/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

#include "defs.h"
#include "tables.h"

#include <time.h>
#include <assert.h>

struct phyint *phyints = NULL;
int num_of_phyints = 0;

static void	phyint_print(struct phyint *pi);
static void	phyint_insert(struct phyint *pi);

static boolean_t tmptoken_isvalid(struct in6_addr *token);

static void	prefix_print(struct prefix *pr);
static void	prefix_insert(struct phyint *pi, struct prefix *pr);
static char	*prefix_print_state(int state, char *buf, int buflen);
static void	prefix_set(struct in6_addr *prefix, struct in6_addr addr,
		    int bits);

static void	adv_prefix_print(struct adv_prefix *adv_pr);
static void	adv_prefix_insert(struct phyint *pi, struct adv_prefix *adv_pr);
static void	adv_prefix_delete(struct adv_prefix *adv_pr);

static void	router_print(struct router *dr);
static void	router_insert(struct phyint *pi, struct router *dr);
static void	router_delete(struct router *dr);
static void	router_add_k(struct router *dr);
static void	router_delete_k(struct router *dr);

static int	rtmseq;				/* rtm_seq sequence number */

/* 1 week in ms */
#define	NDP_PREFIX_DEFAULT_LIFETIME	(7*24*60*60*1000)
struct phyint *
phyint_lookup(char *name)
{
	struct phyint *pi;

	if (debug & D_PHYINT)
		logmsg(LOG_DEBUG, "phyint_lookup(%s)\n", name);

	for (pi = phyints; pi != NULL; pi = pi->pi_next) {
		if (strcmp(pi->pi_name, name) == 0)
			break;
	}
	return (pi);
}

struct phyint *
phyint_lookup_on_index(uint_t ifindex)
{
	struct phyint *pi;

	if (debug & D_PHYINT)
		logmsg(LOG_DEBUG, "phyint_lookup_on_index(%d)\n", ifindex);

	for (pi = phyints; pi != NULL; pi = pi->pi_next) {
		if (pi->pi_index == ifindex)
			break;
	}
	return (pi);
}

struct phyint *
phyint_create(char *name)
{
	struct phyint *pi;
	int i;

	if (debug & D_PHYINT)
		logmsg(LOG_DEBUG, "phyint_create(%s)\n", name);

	pi = (struct phyint *)calloc(sizeof (struct phyint), 1);
	if (pi == NULL) {
		logmsg(LOG_ERR, "phyint_create: out of memory\n");
		return (NULL);
	}
	(void) strncpy(pi->pi_name, name, sizeof (pi->pi_name));
	pi->pi_name[sizeof (pi->pi_name) - 1] = '\0';

	/*
	 * Copy the defaults from the defaults array.
	 * Do not copy the cf_notdefault fields since these have not
	 * been explicitly set for the phyint.
	 */
	for (i = 0; i < I_IFSIZE; i++)
		pi->pi_config[i].cf_value = ifdefaults[i].cf_value;

	/*
	 * TmpDesyncFactor is used to desynchronize temporary token
	 * generation among systems; the actual preferred lifetime value
	 * of a temporary address will be (TmpPreferredLifetime -
	 * TmpDesyncFactor).  It's a random value, with a user-configurable
	 * maximum value.  The value is constant throughout the lifetime
	 * of the in.ndpd process, but can change if the daemon is restarted,
	 * per RFC3041.
	 */
	if (pi->pi_TmpMaxDesyncFactor != 0) {
		time_t seed = time(NULL);
		srand((uint_t)seed);
		pi->pi_TmpDesyncFactor = rand() % pi->pi_TmpMaxDesyncFactor;
		/* we actually want [1,max], not [0,(max-1)] */
		pi->pi_TmpDesyncFactor++;
	}
	pi->pi_TmpRegenCountdown = TIMER_INFINITY;

	pi->pi_sock = -1;
	pi->pi_stateless = pi->pi_StatelessAddrConf;
	pi->pi_stateful = pi->pi_StatefulAddrConf;
	pi->pi_autoconf = _B_TRUE;
	pi->pi_default_token = _B_TRUE;
	if (phyint_init_from_k(pi) == -1) {
		free(pi);
		return (NULL);
	}
	phyint_insert(pi);
	if (pi->pi_sock != -1) {
		if (poll_add(pi->pi_sock) == -1) {
			phyint_delete(pi);
			return (NULL);
		}
	}
	return (pi);
}

/* Insert in linked list */
static void
phyint_insert(struct phyint *pi)
{
	/* Insert in list */
	pi->pi_next = phyints;
	pi->pi_prev = NULL;
	if (phyints)
		phyints->pi_prev = pi;
	phyints = pi;
	num_of_phyints++;
}

/*
 * Initialize both the phyint data structure and the pi_sock for
 * sending and receving on the interface.
 * Extract information from the kernel (if present) and set pi_kernel_state.
 */
int
phyint_init_from_k(struct phyint *pi)
{
	struct ipv6_mreq v6mcastr;
	struct lifreq lifr;
	int fd;
	int save_errno;
	boolean_t newsock;
	uint_t ttl;
	struct sockaddr_in6 *sin6;

	if (debug & D_PHYINT)
		logmsg(LOG_DEBUG, "phyint_init_from_k(%s)\n", pi->pi_name);

start_over:

	if (pi->pi_sock < 0) {
		pi->pi_sock = socket(AF_INET6, SOCK_RAW, IPPROTO_ICMPV6);
		if (pi->pi_sock < 0) {
			logperror_pi(pi, "phyint_init_from_k: socket");
			return (-1);
		}
		newsock = _B_TRUE;
	} else {
		newsock = _B_FALSE;
	}
	fd = pi->pi_sock;

	(void) strncpy(lifr.lifr_name, pi->pi_name, sizeof (lifr.lifr_name));
	lifr.lifr_name[sizeof (lifr.lifr_name) - 1] = '\0';
	if (ioctl(fd, SIOCGLIFINDEX, (char *)&lifr) < 0) {
		if (errno == ENXIO) {
			if (newsock) {
				(void) close(pi->pi_sock);
				pi->pi_sock = -1;
			}
			if (debug & D_PHYINT) {
				logmsg(LOG_DEBUG, "phyint_init_from_k(%s): "
				    "not exist\n", pi->pi_name);
			}
			return (0);
		}
		logperror_pi(pi, "phyint_init_from_k: SIOCGLIFINDEX");
		goto error;
	}

	if (!newsock && (pi->pi_index != lifr.lifr_index)) {
		/*
		 * Interface has been re-plumbed, lets open a new socket.
		 * This situation can occur if plumb/unplumb are happening
		 * quite frequently.
		 */

		phyint_cleanup(pi);
		goto start_over;
	}

	pi->pi_index = lifr.lifr_index;

	if (ioctl(fd, SIOCGLIFFLAGS, (char *)&lifr) < 0) {
		logperror_pi(pi, "phyint_init_from_k: ioctl (get flags)");
		goto error;
	}
	pi->pi_flags = lifr.lifr_flags;

	/*
	 * If the link local interface is not up yet or it's IFF_UP and the
	 * IFF_NOLOCAL flag is set, then ignore the interface.
	 */
	if (!(pi->pi_flags & IFF_UP) || (pi->pi_flags & IFF_NOLOCAL)) {
		if (newsock) {
			(void) close(pi->pi_sock);
			pi->pi_sock = -1;
		}

		if (debug & D_PHYINT) {
			logmsg(LOG_DEBUG, "phyint_init_from_k(%s): "
			    "IFF_NOLOCAL or not IFF_UP\n", pi->pi_name);
		}
		return (0);
	}
	pi->pi_kernel_state |= PI_PRESENT;

	if (ioctl(fd, SIOCGLIFMTU, (caddr_t)&lifr) < 0) {
		logperror_pi(pi, "phyint_init_from_k: ioctl (get mtu)");
		goto error;
	}
	pi->pi_mtu = lifr.lifr_mtu;

	if (ioctl(fd, SIOCGLIFADDR, (char *)&lifr) < 0) {
		logperror_pi(pi, "phyint_init_from_k: SIOCGLIFADDR");
		goto error;
	}
	sin6 = (struct sockaddr_in6 *)&lifr.lifr_addr;
	pi->pi_ifaddr = sin6->sin6_addr;

	if (pi->pi_autoconf && pi->pi_default_token) {
		if (ioctl(fd, SIOCGLIFTOKEN, (char *)&lifr) < 0) {
			logperror_pi(pi, "phyint_init_from_k: SIOCGLIFTOKEN");
			goto error;
		}
		/* Ignore interface if the token is all zeros */
		sin6 = (struct sockaddr_in6 *)&lifr.lifr_token;
		if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
			logmsg(LOG_ERR, "ignoring interface %s: zero token\n",
			    pi->pi_name);
			goto error;
		}
		pi->pi_token = sin6->sin6_addr;
		pi->pi_token_length = lifr.lifr_addrlen;
	}

	/*
	 * Guess a remote token for POINTOPOINT by looking at
	 * the link-local destination address.
	 */
	if (pi->pi_flags & IFF_POINTOPOINT) {
		if (ioctl(fd, SIOCGLIFDSTADDR, (char *)&lifr) < 0) {
			logperror_pi(pi, "phyint_init_from_k: SIOCGLIFDSTADDR");
			goto error;
		}
		sin6 = (struct sockaddr_in6 *)&lifr.lifr_addr;
		if (sin6->sin6_family != AF_INET6 ||
		    IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr) ||
		    !IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
			pi->pi_dst_token = in6addr_any;
		} else {
			pi->pi_dst_token = sin6->sin6_addr;
			/* Clear link-local prefix (first 10 bits) */
			pi->pi_dst_token.s6_addr[0] = 0;
			pi->pi_dst_token.s6_addr[1] &= 0x3f;
		}
	} else {
		pi->pi_dst_token = in6addr_any;
	}

	if (newsock) {
		icmp6_filter_t filter;
		int on = 1;

		/* Set default values */
		pi->pi_LinkMTU = pi->pi_mtu;
		pi->pi_CurHopLimit = 0;
		pi->pi_BaseReachableTime = ND_REACHABLE_TIME;
		phyint_reach_random(pi, _B_FALSE);
		pi->pi_RetransTimer = ND_RETRANS_TIMER;

		/* Setup socket for transmission and reception */
		if (setsockopt(fd, IPPROTO_IPV6,
		    IPV6_BOUND_IF, (char *)&pi->pi_index,
		    sizeof (pi->pi_index)) < 0) {
			logperror_pi(pi, "phyint_init_from_k: setsockopt "
			    "IPV6_BOUND_IF");
			goto error;
		}

		ttl = IPV6_MAX_HOPS;
		if (setsockopt(fd, IPPROTO_IPV6, IPV6_UNICAST_HOPS,
		    (char *)&ttl, sizeof (ttl)) < 0) {
			logperror_pi(pi, "phyint_init_from_k: setsockopt "
			    "IPV6_UNICAST_HOPS");
			goto error;
		}

		if (setsockopt(fd, IPPROTO_IPV6, IPV6_MULTICAST_HOPS,
		    (char *)&ttl, sizeof (ttl)) < 0) {
			logperror_pi(pi, "phyint_init_from_k: setsockopt "
			    "IPV6_MULTICAST_HOPS");
			goto error;
		}

		v6mcastr.ipv6mr_multiaddr = all_nodes_mcast;
		v6mcastr.ipv6mr_interface = pi->pi_index;
		if (setsockopt(fd, IPPROTO_IPV6, IPV6_JOIN_GROUP,
		    (char *)&v6mcastr, sizeof (v6mcastr)) < 0) {
			/*
			 * One benign reason IPV6_JOIN_GROUP could fail is
			 * when `pi' has been placed into an IPMP group and we
			 * haven't yet processed the routing socket message
			 * informing us of its disappearance.  As such, if
			 * it's now in a group, don't print an error.
			 */
			save_errno = errno;
			(void) strlcpy(lifr.lifr_name, pi->pi_name, LIFNAMSIZ);
			if (ioctl(fd, SIOCGLIFGROUPNAME, &lifr) == -1 ||
			    lifr.lifr_groupname[0] == '\0') {
				errno = save_errno;
				logperror_pi(pi, "phyint_init_from_k: "
				    "setsockopt IPV6_JOIN_GROUP");
			}
			goto error;
		}
		pi->pi_state |= PI_JOINED_ALLNODES;
		pi->pi_kernel_state |= PI_JOINED_ALLNODES;

		/*
		 * Filter out so that we only receive router advertisements and
		 * router solicitations.
		 */
		ICMP6_FILTER_SETBLOCKALL(&filter);
		ICMP6_FILTER_SETPASS(ND_ROUTER_SOLICIT, &filter);
		ICMP6_FILTER_SETPASS(ND_ROUTER_ADVERT, &filter);

		if (setsockopt(fd, IPPROTO_ICMPV6, ICMP6_FILTER,
		    (char *)&filter, sizeof (filter)) < 0) {
			logperror_pi(pi, "phyint_init_from_k: setsockopt "
			    "ICMP6_FILTER");
			goto error;
		}

		/* Enable receipt of ancillary data */
		if (setsockopt(fd, IPPROTO_IPV6, IPV6_RECVHOPLIMIT,
		    (char *)&on, sizeof (on)) < 0) {
			logperror_pi(pi, "phyint_init_from_k: setsockopt "
			    "IPV6_RECVHOPLIMIT");
			goto error;
		}
		if (setsockopt(fd, IPPROTO_IPV6, IPV6_RECVRTHDR,
		    (char *)&on, sizeof (on)) < 0) {
			logperror_pi(pi, "phyint_init_from_k: setsockopt "
			    "IPV6_RECVRTHDR");
			goto error;
		}
	}

	if (pi->pi_AdvSendAdvertisements &&
	    !(pi->pi_kernel_state & PI_JOINED_ALLROUTERS)) {
		v6mcastr.ipv6mr_multiaddr = all_routers_mcast;
		v6mcastr.ipv6mr_interface = pi->pi_index;
		if (setsockopt(fd, IPPROTO_IPV6, IPV6_JOIN_GROUP,
		    (char *)&v6mcastr, sizeof (v6mcastr)) < 0) {
			/*
			 * See IPV6_JOIN_GROUP comment above.
			 */
			save_errno = errno;
			(void) strlcpy(lifr.lifr_name, pi->pi_name, LIFNAMSIZ);
			if (ioctl(fd, SIOCGLIFGROUPNAME, &lifr) == -1 ||
			    lifr.lifr_groupname[0] == '\0') {
				errno = save_errno;
				logperror_pi(pi, "phyint_init_from_k: "
				    "setsockopt IPV6_JOIN_GROUP");
			}
			goto error;
		}
		pi->pi_state |= PI_JOINED_ALLROUTERS;
		pi->pi_kernel_state |= PI_JOINED_ALLROUTERS;
	}
	/*
	 * If not already set, set the IFF_ROUTER interface flag based on
	 * AdvSendAdvertisements.  Note that this will also enable IPv6
	 * forwarding on the interface.  We don't clear IFF_ROUTER if we're
	 * not advertising on an interface, because we could still be
	 * forwarding on those interfaces.
	 */
	(void) strncpy(lifr.lifr_name, pi->pi_name, sizeof (lifr.lifr_name));
	lifr.lifr_name[sizeof (lifr.lifr_name) - 1] = '\0';
	if (ioctl(fd, SIOCGLIFFLAGS, (char *)&lifr) < 0) {
		logperror_pi(pi, "phyint_init_from_k: SIOCGLIFFLAGS");
		goto error;
	}
	if (!(lifr.lifr_flags & IFF_ROUTER) && pi->pi_AdvSendAdvertisements) {
		lifr.lifr_flags |= IFF_ROUTER;

		if (ioctl(fd, SIOCSLIFFLAGS, (char *)&lifr) < 0) {
			logperror_pi(pi, "phyint_init_from_k: SIOCSLIFFLAGS");
			goto error;
		}
		pi->pi_flags = lifr.lifr_flags;
	}

	/* Set linkinfo parameters */
	(void) strncpy(lifr.lifr_name, pi->pi_name, sizeof (lifr.lifr_name));
	lifr.lifr_name[sizeof (lifr.lifr_name) - 1] = '\0';
	lifr.lifr_ifinfo.lir_maxhops = pi->pi_CurHopLimit;
	lifr.lifr_ifinfo.lir_reachtime = pi->pi_ReachableTime;
	lifr.lifr_ifinfo.lir_reachretrans = pi->pi_RetransTimer;
	/* Setting maxmtu to 0 means that we're leaving the MTU alone */
	lifr.lifr_ifinfo.lir_maxmtu = 0;
	if (ioctl(fd, SIOCSLIFLNKINFO, (char *)&lifr) < 0) {
		logperror_pi(pi, "phyint_init_from_k: SIOCSLIFLNKINFO");
		goto error;
	}
	if (debug & D_PHYINT) {
		logmsg(LOG_DEBUG, "phyint_init_from_k(%s): done\n",
		    pi->pi_name);
	}
	return (0);

error:
	/* Pretend the interface does not exist in the kernel */
	pi->pi_kernel_state &= ~PI_PRESENT;
	if (newsock) {
		(void) close(pi->pi_sock);
		pi->pi_sock = -1;
	}
	return (-1);
}

/*
 * Delete (unlink and free).
 * Handles delete of things that have not yet been inserted in the list.
 */
void
phyint_delete(struct phyint *pi)
{
	if (debug & D_PHYINT)
		logmsg(LOG_DEBUG, "phyint_delete(%s)\n", pi->pi_name);

	assert(num_of_phyints > 0);

	while (pi->pi_router_list)
		router_delete(pi->pi_router_list);
	while (pi->pi_prefix_list) {
		prefix_update_ipadm_addrobj(pi->pi_prefix_list, _B_FALSE);
		prefix_delete(pi->pi_prefix_list);
	}
	while (pi->pi_adv_prefix_list)
		adv_prefix_delete(pi->pi_adv_prefix_list);

	if (pi->pi_sock != -1) {
		(void) poll_remove(pi->pi_sock);
		if (close(pi->pi_sock) < 0) {
			logperror_pi(pi, "phyint_delete: close");
		}
		pi->pi_sock = -1;
	}

	if (pi->pi_prev == NULL) {
		if (phyints == pi)
			phyints = pi->pi_next;
	} else {
		pi->pi_prev->pi_next = pi->pi_next;
	}
	if (pi->pi_next != NULL)
		pi->pi_next->pi_prev = pi->pi_prev;
	pi->pi_next = pi->pi_prev = NULL;
	free(pi);
	num_of_phyints--;
}

/*
 * Called with the number of milliseconds elapsed since the last call.
 * Determines if any timeout event has occurred and
 * returns the number of milliseconds until the next timeout event
 * for the phyint itself (excluding prefixes and routers).
 * Returns TIMER_INFINITY for "never".
 */
uint_t
phyint_timer(struct phyint *pi, uint_t elapsed)
{
	uint_t next = TIMER_INFINITY;

	if (pi->pi_AdvSendAdvertisements) {
		if (pi->pi_adv_state != NO_ADV) {
			int old_state = pi->pi_adv_state;

			if (debug & (D_STATE|D_PHYINT)) {
				logmsg(LOG_DEBUG, "phyint_timer ADV(%s) "
				    "state %d\n", pi->pi_name, (int)old_state);
			}
			next = advertise_event(pi, ADV_TIMER, elapsed);
			if (debug & D_STATE) {
				logmsg(LOG_DEBUG, "phyint_timer ADV(%s) "
				    "state %d -> %d\n",
				    pi->pi_name, (int)old_state,
				    (int)pi->pi_adv_state);
			}
		}
	} else {
		if (pi->pi_sol_state != NO_SOLICIT) {
			int old_state = pi->pi_sol_state;

			if (debug & (D_STATE|D_PHYINT)) {
				logmsg(LOG_DEBUG, "phyint_timer SOL(%s) "
				    "state %d\n", pi->pi_name, (int)old_state);
			}
			next = solicit_event(pi, SOL_TIMER, elapsed);
			if (debug & D_STATE) {
				logmsg(LOG_DEBUG, "phyint_timer SOL(%s) "
				    "state %d -> %d\n",
				    pi->pi_name, (int)old_state,
				    (int)pi->pi_sol_state);
			}
		}
	}

	/*
	 * If the phyint has been unplumbed, we don't want to call
	 * phyint_reach_random. We will be in the NO_ADV or NO_SOLICIT state.
	 */
	if ((pi->pi_AdvSendAdvertisements && (pi->pi_adv_state != NO_ADV)) ||
	    (!pi->pi_AdvSendAdvertisements &&
	    (pi->pi_sol_state != NO_SOLICIT))) {
		pi->pi_reach_time_since_random += elapsed;
		if (pi->pi_reach_time_since_random >= MAX_REACH_RANDOM_INTERVAL)
			phyint_reach_random(pi, _B_TRUE);
	}

	return (next);
}

static void
phyint_print(struct phyint *pi)
{
	struct prefix *pr;
	struct adv_prefix *adv_pr;
	struct router *dr;
	char abuf[INET6_ADDRSTRLEN];

	logmsg(LOG_DEBUG, "Phyint %s index %d state %x, kernel %x, "
	    "num routers %d\n",
	    pi->pi_name, pi->pi_index, pi->pi_state, pi->pi_kernel_state,
	    pi->pi_num_k_routers);
	logmsg(LOG_DEBUG, "\taddress: %s flags %llx\n",
	    inet_ntop(AF_INET6, (void *)&pi->pi_ifaddr,
	    abuf, sizeof (abuf)), pi->pi_flags);
	logmsg(LOG_DEBUG, "\tsock %d mtu %d\n", pi->pi_sock, pi->pi_mtu);
	logmsg(LOG_DEBUG, "\ttoken: len %d %s\n", pi->pi_token_length,
	    inet_ntop(AF_INET6, (void *)&pi->pi_token,
	    abuf, sizeof (abuf)));
	if (pi->pi_TmpAddrsEnabled) {
		logmsg(LOG_DEBUG, "\ttmp_token: %s\n",
		    inet_ntop(AF_INET6, (void *)&pi->pi_tmp_token,
		    abuf, sizeof (abuf)));
		logmsg(LOG_DEBUG, "\ttmp config: pref %d valid %d "
		    "maxdesync %d desync %d regen %d\n",
		    pi->pi_TmpPreferredLifetime, pi->pi_TmpValidLifetime,
		    pi->pi_TmpMaxDesyncFactor, pi->pi_TmpDesyncFactor,
		    pi->pi_TmpRegenAdvance);
	}
	if (pi->pi_flags & IFF_POINTOPOINT) {
		logmsg(LOG_DEBUG, "\tdst_token: %s\n",
		    inet_ntop(AF_INET6, (void *)&pi->pi_dst_token,
		    abuf, sizeof (abuf)));
	}
	logmsg(LOG_DEBUG, "\tLinkMTU %d CurHopLimit %d "
	    "BaseReachableTime %d\n\tReachableTime %d RetransTimer %d\n",
	    pi->pi_LinkMTU, pi->pi_CurHopLimit, pi->pi_BaseReachableTime,
	    pi->pi_ReachableTime, pi->pi_RetransTimer);
	if (!pi->pi_AdvSendAdvertisements) {
		/* Solicit state */
		logmsg(LOG_DEBUG, "\tSOLICIT: time_left %d state %d count %d\n",
		    pi->pi_sol_time_left, pi->pi_sol_state, pi->pi_sol_count);
	} else {
		/* Advertise state */
		logmsg(LOG_DEBUG, "\tADVERT: time_left %d state %d count %d "
		    "since last %d\n",
		    pi->pi_adv_time_left, pi->pi_adv_state, pi->pi_adv_count,
		    pi->pi_adv_time_since_sent);
		print_iflist(pi->pi_config);
	}
	for (pr = pi->pi_prefix_list; pr != NULL; pr = pr->pr_next)
		prefix_print(pr);

	for (adv_pr = pi->pi_adv_prefix_list; adv_pr != NULL;
	    adv_pr = adv_pr->adv_pr_next) {
		adv_prefix_print(adv_pr);
	}

	for (dr = pi->pi_router_list; dr != NULL; dr = dr->dr_next)
		router_print(dr);

	logmsg(LOG_DEBUG, "\n");
}


/*
 * Store the LLA for the phyint `pi' `lifrp'.  Returns 0 on success, or
 * -1 on failure.
 *
 * Note that we do not cache the hardware address since there's no reliable
 * mechanism to determine when it's become stale.
 */
int
phyint_get_lla(struct phyint *pi, struct lifreq *lifrp)
{
	struct sockaddr_in6 *sin6;

	/* If this phyint doesn't have a link-layer address, bail */
	if (!(pi->pi_flags & IFF_MULTICAST) ||
	    (pi->pi_flags & IFF_POINTOPOINT)) {
		return (-1);
	}

	(void) strlcpy(lifrp->lifr_name, pi->pi_name, LIFNAMSIZ);
	sin6 = (struct sockaddr_in6 *)&(lifrp->lifr_nd.lnr_addr);
	sin6->sin6_family = AF_INET6;
	sin6->sin6_addr = pi->pi_ifaddr;
	if (ioctl(pi->pi_sock, SIOCLIFGETND, lifrp) < 0) {
		/*
		 * For IPMP interfaces, don't report ESRCH errors since that
		 * merely indicates that there are no active interfaces in the
		 * IPMP group (and thus there's no working hardware address),
		 * and the packet will thus never make it out anyway.
		 */
		if (!(pi->pi_flags & IFF_IPMP) || errno != ESRCH)
			logperror_pi(pi, "phyint_get_lla: SIOCLIFGETND");
		return (-1);
	}
	return (0);
}

/*
 * Randomize pi->pi_ReachableTime.
 * Done periodically when there are no RAs and at a maximum frequency when
 * RA's arrive.
 * Assumes that caller has determined that it is time to generate
 * a new random ReachableTime.
 */
void
phyint_reach_random(struct phyint *pi, boolean_t set_needed)
{
	struct lifreq lifr;

	pi->pi_ReachableTime = GET_RANDOM(
	    (int)(ND_MIN_RANDOM_FACTOR * pi->pi_BaseReachableTime),
	    (int)(ND_MAX_RANDOM_FACTOR * pi->pi_BaseReachableTime));
	if (set_needed) {
		bzero(&lifr, sizeof (lifr));
		(void) strlcpy(lifr.lifr_name, pi->pi_name, LIFNAMSIZ);
		lifr.lifr_ifinfo.lir_reachtime = pi->pi_ReachableTime;
		if (ioctl(pi->pi_sock, SIOCSLIFLNKINFO, (char *)&lifr) < 0) {
			logperror_pi(pi,
			    "phyint_reach_random: SIOCSLIFLNKINFO");
			return;
		}
	}
	pi->pi_reach_time_since_random = 0;
}

/*
 * Validate a temporary token against a list of known bad values.
 * Currently assumes that token is 8 bytes long!  Current known
 * bad values include 0, reserved anycast tokens (RFC 2526), tokens
 * used by ISATAP (draft-ietf-ngtrans-isatap-N), any token already
 * assigned to this interface, or any token for which the global
 * bit is set.
 *
 * Called by tmptoken_create().
 *
 * Return _B_TRUE if token is valid (no match), _B_FALSE if not.
 */
static boolean_t
tmptoken_isvalid(struct in6_addr *token)
{
	struct phyint *pi;
	struct in6_addr mask;
	struct in6_addr isatap = { 0, 0, 0, 0, 0, 0, 0, 0, \
				    0, 0, 0x5e, 0xfe, 0, 0, 0, 0 };
	struct in6_addr anycast = { 0, 0, 0, 0, \
				    0, 0, 0, 0, \
				    0xfd, 0xff, 0xff, 0xff, \
				    0xff, 0xff, 0xff, 0x80 };

	if (IN6_IS_ADDR_UNSPECIFIED(token))
		return (_B_FALSE);

	if (token->s6_addr[8] & 0x2)
		return (_B_FALSE);

	(void) memcpy(&mask, token, sizeof (mask));
	mask._S6_un._S6_u32[3] = 0;
	if (IN6_ARE_ADDR_EQUAL(&isatap, token))
		return (_B_FALSE);

	mask._S6_un._S6_u32[3] = token->_S6_un._S6_u32[3] & 0xffffff80;
	if (IN6_ARE_ADDR_EQUAL(&anycast, token))
		return (_B_FALSE);

	for (pi = phyints; pi != NULL; pi = pi->pi_next) {
		if (((pi->pi_token_length == TMP_TOKEN_BITS) &&
		    IN6_ARE_ADDR_EQUAL(&pi->pi_token, token)) ||
		    IN6_ARE_ADDR_EQUAL(&pi->pi_tmp_token, token))
			return (_B_FALSE);
	}

	/* none of our tests failed, must be a good one! */
	return (_B_TRUE);
}

/*
 * Generate a temporary token and set up its timer
 *
 * Called from incoming_prefix_addrconf_process() (when token is first
 * needed) and from tmptoken_timer() (when current token expires).
 *
 * Returns _B_TRUE if a token was successfully generated, _B_FALSE if not.
 */
boolean_t
tmptoken_create(struct phyint *pi)
{
	int fd, i = 0, max_tries = 15;
	struct in6_addr token;
	uint32_t *tokenp = &(token._S6_un._S6_u32[2]);
	char buf[INET6_ADDRSTRLEN];

	if ((fd = open("/dev/urandom", O_RDONLY)) == -1) {
		perror("open /dev/urandom");
		goto no_token;
	}

	bzero((char *)&token, sizeof (token));
	do {
		if (read(fd, (void *)tokenp, TMP_TOKEN_BYTES) == -1) {
			perror("read /dev/urandom");
			(void) close(fd);
			goto no_token;
		}

		/*
		 * Assume EUI-64 formatting, and thus 64-bit
		 * token len; need to clear global bit.
		 */
		token.s6_addr[8] &= 0xfd;

		i++;

	} while (!tmptoken_isvalid(&token) && i < max_tries);

	(void) close(fd);

	if (i == max_tries) {
no_token:
		logmsg(LOG_WARNING, "tmptoken_create(%s): failed to create "
		    "token; disabling temporary addresses on %s\n",
		    pi->pi_name, pi->pi_name);
		pi->pi_TmpAddrsEnabled = 0;
		return (_B_FALSE);
	}

	pi->pi_tmp_token = token;

	if (debug & D_TMP)
		logmsg(LOG_DEBUG, "tmptoken_create(%s): created temporary "
		    "token %s\n", pi->pi_name,
		    inet_ntop(AF_INET6, &pi->pi_tmp_token, buf, sizeof (buf)));

	pi->pi_TmpRegenCountdown = (pi->pi_TmpPreferredLifetime -
	    pi->pi_TmpDesyncFactor - pi->pi_TmpRegenAdvance) * MILLISEC;
	if (pi->pi_TmpRegenCountdown != 0)
		timer_schedule(pi->pi_TmpRegenCountdown);

	return (_B_TRUE);
}

/*
 * Delete a temporary token.  This is outside the normal timeout process,
 * so mark any existing addresses based on this token DEPRECATED and set
 * their preferred lifetime to 0.  Don't tamper with valid lifetime, that
 * will be used to eventually remove the address.  Also reset the current
 * pi_tmp_token value to 0.
 *
 * Called from incoming_prefix_addrconf_process() if DAD fails on a temp
 * addr.
 */
void
tmptoken_delete(struct phyint *pi)
{
	struct prefix *pr;

	for (pr = pi->pi_prefix_list; pr != NULL; pr = pr->pr_next) {
		if (!(pr->pr_flags & IFF_TEMPORARY) ||
		    (pr->pr_flags & IFF_DEPRECATED) ||
		    (!token_equal(pr->pr_address, pi->pi_tmp_token,
		    TMP_TOKEN_BITS))) {
			continue;
		}
		pr->pr_PreferredLifetime = 0;
		pr->pr_state |= PR_DEPRECATED;
		prefix_update_k(pr);
	}

	(void) memset(&pi->pi_tmp_token, 0, sizeof (pi->pi_tmp_token));
}

/*
 * Called from run_timeouts() with the number of milliseconds elapsed
 * since the last call.  Determines if any timeout event has occurred
 * and returns the number of milliseconds until the next timeout event
 * for the tmp token.  Returns TIMER_INFINITY for "never".
 */
uint_t
tmptoken_timer(struct phyint *pi, uint_t elapsed)
{
	struct nd_opt_prefix_info opt;
	struct sockaddr_in6 sin6;
	struct prefix *pr, *newpr;

	if (debug & D_TMP) {
		logmsg(LOG_DEBUG, "tmptoken_timer(%s, %d) regencountdown %d\n",
		    pi->pi_name, (int)elapsed, pi->pi_TmpRegenCountdown);
	}
	if (!pi->pi_TmpAddrsEnabled ||
	    (pi->pi_TmpRegenCountdown == TIMER_INFINITY))
		return (TIMER_INFINITY);

	if (pi->pi_TmpRegenCountdown > elapsed) {
		pi->pi_TmpRegenCountdown -= elapsed;
		return (pi->pi_TmpRegenCountdown);
	}

	/*
	 * Tmp token timer has expired.  Start by generating a new token.
	 * If we can't get a new token, tmp addrs are disabled on this
	 * interface, so there's no need to continue, or to set a timer.
	 */
	if (!tmptoken_create(pi))
		return (TIMER_INFINITY);

	/*
	 * Now that we have a new token, walk the list of prefixes to
	 * find which ones need a corresponding tmp addr generated.
	 */
	for (pr = pi->pi_prefix_list; pr != NULL; pr = pr->pr_next) {

		if (!(pr->pr_state & PR_AUTO) || pr->pr_state & PR_STATIC ||
		    pr->pr_state & PR_DEPRECATED ||
		    pr->pr_flags & IFF_TEMPORARY)
			continue;

		newpr = prefix_create(pi, pr->pr_prefix, pr->pr_prefix_len,
		    IFF_TEMPORARY);
		if (newpr == NULL) {
			char pbuf[INET6_ADDRSTRLEN];
			char tbuf[INET6_ADDRSTRLEN];
			(void) inet_ntop(AF_INET6, &pr->pr_prefix, pbuf,
			    sizeof (pbuf));
			(void) inet_ntop(AF_INET6, &pi->pi_tmp_token, tbuf,
			    sizeof (tbuf));
			logmsg(LOG_ERR, "can't create new tmp addr "
			    "(%s, %s, %s)\n", pi->pi_name, pbuf, tbuf);
			continue;
		}

		/*
		 * We want to use incoming_prefix_*_process() functions to
		 * set up the new tmp addr, so cobble together a prefix
		 * info option struct based on the existing prefix to pass
		 * in.  The lifetimes will be based on the current time
		 * remaining.
		 *
		 * The "from" param is only used for messages; pass in
		 * ::0 for that.
		 */
		opt.nd_opt_pi_type = ND_OPT_PREFIX_INFORMATION;
		opt.nd_opt_pi_len = sizeof (opt) / 8;
		opt.nd_opt_pi_prefix_len = pr->pr_prefix_len;
		opt.nd_opt_pi_flags_reserved = ND_OPT_PI_FLAG_AUTO;
		opt.nd_opt_pi_valid_time =
		    htonl(pr->pr_ValidLifetime / 1000);
		opt.nd_opt_pi_preferred_time =
		    htonl(pr->pr_PreferredLifetime / 1000);
		if (pr->pr_state & PR_ONLINK)
			opt.nd_opt_pi_flags_reserved &= ND_OPT_PI_FLAG_ONLINK;
		opt.nd_opt_pi_prefix = pr->pr_prefix;

		(void) memset(&sin6, 0, sizeof (sin6));

		if (!incoming_prefix_addrconf_process(pi, newpr,
		    (uchar_t *)&opt, &sin6, _B_FALSE, _B_TRUE)) {
			char pbuf[INET6_ADDRSTRLEN];
			char tbuf[INET6_ADDRSTRLEN];
			(void) inet_ntop(AF_INET6, &pr->pr_prefix, pbuf,
			    sizeof (pbuf));
			(void) inet_ntop(AF_INET6, &pi->pi_tmp_token, tbuf,
			    sizeof (tbuf));
			logmsg(LOG_ERR, "can't create new tmp addr "
			    "(%s, %s, %s)\n", pi->pi_name, pbuf, tbuf);
			continue;
		}

		if (pr->pr_state & PR_ONLINK) {
			incoming_prefix_onlink_process(newpr, (uchar_t *)&opt);
		}
	}

	/*
	 * appropriate timers were scheduled when
	 * the token and addresses were created.
	 */
	return (TIMER_INFINITY);
}

/*
 * tlen specifies the token length in bits.  Compares the lower
 * tlen bits of the two addresses provided and returns _B_TRUE if
 * they match, _B_FALSE if not.  Also returns _B_FALSE for invalid
 * values of tlen.
 */
boolean_t
token_equal(struct in6_addr t1, struct in6_addr t2, int tlen)
{
	uchar_t mask;
	int j, abytes, tbytes, tbits;

	if (tlen < 0 || tlen > IPV6_ABITS)
		return (_B_FALSE);

	abytes = IPV6_ABITS >> 3;
	tbytes = tlen >> 3;
	tbits = tlen & 7;

	for (j = abytes - 1; j >= abytes - tbytes; j--)
		if (t1.s6_addr[j] != t2.s6_addr[j])
			return (_B_FALSE);

	if (tbits == 0)
		return (_B_TRUE);

	/* We only care about the tbits rightmost bits */
	mask = 0xff >> (8 - tbits);
	if ((t1.s6_addr[j] & mask) != (t2.s6_addr[j] & mask))
		return (_B_FALSE);

	return (_B_TRUE);
}

/*
 * Lookup prefix structure that matches the prefix and prefix length.
 * Assumes that the bits after prefixlen might not be zero.
 */
static struct prefix *
prefix_lookup(struct phyint *pi, struct in6_addr prefix, int prefixlen)
{
	struct prefix *pr;
	char abuf[INET6_ADDRSTRLEN];

	if (debug & D_PREFIX) {
		logmsg(LOG_DEBUG, "prefix_lookup(%s, %s/%u)\n", pi->pi_name,
		    inet_ntop(AF_INET6, (void *)&prefix,
		    abuf, sizeof (abuf)), prefixlen);
	}

	for (pr = pi->pi_prefix_list; pr != NULL; pr = pr->pr_next) {
		if (pr->pr_prefix_len == prefixlen &&
		    prefix_equal(prefix, pr->pr_prefix, prefixlen))
			return (pr);
	}
	return (NULL);
}

/*
 * Compare two prefixes that have the same prefix length.
 * Fails if the prefix length is unreasonable.
 */
boolean_t
prefix_equal(struct in6_addr p1, struct in6_addr p2, int plen)
{
	uchar_t mask;
	int j, pbytes, pbits;

	if (plen < 0 || plen > IPV6_ABITS)
		return (_B_FALSE);

	pbytes = plen >> 3;
	pbits = plen & 7;

	for (j = 0; j < pbytes; j++)
		if (p1.s6_addr[j] != p2.s6_addr[j])
			return (_B_FALSE);

	if (pbits == 0)
		return (_B_TRUE);

	/* Make the N leftmost bits one */
	mask = 0xff << (8 - pbits);
	if ((p1.s6_addr[j] & mask) != (p2.s6_addr[j] & mask))
		return (_B_FALSE);

	return (_B_TRUE);
}

/*
 * Set a prefix from an address and a prefix length.
 * Force all the bits after the prefix length to be zero.
 */
void
prefix_set(struct in6_addr *prefix, struct in6_addr addr, int prefix_len)
{
	uchar_t mask;
	int j;

	if (prefix_len < 0 || prefix_len > IPV6_ABITS)
		return;

	bzero((char *)prefix, sizeof (*prefix));

	for (j = 0; prefix_len > 8; prefix_len -= 8, j++)
		prefix->s6_addr[j] = addr.s6_addr[j];

	/* Make the N leftmost bits one */
	mask = 0xff << (8 - prefix_len);
	prefix->s6_addr[j] = addr.s6_addr[j] & mask;
}

/*
 * Lookup a prefix based on the kernel's interface name.
 */
struct prefix *
prefix_lookup_name(struct phyint *pi, char *name)
{
	struct prefix *pr;

	if (debug & D_PREFIX) {
		logmsg(LOG_DEBUG, "prefix_lookup_name(%s, %s)\n",
		    pi->pi_name, name);
	}
	if (name[0] == '\0')
		return (NULL);

	for (pr = pi->pi_prefix_list; pr != NULL; pr = pr->pr_next) {
		if (strcmp(name, pr->pr_name) == 0)
			return (pr);
	}
	return (NULL);
}

/*
 * Search the phyints list to make sure that this new prefix does
 * not already exist in any  other physical interfaces that have
 * the same address as this one
 */
struct prefix *
prefix_lookup_addr_match(struct prefix *pr)
{
	char abuf[INET6_ADDRSTRLEN];
	struct phyint *pi;
	struct prefix *otherpr = NULL;
	struct in6_addr prefix;
	int	prefixlen;

	if (debug & D_PREFIX) {
		logmsg(LOG_DEBUG, "prefix_lookup_addr_match(%s/%u)\n",
		    inet_ntop(AF_INET6, (void *)&pr->pr_address,
		    abuf, sizeof (abuf)), pr->pr_prefix_len);
	}
	prefix = pr->pr_prefix;
	prefixlen = pr->pr_prefix_len;
	for (pi = phyints; pi != NULL; pi = pi->pi_next) {
		otherpr = prefix_lookup(pi, prefix, prefixlen);
		if (otherpr == pr)
			continue;
		if (otherpr != NULL && (otherpr->pr_state & PR_AUTO) &&
		    IN6_ARE_ADDR_EQUAL(&pr->pr_address,
		    &otherpr->pr_address))
			return (otherpr);
	}
	return (NULL);
}

/*
 * Initialize a new prefix without setting lifetimes etc.
 */
struct prefix *
prefix_create(struct phyint *pi, struct in6_addr prefix, int prefixlen,
    uint64_t flags)
{
	struct prefix *pr;
	char abuf[INET6_ADDRSTRLEN];

	if (debug & D_PREFIX) {
		logmsg(LOG_DEBUG, "prefix_create(%s, %s/%u, 0x%llx)\n",
		    pi->pi_name, inet_ntop(AF_INET6, (void *)&prefix,
		    abuf, sizeof (abuf)), prefixlen, flags);
	}
	pr = (struct prefix *)calloc(sizeof (struct prefix), 1);
	if (pr == NULL) {
		logmsg(LOG_ERR, "prefix_create: out of memory\n");
		return (NULL);
	}
	/*
	 * The prefix might have non-zero bits after the prefix len bits.
	 * Force them to be zero.
	 */
	prefix_set(&pr->pr_prefix, prefix, prefixlen);
	pr->pr_prefix_len = prefixlen;
	pr->pr_PreferredLifetime = PREFIX_INFINITY;
	pr->pr_ValidLifetime = PREFIX_INFINITY;
	pr->pr_OnLinkLifetime = PREFIX_INFINITY;
	pr->pr_kernel_state = 0;
	pr->pr_flags |= flags;
	prefix_insert(pi, pr);
	return (pr);
}

/*
 * Create a new named prefix. Caller should use prefix_init_from_k
 * to initialize the content.
 */
struct prefix *
prefix_create_name(struct phyint *pi, char *name)
{
	struct prefix *pr;

	if (debug & D_PREFIX) {
		logmsg(LOG_DEBUG, "prefix_create_name(%s, %s)\n",
		    pi->pi_name, name);
	}
	pr = (struct prefix *)calloc(sizeof (struct prefix), 1);
	if (pr == NULL) {
		logmsg(LOG_ERR, "prefix_create_name: out of memory\n");
		return (NULL);
	}
	(void) strncpy(pr->pr_name, name, sizeof (pr->pr_name));
	pr->pr_name[sizeof (pr->pr_name) - 1] = '\0';
	prefix_insert(pi, pr);
	return (pr);
}

/* Insert in linked list */
static void
prefix_insert(struct phyint *pi, struct prefix *pr)
{
	pr->pr_next = pi->pi_prefix_list;
	pr->pr_prev = NULL;
	if (pi->pi_prefix_list != NULL)
		pi->pi_prefix_list->pr_prev = pr;
	pi->pi_prefix_list = pr;
	pr->pr_physical = pi;
}

/*
 * Initialize the prefix from the content of the kernel.
 * If IFF_ADDRCONF is set we treat it as PR_AUTO (i.e. an addrconf
 * prefix).  However, we cannot derive the lifetime from
 * the kernel, thus it is set to 1 week.
 * Ignore the prefix if the interface is not IFF_UP.
 * If it's from DHCPv6, then we set the netmask.
 */
int
prefix_init_from_k(struct prefix *pr)
{
	struct lifreq lifr;
	struct sockaddr_in6 *sin6;
	int sock = pr->pr_physical->pi_sock;

	(void) strncpy(lifr.lifr_name, pr->pr_name, sizeof (lifr.lifr_name));
	lifr.lifr_name[sizeof (lifr.lifr_name) - 1] = '\0';
	if (ioctl(sock, SIOCGLIFADDR, (char *)&lifr) < 0) {
		logperror_pr(pr, "prefix_init_from_k: ioctl (get addr)");
		goto error;
	}
	if (lifr.lifr_addr.ss_family != AF_INET6) {
		logmsg(LOG_ERR, "ignoring interface %s: not AF_INET6\n",
		    pr->pr_name);
		goto error;
	}
	sin6 = (struct sockaddr_in6 *)&lifr.lifr_addr;
	pr->pr_address = sin6->sin6_addr;

	if (ioctl(sock, SIOCGLIFFLAGS, (char *)&lifr) < 0) {
		logperror_pr(pr, "prefix_init_from_k: ioctl (get flags)");
		goto error;
	}
	pr->pr_flags = lifr.lifr_flags;

	/*
	 * If this is a DHCPv6 interface, then we control the netmask.
	 */
	if (lifr.lifr_flags & IFF_DHCPRUNNING) {
		struct phyint *pi = pr->pr_physical;
		struct prefix *pr2;

		pr->pr_prefix_len = IPV6_ABITS;
		if (!(lifr.lifr_flags & IFF_UP) ||
		    IN6_IS_ADDR_UNSPECIFIED(&pr->pr_address) ||
		    IN6_IS_ADDR_LINKLOCAL(&pr->pr_address)) {
			if (debug & D_DHCP)
				logmsg(LOG_DEBUG, "prefix_init_from_k: "
				    "ignoring DHCP %s not ready\n",
				    pr->pr_name);
			return (0);
		}

		for (pr2 = pi->pi_prefix_list; pr2 != NULL;
		    pr2 = pr2->pr_next) {
			/*
			 * Examine any non-static (autoconfigured) prefixes as
			 * well as existing DHCP-controlled prefixes for valid
			 * prefix length information.
			 */
			if (pr2->pr_prefix_len != IPV6_ABITS &&
			    (!(pr2->pr_state & PR_STATIC) ||
			    (pr2->pr_flags & IFF_DHCPRUNNING)) &&
			    prefix_equal(pr->pr_prefix, pr2->pr_prefix,
			    pr2->pr_prefix_len)) {
				pr->pr_prefix_len = pr2->pr_prefix_len;
				break;
			}
		}
		if (pr2 == NULL) {
			if (debug & D_DHCP)
				logmsg(LOG_DEBUG, "prefix_init_from_k: no "
				    "saved mask for DHCP %s; need to "
				    "resolicit\n", pr->pr_name);
			(void) check_to_solicit(pi, RESTART_INIT_SOLICIT);
		} else {
			if (debug & D_DHCP)
				logmsg(LOG_DEBUG, "prefix_init_from_k: using "
				    "%s mask for DHCP %s\n",
				    pr2->pr_name[0] == '\0' ? "saved" :
				    pr2->pr_name, pr->pr_name);
			prefix_update_dhcp(pr);
		}
		/*
		 * If this interface was created using ipadm, store the
		 * addrobj for the DHCPv6 interface in ipmgmtd daemon's
		 * in-memory aobjmap.
		 */
		prefix_update_ipadm_addrobj(pr, _B_TRUE);
	} else {
		if (ioctl(sock, SIOCGLIFSUBNET, (char *)&lifr) < 0) {
			logperror_pr(pr,
			    "prefix_init_from_k: ioctl (get subnet)");
			goto error;
		}
		if (lifr.lifr_subnet.ss_family != AF_INET6) {
			logmsg(LOG_ERR,
			    "ignoring interface %s: not AF_INET6\n",
			    pr->pr_name);
			goto error;
		}
		/*
		 * Guard against the prefix having non-zero bits after the
		 * prefix len bits.
		 */
		sin6 = (struct sockaddr_in6 *)&lifr.lifr_subnet;
		pr->pr_prefix_len = lifr.lifr_addrlen;
		prefix_set(&pr->pr_prefix, sin6->sin6_addr, pr->pr_prefix_len);

		if (pr->pr_prefix_len != IPV6_ABITS &&
		    (pr->pr_flags & IFF_UP) &&
		    IN6_ARE_ADDR_EQUAL(&pr->pr_address, &pr->pr_prefix)) {
			char abuf[INET6_ADDRSTRLEN];

			logmsg(LOG_ERR, "ignoring interface %s: it appears to "
			    "be configured with an invalid interface id "
			    "(%s/%u)\n",
			    pr->pr_name,
			    inet_ntop(AF_INET6, (void *)&pr->pr_address,
			    abuf, sizeof (abuf)), pr->pr_prefix_len);
			goto error;
		}
	}
	pr->pr_kernel_state = 0;
	if (pr->pr_prefix_len != IPV6_ABITS)
		pr->pr_kernel_state |= PR_ONLINK;
	if (!(pr->pr_flags & (IFF_NOLOCAL | IFF_DHCPRUNNING)))
		pr->pr_kernel_state |= PR_AUTO;
	if ((pr->pr_flags & IFF_DEPRECATED) && (pr->pr_kernel_state & PR_AUTO))
		pr->pr_kernel_state |= PR_DEPRECATED;
	if (!(pr->pr_flags & IFF_ADDRCONF)) {
		/* Prevent ndpd from stepping on this prefix */
		pr->pr_kernel_state |= PR_STATIC;
	}
	pr->pr_state = pr->pr_kernel_state;
	/* Adjust pr_prefix_len based if PR_AUTO is set */
	if (pr->pr_state & PR_AUTO) {
		pr->pr_prefix_len =
		    IPV6_ABITS - pr->pr_physical->pi_token_length;
		prefix_set(&pr->pr_prefix, pr->pr_prefix, pr->pr_prefix_len);
	}

	/* Can't extract lifetimes from the kernel - use 1 week */
	pr->pr_ValidLifetime = NDP_PREFIX_DEFAULT_LIFETIME;
	pr->pr_PreferredLifetime = NDP_PREFIX_DEFAULT_LIFETIME;
	pr->pr_OnLinkLifetime = NDP_PREFIX_DEFAULT_LIFETIME;

	/*
	 * If this is a temp addr, the creation time needs to be set.
	 * Though it won't be entirely accurate, the current time is
	 * an okay approximation.
	 */
	if (pr->pr_flags & IFF_TEMPORARY)
		pr->pr_CreateTime = getcurrenttime() / MILLISEC;

	if (pr->pr_kernel_state == 0)
		pr->pr_name[0] = '\0';
	return (0);

error:
	/* Pretend that the prefix does not exist in the kernel */
	pr->pr_kernel_state = 0;
	pr->pr_name[0] = '\0';
	return (-1);
}

/*
 * Delete (unlink and free) and remove from kernel if the prefix
 * was added by in.ndpd (i.e. PR_STATIC is not set).
 * Handles delete of things that have not yet been inserted in the list
 * i.e. pr_physical is NULL.
 * Removes the ipadm addrobj created for the prefix.
 */
void
prefix_delete(struct prefix *pr)
{
	struct phyint *pi;
	char abuf[INET6_ADDRSTRLEN];

	if (debug & D_PREFIX) {
		logmsg(LOG_DEBUG, "prefix_delete(%s, %s, %s/%u)\n",
		    pr->pr_physical->pi_name, pr->pr_name,
		    inet_ntop(AF_INET6, (void *)&pr->pr_prefix,
		    abuf, sizeof (abuf)), pr->pr_prefix_len);
	}
	pi = pr->pr_physical;

	/* Remove non-static prefixes from the kernel. */
	pr->pr_state &= PR_STATIC;
	if (pr->pr_kernel_state != pr->pr_state)
		prefix_update_k(pr);

	if (pr->pr_prev == NULL) {
		if (pi != NULL)
			pi->pi_prefix_list = pr->pr_next;
	} else {
		pr->pr_prev->pr_next = pr->pr_next;
	}
	if (pr->pr_next != NULL)
		pr->pr_next->pr_prev = pr->pr_prev;
	pr->pr_next = pr->pr_prev = NULL;

	free(pr);
}

/*
 * Toggle one or more IFF_ flags for a prefix. Turn on 'onflags' and
 * turn off 'offflags'.
 */
static int
prefix_modify_flags(struct prefix *pr, uint64_t onflags, uint64_t offflags)
{
	struct lifreq lifr;
	struct phyint *pi = pr->pr_physical;
	uint64_t old_flags;
	char abuf[INET6_ADDRSTRLEN];

	if (debug & D_PREFIX) {
		logmsg(LOG_DEBUG, "prefix_modify_flags(%s, %s, %s/%u) "
		    "flags %llx on %llx off %llx\n",
		    pr->pr_physical->pi_name,
		    pr->pr_name,
		    inet_ntop(AF_INET6, (void *)&pr->pr_prefix,
		    abuf, sizeof (abuf)), pr->pr_prefix_len,
		    pr->pr_flags, onflags, offflags);
	}
	/* Assumes that only the PR_STATIC link-local matches the pi_name */
	if (!(pr->pr_state & PR_STATIC) &&
	    strcmp(pr->pr_name, pi->pi_name) == 0) {
		logmsg(LOG_ERR, "prefix_modify_flags(%s, on %llx, off %llx): "
		    "name matches interface name\n",
		    pi->pi_name, onflags, offflags);
		return (-1);
	}

	(void) strncpy(lifr.lifr_name, pr->pr_name, sizeof (lifr.lifr_name));
	lifr.lifr_name[sizeof (lifr.lifr_name) - 1] = '\0';
	if (ioctl(pi->pi_sock, SIOCGLIFFLAGS, (char *)&lifr) < 0) {
		if (errno != ENXIO) {
			logperror_pr(pr, "prefix_modify_flags: SIOCGLIFFLAGS");
			logmsg(LOG_ERR, "prefix_modify_flags(%s, %s) old 0x%llx"
			    " on 0x%llx off 0x%llx\n", pr->pr_physical->pi_name,
			    pr->pr_name, pr->pr_flags, onflags, offflags);
		}
		return (-1);
	}
	old_flags = lifr.lifr_flags;
	lifr.lifr_flags |= onflags;
	lifr.lifr_flags &= ~offflags;
	pr->pr_flags = lifr.lifr_flags;
	if (ioctl(pi->pi_sock, SIOCSLIFFLAGS, (char *)&lifr) < 0) {
		if (errno != ENXIO) {
			logperror_pr(pr, "prefix_modify_flags: SIOCSLIFFLAGS");
			logmsg(LOG_ERR, "prefix_modify_flags(%s, %s) old 0x%llx"
			    " new 0x%llx on 0x%llx off 0x%llx\n",
			    pr->pr_physical->pi_name, pr->pr_name,
			    old_flags, lifr.lifr_flags, onflags, offflags);
		}
		return (-1);
	}
	return (0);
}

/*
 * Update the subnet mask for this interface under DHCPv6 control.
 */
void
prefix_update_dhcp(struct prefix *pr)
{
	struct lifreq lifr;

	(void) memset(&lifr, 0, sizeof (lifr));
	(void) strlcpy(lifr.lifr_name, pr->pr_name, sizeof (lifr.lifr_name));
	lifr.lifr_addr.ss_family = AF_INET6;
	prefix_set(&((struct sockaddr_in6 *)&lifr.lifr_addr)->sin6_addr,
	    pr->pr_address, pr->pr_prefix_len);
	lifr.lifr_addrlen = pr->pr_prefix_len;
	/*
	 * Ignore ENXIO, as the dhcpagent process is responsible for plumbing
	 * and unplumbing these.
	 */
	if (ioctl(pr->pr_physical->pi_sock, SIOCSLIFSUBNET, (char *)&lifr) ==
	    -1 && errno != ENXIO)
		logperror_pr(pr, "prefix_update_dhcp: ioctl (set subnet)");
}

/*
 * Make the kernel state match what is in the prefix structure.
 * This includes creating the prefix (allocating a new interface name)
 * as well as setting the local address and on-link subnet prefix
 * and controlling the IFF_ADDRCONF and IFF_DEPRECATED flags.
 */
void
prefix_update_k(struct prefix *pr)
{
	struct lifreq lifr;
	char abuf[INET6_ADDRSTRLEN];
	char buf1[PREFIX_STATESTRLEN], buf2[PREFIX_STATESTRLEN];
	struct phyint *pi = pr->pr_physical;
	struct sockaddr_in6 *sin6;

	if (debug & D_PREFIX) {
		logmsg(LOG_DEBUG, "prefix_update_k(%s, %s, %s/%u) "
		    "from %s to %s\n", pr->pr_physical->pi_name, pr->pr_name,
		    inet_ntop(AF_INET6, (void *)&pr->pr_prefix,
		    abuf, sizeof (abuf)), pr->pr_prefix_len,
		    prefix_print_state(pr->pr_kernel_state, buf1,
		    sizeof (buf1)),
		    prefix_print_state(pr->pr_state, buf2, sizeof (buf2)));
	}

	if (pr->pr_kernel_state == pr->pr_state)
		return;		/* No changes */

	/* Skip static prefixes */
	if (pr->pr_state & PR_STATIC)
		return;

	if (pr->pr_kernel_state == 0) {
		uint64_t onflags;
		/*
		 * Create a new logical interface name and store in pr_name.
		 * Set IFF_ADDRCONF. Do not set an address (yet).
		 */
		if (pr->pr_name[0] != '\0') {
			/* Name already set! */
			logmsg(LOG_ERR, "prefix_update_k(%s, %s, %s/%u) "
			    "from %s to %s name is already allocated\n",
			    pr->pr_physical->pi_name, pr->pr_name,
			    inet_ntop(AF_INET6, (void *)&pr->pr_prefix,
			    abuf, sizeof (abuf)), pr->pr_prefix_len,
			    prefix_print_state(pr->pr_kernel_state, buf1,
			    sizeof (buf1)),
			    prefix_print_state(pr->pr_state, buf2,
			    sizeof (buf2)));
			return;
		}

		(void) strncpy(lifr.lifr_name, pi->pi_name,
		    sizeof (lifr.lifr_name));
		lifr.lifr_name[sizeof (lifr.lifr_name) - 1] = '\0';
		lifr.lifr_addr.ss_family = AF_UNSPEC;
		if (ioctl(pi->pi_sock, SIOCLIFADDIF, (char *)&lifr) < 0) {
			logperror_pr(pr, "prefix_update_k: SIOCLIFADDIF");
			return;
		}
		(void) strncpy(pr->pr_name, lifr.lifr_name,
		    sizeof (pr->pr_name));
		pr->pr_name[sizeof (pr->pr_name) - 1] = '\0';
		if (debug & D_PREFIX) {
			logmsg(LOG_DEBUG, "prefix_update_k: new name %s\n",
			    pr->pr_name);
		}
		/*
		 * The IFF_TEMPORARY flag might have already been set; if
		 * so, it needs to be or'd into the flags we're turning on.
		 * But be careful, we might be re-creating a manually
		 * removed interface, in which case we don't want to try
		 * to set *all* the flags we might have in our copy of the
		 * flags yet.
		 */
		onflags = IFF_ADDRCONF;
		if (pr->pr_flags & IFF_TEMPORARY)
			onflags |= IFF_TEMPORARY;
		if (prefix_modify_flags(pr, onflags, 0) == -1)
			return;
	}
	if ((pr->pr_state & (PR_ONLINK|PR_AUTO)) == 0) {
		/* Remove the interface */
		if (prefix_modify_flags(pr, 0, IFF_UP|IFF_DEPRECATED) == -1)
			return;
		(void) strncpy(lifr.lifr_name, pr->pr_name,
		    sizeof (lifr.lifr_name));
		lifr.lifr_name[sizeof (lifr.lifr_name) - 1] = '\0';

		if (debug & D_PREFIX) {
			logmsg(LOG_DEBUG, "prefix_update_k: remove name %s\n",
			    pr->pr_name);
		}

		/*
		 * Assumes that only the PR_STATIC link-local matches
		 * the pi_name
		 */
		if (!(pr->pr_state & PR_STATIC) &&
		    strcmp(pr->pr_name, pi->pi_name) == 0) {
			logmsg(LOG_ERR, "prefix_update_k(%s): "
			    "name matches if\n", pi->pi_name);
			return;
		}

		/* Remove logical interface based on pr_name */
		lifr.lifr_addr.ss_family = AF_UNSPEC;
		if (ioctl(pi->pi_sock, SIOCLIFREMOVEIF, (char *)&lifr) < 0 &&
		    errno != ENXIO) {
			logperror_pr(pr, "prefix_update_k: SIOCLIFREMOVEIF");
		}
		pr->pr_kernel_state = 0;
		pr->pr_name[0] = '\0';
		return;
	}
	if ((pr->pr_state & PR_AUTO) && !(pr->pr_kernel_state & PR_AUTO)) {
		/*
		 * Set local address and set the prefix length to 128.
		 * Turn off IFF_NOLOCAL in case it was set.
		 * Turn on IFF_UP.
		 */
		(void) strncpy(lifr.lifr_name, pr->pr_name,
		    sizeof (lifr.lifr_name));
		lifr.lifr_name[sizeof (lifr.lifr_name) - 1] = '\0';
		sin6 = (struct sockaddr_in6 *)&lifr.lifr_addr;
		bzero(sin6, sizeof (struct sockaddr_in6));
		sin6->sin6_family = AF_INET6;
		sin6->sin6_addr = pr->pr_address;
		if (debug & D_PREFIX) {
			logmsg(LOG_DEBUG, "prefix_update_k(%s) set addr %s "
			    "for PR_AUTO on\n",
			    pr->pr_name,
			    inet_ntop(AF_INET6, (void *)&pr->pr_address,
			    abuf, sizeof (abuf)));
		}
		if (ioctl(pi->pi_sock, SIOCSLIFADDR, (char *)&lifr) < 0) {
			logperror_pr(pr, "prefix_update_k: SIOCSLIFADDR");
			return;
		}
		/*
		 * If this interface was created using ipadm, store the
		 * addrobj for the prefix in ipmgmtd daemon's aobjmap.
		 */
		prefix_update_ipadm_addrobj(pr, _B_TRUE);
		if (pr->pr_state & PR_ONLINK) {
			sin6->sin6_addr = pr->pr_prefix;
			lifr.lifr_addrlen = pr->pr_prefix_len;
		} else {
			sin6->sin6_addr = pr->pr_address;
			lifr.lifr_addrlen = IPV6_ABITS;
		}
		if (debug & D_PREFIX) {
			logmsg(LOG_DEBUG, "prefix_update_k(%s) set subnet "
			    "%s/%u for PR_AUTO on\n", pr->pr_name,
			    inet_ntop(AF_INET6, (void *)&sin6->sin6_addr,
			    abuf, sizeof (abuf)), lifr.lifr_addrlen);
		}
		if (ioctl(pi->pi_sock, SIOCSLIFSUBNET, (char *)&lifr) < 0) {
			logperror_pr(pr, "prefix_update_k: SIOCSLIFSUBNET");
			return;
		}
		/*
		 * For ptp interfaces, create a destination based on
		 * prefix and prefix len together with the remote token
		 * extracted from the remote pt-pt address.  This is used by
		 * ip to choose a proper source for outgoing packets.
		 */
		if (pi->pi_flags & IFF_POINTOPOINT) {
			int i;

			sin6 = (struct sockaddr_in6 *)&lifr.lifr_addr;
			bzero(sin6, sizeof (struct sockaddr_in6));
			sin6->sin6_family = AF_INET6;
			sin6->sin6_addr = pr->pr_prefix;
			for (i = 0; i < 16; i++) {
				sin6->sin6_addr.s6_addr[i] |=
				    pi->pi_dst_token.s6_addr[i];
			}
			if (debug & D_PREFIX) {
				logmsg(LOG_DEBUG, "prefix_update_k(%s) "
				    "set dstaddr %s for PR_AUTO on\n",
				    pr->pr_name, inet_ntop(AF_INET6,
				    (void *)&sin6->sin6_addr,
				    abuf, sizeof (abuf)));
			}
			if (ioctl(pi->pi_sock, SIOCSLIFDSTADDR,
			    (char *)&lifr) < 0) {
				logperror_pr(pr,
				    "prefix_update_k: SIOCSLIFDSTADDR");
				return;
			}
		}
		if (prefix_modify_flags(pr, IFF_UP, IFF_NOLOCAL) == -1)
			return;
		pr->pr_kernel_state |= PR_AUTO;
		if (pr->pr_state & PR_ONLINK)
			pr->pr_kernel_state |= PR_ONLINK;
		else
			pr->pr_kernel_state &= ~PR_ONLINK;
	}
	if (!(pr->pr_state & PR_AUTO) && (pr->pr_kernel_state & PR_AUTO)) {
		/* Turn on IFF_NOLOCAL and set the local address to all zero */
		if (prefix_modify_flags(pr, IFF_NOLOCAL, 0) == -1)
			return;
		(void) strncpy(lifr.lifr_name, pr->pr_name,
		    sizeof (lifr.lifr_name));
		lifr.lifr_name[sizeof (lifr.lifr_name) - 1] = '\0';
		sin6 = (struct sockaddr_in6 *)&lifr.lifr_addr;
		bzero(sin6, sizeof (struct sockaddr_in6));
		sin6->sin6_family = AF_INET6;
		if (debug & D_PREFIX) {
			logmsg(LOG_DEBUG, "prefix_update_k(%s) set addr %s "
			    "for PR_AUTO off\n", pr->pr_name,
			    inet_ntop(AF_INET6, (void *)&sin6->sin6_addr,
			    abuf, sizeof (abuf)));
		}
		if (ioctl(pi->pi_sock, SIOCSLIFADDR, (char *)&lifr) < 0) {
			logperror_pr(pr, "prefix_update_k: SIOCSLIFADDR");
			return;
		}
		pr->pr_kernel_state &= ~PR_AUTO;
	}
	if ((pr->pr_state & PR_DEPRECATED) &&
	    !(pr->pr_kernel_state & PR_DEPRECATED) &&
	    (pr->pr_kernel_state & PR_AUTO)) {
		/* Only applies if PR_AUTO */
		if (prefix_modify_flags(pr, IFF_DEPRECATED, 0) == -1)
			return;
		pr->pr_kernel_state |= PR_DEPRECATED;
	}
	if (!(pr->pr_state & PR_DEPRECATED) &&
	    (pr->pr_kernel_state & PR_DEPRECATED)) {
		if (prefix_modify_flags(pr, 0, IFF_DEPRECATED) == -1)
			return;
		pr->pr_kernel_state &= ~PR_DEPRECATED;
	}
	if ((pr->pr_state & PR_ONLINK) && !(pr->pr_kernel_state & PR_ONLINK)) {
		/* Set the subnet and set IFF_UP */
		(void) strncpy(lifr.lifr_name, pr->pr_name,
		    sizeof (lifr.lifr_name));
		lifr.lifr_name[sizeof (lifr.lifr_name) - 1] = '\0';
		sin6 = (struct sockaddr_in6 *)&lifr.lifr_addr;
		bzero(sin6, sizeof (struct sockaddr_in6));
		sin6->sin6_family = AF_INET6;
		sin6->sin6_addr = pr->pr_prefix;
		lifr.lifr_addrlen = pr->pr_prefix_len;
		if (debug & D_PREFIX) {
			logmsg(LOG_DEBUG, "prefix_update_k(%s) set subnet "
			    "%s/%d for PR_ONLINK on\n", pr->pr_name,
			    inet_ntop(AF_INET6, (void *)&sin6->sin6_addr,
			    abuf, sizeof (abuf)), lifr.lifr_addrlen);
		}
		if (ioctl(pi->pi_sock, SIOCSLIFSUBNET, (char *)&lifr) < 0) {
			logperror_pr(pr, "prefix_update_k: SIOCSLIFSUBNET");
			return;
		}
		/*
		 * If we've previously marked the interface "up" while
		 * processing the PR_AUTO flag -- via incoming_prefix_addrconf
		 * -- then there's no need to set it "up" again.  We're done;
		 * just set PR_ONLINK to indicate that we've set the subnet.
		 */
		if (!(pr->pr_state & PR_AUTO) &&
		    prefix_modify_flags(pr, IFF_UP | IFF_NOLOCAL, 0) == -1)
			return;
		pr->pr_kernel_state |= PR_ONLINK;
	}
	if (!(pr->pr_state & PR_ONLINK) && (pr->pr_kernel_state & PR_ONLINK)) {
		/* Set the prefixlen to 128 */
		(void) strncpy(lifr.lifr_name, pr->pr_name,
		    sizeof (lifr.lifr_name));
		lifr.lifr_name[sizeof (lifr.lifr_name) - 1] = '\0';
		sin6 = (struct sockaddr_in6 *)&lifr.lifr_addr;
		bzero(sin6, sizeof (struct sockaddr_in6));
		sin6->sin6_family = AF_INET6;
		sin6->sin6_addr = pr->pr_address;
		lifr.lifr_addrlen = IPV6_ABITS;
		if (debug & D_PREFIX) {
			logmsg(LOG_DEBUG, "prefix_update_k(%s) set subnet "
			    "%s/%d for PR_ONLINK off\n", pr->pr_name,
			    inet_ntop(AF_INET6, (void *)&sin6->sin6_addr,
			    abuf, sizeof (abuf)), lifr.lifr_addrlen);
		}
		if (ioctl(pi->pi_sock, SIOCSLIFSUBNET, (char *)&lifr) < 0) {
			logperror_pr(pr, "prefix_update_k: SIOCSLIFSUBNET");
			return;
		}
		pr->pr_kernel_state &= ~PR_ONLINK;
	}
}

/*
 * Called with the number of millseconds elapsed since the last call.
 * Determines if any timeout event has occurred and
 * returns the number of milliseconds until the next timeout event.
 * Returns TIMER_INFINITY for "never".
 */
uint_t
prefix_timer(struct prefix *pr, uint_t elapsed)
{
	uint_t next = TIMER_INFINITY;
	char abuf[INET6_ADDRSTRLEN];

	if (debug & (D_PREFIX|D_TMP)) {
		logmsg(LOG_DEBUG, "prefix_timer(%s, %s/%u, %d) "
		    "valid %d pref %d onlink %d\n",
		    pr->pr_name,
		    inet_ntop(AF_INET6, (void *)&pr->pr_prefix,
		    abuf, sizeof (abuf)), pr->pr_prefix_len,
		    elapsed, pr->pr_ValidLifetime, pr->pr_PreferredLifetime,
		    pr->pr_OnLinkLifetime);
	}

	/* Exclude static prefixes */
	if (pr->pr_state & PR_STATIC)
		return (next);

	if (pr->pr_AutonomousFlag &&
	    (pr->pr_PreferredLifetime != PREFIX_INFINITY)) {
		if (pr->pr_PreferredLifetime <= elapsed) {
			pr->pr_PreferredLifetime = 0;
		} else {
			pr->pr_PreferredLifetime -= elapsed;
			if (pr->pr_PreferredLifetime < next)
				next = pr->pr_PreferredLifetime;
		}
	}
	if (pr->pr_AutonomousFlag &&
	    (pr->pr_ValidLifetime != PREFIX_INFINITY)) {
		if (pr->pr_ValidLifetime <= elapsed) {
			pr->pr_ValidLifetime = 0;
		} else {
			pr->pr_ValidLifetime -= elapsed;
			if (pr->pr_ValidLifetime < next)
				next = pr->pr_ValidLifetime;
		}
	}
	if (pr->pr_OnLinkFlag &&
	    (pr->pr_OnLinkLifetime != PREFIX_INFINITY)) {
		if (pr->pr_OnLinkLifetime <= elapsed) {
			pr->pr_OnLinkLifetime = 0;
		} else {
			pr->pr_OnLinkLifetime -= elapsed;
			if (pr->pr_OnLinkLifetime < next)
				next = pr->pr_OnLinkLifetime;
		}
	}
	if (pr->pr_AutonomousFlag && pr->pr_ValidLifetime == 0)
		pr->pr_state &= ~(PR_AUTO|PR_DEPRECATED);
	if (pr->pr_AutonomousFlag && pr->pr_PreferredLifetime == 0 &&
	    (pr->pr_state & PR_AUTO)) {
		pr->pr_state |= PR_DEPRECATED;
		if (debug & D_TMP)
			logmsg(LOG_WARNING, "prefix_timer: deprecated "
			    "prefix(%s)\n", pr->pr_name);
	}
	if (pr->pr_OnLinkFlag && pr->pr_OnLinkLifetime == 0)
		pr->pr_state &= ~PR_ONLINK;

	if (pr->pr_state != pr->pr_kernel_state) {
		/* Might cause prefix to be deleted! */

		/* Log a message when an addrconf prefix goes away */
		if ((pr->pr_kernel_state & PR_AUTO) &&
		    !(pr->pr_state & PR_AUTO)) {
			char abuf[INET6_ADDRSTRLEN];

			logmsg(LOG_WARNING,
			    "Address removed due to timeout %s\n",
			    inet_ntop(AF_INET6, (void *)&pr->pr_address,
			    abuf, sizeof (abuf)));
		}
		prefix_update_k(pr);
	}

	return (next);
}

static char *
prefix_print_state(int state, char *buf, int buflen)
{
	char *cp;
	int cplen = buflen;

	cp = buf;
	cp[0] = '\0';

	if (state & PR_ONLINK) {
		if (strlcat(cp, "ONLINK ", cplen) >= cplen)
			return (buf);
		cp += strlen(cp);
		cplen = buflen - (cp - buf);
	}
	if (state & PR_AUTO) {
		if (strlcat(cp, "AUTO ", cplen) >= cplen)
			return (buf);
		cp += strlen(cp);
		cplen = buflen - (cp - buf);
	}
	if (state & PR_DEPRECATED) {
		if (strlcat(cp, "DEPRECATED ", cplen) >= cplen)
			return (buf);
		cp += strlen(cp);
		cplen = buflen - (cp - buf);
	}
	if (state & PR_STATIC) {
		if (strlcat(cp, "STATIC ", cplen) >= cplen)
			return (buf);
		cp += strlen(cp);
		cplen = buflen - (cp - buf);
	}
	return (buf);
}

static void
prefix_print(struct prefix *pr)
{
	char abuf[INET6_ADDRSTRLEN];
	char buf1[PREFIX_STATESTRLEN], buf2[PREFIX_STATESTRLEN];

	logmsg(LOG_DEBUG, "Prefix name: %s prefix %s/%u state %s "
	    "kernel_state %s\n", pr->pr_name,
	    inet_ntop(AF_INET6, (void *)&pr->pr_prefix, abuf, sizeof (abuf)),
	    pr->pr_prefix_len,
	    prefix_print_state(pr->pr_state, buf2, sizeof (buf2)),
	    prefix_print_state(pr->pr_kernel_state, buf1, sizeof (buf1)));
	logmsg(LOG_DEBUG, "\tAddress: %s flags %llx in_use %d\n",
	    inet_ntop(AF_INET6, (void *)&pr->pr_address, abuf, sizeof (abuf)),
	    pr->pr_flags, pr->pr_in_use);
	logmsg(LOG_DEBUG, "\tValidLifetime %u PreferredLifetime %u "
	    "OnLinkLifetime %u\n", pr->pr_ValidLifetime,
	    pr->pr_PreferredLifetime, pr->pr_OnLinkLifetime);
	logmsg(LOG_DEBUG, "\tOnLink %d Auto %d\n",
	    pr->pr_OnLinkFlag, pr->pr_AutonomousFlag);
	logmsg(LOG_DEBUG, "\n");
}

/*
 * Lookup advertisement prefix structure that matches the prefix and
 * prefix length.
 * Assumes that the bits after prefixlen might not be zero.
 */
struct adv_prefix *
adv_prefix_lookup(struct phyint *pi, struct in6_addr prefix, int prefixlen)
{
	struct adv_prefix *adv_pr;
	char abuf[INET6_ADDRSTRLEN];

	if (debug & D_PREFIX) {
		logmsg(LOG_DEBUG, "adv_prefix_lookup(%s, %s/%u)\n",
		    pi->pi_name, inet_ntop(AF_INET6, (void *)&prefix,
		    abuf, sizeof (abuf)), prefixlen);
	}

	for (adv_pr = pi->pi_adv_prefix_list; adv_pr != NULL;
	    adv_pr = adv_pr->adv_pr_next) {
		if (adv_pr->adv_pr_prefix_len == prefixlen &&
		    prefix_equal(prefix, adv_pr->adv_pr_prefix, prefixlen))
			return (adv_pr);
	}
	return (NULL);
}

/*
 * Initialize a new advertisement prefix.
 */
struct adv_prefix *
adv_prefix_create(struct phyint *pi, struct in6_addr prefix, int prefixlen)
{
	struct adv_prefix *adv_pr;
	char abuf[INET6_ADDRSTRLEN];

	if (debug & D_PREFIX) {
		logmsg(LOG_DEBUG, "adv_prefix_create(%s, %s/%u)\n",
		    pi->pi_name, inet_ntop(AF_INET6, (void *)&prefix,
		    abuf, sizeof (abuf)), prefixlen);
	}
	adv_pr = (struct adv_prefix *)calloc(sizeof (struct adv_prefix), 1);
	if (adv_pr == NULL) {
		logmsg(LOG_ERR, "adv_prefix_create: calloc\n");
		return (NULL);
	}
	/*
	 * The prefix might have non-zero bits after the prefix len bits.
	 * Force them to be zero.
	 */
	prefix_set(&adv_pr->adv_pr_prefix, prefix, prefixlen);
	adv_pr->adv_pr_prefix_len = prefixlen;
	adv_prefix_insert(pi, adv_pr);
	return (adv_pr);
}

/* Insert in linked list */
static void
adv_prefix_insert(struct phyint *pi, struct adv_prefix *adv_pr)
{
	adv_pr->adv_pr_next = pi->pi_adv_prefix_list;
	adv_pr->adv_pr_prev = NULL;
	if (pi->pi_adv_prefix_list != NULL)
		pi->pi_adv_prefix_list->adv_pr_prev = adv_pr;
	pi->pi_adv_prefix_list = adv_pr;
	adv_pr->adv_pr_physical = pi;
}

/*
 * Delete (unlink and free) from our tables. There should be
 * a corresponding "struct prefix *" which will clean up the kernel
 * if necessary. adv_prefix is just used for sending out advertisements.
 */
static void
adv_prefix_delete(struct adv_prefix *adv_pr)
{
	struct phyint *pi;
	char abuf[INET6_ADDRSTRLEN];

	if (debug & D_PREFIX) {
		logmsg(LOG_DEBUG, "adv_prefix_delete(%s, %s/%u)\n",
		    adv_pr->adv_pr_physical->pi_name,
		    inet_ntop(AF_INET6, (void *)&adv_pr->adv_pr_prefix,
		    abuf, sizeof (abuf)), adv_pr->adv_pr_prefix_len);
	}
	pi = adv_pr->adv_pr_physical;

	if (adv_pr->adv_pr_prev == NULL) {
		if (pi != NULL)
			pi->pi_adv_prefix_list = adv_pr->adv_pr_next;
	} else {
		adv_pr->adv_pr_prev->adv_pr_next = adv_pr->adv_pr_next;
	}
	if (adv_pr->adv_pr_next != NULL)
		adv_pr->adv_pr_next->adv_pr_prev = adv_pr->adv_pr_prev;
	adv_pr->adv_pr_next = adv_pr->adv_pr_prev = NULL;
	free(adv_pr);
}

/*
 * Called with the number of millseconds elapsed since the last call.
 * Determines if any timeout event has occurred and
 * returns the number of milliseconds until the next timeout event.
 * Returns TIMER_INFINITY for "never".
 */
uint_t
adv_prefix_timer(struct adv_prefix *adv_pr, uint_t elapsed)
{
	int seconds_elapsed = (elapsed + 500) / 1000;	/* Rounded */
	char abuf[INET6_ADDRSTRLEN];

	if (debug & D_PREFIX) {
		logmsg(LOG_DEBUG, "adv_prefix_timer(%s, %s/%u, %d)\n",
		    adv_pr->adv_pr_physical->pi_name,
		    inet_ntop(AF_INET6, (void *)&adv_pr->adv_pr_prefix,
		    abuf, sizeof (abuf)), adv_pr->adv_pr_prefix_len,
		    elapsed);
	}

	/* Decrement Expire time left for real-time lifetimes */
	if (adv_pr->adv_pr_AdvValidRealTime) {
		if (adv_pr->adv_pr_AdvValidExpiration > seconds_elapsed)
			adv_pr->adv_pr_AdvValidExpiration -= seconds_elapsed;
		else
			adv_pr->adv_pr_AdvValidExpiration = 0;
	}
	if (adv_pr->adv_pr_AdvPreferredRealTime) {
		if (adv_pr->adv_pr_AdvPreferredExpiration > seconds_elapsed) {
			adv_pr->adv_pr_AdvPreferredExpiration -=
			    seconds_elapsed;
		} else {
			adv_pr->adv_pr_AdvPreferredExpiration = 0;
		}
	}
	return (TIMER_INFINITY);
}

static void
adv_prefix_print(struct adv_prefix *adv_pr)
{
	print_prefixlist(adv_pr->adv_pr_config);
}

/* Lookup router on its link-local IPv6 address */
struct router *
router_lookup(struct phyint *pi, struct in6_addr addr)
{
	struct router *dr;
	char abuf[INET6_ADDRSTRLEN];

	if (debug & D_ROUTER) {
		logmsg(LOG_DEBUG, "router_lookup(%s, %s)\n", pi->pi_name,
		    inet_ntop(AF_INET6, (void *)&addr,
		    abuf, sizeof (abuf)));
	}

	for (dr = pi->pi_router_list; dr != NULL; dr = dr->dr_next) {
		if (bcmp((char *)&addr, (char *)&dr->dr_address,
		    sizeof (addr)) == 0)
			return (dr);
	}
	return (NULL);
}

/*
 * Create a default router entry.
 * The lifetime parameter is in seconds.
 */
struct router *
router_create(struct phyint *pi, struct in6_addr addr, uint_t lifetime)
{
	struct router *dr;
	char abuf[INET6_ADDRSTRLEN];

	if (debug & D_ROUTER) {
		logmsg(LOG_DEBUG, "router_create(%s, %s, %u)\n", pi->pi_name,
		    inet_ntop(AF_INET6, (void *)&addr,
		    abuf, sizeof (abuf)), lifetime);
	}

	dr = (struct router *)calloc(sizeof (struct router), 1);
	if (dr == NULL) {
		logmsg(LOG_ERR, "router_create: out of memory\n");
		return (NULL);
	}
	dr->dr_address = addr;
	dr->dr_lifetime = lifetime;
	router_insert(pi, dr);
	if (dr->dr_lifetime != 0)
		router_add_k(dr);
	return (dr);
}

/* Insert in linked list */
static void
router_insert(struct phyint *pi, struct router *dr)
{
	dr->dr_next = pi->pi_router_list;
	dr->dr_prev = NULL;
	if (pi->pi_router_list != NULL)
		pi->pi_router_list->dr_prev = dr;
	pi->pi_router_list = dr;
	dr->dr_physical = pi;
}

/*
 * Delete (unlink and free).
 * Handles delete of things that have not yet been inserted in the list
 * i.e. dr_physical is NULL.
 */
static void
router_delete(struct router *dr)
{
	struct phyint *pi;
	char abuf[INET6_ADDRSTRLEN];

	if (debug & D_ROUTER) {
		logmsg(LOG_DEBUG, "router_delete(%s, %s, %u)\n",
		    dr->dr_physical->pi_name,
		    inet_ntop(AF_INET6, (void *)&dr->dr_address,
		    abuf, sizeof (abuf)), dr->dr_lifetime);
	}
	pi = dr->dr_physical;
	if (dr->dr_inkernel && (pi->pi_kernel_state & PI_PRESENT))
		router_delete_k(dr);

	if (dr->dr_prev == NULL) {
		if (pi != NULL)
			pi->pi_router_list = dr->dr_next;
	} else {
		dr->dr_prev->dr_next = dr->dr_next;
	}
	if (dr->dr_next != NULL)
		dr->dr_next->dr_prev = dr->dr_prev;
	dr->dr_next = dr->dr_prev = NULL;
	free(dr);
}

/*
 * Update the kernel to match dr_lifetime
 */
void
router_update_k(struct router *dr)
{
	char abuf[INET6_ADDRSTRLEN];

	if (debug & D_ROUTER) {
		logmsg(LOG_DEBUG, "router_update_k(%s, %s, %u)\n",
		    dr->dr_physical->pi_name,
		    inet_ntop(AF_INET6, (void *)&dr->dr_address,
		    abuf, sizeof (abuf)), dr->dr_lifetime);
	}

	if (dr->dr_lifetime == 0 && dr->dr_inkernel) {
		/* Log a message when last router goes away */
		if (dr->dr_physical->pi_num_k_routers == 1) {
			logmsg(LOG_WARNING,
			    "Last default router (%s) removed on %s\n",
			    inet_ntop(AF_INET6, (void *)&dr->dr_address,
			    abuf, sizeof (abuf)), dr->dr_physical->pi_name);
		}
		router_delete(dr);
	} else if (dr->dr_lifetime != 0 && !dr->dr_inkernel)
		router_add_k(dr);
}

/*
 * Called with the number of millseconds elapsed since the last call.
 * Determines if any timeout event has occurred and
 * returns the number of milliseconds until the next timeout event.
 * Returns TIMER_INFINITY for "never".
 */
uint_t
router_timer(struct router *dr, uint_t elapsed)
{
	uint_t next = TIMER_INFINITY;
	char abuf[INET6_ADDRSTRLEN];

	if (debug & D_ROUTER) {
		logmsg(LOG_DEBUG, "router_timer(%s, %s, %u, %d)\n",
		    dr->dr_physical->pi_name,
		    inet_ntop(AF_INET6, (void *)&dr->dr_address,
		    abuf, sizeof (abuf)), dr->dr_lifetime, elapsed);
	}
	if (dr->dr_lifetime <= elapsed) {
		dr->dr_lifetime = 0;
	} else {
		dr->dr_lifetime -= elapsed;
		if (dr->dr_lifetime < next)
			next = dr->dr_lifetime;
	}

	if (dr->dr_lifetime == 0) {
		/* Log a message when last router goes away */
		if (dr->dr_physical->pi_num_k_routers == 1) {
			logmsg(LOG_WARNING,
			    "Last default router (%s) timed out on %s\n",
			    inet_ntop(AF_INET6, (void *)&dr->dr_address,
			    abuf, sizeof (abuf)), dr->dr_physical->pi_name);
		}
		router_delete(dr);
	}
	return (next);
}

/*
 * Add a default route to the kernel (unless the lifetime is zero)
 * Handles onlink default routes.
 */
static void
router_add_k(struct router *dr)
{
	struct phyint *pi = dr->dr_physical;
	char abuf[INET6_ADDRSTRLEN];
	int rlen;

	if (debug & D_ROUTER) {
		logmsg(LOG_DEBUG, "router_add_k(%s, %s, %u)\n",
		    dr->dr_physical->pi_name,
		    inet_ntop(AF_INET6, (void *)&dr->dr_address,
		    abuf, sizeof (abuf)), dr->dr_lifetime);
	}

	rta_gateway->sin6_addr = dr->dr_address;

	rta_ifp->sdl_index = if_nametoindex(pi->pi_name);
	if (rta_ifp->sdl_index == 0) {
		logperror_pi(pi, "router_add_k: if_nametoindex");
		return;
	}

	rt_msg->rtm_flags = RTF_GATEWAY;
	rt_msg->rtm_type = RTM_ADD;
	rt_msg->rtm_seq = ++rtmseq;
	rlen = write(rtsock, rt_msg, rt_msg->rtm_msglen);
	if (rlen < 0) {
		if (errno != EEXIST) {
			logperror_pi(pi, "router_add_k: RTM_ADD");
			return;
		}
	} else if (rlen < rt_msg->rtm_msglen) {
		logmsg(LOG_ERR, "router_add_k: write to routing socket got "
		    "only %d for rlen (interface %s)\n", rlen, pi->pi_name);
		return;
	}
	dr->dr_inkernel = _B_TRUE;
	pi->pi_num_k_routers++;
}

/*
 * Delete a route from the kernel.
 * Handles onlink default routes.
 */
static void
router_delete_k(struct router *dr)
{
	struct phyint *pi = dr->dr_physical;
	char abuf[INET6_ADDRSTRLEN];
	int rlen;

	if (debug & D_ROUTER) {
		logmsg(LOG_DEBUG, "router_delete_k(%s, %s, %u)\n",
		    dr->dr_physical->pi_name,
		    inet_ntop(AF_INET6, (void *)&dr->dr_address,
		    abuf, sizeof (abuf)), dr->dr_lifetime);
	}

	rta_gateway->sin6_addr = dr->dr_address;

	rta_ifp->sdl_index = if_nametoindex(pi->pi_name);
	if (rta_ifp->sdl_index == 0) {
		logperror_pi(pi, "router_delete_k: if_nametoindex");
		return;
	}

	rt_msg->rtm_flags = RTF_GATEWAY;
	rt_msg->rtm_type = RTM_DELETE;
	rt_msg->rtm_seq = ++rtmseq;
	rlen = write(rtsock, rt_msg, rt_msg->rtm_msglen);
	if (rlen < 0) {
		if (errno != ESRCH) {
			logperror_pi(pi, "router_delete_k: RTM_DELETE");
		}
	} else if (rlen < rt_msg->rtm_msglen) {
		logmsg(LOG_ERR, "router_delete_k: write to routing socket got "
		    "only %d for rlen (interface %s)\n", rlen, pi->pi_name);
	}
	dr->dr_inkernel = _B_FALSE;
	pi->pi_num_k_routers--;
}

static void
router_print(struct router *dr)
{
	char abuf[INET6_ADDRSTRLEN];

	logmsg(LOG_DEBUG, "Router %s on %s inkernel %d lifetime %u\n",
	    inet_ntop(AF_INET6, (void *)&dr->dr_address, abuf, sizeof (abuf)),
	    dr->dr_physical->pi_name, dr->dr_inkernel, dr->dr_lifetime);
}

void
phyint_print_all(void)
{
	struct phyint *pi;

	for (pi = phyints; pi != NULL; pi = pi->pi_next) {
		phyint_print(pi);
	}
}

void
phyint_cleanup(struct phyint *pi)
{
	pi->pi_state = 0;
	pi->pi_kernel_state = 0;

	if (pi->pi_AdvSendAdvertisements) {
		check_to_advertise(pi, ADV_OFF);
	} else {
		check_to_solicit(pi, SOLICIT_OFF);
	}

	while (pi->pi_router_list)
		router_delete(pi->pi_router_list);
	(void) poll_remove(pi->pi_sock);
	(void) close(pi->pi_sock);
	pi->pi_sock = -1;
	pi->pi_stateless = pi->pi_StatelessAddrConf;
	pi->pi_stateful = pi->pi_StatefulAddrConf;
	pi->pi_ipadm_aobjname[0] = '\0';
}

/*
 * Sets/removes the ipadm address object name for the given prefix.
 */
void
prefix_update_ipadm_addrobj(struct prefix *pr, boolean_t add)
{
	struct phyint *pi = pr->pr_physical;
	int lnum = 0;
	char *cp;
	ipadm_handle_t iph;
	ipadm_status_t status;

	/*
	 * If ipadm was used to autoconfigure this interface,
	 * pi_ipadm_aobjname will contain the address object name
	 * that is used to identify the addresses. Use the same
	 * address object name for this prefix.
	 */
	if (pi->pi_ipadm_aobjname[0] == '\0' ||
	    pr->pr_name[0] == '\0' || IN6_IS_ADDR_LINKLOCAL(&pr->pr_address) ||
	    (!(pr->pr_flags & IFF_ADDRCONF) &&
	    !(pr->pr_flags & IFF_DHCPRUNNING))) {
		return;
	}
	if ((status = ipadm_open(&iph, 0)) != IPADM_SUCCESS) {
		logmsg(LOG_ERR, "Could not open handle to libipadm: %s\n",
		    ipadm_status2str(status));
		return;
	}
	cp = strrchr(pr->pr_name, ':');
	if (cp != NULL)
		lnum = atoi(++cp);
	if (add) {
		status = ipadm_add_aobjname(iph, pi->pi_name, AF_INET6,
		    pi->pi_ipadm_aobjname, IPADM_ADDR_IPV6_ADDRCONF, lnum);
	} else {
		status = ipadm_delete_aobjname(iph, pi->pi_name, AF_INET6,
		    pi->pi_ipadm_aobjname, IPADM_ADDR_IPV6_ADDRCONF, lnum);
	}
	/* Ignore the error if the ipmgmtd daemon is not running */
	if (status != IPADM_SUCCESS && status != IPADM_IPC_ERROR) {
		logmsg(LOG_ERR, "ipadm error in %s '%s' : %s\n",
		    (add ? "adding" : "deleting"), pi->pi_ipadm_aobjname,
		    ipadm_status2str(status));
	}
	ipadm_close(iph);
}