xref: /onnv/onnv-gate/usr/src/uts/common/inet/ip/ip6_ire.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */
/*
 * Copyright (c) 1990 Mentat Inc.
 */

#pragma ident	"%Z%%M%	%I%	%E% SMI"

/*
 * This file contains routines that manipulate Internet Routing Entries (IREs).
 */
#include <sys/types.h>
#include <sys/stream.h>
#include <sys/stropts.h>
#include <sys/ddi.h>
#include <sys/cmn_err.h>

#include <sys/systm.h>
#include <sys/param.h>
#include <sys/socket.h>
#include <net/if.h>
#include <net/route.h>
#include <netinet/in.h>
#include <net/if_dl.h>
#include <netinet/ip6.h>
#include <netinet/icmp6.h>

#include <inet/common.h>
#include <inet/mi.h>
#include <inet/ip.h>
#include <inet/ip6.h>
#include <inet/ip_ndp.h>
#include <inet/ip_if.h>
#include <inet/ip_ire.h>
#include <inet/ipclassifier.h>
#include <inet/nd.h>
#include <sys/kmem.h>
#include <sys/zone.h>

#include <sys/tsol/label.h>
#include <sys/tsol/tnet.h>

static	ire_t	ire_null;

static ire_t	*ire_ihandle_lookup_onlink_v6(ire_t *cire);
static boolean_t ire_match_args_v6(ire_t *ire, const in6_addr_t *addr,
    const in6_addr_t *mask, const in6_addr_t *gateway, int type,
    const ipif_t *ipif, zoneid_t zoneid, uint32_t ihandle,
    const ts_label_t *tsl, int match_flags);
static	ire_t	*ire_init_v6(ire_t *, const in6_addr_t *, const in6_addr_t *,
    const in6_addr_t *, const in6_addr_t *, uint_t *, queue_t *, queue_t *,
    ushort_t, ipif_t *, const in6_addr_t *, uint32_t, uint32_t, uint_t,
    const iulp_t *, tsol_gc_t *, tsol_gcgrp_t *, ip_stack_t *);


/*
 * Initialize the ire that is specific to IPv6 part and call
 * ire_init_common to finish it.
 */
static ire_t *
ire_init_v6(ire_t *ire, const in6_addr_t *v6addr, const in6_addr_t *v6mask,
    const in6_addr_t *v6src_addr, const in6_addr_t *v6gateway,
    uint_t *max_fragp, queue_t *rfq, queue_t *stq, ushort_t type,
    ipif_t *ipif, const in6_addr_t *v6cmask, uint32_t phandle,
    uint32_t ihandle, uint_t flags, const iulp_t *ulp_info, tsol_gc_t *gc,
    tsol_gcgrp_t *gcgrp, ip_stack_t *ipst)
{

	/*
	 * Reject IRE security attribute creation/initialization
	 * if system is not running in Trusted mode.
	 */
	if ((gc != NULL || gcgrp != NULL) && !is_system_labeled())
		return (NULL);


	BUMP_IRE_STATS(ipst->ips_ire_stats_v6, ire_stats_alloced);
	ire->ire_addr_v6 = *v6addr;

	if (v6src_addr != NULL)
		ire->ire_src_addr_v6 = *v6src_addr;
	if (v6mask != NULL) {
		ire->ire_mask_v6 = *v6mask;
		ire->ire_masklen = ip_mask_to_plen_v6(&ire->ire_mask_v6);
	}
	if (v6gateway != NULL)
		ire->ire_gateway_addr_v6 = *v6gateway;

	if (type == IRE_CACHE && v6cmask != NULL)
		ire->ire_cmask_v6 = *v6cmask;

	/*
	 * Multirouted packets need to have a fragment header added so that
	 * the receiver is able to discard duplicates according to their
	 * fragment identifier.
	 */
	if (type == IRE_CACHE && (flags & RTF_MULTIRT)) {
		ire->ire_frag_flag = IPH_FRAG_HDR;
	}

	/* ire_init_common will free the mblks upon encountering any failure */
	if (!ire_init_common(ire, max_fragp, NULL, rfq, stq, type, ipif,
	    phandle, ihandle, flags, IPV6_VERSION, ulp_info, gc, gcgrp, ipst))
		return (NULL);

	return (ire);
}

/*
 * Similar to ire_create_v6 except that it is called only when
 * we want to allocate ire as an mblk e.g. we have a external
 * resolver. Do we need this in IPv6 ?
 *
 * IPv6 initializes the ire_nce in ire_add_v6, which expects to
 * find the ire_nce to be null when it is called. So, although
 * we have a src_nce parameter (in the interest of matching up with
 * the argument list of the v4 version), we ignore the src_nce
 * argument here.
 */
/* ARGSUSED */
ire_t *
ire_create_mp_v6(const in6_addr_t *v6addr, const in6_addr_t *v6mask,
    const in6_addr_t *v6src_addr, const in6_addr_t *v6gateway,
    nce_t *src_nce, queue_t *rfq, queue_t *stq, ushort_t type,
    ipif_t *ipif, const in6_addr_t *v6cmask,
    uint32_t phandle, uint32_t ihandle, uint_t flags, const iulp_t *ulp_info,
    tsol_gc_t *gc, tsol_gcgrp_t *gcgrp, ip_stack_t *ipst)
{
	ire_t	*ire;
	ire_t	*ret_ire;
	mblk_t	*mp;

	ASSERT(!IN6_IS_ADDR_V4MAPPED(v6addr));

	/* Allocate the new IRE. */
	mp = allocb(sizeof (ire_t), BPRI_MED);
	if (mp == NULL) {
		ip1dbg(("ire_create_mp_v6: alloc failed\n"));
		return (NULL);
	}

	ire = (ire_t *)mp->b_rptr;
	mp->b_wptr = (uchar_t *)&ire[1];

	/* Start clean. */
	*ire = ire_null;
	ire->ire_mp = mp;
	mp->b_datap->db_type = IRE_DB_TYPE;

	ret_ire = ire_init_v6(ire, v6addr, v6mask, v6src_addr, v6gateway,
	    NULL, rfq, stq, type, ipif, v6cmask, phandle,
	    ihandle, flags, ulp_info, gc, gcgrp, ipst);

	if (ret_ire == NULL) {
		freeb(ire->ire_mp);
		return (NULL);
	}
	return (ire);
}

/*
 * ire_create_v6 is called to allocate and initialize a new IRE.
 *
 * NOTE : This is called as writer sometimes though not required
 * by this function.
 *
 * See comments above ire_create_mp_v6() for the rationale behind the
 * unused src_nce argument.
 */
/* ARGSUSED */
ire_t *
ire_create_v6(const in6_addr_t *v6addr, const in6_addr_t *v6mask,
    const in6_addr_t *v6src_addr, const in6_addr_t *v6gateway,
    uint_t *max_fragp, nce_t *src_nce, queue_t *rfq, queue_t *stq,
    ushort_t type, ipif_t *ipif, const in6_addr_t *v6cmask,
    uint32_t phandle, uint32_t ihandle, uint_t flags, const iulp_t *ulp_info,
    tsol_gc_t *gc, tsol_gcgrp_t *gcgrp, ip_stack_t *ipst)
{
	ire_t	*ire;
	ire_t	*ret_ire;

	ASSERT(!IN6_IS_ADDR_V4MAPPED(v6addr));

	ire = kmem_cache_alloc(ire_cache, KM_NOSLEEP);
	if (ire == NULL) {
		ip1dbg(("ire_create_v6: alloc failed\n"));
		return (NULL);
	}
	*ire = ire_null;

	ret_ire = ire_init_v6(ire, v6addr, v6mask, v6src_addr, v6gateway,
	    max_fragp, rfq, stq, type, ipif, v6cmask, phandle,
	    ihandle, flags, ulp_info, gc, gcgrp, ipst);

	if (ret_ire == NULL) {
		kmem_cache_free(ire_cache, ire);
		return (NULL);
	}
	ASSERT(ret_ire == ire);
	return (ire);
}

/*
 * Find an IRE_INTERFACE for the multicast group.
 * Allows different routes for multicast addresses
 * in the unicast routing table (akin to FF::0/8 but could be more specific)
 * which point at different interfaces. This is used when IPV6_MULTICAST_IF
 * isn't specified (when sending) and when IPV6_JOIN_GROUP doesn't
 * specify the interface to join on.
 *
 * Supports link-local addresses by following the ipif/ill when recursing.
 */
ire_t *
ire_lookup_multi_v6(const in6_addr_t *group, zoneid_t zoneid, ip_stack_t *ipst)
{
	ire_t	*ire;
	ipif_t	*ipif = NULL;
	int	match_flags = MATCH_IRE_TYPE;
	in6_addr_t gw_addr_v6;

	ire = ire_ftable_lookup_v6(group, 0, 0, 0, NULL, NULL,
	    zoneid, 0, NULL, MATCH_IRE_DEFAULT, ipst);

	/* We search a resolvable ire in case of multirouting. */
	if ((ire != NULL) && (ire->ire_flags & RTF_MULTIRT)) {
		ire_t *cire = NULL;
		/*
		 * If the route is not resolvable, the looked up ire
		 * may be changed here. In that case, ire_multirt_lookup()
		 * IRE_REFRELE the original ire and change it.
		 */
		(void) ire_multirt_lookup_v6(&cire, &ire, MULTIRT_CACHEGW,
		    NULL, ipst);
		if (cire != NULL)
			ire_refrele(cire);
	}
	if (ire == NULL)
		return (NULL);
	/*
	 * Make sure we follow ire_ipif.
	 *
	 * We need to determine the interface route through
	 * which the gateway will be reached. We don't really
	 * care which interface is picked if the interface is
	 * part of a group.
	 */
	if (ire->ire_ipif != NULL) {
		ipif = ire->ire_ipif;
		match_flags |= MATCH_IRE_ILL_GROUP;
	}

	switch (ire->ire_type) {
	case IRE_DEFAULT:
	case IRE_PREFIX:
	case IRE_HOST:
		mutex_enter(&ire->ire_lock);
		gw_addr_v6 = ire->ire_gateway_addr_v6;
		mutex_exit(&ire->ire_lock);
		ire_refrele(ire);
		ire = ire_ftable_lookup_v6(&gw_addr_v6, 0, 0,
		    IRE_INTERFACE, ipif, NULL, zoneid, 0,
		    NULL, match_flags, ipst);
		return (ire);
	case IRE_IF_NORESOLVER:
	case IRE_IF_RESOLVER:
		return (ire);
	default:
		ire_refrele(ire);
		return (NULL);
	}
}

/*
 * Return any local address.  We use this to target ourselves
 * when the src address was specified as 'default'.
 * Preference for IRE_LOCAL entries.
 */
ire_t *
ire_lookup_local_v6(zoneid_t zoneid, ip_stack_t *ipst)
{
	ire_t	*ire;
	irb_t	*irb;
	ire_t	*maybe = NULL;
	int i;

	for (i = 0; i < ipst->ips_ip6_cache_table_size;  i++) {
		irb = &ipst->ips_ip_cache_table_v6[i];
		if (irb->irb_ire == NULL)
			continue;
		rw_enter(&irb->irb_lock, RW_READER);
		for (ire = irb->irb_ire; ire; ire = ire->ire_next) {
			if ((ire->ire_marks & IRE_MARK_CONDEMNED) ||
			    ire->ire_zoneid != zoneid &&
			    ire->ire_zoneid != ALL_ZONES)
				continue;
			switch (ire->ire_type) {
			case IRE_LOOPBACK:
				if (maybe == NULL) {
					IRE_REFHOLD(ire);
					maybe = ire;
				}
				break;
			case IRE_LOCAL:
				if (maybe != NULL) {
					ire_refrele(maybe);
				}
				IRE_REFHOLD(ire);
				rw_exit(&irb->irb_lock);
				return (ire);
			}
		}
		rw_exit(&irb->irb_lock);
	}
	return (maybe);
}

/*
 * This function takes a mask and returns number of bits set in the
 * mask (the represented prefix length).  Assumes a contiguous mask.
 */
int
ip_mask_to_plen_v6(const in6_addr_t *v6mask)
{
	int		bits;
	int		plen = IPV6_ABITS;
	int		i;

	for (i = 3; i >= 0; i--) {
		if (v6mask->s6_addr32[i] == 0) {
			plen -= 32;
			continue;
		}
		bits = ffs(ntohl(v6mask->s6_addr32[i])) - 1;
		if (bits == 0)
			break;
		plen -= bits;
	}

	return (plen);
}

/*
 * Convert a prefix length to the mask for that prefix.
 * Returns the argument bitmask.
 */
in6_addr_t *
ip_plen_to_mask_v6(uint_t plen, in6_addr_t *bitmask)
{
	uint32_t *ptr;

	if (plen < 0 || plen > IPV6_ABITS)
		return (NULL);
	*bitmask = ipv6_all_zeros;

	ptr = (uint32_t *)bitmask;
	while (plen > 32) {
		*ptr++ = 0xffffffffU;
		plen -= 32;
	}
	*ptr = htonl(0xffffffffU << (32 - plen));
	return (bitmask);
}

/*
 * Add a fully initialized IRE to an appropriate
 * table based on ire_type.
 *
 * The forward table contains IRE_PREFIX/IRE_HOST/IRE_HOST and
 * IRE_IF_RESOLVER/IRE_IF_NORESOLVER and IRE_DEFAULT.
 *
 * The cache table contains IRE_BROADCAST/IRE_LOCAL/IRE_LOOPBACK
 * and IRE_CACHE.
 *
 * NOTE : This function is called as writer though not required
 * by this function.
 */
int
ire_add_v6(ire_t **ire_p, queue_t *q, mblk_t *mp, ipsq_func_t func)
{
	ire_t	*ire1;
	int	mask_table_index;
	irb_t	*irb_ptr;
	ire_t	**irep;
	int	flags;
	ire_t	*pire = NULL;
	ill_t	*stq_ill;
	boolean_t	ndp_g_lock_held = B_FALSE;
	ire_t	*ire = *ire_p;
	int	error;
	ip_stack_t	*ipst = ire->ire_ipst;

	ASSERT(ire->ire_ipversion == IPV6_VERSION);
	ASSERT(ire->ire_mp == NULL); /* Calls should go through ire_add */
	ASSERT(ire->ire_nce == NULL);

	/* Find the appropriate list head. */
	switch (ire->ire_type) {
	case IRE_HOST:
		ire->ire_mask_v6 = ipv6_all_ones;
		ire->ire_masklen = IPV6_ABITS;
		if ((ire->ire_flags & RTF_SETSRC) == 0)
			ire->ire_src_addr_v6 = ipv6_all_zeros;
		break;
	case IRE_CACHE:
	case IRE_LOCAL:
	case IRE_LOOPBACK:
		ire->ire_mask_v6 = ipv6_all_ones;
		ire->ire_masklen = IPV6_ABITS;
		break;
	case IRE_PREFIX:
		if ((ire->ire_flags & RTF_SETSRC) == 0)
			ire->ire_src_addr_v6 = ipv6_all_zeros;
		break;
	case IRE_DEFAULT:
		if ((ire->ire_flags & RTF_SETSRC) == 0)
			ire->ire_src_addr_v6 = ipv6_all_zeros;
		break;
	case IRE_IF_RESOLVER:
	case IRE_IF_NORESOLVER:
		break;
	default:
		printf("ire_add_v6: ire %p has unrecognized IRE type (%d)\n",
		    (void *)ire, ire->ire_type);
		ire_delete(ire);
		*ire_p = NULL;
		return (EINVAL);
	}

	/* Make sure the address is properly masked. */
	V6_MASK_COPY(ire->ire_addr_v6, ire->ire_mask_v6, ire->ire_addr_v6);

	if ((ire->ire_type & IRE_CACHETABLE) == 0) {
		/* IRE goes into Forward Table */
		mask_table_index = ip_mask_to_plen_v6(&ire->ire_mask_v6);
		if ((ipst->ips_ip_forwarding_table_v6[mask_table_index]) ==
		    NULL) {
			irb_t *ptr;
			int i;

			ptr = (irb_t *)mi_zalloc((
			    ipst->ips_ip6_ftable_hash_size * sizeof (irb_t)));
			if (ptr == NULL) {
				ire_delete(ire);
				*ire_p = NULL;
				return (ENOMEM);
			}
			for (i = 0; i < ipst->ips_ip6_ftable_hash_size; i++) {
				rw_init(&ptr[i].irb_lock, NULL,
				    RW_DEFAULT, NULL);
			}
			mutex_enter(&ipst->ips_ire_ft_init_lock);
			if (ipst->ips_ip_forwarding_table_v6[
			    mask_table_index] == NULL) {
				ipst->ips_ip_forwarding_table_v6[
				    mask_table_index] = ptr;
				mutex_exit(&ipst->ips_ire_ft_init_lock);
			} else {
				/*
				 * Some other thread won the race in
				 * initializing the forwarding table at the
				 * same index.
				 */
				mutex_exit(&ipst->ips_ire_ft_init_lock);
				for (i = 0; i < ipst->ips_ip6_ftable_hash_size;
				    i++) {
					rw_destroy(&ptr[i].irb_lock);
				}
				mi_free(ptr);
			}
		}
		irb_ptr = &(ipst->ips_ip_forwarding_table_v6[mask_table_index][
		    IRE_ADDR_MASK_HASH_V6(ire->ire_addr_v6, ire->ire_mask_v6,
		    ipst->ips_ip6_ftable_hash_size)]);
	} else {
		irb_ptr = &(ipst->ips_ip_cache_table_v6[IRE_ADDR_HASH_V6(
		    ire->ire_addr_v6, ipst->ips_ip6_cache_table_size)]);
	}
	/*
	 * For xresolv interfaces (v6 interfaces with an external
	 * address resolver), ip_newroute_v6/ip_newroute_ipif_v6
	 * are unable to prevent the deletion of the interface route
	 * while adding an IRE_CACHE for an on-link destination
	 * in the IRE_IF_RESOLVER case, since the ire has to go to
	 * the external resolver and return. We can't do a REFHOLD on the
	 * associated interface ire for fear of the message being freed
	 * if the external resolver can't resolve the address.
	 * Here we look up the interface ire in the forwarding table
	 * and make sure that the interface route has not been deleted.
	 */
	if (ire->ire_type == IRE_CACHE &&
	    IN6_IS_ADDR_UNSPECIFIED(&ire->ire_gateway_addr_v6) &&
	    (((ill_t *)ire->ire_stq->q_ptr)->ill_net_type == IRE_IF_RESOLVER) &&
	    (((ill_t *)ire->ire_stq->q_ptr)->ill_flags & ILLF_XRESOLV)) {

		pire = ire_ihandle_lookup_onlink_v6(ire);
		if (pire == NULL) {
			ire_delete(ire);
			*ire_p = NULL;
			return (EINVAL);
		}
		/* Prevent pire from getting deleted */
		IRB_REFHOLD(pire->ire_bucket);
		/* Has it been removed already? */
		if (pire->ire_marks & IRE_MARK_CONDEMNED) {
			IRB_REFRELE(pire->ire_bucket);
			ire_refrele(pire);
			ire_delete(ire);
			*ire_p = NULL;
			return (EINVAL);
		}
	}

	flags = (MATCH_IRE_MASK | MATCH_IRE_TYPE | MATCH_IRE_GW);
	/*
	 * For IRE_CACHES, MATCH_IRE_IPIF is not enough to check
	 * for duplicates because :
	 *
	 * 1) ire_ipif->ipif_ill and ire_stq->q_ptr could be
	 *    pointing at different ills. A real duplicate is
	 *    a match on both ire_ipif and ire_stq.
	 *
	 * 2) We could have multiple packets trying to create
	 *    an IRE_CACHE for the same ill.
	 *
	 * Moreover, IPIF_NOFAILOVER and IPV6_BOUND_PIF endpoints wants
	 * to go out on a particular ill. Rather than looking at the
	 * packet, we depend on the above for MATCH_IRE_ILL here.
	 *
	 * Unlike IPv4, MATCH_IRE_IPIF is needed here as we could have
	 * multiple IRE_CACHES for an ill for the same destination
	 * with various scoped addresses i.e represented by ipifs.
	 *
	 * MATCH_IRE_ILL is done implicitly below for IRE_CACHES.
	 */
	if (ire->ire_ipif != NULL)
		flags |= MATCH_IRE_IPIF;
	/*
	 * If we are creating hidden ires, make sure we search on
	 * this ill (MATCH_IRE_ILL) and a hidden ire, while we are
	 * searching for duplicates below. Otherwise we could
	 * potentially find an IRE on some other interface
	 * and it may not be a IRE marked with IRE_MARK_HIDDEN. We
	 * shouldn't do this as this will lead to an infinite loop as
	 * eventually we need an hidden ire for this packet to go
	 * out. MATCH_IRE_ILL is already marked above.
	 */
	if (ire->ire_marks & IRE_MARK_HIDDEN) {
		ASSERT(ire->ire_type == IRE_CACHE);
		flags |= MATCH_IRE_MARK_HIDDEN;
	}

	/*
	 * Start the atomic add of the ire. Grab the ill locks,
	 * ill_g_usesrc_lock and the bucket lock. Check for condemned.
	 * To avoid lock order problems, get the ndp6.ndp_g_lock now itself.
	 */
	if (ire->ire_type == IRE_CACHE) {
		mutex_enter(&ipst->ips_ndp6->ndp_g_lock);
		ndp_g_lock_held = B_TRUE;
	}

	/*
	 * If ipif or ill is changing ire_atomic_start() may queue the
	 * request and return EINPROGRESS.
	 */

	error = ire_atomic_start(irb_ptr, ire, q, mp, func);
	if (error != 0) {
		if (ndp_g_lock_held)
			mutex_exit(&ipst->ips_ndp6->ndp_g_lock);
		/*
		 * We don't know whether it is a valid ipif or not.
		 * So, set it to NULL. This assumes that the ire has not added
		 * a reference to the ipif.
		 */
		ire->ire_ipif = NULL;
		ire_delete(ire);
		if (pire != NULL) {
			IRB_REFRELE(pire->ire_bucket);
			ire_refrele(pire);
		}
		*ire_p = NULL;
		return (error);
	}
	/*
	 * To avoid creating ires having stale values for the ire_max_frag
	 * we get the latest value atomically here. For more details
	 * see the block comment in ip_sioctl_mtu and in DL_NOTE_SDU_CHANGE
	 * in ip_rput_dlpi_writer
	 */
	if (ire->ire_max_fragp == NULL) {
		if (IN6_IS_ADDR_MULTICAST(&ire->ire_addr_v6))
			ire->ire_max_frag = ire->ire_ipif->ipif_mtu;
		else
			ire->ire_max_frag = pire->ire_max_frag;
	} else {
		uint_t  max_frag;

		max_frag = *ire->ire_max_fragp;
		ire->ire_max_fragp = NULL;
		ire->ire_max_frag = max_frag;
	}

	/*
	 * Atomically check for duplicate and insert in the table.
	 */
	for (ire1 = irb_ptr->irb_ire; ire1 != NULL; ire1 = ire1->ire_next) {
		if (ire1->ire_marks & IRE_MARK_CONDEMNED)
			continue;

		if (ire->ire_type == IRE_CACHE) {
			/*
			 * We do MATCH_IRE_ILL implicitly here for IRE_CACHES.
			 * As ire_ipif and ire_stq could point to two
			 * different ills, we can't pass just ire_ipif to
			 * ire_match_args and get a match on both ills.
			 * This is just needed for duplicate checks here and
			 * so we don't add an extra argument to
			 * ire_match_args for this. Do it locally.
			 *
			 * NOTE : Currently there is no part of the code
			 * that asks for both MATH_IRE_IPIF and MATCH_IRE_ILL
			 * match for IRE_CACHEs. Thus we don't want to
			 * extend the arguments to ire_match_args_v6.
			 */
			if (ire1->ire_stq != ire->ire_stq)
				continue;
			/*
			 * Multiroute IRE_CACHEs for a given destination can
			 * have the same ire_ipif, typically if their source
			 * address is forced using RTF_SETSRC, and the same
			 * send-to queue. We differentiate them using the parent
			 * handle.
			 */
			if ((ire1->ire_flags & RTF_MULTIRT) &&
			    (ire->ire_flags & RTF_MULTIRT) &&
			    (ire1->ire_phandle != ire->ire_phandle))
				continue;
		}
		if (ire1->ire_zoneid != ire->ire_zoneid)
			continue;
		if (ire_match_args_v6(ire1, &ire->ire_addr_v6,
		    &ire->ire_mask_v6, &ire->ire_gateway_addr_v6,
		    ire->ire_type, ire->ire_ipif, ire->ire_zoneid, 0, NULL,
		    flags)) {
			/*
			 * Return the old ire after doing a REFHOLD.
			 * As most of the callers continue to use the IRE
			 * after adding, we return a held ire. This will
			 * avoid a lookup in the caller again. If the callers
			 * don't want to use it, they need to do a REFRELE.
			 */
			ip1dbg(("found dup ire existing %p new %p",
			    (void *)ire1, (void *)ire));
			IRE_REFHOLD(ire1);
			if (ndp_g_lock_held)
				mutex_exit(&ipst->ips_ndp6->ndp_g_lock);
			ire_atomic_end(irb_ptr, ire);
			ire_delete(ire);
			if (pire != NULL) {
				/*
				 * Assert that it is
				 * not yet removed from the list.
				 */
				ASSERT(pire->ire_ptpn != NULL);
				IRB_REFRELE(pire->ire_bucket);
				ire_refrele(pire);
			}
			*ire_p = ire1;
			return (0);
		}
	}
	if (ire->ire_type == IRE_CACHE) {
		in6_addr_t gw_addr_v6;
		ill_t	*ill = ire_to_ill(ire);
		char	buf[INET6_ADDRSTRLEN];
		nce_t	*nce;

		/*
		 * All IRE_CACHE types must have a nce.  If this is
		 * not the case the entry will not be added. We need
		 * to make sure that if somebody deletes the nce
		 * after we looked up, they will find this ire and
		 * delete the ire. To delete this ire one needs the
		 * bucket lock which we are still holding here. So,
		 * even if the nce gets deleted after we looked up,
		 * this ire  will get deleted.
		 *
		 * NOTE : Don't need the ire_lock for accessing
		 * ire_gateway_addr_v6 as it is appearing first
		 * time on the list and rts_setgwr_v6 could not
		 * be changing this.
		 */
		gw_addr_v6 = ire->ire_gateway_addr_v6;
		if (IN6_IS_ADDR_UNSPECIFIED(&gw_addr_v6)) {
			nce = ndp_lookup_v6(ill, &ire->ire_addr_v6, B_TRUE);
		} else {
			nce = ndp_lookup_v6(ill, &gw_addr_v6, B_TRUE);
		}
		if (nce == NULL)
			goto failed;

		/* Pair of refhold, refrele just to get the tracing right */
		NCE_REFHOLD_TO_REFHOLD_NOTR(nce);
		/*
		 * Atomically make sure that new IREs don't point
		 * to an NCE that is logically deleted (CONDEMNED).
		 * ndp_delete() first marks the NCE CONDEMNED.
		 * This ensures that the nce_refcnt won't increase
		 * due to new nce_lookups or due to addition of new IREs
		 * pointing to this NCE. Then ndp_delete() cleans up
		 * existing references. If we don't do it atomically here,
		 * ndp_delete() -> nce_ire_delete() will not be able to
		 * clean up the IRE list completely, and the nce_refcnt
		 * won't go down to zero.
		 */
		mutex_enter(&nce->nce_lock);
		if (ill->ill_flags & ILLF_XRESOLV) {
			/*
			 * If we used an external resolver, we may not
			 * have gone through neighbor discovery to get here.
			 * Must update the nce_state before the next check.
			 */
			if (nce->nce_state == ND_INCOMPLETE)
				nce->nce_state = ND_REACHABLE;
		}
		if (nce->nce_state == ND_INCOMPLETE ||
		    (nce->nce_flags & NCE_F_CONDEMNED) ||
		    (nce->nce_state == ND_UNREACHABLE)) {
failed:
			if (ndp_g_lock_held)
				mutex_exit(&ipst->ips_ndp6->ndp_g_lock);
			if (nce != NULL)
				mutex_exit(&nce->nce_lock);
			ire_atomic_end(irb_ptr, ire);
			ip1dbg(("ire_add_v6: No nce for dst %s \n",
			    inet_ntop(AF_INET6, &ire->ire_addr_v6,
			    buf, sizeof (buf))));
			ire_delete(ire);
			if (pire != NULL) {
				/*
				 * Assert that it is
				 * not yet removed from the list.
				 */
				ASSERT(pire->ire_ptpn != NULL);
				IRB_REFRELE(pire->ire_bucket);
				ire_refrele(pire);
			}
			if (nce != NULL)
				NCE_REFRELE_NOTR(nce);
			*ire_p = NULL;
			return (EINVAL);
		} else {
			ire->ire_nce = nce;
		}
		mutex_exit(&nce->nce_lock);
	}
	/*
	 * Find the first entry that matches ire_addr - provides
	 * tail insertion. *irep will be null if no match.
	 */
	irep = (ire_t **)irb_ptr;
	while ((ire1 = *irep) != NULL &&
	    !IN6_ARE_ADDR_EQUAL(&ire->ire_addr_v6, &ire1->ire_addr_v6))
		irep = &ire1->ire_next;
	ASSERT(!(ire->ire_type & IRE_BROADCAST));

	if (*irep != NULL) {
		/*
		 * Find the last ire which matches ire_addr_v6.
		 * Needed to do tail insertion among entries with the same
		 * ire_addr_v6.
		 */
		while (IN6_ARE_ADDR_EQUAL(&ire->ire_addr_v6,
		    &ire1->ire_addr_v6)) {
			irep = &ire1->ire_next;
			ire1 = *irep;
			if (ire1 == NULL)
				break;
		}
	}

	if (ire->ire_type == IRE_DEFAULT) {
		/*
		 * We keep a count of default gateways which is used when
		 * assigning them as routes.
		 */
		ipst->ips_ipv6_ire_default_count++;
		ASSERT(ipst->ips_ipv6_ire_default_count != 0); /* Wraparound */
	}
	/* Insert at *irep */
	ire1 = *irep;
	if (ire1 != NULL)
		ire1->ire_ptpn = &ire->ire_next;
	ire->ire_next = ire1;
	/* Link the new one in. */
	ire->ire_ptpn = irep;
	/*
	 * ire_walk routines de-reference ire_next without holding
	 * a lock. Before we point to the new ire, we want to make
	 * sure the store that sets the ire_next of the new ire
	 * reaches global visibility, so that ire_walk routines
	 * don't see a truncated list of ires i.e if the ire_next
	 * of the new ire gets set after we do "*irep = ire" due
	 * to re-ordering, the ire_walk thread will see a NULL
	 * once it accesses the ire_next of the new ire.
	 * membar_producer() makes sure that the following store
	 * happens *after* all of the above stores.
	 */
	membar_producer();
	*irep = ire;
	ire->ire_bucket = irb_ptr;
	/*
	 * We return a bumped up IRE above. Keep it symmetrical
	 * so that the callers will always have to release. This
	 * helps the callers of this function because they continue
	 * to use the IRE after adding and hence they don't have to
	 * lookup again after we return the IRE.
	 *
	 * NOTE : We don't have to use atomics as this is appearing
	 * in the list for the first time and no one else can bump
	 * up the reference count on this yet.
	 */
	IRE_REFHOLD_LOCKED(ire);
	BUMP_IRE_STATS(ipst->ips_ire_stats_v6, ire_stats_inserted);
	irb_ptr->irb_ire_cnt++;
	if (ire->ire_marks & IRE_MARK_TEMPORARY)
		irb_ptr->irb_tmp_ire_cnt++;

	if (ire->ire_ipif != NULL) {
		DTRACE_PROBE3(ipif__incr__cnt, (ipif_t *), ire->ire_ipif,
		    (char *), "ire", (void *), ire);
		ire->ire_ipif->ipif_ire_cnt++;
		if (ire->ire_stq != NULL) {
			stq_ill = (ill_t *)ire->ire_stq->q_ptr;
			DTRACE_PROBE3(ill__incr__cnt, (ill_t *), stq_ill,
			    (char *), "ire", (void *), ire);
			stq_ill->ill_ire_cnt++;
		}
	} else {
		ASSERT(ire->ire_stq == NULL);
	}

	if (ndp_g_lock_held)
		mutex_exit(&ipst->ips_ndp6->ndp_g_lock);
	ire_atomic_end(irb_ptr, ire);

	if (pire != NULL) {
		/* Assert that it is not removed from the list yet */
		ASSERT(pire->ire_ptpn != NULL);
		IRB_REFRELE(pire->ire_bucket);
		ire_refrele(pire);
	}

	if (ire->ire_type != IRE_CACHE) {
		/*
		 * For ire's with with host mask see if there is an entry
		 * in the cache. If there is one flush the whole cache as
		 * there might be multiple entries due to RTF_MULTIRT (CGTP).
		 * If no entry is found than there is no need to flush the
		 * cache.
		 */

		if (ip_mask_to_plen_v6(&ire->ire_mask_v6) == IPV6_ABITS) {
			ire_t *lire;
			lire = ire_ctable_lookup_v6(&ire->ire_addr_v6, NULL,
			    IRE_CACHE, NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE,
			    ipst);
			if (lire != NULL) {
				ire_refrele(lire);
				ire_flush_cache_v6(ire, IRE_FLUSH_ADD);
			}
		} else {
			ire_flush_cache_v6(ire, IRE_FLUSH_ADD);
		}
	}

	*ire_p = ire;
	return (0);
}

/*
 * Search for all HOST REDIRECT routes that are
 * pointing at the specified gateway and
 * delete them. This routine is called only
 * when a default gateway is going away.
 */
static void
ire_delete_host_redirects_v6(const in6_addr_t *gateway, ip_stack_t *ipst)
{
	irb_t *irb_ptr;
	irb_t *irb;
	ire_t *ire;
	in6_addr_t gw_addr_v6;
	int i;

	/* get the hash table for HOST routes */
	irb_ptr = ipst->ips_ip_forwarding_table_v6[(IP6_MASK_TABLE_SIZE - 1)];
	if (irb_ptr == NULL)
		return;
	for (i = 0; (i < ipst->ips_ip6_ftable_hash_size); i++) {
		irb = &irb_ptr[i];
		IRB_REFHOLD(irb);
		for (ire = irb->irb_ire; ire != NULL; ire = ire->ire_next) {
			if (!(ire->ire_flags & RTF_DYNAMIC))
				continue;
			mutex_enter(&ire->ire_lock);
			gw_addr_v6 = ire->ire_gateway_addr_v6;
			mutex_exit(&ire->ire_lock);
			if (IN6_ARE_ADDR_EQUAL(&gw_addr_v6, gateway))
				ire_delete(ire);
		}
		IRB_REFRELE(irb);
	}
}

/*
 * Delete all the cache entries with this 'addr'. This is the IPv6 counterpart
 * of ip_ire_clookup_and_delete. The difference being this function does not
 * return any value. IPv6 processing of a gratuitous ARP, as it stands, is
 * different than IPv4 in that, regardless of the presence of a cache entry
 * for this address, an ire_walk_v6 is done. Another difference is that unlike
 * in the case of IPv4 this does not take an ipif_t argument, since it is only
 * called by ip_arp_news and the match is always only on the address.
 */
void
ip_ire_clookup_and_delete_v6(const in6_addr_t *addr, ip_stack_t *ipst)
{
	irb_t		*irb;
	ire_t		*cire;
	boolean_t	found = B_FALSE;

	irb = &ipst->ips_ip_cache_table_v6[IRE_ADDR_HASH_V6(*addr,
	    ipst->ips_ip6_cache_table_size)];
	IRB_REFHOLD(irb);
	for (cire = irb->irb_ire; cire != NULL; cire = cire->ire_next) {
		if (cire->ire_marks & IRE_MARK_CONDEMNED)
			continue;
		if (IN6_ARE_ADDR_EQUAL(&cire->ire_addr_v6, addr)) {

			/* This signifies start of a match */
			if (!found)
				found = B_TRUE;
			if (cire->ire_type == IRE_CACHE) {
				if (cire->ire_nce != NULL)
					ndp_delete(cire->ire_nce);
				ire_delete_v6(cire);
			}
		/* End of the match */
		} else if (found)
			break;
	}
	IRB_REFRELE(irb);
}

/*
 * Delete the specified IRE.
 * All calls should use ire_delete().
 * Sometimes called as writer though not required by this function.
 *
 * NOTE : This function is called only if the ire was added
 * in the list.
 */
void
ire_delete_v6(ire_t *ire)
{
	in6_addr_t gw_addr_v6;
	ip_stack_t	*ipst = ire->ire_ipst;

	ASSERT(ire->ire_refcnt >= 1);
	ASSERT(ire->ire_ipversion == IPV6_VERSION);

	if (ire->ire_type != IRE_CACHE)
		ire_flush_cache_v6(ire, IRE_FLUSH_DELETE);
	if (ire->ire_type == IRE_DEFAULT) {
		/*
		 * when a default gateway is going away
		 * delete all the host redirects pointing at that
		 * gateway.
		 */
		mutex_enter(&ire->ire_lock);
		gw_addr_v6 = ire->ire_gateway_addr_v6;
		mutex_exit(&ire->ire_lock);
		ire_delete_host_redirects_v6(&gw_addr_v6, ipst);
	}
}

/*
 * ire_walk routine to delete all IRE_CACHE and IRE_HOST type redirect
 * entries.
 */
/*ARGSUSED1*/
void
ire_delete_cache_v6(ire_t *ire, char *arg)
{
	char    addrstr1[INET6_ADDRSTRLEN];
	char    addrstr2[INET6_ADDRSTRLEN];

	if ((ire->ire_type & IRE_CACHE) ||
	    (ire->ire_flags & RTF_DYNAMIC)) {
		ip1dbg(("ire_delete_cache_v6: deleted %s type %d through %s\n",
		    inet_ntop(AF_INET6, &ire->ire_addr_v6,
		    addrstr1, sizeof (addrstr1)),
		    ire->ire_type,
		    inet_ntop(AF_INET6, &ire->ire_gateway_addr_v6,
		    addrstr2, sizeof (addrstr2))));
		ire_delete(ire);
	}

}

/*
 * ire_walk routine to delete all IRE_CACHE/IRE_HOST type redirect entries
 * that have a given gateway address.
 */
void
ire_delete_cache_gw_v6(ire_t *ire, char *addr)
{
	in6_addr_t	*gw_addr = (in6_addr_t *)addr;
	char		buf1[INET6_ADDRSTRLEN];
	char		buf2[INET6_ADDRSTRLEN];
	in6_addr_t	ire_gw_addr_v6;

	if (!(ire->ire_type & IRE_CACHE) &&
	    !(ire->ire_flags & RTF_DYNAMIC))
		return;

	mutex_enter(&ire->ire_lock);
	ire_gw_addr_v6 = ire->ire_gateway_addr_v6;
	mutex_exit(&ire->ire_lock);

	if (IN6_ARE_ADDR_EQUAL(&ire_gw_addr_v6, gw_addr)) {
		ip1dbg(("ire_delete_cache_gw_v6: deleted %s type %d to %s\n",
		    inet_ntop(AF_INET6, &ire->ire_src_addr_v6,
		    buf1, sizeof (buf1)),
		    ire->ire_type