xref: /titanic_44/usr/src/uts/common/inet/ip/ip6_if.c (revision fdd1ecae0dfe07e6aa8ee90687e2e91c876dc189)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 /*
26  * Copyright (c) 1990 Mentat Inc.
27  */
28 
29 #pragma ident	"%Z%%M%	%I%	%E% SMI"
30 
31 /*
32  * This file contains the interface control functions for IPv6.
33  */
34 
35 #include <sys/types.h>
36 #include <sys/sysmacros.h>
37 #include <sys/stream.h>
38 #include <sys/dlpi.h>
39 #include <sys/stropts.h>
40 #include <sys/ddi.h>
41 #include <sys/cmn_err.h>
42 #include <sys/kstat.h>
43 #include <sys/debug.h>
44 #include <sys/zone.h>
45 #include <sys/policy.h>
46 
47 #include <sys/systm.h>
48 #include <sys/param.h>
49 #include <sys/socket.h>
50 #include <sys/isa_defs.h>
51 #include <net/if.h>
52 #include <net/if_dl.h>
53 #include <net/route.h>
54 #include <netinet/in.h>
55 #include <netinet/igmp_var.h>
56 #include <netinet/ip6.h>
57 #include <netinet/icmp6.h>
58 #include <netinet/in.h>
59 
60 #include <inet/common.h>
61 #include <inet/nd.h>
62 #include <inet/mib2.h>
63 #include <inet/ip.h>
64 #include <inet/ip6.h>
65 #include <inet/ip_multi.h>
66 #include <inet/ip_ire.h>
67 #include <inet/ip_rts.h>
68 #include <inet/ip_ndp.h>
69 #include <inet/ip_if.h>
70 #include <inet/ip6_asp.h>
71 #include <inet/tun.h>
72 #include <inet/ipclassifier.h>
73 #include <inet/sctp_ip.h>
74 
75 #include <sys/tsol/tndb.h>
76 #include <sys/tsol/tnet.h>
77 
78 static in6_addr_t	ipv6_ll_template =
79 			{(uint32_t)V6_LINKLOCAL, 0x0, 0x0, 0x0};
80 
81 static ipif_t *
82 ipif_lookup_interface_v6(const in6_addr_t *if_addr, const in6_addr_t *dst,
83     queue_t *q, mblk_t *mp, ipsq_func_t func, int *error, ip_stack_t *ipst);
84 
85 /*
86  * These two functions, ipif_lookup_group_v6() and ill_lookup_group_v6(),
87  * are called when an application does not specify an interface to be
88  * used for multicast traffic.  It calls ire_lookup_multi_v6() to look
89  * for an interface route for the specified multicast group.  Doing
90  * this allows the administrator to add prefix routes for multicast to
91  * indicate which interface to be used for multicast traffic in the above
92  * scenario.  The route could be for all multicast (ff00::/8), for a single
93  * multicast group (a /128 route) or anything in between.  If there is no
94  * such multicast route, we just find any multicast capable interface and
95  * return it.
96  */
97 ipif_t *
98 ipif_lookup_group_v6(const in6_addr_t *group, zoneid_t zoneid, ip_stack_t *ipst)
99 {
100 	ire_t	*ire;
101 	ipif_t	*ipif;
102 
103 	ire = ire_lookup_multi_v6(group, zoneid, ipst);
104 	if (ire != NULL) {
105 		ipif = ire->ire_ipif;
106 		ipif_refhold(ipif);
107 		ire_refrele(ire);
108 		return (ipif);
109 	}
110 
111 	return (ipif_lookup_multicast(ipst, zoneid, B_TRUE));
112 }
113 
114 ill_t *
115 ill_lookup_group_v6(const in6_addr_t *group, zoneid_t zoneid, ip_stack_t *ipst)
116 {
117 	ire_t	*ire;
118 	ill_t	*ill;
119 	ipif_t	*ipif;
120 
121 	ire = ire_lookup_multi_v6(group, zoneid, ipst);
122 	if (ire != NULL) {
123 		ill = ire->ire_ipif->ipif_ill;
124 		ill_refhold(ill);
125 		ire_refrele(ire);
126 		return (ill);
127 	}
128 
129 	ipif = ipif_lookup_multicast(ipst, zoneid, B_TRUE);
130 	if (ipif == NULL)
131 		return (NULL);
132 
133 	ill = ipif->ipif_ill;
134 	ill_refhold(ill);
135 	ipif_refrele(ipif);
136 	return (ill);
137 }
138 
139 /*
140  * Look for an ipif with the specified interface address and destination.
141  * The destination address is used only for matching point-to-point interfaces.
142  */
143 static ipif_t *
144 ipif_lookup_interface_v6(const in6_addr_t *if_addr, const in6_addr_t *dst,
145     queue_t *q, mblk_t *mp, ipsq_func_t func, int *error, ip_stack_t *ipst)
146 {
147 	ipif_t	*ipif;
148 	ill_t	*ill;
149 	ipsq_t	*ipsq;
150 	ill_walk_context_t ctx;
151 
152 	if (error != NULL)
153 		*error = 0;
154 
155 	/*
156 	 * First match all the point-to-point interfaces
157 	 * before looking at non-point-to-point interfaces.
158 	 * This is done to avoid returning non-point-to-point
159 	 * ipif instead of unnumbered point-to-point ipif.
160 	 */
161 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
162 	ill = ILL_START_WALK_V6(&ctx, ipst);
163 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
164 		GRAB_CONN_LOCK(q);
165 		mutex_enter(&ill->ill_lock);
166 		for (ipif = ill->ill_ipif; ipif != NULL;
167 		    ipif = ipif->ipif_next) {
168 			/* Allow the ipif to be down */
169 			if ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
170 			    (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr,
171 			    if_addr)) &&
172 			    (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr,
173 			    dst))) {
174 				if (IPIF_CAN_LOOKUP(ipif)) {
175 					ipif_refhold_locked(ipif);
176 					mutex_exit(&ill->ill_lock);
177 					RELEASE_CONN_LOCK(q);
178 					rw_exit(&ipst->ips_ill_g_lock);
179 					return (ipif);
180 				} else if (IPIF_CAN_WAIT(ipif, q)) {
181 					ipsq = ill->ill_phyint->phyint_ipsq;
182 					mutex_enter(&ipsq->ipsq_lock);
183 					mutex_exit(&ill->ill_lock);
184 					rw_exit(&ipst->ips_ill_g_lock);
185 					ipsq_enq(ipsq, q, mp, func, NEW_OP,
186 					    ill);
187 					mutex_exit(&ipsq->ipsq_lock);
188 					RELEASE_CONN_LOCK(q);
189 					*error = EINPROGRESS;
190 					return (NULL);
191 				}
192 			}
193 		}
194 		mutex_exit(&ill->ill_lock);
195 		RELEASE_CONN_LOCK(q);
196 	}
197 	rw_exit(&ipst->ips_ill_g_lock);
198 	/* lookup the ipif based on interface address */
199 	ipif = ipif_lookup_addr_v6(if_addr, NULL, ALL_ZONES, q, mp, func,
200 	    error, ipst);
201 	ASSERT(ipif == NULL || ipif->ipif_isv6);
202 	return (ipif);
203 }
204 
205 /*
206  * Look for an ipif with the specified address. For point-point links
207  * we look for matches on either the destination address and the local
208  * address, but we ignore the check on the local address if IPIF_UNNUMBERED
209  * is set.
210  * Matches on a specific ill if match_ill is set.
211  */
212 /* ARGSUSED */
213 ipif_t *
214 ipif_lookup_addr_v6(const in6_addr_t *addr, ill_t *match_ill, zoneid_t zoneid,
215     queue_t *q, mblk_t *mp, ipsq_func_t func, int *error, ip_stack_t *ipst)
216 {
217 	ipif_t	*ipif;
218 	ill_t	*ill;
219 	boolean_t  ptp = B_FALSE;
220 	ipsq_t	*ipsq;
221 	ill_walk_context_t ctx;
222 
223 	if (error != NULL)
224 		*error = 0;
225 
226 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
227 	/*
228 	 * Repeat twice, first based on local addresses and
229 	 * next time for pointopoint.
230 	 */
231 repeat:
232 	ill = ILL_START_WALK_V6(&ctx, ipst);
233 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
234 		if (match_ill != NULL && ill != match_ill) {
235 			continue;
236 		}
237 		GRAB_CONN_LOCK(q);
238 		mutex_enter(&ill->ill_lock);
239 		for (ipif = ill->ill_ipif; ipif != NULL;
240 		    ipif = ipif->ipif_next) {
241 			if (zoneid != ALL_ZONES &&
242 			    ipif->ipif_zoneid != zoneid &&
243 			    ipif->ipif_zoneid != ALL_ZONES)
244 				continue;
245 			/* Allow the ipif to be down */
246 			if ((!ptp && (IN6_ARE_ADDR_EQUAL(
247 			    &ipif->ipif_v6lcl_addr, addr) &&
248 			    (ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) ||
249 			    (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) &&
250 			    IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr,
251 			    addr))) {
252 				if (IPIF_CAN_LOOKUP(ipif)) {
253 					ipif_refhold_locked(ipif);
254 					mutex_exit(&ill->ill_lock);
255 					RELEASE_CONN_LOCK(q);
256 					rw_exit(&ipst->ips_ill_g_lock);
257 					return (ipif);
258 				} else if (IPIF_CAN_WAIT(ipif, q)) {
259 					ipsq = ill->ill_phyint->phyint_ipsq;
260 					mutex_enter(&ipsq->ipsq_lock);
261 					mutex_exit(&ill->ill_lock);
262 					rw_exit(&ipst->ips_ill_g_lock);
263 					ipsq_enq(ipsq, q, mp, func, NEW_OP,
264 					    ill);
265 					mutex_exit(&ipsq->ipsq_lock);
266 					RELEASE_CONN_LOCK(q);
267 					*error = EINPROGRESS;
268 					return (NULL);
269 				}
270 			}
271 		}
272 		mutex_exit(&ill->ill_lock);
273 		RELEASE_CONN_LOCK(q);
274 	}
275 
276 	/* If we already did the ptp case, then we are done */
277 	if (ptp) {
278 		rw_exit(&ipst->ips_ill_g_lock);
279 		if (error != NULL)
280 			*error = ENXIO;
281 		return (NULL);
282 	}
283 	ptp = B_TRUE;
284 	goto repeat;
285 }
286 
287 /*
288  * Look for an ipif with the specified address. For point-point links
289  * we look for matches on either the destination address and the local
290  * address, but we ignore the check on the local address if IPIF_UNNUMBERED
291  * is set.
292  * Matches on a specific ill if match_ill is set.
293  * Return the zoneid for the ipif. ALL_ZONES if none found.
294  */
295 zoneid_t
296 ipif_lookup_addr_zoneid_v6(const in6_addr_t *addr, ill_t *match_ill,
297     ip_stack_t *ipst)
298 {
299 	ipif_t	*ipif;
300 	ill_t	*ill;
301 	boolean_t  ptp = B_FALSE;
302 	ill_walk_context_t ctx;
303 	zoneid_t	zoneid;
304 
305 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
306 	/*
307 	 * Repeat twice, first based on local addresses and
308 	 * next time for pointopoint.
309 	 */
310 repeat:
311 	ill = ILL_START_WALK_V6(&ctx, ipst);
312 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
313 		if (match_ill != NULL && ill != match_ill) {
314 			continue;
315 		}
316 		mutex_enter(&ill->ill_lock);
317 		for (ipif = ill->ill_ipif; ipif != NULL;
318 		    ipif = ipif->ipif_next) {
319 			/* Allow the ipif to be down */
320 			if ((!ptp && (IN6_ARE_ADDR_EQUAL(
321 			    &ipif->ipif_v6lcl_addr, addr) &&
322 			    (ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) ||
323 			    (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) &&
324 			    IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr,
325 			    addr)) &&
326 			    !(ipif->ipif_state_flags & IPIF_CONDEMNED)) {
327 				zoneid = ipif->ipif_zoneid;
328 				mutex_exit(&ill->ill_lock);
329 				rw_exit(&ipst->ips_ill_g_lock);
330 				/*
331 				 * If ipif_zoneid was ALL_ZONES then we have
332 				 * a trusted extensions shared IP address.
333 				 * In that case GLOBAL_ZONEID works to send.
334 				 */
335 				if (zoneid == ALL_ZONES)
336 					zoneid = GLOBAL_ZONEID;
337 				return (zoneid);
338 			}
339 		}
340 		mutex_exit(&ill->ill_lock);
341 	}
342 
343 	/* If we already did the ptp case, then we are done */
344 	if (ptp) {
345 		rw_exit(&ipst->ips_ill_g_lock);
346 		return (ALL_ZONES);
347 	}
348 	ptp = B_TRUE;
349 	goto repeat;
350 }
351 
352 /*
353  * Perform various checks to verify that an address would make sense as a local
354  * interface address.  This is currently only called when an attempt is made
355  * to set a local address.
356  *
357  * Does not allow a v4-mapped address, an address that equals the subnet
358  * anycast address, ... a multicast address, ...
359  */
360 boolean_t
361 ip_local_addr_ok_v6(const in6_addr_t *addr, const in6_addr_t *subnet_mask)
362 {
363 	in6_addr_t subnet;
364 
365 	if (IN6_IS_ADDR_UNSPECIFIED(addr))
366 		return (B_TRUE);	/* Allow all zeros */
367 
368 	/*
369 	 * Don't allow all zeroes or host part, but allow
370 	 * all ones netmask.
371 	 */
372 	V6_MASK_COPY(*addr, *subnet_mask, subnet);
373 	if (IN6_IS_ADDR_V4MAPPED(addr) ||
374 	    (IN6_ARE_ADDR_EQUAL(addr, &subnet) &&
375 	    !IN6_ARE_ADDR_EQUAL(subnet_mask, &ipv6_all_ones)) ||
376 	    (IN6_IS_ADDR_V4COMPAT(addr) && CLASSD(V4_PART_OF_V6((*addr)))) ||
377 	    IN6_IS_ADDR_MULTICAST(addr))
378 		return (B_FALSE);
379 
380 	return (B_TRUE);
381 }
382 
383 /*
384  * Perform various checks to verify that an address would make sense as a
385  * remote/subnet interface address.
386  */
387 boolean_t
388 ip_remote_addr_ok_v6(const in6_addr_t *addr, const in6_addr_t *subnet_mask)
389 {
390 	in6_addr_t subnet;
391 
392 	if (IN6_IS_ADDR_UNSPECIFIED(addr))
393 		return (B_TRUE);	/* Allow all zeros */
394 
395 	V6_MASK_COPY(*addr, *subnet_mask, subnet);
396 	if (IN6_IS_ADDR_V4MAPPED(addr) ||
397 	    (IN6_ARE_ADDR_EQUAL(addr, &subnet) &&
398 	    !IN6_ARE_ADDR_EQUAL(subnet_mask, &ipv6_all_ones)) ||
399 	    IN6_IS_ADDR_MULTICAST(addr) ||
400 	    (IN6_IS_ADDR_V4COMPAT(addr) && CLASSD(V4_PART_OF_V6((*addr)))))
401 		return (B_FALSE);
402 
403 	return (B_TRUE);
404 }
405 
406 /*
407  * ip_rt_add_v6 is called to add an IPv6 route to the forwarding table.
408  * ipif_arg is passed in to associate it with the correct interface
409  * (for link-local destinations and gateways).
410  */
411 /* ARGSUSED1 */
412 int
413 ip_rt_add_v6(const in6_addr_t *dst_addr, const in6_addr_t *mask,
414     const in6_addr_t *gw_addr, const in6_addr_t *src_addr, int flags,
415     ipif_t *ipif_arg, ire_t **ire_arg, queue_t *q, mblk_t *mp, ipsq_func_t func,
416     struct rtsa_s *sp, ip_stack_t *ipst)
417 {
418 	ire_t	*ire;
419 	ire_t	*gw_ire = NULL;
420 	ipif_t	*ipif;
421 	boolean_t ipif_refheld = B_FALSE;
422 	uint_t	type;
423 	int	match_flags = MATCH_IRE_TYPE;
424 	int	error;
425 	tsol_gc_t *gc = NULL;
426 	tsol_gcgrp_t *gcgrp = NULL;
427 	boolean_t gcgrp_xtraref = B_FALSE;
428 
429 	if (ire_arg != NULL)
430 		*ire_arg = NULL;
431 
432 	/*
433 	 * Prevent routes with a zero gateway from being created (since
434 	 * interfaces can currently be plumbed and brought up with no assigned
435 	 * address).
436 	 */
437 	if (IN6_IS_ADDR_UNSPECIFIED(gw_addr))
438 		return (ENETUNREACH);
439 
440 	/*
441 	 * If this is the case of RTF_HOST being set, then we set the netmask
442 	 * to all ones (regardless if one was supplied).
443 	 */
444 	if (flags & RTF_HOST)
445 		mask = &ipv6_all_ones;
446 
447 	/*
448 	 * Get the ipif, if any, corresponding to the gw_addr
449 	 */
450 	ipif = ipif_lookup_interface_v6(gw_addr, dst_addr, q, mp, func,
451 	    &error, ipst);
452 	if (ipif != NULL)
453 		ipif_refheld = B_TRUE;
454 	else if (error == EINPROGRESS) {
455 		ip1dbg(("ip_rt_add_v6: null and EINPROGRESS"));
456 		return (error);
457 	}
458 
459 	/*
460 	 * GateD will attempt to create routes with a loopback interface
461 	 * address as the gateway and with RTF_GATEWAY set.  We allow
462 	 * these routes to be added, but create them as interface routes
463 	 * since the gateway is an interface address.
464 	 */
465 	if ((ipif != NULL) && (ipif->ipif_ire_type == IRE_LOOPBACK)) {
466 		flags &= ~RTF_GATEWAY;
467 		if (IN6_ARE_ADDR_EQUAL(gw_addr, &ipv6_loopback) &&
468 		    IN6_ARE_ADDR_EQUAL(dst_addr, &ipv6_loopback) &&
469 		    IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones)) {
470 			ire = ire_ctable_lookup_v6(dst_addr, 0, IRE_LOOPBACK,
471 			    ipif, ALL_ZONES, NULL, match_flags, ipst);
472 			if (ire != NULL) {
473 				ire_refrele(ire);
474 				if (ipif_refheld)
475 					ipif_refrele(ipif);
476 				return (EEXIST);
477 			}
478 			ip1dbg(("ipif_up_done: 0x%p creating IRE 0x%x"
479 			    "for 0x%x\n", (void *)ipif,
480 			    ipif->ipif_ire_type,
481 			    ntohl(ipif->ipif_lcl_addr)));
482 			ire = ire_create_v6(
483 			    dst_addr,
484 			    mask,
485 			    &ipif->ipif_v6src_addr,
486 			    NULL,
487 			    &ipif->ipif_mtu,
488 			    NULL,
489 			    NULL,
490 			    NULL,
491 			    ipif->ipif_net_type,
492 			    ipif->ipif_resolver_mp,
493 			    ipif,
494 			    NULL,
495 			    0,
496 			    0,
497 			    flags,
498 			    &ire_uinfo_null,
499 			    NULL,
500 			    NULL,
501 			    ipst);
502 			if (ire == NULL) {
503 				if (ipif_refheld)
504 					ipif_refrele(ipif);
505 				return (ENOMEM);
506 			}
507 			error = ire_add(&ire, q, mp, func, B_FALSE);
508 			if (error == 0)
509 				goto save_ire;
510 			/*
511 			 * In the result of failure, ire_add() will have already
512 			 * deleted the ire in question, so there is no need to
513 			 * do that here.
514 			 */
515 			if (ipif_refheld)
516 				ipif_refrele(ipif);
517 			return (error);
518 		}
519 	}
520 
521 	/*
522 	 * Traditionally, interface routes are ones where RTF_GATEWAY isn't set
523 	 * and the gateway address provided is one of the system's interface
524 	 * addresses.  By using the routing socket interface and supplying an
525 	 * RTA_IFP sockaddr with an interface index, an alternate method of
526 	 * specifying an interface route to be created is available which uses
527 	 * the interface index that specifies the outgoing interface rather than
528 	 * the address of an outgoing interface (which may not be able to
529 	 * uniquely identify an interface).  When coupled with the RTF_GATEWAY
530 	 * flag, routes can be specified which not only specify the next-hop to
531 	 * be used when routing to a certain prefix, but also which outgoing
532 	 * interface should be used.
533 	 *
534 	 * Previously, interfaces would have unique addresses assigned to them
535 	 * and so the address assigned to a particular interface could be used
536 	 * to identify a particular interface.  One exception to this was the
537 	 * case of an unnumbered interface (where IPIF_UNNUMBERED was set).
538 	 *
539 	 * With the advent of IPv6 and its link-local addresses, this
540 	 * restriction was relaxed and interfaces could share addresses between
541 	 * themselves.  In fact, typically all of the link-local interfaces on
542 	 * an IPv6 node or router will have the same link-local address.  In
543 	 * order to differentiate between these interfaces, the use of an
544 	 * interface index is necessary and this index can be carried inside a
545 	 * RTA_IFP sockaddr (which is actually a sockaddr_dl).  One restriction
546 	 * of using the interface index, however, is that all of the ipif's that
547 	 * are part of an ill have the same index and so the RTA_IFP sockaddr
548 	 * cannot be used to differentiate between ipif's (or logical
549 	 * interfaces) that belong to the same ill (physical interface).
550 	 *
551 	 * For example, in the following case involving IPv4 interfaces and
552 	 * logical interfaces
553 	 *
554 	 *	192.0.2.32	255.255.255.224	192.0.2.33	U	if0
555 	 *	192.0.2.32	255.255.255.224	192.0.2.34	U	if0:1
556 	 *	192.0.2.32	255.255.255.224	192.0.2.35	U	if0:2
557 	 *
558 	 * the ipif's corresponding to each of these interface routes can be
559 	 * uniquely identified by the "gateway" (actually interface address).
560 	 *
561 	 * In this case involving multiple IPv6 default routes to a particular
562 	 * link-local gateway, the use of RTA_IFP is necessary to specify which
563 	 * default route is of interest:
564 	 *
565 	 *	default		fe80::123:4567:89ab:cdef	U	if0
566 	 *	default		fe80::123:4567:89ab:cdef	U	if1
567 	 */
568 
569 	/* RTF_GATEWAY not set */
570 	if (!(flags & RTF_GATEWAY)) {
571 		queue_t	*stq;
572 
573 		if (sp != NULL) {
574 			ip2dbg(("ip_rt_add_v6: gateway security attributes "
575 			    "cannot be set with interface route\n"));
576 			if (ipif_refheld)
577 				ipif_refrele(ipif);
578 			return (EINVAL);
579 		}
580 
581 		/*
582 		 * As the interface index specified with the RTA_IFP sockaddr is
583 		 * the same for all ipif's off of an ill, the matching logic
584 		 * below uses MATCH_IRE_ILL if such an index was specified.
585 		 * This means that routes sharing the same prefix when added
586 		 * using a RTA_IFP sockaddr must have distinct interface
587 		 * indices (namely, they must be on distinct ill's).
588 		 *
589 		 * On the other hand, since the gateway address will usually be
590 		 * different for each ipif on the system, the matching logic
591 		 * uses MATCH_IRE_IPIF in the case of a traditional interface
592 		 * route.  This means that interface routes for the same prefix
593 		 * can be created if they belong to distinct ipif's and if a
594 		 * RTA_IFP sockaddr is not present.
595 		 */
596 		if (ipif_arg != NULL) {
597 			if (ipif_refheld) {
598 				ipif_refrele(ipif);
599 				ipif_refheld = B_FALSE;
600 			}
601 			ipif = ipif_arg;
602 			match_flags |= MATCH_IRE_ILL;
603 		} else {
604 			/*
605 			 * Check the ipif corresponding to the gw_addr
606 			 */
607 			if (ipif == NULL)
608 				return (ENETUNREACH);
609 			match_flags |= MATCH_IRE_IPIF;
610 		}
611 
612 		ASSERT(ipif != NULL);
613 		/*
614 		 * We check for an existing entry at this point.
615 		 */
616 		match_flags |= MATCH_IRE_MASK;
617 		ire = ire_ftable_lookup_v6(dst_addr, mask, 0, IRE_INTERFACE,
618 		    ipif, NULL, ALL_ZONES, 0, NULL, match_flags, ipst);
619 		if (ire != NULL) {
620 			ire_refrele(ire);
621 			if (ipif_refheld)
622 				ipif_refrele(ipif);
623 			return (EEXIST);
624 		}
625 
626 		stq = (ipif->ipif_net_type == IRE_IF_RESOLVER)
627 		    ? ipif->ipif_rq : ipif->ipif_wq;
628 
629 		/*
630 		 * Create a copy of the IRE_LOOPBACK, IRE_IF_NORESOLVER or
631 		 * IRE_IF_RESOLVER with the modified address and netmask.
632 		 */
633 		ire = ire_create_v6(
634 		    dst_addr,
635 		    mask,
636 		    &ipif->ipif_v6src_addr,
637 		    NULL,
638 		    &ipif->ipif_mtu,
639 		    NULL,
640 		    NULL,
641 		    stq,
642 		    ipif->ipif_net_type,
643 		    ipif->ipif_resolver_mp,
644 		    ipif,
645 		    NULL,
646 		    0,
647 		    0,
648 		    flags,
649 		    &ire_uinfo_null,
650 		    NULL,
651 		    NULL,
652 		    ipst);
653 		if (ire == NULL) {
654 			if (ipif_refheld)
655 				ipif_refrele(ipif);
656 			return (ENOMEM);
657 		}
658 
659 		/*
660 		 * Some software (for example, GateD and Sun Cluster) attempts
661 		 * to create (what amount to) IRE_PREFIX routes with the
662 		 * loopback address as the gateway.  This is primarily done to
663 		 * set up prefixes with the RTF_REJECT flag set (for example,
664 		 * when generating aggregate routes.)
665 		 *
666 		 * If the IRE type (as defined by ipif->ipif_net_type) is
667 		 * IRE_LOOPBACK, then we map the request into a
668 		 * IRE_IF_NORESOLVER.
669 		 *
670 		 * Needless to say, the real IRE_LOOPBACK is NOT created by this
671 		 * routine, but rather using ire_create_v6() directly.
672 		 */
673 		if (ipif->ipif_net_type == IRE_LOOPBACK)
674 			ire->ire_type = IRE_IF_NORESOLVER;
675 		error = ire_add(&ire, q, mp, func, B_FALSE);
676 		if (error == 0)
677 			goto save_ire;
678 		/*
679 		 * In the result of failure, ire_add() will have already
680 		 * deleted the ire in question, so there is no need to
681 		 * do that here.
682 		 */
683 		if (ipif_refheld)
684 			ipif_refrele(ipif);
685 		return (error);
686 	}
687 	if (ipif_refheld) {
688 		ipif_refrele(ipif);
689 		ipif_refheld = B_FALSE;
690 	}
691 
692 	/*
693 	 * Get an interface IRE for the specified gateway.
694 	 * If we don't have an IRE_IF_NORESOLVER or IRE_IF_RESOLVER for the
695 	 * gateway, it is currently unreachable and we fail the request
696 	 * accordingly.
697 	 */
698 	ipif = ipif_arg;
699 	if (ipif_arg != NULL)
700 		match_flags |= MATCH_IRE_ILL;
701 	gw_ire = ire_ftable_lookup_v6(gw_addr, 0, 0, IRE_INTERFACE, ipif_arg,
702 	    NULL, ALL_ZONES, 0, NULL, match_flags, ipst);
703 	if (gw_ire == NULL)
704 		return (ENETUNREACH);
705 
706 	/*
707 	 * We create one of three types of IREs as a result of this request
708 	 * based on the netmask.  A netmask of all ones (which is automatically
709 	 * assumed when RTF_HOST is set) results in an IRE_HOST being created.
710 	 * An all zeroes netmask implies a default route so an IRE_DEFAULT is
711 	 * created.  Otherwise, an IRE_PREFIX route is created for the
712 	 * destination prefix.
713 	 */
714 	if (IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones))
715 		type = IRE_HOST;
716 	else if (IN6_IS_ADDR_UNSPECIFIED(mask))
717 		type = IRE_DEFAULT;
718 	else
719 		type = IRE_PREFIX;
720 
721 	/* check for a duplicate entry */
722 	ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr, type, ipif_arg,
723 	    NULL, ALL_ZONES, 0, NULL,
724 	    match_flags | MATCH_IRE_MASK | MATCH_IRE_GW, ipst);
725 	if (ire != NULL) {
726 		ire_refrele(gw_ire);
727 		ire_refrele(ire);
728 		return (EEXIST);
729 	}
730 
731 	/* Security attribute exists */
732 	if (sp != NULL) {
733 		tsol_gcgrp_addr_t ga;
734 
735 		/* find or create the gateway credentials group */
736 		ga.ga_af = AF_INET6;
737 		ga.ga_addr = *gw_addr;
738 
739 		/* we hold reference to it upon success */
740 		gcgrp = gcgrp_lookup(&ga, B_TRUE);
741 		if (gcgrp == NULL) {
742 			ire_refrele(gw_ire);
743 			return (ENOMEM);
744 		}
745 
746 		/*
747 		 * Create and add the security attribute to the group; a
748 		 * reference to the group is made upon allocating a new
749 		 * entry successfully.  If it finds an already-existing
750 		 * entry for the security attribute in the group, it simply
751 		 * returns it and no new reference is made to the group.
752 		 */
753 		gc = gc_create(sp, gcgrp, &gcgrp_xtraref);
754 		if (gc == NULL) {
755 			/* release reference held by gcgrp_lookup */
756 			GCGRP_REFRELE(gcgrp);
757 			ire_refrele(gw_ire);
758 			return (ENOMEM);
759 		}
760 	}
761 
762 	/* Create the IRE. */
763 	ire = ire_create_v6(
764 	    dst_addr,				/* dest address */
765 	    mask,				/* mask */
766 	    /* src address assigned by the caller? */
767 	    (((flags & RTF_SETSRC) && !IN6_IS_ADDR_UNSPECIFIED(src_addr)) ?
768 	    src_addr : NULL),
769 	    gw_addr,				/* gateway address */
770 	    &gw_ire->ire_max_frag,
771 	    NULL,				/* no Fast Path header */
772 	    NULL,				/* no recv-from queue */
773 	    NULL,				/* no send-to queue */
774 	    (ushort_t)type,			/* IRE type */
775 	    NULL,
776 	    ipif_arg,
777 	    NULL,
778 	    0,
779 	    0,
780 	    flags,
781 	    &gw_ire->ire_uinfo,			/* Inherit ULP info from gw */
782 	    gc,					/* security attribute */
783 	    NULL,
784 	    ipst);
785 
786 	/*
787 	 * The ire holds a reference to the 'gc' and the 'gc' holds a
788 	 * reference to the 'gcgrp'. We can now release the extra reference
789 	 * the 'gcgrp' acquired in the gcgrp_lookup, if it was not used.
790 	 */
791 	if (gcgrp_xtraref)
792 		GCGRP_REFRELE(gcgrp);
793 	if (ire == NULL) {
794 		if (gc != NULL)
795 			GC_REFRELE(gc);
796 		ire_refrele(gw_ire);
797 		return (ENOMEM);
798 	}
799 
800 	/*
801 	 * POLICY: should we allow an RTF_HOST with address INADDR_ANY?
802 	 * SUN/OS socket stuff does but do we really want to allow ::0 ?
803 	 */
804 
805 	/* Add the new IRE. */
806 	error = ire_add(&ire, q, mp, func, B_FALSE);
807 	/*
808 	 * In the result of failure, ire_add() will have already
809 	 * deleted the ire in question, so there is no need to
810 	 * do that here.
811 	 */
812 	if (error != 0) {
813 		ire_refrele(gw_ire);
814 		return (error);
815 	}
816 
817 	if (flags & RTF_MULTIRT) {
818 		/*
819 		 * Invoke the CGTP (multirouting) filtering module
820 		 * to add the dst address in the filtering database.
821 		 * Replicated inbound packets coming from that address
822 		 * will be filtered to discard the duplicates.
823 		 * It is not necessary to call the CGTP filter hook
824 		 * when the dst address is a multicast, because an
825 		 * IP source address cannot be a multicast.
826 		 */
827 		if ((ip_cgtp_filter_ops != NULL) &&
828 		    ipst->ips_netstack->netstack_stackid == GLOBAL_NETSTACKID &&
829 		    !IN6_IS_ADDR_MULTICAST(&(ire->ire_addr_v6))) {
830 			int res = ip_cgtp_filter_ops->cfo_add_dest_v6(
831 			    &ire->ire_addr_v6,
832 			    &ire->ire_gateway_addr_v6,
833 			    &ire->ire_src_addr_v6,
834 			    &gw_ire->ire_src_addr_v6);
835 			if (res != 0) {
836 				ire_refrele(gw_ire);
837 				ire_delete(ire);
838 				return (res);
839 			}
840 		}
841 	}
842 
843 	/*
844 	 * Now that the prefix IRE entry has been created, delete any
845 	 * existing gateway IRE cache entries as well as any IRE caches
846 	 * using the gateway, and force them to be created through
847 	 * ip_newroute_v6.
848 	 */
849 	if (gc != NULL) {
850 		ASSERT(gcgrp != NULL);
851 		ire_clookup_delete_cache_gw_v6(gw_addr, ALL_ZONES, ipst);
852 	}
853 
854 save_ire:
855 	if (gw_ire != NULL) {
856 		ire_refrele(gw_ire);
857 	}
858 	if (ipif != NULL) {
859 		mblk_t	*save_mp;
860 
861 		/*
862 		 * Save enough information so that we can recreate the IRE if
863 		 * the interface goes down and then up.  The metrics associated
864 		 * with the route will be saved as well when rts_setmetrics() is
865 		 * called after the IRE has been created.  In the case where
866 		 * memory cannot be allocated, none of this information will be
867 		 * saved.
868 		 */
869 		save_mp = allocb(sizeof (ifrt_t), BPRI_MED);
870 		if (save_mp != NULL) {
871 			ifrt_t	*ifrt;
872 
873 			save_mp->b_wptr += sizeof (ifrt_t);
874 			ifrt = (ifrt_t *)save_mp->b_rptr;
875 			bzero(ifrt, sizeof (ifrt_t));
876 			ifrt->ifrt_type = ire->ire_type;
877 			ifrt->ifrt_v6addr = ire->ire_addr_v6;
878 			mutex_enter(&ire->ire_lock);
879 			ifrt->ifrt_v6gateway_addr = ire->ire_gateway_addr_v6;
880 			ifrt->ifrt_v6src_addr = ire->ire_src_addr_v6;
881 			mutex_exit(&ire->ire_lock);
882 			ifrt->ifrt_v6mask = ire->ire_mask_v6;
883 			ifrt->ifrt_flags = ire->ire_flags;
884 			ifrt->ifrt_max_frag = ire->ire_max_frag;
885 			mutex_enter(&ipif->ipif_saved_ire_lock);
886 			save_mp->b_cont = ipif->ipif_saved_ire_mp;
887 			ipif->ipif_saved_ire_mp = save_mp;
888 			ipif->ipif_saved_ire_cnt++;
889 			mutex_exit(&ipif->ipif_saved_ire_lock);
890 		}
891 	}
892 	if (ire_arg != NULL) {
893 		/*
894 		 * Store the ire that was successfully added into where ire_arg
895 		 * points to so that callers don't have to look it up
896 		 * themselves (but they are responsible for ire_refrele()ing
897 		 * the ire when they are finished with it).
898 		 */
899 		*ire_arg = ire;
900 	} else {
901 		ire_refrele(ire);		/* Held in ire_add */
902 	}
903 	if (ipif_refheld)
904 		ipif_refrele(ipif);
905 	return (0);
906 }
907 
908 /*
909  * ip_rt_delete_v6 is called to delete an IPv6 route.
910  * ipif_arg is passed in to associate it with the correct interface
911  * (for link-local destinations and gateways).
912  */
913 /* ARGSUSED4 */
914 int
915 ip_rt_delete_v6(const in6_addr_t *dst_addr, const in6_addr_t *mask,
916     const in6_addr_t *gw_addr, uint_t rtm_addrs, int flags, ipif_t *ipif_arg,
917     queue_t *q, mblk_t *mp, ipsq_func_t func, ip_stack_t *ipst)
918 {
919 	ire_t	*ire = NULL;
920 	ipif_t	*ipif;
921 	uint_t	type;
922 	uint_t	match_flags = MATCH_IRE_TYPE;
923 	int	err = 0;
924 	boolean_t	ipif_refheld = B_FALSE;
925 
926 	/*
927 	 * If this is the case of RTF_HOST being set, then we set the netmask
928 	 * to all ones.  Otherwise, we use the netmask if one was supplied.
929 	 */
930 	if (flags & RTF_HOST) {
931 		mask = &ipv6_all_ones;
932 		match_flags |= MATCH_IRE_MASK;
933 	} else if (rtm_addrs & RTA_NETMASK) {
934 		match_flags |= MATCH_IRE_MASK;
935 	}
936 
937 	/*
938 	 * Note that RTF_GATEWAY is never set on a delete, therefore
939 	 * we check if the gateway address is one of our interfaces first,
940 	 * and fall back on RTF_GATEWAY routes.
941 	 *
942 	 * This makes it possible to delete an original
943 	 * IRE_IF_NORESOLVER/IRE_IF_RESOLVER - consistent with SunOS 4.1.
944 	 *
945 	 * As the interface index specified with the RTA_IFP sockaddr is the
946 	 * same for all ipif's off of an ill, the matching logic below uses
947 	 * MATCH_IRE_ILL if such an index was specified.  This means a route
948 	 * sharing the same prefix and interface index as the the route
949 	 * intended to be deleted might be deleted instead if a RTA_IFP sockaddr
950 	 * is specified in the request.
951 	 *
952 	 * On the other hand, since the gateway address will usually be
953 	 * different for each ipif on the system, the matching logic
954 	 * uses MATCH_IRE_IPIF in the case of a traditional interface
955 	 * route.  This means that interface routes for the same prefix can be
956 	 * uniquely identified if they belong to distinct ipif's and if a
957 	 * RTA_IFP sockaddr is not present.
958 	 *
959 	 * For more detail on specifying routes by gateway address and by
960 	 * interface index, see the comments in ip_rt_add_v6().
961 	 */
962 	ipif = ipif_lookup_interface_v6(gw_addr, dst_addr, q, mp, func, &err,
963 	    ipst);
964 	if (ipif != NULL) {
965 		ipif_refheld = B_TRUE;
966 		if (ipif_arg != NULL) {
967 			ipif_refrele(ipif);
968 			ipif_refheld = B_FALSE;
969 			ipif = ipif_arg;
970 			match_flags |= MATCH_IRE_ILL;
971 		} else {
972 			match_flags |= MATCH_IRE_IPIF;
973 		}
974 
975 		if (ipif->ipif_ire_type == IRE_LOOPBACK)
976 			ire = ire_ctable_lookup_v6(dst_addr, 0, IRE_LOOPBACK,
977 			    ipif, ALL_ZONES, NULL, match_flags, ipst);
978 		if (ire == NULL)
979 			ire = ire_ftable_lookup_v6(dst_addr, mask, 0,
980 			    IRE_INTERFACE, ipif, NULL, ALL_ZONES, 0, NULL,
981 			    match_flags, ipst);
982 	} else if (err == EINPROGRESS) {
983 		return (err);
984 	} else {
985 		err = 0;
986 	}
987 	if (ire == NULL) {
988 		/*
989 		 * At this point, the gateway address is not one of our own
990 		 * addresses or a matching interface route was not found.  We
991 		 * set the IRE type to lookup based on whether
992 		 * this is a host route, a default route or just a prefix.
993 		 *
994 		 * If an ipif_arg was passed in, then the lookup is based on an
995 		 * interface index so MATCH_IRE_ILL is added to match_flags.
996 		 * In any case, MATCH_IRE_IPIF is cleared and MATCH_IRE_GW is
997 		 * set as the route being looked up is not a traditional
998 		 * interface route.
999 		 */
1000 		match_flags &= ~MATCH_IRE_IPIF;
1001 		match_flags |= MATCH_IRE_GW;
1002 		if (ipif_arg != NULL)
1003 			match_flags |= MATCH_IRE_ILL;
1004 		if (IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones))
1005 			type = IRE_HOST;
1006 		else if (IN6_IS_ADDR_UNSPECIFIED(mask))
1007 			type = IRE_DEFAULT;
1008 		else
1009 			type = IRE_PREFIX;
1010 		ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr, type,
1011 		    ipif_arg, NULL, ALL_ZONES, 0, NULL, match_flags, ipst);
1012 	}
1013 
1014 	if (ipif_refheld) {
1015 		ipif_refrele(ipif);
1016 		ipif_refheld = B_FALSE;
1017 	}
1018 	if (ire == NULL)
1019 		return (ESRCH);
1020 
1021 	if (ire->ire_flags & RTF_MULTIRT) {
1022 		/*
1023 		 * Invoke the CGTP (multirouting) filtering module
1024 		 * to remove the dst address from the filtering database.
1025 		 * Packets coming from that address will no longer be
1026 		 * filtered to remove duplicates.
1027 		 */
1028 		if (ip_cgtp_filter_ops != NULL &&
1029 		    ipst->ips_netstack->netstack_stackid == GLOBAL_NETSTACKID) {
1030 			err = ip_cgtp_filter_ops->cfo_del_dest_v6(
1031 			    &ire->ire_addr_v6, &ire->ire_gateway_addr_v6);
1032 		}
1033 	}
1034 
1035 	ipif = ire->ire_ipif;
1036 	if (ipif != NULL) {
1037 		mblk_t		**mpp;
1038 		mblk_t		*mp;
1039 		ifrt_t		*ifrt;
1040 		in6_addr_t	gw_addr_v6;
1041 
1042 		/* Remove from ipif_saved_ire_mp list if it is there */
1043 		mutex_enter(&ire->ire_lock);
1044 		gw_addr_v6 = ire->ire_gateway_addr_v6;
1045 		mutex_exit(&ire->ire_lock);
1046 		mutex_enter(&ipif->ipif_saved_ire_lock);
1047 		for (mpp = &ipif->ipif_saved_ire_mp; *mpp != NULL;
1048 		    mpp = &(*mpp)->b_cont) {
1049 			/*
1050 			 * On a given ipif, the triple of address, gateway and
1051 			 * mask is unique for each saved IRE (in the case of
1052 			 * ordinary interface routes, the gateway address is
1053 			 * all-zeroes).
1054 			 */
1055 			mp = *mpp;
1056 			ifrt = (ifrt_t *)mp->b_rptr;
1057 			if (IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6addr,
1058 			    &ire->ire_addr_v6) &&
1059 			    IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6gateway_addr,
1060 			    &gw_addr_v6) &&
1061 			    IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6mask,
1062 			    &ire->ire_mask_v6)) {
1063 				*mpp = mp->b_cont;
1064 				ipif->ipif_saved_ire_cnt--;
1065 				freeb(mp);
1066 				break;
1067 			}
1068 		}
1069 		mutex_exit(&ipif->ipif_saved_ire_lock);
1070 	}
1071 	ire_delete(ire);
1072 	ire_refrele(ire);
1073 	return (err);
1074 }
1075 
1076 /*
1077  * Derive a token from the link layer address.
1078  */
1079 boolean_t
1080 ill_setdefaulttoken(ill_t *ill)
1081 {
1082 	int 		i;
1083 	in6_addr_t	v6addr, v6mask;
1084 
1085 	if (!MEDIA_V6INTFID(ill->ill_media, ill->ill_phys_addr_length,
1086 	    ill->ill_phys_addr, &v6addr))
1087 		return (B_FALSE);
1088 
1089 	(void) ip_plen_to_mask_v6(IPV6_TOKEN_LEN, &v6mask);
1090 
1091 	for (i = 0; i < 4; i++)
1092 		v6mask.s6_addr32[i] = v6mask.s6_addr32[i] ^
1093 		    (uint32_t)0xffffffff;
1094 
1095 	V6_MASK_COPY(v6addr, v6mask, ill->ill_token);
1096 	ill->ill_token_length = IPV6_TOKEN_LEN;
1097 	return (B_TRUE);
1098 }
1099 
1100 /*
1101  * Create a link-local address from a token.
1102  */
1103 static void
1104 ipif_get_linklocal(in6_addr_t *dest, const in6_addr_t *token)
1105 {
1106 	int i;
1107 
1108 	for (i = 0; i < 4; i++) {
1109 		dest->s6_addr32[i] =
1110 		    token->s6_addr32[i] | ipv6_ll_template.s6_addr32[i];
1111 	}
1112 }
1113 
1114 /*
1115  * Set a nice default address for either automatic tunnels tsrc/96 or
1116  * 6to4 tunnels 2002:<tsrc>::1/64
1117  */
1118 static void
1119 ipif_set_tun_auto_addr(ipif_t *ipif, struct iftun_req *ta)
1120 {
1121 	sin6_t	sin6;
1122 	sin_t	*sin;
1123 	ill_t 	*ill = ipif->ipif_ill;
1124 	tun_t *tp = (tun_t *)ill->ill_wq->q_next->q_ptr;
1125 
1126 	if (ta->ifta_saddr.ss_family != AF_INET ||
1127 	    (ipif->ipif_flags & IPIF_UP) || !ipif->ipif_isv6 ||
1128 	    (ta->ifta_flags & IFTUN_SRC) == 0)
1129 		return;
1130 
1131 	/*
1132 	 * Check the tunnel type by examining q_next->q_ptr
1133 	 */
1134 	if (tp->tun_flags & TUN_AUTOMATIC) {
1135 		/* this is an automatic tunnel */
1136 		(void) ip_plen_to_mask_v6(IPV6_ABITS - IP_ABITS,
1137 		    &ipif->ipif_v6net_mask);
1138 		bzero(&sin6, sizeof (sin6_t));
1139 		sin = (sin_t *)&ta->ifta_saddr;
1140 		V4_PART_OF_V6(sin6.sin6_addr) = sin->sin_addr.s_addr;
1141 		sin6.sin6_family = AF_INET6;
1142 		(void) ip_sioctl_addr(ipif, (sin_t *)&sin6,
1143 		    NULL, NULL, NULL, NULL);
1144 	} else if (tp->tun_flags & TUN_6TO4) {
1145 		/* this is a 6to4 tunnel */
1146 		(void) ip_plen_to_mask_v6(IPV6_PREFIX_LEN,
1147 		    &ipif->ipif_v6net_mask);
1148 		sin = (sin_t *)&ta->ifta_saddr;
1149 		/* create a 6to4 address from the IPv4 tsrc */
1150 		IN6_V4ADDR_TO_6TO4(&sin->sin_addr, &sin6.sin6_addr);
1151 		sin6.sin6_family = AF_INET6;
1152 		(void) ip_sioctl_addr(ipif, (sin_t *)&sin6,
1153 		    NULL, NULL, NULL, NULL);
1154 	} else {
1155 		ip1dbg(("ipif_set_tun_auto_addr: Unknown tunnel type"));
1156 		return;
1157 	}
1158 }
1159 
1160 /*
1161  * Set link local for ipif_id 0 of a configured tunnel based on the
1162  * tsrc or tdst parameter
1163  * For tunnels over IPv4 use the IPv4 address prepended with 32 zeros as
1164  * the token.
1165  * For tunnels over IPv6 use the low-order 64 bits of the "inner" IPv6 address
1166  * as the token for the "outer" link.
1167  */
1168 void
1169 ipif_set_tun_llink(ill_t *ill, struct iftun_req *ta)
1170 {
1171 	ipif_t		*ipif;
1172 	sin_t		*sin;
1173 	in6_addr_t	*s6addr;
1174 
1175 	ASSERT(IAM_WRITER_ILL(ill));
1176 
1177 	/* The first ipif must be id zero. */
1178 	ipif = ill->ill_ipif;
1179 	ASSERT(ipif->ipif_id == 0);
1180 
1181 	/* no link local for automatic tunnels */
1182 	if (!(ipif->ipif_flags & IPIF_POINTOPOINT)) {
1183 		ipif_set_tun_auto_addr(ipif, ta);
1184 		return;
1185 	}
1186 
1187 	if ((ta->ifta_flags & IFTUN_DST) &&
1188 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6pp_dst_addr)) {
1189 		sin6_t	sin6;
1190 
1191 		ASSERT(!(ipif->ipif_flags & IPIF_UP));
1192 		bzero(&sin6, sizeof (sin6_t));
1193 		if ((ta->ifta_saddr.ss_family == AF_INET)) {
1194 			sin = (sin_t *)&ta->ifta_daddr;
1195 			V4_PART_OF_V6(sin6.sin6_addr) =
1196 			    sin->sin_addr.s_addr;
1197 		} else {
1198 			s6addr =
1199 			    &((sin6_t *)&ta->ifta_daddr)->sin6_addr;
1200 			sin6.sin6_addr.s6_addr32[3] = s6addr->s6_addr32[3];
1201 			sin6.sin6_addr.s6_addr32[2] = s6addr->s6_addr32[2];
1202 		}
1203 		ipif_get_linklocal(&ipif->ipif_v6pp_dst_addr,
1204 		    &sin6.sin6_addr);
1205 		ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr;
1206 	}
1207 	if ((ta->ifta_flags & IFTUN_SRC)) {
1208 		ASSERT(!(ipif->ipif_flags & IPIF_UP));
1209 
1210 		/* Set the token if it isn't already set */
1211 		if (IN6_IS_ADDR_UNSPECIFIED(&ill->ill_token)) {
1212 			if ((ta->ifta_saddr.ss_family == AF_INET)) {
1213 				sin = (sin_t *)&ta->ifta_saddr;
1214 				V4_PART_OF_V6(ill->ill_token) =
1215 				    sin->sin_addr.s_addr;
1216 			} else {
1217 				s6addr =
1218 				    &((sin6_t *)&ta->ifta_saddr)->sin6_addr;
1219 				ill->ill_token.s6_addr32[3] =
1220 				    s6addr->s6_addr32[3];
1221 				ill->ill_token.s6_addr32[2] =
1222 				    s6addr->s6_addr32[2];
1223 			}
1224 			ill->ill_token_length = IPV6_TOKEN_LEN;
1225 		}
1226 		/*
1227 		 * Attempt to set the link local address if it isn't set.
1228 		 */
1229 		if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr))
1230 			(void) ipif_setlinklocal(ipif);
1231 	}
1232 }
1233 
1234 /*
1235  * Is it not possible to set the link local address?
1236  * The address can be set if the token is set, and the token
1237  * isn't too long.
1238  * Return B_TRUE if the address can't be set, or B_FALSE if it can.
1239  */
1240 boolean_t
1241 ipif_cant_setlinklocal(ipif_t *ipif)
1242 {
1243 	ill_t *ill = ipif->ipif_ill;
1244 
1245 	if (IN6_IS_ADDR_UNSPECIFIED(&ill->ill_token) ||
1246 	    ill->ill_token_length > IPV6_ABITS - IPV6_LL_PREFIXLEN)
1247 		return (B_TRUE);
1248 
1249 	return (B_FALSE);
1250 }
1251 
1252 /*
1253  * Generate a link-local address from the token.
1254  * Return zero if the address was set, or non-zero if it couldn't be set.
1255  */
1256 int
1257 ipif_setlinklocal(ipif_t *ipif)
1258 {
1259 	ill_t		*ill = ipif->ipif_ill;
1260 	in6_addr_t	ov6addr;
1261 
1262 	ASSERT(IAM_WRITER_ILL(ill));
1263 
1264 	if (ipif_cant_setlinklocal(ipif))
1265 		return (-1);
1266 
1267 	ov6addr = ipif->ipif_v6lcl_addr;
1268 	ipif_get_linklocal(&ipif->ipif_v6lcl_addr, &ill->ill_token);
1269 	sctp_update_ipif_addr(ipif, ov6addr);
1270 	(void) ip_plen_to_mask_v6(IPV6_LL_PREFIXLEN, &ipif->ipif_v6net_mask);
1271 	V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
1272 	    ipif->ipif_v6subnet);
1273 
1274 	if (ipif->ipif_flags & IPIF_NOLOCAL) {
1275 		ipif->ipif_v6src_addr = ipv6_all_zeros;
1276 	} else {
1277 		ipif->ipif_v6src_addr = ipif->ipif_v6lcl_addr;
1278 	}
1279 	return (0);
1280 }
1281 
1282 /*
1283  * This function sets up the multicast mappings in NDP.
1284  * Unlike ARP, there are no mapping_mps here. We delete the
1285  * mapping nces and add a new one.
1286  *
1287  * Returns non-zero on error and 0 on success.
1288  */
1289 int
1290 ipif_ndp_setup_multicast(ipif_t *ipif, nce_t **ret_nce)
1291 {
1292 	ill_t		*ill = ipif->ipif_ill;
1293 	in6_addr_t	v6_mcast_addr = {(uint32_t)V6_MCAST, 0, 0, 0};
1294 	in6_addr_t	v6_mcast_mask = {(uint32_t)V6_MCAST, 0, 0, 0};
1295 	in6_addr_t	v6_extract_mask;
1296 	uchar_t		*phys_addr, *bphys_addr, *alloc_phys;
1297 	nce_t		*mnce = NULL;
1298 	int		err = 0;
1299 	phyint_t	*phyi = ill->ill_phyint;
1300 	uint32_t	hw_extract_start;
1301 	dl_unitdata_req_t *dlur;
1302 	ip_stack_t	*ipst = ill->ill_ipst;
1303 
1304 	if (ret_nce != NULL)
1305 		*ret_nce = NULL;
1306 	/*
1307 	 * Delete the mapping nce. Normally these should not exist
1308 	 * as a previous ipif_down -> ipif_ndp_down should have deleted
1309 	 * all the nces. But they can exist if ip_rput_dlpi_writer
1310 	 * calls this when PHYI_MULTI_BCAST is set.
1311 	 */
1312 	mnce = ndp_lookup_v6(ill, &v6_mcast_addr, B_FALSE);
1313 	if (mnce != NULL) {
1314 		ndp_delete(mnce);
1315 		NCE_REFRELE(mnce);
1316 		mnce = NULL;
1317 	}
1318 
1319 	/*
1320 	 * Get media specific v6 mapping information. Note that
1321 	 * nd_lla_len can be 0 for tunnels.
1322 	 */
1323 	alloc_phys = kmem_alloc(ill->ill_nd_lla_len, KM_NOSLEEP);
1324 	if ((alloc_phys == NULL) && (ill->ill_nd_lla_len != 0))
1325 		return (ENOMEM);
1326 	/*
1327 	 * Determine the broadcast address.
1328 	 */
1329 	dlur = (dl_unitdata_req_t *)ill->ill_bcast_mp->b_rptr;
1330 	if (ill->ill_sap_length < 0)
1331 		bphys_addr = (uchar_t *)dlur + dlur->dl_dest_addr_offset;
1332 	else
1333 		bphys_addr = (uchar_t *)dlur +
1334 		    dlur->dl_dest_addr_offset + ill->ill_sap_length;
1335 
1336 	/*
1337 	 * Check PHYI_MULTI_BCAST and possible length of physical
1338 	 * address to determine if we use the mapping or the
1339 	 * broadcast address.
1340 	 */
1341 	if ((phyi->phyint_flags & PHYI_MULTI_BCAST) ||
1342 	    (!MEDIA_V6MINFO(ill->ill_media, ill->ill_nd_lla_len,
1343 	    bphys_addr, alloc_phys, &hw_extract_start,
1344 	    &v6_extract_mask))) {
1345 		if (ill->ill_phys_addr_length > IP_MAX_HW_LEN) {
1346 			kmem_free(alloc_phys, ill->ill_nd_lla_len);
1347 			return (E2BIG);
1348 		}
1349 		/* Use the link-layer broadcast address for MULTI_BCAST */
1350 		phys_addr = bphys_addr;
1351 		bzero(&v6_extract_mask, sizeof (v6_extract_mask));
1352 		hw_extract_start = ill->ill_nd_lla_len;
1353 	} else {
1354 		phys_addr = alloc_phys;
1355 	}
1356 	if ((ipif->ipif_flags & IPIF_BROADCAST) ||
1357 	    (ill->ill_flags & ILLF_MULTICAST) ||
1358 	    (phyi->phyint_flags & PHYI_MULTI_BCAST)) {
1359 		mutex_enter(&ipst->ips_ndp6->ndp_g_lock);
1360 		err = ndp_add(ill,
1361 		    phys_addr,
1362 		    &v6_mcast_addr,	/* v6 address */
1363 		    &v6_mcast_mask,	/* v6 mask */
1364 		    &v6_extract_mask,
1365 		    hw_extract_start,
1366 		    NCE_F_MAPPING | NCE_F_PERMANENT | NCE_F_NONUD,
1367 		    ND_REACHABLE,
1368 		    &mnce,
1369 		    NULL,
1370 		    NULL);
1371 		mutex_exit(&ipst->ips_ndp6->ndp_g_lock);
1372 		if (err == 0) {
1373 			if (ret_nce != NULL) {
1374 				*ret_nce = mnce;
1375 			} else {
1376 				NCE_REFRELE(mnce);
1377 			}
1378 		}
1379 	}
1380 	kmem_free(alloc_phys, ill->ill_nd_lla_len);
1381 	return (err);
1382 }
1383 
1384 /*
1385  * Get the resolver set up for a new interface address.  (Always called
1386  * as writer.)
1387  */
1388 int
1389 ipif_ndp_up(ipif_t *ipif, const in6_addr_t *addr)
1390 {
1391 	ill_t		*ill = ipif->ipif_ill;
1392 	int		err = 0;
1393 	nce_t		*nce = NULL;
1394 	nce_t		*mnce = NULL;
1395 
1396 	ip1dbg(("ipif_ndp_up(%s:%u)\n",
1397 	    ipif->ipif_ill->ill_name, ipif->ipif_id));
1398 
1399 	/*
1400 	 * ND not supported on XRESOLV interfaces. If ND support (multicast)
1401 	 * added later, take out this check.
1402 	 */
1403 	if ((ill->ill_flags & ILLF_XRESOLV) ||
1404 	    IN6_IS_ADDR_UNSPECIFIED(addr) ||
1405 	    (!(ill->ill_net_type & IRE_INTERFACE))) {
1406 		ipif->ipif_addr_ready = 1;
1407 		return (0);
1408 	}
1409 
1410 	/*
1411 	 * Need to setup multicast mapping only when the first
1412 	 * interface is coming UP.
1413 	 */
1414 	if (ill->ill_ipif_up_count == 0 &&
1415 	    (ill->ill_flags & ILLF_MULTICAST)) {
1416 		/*
1417 		 * We set the multicast before setting up the mapping for
1418 		 * local address because ipif_ndp_setup_multicast does
1419 		 * ndp_walk to delete nces which will delete the mapping
1420 		 * for local address also if we added the mapping for
1421 		 * local address first.
1422 		 */
1423 		err = ipif_ndp_setup_multicast(ipif, &mnce);
1424 		if (err != 0)
1425 			return (err);
1426 	}
1427 
1428 	if ((ipif->ipif_flags & (IPIF_UNNUMBERED|IPIF_NOLOCAL)) == 0) {
1429 		uint16_t	flags;
1430 		uchar_t	*hw_addr = NULL;
1431 
1432 		/* Permanent entries don't need NUD */
1433 		flags = NCE_F_PERMANENT | NCE_F_NONUD;
1434 		if (ill->ill_flags & ILLF_ROUTER)
1435 			flags |= NCE_F_ISROUTER;
1436 
1437 		if (ipif->ipif_flags & IPIF_ANYCAST)
1438 			flags |= NCE_F_ANYCAST;
1439 
1440 		if (ill->ill_net_type == IRE_IF_RESOLVER) {
1441 			hw_addr = ill->ill_nd_lla;
1442 
1443 			if (ill->ill_move_in_progress) {
1444 				/*
1445 				 * Addresses are failing over to this ill.
1446 				 * Don't wait for NUD to see this change.
1447 				 * Publish our new link-layer address.
1448 				 */
1449 				flags |= NCE_F_UNSOL_ADV;
1450 			}
1451 		}
1452 		err = ndp_lookup_then_add(ill,
1453 		    hw_addr,
1454 		    addr,
1455 		    &ipv6_all_ones,
1456 		    &ipv6_all_zeros,
1457 		    0,
1458 		    flags,
1459 		    ND_PROBE,	/* Causes Duplicate Address Detection to run */
1460 		    &nce,
1461 		    NULL,
1462 		    NULL);
1463 		switch (err) {
1464 		case 0:
1465 			ip1dbg(("ipif_ndp_up: NCE created for %s\n",
1466 			    ill->ill_name));
1467 			ipif->ipif_addr_ready = 1;
1468 			break;
1469 		case EINPROGRESS:
1470 			ip1dbg(("ipif_ndp_up: running DAD now for %s\n",
1471 			    ill->ill_name));
1472 			break;
1473 		case EEXIST:
1474 			NCE_REFRELE(nce);
1475 			ip1dbg(("ipif_ndp_up: NCE already exists for %s\n",
1476 			    ill->ill_name));
1477 			if (mnce != NULL) {
1478 				ndp_delete(mnce);
1479 				NCE_REFRELE(mnce);
1480 			}
1481 			return (err);
1482 		default:
1483 			ip1dbg(("ipif_ndp_up: NCE creation failed %s\n",
1484 			    ill->ill_name));
1485 			if (mnce != NULL) {
1486 				ndp_delete(mnce);
1487 				NCE_REFRELE(mnce);
1488 			}
1489 			return (err);
1490 		}
1491 	} else {
1492 		/* No local NCE for this entry */
1493 		ipif->ipif_addr_ready = 1;
1494 	}
1495 	if (nce != NULL)
1496 		NCE_REFRELE(nce);
1497 	if (mnce != NULL)
1498 		NCE_REFRELE(mnce);
1499 	return (0);
1500 }
1501 
1502 /* Remove all cache entries for this logical interface */
1503 void
1504 ipif_ndp_down(ipif_t *ipif)
1505 {
1506 	nce_t	*nce;
1507 
1508 	if (ipif->ipif_isv6) {
1509 		nce = ndp_lookup_v6(ipif->ipif_ill, &ipif->ipif_v6lcl_addr,
1510 		    B_FALSE);
1511 		if (nce != NULL) {
1512 			ndp_delete(nce);
1513 			NCE_REFRELE(nce);
1514 		}
1515 	}
1516 	/*
1517 	 * Remove mapping and all other nces dependent on this ill
1518 	 * when the last ipif is going away.
1519 	 */
1520 	if (ipif->ipif_ill->ill_ipif_up_count == 0) {
1521 		ndp_walk(ipif->ipif_ill, (pfi_t)ndp_delete_per_ill,
1522 		    (uchar_t *)ipif->ipif_ill, ipif->ipif_ill->ill_ipst);
1523 	}
1524 }
1525 
1526 /*
1527  * Used when an interface comes up to recreate any extra routes on this
1528  * interface.
1529  */
1530 static ire_t **
1531 ipif_recover_ire_v6(ipif_t *ipif)
1532 {
1533 	mblk_t	*mp;
1534 	ire_t   **ipif_saved_irep;
1535 	ire_t   **irep;
1536 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
1537 
1538 	ip1dbg(("ipif_recover_ire_v6(%s:%u)", ipif->ipif_ill->ill_name,
1539 	    ipif->ipif_id));
1540 
1541 	ASSERT(ipif->ipif_isv6);
1542 
1543 	mutex_enter(&ipif->ipif_saved_ire_lock);
1544 	ipif_saved_irep = (ire_t **)kmem_zalloc(sizeof (ire_t *) *
1545 	    ipif->ipif_saved_ire_cnt, KM_NOSLEEP);
1546 	if (ipif_saved_irep == NULL) {
1547 		mutex_exit(&ipif->ipif_saved_ire_lock);
1548 		return (NULL);
1549 	}
1550 
1551 	irep = ipif_saved_irep;
1552 
1553 	for (mp = ipif->ipif_saved_ire_mp; mp != NULL; mp = mp->b_cont) {
1554 		ire_t		*ire;
1555 		queue_t		*rfq;
1556 		queue_t		*stq;
1557 		ifrt_t		*ifrt;
1558 		in6_addr_t	*src_addr;
1559 		in6_addr_t	*gateway_addr;
1560 		mblk_t		*resolver_mp;
1561 		char		buf[INET6_ADDRSTRLEN];
1562 		ushort_t	type;
1563 
1564 		/*
1565 		 * When the ire was initially created and then added in
1566 		 * ip_rt_add_v6(), it was created either using
1567 		 * ipif->ipif_net_type in the case of a traditional interface
1568 		 * route, or as one of the IRE_OFFSUBNET types (with the
1569 		 * exception of IRE_HOST type redirect ire which is created by
1570 		 * icmp_redirect_v6() and which we don't need to save or
1571 		 * recover).  In the case where ipif->ipif_net_type was
1572 		 * IRE_LOOPBACK, ip_rt_add_v6() will update the ire_type to
1573 		 * IRE_IF_NORESOLVER before calling ire_add_v6() to satisfy
1574 		 * software like GateD and Sun Cluster which creates routes
1575 		 * using the the loopback interface's address as a gateway.
1576 		 *
1577 		 * As ifrt->ifrt_type reflects the already updated ire_type and
1578 		 * since ire_create_v6() expects that IRE_IF_NORESOLVER will
1579 		 * have a valid ire_dlureq_mp field (which doesn't make sense
1580 		 * for a IRE_LOOPBACK), ire_create_v6() will be called in the
1581 		 * same way here as in ip_rt_add_v6(), namely using
1582 		 * ipif->ipif_net_type when the route looks like a traditional
1583 		 * interface route (where ifrt->ifrt_type & IRE_INTERFACE is
1584 		 * true) and otherwise using the saved ifrt->ifrt_type.  This
1585 		 * means that in the case where ipif->ipif_net_type is
1586 		 * IRE_LOOPBACK, the ire created by ire_create_v6() will be an
1587 		 * IRE_LOOPBACK, it will then be turned into an
1588 		 * IRE_IF_NORESOLVER and then added by ire_add_v6().
1589 		 */
1590 		ifrt = (ifrt_t *)mp->b_rptr;
1591 		if (ifrt->ifrt_type & IRE_INTERFACE) {
1592 			rfq = NULL;
1593 			stq = (ipif->ipif_net_type == IRE_IF_RESOLVER)
1594 			    ? ipif->ipif_rq : ipif->ipif_wq;
1595 			src_addr = (ifrt->ifrt_flags & RTF_SETSRC)
1596 			    ? &ifrt->ifrt_v6src_addr
1597 			    : &ipif->ipif_v6src_addr;
1598 			gateway_addr = NULL;
1599 			resolver_mp = ipif->ipif_resolver_mp;
1600 			type = ipif->ipif_net_type;
1601 		} else {
1602 			rfq = NULL;
1603 			stq = NULL;
1604 			src_addr = (ifrt->ifrt_flags & RTF_SETSRC)
1605 			    ? &ifrt->ifrt_v6src_addr : NULL;
1606 			gateway_addr = &ifrt->ifrt_v6gateway_addr;
1607 			resolver_mp = NULL;
1608 			type = ifrt->ifrt_type;
1609 		}
1610 
1611 		/*
1612 		 * Create a copy of the IRE with the saved address and netmask.
1613 		 */
1614 		ip1dbg(("ipif_recover_ire_v6: creating IRE %s (%d) for %s/%d\n",
1615 		    ip_nv_lookup(ire_nv_tbl, ifrt->ifrt_type), ifrt->ifrt_type,
1616 		    inet_ntop(AF_INET6, &ifrt->ifrt_v6addr, buf, sizeof (buf)),
1617 		    ip_mask_to_plen_v6(&ifrt->ifrt_v6mask)));
1618 		ire = ire_create_v6(
1619 		    &ifrt->ifrt_v6addr,
1620 		    &ifrt->ifrt_v6mask,
1621 		    src_addr,
1622 		    gateway_addr,
1623 		    &ifrt->ifrt_max_frag,
1624 		    NULL,
1625 		    rfq,
1626 		    stq,
1627 		    type,
1628 		    resolver_mp,
1629 		    ipif,
1630 		    NULL,
1631 		    0,
1632 		    0,
1633 		    ifrt->ifrt_flags,
1634 		    &ifrt->ifrt_iulp_info,
1635 		    NULL,
1636 		    NULL,
1637 		    ipst);
1638 		if (ire == NULL) {
1639 			mutex_exit(&ipif->ipif_saved_ire_lock);
1640 			kmem_free(ipif_saved_irep,
1641 			    ipif->ipif_saved_ire_cnt * sizeof (ire_t *));
1642 			return (NULL);
1643 		}
1644 
1645 		/*
1646 		 * Some software (for example, GateD and Sun Cluster) attempts
1647 		 * to create (what amount to) IRE_PREFIX routes with the
1648 		 * loopback address as the gateway.  This is primarily done to
1649 		 * set up prefixes with the RTF_REJECT flag set (for example,
1650 		 * when generating aggregate routes.)
1651 		 *
1652 		 * If the IRE type (as defined by ipif->ipif_net_type) is
1653 		 * IRE_LOOPBACK, then we map the request into a
1654 		 * IRE_IF_NORESOLVER.
1655 		 */
1656 		if (ipif->ipif_net_type == IRE_LOOPBACK)
1657 			ire->ire_type = IRE_IF_NORESOLVER;
1658 		/*
1659 		 * ire held by ire_add, will be refreled' in ipif_up_done
1660 		 * towards the end
1661 		 */
1662 		(void) ire_add(&ire, NULL, NULL, NULL, B_FALSE);
1663 		*irep = ire;
1664 		irep++;
1665 		ip1dbg(("ipif_recover_ire_v6: added ire %p\n", (void *)ire));
1666 	}
1667 	mutex_exit(&ipif->ipif_saved_ire_lock);
1668 	return (ipif_saved_irep);
1669 }
1670 
1671 /*
1672  * Return the scope of the given IPv6 address.  If the address is an
1673  * IPv4 mapped IPv6 address, return the scope of the corresponding
1674  * IPv4 address.
1675  */
1676 in6addr_scope_t
1677 ip_addr_scope_v6(const in6_addr_t *addr)
1678 {
1679 	static in6_addr_t ipv6loopback = IN6ADDR_LOOPBACK_INIT;
1680 
1681 	if (IN6_IS_ADDR_V4MAPPED(addr)) {
1682 		in_addr_t v4addr_h = ntohl(V4_PART_OF_V6((*addr)));
1683 		if ((v4addr_h >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET ||
1684 		    (v4addr_h & IN_AUTOCONF_MASK) == IN_AUTOCONF_NET)
1685 			return (IP6_SCOPE_LINKLOCAL);
1686 		if ((v4addr_h & IN_PRIVATE8_MASK) == IN_PRIVATE8_NET ||
1687 		    (v4addr_h & IN_PRIVATE12_MASK) == IN_PRIVATE12_NET ||
1688 		    (v4addr_h & IN_PRIVATE16_MASK) == IN_PRIVATE16_NET)
1689 			return (IP6_SCOPE_SITELOCAL);
1690 		return (IP6_SCOPE_GLOBAL);
1691 	}
1692 
1693 	if (IN6_IS_ADDR_MULTICAST(addr))
1694 		return (IN6_ADDR_MC_SCOPE(addr));
1695 
1696 	/* link-local and loopback addresses are of link-local scope */
1697 	if (IN6_IS_ADDR_LINKLOCAL(addr) ||
1698 	    IN6_ARE_ADDR_EQUAL(addr, &ipv6loopback))
1699 		return (IP6_SCOPE_LINKLOCAL);
1700 	if (IN6_IS_ADDR_SITELOCAL(addr))
1701 		return (IP6_SCOPE_SITELOCAL);
1702 	return (IP6_SCOPE_GLOBAL);
1703 }
1704 
1705 
1706 /*
1707  * Returns the length of the common prefix of a1 and a2, as per
1708  * CommonPrefixLen() defined in RFC 3484.
1709  */
1710 static int
1711 ip_common_prefix_v6(const in6_addr_t *a1, const in6_addr_t *a2)
1712 {
1713 	int i;
1714 	uint32_t a1val, a2val, mask;
1715 
1716 	for (i = 0; i < 4; i++) {
1717 		if ((a1val = a1->s6_addr32[i]) != (a2val = a2->s6_addr32[i])) {
1718 			a1val ^= a2val;
1719 			i *= 32;
1720 			mask = 0x80000000u;
1721 			while (!(a1val & mask)) {
1722 				mask >>= 1;
1723 				i++;
1724 			}
1725 			return (i);
1726 		}
1727 	}
1728 	return (IPV6_ABITS);
1729 }
1730 
1731 #define	IPIF_VALID_IPV6_SOURCE(ipif) \
1732 	(((ipif)->ipif_flags & IPIF_UP) && \
1733 	!((ipif)->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST)) && \
1734 	(ipif)->ipif_addr_ready)
1735 
1736 /* source address candidate */
1737 typedef struct candidate {
1738 	ipif_t		*cand_ipif;
1739 	/* The properties of this candidate */
1740 	boolean_t	cand_isdst;
1741 	boolean_t	cand_isdst_set;
1742 	in6addr_scope_t	cand_scope;
1743 	boolean_t	cand_scope_set;
1744 	boolean_t	cand_isdeprecated;
1745 	boolean_t	cand_isdeprecated_set;
1746 	boolean_t	cand_ispreferred;
1747 	boolean_t	cand_ispreferred_set;
1748 	boolean_t	cand_matchedinterface;
1749 	boolean_t	cand_matchedinterface_set;
1750 	boolean_t	cand_matchedlabel;
1751 	boolean_t	cand_matchedlabel_set;
1752 	boolean_t	cand_istmp;
1753 	boolean_t	cand_istmp_set;
1754 	int		cand_common_pref;
1755 	boolean_t	cand_common_pref_set;
1756 	boolean_t	cand_pref_eq;
1757 	boolean_t	cand_pref_eq_set;
1758 	int		cand_pref_len;
1759 	boolean_t	cand_pref_len_set;
1760 } cand_t;
1761 #define	cand_srcaddr	cand_ipif->ipif_v6lcl_addr
1762 #define	cand_mask	cand_ipif->ipif_v6net_mask
1763 #define	cand_flags	cand_ipif->ipif_flags
1764 #define	cand_ill	cand_ipif->ipif_ill
1765 #define	cand_zoneid	cand_ipif->ipif_zoneid
1766 
1767 /* information about the destination for source address selection */
1768 typedef struct dstinfo {
1769 	const in6_addr_t	*dst_addr;
1770 	ill_t			*dst_ill;
1771 	uint_t			dst_restrict_ill;
1772 	boolean_t		dst_prefer_src_tmp;
1773 	in6addr_scope_t		dst_scope;
1774 	char			*dst_label;
1775 } dstinfo_t;
1776 
1777 /*
1778  * The following functions are rules used to select a source address in
1779  * ipif_select_source_v6().  Each rule compares a current candidate (cc)
1780  * against the best candidate (bc).  Each rule has three possible outcomes;
1781  * the candidate is preferred over the best candidate (CAND_PREFER), the
1782  * candidate is not preferred over the best candidate (CAND_AVOID), or the
1783  * candidate is of equal value as the best candidate (CAND_TIE).
1784  *
1785  * These rules are part of a greater "Default Address Selection for IPv6"
1786  * sheme, which is standards based work coming out of the IETF ipv6 working
1787  * group.  The IETF document defines both IPv6 source address selection and
1788  * destination address ordering.  The rules defined here implement the IPv6
1789  * source address selection.  Destination address ordering is done by
1790  * libnsl, and uses a similar set of rules to implement the sorting.
1791  *
1792  * Most of the rules are defined by the RFC and are not typically altered.  The
1793  * last rule, number 8, has language that allows for local preferences.  In the
1794  * scheme below, this means that new Solaris rules should normally go between
1795  * rule_ifprefix and rule_prefix.
1796  */
1797 typedef enum {CAND_AVOID, CAND_TIE, CAND_PREFER} rule_res_t;
1798 typedef	rule_res_t (*rulef_t)(cand_t *, cand_t *, const dstinfo_t *,
1799     ip_stack_t *);
1800 
1801 /* Prefer an address if it is equal to the destination address. */
1802 /* ARGSUSED3 */
1803 static rule_res_t
1804 rule_isdst(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst)
1805 {
1806 	if (!bc->cand_isdst_set) {
1807 		bc->cand_isdst =
1808 		    IN6_ARE_ADDR_EQUAL(&bc->cand_srcaddr, dstinfo->dst_addr);
1809 		bc->cand_isdst_set = B_TRUE;
1810 	}
1811 
1812 	cc->cand_isdst =
1813 	    IN6_ARE_ADDR_EQUAL(&cc->cand_srcaddr, dstinfo->dst_addr);
1814 	cc->cand_isdst_set = B_TRUE;
1815 
1816 	if (cc->cand_isdst == bc->cand_isdst)
1817 		return (CAND_TIE);
1818 	else if (cc->cand_isdst)
1819 		return (CAND_PREFER);
1820 	else
1821 		return (CAND_AVOID);
1822 }
1823 
1824 /*
1825  * Prefer addresses that are of closest scope to the destination.  Always
1826  * prefer addresses that are of greater scope than the destination over
1827  * those that are of lesser scope than the destination.
1828  */
1829 /* ARGSUSED3 */
1830 static rule_res_t
1831 rule_scope(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst)
1832 {
1833 	if (!bc->cand_scope_set) {
1834 		bc->cand_scope = ip_addr_scope_v6(&bc->cand_srcaddr);
1835 		bc->cand_scope_set = B_TRUE;
1836 	}
1837 
1838 	cc->cand_scope = ip_addr_scope_v6(&cc->cand_srcaddr);
1839 	cc->cand_scope_set = B_TRUE;
1840 
1841 	if (cc->cand_scope < bc->cand_scope) {
1842 		if (cc->cand_scope < dstinfo->dst_scope)
1843 			return (CAND_AVOID);
1844 		else
1845 			return (CAND_PREFER);
1846 	} else if (bc->cand_scope < cc->cand_scope) {
1847 		if (bc->cand_scope < dstinfo->dst_scope)
1848 			return (CAND_PREFER);
1849 		else
1850 			return (CAND_AVOID);
1851 	} else {
1852 		return (CAND_TIE);
1853 	}
1854 }
1855 
1856 /*
1857  * Prefer non-deprecated source addresses.
1858  */
1859 /* ARGSUSED2 */
1860 static rule_res_t
1861 rule_deprecated(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo,
1862     ip_stack_t *ipst)
1863 {
1864 	if (!bc->cand_isdeprecated_set) {
1865 		bc->cand_isdeprecated =
1866 		    ((bc->cand_flags & IPIF_DEPRECATED) != 0);
1867 		bc->cand_isdeprecated_set = B_TRUE;
1868 	}
1869 
1870 	cc->cand_isdeprecated = ((cc->cand_flags & IPIF_DEPRECATED) != 0);
1871 	cc->cand_isdeprecated_set = B_TRUE;
1872 
1873 	if (bc->cand_isdeprecated == cc->cand_isdeprecated)
1874 		return (CAND_TIE);
1875 	else if (cc->cand_isdeprecated)
1876 		return (CAND_AVOID);
1877 	else
1878 		return (CAND_PREFER);
1879 }
1880 
1881 /*
1882  * Prefer source addresses that have the IPIF_PREFERRED flag set.  This
1883  * rule must be before rule_interface because the flag could be set on any
1884  * interface, not just the interface being used for outgoing packets (for
1885  * example, the IFF_PREFERRED could be set on an address assigned to the
1886  * loopback interface).
1887  */
1888 /* ARGSUSED2 */
1889 static rule_res_t
1890 rule_preferred(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo,
1891     ip_stack_t *ipst)
1892 {
1893 	if (!bc->cand_ispreferred_set) {
1894 		bc->cand_ispreferred = ((bc->cand_flags & IPIF_PREFERRED) != 0);
1895 		bc->cand_ispreferred_set = B_TRUE;
1896 	}
1897 
1898 	cc->cand_ispreferred = ((cc->cand_flags & IPIF_PREFERRED) != 0);
1899 	cc->cand_ispreferred_set = B_TRUE;
1900 
1901 	if (bc->cand_ispreferred == cc->cand_ispreferred)
1902 		return (CAND_TIE);
1903 	else if (cc->cand_ispreferred)
1904 		return (CAND_PREFER);
1905 	else
1906 		return (CAND_AVOID);
1907 }
1908 
1909 /*
1910  * Prefer source addresses that are assigned to the outgoing interface, or
1911  * to an interface that is in the same IPMP group as the outgoing
1912  * interface.
1913  */
1914 /* ARGSUSED3 */
1915 static rule_res_t
1916 rule_interface(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo,
1917     ip_stack_t *ipst)
1918 {
1919 	ill_t *dstill = dstinfo->dst_ill;
1920 
1921 	/*
1922 	 * If dstinfo->dst_restrict_ill is set, this rule is unnecessary
1923 	 * since we know all candidates will be on the same link.
1924 	 */
1925 	if (dstinfo->dst_restrict_ill)
1926 		return (CAND_TIE);
1927 
1928 	if (!bc->cand_matchedinterface_set) {
1929 		bc->cand_matchedinterface = (bc->cand_ill == dstill ||
1930 		    (dstill->ill_group != NULL &&
1931 		    dstill->ill_group == bc->cand_ill->ill_group));
1932 		bc->cand_matchedinterface_set = B_TRUE;
1933 	}
1934 
1935 	cc->cand_matchedinterface = (cc->cand_ill == dstill ||
1936 	    (dstill->ill_group != NULL &&
1937 	    dstill->ill_group == cc->cand_ill->ill_group));
1938 	cc->cand_matchedinterface_set = B_TRUE;
1939 
1940 	if (bc->cand_matchedinterface == cc->cand_matchedinterface)
1941 		return (CAND_TIE);
1942 	else if (cc->cand_matchedinterface)
1943 		return (CAND_PREFER);
1944 	else
1945 		return (CAND_AVOID);
1946 }
1947 
1948 /*
1949  * Prefer source addresses whose label matches the destination's label.
1950  */
1951 static rule_res_t
1952 rule_label(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst)
1953 {
1954 	char *label;
1955 
1956 	if (!bc->cand_matchedlabel_set) {
1957 		label = ip6_asp_lookup(&bc->cand_srcaddr, NULL, ipst);
1958 		bc->cand_matchedlabel =
1959 		    ip6_asp_labelcmp(label, dstinfo->dst_label);
1960 		bc->cand_matchedlabel_set = B_TRUE;
1961 	}
1962 
1963 	label = ip6_asp_lookup(&cc->cand_srcaddr, NULL, ipst);
1964 	cc->cand_matchedlabel = ip6_asp_labelcmp(label, dstinfo->dst_label);
1965 	cc->cand_matchedlabel_set = B_TRUE;
1966 
1967 	if (bc->cand_matchedlabel == cc->cand_matchedlabel)
1968 		return (CAND_TIE);
1969 	else if (cc->cand_matchedlabel)
1970 		return (CAND_PREFER);
1971 	else
1972 		return (CAND_AVOID);
1973 }
1974 
1975 /*
1976  * Prefer public addresses over temporary ones.  An application can reverse
1977  * the logic of this rule and prefer temporary addresses by using the
1978  * IPV6_SRC_PREFERENCES socket option.
1979  */
1980 /* ARGSUSED3 */
1981 static rule_res_t
1982 rule_temporary(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo,
1983     ip_stack_t *ipst)
1984 {
1985 	if (!bc->cand_istmp_set) {
1986 		bc->cand_istmp = ((bc->cand_flags & IPIF_TEMPORARY) != 0);
1987 		bc->cand_istmp_set = B_TRUE;
1988 	}
1989 
1990 	cc->cand_istmp = ((cc->cand_flags & IPIF_TEMPORARY) != 0);
1991 	cc->cand_istmp_set = B_TRUE;
1992 
1993 	if (bc->cand_istmp == cc->cand_istmp)
1994 		return (CAND_TIE);
1995 
1996 	if (dstinfo->dst_prefer_src_tmp && cc->cand_istmp)
1997 		return (CAND_PREFER);
1998 	else if (!dstinfo->dst_prefer_src_tmp && !cc->cand_istmp)
1999 		return (CAND_PREFER);
2000 	else
2001 		return (CAND_AVOID);
2002 }
2003 
2004 /*
2005  * Prefer source addresses with longer matching prefix with the destination
2006  * under the interface mask.  This gets us on the same subnet before applying
2007  * any Solaris-specific rules.
2008  */
2009 /* ARGSUSED3 */
2010 static rule_res_t
2011 rule_ifprefix(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo,
2012     ip_stack_t *ipst)
2013 {
2014 	if (!bc->cand_pref_eq_set) {
2015 		bc->cand_pref_eq = V6_MASK_EQ_2(bc->cand_srcaddr,
2016 		    bc->cand_mask, *dstinfo->dst_addr);
2017 		bc->cand_pref_eq_set = B_TRUE;
2018 	}
2019 
2020 	cc->cand_pref_eq = V6_MASK_EQ_2(cc->cand_srcaddr, cc->cand_mask,
2021 	    *dstinfo->dst_addr);
2022 	cc->cand_pref_eq_set = B_TRUE;
2023 
2024 	if (bc->cand_pref_eq) {
2025 		if (cc->cand_pref_eq) {
2026 			if (!bc->cand_pref_len_set) {
2027 				bc->cand_pref_len =
2028 				    ip_mask_to_plen_v6(&bc->cand_mask);
2029 				bc->cand_pref_len_set = B_TRUE;
2030 			}
2031 			cc->cand_pref_len = ip_mask_to_plen_v6(&cc->cand_mask);
2032 			cc->cand_pref_len_set = B_TRUE;
2033 			if (bc->cand_pref_len == cc->cand_pref_len)
2034 				return (CAND_TIE);
2035 			else if (bc->cand_pref_len > cc->cand_pref_len)
2036 				return (CAND_AVOID);
2037 			else
2038 				return (CAND_PREFER);
2039 		} else {
2040 			return (CAND_AVOID);
2041 		}
2042 	} else {
2043 		if (cc->cand_pref_eq)
2044 			return (CAND_PREFER);
2045 		else
2046 			return (CAND_TIE);
2047 	}
2048 }
2049 
2050 /*
2051  * Prefer to use zone-specific addresses when possible instead of all-zones
2052  * addresses.
2053  */
2054 /* ARGSUSED2 */
2055 static rule_res_t
2056 rule_zone_specific(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo,
2057     ip_stack_t *ipst)
2058 {
2059 	if ((bc->cand_zoneid == ALL_ZONES) ==
2060 	    (cc->cand_zoneid == ALL_ZONES))
2061 		return (CAND_TIE);
2062 	else if (cc->cand_zoneid == ALL_ZONES)
2063 		return (CAND_AVOID);
2064 	else
2065 		return (CAND_PREFER);
2066 }
2067 
2068 /*
2069  * Prefer to use DHCPv6 (first) and static addresses (second) when possible
2070  * instead of statelessly autoconfigured addresses.
2071  *
2072  * This is done after trying all other preferences (and before the final tie
2073  * breaker) so that, if all else is equal, we select addresses configured by
2074  * DHCPv6 over other addresses.  We presume that DHCPv6 addresses, unlike
2075  * stateless autoconfigured addresses, are deliberately configured by an
2076  * administrator, and thus are correctly set up in DNS and network packet
2077  * filters.
2078  */
2079 /* ARGSUSED2 */
2080 static rule_res_t
2081 rule_addr_type(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo,
2082     ip_stack_t *ipst)
2083 {
2084 #define	ATYPE(x)	\
2085 	((x) & IPIF_DHCPRUNNING) ? 1 : ((x) & IPIF_ADDRCONF) ? 3 : 2
2086 	int bcval = ATYPE(bc->cand_flags);
2087 	int ccval = ATYPE(cc->cand_flags);
2088 #undef ATYPE
2089 
2090 	if (bcval == ccval)
2091 		return (CAND_TIE);
2092 	else if (ccval < bcval)
2093 		return (CAND_PREFER);
2094 	else
2095 		return (CAND_AVOID);
2096 }
2097 
2098 /*
2099  * Prefer source addresses with longer matching prefix with the destination.
2100  * We do the longest matching prefix calculation by doing an xor of both
2101  * addresses with the destination, and pick the address with the longest string
2102  * of leading zeros, as per CommonPrefixLen() defined in RFC 3484.
2103  */
2104 /* ARGSUSED3 */
2105 static rule_res_t
2106 rule_prefix(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst)
2107 {
2108 	if (!bc->cand_common_pref_set) {
2109 		bc->cand_common_pref = ip_common_prefix_v6(&bc->cand_srcaddr,
2110 		    dstinfo->dst_addr);
2111 		bc->cand_common_pref_set = B_TRUE;
2112 	}
2113 
2114 	cc->cand_common_pref = ip_common_prefix_v6(&cc->cand_srcaddr,
2115 	    dstinfo->dst_addr);
2116 	cc->cand_common_pref_set = B_TRUE;
2117 
2118 	if (bc->cand_common_pref == cc->cand_common_pref)
2119 		return (CAND_TIE);
2120 	else if (bc->cand_common_pref > cc->cand_common_pref)
2121 		return (CAND_AVOID);
2122 	else
2123 		return (CAND_PREFER);
2124 }
2125 
2126 /*
2127  * Last rule: we must pick something, so just prefer the current best
2128  * candidate.
2129  */
2130 /* ARGSUSED */
2131 static rule_res_t
2132 rule_must_be_last(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo,
2133     ip_stack_t *ipst)
2134 {
2135 	return (CAND_AVOID);
2136 }
2137 
2138 /*
2139  * Determine the best source address given a destination address and a
2140  * destination ill.  If no suitable source address is found, it returns
2141  * NULL. If there is a usable address pointed to by the usesrc
2142  * (i.e ill_usesrc_ifindex != 0) then return that first since it is more
2143  * fine grained (i.e per interface)
2144  *
2145  * This implementation is based on the "Default Address Selection for IPv6"
2146  * specification produced by the IETF IPv6 working group.  It has been
2147  * implemented so that the list of addresses is only traversed once (the
2148  * specification's algorithm could traverse the list of addresses once for
2149  * every rule).
2150  *
2151  * The restrict_ill argument restricts the algorithm to chose a source
2152  * address that is assigned to the destination ill or an ill in the same
2153  * IPMP group as the destination ill.  This is used when the destination
2154  * address is a link-local or multicast address, and when
2155  * ipv6_strict_dst_multihoming is turned on.
2156  *
2157  * src_prefs is the caller's set of source address preferences.  If source
2158  * address selection is being called to determine the source address of a
2159  * connected socket (from ip_bind_connected_v6()), then the preferences are
2160  * taken from conn_src_preferences.  These preferences can be set on a
2161  * per-socket basis using the IPV6_SRC_PREFERENCES socket option.  The only
2162  * preference currently implemented is for rfc3041 temporary addresses.
2163  */
2164 ipif_t *
2165 ipif_select_source_v6(ill_t *dstill, const in6_addr_t *dst,
2166     uint_t restrict_ill, uint32_t src_prefs, zoneid_t zoneid)
2167 {
2168 	dstinfo_t	dstinfo;
2169 	char		dstr[INET6_ADDRSTRLEN];
2170 	char		sstr[INET6_ADDRSTRLEN];
2171 	ipif_t		*ipif;
2172 	ill_t		*ill, *usesrc_ill = NULL;
2173 	ill_walk_context_t	ctx;
2174 	cand_t		best_c;	/* The best candidate */
2175 	cand_t		curr_c;	/* The current candidate */
2176 	uint_t		index;
2177 	boolean_t	first_candidate = B_TRUE;
2178 	rule_res_t	rule_result;
2179 	tsol_tpc_t	*src_rhtp, *dst_rhtp;
2180 	ip_stack_t	*ipst = dstill->ill_ipst;
2181 
2182 	/*
2183 	 * The list of ordering rules.  They are applied in the order they
2184 	 * appear in the list.
2185 	 *
2186 	 * Solaris doesn't currently support Mobile IPv6, so there's no
2187 	 * rule_mipv6 corresponding to rule 4 in the specification.
2188 	 */
2189 	rulef_t	rules[] = {
2190 		rule_isdst,
2191 		rule_scope,
2192 		rule_deprecated,
2193 		rule_preferred,
2194 		rule_interface,
2195 		rule_label,
2196 		rule_temporary,
2197 		rule_ifprefix,			/* local rules after this */
2198 		rule_zone_specific,
2199 		rule_addr_type,
2200 		rule_prefix,			/* local rules before this */
2201 		rule_must_be_last,		/* must always be last */
2202 		NULL
2203 	};
2204 
2205 	ASSERT(dstill->ill_isv6);
2206 	ASSERT(!IN6_IS_ADDR_V4MAPPED(dst));
2207 
2208 	/*
2209 	 * Check if there is a usable src address pointed to by the
2210 	 * usesrc ifindex. This has higher precedence since it is
2211 	 * finer grained (i.e per interface) v/s being system wide.
2212 	 */
2213 	if (dstill->ill_usesrc_ifindex != 0) {
2214 		if ((usesrc_ill =
2215 		    ill_lookup_on_ifindex(dstill->ill_usesrc_ifindex, B_TRUE,
2216 		    NULL, NULL, NULL, NULL, ipst)) != NULL) {
2217 			dstinfo.dst_ill = usesrc_ill;
2218 		} else {
2219 			return (NULL);
2220 		}
2221 	} else {
2222 		dstinfo.dst_ill = dstill;
2223 	}
2224 
2225 	/*
2226 	 * If we're dealing with an unlabeled destination on a labeled system,
2227 	 * make sure that we ignore source addresses that are incompatible with
2228 	 * the destination's default label.  That destination's default label
2229 	 * must dominate the minimum label on the source address.
2230 	 *
2231 	 * (Note that this has to do with Trusted Solaris.  It's not related to
2232 	 * the labels described by ip6_asp_lookup.)
2233 	 */
2234 	dst_rhtp = NULL;
2235 	if (is_system_labeled()) {
2236 		dst_rhtp = find_tpc(dst, IPV6_VERSION, B_FALSE);
2237 		if (dst_rhtp == NULL)
2238 			return (NULL);
2239 		if (dst_rhtp->tpc_tp.host_type != UNLABELED) {
2240 			TPC_RELE(dst_rhtp);
2241 			dst_rhtp = NULL;
2242 		}
2243 	}
2244 
2245 	dstinfo.dst_addr = dst;
2246 	dstinfo.dst_scope = ip_addr_scope_v6(dst);
2247 	dstinfo.dst_label = ip6_asp_lookup(dst, NULL, ipst);
2248 	dstinfo.dst_prefer_src_tmp = ((src_prefs & IPV6_PREFER_SRC_TMP) != 0);
2249 
2250 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
2251 	/*
2252 	 * Section three of the I-D states that for multicast and
2253 	 * link-local destinations, the candidate set must be restricted to
2254 	 * an interface that is on the same link as the outgoing interface.
2255 	 * Also, when ipv6_strict_dst_multihoming is turned on, always
2256 	 * restrict the source address to the destination link as doing
2257 	 * otherwise will almost certainly cause problems.
2258 	 */
2259 	if (IN6_IS_ADDR_LINKLOCAL(dst) || IN6_IS_ADDR_MULTICAST(dst) ||
2260 	    ipst->ips_ipv6_strict_dst_multihoming || usesrc_ill != NULL) {
2261 		if (restrict_ill == RESTRICT_TO_NONE)
2262 			dstinfo.dst_restrict_ill = RESTRICT_TO_GROUP;
2263 		else
2264 			dstinfo.dst_restrict_ill = restrict_ill;
2265 	} else {
2266 		dstinfo.dst_restrict_ill = restrict_ill;
2267 	}
2268 
2269 	bzero(&best_c, sizeof (cand_t));
2270 
2271 	/*
2272 	 * Take a pass through the list of IPv6 interfaces to chose the
2273 	 * best possible source address.  If restrict_ill is true, we only
2274 	 * iterate through the ill's that are in the same IPMP group as the
2275 	 * destination's outgoing ill.  If restrict_ill is false, we walk
2276 	 * the entire list of IPv6 ill's.
2277 	 */
2278 	if (dstinfo.dst_restrict_ill != RESTRICT_TO_NONE) {
2279 		if (dstinfo.dst_ill->ill_group != NULL &&
2280 		    dstinfo.dst_restrict_ill == RESTRICT_TO_GROUP) {
2281 			ill = dstinfo.dst_ill->ill_group->illgrp_ill;
2282 		} else {
2283 			ill = dstinfo.dst_ill;
2284 		}
2285 	} else {
2286 		ill = ILL_START_WALK_V6(&ctx, ipst);
2287 	}
2288 
2289 	while (ill != NULL) {
2290 		ASSERT(ill->ill_isv6);
2291 
2292 		/*
2293 		 * Avoid FAILED/OFFLINE ills.
2294 		 * Global and site local addresses will failover and
2295 		 * will be available on the new ill.
2296 		 * But link local addresses don't move.
2297 		 */
2298 		if (dstinfo.dst_restrict_ill != RESTRICT_TO_ILL &&
2299 		    ill->ill_phyint->phyint_flags &
2300 		    (PHYI_OFFLINE | PHYI_FAILED))
2301 			goto next_ill;
2302 
2303 		for (ipif = ill->ill_ipif; ipif != NULL;
2304 		    ipif = ipif->ipif_next) {
2305 
2306 			if (!IPIF_VALID_IPV6_SOURCE(ipif))
2307 				continue;
2308 
2309 			if (zoneid != ALL_ZONES &&
2310 			    ipif->ipif_zoneid != zoneid &&
2311 			    ipif->ipif_zoneid != ALL_ZONES)
2312 				continue;
2313 
2314 			/*
2315 			 * Check compatibility of local address for
2316 			 * destination's default label if we're on a labeled
2317 			 * system.  Incompatible addresses can't be used at
2318 			 * all and must be skipped over.
2319 			 */
2320 			if (dst_rhtp != NULL) {
2321 				boolean_t incompat;
2322 
2323 				src_rhtp = find_tpc(&ipif->ipif_v6lcl_addr,
2324 				    IPV6_VERSION, B_FALSE);
2325 				if (src_rhtp == NULL)
2326 					continue;
2327 				incompat =
2328 				    src_rhtp->tpc_tp.host_type != SUN_CIPSO ||
2329 				    src_rhtp->tpc_tp.tp_doi !=
2330 				    dst_rhtp->tpc_tp.tp_doi ||
2331 				    (!_blinrange(&dst_rhtp->tpc_tp.tp_def_label,
2332 				    &src_rhtp->tpc_tp.tp_sl_range_cipso) &&
2333 				    !blinlset(&dst_rhtp->tpc_tp.tp_def_label,
2334 				    src_rhtp->tpc_tp.tp_sl_set_cipso));
2335 				TPC_RELE(src_rhtp);
2336 				if (incompat)
2337 					continue;
2338 			}
2339 
2340 			if (first_candidate) {
2341 				/*
2342 				 * This is first valid address in the list.
2343 				 * It is automatically the best candidate
2344 				 * so far.
2345 				 */
2346 				best_c.cand_ipif = ipif;
2347 				first_candidate = B_FALSE;
2348 				continue;
2349 			}
2350 
2351 			bzero(&curr_c, sizeof (cand_t));
2352 			curr_c.cand_ipif = ipif;
2353 
2354 			/*
2355 			 * Compare this current candidate (curr_c) with the
2356 			 * best candidate (best_c) by applying the
2357 			 * comparison rules in order until one breaks the
2358 			 * tie.
2359 			 */
2360 			for (index = 0; rules[index] != NULL; index++) {
2361 				/* Apply a comparison rule. */
2362 				rule_result =
2363 				    (rules[index])(&best_c, &curr_c, &dstinfo,
2364 				    ipst);
2365 				if (rule_result == CAND_AVOID) {
2366 					/*
2367 					 * The best candidate is still the
2368 					 * best candidate.  Forget about
2369 					 * this current candidate and go on
2370 					 * to the next one.
2371 					 */
2372 					break;
2373 				} else if (rule_result == CAND_PREFER) {
2374 					/*
2375 					 * This candidate is prefered.  It
2376 					 * becomes the best candidate so
2377 					 * far.  Go on to the next address.
2378 					 */
2379 					best_c = curr_c;
2380 					break;
2381 				}
2382 				/* We have a tie, apply the next rule. */
2383 			}
2384 
2385 			/*
2386 			 * The last rule must be a tie breaker rule and
2387 			 * must never produce a tie.  At this point, the
2388 			 * candidate should have either been rejected, or
2389 			 * have been prefered as the best candidate so far.
2390 			 */
2391 			ASSERT(rule_result != CAND_TIE);
2392 		}
2393 
2394 		/*
2395 		 * We may be walking the linked-list of ill's in an
2396 		 * IPMP group or traversing the IPv6 ill avl tree. If it is a
2397 		 * usesrc ILL then it can't be part of IPMP group and we
2398 		 * will exit the while loop.
2399 		 */
2400 next_ill:
2401 		if (dstinfo.dst_restrict_ill == RESTRICT_TO_ILL)
2402 			ill = NULL;
2403 		else if (dstinfo.dst_restrict_ill == RESTRICT_TO_GROUP)
2404 			ill = ill->ill_group_next;
2405 		else
2406 			ill = ill_next(&ctx, ill);
2407 	}
2408 
2409 	ipif = best_c.cand_ipif;
2410 	ip1dbg(("ipif_select_source_v6(%s, %s) -> %s\n",
2411 	    dstinfo.dst_ill->ill_name,
2412 	    inet_ntop(AF_INET6, dstinfo.dst_addr, dstr, sizeof (dstr)),
2413 	    (ipif == NULL ? "NULL" :
2414 	    inet_ntop(AF_INET6, &ipif->ipif_v6lcl_addr, sstr, sizeof (sstr)))));
2415 
2416 	if (usesrc_ill != NULL)
2417 		ill_refrele(usesrc_ill);
2418 
2419 	if (dst_rhtp != NULL)
2420 		TPC_RELE(dst_rhtp);
2421 
2422 	if (ipif == NULL) {
2423 		rw_exit(&ipst->ips_ill_g_lock);
2424 		return (NULL);
2425 	}
2426 
2427 	mutex_enter(&ipif->ipif_ill->ill_lock);
2428 	if (IPIF_CAN_LOOKUP(ipif)) {
2429 		ipif_refhold_locked(ipif);
2430 		mutex_exit(&ipif->ipif_ill->ill_lock);
2431 		rw_exit(&ipst->ips_ill_g_lock);
2432 		return (ipif);
2433 	}
2434 	mutex_exit(&ipif->ipif_ill->ill_lock);
2435 	rw_exit(&ipst->ips_ill_g_lock);
2436 	ip1dbg(("ipif_select_source_v6 cannot lookup ipif %p"
2437 	    " returning null \n", (void *)ipif));
2438 
2439 	return (NULL);
2440 }
2441 
2442 /*
2443  * If old_ipif is not NULL, see if ipif was derived from old
2444  * ipif and if so, recreate the interface route by re-doing
2445  * source address selection. This happens when ipif_down ->
2446  * ipif_update_other_ipifs calls us.
2447  *
2448  * If old_ipif is NULL, just redo the source address selection
2449  * if needed. This happens when illgrp_insert or ipif_up_done_v6
2450  * calls us.
2451  */
2452 void
2453 ipif_recreate_interface_routes_v6(ipif_t *old_ipif, ipif_t *ipif)
2454 {
2455 	ire_t *ire;
2456 	ire_t *ipif_ire;
2457 	queue_t *stq;
2458 	ill_t *ill;
2459 	ipif_t *nipif = NULL;
2460 	boolean_t nipif_refheld = B_FALSE;
2461 	boolean_t ip6_asp_table_held = B_FALSE;
2462 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
2463 
2464 	ill = ipif->ipif_ill;
2465 
2466 	if (!(ipif->ipif_flags &
2467 	    (IPIF_NOLOCAL|IPIF_ANYCAST|IPIF_DEPRECATED))) {
2468 		/*
2469 		 * Can't possibly have borrowed the source
2470 		 * from old_ipif.
2471 		 */
2472 		return;
2473 	}
2474 
2475 	/*
2476 	 * Is there any work to be done? No work if the address
2477 	 * is INADDR_ANY, loopback or NOLOCAL or ANYCAST (
2478 	 * ipif_select_source_v6() does not borrow addresses from
2479 	 * NOLOCAL and ANYCAST interfaces).
2480 	 */
2481 	if ((old_ipif != NULL) &&
2482 	    ((IN6_IS_ADDR_UNSPECIFIED(&old_ipif->ipif_v6lcl_addr)) ||
2483 	    (old_ipif->ipif_ill->ill_wq == NULL) ||
2484 	    (old_ipif->ipif_flags &
2485 	    (IPIF_NOLOCAL|IPIF_ANYCAST)))) {
2486 		return;
2487 	}
2488 
2489 	/*
2490 	 * Perform the same checks as when creating the
2491 	 * IRE_INTERFACE in ipif_up_done_v6.
2492 	 */
2493 	if (!(ipif->ipif_flags & IPIF_UP))
2494 		return;
2495 
2496 	if ((ipif->ipif_flags & IPIF_NOXMIT))
2497 		return;
2498 
2499 	if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet) &&
2500 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6net_mask))
2501 		return;
2502 
2503 	/*
2504 	 * We know that ipif uses some other source for its
2505 	 * IRE_INTERFACE. Is it using the source of this
2506 	 * old_ipif?
2507 	 */
2508 	ipif_ire = ipif_to_ire_v6(ipif);
2509 	if (ipif_ire == NULL)
2510 		return;
2511 
2512 	if (old_ipif != NULL &&
2513 	    !IN6_ARE_ADDR_EQUAL(&old_ipif->ipif_v6lcl_addr,
2514 	    &ipif_ire->ire_src_addr_v6)) {
2515 		ire_refrele(ipif_ire);
2516 		return;
2517 	}
2518 
2519 	if (ip_debug > 2) {
2520 		/* ip1dbg */
2521 		pr_addr_dbg("ipif_recreate_interface_routes_v6: deleting IRE"
2522 		    " for src %s\n", AF_INET6, &ipif_ire->ire_src_addr_v6);
2523 	}
2524 
2525 	stq = ipif_ire->ire_stq;
2526 
2527 	/*
2528 	 * Can't use our source address. Select a different source address
2529 	 * for the IRE_INTERFACE.  We restrict interface route source
2530 	 * address selection to ipif's assigned to the same link as the
2531 	 * interface.
2532 	 */
2533 	if (ip6_asp_can_lookup(ipst)) {
2534 		ip6_asp_table_held = B_TRUE;
2535 		nipif = ipif_select_source_v6(ill, &ipif->ipif_v6subnet,
2536 		    RESTRICT_TO_GROUP, IPV6_PREFER_SRC_DEFAULT,
2537 		    ipif->ipif_zoneid);
2538 	}
2539 	if (nipif == NULL) {
2540 		/* Last resort - all ipif's have IPIF_NOLOCAL */
2541 		nipif = ipif;
2542 	} else {
2543 		nipif_refheld = B_TRUE;
2544 	}
2545 
2546 	ire = ire_create_v6(
2547 	    &ipif->ipif_v6subnet,	/* dest pref */
2548 	    &ipif->ipif_v6net_mask,	/* mask */
2549 	    &nipif->ipif_v6src_addr,	/* src addr */
2550 	    NULL,			/* no gateway */
2551 	    &ipif->ipif_mtu,		/* max frag */
2552 	    NULL,			/* no Fast path header */
2553 	    NULL,			/* no recv from queue */
2554 	    stq,			/* send-to queue */
2555 	    ill->ill_net_type,		/* IF_[NO]RESOLVER */
2556 	    ill->ill_resolver_mp,	/* xmit header */
2557 	    ipif,
2558 	    NULL,
2559 	    0,
2560 	    0,
2561 	    0,
2562 	    &ire_uinfo_null,
2563 	    NULL,
2564 	    NULL,
2565 	    ipst);
2566 
2567 	if (ire != NULL) {
2568 		ire_t *ret_ire;
2569 		int   error;
2570 
2571 		/*
2572 		 * We don't need ipif_ire anymore. We need to delete
2573 		 * before we add so that ire_add does not detect
2574 		 * duplicates.
2575 		 */
2576 		ire_delete(ipif_ire);
2577 		ret_ire = ire;
2578 		error = ire_add(&ret_ire, NULL, NULL, NULL, B_FALSE);
2579 		ASSERT(error == 0);
2580 		ASSERT(ret_ire == ire);
2581 		if (ret_ire != NULL) {
2582 			/* Held in ire_add */
2583 			ire_refrele(ret_ire);
2584 		}
2585 	}
2586 	/*
2587 	 * Either we are falling through from above or could not
2588 	 * allocate a replacement.
2589 	 */
2590 	ire_refrele(ipif_ire);
2591 	if (ip6_asp_table_held)
2592 		ip6_asp_table_refrele(ipst);
2593 	if (nipif_refheld)
2594 		ipif_refrele(nipif);
2595 }
2596 
2597 /*
2598  * This old_ipif is going away.
2599  *
2600  * Determine if any other ipif's are using our address as
2601  * ipif_v6lcl_addr (due to those being IPIF_NOLOCAL, IPIF_ANYCAST, or
2602  * IPIF_DEPRECATED).
2603  * Find the IRE_INTERFACE for such ipif's and recreate them
2604  * to use an different source address following the rules in
2605  * ipif_up_done_v6.
2606  *
2607  * This function takes an illgrp as an argument so that illgrp_delete
2608  * can call this to update source address even after deleting the
2609  * old_ipif->ipif_ill from the ill group.
2610  */
2611 void
2612 ipif_update_other_ipifs_v6(ipif_t *old_ipif, ill_group_t *illgrp)
2613 {
2614 	ipif_t	*ipif;
2615 	ill_t	*ill;
2616 	char	buf[INET6_ADDRSTRLEN];
2617 
2618 	ASSERT(IAM_WRITER_IPIF(old_ipif));
2619 
2620 	ill = old_ipif->ipif_ill;
2621 
2622 	ip1dbg(("ipif_update_other_ipifs_v6(%s, %s)\n",
2623 	    ill->ill_name,
2624 	    inet_ntop(AF_INET6, &old_ipif->ipif_v6lcl_addr,
2625 	    buf, sizeof (buf))));
2626 
2627 	/*
2628 	 * If this part of a group, look at all ills as ipif_select_source
2629 	 * borrows a source address across all the ills in the group.
2630 	 */
2631 	if (illgrp != NULL)
2632 		ill = illgrp->illgrp_ill;
2633 
2634 	/* Don't need a lock since this is a writer */
2635 	for (; ill != NULL; ill = ill->ill_group_next) {
2636 		for (ipif = ill->ill_ipif; ipif != NULL;
2637 		    ipif = ipif->ipif_next) {
2638 
2639 			if (ipif == old_ipif)
2640 				continue;
2641 
2642 			ipif_recreate_interface_routes_v6(old_ipif, ipif);
2643 		}
2644 	}
2645 }
2646 
2647 /*
2648  * Perform an attach and bind to get phys addr plus info_req for
2649  * the physical device.
2650  * q and mp represents an ioctl which will be queued waiting for
2651  * completion of the DLPI message exchange.
2652  * MUST be called on an ill queue. Can not set conn_pending_ill for that
2653  * reason thus the DL_PHYS_ADDR_ACK code does not assume ill_pending_q.
2654  *
2655  * Returns EINPROGRESS when mp has been consumed by queueing it on
2656  * ill_pending_mp and the ioctl will complete in ip_rput.
2657  */
2658 int
2659 ill_dl_phys(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q)
2660 {
2661 	mblk_t	*v6token_mp = NULL;
2662 	mblk_t	*v6lla_mp = NULL;
2663 	mblk_t	*phys_mp = NULL;
2664 	mblk_t	*info_mp = NULL;
2665 	mblk_t	*attach_mp = NULL;
2666 	mblk_t	*bind_mp = NULL;
2667 	mblk_t	*unbind_mp = NULL;
2668 	mblk_t	*notify_mp = NULL;
2669 
2670 	ip1dbg(("ill_dl_phys(%s:%u)\n", ill->ill_name, ipif->ipif_id));
2671 	ASSERT(ill->ill_dlpi_style_set);
2672 	ASSERT(WR(q)->q_next != NULL);
2673 
2674 	if (ill->ill_isv6) {
2675 		v6token_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) +
2676 		    sizeof (t_scalar_t), DL_PHYS_ADDR_REQ);
2677 		if (v6token_mp == NULL)
2678 			goto bad;
2679 		((dl_phys_addr_req_t *)v6token_mp->b_rptr)->dl_addr_type =
2680 		    DL_IPV6_TOKEN;
2681 
2682 		v6lla_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) +
2683 		    sizeof (t_scalar_t), DL_PHYS_ADDR_REQ);
2684 		if (v6lla_mp == NULL)
2685 			goto bad;
2686 		((dl_phys_addr_req_t *)v6lla_mp->b_rptr)->dl_addr_type =
2687 		    DL_IPV6_LINK_LAYER_ADDR;
2688 	}
2689 
2690 	/*
2691 	 * Allocate a DL_NOTIFY_REQ and set the notifications we want.
2692 	 */
2693 	notify_mp = ip_dlpi_alloc(sizeof (dl_notify_req_t) + sizeof (long),
2694 	    DL_NOTIFY_REQ);
2695 	if (notify_mp == NULL)
2696 		goto bad;
2697 	((dl_notify_req_t *)notify_mp->b_rptr)->dl_notifications =
2698 	    (DL_NOTE_PHYS_ADDR | DL_NOTE_SDU_SIZE | DL_NOTE_FASTPATH_FLUSH |
2699 	    DL_NOTE_LINK_UP | DL_NOTE_LINK_DOWN | DL_NOTE_CAPAB_RENEG);
2700 
2701 	phys_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) +
2702 	    sizeof (t_scalar_t), DL_PHYS_ADDR_REQ);
2703 	if (phys_mp == NULL)
2704 		goto bad;
2705 	((dl_phys_addr_req_t *)phys_mp->b_rptr)->dl_addr_type =
2706 	    DL_CURR_PHYS_ADDR;
2707 
2708 	info_mp = ip_dlpi_alloc(
2709 	    sizeof (dl_info_req_t) + sizeof (dl_info_ack_t),
2710 	    DL_INFO_REQ);
2711 	if (info_mp == NULL)
2712 		goto bad;
2713 
2714 	bind_mp = ip_dlpi_alloc(sizeof (dl_bind_req_t) + sizeof (long),
2715 	    DL_BIND_REQ);
2716 	if (bind_mp == NULL)
2717 		goto bad;
2718 	((dl_bind_req_t *)bind_mp->b_rptr)->dl_sap = ill->ill_sap;
2719 	((dl_bind_req_t *)bind_mp->b_rptr)->dl_service_mode = DL_CLDLS;
2720 
2721 	unbind_mp = ip_dlpi_alloc(sizeof (dl_unbind_req_t), DL_UNBIND_REQ);
2722 	if (unbind_mp == NULL)
2723 		goto bad;
2724 
2725 	/* If we need to attach, pre-alloc and initialize the mblk */
2726 	if (ill->ill_needs_attach) {
2727 		attach_mp = ip_dlpi_alloc(sizeof (dl_attach_req_t),
2728 		    DL_ATTACH_REQ);
2729 		if (attach_mp == NULL)
2730 			goto bad;
2731 		((dl_attach_req_t *)attach_mp->b_rptr)->dl_ppa = ill->ill_ppa;
2732 	}
2733 
2734 	/*
2735 	 * Here we are going to delay the ioctl ack until after
2736 	 * ACKs from DL_PHYS_ADDR_REQ. So need to save the
2737 	 * original ioctl message before sending the requests
2738 	 */
2739 	mutex_enter(&ill->ill_lock);
2740 	/* ipsq_pending_mp_add won't fail since we pass in a NULL connp */
2741 	(void) ipsq_pending_mp_add(NULL, ipif, ill->ill_wq, mp, 0);
2742 	/*
2743 	 * Set ill_phys_addr_pend to zero. It will be set to the addr_type of
2744 	 * the DL_PHYS_ADDR_REQ in ill_dlpi_send() and ill_dlpi_done(). It will
2745 	 * be used to track which DL_PHYS_ADDR_REQ is being ACK'd/NAK'd.
2746 	 */
2747 	ill->ill_phys_addr_pend = 0;
2748 	mutex_exit(&ill->ill_lock);
2749 
2750 	if (attach_mp != NULL) {
2751 		ip1dbg(("ill_dl_phys: attach\n"));
2752 		ill_dlpi_send(ill, attach_mp);
2753 	}
2754 	ill_dlpi_send(ill, bind_mp);
2755 	ill_dlpi_send(ill, info_mp);
2756 	if (ill->ill_isv6) {
2757 		ill_dlpi_send(ill, v6token_mp);
2758 		ill_dlpi_send(ill, v6lla_mp);
2759 	}
2760 	ill_dlpi_send(ill, phys_mp);
2761 	ill_dlpi_send(ill, notify_mp);
2762 	ill_dlpi_send(ill, unbind_mp);
2763 
2764 	/*
2765 	 * This operation will complete in ip_rput_dlpi_writer with either
2766 	 * a DL_PHYS_ADDR_ACK or DL_ERROR_ACK.
2767 	 */
2768 	return (EINPROGRESS);
2769 bad:
2770 	freemsg(v6token_mp);
2771 	freemsg(v6lla_mp);
2772 	freemsg(phys_mp);
2773 	freemsg(info_mp);
2774 	freemsg(attach_mp);
2775 	freemsg(bind_mp);
2776 	freemsg(unbind_mp);
2777 	freemsg(notify_mp);
2778 	return (ENOMEM);
2779 }
2780 
2781 uint_t ip_loopback_mtu_v6plus = IP_LOOPBACK_MTU + IPV6_HDR_LEN + 20;
2782 
2783 /*
2784  * DLPI is up.
2785  * Create all the IREs associated with an interface bring up multicast.
2786  * Set the interface flag and finish other initialization
2787  * that potentially had to be differed to after DL_BIND_ACK.
2788  */
2789 int
2790 ipif_up_done_v6(ipif_t *ipif)
2791 {
2792 	ire_t	*ire_array[20];
2793 	ire_t	**irep = ire_array;
2794 	ire_t	**irep1;
2795 	ill_t	*ill = ipif->ipif_ill;
2796 	queue_t	*stq;
2797 	in6_addr_t	v6addr;
2798 	in6_addr_t	route_mask;
2799 	ipif_t	 *src_ipif = NULL;
2800 	ipif_t   *tmp_ipif;
2801 	boolean_t	flush_ire_cache = B_TRUE;
2802 	int	err;
2803 	char	buf[INET6_ADDRSTRLEN];
2804 	phyint_t *phyi;
2805 	ire_t	**ipif_saved_irep = NULL;
2806 	int ipif_saved_ire_cnt;
2807 	int cnt;
2808 	boolean_t src_ipif_held = B_FALSE;
2809 	boolean_t ire_added = B_FALSE;
2810 	boolean_t loopback = B_FALSE;
2811 	boolean_t ip6_asp_table_held = B_FALSE;
2812 	ip_stack_t	*ipst = ill->ill_ipst;
2813 
2814 	ip1dbg(("ipif_up_done_v6(%s:%u)\n",
2815 	    ipif->ipif_ill->ill_name, ipif->ipif_id));
2816 
2817 	/* Check if this is a loopback interface */
2818 	if (ipif->ipif_ill->ill_wq == NULL)
2819 		loopback = B_TRUE;
2820 
2821 	ASSERT(ipif->ipif_isv6);
2822 	ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock));
2823 
2824 	/*
2825 	 * If all other interfaces for this ill are down or DEPRECATED,
2826 	 * or otherwise unsuitable for source address selection, remove
2827 	 * any IRE_CACHE entries for this ill to make sure source
2828 	 * address selection gets to take this new ipif into account.
2829 	 * No need to hold ill_lock while traversing the ipif list since
2830 	 * we are writer
2831 	 */
2832 	for (tmp_ipif = ill->ill_ipif; tmp_ipif;
2833 	    tmp_ipif = tmp_ipif->ipif_next) {
2834 		if (((tmp_ipif->ipif_flags &
2835 		    (IPIF_NOXMIT|IPIF_ANYCAST|IPIF_NOLOCAL|IPIF_DEPRECATED)) ||
2836 		    !(tmp_ipif->ipif_flags & IPIF_UP)) ||
2837 		    (tmp_ipif == ipif))
2838 			continue;
2839 		/* first useable pre-existing interface */
2840 		flush_ire_cache = B_FALSE;
2841 		break;
2842 	}
2843 	if (flush_ire_cache)
2844 		ire_walk_ill_v6(MATCH_IRE_ILL_GROUP | MATCH_IRE_TYPE,
2845 		    IRE_CACHE, ill_ipif_cache_delete, (char *)ill, ill);
2846 
2847 	/*
2848 	 * Figure out which way the send-to queue should go.  Only
2849 	 * IRE_IF_RESOLVER or IRE_IF_NORESOLVER should show up here.
2850 	 */
2851 	switch (ill->ill_net_type) {
2852 	case IRE_IF_RESOLVER:
2853 		stq = ill->ill_rq;
2854 		break;
2855 	case IRE_IF_NORESOLVER:
2856 	case IRE_LOOPBACK:
2857 		stq = ill->ill_wq;
2858 		break;
2859 	default:
2860 		return (EINVAL);
2861 	}
2862 
2863 	if (IS_LOOPBACK(ill)) {
2864 		/*
2865 		 * lo0:1 and subsequent ipifs were marked IRE_LOCAL in
2866 		 * ipif_lookup_on_name(), but in the case of zones we can have
2867 		 * several loopback addresses on lo0. So all the interfaces with
2868 		 * loopback addresses need to be marked IRE_LOOPBACK.
2869 		 */
2870 		if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr, &ipv6_loopback))
2871 			ipif->ipif_ire_type = IRE_LOOPBACK;
2872 		else
2873 			ipif->ipif_ire_type = IRE_LOCAL;
2874 	}
2875 
2876 	if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST|IPIF_DEPRECATED)) {
2877 		/*
2878 		 * Can't use our source address. Select a different
2879 		 * source address for the IRE_INTERFACE and IRE_LOCAL
2880 		 */
2881 		if (ip6_asp_can_lookup(ipst)) {
2882 			ip6_asp_table_held = B_TRUE;
2883 			src_ipif = ipif_select_source_v6(ipif->ipif_ill,
2884 			    &ipif->ipif_v6subnet, RESTRICT_TO_NONE,
2885 			    IPV6_PREFER_SRC_DEFAULT, ipif->ipif_zoneid);
2886 		}
2887 		if (src_ipif == NULL)
2888 			src_ipif = ipif;	/* Last resort */
2889 		else
2890 			src_ipif_held = B_TRUE;
2891 	} else {
2892 		src_ipif = ipif;
2893 	}
2894 
2895 	if (!IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) &&
2896 	    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
2897 
2898 		/*
2899 		 * If we're on a labeled system then make sure that zone-
2900 		 * private addresses have proper remote host database entries.
2901 		 */
2902 		if (is_system_labeled() &&
2903 		    ipif->ipif_ire_type != IRE_LOOPBACK) {
2904 			if (ip6opt_ls == 0) {
2905 				cmn_err(CE_WARN, "IPv6 not enabled "
2906 				    "via /etc/system");
2907 				return (EINVAL);
2908 			}
2909 			if (!tsol_check_interface_address(ipif))
2910 				return (EINVAL);
2911 		}
2912 
2913 		/* Register the source address for __sin6_src_id */
2914 		err = ip_srcid_insert(&ipif->ipif_v6lcl_addr,
2915 		    ipif->ipif_zoneid, ipst);
2916 		if (err != 0) {
2917 			ip0dbg(("ipif_up_done_v6: srcid_insert %d\n", err));
2918 			if (src_ipif_held)
2919 				ipif_refrele(src_ipif);
2920 			if (ip6_asp_table_held)
2921 				ip6_asp_table_refrele(ipst);
2922 			return (err);
2923 		}
2924 		/*
2925 		 * If the interface address is set, create the LOCAL
2926 		 * or LOOPBACK IRE.
2927 		 */
2928 		ip1dbg(("ipif_up_done_v6: creating IRE %d for %s\n",
2929 		    ipif->ipif_ire_type,
2930 		    inet_ntop(AF_INET6, &ipif->ipif_v6lcl_addr,
2931 		    buf, sizeof (buf))));
2932 
2933 		*irep++ = ire_create_v6(
2934 		    &ipif->ipif_v6lcl_addr,		/* dest address */
2935 		    &ipv6_all_ones,			/* mask */
2936 		    &src_ipif->ipif_v6src_addr,		/* source address */
2937 		    NULL,				/* no gateway */
2938 		    &ip_loopback_mtu_v6plus,		/* max frag size */
2939 		    NULL,
2940 		    ipif->ipif_rq,			/* recv-from queue */
2941 		    NULL,				/* no send-to queue */
2942 		    ipif->ipif_ire_type,		/* LOCAL or LOOPBACK */
2943 		    NULL,
2944 		    ipif,				/* interface */
2945 		    NULL,
2946 		    0,
2947 		    0,
2948 		    (ipif->ipif_flags & IPIF_PRIVATE) ? RTF_PRIVATE : 0,
2949 		    &ire_uinfo_null,
2950 		    NULL,
2951 		    NULL,
2952 		    ipst);
2953 	}
2954 
2955 	/*
2956 	 * Set up the IRE_IF_RESOLVER or IRE_IF_NORESOLVER, as appropriate.
2957 	 * Note that atun interfaces have an all-zero ipif_v6subnet.
2958 	 * Thus we allow a zero subnet as long as the mask is non-zero.
2959 	 */
2960 	if (stq != NULL && !(ipif->ipif_flags & IPIF_NOXMIT) &&
2961 	    !(IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet) &&
2962 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6net_mask))) {
2963 		/* ipif_v6subnet is ipif_v6pp_dst_addr for pt-pt */
2964 		v6addr = ipif->ipif_v6subnet;
2965 
2966 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
2967 			route_mask = ipv6_all_ones;
2968 		} else {
2969 			route_mask = ipif->ipif_v6net_mask;
2970 		}
2971 
2972 		ip1dbg(("ipif_up_done_v6: creating if IRE %d for %s\n",
2973 		    ill->ill_net_type,
2974 		    inet_ntop(AF_INET6, &v6addr, buf, sizeof (buf))));
2975 
2976 		*irep++ = ire_create_v6(
2977 		    &v6addr,			/* dest pref */
2978 		    &route_mask,		/* mask */
2979 		    &src_ipif->ipif_v6src_addr,	/* src addr */
2980 		    NULL,			/* no gateway */
2981 		    &ipif->ipif_mtu,		/* max frag */
2982 		    NULL,			/* no Fast path header */
2983 		    NULL,			/* no recv from queue */
2984 		    stq,			/* send-to queue */
2985 		    ill->ill_net_type,		/* IF_[NO]RESOLVER */
2986 		    ill->ill_resolver_mp,	/* xmit header */
2987 		    ipif,
2988 		    NULL,
2989 		    0,
2990 		    0,
2991 		    (ipif->ipif_flags & IPIF_PRIVATE) ? RTF_PRIVATE : 0,
2992 		    &ire_uinfo_null,
2993 		    NULL,
2994 		    NULL,
2995 		    ipst);
2996 	}
2997 
2998 	/*
2999 	 * Setup 2002::/16 route, if this interface is a 6to4 tunnel
3000 	 */
3001 	if (IN6_IS_ADDR_6TO4(&ipif->ipif_v6lcl_addr) &&
3002 	    (ill->ill_is_6to4tun)) {
3003 		/*
3004 		 * Destination address is 2002::/16
3005 		 */
3006 #ifdef	_BIG_ENDIAN
3007 		const in6_addr_t prefix_addr = { 0x20020000U, 0, 0, 0 };
3008 		const in6_addr_t prefix_mask = { 0xffff0000U, 0, 0, 0 };
3009 #else
3010 		const in6_addr_t prefix_addr = { 0x00000220U, 0, 0, 0 };
3011 		const in6_addr_t prefix_mask = { 0x0000ffffU, 0, 0, 0 };
3012 #endif /* _BIG_ENDIAN */
3013 		char	buf2[INET6_ADDRSTRLEN];
3014 		ire_t *isdup;
3015 		in6_addr_t *first_addr = &ill->ill_ipif->ipif_v6lcl_addr;
3016 
3017 		/*
3018 		 * check to see if this route has already been added for
3019 		 * this tunnel interface.
3020 		 */
3021 		isdup = ire_ftable_lookup_v6(first_addr, &prefix_mask, 0,
3022 		    IRE_IF_NORESOLVER, ill->ill_ipif, NULL, ALL_ZONES, 0, NULL,
3023 		    (MATCH_IRE_SRC | MATCH_IRE_MASK), ipst);
3024 
3025 		if (isdup == NULL) {
3026 			ip1dbg(("ipif_up_done_v6: creating if IRE %d for %s",
3027 			    IRE_IF_NORESOLVER, inet_ntop(AF_INET6, &v6addr,
3028 			    buf2, sizeof (buf2))));
3029 
3030 			*irep++ = ire_create_v6(
3031 			    &prefix_addr,		/* 2002:: */
3032 			    &prefix_mask,		/* ffff:: */
3033 			    &ipif->ipif_v6lcl_addr, 	/* src addr */
3034 			    NULL, 			/* gateway */
3035 			    &ipif->ipif_mtu, 		/* max_frag */
3036 			    NULL, 			/* no Fast Path hdr */
3037 			    NULL, 			/* no rfq */
3038 			    ill->ill_wq, 		/* stq */
3039 			    IRE_IF_NORESOLVER,		/* type */
3040 			    ill->ill_resolver_mp,	/* dlureq_mp */
3041 			    ipif,			/* interface */
3042 			    NULL,			/* v6cmask */
3043 			    0,
3044 			    0,
3045 			    RTF_UP,
3046 			    &ire_uinfo_null,
3047 			    NULL,
3048 			    NULL,
3049 			    ipst);
3050 		} else {
3051 			ire_refrele(isdup);
3052 		}
3053 	}
3054 
3055 	/* If an earlier ire_create failed, get out now */
3056 	for (irep1 = irep; irep1 > ire_array; ) {
3057 		irep1--;
3058 		if (*irep1 == NULL) {
3059 			ip1dbg(("ipif_up_done_v6: NULL ire found in"
3060 			    " ire_array\n"));
3061 			err = ENOMEM;
3062 			goto bad;
3063 		}
3064 	}
3065 
3066 	ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock));
3067 
3068 	/*
3069 	 * Need to atomically check for ip_addr_availablity_check
3070 	 * now under ill_g_lock, and if it fails got bad, and remove
3071 	 * from group also
3072 	 */
3073 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
3074 	mutex_enter(&ipst->ips_ip_addr_avail_lock);
3075 	ill->ill_ipif_up_count++;
3076 	ipif->ipif_flags |= IPIF_UP;
3077 	err = ip_addr_availability_check(ipif);
3078 	mutex_exit(&ipst->ips_ip_addr_avail_lock);
3079 	rw_exit(&ipst->ips_ill_g_lock);
3080 
3081 	if (err != 0) {
3082 		/*
3083 		 * Our address may already be up on the same ill. In this case,
3084 		 * the external resolver entry for our ipif replaced the one for
3085 		 * the other ipif. So we don't want to delete it (otherwise the
3086 		 * other ipif would be unable to send packets).
3087 		 * ip_addr_availability_check() identifies this case for us and
3088 		 * returns EADDRINUSE; we need to turn it into EADDRNOTAVAIL
3089 		 * which is the expected error code.
3090 		 */
3091 		if (err == EADDRINUSE) {
3092 			if (ipif->ipif_ill->ill_flags & ILLF_XRESOLV) {
3093 				freemsg(ipif->ipif_arp_del_mp);
3094 				ipif->ipif_arp_del_mp = NULL;
3095 			}
3096 			err = EADDRNOTAVAIL;
3097 		}
3098 		ill->ill_ipif_up_count--;
3099 		ipif->ipif_flags &= ~IPIF_UP;
3100 		goto bad;
3101 	}
3102 
3103 	/*
3104 	 * Add in all newly created IREs. We want to add before
3105 	 * we call ifgrp_insert which wants to know whether
3106 	 * IRE_IF_RESOLVER exists or not.
3107 	 *
3108 	 * NOTE : We refrele the ire though we may branch to "bad"
3109 	 *	  later on where we do ire_delete. This is okay
3110 	 *	  because nobody can delete it as we are running
3111 	 *	  exclusively.
3112 	 */
3113 	for (irep1 = irep; irep1 > ire_array; ) {
3114 		irep1--;
3115 		/* Shouldn't be adding any bcast ire's */
3116 		ASSERT((*irep1)->ire_type != IRE_BROADCAST);
3117 		ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock));
3118 		/*
3119 		 * refheld by ire_add. refele towards the end of the func
3120 		 */
3121 		(void) ire_add(irep1, NULL, NULL, NULL, B_FALSE);
3122 	}
3123 	if (ip6_asp_table_held) {
3124 		ip6_asp_table_refrele(ipst);
3125 		ip6_asp_table_held = B_FALSE;
3126 	}
3127 	ire_added = B_TRUE;
3128 
3129 	/*
3130 	 * Form groups if possible.
3131 	 *
3132 	 * If we are supposed to be in a ill_group with a name, insert it
3133 	 * now as we know that at least one ipif is UP. Otherwise form
3134 	 * nameless groups.
3135 	 *
3136 	 * If ip_enable_group_ifs is set and ipif address is not ::0, insert
3137 	 * this ipif into the appropriate interface group, or create a
3138 	 * new one. If this is already in a nameless group, we try to form
3139 	 * a bigger group looking at other ills potentially sharing this
3140 	 * ipif's prefix.
3141 	 */
3142 	phyi = ill->ill_phyint;
3143 	if (phyi->phyint_groupname_len != 0) {
3144 		ASSERT(phyi->phyint_groupname != NULL);
3145 		if (ill->ill_ipif_up_count == 1) {
3146 			ASSERT(ill->ill_group == NULL);
3147 			err = illgrp_insert(&ipst->ips_illgrp_head_v6, ill,
3148 			    phyi->phyint_groupname, NULL, B_TRUE);
3149 			if (err != 0) {
3150 				ip1dbg(("ipif_up_done_v6: illgrp allocation "
3151 				    "failed, error %d\n", err));
3152 				goto bad;
3153 			}
3154 		}
3155 		ASSERT(ill->ill_group != NULL);
3156 	}
3157 
3158 	/* Recover any additional IRE_IF_[NO]RESOLVER entries for this ipif */
3159 	ipif_saved_ire_cnt = ipif->ipif_saved_ire_cnt;
3160 	ipif_saved_irep = ipif_recover_ire_v6(ipif);
3161 
3162 	if (ipif->ipif_ipif_up_count == 1 && !loopback) {
3163 		/*
3164 		 * Need to recover all multicast memberships in the driver.
3165 		 * This had to be deferred until we had attached.
3166 		 */
3167 		ill_recover_multicast(ill);
3168 	}
3169 	/* Join the allhosts multicast address and the solicited node MC */
3170 	ipif_multicast_up(ipif);
3171 
3172 	if (!loopback) {
3173 		/*
3174 		 * See whether anybody else would benefit from the
3175 		 * new ipif that we added. We call this always rather
3176 		 * than while adding a non-IPIF_NOLOCAL/DEPRECATED/ANYCAST
3177 		 * ipif for the benefit of illgrp_insert (done above)
3178 		 * which does not do source address selection as it does
3179 		 * not want to re-create interface routes that we are
3180 		 * having reference to it here.
3181 		 */
3182 		ill_update_source_selection(ill);
3183 	}
3184 
3185 	for (irep1 = irep; irep1 > ire_array; ) {
3186 		irep1--;
3187 		if (*irep1 != NULL) {
3188 			/* was held in ire_add */
3189 			ire_refrele(*irep1);
3190 		}
3191 	}
3192 
3193 	cnt = ipif_saved_ire_cnt;
3194 	for (irep1 = ipif_saved_irep; cnt > 0; irep1++, cnt--) {
3195 		if (*irep1 != NULL) {
3196 			/* was held in ire_add */
3197 			ire_refrele(*irep1);
3198 		}
3199 	}
3200 
3201 	if (ipif->ipif_addr_ready) {
3202 		ip_rts_ifmsg(ipif);
3203 		ip_rts_newaddrmsg(RTM_ADD, 0, ipif);
3204 		sctp_update_ipif(ipif, SCTP_IPIF_UP);
3205 	}
3206 
3207 	if (ipif_saved_irep != NULL) {
3208 		kmem_free(ipif_saved_irep,
3209 		    ipif_saved_ire_cnt * sizeof (ire_t *));
3210 	}
3211 
3212 	if (src_ipif_held)
3213 		ipif_refrele(src_ipif);
3214 	return (0);
3215 
3216 bad:
3217 	if (ip6_asp_table_held)
3218 		ip6_asp_table_refrele(ipst);
3219 	/*
3220 	 * We don't have to bother removing from ill groups because
3221 	 *
3222 	 * 1) For groups with names, we insert only when the first ipif
3223 	 *    comes up. In that case if it fails, it will not be in any
3224 	 *    group. So, we need not try to remove for that case.
3225 	 *
3226 	 * 2) For groups without names, either we tried to insert ipif_ill
3227 	 *    in a group as singleton or found some other group to become
3228 	 *    a bigger group. For the former, if it fails we don't have
3229 	 *    anything to do as ipif_ill is not in the group and for the
3230 	 *    latter, there are no failures in illgrp_insert/illgrp_delete
3231 	 *    (ENOMEM can't occur for this. Check ifgrp_insert).
3232 	 */
3233 
3234 	while (irep > ire_array) {
3235 		irep--;
3236 		if (*irep != NULL) {
3237 			ire_delete(*irep);
3238 			if (ire_added)
3239 				ire_refrele(*irep);
3240 		}
3241 
3242 	}
3243 	(void) ip_srcid_remove(&ipif->ipif_v6lcl_addr, ipif->ipif_zoneid, ipst);
3244 
3245 	if (ipif_saved_irep != NULL) {
3246 		kmem_free(ipif_saved_irep,
3247 		    ipif_saved_ire_cnt * sizeof (ire_t *));
3248 	}
3249 	if (src_ipif_held)
3250 		ipif_refrele(src_ipif);
3251 
3252 	ipif_ndp_down(ipif);
3253 	if (ipif->ipif_ill->ill_flags & ILLF_XRESOLV)
3254 		ipif_arp_down(ipif);
3255 
3256 	return (err);
3257 }
3258 
3259 /*
3260  * Delete an ND entry and the corresponding IRE_CACHE entry if it exists.
3261  */
3262 /* ARGSUSED */
3263 int
3264 ip_siocdelndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
3265     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
3266 {
3267 	in6_addr_t	addr;
3268 	sin6_t		*sin6;
3269 	nce_t		*nce;
3270 	struct lifreq	*lifr;
3271 	lif_nd_req_t	*lnr;
3272 	mblk_t	*mp1;
3273 
3274 	mp1 = mp->b_cont->b_cont;
3275 	lifr = (struct lifreq *)mp1->b_rptr;
3276 	lnr = &lifr->lifr_nd;
3277 	/* Only allow for logical unit zero i.e. not on "le0:17" */
3278 	if (ipif->ipif_id != 0)
3279 		return (EINVAL);
3280 
3281 	if (!ipif->ipif_isv6)
3282 		return (EINVAL);
3283 
3284 	if (lnr->lnr_addr.ss_family != AF_INET6)
3285 		return (EAFNOSUPPORT);
3286 
3287 	sin6 = (sin6_t *)&lnr->lnr_addr;
3288 	addr = sin6->sin6_addr;
3289 	nce = ndp_lookup_v6(ipif->ipif_ill, &addr, B_FALSE);
3290 	if (nce == NULL)
3291 		return (ESRCH);
3292 	ndp_delete(nce);
3293 	NCE_REFRELE(nce);
3294 	return (0);
3295 }
3296 
3297 /*
3298  * Return nbr cache info.
3299  */
3300 /* ARGSUSED */
3301 int
3302 ip_siocqueryndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
3303     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
3304 {
3305 	ill_t		*ill = ipif->ipif_ill;
3306 	struct lifreq	*lifr;
3307 	lif_nd_req_t	*lnr;
3308 
3309 	lifr = (struct lifreq *)mp->b_cont->b_cont->b_rptr;
3310 	lnr = &lifr->lifr_nd;
3311 	/* Only allow for logical unit zero i.e. not on "le0:17" */
3312 	if (ipif->ipif_id != 0)
3313 		return (EINVAL);
3314 
3315 	if (!ipif->ipif_isv6)
3316 		return (EINVAL);
3317 
3318 	if (lnr->lnr_addr.ss_family != AF_INET6)
3319 		return (EAFNOSUPPORT);
3320 
3321 	if (ill->ill_phys_addr_length > sizeof (lnr->lnr_hdw_addr))
3322 		return (EINVAL);
3323 
3324 	return (ndp_query(ill, lnr));
3325 }
3326 
3327 /*
3328  * Perform an update of the nd entry for the specified address.
3329  */
3330 /* ARGSUSED */
3331 int
3332 ip_siocsetndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
3333     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
3334 {
3335 	ill_t		*ill = ipif->ipif_ill;
3336 	struct	lifreq	*lifr;
3337 	lif_nd_req_t	*lnr;
3338 
3339 	ASSERT(!(q->q_flag & QREADR) && q->q_next == NULL);
3340 
3341 	lifr = (struct lifreq *)mp->b_cont->b_cont->b_rptr;
3342 	lnr = &lifr->lifr_nd;
3343 	/* Only allow for logical unit zero i.e. not on "le0:17" */
3344 	if (ipif->ipif_id != 0)
3345 		return (EINVAL);
3346 
3347 	if (!ipif->ipif_isv6)
3348 		return (EINVAL);
3349 
3350 	if (lnr->lnr_addr.ss_family != AF_INET6)
3351 		return (EAFNOSUPPORT);
3352 
3353 	return (ndp_sioc_update(ill, lnr));
3354 }
3355