xref: /freebsd/sys/net/route.c (revision 4c9e27bd0a5f7fda85b0c0bf750575aee300a172)
1 /*-
2  * Copyright (c) 1980, 1986, 1991, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 4. Neither the name of the University nor the names of its contributors
14  *    may be used to endorse or promote products derived from this software
15  *    without specific prior written permission.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  *
29  *	@(#)route.c	8.3.1.1 (Berkeley) 2/23/95
30  * $FreeBSD$
31  */
32 /************************************************************************
33  * Note: In this file a 'fib' is a "forwarding information base"	*
34  * Which is the new name for an in kernel routing (next hop) table.	*
35  ***********************************************************************/
36 
37 #include "opt_inet.h"
38 #include "opt_inet6.h"
39 #include "opt_route.h"
40 #include "opt_mrouting.h"
41 #include "opt_mpath.h"
42 
43 #include <sys/param.h>
44 #include <sys/systm.h>
45 #include <sys/syslog.h>
46 #include <sys/malloc.h>
47 #include <sys/mbuf.h>
48 #include <sys/socket.h>
49 #include <sys/sysctl.h>
50 #include <sys/syslog.h>
51 #include <sys/sysproto.h>
52 #include <sys/proc.h>
53 #include <sys/domain.h>
54 #include <sys/kernel.h>
55 
56 #include <net/if.h>
57 #include <net/if_var.h>
58 #include <net/if_dl.h>
59 #include <net/route.h>
60 #include <net/vnet.h>
61 #include <net/flowtable.h>
62 
63 #ifdef RADIX_MPATH
64 #include <net/radix_mpath.h>
65 #endif
66 
67 #include <netinet/in.h>
68 #include <netinet/ip_mroute.h>
69 
70 #include <vm/uma.h>
71 
72 #define	RT_MAXFIBS	UINT16_MAX
73 
74 /* Kernel config default option. */
75 #ifdef ROUTETABLES
76 #if ROUTETABLES <= 0
77 #error "ROUTETABLES defined too low"
78 #endif
79 #if ROUTETABLES > RT_MAXFIBS
80 #error "ROUTETABLES defined too big"
81 #endif
82 #define	RT_NUMFIBS	ROUTETABLES
83 #endif /* ROUTETABLES */
84 /* Initialize to default if not otherwise set. */
85 #ifndef	RT_NUMFIBS
86 #define	RT_NUMFIBS	1
87 #endif
88 
89 /* This is read-only.. */
90 u_int rt_numfibs = RT_NUMFIBS;
91 SYSCTL_UINT(_net, OID_AUTO, fibs, CTLFLAG_RD, &rt_numfibs, 0, "");
92 /* and this can be set too big but will be fixed before it is used */
93 TUNABLE_INT("net.fibs", &rt_numfibs);
94 
95 /*
96  * By default add routes to all fibs for new interfaces.
97  * Once this is set to 0 then only allocate routes on interface
98  * changes for the FIB of the caller when adding a new set of addresses
99  * to an interface.  XXX this is a shotgun aproach to a problem that needs
100  * a more fine grained solution.. that will come.
101  * XXX also has the problems getting the FIB from curthread which will not
102  * always work given the fib can be overridden and prefixes can be added
103  * from the network stack context.
104  */
105 u_int rt_add_addr_allfibs = 1;
106 SYSCTL_UINT(_net, OID_AUTO, add_addr_allfibs, CTLFLAG_RW,
107     &rt_add_addr_allfibs, 0, "");
108 TUNABLE_INT("net.add_addr_allfibs", &rt_add_addr_allfibs);
109 
110 VNET_DEFINE(struct rtstat, rtstat);
111 #define	V_rtstat	VNET(rtstat)
112 
113 VNET_DEFINE(struct radix_node_head *, rt_tables);
114 #define	V_rt_tables	VNET(rt_tables)
115 
116 VNET_DEFINE(int, rttrash);		/* routes not in table but not freed */
117 #define	V_rttrash	VNET(rttrash)
118 
119 
120 /* compare two sockaddr structures */
121 #define	sa_equal(a1, a2) (bcmp((a1), (a2), (a1)->sa_len) == 0)
122 
123 /*
124  * Convert a 'struct radix_node *' to a 'struct rtentry *'.
125  * The operation can be done safely (in this code) because a
126  * 'struct rtentry' starts with two 'struct radix_node''s, the first
127  * one representing leaf nodes in the routing tree, which is
128  * what the code in radix.c passes us as a 'struct radix_node'.
129  *
130  * But because there are a lot of assumptions in this conversion,
131  * do not cast explicitly, but always use the macro below.
132  */
133 #define RNTORT(p)	((struct rtentry *)(p))
134 
135 static VNET_DEFINE(uma_zone_t, rtzone);		/* Routing table UMA zone. */
136 #define	V_rtzone	VNET(rtzone)
137 
138 /*
139  * handler for net.my_fibnum
140  */
141 static int
142 sysctl_my_fibnum(SYSCTL_HANDLER_ARGS)
143 {
144         int fibnum;
145         int error;
146 
147         fibnum = curthread->td_proc->p_fibnum;
148         error = sysctl_handle_int(oidp, &fibnum, 0, req);
149         return (error);
150 }
151 
152 SYSCTL_PROC(_net, OID_AUTO, my_fibnum, CTLTYPE_INT|CTLFLAG_RD,
153             NULL, 0, &sysctl_my_fibnum, "I", "default FIB of caller");
154 
155 static __inline struct radix_node_head **
156 rt_tables_get_rnh_ptr(int table, int fam)
157 {
158 	struct radix_node_head **rnh;
159 
160 	KASSERT(table >= 0 && table < rt_numfibs, ("%s: table out of bounds.",
161 	    __func__));
162 	KASSERT(fam >= 0 && fam < (AF_MAX+1), ("%s: fam out of bounds.",
163 	    __func__));
164 
165 	/* rnh is [fib=0][af=0]. */
166 	rnh = (struct radix_node_head **)V_rt_tables;
167 	/* Get the offset to the requested table and fam. */
168 	rnh += table * (AF_MAX+1) + fam;
169 
170 	return (rnh);
171 }
172 
173 struct radix_node_head *
174 rt_tables_get_rnh(int table, int fam)
175 {
176 
177 	return (*rt_tables_get_rnh_ptr(table, fam));
178 }
179 
180 /*
181  * route initialization must occur before ip6_init2(), which happenas at
182  * SI_ORDER_MIDDLE.
183  */
184 static void
185 route_init(void)
186 {
187 
188 	/* whack the tunable ints into  line. */
189 	if (rt_numfibs > RT_MAXFIBS)
190 		rt_numfibs = RT_MAXFIBS;
191 	if (rt_numfibs == 0)
192 		rt_numfibs = 1;
193 }
194 SYSINIT(route_init, SI_SUB_PROTO_DOMAIN, SI_ORDER_THIRD, route_init, 0);
195 
196 static void
197 vnet_route_init(const void *unused __unused)
198 {
199 	struct domain *dom;
200 	struct radix_node_head **rnh;
201 	int table;
202 	int fam;
203 
204 	V_rt_tables = malloc(rt_numfibs * (AF_MAX+1) *
205 	    sizeof(struct radix_node_head *), M_RTABLE, M_WAITOK|M_ZERO);
206 
207 	V_rtzone = uma_zcreate("rtentry", sizeof(struct rtentry), NULL, NULL,
208 	    NULL, NULL, UMA_ALIGN_PTR, 0);
209 	for (dom = domains; dom; dom = dom->dom_next) {
210 		if (dom->dom_rtattach == NULL)
211 			continue;
212 
213 		for  (table = 0; table < rt_numfibs; table++) {
214 			fam = dom->dom_family;
215 			if (table != 0 && fam != AF_INET6 && fam != AF_INET)
216 				break;
217 
218 			/*
219 			 * XXX MRT rtattach will be also called from
220 			 * vfs_export.c but the offset will be 0 (only for
221 			 * AF_INET and AF_INET6 which don't need it anyhow).
222 			 */
223 			rnh = rt_tables_get_rnh_ptr(table, fam);
224 			if (rnh == NULL)
225 				panic("%s: rnh NULL", __func__);
226 			dom->dom_rtattach((void **)rnh, dom->dom_rtoffset);
227 		}
228 	}
229 }
230 VNET_SYSINIT(vnet_route_init, SI_SUB_PROTO_DOMAIN, SI_ORDER_FOURTH,
231     vnet_route_init, 0);
232 
233 #ifdef VIMAGE
234 static void
235 vnet_route_uninit(const void *unused __unused)
236 {
237 	int table;
238 	int fam;
239 	struct domain *dom;
240 	struct radix_node_head **rnh;
241 
242 	for (dom = domains; dom; dom = dom->dom_next) {
243 		if (dom->dom_rtdetach == NULL)
244 			continue;
245 
246 		for (table = 0; table < rt_numfibs; table++) {
247 			fam = dom->dom_family;
248 
249 			if (table != 0 && fam != AF_INET6 && fam != AF_INET)
250 				break;
251 
252 			rnh = rt_tables_get_rnh_ptr(table, fam);
253 			if (rnh == NULL)
254 				panic("%s: rnh NULL", __func__);
255 			dom->dom_rtdetach((void **)rnh, dom->dom_rtoffset);
256 		}
257 	}
258 }
259 VNET_SYSUNINIT(vnet_route_uninit, SI_SUB_PROTO_DOMAIN, SI_ORDER_THIRD,
260     vnet_route_uninit, 0);
261 #endif
262 
263 #ifndef _SYS_SYSPROTO_H_
264 struct setfib_args {
265 	int     fibnum;
266 };
267 #endif
268 int
269 sys_setfib(struct thread *td, struct setfib_args *uap)
270 {
271 	if (uap->fibnum < 0 || uap->fibnum >= rt_numfibs)
272 		return EINVAL;
273 	td->td_proc->p_fibnum = uap->fibnum;
274 	return (0);
275 }
276 
277 /*
278  * Packet routing routines.
279  */
280 void
281 rtalloc(struct route *ro)
282 {
283 
284 	rtalloc_ign_fib(ro, 0UL, RT_DEFAULT_FIB);
285 }
286 
287 void
288 rtalloc_fib(struct route *ro, u_int fibnum)
289 {
290 	rtalloc_ign_fib(ro, 0UL, fibnum);
291 }
292 
293 void
294 rtalloc_ign(struct route *ro, u_long ignore)
295 {
296 	struct rtentry *rt;
297 
298 	if ((rt = ro->ro_rt) != NULL) {
299 		if (rt->rt_ifp != NULL && rt->rt_flags & RTF_UP)
300 			return;
301 		RTFREE(rt);
302 		ro->ro_rt = NULL;
303 	}
304 	ro->ro_rt = rtalloc1_fib(&ro->ro_dst, 1, ignore, RT_DEFAULT_FIB);
305 	if (ro->ro_rt)
306 		RT_UNLOCK(ro->ro_rt);
307 }
308 
309 void
310 rtalloc_ign_fib(struct route *ro, u_long ignore, u_int fibnum)
311 {
312 	struct rtentry *rt;
313 
314 	if ((rt = ro->ro_rt) != NULL) {
315 		if (rt->rt_ifp != NULL && rt->rt_flags & RTF_UP)
316 			return;
317 		RTFREE(rt);
318 		ro->ro_rt = NULL;
319 	}
320 	ro->ro_rt = rtalloc1_fib(&ro->ro_dst, 1, ignore, fibnum);
321 	if (ro->ro_rt)
322 		RT_UNLOCK(ro->ro_rt);
323 }
324 
325 /*
326  * Look up the route that matches the address given
327  * Or, at least try.. Create a cloned route if needed.
328  *
329  * The returned route, if any, is locked.
330  */
331 struct rtentry *
332 rtalloc1(struct sockaddr *dst, int report, u_long ignflags)
333 {
334 
335 	return (rtalloc1_fib(dst, report, ignflags, RT_DEFAULT_FIB));
336 }
337 
338 struct rtentry *
339 rtalloc1_fib(struct sockaddr *dst, int report, u_long ignflags,
340 		    u_int fibnum)
341 {
342 	struct radix_node_head *rnh;
343 	struct radix_node *rn;
344 	struct rtentry *newrt;
345 	struct rt_addrinfo info;
346 	int err = 0, msgtype = RTM_MISS;
347 	int needlock;
348 
349 	KASSERT((fibnum < rt_numfibs), ("rtalloc1_fib: bad fibnum"));
350 	switch (dst->sa_family) {
351 	case AF_INET6:
352 	case AF_INET:
353 		/* We support multiple FIBs. */
354 		break;
355 	default:
356 		fibnum = RT_DEFAULT_FIB;
357 		break;
358 	}
359 	rnh = rt_tables_get_rnh(fibnum, dst->sa_family);
360 	newrt = NULL;
361 	if (rnh == NULL)
362 		goto miss;
363 
364 	/*
365 	 * Look up the address in the table for that Address Family
366 	 */
367 	needlock = !(ignflags & RTF_RNH_LOCKED);
368 	if (needlock)
369 		RADIX_NODE_HEAD_RLOCK(rnh);
370 #ifdef INVARIANTS
371 	else
372 		RADIX_NODE_HEAD_LOCK_ASSERT(rnh);
373 #endif
374 	rn = rnh->rnh_matchaddr(dst, rnh);
375 	if (rn && ((rn->rn_flags & RNF_ROOT) == 0)) {
376 		newrt = RNTORT(rn);
377 		RT_LOCK(newrt);
378 		RT_ADDREF(newrt);
379 		if (needlock)
380 			RADIX_NODE_HEAD_RUNLOCK(rnh);
381 		goto done;
382 
383 	} else if (needlock)
384 		RADIX_NODE_HEAD_RUNLOCK(rnh);
385 
386 	/*
387 	 * Either we hit the root or couldn't find any match,
388 	 * Which basically means
389 	 * "caint get there frm here"
390 	 */
391 miss:
392 	V_rtstat.rts_unreach++;
393 
394 	if (report) {
395 		/*
396 		 * If required, report the failure to the supervising
397 		 * Authorities.
398 		 * For a delete, this is not an error. (report == 0)
399 		 */
400 		bzero(&info, sizeof(info));
401 		info.rti_info[RTAX_DST] = dst;
402 		rt_missmsg_fib(msgtype, &info, 0, err, fibnum);
403 	}
404 done:
405 	if (newrt)
406 		RT_LOCK_ASSERT(newrt);
407 	return (newrt);
408 }
409 
410 /*
411  * Remove a reference count from an rtentry.
412  * If the count gets low enough, take it out of the routing table
413  */
414 void
415 rtfree(struct rtentry *rt)
416 {
417 	struct radix_node_head *rnh;
418 
419 	KASSERT(rt != NULL,("%s: NULL rt", __func__));
420 	rnh = rt_tables_get_rnh(rt->rt_fibnum, rt_key(rt)->sa_family);
421 	KASSERT(rnh != NULL,("%s: NULL rnh", __func__));
422 
423 	RT_LOCK_ASSERT(rt);
424 
425 	/*
426 	 * The callers should use RTFREE_LOCKED() or RTFREE(), so
427 	 * we should come here exactly with the last reference.
428 	 */
429 	RT_REMREF(rt);
430 	if (rt->rt_refcnt > 0) {
431 		log(LOG_DEBUG, "%s: %p has %d refs\n", __func__, rt, rt->rt_refcnt);
432 		goto done;
433 	}
434 
435 	/*
436 	 * On last reference give the "close method" a chance
437 	 * to cleanup private state.  This also permits (for
438 	 * IPv4 and IPv6) a chance to decide if the routing table
439 	 * entry should be purged immediately or at a later time.
440 	 * When an immediate purge is to happen the close routine
441 	 * typically calls rtexpunge which clears the RTF_UP flag
442 	 * on the entry so that the code below reclaims the storage.
443 	 */
444 	if (rt->rt_refcnt == 0 && rnh->rnh_close)
445 		rnh->rnh_close((struct radix_node *)rt, rnh);
446 
447 	/*
448 	 * If we are no longer "up" (and ref == 0)
449 	 * then we can free the resources associated
450 	 * with the route.
451 	 */
452 	if ((rt->rt_flags & RTF_UP) == 0) {
453 		if (rt->rt_nodes->rn_flags & (RNF_ACTIVE | RNF_ROOT))
454 			panic("rtfree 2");
455 		/*
456 		 * the rtentry must have been removed from the routing table
457 		 * so it is represented in rttrash.. remove that now.
458 		 */
459 		V_rttrash--;
460 #ifdef	DIAGNOSTIC
461 		if (rt->rt_refcnt < 0) {
462 			printf("rtfree: %p not freed (neg refs)\n", rt);
463 			goto done;
464 		}
465 #endif
466 		/*
467 		 * release references on items we hold them on..
468 		 * e.g other routes and ifaddrs.
469 		 */
470 		if (rt->rt_ifa)
471 			ifa_free(rt->rt_ifa);
472 		/*
473 		 * The key is separatly alloc'd so free it (see rt_setgate()).
474 		 * This also frees the gateway, as they are always malloc'd
475 		 * together.
476 		 */
477 		Free(rt_key(rt));
478 
479 		/*
480 		 * and the rtentry itself of course
481 		 */
482 		RT_LOCK_DESTROY(rt);
483 		uma_zfree(V_rtzone, rt);
484 		return;
485 	}
486 done:
487 	RT_UNLOCK(rt);
488 }
489 
490 
491 /*
492  * Force a routing table entry to the specified
493  * destination to go through the given gateway.
494  * Normally called as a result of a routing redirect
495  * message from the network layer.
496  */
497 void
498 rtredirect(struct sockaddr *dst,
499 	struct sockaddr *gateway,
500 	struct sockaddr *netmask,
501 	int flags,
502 	struct sockaddr *src)
503 {
504 
505 	rtredirect_fib(dst, gateway, netmask, flags, src, RT_DEFAULT_FIB);
506 }
507 
508 void
509 rtredirect_fib(struct sockaddr *dst,
510 	struct sockaddr *gateway,
511 	struct sockaddr *netmask,
512 	int flags,
513 	struct sockaddr *src,
514 	u_int fibnum)
515 {
516 	struct rtentry *rt, *rt0 = NULL;
517 	int error = 0;
518 	short *stat = NULL;
519 	struct rt_addrinfo info;
520 	struct ifaddr *ifa;
521 	struct radix_node_head *rnh;
522 
523 	ifa = NULL;
524 	rnh = rt_tables_get_rnh(fibnum, dst->sa_family);
525 	if (rnh == NULL) {
526 		error = EAFNOSUPPORT;
527 		goto out;
528 	}
529 
530 	/* verify the gateway is directly reachable */
531 	if ((ifa = ifa_ifwithnet(gateway, 0)) == NULL) {
532 		error = ENETUNREACH;
533 		goto out;
534 	}
535 	rt = rtalloc1_fib(dst, 0, 0UL, fibnum);	/* NB: rt is locked */
536 	/*
537 	 * If the redirect isn't from our current router for this dst,
538 	 * it's either old or wrong.  If it redirects us to ourselves,
539 	 * we have a routing loop, perhaps as a result of an interface
540 	 * going down recently.
541 	 */
542 	if (!(flags & RTF_DONE) && rt &&
543 	     (!sa_equal(src, rt->rt_gateway) || rt->rt_ifa != ifa))
544 		error = EINVAL;
545 	else if (ifa_ifwithaddr_check(gateway))
546 		error = EHOSTUNREACH;
547 	if (error)
548 		goto done;
549 	/*
550 	 * Create a new entry if we just got back a wildcard entry
551 	 * or the lookup failed.  This is necessary for hosts
552 	 * which use routing redirects generated by smart gateways
553 	 * to dynamically build the routing tables.
554 	 */
555 	if (rt == NULL || (rt_mask(rt) && rt_mask(rt)->sa_len < 2))
556 		goto create;
557 	/*
558 	 * Don't listen to the redirect if it's
559 	 * for a route to an interface.
560 	 */
561 	if (rt->rt_flags & RTF_GATEWAY) {
562 		if (((rt->rt_flags & RTF_HOST) == 0) && (flags & RTF_HOST)) {
563 			/*
564 			 * Changing from route to net => route to host.
565 			 * Create new route, rather than smashing route to net.
566 			 */
567 		create:
568 			rt0 = rt;
569 			rt = NULL;
570 
571 			flags |=  RTF_GATEWAY | RTF_DYNAMIC;
572 			bzero((caddr_t)&info, sizeof(info));
573 			info.rti_info[RTAX_DST] = dst;
574 			info.rti_info[RTAX_GATEWAY] = gateway;
575 			info.rti_info[RTAX_NETMASK] = netmask;
576 			info.rti_ifa = ifa;
577 			info.rti_flags = flags;
578 			if (rt0 != NULL)
579 				RT_UNLOCK(rt0);	/* drop lock to avoid LOR with RNH */
580 			error = rtrequest1_fib(RTM_ADD, &info, &rt, fibnum);
581 			if (rt != NULL) {
582 				RT_LOCK(rt);
583 				if (rt0 != NULL)
584 					EVENTHANDLER_INVOKE(route_redirect_event, rt0, rt, dst);
585 				flags = rt->rt_flags;
586 			}
587 			if (rt0 != NULL)
588 				RTFREE(rt0);
589 
590 			stat = &V_rtstat.rts_dynamic;
591 		} else {
592 			struct rtentry *gwrt;
593 
594 			/*
595 			 * Smash the current notion of the gateway to
596 			 * this destination.  Should check about netmask!!!
597 			 */
598 			rt->rt_flags |= RTF_MODIFIED;
599 			flags |= RTF_MODIFIED;
600 			stat = &V_rtstat.rts_newgateway;
601 			/*
602 			 * add the key and gateway (in one malloc'd chunk).
603 			 */
604 			RT_UNLOCK(rt);
605 			RADIX_NODE_HEAD_LOCK(rnh);
606 			RT_LOCK(rt);
607 			rt_setgate(rt, rt_key(rt), gateway);
608 			gwrt = rtalloc1(gateway, 1, RTF_RNH_LOCKED);
609 			RADIX_NODE_HEAD_UNLOCK(rnh);
610 			EVENTHANDLER_INVOKE(route_redirect_event, rt, gwrt, dst);
611 			RTFREE_LOCKED(gwrt);
612 		}
613 	} else
614 		error = EHOSTUNREACH;
615 done:
616 	if (rt)
617 		RTFREE_LOCKED(rt);
618 out:
619 	if (error)
620 		V_rtstat.rts_badredirect++;
621 	else if (stat != NULL)
622 		(*stat)++;
623 	bzero((caddr_t)&info, sizeof(info));
624 	info.rti_info[RTAX_DST] = dst;
625 	info.rti_info[RTAX_GATEWAY] = gateway;
626 	info.rti_info[RTAX_NETMASK] = netmask;
627 	info.rti_info[RTAX_AUTHOR] = src;
628 	rt_missmsg_fib(RTM_REDIRECT, &info, flags, error, fibnum);
629 	if (ifa != NULL)
630 		ifa_free(ifa);
631 }
632 
633 int
634 rtioctl(u_long req, caddr_t data)
635 {
636 
637 	return (rtioctl_fib(req, data, RT_DEFAULT_FIB));
638 }
639 
640 /*
641  * Routing table ioctl interface.
642  */
643 int
644 rtioctl_fib(u_long req, caddr_t data, u_int fibnum)
645 {
646 
647 	/*
648 	 * If more ioctl commands are added here, make sure the proper
649 	 * super-user checks are being performed because it is possible for
650 	 * prison-root to make it this far if raw sockets have been enabled
651 	 * in jails.
652 	 */
653 #ifdef INET
654 	/* Multicast goop, grrr... */
655 	return mrt_ioctl ? mrt_ioctl(req, data, fibnum) : EOPNOTSUPP;
656 #else /* INET */
657 	return ENXIO;
658 #endif /* INET */
659 }
660 
661 /*
662  * For both ifa_ifwithroute() routines, 'ifa' is returned referenced.
663  */
664 struct ifaddr *
665 ifa_ifwithroute(int flags, struct sockaddr *dst, struct sockaddr *gateway)
666 {
667 
668 	return (ifa_ifwithroute_fib(flags, dst, gateway, RT_DEFAULT_FIB));
669 }
670 
671 struct ifaddr *
672 ifa_ifwithroute_fib(int flags, struct sockaddr *dst, struct sockaddr *gateway,
673 				u_int fibnum)
674 {
675 	register struct ifaddr *ifa;
676 	int not_found = 0;
677 
678 	if ((flags & RTF_GATEWAY) == 0) {
679 		/*
680 		 * If we are adding a route to an interface,
681 		 * and the interface is a pt to pt link
682 		 * we should search for the destination
683 		 * as our clue to the interface.  Otherwise
684 		 * we can use the local address.
685 		 */
686 		ifa = NULL;
687 		if (flags & RTF_HOST)
688 			ifa = ifa_ifwithdstaddr(dst);
689 		if (ifa == NULL)
690 			ifa = ifa_ifwithaddr(gateway);
691 	} else {
692 		/*
693 		 * If we are adding a route to a remote net
694 		 * or host, the gateway may still be on the
695 		 * other end of a pt to pt link.
696 		 */
697 		ifa = ifa_ifwithdstaddr(gateway);
698 	}
699 	if (ifa == NULL)
700 		ifa = ifa_ifwithnet(gateway, 0);
701 	if (ifa == NULL) {
702 		struct rtentry *rt = rtalloc1_fib(gateway, 0, RTF_RNH_LOCKED, fibnum);
703 		if (rt == NULL)
704 			return (NULL);
705 		/*
706 		 * dismiss a gateway that is reachable only
707 		 * through the default router
708 		 */
709 		switch (gateway->sa_family) {
710 		case AF_INET:
711 			if (satosin(rt_key(rt))->sin_addr.s_addr == INADDR_ANY)
712 				not_found = 1;
713 			break;
714 		case AF_INET6:
715 			if (IN6_IS_ADDR_UNSPECIFIED(&satosin6(rt_key(rt))->sin6_addr))
716 				not_found = 1;
717 			break;
718 		default:
719 			break;
720 		}
721 		if (!not_found && rt->rt_ifa != NULL) {
722 			ifa = rt->rt_ifa;
723 			ifa_ref(ifa);
724 		}
725 		RT_REMREF(rt);
726 		RT_UNLOCK(rt);
727 		if (not_found || ifa == NULL)
728 			return (NULL);
729 	}
730 	if (ifa->ifa_addr->sa_family != dst->sa_family) {
731 		struct ifaddr *oifa = ifa;
732 		ifa = ifaof_ifpforaddr(dst, ifa->ifa_ifp);
733 		if (ifa == NULL)
734 			ifa = oifa;
735 		else
736 			ifa_free(oifa);
737 	}
738 	return (ifa);
739 }
740 
741 /*
742  * Do appropriate manipulations of a routing tree given
743  * all the bits of info needed
744  */
745 int
746 rtrequest(int req,
747 	struct sockaddr *dst,
748 	struct sockaddr *gateway,
749 	struct sockaddr *netmask,
750 	int flags,
751 	struct rtentry **ret_nrt)
752 {
753 
754 	return (rtrequest_fib(req, dst, gateway, netmask, flags, ret_nrt,
755 	    RT_DEFAULT_FIB));
756 }
757 
758 int
759 rtrequest_fib(int req,
760 	struct sockaddr *dst,
761 	struct sockaddr *gateway,
762 	struct sockaddr *netmask,
763 	int flags,
764 	struct rtentry **ret_nrt,
765 	u_int fibnum)
766 {
767 	struct rt_addrinfo info;
768 
769 	if (dst->sa_len == 0)
770 		return(EINVAL);
771 
772 	bzero((caddr_t)&info, sizeof(info));
773 	info.rti_flags = flags;
774 	info.rti_info[RTAX_DST] = dst;
775 	info.rti_info[RTAX_GATEWAY] = gateway;
776 	info.rti_info[RTAX_NETMASK] = netmask;
777 	return rtrequest1_fib(req, &info, ret_nrt, fibnum);
778 }
779 
780 /*
781  * These (questionable) definitions of apparent local variables apply
782  * to the next two functions.  XXXXXX!!!
783  */
784 #define	dst	info->rti_info[RTAX_DST]
785 #define	gateway	info->rti_info[RTAX_GATEWAY]
786 #define	netmask	info->rti_info[RTAX_NETMASK]
787 #define	ifaaddr	info->rti_info[RTAX_IFA]
788 #define	ifpaddr	info->rti_info[RTAX_IFP]
789 #define	flags	info->rti_flags
790 
791 int
792 rt_getifa(struct rt_addrinfo *info)
793 {
794 
795 	return (rt_getifa_fib(info, RT_DEFAULT_FIB));
796 }
797 
798 /*
799  * Look up rt_addrinfo for a specific fib.  Note that if rti_ifa is defined,
800  * it will be referenced so the caller must free it.
801  */
802 int
803 rt_getifa_fib(struct rt_addrinfo *info, u_int fibnum)
804 {
805 	struct ifaddr *ifa;
806 	int error = 0;
807 
808 	/*
809 	 * ifp may be specified by sockaddr_dl
810 	 * when protocol address is ambiguous.
811 	 */
812 	if (info->rti_ifp == NULL && ifpaddr != NULL &&
813 	    ifpaddr->sa_family == AF_LINK &&
814 	    (ifa = ifa_ifwithnet(ifpaddr, 0)) != NULL) {
815 		info->rti_ifp = ifa->ifa_ifp;
816 		ifa_free(ifa);
817 	}
818 	if (info->rti_ifa == NULL && ifaaddr != NULL)
819 		info->rti_ifa = ifa_ifwithaddr(ifaaddr);
820 	if (info->rti_ifa == NULL) {
821 		struct sockaddr *sa;
822 
823 		sa = ifaaddr != NULL ? ifaaddr :
824 		    (gateway != NULL ? gateway : dst);
825 		if (sa != NULL && info->rti_ifp != NULL)
826 			info->rti_ifa = ifaof_ifpforaddr(sa, info->rti_ifp);
827 		else if (dst != NULL && gateway != NULL)
828 			info->rti_ifa = ifa_ifwithroute_fib(flags, dst, gateway,
829 							fibnum);
830 		else if (sa != NULL)
831 			info->rti_ifa = ifa_ifwithroute_fib(flags, sa, sa,
832 							fibnum);
833 	}
834 	if ((ifa = info->rti_ifa) != NULL) {
835 		if (info->rti_ifp == NULL)
836 			info->rti_ifp = ifa->ifa_ifp;
837 	} else
838 		error = ENETUNREACH;
839 	return (error);
840 }
841 
842 /*
843  * Expunges references to a route that's about to be reclaimed.
844  * The route must be locked.
845  */
846 int
847 rtexpunge(struct rtentry *rt)
848 {
849 #if !defined(RADIX_MPATH)
850 	struct radix_node *rn;
851 #else
852 	struct rt_addrinfo info;
853 	int fib;
854 	struct rtentry *rt0;
855 #endif
856 	struct radix_node_head *rnh;
857 	struct ifaddr *ifa;
858 	int error = 0;
859 
860 	/*
861 	 * Find the correct routing tree to use for this Address Family
862 	 */
863 	rnh = rt_tables_get_rnh(rt->rt_fibnum, rt_key(rt)->sa_family);
864 	RT_LOCK_ASSERT(rt);
865 	if (rnh == NULL)
866 		return (EAFNOSUPPORT);
867 	RADIX_NODE_HEAD_LOCK_ASSERT(rnh);
868 
869 #ifdef RADIX_MPATH
870 	fib = rt->rt_fibnum;
871 	bzero(&info, sizeof(info));
872 	info.rti_ifp = rt->rt_ifp;
873 	info.rti_flags = RTF_RNH_LOCKED;
874 	info.rti_info[RTAX_DST] = rt_key(rt);
875 	info.rti_info[RTAX_GATEWAY] = rt->rt_ifa->ifa_addr;
876 
877 	RT_UNLOCK(rt);
878 	error = rtrequest1_fib(RTM_DELETE, &info, &rt0, fib);
879 
880 	if (error == 0 && rt0 != NULL) {
881 		rt = rt0;
882 		RT_LOCK(rt);
883 	} else if (error != 0) {
884 		RT_LOCK(rt);
885 		return (error);
886 	}
887 #else
888 	/*
889 	 * Remove the item from the tree; it should be there,
890 	 * but when callers invoke us blindly it may not (sigh).
891 	 */
892 	rn = rnh->rnh_deladdr(rt_key(rt), rt_mask(rt), rnh);
893 	if (rn == NULL) {
894 		error = ESRCH;
895 		goto bad;
896 	}
897 	KASSERT((rn->rn_flags & (RNF_ACTIVE | RNF_ROOT)) == 0,
898 		("unexpected flags 0x%x", rn->rn_flags));
899 	KASSERT(rt == RNTORT(rn),
900 		("lookup mismatch, rt %p rn %p", rt, rn));
901 #endif /* RADIX_MPATH */
902 
903 	rt->rt_flags &= ~RTF_UP;
904 
905 	/*
906 	 * Give the protocol a chance to keep things in sync.
907 	 */
908 	if ((ifa = rt->rt_ifa) && ifa->ifa_rtrequest) {
909 		struct rt_addrinfo info;
910 
911 		bzero((caddr_t)&info, sizeof(info));
912 		info.rti_flags = rt->rt_flags;
913 		info.rti_info[RTAX_DST] = rt_key(rt);
914 		info.rti_info[RTAX_GATEWAY] = rt->rt_gateway;
915 		info.rti_info[RTAX_NETMASK] = rt_mask(rt);
916 		ifa->ifa_rtrequest(RTM_DELETE, rt, &info);
917 	}
918 
919 	/*
920 	 * one more rtentry floating around that is not
921 	 * linked to the routing table.
922 	 */
923 	V_rttrash++;
924 #if !defined(RADIX_MPATH)
925 bad:
926 #endif
927 	return (error);
928 }
929 
930 #ifdef RADIX_MPATH
931 static int
932 rn_mpath_update(int req, struct rt_addrinfo *info,
933     struct radix_node_head *rnh, struct rtentry **ret_nrt)
934 {
935 	/*
936 	 * if we got multipath routes, we require users to specify
937 	 * a matching RTAX_GATEWAY.
938 	 */
939 	struct rtentry *rt, *rto = NULL;
940 	register struct radix_node *rn;
941 	int error = 0;
942 
943 	rn = rnh->rnh_matchaddr(dst, rnh);
944 	if (rn == NULL)
945 		return (ESRCH);
946 	rto = rt = RNTORT(rn);
947 	rt = rt_mpath_matchgate(rt, gateway);
948 	if (rt == NULL)
949 		return (ESRCH);
950 	/*
951 	 * this is the first entry in the chain
952 	 */
953 	if (rto == rt) {
954 		rn = rn_mpath_next((struct radix_node *)rt);
955 		/*
956 		 * there is another entry, now it's active
957 		 */
958 		if (rn) {
959 			rto = RNTORT(rn);
960 			RT_LOCK(rto);
961 			rto->rt_flags |= RTF_UP;
962 			RT_UNLOCK(rto);
963 		} else if (rt->rt_flags & RTF_GATEWAY) {
964 			/*
965 			 * For gateway routes, we need to
966 			 * make sure that we we are deleting
967 			 * the correct gateway.
968 			 * rt_mpath_matchgate() does not
969 			 * check the case when there is only
970 			 * one route in the chain.
971 			 */
972 			if (gateway &&
973 			    (rt->rt_gateway->sa_len != gateway->sa_len ||
974 				memcmp(rt->rt_gateway, gateway, gateway->sa_len)))
975 				error = ESRCH;
976 			else {
977 				/*
978 				 * remove from tree before returning it
979 				 * to the caller
980 				 */
981 				rn = rnh->rnh_deladdr(dst, netmask, rnh);
982 				KASSERT(rt == RNTORT(rn), ("radix node disappeared"));
983 				goto gwdelete;
984 			}
985 
986 		}
987 		/*
988 		 * use the normal delete code to remove
989 		 * the first entry
990 		 */
991 		if (req != RTM_DELETE)
992 			goto nondelete;
993 
994 		error = ENOENT;
995 		goto done;
996 	}
997 
998 	/*
999 	 * if the entry is 2nd and on up
1000 	 */
1001 	if ((req == RTM_DELETE) && !rt_mpath_deldup(rto, rt))
1002 		panic ("rtrequest1: rt_mpath_deldup");
1003 gwdelete:
1004 	RT_LOCK(rt);
1005 	RT_ADDREF(rt);
1006 	if (req == RTM_DELETE) {
1007 		rt->rt_flags &= ~RTF_UP;
1008 		/*
1009 		 * One more rtentry floating around that is not
1010 		 * linked to the routing table. rttrash will be decremented
1011 		 * when RTFREE(rt) is eventually called.
1012 		 */
1013 		V_rttrash++;
1014 	}
1015 
1016 nondelete:
1017 	if (req != RTM_DELETE)
1018 		panic("unrecognized request %d", req);
1019 
1020 
1021 	/*
1022 	 * If the caller wants it, then it can have it,
1023 	 * but it's up to it to free the rtentry as we won't be
1024 	 * doing it.
1025 	 */
1026 	if (ret_nrt) {
1027 		*ret_nrt = rt;
1028 		RT_UNLOCK(rt);
1029 	} else
1030 		RTFREE_LOCKED(rt);
1031 done:
1032 	return (error);
1033 }
1034 #endif
1035 
1036 int
1037 rtrequest1_fib(int req, struct rt_addrinfo *info, struct rtentry **ret_nrt,
1038 				u_int fibnum)
1039 {
1040 	int error = 0, needlock = 0;
1041 	register struct rtentry *rt;
1042 #ifdef FLOWTABLE
1043 	register struct rtentry *rt0;
1044 #endif
1045 	register struct radix_node *rn;
1046 	register struct radix_node_head *rnh;
1047 	struct ifaddr *ifa;
1048 	struct sockaddr *ndst;
1049 	struct sockaddr_storage mdst;
1050 #define senderr(x) { error = x ; goto bad; }
1051 
1052 	KASSERT((fibnum < rt_numfibs), ("rtrequest1_fib: bad fibnum"));
1053 	switch (dst->sa_family) {
1054 	case AF_INET6:
1055 	case AF_INET:
1056 		/* We support multiple FIBs. */
1057 		break;
1058 	default:
1059 		fibnum = RT_DEFAULT_FIB;
1060 		break;
1061 	}
1062 
1063 	/*
1064 	 * Find the correct routing tree to use for this Address Family
1065 	 */
1066 	rnh = rt_tables_get_rnh(fibnum, dst->sa_family);
1067 	if (rnh == NULL)
1068 		return (EAFNOSUPPORT);
1069 	needlock = ((flags & RTF_RNH_LOCKED) == 0);
1070 	flags &= ~RTF_RNH_LOCKED;
1071 	if (needlock)
1072 		RADIX_NODE_HEAD_LOCK(rnh);
1073 	else
1074 		RADIX_NODE_HEAD_LOCK_ASSERT(rnh);
1075 	/*
1076 	 * If we are adding a host route then we don't want to put
1077 	 * a netmask in the tree, nor do we want to clone it.
1078 	 */
1079 	if (flags & RTF_HOST)
1080 		netmask = NULL;
1081 
1082 	switch (req) {
1083 	case RTM_DELETE:
1084 		if (netmask) {
1085 			rt_maskedcopy(dst, (struct sockaddr *)&mdst, netmask);
1086 			dst = (struct sockaddr *)&mdst;
1087 		}
1088 #ifdef RADIX_MPATH
1089 		if (rn_mpath_capable(rnh)) {
1090 			error = rn_mpath_update(req, info, rnh, ret_nrt);
1091 			/*
1092 			 * "bad" holds true for the success case
1093 			 * as well
1094 			 */
1095 			if (error != ENOENT)
1096 				goto bad;
1097 			error = 0;
1098 		}
1099 #endif
1100 		if ((flags & RTF_PINNED) == 0) {
1101 			/* Check if target route can be deleted */
1102 			rt = (struct rtentry *)rnh->rnh_lookup(dst,
1103 			    netmask, rnh);
1104 			if ((rt != NULL) && (rt->rt_flags & RTF_PINNED))
1105 				senderr(EADDRINUSE);
1106 		}
1107 
1108 		/*
1109 		 * Remove the item from the tree and return it.
1110 		 * Complain if it is not there and do no more processing.
1111 		 */
1112 		rn = rnh->rnh_deladdr(dst, netmask, rnh);
1113 		if (rn == NULL)
1114 			senderr(ESRCH);
1115 		if (rn->rn_flags & (RNF_ACTIVE | RNF_ROOT))
1116 			panic ("rtrequest delete");
1117 		rt = RNTORT(rn);
1118 		RT_LOCK(rt);
1119 		RT_ADDREF(rt);
1120 		rt->rt_flags &= ~RTF_UP;
1121 
1122 		/*
1123 		 * give the protocol a chance to keep things in sync.
1124 		 */
1125 		if ((ifa = rt->rt_ifa) && ifa->ifa_rtrequest)
1126 			ifa->ifa_rtrequest(RTM_DELETE, rt, info);
1127 
1128 		/*
1129 		 * One more rtentry floating around that is not
1130 		 * linked to the routing table. rttrash will be decremented
1131 		 * when RTFREE(rt) is eventually called.
1132 		 */
1133 		V_rttrash++;
1134 
1135 		/*
1136 		 * If the caller wants it, then it can have it,
1137 		 * but it's up to it to free the rtentry as we won't be
1138 		 * doing it.
1139 		 */
1140 		if (ret_nrt) {
1141 			*ret_nrt = rt;
1142 			RT_UNLOCK(rt);
1143 		} else
1144 			RTFREE_LOCKED(rt);
1145 		break;
1146 	case RTM_RESOLVE:
1147 		/*
1148 		 * resolve was only used for route cloning
1149 		 * here for compat
1150 		 */
1151 		break;
1152 	case RTM_ADD:
1153 		if ((flags & RTF_GATEWAY) && !gateway)
1154 			senderr(EINVAL);
1155 		if (dst && gateway && (dst->sa_family != gateway->sa_family) &&
1156 		    (gateway->sa_family != AF_UNSPEC) && (gateway->sa_family != AF_LINK))
1157 			senderr(EINVAL);
1158 
1159 		if (info->rti_ifa == NULL) {
1160 			error = rt_getifa_fib(info, fibnum);
1161 			if (error)
1162 				senderr(error);
1163 		} else
1164 			ifa_ref(info->rti_ifa);
1165 		ifa = info->rti_ifa;
1166 		rt = uma_zalloc(V_rtzone, M_NOWAIT | M_ZERO);
1167 		if (rt == NULL) {
1168 			ifa_free(ifa);
1169 			senderr(ENOBUFS);
1170 		}
1171 		RT_LOCK_INIT(rt);
1172 		rt->rt_flags = RTF_UP | flags;
1173 		rt->rt_fibnum = fibnum;
1174 		/*
1175 		 * Add the gateway. Possibly re-malloc-ing the storage for it.
1176 		 */
1177 		RT_LOCK(rt);
1178 		if ((error = rt_setgate(rt, dst, gateway)) != 0) {
1179 			RT_LOCK_DESTROY(rt);
1180 			ifa_free(ifa);
1181 			uma_zfree(V_rtzone, rt);
1182 			senderr(error);
1183 		}
1184 
1185 		/*
1186 		 * point to the (possibly newly malloc'd) dest address.
1187 		 */
1188 		ndst = (struct sockaddr *)rt_key(rt);
1189 
1190 		/*
1191 		 * make sure it contains the value we want (masked if needed).
1192 		 */
1193 		if (netmask) {
1194 			rt_maskedcopy(dst, ndst, netmask);
1195 		} else
1196 			bcopy(dst, ndst, dst->sa_len);
1197 
1198 		/*
1199 		 * We use the ifa reference returned by rt_getifa_fib().
1200 		 * This moved from below so that rnh->rnh_addaddr() can
1201 		 * examine the ifa and  ifa->ifa_ifp if it so desires.
1202 		 */
1203 		rt->rt_ifa = ifa;
1204 		rt->rt_ifp = ifa->ifa_ifp;
1205 		rt->rt_rmx.rmx_weight = 1;
1206 
1207 #ifdef RADIX_MPATH
1208 		/* do not permit exactly the same dst/mask/gw pair */
1209 		if (rn_mpath_capable(rnh) &&
1210 			rt_mpath_conflict(rnh, rt, netmask)) {
1211 			ifa_free(rt->rt_ifa);
1212 			Free(rt_key(rt));
1213 			RT_LOCK_DESTROY(rt);
1214 			uma_zfree(V_rtzone, rt);
1215 			senderr(EEXIST);
1216 		}
1217 #endif
1218 
1219 #ifdef FLOWTABLE
1220 		rt0 = NULL;
1221 		/* "flow-table" only supports IPv6 and IPv4 at the moment. */
1222 		switch (dst->sa_family) {
1223 #ifdef INET6
1224 		case AF_INET6:
1225 #endif
1226 #ifdef INET
1227 		case AF_INET:
1228 #endif
1229 #if defined(INET6) || defined(INET)
1230 			rn = rnh->rnh_matchaddr(dst, rnh);
1231 			if (rn && ((rn->rn_flags & RNF_ROOT) == 0)) {
1232 				struct sockaddr *mask;
1233 				u_char *m, *n;
1234 				int len;
1235 
1236 				/*
1237 				 * compare mask to see if the new route is
1238 				 * more specific than the existing one
1239 				 */
1240 				rt0 = RNTORT(rn);
1241 				RT_LOCK(rt0);
1242 				RT_ADDREF(rt0);
1243 				RT_UNLOCK(rt0);
1244 				/*
1245 				 * A host route is already present, so
1246 				 * leave the flow-table entries as is.
1247 				 */
1248 				if (rt0->rt_flags & RTF_HOST) {
1249 					RTFREE(rt0);
1250 					rt0 = NULL;
1251 				} else if (!(flags & RTF_HOST) && netmask) {
1252 					mask = rt_mask(rt0);
1253 					len = mask->sa_len;
1254 					m = (u_char *)mask;
1255 					n = (u_char *)netmask;
1256 					while (len-- > 0) {
1257 						if (*n != *m)
1258 							break;
1259 						n++;
1260 						m++;
1261 					}
1262 					if (len == 0 || (*n < *m)) {
1263 						RTFREE(rt0);
1264 						rt0 = NULL;
1265 					}
1266 				}
1267 			}
1268 #endif/* INET6 || INET */
1269 		}
1270 #endif /* FLOWTABLE */
1271 
1272 		/* XXX mtu manipulation will be done in rnh_addaddr -- itojun */
1273 		rn = rnh->rnh_addaddr(ndst, netmask, rnh, rt->rt_nodes);
1274 		/*
1275 		 * If it still failed to go into the tree,
1276 		 * then un-make it (this should be a function)
1277 		 */
1278 		if (rn == NULL) {
1279 			ifa_free(rt->rt_ifa);
1280 			Free(rt_key(rt));
1281 			RT_LOCK_DESTROY(rt);
1282 			uma_zfree(V_rtzone, rt);
1283 #ifdef FLOWTABLE
1284 			if (rt0 != NULL)
1285 				RTFREE(rt0);
1286 #endif
1287 			senderr(EEXIST);
1288 		}
1289 #ifdef FLOWTABLE
1290 		else if (rt0 != NULL) {
1291 			switch (dst->sa_family) {
1292 #ifdef INET6
1293 			case AF_INET6:
1294 				flowtable_route_flush(V_ip6_ft, rt0);
1295 				break;
1296 #endif
1297 #ifdef INET
1298 			case AF_INET:
1299 				flowtable_route_flush(V_ip_ft, rt0);
1300 				break;
1301 #endif
1302 			}
1303 			RTFREE(rt0);
1304 		}
1305 #endif
1306 
1307 		/*
1308 		 * If this protocol has something to add to this then
1309 		 * allow it to do that as well.
1310 		 */
1311 		if (ifa->ifa_rtrequest)
1312 			ifa->ifa_rtrequest(req, rt, info);
1313 
1314 		/*
1315 		 * actually return a resultant rtentry and
1316 		 * give the caller a single reference.
1317 		 */
1318 		if (ret_nrt) {
1319 			*ret_nrt = rt;
1320 			RT_ADDREF(rt);
1321 		}
1322 		RT_UNLOCK(rt);
1323 		break;
1324 	default:
1325 		error = EOPNOTSUPP;
1326 	}
1327 bad:
1328 	if (needlock)
1329 		RADIX_NODE_HEAD_UNLOCK(rnh);
1330 	return (error);
1331 #undef senderr
1332 }
1333 
1334 #undef dst
1335 #undef gateway
1336 #undef netmask
1337 #undef ifaaddr
1338 #undef ifpaddr
1339 #undef flags
1340 
1341 int
1342 rt_setgate(struct rtentry *rt, struct sockaddr *dst, struct sockaddr *gate)
1343 {
1344 	/* XXX dst may be overwritten, can we move this to below */
1345 	int dlen = SA_SIZE(dst), glen = SA_SIZE(gate);
1346 #ifdef INVARIANTS
1347 	struct radix_node_head *rnh;
1348 
1349 	rnh = rt_tables_get_rnh(rt->rt_fibnum, dst->sa_family);
1350 #endif
1351 
1352 	RT_LOCK_ASSERT(rt);
1353 	RADIX_NODE_HEAD_LOCK_ASSERT(rnh);
1354 
1355 	/*
1356 	 * Prepare to store the gateway in rt->rt_gateway.
1357 	 * Both dst and gateway are stored one after the other in the same
1358 	 * malloc'd chunk. If we have room, we can reuse the old buffer,
1359 	 * rt_gateway already points to the right place.
1360 	 * Otherwise, malloc a new block and update the 'dst' address.
1361 	 */
1362 	if (rt->rt_gateway == NULL || glen > SA_SIZE(rt->rt_gateway)) {
1363 		caddr_t new;
1364 
1365 		R_Malloc(new, caddr_t, dlen + glen);
1366 		if (new == NULL)
1367 			return ENOBUFS;
1368 		/*
1369 		 * XXX note, we copy from *dst and not *rt_key(rt) because
1370 		 * rt_setgate() can be called to initialize a newly
1371 		 * allocated route entry, in which case rt_key(rt) == NULL
1372 		 * (and also rt->rt_gateway == NULL).
1373 		 * Free()/free() handle a NULL argument just fine.
1374 		 */
1375 		bcopy(dst, new, dlen);
1376 		Free(rt_key(rt));	/* free old block, if any */
1377 		rt_key(rt) = (struct sockaddr *)new;
1378 		rt->rt_gateway = (struct sockaddr *)(new + dlen);
1379 	}
1380 
1381 	/*
1382 	 * Copy the new gateway value into the memory chunk.
1383 	 */
1384 	bcopy(gate, rt->rt_gateway, glen);
1385 
1386 	return (0);
1387 }
1388 
1389 void
1390 rt_maskedcopy(struct sockaddr *src, struct sockaddr *dst, struct sockaddr *netmask)
1391 {
1392 	register u_char *cp1 = (u_char *)src;
1393 	register u_char *cp2 = (u_char *)dst;
1394 	register u_char *cp3 = (u_char *)netmask;
1395 	u_char *cplim = cp2 + *cp3;
1396 	u_char *cplim2 = cp2 + *cp1;
1397 
1398 	*cp2++ = *cp1++; *cp2++ = *cp1++; /* copies sa_len & sa_family */
1399 	cp3 += 2;
1400 	if (cplim > cplim2)
1401 		cplim = cplim2;
1402 	while (cp2 < cplim)
1403 		*cp2++ = *cp1++ & *cp3++;
1404 	if (cp2 < cplim2)
1405 		bzero((caddr_t)cp2, (unsigned)(cplim2 - cp2));
1406 }
1407 
1408 /*
1409  * Set up a routing table entry, normally
1410  * for an interface.
1411  */
1412 #define _SOCKADDR_TMPSIZE 128 /* Not too big.. kernel stack size is limited */
1413 static inline  int
1414 rtinit1(struct ifaddr *ifa, int cmd, int flags, int fibnum)
1415 {
1416 	struct sockaddr *dst;
1417 	struct sockaddr *netmask;
1418 	struct rtentry *rt = NULL;
1419 	struct rt_addrinfo info;
1420 	int error = 0;
1421 	int startfib, endfib;
1422 	char tempbuf[_SOCKADDR_TMPSIZE];
1423 	int didwork = 0;
1424 	int a_failure = 0;
1425 	static struct sockaddr_dl null_sdl = {sizeof(null_sdl), AF_LINK};
1426 	struct radix_node_head *rnh;
1427 
1428 	if (flags & RTF_HOST) {
1429 		dst = ifa->ifa_dstaddr;
1430 		netmask = NULL;
1431 	} else {
1432 		dst = ifa->ifa_addr;
1433 		netmask = ifa->ifa_netmask;
1434 	}
1435 	if (dst->sa_len == 0)
1436 		return(EINVAL);
1437 	switch (dst->sa_family) {
1438 	case AF_INET6:
1439 	case AF_INET:
1440 		/* We support multiple FIBs. */
1441 		break;
1442 	default:
1443 		fibnum = RT_DEFAULT_FIB;
1444 		break;
1445 	}
1446 	if (fibnum == -1) {
1447 		if (rt_add_addr_allfibs == 0 && cmd == (int)RTM_ADD) {
1448 			startfib = endfib = curthread->td_proc->p_fibnum;
1449 		} else {
1450 			startfib = 0;
1451 			endfib = rt_numfibs - 1;
1452 		}
1453 	} else {
1454 		KASSERT((fibnum < rt_numfibs), ("rtinit1: bad fibnum"));
1455 		startfib = fibnum;
1456 		endfib = fibnum;
1457 	}
1458 
1459 	/*
1460 	 * If it's a delete, check that if it exists,
1461 	 * it's on the correct interface or we might scrub
1462 	 * a route to another ifa which would
1463 	 * be confusing at best and possibly worse.
1464 	 */
1465 	if (cmd == RTM_DELETE) {
1466 		/*
1467 		 * It's a delete, so it should already exist..
1468 		 * If it's a net, mask off the host bits
1469 		 * (Assuming we have a mask)
1470 		 * XXX this is kinda inet specific..
1471 		 */
1472 		if (netmask != NULL) {
1473 			rt_maskedcopy(dst, (struct sockaddr *)tempbuf, netmask);
1474 			dst = (struct sockaddr *)tempbuf;
1475 		}
1476 	}
1477 	/*
1478 	 * Now go through all the requested tables (fibs) and do the
1479 	 * requested action. Realistically, this will either be fib 0
1480 	 * for protocols that don't do multiple tables or all the
1481 	 * tables for those that do.
1482 	 */
1483 	for ( fibnum = startfib; fibnum <= endfib; fibnum++) {
1484 		if (cmd == RTM_DELETE) {
1485 			struct radix_node *rn;
1486 			/*
1487 			 * Look up an rtentry that is in the routing tree and
1488 			 * contains the correct info.
1489 			 */
1490 			rnh = rt_tables_get_rnh(fibnum, dst->sa_family);
1491 			if (rnh == NULL)
1492 				/* this table doesn't exist but others might */
1493 				continue;
1494 			RADIX_NODE_HEAD_RLOCK(rnh);
1495 #ifdef RADIX_MPATH
1496 			if (rn_mpath_capable(rnh)) {
1497 
1498 				rn = rnh->rnh_matchaddr(dst, rnh);
1499 				if (rn == NULL)
1500 					error = ESRCH;
1501 				else {
1502 					rt = RNTORT(rn);
1503 					/*
1504 					 * for interface route the
1505 					 * rt->rt_gateway is sockaddr_intf
1506 					 * for cloning ARP entries, so
1507 					 * rt_mpath_matchgate must use the
1508 					 * interface address
1509 					 */
1510 					rt = rt_mpath_matchgate(rt,
1511 					    ifa->ifa_addr);
1512 					if (!rt)
1513 						error = ESRCH;
1514 				}
1515 			}
1516 			else
1517 #endif
1518 			rn = rnh->rnh_lookup(dst, netmask, rnh);
1519 			error = (rn == NULL ||
1520 			    (rn->rn_flags & RNF_ROOT) ||
1521 			    RNTORT(rn)->rt_ifa != ifa ||
1522 			    !sa_equal((struct sockaddr *)rn->rn_key, dst));
1523 			RADIX_NODE_HEAD_RUNLOCK(rnh);
1524 			if (error) {
1525 				/* this is only an error if bad on ALL tables */
1526 				continue;
1527 			}
1528 		}
1529 		/*
1530 		 * Do the actual request
1531 		 */
1532 		bzero((caddr_t)&info, sizeof(info));
1533 		info.rti_ifa = ifa;
1534 		info.rti_flags = flags |
1535 		    (ifa->ifa_flags & ~IFA_RTSELF) | RTF_PINNED;
1536 		info.rti_info[RTAX_DST] = dst;
1537 		/*
1538 		 * doing this for compatibility reasons
1539 		 */
1540 		if (cmd == RTM_ADD)
1541 			info.rti_info[RTAX_GATEWAY] =
1542 			    (struct sockaddr *)&null_sdl;
1543 		else
1544 			info.rti_info[RTAX_GATEWAY] = ifa->ifa_addr;
1545 		info.rti_info[RTAX_NETMASK] = netmask;
1546 		error = rtrequest1_fib(cmd, &info, &rt, fibnum);
1547 
1548 		if ((error == EEXIST) && (cmd == RTM_ADD)) {
1549 			/*
1550 			 * Interface route addition failed.
1551 			 * Atomically delete current prefix generating
1552 			 * RTM_DELETE message, and retry adding
1553 			 * interface prefix.
1554 			 */
1555 			rnh = rt_tables_get_rnh(fibnum, dst->sa_family);
1556 			RADIX_NODE_HEAD_LOCK(rnh);
1557 
1558 			/* Delete old prefix */
1559 			info.rti_ifa = NULL;
1560 			info.rti_flags = RTF_RNH_LOCKED;
1561 
1562 			error = rtrequest1_fib(RTM_DELETE, &info, NULL, fibnum);
1563 			if (error == 0) {
1564 				info.rti_ifa = ifa;
1565 				info.rti_flags = flags | RTF_RNH_LOCKED |
1566 				    (ifa->ifa_flags & ~IFA_RTSELF) | RTF_PINNED;
1567 				error = rtrequest1_fib(cmd, &info, &rt, fibnum);
1568 			}
1569 
1570 			RADIX_NODE_HEAD_UNLOCK(rnh);
1571 		}
1572 
1573 
1574 		if (error == 0 && rt != NULL) {
1575 			/*
1576 			 * notify any listening routing agents of the change
1577 			 */
1578 			RT_LOCK(rt);
1579 #ifdef RADIX_MPATH
1580 			/*
1581 			 * in case address alias finds the first address
1582 			 * e.g. ifconfig bge0 192.0.2.246/24
1583 			 * e.g. ifconfig bge0 192.0.2.247/24
1584 			 * the address set in the route is 192.0.2.246
1585 			 * so we need to replace it with 192.0.2.247
1586 			 */
1587 			if (memcmp(rt->rt_ifa->ifa_addr,
1588 			    ifa->ifa_addr, ifa->ifa_addr->sa_len)) {
1589 				ifa_free(rt->rt_ifa);
1590 				ifa_ref(ifa);
1591 				rt->rt_ifp = ifa->ifa_ifp;
1592 				rt->rt_ifa = ifa;
1593 			}
1594 #endif
1595 			/*
1596 			 * doing this for compatibility reasons
1597 			 */
1598 			if (cmd == RTM_ADD) {
1599 			    ((struct sockaddr_dl *)rt->rt_gateway)->sdl_type  =
1600 				rt->rt_ifp->if_type;
1601 			    ((struct sockaddr_dl *)rt->rt_gateway)->sdl_index =
1602 				rt->rt_ifp->if_index;
1603 			}
1604 			RT_ADDREF(rt);
1605 			RT_UNLOCK(rt);
1606 			rt_newaddrmsg_fib(cmd, ifa, error, rt, fibnum);
1607 			RT_LOCK(rt);
1608 			RT_REMREF(rt);
1609 			if (cmd == RTM_DELETE) {
1610 				/*
1611 				 * If we are deleting, and we found an entry,
1612 				 * then it's been removed from the tree..
1613 				 * now throw it away.
1614 				 */
1615 				RTFREE_LOCKED(rt);
1616 			} else {
1617 				if (cmd == RTM_ADD) {
1618 					/*
1619 					 * We just wanted to add it..
1620 					 * we don't actually need a reference.
1621 					 */
1622 					RT_REMREF(rt);
1623 				}
1624 				RT_UNLOCK(rt);
1625 			}
1626 			didwork = 1;
1627 		}
1628 		if (error)
1629 			a_failure = error;
1630 	}
1631 	if (cmd == RTM_DELETE) {
1632 		if (didwork) {
1633 			error = 0;
1634 		} else {
1635 			/* we only give an error if it wasn't in any table */
1636 			error = ((flags & RTF_HOST) ?
1637 			    EHOSTUNREACH : ENETUNREACH);
1638 		}
1639 	} else {
1640 		if (a_failure) {
1641 			/* return an error if any of them failed */
1642 			error = a_failure;
1643 		}
1644 	}
1645 	return (error);
1646 }
1647 
1648 #ifndef BURN_BRIDGES
1649 /* special one for inet internal use. may not use. */
1650 int
1651 rtinit_fib(struct ifaddr *ifa, int cmd, int flags)
1652 {
1653 	return (rtinit1(ifa, cmd, flags, -1));
1654 }
1655 #endif
1656 
1657 /*
1658  * Set up a routing table entry, normally
1659  * for an interface.
1660  */
1661 int
1662 rtinit(struct ifaddr *ifa, int cmd, int flags)
1663 {
1664 	struct sockaddr *dst;
1665 	int fib = RT_DEFAULT_FIB;
1666 
1667 	if (flags & RTF_HOST) {
1668 		dst = ifa->ifa_dstaddr;
1669 	} else {
1670 		dst = ifa->ifa_addr;
1671 	}
1672 
1673 	switch (dst->sa_family) {
1674 	case AF_INET6:
1675 	case AF_INET:
1676 		/* We do support multiple FIBs. */
1677 		fib = -1;
1678 		break;
1679 	}
1680 	return (rtinit1(ifa, cmd, flags, fib));
1681 }
1682