xref: /freebsd/sys/net/route.c (revision 95d45410b5100e07f6f98450bcd841a8945d4726)
1 /*-
2  * Copyright (c) 1980, 1986, 1991, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 4. Neither the name of the University nor the names of its contributors
14  *    may be used to endorse or promote products derived from this software
15  *    without specific prior written permission.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  *
29  *	@(#)route.c	8.3.1.1 (Berkeley) 2/23/95
30  * $FreeBSD$
31  */
32 /************************************************************************
33  * Note: In this file a 'fib' is a "forwarding information base"	*
34  * Which is the new name for an in kernel routing (next hop) table.	*
35  ***********************************************************************/
36 
37 #include "opt_inet.h"
38 #include "opt_inet6.h"
39 #include "opt_route.h"
40 #include "opt_sctp.h"
41 #include "opt_mrouting.h"
42 #include "opt_mpath.h"
43 
44 #include <sys/param.h>
45 #include <sys/systm.h>
46 #include <sys/syslog.h>
47 #include <sys/malloc.h>
48 #include <sys/mbuf.h>
49 #include <sys/socket.h>
50 #include <sys/sysctl.h>
51 #include <sys/syslog.h>
52 #include <sys/sysproto.h>
53 #include <sys/proc.h>
54 #include <sys/domain.h>
55 #include <sys/kernel.h>
56 
57 #include <net/if.h>
58 #include <net/if_var.h>
59 #include <net/if_dl.h>
60 #include <net/route.h>
61 #include <net/vnet.h>
62 #include <net/flowtable.h>
63 
64 #ifdef RADIX_MPATH
65 #include <net/radix_mpath.h>
66 #endif
67 
68 #include <netinet/in.h>
69 #include <netinet/ip_mroute.h>
70 
71 #include <vm/uma.h>
72 
73 #define	RT_MAXFIBS	UINT16_MAX
74 
75 /* Kernel config default option. */
76 #ifdef ROUTETABLES
77 #if ROUTETABLES <= 0
78 #error "ROUTETABLES defined too low"
79 #endif
80 #if ROUTETABLES > RT_MAXFIBS
81 #error "ROUTETABLES defined too big"
82 #endif
83 #define	RT_NUMFIBS	ROUTETABLES
84 #endif /* ROUTETABLES */
85 /* Initialize to default if not otherwise set. */
86 #ifndef	RT_NUMFIBS
87 #define	RT_NUMFIBS	1
88 #endif
89 
90 #if defined(INET) || defined(INET6)
91 #ifdef SCTP
92 extern void sctp_addr_change(struct ifaddr *ifa, int cmd);
93 #endif /* SCTP */
94 #endif
95 
96 
97 /* This is read-only.. */
98 u_int rt_numfibs = RT_NUMFIBS;
99 SYSCTL_UINT(_net, OID_AUTO, fibs, CTLFLAG_RDTUN, &rt_numfibs, 0, "");
100 
101 /*
102  * By default add routes to all fibs for new interfaces.
103  * Once this is set to 0 then only allocate routes on interface
104  * changes for the FIB of the caller when adding a new set of addresses
105  * to an interface.  XXX this is a shotgun aproach to a problem that needs
106  * a more fine grained solution.. that will come.
107  * XXX also has the problems getting the FIB from curthread which will not
108  * always work given the fib can be overridden and prefixes can be added
109  * from the network stack context.
110  */
111 u_int rt_add_addr_allfibs = 1;
112 SYSCTL_UINT(_net, OID_AUTO, add_addr_allfibs, CTLFLAG_RWTUN,
113     &rt_add_addr_allfibs, 0, "");
114 
115 VNET_DEFINE(struct rtstat, rtstat);
116 #define	V_rtstat	VNET(rtstat)
117 
118 VNET_DEFINE(struct radix_node_head *, rt_tables);
119 #define	V_rt_tables	VNET(rt_tables)
120 
121 VNET_DEFINE(int, rttrash);		/* routes not in table but not freed */
122 #define	V_rttrash	VNET(rttrash)
123 
124 
125 /*
126  * Convert a 'struct radix_node *' to a 'struct rtentry *'.
127  * The operation can be done safely (in this code) because a
128  * 'struct rtentry' starts with two 'struct radix_node''s, the first
129  * one representing leaf nodes in the routing tree, which is
130  * what the code in radix.c passes us as a 'struct radix_node'.
131  *
132  * But because there are a lot of assumptions in this conversion,
133  * do not cast explicitly, but always use the macro below.
134  */
135 #define RNTORT(p)	((struct rtentry *)(p))
136 
137 static VNET_DEFINE(uma_zone_t, rtzone);		/* Routing table UMA zone. */
138 #define	V_rtzone	VNET(rtzone)
139 
140 static int rtrequest1_fib_change(struct radix_node_head *, struct rt_addrinfo *,
141     struct rtentry **, u_int);
142 static void rt_setmetrics(const struct rt_addrinfo *, struct rtentry *);
143 
144 /*
145  * handler for net.my_fibnum
146  */
147 static int
148 sysctl_my_fibnum(SYSCTL_HANDLER_ARGS)
149 {
150         int fibnum;
151         int error;
152 
153         fibnum = curthread->td_proc->p_fibnum;
154         error = sysctl_handle_int(oidp, &fibnum, 0, req);
155         return (error);
156 }
157 
158 SYSCTL_PROC(_net, OID_AUTO, my_fibnum, CTLTYPE_INT|CTLFLAG_RD,
159             NULL, 0, &sysctl_my_fibnum, "I", "default FIB of caller");
160 
161 static __inline struct radix_node_head **
162 rt_tables_get_rnh_ptr(int table, int fam)
163 {
164 	struct radix_node_head **rnh;
165 
166 	KASSERT(table >= 0 && table < rt_numfibs, ("%s: table out of bounds.",
167 	    __func__));
168 	KASSERT(fam >= 0 && fam < (AF_MAX+1), ("%s: fam out of bounds.",
169 	    __func__));
170 
171 	/* rnh is [fib=0][af=0]. */
172 	rnh = (struct radix_node_head **)V_rt_tables;
173 	/* Get the offset to the requested table and fam. */
174 	rnh += table * (AF_MAX+1) + fam;
175 
176 	return (rnh);
177 }
178 
179 struct radix_node_head *
180 rt_tables_get_rnh(int table, int fam)
181 {
182 
183 	return (*rt_tables_get_rnh_ptr(table, fam));
184 }
185 
186 /*
187  * route initialization must occur before ip6_init2(), which happenas at
188  * SI_ORDER_MIDDLE.
189  */
190 static void
191 route_init(void)
192 {
193 
194 	/* whack the tunable ints into  line. */
195 	if (rt_numfibs > RT_MAXFIBS)
196 		rt_numfibs = RT_MAXFIBS;
197 	if (rt_numfibs == 0)
198 		rt_numfibs = 1;
199 }
200 SYSINIT(route_init, SI_SUB_PROTO_DOMAIN, SI_ORDER_THIRD, route_init, 0);
201 
202 static int
203 rtentry_zinit(void *mem, int size, int how)
204 {
205 	struct rtentry *rt = mem;
206 
207 	rt->rt_pksent = counter_u64_alloc(how);
208 	if (rt->rt_pksent == NULL)
209 		return (ENOMEM);
210 
211 	RT_LOCK_INIT(rt);
212 
213 	return (0);
214 }
215 
216 static void
217 rtentry_zfini(void *mem, int size)
218 {
219 	struct rtentry *rt = mem;
220 
221 	RT_LOCK_DESTROY(rt);
222 	counter_u64_free(rt->rt_pksent);
223 }
224 
225 static int
226 rtentry_ctor(void *mem, int size, void *arg, int how)
227 {
228 	struct rtentry *rt = mem;
229 
230 	bzero(rt, offsetof(struct rtentry, rt_endzero));
231 	counter_u64_zero(rt->rt_pksent);
232 
233 	return (0);
234 }
235 
236 static void
237 rtentry_dtor(void *mem, int size, void *arg)
238 {
239 	struct rtentry *rt = mem;
240 
241 	RT_UNLOCK_COND(rt);
242 }
243 
244 static void
245 vnet_route_init(const void *unused __unused)
246 {
247 	struct domain *dom;
248 	struct radix_node_head **rnh;
249 	int table;
250 	int fam;
251 
252 	V_rt_tables = malloc(rt_numfibs * (AF_MAX+1) *
253 	    sizeof(struct radix_node_head *), M_RTABLE, M_WAITOK|M_ZERO);
254 
255 	V_rtzone = uma_zcreate("rtentry", sizeof(struct rtentry),
256 	    rtentry_ctor, rtentry_dtor,
257 	    rtentry_zinit, rtentry_zfini, UMA_ALIGN_PTR, 0);
258 	for (dom = domains; dom; dom = dom->dom_next) {
259 		if (dom->dom_rtattach == NULL)
260 			continue;
261 
262 		for  (table = 0; table < rt_numfibs; table++) {
263 			fam = dom->dom_family;
264 			if (table != 0 && fam != AF_INET6 && fam != AF_INET)
265 				break;
266 
267 			/*
268 			 * XXX MRT rtattach will be also called from
269 			 * vfs_export.c but the offset will be 0 (only for
270 			 * AF_INET and AF_INET6 which don't need it anyhow).
271 			 */
272 			rnh = rt_tables_get_rnh_ptr(table, fam);
273 			if (rnh == NULL)
274 				panic("%s: rnh NULL", __func__);
275 			dom->dom_rtattach((void **)rnh, dom->dom_rtoffset);
276 		}
277 	}
278 }
279 VNET_SYSINIT(vnet_route_init, SI_SUB_PROTO_DOMAIN, SI_ORDER_FOURTH,
280     vnet_route_init, 0);
281 
282 #ifdef VIMAGE
283 static void
284 vnet_route_uninit(const void *unused __unused)
285 {
286 	int table;
287 	int fam;
288 	struct domain *dom;
289 	struct radix_node_head **rnh;
290 
291 	for (dom = domains; dom; dom = dom->dom_next) {
292 		if (dom->dom_rtdetach == NULL)
293 			continue;
294 
295 		for (table = 0; table < rt_numfibs; table++) {
296 			fam = dom->dom_family;
297 
298 			if (table != 0 && fam != AF_INET6 && fam != AF_INET)
299 				break;
300 
301 			rnh = rt_tables_get_rnh_ptr(table, fam);
302 			if (rnh == NULL)
303 				panic("%s: rnh NULL", __func__);
304 			dom->dom_rtdetach((void **)rnh, dom->dom_rtoffset);
305 		}
306 	}
307 
308 	free(V_rt_tables, M_RTABLE);
309 	uma_zdestroy(V_rtzone);
310 }
311 VNET_SYSUNINIT(vnet_route_uninit, SI_SUB_PROTO_DOMAIN, SI_ORDER_THIRD,
312     vnet_route_uninit, 0);
313 #endif
314 
315 #ifndef _SYS_SYSPROTO_H_
316 struct setfib_args {
317 	int     fibnum;
318 };
319 #endif
320 int
321 sys_setfib(struct thread *td, struct setfib_args *uap)
322 {
323 	if (uap->fibnum < 0 || uap->fibnum >= rt_numfibs)
324 		return EINVAL;
325 	td->td_proc->p_fibnum = uap->fibnum;
326 	return (0);
327 }
328 
329 /*
330  * Packet routing routines.
331  */
332 void
333 rtalloc(struct route *ro)
334 {
335 
336 	rtalloc_ign_fib(ro, 0UL, RT_DEFAULT_FIB);
337 }
338 
339 void
340 rtalloc_fib(struct route *ro, u_int fibnum)
341 {
342 	rtalloc_ign_fib(ro, 0UL, fibnum);
343 }
344 
345 void
346 rtalloc_ign(struct route *ro, u_long ignore)
347 {
348 	struct rtentry *rt;
349 
350 	if ((rt = ro->ro_rt) != NULL) {
351 		if (rt->rt_ifp != NULL && rt->rt_flags & RTF_UP)
352 			return;
353 		RTFREE(rt);
354 		ro->ro_rt = NULL;
355 	}
356 	ro->ro_rt = rtalloc1_fib(&ro->ro_dst, 1, ignore, RT_DEFAULT_FIB);
357 	if (ro->ro_rt)
358 		RT_UNLOCK(ro->ro_rt);
359 }
360 
361 void
362 rtalloc_ign_fib(struct route *ro, u_long ignore, u_int fibnum)
363 {
364 	struct rtentry *rt;
365 
366 	if ((rt = ro->ro_rt) != NULL) {
367 		if (rt->rt_ifp != NULL && rt->rt_flags & RTF_UP)
368 			return;
369 		RTFREE(rt);
370 		ro->ro_rt = NULL;
371 	}
372 	ro->ro_rt = rtalloc1_fib(&ro->ro_dst, 1, ignore, fibnum);
373 	if (ro->ro_rt)
374 		RT_UNLOCK(ro->ro_rt);
375 }
376 
377 /*
378  * Look up the route that matches the address given
379  * Or, at least try.. Create a cloned route if needed.
380  *
381  * The returned route, if any, is locked.
382  */
383 struct rtentry *
384 rtalloc1(struct sockaddr *dst, int report, u_long ignflags)
385 {
386 
387 	return (rtalloc1_fib(dst, report, ignflags, RT_DEFAULT_FIB));
388 }
389 
390 struct rtentry *
391 rtalloc1_fib(struct sockaddr *dst, int report, u_long ignflags,
392 		    u_int fibnum)
393 {
394 	struct radix_node_head *rnh;
395 	struct radix_node *rn;
396 	struct rtentry *newrt;
397 	struct rt_addrinfo info;
398 	int err = 0, msgtype = RTM_MISS;
399 	int needlock;
400 
401 	KASSERT((fibnum < rt_numfibs), ("rtalloc1_fib: bad fibnum"));
402 	rnh = rt_tables_get_rnh(fibnum, dst->sa_family);
403 	newrt = NULL;
404 	if (rnh == NULL)
405 		goto miss;
406 
407 	/*
408 	 * Look up the address in the table for that Address Family
409 	 */
410 	needlock = !(ignflags & RTF_RNH_LOCKED);
411 	if (needlock)
412 		RADIX_NODE_HEAD_RLOCK(rnh);
413 #ifdef INVARIANTS
414 	else
415 		RADIX_NODE_HEAD_LOCK_ASSERT(rnh);
416 #endif
417 	rn = rnh->rnh_matchaddr(dst, rnh);
418 	if (rn && ((rn->rn_flags & RNF_ROOT) == 0)) {
419 		newrt = RNTORT(rn);
420 		RT_LOCK(newrt);
421 		RT_ADDREF(newrt);
422 		if (needlock)
423 			RADIX_NODE_HEAD_RUNLOCK(rnh);
424 		goto done;
425 
426 	} else if (needlock)
427 		RADIX_NODE_HEAD_RUNLOCK(rnh);
428 
429 	/*
430 	 * Either we hit the root or couldn't find any match,
431 	 * Which basically means
432 	 * "caint get there frm here"
433 	 */
434 miss:
435 	V_rtstat.rts_unreach++;
436 
437 	if (report) {
438 		/*
439 		 * If required, report the failure to the supervising
440 		 * Authorities.
441 		 * For a delete, this is not an error. (report == 0)
442 		 */
443 		bzero(&info, sizeof(info));
444 		info.rti_info[RTAX_DST] = dst;
445 		rt_missmsg_fib(msgtype, &info, 0, err, fibnum);
446 	}
447 done:
448 	if (newrt)
449 		RT_LOCK_ASSERT(newrt);
450 	return (newrt);
451 }
452 
453 /*
454  * Remove a reference count from an rtentry.
455  * If the count gets low enough, take it out of the routing table
456  */
457 void
458 rtfree(struct rtentry *rt)
459 {
460 	struct radix_node_head *rnh;
461 
462 	KASSERT(rt != NULL,("%s: NULL rt", __func__));
463 	rnh = rt_tables_get_rnh(rt->rt_fibnum, rt_key(rt)->sa_family);
464 	KASSERT(rnh != NULL,("%s: NULL rnh", __func__));
465 
466 	RT_LOCK_ASSERT(rt);
467 
468 	/*
469 	 * The callers should use RTFREE_LOCKED() or RTFREE(), so
470 	 * we should come here exactly with the last reference.
471 	 */
472 	RT_REMREF(rt);
473 	if (rt->rt_refcnt > 0) {
474 		log(LOG_DEBUG, "%s: %p has %d refs\n", __func__, rt, rt->rt_refcnt);
475 		goto done;
476 	}
477 
478 	/*
479 	 * On last reference give the "close method" a chance
480 	 * to cleanup private state.  This also permits (for
481 	 * IPv4 and IPv6) a chance to decide if the routing table
482 	 * entry should be purged immediately or at a later time.
483 	 * When an immediate purge is to happen the close routine
484 	 * typically calls rtexpunge which clears the RTF_UP flag
485 	 * on the entry so that the code below reclaims the storage.
486 	 */
487 	if (rt->rt_refcnt == 0 && rnh->rnh_close)
488 		rnh->rnh_close((struct radix_node *)rt, rnh);
489 
490 	/*
491 	 * If we are no longer "up" (and ref == 0)
492 	 * then we can free the resources associated
493 	 * with the route.
494 	 */
495 	if ((rt->rt_flags & RTF_UP) == 0) {
496 		if (rt->rt_nodes->rn_flags & (RNF_ACTIVE | RNF_ROOT))
497 			panic("rtfree 2");
498 		/*
499 		 * the rtentry must have been removed from the routing table
500 		 * so it is represented in rttrash.. remove that now.
501 		 */
502 		V_rttrash--;
503 #ifdef	DIAGNOSTIC
504 		if (rt->rt_refcnt < 0) {
505 			printf("rtfree: %p not freed (neg refs)\n", rt);
506 			goto done;
507 		}
508 #endif
509 		/*
510 		 * release references on items we hold them on..
511 		 * e.g other routes and ifaddrs.
512 		 */
513 		if (rt->rt_ifa)
514 			ifa_free(rt->rt_ifa);
515 		/*
516 		 * The key is separatly alloc'd so free it (see rt_setgate()).
517 		 * This also frees the gateway, as they are always malloc'd
518 		 * together.
519 		 */
520 		Free(rt_key(rt));
521 
522 		/*
523 		 * and the rtentry itself of course
524 		 */
525 		uma_zfree(V_rtzone, rt);
526 		return;
527 	}
528 done:
529 	RT_UNLOCK(rt);
530 }
531 
532 
533 /*
534  * Force a routing table entry to the specified
535  * destination to go through the given gateway.
536  * Normally called as a result of a routing redirect
537  * message from the network layer.
538  */
539 void
540 rtredirect(struct sockaddr *dst,
541 	struct sockaddr *gateway,
542 	struct sockaddr *netmask,
543 	int flags,
544 	struct sockaddr *src)
545 {
546 
547 	rtredirect_fib(dst, gateway, netmask, flags, src, RT_DEFAULT_FIB);
548 }
549 
550 void
551 rtredirect_fib(struct sockaddr *dst,
552 	struct sockaddr *gateway,
553 	struct sockaddr *netmask,
554 	int flags,
555 	struct sockaddr *src,
556 	u_int fibnum)
557 {
558 	struct rtentry *rt, *rt0 = NULL;
559 	int error = 0;
560 	short *stat = NULL;
561 	struct rt_addrinfo info;
562 	struct ifaddr *ifa;
563 	struct radix_node_head *rnh;
564 
565 	ifa = NULL;
566 	rnh = rt_tables_get_rnh(fibnum, dst->sa_family);
567 	if (rnh == NULL) {
568 		error = EAFNOSUPPORT;
569 		goto out;
570 	}
571 
572 	/* verify the gateway is directly reachable */
573 	if ((ifa = ifa_ifwithnet_fib(gateway, 0, fibnum)) == NULL) {
574 		error = ENETUNREACH;
575 		goto out;
576 	}
577 	rt = rtalloc1_fib(dst, 0, 0UL, fibnum);	/* NB: rt is locked */
578 	/*
579 	 * If the redirect isn't from our current router for this dst,
580 	 * it's either old or wrong.  If it redirects us to ourselves,
581 	 * we have a routing loop, perhaps as a result of an interface
582 	 * going down recently.
583 	 */
584 	if (!(flags & RTF_DONE) && rt &&
585 	     (!sa_equal(src, rt->rt_gateway) || rt->rt_ifa != ifa))
586 		error = EINVAL;
587 	else if (ifa_ifwithaddr_check(gateway))
588 		error = EHOSTUNREACH;
589 	if (error)
590 		goto done;
591 	/*
592 	 * Create a new entry if we just got back a wildcard entry
593 	 * or the lookup failed.  This is necessary for hosts
594 	 * which use routing redirects generated by smart gateways
595 	 * to dynamically build the routing tables.
596 	 */
597 	if (rt == NULL || (rt_mask(rt) && rt_mask(rt)->sa_len < 2))
598 		goto create;
599 	/*
600 	 * Don't listen to the redirect if it's
601 	 * for a route to an interface.
602 	 */
603 	if (rt->rt_flags & RTF_GATEWAY) {
604 		if (((rt->rt_flags & RTF_HOST) == 0) && (flags & RTF_HOST)) {
605 			/*
606 			 * Changing from route to net => route to host.
607 			 * Create new route, rather than smashing route to net.
608 			 */
609 		create:
610 			rt0 = rt;
611 			rt = NULL;
612 
613 			flags |=  RTF_GATEWAY | RTF_DYNAMIC;
614 			bzero((caddr_t)&info, sizeof(info));
615 			info.rti_info[RTAX_DST] = dst;
616 			info.rti_info[RTAX_GATEWAY] = gateway;
617 			info.rti_info[RTAX_NETMASK] = netmask;
618 			info.rti_ifa = ifa;
619 			info.rti_flags = flags;
620 			if (rt0 != NULL)
621 				RT_UNLOCK(rt0);	/* drop lock to avoid LOR with RNH */
622 			error = rtrequest1_fib(RTM_ADD, &info, &rt, fibnum);
623 			if (rt != NULL) {
624 				RT_LOCK(rt);
625 				if (rt0 != NULL)
626 					EVENTHANDLER_INVOKE(route_redirect_event, rt0, rt, dst);
627 				flags = rt->rt_flags;
628 			}
629 			if (rt0 != NULL)
630 				RTFREE(rt0);
631 
632 			stat = &V_rtstat.rts_dynamic;
633 		} else {
634 			struct rtentry *gwrt;
635 
636 			/*
637 			 * Smash the current notion of the gateway to
638 			 * this destination.  Should check about netmask!!!
639 			 */
640 			rt->rt_flags |= RTF_MODIFIED;
641 			flags |= RTF_MODIFIED;
642 			stat = &V_rtstat.rts_newgateway;
643 			/*
644 			 * add the key and gateway (in one malloc'd chunk).
645 			 */
646 			RT_UNLOCK(rt);
647 			RADIX_NODE_HEAD_LOCK(rnh);
648 			RT_LOCK(rt);
649 			rt_setgate(rt, rt_key(rt), gateway);
650 			gwrt = rtalloc1(gateway, 1, RTF_RNH_LOCKED);
651 			RADIX_NODE_HEAD_UNLOCK(rnh);
652 			EVENTHANDLER_INVOKE(route_redirect_event, rt, gwrt, dst);
653 			RTFREE_LOCKED(gwrt);
654 		}
655 	} else
656 		error = EHOSTUNREACH;
657 done:
658 	if (rt)
659 		RTFREE_LOCKED(rt);
660 out:
661 	if (error)
662 		V_rtstat.rts_badredirect++;
663 	else if (stat != NULL)
664 		(*stat)++;
665 	bzero((caddr_t)&info, sizeof(info));
666 	info.rti_info[RTAX_DST] = dst;
667 	info.rti_info[RTAX_GATEWAY] = gateway;
668 	info.rti_info[RTAX_NETMASK] = netmask;
669 	info.rti_info[RTAX_AUTHOR] = src;
670 	rt_missmsg_fib(RTM_REDIRECT, &info, flags, error, fibnum);
671 	if (ifa != NULL)
672 		ifa_free(ifa);
673 }
674 
675 int
676 rtioctl(u_long req, caddr_t data)
677 {
678 
679 	return (rtioctl_fib(req, data, RT_DEFAULT_FIB));
680 }
681 
682 /*
683  * Routing table ioctl interface.
684  */
685 int
686 rtioctl_fib(u_long req, caddr_t data, u_int fibnum)
687 {
688 
689 	/*
690 	 * If more ioctl commands are added here, make sure the proper
691 	 * super-user checks are being performed because it is possible for
692 	 * prison-root to make it this far if raw sockets have been enabled
693 	 * in jails.
694 	 */
695 #ifdef INET
696 	/* Multicast goop, grrr... */
697 	return mrt_ioctl ? mrt_ioctl(req, data, fibnum) : EOPNOTSUPP;
698 #else /* INET */
699 	return ENXIO;
700 #endif /* INET */
701 }
702 
703 /*
704  * For both ifa_ifwithroute() routines, 'ifa' is returned referenced.
705  */
706 struct ifaddr *
707 ifa_ifwithroute(int flags, struct sockaddr *dst, struct sockaddr *gateway)
708 {
709 
710 	return (ifa_ifwithroute_fib(flags, dst, gateway, RT_DEFAULT_FIB));
711 }
712 
713 struct ifaddr *
714 ifa_ifwithroute_fib(int flags, struct sockaddr *dst, struct sockaddr *gateway,
715 				u_int fibnum)
716 {
717 	struct ifaddr *ifa;
718 	int not_found = 0;
719 
720 	if ((flags & RTF_GATEWAY) == 0) {
721 		/*
722 		 * If we are adding a route to an interface,
723 		 * and the interface is a pt to pt link
724 		 * we should search for the destination
725 		 * as our clue to the interface.  Otherwise
726 		 * we can use the local address.
727 		 */
728 		ifa = NULL;
729 		if (flags & RTF_HOST)
730 			ifa = ifa_ifwithdstaddr_fib(dst, fibnum);
731 		if (ifa == NULL)
732 			ifa = ifa_ifwithaddr(gateway);
733 	} else {
734 		/*
735 		 * If we are adding a route to a remote net
736 		 * or host, the gateway may still be on the
737 		 * other end of a pt to pt link.
738 		 */
739 		ifa = ifa_ifwithdstaddr_fib(gateway, fibnum);
740 	}
741 	if (ifa == NULL)
742 		ifa = ifa_ifwithnet_fib(gateway, 0, fibnum);
743 	if (ifa == NULL) {
744 		struct rtentry *rt = rtalloc1_fib(gateway, 0, RTF_RNH_LOCKED, fibnum);
745 		if (rt == NULL)
746 			return (NULL);
747 		/*
748 		 * dismiss a gateway that is reachable only
749 		 * through the default router
750 		 */
751 		switch (gateway->sa_family) {
752 		case AF_INET:
753 			if (satosin(rt_key(rt))->sin_addr.s_addr == INADDR_ANY)
754 				not_found = 1;
755 			break;
756 		case AF_INET6:
757 			if (IN6_IS_ADDR_UNSPECIFIED(&satosin6(rt_key(rt))->sin6_addr))
758 				not_found = 1;
759 			break;
760 		default:
761 			break;
762 		}
763 		if (!not_found && rt->rt_ifa != NULL) {
764 			ifa = rt->rt_ifa;
765 			ifa_ref(ifa);
766 		}
767 		RT_REMREF(rt);
768 		RT_UNLOCK(rt);
769 		if (not_found || ifa == NULL)
770 			return (NULL);
771 	}
772 	if (ifa->ifa_addr->sa_family != dst->sa_family) {
773 		struct ifaddr *oifa = ifa;
774 		ifa = ifaof_ifpforaddr(dst, ifa->ifa_ifp);
775 		if (ifa == NULL)
776 			ifa = oifa;
777 		else
778 			ifa_free(oifa);
779 	}
780 	return (ifa);
781 }
782 
783 /*
784  * Do appropriate manipulations of a routing tree given
785  * all the bits of info needed
786  */
787 int
788 rtrequest(int req,
789 	struct sockaddr *dst,
790 	struct sockaddr *gateway,
791 	struct sockaddr *netmask,
792 	int flags,
793 	struct rtentry **ret_nrt)
794 {
795 
796 	return (rtrequest_fib(req, dst, gateway, netmask, flags, ret_nrt,
797 	    RT_DEFAULT_FIB));
798 }
799 
800 int
801 rtrequest_fib(int req,
802 	struct sockaddr *dst,
803 	struct sockaddr *gateway,
804 	struct sockaddr *netmask,
805 	int flags,
806 	struct rtentry **ret_nrt,
807 	u_int fibnum)
808 {
809 	struct rt_addrinfo info;
810 
811 	if (dst->sa_len == 0)
812 		return(EINVAL);
813 
814 	bzero((caddr_t)&info, sizeof(info));
815 	info.rti_flags = flags;
816 	info.rti_info[RTAX_DST] = dst;
817 	info.rti_info[RTAX_GATEWAY] = gateway;
818 	info.rti_info[RTAX_NETMASK] = netmask;
819 	return rtrequest1_fib(req, &info, ret_nrt, fibnum);
820 }
821 
822 /*
823  * These (questionable) definitions of apparent local variables apply
824  * to the next two functions.  XXXXXX!!!
825  */
826 #define	dst	info->rti_info[RTAX_DST]
827 #define	gateway	info->rti_info[RTAX_GATEWAY]
828 #define	netmask	info->rti_info[RTAX_NETMASK]
829 #define	ifaaddr	info->rti_info[RTAX_IFA]
830 #define	ifpaddr	info->rti_info[RTAX_IFP]
831 #define	flags	info->rti_flags
832 
833 int
834 rt_getifa(struct rt_addrinfo *info)
835 {
836 
837 	return (rt_getifa_fib(info, RT_DEFAULT_FIB));
838 }
839 
840 /*
841  * Look up rt_addrinfo for a specific fib.  Note that if rti_ifa is defined,
842  * it will be referenced so the caller must free it.
843  */
844 int
845 rt_getifa_fib(struct rt_addrinfo *info, u_int fibnum)
846 {
847 	struct ifaddr *ifa;
848 	int error = 0;
849 
850 	/*
851 	 * ifp may be specified by sockaddr_dl
852 	 * when protocol address is ambiguous.
853 	 */
854 	if (info->rti_ifp == NULL && ifpaddr != NULL &&
855 	    ifpaddr->sa_family == AF_LINK &&
856 	    (ifa = ifa_ifwithnet_fib(ifpaddr, 0, fibnum)) != NULL) {
857 		info->rti_ifp = ifa->ifa_ifp;
858 		ifa_free(ifa);
859 	}
860 	if (info->rti_ifa == NULL && ifaaddr != NULL)
861 		info->rti_ifa = ifa_ifwithaddr(ifaaddr);
862 	if (info->rti_ifa == NULL) {
863 		struct sockaddr *sa;
864 
865 		sa = ifaaddr != NULL ? ifaaddr :
866 		    (gateway != NULL ? gateway : dst);
867 		if (sa != NULL && info->rti_ifp != NULL)
868 			info->rti_ifa = ifaof_ifpforaddr(sa, info->rti_ifp);
869 		else if (dst != NULL && gateway != NULL)
870 			info->rti_ifa = ifa_ifwithroute_fib(flags, dst, gateway,
871 							fibnum);
872 		else if (sa != NULL)
873 			info->rti_ifa = ifa_ifwithroute_fib(flags, sa, sa,
874 							fibnum);
875 	}
876 	if ((ifa = info->rti_ifa) != NULL) {
877 		if (info->rti_ifp == NULL)
878 			info->rti_ifp = ifa->ifa_ifp;
879 	} else
880 		error = ENETUNREACH;
881 	return (error);
882 }
883 
884 /*
885  * Expunges references to a route that's about to be reclaimed.
886  * The route must be locked.
887  */
888 int
889 rt_expunge(struct radix_node_head *rnh, struct rtentry *rt)
890 {
891 #if !defined(RADIX_MPATH)
892 	struct radix_node *rn;
893 #else
894 	struct rt_addrinfo info;
895 	int fib;
896 	struct rtentry *rt0;
897 #endif
898 	struct ifaddr *ifa;
899 	int error = 0;
900 
901 	RT_LOCK_ASSERT(rt);
902 	RADIX_NODE_HEAD_LOCK_ASSERT(rnh);
903 
904 #ifdef RADIX_MPATH
905 	fib = rt->rt_fibnum;
906 	bzero(&info, sizeof(info));
907 	info.rti_ifp = rt->rt_ifp;
908 	info.rti_flags = RTF_RNH_LOCKED;
909 	info.rti_info[RTAX_DST] = rt_key(rt);
910 	info.rti_info[RTAX_GATEWAY] = rt->rt_ifa->ifa_addr;
911 
912 	RT_UNLOCK(rt);
913 	error = rtrequest1_fib(RTM_DELETE, &info, &rt0, fib);
914 
915 	if (error == 0 && rt0 != NULL) {
916 		rt = rt0;
917 		RT_LOCK(rt);
918 	} else if (error != 0) {
919 		RT_LOCK(rt);
920 		return (error);
921 	}
922 #else
923 	/*
924 	 * Remove the item from the tree; it should be there,
925 	 * but when callers invoke us blindly it may not (sigh).
926 	 */
927 	rn = rnh->rnh_deladdr(rt_key(rt), rt_mask(rt), rnh);
928 	if (rn == NULL) {
929 		error = ESRCH;
930 		goto bad;
931 	}
932 	KASSERT((rn->rn_flags & (RNF_ACTIVE | RNF_ROOT)) == 0,
933 		("unexpected flags 0x%x", rn->rn_flags));
934 	KASSERT(rt == RNTORT(rn),
935 		("lookup mismatch, rt %p rn %p", rt, rn));
936 #endif /* RADIX_MPATH */
937 
938 	rt->rt_flags &= ~RTF_UP;
939 
940 	/*
941 	 * Give the protocol a chance to keep things in sync.
942 	 */
943 	if ((ifa = rt->rt_ifa) && ifa->ifa_rtrequest) {
944 		struct rt_addrinfo info;
945 
946 		bzero((caddr_t)&info, sizeof(info));
947 		info.rti_flags = rt->rt_flags;
948 		info.rti_info[RTAX_DST] = rt_key(rt);
949 		info.rti_info[RTAX_GATEWAY] = rt->rt_gateway;
950 		info.rti_info[RTAX_NETMASK] = rt_mask(rt);
951 		ifa->ifa_rtrequest(RTM_DELETE, rt, &info);
952 	}
953 
954 	/*
955 	 * one more rtentry floating around that is not
956 	 * linked to the routing table.
957 	 */
958 	V_rttrash++;
959 #if !defined(RADIX_MPATH)
960 bad:
961 #endif
962 	return (error);
963 }
964 
965 #if 0
966 int p_sockaddr(char *buf, int buflen, struct sockaddr *s);
967 int rt_print(char *buf, int buflen, struct rtentry *rt);
968 
969 int
970 p_sockaddr(char *buf, int buflen, struct sockaddr *s)
971 {
972 	void *paddr = NULL;
973 
974 	switch (s->sa_family) {
975 	case AF_INET:
976 		paddr = &((struct sockaddr_in *)s)->sin_addr;
977 		break;
978 	case AF_INET6:
979 		paddr = &((struct sockaddr_in6 *)s)->sin6_addr;
980 		break;
981 	}
982 
983 	if (paddr == NULL)
984 		return (0);
985 
986 	if (inet_ntop(s->sa_family, paddr, buf, buflen) == NULL)
987 		return (0);
988 
989 	return (strlen(buf));
990 }
991 
992 int
993 rt_print(char *buf, int buflen, struct rtentry *rt)
994 {
995 	struct sockaddr *addr, *mask;
996 	int i = 0;
997 
998 	addr = rt_key(rt);
999 	mask = rt_mask(rt);
1000 
1001 	i = p_sockaddr(buf, buflen, addr);
1002 	if (!(rt->rt_flags & RTF_HOST)) {
1003 		buf[i++] = '/';
1004 		i += p_sockaddr(buf + i, buflen - i, mask);
1005 	}
1006 
1007 	if (rt->rt_flags & RTF_GATEWAY) {
1008 		buf[i++] = '>';
1009 		i += p_sockaddr(buf + i, buflen - i, rt->rt_gateway);
1010 	}
1011 
1012 	return (i);
1013 }
1014 #endif
1015 
1016 #ifdef RADIX_MPATH
1017 static int
1018 rn_mpath_update(int req, struct rt_addrinfo *info,
1019     struct radix_node_head *rnh, struct rtentry **ret_nrt)
1020 {
1021 	/*
1022 	 * if we got multipath routes, we require users to specify
1023 	 * a matching RTAX_GATEWAY.
1024 	 */
1025 	struct rtentry *rt, *rto = NULL;
1026 	struct radix_node *rn;
1027 	int error = 0;
1028 
1029 	rn = rnh->rnh_lookup(dst, netmask, rnh);
1030 	if (rn == NULL)
1031 		return (ESRCH);
1032 	rto = rt = RNTORT(rn);
1033 
1034 	rt = rt_mpath_matchgate(rt, gateway);
1035 	if (rt == NULL)
1036 		return (ESRCH);
1037 	/*
1038 	 * this is the first entry in the chain
1039 	 */
1040 	if (rto == rt) {
1041 		rn = rn_mpath_next((struct radix_node *)rt);
1042 		/*
1043 		 * there is another entry, now it's active
1044 		 */
1045 		if (rn) {
1046 			rto = RNTORT(rn);
1047 			RT_LOCK(rto);
1048 			rto->rt_flags |= RTF_UP;
1049 			RT_UNLOCK(rto);
1050 		} else if (rt->rt_flags & RTF_GATEWAY) {
1051 			/*
1052 			 * For gateway routes, we need to
1053 			 * make sure that we we are deleting
1054 			 * the correct gateway.
1055 			 * rt_mpath_matchgate() does not
1056 			 * check the case when there is only
1057 			 * one route in the chain.
1058 			 */
1059 			if (gateway &&
1060 			    (rt->rt_gateway->sa_len != gateway->sa_len ||
1061 				memcmp(rt->rt_gateway, gateway, gateway->sa_len)))
1062 				error = ESRCH;
1063 			else {
1064 				/*
1065 				 * remove from tree before returning it
1066 				 * to the caller
1067 				 */
1068 				rn = rnh->rnh_deladdr(dst, netmask, rnh);
1069 				KASSERT(rt == RNTORT(rn), ("radix node disappeared"));
1070 				goto gwdelete;
1071 			}
1072 
1073 		}
1074 		/*
1075 		 * use the normal delete code to remove
1076 		 * the first entry
1077 		 */
1078 		if (req != RTM_DELETE)
1079 			goto nondelete;
1080 
1081 		error = ENOENT;
1082 		goto done;
1083 	}
1084 
1085 	/*
1086 	 * if the entry is 2nd and on up
1087 	 */
1088 	if ((req == RTM_DELETE) && !rt_mpath_deldup(rto, rt))
1089 		panic ("rtrequest1: rt_mpath_deldup");
1090 gwdelete:
1091 	RT_LOCK(rt);
1092 	RT_ADDREF(rt);
1093 	if (req == RTM_DELETE) {
1094 		rt->rt_flags &= ~RTF_UP;
1095 		/*
1096 		 * One more rtentry floating around that is not
1097 		 * linked to the routing table. rttrash will be decremented
1098 		 * when RTFREE(rt) is eventually called.
1099 		 */
1100 		V_rttrash++;
1101 	}
1102 
1103 nondelete:
1104 	if (req != RTM_DELETE)
1105 		panic("unrecognized request %d", req);
1106 
1107 
1108 	/*
1109 	 * If the caller wants it, then it can have it,
1110 	 * but it's up to it to free the rtentry as we won't be
1111 	 * doing it.
1112 	 */
1113 	if (ret_nrt) {
1114 		*ret_nrt = rt;
1115 		RT_UNLOCK(rt);
1116 	} else
1117 		RTFREE_LOCKED(rt);
1118 done:
1119 	return (error);
1120 }
1121 #endif
1122 
1123 int
1124 rtrequest1_fib(int req, struct rt_addrinfo *info, struct rtentry **ret_nrt,
1125 				u_int fibnum)
1126 {
1127 	int error = 0, needlock = 0;
1128 	struct rtentry *rt;
1129 #ifdef FLOWTABLE
1130 	struct rtentry *rt0;
1131 #endif
1132 	struct radix_node *rn;
1133 	struct radix_node_head *rnh;
1134 	struct ifaddr *ifa;
1135 	struct sockaddr *ndst;
1136 	struct sockaddr_storage mdst;
1137 #define senderr(x) { error = x ; goto bad; }
1138 
1139 	KASSERT((fibnum < rt_numfibs), ("rtrequest1_fib: bad fibnum"));
1140 	switch (dst->sa_family) {
1141 	case AF_INET6:
1142 	case AF_INET:
1143 		/* We support multiple FIBs. */
1144 		break;
1145 	default:
1146 		fibnum = RT_DEFAULT_FIB;
1147 		break;
1148 	}
1149 
1150 	/*
1151 	 * Find the correct routing tree to use for this Address Family
1152 	 */
1153 	rnh = rt_tables_get_rnh(fibnum, dst->sa_family);
1154 	if (rnh == NULL)
1155 		return (EAFNOSUPPORT);
1156 	needlock = ((flags & RTF_RNH_LOCKED) == 0);
1157 	flags &= ~RTF_RNH_LOCKED;
1158 	if (needlock)
1159 		RADIX_NODE_HEAD_LOCK(rnh);
1160 	else
1161 		RADIX_NODE_HEAD_LOCK_ASSERT(rnh);
1162 	/*
1163 	 * If we are adding a host route then we don't want to put
1164 	 * a netmask in the tree, nor do we want to clone it.
1165 	 */
1166 	if (flags & RTF_HOST)
1167 		netmask = NULL;
1168 
1169 	switch (req) {
1170 	case RTM_DELETE:
1171 		if (netmask) {
1172 			rt_maskedcopy(dst, (struct sockaddr *)&mdst, netmask);
1173 			dst = (struct sockaddr *)&mdst;
1174 		}
1175 #ifdef RADIX_MPATH
1176 		if (rn_mpath_capable(rnh)) {
1177 			error = rn_mpath_update(req, info, rnh, ret_nrt);
1178 			/*
1179 			 * "bad" holds true for the success case
1180 			 * as well
1181 			 */
1182 			if (error != ENOENT)
1183 				goto bad;
1184 			error = 0;
1185 		}
1186 #endif
1187 		if ((flags & RTF_PINNED) == 0) {
1188 			/* Check if target route can be deleted */
1189 			rt = (struct rtentry *)rnh->rnh_lookup(dst,
1190 			    netmask, rnh);
1191 			if ((rt != NULL) && (rt->rt_flags & RTF_PINNED))
1192 				senderr(EADDRINUSE);
1193 		}
1194 
1195 		/*
1196 		 * Remove the item from the tree and return it.
1197 		 * Complain if it is not there and do no more processing.
1198 		 */
1199 		rn = rnh->rnh_deladdr(dst, netmask, rnh);
1200 		if (rn == NULL)
1201 			senderr(ESRCH);
1202 		if (rn->rn_flags & (RNF_ACTIVE | RNF_ROOT))
1203 			panic ("rtrequest delete");
1204 		rt = RNTORT(rn);
1205 		RT_LOCK(rt);
1206 		RT_ADDREF(rt);
1207 		rt->rt_flags &= ~RTF_UP;
1208 
1209 		/*
1210 		 * give the protocol a chance to keep things in sync.
1211 		 */
1212 		if ((ifa = rt->rt_ifa) && ifa->ifa_rtrequest)
1213 			ifa->ifa_rtrequest(RTM_DELETE, rt, info);
1214 
1215 		/*
1216 		 * One more rtentry floating around that is not
1217 		 * linked to the routing table. rttrash will be decremented
1218 		 * when RTFREE(rt) is eventually called.
1219 		 */
1220 		V_rttrash++;
1221 
1222 		/*
1223 		 * If the caller wants it, then it can have it,
1224 		 * but it's up to it to free the rtentry as we won't be
1225 		 * doing it.
1226 		 */
1227 		if (ret_nrt) {
1228 			*ret_nrt = rt;
1229 			RT_UNLOCK(rt);
1230 		} else
1231 			RTFREE_LOCKED(rt);
1232 		break;
1233 	case RTM_RESOLVE:
1234 		/*
1235 		 * resolve was only used for route cloning
1236 		 * here for compat
1237 		 */
1238 		break;
1239 	case RTM_ADD:
1240 		if ((flags & RTF_GATEWAY) && !gateway)
1241 			senderr(EINVAL);
1242 		if (dst && gateway && (dst->sa_family != gateway->sa_family) &&
1243 		    (gateway->sa_family != AF_UNSPEC) && (gateway->sa_family != AF_LINK))
1244 			senderr(EINVAL);
1245 
1246 		if (info->rti_ifa == NULL) {
1247 			error = rt_getifa_fib(info, fibnum);
1248 			if (error)
1249 				senderr(error);
1250 		} else
1251 			ifa_ref(info->rti_ifa);
1252 		ifa = info->rti_ifa;
1253 		rt = uma_zalloc(V_rtzone, M_NOWAIT);
1254 		if (rt == NULL) {
1255 			ifa_free(ifa);
1256 			senderr(ENOBUFS);
1257 		}
1258 		rt->rt_flags = RTF_UP | flags;
1259 		rt->rt_fibnum = fibnum;
1260 		/*
1261 		 * Add the gateway. Possibly re-malloc-ing the storage for it.
1262 		 */
1263 		RT_LOCK(rt);
1264 		if ((error = rt_setgate(rt, dst, gateway)) != 0) {
1265 			ifa_free(ifa);
1266 			uma_zfree(V_rtzone, rt);
1267 			senderr(error);
1268 		}
1269 
1270 		/*
1271 		 * point to the (possibly newly malloc'd) dest address.
1272 		 */
1273 		ndst = (struct sockaddr *)rt_key(rt);
1274 
1275 		/*
1276 		 * make sure it contains the value we want (masked if needed).
1277 		 */
1278 		if (netmask) {
1279 			rt_maskedcopy(dst, ndst, netmask);
1280 		} else
1281 			bcopy(dst, ndst, dst->sa_len);
1282 
1283 		/*
1284 		 * We use the ifa reference returned by rt_getifa_fib().
1285 		 * This moved from below so that rnh->rnh_addaddr() can
1286 		 * examine the ifa and  ifa->ifa_ifp if it so desires.
1287 		 */
1288 		rt->rt_ifa = ifa;
1289 		rt->rt_ifp = ifa->ifa_ifp;
1290 		rt->rt_weight = 1;
1291 
1292 #ifdef RADIX_MPATH
1293 		/* do not permit exactly the same dst/mask/gw pair */
1294 		if (rn_mpath_capable(rnh) &&
1295 			rt_mpath_conflict(rnh, rt, netmask)) {
1296 			ifa_free(rt->rt_ifa);
1297 			Free(rt_key(rt));
1298 			uma_zfree(V_rtzone, rt);
1299 			senderr(EEXIST);
1300 		}
1301 #endif
1302 
1303 #ifdef FLOWTABLE
1304 		rt0 = NULL;
1305 		/* "flow-table" only supports IPv6 and IPv4 at the moment. */
1306 		switch (dst->sa_family) {
1307 #ifdef INET6
1308 		case AF_INET6:
1309 #endif
1310 #ifdef INET
1311 		case AF_INET:
1312 #endif
1313 #if defined(INET6) || defined(INET)
1314 			rn = rnh->rnh_matchaddr(dst, rnh);
1315 			if (rn && ((rn->rn_flags & RNF_ROOT) == 0)) {
1316 				struct sockaddr *mask;
1317 				u_char *m, *n;
1318 				int len;
1319 
1320 				/*
1321 				 * compare mask to see if the new route is
1322 				 * more specific than the existing one
1323 				 */
1324 				rt0 = RNTORT(rn);
1325 				RT_LOCK(rt0);
1326 				RT_ADDREF(rt0);
1327 				RT_UNLOCK(rt0);
1328 				/*
1329 				 * A host route is already present, so
1330 				 * leave the flow-table entries as is.
1331 				 */
1332 				if (rt0->rt_flags & RTF_HOST) {
1333 					RTFREE(rt0);
1334 					rt0 = NULL;
1335 				} else if (!(flags & RTF_HOST) && netmask) {
1336 					mask = rt_mask(rt0);
1337 					len = mask->sa_len;
1338 					m = (u_char *)mask;
1339 					n = (u_char *)netmask;
1340 					while (len-- > 0) {
1341 						if (*n != *m)
1342 							break;
1343 						n++;
1344 						m++;
1345 					}
1346 					if (len == 0 || (*n < *m)) {
1347 						RTFREE(rt0);
1348 						rt0 = NULL;
1349 					}
1350 				}
1351 			}
1352 #endif/* INET6 || INET */
1353 		}
1354 #endif /* FLOWTABLE */
1355 
1356 		/* XXX mtu manipulation will be done in rnh_addaddr -- itojun */
1357 		rn = rnh->rnh_addaddr(ndst, netmask, rnh, rt->rt_nodes);
1358 		/*
1359 		 * If it still failed to go into the tree,
1360 		 * then un-make it (this should be a function)
1361 		 */
1362 		if (rn == NULL) {
1363 			ifa_free(rt->rt_ifa);
1364 			Free(rt_key(rt));
1365 			uma_zfree(V_rtzone, rt);
1366 #ifdef FLOWTABLE
1367 			if (rt0 != NULL)
1368 				RTFREE(rt0);
1369 #endif
1370 			senderr(EEXIST);
1371 		}
1372 #ifdef FLOWTABLE
1373 		else if (rt0 != NULL) {
1374 			flowtable_route_flush(dst->sa_family, rt0);
1375 			RTFREE(rt0);
1376 		}
1377 #endif
1378 
1379 		/*
1380 		 * If this protocol has something to add to this then
1381 		 * allow it to do that as well.
1382 		 */
1383 		if (ifa->ifa_rtrequest)
1384 			ifa->ifa_rtrequest(req, rt, info);
1385 
1386 		rt_setmetrics(info, rt);
1387 
1388 		/*
1389 		 * actually return a resultant rtentry and
1390 		 * give the caller a single reference.
1391 		 */
1392 		if (ret_nrt) {
1393 			*ret_nrt = rt;
1394 			RT_ADDREF(rt);
1395 		}
1396 		RT_UNLOCK(rt);
1397 		break;
1398 	case RTM_CHANGE:
1399 		error = rtrequest1_fib_change(rnh, info, ret_nrt, fibnum);
1400 		break;
1401 	default:
1402 		error = EOPNOTSUPP;
1403 	}
1404 bad:
1405 	if (needlock)
1406 		RADIX_NODE_HEAD_UNLOCK(rnh);
1407 	return (error);
1408 #undef senderr
1409 }
1410 
1411 #undef dst
1412 #undef gateway
1413 #undef netmask
1414 #undef ifaaddr
1415 #undef ifpaddr
1416 #undef flags
1417 
1418 static int
1419 rtrequest1_fib_change(struct radix_node_head *rnh, struct rt_addrinfo *info,
1420     struct rtentry **ret_nrt, u_int fibnum)
1421 {
1422 	struct rtentry *rt = NULL;
1423 	int error = 0;
1424 	int free_ifa = 0;
1425 
1426 	rt = (struct rtentry *)rnh->rnh_lookup(info->rti_info[RTAX_DST],
1427 	    info->rti_info[RTAX_NETMASK], rnh);
1428 
1429 	if (rt == NULL)
1430 		return (ESRCH);
1431 
1432 #ifdef RADIX_MPATH
1433 	/*
1434 	 * If we got multipath routes,
1435 	 * we require users to specify a matching RTAX_GATEWAY.
1436 	 */
1437 	if (rn_mpath_capable(rnh)) {
1438 		rt = rt_mpath_matchgate(rt, info->rti_info[RTAX_GATEWAY]);
1439 		if (rt == NULL)
1440 			return (ESRCH);
1441 	}
1442 #endif
1443 
1444 	RT_LOCK(rt);
1445 
1446 	/*
1447 	 * New gateway could require new ifaddr, ifp;
1448 	 * flags may also be different; ifp may be specified
1449 	 * by ll sockaddr when protocol address is ambiguous
1450 	 */
1451 	if (((rt->rt_flags & RTF_GATEWAY) &&
1452 	    info->rti_info[RTAX_GATEWAY] != NULL) ||
1453 	    info->rti_info[RTAX_IFP] != NULL ||
1454 	    (info->rti_info[RTAX_IFA] != NULL &&
1455 	     !sa_equal(info->rti_info[RTAX_IFA], rt->rt_ifa->ifa_addr))) {
1456 
1457 		error = rt_getifa_fib(info, fibnum);
1458 		if (info->rti_ifa != NULL)
1459 			free_ifa = 1;
1460 
1461 		if (error != 0)
1462 			goto bad;
1463 	}
1464 
1465 	/* Check if outgoing interface has changed */
1466 	if (info->rti_ifa != NULL && info->rti_ifa != rt->rt_ifa &&
1467 	    rt->rt_ifa != NULL && rt->rt_ifa->ifa_rtrequest != NULL) {
1468 		rt->rt_ifa->ifa_rtrequest(RTM_DELETE, rt, info);
1469 		ifa_free(rt->rt_ifa);
1470 	}
1471 	/* Update gateway address */
1472 	if (info->rti_info[RTAX_GATEWAY] != NULL) {
1473 		error = rt_setgate(rt, rt_key(rt), info->rti_info[RTAX_GATEWAY]);
1474 		if (error != 0)
1475 			goto bad;
1476 
1477 		rt->rt_flags &= ~RTF_GATEWAY;
1478 		rt->rt_flags |= (RTF_GATEWAY & info->rti_flags);
1479 	}
1480 
1481 	if (info->rti_ifa != NULL && info->rti_ifa != rt->rt_ifa) {
1482 		ifa_ref(info->rti_ifa);
1483 		rt->rt_ifa = info->rti_ifa;
1484 		rt->rt_ifp = info->rti_ifp;
1485 	}
1486 	/* Allow some flags to be toggled on change. */
1487 	rt->rt_flags &= ~RTF_FMASK;
1488 	rt->rt_flags |= info->rti_flags & RTF_FMASK;
1489 
1490 	if (rt->rt_ifa && rt->rt_ifa->ifa_rtrequest != NULL)
1491 	       rt->rt_ifa->ifa_rtrequest(RTM_ADD, rt, info);
1492 
1493 	rt_setmetrics(info, rt);
1494 
1495 	if (ret_nrt) {
1496 		*ret_nrt = rt;
1497 		RT_ADDREF(rt);
1498 	}
1499 bad:
1500 	RT_UNLOCK(rt);
1501 	if (free_ifa != 0)
1502 		ifa_free(info->rti_ifa);
1503 	return (error);
1504 }
1505 
1506 static void
1507 rt_setmetrics(const struct rt_addrinfo *info, struct rtentry *rt)
1508 {
1509 
1510 	if (info->rti_mflags & RTV_MTU)
1511 		rt->rt_mtu = info->rti_rmx->rmx_mtu;
1512 	if (info->rti_mflags & RTV_WEIGHT)
1513 		rt->rt_weight = info->rti_rmx->rmx_weight;
1514 	/* Kernel -> userland timebase conversion. */
1515 	if (info->rti_mflags & RTV_EXPIRE)
1516 		rt->rt_expire = info->rti_rmx->rmx_expire ?
1517 		    info->rti_rmx->rmx_expire - time_second + time_uptime : 0;
1518 }
1519 
1520 int
1521 rt_setgate(struct rtentry *rt, struct sockaddr *dst, struct sockaddr *gate)
1522 {
1523 	/* XXX dst may be overwritten, can we move this to below */
1524 	int dlen = SA_SIZE(dst), glen = SA_SIZE(gate);
1525 #ifdef INVARIANTS
1526 	struct radix_node_head *rnh;
1527 
1528 	rnh = rt_tables_get_rnh(rt->rt_fibnum, dst->sa_family);
1529 #endif
1530 
1531 	RT_LOCK_ASSERT(rt);
1532 	RADIX_NODE_HEAD_LOCK_ASSERT(rnh);
1533 
1534 	/*
1535 	 * Prepare to store the gateway in rt->rt_gateway.
1536 	 * Both dst and gateway are stored one after the other in the same
1537 	 * malloc'd chunk. If we have room, we can reuse the old buffer,
1538 	 * rt_gateway already points to the right place.
1539 	 * Otherwise, malloc a new block and update the 'dst' address.
1540 	 */
1541 	if (rt->rt_gateway == NULL || glen > SA_SIZE(rt->rt_gateway)) {
1542 		caddr_t new;
1543 
1544 		R_Malloc(new, caddr_t, dlen + glen);
1545 		if (new == NULL)
1546 			return ENOBUFS;
1547 		/*
1548 		 * XXX note, we copy from *dst and not *rt_key(rt) because
1549 		 * rt_setgate() can be called to initialize a newly
1550 		 * allocated route entry, in which case rt_key(rt) == NULL
1551 		 * (and also rt->rt_gateway == NULL).
1552 		 * Free()/free() handle a NULL argument just fine.
1553 		 */
1554 		bcopy(dst, new, dlen);
1555 		Free(rt_key(rt));	/* free old block, if any */
1556 		rt_key(rt) = (struct sockaddr *)new;
1557 		rt->rt_gateway = (struct sockaddr *)(new + dlen);
1558 	}
1559 
1560 	/*
1561 	 * Copy the new gateway value into the memory chunk.
1562 	 */
1563 	bcopy(gate, rt->rt_gateway, glen);
1564 
1565 	return (0);
1566 }
1567 
1568 void
1569 rt_maskedcopy(struct sockaddr *src, struct sockaddr *dst, struct sockaddr *netmask)
1570 {
1571 	u_char *cp1 = (u_char *)src;
1572 	u_char *cp2 = (u_char *)dst;
1573 	u_char *cp3 = (u_char *)netmask;
1574 	u_char *cplim = cp2 + *cp3;
1575 	u_char *cplim2 = cp2 + *cp1;
1576 
1577 	*cp2++ = *cp1++; *cp2++ = *cp1++; /* copies sa_len & sa_family */
1578 	cp3 += 2;
1579 	if (cplim > cplim2)
1580 		cplim = cplim2;
1581 	while (cp2 < cplim)
1582 		*cp2++ = *cp1++ & *cp3++;
1583 	if (cp2 < cplim2)
1584 		bzero((caddr_t)cp2, (unsigned)(cplim2 - cp2));
1585 }
1586 
1587 /*
1588  * Set up a routing table entry, normally
1589  * for an interface.
1590  */
1591 #define _SOCKADDR_TMPSIZE 128 /* Not too big.. kernel stack size is limited */
1592 static inline  int
1593 rtinit1(struct ifaddr *ifa, int cmd, int flags, int fibnum)
1594 {
1595 	struct sockaddr *dst;
1596 	struct sockaddr *netmask;
1597 	struct rtentry *rt = NULL;
1598 	struct rt_addrinfo info;
1599 	int error = 0;
1600 	int startfib, endfib;
1601 	char tempbuf[_SOCKADDR_TMPSIZE];
1602 	int didwork = 0;
1603 	int a_failure = 0;
1604 	static struct sockaddr_dl null_sdl = {sizeof(null_sdl), AF_LINK};
1605 	struct radix_node_head *rnh;
1606 
1607 	if (flags & RTF_HOST) {
1608 		dst = ifa->ifa_dstaddr;
1609 		netmask = NULL;
1610 	} else {
1611 		dst = ifa->ifa_addr;
1612 		netmask = ifa->ifa_netmask;
1613 	}
1614 	if (dst->sa_len == 0)
1615 		return(EINVAL);
1616 	switch (dst->sa_family) {
1617 	case AF_INET6:
1618 	case AF_INET:
1619 		/* We support multiple FIBs. */
1620 		break;
1621 	default:
1622 		fibnum = RT_DEFAULT_FIB;
1623 		break;
1624 	}
1625 	if (fibnum == RT_ALL_FIBS) {
1626 		if (rt_add_addr_allfibs == 0 && cmd == (int)RTM_ADD) {
1627 			startfib = endfib = ifa->ifa_ifp->if_fib;
1628 		} else {
1629 			startfib = 0;
1630 			endfib = rt_numfibs - 1;
1631 		}
1632 	} else {
1633 		KASSERT((fibnum < rt_numfibs), ("rtinit1: bad fibnum"));
1634 		startfib = fibnum;
1635 		endfib = fibnum;
1636 	}
1637 
1638 	/*
1639 	 * If it's a delete, check that if it exists,
1640 	 * it's on the correct interface or we might scrub
1641 	 * a route to another ifa which would
1642 	 * be confusing at best and possibly worse.
1643 	 */
1644 	if (cmd == RTM_DELETE) {
1645 		/*
1646 		 * It's a delete, so it should already exist..
1647 		 * If it's a net, mask off the host bits
1648 		 * (Assuming we have a mask)
1649 		 * XXX this is kinda inet specific..
1650 		 */
1651 		if (netmask != NULL) {
1652 			rt_maskedcopy(dst, (struct sockaddr *)tempbuf, netmask);
1653 			dst = (struct sockaddr *)tempbuf;
1654 		}
1655 	}
1656 	/*
1657 	 * Now go through all the requested tables (fibs) and do the
1658 	 * requested action. Realistically, this will either be fib 0
1659 	 * for protocols that don't do multiple tables or all the
1660 	 * tables for those that do.
1661 	 */
1662 	for ( fibnum = startfib; fibnum <= endfib; fibnum++) {
1663 		if (cmd == RTM_DELETE) {
1664 			struct radix_node *rn;
1665 			/*
1666 			 * Look up an rtentry that is in the routing tree and
1667 			 * contains the correct info.
1668 			 */
1669 			rnh = rt_tables_get_rnh(fibnum, dst->sa_family);
1670 			if (rnh == NULL)
1671 				/* this table doesn't exist but others might */
1672 				continue;
1673 			RADIX_NODE_HEAD_RLOCK(rnh);
1674 			rn = rnh->rnh_lookup(dst, netmask, rnh);
1675 #ifdef RADIX_MPATH
1676 			if (rn_mpath_capable(rnh)) {
1677 
1678 				if (rn == NULL)
1679 					error = ESRCH;
1680 				else {
1681 					rt = RNTORT(rn);
1682 					/*
1683 					 * for interface route the
1684 					 * rt->rt_gateway is sockaddr_intf
1685 					 * for cloning ARP entries, so
1686 					 * rt_mpath_matchgate must use the
1687 					 * interface address
1688 					 */
1689 					rt = rt_mpath_matchgate(rt,
1690 					    ifa->ifa_addr);
1691 					if (rt == NULL)
1692 						error = ESRCH;
1693 				}
1694 			}
1695 #endif
1696 			error = (rn == NULL ||
1697 			    (rn->rn_flags & RNF_ROOT) ||
1698 			    RNTORT(rn)->rt_ifa != ifa);
1699 			RADIX_NODE_HEAD_RUNLOCK(rnh);
1700 			if (error) {
1701 				/* this is only an error if bad on ALL tables */
1702 				continue;
1703 			}
1704 		}
1705 		/*
1706 		 * Do the actual request
1707 		 */
1708 		bzero((caddr_t)&info, sizeof(info));
1709 		info.rti_ifa = ifa;
1710 		info.rti_flags = flags |
1711 		    (ifa->ifa_flags & ~IFA_RTSELF) | RTF_PINNED;
1712 		info.rti_info[RTAX_DST] = dst;
1713 		/*
1714 		 * doing this for compatibility reasons
1715 		 */
1716 		if (cmd == RTM_ADD)
1717 			info.rti_info[RTAX_GATEWAY] =
1718 			    (struct sockaddr *)&null_sdl;
1719 		else
1720 			info.rti_info[RTAX_GATEWAY] = ifa->ifa_addr;
1721 		info.rti_info[RTAX_NETMASK] = netmask;
1722 		error = rtrequest1_fib(cmd, &info, &rt, fibnum);
1723 
1724 		if ((error == EEXIST) && (cmd == RTM_ADD)) {
1725 			/*
1726 			 * Interface route addition failed.
1727 			 * Atomically delete current prefix generating
1728 			 * RTM_DELETE message, and retry adding
1729 			 * interface prefix.
1730 			 */
1731 			rnh = rt_tables_get_rnh(fibnum, dst->sa_family);
1732 			RADIX_NODE_HEAD_LOCK(rnh);
1733 
1734 			/* Delete old prefix */
1735 			info.rti_ifa = NULL;
1736 			info.rti_flags = RTF_RNH_LOCKED;
1737 
1738 			error = rtrequest1_fib(RTM_DELETE, &info, NULL, fibnum);
1739 			if (error == 0) {
1740 				info.rti_ifa = ifa;
1741 				info.rti_flags = flags | RTF_RNH_LOCKED |
1742 				    (ifa->ifa_flags & ~IFA_RTSELF) | RTF_PINNED;
1743 				error = rtrequest1_fib(cmd, &info, &rt, fibnum);
1744 			}
1745 
1746 			RADIX_NODE_HEAD_UNLOCK(rnh);
1747 		}
1748 
1749 
1750 		if (error == 0 && rt != NULL) {
1751 			/*
1752 			 * notify any listening routing agents of the change
1753 			 */
1754 			RT_LOCK(rt);
1755 #ifdef RADIX_MPATH
1756 			/*
1757 			 * in case address alias finds the first address
1758 			 * e.g. ifconfig bge0 192.0.2.246/24
1759 			 * e.g. ifconfig bge0 192.0.2.247/24
1760 			 * the address set in the route is 192.0.2.246
1761 			 * so we need to replace it with 192.0.2.247
1762 			 */
1763 			if (memcmp(rt->rt_ifa->ifa_addr,
1764 			    ifa->ifa_addr, ifa->ifa_addr->sa_len)) {
1765 				ifa_free(rt->rt_ifa);
1766 				ifa_ref(ifa);
1767 				rt->rt_ifp = ifa->ifa_ifp;
1768 				rt->rt_ifa = ifa;
1769 			}
1770 #endif
1771 			/*
1772 			 * doing this for compatibility reasons
1773 			 */
1774 			if (cmd == RTM_ADD) {
1775 			    ((struct sockaddr_dl *)rt->rt_gateway)->sdl_type  =
1776 				rt->rt_ifp->if_type;
1777 			    ((struct sockaddr_dl *)rt->rt_gateway)->sdl_index =
1778 				rt->rt_ifp->if_index;
1779 			}
1780 			RT_ADDREF(rt);
1781 			RT_UNLOCK(rt);
1782 			rt_newaddrmsg_fib(cmd, ifa, error, rt, fibnum);
1783 			RT_LOCK(rt);
1784 			RT_REMREF(rt);
1785 			if (cmd == RTM_DELETE) {
1786 				/*
1787 				 * If we are deleting, and we found an entry,
1788 				 * then it's been removed from the tree..
1789 				 * now throw it away.
1790 				 */
1791 				RTFREE_LOCKED(rt);
1792 			} else {
1793 				if (cmd == RTM_ADD) {
1794 					/*
1795 					 * We just wanted to add it..
1796 					 * we don't actually need a reference.
1797 					 */
1798 					RT_REMREF(rt);
1799 				}
1800 				RT_UNLOCK(rt);
1801 			}
1802 			didwork = 1;
1803 		}
1804 		if (error)
1805 			a_failure = error;
1806 	}
1807 	if (cmd == RTM_DELETE) {
1808 		if (didwork) {
1809 			error = 0;
1810 		} else {
1811 			/* we only give an error if it wasn't in any table */
1812 			error = ((flags & RTF_HOST) ?
1813 			    EHOSTUNREACH : ENETUNREACH);
1814 		}
1815 	} else {
1816 		if (a_failure) {
1817 			/* return an error if any of them failed */
1818 			error = a_failure;
1819 		}
1820 	}
1821 	return (error);
1822 }
1823 
1824 /*
1825  * Set up a routing table entry, normally
1826  * for an interface.
1827  */
1828 int
1829 rtinit(struct ifaddr *ifa, int cmd, int flags)
1830 {
1831 	struct sockaddr *dst;
1832 	int fib = RT_DEFAULT_FIB;
1833 
1834 	if (flags & RTF_HOST) {
1835 		dst = ifa->ifa_dstaddr;
1836 	} else {
1837 		dst = ifa->ifa_addr;
1838 	}
1839 
1840 	switch (dst->sa_family) {
1841 	case AF_INET6:
1842 	case AF_INET:
1843 		/* We do support multiple FIBs. */
1844 		fib = RT_ALL_FIBS;
1845 		break;
1846 	}
1847 	return (rtinit1(ifa, cmd, flags, fib));
1848 }
1849 
1850 /*
1851  * Announce interface address arrival/withdraw
1852  * Returns 0 on success.
1853  */
1854 int
1855 rt_addrmsg(int cmd, struct ifaddr *ifa, int fibnum)
1856 {
1857 
1858 	KASSERT(cmd == RTM_ADD || cmd == RTM_DELETE,
1859 	    ("unexpected cmd %d", cmd));
1860 
1861 	KASSERT(fibnum == RT_ALL_FIBS || (fibnum >= 0 && fibnum < rt_numfibs),
1862 	    ("%s: fib out of range 0 <=%d<%d", __func__, fibnum, rt_numfibs));
1863 
1864 #if defined(INET) || defined(INET6)
1865 #ifdef SCTP
1866 	/*
1867 	 * notify the SCTP stack
1868 	 * this will only get called when an address is added/deleted
1869 	 * XXX pass the ifaddr struct instead if ifa->ifa_addr...
1870 	 */
1871 	sctp_addr_change(ifa, cmd);
1872 #endif /* SCTP */
1873 #endif
1874 	return (rtsock_addrmsg(cmd, ifa, fibnum));
1875 }
1876 
1877 /*
1878  * Announce route addition/removal.
1879  * Users of this function MUST validate input data BEFORE calling.
1880  * However we have to be able to handle invalid data:
1881  * if some userland app sends us "invalid" route message (invalid mask,
1882  * no dst, wrong address families, etc...) we need to pass it back
1883  * to app (and any other rtsock consumers) with rtm_errno field set to
1884  * non-zero value.
1885  * Returns 0 on success.
1886  */
1887 int
1888 rt_routemsg(int cmd, struct ifnet *ifp, int error, struct rtentry *rt,
1889     int fibnum)
1890 {
1891 
1892 	KASSERT(cmd == RTM_ADD || cmd == RTM_DELETE,
1893 	    ("unexpected cmd %d", cmd));
1894 
1895 	KASSERT(fibnum == RT_ALL_FIBS || (fibnum >= 0 && fibnum < rt_numfibs),
1896 	    ("%s: fib out of range 0 <=%d<%d", __func__, fibnum, rt_numfibs));
1897 
1898 	KASSERT(rt_key(rt) != NULL, (":%s: rt_key must be supplied", __func__));
1899 
1900 	return (rtsock_routemsg(cmd, ifp, error, rt, fibnum));
1901 }
1902 
1903 void
1904 rt_newaddrmsg(int cmd, struct ifaddr *ifa, int error, struct rtentry *rt)
1905 {
1906 
1907 	rt_newaddrmsg_fib(cmd, ifa, error, rt, RT_ALL_FIBS);
1908 }
1909 
1910 /*
1911  * This is called to generate messages from the routing socket
1912  * indicating a network interface has had addresses associated with it.
1913  */
1914 void
1915 rt_newaddrmsg_fib(int cmd, struct ifaddr *ifa, int error, struct rtentry *rt,
1916     int fibnum)
1917 {
1918 
1919 	KASSERT(cmd == RTM_ADD || cmd == RTM_DELETE,
1920 		("unexpected cmd %u", cmd));
1921 	KASSERT(fibnum == RT_ALL_FIBS || (fibnum >= 0 && fibnum < rt_numfibs),
1922 	    ("%s: fib out of range 0 <=%d<%d", __func__, fibnum, rt_numfibs));
1923 
1924 	if (cmd == RTM_ADD) {
1925 		rt_addrmsg(cmd, ifa, fibnum);
1926 		if (rt != NULL)
1927 			rt_routemsg(cmd, ifa->ifa_ifp, error, rt, fibnum);
1928 	} else {
1929 		if (rt != NULL)
1930 			rt_routemsg(cmd, ifa->ifa_ifp, error, rt, fibnum);
1931 		rt_addrmsg(cmd, ifa, fibnum);
1932 	}
1933 }
1934 
1935