]> git.saurik.com Git - apple/xnu.git/blobdiff - bsd/netinet6/in6.c
xnu-792.25.20.tar.gz
[apple/xnu.git] / bsd / netinet6 / in6.c
index ab8b787e43e29452e3e6678e63d88cc046ac2c94..8887a091dc693c5ff73d850b35c0ef00a16bc46f 100644 (file)
@@ -1,4 +1,5 @@
-/*     $KAME: in6.c,v 1.72 2000/03/30 03:45:26 itojun Exp $    */
+/*     $FreeBSD: src/sys/netinet6/in6.c,v 1.7.2.7 2001/08/06 20:26:22 ume Exp $        */
+/*     $KAME: in6.c,v 1.187 2001/05/24 07:43:59 itojun Exp $   */
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
  *     @(#)in.c        8.2 (Berkeley) 11/15/93
  */
 
-#if (defined(__FreeBSD__) && __FreeBSD__ >= 3) || defined(__NetBSD__)
-#include "opt_inet.h"
-#endif
 
 #include <sys/param.h>
-#if !(defined(__FreeBSD__) && __FreeBSD__ >= 3)
 #include <sys/ioctl.h>
-#endif
 #include <sys/errno.h>
 #include <sys/malloc.h>
 #include <sys/socket.h>
 #include <sys/time.h>
 #include <sys/kernel.h>
 #include <sys/syslog.h>
+#include <sys/kern_event.h>
+#include <kern/lock.h>
 
 #include <net/if.h>
 #include <net/if_types.h>
 #include <net/route.h>
-#include "gif.h"
-#if NGIF > 0
-#include <net/if_gif.h>
-#endif
 #include <net/if_dl.h>
 
 #include <netinet/in.h>
 #include <netinet/in_var.h>
-#if __NetBSD__
-#include <net/if_ether.h>
-#else
 #include <netinet/if_ether.h>
+#ifndef SCOPEDROUTING
+#include <netinet/in_systm.h>
+#include <netinet/ip.h>
+#include <netinet/in_pcb.h>
 #endif
 
 #include <netinet6/nd6.h>
 #include <netinet6/mld6_var.h>
 #include <netinet6/ip6_mroute.h>
 #include <netinet6/in6_ifattach.h>
+#include <netinet6/scope6_var.h>
+#ifndef SCOPEDROUTING
+#include <netinet6/in6_pcb.h>
+#endif
 
 #include <net/net_osdep.h>
 
-#if MIP6
-#include <netinet6/mip6.h>
-#include <netinet6/mip6_common.h>
-
-struct nd_prefix *(*mip6_get_home_prefix_hook) __P((void));
-#endif /* MIP6 */
-
-#if defined(__FreeBSD__) && __FreeBSD__ >= 3
+#ifndef __APPLE__
 MALLOC_DEFINE(M_IPMADDR, "in6_multi", "internet multicast address");
 #endif
-
-/*
+ /*
  * Definitions of some costant IP6 addresses.
  */
 const struct in6_addr in6addr_any = IN6ADDR_ANY_INIT;
@@ -137,56 +128,17 @@ const struct in6_addr in6mask64 = IN6MASK64;
 const struct in6_addr in6mask96 = IN6MASK96;
 const struct in6_addr in6mask128 = IN6MASK128;
 
-#if !defined(__bsdi__) && !(defined(__FreeBSD__) && __FreeBSD__ < 3) && !defined (__APPLE__)
-static int in6_lifaddr_ioctl __P((struct socket *, u_long, caddr_t,
-       struct ifnet *, struct proc *));
-#else
-static int in6_lifaddr_ioctl __P((struct socket *, u_long, caddr_t,
-       struct ifnet *));
-#endif
-
-#if defined(__FreeBSD__) && __FreeBSD__ >= 3 || defined (__APPLE__)
-struct in6_multihead in6_multihead;    /* XXX BSS initialization */
-#else
-/*
- * This structure is used to keep track of in6_multi chains which belong to
- * deleted interface addresses.
- */
-static LIST_HEAD(, multi6_kludge) in6_mk; /* XXX BSS initialization */
+const struct sockaddr_in6 sa6_any = {sizeof(sa6_any), AF_INET6,
+                                    0, 0, IN6ADDR_ANY_INIT, 0};
 
-struct multi6_kludge {
-       LIST_ENTRY(multi6_kludge) mk_entry;
-       struct ifnet *mk_ifp;
-       struct in6_multihead mk_head;
-};
-#endif
+static int in6_lifaddr_ioctl(struct socket *, u_long, caddr_t,
+       struct ifnet *, struct proc *);
+static int in6_ifinit(struct ifnet *, struct in6_ifaddr *,
+                          struct sockaddr_in6 *, int);
+static void in6_unlink_ifa(struct in6_ifaddr *, struct ifnet *, int);
 
-/*
- * Check if the loopback entry will be automatically generated.
- *   if 0 returned, will not be automatically generated.
- *   if 1 returned, will be automatically generated.
- */
-static int
-in6_is_ifloop_auto(struct ifaddr *ifa)
-{
-#define SIN6(s) ((struct sockaddr_in6 *)s)
-       /*
-        * If RTF_CLONING is unset, or (IFF_LOOPBACK | IFF_POINTOPOINT),
-        * or netmask is all0 or all1, then cloning will not happen,
-        * then we can't rely on its loopback entry generation.
-        */
-       if ((ifa->ifa_flags & RTF_CLONING) == 0 ||
-           (ifa->ifa_ifp->if_flags & (IFF_LOOPBACK | IFF_POINTOPOINT)) ||
-           (SIN6(ifa->ifa_netmask)->sin6_len == sizeof(struct sockaddr_in6)
-            &&
-            IN6_ARE_ADDR_EQUAL(&SIN6(ifa->ifa_netmask)->sin6_addr,
-                               &in6mask128)) ||
-           ((struct sockaddr_in6 *)ifa->ifa_netmask)->sin6_len == 0)
-               return 0;
-       else
-               return 1;
-#undef SIN6
-}
+struct in6_multihead in6_multihead;    /* XXX BSS initialization */
+extern struct lck_mtx_t *nd6_mutex;
 
 /*
  * Subroutine for in6_ifaddloop() and in6_ifremloop().
@@ -195,63 +147,87 @@ in6_is_ifloop_auto(struct ifaddr *ifa)
 static void
 in6_ifloop_request(int cmd, struct ifaddr *ifa)
 {
-       struct sockaddr_in6 lo_sa;
        struct sockaddr_in6 all1_sa;
        struct rtentry *nrt = NULL;
+       int e;
        
-       bzero(&lo_sa, sizeof(lo_sa));
        bzero(&all1_sa, sizeof(all1_sa));
-       lo_sa.sin6_family = AF_INET6;
-       lo_sa.sin6_len = sizeof(struct sockaddr_in6);
-       all1_sa = lo_sa;
-       lo_sa.sin6_addr = in6addr_loopback;
+       all1_sa.sin6_family = AF_INET6;
+       all1_sa.sin6_len = sizeof(struct sockaddr_in6);
        all1_sa.sin6_addr = in6mask128;
-       
-       /* So we add or remove static loopback entry, here. */
-       rtrequest(cmd, ifa->ifa_addr,
-                 (struct sockaddr *)&lo_sa,
-                 (struct sockaddr *)&all1_sa,
-                 RTF_UP|RTF_HOST, &nrt);
+
+       /*
+        * We specify the address itself as the gateway, and set the
+        * RTF_LLINFO flag, so that the corresponding host route would have
+        * the flag, and thus applications that assume traditional behavior
+        * would be happy.  Note that we assume the caller of the function
+        * (probably implicitly) set nd6_rtrequest() to ifa->ifa_rtrequest,
+        * which changes the outgoing interface to the loopback interface.
+        */
+       e = rtrequest_locked(cmd, ifa->ifa_addr, ifa->ifa_addr,
+                     (struct sockaddr *)&all1_sa,
+                     RTF_UP|RTF_HOST|RTF_LLINFO, &nrt);
+       if (e != 0) {
+               log(LOG_ERR, "in6_ifloop_request: "
+                   "%s operation failed for %s (errno=%d)\n",
+                   cmd == RTM_ADD ? "ADD" : "DELETE",
+                   ip6_sprintf(&((struct in6_ifaddr *)ifa)->ia_addr.sin6_addr),
+                   e);
+       }
 
        /*
         * Make sure rt_ifa be equal to IFA, the second argument of the
         * function.
-        * We need this because when we refer rt_ifa->ia6_flags in ip6_input,
-        * we assume that the rt_ifa points to the address instead of the
-        * loopback address.
+        * We need this because when we refer to rt_ifa->ia6_flags in
+        * ip6_input, we assume that the rt_ifa points to the address instead
+        * of the loopback address.
         */
        if (cmd == RTM_ADD && nrt && ifa != nrt->rt_ifa) {
-               IFAFREE(nrt->rt_ifa);
-               ifa->ifa_refcnt++;
-               nrt->rt_ifa = ifa;
-               nrt->rt_dlt = ifa->ifa_dlt;
+               rtsetifa(nrt, ifa);
+       }
+
+       /*
+        * Report the addition/removal of the address to the routing socket.
+        * XXX: since we called rtinit for a p2p interface with a destination,
+        *      we end up reporting twice in such a case.  Should we rather
+        *      omit the second report?
+        */
+       if (nrt) {
+               rt_newaddrmsg(cmd, ifa, e, nrt);
+               if (cmd == RTM_DELETE) {
+                       if (nrt->rt_refcnt <= 0) {
+                               /* XXX: we should free the entry ourselves. */
+                               rtref(nrt);
+                               rtfree_locked(nrt);
+                       }
+               } else {
+                       /* the cmd must be RTM_ADD here */
+                       rtunref(nrt);
+               }
        }
-       if (nrt)
-               nrt->rt_refcnt--;
 }
 
 /*
- * Add ownaddr as loopback rtentry, if necessary(ex. on p2p link).
- * Because, KAME needs loopback rtentry for ownaddr check in
- * ip6_input().
+ * Add ownaddr as loopback rtentry.  We previously add the route only if
+ * necessary (ex. on a p2p link).  However, since we now manage addresses
+ * separately from prefixes, we should always add the route.  We can't
+ * rely on the cloning mechanism from the corresponding interface route
+ * any more.
  */
 static void
 in6_ifaddloop(struct ifaddr *ifa)
 {
-       if (!in6_is_ifloop_auto(ifa)) {
-               struct rtentry *rt;
-
-               /* If there is no loopback entry, allocate one. */
-               rt = rtalloc1(ifa->ifa_addr, 0
-#if defined(__FreeBSD__) || defined (__APPLE__)
-                             , 0
-#endif /* __FreeBSD__ */
-                             );
-               if (rt == 0 || (rt->rt_ifp->if_flags & IFF_LOOPBACK) == 0)
-                       in6_ifloop_request(RTM_ADD, ifa);
-               if (rt)
-                       rt->rt_refcnt--;
-       }
+       struct rtentry *rt;
+
+       lck_mtx_lock(rt_mtx);
+       /* If there is no loopback entry, allocate one. */
+       rt = rtalloc1_locked(ifa->ifa_addr, 0, 0);
+       if (rt == NULL || (rt->rt_flags & RTF_HOST) == 0 ||
+           (rt->rt_ifp->if_flags & IFF_LOOPBACK) == 0)
+               in6_ifloop_request(RTM_ADD, ifa);
+       if (rt)
+               rt->rt_refcnt--;
+       lck_mtx_unlock(rt_mtx);
 }
 
 /*
@@ -259,23 +235,57 @@ in6_ifaddloop(struct ifaddr *ifa)
  * if it exists.
  */
 static void
-in6_ifremloop(struct ifaddr *ifa)
+in6_ifremloop(struct ifaddr *ifa, int locked)
 {
-       if (!in6_is_ifloop_auto(ifa)) {
-               struct in6_ifaddr *ia;
-               int ia_count = 0;
-
-               /* If only one ifa for the loopback entry, delete it. */
-               for (ia = in6_ifaddr; ia; ia = ia->ia_next) {
-                       if (IN6_ARE_ADDR_EQUAL(IFA_IN6(ifa),
-                                              &ia->ia_addr.sin6_addr)) {
-                               ia_count++;
-                               if (ia_count > 1)
-                                       break;
-                       }
+       struct in6_ifaddr *ia;
+       struct rtentry *rt;
+       int ia_count = 0;
+
+       /*
+        * Some of BSD variants do not remove cloned routes
+        * from an interface direct route, when removing the direct route
+        * (see comments in net/net_osdep.h).  Even for variants that do remove
+        * cloned routes, they could fail to remove the cloned routes when
+        * we handle multple addresses that share a common prefix.
+        * So, we should remove the route corresponding to the deleted address
+        * regardless of the result of in6_is_ifloop_auto().
+        */
+
+       /*
+        * Delete the entry only if exact one ifa exists.  More than one ifa
+        * can exist if we assign a same single address to multiple
+        * (probably p2p) interfaces.
+        * XXX: we should avoid such a configuration in IPv6...
+        */
+       if (!locked)
+               lck_mtx_lock(nd6_mutex);
+       for (ia = in6_ifaddrs; ia; ia = ia->ia_next) {
+               if (IN6_ARE_ADDR_EQUAL(IFA_IN6(ifa), &ia->ia_addr.sin6_addr)) {
+                       ia_count++;
+                       if (ia_count > 1)
+                               break;
                }
-               if (ia_count == 1)
+       }
+       if (!locked)
+               lck_mtx_unlock(nd6_mutex);
+
+       if (ia_count == 1) {
+               /*
+                * Before deleting, check if a corresponding loopbacked host
+                * route surely exists.  With this check, we can avoid to
+                * delete an interface direct route whose destination is same
+                * as the address being removed.  This can happen when remofing
+                * a subnet-router anycast address on an interface attahced
+                * to a shared medium.
+                */
+               lck_mtx_lock(rt_mtx);
+               rt = rtalloc1_locked(ifa->ifa_addr, 0, 0);
+               if (rt != NULL && (rt->rt_flags & RTF_HOST) != 0 &&
+                   (rt->rt_ifp->if_flags & IFF_LOOPBACK) != 0) {
+                       rt->rt_refcnt--;
                        in6_ifloop_request(RTM_DELETE, ifa);
+               }
+               lck_mtx_unlock(rt_mtx);
        }
 }
 
@@ -289,41 +299,62 @@ in6_ifindex2scopeid(idx)
 
        if (idx < 0 || if_index < idx)
                return -1;
+       
+       ifnet_head_lock_shared();
        ifp = ifindex2ifnet[idx];
+       ifnet_head_done();
 
-#if defined(__bsdi__) || (defined(__FreeBSD__) && __FreeBSD__ < 3) 
-       for (ifa = ifp->if_addrlist; ifa; ifa = ifa->ifa_next)
-#else
-       for (ifa = ifp->if_addrlist.tqh_first; ifa; ifa = ifa->ifa_list.tqe_next)
-#endif
+       ifnet_lock_shared(ifp);
+       TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list)
        {
                if (ifa->ifa_addr->sa_family != AF_INET6)
                        continue;
                sin6 = (struct sockaddr_in6 *)ifa->ifa_addr;
-               if (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))
+               if (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) {
+                       ifnet_lock_done(ifp);
                        return sin6->sin6_scope_id & 0xffff;
+               }
        }
+       ifnet_lock_done(ifp);
 
        return -1;
 }
 
 int
-in6_mask2len(mask)
+in6_mask2len(mask, lim0)
        struct in6_addr *mask;
+       u_char *lim0;
 {
-       int x, y;
-
-       for (x = 0; x < sizeof(*mask); x++) {
-               if (mask->s6_addr8[x] != 0xff)
+       int x = 0, y;
+       u_char *lim = lim0, *p;
+
+       if (lim0 == NULL ||
+           lim0 - (u_char *)mask > sizeof(*mask)) /* ignore the scope_id part */
+               lim = (u_char *)mask + sizeof(*mask);
+       for (p = (u_char *)mask; p < lim; x++, p++) {
+               if (*p != 0xff)
                        break;
        }
        y = 0;
-       if (x < sizeof(*mask)) {
+       if (p < lim) {
                for (y = 0; y < 8; y++) {
-                       if ((mask->s6_addr8[x] & (0x80 >> y)) == 0)
+                       if ((*p & (0x80 >> y)) == 0)
                                break;
                }
        }
+
+       /*
+        * when the limit pointer is given, do a stricter check on the
+        * remaining bits.
+        */
+       if (p < lim) {
+               if (y != 0 && (*p & (0x00ff >> y)) != 0)
+                       return(-1);
+               for (p = p + 1; p < lim; p++)
+                       if (*p != 0)
+                               return(-1);
+       }
+       
        return x * 8 + y;
 }
 
@@ -345,114 +376,49 @@ in6_len2mask(mask, len)
 #define ia62ifa(ia6)   (&((ia6)->ia_ifa))
 
 int
-#if !defined(__bsdi__) && !(defined(__FreeBSD__) && __FreeBSD__ < 3) && !defined (__APPLE__)
 in6_control(so, cmd, data, ifp, p)
        struct  socket *so;
        u_long cmd;
        caddr_t data;
        struct ifnet *ifp;
        struct proc *p;
-#else
-in6_control(so, cmd, data, ifp)
-       struct  socket *so;
-       u_long cmd;
-       caddr_t data;
-       struct ifnet *ifp;
-#endif
 {
        struct  in6_ifreq *ifr = (struct in6_ifreq *)data;
-#if defined(__bsdi__) || (defined(__FreeBSD__) && __FreeBSD__ < 3)
-       struct  ifaddr *ifa;
-#endif
-       struct  in6_ifaddr *ia = NULL, *oia;
+       struct  in6_ifaddr *ia = NULL;
        struct  in6_aliasreq *ifra = (struct in6_aliasreq *)data;
-       struct  sockaddr_in6 oldaddr;
-#ifdef COMPAT_IN6IFIOCTL
-       struct  sockaddr_in6 net;
-#endif
-       int error = 0, hostIsNew, prefixIsNew;
-       int newifaddr;
-#if !(defined(__FreeBSD__) && __FreeBSD__ >= 3) && !defined(__APPLE__)
-       time_t time_second = (time_t)time.tv_sec;
-#endif
-       int privileged;
-       u_long dl_tag;
+       int privileged, error = 0;
+       int index;
+       struct timeval timenow;
+
+       getmicrotime(&timenow);
 
        privileged = 0;
-#if !defined(__bsdi__) && !(defined(__FreeBSD__) && __FreeBSD__ < 3) && !defined (__APPLE__)
-       if (p && !suser(p->p_ucred, &p->p_acflag))
-               privileged++;
+#ifdef __APPLE__
+       if (p == NULL || !proc_suser(p))
 #else
-       if ((so->so_state & SS_PRIV) != 0)
-               privileged++;
+       if (p == NULL || !suser(p))
 #endif
+               privileged++;
 
-       /*
-        * xxx should prevent processes for link-local addresses?
-        */
-#if NGIF > 0
-       if (ifp && ifp->if_type == IFT_GIF) {
-               switch (cmd) {
-               case SIOCSIFPHYADDR_IN6:
-                       if (!privileged)
-                               return(EPERM);
-                       /*fall through*/
-               case SIOCGIFPSRCADDR_IN6:
-               case SIOCGIFPDSTADDR_IN6:
-                       return gif_ioctl(ifp, cmd, data);
-               }
-       }
-#endif
        switch (cmd) {
        case SIOCGETSGCNT_IN6:
        case SIOCGETMIFCNT_IN6:
                return (mrt6_ioctl(cmd, data));
        }
-#if MIP6
-       /* These require root privileges */
-       switch (cmd) {
-       case SIOCSDEBUG_MIP6:
-       case SIOCSBCFLUSH_MIP6:
-       case SIOCSDEFCONFIG_MIP6:
-       case SIOCSBRUPDATE_MIP6:
-       case SIOCSENABLEBR_MIP6:
-       case SIOCSATTACH_MIP6:
-       case SIOCSRELEASE_MIP6:
-
-       case SIOCSHALISTFLUSH_MIP6:
-       case SIOCSHAPREF_MIP6:
-       case SIOCSFWDSLUNICAST_MIP6:
-       case SIOCSFWDSLMULTICAST_MIP6:
-
-       case SIOCSFORADDRFLUSH_MIP6:
-       case SIOCSHADDRFLUSH_MIP6:
-       case SIOCSBULISTFLUSH_MIP6:
-       case SIOCACOADDR_MIP6:
-       case SIOCAHOMEADDR_MIP6:
-       case SIOCSBULIFETIME_MIP6:
-       case SIOCSHRLIFETIME_MIP6:
-       case SIOCDCOADDR_MIP6:
-       case SIOCSPROMMODE_MIP6:
-       case SIOCSBU2CN_MIP6:
-       case SIOCSREVTUNNEL_MIP6:
-       case SIOCSAUTOCONFIG_MIP6:
-       case SIOCSEAGERMD_MIP6:
-               if (!privileged)
-                       return(EPERM);
-               /* Anyone can use these or the user is root */
-               /* case SIOCXVERYSAFECOMMAND_MIP6:  */
-#if !defined(__bsdi__) && !(defined(__FreeBSD__) && __FreeBSD__ < 3) && !defined(__APPLE__)
-               return mip6_ioctl(so, cmd, data, ifp, p);
-#else
-               return mip6_ioctl(so, cmd, data, ifp);
-#endif
-       }
-#endif /* MIP6 */
 
        if (ifp == NULL)
                return(EOPNOTSUPP);
 
        switch (cmd) {
+       case SIOCAUTOCONF_START:
+       case SIOCAUTOCONF_STOP:
+       case SIOCLL_START:
+       case SIOCLL_STOP:
+       case SIOCPROTOATTACH_IN6:
+       case SIOCPROTODETACH_IN6:
+                if (!privileged)
+                        return(EPERM);
+               break;
        case SIOCSNDFLUSH_IN6:
        case SIOCSPFXFLUSH_IN6:
        case SIOCSRTRFLUSH_IN6:
@@ -460,7 +426,8 @@ in6_control(so, cmd, data, ifp)
        case SIOCSIFINFO_FLAGS:
                if (!privileged)
                        return(EPERM);
-               /*fall through*/
+               /* fall through */
+       case OSIOCGIFINFO_IN6:
        case SIOCGIFINFO_IN6:
        case SIOCGDRLST_IN6:
        case SIOCGPRLST_IN6:
@@ -475,13 +442,25 @@ in6_control(so, cmd, data, ifp)
        case SIOCAIFPREFIX_IN6:
        case SIOCCIFPREFIX_IN6:
        case SIOCSGIFPREFIX_IN6:
-               if (!privileged)
-                       return(EPERM);
-               /*fall through*/
        case SIOCGIFPREFIX_IN6:
-               if (ip6_forwarding == 0)
+               log(LOG_NOTICE,
+                   "prefix ioctls are now invalidated. "
+                   "please use ifconfig.\n");
+               return(EOPNOTSUPP);
+       }
+
+       switch (cmd) {
+       case SIOCSSCOPE6:
+               if (!privileged)
                        return(EPERM);
-               return(in6_prefix_ioctl(so, cmd, data, ifp));
+               return(scope6_set(ifp, ifr->ifr_ifru.ifru_scope_id));
+               break;
+       case SIOCGSCOPE6:
+               return(scope6_get(ifp, ifr->ifr_ifru.ifru_scope_id));
+               break;
+       case SIOCGSCOPE6DEF:
+               return(scope6_get_default(ifr->ifr_ifru.ifru_scope_id));
+               break;
        }
 
        switch (cmd) {
@@ -489,15 +468,109 @@ in6_control(so, cmd, data, ifp)
        case SIOCDLIFADDR:
                if (!privileged)
                        return(EPERM);
-               /*fall through*/
+               /* fall through */
        case SIOCGLIFADDR:
-#if !defined(__bsdi__) && !(defined(__FreeBSD__) && __FreeBSD__ < 3) && !defined (__APPLE__)
                return in6_lifaddr_ioctl(so, cmd, data, ifp, p);
-#else
-               return in6_lifaddr_ioctl(so, cmd, data, ifp);
-#endif
        }
+       
+#ifdef __APPLE__
+
+       switch (cmd) {
+
+       case SIOCAUTOCONF_START:
+               ifnet_lock_exclusive(ifp);
+               ifp->if_eflags |= IFEF_ACCEPT_RTADVD;
+               ifnet_lock_done(ifp);
+               return (0);
+
+       case SIOCAUTOCONF_STOP: 
+               {
+                       struct in6_ifaddr *ia, *nia = NULL;
+                       
+                       ifnet_lock_exclusive(ifp);
+                       ifp->if_eflags &= ~IFEF_ACCEPT_RTADVD;
+                       ifnet_lock_done(ifp);
+
+                       /* nuke prefix list.  this may try to remove some ifaddrs as well */
+                       in6_purgeprefix(ifp);
+
+                       /* removed autoconfigured address from interface */
+                       lck_mtx_lock(nd6_mutex);
+                       for (ia = in6_ifaddrs; ia != NULL; ia = nia) {
+                               nia = ia->ia_next;
+                               if (ia->ia_ifa.ifa_ifp != ifp)
+                                       continue;
+                               if (ia->ia6_flags & IN6_IFF_AUTOCONF)
+                                       in6_purgeaddr(&ia->ia_ifa, 1);
+                       }
+                       lck_mtx_unlock(nd6_mutex);
+                       return (0);
+               }
+
+
+       case SIOCLL_START:
+       
+               /* NOTE: All the interface specific DLIL attachements should be done here
+                *      They are currently done in in6_ifattach() for the interfaces that need it
+                */
+
+               if (ifp->if_type == IFT_PPP && ifra->ifra_addr.sin6_family == AF_INET6 && 
+                    ifra->ifra_dstaddr.sin6_family == AF_INET6)  
+                       in6_if_up(ifp, ifra); /* PPP may provide LinkLocal addresses */
+               else
+                       in6_if_up(ifp, 0);
+
+               return(0);
+
+       case SIOCLL_STOP:
+               {
+                       struct in6_ifaddr *ia, *nia = NULL;
+                       
+                       /* removed link local addresses from interface */
+
+                       lck_mtx_lock(nd6_mutex);
+                       for (ia = in6_ifaddrs; ia != NULL; ia = nia) {
+                               nia = ia->ia_next;
+                               if (ia->ia_ifa.ifa_ifp != ifp)
+                                       continue;
+                               if (IN6_IS_ADDR_LINKLOCAL(&ia->ia_addr.sin6_addr))
+                                       in6_purgeaddr(&ia->ia_ifa, 1);
+                       }
+                       lck_mtx_unlock(nd6_mutex);
+                       return (0);
+               }
+
+
+       case SIOCPROTOATTACH_IN6:
+
+               switch (ifp->if_type) {
+#if IFT_BRIDGE /*OpenBSD 2.8*/
+       /* some of the interfaces are inherently not IPv6 capable */
+                       case IFT_BRIDGE:
+                               return;
+#endif
+                       default:
+
+                               if (error = dlil_plumb_protocol(PF_INET6, ifp))
+                                       printf("SIOCPROTOATTACH_IN6: %s error=%d\n", 
+                                               if_name(ifp), error);
+                               break;
+
+               }
+               return (error);
+
+       
+       case SIOCPROTODETACH_IN6:
+
+               in6_purgeif(ifp);       /* Cleanup interface routes and addresses */
+
+               if (error = dlil_unplumb_protocol(PF_INET6, ifp))
+                        printf("SIOCPROTODETACH_IN6: %s error=%d\n",
+                               if_name(ifp), error);
+               return(error);
 
+       }
+#endif
        /*
         * Find address for this interface, if it exists.
         */
@@ -507,12 +580,12 @@ in6_control(so, cmd, data, ifp)
 
                if (IN6_IS_ADDR_LINKLOCAL(&sa6->sin6_addr)) {
                        if (sa6->sin6_addr.s6_addr16[1] == 0) {
-                               /* interface ID is not embedded by the user */
+                               /* link ID is not embedded by the user */
                                sa6->sin6_addr.s6_addr16[1] =
                                        htons(ifp->if_index);
                        } else if (sa6->sin6_addr.s6_addr16[1] !=
                                    htons(ifp->if_index)) {
-                               return(EINVAL); /* ifid is contradict */
+                               return(EINVAL); /* link ID contradicts */
                        }
                        if (sa6->sin6_scope_id) {
                                if (sa6->sin6_scope_id !=
@@ -525,109 +598,47 @@ in6_control(so, cmd, data, ifp)
        }
 
        switch (cmd) {
+       case SIOCSIFADDR_IN6:
+       case SIOCSIFDSTADDR_IN6:
+       case SIOCSIFNETMASK_IN6:
+               /*
+                * Since IPv6 allows a node to assign multiple addresses
+                * on a single interface, SIOCSIFxxx ioctls are not suitable
+                * and should be unused.
+                */
+               /* we decided to obsolete this command (20000704) */
+               error = EINVAL;
+               goto ioctl_cleanup;
 
        case SIOCDIFADDR_IN6:
                /*
-                * for IPv4, we look for existing in6_ifaddr here to allow
+                * for IPv4, we look for existing in_ifaddr here to allow
                 * "ifconfig if0 delete" to remove first IPv4 address on the
                 * interface.  For IPv6, as the spec allow multiple interface
                 * address from the day one, we consider "remove the first one"
-                * semantics to be not preferrable.
+                * semantics to be not preferable.
                 */
-               if (ia == NULL)
-                       return(EADDRNOTAVAIL);
+               if (ia == NULL) {
+                       error = EADDRNOTAVAIL;
+                       goto ioctl_cleanup;
+               }
+               
                /* FALLTHROUGH */
        case SIOCAIFADDR_IN6:
-       case SIOCSIFADDR_IN6:
-#if COMPAT_IN6IFIOCTL
-       case SIOCSIFDSTADDR_IN6:
-       case SIOCSIFNETMASK_IN6:
                /*
-                * Since IPv6 allows a node to assign multiple addresses
-                * on a single interface, SIOCSIFxxx ioctls are not suitable
-                * and should be unused.
+                * We always require users to specify a valid IPv6 address for
+                * the corresponding operation.
                 */
-#endif
-               if (ifra->ifra_addr.sin6_family != AF_INET6)
-                       return(EAFNOSUPPORT);
-               if (!privileged)
-                       return(EPERM);
-               if (ia == NULL) {
-                       ia = (struct in6_ifaddr *)
-                               _MALLOC(sizeof(*ia), M_IFADDR, M_WAITOK);
-                       if (ia == NULL)
-                               return (ENOBUFS);
-                       bzero((caddr_t)ia, sizeof(*ia));
-                       /* Initialize the address and masks */
-                       ia->ia_ifa.ifa_addr = (struct sockaddr *)&ia->ia_addr;
-                       ia->ia_addr.sin6_family = AF_INET6;
-                       ia->ia_addr.sin6_len = sizeof(ia->ia_addr);
-                       if (ifp->if_flags & IFF_POINTOPOINT) {
-                               ia->ia_ifa.ifa_dstaddr
-                                       = (struct sockaddr *)&ia->ia_dstaddr;
-                               ia->ia_dstaddr.sin6_family = AF_INET6;
-                               ia->ia_dstaddr.sin6_len = sizeof(ia->ia_dstaddr);
-                       } else {
-                               ia->ia_ifa.ifa_dstaddr = NULL;
-                               bzero(&ia->ia_dstaddr, sizeof(ia->ia_dstaddr));
-                       }
-                       ia->ia_ifa.ifa_netmask
-                               = (struct sockaddr *)&ia->ia_prefixmask;
-
-                       ia->ia_ifp = ifp;
-
-                       printf("in6_control: Attach dl_tag for if=%s%n\n", ifp->if_name, ifp->if_unit);
-        
-                       if (strcmp(ifp->if_name, "en") == 0)
-                               dl_tag = ether_attach_inet6(ifp);
-
-                       if (strcmp(ifp->if_name, "lo") == 0)
-                               dl_tag = lo_attach_inet(ifp);
-
-                       if (strcmp(ifp->if_name, "gif") == 0)
-                               dl_tag = gif_attach_inet(ifp);
-/* End of temp code */
-                       ia->ia_ifa.ifa_dlt = dl_tag;
-
-
-                       if ((oia = in6_ifaddr) != NULL) {
-                               for ( ; oia->ia_next; oia = oia->ia_next)
-                                       continue;
-                               oia->ia_next = ia;
-                       } else
-                               in6_ifaddr = ia;
-                       ia->ia_ifa.ifa_refcnt++;
-
-#if defined(__bsdi__) || (defined(__FreeBSD__) && __FreeBSD__ < 3)
-                       if ((ifa = ifp->if_addrlist) != NULL) {
-                               for ( ; ifa->ifa_next; ifa = ifa->ifa_next)
-                                       continue;
-                               ifa->ifa_next = ia62ifa(ia);
-                       } else
-                               ifp->if_addrlist = ia62ifa(ia);
-#else
-                       TAILQ_INSERT_TAIL(&ifp->if_addrlist, &ia->ia_ifa,
-                           ifa_list);
-#endif
-                       ia->ia_ifa.ifa_refcnt++;
-
-                       newifaddr = 1;
-               } else
-                       newifaddr = 0;
-
-               if (cmd == SIOCAIFADDR_IN6) {
-                       /* sanity for overflow - beware unsigned */
-                       struct in6_addrlifetime *lt;
-                       lt = &ifra->ifra_lifetime;
-                       if (lt->ia6t_vltime != ND6_INFINITE_LIFETIME
-                        && lt->ia6t_vltime + time_second < time_second) {
-                               return EINVAL;
-                       }
-                       if (lt->ia6t_pltime != ND6_INFINITE_LIFETIME
-                        && lt->ia6t_pltime + time_second < time_second) {
-                               return EINVAL;
-                       }
+               if (ifra->ifra_addr.sin6_family != AF_INET6 ||
+                   ifra->ifra_addr.sin6_len != sizeof(struct sockaddr_in6)) {
+                       error = EAFNOSUPPORT;
+                       goto ioctl_cleanup;
+               }
+               if (!privileged) {
+                       error = EPERM;
+                       goto ioctl_cleanup;
                }
+
                break;
 
        case SIOCGIFADDR_IN6:
@@ -638,26 +649,34 @@ in6_control(so, cmd, data, ifp)
        case SIOCGIFDSTADDR_IN6:
        case SIOCGIFALIFETIME_IN6:
                /* must think again about its semantics */
-               if (ia == NULL)
-                       return(EADDRNOTAVAIL);
+               if (ia == NULL) {
+                       error = EADDRNOTAVAIL;
+                       goto ioctl_cleanup;
+               }
                break;
        case SIOCSIFALIFETIME_IN6:
            {
                struct in6_addrlifetime *lt;
 
-               if (!privileged)
-                       return(EPERM);
-               if (ia == NULL)
-                       return(EADDRNOTAVAIL);
+               if (!privileged) {
+                       error = EPERM;
+                       goto ioctl_cleanup;
+               }
+               if (ia == NULL) {
+                       error = EADDRNOTAVAIL;
+                       goto ioctl_cleanup;
+               }
                /* sanity for overflow - beware unsigned */
                lt = &ifr->ifr_ifru.ifru_lifetime;
                if (lt->ia6t_vltime != ND6_INFINITE_LIFETIME
-                && lt->ia6t_vltime + time_second < time_second) {
-                       return EINVAL;
+                && lt->ia6t_vltime + timenow.tv_sec < timenow.tv_sec) {
+                       error = EINVAL;
+                       goto ioctl_cleanup;
                }
                if (lt->ia6t_pltime != ND6_INFINITE_LIFETIME
-                && lt->ia6t_pltime + time_second < time_second) {
-                       return EINVAL;
+                && lt->ia6t_pltime + timenow.tv_sec < timenow.tv_sec) {
+                       error = EINVAL;
+                       goto ioctl_cleanup;
                }
                break;
            }
@@ -670,8 +689,14 @@ in6_control(so, cmd, data, ifp)
                break;
 
        case SIOCGIFDSTADDR_IN6:
-               if ((ifp->if_flags & IFF_POINTOPOINT) == 0)
-                       return(EINVAL);
+               if ((ifp->if_flags & IFF_POINTOPOINT) == 0) {
+                       error = EINVAL;
+                       goto ioctl_cleanup;
+               }
+               /*
+                * XXX: should we check if ifa_dstaddr is NULL and return
+                * an error?
+                */
                ifr->ifr_dstaddr = ia->ia_dstaddr;
                break;
 
@@ -684,70 +709,36 @@ in6_control(so, cmd, data, ifp)
                break;
 
        case SIOCGIFSTAT_IN6:
-               if (ifp == NULL)
-                       return EINVAL;
-               if (in6_ifstat == NULL || ifp->if_index >= in6_ifstatmax
-                || in6_ifstat[ifp->if_index] == NULL) {
+               if (ifp == NULL) {
+                       error = EINVAL;
+                       goto ioctl_cleanup;
+               }
+               index = ifp->if_index;
+               if (in6_ifstat == NULL || index >= in6_ifstatmax
+                || in6_ifstat[index] == NULL) {
                        /* return EAFNOSUPPORT? */
                        bzero(&ifr->ifr_ifru.ifru_stat,
                                sizeof(ifr->ifr_ifru.ifru_stat));
                } else
-                       ifr->ifr_ifru.ifru_stat = *in6_ifstat[ifp->if_index];
+                       ifr->ifr_ifru.ifru_stat = *in6_ifstat[index];
                break;
 
        case SIOCGIFSTAT_ICMP6:
-               if (ifp == NULL)
-                       return EINVAL;
-               if (icmp6_ifstat == NULL || ifp->if_index >= icmp6_ifstatmax ||
-                   icmp6_ifstat[ifp->if_index] == NULL) {
+               if (ifp == NULL) {
+                       error = EINVAL;
+                       goto ioctl_cleanup;
+               }
+               index = ifp->if_index;
+               if (icmp6_ifstat == NULL || index >= icmp6_ifstatmax ||
+                   icmp6_ifstat[index] == NULL) {
                        /* return EAFNOSUPPORT? */
                        bzero(&ifr->ifr_ifru.ifru_stat,
                                sizeof(ifr->ifr_ifru.ifru_icmp6stat));
                } else
                        ifr->ifr_ifru.ifru_icmp6stat =
-                               *icmp6_ifstat[ifp->if_index];
-               break;
-#if COMPAT_IN6IFIOCTL          /* should be unused */
-       case SIOCSIFDSTADDR_IN6:
-               if ((ifp->if_flags & IFF_POINTOPOINT) == 0)
-                       return(EINVAL);
-               oldaddr = ia->ia_dstaddr;
-               ia->ia_dstaddr = ifr->ifr_dstaddr;
-
-               /* link-local index check */
-               if (IN6_IS_ADDR_LINKLOCAL(&ia->ia_dstaddr.sin6_addr)) {
-                       if (ia->ia_dstaddr.sin6_addr.s6_addr16[1] == 0) {
-                               /* interface ID is not embedded by the user */
-                               ia->ia_dstaddr.sin6_addr.s6_addr16[1]
-                                       = htons(ifp->if_index);
-                       } else if (ia->ia_dstaddr.sin6_addr.s6_addr16[1] !=
-                                   htons(ifp->if_index)) {
-                               ia->ia_dstaddr = oldaddr;
-                               return(EINVAL); /* ifid is contradict */
-                       }
-               }
-#ifdef __APPLE__
-               error = dlil_ioctl(0, ifp, SIOCSIFDSTADDR, (caddr_t)ia);
-                if (error == EOPNOTSUPP)
-                        error = 0;
-                if (error) { 
-                       ia->ia_dstaddr = oldaddr;
-                       return(error);
-               }
-#else
-               if (ifp->if_ioctl && (error = (ifp->if_ioctl)
-                                     (ifp, SIOCSIFDSTADDR, (caddr_t)ia))) {
-#endif
-               if (ia->ia_flags & IFA_ROUTE) {
-                       ia->ia_ifa.ifa_dstaddr = (struct sockaddr *)&oldaddr;
-                       rtinit(&(ia->ia_ifa), (int)RTM_DELETE, RTF_HOST);
-                       ia->ia_ifa.ifa_dstaddr =
-                               (struct sockaddr *)&ia->ia_dstaddr;
-                       rtinit(&(ia->ia_ifa), (int)RTM_ADD, RTF_HOST|RTF_UP);
-               }
+                               *icmp6_ifstat[index];
                break;
 
-#endif
        case SIOCGIFALIFETIME_IN6:
                ifr->ifr_ifru.ifru_lifetime = ia->ia6_lifetime;
                break;
@@ -757,153 +748,456 @@ in6_control(so, cmd, data, ifp)
                /* for sanity */
                if (ia->ia6_lifetime.ia6t_vltime != ND6_INFINITE_LIFETIME) {
                        ia->ia6_lifetime.ia6t_expire =
-                               time_second + ia->ia6_lifetime.ia6t_vltime;
+                               timenow.tv_sec + ia->ia6_lifetime.ia6t_vltime;
                } else
                        ia->ia6_lifetime.ia6t_expire = 0;
                if (ia->ia6_lifetime.ia6t_pltime != ND6_INFINITE_LIFETIME) {
                        ia->ia6_lifetime.ia6t_preferred =
-                               time_second + ia->ia6_lifetime.ia6t_pltime;
+                               timenow.tv_sec + ia->ia6_lifetime.ia6t_pltime;
                } else
                        ia->ia6_lifetime.ia6t_preferred = 0;
                break;
 
-       case SIOCSIFADDR_IN6:
-               error = in6_ifinit(ifp, ia, &ifr->ifr_addr, 1);
-#if 0
-               /*
-                * the code chokes if we are to assign multiple addresses with
-                * the same address prefix (rtinit() will return EEXIST, which
-                * is not fatal actually).  we will get memory leak if we
-                * don't do it.
-                * -> we may want to hide EEXIST from rtinit().
-                */
-  undo:
-               if (error && newifaddr) {
-#if defined(__bsdi__) || (defined(__FreeBSD__) && __FreeBSD__ < 3)
-                       if ((ifa = ifp->if_addrlist) == ia62ifa(ia))
-                               ifp->if_addrlist = ifa->ifa_next;
-                       else {
-                               while (ifa->ifa_next &&
-                                      (ifa->ifa_next != ia62ifa(ia)))
-                                       ifa = ifa->ifa_next;
-                               if (ifa->ifa_next)
-                                       ifa->ifa_next = ia62ifa(ia)->ifa_next;
-                               else {
-                                       printf("Couldn't unlink in6_ifaddr "
-                                           "from ifp\n");
-                               }
-                       }
-#else
-                       TAILQ_REMOVE(&ifp->if_addrlist, &ia->ia_ifa, ifa_list);
-#endif
-                       IFAFREE(&ia->ia_ifa);
-
-                       oia = ia;
-                       if (oia == (ia = in6_ifaddr))
-                               in6_ifaddr = ia->ia_next;
-                       else {
-                               while (ia->ia_next && (ia->ia_next != oia))
-                                       ia = ia->ia_next;
-                               if (ia->ia_next)
-                                       ia->ia_next = oia->ia_next;
-                               else {
-                                       printf("Didn't unlink in6_ifaddr "
-                                           "from list\n");
-                               }
+       case SIOCAIFADDR_IN6:
+       {
+               int i;
+               struct nd_prefix pr0, *pr;
+               
+               /* Attempt to attache the protocol, in case it isn't attached */
+               error = dlil_plumb_protocol(PF_INET6, ifp);
+               if (error) {
+                       if (error != EEXIST) {
+                               printf("SIOCAIFADDR_IN6: %s can't plumb protocol error=%d\n", 
+                                       if_name(ifp), error);
+                               goto ioctl_cleanup;
                        }
-                       IFAFREE(&ia->ia_ifa);
+                       
+                       /* Ignore, EEXIST */
+                       error = 0;
+               }
+               else {
+                       /* PF_INET6 wasn't previously attached */
+                       in6_if_up(ifp, NULL);
                }
-#endif
-               return error;
-
-#if COMPAT_IN6IFIOCTL          /* XXX should be unused */
-       case SIOCSIFNETMASK_IN6:
-               ia->ia_prefixmask = ifr->ifr_addr;
-               bzero(&net, sizeof(net));
-               net.sin6_len = sizeof(struct sockaddr_in6);
-               net.sin6_family = AF_INET6;
-               net.sin6_port = htons(0);
-               net.sin6_flowinfo = htonl(0);
-               net.sin6_addr.s6_addr32[0]
-                       = ia->ia_addr.sin6_addr.s6_addr32[0] &
-                               ia->ia_prefixmask.sin6_addr.s6_addr32[0];
-               net.sin6_addr.s6_addr32[1]
-                       = ia->ia_addr.sin6_addr.s6_addr32[1] &
-                               ia->ia_prefixmask.sin6_addr.s6_addr32[1];
-               net.sin6_addr.s6_addr32[2]
-                       = ia->ia_addr.sin6_addr.s6_addr32[2] &
-                               ia->ia_prefixmask.sin6_addr.s6_addr32[2];
-               net.sin6_addr.s6_addr32[3]
-                       = ia->ia_addr.sin6_addr.s6_addr32[3] &
-                               ia->ia_prefixmask.sin6_addr.s6_addr32[3];
-               ia->ia_net = net;
-               break;
-#endif
 
-       case SIOCAIFADDR_IN6:
-               prefixIsNew = 0;
-               hostIsNew = 1;
+               /*
+                * first, make or update the interface address structure,
+                * and link it to the list.
+                */
+               if ((error = in6_update_ifa(ifp, ifra, ia)) != 0)
+                       goto ioctl_cleanup;
 
-               if (ifra->ifra_addr.sin6_len == 0) {
-                       ifra->ifra_addr = ia->ia_addr;
-                       hostIsNew = 0;
-               } else if (IN6_ARE_ADDR_EQUAL(&ifra->ifra_addr.sin6_addr,
-                                             &ia->ia_addr.sin6_addr))
-                       hostIsNew = 0;
+               /*
+                * then, make the prefix on-link on the interface.
+                * XXX: we'd rather create the prefix before the address, but
+                * we need at least one address to install the corresponding
+                * interface route, so we configure the address first.
+                */
 
-               /* Validate address families: */
                /*
-                * The destination address for a p2p link must have a family
-                * of AF_UNSPEC or AF_INET6.
+                * convert mask to prefix length (prefixmask has already
+                * been validated in in6_update_ifa().
                 */
-               if ((ifp->if_flags & IFF_POINTOPOINT) != 0 &&
-                   ifra->ifra_dstaddr.sin6_family != AF_INET6 &&
-                   ifra->ifra_dstaddr.sin6_family != AF_UNSPEC)
-                       return(EAFNOSUPPORT);
+               bzero(&pr0, sizeof(pr0));
+               pr0.ndpr_ifp = ifp;
+               pr0.ndpr_plen = in6_mask2len(&ifra->ifra_prefixmask.sin6_addr,
+                                            NULL);
+               if (pr0.ndpr_plen == 128)
+                       break;  /* we don't need to install a host route. */
+               pr0.ndpr_prefix = ifra->ifra_addr;
+               pr0.ndpr_mask = ifra->ifra_prefixmask.sin6_addr;
+               /* apply the mask for safety. */
+               for (i = 0; i < 4; i++) {
+                       pr0.ndpr_prefix.sin6_addr.s6_addr32[i] &=
+                               ifra->ifra_prefixmask.sin6_addr.s6_addr32[i];
+               }
                /*
-                * The prefixmask must have a family of AF_UNSPEC or AF_INET6.
+                * XXX: since we don't have an API to set prefix (not address)
+                * lifetimes, we just use the same lifetimes as addresses.
+                * The (temporarily) installed lifetimes can be overridden by
+                * later advertised RAs (when accept_rtadv is non 0), which is
+                * an intended behavior.
                 */
-               if (ifra->ifra_prefixmask.sin6_family != AF_INET6 &&
-                   ifra->ifra_prefixmask.sin6_family != AF_UNSPEC)
-                       return(EAFNOSUPPORT);
-
-               if (ifra->ifra_prefixmask.sin6_len) {
-                       in6_ifscrub(ifp, ia);
-                       ia->ia_prefixmask = ifra->ifra_prefixmask;
-                       prefixIsNew = 1;
+               pr0.ndpr_raf_onlink = 1; /* should be configurable? */
+               pr0.ndpr_raf_auto =
+                       ((ifra->ifra_flags & IN6_IFF_AUTOCONF) != 0);
+               pr0.ndpr_vltime = ifra->ifra_lifetime.ia6t_vltime;
+               pr0.ndpr_pltime = ifra->ifra_lifetime.ia6t_pltime;
+
+               /* add the prefix if there's one. */
+               if ((pr = nd6_prefix_lookup(&pr0)) == NULL) {
+                       /*
+                        * nd6_prelist_add will install the corresponding
+                        * interface route.
+                        */
+                       if ((error = nd6_prelist_add(&pr0, NULL, &pr)) != 0)
+                               goto ioctl_cleanup;
+                       if (pr == NULL) {
+                               log(LOG_ERR, "nd6_prelist_add succedded but "
+                                   "no prefix\n");
+                               error = EINVAL;
+                               goto ioctl_cleanup;
+                       }
                }
-               if ((ifp->if_flags & IFF_POINTOPOINT) &&
-                   (ifra->ifra_dstaddr.sin6_family == AF_INET6)) {
-                       in6_ifscrub(ifp, ia);
-                       oldaddr = ia->ia_dstaddr;
-                       ia->ia_dstaddr = ifra->ifra_dstaddr;
-                       /* link-local index check: should be a separate function? */
-                       if (IN6_IS_ADDR_LINKLOCAL(&ia->ia_dstaddr.sin6_addr)) {
-                               if (ia->ia_dstaddr.sin6_addr.s6_addr16[1] == 0) {
-                                       /*
-                                        * interface ID is not embedded by
-                                        * the user
-                                        */
-                                       ia->ia_dstaddr.sin6_addr.s6_addr16[1]
-                                               = htons(ifp->if_index);
-                               } else if (ia->ia_dstaddr.sin6_addr.s6_addr16[1] !=
-                                           htons(ifp->if_index)) {
-                                       ia->ia_dstaddr = oldaddr;
-                                       return(EINVAL); /* ifid is contradict */
+               if ((ia = in6ifa_ifpwithaddr(ifp, &ifra->ifra_addr.sin6_addr))
+                   == NULL) {
+                       /* XXX: this should not happen! */
+                       log(LOG_ERR, "in6_control: addition succeeded, but"
+                           " no ifaddr\n");
+               } else {
+                       if ((ia->ia6_flags & IN6_IFF_AUTOCONF) != 0 &&
+                           ia->ia6_ndpr == NULL) { /* new autoconfed addr */
+                               ia->ia6_ndpr = pr;
+                               pr->ndpr_refcnt++;
+
+                               /*
+                                * If this is the first autoconf address from
+                                * the prefix, create a temporary address
+                                * as well (when specified).
+                                */
+                               if (ip6_use_tempaddr &&
+                                   pr->ndpr_refcnt == 1) {
+                                       int e;
+                                       if ((e = in6_tmpifadd(ia, 1)) != 0) {
+                                               log(LOG_NOTICE, "in6_control: "
+                                                   "failed to create a "
+                                                   "temporary address, "
+                                                   "errno=%d\n",
+                                                   e);
+                                       }
                                }
                        }
-                       prefixIsNew = 1; /* We lie; but effect's the same */
+
+                       /*
+                        * this might affect the status of autoconfigured
+                        * addresses, that is, this address might make
+                        * other addresses detached.
+                        */
+                       pfxlist_onlink_check(0);
                }
-               if (hostIsNew || prefixIsNew) {
-                       error = in6_ifinit(ifp, ia, &ifra->ifra_addr, 0);
-#if 0
-                       if (error)
-                               goto undo;
+
+               break;
+       }
+
+       case SIOCDIFADDR_IN6:
+       {
+               int i = 0;
+               struct nd_prefix pr0, *pr;
+
+               /*
+                * If the address being deleted is the only one that owns
+                * the corresponding prefix, expire the prefix as well.
+                * XXX: theoretically, we don't have to warry about such
+                * relationship, since we separate the address management
+                * and the prefix management.  We do this, however, to provide
+                * as much backward compatibility as possible in terms of
+                * the ioctl operation.
+                */
+               bzero(&pr0, sizeof(pr0));
+               pr0.ndpr_ifp = ifp;
+               pr0.ndpr_plen = in6_mask2len(&ia->ia_prefixmask.sin6_addr,
+                                            NULL);
+               if (pr0.ndpr_plen == 128)
+                       goto purgeaddr;
+               pr0.ndpr_prefix = ia->ia_addr;
+               pr0.ndpr_mask = ia->ia_prefixmask.sin6_addr;
+               for (i = 0; i < 4; i++) {
+                       pr0.ndpr_prefix.sin6_addr.s6_addr32[i] &=
+                               ia->ia_prefixmask.sin6_addr.s6_addr32[i];
+               }
+               /*
+                * The logic of the following condition is a bit complicated.
+                * We expire the prefix when
+                * 1. the address obeys autoconfiguration and it is the
+                *    only owner of the associated prefix, or
+                * 2. the address does not obey autoconf and there is no
+                *    other owner of the prefix.
+                */
+               if ((pr = nd6_prefix_lookup(&pr0)) != NULL &&
+                   (((ia->ia6_flags & IN6_IFF_AUTOCONF) != 0 &&
+                     pr->ndpr_refcnt == 1) ||
+                    ((ia->ia6_flags & IN6_IFF_AUTOCONF) == 0 &&
+                     pr->ndpr_refcnt == 0))) {
+                       pr->ndpr_expire = 1; /* XXX: just for expiration */
+               }
+
+         purgeaddr:
+               in6_purgeaddr(&ia->ia_ifa, 0);
+               break;
+       }
+
+       default:
+#ifdef __APPLE__
+               error = dlil_ioctl(PF_INET6, ifp, cmd, (caddr_t)data);
+               goto ioctl_cleanup;
+#else
+               if (ifp == NULL || ifp->if_ioctl == 0)
+                       return(EOPNOTSUPP);
+               return((*ifp->if_ioctl)(ifp, cmd, data));
+#endif
+       }
+ioctl_cleanup:
+       return error;
+}
+
+/*
+ * Update parameters of an IPv6 interface address.
+ * If necessary, a new entry is created and linked into address chains.
+ * This function is separated from in6_control().
+ * XXX: should this be performed under splnet()?
+ */
+int
+in6_update_ifa(ifp, ifra, ia)
+       struct ifnet *ifp;
+       struct in6_aliasreq *ifra;
+       struct in6_ifaddr *ia;
+{
+       int error = 0, hostIsNew = 0, plen = -1;
+       struct in6_ifaddr *oia;
+       struct sockaddr_in6 dst6;
+       struct in6_addrlifetime *lt;
+       struct timeval timenow;
+
+
+       lck_mtx_assert(nd6_mutex, LCK_MTX_ASSERT_NOTOWNED);
+       /* Validate parameters */
+       if (ifp == NULL || ifra == NULL) /* this maybe redundant */
+               return(EINVAL);
+
+       /*
+        * The destination address for a p2p link must have a family
+        * of AF_UNSPEC or AF_INET6.
+        */
+       if ((ifp->if_flags & IFF_POINTOPOINT) != 0 &&
+           ifra->ifra_dstaddr.sin6_family != AF_INET6 &&
+           ifra->ifra_dstaddr.sin6_family != AF_UNSPEC)
+               return(EAFNOSUPPORT);
+       /*
+        * validate ifra_prefixmask.  don't check sin6_family, netmask
+        * does not carry fields other than sin6_len.
+        */
+       if (ifra->ifra_prefixmask.sin6_len > sizeof(struct sockaddr_in6))
+               return(EINVAL);
+       /*
+        * Set the address family value for the mask if it was not set.
+        * Radar 3899482.
+        */
+       if (ifra->ifra_prefixmask.sin6_len == sizeof(struct sockaddr_in6) &&
+               ifra->ifra_prefixmask.sin6_family == 0) {
+               ifra->ifra_prefixmask.sin6_family = AF_INET6;
+       }
+       /*
+        * Because the IPv6 address architecture is classless, we require
+        * users to specify a (non 0) prefix length (mask) for a new address.
+        * We also require the prefix (when specified) mask is valid, and thus
+        * reject a non-consecutive mask.
+        */
+       if (ia == NULL && ifra->ifra_prefixmask.sin6_len == 0)
+               return(EINVAL);
+       if (ifra->ifra_prefixmask.sin6_len != 0) {
+               plen = in6_mask2len(&ifra->ifra_prefixmask.sin6_addr,
+                                   (u_char *)&ifra->ifra_prefixmask +
+                                   ifra->ifra_prefixmask.sin6_len);
+               if (plen <= 0)
+                       return(EINVAL);
+       }
+       else {
+               /*
+                * In this case, ia must not be NULL.  We just use its prefix
+                * length.
+                */
+               plen = in6_mask2len(&ia->ia_prefixmask.sin6_addr, NULL);
+       }
+       /*
+        * If the destination address on a p2p interface is specified,
+        * and the address is a scoped one, validate/set the scope
+        * zone identifier.
+        */
+       dst6 = ifra->ifra_dstaddr;
+       if ((ifp->if_flags & (IFF_POINTOPOINT|IFF_LOOPBACK)) &&
+           (dst6.sin6_family == AF_INET6)) {
+               int scopeid;
+
+#ifndef SCOPEDROUTING
+               if ((error = in6_recoverscope(&dst6,
+                                             &ifra->ifra_dstaddr.sin6_addr,
+                                             ifp)) != 0)
+                       return(error);
 #endif
+               scopeid = in6_addr2scopeid(ifp, &dst6.sin6_addr);
+               if (dst6.sin6_scope_id == 0) /* user omit to specify the ID. */
+                       dst6.sin6_scope_id = scopeid;
+               else if (dst6.sin6_scope_id != scopeid)
+                       return(EINVAL); /* scope ID mismatch. */
+#ifndef SCOPEDROUTING
+               if ((error = in6_embedscope(&dst6.sin6_addr, &dst6, NULL, NULL))
+                   != 0)
+                       return(error);
+               dst6.sin6_scope_id = 0; /* XXX */
+#endif
+       }
+       /*
+        * The destination address can be specified only for a p2p or a
+        * loopback interface.  If specified, the corresponding prefix length
+        * must be 128.
+        */
+       if (ifra->ifra_dstaddr.sin6_family == AF_INET6) {
+               if ((ifp->if_flags & (IFF_POINTOPOINT|IFF_LOOPBACK)) == 0) {
+                       /* XXX: noisy message */
+                       log(LOG_INFO, "in6_update_ifa: a destination can be "
+                           "specified for a p2p or a loopback IF only\n");
+                       return(EINVAL);
+               }
+               if (plen != 128) {
+                       /*
+                        * The following message seems noisy, but we dare to
+                        * add it for diagnosis.
+                        */
+                       log(LOG_INFO, "in6_update_ifa: prefixlen must be 128 "
+                           "when dstaddr is specified\n");
+                       return(EINVAL);
+               }
+       }
+       /* lifetime consistency check */
+
+       getmicrotime(&timenow);
+       lt = &ifra->ifra_lifetime;
+       if (lt->ia6t_vltime != ND6_INFINITE_LIFETIME
+           && lt->ia6t_vltime + timenow.tv_sec < timenow.tv_sec) {
+               return EINVAL;
+       }
+       if (lt->ia6t_vltime == 0) {
+               /*
+                * the following log might be noisy, but this is a typical
+                * configuration mistake or a tool's bug.
+                */
+               log(LOG_INFO,
+                   "in6_update_ifa: valid lifetime is 0 for %s\n",
+                   ip6_sprintf(&ifra->ifra_addr.sin6_addr));
+       }
+       if (lt->ia6t_pltime != ND6_INFINITE_LIFETIME
+           && lt->ia6t_pltime + timenow.tv_sec < timenow.tv_sec) {
+               return EINVAL;
+       }
+
+       /*
+        * If this is a new address, allocate a new ifaddr and link it
+        * into chains.
+        */
+       if (ia == NULL) {
+               hostIsNew = 1;
+               /*
+                * When in6_update_ifa() is called in a process of a received
+                * RA, it is called under splnet().  So, we should call malloc
+                * with M_NOWAIT.
+                */
+               ia = (struct in6_ifaddr *)
+                       _MALLOC(sizeof(*ia), M_IFADDR, M_NOWAIT);
+               if (ia == NULL)
+                       return ENOBUFS;
+               bzero((caddr_t)ia, sizeof(*ia));
+               /* Initialize the address and masks */
+               ia->ia_ifa.ifa_addr = (struct sockaddr *)&ia->ia_addr;
+               ia->ia_addr.sin6_family = AF_INET6;
+               ia->ia_addr.sin6_len = sizeof(ia->ia_addr);
+               if ((ifp->if_flags & (IFF_POINTOPOINT | IFF_LOOPBACK)) != 0) {
+                       /*
+                        * XXX: some functions expect that ifa_dstaddr is not
+                        * NULL for p2p interfaces.
+                        */
+                       ia->ia_ifa.ifa_dstaddr
+                               = (struct sockaddr *)&ia->ia_dstaddr;
+               } else {
+                       ia->ia_ifa.ifa_dstaddr = NULL;
+               }
+               ia->ia_ifa.ifa_netmask
+                       = (struct sockaddr *)&ia->ia_prefixmask;
+
+               ia->ia_ifp = ifp;
+               lck_mtx_lock(nd6_mutex);
+               if ((oia = in6_ifaddrs) != NULL) {
+                       for ( ; oia->ia_next; oia = oia->ia_next)
+                               continue;
+                       oia->ia_next = ia;
+               } else
+                       in6_ifaddrs = ia;
+               lck_mtx_unlock(nd6_mutex);
+
+               ifnet_lock_exclusive(ifp);
+               if_attach_ifa(ifp, &ia->ia_ifa);
+               ifnet_lock_done(ifp);
+       }
+
+       /* set prefix mask */
+       if (ifra->ifra_prefixmask.sin6_len) {
+               /*
+                * We prohibit changing the prefix length of an existing
+                * address, because
+                * + such an operation should be rare in IPv6, and
+                * + the operation would confuse prefix management.
+                */
+               if (ia->ia_prefixmask.sin6_len &&
+                   in6_mask2len(&ia->ia_prefixmask.sin6_addr, NULL) != plen) {
+                       log(LOG_INFO, "in6_update_ifa: the prefix length of an"
+                           " existing (%s) address should not be changed\n",
+                           ip6_sprintf(&ia->ia_addr.sin6_addr));
+                       error = EINVAL;
+                       goto unlink;
                }
-               if (hostIsNew && (ifp->if_flags & IFF_MULTICAST)) {
-                       int error_local = 0;
+               ia->ia_prefixmask = ifra->ifra_prefixmask;
+       }
 
+       /*
+        * If a new destination address is specified, scrub the old one and
+        * install the new destination.  Note that the interface must be
+        * p2p or loopback (see the check above.) 
+        */
+       if (dst6.sin6_family == AF_INET6 &&
+           !IN6_ARE_ADDR_EQUAL(&dst6.sin6_addr,
+                               &ia->ia_dstaddr.sin6_addr)) {
+               int e;
+
+               if ((ia->ia_flags & IFA_ROUTE) != 0 &&
+                   (e = rtinit(&(ia->ia_ifa), (int)RTM_DELETE, RTF_HOST))
+                   != 0) {
+                       log(LOG_ERR, "in6_update_ifa: failed to remove "
+                           "a route to the old destination: %s\n",
+                           ip6_sprintf(&ia->ia_addr.sin6_addr));
+                       /* proceed anyway... */
+               }
+               else
+                       ia->ia_flags &= ~IFA_ROUTE;
+               ia->ia_dstaddr = dst6;
+       }
+
+       /* reset the interface and routing table appropriately. */
+       if ((error = in6_ifinit(ifp, ia, &ifra->ifra_addr, hostIsNew)) != 0)
+               goto unlink;
+
+       /*
+        * Beyond this point, we should call in6_purgeaddr upon an error,
+        * not just go to unlink. 
+        */
+
+#if 0                          /* disable this mechanism for now */
+       /* update prefix list */
+       if (hostIsNew &&
+           (ifra->ifra_flags & IN6_IFF_NOPFX) == 0) { /* XXX */
+               int iilen;
+
+               iilen = (sizeof(ia->ia_prefixmask.sin6_addr) << 3) - plen;
+               if ((error = in6_prefix_add_ifid(iilen, ia)) != 0) {
+                       in6_purgeaddr((struct ifaddr *)ia, 0);
+                       return(error);
+               }
+       }
+#endif
+
+       if ((ifp->if_flags & IFF_MULTICAST) != 0) {
+               struct sockaddr_in6 mltaddr, mltmask;
+               struct in6_multi *in6m;
+
+               if (hostIsNew) {
                        /*
                         * join solicited multicast addr for new host id
                         */
@@ -916,97 +1210,190 @@ in6_control(so, cmd, data, ifp)
                        llsol.s6_addr32[3] =
                                ifra->ifra_addr.sin6_addr.s6_addr32[3];
                        llsol.s6_addr8[12] = 0xff;
-                       (void)in6_addmulti(&llsol, ifp, &error_local);
-                       if (error == 0)
-                               error = error_local;
+                       (void)in6_addmulti(&llsol, ifp, &error, 0);
+                       if (error != 0) {
+                               log(LOG_WARNING,
+                                   "in6_update_ifa: addmulti failed for "
+                                   "%s on %s (errno=%d)\n",
+                                   ip6_sprintf(&llsol), if_name(ifp),
+                                   error);
+                               in6_purgeaddr((struct ifaddr *)ia, 0);
+                               return(error);
+                       }
                }
 
-               ia->ia6_flags = ifra->ifra_flags;
-               ia->ia6_flags &= ~IN6_IFF_DUPLICATED;   /*safety*/
-               ia->ia6_flags &= ~IN6_IFF_NODAD;        /* Mobile IPv6 */
-
-               ia->ia6_lifetime = ifra->ifra_lifetime;
-               /* for sanity */
-               if (ia->ia6_lifetime.ia6t_vltime != ND6_INFINITE_LIFETIME) {
-                       ia->ia6_lifetime.ia6t_expire =
-                               time_second + ia->ia6_lifetime.ia6t_vltime;
-               } else
-                       ia->ia6_lifetime.ia6t_expire = 0;
-               if (ia->ia6_lifetime.ia6t_pltime != ND6_INFINITE_LIFETIME) {
-                       ia->ia6_lifetime.ia6t_preferred =
-                               time_second + ia->ia6_lifetime.ia6t_pltime;
-               } else
-                       ia->ia6_lifetime.ia6t_preferred = 0;
+               bzero(&mltmask, sizeof(mltmask));
+               mltmask.sin6_len = sizeof(struct sockaddr_in6);
+               mltmask.sin6_family = AF_INET6;
+               mltmask.sin6_addr = in6mask32;
 
                /*
-                * Perform DAD, if needed.
-                * XXX It may be of use, if we can administratively
-                * disable DAD.
+                * join link-local all-nodes address
                 */
-               switch (ifp->if_type) {
-               case IFT_ARCNET:
-               case IFT_ETHER:
-               case IFT_FDDI:
-#if 0
-               case IFT_ATM:
-               case IFT_SLIP:
-               case IFT_PPP:
-#endif
-                       /* Mobile IPv6 modification */
-                       if ((ifra->ifra_flags & IN6_IFF_NODAD) == 0) {
-                               ia->ia6_flags |= IN6_IFF_TENTATIVE;
-                               nd6_dad_start((struct ifaddr *)ia, NULL);
+               bzero(&mltaddr, sizeof(mltaddr));
+               mltaddr.sin6_len = sizeof(struct sockaddr_in6);
+               mltaddr.sin6_family = AF_INET6;
+               mltaddr.sin6_addr = in6addr_linklocal_allnodes;
+               mltaddr.sin6_addr.s6_addr16[1] = htons(ifp->if_index);
+
+               ifnet_lock_shared(ifp);
+               IN6_LOOKUP_MULTI(mltaddr.sin6_addr, ifp, in6m);
+               ifnet_lock_done(ifp);
+               if (in6m == NULL) {
+                       rtrequest(RTM_ADD,
+                                 (struct sockaddr *)&mltaddr,
+                                 (struct sockaddr *)&ia->ia_addr,
+                                 (struct sockaddr *)&mltmask,
+                                 RTF_UP|RTF_CLONING,  /* xxx */
+                                 (struct rtentry **)0);
+                       (void)in6_addmulti(&mltaddr.sin6_addr, ifp, &error, 0);
+                       if (error != 0) {
+                               log(LOG_WARNING,
+                                   "in6_update_ifa: addmulti failed for "
+                                   "%s on %s (errno=%d)\n",
+                                   ip6_sprintf(&mltaddr.sin6_addr), 
+                                   if_name(ifp), error);
                        }
-                       break;
-               case IFT_DUMMY:
-               case IFT_FAITH:
-               case IFT_GIF:
-               case IFT_LOOP:
-               default:
-                       break;
                }
 
-               if (hostIsNew) {
-                       int iilen;
-                       int error_local = 0;
-
-                       iilen = (sizeof(ia->ia_prefixmask.sin6_addr) << 3) -
-                               in6_mask2len(&ia->ia_prefixmask.sin6_addr);
-                       error_local = in6_prefix_add_ifid(iilen, ia);
-                       if (error == 0)
-                               error = error_local;
+               /*
+                * join node information group address
+                */
+#define hostnamelen    strlen(hostname)
+               if (in6_nigroup(ifp, hostname, hostnamelen, &mltaddr.sin6_addr)
+                   == 0) {
+                   ifnet_lock_shared(ifp);
+                       IN6_LOOKUP_MULTI(mltaddr.sin6_addr, ifp, in6m);
+                       ifnet_lock_done(ifp);
+                       if (in6m == NULL && ia != NULL) {
+                               (void)in6_addmulti(&mltaddr.sin6_addr,
+                                   ifp, &error, 0);
+                               if (error != 0) {
+                                       log(LOG_WARNING, "in6_update_ifa: "
+                                           "addmulti failed for "
+                                           "%s on %s (errno=%d)\n",
+                                           ip6_sprintf(&mltaddr.sin6_addr), 
+                                           if_name(ifp), error);
+                               }
+                       }
                }
+#undef hostnamelen
 
-               return(error);
+               /*
+                * join node-local all-nodes address, on loopback.
+                * XXX: since "node-local" is obsoleted by interface-local,
+                *      we have to join the group on every interface with
+                *      some interface-boundary restriction.
+                */
+               if (ifp->if_flags & IFF_LOOPBACK) {
+                       struct in6_ifaddr *ia_loop;
+
+                       struct in6_addr loop6 = in6addr_loopback;
+                       ia_loop = in6ifa_ifpwithaddr(ifp, &loop6);
+
+                       mltaddr.sin6_addr = in6addr_nodelocal_allnodes;
+
+                       ifnet_lock_shared(ifp);
+                       IN6_LOOKUP_MULTI(mltaddr.sin6_addr, ifp, in6m);
+                       ifnet_lock_done(ifp);
+                       if (in6m == NULL && ia_loop != NULL) {
+                               rtrequest(RTM_ADD,
+                                         (struct sockaddr *)&mltaddr,
+                                         (struct sockaddr *)&ia_loop->ia_addr,
+                                         (struct sockaddr *)&mltmask,
+                                         RTF_UP,
+                                         (struct rtentry **)0);
+                               (void)in6_addmulti(&mltaddr.sin6_addr, ifp,
+                                                  &error, 0);
+                               if (error != 0) {
+                                       log(LOG_WARNING, "in6_update_ifa: "
+                                           "addmulti failed for %s on %s "
+                                           "(errno=%d)\n",
+                                           ip6_sprintf(&mltaddr.sin6_addr), 
+                                           if_name(ifp), error);
+                               }
+                       }
+               }
+       }
 
-       case SIOCDIFADDR_IN6:
-               in6_purgeaddr(&ia->ia_ifa, ifp);
-               break;
+       ia->ia6_flags = ifra->ifra_flags;
+       ia->ia6_flags &= ~IN6_IFF_DUPLICATED;   /*safety*/
+       ia->ia6_flags &= ~IN6_IFF_NODAD;        /* Mobile IPv6 */
+
+       ia->ia6_lifetime = ifra->ifra_lifetime;
+       /* for sanity */
+       if (ia->ia6_lifetime.ia6t_vltime != ND6_INFINITE_LIFETIME) {
+               ia->ia6_lifetime.ia6t_expire =
+                       timenow.tv_sec + ia->ia6_lifetime.ia6t_vltime;
+       } else
+               ia->ia6_lifetime.ia6t_expire = 0;
+       if (ia->ia6_lifetime.ia6t_pltime != ND6_INFINITE_LIFETIME) {
+               ia->ia6_lifetime.ia6t_preferred =
+                       timenow.tv_sec + ia->ia6_lifetime.ia6t_pltime;
+       } else
+               ia->ia6_lifetime.ia6t_preferred = 0;
 
-       default:
-#ifdef __APPLE__
-                error = dlil_ioctl(0, ifp, cmd, (caddr_t)data);
-               if (error == EOPNOTSUPP)
-                       error = 0;
-                return error;
+       /*
+        * make sure to initialize ND6 information.  this is to workaround
+        * issues with interfaces with IPv6 addresses, which have never brought
+        * up.  We are assuming that it is safe to nd6_ifattach multiple times.
+        */
+       nd6_ifattach(ifp);
 
-#else
-               if (ifp == NULL || ifp->if_ioctl == 0)
-                       return(EOPNOTSUPP);
-               return((*ifp->if_ioctl)(ifp, cmd, data));
-#endif
+       /*
+        * Perform DAD, if needed.
+        * XXX It may be of use, if we can administratively
+        * disable DAD.
+        */
+       if (in6if_do_dad(ifp) && (ifra->ifra_flags & IN6_IFF_NODAD) == 0) {
+               ia->ia6_flags |= IN6_IFF_TENTATIVE;
+               nd6_dad_start((struct ifaddr *)ia, NULL);
        }
-       return(0);
+
+       return(error);
+
+  unlink:
+       /*
+        * XXX: if a change of an existing address failed, keep the entry
+        * anyway.
+        */
+       if (hostIsNew)
+               in6_unlink_ifa(ia, ifp, 0);
+       return(error);
 }
 
 void
-in6_purgeaddr(ifa, ifp)
-       struct ifaddr *ifa;
-       struct ifnet *ifp;
+in6_purgeaddr(
+       struct ifaddr *ifa, int nd6_locked)
 {
-       struct in6_ifaddr *oia, *ia = (void *) ifa;
+       struct ifnet *ifp = ifa->ifa_ifp;
+       struct in6_ifaddr *ia = (struct in6_ifaddr *) ifa;
+
+       /* stop DAD processing */
+       nd6_dad_stop(ifa);
 
-       in6_ifscrub(ifp, ia);
+       /*
+        * delete route to the destination of the address being purged.
+        * The interface must be p2p or loopback in this case.
+        */
+       if ((ia->ia_flags & IFA_ROUTE) != 0 && ia->ia_dstaddr.sin6_len != 0) {
+               int e;
+
+               if ((e = rtinit(&(ia->ia_ifa), (int)RTM_DELETE, RTF_HOST))
+                   != 0) {
+                       log(LOG_ERR, "in6_purgeaddr: failed to remove "
+                           "a route to the p2p destination: %s on %s, "
+                           "errno=%d\n",
+                           ip6_sprintf(&ia->ia_addr.sin6_addr), if_name(ifp),
+                           e);
+                       /* proceed anyway... */
+               }
+               else
+                       ia->ia_flags &= ~IFA_ROUTE;
+       }
+
+       /* Remove ownaddr's loopback rtentry, if it exists. */
+       in6_ifremloop(&(ia->ia_ifa), nd6_locked);
 
        if (ifp->if_flags & IFF_MULTICAST) {
                /*
@@ -1023,57 +1410,106 @@ in6_purgeaddr(ifa, ifp)
                        ia->ia_addr.sin6_addr.s6_addr32[3];
                llsol.s6_addr8[12] = 0xff;
 
+               ifnet_lock_shared(ifp);
                IN6_LOOKUP_MULTI(llsol, ifp, in6m);
+               ifnet_lock_done(ifp);
                if (in6m)
-                       in6_delmulti(in6m);
+                       in6_delmulti(in6m, nd6_locked);
        }
 
-#if defined(__bsdi__) || (defined(__FreeBSD__) && __FreeBSD__ < 3)
-       if ((ifa = ifp->if_addrlist) == ia62ifa(ia))
-               ifp->if_addrlist = ifa->ifa_next;
-       else {
-               while (ifa->ifa_next &&
-                      (ifa->ifa_next != ia62ifa(ia)))
-                       ifa = ifa->ifa_next;
-               if (ifa->ifa_next)
-                       ifa->ifa_next = ia62ifa(ia)->ifa_next;
-               else
-                       printf("Couldn't unlink in6_ifaddr from ifp\n");
-       }
-#else
-       TAILQ_REMOVE(&ifp->if_addrlist, &ia->ia_ifa, ifa_list);
-#endif
-       IFAFREE(&ia->ia_ifa);
+       in6_unlink_ifa(ia, ifp, nd6_locked);
+       in6_post_msg(ifp, KEV_INET6_ADDR_DELETED, ia);
+}
 
+static void
+in6_unlink_ifa(ia, ifp, nd6_locked)
+       struct in6_ifaddr *ia;
+       struct ifnet *ifp;
+       int nd6_locked;
+{
+       int plen, iilen;
+       struct in6_ifaddr *oia;
+
+       ifnet_lock_exclusive(ifp);
+       if_detach_ifa(ifp, &ia->ia_ifa);
+       ifnet_lock_done(ifp);
+
+       if (!nd6_locked)
+               lck_mtx_lock(nd6_mutex);
        oia = ia;
-       if (oia == (ia = in6_ifaddr))
-               in6_ifaddr = ia->ia_next;
+       if (oia == (ia = in6_ifaddrs)) 
+               in6_ifaddrs = ia->ia_next;
        else {
                while (ia->ia_next && (ia->ia_next != oia))
                        ia = ia->ia_next;
                if (ia->ia_next)
                        ia->ia_next = oia->ia_next;
-               else
-                       printf("Didn't unlink in6_ifaddr from list\n");
+               else {
+                       /* search failed */
+                       printf("Couldn't unlink in6_ifaddr from in6_ifaddr\n");
+               }
        }
-       {
-               int iilen;
-
-               iilen = (sizeof(oia->ia_prefixmask.sin6_addr) << 3) -
-                       in6_mask2len(&oia->ia_prefixmask.sin6_addr);
+       if (oia->ia6_ifpr) {    /* check for safety */
+               plen = in6_mask2len(&oia->ia_prefixmask.sin6_addr, NULL);
+               iilen = (sizeof(oia->ia_prefixmask.sin6_addr) << 3) - plen;
                in6_prefix_remove_ifid(iilen, oia);
        }
-#if !(defined(__FreeBSD__) && __FreeBSD__ >= 3) && !defined (__APPLE__)
-       if (oia->ia6_multiaddrs.lh_first != NULL)
-               in6_savemkludge(oia);
-#endif
 
-       IFAFREE(&oia->ia_ifa);
+       /*
+        * When an autoconfigured address is being removed, release the
+        * reference to the base prefix.  Also, since the release might
+        * affect the status of other (detached) addresses, call
+        * pfxlist_onlink_check().
+        */
+       if ((oia->ia6_flags & IN6_IFF_AUTOCONF) != 0) {
+               if (oia->ia6_ndpr == NULL) {
+                       log(LOG_NOTICE, "in6_unlink_ifa: autoconf'ed address "
+                           "%p has no prefix\n", oia);
+               } else {
+                       oia->ia6_ndpr->ndpr_refcnt--;
+                       oia->ia6_flags &= ~IN6_IFF_AUTOCONF;
+                       oia->ia6_ndpr = NULL;
+               }
+
+               pfxlist_onlink_check(1);
+       }
+       if (!nd6_locked)
+               lck_mtx_unlock(nd6_mutex);
+
+
+       /*
+        * release another refcnt for the link from in6_ifaddrs.
+        * Note that we should decrement the refcnt at least once for all *BSD.
+        */
+       ifafree(&oia->ia_ifa);
+
+}
+
+void
+in6_purgeif(ifp)
+       struct ifnet *ifp;
+{
+       struct in6_ifaddr *ia, *nia = NULL;
+
+       if (ifp == NULL || &ifp->if_addrlist == NULL)
+               return;
+       
+       lck_mtx_lock(nd6_mutex);
+       for (ia = in6_ifaddrs; ia != NULL; ia = nia)
+       {
+               nia = ia->ia_next;
+               if (ia->ia_ifa.ifa_ifp != ifp)
+                       continue;
+               in6_purgeaddr(&ia->ia_ifa, 1);
+       }
+       lck_mtx_unlock(nd6_mutex);
+
+       in6_ifdetach(ifp);
 }
 
 /*
  * SIOC[GAD]LIFADDR.
- *     SIOCGLIFADDR: get first address. (???)
+ *     SIOCGLIFADDR: get first address. (?)
  *     SIOCGLIFADDR with IFLR_PREFIX:
  *             get first address that matches the specified prefix.
  *     SIOCALIFADDR: add the specified address.
@@ -1095,20 +1531,12 @@ in6_purgeaddr(ifa, ifp)
  * address encoding scheme. (see figure on page 8)
  */
 static int
-#if !defined(__bsdi__) && !(defined(__FreeBSD__) && __FreeBSD__ < 3) && !defined (__APPLE__)
 in6_lifaddr_ioctl(so, cmd, data, ifp, p)
        struct socket *so;
        u_long cmd;
        caddr_t data;
        struct ifnet *ifp;
        struct proc *p;
-#else
-in6_lifaddr_ioctl(so, cmd, data, ifp)
-       struct socket *so;
-       u_long cmd;
-       caddr_t data;
-       struct ifnet *ifp;
-#endif
 {
        struct if_laddrreq *iflr = (struct if_laddrreq *)data;
        struct ifaddr *ifa;
@@ -1125,7 +1553,7 @@ in6_lifaddr_ioctl(so, cmd, data, ifp)
                /* address must be specified on GET with IFLR_PREFIX */
                if ((iflr->flags & IFLR_PREFIX) == 0)
                        break;
-               /*FALLTHROUGH*/
+               /* FALLTHROUGH */
        case SIOCALIFADDR:
        case SIOCDLIFADDR:
                /* address must be specified on ADD and DELETE */
@@ -1141,10 +1569,10 @@ in6_lifaddr_ioctl(so, cmd, data, ifp)
                if (sa->sa_len && sa->sa_len != sizeof(struct sockaddr_in6))
                        return EINVAL;
                break;
-       default: /*shouldn't happen*/
+       default: /* shouldn't happen */
 #if 0
                panic("invalid cmd to in6_lifaddr_ioctl");
-               /*NOTREACHED*/
+               /* NOTREACHED */
 #else
                return EOPNOTSUPP;
 #endif
@@ -1156,8 +1584,9 @@ in6_lifaddr_ioctl(so, cmd, data, ifp)
        case SIOCALIFADDR:
            {
                struct in6_aliasreq ifra;
-               struct in6_addr *hostid = NULL;
+               struct in6_addr hostid;
                int prefixlen;
+               int hostid_found = 0;
 
                if ((iflr->flags & IFLR_PREFIX) != 0) {
                        struct sockaddr_in6 *sin6;
@@ -1170,7 +1599,8 @@ in6_lifaddr_ioctl(so, cmd, data, ifp)
                        ifa = (struct ifaddr *)in6ifa_ifpforlinklocal(ifp, 0);
                        if (!ifa)
                                return EADDRNOTAVAIL;
-                       hostid = IFA_IN6(ifa);
+                       hostid = *IFA_IN6(ifa);
+                       hostid_found = 1;
 
                        /* prefixlen must be <= 64. */
                        if (64 < iflr->prefixlen)
@@ -1193,35 +1623,30 @@ in6_lifaddr_ioctl(so, cmd, data, ifp)
 
                bcopy(&iflr->addr, &ifra.ifra_addr,
                        ((struct sockaddr *)&iflr->addr)->sa_len);
-               if (hostid) {
+               if (hostid_found) {
                        /* fill in hostid part */
                        ifra.ifra_addr.sin6_addr.s6_addr32[2] =
-                               hostid->s6_addr32[2];
+                               hostid.s6_addr32[2];
                        ifra.ifra_addr.sin6_addr.s6_addr32[3] =
-                               hostid->s6_addr32[3];
+                               hostid.s6_addr32[3];
                }
 
                if (((struct sockaddr *)&iflr->dstaddr)->sa_family) {   /*XXX*/
                        bcopy(&iflr->dstaddr, &ifra.ifra_dstaddr,
                                ((struct sockaddr *)&iflr->dstaddr)->sa_len);
-                       if (hostid) {
+                       if (hostid_found) {
                                ifra.ifra_dstaddr.sin6_addr.s6_addr32[2] =
-                                       hostid->s6_addr32[2];
+                                       hostid.s6_addr32[2];
                                ifra.ifra_dstaddr.sin6_addr.s6_addr32[3] =
-                                       hostid->s6_addr32[3];
+                                       hostid.s6_addr32[3];
                        }
                }
 
-               ifra.ifra_prefixmask.sin6_family = AF_INET6;
                ifra.ifra_prefixmask.sin6_len = sizeof(struct sockaddr_in6);
                in6_len2mask(&ifra.ifra_prefixmask.sin6_addr, prefixlen);
 
                ifra.ifra_flags = iflr->flags & ~IFLR_PREFIX;
-#if !defined(__bsdi__) && !(defined(__FreeBSD__) && __FreeBSD__ < 3) && !defined (__APPLE__)
                return in6_control(so, SIOCAIFADDR_IN6, (caddr_t)&ifra, ifp, p);
-#else
-               return in6_control(so, SIOCAIFADDR_IN6, (caddr_t)&ifra, ifp);
-#endif
            }
        case SIOCGLIFADDR:
        case SIOCDLIFADDR:
@@ -1251,7 +1676,7 @@ in6_lifaddr_ioctl(so, cmd, data, ifp)
                } else {
                        if (cmd == SIOCGLIFADDR) {
                                /* on getting an address, take the 1st match */
-                               cmp = 0;        /*XXX*/
+                               cmp = 0;        /* XXX */
                        } else {
                                /* on deleting an address, do exact match */
                                in6_len2mask(&mask, 128);
@@ -1262,19 +1687,24 @@ in6_lifaddr_ioctl(so, cmd, data, ifp)
                        }
                }
 
-#if defined(__bsdi__) || (defined(__FreeBSD__) && __FreeBSD__ < 3)
-               for (ifa = ifp->if_addrlist; ifa; ifa = ifa->ifa_next)
-#else
-               for (ifa = ifp->if_addrlist.tqh_first;
-                    ifa;
-                    ifa = ifa->ifa_list.tqe_next)
-#endif
+               ifnet_lock_shared(ifp);
+               TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list)
                {
                        if (ifa->ifa_addr->sa_family != AF_INET6)
                                continue;
                        if (!cmp)
                                break;
+
                        bcopy(IFA_IN6(ifa), &candidate, sizeof(candidate));
+#ifndef SCOPEDROUTING
+                       /*
+                        * XXX: this is adhoc, but is necessary to allow
+                        * a user to specify fe80::/64 (not /10) for a
+                        * link-local address.
+                        */
+                       if (IN6_IS_ADDR_LINKLOCAL(&candidate))
+                               candidate.s6_addr16[1] = 0;
+#endif
                        candidate.s6_addr32[0] &= mask.s6_addr32[0];
                        candidate.s6_addr32[1] &= mask.s6_addr32[1];
                        candidate.s6_addr32[2] &= mask.s6_addr32[2];
@@ -1282,24 +1712,46 @@ in6_lifaddr_ioctl(so, cmd, data, ifp)
                        if (IN6_ARE_ADDR_EQUAL(&candidate, &match))
                                break;
                }
+               ifnet_lock_done(ifp);
                if (!ifa)
                        return EADDRNOTAVAIL;
                ia = ifa2ia6(ifa);
 
                if (cmd == SIOCGLIFADDR) {
+#ifndef SCOPEDROUTING
+                       struct sockaddr_in6 *s6;
+#endif
+
                        /* fill in the if_laddrreq structure */
                        bcopy(&ia->ia_addr, &iflr->addr, ia->ia_addr.sin6_len);
-
+#ifndef SCOPEDROUTING          /* XXX see above */
+                       s6 = (struct sockaddr_in6 *)&iflr->addr;
+                       if (IN6_IS_ADDR_LINKLOCAL(&s6->sin6_addr)) {
+                               s6->sin6_addr.s6_addr16[1] = 0;
+                               s6->sin6_scope_id =
+                                       in6_addr2scopeid(ifp, &s6->sin6_addr);
+                       }
+#endif
                        if ((ifp->if_flags & IFF_POINTOPOINT) != 0) {
                                bcopy(&ia->ia_dstaddr, &iflr->dstaddr,
                                        ia->ia_dstaddr.sin6_len);
+#ifndef SCOPEDROUTING          /* XXX see above */
+                               s6 = (struct sockaddr_in6 *)&iflr->dstaddr;
+                               if (IN6_IS_ADDR_LINKLOCAL(&s6->sin6_addr)) {
+                                       s6->sin6_addr.s6_addr16[1] = 0;
+                                       s6->sin6_scope_id =
+                                               in6_addr2scopeid(ifp,
+                                                                &s6->sin6_addr);
+                               }
+#endif
                        } else
                                bzero(&iflr->dstaddr, sizeof(iflr->dstaddr));
 
                        iflr->prefixlen =
-                               in6_mask2len(&ia->ia_prefixmask.sin6_addr);
+                               in6_mask2len(&ia->ia_prefixmask.sin6_addr,
+                                            NULL);
 
-                       iflr->flags = ia->ia6_flags;    /*XXX*/
+                       iflr->flags = ia->ia6_flags;    /* XXX */
 
                        return 0;
                } else {
@@ -1310,404 +1762,116 @@ in6_lifaddr_ioctl(so, cmd, data, ifp)
                        bcopy(iflr->iflr_name, ifra.ifra_name,
                                sizeof(ifra.ifra_name));
 
-                       bcopy(&ia->ia_addr, &ifra.ifra_addr,
-                               ia->ia_addr.sin6_len);
-                       if ((ifp->if_flags & IFF_POINTOPOINT) != 0) {
-                               bcopy(&ia->ia_dstaddr, &ifra.ifra_dstaddr,
-                                       ia->ia_dstaddr.sin6_len);
-                       } else {
-                               bzero(&ifra.ifra_dstaddr,
-                                   sizeof(ifra.ifra_dstaddr));
-                       }
-                       bcopy(&ia->ia_prefixmask, &ifra.ifra_dstaddr,
-                               ia->ia_prefixmask.sin6_len);
-
-                       ifra.ifra_flags = ia->ia6_flags;
-#if !defined(__bsdi__) && !(defined(__FreeBSD__) && __FreeBSD__ < 3) && !defined (__APPLE__)
-                       return in6_control(so, SIOCDIFADDR_IN6, (caddr_t)&ifra,
-                               ifp, p);
-#else
-                       return in6_control(so, SIOCDIFADDR_IN6, (caddr_t)&ifra,
-                               ifp);
-#endif
-               }
-           }
-       }
-
-       return EOPNOTSUPP;      /*just for safety*/
-}
-
-/*
- * Delete any existing route for an interface.
- */
-void
-in6_ifscrub(ifp, ia)
-       register struct ifnet *ifp;
-       register struct in6_ifaddr *ia;
-{
-       if ((ia->ia_flags & IFA_ROUTE) == 0)
-               return;
-       if (ifp->if_flags & (IFF_LOOPBACK | IFF_POINTOPOINT))
-               rtinit(&(ia->ia_ifa), (int)RTM_DELETE, RTF_HOST);
-       else
-               rtinit(&(ia->ia_ifa), (int)RTM_DELETE, 0);
-       ia->ia_flags &= ~IFA_ROUTE;
-
-       /* Remove ownaddr's loopback rtentry, if it exists. */
-       in6_ifremloop(&(ia->ia_ifa));
-}
-
-/*
- * Initialize an interface's intetnet6 address
- * and routing table entry.
- */
-int
-in6_ifinit(ifp, ia, sin6, scrub)
-       struct ifnet *ifp;
-       struct in6_ifaddr *ia;
-       struct sockaddr_in6 *sin6;
-       int scrub;
-{
-       struct  sockaddr_in6 oldaddr;
-       int     error, flags = RTF_UP;
-       u_long dl_tag;
-       int     s = splimp();
-
-       oldaddr = ia->ia_addr;
-       ia->ia_addr = *sin6;
-       /*
-        * Give the interface a chance to initialize
-        * if this is its first address,
-        * and to validate the address if necessary.
-        */
-#ifdef __APPLE__
-       error = dlil_ioctl(0, ifp, SIOCSIFADDR, (caddr_t)ia) ; 
-        if (error == EOPNOTSUPP)
-                error = 0;
-        if (error) {
-
-#else
-       if (ifp->if_ioctl &&
-          (error = (*ifp->if_ioctl)(ifp, SIOCSIFADDR, (caddr_t)ia))) {
-#endif
-               printf("in6_ifinit SIOCSIFADDR for if=%s returns error=%x\n", if_name(ifp), error);
-               splx(s);
-               ia->ia_addr = oldaddr;
-               return(error);
-       }
-
-       switch (ifp->if_type) {
-       case IFT_ARCNET:
-       case IFT_ETHER:
-       case IFT_FDDI:
-               ia->ia_ifa.ifa_rtrequest = nd6_rtrequest;
-               ia->ia_ifa.ifa_flags |= RTF_CLONING;
-               break;
-       case IFT_PPP:
-               ia->ia_ifa.ifa_rtrequest = nd6_p2p_rtrequest;
-               ia->ia_ifa.ifa_flags |= RTF_CLONING;
-               break;
-       }
-
-       splx(s);
-       if (scrub) {
-               ia->ia_ifa.ifa_addr = (struct sockaddr *)&oldaddr;
-               in6_ifscrub(ifp, ia);
-               ia->ia_ifa.ifa_addr = (struct sockaddr *)&ia->ia_addr;
-       }
-       /* xxx
-        * in_socktrim
-        */
-       /*
-        * Add route for the network.
-        */
-       ia->ia_ifa.ifa_metric = ifp->if_metric;
-       if (ifp->if_flags & IFF_LOOPBACK) {
-               ia->ia_ifa.ifa_dstaddr = ia->ia_ifa.ifa_addr;
-               flags |= RTF_HOST;
-       } else if (ifp->if_flags & IFF_POINTOPOINT) {
-               if (ia->ia_dstaddr.sin6_family != AF_INET6)
-                       return(0);
-               flags |= RTF_HOST;
-       }
-       if ((error = rtinit(&(ia->ia_ifa), (int)RTM_ADD, flags)) == 0)
-               ia->ia_flags |= IFA_ROUTE;
-
-       /* Add ownaddr as loopback rtentry, if necessary(ex. on p2p link). */
-       in6_ifaddloop(&(ia->ia_ifa));
-
-#if !(defined(__FreeBSD__) && __FreeBSD__ >= 3) && !defined (__APPLE__)
-       if (ifp->if_flags & IFF_MULTICAST)
-               in6_restoremkludge(ia, ifp);
-#endif
-
-#ifdef __APPLE__
-         printf("in6_ifinit: Attach dl_tag for if=%s%n\n", ifp->if_name, ifp->if_unit);
-
-         if (strcmp(ifp->if_name, "en") == 0)
-                dl_tag = ether_attach_inet6(ifp);
-         if (strcmp(ifp->if_name, "lo") == 0)
-                dl_tag = lo_attach_inet(ifp);
-
-         if (strcmp(ifp->if_name, "gif") == 0)
-                dl_tag = gif_attach_inet(ifp);
-/* End of temp code */
-         ia->ia_ifa.ifa_dlt = dl_tag; 
-#endif
-
-       return(error);
-}
-
-#if !(defined(__FreeBSD__) && __FreeBSD__ >= 3)  && !defined (__APPLE__)
-/*
- * Multicast address kludge:
- * If there were any multicast addresses attached to this interface address,
- * either move them to another address on this interface, or save them until
- * such time as this interface is reconfigured for IPv6.
- */
-void
-in6_savemkludge(oia)
-       struct in6_ifaddr *oia;
-{
-       struct in6_ifaddr *ia;
-       struct in6_multi *in6m, *next;
-
-       IFP_TO_IA6(oia->ia_ifp, ia);
-       if (ia) {       /* there is another address */
-               for (in6m = oia->ia6_multiaddrs.lh_first; in6m; in6m = next){
-                       next = in6m->in6m_entry.le_next;
-                       IFAFREE(&in6m->in6m_ia->ia_ifa);
-                       ia->ia_ifa.ifa_refcnt++;
-                       in6m->in6m_ia = ia;
-                       LIST_INSERT_HEAD(&ia->ia6_multiaddrs, in6m, in6m_entry);
-               }
-       } else {        /* last address on this if deleted, save */
-               struct multi6_kludge *mk;
-
-               mk = _MALLOC(sizeof(*mk), M_IPMADDR, M_WAITOK);
-
-               LIST_INIT(&mk->mk_head);
-               mk->mk_ifp = oia->ia_ifp;
-
-               for (in6m = oia->ia6_multiaddrs.lh_first; in6m; in6m = next){
-                       next = in6m->in6m_entry.le_next;
-                       IFAFREE(&in6m->in6m_ia->ia_ifa); /* release reference */
-                       in6m->in6m_ia = NULL;
-                       LIST_INSERT_HEAD(&mk->mk_head, in6m, in6m_entry);
-               }
-
-               if (mk->mk_head.lh_first != NULL) {
-                       LIST_INSERT_HEAD(&in6_mk, mk, mk_entry);
-               } else {
-                       FREE(mk, M_IPMADDR);
-               }
-       }
-}
-
-/*
- * Continuation of multicast address hack:
- * If there was a multicast group list previously saved for this interface,
- * then we re-attach it to the first address configured on the i/f.
- */
-void
-in6_restoremkludge(ia, ifp)
-       struct in6_ifaddr *ia;
-       struct ifnet *ifp;
-{
-       struct multi6_kludge *mk;
-
-       for (mk = in6_mk.lh_first; mk; mk = mk->mk_entry.le_next) {
-               if (mk->mk_ifp == ifp) {
-                       struct in6_multi *in6m, *next;
-
-                       for (in6m = mk->mk_head.lh_first; in6m; in6m = next){
-                               next = in6m->in6m_entry.le_next;
-                               in6m->in6m_ia = ia;
-                               ia->ia_ifa.ifa_refcnt++;
-                               LIST_INSERT_HEAD(&ia->ia6_multiaddrs,
-                                                in6m, in6m_entry);
+                       bcopy(&ia->ia_addr, &ifra.ifra_addr,
+                               ia->ia_addr.sin6_len);
+                       if ((ifp->if_flags & IFF_POINTOPOINT) != 0) {
+                               bcopy(&ia->ia_dstaddr, &ifra.ifra_dstaddr,
+                                       ia->ia_dstaddr.sin6_len);
+                       } else {
+                               bzero(&ifra.ifra_dstaddr,
+                                   sizeof(ifra.ifra_dstaddr));
                        }
-                       LIST_REMOVE(mk, mk_entry);
-                       _FREE(mk, M_IPMADDR);
-                       break;
+                       bcopy(&ia->ia_prefixmask, &ifra.ifra_dstaddr,
+                               ia->ia_prefixmask.sin6_len);
+
+                       ifra.ifra_flags = ia->ia6_flags;
+                       return in6_control(so, SIOCDIFADDR_IN6, (caddr_t)&ifra,
+                               ifp, p);
                }
+           }
        }
-}
-
-void
-in6_purgemkludge(ifp)
-       struct ifnet *ifp;
-{
-       struct multi6_kludge *mk;
-       struct in6_multi *in6m;
-
-       for (mk = in6_mk.lh_first; mk; mk = mk->mk_entry.le_next) {
-               if (mk->mk_ifp != ifp)
-                       continue;
 
-               /* leave from all multicast groups joined */
-               while ((in6m = LIST_FIRST(&mk->mk_head)) != NULL)
-                       in6_delmulti(in6m);
-               LIST_REMOVE(mk, mk_entry);
-               _FREE(mk, M_IPMADDR);
-               break;
-       }
+       return EOPNOTSUPP;      /* just for safety */
 }
 
 /*
- * Add an address to the list of IP6 multicast addresses for a
- * given interface.
+ * Initialize an interface's intetnet6 address
+ * and routing table entry.
  */
-struct in6_multi *
-in6_addmulti(maddr6, ifp, errorp)
-       register struct in6_addr *maddr6;
-       register struct ifnet *ifp;
-       int *errorp;
+static int
+in6_ifinit(ifp, ia, sin6, newhost)
+       struct ifnet *ifp;
+       struct in6_ifaddr *ia;
+       struct sockaddr_in6 *sin6;
+       int newhost;
 {
-       struct  in6_ifaddr *ia;
-       struct  in6_ifreq ifr;
-       struct  in6_multi *in6m;
-#if __NetBSD__
-       int     s = splsoftnet();
-#else
-       int     s = splnet();
-#endif
+       int     error = 0, plen, ifacount = 0;
+       struct ifaddr *ifa;
 
-       *errorp = 0;
        /*
-        * See if address already in list.
+        * Give the interface a chance to initialize
+        * if this is its first address,
+        * and to validate the address if necessary.
         */
-       IN6_LOOKUP_MULTI(*maddr6, ifp, in6m);
-       if (in6m != NULL) {
-               /*
-                * Found it; just increment the refrence count.
-                */
-               in6m->in6m_refcount++;
-       } else {
-               /*
-                * New address; allocate a new multicast record
-                * and link it into the interface's multicast list.
-                */
-               in6m = (struct in6_multi *)
-                       _MALLOC(sizeof(*in6m), M_IPMADDR, M_NOWAIT);
-               if (in6m == NULL) {
-                       splx(s);
-                       *errorp = ENOBUFS;
-                       return(NULL);
-               }
-               in6m->in6m_addr = *maddr6;
-               in6m->in6m_ifp = ifp;
-               in6m->in6m_refcount = 1;
-               IFP_TO_IA6(ifp, ia);
-               if (ia == NULL) {
-                       _FREE(in6m, M_IPMADDR);
-                       splx(s);
-                       *errorp = EADDRNOTAVAIL; /* appropriate? */
-                       return(NULL);
-               }
-               in6m->in6m_ia = ia;
-               ia->ia_ifa.ifa_refcnt++; /* gain a reference */
-               LIST_INSERT_HEAD(&ia->ia6_multiaddrs, in6m, in6m_entry);
+       ifnet_lock_shared(ifp);
+       TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list)
+       {
+               if (ifa->ifa_addr == NULL)
+                       continue;       /* just for safety */
+               if (ifa->ifa_addr->sa_family != AF_INET6)
+                       continue;
+               ifacount++;
+       }
+       ifnet_lock_done(ifp);
 
-               /*
-                * Ask the network driver to update its multicast reception
-                * filter appropriately for the new address.
-                */
-               bzero(&ifr.ifr_addr, sizeof(struct sockaddr_in6));
-               ifr.ifr_addr.sin6_len = sizeof(struct sockaddr_in6);
-               ifr.ifr_addr.sin6_family = AF_INET6;
-               ifr.ifr_addr.sin6_addr = *maddr6;
-#ifdef __APPLE__
-                 *errorp = dlil_ioctl(0, ifp, SIOCADDMULTI, (caddr_t)&ifr);
-                printf("in6_addmulti: if=%s%n dlil_ioctl returns=%d\n", ifp->if_name, ifp->if_unit, *errorp);
-                 if (*errorp == EOPNOTSUPP)
-                                *errorp = 0;
+       ia->ia_addr = *sin6;
 
-#else
-               if (ifp->if_ioctl == NULL)
-                       *errorp = ENXIO; /* XXX: appropriate? */
-               else
-                       *errorp = (*ifp->if_ioctl)(ifp, SIOCADDMULTI,
-                                                   (caddr_t)&ifr);
-#endif
-               if (*errorp) {
-                       LIST_REMOVE(in6m, in6m_entry);
-                       _FREE(in6m, M_IPMADDR);
-                       splx(s);
-                       return(NULL);
+
+       if (ifacount <= 1 && 
+           (error = dlil_ioctl(PF_INET6, ifp, SIOCSIFADDR, (caddr_t)ia))) {
+               if (error) {
+                       return(error);
                }
-               /*
-                * Let MLD6 know that we have joined a new IP6 multicast
-                * group.
-                */
-               mld6_start_listening(in6m);
        }
-       splx(s);
-       return(in6m);
-}
 
-/*
- * Delete a multicast address record.
- */
-void
-in6_delmulti(in6m)
-       struct in6_multi *in6m;
-{
-       struct  in6_ifreq ifr;
-#if __NetBSD__
-       int     s = splsoftnet();
-#else
-       int     s = splnet();
-#endif
+       ia->ia_ifa.ifa_metric = ifp->if_metric;
 
-       if (--in6m->in6m_refcount == 0) {
-               /*
-                * No remaining claims to this record; let MLD6 know
-                * that we are leaving the multicast group.
-                */
-               mld6_stop_listening(in6m);
+       /* we could do in(6)_socktrim here, but just omit it at this moment. */
 
+       /*
+        * Special case:
+        * If the destination address is specified for a point-to-point
+        * interface, install a route to the destination as an interface
+        * direct route.
+        */
+       plen = in6_mask2len(&ia->ia_prefixmask.sin6_addr, NULL); /* XXX */
+       if (plen == 128 && ia->ia_dstaddr.sin6_family == AF_INET6) {
+               if ((error = rtinit(&(ia->ia_ifa), (int)RTM_ADD,
+                                   RTF_UP | RTF_HOST)) != 0)
+                       return(error);
+               ia->ia_flags |= IFA_ROUTE;
+       }
+       if (plen < 128) {
                /*
-                * Unlink from list.
+                * The RTF_CLONING flag is necessary for in6_is_ifloop_auto().
                 */
-               LIST_REMOVE(in6m, in6m_entry);
-               if (in6m->in6m_ia)
-                       IFAFREE(&in6m->in6m_ia->ia_ifa); /* release reference */
+               ia->ia_ifa.ifa_flags |= RTF_CLONING;
+       }
 
-               /*
-                * Notify the network driver to update its multicast
-                * reception filter.
-                */
-               bzero(&ifr.ifr_addr, sizeof(struct sockaddr_in6));
-               ifr.ifr_addr.sin6_len = sizeof(struct sockaddr_in6);
-               ifr.ifr_addr.sin6_family = AF_INET6;
-               ifr.ifr_addr.sin6_addr = in6m->in6m_addr;
-#ifdef __APPLE__
-               dlil_ioctl(0, in6m->in6m_ifp, SIOCDELMULTI, (caddr_t)&ifr);
-#else
-               (*in6m->in6m_ifp->if_ioctl)(in6m->in6m_ifp,
-                                           SIOCDELMULTI, (caddr_t)&ifr);
-#endif
-               _FREE(in6m, M_IPMADDR);
+       /* Add ownaddr as loopback rtentry, if necessary (ex. on p2p link). */
+       if (newhost) {
+               /* set the rtrequest function to create llinfo */
+               ia->ia_ifa.ifa_rtrequest = nd6_rtrequest;
+               in6_ifaddloop(&(ia->ia_ifa));
        }
-       splx(s);
+
+       return(error);
 }
-#else /* not FreeBSD3 */
+
 /*
  * Add an address to the list of IP6 multicast addresses for a
  * given interface.
  */
 struct in6_multi *
-in6_addmulti(maddr6, ifp, errorp)
-       register struct in6_addr *maddr6;
-       register struct ifnet *ifp;
+in6_addmulti(maddr6, ifp, errorp, nd6_locked)
+       struct in6_addr *maddr6;
+       struct ifnet *ifp;
        int *errorp;
+       int nd6_locked;
 {
        struct  in6_multi *in6m;
        struct sockaddr_in6 sin6;
        struct ifmultiaddr *ifma;
-       int     s = splnet();
 
        *errorp = 0;
 
@@ -1722,7 +1886,6 @@ in6_addmulti(maddr6, ifp, errorp)
        sin6.sin6_addr = *maddr6;
        *errorp = if_addmulti(ifp, (struct sockaddr *)&sin6, &ifma);
        if (*errorp) {
-               splx(s);
                return 0;
        }
 
@@ -1737,7 +1900,6 @@ in6_addmulti(maddr6, ifp, errorp)
           at interrupt time?  If so, need to fix if_addmulti. XXX */
        in6m = (struct in6_multi *)_MALLOC(sizeof(*in6m), M_IPMADDR, M_NOWAIT);
        if (in6m == NULL) {
-               splx(s);
                return (NULL);
        }
 
@@ -1746,14 +1908,17 @@ in6_addmulti(maddr6, ifp, errorp)
        in6m->in6m_ifp = ifp;
        in6m->in6m_ifma = ifma;
        ifma->ifma_protospec = in6m;
+       if (nd6_locked == 0)
+               lck_mtx_lock(nd6_mutex);
        LIST_INSERT_HEAD(&in6_multihead, in6m, in6m_entry);
+       if (nd6_locked == 0)
+               lck_mtx_unlock(nd6_mutex);
 
        /*
         * Let MLD6 know that we have joined a new IP6 multicast
         * group.
         */
        mld6_start_listening(in6m);
-       splx(s);
        return(in6m);
 }
 
@@ -1761,27 +1926,31 @@ in6_addmulti(maddr6, ifp, errorp)
  * Delete a multicast address record.
  */
 void
-in6_delmulti(in6m)
-       struct in6_multi *in6m;
+in6_delmulti(
+       struct in6_multi *in6m, int nd6locked)
 {
        struct ifmultiaddr *ifma = in6m->in6m_ifma;
-       int     s = splnet();
 
-       if (ifma->ifma_refcount == 1) {
+       if (ifma && ifma->ifma_usecount == 1) {
                /*
                 * No remaining claims to this record; let MLD6 know
                 * that we are leaving the multicast group.
                 */
                mld6_stop_listening(in6m);
                ifma->ifma_protospec = 0;
+               if (nd6locked == 0)
+                       lck_mtx_lock(nd6_mutex);
                LIST_REMOVE(in6m, in6m_entry);
-               _FREE(in6m, M_IPMADDR);
+               if (nd6locked == 0)
+                       lck_mtx_unlock(nd6_mutex);
+               FREE(in6m, M_IPMADDR);
        }
        /* XXX - should be separate API for when we have an ifma? */
-       if_delmulti(ifma->ifma_ifp, ifma->ifma_addr);
-       splx(s);
+       if (ifma) {
+               if_delmultiaddr(ifma, 0);
+               ifma_release(ifma);
+       }
 }
-#endif /* not FreeBSD3 */
 
 /*
  * Find an IPv6 interface link-local address specific to an interface.
@@ -1791,13 +1960,10 @@ in6ifa_ifpforlinklocal(ifp, ignoreflags)
        struct ifnet *ifp;
        int ignoreflags;
 {
-       register struct ifaddr *ifa;
+       struct ifaddr *ifa;
 
-#if defined(__bsdi__) || (defined(__FreeBSD__) && __FreeBSD__ < 3)
-       for (ifa = ifp->if_addrlist; ifa; ifa = ifa->ifa_next)
-#else
-       for (ifa = ifp->if_addrlist.tqh_first; ifa; ifa = ifa->ifa_list.tqe_next)
-#endif
+       ifnet_lock_shared(ifp);
+       TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list)
        {
                if (ifa->ifa_addr == NULL)
                        continue;       /* just for safety */
@@ -1810,11 +1976,11 @@ in6ifa_ifpforlinklocal(ifp, ignoreflags)
                        break;
                }
        }
+       ifnet_lock_done(ifp);
 
        return((struct in6_ifaddr *)ifa);
 }
 
-
 /*
  * find the internet address corresponding to a given interface and address.
  */
@@ -1823,13 +1989,10 @@ in6ifa_ifpwithaddr(ifp, addr)
        struct ifnet *ifp;
        struct in6_addr *addr;
 {
-       register struct ifaddr *ifa;
+       struct ifaddr *ifa;
 
-#if defined(__bsdi__) || (defined(__FreeBSD__) && __FreeBSD__ < 3)
-       for (ifa = ifp->if_addrlist; ifa; ifa = ifa->ifa_next)
-#else
-       for (ifa = ifp->if_addrlist.tqh_first; ifa; ifa = ifa->ifa_list.tqe_next)
-#endif
+       ifnet_lock_shared(ifp);
+       TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list)
        {
                if (ifa->ifa_addr == NULL)
                        continue;       /* just for safety */
@@ -1838,6 +2001,7 @@ in6ifa_ifpwithaddr(ifp, addr)
                if (IN6_ARE_ADDR_EQUAL(addr, IFA_IN6(ifa)))
                        break;
        }
+       ifnet_lock_done(ifp);
 
        return((struct in6_ifaddr *)ifa);
 }
@@ -1849,13 +2013,13 @@ static char digits[] = "0123456789abcdef";
 static int ip6round = 0;
 char *
 ip6_sprintf(addr)
-register struct in6_addr *addr;
+       const struct in6_addr *addr;
 {
        static char ip6buf[8][48];
-       register int i;
-       register char *cp;
-       register u_short *a = (u_short *)addr;
-       register u_char *d;
+       int i;
+       char *cp;
+       const u_short *a = (const u_short *)addr;
+       const u_char *d;
        int dcolon = 0;
 
        ip6round = (ip6round + 1) & 7;
@@ -1884,7 +2048,7 @@ register struct in6_addr *addr;
                        a++;
                        continue;
                }
-               d = (u_char *)a;
+               d = (const u_char *)a;
                *cp++ = digits[*d >> 4];
                *cp++ = digits[*d++ & 0xf];
                *cp++ = digits[*d >> 4];
@@ -1905,101 +2069,47 @@ in6_localaddr(in6)
        if (IN6_IS_ADDR_LOOPBACK(in6) || IN6_IS_ADDR_LINKLOCAL(in6))
                return 1;
 
-       for (ia = in6_ifaddr; ia; ia = ia->ia_next)
+       lck_mtx_lock(nd6_mutex);
+       for (ia = in6_ifaddrs; ia; ia = ia->ia_next)
                if (IN6_ARE_MASKED_ADDR_EQUAL(in6, &ia->ia_addr.sin6_addr,
-                                             &ia->ia_prefixmask.sin6_addr))
+                                             &ia->ia_prefixmask.sin6_addr)) {
+                       lck_mtx_unlock(nd6_mutex);
                        return 1;
+               }
 
+       lck_mtx_unlock(nd6_mutex);
        return (0);
 }
 
-/*
- * Get a scope of the address. Node-local, link-local, site-local or global.
- */
 int
-in6_addrscope (addr)
-struct in6_addr *addr;
+in6_is_addr_deprecated(sa6)
+       struct sockaddr_in6 *sa6;
 {
-       int scope;
-
-       if (addr->s6_addr8[0] == 0xfe) {
-               scope = addr->s6_addr8[1] & 0xc0;
-
-               switch (scope) {
-               case 0x80:
-                       return IPV6_ADDR_SCOPE_LINKLOCAL;
-                       break;
-               case 0xc0:
-                       return IPV6_ADDR_SCOPE_SITELOCAL;
-                       break;
-               default:
-                       return IPV6_ADDR_SCOPE_GLOBAL; /* just in case */
-                       break;
-               }
-       }
-
-
-       if (addr->s6_addr8[0] == 0xff) {
-               scope = addr->s6_addr8[1] & 0x0f;
+       struct in6_ifaddr *ia;
 
-               /*
-                * due to other scope such as reserved,
-                * return scope doesn't work.
-                */
-               switch (scope) {
-               case IPV6_ADDR_SCOPE_NODELOCAL:
-                       return IPV6_ADDR_SCOPE_NODELOCAL;
-                       break;
-               case IPV6_ADDR_SCOPE_LINKLOCAL:
-                       return IPV6_ADDR_SCOPE_LINKLOCAL;
-                       break;
-               case IPV6_ADDR_SCOPE_SITELOCAL:
-                       return IPV6_ADDR_SCOPE_SITELOCAL;
-                       break;
-               default:
-                       return IPV6_ADDR_SCOPE_GLOBAL;
-                       break;
+       lck_mtx_lock(nd6_mutex);
+       for (ia = in6_ifaddrs; ia; ia = ia->ia_next) {
+               if (IN6_ARE_ADDR_EQUAL(&ia->ia_addr.sin6_addr,
+                                      &sa6->sin6_addr) &&
+#if SCOPEDROUTING
+                   ia->ia_addr.sin6_scope_id == sa6->sin6_scope_id &&
+#endif
+                   (ia->ia6_flags & IN6_IFF_DEPRECATED) != 0) {
+                       lck_mtx_unlock(nd6_mutex);
+                       return(1); /* true */
                }
-       }
 
-       if (bcmp(&in6addr_loopback, addr, sizeof(addr) - 1) == 0) {
-               if (addr->s6_addr8[15] == 1) /* loopback */
-                       return IPV6_ADDR_SCOPE_NODELOCAL;
-               if (addr->s6_addr8[15] == 0) /* unspecified */
-                       return IPV6_ADDR_SCOPE_LINKLOCAL;
+               /* XXX: do we still have to go thru the rest of the list? */
        }
 
-       return IPV6_ADDR_SCOPE_GLOBAL;
-}
-
-int
-in6_addr2scopeid(ifp, addr)
-       struct ifnet *ifp;      /* must not be NULL */
-       struct in6_addr *addr;  /* must not be NULL */
-{
-       int scope = in6_addrscope(addr);
-               
-       switch(scope) {
-       case IPV6_ADDR_SCOPE_NODELOCAL:
-               return(-1);     /* XXX: is this an appropriate value? */
-
-       case IPV6_ADDR_SCOPE_LINKLOCAL:
-               /* XXX: we do not distinguish between a link and an I/F. */
-               return(ifp->if_index);
-
-       case IPV6_ADDR_SCOPE_SITELOCAL:
-               return(0);      /* XXX: invalid. */
-
-       default:
-               return(0);      /* XXX: treat as global. */
-       }
+       lck_mtx_unlock(nd6_mutex);
+       return(0);              /* false */
 }
 
 /*
  * return length of part which dst and src are equal
  * hard coding...
  */
-
 int
 in6_matchlen(src, dst)
 struct in6_addr *src, *dst;
@@ -2020,6 +2130,7 @@ struct in6_addr *src, *dst;
        return match;
 }
 
+/* XXX: to be scope conscious */
 int
 in6_are_prefix_equal(p1, p2, len)
        struct in6_addr *p1, *p2;
@@ -2039,7 +2150,8 @@ in6_are_prefix_equal(p1, p2, len)
 
        if (bcmp(&p1->s6_addr, &p2->s6_addr, bytelen))
                return(0);
-       if (p1->s6_addr[bytelen] >> (8 - bitlen) !=
+       if (bitlen != 0 && 
+           p1->s6_addr[bytelen] >> (8 - bitlen) !=
            p2->s6_addr[bytelen] >> (8 - bitlen))
                return(0);
 
@@ -2074,9 +2186,9 @@ in6_prefixlen2mask(maskp, len)
  * return the best address out of the same scope
  */
 struct in6_ifaddr *
-in6_ifawithscope(oifp, dst)
-       register struct ifnet *oifp;
-       register struct in6_addr *dst;
+in6_ifawithscope(
+       struct ifnet *oifp,
+       struct in6_addr *dst)
 {
        int dst_scope = in6_addrscope(dst), src_scope, best_scope = 0;
        int blen = -1;
@@ -2085,7 +2197,9 @@ in6_ifawithscope(oifp, dst)
        struct in6_ifaddr *ifa_best = NULL;
        
        if (oifp == NULL) {
+#if 0
                printf("in6_ifawithscope: output interface is not specified\n");
+#endif
                return(NULL);
        }
 
@@ -2094,12 +2208,8 @@ in6_ifawithscope(oifp, dst)
         * Comparing an interface with the outgoing interface will be done
         * only at the final stage of tiebreaking.
         */
-#if defined(__bsdi__) || (defined(__FreeBSD__) && __FreeBSD__ < 3)
-       for (ifp = ifnet; ifp; ifp = ifp->if_next)
-#else
-       for (ifp = TAILQ_FIRST(&ifnet); ifp; ifp = TAILQ_NEXT(ifp, if_list))
-#endif
-       {
+       ifnet_head_lock_shared();
+       TAILQ_FOREACH(ifp, &ifnet_head, if_list) {
                /*
                 * We can never take an address that breaks the scope zone
                 * of the destination.
@@ -2107,14 +2217,8 @@ in6_ifawithscope(oifp, dst)
                if (in6_addr2scopeid(ifp, dst) != in6_addr2scopeid(oifp, dst))
                        continue;
 
-#if defined(__bsdi__) || (defined(__FreeBSD__) && __FreeBSD__ < 3)
-               for (ifa = ifp->if_addrlist; ifa; ifa = ifa->ifa_next)
-#elif defined(__FreeBSD__) && __FreeBSD__ >= 4
+               ifnet_lock_shared(ifp);
                TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list)
-#else
-               for (ifa = ifp->if_addrlist.tqh_first; ifa;
-                    ifa = ifa->ifa_list.tqe_next)
-#endif
                {
                        int tlen = -1, dscopecmp, bscopecmp, matchcmp;
 
@@ -2123,20 +2227,6 @@ in6_ifawithscope(oifp, dst)
 
                        src_scope = in6_addrscope(IFA_IN6(ifa));
 
-#if ADDRSELECT_DEBUG           /* should be removed after stabilization */
-                       dscopecmp = IN6_ARE_SCOPE_CMP(src_scope, dst_scope);
-                       printf("in6_ifawithscope: dst=%s bestaddr=%s, "
-                              "newaddr=%s, scope=%x, dcmp=%d, bcmp=%d, "
-                              "matchlen=%d, flgs=%x\n",
-                              ip6_sprintf(dst),
-                              ifa_best ? ip6_sprintf(&ifa_best->ia_addr.sin6_addr) : "none",
-                              ip6_sprintf(IFA_IN6(ifa)), src_scope,
-                              dscopecmp,
-                              ifa_best ? IN6_ARE_SCOPE_CMP(src_scope, best_scope) : -1,
-                              in6_matchlen(IFA_IN6(ifa), dst),
-                              ((struct in6_ifaddr *)ifa)->ia6_flags);
-#endif
-
                        /*
                         * Don't use an address before completing DAD
                         * nor a duplicated address.
@@ -2173,13 +2263,20 @@ in6_ifawithscope(oifp, dst)
                         * Also, if the current address has a smaller scope
                         * than dst, ignore it unless ifa_best also has a
                         * smaller scope.
+                        * Consequently, after the two if-clause below,
+                        * the followings must be satisfied:
+                        * (scope(src) < scope(dst) &&
+                        *  scope(best) < scope(dst))
+                        *  OR
+                        * (scope(best) >= scope(dst) &&
+                        *  scope(src) >= scope(dst))
                         */
                        if (IN6_ARE_SCOPE_CMP(best_scope, dst_scope) < 0 &&
                            IN6_ARE_SCOPE_CMP(src_scope, dst_scope) >= 0)
-                               goto replace;
+                               goto replace; /* (A) */
                        if (IN6_ARE_SCOPE_CMP(src_scope, dst_scope) < 0 &&
                            IN6_ARE_SCOPE_CMP(best_scope, dst_scope) >= 0)
-                               continue;
+                               continue; /* (B) */
 
                        /*
                         * A deprecated address SHOULD NOT be used in new
@@ -2208,13 +2305,45 @@ in6_ifawithscope(oifp, dst)
                        /*
                         * A non-deprecated address is always preferred
                         * to a deprecated one regardless of scopes and
-                        * address matching.
+                        * address matching (Note invariants ensured by the
+                        * conditions (A) and (B) above.)
                         */
                        if ((ifa_best->ia6_flags & IN6_IFF_DEPRECATED) &&
                            (((struct in6_ifaddr *)ifa)->ia6_flags &
                             IN6_IFF_DEPRECATED) == 0)
                                goto replace;
 
+                       /*
+                        * When we use temporary addresses described in
+                        * RFC 3041, we prefer temporary addresses to
+                        * public autoconf addresses.  Again, note the
+                        * invariants from (A) and (B).  Also note that we
+                        * don't have any preference between static addresses
+                        * and autoconf addresses (despite of whether or not
+                        * the latter is temporary or public.)
+                        */
+                       if (ip6_use_tempaddr) {
+                               struct in6_ifaddr *ifat;
+
+                               ifat = (struct in6_ifaddr *)ifa;
+                               if ((ifa_best->ia6_flags &
+                                    (IN6_IFF_AUTOCONF|IN6_IFF_TEMPORARY))
+                                    == IN6_IFF_AUTOCONF &&
+                                   (ifat->ia6_flags &
+                                    (IN6_IFF_AUTOCONF|IN6_IFF_TEMPORARY))
+                                    == (IN6_IFF_AUTOCONF|IN6_IFF_TEMPORARY)) {
+                                       goto replace;
+                               }
+                               if ((ifa_best->ia6_flags &
+                                    (IN6_IFF_AUTOCONF|IN6_IFF_TEMPORARY))
+                                   == (IN6_IFF_AUTOCONF|IN6_IFF_TEMPORARY) &&
+                                   (ifat->ia6_flags &
+                                    (IN6_IFF_AUTOCONF|IN6_IFF_TEMPORARY))
+                                    == IN6_IFF_AUTOCONF) {
+                                       continue;
+                               }
+                       }
+
                        /*
                         * At this point, we have two cases:
                         * 1. we are looking at a non-deprecated address,
@@ -2241,72 +2370,81 @@ in6_ifawithscope(oifp, dst)
                         *   Smaller scopes are the last resort.
                         * - A deprecated address is chosen only when we have
                         *   no address that has an enough scope, but is
-                        *   prefered to any addresses of smaller scopes.
-                        * - Longest address match against dst is considered
-                        *   only for addresses that has the same scope of dst.
+                        *   prefered to any addresses of smaller scopes
+                        *   (this must be already done above.)
+                        * - addresses on the outgoing I/F are preferred to
+                        *   ones on other interfaces if none of above
+                        *   tiebreaks.  In the table below, the column "bI"
+                        *   means if the best_ifa is on the outgoing
+                        *   interface, and the column "sI" means if the ifa
+                        *   is on the outgoing interface.
                         * - If there is no other reasons to choose one,
-                        *   addresses on the outgoing I/F are preferred.
+                        *   longest address match against dst is considered.
                         *
                         * The precise decision table is as follows:
-                        * dscopecmp bscopecmp matchcmp outI/F | replace?
-                        *    !equal     equal      N/A    Yes |      Yes (1)
-                        *    !equal     equal      N/A     No |       No (2)
-                        *    larger    larger      N/A    N/A |       No (3)
-                        *    larger   smaller      N/A    N/A |      Yes (4)
-                        *   smaller    larger      N/A    N/A |      Yes (5)
-                        *   smaller   smaller      N/A    N/A |       No (6)
-                        *     equal   smaller      N/A    N/A |      Yes (7)
-                        *     equal    larger       (already done)
-                        *     equal     equal   larger    N/A |      Yes (8)
-                        *     equal     equal  smaller    N/A |       No (9)
-                        *     equal     equal    equal    Yes |      Yes (a)
-                        *     eaual     eqaul    equal     No |       No (b)
+                        * dscopecmp bscopecmp    match  bI oI | replace?
+                        *       N/A     equal      N/A   Y  N |   No (1)
+                        *       N/A     equal      N/A   N  Y |  Yes (2)
+                        *       N/A     equal   larger    N/A |  Yes (3)
+                        *       N/A     equal  !larger    N/A |   No (4)
+                        *    larger    larger      N/A    N/A |   No (5)
+                        *    larger   smaller      N/A    N/A |  Yes (6)
+                        *   smaller    larger      N/A    N/A |  Yes (7)
+                        *   smaller   smaller      N/A    N/A |   No (8)
+                        *     equal   smaller      N/A    N/A |  Yes (9)
+                        *     equal    larger       (already done at A above)
                         */
                        dscopecmp = IN6_ARE_SCOPE_CMP(src_scope, dst_scope);
                        bscopecmp = IN6_ARE_SCOPE_CMP(src_scope, best_scope);
 
-                       if (dscopecmp && bscopecmp == 0) {
-                               if (oifp == ifp) /* (1) */
+                       if (bscopecmp == 0) {
+                               struct ifnet *bifp = ifa_best->ia_ifp;
+
+                               if (bifp == oifp && ifp != oifp) /* (1) */
+                                       continue;
+                               if (bifp != oifp && ifp == oifp) /* (2) */
+                                       goto replace;
+
+                               /*
+                                * Both bifp and ifp are on the outgoing
+                                * interface, or both two are on a different
+                                * interface from the outgoing I/F.
+                                * now we need address matching against dst
+                                * for tiebreaking.
+                                */
+                               tlen = in6_matchlen(IFA_IN6(ifa), dst);
+                               matchcmp = tlen - blen;
+                               if (matchcmp > 0) /* (3) */
                                        goto replace;
-                               continue; /* (2) */
+                               continue; /* (4) */
                        }
                        if (dscopecmp > 0) {
-                               if (bscopecmp > 0) /* (3) */
+                               if (bscopecmp > 0) /* (5) */
                                        continue;
-                               goto replace; /* (4) */
+                               goto replace; /* (6) */
                        }
                        if (dscopecmp < 0) {
-                               if (bscopecmp > 0) /* (5) */
+                               if (bscopecmp > 0) /* (7) */
                                        goto replace;
-                               continue; /* (6) */
+                               continue; /* (8) */
                        }
 
                        /* now dscopecmp must be 0 */
                        if (bscopecmp < 0)
-                               goto replace; /* (7) */
-
-                       /*
-                        * At last both dscopecmp and bscopecmp must be 0.
-                        * We need address matching against dst for
-                        * tiebreaking.
-                        */
-                       tlen = in6_matchlen(IFA_IN6(ifa), dst);
-                       matchcmp = tlen - blen;
-                       if (matchcmp > 0) /* (8) */
-                               goto replace;
-                       if (matchcmp < 0) /* (9) */
-                               continue;
-                       if (oifp == ifp) /* (a) */
-                               goto replace;
-                       continue; /* (b) */
+                               goto replace; /* (9) */
 
                  replace:
+                       ifaref(ifa);
+                       if (ifa_best)
+                               ifafree(&ifa_best->ia_ifa);
                        ifa_best = (struct in6_ifaddr *)ifa;
                        blen = tlen >= 0 ? tlen :
                                in6_matchlen(IFA_IN6(ifa), dst);
                        best_scope = in6_addrscope(&ifa_best->ia_addr.sin6_addr);
                }
+               ifnet_lock_done(ifp);
        }
+       ifnet_head_done();
 
        /* count statistics for future improvements */
        if (ifa_best == NULL)
@@ -2333,58 +2471,26 @@ in6_ifawithscope(oifp, dst)
  * return the best address out of the same scope. if no address was
  * found, return the first valid address from designated IF.
  */
-
 struct in6_ifaddr *
-in6_ifawithifp(ifp, dst)
-       register struct ifnet *ifp;
-       register struct in6_addr *dst;
+in6_ifawithifp(
+       struct ifnet *ifp,
+       struct in6_addr *dst)
 {
        int dst_scope = in6_addrscope(dst), blen = -1, tlen;
        struct ifaddr *ifa;
        struct in6_ifaddr *besta = 0;
-       struct in6_ifaddr *dep[2];      /*last-resort: deprecated*/
+       struct in6_ifaddr *dep[2];      /* last-resort: deprecated */
 
        dep[0] = dep[1] = NULL;
 
-#if 0
-#if MIP6
-       /*
-        * This is needed to assure that the Home Address is used for
-        * outgoing packets when not at home. We can't choose any other
-        * address if we want to keep connections up during movement.
-        */
-       if (mip6_get_home_prefix_hook) {        /* Only Mobile Node */
-               struct nd_prefix *pr;
-               if ((pr = (*mip6_get_home_prefix_hook)()) &&
-                   !IN6_IS_ADDR_UNSPECIFIED(&pr->ndpr_addr))
-               {
-                       if (dst_scope == in6_addrscope(&pr->ndpr_addr)) {
-#if MIP6_DEBUG
-                               /* Noisy but useful */
-                               mip6_debug("%s: Local address %s is chosen "
-                                          "for pcb to dest %s.\n",
-                                          __FUNCTION__,
-                                          ip6_sprintf(&pr->ndpr_addr),
-                                          ip6_sprintf(dst));
-#endif
-                               return(in6ifa_ifpwithaddr(ifp, &pr->ndpr_addr));
-                       }
-               }
-       }
-#endif /* MIP6 */
-#endif /* 0 */
-
        /*
         * We first look for addresses in the same scope.
         * If there is one, return it.
         * If two or more, return one which matches the dst longest.
         * If none, return one of global addresses assigned other ifs.
         */
-#if defined(__bsdi__) || (defined(__FreeBSD__) && __FreeBSD__ < 3)
-       for (ifa = ifp->if_addrlist; ifa; ifa = ifa->ifa_next)
-#else
-       for (ifa = ifp->if_addrlist.tqh_first; ifa; ifa = ifa->ifa_list.tqe_next)
-#endif
+       ifnet_lock_shared(ifp);
+       TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list)
        {
                if (ifa->ifa_addr->sa_family != AF_INET6)
                        continue;
@@ -2416,14 +2522,12 @@ in6_ifawithifp(ifp, dst)
                                besta = (struct in6_ifaddr *)ifa;
                }
        }
-       if (besta)
+       if (besta) {
+               ifnet_lock_done(ifp);
                return(besta);
+       }
 
-#if defined(__bsdi__) || (defined(__FreeBSD__) && __FreeBSD__ < 3)
-       for (ifa = ifp->if_addrlist; ifa; ifa = ifa->ifa_next)
-#else
-       for (ifa = ifp->if_addrlist.tqh_first; ifa; ifa = ifa->ifa_list.tqe_next)
-#endif
+       TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list)
        {
                if (ifa->ifa_addr->sa_family != AF_INET6)
                        continue;
@@ -2438,9 +2542,11 @@ in6_ifawithifp(ifp, dst)
                                dep[1] = (struct in6_ifaddr *)ifa;
                        continue;
                }
-
+               
+               ifnet_lock_done(ifp);
                return (struct in6_ifaddr *)ifa;
        }
+       ifnet_lock_done(ifp);
 
        /* use the last-resort values, that are, deprecated addresses */
        if (dep[0])
@@ -2451,101 +2557,75 @@ in6_ifawithifp(ifp, dst)
        return NULL;
 }
 
+extern int in6_init2done;
+
 /*
  * perform DAD when interface becomes IFF_UP.
  */
 void
-in6_if_up(ifp)
-       struct ifnet *ifp;
+in6_if_up(
+       struct ifnet *ifp,
+       struct in6_aliasreq *ifra)
 {
        struct ifaddr *ifa;
        struct in6_ifaddr *ia;
-       struct sockaddr_dl *sdl;
-       int type;
-#if __bsdi__
-       u_char ea[ETHER_ADDR_LEN];
-#else
-       struct ether_addr ea;
-#endif
-       int off;
        int dad_delay;          /* delay ticks before DAD output */
 
-       bzero(&ea, sizeof(ea));
-       sdl = NULL;
+       if (!in6_init2done)
+               return;
 
-#if defined(__bsdi__) || (defined(__FreeBSD__) && __FreeBSD__ < 3)
-       for (ifa = ifp->if_addrlist; ifa; ifa = ifa->ifa_next)
-#else
-       for (ifa = ifp->if_addrlist.tqh_first; ifa; ifa = ifa->ifa_list.tqe_next)
-#endif
+       /*
+        * special cases, like 6to4, are handled in in6_ifattach
+        */
+       in6_ifattach(ifp, NULL, ifra);
+
+       dad_delay = 0;
+       ifnet_lock_exclusive(ifp);
+       TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list)
        {
-               if (ifa->ifa_addr->sa_family == AF_INET6
-                && IN6_IS_ADDR_LINKLOCAL(&((struct sockaddr_in6 *)ifa->ifa_addr)->sin6_addr)) {
-                       goto dad;
-               }
-               if (ifa->ifa_addr->sa_family != AF_LINK)
+               if (ifa->ifa_addr->sa_family != AF_INET6)
                        continue;
-               sdl = (struct sockaddr_dl *)ifa->ifa_addr;
-               break;
+               ia = (struct in6_ifaddr *)ifa;
+               if (ia->ia6_flags & IN6_IFF_TENTATIVE)
+                       nd6_dad_start(ifa, &dad_delay);
        }
+       ifnet_lock_done(ifp);
+}
+
+int
+in6if_do_dad(
+       struct ifnet *ifp)
+{
+       if ((ifp->if_flags & IFF_LOOPBACK) != 0)
+               return(0);
 
        switch (ifp->if_type) {
-       case IFT_LOOP:
-               in6_ifattach(ifp, IN6_IFT_LOOP, NULL, 1);
-               break;
-       case IFT_SLIP:
-       case IFT_PPP:
+#if IFT_DUMMY
        case IFT_DUMMY:
-       case IFT_GIF:
+#endif
        case IFT_FAITH:
-               type = IN6_IFT_P2P;
-               in6_ifattach(ifp, type, 0, 1);
-               break;
-#if IFT_STF
-       case IFT_STF:
                /*
-                * This is VERY awkward to call nd6_ifattach while we will
-                * not do ND at all on the interface.  It is necessary for
-                * initializing default hoplimit, and ND mtu.
+                * These interfaces do not have the IFF_LOOPBACK flag,
+                * but loop packets back.  We do not have to do DAD on such
+                * interfaces.  We should even omit it, because loop-backed
+                * NS would confuse the DAD procedure.
                 */
-               nd6_ifattach(ifp);
-               break;
-#endif
-       case IFT_ETHER:
-       case IFT_FDDI:
-       case IFT_ATM:
-               type = IN6_IFT_802;
-               if (sdl == NULL)
-                       break;
-               off = sdl->sdl_nlen;
-               if (bcmp(&sdl->sdl_data[off], &ea, sizeof(ea)) != 0)
-                       in6_ifattach(ifp, type, LLADDR(sdl), 0);
-               break;
-       case IFT_ARCNET:
-               type = IN6_IFT_ARCNET;
-               if (sdl == NULL)
-                       break;
-               off = sdl->sdl_nlen;
-               if (sdl->sdl_data[off] != 0)    /* XXX ?: */
-                       in6_ifattach(ifp, type, LLADDR(sdl), 0);
-               break;
+               return(0);
        default:
-               break;
-       }
+               /*
+                * Our DAD routine requires the interface up and running.
+                * However, some interfaces can be up before the RUNNING
+                * status.  Additionaly, users may try to assign addresses
+                * before the interface becomes up (or running).
+                * We simply skip DAD in such a case as a work around.
+                * XXX: we should rather mark "tentative" on such addresses,
+                * and do DAD after the interface becomes ready.
+                */
+               if ((ifp->if_flags & (IFF_UP|IFF_RUNNING)) !=
+                   (IFF_UP|IFF_RUNNING))
+                       return(0);
 
-dad:
-       dad_delay = 0;
-#if defined(__bsdi__) || (defined(__FreeBSD__) && __FreeBSD__ < 3)
-       for (ifa = ifp->if_addrlist; ifa; ifa = ifa->ifa_next)
-#else
-       for (ifa = ifp->if_addrlist.tqh_first; ifa; ifa = ifa->ifa_list.tqe_next)
-#endif
-       {
-               if (ifa->ifa_addr->sa_family != AF_INET6)
-                       continue;
-               ia = (struct in6_ifaddr *)ifa;
-               if (ia->ia6_flags & IN6_IFF_TENTATIVE)
-                       nd6_dad_start(ifa, &dad_delay);
+               return(1);
        }
 }
 
@@ -2559,23 +2639,19 @@ in6_setmaxmtu()
        unsigned long maxmtu = 0;
        struct ifnet *ifp;
 
-#if defined(__bsdi__) || (defined(__FreeBSD__) && __FreeBSD__ < 3)
-       for (ifp = ifnet; ifp; ifp = ifp->if_next)
-#else
-       for (ifp = TAILQ_FIRST(&ifnet); ifp; ifp = TAILQ_NEXT(ifp, if_list))
-#endif
-       {
+       ifnet_head_lock_shared();
+       TAILQ_FOREACH(ifp, &ifnet_head, if_list) {
                if ((ifp->if_flags & IFF_LOOPBACK) == 0 &&
                    nd_ifinfo[ifp->if_index].linkmtu > maxmtu)
                        maxmtu =  nd_ifinfo[ifp->if_index].linkmtu;
        }
+       ifnet_head_done();
        if (maxmtu)     /* update only when maxmtu is positive */
                in6_maxmtu = maxmtu;
 }
 
-#if MAPPED_ADDR_ENABLED
-/* 
- * Convert sockaddr_in6 to sockaddr_in. Original sockaddr_in6 must be
+/*
+ * Convert sockaddr_in6 to sockaddr_in.  Original sockaddr_in6 must be
  * v4 mapped addr or v4 compat addr
  */
 void
@@ -2632,5 +2708,36 @@ in6_sin_2_v4mapsin6_in_sock(struct sockaddr **nam)
        FREE(*nam, M_SONAME);
        *nam = (struct sockaddr *)sin6_p;
 }
-#endif /* MAPPED_ADDR_ENABLED */
 
+/* Posts in6_event_data message kernel events */
+void
+in6_post_msg(struct ifnet *ifp, u_long event_code, struct in6_ifaddr *ifa)
+{
+       struct kev_msg        ev_msg;
+       struct kev_in6_data    in6_event_data;
+
+       ev_msg.vendor_code    = KEV_VENDOR_APPLE;
+       ev_msg.kev_class      = KEV_NETWORK_CLASS;
+       ev_msg.kev_subclass   = KEV_INET6_SUBCLASS;
+       ev_msg.event_code     = event_code;
+
+       in6_event_data.ia_addr         = ifa->ia_addr;
+       in6_event_data.ia_net          = ifa->ia_net;
+       in6_event_data.ia_dstaddr      = ifa->ia_dstaddr;
+       in6_event_data.ia_prefixmask   = ifa->ia_prefixmask;
+       in6_event_data.ia_plen         = ifa->ia_plen;
+       in6_event_data.ia6_flags       = (u_int32_t)ifa->ia6_flags;
+       in6_event_data.ia_lifetime     = ifa->ia6_lifetime;
+
+       if (ifp != NULL) {
+               strncpy(&in6_event_data.link_data.if_name[0], ifp->if_name, IFNAMSIZ);
+               in6_event_data.link_data.if_family = ifp->if_family;
+               in6_event_data.link_data.if_unit  = (unsigned long) ifp->if_unit;
+       }
+
+       ev_msg.dv[0].data_ptr    = &in6_event_data;
+       ev_msg.dv[0].data_length = sizeof(struct kev_in6_data);
+       ev_msg.dv[1].data_length = 0;
+
+       kev_post_msg(&ev_msg);
+}