xref: /illumos-gate/usr/src/uts/common/inet/ip/ip6_if.c (revision ef2504f26d1ea5859db9838255bb63f488f1b050)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 /*
26  * Copyright (c) 1990 Mentat Inc.
27  */
28 
29 /*
30  * This file contains the interface control functions for IPv6.
31  */
32 
33 #include <sys/types.h>
34 #include <sys/sysmacros.h>
35 #include <sys/stream.h>
36 #include <sys/dlpi.h>
37 #include <sys/stropts.h>
38 #include <sys/ddi.h>
39 #include <sys/cmn_err.h>
40 #include <sys/kstat.h>
41 #include <sys/debug.h>
42 #include <sys/zone.h>
43 #include <sys/policy.h>
44 
45 #include <sys/systm.h>
46 #include <sys/param.h>
47 #include <sys/socket.h>
48 #include <sys/isa_defs.h>
49 #include <net/if.h>
50 #include <net/if_dl.h>
51 #include <net/route.h>
52 #include <netinet/in.h>
53 #include <netinet/igmp_var.h>
54 #include <netinet/ip6.h>
55 #include <netinet/icmp6.h>
56 
57 #include <inet/common.h>
58 #include <inet/nd.h>
59 #include <inet/mib2.h>
60 #include <inet/ip.h>
61 #include <inet/ip6.h>
62 #include <inet/ip_multi.h>
63 #include <inet/ip_ire.h>
64 #include <inet/ip_rts.h>
65 #include <inet/ip_ndp.h>
66 #include <inet/ip_if.h>
67 #include <inet/ip6_asp.h>
68 #include <inet/tun.h>
69 #include <inet/ipclassifier.h>
70 #include <inet/sctp_ip.h>
71 
72 #include <sys/tsol/tndb.h>
73 #include <sys/tsol/tnet.h>
74 
75 static in6_addr_t	ipv6_ll_template =
76 			{(uint32_t)V6_LINKLOCAL, 0x0, 0x0, 0x0};
77 
78 static ipif_t *
79 ipif_lookup_interface_v6(const in6_addr_t *if_addr, const in6_addr_t *dst,
80     queue_t *q, mblk_t *mp, ipsq_func_t func, int *error, ip_stack_t *ipst);
81 
82 /*
83  * These two functions, ipif_lookup_group_v6() and ill_lookup_group_v6(),
84  * are called when an application does not specify an interface to be
85  * used for multicast traffic.  It calls ire_lookup_multi_v6() to look
86  * for an interface route for the specified multicast group.  Doing
87  * this allows the administrator to add prefix routes for multicast to
88  * indicate which interface to be used for multicast traffic in the above
89  * scenario.  The route could be for all multicast (ff00::/8), for a single
90  * multicast group (a /128 route) or anything in between.  If there is no
91  * such multicast route, we just find any multicast capable interface and
92  * return it.
93  */
94 ipif_t *
95 ipif_lookup_group_v6(const in6_addr_t *group, zoneid_t zoneid, ip_stack_t *ipst)
96 {
97 	ire_t	*ire;
98 	ipif_t	*ipif;
99 
100 	ire = ire_lookup_multi_v6(group, zoneid, ipst);
101 	if (ire != NULL) {
102 		ipif = ire->ire_ipif;
103 		ipif_refhold(ipif);
104 		ire_refrele(ire);
105 		return (ipif);
106 	}
107 
108 	return (ipif_lookup_multicast(ipst, zoneid, B_TRUE));
109 }
110 
111 ill_t *
112 ill_lookup_group_v6(const in6_addr_t *group, zoneid_t zoneid, ip_stack_t *ipst)
113 {
114 	ire_t	*ire;
115 	ill_t	*ill;
116 	ipif_t	*ipif;
117 
118 	ire = ire_lookup_multi_v6(group, zoneid, ipst);
119 	if (ire != NULL) {
120 		ill = ire->ire_ipif->ipif_ill;
121 		ill_refhold(ill);
122 		ire_refrele(ire);
123 		return (ill);
124 	}
125 
126 	ipif = ipif_lookup_multicast(ipst, zoneid, B_TRUE);
127 	if (ipif == NULL)
128 		return (NULL);
129 
130 	ill = ipif->ipif_ill;
131 	ill_refhold(ill);
132 	ipif_refrele(ipif);
133 	return (ill);
134 }
135 
136 /*
137  * Look for an ipif with the specified interface address and destination.
138  * The destination address is used only for matching point-to-point interfaces.
139  */
140 static ipif_t *
141 ipif_lookup_interface_v6(const in6_addr_t *if_addr, const in6_addr_t *dst,
142     queue_t *q, mblk_t *mp, ipsq_func_t func, int *error, ip_stack_t *ipst)
143 {
144 	ipif_t	*ipif;
145 	ill_t	*ill;
146 	ipsq_t	*ipsq;
147 	ill_walk_context_t ctx;
148 
149 	if (error != NULL)
150 		*error = 0;
151 
152 	/*
153 	 * First match all the point-to-point interfaces
154 	 * before looking at non-point-to-point interfaces.
155 	 * This is done to avoid returning non-point-to-point
156 	 * ipif instead of unnumbered point-to-point ipif.
157 	 */
158 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
159 	ill = ILL_START_WALK_V6(&ctx, ipst);
160 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
161 		GRAB_CONN_LOCK(q);
162 		mutex_enter(&ill->ill_lock);
163 		for (ipif = ill->ill_ipif; ipif != NULL;
164 		    ipif = ipif->ipif_next) {
165 			/* Allow the ipif to be down */
166 			if ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
167 			    (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr,
168 			    if_addr)) &&
169 			    (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr,
170 			    dst))) {
171 				if (IPIF_CAN_LOOKUP(ipif)) {
172 					ipif_refhold_locked(ipif);
173 					mutex_exit(&ill->ill_lock);
174 					RELEASE_CONN_LOCK(q);
175 					rw_exit(&ipst->ips_ill_g_lock);
176 					return (ipif);
177 				} else if (IPIF_CAN_WAIT(ipif, q)) {
178 					ipsq = ill->ill_phyint->phyint_ipsq;
179 					mutex_enter(&ipsq->ipsq_lock);
180 					mutex_enter(&ipsq->ipsq_xop->ipx_lock);
181 					mutex_exit(&ill->ill_lock);
182 					rw_exit(&ipst->ips_ill_g_lock);
183 					ipsq_enq(ipsq, q, mp, func, NEW_OP,
184 					    ill);
185 					mutex_exit(&ipsq->ipsq_xop->ipx_lock);
186 					mutex_exit(&ipsq->ipsq_lock);
187 					RELEASE_CONN_LOCK(q);
188 					if (error != NULL)
189 						*error = EINPROGRESS;
190 					return (NULL);
191 				}
192 			}
193 		}
194 		mutex_exit(&ill->ill_lock);
195 		RELEASE_CONN_LOCK(q);
196 	}
197 	rw_exit(&ipst->ips_ill_g_lock);
198 	/* lookup the ipif based on interface address */
199 	ipif = ipif_lookup_addr_v6(if_addr, NULL, ALL_ZONES, q, mp, func,
200 	    error, ipst);
201 	ASSERT(ipif == NULL || ipif->ipif_isv6);
202 	return (ipif);
203 }
204 
205 /*
206  * Common function for ipif_lookup_addr_v6() and ipif_lookup_addr_exact_v6().
207  */
208 static ipif_t *
209 ipif_lookup_addr_common_v6(const in6_addr_t *addr, ill_t *match_ill,
210     boolean_t match_illgrp, zoneid_t zoneid, queue_t *q, mblk_t *mp,
211     ipsq_func_t func, int *error, ip_stack_t *ipst)
212 {
213 	ipif_t	*ipif;
214 	ill_t	*ill;
215 	boolean_t  ptp = B_FALSE;
216 	ipsq_t	*ipsq;
217 	ill_walk_context_t ctx;
218 
219 	if (error != NULL)
220 		*error = 0;
221 
222 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
223 	/*
224 	 * Repeat twice, first based on local addresses and
225 	 * next time for pointopoint.
226 	 */
227 repeat:
228 	ill = ILL_START_WALK_V6(&ctx, ipst);
229 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
230 		if (match_ill != NULL && ill != match_ill &&
231 		    (!match_illgrp || !IS_IN_SAME_ILLGRP(ill, match_ill))) {
232 			continue;
233 		}
234 		GRAB_CONN_LOCK(q);
235 		mutex_enter(&ill->ill_lock);
236 		for (ipif = ill->ill_ipif; ipif != NULL;
237 		    ipif = ipif->ipif_next) {
238 			if (zoneid != ALL_ZONES &&
239 			    ipif->ipif_zoneid != zoneid &&
240 			    ipif->ipif_zoneid != ALL_ZONES)
241 				continue;
242 			/* Allow the ipif to be down */
243 			if ((!ptp && (IN6_ARE_ADDR_EQUAL(
244 			    &ipif->ipif_v6lcl_addr, addr) &&
245 			    (ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) ||
246 			    (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) &&
247 			    IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr,
248 			    addr))) {
249 				if (IPIF_CAN_LOOKUP(ipif)) {
250 					ipif_refhold_locked(ipif);
251 					mutex_exit(&ill->ill_lock);
252 					RELEASE_CONN_LOCK(q);
253 					rw_exit(&ipst->ips_ill_g_lock);
254 					return (ipif);
255 				} else if (IPIF_CAN_WAIT(ipif, q)) {
256 					ipsq = ill->ill_phyint->phyint_ipsq;
257 					mutex_enter(&ipsq->ipsq_lock);
258 					mutex_enter(&ipsq->ipsq_xop->ipx_lock);
259 					mutex_exit(&ill->ill_lock);
260 					rw_exit(&ipst->ips_ill_g_lock);
261 					ipsq_enq(ipsq, q, mp, func, NEW_OP,
262 					    ill);
263 					mutex_exit(&ipsq->ipsq_xop->ipx_lock);
264 					mutex_exit(&ipsq->ipsq_lock);
265 					RELEASE_CONN_LOCK(q);
266 					if (error != NULL)
267 						*error = EINPROGRESS;
268 					return (NULL);
269 				}
270 			}
271 		}
272 		mutex_exit(&ill->ill_lock);
273 		RELEASE_CONN_LOCK(q);
274 	}
275 
276 	/* If we already did the ptp case, then we are done */
277 	if (ptp) {
278 		rw_exit(&ipst->ips_ill_g_lock);
279 		if (error != NULL)
280 			*error = ENXIO;
281 		return (NULL);
282 	}
283 	ptp = B_TRUE;
284 	goto repeat;
285 }
286 
287 boolean_t
288 ip_addr_exists_v6(const in6_addr_t *addr, zoneid_t zoneid,
289     ip_stack_t *ipst)
290 {
291 	ipif_t	*ipif;
292 	ill_t	*ill;
293 	ill_walk_context_t ctx;
294 
295 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
296 
297 	ill = ILL_START_WALK_V6(&ctx, ipst);
298 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
299 		mutex_enter(&ill->ill_lock);
300 		for (ipif = ill->ill_ipif; ipif != NULL;
301 		    ipif = ipif->ipif_next) {
302 			if (zoneid != ALL_ZONES &&
303 			    ipif->ipif_zoneid != zoneid &&
304 			    ipif->ipif_zoneid != ALL_ZONES)
305 				continue;
306 			/* Allow the ipif to be down */
307 			if (((IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr,
308 			    addr) &&
309 			    (ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) ||
310 			    ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
311 			    IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr,
312 			    addr))) {
313 				mutex_exit(&ill->ill_lock);
314 				rw_exit(&ipst->ips_ill_g_lock);
315 				return (B_TRUE);
316 			}
317 		}
318 		mutex_exit(&ill->ill_lock);
319 	}
320 
321 	rw_exit(&ipst->ips_ill_g_lock);
322 	return (B_FALSE);
323 }
324 
325 /*
326  * Lookup an ipif with the specified address.  For point-to-point links we
327  * look for matches on either the destination address or the local address,
328  * but we skip the local address check if IPIF_UNNUMBERED is set.  If the
329  * `match_ill' argument is non-NULL, the lookup is restricted to that ill
330  * (or illgrp if `match_ill' is in an IPMP group).
331  */
332 ipif_t *
333 ipif_lookup_addr_v6(const in6_addr_t *addr, ill_t *match_ill, zoneid_t zoneid,
334     queue_t *q, mblk_t *mp, ipsq_func_t func, int *error, ip_stack_t *ipst)
335 {
336 	return (ipif_lookup_addr_common_v6(addr, match_ill, B_TRUE, zoneid, q,
337 	    mp, func, error, ipst));
338 }
339 
340 /*
341  * Special abbreviated version of ipif_lookup_addr_v6() that doesn't match
342  * `match_ill' across the IPMP group.  This function is only needed in some
343  * corner-cases; almost everything should use ipif_lookup_addr_v6().
344  */
345 ipif_t *
346 ipif_lookup_addr_exact_v6(const in6_addr_t *addr, ill_t *match_ill,
347     ip_stack_t *ipst)
348 {
349 	ASSERT(match_ill != NULL);
350 	return (ipif_lookup_addr_common_v6(addr, match_ill, B_FALSE, ALL_ZONES,
351 	    NULL, NULL, NULL, NULL, ipst));
352 }
353 
354 /*
355  * Look for an ipif with the specified address. For point-point links
356  * we look for matches on either the destination address and the local
357  * address, but we ignore the check on the local address if IPIF_UNNUMBERED
358  * is set.
359  * If the `match_ill' argument is non-NULL, the lookup is restricted to that
360  * ill (or illgrp if `match_ill' is in an IPMP group).
361  * Return the zoneid for the ipif. ALL_ZONES if none found.
362  */
363 zoneid_t
364 ipif_lookup_addr_zoneid_v6(const in6_addr_t *addr, ill_t *match_ill,
365     ip_stack_t *ipst)
366 {
367 	ipif_t	*ipif;
368 	ill_t	*ill;
369 	boolean_t  ptp = B_FALSE;
370 	ill_walk_context_t ctx;
371 	zoneid_t	zoneid;
372 
373 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
374 	/*
375 	 * Repeat twice, first based on local addresses and
376 	 * next time for pointopoint.
377 	 */
378 repeat:
379 	ill = ILL_START_WALK_V6(&ctx, ipst);
380 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
381 		if (match_ill != NULL && ill != match_ill &&
382 		    !IS_IN_SAME_ILLGRP(ill, match_ill)) {
383 			continue;
384 		}
385 		mutex_enter(&ill->ill_lock);
386 		for (ipif = ill->ill_ipif; ipif != NULL;
387 		    ipif = ipif->ipif_next) {
388 			/* Allow the ipif to be down */
389 			if ((!ptp && (IN6_ARE_ADDR_EQUAL(
390 			    &ipif->ipif_v6lcl_addr, addr) &&
391 			    (ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) ||
392 			    (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) &&
393 			    IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr,
394 			    addr)) &&
395 			    !(ipif->ipif_state_flags & IPIF_CONDEMNED)) {
396 				zoneid = ipif->ipif_zoneid;
397 				mutex_exit(&ill->ill_lock);
398 				rw_exit(&ipst->ips_ill_g_lock);
399 				/*
400 				 * If ipif_zoneid was ALL_ZONES then we have
401 				 * a trusted extensions shared IP address.
402 				 * In that case GLOBAL_ZONEID works to send.
403 				 */
404 				if (zoneid == ALL_ZONES)
405 					zoneid = GLOBAL_ZONEID;
406 				return (zoneid);
407 			}
408 		}
409 		mutex_exit(&ill->ill_lock);
410 	}
411 
412 	/* If we already did the ptp case, then we are done */
413 	if (ptp) {
414 		rw_exit(&ipst->ips_ill_g_lock);
415 		return (ALL_ZONES);
416 	}
417 	ptp = B_TRUE;
418 	goto repeat;
419 }
420 
421 /*
422  * Perform various checks to verify that an address would make sense as a local
423  * interface address.  This is currently only called when an attempt is made
424  * to set a local address.
425  *
426  * Does not allow a v4-mapped address, an address that equals the subnet
427  * anycast address, ... a multicast address, ...
428  */
429 boolean_t
430 ip_local_addr_ok_v6(const in6_addr_t *addr, const in6_addr_t *subnet_mask)
431 {
432 	in6_addr_t subnet;
433 
434 	if (IN6_IS_ADDR_UNSPECIFIED(addr))
435 		return (B_TRUE);	/* Allow all zeros */
436 
437 	/*
438 	 * Don't allow all zeroes or host part, but allow
439 	 * all ones netmask.
440 	 */
441 	V6_MASK_COPY(*addr, *subnet_mask, subnet);
442 	if (IN6_IS_ADDR_V4MAPPED(addr) ||
443 	    (IN6_ARE_ADDR_EQUAL(addr, &subnet) &&
444 	    !IN6_ARE_ADDR_EQUAL(subnet_mask, &ipv6_all_ones)) ||
445 	    (IN6_IS_ADDR_V4COMPAT(addr) && CLASSD(V4_PART_OF_V6((*addr)))) ||
446 	    IN6_IS_ADDR_MULTICAST(addr))
447 		return (B_FALSE);
448 
449 	return (B_TRUE);
450 }
451 
452 /*
453  * Perform various checks to verify that an address would make sense as a
454  * remote/subnet interface address.
455  */
456 boolean_t
457 ip_remote_addr_ok_v6(const in6_addr_t *addr, const in6_addr_t *subnet_mask)
458 {
459 	in6_addr_t subnet;
460 
461 	if (IN6_IS_ADDR_UNSPECIFIED(addr))
462 		return (B_TRUE);	/* Allow all zeros */
463 
464 	V6_MASK_COPY(*addr, *subnet_mask, subnet);
465 	if (IN6_IS_ADDR_V4MAPPED(addr) ||
466 	    (IN6_ARE_ADDR_EQUAL(addr, &subnet) &&
467 	    !IN6_ARE_ADDR_EQUAL(subnet_mask, &ipv6_all_ones)) ||
468 	    IN6_IS_ADDR_MULTICAST(addr) ||
469 	    (IN6_IS_ADDR_V4COMPAT(addr) && CLASSD(V4_PART_OF_V6((*addr)))))
470 		return (B_FALSE);
471 
472 	return (B_TRUE);
473 }
474 
475 /*
476  * ip_rt_add_v6 is called to add an IPv6 route to the forwarding table.
477  * ipif_arg is passed in to associate it with the correct interface
478  * (for link-local destinations and gateways).
479  */
480 /* ARGSUSED1 */
481 int
482 ip_rt_add_v6(const in6_addr_t *dst_addr, const in6_addr_t *mask,
483     const in6_addr_t *gw_addr, const in6_addr_t *src_addr, int flags,
484     ipif_t *ipif_arg, ire_t **ire_arg, queue_t *q, mblk_t *mp, ipsq_func_t func,
485     struct rtsa_s *sp, ip_stack_t *ipst)
486 {
487 	ire_t	*ire;
488 	ire_t	*gw_ire = NULL;
489 	ipif_t	*ipif;
490 	boolean_t ipif_refheld = B_FALSE;
491 	uint_t	type;
492 	int	match_flags = MATCH_IRE_TYPE;
493 	int	error;
494 	tsol_gc_t *gc = NULL;
495 	tsol_gcgrp_t *gcgrp = NULL;
496 	boolean_t gcgrp_xtraref = B_FALSE;
497 
498 	if (ire_arg != NULL)
499 		*ire_arg = NULL;
500 
501 	/*
502 	 * Prevent routes with a zero gateway from being created (since
503 	 * interfaces can currently be plumbed and brought up with no assigned
504 	 * address).
505 	 */
506 	if (IN6_IS_ADDR_UNSPECIFIED(gw_addr))
507 		return (ENETUNREACH);
508 
509 	/*
510 	 * If this is the case of RTF_HOST being set, then we set the netmask
511 	 * to all ones (regardless if one was supplied).
512 	 */
513 	if (flags & RTF_HOST)
514 		mask = &ipv6_all_ones;
515 
516 	/*
517 	 * Get the ipif, if any, corresponding to the gw_addr
518 	 */
519 	ipif = ipif_lookup_interface_v6(gw_addr, dst_addr, q, mp, func,
520 	    &error, ipst);
521 	if (ipif != NULL)
522 		ipif_refheld = B_TRUE;
523 	else if (error == EINPROGRESS) {
524 		ip1dbg(("ip_rt_add_v6: null and EINPROGRESS"));
525 		return (error);
526 	}
527 
528 	/*
529 	 * GateD will attempt to create routes with a loopback interface
530 	 * address as the gateway and with RTF_GATEWAY set.  We allow
531 	 * these routes to be added, but create them as interface routes
532 	 * since the gateway is an interface address.
533 	 */
534 	if ((ipif != NULL) && (ipif->ipif_ire_type == IRE_LOOPBACK)) {
535 		flags &= ~RTF_GATEWAY;
536 		if (IN6_ARE_ADDR_EQUAL(gw_addr, &ipv6_loopback) &&
537 		    IN6_ARE_ADDR_EQUAL(dst_addr, &ipv6_loopback) &&
538 		    IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones)) {
539 			ire = ire_ctable_lookup_v6(dst_addr, 0, IRE_LOOPBACK,
540 			    ipif, ALL_ZONES, NULL, match_flags, ipst);
541 			if (ire != NULL) {
542 				ire_refrele(ire);
543 				if (ipif_refheld)
544 					ipif_refrele(ipif);
545 				return (EEXIST);
546 			}
547 			ip1dbg(("ipif_up_done: 0x%p creating IRE 0x%x"
548 			    "for 0x%x\n", (void *)ipif,
549 			    ipif->ipif_ire_type,
550 			    ntohl(ipif->ipif_lcl_addr)));
551 			ire = ire_create_v6(
552 			    dst_addr,
553 			    mask,
554 			    &ipif->ipif_v6src_addr,
555 			    NULL,
556 			    &ipif->ipif_mtu,
557 			    NULL,
558 			    NULL,
559 			    NULL,
560 			    ipif->ipif_net_type,
561 			    ipif,
562 			    NULL,
563 			    0,
564 			    0,
565 			    flags,
566 			    &ire_uinfo_null,
567 			    NULL,
568 			    NULL,
569 			    ipst);
570 			if (ire == NULL) {
571 				if (ipif_refheld)
572 					ipif_refrele(ipif);
573 				return (ENOMEM);
574 			}
575 			error = ire_add(&ire, q, mp, func, B_FALSE);
576 			if (error == 0)
577 				goto save_ire;
578 			/*
579 			 * In the result of failure, ire_add() will have already
580 			 * deleted the ire in question, so there is no need to
581 			 * do that here.
582 			 */
583 			if (ipif_refheld)
584 				ipif_refrele(ipif);
585 			return (error);
586 		}
587 	}
588 
589 	/*
590 	 * Traditionally, interface routes are ones where RTF_GATEWAY isn't set
591 	 * and the gateway address provided is one of the system's interface
592 	 * addresses.  By using the routing socket interface and supplying an
593 	 * RTA_IFP sockaddr with an interface index, an alternate method of
594 	 * specifying an interface route to be created is available which uses
595 	 * the interface index that specifies the outgoing interface rather than
596 	 * the address of an outgoing interface (which may not be able to
597 	 * uniquely identify an interface).  When coupled with the RTF_GATEWAY
598 	 * flag, routes can be specified which not only specify the next-hop to
599 	 * be used when routing to a certain prefix, but also which outgoing
600 	 * interface should be used.
601 	 *
602 	 * Previously, interfaces would have unique addresses assigned to them
603 	 * and so the address assigned to a particular interface could be used
604 	 * to identify a particular interface.  One exception to this was the
605 	 * case of an unnumbered interface (where IPIF_UNNUMBERED was set).
606 	 *
607 	 * With the advent of IPv6 and its link-local addresses, this
608 	 * restriction was relaxed and interfaces could share addresses between
609 	 * themselves.  In fact, typically all of the link-local interfaces on
610 	 * an IPv6 node or router will have the same link-local address.  In
611 	 * order to differentiate between these interfaces, the use of an
612 	 * interface index is necessary and this index can be carried inside a
613 	 * RTA_IFP sockaddr (which is actually a sockaddr_dl).  One restriction
614 	 * of using the interface index, however, is that all of the ipif's that
615 	 * are part of an ill have the same index and so the RTA_IFP sockaddr
616 	 * cannot be used to differentiate between ipif's (or logical
617 	 * interfaces) that belong to the same ill (physical interface).
618 	 *
619 	 * For example, in the following case involving IPv4 interfaces and
620 	 * logical interfaces
621 	 *
622 	 *	192.0.2.32	255.255.255.224	192.0.2.33	U	if0
623 	 *	192.0.2.32	255.255.255.224	192.0.2.34	U	if0:1
624 	 *	192.0.2.32	255.255.255.224	192.0.2.35	U	if0:2
625 	 *
626 	 * the ipif's corresponding to each of these interface routes can be
627 	 * uniquely identified by the "gateway" (actually interface address).
628 	 *
629 	 * In this case involving multiple IPv6 default routes to a particular
630 	 * link-local gateway, the use of RTA_IFP is necessary to specify which
631 	 * default route is of interest:
632 	 *
633 	 *	default		fe80::123:4567:89ab:cdef	U	if0
634 	 *	default		fe80::123:4567:89ab:cdef	U	if1
635 	 */
636 
637 	/* RTF_GATEWAY not set */
638 	if (!(flags & RTF_GATEWAY)) {
639 		queue_t	*stq;
640 
641 		if (sp != NULL) {
642 			ip2dbg(("ip_rt_add_v6: gateway security attributes "
643 			    "cannot be set with interface route\n"));
644 			if (ipif_refheld)
645 				ipif_refrele(ipif);
646 			return (EINVAL);
647 		}
648 
649 		/*
650 		 * As the interface index specified with the RTA_IFP sockaddr is
651 		 * the same for all ipif's off of an ill, the matching logic
652 		 * below uses MATCH_IRE_ILL if such an index was specified.
653 		 * This means that routes sharing the same prefix when added
654 		 * using a RTA_IFP sockaddr must have distinct interface
655 		 * indices (namely, they must be on distinct ill's).
656 		 *
657 		 * On the other hand, since the gateway address will usually be
658 		 * different for each ipif on the system, the matching logic
659 		 * uses MATCH_IRE_IPIF in the case of a traditional interface
660 		 * route.  This means that interface routes for the same prefix
661 		 * can be created if they belong to distinct ipif's and if a
662 		 * RTA_IFP sockaddr is not present.
663 		 */
664 		if (ipif_arg != NULL) {
665 			if (ipif_refheld) {
666 				ipif_refrele(ipif);
667 				ipif_refheld = B_FALSE;
668 			}
669 			ipif = ipif_arg;
670 			match_flags |= MATCH_IRE_ILL;
671 		} else {
672 			/*
673 			 * Check the ipif corresponding to the gw_addr
674 			 */
675 			if (ipif == NULL)
676 				return (ENETUNREACH);
677 			match_flags |= MATCH_IRE_IPIF;
678 		}
679 
680 		ASSERT(ipif != NULL);
681 		/*
682 		 * We check for an existing entry at this point.
683 		 */
684 		match_flags |= MATCH_IRE_MASK;
685 		ire = ire_ftable_lookup_v6(dst_addr, mask, 0, IRE_INTERFACE,
686 		    ipif, NULL, ALL_ZONES, 0, NULL, match_flags, ipst);
687 		if (ire != NULL) {
688 			ire_refrele(ire);
689 			if (ipif_refheld)
690 				ipif_refrele(ipif);
691 			return (EEXIST);
692 		}
693 
694 		stq = (ipif->ipif_net_type == IRE_IF_RESOLVER)
695 		    ? ipif->ipif_rq : ipif->ipif_wq;
696 
697 		/*
698 		 * Create a copy of the IRE_LOOPBACK, IRE_IF_NORESOLVER or
699 		 * IRE_IF_RESOLVER with the modified address and netmask.
700 		 */
701 		ire = ire_create_v6(
702 		    dst_addr,
703 		    mask,
704 		    &ipif->ipif_v6src_addr,
705 		    NULL,
706 		    &ipif->ipif_mtu,
707 		    NULL,
708 		    NULL,
709 		    stq,
710 		    ipif->ipif_net_type,
711 		    ipif,
712 		    NULL,
713 		    0,
714 		    0,
715 		    flags,
716 		    &ire_uinfo_null,
717 		    NULL,
718 		    NULL,
719 		    ipst);
720 		if (ire == NULL) {
721 			if (ipif_refheld)
722 				ipif_refrele(ipif);
723 			return (ENOMEM);
724 		}
725 
726 		/*
727 		 * Some software (for example, GateD and Sun Cluster) attempts
728 		 * to create (what amount to) IRE_PREFIX routes with the
729 		 * loopback address as the gateway.  This is primarily done to
730 		 * set up prefixes with the RTF_REJECT flag set (for example,
731 		 * when generating aggregate routes). We also OR in the
732 		 * RTF_BLACKHOLE flag as these interface routes, by
733 		 * definition, can only be that.
734 		 *
735 		 * If the IRE type (as defined by ipif->ipif_net_type) is
736 		 * IRE_LOOPBACK, then we map the request into a
737 		 * IRE_IF_NORESOLVER.
738 		 *
739 		 * Needless to say, the real IRE_LOOPBACK is NOT created by this
740 		 * routine, but rather using ire_create_v6() directly.
741 		 */
742 		if (ipif->ipif_net_type == IRE_LOOPBACK) {
743 			ire->ire_type = IRE_IF_NORESOLVER;
744 			ire->ire_flags |= RTF_BLACKHOLE;
745 		}
746 		error = ire_add(&ire, q, mp, func, B_FALSE);
747 		if (error == 0)
748 			goto save_ire;
749 		/*
750 		 * In the result of failure, ire_add() will have already
751 		 * deleted the ire in question, so there is no need to
752 		 * do that here.
753 		 */
754 		if (ipif_refheld)
755 			ipif_refrele(ipif);
756 		return (error);
757 	}
758 	if (ipif_refheld) {
759 		ipif_refrele(ipif);
760 		ipif_refheld = B_FALSE;
761 	}
762 
763 	/*
764 	 * Get an interface IRE for the specified gateway.
765 	 * If we don't have an IRE_IF_NORESOLVER or IRE_IF_RESOLVER for the
766 	 * gateway, it is currently unreachable and we fail the request
767 	 * accordingly.
768 	 */
769 	ipif = ipif_arg;
770 	if (ipif_arg != NULL)
771 		match_flags |= MATCH_IRE_ILL;
772 	gw_ire = ire_ftable_lookup_v6(gw_addr, 0, 0, IRE_INTERFACE, ipif_arg,
773 	    NULL, ALL_ZONES, 0, NULL, match_flags, ipst);
774 	if (gw_ire == NULL)
775 		return (ENETUNREACH);
776 
777 	/*
778 	 * We create one of three types of IREs as a result of this request
779 	 * based on the netmask.  A netmask of all ones (which is automatically
780 	 * assumed when RTF_HOST is set) results in an IRE_HOST being created.
781 	 * An all zeroes netmask implies a default route so an IRE_DEFAULT is
782 	 * created.  Otherwise, an IRE_PREFIX route is created for the
783 	 * destination prefix.
784 	 */
785 	if (IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones))
786 		type = IRE_HOST;
787 	else if (IN6_IS_ADDR_UNSPECIFIED(mask))
788 		type = IRE_DEFAULT;
789 	else
790 		type = IRE_PREFIX;
791 
792 	/* check for a duplicate entry */
793 	ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr, type, ipif_arg,
794 	    NULL, ALL_ZONES, 0, NULL,
795 	    match_flags | MATCH_IRE_MASK | MATCH_IRE_GW, ipst);
796 	if (ire != NULL) {
797 		ire_refrele(gw_ire);
798 		ire_refrele(ire);
799 		return (EEXIST);
800 	}
801 
802 	/* Security attribute exists */
803 	if (sp != NULL) {
804 		tsol_gcgrp_addr_t ga;
805 
806 		/* find or create the gateway credentials group */
807 		ga.ga_af = AF_INET6;
808 		ga.ga_addr = *gw_addr;
809 
810 		/* we hold reference to it upon success */
811 		gcgrp = gcgrp_lookup(&ga, B_TRUE);
812 		if (gcgrp == NULL) {
813 			ire_refrele(gw_ire);
814 			return (ENOMEM);
815 		}
816 
817 		/*
818 		 * Create and add the security attribute to the group; a
819 		 * reference to the group is made upon allocating a new
820 		 * entry successfully.  If it finds an already-existing
821 		 * entry for the security attribute in the group, it simply
822 		 * returns it and no new reference is made to the group.
823 		 */
824 		gc = gc_create(sp, gcgrp, &gcgrp_xtraref);
825 		if (gc == NULL) {
826 			/* release reference held by gcgrp_lookup */
827 			GCGRP_REFRELE(gcgrp);
828 			ire_refrele(gw_ire);
829 			return (ENOMEM);
830 		}
831 	}
832 
833 	/* Create the IRE. */
834 	ire = ire_create_v6(
835 	    dst_addr,				/* dest address */
836 	    mask,				/* mask */
837 	    /* src address assigned by the caller? */
838 	    (((flags & RTF_SETSRC) && !IN6_IS_ADDR_UNSPECIFIED(src_addr)) ?
839 	    src_addr : NULL),
840 	    gw_addr,				/* gateway address */
841 	    &gw_ire->ire_max_frag,
842 	    NULL,				/* no src nce */
843 	    NULL,				/* no recv-from queue */
844 	    NULL,				/* no send-to queue */
845 	    (ushort_t)type,			/* IRE type */
846 	    ipif_arg,
847 	    NULL,
848 	    0,
849 	    0,
850 	    flags,
851 	    &gw_ire->ire_uinfo,			/* Inherit ULP info from gw */
852 	    gc,					/* security attribute */
853 	    NULL,
854 	    ipst);
855 
856 	/*
857 	 * The ire holds a reference to the 'gc' and the 'gc' holds a
858 	 * reference to the 'gcgrp'. We can now release the extra reference
859 	 * the 'gcgrp' acquired in the gcgrp_lookup, if it was not used.
860 	 */
861 	if (gcgrp_xtraref)
862 		GCGRP_REFRELE(gcgrp);
863 	if (ire == NULL) {
864 		if (gc != NULL)
865 			GC_REFRELE(gc);
866 		ire_refrele(gw_ire);
867 		return (ENOMEM);
868 	}
869 
870 	/*
871 	 * POLICY: should we allow an RTF_HOST with address INADDR_ANY?
872 	 * SUN/OS socket stuff does but do we really want to allow ::0 ?
873 	 */
874 
875 	/* Add the new IRE. */
876 	error = ire_add(&ire, q, mp, func, B_FALSE);
877 	/*
878 	 * In the result of failure, ire_add() will have already
879 	 * deleted the ire in question, so there is no need to
880 	 * do that here.
881 	 */
882 	if (error != 0) {
883 		ire_refrele(gw_ire);
884 		return (error);
885 	}
886 
887 	if (flags & RTF_MULTIRT) {
888 		/*
889 		 * Invoke the CGTP (multirouting) filtering module
890 		 * to add the dst address in the filtering database.
891 		 * Replicated inbound packets coming from that address
892 		 * will be filtered to discard the duplicates.
893 		 * It is not necessary to call the CGTP filter hook
894 		 * when the dst address is a multicast, because an
895 		 * IP source address cannot be a multicast.
896 		 */
897 		if (ipst->ips_ip_cgtp_filter_ops != NULL &&
898 		    !IN6_IS_ADDR_MULTICAST(&(ire->ire_addr_v6))) {
899 			int res;
900 
901 			res = ipst->ips_ip_cgtp_filter_ops->cfo_add_dest_v6(
902 			    ipst->ips_netstack->netstack_stackid,
903 			    &ire->ire_addr_v6,
904 			    &ire->ire_gateway_addr_v6,
905 			    &ire->ire_src_addr_v6,
906 			    &gw_ire->ire_src_addr_v6);
907 			if (res != 0) {
908 				ire_refrele(gw_ire);
909 				ire_delete(ire);
910 				return (res);
911 			}
912 		}
913 	}
914 
915 	/*
916 	 * Now that the prefix IRE entry has been created, delete any
917 	 * existing gateway IRE cache entries as well as any IRE caches
918 	 * using the gateway, and force them to be created through
919 	 * ip_newroute_v6.
920 	 */
921 	if (gc != NULL) {
922 		ASSERT(gcgrp != NULL);
923 		ire_clookup_delete_cache_gw_v6(gw_addr, ALL_ZONES, ipst);
924 	}
925 
926 save_ire:
927 	if (gw_ire != NULL) {
928 		ire_refrele(gw_ire);
929 	}
930 	if (ipif != NULL) {
931 		mblk_t	*save_mp;
932 
933 		/*
934 		 * Save enough information so that we can recreate the IRE if
935 		 * the interface goes down and then up.  The metrics associated
936 		 * with the route will be saved as well when rts_setmetrics() is
937 		 * called after the IRE has been created.  In the case where
938 		 * memory cannot be allocated, none of this information will be
939 		 * saved.
940 		 */
941 		save_mp = allocb(sizeof (ifrt_t), BPRI_MED);
942 		if (save_mp != NULL) {
943 			ifrt_t	*ifrt;
944 
945 			save_mp->b_wptr += sizeof (ifrt_t);
946 			ifrt = (ifrt_t *)save_mp->b_rptr;
947 			bzero(ifrt, sizeof (ifrt_t));
948 			ifrt->ifrt_type = ire->ire_type;
949 			ifrt->ifrt_v6addr = ire->ire_addr_v6;
950 			mutex_enter(&ire->ire_lock);
951 			ifrt->ifrt_v6gateway_addr = ire->ire_gateway_addr_v6;
952 			ifrt->ifrt_v6src_addr = ire->ire_src_addr_v6;
953 			mutex_exit(&ire->ire_lock);
954 			ifrt->ifrt_v6mask = ire->ire_mask_v6;
955 			ifrt->ifrt_flags = ire->ire_flags;
956 			ifrt->ifrt_max_frag = ire->ire_max_frag;
957 			mutex_enter(&ipif->ipif_saved_ire_lock);
958 			save_mp->b_cont = ipif->ipif_saved_ire_mp;
959 			ipif->ipif_saved_ire_mp = save_mp;
960 			ipif->ipif_saved_ire_cnt++;
961 			mutex_exit(&ipif->ipif_saved_ire_lock);
962 		}
963 	}
964 	if (ire_arg != NULL) {
965 		/*
966 		 * Store the ire that was successfully added into where ire_arg
967 		 * points to so that callers don't have to look it up
968 		 * themselves (but they are responsible for ire_refrele()ing
969 		 * the ire when they are finished with it).
970 		 */
971 		*ire_arg = ire;
972 	} else {
973 		ire_refrele(ire);		/* Held in ire_add */
974 	}
975 	if (ipif_refheld)
976 		ipif_refrele(ipif);
977 	return (0);
978 }
979 
980 /*
981  * ip_rt_delete_v6 is called to delete an IPv6 route.
982  * ipif_arg is passed in to associate it with the correct interface
983  * (for link-local destinations and gateways).
984  */
985 /* ARGSUSED4 */
986 int
987 ip_rt_delete_v6(const in6_addr_t *dst_addr, const in6_addr_t *mask,
988     const in6_addr_t *gw_addr, uint_t rtm_addrs, int flags, ipif_t *ipif_arg,
989     queue_t *q, mblk_t *mp, ipsq_func_t func, ip_stack_t *ipst)
990 {
991 	ire_t	*ire = NULL;
992 	ipif_t	*ipif;
993 	uint_t	type;
994 	uint_t	match_flags = MATCH_IRE_TYPE;
995 	int	err = 0;
996 	boolean_t	ipif_refheld = B_FALSE;
997 
998 	/*
999 	 * If this is the case of RTF_HOST being set, then we set the netmask
1000 	 * to all ones.  Otherwise, we use the netmask if one was supplied.
1001 	 */
1002 	if (flags & RTF_HOST) {
1003 		mask = &ipv6_all_ones;
1004 		match_flags |= MATCH_IRE_MASK;
1005 	} else if (rtm_addrs & RTA_NETMASK) {
1006 		match_flags |= MATCH_IRE_MASK;
1007 	}
1008 
1009 	/*
1010 	 * Note that RTF_GATEWAY is never set on a delete, therefore
1011 	 * we check if the gateway address is one of our interfaces first,
1012 	 * and fall back on RTF_GATEWAY routes.
1013 	 *
1014 	 * This makes it possible to delete an original
1015 	 * IRE_IF_NORESOLVER/IRE_IF_RESOLVER - consistent with SunOS 4.1.
1016 	 *
1017 	 * As the interface index specified with the RTA_IFP sockaddr is the
1018 	 * same for all ipif's off of an ill, the matching logic below uses
1019 	 * MATCH_IRE_ILL if such an index was specified.  This means a route
1020 	 * sharing the same prefix and interface index as the the route
1021 	 * intended to be deleted might be deleted instead if a RTA_IFP sockaddr
1022 	 * is specified in the request.
1023 	 *
1024 	 * On the other hand, since the gateway address will usually be
1025 	 * different for each ipif on the system, the matching logic
1026 	 * uses MATCH_IRE_IPIF in the case of a traditional interface
1027 	 * route.  This means that interface routes for the same prefix can be
1028 	 * uniquely identified if they belong to distinct ipif's and if a
1029 	 * RTA_IFP sockaddr is not present.
1030 	 *
1031 	 * For more detail on specifying routes by gateway address and by
1032 	 * interface index, see the comments in ip_rt_add_v6().
1033 	 */
1034 	ipif = ipif_lookup_interface_v6(gw_addr, dst_addr, q, mp, func, &err,
1035 	    ipst);
1036 	if (ipif != NULL) {
1037 		ipif_refheld = B_TRUE;
1038 		if (ipif_arg != NULL) {
1039 			ipif_refrele(ipif);
1040 			ipif_refheld = B_FALSE;
1041 			ipif = ipif_arg;
1042 			match_flags |= MATCH_IRE_ILL;
1043 		} else {
1044 			match_flags |= MATCH_IRE_IPIF;
1045 		}
1046 
1047 		if (ipif->ipif_ire_type == IRE_LOOPBACK)
1048 			ire = ire_ctable_lookup_v6(dst_addr, 0, IRE_LOOPBACK,
1049 			    ipif, ALL_ZONES, NULL, match_flags, ipst);
1050 		if (ire == NULL)
1051 			ire = ire_ftable_lookup_v6(dst_addr, mask, 0,
1052 			    IRE_INTERFACE, ipif, NULL, ALL_ZONES, 0, NULL,
1053 			    match_flags, ipst);
1054 	} else if (err == EINPROGRESS) {
1055 		return (err);
1056 	} else {
1057 		err = 0;
1058 	}
1059 	if (ire == NULL) {
1060 		/*
1061 		 * At this point, the gateway address is not one of our own
1062 		 * addresses or a matching interface route was not found.  We
1063 		 * set the IRE type to lookup based on whether
1064 		 * this is a host route, a default route or just a prefix.
1065 		 *
1066 		 * If an ipif_arg was passed in, then the lookup is based on an
1067 		 * interface index so MATCH_IRE_ILL is added to match_flags.
1068 		 * In any case, MATCH_IRE_IPIF is cleared and MATCH_IRE_GW is
1069 		 * set as the route being looked up is not a traditional
1070 		 * interface route.
1071 		 */
1072 		match_flags &= ~MATCH_IRE_IPIF;
1073 		match_flags |= MATCH_IRE_GW;
1074 		if (ipif_arg != NULL)
1075 			match_flags |= MATCH_IRE_ILL;
1076 		if (IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones))
1077 			type = IRE_HOST;
1078 		else if (IN6_IS_ADDR_UNSPECIFIED(mask))
1079 			type = IRE_DEFAULT;
1080 		else
1081 			type = IRE_PREFIX;
1082 		ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr, type,
1083 		    ipif_arg, NULL, ALL_ZONES, 0, NULL, match_flags, ipst);
1084 	}
1085 
1086 	if (ipif_refheld) {
1087 		ipif_refrele(ipif);
1088 		ipif_refheld = B_FALSE;
1089 	}
1090 	if (ire == NULL)
1091 		return (ESRCH);
1092 
1093 	if (ire->ire_flags & RTF_MULTIRT) {
1094 		/*
1095 		 * Invoke the CGTP (multirouting) filtering module
1096 		 * to remove the dst address from the filtering database.
1097 		 * Packets coming from that address will no longer be
1098 		 * filtered to remove duplicates.
1099 		 */
1100 		if (ipst->ips_ip_cgtp_filter_ops != NULL) {
1101 			err = ipst->ips_ip_cgtp_filter_ops->cfo_del_dest_v6(
1102 			    ipst->ips_netstack->netstack_stackid,
1103 			    &ire->ire_addr_v6, &ire->ire_gateway_addr_v6);
1104 		}
1105 	}
1106 
1107 	ipif = ire->ire_ipif;
1108 	if (ipif != NULL) {
1109 		mblk_t		**mpp;
1110 		mblk_t		*mp;
1111 		ifrt_t		*ifrt;
1112 		in6_addr_t	gw_addr_v6;
1113 
1114 		/* Remove from ipif_saved_ire_mp list if it is there */
1115 		mutex_enter(&ire->ire_lock);
1116 		gw_addr_v6 = ire->ire_gateway_addr_v6;
1117 		mutex_exit(&ire->ire_lock);
1118 		mutex_enter(&ipif->ipif_saved_ire_lock);
1119 		for (mpp = &ipif->ipif_saved_ire_mp; *mpp != NULL;
1120 		    mpp = &(*mpp)->b_cont) {
1121 			/*
1122 			 * On a given ipif, the triple of address, gateway and
1123 			 * mask is unique for each saved IRE (in the case of
1124 			 * ordinary interface routes, the gateway address is
1125 			 * all-zeroes).
1126 			 */
1127 			mp = *mpp;
1128 			ifrt = (ifrt_t *)mp->b_rptr;
1129 			if (IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6addr,
1130 			    &ire->ire_addr_v6) &&
1131 			    IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6gateway_addr,
1132 			    &gw_addr_v6) &&
1133 			    IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6mask,
1134 			    &ire->ire_mask_v6)) {
1135 				*mpp = mp->b_cont;
1136 				ipif->ipif_saved_ire_cnt--;
1137 				freeb(mp);
1138 				break;
1139 			}
1140 		}
1141 		mutex_exit(&ipif->ipif_saved_ire_lock);
1142 	}
1143 	ire_delete(ire);
1144 	ire_refrele(ire);
1145 	return (err);
1146 }
1147 
1148 /*
1149  * Derive a token from the link layer address.
1150  */
1151 boolean_t
1152 ill_setdefaulttoken(ill_t *ill)
1153 {
1154 	int		i;
1155 	in6_addr_t	v6addr, v6mask;
1156 
1157 	if (!MEDIA_V6INTFID(ill->ill_media, ill, &v6addr))
1158 		return (B_FALSE);
1159 
1160 	(void) ip_plen_to_mask_v6(IPV6_TOKEN_LEN, &v6mask);
1161 
1162 	for (i = 0; i < 4; i++)
1163 		v6mask.s6_addr32[i] = v6mask.s6_addr32[i] ^
1164 		    (uint32_t)0xffffffff;
1165 
1166 	V6_MASK_COPY(v6addr, v6mask, ill->ill_token);
1167 	ill->ill_token_length = IPV6_TOKEN_LEN;
1168 	return (B_TRUE);
1169 }
1170 
1171 /*
1172  * Create a link-local address from a token.
1173  */
1174 static void
1175 ipif_get_linklocal(in6_addr_t *dest, const in6_addr_t *token)
1176 {
1177 	int i;
1178 
1179 	for (i = 0; i < 4; i++) {
1180 		dest->s6_addr32[i] =
1181 		    token->s6_addr32[i] | ipv6_ll_template.s6_addr32[i];
1182 	}
1183 }
1184 
1185 /*
1186  * Set a nice default address for either automatic tunnels tsrc/96 or
1187  * 6to4 tunnels 2002:<tsrc>::1/64
1188  */
1189 static void
1190 ipif_set_tun_auto_addr(ipif_t *ipif, struct iftun_req *ta)
1191 {
1192 	sin6_t	sin6;
1193 	sin_t	*sin;
1194 	ill_t	*ill = ipif->ipif_ill;
1195 	tun_t *tp = (tun_t *)ill->ill_wq->q_next->q_ptr;
1196 
1197 	if (ta->ifta_saddr.ss_family != AF_INET ||
1198 	    (ipif->ipif_flags & IPIF_UP) || !ipif->ipif_isv6 ||
1199 	    (ta->ifta_flags & IFTUN_SRC) == 0)
1200 		return;
1201 
1202 	/*
1203 	 * Check the tunnel type by examining q_next->q_ptr
1204 	 */
1205 	if (tp->tun_flags & TUN_AUTOMATIC) {
1206 		/* this is an automatic tunnel */
1207 		(void) ip_plen_to_mask_v6(IPV6_ABITS - IP_ABITS,
1208 		    &ipif->ipif_v6net_mask);
1209 		bzero(&sin6, sizeof (sin6_t));
1210 		sin = (sin_t *)&ta->ifta_saddr;
1211 		V4_PART_OF_V6(sin6.sin6_addr) = sin->sin_addr.s_addr;
1212 		sin6.sin6_family = AF_INET6;
1213 		(void) ip_sioctl_addr(ipif, (sin_t *)&sin6,
1214 		    NULL, NULL, NULL, NULL);
1215 	} else if (tp->tun_flags & TUN_6TO4) {
1216 		/* this is a 6to4 tunnel */
1217 		(void) ip_plen_to_mask_v6(IPV6_PREFIX_LEN,
1218 		    &ipif->ipif_v6net_mask);
1219 		sin = (sin_t *)&ta->ifta_saddr;
1220 		/* create a 6to4 address from the IPv4 tsrc */
1221 		IN6_V4ADDR_TO_6TO4(&sin->sin_addr, &sin6.sin6_addr);
1222 		sin6.sin6_family = AF_INET6;
1223 		(void) ip_sioctl_addr(ipif, (sin_t *)&sin6,
1224 		    NULL, NULL, NULL, NULL);
1225 	} else {
1226 		ip1dbg(("ipif_set_tun_auto_addr: Unknown tunnel type"));
1227 		return;
1228 	}
1229 }
1230 
1231 /*
1232  * Set link local for ipif_id 0 of a configured tunnel based on the
1233  * tsrc or tdst parameter
1234  * For tunnels over IPv4 use the IPv4 address prepended with 32 zeros as
1235  * the token.
1236  * For tunnels over IPv6 use the low-order 64 bits of the "inner" IPv6 address
1237  * as the token for the "outer" link.
1238  */
1239 void
1240 ipif_set_tun_llink(ill_t *ill, struct iftun_req *ta)
1241 {
1242 	ipif_t		*ipif;
1243 	sin_t		*sin;
1244 	in6_addr_t	*s6addr;
1245 
1246 	ASSERT(IAM_WRITER_ILL(ill));
1247 
1248 	/* The first ipif must be id zero. */
1249 	ipif = ill->ill_ipif;
1250 	ASSERT(ipif->ipif_id == 0);
1251 
1252 	/* no link local for automatic tunnels */
1253 	if (!(ipif->ipif_flags & IPIF_POINTOPOINT)) {
1254 		ipif_set_tun_auto_addr(ipif, ta);
1255 		return;
1256 	}
1257 
1258 	if ((ta->ifta_flags & IFTUN_DST) &&
1259 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6pp_dst_addr)) {
1260 		sin6_t  sin6;
1261 
1262 		ASSERT(!(ipif->ipif_flags & IPIF_UP));
1263 		bzero(&sin6, sizeof (sin6_t));
1264 		if ((ta->ifta_saddr.ss_family == AF_INET)) {
1265 			sin = (sin_t *)&ta->ifta_daddr;
1266 			V4_PART_OF_V6(sin6.sin6_addr) =
1267 			    sin->sin_addr.s_addr;
1268 		} else {
1269 			s6addr =
1270 			    &((sin6_t *)&ta->ifta_daddr)->sin6_addr;
1271 			sin6.sin6_addr.s6_addr32[3] = s6addr->s6_addr32[3];
1272 			sin6.sin6_addr.s6_addr32[2] = s6addr->s6_addr32[2];
1273 		}
1274 		ipif_get_linklocal(&ipif->ipif_v6pp_dst_addr,
1275 		    &sin6.sin6_addr);
1276 		ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr;
1277 	}
1278 	if ((ta->ifta_flags & IFTUN_SRC)) {
1279 		ASSERT(!(ipif->ipif_flags & IPIF_UP));
1280 
1281 		/* Set the token if it isn't already set */
1282 		if (IN6_IS_ADDR_UNSPECIFIED(&ill->ill_token)) {
1283 			if ((ta->ifta_saddr.ss_family == AF_INET)) {
1284 				sin = (sin_t *)&ta->ifta_saddr;
1285 				V4_PART_OF_V6(ill->ill_token) =
1286 				    sin->sin_addr.s_addr;
1287 			} else {
1288 				s6addr =
1289 				    &((sin6_t *)&ta->ifta_saddr)->sin6_addr;
1290 				ill->ill_token.s6_addr32[3] =
1291 				    s6addr->s6_addr32[3];
1292 				ill->ill_token.s6_addr32[2] =
1293 				    s6addr->s6_addr32[2];
1294 			}
1295 			ill->ill_token_length = IPV6_TOKEN_LEN;
1296 		}
1297 		/*
1298 		 * Attempt to set the link local address if it isn't set.
1299 		 */
1300 		if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr))
1301 			(void) ipif_setlinklocal(ipif);
1302 	}
1303 }
1304 
1305 /*
1306  * Is it not possible to set the link local address?
1307  * The address can be set if the token is set, and the token
1308  * isn't too long.
1309  * Return B_TRUE if the address can't be set, or B_FALSE if it can.
1310  */
1311 boolean_t
1312 ipif_cant_setlinklocal(ipif_t *ipif)
1313 {
1314 	ill_t *ill = ipif->ipif_ill;
1315 
1316 	if (IN6_IS_ADDR_UNSPECIFIED(&ill->ill_token) ||
1317 	    ill->ill_token_length > IPV6_ABITS - IPV6_LL_PREFIXLEN)
1318 		return (B_TRUE);
1319 
1320 	return (B_FALSE);
1321 }
1322 
1323 /*
1324  * Generate a link-local address from the token.
1325  * Return zero if the address was set, or non-zero if it couldn't be set.
1326  */
1327 int
1328 ipif_setlinklocal(ipif_t *ipif)
1329 {
1330 	ill_t		*ill = ipif->ipif_ill;
1331 	in6_addr_t	ov6addr;
1332 
1333 	ASSERT(IAM_WRITER_ILL(ill));
1334 
1335 	if (ipif_cant_setlinklocal(ipif))
1336 		return (-1);
1337 
1338 	ov6addr = ipif->ipif_v6lcl_addr;
1339 	ipif_get_linklocal(&ipif->ipif_v6lcl_addr, &ill->ill_token);
1340 	sctp_update_ipif_addr(ipif, ov6addr);
1341 	(void) ip_plen_to_mask_v6(IPV6_LL_PREFIXLEN, &ipif->ipif_v6net_mask);
1342 	V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
1343 	    ipif->ipif_v6subnet);
1344 
1345 	if (ipif->ipif_flags & IPIF_NOLOCAL) {
1346 		ipif->ipif_v6src_addr = ipv6_all_zeros;
1347 	} else {
1348 		ipif->ipif_v6src_addr = ipif->ipif_v6lcl_addr;
1349 	}
1350 	return (0);
1351 }
1352 
1353 /*
1354  * This function sets up the multicast mappings in NDP.
1355  * Unlike ARP, there are no mapping_mps here. We delete the
1356  * mapping nces and add a new one.
1357  *
1358  * Returns non-zero on error and 0 on success.
1359  */
1360 int
1361 ipif_ndp_setup_multicast(ipif_t *ipif, nce_t **ret_nce)
1362 {
1363 	ill_t		*ill = ipif->ipif_ill;
1364 	in6_addr_t	v6_mcast_addr = {(uint32_t)V6_MCAST, 0, 0, 0};
1365 	in6_addr_t	v6_mcast_mask = {(uint32_t)V6_MCAST, 0, 0, 0};
1366 	in6_addr_t	v6_extract_mask;
1367 	uchar_t		*phys_addr, *bphys_addr, *alloc_phys;
1368 	nce_t		*mnce = NULL;
1369 	int		err = 0;
1370 	phyint_t	*phyi = ill->ill_phyint;
1371 	uint32_t	hw_extract_start;
1372 	dl_unitdata_req_t *dlur;
1373 	ip_stack_t	*ipst = ill->ill_ipst;
1374 
1375 	if (ret_nce != NULL)
1376 		*ret_nce = NULL;
1377 
1378 	/*
1379 	 * IPMP meta-interfaces don't have any inherent multicast mappings,
1380 	 * and instead use the ones on the underlying interfaces.
1381 	 */
1382 	if (IS_IPMP(ill))
1383 		return (0);
1384 
1385 	/*
1386 	 * Delete the mapping nce. Normally these should not exist
1387 	 * as a previous ipif_down -> ipif_ndp_down should have deleted
1388 	 * all the nces. But they can exist if ip_rput_dlpi_writer
1389 	 * calls this when PHYI_MULTI_BCAST is set.  Mappings are always
1390 	 * tied to the underlying ill, so don't match across the illgrp.
1391 	 */
1392 	mnce = ndp_lookup_v6(ill, B_FALSE, &v6_mcast_addr, B_FALSE);
1393 	if (mnce != NULL) {
1394 		ndp_delete(mnce);
1395 		NCE_REFRELE(mnce);
1396 		mnce = NULL;
1397 	}
1398 
1399 	/*
1400 	 * Get media specific v6 mapping information. Note that
1401 	 * nd_lla_len can be 0 for tunnels.
1402 	 */
1403 	alloc_phys = kmem_alloc(ill->ill_nd_lla_len, KM_NOSLEEP);
1404 	if ((alloc_phys == NULL) && (ill->ill_nd_lla_len != 0))
1405 		return (ENOMEM);
1406 	/*
1407 	 * Determine the broadcast address.
1408 	 */
1409 	dlur = (dl_unitdata_req_t *)ill->ill_bcast_mp->b_rptr;
1410 	if (ill->ill_sap_length < 0)
1411 		bphys_addr = (uchar_t *)dlur + dlur->dl_dest_addr_offset;
1412 	else
1413 		bphys_addr = (uchar_t *)dlur +
1414 		    dlur->dl_dest_addr_offset + ill->ill_sap_length;
1415 
1416 	/*
1417 	 * Check PHYI_MULTI_BCAST and possible length of physical
1418 	 * address to determine if we use the mapping or the
1419 	 * broadcast address.
1420 	 */
1421 	if ((phyi->phyint_flags & PHYI_MULTI_BCAST) ||
1422 	    (!MEDIA_V6MINFO(ill->ill_media, ill->ill_nd_lla_len,
1423 	    bphys_addr, alloc_phys, &hw_extract_start,
1424 	    &v6_extract_mask))) {
1425 		if (ill->ill_phys_addr_length > IP_MAX_HW_LEN) {
1426 			kmem_free(alloc_phys, ill->ill_nd_lla_len);
1427 			return (E2BIG);
1428 		}
1429 		/* Use the link-layer broadcast address for MULTI_BCAST */
1430 		phys_addr = bphys_addr;
1431 		bzero(&v6_extract_mask, sizeof (v6_extract_mask));
1432 		hw_extract_start = ill->ill_nd_lla_len;
1433 	} else {
1434 		phys_addr = alloc_phys;
1435 	}
1436 	if ((ipif->ipif_flags & IPIF_BROADCAST) ||
1437 	    (ill->ill_flags & ILLF_MULTICAST) ||
1438 	    (phyi->phyint_flags & PHYI_MULTI_BCAST)) {
1439 		mutex_enter(&ipst->ips_ndp6->ndp_g_lock);
1440 		err = ndp_add_v6(ill,
1441 		    phys_addr,
1442 		    &v6_mcast_addr,	/* v6 address */
1443 		    &v6_mcast_mask,	/* v6 mask */
1444 		    &v6_extract_mask,
1445 		    hw_extract_start,
1446 		    NCE_F_MAPPING | NCE_F_PERMANENT | NCE_F_NONUD,
1447 		    ND_REACHABLE,
1448 		    &mnce);
1449 		mutex_exit(&ipst->ips_ndp6->ndp_g_lock);
1450 		if (err == 0) {
1451 			if (ret_nce != NULL) {
1452 				*ret_nce = mnce;
1453 			} else {
1454 				NCE_REFRELE(mnce);
1455 			}
1456 		}
1457 	}
1458 	kmem_free(alloc_phys, ill->ill_nd_lla_len);
1459 	return (err);
1460 }
1461 
1462 /*
1463  * Get the resolver set up for a new ipif.  (Always called as writer.)
1464  */
1465 int
1466 ipif_ndp_up(ipif_t *ipif, boolean_t initial)
1467 {
1468 	ill_t		*ill = ipif->ipif_ill;
1469 	int		err = 0;
1470 	nce_t		*nce = NULL;
1471 	nce_t		*mnce = NULL;
1472 	boolean_t	added_ipif = B_FALSE;
1473 
1474 	ASSERT(IAM_WRITER_ILL(ill));
1475 	ip1dbg(("ipif_ndp_up(%s:%u)\n", ill->ill_name, ipif->ipif_id));
1476 
1477 	/*
1478 	 * ND not supported on XRESOLV interfaces. If ND support (multicast)
1479 	 * added later, take out this check.
1480 	 */
1481 	if ((ill->ill_flags & ILLF_XRESOLV) ||
1482 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) ||
1483 	    (!(ill->ill_net_type & IRE_INTERFACE))) {
1484 		ipif->ipif_addr_ready = 1;
1485 		return (0);
1486 	}
1487 
1488 	/*
1489 	 * Need to setup multicast mapping only when the first
1490 	 * interface is coming UP.
1491 	 */
1492 	if (ill->ill_ipif_up_count == 0 &&
1493 	    (ill->ill_flags & ILLF_MULTICAST)) {
1494 		/*
1495 		 * We set the multicast before setting up the mapping for
1496 		 * local address because ipif_ndp_setup_multicast does
1497 		 * ndp_walk to delete nces which will delete the mapping
1498 		 * for local address also if we added the mapping for
1499 		 * local address first.
1500 		 */
1501 		err = ipif_ndp_setup_multicast(ipif, &mnce);
1502 		if (err != 0)
1503 			return (err);
1504 	}
1505 
1506 	if ((ipif->ipif_flags & (IPIF_UNNUMBERED|IPIF_NOLOCAL)) == 0) {
1507 		uint16_t	flags;
1508 		uint16_t	state;
1509 		uchar_t		*hw_addr = NULL;
1510 		ill_t		*bound_ill;
1511 		ipmp_illgrp_t	*illg = ill->ill_grp;
1512 
1513 		/* Permanent entries don't need NUD */
1514 		flags = NCE_F_PERMANENT | NCE_F_NONUD;
1515 		if (ill->ill_flags & ILLF_ROUTER)
1516 			flags |= NCE_F_ISROUTER;
1517 
1518 		if (ipif->ipif_flags & IPIF_ANYCAST)
1519 			flags |= NCE_F_ANYCAST;
1520 
1521 		if (IS_IPMP(ill)) {
1522 			ASSERT(ill->ill_net_type == IRE_IF_RESOLVER);
1523 			/*
1524 			 * If we're here via ipif_up(), then the ipif won't be
1525 			 * bound yet -- add it to the group, which will bind
1526 			 * it if possible.  (We would add it in ipif_up(), but
1527 			 * deleting on failure there is gruesome.)  If we're
1528 			 * here via ipmp_ill_bind_ipif(), then the ipif has
1529 			 * already been added to the group and we just need to
1530 			 * use the binding.
1531 			 */
1532 			if ((bound_ill = ipmp_ipif_bound_ill(ipif)) == NULL) {
1533 				bound_ill = ipmp_illgrp_add_ipif(illg, ipif);
1534 				if (bound_ill == NULL) {
1535 					/*
1536 					 * We couldn't bind the ipif to an ill
1537 					 * yet, so we have nothing to publish.
1538 					 * Set ipif_addr_ready so that this
1539 					 * address can be used locally for now.
1540 					 * The routing socket message will be
1541 					 * sent from ipif_up_done_v6().
1542 					 */
1543 					ipif->ipif_addr_ready = 1;
1544 					return (0);
1545 				}
1546 				added_ipif = B_TRUE;
1547 			}
1548 			hw_addr = bound_ill->ill_nd_lla;
1549 		} else {
1550 			bound_ill = ill;
1551 			if (ill->ill_net_type == IRE_IF_RESOLVER)
1552 				hw_addr = ill->ill_nd_lla;
1553 		}
1554 
1555 		/*
1556 		 * If this is an initial bring-up (or the ipif was never
1557 		 * completely brought up), do DAD.  Otherwise, we're here
1558 		 * because IPMP has rebound an address to this ill: send
1559 		 * unsolicited advertisements to inform others.
1560 		 */
1561 		if (initial || !ipif->ipif_addr_ready) {
1562 			state = ND_PROBE;
1563 		} else {
1564 			state = ND_REACHABLE;
1565 			flags |= NCE_F_UNSOL_ADV;
1566 		}
1567 		/*
1568 		 * Create an nce for the local address. We pass a match_illgrp
1569 		 * of B_TRUE because the local address must be unique across
1570 		 * the illgrp, and the existence of an nce with nce_ill set
1571 		 * to any ill in the group is indicative of a duplicate address
1572 		 */
1573 		err = ndp_lookup_then_add_v6(bound_ill,
1574 		    B_TRUE,
1575 		    hw_addr,
1576 		    &ipif->ipif_v6lcl_addr,
1577 		    &ipv6_all_ones,
1578 		    &ipv6_all_zeros,
1579 		    0,
1580 		    flags,
1581 		    state,
1582 		    &nce);
1583 		switch (err) {
1584 		case 0:
1585 			ip1dbg(("ipif_ndp_up: NCE created for %s\n",
1586 			    ill->ill_name));
1587 			ipif->ipif_addr_ready = 1;
1588 			ipif->ipif_added_nce = 1;
1589 			nce->nce_ipif_cnt++;
1590 			break;
1591 		case EINPROGRESS:
1592 			ip1dbg(("ipif_ndp_up: running DAD now for %s\n",
1593 			    ill->ill_name));
1594 			ipif->ipif_added_nce = 1;
1595 			nce->nce_ipif_cnt++;
1596 			break;
1597 		case EEXIST:
1598 			ip1dbg(("ipif_ndp_up: NCE already exists for %s\n",
1599 			    ill->ill_name));
1600 			if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
1601 				NCE_REFRELE(nce);
1602 				goto fail;
1603 			}
1604 			/*
1605 			 * Duplicate local addresses are permissible for
1606 			 * IPIF_POINTOPOINT interfaces which will get marked
1607 			 * IPIF_UNNUMBERED later in
1608 			 * ip_addr_availability_check().
1609 			 *
1610 			 * The nce_ipif_cnt field tracks the number of
1611 			 * ipifs that have nce_addr as their local address.
1612 			 */
1613 			ipif->ipif_addr_ready = 1;
1614 			ipif->ipif_added_nce = 1;
1615 			nce->nce_ipif_cnt++;
1616 			break;
1617 		default:
1618 			ip1dbg(("ipif_ndp_up: NCE creation failed for %s\n",
1619 			    ill->ill_name));
1620 			goto fail;
1621 		}
1622 	} else {
1623 		/* No local NCE for this entry */
1624 		ipif->ipif_addr_ready = 1;
1625 	}
1626 	if (nce != NULL)
1627 		NCE_REFRELE(nce);
1628 	if (mnce != NULL)
1629 		NCE_REFRELE(mnce);
1630 	return (0);
1631 fail:
1632 	if (mnce != NULL) {
1633 		ndp_delete(mnce);
1634 		NCE_REFRELE(mnce);
1635 	}
1636 	if (added_ipif)
1637 		ipmp_illgrp_del_ipif(ill->ill_grp, ipif);
1638 
1639 	return (err);
1640 }
1641 
1642 /* Remove all cache entries for this logical interface */
1643 void
1644 ipif_ndp_down(ipif_t *ipif)
1645 {
1646 	nce_t	*nce;
1647 	ill_t	*ill = ipif->ipif_ill;
1648 
1649 	ASSERT(IAM_WRITER_ILL(ill));
1650 
1651 	if (ipif->ipif_isv6) {
1652 		ill_t *bound_ill;
1653 
1654 		if (IS_IPMP(ill))
1655 			bound_ill = ipmp_ipif_bound_ill(ipif);
1656 		else
1657 			bound_ill = ill;
1658 
1659 		if (bound_ill != NULL && ipif->ipif_added_nce) {
1660 			nce = ndp_lookup_v6(bound_ill,
1661 			    B_TRUE,
1662 			    &ipif->ipif_v6lcl_addr,
1663 			    B_FALSE);
1664 			if (nce == NULL)
1665 				goto no_nce;
1666 			if (--nce->nce_ipif_cnt == 0)
1667 				ndp_delete(nce); /* last ipif for nce */
1668 			ipif->ipif_added_nce = 0;
1669 			NCE_REFRELE(nce);
1670 		}
1671 no_nce:
1672 		/*
1673 		 * Make IPMP aware of the deleted data address.
1674 		 */
1675 		if (IS_IPMP(ill))
1676 			ipmp_illgrp_del_ipif(ill->ill_grp, ipif);
1677 	}
1678 
1679 	/*
1680 	 * Remove mapping and all other nces dependent on this ill
1681 	 * when the last ipif is going away.
1682 	 */
1683 	if (ill->ill_ipif_up_count == 0)
1684 		ndp_walk(ill, (pfi_t)ndp_delete_per_ill, ill, ill->ill_ipst);
1685 }
1686 
1687 /*
1688  * Used when an interface comes up to recreate any extra routes on this
1689  * interface.
1690  */
1691 static ire_t **
1692 ipif_recover_ire_v6(ipif_t *ipif)
1693 {
1694 	mblk_t	*mp;
1695 	ire_t   **ipif_saved_irep;
1696 	ire_t   **irep;
1697 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
1698 
1699 	ip1dbg(("ipif_recover_ire_v6(%s:%u)", ipif->ipif_ill->ill_name,
1700 	    ipif->ipif_id));
1701 
1702 	ASSERT(ipif->ipif_isv6);
1703 
1704 	mutex_enter(&ipif->ipif_saved_ire_lock);
1705 	ipif_saved_irep = (ire_t **)kmem_zalloc(sizeof (ire_t *) *
1706 	    ipif->ipif_saved_ire_cnt, KM_NOSLEEP);
1707 	if (ipif_saved_irep == NULL) {
1708 		mutex_exit(&ipif->ipif_saved_ire_lock);
1709 		return (NULL);
1710 	}
1711 
1712 	irep = ipif_saved_irep;
1713 
1714 	for (mp = ipif->ipif_saved_ire_mp; mp != NULL; mp = mp->b_cont) {
1715 		ire_t		*ire;
1716 		queue_t		*rfq;
1717 		queue_t		*stq;
1718 		ifrt_t		*ifrt;
1719 		in6_addr_t	*src_addr;
1720 		in6_addr_t	*gateway_addr;
1721 		char		buf[INET6_ADDRSTRLEN];
1722 		ushort_t	type;
1723 
1724 		/*
1725 		 * When the ire was initially created and then added in
1726 		 * ip_rt_add_v6(), it was created either using
1727 		 * ipif->ipif_net_type in the case of a traditional interface
1728 		 * route, or as one of the IRE_OFFSUBNET types (with the
1729 		 * exception of IRE_HOST type redirect ire which is created by
1730 		 * icmp_redirect_v6() and which we don't need to save or
1731 		 * recover).  In the case where ipif->ipif_net_type was
1732 		 * IRE_LOOPBACK, ip_rt_add_v6() will update the ire_type to
1733 		 * IRE_IF_NORESOLVER before calling ire_add_v6() to satisfy
1734 		 * software like GateD and Sun Cluster which creates routes
1735 		 * using the the loopback interface's address as a gateway.
1736 		 *
1737 		 * As ifrt->ifrt_type reflects the already updated ire_type,
1738 		 * ire_create_v6() will be called in the same way here as in
1739 		 * ip_rt_add_v6(), namely using ipif->ipif_net_type when the
1740 		 * route looks like a traditional interface route (where
1741 		 * ifrt->ifrt_type & IRE_INTERFACE is true) and otherwise
1742 		 * using the saved ifrt->ifrt_type.  This means that in
1743 		 * the case where ipif->ipif_net_type is IRE_LOOPBACK,
1744 		 * the ire created by ire_create_v6() will be an IRE_LOOPBACK,
1745 		 * it will then be turned into an IRE_IF_NORESOLVER and then
1746 		 * added by ire_add_v6().
1747 		 */
1748 		ifrt = (ifrt_t *)mp->b_rptr;
1749 		if (ifrt->ifrt_type & IRE_INTERFACE) {
1750 			rfq = NULL;
1751 			stq = (ipif->ipif_net_type == IRE_IF_RESOLVER)
1752 			    ? ipif->ipif_rq : ipif->ipif_wq;
1753 			src_addr = (ifrt->ifrt_flags & RTF_SETSRC)
1754 			    ? &ifrt->ifrt_v6src_addr
1755 			    : &ipif->ipif_v6src_addr;
1756 			gateway_addr = NULL;
1757 			type = ipif->ipif_net_type;
1758 		} else {
1759 			rfq = NULL;
1760 			stq = NULL;
1761 			src_addr = (ifrt->ifrt_flags & RTF_SETSRC)
1762 			    ? &ifrt->ifrt_v6src_addr : NULL;
1763 			gateway_addr = &ifrt->ifrt_v6gateway_addr;
1764 			type = ifrt->ifrt_type;
1765 		}
1766 
1767 		/*
1768 		 * Create a copy of the IRE with the saved address and netmask.
1769 		 */
1770 		ip1dbg(("ipif_recover_ire_v6: creating IRE %s (%d) for %s/%d\n",
1771 		    ip_nv_lookup(ire_nv_tbl, ifrt->ifrt_type), ifrt->ifrt_type,
1772 		    inet_ntop(AF_INET6, &ifrt->ifrt_v6addr, buf, sizeof (buf)),
1773 		    ip_mask_to_plen_v6(&ifrt->ifrt_v6mask)));
1774 		ire = ire_create_v6(
1775 		    &ifrt->ifrt_v6addr,
1776 		    &ifrt->ifrt_v6mask,
1777 		    src_addr,
1778 		    gateway_addr,
1779 		    &ifrt->ifrt_max_frag,
1780 		    NULL,
1781 		    rfq,
1782 		    stq,
1783 		    type,
1784 		    ipif,
1785 		    NULL,
1786 		    0,
1787 		    0,
1788 		    ifrt->ifrt_flags,
1789 		    &ifrt->ifrt_iulp_info,
1790 		    NULL,
1791 		    NULL,
1792 		    ipst);
1793 		if (ire == NULL) {
1794 			mutex_exit(&ipif->ipif_saved_ire_lock);
1795 			kmem_free(ipif_saved_irep,
1796 			    ipif->ipif_saved_ire_cnt * sizeof (ire_t *));
1797 			return (NULL);
1798 		}
1799 
1800 		/*
1801 		 * Some software (for example, GateD and Sun Cluster) attempts
1802 		 * to create (what amount to) IRE_PREFIX routes with the
1803 		 * loopback address as the gateway.  This is primarily done to
1804 		 * set up prefixes with the RTF_REJECT flag set (for example,
1805 		 * when generating aggregate routes.)
1806 		 *
1807 		 * If the IRE type (as defined by ipif->ipif_net_type) is
1808 		 * IRE_LOOPBACK, then we map the request into a
1809 		 * IRE_IF_NORESOLVER.
1810 		 */
1811 		if (ipif->ipif_net_type == IRE_LOOPBACK)
1812 			ire->ire_type = IRE_IF_NORESOLVER;
1813 		/*
1814 		 * ire held by ire_add, will be refreled' in ipif_up_done
1815 		 * towards the end
1816 		 */
1817 		(void) ire_add(&ire, NULL, NULL, NULL, B_FALSE);
1818 		*irep = ire;
1819 		irep++;
1820 		ip1dbg(("ipif_recover_ire_v6: added ire %p\n", (void *)ire));
1821 	}
1822 	mutex_exit(&ipif->ipif_saved_ire_lock);
1823 	return (ipif_saved_irep);
1824 }
1825 
1826 /*
1827  * Return the scope of the given IPv6 address.  If the address is an
1828  * IPv4 mapped IPv6 address, return the scope of the corresponding
1829  * IPv4 address.
1830  */
1831 in6addr_scope_t
1832 ip_addr_scope_v6(const in6_addr_t *addr)
1833 {
1834 	static in6_addr_t ipv6loopback = IN6ADDR_LOOPBACK_INIT;
1835 
1836 	if (IN6_IS_ADDR_V4MAPPED(addr)) {
1837 		in_addr_t v4addr_h = ntohl(V4_PART_OF_V6((*addr)));
1838 		if ((v4addr_h >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET ||
1839 		    (v4addr_h & IN_AUTOCONF_MASK) == IN_AUTOCONF_NET)
1840 			return (IP6_SCOPE_LINKLOCAL);
1841 		if ((v4addr_h & IN_PRIVATE8_MASK) == IN_PRIVATE8_NET ||
1842 		    (v4addr_h & IN_PRIVATE12_MASK) == IN_PRIVATE12_NET ||
1843 		    (v4addr_h & IN_PRIVATE16_MASK) == IN_PRIVATE16_NET)
1844 			return (IP6_SCOPE_SITELOCAL);
1845 		return (IP6_SCOPE_GLOBAL);
1846 	}
1847 
1848 	if (IN6_IS_ADDR_MULTICAST(addr))
1849 		return (IN6_ADDR_MC_SCOPE(addr));
1850 
1851 	/* link-local and loopback addresses are of link-local scope */
1852 	if (IN6_IS_ADDR_LINKLOCAL(addr) ||
1853 	    IN6_ARE_ADDR_EQUAL(addr, &ipv6loopback))
1854 		return (IP6_SCOPE_LINKLOCAL);
1855 	if (IN6_IS_ADDR_SITELOCAL(addr))
1856 		return (IP6_SCOPE_SITELOCAL);
1857 	return (IP6_SCOPE_GLOBAL);
1858 }
1859 
1860 
1861 /*
1862  * Returns the length of the common prefix of a1 and a2, as per
1863  * CommonPrefixLen() defined in RFC 3484.
1864  */
1865 static int
1866 ip_common_prefix_v6(const in6_addr_t *a1, const in6_addr_t *a2)
1867 {
1868 	int i;
1869 	uint32_t a1val, a2val, mask;
1870 
1871 	for (i = 0; i < 4; i++) {
1872 		if ((a1val = a1->s6_addr32[i]) != (a2val = a2->s6_addr32[i])) {
1873 			a1val ^= a2val;
1874 			i *= 32;
1875 			mask = 0x80000000u;
1876 			while (!(a1val & mask)) {
1877 				mask >>= 1;
1878 				i++;
1879 			}
1880 			return (i);
1881 		}
1882 	}
1883 	return (IPV6_ABITS);
1884 }
1885 
1886 #define	IPIF_VALID_IPV6_SOURCE(ipif) \
1887 	(((ipif)->ipif_flags & IPIF_UP) && \
1888 	!((ipif)->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST)) && \
1889 	(ipif)->ipif_addr_ready)
1890 
1891 /* source address candidate */
1892 typedef struct candidate {
1893 	ipif_t		*cand_ipif;
1894 	/* The properties of this candidate */
1895 	boolean_t	cand_isdst;
1896 	boolean_t	cand_isdst_set;
1897 	in6addr_scope_t	cand_scope;
1898 	boolean_t	cand_scope_set;
1899 	boolean_t	cand_isdeprecated;
1900 	boolean_t	cand_isdeprecated_set;
1901 	boolean_t	cand_ispreferred;
1902 	boolean_t	cand_ispreferred_set;
1903 	boolean_t	cand_matchedinterface;
1904 	boolean_t	cand_matchedinterface_set;
1905 	boolean_t	cand_matchedlabel;
1906 	boolean_t	cand_matchedlabel_set;
1907 	boolean_t	cand_istmp;
1908 	boolean_t	cand_istmp_set;
1909 	int		cand_common_pref;
1910 	boolean_t	cand_common_pref_set;
1911 	boolean_t	cand_pref_eq;
1912 	boolean_t	cand_pref_eq_set;
1913 	int		cand_pref_len;
1914 	boolean_t	cand_pref_len_set;
1915 } cand_t;
1916 #define	cand_srcaddr	cand_ipif->ipif_v6lcl_addr
1917 #define	cand_mask	cand_ipif->ipif_v6net_mask
1918 #define	cand_flags	cand_ipif->ipif_flags
1919 #define	cand_ill	cand_ipif->ipif_ill
1920 #define	cand_zoneid	cand_ipif->ipif_zoneid
1921 
1922 /* information about the destination for source address selection */
1923 typedef struct dstinfo {
1924 	const in6_addr_t	*dst_addr;
1925 	ill_t			*dst_ill;
1926 	uint_t			dst_restrict_ill;
1927 	boolean_t		dst_prefer_src_tmp;
1928 	in6addr_scope_t		dst_scope;
1929 	char			*dst_label;
1930 } dstinfo_t;
1931 
1932 /*
1933  * The following functions are rules used to select a source address in
1934  * ipif_select_source_v6().  Each rule compares a current candidate (cc)
1935  * against the best candidate (bc).  Each rule has three possible outcomes;
1936  * the candidate is preferred over the best candidate (CAND_PREFER), the
1937  * candidate is not preferred over the best candidate (CAND_AVOID), or the
1938  * candidate is of equal value as the best candidate (CAND_TIE).
1939  *
1940  * These rules are part of a greater "Default Address Selection for IPv6"
1941  * sheme, which is standards based work coming out of the IETF ipv6 working
1942  * group.  The IETF document defines both IPv6 source address selection and
1943  * destination address ordering.  The rules defined here implement the IPv6
1944  * source address selection.  Destination address ordering is done by
1945  * libnsl, and uses a similar set of rules to implement the sorting.
1946  *
1947  * Most of the rules are defined by the RFC and are not typically altered.  The
1948  * last rule, number 8, has language that allows for local preferences.  In the
1949  * scheme below, this means that new Solaris rules should normally go between
1950  * rule_ifprefix and rule_prefix.
1951  */
1952 typedef enum {CAND_AVOID, CAND_TIE, CAND_PREFER} rule_res_t;
1953 typedef	rule_res_t (*rulef_t)(cand_t *, cand_t *, const dstinfo_t *,
1954     ip_stack_t *);
1955 
1956 /* Prefer an address if it is equal to the destination address. */
1957 /* ARGSUSED3 */
1958 static rule_res_t
1959 rule_isdst(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst)
1960 {
1961 	if (!bc->cand_isdst_set) {
1962 		bc->cand_isdst =
1963 		    IN6_ARE_ADDR_EQUAL(&bc->cand_srcaddr, dstinfo->dst_addr);
1964 		bc->cand_isdst_set = B_TRUE;
1965 	}
1966 
1967 	cc->cand_isdst =
1968 	    IN6_ARE_ADDR_EQUAL(&cc->cand_srcaddr, dstinfo->dst_addr);
1969 	cc->cand_isdst_set = B_TRUE;
1970 
1971 	if (cc->cand_isdst == bc->cand_isdst)
1972 		return (CAND_TIE);
1973 	else if (cc->cand_isdst)
1974 		return (CAND_PREFER);
1975 	else
1976 		return (CAND_AVOID);
1977 }
1978 
1979 /*
1980  * Prefer addresses that are of closest scope to the destination.  Always
1981  * prefer addresses that are of greater scope than the destination over
1982  * those that are of lesser scope than the destination.
1983  */
1984 /* ARGSUSED3 */
1985 static rule_res_t
1986 rule_scope(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst)
1987 {
1988 	if (!bc->cand_scope_set) {
1989 		bc->cand_scope = ip_addr_scope_v6(&bc->cand_srcaddr);
1990 		bc->cand_scope_set = B_TRUE;
1991 	}
1992 
1993 	cc->cand_scope = ip_addr_scope_v6(&cc->cand_srcaddr);
1994 	cc->cand_scope_set = B_TRUE;
1995 
1996 	if (cc->cand_scope < bc->cand_scope) {
1997 		if (cc->cand_scope < dstinfo->dst_scope)
1998 			return (CAND_AVOID);
1999 		else
2000 			return (CAND_PREFER);
2001 	} else if (bc->cand_scope < cc->cand_scope) {
2002 		if (bc->cand_scope < dstinfo->dst_scope)
2003 			return (CAND_PREFER);
2004 		else
2005 			return (CAND_AVOID);
2006 	} else {
2007 		return (CAND_TIE);
2008 	}
2009 }
2010 
2011 /*
2012  * Prefer non-deprecated source addresses.
2013  */
2014 /* ARGSUSED2 */
2015 static rule_res_t
2016 rule_deprecated(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo,
2017     ip_stack_t *ipst)
2018 {
2019 	if (!bc->cand_isdeprecated_set) {
2020 		bc->cand_isdeprecated =
2021 		    ((bc->cand_flags & IPIF_DEPRECATED) != 0);
2022 		bc->cand_isdeprecated_set = B_TRUE;
2023 	}
2024 
2025 	cc->cand_isdeprecated = ((cc->cand_flags & IPIF_DEPRECATED) != 0);
2026 	cc->cand_isdeprecated_set = B_TRUE;
2027 
2028 	if (bc->cand_isdeprecated == cc->cand_isdeprecated)
2029 		return (CAND_TIE);
2030 	else if (cc->cand_isdeprecated)
2031 		return (CAND_AVOID);
2032 	else
2033 		return (CAND_PREFER);
2034 }
2035 
2036 /*
2037  * Prefer source addresses that have the IPIF_PREFERRED flag set.  This
2038  * rule must be before rule_interface because the flag could be set on any
2039  * interface, not just the interface being used for outgoing packets (for
2040  * example, the IFF_PREFERRED could be set on an address assigned to the
2041  * loopback interface).
2042  */
2043 /* ARGSUSED2 */
2044 static rule_res_t
2045 rule_preferred(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo,
2046     ip_stack_t *ipst)
2047 {
2048 	if (!bc->cand_ispreferred_set) {
2049 		bc->cand_ispreferred = ((bc->cand_flags & IPIF_PREFERRED) != 0);
2050 		bc->cand_ispreferred_set = B_TRUE;
2051 	}
2052 
2053 	cc->cand_ispreferred = ((cc->cand_flags & IPIF_PREFERRED) != 0);
2054 	cc->cand_ispreferred_set = B_TRUE;
2055 
2056 	if (bc->cand_ispreferred == cc->cand_ispreferred)
2057 		return (CAND_TIE);
2058 	else if (cc->cand_ispreferred)
2059 		return (CAND_PREFER);
2060 	else
2061 		return (CAND_AVOID);
2062 }
2063 
2064 /*
2065  * Prefer source addresses that are assigned to the outgoing interface.
2066  */
2067 /* ARGSUSED3 */
2068 static rule_res_t
2069 rule_interface(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo,
2070     ip_stack_t *ipst)
2071 {
2072 	ill_t *dstill = dstinfo->dst_ill;
2073 
2074 	/*
2075 	 * If dstinfo->dst_restrict_ill is set, this rule is unnecessary
2076 	 * since we know all candidates will be on the same link.
2077 	 */
2078 	if (dstinfo->dst_restrict_ill)
2079 		return (CAND_TIE);
2080 
2081 	if (!bc->cand_matchedinterface_set) {
2082 		bc->cand_matchedinterface = bc->cand_ill == dstill;
2083 		bc->cand_matchedinterface_set = B_TRUE;
2084 	}
2085 
2086 	cc->cand_matchedinterface = cc->cand_ill == dstill;
2087 	cc->cand_matchedinterface_set = B_TRUE;
2088 
2089 	if (bc->cand_matchedinterface == cc->cand_matchedinterface)
2090 		return (CAND_TIE);
2091 	else if (cc->cand_matchedinterface)
2092 		return (CAND_PREFER);
2093 	else
2094 		return (CAND_AVOID);
2095 }
2096 
2097 /*
2098  * Prefer source addresses whose label matches the destination's label.
2099  */
2100 static rule_res_t
2101 rule_label(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst)
2102 {
2103 	char *label;
2104 
2105 	if (!bc->cand_matchedlabel_set) {
2106 		label = ip6_asp_lookup(&bc->cand_srcaddr, NULL, ipst);
2107 		bc->cand_matchedlabel =
2108 		    ip6_asp_labelcmp(label, dstinfo->dst_label);
2109 		bc->cand_matchedlabel_set = B_TRUE;
2110 	}
2111 
2112 	label = ip6_asp_lookup(&cc->cand_srcaddr, NULL, ipst);
2113 	cc->cand_matchedlabel = ip6_asp_labelcmp(label, dstinfo->dst_label);
2114 	cc->cand_matchedlabel_set = B_TRUE;
2115 
2116 	if (bc->cand_matchedlabel == cc->cand_matchedlabel)
2117 		return (CAND_TIE);
2118 	else if (cc->cand_matchedlabel)
2119 		return (CAND_PREFER);
2120 	else
2121 		return (CAND_AVOID);
2122 }
2123 
2124 /*
2125  * Prefer public addresses over temporary ones.  An application can reverse
2126  * the logic of this rule and prefer temporary addresses by using the
2127  * IPV6_SRC_PREFERENCES socket option.
2128  */
2129 /* ARGSUSED3 */
2130 static rule_res_t
2131 rule_temporary(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo,
2132     ip_stack_t *ipst)
2133 {
2134 	if (!bc->cand_istmp_set) {
2135 		bc->cand_istmp = ((bc->cand_flags & IPIF_TEMPORARY) != 0);
2136 		bc->cand_istmp_set = B_TRUE;
2137 	}
2138 
2139 	cc->cand_istmp = ((cc->cand_flags & IPIF_TEMPORARY) != 0);
2140 	cc->cand_istmp_set = B_TRUE;
2141 
2142 	if (bc->cand_istmp == cc->cand_istmp)
2143 		return (CAND_TIE);
2144 
2145 	if (dstinfo->dst_prefer_src_tmp && cc->cand_istmp)
2146 		return (CAND_PREFER);
2147 	else if (!dstinfo->dst_prefer_src_tmp && !cc->cand_istmp)
2148 		return (CAND_PREFER);
2149 	else
2150 		return (CAND_AVOID);
2151 }
2152 
2153 /*
2154  * Prefer source addresses with longer matching prefix with the destination
2155  * under the interface mask.  This gets us on the same subnet before applying
2156  * any Solaris-specific rules.
2157  */
2158 /* ARGSUSED3 */
2159 static rule_res_t
2160 rule_ifprefix(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo,
2161     ip_stack_t *ipst)
2162 {
2163 	if (!bc->cand_pref_eq_set) {
2164 		bc->cand_pref_eq = V6_MASK_EQ_2(bc->cand_srcaddr,
2165 		    bc->cand_mask, *dstinfo->dst_addr);
2166 		bc->cand_pref_eq_set = B_TRUE;
2167 	}
2168 
2169 	cc->cand_pref_eq = V6_MASK_EQ_2(cc->cand_srcaddr, cc->cand_mask,
2170 	    *dstinfo->dst_addr);
2171 	cc->cand_pref_eq_set = B_TRUE;
2172 
2173 	if (bc->cand_pref_eq) {
2174 		if (cc->cand_pref_eq) {
2175 			if (!bc->cand_pref_len_set) {
2176 				bc->cand_pref_len =
2177 				    ip_mask_to_plen_v6(&bc->cand_mask);
2178 				bc->cand_pref_len_set = B_TRUE;
2179 			}
2180 			cc->cand_pref_len = ip_mask_to_plen_v6(&cc->cand_mask);
2181 			cc->cand_pref_len_set = B_TRUE;
2182 			if (bc->cand_pref_len == cc->cand_pref_len)
2183 				return (CAND_TIE);
2184 			else if (bc->cand_pref_len > cc->cand_pref_len)
2185 				return (CAND_AVOID);
2186 			else
2187 				return (CAND_PREFER);
2188 		} else {
2189 			return (CAND_AVOID);
2190 		}
2191 	} else {
2192 		if (cc->cand_pref_eq)
2193 			return (CAND_PREFER);
2194 		else
2195 			return (CAND_TIE);
2196 	}
2197 }
2198 
2199 /*
2200  * Prefer to use zone-specific addresses when possible instead of all-zones
2201  * addresses.
2202  */
2203 /* ARGSUSED2 */
2204 static rule_res_t
2205 rule_zone_specific(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo,
2206     ip_stack_t *ipst)
2207 {
2208 	if ((bc->cand_zoneid == ALL_ZONES) ==
2209 	    (cc->cand_zoneid == ALL_ZONES))
2210 		return (CAND_TIE);
2211 	else if (cc->cand_zoneid == ALL_ZONES)
2212 		return (CAND_AVOID);
2213 	else
2214 		return (CAND_PREFER);
2215 }
2216 
2217 /*
2218  * Prefer to use DHCPv6 (first) and static addresses (second) when possible
2219  * instead of statelessly autoconfigured addresses.
2220  *
2221  * This is done after trying all other preferences (and before the final tie
2222  * breaker) so that, if all else is equal, we select addresses configured by
2223  * DHCPv6 over other addresses.  We presume that DHCPv6 addresses, unlike
2224  * stateless autoconfigured addresses, are deliberately configured by an
2225  * administrator, and thus are correctly set up in DNS and network packet
2226  * filters.
2227  */
2228 /* ARGSUSED2 */
2229 static rule_res_t
2230 rule_addr_type(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo,
2231     ip_stack_t *ipst)
2232 {
2233 #define	ATYPE(x)	\
2234 	((x) & IPIF_DHCPRUNNING) ? 1 : ((x) & IPIF_ADDRCONF) ? 3 : 2
2235 	int bcval = ATYPE(bc->cand_flags);
2236 	int ccval = ATYPE(cc->cand_flags);
2237 #undef ATYPE
2238 
2239 	if (bcval == ccval)
2240 		return (CAND_TIE);
2241 	else if (ccval < bcval)
2242 		return (CAND_PREFER);
2243 	else
2244 		return (CAND_AVOID);
2245 }
2246 
2247 /*
2248  * Prefer source addresses with longer matching prefix with the destination.
2249  * We do the longest matching prefix calculation by doing an xor of both
2250  * addresses with the destination, and pick the address with the longest string
2251  * of leading zeros, as per CommonPrefixLen() defined in RFC 3484.
2252  */
2253 /* ARGSUSED3 */
2254 static rule_res_t
2255 rule_prefix(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst)
2256 {
2257 	/*
2258 	 * For IPMP, we always want to choose a random source address from
2259 	 * among any equally usable addresses, so always report a tie.
2260 	 */
2261 	if (IS_IPMP(dstinfo->dst_ill))
2262 		return (CAND_TIE);
2263 
2264 	if (!bc->cand_common_pref_set) {
2265 		bc->cand_common_pref = ip_common_prefix_v6(&bc->cand_srcaddr,
2266 		    dstinfo->dst_addr);
2267 		bc->cand_common_pref_set = B_TRUE;
2268 	}
2269 
2270 	cc->cand_common_pref = ip_common_prefix_v6(&cc->cand_srcaddr,
2271 	    dstinfo->dst_addr);
2272 	cc->cand_common_pref_set = B_TRUE;
2273 
2274 	if (bc->cand_common_pref == cc->cand_common_pref)
2275 		return (CAND_TIE);
2276 	else if (bc->cand_common_pref > cc->cand_common_pref)
2277 		return (CAND_AVOID);
2278 	else
2279 		return (CAND_PREFER);
2280 }
2281 
2282 /*
2283  * Last rule: we must pick something, so just prefer the current best
2284  * candidate.
2285  */
2286 /* ARGSUSED */
2287 static rule_res_t
2288 rule_must_be_last(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo,
2289     ip_stack_t *ipst)
2290 {
2291 	return (CAND_AVOID);
2292 }
2293 
2294 /*
2295  * Determine the best source address given a destination address and a
2296  * destination ill.  If no suitable source address is found, it returns
2297  * NULL. If there is a usable address pointed to by the usesrc
2298  * (i.e ill_usesrc_ifindex != 0) then return that first since it is more
2299  * fine grained (i.e per interface)
2300  *
2301  * This implementation is based on the "Default Address Selection for IPv6"
2302  * specification produced by the IETF IPv6 working group.  It has been
2303  * implemented so that the list of addresses is only traversed once (the
2304  * specification's algorithm could traverse the list of addresses once for
2305  * every rule).
2306  *
2307  * The restrict_ill argument restricts the algorithm to choose a source
2308  * address that is assigned to the destination ill.  This is used when
2309  * the destination address is a link-local or multicast address, and when
2310  * ipv6_strict_dst_multihoming is turned on.
2311  *
2312  * src_prefs is the caller's set of source address preferences.  If source
2313  * address selection is being called to determine the source address of a
2314  * connected socket (from ip_bind_connected_v6()), then the preferences are
2315  * taken from conn_src_preferences.  These preferences can be set on a
2316  * per-socket basis using the IPV6_SRC_PREFERENCES socket option.  The only
2317  * preference currently implemented is for rfc3041 temporary addresses.
2318  */
2319 ipif_t *
2320 ipif_select_source_v6(ill_t *dstill, const in6_addr_t *dst,
2321     boolean_t restrict_ill, uint32_t src_prefs, zoneid_t zoneid)
2322 {
2323 	dstinfo_t	dstinfo;
2324 	char		dstr[INET6_ADDRSTRLEN];
2325 	char		sstr[INET6_ADDRSTRLEN];
2326 	ipif_t		*ipif, *start_ipif, *next_ipif;
2327 	ill_t		*ill, *usesrc_ill = NULL, *ipmp_ill = NULL;
2328 	ill_walk_context_t	ctx;
2329 	cand_t		best_c;	/* The best candidate */
2330 	cand_t		curr_c;	/* The current candidate */
2331 	uint_t		index;
2332 	boolean_t	first_candidate = B_TRUE;
2333 	rule_res_t	rule_result;
2334 	tsol_tpc_t	*src_rhtp, *dst_rhtp;
2335 	ip_stack_t	*ipst = dstill->ill_ipst;
2336 
2337 	/*
2338 	 * The list of ordering rules.  They are applied in the order they
2339 	 * appear in the list.
2340 	 *
2341 	 * Solaris doesn't currently support Mobile IPv6, so there's no
2342 	 * rule_mipv6 corresponding to rule 4 in the specification.
2343 	 */
2344 	rulef_t	rules[] = {
2345 		rule_isdst,
2346 		rule_scope,
2347 		rule_deprecated,
2348 		rule_preferred,
2349 		rule_interface,
2350 		rule_label,
2351 		rule_temporary,
2352 		rule_ifprefix,			/* local rules after this */
2353 		rule_zone_specific,
2354 		rule_addr_type,
2355 		rule_prefix,			/* local rules before this */
2356 		rule_must_be_last,		/* must always be last */
2357 		NULL
2358 	};
2359 
2360 	ASSERT(dstill->ill_isv6);
2361 	ASSERT(!IN6_IS_ADDR_V4MAPPED(dst));
2362 
2363 	/*
2364 	 * Check if there is a usable src address pointed to by the
2365 	 * usesrc ifindex. This has higher precedence since it is
2366 	 * finer grained (i.e per interface) v/s being system wide.
2367 	 */
2368 	if (dstill->ill_usesrc_ifindex != 0) {
2369 		if ((usesrc_ill =
2370 		    ill_lookup_on_ifindex(dstill->ill_usesrc_ifindex, B_TRUE,
2371 		    NULL, NULL, NULL, NULL, ipst)) != NULL) {
2372 			dstinfo.dst_ill = usesrc_ill;
2373 		} else {
2374 			return (NULL);
2375 		}
2376 	} else if (IS_UNDER_IPMP(dstill)) {
2377 		/*
2378 		 * Test addresses should never be used for source address
2379 		 * selection, so if we were passed an underlying ill, switch
2380 		 * to the IPMP meta-interface.
2381 		 */
2382 		if ((ipmp_ill = ipmp_ill_hold_ipmp_ill(dstill)) != NULL)
2383 			dstinfo.dst_ill = ipmp_ill;
2384 		else
2385 			return (NULL);
2386 	} else {
2387 		dstinfo.dst_ill = dstill;
2388 	}
2389 
2390 	/*
2391 	 * If we're dealing with an unlabeled destination on a labeled system,
2392 	 * make sure that we ignore source addresses that are incompatible with
2393 	 * the destination's default label.  That destination's default label
2394 	 * must dominate the minimum label on the source address.
2395 	 *
2396 	 * (Note that this has to do with Trusted Solaris.  It's not related to
2397 	 * the labels described by ip6_asp_lookup.)
2398 	 */
2399 	dst_rhtp = NULL;
2400 	if (is_system_labeled()) {
2401 		dst_rhtp = find_tpc(dst, IPV6_VERSION, B_FALSE);
2402 		if (dst_rhtp == NULL)
2403 			return (NULL);
2404 		if (dst_rhtp->tpc_tp.host_type != UNLABELED) {
2405 			TPC_RELE(dst_rhtp);
2406 			dst_rhtp = NULL;
2407 		}
2408 	}
2409 
2410 	dstinfo.dst_addr = dst;
2411 	dstinfo.dst_scope = ip_addr_scope_v6(dst);
2412 	dstinfo.dst_label = ip6_asp_lookup(dst, NULL, ipst);
2413 	dstinfo.dst_prefer_src_tmp = ((src_prefs & IPV6_PREFER_SRC_TMP) != 0);
2414 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
2415 	/*
2416 	 * Section three of the I-D states that for multicast and
2417 	 * link-local destinations, the candidate set must be restricted to
2418 	 * an interface that is on the same link as the outgoing interface.
2419 	 * Also, when ipv6_strict_dst_multihoming is turned on, always
2420 	 * restrict the source address to the destination link as doing
2421 	 * otherwise will almost certainly cause problems.
2422 	 */
2423 	if (IN6_IS_ADDR_LINKLOCAL(dst) || IN6_IS_ADDR_MULTICAST(dst) ||
2424 	    ipst->ips_ipv6_strict_dst_multihoming || usesrc_ill != NULL) {
2425 		dstinfo.dst_restrict_ill = B_TRUE;
2426 	} else {
2427 		dstinfo.dst_restrict_ill = restrict_ill;
2428 	}
2429 
2430 	bzero(&best_c, sizeof (cand_t));
2431 
2432 	/*
2433 	 * Take a pass through the list of IPv6 interfaces to choose the best
2434 	 * possible source address.  If restrict_ill is set, just use dst_ill.
2435 	 */
2436 	if (dstinfo.dst_restrict_ill)
2437 		ill = dstinfo.dst_ill;
2438 	else
2439 		ill = ILL_START_WALK_V6(&ctx, ipst);
2440 
2441 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
2442 		ASSERT(ill->ill_isv6);
2443 
2444 		/*
2445 		 * Test addresses should never be used for source address
2446 		 * selection, so ignore underlying ills.
2447 		 */
2448 		if (IS_UNDER_IPMP(ill))
2449 			continue;
2450 
2451 		if (ill->ill_ipif == NULL)
2452 			continue;
2453 		/*
2454 		 * For source address selection, we treat the ipif list as
2455 		 * circular and continue until we get back to where we
2456 		 * started.  This allows IPMP to vary source address selection
2457 		 * (which improves inbound load spreading) by caching its last
2458 		 * ending point and starting from there.  NOTE: we don't have
2459 		 * to worry about ill_src_ipif changing ills since that can't
2460 		 * happen on the IPMP ill.
2461 		 */
2462 		start_ipif = ill->ill_ipif;
2463 		if (IS_IPMP(ill) && ill->ill_src_ipif != NULL)
2464 			start_ipif = ill->ill_src_ipif;
2465 
2466 		ipif = start_ipif;
2467 		do {
2468 			if ((next_ipif = ipif->ipif_next) == NULL)
2469 				next_ipif = ill->ill_ipif;
2470 
2471 			if (!IPIF_VALID_IPV6_SOURCE(ipif))
2472 				continue;
2473 
2474 			if (zoneid != ALL_ZONES &&
2475 			    ipif->ipif_zoneid != zoneid &&
2476 			    ipif->ipif_zoneid != ALL_ZONES)
2477 				continue;
2478 
2479 			/*
2480 			 * Check compatibility of local address for
2481 			 * destination's default label if we're on a labeled
2482 			 * system.  Incompatible addresses can't be used at
2483 			 * all and must be skipped over.
2484 			 */
2485 			if (dst_rhtp != NULL) {
2486 				boolean_t incompat;
2487 
2488 				src_rhtp = find_tpc(&ipif->ipif_v6lcl_addr,
2489 				    IPV6_VERSION, B_FALSE);
2490 				if (src_rhtp == NULL)
2491 					continue;
2492 				incompat =
2493 				    src_rhtp->tpc_tp.host_type != SUN_CIPSO ||
2494 				    src_rhtp->tpc_tp.tp_doi !=
2495 				    dst_rhtp->tpc_tp.tp_doi ||
2496 				    (!_blinrange(&dst_rhtp->tpc_tp.tp_def_label,
2497 				    &src_rhtp->tpc_tp.tp_sl_range_cipso) &&
2498 				    !blinlset(&dst_rhtp->tpc_tp.tp_def_label,
2499 				    src_rhtp->tpc_tp.tp_sl_set_cipso));
2500 				TPC_RELE(src_rhtp);
2501 				if (incompat)
2502 					continue;
2503 			}
2504 
2505 			if (first_candidate) {
2506 				/*
2507 				 * This is first valid address in the list.
2508 				 * It is automatically the best candidate
2509 				 * so far.
2510 				 */
2511 				best_c.cand_ipif = ipif;
2512 				first_candidate = B_FALSE;
2513 				continue;
2514 			}
2515 
2516 			bzero(&curr_c, sizeof (cand_t));
2517 			curr_c.cand_ipif = ipif;
2518 
2519 			/*
2520 			 * Compare this current candidate (curr_c) with the
2521 			 * best candidate (best_c) by applying the
2522 			 * comparison rules in order until one breaks the
2523 			 * tie.
2524 			 */
2525 			for (index = 0; rules[index] != NULL; index++) {
2526 				/* Apply a comparison rule. */
2527 				rule_result = (rules[index])(&best_c, &curr_c,
2528 				    &dstinfo, ipst);
2529 				if (rule_result == CAND_AVOID) {
2530 					/*
2531 					 * The best candidate is still the
2532 					 * best candidate.  Forget about
2533 					 * this current candidate and go on
2534 					 * to the next one.
2535 					 */
2536 					break;
2537 				} else if (rule_result == CAND_PREFER) {
2538 					/*
2539 					 * This candidate is prefered.  It
2540 					 * becomes the best candidate so
2541 					 * far.  Go on to the next address.
2542 					 */
2543 					best_c = curr_c;
2544 					break;
2545 				}
2546 				/* We have a tie, apply the next rule. */
2547 			}
2548 
2549 			/*
2550 			 * The last rule must be a tie breaker rule and
2551 			 * must never produce a tie.  At this point, the
2552 			 * candidate should have either been rejected, or
2553 			 * have been prefered as the best candidate so far.
2554 			 */
2555 			ASSERT(rule_result != CAND_TIE);
2556 		} while ((ipif = next_ipif) != start_ipif);
2557 
2558 		/*
2559 		 * For IPMP, update the source ipif rotor to the next ipif,
2560 		 * provided we can look it up.  (We must not use it if it's
2561 		 * IPIF_CONDEMNED since we may have grabbed ill_g_lock after
2562 		 * ipif_free() checked ill_src_ipif.)
2563 		 */
2564 		if (IS_IPMP(ill) && ipif != NULL) {
2565 			mutex_enter(&ipif->ipif_ill->ill_lock);
2566 			next_ipif = ipif->ipif_next;
2567 			if (next_ipif != NULL && IPIF_CAN_LOOKUP(next_ipif))
2568 				ill->ill_src_ipif = next_ipif;
2569 			else
2570 				ill->ill_src_ipif = NULL;
2571 			mutex_exit(&ipif->ipif_ill->ill_lock);
2572 		}
2573 
2574 		/*
2575 		 * Only one ill to consider if dst_restrict_ill is set.
2576 		 */
2577 		if (dstinfo.dst_restrict_ill)
2578 			break;
2579 	}
2580 
2581 	ipif = best_c.cand_ipif;
2582 	ip1dbg(("ipif_select_source_v6(%s, %s) -> %s\n",
2583 	    dstinfo.dst_ill->ill_name,
2584 	    inet_ntop(AF_INET6, dstinfo.dst_addr, dstr, sizeof (dstr)),
2585 	    (ipif == NULL ? "NULL" :
2586 	    inet_ntop(AF_INET6, &ipif->ipif_v6lcl_addr, sstr, sizeof (sstr)))));
2587 
2588 	if (usesrc_ill != NULL)
2589 		ill_refrele(usesrc_ill);
2590 
2591 	if (ipmp_ill != NULL)
2592 		ill_refrele(ipmp_ill);
2593 
2594 	if (dst_rhtp != NULL)
2595 		TPC_RELE(dst_rhtp);
2596 
2597 	if (ipif == NULL) {
2598 		rw_exit(&ipst->ips_ill_g_lock);
2599 		return (NULL);
2600 	}
2601 
2602 	mutex_enter(&ipif->ipif_ill->ill_lock);
2603 	if (IPIF_CAN_LOOKUP(ipif)) {
2604 		ipif_refhold_locked(ipif);
2605 		mutex_exit(&ipif->ipif_ill->ill_lock);
2606 		rw_exit(&ipst->ips_ill_g_lock);
2607 		return (ipif);
2608 	}
2609 	mutex_exit(&ipif->ipif_ill->ill_lock);
2610 	rw_exit(&ipst->ips_ill_g_lock);
2611 	ip1dbg(("ipif_select_source_v6 cannot lookup ipif %p"
2612 	    " returning null \n", (void *)ipif));
2613 
2614 	return (NULL);
2615 }
2616 
2617 /*
2618  * If old_ipif is not NULL, see if ipif was derived from old
2619  * ipif and if so, recreate the interface route by re-doing
2620  * source address selection. This happens when ipif_down ->
2621  * ipif_update_other_ipifs calls us.
2622  *
2623  * If old_ipif is NULL, just redo the source address selection
2624  * if needed. This happens when ipif_up_done_v6 calls us.
2625  */
2626 void
2627 ipif_recreate_interface_routes_v6(ipif_t *old_ipif, ipif_t *ipif)
2628 {
2629 	ire_t *ire;
2630 	ire_t *ipif_ire;
2631 	queue_t *stq;
2632 	ill_t *ill;
2633 	ipif_t *nipif = NULL;
2634 	boolean_t nipif_refheld = B_FALSE;
2635 	boolean_t ip6_asp_table_held = B_FALSE;
2636 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
2637 
2638 	ill = ipif->ipif_ill;
2639 
2640 	if (!(ipif->ipif_flags &
2641 	    (IPIF_NOLOCAL|IPIF_ANYCAST|IPIF_DEPRECATED))) {
2642 		/*
2643 		 * Can't possibly have borrowed the source
2644 		 * from old_ipif.
2645 		 */
2646 		return;
2647 	}
2648 
2649 	/*
2650 	 * Is there any work to be done? No work if the address
2651 	 * is INADDR_ANY, loopback or NOLOCAL or ANYCAST (
2652 	 * ipif_select_source_v6() does not borrow addresses from
2653 	 * NOLOCAL and ANYCAST interfaces).
2654 	 */
2655 	if ((old_ipif != NULL) &&
2656 	    ((IN6_IS_ADDR_UNSPECIFIED(&old_ipif->ipif_v6lcl_addr)) ||
2657 	    (old_ipif->ipif_ill->ill_wq == NULL) ||
2658 	    (old_ipif->ipif_flags &
2659 	    (IPIF_NOLOCAL|IPIF_ANYCAST)))) {
2660 		return;
2661 	}
2662 
2663 	/*
2664 	 * Perform the same checks as when creating the
2665 	 * IRE_INTERFACE in ipif_up_done_v6.
2666 	 */
2667 	if (!(ipif->ipif_flags & IPIF_UP))
2668 		return;
2669 
2670 	if ((ipif->ipif_flags & IPIF_NOXMIT))
2671 		return;
2672 
2673 	if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet) &&
2674 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6net_mask))
2675 		return;
2676 
2677 	/*
2678 	 * We know that ipif uses some other source for its
2679 	 * IRE_INTERFACE. Is it using the source of this
2680 	 * old_ipif?
2681 	 */
2682 	ipif_ire = ipif_to_ire_v6(ipif);
2683 	if (ipif_ire == NULL)
2684 		return;
2685 
2686 	if (old_ipif != NULL &&
2687 	    !IN6_ARE_ADDR_EQUAL(&old_ipif->ipif_v6lcl_addr,
2688 	    &ipif_ire->ire_src_addr_v6)) {
2689 		ire_refrele(ipif_ire);
2690 		return;
2691 	}
2692 
2693 	if (ip_debug > 2) {
2694 		/* ip1dbg */
2695 		pr_addr_dbg("ipif_recreate_interface_routes_v6: deleting IRE"
2696 		    " for src %s\n", AF_INET6, &ipif_ire->ire_src_addr_v6);
2697 	}
2698 
2699 	stq = ipif_ire->ire_stq;
2700 
2701 	/*
2702 	 * Can't use our source address. Select a different source address
2703 	 * for the IRE_INTERFACE.  We restrict interface route source
2704 	 * address selection to ipif's assigned to the same link as the
2705 	 * interface.
2706 	 */
2707 	if (ip6_asp_can_lookup(ipst)) {
2708 		ip6_asp_table_held = B_TRUE;
2709 		nipif = ipif_select_source_v6(ill, &ipif->ipif_v6subnet,
2710 		    B_TRUE, IPV6_PREFER_SRC_DEFAULT, ipif->ipif_zoneid);
2711 	}
2712 	if (nipif == NULL) {
2713 		/* Last resort - all ipif's have IPIF_NOLOCAL */
2714 		nipif = ipif;
2715 	} else {
2716 		nipif_refheld = B_TRUE;
2717 	}
2718 
2719 	ire = ire_create_v6(
2720 	    &ipif->ipif_v6subnet,	/* dest pref */
2721 	    &ipif->ipif_v6net_mask,	/* mask */
2722 	    &nipif->ipif_v6src_addr,	/* src addr */
2723 	    NULL,			/* no gateway */
2724 	    &ipif->ipif_mtu,		/* max frag */
2725 	    NULL,			/* no src nce */
2726 	    NULL,			/* no recv from queue */
2727 	    stq,			/* send-to queue */
2728 	    ill->ill_net_type,		/* IF_[NO]RESOLVER */
2729 	    ipif,
2730 	    NULL,
2731 	    0,
2732 	    0,
2733 	    0,
2734 	    &ire_uinfo_null,
2735 	    NULL,
2736 	    NULL,
2737 	    ipst);
2738 
2739 	if (ire != NULL) {
2740 		ire_t *ret_ire;
2741 		int   error;
2742 
2743 		/*
2744 		 * We don't need ipif_ire anymore. We need to delete
2745 		 * before we add so that ire_add does not detect
2746 		 * duplicates.
2747 		 */
2748 		ire_delete(ipif_ire);
2749 		ret_ire = ire;
2750 		error = ire_add(&ret_ire, NULL, NULL, NULL, B_FALSE);
2751 		ASSERT(error == 0);
2752 		ASSERT(ret_ire == ire);
2753 		if (ret_ire != NULL) {
2754 			/* Held in ire_add */
2755 			ire_refrele(ret_ire);
2756 		}
2757 	}
2758 	/*
2759 	 * Either we are falling through from above or could not
2760 	 * allocate a replacement.
2761 	 */
2762 	ire_refrele(ipif_ire);
2763 	if (ip6_asp_table_held)
2764 		ip6_asp_table_refrele(ipst);
2765 	if (nipif_refheld)
2766 		ipif_refrele(nipif);
2767 }
2768 
2769 /*
2770  * This old_ipif is going away.
2771  *
2772  * Determine if any other ipif's are using our address as
2773  * ipif_v6lcl_addr (due to those being IPIF_NOLOCAL, IPIF_ANYCAST, or
2774  * IPIF_DEPRECATED).
2775  * Find the IRE_INTERFACE for such ipif's and recreate them
2776  * to use an different source address following the rules in
2777  * ipif_up_done_v6.
2778  */
2779 void
2780 ipif_update_other_ipifs_v6(ipif_t *old_ipif)
2781 {
2782 	ipif_t	*ipif;
2783 	ill_t	*ill;
2784 	char	buf[INET6_ADDRSTRLEN];
2785 
2786 	ASSERT(IAM_WRITER_IPIF(old_ipif));
2787 
2788 	ill = old_ipif->ipif_ill;
2789 
2790 	ip1dbg(("ipif_update_other_ipifs_v6(%s, %s)\n",
2791 	    ill->ill_name,
2792 	    inet_ntop(AF_INET6, &old_ipif->ipif_v6lcl_addr,
2793 	    buf, sizeof (buf))));
2794 
2795 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
2796 		if (ipif != old_ipif)
2797 			ipif_recreate_interface_routes_v6(old_ipif, ipif);
2798 	}
2799 }
2800 
2801 /*
2802  * Perform an attach and bind to get phys addr plus info_req for
2803  * the physical device.
2804  * q and mp represents an ioctl which will be queued waiting for
2805  * completion of the DLPI message exchange.
2806  * MUST be called on an ill queue. Can not set conn_pending_ill for that
2807  * reason thus the DL_PHYS_ADDR_ACK code does not assume ill_pending_q.
2808  *
2809  * Returns EINPROGRESS when mp has been consumed by queueing it on
2810  * ill_pending_mp and the ioctl will complete in ip_rput.
2811  */
2812 int
2813 ill_dl_phys(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q)
2814 {
2815 	mblk_t	*v6token_mp = NULL;
2816 	mblk_t	*v6lla_mp = NULL;
2817 	mblk_t	*phys_mp = NULL;
2818 	mblk_t	*info_mp = NULL;
2819 	mblk_t	*attach_mp = NULL;
2820 	mblk_t	*bind_mp = NULL;
2821 	mblk_t	*unbind_mp = NULL;
2822 	mblk_t	*notify_mp = NULL;
2823 
2824 	ip1dbg(("ill_dl_phys(%s:%u)\n", ill->ill_name, ipif->ipif_id));
2825 	ASSERT(ill->ill_dlpi_style_set);
2826 	ASSERT(WR(q)->q_next != NULL);
2827 
2828 	if (ill->ill_isv6) {
2829 		v6token_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) +
2830 		    sizeof (t_scalar_t), DL_PHYS_ADDR_REQ);
2831 		if (v6token_mp == NULL)
2832 			goto bad;
2833 		((dl_phys_addr_req_t *)v6token_mp->b_rptr)->dl_addr_type =
2834 		    DL_IPV6_TOKEN;
2835 
2836 		v6lla_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) +
2837 		    sizeof (t_scalar_t), DL_PHYS_ADDR_REQ);
2838 		if (v6lla_mp == NULL)
2839 			goto bad;
2840 		((dl_phys_addr_req_t *)v6lla_mp->b_rptr)->dl_addr_type =
2841 		    DL_IPV6_LINK_LAYER_ADDR;
2842 	}
2843 
2844 	/*
2845 	 * Allocate a DL_NOTIFY_REQ and set the notifications we want.
2846 	 */
2847 	notify_mp = ip_dlpi_alloc(sizeof (dl_notify_req_t) + sizeof (long),
2848 	    DL_NOTIFY_REQ);
2849 	if (notify_mp == NULL)
2850 		goto bad;
2851 	((dl_notify_req_t *)notify_mp->b_rptr)->dl_notifications =
2852 	    (DL_NOTE_PHYS_ADDR | DL_NOTE_SDU_SIZE | DL_NOTE_FASTPATH_FLUSH |
2853 	    DL_NOTE_LINK_UP | DL_NOTE_LINK_DOWN | DL_NOTE_CAPAB_RENEG |
2854 	    DL_NOTE_REPLUMB);
2855 
2856 	phys_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) +
2857 	    sizeof (t_scalar_t), DL_PHYS_ADDR_REQ);
2858 	if (phys_mp == NULL)
2859 		goto bad;
2860 	((dl_phys_addr_req_t *)phys_mp->b_rptr)->dl_addr_type =
2861 	    DL_CURR_PHYS_ADDR;
2862 
2863 	info_mp = ip_dlpi_alloc(
2864 	    sizeof (dl_info_req_t) + sizeof (dl_info_ack_t),
2865 	    DL_INFO_REQ);
2866 	if (info_mp == NULL)
2867 		goto bad;
2868 
2869 	bind_mp = ip_dlpi_alloc(sizeof (dl_bind_req_t) + sizeof (long),
2870 	    DL_BIND_REQ);
2871 	if (bind_mp == NULL)
2872 		goto bad;
2873 	((dl_bind_req_t *)bind_mp->b_rptr)->dl_sap = ill->ill_sap;
2874 	((dl_bind_req_t *)bind_mp->b_rptr)->dl_service_mode = DL_CLDLS;
2875 
2876 	unbind_mp = ip_dlpi_alloc(sizeof (dl_unbind_req_t), DL_UNBIND_REQ);
2877 	if (unbind_mp == NULL)
2878 		goto bad;
2879 
2880 	/* If we need to attach, pre-alloc and initialize the mblk */
2881 	if (ill->ill_needs_attach) {
2882 		attach_mp = ip_dlpi_alloc(sizeof (dl_attach_req_t),
2883 		    DL_ATTACH_REQ);
2884 		if (attach_mp == NULL)
2885 			goto bad;
2886 		((dl_attach_req_t *)attach_mp->b_rptr)->dl_ppa = ill->ill_ppa;
2887 	}
2888 
2889 	/*
2890 	 * Here we are going to delay the ioctl ack until after
2891 	 * ACKs from DL_PHYS_ADDR_REQ. So need to save the
2892 	 * original ioctl message before sending the requests
2893 	 */
2894 	mutex_enter(&ill->ill_lock);
2895 	/* ipsq_pending_mp_add won't fail since we pass in a NULL connp */
2896 	(void) ipsq_pending_mp_add(NULL, ipif, ill->ill_wq, mp, 0);
2897 	/*
2898 	 * Set ill_phys_addr_pend to zero. It will be set to the addr_type of
2899 	 * the DL_PHYS_ADDR_REQ in ill_dlpi_send() and ill_dlpi_done(). It will
2900 	 * be used to track which DL_PHYS_ADDR_REQ is being ACK'd/NAK'd.
2901 	 */
2902 	ill->ill_phys_addr_pend = 0;
2903 	mutex_exit(&ill->ill_lock);
2904 
2905 	if (attach_mp != NULL) {
2906 		ip1dbg(("ill_dl_phys: attach\n"));
2907 		ill_dlpi_send(ill, attach_mp);
2908 	}
2909 	ill_dlpi_send(ill, bind_mp);
2910 	ill_dlpi_send(ill, info_mp);
2911 	if (ill->ill_isv6) {
2912 		ill_dlpi_send(ill, v6token_mp);
2913 		ill_dlpi_send(ill, v6lla_mp);
2914 	}
2915 	ill_dlpi_send(ill, phys_mp);
2916 	ill_dlpi_send(ill, notify_mp);
2917 	ill_dlpi_send(ill, unbind_mp);
2918 
2919 	/*
2920 	 * This operation will complete in ip_rput_dlpi_writer with either
2921 	 * a DL_PHYS_ADDR_ACK or DL_ERROR_ACK.
2922 	 */
2923 	return (EINPROGRESS);
2924 bad:
2925 	freemsg(v6token_mp);
2926 	freemsg(v6lla_mp);
2927 	freemsg(phys_mp);
2928 	freemsg(info_mp);
2929 	freemsg(attach_mp);
2930 	freemsg(bind_mp);
2931 	freemsg(unbind_mp);
2932 	freemsg(notify_mp);
2933 	return (ENOMEM);
2934 }
2935 
2936 uint_t ip_loopback_mtu_v6plus = IP_LOOPBACK_MTU + IPV6_HDR_LEN + 20;
2937 
2938 /*
2939  * DLPI is up.
2940  * Create all the IREs associated with an interface bring up multicast.
2941  * Set the interface flag and finish other initialization
2942  * that potentially had to be differed to after DL_BIND_ACK.
2943  */
2944 int
2945 ipif_up_done_v6(ipif_t *ipif)
2946 {
2947 	ire_t	*ire_array[20];
2948 	ire_t	**irep = ire_array;
2949 	ire_t	**irep1;
2950 	ill_t	*ill = ipif->ipif_ill;
2951 	queue_t	*stq;
2952 	in6_addr_t	v6addr;
2953 	in6_addr_t	route_mask;
2954 	ipif_t	 *src_ipif = NULL;
2955 	ipif_t   *tmp_ipif;
2956 	boolean_t	flush_ire_cache = B_TRUE;
2957 	int	err;
2958 	char	buf[INET6_ADDRSTRLEN];
2959 	ire_t	**ipif_saved_irep = NULL;
2960 	int ipif_saved_ire_cnt;
2961 	int cnt;
2962 	boolean_t src_ipif_held = B_FALSE;
2963 	boolean_t loopback = B_FALSE;
2964 	boolean_t ip6_asp_table_held = B_FALSE;
2965 	ip_stack_t	*ipst = ill->ill_ipst;
2966 
2967 	ip1dbg(("ipif_up_done_v6(%s:%u)\n",
2968 	    ipif->ipif_ill->ill_name, ipif->ipif_id));
2969 
2970 	/* Check if this is a loopback interface */
2971 	if (ipif->ipif_ill->ill_wq == NULL)
2972 		loopback = B_TRUE;
2973 
2974 	ASSERT(ipif->ipif_isv6);
2975 	ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock));
2976 
2977 	/*
2978 	 * If all other interfaces for this ill are down or DEPRECATED,
2979 	 * or otherwise unsuitable for source address selection, remove
2980 	 * any IRE_CACHE entries for this ill to make sure source
2981 	 * address selection gets to take this new ipif into account.
2982 	 * No need to hold ill_lock while traversing the ipif list since
2983 	 * we are writer
2984 	 */
2985 	for (tmp_ipif = ill->ill_ipif; tmp_ipif;
2986 	    tmp_ipif = tmp_ipif->ipif_next) {
2987 		if (((tmp_ipif->ipif_flags &
2988 		    (IPIF_NOXMIT|IPIF_ANYCAST|IPIF_NOLOCAL|IPIF_DEPRECATED)) ||
2989 		    !(tmp_ipif->ipif_flags & IPIF_UP)) ||
2990 		    (tmp_ipif == ipif))
2991 			continue;
2992 		/* first useable pre-existing interface */
2993 		flush_ire_cache = B_FALSE;
2994 		break;
2995 	}
2996 	if (flush_ire_cache)
2997 		ire_walk_ill_v6(MATCH_IRE_ILL | MATCH_IRE_TYPE,
2998 		    IRE_CACHE, ill_ipif_cache_delete, ill, ill);
2999 
3000 	/*
3001 	 * Figure out which way the send-to queue should go.  Only
3002 	 * IRE_IF_RESOLVER or IRE_IF_NORESOLVER should show up here.
3003 	 */
3004 	switch (ill->ill_net_type) {
3005 	case IRE_IF_RESOLVER:
3006 		stq = ill->ill_rq;
3007 		break;
3008 	case IRE_IF_NORESOLVER:
3009 	case IRE_LOOPBACK:
3010 		stq = ill->ill_wq;
3011 		break;
3012 	default:
3013 		return (EINVAL);
3014 	}
3015 
3016 	if (IS_LOOPBACK(ill)) {
3017 		/*
3018 		 * lo0:1 and subsequent ipifs were marked IRE_LOCAL in
3019 		 * ipif_lookup_on_name(), but in the case of zones we can have
3020 		 * several loopback addresses on lo0. So all the interfaces with
3021 		 * loopback addresses need to be marked IRE_LOOPBACK.
3022 		 */
3023 		if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr, &ipv6_loopback))
3024 			ipif->ipif_ire_type = IRE_LOOPBACK;
3025 		else
3026 			ipif->ipif_ire_type = IRE_LOCAL;
3027 	}
3028 
3029 	if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST) ||
3030 	    ((ipif->ipif_flags & IPIF_DEPRECATED) &&
3031 	    !(ipif->ipif_flags & IPIF_NOFAILOVER))) {
3032 		/*
3033 		 * Can't use our source address. Select a different
3034 		 * source address for the IRE_INTERFACE and IRE_LOCAL
3035 		 */
3036 		if (ip6_asp_can_lookup(ipst)) {
3037 			ip6_asp_table_held = B_TRUE;
3038 			src_ipif = ipif_select_source_v6(ipif->ipif_ill,
3039 			    &ipif->ipif_v6subnet, B_FALSE,
3040 			    IPV6_PREFER_SRC_DEFAULT, ipif->ipif_zoneid);
3041 		}
3042 		if (src_ipif == NULL)
3043 			src_ipif = ipif;	/* Last resort */
3044 		else
3045 			src_ipif_held = B_TRUE;
3046 	} else {
3047 		src_ipif = ipif;
3048 	}
3049 
3050 	if (!IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) &&
3051 	    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
3052 
3053 		/*
3054 		 * If we're on a labeled system then make sure that zone-
3055 		 * private addresses have proper remote host database entries.
3056 		 */
3057 		if (is_system_labeled() &&
3058 		    ipif->ipif_ire_type != IRE_LOOPBACK) {
3059 			if (ip6opt_ls == 0) {
3060 				cmn_err(CE_WARN, "IPv6 not enabled "
3061 				    "via /etc/system");
3062 				return (EINVAL);
3063 			}
3064 			if (!tsol_check_interface_address(ipif))
3065 				return (EINVAL);
3066 		}
3067 
3068 		/* Register the source address for __sin6_src_id */
3069 		err = ip_srcid_insert(&ipif->ipif_v6lcl_addr,
3070 		    ipif->ipif_zoneid, ipst);
3071 		if (err != 0) {
3072 			ip0dbg(("ipif_up_done_v6: srcid_insert %d\n", err));
3073 			if (src_ipif_held)
3074 				ipif_refrele(src_ipif);
3075 			if (ip6_asp_table_held)
3076 				ip6_asp_table_refrele(ipst);
3077 			return (err);
3078 		}
3079 		/*
3080 		 * If the interface address is set, create the LOCAL
3081 		 * or LOOPBACK IRE.
3082 		 */
3083 		ip1dbg(("ipif_up_done_v6: creating IRE %d for %s\n",
3084 		    ipif->ipif_ire_type,
3085 		    inet_ntop(AF_INET6, &ipif->ipif_v6lcl_addr,
3086 		    buf, sizeof (buf))));
3087 
3088 		*irep++ = ire_create_v6(
3089 		    &ipif->ipif_v6lcl_addr,		/* dest address */
3090 		    &ipv6_all_ones,			/* mask */
3091 		    &src_ipif->ipif_v6src_addr,		/* source address */
3092 		    NULL,				/* no gateway */
3093 		    &ip_loopback_mtu_v6plus,		/* max frag size */
3094 		    NULL,
3095 		    ipif->ipif_rq,			/* recv-from queue */
3096 		    NULL,				/* no send-to queue */
3097 		    ipif->ipif_ire_type,		/* LOCAL or LOOPBACK */
3098 		    ipif,				/* interface */
3099 		    NULL,
3100 		    0,
3101 		    0,
3102 		    (ipif->ipif_flags & IPIF_PRIVATE) ? RTF_PRIVATE : 0,
3103 		    &ire_uinfo_null,
3104 		    NULL,
3105 		    NULL,
3106 		    ipst);
3107 	}
3108 
3109 	/*
3110 	 * Set up the IRE_IF_RESOLVER or IRE_IF_NORESOLVER, as appropriate.
3111 	 * Note that atun interfaces have an all-zero ipif_v6subnet.
3112 	 * Thus we allow a zero subnet as long as the mask is non-zero.
3113 	 */
3114 	if (stq != NULL && !(ipif->ipif_flags & IPIF_NOXMIT) &&
3115 	    !(IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet) &&
3116 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6net_mask))) {
3117 		/* ipif_v6subnet is ipif_v6pp_dst_addr for pt-pt */
3118 		v6addr = ipif->ipif_v6subnet;
3119 
3120 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
3121 			route_mask = ipv6_all_ones;
3122 		} else {
3123 			route_mask = ipif->ipif_v6net_mask;
3124 		}
3125 
3126 		ip1dbg(("ipif_up_done_v6: creating if IRE %d for %s\n",
3127 		    ill->ill_net_type,
3128 		    inet_ntop(AF_INET6, &v6addr, buf, sizeof (buf))));
3129 
3130 		*irep++ = ire_create_v6(
3131 		    &v6addr,			/* dest pref */
3132 		    &route_mask,		/* mask */
3133 		    &src_ipif->ipif_v6src_addr,	/* src addr */
3134 		    NULL,			/* no gateway */
3135 		    &ipif->ipif_mtu,		/* max frag */
3136 		    NULL,			/* no src nce */
3137 		    NULL,			/* no recv from queue */
3138 		    stq,			/* send-to queue */
3139 		    ill->ill_net_type,		/* IF_[NO]RESOLVER */
3140 		    ipif,
3141 		    NULL,
3142 		    0,
3143 		    0,
3144 		    (ipif->ipif_flags & IPIF_PRIVATE) ? RTF_PRIVATE : 0,
3145 		    &ire_uinfo_null,
3146 		    NULL,
3147 		    NULL,
3148 		    ipst);
3149 	}
3150 
3151 	/*
3152 	 * Setup 2002::/16 route, if this interface is a 6to4 tunnel
3153 	 */
3154 	if (IN6_IS_ADDR_6TO4(&ipif->ipif_v6lcl_addr) &&
3155 	    (ill->ill_is_6to4tun)) {
3156 		/*
3157 		 * Destination address is 2002::/16
3158 		 */
3159 #ifdef	_BIG_ENDIAN
3160 		const in6_addr_t prefix_addr = { 0x20020000U, 0, 0, 0 };
3161 		const in6_addr_t prefix_mask = { 0xffff0000U, 0, 0, 0 };
3162 #else
3163 		const in6_addr_t prefix_addr = { 0x00000220U, 0, 0, 0 };
3164 		const in6_addr_t prefix_mask = { 0x0000ffffU, 0, 0, 0 };
3165 #endif /* _BIG_ENDIAN */
3166 		char	buf2[INET6_ADDRSTRLEN];
3167 		ire_t *isdup;
3168 		in6_addr_t *first_addr = &ill->ill_ipif->ipif_v6lcl_addr;
3169 
3170 		/*
3171 		 * check to see if this route has already been added for
3172 		 * this tunnel interface.
3173 		 */
3174 		isdup = ire_ftable_lookup_v6(first_addr, &prefix_mask, 0,
3175 		    IRE_IF_NORESOLVER, ill->ill_ipif, NULL, ALL_ZONES, 0, NULL,
3176 		    (MATCH_IRE_SRC | MATCH_IRE_MASK), ipst);
3177 
3178 		if (isdup == NULL) {
3179 			ip1dbg(("ipif_up_done_v6: creating if IRE %d for %s",
3180 			    IRE_IF_NORESOLVER, inet_ntop(AF_INET6, &v6addr,
3181 			    buf2, sizeof (buf2))));
3182 
3183 			*irep++ = ire_create_v6(
3184 			    &prefix_addr,		/* 2002:: */
3185 			    &prefix_mask,		/* ffff:: */
3186 			    &ipif->ipif_v6lcl_addr, 	/* src addr */
3187 			    NULL, 			/* gateway */
3188 			    &ipif->ipif_mtu, 		/* max_frag */
3189 			    NULL, 			/* no src nce */
3190 			    NULL, 			/* no rfq */
3191 			    ill->ill_wq, 		/* stq */
3192 			    IRE_IF_NORESOLVER,		/* type */
3193 			    ipif,			/* interface */
3194 			    NULL,			/* v6cmask */
3195 			    0,
3196 			    0,
3197 			    RTF_UP,
3198 			    &ire_uinfo_null,
3199 			    NULL,
3200 			    NULL,
3201 			    ipst);
3202 		} else {
3203 			ire_refrele(isdup);
3204 		}
3205 	}
3206 
3207 	/* If an earlier ire_create failed, get out now */
3208 	for (irep1 = irep; irep1 > ire_array; ) {
3209 		irep1--;
3210 		if (*irep1 == NULL) {
3211 			ip1dbg(("ipif_up_done_v6: NULL ire found in"
3212 			    " ire_array\n"));
3213 			err = ENOMEM;
3214 			goto bad;
3215 		}
3216 	}
3217 
3218 	ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock));
3219 
3220 	/*
3221 	 * Need to atomically check for IP address availability under
3222 	 * ip_addr_avail_lock.  ill_g_lock is held as reader to ensure no new
3223 	 * ills or new ipifs can be added while we are checking availability.
3224 	 */
3225 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
3226 	mutex_enter(&ipst->ips_ip_addr_avail_lock);
3227 	ill->ill_ipif_up_count++;
3228 	ipif->ipif_flags |= IPIF_UP;
3229 	err = ip_addr_availability_check(ipif);
3230 	mutex_exit(&ipst->ips_ip_addr_avail_lock);
3231 	rw_exit(&ipst->ips_ill_g_lock);
3232 
3233 	if (err != 0) {
3234 		/*
3235 		 * Our address may already be up on the same ill. In this case,
3236 		 * the external resolver entry for our ipif replaced the one for
3237 		 * the other ipif. So we don't want to delete it (otherwise the
3238 		 * other ipif would be unable to send packets).
3239 		 * ip_addr_availability_check() identifies this case for us and
3240 		 * returns EADDRINUSE; we need to turn it into EADDRNOTAVAIL
3241 		 * which is the expected error code.
3242 		 *
3243 		 * Note that, for the non-XRESOLV case, ipif_ndp_down() will
3244 		 * only delete the nce in the case when the nce_ipif_cnt drops
3245 		 * to 0.
3246 		 */
3247 		if (err == EADDRINUSE) {
3248 			if (ipif->ipif_ill->ill_flags & ILLF_XRESOLV) {
3249 				freemsg(ipif->ipif_arp_del_mp);
3250 				ipif->ipif_arp_del_mp = NULL;
3251 			}
3252 			err = EADDRNOTAVAIL;
3253 		}
3254 		ill->ill_ipif_up_count--;
3255 		ipif->ipif_flags &= ~IPIF_UP;
3256 		goto bad;
3257 	}
3258 
3259 	/*
3260 	 * Add in all newly created IREs.
3261 	 *
3262 	 * NOTE : We refrele the ire though we may branch to "bad"
3263 	 *	  later on where we do ire_delete. This is okay
3264 	 *	  because nobody can delete it as we are running
3265 	 *	  exclusively.
3266 	 */
3267 	for (irep1 = irep; irep1 > ire_array; ) {
3268 		irep1--;
3269 		/* Shouldn't be adding any bcast ire's */
3270 		ASSERT((*irep1)->ire_type != IRE_BROADCAST);
3271 		ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock));
3272 		/*
3273 		 * refheld by ire_add. refele towards the end of the func
3274 		 */
3275 		(void) ire_add(irep1, NULL, NULL, NULL, B_FALSE);
3276 	}
3277 	if (ip6_asp_table_held) {
3278 		ip6_asp_table_refrele(ipst);
3279 		ip6_asp_table_held = B_FALSE;
3280 	}
3281 
3282 	/* Recover any additional IRE_IF_[NO]RESOLVER entries for this ipif */
3283 	ipif_saved_ire_cnt = ipif->ipif_saved_ire_cnt;
3284 	ipif_saved_irep = ipif_recover_ire_v6(ipif);
3285 
3286 	if (ill->ill_need_recover_multicast) {
3287 		/*
3288 		 * Need to recover all multicast memberships in the driver.
3289 		 * This had to be deferred until we had attached.
3290 		 */
3291 		ill_recover_multicast(ill);
3292 	}
3293 
3294 	if (ill->ill_ipif_up_count == 1) {
3295 		/*
3296 		 * Since the interface is now up, it may now be active.
3297 		 */
3298 		if (IS_UNDER_IPMP(ill))
3299 			ipmp_ill_refresh_active(ill);
3300 	}
3301 
3302 	/* Join the allhosts multicast address and the solicited node MC */
3303 	ipif_multicast_up(ipif);
3304 
3305 	/*
3306 	 * See if anybody else would benefit from our new ipif.
3307 	 */
3308 	if (!loopback &&
3309 	    !(ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST|IPIF_DEPRECATED))) {
3310 		ill_update_source_selection(ill);
3311 	}
3312 
3313 	for (irep1 = irep; irep1 > ire_array; ) {
3314 		irep1--;
3315 		if (*irep1 != NULL) {
3316 			/* was held in ire_add */
3317 			ire_refrele(*irep1);
3318 		}
3319 	}
3320 
3321 	cnt = ipif_saved_ire_cnt;
3322 	for (irep1 = ipif_saved_irep; cnt > 0; irep1++, cnt--) {
3323 		if (*irep1 != NULL) {
3324 			/* was held in ire_add */
3325 			ire_refrele(*irep1);
3326 		}
3327 	}
3328 
3329 	if (ipif->ipif_addr_ready)
3330 		ipif_up_notify(ipif);
3331 
3332 	if (ipif_saved_irep != NULL) {
3333 		kmem_free(ipif_saved_irep,
3334 		    ipif_saved_ire_cnt * sizeof (ire_t *));
3335 	}
3336 
3337 	if (src_ipif_held)
3338 		ipif_refrele(src_ipif);
3339 
3340 	return (0);
3341 
3342 bad:
3343 	if (ip6_asp_table_held)
3344 		ip6_asp_table_refrele(ipst);
3345 
3346 	while (irep > ire_array) {
3347 		irep--;
3348 		if (*irep != NULL)
3349 			ire_delete(*irep);
3350 	}
3351 	(void) ip_srcid_remove(&ipif->ipif_v6lcl_addr, ipif->ipif_zoneid, ipst);
3352 
3353 	if (ipif_saved_irep != NULL) {
3354 		kmem_free(ipif_saved_irep,
3355 		    ipif_saved_ire_cnt * sizeof (ire_t *));
3356 	}
3357 	if (src_ipif_held)
3358 		ipif_refrele(src_ipif);
3359 
3360 	ipif_ndp_down(ipif);
3361 	ipif_resolver_down(ipif);
3362 
3363 	return (err);
3364 }
3365 
3366 /*
3367  * Delete an ND entry and the corresponding IRE_CACHE entry if it exists.
3368  */
3369 /* ARGSUSED */
3370 int
3371 ip_siocdelndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
3372     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
3373 {
3374 	sin6_t		*sin6;
3375 	nce_t		*nce;
3376 	struct lifreq	*lifr;
3377 	lif_nd_req_t	*lnr;
3378 	ill_t		*ill = ipif->ipif_ill;
3379 	ire_t		*ire;
3380 
3381 	lifr = (struct lifreq *)mp->b_cont->b_cont->b_rptr;
3382 	lnr = &lifr->lifr_nd;
3383 	/* Only allow for logical unit zero i.e. not on "le0:17" */
3384 	if (ipif->ipif_id != 0)
3385 		return (EINVAL);
3386 
3387 	if (!ipif->ipif_isv6)
3388 		return (EINVAL);
3389 
3390 	if (lnr->lnr_addr.ss_family != AF_INET6)
3391 		return (EAFNOSUPPORT);
3392 
3393 	sin6 = (sin6_t *)&lnr->lnr_addr;
3394 
3395 	/*
3396 	 * Since ND mappings must be consistent across an IPMP group, prohibit
3397 	 * deleting ND mappings on underlying interfaces.  Also, since ND
3398 	 * mappings for IPMP data addresses are owned by IP itself, prohibit
3399 	 * deleting them.
3400 	 */
3401 	if (IS_UNDER_IPMP(ill))
3402 		return (EPERM);
3403 
3404 	if (IS_IPMP(ill)) {
3405 		ire = ire_ctable_lookup_v6(&sin6->sin6_addr, NULL, IRE_LOCAL,
3406 		    ipif, ALL_ZONES, NULL, MATCH_IRE_TYPE | MATCH_IRE_ILL,
3407 		    ill->ill_ipst);
3408 		if (ire != NULL) {
3409 			ire_refrele(ire);
3410 			return (EPERM);
3411 		}
3412 	}
3413 
3414 	/* See comment in ndp_query() regarding IS_IPMP(ill) usage */
3415 	nce = ndp_lookup_v6(ill, IS_IPMP(ill), &sin6->sin6_addr, B_FALSE);
3416 	if (nce == NULL)
3417 		return (ESRCH);
3418 	ndp_delete(nce);
3419 	NCE_REFRELE(nce);
3420 	return (0);
3421 }
3422 
3423 /*
3424  * Return nbr cache info.
3425  */
3426 /* ARGSUSED */
3427 int
3428 ip_siocqueryndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
3429     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
3430 {
3431 	ill_t		*ill = ipif->ipif_ill;
3432 	struct lifreq	*lifr;
3433 	lif_nd_req_t	*lnr;
3434 
3435 	lifr = (struct lifreq *)mp->b_cont->b_cont->b_rptr;
3436 	lnr = &lifr->lifr_nd;
3437 	/* Only allow for logical unit zero i.e. not on "le0:17" */
3438 	if (ipif->ipif_id != 0)
3439 		return (EINVAL);
3440 
3441 	if (!ipif->ipif_isv6)
3442 		return (EINVAL);
3443 
3444 	if (lnr->lnr_addr.ss_family != AF_INET6)
3445 		return (EAFNOSUPPORT);
3446 
3447 	if (ill->ill_phys_addr_length > sizeof (lnr->lnr_hdw_addr))
3448 		return (EINVAL);
3449 
3450 	return (ndp_query(ill, lnr));
3451 }
3452 
3453 /*
3454  * Perform an update of the nd entry for the specified address.
3455  */
3456 /* ARGSUSED */
3457 int
3458 ip_siocsetndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
3459     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
3460 {
3461 	sin6_t		*sin6;
3462 	ill_t		*ill = ipif->ipif_ill;
3463 	struct	lifreq	*lifr;
3464 	lif_nd_req_t	*lnr;
3465 	ire_t		*ire;
3466 
3467 	lifr = (struct lifreq *)mp->b_cont->b_cont->b_rptr;
3468 	lnr = &lifr->lifr_nd;
3469 	/* Only allow for logical unit zero i.e. not on "le0:17" */
3470 	if (ipif->ipif_id != 0)
3471 		return (EINVAL);
3472 
3473 	if (!ipif->ipif_isv6)
3474 		return (EINVAL);
3475 
3476 	if (lnr->lnr_addr.ss_family != AF_INET6)
3477 		return (EAFNOSUPPORT);
3478 
3479 	sin6 = (sin6_t *)&lnr->lnr_addr;
3480 
3481 	/*
3482 	 * Since ND mappings must be consistent across an IPMP group, prohibit
3483 	 * updating ND mappings on underlying interfaces.  Also, since ND
3484 	 * mappings for IPMP data addresses are owned by IP itself, prohibit
3485 	 * updating them.
3486 	 */
3487 	if (IS_UNDER_IPMP(ill))
3488 		return (EPERM);
3489 
3490 	if (IS_IPMP(ill)) {
3491 		ire = ire_ctable_lookup_v6(&sin6->sin6_addr, NULL, IRE_LOCAL,
3492 		    ipif, ALL_ZONES, NULL, MATCH_IRE_TYPE | MATCH_IRE_ILL,
3493 		    ill->ill_ipst);
3494 		if (ire != NULL) {
3495 			ire_refrele(ire);
3496 			return (EPERM);
3497 		}
3498 	}
3499 
3500 	return (ndp_sioc_update(ill, lnr));
3501 }
3502