xref: /titanic_41/usr/src/uts/common/inet/ip/ip6_if.c (revision 51208d123c034a24326c8a1bfc3b557a63d467e8)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 /*
26  * Copyright (c) 1990 Mentat Inc.
27  */
28 
29 #pragma ident	"%Z%%M%	%I%	%E% SMI"
30 
31 /*
32  * This file contains the interface control functions for IPv6.
33  */
34 
35 #include <sys/types.h>
36 #include <sys/sysmacros.h>
37 #include <sys/stream.h>
38 #include <sys/dlpi.h>
39 #include <sys/stropts.h>
40 #include <sys/ddi.h>
41 #include <sys/cmn_err.h>
42 #include <sys/kstat.h>
43 #include <sys/debug.h>
44 #include <sys/zone.h>
45 #include <sys/policy.h>
46 
47 #include <sys/systm.h>
48 #include <sys/param.h>
49 #include <sys/socket.h>
50 #include <sys/isa_defs.h>
51 #include <net/if.h>
52 #include <net/if_dl.h>
53 #include <net/route.h>
54 #include <netinet/in.h>
55 #include <netinet/igmp_var.h>
56 #include <netinet/ip6.h>
57 #include <netinet/icmp6.h>
58 #include <netinet/in.h>
59 
60 #include <inet/common.h>
61 #include <inet/nd.h>
62 #include <inet/mib2.h>
63 #include <inet/ip.h>
64 #include <inet/ip6.h>
65 #include <inet/ip_multi.h>
66 #include <inet/ip_ire.h>
67 #include <inet/ip_rts.h>
68 #include <inet/ip_ndp.h>
69 #include <inet/ip_if.h>
70 #include <inet/ip6_asp.h>
71 #include <inet/tun.h>
72 #include <inet/ipclassifier.h>
73 #include <inet/sctp_ip.h>
74 
75 #include <sys/tsol/tndb.h>
76 #include <sys/tsol/tnet.h>
77 
78 static in6_addr_t	ipv6_ll_template =
79 			{(uint32_t)V6_LINKLOCAL, 0x0, 0x0, 0x0};
80 
81 static ipif_t *
82 ipif_lookup_interface_v6(const in6_addr_t *if_addr, const in6_addr_t *dst,
83     queue_t *q, mblk_t *mp, ipsq_func_t func, int *error, ip_stack_t *ipst);
84 
85 /*
86  * ipif_lookup_group_v6
87  */
88 ipif_t *
89 ipif_lookup_group_v6(const in6_addr_t *group, zoneid_t zoneid, ip_stack_t *ipst)
90 {
91 	ire_t	*ire;
92 	ipif_t	*ipif;
93 
94 	ire = ire_lookup_multi_v6(group, zoneid, ipst);
95 	if (ire == NULL)
96 		return (NULL);
97 	ipif = ire->ire_ipif;
98 	ipif_refhold(ipif);
99 	ire_refrele(ire);
100 	return (ipif);
101 }
102 
103 /*
104  * ill_lookup_group_v6
105  */
106 ill_t *
107 ill_lookup_group_v6(const in6_addr_t *group, zoneid_t zoneid, ip_stack_t *ipst)
108 {
109 	ire_t	*ire;
110 	ill_t	*ill;
111 
112 	ire = ire_lookup_multi_v6(group, zoneid, ipst);
113 	if (ire == NULL)
114 		return (NULL);
115 	ill = ire->ire_ipif->ipif_ill;
116 	ill_refhold(ill);
117 	ire_refrele(ire);
118 	return (ill);
119 }
120 
121 /*
122  * Look for an ipif with the specified interface address and destination.
123  * The destination address is used only for matching point-to-point interfaces.
124  */
125 static ipif_t *
126 ipif_lookup_interface_v6(const in6_addr_t *if_addr, const in6_addr_t *dst,
127     queue_t *q, mblk_t *mp, ipsq_func_t func, int *error, ip_stack_t *ipst)
128 {
129 	ipif_t	*ipif;
130 	ill_t	*ill;
131 	ipsq_t	*ipsq;
132 	ill_walk_context_t ctx;
133 
134 	if (error != NULL)
135 		*error = 0;
136 
137 	/*
138 	 * First match all the point-to-point interfaces
139 	 * before looking at non-point-to-point interfaces.
140 	 * This is done to avoid returning non-point-to-point
141 	 * ipif instead of unnumbered point-to-point ipif.
142 	 */
143 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
144 	ill = ILL_START_WALK_V6(&ctx, ipst);
145 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
146 		GRAB_CONN_LOCK(q);
147 		mutex_enter(&ill->ill_lock);
148 		for (ipif = ill->ill_ipif; ipif != NULL;
149 		    ipif = ipif->ipif_next) {
150 			/* Allow the ipif to be down */
151 			if ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
152 			    (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr,
153 			    if_addr)) &&
154 			    (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr,
155 			    dst))) {
156 				if (IPIF_CAN_LOOKUP(ipif)) {
157 					ipif_refhold_locked(ipif);
158 					mutex_exit(&ill->ill_lock);
159 					RELEASE_CONN_LOCK(q);
160 					rw_exit(&ipst->ips_ill_g_lock);
161 					return (ipif);
162 				} else if (IPIF_CAN_WAIT(ipif, q)) {
163 					ipsq = ill->ill_phyint->phyint_ipsq;
164 					mutex_enter(&ipsq->ipsq_lock);
165 					mutex_exit(&ill->ill_lock);
166 					rw_exit(&ipst->ips_ill_g_lock);
167 					ipsq_enq(ipsq, q, mp, func, NEW_OP,
168 						ill);
169 					mutex_exit(&ipsq->ipsq_lock);
170 					RELEASE_CONN_LOCK(q);
171 					*error = EINPROGRESS;
172 					return (NULL);
173 				}
174 			}
175 		}
176 		mutex_exit(&ill->ill_lock);
177 		RELEASE_CONN_LOCK(q);
178 	}
179 	rw_exit(&ipst->ips_ill_g_lock);
180 	/* lookup the ipif based on interface address */
181 	ipif = ipif_lookup_addr_v6(if_addr, NULL, ALL_ZONES, q, mp, func,
182 	    error, ipst);
183 	ASSERT(ipif == NULL || ipif->ipif_isv6);
184 	return (ipif);
185 }
186 
187 /*
188  * Look for an ipif with the specified address. For point-point links
189  * we look for matches on either the destination address and the local
190  * address, but we ignore the check on the local address if IPIF_UNNUMBERED
191  * is set.
192  * Matches on a specific ill if match_ill is set.
193  */
194 /* ARGSUSED */
195 ipif_t *
196 ipif_lookup_addr_v6(const in6_addr_t *addr, ill_t *match_ill, zoneid_t zoneid,
197     queue_t *q, mblk_t *mp, ipsq_func_t func, int *error, ip_stack_t *ipst)
198 {
199 	ipif_t	*ipif;
200 	ill_t	*ill;
201 	boolean_t  ptp = B_FALSE;
202 	ipsq_t	*ipsq;
203 	ill_walk_context_t ctx;
204 
205 	if (error != NULL)
206 		*error = 0;
207 
208 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
209 	/*
210 	 * Repeat twice, first based on local addresses and
211 	 * next time for pointopoint.
212 	 */
213 repeat:
214 	ill = ILL_START_WALK_V6(&ctx, ipst);
215 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
216 		if (match_ill != NULL && ill != match_ill) {
217 			continue;
218 		}
219 		GRAB_CONN_LOCK(q);
220 		mutex_enter(&ill->ill_lock);
221 		for (ipif = ill->ill_ipif; ipif != NULL;
222 		    ipif = ipif->ipif_next) {
223 			if (zoneid != ALL_ZONES &&
224 			    ipif->ipif_zoneid != zoneid &&
225 			    ipif->ipif_zoneid != ALL_ZONES)
226 				continue;
227 			/* Allow the ipif to be down */
228 			if ((!ptp && (IN6_ARE_ADDR_EQUAL(
229 			    &ipif->ipif_v6lcl_addr, addr) &&
230 			    (ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) ||
231 			    (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) &&
232 			    IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr,
233 			    addr))) {
234 				if (IPIF_CAN_LOOKUP(ipif)) {
235 					ipif_refhold_locked(ipif);
236 					mutex_exit(&ill->ill_lock);
237 					RELEASE_CONN_LOCK(q);
238 					rw_exit(&ipst->ips_ill_g_lock);
239 					return (ipif);
240 				} else if (IPIF_CAN_WAIT(ipif, q)) {
241 					ipsq = ill->ill_phyint->phyint_ipsq;
242 					mutex_enter(&ipsq->ipsq_lock);
243 					mutex_exit(&ill->ill_lock);
244 					rw_exit(&ipst->ips_ill_g_lock);
245 					ipsq_enq(ipsq, q, mp, func, NEW_OP,
246 						ill);
247 					mutex_exit(&ipsq->ipsq_lock);
248 					RELEASE_CONN_LOCK(q);
249 					*error = EINPROGRESS;
250 					return (NULL);
251 				}
252 			}
253 		}
254 		mutex_exit(&ill->ill_lock);
255 		RELEASE_CONN_LOCK(q);
256 	}
257 
258 	/* If we already did the ptp case, then we are done */
259 	if (ptp) {
260 		rw_exit(&ipst->ips_ill_g_lock);
261 		if (error != NULL)
262 			*error = ENXIO;
263 		return (NULL);
264 	}
265 	ptp = B_TRUE;
266 	goto repeat;
267 }
268 
269 /*
270  * Look for an ipif with the specified address. For point-point links
271  * we look for matches on either the destination address and the local
272  * address, but we ignore the check on the local address if IPIF_UNNUMBERED
273  * is set.
274  * Matches on a specific ill if match_ill is set.
275  * Return the zoneid for the ipif. ALL_ZONES if none found.
276  */
277 zoneid_t
278 ipif_lookup_addr_zoneid_v6(const in6_addr_t *addr, ill_t *match_ill,
279     ip_stack_t *ipst)
280 {
281 	ipif_t	*ipif;
282 	ill_t	*ill;
283 	boolean_t  ptp = B_FALSE;
284 	ill_walk_context_t ctx;
285 	zoneid_t	zoneid;
286 
287 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
288 	/*
289 	 * Repeat twice, first based on local addresses and
290 	 * next time for pointopoint.
291 	 */
292 repeat:
293 	ill = ILL_START_WALK_V6(&ctx, ipst);
294 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
295 		if (match_ill != NULL && ill != match_ill) {
296 			continue;
297 		}
298 		mutex_enter(&ill->ill_lock);
299 		for (ipif = ill->ill_ipif; ipif != NULL;
300 		    ipif = ipif->ipif_next) {
301 			/* Allow the ipif to be down */
302 			if ((!ptp && (IN6_ARE_ADDR_EQUAL(
303 			    &ipif->ipif_v6lcl_addr, addr) &&
304 			    (ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) ||
305 			    (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) &&
306 			    IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr,
307 			    addr)) &&
308 			    !(ipif->ipif_state_flags & IPIF_CONDEMNED)) {
309 				zoneid = ipif->ipif_zoneid;
310 				mutex_exit(&ill->ill_lock);
311 				rw_exit(&ipst->ips_ill_g_lock);
312 				/*
313 				 * If ipif_zoneid was ALL_ZONES then we have
314 				 * a trusted extensions shared IP address.
315 				 * In that case GLOBAL_ZONEID works to send.
316 				 */
317 				if (zoneid == ALL_ZONES)
318 					zoneid = GLOBAL_ZONEID;
319 				return (zoneid);
320 			}
321 		}
322 		mutex_exit(&ill->ill_lock);
323 	}
324 
325 	/* If we already did the ptp case, then we are done */
326 	if (ptp) {
327 		rw_exit(&ipst->ips_ill_g_lock);
328 		return (ALL_ZONES);
329 	}
330 	ptp = B_TRUE;
331 	goto repeat;
332 }
333 
334 /*
335  * Perform various checks to verify that an address would make sense as a local
336  * interface address.  This is currently only called when an attempt is made
337  * to set a local address.
338  *
339  * Does not allow a v4-mapped address, an address that equals the subnet
340  * anycast address, ... a multicast address, ...
341  */
342 boolean_t
343 ip_local_addr_ok_v6(const in6_addr_t *addr, const in6_addr_t *subnet_mask)
344 {
345 	in6_addr_t subnet;
346 
347 	if (IN6_IS_ADDR_UNSPECIFIED(addr))
348 		return (B_TRUE);	/* Allow all zeros */
349 
350 	/*
351 	 * Don't allow all zeroes or host part, but allow
352 	 * all ones netmask.
353 	 */
354 	V6_MASK_COPY(*addr, *subnet_mask, subnet);
355 	if (IN6_IS_ADDR_V4MAPPED(addr) ||
356 	    (IN6_ARE_ADDR_EQUAL(addr, &subnet) &&
357 	    !IN6_ARE_ADDR_EQUAL(subnet_mask, &ipv6_all_ones)) ||
358 	    (IN6_IS_ADDR_V4COMPAT(addr) && CLASSD(V4_PART_OF_V6((*addr)))) ||
359 	    IN6_IS_ADDR_MULTICAST(addr))
360 		return (B_FALSE);
361 
362 	return (B_TRUE);
363 }
364 
365 /*
366  * Perform various checks to verify that an address would make sense as a
367  * remote/subnet interface address.
368  */
369 boolean_t
370 ip_remote_addr_ok_v6(const in6_addr_t *addr, const in6_addr_t *subnet_mask)
371 {
372 	in6_addr_t subnet;
373 
374 	if (IN6_IS_ADDR_UNSPECIFIED(addr))
375 		return (B_TRUE);	/* Allow all zeros */
376 
377 	V6_MASK_COPY(*addr, *subnet_mask, subnet);
378 	if (IN6_IS_ADDR_V4MAPPED(addr) ||
379 	    (IN6_ARE_ADDR_EQUAL(addr, &subnet) &&
380 	    !IN6_ARE_ADDR_EQUAL(subnet_mask, &ipv6_all_ones)) ||
381 	    IN6_IS_ADDR_MULTICAST(addr) ||
382 	    (IN6_IS_ADDR_V4COMPAT(addr) && CLASSD(V4_PART_OF_V6((*addr)))))
383 		return (B_FALSE);
384 
385 	return (B_TRUE);
386 }
387 
388 /*
389  * ip_rt_add_v6 is called to add an IPv6 route to the forwarding table.
390  * ipif_arg is passed in to associate it with the correct interface
391  * (for link-local destinations and gateways).
392  */
393 /* ARGSUSED1 */
394 int
395 ip_rt_add_v6(const in6_addr_t *dst_addr, const in6_addr_t *mask,
396     const in6_addr_t *gw_addr, const in6_addr_t *src_addr, int flags,
397     ipif_t *ipif_arg, ire_t **ire_arg, queue_t *q, mblk_t *mp, ipsq_func_t func,
398     struct rtsa_s *sp, ip_stack_t *ipst)
399 {
400 	ire_t	*ire;
401 	ire_t	*gw_ire = NULL;
402 	ipif_t	*ipif;
403 	boolean_t ipif_refheld = B_FALSE;
404 	uint_t	type;
405 	int	match_flags = MATCH_IRE_TYPE;
406 	int	error;
407 	tsol_gc_t *gc = NULL;
408 	tsol_gcgrp_t *gcgrp = NULL;
409 	boolean_t gcgrp_xtraref = B_FALSE;
410 
411 	if (ire_arg != NULL)
412 		*ire_arg = NULL;
413 
414 	/*
415 	 * Prevent routes with a zero gateway from being created (since
416 	 * interfaces can currently be plumbed and brought up with no assigned
417 	 * address).
418 	 */
419 	if (IN6_IS_ADDR_UNSPECIFIED(gw_addr))
420 		return (ENETUNREACH);
421 
422 	/*
423 	 * If this is the case of RTF_HOST being set, then we set the netmask
424 	 * to all ones (regardless if one was supplied).
425 	 */
426 	if (flags & RTF_HOST)
427 		mask = &ipv6_all_ones;
428 
429 	/*
430 	 * Get the ipif, if any, corresponding to the gw_addr
431 	 */
432 	ipif = ipif_lookup_interface_v6(gw_addr, dst_addr, q, mp, func,
433 	    &error, ipst);
434 	if (ipif != NULL)
435 		ipif_refheld = B_TRUE;
436 	else if (error == EINPROGRESS) {
437 		ip1dbg(("ip_rt_add_v6: null and EINPROGRESS"));
438 		return (error);
439 	}
440 
441 	/*
442 	 * GateD will attempt to create routes with a loopback interface
443 	 * address as the gateway and with RTF_GATEWAY set.  We allow
444 	 * these routes to be added, but create them as interface routes
445 	 * since the gateway is an interface address.
446 	 */
447 	if ((ipif != NULL) && (ipif->ipif_ire_type == IRE_LOOPBACK)) {
448 		flags &= ~RTF_GATEWAY;
449 		if (IN6_ARE_ADDR_EQUAL(gw_addr, &ipv6_loopback) &&
450 		    IN6_ARE_ADDR_EQUAL(dst_addr, &ipv6_loopback) &&
451 		    IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones)) {
452 			ire = ire_ctable_lookup_v6(dst_addr, 0, IRE_LOOPBACK,
453 			    ipif, ALL_ZONES, NULL, match_flags, ipst);
454 			if (ire != NULL) {
455 				ire_refrele(ire);
456 				if (ipif_refheld)
457 					ipif_refrele(ipif);
458 				return (EEXIST);
459 			}
460 			ip1dbg(("ipif_up_done: 0x%p creating IRE 0x%x"
461 			    "for 0x%x\n", (void *)ipif,
462 			    ipif->ipif_ire_type,
463 			    ntohl(ipif->ipif_lcl_addr)));
464 			ire = ire_create_v6(
465 			    dst_addr,
466 			    mask,
467 			    &ipif->ipif_v6src_addr,
468 			    NULL,
469 			    &ipif->ipif_mtu,
470 			    NULL,
471 			    NULL,
472 			    NULL,
473 			    ipif->ipif_net_type,
474 			    ipif->ipif_resolver_mp,
475 			    ipif,
476 			    NULL,
477 			    0,
478 			    0,
479 			    flags,
480 			    &ire_uinfo_null,
481 			    NULL,
482 			    NULL,
483 			    ipst);
484 			if (ire == NULL) {
485 				if (ipif_refheld)
486 					ipif_refrele(ipif);
487 				return (ENOMEM);
488 			}
489 			error = ire_add(&ire, q, mp, func, B_FALSE);
490 			if (error == 0)
491 				goto save_ire;
492 			/*
493 			 * In the result of failure, ire_add() will have already
494 			 * deleted the ire in question, so there is no need to
495 			 * do that here.
496 			 */
497 			if (ipif_refheld)
498 				ipif_refrele(ipif);
499 			return (error);
500 		}
501 	}
502 
503 	/*
504 	 * Traditionally, interface routes are ones where RTF_GATEWAY isn't set
505 	 * and the gateway address provided is one of the system's interface
506 	 * addresses.  By using the routing socket interface and supplying an
507 	 * RTA_IFP sockaddr with an interface index, an alternate method of
508 	 * specifying an interface route to be created is available which uses
509 	 * the interface index that specifies the outgoing interface rather than
510 	 * the address of an outgoing interface (which may not be able to
511 	 * uniquely identify an interface).  When coupled with the RTF_GATEWAY
512 	 * flag, routes can be specified which not only specify the next-hop to
513 	 * be used when routing to a certain prefix, but also which outgoing
514 	 * interface should be used.
515 	 *
516 	 * Previously, interfaces would have unique addresses assigned to them
517 	 * and so the address assigned to a particular interface could be used
518 	 * to identify a particular interface.  One exception to this was the
519 	 * case of an unnumbered interface (where IPIF_UNNUMBERED was set).
520 	 *
521 	 * With the advent of IPv6 and its link-local addresses, this
522 	 * restriction was relaxed and interfaces could share addresses between
523 	 * themselves.  In fact, typically all of the link-local interfaces on
524 	 * an IPv6 node or router will have the same link-local address.  In
525 	 * order to differentiate between these interfaces, the use of an
526 	 * interface index is necessary and this index can be carried inside a
527 	 * RTA_IFP sockaddr (which is actually a sockaddr_dl).  One restriction
528 	 * of using the interface index, however, is that all of the ipif's that
529 	 * are part of an ill have the same index and so the RTA_IFP sockaddr
530 	 * cannot be used to differentiate between ipif's (or logical
531 	 * interfaces) that belong to the same ill (physical interface).
532 	 *
533 	 * For example, in the following case involving IPv4 interfaces and
534 	 * logical interfaces
535 	 *
536 	 *	192.0.2.32	255.255.255.224	192.0.2.33	U	if0
537 	 *	192.0.2.32	255.255.255.224	192.0.2.34	U	if0:1
538 	 *	192.0.2.32	255.255.255.224	192.0.2.35	U	if0:2
539 	 *
540 	 * the ipif's corresponding to each of these interface routes can be
541 	 * uniquely identified by the "gateway" (actually interface address).
542 	 *
543 	 * In this case involving multiple IPv6 default routes to a particular
544 	 * link-local gateway, the use of RTA_IFP is necessary to specify which
545 	 * default route is of interest:
546 	 *
547 	 *	default		fe80::123:4567:89ab:cdef	U	if0
548 	 *	default		fe80::123:4567:89ab:cdef	U	if1
549 	 */
550 
551 	/* RTF_GATEWAY not set */
552 	if (!(flags & RTF_GATEWAY)) {
553 		queue_t	*stq;
554 
555 		if (sp != NULL) {
556 			ip2dbg(("ip_rt_add_v6: gateway security attributes "
557 			    "cannot be set with interface route\n"));
558 			if (ipif_refheld)
559 				ipif_refrele(ipif);
560 			return (EINVAL);
561 		}
562 
563 		/*
564 		 * As the interface index specified with the RTA_IFP sockaddr is
565 		 * the same for all ipif's off of an ill, the matching logic
566 		 * below uses MATCH_IRE_ILL if such an index was specified.
567 		 * This means that routes sharing the same prefix when added
568 		 * using a RTA_IFP sockaddr must have distinct interface
569 		 * indices (namely, they must be on distinct ill's).
570 		 *
571 		 * On the other hand, since the gateway address will usually be
572 		 * different for each ipif on the system, the matching logic
573 		 * uses MATCH_IRE_IPIF in the case of a traditional interface
574 		 * route.  This means that interface routes for the same prefix
575 		 * can be created if they belong to distinct ipif's and if a
576 		 * RTA_IFP sockaddr is not present.
577 		 */
578 		if (ipif_arg != NULL) {
579 			if (ipif_refheld) {
580 				ipif_refrele(ipif);
581 				ipif_refheld = B_FALSE;
582 			}
583 			ipif = ipif_arg;
584 			match_flags |= MATCH_IRE_ILL;
585 		} else {
586 			/*
587 			 * Check the ipif corresponding to the gw_addr
588 			 */
589 			if (ipif == NULL)
590 				return (ENETUNREACH);
591 			match_flags |= MATCH_IRE_IPIF;
592 		}
593 
594 		ASSERT(ipif != NULL);
595 		/*
596 		 * We check for an existing entry at this point.
597 		 */
598 		match_flags |= MATCH_IRE_MASK;
599 		ire = ire_ftable_lookup_v6(dst_addr, mask, 0, IRE_INTERFACE,
600 		    ipif, NULL, ALL_ZONES, 0, NULL, match_flags, ipst);
601 		if (ire != NULL) {
602 			ire_refrele(ire);
603 			if (ipif_refheld)
604 				ipif_refrele(ipif);
605 			return (EEXIST);
606 		}
607 
608 		stq = (ipif->ipif_net_type == IRE_IF_RESOLVER)
609 		    ? ipif->ipif_rq : ipif->ipif_wq;
610 
611 		/*
612 		 * Create a copy of the IRE_LOOPBACK, IRE_IF_NORESOLVER or
613 		 * IRE_IF_RESOLVER with the modified address and netmask.
614 		 */
615 		ire = ire_create_v6(
616 		    dst_addr,
617 		    mask,
618 		    &ipif->ipif_v6src_addr,
619 		    NULL,
620 		    &ipif->ipif_mtu,
621 		    NULL,
622 		    NULL,
623 		    stq,
624 		    ipif->ipif_net_type,
625 		    ipif->ipif_resolver_mp,
626 		    ipif,
627 		    NULL,
628 		    0,
629 		    0,
630 		    flags,
631 		    &ire_uinfo_null,
632 		    NULL,
633 		    NULL,
634 		    ipst);
635 		if (ire == NULL) {
636 			if (ipif_refheld)
637 				ipif_refrele(ipif);
638 			return (ENOMEM);
639 		}
640 
641 		/*
642 		 * Some software (for example, GateD and Sun Cluster) attempts
643 		 * to create (what amount to) IRE_PREFIX routes with the
644 		 * loopback address as the gateway.  This is primarily done to
645 		 * set up prefixes with the RTF_REJECT flag set (for example,
646 		 * when generating aggregate routes.)
647 		 *
648 		 * If the IRE type (as defined by ipif->ipif_net_type) is
649 		 * IRE_LOOPBACK, then we map the request into a
650 		 * IRE_IF_NORESOLVER.
651 		 *
652 		 * Needless to say, the real IRE_LOOPBACK is NOT created by this
653 		 * routine, but rather using ire_create_v6() directly.
654 		 */
655 		if (ipif->ipif_net_type == IRE_LOOPBACK)
656 			ire->ire_type = IRE_IF_NORESOLVER;
657 		error = ire_add(&ire, q, mp, func, B_FALSE);
658 		if (error == 0)
659 			goto save_ire;
660 		/*
661 		 * In the result of failure, ire_add() will have already
662 		 * deleted the ire in question, so there is no need to
663 		 * do that here.
664 		 */
665 		if (ipif_refheld)
666 			ipif_refrele(ipif);
667 		return (error);
668 	}
669 	if (ipif_refheld) {
670 		ipif_refrele(ipif);
671 		ipif_refheld = B_FALSE;
672 	}
673 
674 	/*
675 	 * Get an interface IRE for the specified gateway.
676 	 * If we don't have an IRE_IF_NORESOLVER or IRE_IF_RESOLVER for the
677 	 * gateway, it is currently unreachable and we fail the request
678 	 * accordingly.
679 	 */
680 	ipif = ipif_arg;
681 	if (ipif_arg != NULL)
682 		match_flags |= MATCH_IRE_ILL;
683 	gw_ire = ire_ftable_lookup_v6(gw_addr, 0, 0, IRE_INTERFACE, ipif_arg,
684 	    NULL, ALL_ZONES, 0, NULL, match_flags, ipst);
685 	if (gw_ire == NULL)
686 		return (ENETUNREACH);
687 
688 	/*
689 	 * We create one of three types of IREs as a result of this request
690 	 * based on the netmask.  A netmask of all ones (which is automatically
691 	 * assumed when RTF_HOST is set) results in an IRE_HOST being created.
692 	 * An all zeroes netmask implies a default route so an IRE_DEFAULT is
693 	 * created.  Otherwise, an IRE_PREFIX route is created for the
694 	 * destination prefix.
695 	 */
696 	if (IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones))
697 		type = IRE_HOST;
698 	else if (IN6_IS_ADDR_UNSPECIFIED(mask))
699 		type = IRE_DEFAULT;
700 	else
701 		type = IRE_PREFIX;
702 
703 	/* check for a duplicate entry */
704 	ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr, type, ipif_arg,
705 	    NULL, ALL_ZONES, 0, NULL,
706 	    match_flags | MATCH_IRE_MASK | MATCH_IRE_GW, ipst);
707 	if (ire != NULL) {
708 		ire_refrele(gw_ire);
709 		ire_refrele(ire);
710 		return (EEXIST);
711 	}
712 
713 	/* Security attribute exists */
714 	if (sp != NULL) {
715 		tsol_gcgrp_addr_t ga;
716 
717 		/* find or create the gateway credentials group */
718 		ga.ga_af = AF_INET6;
719 		ga.ga_addr = *gw_addr;
720 
721 		/* we hold reference to it upon success */
722 		gcgrp = gcgrp_lookup(&ga, B_TRUE);
723 		if (gcgrp == NULL) {
724 			ire_refrele(gw_ire);
725 			return (ENOMEM);
726 		}
727 
728 		/*
729 		 * Create and add the security attribute to the group; a
730 		 * reference to the group is made upon allocating a new
731 		 * entry successfully.  If it finds an already-existing
732 		 * entry for the security attribute in the group, it simply
733 		 * returns it and no new reference is made to the group.
734 		 */
735 		gc = gc_create(sp, gcgrp, &gcgrp_xtraref);
736 		if (gc == NULL) {
737 			/* release reference held by gcgrp_lookup */
738 			GCGRP_REFRELE(gcgrp);
739 			ire_refrele(gw_ire);
740 			return (ENOMEM);
741 		}
742 	}
743 
744 	/* Create the IRE. */
745 	ire = ire_create_v6(
746 	    dst_addr,				/* dest address */
747 	    mask,				/* mask */
748 	    /* src address assigned by the caller? */
749 	    (((flags & RTF_SETSRC) && !IN6_IS_ADDR_UNSPECIFIED(src_addr)) ?
750 		src_addr : NULL),
751 	    gw_addr,				/* gateway address */
752 	    &gw_ire->ire_max_frag,
753 	    NULL,				/* no Fast Path header */
754 	    NULL,				/* no recv-from queue */
755 	    NULL,				/* no send-to queue */
756 	    (ushort_t)type,			/* IRE type */
757 	    NULL,
758 	    ipif_arg,
759 	    NULL,
760 	    0,
761 	    0,
762 	    flags,
763 	    &gw_ire->ire_uinfo,			/* Inherit ULP info from gw */
764 	    gc,					/* security attribute */
765 	    NULL,
766 	    ipst);
767 
768 	/*
769 	 * The ire holds a reference to the 'gc' and the 'gc' holds a
770 	 * reference to the 'gcgrp'. We can now release the extra reference
771 	 * the 'gcgrp' acquired in the gcgrp_lookup, if it was not used.
772 	 */
773 	if (gcgrp_xtraref)
774 		GCGRP_REFRELE(gcgrp);
775 	if (ire == NULL) {
776 		if (gc != NULL)
777 			GC_REFRELE(gc);
778 		ire_refrele(gw_ire);
779 		return (ENOMEM);
780 	}
781 
782 	/*
783 	 * POLICY: should we allow an RTF_HOST with address INADDR_ANY?
784 	 * SUN/OS socket stuff does but do we really want to allow ::0 ?
785 	 */
786 
787 	/* Add the new IRE. */
788 	error = ire_add(&ire, q, mp, func, B_FALSE);
789 	/*
790 	 * In the result of failure, ire_add() will have already
791 	 * deleted the ire in question, so there is no need to
792 	 * do that here.
793 	 */
794 	if (error != 0) {
795 		ire_refrele(gw_ire);
796 		return (error);
797 	}
798 
799 	if (flags & RTF_MULTIRT) {
800 		/*
801 		 * Invoke the CGTP (multirouting) filtering module
802 		 * to add the dst address in the filtering database.
803 		 * Replicated inbound packets coming from that address
804 		 * will be filtered to discard the duplicates.
805 		 * It is not necessary to call the CGTP filter hook
806 		 * when the dst address is a multicast, because an
807 		 * IP source address cannot be a multicast.
808 		 */
809 		if ((ip_cgtp_filter_ops != NULL) &&
810 		    ipst->ips_netstack->netstack_stackid == GLOBAL_NETSTACKID &&
811 		    !IN6_IS_ADDR_MULTICAST(&(ire->ire_addr_v6))) {
812 			int res = ip_cgtp_filter_ops->cfo_add_dest_v6(
813 			    &ire->ire_addr_v6,
814 			    &ire->ire_gateway_addr_v6,
815 			    &ire->ire_src_addr_v6,
816 			    &gw_ire->ire_src_addr_v6);
817 			if (res != 0) {
818 				ire_refrele(gw_ire);
819 				ire_delete(ire);
820 				return (res);
821 			}
822 		}
823 	}
824 
825 	/*
826 	 * Now that the prefix IRE entry has been created, delete any
827 	 * existing gateway IRE cache entries as well as any IRE caches
828 	 * using the gateway, and force them to be created through
829 	 * ip_newroute_v6.
830 	 */
831 	if (gc != NULL) {
832 		ASSERT(gcgrp != NULL);
833 		ire_clookup_delete_cache_gw_v6(gw_addr, ALL_ZONES, ipst);
834 	}
835 
836 save_ire:
837 	if (gw_ire != NULL) {
838 		ire_refrele(gw_ire);
839 	}
840 	if (ipif != NULL) {
841 		mblk_t	*save_mp;
842 
843 		/*
844 		 * Save enough information so that we can recreate the IRE if
845 		 * the interface goes down and then up.  The metrics associated
846 		 * with the route will be saved as well when rts_setmetrics() is
847 		 * called after the IRE has been created.  In the case where
848 		 * memory cannot be allocated, none of this information will be
849 		 * saved.
850 		 */
851 		save_mp = allocb(sizeof (ifrt_t), BPRI_MED);
852 		if (save_mp != NULL) {
853 			ifrt_t	*ifrt;
854 
855 			save_mp->b_wptr += sizeof (ifrt_t);
856 			ifrt = (ifrt_t *)save_mp->b_rptr;
857 			bzero(ifrt, sizeof (ifrt_t));
858 			ifrt->ifrt_type = ire->ire_type;
859 			ifrt->ifrt_v6addr = ire->ire_addr_v6;
860 			mutex_enter(&ire->ire_lock);
861 			ifrt->ifrt_v6gateway_addr = ire->ire_gateway_addr_v6;
862 			ifrt->ifrt_v6src_addr = ire->ire_src_addr_v6;
863 			mutex_exit(&ire->ire_lock);
864 			ifrt->ifrt_v6mask = ire->ire_mask_v6;
865 			ifrt->ifrt_flags = ire->ire_flags;
866 			ifrt->ifrt_max_frag = ire->ire_max_frag;
867 			mutex_enter(&ipif->ipif_saved_ire_lock);
868 			save_mp->b_cont = ipif->ipif_saved_ire_mp;
869 			ipif->ipif_saved_ire_mp = save_mp;
870 			ipif->ipif_saved_ire_cnt++;
871 			mutex_exit(&ipif->ipif_saved_ire_lock);
872 		}
873 	}
874 	if (ire_arg != NULL) {
875 		/*
876 		 * Store the ire that was successfully added into where ire_arg
877 		 * points to so that callers don't have to look it up
878 		 * themselves (but they are responsible for ire_refrele()ing
879 		 * the ire when they are finished with it).
880 		 */
881 		*ire_arg = ire;
882 	} else {
883 		ire_refrele(ire);		/* Held in ire_add */
884 	}
885 	if (ipif_refheld)
886 		ipif_refrele(ipif);
887 	return (0);
888 }
889 
890 /*
891  * ip_rt_delete_v6 is called to delete an IPv6 route.
892  * ipif_arg is passed in to associate it with the correct interface
893  * (for link-local destinations and gateways).
894  */
895 /* ARGSUSED4 */
896 int
897 ip_rt_delete_v6(const in6_addr_t *dst_addr, const in6_addr_t *mask,
898     const in6_addr_t *gw_addr, uint_t rtm_addrs, int flags, ipif_t *ipif_arg,
899     queue_t *q, mblk_t *mp, ipsq_func_t func, ip_stack_t *ipst)
900 {
901 	ire_t	*ire = NULL;
902 	ipif_t	*ipif;
903 	uint_t	type;
904 	uint_t	match_flags = MATCH_IRE_TYPE;
905 	int	err = 0;
906 	boolean_t	ipif_refheld = B_FALSE;
907 
908 	/*
909 	 * If this is the case of RTF_HOST being set, then we set the netmask
910 	 * to all ones.  Otherwise, we use the netmask if one was supplied.
911 	 */
912 	if (flags & RTF_HOST) {
913 		mask = &ipv6_all_ones;
914 		match_flags |= MATCH_IRE_MASK;
915 	} else if (rtm_addrs & RTA_NETMASK) {
916 		match_flags |= MATCH_IRE_MASK;
917 	}
918 
919 	/*
920 	 * Note that RTF_GATEWAY is never set on a delete, therefore
921 	 * we check if the gateway address is one of our interfaces first,
922 	 * and fall back on RTF_GATEWAY routes.
923 	 *
924 	 * This makes it possible to delete an original
925 	 * IRE_IF_NORESOLVER/IRE_IF_RESOLVER - consistent with SunOS 4.1.
926 	 *
927 	 * As the interface index specified with the RTA_IFP sockaddr is the
928 	 * same for all ipif's off of an ill, the matching logic below uses
929 	 * MATCH_IRE_ILL if such an index was specified.  This means a route
930 	 * sharing the same prefix and interface index as the the route
931 	 * intended to be deleted might be deleted instead if a RTA_IFP sockaddr
932 	 * is specified in the request.
933 	 *
934 	 * On the other hand, since the gateway address will usually be
935 	 * different for each ipif on the system, the matching logic
936 	 * uses MATCH_IRE_IPIF in the case of a traditional interface
937 	 * route.  This means that interface routes for the same prefix can be
938 	 * uniquely identified if they belong to distinct ipif's and if a
939 	 * RTA_IFP sockaddr is not present.
940 	 *
941 	 * For more detail on specifying routes by gateway address and by
942 	 * interface index, see the comments in ip_rt_add_v6().
943 	 */
944 	ipif = ipif_lookup_interface_v6(gw_addr, dst_addr, q, mp, func, &err,
945 	    ipst);
946 	if (ipif != NULL) {
947 		ipif_refheld = B_TRUE;
948 		if (ipif_arg != NULL) {
949 			ipif_refrele(ipif);
950 			ipif_refheld = B_FALSE;
951 			ipif = ipif_arg;
952 			match_flags |= MATCH_IRE_ILL;
953 		} else {
954 			match_flags |= MATCH_IRE_IPIF;
955 		}
956 
957 		if (ipif->ipif_ire_type == IRE_LOOPBACK)
958 			ire = ire_ctable_lookup_v6(dst_addr, 0, IRE_LOOPBACK,
959 			    ipif, ALL_ZONES, NULL, match_flags, ipst);
960 		if (ire == NULL)
961 			ire = ire_ftable_lookup_v6(dst_addr, mask, 0,
962 			    IRE_INTERFACE, ipif, NULL, ALL_ZONES, 0, NULL,
963 			    match_flags, ipst);
964 	} else if (err == EINPROGRESS) {
965 		return (err);
966 	} else {
967 		err = 0;
968 	}
969 	if (ire == NULL) {
970 		/*
971 		 * At this point, the gateway address is not one of our own
972 		 * addresses or a matching interface route was not found.  We
973 		 * set the IRE type to lookup based on whether
974 		 * this is a host route, a default route or just a prefix.
975 		 *
976 		 * If an ipif_arg was passed in, then the lookup is based on an
977 		 * interface index so MATCH_IRE_ILL is added to match_flags.
978 		 * In any case, MATCH_IRE_IPIF is cleared and MATCH_IRE_GW is
979 		 * set as the route being looked up is not a traditional
980 		 * interface route.
981 		 */
982 		match_flags &= ~MATCH_IRE_IPIF;
983 		match_flags |= MATCH_IRE_GW;
984 		if (ipif_arg != NULL)
985 			match_flags |= MATCH_IRE_ILL;
986 		if (IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones))
987 			type = IRE_HOST;
988 		else if (IN6_IS_ADDR_UNSPECIFIED(mask))
989 			type = IRE_DEFAULT;
990 		else
991 			type = IRE_PREFIX;
992 		ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr, type,
993 		    ipif_arg, NULL, ALL_ZONES, 0, NULL, match_flags, ipst);
994 	}
995 
996 	if (ipif_refheld) {
997 		ipif_refrele(ipif);
998 		ipif_refheld = B_FALSE;
999 	}
1000 	if (ire == NULL)
1001 		return (ESRCH);
1002 
1003 	if (ire->ire_flags & RTF_MULTIRT) {
1004 		/*
1005 		 * Invoke the CGTP (multirouting) filtering module
1006 		 * to remove the dst address from the filtering database.
1007 		 * Packets coming from that address will no longer be
1008 		 * filtered to remove duplicates.
1009 		 */
1010 		if (ip_cgtp_filter_ops != NULL &&
1011 		    ipst->ips_netstack->netstack_stackid == GLOBAL_NETSTACKID) {
1012 			err = ip_cgtp_filter_ops->cfo_del_dest_v6(
1013 			    &ire->ire_addr_v6, &ire->ire_gateway_addr_v6);
1014 		}
1015 	}
1016 
1017 	ipif = ire->ire_ipif;
1018 	if (ipif != NULL) {
1019 		mblk_t		**mpp;
1020 		mblk_t		*mp;
1021 		ifrt_t		*ifrt;
1022 		in6_addr_t	gw_addr_v6;
1023 
1024 		/* Remove from ipif_saved_ire_mp list if it is there */
1025 		mutex_enter(&ire->ire_lock);
1026 		gw_addr_v6 = ire->ire_gateway_addr_v6;
1027 		mutex_exit(&ire->ire_lock);
1028 		mutex_enter(&ipif->ipif_saved_ire_lock);
1029 		for (mpp = &ipif->ipif_saved_ire_mp; *mpp != NULL;
1030 		    mpp = &(*mpp)->b_cont) {
1031 			/*
1032 			 * On a given ipif, the triple of address, gateway and
1033 			 * mask is unique for each saved IRE (in the case of
1034 			 * ordinary interface routes, the gateway address is
1035 			 * all-zeroes).
1036 			 */
1037 			mp = *mpp;
1038 			ifrt = (ifrt_t *)mp->b_rptr;
1039 			if (IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6addr,
1040 			    &ire->ire_addr_v6) &&
1041 			    IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6gateway_addr,
1042 			    &gw_addr_v6) &&
1043 			    IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6mask,
1044 			    &ire->ire_mask_v6)) {
1045 				*mpp = mp->b_cont;
1046 				ipif->ipif_saved_ire_cnt--;
1047 				freeb(mp);
1048 				break;
1049 			}
1050 		}
1051 		mutex_exit(&ipif->ipif_saved_ire_lock);
1052 	}
1053 	ire_delete(ire);
1054 	ire_refrele(ire);
1055 	return (err);
1056 }
1057 
1058 /*
1059  * Derive a token from the link layer address.
1060  */
1061 boolean_t
1062 ill_setdefaulttoken(ill_t *ill)
1063 {
1064 	int 		i;
1065 	in6_addr_t	v6addr, v6mask;
1066 
1067 	if (!MEDIA_V6INTFID(ill->ill_media, ill->ill_phys_addr_length,
1068 	    ill->ill_phys_addr, &v6addr))
1069 		return (B_FALSE);
1070 
1071 	(void) ip_plen_to_mask_v6(IPV6_TOKEN_LEN, &v6mask);
1072 
1073 	for (i = 0; i < 4; i++)
1074 		v6mask.s6_addr32[i] = v6mask.s6_addr32[i] ^
1075 		    (uint32_t)0xffffffff;
1076 
1077 	V6_MASK_COPY(v6addr, v6mask, ill->ill_token);
1078 	ill->ill_token_length = IPV6_TOKEN_LEN;
1079 	return (B_TRUE);
1080 }
1081 
1082 /*
1083  * Create a link-local address from a token.
1084  */
1085 static void
1086 ipif_get_linklocal(in6_addr_t *dest, const in6_addr_t *token)
1087 {
1088 	int i;
1089 
1090 	for (i = 0; i < 4; i++) {
1091 		dest->s6_addr32[i] =
1092 		    token->s6_addr32[i] | ipv6_ll_template.s6_addr32[i];
1093 	}
1094 }
1095 
1096 /*
1097  * Set a nice default address for either automatic tunnels tsrc/96 or
1098  * 6to4 tunnels 2002:<tsrc>::1/64
1099  */
1100 static void
1101 ipif_set_tun_auto_addr(ipif_t *ipif, struct iftun_req *ta)
1102 {
1103 	sin6_t	sin6;
1104 	sin_t	*sin;
1105 	ill_t 	*ill = ipif->ipif_ill;
1106 	tun_t *tp = (tun_t *)ill->ill_wq->q_next->q_ptr;
1107 
1108 	if (ta->ifta_saddr.ss_family != AF_INET ||
1109 	    (ipif->ipif_flags & IPIF_UP) || !ipif->ipif_isv6 ||
1110 	    (ta->ifta_flags & IFTUN_SRC) == 0)
1111 		return;
1112 
1113 	/*
1114 	 * Check the tunnel type by examining q_next->q_ptr
1115 	 */
1116 	if (tp->tun_flags & TUN_AUTOMATIC) {
1117 		/* this is an automatic tunnel */
1118 		(void) ip_plen_to_mask_v6(IPV6_ABITS - IP_ABITS,
1119 		    &ipif->ipif_v6net_mask);
1120 		bzero(&sin6, sizeof (sin6_t));
1121 		sin = (sin_t *)&ta->ifta_saddr;
1122 		V4_PART_OF_V6(sin6.sin6_addr) = sin->sin_addr.s_addr;
1123 		sin6.sin6_family = AF_INET6;
1124 		(void) ip_sioctl_addr(ipif, (sin_t *)&sin6,
1125 		    NULL, NULL, NULL, NULL);
1126 	} else if (tp->tun_flags & TUN_6TO4) {
1127 		/* this is a 6to4 tunnel */
1128 		(void) ip_plen_to_mask_v6(IPV6_PREFIX_LEN,
1129 		    &ipif->ipif_v6net_mask);
1130 		sin = (sin_t *)&ta->ifta_saddr;
1131 		/* create a 6to4 address from the IPv4 tsrc */
1132 		IN6_V4ADDR_TO_6TO4(&sin->sin_addr, &sin6.sin6_addr);
1133 		sin6.sin6_family = AF_INET6;
1134 		(void) ip_sioctl_addr(ipif, (sin_t *)&sin6,
1135 		    NULL, NULL, NULL, NULL);
1136 	} else {
1137 		ip1dbg(("ipif_set_tun_auto_addr: Unknown tunnel type"));
1138 		return;
1139 	}
1140 }
1141 
1142 /*
1143  * Set link local for ipif_id 0 of a configured tunnel based on the
1144  * tsrc or tdst parameter
1145  * For tunnels over IPv4 use the IPv4 address prepended with 32 zeros as
1146  * the token.
1147  * For tunnels over IPv6 use the low-order 64 bits of the "inner" IPv6 address
1148  * as the token for the "outer" link.
1149  */
1150 void
1151 ipif_set_tun_llink(ill_t *ill, struct iftun_req *ta)
1152 {
1153 	ipif_t		*ipif;
1154 	sin_t		*sin;
1155 	in6_addr_t	*s6addr;
1156 
1157 	ASSERT(IAM_WRITER_ILL(ill));
1158 
1159 	/* The first ipif must be id zero. */
1160 	ipif = ill->ill_ipif;
1161 	ASSERT(ipif->ipif_id == 0);
1162 
1163 	/* no link local for automatic tunnels */
1164 	if (!(ipif->ipif_flags & IPIF_POINTOPOINT)) {
1165 		ipif_set_tun_auto_addr(ipif, ta);
1166 		return;
1167 	}
1168 
1169 	if ((ta->ifta_flags & IFTUN_DST) &&
1170 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6pp_dst_addr)) {
1171 		sin6_t	sin6;
1172 
1173 		ASSERT(!(ipif->ipif_flags & IPIF_UP));
1174 		bzero(&sin6, sizeof (sin6_t));
1175 		if ((ta->ifta_saddr.ss_family == AF_INET)) {
1176 			sin = (sin_t *)&ta->ifta_daddr;
1177 			V4_PART_OF_V6(sin6.sin6_addr) =
1178 			    sin->sin_addr.s_addr;
1179 		} else {
1180 			s6addr =
1181 			    &((sin6_t *)&ta->ifta_daddr)->sin6_addr;
1182 			sin6.sin6_addr.s6_addr32[3] = s6addr->s6_addr32[3];
1183 			sin6.sin6_addr.s6_addr32[2] = s6addr->s6_addr32[2];
1184 		}
1185 		ipif_get_linklocal(&ipif->ipif_v6pp_dst_addr,
1186 		    &sin6.sin6_addr);
1187 		ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr;
1188 	}
1189 	if ((ta->ifta_flags & IFTUN_SRC)) {
1190 		ASSERT(!(ipif->ipif_flags & IPIF_UP));
1191 
1192 		/* Set the token if it isn't already set */
1193 		if (IN6_IS_ADDR_UNSPECIFIED(&ill->ill_token)) {
1194 			if ((ta->ifta_saddr.ss_family == AF_INET)) {
1195 				sin = (sin_t *)&ta->ifta_saddr;
1196 				V4_PART_OF_V6(ill->ill_token) =
1197 				    sin->sin_addr.s_addr;
1198 			} else {
1199 				s6addr =
1200 				    &((sin6_t *)&ta->ifta_saddr)->sin6_addr;
1201 				ill->ill_token.s6_addr32[3] =
1202 				    s6addr->s6_addr32[3];
1203 				ill->ill_token.s6_addr32[2] =
1204 				    s6addr->s6_addr32[2];
1205 			}
1206 			ill->ill_token_length = IPV6_TOKEN_LEN;
1207 		}
1208 		/*
1209 		 * Attempt to set the link local address if it isn't set.
1210 		 */
1211 		if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr))
1212 			(void) ipif_setlinklocal(ipif);
1213 	}
1214 }
1215 
1216 /*
1217  * Is it not possible to set the link local address?
1218  * The address can be set if the token is set, and the token
1219  * isn't too long.
1220  * Return B_TRUE if the address can't be set, or B_FALSE if it can.
1221  */
1222 boolean_t
1223 ipif_cant_setlinklocal(ipif_t *ipif)
1224 {
1225 	ill_t *ill = ipif->ipif_ill;
1226 
1227 	if (IN6_IS_ADDR_UNSPECIFIED(&ill->ill_token) ||
1228 	    ill->ill_token_length > IPV6_ABITS - IPV6_LL_PREFIXLEN)
1229 		return (B_TRUE);
1230 
1231 	return (B_FALSE);
1232 }
1233 
1234 /*
1235  * Generate a link-local address from the token.
1236  * Return zero if the address was set, or non-zero if it couldn't be set.
1237  */
1238 int
1239 ipif_setlinklocal(ipif_t *ipif)
1240 {
1241 	ill_t		*ill = ipif->ipif_ill;
1242 	in6_addr_t	ov6addr;
1243 
1244 	ASSERT(IAM_WRITER_ILL(ill));
1245 
1246 	if (ipif_cant_setlinklocal(ipif))
1247 		return (-1);
1248 
1249 	ov6addr = ipif->ipif_v6lcl_addr;
1250 	ipif_get_linklocal(&ipif->ipif_v6lcl_addr, &ill->ill_token);
1251 	sctp_update_ipif_addr(ipif, ov6addr);
1252 	(void) ip_plen_to_mask_v6(IPV6_LL_PREFIXLEN, &ipif->ipif_v6net_mask);
1253 	V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
1254 	    ipif->ipif_v6subnet);
1255 
1256 	if (ipif->ipif_flags & IPIF_NOLOCAL) {
1257 		ipif->ipif_v6src_addr = ipv6_all_zeros;
1258 	} else {
1259 		ipif->ipif_v6src_addr = ipif->ipif_v6lcl_addr;
1260 	}
1261 	return (0);
1262 }
1263 
1264 /*
1265  * This function sets up the multicast mappings in NDP.
1266  * Unlike ARP, there are no mapping_mps here. We delete the
1267  * mapping nces and add a new one.
1268  *
1269  * Returns non-zero on error and 0 on success.
1270  */
1271 int
1272 ipif_ndp_setup_multicast(ipif_t *ipif, nce_t **ret_nce)
1273 {
1274 	ill_t		*ill = ipif->ipif_ill;
1275 	in6_addr_t	v6_mcast_addr = {(uint32_t)V6_MCAST, 0, 0, 0};
1276 	in6_addr_t	v6_mcast_mask = {(uint32_t)V6_MCAST, 0, 0, 0};
1277 	in6_addr_t	v6_extract_mask;
1278 	uchar_t		*phys_addr, *bphys_addr, *alloc_phys;
1279 	nce_t		*mnce = NULL;
1280 	int		err = 0;
1281 	phyint_t	*phyi = ill->ill_phyint;
1282 	uint32_t	hw_extract_start;
1283 	dl_unitdata_req_t *dlur;
1284 	ip_stack_t	*ipst = ill->ill_ipst;
1285 
1286 	if (ret_nce != NULL)
1287 		*ret_nce = NULL;
1288 	/*
1289 	 * Delete the mapping nce. Normally these should not exist
1290 	 * as a previous ipif_down -> ipif_ndp_down should have deleted
1291 	 * all the nces. But they can exist if ip_rput_dlpi_writer
1292 	 * calls this when PHYI_MULTI_BCAST is set.
1293 	 */
1294 	mnce = ndp_lookup_v6(ill, &v6_mcast_addr, B_FALSE);
1295 	if (mnce != NULL) {
1296 		ndp_delete(mnce);
1297 		NCE_REFRELE(mnce);
1298 		mnce = NULL;
1299 	}
1300 
1301 	/*
1302 	 * Get media specific v6 mapping information. Note that
1303 	 * nd_lla_len can be 0 for tunnels.
1304 	 */
1305 	alloc_phys = kmem_alloc(ill->ill_nd_lla_len, KM_NOSLEEP);
1306 	if ((alloc_phys == NULL) && (ill->ill_nd_lla_len != 0))
1307 		return (ENOMEM);
1308 	/*
1309 	 * Determine the broadcast address.
1310 	 */
1311 	dlur = (dl_unitdata_req_t *)ill->ill_bcast_mp->b_rptr;
1312 	if (ill->ill_sap_length < 0)
1313 		bphys_addr = (uchar_t *)dlur + dlur->dl_dest_addr_offset;
1314 	else
1315 		bphys_addr = (uchar_t *)dlur +
1316 		    dlur->dl_dest_addr_offset + ill->ill_sap_length;
1317 
1318 	/*
1319 	 * Check PHYI_MULTI_BCAST and possible length of physical
1320 	 * address to determine if we use the mapping or the
1321 	 * broadcast address.
1322 	 */
1323 	if ((phyi->phyint_flags & PHYI_MULTI_BCAST) ||
1324 	    (!MEDIA_V6MINFO(ill->ill_media, ill->ill_nd_lla_len,
1325 	    bphys_addr, alloc_phys, &hw_extract_start,
1326 	    &v6_extract_mask))) {
1327 		if (ill->ill_phys_addr_length > IP_MAX_HW_LEN) {
1328 			kmem_free(alloc_phys, ill->ill_nd_lla_len);
1329 			return (E2BIG);
1330 		}
1331 		/* Use the link-layer broadcast address for MULTI_BCAST */
1332 		phys_addr = bphys_addr;
1333 		bzero(&v6_extract_mask, sizeof (v6_extract_mask));
1334 		hw_extract_start = ill->ill_nd_lla_len;
1335 	} else {
1336 		phys_addr = alloc_phys;
1337 	}
1338 	if ((ipif->ipif_flags & IPIF_BROADCAST) ||
1339 	    (ill->ill_flags & ILLF_MULTICAST) ||
1340 	    (phyi->phyint_flags & PHYI_MULTI_BCAST)) {
1341 		mutex_enter(&ipst->ips_ndp6->ndp_g_lock);
1342 		err = ndp_add(ill,
1343 		    phys_addr,
1344 		    &v6_mcast_addr,	/* v6 address */
1345 		    &v6_mcast_mask,	/* v6 mask */
1346 		    &v6_extract_mask,
1347 		    hw_extract_start,
1348 		    NCE_F_MAPPING | NCE_F_PERMANENT | NCE_F_NONUD,
1349 		    ND_REACHABLE,
1350 		    &mnce,
1351 		    NULL,
1352 		    NULL);
1353 		mutex_exit(&ipst->ips_ndp6->ndp_g_lock);
1354 		if (err == 0) {
1355 			if (ret_nce != NULL) {
1356 				*ret_nce = mnce;
1357 			} else {
1358 				NCE_REFRELE(mnce);
1359 			}
1360 		}
1361 	}
1362 	kmem_free(alloc_phys, ill->ill_nd_lla_len);
1363 	return (err);
1364 }
1365 
1366 /*
1367  * Get the resolver set up for a new interface address.  (Always called
1368  * as writer.)
1369  */
1370 int
1371 ipif_ndp_up(ipif_t *ipif, const in6_addr_t *addr)
1372 {
1373 	ill_t		*ill = ipif->ipif_ill;
1374 	int		err = 0;
1375 	nce_t		*nce = NULL;
1376 	nce_t		*mnce = NULL;
1377 
1378 	ip1dbg(("ipif_ndp_up(%s:%u)\n",
1379 		ipif->ipif_ill->ill_name, ipif->ipif_id));
1380 
1381 	/*
1382 	 * ND not supported on XRESOLV interfaces. If ND support (multicast)
1383 	 * added later, take out this check.
1384 	 */
1385 	if ((ill->ill_flags & ILLF_XRESOLV) ||
1386 	    IN6_IS_ADDR_UNSPECIFIED(addr) ||
1387 	    (!(ill->ill_net_type & IRE_INTERFACE))) {
1388 		ipif->ipif_addr_ready = 1;
1389 		return (0);
1390 	}
1391 
1392 	/*
1393 	 * Need to setup multicast mapping only when the first
1394 	 * interface is coming UP.
1395 	 */
1396 	if (ill->ill_ipif_up_count == 0 &&
1397 	    (ill->ill_flags & ILLF_MULTICAST)) {
1398 		/*
1399 		 * We set the multicast before setting up the mapping for
1400 		 * local address because ipif_ndp_setup_multicast does
1401 		 * ndp_walk to delete nces which will delete the mapping
1402 		 * for local address also if we added the mapping for
1403 		 * local address first.
1404 		 */
1405 		err = ipif_ndp_setup_multicast(ipif, &mnce);
1406 		if (err != 0)
1407 			return (err);
1408 	}
1409 
1410 	if ((ipif->ipif_flags & (IPIF_UNNUMBERED|IPIF_NOLOCAL)) == 0) {
1411 		uint16_t	flags;
1412 		uchar_t	*hw_addr = NULL;
1413 
1414 		/* Permanent entries don't need NUD */
1415 		flags = NCE_F_PERMANENT | NCE_F_NONUD;
1416 		if (ill->ill_flags & ILLF_ROUTER)
1417 			flags |= NCE_F_ISROUTER;
1418 
1419 		if (ipif->ipif_flags & IPIF_ANYCAST)
1420 			flags |= NCE_F_ANYCAST;
1421 
1422 		if (ill->ill_net_type == IRE_IF_RESOLVER) {
1423 			hw_addr = ill->ill_nd_lla;
1424 
1425 			if (ill->ill_move_in_progress) {
1426 				/*
1427 				 * Addresses are failing over to this ill.
1428 				 * Don't wait for NUD to see this change.
1429 				 * Publish our new link-layer address.
1430 				 */
1431 				flags |= NCE_F_UNSOL_ADV;
1432 			}
1433 		}
1434 		err = ndp_lookup_then_add(ill,
1435 		    hw_addr,
1436 		    addr,
1437 		    &ipv6_all_ones,
1438 		    &ipv6_all_zeros,
1439 		    0,
1440 		    flags,
1441 		    ND_PROBE,	/* Causes Duplicate Address Detection to run */
1442 		    &nce,
1443 		    NULL,
1444 		    NULL);
1445 		switch (err) {
1446 		case 0:
1447 			ip1dbg(("ipif_ndp_up: NCE created for %s\n",
1448 			    ill->ill_name));
1449 			ipif->ipif_addr_ready = 1;
1450 			break;
1451 		case EINPROGRESS:
1452 			ip1dbg(("ipif_ndp_up: running DAD now for %s\n",
1453 			    ill->ill_name));
1454 			break;
1455 		case EEXIST:
1456 			NCE_REFRELE(nce);
1457 			ip1dbg(("ipif_ndp_up: NCE already exists for %s\n",
1458 			    ill->ill_name));
1459 			if (mnce != NULL) {
1460 				ndp_delete(mnce);
1461 				NCE_REFRELE(mnce);
1462 			}
1463 			return (err);
1464 		default:
1465 			ip1dbg(("ipif_ndp_up: NCE creation failed %s\n",
1466 			    ill->ill_name));
1467 			if (mnce != NULL) {
1468 				ndp_delete(mnce);
1469 				NCE_REFRELE(mnce);
1470 			}
1471 			return (err);
1472 		}
1473 	} else {
1474 		/* No local NCE for this entry */
1475 		ipif->ipif_addr_ready = 1;
1476 	}
1477 	if (nce != NULL)
1478 		NCE_REFRELE(nce);
1479 	if (mnce != NULL)
1480 		NCE_REFRELE(mnce);
1481 	return (0);
1482 }
1483 
1484 /* Remove all cache entries for this logical interface */
1485 void
1486 ipif_ndp_down(ipif_t *ipif)
1487 {
1488 	nce_t	*nce;
1489 
1490 	if (ipif->ipif_isv6) {
1491 		nce = ndp_lookup_v6(ipif->ipif_ill, &ipif->ipif_v6lcl_addr,
1492 		    B_FALSE);
1493 		if (nce != NULL) {
1494 			ndp_delete(nce);
1495 			NCE_REFRELE(nce);
1496 		}
1497 	}
1498 	/*
1499 	 * Remove mapping and all other nces dependent on this ill
1500 	 * when the last ipif is going away.
1501 	 */
1502 	if (ipif->ipif_ill->ill_ipif_up_count == 0) {
1503 		ndp_walk(ipif->ipif_ill, (pfi_t)ndp_delete_per_ill,
1504 		    (uchar_t *)ipif->ipif_ill, ipif->ipif_ill->ill_ipst);
1505 	}
1506 }
1507 
1508 /*
1509  * Used when an interface comes up to recreate any extra routes on this
1510  * interface.
1511  */
1512 static ire_t **
1513 ipif_recover_ire_v6(ipif_t *ipif)
1514 {
1515 	mblk_t	*mp;
1516 	ire_t   **ipif_saved_irep;
1517 	ire_t   **irep;
1518 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
1519 
1520 	ip1dbg(("ipif_recover_ire_v6(%s:%u)", ipif->ipif_ill->ill_name,
1521 	    ipif->ipif_id));
1522 
1523 	ASSERT(ipif->ipif_isv6);
1524 
1525 	mutex_enter(&ipif->ipif_saved_ire_lock);
1526 	ipif_saved_irep = (ire_t **)kmem_zalloc(sizeof (ire_t *) *
1527 	    ipif->ipif_saved_ire_cnt, KM_NOSLEEP);
1528 	if (ipif_saved_irep == NULL) {
1529 		mutex_exit(&ipif->ipif_saved_ire_lock);
1530 		return (NULL);
1531 	}
1532 
1533 	irep = ipif_saved_irep;
1534 
1535 	for (mp = ipif->ipif_saved_ire_mp; mp != NULL; mp = mp->b_cont) {
1536 		ire_t		*ire;
1537 		queue_t		*rfq;
1538 		queue_t		*stq;
1539 		ifrt_t		*ifrt;
1540 		in6_addr_t	*src_addr;
1541 		in6_addr_t	*gateway_addr;
1542 		mblk_t		*resolver_mp;
1543 		char		buf[INET6_ADDRSTRLEN];
1544 		ushort_t	type;
1545 
1546 		/*
1547 		 * When the ire was initially created and then added in
1548 		 * ip_rt_add_v6(), it was created either using
1549 		 * ipif->ipif_net_type in the case of a traditional interface
1550 		 * route, or as one of the IRE_OFFSUBNET types (with the
1551 		 * exception of IRE_HOST type redirect ire which is created by
1552 		 * icmp_redirect_v6() and which we don't need to save or
1553 		 * recover).  In the case where ipif->ipif_net_type was
1554 		 * IRE_LOOPBACK, ip_rt_add_v6() will update the ire_type to
1555 		 * IRE_IF_NORESOLVER before calling ire_add_v6() to satisfy
1556 		 * software like GateD and Sun Cluster which creates routes
1557 		 * using the the loopback interface's address as a gateway.
1558 		 *
1559 		 * As ifrt->ifrt_type reflects the already updated ire_type and
1560 		 * since ire_create_v6() expects that IRE_IF_NORESOLVER will
1561 		 * have a valid ire_dlureq_mp field (which doesn't make sense
1562 		 * for a IRE_LOOPBACK), ire_create_v6() will be called in the
1563 		 * same way here as in ip_rt_add_v6(), namely using
1564 		 * ipif->ipif_net_type when the route looks like a traditional
1565 		 * interface route (where ifrt->ifrt_type & IRE_INTERFACE is
1566 		 * true) and otherwise using the saved ifrt->ifrt_type.  This
1567 		 * means that in the case where ipif->ipif_net_type is
1568 		 * IRE_LOOPBACK, the ire created by ire_create_v6() will be an
1569 		 * IRE_LOOPBACK, it will then be turned into an
1570 		 * IRE_IF_NORESOLVER and then added by ire_add_v6().
1571 		 */
1572 		ifrt = (ifrt_t *)mp->b_rptr;
1573 		if (ifrt->ifrt_type & IRE_INTERFACE) {
1574 			rfq = NULL;
1575 			stq = (ipif->ipif_net_type == IRE_IF_RESOLVER)
1576 			    ? ipif->ipif_rq : ipif->ipif_wq;
1577 			src_addr = (ifrt->ifrt_flags & RTF_SETSRC)
1578 			    ? &ifrt->ifrt_v6src_addr
1579 			    : &ipif->ipif_v6src_addr;
1580 			gateway_addr = NULL;
1581 			resolver_mp = ipif->ipif_resolver_mp;
1582 			type = ipif->ipif_net_type;
1583 		} else {
1584 			rfq = NULL;
1585 			stq = NULL;
1586 			src_addr = (ifrt->ifrt_flags & RTF_SETSRC)
1587 			    ? &ifrt->ifrt_v6src_addr : NULL;
1588 			gateway_addr = &ifrt->ifrt_v6gateway_addr;
1589 			resolver_mp = NULL;
1590 			type = ifrt->ifrt_type;
1591 		}
1592 
1593 		/*
1594 		 * Create a copy of the IRE with the saved address and netmask.
1595 		 */
1596 		ip1dbg(("ipif_recover_ire_v6: creating IRE %s (%d) for %s/%d\n",
1597 		    ip_nv_lookup(ire_nv_tbl, ifrt->ifrt_type), ifrt->ifrt_type,
1598 		    inet_ntop(AF_INET6, &ifrt->ifrt_v6addr, buf, sizeof (buf)),
1599 		    ip_mask_to_plen_v6(&ifrt->ifrt_v6mask)));
1600 		ire = ire_create_v6(
1601 		    &ifrt->ifrt_v6addr,
1602 		    &ifrt->ifrt_v6mask,
1603 		    src_addr,
1604 		    gateway_addr,
1605 		    &ifrt->ifrt_max_frag,
1606 		    NULL,
1607 		    rfq,
1608 		    stq,
1609 		    type,
1610 		    resolver_mp,
1611 		    ipif,
1612 		    NULL,
1613 		    0,
1614 		    0,
1615 		    ifrt->ifrt_flags,
1616 		    &ifrt->ifrt_iulp_info,
1617 		    NULL,
1618 		    NULL,
1619 		    ipst);
1620 		if (ire == NULL) {
1621 			mutex_exit(&ipif->ipif_saved_ire_lock);
1622 			kmem_free(ipif_saved_irep,
1623 			    ipif->ipif_saved_ire_cnt * sizeof (ire_t *));
1624 			return (NULL);
1625 		}
1626 
1627 		/*
1628 		 * Some software (for example, GateD and Sun Cluster) attempts
1629 		 * to create (what amount to) IRE_PREFIX routes with the
1630 		 * loopback address as the gateway.  This is primarily done to
1631 		 * set up prefixes with the RTF_REJECT flag set (for example,
1632 		 * when generating aggregate routes.)
1633 		 *
1634 		 * If the IRE type (as defined by ipif->ipif_net_type) is
1635 		 * IRE_LOOPBACK, then we map the request into a
1636 		 * IRE_IF_NORESOLVER.
1637 		 */
1638 		if (ipif->ipif_net_type == IRE_LOOPBACK)
1639 			ire->ire_type = IRE_IF_NORESOLVER;
1640 		/*
1641 		 * ire held by ire_add, will be refreled' in ipif_up_done
1642 		 * towards the end
1643 		 */
1644 		(void) ire_add(&ire, NULL, NULL, NULL, B_FALSE);
1645 		*irep = ire;
1646 		irep++;
1647 		ip1dbg(("ipif_recover_ire_v6: added ire %p\n", (void *)ire));
1648 	}
1649 	mutex_exit(&ipif->ipif_saved_ire_lock);
1650 	return (ipif_saved_irep);
1651 }
1652 
1653 /*
1654  * Return the scope of the given IPv6 address.  If the address is an
1655  * IPv4 mapped IPv6 address, return the scope of the corresponding
1656  * IPv4 address.
1657  */
1658 in6addr_scope_t
1659 ip_addr_scope_v6(const in6_addr_t *addr)
1660 {
1661 	static in6_addr_t ipv6loopback = IN6ADDR_LOOPBACK_INIT;
1662 
1663 	if (IN6_IS_ADDR_V4MAPPED(addr)) {
1664 		in_addr_t v4addr_h = ntohl(V4_PART_OF_V6((*addr)));
1665 		if ((v4addr_h >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET ||
1666 		    (v4addr_h & IN_AUTOCONF_MASK) == IN_AUTOCONF_NET)
1667 			return (IP6_SCOPE_LINKLOCAL);
1668 		if ((v4addr_h & IN_PRIVATE8_MASK) == IN_PRIVATE8_NET ||
1669 		    (v4addr_h & IN_PRIVATE12_MASK) == IN_PRIVATE12_NET ||
1670 		    (v4addr_h & IN_PRIVATE16_MASK) == IN_PRIVATE16_NET)
1671 			return (IP6_SCOPE_SITELOCAL);
1672 		return (IP6_SCOPE_GLOBAL);
1673 	}
1674 
1675 	if (IN6_IS_ADDR_MULTICAST(addr))
1676 		return (IN6_ADDR_MC_SCOPE(addr));
1677 
1678 	/* link-local and loopback addresses are of link-local scope */
1679 	if (IN6_IS_ADDR_LINKLOCAL(addr) ||
1680 	    IN6_ARE_ADDR_EQUAL(addr, &ipv6loopback))
1681 		return (IP6_SCOPE_LINKLOCAL);
1682 	if (IN6_IS_ADDR_SITELOCAL(addr))
1683 		return (IP6_SCOPE_SITELOCAL);
1684 	return (IP6_SCOPE_GLOBAL);
1685 }
1686 
1687 
1688 /*
1689  * Returns the length of the common prefix of a1 and a2, as per
1690  * CommonPrefixLen() defined in RFC 3484.
1691  */
1692 static int
1693 ip_common_prefix_v6(const in6_addr_t *a1, const in6_addr_t *a2)
1694 {
1695 	int i;
1696 	uint32_t a1val, a2val, mask;
1697 
1698 	for (i = 0; i < 4; i++) {
1699 		if ((a1val = a1->s6_addr32[i]) != (a2val = a2->s6_addr32[i])) {
1700 			a1val ^= a2val;
1701 			i *= 32;
1702 			mask = 0x80000000u;
1703 			while (!(a1val & mask)) {
1704 				mask >>= 1;
1705 				i++;
1706 			}
1707 			return (i);
1708 		}
1709 	}
1710 	return (IPV6_ABITS);
1711 }
1712 
1713 #define	IPIF_VALID_IPV6_SOURCE(ipif) \
1714 	(((ipif)->ipif_flags & IPIF_UP) && \
1715 	!((ipif)->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST)) && \
1716 	(ipif)->ipif_addr_ready)
1717 
1718 /* source address candidate */
1719 typedef struct candidate {
1720 	ipif_t		*cand_ipif;
1721 	/* The properties of this candidate */
1722 	boolean_t	cand_isdst;
1723 	boolean_t	cand_isdst_set;
1724 	in6addr_scope_t	cand_scope;
1725 	boolean_t	cand_scope_set;
1726 	boolean_t	cand_isdeprecated;
1727 	boolean_t	cand_isdeprecated_set;
1728 	boolean_t	cand_ispreferred;
1729 	boolean_t	cand_ispreferred_set;
1730 	boolean_t	cand_matchedinterface;
1731 	boolean_t	cand_matchedinterface_set;
1732 	boolean_t	cand_matchedlabel;
1733 	boolean_t	cand_matchedlabel_set;
1734 	boolean_t	cand_istmp;
1735 	boolean_t	cand_istmp_set;
1736 	int		cand_common_pref;
1737 	boolean_t	cand_common_pref_set;
1738 	boolean_t	cand_pref_eq;
1739 	boolean_t	cand_pref_eq_set;
1740 	int		cand_pref_len;
1741 	boolean_t	cand_pref_len_set;
1742 } cand_t;
1743 #define	cand_srcaddr	cand_ipif->ipif_v6lcl_addr
1744 #define	cand_mask	cand_ipif->ipif_v6net_mask
1745 #define	cand_flags	cand_ipif->ipif_flags
1746 #define	cand_ill	cand_ipif->ipif_ill
1747 #define	cand_zoneid	cand_ipif->ipif_zoneid
1748 
1749 /* information about the destination for source address selection */
1750 typedef struct dstinfo {
1751 	const in6_addr_t	*dst_addr;
1752 	ill_t			*dst_ill;
1753 	uint_t			dst_restrict_ill;
1754 	boolean_t		dst_prefer_src_tmp;
1755 	in6addr_scope_t		dst_scope;
1756 	char			*dst_label;
1757 } dstinfo_t;
1758 
1759 /*
1760  * The following functions are rules used to select a source address in
1761  * ipif_select_source_v6().  Each rule compares a current candidate (cc)
1762  * against the best candidate (bc).  Each rule has three possible outcomes;
1763  * the candidate is preferred over the best candidate (CAND_PREFER), the
1764  * candidate is not preferred over the best candidate (CAND_AVOID), or the
1765  * candidate is of equal value as the best candidate (CAND_TIE).
1766  *
1767  * These rules are part of a greater "Default Address Selection for IPv6"
1768  * sheme, which is standards based work coming out of the IETF ipv6 working
1769  * group.  The IETF document defines both IPv6 source address selection and
1770  * destination address ordering.  The rules defined here implement the IPv6
1771  * source address selection.  Destination address ordering is done by
1772  * libnsl, and uses a similar set of rules to implement the sorting.
1773  *
1774  * Most of the rules are defined by the RFC and are not typically altered.  The
1775  * last rule, number 8, has language that allows for local preferences.  In the
1776  * scheme below, this means that new Solaris rules should normally go between
1777  * rule_ifprefix and rule_prefix.
1778  */
1779 typedef enum {CAND_AVOID, CAND_TIE, CAND_PREFER} rule_res_t;
1780 typedef	rule_res_t (*rulef_t)(cand_t *, cand_t *, const dstinfo_t *,
1781     ip_stack_t *);
1782 
1783 /* Prefer an address if it is equal to the destination address. */
1784 /* ARGSUSED3 */
1785 static rule_res_t
1786 rule_isdst(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst)
1787 {
1788 	if (!bc->cand_isdst_set) {
1789 		bc->cand_isdst =
1790 		    IN6_ARE_ADDR_EQUAL(&bc->cand_srcaddr, dstinfo->dst_addr);
1791 		bc->cand_isdst_set = B_TRUE;
1792 	}
1793 
1794 	cc->cand_isdst =
1795 	    IN6_ARE_ADDR_EQUAL(&cc->cand_srcaddr, dstinfo->dst_addr);
1796 	cc->cand_isdst_set = B_TRUE;
1797 
1798 	if (cc->cand_isdst == bc->cand_isdst)
1799 		return (CAND_TIE);
1800 	else if (cc->cand_isdst)
1801 		return (CAND_PREFER);
1802 	else
1803 		return (CAND_AVOID);
1804 }
1805 
1806 /*
1807  * Prefer addresses that are of closest scope to the destination.  Always
1808  * prefer addresses that are of greater scope than the destination over
1809  * those that are of lesser scope than the destination.
1810  */
1811 /* ARGSUSED3 */
1812 static rule_res_t
1813 rule_scope(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst)
1814 {
1815 	if (!bc->cand_scope_set) {
1816 		bc->cand_scope = ip_addr_scope_v6(&bc->cand_srcaddr);
1817 		bc->cand_scope_set = B_TRUE;
1818 	}
1819 
1820 	cc->cand_scope = ip_addr_scope_v6(&cc->cand_srcaddr);
1821 	cc->cand_scope_set = B_TRUE;
1822 
1823 	if (cc->cand_scope < bc->cand_scope) {
1824 		if (cc->cand_scope < dstinfo->dst_scope)
1825 			return (CAND_AVOID);
1826 		else
1827 			return (CAND_PREFER);
1828 	} else if (bc->cand_scope < cc->cand_scope) {
1829 		if (bc->cand_scope < dstinfo->dst_scope)
1830 			return (CAND_PREFER);
1831 		else
1832 			return (CAND_AVOID);
1833 	} else {
1834 		return (CAND_TIE);
1835 	}
1836 }
1837 
1838 /*
1839  * Prefer non-deprecated source addresses.
1840  */
1841 /* ARGSUSED2 */
1842 static rule_res_t
1843 rule_deprecated(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo,
1844     ip_stack_t *ipst)
1845 {
1846 	if (!bc->cand_isdeprecated_set) {
1847 		bc->cand_isdeprecated =
1848 		    ((bc->cand_flags & IPIF_DEPRECATED) != 0);
1849 		bc->cand_isdeprecated_set = B_TRUE;
1850 	}
1851 
1852 	cc->cand_isdeprecated = ((cc->cand_flags & IPIF_DEPRECATED) != 0);
1853 	cc->cand_isdeprecated_set = B_TRUE;
1854 
1855 	if (bc->cand_isdeprecated == cc->cand_isdeprecated)
1856 		return (CAND_TIE);
1857 	else if (cc->cand_isdeprecated)
1858 		return (CAND_AVOID);
1859 	else
1860 		return (CAND_PREFER);
1861 }
1862 
1863 /*
1864  * Prefer source addresses that have the IPIF_PREFERRED flag set.  This
1865  * rule must be before rule_interface because the flag could be set on any
1866  * interface, not just the interface being used for outgoing packets (for
1867  * example, the IFF_PREFERRED could be set on an address assigned to the
1868  * loopback interface).
1869  */
1870 /* ARGSUSED2 */
1871 static rule_res_t
1872 rule_preferred(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo,
1873     ip_stack_t *ipst)
1874 {
1875 	if (!bc->cand_ispreferred_set) {
1876 		bc->cand_ispreferred = ((bc->cand_flags & IPIF_PREFERRED) != 0);
1877 		bc->cand_ispreferred_set = B_TRUE;
1878 	}
1879 
1880 	cc->cand_ispreferred = ((cc->cand_flags & IPIF_PREFERRED) != 0);
1881 	cc->cand_ispreferred_set = B_TRUE;
1882 
1883 	if (bc->cand_ispreferred == cc->cand_ispreferred)
1884 		return (CAND_TIE);
1885 	else if (cc->cand_ispreferred)
1886 		return (CAND_PREFER);
1887 	else
1888 		return (CAND_AVOID);
1889 }
1890 
1891 /*
1892  * Prefer source addresses that are assigned to the outgoing interface, or
1893  * to an interface that is in the same IPMP group as the outgoing
1894  * interface.
1895  */
1896 /* ARGSUSED3 */
1897 static rule_res_t
1898 rule_interface(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo,
1899     ip_stack_t *ipst)
1900 {
1901 	ill_t *dstill = dstinfo->dst_ill;
1902 
1903 	/*
1904 	 * If dstinfo->dst_restrict_ill is set, this rule is unnecessary
1905 	 * since we know all candidates will be on the same link.
1906 	 */
1907 	if (dstinfo->dst_restrict_ill)
1908 		return (CAND_TIE);
1909 
1910 	if (!bc->cand_matchedinterface_set) {
1911 		bc->cand_matchedinterface = (bc->cand_ill == dstill ||
1912 		    (dstill->ill_group != NULL &&
1913 		    dstill->ill_group == bc->cand_ill->ill_group));
1914 		bc->cand_matchedinterface_set = B_TRUE;
1915 	}
1916 
1917 	cc->cand_matchedinterface = (cc->cand_ill == dstill ||
1918 	    (dstill->ill_group != NULL &&
1919 		dstill->ill_group == cc->cand_ill->ill_group));
1920 	cc->cand_matchedinterface_set = B_TRUE;
1921 
1922 	if (bc->cand_matchedinterface == cc->cand_matchedinterface)
1923 		return (CAND_TIE);
1924 	else if (cc->cand_matchedinterface)
1925 		return (CAND_PREFER);
1926 	else
1927 		return (CAND_AVOID);
1928 }
1929 
1930 /*
1931  * Prefer source addresses whose label matches the destination's label.
1932  */
1933 static rule_res_t
1934 rule_label(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst)
1935 {
1936 	char *label;
1937 
1938 	if (!bc->cand_matchedlabel_set) {
1939 		label = ip6_asp_lookup(&bc->cand_srcaddr, NULL, ipst);
1940 		bc->cand_matchedlabel =
1941 		    ip6_asp_labelcmp(label, dstinfo->dst_label);
1942 		bc->cand_matchedlabel_set = B_TRUE;
1943 	}
1944 
1945 	label = ip6_asp_lookup(&cc->cand_srcaddr, NULL, ipst);
1946 	cc->cand_matchedlabel = ip6_asp_labelcmp(label, dstinfo->dst_label);
1947 	cc->cand_matchedlabel_set = B_TRUE;
1948 
1949 	if (bc->cand_matchedlabel == cc->cand_matchedlabel)
1950 		return (CAND_TIE);
1951 	else if (cc->cand_matchedlabel)
1952 		return (CAND_PREFER);
1953 	else
1954 		return (CAND_AVOID);
1955 }
1956 
1957 /*
1958  * Prefer public addresses over temporary ones.  An application can reverse
1959  * the logic of this rule and prefer temporary addresses by using the
1960  * IPV6_SRC_PREFERENCES socket option.
1961  */
1962 /* ARGSUSED3 */
1963 static rule_res_t
1964 rule_temporary(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo,
1965     ip_stack_t *ipst)
1966 {
1967 	if (!bc->cand_istmp_set) {
1968 		bc->cand_istmp = ((bc->cand_flags & IPIF_TEMPORARY) != 0);
1969 		bc->cand_istmp_set = B_TRUE;
1970 	}
1971 
1972 	cc->cand_istmp = ((cc->cand_flags & IPIF_TEMPORARY) != 0);
1973 	cc->cand_istmp_set = B_TRUE;
1974 
1975 	if (bc->cand_istmp == cc->cand_istmp)
1976 		return (CAND_TIE);
1977 
1978 	if (dstinfo->dst_prefer_src_tmp && cc->cand_istmp)
1979 		return (CAND_PREFER);
1980 	else if (!dstinfo->dst_prefer_src_tmp && !cc->cand_istmp)
1981 		return (CAND_PREFER);
1982 	else
1983 		return (CAND_AVOID);
1984 }
1985 
1986 /*
1987  * Prefer source addresses with longer matching prefix with the destination
1988  * under the interface mask.  This gets us on the same subnet before applying
1989  * any Solaris-specific rules.
1990  */
1991 /* ARGSUSED3 */
1992 static rule_res_t
1993 rule_ifprefix(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo,
1994     ip_stack_t *ipst)
1995 {
1996 	if (!bc->cand_pref_eq_set) {
1997 		bc->cand_pref_eq = V6_MASK_EQ_2(bc->cand_srcaddr,
1998 		    bc->cand_mask, *dstinfo->dst_addr);
1999 		bc->cand_pref_eq_set = B_TRUE;
2000 	}
2001 
2002 	cc->cand_pref_eq = V6_MASK_EQ_2(cc->cand_srcaddr, cc->cand_mask,
2003 	    *dstinfo->dst_addr);
2004 	cc->cand_pref_eq_set = B_TRUE;
2005 
2006 	if (bc->cand_pref_eq) {
2007 		if (cc->cand_pref_eq) {
2008 			if (!bc->cand_pref_len_set) {
2009 				bc->cand_pref_len =
2010 				    ip_mask_to_plen_v6(&bc->cand_mask);
2011 				bc->cand_pref_len_set = B_TRUE;
2012 			}
2013 			cc->cand_pref_len = ip_mask_to_plen_v6(&cc->cand_mask);
2014 			cc->cand_pref_len_set = B_TRUE;
2015 			if (bc->cand_pref_len == cc->cand_pref_len)
2016 				return (CAND_TIE);
2017 			else if (bc->cand_pref_len > cc->cand_pref_len)
2018 				return (CAND_AVOID);
2019 			else
2020 				return (CAND_PREFER);
2021 		} else {
2022 			return (CAND_AVOID);
2023 		}
2024 	} else {
2025 		if (cc->cand_pref_eq)
2026 			return (CAND_PREFER);
2027 		else
2028 			return (CAND_TIE);
2029 	}
2030 }
2031 
2032 /*
2033  * Prefer to use zone-specific addresses when possible instead of all-zones
2034  * addresses.
2035  */
2036 /* ARGSUSED2 */
2037 static rule_res_t
2038 rule_zone_specific(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo,
2039     ip_stack_t *ipst)
2040 {
2041 	if ((bc->cand_zoneid == ALL_ZONES) ==
2042 	    (cc->cand_zoneid == ALL_ZONES))
2043 		return (CAND_TIE);
2044 	else if (cc->cand_zoneid == ALL_ZONES)
2045 		return (CAND_AVOID);
2046 	else
2047 		return (CAND_PREFER);
2048 }
2049 
2050 /*
2051  * Prefer to use DHCPv6 (first) and static addresses (second) when possible
2052  * instead of statelessly autoconfigured addresses.
2053  *
2054  * This is done after trying all other preferences (and before the final tie
2055  * breaker) so that, if all else is equal, we select addresses configured by
2056  * DHCPv6 over other addresses.  We presume that DHCPv6 addresses, unlike
2057  * stateless autoconfigured addresses, are deliberately configured by an
2058  * administrator, and thus are correctly set up in DNS and network packet
2059  * filters.
2060  */
2061 /* ARGSUSED2 */
2062 static rule_res_t
2063 rule_addr_type(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo,
2064     ip_stack_t *ipst)
2065 {
2066 #define	ATYPE(x)	\
2067 	((x) & IPIF_DHCPRUNNING) ? 1 : ((x) & IPIF_ADDRCONF) ? 3 : 2
2068 	int bcval = ATYPE(bc->cand_flags);
2069 	int ccval = ATYPE(cc->cand_flags);
2070 #undef ATYPE
2071 
2072 	if (bcval == ccval)
2073 		return (CAND_TIE);
2074 	else if (ccval < bcval)
2075 		return (CAND_PREFER);
2076 	else
2077 		return (CAND_AVOID);
2078 }
2079 
2080 /*
2081  * Prefer source addresses with longer matching prefix with the destination.
2082  * We do the longest matching prefix calculation by doing an xor of both
2083  * addresses with the destination, and pick the address with the longest string
2084  * of leading zeros, as per CommonPrefixLen() defined in RFC 3484.
2085  */
2086 /* ARGSUSED3 */
2087 static rule_res_t
2088 rule_prefix(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst)
2089 {
2090 	if (!bc->cand_common_pref_set) {
2091 		bc->cand_common_pref = ip_common_prefix_v6(&bc->cand_srcaddr,
2092 		    dstinfo->dst_addr);
2093 		bc->cand_common_pref_set = B_TRUE;
2094 	}
2095 
2096 	cc->cand_common_pref = ip_common_prefix_v6(&cc->cand_srcaddr,
2097 	    dstinfo->dst_addr);
2098 	cc->cand_common_pref_set = B_TRUE;
2099 
2100 	if (bc->cand_common_pref == cc->cand_common_pref)
2101 		return (CAND_TIE);
2102 	else if (bc->cand_common_pref > cc->cand_common_pref)
2103 		return (CAND_AVOID);
2104 	else
2105 		return (CAND_PREFER);
2106 }
2107 
2108 /*
2109  * Last rule: we must pick something, so just prefer the current best
2110  * candidate.
2111  */
2112 /* ARGSUSED */
2113 static rule_res_t
2114 rule_must_be_last(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo,
2115     ip_stack_t *ipst)
2116 {
2117 	return (CAND_AVOID);
2118 }
2119 
2120 /*
2121  * Determine the best source address given a destination address and a
2122  * destination ill.  If no suitable source address is found, it returns
2123  * NULL. If there is a usable address pointed to by the usesrc
2124  * (i.e ill_usesrc_ifindex != 0) then return that first since it is more
2125  * fine grained (i.e per interface)
2126  *
2127  * This implementation is based on the "Default Address Selection for IPv6"
2128  * specification produced by the IETF IPv6 working group.  It has been
2129  * implemented so that the list of addresses is only traversed once (the
2130  * specification's algorithm could traverse the list of addresses once for
2131  * every rule).
2132  *
2133  * The restrict_ill argument restricts the algorithm to chose a source
2134  * address that is assigned to the destination ill or an ill in the same
2135  * IPMP group as the destination ill.  This is used when the destination
2136  * address is a link-local or multicast address, and when
2137  * ipv6_strict_dst_multihoming is turned on.
2138  *
2139  * src_prefs is the caller's set of source address preferences.  If source
2140  * address selection is being called to determine the source address of a
2141  * connected socket (from ip_bind_connected_v6()), then the preferences are
2142  * taken from conn_src_preferences.  These preferences can be set on a
2143  * per-socket basis using the IPV6_SRC_PREFERENCES socket option.  The only
2144  * preference currently implemented is for rfc3041 temporary addresses.
2145  */
2146 ipif_t *
2147 ipif_select_source_v6(ill_t *dstill, const in6_addr_t *dst,
2148     uint_t restrict_ill, uint32_t src_prefs, zoneid_t zoneid)
2149 {
2150 	dstinfo_t	dstinfo;
2151 	char		dstr[INET6_ADDRSTRLEN];
2152 	char		sstr[INET6_ADDRSTRLEN];
2153 	ipif_t		*ipif;
2154 	ill_t		*ill, *usesrc_ill = NULL;
2155 	ill_walk_context_t	ctx;
2156 	cand_t		best_c;	/* The best candidate */
2157 	cand_t		curr_c;	/* The current candidate */
2158 	uint_t		index;
2159 	boolean_t	first_candidate = B_TRUE;
2160 	rule_res_t	rule_result;
2161 	tsol_tpc_t	*src_rhtp, *dst_rhtp;
2162 	ip_stack_t	*ipst = dstill->ill_ipst;
2163 
2164 	/*
2165 	 * The list of ordering rules.  They are applied in the order they
2166 	 * appear in the list.
2167 	 *
2168 	 * Solaris doesn't currently support Mobile IPv6, so there's no
2169 	 * rule_mipv6 corresponding to rule 4 in the specification.
2170 	 */
2171 	rulef_t	rules[] = {
2172 		rule_isdst,
2173 		rule_scope,
2174 		rule_deprecated,
2175 		rule_preferred,
2176 		rule_interface,
2177 		rule_label,
2178 		rule_temporary,
2179 		rule_ifprefix,			/* local rules after this */
2180 		rule_zone_specific,
2181 		rule_addr_type,
2182 		rule_prefix,			/* local rules before this */
2183 		rule_must_be_last,		/* must always be last */
2184 		NULL
2185 	};
2186 
2187 	ASSERT(dstill->ill_isv6);
2188 	ASSERT(!IN6_IS_ADDR_V4MAPPED(dst));
2189 
2190 	/*
2191 	 * Check if there is a usable src address pointed to by the
2192 	 * usesrc ifindex. This has higher precedence since it is
2193 	 * finer grained (i.e per interface) v/s being system wide.
2194 	 */
2195 	if (dstill->ill_usesrc_ifindex != 0) {
2196 		if ((usesrc_ill =
2197 		    ill_lookup_on_ifindex(dstill->ill_usesrc_ifindex, B_TRUE,
2198 		    NULL, NULL, NULL, NULL, ipst)) != NULL) {
2199 			dstinfo.dst_ill = usesrc_ill;
2200 		} else {
2201 			return (NULL);
2202 		}
2203 	} else {
2204 		dstinfo.dst_ill = dstill;
2205 	}
2206 
2207 	/*
2208 	 * If we're dealing with an unlabeled destination on a labeled system,
2209 	 * make sure that we ignore source addresses that are incompatible with
2210 	 * the destination's default label.  That destination's default label
2211 	 * must dominate the minimum label on the source address.
2212 	 *
2213 	 * (Note that this has to do with Trusted Solaris.  It's not related to
2214 	 * the labels described by ip6_asp_lookup.)
2215 	 */
2216 	dst_rhtp = NULL;
2217 	if (is_system_labeled()) {
2218 		dst_rhtp = find_tpc(dst, IPV6_VERSION, B_FALSE);
2219 		if (dst_rhtp == NULL)
2220 			return (NULL);
2221 		if (dst_rhtp->tpc_tp.host_type != UNLABELED) {
2222 			TPC_RELE(dst_rhtp);
2223 			dst_rhtp = NULL;
2224 		}
2225 	}
2226 
2227 	dstinfo.dst_addr = dst;
2228 	dstinfo.dst_scope = ip_addr_scope_v6(dst);
2229 	dstinfo.dst_label = ip6_asp_lookup(dst, NULL, ipst);
2230 	dstinfo.dst_prefer_src_tmp = ((src_prefs & IPV6_PREFER_SRC_TMP) != 0);
2231 
2232 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
2233 	/*
2234 	 * Section three of the I-D states that for multicast and
2235 	 * link-local destinations, the candidate set must be restricted to
2236 	 * an interface that is on the same link as the outgoing interface.
2237 	 * Also, when ipv6_strict_dst_multihoming is turned on, always
2238 	 * restrict the source address to the destination link as doing
2239 	 * otherwise will almost certainly cause problems.
2240 	 */
2241 	if (IN6_IS_ADDR_LINKLOCAL(dst) || IN6_IS_ADDR_MULTICAST(dst) ||
2242 	    ipst->ips_ipv6_strict_dst_multihoming || usesrc_ill != NULL) {
2243 		if (restrict_ill == RESTRICT_TO_NONE)
2244 			dstinfo.dst_restrict_ill = RESTRICT_TO_GROUP;
2245 		else
2246 			dstinfo.dst_restrict_ill = restrict_ill;
2247 	} else {
2248 		dstinfo.dst_restrict_ill = restrict_ill;
2249 	}
2250 
2251 	bzero(&best_c, sizeof (cand_t));
2252 
2253 	/*
2254 	 * Take a pass through the list of IPv6 interfaces to chose the
2255 	 * best possible source address.  If restrict_ill is true, we only
2256 	 * iterate through the ill's that are in the same IPMP group as the
2257 	 * destination's outgoing ill.  If restrict_ill is false, we walk
2258 	 * the entire list of IPv6 ill's.
2259 	 */
2260 	if (dstinfo.dst_restrict_ill != RESTRICT_TO_NONE) {
2261 		if (dstinfo.dst_ill->ill_group != NULL &&
2262 		    dstinfo.dst_restrict_ill == RESTRICT_TO_GROUP) {
2263 			ill = dstinfo.dst_ill->ill_group->illgrp_ill;
2264 		} else {
2265 			ill = dstinfo.dst_ill;
2266 		}
2267 	} else {
2268 		ill = ILL_START_WALK_V6(&ctx, ipst);
2269 	}
2270 
2271 	while (ill != NULL) {
2272 		ASSERT(ill->ill_isv6);
2273 
2274 		/*
2275 		 * Avoid FAILED/OFFLINE ills.
2276 		 * Global and site local addresses will failover and
2277 		 * will be available on the new ill.
2278 		 * But link local addresses don't move.
2279 		 */
2280 		if (dstinfo.dst_restrict_ill != RESTRICT_TO_ILL &&
2281 		    ill->ill_phyint->phyint_flags &
2282 		    (PHYI_OFFLINE | PHYI_FAILED))
2283 			goto next_ill;
2284 
2285 		for (ipif = ill->ill_ipif; ipif != NULL;
2286 		    ipif = ipif->ipif_next) {
2287 
2288 			if (!IPIF_VALID_IPV6_SOURCE(ipif))
2289 				continue;
2290 
2291 			if (zoneid != ALL_ZONES &&
2292 			    ipif->ipif_zoneid != zoneid &&
2293 			    ipif->ipif_zoneid != ALL_ZONES)
2294 				continue;
2295 
2296 			/*
2297 			 * Check compatibility of local address for
2298 			 * destination's default label if we're on a labeled
2299 			 * system.  Incompatible addresses can't be used at
2300 			 * all and must be skipped over.
2301 			 */
2302 			if (dst_rhtp != NULL) {
2303 				boolean_t incompat;
2304 
2305 				src_rhtp = find_tpc(&ipif->ipif_v6lcl_addr,
2306 				    IPV6_VERSION, B_FALSE);
2307 				if (src_rhtp == NULL)
2308 					continue;
2309 				incompat =
2310 				    src_rhtp->tpc_tp.host_type != SUN_CIPSO ||
2311 				    src_rhtp->tpc_tp.tp_doi !=
2312 				    dst_rhtp->tpc_tp.tp_doi ||
2313 				    (!_blinrange(&dst_rhtp->tpc_tp.tp_def_label,
2314 				    &src_rhtp->tpc_tp.tp_sl_range_cipso) &&
2315 				    !blinlset(&dst_rhtp->tpc_tp.tp_def_label,
2316 				    src_rhtp->tpc_tp.tp_sl_set_cipso));
2317 				TPC_RELE(src_rhtp);
2318 				if (incompat)
2319 					continue;
2320 			}
2321 
2322 			if (first_candidate) {
2323 				/*
2324 				 * This is first valid address in the list.
2325 				 * It is automatically the best candidate
2326 				 * so far.
2327 				 */
2328 				best_c.cand_ipif = ipif;
2329 				first_candidate = B_FALSE;
2330 				continue;
2331 			}
2332 
2333 			bzero(&curr_c, sizeof (cand_t));
2334 			curr_c.cand_ipif = ipif;
2335 
2336 			/*
2337 			 * Compare this current candidate (curr_c) with the
2338 			 * best candidate (best_c) by applying the
2339 			 * comparison rules in order until one breaks the
2340 			 * tie.
2341 			 */
2342 			for (index = 0; rules[index] != NULL; index++) {
2343 				/* Apply a comparison rule. */
2344 				rule_result =
2345 				    (rules[index])(&best_c, &curr_c, &dstinfo,
2346 				    ipst);
2347 				if (rule_result == CAND_AVOID) {
2348 					/*
2349 					 * The best candidate is still the
2350 					 * best candidate.  Forget about
2351 					 * this current candidate and go on
2352 					 * to the next one.
2353 					 */
2354 					break;
2355 				} else if (rule_result == CAND_PREFER) {
2356 					/*
2357 					 * This candidate is prefered.  It
2358 					 * becomes the best candidate so
2359 					 * far.  Go on to the next address.
2360 					 */
2361 					best_c = curr_c;
2362 					break;
2363 				}
2364 				/* We have a tie, apply the next rule. */
2365 			}
2366 
2367 			/*
2368 			 * The last rule must be a tie breaker rule and
2369 			 * must never produce a tie.  At this point, the
2370 			 * candidate should have either been rejected, or
2371 			 * have been prefered as the best candidate so far.
2372 			 */
2373 			ASSERT(rule_result != CAND_TIE);
2374 		}
2375 
2376 		/*
2377 		 * We may be walking the linked-list of ill's in an
2378 		 * IPMP group or traversing the IPv6 ill avl tree. If it is a
2379 		 * usesrc ILL then it can't be part of IPMP group and we
2380 		 * will exit the while loop.
2381 		 */
2382 next_ill:
2383 		if (dstinfo.dst_restrict_ill == RESTRICT_TO_ILL)
2384 			ill = NULL;
2385 		else if (dstinfo.dst_restrict_ill == RESTRICT_TO_GROUP)
2386 			ill = ill->ill_group_next;
2387 		else
2388 			ill = ill_next(&ctx, ill);
2389 	}
2390 
2391 	ipif = best_c.cand_ipif;
2392 	ip1dbg(("ipif_select_source_v6(%s, %s) -> %s\n",
2393 	    dstinfo.dst_ill->ill_name,
2394 	    inet_ntop(AF_INET6, dstinfo.dst_addr, dstr, sizeof (dstr)),
2395 	    (ipif == NULL ? "NULL" :
2396 	    inet_ntop(AF_INET6, &ipif->ipif_v6lcl_addr, sstr, sizeof (sstr)))));
2397 
2398 	if (usesrc_ill != NULL)
2399 		ill_refrele(usesrc_ill);
2400 
2401 	if (dst_rhtp != NULL)
2402 		TPC_RELE(dst_rhtp);
2403 
2404 	if (ipif == NULL) {
2405 		rw_exit(&ipst->ips_ill_g_lock);
2406 		return (NULL);
2407 	}
2408 
2409 	mutex_enter(&ipif->ipif_ill->ill_lock);
2410 	if (IPIF_CAN_LOOKUP(ipif)) {
2411 		ipif_refhold_locked(ipif);
2412 		mutex_exit(&ipif->ipif_ill->ill_lock);
2413 		rw_exit(&ipst->ips_ill_g_lock);
2414 		return (ipif);
2415 	}
2416 	mutex_exit(&ipif->ipif_ill->ill_lock);
2417 	rw_exit(&ipst->ips_ill_g_lock);
2418 	ip1dbg(("ipif_select_source_v6 cannot lookup ipif %p"
2419 	    " returning null \n", (void *)ipif));
2420 
2421 	return (NULL);
2422 }
2423 
2424 /*
2425  * If old_ipif is not NULL, see if ipif was derived from old
2426  * ipif and if so, recreate the interface route by re-doing
2427  * source address selection. This happens when ipif_down ->
2428  * ipif_update_other_ipifs calls us.
2429  *
2430  * If old_ipif is NULL, just redo the source address selection
2431  * if needed. This happens when illgrp_insert or ipif_up_done_v6
2432  * calls us.
2433  */
2434 void
2435 ipif_recreate_interface_routes_v6(ipif_t *old_ipif, ipif_t *ipif)
2436 {
2437 	ire_t *ire;
2438 	ire_t *ipif_ire;
2439 	queue_t *stq;
2440 	ill_t *ill;
2441 	ipif_t *nipif = NULL;
2442 	boolean_t nipif_refheld = B_FALSE;
2443 	boolean_t ip6_asp_table_held = B_FALSE;
2444 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
2445 
2446 	ill = ipif->ipif_ill;
2447 
2448 	if (!(ipif->ipif_flags &
2449 	    (IPIF_NOLOCAL|IPIF_ANYCAST|IPIF_DEPRECATED))) {
2450 		/*
2451 		 * Can't possibly have borrowed the source
2452 		 * from old_ipif.
2453 		 */
2454 		return;
2455 	}
2456 
2457 	/*
2458 	 * Is there any work to be done? No work if the address
2459 	 * is INADDR_ANY, loopback or NOLOCAL or ANYCAST (
2460 	 * ipif_select_source_v6() does not borrow addresses from
2461 	 * NOLOCAL and ANYCAST interfaces).
2462 	 */
2463 	if ((old_ipif != NULL) &&
2464 	    ((IN6_IS_ADDR_UNSPECIFIED(&old_ipif->ipif_v6lcl_addr)) ||
2465 	    (old_ipif->ipif_ill->ill_wq == NULL) ||
2466 	    (old_ipif->ipif_flags &
2467 	    (IPIF_NOLOCAL|IPIF_ANYCAST)))) {
2468 		return;
2469 	}
2470 
2471 	/*
2472 	 * Perform the same checks as when creating the
2473 	 * IRE_INTERFACE in ipif_up_done_v6.
2474 	 */
2475 	if (!(ipif->ipif_flags & IPIF_UP))
2476 		return;
2477 
2478 	if ((ipif->ipif_flags & IPIF_NOXMIT))
2479 		return;
2480 
2481 	if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet) &&
2482 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6net_mask))
2483 		return;
2484 
2485 	/*
2486 	 * We know that ipif uses some other source for its
2487 	 * IRE_INTERFACE. Is it using the source of this
2488 	 * old_ipif?
2489 	 */
2490 	ipif_ire = ipif_to_ire_v6(ipif);
2491 	if (ipif_ire == NULL)
2492 		return;
2493 
2494 	if (old_ipif != NULL &&
2495 	    !IN6_ARE_ADDR_EQUAL(&old_ipif->ipif_v6lcl_addr,
2496 	    &ipif_ire->ire_src_addr_v6)) {
2497 		ire_refrele(ipif_ire);
2498 		return;
2499 	}
2500 
2501 	if (ip_debug > 2) {
2502 		/* ip1dbg */
2503 		pr_addr_dbg("ipif_recreate_interface_routes_v6: deleting IRE"
2504 		    " for src %s\n", AF_INET6, &ipif_ire->ire_src_addr_v6);
2505 	}
2506 
2507 	stq = ipif_ire->ire_stq;
2508 
2509 	/*
2510 	 * Can't use our source address. Select a different source address
2511 	 * for the IRE_INTERFACE.  We restrict interface route source
2512 	 * address selection to ipif's assigned to the same link as the
2513 	 * interface.
2514 	 */
2515 	if (ip6_asp_can_lookup(ipst)) {
2516 		ip6_asp_table_held = B_TRUE;
2517 		nipif = ipif_select_source_v6(ill, &ipif->ipif_v6subnet,
2518 		    RESTRICT_TO_GROUP, IPV6_PREFER_SRC_DEFAULT,
2519 		    ipif->ipif_zoneid);
2520 	}
2521 	if (nipif == NULL) {
2522 		/* Last resort - all ipif's have IPIF_NOLOCAL */
2523 		nipif = ipif;
2524 	} else {
2525 		nipif_refheld = B_TRUE;
2526 	}
2527 
2528 	ire = ire_create_v6(
2529 	    &ipif->ipif_v6subnet,	/* dest pref */
2530 	    &ipif->ipif_v6net_mask,	/* mask */
2531 	    &nipif->ipif_v6src_addr,	/* src addr */
2532 	    NULL,			/* no gateway */
2533 	    &ipif->ipif_mtu,		/* max frag */
2534 	    NULL,			/* no Fast path header */
2535 	    NULL,			/* no recv from queue */
2536 	    stq,			/* send-to queue */
2537 	    ill->ill_net_type,		/* IF_[NO]RESOLVER */
2538 	    ill->ill_resolver_mp,	/* xmit header */
2539 	    ipif,
2540 	    NULL,
2541 	    0,
2542 	    0,
2543 	    0,
2544 	    &ire_uinfo_null,
2545 	    NULL,
2546 	    NULL,
2547 	    ipst);
2548 
2549 	if (ire != NULL) {
2550 		ire_t *ret_ire;
2551 		int   error;
2552 
2553 		/*
2554 		 * We don't need ipif_ire anymore. We need to delete
2555 		 * before we add so that ire_add does not detect
2556 		 * duplicates.
2557 		 */
2558 		ire_delete(ipif_ire);
2559 		ret_ire = ire;
2560 		error = ire_add(&ret_ire, NULL, NULL, NULL, B_FALSE);
2561 		ASSERT(error == 0);
2562 		ASSERT(ret_ire == ire);
2563 		if (ret_ire != NULL) {
2564 			/* Held in ire_add */
2565 			ire_refrele(ret_ire);
2566 		}
2567 	}
2568 	/*
2569 	 * Either we are falling through from above or could not
2570 	 * allocate a replacement.
2571 	 */
2572 	ire_refrele(ipif_ire);
2573 	if (ip6_asp_table_held)
2574 		ip6_asp_table_refrele(ipst);
2575 	if (nipif_refheld)
2576 		ipif_refrele(nipif);
2577 }
2578 
2579 /*
2580  * This old_ipif is going away.
2581  *
2582  * Determine if any other ipif's are using our address as
2583  * ipif_v6lcl_addr (due to those being IPIF_NOLOCAL, IPIF_ANYCAST, or
2584  * IPIF_DEPRECATED).
2585  * Find the IRE_INTERFACE for such ipif's and recreate them
2586  * to use an different source address following the rules in
2587  * ipif_up_done_v6.
2588  *
2589  * This function takes an illgrp as an argument so that illgrp_delete
2590  * can call this to update source address even after deleting the
2591  * old_ipif->ipif_ill from the ill group.
2592  */
2593 void
2594 ipif_update_other_ipifs_v6(ipif_t *old_ipif, ill_group_t *illgrp)
2595 {
2596 	ipif_t	*ipif;
2597 	ill_t	*ill;
2598 	char	buf[INET6_ADDRSTRLEN];
2599 
2600 	ASSERT(IAM_WRITER_IPIF(old_ipif));
2601 
2602 	ill = old_ipif->ipif_ill;
2603 
2604 	ip1dbg(("ipif_update_other_ipifs_v6(%s, %s)\n",
2605 	    ill->ill_name,
2606 	    inet_ntop(AF_INET6, &old_ipif->ipif_v6lcl_addr,
2607 	    buf, sizeof (buf))));
2608 
2609 	/*
2610 	 * If this part of a group, look at all ills as ipif_select_source
2611 	 * borrows a source address across all the ills in the group.
2612 	 */
2613 	if (illgrp != NULL)
2614 		ill = illgrp->illgrp_ill;
2615 
2616 	/* Don't need a lock since this is a writer */
2617 	for (; ill != NULL; ill = ill->ill_group_next) {
2618 		for (ipif = ill->ill_ipif; ipif != NULL;
2619 		    ipif = ipif->ipif_next) {
2620 
2621 			if (ipif == old_ipif)
2622 				continue;
2623 
2624 			ipif_recreate_interface_routes_v6(old_ipif, ipif);
2625 		}
2626 	}
2627 }
2628 
2629 /*
2630  * Perform an attach and bind to get phys addr plus info_req for
2631  * the physical device.
2632  * q and mp represents an ioctl which will be queued waiting for
2633  * completion of the DLPI message exchange.
2634  * MUST be called on an ill queue. Can not set conn_pending_ill for that
2635  * reason thus the DL_PHYS_ADDR_ACK code does not assume ill_pending_q.
2636  *
2637  * Returns EINPROGRESS when mp has been consumed by queueing it on
2638  * ill_pending_mp and the ioctl will complete in ip_rput.
2639  */
2640 int
2641 ill_dl_phys(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q)
2642 {
2643 	mblk_t	*v6token_mp = NULL;
2644 	mblk_t	*v6lla_mp = NULL;
2645 	mblk_t	*phys_mp = NULL;
2646 	mblk_t	*info_mp = NULL;
2647 	mblk_t	*attach_mp = NULL;
2648 	mblk_t	*detach_mp = NULL;
2649 	mblk_t	*bind_mp = NULL;
2650 	mblk_t	*unbind_mp = NULL;
2651 	mblk_t	*notify_mp = NULL;
2652 
2653 	ip1dbg(("ill_dl_phys(%s:%u)\n", ill->ill_name, ipif->ipif_id));
2654 	ASSERT(ill->ill_dlpi_style_set);
2655 	ASSERT(WR(q)->q_next != NULL);
2656 
2657 	if (ill->ill_isv6) {
2658 		v6token_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) +
2659 		    sizeof (t_scalar_t), DL_PHYS_ADDR_REQ);
2660 		if (v6token_mp == NULL)
2661 			goto bad;
2662 		((dl_phys_addr_req_t *)v6token_mp->b_rptr)->dl_addr_type =
2663 		    DL_IPV6_TOKEN;
2664 
2665 		v6lla_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) +
2666 		    sizeof (t_scalar_t), DL_PHYS_ADDR_REQ);
2667 		if (v6lla_mp == NULL)
2668 			goto bad;
2669 		((dl_phys_addr_req_t *)v6lla_mp->b_rptr)->dl_addr_type =
2670 		    DL_IPV6_LINK_LAYER_ADDR;
2671 	}
2672 
2673 	/*
2674 	 * Allocate a DL_NOTIFY_REQ and set the notifications we want.
2675 	 */
2676 	notify_mp = ip_dlpi_alloc(sizeof (dl_notify_req_t) + sizeof (long),
2677 	    DL_NOTIFY_REQ);
2678 	if (notify_mp == NULL)
2679 		goto bad;
2680 	((dl_notify_req_t *)notify_mp->b_rptr)->dl_notifications =
2681 	    (DL_NOTE_PHYS_ADDR | DL_NOTE_SDU_SIZE | DL_NOTE_FASTPATH_FLUSH |
2682 	    DL_NOTE_LINK_UP | DL_NOTE_LINK_DOWN | DL_NOTE_CAPAB_RENEG);
2683 
2684 	phys_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) +
2685 	    sizeof (t_scalar_t), DL_PHYS_ADDR_REQ);
2686 	if (phys_mp == NULL)
2687 		goto bad;
2688 	((dl_phys_addr_req_t *)phys_mp->b_rptr)->dl_addr_type =
2689 	    DL_CURR_PHYS_ADDR;
2690 
2691 	info_mp = ip_dlpi_alloc(
2692 	    sizeof (dl_info_req_t) + sizeof (dl_info_ack_t),
2693 	    DL_INFO_REQ);
2694 	if (info_mp == NULL)
2695 		goto bad;
2696 
2697 	bind_mp = ip_dlpi_alloc(sizeof (dl_bind_req_t) + sizeof (long),
2698 	    DL_BIND_REQ);
2699 	if (bind_mp == NULL)
2700 		goto bad;
2701 	((dl_bind_req_t *)bind_mp->b_rptr)->dl_sap = ill->ill_sap;
2702 	((dl_bind_req_t *)bind_mp->b_rptr)->dl_service_mode = DL_CLDLS;
2703 
2704 	unbind_mp = ip_dlpi_alloc(sizeof (dl_unbind_req_t), DL_UNBIND_REQ);
2705 	if (unbind_mp == NULL)
2706 		goto bad;
2707 
2708 	/* If we need to attach/detach, pre-alloc and initialize the mblks */
2709 	if (ill->ill_needs_attach) {
2710 		attach_mp = ip_dlpi_alloc(sizeof (dl_attach_req_t),
2711 		    DL_ATTACH_REQ);
2712 		if (attach_mp == NULL)
2713 			goto bad;
2714 		((dl_attach_req_t *)attach_mp->b_rptr)->dl_ppa = ill->ill_ppa;
2715 
2716 		detach_mp = ip_dlpi_alloc(sizeof (dl_detach_req_t),
2717 		    DL_DETACH_REQ);
2718 		if (detach_mp == NULL)
2719 			goto bad;
2720 	}
2721 
2722 	/*
2723 	 * Here we are going to delay the ioctl ack until after
2724 	 * ACKs from DL_PHYS_ADDR_REQ. So need to save the
2725 	 * original ioctl message before sending the requests
2726 	 */
2727 	mutex_enter(&ill->ill_lock);
2728 	/* ipsq_pending_mp_add won't fail since we pass in a NULL connp */
2729 	(void) ipsq_pending_mp_add(NULL, ipif, ill->ill_wq, mp, 0);
2730 	/*
2731 	 * Set ill_phys_addr_pend to zero. It will be set to the addr_type of
2732 	 * the DL_PHYS_ADDR_REQ in ill_dlpi_send() and ill_dlpi_done(). It will
2733 	 * be used to track which DL_PHYS_ADDR_REQ is being ACK'd/NAK'd.
2734 	 */
2735 	ill->ill_phys_addr_pend = 0;
2736 	mutex_exit(&ill->ill_lock);
2737 
2738 	if (attach_mp != NULL) {
2739 		ip1dbg(("ill_dl_phys: attach\n"));
2740 		ill_dlpi_send(ill, attach_mp);
2741 	}
2742 	ill_dlpi_send(ill, bind_mp);
2743 	ill_dlpi_send(ill, info_mp);
2744 	if (ill->ill_isv6) {
2745 		ill_dlpi_send(ill, v6token_mp);
2746 		ill_dlpi_send(ill, v6lla_mp);
2747 	}
2748 	ill_dlpi_send(ill, phys_mp);
2749 	ill_dlpi_send(ill, notify_mp);
2750 	ill_dlpi_send(ill, unbind_mp);
2751 
2752 	/*
2753 	 * Save the DL_DETACH_REQ (if there is one) for use in ill_delete().
2754 	 */
2755 	ASSERT(ill->ill_detach_mp == NULL);
2756 	ill->ill_detach_mp = detach_mp;
2757 
2758 	/*
2759 	 * This operation will complete in ip_rput_dlpi_writer with either
2760 	 * a DL_PHYS_ADDR_ACK or DL_ERROR_ACK.
2761 	 */
2762 	return (EINPROGRESS);
2763 bad:
2764 	if (v6token_mp != NULL)
2765 		freemsg(v6token_mp);
2766 	if (v6lla_mp != NULL)
2767 		freemsg(v6lla_mp);
2768 	if (phys_mp != NULL)
2769 		freemsg(phys_mp);
2770 	if (info_mp != NULL)
2771 		freemsg(info_mp);
2772 	if (attach_mp != NULL)
2773 		freemsg(attach_mp);
2774 	if (detach_mp != NULL)
2775 		freemsg(detach_mp);
2776 	if (bind_mp != NULL)
2777 		freemsg(bind_mp);
2778 	if (unbind_mp != NULL)
2779 		freemsg(unbind_mp);
2780 	if (notify_mp != NULL)
2781 		freemsg(notify_mp);
2782 	return (ENOMEM);
2783 }
2784 
2785 uint_t ip_loopback_mtu_v6plus = IP_LOOPBACK_MTU + IPV6_HDR_LEN + 20;
2786 
2787 /*
2788  * DLPI is up.
2789  * Create all the IREs associated with an interface bring up multicast.
2790  * Set the interface flag and finish other initialization
2791  * that potentially had to be differed to after DL_BIND_ACK.
2792  */
2793 int
2794 ipif_up_done_v6(ipif_t *ipif)
2795 {
2796 	ire_t	*ire_array[20];
2797 	ire_t	**irep = ire_array;
2798 	ire_t	**irep1;
2799 	ill_t	*ill = ipif->ipif_ill;
2800 	queue_t	*stq;
2801 	in6_addr_t	v6addr;
2802 	in6_addr_t	route_mask;
2803 	ipif_t	 *src_ipif = NULL;
2804 	ipif_t   *tmp_ipif;
2805 	boolean_t	flush_ire_cache = B_TRUE;
2806 	int	err;
2807 	char	buf[INET6_ADDRSTRLEN];
2808 	phyint_t *phyi;
2809 	ire_t	**ipif_saved_irep = NULL;
2810 	int ipif_saved_ire_cnt;
2811 	int cnt;
2812 	boolean_t src_ipif_held = B_FALSE;
2813 	boolean_t ire_added = B_FALSE;
2814 	boolean_t loopback = B_FALSE;
2815 	boolean_t ip6_asp_table_held = B_FALSE;
2816 	ip_stack_t	*ipst = ill->ill_ipst;
2817 
2818 	ip1dbg(("ipif_up_done_v6(%s:%u)\n",
2819 		ipif->ipif_ill->ill_name, ipif->ipif_id));
2820 
2821 	/* Check if this is a loopback interface */
2822 	if (ipif->ipif_ill->ill_wq == NULL)
2823 		loopback = B_TRUE;
2824 
2825 	ASSERT(ipif->ipif_isv6);
2826 	ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock));
2827 
2828 	/*
2829 	 * If all other interfaces for this ill are down or DEPRECATED,
2830 	 * or otherwise unsuitable for source address selection, remove
2831 	 * any IRE_CACHE entries for this ill to make sure source
2832 	 * address selection gets to take this new ipif into account.
2833 	 * No need to hold ill_lock while traversing the ipif list since
2834 	 * we are writer
2835 	 */
2836 	for (tmp_ipif = ill->ill_ipif; tmp_ipif;
2837 		tmp_ipif = tmp_ipif->ipif_next) {
2838 		if (((tmp_ipif->ipif_flags &
2839 		    (IPIF_NOXMIT|IPIF_ANYCAST|IPIF_NOLOCAL|IPIF_DEPRECATED)) ||
2840 		    !(tmp_ipif->ipif_flags & IPIF_UP)) ||
2841 		    (tmp_ipif == ipif))
2842 			continue;
2843 		/* first useable pre-existing interface */
2844 		flush_ire_cache = B_FALSE;
2845 		break;
2846 	}
2847 	if (flush_ire_cache)
2848 		ire_walk_ill_v6(MATCH_IRE_ILL_GROUP | MATCH_IRE_TYPE,
2849 		    IRE_CACHE, ill_ipif_cache_delete, (char *)ill, ill);
2850 
2851 	/*
2852 	 * Figure out which way the send-to queue should go.  Only
2853 	 * IRE_IF_RESOLVER or IRE_IF_NORESOLVER should show up here.
2854 	 */
2855 	switch (ill->ill_net_type) {
2856 	case IRE_IF_RESOLVER:
2857 		stq = ill->ill_rq;
2858 		break;
2859 	case IRE_IF_NORESOLVER:
2860 	case IRE_LOOPBACK:
2861 		stq = ill->ill_wq;
2862 		break;
2863 	default:
2864 		return (EINVAL);
2865 	}
2866 
2867 	if (ill->ill_phyint->phyint_flags & PHYI_LOOPBACK) {
2868 		/*
2869 		 * lo0:1 and subsequent ipifs were marked IRE_LOCAL in
2870 		 * ipif_lookup_on_name(), but in the case of zones we can have
2871 		 * several loopback addresses on lo0. So all the interfaces with
2872 		 * loopback addresses need to be marked IRE_LOOPBACK.
2873 		 */
2874 		if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr, &ipv6_loopback))
2875 			ipif->ipif_ire_type = IRE_LOOPBACK;
2876 		else
2877 			ipif->ipif_ire_type = IRE_LOCAL;
2878 	}
2879 
2880 	if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST|IPIF_DEPRECATED)) {
2881 		/*
2882 		 * Can't use our source address. Select a different
2883 		 * source address for the IRE_INTERFACE and IRE_LOCAL
2884 		 */
2885 		if (ip6_asp_can_lookup(ipst)) {
2886 			ip6_asp_table_held = B_TRUE;
2887 			src_ipif = ipif_select_source_v6(ipif->ipif_ill,
2888 			    &ipif->ipif_v6subnet, RESTRICT_TO_NONE,
2889 			    IPV6_PREFER_SRC_DEFAULT, ipif->ipif_zoneid);
2890 		}
2891 		if (src_ipif == NULL)
2892 			src_ipif = ipif;	/* Last resort */
2893 		else
2894 			src_ipif_held = B_TRUE;
2895 	} else {
2896 		src_ipif = ipif;
2897 	}
2898 
2899 	if (!IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) &&
2900 	    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
2901 
2902 		/*
2903 		 * If we're on a labeled system then make sure that zone-
2904 		 * private addresses have proper remote host database entries.
2905 		 */
2906 		if (is_system_labeled() &&
2907 		    ipif->ipif_ire_type != IRE_LOOPBACK) {
2908 			if (ip6opt_ls == 0) {
2909 				cmn_err(CE_WARN, "IPv6 not enabled "
2910 				    "via /etc/system");
2911 				return (EINVAL);
2912 			}
2913 			if (!tsol_check_interface_address(ipif))
2914 				return (EINVAL);
2915 		}
2916 
2917 		/* Register the source address for __sin6_src_id */
2918 		err = ip_srcid_insert(&ipif->ipif_v6lcl_addr,
2919 		    ipif->ipif_zoneid, ipst);
2920 		if (err != 0) {
2921 			ip0dbg(("ipif_up_done_v6: srcid_insert %d\n", err));
2922 			if (src_ipif_held)
2923 				ipif_refrele(src_ipif);
2924 			if (ip6_asp_table_held)
2925 				ip6_asp_table_refrele(ipst);
2926 			return (err);
2927 		}
2928 		/*
2929 		 * If the interface address is set, create the LOCAL
2930 		 * or LOOPBACK IRE.
2931 		 */
2932 		ip1dbg(("ipif_up_done_v6: creating IRE %d for %s\n",
2933 		    ipif->ipif_ire_type,
2934 		    inet_ntop(AF_INET6, &ipif->ipif_v6lcl_addr,
2935 		    buf, sizeof (buf))));
2936 
2937 		*irep++ = ire_create_v6(
2938 		    &ipif->ipif_v6lcl_addr,		/* dest address */
2939 		    &ipv6_all_ones,			/* mask */
2940 		    &src_ipif->ipif_v6src_addr,		/* source address */
2941 		    NULL,				/* no gateway */
2942 		    &ip_loopback_mtu_v6plus,		/* max frag size */
2943 		    NULL,
2944 		    ipif->ipif_rq,			/* recv-from queue */
2945 		    NULL,				/* no send-to queue */
2946 		    ipif->ipif_ire_type,		/* LOCAL or LOOPBACK */
2947 		    NULL,
2948 		    ipif,				/* interface */
2949 		    NULL,
2950 		    0,
2951 		    0,
2952 		    (ipif->ipif_flags & IPIF_PRIVATE) ? RTF_PRIVATE : 0,
2953 		    &ire_uinfo_null,
2954 		    NULL,
2955 		    NULL,
2956 		    ipst);
2957 	}
2958 
2959 	/*
2960 	 * Set up the IRE_IF_RESOLVER or IRE_IF_NORESOLVER, as appropriate.
2961 	 * Note that atun interfaces have an all-zero ipif_v6subnet.
2962 	 * Thus we allow a zero subnet as long as the mask is non-zero.
2963 	 */
2964 	if (stq != NULL && !(ipif->ipif_flags & IPIF_NOXMIT) &&
2965 	    !(IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet) &&
2966 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6net_mask))) {
2967 		/* ipif_v6subnet is ipif_v6pp_dst_addr for pt-pt */
2968 		v6addr = ipif->ipif_v6subnet;
2969 
2970 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
2971 			route_mask = ipv6_all_ones;
2972 		} else {
2973 			route_mask = ipif->ipif_v6net_mask;
2974 		}
2975 
2976 		ip1dbg(("ipif_up_done_v6: creating if IRE %d for %s\n",
2977 		    ill->ill_net_type,
2978 		    inet_ntop(AF_INET6, &v6addr, buf, sizeof (buf))));
2979 
2980 		*irep++ = ire_create_v6(
2981 		    &v6addr,			/* dest pref */
2982 		    &route_mask,		/* mask */
2983 		    &src_ipif->ipif_v6src_addr,	/* src addr */
2984 		    NULL,			/* no gateway */
2985 		    &ipif->ipif_mtu,		/* max frag */
2986 		    NULL,			/* no Fast path header */
2987 		    NULL,			/* no recv from queue */
2988 		    stq,			/* send-to queue */
2989 		    ill->ill_net_type,		/* IF_[NO]RESOLVER */
2990 		    ill->ill_resolver_mp,	/* xmit header */
2991 		    ipif,
2992 		    NULL,
2993 		    0,
2994 		    0,
2995 		    (ipif->ipif_flags & IPIF_PRIVATE) ? RTF_PRIVATE : 0,
2996 		    &ire_uinfo_null,
2997 		    NULL,
2998 		    NULL,
2999 		    ipst);
3000 	}
3001 
3002 	/*
3003 	 * Setup 2002::/16 route, if this interface is a 6to4 tunnel
3004 	 */
3005 	if (IN6_IS_ADDR_6TO4(&ipif->ipif_v6lcl_addr) &&
3006 	    (ill->ill_is_6to4tun)) {
3007 		/*
3008 		 * Destination address is 2002::/16
3009 		 */
3010 #ifdef	_BIG_ENDIAN
3011 		const in6_addr_t prefix_addr = { 0x20020000U, 0, 0, 0 };
3012 		const in6_addr_t prefix_mask = { 0xffff0000U, 0, 0, 0 };
3013 #else
3014 		const in6_addr_t prefix_addr = { 0x00000220U, 0, 0, 0 };
3015 		const in6_addr_t prefix_mask = { 0x0000ffffU, 0, 0, 0 };
3016 #endif /* _BIG_ENDIAN */
3017 		char	buf2[INET6_ADDRSTRLEN];
3018 		ire_t *isdup;
3019 		in6_addr_t *first_addr = &ill->ill_ipif->ipif_v6lcl_addr;
3020 
3021 		/*
3022 		 * check to see if this route has already been added for
3023 		 * this tunnel interface.
3024 		 */
3025 		isdup = ire_ftable_lookup_v6(first_addr, &prefix_mask, 0,
3026 		    IRE_IF_NORESOLVER, ill->ill_ipif, NULL, ALL_ZONES, 0, NULL,
3027 		    (MATCH_IRE_SRC | MATCH_IRE_MASK), ipst);
3028 
3029 		if (isdup == NULL) {
3030 			ip1dbg(("ipif_up_done_v6: creating if IRE %d for %s",
3031 			    IRE_IF_NORESOLVER, inet_ntop(AF_INET6, &v6addr,
3032 				buf2, sizeof (buf2))));
3033 
3034 			*irep++ = ire_create_v6(
3035 			    &prefix_addr,		/* 2002:: */
3036 			    &prefix_mask,		/* ffff:: */
3037 			    &ipif->ipif_v6lcl_addr, 	/* src addr */
3038 			    NULL, 			/* gateway */
3039 			    &ipif->ipif_mtu, 		/* max_frag */
3040 			    NULL, 			/* no Fast Path hdr */
3041 			    NULL, 			/* no rfq */
3042 			    ill->ill_wq, 		/* stq */
3043 			    IRE_IF_NORESOLVER,		/* type */
3044 			    ill->ill_resolver_mp,	/* dlureq_mp */
3045 			    ipif,			/* interface */
3046 			    NULL,			/* v6cmask */
3047 			    0,
3048 			    0,
3049 			    RTF_UP,
3050 			    &ire_uinfo_null,
3051 			    NULL,
3052 			    NULL,
3053 			    ipst);
3054 		} else {
3055 			ire_refrele(isdup);
3056 		}
3057 	}
3058 
3059 	/* If an earlier ire_create failed, get out now */
3060 	for (irep1 = irep; irep1 > ire_array; ) {
3061 		irep1--;
3062 		if (*irep1 == NULL) {
3063 			ip1dbg(("ipif_up_done_v6: NULL ire found in"
3064 			    " ire_array\n"));
3065 			err = ENOMEM;
3066 			goto bad;
3067 		}
3068 	}
3069 
3070 	ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock));
3071 
3072 	/*
3073 	 * Need to atomically check for ip_addr_availablity_check
3074 	 * now under ill_g_lock, and if it fails got bad, and remove
3075 	 * from group also
3076 	 */
3077 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
3078 	mutex_enter(&ipst->ips_ip_addr_avail_lock);
3079 	ill->ill_ipif_up_count++;
3080 	ipif->ipif_flags |= IPIF_UP;
3081 	err = ip_addr_availability_check(ipif);
3082 	mutex_exit(&ipst->ips_ip_addr_avail_lock);
3083 	rw_exit(&ipst->ips_ill_g_lock);
3084 
3085 	if (err != 0) {
3086 		/*
3087 		 * Our address may already be up on the same ill. In this case,
3088 		 * the external resolver entry for our ipif replaced the one for
3089 		 * the other ipif. So we don't want to delete it (otherwise the
3090 		 * other ipif would be unable to send packets).
3091 		 * ip_addr_availability_check() identifies this case for us and
3092 		 * returns EADDRINUSE; we need to turn it into EADDRNOTAVAIL
3093 		 * which is the expected error code.
3094 		 */
3095 		if (err == EADDRINUSE) {
3096 			if (ipif->ipif_ill->ill_flags & ILLF_XRESOLV) {
3097 				freemsg(ipif->ipif_arp_del_mp);
3098 				ipif->ipif_arp_del_mp = NULL;
3099 			}
3100 			err = EADDRNOTAVAIL;
3101 		}
3102 		ill->ill_ipif_up_count--;
3103 		ipif->ipif_flags &= ~IPIF_UP;
3104 		goto bad;
3105 	}
3106 
3107 	/*
3108 	 * Add in all newly created IREs. We want to add before
3109 	 * we call ifgrp_insert which wants to know whether
3110 	 * IRE_IF_RESOLVER exists or not.
3111 	 *
3112 	 * NOTE : We refrele the ire though we may branch to "bad"
3113 	 *	  later on where we do ire_delete. This is okay
3114 	 *	  because nobody can delete it as we are running
3115 	 *	  exclusively.
3116 	 */
3117 	for (irep1 = irep; irep1 > ire_array; ) {
3118 		irep1--;
3119 		/* Shouldn't be adding any bcast ire's */
3120 		ASSERT((*irep1)->ire_type != IRE_BROADCAST);
3121 		ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock));
3122 		/*
3123 		 * refheld by ire_add. refele towards the end of the func
3124 		 */
3125 		(void) ire_add(irep1, NULL, NULL, NULL, B_FALSE);
3126 	}
3127 	if (ip6_asp_table_held) {
3128 		ip6_asp_table_refrele(ipst);
3129 		ip6_asp_table_held = B_FALSE;
3130 	}
3131 	ire_added = B_TRUE;
3132 
3133 	/*
3134 	 * Form groups if possible.
3135 	 *
3136 	 * If we are supposed to be in a ill_group with a name, insert it
3137 	 * now as we know that at least one ipif is UP. Otherwise form
3138 	 * nameless groups.
3139 	 *
3140 	 * If ip_enable_group_ifs is set and ipif address is not ::0, insert
3141 	 * this ipif into the appropriate interface group, or create a
3142 	 * new one. If this is already in a nameless group, we try to form
3143 	 * a bigger group looking at other ills potentially sharing this
3144 	 * ipif's prefix.
3145 	 */
3146 	phyi = ill->ill_phyint;
3147 	if (phyi->phyint_groupname_len != 0) {
3148 		ASSERT(phyi->phyint_groupname != NULL);
3149 		if (ill->ill_ipif_up_count == 1) {
3150 			ASSERT(ill->ill_group == NULL);
3151 			err = illgrp_insert(&ipst->ips_illgrp_head_v6, ill,
3152 			    phyi->phyint_groupname, NULL, B_TRUE);
3153 			if (err != 0) {
3154 				ip1dbg(("ipif_up_done_v6: illgrp allocation "
3155 				    "failed, error %d\n", err));
3156 				goto bad;
3157 			}
3158 		}
3159 		ASSERT(ill->ill_group != NULL);
3160 	}
3161 
3162 	/* Recover any additional IRE_IF_[NO]RESOLVER entries for this ipif */
3163 	ipif_saved_ire_cnt = ipif->ipif_saved_ire_cnt;
3164 	ipif_saved_irep = ipif_recover_ire_v6(ipif);
3165 
3166 	if (ipif->ipif_ipif_up_count == 1 && !loopback) {
3167 		/*
3168 		 * Need to recover all multicast memberships in the driver.
3169 		 * This had to be deferred until we had attached.
3170 		 */
3171 		ill_recover_multicast(ill);
3172 	}
3173 	/* Join the allhosts multicast address and the solicited node MC */
3174 	ipif_multicast_up(ipif);
3175 
3176 	if (!loopback) {
3177 		/*
3178 		 * See whether anybody else would benefit from the
3179 		 * new ipif that we added. We call this always rather
3180 		 * than while adding a non-IPIF_NOLOCAL/DEPRECATED/ANYCAST
3181 		 * ipif for the benefit of illgrp_insert (done above)
3182 		 * which does not do source address selection as it does
3183 		 * not want to re-create interface routes that we are
3184 		 * having reference to it here.
3185 		 */
3186 		ill_update_source_selection(ill);
3187 	}
3188 
3189 	for (irep1 = irep; irep1 > ire_array; ) {
3190 		irep1--;
3191 		if (*irep1 != NULL) {
3192 			/* was held in ire_add */
3193 			ire_refrele(*irep1);
3194 		}
3195 	}
3196 
3197 	cnt = ipif_saved_ire_cnt;
3198 	for (irep1 = ipif_saved_irep; cnt > 0; irep1++, cnt--) {
3199 		if (*irep1 != NULL) {
3200 			/* was held in ire_add */
3201 			ire_refrele(*irep1);
3202 		}
3203 	}
3204 
3205 	if (ipif->ipif_addr_ready) {
3206 		ip_rts_ifmsg(ipif);
3207 		ip_rts_newaddrmsg(RTM_ADD, 0, ipif);
3208 		sctp_update_ipif(ipif, SCTP_IPIF_UP);
3209 	}
3210 
3211 	if (ipif_saved_irep != NULL) {
3212 		kmem_free(ipif_saved_irep,
3213 		    ipif_saved_ire_cnt * sizeof (ire_t *));
3214 	}
3215 
3216 	if (src_ipif_held)
3217 		ipif_refrele(src_ipif);
3218 	return (0);
3219 
3220 bad:
3221 	if (ip6_asp_table_held)
3222 		ip6_asp_table_refrele(ipst);
3223 	/*
3224 	 * We don't have to bother removing from ill groups because
3225 	 *
3226 	 * 1) For groups with names, we insert only when the first ipif
3227 	 *    comes up. In that case if it fails, it will not be in any
3228 	 *    group. So, we need not try to remove for that case.
3229 	 *
3230 	 * 2) For groups without names, either we tried to insert ipif_ill
3231 	 *    in a group as singleton or found some other group to become
3232 	 *    a bigger group. For the former, if it fails we don't have
3233 	 *    anything to do as ipif_ill is not in the group and for the
3234 	 *    latter, there are no failures in illgrp_insert/illgrp_delete
3235 	 *    (ENOMEM can't occur for this. Check ifgrp_insert).
3236 	 */
3237 
3238 	while (irep > ire_array) {
3239 		irep--;
3240 		if (*irep != NULL) {
3241 			ire_delete(*irep);
3242 			if (ire_added)
3243 				ire_refrele(*irep);
3244 		}
3245 
3246 	}
3247 	(void) ip_srcid_remove(&ipif->ipif_v6lcl_addr, ipif->ipif_zoneid, ipst);
3248 
3249 	if (ipif_saved_irep != NULL) {
3250 		kmem_free(ipif_saved_irep,
3251 		    ipif_saved_ire_cnt * sizeof (ire_t *));
3252 	}
3253 	if (src_ipif_held)
3254 		ipif_refrele(src_ipif);
3255 
3256 	ipif_ndp_down(ipif);
3257 	if (ipif->ipif_ill->ill_flags & ILLF_XRESOLV)
3258 		ipif_arp_down(ipif);
3259 
3260 	return (err);
3261 }
3262 
3263 /*
3264  * Delete an ND entry and the corresponding IRE_CACHE entry if it exists.
3265  */
3266 /* ARGSUSED */
3267 int
3268 ip_siocdelndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
3269     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
3270 {
3271 	in6_addr_t	addr;
3272 	sin6_t		*sin6;
3273 	nce_t		*nce;
3274 	struct lifreq	*lifr;
3275 	lif_nd_req_t	*lnr;
3276 	mblk_t	*mp1;
3277 
3278 	mp1 = mp->b_cont->b_cont;
3279 	lifr = (struct lifreq *)mp1->b_rptr;
3280 	lnr = &lifr->lifr_nd;
3281 	/* Only allow for logical unit zero i.e. not on "le0:17" */
3282 	if (ipif->ipif_id != 0)
3283 		return (EINVAL);
3284 
3285 	if (!ipif->ipif_isv6)
3286 		return (EINVAL);
3287 
3288 	if (lnr->lnr_addr.ss_family != AF_INET6)
3289 		return (EAFNOSUPPORT);
3290 
3291 	sin6 = (sin6_t *)&lnr->lnr_addr;
3292 	addr = sin6->sin6_addr;
3293 	nce = ndp_lookup_v6(ipif->ipif_ill, &addr, B_FALSE);
3294 	if (nce == NULL)
3295 		return (ESRCH);
3296 	ndp_delete(nce);
3297 	NCE_REFRELE(nce);
3298 	return (0);
3299 }
3300 
3301 /*
3302  * Return nbr cache info.
3303  */
3304 /* ARGSUSED */
3305 int
3306 ip_siocqueryndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
3307     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
3308 {
3309 	ill_t		*ill = ipif->ipif_ill;
3310 	struct lifreq	*lifr;
3311 	lif_nd_req_t	*lnr;
3312 
3313 	lifr = (struct lifreq *)mp->b_cont->b_cont->b_rptr;
3314 	lnr = &lifr->lifr_nd;
3315 	/* Only allow for logical unit zero i.e. not on "le0:17" */
3316 	if (ipif->ipif_id != 0)
3317 		return (EINVAL);
3318 
3319 	if (!ipif->ipif_isv6)
3320 		return (EINVAL);
3321 
3322 	if (lnr->lnr_addr.ss_family != AF_INET6)
3323 		return (EAFNOSUPPORT);
3324 
3325 	if (ill->ill_phys_addr_length > sizeof (lnr->lnr_hdw_addr))
3326 		return (EINVAL);
3327 
3328 	return (ndp_query(ill, lnr));
3329 }
3330 
3331 /*
3332  * Perform an update of the nd entry for the specified address.
3333  */
3334 /* ARGSUSED */
3335 int
3336 ip_siocsetndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
3337     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
3338 {
3339 	ill_t		*ill = ipif->ipif_ill;
3340 	struct	lifreq	*lifr;
3341 	lif_nd_req_t	*lnr;
3342 
3343 	ASSERT(!(q->q_flag & QREADR) && q->q_next == NULL);
3344 
3345 	lifr = (struct lifreq *)mp->b_cont->b_cont->b_rptr;
3346 	lnr = &lifr->lifr_nd;
3347 	/* Only allow for logical unit zero i.e. not on "le0:17" */
3348 	if (ipif->ipif_id != 0)
3349 		return (EINVAL);
3350 
3351 	if (!ipif->ipif_isv6)
3352 		return (EINVAL);
3353 
3354 	if (lnr->lnr_addr.ss_family != AF_INET6)
3355 		return (EAFNOSUPPORT);
3356 
3357 	return (ndp_sioc_update(ill, lnr));
3358 }
3359