/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright (c) 1999, 2010, Oracle and/or its affiliates. All rights reserved.
 * Copyright (c) 1990 Mentat Inc.
 */

/*
 * This file contains the interface control functions for IPv6.
 */

#include <sys/types.h>
#include <sys/sysmacros.h>
#include <sys/stream.h>
#include <sys/dlpi.h>
#include <sys/stropts.h>
#include <sys/ddi.h>
#include <sys/cmn_err.h>
#include <sys/kstat.h>
#include <sys/debug.h>
#include <sys/zone.h>
#include <sys/policy.h>

#include <sys/systm.h>
#include <sys/param.h>
#include <sys/socket.h>
#include <sys/isa_defs.h>
#include <net/if.h>
#include <net/if_dl.h>
#include <net/route.h>
#include <netinet/in.h>
#include <netinet/igmp_var.h>
#include <netinet/ip6.h>
#include <netinet/icmp6.h>

#include <inet/common.h>
#include <inet/nd.h>
#include <inet/tunables.h>
#include <inet/mib2.h>
#include <inet/ip.h>
#include <inet/ip6.h>
#include <inet/ip_multi.h>
#include <inet/ip_ire.h>
#include <inet/ip_rts.h>
#include <inet/ip_ndp.h>
#include <inet/ip_if.h>
#include <inet/ip6_asp.h>
#include <inet/ipclassifier.h>
#include <inet/sctp_ip.h>

#include <sys/tsol/tndb.h>
#include <sys/tsol/tnet.h>

static in6_addr_t       ipv6_ll_template =
                        {(uint32_t)V6_LINKLOCAL, 0x0, 0x0, 0x0};

static ipif_t *
ipif_lookup_interface_v6(const in6_addr_t *if_addr, const in6_addr_t *dst,
    ip_stack_t *ipst);

static int      ipif_add_ires_v6(ipif_t *, boolean_t);

/*
 * This function is called when an application does not specify an interface
 * to be used for multicast traffic.  It calls ire_lookup_multi_v6() to look
 * for an interface route for the specified multicast group.  Doing
 * this allows the administrator to add prefix routes for multicast to
 * indicate which interface to be used for multicast traffic in the above
 * scenario.  The route could be for all multicast (ff00::/8), for a single
 * multicast group (a /128 route) or anything in between.  If there is no
 * such multicast route, we just find any multicast capable interface and
 * return it.
 *
 * We support MULTIRT and RTF_SETSRC on the multicast routes added to the
 * unicast table. This is used by CGTP.
 */
ill_t *
ill_lookup_group_v6(const in6_addr_t *group, zoneid_t zoneid, ip_stack_t *ipst,
    boolean_t *multirtp, in6_addr_t *setsrcp)
{
        ill_t   *ill;

        ill = ire_lookup_multi_ill_v6(group, zoneid, ipst, multirtp, setsrcp);
        if (ill != NULL)
                return (ill);

        return (ill_lookup_multicast(ipst, zoneid, B_TRUE));
}

/*
 * Look for an ipif with the specified interface address and destination.
 * The destination address is used only for matching point-to-point interfaces.
 */
static ipif_t *
ipif_lookup_interface_v6(const in6_addr_t *if_addr, const in6_addr_t *dst,
    ip_stack_t *ipst)
{
        ipif_t  *ipif;
        ill_t   *ill;
        ill_walk_context_t ctx;

        /*
         * First match all the point-to-point interfaces
         * before looking at non-point-to-point interfaces.
         * This is done to avoid returning non-point-to-point
         * ipif instead of unnumbered point-to-point ipif.
         */
        rw_enter(&ipst->ips_ill_g_lock, RW_READER);
        ill = ILL_START_WALK_V6(&ctx, ipst);
        for (; ill != NULL; ill = ill_next(&ctx, ill)) {
                mutex_enter(&ill->ill_lock);
                for (ipif = ill->ill_ipif; ipif != NULL;
                    ipif = ipif->ipif_next) {
                        /* Allow the ipif to be down */
                        if ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
                            (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr,
                            if_addr)) &&
                            (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr,
                            dst))) {
                                if (!IPIF_IS_CONDEMNED(ipif)) {
                                        ipif_refhold_locked(ipif);
                                        mutex_exit(&ill->ill_lock);
                                        rw_exit(&ipst->ips_ill_g_lock);
                                        return (ipif);
                                }
                        }
                }
                mutex_exit(&ill->ill_lock);
        }
        rw_exit(&ipst->ips_ill_g_lock);
        /* lookup the ipif based on interface address */
        ipif = ipif_lookup_addr_v6(if_addr, NULL, ALL_ZONES, ipst);
        ASSERT(ipif == NULL || ipif->ipif_isv6);
        return (ipif);
}

/*
 * Common function for ipif_lookup_addr_v6() and ipif_lookup_addr_exact_v6().
 */
static ipif_t *
ipif_lookup_addr_common_v6(const in6_addr_t *addr, ill_t *match_ill,
    uint32_t match_flags, zoneid_t zoneid, ip_stack_t *ipst)
{
        ipif_t  *ipif;
        ill_t   *ill;
        boolean_t  ptp = B_FALSE;
        ill_walk_context_t ctx;
        boolean_t match_illgrp = (match_flags & IPIF_MATCH_ILLGRP);
        boolean_t no_duplicate = (match_flags & IPIF_MATCH_NONDUP);

        rw_enter(&ipst->ips_ill_g_lock, RW_READER);
        /*
         * Repeat twice, first based on local addresses and
         * next time for pointopoint.
         */
repeat:
        ill = ILL_START_WALK_V6(&ctx, ipst);
        for (; ill != NULL; ill = ill_next(&ctx, ill)) {
                if (match_ill != NULL && ill != match_ill &&
                    (!match_illgrp || !IS_IN_SAME_ILLGRP(ill, match_ill))) {
                        continue;
                }
                mutex_enter(&ill->ill_lock);
                for (ipif = ill->ill_ipif; ipif != NULL;
                    ipif = ipif->ipif_next) {
                        if (zoneid != ALL_ZONES &&
                            ipif->ipif_zoneid != zoneid &&
                            ipif->ipif_zoneid != ALL_ZONES)
                                continue;

                        if (no_duplicate &&
                            !(ipif->ipif_flags & IPIF_UP)) {
                                continue;
                        }

                        /* Allow the ipif to be down */
                        if ((!ptp && (IN6_ARE_ADDR_EQUAL(
                            &ipif->ipif_v6lcl_addr, addr) &&
                            (ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) ||
                            (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) &&
                            IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr,
                            addr))) {
                                if (!IPIF_IS_CONDEMNED(ipif)) {
                                        ipif_refhold_locked(ipif);
                                        mutex_exit(&ill->ill_lock);
                                        rw_exit(&ipst->ips_ill_g_lock);
                                        return (ipif);
                                }
                        }
                }
                mutex_exit(&ill->ill_lock);
        }

        /* If we already did the ptp case, then we are done */
        if (ptp) {
                rw_exit(&ipst->ips_ill_g_lock);
                return (NULL);
        }
        ptp = B_TRUE;
        goto repeat;
}

/*
 * Lookup an ipif with the specified address.  For point-to-point links we
 * look for matches on either the destination address or the local address,
 * but we skip the local address check if IPIF_UNNUMBERED is set.  If the
 * `match_ill' argument is non-NULL, the lookup is restricted to that ill
 * (or illgrp if `match_ill' is in an IPMP group).
 */
ipif_t *
ipif_lookup_addr_v6(const in6_addr_t *addr, ill_t *match_ill, zoneid_t zoneid,
    ip_stack_t *ipst)
{
        return (ipif_lookup_addr_common_v6(addr, match_ill, IPIF_MATCH_ILLGRP,
            zoneid, ipst));
}

/*
 * Lookup an ipif with the specified address. Similar to ipif_lookup_addr,
 * except that we will only return an address if it is not marked as
 * IPIF_DUPLICATE
 */
ipif_t *
ipif_lookup_addr_nondup_v6(const in6_addr_t *addr, ill_t *match_ill,
    zoneid_t zoneid, ip_stack_t *ipst)
{
        return (ipif_lookup_addr_common_v6(addr, match_ill,
            (IPIF_MATCH_ILLGRP | IPIF_MATCH_NONDUP), zoneid,
            ipst));
}

/*
 * Special abbreviated version of ipif_lookup_addr_v6() that doesn't match
 * `match_ill' across the IPMP group.  This function is only needed in some
 * corner-cases; almost everything should use ipif_lookup_addr_v6().
 */
ipif_t *
ipif_lookup_addr_exact_v6(const in6_addr_t *addr, ill_t *match_ill,
    ip_stack_t *ipst)
{
        ASSERT(match_ill != NULL);
        return (ipif_lookup_addr_common_v6(addr, match_ill, 0, ALL_ZONES,
            ipst));
}

/*
 * Look for an ipif with the specified address. For point-point links
 * we look for matches on either the destination address and the local
 * address, but we ignore the check on the local address if IPIF_UNNUMBERED
 * is set.
 * If the `match_ill' argument is non-NULL, the lookup is restricted to that
 * ill (or illgrp if `match_ill' is in an IPMP group).
 * Return the zoneid for the ipif. ALL_ZONES if none found.
 */
zoneid_t
ipif_lookup_addr_zoneid_v6(const in6_addr_t *addr, ill_t *match_ill,
    ip_stack_t *ipst)
{
        ipif_t  *ipif;
        ill_t   *ill;
        boolean_t  ptp = B_FALSE;
        ill_walk_context_t ctx;
        zoneid_t        zoneid;

        rw_enter(&ipst->ips_ill_g_lock, RW_READER);
        /*
         * Repeat twice, first based on local addresses and
         * next time for pointopoint.
         */
repeat:
        ill = ILL_START_WALK_V6(&ctx, ipst);
        for (; ill != NULL; ill = ill_next(&ctx, ill)) {
                if (match_ill != NULL && ill != match_ill &&
                    !IS_IN_SAME_ILLGRP(ill, match_ill)) {
                        continue;
                }
                mutex_enter(&ill->ill_lock);
                for (ipif = ill->ill_ipif; ipif != NULL;
                    ipif = ipif->ipif_next) {
                        /* Allow the ipif to be down */
                        if ((!ptp && (IN6_ARE_ADDR_EQUAL(
                            &ipif->ipif_v6lcl_addr, addr) &&
                            (ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) ||
                            (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) &&
                            IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr,
                            addr)) &&
                            !(ipif->ipif_state_flags & IPIF_CONDEMNED)) {
                                zoneid = ipif->ipif_zoneid;
                                mutex_exit(&ill->ill_lock);
                                rw_exit(&ipst->ips_ill_g_lock);
                                /*
                                 * If ipif_zoneid was ALL_ZONES then we have
                                 * a trusted extensions shared IP address.
                                 * In that case GLOBAL_ZONEID works to send.
                                 */
                                if (zoneid == ALL_ZONES)
                                        zoneid = GLOBAL_ZONEID;
                                return (zoneid);
                        }
                }
                mutex_exit(&ill->ill_lock);
        }

        /* If we already did the ptp case, then we are done */
        if (ptp) {
                rw_exit(&ipst->ips_ill_g_lock);
                return (ALL_ZONES);
        }
        ptp = B_TRUE;
        goto repeat;
}

/*
 * Perform various checks to verify that an address would make sense as a local
 * interface address.  This is currently only called when an attempt is made
 * to set a local address.
 *
 * Does not allow a v4-mapped address, an address that equals the subnet
 * anycast address, ... a multicast address, ...
 */
boolean_t
ip_local_addr_ok_v6(const in6_addr_t *addr, const in6_addr_t *subnet_mask)
{
        in6_addr_t subnet;

        if (IN6_IS_ADDR_UNSPECIFIED(addr))
                return (B_TRUE);        /* Allow all zeros */

        /*
         * Don't allow all zeroes or host part, but allow
         * all ones netmask.
         */
        V6_MASK_COPY(*addr, *subnet_mask, subnet);
        if (IN6_IS_ADDR_V4MAPPED(addr) ||
            (IN6_ARE_ADDR_EQUAL(addr, &subnet) &&
            !IN6_ARE_ADDR_EQUAL(subnet_mask, &ipv6_all_ones)) ||
            (IN6_IS_ADDR_V4COMPAT(addr) && CLASSD(V4_PART_OF_V6((*addr)))) ||
            IN6_IS_ADDR_MULTICAST(addr))
                return (B_FALSE);

        return (B_TRUE);
}

/*
 * Perform various checks to verify that an address would make sense as a
 * remote/subnet interface address.
 */
boolean_t
ip_remote_addr_ok_v6(const in6_addr_t *addr, const in6_addr_t *subnet_mask)
{
        in6_addr_t subnet;

        if (IN6_IS_ADDR_UNSPECIFIED(addr))
                return (B_TRUE);        /* Allow all zeros */

        V6_MASK_COPY(*addr, *subnet_mask, subnet);
        if (IN6_IS_ADDR_V4MAPPED(addr) ||
            (IN6_ARE_ADDR_EQUAL(addr, &subnet) &&
            !IN6_ARE_ADDR_EQUAL(subnet_mask, &ipv6_all_ones)) ||
            IN6_IS_ADDR_MULTICAST(addr) ||
            (IN6_IS_ADDR_V4COMPAT(addr) && CLASSD(V4_PART_OF_V6((*addr)))))
                return (B_FALSE);

        return (B_TRUE);
}

/*
 * ip_rt_add_v6 is called to add an IPv6 route to the forwarding table.
 * ill is passed in to associate it with the correct interface
 * (for link-local destinations and gateways).
 * If ire_arg is set, then we return the held IRE in that location.
 */
/* ARGSUSED1 */
int
ip_rt_add_v6(const in6_addr_t *dst_addr, const in6_addr_t *mask,
    const in6_addr_t *gw_addr, const in6_addr_t *src_addr, int flags,
    ill_t *ill, ire_t **ire_arg, struct rtsa_s *sp, ip_stack_t *ipst,
    zoneid_t zoneid)
{
        ire_t   *ire, *nire;
        ire_t   *gw_ire = NULL;
        ipif_t  *ipif;
        uint_t  type;
        int     match_flags = MATCH_IRE_TYPE;
        tsol_gc_t *gc = NULL;
        tsol_gcgrp_t *gcgrp = NULL;
        boolean_t gcgrp_xtraref = B_FALSE;
        boolean_t unbound = B_FALSE;

        if (ire_arg != NULL)
                *ire_arg = NULL;

        /*
         * Prevent routes with a zero gateway from being created (since
         * interfaces can currently be plumbed and brought up with no assigned
         * address).
         */
        if (IN6_IS_ADDR_UNSPECIFIED(gw_addr))
                return (ENETUNREACH);

        /*
         * If this is the case of RTF_HOST being set, then we set the netmask
         * to all ones (regardless if one was supplied).
         */
        if (flags & RTF_HOST)
                mask = &ipv6_all_ones;

        /*
         * Get the ipif, if any, corresponding to the gw_addr
         * If -ifp was specified we restrict ourselves to the ill, otherwise
         * we match on the gatway and destination to handle unnumbered pt-pt
         * interfaces.
         */
        if (ill != NULL)
                ipif = ipif_lookup_addr_v6(gw_addr, ill, ALL_ZONES, ipst);
        else
                ipif = ipif_lookup_interface_v6(gw_addr, dst_addr, ipst);
        if (ipif != NULL) {
                if (IS_VNI(ipif->ipif_ill)) {
                        ipif_refrele(ipif);
                        return (EINVAL);
                }
        }

        /*
         * GateD will attempt to create routes with a loopback interface
         * address as the gateway and with RTF_GATEWAY set.  We allow
         * these routes to be added, but create them as interface routes
         * since the gateway is an interface address.
         */
        if ((ipif != NULL) && (ipif->ipif_ire_type == IRE_LOOPBACK)) {
                flags &= ~RTF_GATEWAY;
                if (IN6_ARE_ADDR_EQUAL(gw_addr, &ipv6_loopback) &&
                    IN6_ARE_ADDR_EQUAL(dst_addr, &ipv6_loopback) &&
                    IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones)) {
                        ire = ire_ftable_lookup_v6(dst_addr, 0, 0, IRE_LOOPBACK,
                            NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, 0, ipst,
                            NULL);
                        if (ire != NULL) {
                                ire_refrele(ire);
                                ipif_refrele(ipif);
                                return (EEXIST);
                        }
                        ip1dbg(("ip_rt_add_v6: 0x%p creating IRE 0x%x"
                            "for 0x%x\n", (void *)ipif,
                            ipif->ipif_ire_type,
                            ntohl(ipif->ipif_lcl_addr)));
                        ire = ire_create_v6(
                            dst_addr,
                            mask,
                            NULL,
                            ipif->ipif_ire_type,        /* LOOPBACK */
                            ipif->ipif_ill,
                            zoneid,
                            (ipif->ipif_flags & IPIF_PRIVATE) ? RTF_PRIVATE : 0,
                            NULL,
                            ipst);

                        if (ire == NULL) {
                                ipif_refrele(ipif);
                                return (ENOMEM);
                        }
                        /* src address assigned by the caller? */
                        if ((flags & RTF_SETSRC) &&
                            !IN6_IS_ADDR_UNSPECIFIED(src_addr))
                                ire->ire_setsrc_addr_v6 = *src_addr;

                        nire = ire_add(ire);
                        if (nire == NULL) {
                                /*
                                 * In the result of failure, ire_add() will have
                                 * already deleted the ire in question, so there
                                 * is no need to do that here.
                                 */
                                ipif_refrele(ipif);
                                return (ENOMEM);
                        }
                        /*
                         * Check if it was a duplicate entry. This handles
                         * the case of two racing route adds for the same route
                         */
                        if (nire != ire) {
                                ASSERT(nire->ire_identical_ref > 1);
                                ire_delete(nire);
                                ire_refrele(nire);
                                ipif_refrele(ipif);
                                return (EEXIST);
                        }
                        ire = nire;
                        goto save_ire;
                }
        }

        /*
         * The routes for multicast with CGTP are quite special in that
         * the gateway is the local interface address, yet RTF_GATEWAY
         * is set. We turn off RTF_GATEWAY to provide compatibility with
         * this undocumented and unusual use of multicast routes.
         */
        if ((flags & RTF_MULTIRT) && ipif != NULL)
                flags &= ~RTF_GATEWAY;

        /*
         * Traditionally, interface routes are ones where RTF_GATEWAY isn't set
         * and the gateway address provided is one of the system's interface
         * addresses.  By using the routing socket interface and supplying an
         * RTA_IFP sockaddr with an interface index, an alternate method of
         * specifying an interface route to be created is available which uses
         * the interface index that specifies the outgoing interface rather than
         * the address of an outgoing interface (which may not be able to
         * uniquely identify an interface).  When coupled with the RTF_GATEWAY
         * flag, routes can be specified which not only specify the next-hop to
         * be used when routing to a certain prefix, but also which outgoing
         * interface should be used.
         *
         * Previously, interfaces would have unique addresses assigned to them
         * and so the address assigned to a particular interface could be used
         * to identify a particular interface.  One exception to this was the
         * case of an unnumbered interface (where IPIF_UNNUMBERED was set).
         *
         * With the advent of IPv6 and its link-local addresses, this
         * restriction was relaxed and interfaces could share addresses between
         * themselves.  In fact, typically all of the link-local interfaces on
         * an IPv6 node or router will have the same link-local address.  In
         * order to differentiate between these interfaces, the use of an
         * interface index is necessary and this index can be carried inside a
         * RTA_IFP sockaddr (which is actually a sockaddr_dl).  One restriction
         * of using the interface index, however, is that all of the ipif's that
         * are part of an ill have the same index and so the RTA_IFP sockaddr
         * cannot be used to differentiate between ipif's (or logical
         * interfaces) that belong to the same ill (physical interface).
         *
         * For example, in the following case involving IPv4 interfaces and
         * logical interfaces
         *
         *      192.0.2.32      255.255.255.224 192.0.2.33      U       if0
         *      192.0.2.32      255.255.255.224 192.0.2.34      U       if0
         *      192.0.2.32      255.255.255.224 192.0.2.35      U       if0
         *
         * the ipif's corresponding to each of these interface routes can be
         * uniquely identified by the "gateway" (actually interface address).
         *
         * In this case involving multiple IPv6 default routes to a particular
         * link-local gateway, the use of RTA_IFP is necessary to specify which
         * default route is of interest:
         *
         *      default         fe80::123:4567:89ab:cdef        U       if0
         *      default         fe80::123:4567:89ab:cdef        U       if1
         */

        /* RTF_GATEWAY not set */
        if (!(flags & RTF_GATEWAY)) {
                if (sp != NULL) {
                        ip2dbg(("ip_rt_add_v6: gateway security attributes "
                            "cannot be set with interface route\n"));
                        if (ipif != NULL)
                                ipif_refrele(ipif);
                        return (EINVAL);
                }

                /*
                 * Whether or not ill (RTA_IFP) is set, we require that
                 * the gateway is one of our local addresses.
                 */
                if (ipif == NULL)
                        return (ENETUNREACH);

                /*
                 * We use MATCH_IRE_ILL here. If the caller specified an
                 * interface (from the RTA_IFP sockaddr) we use it, otherwise
                 * we use the ill derived from the gateway address.
                 * We can always match the gateway address since we record it
                 * in ire_gateway_addr.
                 * We don't allow RTA_IFP to specify a different ill than the
                 * one matching the ipif to make sure we can delete the route.
                 */
                match_flags |= MATCH_IRE_GW | MATCH_IRE_ILL;
                if (ill == NULL) {
                        ill = ipif->ipif_ill;
                } else if (ill != ipif->ipif_ill) {
                        ipif_refrele(ipif);
                        return (EINVAL);
                }

                /*
                 * We check for an existing entry at this point.
                 */
                match_flags |= MATCH_IRE_MASK;
                ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr,
                    IRE_INTERFACE, ill, ALL_ZONES, NULL, match_flags, 0, ipst,
                    NULL);
                if (ire != NULL) {
                        ire_refrele(ire);
                        ipif_refrele(ipif);
                        return (EEXIST);
                }

                /*
                 * Some software (for example, GateD and Sun Cluster) attempts
                 * to create (what amount to) IRE_PREFIX routes with the
                 * loopback address as the gateway.  This is primarily done to
                 * set up prefixes with the RTF_REJECT flag set (for example,
                 * when generating aggregate routes). We also OR in the
                 * RTF_BLACKHOLE flag as these interface routes, by
                 * definition, can only be that.
                 *
                 * If the IRE type (as defined by ill->ill_net_type) would be
                 * IRE_LOOPBACK, then we map the request into a
                 * IRE_IF_NORESOLVER.
                 *
                 * Needless to say, the real IRE_LOOPBACK is NOT created by this
                 * routine, but rather using ire_create_v6() directly.
                 */
                type = ill->ill_net_type;
                if (type == IRE_LOOPBACK) {
                        type = IRE_IF_NORESOLVER;
                        flags |= RTF_BLACKHOLE;
                }

                /*
                 * Create a copy of the IRE_IF_NORESOLVER or
                 * IRE_IF_RESOLVER with the modified address, netmask, and
                 * gateway.
                 */
                ire = ire_create_v6(
                    dst_addr,
                    mask,
                    gw_addr,
                    type,
                    ill,
                    zoneid,
                    flags,
                    NULL,
                    ipst);
                if (ire == NULL) {
                        ipif_refrele(ipif);
                        return (ENOMEM);
                }

                /* src address assigned by the caller? */
                if ((flags & RTF_SETSRC) && !IN6_IS_ADDR_UNSPECIFIED(src_addr))
                        ire->ire_setsrc_addr_v6 = *src_addr;

                nire = ire_add(ire);
                if (nire == NULL) {
                        /*
                         * In the result of failure, ire_add() will have
                         * already deleted the ire in question, so there
                         * is no need to do that here.
                         */
                        ipif_refrele(ipif);
                        return (ENOMEM);
                }
                /*
                 * Check if it was a duplicate entry. This handles
                 * the case of two racing route adds for the same route
                 */
                if (nire != ire) {
                        ASSERT(nire->ire_identical_ref > 1);
                        ire_delete(nire);
                        ire_refrele(nire);
                        ipif_refrele(ipif);
                        return (EEXIST);
                }
                ire = nire;
                goto save_ire;
        }

        /*
         * Get an interface IRE for the specified gateway.
         * If we don't have an IRE_IF_NORESOLVER or IRE_IF_RESOLVER for the
         * gateway, it is currently unreachable and we fail the request
         * accordingly. We reject any RTF_GATEWAY routes where the gateway
         * is an IRE_LOCAL or IRE_LOOPBACK.
         * If RTA_IFP was specified we look on that particular ill.
         */
        if (ill != NULL)
                match_flags |= MATCH_IRE_ILL;

        /* Check whether the gateway is reachable. */
again:
        type = IRE_INTERFACE | IRE_LOCAL | IRE_LOOPBACK;
        if (flags & RTF_INDIRECT)
                type |= IRE_OFFLINK;

        gw_ire = ire_ftable_lookup_v6(gw_addr, 0, 0, type, ill,
            ALL_ZONES, NULL, match_flags, 0, ipst, NULL);
        if (gw_ire == NULL) {
                /*
                 * With IPMP, we allow host routes to influence in.mpathd's
                 * target selection.  However, if the test addresses are on
                 * their own network, the above lookup will fail since the
                 * underlying IRE_INTERFACEs are marked hidden.  So allow
                 * hidden test IREs to be found and try again.
                 */
                if (!(match_flags & MATCH_IRE_TESTHIDDEN))  {
                        match_flags |= MATCH_IRE_TESTHIDDEN;
                        goto again;
                }
                if (ipif != NULL)
                        ipif_refrele(ipif);
                return (ENETUNREACH);
        }
        if (gw_ire->ire_type & (IRE_LOCAL|IRE_LOOPBACK)) {
                ire_refrele(gw_ire);
                if (ipif != NULL)
                        ipif_refrele(ipif);
                return (ENETUNREACH);
        }
        if (ill == NULL && !(flags & RTF_INDIRECT)) {
                unbound = B_TRUE;
                if (ipst->ips_ipv6_strict_src_multihoming > 0)
                        ill = gw_ire->ire_ill;
        }

        /*
         * We create one of three types of IREs as a result of this request
         * based on the netmask.  A netmask of all ones (which is automatically
         * assumed when RTF_HOST is set) results in an IRE_HOST being created.
         * An all zeroes netmask implies a default route so an IRE_DEFAULT is
         * created.  Otherwise, an IRE_PREFIX route is created for the
         * destination prefix.
         */
        if (IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones))
                type = IRE_HOST;
        else if (IN6_IS_ADDR_UNSPECIFIED(mask))
                type = IRE_DEFAULT;
        else
                type = IRE_PREFIX;

        /* check for a duplicate entry */
        ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr, type, ill,
            ALL_ZONES, NULL,
            match_flags | MATCH_IRE_MASK | MATCH_IRE_GW, 0, ipst, NULL);
        if (ire != NULL) {
                if (ipif != NULL)
                        ipif_refrele(ipif);
                ire_refrele(gw_ire);
                ire_refrele(ire);
                return (EEXIST);
        }

        /* Security attribute exists */
        if (sp != NULL) {
                tsol_gcgrp_addr_t ga;

                /* find or create the gateway credentials group */
                ga.ga_af = AF_INET6;
                ga.ga_addr = *gw_addr;

                /* we hold reference to it upon success */
                gcgrp = gcgrp_lookup(&ga, B_TRUE);
                if (gcgrp == NULL) {
                        if (ipif != NULL)
                                ipif_refrele(ipif);
                        ire_refrele(gw_ire);
                        return (ENOMEM);
                }

                /*
                 * Create and add the security attribute to the group; a
                 * reference to the group is made upon allocating a new
                 * entry successfully.  If it finds an already-existing
                 * entry for the security attribute in the group, it simply
                 * returns it and no new reference is made to the group.
                 */
                gc = gc_create(sp, gcgrp, &gcgrp_xtraref);
                if (gc == NULL) {
                        /* release reference held by gcgrp_lookup */
                        GCGRP_REFRELE(gcgrp);
                        if (ipif != NULL)
                                ipif_refrele(ipif);
                        ire_refrele(gw_ire);
                        return (ENOMEM);
                }
        }

        /* Create the IRE. */
        ire = ire_create_v6(
            dst_addr,                           /* dest address */
            mask,                               /* mask */
            gw_addr,                            /* gateway address */
            (ushort_t)type,                     /* IRE type */
            ill,
            zoneid,
            flags,
            gc,                                 /* security attribute */
            ipst);

        /*
         * The ire holds a reference to the 'gc' and the 'gc' holds a
         * reference to the 'gcgrp'. We can now release the extra reference
         * the 'gcgrp' acquired in the gcgrp_lookup, if it was not used.
         */
        if (gcgrp_xtraref)
                GCGRP_REFRELE(gcgrp);
        if (ire == NULL) {
                if (gc != NULL)
                        GC_REFRELE(gc);
                if (ipif != NULL)
                        ipif_refrele(ipif);
                ire_refrele(gw_ire);
                return (ENOMEM);
        }

        /* src address assigned by the caller? */
        if ((flags & RTF_SETSRC) && !IN6_IS_ADDR_UNSPECIFIED(src_addr))
                ire->ire_setsrc_addr_v6 = *src_addr;

        ire->ire_unbound = unbound;

        /*
         * POLICY: should we allow an RTF_HOST with address INADDR_ANY?
         * SUN/OS socket stuff does but do we really want to allow ::0 ?
         */

        /* Add the new IRE. */
        nire = ire_add(ire);
        if (nire == NULL) {
                /*
                 * In the result of failure, ire_add() will have
                 * already deleted the ire in question, so there
                 * is no need to do that here.
                 */
                if (ipif != NULL)
                        ipif_refrele(ipif);
                ire_refrele(gw_ire);
                return (ENOMEM);
        }
        /*
         * Check if it was a duplicate entry. This handles
         * the case of two racing route adds for the same route
         */
        if (nire != ire) {
                ASSERT(nire->ire_identical_ref > 1);
                ire_delete(nire);
                ire_refrele(nire);
                if (ipif != NULL)
                        ipif_refrele(ipif);
                ire_refrele(gw_ire);
                return (EEXIST);
        }
        ire = nire;

        if (flags & RTF_MULTIRT) {
                /*
                 * Invoke the CGTP (multirouting) filtering module
                 * to add the dst address in the filtering database.
                 * Replicated inbound packets coming from that address
                 * will be filtered to discard the duplicates.
                 * It is not necessary to call the CGTP filter hook
                 * when the dst address is a multicast, because an
                 * IP source address cannot be a multicast.
                 */
                if (ipst->ips_ip_cgtp_filter_ops != NULL &&
                    !IN6_IS_ADDR_MULTICAST(&(ire->ire_addr_v6))) {
                        int res;
                        ipif_t *src_ipif;

                        /* Find the source address corresponding to gw_ire */
                        src_ipif = ipif_lookup_addr_v6(
                            &gw_ire->ire_gateway_addr_v6, NULL, zoneid, ipst);
                        if (src_ipif != NULL) {
                                res = ipst->ips_ip_cgtp_filter_ops->
                                    cfo_add_dest_v6(
                                    ipst->ips_netstack->netstack_stackid,
                                    &ire->ire_addr_v6,
                                    &ire->ire_gateway_addr_v6,
                                    &ire->ire_setsrc_addr_v6,
                                    &src_ipif->ipif_v6lcl_addr);
                                ipif_refrele(src_ipif);
                        } else {
                                res = EADDRNOTAVAIL;
                        }
                        if (res != 0) {
                                if (ipif != NULL)
                                        ipif_refrele(ipif);
                                ire_refrele(gw_ire);
                                ire_delete(ire);
                                ire_refrele(ire);       /* Held in ire_add */
                                return (res);
                        }
                }
        }

save_ire:
        if (gw_ire != NULL) {
                ire_refrele(gw_ire);
                gw_ire = NULL;
        }
        if (ire->ire_ill != NULL) {
                /*
                 * Save enough information so that we can recreate the IRE if
                 * the ILL goes down and then up.  The metrics associated
                 * with the route will be saved as well when rts_setmetrics() is
                 * called after the IRE has been created.  In the case where
                 * memory cannot be allocated, none of this information will be
                 * saved.
                 */
                ill_save_ire(ire->ire_ill, ire);
        }

        if (ire_arg != NULL) {
                /*
                 * Store the ire that was successfully added into where ire_arg
                 * points to so that callers don't have to look it up
                 * themselves (but they are responsible for ire_refrele()ing
                 * the ire when they are finished with it).
                 */
                *ire_arg = ire;
        } else {
                ire_refrele(ire);               /* Held in ire_add */
        }
        if (ipif != NULL)
                ipif_refrele(ipif);
        return (0);
}

/*
 * ip_rt_delete_v6 is called to delete an IPv6 route.
 * ill is passed in to associate it with the correct interface.
 * (for link-local destinations and gateways).
 */
/* ARGSUSED4 */
int
ip_rt_delete_v6(const in6_addr_t *dst_addr, const in6_addr_t *mask,
    const in6_addr_t *gw_addr, uint_t rtm_addrs, int flags, ill_t *ill,
    ip_stack_t *ipst, zoneid_t zoneid)
{
        ire_t   *ire = NULL;
        ipif_t  *ipif;
        uint_t  type;
        uint_t  match_flags = MATCH_IRE_TYPE;
        int     err = 0;

        /*
         * If this is the case of RTF_HOST being set, then we set the netmask
         * to all ones.  Otherwise, we use the netmask if one was supplied.
         */
        if (flags & RTF_HOST) {
                mask = &ipv6_all_ones;
                match_flags |= MATCH_IRE_MASK;
        } else if (rtm_addrs & RTA_NETMASK) {
                match_flags |= MATCH_IRE_MASK;
        }

        /*
         * Note that RTF_GATEWAY is never set on a delete, therefore
         * we check if the gateway address is one of our interfaces first,
         * and fall back on RTF_GATEWAY routes.
         *
         * This makes it possible to delete an original
         * IRE_IF_NORESOLVER/IRE_IF_RESOLVER - consistent with SunOS 4.1.
         * However, we have RTF_KERNEL set on the ones created by ipif_up
         * and those can not be deleted here.
         *
         * We use MATCH_IRE_ILL if we know the interface. If the caller
         * specified an interface (from the RTA_IFP sockaddr) we use it,
         * otherwise we use the ill derived from the gateway address.
         * We can always match the gateway address since we record it
         * in ire_gateway_addr.
         *
         * For more detail on specifying routes by gateway address and by
         * interface index, see the comments in ip_rt_add_v6().
         */
        ipif = ipif_lookup_interface_v6(gw_addr, dst_addr, ipst);
        if (ipif != NULL) {
                ill_t   *ill_match;

                if (ill != NULL)
                        ill_match = ill;
                else
                        ill_match = ipif->ipif_ill;

                match_flags |= MATCH_IRE_ILL;
                if (ipif->ipif_ire_type == IRE_LOOPBACK) {
                        ire = ire_ftable_lookup_v6(dst_addr, mask, 0,
                            IRE_LOOPBACK, ill_match, ALL_ZONES, NULL,
                            match_flags, 0, ipst, NULL);
                }
                if (ire == NULL) {
                        match_flags |= MATCH_IRE_GW;
                        ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr,
                            IRE_INTERFACE, ill_match, ALL_ZONES, NULL,
                            match_flags, 0, ipst, NULL);
                }
                /* Avoid deleting routes created by kernel from an ipif */
                if (ire != NULL && (ire->ire_flags & RTF_KERNEL)) {
                        ire_refrele(ire);
                        ire = NULL;
                }

                /* Restore in case we didn't find a match */
                match_flags &= ~(MATCH_IRE_GW|MATCH_IRE_ILL);
        }

        if (ire == NULL) {
                /*
                 * At this point, the gateway address is not one of our own
                 * addresses or a matching interface route was not found.  We
                 * set the IRE type to lookup based on whether
                 * this is a host route, a default route or just a prefix.
                 *
                 * If an ill was passed in, then the lookup is based on an
                 * interface index so MATCH_IRE_ILL is added to match_flags.
                 */
                match_flags |= MATCH_IRE_GW;
                if (ill != NULL)
                        match_flags |= MATCH_IRE_ILL;
                if (IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones))
                        type = IRE_HOST;
                else if (IN6_IS_ADDR_UNSPECIFIED(mask))
                        type = IRE_DEFAULT;
                else
                        type = IRE_PREFIX;
                ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr, type,
                    ill, ALL_ZONES, NULL, match_flags, 0, ipst, NULL);
        }

        if (ipif != NULL) {
                ipif_refrele(ipif);
                ipif = NULL;
        }
        if (ire == NULL)
                return (ESRCH);

        if (ire->ire_flags & RTF_MULTIRT) {
                /*
                 * Invoke the CGTP (multirouting) filtering module
                 * to remove the dst address from the filtering database.
                 * Packets coming from that address will no longer be
                 * filtered to remove duplicates.
                 */
                if (ipst->ips_ip_cgtp_filter_ops != NULL) {
                        err = ipst->ips_ip_cgtp_filter_ops->cfo_del_dest_v6(
                            ipst->ips_netstack->netstack_stackid,
                            &ire->ire_addr_v6, &ire->ire_gateway_addr_v6);
                }
        }

        ill = ire->ire_ill;
        if (ill != NULL)
                ill_remove_saved_ire(ill, ire);
        ire_delete(ire);
        ire_refrele(ire);
        return (err);
}

/*
 * Derive an interface id from the link layer address.
 */
void
ill_setdefaulttoken(ill_t *ill)
{
        if (!ill->ill_manual_token) {
                bzero(&ill->ill_token, sizeof (ill->ill_token));
                MEDIA_V6INTFID(ill->ill_media, ill, &ill->ill_token);
                ill->ill_token_length = IPV6_TOKEN_LEN;
        }
}

void
ill_setdesttoken(ill_t *ill)
{
        bzero(&ill->ill_dest_token, sizeof (ill->ill_dest_token));
        MEDIA_V6DESTINTFID(ill->ill_media, ill, &ill->ill_dest_token);
}

/*
 * Create a link-local address from a token.
 */
static void
ipif_get_linklocal(in6_addr_t *dest, const in6_addr_t *token)
{
        int i;

        for (i = 0; i < 4; i++) {
                dest->s6_addr32[i] =
                    token->s6_addr32[i] | ipv6_ll_template.s6_addr32[i];
        }
}

/*
 * Set a default IPv6 address for a 6to4 tunnel interface 2002:<tsrc>::1/16
 */
static void
ipif_set6to4addr(ipif_t *ipif)
{
        ill_t           *ill = ipif->ipif_ill;
        struct in_addr  v4phys;

        ASSERT(ill->ill_mactype == DL_6TO4);
        ASSERT(ill->ill_phys_addr_length == sizeof (struct in_addr));
        ASSERT(ipif->ipif_isv6);

        if (ipif->ipif_flags & IPIF_UP)
                return;

        (void) ip_plen_to_mask_v6(16, &ipif->ipif_v6net_mask);
        bcopy(ill->ill_phys_addr, &v4phys, sizeof (struct in_addr));
        IN6_V4ADDR_TO_6TO4(&v4phys, &ipif->ipif_v6lcl_addr);
        V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
            ipif->ipif_v6subnet);
}

/*
 * Is it not possible to set the link local address?
 * The address can be set if the token is set, and the token
 * isn't too long.
 * Return B_TRUE if the address can't be set, or B_FALSE if it can.
 */
boolean_t
ipif_cant_setlinklocal(ipif_t *ipif)
{
        ill_t *ill = ipif->ipif_ill;

        if (IN6_IS_ADDR_UNSPECIFIED(&ill->ill_token) ||
            ill->ill_token_length > IPV6_ABITS - IPV6_LL_PREFIXLEN)
                return (B_TRUE);

        return (B_FALSE);
}

/*
 * Generate a link-local address from the token.
 */
void
ipif_setlinklocal(ipif_t *ipif)
{
        ill_t           *ill = ipif->ipif_ill;
        in6_addr_t      ov6addr;

        ASSERT(IAM_WRITER_ILL(ill));

        /*
         * If the interface was created with no link-local address
         * on it and the flag ILLF_NOLINKLOCAL was set, then we
         * dont want to update the link-local.
         */
        if ((ill->ill_flags & ILLF_NOLINKLOCAL) &&
            IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr))
                return;
        /*
         * ill_manual_linklocal is set when the link-local address was
         * manually configured.
         */
        if (ill->ill_manual_linklocal)
                return;

        /*
         * IPv6 interfaces over 6to4 tunnels are special.  They do not have
         * link-local addresses, but instead have a single automatically
         * generated global address.
         */
        if (ill->ill_mactype == DL_6TO4) {
                ipif_set6to4addr(ipif);
                return;
        }

        if (ipif_cant_setlinklocal(ipif))
                return;

        ov6addr = ipif->ipif_v6lcl_addr;
        ipif_get_linklocal(&ipif->ipif_v6lcl_addr, &ill->ill_token);
        sctp_update_ipif_addr(ipif, ov6addr);
        (void) ip_plen_to_mask_v6(IPV6_LL_PREFIXLEN, &ipif->ipif_v6net_mask);
        if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6pp_dst_addr)) {
                V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
                    ipif->ipif_v6subnet);
        }

        ip_rts_newaddrmsg(RTM_CHGADDR, 0, ipif, RTSQ_DEFAULT);
}

/*
 * Generate a destination link-local address for a point-to-point IPv6
 * interface with a destination interface id (IP tunnels are such interfaces)
 * based on the destination token.
 */
void
ipif_setdestlinklocal(ipif_t *ipif)
{
        ill_t   *ill = ipif->ipif_ill;

        ASSERT(IAM_WRITER_ILL(ill));

        if (ill->ill_manual_dst_linklocal)
                return;

        if (IN6_IS_ADDR_UNSPECIFIED(&ill->ill_dest_token))
                return;

        ipif_get_linklocal(&ipif->ipif_v6pp_dst_addr, &ill->ill_dest_token);
        ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr;
}

/*
 * Get the resolver set up for a new ipif.  (Always called as writer.)
 */
int
ipif_ndp_up(ipif_t *ipif, boolean_t initial)
{
        ill_t           *ill = ipif->ipif_ill;
        int             err = 0;
        nce_t           *nce = NULL;
        boolean_t       added_ipif = B_FALSE;

        DTRACE_PROBE3(ipif__downup, char *, "ipif_ndp_up",
            ill_t *, ill, ipif_t *, ipif);
        ip1dbg(("ipif_ndp_up(%s:%u)\n", ill->ill_name, ipif->ipif_id));

        if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) ||
            (!(ill->ill_net_type & IRE_INTERFACE))) {
                ipif->ipif_addr_ready = 1;
                return (0);
        }

        if ((ipif->ipif_flags & (IPIF_UNNUMBERED|IPIF_NOLOCAL)) == 0) {
                uint16_t        flags;
                uint16_t        state;
                uchar_t         *hw_addr;
                ill_t           *bound_ill;
                ipmp_illgrp_t   *illg = ill->ill_grp;
                uint_t          hw_addr_len;

                flags = NCE_F_MYADDR | NCE_F_NONUD | NCE_F_PUBLISH |
                    NCE_F_AUTHORITY;
                if (ill->ill_flags & ILLF_ROUTER)
                        flags |= NCE_F_ISROUTER;

                if (ipif->ipif_flags & IPIF_ANYCAST)
                        flags |= NCE_F_ANYCAST;

                if (IS_IPMP(ill)) {
                        ASSERT(ill->ill_net_type == IRE_IF_RESOLVER);
                        /*
                         * If we're here via ipif_up(), then the ipif won't be
                         * bound yet -- add it to the group, which will bind
                         * it if possible.  (We would add it in ipif_up(), but
                         * deleting on failure there is gruesome.)  If we're
                         * here via ipmp_ill_bind_ipif(), then the ipif has
                         * already been added to the group and we just need to
                         * use the binding.
                         */
                        if ((bound_ill = ipmp_ipif_bound_ill(ipif)) == NULL) {
                                bound_ill = ipmp_illgrp_add_ipif(illg, ipif);
                                if (bound_ill == NULL) {
                                        /*
                                         * We couldn't bind the ipif to an ill
                                         * yet, so we have nothing to publish.
                                         * Set ipif_addr_ready so that this
                                         * address can be used locally for now.
                                         * The routing socket message will be
                                         * sent from ipif_up_done_v6().
                                         */
                                        ipif->ipif_addr_ready = 1;
                                        return (0);
                                }
                                added_ipif = B_TRUE;
                        }
                        hw_addr = bound_ill->ill_nd_lla;
                        hw_addr_len = bound_ill->ill_phys_addr_length;
                } else {
                        bound_ill = ill;
                        hw_addr = ill->ill_nd_lla;
                        hw_addr_len = ill->ill_phys_addr_length;
                }

                /*
                 * If this is an initial bring-up (or the ipif was never
                 * completely brought up), do DAD.  Otherwise, we're here
                 * because IPMP has rebound an address to this ill: send
                 * unsolicited advertisements to inform others.
                 */
                if (initial || !ipif->ipif_addr_ready) {
                        /* Causes Duplicate Address Detection to run */
                        state = ND_PROBE;
                } else {
                        state = ND_REACHABLE;
                        flags |= NCE_F_UNSOL_ADV;
                }

retry:
                err = nce_lookup_then_add_v6(ill, hw_addr, hw_addr_len,
                    &ipif->ipif_v6lcl_addr, flags, state, &nce);
                switch (err) {
                case 0:
                        ip1dbg(("ipif_ndp_up: NCE created for %s\n",
                            ill->ill_name));
                        ipif->ipif_addr_ready = 1;
                        ipif->ipif_added_nce = 1;
                        nce->nce_ipif_cnt++;
                        break;
                case EINPROGRESS:
                        ip1dbg(("ipif_ndp_up: running DAD now for %s\n",
                            ill->ill_name));
                        ipif->ipif_added_nce = 1;
                        nce->nce_ipif_cnt++;
                        break;
                case EEXIST:
                        ip1dbg(("ipif_ndp_up: NCE already exists for %s\n",
                            ill->ill_name));
                        if (!NCE_MYADDR(nce->nce_common)) {
                                /*
                                 * A leftover nce from before this address
                                 * existed
                                 */
                                ncec_delete(nce->nce_common);
                                nce_refrele(nce);
                                nce = NULL;
                                goto retry;
                        }
                        if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
                                nce_refrele(nce);
                                nce = NULL;
                                ip1dbg(("ipif_ndp_up: NCE already exists "
                                    "for %s\n", ill->ill_name));
                                goto fail;
                        }
                        /*
                         * Duplicate local addresses are permissible for
                         * IPIF_POINTOPOINT interfaces which will get marked
                         * IPIF_UNNUMBERED later in
                         * ip_addr_availability_check().
                         *
                         * The nce_ipif_cnt field tracks the number of
                         * ipifs that have nce_addr as their local address.
                         */
                        ipif->ipif_addr_ready = 1;
                        ipif->ipif_added_nce = 1;
                        nce->nce_ipif_cnt++;
                        err = 0;
                        break;
                default:
                        ip1dbg(("ipif_ndp_up: NCE creation failed for %s\n",
                            ill->ill_name));
                        goto fail;
                }
        } else {
                /* No local NCE for this entry */
                ipif->ipif_addr_ready = 1;
        }
        if (nce != NULL)
                nce_refrele(nce);
        return (0);
fail:
        if (added_ipif)
                ipmp_illgrp_del_ipif(ill->ill_grp, ipif);

        return (err);
}

/* Remove all cache entries for this logical interface */
void
ipif_ndp_down(ipif_t *ipif)
{
        ipif_nce_down(ipif);
}

/*
 * Return the scope of the given IPv6 address.  If the address is an
 * IPv4 mapped IPv6 address, return the scope of the corresponding
 * IPv4 address.
 */
in6addr_scope_t
ip_addr_scope_v6(const in6_addr_t *addr)
{
        static in6_addr_t ipv6loopback = IN6ADDR_LOOPBACK_INIT;

        if (IN6_IS_ADDR_V4MAPPED(addr)) {
                in_addr_t v4addr_h = ntohl(V4_PART_OF_V6((*addr)));
                if ((v4addr_h >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET ||
                    (v4addr_h & IN_AUTOCONF_MASK) == IN_AUTOCONF_NET)
                        return (IP6_SCOPE_LINKLOCAL);
                if ((v4addr_h & IN_PRIVATE8_MASK) == IN_PRIVATE8_NET ||
                    (v4addr_h & IN_PRIVATE12_MASK) == IN_PRIVATE12_NET ||
                    (v4addr_h & IN_PRIVATE16_MASK) == IN_PRIVATE16_NET)
                        return (IP6_SCOPE_SITELOCAL);
                return (IP6_SCOPE_GLOBAL);
        }

        if (IN6_IS_ADDR_MULTICAST(addr))
                return (IN6_ADDR_MC_SCOPE(addr));

        /* link-local and loopback addresses are of link-local scope */
        if (IN6_IS_ADDR_LINKLOCAL(addr) ||
            IN6_ARE_ADDR_EQUAL(addr, &ipv6loopback))
                return (IP6_SCOPE_LINKLOCAL);
        if (IN6_IS_ADDR_SITELOCAL(addr))
                return (IP6_SCOPE_SITELOCAL);
        return (IP6_SCOPE_GLOBAL);
}


/*
 * Returns the length of the common prefix of a1 and a2, as per
 * CommonPrefixLen() defined in RFC 3484.
 */
static int
ip_common_prefix_v6(const in6_addr_t *a1, const in6_addr_t *a2)
{
        int i;
        uint32_t a1val, a2val, mask;

        for (i = 0; i < 4; i++) {
                if ((a1val = a1->s6_addr32[i]) != (a2val = a2->s6_addr32[i])) {
                        a1val ^= a2val;
                        i *= 32;
                        mask = 0x80000000u;
                        while (!(a1val & mask)) {
                                mask >>= 1;
                                i++;
                        }
                        return (i);
                }
        }
        return (IPV6_ABITS);
}

#define IPIF_VALID_IPV6_SOURCE(ipif) \
        (((ipif)->ipif_flags & IPIF_UP) && \
        !((ipif)->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST)) && \
        !((ipif)->ipif_ill->ill_flags & ILLF_NOACCEPT))

/* source address candidate */
typedef struct candidate {
        ipif_t          *cand_ipif;
        /* The properties of this candidate */
        boolean_t       cand_isdst;
        boolean_t       cand_isdst_set;
        in6addr_scope_t cand_scope;
        boolean_t       cand_scope_set;
        boolean_t       cand_isdeprecated;
        boolean_t       cand_isdeprecated_set;
        boolean_t       cand_ispreferred;
        boolean_t       cand_ispreferred_set;
        boolean_t       cand_matchedinterface;
        boolean_t       cand_matchedinterface_set;
        boolean_t       cand_matchedlabel;
        boolean_t       cand_matchedlabel_set;
        boolean_t       cand_istmp;
        boolean_t       cand_istmp_set;
        int             cand_common_pref;
        boolean_t       cand_common_pref_set;
        boolean_t       cand_pref_eq;
        boolean_t       cand_pref_eq_set;
        int             cand_pref_len;
        boolean_t       cand_pref_len_set;
} cand_t;
#define cand_srcaddr    cand_ipif->ipif_v6lcl_addr
#define cand_mask       cand_ipif->ipif_v6net_mask
#define cand_flags      cand_ipif->ipif_flags
#define cand_ill        cand_ipif->ipif_ill
#define cand_zoneid     cand_ipif->ipif_zoneid

/* information about the destination for source address selection */
typedef struct dstinfo {
        const in6_addr_t        *dst_addr;
        ill_t                   *dst_ill;
        uint_t                  dst_restrict_ill;
        boolean_t               dst_prefer_src_tmp;
        in6addr_scope_t         dst_scope;
        char                    *dst_label;
} dstinfo_t;

/*
 * The following functions are rules used to select a source address in
 * ipif_select_source_v6().  Each rule compares a current candidate (cc)
 * against the best candidate (bc).  Each rule has three possible outcomes;
 * the candidate is preferred over the best candidate (CAND_PREFER), the
 * candidate is not preferred over the best candidate (CAND_AVOID), or the
 * candidate is of equal value as the best candidate (CAND_TIE).
 *
 * These rules are part of a greater "Default Address Selection for IPv6"
 * sheme, which is standards based work coming out of the IETF ipv6 working
 * group.  The IETF document defines both IPv6 source address selection and
 * destination address ordering.  The rules defined here implement the IPv6
 * source address selection.  Destination address ordering is done by
 * libnsl, and uses a similar set of rules to implement the sorting.
 *
 * Most of the rules are defined by the RFC and are not typically altered.  The
 * last rule, number 8, has language that allows for local preferences.  In the
 * scheme below, this means that new Solaris rules should normally go between
 * rule_ifprefix and rule_prefix.
 */
typedef enum {CAND_AVOID, CAND_TIE, CAND_PREFER} rule_res_t;
typedef rule_res_t (*rulef_t)(cand_t *, cand_t *, const dstinfo_t *,
    ip_stack_t *);

/* Prefer an address if it is equal to the destination address. */
/* ARGSUSED3 */
static rule_res_t
rule_isdst(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst)
{
        if (!bc->cand_isdst_set) {
                bc->cand_isdst =
                    IN6_ARE_ADDR_EQUAL(&bc->cand_srcaddr, dstinfo->dst_addr);
                bc->cand_isdst_set = B_TRUE;
        }

        cc->cand_isdst =
            IN6_ARE_ADDR_EQUAL(&cc->cand_srcaddr, dstinfo->dst_addr);
        cc->cand_isdst_set = B_TRUE;

        if (cc->cand_isdst == bc->cand_isdst)
                return (CAND_TIE);
        else if (cc->cand_isdst)
                return (CAND_PREFER);
        else
                return (CAND_AVOID);
}

/*
 * Prefer addresses that are of closest scope to the destination.  Always
 * prefer addresses that are of greater scope than the destination over
 * those that are of lesser scope than the destination.
 */
/* ARGSUSED3 */
static rule_res_t
rule_scope(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst)
{
        if (!bc->cand_scope_set) {
                bc->cand_scope = ip_addr_scope_v6(&bc->cand_srcaddr);
                bc->cand_scope_set = B_TRUE;
        }

        cc->cand_scope = ip_addr_scope_v6(&cc->cand_srcaddr);
        cc->cand_scope_set = B_TRUE;

        if (cc->cand_scope < bc->cand_scope) {
                if (cc->cand_scope < dstinfo->dst_scope)
                        return (CAND_AVOID);
                else
                        return (CAND_PREFER);
        } else if (bc->cand_scope < cc->cand_scope) {
                if (bc->cand_scope < dstinfo->dst_scope)
                        return (CAND_PREFER);
                else
                        return (CAND_AVOID);
        } else {
                return (CAND_TIE);
        }
}

/*
 * Prefer non-deprecated source addresses.
 */
/* ARGSUSED2 */
static rule_res_t
rule_deprecated(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo,
    ip_stack_t *ipst)
{
        if (!bc->cand_isdeprecated_set) {
                bc->cand_isdeprecated =
                    ((bc->cand_flags & IPIF_DEPRECATED) != 0);
                bc->cand_isdeprecated_set = B_TRUE;
        }

        cc->cand_isdeprecated = ((cc->cand_flags & IPIF_DEPRECATED) != 0);
        cc->cand_isdeprecated_set = B_TRUE;

        if (bc->cand_isdeprecated == cc->cand_isdeprecated)
                return (CAND_TIE);
        else if (cc->cand_isdeprecated)
                return (CAND_AVOID);
        else
                return (CAND_PREFER);
}

/*
 * Prefer source addresses that have the IPIF_PREFERRED flag set.  This
 * rule must be before rule_interface because the flag could be set on any
 * interface, not just the interface being used for outgoing packets (for
 * example, the IFF_PREFERRED could be set on an address assigned to the
 * loopback interface).
 */
/* ARGSUSED2 */
static rule_res_t
rule_preferred(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo,
    ip_stack_t *ipst)
{
        if (!bc->cand_ispreferred_set) {
                bc->cand_ispreferred = ((bc->cand_flags & IPIF_PREFERRED) != 0);
                bc->cand_ispreferred_set = B_TRUE;
        }

        cc->cand_ispreferred = ((cc->cand_flags & IPIF_PREFERRED) != 0);
        cc->cand_ispreferred_set = B_TRUE;

        if (bc->cand_ispreferred == cc->cand_ispreferred)
                return (CAND_TIE);
        else if (cc->cand_ispreferred)
                return (CAND_PREFER);
        else
                return (CAND_AVOID);
}

/*
 * Prefer source addresses that are assigned to the outgoing interface.
 */
/* ARGSUSED3 */
static rule_res_t
rule_interface(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo,
    ip_stack_t *ipst)
{
        ill_t *dstill = dstinfo->dst_ill;

        /*
         * If dstinfo->dst_restrict_ill is set, this rule is unnecessary
         * since we know all candidates will be on the same link.
         */
        if (dstinfo->dst_restrict_ill)
                return (CAND_TIE);

        if (!bc->cand_matchedinterface_set) {
                bc->cand_matchedinterface = bc->cand_ill == dstill;
                bc->cand_matchedinterface_set = B_TRUE;
        }

        cc->cand_matchedinterface = cc->cand_ill == dstill;
        cc->cand_matchedinterface_set = B_TRUE;

        if (bc->cand_matchedinterface == cc->cand_matchedinterface)
                return (CAND_TIE);
        else if (cc->cand_matchedinterface)
                return (CAND_PREFER);
        else
                return (CAND_AVOID);
}

/*
 * Prefer source addresses whose label matches the destination's label.
 */
static rule_res_t
rule_label(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst)
{
        char *label;

        if (!bc->cand_matchedlabel_set) {
                label = ip6_asp_lookup(&bc->cand_srcaddr, NULL, ipst);
                bc->cand_matchedlabel =
                    ip6_asp_labelcmp(label, dstinfo->dst_label);
                bc->cand_matchedlabel_set = B_TRUE;
        }

        label = ip6_asp_lookup(&cc->cand_srcaddr, NULL, ipst);
        cc->cand_matchedlabel = ip6_asp_labelcmp(label, dstinfo->dst_label);
        cc->cand_matchedlabel_set = B_TRUE;

        if (bc->cand_matchedlabel == cc->cand_matchedlabel)
                return (CAND_TIE);
        else if (cc->cand_matchedlabel)
                return (CAND_PREFER);
        else
                return (CAND_AVOID);
}

/*
 * Prefer public addresses over temporary ones.  An application can reverse
 * the logic of this rule and prefer temporary addresses by using the
 * IPV6_SRC_PREFERENCES socket option.
 */
/* ARGSUSED3 */
static rule_res_t
rule_temporary(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo,
    ip_stack_t *ipst)
{
        if (!bc->cand_istmp_set) {
                bc->cand_istmp = ((bc->cand_flags & IPIF_TEMPORARY) != 0);
                bc->cand_istmp_set = B_TRUE;
        }

        cc->cand_istmp = ((cc->cand_flags & IPIF_TEMPORARY) != 0);
        cc->cand_istmp_set = B_TRUE;

        if (bc->cand_istmp == cc->cand_istmp)
                return (CAND_TIE);

        if (dstinfo->dst_prefer_src_tmp && cc->cand_istmp)
                return (CAND_PREFER);
        else if (!dstinfo->dst_prefer_src_tmp && !cc->cand_istmp)
                return (CAND_PREFER);
        else
                return (CAND_AVOID);
}

/*
 * Prefer source addresses with longer matching prefix with the destination
 * under the interface mask.  This gets us on the same subnet before applying
 * any Solaris-specific rules.
 */
/* ARGSUSED3 */
static rule_res_t
rule_ifprefix(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo,
    ip_stack_t *ipst)
{
        if (!bc->cand_pref_eq_set) {
                bc->cand_pref_eq = V6_MASK_EQ_2(bc->cand_srcaddr,
                    bc->cand_mask, *dstinfo->dst_addr);
                bc->cand_pref_eq_set = B_TRUE;
        }

        cc->cand_pref_eq = V6_MASK_EQ_2(cc->cand_srcaddr, cc->cand_mask,
            *dstinfo->dst_addr);
        cc->cand_pref_eq_set = B_TRUE;

        if (bc->cand_pref_eq) {
                if (cc->cand_pref_eq) {
                        if (!bc->cand_pref_len_set) {
                                bc->cand_pref_len =
                                    ip_mask_to_plen_v6(&bc->cand_mask);
                                bc->cand_pref_len_set = B_TRUE;
                        }
                        cc->cand_pref_len = ip_mask_to_plen_v6(&cc->cand_mask);
                        cc->cand_pref_len_set = B_TRUE;
                        if (bc->cand_pref_len == cc->cand_pref_len)
                                return (CAND_TIE);
                        else if (bc->cand_pref_len > cc->cand_pref_len)
                                return (CAND_AVOID);
                        else
                                return (CAND_PREFER);
                } else {
                        return (CAND_AVOID);
                }
        } else {
                if (cc->cand_pref_eq)
                        return (CAND_PREFER);
                else
                        return (CAND_TIE);
        }
}

/*
 * Prefer to use zone-specific addresses when possible instead of all-zones
 * addresses.
 */
/* ARGSUSED2 */
static rule_res_t
rule_zone_specific(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo,
    ip_stack_t *ipst)
{
        if ((bc->cand_zoneid == ALL_ZONES) ==
            (cc->cand_zoneid == ALL_ZONES))
                return (CAND_TIE);
        else if (cc->cand_zoneid == ALL_ZONES)
                return (CAND_AVOID);
        else
                return (CAND_PREFER);
}

/*
 * Prefer to use DHCPv6 (first) and static addresses (second) when possible
 * instead of statelessly autoconfigured addresses.
 *
 * This is done after trying all other preferences (and before the final tie
 * breaker) so that, if all else is equal, we select addresses configured by
 * DHCPv6 over other addresses.  We presume that DHCPv6 addresses, unlike
 * stateless autoconfigured addresses, are deliberately configured by an
 * administrator, and thus are correctly set up in DNS and network packet
 * filters.
 */
/* ARGSUSED2 */
static rule_res_t
rule_addr_type(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo,
    ip_stack_t *ipst)
{
#define ATYPE(x)        \
        ((x) & IPIF_DHCPRUNNING) ? 1 : ((x) & IPIF_ADDRCONF) ? 3 : 2
        int bcval = ATYPE(bc->cand_flags);
        int ccval = ATYPE(cc->cand_flags);
#undef ATYPE

        if (bcval == ccval)
                return (CAND_TIE);
        else if (ccval < bcval)
                return (CAND_PREFER);
        else
                return (CAND_AVOID);
}

/*
 * Prefer source addresses with longer matching prefix with the destination.
 * We do the longest matching prefix calculation by doing an xor of both
 * addresses with the destination, and pick the address with the longest string
 * of leading zeros, as per CommonPrefixLen() defined in RFC 3484.
 */
/* ARGSUSED3 */
static rule_res_t
rule_prefix(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst)
{
        if (!bc->cand_common_pref_set) {
                bc->cand_common_pref = ip_common_prefix_v6(&bc->cand_srcaddr,
                    dstinfo->dst_addr);
                bc->cand_common_pref_set = B_TRUE;
        }

        cc->cand_common_pref = ip_common_prefix_v6(&cc->cand_srcaddr,
            dstinfo->dst_addr);
        cc->cand_common_pref_set = B_TRUE;

        if (bc->cand_common_pref == cc->cand_common_pref)
                return (CAND_TIE);
        else if (bc->cand_common_pref > cc->cand_common_pref)
                return (CAND_AVOID);
        else
                return (CAND_PREFER);
}

/*
 * Last rule: we must pick something, so just prefer the current best
 * candidate.
 */
/* ARGSUSED */
static rule_res_t
rule_must_be_last(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo,
    ip_stack_t *ipst)
{
        return (CAND_AVOID);
}

/*
 * Determine the best source address given a destination address and a
 * destination ill.  If no suitable source address is found, it returns
 * NULL. If there is a usable address pointed to by the usesrc
 * (i.e ill_usesrc_ifindex != 0) then return that first since it is more
 * fine grained (i.e per interface)
 *
 * This implementation is based on the "Default Address Selection for IPv6"
 * specification produced by the IETF IPv6 working group.  It has been
 * implemented so that the list of addresses is only traversed once (the
 * specification's algorithm could traverse the list of addresses once for
 * every rule).
 *
 * The restrict_ill argument restricts the algorithm to choose a source
 * address that is assigned to the destination ill.  This is used when
 * the destination address is a link-local or multicast address, and when
 * ipv6_strict_dst_multihoming is turned on.
 *
 * src_prefs is the caller's set of source address preferences.  If source
 * address selection is being called to determine the source address of a
 * connected socket (from ip_set_destination_v6()), then the preferences are
 * taken from conn_ixa->ixa_src_preferences.  These preferences can be set on a
 * per-socket basis using the IPV6_SRC_PREFERENCES socket option.  The only
 * preference currently implemented is for rfc3041 temporary addresses.
 */
ipif_t *
ipif_select_source_v6(ill_t *dstill, const in6_addr_t *dst,
    boolean_t restrict_ill, uint32_t src_prefs, zoneid_t zoneid,
    boolean_t allow_usesrc, boolean_t *notreadyp)
{
        dstinfo_t       dstinfo;
        char            dstr[INET6_ADDRSTRLEN];
        char            sstr[INET6_ADDRSTRLEN];
        ipif_t          *ipif, *start_ipif, *next_ipif;
        ill_t           *ill, *usesrc_ill = NULL, *ipmp_ill = NULL;
        ill_walk_context_t      ctx;
        cand_t          best_c; /* The best candidate */
        cand_t          curr_c; /* The current candidate */
        uint_t          index;
        boolean_t       first_candidate = B_TRUE;
        rule_res_t      rule_result;
        tsol_tpc_t      *src_rhtp, *dst_rhtp;
        ip_stack_t      *ipst = dstill->ill_ipst;

        /*
         * The list of ordering rules.  They are applied in the order they
         * appear in the list.
         *
         * Solaris doesn't currently support Mobile IPv6, so there's no
         * rule_mipv6 corresponding to rule 4 in the specification.
         */
        rulef_t rules[] = {
                rule_isdst,
                rule_scope,
                rule_deprecated,
                rule_preferred,
                rule_interface,
                rule_label,
                rule_temporary,
                rule_ifprefix,                  /* local rules after this */
                rule_zone_specific,
                rule_addr_type,
                rule_prefix,                    /* local rules before this */
                rule_must_be_last,              /* must always be last */
                NULL
        };

        ASSERT(dstill->ill_isv6);
        ASSERT(!IN6_IS_ADDR_V4MAPPED(dst));

        /*
         * Check if there is a usable src address pointed to by the
         * usesrc ifindex. This has higher precedence since it is
         * finer grained (i.e per interface) v/s being system wide.
         */
        if (dstill->ill_usesrc_ifindex != 0 && allow_usesrc) {
                if ((usesrc_ill =
                    ill_lookup_on_ifindex(dstill->ill_usesrc_ifindex, B_TRUE,
                    ipst)) != NULL) {
                        dstinfo.dst_ill = usesrc_ill;
                } else {
                        return (NULL);
                }
        } else if (IS_UNDER_IPMP(dstill)) {
                /*
                 * Test addresses should never be used for source address
                 * selection, so if we were passed an underlying ill, switch
                 * to the IPMP meta-interface.
                 */
                if ((ipmp_ill = ipmp_ill_hold_ipmp_ill(dstill)) != NULL)
                        dstinfo.dst_ill = ipmp_ill;
                else
                        return (NULL);
        } else {
                dstinfo.dst_ill = dstill;
        }

        /*
         * If we're dealing with an unlabeled destination on a labeled system,
         * make sure that we ignore source addresses that are incompatible with
         * the destination's default label.  That destination's default label
         * must dominate the minimum label on the source address.
         *
         * (Note that this has to do with Trusted Solaris.  It's not related to
         * the labels described by ip6_asp_lookup.)
         */
        dst_rhtp = NULL;
        if (is_system_labeled()) {
                dst_rhtp = find_tpc(dst, IPV6_VERSION, B_FALSE);
                if (dst_rhtp == NULL)
                        return (NULL);
                if (dst_rhtp->tpc_tp.host_type != UNLABELED) {
                        TPC_RELE(dst_rhtp);
                        dst_rhtp = NULL;
                }
        }

        dstinfo.dst_addr = dst;
        dstinfo.dst_scope = ip_addr_scope_v6(dst);
        dstinfo.dst_label = ip6_asp_lookup(dst, NULL, ipst);
        dstinfo.dst_prefer_src_tmp = ((src_prefs & IPV6_PREFER_SRC_TMP) != 0);
        rw_enter(&ipst->ips_ill_g_lock, RW_READER);
        /*
         * Section three of the I-D states that for multicast and
         * link-local destinations, the candidate set must be restricted to
         * an interface that is on the same link as the outgoing interface.
         * Also, when ipv6_strict_dst_multihoming is turned on, always
         * restrict the source address to the destination link as doing
         * otherwise will almost certainly cause problems.
         */
        if (IN6_IS_ADDR_LINKLOCAL(dst) || IN6_IS_ADDR_MULTICAST(dst) ||
            ipst->ips_ipv6_strict_dst_multihoming || usesrc_ill != NULL) {
                dstinfo.dst_restrict_ill = B_TRUE;
        } else {
                dstinfo.dst_restrict_ill = restrict_ill;
        }

        bzero(&best_c, sizeof (cand_t));

        /*
         * Take a pass through the list of IPv6 interfaces to choose the best
         * possible source address.  If restrict_ill is set, just use dst_ill.
         */
        if (dstinfo.dst_restrict_ill)
                ill = dstinfo.dst_ill;
        else
                ill = ILL_START_WALK_V6(&ctx, ipst);

        for (; ill != NULL; ill = ill_next(&ctx, ill)) {
                ASSERT(ill->ill_isv6);

                /*
                 * Test addresses should never be used for source address
                 * selection, so ignore underlying ills.
                 */
                if (IS_UNDER_IPMP(ill))
                        continue;

                if (ill->ill_ipif == NULL)
                        continue;
                /*
                 * For source address selection, we treat the ipif list as
                 * circular and continue until we get back to where we
                 * started.  This allows IPMP to vary source address selection
                 * (which improves inbound load spreading) by caching its last
                 * ending point and starting from there.  NOTE: we don't have
                 * to worry about ill_src_ipif changing ills since that can't
                 * happen on the IPMP ill.
                 */
                start_ipif = ill->ill_ipif;
                if (IS_IPMP(ill) && ill->ill_src_ipif != NULL)
                        start_ipif = ill->ill_src_ipif;

                ipif = start_ipif;
                do {
                        if ((next_ipif = ipif->ipif_next) == NULL)
                                next_ipif = ill->ill_ipif;

                        if (!IPIF_VALID_IPV6_SOURCE(ipif))
                                continue;

                        if (!ipif->ipif_addr_ready) {
                                if (notreadyp != NULL)
                                        *notreadyp = B_TRUE;
                                continue;
                        }

                        if (zoneid != ALL_ZONES &&
                            ipif->ipif_zoneid != zoneid &&
                            ipif->ipif_zoneid != ALL_ZONES)
                                continue;

                        /*
                         * Check compatibility of local address for
                         * destination's default label if we're on a labeled
                         * system.  Incompatible addresses can't be used at
                         * all and must be skipped over.
                         */
                        if (dst_rhtp != NULL) {
                                boolean_t incompat;

                                src_rhtp = find_tpc(&ipif->ipif_v6lcl_addr,
                                    IPV6_VERSION, B_FALSE);
                                if (src_rhtp == NULL)
                                        continue;
                                incompat =
                                    src_rhtp->tpc_tp.host_type != SUN_CIPSO ||
                                    src_rhtp->tpc_tp.tp_doi !=
                                    dst_rhtp->tpc_tp.tp_doi ||
                                    (!_blinrange(&dst_rhtp->tpc_tp.tp_def_label,
                                    &src_rhtp->tpc_tp.tp_sl_range_cipso) &&
                                    !blinlset(&dst_rhtp->tpc_tp.tp_def_label,
                                    src_rhtp->tpc_tp.tp_sl_set_cipso));
                                TPC_RELE(src_rhtp);
                                if (incompat)
                                        continue;
                        }

                        if (first_candidate) {
                                /*
                                 * This is first valid address in the list.
                                 * It is automatically the best candidate
                                 * so far.
                                 */
                                best_c.cand_ipif = ipif;
                                first_candidate = B_FALSE;
                                continue;
                        }

                        bzero(&curr_c, sizeof (cand_t));
                        curr_c.cand_ipif = ipif;

                        /*
                         * Compare this current candidate (curr_c) with the
                         * best candidate (best_c) by applying the
                         * comparison rules in order until one breaks the
                         * tie.
                         */
                        for (index = 0; rules[index] != NULL; index++) {
                                /* Apply a comparison rule. */
                                rule_result = (rules[index])(&best_c, &curr_c,
                                    &dstinfo, ipst);
                                if (rule_result == CAND_AVOID) {
                                        /*
                                         * The best candidate is still the
                                         * best candidate.  Forget about
                                         * this current candidate and go on
                                         * to the next one.
                                         */
                                        break;
                                } else if (rule_result == CAND_PREFER) {
                                        /*
                                         * This candidate is prefered.  It
                                         * becomes the best candidate so
                                         * far.  Go on to the next address.
                                         */
                                        best_c = curr_c;
                                        break;
                                }
                                /* We have a tie, apply the next rule. */
                        }

                        /*
                         * The last rule must be a tie breaker rule and
                         * must never produce a tie.  At this point, the
                         * candidate should have either been rejected, or
                         * have been prefered as the best candidate so far.
                         */
                        ASSERT(rule_result != CAND_TIE);
                } while ((ipif = next_ipif) != start_ipif);

                /*
                 * For IPMP, update the source ipif rotor to the next ipif,
                 * provided we can look it up.  (We must not use it if it's
                 * IPIF_CONDEMNED since we may have grabbed ill_g_lock after
                 * ipif_free() checked ill_src_ipif.)
                 */
                if (IS_IPMP(ill) && ipif != NULL) {
                        mutex_enter(&ipif->ipif_ill->ill_lock);
                        next_ipif = ipif->ipif_next;
                        if (next_ipif != NULL && !IPIF_IS_CONDEMNED(next_ipif))
                                ill->ill_src_ipif = next_ipif;
                        else
                                ill->ill_src_ipif = NULL;
                        mutex_exit(&ipif->ipif_ill->ill_lock);
                }

                /*
                 * Only one ill to consider if dst_restrict_ill is set.
                 */
                if (dstinfo.dst_restrict_ill)
                        break;
        }

        ipif = best_c.cand_ipif;
        ip1dbg(("ipif_select_source_v6(%s, %s) -> %s\n",
            dstinfo.dst_ill->ill_name,
            inet_ntop(AF_INET6, dstinfo.dst_addr, dstr, sizeof (dstr)),
            (ipif == NULL ? "NULL" :
            inet_ntop(AF_INET6, &ipif->ipif_v6lcl_addr, sstr, sizeof (sstr)))));

        if (usesrc_ill != NULL)
                ill_refrele(usesrc_ill);

        if (ipmp_ill != NULL)
                ill_refrele(ipmp_ill);

        if (dst_rhtp != NULL)
                TPC_RELE(dst_rhtp);

        if (ipif == NULL) {
                rw_exit(&ipst->ips_ill_g_lock);
                return (NULL);
        }

        mutex_enter(&ipif->ipif_ill->ill_lock);
        if (!IPIF_IS_CONDEMNED(ipif)) {
                ipif_refhold_locked(ipif);
                mutex_exit(&ipif->ipif_ill->ill_lock);
                rw_exit(&ipst->ips_ill_g_lock);
                return (ipif);
        }
        mutex_exit(&ipif->ipif_ill->ill_lock);
        rw_exit(&ipst->ips_ill_g_lock);
        ip1dbg(("ipif_select_source_v6 cannot lookup ipif %p"
            " returning null \n", (void *)ipif));

        return (NULL);
}

/*
 * Pick a source address based on the destination ill and an optional setsrc
 * address.
 * The result is stored in srcp. If generation is set, then put the source
 * generation number there before we look for the source address (to avoid
 * missing changes in the set of source addresses.
 * If flagsp is set, then us it to pass back ipif_flags.
 *
 * If the caller wants to cache the returned source address and detect when
 * that might be stale, the caller should pass in a generation argument,
 * which the caller can later compare against ips_src_generation
 *
 * The precedence order for selecting an IPv6 source address is:
 *  - RTF_SETSRC on the first ire in the recursive lookup always wins.
 *  - If usrsrc is set, swap the ill to be the usesrc one.
 *  - If IPMP is used on the ill, select a random address from the most
 *    preferred ones below:
 * That is followed by the long list of IPv6 source address selection rules
 * starting with rule_isdst(), rule_scope(), etc.
 *
 * We have lower preference for ALL_ZONES IP addresses,
 * as they pose problems with unlabeled destinations.
 *
 * Note that when multiple IP addresses match e.g., with rule_scope() we pick
 * the first one if IPMP is not in use. With IPMP we randomize.
 */
int
ip_select_source_v6(ill_t *ill, const in6_addr_t *setsrc, const in6_addr_t *dst,
    zoneid_t zoneid, ip_stack_t *ipst, uint_t restrict_ill, uint32_t src_prefs,
    in6_addr_t *srcp, uint32_t *generation, uint64_t *flagsp)
{
        ipif_t *ipif;
        boolean_t notready = B_FALSE;   /* Set if !ipif_addr_ready found */

        if (flagsp != NULL)
                *flagsp = 0;

        /*
         * Need to grab the generation number before we check to
         * avoid a race with a change to the set of local addresses.
         * No lock needed since the thread which updates the set of local
         * addresses use ipif/ill locks and exit those (hence a store memory
         * barrier) before doing the atomic increase of ips_src_generation.
         */
        if (generation != NULL) {
                *generation = ipst->ips_src_generation;
        }

        /* Was RTF_SETSRC set on the first IRE in the recursive lookup? */
        if (setsrc != NULL && !IN6_IS_ADDR_UNSPECIFIED(setsrc)) {
                *srcp = *setsrc;
                return (0);
        }

        ipif = ipif_select_source_v6(ill, dst, restrict_ill, src_prefs, zoneid,
            B_TRUE, &notready);
        if (ipif == NULL) {
                if (notready)
                        return (ENETDOWN);
                else
                        return (EADDRNOTAVAIL);
        }
        *srcp = ipif->ipif_v6lcl_addr;
        if (flagsp != NULL)
                *flagsp = ipif->ipif_flags;
        ipif_refrele(ipif);
        return (0);
}

/*
 * Perform an attach and bind to get phys addr plus info_req for
 * the physical device.
 * q and mp represents an ioctl which will be queued waiting for
 * completion of the DLPI message exchange.
 * MUST be called on an ill queue.
 *
 * Returns EINPROGRESS when mp has been consumed by queueing it.
 * The ioctl will complete in ip_rput.
 */
int
ill_dl_phys(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q)
{
        mblk_t  *v6token_mp = NULL;
        mblk_t  *v6lla_mp = NULL;
        mblk_t  *dest_mp = NULL;
        mblk_t  *phys_mp = NULL;
        mblk_t  *info_mp = NULL;
        mblk_t  *attach_mp = NULL;
        mblk_t  *bind_mp = NULL;
        mblk_t  *unbind_mp = NULL;
        mblk_t  *notify_mp = NULL;
        mblk_t  *capab_mp = NULL;

        ip1dbg(("ill_dl_phys(%s:%u)\n", ill->ill_name, ipif->ipif_id));
        ASSERT(ill->ill_dlpi_style_set);
        ASSERT(WR(q)->q_next != NULL);

        if (ill->ill_isv6) {
                v6token_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) +
                    sizeof (t_scalar_t), DL_PHYS_ADDR_REQ);
                if (v6token_mp == NULL)
                        goto bad;
                ((dl_phys_addr_req_t *)v6token_mp->b_rptr)->dl_addr_type =
                    DL_IPV6_TOKEN;

                v6lla_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) +
                    sizeof (t_scalar_t), DL_PHYS_ADDR_REQ);
                if (v6lla_mp == NULL)
                        goto bad;
                ((dl_phys_addr_req_t *)v6lla_mp->b_rptr)->dl_addr_type =
                    DL_IPV6_LINK_LAYER_ADDR;
        }

        if (ill->ill_mactype == DL_IPV4 || ill->ill_mactype == DL_IPV6) {
                dest_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) +
                    sizeof (t_scalar_t), DL_PHYS_ADDR_REQ);
                if (dest_mp == NULL)
                        goto bad;
                ((dl_phys_addr_req_t *)dest_mp->b_rptr)->dl_addr_type =
                    DL_CURR_DEST_ADDR;
        }

        /*
         * Allocate a DL_NOTIFY_REQ and set the notifications we want.
         */
        notify_mp = ip_dlpi_alloc(sizeof (dl_notify_req_t) + sizeof (long),
            DL_NOTIFY_REQ);
        if (notify_mp == NULL)
                goto bad;
        ((dl_notify_req_t *)notify_mp->b_rptr)->dl_notifications =
            (DL_NOTE_PHYS_ADDR | DL_NOTE_SDU_SIZE | DL_NOTE_FASTPATH_FLUSH |
            DL_NOTE_LINK_UP | DL_NOTE_LINK_DOWN | DL_NOTE_CAPAB_RENEG |
            DL_NOTE_PROMISC_ON_PHYS | DL_NOTE_PROMISC_OFF_PHYS |
            DL_NOTE_REPLUMB | DL_NOTE_ALLOWED_IPS | DL_NOTE_SDU_SIZE2);

        phys_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) +
            sizeof (t_scalar_t), DL_PHYS_ADDR_REQ);
        if (phys_mp == NULL)
                goto bad;
        ((dl_phys_addr_req_t *)phys_mp->b_rptr)->dl_addr_type =
            DL_CURR_PHYS_ADDR;

        info_mp = ip_dlpi_alloc(
            sizeof (dl_info_req_t) + sizeof (dl_info_ack_t),
            DL_INFO_REQ);
        if (info_mp == NULL)
                goto bad;

        ASSERT(ill->ill_dlpi_capab_state == IDCS_UNKNOWN);
        capab_mp = ip_dlpi_alloc(sizeof (dl_capability_req_t),
            DL_CAPABILITY_REQ);
        if (capab_mp == NULL)
                goto bad;

        bind_mp = ip_dlpi_alloc(sizeof (dl_bind_req_t) + sizeof (long),
            DL_BIND_REQ);
        if (bind_mp == NULL)
                goto bad;
        ((dl_bind_req_t *)bind_mp->b_rptr)->dl_sap = ill->ill_sap;
        ((dl_bind_req_t *)bind_mp->b_rptr)->dl_service_mode = DL_CLDLS;

        unbind_mp = ip_dlpi_alloc(sizeof (dl_unbind_req_t), DL_UNBIND_REQ);
        if (unbind_mp == NULL)
                goto bad;

        /* If we need to attach, pre-alloc and initialize the mblk */
        if (ill->ill_needs_attach) {
                attach_mp = ip_dlpi_alloc(sizeof (dl_attach_req_t),
                    DL_ATTACH_REQ);
                if (attach_mp == NULL)
                        goto bad;
                ((dl_attach_req_t *)attach_mp->b_rptr)->dl_ppa = ill->ill_ppa;
        }

        /*
         * Here we are going to delay the ioctl ack until after
         * ACKs from DL_PHYS_ADDR_REQ. So need to save the
         * original ioctl message before sending the requests
         */
        mutex_enter(&ill->ill_lock);
        /* ipsq_pending_mp_add won't fail since we pass in a NULL connp */
        (void) ipsq_pending_mp_add(NULL, ipif, ill->ill_wq, mp, 0);
        /*
         * Set ill_phys_addr_pend to zero. It will be set to the addr_type of
         * the DL_PHYS_ADDR_REQ in ill_dlpi_send() and ill_dlpi_done(). It will
         * be used to track which DL_PHYS_ADDR_REQ is being ACK'd/NAK'd.
         */
        ill->ill_phys_addr_pend = 0;
        mutex_exit(&ill->ill_lock);

        if (attach_mp != NULL) {
                ip1dbg(("ill_dl_phys: attach\n"));
                ill_dlpi_send(ill, attach_mp);
        }
        ill_dlpi_send(ill, bind_mp);
        ill_dlpi_send(ill, info_mp);

        /*
         * Send the capability request to get the VRRP capability information.
         */
        ill_capability_send(ill, capab_mp);

        if (v6token_mp != NULL)
                ill_dlpi_send(ill, v6token_mp);
        if (v6lla_mp != NULL)
                ill_dlpi_send(ill, v6lla_mp);
        if (dest_mp != NULL)
                ill_dlpi_send(ill, dest_mp);
        ill_dlpi_send(ill, phys_mp);
        ill_dlpi_send(ill, notify_mp);
        ill_dlpi_send(ill, unbind_mp);

        /*
         * This operation will complete in ip_rput_dlpi_writer with either
         * a DL_PHYS_ADDR_ACK or DL_ERROR_ACK.
         */
        return (EINPROGRESS);
bad:
        freemsg(v6token_mp);
        freemsg(v6lla_mp);
        freemsg(dest_mp);
        freemsg(phys_mp);
        freemsg(info_mp);
        freemsg(attach_mp);
        freemsg(bind_mp);
        freemsg(capab_mp);
        freemsg(unbind_mp);
        freemsg(notify_mp);
        return (ENOMEM);
}

/* Add room for tcp+ip headers */
uint_t ip_loopback_mtu_v6plus = IP_LOOPBACK_MTU + IPV6_HDR_LEN + 20;

/*
 * DLPI is up.
 * Create all the IREs associated with an interface bring up multicast.
 * Set the interface flag and finish other initialization
 * that potentially had to be differed to after DL_BIND_ACK.
 */
int
ipif_up_done_v6(ipif_t *ipif)
{
        ill_t   *ill = ipif->ipif_ill;
        int     err;
        boolean_t loopback = B_FALSE;

        ip1dbg(("ipif_up_done_v6(%s:%u)\n",
            ipif->ipif_ill->ill_name, ipif->ipif_id));
        DTRACE_PROBE3(ipif__downup, char *, "ipif_up_done_v6",
            ill_t *, ill, ipif_t *, ipif);

        /* Check if this is a loopback interface */
        if (ipif->ipif_ill->ill_wq == NULL)
                loopback = B_TRUE;

        ASSERT(ipif->ipif_isv6);
        ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock));

        if (IS_LOOPBACK(ill) || ill->ill_net_type == IRE_IF_NORESOLVER) {
                nce_t *loop_nce = NULL;
                uint16_t flags = (NCE_F_MYADDR | NCE_F_NONUD | NCE_F_AUTHORITY);

                /*
                 * lo0:1 and subsequent ipifs were marked IRE_LOCAL in
                 * ipif_lookup_on_name(), but in the case of zones we can have
                 * several loopback addresses on lo0. So all the interfaces with
                 * loopback addresses need to be marked IRE_LOOPBACK.
                 */
                if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr, &ipv6_loopback))
                        ipif->ipif_ire_type = IRE_LOOPBACK;
                else
                        ipif->ipif_ire_type = IRE_LOCAL;
                if (ill->ill_net_type != IRE_LOOPBACK)
                        flags |= NCE_F_PUBLISH;
                err = nce_lookup_then_add_v6(ill, NULL,
                    ill->ill_phys_addr_length,
                    &ipif->ipif_v6lcl_addr, flags, ND_REACHABLE, &loop_nce);

                /* A shared-IP zone sees EEXIST for lo0:N */
                if (err == 0 || err == EEXIST) {
                        ipif->ipif_added_nce = 1;
                        loop_nce->nce_ipif_cnt++;
                        nce_refrele(loop_nce);
                        err = 0;
                } else {
                        ASSERT(loop_nce == NULL);
                        return (err);
                }
        }

        err = ipif_add_ires_v6(ipif, loopback);
        if (err != 0) {
                /*
                 * See comments about return value from
                 * ipif_addr_availability_check() in ipif_add_ires_v6().
                 */
                if (err != EADDRINUSE) {
                        ipif_ndp_down(ipif);
                } else {
                        /*
                         * Make IPMP aware of the deleted ipif so that
                         * the needed ipmp cleanup (e.g., of ipif_bound_ill)
                         * can be completed. Note that we do not want to
                         * destroy the nce that was created on the ipmp_ill
                         * for the active copy of the duplicate address in
                         * use.
                         */
                        if (IS_IPMP(ill))
                                ipmp_illgrp_del_ipif(ill->ill_grp, ipif);
                        err = EADDRNOTAVAIL;
                }
                return (err);
        }

        if (ill->ill_ipif_up_count == 1 && !loopback) {
                /* Recover any additional IREs entries for this ill */
                (void) ill_recover_saved_ire(ill);
        }

        if (ill->ill_need_recover_multicast) {
                /*
                 * Need to recover all multicast memberships in the driver.
                 * This had to be deferred until we had attached.
                 */
                ill_recover_multicast(ill);
        }

        if (ill->ill_ipif_up_count == 1) {
                /*
                 * Since the interface is now up, it may now be active.
                 */
                if (IS_UNDER_IPMP(ill))
                        ipmp_ill_refresh_active(ill);
        }

        /* Join the allhosts multicast address and the solicited node MC */
        ipif_multicast_up(ipif);

        /* Perhaps ilgs should use this ill */
        update_conn_ill(NULL, ill->ill_ipst);

        if (ipif->ipif_addr_ready)
                ipif_up_notify(ipif);

        return (0);
}

/*
 * Add the IREs associated with the ipif.
 * Those MUST be explicitly removed in ipif_delete_ires_v6.
 */
static int
ipif_add_ires_v6(ipif_t *ipif, boolean_t loopback)
{
        ill_t           *ill = ipif->ipif_ill;
        ip_stack_t      *ipst = ill->ill_ipst;
        in6_addr_t      v6addr;
        in6_addr_t      route_mask;
        int             err;
        char            buf[INET6_ADDRSTRLEN];
        ire_t           *ire_local = NULL;      /* LOCAL or LOOPBACK */
        ire_t           *ire_if = NULL;
        in6_addr_t      *gw;

        if (!IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) &&
            !(ipif->ipif_flags & IPIF_NOLOCAL)) {

                /*
                 * If we're on a labeled system then make sure that zone-
                 * private addresses have proper remote host database entries.
                 */
                if (is_system_labeled() &&
                    ipif->ipif_ire_type != IRE_LOOPBACK) {
                        if (ip6opt_ls == 0) {
                                cmn_err(CE_WARN, "IPv6 not enabled "
                                    "via /etc/system");
                                return (EINVAL);
                        }
                        if (!tsol_check_interface_address(ipif))
                                return (EINVAL);
                }

                if (loopback)
                        gw = &ipif->ipif_v6lcl_addr;
                else
                        gw = NULL;

                /* Register the source address for __sin6_src_id */
                err = ip_srcid_insert(&ipif->ipif_v6lcl_addr,
                    ipif->ipif_zoneid, ipst);
                if (err != 0) {
                        ip0dbg(("ipif_add_ires_v6: srcid_insert %d\n", err));
                        return (err);
                }
                /*
                 * If the interface address is set, create the LOCAL
                 * or LOOPBACK IRE.
                 */
                ip1dbg(("ipif_add_ires_v6: creating IRE %d for %s\n",
                    ipif->ipif_ire_type,
                    inet_ntop(AF_INET6, &ipif->ipif_v6lcl_addr,
                    buf, sizeof (buf))));

                ire_local = ire_create_v6(
                    &ipif->ipif_v6lcl_addr,             /* dest address */
                    &ipv6_all_ones,                     /* mask */
                    gw,                                 /* gateway */
                    ipif->ipif_ire_type,                /* LOCAL or LOOPBACK */
                    ipif->ipif_ill,                     /* interface */
                    ipif->ipif_zoneid,
                    ((ipif->ipif_flags & IPIF_PRIVATE) ?
                    RTF_PRIVATE : 0) | RTF_KERNEL,
                    NULL,
                    ipst);
                if (ire_local == NULL) {
                        ip1dbg(("ipif_up_done_v6: NULL ire_local\n"));
                        err = ENOMEM;
                        goto bad;
                }
        }

        /* Set up the IRE_IF_RESOLVER or IRE_IF_NORESOLVER, as appropriate. */
        if (!loopback && !(ipif->ipif_flags & IPIF_NOXMIT) &&
            !(IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet) &&
            IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6net_mask))) {
                /* ipif_v6subnet is ipif_v6pp_dst_addr for pt-pt */
                v6addr = ipif->ipif_v6subnet;

                if (ipif->ipif_flags & IPIF_POINTOPOINT) {
                        route_mask = ipv6_all_ones;
                } else {
                        route_mask = ipif->ipif_v6net_mask;
                }

                ip1dbg(("ipif_add_ires_v6: creating if IRE %d for %s\n",
                    ill->ill_net_type,
                    inet_ntop(AF_INET6, &v6addr, buf, sizeof (buf))));

                ire_if = ire_create_v6(
                    &v6addr,                    /* dest pref */
                    &route_mask,                /* mask */
                    &ipif->ipif_v6lcl_addr,     /* gateway */
                    ill->ill_net_type,          /* IF_[NO]RESOLVER */
                    ipif->ipif_ill,
                    ipif->ipif_zoneid,
                    ((ipif->ipif_flags & IPIF_PRIVATE) ?
                    RTF_PRIVATE : 0) | RTF_KERNEL,
                    NULL,
                    ipst);
                if (ire_if == NULL) {
                        ip1dbg(("ipif_up_done: NULL ire_if\n"));
                        err = ENOMEM;
                        goto bad;
                }
        }

        /*
         * Need to atomically check for IP address availability under
         * ip_addr_avail_lock.  ill_g_lock is held as reader to ensure no new
         * ills or new ipifs can be added while we are checking availability.
         */
        rw_enter(&ipst->ips_ill_g_lock, RW_READER);
        mutex_enter(&ipst->ips_ip_addr_avail_lock);
        ill->ill_ipif_up_count++;
        ipif->ipif_flags |= IPIF_UP;
        err = ip_addr_availability_check(ipif);
        mutex_exit(&ipst->ips_ip_addr_avail_lock);
        rw_exit(&ipst->ips_ill_g_lock);

        if (err != 0) {
                /*
                 * Our address may already be up on the same ill. In this case,
                 * the external resolver entry for our ipif replaced the one for
                 * the other ipif. So we don't want to delete it (otherwise the
                 * other ipif would be unable to send packets).
                 * ip_addr_availability_check() identifies this case for us and
                 * returns EADDRINUSE; Caller must  turn it into EADDRNOTAVAIL
                 * which is the expected error code.
                 *
                 * Note that ipif_ndp_down() will only delete the nce in the
                 * case when the nce_ipif_cnt drops to 0.
                 */
                ill->ill_ipif_up_count--;
                ipif->ipif_flags &= ~IPIF_UP;
                goto bad;
        }

        /*
         * Add in all newly created IREs.
         * We add the IRE_INTERFACE before the IRE_LOCAL to ensure
         * that lookups find the IRE_LOCAL even if the IRE_INTERFACE is
         * a /128 route.
         */
        if (ire_if != NULL) {
                ire_if = ire_add(ire_if);
                if (ire_if == NULL) {
                        err = ENOMEM;
                        goto bad2;
                }
#ifdef DEBUG
                ire_refhold_notr(ire_if);
                ire_refrele(ire_if);
#endif
        }
        if (ire_local != NULL) {
                ire_local = ire_add(ire_local);
                if (ire_local == NULL) {
                        err = ENOMEM;
                        goto bad2;
                }
#ifdef DEBUG
                ire_refhold_notr(ire_local);
                ire_refrele(ire_local);
#endif
        }
        rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
        if (ire_local != NULL)
                ipif->ipif_ire_local = ire_local;
        if (ire_if != NULL)
                ipif->ipif_ire_if = ire_if;
        rw_exit(&ipst->ips_ill_g_lock);
        ire_local = NULL;
        ire_if = NULL;

        if (ipif->ipif_addr_ready)
                ipif_up_notify(ipif);
        return (0);

bad2:
        ill->ill_ipif_up_count--;
        ipif->ipif_flags &= ~IPIF_UP;

bad:
        if (ire_local != NULL)
                ire_delete(ire_local);
        if (ire_if != NULL)
                ire_delete(ire_if);

        rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
        ire_local = ipif->ipif_ire_local;
        ipif->ipif_ire_local = NULL;
        ire_if = ipif->ipif_ire_if;
        ipif->ipif_ire_if = NULL;
        rw_exit(&ipst->ips_ill_g_lock);
        if (ire_local != NULL) {
                ire_delete(ire_local);
                ire_refrele_notr(ire_local);
        }
        if (ire_if != NULL) {
                ire_delete(ire_if);
                ire_refrele_notr(ire_if);
        }
        (void) ip_srcid_remove(&ipif->ipif_v6lcl_addr, ipif->ipif_zoneid, ipst);

        return (err);
}

/* Remove all the IREs created by ipif_add_ires_v6 */
void
ipif_delete_ires_v6(ipif_t *ipif)
{
        ill_t           *ill = ipif->ipif_ill;
        ip_stack_t      *ipst = ill->ill_ipst;
        ire_t           *ire;

        rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
        ire = ipif->ipif_ire_local;
        ipif->ipif_ire_local = NULL;
        rw_exit(&ipst->ips_ill_g_lock);
        if (ire != NULL) {
                /*
                 * Move count to ipif so we don't loose the count due to
                 * a down/up dance.
                 */
                atomic_add_32(&ipif->ipif_ib_pkt_count, ire->ire_ib_pkt_count);

                ire_delete(ire);
                ire_refrele_notr(ire);
        }
        rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
        ire = ipif->ipif_ire_if;
        ipif->ipif_ire_if = NULL;
        rw_exit(&ipst->ips_ill_g_lock);
        if (ire != NULL) {
                ire_delete(ire);
                ire_refrele_notr(ire);
        }
}

/*
 * Delete an ND entry if it exists.
 */
/* ARGSUSED */
int
ip_siocdelndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
    ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
{
        sin6_t          *sin6;
        struct lifreq   *lifr;
        lif_nd_req_t    *lnr;
        ill_t           *ill = ipif->ipif_ill;
        nce_t           *nce;

        lifr = (struct lifreq *)mp->b_cont->b_cont->b_rptr;
        lnr = &lifr->lifr_nd;
        /* Only allow for logical unit zero i.e. not on "le0:17" */
        if (ipif->ipif_id != 0)
                return (EINVAL);

        if (!ipif->ipif_isv6)
                return (EINVAL);

        if (lnr->lnr_addr.ss_family != AF_INET6)
                return (EAFNOSUPPORT);

        sin6 = (sin6_t *)&lnr->lnr_addr;

        /*
         * Since ND mappings must be consistent across an IPMP group, prohibit
         * deleting ND mappings on underlying interfaces.
         * Don't allow deletion of mappings for local addresses.
         */
        if (IS_UNDER_IPMP(ill))
                return (EPERM);

        nce = nce_lookup_v6(ill, &sin6->sin6_addr);
        if (nce == NULL)
                return (ESRCH);

        if (NCE_MYADDR(nce->nce_common)) {
                nce_refrele(nce);
                return (EPERM);
        }

        /*
         * delete the nce_common which will also delete the nces on any
         * under_ill in the case of ipmp.
         */
        ncec_delete(nce->nce_common);
        nce_refrele(nce);
        return (0);
}

/*
 * Return nbr cache info.
 */
/* ARGSUSED */
int
ip_siocqueryndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
    ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
{
        ill_t           *ill = ipif->ipif_ill;
        struct lifreq   *lifr;
        lif_nd_req_t    *lnr;

        lifr = (struct lifreq *)mp->b_cont->b_cont->b_rptr;
        lnr = &lifr->lifr_nd;
        /* Only allow for logical unit zero i.e. not on "le0:17" */
        if (ipif->ipif_id != 0)
                return (EINVAL);

        if (!ipif->ipif_isv6)
                return (EINVAL);

        if (lnr->lnr_addr.ss_family != AF_INET6)
                return (EAFNOSUPPORT);

        if (ill->ill_phys_addr_length > sizeof (lnr->lnr_hdw_addr))
                return (EINVAL);

        return (ndp_query(ill, lnr));
}

/*
 * Perform an update of the nd entry for the specified address.
 */
/* ARGSUSED */
int
ip_siocsetndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
    ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
{
        sin6_t          *sin6;
        ill_t           *ill = ipif->ipif_ill;
        struct  lifreq  *lifr;
        lif_nd_req_t    *lnr;
        ire_t           *ire;

        lifr = (struct lifreq *)mp->b_cont->b_cont->b_rptr;
        lnr = &lifr->lifr_nd;
        /* Only allow for logical unit zero i.e. not on "le0:17" */
        if (ipif->ipif_id != 0)
                return (EINVAL);

        if (!ipif->ipif_isv6)
                return (EINVAL);

        if (lnr->lnr_addr.ss_family != AF_INET6)
                return (EAFNOSUPPORT);

        sin6 = (sin6_t *)&lnr->lnr_addr;

        /*
         * Since ND mappings must be consistent across an IPMP group, prohibit
         * updating ND mappings on underlying interfaces.  Also, since ND
         * mappings for IPMP data addresses are owned by IP itself, prohibit
         * updating them.
         */
        if (IS_UNDER_IPMP(ill))
                return (EPERM);

        if (IS_IPMP(ill)) {
                ire = ire_ftable_lookup_v6(&sin6->sin6_addr, NULL, NULL,
                    IRE_LOCAL, ill, ALL_ZONES, NULL,
                    MATCH_IRE_TYPE | MATCH_IRE_ILL, 0, ill->ill_ipst, NULL);
                if (ire != NULL) {
                        ire_refrele(ire);
                        return (EPERM);
                }
        }

        return (ndp_sioc_update(ill, lnr));
}