xref: /titanic_52/usr/src/uts/common/inet/ip/ip6_if.c (revision bd670b35a010421b6e1a5536c34453a827007c81)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 /*
26  * Copyright (c) 1990 Mentat Inc.
27  */
28 
29 /*
30  * This file contains the interface control functions for IPv6.
31  */
32 
33 #include <sys/types.h>
34 #include <sys/sysmacros.h>
35 #include <sys/stream.h>
36 #include <sys/dlpi.h>
37 #include <sys/stropts.h>
38 #include <sys/ddi.h>
39 #include <sys/cmn_err.h>
40 #include <sys/kstat.h>
41 #include <sys/debug.h>
42 #include <sys/zone.h>
43 #include <sys/policy.h>
44 
45 #include <sys/systm.h>
46 #include <sys/param.h>
47 #include <sys/socket.h>
48 #include <sys/isa_defs.h>
49 #include <net/if.h>
50 #include <net/if_dl.h>
51 #include <net/route.h>
52 #include <netinet/in.h>
53 #include <netinet/igmp_var.h>
54 #include <netinet/ip6.h>
55 #include <netinet/icmp6.h>
56 
57 #include <inet/common.h>
58 #include <inet/nd.h>
59 #include <inet/mib2.h>
60 #include <inet/ip.h>
61 #include <inet/ip6.h>
62 #include <inet/ip_multi.h>
63 #include <inet/ip_ire.h>
64 #include <inet/ip_rts.h>
65 #include <inet/ip_ndp.h>
66 #include <inet/ip_if.h>
67 #include <inet/ip6_asp.h>
68 #include <inet/ipclassifier.h>
69 #include <inet/sctp_ip.h>
70 
71 #include <sys/tsol/tndb.h>
72 #include <sys/tsol/tnet.h>
73 
74 static in6_addr_t	ipv6_ll_template =
75 			{(uint32_t)V6_LINKLOCAL, 0x0, 0x0, 0x0};
76 
77 static ipif_t *
78 ipif_lookup_interface_v6(const in6_addr_t *if_addr, const in6_addr_t *dst,
79     ip_stack_t *ipst);
80 
81 static int	ipif_add_ires_v6(ipif_t *, boolean_t);
82 
83 /*
84  * This function is called when an application does not specify an interface
85  * to be used for multicast traffic.  It calls ire_lookup_multi_v6() to look
86  * for an interface route for the specified multicast group.  Doing
87  * this allows the administrator to add prefix routes for multicast to
88  * indicate which interface to be used for multicast traffic in the above
89  * scenario.  The route could be for all multicast (ff00::/8), for a single
90  * multicast group (a /128 route) or anything in between.  If there is no
91  * such multicast route, we just find any multicast capable interface and
92  * return it.
93  *
94  * We support MULTIRT and RTF_SETSRC on the multicast routes added to the
95  * unicast table. This is used by CGTP.
96  */
97 ill_t *
98 ill_lookup_group_v6(const in6_addr_t *group, zoneid_t zoneid, ip_stack_t *ipst,
99     boolean_t *multirtp, in6_addr_t *setsrcp)
100 {
101 	ill_t	*ill;
102 
103 	ill = ire_lookup_multi_ill_v6(group, zoneid, ipst, multirtp, setsrcp);
104 	if (ill != NULL)
105 		return (ill);
106 
107 	return (ill_lookup_multicast(ipst, zoneid, B_TRUE));
108 }
109 
110 /*
111  * Look for an ipif with the specified interface address and destination.
112  * The destination address is used only for matching point-to-point interfaces.
113  */
114 static ipif_t *
115 ipif_lookup_interface_v6(const in6_addr_t *if_addr, const in6_addr_t *dst,
116     ip_stack_t *ipst)
117 {
118 	ipif_t	*ipif;
119 	ill_t	*ill;
120 	ill_walk_context_t ctx;
121 
122 	/*
123 	 * First match all the point-to-point interfaces
124 	 * before looking at non-point-to-point interfaces.
125 	 * This is done to avoid returning non-point-to-point
126 	 * ipif instead of unnumbered point-to-point ipif.
127 	 */
128 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
129 	ill = ILL_START_WALK_V6(&ctx, ipst);
130 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
131 		mutex_enter(&ill->ill_lock);
132 		for (ipif = ill->ill_ipif; ipif != NULL;
133 		    ipif = ipif->ipif_next) {
134 			/* Allow the ipif to be down */
135 			if ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
136 			    (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr,
137 			    if_addr)) &&
138 			    (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr,
139 			    dst))) {
140 				if (!IPIF_IS_CONDEMNED(ipif)) {
141 					ipif_refhold_locked(ipif);
142 					mutex_exit(&ill->ill_lock);
143 					rw_exit(&ipst->ips_ill_g_lock);
144 					return (ipif);
145 				}
146 			}
147 		}
148 		mutex_exit(&ill->ill_lock);
149 	}
150 	rw_exit(&ipst->ips_ill_g_lock);
151 	/* lookup the ipif based on interface address */
152 	ipif = ipif_lookup_addr_v6(if_addr, NULL, ALL_ZONES, ipst);
153 	ASSERT(ipif == NULL || ipif->ipif_isv6);
154 	return (ipif);
155 }
156 
157 /*
158  * Common function for ipif_lookup_addr_v6() and ipif_lookup_addr_exact_v6().
159  */
160 static ipif_t *
161 ipif_lookup_addr_common_v6(const in6_addr_t *addr, ill_t *match_ill,
162     uint32_t match_flags, zoneid_t zoneid, ip_stack_t *ipst)
163 {
164 	ipif_t	*ipif;
165 	ill_t	*ill;
166 	boolean_t  ptp = B_FALSE;
167 	ill_walk_context_t ctx;
168 	boolean_t match_illgrp = (match_flags & IPIF_MATCH_ILLGRP);
169 	boolean_t no_duplicate = (match_flags & IPIF_MATCH_NONDUP);
170 
171 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
172 	/*
173 	 * Repeat twice, first based on local addresses and
174 	 * next time for pointopoint.
175 	 */
176 repeat:
177 	ill = ILL_START_WALK_V6(&ctx, ipst);
178 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
179 		if (match_ill != NULL && ill != match_ill &&
180 		    (!match_illgrp || !IS_IN_SAME_ILLGRP(ill, match_ill))) {
181 			continue;
182 		}
183 		mutex_enter(&ill->ill_lock);
184 		for (ipif = ill->ill_ipif; ipif != NULL;
185 		    ipif = ipif->ipif_next) {
186 			if (zoneid != ALL_ZONES &&
187 			    ipif->ipif_zoneid != zoneid &&
188 			    ipif->ipif_zoneid != ALL_ZONES)
189 				continue;
190 
191 			if (no_duplicate &&
192 			    !(ipif->ipif_flags & IPIF_UP)) {
193 				continue;
194 			}
195 
196 			/* Allow the ipif to be down */
197 			if ((!ptp && (IN6_ARE_ADDR_EQUAL(
198 			    &ipif->ipif_v6lcl_addr, addr) &&
199 			    (ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) ||
200 			    (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) &&
201 			    IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr,
202 			    addr))) {
203 				if (!IPIF_IS_CONDEMNED(ipif)) {
204 					ipif_refhold_locked(ipif);
205 					mutex_exit(&ill->ill_lock);
206 					rw_exit(&ipst->ips_ill_g_lock);
207 					return (ipif);
208 				}
209 			}
210 		}
211 		mutex_exit(&ill->ill_lock);
212 	}
213 
214 	/* If we already did the ptp case, then we are done */
215 	if (ptp) {
216 		rw_exit(&ipst->ips_ill_g_lock);
217 		return (NULL);
218 	}
219 	ptp = B_TRUE;
220 	goto repeat;
221 }
222 
223 /*
224  * Lookup an ipif with the specified address.  For point-to-point links we
225  * look for matches on either the destination address or the local address,
226  * but we skip the local address check if IPIF_UNNUMBERED is set.  If the
227  * `match_ill' argument is non-NULL, the lookup is restricted to that ill
228  * (or illgrp if `match_ill' is in an IPMP group).
229  */
230 ipif_t *
231 ipif_lookup_addr_v6(const in6_addr_t *addr, ill_t *match_ill, zoneid_t zoneid,
232     ip_stack_t *ipst)
233 {
234 	return (ipif_lookup_addr_common_v6(addr, match_ill, IPIF_MATCH_ILLGRP,
235 	    zoneid, ipst));
236 }
237 
238 /*
239  * Lookup an ipif with the specified address. Similar to ipif_lookup_addr,
240  * except that we will only return an address if it is not marked as
241  * IPIF_DUPLICATE
242  */
243 ipif_t *
244 ipif_lookup_addr_nondup_v6(const in6_addr_t *addr, ill_t *match_ill,
245     zoneid_t zoneid, ip_stack_t *ipst)
246 {
247 	return (ipif_lookup_addr_common_v6(addr, match_ill,
248 	    (IPIF_MATCH_ILLGRP | IPIF_MATCH_NONDUP), zoneid,
249 	    ipst));
250 }
251 
252 /*
253  * Special abbreviated version of ipif_lookup_addr_v6() that doesn't match
254  * `match_ill' across the IPMP group.  This function is only needed in some
255  * corner-cases; almost everything should use ipif_lookup_addr_v6().
256  */
257 ipif_t *
258 ipif_lookup_addr_exact_v6(const in6_addr_t *addr, ill_t *match_ill,
259     ip_stack_t *ipst)
260 {
261 	ASSERT(match_ill != NULL);
262 	return (ipif_lookup_addr_common_v6(addr, match_ill, 0, ALL_ZONES,
263 	    ipst));
264 }
265 
266 /*
267  * Look for an ipif with the specified address. For point-point links
268  * we look for matches on either the destination address and the local
269  * address, but we ignore the check on the local address if IPIF_UNNUMBERED
270  * is set.
271  * If the `match_ill' argument is non-NULL, the lookup is restricted to that
272  * ill (or illgrp if `match_ill' is in an IPMP group).
273  * Return the zoneid for the ipif. ALL_ZONES if none found.
274  */
275 zoneid_t
276 ipif_lookup_addr_zoneid_v6(const in6_addr_t *addr, ill_t *match_ill,
277     ip_stack_t *ipst)
278 {
279 	ipif_t	*ipif;
280 	ill_t	*ill;
281 	boolean_t  ptp = B_FALSE;
282 	ill_walk_context_t ctx;
283 	zoneid_t	zoneid;
284 
285 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
286 	/*
287 	 * Repeat twice, first based on local addresses and
288 	 * next time for pointopoint.
289 	 */
290 repeat:
291 	ill = ILL_START_WALK_V6(&ctx, ipst);
292 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
293 		if (match_ill != NULL && ill != match_ill &&
294 		    !IS_IN_SAME_ILLGRP(ill, match_ill)) {
295 			continue;
296 		}
297 		mutex_enter(&ill->ill_lock);
298 		for (ipif = ill->ill_ipif; ipif != NULL;
299 		    ipif = ipif->ipif_next) {
300 			/* Allow the ipif to be down */
301 			if ((!ptp && (IN6_ARE_ADDR_EQUAL(
302 			    &ipif->ipif_v6lcl_addr, addr) &&
303 			    (ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) ||
304 			    (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) &&
305 			    IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr,
306 			    addr)) &&
307 			    !(ipif->ipif_state_flags & IPIF_CONDEMNED)) {
308 				zoneid = ipif->ipif_zoneid;
309 				mutex_exit(&ill->ill_lock);
310 				rw_exit(&ipst->ips_ill_g_lock);
311 				/*
312 				 * If ipif_zoneid was ALL_ZONES then we have
313 				 * a trusted extensions shared IP address.
314 				 * In that case GLOBAL_ZONEID works to send.
315 				 */
316 				if (zoneid == ALL_ZONES)
317 					zoneid = GLOBAL_ZONEID;
318 				return (zoneid);
319 			}
320 		}
321 		mutex_exit(&ill->ill_lock);
322 	}
323 
324 	/* If we already did the ptp case, then we are done */
325 	if (ptp) {
326 		rw_exit(&ipst->ips_ill_g_lock);
327 		return (ALL_ZONES);
328 	}
329 	ptp = B_TRUE;
330 	goto repeat;
331 }
332 
333 /*
334  * Perform various checks to verify that an address would make sense as a local
335  * interface address.  This is currently only called when an attempt is made
336  * to set a local address.
337  *
338  * Does not allow a v4-mapped address, an address that equals the subnet
339  * anycast address, ... a multicast address, ...
340  */
341 boolean_t
342 ip_local_addr_ok_v6(const in6_addr_t *addr, const in6_addr_t *subnet_mask)
343 {
344 	in6_addr_t subnet;
345 
346 	if (IN6_IS_ADDR_UNSPECIFIED(addr))
347 		return (B_TRUE);	/* Allow all zeros */
348 
349 	/*
350 	 * Don't allow all zeroes or host part, but allow
351 	 * all ones netmask.
352 	 */
353 	V6_MASK_COPY(*addr, *subnet_mask, subnet);
354 	if (IN6_IS_ADDR_V4MAPPED(addr) ||
355 	    (IN6_ARE_ADDR_EQUAL(addr, &subnet) &&
356 	    !IN6_ARE_ADDR_EQUAL(subnet_mask, &ipv6_all_ones)) ||
357 	    (IN6_IS_ADDR_V4COMPAT(addr) && CLASSD(V4_PART_OF_V6((*addr)))) ||
358 	    IN6_IS_ADDR_MULTICAST(addr))
359 		return (B_FALSE);
360 
361 	return (B_TRUE);
362 }
363 
364 /*
365  * Perform various checks to verify that an address would make sense as a
366  * remote/subnet interface address.
367  */
368 boolean_t
369 ip_remote_addr_ok_v6(const in6_addr_t *addr, const in6_addr_t *subnet_mask)
370 {
371 	in6_addr_t subnet;
372 
373 	if (IN6_IS_ADDR_UNSPECIFIED(addr))
374 		return (B_TRUE);	/* Allow all zeros */
375 
376 	V6_MASK_COPY(*addr, *subnet_mask, subnet);
377 	if (IN6_IS_ADDR_V4MAPPED(addr) ||
378 	    (IN6_ARE_ADDR_EQUAL(addr, &subnet) &&
379 	    !IN6_ARE_ADDR_EQUAL(subnet_mask, &ipv6_all_ones)) ||
380 	    IN6_IS_ADDR_MULTICAST(addr) ||
381 	    (IN6_IS_ADDR_V4COMPAT(addr) && CLASSD(V4_PART_OF_V6((*addr)))))
382 		return (B_FALSE);
383 
384 	return (B_TRUE);
385 }
386 
387 /*
388  * ip_rt_add_v6 is called to add an IPv6 route to the forwarding table.
389  * ill is passed in to associate it with the correct interface
390  * (for link-local destinations and gateways).
391  * If ire_arg is set, then we return the held IRE in that location.
392  */
393 /* ARGSUSED1 */
394 int
395 ip_rt_add_v6(const in6_addr_t *dst_addr, const in6_addr_t *mask,
396     const in6_addr_t *gw_addr, const in6_addr_t *src_addr, int flags,
397     ill_t *ill, ire_t **ire_arg, struct rtsa_s *sp, ip_stack_t *ipst,
398     zoneid_t zoneid)
399 {
400 	ire_t	*ire, *nire;
401 	ire_t	*gw_ire = NULL;
402 	ipif_t	*ipif;
403 	uint_t	type;
404 	int	match_flags = MATCH_IRE_TYPE;
405 	tsol_gc_t *gc = NULL;
406 	tsol_gcgrp_t *gcgrp = NULL;
407 	boolean_t gcgrp_xtraref = B_FALSE;
408 
409 	if (ire_arg != NULL)
410 		*ire_arg = NULL;
411 
412 	/*
413 	 * Prevent routes with a zero gateway from being created (since
414 	 * interfaces can currently be plumbed and brought up with no assigned
415 	 * address).
416 	 */
417 	if (IN6_IS_ADDR_UNSPECIFIED(gw_addr))
418 		return (ENETUNREACH);
419 
420 	/*
421 	 * If this is the case of RTF_HOST being set, then we set the netmask
422 	 * to all ones (regardless if one was supplied).
423 	 */
424 	if (flags & RTF_HOST)
425 		mask = &ipv6_all_ones;
426 
427 	/*
428 	 * Get the ipif, if any, corresponding to the gw_addr
429 	 * If -ifp was specified we restrict ourselves to the ill, otherwise
430 	 * we match on the gatway and destination to handle unnumbered pt-pt
431 	 * interfaces.
432 	 */
433 	if (ill != NULL)
434 		ipif = ipif_lookup_addr_v6(gw_addr, ill, ALL_ZONES, ipst);
435 	else
436 		ipif = ipif_lookup_interface_v6(gw_addr, dst_addr, ipst);
437 	if (ipif != NULL) {
438 		if (IS_VNI(ipif->ipif_ill)) {
439 			ipif_refrele(ipif);
440 			return (EINVAL);
441 		}
442 	}
443 
444 	/*
445 	 * GateD will attempt to create routes with a loopback interface
446 	 * address as the gateway and with RTF_GATEWAY set.  We allow
447 	 * these routes to be added, but create them as interface routes
448 	 * since the gateway is an interface address.
449 	 */
450 	if ((ipif != NULL) && (ipif->ipif_ire_type == IRE_LOOPBACK)) {
451 		flags &= ~RTF_GATEWAY;
452 		if (IN6_ARE_ADDR_EQUAL(gw_addr, &ipv6_loopback) &&
453 		    IN6_ARE_ADDR_EQUAL(dst_addr, &ipv6_loopback) &&
454 		    IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones)) {
455 			ire = ire_ftable_lookup_v6(dst_addr, 0, 0, IRE_LOOPBACK,
456 			    NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, 0, ipst,
457 			    NULL);
458 			if (ire != NULL) {
459 				ire_refrele(ire);
460 				ipif_refrele(ipif);
461 				return (EEXIST);
462 			}
463 			ip1dbg(("ip_rt_add_v6: 0x%p creating IRE 0x%x"
464 			    "for 0x%x\n", (void *)ipif,
465 			    ipif->ipif_ire_type,
466 			    ntohl(ipif->ipif_lcl_addr)));
467 			ire = ire_create_v6(
468 			    dst_addr,
469 			    mask,
470 			    NULL,
471 			    ipif->ipif_ire_type,	/* LOOPBACK */
472 			    ipif->ipif_ill,
473 			    zoneid,
474 			    (ipif->ipif_flags & IPIF_PRIVATE) ? RTF_PRIVATE : 0,
475 			    NULL,
476 			    ipst);
477 
478 			if (ire == NULL) {
479 				ipif_refrele(ipif);
480 				return (ENOMEM);
481 			}
482 			/* src address assigned by the caller? */
483 			if ((flags & RTF_SETSRC) &&
484 			    !IN6_IS_ADDR_UNSPECIFIED(src_addr))
485 				ire->ire_setsrc_addr_v6 = *src_addr;
486 
487 			nire = ire_add(ire);
488 			if (nire == NULL) {
489 				/*
490 				 * In the result of failure, ire_add() will have
491 				 * already deleted the ire in question, so there
492 				 * is no need to do that here.
493 				 */
494 				ipif_refrele(ipif);
495 				return (ENOMEM);
496 			}
497 			/*
498 			 * Check if it was a duplicate entry. This handles
499 			 * the case of two racing route adds for the same route
500 			 */
501 			if (nire != ire) {
502 				ASSERT(nire->ire_identical_ref > 1);
503 				ire_delete(nire);
504 				ire_refrele(nire);
505 				ipif_refrele(ipif);
506 				return (EEXIST);
507 			}
508 			ire = nire;
509 			goto save_ire;
510 		}
511 	}
512 
513 	/*
514 	 * The routes for multicast with CGTP are quite special in that
515 	 * the gateway is the local interface address, yet RTF_GATEWAY
516 	 * is set. We turn off RTF_GATEWAY to provide compatibility with
517 	 * this undocumented and unusual use of multicast routes.
518 	 */
519 	if ((flags & RTF_MULTIRT) && ipif != NULL)
520 		flags &= ~RTF_GATEWAY;
521 
522 	/*
523 	 * Traditionally, interface routes are ones where RTF_GATEWAY isn't set
524 	 * and the gateway address provided is one of the system's interface
525 	 * addresses.  By using the routing socket interface and supplying an
526 	 * RTA_IFP sockaddr with an interface index, an alternate method of
527 	 * specifying an interface route to be created is available which uses
528 	 * the interface index that specifies the outgoing interface rather than
529 	 * the address of an outgoing interface (which may not be able to
530 	 * uniquely identify an interface).  When coupled with the RTF_GATEWAY
531 	 * flag, routes can be specified which not only specify the next-hop to
532 	 * be used when routing to a certain prefix, but also which outgoing
533 	 * interface should be used.
534 	 *
535 	 * Previously, interfaces would have unique addresses assigned to them
536 	 * and so the address assigned to a particular interface could be used
537 	 * to identify a particular interface.  One exception to this was the
538 	 * case of an unnumbered interface (where IPIF_UNNUMBERED was set).
539 	 *
540 	 * With the advent of IPv6 and its link-local addresses, this
541 	 * restriction was relaxed and interfaces could share addresses between
542 	 * themselves.  In fact, typically all of the link-local interfaces on
543 	 * an IPv6 node or router will have the same link-local address.  In
544 	 * order to differentiate between these interfaces, the use of an
545 	 * interface index is necessary and this index can be carried inside a
546 	 * RTA_IFP sockaddr (which is actually a sockaddr_dl).  One restriction
547 	 * of using the interface index, however, is that all of the ipif's that
548 	 * are part of an ill have the same index and so the RTA_IFP sockaddr
549 	 * cannot be used to differentiate between ipif's (or logical
550 	 * interfaces) that belong to the same ill (physical interface).
551 	 *
552 	 * For example, in the following case involving IPv4 interfaces and
553 	 * logical interfaces
554 	 *
555 	 *	192.0.2.32	255.255.255.224	192.0.2.33	U	if0
556 	 *	192.0.2.32	255.255.255.224	192.0.2.34	U	if0
557 	 *	192.0.2.32	255.255.255.224	192.0.2.35	U	if0
558 	 *
559 	 * the ipif's corresponding to each of these interface routes can be
560 	 * uniquely identified by the "gateway" (actually interface address).
561 	 *
562 	 * In this case involving multiple IPv6 default routes to a particular
563 	 * link-local gateway, the use of RTA_IFP is necessary to specify which
564 	 * default route is of interest:
565 	 *
566 	 *	default		fe80::123:4567:89ab:cdef	U	if0
567 	 *	default		fe80::123:4567:89ab:cdef	U	if1
568 	 */
569 
570 	/* RTF_GATEWAY not set */
571 	if (!(flags & RTF_GATEWAY)) {
572 		if (sp != NULL) {
573 			ip2dbg(("ip_rt_add_v6: gateway security attributes "
574 			    "cannot be set with interface route\n"));
575 			if (ipif != NULL)
576 				ipif_refrele(ipif);
577 			return (EINVAL);
578 		}
579 
580 		/*
581 		 * Whether or not ill (RTA_IFP) is set, we require that
582 		 * the gateway is one of our local addresses.
583 		 */
584 		if (ipif == NULL)
585 			return (ENETUNREACH);
586 
587 		/*
588 		 * We use MATCH_IRE_ILL here. If the caller specified an
589 		 * interface (from the RTA_IFP sockaddr) we use it, otherwise
590 		 * we use the ill derived from the gateway address.
591 		 * We can always match the gateway address since we record it
592 		 * in ire_gateway_addr.
593 		 * We don't allow RTA_IFP to specify a different ill than the
594 		 * one matching the ipif to make sure we can delete the route.
595 		 */
596 		match_flags |= MATCH_IRE_GW | MATCH_IRE_ILL;
597 		if (ill == NULL) {
598 			ill = ipif->ipif_ill;
599 		} else if (ill != ipif->ipif_ill) {
600 			ipif_refrele(ipif);
601 			return (EINVAL);
602 		}
603 
604 		/*
605 		 * We check for an existing entry at this point.
606 		 */
607 		match_flags |= MATCH_IRE_MASK;
608 		ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr,
609 		    IRE_INTERFACE, ill, ALL_ZONES, NULL, match_flags, 0, ipst,
610 		    NULL);
611 		if (ire != NULL) {
612 			ire_refrele(ire);
613 			ipif_refrele(ipif);
614 			return (EEXIST);
615 		}
616 
617 		/*
618 		 * Create a copy of the IRE_LOOPBACK, IRE_IF_NORESOLVER or
619 		 * IRE_IF_RESOLVER with the modified address, netmask, and
620 		 * gateway.
621 		 */
622 		ire = ire_create_v6(
623 		    dst_addr,
624 		    mask,
625 		    gw_addr,
626 		    ill->ill_net_type,
627 		    ill,
628 		    zoneid,
629 		    flags,
630 		    NULL,
631 		    ipst);
632 		if (ire == NULL) {
633 			ipif_refrele(ipif);
634 			return (ENOMEM);
635 		}
636 
637 		/*
638 		 * Some software (for example, GateD and Sun Cluster) attempts
639 		 * to create (what amount to) IRE_PREFIX routes with the
640 		 * loopback address as the gateway.  This is primarily done to
641 		 * set up prefixes with the RTF_REJECT flag set (for example,
642 		 * when generating aggregate routes). We also OR in the
643 		 * RTF_BLACKHOLE flag as these interface routes, by
644 		 * definition, can only be that.
645 		 *
646 		 * If the IRE type (as defined by ill->ill_net_type) is
647 		 * IRE_LOOPBACK, then we map the request into a
648 		 * IRE_IF_NORESOLVER.
649 		 *
650 		 * Needless to say, the real IRE_LOOPBACK is NOT created by this
651 		 * routine, but rather using ire_create_v6() directly.
652 		 */
653 		if (ill->ill_net_type == IRE_LOOPBACK) {
654 			ire->ire_type = IRE_IF_NORESOLVER;
655 			ire->ire_flags |= RTF_BLACKHOLE;
656 		}
657 		/* src address assigned by the caller? */
658 		if ((flags & RTF_SETSRC) && !IN6_IS_ADDR_UNSPECIFIED(src_addr))
659 			ire->ire_setsrc_addr_v6 = *src_addr;
660 
661 		nire = ire_add(ire);
662 		if (nire == NULL) {
663 			/*
664 			 * In the result of failure, ire_add() will have
665 			 * already deleted the ire in question, so there
666 			 * is no need to do that here.
667 			 */
668 			ipif_refrele(ipif);
669 			return (ENOMEM);
670 		}
671 		/*
672 		 * Check if it was a duplicate entry. This handles
673 		 * the case of two racing route adds for the same route
674 		 */
675 		if (nire != ire) {
676 			ASSERT(nire->ire_identical_ref > 1);
677 			ire_delete(nire);
678 			ire_refrele(nire);
679 			ipif_refrele(ipif);
680 			return (EEXIST);
681 		}
682 		ire = nire;
683 		goto save_ire;
684 	}
685 
686 	/*
687 	 * Get an interface IRE for the specified gateway.
688 	 * If we don't have an IRE_IF_NORESOLVER or IRE_IF_RESOLVER for the
689 	 * gateway, it is currently unreachable and we fail the request
690 	 * accordingly.
691 	 * If RTA_IFP was specified we look on that particular ill.
692 	 */
693 	if (ill != NULL)
694 		match_flags |= MATCH_IRE_ILL;
695 
696 	/* Check whether the gateway is reachable. */
697 	type = IRE_INTERFACE;
698 	if (flags & RTF_INDIRECT)
699 		type |= IRE_OFFLINK;
700 
701 	gw_ire = ire_ftable_lookup_v6(gw_addr, 0, 0, type, ill,
702 	    ALL_ZONES, NULL, match_flags, 0, ipst, NULL);
703 	if (gw_ire == NULL) {
704 		if (ipif != NULL)
705 			ipif_refrele(ipif);
706 		return (ENETUNREACH);
707 	}
708 
709 	/*
710 	 * We create one of three types of IREs as a result of this request
711 	 * based on the netmask.  A netmask of all ones (which is automatically
712 	 * assumed when RTF_HOST is set) results in an IRE_HOST being created.
713 	 * An all zeroes netmask implies a default route so an IRE_DEFAULT is
714 	 * created.  Otherwise, an IRE_PREFIX route is created for the
715 	 * destination prefix.
716 	 */
717 	if (IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones))
718 		type = IRE_HOST;
719 	else if (IN6_IS_ADDR_UNSPECIFIED(mask))
720 		type = IRE_DEFAULT;
721 	else
722 		type = IRE_PREFIX;
723 
724 	/* check for a duplicate entry */
725 	ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr, type, ill,
726 	    ALL_ZONES, NULL,
727 	    match_flags | MATCH_IRE_MASK | MATCH_IRE_GW, 0, ipst, NULL);
728 	if (ire != NULL) {
729 		if (ipif != NULL)
730 			ipif_refrele(ipif);
731 		ire_refrele(gw_ire);
732 		ire_refrele(ire);
733 		return (EEXIST);
734 	}
735 
736 	/* Security attribute exists */
737 	if (sp != NULL) {
738 		tsol_gcgrp_addr_t ga;
739 
740 		/* find or create the gateway credentials group */
741 		ga.ga_af = AF_INET6;
742 		ga.ga_addr = *gw_addr;
743 
744 		/* we hold reference to it upon success */
745 		gcgrp = gcgrp_lookup(&ga, B_TRUE);
746 		if (gcgrp == NULL) {
747 			if (ipif != NULL)
748 				ipif_refrele(ipif);
749 			ire_refrele(gw_ire);
750 			return (ENOMEM);
751 		}
752 
753 		/*
754 		 * Create and add the security attribute to the group; a
755 		 * reference to the group is made upon allocating a new
756 		 * entry successfully.  If it finds an already-existing
757 		 * entry for the security attribute in the group, it simply
758 		 * returns it and no new reference is made to the group.
759 		 */
760 		gc = gc_create(sp, gcgrp, &gcgrp_xtraref);
761 		if (gc == NULL) {
762 			/* release reference held by gcgrp_lookup */
763 			GCGRP_REFRELE(gcgrp);
764 			if (ipif != NULL)
765 				ipif_refrele(ipif);
766 			ire_refrele(gw_ire);
767 			return (ENOMEM);
768 		}
769 	}
770 
771 	/* Create the IRE. */
772 	ire = ire_create_v6(
773 	    dst_addr,				/* dest address */
774 	    mask,				/* mask */
775 	    gw_addr,				/* gateway address */
776 	    (ushort_t)type,			/* IRE type */
777 	    ill,
778 	    zoneid,
779 	    flags,
780 	    gc,					/* security attribute */
781 	    ipst);
782 
783 	/*
784 	 * The ire holds a reference to the 'gc' and the 'gc' holds a
785 	 * reference to the 'gcgrp'. We can now release the extra reference
786 	 * the 'gcgrp' acquired in the gcgrp_lookup, if it was not used.
787 	 */
788 	if (gcgrp_xtraref)
789 		GCGRP_REFRELE(gcgrp);
790 	if (ire == NULL) {
791 		if (gc != NULL)
792 			GC_REFRELE(gc);
793 		if (ipif != NULL)
794 			ipif_refrele(ipif);
795 		ire_refrele(gw_ire);
796 		return (ENOMEM);
797 	}
798 
799 	/* src address assigned by the caller? */
800 	if ((flags & RTF_SETSRC) && !IN6_IS_ADDR_UNSPECIFIED(src_addr))
801 		ire->ire_setsrc_addr_v6 = *src_addr;
802 
803 	/*
804 	 * POLICY: should we allow an RTF_HOST with address INADDR_ANY?
805 	 * SUN/OS socket stuff does but do we really want to allow ::0 ?
806 	 */
807 
808 	/* Add the new IRE. */
809 	nire = ire_add(ire);
810 	if (nire == NULL) {
811 		/*
812 		 * In the result of failure, ire_add() will have
813 		 * already deleted the ire in question, so there
814 		 * is no need to do that here.
815 		 */
816 		if (ipif != NULL)
817 			ipif_refrele(ipif);
818 		ire_refrele(gw_ire);
819 		return (ENOMEM);
820 	}
821 	/*
822 	 * Check if it was a duplicate entry. This handles
823 	 * the case of two racing route adds for the same route
824 	 */
825 	if (nire != ire) {
826 		ASSERT(nire->ire_identical_ref > 1);
827 		ire_delete(nire);
828 		ire_refrele(nire);
829 		if (ipif != NULL)
830 			ipif_refrele(ipif);
831 		ire_refrele(gw_ire);
832 		return (EEXIST);
833 	}
834 	ire = nire;
835 
836 	if (flags & RTF_MULTIRT) {
837 		/*
838 		 * Invoke the CGTP (multirouting) filtering module
839 		 * to add the dst address in the filtering database.
840 		 * Replicated inbound packets coming from that address
841 		 * will be filtered to discard the duplicates.
842 		 * It is not necessary to call the CGTP filter hook
843 		 * when the dst address is a multicast, because an
844 		 * IP source address cannot be a multicast.
845 		 */
846 		if (ipst->ips_ip_cgtp_filter_ops != NULL &&
847 		    !IN6_IS_ADDR_MULTICAST(&(ire->ire_addr_v6))) {
848 			int res;
849 			ipif_t *src_ipif;
850 
851 			/* Find the source address corresponding to gw_ire */
852 			src_ipif = ipif_lookup_addr_v6(
853 			    &gw_ire->ire_gateway_addr_v6, NULL, zoneid, ipst);
854 			if (src_ipif != NULL) {
855 				res = ipst->ips_ip_cgtp_filter_ops->
856 				    cfo_add_dest_v6(
857 				    ipst->ips_netstack->netstack_stackid,
858 				    &ire->ire_addr_v6,
859 				    &ire->ire_gateway_addr_v6,
860 				    &ire->ire_setsrc_addr_v6,
861 				    &src_ipif->ipif_v6lcl_addr);
862 				ipif_refrele(src_ipif);
863 			} else {
864 				res = EADDRNOTAVAIL;
865 			}
866 			if (res != 0) {
867 				if (ipif != NULL)
868 					ipif_refrele(ipif);
869 				ire_refrele(gw_ire);
870 				ire_delete(ire);
871 				ire_refrele(ire);	/* Held in ire_add */
872 				return (res);
873 			}
874 		}
875 	}
876 
877 save_ire:
878 	if (gw_ire != NULL) {
879 		ire_refrele(gw_ire);
880 		gw_ire = NULL;
881 	}
882 	if (ire->ire_ill != NULL) {
883 		/*
884 		 * Save enough information so that we can recreate the IRE if
885 		 * the ILL goes down and then up.  The metrics associated
886 		 * with the route will be saved as well when rts_setmetrics() is
887 		 * called after the IRE has been created.  In the case where
888 		 * memory cannot be allocated, none of this information will be
889 		 * saved.
890 		 */
891 		ill_save_ire(ire->ire_ill, ire);
892 	}
893 
894 	if (ire_arg != NULL) {
895 		/*
896 		 * Store the ire that was successfully added into where ire_arg
897 		 * points to so that callers don't have to look it up
898 		 * themselves (but they are responsible for ire_refrele()ing
899 		 * the ire when they are finished with it).
900 		 */
901 		*ire_arg = ire;
902 	} else {
903 		ire_refrele(ire);		/* Held in ire_add */
904 	}
905 	if (ipif != NULL)
906 		ipif_refrele(ipif);
907 	return (0);
908 }
909 
910 /*
911  * ip_rt_delete_v6 is called to delete an IPv6 route.
912  * ill is passed in to associate it with the correct interface.
913  * (for link-local destinations and gateways).
914  */
915 /* ARGSUSED4 */
916 int
917 ip_rt_delete_v6(const in6_addr_t *dst_addr, const in6_addr_t *mask,
918     const in6_addr_t *gw_addr, uint_t rtm_addrs, int flags, ill_t *ill,
919     ip_stack_t *ipst, zoneid_t zoneid)
920 {
921 	ire_t	*ire = NULL;
922 	ipif_t	*ipif;
923 	uint_t	type;
924 	uint_t	match_flags = MATCH_IRE_TYPE;
925 	int	err = 0;
926 
927 	/*
928 	 * If this is the case of RTF_HOST being set, then we set the netmask
929 	 * to all ones.  Otherwise, we use the netmask if one was supplied.
930 	 */
931 	if (flags & RTF_HOST) {
932 		mask = &ipv6_all_ones;
933 		match_flags |= MATCH_IRE_MASK;
934 	} else if (rtm_addrs & RTA_NETMASK) {
935 		match_flags |= MATCH_IRE_MASK;
936 	}
937 
938 	/*
939 	 * Note that RTF_GATEWAY is never set on a delete, therefore
940 	 * we check if the gateway address is one of our interfaces first,
941 	 * and fall back on RTF_GATEWAY routes.
942 	 *
943 	 * This makes it possible to delete an original
944 	 * IRE_IF_NORESOLVER/IRE_IF_RESOLVER - consistent with SunOS 4.1.
945 	 * However, we have RTF_KERNEL set on the ones created by ipif_up
946 	 * and those can not be deleted here.
947 	 *
948 	 * We use MATCH_IRE_ILL if we know the interface. If the caller
949 	 * specified an interface (from the RTA_IFP sockaddr) we use it,
950 	 * otherwise we use the ill derived from the gateway address.
951 	 * We can always match the gateway address since we record it
952 	 * in ire_gateway_addr.
953 	 *
954 	 * For more detail on specifying routes by gateway address and by
955 	 * interface index, see the comments in ip_rt_add_v6().
956 	 */
957 	ipif = ipif_lookup_interface_v6(gw_addr, dst_addr, ipst);
958 	if (ipif != NULL) {
959 		ill_t	*ill_match;
960 
961 		if (ill != NULL)
962 			ill_match = ill;
963 		else
964 			ill_match = ipif->ipif_ill;
965 
966 		match_flags |= MATCH_IRE_ILL;
967 		if (ipif->ipif_ire_type == IRE_LOOPBACK) {
968 			ire = ire_ftable_lookup_v6(dst_addr, 0, 0, IRE_LOOPBACK,
969 			    ill_match, ALL_ZONES, NULL, match_flags, 0, ipst,
970 			    NULL);
971 		}
972 		if (ire == NULL) {
973 			match_flags |= MATCH_IRE_GW;
974 			ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr,
975 			    IRE_INTERFACE, ill_match, ALL_ZONES, NULL,
976 			    match_flags, 0, ipst, NULL);
977 		}
978 		/* Avoid deleting routes created by kernel from an ipif */
979 		if (ire != NULL && (ire->ire_flags & RTF_KERNEL)) {
980 			ire_refrele(ire);
981 			ire = NULL;
982 		}
983 
984 		/* Restore in case we didn't find a match */
985 		match_flags &= ~(MATCH_IRE_GW|MATCH_IRE_ILL);
986 	}
987 
988 	if (ire == NULL) {
989 		/*
990 		 * At this point, the gateway address is not one of our own
991 		 * addresses or a matching interface route was not found.  We
992 		 * set the IRE type to lookup based on whether
993 		 * this is a host route, a default route or just a prefix.
994 		 *
995 		 * If an ill was passed in, then the lookup is based on an
996 		 * interface index so MATCH_IRE_ILL is added to match_flags.
997 		 */
998 		match_flags |= MATCH_IRE_GW;
999 		if (ill != NULL)
1000 			match_flags |= MATCH_IRE_ILL;
1001 		if (IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones))
1002 			type = IRE_HOST;
1003 		else if (IN6_IS_ADDR_UNSPECIFIED(mask))
1004 			type = IRE_DEFAULT;
1005 		else
1006 			type = IRE_PREFIX;
1007 		ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr, type,
1008 		    ill, ALL_ZONES, NULL, match_flags, 0, ipst, NULL);
1009 	}
1010 
1011 	if (ipif != NULL) {
1012 		ipif_refrele(ipif);
1013 		ipif = NULL;
1014 	}
1015 	if (ire == NULL)
1016 		return (ESRCH);
1017 
1018 	if (ire->ire_flags & RTF_MULTIRT) {
1019 		/*
1020 		 * Invoke the CGTP (multirouting) filtering module
1021 		 * to remove the dst address from the filtering database.
1022 		 * Packets coming from that address will no longer be
1023 		 * filtered to remove duplicates.
1024 		 */
1025 		if (ipst->ips_ip_cgtp_filter_ops != NULL) {
1026 			err = ipst->ips_ip_cgtp_filter_ops->cfo_del_dest_v6(
1027 			    ipst->ips_netstack->netstack_stackid,
1028 			    &ire->ire_addr_v6, &ire->ire_gateway_addr_v6);
1029 		}
1030 	}
1031 
1032 	ill = ire->ire_ill;
1033 	if (ill != NULL)
1034 		ill_remove_saved_ire(ill, ire);
1035 	ire_delete(ire);
1036 	ire_refrele(ire);
1037 	return (err);
1038 }
1039 
1040 /*
1041  * Derive an interface id from the link layer address.
1042  */
1043 void
1044 ill_setdefaulttoken(ill_t *ill)
1045 {
1046 	if (!ill->ill_manual_token) {
1047 		bzero(&ill->ill_token, sizeof (ill->ill_token));
1048 		MEDIA_V6INTFID(ill->ill_media, ill, &ill->ill_token);
1049 		ill->ill_token_length = IPV6_TOKEN_LEN;
1050 	}
1051 }
1052 
1053 void
1054 ill_setdesttoken(ill_t *ill)
1055 {
1056 	bzero(&ill->ill_dest_token, sizeof (ill->ill_dest_token));
1057 	MEDIA_V6DESTINTFID(ill->ill_media, ill, &ill->ill_dest_token);
1058 }
1059 
1060 /*
1061  * Create a link-local address from a token.
1062  */
1063 static void
1064 ipif_get_linklocal(in6_addr_t *dest, const in6_addr_t *token)
1065 {
1066 	int i;
1067 
1068 	for (i = 0; i < 4; i++) {
1069 		dest->s6_addr32[i] =
1070 		    token->s6_addr32[i] | ipv6_ll_template.s6_addr32[i];
1071 	}
1072 }
1073 
1074 /*
1075  * Set a default IPv6 address for a 6to4 tunnel interface 2002:<tsrc>::1/16
1076  */
1077 static void
1078 ipif_set6to4addr(ipif_t *ipif)
1079 {
1080 	ill_t		*ill = ipif->ipif_ill;
1081 	struct in_addr	v4phys;
1082 
1083 	ASSERT(ill->ill_mactype == DL_6TO4);
1084 	ASSERT(ill->ill_phys_addr_length == sizeof (struct in_addr));
1085 	ASSERT(ipif->ipif_isv6);
1086 
1087 	if (ipif->ipif_flags & IPIF_UP)
1088 		return;
1089 
1090 	(void) ip_plen_to_mask_v6(16, &ipif->ipif_v6net_mask);
1091 	bcopy(ill->ill_phys_addr, &v4phys, sizeof (struct in_addr));
1092 	IN6_V4ADDR_TO_6TO4(&v4phys, &ipif->ipif_v6lcl_addr);
1093 	V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
1094 	    ipif->ipif_v6subnet);
1095 }
1096 
1097 /*
1098  * Is it not possible to set the link local address?
1099  * The address can be set if the token is set, and the token
1100  * isn't too long.
1101  * Return B_TRUE if the address can't be set, or B_FALSE if it can.
1102  */
1103 boolean_t
1104 ipif_cant_setlinklocal(ipif_t *ipif)
1105 {
1106 	ill_t *ill = ipif->ipif_ill;
1107 
1108 	if (IN6_IS_ADDR_UNSPECIFIED(&ill->ill_token) ||
1109 	    ill->ill_token_length > IPV6_ABITS - IPV6_LL_PREFIXLEN)
1110 		return (B_TRUE);
1111 
1112 	return (B_FALSE);
1113 }
1114 
1115 /*
1116  * Generate a link-local address from the token.
1117  */
1118 void
1119 ipif_setlinklocal(ipif_t *ipif)
1120 {
1121 	ill_t		*ill = ipif->ipif_ill;
1122 	in6_addr_t	ov6addr;
1123 
1124 	ASSERT(IAM_WRITER_ILL(ill));
1125 
1126 	/*
1127 	 * ill_manual_linklocal is set when the link-local address was
1128 	 * manually configured.
1129 	 */
1130 	if (ill->ill_manual_linklocal)
1131 		return;
1132 
1133 	/*
1134 	 * IPv6 interfaces over 6to4 tunnels are special.  They do not have
1135 	 * link-local addresses, but instead have a single automatically
1136 	 * generated global address.
1137 	 */
1138 	if (ill->ill_mactype == DL_6TO4) {
1139 		ipif_set6to4addr(ipif);
1140 		return;
1141 	}
1142 
1143 	if (ipif_cant_setlinklocal(ipif))
1144 		return;
1145 
1146 	ov6addr = ipif->ipif_v6lcl_addr;
1147 	ipif_get_linklocal(&ipif->ipif_v6lcl_addr, &ill->ill_token);
1148 	sctp_update_ipif_addr(ipif, ov6addr);
1149 	(void) ip_plen_to_mask_v6(IPV6_LL_PREFIXLEN, &ipif->ipif_v6net_mask);
1150 	if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6pp_dst_addr)) {
1151 		V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
1152 		    ipif->ipif_v6subnet);
1153 	}
1154 
1155 }
1156 
1157 /*
1158  * Set the destination link-local address for a point-to-point IPv6
1159  * interface with a destination interface id (IP tunnels are such
1160  * interfaces).
1161  */
1162 void
1163 ipif_setdestlinklocal(ipif_t *ipif)
1164 {
1165 	ill_t	*ill = ipif->ipif_ill;
1166 
1167 	ASSERT(IAM_WRITER_ILL(ill));
1168 	if (IN6_IS_ADDR_UNSPECIFIED(&ill->ill_dest_token))
1169 		return;
1170 	/* Skip if we've already set the pp_dst_addr */
1171 	if (!IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6pp_dst_addr))
1172 		return;
1173 
1174 	ipif_get_linklocal(&ipif->ipif_v6pp_dst_addr, &ill->ill_dest_token);
1175 	ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr;
1176 }
1177 
1178 /*
1179  * Get the resolver set up for a new ipif.  (Always called as writer.)
1180  */
1181 int
1182 ipif_ndp_up(ipif_t *ipif, boolean_t initial)
1183 {
1184 	ill_t		*ill = ipif->ipif_ill;
1185 	int		err = 0;
1186 	nce_t		*nce = NULL;
1187 	boolean_t	added_ipif = B_FALSE;
1188 
1189 	DTRACE_PROBE3(ipif__downup, char *, "ipif_ndp_up",
1190 	    ill_t *, ill, ipif_t *, ipif);
1191 	ip1dbg(("ipif_ndp_up(%s:%u)\n", ill->ill_name, ipif->ipif_id));
1192 
1193 	if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) ||
1194 	    (!(ill->ill_net_type & IRE_INTERFACE))) {
1195 		ipif->ipif_addr_ready = 1;
1196 		return (0);
1197 	}
1198 
1199 	if ((ipif->ipif_flags & (IPIF_UNNUMBERED|IPIF_NOLOCAL)) == 0) {
1200 		uint16_t	flags;
1201 		uint16_t	state;
1202 		uchar_t		*hw_addr;
1203 		ill_t		*bound_ill;
1204 		ipmp_illgrp_t	*illg = ill->ill_grp;
1205 		uint_t		hw_addr_len;
1206 
1207 		flags = NCE_F_MYADDR | NCE_F_NONUD | NCE_F_PUBLISH |
1208 		    NCE_F_AUTHORITY;
1209 		if (ill->ill_flags & ILLF_ROUTER)
1210 			flags |= NCE_F_ISROUTER;
1211 
1212 		if (ipif->ipif_flags & IPIF_ANYCAST)
1213 			flags |= NCE_F_ANYCAST;
1214 
1215 		if (IS_IPMP(ill)) {
1216 			ASSERT(ill->ill_net_type == IRE_IF_RESOLVER);
1217 			/*
1218 			 * If we're here via ipif_up(), then the ipif won't be
1219 			 * bound yet -- add it to the group, which will bind
1220 			 * it if possible.  (We would add it in ipif_up(), but
1221 			 * deleting on failure there is gruesome.)  If we're
1222 			 * here via ipmp_ill_bind_ipif(), then the ipif has
1223 			 * already been added to the group and we just need to
1224 			 * use the binding.
1225 			 */
1226 			if ((bound_ill = ipmp_ipif_bound_ill(ipif)) == NULL) {
1227 				bound_ill = ipmp_illgrp_add_ipif(illg, ipif);
1228 				if (bound_ill == NULL) {
1229 					/*
1230 					 * We couldn't bind the ipif to an ill
1231 					 * yet, so we have nothing to publish.
1232 					 * Set ipif_addr_ready so that this
1233 					 * address can be used locally for now.
1234 					 * The routing socket message will be
1235 					 * sent from ipif_up_done_v6().
1236 					 */
1237 					ipif->ipif_addr_ready = 1;
1238 					return (0);
1239 				}
1240 				added_ipif = B_TRUE;
1241 			}
1242 			hw_addr = bound_ill->ill_nd_lla;
1243 			hw_addr_len = bound_ill->ill_phys_addr_length;
1244 		} else {
1245 			bound_ill = ill;
1246 			if (ill->ill_net_type == IRE_IF_RESOLVER) {
1247 				hw_addr = ill->ill_nd_lla;
1248 				hw_addr_len = ill->ill_phys_addr_length;
1249 			} else {
1250 				hw_addr = NULL;
1251 				hw_addr_len = 0;
1252 			}
1253 		}
1254 
1255 		/*
1256 		 * If this is an initial bring-up (or the ipif was never
1257 		 * completely brought up), do DAD.  Otherwise, we're here
1258 		 * because IPMP has rebound an address to this ill: send
1259 		 * unsolicited advertisements to inform others.
1260 		 */
1261 		if (initial || !ipif->ipif_addr_ready) {
1262 			/* Causes Duplicate Address Detection to run */
1263 			state = ND_PROBE;
1264 		} else {
1265 			state = ND_REACHABLE;
1266 			flags |= NCE_F_UNSOL_ADV;
1267 		}
1268 
1269 retry:
1270 		err = nce_lookup_then_add_v6(ill, hw_addr, hw_addr_len,
1271 		    &ipif->ipif_v6lcl_addr, flags, state, &nce);
1272 		switch (err) {
1273 		case 0:
1274 			ip1dbg(("ipif_ndp_up: NCE created for %s\n",
1275 			    ill->ill_name));
1276 			ipif->ipif_addr_ready = 1;
1277 			ipif->ipif_added_nce = 1;
1278 			nce->nce_ipif_cnt++;
1279 			break;
1280 		case EINPROGRESS:
1281 			ip1dbg(("ipif_ndp_up: running DAD now for %s\n",
1282 			    ill->ill_name));
1283 			ipif->ipif_added_nce = 1;
1284 			nce->nce_ipif_cnt++;
1285 			break;
1286 		case EEXIST:
1287 			ip1dbg(("ipif_ndp_up: NCE already exists for %s\n",
1288 			    ill->ill_name));
1289 			if (!NCE_MYADDR(nce->nce_common)) {
1290 				/*
1291 				 * A leftover nce from before this address
1292 				 * existed
1293 				 */
1294 				ncec_delete(nce->nce_common);
1295 				nce_refrele(nce);
1296 				nce = NULL;
1297 				goto retry;
1298 			}
1299 			if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
1300 				nce_refrele(nce);
1301 				nce = NULL;
1302 				ip1dbg(("ipif_ndp_up: NCE already exists "
1303 				    "for %s\n", ill->ill_name));
1304 				goto fail;
1305 			}
1306 			/*
1307 			 * Duplicate local addresses are permissible for
1308 			 * IPIF_POINTOPOINT interfaces which will get marked
1309 			 * IPIF_UNNUMBERED later in
1310 			 * ip_addr_availability_check().
1311 			 *
1312 			 * The nce_ipif_cnt field tracks the number of
1313 			 * ipifs that have nce_addr as their local address.
1314 			 */
1315 			ipif->ipif_addr_ready = 1;
1316 			ipif->ipif_added_nce = 1;
1317 			nce->nce_ipif_cnt++;
1318 			err = 0;
1319 			break;
1320 		default:
1321 			ip1dbg(("ipif_ndp_up: NCE creation failed for %s\n",
1322 			    ill->ill_name));
1323 			goto fail;
1324 		}
1325 	} else {
1326 		/* No local NCE for this entry */
1327 		ipif->ipif_addr_ready = 1;
1328 	}
1329 	if (nce != NULL)
1330 		nce_refrele(nce);
1331 	return (0);
1332 fail:
1333 	if (added_ipif)
1334 		ipmp_illgrp_del_ipif(ill->ill_grp, ipif);
1335 
1336 	return (err);
1337 }
1338 
1339 /* Remove all cache entries for this logical interface */
1340 void
1341 ipif_ndp_down(ipif_t *ipif)
1342 {
1343 	ipif_nce_down(ipif);
1344 }
1345 
1346 /*
1347  * Return the scope of the given IPv6 address.  If the address is an
1348  * IPv4 mapped IPv6 address, return the scope of the corresponding
1349  * IPv4 address.
1350  */
1351 in6addr_scope_t
1352 ip_addr_scope_v6(const in6_addr_t *addr)
1353 {
1354 	static in6_addr_t ipv6loopback = IN6ADDR_LOOPBACK_INIT;
1355 
1356 	if (IN6_IS_ADDR_V4MAPPED(addr)) {
1357 		in_addr_t v4addr_h = ntohl(V4_PART_OF_V6((*addr)));
1358 		if ((v4addr_h >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET ||
1359 		    (v4addr_h & IN_AUTOCONF_MASK) == IN_AUTOCONF_NET)
1360 			return (IP6_SCOPE_LINKLOCAL);
1361 		if ((v4addr_h & IN_PRIVATE8_MASK) == IN_PRIVATE8_NET ||
1362 		    (v4addr_h & IN_PRIVATE12_MASK) == IN_PRIVATE12_NET ||
1363 		    (v4addr_h & IN_PRIVATE16_MASK) == IN_PRIVATE16_NET)
1364 			return (IP6_SCOPE_SITELOCAL);
1365 		return (IP6_SCOPE_GLOBAL);
1366 	}
1367 
1368 	if (IN6_IS_ADDR_MULTICAST(addr))
1369 		return (IN6_ADDR_MC_SCOPE(addr));
1370 
1371 	/* link-local and loopback addresses are of link-local scope */
1372 	if (IN6_IS_ADDR_LINKLOCAL(addr) ||
1373 	    IN6_ARE_ADDR_EQUAL(addr, &ipv6loopback))
1374 		return (IP6_SCOPE_LINKLOCAL);
1375 	if (IN6_IS_ADDR_SITELOCAL(addr))
1376 		return (IP6_SCOPE_SITELOCAL);
1377 	return (IP6_SCOPE_GLOBAL);
1378 }
1379 
1380 
1381 /*
1382  * Returns the length of the common prefix of a1 and a2, as per
1383  * CommonPrefixLen() defined in RFC 3484.
1384  */
1385 static int
1386 ip_common_prefix_v6(const in6_addr_t *a1, const in6_addr_t *a2)
1387 {
1388 	int i;
1389 	uint32_t a1val, a2val, mask;
1390 
1391 	for (i = 0; i < 4; i++) {
1392 		if ((a1val = a1->s6_addr32[i]) != (a2val = a2->s6_addr32[i])) {
1393 			a1val ^= a2val;
1394 			i *= 32;
1395 			mask = 0x80000000u;
1396 			while (!(a1val & mask)) {
1397 				mask >>= 1;
1398 				i++;
1399 			}
1400 			return (i);
1401 		}
1402 	}
1403 	return (IPV6_ABITS);
1404 }
1405 
1406 #define	IPIF_VALID_IPV6_SOURCE(ipif) \
1407 	(((ipif)->ipif_flags & IPIF_UP) && \
1408 	!((ipif)->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST)))
1409 
1410 /* source address candidate */
1411 typedef struct candidate {
1412 	ipif_t		*cand_ipif;
1413 	/* The properties of this candidate */
1414 	boolean_t	cand_isdst;
1415 	boolean_t	cand_isdst_set;
1416 	in6addr_scope_t	cand_scope;
1417 	boolean_t	cand_scope_set;
1418 	boolean_t	cand_isdeprecated;
1419 	boolean_t	cand_isdeprecated_set;
1420 	boolean_t	cand_ispreferred;
1421 	boolean_t	cand_ispreferred_set;
1422 	boolean_t	cand_matchedinterface;
1423 	boolean_t	cand_matchedinterface_set;
1424 	boolean_t	cand_matchedlabel;
1425 	boolean_t	cand_matchedlabel_set;
1426 	boolean_t	cand_istmp;
1427 	boolean_t	cand_istmp_set;
1428 	int		cand_common_pref;
1429 	boolean_t	cand_common_pref_set;
1430 	boolean_t	cand_pref_eq;
1431 	boolean_t	cand_pref_eq_set;
1432 	int		cand_pref_len;
1433 	boolean_t	cand_pref_len_set;
1434 } cand_t;
1435 #define	cand_srcaddr	cand_ipif->ipif_v6lcl_addr
1436 #define	cand_mask	cand_ipif->ipif_v6net_mask
1437 #define	cand_flags	cand_ipif->ipif_flags
1438 #define	cand_ill	cand_ipif->ipif_ill
1439 #define	cand_zoneid	cand_ipif->ipif_zoneid
1440 
1441 /* information about the destination for source address selection */
1442 typedef struct dstinfo {
1443 	const in6_addr_t	*dst_addr;
1444 	ill_t			*dst_ill;
1445 	uint_t			dst_restrict_ill;
1446 	boolean_t		dst_prefer_src_tmp;
1447 	in6addr_scope_t		dst_scope;
1448 	char			*dst_label;
1449 } dstinfo_t;
1450 
1451 /*
1452  * The following functions are rules used to select a source address in
1453  * ipif_select_source_v6().  Each rule compares a current candidate (cc)
1454  * against the best candidate (bc).  Each rule has three possible outcomes;
1455  * the candidate is preferred over the best candidate (CAND_PREFER), the
1456  * candidate is not preferred over the best candidate (CAND_AVOID), or the
1457  * candidate is of equal value as the best candidate (CAND_TIE).
1458  *
1459  * These rules are part of a greater "Default Address Selection for IPv6"
1460  * sheme, which is standards based work coming out of the IETF ipv6 working
1461  * group.  The IETF document defines both IPv6 source address selection and
1462  * destination address ordering.  The rules defined here implement the IPv6
1463  * source address selection.  Destination address ordering is done by
1464  * libnsl, and uses a similar set of rules to implement the sorting.
1465  *
1466  * Most of the rules are defined by the RFC and are not typically altered.  The
1467  * last rule, number 8, has language that allows for local preferences.  In the
1468  * scheme below, this means that new Solaris rules should normally go between
1469  * rule_ifprefix and rule_prefix.
1470  */
1471 typedef enum {CAND_AVOID, CAND_TIE, CAND_PREFER} rule_res_t;
1472 typedef	rule_res_t (*rulef_t)(cand_t *, cand_t *, const dstinfo_t *,
1473     ip_stack_t *);
1474 
1475 /* Prefer an address if it is equal to the destination address. */
1476 /* ARGSUSED3 */
1477 static rule_res_t
1478 rule_isdst(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst)
1479 {
1480 	if (!bc->cand_isdst_set) {
1481 		bc->cand_isdst =
1482 		    IN6_ARE_ADDR_EQUAL(&bc->cand_srcaddr, dstinfo->dst_addr);
1483 		bc->cand_isdst_set = B_TRUE;
1484 	}
1485 
1486 	cc->cand_isdst =
1487 	    IN6_ARE_ADDR_EQUAL(&cc->cand_srcaddr, dstinfo->dst_addr);
1488 	cc->cand_isdst_set = B_TRUE;
1489 
1490 	if (cc->cand_isdst == bc->cand_isdst)
1491 		return (CAND_TIE);
1492 	else if (cc->cand_isdst)
1493 		return (CAND_PREFER);
1494 	else
1495 		return (CAND_AVOID);
1496 }
1497 
1498 /*
1499  * Prefer addresses that are of closest scope to the destination.  Always
1500  * prefer addresses that are of greater scope than the destination over
1501  * those that are of lesser scope than the destination.
1502  */
1503 /* ARGSUSED3 */
1504 static rule_res_t
1505 rule_scope(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst)
1506 {
1507 	if (!bc->cand_scope_set) {
1508 		bc->cand_scope = ip_addr_scope_v6(&bc->cand_srcaddr);
1509 		bc->cand_scope_set = B_TRUE;
1510 	}
1511 
1512 	cc->cand_scope = ip_addr_scope_v6(&cc->cand_srcaddr);
1513 	cc->cand_scope_set = B_TRUE;
1514 
1515 	if (cc->cand_scope < bc->cand_scope) {
1516 		if (cc->cand_scope < dstinfo->dst_scope)
1517 			return (CAND_AVOID);
1518 		else
1519 			return (CAND_PREFER);
1520 	} else if (bc->cand_scope < cc->cand_scope) {
1521 		if (bc->cand_scope < dstinfo->dst_scope)
1522 			return (CAND_PREFER);
1523 		else
1524 			return (CAND_AVOID);
1525 	} else {
1526 		return (CAND_TIE);
1527 	}
1528 }
1529 
1530 /*
1531  * Prefer non-deprecated source addresses.
1532  */
1533 /* ARGSUSED2 */
1534 static rule_res_t
1535 rule_deprecated(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo,
1536     ip_stack_t *ipst)
1537 {
1538 	if (!bc->cand_isdeprecated_set) {
1539 		bc->cand_isdeprecated =
1540 		    ((bc->cand_flags & IPIF_DEPRECATED) != 0);
1541 		bc->cand_isdeprecated_set = B_TRUE;
1542 	}
1543 
1544 	cc->cand_isdeprecated = ((cc->cand_flags & IPIF_DEPRECATED) != 0);
1545 	cc->cand_isdeprecated_set = B_TRUE;
1546 
1547 	if (bc->cand_isdeprecated == cc->cand_isdeprecated)
1548 		return (CAND_TIE);
1549 	else if (cc->cand_isdeprecated)
1550 		return (CAND_AVOID);
1551 	else
1552 		return (CAND_PREFER);
1553 }
1554 
1555 /*
1556  * Prefer source addresses that have the IPIF_PREFERRED flag set.  This
1557  * rule must be before rule_interface because the flag could be set on any
1558  * interface, not just the interface being used for outgoing packets (for
1559  * example, the IFF_PREFERRED could be set on an address assigned to the
1560  * loopback interface).
1561  */
1562 /* ARGSUSED2 */
1563 static rule_res_t
1564 rule_preferred(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo,
1565     ip_stack_t *ipst)
1566 {
1567 	if (!bc->cand_ispreferred_set) {
1568 		bc->cand_ispreferred = ((bc->cand_flags & IPIF_PREFERRED) != 0);
1569 		bc->cand_ispreferred_set = B_TRUE;
1570 	}
1571 
1572 	cc->cand_ispreferred = ((cc->cand_flags & IPIF_PREFERRED) != 0);
1573 	cc->cand_ispreferred_set = B_TRUE;
1574 
1575 	if (bc->cand_ispreferred == cc->cand_ispreferred)
1576 		return (CAND_TIE);
1577 	else if (cc->cand_ispreferred)
1578 		return (CAND_PREFER);
1579 	else
1580 		return (CAND_AVOID);
1581 }
1582 
1583 /*
1584  * Prefer source addresses that are assigned to the outgoing interface.
1585  */
1586 /* ARGSUSED3 */
1587 static rule_res_t
1588 rule_interface(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo,
1589     ip_stack_t *ipst)
1590 {
1591 	ill_t *dstill = dstinfo->dst_ill;
1592 
1593 	/*
1594 	 * If dstinfo->dst_restrict_ill is set, this rule is unnecessary
1595 	 * since we know all candidates will be on the same link.
1596 	 */
1597 	if (dstinfo->dst_restrict_ill)
1598 		return (CAND_TIE);
1599 
1600 	if (!bc->cand_matchedinterface_set) {
1601 		bc->cand_matchedinterface = bc->cand_ill == dstill;
1602 		bc->cand_matchedinterface_set = B_TRUE;
1603 	}
1604 
1605 	cc->cand_matchedinterface = cc->cand_ill == dstill;
1606 	cc->cand_matchedinterface_set = B_TRUE;
1607 
1608 	if (bc->cand_matchedinterface == cc->cand_matchedinterface)
1609 		return (CAND_TIE);
1610 	else if (cc->cand_matchedinterface)
1611 		return (CAND_PREFER);
1612 	else
1613 		return (CAND_AVOID);
1614 }
1615 
1616 /*
1617  * Prefer source addresses whose label matches the destination's label.
1618  */
1619 static rule_res_t
1620 rule_label(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst)
1621 {
1622 	char *label;
1623 
1624 	if (!bc->cand_matchedlabel_set) {
1625 		label = ip6_asp_lookup(&bc->cand_srcaddr, NULL, ipst);
1626 		bc->cand_matchedlabel =
1627 		    ip6_asp_labelcmp(label, dstinfo->dst_label);
1628 		bc->cand_matchedlabel_set = B_TRUE;
1629 	}
1630 
1631 	label = ip6_asp_lookup(&cc->cand_srcaddr, NULL, ipst);
1632 	cc->cand_matchedlabel = ip6_asp_labelcmp(label, dstinfo->dst_label);
1633 	cc->cand_matchedlabel_set = B_TRUE;
1634 
1635 	if (bc->cand_matchedlabel == cc->cand_matchedlabel)
1636 		return (CAND_TIE);
1637 	else if (cc->cand_matchedlabel)
1638 		return (CAND_PREFER);
1639 	else
1640 		return (CAND_AVOID);
1641 }
1642 
1643 /*
1644  * Prefer public addresses over temporary ones.  An application can reverse
1645  * the logic of this rule and prefer temporary addresses by using the
1646  * IPV6_SRC_PREFERENCES socket option.
1647  */
1648 /* ARGSUSED3 */
1649 static rule_res_t
1650 rule_temporary(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo,
1651     ip_stack_t *ipst)
1652 {
1653 	if (!bc->cand_istmp_set) {
1654 		bc->cand_istmp = ((bc->cand_flags & IPIF_TEMPORARY) != 0);
1655 		bc->cand_istmp_set = B_TRUE;
1656 	}
1657 
1658 	cc->cand_istmp = ((cc->cand_flags & IPIF_TEMPORARY) != 0);
1659 	cc->cand_istmp_set = B_TRUE;
1660 
1661 	if (bc->cand_istmp == cc->cand_istmp)
1662 		return (CAND_TIE);
1663 
1664 	if (dstinfo->dst_prefer_src_tmp && cc->cand_istmp)
1665 		return (CAND_PREFER);
1666 	else if (!dstinfo->dst_prefer_src_tmp && !cc->cand_istmp)
1667 		return (CAND_PREFER);
1668 	else
1669 		return (CAND_AVOID);
1670 }
1671 
1672 /*
1673  * Prefer source addresses with longer matching prefix with the destination
1674  * under the interface mask.  This gets us on the same subnet before applying
1675  * any Solaris-specific rules.
1676  */
1677 /* ARGSUSED3 */
1678 static rule_res_t
1679 rule_ifprefix(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo,
1680     ip_stack_t *ipst)
1681 {
1682 	if (!bc->cand_pref_eq_set) {
1683 		bc->cand_pref_eq = V6_MASK_EQ_2(bc->cand_srcaddr,
1684 		    bc->cand_mask, *dstinfo->dst_addr);
1685 		bc->cand_pref_eq_set = B_TRUE;
1686 	}
1687 
1688 	cc->cand_pref_eq = V6_MASK_EQ_2(cc->cand_srcaddr, cc->cand_mask,
1689 	    *dstinfo->dst_addr);
1690 	cc->cand_pref_eq_set = B_TRUE;
1691 
1692 	if (bc->cand_pref_eq) {
1693 		if (cc->cand_pref_eq) {
1694 			if (!bc->cand_pref_len_set) {
1695 				bc->cand_pref_len =
1696 				    ip_mask_to_plen_v6(&bc->cand_mask);
1697 				bc->cand_pref_len_set = B_TRUE;
1698 			}
1699 			cc->cand_pref_len = ip_mask_to_plen_v6(&cc->cand_mask);
1700 			cc->cand_pref_len_set = B_TRUE;
1701 			if (bc->cand_pref_len == cc->cand_pref_len)
1702 				return (CAND_TIE);
1703 			else if (bc->cand_pref_len > cc->cand_pref_len)
1704 				return (CAND_AVOID);
1705 			else
1706 				return (CAND_PREFER);
1707 		} else {
1708 			return (CAND_AVOID);
1709 		}
1710 	} else {
1711 		if (cc->cand_pref_eq)
1712 			return (CAND_PREFER);
1713 		else
1714 			return (CAND_TIE);
1715 	}
1716 }
1717 
1718 /*
1719  * Prefer to use zone-specific addresses when possible instead of all-zones
1720  * addresses.
1721  */
1722 /* ARGSUSED2 */
1723 static rule_res_t
1724 rule_zone_specific(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo,
1725     ip_stack_t *ipst)
1726 {
1727 	if ((bc->cand_zoneid == ALL_ZONES) ==
1728 	    (cc->cand_zoneid == ALL_ZONES))
1729 		return (CAND_TIE);
1730 	else if (cc->cand_zoneid == ALL_ZONES)
1731 		return (CAND_AVOID);
1732 	else
1733 		return (CAND_PREFER);
1734 }
1735 
1736 /*
1737  * Prefer to use DHCPv6 (first) and static addresses (second) when possible
1738  * instead of statelessly autoconfigured addresses.
1739  *
1740  * This is done after trying all other preferences (and before the final tie
1741  * breaker) so that, if all else is equal, we select addresses configured by
1742  * DHCPv6 over other addresses.  We presume that DHCPv6 addresses, unlike
1743  * stateless autoconfigured addresses, are deliberately configured by an
1744  * administrator, and thus are correctly set up in DNS and network packet
1745  * filters.
1746  */
1747 /* ARGSUSED2 */
1748 static rule_res_t
1749 rule_addr_type(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo,
1750     ip_stack_t *ipst)
1751 {
1752 #define	ATYPE(x)	\
1753 	((x) & IPIF_DHCPRUNNING) ? 1 : ((x) & IPIF_ADDRCONF) ? 3 : 2
1754 	int bcval = ATYPE(bc->cand_flags);
1755 	int ccval = ATYPE(cc->cand_flags);
1756 #undef ATYPE
1757 
1758 	if (bcval == ccval)
1759 		return (CAND_TIE);
1760 	else if (ccval < bcval)
1761 		return (CAND_PREFER);
1762 	else
1763 		return (CAND_AVOID);
1764 }
1765 
1766 /*
1767  * Prefer source addresses with longer matching prefix with the destination.
1768  * We do the longest matching prefix calculation by doing an xor of both
1769  * addresses with the destination, and pick the address with the longest string
1770  * of leading zeros, as per CommonPrefixLen() defined in RFC 3484.
1771  */
1772 /* ARGSUSED3 */
1773 static rule_res_t
1774 rule_prefix(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst)
1775 {
1776 	if (!bc->cand_common_pref_set) {
1777 		bc->cand_common_pref = ip_common_prefix_v6(&bc->cand_srcaddr,
1778 		    dstinfo->dst_addr);
1779 		bc->cand_common_pref_set = B_TRUE;
1780 	}
1781 
1782 	cc->cand_common_pref = ip_common_prefix_v6(&cc->cand_srcaddr,
1783 	    dstinfo->dst_addr);
1784 	cc->cand_common_pref_set = B_TRUE;
1785 
1786 	if (bc->cand_common_pref == cc->cand_common_pref)
1787 		return (CAND_TIE);
1788 	else if (bc->cand_common_pref > cc->cand_common_pref)
1789 		return (CAND_AVOID);
1790 	else
1791 		return (CAND_PREFER);
1792 }
1793 
1794 /*
1795  * Last rule: we must pick something, so just prefer the current best
1796  * candidate.
1797  */
1798 /* ARGSUSED */
1799 static rule_res_t
1800 rule_must_be_last(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo,
1801     ip_stack_t *ipst)
1802 {
1803 	return (CAND_AVOID);
1804 }
1805 
1806 /*
1807  * Determine the best source address given a destination address and a
1808  * destination ill.  If no suitable source address is found, it returns
1809  * NULL. If there is a usable address pointed to by the usesrc
1810  * (i.e ill_usesrc_ifindex != 0) then return that first since it is more
1811  * fine grained (i.e per interface)
1812  *
1813  * This implementation is based on the "Default Address Selection for IPv6"
1814  * specification produced by the IETF IPv6 working group.  It has been
1815  * implemented so that the list of addresses is only traversed once (the
1816  * specification's algorithm could traverse the list of addresses once for
1817  * every rule).
1818  *
1819  * The restrict_ill argument restricts the algorithm to choose a source
1820  * address that is assigned to the destination ill.  This is used when
1821  * the destination address is a link-local or multicast address, and when
1822  * ipv6_strict_dst_multihoming is turned on.
1823  *
1824  * src_prefs is the caller's set of source address preferences.  If source
1825  * address selection is being called to determine the source address of a
1826  * connected socket (from ip_set_destination_v6()), then the preferences are
1827  * taken from conn_ixa->ixa_src_preferences.  These preferences can be set on a
1828  * per-socket basis using the IPV6_SRC_PREFERENCES socket option.  The only
1829  * preference currently implemented is for rfc3041 temporary addresses.
1830  */
1831 ipif_t *
1832 ipif_select_source_v6(ill_t *dstill, const in6_addr_t *dst,
1833     boolean_t restrict_ill, uint32_t src_prefs, zoneid_t zoneid,
1834     boolean_t allow_usesrc, boolean_t *notreadyp)
1835 {
1836 	dstinfo_t	dstinfo;
1837 	char		dstr[INET6_ADDRSTRLEN];
1838 	char		sstr[INET6_ADDRSTRLEN];
1839 	ipif_t		*ipif, *start_ipif, *next_ipif;
1840 	ill_t		*ill, *usesrc_ill = NULL, *ipmp_ill = NULL;
1841 	ill_walk_context_t	ctx;
1842 	cand_t		best_c;	/* The best candidate */
1843 	cand_t		curr_c;	/* The current candidate */
1844 	uint_t		index;
1845 	boolean_t	first_candidate = B_TRUE;
1846 	rule_res_t	rule_result;
1847 	tsol_tpc_t	*src_rhtp, *dst_rhtp;
1848 	ip_stack_t	*ipst = dstill->ill_ipst;
1849 
1850 	/*
1851 	 * The list of ordering rules.  They are applied in the order they
1852 	 * appear in the list.
1853 	 *
1854 	 * Solaris doesn't currently support Mobile IPv6, so there's no
1855 	 * rule_mipv6 corresponding to rule 4 in the specification.
1856 	 */
1857 	rulef_t	rules[] = {
1858 		rule_isdst,
1859 		rule_scope,
1860 		rule_deprecated,
1861 		rule_preferred,
1862 		rule_interface,
1863 		rule_label,
1864 		rule_temporary,
1865 		rule_ifprefix,			/* local rules after this */
1866 		rule_zone_specific,
1867 		rule_addr_type,
1868 		rule_prefix,			/* local rules before this */
1869 		rule_must_be_last,		/* must always be last */
1870 		NULL
1871 	};
1872 
1873 	ASSERT(dstill->ill_isv6);
1874 	ASSERT(!IN6_IS_ADDR_V4MAPPED(dst));
1875 
1876 	/*
1877 	 * Check if there is a usable src address pointed to by the
1878 	 * usesrc ifindex. This has higher precedence since it is
1879 	 * finer grained (i.e per interface) v/s being system wide.
1880 	 */
1881 	if (dstill->ill_usesrc_ifindex != 0 && allow_usesrc) {
1882 		if ((usesrc_ill =
1883 		    ill_lookup_on_ifindex(dstill->ill_usesrc_ifindex, B_TRUE,
1884 		    ipst)) != NULL) {
1885 			dstinfo.dst_ill = usesrc_ill;
1886 		} else {
1887 			return (NULL);
1888 		}
1889 	} else if (IS_UNDER_IPMP(dstill)) {
1890 		/*
1891 		 * Test addresses should never be used for source address
1892 		 * selection, so if we were passed an underlying ill, switch
1893 		 * to the IPMP meta-interface.
1894 		 */
1895 		if ((ipmp_ill = ipmp_ill_hold_ipmp_ill(dstill)) != NULL)
1896 			dstinfo.dst_ill = ipmp_ill;
1897 		else
1898 			return (NULL);
1899 	} else {
1900 		dstinfo.dst_ill = dstill;
1901 	}
1902 
1903 	/*
1904 	 * If we're dealing with an unlabeled destination on a labeled system,
1905 	 * make sure that we ignore source addresses that are incompatible with
1906 	 * the destination's default label.  That destination's default label
1907 	 * must dominate the minimum label on the source address.
1908 	 *
1909 	 * (Note that this has to do with Trusted Solaris.  It's not related to
1910 	 * the labels described by ip6_asp_lookup.)
1911 	 */
1912 	dst_rhtp = NULL;
1913 	if (is_system_labeled()) {
1914 		dst_rhtp = find_tpc(dst, IPV6_VERSION, B_FALSE);
1915 		if (dst_rhtp == NULL)
1916 			return (NULL);
1917 		if (dst_rhtp->tpc_tp.host_type != UNLABELED) {
1918 			TPC_RELE(dst_rhtp);
1919 			dst_rhtp = NULL;
1920 		}
1921 	}
1922 
1923 	dstinfo.dst_addr = dst;
1924 	dstinfo.dst_scope = ip_addr_scope_v6(dst);
1925 	dstinfo.dst_label = ip6_asp_lookup(dst, NULL, ipst);
1926 	dstinfo.dst_prefer_src_tmp = ((src_prefs & IPV6_PREFER_SRC_TMP) != 0);
1927 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
1928 	/*
1929 	 * Section three of the I-D states that for multicast and
1930 	 * link-local destinations, the candidate set must be restricted to
1931 	 * an interface that is on the same link as the outgoing interface.
1932 	 * Also, when ipv6_strict_dst_multihoming is turned on, always
1933 	 * restrict the source address to the destination link as doing
1934 	 * otherwise will almost certainly cause problems.
1935 	 */
1936 	if (IN6_IS_ADDR_LINKLOCAL(dst) || IN6_IS_ADDR_MULTICAST(dst) ||
1937 	    ipst->ips_ipv6_strict_dst_multihoming || usesrc_ill != NULL) {
1938 		dstinfo.dst_restrict_ill = B_TRUE;
1939 	} else {
1940 		dstinfo.dst_restrict_ill = restrict_ill;
1941 	}
1942 
1943 	bzero(&best_c, sizeof (cand_t));
1944 
1945 	/*
1946 	 * Take a pass through the list of IPv6 interfaces to choose the best
1947 	 * possible source address.  If restrict_ill is set, just use dst_ill.
1948 	 */
1949 	if (dstinfo.dst_restrict_ill)
1950 		ill = dstinfo.dst_ill;
1951 	else
1952 		ill = ILL_START_WALK_V6(&ctx, ipst);
1953 
1954 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
1955 		ASSERT(ill->ill_isv6);
1956 
1957 		/*
1958 		 * Test addresses should never be used for source address
1959 		 * selection, so ignore underlying ills.
1960 		 */
1961 		if (IS_UNDER_IPMP(ill))
1962 			continue;
1963 
1964 		if (ill->ill_ipif == NULL)
1965 			continue;
1966 		/*
1967 		 * For source address selection, we treat the ipif list as
1968 		 * circular and continue until we get back to where we
1969 		 * started.  This allows IPMP to vary source address selection
1970 		 * (which improves inbound load spreading) by caching its last
1971 		 * ending point and starting from there.  NOTE: we don't have
1972 		 * to worry about ill_src_ipif changing ills since that can't
1973 		 * happen on the IPMP ill.
1974 		 */
1975 		start_ipif = ill->ill_ipif;
1976 		if (IS_IPMP(ill) && ill->ill_src_ipif != NULL)
1977 			start_ipif = ill->ill_src_ipif;
1978 
1979 		ipif = start_ipif;
1980 		do {
1981 			if ((next_ipif = ipif->ipif_next) == NULL)
1982 				next_ipif = ill->ill_ipif;
1983 
1984 			if (!IPIF_VALID_IPV6_SOURCE(ipif))
1985 				continue;
1986 
1987 			if (!ipif->ipif_addr_ready) {
1988 				if (notreadyp != NULL)
1989 					*notreadyp = B_TRUE;
1990 				continue;
1991 			}
1992 
1993 			if (zoneid != ALL_ZONES &&
1994 			    ipif->ipif_zoneid != zoneid &&
1995 			    ipif->ipif_zoneid != ALL_ZONES)
1996 				continue;
1997 
1998 			/*
1999 			 * Check compatibility of local address for
2000 			 * destination's default label if we're on a labeled
2001 			 * system.  Incompatible addresses can't be used at
2002 			 * all and must be skipped over.
2003 			 */
2004 			if (dst_rhtp != NULL) {
2005 				boolean_t incompat;
2006 
2007 				src_rhtp = find_tpc(&ipif->ipif_v6lcl_addr,
2008 				    IPV6_VERSION, B_FALSE);
2009 				if (src_rhtp == NULL)
2010 					continue;
2011 				incompat =
2012 				    src_rhtp->tpc_tp.host_type != SUN_CIPSO ||
2013 				    src_rhtp->tpc_tp.tp_doi !=
2014 				    dst_rhtp->tpc_tp.tp_doi ||
2015 				    (!_blinrange(&dst_rhtp->tpc_tp.tp_def_label,
2016 				    &src_rhtp->tpc_tp.tp_sl_range_cipso) &&
2017 				    !blinlset(&dst_rhtp->tpc_tp.tp_def_label,
2018 				    src_rhtp->tpc_tp.tp_sl_set_cipso));
2019 				TPC_RELE(src_rhtp);
2020 				if (incompat)
2021 					continue;
2022 			}
2023 
2024 			if (first_candidate) {
2025 				/*
2026 				 * This is first valid address in the list.
2027 				 * It is automatically the best candidate
2028 				 * so far.
2029 				 */
2030 				best_c.cand_ipif = ipif;
2031 				first_candidate = B_FALSE;
2032 				continue;
2033 			}
2034 
2035 			bzero(&curr_c, sizeof (cand_t));
2036 			curr_c.cand_ipif = ipif;
2037 
2038 			/*
2039 			 * Compare this current candidate (curr_c) with the
2040 			 * best candidate (best_c) by applying the
2041 			 * comparison rules in order until one breaks the
2042 			 * tie.
2043 			 */
2044 			for (index = 0; rules[index] != NULL; index++) {
2045 				/* Apply a comparison rule. */
2046 				rule_result = (rules[index])(&best_c, &curr_c,
2047 				    &dstinfo, ipst);
2048 				if (rule_result == CAND_AVOID) {
2049 					/*
2050 					 * The best candidate is still the
2051 					 * best candidate.  Forget about
2052 					 * this current candidate and go on
2053 					 * to the next one.
2054 					 */
2055 					break;
2056 				} else if (rule_result == CAND_PREFER) {
2057 					/*
2058 					 * This candidate is prefered.  It
2059 					 * becomes the best candidate so
2060 					 * far.  Go on to the next address.
2061 					 */
2062 					best_c = curr_c;
2063 					break;
2064 				}
2065 				/* We have a tie, apply the next rule. */
2066 			}
2067 
2068 			/*
2069 			 * The last rule must be a tie breaker rule and
2070 			 * must never produce a tie.  At this point, the
2071 			 * candidate should have either been rejected, or
2072 			 * have been prefered as the best candidate so far.
2073 			 */
2074 			ASSERT(rule_result != CAND_TIE);
2075 		} while ((ipif = next_ipif) != start_ipif);
2076 
2077 		/*
2078 		 * For IPMP, update the source ipif rotor to the next ipif,
2079 		 * provided we can look it up.  (We must not use it if it's
2080 		 * IPIF_CONDEMNED since we may have grabbed ill_g_lock after
2081 		 * ipif_free() checked ill_src_ipif.)
2082 		 */
2083 		if (IS_IPMP(ill) && ipif != NULL) {
2084 			mutex_enter(&ipif->ipif_ill->ill_lock);
2085 			next_ipif = ipif->ipif_next;
2086 			if (next_ipif != NULL && !IPIF_IS_CONDEMNED(next_ipif))
2087 				ill->ill_src_ipif = next_ipif;
2088 			else
2089 				ill->ill_src_ipif = NULL;
2090 			mutex_exit(&ipif->ipif_ill->ill_lock);
2091 		}
2092 
2093 		/*
2094 		 * Only one ill to consider if dst_restrict_ill is set.
2095 		 */
2096 		if (dstinfo.dst_restrict_ill)
2097 			break;
2098 	}
2099 
2100 	ipif = best_c.cand_ipif;
2101 	ip1dbg(("ipif_select_source_v6(%s, %s) -> %s\n",
2102 	    dstinfo.dst_ill->ill_name,
2103 	    inet_ntop(AF_INET6, dstinfo.dst_addr, dstr, sizeof (dstr)),
2104 	    (ipif == NULL ? "NULL" :
2105 	    inet_ntop(AF_INET6, &ipif->ipif_v6lcl_addr, sstr, sizeof (sstr)))));
2106 
2107 	if (usesrc_ill != NULL)
2108 		ill_refrele(usesrc_ill);
2109 
2110 	if (ipmp_ill != NULL)
2111 		ill_refrele(ipmp_ill);
2112 
2113 	if (dst_rhtp != NULL)
2114 		TPC_RELE(dst_rhtp);
2115 
2116 	if (ipif == NULL) {
2117 		rw_exit(&ipst->ips_ill_g_lock);
2118 		return (NULL);
2119 	}
2120 
2121 	mutex_enter(&ipif->ipif_ill->ill_lock);
2122 	if (!IPIF_IS_CONDEMNED(ipif)) {
2123 		ipif_refhold_locked(ipif);
2124 		mutex_exit(&ipif->ipif_ill->ill_lock);
2125 		rw_exit(&ipst->ips_ill_g_lock);
2126 		return (ipif);
2127 	}
2128 	mutex_exit(&ipif->ipif_ill->ill_lock);
2129 	rw_exit(&ipst->ips_ill_g_lock);
2130 	ip1dbg(("ipif_select_source_v6 cannot lookup ipif %p"
2131 	    " returning null \n", (void *)ipif));
2132 
2133 	return (NULL);
2134 }
2135 
2136 /*
2137  * Pick a source address based on the destination ill and an optional setsrc
2138  * address.
2139  * The result is stored in srcp. If generation is set, then put the source
2140  * generation number there before we look for the source address (to avoid
2141  * missing changes in the set of source addresses.
2142  * If flagsp is set, then us it to pass back ipif_flags.
2143  *
2144  * If the caller wants to cache the returned source address and detect when
2145  * that might be stale, the caller should pass in a generation argument,
2146  * which the caller can later compare against ips_src_generation
2147  *
2148  * The precedence order for selecting an IPv6 source address is:
2149  *  - RTF_SETSRC on the first ire in the recursive lookup always wins.
2150  *  - If usrsrc is set, swap the ill to be the usesrc one.
2151  *  - If IPMP is used on the ill, select a random address from the most
2152  *    preferred ones below:
2153  * That is followed by the long list of IPv6 source address selection rules
2154  * starting with rule_isdst(), rule_scope(), etc.
2155  *
2156  * We have lower preference for ALL_ZONES IP addresses,
2157  * as they pose problems with unlabeled destinations.
2158  *
2159  * Note that when multiple IP addresses match e.g., with rule_scope() we pick
2160  * the first one if IPMP is not in use. With IPMP we randomize.
2161  */
2162 int
2163 ip_select_source_v6(ill_t *ill, const in6_addr_t *setsrc, const in6_addr_t *dst,
2164     zoneid_t zoneid, ip_stack_t *ipst, uint_t restrict_ill, uint32_t src_prefs,
2165     in6_addr_t *srcp, uint32_t *generation, uint64_t *flagsp)
2166 {
2167 	ipif_t *ipif;
2168 	boolean_t notready = B_FALSE;	/* Set if !ipif_addr_ready found */
2169 
2170 	if (flagsp != NULL)
2171 		*flagsp = 0;
2172 
2173 	/*
2174 	 * Need to grab the generation number before we check to
2175 	 * avoid a race with a change to the set of local addresses.
2176 	 * No lock needed since the thread which updates the set of local
2177 	 * addresses use ipif/ill locks and exit those (hence a store memory
2178 	 * barrier) before doing the atomic increase of ips_src_generation.
2179 	 */
2180 	if (generation != NULL) {
2181 		*generation = ipst->ips_src_generation;
2182 	}
2183 
2184 	/* Was RTF_SETSRC set on the first IRE in the recursive lookup? */
2185 	if (setsrc != NULL && !IN6_IS_ADDR_UNSPECIFIED(setsrc)) {
2186 		*srcp = *setsrc;
2187 		return (0);
2188 	}
2189 
2190 	ipif = ipif_select_source_v6(ill, dst, restrict_ill, src_prefs, zoneid,
2191 	    B_TRUE, &notready);
2192 	if (ipif == NULL) {
2193 		if (notready)
2194 			return (ENETDOWN);
2195 		else
2196 			return (EADDRNOTAVAIL);
2197 	}
2198 	*srcp = ipif->ipif_v6lcl_addr;
2199 	if (flagsp != NULL)
2200 		*flagsp = ipif->ipif_flags;
2201 	ipif_refrele(ipif);
2202 	return (0);
2203 }
2204 
2205 /*
2206  * Perform an attach and bind to get phys addr plus info_req for
2207  * the physical device.
2208  * q and mp represents an ioctl which will be queued waiting for
2209  * completion of the DLPI message exchange.
2210  * MUST be called on an ill queue.
2211  *
2212  * Returns EINPROGRESS when mp has been consumed by queueing it.
2213  * The ioctl will complete in ip_rput.
2214  */
2215 int
2216 ill_dl_phys(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q)
2217 {
2218 	mblk_t	*v6token_mp = NULL;
2219 	mblk_t	*v6lla_mp = NULL;
2220 	mblk_t	*dest_mp = NULL;
2221 	mblk_t	*phys_mp = NULL;
2222 	mblk_t	*info_mp = NULL;
2223 	mblk_t	*attach_mp = NULL;
2224 	mblk_t	*bind_mp = NULL;
2225 	mblk_t	*unbind_mp = NULL;
2226 	mblk_t	*notify_mp = NULL;
2227 
2228 	ip1dbg(("ill_dl_phys(%s:%u)\n", ill->ill_name, ipif->ipif_id));
2229 	ASSERT(ill->ill_dlpi_style_set);
2230 	ASSERT(WR(q)->q_next != NULL);
2231 
2232 	if (ill->ill_isv6) {
2233 		v6token_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) +
2234 		    sizeof (t_scalar_t), DL_PHYS_ADDR_REQ);
2235 		if (v6token_mp == NULL)
2236 			goto bad;
2237 		((dl_phys_addr_req_t *)v6token_mp->b_rptr)->dl_addr_type =
2238 		    DL_IPV6_TOKEN;
2239 
2240 		v6lla_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) +
2241 		    sizeof (t_scalar_t), DL_PHYS_ADDR_REQ);
2242 		if (v6lla_mp == NULL)
2243 			goto bad;
2244 		((dl_phys_addr_req_t *)v6lla_mp->b_rptr)->dl_addr_type =
2245 		    DL_IPV6_LINK_LAYER_ADDR;
2246 	}
2247 
2248 	if (ill->ill_mactype == DL_IPV4 || ill->ill_mactype == DL_IPV6) {
2249 		dest_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) +
2250 		    sizeof (t_scalar_t), DL_PHYS_ADDR_REQ);
2251 		if (dest_mp == NULL)
2252 			goto bad;
2253 		((dl_phys_addr_req_t *)dest_mp->b_rptr)->dl_addr_type =
2254 		    DL_CURR_DEST_ADDR;
2255 	}
2256 
2257 	/*
2258 	 * Allocate a DL_NOTIFY_REQ and set the notifications we want.
2259 	 */
2260 	notify_mp = ip_dlpi_alloc(sizeof (dl_notify_req_t) + sizeof (long),
2261 	    DL_NOTIFY_REQ);
2262 	if (notify_mp == NULL)
2263 		goto bad;
2264 	((dl_notify_req_t *)notify_mp->b_rptr)->dl_notifications =
2265 	    (DL_NOTE_PHYS_ADDR | DL_NOTE_SDU_SIZE | DL_NOTE_FASTPATH_FLUSH |
2266 	    DL_NOTE_LINK_UP | DL_NOTE_LINK_DOWN | DL_NOTE_CAPAB_RENEG |
2267 	    DL_NOTE_PROMISC_ON_PHYS | DL_NOTE_PROMISC_OFF_PHYS |
2268 	    DL_NOTE_REPLUMB);
2269 
2270 	phys_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) +
2271 	    sizeof (t_scalar_t), DL_PHYS_ADDR_REQ);
2272 	if (phys_mp == NULL)
2273 		goto bad;
2274 	((dl_phys_addr_req_t *)phys_mp->b_rptr)->dl_addr_type =
2275 	    DL_CURR_PHYS_ADDR;
2276 
2277 	info_mp = ip_dlpi_alloc(
2278 	    sizeof (dl_info_req_t) + sizeof (dl_info_ack_t),
2279 	    DL_INFO_REQ);
2280 	if (info_mp == NULL)
2281 		goto bad;
2282 
2283 	bind_mp = ip_dlpi_alloc(sizeof (dl_bind_req_t) + sizeof (long),
2284 	    DL_BIND_REQ);
2285 	if (bind_mp == NULL)
2286 		goto bad;
2287 	((dl_bind_req_t *)bind_mp->b_rptr)->dl_sap = ill->ill_sap;
2288 	((dl_bind_req_t *)bind_mp->b_rptr)->dl_service_mode = DL_CLDLS;
2289 
2290 	unbind_mp = ip_dlpi_alloc(sizeof (dl_unbind_req_t), DL_UNBIND_REQ);
2291 	if (unbind_mp == NULL)
2292 		goto bad;
2293 
2294 	/* If we need to attach, pre-alloc and initialize the mblk */
2295 	if (ill->ill_needs_attach) {
2296 		attach_mp = ip_dlpi_alloc(sizeof (dl_attach_req_t),
2297 		    DL_ATTACH_REQ);
2298 		if (attach_mp == NULL)
2299 			goto bad;
2300 		((dl_attach_req_t *)attach_mp->b_rptr)->dl_ppa = ill->ill_ppa;
2301 	}
2302 
2303 	/*
2304 	 * Here we are going to delay the ioctl ack until after
2305 	 * ACKs from DL_PHYS_ADDR_REQ. So need to save the
2306 	 * original ioctl message before sending the requests
2307 	 */
2308 	mutex_enter(&ill->ill_lock);
2309 	/* ipsq_pending_mp_add won't fail since we pass in a NULL connp */
2310 	(void) ipsq_pending_mp_add(NULL, ipif, ill->ill_wq, mp, 0);
2311 	/*
2312 	 * Set ill_phys_addr_pend to zero. It will be set to the addr_type of
2313 	 * the DL_PHYS_ADDR_REQ in ill_dlpi_send() and ill_dlpi_done(). It will
2314 	 * be used to track which DL_PHYS_ADDR_REQ is being ACK'd/NAK'd.
2315 	 */
2316 	ill->ill_phys_addr_pend = 0;
2317 	mutex_exit(&ill->ill_lock);
2318 
2319 	if (attach_mp != NULL) {
2320 		ip1dbg(("ill_dl_phys: attach\n"));
2321 		ill_dlpi_send(ill, attach_mp);
2322 	}
2323 	ill_dlpi_send(ill, bind_mp);
2324 	ill_dlpi_send(ill, info_mp);
2325 	if (v6token_mp != NULL)
2326 		ill_dlpi_send(ill, v6token_mp);
2327 	if (v6lla_mp != NULL)
2328 		ill_dlpi_send(ill, v6lla_mp);
2329 	if (dest_mp != NULL)
2330 		ill_dlpi_send(ill, dest_mp);
2331 	ill_dlpi_send(ill, phys_mp);
2332 	ill_dlpi_send(ill, notify_mp);
2333 	ill_dlpi_send(ill, unbind_mp);
2334 
2335 	/*
2336 	 * This operation will complete in ip_rput_dlpi_writer with either
2337 	 * a DL_PHYS_ADDR_ACK or DL_ERROR_ACK.
2338 	 */
2339 	return (EINPROGRESS);
2340 bad:
2341 	freemsg(v6token_mp);
2342 	freemsg(v6lla_mp);
2343 	freemsg(dest_mp);
2344 	freemsg(phys_mp);
2345 	freemsg(info_mp);
2346 	freemsg(attach_mp);
2347 	freemsg(bind_mp);
2348 	freemsg(unbind_mp);
2349 	freemsg(notify_mp);
2350 	return (ENOMEM);
2351 }
2352 
2353 /* Add room for tcp+ip headers */
2354 uint_t ip_loopback_mtu_v6plus = IP_LOOPBACK_MTU + IPV6_HDR_LEN + 20;
2355 
2356 /*
2357  * DLPI is up.
2358  * Create all the IREs associated with an interface bring up multicast.
2359  * Set the interface flag and finish other initialization
2360  * that potentially had to be differed to after DL_BIND_ACK.
2361  */
2362 int
2363 ipif_up_done_v6(ipif_t *ipif)
2364 {
2365 	ill_t	*ill = ipif->ipif_ill;
2366 	int	err;
2367 	boolean_t loopback = B_FALSE;
2368 
2369 	ip1dbg(("ipif_up_done_v6(%s:%u)\n",
2370 	    ipif->ipif_ill->ill_name, ipif->ipif_id));
2371 	DTRACE_PROBE3(ipif__downup, char *, "ipif_up_done_v6",
2372 	    ill_t *, ill, ipif_t *, ipif);
2373 
2374 	/* Check if this is a loopback interface */
2375 	if (ipif->ipif_ill->ill_wq == NULL)
2376 		loopback = B_TRUE;
2377 
2378 	ASSERT(ipif->ipif_isv6);
2379 	ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock));
2380 
2381 	if (IS_LOOPBACK(ill) || ill->ill_net_type == IRE_IF_NORESOLVER) {
2382 		nce_t *loop_nce = NULL;
2383 		uint16_t flags = (NCE_F_MYADDR | NCE_F_NONUD | NCE_F_AUTHORITY);
2384 
2385 		/*
2386 		 * lo0:1 and subsequent ipifs were marked IRE_LOCAL in
2387 		 * ipif_lookup_on_name(), but in the case of zones we can have
2388 		 * several loopback addresses on lo0. So all the interfaces with
2389 		 * loopback addresses need to be marked IRE_LOOPBACK.
2390 		 */
2391 		if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr, &ipv6_loopback))
2392 			ipif->ipif_ire_type = IRE_LOOPBACK;
2393 		else
2394 			ipif->ipif_ire_type = IRE_LOCAL;
2395 		if (ill->ill_net_type != IRE_LOOPBACK)
2396 			flags |= NCE_F_PUBLISH;
2397 		err = nce_lookup_then_add_v6(ill, NULL,
2398 		    ill->ill_phys_addr_length,
2399 		    &ipif->ipif_v6lcl_addr, flags, ND_REACHABLE, &loop_nce);
2400 
2401 		/* A shared-IP zone sees EEXIST for lo0:N */
2402 		if (err == 0 || err == EEXIST) {
2403 			ipif->ipif_added_nce = 1;
2404 			loop_nce->nce_ipif_cnt++;
2405 			nce_refrele(loop_nce);
2406 			err = 0;
2407 		} else {
2408 			ASSERT(loop_nce == NULL);
2409 			return (err);
2410 		}
2411 	}
2412 
2413 	err = ipif_add_ires_v6(ipif, loopback);
2414 	if (err != 0) {
2415 		/*
2416 		 * See comments about return value from
2417 		 * ipif_addr_availability_check() in ipif_add_ires_v6().
2418 		 */
2419 		if (err != EADDRINUSE) {
2420 			ipif_ndp_down(ipif);
2421 		} else {
2422 			/*
2423 			 * Make IPMP aware of the deleted ipif so that
2424 			 * the needed ipmp cleanup (e.g., of ipif_bound_ill)
2425 			 * can be completed. Note that we do not want to
2426 			 * destroy the nce that was created on the ipmp_ill
2427 			 * for the active copy of the duplicate address in
2428 			 * use.
2429 			 */
2430 			if (IS_IPMP(ill))
2431 				ipmp_illgrp_del_ipif(ill->ill_grp, ipif);
2432 			err = EADDRNOTAVAIL;
2433 		}
2434 		return (err);
2435 	}
2436 
2437 	if (ill->ill_ipif_up_count == 1 && !loopback) {
2438 		/* Recover any additional IREs entries for this ill */
2439 		(void) ill_recover_saved_ire(ill);
2440 	}
2441 
2442 	if (ill->ill_need_recover_multicast) {
2443 		/*
2444 		 * Need to recover all multicast memberships in the driver.
2445 		 * This had to be deferred until we had attached.
2446 		 */
2447 		ill_recover_multicast(ill);
2448 	}
2449 
2450 	if (ill->ill_ipif_up_count == 1) {
2451 		/*
2452 		 * Since the interface is now up, it may now be active.
2453 		 */
2454 		if (IS_UNDER_IPMP(ill))
2455 			ipmp_ill_refresh_active(ill);
2456 	}
2457 
2458 	/* Join the allhosts multicast address and the solicited node MC */
2459 	ipif_multicast_up(ipif);
2460 
2461 	/* Perhaps ilgs should use this ill */
2462 	update_conn_ill(NULL, ill->ill_ipst);
2463 
2464 	if (ipif->ipif_addr_ready)
2465 		ipif_up_notify(ipif);
2466 
2467 	return (0);
2468 }
2469 
2470 /*
2471  * Add the IREs associated with the ipif.
2472  * Those MUST be explicitly removed in ipif_delete_ires_v6.
2473  */
2474 static int
2475 ipif_add_ires_v6(ipif_t *ipif, boolean_t loopback)
2476 {
2477 	ill_t		*ill = ipif->ipif_ill;
2478 	ip_stack_t	*ipst = ill->ill_ipst;
2479 	ire_t		*ire_array[20];
2480 	ire_t		**irep = ire_array;
2481 	ire_t		**irep1;
2482 	in6_addr_t	v6addr;
2483 	in6_addr_t	route_mask;
2484 	int		err;
2485 	char		buf[INET6_ADDRSTRLEN];
2486 	ire_t		*ire_local = NULL;	/* LOCAL or LOOPBACK */
2487 
2488 	if (!IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) &&
2489 	    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
2490 
2491 		/*
2492 		 * If we're on a labeled system then make sure that zone-
2493 		 * private addresses have proper remote host database entries.
2494 		 */
2495 		if (is_system_labeled() &&
2496 		    ipif->ipif_ire_type != IRE_LOOPBACK) {
2497 			if (ip6opt_ls == 0) {
2498 				cmn_err(CE_WARN, "IPv6 not enabled "
2499 				    "via /etc/system");
2500 				return (EINVAL);
2501 			}
2502 			if (!tsol_check_interface_address(ipif))
2503 				return (EINVAL);
2504 		}
2505 
2506 		/* Register the source address for __sin6_src_id */
2507 		err = ip_srcid_insert(&ipif->ipif_v6lcl_addr,
2508 		    ipif->ipif_zoneid, ipst);
2509 		if (err != 0) {
2510 			ip0dbg(("ipif_add_ires_v6: srcid_insert %d\n", err));
2511 			return (err);
2512 		}
2513 		/*
2514 		 * If the interface address is set, create the LOCAL
2515 		 * or LOOPBACK IRE.
2516 		 */
2517 		ip1dbg(("ipif_add_ires_v6: creating IRE %d for %s\n",
2518 		    ipif->ipif_ire_type,
2519 		    inet_ntop(AF_INET6, &ipif->ipif_v6lcl_addr,
2520 		    buf, sizeof (buf))));
2521 
2522 		ire_local = ire_create_v6(
2523 		    &ipif->ipif_v6lcl_addr,		/* dest address */
2524 		    &ipv6_all_ones,			/* mask */
2525 		    NULL,				/* no gateway */
2526 		    ipif->ipif_ire_type,		/* LOCAL or LOOPBACK */
2527 		    ipif->ipif_ill,			/* interface */
2528 		    ipif->ipif_zoneid,
2529 		    ((ipif->ipif_flags & IPIF_PRIVATE) ?
2530 		    RTF_PRIVATE : 0) | RTF_KERNEL,
2531 		    NULL,
2532 		    ipst);
2533 		if (ire_local == NULL) {
2534 			ip1dbg(("ipif_up_done_v6: NULL ire_local\n"));
2535 			err = ENOMEM;
2536 			goto bad;
2537 		}
2538 	}
2539 
2540 	/* Set up the IRE_IF_RESOLVER or IRE_IF_NORESOLVER, as appropriate. */
2541 	if (!loopback && !(ipif->ipif_flags & IPIF_NOXMIT) &&
2542 	    !(IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet) &&
2543 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6net_mask))) {
2544 		/* ipif_v6subnet is ipif_v6pp_dst_addr for pt-pt */
2545 		v6addr = ipif->ipif_v6subnet;
2546 
2547 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
2548 			route_mask = ipv6_all_ones;
2549 		} else {
2550 			route_mask = ipif->ipif_v6net_mask;
2551 		}
2552 
2553 		ip1dbg(("ipif_add_ires_v6: creating if IRE %d for %s\n",
2554 		    ill->ill_net_type,
2555 		    inet_ntop(AF_INET6, &v6addr, buf, sizeof (buf))));
2556 
2557 		*irep++ = ire_create_v6(
2558 		    &v6addr,			/* dest pref */
2559 		    &route_mask,		/* mask */
2560 		    &ipif->ipif_v6lcl_addr,	/* gateway */
2561 		    ill->ill_net_type,		/* IF_[NO]RESOLVER */
2562 		    ipif->ipif_ill,
2563 		    ipif->ipif_zoneid,
2564 		    ((ipif->ipif_flags & IPIF_PRIVATE) ?
2565 		    RTF_PRIVATE : 0) | RTF_KERNEL,
2566 		    NULL,
2567 		    ipst);
2568 	}
2569 
2570 	/* If an earlier ire_create failed, get out now */
2571 	for (irep1 = irep; irep1 > ire_array; ) {
2572 		irep1--;
2573 		if (*irep1 == NULL) {
2574 			ip1dbg(("ipif_add_ires_v6: NULL ire found in"
2575 			    " ire_array\n"));
2576 			err = ENOMEM;
2577 			goto bad;
2578 		}
2579 	}
2580 
2581 	/*
2582 	 * Need to atomically check for IP address availability under
2583 	 * ip_addr_avail_lock.  ill_g_lock is held as reader to ensure no new
2584 	 * ills or new ipifs can be added while we are checking availability.
2585 	 */
2586 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
2587 	mutex_enter(&ipst->ips_ip_addr_avail_lock);
2588 	ill->ill_ipif_up_count++;
2589 	ipif->ipif_flags |= IPIF_UP;
2590 	err = ip_addr_availability_check(ipif);
2591 	mutex_exit(&ipst->ips_ip_addr_avail_lock);
2592 	rw_exit(&ipst->ips_ill_g_lock);
2593 
2594 	if (err != 0) {
2595 		/*
2596 		 * Our address may already be up on the same ill. In this case,
2597 		 * the external resolver entry for our ipif replaced the one for
2598 		 * the other ipif. So we don't want to delete it (otherwise the
2599 		 * other ipif would be unable to send packets).
2600 		 * ip_addr_availability_check() identifies this case for us and
2601 		 * returns EADDRINUSE; Caller must  turn it into EADDRNOTAVAIL
2602 		 * which is the expected error code.
2603 		 *
2604 		 * Note that ipif_ndp_down() will only delete the nce in the
2605 		 * case when the nce_ipif_cnt drops to 0.
2606 		 */
2607 		ill->ill_ipif_up_count--;
2608 		ipif->ipif_flags &= ~IPIF_UP;
2609 		goto bad;
2610 	}
2611 
2612 	/*
2613 	 * Add in all newly created IREs.
2614 	 */
2615 	if (ire_local != NULL) {
2616 		ire_local = ire_add(ire_local);
2617 #ifdef DEBUG
2618 		if (ire_local != NULL) {
2619 			ire_refhold_notr(ire_local);
2620 			ire_refrele(ire_local);
2621 		}
2622 #endif
2623 	}
2624 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
2625 	if (ire_local != NULL)
2626 		ipif->ipif_ire_local = ire_local;
2627 	rw_exit(&ipst->ips_ill_g_lock);
2628 	ire_local = NULL;
2629 
2630 	for (irep1 = irep; irep1 > ire_array; ) {
2631 		irep1--;
2632 		/* Shouldn't be adding any bcast ire's */
2633 		ASSERT((*irep1)->ire_type != IRE_BROADCAST);
2634 		ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock));
2635 		/* refheld by ire_add */
2636 		*irep1 = ire_add(*irep1);
2637 		if (*irep1 != NULL) {
2638 			ire_refrele(*irep1);
2639 			*irep1 = NULL;
2640 		}
2641 	}
2642 
2643 	if (ipif->ipif_addr_ready)
2644 		ipif_up_notify(ipif);
2645 	return (0);
2646 
2647 bad:
2648 	if (ire_local != NULL)
2649 		ire_delete(ire_local);
2650 	while (irep > ire_array) {
2651 		irep--;
2652 		if (*irep != NULL)
2653 			ire_delete(*irep);
2654 	}
2655 	(void) ip_srcid_remove(&ipif->ipif_v6lcl_addr, ipif->ipif_zoneid, ipst);
2656 
2657 	return (err);
2658 }
2659 
2660 /* Remove all the IREs created by ipif_add_ires_v6 */
2661 void
2662 ipif_delete_ires_v6(ipif_t *ipif)
2663 {
2664 	ill_t		*ill = ipif->ipif_ill;
2665 	ip_stack_t	*ipst = ill->ill_ipst;
2666 	in6_addr_t	v6addr;
2667 	in6_addr_t	route_mask;
2668 	ire_t		*ire;
2669 	int		match_args;
2670 	boolean_t	loopback;
2671 
2672 	/* Check if this is a loopback interface */
2673 	loopback = (ipif->ipif_ill->ill_wq == NULL);
2674 
2675 	match_args = MATCH_IRE_TYPE | MATCH_IRE_ILL | MATCH_IRE_MASK |
2676 	    MATCH_IRE_ZONEONLY;
2677 
2678 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
2679 	if ((ire = ipif->ipif_ire_local) != NULL) {
2680 		ipif->ipif_ire_local = NULL;
2681 		rw_exit(&ipst->ips_ill_g_lock);
2682 		/*
2683 		 * Move count to ipif so we don't loose the count due to
2684 		 * a down/up dance.
2685 		 */
2686 		atomic_add_32(&ipif->ipif_ib_pkt_count, ire->ire_ib_pkt_count);
2687 
2688 		ire_delete(ire);
2689 		ire_refrele_notr(ire);
2690 	} else {
2691 		rw_exit(&ipst->ips_ill_g_lock);
2692 	}
2693 
2694 	match_args |= MATCH_IRE_GW;
2695 
2696 	/*
2697 	 * Delete the IRE_IF_RESOLVER or IRE_IF_NORESOLVER, as appropriate.
2698 	 * Note that atun interfaces have an all-zero ipif_v6subnet.
2699 	 * Thus we allow a zero subnet as long as the mask is non-zero.
2700 	 */
2701 	if (IS_UNDER_IPMP(ill))
2702 		match_args |= MATCH_IRE_TESTHIDDEN;
2703 
2704 	if (!loopback && !(ipif->ipif_flags & IPIF_NOXMIT) &&
2705 	    !(IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet) &&
2706 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6net_mask))) {
2707 		/* ipif_v6subnet is ipif_v6pp_dst_addr for pt-pt */
2708 		v6addr = ipif->ipif_v6subnet;
2709 
2710 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
2711 			route_mask = ipv6_all_ones;
2712 		} else {
2713 			route_mask = ipif->ipif_v6net_mask;
2714 		}
2715 
2716 		ire = ire_ftable_lookup_v6(
2717 		    &v6addr,			/* dest pref */
2718 		    &route_mask,		/* mask */
2719 		    &ipif->ipif_v6lcl_addr,	/* gateway */
2720 		    ill->ill_net_type,		/* IF_[NO]RESOLVER */
2721 		    ipif->ipif_ill,
2722 		    ipif->ipif_zoneid,
2723 		    NULL,
2724 		    match_args,
2725 		    0,
2726 		    ipst,
2727 		    NULL);
2728 		ASSERT(ire != NULL);
2729 		ire_delete(ire);
2730 		ire_refrele(ire);
2731 	}
2732 }
2733 
2734 /*
2735  * Delete an ND entry if it exists.
2736  */
2737 /* ARGSUSED */
2738 int
2739 ip_siocdelndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
2740     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
2741 {
2742 	sin6_t		*sin6;
2743 	struct lifreq	*lifr;
2744 	lif_nd_req_t	*lnr;
2745 	ill_t		*ill = ipif->ipif_ill;
2746 	nce_t		*nce;
2747 
2748 	lifr = (struct lifreq *)mp->b_cont->b_cont->b_rptr;
2749 	lnr = &lifr->lifr_nd;
2750 	/* Only allow for logical unit zero i.e. not on "le0:17" */
2751 	if (ipif->ipif_id != 0)
2752 		return (EINVAL);
2753 
2754 	if (!ipif->ipif_isv6)
2755 		return (EINVAL);
2756 
2757 	if (lnr->lnr_addr.ss_family != AF_INET6)
2758 		return (EAFNOSUPPORT);
2759 
2760 	sin6 = (sin6_t *)&lnr->lnr_addr;
2761 
2762 	/*
2763 	 * Since ND mappings must be consistent across an IPMP group, prohibit
2764 	 * deleting ND mappings on underlying interfaces.
2765 	 * Don't allow deletion of mappings for local addresses.
2766 	 */
2767 	if (IS_UNDER_IPMP(ill))
2768 		return (EPERM);
2769 
2770 	nce = nce_lookup_v6(ill, &sin6->sin6_addr);
2771 	if (nce == NULL)
2772 		return (ESRCH);
2773 
2774 	if (NCE_MYADDR(nce->nce_common)) {
2775 		nce_refrele(nce);
2776 		return (EPERM);
2777 	}
2778 
2779 	/*
2780 	 * delete the nce_common which will also delete the nces on any
2781 	 * under_ill in the case of ipmp.
2782 	 */
2783 	ncec_delete(nce->nce_common);
2784 	nce_refrele(nce);
2785 	return (0);
2786 }
2787 
2788 /*
2789  * Return nbr cache info.
2790  */
2791 /* ARGSUSED */
2792 int
2793 ip_siocqueryndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
2794     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
2795 {
2796 	ill_t		*ill = ipif->ipif_ill;
2797 	struct lifreq	*lifr;
2798 	lif_nd_req_t	*lnr;
2799 
2800 	lifr = (struct lifreq *)mp->b_cont->b_cont->b_rptr;
2801 	lnr = &lifr->lifr_nd;
2802 	/* Only allow for logical unit zero i.e. not on "le0:17" */
2803 	if (ipif->ipif_id != 0)
2804 		return (EINVAL);
2805 
2806 	if (!ipif->ipif_isv6)
2807 		return (EINVAL);
2808 
2809 	if (lnr->lnr_addr.ss_family != AF_INET6)
2810 		return (EAFNOSUPPORT);
2811 
2812 	if (ill->ill_phys_addr_length > sizeof (lnr->lnr_hdw_addr))
2813 		return (EINVAL);
2814 
2815 	return (ndp_query(ill, lnr));
2816 }
2817 
2818 /*
2819  * Perform an update of the nd entry for the specified address.
2820  */
2821 /* ARGSUSED */
2822 int
2823 ip_siocsetndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
2824     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
2825 {
2826 	sin6_t		*sin6;
2827 	ill_t		*ill = ipif->ipif_ill;
2828 	struct	lifreq	*lifr;
2829 	lif_nd_req_t	*lnr;
2830 	ire_t		*ire;
2831 
2832 	lifr = (struct lifreq *)mp->b_cont->b_cont->b_rptr;
2833 	lnr = &lifr->lifr_nd;
2834 	/* Only allow for logical unit zero i.e. not on "le0:17" */
2835 	if (ipif->ipif_id != 0)
2836 		return (EINVAL);
2837 
2838 	if (!ipif->ipif_isv6)
2839 		return (EINVAL);
2840 
2841 	if (lnr->lnr_addr.ss_family != AF_INET6)
2842 		return (EAFNOSUPPORT);
2843 
2844 	sin6 = (sin6_t *)&lnr->lnr_addr;
2845 
2846 	/*
2847 	 * Since ND mappings must be consistent across an IPMP group, prohibit
2848 	 * updating ND mappings on underlying interfaces.  Also, since ND
2849 	 * mappings for IPMP data addresses are owned by IP itself, prohibit
2850 	 * updating them.
2851 	 */
2852 	if (IS_UNDER_IPMP(ill))
2853 		return (EPERM);
2854 
2855 	if (IS_IPMP(ill)) {
2856 		ire = ire_ftable_lookup_v6(&sin6->sin6_addr, NULL, NULL,
2857 		    IRE_LOCAL, ill, ALL_ZONES, NULL,
2858 		    MATCH_IRE_TYPE | MATCH_IRE_ILL, 0, ill->ill_ipst, NULL);
2859 		if (ire != NULL) {
2860 			ire_refrele(ire);
2861 			return (EPERM);
2862 		}
2863 	}
2864 
2865 	return (ndp_sioc_update(ill, lnr));
2866 }
2867