xref: /openbsd-src/sys/netinet6/in6.c (revision d13be5d47e4149db2549a9828e244d59dbc43f15)
1 /*	$OpenBSD: in6.c,v 1.93 2011/08/08 13:04:35 bluhm Exp $	*/
2 /*	$KAME: in6.c,v 1.372 2004/06/14 08:14:21 itojun Exp $	*/
3 
4 /*
5  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. Neither the name of the project nor the names of its contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  */
32 
33 /*
34  * Copyright (c) 1982, 1986, 1991, 1993
35  *	The Regents of the University of California.  All rights reserved.
36  *
37  * Redistribution and use in source and binary forms, with or without
38  * modification, are permitted provided that the following conditions
39  * are met:
40  * 1. Redistributions of source code must retain the above copyright
41  *    notice, this list of conditions and the following disclaimer.
42  * 2. Redistributions in binary form must reproduce the above copyright
43  *    notice, this list of conditions and the following disclaimer in the
44  *    documentation and/or other materials provided with the distribution.
45  * 3. Neither the name of the University nor the names of its contributors
46  *    may be used to endorse or promote products derived from this software
47  *    without specific prior written permission.
48  *
49  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
50  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
51  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
52  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
53  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
54  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
55  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
56  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
57  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
58  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
59  * SUCH DAMAGE.
60  *
61  *	@(#)in.c	8.2 (Berkeley) 11/15/93
62  */
63 
64 #include "bridge.h"
65 #include "carp.h"
66 
67 #include <sys/param.h>
68 #include <sys/ioctl.h>
69 #include <sys/errno.h>
70 #include <sys/malloc.h>
71 #include <sys/socket.h>
72 #include <sys/socketvar.h>
73 #include <sys/sockio.h>
74 #include <sys/systm.h>
75 #include <sys/proc.h>
76 #include <sys/time.h>
77 #include <sys/kernel.h>
78 #include <sys/syslog.h>
79 
80 #include <net/if.h>
81 #include <net/if_types.h>
82 #include <net/route.h>
83 #include <net/if_dl.h>
84 
85 #include <netinet/in.h>
86 #include <netinet/in_var.h>
87 #include <netinet/if_ether.h>
88 
89 #include <netinet/ip6.h>
90 #include <netinet6/ip6_var.h>
91 #include <netinet6/nd6.h>
92 #include <netinet6/mld6_var.h>
93 #ifdef MROUTING
94 #include <netinet6/ip6_mroute.h>
95 #endif
96 #include <netinet6/in6_ifattach.h>
97 
98 /* backward compatibility for a while... */
99 #define COMPAT_IN6IFIOCTL
100 
101 /*
102  * Definitions of some constant IP6 addresses.
103  */
104 const struct in6_addr in6addr_any = IN6ADDR_ANY_INIT;
105 const struct in6_addr in6addr_loopback = IN6ADDR_LOOPBACK_INIT;
106 const struct in6_addr in6addr_intfacelocal_allnodes =
107 	IN6ADDR_INTFACELOCAL_ALLNODES_INIT;
108 const struct in6_addr in6addr_linklocal_allnodes =
109 	IN6ADDR_LINKLOCAL_ALLNODES_INIT;
110 
111 const struct in6_addr in6mask0 = IN6MASK0;
112 const struct in6_addr in6mask32 = IN6MASK32;
113 const struct in6_addr in6mask64 = IN6MASK64;
114 const struct in6_addr in6mask96 = IN6MASK96;
115 const struct in6_addr in6mask128 = IN6MASK128;
116 
117 int in6_lifaddr_ioctl(struct socket *, u_long, caddr_t, struct ifnet *,
118 	    struct proc *);
119 int in6_ifinit(struct ifnet *, struct in6_ifaddr *, int);
120 void in6_unlink_ifa(struct in6_ifaddr *, struct ifnet *);
121 void in6_ifloop_request(int, struct ifaddr *);
122 
123 const struct sockaddr_in6 sa6_any = {
124 	sizeof(sa6_any), AF_INET6, 0, 0, IN6ADDR_ANY_INIT, 0
125 };
126 
127 /*
128  * This structure is used to keep track of in6_multi chains which belong to
129  * deleted interface addresses.
130  */
131 static LIST_HEAD(, multi6_kludge) in6_mk; /* XXX BSS initialization */
132 
133 struct multi6_kludge {
134 	LIST_ENTRY(multi6_kludge) mk_entry;
135 	struct ifnet *mk_ifp;
136 	struct in6_multihead mk_head;
137 };
138 
139 /*
140  * Subroutine for in6_ifaddloop() and in6_ifremloop().
141  * This routine does actual work.
142  */
143 void
144 in6_ifloop_request(int cmd, struct ifaddr *ifa)
145 {
146 	struct rt_addrinfo info;
147 	struct sockaddr_in6 lo_sa;
148 	struct sockaddr_in6 all1_sa;
149 	struct rtentry *nrt = NULL;
150 	int e;
151 
152 	bzero(&lo_sa, sizeof(lo_sa));
153 	bzero(&all1_sa, sizeof(all1_sa));
154 	lo_sa.sin6_family = all1_sa.sin6_family = AF_INET6;
155 	lo_sa.sin6_len = all1_sa.sin6_len = sizeof(struct sockaddr_in6);
156 	lo_sa.sin6_addr = in6addr_loopback;
157 	all1_sa.sin6_addr = in6mask128;
158 
159 	/*
160 	 * We specify the address itself as the gateway, and set the
161 	 * RTF_LLINFO flag, so that the corresponding host route would have
162 	 * the flag, and thus applications that assume traditional behavior
163 	 * would be happy.  Note that we assume the caller of the function
164 	 * (probably implicitly) set nd6_rtrequest() to ifa->ifa_rtrequest,
165 	 * which changes the outgoing interface to the loopback interface.
166 	 * XXX only table 0 for now
167 	 */
168 	bzero(&info, sizeof(info));
169 	info.rti_flags = RTF_UP | RTF_HOST | RTF_LLINFO;
170 	info.rti_info[RTAX_DST] = ifa->ifa_addr;
171 	if (cmd != RTM_DELETE)
172 		info.rti_info[RTAX_GATEWAY] = ifa->ifa_addr;
173 	info.rti_info[RTAX_NETMASK] = (struct sockaddr *)&all1_sa;
174 	e = rtrequest1(cmd, &info, RTP_CONNECTED, &nrt, 0);
175 	if (e != 0) {
176 		log(LOG_ERR, "in6_ifloop_request: "
177 		    "%s operation failed for %s (errno=%d)\n",
178 		    cmd == RTM_ADD ? "ADD" : "DELETE",
179 		    ip6_sprintf(&((struct in6_ifaddr *)ifa)->ia_addr.sin6_addr),
180 		    e);
181 	}
182 
183 	/*
184 	 * Make sure rt_ifa be equal to IFA, the second argument of the
185 	 * function.
186 	 * We need this because when we refer to rt_ifa->ia6_flags in
187 	 * ip6_input, we assume that the rt_ifa points to the address instead
188 	 * of the loopback address.
189 	 */
190 	if (cmd == RTM_ADD && nrt && ifa != nrt->rt_ifa) {
191 		IFAFREE(nrt->rt_ifa);
192 		ifa->ifa_refcnt++;
193 		nrt->rt_ifa = ifa;
194 	}
195 
196 	/*
197 	 * Report the addition/removal of the address to the routing socket.
198 	 * XXX: since we called rtinit for a p2p interface with a destination,
199 	 *      we end up reporting twice in such a case.  Should we rather
200 	 *      omit the second report?
201 	 */
202 	if (nrt) {
203 		rt_newaddrmsg(cmd, ifa, e, nrt);
204 		if (cmd == RTM_DELETE) {
205 			if (nrt->rt_refcnt <= 0) {
206 				/* XXX: we should free the entry ourselves. */
207 				nrt->rt_refcnt++;
208 				rtfree(nrt);
209 			}
210 		} else {
211 			/* the cmd must be RTM_ADD here */
212 			nrt->rt_refcnt--;
213 		}
214 	}
215 }
216 
217 /*
218  * Add ownaddr as loopback rtentry.  We previously add the route only if
219  * necessary (ex. on a p2p link).  However, since we now manage addresses
220  * separately from prefixes, we should always add the route.  We can't
221  * rely on the cloning mechanism from the corresponding interface route
222  * any more.
223  */
224 void
225 in6_ifaddloop(struct ifaddr *ifa)
226 {
227 	struct rtentry *rt;
228 
229 	/* If there is no loopback entry, allocate one. */
230 	rt = rtalloc1(ifa->ifa_addr, 0, 0);
231 	if (rt == NULL || (rt->rt_flags & RTF_HOST) == 0 ||
232 	    (rt->rt_ifp->if_flags & IFF_LOOPBACK) == 0)
233 		in6_ifloop_request(RTM_ADD, ifa);
234 	if (rt)
235 		rt->rt_refcnt--;
236 }
237 
238 /*
239  * Remove loopback rtentry of ownaddr generated by in6_ifaddloop(),
240  * if it exists.
241  */
242 void
243 in6_ifremloop(struct ifaddr *ifa)
244 {
245 	struct in6_ifaddr *ia;
246 	struct rtentry *rt;
247 	int ia_count = 0;
248 
249 	/*
250 	 * Some of BSD variants do not remove cloned routes
251 	 * from an interface direct route, when removing the direct route
252 	 * (see comments in net/net_osdep.h).  Even for variants that do remove
253 	 * cloned routes, they could fail to remove the cloned routes when
254 	 * we handle multple addresses that share a common prefix.
255 	 * So, we should remove the route corresponding to the deleted address.
256 	 */
257 
258 	/*
259 	 * Delete the entry only if exact one ifa exists.  More than one ifa
260 	 * can exist if we assign a same single address to multiple
261 	 * (probably p2p) interfaces.
262 	 * XXX: we should avoid such a configuration in IPv6...
263 	 */
264 	for (ia = in6_ifaddr; ia; ia = ia->ia_next) {
265 		if (IN6_ARE_ADDR_EQUAL(IFA_IN6(ifa), &ia->ia_addr.sin6_addr)) {
266 			ia_count++;
267 			if (ia_count > 1)
268 				break;
269 		}
270 	}
271 
272 	if (ia_count == 1) {
273 		/*
274 		 * Before deleting, check if a corresponding loopbacked host
275 		 * route surely exists.  With this check, we can avoid to
276 		 * delete an interface direct route whose destination is same
277 		 * as the address being removed.  This can happen when removing
278 		 * a subnet-router anycast address on an interface attached
279 		 * to a shared medium.
280 		 */
281 		rt = rtalloc1(ifa->ifa_addr, 0, 0);
282 		if (rt != NULL && (rt->rt_flags & RTF_HOST) != 0 &&
283 		    (rt->rt_ifp->if_flags & IFF_LOOPBACK) != 0) {
284 			rt->rt_refcnt--;
285 			in6_ifloop_request(RTM_DELETE, ifa);
286 		}
287 	}
288 }
289 
290 int
291 in6_mask2len(struct in6_addr *mask, u_char *lim0)
292 {
293 	int x = 0, y;
294 	u_char *lim = lim0, *p;
295 
296 	/* ignore the scope_id part */
297 	if (lim0 == NULL || lim0 - (u_char *)mask > sizeof(*mask))
298 		lim = (u_char *)mask + sizeof(*mask);
299 	for (p = (u_char *)mask; p < lim; x++, p++) {
300 		if (*p != 0xff)
301 			break;
302 	}
303 	y = 0;
304 	if (p < lim) {
305 		for (y = 0; y < 8; y++) {
306 			if ((*p & (0x80 >> y)) == 0)
307 				break;
308 		}
309 	}
310 
311 	/*
312 	 * when the limit pointer is given, do a stricter check on the
313 	 * remaining bits.
314 	 */
315 	if (p < lim) {
316 		if (y != 0 && (*p & (0x00ff >> y)) != 0)
317 			return (-1);
318 		for (p = p + 1; p < lim; p++)
319 			if (*p != 0)
320 				return (-1);
321 	}
322 
323 	return x * 8 + y;
324 }
325 
326 #define ifa2ia6(ifa)	((struct in6_ifaddr *)(ifa))
327 #define ia62ifa(ia6)	(&((ia6)->ia_ifa))
328 
329 int
330 in6_control(struct socket *so, u_long cmd, caddr_t data, struct ifnet *ifp,
331     struct proc *p)
332 {
333 	struct	in6_ifreq *ifr = (struct in6_ifreq *)data;
334 	struct	in6_ifaddr *ia = NULL;
335 	struct	in6_aliasreq *ifra = (struct in6_aliasreq *)data;
336 	struct sockaddr_in6 *sa6;
337 	int privileged;
338 
339 	privileged = 0;
340 	if ((so->so_state & SS_PRIV) != 0)
341 		privileged++;
342 
343 #ifdef MROUTING
344 	switch (cmd) {
345 	case SIOCGETSGCNT_IN6:
346 	case SIOCGETMIFCNT_IN6:
347 		return (mrt6_ioctl(cmd, data));
348 	}
349 #endif
350 
351 	if (ifp == NULL)
352 		return (EOPNOTSUPP);
353 
354 	switch (cmd) {
355 	case SIOCSNDFLUSH_IN6:
356 	case SIOCSPFXFLUSH_IN6:
357 	case SIOCSRTRFLUSH_IN6:
358 	case SIOCSDEFIFACE_IN6:
359 	case SIOCSIFINFO_FLAGS:
360 		if (!privileged)
361 			return (EPERM);
362 		/* FALLTHROUGH */
363 	case OSIOCGIFINFO_IN6:
364 	case SIOCGIFINFO_IN6:
365 	case SIOCGDRLST_IN6:
366 	case SIOCGPRLST_IN6:
367 	case SIOCGNBRINFO_IN6:
368 	case SIOCGDEFIFACE_IN6:
369 		return (nd6_ioctl(cmd, data, ifp));
370 	}
371 
372 	switch (cmd) {
373 	case SIOCSIFPREFIX_IN6:
374 	case SIOCDIFPREFIX_IN6:
375 	case SIOCAIFPREFIX_IN6:
376 	case SIOCCIFPREFIX_IN6:
377 	case SIOCSGIFPREFIX_IN6:
378 	case SIOCGIFPREFIX_IN6:
379 		log(LOG_NOTICE,
380 		    "prefix ioctls are now invalidated. "
381 		    "please use ifconfig.\n");
382 		return (EOPNOTSUPP);
383 	}
384 
385 	switch (cmd) {
386 	case SIOCALIFADDR:
387 	case SIOCDLIFADDR:
388 		if (!privileged)
389 			return (EPERM);
390 		/* FALLTHROUGH */
391 	case SIOCGLIFADDR:
392 		return in6_lifaddr_ioctl(so, cmd, data, ifp, p);
393 	}
394 
395 	/*
396 	 * Find address for this interface, if it exists.
397 	 *
398 	 * In netinet code, we have checked ifra_addr in SIOCSIF*ADDR operation
399 	 * only, and used the first interface address as the target of other
400 	 * operations (without checking ifra_addr).  This was because netinet
401 	 * code/API assumed at most 1 interface address per interface.
402 	 * Since IPv6 allows a node to assign multiple addresses
403 	 * on a single interface, we almost always look and check the
404 	 * presence of ifra_addr, and reject invalid ones here.
405 	 * It also decreases duplicated code among SIOC*_IN6 operations.
406 	 */
407 	switch (cmd) {
408 	case SIOCAIFADDR_IN6:
409 	case SIOCSIFPHYADDR_IN6:
410 		sa6 = &ifra->ifra_addr;
411 		break;
412 	case SIOCSIFADDR_IN6:
413 	case SIOCGIFADDR_IN6:
414 	case SIOCSIFDSTADDR_IN6:
415 	case SIOCSIFNETMASK_IN6:
416 	case SIOCGIFDSTADDR_IN6:
417 	case SIOCGIFNETMASK_IN6:
418 	case SIOCDIFADDR_IN6:
419 	case SIOCGIFPSRCADDR_IN6:
420 	case SIOCGIFPDSTADDR_IN6:
421 	case SIOCGIFAFLAG_IN6:
422 	case SIOCSNDFLUSH_IN6:
423 	case SIOCSPFXFLUSH_IN6:
424 	case SIOCSRTRFLUSH_IN6:
425 	case SIOCGIFALIFETIME_IN6:
426 	case SIOCSIFALIFETIME_IN6:
427 	case SIOCGIFSTAT_IN6:
428 	case SIOCGIFSTAT_ICMP6:
429 		sa6 = &ifr->ifr_addr;
430 		break;
431 	default:
432 		sa6 = NULL;
433 		break;
434 	}
435 	if (sa6 && sa6->sin6_family == AF_INET6) {
436 		if (IN6_IS_ADDR_LINKLOCAL(&sa6->sin6_addr)) {
437 			if (sa6->sin6_addr.s6_addr16[1] == 0) {
438 				/* link ID is not embedded by the user */
439 				sa6->sin6_addr.s6_addr16[1] =
440 				    htons(ifp->if_index);
441 			} else if (sa6->sin6_addr.s6_addr16[1] !=
442 			    htons(ifp->if_index)) {
443 				return (EINVAL);	/* link ID contradicts */
444 			}
445 			if (sa6->sin6_scope_id) {
446 				if (sa6->sin6_scope_id !=
447 				    (u_int32_t)ifp->if_index)
448 					return (EINVAL);
449 				sa6->sin6_scope_id = 0; /* XXX: good way? */
450 			}
451 		}
452 		ia = in6ifa_ifpwithaddr(ifp, &sa6->sin6_addr);
453 	} else
454 		ia = NULL;
455 
456 	switch (cmd) {
457 	case SIOCSIFADDR_IN6:
458 	case SIOCSIFDSTADDR_IN6:
459 	case SIOCSIFNETMASK_IN6:
460 		/*
461 		 * Since IPv6 allows a node to assign multiple addresses
462 		 * on a single interface, SIOCSIFxxx ioctls are deprecated.
463 		 */
464 		return (EINVAL);
465 
466 	case SIOCDIFADDR_IN6:
467 		/*
468 		 * for IPv4, we look for existing in_ifaddr here to allow
469 		 * "ifconfig if0 delete" to remove the first IPv4 address on
470 		 * the interface.  For IPv6, as the spec allows multiple
471 		 * interface address from the day one, we consider "remove the
472 		 * first one" semantics to be not preferable.
473 		 */
474 		if (ia == NULL)
475 			return (EADDRNOTAVAIL);
476 		/* FALLTHROUGH */
477 	case SIOCAIFADDR_IN6:
478 		/*
479 		 * We always require users to specify a valid IPv6 address for
480 		 * the corresponding operation.
481 		 */
482 		if (ifra->ifra_addr.sin6_family != AF_INET6 ||
483 		    ifra->ifra_addr.sin6_len != sizeof(struct sockaddr_in6))
484 			return (EAFNOSUPPORT);
485 		if (!privileged)
486 			return (EPERM);
487 
488 		break;
489 
490 	case SIOCGIFADDR_IN6:
491 		/* This interface is basically deprecated. use SIOCGIFCONF. */
492 		/* FALLTHROUGH */
493 	case SIOCGIFAFLAG_IN6:
494 	case SIOCGIFNETMASK_IN6:
495 	case SIOCGIFDSTADDR_IN6:
496 	case SIOCGIFALIFETIME_IN6:
497 		/* must think again about its semantics */
498 		if (ia == NULL)
499 			return (EADDRNOTAVAIL);
500 		break;
501 	case SIOCSIFALIFETIME_IN6:
502 	    {
503 		struct in6_addrlifetime *lt;
504 
505 		if (!privileged)
506 			return (EPERM);
507 		if (ia == NULL)
508 			return (EADDRNOTAVAIL);
509 		/* sanity for overflow - beware unsigned */
510 		lt = &ifr->ifr_ifru.ifru_lifetime;
511 		if (lt->ia6t_vltime != ND6_INFINITE_LIFETIME
512 		 && lt->ia6t_vltime + time_second < time_second) {
513 			return EINVAL;
514 		}
515 		if (lt->ia6t_pltime != ND6_INFINITE_LIFETIME
516 		 && lt->ia6t_pltime + time_second < time_second) {
517 			return EINVAL;
518 		}
519 		break;
520 	    }
521 	}
522 
523 	switch (cmd) {
524 
525 	case SIOCGIFADDR_IN6:
526 		ifr->ifr_addr = ia->ia_addr;
527 		break;
528 
529 	case SIOCGIFDSTADDR_IN6:
530 		if ((ifp->if_flags & IFF_POINTOPOINT) == 0)
531 			return (EINVAL);
532 		/*
533 		 * XXX: should we check if ifa_dstaddr is NULL and return
534 		 * an error?
535 		 */
536 		ifr->ifr_dstaddr = ia->ia_dstaddr;
537 		break;
538 
539 	case SIOCGIFNETMASK_IN6:
540 		ifr->ifr_addr = ia->ia_prefixmask;
541 		break;
542 
543 	case SIOCGIFAFLAG_IN6:
544 		ifr->ifr_ifru.ifru_flags6 = ia->ia6_flags;
545 		break;
546 
547 	case SIOCGIFSTAT_IN6:
548 		if (ifp == NULL)
549 			return EINVAL;
550 		bzero(&ifr->ifr_ifru.ifru_stat,
551 		    sizeof(ifr->ifr_ifru.ifru_stat));
552 		ifr->ifr_ifru.ifru_stat =
553 		    *((struct in6_ifextra *)ifp->if_afdata[AF_INET6])->in6_ifstat;
554 		break;
555 
556 	case SIOCGIFSTAT_ICMP6:
557 		if (ifp == NULL)
558 			return EINVAL;
559 		bzero(&ifr->ifr_ifru.ifru_icmp6stat,
560 		    sizeof(ifr->ifr_ifru.ifru_icmp6stat));
561 		ifr->ifr_ifru.ifru_icmp6stat =
562 		    *((struct in6_ifextra *)ifp->if_afdata[AF_INET6])->icmp6_ifstat;
563 		break;
564 
565 	case SIOCGIFALIFETIME_IN6:
566 		ifr->ifr_ifru.ifru_lifetime = ia->ia6_lifetime;
567 		if (ia->ia6_lifetime.ia6t_vltime != ND6_INFINITE_LIFETIME) {
568 			time_t maxexpire;
569 			struct in6_addrlifetime *retlt =
570 			    &ifr->ifr_ifru.ifru_lifetime;
571 
572 			/*
573 			 * XXX: adjust expiration time assuming time_t is
574 			 * signed.
575 			 */
576 			maxexpire = (-1) &
577 			    ~(1 << ((sizeof(maxexpire) * 8) - 1));
578 			if (ia->ia6_lifetime.ia6t_vltime <
579 			    maxexpire - ia->ia6_updatetime) {
580 				retlt->ia6t_expire = ia->ia6_updatetime +
581 				    ia->ia6_lifetime.ia6t_vltime;
582 			} else
583 				retlt->ia6t_expire = maxexpire;
584 		}
585 		if (ia->ia6_lifetime.ia6t_pltime != ND6_INFINITE_LIFETIME) {
586 			time_t maxexpire;
587 			struct in6_addrlifetime *retlt =
588 			    &ifr->ifr_ifru.ifru_lifetime;
589 
590 			/*
591 			 * XXX: adjust expiration time assuming time_t is
592 			 * signed.
593 			 */
594 			maxexpire = (-1) &
595 			    ~(1 << ((sizeof(maxexpire) * 8) - 1));
596 			if (ia->ia6_lifetime.ia6t_pltime <
597 			    maxexpire - ia->ia6_updatetime) {
598 				retlt->ia6t_preferred = ia->ia6_updatetime +
599 				    ia->ia6_lifetime.ia6t_pltime;
600 			} else
601 				retlt->ia6t_preferred = maxexpire;
602 		}
603 		break;
604 
605 	case SIOCSIFALIFETIME_IN6:
606 		ia->ia6_lifetime = ifr->ifr_ifru.ifru_lifetime;
607 		/* for sanity */
608 		if (ia->ia6_lifetime.ia6t_vltime != ND6_INFINITE_LIFETIME) {
609 			ia->ia6_lifetime.ia6t_expire =
610 				time_second + ia->ia6_lifetime.ia6t_vltime;
611 		} else
612 			ia->ia6_lifetime.ia6t_expire = 0;
613 		if (ia->ia6_lifetime.ia6t_pltime != ND6_INFINITE_LIFETIME) {
614 			ia->ia6_lifetime.ia6t_preferred =
615 				time_second + ia->ia6_lifetime.ia6t_pltime;
616 		} else
617 			ia->ia6_lifetime.ia6t_preferred = 0;
618 		break;
619 
620 	case SIOCAIFADDR_IN6:
621 	{
622 		int i, error = 0;
623 		struct nd_prefix pr0, *pr;
624 		int s;
625 
626 		/* reject read-only flags */
627 		if ((ifra->ifra_flags & IN6_IFF_DUPLICATED) != 0 ||
628 		    (ifra->ifra_flags & IN6_IFF_DETACHED) != 0 ||
629 		    (ifra->ifra_flags & IN6_IFF_NODAD) != 0 ||
630 		    (ifra->ifra_flags & IN6_IFF_AUTOCONF) != 0) {
631 			return (EINVAL);
632 		}
633 		/*
634 		 * first, make or update the interface address structure,
635 		 * and link it to the list.
636 		 */
637  		s = splsoftnet();
638 		error = in6_update_ifa(ifp, ifra, ia);
639 		splx(s);
640 		if (error != 0)
641 			return (error);
642 		if ((ia = in6ifa_ifpwithaddr(ifp, &ifra->ifra_addr.sin6_addr))
643 		    == NULL) {
644 		    	/*
645 			 * this can happen when the user specify the 0 valid
646 			 * lifetime.
647 			 */
648 			break;
649 		}
650 
651 		/*
652 		 * then, make the prefix on-link on the interface.
653 		 * XXX: we'd rather create the prefix before the address, but
654 		 * we need at least one address to install the corresponding
655 		 * interface route, so we configure the address first.
656 		 */
657 
658 		/*
659 		 * convert mask to prefix length (prefixmask has already
660 		 * been validated in in6_update_ifa().
661 		 */
662 		bzero(&pr0, sizeof(pr0));
663 		pr0.ndpr_ifp = ifp;
664 		pr0.ndpr_plen = in6_mask2len(&ifra->ifra_prefixmask.sin6_addr,
665 		    NULL);
666 		if (pr0.ndpr_plen == 128) {
667 			dohooks(ifp->if_addrhooks, 0);
668 			break;	/* we don't need to install a host route. */
669 		}
670 		pr0.ndpr_prefix = ifra->ifra_addr;
671 		pr0.ndpr_mask = ifra->ifra_prefixmask.sin6_addr;
672 		/* apply the mask for safety. */
673 		for (i = 0; i < 4; i++) {
674 			pr0.ndpr_prefix.sin6_addr.s6_addr32[i] &=
675 			    ifra->ifra_prefixmask.sin6_addr.s6_addr32[i];
676 		}
677 		/*
678 		 * XXX: since we don't have an API to set prefix (not address)
679 		 * lifetimes, we just use the same lifetimes as addresses.
680 		 * The (temporarily) installed lifetimes can be overridden by
681 		 * later advertised RAs (when accept_rtadv is non 0), which is
682 		 * an intended behavior.
683 		 */
684 		pr0.ndpr_raf_onlink = 1; /* should be configurable? */
685 		pr0.ndpr_raf_auto =
686 		    ((ifra->ifra_flags & IN6_IFF_AUTOCONF) != 0);
687 		pr0.ndpr_vltime = ifra->ifra_lifetime.ia6t_vltime;
688 		pr0.ndpr_pltime = ifra->ifra_lifetime.ia6t_pltime;
689 
690 		/* add the prefix if not yet. */
691 		if ((pr = nd6_prefix_lookup(&pr0)) == NULL) {
692 			/*
693 			 * nd6_prelist_add will install the corresponding
694 			 * interface route.
695 			 */
696 			if ((error = nd6_prelist_add(&pr0, NULL, &pr)) != 0)
697 				return (error);
698 			if (pr == NULL) {
699 				log(LOG_ERR, "nd6_prelist_add succeeded but "
700 				    "no prefix\n");
701 				return (EINVAL); /* XXX panic here? */
702 			}
703 		}
704 
705 		/* relate the address to the prefix */
706 		if (ia->ia6_ndpr == NULL) {
707 			ia->ia6_ndpr = pr;
708 			pr->ndpr_refcnt++;
709 		}
710 
711 		/*
712 		 * this might affect the status of autoconfigured addresses,
713 		 * that is, this address might make other addresses detached.
714 		 */
715 		pfxlist_onlink_check();
716 
717 		dohooks(ifp->if_addrhooks, 0);
718 		break;
719 	}
720 
721 	case SIOCDIFADDR_IN6:
722 	{
723 		int i = 0, purgeprefix = 0;
724 		struct nd_prefix pr0, *pr = NULL;
725 
726 		/*
727 		 * If the address being deleted is the only one that owns
728 		 * the corresponding prefix, expire the prefix as well.
729 		 * XXX: theoretically, we don't have to worry about such
730 		 * relationship, since we separate the address management
731 		 * and the prefix management.  We do this, however, to provide
732 		 * as much backward compatibility as possible in terms of
733 		 * the ioctl operation.
734 		 */
735 		bzero(&pr0, sizeof(pr0));
736 		pr0.ndpr_ifp = ifp;
737 		pr0.ndpr_plen = in6_mask2len(&ia->ia_prefixmask.sin6_addr,
738 		    NULL);
739 		if (pr0.ndpr_plen == 128)
740 			goto purgeaddr;
741 		pr0.ndpr_prefix = ia->ia_addr;
742 		pr0.ndpr_mask = ia->ia_prefixmask.sin6_addr;
743 		for (i = 0; i < 4; i++) {
744 			pr0.ndpr_prefix.sin6_addr.s6_addr32[i] &=
745 			    ia->ia_prefixmask.sin6_addr.s6_addr32[i];
746 		}
747 		if ((pr = nd6_prefix_lookup(&pr0)) != NULL &&
748 		    pr == ia->ia6_ndpr) {
749 			pr->ndpr_refcnt--;
750 			if (pr->ndpr_refcnt == 0)
751 				purgeprefix = 1;
752 		}
753 
754 	  purgeaddr:
755 		in6_purgeaddr(&ia->ia_ifa);
756 		if (pr && purgeprefix)
757 			prelist_remove(pr);
758 		dohooks(ifp->if_addrhooks, 0);
759 		break;
760 	}
761 
762 	default:
763 		if (ifp == NULL || ifp->if_ioctl == 0)
764 			return (EOPNOTSUPP);
765 		return ((*ifp->if_ioctl)(ifp, cmd, data));
766 	}
767 
768 	return (0);
769 }
770 
771 /*
772  * Update parameters of an IPv6 interface address.
773  * If necessary, a new entry is created and linked into address chains.
774  * This function is separated from in6_control().
775  */
776 int
777 in6_update_ifa(struct ifnet *ifp, struct in6_aliasreq *ifra,
778     struct in6_ifaddr *ia)
779 {
780 	int error = 0, hostIsNew = 0, plen = -1;
781 	struct in6_ifaddr *oia;
782 	struct sockaddr_in6 dst6;
783 	struct in6_addrlifetime *lt;
784 	struct in6_multi_mship *imm;
785 	struct rtentry *rt;
786 
787 	splsoftassert(IPL_SOFTNET);
788 
789 	/* Validate parameters */
790 	if (ifp == NULL || ifra == NULL) /* this maybe redundant */
791 		return (EINVAL);
792 
793 	/*
794 	 * The destination address for a p2p link must have a family
795 	 * of AF_UNSPEC or AF_INET6.
796 	 */
797 	if ((ifp->if_flags & IFF_POINTOPOINT) != 0 &&
798 	    ifra->ifra_dstaddr.sin6_family != AF_INET6 &&
799 	    ifra->ifra_dstaddr.sin6_family != AF_UNSPEC)
800 		return (EAFNOSUPPORT);
801 
802 	/* must have link-local */
803 	if (ifp->if_xflags & IFXF_NOINET6)
804 		return (EAFNOSUPPORT);
805 
806 	/*
807 	 * validate ifra_prefixmask.  don't check sin6_family, netmask
808 	 * does not carry fields other than sin6_len.
809 	 */
810 	if (ifra->ifra_prefixmask.sin6_len > sizeof(struct sockaddr_in6))
811 		return (EINVAL);
812 	/*
813 	 * Because the IPv6 address architecture is classless, we require
814 	 * users to specify a (non 0) prefix length (mask) for a new address.
815 	 * We also require the prefix (when specified) mask is valid, and thus
816 	 * reject a non-consecutive mask.
817 	 */
818 	if (ia == NULL && ifra->ifra_prefixmask.sin6_len == 0)
819 		return (EINVAL);
820 	if (ifra->ifra_prefixmask.sin6_len != 0) {
821 		plen = in6_mask2len(&ifra->ifra_prefixmask.sin6_addr,
822 		    (u_char *)&ifra->ifra_prefixmask +
823 		    ifra->ifra_prefixmask.sin6_len);
824 		if (plen <= 0)
825 			return (EINVAL);
826 	} else {
827 		/*
828 		 * In this case, ia must not be NULL.  We just use its prefix
829 		 * length.
830 		 */
831 		plen = in6_mask2len(&ia->ia_prefixmask.sin6_addr, NULL);
832 	}
833 	/*
834 	 * If the destination address on a p2p interface is specified,
835 	 * and the address is a scoped one, validate/set the scope
836 	 * zone identifier.
837 	 */
838 	dst6 = ifra->ifra_dstaddr;
839 	if ((ifp->if_flags & (IFF_POINTOPOINT|IFF_LOOPBACK)) != 0 &&
840 	    (dst6.sin6_family == AF_INET6)) {
841 		/* link-local index check: should be a separate function? */
842 		if (IN6_IS_ADDR_LINKLOCAL(&dst6.sin6_addr)) {
843 			if (dst6.sin6_addr.s6_addr16[1] == 0) {
844 				/*
845 				 * interface ID is not embedded by
846 				 * the user
847 				 */
848 				dst6.sin6_addr.s6_addr16[1] =
849 				    htons(ifp->if_index);
850 			} else if (dst6.sin6_addr.s6_addr16[1] !=
851 			    htons(ifp->if_index)) {
852 				return (EINVAL);	/* ifid contradicts */
853 			}
854 		}
855 	}
856 	/*
857 	 * The destination address can be specified only for a p2p or a
858 	 * loopback interface.  If specified, the corresponding prefix length
859 	 * must be 128.
860 	 */
861 	if (ifra->ifra_dstaddr.sin6_family == AF_INET6) {
862 #ifdef FORCE_P2PPLEN
863 		int i;
864 #endif
865 
866 		if ((ifp->if_flags & (IFF_POINTOPOINT|IFF_LOOPBACK)) == 0) {
867 			/* XXX: noisy message */
868 			nd6log((LOG_INFO, "in6_update_ifa: a destination can "
869 			    "be specified for a p2p or a loopback IF only\n"));
870 			return (EINVAL);
871 		}
872 		if (plen != 128) {
873 			nd6log((LOG_INFO, "in6_update_ifa: prefixlen should "
874 			    "be 128 when dstaddr is specified\n"));
875 #ifdef FORCE_P2PPLEN
876 			/*
877 			 * To be compatible with old configurations,
878 			 * such as ifconfig gif0 inet6 2001::1 2001::2
879 			 * prefixlen 126, we override the specified
880 			 * prefixmask as if the prefix length was 128.
881 			 */
882 			ifra->ifra_prefixmask.sin6_len =
883 			    sizeof(struct sockaddr_in6);
884 			for (i = 0; i < 4; i++)
885 				ifra->ifra_prefixmask.sin6_addr.s6_addr32[i] =
886 				    0xffffffff;
887 			plen = 128;
888 #else
889 			return (EINVAL);
890 #endif
891 		}
892 	}
893 	/* lifetime consistency check */
894 	lt = &ifra->ifra_lifetime;
895 	if (lt->ia6t_pltime > lt->ia6t_vltime)
896 		return (EINVAL);
897 	if (lt->ia6t_vltime == 0) {
898 		/*
899 		 * the following log might be noisy, but this is a typical
900 		 * configuration mistake or a tool's bug.
901 		 */
902 		nd6log((LOG_INFO,
903 		    "in6_update_ifa: valid lifetime is 0 for %s\n",
904 		    ip6_sprintf(&ifra->ifra_addr.sin6_addr)));
905 
906 		if (ia == NULL)
907 			return (0); /* there's nothing to do */
908 	}
909 
910 	/*
911 	 * If this is a new address, allocate a new ifaddr and link it
912 	 * into chains.
913 	 */
914 	if (ia == NULL) {
915 		hostIsNew = 1;
916 		ia = malloc(sizeof(*ia), M_IFADDR, M_WAITOK | M_ZERO);
917 		LIST_INIT(&ia->ia6_memberships);
918 		/* Initialize the address and masks, and put time stamp */
919 		ia->ia_ifa.ifa_addr = (struct sockaddr *)&ia->ia_addr;
920 		ia->ia_addr.sin6_family = AF_INET6;
921 		ia->ia_addr.sin6_len = sizeof(ia->ia_addr);
922 		ia->ia6_createtime = ia->ia6_updatetime = time_second;
923 		if ((ifp->if_flags & (IFF_POINTOPOINT | IFF_LOOPBACK)) != 0) {
924 			/*
925 			 * XXX: some functions expect that ifa_dstaddr is not
926 			 * NULL for p2p interfaces.
927 			 */
928 			ia->ia_ifa.ifa_dstaddr =
929 			    (struct sockaddr *)&ia->ia_dstaddr;
930 		} else {
931 			ia->ia_ifa.ifa_dstaddr = NULL;
932 		}
933 		ia->ia_ifa.ifa_netmask =
934 		    (struct sockaddr *)&ia->ia_prefixmask;
935 
936 		ia->ia_ifp = ifp;
937 		if ((oia = in6_ifaddr) != NULL) {
938 			for ( ; oia->ia_next; oia = oia->ia_next)
939 				continue;
940 			oia->ia_next = ia;
941 		} else
942 			in6_ifaddr = ia;
943 		ia->ia_addr = ifra->ifra_addr;
944 		ifa_add(ifp, &ia->ia_ifa);
945 	}
946 
947 	/* set prefix mask */
948 	if (ifra->ifra_prefixmask.sin6_len) {
949 		/*
950 		 * We prohibit changing the prefix length of an existing
951 		 * address, because
952 		 * + such an operation should be rare in IPv6, and
953 		 * + the operation would confuse prefix management.
954 		 */
955 		if (ia->ia_prefixmask.sin6_len &&
956 		    in6_mask2len(&ia->ia_prefixmask.sin6_addr, NULL) != plen) {
957 			nd6log((LOG_INFO, "in6_update_ifa: the prefix length of an"
958 			    " existing (%s) address should not be changed\n",
959 			    ip6_sprintf(&ia->ia_addr.sin6_addr)));
960 			error = EINVAL;
961 			goto unlink;
962 		}
963 		ia->ia_prefixmask = ifra->ifra_prefixmask;
964 	}
965 
966 	/*
967 	 * If a new destination address is specified, scrub the old one and
968 	 * install the new destination.  Note that the interface must be
969 	 * p2p or loopback (see the check above.)
970 	 */
971 	if (dst6.sin6_family == AF_INET6 &&
972 	    !IN6_ARE_ADDR_EQUAL(&dst6.sin6_addr, &ia->ia_dstaddr.sin6_addr)) {
973 		int e;
974 
975 		if ((ia->ia_flags & IFA_ROUTE) != 0 &&
976 		    (e = rtinit(&(ia->ia_ifa), (int)RTM_DELETE, RTF_HOST)) != 0) {
977 			nd6log((LOG_ERR, "in6_update_ifa: failed to remove "
978 			    "a route to the old destination: %s\n",
979 			    ip6_sprintf(&ia->ia_addr.sin6_addr)));
980 			/* proceed anyway... */
981 		} else
982 			ia->ia_flags &= ~IFA_ROUTE;
983 		ia->ia_dstaddr = dst6;
984 	}
985 
986 	/*
987 	 * Set lifetimes.  We do not refer to ia6t_expire and ia6t_preferred
988 	 * to see if the address is deprecated or invalidated, but initialize
989 	 * these members for applications.
990 	 */
991 	ia->ia6_lifetime = ifra->ifra_lifetime;
992 	if (ia->ia6_lifetime.ia6t_vltime != ND6_INFINITE_LIFETIME) {
993 		ia->ia6_lifetime.ia6t_expire =
994 		    time_second + ia->ia6_lifetime.ia6t_vltime;
995 	} else
996 		ia->ia6_lifetime.ia6t_expire = 0;
997 	if (ia->ia6_lifetime.ia6t_pltime != ND6_INFINITE_LIFETIME) {
998 		ia->ia6_lifetime.ia6t_preferred =
999 		    time_second + ia->ia6_lifetime.ia6t_pltime;
1000 	} else
1001 		ia->ia6_lifetime.ia6t_preferred = 0;
1002 
1003 	/* reset the interface and routing table appropriately. */
1004 	if ((error = in6_ifinit(ifp, ia, hostIsNew)) != 0)
1005 		goto unlink;
1006 
1007 	/*
1008 	 * configure address flags.
1009 	 */
1010 	ia->ia6_flags = ifra->ifra_flags;
1011 	/*
1012 	 * backward compatibility - if IN6_IFF_DEPRECATED is set from the
1013 	 * userland, make it deprecated.
1014 	 */
1015 	if ((ifra->ifra_flags & IN6_IFF_DEPRECATED) != 0) {
1016 		ia->ia6_lifetime.ia6t_pltime = 0;
1017 		ia->ia6_lifetime.ia6t_preferred = time_second;
1018 	}
1019 	/*
1020 	 * Make the address tentative before joining multicast addresses,
1021 	 * so that corresponding MLD responses would not have a tentative
1022 	 * source address.
1023 	 */
1024 	ia->ia6_flags &= ~IN6_IFF_DUPLICATED;	/* safety */
1025 	if (hostIsNew && in6if_do_dad(ifp))
1026 		ia->ia6_flags |= IN6_IFF_TENTATIVE;
1027 
1028 	/*
1029 	 * We are done if we have simply modified an existing address.
1030 	 */
1031 	if (!hostIsNew)
1032 		return (error);
1033 
1034 	/*
1035 	 * Beyond this point, we should call in6_purgeaddr upon an error,
1036 	 * not just go to unlink.
1037 	 */
1038 
1039 	/* join necessary multiast groups */
1040 	if ((ifp->if_flags & IFF_MULTICAST) != 0) {
1041 		struct sockaddr_in6 mltaddr, mltmask;
1042 
1043 		/* join solicited multicast addr for new host id */
1044 		struct sockaddr_in6 llsol;
1045 
1046 		bzero(&llsol, sizeof(llsol));
1047 		llsol.sin6_family = AF_INET6;
1048 		llsol.sin6_len = sizeof(llsol);
1049 		llsol.sin6_addr.s6_addr16[0] = htons(0xff02);
1050 		llsol.sin6_addr.s6_addr16[1] = htons(ifp->if_index);
1051 		llsol.sin6_addr.s6_addr32[1] = 0;
1052 		llsol.sin6_addr.s6_addr32[2] = htonl(1);
1053 		llsol.sin6_addr.s6_addr32[3] =
1054 		    ifra->ifra_addr.sin6_addr.s6_addr32[3];
1055 		llsol.sin6_addr.s6_addr8[12] = 0xff;
1056 		imm = in6_joingroup(ifp, &llsol.sin6_addr, &error);
1057 		if (!imm) {
1058 			nd6log((LOG_ERR, "in6_update_ifa: "
1059 			    "addmulti failed for %s on %s (errno=%d)\n",
1060 			    ip6_sprintf(&llsol.sin6_addr),
1061 			    ifp->if_xname, error));
1062 			goto cleanup;
1063 		}
1064 		LIST_INSERT_HEAD(&ia->ia6_memberships, imm, i6mm_chain);
1065 
1066 		bzero(&mltmask, sizeof(mltmask));
1067 		mltmask.sin6_len = sizeof(struct sockaddr_in6);
1068 		mltmask.sin6_family = AF_INET6;
1069 		mltmask.sin6_addr = in6mask32;
1070 
1071 		/*
1072 		 * join link-local all-nodes address
1073 		 */
1074 		bzero(&mltaddr, sizeof(mltaddr));
1075 		mltaddr.sin6_len = sizeof(struct sockaddr_in6);
1076 		mltaddr.sin6_family = AF_INET6;
1077 		mltaddr.sin6_addr = in6addr_linklocal_allnodes;
1078 		mltaddr.sin6_addr.s6_addr16[1] = htons(ifp->if_index);
1079 		mltaddr.sin6_scope_id = 0;
1080 
1081 		/*
1082 		 * XXX: do we really need this automatic routes?
1083 		 * We should probably reconsider this stuff.  Most applications
1084 		 * actually do not need the routes, since they usually specify
1085 		 * the outgoing interface.
1086 		 */
1087 		rt = rtalloc1((struct sockaddr *)&mltaddr, 0, 0);
1088 		if (rt) {
1089 			/*
1090 			 * 32bit came from "mltmask"
1091 			 */
1092 			if (memcmp(&mltaddr.sin6_addr,
1093 			    &((struct sockaddr_in6 *)rt_key(rt))->sin6_addr,
1094 			    32 / 8)) {
1095 				RTFREE(rt);
1096 				rt = NULL;
1097 			}
1098 		}
1099 		if (!rt) {
1100 			struct rt_addrinfo info;
1101 
1102 			bzero(&info, sizeof(info));
1103 			info.rti_info[RTAX_DST] = (struct sockaddr *)&mltaddr;
1104 			info.rti_info[RTAX_GATEWAY] =
1105 			    (struct sockaddr *)&ia->ia_addr;
1106 			info.rti_info[RTAX_NETMASK] =
1107 			    (struct sockaddr *)&mltmask;
1108 			info.rti_info[RTAX_IFA] =
1109 			    (struct sockaddr *)&ia->ia_addr;
1110 			/* XXX: we need RTF_CLONING to fake nd6_rtrequest */
1111 			info.rti_flags = RTF_UP | RTF_CLONING;
1112 			error = rtrequest1(RTM_ADD, &info, RTP_CONNECTED, NULL,
1113 			    0);
1114 			if (error)
1115 				goto cleanup;
1116 		} else {
1117 			RTFREE(rt);
1118 		}
1119 		imm = in6_joingroup(ifp, &mltaddr.sin6_addr, &error);
1120 		if (!imm) {
1121 			nd6log((LOG_WARNING,
1122 			    "in6_update_ifa: addmulti failed for "
1123 			    "%s on %s (errno=%d)\n",
1124 			    ip6_sprintf(&mltaddr.sin6_addr),
1125 			    ifp->if_xname, error));
1126 			goto cleanup;
1127 		}
1128 		LIST_INSERT_HEAD(&ia->ia6_memberships, imm, i6mm_chain);
1129 
1130 		/*
1131 		 * join node information group address
1132 		 */
1133 		if (in6_nigroup(ifp, hostname, hostnamelen, &mltaddr) == 0) {
1134 			imm = in6_joingroup(ifp, &mltaddr.sin6_addr, &error);
1135 			if (!imm) {
1136 				nd6log((LOG_WARNING, "in6_update_ifa: "
1137 				    "addmulti failed for %s on %s (errno=%d)\n",
1138 				    ip6_sprintf(&mltaddr.sin6_addr),
1139 				    ifp->if_xname, error));
1140 				/* XXX not very fatal, go on... */
1141 			} else {
1142 				LIST_INSERT_HEAD(&ia->ia6_memberships,
1143 				    imm, i6mm_chain);
1144 			}
1145 		}
1146 
1147 		/*
1148 		 * join interface-local all-nodes address.
1149 		 * (ff01::1%ifN, and ff01::%ifN/32)
1150 		 */
1151 		bzero(&mltaddr.sin6_addr, sizeof(mltaddr.sin6_addr));
1152 		mltaddr.sin6_len = sizeof(struct sockaddr_in6);
1153 		mltaddr.sin6_family = AF_INET6;
1154 		mltaddr.sin6_addr = in6addr_intfacelocal_allnodes;
1155 		mltaddr.sin6_addr.s6_addr16[1] = htons(ifp->if_index);
1156 		mltaddr.sin6_scope_id = 0;
1157 
1158 		/* XXX: again, do we really need the route? */
1159 		rt = rtalloc1((struct sockaddr *)&mltaddr, 0, 0);
1160 		if (rt) {
1161 			/* 32bit came from "mltmask" */
1162 			if (memcmp(&mltaddr.sin6_addr,
1163 			    &((struct sockaddr_in6 *)rt_key(rt))->sin6_addr,
1164 			    32 / 8)) {
1165 				RTFREE(rt);
1166 				rt = NULL;
1167 			}
1168 		}
1169 		if (!rt) {
1170 			struct rt_addrinfo info;
1171 
1172 			bzero(&info, sizeof(info));
1173 			info.rti_info[RTAX_DST] = (struct sockaddr *)&mltaddr;
1174 			info.rti_info[RTAX_GATEWAY] =
1175 			    (struct sockaddr *)&ia->ia_addr;
1176 			info.rti_info[RTAX_NETMASK] =
1177 			    (struct sockaddr *)&mltmask;
1178 			info.rti_info[RTAX_IFA] =
1179 			    (struct sockaddr *)&ia->ia_addr;
1180 			info.rti_flags = RTF_UP | RTF_CLONING;
1181 			error = rtrequest1(RTM_ADD, &info, RTP_CONNECTED,
1182 			    NULL, 0);
1183 			if (error)
1184 				goto cleanup;
1185 		} else {
1186 			RTFREE(rt);
1187 		}
1188 		imm = in6_joingroup(ifp, &mltaddr.sin6_addr, &error);
1189 		if (!imm) {
1190 			nd6log((LOG_WARNING, "in6_update_ifa: "
1191 			    "addmulti failed for %s on %s (errno=%d)\n",
1192 			    ip6_sprintf(&mltaddr.sin6_addr),
1193 			    ifp->if_xname, error));
1194 			goto cleanup;
1195 		}
1196 		LIST_INSERT_HEAD(&ia->ia6_memberships, imm, i6mm_chain);
1197 	}
1198 
1199 	/*
1200 	 * Perform DAD, if needed.
1201 	 * XXX It may be of use, if we can administratively
1202 	 * disable DAD.
1203 	 */
1204 	if (hostIsNew && in6if_do_dad(ifp) &&
1205 	    (ifra->ifra_flags & IN6_IFF_NODAD) == 0)
1206 	{
1207 		nd6_dad_start((struct ifaddr *)ia, NULL);
1208 	}
1209 
1210 	return (error);
1211 
1212   unlink:
1213 	/*
1214 	 * XXX: if a change of an existing address failed, keep the entry
1215 	 * anyway.
1216 	 */
1217 	if (hostIsNew)
1218 		in6_unlink_ifa(ia, ifp);
1219 	return (error);
1220 
1221   cleanup:
1222 	in6_purgeaddr(&ia->ia_ifa);
1223 	return error;
1224 }
1225 
1226 void
1227 in6_purgeaddr(struct ifaddr *ifa)
1228 {
1229 	struct ifnet *ifp = ifa->ifa_ifp;
1230 	struct in6_ifaddr *ia = (struct in6_ifaddr *) ifa;
1231 	struct in6_multi_mship *imm;
1232 
1233 	/* stop DAD processing */
1234 	nd6_dad_stop(ifa);
1235 
1236 	/*
1237 	 * delete route to the destination of the address being purged.
1238 	 * The interface must be p2p or loopback in this case.
1239 	 */
1240 	if ((ia->ia_flags & IFA_ROUTE) != 0 && ia->ia_dstaddr.sin6_len != 0) {
1241 		int e;
1242 
1243 		if ((e = rtinit(&(ia->ia_ifa), (int)RTM_DELETE, RTF_HOST))
1244 		    != 0) {
1245 			log(LOG_ERR, "in6_purgeaddr: failed to remove "
1246 			    "a route to the p2p destination: %s on %s, "
1247 			    "errno=%d\n",
1248 			    ip6_sprintf(&ia->ia_addr.sin6_addr), ifp->if_xname,
1249 			    e);
1250 			/* proceed anyway... */
1251 		} else
1252 			ia->ia_flags &= ~IFA_ROUTE;
1253 	}
1254 
1255 	/* Remove ownaddr's loopback rtentry, if it exists. */
1256 	in6_ifremloop(&(ia->ia_ifa));
1257 
1258 	/*
1259 	 * leave from multicast groups we have joined for the interface
1260 	 */
1261 	while (!LIST_EMPTY(&ia->ia6_memberships)) {
1262 		imm = LIST_FIRST(&ia->ia6_memberships);
1263 		LIST_REMOVE(imm, i6mm_chain);
1264 		in6_leavegroup(imm);
1265 	}
1266 
1267 	in6_unlink_ifa(ia, ifp);
1268 }
1269 
1270 void
1271 in6_unlink_ifa(struct in6_ifaddr *ia, struct ifnet *ifp)
1272 {
1273 	struct in6_ifaddr *oia;
1274 	int	s = splnet();
1275 
1276 	ifa_del(ifp, &ia->ia_ifa);
1277 
1278 	oia = ia;
1279 	if (oia == (ia = in6_ifaddr))
1280 		in6_ifaddr = ia->ia_next;
1281 	else {
1282 		while (ia->ia_next && (ia->ia_next != oia))
1283 			ia = ia->ia_next;
1284 		if (ia->ia_next)
1285 			ia->ia_next = oia->ia_next;
1286 		else {
1287 			/* search failed */
1288 			printf("Couldn't unlink in6_ifaddr from in6_ifaddr\n");
1289 		}
1290 	}
1291 
1292 	if (!LIST_EMPTY(&oia->ia6_multiaddrs)) {
1293 		in6_savemkludge(oia);
1294 	}
1295 
1296 	/*
1297 	 * When an autoconfigured address is being removed, release the
1298 	 * reference to the base prefix.  Also, since the release might
1299 	 * affect the status of other (detached) addresses, call
1300 	 * pfxlist_onlink_check().
1301 	 */
1302 	if ((oia->ia6_flags & IN6_IFF_AUTOCONF) != 0) {
1303 		if (oia->ia6_ndpr == NULL) {
1304 			log(LOG_NOTICE, "in6_unlink_ifa: autoconf'ed address "
1305 			    "%p has no prefix\n", oia);
1306 		} else {
1307 			oia->ia6_ndpr->ndpr_refcnt--;
1308 			oia->ia6_flags &= ~IN6_IFF_AUTOCONF;
1309 			oia->ia6_ndpr = NULL;
1310 		}
1311 
1312 		pfxlist_onlink_check();
1313 	}
1314 
1315 	/*
1316 	 * release another refcnt for the link from in6_ifaddr.
1317 	 * Note that we should decrement the refcnt at least once for all *BSD.
1318 	 */
1319 	IFAFREE(&oia->ia_ifa);
1320 
1321 	splx(s);
1322 }
1323 
1324 /*
1325  * SIOC[GAD]LIFADDR.
1326  *	SIOCGLIFADDR: get first address. (?)
1327  *	SIOCGLIFADDR with IFLR_PREFIX:
1328  *		get first address that matches the specified prefix.
1329  *	SIOCALIFADDR: add the specified address.
1330  *	SIOCALIFADDR with IFLR_PREFIX:
1331  *		add the specified prefix, filling hostid part from
1332  *		the first link-local address.  prefixlen must be <= 64.
1333  *	SIOCDLIFADDR: delete the specified address.
1334  *	SIOCDLIFADDR with IFLR_PREFIX:
1335  *		delete the first address that matches the specified prefix.
1336  * return values:
1337  *	EINVAL on invalid parameters
1338  *	EADDRNOTAVAIL on prefix match failed/specified address not found
1339  *	other values may be returned from in6_ioctl()
1340  *
1341  * NOTE: SIOCALIFADDR(with IFLR_PREFIX set) allows prefixlen less than 64.
1342  * this is to accommodate address naming scheme other than RFC2374,
1343  * in the future.
1344  * RFC2373 defines interface id to be 64bit, but it allows non-RFC2374
1345  * address encoding scheme. (see figure on page 8)
1346  */
1347 int
1348 in6_lifaddr_ioctl(struct socket *so, u_long cmd, caddr_t data,
1349     struct ifnet *ifp, struct proc *p)
1350 {
1351 	struct if_laddrreq *iflr = (struct if_laddrreq *)data;
1352 	struct ifaddr *ifa;
1353 	struct sockaddr *sa;
1354 
1355 	/* sanity checks */
1356 	if (!data || !ifp) {
1357 		panic("invalid argument to in6_lifaddr_ioctl");
1358 		/* NOTREACHED */
1359 	}
1360 
1361 	switch (cmd) {
1362 	case SIOCGLIFADDR:
1363 		/* address must be specified on GET with IFLR_PREFIX */
1364 		if ((iflr->flags & IFLR_PREFIX) == 0)
1365 			break;
1366 		/* FALLTHROUGH */
1367 	case SIOCALIFADDR:
1368 	case SIOCDLIFADDR:
1369 		/* address must be specified on ADD and DELETE */
1370 		sa = (struct sockaddr *)&iflr->addr;
1371 		if (sa->sa_family != AF_INET6)
1372 			return EINVAL;
1373 		if (sa->sa_len != sizeof(struct sockaddr_in6))
1374 			return EINVAL;
1375 		/* XXX need improvement */
1376 		sa = (struct sockaddr *)&iflr->dstaddr;
1377 		if (sa->sa_family && sa->sa_family != AF_INET6)
1378 			return EINVAL;
1379 		if (sa->sa_len && sa->sa_len != sizeof(struct sockaddr_in6))
1380 			return EINVAL;
1381 		break;
1382 	default: /* shouldn't happen */
1383 #if 0
1384 		panic("invalid cmd to in6_lifaddr_ioctl");
1385 		/* NOTREACHED */
1386 #else
1387 		return EOPNOTSUPP;
1388 #endif
1389 	}
1390 	if (sizeof(struct in6_addr) * 8 < iflr->prefixlen)
1391 		return EINVAL;
1392 
1393 	switch (cmd) {
1394 	case SIOCALIFADDR:
1395 	    {
1396 		struct in6_aliasreq ifra;
1397 		struct in6_addr *hostid = NULL;
1398 		int prefixlen;
1399 
1400 		if ((iflr->flags & IFLR_PREFIX) != 0) {
1401 			struct sockaddr_in6 *sin6;
1402 
1403 			/*
1404 			 * hostid is to fill in the hostid part of the
1405 			 * address.  hostid points to the first link-local
1406 			 * address attached to the interface.
1407 			 */
1408 			ifa = (struct ifaddr *)in6ifa_ifpforlinklocal(ifp, 0);
1409 			if (!ifa)
1410 				return EADDRNOTAVAIL;
1411 			hostid = IFA_IN6(ifa);
1412 
1413 		 	/* prefixlen must be <= 64. */
1414 			if (64 < iflr->prefixlen)
1415 				return EINVAL;
1416 			prefixlen = iflr->prefixlen;
1417 
1418 			/* hostid part must be zero. */
1419 			sin6 = (struct sockaddr_in6 *)&iflr->addr;
1420 			if (sin6->sin6_addr.s6_addr32[2] != 0
1421 			 || sin6->sin6_addr.s6_addr32[3] != 0) {
1422 				return EINVAL;
1423 			}
1424 		} else
1425 			prefixlen = iflr->prefixlen;
1426 
1427 		/* copy args to in6_aliasreq, perform ioctl(SIOCAIFADDR_IN6). */
1428 		bzero(&ifra, sizeof(ifra));
1429 		bcopy(iflr->iflr_name, ifra.ifra_name, sizeof(ifra.ifra_name));
1430 
1431 		bcopy(&iflr->addr, &ifra.ifra_addr,
1432 		    ((struct sockaddr *)&iflr->addr)->sa_len);
1433 		if (hostid) {
1434 			/* fill in hostid part */
1435 			ifra.ifra_addr.sin6_addr.s6_addr32[2] =
1436 			    hostid->s6_addr32[2];
1437 			ifra.ifra_addr.sin6_addr.s6_addr32[3] =
1438 			    hostid->s6_addr32[3];
1439 		}
1440 
1441 		if (((struct sockaddr *)&iflr->dstaddr)->sa_family) {	/*XXX*/
1442 			bcopy(&iflr->dstaddr, &ifra.ifra_dstaddr,
1443 			    ((struct sockaddr *)&iflr->dstaddr)->sa_len);
1444 			if (hostid) {
1445 				ifra.ifra_dstaddr.sin6_addr.s6_addr32[2] =
1446 				    hostid->s6_addr32[2];
1447 				ifra.ifra_dstaddr.sin6_addr.s6_addr32[3] =
1448 				    hostid->s6_addr32[3];
1449 			}
1450 		}
1451 
1452 		ifra.ifra_prefixmask.sin6_len = sizeof(struct sockaddr_in6);
1453 		in6_prefixlen2mask(&ifra.ifra_prefixmask.sin6_addr, prefixlen);
1454 
1455 		ifra.ifra_flags = iflr->flags & ~IFLR_PREFIX;
1456 		return in6_control(so, SIOCAIFADDR_IN6, (caddr_t)&ifra, ifp, p);
1457 	    }
1458 	case SIOCGLIFADDR:
1459 	case SIOCDLIFADDR:
1460 	    {
1461 		struct in6_ifaddr *ia;
1462 		struct in6_addr mask, candidate, match;
1463 		struct sockaddr_in6 *sin6;
1464 		int cmp;
1465 
1466 		bzero(&mask, sizeof(mask));
1467 		if (iflr->flags & IFLR_PREFIX) {
1468 			/* lookup a prefix rather than address. */
1469 			in6_prefixlen2mask(&mask, iflr->prefixlen);
1470 
1471 			sin6 = (struct sockaddr_in6 *)&iflr->addr;
1472 			bcopy(&sin6->sin6_addr, &match, sizeof(match));
1473 			match.s6_addr32[0] &= mask.s6_addr32[0];
1474 			match.s6_addr32[1] &= mask.s6_addr32[1];
1475 			match.s6_addr32[2] &= mask.s6_addr32[2];
1476 			match.s6_addr32[3] &= mask.s6_addr32[3];
1477 
1478 			/* if you set extra bits, that's wrong */
1479 			if (bcmp(&match, &sin6->sin6_addr, sizeof(match)))
1480 				return EINVAL;
1481 
1482 			cmp = 1;
1483 		} else {
1484 			if (cmd == SIOCGLIFADDR) {
1485 				/* on getting an address, take the 1st match */
1486 				cmp = 0;	/* XXX */
1487 			} else {
1488 				/* on deleting an address, do exact match */
1489 				in6_prefixlen2mask(&mask, 128);
1490 				sin6 = (struct sockaddr_in6 *)&iflr->addr;
1491 				bcopy(&sin6->sin6_addr, &match, sizeof(match));
1492 
1493 				cmp = 1;
1494 			}
1495 		}
1496 
1497 		TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) {
1498 			if (ifa->ifa_addr->sa_family != AF_INET6)
1499 				continue;
1500 			if (!cmp)
1501 				break;
1502 
1503 			bcopy(IFA_IN6(ifa), &candidate, sizeof(candidate));
1504 			candidate.s6_addr32[0] &= mask.s6_addr32[0];
1505 			candidate.s6_addr32[1] &= mask.s6_addr32[1];
1506 			candidate.s6_addr32[2] &= mask.s6_addr32[2];
1507 			candidate.s6_addr32[3] &= mask.s6_addr32[3];
1508 			if (IN6_ARE_ADDR_EQUAL(&candidate, &match))
1509 				break;
1510 		}
1511 		if (!ifa)
1512 			return EADDRNOTAVAIL;
1513 		ia = ifa2ia6(ifa);
1514 
1515 		if (cmd == SIOCGLIFADDR) {
1516 			/* fill in the if_laddrreq structure */
1517 			bcopy(&ia->ia_addr, &iflr->addr, ia->ia_addr.sin6_len);
1518 			if ((ifp->if_flags & IFF_POINTOPOINT) != 0) {
1519 				bcopy(&ia->ia_dstaddr, &iflr->dstaddr,
1520 				    ia->ia_dstaddr.sin6_len);
1521 			} else
1522 				bzero(&iflr->dstaddr, sizeof(iflr->dstaddr));
1523 
1524 			iflr->prefixlen =
1525 			    in6_mask2len(&ia->ia_prefixmask.sin6_addr, NULL);
1526 
1527 			iflr->flags = ia->ia6_flags;	/*XXX*/
1528 
1529 			return 0;
1530 		} else {
1531 			struct in6_aliasreq ifra;
1532 
1533 			/* fill in6_aliasreq and do ioctl(SIOCDIFADDR_IN6) */
1534 			bzero(&ifra, sizeof(ifra));
1535 			bcopy(iflr->iflr_name, ifra.ifra_name,
1536 			    sizeof(ifra.ifra_name));
1537 
1538 			bcopy(&ia->ia_addr, &ifra.ifra_addr,
1539 			    ia->ia_addr.sin6_len);
1540 			if ((ifp->if_flags & IFF_POINTOPOINT) != 0) {
1541 				bcopy(&ia->ia_dstaddr, &ifra.ifra_dstaddr,
1542 				    ia->ia_dstaddr.sin6_len);
1543 			} else {
1544 				bzero(&ifra.ifra_dstaddr,
1545 				    sizeof(ifra.ifra_dstaddr));
1546 			}
1547 			bcopy(&ia->ia_prefixmask, &ifra.ifra_dstaddr,
1548 			    ia->ia_prefixmask.sin6_len);
1549 
1550 			ifra.ifra_flags = ia->ia6_flags;
1551 			return in6_control(so, SIOCDIFADDR_IN6, (caddr_t)&ifra,
1552 			    ifp, p);
1553 		}
1554 	    }
1555 	}
1556 
1557 	return EOPNOTSUPP;	/* just for safety */
1558 }
1559 
1560 /*
1561  * Initialize an interface's intetnet6 address
1562  * and routing table entry.
1563  */
1564 int
1565 in6_ifinit(struct ifnet *ifp, struct in6_ifaddr *ia, int newhost)
1566 {
1567 	int	error = 0, plen, ifacount = 0;
1568 	int	s = splnet();
1569 	struct ifaddr *ifa;
1570 
1571 	/*
1572 	 * Give the interface a chance to initialize
1573 	 * if this is its first address (or it is a CARP interface)
1574 	 * and to validate the address if necessary.
1575 	 */
1576 	TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) {
1577 		if (ifa->ifa_addr == NULL)
1578 			continue;	/* just for safety */
1579 		if (ifa->ifa_addr->sa_family != AF_INET6)
1580 			continue;
1581 		ifacount++;
1582 	}
1583 
1584 	if ((ifacount <= 1 || ifp->if_type == IFT_CARP) && ifp->if_ioctl &&
1585 	    (error = (*ifp->if_ioctl)(ifp, SIOCSIFADDR, (caddr_t)ia))) {
1586 		splx(s);
1587 		return (error);
1588 	}
1589 	splx(s);
1590 
1591 	ia->ia_ifa.ifa_metric = ifp->if_metric;
1592 
1593 	/* we could do in(6)_socktrim here, but just omit it at this moment. */
1594 
1595 	/*
1596 	 * Special case:
1597 	 * If the destination address is specified for a point-to-point
1598 	 * interface, install a route to the destination as an interface
1599 	 * direct route.
1600 	 */
1601 	plen = in6_mask2len(&ia->ia_prefixmask.sin6_addr, NULL); /* XXX */
1602 	if (plen == 128 && ia->ia_dstaddr.sin6_family == AF_INET6) {
1603 		if ((error = rtinit(&(ia->ia_ifa), (int)RTM_ADD,
1604 				    RTF_UP | RTF_HOST)) != 0)
1605 			return (error);
1606 		ia->ia_flags |= IFA_ROUTE;
1607 	}
1608 
1609 	/* Add ownaddr as loopback rtentry, if necessary (ex. on p2p link). */
1610 	if (newhost) {
1611 		/* set the rtrequest function to create llinfo */
1612 		ia->ia_ifa.ifa_rtrequest = nd6_rtrequest;
1613 		in6_ifaddloop(&(ia->ia_ifa));
1614 	}
1615 
1616 	if (ifp->if_flags & IFF_MULTICAST)
1617 		in6_restoremkludge(ia, ifp);
1618 
1619 	return (error);
1620 }
1621 
1622 /*
1623  * Multicast address kludge:
1624  * If there were any multicast addresses attached to this interface address,
1625  * either move them to another address on this interface, or save them until
1626  * such time as this interface is reconfigured for IPv6.
1627  */
1628 void
1629 in6_savemkludge(struct in6_ifaddr *oia)
1630 {
1631 	struct in6_ifaddr *ia;
1632 	struct in6_multi *in6m, *next;
1633 
1634 	IFP_TO_IA6(oia->ia_ifp, ia);
1635 	if (ia) {	/* there is another address */
1636 		for (in6m = LIST_FIRST(&oia->ia6_multiaddrs);
1637 		    in6m != LIST_END(&oia->ia6_multiaddrs); in6m = next) {
1638 			next = LIST_NEXT(in6m, in6m_entry);
1639 			IFAFREE(&in6m->in6m_ia->ia_ifa);
1640 			ia->ia_ifa.ifa_refcnt++;
1641 			in6m->in6m_ia = ia;
1642 			LIST_INSERT_HEAD(&ia->ia6_multiaddrs, in6m, in6m_entry);
1643 		}
1644 	} else {	/* last address on this if deleted, save */
1645 		struct multi6_kludge *mk;
1646 
1647 		LIST_FOREACH(mk, &in6_mk, mk_entry) {
1648 			if (mk->mk_ifp == oia->ia_ifp)
1649 				break;
1650 		}
1651 		if (mk == NULL) /* this should not happen! */
1652 			panic("in6_savemkludge: no kludge space");
1653 
1654 		for (in6m = LIST_FIRST(&oia->ia6_multiaddrs);
1655 		    in6m != LIST_END(&oia->ia6_multiaddrs); in6m = next) {
1656 			next = LIST_NEXT(in6m, in6m_entry);
1657 			IFAFREE(&in6m->in6m_ia->ia_ifa); /* release reference */
1658 			in6m->in6m_ia = NULL;
1659 			LIST_INSERT_HEAD(&mk->mk_head, in6m, in6m_entry);
1660 		}
1661 	}
1662 }
1663 
1664 /*
1665  * Continuation of multicast address hack:
1666  * If there was a multicast group list previously saved for this interface,
1667  * then we re-attach it to the first address configured on the i/f.
1668  */
1669 void
1670 in6_restoremkludge(struct in6_ifaddr *ia, struct ifnet *ifp)
1671 {
1672 	struct multi6_kludge *mk;
1673 
1674 	LIST_FOREACH(mk, &in6_mk, mk_entry) {
1675 		if (mk->mk_ifp == ifp) {
1676 			struct in6_multi *in6m, *next;
1677 
1678 			for (in6m = LIST_FIRST(&mk->mk_head);
1679 			    in6m != LIST_END(&mk->mk_head);
1680 			    in6m = next) {
1681 				next = LIST_NEXT(in6m, in6m_entry);
1682 				in6m->in6m_ia = ia;
1683 				ia->ia_ifa.ifa_refcnt++;
1684 				LIST_INSERT_HEAD(&ia->ia6_multiaddrs,
1685 						 in6m, in6m_entry);
1686 			}
1687 			LIST_INIT(&mk->mk_head);
1688 			break;
1689 		}
1690 	}
1691 }
1692 
1693 /*
1694  * Allocate space for the kludge at interface initialization time.
1695  * Formerly, we dynamically allocated the space in in6_savemkludge() with
1696  * malloc(M_WAITOK).  However, it was wrong since the function could be called
1697  * under an interrupt context (software timer on address lifetime expiration).
1698  * Also, we cannot just give up allocating the strucutre, since the group
1699  * membership structure is very complex and we need to keep it anyway.
1700  * Of course, this function MUST NOT be called under an interrupt context.
1701  * Specifically, it is expected to be called only from in6_ifattach(), though
1702  * it is a global function.
1703  */
1704 void
1705 in6_createmkludge(struct ifnet *ifp)
1706 {
1707 	struct multi6_kludge *mk;
1708 
1709 	LIST_FOREACH(mk, &in6_mk, mk_entry) {
1710 		/* If we've already had one, do not allocate. */
1711 		if (mk->mk_ifp == ifp)
1712 			return;
1713 	}
1714 
1715 	mk = malloc(sizeof(*mk), M_IPMADDR, M_WAITOK | M_ZERO);
1716 
1717 	LIST_INIT(&mk->mk_head);
1718 	mk->mk_ifp = ifp;
1719 	LIST_INSERT_HEAD(&in6_mk, mk, mk_entry);
1720 }
1721 
1722 void
1723 in6_purgemkludge(struct ifnet *ifp)
1724 {
1725 	struct multi6_kludge *mk;
1726 	struct in6_multi *in6m;
1727 
1728 	LIST_FOREACH(mk, &in6_mk, mk_entry) {
1729 		if (mk->mk_ifp != ifp)
1730 			continue;
1731 
1732 		/* leave from all multicast groups joined */
1733 		while ((in6m = LIST_FIRST(&mk->mk_head)) != NULL)
1734 			in6_delmulti(in6m);
1735 		LIST_REMOVE(mk, mk_entry);
1736 		free(mk, M_IPMADDR);
1737 		break;
1738 	}
1739 }
1740 
1741 /*
1742  * Add an address to the list of IP6 multicast addresses for a
1743  * given interface.
1744  */
1745 struct in6_multi *
1746 in6_addmulti(struct in6_addr *maddr6, struct ifnet *ifp, int *errorp)
1747 {
1748 	struct	in6_ifaddr *ia;
1749 	struct	in6_ifreq ifr;
1750 	struct	in6_multi *in6m;
1751 	int	s = splsoftnet();
1752 
1753 	*errorp = 0;
1754 	/*
1755 	 * See if address already in list.
1756 	 */
1757 	IN6_LOOKUP_MULTI(*maddr6, ifp, in6m);
1758 	if (in6m != NULL) {
1759 		/*
1760 		 * Found it; just increment the refrence count.
1761 		 */
1762 		in6m->in6m_refcount++;
1763 	} else {
1764 		/*
1765 		 * New address; allocate a new multicast record
1766 		 * and link it into the interface's multicast list.
1767 		 */
1768 		in6m = (struct in6_multi *)
1769 			malloc(sizeof(*in6m), M_IPMADDR, M_NOWAIT);
1770 		if (in6m == NULL) {
1771 			splx(s);
1772 			*errorp = ENOBUFS;
1773 			return (NULL);
1774 		}
1775 		in6m->in6m_addr = *maddr6;
1776 		in6m->in6m_ifp = ifp;
1777 		in6m->in6m_refcount = 1;
1778 		IFP_TO_IA6(ifp, ia);
1779 		if (ia == NULL) {
1780 			free(in6m, M_IPMADDR);
1781 			splx(s);
1782 			*errorp = EADDRNOTAVAIL; /* appropriate? */
1783 			return (NULL);
1784 		}
1785 		in6m->in6m_ia = ia;
1786 		ia->ia_ifa.ifa_refcnt++; /* gain a reference */
1787 		LIST_INSERT_HEAD(&ia->ia6_multiaddrs, in6m, in6m_entry);
1788 
1789 		/*
1790 		 * Ask the network driver to update its multicast reception
1791 		 * filter appropriately for the new address.
1792 		 */
1793 		bzero(&ifr.ifr_addr, sizeof(struct sockaddr_in6));
1794 		ifr.ifr_addr.sin6_len = sizeof(struct sockaddr_in6);
1795 		ifr.ifr_addr.sin6_family = AF_INET6;
1796 		ifr.ifr_addr.sin6_addr = *maddr6;
1797 		if (ifp->if_ioctl == NULL)
1798 			*errorp = ENXIO; /* XXX: appropriate? */
1799 		else
1800 			*errorp = (*ifp->if_ioctl)(ifp, SIOCADDMULTI,
1801 			    (caddr_t)&ifr);
1802 		if (*errorp) {
1803 			LIST_REMOVE(in6m, in6m_entry);
1804 			free(in6m, M_IPMADDR);
1805 			IFAFREE(&ia->ia_ifa);
1806 			splx(s);
1807 			return (NULL);
1808 		}
1809 		/*
1810 		 * Let MLD6 know that we have joined a new IP6 multicast
1811 		 * group.
1812 		 */
1813 		mld6_start_listening(in6m);
1814 	}
1815 	splx(s);
1816 	return (in6m);
1817 }
1818 
1819 /*
1820  * Delete a multicast address record.
1821  */
1822 void
1823 in6_delmulti(struct in6_multi *in6m)
1824 {
1825 	struct	in6_ifreq ifr;
1826 	int	s = splsoftnet();
1827 
1828 	if (--in6m->in6m_refcount == 0) {
1829 		/*
1830 		 * No remaining claims to this record; let MLD6 know
1831 		 * that we are leaving the multicast group.
1832 		 */
1833 		mld6_stop_listening(in6m);
1834 
1835 		/*
1836 		 * Unlink from list.
1837 		 */
1838 		LIST_REMOVE(in6m, in6m_entry);
1839 		if (in6m->in6m_ia) {
1840 			IFAFREE(&in6m->in6m_ia->ia_ifa); /* release reference */
1841 		}
1842 
1843 		/*
1844 		 * Notify the network driver to update its multicast
1845 		 * reception filter.
1846 		 */
1847 		bzero(&ifr.ifr_addr, sizeof(struct sockaddr_in6));
1848 		ifr.ifr_addr.sin6_len = sizeof(struct sockaddr_in6);
1849 		ifr.ifr_addr.sin6_family = AF_INET6;
1850 		ifr.ifr_addr.sin6_addr = in6m->in6m_addr;
1851 		(*in6m->in6m_ifp->if_ioctl)(in6m->in6m_ifp,
1852 					    SIOCDELMULTI, (caddr_t)&ifr);
1853 		free(in6m, M_IPMADDR);
1854 	}
1855 	splx(s);
1856 }
1857 
1858 struct in6_multi_mship *
1859 in6_joingroup(struct ifnet *ifp, struct in6_addr *addr, int *errorp)
1860 {
1861 	struct in6_multi_mship *imm;
1862 
1863 	imm = malloc(sizeof(*imm), M_IPMADDR, M_NOWAIT);
1864 	if (!imm) {
1865 		*errorp = ENOBUFS;
1866 		return NULL;
1867 	}
1868 	imm->i6mm_maddr = in6_addmulti(addr, ifp, errorp);
1869 	if (!imm->i6mm_maddr) {
1870 		/* *errorp is alrady set */
1871 		free(imm, M_IPMADDR);
1872 		return NULL;
1873 	}
1874 	return imm;
1875 }
1876 
1877 int
1878 in6_leavegroup(struct in6_multi_mship *imm)
1879 {
1880 
1881 	if (imm->i6mm_maddr)
1882 		in6_delmulti(imm->i6mm_maddr);
1883 	free(imm,  M_IPMADDR);
1884 	return 0;
1885 }
1886 
1887 /*
1888  * Find an IPv6 interface link-local address specific to an interface.
1889  */
1890 struct in6_ifaddr *
1891 in6ifa_ifpforlinklocal(struct ifnet *ifp, int ignoreflags)
1892 {
1893 	struct ifaddr *ifa;
1894 
1895 	TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) {
1896 		if (ifa->ifa_addr == NULL)
1897 			continue;	/* just for safety */
1898 		if (ifa->ifa_addr->sa_family != AF_INET6)
1899 			continue;
1900 		if (IN6_IS_ADDR_LINKLOCAL(IFA_IN6(ifa))) {
1901 			if ((((struct in6_ifaddr *)ifa)->ia6_flags &
1902 			     ignoreflags) != 0)
1903 				continue;
1904 			break;
1905 		}
1906 	}
1907 
1908 	return ((struct in6_ifaddr *)ifa);
1909 }
1910 
1911 
1912 /*
1913  * find the internet address corresponding to a given interface and address.
1914  */
1915 struct in6_ifaddr *
1916 in6ifa_ifpwithaddr(struct ifnet *ifp, struct in6_addr *addr)
1917 {
1918 	struct ifaddr *ifa;
1919 
1920 	TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) {
1921 		if (ifa->ifa_addr == NULL)
1922 			continue;	/* just for safety */
1923 		if (ifa->ifa_addr->sa_family != AF_INET6)
1924 			continue;
1925 		if (IN6_ARE_ADDR_EQUAL(addr, IFA_IN6(ifa)))
1926 			break;
1927 	}
1928 
1929 	return ((struct in6_ifaddr *)ifa);
1930 }
1931 
1932 /*
1933  * Check wether an interface has a prefix by looking up the cloning route.
1934  */
1935 int
1936 in6_ifpprefix(const struct ifnet *ifp, const struct in6_addr *addr)
1937 {
1938 	struct sockaddr_in6 dst;
1939 	struct rtentry *rt;
1940 	u_int tableid = 0;  /* XXX */
1941 
1942 	bzero(&dst, sizeof(dst));
1943 	dst.sin6_len = sizeof(struct sockaddr_in6);
1944 	dst.sin6_family = AF_INET6;
1945 	dst.sin6_addr = *addr;
1946 	rt = rtalloc1((struct sockaddr *)&dst, RT_NOCLONING, tableid);
1947 
1948 	if (rt == NULL)
1949 		return (0);
1950 	if ((rt->rt_flags & (RTF_CLONING | RTF_CLONED)) == 0 ||
1951 	    (rt->rt_ifp != ifp &&
1952 #if NBRIDGE > 0
1953 	    (rt->rt_ifp->if_bridge == NULL || ifp->if_bridge == NULL ||
1954 	    rt->rt_ifp->if_bridge != ifp->if_bridge) &&
1955 #endif
1956 #if NCARP > 0
1957 	    (ifp->if_type != IFT_CARP || rt->rt_ifp != ifp->if_carpdev) &&
1958 	    (rt->rt_ifp->if_type != IFT_CARP || rt->rt_ifp->if_carpdev != ifp)&&
1959 	    (ifp->if_type != IFT_CARP || rt->rt_ifp->if_type != IFT_CARP ||
1960 	    rt->rt_ifp->if_carpdev != ifp->if_carpdev) &&
1961 #endif
1962 	    1)) {
1963 		RTFREE(rt);
1964 		return (0);
1965 	}
1966 
1967 	RTFREE(rt);
1968 	return (1);
1969 }
1970 
1971 /*
1972  * Convert IP6 address to printable (loggable) representation.
1973  */
1974 static char digits[] = "0123456789abcdef";
1975 static int ip6round = 0;
1976 char *
1977 ip6_sprintf(struct in6_addr *addr)
1978 {
1979 	static char ip6buf[8][48];
1980 	int i;
1981 	char *cp;
1982 	u_short *a = (u_short *)addr;
1983 	u_char *d;
1984 	int dcolon = 0;
1985 
1986 	ip6round = (ip6round + 1) & 7;
1987 	cp = ip6buf[ip6round];
1988 
1989 	for (i = 0; i < 8; i++) {
1990 		if (dcolon == 1) {
1991 			if (*a == 0) {
1992 				if (i == 7)
1993 					*cp++ = ':';
1994 				a++;
1995 				continue;
1996 			} else
1997 				dcolon = 2;
1998 		}
1999 		if (*a == 0) {
2000 			if (dcolon == 0 && *(a + 1) == 0) {
2001 				if (i == 0)
2002 					*cp++ = ':';
2003 				*cp++ = ':';
2004 				dcolon = 1;
2005 			} else {
2006 				*cp++ = '0';
2007 				*cp++ = ':';
2008 			}
2009 			a++;
2010 			continue;
2011 		}
2012 		d = (u_char *)a;
2013 		*cp++ = digits[*d >> 4];
2014 		*cp++ = digits[*d++ & 0xf];
2015 		*cp++ = digits[*d >> 4];
2016 		*cp++ = digits[*d & 0xf];
2017 		*cp++ = ':';
2018 		a++;
2019 	}
2020 	*--cp = 0;
2021 	return (ip6buf[ip6round]);
2022 }
2023 
2024 /*
2025  * Get a scope of the address. Node-local, link-local, site-local or global.
2026  */
2027 int
2028 in6_addrscope(struct in6_addr *addr)
2029 {
2030 	int scope;
2031 
2032 	if (addr->s6_addr8[0] == 0xfe) {
2033 		scope = addr->s6_addr8[1] & 0xc0;
2034 
2035 		switch (scope) {
2036 		case 0x80:
2037 			return IPV6_ADDR_SCOPE_LINKLOCAL;
2038 			break;
2039 		case 0xc0:
2040 			return IPV6_ADDR_SCOPE_SITELOCAL;
2041 			break;
2042 		default:
2043 			return IPV6_ADDR_SCOPE_GLOBAL; /* just in case */
2044 			break;
2045 		}
2046 	}
2047 
2048 
2049 	if (addr->s6_addr8[0] == 0xff) {
2050 		scope = addr->s6_addr8[1] & 0x0f;
2051 
2052 		/*
2053 		 * due to other scope such as reserved,
2054 		 * return scope doesn't work.
2055 		 */
2056 		switch (scope) {
2057 		case IPV6_ADDR_SCOPE_INTFACELOCAL:
2058 			return IPV6_ADDR_SCOPE_INTFACELOCAL;
2059 			break;
2060 		case IPV6_ADDR_SCOPE_LINKLOCAL:
2061 			return IPV6_ADDR_SCOPE_LINKLOCAL;
2062 			break;
2063 		case IPV6_ADDR_SCOPE_SITELOCAL:
2064 			return IPV6_ADDR_SCOPE_SITELOCAL;
2065 			break;
2066 		default:
2067 			return IPV6_ADDR_SCOPE_GLOBAL;
2068 			break;
2069 		}
2070 	}
2071 
2072 	if (bcmp(&in6addr_loopback, addr, sizeof(*addr) - 1) == 0) {
2073 		if (addr->s6_addr8[15] == 1) /* loopback */
2074 			return IPV6_ADDR_SCOPE_INTFACELOCAL;
2075 		if (addr->s6_addr8[15] == 0) /* unspecified */
2076 			return IPV6_ADDR_SCOPE_LINKLOCAL;
2077 	}
2078 
2079 	return IPV6_ADDR_SCOPE_GLOBAL;
2080 }
2081 
2082 /*
2083  * ifp - must not be NULL
2084  * addr - must not be NULL
2085  */
2086 
2087 int
2088 in6_addr2scopeid(struct ifnet *ifp, struct in6_addr *addr)
2089 {
2090 	int scope = in6_addrscope(addr);
2091 
2092 	switch(scope) {
2093 	case IPV6_ADDR_SCOPE_INTFACELOCAL:
2094 	case IPV6_ADDR_SCOPE_LINKLOCAL:
2095 		/* XXX: we do not distinguish between a link and an I/F. */
2096 		return (ifp->if_index);
2097 
2098 	case IPV6_ADDR_SCOPE_SITELOCAL:
2099 		return (0);	/* XXX: invalid. */
2100 
2101 	default:
2102 		return (0);	/* XXX: treat as global. */
2103 	}
2104 }
2105 
2106 /*
2107  * return length of part which dst and src are equal
2108  * hard coding...
2109  */
2110 int
2111 in6_matchlen(struct in6_addr *src, struct in6_addr *dst)
2112 {
2113 	int match = 0;
2114 	u_char *s = (u_char *)src, *d = (u_char *)dst;
2115 	u_char *lim = s + 16, r;
2116 
2117 	while (s < lim)
2118 		if ((r = (*d++ ^ *s++)) != 0) {
2119 			while (r < 128) {
2120 				match++;
2121 				r <<= 1;
2122 			}
2123 			break;
2124 		} else
2125 			match += 8;
2126 	return match;
2127 }
2128 
2129 int
2130 in6_are_prefix_equal(struct in6_addr *p1, struct in6_addr *p2, int len)
2131 {
2132 	int bytelen, bitlen;
2133 
2134 	/* sanity check */
2135 	if (0 > len || len > 128) {
2136 		log(LOG_ERR, "in6_are_prefix_equal: invalid prefix length(%d)\n",
2137 		    len);
2138 		return (0);
2139 	}
2140 
2141 	bytelen = len / 8;
2142 	bitlen = len % 8;
2143 
2144 	if (bcmp(&p1->s6_addr, &p2->s6_addr, bytelen))
2145 		return (0);
2146 	/* len == 128 is ok because bitlen == 0 then */
2147 	if (bitlen != 0 &&
2148 	    p1->s6_addr[bytelen] >> (8 - bitlen) !=
2149 	    p2->s6_addr[bytelen] >> (8 - bitlen))
2150 		return (0);
2151 
2152 	return (1);
2153 }
2154 
2155 void
2156 in6_prefixlen2mask(struct in6_addr *maskp, int len)
2157 {
2158 	u_char maskarray[8] = {0x80, 0xc0, 0xe0, 0xf0, 0xf8, 0xfc, 0xfe, 0xff};
2159 	int bytelen, bitlen, i;
2160 
2161 	/* sanity check */
2162 	if (0 > len || len > 128) {
2163 		log(LOG_ERR, "in6_prefixlen2mask: invalid prefix length(%d)\n",
2164 		    len);
2165 		return;
2166 	}
2167 
2168 	bzero(maskp, sizeof(*maskp));
2169 	bytelen = len / 8;
2170 	bitlen = len % 8;
2171 	for (i = 0; i < bytelen; i++)
2172 		maskp->s6_addr[i] = 0xff;
2173 	/* len == 128 is ok because bitlen == 0 then */
2174 	if (bitlen)
2175 		maskp->s6_addr[bytelen] = maskarray[bitlen - 1];
2176 }
2177 
2178 /*
2179  * return the best address out of the same scope
2180  */
2181 struct in6_ifaddr *
2182 in6_ifawithscope(struct ifnet *oifp, struct in6_addr *dst)
2183 {
2184 	int dst_scope =	in6_addrscope(dst), src_scope, best_scope = 0;
2185 	int blen = -1;
2186 	struct ifaddr *ifa;
2187 	struct ifnet *ifp;
2188 	struct in6_ifaddr *ifa_best = NULL;
2189 
2190 	if (oifp == NULL) {
2191 		printf("in6_ifawithscope: output interface is not specified\n");
2192 		return (NULL);
2193 	}
2194 
2195 	/*
2196 	 * We search for all addresses on all interfaces from the beginning.
2197 	 * Comparing an interface with the outgoing interface will be done
2198 	 * only at the final stage of tiebreaking.
2199 	 */
2200 	for (ifp = TAILQ_FIRST(&ifnet); ifp; ifp = TAILQ_NEXT(ifp, if_list))
2201 	{
2202 		/*
2203 		 * We can never take an address that breaks the scope zone
2204 		 * of the destination.
2205 		 */
2206 		if (in6_addr2scopeid(ifp, dst) != in6_addr2scopeid(oifp, dst))
2207 			continue;
2208 
2209 		TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) {
2210 			int tlen = -1, dscopecmp, bscopecmp, matchcmp;
2211 
2212 			if (ifa->ifa_addr->sa_family != AF_INET6)
2213 				continue;
2214 
2215 			src_scope = in6_addrscope(IFA_IN6(ifa));
2216 
2217 #ifdef ADDRSELECT_DEBUG		/* should be removed after stabilization */
2218 			dscopecmp = IN6_ARE_SCOPE_CMP(src_scope, dst_scope);
2219 			printf("in6_ifawithscope: dst=%s bestaddr=%s, "
2220 			       "newaddr=%s, scope=%x, dcmp=%d, bcmp=%d, "
2221 			       "matchlen=%d, flgs=%x\n",
2222 			       ip6_sprintf(dst),
2223 			       ifa_best ? ip6_sprintf(&ifa_best->ia_addr.sin6_addr) : "none",
2224 			       ip6_sprintf(IFA_IN6(ifa)), src_scope,
2225 			       dscopecmp,
2226 			       ifa_best ? IN6_ARE_SCOPE_CMP(src_scope, best_scope) : -1,
2227 			       in6_matchlen(IFA_IN6(ifa), dst),
2228 			       ((struct in6_ifaddr *)ifa)->ia6_flags);
2229 #endif
2230 
2231 			/*
2232 			 * Don't use an address before completing DAD
2233 			 * nor a duplicated address.
2234 			 */
2235 			if (((struct in6_ifaddr *)ifa)->ia6_flags &
2236 			    IN6_IFF_NOTREADY)
2237 				continue;
2238 
2239 			/* XXX: is there any case to allow anycasts? */
2240 			if (((struct in6_ifaddr *)ifa)->ia6_flags &
2241 			    IN6_IFF_ANYCAST)
2242 				continue;
2243 
2244 			if (((struct in6_ifaddr *)ifa)->ia6_flags &
2245 			    IN6_IFF_DETACHED)
2246 				continue;
2247 
2248 			/*
2249 			 * If this is the first address we find,
2250 			 * keep it anyway.
2251 			 */
2252 			if (ifa_best == NULL)
2253 				goto replace;
2254 
2255 			/*
2256 			 * ifa_best is never NULL beyond this line except
2257 			 * within the block labeled "replace".
2258 			 */
2259 
2260 			/*
2261 			 * If ifa_best has a smaller scope than dst and
2262 			 * the current address has a larger one than
2263 			 * (or equal to) dst, always replace ifa_best.
2264 			 * Also, if the current address has a smaller scope
2265 			 * than dst, ignore it unless ifa_best also has a
2266 			 * smaller scope.
2267 			 */
2268 			if (IN6_ARE_SCOPE_CMP(best_scope, dst_scope) < 0 &&
2269 			    IN6_ARE_SCOPE_CMP(src_scope, dst_scope) >= 0)
2270 				goto replace;
2271 			if (IN6_ARE_SCOPE_CMP(src_scope, dst_scope) < 0 &&
2272 			    IN6_ARE_SCOPE_CMP(best_scope, dst_scope) >= 0)
2273 				continue;
2274 
2275 			/*
2276 			 * A deprecated address SHOULD NOT be used in new
2277 			 * communications if an alternate (non-deprecated)
2278 			 * address is available and has sufficient scope.
2279 			 * RFC 2462, Section 5.5.4.
2280 			 */
2281 			if (((struct in6_ifaddr *)ifa)->ia6_flags &
2282 			    IN6_IFF_DEPRECATED) {
2283 				/*
2284 				 * Ignore any deprecated addresses if
2285 				 * specified by configuration.
2286 				 */
2287 				if (!ip6_use_deprecated)
2288 					continue;
2289 
2290 				/*
2291 				 * If we have already found a non-deprecated
2292 				 * candidate, just ignore deprecated addresses.
2293 				 */
2294 				if ((ifa_best->ia6_flags & IN6_IFF_DEPRECATED)
2295 				    == 0)
2296 					continue;
2297 			}
2298 
2299 			/*
2300 			 * A non-deprecated address is always preferred
2301 			 * to a deprecated one regardless of scopes and
2302 			 * address matching.
2303 			 */
2304 			if ((ifa_best->ia6_flags & IN6_IFF_DEPRECATED) &&
2305 			    (((struct in6_ifaddr *)ifa)->ia6_flags &
2306 			     IN6_IFF_DEPRECATED) == 0)
2307 				goto replace;
2308 
2309 			if (oifp == ifp) {
2310 				/* Do not replace temporary autoconf addresses
2311 				 * with non-temporary addresses. */
2312 				if ((ifa_best->ia6_flags & IN6_IFF_PRIVACY) &&
2313 			            !(((struct in6_ifaddr *)ifa)->ia6_flags &
2314 				    IN6_IFF_PRIVACY))
2315 					continue;
2316 
2317 				/* Replace non-temporary autoconf addresses
2318 				 * with temporary addresses. */
2319 				if (!(ifa_best->ia6_flags & IN6_IFF_PRIVACY) &&
2320 			            (((struct in6_ifaddr *)ifa)->ia6_flags &
2321 				    IN6_IFF_PRIVACY))
2322 					goto replace;
2323 			}
2324 
2325 			/*
2326 			 * At this point, we have two cases:
2327 			 * 1. we are looking at a non-deprecated address,
2328 			 *    and ifa_best is also non-deprecated.
2329 			 * 2. we are looking at a deprecated address,
2330 			 *    and ifa_best is also deprecated.
2331 			 * Also, we do not have to consider a case where
2332 			 * the scope of if_best is larger(smaller) than dst and
2333 			 * the scope of the current address is smaller(larger)
2334 			 * than dst. Such a case has already been covered.
2335 			 * Tiebreaking is done according to the following
2336 			 * items:
2337 			 * - the scope comparison between the address and
2338 			 *   dst (dscopecmp)
2339 			 * - the scope comparison between the address and
2340 			 *   ifa_best (bscopecmp)
2341 			 * - if the address match dst longer than ifa_best
2342 			 *   (matchcmp)
2343 			 * - if the address is on the outgoing I/F (outI/F)
2344 			 *
2345 			 * Roughly speaking, the selection policy is
2346 			 * - the most important item is scope. The same scope
2347 			 *   is best. Then search for a larger scope.
2348 			 *   Smaller scopes are the last resort.
2349 			 * - A deprecated address is chosen only when we have
2350 			 *   no address that has an enough scope, but is
2351 			 *   prefered to any addresses of smaller scopes.
2352 			 * - Longest address match against dst is considered
2353 			 *   only for addresses that has the same scope of dst.
2354 			 * - If there is no other reasons to choose one,
2355 			 *   addresses on the outgoing I/F are preferred.
2356 			 *
2357 			 * The precise decision table is as follows:
2358 			 * dscopecmp bscopecmp matchcmp outI/F | replace?
2359 			 *    !equal     equal      N/A    Yes |      Yes (1)
2360 			 *    !equal     equal      N/A     No |       No (2)
2361 			 *    larger    larger      N/A    N/A |       No (3)
2362 			 *    larger   smaller      N/A    N/A |      Yes (4)
2363 			 *   smaller    larger      N/A    N/A |      Yes (5)
2364 			 *   smaller   smaller      N/A    N/A |       No (6)
2365 			 *     equal   smaller      N/A    N/A |      Yes (7)
2366 			 *     equal    larger       (already done)
2367 			 *     equal     equal   larger    N/A |      Yes (8)
2368 			 *     equal     equal  smaller    N/A |       No (9)
2369 			 *     equal     equal    equal    Yes |      Yes (a)
2370 			 *     equal     equal    equal     No |       No (b)
2371 			 */
2372 			dscopecmp = IN6_ARE_SCOPE_CMP(src_scope, dst_scope);
2373 			bscopecmp = IN6_ARE_SCOPE_CMP(src_scope, best_scope);
2374 
2375 			if (dscopecmp && bscopecmp == 0) {
2376 				if (oifp == ifp) /* (1) */
2377 					goto replace;
2378 				continue; /* (2) */
2379 			}
2380 			if (dscopecmp > 0) {
2381 				if (bscopecmp > 0) /* (3) */
2382 					continue;
2383 				goto replace; /* (4) */
2384 			}
2385 			if (dscopecmp < 0) {
2386 				if (bscopecmp > 0) /* (5) */
2387 					goto replace;
2388 				continue; /* (6) */
2389 			}
2390 
2391 			/* now dscopecmp must be 0 */
2392 			if (bscopecmp < 0)
2393 				goto replace; /* (7) */
2394 
2395 			/*
2396 			 * At last both dscopecmp and bscopecmp must be 0.
2397 			 * We need address matching against dst for
2398 			 * tiebreaking.
2399 			 */
2400 			tlen = in6_matchlen(IFA_IN6(ifa), dst);
2401 			matchcmp = tlen - blen;
2402 			if (matchcmp > 0) /* (8) */
2403 				goto replace;
2404 			if (matchcmp < 0) /* (9) */
2405 				continue;
2406 			if (oifp == ifp) /* (a) */
2407 				goto replace;
2408 			continue; /* (b) */
2409 
2410 		  replace:
2411 			ifa_best = (struct in6_ifaddr *)ifa;
2412 			blen = tlen >= 0 ? tlen :
2413 				in6_matchlen(IFA_IN6(ifa), dst);
2414 			best_scope = in6_addrscope(&ifa_best->ia_addr.sin6_addr);
2415 		}
2416 	}
2417 
2418 	/* count statistics for future improvements */
2419 	if (ifa_best == NULL)
2420 		ip6stat.ip6s_sources_none++;
2421 	else {
2422 		if (oifp == ifa_best->ia_ifp)
2423 			ip6stat.ip6s_sources_sameif[best_scope]++;
2424 		else
2425 			ip6stat.ip6s_sources_otherif[best_scope]++;
2426 
2427 		if (best_scope == dst_scope)
2428 			ip6stat.ip6s_sources_samescope[best_scope]++;
2429 		else
2430 			ip6stat.ip6s_sources_otherscope[best_scope]++;
2431 
2432 		if ((ifa_best->ia6_flags & IN6_IFF_DEPRECATED) != 0)
2433 			ip6stat.ip6s_sources_deprecated[best_scope]++;
2434 	}
2435 
2436 	return (ifa_best);
2437 }
2438 
2439 /*
2440  * perform DAD when interface becomes IFF_UP.
2441  */
2442 void
2443 in6_if_up(struct ifnet *ifp)
2444 {
2445 	struct ifaddr *ifa;
2446 	struct in6_ifaddr *ia;
2447 	int dad_delay;		/* delay ticks before DAD output */
2448 
2449 	/*
2450 	 * special cases, like 6to4, are handled in in6_ifattach
2451 	 */
2452 	in6_ifattach(ifp, NULL);
2453 
2454 	dad_delay = 0;
2455 	TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) {
2456 		if (ifa->ifa_addr->sa_family != AF_INET6)
2457 			continue;
2458 		ia = (struct in6_ifaddr *)ifa;
2459 		if (ia->ia6_flags & IN6_IFF_TENTATIVE)
2460 			nd6_dad_start(ifa, &dad_delay);
2461 	}
2462 }
2463 
2464 int
2465 in6if_do_dad(struct ifnet *ifp)
2466 {
2467 	if ((ifp->if_flags & IFF_LOOPBACK) != 0)
2468 		return (0);
2469 
2470 	switch (ifp->if_type) {
2471 	case IFT_FAITH:
2472 		/*
2473 		 * These interfaces do not have the IFF_LOOPBACK flag,
2474 		 * but loop packets back.  We do not have to do DAD on such
2475 		 * interfaces.  We should even omit it, because loop-backed
2476 		 * NS would confuse the DAD procedure.
2477 		 */
2478 		return (0);
2479 	default:
2480 		/*
2481 		 * Our DAD routine requires the interface up and running.
2482 		 * However, some interfaces can be up before the RUNNING
2483 		 * status.  Additionaly, users may try to assign addresses
2484 		 * before the interface becomes up (or running).
2485 		 * We simply skip DAD in such a case as a work around.
2486 		 * XXX: we should rather mark "tentative" on such addresses,
2487 		 * and do DAD after the interface becomes ready.
2488 		 */
2489 		if ((ifp->if_flags & (IFF_UP|IFF_RUNNING)) !=
2490 		    (IFF_UP|IFF_RUNNING))
2491 			return (0);
2492 
2493 		return (1);
2494 	}
2495 }
2496 
2497 /*
2498  * Calculate max IPv6 MTU through all the interfaces and store it
2499  * to in6_maxmtu.
2500  */
2501 void
2502 in6_setmaxmtu(void)
2503 {
2504 	unsigned long maxmtu = 0;
2505 	struct ifnet *ifp;
2506 
2507 	for (ifp = TAILQ_FIRST(&ifnet); ifp; ifp = TAILQ_NEXT(ifp, if_list))
2508 	{
2509 		/* this function can be called during ifnet initialization */
2510 		if (!ifp->if_afdata[AF_INET6])
2511 			continue;
2512 		if ((ifp->if_flags & IFF_LOOPBACK) == 0 &&
2513 		    IN6_LINKMTU(ifp) > maxmtu)
2514 			maxmtu = IN6_LINKMTU(ifp);
2515 	}
2516 	if (maxmtu)	     /* update only when maxmtu is positive */
2517 		in6_maxmtu = maxmtu;
2518 }
2519 
2520 void *
2521 in6_domifattach(struct ifnet *ifp)
2522 {
2523 	struct in6_ifextra *ext;
2524 
2525 	ext = malloc(sizeof(*ext), M_IFADDR, M_WAITOK | M_ZERO);
2526 
2527 	ext->in6_ifstat = malloc(sizeof(*ext->in6_ifstat), M_IFADDR,
2528 	    M_WAITOK | M_ZERO);
2529 
2530 	ext->icmp6_ifstat = malloc(sizeof(*ext->icmp6_ifstat), M_IFADDR,
2531 	    M_WAITOK | M_ZERO);
2532 
2533 	ext->nd_ifinfo = nd6_ifattach(ifp);
2534 	ext->nprefixes = 0;
2535 	ext->ndefrouters = 0;
2536 	return ext;
2537 }
2538 
2539 void
2540 in6_domifdetach(struct ifnet *ifp, void *aux)
2541 {
2542 	struct in6_ifextra *ext = (struct in6_ifextra *)aux;
2543 
2544 	nd6_ifdetach(ext->nd_ifinfo);
2545 	free(ext->in6_ifstat, M_IFADDR);
2546 	free(ext->icmp6_ifstat, M_IFADDR);
2547 	free(ext, M_IFADDR);
2548 }
2549