xref: /titanic_50/usr/src/uts/common/inet/ip/ip6_if.c (revision bf430c99546e92acc3ba67238eb12cc61375bd1b)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 /*
26  * Copyright (c) 1990 Mentat Inc.
27  */
28 
29 #pragma ident	"%Z%%M%	%I%	%E% SMI"
30 
31 /*
32  * This file contains the interface control functions for IPv6.
33  */
34 
35 #include <sys/types.h>
36 #include <sys/sysmacros.h>
37 #include <sys/stream.h>
38 #include <sys/dlpi.h>
39 #include <sys/stropts.h>
40 #include <sys/ddi.h>
41 #include <sys/cmn_err.h>
42 #include <sys/kstat.h>
43 #include <sys/debug.h>
44 #include <sys/zone.h>
45 
46 #include <sys/systm.h>
47 #include <sys/param.h>
48 #include <sys/socket.h>
49 #include <sys/isa_defs.h>
50 #include <net/if.h>
51 #include <net/if_dl.h>
52 #include <net/route.h>
53 #include <netinet/in.h>
54 #include <netinet/igmp_var.h>
55 #include <netinet/ip6.h>
56 #include <netinet/icmp6.h>
57 #include <netinet/in.h>
58 
59 #include <inet/common.h>
60 #include <inet/nd.h>
61 #include <inet/mib2.h>
62 #include <inet/ip.h>
63 #include <inet/ip6.h>
64 #include <inet/ip_multi.h>
65 #include <inet/ip_ire.h>
66 #include <inet/ip_rts.h>
67 #include <inet/ip_ndp.h>
68 #include <inet/ip_if.h>
69 #include <inet/ip6_asp.h>
70 #include <inet/tun.h>
71 #include <inet/ipclassifier.h>
72 #include <inet/sctp_ip.h>
73 
74 #include <sys/tsol/tndb.h>
75 #include <sys/tsol/tnet.h>
76 
77 static in6_addr_t	ipv6_ll_template =
78 			{(uint32_t)V6_LINKLOCAL, 0x0, 0x0, 0x0};
79 
80 static ipif_t *
81 ipif_lookup_interface_v6(const in6_addr_t *if_addr, const in6_addr_t *dst,
82     queue_t *q, mblk_t *mp, ipsq_func_t func, int *error);
83 
84 /*
85  * ipif_lookup_group_v6
86  */
87 ipif_t *
88 ipif_lookup_group_v6(const in6_addr_t *group, zoneid_t zoneid)
89 {
90 	ire_t	*ire;
91 	ipif_t	*ipif;
92 
93 	ire = ire_lookup_multi_v6(group, zoneid);
94 	if (ire == NULL)
95 		return (NULL);
96 	ipif = ire->ire_ipif;
97 	ipif_refhold(ipif);
98 	ire_refrele(ire);
99 	return (ipif);
100 }
101 
102 /*
103  * ill_lookup_group_v6
104  */
105 ill_t *
106 ill_lookup_group_v6(const in6_addr_t *group, zoneid_t zoneid)
107 {
108 	ire_t	*ire;
109 	ill_t	*ill;
110 
111 	ire = ire_lookup_multi_v6(group, zoneid);
112 	if (ire == NULL)
113 		return (NULL);
114 	ill = ire->ire_ipif->ipif_ill;
115 	ill_refhold(ill);
116 	ire_refrele(ire);
117 	return (ill);
118 }
119 
120 /*
121  * Look for an ipif with the specified interface address and destination.
122  * The destination address is used only for matching point-to-point interfaces.
123  */
124 static ipif_t *
125 ipif_lookup_interface_v6(const in6_addr_t *if_addr, const in6_addr_t *dst,
126     queue_t *q, mblk_t *mp, ipsq_func_t func, int *error)
127 {
128 	ipif_t	*ipif;
129 	ill_t	*ill;
130 	ipsq_t	*ipsq;
131 	ill_walk_context_t ctx;
132 
133 	if (error != NULL)
134 		*error = 0;
135 
136 	/*
137 	 * First match all the point-to-point interfaces
138 	 * before looking at non-point-to-point interfaces.
139 	 * This is done to avoid returning non-point-to-point
140 	 * ipif instead of unnumbered point-to-point ipif.
141 	 */
142 	rw_enter(&ill_g_lock, RW_READER);
143 	ill = ILL_START_WALK_V6(&ctx);
144 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
145 		GRAB_CONN_LOCK(q);
146 		mutex_enter(&ill->ill_lock);
147 		for (ipif = ill->ill_ipif; ipif != NULL;
148 		    ipif = ipif->ipif_next) {
149 			/* Allow the ipif to be down */
150 			if ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
151 			    (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr,
152 			    if_addr)) &&
153 			    (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr,
154 			    dst))) {
155 				if (IPIF_CAN_LOOKUP(ipif)) {
156 					ipif_refhold_locked(ipif);
157 					mutex_exit(&ill->ill_lock);
158 					RELEASE_CONN_LOCK(q);
159 					rw_exit(&ill_g_lock);
160 					return (ipif);
161 				} else if (IPIF_CAN_WAIT(ipif, q)) {
162 					ipsq = ill->ill_phyint->phyint_ipsq;
163 					mutex_enter(&ipsq->ipsq_lock);
164 					mutex_exit(&ill->ill_lock);
165 					rw_exit(&ill_g_lock);
166 					ipsq_enq(ipsq, q, mp, func, NEW_OP,
167 						ill);
168 					mutex_exit(&ipsq->ipsq_lock);
169 					RELEASE_CONN_LOCK(q);
170 					*error = EINPROGRESS;
171 					return (NULL);
172 				}
173 			}
174 		}
175 		mutex_exit(&ill->ill_lock);
176 		RELEASE_CONN_LOCK(q);
177 	}
178 	rw_exit(&ill_g_lock);
179 	/* lookup the ipif based on interface address */
180 	ipif = ipif_lookup_addr_v6(if_addr, NULL, ALL_ZONES, q, mp, func,
181 	    error);
182 	ASSERT(ipif == NULL || ipif->ipif_isv6);
183 	return (ipif);
184 }
185 
186 /*
187  * Look for an ipif with the specified address. For point-point links
188  * we look for matches on either the destination address and the local
189  * address, but we ignore the check on the local address if IPIF_UNNUMBERED
190  * is set.
191  * Matches on a specific ill if match_ill is set.
192  */
193 /* ARGSUSED */
194 ipif_t *
195 ipif_lookup_addr_v6(const in6_addr_t *addr, ill_t *match_ill, zoneid_t zoneid,
196     queue_t *q, mblk_t *mp, ipsq_func_t func, int *error)
197 {
198 	ipif_t	*ipif;
199 	ill_t	*ill;
200 	boolean_t  ptp = B_FALSE;
201 	ipsq_t	*ipsq;
202 	ill_walk_context_t ctx;
203 
204 	if (error != NULL)
205 		*error = 0;
206 
207 	rw_enter(&ill_g_lock, RW_READER);
208 	/*
209 	 * Repeat twice, first based on local addresses and
210 	 * next time for pointopoint.
211 	 */
212 repeat:
213 	ill = ILL_START_WALK_V6(&ctx);
214 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
215 		if (match_ill != NULL && ill != match_ill) {
216 			continue;
217 		}
218 		GRAB_CONN_LOCK(q);
219 		mutex_enter(&ill->ill_lock);
220 		for (ipif = ill->ill_ipif; ipif != NULL;
221 		    ipif = ipif->ipif_next) {
222 			if (zoneid != ALL_ZONES &&
223 			    ipif->ipif_zoneid != zoneid &&
224 			    ipif->ipif_zoneid != ALL_ZONES)
225 				continue;
226 			/* Allow the ipif to be down */
227 			if ((!ptp && (IN6_ARE_ADDR_EQUAL(
228 			    &ipif->ipif_v6lcl_addr, addr) &&
229 			    (ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) ||
230 			    (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) &&
231 			    IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr,
232 			    addr))) {
233 				if (IPIF_CAN_LOOKUP(ipif)) {
234 					ipif_refhold_locked(ipif);
235 					mutex_exit(&ill->ill_lock);
236 					RELEASE_CONN_LOCK(q);
237 					rw_exit(&ill_g_lock);
238 					return (ipif);
239 				} else if (IPIF_CAN_WAIT(ipif, q)) {
240 					ipsq = ill->ill_phyint->phyint_ipsq;
241 					mutex_enter(&ipsq->ipsq_lock);
242 					mutex_exit(&ill->ill_lock);
243 					rw_exit(&ill_g_lock);
244 					ipsq_enq(ipsq, q, mp, func, NEW_OP,
245 						ill);
246 					mutex_exit(&ipsq->ipsq_lock);
247 					RELEASE_CONN_LOCK(q);
248 					*error = EINPROGRESS;
249 					return (NULL);
250 				}
251 			}
252 		}
253 		mutex_exit(&ill->ill_lock);
254 		RELEASE_CONN_LOCK(q);
255 	}
256 
257 	/* If we already did the ptp case, then we are done */
258 	if (ptp) {
259 		rw_exit(&ill_g_lock);
260 		if (error != NULL)
261 			*error = ENXIO;
262 		return (NULL);
263 	}
264 	ptp = B_TRUE;
265 	goto repeat;
266 }
267 
268 /*
269  * Look for an ipif with the specified address. For point-point links
270  * we look for matches on either the destination address and the local
271  * address, but we ignore the check on the local address if IPIF_UNNUMBERED
272  * is set.
273  * Matches on a specific ill if match_ill is set.
274  * Return the zoneid for the ipif. ALL_ZONES if none found.
275  */
276 zoneid_t
277 ipif_lookup_addr_zoneid_v6(const in6_addr_t *addr, ill_t *match_ill)
278 {
279 	ipif_t	*ipif;
280 	ill_t	*ill;
281 	boolean_t  ptp = B_FALSE;
282 	ill_walk_context_t ctx;
283 	zoneid_t	zoneid;
284 
285 	rw_enter(&ill_g_lock, RW_READER);
286 	/*
287 	 * Repeat twice, first based on local addresses and
288 	 * next time for pointopoint.
289 	 */
290 repeat:
291 	ill = ILL_START_WALK_V6(&ctx);
292 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
293 		if (match_ill != NULL && ill != match_ill) {
294 			continue;
295 		}
296 		mutex_enter(&ill->ill_lock);
297 		for (ipif = ill->ill_ipif; ipif != NULL;
298 		    ipif = ipif->ipif_next) {
299 			/* Allow the ipif to be down */
300 			if ((!ptp && (IN6_ARE_ADDR_EQUAL(
301 			    &ipif->ipif_v6lcl_addr, addr) &&
302 			    (ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) ||
303 			    (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) &&
304 			    IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr,
305 			    addr)) &&
306 			    !(ipif->ipif_state_flags & IPIF_CONDEMNED)) {
307 				zoneid = ipif->ipif_zoneid;
308 				mutex_exit(&ill->ill_lock);
309 				rw_exit(&ill_g_lock);
310 				/*
311 				 * If ipif_zoneid was ALL_ZONES then we have
312 				 * a trusted extensions shared IP address.
313 				 * In that case GLOBAL_ZONEID works to send.
314 				 */
315 				if (zoneid == ALL_ZONES)
316 					zoneid = GLOBAL_ZONEID;
317 				return (zoneid);
318 			}
319 		}
320 		mutex_exit(&ill->ill_lock);
321 	}
322 
323 	/* If we already did the ptp case, then we are done */
324 	if (ptp) {
325 		rw_exit(&ill_g_lock);
326 		return (ALL_ZONES);
327 	}
328 	ptp = B_TRUE;
329 	goto repeat;
330 }
331 
332 /*
333  * Perform various checks to verify that an address would make sense as a local
334  * interface address.  This is currently only called when an attempt is made
335  * to set a local address.
336  *
337  * Does not allow a v4-mapped address, an address that equals the subnet
338  * anycast address, ... a multicast address, ...
339  */
340 boolean_t
341 ip_local_addr_ok_v6(const in6_addr_t *addr, const in6_addr_t *subnet_mask)
342 {
343 	in6_addr_t subnet;
344 
345 	if (IN6_IS_ADDR_UNSPECIFIED(addr))
346 		return (B_TRUE);	/* Allow all zeros */
347 
348 	/*
349 	 * Don't allow all zeroes or host part, but allow
350 	 * all ones netmask.
351 	 */
352 	V6_MASK_COPY(*addr, *subnet_mask, subnet);
353 	if (IN6_IS_ADDR_V4MAPPED(addr) ||
354 	    (IN6_ARE_ADDR_EQUAL(addr, &subnet) &&
355 	    !IN6_ARE_ADDR_EQUAL(subnet_mask, &ipv6_all_ones)) ||
356 	    (IN6_IS_ADDR_V4COMPAT(addr) && CLASSD(V4_PART_OF_V6((*addr)))) ||
357 	    IN6_IS_ADDR_MULTICAST(addr))
358 		return (B_FALSE);
359 
360 	return (B_TRUE);
361 }
362 
363 /*
364  * Perform various checks to verify that an address would make sense as a
365  * remote/subnet interface address.
366  */
367 boolean_t
368 ip_remote_addr_ok_v6(const in6_addr_t *addr, const in6_addr_t *subnet_mask)
369 {
370 	in6_addr_t subnet;
371 
372 	if (IN6_IS_ADDR_UNSPECIFIED(addr))
373 		return (B_TRUE);	/* Allow all zeros */
374 
375 	V6_MASK_COPY(*addr, *subnet_mask, subnet);
376 	if (IN6_IS_ADDR_V4MAPPED(addr) ||
377 	    (IN6_ARE_ADDR_EQUAL(addr, &subnet) &&
378 	    !IN6_ARE_ADDR_EQUAL(subnet_mask, &ipv6_all_ones)) ||
379 	    IN6_IS_ADDR_MULTICAST(addr) ||
380 	    (IN6_IS_ADDR_V4COMPAT(addr) && CLASSD(V4_PART_OF_V6((*addr)))))
381 		return (B_FALSE);
382 
383 	return (B_TRUE);
384 }
385 
386 /*
387  * ip_rt_add_v6 is called to add an IPv6 route to the forwarding table.
388  * ipif_arg is passed in to associate it with the correct interface
389  * (for link-local destinations and gateways).
390  */
391 /* ARGSUSED1 */
392 int
393 ip_rt_add_v6(const in6_addr_t *dst_addr, const in6_addr_t *mask,
394     const in6_addr_t *gw_addr, const in6_addr_t *src_addr, int flags,
395     ipif_t *ipif_arg, ire_t **ire_arg, queue_t *q, mblk_t *mp, ipsq_func_t func,
396     struct rtsa_s *sp)
397 {
398 	ire_t	*ire;
399 	ire_t	*gw_ire = NULL;
400 	ipif_t	*ipif;
401 	boolean_t ipif_refheld = B_FALSE;
402 	uint_t	type;
403 	int	match_flags = MATCH_IRE_TYPE;
404 	int	error;
405 	tsol_gc_t *gc = NULL;
406 	tsol_gcgrp_t *gcgrp = NULL;
407 	boolean_t gcgrp_xtraref = B_FALSE;
408 
409 	if (ire_arg != NULL)
410 		*ire_arg = NULL;
411 
412 	/*
413 	 * Prevent routes with a zero gateway from being created (since
414 	 * interfaces can currently be plumbed and brought up with no assigned
415 	 * address).
416 	 */
417 	if (IN6_IS_ADDR_UNSPECIFIED(gw_addr))
418 		return (ENETUNREACH);
419 
420 	/*
421 	 * If this is the case of RTF_HOST being set, then we set the netmask
422 	 * to all ones (regardless if one was supplied).
423 	 */
424 	if (flags & RTF_HOST)
425 		mask = &ipv6_all_ones;
426 
427 	/*
428 	 * Get the ipif, if any, corresponding to the gw_addr
429 	 */
430 	ipif = ipif_lookup_interface_v6(gw_addr, dst_addr, q, mp, func,
431 	    &error);
432 	if (ipif != NULL)
433 		ipif_refheld = B_TRUE;
434 	else if (error == EINPROGRESS) {
435 		ip1dbg(("ip_rt_add_v6: null and EINPROGRESS"));
436 		return (error);
437 	}
438 
439 	/*
440 	 * GateD will attempt to create routes with a loopback interface
441 	 * address as the gateway and with RTF_GATEWAY set.  We allow
442 	 * these routes to be added, but create them as interface routes
443 	 * since the gateway is an interface address.
444 	 */
445 	if ((ipif != NULL) && (ipif->ipif_ire_type == IRE_LOOPBACK)) {
446 		flags &= ~RTF_GATEWAY;
447 		if (IN6_ARE_ADDR_EQUAL(gw_addr, &ipv6_loopback) &&
448 		    IN6_ARE_ADDR_EQUAL(dst_addr, &ipv6_loopback) &&
449 		    IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones)) {
450 			ire = ire_ctable_lookup_v6(dst_addr, 0, IRE_LOOPBACK,
451 			    ipif, ALL_ZONES, NULL, match_flags);
452 			if (ire != NULL) {
453 				ire_refrele(ire);
454 				if (ipif_refheld)
455 					ipif_refrele(ipif);
456 				return (EEXIST);
457 			}
458 			ip1dbg(("ipif_up_done: 0x%p creating IRE 0x%x"
459 			    "for 0x%x\n", (void *)ipif,
460 			    ipif->ipif_ire_type,
461 			    ntohl(ipif->ipif_lcl_addr)));
462 			ire = ire_create_v6(
463 			    dst_addr,
464 			    mask,
465 			    &ipif->ipif_v6src_addr,
466 			    NULL,
467 			    &ipif->ipif_mtu,
468 			    NULL,
469 			    NULL,
470 			    NULL,
471 			    ipif->ipif_net_type,
472 			    ipif->ipif_resolver_mp,
473 			    ipif,
474 			    NULL,
475 			    0,
476 			    0,
477 			    flags,
478 			    &ire_uinfo_null,
479 			    NULL,
480 			    NULL);
481 			if (ire == NULL) {
482 				if (ipif_refheld)
483 					ipif_refrele(ipif);
484 				return (ENOMEM);
485 			}
486 			error = ire_add(&ire, q, mp, func, B_FALSE);
487 			if (error == 0)
488 				goto save_ire;
489 			/*
490 			 * In the result of failure, ire_add() will have already
491 			 * deleted the ire in question, so there is no need to
492 			 * do that here.
493 			 */
494 			if (ipif_refheld)
495 				ipif_refrele(ipif);
496 			return (error);
497 		}
498 	}
499 
500 	/*
501 	 * Traditionally, interface routes are ones where RTF_GATEWAY isn't set
502 	 * and the gateway address provided is one of the system's interface
503 	 * addresses.  By using the routing socket interface and supplying an
504 	 * RTA_IFP sockaddr with an interface index, an alternate method of
505 	 * specifying an interface route to be created is available which uses
506 	 * the interface index that specifies the outgoing interface rather than
507 	 * the address of an outgoing interface (which may not be able to
508 	 * uniquely identify an interface).  When coupled with the RTF_GATEWAY
509 	 * flag, routes can be specified which not only specify the next-hop to
510 	 * be used when routing to a certain prefix, but also which outgoing
511 	 * interface should be used.
512 	 *
513 	 * Previously, interfaces would have unique addresses assigned to them
514 	 * and so the address assigned to a particular interface could be used
515 	 * to identify a particular interface.  One exception to this was the
516 	 * case of an unnumbered interface (where IPIF_UNNUMBERED was set).
517 	 *
518 	 * With the advent of IPv6 and its link-local addresses, this
519 	 * restriction was relaxed and interfaces could share addresses between
520 	 * themselves.  In fact, typically all of the link-local interfaces on
521 	 * an IPv6 node or router will have the same link-local address.  In
522 	 * order to differentiate between these interfaces, the use of an
523 	 * interface index is necessary and this index can be carried inside a
524 	 * RTA_IFP sockaddr (which is actually a sockaddr_dl).  One restriction
525 	 * of using the interface index, however, is that all of the ipif's that
526 	 * are part of an ill have the same index and so the RTA_IFP sockaddr
527 	 * cannot be used to differentiate between ipif's (or logical
528 	 * interfaces) that belong to the same ill (physical interface).
529 	 *
530 	 * For example, in the following case involving IPv4 interfaces and
531 	 * logical interfaces
532 	 *
533 	 *	192.0.2.32	255.255.255.224	192.0.2.33	U	if0
534 	 *	192.0.2.32	255.255.255.224	192.0.2.34	U	if0:1
535 	 *	192.0.2.32	255.255.255.224	192.0.2.35	U	if0:2
536 	 *
537 	 * the ipif's corresponding to each of these interface routes can be
538 	 * uniquely identified by the "gateway" (actually interface address).
539 	 *
540 	 * In this case involving multiple IPv6 default routes to a particular
541 	 * link-local gateway, the use of RTA_IFP is necessary to specify which
542 	 * default route is of interest:
543 	 *
544 	 *	default		fe80::123:4567:89ab:cdef	U	if0
545 	 *	default		fe80::123:4567:89ab:cdef	U	if1
546 	 */
547 
548 	/* RTF_GATEWAY not set */
549 	if (!(flags & RTF_GATEWAY)) {
550 		queue_t	*stq;
551 
552 		if (sp != NULL) {
553 			ip2dbg(("ip_rt_add_v6: gateway security attributes "
554 			    "cannot be set with interface route\n"));
555 			if (ipif_refheld)
556 				ipif_refrele(ipif);
557 			return (EINVAL);
558 		}
559 
560 		/*
561 		 * As the interface index specified with the RTA_IFP sockaddr is
562 		 * the same for all ipif's off of an ill, the matching logic
563 		 * below uses MATCH_IRE_ILL if such an index was specified.
564 		 * This means that routes sharing the same prefix when added
565 		 * using a RTA_IFP sockaddr must have distinct interface
566 		 * indices (namely, they must be on distinct ill's).
567 		 *
568 		 * On the other hand, since the gateway address will usually be
569 		 * different for each ipif on the system, the matching logic
570 		 * uses MATCH_IRE_IPIF in the case of a traditional interface
571 		 * route.  This means that interface routes for the same prefix
572 		 * can be created if they belong to distinct ipif's and if a
573 		 * RTA_IFP sockaddr is not present.
574 		 */
575 		if (ipif_arg != NULL) {
576 			if (ipif_refheld) {
577 				ipif_refrele(ipif);
578 				ipif_refheld = B_FALSE;
579 			}
580 			ipif = ipif_arg;
581 			match_flags |= MATCH_IRE_ILL;
582 		} else {
583 			/*
584 			 * Check the ipif corresponding to the gw_addr
585 			 */
586 			if (ipif == NULL)
587 				return (ENETUNREACH);
588 			match_flags |= MATCH_IRE_IPIF;
589 		}
590 
591 		ASSERT(ipif != NULL);
592 		/*
593 		 * We check for an existing entry at this point.
594 		 */
595 		match_flags |= MATCH_IRE_MASK;
596 		ire = ire_ftable_lookup_v6(dst_addr, mask, 0, IRE_INTERFACE,
597 		    ipif, NULL, ALL_ZONES, 0, NULL, match_flags);
598 		if (ire != NULL) {
599 			ire_refrele(ire);
600 			if (ipif_refheld)
601 				ipif_refrele(ipif);
602 			return (EEXIST);
603 		}
604 
605 		stq = (ipif->ipif_net_type == IRE_IF_RESOLVER)
606 		    ? ipif->ipif_rq : ipif->ipif_wq;
607 
608 		/*
609 		 * Create a copy of the IRE_LOOPBACK, IRE_IF_NORESOLVER or
610 		 * IRE_IF_RESOLVER with the modified address and netmask.
611 		 */
612 		ire = ire_create_v6(
613 		    dst_addr,
614 		    mask,
615 		    &ipif->ipif_v6src_addr,
616 		    NULL,
617 		    &ipif->ipif_mtu,
618 		    NULL,
619 		    NULL,
620 		    stq,
621 		    ipif->ipif_net_type,
622 		    ipif->ipif_resolver_mp,
623 		    ipif,
624 		    NULL,
625 		    0,
626 		    0,
627 		    flags,
628 		    &ire_uinfo_null,
629 		    NULL,
630 		    NULL);
631 		if (ire == NULL) {
632 			if (ipif_refheld)
633 				ipif_refrele(ipif);
634 			return (ENOMEM);
635 		}
636 
637 		/*
638 		 * Some software (for example, GateD and Sun Cluster) attempts
639 		 * to create (what amount to) IRE_PREFIX routes with the
640 		 * loopback address as the gateway.  This is primarily done to
641 		 * set up prefixes with the RTF_REJECT flag set (for example,
642 		 * when generating aggregate routes.)
643 		 *
644 		 * If the IRE type (as defined by ipif->ipif_net_type) is
645 		 * IRE_LOOPBACK, then we map the request into a
646 		 * IRE_IF_NORESOLVER.
647 		 *
648 		 * Needless to say, the real IRE_LOOPBACK is NOT created by this
649 		 * routine, but rather using ire_create_v6() directly.
650 		 */
651 		if (ipif->ipif_net_type == IRE_LOOPBACK)
652 			ire->ire_type = IRE_IF_NORESOLVER;
653 		error = ire_add(&ire, q, mp, func, B_FALSE);
654 		if (error == 0)
655 			goto save_ire;
656 		/*
657 		 * In the result of failure, ire_add() will have already
658 		 * deleted the ire in question, so there is no need to
659 		 * do that here.
660 		 */
661 		if (ipif_refheld)
662 			ipif_refrele(ipif);
663 		return (error);
664 	}
665 	if (ipif_refheld) {
666 		ipif_refrele(ipif);
667 		ipif_refheld = B_FALSE;
668 	}
669 
670 	/*
671 	 * Get an interface IRE for the specified gateway.
672 	 * If we don't have an IRE_IF_NORESOLVER or IRE_IF_RESOLVER for the
673 	 * gateway, it is currently unreachable and we fail the request
674 	 * accordingly.
675 	 */
676 	ipif = ipif_arg;
677 	if (ipif_arg != NULL)
678 		match_flags |= MATCH_IRE_ILL;
679 	gw_ire = ire_ftable_lookup_v6(gw_addr, 0, 0, IRE_INTERFACE, ipif_arg,
680 	    NULL, ALL_ZONES, 0, NULL, match_flags);
681 	if (gw_ire == NULL)
682 		return (ENETUNREACH);
683 
684 	/*
685 	 * We create one of three types of IREs as a result of this request
686 	 * based on the netmask.  A netmask of all ones (which is automatically
687 	 * assumed when RTF_HOST is set) results in an IRE_HOST being created.
688 	 * An all zeroes netmask implies a default route so an IRE_DEFAULT is
689 	 * created.  Otherwise, an IRE_PREFIX route is created for the
690 	 * destination prefix.
691 	 */
692 	if (IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones))
693 		type = IRE_HOST;
694 	else if (IN6_IS_ADDR_UNSPECIFIED(mask))
695 		type = IRE_DEFAULT;
696 	else
697 		type = IRE_PREFIX;
698 
699 	/* check for a duplicate entry */
700 	ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr, type, ipif_arg,
701 	    NULL, ALL_ZONES, 0, NULL,
702 	    match_flags | MATCH_IRE_MASK | MATCH_IRE_GW);
703 	if (ire != NULL) {
704 		ire_refrele(gw_ire);
705 		ire_refrele(ire);
706 		return (EEXIST);
707 	}
708 
709 	/* Security attribute exists */
710 	if (sp != NULL) {
711 		tsol_gcgrp_addr_t ga;
712 
713 		/* find or create the gateway credentials group */
714 		ga.ga_af = AF_INET6;
715 		ga.ga_addr = *gw_addr;
716 
717 		/* we hold reference to it upon success */
718 		gcgrp = gcgrp_lookup(&ga, B_TRUE);
719 		if (gcgrp == NULL) {
720 			ire_refrele(gw_ire);
721 			return (ENOMEM);
722 		}
723 
724 		/*
725 		 * Create and add the security attribute to the group; a
726 		 * reference to the group is made upon allocating a new
727 		 * entry successfully.  If it finds an already-existing
728 		 * entry for the security attribute in the group, it simply
729 		 * returns it and no new reference is made to the group.
730 		 */
731 		gc = gc_create(sp, gcgrp, &gcgrp_xtraref);
732 		if (gc == NULL) {
733 			/* release reference held by gcgrp_lookup */
734 			GCGRP_REFRELE(gcgrp);
735 			ire_refrele(gw_ire);
736 			return (ENOMEM);
737 		}
738 	}
739 
740 	/* Create the IRE. */
741 	ire = ire_create_v6(
742 	    dst_addr,				/* dest address */
743 	    mask,				/* mask */
744 	    /* src address assigned by the caller? */
745 	    (((flags & RTF_SETSRC) && !IN6_IS_ADDR_UNSPECIFIED(src_addr)) ?
746 		src_addr : NULL),
747 	    gw_addr,				/* gateway address */
748 	    &gw_ire->ire_max_frag,
749 	    NULL,				/* no Fast Path header */
750 	    NULL,				/* no recv-from queue */
751 	    NULL,				/* no send-to queue */
752 	    (ushort_t)type,			/* IRE type */
753 	    NULL,
754 	    ipif_arg,
755 	    NULL,
756 	    0,
757 	    0,
758 	    flags,
759 	    &gw_ire->ire_uinfo,			/* Inherit ULP info from gw */
760 	    gc,					/* security attribute */
761 	    NULL);
762 	/*
763 	 * The ire holds a reference to the 'gc' and the 'gc' holds a
764 	 * reference to the 'gcgrp'. We can now release the extra reference
765 	 * the 'gcgrp' acquired in the gcgrp_lookup, if it was not used.
766 	 */
767 	if (gcgrp_xtraref)
768 		GCGRP_REFRELE(gcgrp);
769 	if (ire == NULL) {
770 		if (gc != NULL)
771 			GC_REFRELE(gc);
772 		ire_refrele(gw_ire);
773 		return (ENOMEM);
774 	}
775 
776 	/*
777 	 * POLICY: should we allow an RTF_HOST with address INADDR_ANY?
778 	 * SUN/OS socket stuff does but do we really want to allow ::0 ?
779 	 */
780 
781 	/* Add the new IRE. */
782 	error = ire_add(&ire, q, mp, func, B_FALSE);
783 	/*
784 	 * In the result of failure, ire_add() will have already
785 	 * deleted the ire in question, so there is no need to
786 	 * do that here.
787 	 */
788 	if (error != 0) {
789 		ire_refrele(gw_ire);
790 		return (error);
791 	}
792 
793 	if (flags & RTF_MULTIRT) {
794 		/*
795 		 * Invoke the CGTP (multirouting) filtering module
796 		 * to add the dst address in the filtering database.
797 		 * Replicated inbound packets coming from that address
798 		 * will be filtered to discard the duplicates.
799 		 * It is not necessary to call the CGTP filter hook
800 		 * when the dst address is a multicast, because an
801 		 * IP source address cannot be a multicast.
802 		 */
803 		if ((ip_cgtp_filter_ops != NULL) &&
804 		    !IN6_IS_ADDR_MULTICAST(&(ire->ire_addr_v6))) {
805 			int res = ip_cgtp_filter_ops->cfo_add_dest_v6(
806 			    &ire->ire_addr_v6,
807 			    &ire->ire_gateway_addr_v6,
808 			    &ire->ire_src_addr_v6,
809 			    &gw_ire->ire_src_addr_v6);
810 			if (res != 0) {
811 				ire_refrele(gw_ire);
812 				ire_delete(ire);
813 				return (res);
814 			}
815 		}
816 	}
817 
818 	/*
819 	 * Now that the prefix IRE entry has been created, delete any
820 	 * existing gateway IRE cache entries as well as any IRE caches
821 	 * using the gateway, and force them to be created through
822 	 * ip_newroute_v6.
823 	 */
824 	if (gc != NULL) {
825 		ASSERT(gcgrp != NULL);
826 		ire_clookup_delete_cache_gw_v6(gw_addr, ALL_ZONES);
827 	}
828 
829 save_ire:
830 	if (gw_ire != NULL) {
831 		ire_refrele(gw_ire);
832 	}
833 	if (ipif != NULL) {
834 		mblk_t	*save_mp;
835 
836 		/*
837 		 * Save enough information so that we can recreate the IRE if
838 		 * the interface goes down and then up.  The metrics associated
839 		 * with the route will be saved as well when rts_setmetrics() is
840 		 * called after the IRE has been created.  In the case where
841 		 * memory cannot be allocated, none of this information will be
842 		 * saved.
843 		 */
844 		save_mp = allocb(sizeof (ifrt_t), BPRI_MED);
845 		if (save_mp != NULL) {
846 			ifrt_t	*ifrt;
847 
848 			save_mp->b_wptr += sizeof (ifrt_t);
849 			ifrt = (ifrt_t *)save_mp->b_rptr;
850 			bzero(ifrt, sizeof (ifrt_t));
851 			ifrt->ifrt_type = ire->ire_type;
852 			ifrt->ifrt_v6addr = ire->ire_addr_v6;
853 			mutex_enter(&ire->ire_lock);
854 			ifrt->ifrt_v6gateway_addr = ire->ire_gateway_addr_v6;
855 			ifrt->ifrt_v6src_addr = ire->ire_src_addr_v6;
856 			mutex_exit(&ire->ire_lock);
857 			ifrt->ifrt_v6mask = ire->ire_mask_v6;
858 			ifrt->ifrt_flags = ire->ire_flags;
859 			ifrt->ifrt_max_frag = ire->ire_max_frag;
860 			mutex_enter(&ipif->ipif_saved_ire_lock);
861 			save_mp->b_cont = ipif->ipif_saved_ire_mp;
862 			ipif->ipif_saved_ire_mp = save_mp;
863 			ipif->ipif_saved_ire_cnt++;
864 			mutex_exit(&ipif->ipif_saved_ire_lock);
865 		}
866 	}
867 	if (ire_arg != NULL) {
868 		/*
869 		 * Store the ire that was successfully added into where ire_arg
870 		 * points to so that callers don't have to look it up
871 		 * themselves (but they are responsible for ire_refrele()ing
872 		 * the ire when they are finished with it).
873 		 */
874 		*ire_arg = ire;
875 	} else {
876 		ire_refrele(ire);		/* Held in ire_add */
877 	}
878 	if (ipif_refheld)
879 		ipif_refrele(ipif);
880 	return (0);
881 }
882 
883 /*
884  * ip_rt_delete_v6 is called to delete an IPv6 route.
885  * ipif_arg is passed in to associate it with the correct interface
886  * (for link-local destinations and gateways).
887  */
888 /* ARGSUSED4 */
889 int
890 ip_rt_delete_v6(const in6_addr_t *dst_addr, const in6_addr_t *mask,
891     const in6_addr_t *gw_addr, uint_t rtm_addrs, int flags, ipif_t *ipif_arg,
892     queue_t *q, mblk_t *mp, ipsq_func_t func)
893 {
894 	ire_t	*ire = NULL;
895 	ipif_t	*ipif;
896 	uint_t	type;
897 	uint_t	match_flags = MATCH_IRE_TYPE;
898 	int	err = 0;
899 	boolean_t	ipif_refheld = B_FALSE;
900 
901 	/*
902 	 * If this is the case of RTF_HOST being set, then we set the netmask
903 	 * to all ones.  Otherwise, we use the netmask if one was supplied.
904 	 */
905 	if (flags & RTF_HOST) {
906 		mask = &ipv6_all_ones;
907 		match_flags |= MATCH_IRE_MASK;
908 	} else if (rtm_addrs & RTA_NETMASK) {
909 		match_flags |= MATCH_IRE_MASK;
910 	}
911 
912 	/*
913 	 * Note that RTF_GATEWAY is never set on a delete, therefore
914 	 * we check if the gateway address is one of our interfaces first,
915 	 * and fall back on RTF_GATEWAY routes.
916 	 *
917 	 * This makes it possible to delete an original
918 	 * IRE_IF_NORESOLVER/IRE_IF_RESOLVER - consistent with SunOS 4.1.
919 	 *
920 	 * As the interface index specified with the RTA_IFP sockaddr is the
921 	 * same for all ipif's off of an ill, the matching logic below uses
922 	 * MATCH_IRE_ILL if such an index was specified.  This means a route
923 	 * sharing the same prefix and interface index as the the route
924 	 * intended to be deleted might be deleted instead if a RTA_IFP sockaddr
925 	 * is specified in the request.
926 	 *
927 	 * On the other hand, since the gateway address will usually be
928 	 * different for each ipif on the system, the matching logic
929 	 * uses MATCH_IRE_IPIF in the case of a traditional interface
930 	 * route.  This means that interface routes for the same prefix can be
931 	 * uniquely identified if they belong to distinct ipif's and if a
932 	 * RTA_IFP sockaddr is not present.
933 	 *
934 	 * For more detail on specifying routes by gateway address and by
935 	 * interface index, see the comments in ip_rt_add_v6().
936 	 */
937 	ipif = ipif_lookup_interface_v6(gw_addr, dst_addr, q, mp, func, &err);
938 	if (ipif != NULL) {
939 		ipif_refheld = B_TRUE;
940 		if (ipif_arg != NULL) {
941 			ipif_refrele(ipif);
942 			ipif_refheld = B_FALSE;
943 			ipif = ipif_arg;
944 			match_flags |= MATCH_IRE_ILL;
945 		} else {
946 			match_flags |= MATCH_IRE_IPIF;
947 		}
948 
949 		if (ipif->ipif_ire_type == IRE_LOOPBACK)
950 			ire = ire_ctable_lookup_v6(dst_addr, 0, IRE_LOOPBACK,
951 			    ipif, ALL_ZONES, NULL, match_flags);
952 		if (ire == NULL)
953 			ire = ire_ftable_lookup_v6(dst_addr, mask, 0,
954 			    IRE_INTERFACE, ipif, NULL, ALL_ZONES, 0, NULL,
955 			    match_flags);
956 	} else if (err == EINPROGRESS) {
957 		return (err);
958 	} else {
959 		err = 0;
960 	}
961 	if (ire == NULL) {
962 		/*
963 		 * At this point, the gateway address is not one of our own
964 		 * addresses or a matching interface route was not found.  We
965 		 * set the IRE type to lookup based on whether
966 		 * this is a host route, a default route or just a prefix.
967 		 *
968 		 * If an ipif_arg was passed in, then the lookup is based on an
969 		 * interface index so MATCH_IRE_ILL is added to match_flags.
970 		 * In any case, MATCH_IRE_IPIF is cleared and MATCH_IRE_GW is
971 		 * set as the route being looked up is not a traditional
972 		 * interface route.
973 		 */
974 		match_flags &= ~MATCH_IRE_IPIF;
975 		match_flags |= MATCH_IRE_GW;
976 		if (ipif_arg != NULL)
977 			match_flags |= MATCH_IRE_ILL;
978 		if (IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones))
979 			type = IRE_HOST;
980 		else if (IN6_IS_ADDR_UNSPECIFIED(mask))
981 			type = IRE_DEFAULT;
982 		else
983 			type = IRE_PREFIX;
984 		ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr, type,
985 		    ipif_arg, NULL, ALL_ZONES, 0, NULL, match_flags);
986 		if (ire == NULL && type == IRE_HOST) {
987 			ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr,
988 			    IRE_HOST_REDIRECT, ipif_arg, NULL, ALL_ZONES, 0,
989 			    NULL, match_flags);
990 		}
991 	}
992 
993 	if (ipif_refheld) {
994 		ipif_refrele(ipif);
995 		ipif_refheld = B_FALSE;
996 	}
997 	if (ire == NULL)
998 		return (ESRCH);
999 
1000 	if (ire->ire_flags & RTF_MULTIRT) {
1001 		/*
1002 		 * Invoke the CGTP (multirouting) filtering module
1003 		 * to remove the dst address from the filtering database.
1004 		 * Packets coming from that address will no longer be
1005 		 * filtered to remove duplicates.
1006 		 */
1007 		if (ip_cgtp_filter_ops != NULL) {
1008 			err = ip_cgtp_filter_ops->cfo_del_dest_v6(
1009 			    &ire->ire_addr_v6, &ire->ire_gateway_addr_v6);
1010 		}
1011 	}
1012 
1013 	ipif = ire->ire_ipif;
1014 	if (ipif != NULL) {
1015 		mblk_t		**mpp;
1016 		mblk_t		*mp;
1017 		ifrt_t		*ifrt;
1018 		in6_addr_t	gw_addr_v6;
1019 
1020 		/* Remove from ipif_saved_ire_mp list if it is there */
1021 		mutex_enter(&ire->ire_lock);
1022 		gw_addr_v6 = ire->ire_gateway_addr_v6;
1023 		mutex_exit(&ire->ire_lock);
1024 		mutex_enter(&ipif->ipif_saved_ire_lock);
1025 		for (mpp = &ipif->ipif_saved_ire_mp; *mpp != NULL;
1026 		    mpp = &(*mpp)->b_cont) {
1027 			/*
1028 			 * On a given ipif, the triple of address, gateway and
1029 			 * mask is unique for each saved IRE (in the case of
1030 			 * ordinary interface routes, the gateway address is
1031 			 * all-zeroes).
1032 			 */
1033 			mp = *mpp;
1034 			ifrt = (ifrt_t *)mp->b_rptr;
1035 			if (IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6addr,
1036 			    &ire->ire_addr_v6) &&
1037 			    IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6gateway_addr,
1038 			    &gw_addr_v6) &&
1039 			    IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6mask,
1040 			    &ire->ire_mask_v6)) {
1041 				*mpp = mp->b_cont;
1042 				ipif->ipif_saved_ire_cnt--;
1043 				freeb(mp);
1044 				break;
1045 			}
1046 		}
1047 		mutex_exit(&ipif->ipif_saved_ire_lock);
1048 	}
1049 	ire_delete(ire);
1050 	ire_refrele(ire);
1051 	return (err);
1052 }
1053 
1054 /*
1055  * Derive a token from the link layer address.
1056  */
1057 boolean_t
1058 ill_setdefaulttoken(ill_t *ill)
1059 {
1060 	int 		i;
1061 	in6_addr_t	v6addr, v6mask;
1062 
1063 	/*
1064 	 * Though we execute on the ipsq, we need to hold the ill_lock
1065 	 * to prevent readers from seeing partially updated values
1066 	 * while we do the update.
1067 	 */
1068 	mutex_enter(&ill->ill_lock);
1069 	if (!MEDIA_V6INTFID(ill->ill_media, ill->ill_phys_addr_length,
1070 	    ill->ill_phys_addr, &v6addr)) {
1071 		mutex_exit(&ill->ill_lock);
1072 		return (B_FALSE);
1073 	}
1074 
1075 	(void) ip_plen_to_mask_v6(IPV6_TOKEN_LEN, &v6mask);
1076 
1077 	for (i = 0; i < 4; i++)
1078 		v6mask.s6_addr32[i] = v6mask.s6_addr32[i] ^
1079 		    (uint32_t)0xffffffff;
1080 
1081 	V6_MASK_COPY(v6addr, v6mask, ill->ill_token);
1082 	ill->ill_token_length = IPV6_TOKEN_LEN;
1083 	mutex_exit(&ill->ill_lock);
1084 	return (B_TRUE);
1085 }
1086 
1087 /*
1088  * Create a link-local address from a token.
1089  */
1090 static void
1091 ipif_get_linklocal(in6_addr_t *dest, const in6_addr_t *token)
1092 {
1093 	int i;
1094 
1095 	for (i = 0; i < 4; i++) {
1096 		dest->s6_addr32[i] =
1097 		    token->s6_addr32[i] | ipv6_ll_template.s6_addr32[i];
1098 	}
1099 }
1100 
1101 /*
1102  * Set a nice default address for either automatic tunnels tsrc/96 or
1103  * 6to4 tunnels 2002:<tsrc>::1/64
1104  */
1105 static void
1106 ipif_set_tun_auto_addr(ipif_t *ipif, struct iftun_req *ta)
1107 {
1108 	sin6_t	sin6;
1109 	sin_t	*sin;
1110 	ill_t 	*ill = ipif->ipif_ill;
1111 	tun_t *tp = (tun_t *)ill->ill_wq->q_next->q_ptr;
1112 
1113 	if (ta->ifta_saddr.ss_family != AF_INET ||
1114 	    (ipif->ipif_flags & IPIF_UP) || !ipif->ipif_isv6 ||
1115 	    (ta->ifta_flags & IFTUN_SRC) == 0)
1116 		return;
1117 
1118 	/*
1119 	 * Check the tunnel type by examining q_next->q_ptr
1120 	 */
1121 	if (tp->tun_flags & TUN_AUTOMATIC) {
1122 		/* this is an automatic tunnel */
1123 		(void) ip_plen_to_mask_v6(IPV6_ABITS - IP_ABITS,
1124 		    &ipif->ipif_v6net_mask);
1125 		bzero(&sin6, sizeof (sin6_t));
1126 		sin = (sin_t *)&ta->ifta_saddr;
1127 		V4_PART_OF_V6(sin6.sin6_addr) = sin->sin_addr.s_addr;
1128 		sin6.sin6_family = AF_INET6;
1129 		(void) ip_sioctl_addr(ipif, (sin_t *)&sin6,
1130 		    NULL, NULL, NULL, NULL);
1131 	} else if (tp->tun_flags & TUN_6TO4) {
1132 		/* this is a 6to4 tunnel */
1133 		(void) ip_plen_to_mask_v6(IPV6_PREFIX_LEN,
1134 		    &ipif->ipif_v6net_mask);
1135 		sin = (sin_t *)&ta->ifta_saddr;
1136 		/* create a 6to4 address from the IPv4 tsrc */
1137 		IN6_V4ADDR_TO_6TO4(&sin->sin_addr, &sin6.sin6_addr);
1138 		sin6.sin6_family = AF_INET6;
1139 		(void) ip_sioctl_addr(ipif, (sin_t *)&sin6,
1140 		    NULL, NULL, NULL, NULL);
1141 	} else {
1142 		ip1dbg(("ipif_set_tun_auto_addr: Unknown tunnel type"));
1143 		return;
1144 	}
1145 }
1146 
1147 /*
1148  * Set link local for ipif_id 0 of a configured tunnel based on the
1149  * tsrc or tdst parameter
1150  * For tunnels over IPv4 use the IPv4 address prepended with 32 zeros as
1151  * the token.
1152  * For tunnels over IPv6 use the low-order 64 bits of the "inner" IPv6 address
1153  * as the token for the "outer" link.
1154  */
1155 void
1156 ipif_set_tun_llink(ill_t *ill, struct iftun_req *ta)
1157 {
1158 	ipif_t		*ipif;
1159 	sin_t		*sin;
1160 	in6_addr_t	*s6addr;
1161 
1162 	ASSERT(IAM_WRITER_ILL(ill));
1163 
1164 	/* The first ipif must be id zero. */
1165 	ipif = ill->ill_ipif;
1166 	ASSERT(ipif->ipif_id == 0);
1167 
1168 	/* no link local for automatic tunnels */
1169 	if (!(ipif->ipif_flags & IPIF_POINTOPOINT)) {
1170 		ipif_set_tun_auto_addr(ipif, ta);
1171 		return;
1172 	}
1173 
1174 	if ((ta->ifta_flags & IFTUN_DST) &&
1175 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6pp_dst_addr)) {
1176 		sin6_t	sin6;
1177 
1178 		ASSERT(!(ipif->ipif_flags & IPIF_UP));
1179 		bzero(&sin6, sizeof (sin6_t));
1180 		if ((ta->ifta_saddr.ss_family == AF_INET)) {
1181 			sin = (sin_t *)&ta->ifta_daddr;
1182 			V4_PART_OF_V6(sin6.sin6_addr) =
1183 			    sin->sin_addr.s_addr;
1184 		} else {
1185 			s6addr =
1186 			    &((sin6_t *)&ta->ifta_daddr)->sin6_addr;
1187 			sin6.sin6_addr.s6_addr32[3] = s6addr->s6_addr32[3];
1188 			sin6.sin6_addr.s6_addr32[2] = s6addr->s6_addr32[2];
1189 		}
1190 		ipif_get_linklocal(&ipif->ipif_v6pp_dst_addr,
1191 		    &sin6.sin6_addr);
1192 		ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr;
1193 	}
1194 	if ((ta->ifta_flags & IFTUN_SRC)) {
1195 		ASSERT(!(ipif->ipif_flags & IPIF_UP));
1196 
1197 		/* Set the token if it isn't already set */
1198 		if (IN6_IS_ADDR_UNSPECIFIED(&ill->ill_token)) {
1199 			if ((ta->ifta_saddr.ss_family == AF_INET)) {
1200 				sin = (sin_t *)&ta->ifta_saddr;
1201 				V4_PART_OF_V6(ill->ill_token) =
1202 				    sin->sin_addr.s_addr;
1203 			} else {
1204 				s6addr =
1205 				    &((sin6_t *)&ta->ifta_saddr)->sin6_addr;
1206 				ill->ill_token.s6_addr32[3] =
1207 				    s6addr->s6_addr32[3];
1208 				ill->ill_token.s6_addr32[2] =
1209 				    s6addr->s6_addr32[2];
1210 			}
1211 			ill->ill_token_length = IPV6_TOKEN_LEN;
1212 		}
1213 		/*
1214 		 * Attempt to set the link local address if it isn't set.
1215 		 */
1216 		if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr))
1217 			(void) ipif_setlinklocal(ipif);
1218 	}
1219 }
1220 
1221 /*
1222  * Is it not possible to set the link local address?
1223  * The address can be set if the token is set, and the token
1224  * isn't too long.
1225  * Return B_TRUE if the address can't be set, or B_FALSE if it can.
1226  */
1227 boolean_t
1228 ipif_cant_setlinklocal(ipif_t *ipif)
1229 {
1230 	ill_t *ill = ipif->ipif_ill;
1231 
1232 	if (IN6_IS_ADDR_UNSPECIFIED(&ill->ill_token) ||
1233 	    ill->ill_token_length > IPV6_ABITS - IPV6_LL_PREFIXLEN)
1234 		return (B_TRUE);
1235 
1236 	return (B_FALSE);
1237 }
1238 
1239 /*
1240  * Generate a link-local address from the token.
1241  * Return zero if the address was set, or non-zero if it couldn't be set.
1242  */
1243 int
1244 ipif_setlinklocal(ipif_t *ipif)
1245 {
1246 	ill_t *ill = ipif->ipif_ill;
1247 
1248 	ASSERT(IAM_WRITER_ILL(ill));
1249 
1250 	if (ipif_cant_setlinklocal(ipif))
1251 		return (-1);
1252 
1253 	ipif_get_linklocal(&ipif->ipif_v6lcl_addr, &ill->ill_token);
1254 	(void) ip_plen_to_mask_v6(IPV6_LL_PREFIXLEN, &ipif->ipif_v6net_mask);
1255 	V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
1256 	    ipif->ipif_v6subnet);
1257 
1258 	if (ipif->ipif_flags & IPIF_NOLOCAL) {
1259 		ipif->ipif_v6src_addr = ipv6_all_zeros;
1260 	} else {
1261 		ipif->ipif_v6src_addr = ipif->ipif_v6lcl_addr;
1262 	}
1263 	return (0);
1264 }
1265 
1266 /*
1267  * This function sets up the multicast mappings in NDP.
1268  * Unlike ARP, there are no mapping_mps here. We delete the
1269  * mapping nces and add a new one.
1270  *
1271  * Returns non-zero on error and 0 on success.
1272  */
1273 int
1274 ipif_ndp_setup_multicast(ipif_t *ipif, nce_t **ret_nce)
1275 {
1276 	ill_t		*ill = ipif->ipif_ill;
1277 	in6_addr_t	v6_mcast_addr = {(uint32_t)V6_MCAST, 0, 0, 0};
1278 	in6_addr_t	v6_mcast_mask = {(uint32_t)V6_MCAST, 0, 0, 0};
1279 	in6_addr_t	v6_extract_mask;
1280 	uchar_t		*phys_addr, *bphys_addr, *alloc_phys;
1281 	nce_t		*mnce = NULL;
1282 	int		err = 0;
1283 	phyint_t	*phyi = ill->ill_phyint;
1284 	uint32_t	hw_extract_start;
1285 	dl_unitdata_req_t *dlur;
1286 
1287 	if (ret_nce != NULL)
1288 		*ret_nce = NULL;
1289 	/*
1290 	 * Delete the mapping nce. Normally these should not exist
1291 	 * as a previous ipif_down -> ipif_ndp_down should have deleted
1292 	 * all the nces. But they can exist if ip_rput_dlpi_writer
1293 	 * calls this when PHYI_MULTI_BCAST is set.
1294 	 */
1295 	mnce = ndp_lookup_v6(ill, &v6_mcast_addr, B_FALSE);
1296 	if (mnce != NULL) {
1297 		ndp_delete(mnce);
1298 		NCE_REFRELE(mnce);
1299 		mnce = NULL;
1300 	}
1301 
1302 	/*
1303 	 * Get media specific v6 mapping information. Note that
1304 	 * nd_lla_len can be 0 for tunnels.
1305 	 */
1306 	alloc_phys = kmem_alloc(ill->ill_nd_lla_len, KM_NOSLEEP);
1307 	if ((alloc_phys == NULL) && (ill->ill_nd_lla_len != 0))
1308 		return (ENOMEM);
1309 	/*
1310 	 * Determine the broadcast address.
1311 	 */
1312 	dlur = (dl_unitdata_req_t *)ill->ill_bcast_mp->b_rptr;
1313 	if (ill->ill_sap_length < 0)
1314 		bphys_addr = (uchar_t *)dlur + dlur->dl_dest_addr_offset;
1315 	else
1316 		bphys_addr = (uchar_t *)dlur +
1317 		    dlur->dl_dest_addr_offset + ill->ill_sap_length;
1318 
1319 	/*
1320 	 * Check PHYI_MULTI_BCAST and possible length of physical
1321 	 * address to determine if we use the mapping or the
1322 	 * broadcast address.
1323 	 */
1324 	if ((phyi->phyint_flags & PHYI_MULTI_BCAST) ||
1325 	    (!MEDIA_V6MINFO(ill->ill_media, ill->ill_nd_lla_len,
1326 	    bphys_addr, alloc_phys, &hw_extract_start,
1327 	    &v6_extract_mask))) {
1328 		if (ill->ill_phys_addr_length > IP_MAX_HW_LEN) {
1329 			kmem_free(alloc_phys, ill->ill_nd_lla_len);
1330 			return (E2BIG);
1331 		}
1332 		/* Use the link-layer broadcast address for MULTI_BCAST */
1333 		phys_addr = bphys_addr;
1334 		bzero(&v6_extract_mask, sizeof (v6_extract_mask));
1335 		hw_extract_start = ill->ill_nd_lla_len;
1336 	} else {
1337 		phys_addr = alloc_phys;
1338 	}
1339 	if ((ipif->ipif_flags & IPIF_BROADCAST) ||
1340 	    (ill->ill_flags & ILLF_MULTICAST) ||
1341 	    (phyi->phyint_flags & PHYI_MULTI_BCAST)) {
1342 		mutex_enter(&ndp6.ndp_g_lock);
1343 		err = ndp_add(ill,
1344 		    phys_addr,
1345 		    &v6_mcast_addr,	/* v6 address */
1346 		    &v6_mcast_mask,	/* v6 mask */
1347 		    &v6_extract_mask,
1348 		    hw_extract_start,
1349 		    NCE_F_MAPPING | NCE_F_PERMANENT | NCE_F_NONUD,
1350 		    ND_REACHABLE,
1351 		    &mnce,
1352 		    NULL,
1353 		    NULL);
1354 		mutex_exit(&ndp6.ndp_g_lock);
1355 		if (err == 0) {
1356 			if (ret_nce != NULL) {
1357 				*ret_nce = mnce;
1358 			} else {
1359 				NCE_REFRELE(mnce);
1360 			}
1361 		}
1362 	}
1363 	kmem_free(alloc_phys, ill->ill_nd_lla_len);
1364 	return (err);
1365 }
1366 
1367 /*
1368  * Get the resolver set up for a new interface address.  (Always called
1369  * as writer.)
1370  */
1371 int
1372 ipif_ndp_up(ipif_t *ipif, const in6_addr_t *addr, boolean_t macaddr_change)
1373 {
1374 	ill_t		*ill = ipif->ipif_ill;
1375 	int		err = 0;
1376 	nce_t		*nce = NULL;
1377 	nce_t		*mnce = NULL;
1378 
1379 	ip1dbg(("ipif_ndp_up(%s:%u)\n",
1380 		ipif->ipif_ill->ill_name, ipif->ipif_id));
1381 
1382 	/*
1383 	 * ND not supported on XRESOLV interfaces. If ND support (multicast)
1384 	 * added later, take out this check.
1385 	 */
1386 	if ((ill->ill_flags & ILLF_XRESOLV) ||
1387 	    IN6_IS_ADDR_UNSPECIFIED(addr) ||
1388 	    (!(ill->ill_net_type & IRE_INTERFACE))) {
1389 		ipif->ipif_addr_ready = 1;
1390 		return (0);
1391 	}
1392 
1393 	/*
1394 	 * Need to setup multicast mapping only when the first
1395 	 * interface is coming UP.
1396 	 */
1397 	if (ill->ill_ipif_up_count == 0 &&
1398 	    (ill->ill_flags & ILLF_MULTICAST)) {
1399 		/*
1400 		 * We set the multicast before setting up the mapping for
1401 		 * local address because ipif_ndp_setup_multicast does
1402 		 * ndp_walk to delete nces which will delete the mapping
1403 		 * for local address also if we added the mapping for
1404 		 * local address first.
1405 		 */
1406 		err = ipif_ndp_setup_multicast(ipif, &mnce);
1407 		if (err != 0)
1408 			return (err);
1409 	}
1410 
1411 	if ((ipif->ipif_flags & (IPIF_UNNUMBERED|IPIF_NOLOCAL)) == 0) {
1412 		uint16_t	flags;
1413 		uchar_t	*hw_addr = NULL;
1414 
1415 		/* Permanent entries don't need NUD */
1416 		flags = NCE_F_PERMANENT;
1417 		flags |= NCE_F_NONUD;
1418 		if (ill->ill_flags & ILLF_ROUTER)
1419 			flags |= NCE_F_ISROUTER;
1420 
1421 		if (ipif->ipif_flags & IPIF_ANYCAST)
1422 			flags |= NCE_F_ANYCAST;
1423 
1424 		if (ill->ill_net_type == IRE_IF_RESOLVER) {
1425 			hw_addr = ill->ill_nd_lla;
1426 
1427 			if (ill->ill_move_in_progress || macaddr_change) {
1428 				/*
1429 				 * Addresses are failing over to this ill.
1430 				 * Don't wait for NUD to see this change.
1431 				 * Publish our new link-layer address.
1432 				 */
1433 				flags |= NCE_F_UNSOL_ADV;
1434 			}
1435 		}
1436 		err = ndp_lookup_then_add(ill,
1437 		    hw_addr,
1438 		    addr,
1439 		    &ipv6_all_ones,
1440 		    &ipv6_all_zeros,
1441 		    0,
1442 		    flags,
1443 		    ND_PROBE,	/* Causes Duplicate Address Detection to run */
1444 		    &nce,
1445 		    NULL,
1446 		    NULL);
1447 		switch (err) {
1448 		case 0:
1449 			ip1dbg(("ipif_ndp_up: NCE created for %s\n",
1450 			    ill->ill_name));
1451 			ipif->ipif_addr_ready = 1;
1452 			break;
1453 		case EINPROGRESS:
1454 			ip1dbg(("ipif_ndp_up: running DAD now for %s\n",
1455 			    ill->ill_name));
1456 			break;
1457 		case EEXIST:
1458 			NCE_REFRELE(nce);
1459 			ip1dbg(("ipif_ndp_up: NCE already exists for %s\n",
1460 			    ill->ill_name));
1461 			if (mnce != NULL) {
1462 				ndp_delete(mnce);
1463 				NCE_REFRELE(mnce);
1464 			}
1465 			return (err);
1466 		default:
1467 			ip1dbg(("ipif_ndp_up: NCE creation failed %s\n",
1468 			    ill->ill_name));
1469 			if (mnce != NULL) {
1470 				ndp_delete(mnce);
1471 				NCE_REFRELE(mnce);
1472 			}
1473 			return (err);
1474 		}
1475 	} else {
1476 		/* No local NCE for this entry */
1477 		ipif->ipif_addr_ready = 1;
1478 	}
1479 	if (nce != NULL)
1480 		NCE_REFRELE(nce);
1481 	if (mnce != NULL)
1482 		NCE_REFRELE(mnce);
1483 	return (0);
1484 }
1485 
1486 /* Remove all cache entries for this logical interface */
1487 void
1488 ipif_ndp_down(ipif_t *ipif)
1489 {
1490 	nce_t	*nce;
1491 
1492 	if (ipif->ipif_isv6) {
1493 		nce = ndp_lookup_v6(ipif->ipif_ill, &ipif->ipif_v6lcl_addr,
1494 		    B_FALSE);
1495 		if (nce != NULL) {
1496 			ndp_delete(nce);
1497 			NCE_REFRELE(nce);
1498 		}
1499 	}
1500 	/*
1501 	 * Remove mapping and all other nces dependent on this ill
1502 	 * when the last ipif is going away.
1503 	 */
1504 	if (ipif->ipif_ill->ill_ipif_up_count == 0) {
1505 		ndp_walk(ipif->ipif_ill, (pfi_t)ndp_delete_per_ill,
1506 		    (uchar_t *)ipif->ipif_ill);
1507 	}
1508 }
1509 
1510 /*
1511  * Used when an interface comes up to recreate any extra routes on this
1512  * interface.
1513  */
1514 static ire_t **
1515 ipif_recover_ire_v6(ipif_t *ipif)
1516 {
1517 	mblk_t	*mp;
1518 	ire_t   **ipif_saved_irep;
1519 	ire_t   **irep;
1520 
1521 	ip1dbg(("ipif_recover_ire_v6(%s:%u)", ipif->ipif_ill->ill_name,
1522 	    ipif->ipif_id));
1523 
1524 	ASSERT(ipif->ipif_isv6);
1525 
1526 	mutex_enter(&ipif->ipif_saved_ire_lock);
1527 	ipif_saved_irep = (ire_t **)kmem_zalloc(sizeof (ire_t *) *
1528 	    ipif->ipif_saved_ire_cnt, KM_NOSLEEP);
1529 	if (ipif_saved_irep == NULL) {
1530 		mutex_exit(&ipif->ipif_saved_ire_lock);
1531 		return (NULL);
1532 	}
1533 
1534 	irep = ipif_saved_irep;
1535 
1536 	for (mp = ipif->ipif_saved_ire_mp; mp != NULL; mp = mp->b_cont) {
1537 		ire_t		*ire;
1538 		queue_t		*rfq;
1539 		queue_t		*stq;
1540 		ifrt_t		*ifrt;
1541 		in6_addr_t	*src_addr;
1542 		in6_addr_t	*gateway_addr;
1543 		mblk_t		*resolver_mp;
1544 		char		buf[INET6_ADDRSTRLEN];
1545 		ushort_t	type;
1546 
1547 		/*
1548 		 * When the ire was initially created and then added in
1549 		 * ip_rt_add_v6(), it was created either using
1550 		 * ipif->ipif_net_type in the case of a traditional interface
1551 		 * route, or as one of the IRE_OFFSUBNET types (with the
1552 		 * exception of IRE_HOST_REDIRECT which is created by
1553 		 * icmp_redirect_v6() and which we don't need to save or
1554 		 * recover).  In the case where ipif->ipif_net_type was
1555 		 * IRE_LOOPBACK, ip_rt_add_v6() will update the ire_type to
1556 		 * IRE_IF_NORESOLVER before calling ire_add_v6() to satisfy
1557 		 * software like GateD and Sun Cluster which creates routes
1558 		 * using the the loopback interface's address as a gateway.
1559 		 *
1560 		 * As ifrt->ifrt_type reflects the already updated ire_type and
1561 		 * since ire_create_v6() expects that IRE_IF_NORESOLVER will
1562 		 * have a valid ire_dlureq_mp field (which doesn't make sense
1563 		 * for a IRE_LOOPBACK), ire_create_v6() will be called in the
1564 		 * same way here as in ip_rt_add_v6(), namely using
1565 		 * ipif->ipif_net_type when the route looks like a traditional
1566 		 * interface route (where ifrt->ifrt_type & IRE_INTERFACE is
1567 		 * true) and otherwise using the saved ifrt->ifrt_type.  This
1568 		 * means that in the case where ipif->ipif_net_type is
1569 		 * IRE_LOOPBACK, the ire created by ire_create_v6() will be an
1570 		 * IRE_LOOPBACK, it will then be turned into an
1571 		 * IRE_IF_NORESOLVER and then added by ire_add_v6().
1572 		 */
1573 		ifrt = (ifrt_t *)mp->b_rptr;
1574 		if (ifrt->ifrt_type & IRE_INTERFACE) {
1575 			rfq = NULL;
1576 			stq = (ipif->ipif_net_type == IRE_IF_RESOLVER)
1577 			    ? ipif->ipif_rq : ipif->ipif_wq;
1578 			src_addr = (ifrt->ifrt_flags & RTF_SETSRC)
1579 			    ? &ifrt->ifrt_v6src_addr
1580 			    : &ipif->ipif_v6src_addr;
1581 			gateway_addr = NULL;
1582 			resolver_mp = ipif->ipif_resolver_mp;
1583 			type = ipif->ipif_net_type;
1584 		} else {
1585 			rfq = NULL;
1586 			stq = NULL;
1587 			src_addr = (ifrt->ifrt_flags & RTF_SETSRC)
1588 			    ? &ifrt->ifrt_v6src_addr : NULL;
1589 			gateway_addr = &ifrt->ifrt_v6gateway_addr;
1590 			resolver_mp = NULL;
1591 			type = ifrt->ifrt_type;
1592 		}
1593 
1594 		/*
1595 		 * Create a copy of the IRE with the saved address and netmask.
1596 		 */
1597 		ip1dbg(("ipif_recover_ire_v6: creating IRE %s (%d) for %s/%d\n",
1598 		    ip_nv_lookup(ire_nv_tbl, ifrt->ifrt_type), ifrt->ifrt_type,
1599 		    inet_ntop(AF_INET6, &ifrt->ifrt_v6addr, buf, sizeof (buf)),
1600 		    ip_mask_to_plen_v6(&ifrt->ifrt_v6mask)));
1601 		ire = ire_create_v6(
1602 		    &ifrt->ifrt_v6addr,
1603 		    &ifrt->ifrt_v6mask,
1604 		    src_addr,
1605 		    gateway_addr,
1606 		    &ifrt->ifrt_max_frag,
1607 		    NULL,
1608 		    rfq,
1609 		    stq,
1610 		    type,
1611 		    resolver_mp,
1612 		    ipif,
1613 		    NULL,
1614 		    0,
1615 		    0,
1616 		    ifrt->ifrt_flags,
1617 		    &ifrt->ifrt_iulp_info,
1618 		    NULL,
1619 		    NULL);
1620 		if (ire == NULL) {
1621 			mutex_exit(&ipif->ipif_saved_ire_lock);
1622 			kmem_free(ipif_saved_irep,
1623 			    ipif->ipif_saved_ire_cnt * sizeof (ire_t *));
1624 			return (NULL);
1625 		}
1626 
1627 		/*
1628 		 * Some software (for example, GateD and Sun Cluster) attempts
1629 		 * to create (what amount to) IRE_PREFIX routes with the
1630 		 * loopback address as the gateway.  This is primarily done to
1631 		 * set up prefixes with the RTF_REJECT flag set (for example,
1632 		 * when generating aggregate routes.)
1633 		 *
1634 		 * If the IRE type (as defined by ipif->ipif_net_type) is
1635 		 * IRE_LOOPBACK, then we map the request into a
1636 		 * IRE_IF_NORESOLVER.
1637 		 */
1638 		if (ipif->ipif_net_type == IRE_LOOPBACK)
1639 			ire->ire_type = IRE_IF_NORESOLVER;
1640 		/*
1641 		 * ire held by ire_add, will be refreled' in ipif_up_done
1642 		 * towards the end
1643 		 */
1644 		(void) ire_add(&ire, NULL, NULL, NULL, B_FALSE);
1645 		*irep = ire;
1646 		irep++;
1647 		ip1dbg(("ipif_recover_ire_v6: added ire %p\n", (void *)ire));
1648 	}
1649 	mutex_exit(&ipif->ipif_saved_ire_lock);
1650 	return (ipif_saved_irep);
1651 }
1652 
1653 /*
1654  * Return the scope of the given IPv6 address.  If the address is an
1655  * IPv4 mapped IPv6 address, return the scope of the corresponding
1656  * IPv4 address.
1657  */
1658 in6addr_scope_t
1659 ip_addr_scope_v6(const in6_addr_t *addr)
1660 {
1661 	static in6_addr_t ipv6loopback = IN6ADDR_LOOPBACK_INIT;
1662 
1663 	if (IN6_IS_ADDR_V4MAPPED(addr)) {
1664 		in_addr_t v4addr_h = ntohl(V4_PART_OF_V6((*addr)));
1665 		if ((v4addr_h >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET ||
1666 		    (v4addr_h & IN_AUTOCONF_MASK) == IN_AUTOCONF_NET)
1667 			return (IP6_SCOPE_LINKLOCAL);
1668 		if ((v4addr_h & IN_PRIVATE8_MASK) == IN_PRIVATE8_NET ||
1669 		    (v4addr_h & IN_PRIVATE12_MASK) == IN_PRIVATE12_NET ||
1670 		    (v4addr_h & IN_PRIVATE16_MASK) == IN_PRIVATE16_NET)
1671 			return (IP6_SCOPE_SITELOCAL);
1672 		return (IP6_SCOPE_GLOBAL);
1673 	}
1674 
1675 	if (IN6_IS_ADDR_MULTICAST(addr))
1676 		return (IN6_ADDR_MC_SCOPE(addr));
1677 
1678 	/* link-local and loopback addresses are of link-local scope */
1679 	if (IN6_IS_ADDR_LINKLOCAL(addr) ||
1680 	    IN6_ARE_ADDR_EQUAL(addr, &ipv6loopback))
1681 		return (IP6_SCOPE_LINKLOCAL);
1682 	if (IN6_IS_ADDR_SITELOCAL(addr))
1683 		return (IP6_SCOPE_SITELOCAL);
1684 	return (IP6_SCOPE_GLOBAL);
1685 }
1686 
1687 
1688 /*
1689  * Calculates the xor of a1 and a2, and stores the result in res.
1690  */
1691 static void
1692 ip_addr_xor_v6(const in6_addr_t *a1, const in6_addr_t *a2, in6_addr_t *res)
1693 {
1694 	int i;
1695 
1696 	for (i = 0; i < 4; i++)
1697 		res->s6_addr32[i] = a1->s6_addr32[i] ^ a2->s6_addr32[i];
1698 }
1699 
1700 #define	IPIF_VALID_IPV6_SOURCE(ipif) \
1701 	(((ipif)->ipif_flags & IPIF_UP) && \
1702 	!((ipif)->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST)) && \
1703 	(ipif)->ipif_addr_ready)
1704 
1705 /* source address candidate */
1706 typedef struct candidate {
1707 	ipif_t		*cand_ipif;
1708 	/* The properties of this candidate */
1709 	boolean_t	cand_isdst;
1710 	boolean_t	cand_isdst_set;
1711 	in6addr_scope_t	cand_scope;
1712 	boolean_t	cand_scope_set;
1713 	boolean_t	cand_isdeprecated;
1714 	boolean_t	cand_isdeprecated_set;
1715 	boolean_t	cand_ispreferred;
1716 	boolean_t	cand_ispreferred_set;
1717 	boolean_t	cand_matchedinterface;
1718 	boolean_t	cand_matchedinterface_set;
1719 	boolean_t	cand_matchedlabel;
1720 	boolean_t	cand_matchedlabel_set;
1721 	boolean_t	cand_istmp;
1722 	boolean_t	cand_istmp_set;
1723 	in6_addr_t	cand_xor;
1724 	boolean_t	cand_xor_set;
1725 } cand_t;
1726 #define	cand_srcaddr	cand_ipif->ipif_v6lcl_addr
1727 #define	cand_flags	cand_ipif->ipif_flags
1728 #define	cand_ill	cand_ipif->ipif_ill
1729 #define	cand_zoneid	cand_ipif->ipif_zoneid
1730 
1731 /* information about the destination for source address selection */
1732 typedef struct dstinfo {
1733 	const in6_addr_t	*dst_addr;
1734 	ill_t			*dst_ill;
1735 	uint_t			dst_restrict_ill;
1736 	boolean_t		dst_prefer_src_tmp;
1737 	in6addr_scope_t		dst_scope;
1738 	char			*dst_label;
1739 } dstinfo_t;
1740 
1741 /*
1742  * The following functions are rules used to select a source address in
1743  * ipif_select_source_v6().  Each rule compares a current candidate (cc)
1744  * against the best candidate (bc).  Each rule has three possible outcomes;
1745  * the candidate is preferred over the best candidate (CAND_PREFER), the
1746  * candidate is not preferred over the best candidate (CAND_AVOID), or the
1747  * candidate is of equal value as the best candidate (CAND_TIE).
1748  *
1749  * These rules are part of a greater "Default Address Selection for IPv6"
1750  * sheme, which is standards based work coming out of the IETF ipv6 working
1751  * group.  The IETF document defines both IPv6 source address selection and
1752  * destination address ordering.  The rules defined here implement the IPv6
1753  * source address selection.  Destination address ordering is done by
1754  * libnsl, and uses a similar set of rules to implement the sorting.
1755  */
1756 typedef enum {CAND_AVOID, CAND_TIE, CAND_PREFER} rule_res_t;
1757 typedef	rule_res_t (*rulef_t)(cand_t *, cand_t *, const dstinfo_t *);
1758 
1759 /* Prefer an address if it is equal to the destination address. */
1760 static rule_res_t
1761 rule_isdst(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo)
1762 {
1763 	if (!bc->cand_isdst_set) {
1764 		bc->cand_isdst =
1765 		    IN6_ARE_ADDR_EQUAL(&bc->cand_srcaddr, dstinfo->dst_addr);
1766 		bc->cand_isdst_set = B_TRUE;
1767 	}
1768 
1769 	cc->cand_isdst =
1770 	    IN6_ARE_ADDR_EQUAL(&cc->cand_srcaddr, dstinfo->dst_addr);
1771 	cc->cand_isdst_set = B_TRUE;
1772 
1773 	if (cc->cand_isdst == bc->cand_isdst)
1774 		return (CAND_TIE);
1775 	else if (cc->cand_isdst)
1776 		return (CAND_PREFER);
1777 	else
1778 		return (CAND_AVOID);
1779 }
1780 
1781 /*
1782  * Prefer addresses that are of closest scope to the destination.  Always
1783  * prefer addresses that are of greater scope than the destination over
1784  * those that are of lesser scope than the destination.
1785  */
1786 static rule_res_t
1787 rule_scope(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo)
1788 {
1789 	if (!bc->cand_scope_set) {
1790 		bc->cand_scope = ip_addr_scope_v6(&bc->cand_srcaddr);
1791 		bc->cand_scope_set = B_TRUE;
1792 	}
1793 
1794 	cc->cand_scope = ip_addr_scope_v6(&cc->cand_srcaddr);
1795 	cc->cand_scope_set = B_TRUE;
1796 
1797 	if (cc->cand_scope < bc->cand_scope) {
1798 		if (cc->cand_scope < dstinfo->dst_scope)
1799 			return (CAND_AVOID);
1800 		else
1801 			return (CAND_PREFER);
1802 	} else if (bc->cand_scope < cc->cand_scope) {
1803 		if (bc->cand_scope < dstinfo->dst_scope)
1804 			return (CAND_PREFER);
1805 		else
1806 			return (CAND_AVOID);
1807 	} else {
1808 		return (CAND_TIE);
1809 	}
1810 }
1811 
1812 /*
1813  * Prefer non-deprecated source addresses.
1814  */
1815 /* ARGSUSED2 */
1816 static rule_res_t
1817 rule_deprecated(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo)
1818 {
1819 	if (!bc->cand_isdeprecated_set) {
1820 		bc->cand_isdeprecated =
1821 		    ((bc->cand_flags & IPIF_DEPRECATED) != 0);
1822 		bc->cand_isdeprecated_set = B_TRUE;
1823 	}
1824 
1825 	cc->cand_isdeprecated = ((cc->cand_flags & IPIF_DEPRECATED) != 0);
1826 	cc->cand_isdeprecated_set = B_TRUE;
1827 
1828 	if (bc->cand_isdeprecated == cc->cand_isdeprecated)
1829 		return (CAND_TIE);
1830 	else if (cc->cand_isdeprecated)
1831 		return (CAND_AVOID);
1832 	else
1833 		return (CAND_PREFER);
1834 }
1835 
1836 /*
1837  * Prefer source addresses that have the IPIF_PREFERRED flag set.  This
1838  * rule must be before rule_interface because the flag could be set on any
1839  * interface, not just the interface being used for outgoing packets (for
1840  * example, the IFF_PREFERRED could be set on an address assigned to the
1841  * loopback interface).
1842  */
1843 /* ARGSUSED2 */
1844 static rule_res_t
1845 rule_preferred(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo)
1846 {
1847 	if (!bc->cand_ispreferred_set) {
1848 		bc->cand_ispreferred = ((bc->cand_flags & IPIF_PREFERRED) != 0);
1849 		bc->cand_ispreferred_set = B_TRUE;
1850 	}
1851 
1852 	cc->cand_ispreferred = ((cc->cand_flags & IPIF_PREFERRED) != 0);
1853 	cc->cand_ispreferred_set = B_TRUE;
1854 
1855 	if (bc->cand_ispreferred == cc->cand_ispreferred)
1856 		return (CAND_TIE);
1857 	else if (cc->cand_ispreferred)
1858 		return (CAND_PREFER);
1859 	else
1860 		return (CAND_AVOID);
1861 }
1862 
1863 /*
1864  * Prefer source addresses that are assigned to the outgoing interface, or
1865  * to an interface that is in the same IPMP group as the outgoing
1866  * interface.
1867  */
1868 static rule_res_t
1869 rule_interface(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo)
1870 {
1871 	ill_t *dstill = dstinfo->dst_ill;
1872 
1873 	/*
1874 	 * If dstinfo->dst_restrict_ill is set, this rule is unnecessary
1875 	 * since we know all candidates will be on the same link.
1876 	 */
1877 	if (dstinfo->dst_restrict_ill)
1878 		return (CAND_TIE);
1879 
1880 	if (!bc->cand_matchedinterface_set) {
1881 		bc->cand_matchedinterface = (bc->cand_ill == dstill ||
1882 		    (dstill->ill_group != NULL &&
1883 		    dstill->ill_group == bc->cand_ill->ill_group));
1884 		bc->cand_matchedinterface_set = B_TRUE;
1885 	}
1886 
1887 	cc->cand_matchedinterface = (cc->cand_ill == dstill ||
1888 	    (dstill->ill_group != NULL &&
1889 		dstill->ill_group == cc->cand_ill->ill_group));
1890 	cc->cand_matchedinterface_set = B_TRUE;
1891 
1892 	if (bc->cand_matchedinterface == cc->cand_matchedinterface)
1893 		return (CAND_TIE);
1894 	else if (cc->cand_matchedinterface)
1895 		return (CAND_PREFER);
1896 	else
1897 		return (CAND_AVOID);
1898 }
1899 
1900 /*
1901  * Prefer source addresses whose label matches the destination's label.
1902  */
1903 static rule_res_t
1904 rule_label(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo)
1905 {
1906 	char *label;
1907 
1908 	if (!bc->cand_matchedlabel_set) {
1909 		label = ip6_asp_lookup(&bc->cand_srcaddr, NULL);
1910 		bc->cand_matchedlabel =
1911 		    ip6_asp_labelcmp(label, dstinfo->dst_label);
1912 		bc->cand_matchedlabel_set = B_TRUE;
1913 	}
1914 
1915 	label = ip6_asp_lookup(&cc->cand_srcaddr, NULL);
1916 	cc->cand_matchedlabel = ip6_asp_labelcmp(label, dstinfo->dst_label);
1917 	cc->cand_matchedlabel_set = B_TRUE;
1918 
1919 	if (bc->cand_matchedlabel == cc->cand_matchedlabel)
1920 		return (CAND_TIE);
1921 	else if (cc->cand_matchedlabel)
1922 		return (CAND_PREFER);
1923 	else
1924 		return (CAND_AVOID);
1925 }
1926 
1927 /*
1928  * Prefer public addresses over temporary ones.  An application can reverse
1929  * the logic of this rule and prefer temporary addresses by using the
1930  * IPV6_SRC_PREFERENCES socket option.
1931  */
1932 static rule_res_t
1933 rule_temporary(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo)
1934 {
1935 	if (!bc->cand_istmp_set) {
1936 		bc->cand_istmp = ((bc->cand_flags & IPIF_TEMPORARY) != 0);
1937 		bc->cand_istmp_set = B_TRUE;
1938 	}
1939 
1940 	cc->cand_istmp = ((cc->cand_flags & IPIF_TEMPORARY) != 0);
1941 	cc->cand_istmp_set = B_TRUE;
1942 
1943 	if (bc->cand_istmp == cc->cand_istmp)
1944 		return (CAND_TIE);
1945 
1946 	if (dstinfo->dst_prefer_src_tmp && cc->cand_istmp)
1947 		return (CAND_PREFER);
1948 	else if (!dstinfo->dst_prefer_src_tmp && !cc->cand_istmp)
1949 		return (CAND_PREFER);
1950 	else
1951 		return (CAND_AVOID);
1952 }
1953 
1954 /*
1955  * Prefer source addresses with longer matching prefix with the
1956  * destination.  Since this is the last rule, it must not produce a tie.
1957  * We do the longest matching prefix calculation and the tie break in one
1958  * calculation by doing an xor of both addresses with the destination, and
1959  * pick the address with the smallest xor value.  That way, we're both
1960  * picking the address with the longest matching prefix, and breaking the
1961  * tie if they happen to have both have equal mathing prefixes.
1962  */
1963 static rule_res_t
1964 rule_prefix(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo)
1965 {
1966 	int i;
1967 
1968 	if (!bc->cand_xor_set) {
1969 		ip_addr_xor_v6(&bc->cand_srcaddr,
1970 		    dstinfo->dst_addr, &bc->cand_xor);
1971 		bc->cand_xor_set = B_TRUE;
1972 	}
1973 
1974 	ip_addr_xor_v6(&cc->cand_srcaddr, dstinfo->dst_addr, &cc->cand_xor);
1975 	cc->cand_xor_set = B_TRUE;
1976 
1977 	for (i = 0; i < 4; i++) {
1978 		if (bc->cand_xor.s6_addr32[i] != cc->cand_xor.s6_addr32[i])
1979 			break;
1980 	}
1981 
1982 	if (cc->cand_xor.s6_addr32[i] < bc->cand_xor.s6_addr32[i])
1983 		return (CAND_PREFER);
1984 	else
1985 		return (CAND_AVOID);
1986 }
1987 
1988 /*
1989  * Prefer to use zone-specific addresses when possible instead of all-zones
1990  * addresses.
1991  */
1992 /* ARGSUSED2 */
1993 static rule_res_t
1994 rule_zone_specific(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo)
1995 {
1996 	if ((bc->cand_zoneid == ALL_ZONES) ==
1997 	    (cc->cand_zoneid == ALL_ZONES))
1998 		return (CAND_TIE);
1999 	else if (cc->cand_zoneid == ALL_ZONES)
2000 		return (CAND_AVOID);
2001 	else
2002 		return (CAND_PREFER);
2003 }
2004 
2005 /*
2006  * Determine the best source address given a destination address and a
2007  * destination ill.  If no suitable source address is found, it returns
2008  * NULL. If there is a usable address pointed to by the usesrc
2009  * (i.e ill_usesrc_ifindex != 0) then return that first since it is more
2010  * fine grained (i.e per interface)
2011  *
2012  * This implementation is based on the "Default Address Selection for IPv6"
2013  * specification produced by the IETF IPv6 working group.  It has been
2014  * implemented so that the list of addresses is only traversed once (the
2015  * specification's algorithm could traverse the list of addresses once for
2016  * every rule).
2017  *
2018  * The restrict_ill argument restricts the algorithm to chose a source
2019  * address that is assigned to the destination ill or an ill in the same
2020  * IPMP group as the destination ill.  This is used when the destination
2021  * address is a link-local or multicast address, and when
2022  * ipv6_strict_dst_multihoming is turned on.
2023  *
2024  * src_prefs is the caller's set of source address preferences.  If source
2025  * address selection is being called to determine the source address of a
2026  * connected socket (from ip_bind_connected_v6()), then the preferences are
2027  * taken from conn_src_preferences.  These preferences can be set on a
2028  * per-socket basis using the IPV6_SRC_PREFERENCES socket option.  The only
2029  * preference currently implemented is for rfc3041 temporary addresses.
2030  */
2031 ipif_t *
2032 ipif_select_source_v6(ill_t *dstill, const in6_addr_t *dst,
2033     uint_t restrict_ill, uint32_t src_prefs, zoneid_t zoneid)
2034 {
2035 	dstinfo_t	dstinfo;
2036 	char		dstr[INET6_ADDRSTRLEN];
2037 	char		sstr[INET6_ADDRSTRLEN];
2038 	ipif_t		*ipif;
2039 	ill_t		*ill, *usesrc_ill = NULL;
2040 	ill_walk_context_t	ctx;
2041 	cand_t		best_c;	/* The best candidate */
2042 	cand_t		curr_c;	/* The current candidate */
2043 	uint_t		index;
2044 	boolean_t	first_candidate = B_TRUE;
2045 	rule_res_t	rule_result;
2046 	tsol_tpc_t	*src_rhtp, *dst_rhtp;
2047 
2048 	/*
2049 	 * The list of ordering rules.  They are applied in the order they
2050 	 * appear in the list.
2051 	 *
2052 	 * XXX rule_mipv6 will need to be implemented (the specification's
2053 	 * rules 4) if a mobile IPv6 node is ever implemented.
2054 	 */
2055 	rulef_t	rules[] = {
2056 		rule_isdst,
2057 		rule_scope,
2058 		rule_deprecated,
2059 		rule_preferred,
2060 		rule_interface,
2061 		rule_label,
2062 		rule_temporary,
2063 		rule_prefix,
2064 		rule_zone_specific,
2065 		NULL
2066 	};
2067 
2068 	ASSERT(dstill->ill_isv6);
2069 	ASSERT(!IN6_IS_ADDR_V4MAPPED(dst));
2070 
2071 	/*
2072 	 * Check if there is a usable src address pointed to by the
2073 	 * usesrc ifindex. This has higher precedence since it is
2074 	 * finer grained (i.e per interface) v/s being system wide.
2075 	 */
2076 	if (dstill->ill_usesrc_ifindex != 0) {
2077 		if ((usesrc_ill =
2078 		    ill_lookup_on_ifindex(dstill->ill_usesrc_ifindex, B_TRUE,
2079 		    NULL, NULL, NULL, NULL)) != NULL) {
2080 			dstinfo.dst_ill = usesrc_ill;
2081 		} else {
2082 			return (NULL);
2083 		}
2084 	} else {
2085 		dstinfo.dst_ill = dstill;
2086 	}
2087 
2088 	/*
2089 	 * If we're dealing with an unlabeled destination on a labeled system,
2090 	 * make sure that we ignore source addresses that are incompatible with
2091 	 * the destination's default label.  That destination's default label
2092 	 * must dominate the minimum label on the source address.
2093 	 *
2094 	 * (Note that this has to do with Trusted Solaris.  It's not related to
2095 	 * the labels described by ip6_asp_lookup.)
2096 	 */
2097 	dst_rhtp = NULL;
2098 	if (is_system_labeled()) {
2099 		dst_rhtp = find_tpc(dst, IPV6_VERSION, B_FALSE);
2100 		if (dst_rhtp == NULL)
2101 			return (NULL);
2102 		if (dst_rhtp->tpc_tp.host_type != UNLABELED) {
2103 			TPC_RELE(dst_rhtp);
2104 			dst_rhtp = NULL;
2105 		}
2106 	}
2107 
2108 	dstinfo.dst_addr = dst;
2109 	dstinfo.dst_scope = ip_addr_scope_v6(dst);
2110 	dstinfo.dst_label = ip6_asp_lookup(dst, NULL);
2111 	dstinfo.dst_prefer_src_tmp = ((src_prefs & IPV6_PREFER_SRC_TMP) != 0);
2112 
2113 	rw_enter(&ill_g_lock, RW_READER);
2114 	/*
2115 	 * Section three of the I-D states that for multicast and
2116 	 * link-local destinations, the candidate set must be restricted to
2117 	 * an interface that is on the same link as the outgoing interface.
2118 	 * Also, when ipv6_strict_dst_multihoming is turned on, always
2119 	 * restrict the source address to the destination link as doing
2120 	 * otherwise will almost certainly cause problems.
2121 	 */
2122 	if (IN6_IS_ADDR_LINKLOCAL(dst) || IN6_IS_ADDR_MULTICAST(dst) ||
2123 	    ipv6_strict_dst_multihoming || usesrc_ill != NULL) {
2124 		if (restrict_ill == RESTRICT_TO_NONE)
2125 			dstinfo.dst_restrict_ill = RESTRICT_TO_GROUP;
2126 		else
2127 			dstinfo.dst_restrict_ill = restrict_ill;
2128 	} else {
2129 		dstinfo.dst_restrict_ill = restrict_ill;
2130 	}
2131 
2132 	bzero(&best_c, sizeof (cand_t));
2133 
2134 	/*
2135 	 * Take a pass through the list of IPv6 interfaces to chose the
2136 	 * best possible source address.  If restrict_ill is true, we only
2137 	 * iterate through the ill's that are in the same IPMP group as the
2138 	 * destination's outgoing ill.  If restrict_ill is false, we walk
2139 	 * the entire list of IPv6 ill's.
2140 	 */
2141 	if (dstinfo.dst_restrict_ill != RESTRICT_TO_NONE) {
2142 		if (dstinfo.dst_ill->ill_group != NULL &&
2143 		    dstinfo.dst_restrict_ill == RESTRICT_TO_GROUP) {
2144 			ill = dstinfo.dst_ill->ill_group->illgrp_ill;
2145 		} else {
2146 			ill = dstinfo.dst_ill;
2147 		}
2148 	} else {
2149 		ill = ILL_START_WALK_V6(&ctx);
2150 	}
2151 
2152 	while (ill != NULL) {
2153 		ASSERT(ill->ill_isv6);
2154 
2155 		/*
2156 		 * Avoid FAILED/OFFLINE ills.
2157 		 * Global and site local addresses will failover and
2158 		 * will be available on the new ill.
2159 		 * But link local addresses don't move.
2160 		 */
2161 		if (dstinfo.dst_restrict_ill != RESTRICT_TO_ILL &&
2162 		    ill->ill_phyint->phyint_flags &
2163 		    (PHYI_OFFLINE | PHYI_FAILED))
2164 			goto next_ill;
2165 
2166 		for (ipif = ill->ill_ipif; ipif != NULL;
2167 		    ipif = ipif->ipif_next) {
2168 
2169 			if (!IPIF_VALID_IPV6_SOURCE(ipif))
2170 				continue;
2171 
2172 			if (zoneid != ALL_ZONES &&
2173 			    ipif->ipif_zoneid != zoneid &&
2174 			    ipif->ipif_zoneid != ALL_ZONES)
2175 				continue;
2176 
2177 			/*
2178 			 * Check compatibility of local address for
2179 			 * destination's default label if we're on a labeled
2180 			 * system.  Incompatible addresses can't be used at
2181 			 * all and must be skipped over.
2182 			 */
2183 			if (dst_rhtp != NULL) {
2184 				boolean_t incompat;
2185 
2186 				src_rhtp = find_tpc(&ipif->ipif_v6lcl_addr,
2187 				    IPV6_VERSION, B_FALSE);
2188 				if (src_rhtp == NULL)
2189 					continue;
2190 				incompat =
2191 				    src_rhtp->tpc_tp.host_type != SUN_CIPSO ||
2192 				    src_rhtp->tpc_tp.tp_doi !=
2193 				    dst_rhtp->tpc_tp.tp_doi ||
2194 				    (!_blinrange(&dst_rhtp->tpc_tp.tp_def_label,
2195 				    &src_rhtp->tpc_tp.tp_sl_range_cipso) &&
2196 				    !blinlset(&dst_rhtp->tpc_tp.tp_def_label,
2197 				    src_rhtp->tpc_tp.tp_sl_set_cipso));
2198 				TPC_RELE(src_rhtp);
2199 				if (incompat)
2200 					continue;
2201 			}
2202 
2203 			if (first_candidate) {
2204 				/*
2205 				 * This is first valid address in the list.
2206 				 * It is automatically the best candidate
2207 				 * so far.
2208 				 */
2209 				best_c.cand_ipif = ipif;
2210 				first_candidate = B_FALSE;
2211 				continue;
2212 			}
2213 
2214 			bzero(&curr_c, sizeof (cand_t));
2215 			curr_c.cand_ipif = ipif;
2216 
2217 			/*
2218 			 * Compare this current candidate (curr_c) with the
2219 			 * best candidate (best_c) by applying the
2220 			 * comparison rules in order until one breaks the
2221 			 * tie.
2222 			 */
2223 			for (index = 0; rules[index] != NULL; index++) {
2224 				/* Apply a comparison rule. */
2225 				rule_result =
2226 				    (rules[index])(&best_c, &curr_c, &dstinfo);
2227 				if (rule_result == CAND_AVOID) {
2228 					/*
2229 					 * The best candidate is still the
2230 					 * best candidate.  Forget about
2231 					 * this current candidate and go on
2232 					 * to the next one.
2233 					 */
2234 					break;
2235 				} else if (rule_result == CAND_PREFER) {
2236 					/*
2237 					 * This candidate is prefered.  It
2238 					 * becomes the best candidate so
2239 					 * far.  Go on to the next address.
2240 					 */
2241 					best_c = curr_c;
2242 					break;
2243 				}
2244 				/* We have a tie, apply the next rule. */
2245 			}
2246 
2247 			/*
2248 			 * The last rule must be a tie breaker rule and
2249 			 * must never produce a tie.  At this point, the
2250 			 * candidate should have either been rejected, or
2251 			 * have been prefered as the best candidate so far.
2252 			 */
2253 			ASSERT(rule_result != CAND_TIE);
2254 		}
2255 
2256 		/*
2257 		 * We may be walking the linked-list of ill's in an
2258 		 * IPMP group or traversing the IPv6 ill avl tree. If it is a
2259 		 * usesrc ILL then it can't be part of IPMP group and we
2260 		 * will exit the while loop.
2261 		 */
2262 next_ill:
2263 		if (dstinfo.dst_restrict_ill == RESTRICT_TO_ILL)
2264 			ill = NULL;
2265 		else if (dstinfo.dst_restrict_ill == RESTRICT_TO_GROUP)
2266 			ill = ill->ill_group_next;
2267 		else
2268 			ill = ill_next(&ctx, ill);
2269 	}
2270 
2271 	ipif = best_c.cand_ipif;
2272 	ip1dbg(("ipif_select_source_v6(%s, %s) -> %s\n",
2273 	    dstinfo.dst_ill->ill_name,
2274 	    inet_ntop(AF_INET6, dstinfo.dst_addr, dstr, sizeof (dstr)),
2275 	    (ipif == NULL ? "NULL" :
2276 	    inet_ntop(AF_INET6, &ipif->ipif_v6lcl_addr, sstr, sizeof (sstr)))));
2277 
2278 	if (usesrc_ill != NULL)
2279 		ill_refrele(usesrc_ill);
2280 
2281 	if (dst_rhtp != NULL)
2282 		TPC_RELE(dst_rhtp);
2283 
2284 	if (ipif == NULL) {
2285 		rw_exit(&ill_g_lock);
2286 		return (NULL);
2287 	}
2288 
2289 	mutex_enter(&ipif->ipif_ill->ill_lock);
2290 	if (IPIF_CAN_LOOKUP(ipif)) {
2291 		ipif_refhold_locked(ipif);
2292 		mutex_exit(&ipif->ipif_ill->ill_lock);
2293 		rw_exit(&ill_g_lock);
2294 		return (ipif);
2295 	}
2296 	mutex_exit(&ipif->ipif_ill->ill_lock);
2297 	rw_exit(&ill_g_lock);
2298 	ip1dbg(("ipif_select_source_v6 cannot lookup ipif %p"
2299 	    " returning null \n", (void *)ipif));
2300 
2301 	return (NULL);
2302 }
2303 
2304 /*
2305  * If old_ipif is not NULL, see if ipif was derived from old
2306  * ipif and if so, recreate the interface route by re-doing
2307  * source address selection. This happens when ipif_down ->
2308  * ipif_update_other_ipifs calls us.
2309  *
2310  * If old_ipif is NULL, just redo the source address selection
2311  * if needed. This happens when illgrp_insert or ipif_up_done_v6
2312  * calls us.
2313  */
2314 void
2315 ipif_recreate_interface_routes_v6(ipif_t *old_ipif, ipif_t *ipif)
2316 {
2317 	ire_t *ire;
2318 	ire_t *ipif_ire;
2319 	queue_t *stq;
2320 	ill_t *ill;
2321 	ipif_t *nipif = NULL;
2322 	boolean_t nipif_refheld = B_FALSE;
2323 	boolean_t ip6_asp_table_held = B_FALSE;
2324 
2325 	ill = ipif->ipif_ill;
2326 
2327 	if (!(ipif->ipif_flags &
2328 	    (IPIF_NOLOCAL|IPIF_ANYCAST|IPIF_DEPRECATED))) {
2329 		/*
2330 		 * Can't possibly have borrowed the source
2331 		 * from old_ipif.
2332 		 */
2333 		return;
2334 	}
2335 
2336 	/*
2337 	 * Is there any work to be done? No work if the address
2338 	 * is INADDR_ANY, loopback or NOLOCAL or ANYCAST (
2339 	 * ipif_select_source_v6() does not borrow addresses from
2340 	 * NOLOCAL and ANYCAST interfaces).
2341 	 */
2342 	if ((old_ipif != NULL) &&
2343 	    ((IN6_IS_ADDR_UNSPECIFIED(&old_ipif->ipif_v6lcl_addr)) ||
2344 	    (old_ipif->ipif_ill->ill_wq == NULL) ||
2345 	    (old_ipif->ipif_flags &
2346 	    (IPIF_NOLOCAL|IPIF_ANYCAST)))) {
2347 		return;
2348 	}
2349 
2350 	/*
2351 	 * Perform the same checks as when creating the
2352 	 * IRE_INTERFACE in ipif_up_done_v6.
2353 	 */
2354 	if (!(ipif->ipif_flags & IPIF_UP))
2355 		return;
2356 
2357 	if ((ipif->ipif_flags & IPIF_NOXMIT))
2358 		return;
2359 
2360 	if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet) &&
2361 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6net_mask))
2362 		return;
2363 
2364 	/*
2365 	 * We know that ipif uses some other source for its
2366 	 * IRE_INTERFACE. Is it using the source of this
2367 	 * old_ipif?
2368 	 */
2369 	ipif_ire = ipif_to_ire_v6(ipif);
2370 	if (ipif_ire == NULL)
2371 		return;
2372 
2373 	if (old_ipif != NULL &&
2374 	    !IN6_ARE_ADDR_EQUAL(&old_ipif->ipif_v6lcl_addr,
2375 	    &ipif_ire->ire_src_addr_v6)) {
2376 		ire_refrele(ipif_ire);
2377 		return;
2378 	}
2379 
2380 	if (ip_debug > 2) {
2381 		/* ip1dbg */
2382 		pr_addr_dbg("ipif_recreate_interface_routes_v6: deleting IRE"
2383 		    " for src %s\n", AF_INET6, &ipif_ire->ire_src_addr_v6);
2384 	}
2385 
2386 	stq = ipif_ire->ire_stq;
2387 
2388 	/*
2389 	 * Can't use our source address. Select a different source address
2390 	 * for the IRE_INTERFACE.  We restrict interface route source
2391 	 * address selection to ipif's assigned to the same link as the
2392 	 * interface.
2393 	 */
2394 	if (ip6_asp_can_lookup()) {
2395 		ip6_asp_table_held = B_TRUE;
2396 		nipif = ipif_select_source_v6(ill, &ipif->ipif_v6subnet,
2397 		    RESTRICT_TO_GROUP, IPV6_PREFER_SRC_DEFAULT,
2398 		    ipif->ipif_zoneid);
2399 	}
2400 	if (nipif == NULL) {
2401 		/* Last resort - all ipif's have IPIF_NOLOCAL */
2402 		nipif = ipif;
2403 	} else {
2404 		nipif_refheld = B_TRUE;
2405 	}
2406 
2407 	ire = ire_create_v6(
2408 	    &ipif->ipif_v6subnet,	/* dest pref */
2409 	    &ipif->ipif_v6net_mask,	/* mask */
2410 	    &nipif->ipif_v6src_addr,	/* src addr */
2411 	    NULL,			/* no gateway */
2412 	    &ipif->ipif_mtu,		/* max frag */
2413 	    NULL,			/* no Fast path header */
2414 	    NULL,			/* no recv from queue */
2415 	    stq,			/* send-to queue */
2416 	    ill->ill_net_type,		/* IF_[NO]RESOLVER */
2417 	    ill->ill_resolver_mp,	/* xmit header */
2418 	    ipif,
2419 	    NULL,
2420 	    0,
2421 	    0,
2422 	    0,
2423 	    &ire_uinfo_null,
2424 	    NULL,
2425 	    NULL);
2426 
2427 	if (ire != NULL) {
2428 		ire_t *ret_ire;
2429 		int   error;
2430 
2431 		/*
2432 		 * We don't need ipif_ire anymore. We need to delete
2433 		 * before we add so that ire_add does not detect
2434 		 * duplicates.
2435 		 */
2436 		ire_delete(ipif_ire);
2437 		ret_ire = ire;
2438 		error = ire_add(&ret_ire, NULL, NULL, NULL, B_FALSE);
2439 		ASSERT(error == 0);
2440 		ASSERT(ret_ire == ire);
2441 		if (ret_ire != NULL) {
2442 			/* Held in ire_add */
2443 			ire_refrele(ret_ire);
2444 		}
2445 	}
2446 	/*
2447 	 * Either we are falling through from above or could not
2448 	 * allocate a replacement.
2449 	 */
2450 	ire_refrele(ipif_ire);
2451 	if (ip6_asp_table_held)
2452 		ip6_asp_table_refrele();
2453 	if (nipif_refheld)
2454 		ipif_refrele(nipif);
2455 }
2456 
2457 /*
2458  * This old_ipif is going away.
2459  *
2460  * Determine if any other ipif's are using our address as
2461  * ipif_v6lcl_addr (due to those being IPIF_NOLOCAL, IPIF_ANYCAST, or
2462  * IPIF_DEPRECATED).
2463  * Find the IRE_INTERFACE for such ipif's and recreate them
2464  * to use an different source address following the rules in
2465  * ipif_up_done_v6.
2466  *
2467  * This function takes an illgrp as an argument so that illgrp_delete
2468  * can call this to update source address even after deleting the
2469  * old_ipif->ipif_ill from the ill group.
2470  */
2471 void
2472 ipif_update_other_ipifs_v6(ipif_t *old_ipif, ill_group_t *illgrp)
2473 {
2474 	ipif_t	*ipif;
2475 	ill_t	*ill;
2476 	char	buf[INET6_ADDRSTRLEN];
2477 
2478 	ASSERT(IAM_WRITER_IPIF(old_ipif));
2479 
2480 	ill = old_ipif->ipif_ill;
2481 
2482 	ip1dbg(("ipif_update_other_ipifs_v6(%s, %s)\n",
2483 	    ill->ill_name,
2484 	    inet_ntop(AF_INET6, &old_ipif->ipif_v6lcl_addr,
2485 	    buf, sizeof (buf))));
2486 
2487 	/*
2488 	 * If this part of a group, look at all ills as ipif_select_source
2489 	 * borrows a source address across all the ills in the group.
2490 	 */
2491 	if (illgrp != NULL)
2492 		ill = illgrp->illgrp_ill;
2493 
2494 	/* Don't need a lock since this is a writer */
2495 	for (; ill != NULL; ill = ill->ill_group_next) {
2496 		for (ipif = ill->ill_ipif; ipif != NULL;
2497 		    ipif = ipif->ipif_next) {
2498 
2499 			if (ipif == old_ipif)
2500 				continue;
2501 
2502 			ipif_recreate_interface_routes_v6(old_ipif, ipif);
2503 		}
2504 	}
2505 }
2506 
2507 /*
2508  * Perform an attach and bind to get phys addr plus info_req for
2509  * the physical device.
2510  * q and mp represents an ioctl which will be queued waiting for
2511  * completion of the DLPI message exchange.
2512  * MUST be called on an ill queue. Can not set conn_pending_ill for that
2513  * reason thus the DL_PHYS_ADDR_ACK code does not assume ill_pending_q.
2514  *
2515  * Returns EINPROGRESS when mp has been consumed by queueing it on
2516  * ill_pending_mp and the ioctl will complete in ip_rput.
2517  */
2518 int
2519 ill_dl_phys(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q)
2520 {
2521 	mblk_t	*v6token_mp = NULL;
2522 	mblk_t	*v6lla_mp = NULL;
2523 	mblk_t	*phys_mp = NULL;
2524 	mblk_t	*info_mp = NULL;
2525 	mblk_t	*attach_mp = NULL;
2526 	mblk_t	*detach_mp = NULL;
2527 	mblk_t	*bind_mp = NULL;
2528 	mblk_t	*unbind_mp = NULL;
2529 	mblk_t	*notify_mp = NULL;
2530 
2531 	ip1dbg(("ill_dl_phys(%s:%u)\n", ill->ill_name, ipif->ipif_id));
2532 	ASSERT(ill->ill_dlpi_style_set);
2533 	ASSERT(WR(q)->q_next != NULL);
2534 
2535 	if (ill->ill_isv6) {
2536 		v6token_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) +
2537 		    sizeof (t_scalar_t), DL_PHYS_ADDR_REQ);
2538 		if (v6token_mp == NULL)
2539 			goto bad;
2540 		((dl_phys_addr_req_t *)v6token_mp->b_rptr)->dl_addr_type =
2541 		    DL_IPV6_TOKEN;
2542 
2543 		v6lla_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) +
2544 		    sizeof (t_scalar_t), DL_PHYS_ADDR_REQ);
2545 		if (v6lla_mp == NULL)
2546 			goto bad;
2547 		((dl_phys_addr_req_t *)v6lla_mp->b_rptr)->dl_addr_type =
2548 		    DL_IPV6_LINK_LAYER_ADDR;
2549 	}
2550 
2551 	/*
2552 	 * Allocate a DL_NOTIFY_REQ and set the notifications we want.
2553 	 */
2554 	notify_mp = ip_dlpi_alloc(sizeof (dl_notify_req_t) + sizeof (long),
2555 	    DL_NOTIFY_REQ);
2556 	if (notify_mp == NULL)
2557 		goto bad;
2558 	((dl_notify_req_t *)notify_mp->b_rptr)->dl_notifications =
2559 	    (DL_NOTE_PHYS_ADDR | DL_NOTE_SDU_SIZE | DL_NOTE_FASTPATH_FLUSH |
2560 	    DL_NOTE_LINK_UP | DL_NOTE_LINK_DOWN | DL_NOTE_CAPAB_RENEG);
2561 
2562 	phys_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) +
2563 	    sizeof (t_scalar_t), DL_PHYS_ADDR_REQ);
2564 	if (phys_mp == NULL)
2565 		goto bad;
2566 	((dl_phys_addr_req_t *)phys_mp->b_rptr)->dl_addr_type =
2567 	    DL_CURR_PHYS_ADDR;
2568 
2569 	info_mp = ip_dlpi_alloc(
2570 	    sizeof (dl_info_req_t) + sizeof (dl_info_ack_t),
2571 	    DL_INFO_REQ);
2572 	if (info_mp == NULL)
2573 		goto bad;
2574 
2575 	bind_mp = ip_dlpi_alloc(sizeof (dl_bind_req_t) + sizeof (long),
2576 	    DL_BIND_REQ);
2577 	if (bind_mp == NULL)
2578 		goto bad;
2579 	((dl_bind_req_t *)bind_mp->b_rptr)->dl_sap = ill->ill_sap;
2580 	((dl_bind_req_t *)bind_mp->b_rptr)->dl_service_mode = DL_CLDLS;
2581 
2582 	unbind_mp = ip_dlpi_alloc(sizeof (dl_unbind_req_t), DL_UNBIND_REQ);
2583 	if (unbind_mp == NULL)
2584 		goto bad;
2585 
2586 	/* If we need to attach/detach, pre-alloc and initialize the mblks */
2587 	if (ill->ill_needs_attach) {
2588 		attach_mp = ip_dlpi_alloc(sizeof (dl_attach_req_t),
2589 		    DL_ATTACH_REQ);
2590 		if (attach_mp == NULL)
2591 			goto bad;
2592 		((dl_attach_req_t *)attach_mp->b_rptr)->dl_ppa = ill->ill_ppa;
2593 
2594 		detach_mp = ip_dlpi_alloc(sizeof (dl_detach_req_t),
2595 		    DL_DETACH_REQ);
2596 		if (detach_mp == NULL)
2597 			goto bad;
2598 	}
2599 
2600 	/*
2601 	 * Here we are going to delay the ioctl ack until after
2602 	 * ACKs from DL_PHYS_ADDR_REQ. So need to save the
2603 	 * original ioctl message before sending the requests
2604 	 */
2605 	mutex_enter(&ill->ill_lock);
2606 	/* ipsq_pending_mp_add won't fail since we pass in a NULL connp */
2607 	(void) ipsq_pending_mp_add(NULL, ipif, ill->ill_wq, mp, 0);
2608 	/*
2609 	 * Set ill_phys_addr_pend to zero. It will be set to the addr_type of
2610 	 * the DL_PHYS_ADDR_REQ in ill_dlpi_send() and ill_dlpi_done(). It will
2611 	 * be used to track which DL_PHYS_ADDR_REQ is being ACK'd/NAK'd.
2612 	 */
2613 	ill->ill_phys_addr_pend = 0;
2614 	mutex_exit(&ill->ill_lock);
2615 
2616 	if (attach_mp != NULL) {
2617 		ip1dbg(("ill_dl_phys: attach\n"));
2618 		ill_dlpi_send(ill, attach_mp);
2619 	}
2620 	ill_dlpi_send(ill, bind_mp);
2621 	ill_dlpi_send(ill, info_mp);
2622 	if (ill->ill_isv6) {
2623 		ill_dlpi_send(ill, v6token_mp);
2624 		ill_dlpi_send(ill, v6lla_mp);
2625 	}
2626 	ill_dlpi_send(ill, phys_mp);
2627 	ill_dlpi_send(ill, notify_mp);
2628 	ill_dlpi_send(ill, unbind_mp);
2629 
2630 	/*
2631 	 * Save the DL_DETACH_REQ (if there is one) for use in ill_delete().
2632 	 */
2633 	ASSERT(ill->ill_detach_mp == NULL);
2634 	ill->ill_detach_mp = detach_mp;
2635 
2636 	/*
2637 	 * This operation will complete in ip_rput_dlpi_writer with either
2638 	 * a DL_PHYS_ADDR_ACK or DL_ERROR_ACK.
2639 	 */
2640 	return (EINPROGRESS);
2641 bad:
2642 	if (v6token_mp != NULL)
2643 		freemsg(v6token_mp);
2644 	if (v6lla_mp != NULL)
2645 		freemsg(v6lla_mp);
2646 	if (phys_mp != NULL)
2647 		freemsg(phys_mp);
2648 	if (info_mp != NULL)
2649 		freemsg(info_mp);
2650 	if (attach_mp != NULL)
2651 		freemsg(attach_mp);
2652 	if (detach_mp != NULL)
2653 		freemsg(detach_mp);
2654 	if (bind_mp != NULL)
2655 		freemsg(bind_mp);
2656 	if (unbind_mp != NULL)
2657 		freemsg(unbind_mp);
2658 	if (notify_mp != NULL)
2659 		freemsg(notify_mp);
2660 	return (ENOMEM);
2661 }
2662 
2663 uint_t ip_loopback_mtu_v6plus = IP_LOOPBACK_MTU + IPV6_HDR_LEN + 20;
2664 
2665 /*
2666  * DLPI is up.
2667  * Create all the IREs associated with an interface bring up multicast.
2668  * Set the interface flag and finish other initialization
2669  * that potentially had to be differed to after DL_BIND_ACK.
2670  */
2671 int
2672 ipif_up_done_v6(ipif_t *ipif)
2673 {
2674 	ire_t	*ire_array[20];
2675 	ire_t	**irep = ire_array;
2676 	ire_t	**irep1;
2677 	ill_t	*ill = ipif->ipif_ill;
2678 	queue_t	*stq;
2679 	in6_addr_t	v6addr;
2680 	in6_addr_t	route_mask;
2681 	ipif_t	 *src_ipif = NULL;
2682 	ipif_t   *tmp_ipif;
2683 	boolean_t	flush_ire_cache = B_TRUE;
2684 	int	err;
2685 	char	buf[INET6_ADDRSTRLEN];
2686 	phyint_t *phyi;
2687 	ire_t	**ipif_saved_irep = NULL;
2688 	int ipif_saved_ire_cnt;
2689 	int cnt;
2690 	boolean_t src_ipif_held = B_FALSE;
2691 	boolean_t ire_added = B_FALSE;
2692 	boolean_t loopback = B_FALSE;
2693 	boolean_t ip6_asp_table_held = B_FALSE;
2694 
2695 	ip1dbg(("ipif_up_done_v6(%s:%u)\n",
2696 		ipif->ipif_ill->ill_name, ipif->ipif_id));
2697 
2698 	/* Check if this is a loopback interface */
2699 	if (ipif->ipif_ill->ill_wq == NULL)
2700 		loopback = B_TRUE;
2701 
2702 	ASSERT(ipif->ipif_isv6);
2703 	ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock));
2704 
2705 	/*
2706 	 * If all other interfaces for this ill are down or DEPRECATED,
2707 	 * or otherwise unsuitable for source address selection, remove
2708 	 * any IRE_CACHE entries for this ill to make sure source
2709 	 * address selection gets to take this new ipif into account.
2710 	 * No need to hold ill_lock while traversing the ipif list since
2711 	 * we are writer
2712 	 */
2713 	for (tmp_ipif = ill->ill_ipif; tmp_ipif;
2714 		tmp_ipif = tmp_ipif->ipif_next) {
2715 		if (((tmp_ipif->ipif_flags &
2716 		    (IPIF_NOXMIT|IPIF_ANYCAST|IPIF_NOLOCAL|IPIF_DEPRECATED)) ||
2717 		    !(tmp_ipif->ipif_flags & IPIF_UP)) ||
2718 		    (tmp_ipif == ipif))
2719 			continue;
2720 		/* first useable pre-existing interface */
2721 		flush_ire_cache = B_FALSE;
2722 		break;
2723 	}
2724 	if (flush_ire_cache)
2725 		ire_walk_ill_v6(MATCH_IRE_ILL_GROUP | MATCH_IRE_TYPE,
2726 		    IRE_CACHE, ill_ipif_cache_delete, (char *)ill, ill);
2727 
2728 	/*
2729 	 * Figure out which way the send-to queue should go.  Only
2730 	 * IRE_IF_RESOLVER or IRE_IF_NORESOLVER should show up here.
2731 	 */
2732 	switch (ill->ill_net_type) {
2733 	case IRE_IF_RESOLVER:
2734 		stq = ill->ill_rq;
2735 		break;
2736 	case IRE_IF_NORESOLVER:
2737 	case IRE_LOOPBACK:
2738 		stq = ill->ill_wq;
2739 		break;
2740 	default:
2741 		return (EINVAL);
2742 	}
2743 
2744 	if (ill->ill_phyint->phyint_flags & PHYI_LOOPBACK) {
2745 		/*
2746 		 * lo0:1 and subsequent ipifs were marked IRE_LOCAL in
2747 		 * ipif_lookup_on_name(), but in the case of zones we can have
2748 		 * several loopback addresses on lo0. So all the interfaces with
2749 		 * loopback addresses need to be marked IRE_LOOPBACK.
2750 		 */
2751 		if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr, &ipv6_loopback))
2752 			ipif->ipif_ire_type = IRE_LOOPBACK;
2753 		else
2754 			ipif->ipif_ire_type = IRE_LOCAL;
2755 	}
2756 
2757 	if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST|IPIF_DEPRECATED)) {
2758 		/*
2759 		 * Can't use our source address. Select a different
2760 		 * source address for the IRE_INTERFACE and IRE_LOCAL
2761 		 */
2762 		if (ip6_asp_can_lookup()) {
2763 			ip6_asp_table_held = B_TRUE;
2764 			src_ipif = ipif_select_source_v6(ipif->ipif_ill,
2765 			    &ipif->ipif_v6subnet, RESTRICT_TO_NONE,
2766 			    IPV6_PREFER_SRC_DEFAULT, ipif->ipif_zoneid);
2767 		}
2768 		if (src_ipif == NULL)
2769 			src_ipif = ipif;	/* Last resort */
2770 		else
2771 			src_ipif_held = B_TRUE;
2772 	} else {
2773 		src_ipif = ipif;
2774 	}
2775 
2776 	if (!IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) &&
2777 	    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
2778 
2779 		/*
2780 		 * If we're on a labeled system then make sure that zone-
2781 		 * private addresses have proper remote host database entries.
2782 		 */
2783 		if (is_system_labeled() &&
2784 		    ipif->ipif_ire_type != IRE_LOOPBACK) {
2785 			if (ip6opt_ls == 0) {
2786 				cmn_err(CE_WARN, "IPv6 not enabled "
2787 				    "via /etc/system");
2788 				return (EINVAL);
2789 			}
2790 			if (!tsol_check_interface_address(ipif))
2791 				return (EINVAL);
2792 		}
2793 
2794 		/* Register the source address for __sin6_src_id */
2795 		err = ip_srcid_insert(&ipif->ipif_v6lcl_addr,
2796 		    ipif->ipif_zoneid);
2797 		if (err != 0) {
2798 			ip0dbg(("ipif_up_done_v6: srcid_insert %d\n", err));
2799 			if (src_ipif_held)
2800 				ipif_refrele(src_ipif);
2801 			if (ip6_asp_table_held)
2802 				ip6_asp_table_refrele();
2803 			return (err);
2804 		}
2805 		/*
2806 		 * If the interface address is set, create the LOCAL
2807 		 * or LOOPBACK IRE.
2808 		 */
2809 		ip1dbg(("ipif_up_done_v6: creating IRE %d for %s\n",
2810 		    ipif->ipif_ire_type,
2811 		    inet_ntop(AF_INET6, &ipif->ipif_v6lcl_addr,
2812 		    buf, sizeof (buf))));
2813 
2814 		*irep++ = ire_create_v6(
2815 		    &ipif->ipif_v6lcl_addr,		/* dest address */
2816 		    &ipv6_all_ones,			/* mask */
2817 		    &src_ipif->ipif_v6src_addr,		/* source address */
2818 		    NULL,				/* no gateway */
2819 		    &ip_loopback_mtu_v6plus,		/* max frag size */
2820 		    NULL,
2821 		    ipif->ipif_rq,			/* recv-from queue */
2822 		    NULL,				/* no send-to queue */
2823 		    ipif->ipif_ire_type,		/* LOCAL or LOOPBACK */
2824 		    NULL,
2825 		    ipif,				/* interface */
2826 		    NULL,
2827 		    0,
2828 		    0,
2829 		    (ipif->ipif_flags & IPIF_PRIVATE) ? RTF_PRIVATE : 0,
2830 		    &ire_uinfo_null,
2831 		    NULL,
2832 		    NULL);
2833 	}
2834 
2835 	/*
2836 	 * Set up the IRE_IF_RESOLVER or IRE_IF_NORESOLVER, as appropriate.
2837 	 * Note that atun interfaces have an all-zero ipif_v6subnet.
2838 	 * Thus we allow a zero subnet as long as the mask is non-zero.
2839 	 */
2840 	if (stq != NULL && !(ipif->ipif_flags & IPIF_NOXMIT) &&
2841 	    !(IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet) &&
2842 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6net_mask))) {
2843 		/* ipif_v6subnet is ipif_v6pp_dst_addr for pt-pt */
2844 		v6addr = ipif->ipif_v6subnet;
2845 
2846 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
2847 			route_mask = ipv6_all_ones;
2848 		} else {
2849 			route_mask = ipif->ipif_v6net_mask;
2850 		}
2851 
2852 		ip1dbg(("ipif_up_done_v6: creating if IRE %d for %s\n",
2853 		    ill->ill_net_type,
2854 		    inet_ntop(AF_INET6, &v6addr, buf, sizeof (buf))));
2855 
2856 		*irep++ = ire_create_v6(
2857 		    &v6addr,			/* dest pref */
2858 		    &route_mask,		/* mask */
2859 		    &src_ipif->ipif_v6src_addr,	/* src addr */
2860 		    NULL,			/* no gateway */
2861 		    &ipif->ipif_mtu,		/* max frag */
2862 		    NULL,			/* no Fast path header */
2863 		    NULL,			/* no recv from queue */
2864 		    stq,			/* send-to queue */
2865 		    ill->ill_net_type,		/* IF_[NO]RESOLVER */
2866 		    ill->ill_resolver_mp,	/* xmit header */
2867 		    ipif,
2868 		    NULL,
2869 		    0,
2870 		    0,
2871 		    (ipif->ipif_flags & IPIF_PRIVATE) ? RTF_PRIVATE : 0,
2872 		    &ire_uinfo_null,
2873 		    NULL,
2874 		    NULL);
2875 	}
2876 
2877 	/*
2878 	 * Setup 2002::/16 route, if this interface is a 6to4 tunnel
2879 	 */
2880 	if (IN6_IS_ADDR_6TO4(&ipif->ipif_v6lcl_addr) &&
2881 	    (ill->ill_is_6to4tun)) {
2882 		/*
2883 		 * Destination address is 2002::/16
2884 		 */
2885 #ifdef	_BIG_ENDIAN
2886 		const in6_addr_t prefix_addr = { 0x20020000U, 0, 0, 0 };
2887 		const in6_addr_t prefix_mask = { 0xffff0000U, 0, 0, 0 };
2888 #else
2889 		const in6_addr_t prefix_addr = { 0x00000220U, 0, 0, 0 };
2890 		const in6_addr_t prefix_mask = { 0x0000ffffU, 0, 0, 0 };
2891 #endif /* _BIG_ENDIAN */
2892 		char	buf2[INET6_ADDRSTRLEN];
2893 		ire_t *isdup;
2894 		in6_addr_t *first_addr = &ill->ill_ipif->ipif_v6lcl_addr;
2895 
2896 		/*
2897 		 * check to see if this route has already been added for
2898 		 * this tunnel interface.
2899 		 */
2900 		isdup = ire_ftable_lookup_v6(first_addr, &prefix_mask, 0,
2901 		    IRE_IF_NORESOLVER, ill->ill_ipif, NULL, ALL_ZONES, 0, NULL,
2902 		    (MATCH_IRE_SRC | MATCH_IRE_MASK));
2903 
2904 		if (isdup == NULL) {
2905 			ip1dbg(("ipif_up_done_v6: creating if IRE %d for %s",
2906 			    IRE_IF_NORESOLVER, inet_ntop(AF_INET6, &v6addr,
2907 				buf2, sizeof (buf2))));
2908 
2909 			*irep++ = ire_create_v6(
2910 			    &prefix_addr,		/* 2002:: */
2911 			    &prefix_mask,		/* ffff:: */
2912 			    &ipif->ipif_v6lcl_addr, 	/* src addr */
2913 			    NULL, 			/* gateway */
2914 			    &ipif->ipif_mtu, 		/* max_frag */
2915 			    NULL, 			/* no Fast Path hdr */
2916 			    NULL, 			/* no rfq */
2917 			    ill->ill_wq, 		/* stq */
2918 			    IRE_IF_NORESOLVER,		/* type */
2919 			    ill->ill_resolver_mp,	/* dlureq_mp */
2920 			    ipif,			/* interface */
2921 			    NULL,			/* v6cmask */
2922 			    0,
2923 			    0,
2924 			    RTF_UP,
2925 			    &ire_uinfo_null,
2926 			    NULL,
2927 			    NULL);
2928 		} else {
2929 			ire_refrele(isdup);
2930 		}
2931 	}
2932 
2933 	/* If an earlier ire_create failed, get out now */
2934 	for (irep1 = irep; irep1 > ire_array; ) {
2935 		irep1--;
2936 		if (*irep1 == NULL) {
2937 			ip1dbg(("ipif_up_done_v6: NULL ire found in"
2938 			    " ire_array\n"));
2939 			err = ENOMEM;
2940 			goto bad;
2941 		}
2942 	}
2943 
2944 	ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock));
2945 
2946 	/*
2947 	 * Need to atomically check for ip_addr_availablity_check
2948 	 * now under ill_g_lock, and if it fails got bad, and remove
2949 	 * from group also
2950 	 */
2951 	rw_enter(&ill_g_lock, RW_READER);
2952 	mutex_enter(&ip_addr_avail_lock);
2953 	ill->ill_ipif_up_count++;
2954 	ipif->ipif_flags |= IPIF_UP;
2955 	err = ip_addr_availability_check(ipif);
2956 	mutex_exit(&ip_addr_avail_lock);
2957 	rw_exit(&ill_g_lock);
2958 
2959 	if (err != 0) {
2960 		/*
2961 		 * Our address may already be up on the same ill. In this case,
2962 		 * the external resolver entry for our ipif replaced the one for
2963 		 * the other ipif. So we don't want to delete it (otherwise the
2964 		 * other ipif would be unable to send packets).
2965 		 * ip_addr_availability_check() identifies this case for us and
2966 		 * returns EADDRINUSE; we need to turn it into EADDRNOTAVAIL
2967 		 * which is the expected error code.
2968 		 */
2969 		if (err == EADDRINUSE) {
2970 			if (ipif->ipif_ill->ill_flags & ILLF_XRESOLV) {
2971 				freemsg(ipif->ipif_arp_del_mp);
2972 				ipif->ipif_arp_del_mp = NULL;
2973 			}
2974 			err = EADDRNOTAVAIL;
2975 		}
2976 		ill->ill_ipif_up_count--;
2977 		ipif->ipif_flags &= ~IPIF_UP;
2978 		goto bad;
2979 	}
2980 
2981 	/*
2982 	 * Add in all newly created IREs. We want to add before
2983 	 * we call ifgrp_insert which wants to know whether
2984 	 * IRE_IF_RESOLVER exists or not.
2985 	 *
2986 	 * NOTE : We refrele the ire though we may branch to "bad"
2987 	 *	  later on where we do ire_delete. This is okay
2988 	 *	  because nobody can delete it as we are running
2989 	 *	  exclusively.
2990 	 */
2991 	for (irep1 = irep; irep1 > ire_array; ) {
2992 		irep1--;
2993 		/* Shouldn't be adding any bcast ire's */
2994 		ASSERT((*irep1)->ire_type != IRE_BROADCAST);
2995 		ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock));
2996 		/*
2997 		 * refheld by ire_add. refele towards the end of the func
2998 		 */
2999 		(void) ire_add(irep1, NULL, NULL, NULL, B_FALSE);
3000 	}
3001 	if (ip6_asp_table_held) {
3002 		ip6_asp_table_refrele();
3003 		ip6_asp_table_held = B_FALSE;
3004 	}
3005 	ire_added = B_TRUE;
3006 
3007 	/*
3008 	 * Form groups if possible.
3009 	 *
3010 	 * If we are supposed to be in a ill_group with a name, insert it
3011 	 * now as we know that at least one ipif is UP. Otherwise form
3012 	 * nameless groups.
3013 	 *
3014 	 * If ip_enable_group_ifs is set and ipif address is not ::0, insert
3015 	 * this ipif into the appropriate interface group, or create a
3016 	 * new one. If this is already in a nameless group, we try to form
3017 	 * a bigger group looking at other ills potentially sharing this
3018 	 * ipif's prefix.
3019 	 */
3020 	phyi = ill->ill_phyint;
3021 	if (phyi->phyint_groupname_len != 0) {
3022 		ASSERT(phyi->phyint_groupname != NULL);
3023 		if (ill->ill_ipif_up_count == 1) {
3024 			ASSERT(ill->ill_group == NULL);
3025 			err = illgrp_insert(&illgrp_head_v6, ill,
3026 			    phyi->phyint_groupname, NULL, B_TRUE);
3027 			if (err != 0) {
3028 				ip1dbg(("ipif_up_done_v6: illgrp allocation "
3029 				    "failed, error %d\n", err));
3030 				goto bad;
3031 			}
3032 		}
3033 		ASSERT(ill->ill_group != NULL);
3034 	}
3035 
3036 	/* Recover any additional IRE_IF_[NO]RESOLVER entries for this ipif */
3037 	ipif_saved_ire_cnt = ipif->ipif_saved_ire_cnt;
3038 	ipif_saved_irep = ipif_recover_ire_v6(ipif);
3039 
3040 	if (ipif->ipif_ipif_up_count == 1 && !loopback) {
3041 		/*
3042 		 * Need to recover all multicast memberships in the driver.
3043 		 * This had to be deferred until we had attached.
3044 		 */
3045 		ill_recover_multicast(ill);
3046 	}
3047 	/* Join the allhosts multicast address and the solicited node MC */
3048 	ipif_multicast_up(ipif);
3049 
3050 	if (!loopback) {
3051 		/*
3052 		 * See whether anybody else would benefit from the
3053 		 * new ipif that we added. We call this always rather
3054 		 * than while adding a non-IPIF_NOLOCAL/DEPRECATED/ANYCAST
3055 		 * ipif for the benefit of illgrp_insert (done above)
3056 		 * which does not do source address selection as it does
3057 		 * not want to re-create interface routes that we are
3058 		 * having reference to it here.
3059 		 */
3060 		ill_update_source_selection(ill);
3061 	}
3062 
3063 	for (irep1 = irep; irep1 > ire_array; ) {
3064 		irep1--;
3065 		if (*irep1 != NULL) {
3066 			/* was held in ire_add */
3067 			ire_refrele(*irep1);
3068 		}
3069 	}
3070 
3071 	cnt = ipif_saved_ire_cnt;
3072 	for (irep1 = ipif_saved_irep; cnt > 0; irep1++, cnt--) {
3073 		if (*irep1 != NULL) {
3074 			/* was held in ire_add */
3075 			ire_refrele(*irep1);
3076 		}
3077 	}
3078 
3079 	if (ipif->ipif_addr_ready) {
3080 		ip_rts_ifmsg(ipif);
3081 		ip_rts_newaddrmsg(RTM_ADD, 0, ipif);
3082 		sctp_update_ipif(ipif, SCTP_IPIF_UP);
3083 	}
3084 
3085 	if (ipif_saved_irep != NULL) {
3086 		kmem_free(ipif_saved_irep,
3087 		    ipif_saved_ire_cnt * sizeof (ire_t *));
3088 	}
3089 
3090 	if (src_ipif_held)
3091 		ipif_refrele(src_ipif);
3092 	return (0);
3093 
3094 bad:
3095 	if (ip6_asp_table_held)
3096 		ip6_asp_table_refrele();
3097 	/*
3098 	 * We don't have to bother removing from ill groups because
3099 	 *
3100 	 * 1) For groups with names, we insert only when the first ipif
3101 	 *    comes up. In that case if it fails, it will not be in any
3102 	 *    group. So, we need not try to remove for that case.
3103 	 *
3104 	 * 2) For groups without names, either we tried to insert ipif_ill
3105 	 *    in a group as singleton or found some other group to become
3106 	 *    a bigger group. For the former, if it fails we don't have
3107 	 *    anything to do as ipif_ill is not in the group and for the
3108 	 *    latter, there are no failures in illgrp_insert/illgrp_delete
3109 	 *    (ENOMEM can't occur for this. Check ifgrp_insert).
3110 	 */
3111 
3112 	while (irep > ire_array) {
3113 		irep--;
3114 		if (*irep != NULL) {
3115 			ire_delete(*irep);
3116 			if (ire_added)
3117 				ire_refrele(*irep);
3118 		}
3119 
3120 	}
3121 	(void) ip_srcid_remove(&ipif->ipif_v6lcl_addr, ipif->ipif_zoneid);
3122 
3123 	if (ipif_saved_irep != NULL) {
3124 		kmem_free(ipif_saved_irep,
3125 		    ipif_saved_ire_cnt * sizeof (ire_t *));
3126 	}
3127 	if (src_ipif_held)
3128 		ipif_refrele(src_ipif);
3129 
3130 	ipif_ndp_down(ipif);
3131 	if (ipif->ipif_ill->ill_flags & ILLF_XRESOLV)
3132 		ipif_arp_down(ipif);
3133 
3134 	return (err);
3135 }
3136 
3137 /*
3138  * Delete an ND entry and the corresponding IRE_CACHE entry if it exists.
3139  */
3140 /* ARGSUSED */
3141 int
3142 ip_siocdelndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
3143     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
3144 {
3145 	in6_addr_t	addr;
3146 	sin6_t		*sin6;
3147 	nce_t		*nce;
3148 	struct lifreq	*lifr;
3149 	lif_nd_req_t	*lnr;
3150 	mblk_t	*mp1;
3151 
3152 	mp1 = mp->b_cont->b_cont;
3153 	lifr = (struct lifreq *)mp1->b_rptr;
3154 	lnr = &lifr->lifr_nd;
3155 	/* Only allow for logical unit zero i.e. not on "le0:17" */
3156 	if (ipif->ipif_id != 0)
3157 		return (EINVAL);
3158 
3159 	if (!ipif->ipif_isv6)
3160 		return (EINVAL);
3161 
3162 	if (lnr->lnr_addr.ss_family != AF_INET6)
3163 		return (EAFNOSUPPORT);
3164 
3165 	sin6 = (sin6_t *)&lnr->lnr_addr;
3166 	addr = sin6->sin6_addr;
3167 	nce = ndp_lookup_v6(ipif->ipif_ill, &addr, B_FALSE);
3168 	if (nce == NULL)
3169 		return (ESRCH);
3170 	ndp_delete(nce);
3171 	NCE_REFRELE(nce);
3172 	return (0);
3173 }
3174 
3175 /*
3176  * Return nbr cache info.
3177  */
3178 /* ARGSUSED */
3179 int
3180 ip_siocqueryndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
3181     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
3182 {
3183 	ill_t		*ill = ipif->ipif_ill;
3184 	struct lifreq	*lifr;
3185 	lif_nd_req_t	*lnr;
3186 
3187 	lifr = (struct lifreq *)mp->b_cont->b_cont->b_rptr;
3188 	lnr = &lifr->lifr_nd;
3189 	/* Only allow for logical unit zero i.e. not on "le0:17" */
3190 	if (ipif->ipif_id != 0)
3191 		return (EINVAL);
3192 
3193 	if (!ipif->ipif_isv6)
3194 		return (EINVAL);
3195 
3196 	if (lnr->lnr_addr.ss_family != AF_INET6)
3197 		return (EAFNOSUPPORT);
3198 
3199 	if (ill->ill_phys_addr_length > sizeof (lnr->lnr_hdw_addr))
3200 		return (EINVAL);
3201 
3202 	return (ndp_query(ill, lnr));
3203 }
3204 
3205 /*
3206  * Perform an update of the nd entry for the specified address.
3207  */
3208 /* ARGSUSED */
3209 int
3210 ip_siocsetndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
3211     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
3212 {
3213 	ill_t		*ill = ipif->ipif_ill;
3214 	struct	lifreq	*lifr;
3215 	lif_nd_req_t	*lnr;
3216 
3217 	lifr = (struct lifreq *)mp->b_cont->b_cont->b_rptr;
3218 	lnr = &lifr->lifr_nd;
3219 	/* Only allow for logical unit zero i.e. not on "le0:17" */
3220 	if (ipif->ipif_id != 0)
3221 		return (EINVAL);
3222 
3223 	if (!ipif->ipif_isv6)
3224 		return (EINVAL);
3225 
3226 	if (lnr->lnr_addr.ss_family != AF_INET6)
3227 		return (EAFNOSUPPORT);
3228 
3229 	return (ndp_sioc_update(ill, lnr));
3230 }
3231