Sync with recent KAME.

This work was based on kame-20010528-freebsd43-snap.tgz and some
critical problem after the snap was out were fixed.
There are many many changes since last KAME merge.

TODO:
  - The definitions of SADB_* in sys/net/pfkeyv2.h are still different
    from RFC2407/IANA assignment because of binary compatibility
    issue.  It should be fixed under 5-CURRENT.
  - ip6po_m member of struct ip6_pktopts is no longer used.  But, it
    is still there because of binary compatibility issue.  It should
    be removed under 5-CURRENT.

Reviewed by:	itojun
Obtained from:	KAME
MFC after:	3 weeks

1 files changed, 900 insertions, 531 deletions

diff --git a/sys/netinet6/nd6_rtr.c b/sys/netinet6/nd6_rtr.c
index 258a59c..715ccf0 100644
--- a/sys/netinet6/nd6_rtr.c
+++ b/sys/netinet6/nd6_rtr.c
@@ -1,5 +1,5 @@
 /*	$FreeBSD$	*/
-/*	$KAME: nd6_rtr.c,v 1.47 2000/08/08 08:58:42 jinmei Exp $	*/
+/*	$KAME: nd6_rtr.c,v 1.111 2001/04/27 01:37:15 jinmei Exp $	*/
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -40,8 +40,10 @@
 #include <sys/socket.h>
 #include <sys/sockio.h>
 #include <sys/time.h>
+#include <sys/kernel.h>
 #include <sys/errno.h>
 #include <sys/syslog.h>
+#include <sys/queue.h>
 
 #include <net/if.h>
 #include <net/if_types.h>
@@ -51,6 +53,7 @@
 
 #include <netinet/in.h>
 #include <netinet6/in6_var.h>
+#include <netinet6/in6_ifattach.h>
 #include <netinet/ip6.h>
 #include <netinet6/ip6_var.h>
 #include <netinet6/nd6.h>
@@ -62,34 +65,39 @@
 #define SDL(s)	((struct sockaddr_dl *)s)
 
 static struct nd_defrouter *defrtrlist_update __P((struct nd_defrouter *));
-static int prelist_add __P((struct nd_prefix *, struct nd_defrouter *));
-static struct nd_prefix *prefix_lookup __P((struct nd_prefix *));
-static struct in6_ifaddr *in6_ifadd __P((struct ifnet *, struct in6_addr *,
-			  struct in6_addr *, int));
+static struct in6_ifaddr *in6_ifadd __P((struct nd_prefix *,
+	struct in6_addr *));
 static struct nd_pfxrouter *pfxrtr_lookup __P((struct nd_prefix *,
-    struct nd_defrouter *));
+	struct nd_defrouter *));
 static void pfxrtr_add __P((struct nd_prefix *, struct nd_defrouter *));
 static void pfxrtr_del __P((struct nd_pfxrouter *));
 static struct nd_pfxrouter *find_pfxlist_reachable_router
-    __P((struct nd_prefix *));
-static void nd6_detach_prefix __P((struct nd_prefix *));
-static void nd6_attach_prefix __P((struct nd_prefix *));
+	__P((struct nd_prefix *));
 static void defrouter_addifreq __P((struct ifnet *));
-#ifdef ND6_USE_RTSOCK
-static void defrouter_msg __P((int, struct rtentry *));
-#endif
+static void nd6_rtmsg __P((int, struct rtentry *));
 
 static void in6_init_address_ltimes __P((struct nd_prefix *ndpr,
-					 struct in6_addrlifetime *lt6,
-					 int update_vltime));
+					 struct in6_addrlifetime *lt6));
 
 static int rt6_deleteroute __P((struct radix_node *, void *));
 
 extern int nd6_recalc_reachtm_interval;
 
-struct ifnet *nd6_defifp;
+static struct ifnet *nd6_defifp;
 int nd6_defifindex;
 
+int ip6_use_tempaddr = 0;
+
+int ip6_desync_factor;
+u_int32_t ip6_temp_preferred_lifetime = DEF_TEMP_PREFERRED_LIFETIME;
+u_int32_t ip6_temp_valid_lifetime = DEF_TEMP_VALID_LIFETIME;
+/*
+ * shorter lifetimes for debugging purposes.
+int ip6_temp_preferred_lifetime = 800;
+static int ip6_temp_valid_lifetime = 1800;
+*/
+int ip6_temp_regen_advance = TEMPADDR_REGEN_ADVANCE;
+
 /*
  * Receive Router Solicitation Message - just for routers.
  * Router solicitation/advertisement is mostly managed by userland program
@@ -125,9 +133,11 @@ nd6_rs_input(m, off, icmp6len)
 
 	/* Sanity checks */
 	if (ip6->ip6_hlim != 255) {
-		log(LOG_ERR,
-		    "nd6_rs_input: invalid hlim %d\n", ip6->ip6_hlim);
-		goto freeit;
+		nd6log((LOG_ERR,
+		    "nd6_rs_input: invalid hlim (%d) from %s to %s on %s\n",
+		    ip6->ip6_hlim, ip6_sprintf(&ip6->ip6_src),
+		    ip6_sprintf(&ip6->ip6_dst), if_name(ifp)));
+		goto bad;
 	}
 
 	/*
@@ -151,7 +161,9 @@ nd6_rs_input(m, off, icmp6len)
 	icmp6len -= sizeof(*nd_rs);
 	nd6_option_init(nd_rs + 1, icmp6len, &ndopts);
 	if (nd6_options(&ndopts) < 0) {
-		log(LOG_INFO, "nd6_rs_input: invalid ND option, ignored\n");
+		nd6log((LOG_INFO,
+		    "nd6_rs_input: invalid ND option, ignored\n"));
+		/* nd6_options have incremented stats */
 		goto freeit;
 	}
 
@@ -161,16 +173,22 @@ nd6_rs_input(m, off, icmp6len)
 	}
 
 	if (lladdr && ((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) {
-		log(LOG_INFO,
+		nd6log((LOG_INFO,
 		    "nd6_rs_input: lladdrlen mismatch for %s "
 		    "(if %d, RS packet %d)\n",
-			ip6_sprintf(&saddr6), ifp->if_addrlen, lladdrlen - 2);
+			ip6_sprintf(&saddr6), ifp->if_addrlen, lladdrlen - 2));
+		goto bad;
 	}
 
 	nd6_cache_lladdr(ifp, &saddr6, lladdr, lladdrlen, ND_ROUTER_SOLICIT, 0);
 
  freeit:
 	m_freem(m);
+	return;
+
+ bad:
+	icmp6stat.icp6s_badrs++;
+	m_freem(m);
 }
 
 /*
@@ -203,16 +221,18 @@ nd6_ra_input(m, off, icmp6len)
 		goto freeit;
 
 	if (ip6->ip6_hlim != 255) {
-		log(LOG_ERR,
-		    "nd6_ra_input: invalid hlim %d\n", ip6->ip6_hlim);
-		goto freeit;
+		nd6log((LOG_ERR,
+		    "nd6_ra_input: invalid hlim (%d) from %s to %s on %s\n",
+		    ip6->ip6_hlim, ip6_sprintf(&ip6->ip6_src),
+		    ip6_sprintf(&ip6->ip6_dst), if_name(ifp)));
+		goto bad;
 	}
 
 	if (!IN6_IS_ADDR_LINKLOCAL(&saddr6)) {
-		log(LOG_ERR,
+		nd6log((LOG_ERR,
 		    "nd6_ra_input: src %s is not link-local\n",
-		    ip6_sprintf(&saddr6));
-		goto freeit;
+		    ip6_sprintf(&saddr6)));
+		goto bad;
 	}
 
 #ifndef PULLDOWN_TEST
@@ -229,7 +249,9 @@ nd6_ra_input(m, off, icmp6len)
 	icmp6len -= sizeof(*nd_ra);
 	nd6_option_init(nd_ra + 1, icmp6len, &ndopts);
 	if (nd6_options(&ndopts) < 0) {
-		log(LOG_INFO, "nd6_ra_input: invalid ND option, ignored\n");
+		nd6log((LOG_INFO,
+		    "nd6_ra_input: invalid ND option, ignored\n"));
+		/* nd6_options have incremented stats */
 		goto freeit;
 	}
 
@@ -267,7 +289,7 @@ nd6_ra_input(m, off, icmp6len)
 	 */
 	if (ndopts.nd_opts_pi) {
 		struct nd_opt_hdr *pt;
-		struct nd_opt_prefix_info *pi;
+		struct nd_opt_prefix_info *pi = NULL;
 		struct nd_prefix pr;
 
 		for (pt = (struct nd_opt_hdr *)ndopts.nd_opts_pi;
@@ -279,34 +301,38 @@ nd6_ra_input(m, off, icmp6len)
 			pi = (struct nd_opt_prefix_info *)pt;
 
 			if (pi->nd_opt_pi_len != 4) {
-				log(LOG_INFO, "nd6_ra_input: invalid option "
-					"len %d for prefix information option, "
-					"ignored\n", pi->nd_opt_pi_len);
+				nd6log((LOG_INFO,
+				    "nd6_ra_input: invalid option "
+				    "len %d for prefix information option, "
+				    "ignored\n", pi->nd_opt_pi_len));
 				continue;
 			}
 
 			if (128 < pi->nd_opt_pi_prefix_len) {
-				log(LOG_INFO, "nd6_ra_input: invalid prefix "
-					"len %d for prefix information option, "
-					"ignored\n", pi->nd_opt_pi_prefix_len);
+				nd6log((LOG_INFO,
+				    "nd6_ra_input: invalid prefix "
+				    "len %d for prefix information option, "
+				    "ignored\n", pi->nd_opt_pi_prefix_len));
 				continue;
 			}
 
 			if (IN6_IS_ADDR_MULTICAST(&pi->nd_opt_pi_prefix)
 			 || IN6_IS_ADDR_LINKLOCAL(&pi->nd_opt_pi_prefix)) {
-				log(LOG_INFO, "nd6_ra_input: invalid prefix "
-					"%s, ignored\n",
-					ip6_sprintf(&pi->nd_opt_pi_prefix));
+				nd6log((LOG_INFO,
+				    "nd6_ra_input: invalid prefix "
+				    "%s, ignored\n",
+				    ip6_sprintf(&pi->nd_opt_pi_prefix)));
 				continue;
 			}
 
 			/* aggregatable unicast address, rfc2374 */
 			if ((pi->nd_opt_pi_prefix.s6_addr8[0] & 0xe0) == 0x20
 			 && pi->nd_opt_pi_prefix_len != 64) {
-				log(LOG_INFO, "nd6_ra_input: invalid prefixlen "
-					"%d for rfc2374 prefix %s, ignored\n",
-					pi->nd_opt_pi_prefix_len,
-					ip6_sprintf(&pi->nd_opt_pi_prefix));
+				nd6log((LOG_INFO,
+				    "nd6_ra_input: invalid prefixlen "
+				    "%d for rfc2374 prefix %s, ignored\n",
+				    pi->nd_opt_pi_prefix_len,
+				    ip6_sprintf(&pi->nd_opt_pi_prefix)));
 				continue;
 			}
 
@@ -340,9 +366,9 @@ nd6_ra_input(m, off, icmp6len)
 
 		/* lower bound */
 		if (mtu < IPV6_MMTU) {
-			log(LOG_INFO, "nd6_ra_input: bogus mtu option "
+			nd6log((LOG_INFO, "nd6_ra_input: bogus mtu option "
 			    "mtu=%d sent from %s, ignoring\n",
-			    mtu, ip6_sprintf(&ip6->ip6_src));
+			    mtu, ip6_sprintf(&ip6->ip6_src)));
 			goto skip;
 		}
 
@@ -355,17 +381,17 @@ nd6_ra_input(m, off, icmp6len)
 				if (change) /* in6_maxmtu may change */
 					in6_setmaxmtu();
 			} else {
-				log(LOG_INFO, "nd6_ra_input: bogus mtu "
+				nd6log((LOG_INFO, "nd6_ra_input: bogus mtu "
 				    "mtu=%d sent from %s; "
 				    "exceeds maxmtu %d, ignoring\n",
 				    mtu, ip6_sprintf(&ip6->ip6_src),
-				    ndi->maxmtu);
+				    ndi->maxmtu));
 			}
 		} else {
-			log(LOG_INFO, "nd6_ra_input: mtu option "
+			nd6log((LOG_INFO, "nd6_ra_input: mtu option "
 			    "mtu=%d sent from %s; maxmtu unknown, "
 			    "ignoring\n",
-			    mtu, ip6_sprintf(&ip6->ip6_src));
+			    mtu, ip6_sprintf(&ip6->ip6_src)));
 		}
 	}
 
@@ -384,10 +410,11 @@ nd6_ra_input(m, off, icmp6len)
 	}
 
 	if (lladdr && ((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) {
-		log(LOG_INFO,
+		nd6log((LOG_INFO,
 		    "nd6_ra_input: lladdrlen mismatch for %s "
 		    "(if %d, RA packet %d)\n",
-			ip6_sprintf(&saddr6), ifp->if_addrlen, lladdrlen - 2);
+			ip6_sprintf(&saddr6), ifp->if_addrlen, lladdrlen - 2));
+		goto bad;
 	}
 
 	nd6_cache_lladdr(ifp, &saddr6, lladdr, lladdrlen, ND_ROUTER_ADVERT, 0);
@@ -400,7 +427,12 @@ nd6_ra_input(m, off, icmp6len)
 	pfxlist_onlink_check();
     }
 
-freeit:
+ freeit:
+	m_freem(m);
+	return;
+
+ bad:
+	icmp6stat.icp6s_badra++;
 	m_freem(m);
 }
 
@@ -408,10 +440,9 @@ freeit:
  * default router list proccessing sub routines
  */
 
-#ifdef ND6_USE_RTSOCK
 /* tell the change to user processes watching the routing socket. */
 static void
-defrouter_msg(cmd, rt)
+nd6_rtmsg(cmd, rt)
 	int cmd;
 	struct rtentry *rt;
 {
@@ -421,10 +452,12 @@ defrouter_msg(cmd, rt)
 	info.rti_info[RTAX_DST] = rt_key(rt);
 	info.rti_info[RTAX_GATEWAY] = rt->rt_gateway;
 	info.rti_info[RTAX_NETMASK] = rt_mask(rt);
+	info.rti_info[RTAX_IFP] =
+		(struct sockaddr *)TAILQ_FIRST(&rt->rt_ifp->if_addrlist);
+	info.rti_info[RTAX_IFA] = rt->rt_ifa->ifa_addr;
 
 	rt_missmsg(cmd, &info, rt->rt_flags, 0);
 }
-#endif
 
 void
 defrouter_addreq(new)
@@ -448,9 +481,7 @@ defrouter_addreq(new)
 		(struct sockaddr *)&gate, (struct sockaddr *)&mask,
 		RTF_GATEWAY, &newrt);
 	if (newrt) {
-#ifdef ND6_USE_RTSOCK
-		defrouter_msg(RTM_ADD, newrt); /* tell user process */
-#endif
+		nd6_rtmsg(RTM_ADD, newrt); /* tell user process */
 		newrt->rt_refcnt--;
 	}
 	splx(s);
@@ -478,31 +509,27 @@ defrouter_addifreq(ifp)
 	 * XXX: An IPv6 address are required to be assigned on the interface.
 	 */
 	if ((ifa = ifaof_ifpforaddr((struct sockaddr *)&def, ifp)) == NULL) {
-		log(LOG_ERR,	/* better error? */
+		nd6log((LOG_ERR,	/* better error? */
 		    "defrouter_addifreq: failed to find an ifaddr "
 		    "to install a route to interface %s\n",
-		    if_name(ifp));
+		    if_name(ifp)));
 		return;
 	}
 
 	flags = ifa->ifa_flags;
-	if ((ifp->if_flags & IFF_POINTOPOINT) != 0)
-		flags &= ~RTF_CLONING;
-	if ((error = rtrequest(RTM_ADD, (struct sockaddr *)&def,
-			       ifa->ifa_addr, (struct sockaddr *)&mask,
-			       flags, &newrt)) != 0) {
-		log(LOG_ERR,
+	error = rtrequest(RTM_ADD, (struct sockaddr *)&def, ifa->ifa_addr,
+			  (struct sockaddr *)&mask, flags, &newrt);
+	if (error != 0) {
+		nd6log((LOG_ERR,
 		    "defrouter_addifreq: failed to install a route to "
 		    "interface %s (errno = %d)\n",
-		    if_name(ifp), error);
+		    if_name(ifp), error));
 
 		if (newrt)	/* maybe unnecessary, but do it for safety */
 			newrt->rt_refcnt--;
 	} else {
 		if (newrt) {
-#ifdef ND6_USE_RTSOCK
-			defrouter_msg(RTM_ADD, newrt);
-#endif
+			nd6_rtmsg(RTM_ADD, newrt);
 			newrt->rt_refcnt--;
 		}
 	}
@@ -546,9 +573,7 @@ defrouter_delreq(dr, dofree)
 		  (struct sockaddr *)&mask,
 		  RTF_GATEWAY, &oldrt);
 	if (oldrt) {
-#ifdef ND6_USE_RTSOCK
-		defrouter_msg(RTM_DELETE, oldrt);
-#endif
+		nd6_rtmsg(RTM_DELETE, oldrt);
 		if (oldrt->rt_refcnt <= 0) {
 			/*
 			 * XXX: borrowed from the RTM_DELETE case of
@@ -669,15 +694,17 @@ defrouter_select()
 				/*
 				 * Install a route to the default interface
 				 * as default route.
+				 * XXX: we enable this for host only, because
+				 * this may override a default route installed
+				 * a user process (e.g. routing daemon) in a
+				 * router case.
 				 */
 				defrouter_addifreq(nd6_defifp);
-			}
-#ifdef ND6_DEBUG
-			else	/* noisy log? */
-				log(LOG_INFO, "defrouter_select: "
+			} else {
+				nd6log((LOG_INFO, "defrouter_select: "
 				    "there's no default router and no default"
-				    " interface\n");
-#endif
+				    " interface\n"));
+			}
 		}
 	}
 
@@ -775,8 +802,8 @@ pfxrtr_del(pfr)
 	free(pfr, M_IP6NDP);
 }
 
-static struct nd_prefix *
-prefix_lookup(pr)
+struct nd_prefix *
+nd6_prefix_lookup(pr)
 	struct nd_prefix *pr;
 {
 	struct nd_prefix *search;
@@ -795,12 +822,12 @@ prefix_lookup(pr)
 	return(search);
 }
 
-static int
-prelist_add(pr, dr)
-	struct nd_prefix *pr;
+int
+nd6_prelist_add(pr, dr, newp)
+	struct nd_prefix *pr, **newp;
 	struct nd_defrouter *dr;
 {
-	struct nd_prefix *new;
+	struct nd_prefix *new = NULL;
 	int i, s;
 
 	new = (struct nd_prefix *)malloc(sizeof(*new), M_IP6NDP, M_NOWAIT);
@@ -808,9 +835,10 @@ prelist_add(pr, dr)
 		return ENOMEM;
 	bzero(new, sizeof(*new));
 	*new = *pr;
+	if (newp != NULL)
+		*newp = new;
 
 	/* initilization */
-	new->ndpr_statef_onlink = pr->ndpr_statef_onlink;
 	LIST_INIT(&new->ndpr_advrtrs);
 	in6_prefixlen2mask(&new->ndpr_mask, new->ndpr_plen);
 	/* make prefix in the canonical form */
@@ -818,13 +846,24 @@ prelist_add(pr, dr)
 		new->ndpr_prefix.sin6_addr.s6_addr32[i] &=
 			new->ndpr_mask.s6_addr32[i];
 
-	/* xxx ND_OPT_PI_FLAG_ONLINK processing */
-
 	s = splnet();
 	/* link ndpr_entry to nd_prefix list */
 	LIST_INSERT_HEAD(&nd_prefix, new, ndpr_entry);
 	splx(s);
 
+	/* ND_OPT_PI_FLAG_ONLINK processing */
+	if (new->ndpr_raf_onlink) {
+		int e;
+
+		if ((e = nd6_prefix_onlink(new)) != 0) {
+			nd6log((LOG_ERR, "nd6_prelist_add: failed to make "
+			    "the prefix %s/%d on-link on %s (errno=%d)\n",
+			    ip6_sprintf(&pr->ndpr_prefix.sin6_addr),
+			    pr->ndpr_plen, if_name(pr->ndpr_ifp), e));
+			/* proceed anyway. XXX: is it correct? */
+		}
+	}
+
 	if (dr) {
 		pfxrtr_add(new, dr);
 	}
@@ -837,12 +876,35 @@ prelist_remove(pr)
 	struct nd_prefix *pr;
 {
 	struct nd_pfxrouter *pfr, *next;
-	int s;
+	int e, s;
+
+	/* make sure to invalidate the prefix until it is really freed. */
+	pr->ndpr_vltime = 0;
+	pr->ndpr_pltime = 0;
+#if 0
+	/*
+	 * Though these flags are now meaningless, we'd rather keep the value
+	 * not to confuse users when executing "ndp -p".
+	 */
+	pr->ndpr_raf_onlink = 0;
+	pr->ndpr_raf_auto = 0;
+#endif
+	if ((pr->ndpr_stateflags & NDPRF_ONLINK) != 0 &&
+	    (e = nd6_prefix_offlink(pr)) != 0) {
+		nd6log((LOG_ERR, "prelist_remove: failed to make %s/%d offlink "
+		    "on %s, errno=%d\n",
+		    ip6_sprintf(&pr->ndpr_prefix.sin6_addr),
+		    pr->ndpr_plen, if_name(pr->ndpr_ifp), e));
+		/* what should we do? */
+	}
+
+	if (pr->ndpr_refcnt > 0)
+		return;		/* notice here? */
 
 	s = splnet();
+
 	/* unlink ndpr_entry from nd_prefix list */
 	LIST_REMOVE(pr, ndpr_entry);
-	splx(s);
 
 	/* free list of routers that adversed the prefix */
 	for (pfr = pr->ndpr_advrtrs.lh_first; pfr; pfr = next) {
@@ -850,30 +912,28 @@ prelist_remove(pr)
 
 		free(pfr, M_IP6NDP);
 	}
+	splx(s);
+
 	free(pr, M_IP6NDP);
 
 	pfxlist_onlink_check();
 }
 
-/*
- * NOTE: We set address lifetime to keep
- *	address lifetime <= prefix lifetime
- * invariant.  This is to simplify on-link determination code.
- * If onlink determination is udated, this routine may have to be updated too.
- */
 int
 prelist_update(new, dr, m)
 	struct nd_prefix *new;
 	struct nd_defrouter *dr; /* may be NULL */
 	struct mbuf *m;
 {
-	struct in6_ifaddr *ia6 = NULL;
+	struct in6_ifaddr *ia6 = NULL, *ia6_match = NULL;
+	struct ifaddr *ifa;
+	struct ifnet *ifp = new->ndpr_ifp;
 	struct nd_prefix *pr;
 	int s = splnet();
 	int error = 0;
+	int newprefix = 0;
 	int auth;
-	struct in6_addrlifetime *lt6;
-	u_char onlink;	/* Mobile IPv6 */
+	struct in6_addrlifetime lt6_tmp;
 
 	auth = 0;
 	if (m) {
@@ -887,170 +947,259 @@ prelist_update(new, dr, m)
 #endif
 	}
 
-	if ((pr = prefix_lookup(new)) != NULL) {
-		if (pr->ndpr_ifp != new->ndpr_ifp) {
-			error = EADDRNOTAVAIL;
-			goto end;
-		}
-
-		/* update prefix information */
-		pr->ndpr_flags = new->ndpr_flags;
-		pr->ndpr_vltime = new->ndpr_vltime;
-		pr->ndpr_pltime = new->ndpr_pltime;
-		pr->ndpr_preferred = new->ndpr_preferred;
-		pr->ndpr_expire = new->ndpr_expire;
 
+	if ((pr = nd6_prefix_lookup(new)) != NULL) {
 		/*
-		 * RFC 2462 5.5.3 (d) or (e)
-		 * We got a prefix which we have seen in the past.
+		 * nd6_prefix_lookup() ensures that pr and new have the same
+		 * prefix on a same interface.
 		 */
-		if (!new->ndpr_raf_auto)
-			goto noautoconf1;
 
-		if (IN6_IS_ADDR_UNSPECIFIED(&pr->ndpr_addr))
-			ia6 = NULL;
-		else
-			ia6 = in6ifa_ifpwithaddr(pr->ndpr_ifp, &pr->ndpr_addr);
+		/*
+		 * Update prefix information.  Note that the on-link (L) bit
+		 * and the autonomous (A) bit should NOT be changed from 1
+		 * to 0.
+		 */
+		if (new->ndpr_raf_onlink == 1)
+			pr->ndpr_raf_onlink = 1;
+		if (new->ndpr_raf_auto == 1)
+			pr->ndpr_raf_auto = 1;
+		if (new->ndpr_raf_onlink) {
+			pr->ndpr_vltime = new->ndpr_vltime;
+			pr->ndpr_pltime = new->ndpr_pltime;
+			pr->ndpr_preferred = new->ndpr_preferred;
+			pr->ndpr_expire = new->ndpr_expire;
+		}
 
-		if (ia6 == NULL) {
-			/*
-			 * Special case:
-			 * (1) We have seen the prefix advertised before, but
-			 * we have never performed autoconfig for this prefix.
-			 * This is because Autonomous bit was 0 previously, or
-			 * autoconfig failed due to some other reasons.
-			 * (2) We have seen the prefix advertised before and
-			 * we have performed autoconfig in the past, but
-			 * we seem to have no interface address right now.
-			 * This is because the interface address have expired.
-			 *
-			 * This prefix is fresh, with respect to autoconfig
-			 * process.
-			 *
-			 * Add an address based on RFC 2462 5.5.3 (d).
-			 */
-			ia6 = in6_ifadd(pr->ndpr_ifp,
-				&pr->ndpr_prefix.sin6_addr, &pr->ndpr_addr,
-				new->ndpr_plen);
-			if (!ia6) {
-				error = EADDRNOTAVAIL;
-				log(LOG_ERR, "prelist_update: failed to add a "
-				    "new address\n");
-				goto noautoconf1;
+		if (new->ndpr_raf_onlink &&
+		    (pr->ndpr_stateflags & NDPRF_ONLINK) == 0) {
+			int e;
+
+			if ((e = nd6_prefix_onlink(pr)) != 0) {
+				nd6log((LOG_ERR,
+				    "prelist_update: failed to make "
+				    "the prefix %s/%d on-link on %s "
+				    "(errno=%d)\n",
+				    ip6_sprintf(&pr->ndpr_prefix.sin6_addr),
+				    pr->ndpr_plen, if_name(pr->ndpr_ifp), e));
+				/* proceed anyway. XXX: is it correct? */
 			}
+		}
 
-			lt6 = &ia6->ia6_lifetime;
+		if (dr && pfxrtr_lookup(pr, dr) == NULL)
+			pfxrtr_add(pr, dr);
+	} else {
+		struct nd_prefix *newpr = NULL;
 
-			/* address lifetime <= prefix lifetime */
-			lt6->ia6t_vltime = new->ndpr_vltime;
-			lt6->ia6t_pltime = new->ndpr_pltime;
-			in6_init_address_ltimes(new, lt6, 1);
-		} else {
-#define TWOHOUR		(120*60)
-			/*
-			 * We have seen the prefix before, and we have added
-			 * interface address in the past.  We still have
-			 * the interface address assigned.
-			 *
-			 * update address lifetime based on RFC 2462
-			 * 5.5.3 (e).
-			 */
-			int update = 0;
-
-			lt6 = &ia6->ia6_lifetime;
-
-#if 0	/* RFC 2462 5.5.3 (e) */
-			lt6->ia6t_pltime = new->ndpr_pltime;
-			if (TWOHOUR < new->ndpr_vltime
-			 || lt6pr->nd < new->ndpr_vltime) {
-				lt6->ia6t_vltime = new->ndpr_vltime;
-				update++;
-			} else if (auth
-				&& lt6->ia6t_vltime <= TWOHOUR0
-				&& new->ndpr_vltime <= lt6->ia6t_vltime) {
-				lt6->ia6t_vltime = new->ndpr_vltime;
-				update++;
-			} else {
-				lt6->ia6t_vltime = TWOHOUR;
-				update++;
-			}
+		newprefix = 1;
 
-			/* 2 hour rule is not imposed for pref lifetime */
-			new->ndpr_apltime = new->ndpr_pltime;
-			lt6->ia6t_pltime = new->ndpr_pltime;
-#else	/* update from Jim Bound, (ipng 6712) */
-			if (TWOHOUR < new->ndpr_vltime
-			 || lt6->ia6t_vltime < new->ndpr_vltime) {
-				lt6->ia6t_vltime = new->ndpr_vltime;
-				update++;
-			} else if (auth) {
-				lt6->ia6t_vltime = new->ndpr_vltime;
-				update++;
-			}
+		if (new->ndpr_vltime == 0)
+			goto end;
+		if (new->ndpr_raf_onlink == 0 && new->ndpr_raf_auto == 0)
+			goto end;
 
-			/* jim bound rule is not imposed for pref lifetime */
-			lt6->ia6t_pltime = new->ndpr_pltime;
-#endif
-			in6_init_address_ltimes(new, lt6, update);
+		bzero(&new->ndpr_addr, sizeof(struct in6_addr));
+
+		error = nd6_prelist_add(new, dr, &newpr);
+		if (error != 0 || newpr == NULL) {
+			nd6log((LOG_NOTICE, "prelist_update: "
+			    "nd6_prelist_add failed for %s/%d on %s "
+			    "errno=%d, returnpr=%p\n",
+			    ip6_sprintf(&new->ndpr_prefix.sin6_addr),
+					new->ndpr_plen, if_name(new->ndpr_ifp),
+					error, newpr));
+			goto end; /* we should just give up in this case. */
 		}
 
- noautoconf1:
+		/*
+		 * XXX: from the ND point of view, we can ignore a prefix
+		 * with the on-link bit being zero.  However, we need a
+		 * prefix structure for references from autoconfigured
+		 * addresses.  Thus, we explicitly make suret that the prefix
+		 * itself expires now.
+		 */
+		if (newpr->ndpr_raf_onlink == 0) {
+			newpr->ndpr_vltime = 0;
+			newpr->ndpr_pltime = 0;
+			in6_init_prefix_ltimes(newpr);
+		}
 
-#if 0
-		/* address lifetime expire processing, RFC 2462 5.5.4. */
-		if (pr->ndpr_preferred && pr->ndpr_preferred < time_second) {
-			struct in6_ifaddr *ia6;
+		pr = newpr;
+	}
 
-			ia6 = in6ifa_ifpwithaddr(pr->ndpr_ifp, &pr->ndpr_addr);
-			if (ia6)
-				ia6->ia6_flags &= ~IN6_IFF_DEPRECATED;
-		}
-#endif
+	/*
+	 * Address autoconfiguration based on Section 5.5.3 of RFC 2462.
+	 * Note that pr must be non NULL at this point.
+	 */
 
-		onlink = pr->ndpr_statef_onlink;     /* Mobile IPv6 */
+	/* 5.5.3 (a). Ignore the prefix without the A bit set. */
+	if (!new->ndpr_raf_auto)
+		goto afteraddrconf;
 
-		if (dr && pfxrtr_lookup(pr, dr) == NULL)
-			pfxrtr_add(pr, dr);
+	/*
+	 * 5.5.3 (b). the link-local prefix should have been ignored in
+	 * nd6_ra_input.
+	 */
 
-	} else {
-		int error_tmp;
+	/*
+	 * 5.5.3 (c). Consistency check on lifetimes: pltime <= vltime.
+	 * This should have been done in nd6_ra_input.
+	 */
 
-		if (new->ndpr_vltime == 0) goto end;
+ 	/*
+	 * 5.5.3 (d). If the prefix advertised does not match the prefix of an
+	 * address already in the list, and the Valid Lifetime is not 0,
+	 * form an address.  Note that even a manually configured address
+	 * should reject autoconfiguration of a new address.
+	 */
+	TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list)
+	{
+		struct in6_ifaddr *ifa6;
+		int ifa_plen;
+		u_int32_t storedlifetime;
 
-		bzero(&new->ndpr_addr, sizeof(struct in6_addr));
+		if (ifa->ifa_addr->sa_family != AF_INET6)
+			continue;
+
+		ifa6 = (struct in6_ifaddr *)ifa;
+
+		/*
+		 * Spec is not clear here, but I believe we should concentrate
+		 * on unicast (i.e. not anycast) addresses.
+		 * XXX: other ia6_flags? detached or duplicated?
+		 */
+		if ((ifa6->ia6_flags & IN6_IFF_ANYCAST) != 0)
+			continue;
+		
+		ifa_plen = in6_mask2len(&ifa6->ia_prefixmask.sin6_addr, NULL);
+		if (ifa_plen != new->ndpr_plen ||
+		    !in6_are_prefix_equal(&ifa6->ia_addr.sin6_addr,
+					  &new->ndpr_prefix.sin6_addr,
+					  ifa_plen))
+			continue;
+
+		if (ia6_match == NULL) /* remember the first one */
+			ia6_match = ifa6;
+
+		if ((ifa6->ia6_flags & IN6_IFF_AUTOCONF) == 0)
+			continue;
 
 		/*
-		 * RFC 2462 5.5.3 (d)
-		 * We got a fresh prefix.  Perform some sanity checks
-		 * and add an interface address by appending interface ID
-		 * to the advertised prefix.
+		 * An already autoconfigured address matched.  Now that we
+		 * are sure there is at least one matched address, we can
+		 * proceed to 5.5.3. (e): update the lifetimes according to the
+		 * "two hours" rule and the privacy extension.
 		 */
-		if (!new->ndpr_raf_auto)
-			goto noautoconf2;
-
-		ia6 = in6_ifadd(new->ndpr_ifp, &new->ndpr_prefix.sin6_addr,
-			  &new->ndpr_addr, new->ndpr_plen);
-		if (!ia6) {
-			error = EADDRNOTAVAIL;
-			log(LOG_ERR, "prelist_update: "
-				"failed to add a new address\n");
-			goto noautoconf2;
+#define TWOHOUR		(120*60)
+		lt6_tmp = ifa6->ia6_lifetime;
+
+		storedlifetime = IFA6_IS_INVALID(ifa6) ? 0 :
+			(lt6_tmp.ia6t_expire - time_second);
+
+		if (TWOHOUR < new->ndpr_vltime ||
+		    storedlifetime < new->ndpr_vltime) {
+			lt6_tmp.ia6t_vltime = new->ndpr_vltime;
+		} else if (storedlifetime <= TWOHOUR
+#if 0
+			   /*
+			    * This condition is logically redundant, so we just
+			    * omit it.
+			    * See IPng 6712, 6717, and 6721.
+			    */
+			   && new->ndpr_vltime <= storedlifetime
+#endif
+			) {
+			if (auth) {
+				lt6_tmp.ia6t_vltime = new->ndpr_vltime;
+			}
+		} else {
+			/*
+			 * new->ndpr_vltime <= TWOHOUR &&
+			 * TWOHOUR < storedlifetime
+			 */
+			lt6_tmp.ia6t_vltime = TWOHOUR;
 		}
-		/* set onlink bit if an interface route is configured */
-		new->ndpr_statef_onlink = (ia6->ia_flags & IFA_ROUTE) ? 1 : 0;
 
-		lt6 = &ia6->ia6_lifetime;
+		/* The 2 hour rule is not imposed for preferred lifetime. */
+		lt6_tmp.ia6t_pltime = new->ndpr_pltime;
+
+		in6_init_address_ltimes(pr, &lt6_tmp);
+
+		/*
+		 * When adjusting the lifetimes of an existing temporary
+		 * address, only lower the lifetimes.
+		 * RFC 3041 3.3. (1).
+		 * XXX: how should we modify ia6t_[pv]ltime?
+		 */
+		if ((ifa6->ia6_flags & IN6_IFF_TEMPORARY) != 0) {
+			if (lt6_tmp.ia6t_expire == 0 || /* no expire */
+			    lt6_tmp.ia6t_expire >
+			    ifa6->ia6_lifetime.ia6t_expire) {
+				lt6_tmp.ia6t_expire =
+					ifa6->ia6_lifetime.ia6t_expire;
+			}
+			if (lt6_tmp.ia6t_preferred == 0 || /* no expire */
+			    lt6_tmp.ia6t_preferred >
+			    ifa6->ia6_lifetime.ia6t_preferred) {
+				lt6_tmp.ia6t_preferred =
+					ifa6->ia6_lifetime.ia6t_preferred;
+			}
+		}
+
+		ifa6->ia6_lifetime = lt6_tmp;
+	}
+	if (ia6_match == NULL && new->ndpr_vltime) {
+		/*
+		 * No address matched and the valid lifetime is non-zero.
+		 * Create a new address.
+		 */
+		if ((ia6 = in6_ifadd(new, NULL)) != NULL) {
+			/*
+			 * note that we should use pr (not new) for reference.
+			 */
+			pr->ndpr_refcnt++;
+			ia6->ia6_ndpr = pr;
+
+#if 0
+			/* XXXYYY Don't do this, according to Jinmei. */
+			pr->ndpr_addr = new->ndpr_addr;
+#endif
 
-		/* address lifetime <= prefix lifetime */
-		lt6->ia6t_vltime = new->ndpr_vltime;
-		lt6->ia6t_pltime = new->ndpr_pltime;
-		in6_init_address_ltimes(new, lt6, 1);
+			/*
+			 * RFC 3041 3.3 (2).
+			 * When a new public address is created as described
+			 * in RFC2462, also create a new temporary address.
+			 *
+			 * RFC 3041 3.5.
+			 * When an interface connects to a new link, a new
+			 * randomized interface identifier should be generated
+			 * immediately together with a new set of temporary
+			 * addresses.  Thus, we specifiy 1 as the 2nd arg of
+			 * in6_tmpifadd().
+			 */
+			if (ip6_use_tempaddr) {
+				int e;
+				if ((e = in6_tmpifadd(ia6, 1)) != 0) {
+					nd6log((LOG_NOTICE, "prelist_update: "
+					    "failed to create a temporary "
+					    "address, errno=%d\n",
+					    e));
+				}
+			}
 
- noautoconf2:
-		error_tmp = prelist_add(new, dr);
-		error = error_tmp ? error_tmp : error;
+			/*
+			 * A newly added address might affect the status
+			 * of other addresses, so we check and update it.
+			 * XXX: what if address duplication happens?
+			 */
+			pfxlist_onlink_check();
+		} else {
+			/* just set an error. do not bark here. */
+			error = EADDRNOTAVAIL; /* XXX: might be unused. */
+		}
 	}
 
+  afteraddrconf:
+
  end:
 	splx(s);
 	return error;
@@ -1061,7 +1210,7 @@ prelist_update(new, dr, m)
  * detect if a given prefix has a (probably) reachable advertising router.
  * XXX: lengthy function name...
  */
-struct nd_pfxrouter *
+static struct nd_pfxrouter *
 find_pfxlist_reachable_router(pr)
 	struct nd_prefix *pr;
 {
@@ -1084,14 +1233,14 @@ find_pfxlist_reachable_router(pr)
 
 /*
  * Check if each prefix in the prefix list has at least one available router
- * that advertised the prefix (A router is "available" if its neighbor cache
- * entry has reachable or probably reachable).
+ * that advertised the prefix (a router is "available" if its neighbor cache
+ * entry is reachable or probably reachable).
  * If the check fails, the prefix may be off-link, because, for example,
  * we have moved from the network but the lifetime of the prefix has not
- * been expired yet. So we should not use the prefix if there is another
- * prefix that has an available router.
- * But if there is no prefix that has an available router, we still regards
- * all the prefixes as on-link. This is because we can't tell if all the
+ * expired yet.  So we should not use the prefix if there is another prefix
+ * that has an available router.
+ * But, if there is no prefix that has an available router, we still regards
+ * all the prefixes as on-link.  This is because we can't tell if all the
  * routers are simply dead or if we really moved from the network and there
  * is no router around us.
  */
@@ -1099,55 +1248,275 @@ void
 pfxlist_onlink_check()
 {
 	struct nd_prefix *pr;
+	struct in6_ifaddr *ifa;
 
 	/*
 	 * Check if there is a prefix that has a reachable advertising
 	 * router.
 	 */
 	for (pr = nd_prefix.lh_first; pr; pr = pr->ndpr_next) {
-		if (find_pfxlist_reachable_router(pr))
+		if (pr->ndpr_raf_onlink && find_pfxlist_reachable_router(pr))
 			break;
 	}
 
 	if (pr) {
 		/*
 		 * There is at least one prefix that has a reachable router.
-		 * First, detach prefixes which has no reachable advertising
-		 * router and then attach other prefixes.
-		 * The order is important since an attached prefix and a
-		 * detached prefix may have a same interface route.
+		 * Detach prefixes which have no reachable advertising
+		 * router, and attach other prefixes.
 		 */
 		for (pr = nd_prefix.lh_first; pr; pr = pr->ndpr_next) {
-			if (find_pfxlist_reachable_router(pr) == NULL &&
-			    pr->ndpr_statef_onlink) {
-				pr->ndpr_statef_onlink = 0;
-				nd6_detach_prefix(pr);
-			}
+			/* XXX: a link-local prefix should never be detached */
+			if (IN6_IS_ADDR_LINKLOCAL(&pr->ndpr_prefix.sin6_addr))
+				continue;
+
+			/*
+			 * we aren't interested in prefixes without the L bit
+			 * set.
+			 */
+			if (pr->ndpr_raf_onlink == 0)
+				continue;
+
+			if ((pr->ndpr_stateflags & NDPRF_DETACHED) == 0 &&
+			    find_pfxlist_reachable_router(pr) == NULL)
+				pr->ndpr_stateflags |= NDPRF_DETACHED;
+			if ((pr->ndpr_stateflags & NDPRF_DETACHED) != 0 &&
+			    find_pfxlist_reachable_router(pr) != 0)
+				pr->ndpr_stateflags &= ~NDPRF_DETACHED;
 		}
+	} else {
+		/* there is no prefix that has a reachable router */
 		for (pr = nd_prefix.lh_first; pr; pr = pr->ndpr_next) {
-			if (find_pfxlist_reachable_router(pr) &&
-			    pr->ndpr_statef_onlink == 0)
-				nd6_attach_prefix(pr);
+			if (IN6_IS_ADDR_LINKLOCAL(&pr->ndpr_prefix.sin6_addr))
+				continue;
+
+			if (pr->ndpr_raf_onlink == 0)
+				continue;
+
+			if ((pr->ndpr_stateflags & NDPRF_DETACHED) != 0)
+				pr->ndpr_stateflags &= ~NDPRF_DETACHED;
+		}
+	}
+
+	/*
+	 * Remove each interface route associated with a (just) detached
+	 * prefix, and reinstall the interface route for a (just) attached
+	 * prefix.  Note that all attempt of reinstallation does not
+	 * necessarily success, when a same prefix is shared among multiple
+	 * interfaces.  Such cases will be handled in nd6_prefix_onlink,
+	 * so we don't have to care about them.
+	 */
+	for (pr = nd_prefix.lh_first; pr; pr = pr->ndpr_next) {
+		int e;
+
+		if (IN6_IS_ADDR_LINKLOCAL(&pr->ndpr_prefix.sin6_addr))
+			continue;
+
+		if (pr->ndpr_raf_onlink == 0)
+			continue;
+
+		if ((pr->ndpr_stateflags & NDPRF_DETACHED) != 0 &&
+		    (pr->ndpr_stateflags & NDPRF_ONLINK) != 0) {
+			if ((e = nd6_prefix_offlink(pr)) != 0) {
+				nd6log((LOG_ERR,
+				    "pfxlist_onlink_check: failed to "
+				    "make %s/%d offlink, errno=%d\n",
+				    ip6_sprintf(&pr->ndpr_prefix.sin6_addr),
+				    pr->ndpr_plen, e));
+			}
+		}
+		if ((pr->ndpr_stateflags & NDPRF_DETACHED) == 0 &&
+		    (pr->ndpr_stateflags & NDPRF_ONLINK) == 0 &&
+		    pr->ndpr_raf_onlink) {
+			if ((e = nd6_prefix_onlink(pr)) != 0) {
+				nd6log((LOG_ERR,
+				    "pfxlist_onlink_check: failed to "
+				    "make %s/%d offlink, errno=%d\n",
+				    ip6_sprintf(&pr->ndpr_prefix.sin6_addr),
+				    pr->ndpr_plen, e));
+			}
+		}
+	}
+
+	/*
+	 * Changes on the prefix status might affect address status as well.
+	 * Make sure that all addresses derived from an attached prefix are
+	 * attached, and that all addresses derived from a detached prefix are
+	 * detached.  Note, however, that a manually configured address should
+	 * always be attached.
+	 * The precise detection logic is same as the one for prefixes.
+	 */
+	for (ifa = in6_ifaddr; ifa; ifa = ifa->ia_next) {
+		if ((ifa->ia6_flags & IN6_IFF_AUTOCONF) == 0)
+			continue;
+
+		if (ifa->ia6_ndpr == NULL) {
+			/*
+			 * This can happen when we first configure the address
+			 * (i.e. the address exists, but the prefix does not).
+			 * XXX: complicated relationships...
+			 */
+			continue;
+		}
+
+		if (find_pfxlist_reachable_router(ifa->ia6_ndpr))
+			break;
+	}
+	if (ifa) {
+		for (ifa = in6_ifaddr; ifa; ifa = ifa->ia_next) {
+			if ((ifa->ia6_flags & IN6_IFF_AUTOCONF) == 0)
+				continue;
+
+			if (ifa->ia6_ndpr == NULL) /* XXX: see above. */
+				continue;
+
+			if (find_pfxlist_reachable_router(ifa->ia6_ndpr))
+				ifa->ia6_flags &= ~IN6_IFF_DETACHED;
+			else
+				ifa->ia6_flags |= IN6_IFF_DETACHED;
 		}
 	}
 	else {
-		/* there is no prefix that has a reachable router */
-		for (pr = nd_prefix.lh_first; pr; pr = pr->ndpr_next)
-			if (pr->ndpr_statef_onlink == 0)
-				nd6_attach_prefix(pr);
+		for (ifa = in6_ifaddr; ifa; ifa = ifa->ia_next) {
+			if ((ifa->ia6_flags & IN6_IFF_AUTOCONF) == 0)
+				continue;
+
+			ifa->ia6_flags &= ~IN6_IFF_DETACHED;
+		}
 	}
 }
 
-static void
-nd6_detach_prefix(pr)
+int
+nd6_prefix_onlink(pr)
 	struct nd_prefix *pr;
 {
-	struct in6_ifaddr *ia6;
-	struct sockaddr_in6 sa6, mask6;
+	struct ifaddr *ifa;
+	struct ifnet *ifp = pr->ndpr_ifp;
+	struct sockaddr_in6 mask6;
+	struct nd_prefix *opr;
+	u_long rtflags;
+	int error = 0;
+	struct rtentry *rt = NULL;
+
+	/* sanity check */
+	if ((pr->ndpr_stateflags & NDPRF_ONLINK) != 0) {
+		nd6log((LOG_ERR,
+		    "nd6_prefix_onlink: %s/%d is already on-link\n",
+		    ip6_sprintf(&pr->ndpr_prefix.sin6_addr), pr->ndpr_plen);
+		return(EEXIST));
+	}
 
 	/*
-	 * Delete the interface route associated with the prefix.
+	 * Add the interface route associated with the prefix.  Before
+	 * installing the route, check if there's the same prefix on another
+	 * interface, and the prefix has already installed the interface route.
+	 * Although such a configuration is expected to be rare, we explicitly
+	 * allow it.
 	 */
+	for (opr = nd_prefix.lh_first; opr; opr = opr->ndpr_next) {
+		if (opr == pr)
+			continue;
+
+		if ((opr->ndpr_stateflags & NDPRF_ONLINK) == 0)
+			continue;
+
+		if (opr->ndpr_plen == pr->ndpr_plen &&
+		    in6_are_prefix_equal(&pr->ndpr_prefix.sin6_addr,
+					 &opr->ndpr_prefix.sin6_addr,
+					 pr->ndpr_plen))
+			return(0);
+	}
+
+	/*
+	 * We prefer link-local addresses as the associated interface address. 
+	 */
+	/* search for a link-local addr */
+	ifa = (struct ifaddr *)in6ifa_ifpforlinklocal(ifp,
+						      IN6_IFF_NOTREADY|
+						      IN6_IFF_ANYCAST);
+	if (ifa == NULL) {
+		/* XXX: freebsd does not have ifa_ifwithaf */
+		TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list)
+		{
+			if (ifa->ifa_addr->sa_family == AF_INET6)
+				break;
+		}
+		/* should we care about ia6_flags? */
+	}
+	if (ifa == NULL) {
+		/*
+		 * This can still happen, when, for example, we receive an RA
+		 * containing a prefix with the L bit set and the A bit clear,
+		 * after removing all IPv6 addresses on the receiving
+		 * interface.  This should, of course, be rare though.
+		 */
+		nd6log((LOG_NOTICE,
+		    "nd6_prefix_onlink: failed to find any ifaddr"
+		    " to add route for a prefix(%s/%d) on %s\n",
+		    ip6_sprintf(&pr->ndpr_prefix.sin6_addr),
+		    pr->ndpr_plen, if_name(ifp)));
+		return(0);
+	}
+
+	/*
+	 * in6_ifinit() sets nd6_rtrequest to ifa_rtrequest for all ifaddrs.
+	 * ifa->ifa_rtrequest = nd6_rtrequest;
+	 */
+	bzero(&mask6, sizeof(mask6));
+	mask6.sin6_len = sizeof(mask6);
+	mask6.sin6_addr = pr->ndpr_mask;
+	rtflags = ifa->ifa_flags | RTF_CLONING | RTF_UP;
+	if (nd6_need_cache(ifp)) {
+		/* explicitly set in case ifa_flags does not set the flag. */
+		rtflags |= RTF_CLONING;
+	} else {
+		/*
+		 * explicitly clear the cloning bit in case ifa_flags sets it.
+		 */
+		rtflags &= ~RTF_CLONING;
+	}
+	error = rtrequest(RTM_ADD, (struct sockaddr *)&pr->ndpr_prefix,
+			  ifa->ifa_addr, (struct sockaddr *)&mask6,
+			  rtflags, &rt);
+	if (error == 0) {
+		if (rt != NULL) /* this should be non NULL, though */
+			nd6_rtmsg(RTM_ADD, rt);
+		pr->ndpr_stateflags |= NDPRF_ONLINK;
+	}
+	else {
+		nd6log((LOG_ERR, "nd6_prefix_onlink: failed to add route for a"
+		    " prefix (%s/%d) on %s, gw=%s, mask=%s, flags=%lx "
+		    "errno = %d\n",
+		    ip6_sprintf(&pr->ndpr_prefix.sin6_addr),
+		    pr->ndpr_plen, if_name(ifp),
+		    ip6_sprintf(&((struct sockaddr_in6 *)ifa->ifa_addr)->sin6_addr),
+		    ip6_sprintf(&mask6.sin6_addr), rtflags, error));
+	}
+
+	if (rt != NULL)
+		rt->rt_refcnt--;
+
+	return(error);
+}
+
+int
+nd6_prefix_offlink(pr)
+	struct nd_prefix *pr;
+{
+	int error = 0;
+	struct ifnet *ifp = pr->ndpr_ifp;
+	struct nd_prefix *opr;
+	struct sockaddr_in6 sa6, mask6;
+	struct rtentry *rt = NULL;
+
+	/* sanity check */
+	if ((pr->ndpr_stateflags & NDPRF_ONLINK) == 0) {
+		nd6log((LOG_ERR,
+		    "nd6_prefix_offlink: %s/%d is already off-link\n",
+		    ip6_sprintf(&pr->ndpr_prefix.sin6_addr), pr->ndpr_plen));
+		return(EEXIST);
+	}
+
 	bzero(&sa6, sizeof(sa6));
 	sa6.sin6_family = AF_INET6;
 	sa6.sin6_len = sizeof(sa6);
@@ -1157,103 +1526,113 @@ nd6_detach_prefix(pr)
 	mask6.sin6_family = AF_INET6;
 	mask6.sin6_len = sizeof(sa6);
 	bcopy(&pr->ndpr_mask, &mask6.sin6_addr, sizeof(struct in6_addr));
-	{
-		int e;
+	error = rtrequest(RTM_DELETE, (struct sockaddr *)&sa6, NULL,
+			  (struct sockaddr *)&mask6, 0, &rt);
+	if (error == 0) {
+		pr->ndpr_stateflags &= ~NDPRF_ONLINK;
 
-		e = rtrequest(RTM_DELETE, (struct sockaddr *)&sa6, NULL,
-			      (struct sockaddr *)&mask6, 0, NULL);
-		if (e) {
-			log(LOG_ERR,
-			    "nd6_detach_prefix: failed to delete route: "
-			    "%s/%d (errno = %d)\n",
-			    ip6_sprintf(&sa6.sin6_addr),
-			    pr->ndpr_plen,
-			    e);
-		}
-	}
+		/* report the route deletion to the routing socket. */
+		if (rt != NULL)
+			nd6_rtmsg(RTM_DELETE, rt);
 
-	/*
-	 * Mark the address derived from the prefix detached so that
-	 * it won't be used as a source address for a new connection.
-	 */
-	if (IN6_IS_ADDR_UNSPECIFIED(&pr->ndpr_addr))
-		ia6 = NULL;
-	else
-		ia6 = in6ifa_ifpwithaddr(pr->ndpr_ifp, &pr->ndpr_addr);
-	if (ia6)
-		ia6->ia6_flags |= IN6_IFF_DETACHED;
-}
+		/*
+		 * There might be the same prefix on another interface,
+		 * the prefix which could not be on-link just because we have
+		 * the interface route (see comments in nd6_prefix_onlink).
+		 * If there's one, try to make the prefix on-link on the
+		 * interface.
+		 */
+		for (opr = nd_prefix.lh_first; opr; opr = opr->ndpr_next) {
+			if (opr == pr)
+				continue;
 
-static void
-nd6_attach_prefix(pr)
-	struct nd_prefix *pr;
-{
-	struct ifaddr *ifa;
-	struct in6_ifaddr *ia6;
+			if ((opr->ndpr_stateflags & NDPRF_ONLINK) != 0)
+				continue;
 
-	/*
-	 * Add the interface route associated with the prefix(if necessary)
-	 * Should we consider if the L bit is set in pr->ndpr_flags?
-	 */
-	ifa = ifaof_ifpforaddr((struct sockaddr *)&pr->ndpr_prefix,
-			       pr->ndpr_ifp);
-	if (ifa == NULL) {
-		log(LOG_ERR,
-		    "nd6_attach_prefix: failed to find any ifaddr"
-		    " to add route for a prefix(%s/%d)\n",
-		    ip6_sprintf(&pr->ndpr_addr), pr->ndpr_plen);
+			/*
+			 * KAME specific: detached prefixes should not be
+			 * on-link.
+			 */
+			if ((opr->ndpr_stateflags & NDPRF_DETACHED) != 0)
+				continue;
+
+			if (opr->ndpr_plen == pr->ndpr_plen &&
+			    in6_are_prefix_equal(&pr->ndpr_prefix.sin6_addr,
+						 &opr->ndpr_prefix.sin6_addr,
+						 pr->ndpr_plen)) {
+				int e;
+
+				if ((e = nd6_prefix_onlink(opr)) != 0) {
+					nd6log((LOG_ERR,
+					    "nd6_prefix_offlink: failed to "
+					    "recover a prefix %s/%d from %s "
+					    "to %s (errno = %d)\n",
+					    ip6_sprintf(&opr->ndpr_prefix.sin6_addr),
+					    opr->ndpr_plen, if_name(ifp),
+					    if_name(opr->ndpr_ifp), e));
+				}
+			}
+		}
 	}
 	else {
-		int e;
-		struct sockaddr_in6 mask6;
-
-		bzero(&mask6, sizeof(mask6));
-		mask6.sin6_family = AF_INET6;
-		mask6.sin6_len = sizeof(mask6);
-		mask6.sin6_addr = pr->ndpr_mask;
-		e = rtrequest(RTM_ADD, (struct sockaddr *)&pr->ndpr_prefix,
-			      ifa->ifa_addr, (struct sockaddr *)&mask6,
-			      ifa->ifa_flags, NULL);
-		if (e == 0)
-			pr->ndpr_statef_onlink = 1;
-		else {
-			log(LOG_ERR,
-			    "nd6_attach_prefix: failed to add route for"
-			    " a prefix(%s/%d), errno = %d\n",
-			    ip6_sprintf(&pr->ndpr_addr), pr->ndpr_plen, e);
-		}
+		/* XXX: can we still set the NDPRF_ONLINK flag? */
+		nd6log((LOG_ERR,
+		    "nd6_prefix_offlink: failed to delete route: "
+		    "%s/%d on %s (errno = %d)\n",
+		    ip6_sprintf(&sa6.sin6_addr), pr->ndpr_plen, if_name(ifp),
+		    error));
 	}
 
-	/*
-	 * Now the address derived from the prefix can be used as a source
-	 * for a new connection, so clear the detached flag.
-	 */
-	if (IN6_IS_ADDR_UNSPECIFIED(&pr->ndpr_addr))
-		ia6 = NULL;
-	else
-		ia6 = in6ifa_ifpwithaddr(pr->ndpr_ifp, &pr->ndpr_addr);
-	if (ia6) {
-		ia6->ia6_flags &= ~IN6_IFF_DETACHED;
-		if (pr->ndpr_statef_onlink)
-			ia6->ia_flags |= IFA_ROUTE;
+	if (rt != NULL) {
+		if (rt->rt_refcnt <= 0) {
+			/* XXX: we should free the entry ourselves. */
+			rt->rt_refcnt++;
+			rtfree(rt);
+		}
 	}
+
+	return(error);
 }
 
 static struct in6_ifaddr *
-in6_ifadd(ifp, in6, addr, prefixlen)
-	struct ifnet *ifp;
-	struct in6_addr *in6;
-	struct in6_addr *addr;
-	int prefixlen;	/* prefix len of the new prefix in "in6" */
+in6_ifadd(pr, ifid)
+	struct nd_prefix *pr;
+	struct in6_addr  *ifid;   /* Mobile IPv6 addition */
 {
+	struct ifnet *ifp = pr->ndpr_ifp;
 	struct ifaddr *ifa;
-	struct in6_ifaddr *ia, *ib, *oia;
-	int s, error;
+	struct in6_aliasreq ifra;
+	struct in6_ifaddr *ia, *ib;
+	int error, plen0;
 	struct in6_addr mask;
+	int prefixlen = pr->ndpr_plen;
 
 	in6_len2mask(&mask, prefixlen);
 
-	/* find link-local address (will be interface ID) */
+	/*
+	 * find a link-local address (will be interface ID).
+	 * Is it really mandatory? Theoretically, a global or a site-local
+	 * address can be configured without a link-local address, if we
+	 * have a unique interface identifier...
+	 *
+	 * it is not mandatory to have a link-local address, we can generate
+	 * interface identifier on the fly.  we do this because:
+	 * (1) it should be the easiest way to find interface identifier.
+	 * (2) RFC2462 5.4 suggesting the use of the same interface identifier
+	 * for multiple addresses on a single interface, and possible shortcut
+	 * of DAD.  we omitted DAD for this reason in the past.
+	 * (3) a user can prevent autoconfiguration of global address 
+	 * by removing link-local address by hand (this is partly because we
+	 * don't have other way to control the use of IPv6 on a interface.
+	 * this has been our design choice - cf. NRL's "ifconfig auto").
+	 * (4) it is easier to manage when an interface has addresses
+	 * with the same interface identifier, than to have multiple addresses
+	 * with different interface identifiers.
+	 *
+	 * Mobile IPv6 addition: allow for caller to specify a wished interface
+	 * ID. This is to not break connections when moving addresses between
+	 * interfaces.
+	 */
 	ifa = (struct ifaddr *)in6ifa_ifpforlinklocal(ifp, 0);/* 0 is OK? */
 	if (ifa)
 		ib = (struct in6_ifaddr *)ifa;
@@ -1269,204 +1648,199 @@ in6_ifadd(ifp, in6, addr, prefixlen)
 #endif
 
 	/* prefixlen + ifidlen must be equal to 128 */
-	if (prefixlen != in6_mask2len(&ib->ia_prefixmask.sin6_addr)) {
-		log(LOG_ERR, "in6_ifadd: wrong prefixlen for %s"
-			"(prefix=%d ifid=%d)\n", if_name(ifp),
-			prefixlen,
-			128 - in6_mask2len(&ib->ia_prefixmask.sin6_addr));
+	plen0 = in6_mask2len(&ib->ia_prefixmask.sin6_addr, NULL);
+	if (prefixlen != plen0) {
+		nd6log((LOG_INFO, "in6_ifadd: wrong prefixlen for %s "
+		    "(prefix=%d ifid=%d)\n",
+		    if_name(ifp), prefixlen, 128 - plen0));
 		return NULL;
 	}
 
 	/* make ifaddr */
-	ia = (struct in6_ifaddr *)malloc(sizeof(*ia), M_IFADDR, M_DONTWAIT);
-	if (ia == NULL) {
-		printf("ENOBUFS in in6_ifadd %d\n", __LINE__);
-		return NULL;
-	}
 
-	bzero((caddr_t)ia, sizeof(*ia));
-	ia->ia_ifa.ifa_addr = (struct sockaddr *)&ia->ia_addr;
-	if (ifp->if_flags & IFF_POINTOPOINT)
-		ia->ia_ifa.ifa_dstaddr = (struct sockaddr *)&ia->ia_dstaddr;
-	else
-		ia->ia_ifa.ifa_dstaddr = NULL;
-	ia->ia_ifa.ifa_netmask = (struct sockaddr *)&ia->ia_prefixmask;
-	ia->ia_ifp = ifp;
-
-	/* link to in6_ifaddr */
-	if ((oia = in6_ifaddr) != NULL) {
-		for( ; oia->ia_next; oia = oia->ia_next)
-			continue;
-		oia->ia_next = ia;
-	} else {
-		/*
-		 * This should be impossible, since we have at least one
-		 * link-local address (see the beginning of this function).
-		 * XXX: should we rather panic here?
-		 */
-		printf("in6_ifadd: in6_ifaddr is NULL (impossible!)\n");
-		in6_ifaddr = ia;
-	}
-	/* gain a refcnt for the link from in6_ifaddr */
-	ia->ia_ifa.ifa_refcnt++;
-
-	/* link to if_addrlist */
-	TAILQ_INSERT_TAIL(&ifp->if_addrlist, (struct ifaddr *)ia, ifa_list);
-	/* gain another refcnt for the link from if_addrlist */
-	ia->ia_ifa.ifa_refcnt++;
-
-	/* new address */
-	ia->ia_addr.sin6_len = sizeof(struct sockaddr_in6);
-	ia->ia_addr.sin6_family = AF_INET6;
+	bzero(&ifra, sizeof(ifra));
+	/*
+	 * in6_update_ifa() does not use ifra_name, but we accurately set it
+	 * for safety.
+	 */
+	strncpy(ifra.ifra_name, if_name(ifp), sizeof(ifra.ifra_name));
+	ifra.ifra_addr.sin6_family = AF_INET6;
+	ifra.ifra_addr.sin6_len = sizeof(struct sockaddr_in6);
 	/* prefix */
-	bcopy(in6, &ia->ia_addr.sin6_addr, sizeof(ia->ia_addr.sin6_addr));
-	ia->ia_addr.sin6_addr.s6_addr32[0] &= mask.s6_addr32[0];
-	ia->ia_addr.sin6_addr.s6_addr32[1] &= mask.s6_addr32[1];
-	ia->ia_addr.sin6_addr.s6_addr32[2] &= mask.s6_addr32[2];
-	ia->ia_addr.sin6_addr.s6_addr32[3] &= mask.s6_addr32[3];
-	/* interface ID */
-	ia->ia_addr.sin6_addr.s6_addr32[0]
-		|= (ib->ia_addr.sin6_addr.s6_addr32[0] & ~mask.s6_addr32[0]);
-	ia->ia_addr.sin6_addr.s6_addr32[1]
-		|= (ib->ia_addr.sin6_addr.s6_addr32[1] & ~mask.s6_addr32[1]);
-	ia->ia_addr.sin6_addr.s6_addr32[2]
-		|= (ib->ia_addr.sin6_addr.s6_addr32[2] & ~mask.s6_addr32[2]);
-	ia->ia_addr.sin6_addr.s6_addr32[3]
-		|= (ib->ia_addr.sin6_addr.s6_addr32[3] & ~mask.s6_addr32[3]);
-
-	/* new prefix */
-	ia->ia_prefixmask.sin6_len = sizeof(struct sockaddr_in6);
-	ia->ia_prefixmask.sin6_family = AF_INET6;
-	bcopy(&mask, &ia->ia_prefixmask.sin6_addr,
-		sizeof(ia->ia_prefixmask.sin6_addr));
-
-	/* same routine */
-	ia->ia_ifa.ifa_rtrequest =
-		(ifp->if_type == IFT_PPP) ? nd6_p2p_rtrequest : nd6_rtrequest;
-	ia->ia_ifa.ifa_flags |= RTF_CLONING;
-	ia->ia_ifa.ifa_metric = ifp->if_metric;
-
-	/* add interface route */
-	if ((error = rtinit(&(ia->ia_ifa), (int)RTM_ADD, RTF_UP|RTF_CLONING))) {
-		log(LOG_NOTICE, "in6_ifadd: failed to add an interface route "
-		    "for %s/%d on %s, errno = %d\n",
-		    ip6_sprintf(&ia->ia_addr.sin6_addr), prefixlen,
-		    if_name(ifp), error);
-	} else
-		ia->ia_flags |= IFA_ROUTE;
+	bcopy(&pr->ndpr_prefix.sin6_addr, &ifra.ifra_addr.sin6_addr,
+	      sizeof(ifra.ifra_addr.sin6_addr));
+	ifra.ifra_addr.sin6_addr.s6_addr32[0] &= mask.s6_addr32[0];
+	ifra.ifra_addr.sin6_addr.s6_addr32[1] &= mask.s6_addr32[1];
+	ifra.ifra_addr.sin6_addr.s6_addr32[2] &= mask.s6_addr32[2];
+	ifra.ifra_addr.sin6_addr.s6_addr32[3] &= mask.s6_addr32[3];
 
-	*addr = ia->ia_addr.sin6_addr;
+	/* interface ID */
+	if (ifid == NULL || IN6_IS_ADDR_UNSPECIFIED(ifid))
+		ifid = &ib->ia_addr.sin6_addr;
+	ifra.ifra_addr.sin6_addr.s6_addr32[0]
+		|= (ifid->s6_addr32[0] & ~mask.s6_addr32[0]);
+	ifra.ifra_addr.sin6_addr.s6_addr32[1]
+		|= (ifid->s6_addr32[1] & ~mask.s6_addr32[1]);
+	ifra.ifra_addr.sin6_addr.s6_addr32[2]
+		|= (ifid->s6_addr32[2] & ~mask.s6_addr32[2]);
+	ifra.ifra_addr.sin6_addr.s6_addr32[3]
+		|= (ifid->s6_addr32[3] & ~mask.s6_addr32[3]);
+	    
+	/* new prefix mask. */
+	ifra.ifra_prefixmask.sin6_len = sizeof(struct sockaddr_in6);
+	ifra.ifra_prefixmask.sin6_family = AF_INET6;
+	bcopy(&mask, &ifra.ifra_prefixmask.sin6_addr,
+	      sizeof(ifra.ifra_prefixmask.sin6_addr));
 
-	if (ifp->if_flags & IFF_MULTICAST) {
-		int error;	/* not used */
-		struct in6_addr sol6;
+	/*
+	 * lifetime.
+	 * XXX: in6_init_address_ltimes would override these values later.
+	 * We should reconsider this logic. 
+	 */
+	ifra.ifra_lifetime.ia6t_vltime = pr->ndpr_vltime;
+	ifra.ifra_lifetime.ia6t_pltime = pr->ndpr_pltime;
 
-		/* join solicited node multicast address */
-		bzero(&sol6, sizeof(sol6));
-		sol6.s6_addr16[0] = htons(0xff02);
-		sol6.s6_addr16[1] = htons(ifp->if_index);
-		sol6.s6_addr32[1] = 0;
-		sol6.s6_addr32[2] = htonl(1);
-		sol6.s6_addr32[3] = ia->ia_addr.sin6_addr.s6_addr32[3];
-		sol6.s6_addr8[12] = 0xff;
-		(void)in6_addmulti(&sol6, ifp, &error);
-	}
+	/* XXX: scope zone ID? */
 
-	ia->ia6_flags |= IN6_IFF_TENTATIVE;
+	ifra.ifra_flags |= IN6_IFF_AUTOCONF; /* obey autoconf */
+	/*
+	 * temporarily set the nopfx flag to avoid conflict.
+	 * XXX: we should reconsider the entire mechanism about prefix
+	 * manipulation.
+	 */
+	ifra.ifra_flags |= IN6_IFF_NOPFX;
 
 	/*
-	 * To make the interface up. Only AF_INET6 in ia is used...
+	 * keep the new address, regardless of the result of in6_update_ifa.
+	 * XXX: this address is now meaningless.
+	 * We should reconsider its role.
 	 */
-	s = splimp();
-	if (ifp->if_ioctl && (*ifp->if_ioctl)(ifp, SIOCSIFADDR, (caddr_t)ia)) {
-		splx(s);
-		return NULL;
+	pr->ndpr_addr = ifra.ifra_addr.sin6_addr;
+
+	/* allocate ifaddr structure, link into chain, etc. */
+	if ((error = in6_update_ifa(ifp, &ifra, NULL)) != 0) {
+		nd6log((LOG_ERR,
+		    "in6_ifadd: failed to make ifaddr %s on %s (errno=%d)\n",
+		    ip6_sprintf(&ifra.ifra_addr.sin6_addr), if_name(ifp),
+		    error));
+		return(NULL);	/* ifaddr must not have been allocated. */
 	}
-	splx(s);
 
-	/* Perform DAD, if needed. */
-	nd6_dad_start((struct ifaddr *)ia, NULL);
+	ia = in6ifa_ifpwithaddr(ifp, &ifra.ifra_addr.sin6_addr);
 
-	return ia;
+	return(ia);		/* this must NOT be NULL. */
 }
 
 int
-in6_ifdel(ifp, in6)
-	struct ifnet *ifp;
-	struct in6_addr *in6;
+in6_tmpifadd(ia0, forcegen)
+	const struct in6_ifaddr *ia0; /* corresponding public address */
 {
-	struct in6_ifaddr *ia = (struct in6_ifaddr *)NULL;
-	struct in6_ifaddr *oia = (struct in6_ifaddr *)NULL;
+	struct ifnet *ifp = ia0->ia_ifa.ifa_ifp;
+	struct in6_ifaddr *newia;
+	struct in6_aliasreq ifra;
+	int i, error;
+	int trylimit = 3;	/* XXX: adhoc value */
+	u_int32_t randid[2];
+	time_t vltime0, pltime0;
+
+	bzero(&ifra, sizeof(ifra));
+	strncpy(ifra.ifra_name, if_name(ifp), sizeof(ifra.ifra_name));
+	ifra.ifra_addr = ia0->ia_addr;
+	/* copy prefix mask */
+	ifra.ifra_prefixmask = ia0->ia_prefixmask;
+	/* clear the old IFID */
+	for (i = 0; i < 4; i++) {
+		ifra.ifra_addr.sin6_addr.s6_addr32[i]
+			&= ifra.ifra_prefixmask.sin6_addr.s6_addr32[i];
+	}
 
-	if (!ifp)
-		return -1;
+  again:
+	in6_get_tmpifid(ifp, (u_int8_t *)randid,
+			(const u_int8_t *)&ia0->ia_addr.sin6_addr.s6_addr[8],
+			forcegen);
+	ifra.ifra_addr.sin6_addr.s6_addr32[2]
+		|= (randid[0] & ~(ifra.ifra_prefixmask.sin6_addr.s6_addr32[2]));
+	ifra.ifra_addr.sin6_addr.s6_addr32[3]
+		|= (randid[1] & ~(ifra.ifra_prefixmask.sin6_addr.s6_addr32[3]));
 
-	ia = in6ifa_ifpwithaddr(ifp, in6);
-	if (!ia)
-		return -1;
+	/*
+	 * If by chance the new temporary address is the same as an address
+	 * already assigned to the interface, generate a new randomized
+	 * interface identifier and repeat this step.
+	 * RFC 3041 3.3 (4).
+	 */
+	if (in6ifa_ifpwithaddr(ifp, &ifra.ifra_addr.sin6_addr) != NULL) {
+		if (trylimit-- == 0) {
+			nd6log((LOG_NOTICE, "in6_tmpifadd: failed to find "
+			    "a unique random IFID\n"));
+			return(EEXIST);
+		}
+		forcegen = 1;
+		goto again;
+	}
 
-	if (ifp->if_flags & IFF_MULTICAST) {
-		/*
-		 * delete solicited multicast addr for deleting host id
-		 */
-		struct in6_multi *in6m;
-		struct in6_addr llsol;
-		bzero(&llsol, sizeof(struct in6_addr));
-		llsol.s6_addr16[0] = htons(0xff02);
-		llsol.s6_addr16[1] = htons(ifp->if_index);
-		llsol.s6_addr32[1] = 0;
-		llsol.s6_addr32[2] = htonl(1);
-		llsol.s6_addr32[3] =
-				ia->ia_addr.sin6_addr.s6_addr32[3];
-		llsol.s6_addr8[12] = 0xff;
-
-		IN6_LOOKUP_MULTI(llsol, ifp, in6m);
-		if (in6m)
-			in6_delmulti(in6m);
-	}
-
-	if (ia->ia_flags & IFA_ROUTE) {
-		rtinit(&(ia->ia_ifa), (int)RTM_DELETE, 0);
-		ia->ia_flags &= ~IFA_ROUTE;
-	}
-
-	TAILQ_REMOVE(&ifp->if_addrlist, (struct ifaddr *)ia, ifa_list);
-	IFAFREE(&ia->ia_ifa);
-
-	/* lladdr is never deleted */
-	oia = ia;
-	if (oia == (ia = in6_ifaddr))
-		in6_ifaddr = ia->ia_next;
-	else {
-		while (ia->ia_next && (ia->ia_next != oia))
-			ia = ia->ia_next;
-		if (ia->ia_next)
-			ia->ia_next = oia->ia_next;
-		else
-			return -1;
+	/*
+	 * The Valid Lifetime is the lower of the Valid Lifetime of the
+         * public address or TEMP_VALID_LIFETIME.
+	 * The Preferred Lifetime is the lower of the Preferred Lifetime
+         * of the public address or TEMP_PREFERRED_LIFETIME -
+         * DESYNC_FACTOR.
+	 */
+	if (ia0->ia6_lifetime.ia6t_expire != 0) {
+		vltime0 = IFA6_IS_INVALID(ia0) ? 0 :
+			(ia0->ia6_lifetime.ia6t_expire - time_second);
+		if (vltime0 > ip6_temp_valid_lifetime)
+			vltime0 = ip6_temp_valid_lifetime;
+	} else
+		vltime0 = ip6_temp_valid_lifetime;
+	if (ia0->ia6_lifetime.ia6t_preferred != 0) {
+		pltime0 = IFA6_IS_DEPRECATED(ia0) ? 0 :
+			(ia0->ia6_lifetime.ia6t_preferred - time_second);
+		if (pltime0 > ip6_temp_preferred_lifetime - ip6_desync_factor){
+			pltime0 = ip6_temp_preferred_lifetime -
+				ip6_desync_factor;
+		}
+	} else
+		pltime0 = ip6_temp_preferred_lifetime - ip6_desync_factor;
+	ifra.ifra_lifetime.ia6t_vltime = vltime0;
+	ifra.ifra_lifetime.ia6t_pltime = pltime0;
+
+	/*
+	 * A temporary address is created only if this calculated Preferred
+	 * Lifetime is greater than REGEN_ADVANCE time units.
+	 */
+	if (ifra.ifra_lifetime.ia6t_pltime <= ip6_temp_regen_advance)
+		return(0);
+
+	/* XXX: scope zone ID? */
+
+	ifra.ifra_flags |= (IN6_IFF_AUTOCONF|IN6_IFF_TEMPORARY);
+
+	/* allocate ifaddr structure, link into chain, etc. */
+	if ((error = in6_update_ifa(ifp, &ifra, NULL)) != 0)
+		return(error);
+
+	newia = in6ifa_ifpwithaddr(ifp, &ifra.ifra_addr.sin6_addr);
+	if (newia == NULL) {	/* XXX: can it happen? */
+		nd6log((LOG_ERR,
+		    "in6_tmpifadd: ifa update succeeded, but we got "
+		    "no ifaddr\n"));
+		return(EINVAL); /* XXX */
 	}
+	newia->ia6_ndpr = ia0->ia6_ndpr;
+	newia->ia6_ndpr->ndpr_refcnt++;
 
-	IFAFREE((&oia->ia_ifa));
-/* xxx
-	rtrequest(RTM_DELETE,
-		  (struct sockaddr *)&ia->ia_addr,
-		  (struct sockaddr *)0
-		  (struct sockaddr *)&ia->ia_prefixmask,
-		  RTF_UP|RTF_CLONING,
-		  (struct rtentry **)0);
-*/
-	return 0;
-}
+	return(0);
+}	    
 
 int
 in6_init_prefix_ltimes(struct nd_prefix *ndpr)
 {
-
-	/* check if preferred lifetime > valid lifetime */
+	/* check if preferred lifetime > valid lifetime.  RFC2462 5.5.3 (c) */
 	if (ndpr->ndpr_pltime > ndpr->ndpr_vltime) {
-		log(LOG_INFO, "in6_init_prefix_ltimes: preferred lifetime"
+		nd6log((LOG_INFO, "in6_init_prefix_ltimes: preferred lifetime"
 		    "(%d) is greater than valid lifetime(%d)\n",
-		    (u_int)ndpr->ndpr_pltime, (u_int)ndpr->ndpr_vltime);
+		    (u_int)ndpr->ndpr_pltime, (u_int)ndpr->ndpr_vltime));
 		return (EINVAL);
 	}
 	if (ndpr->ndpr_pltime == ND6_INFINITE_LIFETIME)
@@ -1482,24 +1856,15 @@ in6_init_prefix_ltimes(struct nd_prefix *ndpr)
 }
 
 static void
-in6_init_address_ltimes(struct nd_prefix *new,
-			struct in6_addrlifetime *lt6,
-			int update_vltime)
+in6_init_address_ltimes(struct nd_prefix *new, struct in6_addrlifetime *lt6)
 {
-
 	/* Valid lifetime must not be updated unless explicitly specified. */
-	if (update_vltime) {
-		/* init ia6t_expire */
-		if (lt6->ia6t_vltime == ND6_INFINITE_LIFETIME)
-			lt6->ia6t_expire = 0;
-		else {
-			lt6->ia6t_expire = time_second;
-			lt6->ia6t_expire += lt6->ia6t_vltime;
-		}
-		/* Ensure addr lifetime <= prefix lifetime. */
-		if (new->ndpr_expire && lt6->ia6t_expire &&
-		    new->ndpr_expire < lt6->ia6t_expire)
-			lt6->ia6t_expire = new->ndpr_expire;
+	/* init ia6t_expire */
+	if (lt6->ia6t_vltime == ND6_INFINITE_LIFETIME)
+		lt6->ia6t_expire = 0;
+	else {
+		lt6->ia6t_expire = time_second;
+		lt6->ia6t_expire += lt6->ia6t_vltime;
 	}
 
 	/* init ia6t_preferred */
@@ -1509,10 +1874,6 @@ in6_init_address_ltimes(struct nd_prefix *new,
 		lt6->ia6t_preferred = time_second;
 		lt6->ia6t_preferred += lt6->ia6t_pltime;
 	}
-	 /* Ensure addr lifetime <= prefix lifetime. */
-	if (new->ndpr_preferred && lt6->ia6t_preferred
-	    && new->ndpr_preferred < lt6->ia6t_preferred)
-		lt6->ia6t_preferred = new->ndpr_preferred;
 }
 
 /*
@@ -1522,8 +1883,8 @@ in6_init_address_ltimes(struct nd_prefix *new,
  */
 void
 rt6_flush(gateway, ifp)
-    struct in6_addr *gateway;
-    struct ifnet *ifp;
+	struct in6_addr *gateway;
+	struct ifnet *ifp;
 {
 	struct radix_node_head *rnh = rt_tables[AF_INET6];
 	int s = splnet();
@@ -1556,6 +1917,14 @@ rt6_deleteroute(rn, arg)
 		return(0);
 
 	/*
+	 * Do not delete a static route.
+	 * XXX: this seems to be a bit ad-hoc. Should we consider the
+	 * 'cloned' bit instead?
+	 */
+	if ((rt->rt_flags & RTF_STATIC) != 0)
+		return(0);
+
+	/*
 	 * We delete only host route. This means, in particular, we don't
 	 * delete default route.
 	 */