6, &ifrt->ifrt_v6addr, buf, sizeof (buf)),
1519 		    ip_mask_to_plen_v6(&ifrt->ifrt_v6mask)));
1520 		ire = ire_create_v6(
1521 		    &ifrt->ifrt_v6addr,
1522 		    &ifrt->ifrt_v6mask,
1523 		    src_addr,
1524 		    gateway_addr,
1525 		    &ifrt->ifrt_max_frag,
1526 		    NULL,
1527 		    rfq,
1528 		    stq,
1529 		    type,
1530 		    resolver_mp,
1531 		    ipif,
1532 		    NULL,
1533 		    0,
1534 		    0,
1535 		    ifrt->ifrt_flags,
1536 		    &ifrt->ifrt_iulp_info,
1537 		    NULL,
1538 		    NULL);
1539 		if (ire == NULL) {
1540 			mutex_exit(&ipif->ipif_saved_ire_lock);
1541 			kmem_free(ipif_saved_irep,
1542 			    ipif->ipif_saved_ire_cnt * sizeof (ire_t *));
1543 			return (NULL);
1544 		}
1545 
1546 		/*
1547 		 * Some software (for example, GateD and Sun Cluster) attempts
1548 		 * to create (what amount to) IRE_PREFIX routes with the
1549 		 * loopback address as the gateway.  This is primarily done to
1550 		 * set up prefixes with the RTF_REJECT flag set (for example,
1551 		 * when generating aggregate routes.)
1552 		 *
1553 		 * If the IRE type (as defined by ipif->ipif_net_type) is
1554 		 * IRE_LOOPBACK, then we map the request into a
1555 		 * IRE_IF_NORESOLVER.
1556 		 */
1557 		if (ipif->ipif_net_type == IRE_LOOPBACK)
1558 			ire->ire_type = IRE_IF_NORESOLVER;
1559 		/*
1560 		 * ire held by ire_add, will be refreled' in ipif_up_done
1561 		 * towards the end
1562 		 */
1563 		(void) ire_add(&ire, NULL, NULL, NULL);
1564 		*irep = ire;
1565 		irep++;
1566 		ip1dbg(("ipif_recover_ire_v6: added ire %p\n", (void *)ire));
1567 	}
1568 	mutex_exit(&ipif->ipif_saved_ire_lock);
1569 	return (ipif_saved_irep);
1570 }
1571 
1572 /*
1573  * Return the scope of the given IPv6 address.  If the address is an
1574  * IPv4 mapped IPv6 address, return the scope of the corresponding
1575  * IPv4 address.
1576  */
1577 in6addr_scope_t
1578 ip_addr_scope_v6(const in6_addr_t *addr)
1579 {
1580 	static in6_addr_t ipv6loopback = IN6ADDR_LOOPBACK_INIT;
1581 
1582 	if (IN6_IS_ADDR_V4MAPPED(addr)) {
1583 		in_addr_t v4addr_h = ntohl(V4_PART_OF_V6((*addr)));
1584 		if ((v4addr_h >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET ||
1585 		    (v4addr_h & IN_AUTOCONF_MASK) == IN_AUTOCONF_NET)
1586 			return (IP6_SCOPE_LINKLOCAL);
1587 		if ((v4addr_h & IN_PRIVATE8_MASK) == IN_PRIVATE8_NET ||
1588 		    (v4addr_h & IN_PRIVATE12_MASK) == IN_PRIVATE12_NET ||
1589 		    (v4addr_h & IN_PRIVATE16_MASK) == IN_PRIVATE16_NET)
1590 			return (IP6_SCOPE_SITELOCAL);
1591 		return (IP6_SCOPE_GLOBAL);
1592 	}
1593 
1594 	if (IN6_IS_ADDR_MULTICAST(addr))
1595 		return (IN6_ADDR_MC_SCOPE(addr));
1596 
1597 	/* link-local and loopback addresses are of link-local scope */
1598 	if (IN6_IS_ADDR_LINKLOCAL(addr) ||
1599 	    IN6_ARE_ADDR_EQUAL(addr, &ipv6loopback))
1600 		return (IP6_SCOPE_LINKLOCAL);
1601 	if (IN6_IS_ADDR_SITELOCAL(addr))
1602 		return (IP6_SCOPE_SITELOCAL);
1603 	return (IP6_SCOPE_GLOBAL);
1604 }
1605 
1606 
1607 /*
1608  * Calculates the xor of a1 and a2, and stores the result in res.
1609  */
1610 static void
1611 ip_addr_xor_v6(const in6_addr_t *a1, const in6_addr_t *a2, in6_addr_t *res)
1612 {
1613 	int i;
1614 
1615 	for (i = 0; i < 4; i++)
1616 		res->s6_addr32[i] = a1->s6_addr32[i] ^ a2->s6_addr32[i];
1617 }
1618 
1619 #define	IPIF_VALID_IPV6_SOURCE(ipif) \
1620 	(((ipif)->ipif_flags & IPIF_UP) && \
1621 	!((ipif)->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST)))
1622 
1623 /* source address candidate */
1624 typedef struct candidate {
1625 	ipif_t		*cand_ipif;
1626 	/* The properties of this candidate */
1627 	boolean_t	cand_isdst;
1628 	boolean_t	cand_isdst_set;
1629 	in6addr_scope_t	cand_scope;
1630 	boolean_t	cand_scope_set;
1631 	boolean_t	cand_isdeprecated;
1632 	boolean_t	cand_isdeprecated_set;
1633 	boolean_t	cand_ispreferred;
1634 	boolean_t	cand_ispreferred_set;
1635 	boolean_t	cand_matchedinterface;
1636 	boolean_t	cand_matchedinterface_set;
1637 	boolean_t	cand_matchedlabel;
1638 	boolean_t	cand_matchedlabel_set;
1639 	boolean_t	cand_istmp;
1640 	boolean_t	cand_istmp_set;
1641 	in6_addr_t	cand_xor;
1642 	boolean_t	cand_xor_set;
1643 } cand_t;
1644 #define	cand_srcaddr	cand_ipif->ipif_v6lcl_addr
1645 #define	cand_flags	cand_ipif->ipif_flags
1646 #define	cand_ill	cand_ipif->ipif_ill
1647 #define	cand_zoneid	cand_ipif->ipif_zoneid
1648 
1649 /* information about the destination for source address selection */
1650 typedef struct dstinfo {
1651 	const in6_addr_t	*dst_addr;
1652 	ill_t			*dst_ill;
1653 	uint_t			dst_restrict_ill;
1654 	boolean_t		dst_prefer_src_tmp;
1655 	in6addr_scope_t		dst_scope;
1656 	char			*dst_label;
1657 } dstinfo_t;
1658 
1659 /*
1660  * The following functions are rules used to select a source address in
1661  * ipif_select_source_v6().  Each rule compares a current candidate (cc)
1662  * against the best candidate (bc).  Each rule has three possible outcomes;
1663  * the candidate is preferred over the best candidate (CAND_PREFER), the
1664  * candidate is not preferred over the best candidate (CAND_AVOID), or the
1665  * candidate is of equal value as the best candidate (CAND_TIE).
1666  *
1667  * These rules are part of a greater "Default Address Selection for IPv6"
1668  * sheme, which is standards based work coming out of the IETF ipv6 working
1669  * group.  The IETF document defines both IPv6 source address selection and
1670  * destination address ordering.  The rules defined here implement the IPv6
1671  * source address selection.  Destination address ordering is done by
1672  * libnsl, and uses a similar set of rules to implement the sorting.
1673  */
1674 typedef enum {CAND_AVOID, CAND_TIE, CAND_PREFER} rule_res_t;
1675 typedef	rule_res_t (*rulef_t)(cand_t *, cand_t *, const dstinfo_t *);
1676 
1677 /* Prefer an address if it is equal to the destination address. */
1678 static rule_res_t
1679 rule_isdst(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo)
1680 {
1681 	if (!bc->cand_isdst_set) {
1682 		bc->cand_isdst =
1683 		    IN6_ARE_ADDR_EQUAL(&bc->cand_srcaddr, dstinfo->dst_addr);
1684 		bc->cand_isdst_set = B_TRUE;
1685 	}
1686 
1687 	cc->cand_isdst =
1688 	    IN6_ARE_ADDR_EQUAL(&cc->cand_srcaddr, dstinfo->dst_addr);
1689 	cc->cand_isdst_set = B_TRUE;
1690 
1691 	if (cc->cand_isdst == bc->cand_isdst)
1692 		return (CAND_TIE);
1693 	else if (cc->cand_isdst)
1694 		return (CAND_PREFER);
1695 	else
1696 		return (CAND_AVOID);
1697 }
1698 
1699 /*
1700  * Prefer addresses that are of closest scope to the destination.  Always
1701  * prefer addresses that are of greater scope than the destination over
1702  * those that are of lesser scope than the destination.
1703  */
1704 static rule_res_t
1705 rule_scope(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo)
1706 {
1707 	if (!bc->cand_scope_set) {
1708 		bc->cand_scope = ip_addr_scope_v6(&bc->cand_srcaddr);
1709 		bc->cand_scope_set = B_TRUE;
1710 	}
1711 
1712 	cc->cand_scope = ip_addr_scope_v6(&cc->cand_srcaddr);
1713 	cc->cand_scope_set = B_TRUE;
1714 
1715 	if (cc->cand_scope < bc->cand_scope) {
1716 		if (cc->cand_scope < dstinfo->dst_scope)
1717 			return (CAND_AVOID);
1718 		else
1719 			return (CAND_PREFER);
1720 	} else if (bc->cand_scope < cc->cand_scope) {
1721 		if (bc->cand_scope < dstinfo->dst_scope)
1722 			return (CAND_PREFER);
1723 		else
1724 			return (CAND_AVOID);
1725 	} else {
1726 		return (CAND_TIE);
1727 	}
1728 }
1729 
1730 /*
1731  * Prefer non-deprecated source addresses.
1732  */
1733 /* ARGSUSED2 */
1734 static rule_res_t
1735 rule_deprecated(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo)
1736 {
1737 	if (!bc->cand_isdeprecated_set) {
1738 		bc->cand_isdeprecated =
1739 		    ((bc->cand_flags & IPIF_DEPRECATED) != 0);
1740 		bc->cand_isdeprecated_set = B_TRUE;
1741 	}
1742 
1743 	cc->cand_isdeprecated = ((cc->cand_flags & IPIF_DEPRECATED) != 0);
1744 	cc->cand_isdeprecated_set = B_TRUE;
1745 
1746 	if (bc->cand_isdeprecated == cc->cand_isdeprecated)
1747 		return (CAND_TIE);
1748 	else if (cc->cand_isdeprecated)
1749 		return (CAND_AVOID);
1750 	else
1751 		return (CAND_PREFER);
1752 }
1753 
1754 /*
1755  * Prefer source addresses that have the IPIF_PREFERRED flag set.  This
1756  * rule must be before rule_interface because the flag could be set on any
1757  * interface, not just the interface being used for outgoing packets (for
1758  * example, the IFF_PREFERRED could be set on an address assigned to the
1759  * loopback interface).
1760  */
1761 /* ARGSUSED2 */
1762 static rule_res_t
1763 rule_preferred(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo)
1764 {
1765 	if (!bc->cand_ispreferred_set) {
1766 		bc->cand_ispreferred = ((bc->cand_flags & IPIF_PREFERRED) != 0);
1767 		bc->cand_ispreferred_set = B_TRUE;
1768 	}
1769 
1770 	cc->cand_ispreferred = ((cc->cand_flags & IPIF_PREFERRED) != 0);
1771 	cc->cand_ispreferred_set = B_TRUE;
1772 
1773 	if (bc->cand_ispreferred == cc->cand_ispreferred)
1774 		return (CAND_TIE);
1775 	else if (cc->cand_ispreferred)
1776 		return (CAND_PREFER);
1777 	else
1778 		return (CAND_AVOID);
1779 }
1780 
1781 /*
1782  * Prefer source addresses that are assigned to the outgoing interface, or
1783  * to an interface that is in the same IPMP group as the outgoing
1784  * interface.
1785  */
1786 static rule_res_t
1787 rule_interface(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo)
1788 {
1789 	ill_t *dstill = dstinfo->dst_ill;
1790 
1791 	/*
1792 	 * If dstinfo->dst_restrict_ill is set, this rule is unnecessary
1793 	 * since we know all candidates will be on the same link.
1794 	 */
1795 	if (dstinfo->dst_restrict_ill)
1796 		return (CAND_TIE);
1797 
1798 	if (!bc->cand_matchedinterface_set) {
1799 		bc->cand_matchedinterface = (bc->cand_ill == dstill ||
1800 		    (dstill->ill_group != NULL &&
1801 		    dstill->ill_group == bc->cand_ill->ill_group));
1802 		bc->cand_matchedinterface_set = B_TRUE;
1803 	}
1804 
1805 	cc->cand_matchedinterface = (cc->cand_ill == dstill ||
1806 	    (dstill->ill_group != NULL &&
1807 		dstill->ill_group == cc->cand_ill->ill_group));
1808 	cc->cand_matchedinterface_set = B_TRUE;
1809 
1810 	if (bc->cand_matchedinterface == cc->cand_matchedinterface)
1811 		return (CAND_TIE);
1812 	else if (cc->cand_matchedinterface)
1813 		return (CAND_PREFER);
1814 	else
1815 		return (CAND_AVOID);
1816 }
1817 
1818 /*
1819  * Prefer source addresses whose label matches the destination's label.
1820  */
1821 static rule_res_t
1822 rule_label(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo)
1823 {
1824 	char *label;
1825 
1826 	if (!bc->cand_matchedlabel_set) {
1827 		label = ip6_asp_lookup(&bc->cand_srcaddr, NULL);
1828 		bc->cand_matchedlabel =
1829 		    ip6_asp_labelcmp(label, dstinfo->dst_label);
1830 		bc->cand_matchedlabel_set = B_TRUE;
1831 	}
1832 
1833 	label = ip6_asp_lookup(&cc->cand_srcaddr, NULL);
1834 	cc->cand_matchedlabel = ip6_asp_labelcmp(label, dstinfo->dst_label);
1835 	cc->cand_matchedlabel_set = B_TRUE;
1836 
1837 	if (bc->cand_matchedlabel == cc->cand_matchedlabel)
1838 		return (CAND_TIE);
1839 	else if (cc->cand_matchedlabel)
1840 		return (CAND_PREFER);
1841 	else
1842 		return (CAND_AVOID);
1843 }
1844 
1845 /*
1846  * Prefer public addresses over temporary ones.  An application can reverse
1847  * the logic of this rule and prefer temporary addresses by using the
1848  * IPV6_SRC_PREFERENCES socket option.
1849  */
1850 static rule_res_t
1851 rule_temporary(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo)
1852 {
1853 	if (!bc->cand_istmp_set) {
1854 		bc->cand_istmp = ((bc->cand_flags & IPIF_TEMPORARY) != 0);
1855 		bc->cand_istmp_set = B_TRUE;
1856 	}
1857 
1858 	cc->cand_istmp = ((cc->cand_flags & IPIF_TEMPORARY) != 0);
1859 	cc->cand_istmp_set = B_TRUE;
1860 
1861 	if (bc->cand_istmp == cc->cand_istmp)
1862 		return (CAND_TIE);
1863 
1864 	if (dstinfo->dst_prefer_src_tmp && cc->cand_istmp)
1865 		return (CAND_PREFER);
1866 	else if (!dstinfo->dst_prefer_src_tmp && !cc->cand_istmp)
1867 		return (CAND_PREFER);
1868 	else
1869 		return (CAND_AVOID);
1870 }
1871 
1872 /*
1873  * Prefer source addresses with longer matching prefix with the
1874  * destination.  Since this is the last rule, it must not produce a tie.
1875  * We do the longest matching prefix calculation and the tie break in one
1876  * calculation by doing an xor of both addresses with the destination, and
1877  * pick the address with the smallest xor value.  That way, we're both
1878  * picking the address with the longest matching prefix, and breaking the
1879  * tie if they happen to have both have equal mathing prefixes.
1880  */
1881 static rule_res_t
1882 rule_prefix(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo)
1883 {
1884 	int i;
1885 
1886 	if (!bc->cand_xor_set) {
1887 		ip_addr_xor_v6(&bc->cand_srcaddr,
1888 		    dstinfo->dst_addr, &bc->cand_xor);
1889 		bc->cand_xor_set = B_TRUE;
1890 	}
1891 
1892 	ip_addr_xor_v6(&cc->cand_srcaddr, dstinfo->dst_addr, &cc->cand_xor);
1893 	cc->cand_xor_set = B_TRUE;
1894 
1895 	for (i = 0; i < 4; i++) {
1896 		if (bc->cand_xor.s6_addr32[i] != cc->cand_xor.s6_addr32[i])
1897 			break;
1898 	}
1899 
1900 	if (cc->cand_xor.s6_addr32[i] < bc->cand_xor.s6_addr32[i])
1901 		return (CAND_PREFER);
1902 	else
1903 		return (CAND_AVOID);
1904 }
1905 
1906 /*
1907  * Prefer to use zone-specific addresses when possible instead of all-zones
1908  * addresses.
1909  */
1910 /* ARGSUSED2 */
1911 static rule_res_t
1912 rule_zone_specific(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo)
1913 {
1914 	if ((bc->cand_zoneid == ALL_ZONES) ==
1915 	    (cc->cand_zoneid == ALL_ZONES))
1916 		return (CAND_TIE);
1917 	else if (cc->cand_zoneid == ALL_ZONES)
1918 		return (CAND_AVOID);
1919 	else
1920 		return (CAND_PREFER);
1921 }
1922 
1923 /*
1924  * Determine the best source address given a destination address and a
1925  * destination ill.  If no suitable source address is found, it returns
1926  * NULL. If there is a usable address pointed to by the usesrc
1927  * (i.e ill_usesrc_ifindex != 0) then return that first since it is more
1928  * fine grained (i.e per interface)
1929  *
1930  * This implementation is based on the "Default Address Selection for IPv6"
1931  * specification produced by the IETF IPv6 working group.  It has been
1932  * implemented so that the list of addresses is only traversed once (the
1933  * specification's algorithm could traverse the list of addresses once for
1934  * every rule).
1935  *
1936  * The restrict_ill argument restricts the algorithm to chose a source
1937  * address that is assigned to the destination ill or an ill in the same
1938  * IPMP group as the destination ill.  This is used when the destination
1939  * address is a link-local or multicast address, and when
1940  * ipv6_strict_dst_multihoming is turned on.
1941  *
1942  * src_prefs is the caller's set of source address preferences.  If source
1943  * address selection is being called to determine the source address of a
1944  * connected socket (from ip_bind_connected_v6()), then the preferences are
1945  * taken from conn_src_preferences.  These preferences can be set on a
1946  * per-socket basis using the IPV6_SRC_PREFERENCES socket option.  The only
1947  * preference currently implemented is for rfc3041 temporary addresses.
1948  */
1949 ipif_t *
1950 ipif_select_source_v6(ill_t *dstill, const in6_addr_t *dst,
1951     uint_t restrict_ill, uint32_t src_prefs, zoneid_t zoneid)
1952 {
1953 	dstinfo_t	dstinfo;
1954 	char		dstr[INET6_ADDRSTRLEN];
1955 	char		sstr[INET6_ADDRSTRLEN];
1956 	ipif_t		*ipif;
1957 	ill_t		*ill, *usesrc_ill = NULL;
1958 	ill_walk_context_t	ctx;
1959 	cand_t		best_c;	/* The best candidate */
1960 	cand_t		curr_c;	/* The current candidate */
1961 	uint_t		index;
1962 	boolean_t	first_candidate = B_TRUE;
1963 	rule_res_t	rule_result;
1964 	tsol_tpc_t	*src_rhtp, *dst_rhtp;
1965 
1966 	/*
1967 	 * The list of ordering rules.  They are applied in the order they
1968 	 * appear in the list.
1969 	 *
1970 	 * XXX rule_mipv6 will need to be implemented (the specification's
1971 	 * rules 4) if a mobile IPv6 node is ever implemented.
1972 	 */
1973 	rulef_t	rules[] = {
1974 		rule_isdst,
1975 		rule_scope,
1976 		rule_deprecated,
1977 		rule_preferred,
1978 		rule_interface,
1979 		rule_label,
1980 		rule_temporary,
1981 		rule_prefix,
1982 		rule_zone_specific,
1983 		NULL
1984 	};
1985 
1986 	ASSERT(dstill->ill_isv6);
1987 	ASSERT(!IN6_IS_ADDR_V4MAPPED(dst));
1988 
1989 	/*
1990 	 * Check if there is a usable src address pointed to by the
1991 	 * usesrc ifindex. This has higher precedence since it is
1992 	 * finer grained (i.e per interface) v/s being system wide.
1993 	 */
1994 	if (dstill->ill_usesrc_ifindex != 0) {
1995 		if ((usesrc_ill =
1996 		    ill_lookup_on_ifindex(dstill->ill_usesrc_ifindex, B_TRUE,
1997 		    NULL, NULL, NULL, NULL)) != NULL) {
1998 			dstinfo.dst_ill = usesrc_ill;
1999 		} else {
2000 			return (NULL);
2001 		}
2002 	} else {
2003 		dstinfo.dst_ill = dstill;
2004 	}
2005 
2006 	/*
2007 	 * If we're dealing with an unlabeled destination on a labeled system,
2008 	 * make sure that we ignore source addresses that are incompatible with
2009 	 * the destination's default label.  That destination's default label
2010 	 * must dominate the minimum label on the source address.
2011 	 *
2012 	 * (Note that this has to do with Trusted Solaris.  It's not related to
2013 	 * the labels described by ip6_asp_lookup.)
2014 	 */
2015 	dst_rhtp = NULL;
2016 	if (is_system_labeled()) {
2017 		dst_rhtp = find_tpc(dst, IPV6_VERSION, B_FALSE);
2018 		if (dst_rhtp == NULL)
2019 			return (NULL);
2020 		if (dst_rhtp->tpc_tp.host_type != UNLABELED) {
2021 			TPC_RELE(dst_rhtp);
2022 			dst_rhtp = NULL;
2023 		}
2024 	}
2025 
2026 	dstinfo.dst_addr = dst;
2027 	dstinfo.dst_scope = ip_addr_scope_v6(dst);
2028 	dstinfo.dst_label = ip6_asp_lookup(dst, NULL);
2029 	dstinfo.dst_prefer_src_tmp = ((src_prefs & IPV6_PREFER_SRC_TMP) != 0);
2030 
2031 	rw_enter(&ill_g_lock, RW_READER);
2032 	/*
2033 	 * Section three of the I-D states that for multicast and
2034 	 * link-local destinations, the candidate set must be restricted to
2035 	 * an interface that is on the same link as the outgoing interface.
2036 	 * Also, when ipv6_strict_dst_multihoming is turned on, always
2037 	 * restrict the source address to the destination link as doing
2038 	 * otherwise will almost certainly cause problems.
2039 	 */
2040 	if (IN6_IS_ADDR_LINKLOCAL(dst) || IN6_IS_ADDR_MULTICAST(dst) ||
2041 	    ipv6_strict_dst_multihoming || usesrc_ill != NULL) {
2042 		if (restrict_ill == RESTRICT_TO_NONE)
2043 			dstinfo.dst_restrict_ill = RESTRICT_TO_GROUP;
2044 		else
2045 			dstinfo.dst_restrict_ill = restrict_ill;
2046 	} else {
2047 		dstinfo.dst_restrict_ill = restrict_ill;
2048 	}
2049 
2050 	bzero(&best_c, sizeof (cand_t));
2051 
2052 	/*
2053 	 * Take a pass through the list of IPv6 interfaces to chose the
2054 	 * best possible source address.  If restrict_ill is true, we only
2055 	 * iterate through the ill's that are in the same IPMP group as the
2056 	 * destination's outgoing ill.  If restrict_ill is false, we walk
2057 	 * the entire list of IPv6 ill's.
2058 	 */
2059 	if (dstinfo.dst_restrict_ill != RESTRICT_TO_NONE) {
2060 		if (dstinfo.dst_ill->ill_group != NULL &&
2061 		    dstinfo.dst_restrict_ill == RESTRICT_TO_GROUP) {
2062 			ill = dstinfo.dst_ill->ill_group->illgrp_ill;
2063 		} else {
2064 			ill = dstinfo.dst_ill;
2065 		}
2066 	} else {
2067 		ill = ILL_START_WALK_V6(&ctx);
2068 	}
2069 
2070 	while (ill != NULL) {
2071 		ASSERT(ill->ill_isv6);
2072 
2073 		/*
2074 		 * Avoid FAILED/OFFLINE ills.
2075 		 * Global and site local addresses will failover and
2076 		 * will be available on the new ill.
2077 		 * But link local addresses don't move.
2078 		 */
2079 		if (ill->ill_phyint->phyint_flags &
2080 		    (PHYI_OFFLINE | PHYI_FAILED))
2081 			goto next_ill;
2082 
2083 		for (ipif = ill->ill_ipif; ipif != NULL;
2084 		    ipif = ipif->ipif_next) {
2085 
2086 			if (!IPIF_VALID_IPV6_SOURCE(ipif))
2087 				continue;
2088 
2089 			if (zoneid != ALL_ZONES &&
2090 			    ipif->ipif_zoneid != zoneid &&
2091 			    ipif->ipif_zoneid != ALL_ZONES)
2092 				continue;
2093 
2094 			/*
2095 			 * Check compatibility of local address for
2096 			 * destination's default label if we're on a labeled
2097 			 * system.  Incompatible addresses can't be used at
2098 			 * all and must be skipped over.
2099 			 */
2100 			if (dst_rhtp != NULL) {
2101 				boolean_t incompat;
2102 
2103 				src_rhtp = find_tpc(&ipif->ipif_v6lcl_addr,
2104 				    IPV6_VERSION, B_FALSE);
2105 				if (src_rhtp == NULL)
2106 					continue;
2107 				incompat =
2108 				    src_rhtp->tpc_tp.host_type != SUN_CIPSO ||
2109 				    src_rhtp->tpc_tp.tp_doi !=
2110 				    dst_rhtp->tpc_tp.tp_doi ||
2111 				    (!_blinrange(&dst_rhtp->tpc_tp.tp_def_label,
2112 				    &src_rhtp->tpc_tp.tp_sl_range_cipso) &&
2113 				    !blinlset(&dst_rhtp->tpc_tp.tp_def_label,
2114 				    src_rhtp->tpc_tp.tp_sl_set_cipso));
2115 				TPC_RELE(src_rhtp);
2116 				if (incompat)
2117 					continue;
2118 			}
2119 
2120 			if (first_candidate) {
2121 				/*
2122 				 * This is first valid address in the list.
2123 				 * It is automatically the best candidate
2124 				 * so far.
2125 				 */
2126 				best_c.cand_ipif = ipif;
2127 				first_candidate = B_FALSE;
2128 				continue;
2129 			}
2130 
2131 			bzero(&curr_c, sizeof (cand_t));
2132 			curr_c.cand_ipif = ipif;
2133 
2134 			/*
2135 			 * Compare this current candidate (curr_c) with the
2136 			 * best candidate (best_c) by applying the
2137 			 * comparison rules in order until one breaks the
2138 			 * tie.
2139 			 */
2140 			for (index = 0; rules[index] != NULL; index++) {
2141 				/* Apply a comparison rule. */
2142 				rule_result =
2143 				    (rules[index])(&best_c, &curr_c, &dstinfo);
2144 				if (rule_result == CAND_AVOID) {
2145 					/*
2146 					 * The best candidate is still the
2147 					 * best candidate.  Forget about
2148 					 * this current candidate and go on
2149 					 * to the next one.
2150 					 */
2151 					break;
2152 				} else if (rule_result == CAND_PREFER) {
2153 					/*
2154 					 * This candidate is prefered.  It
2155 					 * becomes the best candidate so
2156 					 * far.  Go on to the next address.
2157 					 */
2158 					best_c = curr_c;
2159 					break;
2160 				}
2161 				/* We have a tie, apply the next rule. */
2162 			}
2163 
2164 			/*
2165 			 * The last rule must be a tie breaker rule and
2166 			 * must never produce a tie.  At this point, the
2167 			 * candidate should have either been rejected, or
2168 			 * have been prefered as the best candidate so far.
2169 			 */
2170 			ASSERT(rule_result != CAND_TIE);
2171 		}
2172 
2173 		/*
2174 		 * We may be walking the linked-list of ill's in an
2175 		 * IPMP group or traversing the IPv6 ill avl tree. If it is a
2176 		 * usesrc ILL then it can't be part of IPMP group and we
2177 		 * will exit the while loop.
2178 		 */
2179 next_ill:
2180 		if (dstinfo.dst_restrict_ill == RESTRICT_TO_ILL)
2181 			ill = NULL;
2182 		else if (dstinfo.dst_restrict_ill == RESTRICT_TO_GROUP)
2183 			ill = ill->ill_group_next;
2184 		else
2185 			ill = ill_next(&ctx, ill);
2186 	}
2187 
2188 	ipif = best_c.cand_ipif;
2189 	ip1dbg(("ipif_select_source_v6(%s, %s) -> %s\n",
2190 	    dstinfo.dst_ill->ill_name,
2191 	    inet_ntop(AF_INET6, dstinfo.dst_addr, dstr, sizeof (dstr)),
2192 	    (ipif == NULL ? "NULL" :
2193 	    inet_ntop(AF_INET6, &ipif->ipif_v6lcl_addr, sstr, sizeof (sstr)))));
2194 
2195 	if (usesrc_ill != NULL)
2196 		ill_refrele(usesrc_ill);
2197 
2198 	if (dst_rhtp != NULL)
2199 		TPC_RELE(dst_rhtp);
2200 
2201 	if (ipif == NULL) {
2202 		rw_exit(&ill_g_lock);
2203 		return (NULL);
2204 	}
2205 
2206 	mutex_enter(&ipif->ipif_ill->ill_lock);
2207 	if (IPIF_CAN_LOOKUP(ipif)) {
2208 		ipif_refhold_locked(ipif);
2209 		mutex_exit(&ipif->ipif_ill->ill_lock);
2210 		rw_exit(&ill_g_lock);
2211 		return (ipif);
2212 	}
2213 	mutex_exit(&ipif->ipif_ill->ill_lock);
2214 	rw_exit(&ill_g_lock);
2215 	ip1dbg(("ipif_select_source_v6 cannot lookup ipif %p"
2216 	    " returning null \n", (void *)ipif));
2217 
2218 	return (NULL);
2219 }
2220 
2221 /*
2222  * If old_ipif is not NULL, see if ipif was derived from old
2223  * ipif and if so, recreate the interface route by re-doing
2224  * source address selection. This happens when ipif_down ->
2225  * ipif_update_other_ipifs calls us.
2226  *
2227  * If old_ipif is NULL, just redo the source address selection
2228  * if needed. This happens when illgrp_insert or ipif_up_done_v6
2229  * calls us.
2230  */
2231 void
2232 ipif_recreate_interface_routes_v6(ipif_t *old_ipif, ipif_t *ipif)
2233 {
2234 	ire_t *ire;
2235 	ire_t *ipif_ire;
2236 	queue_t *stq;
2237 	ill_t *ill;
2238 	ipif_t *nipif = NULL;
2239 	boolean_t nipif_refheld = B_FALSE;
2240 	boolean_t ip6_asp_table_held = B_FALSE;
2241 
2242 	ill = ipif->ipif_ill;
2243 
2244 	if (!(ipif->ipif_flags &
2245 	    (IPIF_NOLOCAL|IPIF_ANYCAST|IPIF_DEPRECATED))) {
2246 		/*
2247 		 * Can't possibly have borrowed the source
2248 		 * from old_ipif.
2249 		 */
2250 		return;
2251 	}
2252 
2253 	/*
2254 	 * Is there any work to be done? No work if the address
2255 	 * is INADDR_ANY, loopback or NOLOCAL or ANYCAST (
2256 	 * ipif_select_source_v6() does not borrow addresses from
2257 	 * NOLOCAL and ANYCAST interfaces).
2258 	 */
2259 	if ((old_ipif != NULL) &&
2260 	    ((IN6_IS_ADDR_UNSPECIFIED(&old_ipif->ipif_v6lcl_addr)) ||
2261 	    (old_ipif->ipif_ill->ill_wq == NULL) ||
2262 	    (old_ipif->ipif_flags &
2263 	    (IPIF_NOLOCAL|IPIF_ANYCAST)))) {
2264 		return;
2265 	}
2266 
2267 	/*
2268 	 * Perform the same checks as when creating the
2269 	 * IRE_INTERFACE in ipif_up_done_v6.
2270 	 */
2271 	if (!(ipif->ipif_flags & IPIF_UP))
2272 		return;
2273 
2274 	if ((ipif->ipif_flags & IPIF_NOXMIT))
2275 		return;
2276 
2277 	if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet) &&
2278 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6net_mask))
2279 		return;
2280 
2281 	/*
2282 	 * We know that ipif uses some other source for its
2283 	 * IRE_INTERFACE. Is it using the source of this
2284 	 * old_ipif?
2285 	 */
2286 	ipif_ire = ipif_to_ire_v6(ipif);
2287 	if (ipif_ire == NULL)
2288 		return;
2289 
2290 	if (old_ipif != NULL &&
2291 	    !IN6_ARE_ADDR_EQUAL(&old_ipif->ipif_v6lcl_addr,
2292 	    &ipif_ire->ire_src_addr_v6)) {
2293 		ire_refrele(ipif_ire);
2294 		return;
2295 	}
2296 
2297 	if (ip_debug > 2) {
2298 		/* ip1dbg */
2299 		pr_addr_dbg("ipif_recreate_interface_routes_v6: deleting IRE"
2300 		    " for src %s\n", AF_INET6, &ipif_ire->ire_src_addr_v6);
2301 	}
2302 
2303 	stq = ipif_ire->ire_stq;
2304 
2305 	/*
2306 	 * Can't use our source address. Select a different source address
2307 	 * for the IRE_INTERFACE.  We restrict interface route source
2308 	 * address selection to ipif's assigned to the same link as the
2309 	 * interface.
2310 	 */
2311 	if (ip6_asp_can_lookup()) {
2312 		ip6_asp_table_held = B_TRUE;
2313 		nipif = ipif_select_source_v6(ill, &ipif->ipif_v6subnet,
2314 		    RESTRICT_TO_GROUP, IPV6_PREFER_SRC_DEFAULT,
2315 		    ipif->ipif_zoneid);
2316 	}
2317 	if (nipif == NULL) {
2318 		/* Last resort - all ipif's have IPIF_NOLOCAL */
2319 		nipif = ipif;
2320 	} else {
2321 		nipif_refheld = B_TRUE;
2322 	}
2323 
2324 	ire = ire_create_v6(
2325 	    &ipif->ipif_v6subnet,	/* dest pref */
2326 	    &ipif->ipif_v6net_mask,	/* mask */
2327 	    &nipif->ipif_v6src_addr,	/* src addr */
2328 	    NULL,			/* no gateway */
2329 	    &ipif->ipif_mtu,		/* max frag */
2330 	    NULL,			/* no Fast path header */
2331 	    NULL,			/* no recv from queue */
2332 	    stq,			/* send-to queue */
2333 	    ill->ill_net_type,		/* IF_[NO]RESOLVER */
2334 	    ill->ill_resolver_mp,	/* xmit header */
2335 	    ipif,
2336 	    NULL,
2337 	    0,
2338 	    0,
2339 	    0,
2340 	    &ire_uinfo_null,
2341 	    NULL,
2342 	    NULL);
2343 
2344 	if (ire != NULL) {
2345 		ire_t *ret_ire;
2346 		int   error;
2347 
2348 		/*
2349 		 * We don't need ipif_ire anymore. We need to delete
2350 		 * before we add so that ire_add does not detect
2351 		 * duplicates.
2352 		 */
2353 		ire_delete(ipif_ire);
2354 		ret_ire = ire;
2355 		error = ire_add(&ret_ire, NULL, NULL, NULL);
2356 		ASSERT(error == 0);
2357 		ASSERT(ret_ire == ire);
2358 		if (ret_ire != NULL) {
2359 			/* Held in ire_add */
2360 			ire_refrele(ret_ire);
2361 		}
2362 	}
2363 	/*
2364 	 * Either we are falling through from above or could not
2365 	 * allocate a replacement.
2366 	 */
2367 	ire_refrele(ipif_ire);
2368 	if (ip6_asp_table_held)
2369 		ip6_asp_table_refrele();
2370 	if (nipif_refheld)
2371 		ipif_refrele(nipif);
2372 }
2373 
2374 /*
2375  * This old_ipif is going away.
2376  *
2377  * Determine if any other ipif's are using our address as
2378  * ipif_v6lcl_addr (due to those being IPIF_NOLOCAL, IPIF_ANYCAST, or
2379  * IPIF_DEPRECATED).
2380  * Find the IRE_INTERFACE for such ipif's and recreate them
2381  * to use an different source address following the rules in
2382  * ipif_up_done_v6.
2383  *
2384  * This function takes an illgrp as an argument so that illgrp_delete
2385  * can call this to update source address even after deleting the
2386  * old_ipif->ipif_ill from the ill group.
2387  */
2388 void
2389 ipif_update_other_ipifs_v6(ipif_t *old_ipif, ill_group_t *illgrp)
2390 {
2391 	ipif_t	*ipif;
2392 	ill_t	*ill;
2393 	char	buf[INET6_ADDRSTRLEN];
2394 
2395 	ASSERT(IAM_WRITER_IPIF(old_ipif));
2396 
2397 	ill = old_ipif->ipif_ill;
2398 
2399 	ip1dbg(("ipif_update_other_ipifs_v6(%s, %s)\n",
2400 	    ill->ill_name,
2401 	    inet_ntop(AF_INET6, &old_ipif->ipif_v6lcl_addr,
2402 	    buf, sizeof (buf))));
2403 
2404 	/*
2405 	 * If this part of a group, look at all ills as ipif_select_source
2406 	 * borrows a source address across all the ills in the group.
2407 	 */
2408 	if (illgrp != NULL)
2409 		ill = illgrp->illgrp_ill;
2410 
2411 	/* Don't need a lock since this is a writer */
2412 	for (; ill != NULL; ill = ill->ill_group_next) {
2413 		for (ipif = ill->ill_ipif; ipif != NULL;
2414 		    ipif = ipif->ipif_next) {
2415 
2416 			if (ipif == old_ipif)
2417 				continue;
2418 
2419 			ipif_recreate_interface_routes_v6(old_ipif, ipif);
2420 		}
2421 	}
2422 }
2423 
2424 /*
2425  * Perform an attach and bind to get phys addr plus info_req for
2426  * the physical device.
2427  * q and mp represents an ioctl which will be queued waiting for
2428  * completion of the DLPI message exchange.
2429  * MUST be called on an ill queue. Can not set conn_pending_ill for that
2430  * reason thus the DL_PHYS_ADDR_ACK code does not assume ill_pending_q.
2431  *
2432  * Returns EINPROGRESS when mp has been consumed by queueing it on
2433  * ill_pending_mp and the ioctl will complete in ip_rput.
2434  */
2435 int
2436 ill_dl_phys(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q)
2437 {
2438 	mblk_t	*v6token_mp = NULL;
2439 	mblk_t	*v6lla_mp = NULL;
2440 	mblk_t	*phys_mp = NULL;
2441 	mblk_t	*info_mp = NULL;
2442 	mblk_t	*attach_mp = NULL;
2443 	mblk_t	*detach_mp = NULL;
2444 	mblk_t	*bind_mp = NULL;
2445 	mblk_t	*unbind_mp = NULL;
2446 	mblk_t	*notify_mp = NULL;
2447 
2448 	ip1dbg(("ill_dl_phys(%s:%u)\n", ill->ill_name, ipif->ipif_id));
2449 	ASSERT(ill->ill_dlpi_style_set);
2450 	ASSERT(WR(q)->q_next != NULL);
2451 
2452 	if (ill->ill_isv6) {
2453 		v6token_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) +
2454 		    sizeof (t_scalar_t), DL_PHYS_ADDR_REQ);
2455 		if (v6token_mp == NULL)
2456 			goto bad;
2457 		((dl_phys_addr_req_t *)v6token_mp->b_rptr)->dl_addr_type =
2458 		    DL_IPV6_TOKEN;
2459 
2460 		v6lla_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) +
2461 		    sizeof (t_scalar_t), DL_PHYS_ADDR_REQ);
2462 		if (v6lla_mp == NULL)
2463 			goto bad;
2464 		((dl_phys_addr_req_t *)v6lla_mp->b_rptr)->dl_addr_type =
2465 		    DL_IPV6_LINK_LAYER_ADDR;
2466 	}
2467 
2468 	/*
2469 	 * Allocate a DL_NOTIFY_REQ and set the notifications we want.
2470 	 */
2471 	notify_mp = ip_dlpi_alloc(sizeof (dl_notify_req_t) + sizeof (long),
2472 	    DL_NOTIFY_REQ);
2473 	if (notify_mp == NULL)
2474 		goto bad;
2475 	((dl_notify_req_t *)notify_mp->b_rptr)->dl_notifications =
2476 	    (DL_NOTE_PHYS_ADDR | DL_NOTE_SDU_SIZE | DL_NOTE_FASTPATH_FLUSH |
2477 	    DL_NOTE_LINK_UP | DL_NOTE_LINK_DOWN | DL_NOTE_CAPAB_RENEG);
2478 
2479 	phys_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) +
2480 	    sizeof (t_scalar_t), DL_PHYS_ADDR_REQ);
2481 	if (phys_mp == NULL)
2482 		goto bad;
2483 	((dl_phys_addr_req_t *)phys_mp->b_rptr)->dl_addr_type =
2484 	    DL_CURR_PHYS_ADDR;
2485 
2486 	info_mp = ip_dlpi_alloc(
2487 	    sizeof (dl_info_req_t) + sizeof (dl_info_ack_t),
2488 	    DL_INFO_REQ);
2489 	if (info_mp == NULL)
2490 		goto bad;
2491 
2492 	bind_mp = ip_dlpi_alloc(sizeof (dl_bind_req_t) + sizeof (long),
2493 	    DL_BIND_REQ);
2494 	if (bind_mp == NULL)
2495 		goto bad;
2496 	((dl_bind_req_t *)bind_mp->b_rptr)->dl_sap = ill->ill_sap;
2497 	((dl_bind_req_t *)bind_mp->b_rptr)->dl_service_mode = DL_CLDLS;
2498 
2499 	unbind_mp = ip_dlpi_alloc(sizeof (dl_unbind_req_t), DL_UNBIND_REQ);
2500 	if (unbind_mp == NULL)
2501 		goto bad;
2502 
2503 	/* If we need to attach/detach, pre-alloc and initialize the mblks */
2504 	if (ill->ill_needs_attach) {
2505 		attach_mp = ip_dlpi_alloc(sizeof (dl_attach_req_t),
2506 		    DL_ATTACH_REQ);
2507 		if (attach_mp == NULL)
2508 			goto bad;
2509 		((dl_attach_req_t *)attach_mp->b_rptr)->dl_ppa = ill->ill_ppa;
2510 
2511 		detach_mp = ip_dlpi_alloc(sizeof (dl_detach_req_t),
2512 		    DL_DETACH_REQ);
2513 		if (detach_mp == NULL)
2514 			goto bad;
2515 	}
2516 
2517 	/*
2518 	 * Here we are going to delay the ioctl ack until after
2519 	 * ACKs from DL_PHYS_ADDR_REQ. So need to save the
2520 	 * original ioctl message before sending the requests
2521 	 */
2522 	mutex_enter(&ill->ill_lock);
2523 	/* ipsq_pending_mp_add won't fail since we pass in a NULL connp */
2524 	(void) ipsq_pending_mp_add(NULL, ipif, ill->ill_wq, mp, 0);
2525 	/*
2526 	 * Set ill_phys_addr_pend to zero. It will be set to the addr_type of
2527 	 * the DL_PHYS_ADDR_REQ in ill_dlpi_send() and ill_dlpi_done(). It will
2528 	 * be used to track which DL_PHYS_ADDR_REQ is being ACK'd/NAK'd.
2529 	 */
2530 	ill->ill_phys_addr_pend = 0;
2531 	mutex_exit(&ill->ill_lock);
2532 
2533 	if (attach_mp != NULL) {
2534 		ip1dbg(("ill_dl_phys: attach\n"));
2535 		ill_dlpi_send(ill, attach_mp);
2536 	}
2537 	ill_dlpi_send(ill, bind_mp);
2538 	ill_dlpi_send(ill, info_mp);
2539 	if (ill->ill_isv6) {
2540 		ill_dlpi_send(ill, v6token_mp);
2541 		ill_dlpi_send(ill, v6lla_mp);
2542 	}
2543 	ill_dlpi_send(ill, phys_mp);
2544 	ill_dlpi_send(ill, notify_mp);
2545 	ill_dlpi_send(ill, unbind_mp);
2546 
2547 	/*
2548 	 * Save the DL_DETACH_REQ (if there is one) for use in ill_delete().
2549 	 */
2550 	ASSERT(ill->ill_detach_mp == NULL);
2551 	ill->ill_detach_mp = detach_mp;
2552 
2553 	/*
2554 	 * This operation will complete in ip_rput_dlpi_writer with either
2555 	 * a DL_PHYS_ADDR_ACK or DL_ERROR_ACK.
2556 	 */
2557 	return (EINPROGRESS);
2558 bad:
2559 	if (v6token_mp != NULL)
2560 		freemsg(v6token_mp);
2561 	if (v6lla_mp != NULL)
2562 		freemsg(v6lla_mp);
2563 	if (phys_mp != NULL)
2564 		freemsg(phys_mp);
2565 	if (info_mp != NULL)
2566 		freemsg(info_mp);
2567 	if (attach_mp != NULL)
2568 		freemsg(attach_mp);
2569 	if (detach_mp != NULL)
2570 		freemsg(detach_mp);
2571 	if (bind_mp != NULL)
2572 		freemsg(bind_mp);
2573 	if (unbind_mp != NULL)
2574 		freemsg(unbind_mp);
2575 	if (notify_mp != NULL)
2576 		freemsg(notify_mp);
2577 	return (ENOMEM);
2578 }
2579 
2580 uint_t ip_loopback_mtu_v6plus = IP_LOOPBACK_MTU + IPV6_HDR_LEN + 20;
2581 
2582 /*
2583  * DLPI is up.
2584  * Create all the IREs associated with an interface bring up multicast.
2585  * Set the interface flag and finish other initialization
2586  * that potentially had to be differed to after DL_BIND_ACK.
2587  */
2588 int
2589 ipif_up_done_v6(ipif_t *ipif)
2590 {
2591 	ire_t	*ire_array[20];
2592 	ire_t	**irep = ire_array;
2593 	ire_t	**irep1;
2594 	ill_t	*ill = ipif->ipif_ill;
2595 	queue_t	*stq;
2596 	in6_addr_t	v6addr;
2597 	in6_addr_t	route_mask;
2598 	ipif_t	 *src_ipif = NULL;
2599 	ipif_t   *tmp_ipif;
2600 	boolean_t	flush_ire_cache = B_TRUE;
2601 	int	err;
2602 	char	buf[INET6_ADDRSTRLEN];
2603 	phyint_t *phyi;
2604 	ire_t	**ipif_saved_irep = NULL;
2605 	int ipif_saved_ire_cnt;
2606 	int cnt;
2607 	boolean_t src_ipif_held = B_FALSE;
2608 	boolean_t ire_added = B_FALSE;
2609 	boolean_t loopback = B_FALSE;
2610 	boolean_t ip6_asp_table_held = B_FALSE;
2611 
2612 	ip1dbg(("ipif_up_done_v6(%s:%u)\n",
2613 		ipif->ipif_ill->ill_name, ipif->ipif_id));
2614 
2615 	/* Check if this is a loopback interface */
2616 	if (ipif->ipif_ill->ill_wq == NULL)
2617 		loopback = B_TRUE;
2618 
2619 	ASSERT(ipif->ipif_isv6);
2620 	ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock));
2621 
2622 	/*
2623 	 * If all other interfaces for this ill are down or DEPRECATED,
2624 	 * or otherwise unsuitable for source address selection, remove
2625 	 * any IRE_CACHE entries for this ill to make sure source
2626 	 * address selection gets to take this new ipif into account.
2627 	 * No need to hold ill_lock while traversing the ipif list since
2628 	 * we are writer
2629 	 */
2630 	for (tmp_ipif = ill->ill_ipif; tmp_ipif;
2631 		tmp_ipif = tmp_ipif->ipif_next) {
2632 		if (((tmp_ipif->ipif_flags &
2633 		    (IPIF_NOXMIT|IPIF_ANYCAST|IPIF_NOLOCAL|IPIF_DEPRECATED)) ||
2634 		    !(tmp_ipif->ipif_flags & IPIF_UP)) ||
2635 		    (tmp_ipif == ipif))
2636 			continue;
2637 		/* first useable pre-existing interface */
2638 		flush_ire_cache = B_FALSE;
2639 		break;
2640 	}
2641 	if (flush_ire_cache)
2642 		ire_walk_ill_v6(MATCH_IRE_ILL_GROUP | MATCH_IRE_TYPE,
2643 		    IRE_CACHE, ill_ipif_cache_delete, (char *)ill, ill);
2644 
2645 	/*
2646 	 * Figure out which way the send-to queue should go.  Only
2647 	 * IRE_IF_RESOLVER or IRE_IF_NORESOLVER should show up here.
2648 	 */
2649 	switch (ill->ill_net_type) {
2650 	case IRE_IF_RESOLVER:
2651 		stq = ill->ill_rq;
2652 		break;
2653 	case IRE_IF_NORESOLVER:
2654 	case IRE_LOOPBACK:
2655 		stq = ill->ill_wq;
2656 		break;
2657 	default:
2658 		return (EINVAL);
2659 	}
2660 
2661 	if (ill->ill_phyint->phyint_flags & PHYI_LOOPBACK) {
2662 		/*
2663 		 * lo0:1 and subsequent ipifs were marked IRE_LOCAL in
2664 		 * ipif_lookup_on_name(), but in the case of zones we can have
2665 		 * several loopback addresses on lo0. So all the interfaces with
2666 		 * loopback addresses need to be marked IRE_LOOPBACK.
2667 		 */
2668 		if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr, &ipv6_loopback))
2669 			ipif->ipif_ire_type = IRE_LOOPBACK;
2670 		else
2671 			ipif->ipif_ire_type = IRE_LOCAL;
2672 	}
2673 
2674 	if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST|IPIF_DEPRECATED)) {
2675 		/*
2676 		 * Can't use our source address. Select a different
2677 		 * source address for the IRE_INTERFACE and IRE_LOCAL
2678 		 */
2679 		if (ip6_asp_can_lookup()) {
2680 			ip6_asp_table_held = B_TRUE;
2681 			src_ipif = ipif_select_source_v6(ipif->ipif_ill,
2682 			    &ipif->ipif_v6subnet, RESTRICT_TO_NONE,
2683 			    IPV6_PREFER_SRC_DEFAULT, ipif->ipif_zoneid);
2684 		}
2685 		if (src_ipif == NULL)
2686 			src_ipif = ipif;	/* Last resort */
2687 		else
2688 			src_ipif_held = B_TRUE;
2689 	} else {
2690 		src_ipif = ipif;
2691 	}
2692 
2693 	if (!IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) &&
2694 	    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
2695 
2696 		/*
2697 		 * If we're on a labeled system then make sure that zone-
2698 		 * private addresses have proper remote host database entries.
2699 		 */
2700 		if (is_system_labeled() &&
2701 		    ipif->ipif_ire_type != IRE_LOOPBACK) {
2702 			if (ip6opt_ls == 0) {
2703 				cmn_err(CE_WARN, "IPv6 not enabled "
2704 				    "via /etc/system");
2705 				return (EINVAL);
2706 			}
2707 			if (!tsol_check_interface_address(ipif))
2708 				return (EINVAL);
2709 		}
2710 
2711 		/* Register the source address for __sin6_src_id */
2712 		err = ip_srcid_insert(&ipif->ipif_v6lcl_addr,
2713 		    ipif->ipif_zoneid);
2714 		if (err != 0) {
2715 			ip0dbg(("ipif_up_done_v6: srcid_insert %d\n", err));
2716 			if (src_ipif_held)
2717 				ipif_refrele(src_ipif);
2718 			if (ip6_asp_table_held)
2719 				ip6_asp_table_refrele();
2720 			return (err);
2721 		}
2722 		/*
2723 		 * If the interface address is set, create the LOCAL
2724 		 * or LOOPBACK IRE.
2725 		 */
2726 		ip1dbg(("ipif_up_done_v6: creating IRE %d for %s\n",
2727 		    ipif->ipif_ire_type,
2728 		    inet_ntop(AF_INET6, &ipif->ipif_v6lcl_addr,
2729 		    buf, sizeof (buf))));
2730 
2731 		*irep++ = ire_create_v6(
2732 		    &ipif->ipif_v6lcl_addr,		/* dest address */
2733 		    &ipv6_all_ones,			/* mask */
2734 		    &src_ipif->ipif_v6src_addr,		/* source address */
2735 		    NULL,				/* no gateway */
2736 		    &ip_loopback_mtu_v6plus,		/* max frag size */
2737 		    NULL,
2738 		    ipif->ipif_rq,			/* recv-from queue */
2739 		    NULL,				/* no send-to queue */
2740 		    ipif->ipif_ire_type,		/* LOCAL or LOOPBACK */
2741 		    NULL,
2742 		    ipif,				/* interface */
2743 		    NULL,
2744 		    0,
2745 		    0,
2746 		    (ipif->ipif_flags & IPIF_PRIVATE) ? RTF_PRIVATE : 0,
2747 		    &ire_uinfo_null,
2748 		    NULL,
2749 		    NULL);
2750 	}
2751 
2752 	/*
2753 	 * Set up the IRE_IF_RESOLVER or IRE_IF_NORESOLVER, as appropriate.
2754 	 * Note that atun interfaces have an all-zero ipif_v6subnet.
2755 	 * Thus we allow a zero subnet as long as the mask is non-zero.
2756 	 */
2757 	if (stq != NULL && !(ipif->ipif_flags & IPIF_NOXMIT) &&
2758 	    !(IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet) &&
2759 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6net_mask))) {
2760 		/* ipif_v6subnet is ipif_v6pp_dst_addr for pt-pt */
2761 		v6addr = ipif->ipif_v6subnet;
2762 
2763 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
2764 			route_mask = ipv6_all_ones;
2765 		} else {
2766 			route_mask = ipif->ipif_v6net_mask;
2767 		}
2768 
2769 		ip1dbg(("ipif_up_done_v6: creating if IRE %d for %s\n",
2770 		    ill->ill_net_type,
2771 		    inet_ntop(AF_INET6, &v6addr, buf, sizeof (buf))));
2772 
2773 		*irep++ = ire_create_v6(
2774 		    &v6addr,			/* dest pref */
2775 		    &route_mask,		/* mask */
2776 		    &src_ipif->ipif_v6src_addr,	/* src addr */
2777 		    NULL,			/* no gateway */
2778 		    &ipif->ipif_mtu,		/* max frag */
2779 		    NULL,			/* no Fast path header */
2780 		    NULL,			/* no recv from queue */
2781 		    stq,			/* send-to queue */
2782 		    ill->ill_net_type,		/* IF_[NO]RESOLVER */
2783 		    ill->ill_resolver_mp,	/* xmit header */
2784 		    ipif,
2785 		    NULL,
2786 		    0,
2787 		    0,
2788 		    (ipif->ipif_flags & IPIF_PRIVATE) ? RTF_PRIVATE : 0,
2789 		    &ire_uinfo_null,
2790 		    NULL,
2791 		    NULL);
2792 	}
2793 
2794 	/*
2795 	 * Setup 2002::/16 route, if this interface is a 6to4 tunnel
2796 	 */
2797 	if (IN6_IS_ADDR_6TO4(&ipif->ipif_v6lcl_addr) &&
2798 	    (ill->ill_is_6to4tun)) {
2799 		/*
2800 		 * Destination address is 2002::/16
2801 		 */
2802 #ifdef	_BIG_ENDIAN
2803 		const in6_addr_t prefix_addr = { 0x20020000U, 0, 0, 0 };
2804 		const in6_addr_t prefix_mask = { 0xffff0000U, 0, 0, 0 };
2805 #else
2806 		const in6_addr_t prefix_addr = { 0x00000220U, 0, 0, 0 };
2807 		const in6_addr_t prefix_mask = { 0x0000ffffU, 0, 0, 0 };
2808 #endif /* _BIG_ENDIAN */
2809 		char	buf2[INET6_ADDRSTRLEN];
2810 		ire_t *isdup;
2811 		in6_addr_t *first_addr = &ill->ill_ipif->ipif_v6lcl_addr;
2812 
2813 		/*
2814 		 * check to see if this route has already been added for
2815 		 * this tunnel interface.
2816 		 */
2817 		isdup = ire_ftable_lookup_v6(first_addr, &prefix_mask, 0,
2818 		    IRE_IF_NORESOLVER, ill->ill_ipif, NULL, ALL_ZONES, 0, NULL,
2819 		    (MATCH_IRE_SRC | MATCH_IRE_MASK));
2820 
2821 		if (isdup == NULL) {
2822 			ip1dbg(("ipif_up_done_v6: creating if IRE %d for %s",
2823 			    IRE_IF_NORESOLVER, inet_ntop(AF_INET6, &v6addr,
2824 				buf2, sizeof (buf2))));
2825 
2826 			*irep++ = ire_create_v6(
2827 			    &prefix_addr,		/* 2002:: */
2828 			    &prefix_mask,		/* ffff:: */
2829 			    &ipif->ipif_v6lcl_addr, 	/* src addr */
2830 			    NULL, 			/* gateway */
2831 			    &ipif->ipif_mtu, 		/* max_frag */
2832 			    NULL, 			/* no Fast Path hdr */
2833 			    NULL, 			/* no rfq */
2834 			    ill->ill_wq, 		/* stq */
2835 			    IRE_IF_NORESOLVER,		/* type */
2836 			    ill->ill_resolver_mp,	/* dlureq_mp */
2837 			    ipif,			/* interface */
2838 			    NULL,			/* v6cmask */
2839 			    0,
2840 			    0,
2841 			    RTF_UP,
2842 			    &ire_uinfo_null,
2843 			    NULL,
2844 			    NULL);
2845 		} else {
2846 			ire_refrele(isdup);
2847 		}
2848 	}
2849 
2850 	/* If an earlier ire_create failed, get out now */
2851 	for (irep1 = irep; irep1 > ire_array; ) {
2852 		irep1--;
2853 		if (*irep1 == NULL) {
2854 			ip1dbg(("ipif_up_done_v6: NULL ire found in"
2855 			    " ire_array\n"));
2856 			err = ENOMEM;
2857 			goto bad;
2858 		}
2859 	}
2860 
2861 	ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock));
2862 
2863 	/*
2864 	 * Need to atomically check for ip_addr_availablity_check
2865 	 * now under ill_g_lock, and if it fails got bad, and remove
2866 	 * from group also
2867 	 */
2868 	rw_enter(&ill_g_lock, RW_READER);
2869 	mutex_enter(&ip_addr_avail_lock);
2870 	ill->ill_ipif_up_count++;
2871 	ipif->ipif_flags |= IPIF_UP;
2872 	err = ip_addr_availability_check(ipif);
2873 	mutex_exit(&ip_addr_avail_lock);
2874 	rw_exit(&ill_g_lock);
2875 
2876 	if (err != 0) {
2877 		/*
2878 		 * Our address may already be up on the same ill. In this case,
2879 		 * the external resolver entry for our ipif replaced the one for
2880 		 * the other ipif. So we don't want to delete it (otherwise the
2881 		 * other ipif would be unable to send packets).
2882 		 * ip_addr_availability_check() identifies this case for us and
2883 		 * returns EADDRINUSE; we need to turn it into EADDRNOTAVAIL
2884 		 * which is the expected error code.
2885 		 */
2886 		if (err == EADDRINUSE) {
2887 			if (ipif->ipif_ill->ill_flags & ILLF_XRESOLV) {
2888 				freemsg(ipif->ipif_arp_del_mp);
2889 				ipif->ipif_arp_del_mp = NULL;
2890 			}
2891 			err = EADDRNOTAVAIL;
2892 		}
2893 		ill->ill_ipif_up_count--;
2894 		ipif->ipif_flags &= ~IPIF_UP;
2895 		goto bad;
2896 	}
2897 
2898 	/*
2899 	 * Add in all newly created IREs. We want to add before
2900 	 * we call ifgrp_insert which wants to know whether
2901 	 * IRE_IF_RESOLVER exists or not.
2902 	 *
2903 	 * NOTE : We refrele the ire though we may branch to "bad"
2904 	 *	  later on where we do ire_delete. This is okay
2905 	 *	  because nobody can delete it as we are running
2906 	 *	  exclusively.
2907 	 */
2908 	for (irep1 = irep; irep1 > ire_array; ) {
2909 		irep1--;
2910 		/* Shouldn't be adding any bcast ire's */
2911 		ASSERT((*irep1)->ire_type != IRE_BROADCAST);
2912 		ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock));
2913 		/*
2914 		 * refheld by ire_add. refele towards the end of the func
2915 		 */
2916 		(void) ire_add(irep1, NULL, NULL, NULL);
2917 	}
2918 	if (ip6_asp_table_held) {
2919 		ip6_asp_table_refrele();
2920 		ip6_asp_table_held = B_FALSE;
2921 	}
2922 	ire_added = B_TRUE;
2923 
2924 	/*
2925 	 * Form groups if possible.
2926 	 *
2927 	 * If we are supposed to be in a ill_group with a name, insert it
2928 	 * now as we know that at least one ipif is UP. Otherwise form
2929 	 * nameless groups.
2930 	 *
2931 	 * If ip_enable_group_ifs is set and ipif address is not ::0, insert
2932 	 * this ipif into the appropriate interface group, or create a
2933 	 * new one. If this is already in a nameless group, we try to form
2934 	 * a bigger group looking at other ills potentially sharing this
2935 	 * ipif's prefix.
2936 	 */
2937 	phyi = ill->ill_phyint;
2938 	if (phyi->phyint_groupname_len != 0) {
2939 		ASSERT(phyi->phyint_groupname != NULL);
2940 		if (ill->ill_ipif_up_count == 1) {
2941 			ASSERT(ill->ill_group == NULL);
2942 			err = illgrp_insert(&illgrp_head_v6, ill,
2943 			    phyi->phyint_groupname, NULL, B_TRUE);
2944 			if (err != 0) {
2945 				ip1dbg(("ipif_up_done_v6: illgrp allocation "
2946 				    "failed, error %d\n", err));
2947 				goto bad;
2948 			}
2949 		}
2950 		ASSERT(ill->ill_group != NULL);
2951 	}
2952 
2953 	/* Recover any additional IRE_IF_[NO]RESOLVER entries for this ipif */
2954 	ipif_saved_ire_cnt = ipif->ipif_saved_ire_cnt;
2955 	ipif_saved_irep = ipif_recover_ire_v6(ipif);
2956 
2957 	if (ipif->ipif_ipif_up_count == 1 && !loopback) {
2958 		/*
2959 		 * Need to recover all multicast memberships in the driver.
2960 		 * This had to be deferred until we had attached.
2961 		 */
2962 		ill_recover_multicast(ill);
2963 	}
2964 	/* Join the allhosts multicast address and the solicited node MC */
2965 	ipif_multicast_up(ipif);
2966 
2967 	if (!loopback) {
2968 		/*
2969 		 * See whether anybody else would benefit from the
2970 		 * new ipif that we added. We call this always rather
2971 		 * than while adding a non-IPIF_NOLOCAL/DEPRECATED/ANYCAST
2972 		 * ipif for the benefit of illgrp_insert (done above)
2973 		 * which does not do source address selection as it does
2974 		 * not want to re-create interface routes that we are
2975 		 * having reference to it here.
2976 		 */
2977 		ill_update_source_selection(ill);
2978 	}
2979 
2980 	for (irep1 = irep; irep1 > ire_array; ) {
2981 		irep1--;
2982 		if (*irep1 != NULL) {
2983 			/* was held in ire_add */
2984 			ire_refrele(*irep1);
2985 		}
2986 	}
2987 
2988 	cnt = ipif_saved_ire_cnt;
2989 	for (irep1 = ipif_saved_irep; cnt > 0; irep1++, cnt--) {
2990 		if (*irep1 != NULL) {
2991 			/* was held in ire_add */
2992 			ire_refrele(*irep1);
2993 		}
2994 	}
2995 
2996 
2997 	ip_rts_ifmsg(ipif);
2998 	ip_rts_newaddrmsg(RTM_ADD, 0, ipif);
2999 	if (ipif_saved_irep != NULL) {
3000 		kmem_free(ipif_saved_irep,
3001 		    ipif_saved_ire_cnt * sizeof (ire_t *));
3002 	}
3003 
3004 	if (src_ipif_held)
3005 		ipif_refrele(src_ipif);
3006 	sctp_update_ipif(ipif, SCTP_IPIF_UP);
3007 	return (0);
3008 
3009 bad:
3010 	if (ip6_asp_table_held)
3011 		ip6_asp_table_refrele();
3012 	/*
3013 	 * We don't have to bother removing from ill groups because
3014 	 *
3015 	 * 1) For groups with names, we insert only when the first ipif
3016 	 *    comes up. In that case if it fails, it will not be in any
3017 	 *    group. So, we need not try to remove for that case.
3018 	 *
3019 	 * 2) For groups without names, either we tried to insert ipif_ill
3020 	 *    in a group as singleton or found some other group to become
3021 	 *    a bigger group. For the former, if it fails we don't have
3022 	 *    anything to do as ipif_ill is not in the group and for the
3023 	 *    latter, there are no failures in illgrp_insert/illgrp_delete
3024 	 *    (ENOMEM can't occur for this. Check ifgrp_insert).
3025 	 */
3026 
3027 	while (irep > ire_array) {
3028 		irep--;
3029 		if (*irep != NULL) {
3030 			ire_delete(*irep);
3031 			if (ire_added)
3032 				ire_refrele(*irep);
3033 		}
3034 
3035 	}
3036 	(void) ip_srcid_remove(&ipif->ipif_v6lcl_addr, ipif->ipif_zoneid);
3037 
3038 	if (ipif_saved_irep != NULL) {
3039 		kmem_free(ipif_saved_irep,
3040 		    ipif_saved_ire_cnt * sizeof (ire_t *));
3041 	}
3042 	if (src_ipif_held)
3043 		ipif_refrele(src_ipif);
3044 
3045 	ipif_ndp_down(ipif);
3046 	if (ipif->ipif_ill->ill_flags & ILLF_XRESOLV)
3047 		ipif_arp_down(ipif);
3048 
3049 	return (err);
3050 }
3051 
3052 /*
3053  * Delete an ND entry and the corresponding IRE_CACHE entry if it exists.
3054  */
3055 /* ARGSUSED */
3056 int
3057 ip_siocdelndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
3058     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
3059 {
3060 	in6_addr_t	addr;
3061 	sin6_t		*sin6;
3062 	nce_t		*nce;
3063 	struct lifreq	*lifr;
3064 	lif_nd_req_t	*lnr;
3065 	mblk_t	*mp1;
3066 
3067 	mp1 = mp->b_cont->b_cont;
3068 	lifr = (struct lifreq *)mp1->b_rptr;
3069 	lnr = &lifr->lifr_nd;
3070 	/* Only allow for logical unit zero i.e. not on "le0:17" */
3071 	if (ipif->ipif_id != 0)
3072 		return (EINVAL);
3073 
3074 	if (!ipif->ipif_isv6)
3075 		return (EINVAL);
3076 
3077 	if (lnr->lnr_addr.ss_family != AF_INET6)
3078 		return (EAFNOSUPPORT);
3079 
3080 	sin6 = (sin6_t *)&lnr->lnr_addr;
3081 	addr = sin6->sin6_addr;
3082 	nce = ndp_lookup(ipif->ipif_ill, &addr, B_FALSE);
3083 	if (nce == NULL)
3084 		return (ESRCH);
3085 	ndp_delete(nce);
3086 	NCE_REFRELE(nce);
3087 	return (0);
3088 }
3089 
3090 /*
3091  * Return nbr cache info.
3092  */
3093 /* ARGSUSED */
3094 int
3095 ip_siocqueryndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
3096     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
3097 {
3098 	ill_t		*ill = ipif->ipif_ill;
3099 	struct lifreq	*lifr;
3100 	lif_nd_req_t	*lnr;
3101 
3102 	lifr = (struct lifreq *)mp->b_cont->b_cont->b_rptr;
3103 	lnr = &lifr->lifr_nd;
3104 	/* Only allow for logical unit zero i.e. not on "le0:17" */
3105 	if (ipif->ipif_id != 0)
3106 		return (EINVAL);
3107 
3108 	if (!ipif->ipif_isv6)
3109 		return (EINVAL);
3110 
3111 	if (lnr->lnr_addr.ss_family != AF_INET6)
3112 		return (EAFNOSUPPORT);
3113 
3114 	if (ill->ill_phys_addr_length > sizeof (lnr->lnr_hdw_addr))
3115 		return (EINVAL);
3116 
3117 	return (ndp_query(ill, lnr));
3118 }
3119 
3120 /*
3121  * Perform an update of the nd entry for the specified address.
3122  */
3123 /* ARGSUSED */
3124 int
3125 ip_siocsetndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
3126     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
3127 {
3128 	ill_t		*ill = ipif->ipif_ill;
3129 	struct	lifreq	*lifr;
3130 	lif_nd_req_t	*lnr;
3131 
3132 	lifr = (struct lifreq *)mp->b_cont->b_cont->b_rptr;
3133 	lnr = &lifr->lifr_nd;
3134 	/* Only allow for logical unit zero i.e. not on "le0:17" */
3135 	if (ipif->ipif_id != 0)
3136 		return (EINVAL);
3137 
3138 	if (!ipif->ipif_isv6)
3139 		return (EINVAL);
3140 
3141 	if (lnr->lnr_addr.ss_family != AF_INET6)
3142 		return (EAFNOSUPPORT);
3143 
3144 	return (ndp_sioc_update(ill, lnr));
3145 }
3146