xref: /freebsd/sys/net/route.c (revision 472ced39efb537374068f06b348fe5dac389c45a)
1 /*-
2  * SPDX-License-Identifier: BSD-3-Clause
3  *
4  * Copyright (c) 1980, 1986, 1991, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. Neither the name of the University nor the names of its contributors
16  *    may be used to endorse or promote products derived from this software
17  *    without specific prior written permission.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29  * SUCH DAMAGE.
30  *
31  *	@(#)route.c	8.3.1.1 (Berkeley) 2/23/95
32  * $FreeBSD$
33  */
34 /************************************************************************
35  * Note: In this file a 'fib' is a "forwarding information base"	*
36  * Which is the new name for an in kernel routing (next hop) table.	*
37  ***********************************************************************/
38 
39 #include "opt_inet.h"
40 #include "opt_inet6.h"
41 #include "opt_mrouting.h"
42 #include "opt_mpath.h"
43 #include "opt_route.h"
44 
45 #include <sys/param.h>
46 #include <sys/systm.h>
47 #include <sys/malloc.h>
48 #include <sys/mbuf.h>
49 #include <sys/socket.h>
50 #include <sys/sysctl.h>
51 #include <sys/syslog.h>
52 #include <sys/sysproto.h>
53 #include <sys/proc.h>
54 #include <sys/domain.h>
55 #include <sys/eventhandler.h>
56 #include <sys/kernel.h>
57 #include <sys/lock.h>
58 #include <sys/rmlock.h>
59 
60 #include <net/if.h>
61 #include <net/if_var.h>
62 #include <net/if_dl.h>
63 #include <net/route.h>
64 #include <net/route_var.h>
65 #include <net/route/nhop.h>
66 #include <net/route/shared.h>
67 #include <net/vnet.h>
68 
69 #ifdef RADIX_MPATH
70 #include <net/radix_mpath.h>
71 #endif
72 
73 #include <netinet/in.h>
74 #include <netinet/ip_mroute.h>
75 
76 #include <vm/uma.h>
77 
78 #define	RT_MAXFIBS	UINT16_MAX
79 
80 /* Kernel config default option. */
81 #ifdef ROUTETABLES
82 #if ROUTETABLES <= 0
83 #error "ROUTETABLES defined too low"
84 #endif
85 #if ROUTETABLES > RT_MAXFIBS
86 #error "ROUTETABLES defined too big"
87 #endif
88 #define	RT_NUMFIBS	ROUTETABLES
89 #endif /* ROUTETABLES */
90 /* Initialize to default if not otherwise set. */
91 #ifndef	RT_NUMFIBS
92 #define	RT_NUMFIBS	1
93 #endif
94 
95 /* This is read-only.. */
96 u_int rt_numfibs = RT_NUMFIBS;
97 SYSCTL_UINT(_net, OID_AUTO, fibs, CTLFLAG_RDTUN, &rt_numfibs, 0, "");
98 
99 /*
100  * By default add routes to all fibs for new interfaces.
101  * Once this is set to 0 then only allocate routes on interface
102  * changes for the FIB of the caller when adding a new set of addresses
103  * to an interface.  XXX this is a shotgun aproach to a problem that needs
104  * a more fine grained solution.. that will come.
105  * XXX also has the problems getting the FIB from curthread which will not
106  * always work given the fib can be overridden and prefixes can be added
107  * from the network stack context.
108  */
109 VNET_DEFINE(u_int, rt_add_addr_allfibs) = 1;
110 SYSCTL_UINT(_net, OID_AUTO, add_addr_allfibs, CTLFLAG_RWTUN | CTLFLAG_VNET,
111     &VNET_NAME(rt_add_addr_allfibs), 0, "");
112 
113 VNET_PCPUSTAT_DEFINE(struct rtstat, rtstat);
114 
115 VNET_PCPUSTAT_SYSINIT(rtstat);
116 #ifdef VIMAGE
117 VNET_PCPUSTAT_SYSUNINIT(rtstat);
118 #endif
119 
120 VNET_DEFINE(struct rib_head *, rt_tables);
121 #define	V_rt_tables	VNET(rt_tables)
122 
123 VNET_DEFINE(int, rttrash);		/* routes not in table but not freed */
124 #define	V_rttrash	VNET(rttrash)
125 
126 
127 /*
128  * Convert a 'struct radix_node *' to a 'struct rtentry *'.
129  * The operation can be done safely (in this code) because a
130  * 'struct rtentry' starts with two 'struct radix_node''s, the first
131  * one representing leaf nodes in the routing tree, which is
132  * what the code in radix.c passes us as a 'struct radix_node'.
133  *
134  * But because there are a lot of assumptions in this conversion,
135  * do not cast explicitly, but always use the macro below.
136  */
137 #define RNTORT(p)	((struct rtentry *)(p))
138 
139 VNET_DEFINE_STATIC(uma_zone_t, rtzone);		/* Routing table UMA zone. */
140 #define	V_rtzone	VNET(rtzone)
141 
142 EVENTHANDLER_LIST_DEFINE(rt_addrmsg);
143 
144 static int rt_getifa_fib(struct rt_addrinfo *, u_int);
145 static void rt_setmetrics(const struct rt_addrinfo *, struct rtentry *);
146 static int rt_ifdelroute(const struct rtentry *rt, void *arg);
147 static struct rtentry *rt_unlinkrte(struct rib_head *rnh,
148     struct rt_addrinfo *info, int *perror);
149 static void rt_notifydelete(struct rtentry *rt, struct rt_addrinfo *info);
150 #ifdef RADIX_MPATH
151 static struct radix_node *rt_mpath_unlink(struct rib_head *rnh,
152     struct rt_addrinfo *info, struct rtentry *rto, int *perror);
153 #endif
154 static int rt_exportinfo(struct rtentry *rt, struct rt_addrinfo *info,
155     int flags);
156 
157 static int add_route(struct rib_head *rnh, struct rt_addrinfo *info,
158     struct rtentry **ret_nrt);
159 static int del_route(struct rib_head *rnh, struct rt_addrinfo *info,
160     struct rtentry **ret_nrt);
161 static int change_route(struct rib_head *, struct rt_addrinfo *,
162     struct rtentry **);
163 
164 struct if_mtuinfo
165 {
166 	struct ifnet	*ifp;
167 	int		mtu;
168 };
169 
170 static int	if_updatemtu_cb(struct radix_node *, void *);
171 
172 /*
173  * handler for net.my_fibnum
174  */
175 static int
176 sysctl_my_fibnum(SYSCTL_HANDLER_ARGS)
177 {
178         int fibnum;
179         int error;
180 
181         fibnum = curthread->td_proc->p_fibnum;
182         error = sysctl_handle_int(oidp, &fibnum, 0, req);
183         return (error);
184 }
185 
186 SYSCTL_PROC(_net, OID_AUTO, my_fibnum,
187     CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0,
188     &sysctl_my_fibnum, "I",
189     "default FIB of caller");
190 
191 static __inline struct rib_head **
192 rt_tables_get_rnh_ptr(int table, int fam)
193 {
194 	struct rib_head **rnh;
195 
196 	KASSERT(table >= 0 && table < rt_numfibs,
197 	    ("%s: table out of bounds (0 <= %d < %d)", __func__, table,
198 	     rt_numfibs));
199 	KASSERT(fam >= 0 && fam < (AF_MAX + 1),
200 	    ("%s: fam out of bounds (0 <= %d < %d)", __func__, fam, AF_MAX+1));
201 
202 	/* rnh is [fib=0][af=0]. */
203 	rnh = (struct rib_head **)V_rt_tables;
204 	/* Get the offset to the requested table and fam. */
205 	rnh += table * (AF_MAX+1) + fam;
206 
207 	return (rnh);
208 }
209 
210 struct rib_head *
211 rt_tables_get_rnh(int table, int fam)
212 {
213 
214 	return (*rt_tables_get_rnh_ptr(table, fam));
215 }
216 
217 u_int
218 rt_tables_get_gen(int table, int fam)
219 {
220 	struct rib_head *rnh;
221 
222 	rnh = *rt_tables_get_rnh_ptr(table, fam);
223 	KASSERT(rnh != NULL, ("%s: NULL rib_head pointer table %d fam %d",
224 	    __func__, table, fam));
225 	return (rnh->rnh_gen);
226 }
227 
228 
229 /*
230  * route initialization must occur before ip6_init2(), which happenas at
231  * SI_ORDER_MIDDLE.
232  */
233 static void
234 route_init(void)
235 {
236 
237 	/* whack the tunable ints into  line. */
238 	if (rt_numfibs > RT_MAXFIBS)
239 		rt_numfibs = RT_MAXFIBS;
240 	if (rt_numfibs == 0)
241 		rt_numfibs = 1;
242 	nhops_init();
243 }
244 SYSINIT(route_init, SI_SUB_PROTO_DOMAIN, SI_ORDER_THIRD, route_init, NULL);
245 
246 static int
247 rtentry_zinit(void *mem, int size, int how)
248 {
249 	struct rtentry *rt = mem;
250 
251 	rt->rt_pksent = counter_u64_alloc(how);
252 	if (rt->rt_pksent == NULL)
253 		return (ENOMEM);
254 
255 	RT_LOCK_INIT(rt);
256 
257 	return (0);
258 }
259 
260 static void
261 rtentry_zfini(void *mem, int size)
262 {
263 	struct rtentry *rt = mem;
264 
265 	RT_LOCK_DESTROY(rt);
266 	counter_u64_free(rt->rt_pksent);
267 }
268 
269 static int
270 rtentry_ctor(void *mem, int size, void *arg, int how)
271 {
272 	struct rtentry *rt = mem;
273 
274 	bzero(rt, offsetof(struct rtentry, rt_endzero));
275 	counter_u64_zero(rt->rt_pksent);
276 	rt->rt_chain = NULL;
277 
278 	return (0);
279 }
280 
281 static void
282 rtentry_dtor(void *mem, int size, void *arg)
283 {
284 	struct rtentry *rt = mem;
285 
286 	RT_UNLOCK_COND(rt);
287 }
288 
289 static void
290 vnet_route_init(const void *unused __unused)
291 {
292 	struct domain *dom;
293 	struct rib_head **rnh;
294 	int table;
295 	int fam;
296 
297 	V_rt_tables = malloc(rt_numfibs * (AF_MAX+1) *
298 	    sizeof(struct rib_head *), M_RTABLE, M_WAITOK|M_ZERO);
299 
300 	V_rtzone = uma_zcreate("rtentry", sizeof(struct rtentry),
301 	    rtentry_ctor, rtentry_dtor,
302 	    rtentry_zinit, rtentry_zfini, UMA_ALIGN_PTR, 0);
303 	for (dom = domains; dom; dom = dom->dom_next) {
304 		if (dom->dom_rtattach == NULL)
305 			continue;
306 
307 		for  (table = 0; table < rt_numfibs; table++) {
308 			fam = dom->dom_family;
309 			if (table != 0 && fam != AF_INET6 && fam != AF_INET)
310 				break;
311 
312 			rnh = rt_tables_get_rnh_ptr(table, fam);
313 			if (rnh == NULL)
314 				panic("%s: rnh NULL", __func__);
315 			dom->dom_rtattach((void **)rnh, 0, table);
316 		}
317 	}
318 }
319 VNET_SYSINIT(vnet_route_init, SI_SUB_PROTO_DOMAIN, SI_ORDER_FOURTH,
320     vnet_route_init, 0);
321 
322 #ifdef VIMAGE
323 static void
324 vnet_route_uninit(const void *unused __unused)
325 {
326 	int table;
327 	int fam;
328 	struct domain *dom;
329 	struct rib_head **rnh;
330 
331 	for (dom = domains; dom; dom = dom->dom_next) {
332 		if (dom->dom_rtdetach == NULL)
333 			continue;
334 
335 		for (table = 0; table < rt_numfibs; table++) {
336 			fam = dom->dom_family;
337 
338 			if (table != 0 && fam != AF_INET6 && fam != AF_INET)
339 				break;
340 
341 			rnh = rt_tables_get_rnh_ptr(table, fam);
342 			if (rnh == NULL)
343 				panic("%s: rnh NULL", __func__);
344 			dom->dom_rtdetach((void **)rnh, 0);
345 		}
346 	}
347 
348 	free(V_rt_tables, M_RTABLE);
349 	uma_zdestroy(V_rtzone);
350 }
351 VNET_SYSUNINIT(vnet_route_uninit, SI_SUB_PROTO_DOMAIN, SI_ORDER_FIRST,
352     vnet_route_uninit, 0);
353 #endif
354 
355 struct rib_head *
356 rt_table_init(int offset, int family, u_int fibnum)
357 {
358 	struct rib_head *rh;
359 
360 	rh = malloc(sizeof(struct rib_head), M_RTABLE, M_WAITOK | M_ZERO);
361 
362 	/* TODO: These details should be hidded inside radix.c */
363 	/* Init masks tree */
364 	rn_inithead_internal(&rh->head, rh->rnh_nodes, offset);
365 	rn_inithead_internal(&rh->rmhead.head, rh->rmhead.mask_nodes, 0);
366 	rh->head.rnh_masks = &rh->rmhead;
367 
368 	/* Save metadata associated with this routing table. */
369 	rh->rib_family = family;
370 	rh->rib_fibnum = fibnum;
371 #ifdef VIMAGE
372 	rh->rib_vnet = curvnet;
373 #endif
374 
375 	tmproutes_init(rh);
376 
377 	/* Init locks */
378 	RIB_LOCK_INIT(rh);
379 
380 	nhops_init_rib(rh);
381 
382 	/* Finally, set base callbacks */
383 	rh->rnh_addaddr = rn_addroute;
384 	rh->rnh_deladdr = rn_delete;
385 	rh->rnh_matchaddr = rn_match;
386 	rh->rnh_lookup = rn_lookup;
387 	rh->rnh_walktree = rn_walktree;
388 	rh->rnh_walktree_from = rn_walktree_from;
389 
390 	return (rh);
391 }
392 
393 static int
394 rt_freeentry(struct radix_node *rn, void *arg)
395 {
396 	struct radix_head * const rnh = arg;
397 	struct radix_node *x;
398 
399 	x = (struct radix_node *)rn_delete(rn + 2, NULL, rnh);
400 	if (x != NULL)
401 		R_Free(x);
402 	return (0);
403 }
404 
405 void
406 rt_table_destroy(struct rib_head *rh)
407 {
408 
409 	tmproutes_destroy(rh);
410 
411 	rn_walktree(&rh->rmhead.head, rt_freeentry, &rh->rmhead.head);
412 
413 	nhops_destroy_rib(rh);
414 
415 	/* Assume table is already empty */
416 	RIB_LOCK_DESTROY(rh);
417 	free(rh, M_RTABLE);
418 }
419 
420 
421 #ifndef _SYS_SYSPROTO_H_
422 struct setfib_args {
423 	int     fibnum;
424 };
425 #endif
426 int
427 sys_setfib(struct thread *td, struct setfib_args *uap)
428 {
429 	if (uap->fibnum < 0 || uap->fibnum >= rt_numfibs)
430 		return EINVAL;
431 	td->td_proc->p_fibnum = uap->fibnum;
432 	return (0);
433 }
434 
435 /*
436  * Packet routing routines.
437  */
438 void
439 rtalloc_ign_fib(struct route *ro, u_long ignore, u_int fibnum)
440 {
441 	struct rtentry *rt;
442 
443 	if ((rt = ro->ro_rt) != NULL) {
444 		if (rt->rt_ifp != NULL && rt->rt_flags & RTF_UP)
445 			return;
446 		RTFREE(rt);
447 		ro->ro_rt = NULL;
448 	}
449 	ro->ro_rt = rtalloc1_fib(&ro->ro_dst, 1, ignore, fibnum);
450 	if (ro->ro_rt)
451 		RT_UNLOCK(ro->ro_rt);
452 }
453 
454 /*
455  * Look up the route that matches the address given
456  * Or, at least try.. Create a cloned route if needed.
457  *
458  * The returned route, if any, is locked.
459  */
460 struct rtentry *
461 rtalloc1(struct sockaddr *dst, int report, u_long ignflags)
462 {
463 
464 	return (rtalloc1_fib(dst, report, ignflags, RT_DEFAULT_FIB));
465 }
466 
467 struct rtentry *
468 rtalloc1_fib(struct sockaddr *dst, int report, u_long ignflags,
469 		    u_int fibnum)
470 {
471 	RIB_RLOCK_TRACKER;
472 	struct rib_head *rh;
473 	struct radix_node *rn;
474 	struct rtentry *newrt;
475 	struct rt_addrinfo info;
476 	int err = 0, msgtype = RTM_MISS;
477 
478 	KASSERT((fibnum < rt_numfibs), ("rtalloc1_fib: bad fibnum"));
479 	rh = rt_tables_get_rnh(fibnum, dst->sa_family);
480 	newrt = NULL;
481 	if (rh == NULL)
482 		goto miss;
483 
484 	/*
485 	 * Look up the address in the table for that Address Family
486 	 */
487 	if ((ignflags & RTF_RNH_LOCKED) == 0)
488 		RIB_RLOCK(rh);
489 #ifdef INVARIANTS
490 	else
491 		RIB_LOCK_ASSERT(rh);
492 #endif
493 	rn = rh->rnh_matchaddr(dst, &rh->head);
494 	if (rn && ((rn->rn_flags & RNF_ROOT) == 0)) {
495 		newrt = RNTORT(rn);
496 		RT_LOCK(newrt);
497 		RT_ADDREF(newrt);
498 		if ((ignflags & RTF_RNH_LOCKED) == 0)
499 			RIB_RUNLOCK(rh);
500 		return (newrt);
501 
502 	} else if ((ignflags & RTF_RNH_LOCKED) == 0)
503 		RIB_RUNLOCK(rh);
504 	/*
505 	 * Either we hit the root or could not find any match,
506 	 * which basically means: "cannot get there from here".
507 	 */
508 miss:
509 	RTSTAT_INC(rts_unreach);
510 
511 	if (report) {
512 		/*
513 		 * If required, report the failure to the supervising
514 		 * Authorities.
515 		 * For a delete, this is not an error. (report == 0)
516 		 */
517 		bzero(&info, sizeof(info));
518 		info.rti_info[RTAX_DST] = dst;
519 		rt_missmsg_fib(msgtype, &info, 0, err, fibnum);
520 	}
521 	return (newrt);
522 }
523 
524 /*
525  * Remove a reference count from an rtentry.
526  * If the count gets low enough, take it out of the routing table
527  */
528 void
529 rtfree(struct rtentry *rt)
530 {
531 	struct rib_head *rnh;
532 
533 	KASSERT(rt != NULL,("%s: NULL rt", __func__));
534 	rnh = rt_tables_get_rnh(rt->rt_fibnum, rt_key(rt)->sa_family);
535 	KASSERT(rnh != NULL,("%s: NULL rnh", __func__));
536 
537 	RT_LOCK_ASSERT(rt);
538 
539 	/*
540 	 * The callers should use RTFREE_LOCKED() or RTFREE(), so
541 	 * we should come here exactly with the last reference.
542 	 */
543 	RT_REMREF(rt);
544 	if (rt->rt_refcnt > 0) {
545 		log(LOG_DEBUG, "%s: %p has %d refs\n", __func__, rt, rt->rt_refcnt);
546 		goto done;
547 	}
548 
549 	/*
550 	 * On last reference give the "close method" a chance
551 	 * to cleanup private state.  This also permits (for
552 	 * IPv4 and IPv6) a chance to decide if the routing table
553 	 * entry should be purged immediately or at a later time.
554 	 * When an immediate purge is to happen the close routine
555 	 * typically calls rtexpunge which clears the RTF_UP flag
556 	 * on the entry so that the code below reclaims the storage.
557 	 */
558 	if (rt->rt_refcnt == 0 && rnh->rnh_close)
559 		rnh->rnh_close((struct radix_node *)rt, &rnh->head);
560 
561 	/*
562 	 * If we are no longer "up" (and ref == 0)
563 	 * then we can free the resources associated
564 	 * with the route.
565 	 */
566 	if ((rt->rt_flags & RTF_UP) == 0) {
567 		if (rt->rt_nodes->rn_flags & (RNF_ACTIVE | RNF_ROOT))
568 			panic("rtfree 2");
569 		/*
570 		 * the rtentry must have been removed from the routing table
571 		 * so it is represented in rttrash.. remove that now.
572 		 */
573 		V_rttrash--;
574 #ifdef	DIAGNOSTIC
575 		if (rt->rt_refcnt < 0) {
576 			printf("rtfree: %p not freed (neg refs)\n", rt);
577 			goto done;
578 		}
579 #endif
580 		/*
581 		 * release references on items we hold them on..
582 		 * e.g other routes and ifaddrs.
583 		 */
584 		if (rt->rt_ifa)
585 			ifa_free(rt->rt_ifa);
586 		/*
587 		 * The key is separatly alloc'd so free it (see rt_setgate()).
588 		 * This also frees the gateway, as they are always malloc'd
589 		 * together.
590 		 */
591 		R_Free(rt_key(rt));
592 
593 		/* Unreference nexthop */
594 		nhop_free(rt->rt_nhop);
595 
596 		/*
597 		 * and the rtentry itself of course
598 		 */
599 		uma_zfree(V_rtzone, rt);
600 		return;
601 	}
602 done:
603 	RT_UNLOCK(rt);
604 }
605 
606 /*
607  * Adds a temporal redirect entry to the routing table.
608  * @fibnum: fib number
609  * @dst: destination to install redirect to
610  * @gateway: gateway to go via
611  * @author: sockaddr of originating router, can be NULL
612  * @ifp: interface to use for the redirected route
613  * @flags: set of flags to add. Allowed: RTF_GATEWAY
614  * @lifetime_sec: time in seconds to expire this redirect.
615  *
616  * Retuns 0 on success, errno otherwise.
617  */
618 int
619 rib_add_redirect(u_int fibnum, struct sockaddr *dst, struct sockaddr *gateway,
620     struct sockaddr *author, struct ifnet *ifp, int flags, int lifetime_sec)
621 {
622 	struct rtentry *rt;
623 	int error;
624 	struct rt_addrinfo info;
625 	struct rt_metrics rti_rmx;
626 	struct ifaddr *ifa;
627 
628 	NET_EPOCH_ASSERT();
629 
630 	if (rt_tables_get_rnh(fibnum, dst->sa_family) == NULL)
631 		return (EAFNOSUPPORT);
632 
633 	/* Verify the allowed flag mask. */
634 	KASSERT(((flags & ~(RTF_GATEWAY)) == 0),
635 	    ("invalid redirect flags: %x", flags));
636 
637 	/* Get the best ifa for the given interface and gateway. */
638 	if ((ifa = ifaof_ifpforaddr(gateway, ifp)) == NULL)
639 		return (ENETUNREACH);
640 	ifa_ref(ifa);
641 
642 	bzero(&info, sizeof(info));
643 	info.rti_info[RTAX_DST] = dst;
644 	info.rti_info[RTAX_GATEWAY] = gateway;
645 	info.rti_ifa = ifa;
646 	info.rti_ifp = ifp;
647 	info.rti_flags = flags | RTF_HOST | RTF_DYNAMIC;
648 
649 	/* Setup route metrics to define expire time. */
650 	bzero(&rti_rmx, sizeof(rti_rmx));
651 	/* Set expire time as absolute. */
652 	rti_rmx.rmx_expire = lifetime_sec + time_second;
653 	info.rti_mflags |= RTV_EXPIRE;
654 	info.rti_rmx = &rti_rmx;
655 
656 	error = rtrequest1_fib(RTM_ADD, &info, &rt, fibnum);
657 	ifa_free(ifa);
658 
659 	if (error != 0) {
660 		/* TODO: add per-fib redirect stats. */
661 		return (error);
662 	}
663 
664 	RT_LOCK(rt);
665 	flags = rt->rt_flags;
666 	RTFREE_LOCKED(rt);
667 
668 	RTSTAT_INC(rts_dynamic);
669 
670 	/* Send notification of a route addition to userland. */
671 	bzero(&info, sizeof(info));
672 	info.rti_info[RTAX_DST] = dst;
673 	info.rti_info[RTAX_GATEWAY] = gateway;
674 	info.rti_info[RTAX_AUTHOR] = author;
675 	rt_missmsg_fib(RTM_REDIRECT, &info, flags, error, fibnum);
676 
677 	return (0);
678 }
679 
680 /*
681  * Routing table ioctl interface.
682  */
683 int
684 rtioctl_fib(u_long req, caddr_t data, u_int fibnum)
685 {
686 
687 	/*
688 	 * If more ioctl commands are added here, make sure the proper
689 	 * super-user checks are being performed because it is possible for
690 	 * prison-root to make it this far if raw sockets have been enabled
691 	 * in jails.
692 	 */
693 #ifdef INET
694 	/* Multicast goop, grrr... */
695 	return mrt_ioctl ? mrt_ioctl(req, data, fibnum) : EOPNOTSUPP;
696 #else /* INET */
697 	return ENXIO;
698 #endif /* INET */
699 }
700 
701 struct ifaddr *
702 ifa_ifwithroute(int flags, const struct sockaddr *dst, struct sockaddr *gateway,
703 				u_int fibnum)
704 {
705 	struct ifaddr *ifa;
706 	int not_found = 0;
707 
708 	NET_EPOCH_ASSERT();
709 	if ((flags & RTF_GATEWAY) == 0) {
710 		/*
711 		 * If we are adding a route to an interface,
712 		 * and the interface is a pt to pt link
713 		 * we should search for the destination
714 		 * as our clue to the interface.  Otherwise
715 		 * we can use the local address.
716 		 */
717 		ifa = NULL;
718 		if (flags & RTF_HOST)
719 			ifa = ifa_ifwithdstaddr(dst, fibnum);
720 		if (ifa == NULL)
721 			ifa = ifa_ifwithaddr(gateway);
722 	} else {
723 		/*
724 		 * If we are adding a route to a remote net
725 		 * or host, the gateway may still be on the
726 		 * other end of a pt to pt link.
727 		 */
728 		ifa = ifa_ifwithdstaddr(gateway, fibnum);
729 	}
730 	if (ifa == NULL)
731 		ifa = ifa_ifwithnet(gateway, 0, fibnum);
732 	if (ifa == NULL) {
733 		struct rtentry *rt;
734 
735 		rt = rtalloc1_fib(gateway, 0, flags, fibnum);
736 		if (rt == NULL)
737 			goto out;
738 		/*
739 		 * dismiss a gateway that is reachable only
740 		 * through the default router
741 		 */
742 		switch (gateway->sa_family) {
743 		case AF_INET:
744 			if (satosin(rt_key(rt))->sin_addr.s_addr == INADDR_ANY)
745 				not_found = 1;
746 			break;
747 		case AF_INET6:
748 			if (IN6_IS_ADDR_UNSPECIFIED(&satosin6(rt_key(rt))->sin6_addr))
749 				not_found = 1;
750 			break;
751 		default:
752 			break;
753 		}
754 		if (!not_found && rt->rt_ifa != NULL) {
755 			ifa = rt->rt_ifa;
756 		}
757 		RT_REMREF(rt);
758 		RT_UNLOCK(rt);
759 		if (not_found || ifa == NULL)
760 			goto out;
761 	}
762 	if (ifa->ifa_addr->sa_family != dst->sa_family) {
763 		struct ifaddr *oifa = ifa;
764 		ifa = ifaof_ifpforaddr(dst, ifa->ifa_ifp);
765 		if (ifa == NULL)
766 			ifa = oifa;
767 	}
768  out:
769 	return (ifa);
770 }
771 
772 /*
773  * Do appropriate manipulations of a routing tree given
774  * all the bits of info needed
775  */
776 int
777 rtrequest_fib(int req,
778 	struct sockaddr *dst,
779 	struct sockaddr *gateway,
780 	struct sockaddr *netmask,
781 	int flags,
782 	struct rtentry **ret_nrt,
783 	u_int fibnum)
784 {
785 	struct rt_addrinfo info;
786 
787 	if (dst->sa_len == 0)
788 		return(EINVAL);
789 
790 	bzero((caddr_t)&info, sizeof(info));
791 	info.rti_flags = flags;
792 	info.rti_info[RTAX_DST] = dst;
793 	info.rti_info[RTAX_GATEWAY] = gateway;
794 	info.rti_info[RTAX_NETMASK] = netmask;
795 	return rtrequest1_fib(req, &info, ret_nrt, fibnum);
796 }
797 
798 
799 /*
800  * Copy most of @rt data into @info.
801  *
802  * If @flags contains NHR_COPY, copies dst,netmask and gw to the
803  * pointers specified by @info structure. Assume such pointers
804  * are zeroed sockaddr-like structures with sa_len field initialized
805  * to reflect size of the provided buffer. if no NHR_COPY is specified,
806  * point dst,netmask and gw @info fields to appropriate @rt values.
807  *
808  * if @flags contains NHR_REF, do refcouting on rt_ifp and rt_ifa.
809  *
810  * Returns 0 on success.
811  */
812 int
813 rt_exportinfo(struct rtentry *rt, struct rt_addrinfo *info, int flags)
814 {
815 	struct rt_metrics *rmx;
816 	struct sockaddr *src, *dst;
817 	int sa_len;
818 
819 	if (flags & NHR_COPY) {
820 		/* Copy destination if dst is non-zero */
821 		src = rt_key(rt);
822 		dst = info->rti_info[RTAX_DST];
823 		sa_len = src->sa_len;
824 		if (dst != NULL) {
825 			if (src->sa_len > dst->sa_len)
826 				return (ENOMEM);
827 			memcpy(dst, src, src->sa_len);
828 			info->rti_addrs |= RTA_DST;
829 		}
830 
831 		/* Copy mask if set && dst is non-zero */
832 		src = rt_mask(rt);
833 		dst = info->rti_info[RTAX_NETMASK];
834 		if (src != NULL && dst != NULL) {
835 
836 			/*
837 			 * Radix stores different value in sa_len,
838 			 * assume rt_mask() to have the same length
839 			 * as rt_key()
840 			 */
841 			if (sa_len > dst->sa_len)
842 				return (ENOMEM);
843 			memcpy(dst, src, src->sa_len);
844 			info->rti_addrs |= RTA_NETMASK;
845 		}
846 
847 		/* Copy gateway is set && dst is non-zero */
848 		src = rt->rt_gateway;
849 		dst = info->rti_info[RTAX_GATEWAY];
850 		if ((rt->rt_flags & RTF_GATEWAY) && src != NULL && dst != NULL){
851 			if (src->sa_len > dst->sa_len)
852 				return (ENOMEM);
853 			memcpy(dst, src, src->sa_len);
854 			info->rti_addrs |= RTA_GATEWAY;
855 		}
856 	} else {
857 		info->rti_info[RTAX_DST] = rt_key(rt);
858 		info->rti_addrs |= RTA_DST;
859 		if (rt_mask(rt) != NULL) {
860 			info->rti_info[RTAX_NETMASK] = rt_mask(rt);
861 			info->rti_addrs |= RTA_NETMASK;
862 		}
863 		if (rt->rt_flags & RTF_GATEWAY) {
864 			info->rti_info[RTAX_GATEWAY] = rt->rt_gateway;
865 			info->rti_addrs |= RTA_GATEWAY;
866 		}
867 	}
868 
869 	rmx = info->rti_rmx;
870 	if (rmx != NULL) {
871 		info->rti_mflags |= RTV_MTU;
872 		rmx->rmx_mtu = rt->rt_mtu;
873 	}
874 
875 	info->rti_flags = rt->rt_flags;
876 	info->rti_ifp = rt->rt_ifp;
877 	info->rti_ifa = rt->rt_ifa;
878 	if (flags & NHR_REF) {
879 		if_ref(info->rti_ifp);
880 		ifa_ref(info->rti_ifa);
881 	}
882 
883 	return (0);
884 }
885 
886 /*
887  * Lookups up route entry for @dst in RIB database for fib @fibnum.
888  * Exports entry data to @info using rt_exportinfo().
889  *
890  * If @flags contains NHR_REF, refcouting is performed on rt_ifp and rt_ifa.
891  * All references can be released later by calling rib_free_info().
892  *
893  * Returns 0 on success.
894  * Returns ENOENT for lookup failure, ENOMEM for export failure.
895  */
896 int
897 rib_lookup_info(uint32_t fibnum, const struct sockaddr *dst, uint32_t flags,
898     uint32_t flowid, struct rt_addrinfo *info)
899 {
900 	RIB_RLOCK_TRACKER;
901 	struct rib_head *rh;
902 	struct radix_node *rn;
903 	struct rtentry *rt;
904 	int error;
905 
906 	KASSERT((fibnum < rt_numfibs), ("rib_lookup_rte: bad fibnum"));
907 	rh = rt_tables_get_rnh(fibnum, dst->sa_family);
908 	if (rh == NULL)
909 		return (ENOENT);
910 
911 	RIB_RLOCK(rh);
912 	rn = rh->rnh_matchaddr(__DECONST(void *, dst), &rh->head);
913 	if (rn != NULL && ((rn->rn_flags & RNF_ROOT) == 0)) {
914 		rt = RNTORT(rn);
915 		/* Ensure route & ifp is UP */
916 		if (RT_LINK_IS_UP(rt->rt_ifp)) {
917 			flags = (flags & NHR_REF) | NHR_COPY;
918 			error = rt_exportinfo(rt, info, flags);
919 			RIB_RUNLOCK(rh);
920 
921 			return (error);
922 		}
923 	}
924 	RIB_RUNLOCK(rh);
925 
926 	return (ENOENT);
927 }
928 
929 /*
930  * Releases all references acquired by rib_lookup_info() when
931  * called with NHR_REF flags.
932  */
933 void
934 rib_free_info(struct rt_addrinfo *info)
935 {
936 
937 	ifa_free(info->rti_ifa);
938 	if_rele(info->rti_ifp);
939 }
940 
941 /*
942  * Iterates over all existing fibs in system calling
943  *  @setwa_f function prior to traversing each fib.
944  *  Calls @wa_f function for each element in current fib.
945  * If af is not AF_UNSPEC, iterates over fibs in particular
946  * address family.
947  */
948 void
949 rt_foreach_fib_walk(int af, rt_setwarg_t *setwa_f, rt_walktree_f_t *wa_f,
950     void *arg)
951 {
952 	struct rib_head *rnh;
953 	uint32_t fibnum;
954 	int i;
955 
956 	for (fibnum = 0; fibnum < rt_numfibs; fibnum++) {
957 		/* Do we want some specific family? */
958 		if (af != AF_UNSPEC) {
959 			rnh = rt_tables_get_rnh(fibnum, af);
960 			if (rnh == NULL)
961 				continue;
962 			if (setwa_f != NULL)
963 				setwa_f(rnh, fibnum, af, arg);
964 
965 			RIB_WLOCK(rnh);
966 			rnh->rnh_walktree(&rnh->head, (walktree_f_t *)wa_f,arg);
967 			RIB_WUNLOCK(rnh);
968 			continue;
969 		}
970 
971 		for (i = 1; i <= AF_MAX; i++) {
972 			rnh = rt_tables_get_rnh(fibnum, i);
973 			if (rnh == NULL)
974 				continue;
975 			if (setwa_f != NULL)
976 				setwa_f(rnh, fibnum, i, arg);
977 
978 			RIB_WLOCK(rnh);
979 			rnh->rnh_walktree(&rnh->head, (walktree_f_t *)wa_f,arg);
980 			RIB_WUNLOCK(rnh);
981 		}
982 	}
983 }
984 
985 struct rt_delinfo
986 {
987 	struct rt_addrinfo info;
988 	struct rib_head *rnh;
989 	struct rtentry *head;
990 };
991 
992 /*
993  * Conditionally unlinks @rn from radix tree based
994  * on info data passed in @arg.
995  */
996 static int
997 rt_checkdelroute(struct radix_node *rn, void *arg)
998 {
999 	struct rt_delinfo *di;
1000 	struct rt_addrinfo *info;
1001 	struct rtentry *rt;
1002 	int error;
1003 
1004 	di = (struct rt_delinfo *)arg;
1005 	rt = (struct rtentry *)rn;
1006 	info = &di->info;
1007 	error = 0;
1008 
1009 	info->rti_info[RTAX_DST] = rt_key(rt);
1010 	info->rti_info[RTAX_NETMASK] = rt_mask(rt);
1011 	info->rti_info[RTAX_GATEWAY] = rt->rt_gateway;
1012 
1013 	rt = rt_unlinkrte(di->rnh, info, &error);
1014 	if (rt == NULL) {
1015 		/* Either not allowed or not matched. Skip entry */
1016 		return (0);
1017 	}
1018 
1019 	/* Entry was unlinked. Add to the list and return */
1020 	rt->rt_chain = di->head;
1021 	di->head = rt;
1022 
1023 	return (0);
1024 }
1025 
1026 /*
1027  * Iterates over a routing table specified by @fibnum and @family and
1028  *  deletes elements marked by @filter_f.
1029  * @fibnum: rtable id
1030  * @family: AF_ address family
1031  * @filter_f: function returning non-zero value for items to delete
1032  * @arg: data to pass to the @filter_f function
1033  * @report: true if rtsock notification is needed.
1034  */
1035 void
1036 rib_walk_del(u_int fibnum, int family, rt_filter_f_t *filter_f, void *arg, bool report)
1037 {
1038 	struct rib_head *rnh;
1039 	struct rt_delinfo di;
1040 	struct rtentry *rt;
1041 
1042 	rnh = rt_tables_get_rnh(fibnum, family);
1043 	if (rnh == NULL)
1044 		return;
1045 
1046 	bzero(&di, sizeof(di));
1047 	di.info.rti_filter = filter_f;
1048 	di.info.rti_filterdata = arg;
1049 	di.rnh = rnh;
1050 
1051 	RIB_WLOCK(rnh);
1052 	rnh->rnh_walktree(&rnh->head, rt_checkdelroute, &di);
1053 	RIB_WUNLOCK(rnh);
1054 
1055 	if (di.head == NULL)
1056 		return;
1057 
1058 	/* We might have something to reclaim. */
1059 	while (di.head != NULL) {
1060 		rt = di.head;
1061 		di.head = rt->rt_chain;
1062 		rt->rt_chain = NULL;
1063 
1064 		/* TODO std rt -> rt_addrinfo export */
1065 		di.info.rti_info[RTAX_DST] = rt_key(rt);
1066 		di.info.rti_info[RTAX_NETMASK] = rt_mask(rt);
1067 
1068 		rt_notifydelete(rt, &di.info);
1069 
1070 		if (report)
1071 			rt_routemsg(RTM_DELETE, rt, rt->rt_ifp, 0, fibnum);
1072 		RTFREE_LOCKED(rt);
1073 	}
1074 }
1075 
1076 /*
1077  * Iterates over all existing fibs in system and deletes each element
1078  *  for which @filter_f function returns non-zero value.
1079  * If @family is not AF_UNSPEC, iterates over fibs in particular
1080  * address family.
1081  */
1082 void
1083 rt_foreach_fib_walk_del(int family, rt_filter_f_t *filter_f, void *arg)
1084 {
1085 	u_int fibnum;
1086 	int i, start, end;
1087 
1088 	for (fibnum = 0; fibnum < rt_numfibs; fibnum++) {
1089 		/* Do we want some specific family? */
1090 		if (family != AF_UNSPEC) {
1091 			start = family;
1092 			end = family;
1093 		} else {
1094 			start = 1;
1095 			end = AF_MAX;
1096 		}
1097 
1098 		for (i = start; i <= end; i++) {
1099 			if (rt_tables_get_rnh(fibnum, i) == NULL)
1100 				continue;
1101 
1102 			rib_walk_del(fibnum, i, filter_f, arg, 0);
1103 		}
1104 	}
1105 }
1106 
1107 /*
1108  * Delete Routes for a Network Interface
1109  *
1110  * Called for each routing entry via the rnh->rnh_walktree() call above
1111  * to delete all route entries referencing a detaching network interface.
1112  *
1113  * Arguments:
1114  *	rt	pointer to rtentry
1115  *	arg	argument passed to rnh->rnh_walktree() - detaching interface
1116  *
1117  * Returns:
1118  *	0	successful
1119  *	errno	failed - reason indicated
1120  */
1121 static int
1122 rt_ifdelroute(const struct rtentry *rt, void *arg)
1123 {
1124 	struct ifnet	*ifp = arg;
1125 
1126 	if (rt->rt_ifp != ifp)
1127 		return (0);
1128 
1129 	/*
1130 	 * Protect (sorta) against walktree recursion problems
1131 	 * with cloned routes
1132 	 */
1133 	if ((rt->rt_flags & RTF_UP) == 0)
1134 		return (0);
1135 
1136 	return (1);
1137 }
1138 
1139 /*
1140  * Delete all remaining routes using this interface
1141  * Unfortuneatly the only way to do this is to slog through
1142  * the entire routing table looking for routes which point
1143  * to this interface...oh well...
1144  */
1145 void
1146 rt_flushifroutes_af(struct ifnet *ifp, int af)
1147 {
1148 	KASSERT((af >= 1 && af <= AF_MAX), ("%s: af %d not >= 1 and <= %d",
1149 	    __func__, af, AF_MAX));
1150 
1151 	rt_foreach_fib_walk_del(af, rt_ifdelroute, ifp);
1152 }
1153 
1154 void
1155 rt_flushifroutes(struct ifnet *ifp)
1156 {
1157 
1158 	rt_foreach_fib_walk_del(AF_UNSPEC, rt_ifdelroute, ifp);
1159 }
1160 
1161 /*
1162  * Conditionally unlinks rtentry matching data inside @info from @rnh.
1163  * Returns unlinked, locked and referenced @rtentry on success,
1164  * Returns NULL and sets @perror to:
1165  * ESRCH - if prefix was not found,
1166  * EADDRINUSE - if trying to delete PINNED route without appropriate flag.
1167  * ENOENT - if supplied filter function returned 0 (not matched).
1168  */
1169 static struct rtentry *
1170 rt_unlinkrte(struct rib_head *rnh, struct rt_addrinfo *info, int *perror)
1171 {
1172 	struct sockaddr *dst, *netmask;
1173 	struct rtentry *rt;
1174 	struct radix_node *rn;
1175 
1176 	dst = info->rti_info[RTAX_DST];
1177 	netmask = info->rti_info[RTAX_NETMASK];
1178 
1179 	rt = (struct rtentry *)rnh->rnh_lookup(dst, netmask, &rnh->head);
1180 	if (rt == NULL) {
1181 		*perror = ESRCH;
1182 		return (NULL);
1183 	}
1184 
1185 	if ((info->rti_flags & RTF_PINNED) == 0) {
1186 		/* Check if target route can be deleted */
1187 		if (rt->rt_flags & RTF_PINNED) {
1188 			*perror = EADDRINUSE;
1189 			return (NULL);
1190 		}
1191 	}
1192 
1193 	if (info->rti_filter != NULL) {
1194 		if (info->rti_filter(rt, info->rti_filterdata) == 0) {
1195 			/* Not matched */
1196 			*perror = ENOENT;
1197 			return (NULL);
1198 		}
1199 
1200 		/*
1201 		 * Filter function requested rte deletion.
1202 		 * Ease the caller work by filling in remaining info
1203 		 * from that particular entry.
1204 		 */
1205 		info->rti_info[RTAX_GATEWAY] = rt->rt_gateway;
1206 	}
1207 
1208 	/*
1209 	 * Remove the item from the tree and return it.
1210 	 * Complain if it is not there and do no more processing.
1211 	 */
1212 	*perror = ESRCH;
1213 #ifdef RADIX_MPATH
1214 	if (rt_mpath_capable(rnh))
1215 		rn = rt_mpath_unlink(rnh, info, rt, perror);
1216 	else
1217 #endif
1218 	rn = rnh->rnh_deladdr(dst, netmask, &rnh->head);
1219 	if (rn == NULL)
1220 		return (NULL);
1221 
1222 	if (rn->rn_flags & (RNF_ACTIVE | RNF_ROOT))
1223 		panic ("rtrequest delete");
1224 
1225 	rt = RNTORT(rn);
1226 	RT_LOCK(rt);
1227 	RT_ADDREF(rt);
1228 	rt->rt_flags &= ~RTF_UP;
1229 
1230 	*perror = 0;
1231 
1232 	return (rt);
1233 }
1234 
1235 static void
1236 rt_notifydelete(struct rtentry *rt, struct rt_addrinfo *info)
1237 {
1238 	struct ifaddr *ifa;
1239 
1240 	/*
1241 	 * give the protocol a chance to keep things in sync.
1242 	 */
1243 	ifa = rt->rt_ifa;
1244 	if (ifa != NULL && ifa->ifa_rtrequest != NULL)
1245 		ifa->ifa_rtrequest(RTM_DELETE, rt, info);
1246 
1247 	/*
1248 	 * One more rtentry floating around that is not
1249 	 * linked to the routing table. rttrash will be decremented
1250 	 * when RTFREE(rt) is eventually called.
1251 	 */
1252 	V_rttrash++;
1253 }
1254 
1255 
1256 /*
1257  * These (questionable) definitions of apparent local variables apply
1258  * to the next two functions.  XXXXXX!!!
1259  */
1260 #define	dst	info->rti_info[RTAX_DST]
1261 #define	gateway	info->rti_info[RTAX_GATEWAY]
1262 #define	netmask	info->rti_info[RTAX_NETMASK]
1263 #define	ifaaddr	info->rti_info[RTAX_IFA]
1264 #define	ifpaddr	info->rti_info[RTAX_IFP]
1265 #define	flags	info->rti_flags
1266 
1267 /*
1268  * Look up rt_addrinfo for a specific fib.  Note that if rti_ifa is defined,
1269  * it will be referenced so the caller must free it.
1270  *
1271  * Assume basic consistency checks are executed by callers:
1272  * RTAX_DST exists, if RTF_GATEWAY is set, RTAX_GATEWAY exists as well.
1273  */
1274 int
1275 rt_getifa_fib(struct rt_addrinfo *info, u_int fibnum)
1276 {
1277 	struct epoch_tracker et;
1278 	int needref, error;
1279 
1280 	/*
1281 	 * ifp may be specified by sockaddr_dl
1282 	 * when protocol address is ambiguous.
1283 	 */
1284 	error = 0;
1285 	needref = (info->rti_ifa == NULL);
1286 	NET_EPOCH_ENTER(et);
1287 
1288 	/* If we have interface specified by the ifindex in the address, use it */
1289 	if (info->rti_ifp == NULL && ifpaddr != NULL &&
1290 	    ifpaddr->sa_family == AF_LINK) {
1291 	    const struct sockaddr_dl *sdl = (const struct sockaddr_dl *)ifpaddr;
1292 	    if (sdl->sdl_index != 0)
1293 		    info->rti_ifp = ifnet_byindex(sdl->sdl_index);
1294 	}
1295 	/*
1296 	 * If we have source address specified, try to find it
1297 	 * TODO: avoid enumerating all ifas on all interfaces.
1298 	 */
1299 	if (info->rti_ifa == NULL && ifaaddr != NULL)
1300 		info->rti_ifa = ifa_ifwithaddr(ifaaddr);
1301 	if (info->rti_ifa == NULL) {
1302 		struct sockaddr *sa;
1303 
1304 		/*
1305 		 * Most common use case for the userland-supplied routes.
1306 		 *
1307 		 * Choose sockaddr to select ifa.
1308 		 * -- if ifp is set --
1309 		 * Order of preference:
1310 		 * 1) IFA address
1311 		 * 2) gateway address
1312 		 *   Note: for interface routes link-level gateway address
1313 		 *     is specified to indicate the interface index without
1314 		 *     specifying RTF_GATEWAY. In this case, ignore gateway
1315 		 *   Note: gateway AF may be different from dst AF. In this case,
1316 		 *   ignore gateway
1317 		 * 3) final destination.
1318 		 * 4) if all of these fails, try to get at least link-level ifa.
1319 		 * -- else --
1320 		 * try to lookup gateway or dst in the routing table to get ifa
1321 		 */
1322 		if (info->rti_info[RTAX_IFA] != NULL)
1323 			sa = info->rti_info[RTAX_IFA];
1324 		else if ((info->rti_flags & RTF_GATEWAY) != 0 &&
1325 		    gateway->sa_family == dst->sa_family)
1326 			sa = gateway;
1327 		else
1328 			sa = dst;
1329 		if (info->rti_ifp != NULL) {
1330 			info->rti_ifa = ifaof_ifpforaddr(sa, info->rti_ifp);
1331 			/* Case 4 */
1332 			if (info->rti_ifa == NULL && gateway != NULL)
1333 				info->rti_ifa = ifaof_ifpforaddr(gateway, info->rti_ifp);
1334 		} else if (dst != NULL && gateway != NULL)
1335 			info->rti_ifa = ifa_ifwithroute(flags, dst, gateway,
1336 							fibnum);
1337 		else if (sa != NULL)
1338 			info->rti_ifa = ifa_ifwithroute(flags, sa, sa,
1339 							fibnum);
1340 	}
1341 	if (needref && info->rti_ifa != NULL) {
1342 		if (info->rti_ifp == NULL)
1343 			info->rti_ifp = info->rti_ifa->ifa_ifp;
1344 		ifa_ref(info->rti_ifa);
1345 	} else
1346 		error = ENETUNREACH;
1347 	NET_EPOCH_EXIT(et);
1348 	return (error);
1349 }
1350 
1351 static int
1352 if_updatemtu_cb(struct radix_node *rn, void *arg)
1353 {
1354 	struct rtentry *rt;
1355 	struct if_mtuinfo *ifmtu;
1356 
1357 	rt = (struct rtentry *)rn;
1358 	ifmtu = (struct if_mtuinfo *)arg;
1359 
1360 	if (rt->rt_ifp != ifmtu->ifp)
1361 		return (0);
1362 
1363 	if (rt->rt_mtu >= ifmtu->mtu) {
1364 		/* We have to decrease mtu regardless of flags */
1365 		rt->rt_mtu = ifmtu->mtu;
1366 		return (0);
1367 	}
1368 
1369 	/*
1370 	 * New MTU is bigger. Check if are allowed to alter it
1371 	 */
1372 	if ((rt->rt_flags & (RTF_FIXEDMTU | RTF_GATEWAY | RTF_HOST)) != 0) {
1373 
1374 		/*
1375 		 * Skip routes with user-supplied MTU and
1376 		 * non-interface routes
1377 		 */
1378 		return (0);
1379 	}
1380 
1381 	/* We are safe to update route MTU */
1382 	rt->rt_mtu = ifmtu->mtu;
1383 
1384 	return (0);
1385 }
1386 
1387 void
1388 rt_updatemtu(struct ifnet *ifp)
1389 {
1390 	struct if_mtuinfo ifmtu;
1391 	struct rib_head *rnh;
1392 	int i, j;
1393 
1394 	ifmtu.ifp = ifp;
1395 
1396 	/*
1397 	 * Try to update rt_mtu for all routes using this interface
1398 	 * Unfortunately the only way to do this is to traverse all
1399 	 * routing tables in all fibs/domains.
1400 	 */
1401 	for (i = 1; i <= AF_MAX; i++) {
1402 		ifmtu.mtu = if_getmtu_family(ifp, i);
1403 		for (j = 0; j < rt_numfibs; j++) {
1404 			rnh = rt_tables_get_rnh(j, i);
1405 			if (rnh == NULL)
1406 				continue;
1407 			RIB_WLOCK(rnh);
1408 			rnh->rnh_walktree(&rnh->head, if_updatemtu_cb, &ifmtu);
1409 			RIB_WUNLOCK(rnh);
1410 			nhops_update_ifmtu(rnh, ifp, ifmtu.mtu);
1411 		}
1412 	}
1413 }
1414 
1415 
1416 #if 0
1417 int p_sockaddr(char *buf, int buflen, struct sockaddr *s);
1418 int rt_print(char *buf, int buflen, struct rtentry *rt);
1419 
1420 int
1421 p_sockaddr(char *buf, int buflen, struct sockaddr *s)
1422 {
1423 	void *paddr = NULL;
1424 
1425 	switch (s->sa_family) {
1426 	case AF_INET:
1427 		paddr = &((struct sockaddr_in *)s)->sin_addr;
1428 		break;
1429 	case AF_INET6:
1430 		paddr = &((struct sockaddr_in6 *)s)->sin6_addr;
1431 		break;
1432 	}
1433 
1434 	if (paddr == NULL)
1435 		return (0);
1436 
1437 	if (inet_ntop(s->sa_family, paddr, buf, buflen) == NULL)
1438 		return (0);
1439 
1440 	return (strlen(buf));
1441 }
1442 
1443 int
1444 rt_print(char *buf, int buflen, struct rtentry *rt)
1445 {
1446 	struct sockaddr *addr, *mask;
1447 	int i = 0;
1448 
1449 	addr = rt_key(rt);
1450 	mask = rt_mask(rt);
1451 
1452 	i = p_sockaddr(buf, buflen, addr);
1453 	if (!(rt->rt_flags & RTF_HOST)) {
1454 		buf[i++] = '/';
1455 		i += p_sockaddr(buf + i, buflen - i, mask);
1456 	}
1457 
1458 	if (rt->rt_flags & RTF_GATEWAY) {
1459 		buf[i++] = '>';
1460 		i += p_sockaddr(buf + i, buflen - i, rt->rt_gateway);
1461 	}
1462 
1463 	return (i);
1464 }
1465 #endif
1466 
1467 #ifdef RADIX_MPATH
1468 /*
1469  * Deletes key for single-path routes, unlinks rtentry with
1470  * gateway specified in @info from multi-path routes.
1471  *
1472  * Returnes unlinked entry. In case of failure, returns NULL
1473  * and sets @perror to ESRCH.
1474  */
1475 static struct radix_node *
1476 rt_mpath_unlink(struct rib_head *rnh, struct rt_addrinfo *info,
1477     struct rtentry *rto, int *perror)
1478 {
1479 	/*
1480 	 * if we got multipath routes, we require users to specify
1481 	 * a matching RTAX_GATEWAY.
1482 	 */
1483 	struct rtentry *rt; // *rto = NULL;
1484 	struct radix_node *rn;
1485 	struct sockaddr *gw;
1486 
1487 	gw = info->rti_info[RTAX_GATEWAY];
1488 	rt = rt_mpath_matchgate(rto, gw);
1489 	if (rt == NULL) {
1490 		*perror = ESRCH;
1491 		return (NULL);
1492 	}
1493 
1494 	/*
1495 	 * this is the first entry in the chain
1496 	 */
1497 	if (rto == rt) {
1498 		rn = rn_mpath_next((struct radix_node *)rt);
1499 		/*
1500 		 * there is another entry, now it's active
1501 		 */
1502 		if (rn) {
1503 			rto = RNTORT(rn);
1504 			RT_LOCK(rto);
1505 			rto->rt_flags |= RTF_UP;
1506 			RT_UNLOCK(rto);
1507 		} else if (rt->rt_flags & RTF_GATEWAY) {
1508 			/*
1509 			 * For gateway routes, we need to
1510 			 * make sure that we we are deleting
1511 			 * the correct gateway.
1512 			 * rt_mpath_matchgate() does not
1513 			 * check the case when there is only
1514 			 * one route in the chain.
1515 			 */
1516 			if (gw &&
1517 			    (rt->rt_gateway->sa_len != gw->sa_len ||
1518 				memcmp(rt->rt_gateway, gw, gw->sa_len))) {
1519 				*perror = ESRCH;
1520 				return (NULL);
1521 			}
1522 		}
1523 
1524 		/*
1525 		 * use the normal delete code to remove
1526 		 * the first entry
1527 		 */
1528 		rn = rnh->rnh_deladdr(dst, netmask, &rnh->head);
1529 		*perror = 0;
1530 		return (rn);
1531 	}
1532 
1533 	/*
1534 	 * if the entry is 2nd and on up
1535 	 */
1536 	if (rt_mpath_deldup(rto, rt) == 0)
1537 		panic ("rtrequest1: rt_mpath_deldup");
1538 	*perror = 0;
1539 	rn = (struct radix_node *)rt;
1540 	return (rn);
1541 }
1542 #endif
1543 
1544 #undef dst
1545 #undef gateway
1546 #undef netmask
1547 #undef ifaaddr
1548 #undef ifpaddr
1549 #undef flags
1550 
1551 int
1552 rtrequest1_fib(int req, struct rt_addrinfo *info, struct rtentry **ret_nrt,
1553 				u_int fibnum)
1554 {
1555 	struct epoch_tracker et;
1556 	const struct sockaddr *dst;
1557 	struct rib_head *rnh;
1558 	int error;
1559 
1560 	KASSERT((fibnum < rt_numfibs), ("rtrequest1_fib: bad fibnum"));
1561 	KASSERT((info->rti_flags & RTF_RNH_LOCKED) == 0, ("rtrequest1_fib: locked"));
1562 
1563 	dst = info->rti_info[RTAX_DST];
1564 
1565 	switch (dst->sa_family) {
1566 	case AF_INET6:
1567 	case AF_INET:
1568 		/* We support multiple FIBs. */
1569 		break;
1570 	default:
1571 		fibnum = RT_DEFAULT_FIB;
1572 		break;
1573 	}
1574 
1575 	/*
1576 	 * Find the correct routing tree to use for this Address Family
1577 	 */
1578 	rnh = rt_tables_get_rnh(fibnum, dst->sa_family);
1579 	if (rnh == NULL)
1580 		return (EAFNOSUPPORT);
1581 
1582 	/*
1583 	 * If we are adding a host route then we don't want to put
1584 	 * a netmask in the tree, nor do we want to clone it.
1585 	 */
1586 	if (info->rti_flags & RTF_HOST)
1587 		info->rti_info[RTAX_NETMASK] = NULL;
1588 
1589 	error = 0;
1590 	switch (req) {
1591 	case RTM_DELETE:
1592 		error = del_route(rnh, info, ret_nrt);
1593 		break;
1594 	case RTM_RESOLVE:
1595 		/*
1596 		 * resolve was only used for route cloning
1597 		 * here for compat
1598 		 */
1599 		break;
1600 	case RTM_ADD:
1601 		error = add_route(rnh, info, ret_nrt);
1602 		break;
1603 	case RTM_CHANGE:
1604 		NET_EPOCH_ENTER(et);
1605 		RIB_WLOCK(rnh);
1606 		error = change_route(rnh, info, ret_nrt);
1607 		RIB_WUNLOCK(rnh);
1608 		NET_EPOCH_EXIT(et);
1609 		break;
1610 	default:
1611 		error = EOPNOTSUPP;
1612 	}
1613 
1614 	return (error);
1615 }
1616 
1617 static int
1618 add_route(struct rib_head *rnh, struct rt_addrinfo *info,
1619     struct rtentry **ret_nrt)
1620 {
1621 	struct sockaddr *dst, *ndst, *gateway, *netmask;
1622 	struct rtentry *rt, *rt_old;
1623 	struct nhop_object *nh;
1624 	struct radix_node *rn;
1625 	struct ifaddr *ifa;
1626 	int error, flags;
1627 	struct epoch_tracker et;
1628 
1629 	dst = info->rti_info[RTAX_DST];
1630 	gateway = info->rti_info[RTAX_GATEWAY];
1631 	netmask = info->rti_info[RTAX_NETMASK];
1632 	flags = info->rti_flags;
1633 
1634 	if ((flags & RTF_GATEWAY) && !gateway)
1635 		return (EINVAL);
1636 	if (dst && gateway && (dst->sa_family != gateway->sa_family) &&
1637 	    (gateway->sa_family != AF_UNSPEC) && (gateway->sa_family != AF_LINK))
1638 		return (EINVAL);
1639 
1640 	if (info->rti_ifa == NULL) {
1641 		error = rt_getifa_fib(info, rnh->rib_fibnum);
1642 		if (error)
1643 			return (error);
1644 	} else {
1645 		ifa_ref(info->rti_ifa);
1646 	}
1647 
1648 	NET_EPOCH_ENTER(et);
1649 	error = nhop_create_from_info(rnh, info, &nh);
1650 	NET_EPOCH_EXIT(et);
1651 	if (error != 0) {
1652 		ifa_free(info->rti_ifa);
1653 		return (error);
1654 	}
1655 
1656 	rt = uma_zalloc(V_rtzone, M_NOWAIT);
1657 	if (rt == NULL) {
1658 		ifa_free(info->rti_ifa);
1659 		nhop_free(nh);
1660 		return (ENOBUFS);
1661 	}
1662 	rt->rt_flags = RTF_UP | flags;
1663 	rt->rt_fibnum = rnh->rib_fibnum;
1664 	rt->rt_nhop = nh;
1665 	/*
1666 	 * Add the gateway. Possibly re-malloc-ing the storage for it.
1667 	 */
1668 	if ((error = rt_setgate(rt, dst, gateway)) != 0) {
1669 		ifa_free(info->rti_ifa);
1670 		nhop_free(nh);
1671 		uma_zfree(V_rtzone, rt);
1672 		return (error);
1673 	}
1674 
1675 	/*
1676 	 * point to the (possibly newly malloc'd) dest address.
1677 	 */
1678 	ndst = (struct sockaddr *)rt_key(rt);
1679 
1680 	/*
1681 	 * make sure it contains the value we want (masked if needed).
1682 	 */
1683 	if (netmask) {
1684 		rt_maskedcopy(dst, ndst, netmask);
1685 	} else
1686 		bcopy(dst, ndst, dst->sa_len);
1687 
1688 	/*
1689 	 * We use the ifa reference returned by rt_getifa_fib().
1690 	 * This moved from below so that rnh->rnh_addaddr() can
1691 	 * examine the ifa and  ifa->ifa_ifp if it so desires.
1692 	 */
1693 	ifa = info->rti_ifa;
1694 	rt->rt_ifa = ifa;
1695 	rt->rt_ifp = ifa->ifa_ifp;
1696 	rt->rt_weight = 1;
1697 
1698 	rt_setmetrics(info, rt);
1699 
1700 	RIB_WLOCK(rnh);
1701 	RT_LOCK(rt);
1702 #ifdef RADIX_MPATH
1703 	/* do not permit exactly the same dst/mask/gw pair */
1704 	if (rt_mpath_capable(rnh) &&
1705 		rt_mpath_conflict(rnh, rt, netmask)) {
1706 		RIB_WUNLOCK(rnh);
1707 
1708 		ifa_free(rt->rt_ifa);
1709 		R_Free(rt_key(rt));
1710 		nhop_free(nh);
1711 		uma_zfree(V_rtzone, rt);
1712 		return (EEXIST);
1713 	}
1714 #endif
1715 
1716 	/* XXX mtu manipulation will be done in rnh_addaddr -- itojun */
1717 	rn = rnh->rnh_addaddr(ndst, netmask, &rnh->head, rt->rt_nodes);
1718 
1719 	if (rn != NULL && rt->rt_expire > 0)
1720 		tmproutes_update(rnh, rt);
1721 
1722 	rt_old = NULL;
1723 	if (rn == NULL && (info->rti_flags & RTF_PINNED) != 0) {
1724 
1725 		/*
1726 		 * Force removal and re-try addition
1727 		 * TODO: better multipath&pinned support
1728 		 */
1729 		struct sockaddr *info_dst = info->rti_info[RTAX_DST];
1730 		info->rti_info[RTAX_DST] = ndst;
1731 		/* Do not delete existing PINNED(interface) routes */
1732 		info->rti_flags &= ~RTF_PINNED;
1733 		rt_old = rt_unlinkrte(rnh, info, &error);
1734 		info->rti_flags |= RTF_PINNED;
1735 		info->rti_info[RTAX_DST] = info_dst;
1736 		if (rt_old != NULL)
1737 			rn = rnh->rnh_addaddr(ndst, netmask, &rnh->head,
1738 			    rt->rt_nodes);
1739 	}
1740 	RIB_WUNLOCK(rnh);
1741 
1742 	if (rt_old != NULL)
1743 		RT_UNLOCK(rt_old);
1744 
1745 	/*
1746 	 * If it still failed to go into the tree,
1747 	 * then un-make it (this should be a function)
1748 	 */
1749 	if (rn == NULL) {
1750 		ifa_free(rt->rt_ifa);
1751 		R_Free(rt_key(rt));
1752 		nhop_free(nh);
1753 		uma_zfree(V_rtzone, rt);
1754 		return (EEXIST);
1755 	}
1756 
1757 	if (rt_old != NULL) {
1758 		rt_notifydelete(rt_old, info);
1759 		RTFREE(rt_old);
1760 	}
1761 
1762 	/*
1763 	 * If this protocol has something to add to this then
1764 	 * allow it to do that as well.
1765 	 */
1766 	if (ifa->ifa_rtrequest)
1767 		ifa->ifa_rtrequest(RTM_ADD, rt, info);
1768 
1769 	/*
1770 	 * actually return a resultant rtentry and
1771 	 * give the caller a single reference.
1772 	 */
1773 	if (ret_nrt) {
1774 		*ret_nrt = rt;
1775 		RT_ADDREF(rt);
1776 	}
1777 	rnh->rnh_gen++;		/* Routing table updated */
1778 	RT_UNLOCK(rt);
1779 
1780 	return (0);
1781 }
1782 
1783 static int
1784 del_route(struct rib_head *rnh, struct rt_addrinfo *info,
1785     struct rtentry **ret_nrt)
1786 {
1787 	struct sockaddr *dst, *netmask;
1788 	struct sockaddr_storage mdst;
1789 	struct rtentry *rt;
1790 	int error;
1791 
1792 	dst = info->rti_info[RTAX_DST];
1793 	netmask = info->rti_info[RTAX_NETMASK];
1794 
1795 	if (netmask) {
1796 		if (dst->sa_len > sizeof(mdst))
1797 			return (EINVAL);
1798 		rt_maskedcopy(dst, (struct sockaddr *)&mdst, netmask);
1799 		dst = (struct sockaddr *)&mdst;
1800 	}
1801 
1802 	RIB_WLOCK(rnh);
1803 	rt = rt_unlinkrte(rnh, info, &error);
1804 	RIB_WUNLOCK(rnh);
1805 	if (error != 0)
1806 		return (error);
1807 
1808 	rt_notifydelete(rt, info);
1809 
1810 	/*
1811 	 * If the caller wants it, then it can have it,
1812 	 * but it's up to it to free the rtentry as we won't be
1813 	 * doing it.
1814 	 */
1815 	if (ret_nrt) {
1816 		*ret_nrt = rt;
1817 		RT_UNLOCK(rt);
1818 	} else
1819 		RTFREE_LOCKED(rt);
1820 
1821 	return (0);
1822 }
1823 
1824 static int
1825 change_route(struct rib_head *rnh, struct rt_addrinfo *info,
1826     struct rtentry **ret_nrt)
1827 {
1828 	struct rtentry *rt = NULL;
1829 	int error = 0;
1830 	int free_ifa = 0;
1831 	int family, mtu;
1832 	struct nhop_object *nh;
1833 	struct if_mtuinfo ifmtu;
1834 
1835 	RIB_WLOCK_ASSERT(rnh);
1836 
1837 	rt = (struct rtentry *)rnh->rnh_lookup(info->rti_info[RTAX_DST],
1838 	    info->rti_info[RTAX_NETMASK], &rnh->head);
1839 
1840 	if (rt == NULL)
1841 		return (ESRCH);
1842 
1843 #ifdef RADIX_MPATH
1844 	/*
1845 	 * If we got multipath routes,
1846 	 * we require users to specify a matching RTAX_GATEWAY.
1847 	 */
1848 	if (rt_mpath_capable(rnh)) {
1849 		rt = rt_mpath_matchgate(rt, info->rti_info[RTAX_GATEWAY]);
1850 		if (rt == NULL)
1851 			return (ESRCH);
1852 	}
1853 #endif
1854 
1855 	nh = NULL;
1856 	RT_LOCK(rt);
1857 
1858 	rt_setmetrics(info, rt);
1859 
1860 	/*
1861 	 * New gateway could require new ifaddr, ifp;
1862 	 * flags may also be different; ifp may be specified
1863 	 * by ll sockaddr when protocol address is ambiguous
1864 	 */
1865 	if (((rt->rt_flags & RTF_GATEWAY) &&
1866 	    info->rti_info[RTAX_GATEWAY] != NULL) ||
1867 	    info->rti_info[RTAX_IFP] != NULL ||
1868 	    (info->rti_info[RTAX_IFA] != NULL &&
1869 	     !sa_equal(info->rti_info[RTAX_IFA], rt->rt_ifa->ifa_addr))) {
1870 		/*
1871 		 * XXX: Temporarily set RTF_RNH_LOCKED flag in the rti_flags
1872 		 *	to avoid rlock in the ifa_ifwithroute().
1873 		 */
1874 		info->rti_flags |= RTF_RNH_LOCKED;
1875 		error = rt_getifa_fib(info, rnh->rib_fibnum);
1876 		info->rti_flags &= ~RTF_RNH_LOCKED;
1877 		if (info->rti_ifa != NULL)
1878 			free_ifa = 1;
1879 
1880 		if (error != 0)
1881 			goto bad;
1882 	}
1883 
1884 	error = nhop_create_from_nhop(rnh, rt->rt_nhop, info, &nh);
1885 	if (error != 0)
1886 		goto bad;
1887 
1888 	/* Check if outgoing interface has changed */
1889 	if (info->rti_ifa != NULL && info->rti_ifa != rt->rt_ifa &&
1890 	    rt->rt_ifa != NULL) {
1891 		if (rt->rt_ifa->ifa_rtrequest != NULL)
1892 			rt->rt_ifa->ifa_rtrequest(RTM_DELETE, rt, info);
1893 		ifa_free(rt->rt_ifa);
1894 		rt->rt_ifa = NULL;
1895 	}
1896 	/* Update gateway address */
1897 	if (info->rti_info[RTAX_GATEWAY] != NULL) {
1898 		error = rt_setgate(rt, rt_key(rt), info->rti_info[RTAX_GATEWAY]);
1899 		if (error != 0)
1900 			goto bad;
1901 
1902 		rt->rt_flags &= ~RTF_GATEWAY;
1903 		rt->rt_flags |= (RTF_GATEWAY & info->rti_flags);
1904 	}
1905 
1906 	if (info->rti_ifa != NULL && info->rti_ifa != rt->rt_ifa) {
1907 		ifa_ref(info->rti_ifa);
1908 		rt->rt_ifa = info->rti_ifa;
1909 		rt->rt_ifp = info->rti_ifp;
1910 	}
1911 	/* Allow some flags to be toggled on change. */
1912 	rt->rt_flags &= ~RTF_FMASK;
1913 	rt->rt_flags |= info->rti_flags & RTF_FMASK;
1914 
1915 	if (rt->rt_ifa && rt->rt_ifa->ifa_rtrequest != NULL)
1916 	       rt->rt_ifa->ifa_rtrequest(RTM_ADD, rt, info);
1917 
1918 	/* Alter route MTU if necessary */
1919 	if (rt->rt_ifp != NULL) {
1920 		family = info->rti_info[RTAX_DST]->sa_family;
1921 		mtu = if_getmtu_family(rt->rt_ifp, family);
1922 		/* Set default MTU */
1923 		if (rt->rt_mtu == 0)
1924 			rt->rt_mtu = mtu;
1925 		if (rt->rt_mtu != mtu) {
1926 			/* Check if we really need to update */
1927 			ifmtu.ifp = rt->rt_ifp;
1928 			ifmtu.mtu = mtu;
1929 			if_updatemtu_cb(rt->rt_nodes, &ifmtu);
1930 		}
1931 	}
1932 
1933 	/* Update nexthop */
1934 	nhop_free(rt->rt_nhop);
1935 	rt->rt_nhop = nh;
1936 	nh = NULL;
1937 
1938 	/*
1939 	 * This route change may have modified the route's gateway.  In that
1940 	 * case, any inpcbs that have cached this route need to invalidate their
1941 	 * llentry cache.
1942 	 */
1943 	rnh->rnh_gen++;
1944 
1945 	if (ret_nrt) {
1946 		*ret_nrt = rt;
1947 		RT_ADDREF(rt);
1948 	}
1949 bad:
1950 	RT_UNLOCK(rt);
1951 	if (nh != NULL)
1952 		nhop_free(nh);
1953 	if (free_ifa != 0) {
1954 		ifa_free(info->rti_ifa);
1955 		info->rti_ifa = NULL;
1956 	}
1957 	return (error);
1958 }
1959 
1960 static void
1961 rt_setmetrics(const struct rt_addrinfo *info, struct rtentry *rt)
1962 {
1963 
1964 	if (info->rti_mflags & RTV_MTU) {
1965 		if (info->rti_rmx->rmx_mtu != 0) {
1966 
1967 			/*
1968 			 * MTU was explicitly provided by user.
1969 			 * Keep it.
1970 			 */
1971 			rt->rt_flags |= RTF_FIXEDMTU;
1972 		} else {
1973 
1974 			/*
1975 			 * User explicitly sets MTU to 0.
1976 			 * Assume rollback to default.
1977 			 */
1978 			rt->rt_flags &= ~RTF_FIXEDMTU;
1979 		}
1980 		rt->rt_mtu = info->rti_rmx->rmx_mtu;
1981 	}
1982 	if (info->rti_mflags & RTV_WEIGHT)
1983 		rt->rt_weight = info->rti_rmx->rmx_weight;
1984 	/* Kernel -> userland timebase conversion. */
1985 	if (info->rti_mflags & RTV_EXPIRE)
1986 		rt->rt_expire = info->rti_rmx->rmx_expire ?
1987 		    info->rti_rmx->rmx_expire - time_second + time_uptime : 0;
1988 }
1989 
1990 int
1991 rt_setgate(struct rtentry *rt, struct sockaddr *dst, struct sockaddr *gate)
1992 {
1993 	/* XXX dst may be overwritten, can we move this to below */
1994 	int dlen = SA_SIZE(dst), glen = SA_SIZE(gate);
1995 
1996 	/*
1997 	 * Prepare to store the gateway in rt->rt_gateway.
1998 	 * Both dst and gateway are stored one after the other in the same
1999 	 * malloc'd chunk. If we have room, we can reuse the old buffer,
2000 	 * rt_gateway already points to the right place.
2001 	 * Otherwise, malloc a new block and update the 'dst' address.
2002 	 */
2003 	if (rt->rt_gateway == NULL || glen > SA_SIZE(rt->rt_gateway)) {
2004 		caddr_t new;
2005 
2006 		R_Malloc(new, caddr_t, dlen + glen);
2007 		if (new == NULL)
2008 			return ENOBUFS;
2009 		/*
2010 		 * XXX note, we copy from *dst and not *rt_key(rt) because
2011 		 * rt_setgate() can be called to initialize a newly
2012 		 * allocated route entry, in which case rt_key(rt) == NULL
2013 		 * (and also rt->rt_gateway == NULL).
2014 		 * Free()/free() handle a NULL argument just fine.
2015 		 */
2016 		bcopy(dst, new, dlen);
2017 		R_Free(rt_key(rt));	/* free old block, if any */
2018 		rt_key(rt) = (struct sockaddr *)new;
2019 		rt->rt_gateway = (struct sockaddr *)(new + dlen);
2020 	}
2021 
2022 	/*
2023 	 * Copy the new gateway value into the memory chunk.
2024 	 */
2025 	bcopy(gate, rt->rt_gateway, glen);
2026 
2027 	return (0);
2028 }
2029 
2030 void
2031 rt_maskedcopy(struct sockaddr *src, struct sockaddr *dst, struct sockaddr *netmask)
2032 {
2033 	u_char *cp1 = (u_char *)src;
2034 	u_char *cp2 = (u_char *)dst;
2035 	u_char *cp3 = (u_char *)netmask;
2036 	u_char *cplim = cp2 + *cp3;
2037 	u_char *cplim2 = cp2 + *cp1;
2038 
2039 	*cp2++ = *cp1++; *cp2++ = *cp1++; /* copies sa_len & sa_family */
2040 	cp3 += 2;
2041 	if (cplim > cplim2)
2042 		cplim = cplim2;
2043 	while (cp2 < cplim)
2044 		*cp2++ = *cp1++ & *cp3++;
2045 	if (cp2 < cplim2)
2046 		bzero((caddr_t)cp2, (unsigned)(cplim2 - cp2));
2047 }
2048 
2049 /*
2050  * Set up a routing table entry, normally
2051  * for an interface.
2052  */
2053 #define _SOCKADDR_TMPSIZE 128 /* Not too big.. kernel stack size is limited */
2054 static inline  int
2055 rtinit1(struct ifaddr *ifa, int cmd, int flags, int fibnum)
2056 {
2057 	RIB_RLOCK_TRACKER;
2058 	struct sockaddr *dst;
2059 	struct sockaddr *netmask;
2060 	struct rtentry *rt = NULL;
2061 	struct rt_addrinfo info;
2062 	int error = 0;
2063 	int startfib, endfib;
2064 	char tempbuf[_SOCKADDR_TMPSIZE];
2065 	int didwork = 0;
2066 	int a_failure = 0;
2067 	struct sockaddr_dl *sdl = NULL;
2068 	struct rib_head *rnh;
2069 
2070 	if (flags & RTF_HOST) {
2071 		dst = ifa->ifa_dstaddr;
2072 		netmask = NULL;
2073 	} else {
2074 		dst = ifa->ifa_addr;
2075 		netmask = ifa->ifa_netmask;
2076 	}
2077 	if (dst->sa_len == 0)
2078 		return(EINVAL);
2079 	switch (dst->sa_family) {
2080 	case AF_INET6:
2081 	case AF_INET:
2082 		/* We support multiple FIBs. */
2083 		break;
2084 	default:
2085 		fibnum = RT_DEFAULT_FIB;
2086 		break;
2087 	}
2088 	if (fibnum == RT_ALL_FIBS) {
2089 		if (V_rt_add_addr_allfibs == 0 && cmd == (int)RTM_ADD)
2090 			startfib = endfib = ifa->ifa_ifp->if_fib;
2091 		else {
2092 			startfib = 0;
2093 			endfib = rt_numfibs - 1;
2094 		}
2095 	} else {
2096 		KASSERT((fibnum < rt_numfibs), ("rtinit1: bad fibnum"));
2097 		startfib = fibnum;
2098 		endfib = fibnum;
2099 	}
2100 
2101 	/*
2102 	 * If it's a delete, check that if it exists,
2103 	 * it's on the correct interface or we might scrub
2104 	 * a route to another ifa which would
2105 	 * be confusing at best and possibly worse.
2106 	 */
2107 	if (cmd == RTM_DELETE) {
2108 		/*
2109 		 * It's a delete, so it should already exist..
2110 		 * If it's a net, mask off the host bits
2111 		 * (Assuming we have a mask)
2112 		 * XXX this is kinda inet specific..
2113 		 */
2114 		if (netmask != NULL) {
2115 			rt_maskedcopy(dst, (struct sockaddr *)tempbuf, netmask);
2116 			dst = (struct sockaddr *)tempbuf;
2117 		}
2118 	} else if (cmd == RTM_ADD) {
2119 		sdl = (struct sockaddr_dl *)tempbuf;
2120 		bzero(sdl, sizeof(struct sockaddr_dl));
2121 		sdl->sdl_family = AF_LINK;
2122 		sdl->sdl_len = sizeof(struct sockaddr_dl);
2123 		sdl->sdl_type = ifa->ifa_ifp->if_type;
2124 		sdl->sdl_index = ifa->ifa_ifp->if_index;
2125         }
2126 	/*
2127 	 * Now go through all the requested tables (fibs) and do the
2128 	 * requested action. Realistically, this will either be fib 0
2129 	 * for protocols that don't do multiple tables or all the
2130 	 * tables for those that do.
2131 	 */
2132 	for ( fibnum = startfib; fibnum <= endfib; fibnum++) {
2133 		if (cmd == RTM_DELETE) {
2134 			struct radix_node *rn;
2135 			/*
2136 			 * Look up an rtentry that is in the routing tree and
2137 			 * contains the correct info.
2138 			 */
2139 			rnh = rt_tables_get_rnh(fibnum, dst->sa_family);
2140 			if (rnh == NULL)
2141 				/* this table doesn't exist but others might */
2142 				continue;
2143 			RIB_RLOCK(rnh);
2144 			rn = rnh->rnh_lookup(dst, netmask, &rnh->head);
2145 #ifdef RADIX_MPATH
2146 			if (rt_mpath_capable(rnh)) {
2147 
2148 				if (rn == NULL)
2149 					error = ESRCH;
2150 				else {
2151 					rt = RNTORT(rn);
2152 					/*
2153 					 * for interface route the
2154 					 * rt->rt_gateway is sockaddr_intf
2155 					 * for cloning ARP entries, so
2156 					 * rt_mpath_matchgate must use the
2157 					 * interface address
2158 					 */
2159 					rt = rt_mpath_matchgate(rt,
2160 					    ifa->ifa_addr);
2161 					if (rt == NULL)
2162 						error = ESRCH;
2163 				}
2164 			}
2165 #endif
2166 			error = (rn == NULL ||
2167 			    (rn->rn_flags & RNF_ROOT) ||
2168 			    RNTORT(rn)->rt_ifa != ifa);
2169 			RIB_RUNLOCK(rnh);
2170 			if (error) {
2171 				/* this is only an error if bad on ALL tables */
2172 				continue;
2173 			}
2174 		}
2175 		/*
2176 		 * Do the actual request
2177 		 */
2178 		bzero((caddr_t)&info, sizeof(info));
2179 		info.rti_ifa = ifa;
2180 		info.rti_flags = flags |
2181 		    (ifa->ifa_flags & ~IFA_RTSELF) | RTF_PINNED;
2182 		info.rti_info[RTAX_DST] = dst;
2183 		/*
2184 		 * doing this for compatibility reasons
2185 		 */
2186 		if (cmd == RTM_ADD)
2187 			info.rti_info[RTAX_GATEWAY] = (struct sockaddr *)sdl;
2188 		else
2189 			info.rti_info[RTAX_GATEWAY] = ifa->ifa_addr;
2190 		info.rti_info[RTAX_NETMASK] = netmask;
2191 		error = rtrequest1_fib(cmd, &info, &rt, fibnum);
2192 		if (error == 0 && rt != NULL) {
2193 			/*
2194 			 * notify any listening routing agents of the change
2195 			 */
2196 			RT_LOCK(rt);
2197 #ifdef RADIX_MPATH
2198 			/*
2199 			 * in case address alias finds the first address
2200 			 * e.g. ifconfig bge0 192.0.2.246/24
2201 			 * e.g. ifconfig bge0 192.0.2.247/24
2202 			 * the address set in the route is 192.0.2.246
2203 			 * so we need to replace it with 192.0.2.247
2204 			 */
2205 			if (memcmp(rt->rt_ifa->ifa_addr,
2206 			    ifa->ifa_addr, ifa->ifa_addr->sa_len)) {
2207 				ifa_free(rt->rt_ifa);
2208 				ifa_ref(ifa);
2209 				rt->rt_ifp = ifa->ifa_ifp;
2210 				rt->rt_ifa = ifa;
2211 			}
2212 #endif
2213 			RT_ADDREF(rt);
2214 			RT_UNLOCK(rt);
2215 			rt_newaddrmsg_fib(cmd, ifa, rt, fibnum);
2216 			RT_LOCK(rt);
2217 			RT_REMREF(rt);
2218 			if (cmd == RTM_DELETE) {
2219 				/*
2220 				 * If we are deleting, and we found an entry,
2221 				 * then it's been removed from the tree..
2222 				 * now throw it away.
2223 				 */
2224 				RTFREE_LOCKED(rt);
2225 			} else {
2226 				if (cmd == RTM_ADD) {
2227 					/*
2228 					 * We just wanted to add it..
2229 					 * we don't actually need a reference.
2230 					 */
2231 					RT_REMREF(rt);
2232 				}
2233 				RT_UNLOCK(rt);
2234 			}
2235 			didwork = 1;
2236 		}
2237 		if (error)
2238 			a_failure = error;
2239 	}
2240 	if (cmd == RTM_DELETE) {
2241 		if (didwork) {
2242 			error = 0;
2243 		} else {
2244 			/* we only give an error if it wasn't in any table */
2245 			error = ((flags & RTF_HOST) ?
2246 			    EHOSTUNREACH : ENETUNREACH);
2247 		}
2248 	} else {
2249 		if (a_failure) {
2250 			/* return an error if any of them failed */
2251 			error = a_failure;
2252 		}
2253 	}
2254 	return (error);
2255 }
2256 
2257 /*
2258  * Set up a routing table entry, normally
2259  * for an interface.
2260  */
2261 int
2262 rtinit(struct ifaddr *ifa, int cmd, int flags)
2263 {
2264 	struct sockaddr *dst;
2265 	int fib = RT_DEFAULT_FIB;
2266 
2267 	if (flags & RTF_HOST) {
2268 		dst = ifa->ifa_dstaddr;
2269 	} else {
2270 		dst = ifa->ifa_addr;
2271 	}
2272 
2273 	switch (dst->sa_family) {
2274 	case AF_INET6:
2275 	case AF_INET:
2276 		/* We do support multiple FIBs. */
2277 		fib = RT_ALL_FIBS;
2278 		break;
2279 	}
2280 	return (rtinit1(ifa, cmd, flags, fib));
2281 }
2282 
2283 /*
2284  * Announce interface address arrival/withdraw
2285  * Returns 0 on success.
2286  */
2287 int
2288 rt_addrmsg(int cmd, struct ifaddr *ifa, int fibnum)
2289 {
2290 
2291 	KASSERT(cmd == RTM_ADD || cmd == RTM_DELETE,
2292 	    ("unexpected cmd %d", cmd));
2293 	KASSERT(fibnum == RT_ALL_FIBS || (fibnum >= 0 && fibnum < rt_numfibs),
2294 	    ("%s: fib out of range 0 <=%d<%d", __func__, fibnum, rt_numfibs));
2295 
2296 	EVENTHANDLER_DIRECT_INVOKE(rt_addrmsg, ifa, cmd);
2297 	return (rtsock_addrmsg(cmd, ifa, fibnum));
2298 }
2299 
2300 /*
2301  * Announce kernel-originated route addition/removal to rtsock based on @rt data.
2302  * cmd: RTM_ cmd
2303  * @rt: valid rtentry
2304  * @ifp: target route interface
2305  * @fibnum: fib id or RT_ALL_FIBS
2306  *
2307  * Returns 0 on success.
2308  */
2309 int
2310 rt_routemsg(int cmd, struct rtentry *rt, struct ifnet *ifp, int rti_addrs,
2311     int fibnum)
2312 {
2313 
2314 	KASSERT(cmd == RTM_ADD || cmd == RTM_DELETE,
2315 	    ("unexpected cmd %d", cmd));
2316 
2317 	KASSERT(fibnum == RT_ALL_FIBS || (fibnum >= 0 && fibnum < rt_numfibs),
2318 	    ("%s: fib out of range 0 <=%d<%d", __func__, fibnum, rt_numfibs));
2319 
2320 	KASSERT(rt_key(rt) != NULL, (":%s: rt_key must be supplied", __func__));
2321 
2322 	return (rtsock_routemsg(cmd, rt, ifp, 0, fibnum));
2323 }
2324 
2325 /*
2326  * Announce kernel-originated route addition/removal to rtsock based on @rt data.
2327  * cmd: RTM_ cmd
2328  * @info: addrinfo structure with valid data.
2329  * @fibnum: fib id or RT_ALL_FIBS
2330  *
2331  * Returns 0 on success.
2332  */
2333 int
2334 rt_routemsg_info(int cmd, struct rt_addrinfo *info, int fibnum)
2335 {
2336 
2337 	KASSERT(cmd == RTM_ADD || cmd == RTM_DELETE || cmd == RTM_CHANGE,
2338 	    ("unexpected cmd %d", cmd));
2339 
2340 	KASSERT(fibnum == RT_ALL_FIBS || (fibnum >= 0 && fibnum < rt_numfibs),
2341 	    ("%s: fib out of range 0 <=%d<%d", __func__, fibnum, rt_numfibs));
2342 
2343 	KASSERT(info->rti_info[RTAX_DST] != NULL, (":%s: RTAX_DST must be supplied", __func__));
2344 
2345 	return (rtsock_routemsg_info(cmd, info, fibnum));
2346 }
2347 
2348 
2349 /*
2350  * This is called to generate messages from the routing socket
2351  * indicating a network interface has had addresses associated with it.
2352  */
2353 void
2354 rt_newaddrmsg_fib(int cmd, struct ifaddr *ifa, struct rtentry *rt, int fibnum)
2355 {
2356 
2357 	KASSERT(cmd == RTM_ADD || cmd == RTM_DELETE,
2358 		("unexpected cmd %u", cmd));
2359 	KASSERT(fibnum == RT_ALL_FIBS || (fibnum >= 0 && fibnum < rt_numfibs),
2360 	    ("%s: fib out of range 0 <=%d<%d", __func__, fibnum, rt_numfibs));
2361 
2362 	if (cmd == RTM_ADD) {
2363 		rt_addrmsg(cmd, ifa, fibnum);
2364 		if (rt != NULL)
2365 			rt_routemsg(cmd, rt, ifa->ifa_ifp, 0, fibnum);
2366 	} else {
2367 		if (rt != NULL)
2368 			rt_routemsg(cmd, rt, ifa->ifa_ifp, 0, fibnum);
2369 		rt_addrmsg(cmd, ifa, fibnum);
2370 	}
2371 }
2372 
2373