X-Git-Url: https://git.archive.openwrt.org/?p=project%2Fnetifd.git;a=blobdiff_plain;f=interface-ip.c;h=1e49fe6feac7dcf0d27278b0caedc7ee8370c7ef;hp=1a22ce635206ad0cd2f85ad9c625593e11601de3;hb=56cecedb261808f5ea700b92b97590f7fa16de9c;hpb=0b0e5e2fc5b065092644a5c4717c0a03a9098dcf

diff --git a/interface-ip.c b/interface-ip.c
index 1a22ce6..1e49fe6 100644
--- a/interface-ip.c
+++ b/interface-ip.c
@@ -40,6 +40,7 @@ enum {
 	ROUTE_SOURCE,
 	ROUTE_ONLINK,
 	ROUTE_TYPE,
+	ROUTE_PROTO,
 	__ROUTE_MAX
 };
 
@@ -54,7 +55,8 @@ static const struct blobmsg_policy route_attr[__ROUTE_MAX] = {
 	[ROUTE_VALID] = { .name = "valid", .type = BLOBMSG_TYPE_INT32 },
 	[ROUTE_SOURCE] = { .name = "source", .type = BLOBMSG_TYPE_STRING },
 	[ROUTE_ONLINK] = { .name = "onlink", .type = BLOBMSG_TYPE_BOOL },
-	[ROUTE_TYPE] = { .name = "type", .type = BLOBMSG_TYPE_STRING }
+	[ROUTE_TYPE] = { .name = "type", .type = BLOBMSG_TYPE_STRING },
+	[ROUTE_PROTO] = { .name = "proto", .type = BLOBMSG_TYPE_STRING },
 };
 
 const struct uci_blob_param_list route_attr_list = {
@@ -99,7 +101,7 @@ match_if_addr(union if_addr *a1, union if_addr *a2, int mask)
 
 static int set_ip_source_policy(bool add, bool v6, unsigned int priority,
 		const union if_addr *addr, uint8_t mask, unsigned int table,
-		struct interface *in_iface, const char *action)
+		struct interface *in_iface, const char *action, bool src)
 {
 	struct iprule rule = {
 		.flags = IPRULE_PRIORITY,
@@ -107,9 +109,15 @@ static int set_ip_source_policy(bool add, bool v6, unsigned int priority,
 	};
 
 	if (addr) {
-		rule.flags |= IPRULE_SRC;
-		rule.src_addr = *addr;
-		rule.src_mask = mask;
+		if (src) {
+			rule.flags |= IPRULE_SRC;
+			rule.src_addr = *addr;
+			rule.src_mask = mask;
+		} else {
+			rule.flags |= IPRULE_DEST;
+			rule.dest_addr = *addr;
+			rule.dest_mask = mask;
+		}
 	}
 
 	if (table) {
@@ -196,7 +204,7 @@ __find_ip_route_target(struct interface_ip_settings *ip, union if_addr *a,
 		if (route->flags & DEVROUTE_TABLE)
 			continue;
 
-		if (!*res || route->mask < (*res)->mask)
+		if (!*res || route->mask > (*res)->mask)
 			*res = route;
 	}
 }
@@ -221,23 +229,17 @@ interface_ip_add_target_route(union if_addr *addr, bool v6, struct interface *if
 {
 	struct device_route *route, *r_next = NULL;
 	bool defaultroute_target = false;
+	union if_addr addr_zero;
 	int addrsize = v6 ? sizeof(addr->in6) : sizeof(addr->in);
 
-	route = calloc(1, sizeof(*route));
-	if (!route)
-		return NULL;
-
-	route->flags = v6 ? DEVADDR_INET6 : DEVADDR_INET4;
-	route->mask = v6 ? 128 : 32;
-	if (memcmp(&route->addr, addr, addrsize) == 0)
+	memset(&addr_zero, 0, sizeof(addr_zero));
+	if (memcmp(&addr_zero, addr, addrsize) == 0)
 		defaultroute_target = true;
-	else
-		memcpy(&route->addr, addr, addrsize);
 
 	if (iface) {
 		/* look for locally addressable target first */
 		if (interface_ip_find_addr_target(iface, addr, v6))
-			goto done;
+			return iface;
 
 		/* do not stop at the first route, let the lookup compare
 		 * masks to find the best match */
@@ -246,7 +248,7 @@ interface_ip_add_target_route(union if_addr *addr, bool v6, struct interface *if
 		vlist_for_each_element(&interfaces, iface, node) {
 			/* look for locally addressable target first */
 			if (interface_ip_find_addr_target(iface, addr, v6))
-				goto done;
+				return iface;
 
 			/* do not stop at the first route, let the lookup compare
 			 * masks to find the best match */
@@ -254,26 +256,48 @@ interface_ip_add_target_route(union if_addr *addr, bool v6, struct interface *if
 		}
 	}
 
-	if (!r_next) {
-		free(route);
+	if (!r_next)
 		return NULL;
-	}
 
 	iface = r_next->iface;
+	if (defaultroute_target)
+		return iface;
+
+	route = calloc(1, sizeof(*route));
+	if (!route)
+		return NULL;
+
+	route->flags = v6 ? DEVADDR_INET6 : DEVADDR_INET4;
+	route->mask = v6 ? 128 : 32;
+	memcpy(&route->addr, addr, addrsize);
 	memcpy(&route->nexthop, &r_next->nexthop, sizeof(route->nexthop));
 	route->mtu = r_next->mtu;
 	route->metric = r_next->metric;
 	route->table = r_next->table;
-
-done:
 	route->iface = iface;
-	if (defaultroute_target)
-		free(route);
-	else
-		vlist_add(&iface->host_routes, &route->node, route);
+	vlist_add(&iface->host_routes, &route->node, route);
+
 	return iface;
 }
 
+static void
+interface_set_route_info(struct interface *iface, struct device_route *route)
+{
+	bool v6 = ((route->flags & DEVADDR_FAMILY) == DEVADDR_INET6);
+
+	if (!iface)
+		return;
+
+	if (!(route->flags & DEVROUTE_METRIC))
+		route->metric = iface->metric;
+
+	if (!(route->flags & DEVROUTE_TABLE)) {
+		route->table = (v6) ? iface->ip6table : iface->ip4table;
+		if (route->table)
+			route->flags |= DEVROUTE_SRCTABLE;
+	}
+}
+
 void
 interface_ip_add_route(struct interface *iface, struct blob_attr *attr, bool v6)
 {
@@ -281,7 +305,6 @@ interface_ip_add_route(struct interface *iface, struct blob_attr *attr, bool v6)
 	struct blob_attr *tb[__ROUTE_MAX], *cur;
 	struct device_route *route;
 	int af = v6 ? AF_INET6 : AF_INET;
-	bool is_proto_route = !!iface;
 
 	blobmsg_parse(route_attr, __ROUTE_MAX, tb, blobmsg_data(attr), blobmsg_data_len(attr));
 
@@ -327,8 +350,7 @@ interface_ip_add_route(struct interface *iface, struct blob_attr *attr, bool v6)
 	if ((cur = tb[ROUTE_METRIC]) != NULL) {
 		route->metric = blobmsg_get_u32(cur);
 		route->flags |= DEVROUTE_METRIC;
-	} else
-		route->metric = iface->metric;
+	}
 
 	if ((cur = tb[ROUTE_MTU]) != NULL) {
 		route->mtu = blobmsg_get_u32(cur);
@@ -344,7 +366,7 @@ interface_ip_add_route(struct interface *iface, struct blob_attr *attr, bool v6)
 		const char *mask = strtok_r(NULL, "/", &saveptr);
 
 		if (!addr || inet_pton(af, addr, &route->source) < 1) {
-			DPRINTF("Failed to parse route source: %s\n", addr);
+			DPRINTF("Failed to parse route source: %s\n", addr ? addr : "NULL");
 			goto error;
 		}
 
@@ -354,11 +376,6 @@ interface_ip_add_route(struct interface *iface, struct blob_attr *attr, bool v6)
 	if ((cur = tb[ROUTE_ONLINK]) != NULL && blobmsg_get_bool(cur))
 		route->flags |= DEVROUTE_ONLINK;
 
-	if (is_proto_route) {
-		route->table = (v6) ? iface->ip6table : iface->ip4table;
-		route->flags |= DEVROUTE_SRCTABLE;
-	}
-
 	if ((cur = tb[ROUTE_TABLE]) != NULL) {
 		if (!system_resolve_rt_table(blobmsg_data(cur), &route->table)) {
 			DPRINTF("Failed to resolve routing table: %s\n", (char *) blobmsg_data(cur));
@@ -388,6 +405,15 @@ interface_ip_add_route(struct interface *iface, struct blob_attr *attr, bool v6)
 		route->flags |= DEVROUTE_TYPE;
 	}
 
+	if ((cur = tb[ROUTE_PROTO]) != NULL) {
+		if (!system_resolve_rt_proto(blobmsg_data(cur), &route->proto)) {
+			DPRINTF("Failed to resolve proto type: %s\n", (char *) blobmsg_data(cur));
+			goto error;
+		}
+		route->flags |= DEVROUTE_PROTO;
+	}
+
+	interface_set_route_info(iface, route);
 	vlist_add(&ip->route, &route->node, route);
 	return;
 
@@ -440,28 +466,49 @@ static void
 interface_handle_subnet_route(struct interface *iface, struct device_addr *addr, bool add)
 {
 	struct device *dev = iface->l3_dev.dev;
-	struct device_route route;
+	struct device_route *r = &addr->subnet;
 
-	memset(&route, 0, sizeof(route));
-	route.iface = iface;
-	route.flags = addr->flags;
-	route.mask = addr->mask;
-	memcpy(&route.addr, &addr->addr, sizeof(route.addr));
-	clear_if_addr(&route.addr, route.mask);
-
-	if (add) {
-		route.flags |= DEVADDR_KERNEL;
-		system_del_route(dev, &route);
-
-		if (!(addr->flags & DEVADDR_OFFLINK)) {
-			route.flags &= ~DEVADDR_KERNEL;
-			route.metric = iface->metric;
-			system_add_route(dev, &route);
-		}
-	} else {
-		if (!(addr->flags & DEVADDR_OFFLINK))
-			system_del_route(dev, &route);
+	if (addr->flags & DEVADDR_OFFLINK)
+		return;
+
+	if (!add) {
+		if (!addr->subnet.iface)
+			return;
+
+		system_del_route(dev, r);
+		memset(r, 0, sizeof(*r));
+		return;
 	}
+
+	r->iface = iface;
+	r->flags = addr->flags;
+	r->mask = addr->mask;
+	memcpy(&r->addr, &addr->addr, sizeof(r->addr));
+	clear_if_addr(&r->addr, r->mask);
+
+	if (!system_resolve_rt_proto("kernel", &r->proto))
+		return;
+
+	r->flags |= DEVROUTE_PROTO;
+	system_del_route(dev, r);
+
+	r->flags &= ~DEVROUTE_PROTO;
+	interface_set_route_info(iface, r);
+
+	system_add_route(dev, r);
+}
+
+static void
+interface_add_addr_rules(struct device_addr *addr, bool enabled)
+{
+	bool v6 = (addr->flags & DEVADDR_FAMILY) == DEVADDR_INET6;
+
+	set_ip_source_policy(enabled, v6, IPRULE_PRIORITY_ADDR, &addr->addr,
+			     (v6) ? 128 : 32, addr->policy_table, NULL, NULL,
+			     true);
+	set_ip_source_policy(enabled, v6, IPRULE_PRIORITY_ADDR_MASK,
+			     &addr->addr, addr->mask, addr->policy_table, NULL,
+			     NULL, false);
 }
 
 static void
@@ -490,11 +537,17 @@ interface_update_proto_addr(struct vlist_tree *tree,
 		if ((a_new->flags & DEVADDR_FAMILY) == DEVADDR_INET4 &&
 		    !a_new->broadcast) {
 
-			uint32_t mask = ~0;
-			uint32_t *a = (uint32_t *) &a_new->addr;
+			/* /31 and /32 addressing need 255.255.255.255
+			 * as broadcast address. */
+			if (a_new->mask >= 31) {
+				a_new->broadcast = (uint32_t) ~0;
+			} else {
+				uint32_t mask = ~0;
+				uint32_t *a = (uint32_t *) &a_new->addr;
 
-			mask >>= a_new->mask;
-			a_new->broadcast = *a | htonl(mask);
+				mask >>= a_new->mask;
+				a_new->broadcast = *a | htonl(mask);
+			}
 		}
 	}
 
@@ -511,32 +564,25 @@ interface_update_proto_addr(struct vlist_tree *tree,
 				a_old->preferred_until != a_new->preferred_until)
 			replace = true;
 
-		if ((a_new->flags & DEVADDR_FAMILY) == DEVADDR_INET4 &&
-		    a_new->broadcast != a_old->broadcast)
+		if (((a_new->flags & DEVADDR_FAMILY) == DEVADDR_INET4) &&
+		     (a_new->broadcast != a_old->broadcast ||
+		      a_new->point_to_point != a_old->point_to_point))
 			keep = false;
 	}
 
 	if (node_old) {
-		if (!(a_old->flags & DEVADDR_EXTERNAL) && a_old->enabled && !keep) {
-			interface_handle_subnet_route(iface, a_old, false);
-
-			if ((a_old->flags & DEVADDR_FAMILY) == DEVADDR_INET6)
-				v6 = true;
-
-			unsigned int table = (v6) ? iface->ip6table : iface->ip4table;
-
+		if (a_old->enabled && !keep) {
 			//This is needed for source routing to work correctly. If a device
 			//has two connections to a network using the same subnet, adding
 			//only the network-rule will cause packets to be routed through the
 			//first matching network (source IP matches both masks).
-			if (table) {
-				set_ip_source_policy(false, v6, IPRULE_PRIORITY_ADDR, &a_old->addr,
-						(v6) ? 128 : 32, table, NULL, NULL);
-				set_ip_source_policy(false, v6, IPRULE_PRIORITY_NW, &a_old->addr,
-						a_old->mask, table, NULL, NULL);
-			}
+			if (a_old->policy_table)
+				interface_add_addr_rules(a_old, false);
 
-			system_del_address(dev, a_old);
+			if (!(a_old->flags & DEVADDR_EXTERNAL)) {
+				interface_handle_subnet_route(iface, a_old, false);
+				system_del_address(dev, a_old);
+			}
 		}
 		free(a_old->pclass);
 		free(a_old);
@@ -544,26 +590,25 @@ interface_update_proto_addr(struct vlist_tree *tree,
 
 	if (node_new) {
 		a_new->enabled = true;
-		if (!(a_new->flags & DEVADDR_EXTERNAL) && (!keep || replace)) {
-			if (system_add_address(dev, a_new))
-				a_new->failed = true;
 
-			if (!keep) {
-				if ((a_new->flags & DEVADDR_FAMILY) == DEVADDR_INET6)
-					v6 = true;
+		if ((a_new->flags & DEVADDR_FAMILY) == DEVADDR_INET6)
+				v6 = true;
 
-				unsigned int table = (v6) ? iface->ip6table : iface->ip4table;
+		a_new->policy_table = (v6) ? iface->ip6table : iface->ip4table;
 
-				if (table) {
-					set_ip_source_policy(true, v6, IPRULE_PRIORITY_ADDR, &a_new->addr,
-							(v6) ? 128 : 32, table, NULL, NULL);
-					set_ip_source_policy(true, v6, IPRULE_PRIORITY_NW, &a_new->addr,
-							a_new->mask, table, NULL, NULL);
-				}
+		if (!keep || replace) {
+			if (!(a_new->flags & DEVADDR_EXTERNAL)) {
+				if (system_add_address(dev, a_new))
+					a_new->failed = true;
+
+				if (iface->metric || a_new->policy_table)
+					interface_handle_subnet_route(iface, a_new, true);
 			}
 
-			if ((a_new->flags & DEVADDR_OFFLINK) || iface->metric)
-				interface_handle_subnet_route(iface, a_new, true);
+			if (!keep) {
+				if (a_new->policy_table)
+					interface_add_addr_rules(a_new, true);
+			}
 		}
 	}
 }
@@ -601,7 +646,7 @@ interface_update_proto_route(struct vlist_tree *tree,
 	if (node_old && node_new)
 		keep = !memcmp(&route_old->nexthop, &route_new->nexthop, sizeof(route_old->nexthop)) &&
 			(route_old->mtu == route_new->mtu) && (route_old->type == route_new->type) &&
-			(route_old->valid_until == route_new->valid_until) && !route_old->failed;
+			(route_old->proto == route_new->proto) && !route_old->failed;
 
 	if (node_old) {
 		if (!(route_old->flags & DEVADDR_EXTERNAL) && route_old->enabled && !keep)
@@ -665,9 +710,16 @@ random_ifaceid(struct in6_addr *addr)
 	addr->s6_addr32[3] = (uint32_t)mrand48();
 }
 
-static void
+static bool
 eui64_ifaceid(struct interface *iface, struct in6_addr *addr)
 {
+	struct device_settings st;
+
+	device_merge_settings(iface->l3_dev.dev, &st);
+
+	if (!(st.flags & DEV_OPT_MACADDR))
+		return false;
+
 	/* get mac address */
 	uint8_t *macaddr = iface->l3_dev.dev->settings.macaddr;
 	uint8_t *ifaceid = addr->s6_addr + 8;
@@ -676,11 +728,15 @@ eui64_ifaceid(struct interface *iface, struct in6_addr *addr)
 	ifaceid[3] = 0xff;
 	ifaceid[4] = 0xfe;
 	ifaceid[0] ^= 0x02;
+
+	return true;
 }
 
-static void
+static bool
 generate_ifaceid(struct interface *iface, struct in6_addr *addr)
 {
+	bool ret = true;
+
 	/* generate new iface id */
 	switch (iface->assignment_iface_id_selection) {
 	case IFID_FIXED:
@@ -694,9 +750,13 @@ generate_ifaceid(struct interface *iface, struct in6_addr *addr)
 		break;
 	case IFID_EUI64:
 		/* eui64 */
-		eui64_ifaceid(iface, addr);
+		ret = eui64_ifaceid(iface, addr);
+		break;
+	default:
+		ret = false;
 		break;
 	}
+	return ret;
 }
 
 static void
@@ -710,74 +770,87 @@ interface_set_prefix_address(struct device_prefix_assignment *assignment,
 	struct device *l3_downlink = iface->l3_dev.dev;
 
 	struct device_addr addr;
+	struct device_route route;
 	memset(&addr, 0, sizeof(addr));
+	memset(&route, 0, sizeof(route));
 
-	if (IN6_IS_ADDR_UNSPECIFIED(&assignment->addr)) {
-		addr.addr.in6 = prefix->addr;
-		addr.addr.in6.s6_addr32[1] |= htonl(assignment->assigned);
-		generate_ifaceid(iface, &addr.addr.in6);
-		assignment->addr = addr.addr.in6;
-	}
-	else
-		addr.addr.in6 = assignment->addr;
-
+	addr.addr.in6 = assignment->addr;
 	addr.mask = assignment->length;
-	addr.flags = DEVADDR_INET6;
+	addr.flags = DEVADDR_INET6 | DEVADDR_OFFLINK;
 	addr.preferred_until = prefix->preferred_until;
 	addr.valid_until = prefix->valid_until;
 
-	if (addr.mask < 64) {
-		addr.mask = 64;
-		system_del_address(l3_downlink, &addr);
-		addr.mask = assignment->length;
-	}
+	route.flags = DEVADDR_INET6;
+	route.mask = addr.mask < 64 ? 64 : addr.mask;
+	route.addr = addr.addr;
 
 	if (!add && assignment->enabled) {
 		time_t now = system_get_rtime();
+
 		addr.preferred_until = now;
 		if (!addr.valid_until || addr.valid_until - now > 7200)
 			addr.valid_until = now + 7200;
 
-		system_del_address(l3_downlink, &addr); // Work around dangling prefix routes
+		if (iface->ip6table)
+			set_ip_source_policy(false, true, IPRULE_PRIORITY_ADDR_MASK, &addr.addr,
+					addr.mask < 64 ? 64 : addr.mask, iface->ip6table, NULL, NULL, false);
 
 		if (prefix->iface) {
 			if (prefix->iface->ip6table)
 				set_ip_source_policy(false, true, IPRULE_PRIORITY_NW, &addr.addr,
-						addr.mask, prefix->iface->ip6table, iface, NULL);
+						addr.mask, prefix->iface->ip6table, iface, NULL, true);
 
 			set_ip_source_policy(false, true, IPRULE_PRIORITY_REJECT, &addr.addr,
-							addr.mask, 0, iface, "unreachable");
+							addr.mask, 0, iface, "unreachable", true);
 		}
 
-		if (addr.mask < 64)
-			addr.mask = 64;
+		clear_if_addr(&route.addr, route.mask);
+		interface_set_route_info(iface, &route);
 
-		interface_handle_subnet_route(iface, &addr, false);
+		system_del_route(l3_downlink, &route);
 		system_add_address(l3_downlink, &addr);
 
+		assignment->addr = in6addr_any;
 		assignment->enabled = false;
-	} else if (add && (iface->state == IFS_UP || iface->state == IFS_SETUP) &&
-			!system_add_address(l3_downlink, &addr)) {
-		interface_handle_subnet_route(iface, &addr, false);
+	} else if (add && (iface->state == IFS_UP || iface->state == IFS_SETUP)) {
+		if (IN6_IS_ADDR_UNSPECIFIED(&addr.addr.in6)) {
+			addr.addr.in6 = prefix->addr;
+			addr.addr.in6.s6_addr32[1] |= htonl(assignment->assigned);
+			if (!generate_ifaceid(iface, &addr.addr.in6))
+				return;
+
+			assignment->addr = addr.addr.in6;
+			route.addr = addr.addr;
+		}
 
-		if (prefix->iface && !assignment->enabled) {
-			set_ip_source_policy(true, true, IPRULE_PRIORITY_REJECT, &addr.addr,
-					addr.mask, 0, iface, "unreachable");
+		if (system_add_address(l3_downlink, &addr))
+			return;
 
-			if (prefix->iface->ip6table)
-				set_ip_source_policy(true, true, IPRULE_PRIORITY_NW, &addr.addr,
-						addr.mask, prefix->iface->ip6table, iface, NULL);
+		if (!assignment->enabled) {
+			if (iface->ip6table)
+				set_ip_source_policy(true, true, IPRULE_PRIORITY_ADDR_MASK, &addr.addr,
+						addr.mask < 64 ? 64 : addr.mask, iface->ip6table, NULL, NULL, false);
+
+			if (prefix->iface) {
+				set_ip_source_policy(true, true, IPRULE_PRIORITY_REJECT, &addr.addr,
+						addr.mask, 0, iface, "unreachable", true);
+
+				if (prefix->iface->ip6table)
+					set_ip_source_policy(true, true, IPRULE_PRIORITY_NW, &addr.addr,
+							addr.mask, prefix->iface->ip6table, iface, NULL, true);
+			}
 		}
 
-		if (addr.mask < 64)
-			addr.mask = 64;
+		clear_if_addr(&route.addr, route.mask);
+		interface_set_route_info(iface, &route);
+
+		system_add_route(l3_downlink, &route);
 
-		interface_handle_subnet_route(iface, &addr, true);
+		if (uplink && uplink->l3_dev.dev && !(l3_downlink->settings.flags & DEV_OPT_MTU6)) {
+			int mtu = system_update_ipv6_mtu(uplink->l3_dev.dev, 0);
+			int mtu_old = system_update_ipv6_mtu(l3_downlink, 0);
 
-		if (uplink && uplink->l3_dev.dev) {
-			int mtu = system_update_ipv6_mtu(
-					uplink->l3_dev.dev, 0);
-			if (mtu > 0)
+			if (mtu > 0 && mtu_old > mtu)
 				system_update_ipv6_mtu(l3_downlink, mtu);
 		}
 
@@ -809,6 +882,25 @@ static bool interface_prefix_assign(struct list_head *list,
 	return false;
 }
 
+/*
+ * Sorting of assignment entries:
+ * Primary on assignment length: smallest assignment first
+ * Secondary on assignment weight: highest weight first
+ * Finally alphabetical order of interface names
+ */
+static int prefix_assignment_cmp(const void *k1, const void *k2, void *ptr)
+{
+	const struct device_prefix_assignment *a1 = k1, *a2 = k2;
+
+	if (a1->length != a2->length)
+		return a1->length - a2->length;
+
+	if (a1->weight != a2->weight)
+		return a2->weight - a1->weight;
+
+	return strcmp(a1->name, a2->name);
+}
+
 static void interface_update_prefix_assignments(struct device_prefix *prefix, bool setup)
 {
 	struct device_prefix_assignment *c;
@@ -829,6 +921,9 @@ static void interface_update_prefix_assignments(struct device_prefix *prefix, bo
 
 	// End-of-assignment sentinel
 	c = malloc(sizeof(*c) + 1);
+	if (!c)
+		return;
+
 	c->assigned = 1 << (64 - prefix->length);
 	c->length = 64;
 	c->name[0] = 0;
@@ -839,16 +934,24 @@ static void interface_update_prefix_assignments(struct device_prefix *prefix, bo
 	if (prefix->excl_length > 0) {
 		const char name[] = "!excluded";
 		c = malloc(sizeof(*c) + sizeof(name));
-		c->assigned = ntohl(prefix->excl_addr.s6_addr32[1]) &
-				((1 << (64 - prefix->length)) - 1);
-		c->length = prefix->excl_length;
-		c->addr = in6addr_any;
-		memcpy(c->name, name, sizeof(name));
-		list_add(&c->head, &prefix->assignments);
+		if (c) {
+			c->assigned = ntohl(prefix->excl_addr.s6_addr32[1]) &
+					((1 << (64 - prefix->length)) - 1);
+			c->length = prefix->excl_length;
+			c->addr = in6addr_any;
+			memcpy(c->name, name, sizeof(name));
+			list_add(&c->head, &prefix->assignments);
+		}
 	}
 
 	bool assigned_any = false;
-	struct list_head assign_later = LIST_HEAD_INIT(assign_later);
+	struct {
+		struct avl_node node;
+	} *entry, *n_entry;
+	struct avl_tree assign_later;
+
+	avl_init(&assign_later, prefix_assignment_cmp, false, NULL);
+
 	vlist_for_each_element(&interfaces, iface, node) {
 		if (iface->assignment_length < 48 ||
 				iface->assignment_length > 64)
@@ -872,8 +975,12 @@ static void interface_update_prefix_assignments(struct device_prefix *prefix, bo
 
 		size_t namelen = strlen(iface->name) + 1;
 		c = malloc(sizeof(*c) + namelen);
+		if (!c)
+			continue;
+
 		c->length = iface->assignment_length;
 		c->assigned = iface->assignment_hint;
+		c->weight = iface->assignment_weight;
 		c->addr = in6addr_any;
 		c->enabled = false;
 		memcpy(c->name, iface->name, namelen);
@@ -886,27 +993,27 @@ static void interface_update_prefix_assignments(struct device_prefix *prefix, bo
 						"of size %hhu for %s, trying other\n", c->length, c->name);
 			}
 
-			struct list_head *next = &assign_later;
-			struct device_prefix_assignment *n;
-			list_for_each_entry(n, &assign_later, head) {
-				if (n->length < c->length) {
-					next = &n->head;
-					break;
-				}
+			entry = calloc(1, sizeof(*entry));
+			if (!entry) {
+				free(c);
+				continue;
 			}
-			list_add_tail(&c->head, next);
+
+			entry->node.key = c;
+			avl_insert(&assign_later, &entry->node);
 		}
 
 		if (c->assigned != -1)
 			assigned_any = true;
 	}
 
-	// Then try to assign all other + failed custom assignments
-	while (!list_empty(&assign_later)) {
-		c = list_first_entry(&assign_later, struct device_prefix_assignment, head);
-		list_del(&c->head);
-
+	/* Then try to assign all other + failed custom assignments */
+	avl_for_each_element_safe(&assign_later, entry, node, n_entry) {
 		bool assigned = false;
+
+		c = (struct device_prefix_assignment *)entry->node.key;
+		avl_delete(&assign_later, &entry->node);
+
 		do {
 			assigned = interface_prefix_assign(&prefix->assignments, c);
 		} while (!assigned && ++c->length <= 64);
@@ -915,9 +1022,10 @@ static void interface_update_prefix_assignments(struct device_prefix *prefix, bo
 			netifd_log_message(L_WARNING, "Failed to assign subprefix "
 					"of size %hhu for %s\n", c->length, c->name);
 			free(c);
-		} else {
+		} else
 			assigned_any = true;
-		}
+
+		free(entry);
 	}
 
 	list_for_each_entry(c, &prefix->assignments, head)
@@ -973,6 +1081,10 @@ interface_update_prefix(struct vlist_tree *tree,
 		list_for_each_entry(c, &prefix_new->assignments, head)
 			if ((iface = vlist_find(&interfaces, c->name, iface, node)))
 				interface_set_prefix_address(c, prefix_new, iface, true);
+
+		if (prefix_new->preferred_until != prefix_old->preferred_until ||
+				prefix_new->valid_until != prefix_old->valid_until)
+			ip->iface->updated |= IUF_PREFIX;
 	} else if (node_new) {
 		// Set null-route to avoid routing loops
 		system_add_route(NULL, &route);
@@ -1005,6 +1117,9 @@ interface_ip_add_device_prefix(struct interface *iface, struct in6_addr *addr,
 		pclass = (iface) ? iface->name : "local";
 
 	struct device_prefix *prefix = calloc(1, sizeof(*prefix) + strlen(pclass) + 1);
+	if (!prefix)
+		return NULL;
+
 	prefix->length = length;
 	prefix->addr = *addr;
 	prefix->preferred_until = preferred_until;
@@ -1158,21 +1273,33 @@ write_resolv_conf_entries(FILE *f, struct interface_ip_settings *ip, const char
 	}
 }
 
-void
-interface_write_resolv_conf(void)
+/* Sorting of interface resolver entries :               */
+/* Primary on interface dns_metric : lowest metric first */
+/* Secondary on interface metric : lowest metric first   */
+/* Finally alphabetical order of interface names         */
+static int resolv_conf_iface_cmp(const void *k1, const void *k2, void *ptr)
+{
+	const struct interface *iface1 = k1, *iface2 = k2;
+
+	if (iface1->dns_metric != iface2->dns_metric)
+		return iface1->dns_metric - iface2->dns_metric;
+
+	if (iface1->metric != iface2->metric)
+		return iface1->metric - iface2->metric;
+
+	return strcmp(iface1->name, iface2->name);
+}
+
+static void
+__interface_write_dns_entries(FILE *f)
 {
 	struct interface *iface;
-	char *path = alloca(strlen(resolv_conf) + 5);
-	FILE *f;
-	uint32_t crcold, crcnew;
+	struct {
+		struct avl_node node;
+	} *entry, *n_entry;
+	struct avl_tree resolv_conf_iface_entries;
 
-	sprintf(path, "%s.tmp", resolv_conf);
-	unlink(path);
-	f = fopen(path, "w+");
-	if (!f) {
-		D(INTERFACE, "Failed to open %s for writing\n", path);
-		return;
-	}
+	avl_init(&resolv_conf_iface_entries, resolv_conf_iface_cmp, false, NULL);
 
 	vlist_for_each_element(&interfaces, iface, node) {
 		if (iface->state != IFS_UP)
@@ -1180,15 +1307,51 @@ interface_write_resolv_conf(void)
 
 		if (vlist_simple_empty(&iface->proto_ip.dns_search) &&
 		    vlist_simple_empty(&iface->proto_ip.dns_servers) &&
-			vlist_simple_empty(&iface->config_ip.dns_search) &&
+		    vlist_simple_empty(&iface->config_ip.dns_search) &&
 		    vlist_simple_empty(&iface->config_ip.dns_servers))
 			continue;
 
+		entry = calloc(1, sizeof(*entry));
+		if (!entry)
+			continue;
+
+		entry->node.key = iface;
+		avl_insert(&resolv_conf_iface_entries, &entry->node);
+	}
+
+	avl_for_each_element(&resolv_conf_iface_entries, entry, node) {
+		iface = (struct interface *)entry->node.key;
+		struct device *dev = iface->l3_dev.dev;
+
 		fprintf(f, "# Interface %s\n", iface->name);
-		write_resolv_conf_entries(f, &iface->config_ip, iface->ifname);
+
+		write_resolv_conf_entries(f, &iface->config_ip, dev->ifname);
+
 		if (!iface->proto_ip.no_dns)
-			write_resolv_conf_entries(f, &iface->proto_ip, iface->ifname);
+			write_resolv_conf_entries(f, &iface->proto_ip, dev->ifname);
+	}
+
+	avl_remove_all_elements(&resolv_conf_iface_entries, entry, node, n_entry)
+		free(entry);
+}
+
+void
+interface_write_resolv_conf(void)
+{
+	char *path = alloca(strlen(resolv_conf) + 5);
+	FILE *f;
+	uint32_t crcold, crcnew;
+
+	sprintf(path, "%s.tmp", resolv_conf);
+	unlink(path);
+	f = fopen(path, "w+");
+	if (!f) {
+		D(INTERFACE, "Failed to open %s for writing\n", path);
+		return;
 	}
+
+	__interface_write_dns_entries(f);
+
 	fflush(f);
 	rewind(f);
 	crcnew = crc32_file(f);
@@ -1223,16 +1386,29 @@ void interface_ip_set_enabled(struct interface_ip_settings *ip, bool enabled)
 		return;
 
 	vlist_for_each_element(&ip->addr, addr, node) {
+		bool v6 = ((addr->flags & DEVADDR_FAMILY) == DEVADDR_INET6) ? true : false;
+
+		if (addr->flags & DEVADDR_EXTERNAL)
+			continue;
+
 		if (addr->enabled == enabled)
 			continue;
 
 		if (enabled) {
 			system_add_address(dev, addr);
-			if ((addr->flags & DEVADDR_OFFLINK) || iface->metric)
+
+			addr->policy_table = (v6) ? iface->ip6table : iface->ip4table;
+			if (iface->metric || addr->policy_table)
 				interface_handle_subnet_route(iface, addr, true);
+
+			if (addr->policy_table)
+				interface_add_addr_rules(addr, true);
 		} else {
 			interface_handle_subnet_route(iface, addr, false);
 			system_del_address(dev, addr);
+
+			if (addr->policy_table)
+				interface_add_addr_rules(addr, false);
 		}
 		addr->enabled = enabled;
 	}
@@ -1240,6 +1416,9 @@ void interface_ip_set_enabled(struct interface_ip_settings *ip, bool enabled)
 	vlist_for_each_element(&ip->route, route, node) {
 		bool _enabled = enabled;
 
+		if (route->flags & DEVADDR_EXTERNAL)
+			continue;
+
 		if (!enable_route(ip, route))
 			_enabled = false;
 
@@ -1247,8 +1426,7 @@ void interface_ip_set_enabled(struct interface_ip_settings *ip, bool enabled)
 			continue;
 
 		if (_enabled) {
-			if (!(route->flags & DEVROUTE_METRIC))
-				route->metric = ip->iface->metric;
+			interface_set_route_info(ip->iface, route);
 
 			if (system_add_route(dev, route))
 				route->failed = true;
@@ -1264,12 +1442,14 @@ void interface_ip_set_enabled(struct interface_ip_settings *ip, bool enabled)
 			if (!strcmp(a->name, ip->iface->name))
 				interface_set_prefix_address(a, c, ip->iface, enabled);
 
-	if (ip->iface && ip->iface->l3_dev.dev) {
+	if (ip->iface->policy_rules_set != enabled &&
+	    ip->iface->l3_dev.dev) {
 		set_ip_lo_policy(enabled, true, ip->iface);
 		set_ip_lo_policy(enabled, false, ip->iface);
 
 		set_ip_source_policy(enabled, true, IPRULE_PRIORITY_REJECT + ip->iface->l3_dev.dev->ifindex,
-			NULL, 0, 0, ip->iface, "failed_policy");
+			NULL, 0, 0, ip->iface, "failed_policy", true);
+		ip->iface->policy_rules_set = enabled;
 	}
 }