xref: /freebsd/sys/net/route.c (revision 7850fa71f55a16f414bb21163d80a03a5ab34522)
1 /*-
2  * Copyright (c) 1980, 1986, 1991, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 4. Neither the name of the University nor the names of its contributors
14  *    may be used to endorse or promote products derived from this software
15  *    without specific prior written permission.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  *
29  *	@(#)route.c	8.3.1.1 (Berkeley) 2/23/95
30  * $FreeBSD$
31  */
32 /************************************************************************
33  * Note: In this file a 'fib' is a "forwarding information base"	*
34  * Which is the new name for an in kernel routing (next hop) table.	*
35  ***********************************************************************/
36 
37 #include "opt_inet.h"
38 #include "opt_route.h"
39 #include "opt_mrouting.h"
40 #include "opt_mpath.h"
41 
42 #include <sys/param.h>
43 #include <sys/systm.h>
44 #include <sys/syslog.h>
45 #include <sys/malloc.h>
46 #include <sys/mbuf.h>
47 #include <sys/socket.h>
48 #include <sys/sysctl.h>
49 #include <sys/syslog.h>
50 #include <sys/sysproto.h>
51 #include <sys/proc.h>
52 #include <sys/domain.h>
53 #include <sys/kernel.h>
54 #include <sys/vimage.h>
55 
56 #include <net/if.h>
57 #include <net/if_dl.h>
58 #include <net/route.h>
59 
60 #ifdef RADIX_MPATH
61 #include <net/radix_mpath.h>
62 #endif
63 
64 #include <netinet/in.h>
65 #include <netinet/ip_mroute.h>
66 #include <netinet/vinet.h>
67 
68 #include <vm/uma.h>
69 
70 u_int rt_numfibs = RT_NUMFIBS;
71 SYSCTL_INT(_net, OID_AUTO, fibs, CTLFLAG_RD, &rt_numfibs, 0, "");
72 /*
73  * Allow the boot code to allow LESS than RT_MAXFIBS to be used.
74  * We can't do more because storage is statically allocated for now.
75  * (for compatibility reasons.. this will change).
76  */
77 TUNABLE_INT("net.fibs", &rt_numfibs);
78 
79 /*
80  * By default add routes to all fibs for new interfaces.
81  * Once this is set to 0 then only allocate routes on interface
82  * changes for the FIB of the caller when adding a new set of addresses
83  * to an interface.  XXX this is a shotgun aproach to a problem that needs
84  * a more fine grained solution.. that will come.
85  */
86 u_int rt_add_addr_allfibs = 1;
87 SYSCTL_INT(_net, OID_AUTO, add_addr_allfibs, CTLFLAG_RW,
88     &rt_add_addr_allfibs, 0, "");
89 TUNABLE_INT("net.add_addr_allfibs", &rt_add_addr_allfibs);
90 
91 #ifdef VIMAGE_GLOBALS
92 struct radix_node_head	*rt_tables;
93 static uma_zone_t	rtzone;		/* Routing table UMA zone. */
94 int			rttrash;	/* routes not in table but not freed */
95 struct rtstat		rtstat;
96 #endif
97 
98 #ifndef VIMAGE_GLOBALS
99 struct vnet_rtable {
100 	struct radix_node_head *_rt_tables;
101 	uma_zone_t		_rtzone;
102 	int			_rttrash;
103 	struct rtstat		_rtstat;
104 };
105 
106 /* Size guard. See sys/vimage.h. */
107 VIMAGE_CTASSERT(SIZEOF_vnet_rtable, sizeof(struct vnet_rtable));
108 
109 #ifndef VIMAGE
110 static struct vnet_rtable vnet_rtable_0;
111 #endif
112 #endif
113 
114 /*
115  * Symbol translation macros
116  */
117 #define	INIT_VNET_RTABLE(vnet) \
118 	INIT_FROM_VNET(vnet, VNET_MOD_RTABLE, struct vnet_rtable, vnet_rtable)
119 
120 #define	VNET_RTABLE(sym)	VSYM(vnet_rtable, sym)
121 
122 #define	V_rt_tables		VNET_RTABLE(rt_tables)
123 #define	V_rtstat		VNET_RTABLE(rtstat)
124 #define	V_rttrash		VNET_RTABLE(rttrash)
125 #define	V_rtzone		VNET_RTABLE(rtzone)
126 
127 static void rt_maskedcopy(struct sockaddr *,
128 	    struct sockaddr *, struct sockaddr *);
129 static int vnet_route_iattach(const void *);
130 #ifdef VIMAGE
131 static int vnet_route_idetach(const void *);
132 #endif
133 
134 #ifndef VIMAGE_GLOBALS
135 static struct vnet_symmap vnet_rtable_symmap[] = {
136 	VNET_SYMMAP(rtable, rt_tables),
137 	VNET_SYMMAP(rtable, rtstat),
138 	VNET_SYMMAP(rtable, rttrash),
139 	VNET_SYMMAP_END
140 };
141 
142 static const vnet_modinfo_t vnet_rtable_modinfo = {
143 	.vmi_id		= VNET_MOD_RTABLE,
144 	.vmi_name	= "rtable",
145 	.vmi_size	= sizeof(struct vnet_rtable),
146 	.vmi_symmap	= vnet_rtable_symmap,
147 	.vmi_iattach	= vnet_route_iattach,
148 #ifdef VIMAGE
149 	.vmi_idetach	= vnet_route_idetach
150 #endif
151 };
152 #endif /* !VIMAGE_GLOBALS */
153 
154 /* compare two sockaddr structures */
155 #define	sa_equal(a1, a2) (bcmp((a1), (a2), (a1)->sa_len) == 0)
156 
157 /*
158  * Convert a 'struct radix_node *' to a 'struct rtentry *'.
159  * The operation can be done safely (in this code) because a
160  * 'struct rtentry' starts with two 'struct radix_node''s, the first
161  * one representing leaf nodes in the routing tree, which is
162  * what the code in radix.c passes us as a 'struct radix_node'.
163  *
164  * But because there are a lot of assumptions in this conversion,
165  * do not cast explicitly, but always use the macro below.
166  */
167 #define RNTORT(p)	((struct rtentry *)(p))
168 
169 #if 0
170 /* default fib for tunnels to use */
171 u_int tunnel_fib = 0;
172 SYSCTL_INT(_net, OID_AUTO, tunnelfib, CTLFLAG_RD, &tunnel_fib, 0, "");
173 #endif
174 
175 /*
176  * handler for net.my_fibnum
177  */
178 static int
179 sysctl_my_fibnum(SYSCTL_HANDLER_ARGS)
180 {
181         int fibnum;
182         int error;
183 
184         fibnum = curthread->td_proc->p_fibnum;
185         error = sysctl_handle_int(oidp, &fibnum, 0, req);
186         return (error);
187 }
188 
189 SYSCTL_PROC(_net, OID_AUTO, my_fibnum, CTLTYPE_INT|CTLFLAG_RD,
190             NULL, 0, &sysctl_my_fibnum, "I", "default FIB of caller");
191 
192 static __inline struct radix_node_head **
193 rt_tables_get_rnh_ptr(int table, int fam)
194 {
195 	INIT_VNET_RTABLE(curvnet);
196 	struct radix_node_head **rnh;
197 
198 	KASSERT(table >= 0 && table < rt_numfibs, ("%s: table out of bounds.",
199 	    __func__));
200 	KASSERT(fam >= 0 && fam < (AF_MAX+1), ("%s: fam out of bounds.",
201 	    __func__));
202 
203 	/* rnh is [fib=0][af=0]. */
204 	rnh = (struct radix_node_head **)V_rt_tables;
205 	/* Get the offset to the requested table and fam. */
206 	rnh += table * (AF_MAX+1) + fam;
207 
208 	return (rnh);
209 }
210 
211 struct radix_node_head *
212 rt_tables_get_rnh(int table, int fam)
213 {
214 
215 	return (*rt_tables_get_rnh_ptr(table, fam));
216 }
217 
218 static void
219 route_init(void)
220 {
221 
222 	/* whack the tunable ints into  line. */
223 	if (rt_numfibs > RT_MAXFIBS)
224 		rt_numfibs = RT_MAXFIBS;
225 	if (rt_numfibs == 0)
226 		rt_numfibs = 1;
227 	rn_init();	/* initialize all zeroes, all ones, mask table */
228 
229 #ifndef VIMAGE_GLOBALS
230 	vnet_mod_register(&vnet_rtable_modinfo);
231 #else
232 	vnet_route_iattach(NULL);
233 #endif
234 }
235 
236 static int
237 vnet_route_iattach(const void *unused __unused)
238 {
239 	INIT_VNET_RTABLE(curvnet);
240 	struct domain *dom;
241 	struct radix_node_head **rnh;
242 	int table;
243 	int fam;
244 
245 	V_rt_tables = malloc(rt_numfibs * (AF_MAX+1) *
246 	    sizeof(struct radix_node_head *), M_RTABLE, M_WAITOK|M_ZERO);
247 
248 	V_rtzone = uma_zcreate("rtentry", sizeof(struct rtentry), NULL, NULL,
249 	    NULL, NULL, UMA_ALIGN_PTR, 0);
250 	for (dom = domains; dom; dom = dom->dom_next) {
251 		if (dom->dom_rtattach)  {
252 			for  (table = 0; table < rt_numfibs; table++) {
253 				if ( (fam = dom->dom_family) == AF_INET ||
254 				    table == 0) {
255  			        	/* for now only AF_INET has > 1 table */
256 					/* XXX MRT
257 					 * rtattach will be also called
258 					 * from vfs_export.c but the
259 					 * offset will be 0
260 					 * (only for AF_INET and AF_INET6
261 					 * which don't need it anyhow)
262 					 */
263 					rnh = rt_tables_get_rnh_ptr(table, fam);
264 					if (rnh == NULL)
265 						panic("%s: rnh NULL", __func__);
266 					dom->dom_rtattach((void **)rnh,
267 				    	    dom->dom_rtoffset);
268 				} else {
269 					break;
270 				}
271 			}
272 		}
273 	}
274 
275 	return (0);
276 }
277 
278 #ifdef VIMAGE
279 static int
280 vnet_route_idetach(const void *unused __unused)
281 {
282 	int table;
283 	int fam;
284 	struct domain *dom;
285 	struct radix_node_head **rnh;
286 
287 	for (dom = domains; dom; dom = dom->dom_next) {
288 		if (dom->dom_rtdetach) {
289 			for (table = 0; table < rt_numfibs; table++) {
290 				if ( (fam = dom->dom_family) == AF_INET ||
291 				    table == 0) {
292 					/* For now only AF_INET has > 1 tbl. */
293 					rnh = rt_tables_get_rnh_ptr(table, fam);
294 					if (rnh == NULL)
295 						panic("%s: rnh NULL", __func__);
296 					dom->dom_rtdetach((void **)rnh,
297 					    dom->dom_rtoffset);
298 				} else {
299 					break;
300 				}
301 			}
302 		}
303 	}
304 	return (0);
305 }
306 #endif
307 
308 #ifndef _SYS_SYSPROTO_H_
309 struct setfib_args {
310 	int     fibnum;
311 };
312 #endif
313 int
314 setfib(struct thread *td, struct setfib_args *uap)
315 {
316 	if (uap->fibnum < 0 || uap->fibnum >= rt_numfibs)
317 		return EINVAL;
318 	td->td_proc->p_fibnum = uap->fibnum;
319 	return (0);
320 }
321 
322 /*
323  * Packet routing routines.
324  */
325 void
326 rtalloc(struct route *ro)
327 {
328 	rtalloc_ign_fib(ro, 0UL, 0);
329 }
330 
331 void
332 rtalloc_fib(struct route *ro, u_int fibnum)
333 {
334 	rtalloc_ign_fib(ro, 0UL, fibnum);
335 }
336 
337 void
338 rtalloc_ign(struct route *ro, u_long ignore)
339 {
340 	struct rtentry *rt;
341 
342 	if ((rt = ro->ro_rt) != NULL) {
343 		if (rt->rt_ifp != NULL && rt->rt_flags & RTF_UP)
344 			return;
345 		RTFREE(rt);
346 		ro->ro_rt = NULL;
347 	}
348 	ro->ro_rt = rtalloc1_fib(&ro->ro_dst, 1, ignore, 0);
349 	if (ro->ro_rt)
350 		RT_UNLOCK(ro->ro_rt);
351 }
352 
353 void
354 rtalloc_ign_fib(struct route *ro, u_long ignore, u_int fibnum)
355 {
356 	struct rtentry *rt;
357 
358 	if ((rt = ro->ro_rt) != NULL) {
359 		if (rt->rt_ifp != NULL && rt->rt_flags & RTF_UP)
360 			return;
361 		RTFREE(rt);
362 		ro->ro_rt = NULL;
363 	}
364 	ro->ro_rt = rtalloc1_fib(&ro->ro_dst, 1, ignore, fibnum);
365 	if (ro->ro_rt)
366 		RT_UNLOCK(ro->ro_rt);
367 }
368 
369 /*
370  * Look up the route that matches the address given
371  * Or, at least try.. Create a cloned route if needed.
372  *
373  * The returned route, if any, is locked.
374  */
375 struct rtentry *
376 rtalloc1(struct sockaddr *dst, int report, u_long ignflags)
377 {
378 	return (rtalloc1_fib(dst, report, ignflags, 0));
379 }
380 
381 struct rtentry *
382 rtalloc1_fib(struct sockaddr *dst, int report, u_long ignflags,
383 		    u_int fibnum)
384 {
385 	INIT_VNET_RTABLE(curvnet);
386 	struct radix_node_head *rnh;
387 	struct rtentry *rt;
388 	struct radix_node *rn;
389 	struct rtentry *newrt;
390 	struct rt_addrinfo info;
391 	int err = 0, msgtype = RTM_MISS;
392 	int needlock;
393 
394 	KASSERT((fibnum < rt_numfibs), ("rtalloc1_fib: bad fibnum"));
395 	if (dst->sa_family != AF_INET)	/* Only INET supports > 1 fib now */
396 		fibnum = 0;
397 	rnh = rt_tables_get_rnh(fibnum, dst->sa_family);
398 	newrt = NULL;
399 	/*
400 	 * Look up the address in the table for that Address Family
401 	 */
402 	if (rnh == NULL) {
403 		V_rtstat.rts_unreach++;
404 		goto miss;
405 	}
406 	needlock = !(ignflags & RTF_RNH_LOCKED);
407 	if (needlock)
408 		RADIX_NODE_HEAD_RLOCK(rnh);
409 #ifdef INVARIANTS
410 	else
411 		RADIX_NODE_HEAD_LOCK_ASSERT(rnh);
412 #endif
413 	rn = rnh->rnh_matchaddr(dst, rnh);
414 	if (rn && ((rn->rn_flags & RNF_ROOT) == 0)) {
415 		newrt = rt = RNTORT(rn);
416 		RT_LOCK(newrt);
417 		RT_ADDREF(newrt);
418 		if (needlock)
419 			RADIX_NODE_HEAD_RUNLOCK(rnh);
420 		goto done;
421 
422 	} else if (needlock)
423 		RADIX_NODE_HEAD_RUNLOCK(rnh);
424 
425 	/*
426 	 * Either we hit the root or couldn't find any match,
427 	 * Which basically means
428 	 * "caint get there frm here"
429 	 */
430 	V_rtstat.rts_unreach++;
431 miss:
432 	if (report) {
433 		/*
434 		 * If required, report the failure to the supervising
435 		 * Authorities.
436 		 * For a delete, this is not an error. (report == 0)
437 		 */
438 		bzero(&info, sizeof(info));
439 		info.rti_info[RTAX_DST] = dst;
440 		rt_missmsg(msgtype, &info, 0, err);
441 	}
442 done:
443 	if (newrt)
444 		RT_LOCK_ASSERT(newrt);
445 	return (newrt);
446 }
447 
448 /*
449  * Remove a reference count from an rtentry.
450  * If the count gets low enough, take it out of the routing table
451  */
452 void
453 rtfree(struct rtentry *rt)
454 {
455 	INIT_VNET_RTABLE(curvnet);
456 	struct radix_node_head *rnh;
457 
458 	KASSERT(rt != NULL,("%s: NULL rt", __func__));
459 	rnh = rt_tables_get_rnh(rt->rt_fibnum, rt_key(rt)->sa_family);
460 	KASSERT(rnh != NULL,("%s: NULL rnh", __func__));
461 
462 	RT_LOCK_ASSERT(rt);
463 
464 	/*
465 	 * The callers should use RTFREE_LOCKED() or RTFREE(), so
466 	 * we should come here exactly with the last reference.
467 	 */
468 	RT_REMREF(rt);
469 	if (rt->rt_refcnt > 0) {
470 		log(LOG_DEBUG, "%s: %p has %d refs\n", __func__, rt, rt->rt_refcnt);
471 		goto done;
472 	}
473 
474 	/*
475 	 * On last reference give the "close method" a chance
476 	 * to cleanup private state.  This also permits (for
477 	 * IPv4 and IPv6) a chance to decide if the routing table
478 	 * entry should be purged immediately or at a later time.
479 	 * When an immediate purge is to happen the close routine
480 	 * typically calls rtexpunge which clears the RTF_UP flag
481 	 * on the entry so that the code below reclaims the storage.
482 	 */
483 	if (rt->rt_refcnt == 0 && rnh->rnh_close)
484 		rnh->rnh_close((struct radix_node *)rt, rnh);
485 
486 	/*
487 	 * If we are no longer "up" (and ref == 0)
488 	 * then we can free the resources associated
489 	 * with the route.
490 	 */
491 	if ((rt->rt_flags & RTF_UP) == 0) {
492 		if (rt->rt_nodes->rn_flags & (RNF_ACTIVE | RNF_ROOT))
493 			panic("rtfree 2");
494 		/*
495 		 * the rtentry must have been removed from the routing table
496 		 * so it is represented in rttrash.. remove that now.
497 		 */
498 		V_rttrash--;
499 #ifdef	DIAGNOSTIC
500 		if (rt->rt_refcnt < 0) {
501 			printf("rtfree: %p not freed (neg refs)\n", rt);
502 			goto done;
503 		}
504 #endif
505 		/*
506 		 * release references on items we hold them on..
507 		 * e.g other routes and ifaddrs.
508 		 */
509 		if (rt->rt_ifa)
510 			ifa_free(rt->rt_ifa);
511 		/*
512 		 * The key is separatly alloc'd so free it (see rt_setgate()).
513 		 * This also frees the gateway, as they are always malloc'd
514 		 * together.
515 		 */
516 		Free(rt_key(rt));
517 
518 		/*
519 		 * and the rtentry itself of course
520 		 */
521 		RT_LOCK_DESTROY(rt);
522 		uma_zfree(V_rtzone, rt);
523 		return;
524 	}
525 done:
526 	RT_UNLOCK(rt);
527 }
528 
529 
530 /*
531  * Force a routing table entry to the specified
532  * destination to go through the given gateway.
533  * Normally called as a result of a routing redirect
534  * message from the network layer.
535  */
536 void
537 rtredirect(struct sockaddr *dst,
538 	struct sockaddr *gateway,
539 	struct sockaddr *netmask,
540 	int flags,
541 	struct sockaddr *src)
542 {
543 	rtredirect_fib(dst, gateway, netmask, flags, src, 0);
544 }
545 
546 void
547 rtredirect_fib(struct sockaddr *dst,
548 	struct sockaddr *gateway,
549 	struct sockaddr *netmask,
550 	int flags,
551 	struct sockaddr *src,
552 	u_int fibnum)
553 {
554 	INIT_VNET_RTABLE(curvnet);
555 	struct rtentry *rt, *rt0 = NULL;
556 	int error = 0;
557 	short *stat = NULL;
558 	struct rt_addrinfo info;
559 	struct ifaddr *ifa;
560 	struct radix_node_head *rnh;
561 
562 	ifa = NULL;
563 	rnh = rt_tables_get_rnh(fibnum, dst->sa_family);
564 	if (rnh == NULL) {
565 		error = EAFNOSUPPORT;
566 		goto out;
567 	}
568 
569 	/* verify the gateway is directly reachable */
570 	if ((ifa = ifa_ifwithnet(gateway)) == NULL) {
571 		error = ENETUNREACH;
572 		goto out;
573 	}
574 	rt = rtalloc1_fib(dst, 0, 0UL, fibnum);	/* NB: rt is locked */
575 	/*
576 	 * If the redirect isn't from our current router for this dst,
577 	 * it's either old or wrong.  If it redirects us to ourselves,
578 	 * we have a routing loop, perhaps as a result of an interface
579 	 * going down recently.
580 	 */
581 	if (!(flags & RTF_DONE) && rt &&
582 	     (!sa_equal(src, rt->rt_gateway) || rt->rt_ifa != ifa))
583 		error = EINVAL;
584 	else if (ifa_ifwithaddr_check(gateway))
585 		error = EHOSTUNREACH;
586 	if (error)
587 		goto done;
588 	/*
589 	 * Create a new entry if we just got back a wildcard entry
590 	 * or the the lookup failed.  This is necessary for hosts
591 	 * which use routing redirects generated by smart gateways
592 	 * to dynamically build the routing tables.
593 	 */
594 	if (rt == NULL || (rt_mask(rt) && rt_mask(rt)->sa_len < 2))
595 		goto create;
596 	/*
597 	 * Don't listen to the redirect if it's
598 	 * for a route to an interface.
599 	 */
600 	if (rt->rt_flags & RTF_GATEWAY) {
601 		if (((rt->rt_flags & RTF_HOST) == 0) && (flags & RTF_HOST)) {
602 			/*
603 			 * Changing from route to net => route to host.
604 			 * Create new route, rather than smashing route to net.
605 			 */
606 		create:
607 			rt0 = rt;
608 			rt = NULL;
609 
610 			flags |=  RTF_GATEWAY | RTF_DYNAMIC;
611 			bzero((caddr_t)&info, sizeof(info));
612 			info.rti_info[RTAX_DST] = dst;
613 			info.rti_info[RTAX_GATEWAY] = gateway;
614 			info.rti_info[RTAX_NETMASK] = netmask;
615 			info.rti_ifa = ifa;
616 			info.rti_flags = flags;
617 			if (rt0 != NULL)
618 				RT_UNLOCK(rt0);	/* drop lock to avoid LOR with RNH */
619 			error = rtrequest1_fib(RTM_ADD, &info, &rt, fibnum);
620 			if (rt != NULL) {
621 				RT_LOCK(rt);
622 				if (rt0 != NULL)
623 					EVENTHANDLER_INVOKE(route_redirect_event, rt0, rt, dst);
624 				flags = rt->rt_flags;
625 			}
626 			if (rt0 != NULL)
627 				RTFREE(rt0);
628 
629 			stat = &V_rtstat.rts_dynamic;
630 		} else {
631 			struct rtentry *gwrt;
632 
633 			/*
634 			 * Smash the current notion of the gateway to
635 			 * this destination.  Should check about netmask!!!
636 			 */
637 			rt->rt_flags |= RTF_MODIFIED;
638 			flags |= RTF_MODIFIED;
639 			stat = &V_rtstat.rts_newgateway;
640 			/*
641 			 * add the key and gateway (in one malloc'd chunk).
642 			 */
643 			RT_UNLOCK(rt);
644 			RADIX_NODE_HEAD_LOCK(rnh);
645 			RT_LOCK(rt);
646 			rt_setgate(rt, rt_key(rt), gateway);
647 			gwrt = rtalloc1(gateway, 1, RTF_RNH_LOCKED);
648 			RADIX_NODE_HEAD_UNLOCK(rnh);
649 			EVENTHANDLER_INVOKE(route_redirect_event, rt, gwrt, dst);
650 			RTFREE_LOCKED(gwrt);
651 		}
652 	} else
653 		error = EHOSTUNREACH;
654 done:
655 	if (rt)
656 		RTFREE_LOCKED(rt);
657 out:
658 	if (error)
659 		V_rtstat.rts_badredirect++;
660 	else if (stat != NULL)
661 		(*stat)++;
662 	bzero((caddr_t)&info, sizeof(info));
663 	info.rti_info[RTAX_DST] = dst;
664 	info.rti_info[RTAX_GATEWAY] = gateway;
665 	info.rti_info[RTAX_NETMASK] = netmask;
666 	info.rti_info[RTAX_AUTHOR] = src;
667 	rt_missmsg(RTM_REDIRECT, &info, flags, error);
668 	if (ifa != NULL)
669 		ifa_free(ifa);
670 }
671 
672 int
673 rtioctl(u_long req, caddr_t data)
674 {
675 	return (rtioctl_fib(req, data, 0));
676 }
677 
678 /*
679  * Routing table ioctl interface.
680  */
681 int
682 rtioctl_fib(u_long req, caddr_t data, u_int fibnum)
683 {
684 
685 	/*
686 	 * If more ioctl commands are added here, make sure the proper
687 	 * super-user checks are being performed because it is possible for
688 	 * prison-root to make it this far if raw sockets have been enabled
689 	 * in jails.
690 	 */
691 #ifdef INET
692 	/* Multicast goop, grrr... */
693 	return mrt_ioctl ? mrt_ioctl(req, data, fibnum) : EOPNOTSUPP;
694 #else /* INET */
695 	return ENXIO;
696 #endif /* INET */
697 }
698 
699 /*
700  * For both ifa_ifwithroute() routines, 'ifa' is returned referenced.
701  */
702 struct ifaddr *
703 ifa_ifwithroute(int flags, struct sockaddr *dst, struct sockaddr *gateway)
704 {
705 	return (ifa_ifwithroute_fib(flags, dst, gateway, 0));
706 }
707 
708 struct ifaddr *
709 ifa_ifwithroute_fib(int flags, struct sockaddr *dst, struct sockaddr *gateway,
710 				u_int fibnum)
711 {
712 	register struct ifaddr *ifa;
713 	int not_found = 0;
714 
715 	if ((flags & RTF_GATEWAY) == 0) {
716 		/*
717 		 * If we are adding a route to an interface,
718 		 * and the interface is a pt to pt link
719 		 * we should search for the destination
720 		 * as our clue to the interface.  Otherwise
721 		 * we can use the local address.
722 		 */
723 		ifa = NULL;
724 		if (flags & RTF_HOST)
725 			ifa = ifa_ifwithdstaddr(dst);
726 		if (ifa == NULL)
727 			ifa = ifa_ifwithaddr(gateway);
728 	} else {
729 		/*
730 		 * If we are adding a route to a remote net
731 		 * or host, the gateway may still be on the
732 		 * other end of a pt to pt link.
733 		 */
734 		ifa = ifa_ifwithdstaddr(gateway);
735 	}
736 	if (ifa == NULL)
737 		ifa = ifa_ifwithnet(gateway);
738 	if (ifa == NULL) {
739 		struct rtentry *rt = rtalloc1_fib(gateway, 0, RTF_RNH_LOCKED, fibnum);
740 		if (rt == NULL)
741 			return (NULL);
742 		/*
743 		 * dismiss a gateway that is reachable only
744 		 * through the default router
745 		 */
746 		switch (gateway->sa_family) {
747 		case AF_INET:
748 			if (satosin(rt_key(rt))->sin_addr.s_addr == INADDR_ANY)
749 				not_found = 1;
750 			break;
751 		case AF_INET6:
752 			if (IN6_IS_ADDR_UNSPECIFIED(&satosin6(rt_key(rt))->sin6_addr))
753 				not_found = 1;
754 			break;
755 		default:
756 			break;
757 		}
758 		if (!not_found && rt->rt_ifa != NULL) {
759 			ifa = rt->rt_ifa;
760 			ifa_ref(ifa);
761 		}
762 		RT_REMREF(rt);
763 		RT_UNLOCK(rt);
764 		if (not_found || ifa == NULL)
765 			return (NULL);
766 	}
767 	if (ifa->ifa_addr->sa_family != dst->sa_family) {
768 		struct ifaddr *oifa = ifa;
769 		ifa = ifaof_ifpforaddr(dst, ifa->ifa_ifp);
770 		if (ifa == NULL)
771 			ifa = oifa;
772 		else
773 			ifa_free(oifa);
774 	}
775 	return (ifa);
776 }
777 
778 /*
779  * Do appropriate manipulations of a routing tree given
780  * all the bits of info needed
781  */
782 int
783 rtrequest(int req,
784 	struct sockaddr *dst,
785 	struct sockaddr *gateway,
786 	struct sockaddr *netmask,
787 	int flags,
788 	struct rtentry **ret_nrt)
789 {
790 	return (rtrequest_fib(req, dst, gateway, netmask, flags, ret_nrt, 0));
791 }
792 
793 int
794 rtrequest_fib(int req,
795 	struct sockaddr *dst,
796 	struct sockaddr *gateway,
797 	struct sockaddr *netmask,
798 	int flags,
799 	struct rtentry **ret_nrt,
800 	u_int fibnum)
801 {
802 	struct rt_addrinfo info;
803 
804 	if (dst->sa_len == 0)
805 		return(EINVAL);
806 
807 	bzero((caddr_t)&info, sizeof(info));
808 	info.rti_flags = flags;
809 	info.rti_info[RTAX_DST] = dst;
810 	info.rti_info[RTAX_GATEWAY] = gateway;
811 	info.rti_info[RTAX_NETMASK] = netmask;
812 	return rtrequest1_fib(req, &info, ret_nrt, fibnum);
813 }
814 
815 /*
816  * These (questionable) definitions of apparent local variables apply
817  * to the next two functions.  XXXXXX!!!
818  */
819 #define	dst	info->rti_info[RTAX_DST]
820 #define	gateway	info->rti_info[RTAX_GATEWAY]
821 #define	netmask	info->rti_info[RTAX_NETMASK]
822 #define	ifaaddr	info->rti_info[RTAX_IFA]
823 #define	ifpaddr	info->rti_info[RTAX_IFP]
824 #define	flags	info->rti_flags
825 
826 int
827 rt_getifa(struct rt_addrinfo *info)
828 {
829 	return (rt_getifa_fib(info, 0));
830 }
831 
832 /*
833  * Look up rt_addrinfo for a specific fib.  Note that if rti_ifa is defined,
834  * it will be referenced so the caller must free it.
835  */
836 int
837 rt_getifa_fib(struct rt_addrinfo *info, u_int fibnum)
838 {
839 	struct ifaddr *ifa;
840 	int error = 0;
841 
842 	/*
843 	 * ifp may be specified by sockaddr_dl
844 	 * when protocol address is ambiguous.
845 	 */
846 	if (info->rti_ifp == NULL && ifpaddr != NULL &&
847 	    ifpaddr->sa_family == AF_LINK &&
848 	    (ifa = ifa_ifwithnet(ifpaddr)) != NULL) {
849 		info->rti_ifp = ifa->ifa_ifp;
850 		ifa_free(ifa);
851 	}
852 	if (info->rti_ifa == NULL && ifaaddr != NULL)
853 		info->rti_ifa = ifa_ifwithaddr(ifaaddr);
854 	if (info->rti_ifa == NULL) {
855 		struct sockaddr *sa;
856 
857 		sa = ifaaddr != NULL ? ifaaddr :
858 		    (gateway != NULL ? gateway : dst);
859 		if (sa != NULL && info->rti_ifp != NULL)
860 			info->rti_ifa = ifaof_ifpforaddr(sa, info->rti_ifp);
861 		else if (dst != NULL && gateway != NULL)
862 			info->rti_ifa = ifa_ifwithroute_fib(flags, dst, gateway,
863 							fibnum);
864 		else if (sa != NULL)
865 			info->rti_ifa = ifa_ifwithroute_fib(flags, sa, sa,
866 							fibnum);
867 	}
868 	if ((ifa = info->rti_ifa) != NULL) {
869 		if (info->rti_ifp == NULL)
870 			info->rti_ifp = ifa->ifa_ifp;
871 	} else
872 		error = ENETUNREACH;
873 	return (error);
874 }
875 
876 /*
877  * Expunges references to a route that's about to be reclaimed.
878  * The route must be locked.
879  */
880 int
881 rtexpunge(struct rtentry *rt)
882 {
883 	INIT_VNET_RTABLE(curvnet);
884 	struct radix_node *rn;
885 	struct radix_node_head *rnh;
886 	struct ifaddr *ifa;
887 	int error = 0;
888 
889 	/*
890 	 * Find the correct routing tree to use for this Address Family
891 	 */
892 	rnh = rt_tables_get_rnh(rt->rt_fibnum, rt_key(rt)->sa_family);
893 	RT_LOCK_ASSERT(rt);
894 	if (rnh == NULL)
895 		return (EAFNOSUPPORT);
896 	RADIX_NODE_HEAD_LOCK_ASSERT(rnh);
897 #if 0
898 	/*
899 	 * We cannot assume anything about the reference count
900 	 * because protocols call us in many situations; often
901 	 * before unwinding references to the table entry.
902 	 */
903 	KASSERT(rt->rt_refcnt <= 1, ("bogus refcnt %ld", rt->rt_refcnt));
904 #endif
905 	/*
906 	 * Remove the item from the tree; it should be there,
907 	 * but when callers invoke us blindly it may not (sigh).
908 	 */
909 	rn = rnh->rnh_deladdr(rt_key(rt), rt_mask(rt), rnh);
910 	if (rn == NULL) {
911 		error = ESRCH;
912 		goto bad;
913 	}
914 	KASSERT((rn->rn_flags & (RNF_ACTIVE | RNF_ROOT)) == 0,
915 		("unexpected flags 0x%x", rn->rn_flags));
916 	KASSERT(rt == RNTORT(rn),
917 		("lookup mismatch, rt %p rn %p", rt, rn));
918 
919 	rt->rt_flags &= ~RTF_UP;
920 
921 	/*
922 	 * Give the protocol a chance to keep things in sync.
923 	 */
924 	if ((ifa = rt->rt_ifa) && ifa->ifa_rtrequest) {
925 		struct rt_addrinfo info;
926 
927 		bzero((caddr_t)&info, sizeof(info));
928 		info.rti_flags = rt->rt_flags;
929 		info.rti_info[RTAX_DST] = rt_key(rt);
930 		info.rti_info[RTAX_GATEWAY] = rt->rt_gateway;
931 		info.rti_info[RTAX_NETMASK] = rt_mask(rt);
932 		ifa->ifa_rtrequest(RTM_DELETE, rt, &info);
933 	}
934 
935 	/*
936 	 * one more rtentry floating around that is not
937 	 * linked to the routing table.
938 	 */
939 	V_rttrash++;
940 bad:
941 	return (error);
942 }
943 
944 #ifdef RADIX_MPATH
945 static int
946 rn_mpath_update(int req, struct rt_addrinfo *info,
947     struct radix_node_head *rnh, struct rtentry **ret_nrt)
948 {
949 	/*
950 	 * if we got multipath routes, we require users to specify
951 	 * a matching RTAX_GATEWAY.
952 	 */
953 	struct rtentry *rt, *rto = NULL;
954 	register struct radix_node *rn;
955 	int error = 0;
956 
957 	rn = rnh->rnh_matchaddr(dst, rnh);
958 	if (rn == NULL)
959 		return (ESRCH);
960 	rto = rt = RNTORT(rn);
961 	rt = rt_mpath_matchgate(rt, gateway);
962 	if (rt == NULL)
963 		return (ESRCH);
964 	/*
965 	 * this is the first entry in the chain
966 	 */
967 	if (rto == rt) {
968 		rn = rn_mpath_next((struct radix_node *)rt);
969 		/*
970 		 * there is another entry, now it's active
971 		 */
972 		if (rn) {
973 			rto = RNTORT(rn);
974 			RT_LOCK(rto);
975 			rto->rt_flags |= RTF_UP;
976 			RT_UNLOCK(rto);
977 		} else if (rt->rt_flags & RTF_GATEWAY) {
978 			/*
979 			 * For gateway routes, we need to
980 			 * make sure that we we are deleting
981 			 * the correct gateway.
982 			 * rt_mpath_matchgate() does not
983 			 * check the case when there is only
984 			 * one route in the chain.
985 			 */
986 			if (gateway &&
987 			    (rt->rt_gateway->sa_len != gateway->sa_len ||
988 				memcmp(rt->rt_gateway, gateway, gateway->sa_len)))
989 				error = ESRCH;
990 			goto done;
991 		}
992 		/*
993 		 * use the normal delete code to remove
994 		 * the first entry
995 		 */
996 		if (req != RTM_DELETE)
997 			goto nondelete;
998 
999 		error = ENOENT;
1000 		goto done;
1001 	}
1002 
1003 	/*
1004 	 * if the entry is 2nd and on up
1005 	 */
1006 	if ((req == RTM_DELETE) && !rt_mpath_deldup(rto, rt))
1007 		panic ("rtrequest1: rt_mpath_deldup");
1008 	RT_LOCK(rt);
1009 	RT_ADDREF(rt);
1010 	if (req == RTM_DELETE) {
1011 		INIT_VNET_RTABLE(curvnet);
1012 
1013 		rt->rt_flags &= ~RTF_UP;
1014 		/*
1015 		 * One more rtentry floating around that is not
1016 		 * linked to the routing table. rttrash will be decremented
1017 		 * when RTFREE(rt) is eventually called.
1018 		 */
1019 		V_rttrash++;
1020 
1021 	}
1022 
1023 nondelete:
1024 	if (req != RTM_DELETE)
1025 		panic("unrecognized request %d", req);
1026 
1027 
1028 	/*
1029 	 * If the caller wants it, then it can have it,
1030 	 * but it's up to it to free the rtentry as we won't be
1031 	 * doing it.
1032 	 */
1033 	if (ret_nrt) {
1034 		*ret_nrt = rt;
1035 		RT_UNLOCK(rt);
1036 	} else
1037 		RTFREE_LOCKED(rt);
1038 done:
1039 	return (error);
1040 }
1041 #endif
1042 
1043 int
1044 rtrequest1_fib(int req, struct rt_addrinfo *info, struct rtentry **ret_nrt,
1045 				u_int fibnum)
1046 {
1047 	INIT_VNET_RTABLE(curvnet);
1048 	int error = 0, needlock = 0;
1049 	register struct rtentry *rt;
1050 	register struct radix_node *rn;
1051 	register struct radix_node_head *rnh;
1052 	struct ifaddr *ifa;
1053 	struct sockaddr *ndst;
1054 #define senderr(x) { error = x ; goto bad; }
1055 
1056 	KASSERT((fibnum < rt_numfibs), ("rtrequest1_fib: bad fibnum"));
1057 	if (dst->sa_family != AF_INET)	/* Only INET supports > 1 fib now */
1058 		fibnum = 0;
1059 	/*
1060 	 * Find the correct routing tree to use for this Address Family
1061 	 */
1062 	rnh = rt_tables_get_rnh(fibnum, dst->sa_family);
1063 	if (rnh == NULL)
1064 		return (EAFNOSUPPORT);
1065 	needlock = ((flags & RTF_RNH_LOCKED) == 0);
1066 	flags &= ~RTF_RNH_LOCKED;
1067 	if (needlock)
1068 		RADIX_NODE_HEAD_LOCK(rnh);
1069 	else
1070 		RADIX_NODE_HEAD_LOCK_ASSERT(rnh);
1071 	/*
1072 	 * If we are adding a host route then we don't want to put
1073 	 * a netmask in the tree, nor do we want to clone it.
1074 	 */
1075 	if (flags & RTF_HOST)
1076 		netmask = NULL;
1077 
1078 	switch (req) {
1079 	case RTM_DELETE:
1080 #ifdef RADIX_MPATH
1081 		if (rn_mpath_capable(rnh)) {
1082 			error = rn_mpath_update(req, info, rnh, ret_nrt);
1083 			/*
1084 			 * "bad" holds true for the success case
1085 			 * as well
1086 			 */
1087 			if (error != ENOENT)
1088 				goto bad;
1089 		}
1090 #endif
1091 		/*
1092 		 * Remove the item from the tree and return it.
1093 		 * Complain if it is not there and do no more processing.
1094 		 */
1095 		rn = rnh->rnh_deladdr(dst, netmask, rnh);
1096 		if (rn == NULL)
1097 			senderr(ESRCH);
1098 		if (rn->rn_flags & (RNF_ACTIVE | RNF_ROOT))
1099 			panic ("rtrequest delete");
1100 		rt = RNTORT(rn);
1101 		RT_LOCK(rt);
1102 		RT_ADDREF(rt);
1103 		rt->rt_flags &= ~RTF_UP;
1104 
1105 		/*
1106 		 * give the protocol a chance to keep things in sync.
1107 		 */
1108 		if ((ifa = rt->rt_ifa) && ifa->ifa_rtrequest)
1109 			ifa->ifa_rtrequest(RTM_DELETE, rt, info);
1110 
1111 		/*
1112 		 * One more rtentry floating around that is not
1113 		 * linked to the routing table. rttrash will be decremented
1114 		 * when RTFREE(rt) is eventually called.
1115 		 */
1116 		V_rttrash++;
1117 
1118 		/*
1119 		 * If the caller wants it, then it can have it,
1120 		 * but it's up to it to free the rtentry as we won't be
1121 		 * doing it.
1122 		 */
1123 		if (ret_nrt) {
1124 			*ret_nrt = rt;
1125 			RT_UNLOCK(rt);
1126 		} else
1127 			RTFREE_LOCKED(rt);
1128 		break;
1129 	case RTM_RESOLVE:
1130 		/*
1131 		 * resolve was only used for route cloning
1132 		 * here for compat
1133 		 */
1134 		break;
1135 	case RTM_ADD:
1136 		if ((flags & RTF_GATEWAY) && !gateway)
1137 			senderr(EINVAL);
1138 		if (dst && gateway && (dst->sa_family != gateway->sa_family) &&
1139 		    (gateway->sa_family != AF_UNSPEC) && (gateway->sa_family != AF_LINK))
1140 			senderr(EINVAL);
1141 
1142 		if (info->rti_ifa == NULL) {
1143 			error = rt_getifa_fib(info, fibnum);
1144 			if (error)
1145 				senderr(error);
1146 		} else
1147 			ifa_ref(info->rti_ifa);
1148 		ifa = info->rti_ifa;
1149 		rt = uma_zalloc(V_rtzone, M_NOWAIT | M_ZERO);
1150 		if (rt == NULL) {
1151 			if (ifa != NULL)
1152 				ifa_free(ifa);
1153 			senderr(ENOBUFS);
1154 		}
1155 		RT_LOCK_INIT(rt);
1156 		rt->rt_flags = RTF_UP | flags;
1157 		rt->rt_fibnum = fibnum;
1158 		/*
1159 		 * Add the gateway. Possibly re-malloc-ing the storage for it
1160 		 *
1161 		 */
1162 		RT_LOCK(rt);
1163 		if ((error = rt_setgate(rt, dst, gateway)) != 0) {
1164 			RT_LOCK_DESTROY(rt);
1165 			if (ifa != NULL)
1166 				ifa_free(ifa);
1167 			uma_zfree(V_rtzone, rt);
1168 			senderr(error);
1169 		}
1170 
1171 		/*
1172 		 * point to the (possibly newly malloc'd) dest address.
1173 		 */
1174 		ndst = (struct sockaddr *)rt_key(rt);
1175 
1176 		/*
1177 		 * make sure it contains the value we want (masked if needed).
1178 		 */
1179 		if (netmask) {
1180 			rt_maskedcopy(dst, ndst, netmask);
1181 		} else
1182 			bcopy(dst, ndst, dst->sa_len);
1183 
1184 		/*
1185 		 * We use the ifa reference returned by rt_getifa_fib().
1186 		 * This moved from below so that rnh->rnh_addaddr() can
1187 		 * examine the ifa and  ifa->ifa_ifp if it so desires.
1188 		 */
1189 		rt->rt_ifa = ifa;
1190 		rt->rt_ifp = ifa->ifa_ifp;
1191 		rt->rt_rmx.rmx_weight = 1;
1192 
1193 #ifdef RADIX_MPATH
1194 		/* do not permit exactly the same dst/mask/gw pair */
1195 		if (rn_mpath_capable(rnh) &&
1196 			rt_mpath_conflict(rnh, rt, netmask)) {
1197 			if (rt->rt_ifa) {
1198 				ifa_free(rt->rt_ifa);
1199 			}
1200 			Free(rt_key(rt));
1201 			RT_LOCK_DESTROY(rt);
1202 			uma_zfree(V_rtzone, rt);
1203 			senderr(EEXIST);
1204 		}
1205 #endif
1206 
1207 		/* XXX mtu manipulation will be done in rnh_addaddr -- itojun */
1208 		rn = rnh->rnh_addaddr(ndst, netmask, rnh, rt->rt_nodes);
1209 		/*
1210 		 * If it still failed to go into the tree,
1211 		 * then un-make it (this should be a function)
1212 		 */
1213 		if (rn == NULL) {
1214 			if (rt->rt_ifa)
1215 				ifa_free(rt->rt_ifa);
1216 			Free(rt_key(rt));
1217 			RT_LOCK_DESTROY(rt);
1218 			uma_zfree(V_rtzone, rt);
1219 			senderr(EEXIST);
1220 		}
1221 
1222 		/*
1223 		 * If this protocol has something to add to this then
1224 		 * allow it to do that as well.
1225 		 */
1226 		if (ifa->ifa_rtrequest)
1227 			ifa->ifa_rtrequest(req, rt, info);
1228 
1229 		/*
1230 		 * actually return a resultant rtentry and
1231 		 * give the caller a single reference.
1232 		 */
1233 		if (ret_nrt) {
1234 			*ret_nrt = rt;
1235 			RT_ADDREF(rt);
1236 		}
1237 		RT_UNLOCK(rt);
1238 		break;
1239 	default:
1240 		error = EOPNOTSUPP;
1241 	}
1242 bad:
1243 	if (needlock)
1244 		RADIX_NODE_HEAD_UNLOCK(rnh);
1245 	return (error);
1246 #undef senderr
1247 }
1248 
1249 #undef dst
1250 #undef gateway
1251 #undef netmask
1252 #undef ifaaddr
1253 #undef ifpaddr
1254 #undef flags
1255 
1256 int
1257 rt_setgate(struct rtentry *rt, struct sockaddr *dst, struct sockaddr *gate)
1258 {
1259 	/* XXX dst may be overwritten, can we move this to below */
1260 	int dlen = SA_SIZE(dst), glen = SA_SIZE(gate);
1261 #ifdef INVARIANTS
1262 	struct radix_node_head *rnh;
1263 
1264 	rnh = rt_tables_get_rnh(rt->rt_fibnum, dst->sa_family);
1265 #endif
1266 
1267 	RT_LOCK_ASSERT(rt);
1268 	RADIX_NODE_HEAD_LOCK_ASSERT(rnh);
1269 
1270 	/*
1271 	 * Prepare to store the gateway in rt->rt_gateway.
1272 	 * Both dst and gateway are stored one after the other in the same
1273 	 * malloc'd chunk. If we have room, we can reuse the old buffer,
1274 	 * rt_gateway already points to the right place.
1275 	 * Otherwise, malloc a new block and update the 'dst' address.
1276 	 */
1277 	if (rt->rt_gateway == NULL || glen > SA_SIZE(rt->rt_gateway)) {
1278 		caddr_t new;
1279 
1280 		R_Malloc(new, caddr_t, dlen + glen);
1281 		if (new == NULL)
1282 			return ENOBUFS;
1283 		/*
1284 		 * XXX note, we copy from *dst and not *rt_key(rt) because
1285 		 * rt_setgate() can be called to initialize a newly
1286 		 * allocated route entry, in which case rt_key(rt) == NULL
1287 		 * (and also rt->rt_gateway == NULL).
1288 		 * Free()/free() handle a NULL argument just fine.
1289 		 */
1290 		bcopy(dst, new, dlen);
1291 		Free(rt_key(rt));	/* free old block, if any */
1292 		rt_key(rt) = (struct sockaddr *)new;
1293 		rt->rt_gateway = (struct sockaddr *)(new + dlen);
1294 	}
1295 
1296 	/*
1297 	 * Copy the new gateway value into the memory chunk.
1298 	 */
1299 	bcopy(gate, rt->rt_gateway, glen);
1300 
1301 	return (0);
1302 }
1303 
1304 static void
1305 rt_maskedcopy(struct sockaddr *src, struct sockaddr *dst, struct sockaddr *netmask)
1306 {
1307 	register u_char *cp1 = (u_char *)src;
1308 	register u_char *cp2 = (u_char *)dst;
1309 	register u_char *cp3 = (u_char *)netmask;
1310 	u_char *cplim = cp2 + *cp3;
1311 	u_char *cplim2 = cp2 + *cp1;
1312 
1313 	*cp2++ = *cp1++; *cp2++ = *cp1++; /* copies sa_len & sa_family */
1314 	cp3 += 2;
1315 	if (cplim > cplim2)
1316 		cplim = cplim2;
1317 	while (cp2 < cplim)
1318 		*cp2++ = *cp1++ & *cp3++;
1319 	if (cp2 < cplim2)
1320 		bzero((caddr_t)cp2, (unsigned)(cplim2 - cp2));
1321 }
1322 
1323 /*
1324  * Set up a routing table entry, normally
1325  * for an interface.
1326  */
1327 #define _SOCKADDR_TMPSIZE 128 /* Not too big.. kernel stack size is limited */
1328 static inline  int
1329 rtinit1(struct ifaddr *ifa, int cmd, int flags, int fibnum)
1330 {
1331 	struct sockaddr *dst;
1332 	struct sockaddr *netmask;
1333 	struct rtentry *rt = NULL;
1334 	struct rt_addrinfo info;
1335 	int error = 0;
1336 	int startfib, endfib;
1337 	char tempbuf[_SOCKADDR_TMPSIZE];
1338 	int didwork = 0;
1339 	int a_failure = 0;
1340 	static struct sockaddr_dl null_sdl = {sizeof(null_sdl), AF_LINK};
1341 
1342 	if (flags & RTF_HOST) {
1343 		dst = ifa->ifa_dstaddr;
1344 		netmask = NULL;
1345 	} else {
1346 		dst = ifa->ifa_addr;
1347 		netmask = ifa->ifa_netmask;
1348 	}
1349 	if ( dst->sa_family != AF_INET)
1350 		fibnum = 0;
1351 	if (fibnum == -1) {
1352 		if (rt_add_addr_allfibs == 0 && cmd == (int)RTM_ADD) {
1353 			startfib = endfib = curthread->td_proc->p_fibnum;
1354 		} else {
1355 			startfib = 0;
1356 			endfib = rt_numfibs - 1;
1357 		}
1358 	} else {
1359 		KASSERT((fibnum < rt_numfibs), ("rtinit1: bad fibnum"));
1360 		startfib = fibnum;
1361 		endfib = fibnum;
1362 	}
1363 	if (dst->sa_len == 0)
1364 		return(EINVAL);
1365 
1366 	/*
1367 	 * If it's a delete, check that if it exists,
1368 	 * it's on the correct interface or we might scrub
1369 	 * a route to another ifa which would
1370 	 * be confusing at best and possibly worse.
1371 	 */
1372 	if (cmd == RTM_DELETE) {
1373 		/*
1374 		 * It's a delete, so it should already exist..
1375 		 * If it's a net, mask off the host bits
1376 		 * (Assuming we have a mask)
1377 		 * XXX this is kinda inet specific..
1378 		 */
1379 		if (netmask != NULL) {
1380 			rt_maskedcopy(dst, (struct sockaddr *)tempbuf, netmask);
1381 			dst = (struct sockaddr *)tempbuf;
1382 		}
1383 	}
1384 	/*
1385 	 * Now go through all the requested tables (fibs) and do the
1386 	 * requested action. Realistically, this will either be fib 0
1387 	 * for protocols that don't do multiple tables or all the
1388 	 * tables for those that do. XXX For this version only AF_INET.
1389 	 * When that changes code should be refactored to protocol
1390 	 * independent parts and protocol dependent parts.
1391 	 */
1392 	for ( fibnum = startfib; fibnum <= endfib; fibnum++) {
1393 		if (cmd == RTM_DELETE) {
1394 			struct radix_node_head *rnh;
1395 			struct radix_node *rn;
1396 			/*
1397 			 * Look up an rtentry that is in the routing tree and
1398 			 * contains the correct info.
1399 			 */
1400 			rnh = rt_tables_get_rnh(fibnum, dst->sa_family);
1401 			if (rnh == NULL)
1402 				/* this table doesn't exist but others might */
1403 				continue;
1404 			RADIX_NODE_HEAD_LOCK(rnh);
1405 #ifdef RADIX_MPATH
1406 			if (rn_mpath_capable(rnh)) {
1407 
1408 				rn = rnh->rnh_matchaddr(dst, rnh);
1409 				if (rn == NULL)
1410 					error = ESRCH;
1411 				else {
1412 					rt = RNTORT(rn);
1413 					/*
1414 					 * for interface route the
1415 					 * rt->rt_gateway is sockaddr_intf
1416 					 * for cloning ARP entries, so
1417 					 * rt_mpath_matchgate must use the
1418 					 * interface address
1419 					 */
1420 					rt = rt_mpath_matchgate(rt,
1421 					    ifa->ifa_addr);
1422 					if (!rt)
1423 						error = ESRCH;
1424 				}
1425 			}
1426 			else
1427 #endif
1428 			rn = rnh->rnh_lookup(dst, netmask, rnh);
1429 			error = (rn == NULL ||
1430 			    (rn->rn_flags & RNF_ROOT) ||
1431 			    RNTORT(rn)->rt_ifa != ifa ||
1432 			    !sa_equal((struct sockaddr *)rn->rn_key, dst));
1433 			RADIX_NODE_HEAD_UNLOCK(rnh);
1434 			if (error) {
1435 				/* this is only an error if bad on ALL tables */
1436 				continue;
1437 			}
1438 		}
1439 		/*
1440 		 * Do the actual request
1441 		 */
1442 		bzero((caddr_t)&info, sizeof(info));
1443 		info.rti_ifa = ifa;
1444 		info.rti_flags = flags | ifa->ifa_flags;
1445 		info.rti_info[RTAX_DST] = dst;
1446 		/*
1447 		 * doing this for compatibility reasons
1448 		 */
1449 		if (cmd == RTM_ADD)
1450 			info.rti_info[RTAX_GATEWAY] =
1451 			    (struct sockaddr *)&null_sdl;
1452 		else
1453 			info.rti_info[RTAX_GATEWAY] = ifa->ifa_addr;
1454 		info.rti_info[RTAX_NETMASK] = netmask;
1455 		error = rtrequest1_fib(cmd, &info, &rt, fibnum);
1456 		if (error == 0 && rt != NULL) {
1457 			/*
1458 			 * notify any listening routing agents of the change
1459 			 */
1460 			RT_LOCK(rt);
1461 #ifdef RADIX_MPATH
1462 			/*
1463 			 * in case address alias finds the first address
1464 			 * e.g. ifconfig bge0 192.103.54.246/24
1465 			 * e.g. ifconfig bge0 192.103.54.247/24
1466 			 * the address set in the route is 192.103.54.246
1467 			 * so we need to replace it with 192.103.54.247
1468 			 */
1469 			if (memcmp(rt->rt_ifa->ifa_addr,
1470 			    ifa->ifa_addr, ifa->ifa_addr->sa_len)) {
1471 				ifa_free(rt->rt_ifa);
1472 				ifa_ref(ifa);
1473 				rt->rt_ifp = ifa->ifa_ifp;
1474 				rt->rt_ifa = ifa;
1475 			}
1476 #endif
1477 			/*
1478 			 * doing this for compatibility reasons
1479 			 */
1480 			if (cmd == RTM_ADD) {
1481 			    ((struct sockaddr_dl *)rt->rt_gateway)->sdl_type  =
1482 				rt->rt_ifp->if_type;
1483 			    ((struct sockaddr_dl *)rt->rt_gateway)->sdl_index =
1484 				rt->rt_ifp->if_index;
1485 			}
1486 			rt_newaddrmsg(cmd, ifa, error, rt);
1487 			if (cmd == RTM_DELETE) {
1488 				/*
1489 				 * If we are deleting, and we found an entry,
1490 				 * then it's been removed from the tree..
1491 				 * now throw it away.
1492 				 */
1493 				RTFREE_LOCKED(rt);
1494 			} else {
1495 				if (cmd == RTM_ADD) {
1496 					/*
1497 					 * We just wanted to add it..
1498 					 * we don't actually need a reference.
1499 					 */
1500 					RT_REMREF(rt);
1501 				}
1502 				RT_UNLOCK(rt);
1503 			}
1504 			didwork = 1;
1505 		}
1506 		if (error)
1507 			a_failure = error;
1508 	}
1509 	if (cmd == RTM_DELETE) {
1510 		if (didwork) {
1511 			error = 0;
1512 		} else {
1513 			/* we only give an error if it wasn't in any table */
1514 			error = ((flags & RTF_HOST) ?
1515 			    EHOSTUNREACH : ENETUNREACH);
1516 		}
1517 	} else {
1518 		if (a_failure) {
1519 			/* return an error if any of them failed */
1520 			error = a_failure;
1521 		}
1522 	}
1523 	return (error);
1524 }
1525 
1526 /* special one for inet internal use. may not use. */
1527 int
1528 rtinit_fib(struct ifaddr *ifa, int cmd, int flags)
1529 {
1530 	return (rtinit1(ifa, cmd, flags, -1));
1531 }
1532 
1533 /*
1534  * Set up a routing table entry, normally
1535  * for an interface.
1536  */
1537 int
1538 rtinit(struct ifaddr *ifa, int cmd, int flags)
1539 {
1540 	struct sockaddr *dst;
1541 	int fib = 0;
1542 
1543 	if (flags & RTF_HOST) {
1544 		dst = ifa->ifa_dstaddr;
1545 	} else {
1546 		dst = ifa->ifa_addr;
1547 	}
1548 
1549 	if (dst->sa_family == AF_INET)
1550 		fib = -1;
1551 	return (rtinit1(ifa, cmd, flags, fib));
1552 }
1553 
1554 /* This must be before ip6_init2(), which is now SI_ORDER_MIDDLE */
1555 SYSINIT(route, SI_SUB_PROTO_DOMAIN, SI_ORDER_THIRD, route_init, 0);
1556