xref: /freebsd/sys/net/rtsock.c (revision 6f63e88c0166ed3e5f2805a9e667c7d24d304cf1)
1 /*-
2  * SPDX-License-Identifier: BSD-3-Clause
3  *
4  * Copyright (c) 1988, 1991, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. Neither the name of the University nor the names of its contributors
16  *    may be used to endorse or promote products derived from this software
17  *    without specific prior written permission.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29  * SUCH DAMAGE.
30  *
31  *	@(#)rtsock.c	8.7 (Berkeley) 10/12/95
32  * $FreeBSD$
33  */
34 #include "opt_ddb.h"
35 #include "opt_mpath.h"
36 #include "opt_inet.h"
37 #include "opt_inet6.h"
38 
39 #include <sys/param.h>
40 #include <sys/jail.h>
41 #include <sys/kernel.h>
42 #include <sys/domain.h>
43 #include <sys/lock.h>
44 #include <sys/malloc.h>
45 #include <sys/mbuf.h>
46 #include <sys/priv.h>
47 #include <sys/proc.h>
48 #include <sys/protosw.h>
49 #include <sys/rmlock.h>
50 #include <sys/rwlock.h>
51 #include <sys/signalvar.h>
52 #include <sys/socket.h>
53 #include <sys/socketvar.h>
54 #include <sys/sysctl.h>
55 #include <sys/systm.h>
56 
57 #ifdef DDB
58 #include <ddb/ddb.h>
59 #include <ddb/db_lex.h>
60 #endif
61 
62 #include <net/if.h>
63 #include <net/if_var.h>
64 #include <net/if_dl.h>
65 #include <net/if_llatbl.h>
66 #include <net/if_types.h>
67 #include <net/netisr.h>
68 #include <net/raw_cb.h>
69 #include <net/route.h>
70 #include <net/route_var.h>
71 #include <net/vnet.h>
72 
73 #include <netinet/in.h>
74 #include <netinet/if_ether.h>
75 #include <netinet/ip_carp.h>
76 #ifdef INET6
77 #include <netinet6/ip6_var.h>
78 #include <netinet6/scope6_var.h>
79 #endif
80 #include <net/route/nhop.h>
81 #include <net/route/shared.h>
82 
83 #ifdef COMPAT_FREEBSD32
84 #include <sys/mount.h>
85 #include <compat/freebsd32/freebsd32.h>
86 
87 struct if_msghdr32 {
88 	uint16_t ifm_msglen;
89 	uint8_t	ifm_version;
90 	uint8_t	ifm_type;
91 	int32_t	ifm_addrs;
92 	int32_t	ifm_flags;
93 	uint16_t ifm_index;
94 	uint16_t _ifm_spare1;
95 	struct	if_data ifm_data;
96 };
97 
98 struct if_msghdrl32 {
99 	uint16_t ifm_msglen;
100 	uint8_t	ifm_version;
101 	uint8_t	ifm_type;
102 	int32_t	ifm_addrs;
103 	int32_t	ifm_flags;
104 	uint16_t ifm_index;
105 	uint16_t _ifm_spare1;
106 	uint16_t ifm_len;
107 	uint16_t ifm_data_off;
108 	uint32_t _ifm_spare2;
109 	struct	if_data ifm_data;
110 };
111 
112 struct ifa_msghdrl32 {
113 	uint16_t ifam_msglen;
114 	uint8_t	ifam_version;
115 	uint8_t	ifam_type;
116 	int32_t	ifam_addrs;
117 	int32_t	ifam_flags;
118 	uint16_t ifam_index;
119 	uint16_t _ifam_spare1;
120 	uint16_t ifam_len;
121 	uint16_t ifam_data_off;
122 	int32_t	ifam_metric;
123 	struct	if_data ifam_data;
124 };
125 
126 #define SA_SIZE32(sa)						\
127     (  (((struct sockaddr *)(sa))->sa_len == 0) ?		\
128 	sizeof(int)		:				\
129 	1 + ( (((struct sockaddr *)(sa))->sa_len - 1) | (sizeof(int) - 1) ) )
130 
131 #endif /* COMPAT_FREEBSD32 */
132 
133 MALLOC_DEFINE(M_RTABLE, "routetbl", "routing tables");
134 
135 /* NB: these are not modified */
136 static struct	sockaddr route_src = { 2, PF_ROUTE, };
137 static struct	sockaddr sa_zero   = { sizeof(sa_zero), AF_INET, };
138 
139 /* These are external hooks for CARP. */
140 int	(*carp_get_vhid_p)(struct ifaddr *);
141 
142 /*
143  * Used by rtsock/raw_input callback code to decide whether to filter the update
144  * notification to a socket bound to a particular FIB.
145  */
146 #define	RTS_FILTER_FIB	M_PROTO8
147 
148 typedef struct {
149 	int	ip_count;	/* attached w/ AF_INET */
150 	int	ip6_count;	/* attached w/ AF_INET6 */
151 	int	any_count;	/* total attached */
152 } route_cb_t;
153 VNET_DEFINE_STATIC(route_cb_t, route_cb);
154 #define	V_route_cb VNET(route_cb)
155 
156 struct mtx rtsock_mtx;
157 MTX_SYSINIT(rtsock, &rtsock_mtx, "rtsock route_cb lock", MTX_DEF);
158 
159 #define	RTSOCK_LOCK()	mtx_lock(&rtsock_mtx)
160 #define	RTSOCK_UNLOCK()	mtx_unlock(&rtsock_mtx)
161 #define	RTSOCK_LOCK_ASSERT()	mtx_assert(&rtsock_mtx, MA_OWNED)
162 
163 static SYSCTL_NODE(_net, OID_AUTO, route, CTLFLAG_RD | CTLFLAG_MPSAFE, 0,
164     "");
165 
166 struct walkarg {
167 	int	w_tmemsize;
168 	int	w_op, w_arg;
169 	caddr_t	w_tmem;
170 	struct sysctl_req *w_req;
171 };
172 
173 static void	rts_input(struct mbuf *m);
174 static struct mbuf *rtsock_msg_mbuf(int type, struct rt_addrinfo *rtinfo);
175 static int	rtsock_msg_buffer(int type, struct rt_addrinfo *rtinfo,
176 			struct walkarg *w, int *plen);
177 static int	rt_xaddrs(caddr_t cp, caddr_t cplim,
178 			struct rt_addrinfo *rtinfo);
179 static int	sysctl_dumpentry(struct radix_node *rn, void *vw);
180 static int	sysctl_iflist(int af, struct walkarg *w);
181 static int	sysctl_ifmalist(int af, struct walkarg *w);
182 static int	route_output(struct mbuf *m, struct socket *so, ...);
183 static void	rt_getmetrics(const struct rtentry *rt, struct rt_metrics *out);
184 static void	rt_dispatch(struct mbuf *, sa_family_t);
185 static struct sockaddr	*rtsock_fix_netmask(struct sockaddr *dst,
186 			struct sockaddr *smask, struct sockaddr_storage *dmask);
187 static int	handle_rtm_get(struct rt_addrinfo *info, u_int fibnum,
188 			struct rt_msghdr *rtm, struct rtentry **ret_nrt);
189 static int	update_rtm_from_rte(struct rt_addrinfo *info,
190 			struct rt_msghdr **prtm, int alloc_len,
191 			struct rtentry *rt);
192 static void	send_rtm_reply(struct socket *so, struct rt_msghdr *rtm,
193 			struct mbuf *m, sa_family_t saf, u_int fibnum,
194 			int rtm_errno);
195 static int	can_export_rte(struct ucred *td_ucred, const struct rtentry *rt);
196 
197 static struct netisr_handler rtsock_nh = {
198 	.nh_name = "rtsock",
199 	.nh_handler = rts_input,
200 	.nh_proto = NETISR_ROUTE,
201 	.nh_policy = NETISR_POLICY_SOURCE,
202 };
203 
204 static int
205 sysctl_route_netisr_maxqlen(SYSCTL_HANDLER_ARGS)
206 {
207 	int error, qlimit;
208 
209 	netisr_getqlimit(&rtsock_nh, &qlimit);
210 	error = sysctl_handle_int(oidp, &qlimit, 0, req);
211         if (error || !req->newptr)
212                 return (error);
213 	if (qlimit < 1)
214 		return (EINVAL);
215 	return (netisr_setqlimit(&rtsock_nh, qlimit));
216 }
217 SYSCTL_PROC(_net_route, OID_AUTO, netisr_maxqlen,
218     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
219     0, 0, sysctl_route_netisr_maxqlen, "I",
220     "maximum routing socket dispatch queue length");
221 
222 static void
223 vnet_rts_init(void)
224 {
225 	int tmp;
226 
227 	if (IS_DEFAULT_VNET(curvnet)) {
228 		if (TUNABLE_INT_FETCH("net.route.netisr_maxqlen", &tmp))
229 			rtsock_nh.nh_qlimit = tmp;
230 		netisr_register(&rtsock_nh);
231 	}
232 #ifdef VIMAGE
233 	 else
234 		netisr_register_vnet(&rtsock_nh);
235 #endif
236 }
237 VNET_SYSINIT(vnet_rtsock, SI_SUB_PROTO_DOMAIN, SI_ORDER_THIRD,
238     vnet_rts_init, 0);
239 
240 #ifdef VIMAGE
241 static void
242 vnet_rts_uninit(void)
243 {
244 
245 	netisr_unregister_vnet(&rtsock_nh);
246 }
247 VNET_SYSUNINIT(vnet_rts_uninit, SI_SUB_PROTO_DOMAIN, SI_ORDER_THIRD,
248     vnet_rts_uninit, 0);
249 #endif
250 
251 static int
252 raw_input_rts_cb(struct mbuf *m, struct sockproto *proto, struct sockaddr *src,
253     struct rawcb *rp)
254 {
255 	int fibnum;
256 
257 	KASSERT(m != NULL, ("%s: m is NULL", __func__));
258 	KASSERT(proto != NULL, ("%s: proto is NULL", __func__));
259 	KASSERT(rp != NULL, ("%s: rp is NULL", __func__));
260 
261 	/* No filtering requested. */
262 	if ((m->m_flags & RTS_FILTER_FIB) == 0)
263 		return (0);
264 
265 	/* Check if it is a rts and the fib matches the one of the socket. */
266 	fibnum = M_GETFIB(m);
267 	if (proto->sp_family != PF_ROUTE ||
268 	    rp->rcb_socket == NULL ||
269 	    rp->rcb_socket->so_fibnum == fibnum)
270 		return (0);
271 
272 	/* Filtering requested and no match, the socket shall be skipped. */
273 	return (1);
274 }
275 
276 static void
277 rts_input(struct mbuf *m)
278 {
279 	struct sockproto route_proto;
280 	unsigned short *family;
281 	struct m_tag *tag;
282 
283 	route_proto.sp_family = PF_ROUTE;
284 	tag = m_tag_find(m, PACKET_TAG_RTSOCKFAM, NULL);
285 	if (tag != NULL) {
286 		family = (unsigned short *)(tag + 1);
287 		route_proto.sp_protocol = *family;
288 		m_tag_delete(m, tag);
289 	} else
290 		route_proto.sp_protocol = 0;
291 
292 	raw_input_ext(m, &route_proto, &route_src, raw_input_rts_cb);
293 }
294 
295 /*
296  * It really doesn't make any sense at all for this code to share much
297  * with raw_usrreq.c, since its functionality is so restricted.  XXX
298  */
299 static void
300 rts_abort(struct socket *so)
301 {
302 
303 	raw_usrreqs.pru_abort(so);
304 }
305 
306 static void
307 rts_close(struct socket *so)
308 {
309 
310 	raw_usrreqs.pru_close(so);
311 }
312 
313 /* pru_accept is EOPNOTSUPP */
314 
315 static int
316 rts_attach(struct socket *so, int proto, struct thread *td)
317 {
318 	struct rawcb *rp;
319 	int error;
320 
321 	KASSERT(so->so_pcb == NULL, ("rts_attach: so_pcb != NULL"));
322 
323 	/* XXX */
324 	rp = malloc(sizeof *rp, M_PCB, M_WAITOK | M_ZERO);
325 
326 	so->so_pcb = (caddr_t)rp;
327 	so->so_fibnum = td->td_proc->p_fibnum;
328 	error = raw_attach(so, proto);
329 	rp = sotorawcb(so);
330 	if (error) {
331 		so->so_pcb = NULL;
332 		free(rp, M_PCB);
333 		return error;
334 	}
335 	RTSOCK_LOCK();
336 	switch(rp->rcb_proto.sp_protocol) {
337 	case AF_INET:
338 		V_route_cb.ip_count++;
339 		break;
340 	case AF_INET6:
341 		V_route_cb.ip6_count++;
342 		break;
343 	}
344 	V_route_cb.any_count++;
345 	RTSOCK_UNLOCK();
346 	soisconnected(so);
347 	so->so_options |= SO_USELOOPBACK;
348 	return 0;
349 }
350 
351 static int
352 rts_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
353 {
354 
355 	return (raw_usrreqs.pru_bind(so, nam, td)); /* xxx just EINVAL */
356 }
357 
358 static int
359 rts_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
360 {
361 
362 	return (raw_usrreqs.pru_connect(so, nam, td)); /* XXX just EINVAL */
363 }
364 
365 /* pru_connect2 is EOPNOTSUPP */
366 /* pru_control is EOPNOTSUPP */
367 
368 static void
369 rts_detach(struct socket *so)
370 {
371 	struct rawcb *rp = sotorawcb(so);
372 
373 	KASSERT(rp != NULL, ("rts_detach: rp == NULL"));
374 
375 	RTSOCK_LOCK();
376 	switch(rp->rcb_proto.sp_protocol) {
377 	case AF_INET:
378 		V_route_cb.ip_count--;
379 		break;
380 	case AF_INET6:
381 		V_route_cb.ip6_count--;
382 		break;
383 	}
384 	V_route_cb.any_count--;
385 	RTSOCK_UNLOCK();
386 	raw_usrreqs.pru_detach(so);
387 }
388 
389 static int
390 rts_disconnect(struct socket *so)
391 {
392 
393 	return (raw_usrreqs.pru_disconnect(so));
394 }
395 
396 /* pru_listen is EOPNOTSUPP */
397 
398 static int
399 rts_peeraddr(struct socket *so, struct sockaddr **nam)
400 {
401 
402 	return (raw_usrreqs.pru_peeraddr(so, nam));
403 }
404 
405 /* pru_rcvd is EOPNOTSUPP */
406 /* pru_rcvoob is EOPNOTSUPP */
407 
408 static int
409 rts_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam,
410 	 struct mbuf *control, struct thread *td)
411 {
412 
413 	return (raw_usrreqs.pru_send(so, flags, m, nam, control, td));
414 }
415 
416 /* pru_sense is null */
417 
418 static int
419 rts_shutdown(struct socket *so)
420 {
421 
422 	return (raw_usrreqs.pru_shutdown(so));
423 }
424 
425 static int
426 rts_sockaddr(struct socket *so, struct sockaddr **nam)
427 {
428 
429 	return (raw_usrreqs.pru_sockaddr(so, nam));
430 }
431 
432 static struct pr_usrreqs route_usrreqs = {
433 	.pru_abort =		rts_abort,
434 	.pru_attach =		rts_attach,
435 	.pru_bind =		rts_bind,
436 	.pru_connect =		rts_connect,
437 	.pru_detach =		rts_detach,
438 	.pru_disconnect =	rts_disconnect,
439 	.pru_peeraddr =		rts_peeraddr,
440 	.pru_send =		rts_send,
441 	.pru_shutdown =		rts_shutdown,
442 	.pru_sockaddr =		rts_sockaddr,
443 	.pru_close =		rts_close,
444 };
445 
446 #ifndef _SOCKADDR_UNION_DEFINED
447 #define	_SOCKADDR_UNION_DEFINED
448 /*
449  * The union of all possible address formats we handle.
450  */
451 union sockaddr_union {
452 	struct sockaddr		sa;
453 	struct sockaddr_in	sin;
454 	struct sockaddr_in6	sin6;
455 };
456 #endif /* _SOCKADDR_UNION_DEFINED */
457 
458 static int
459 rtm_get_jailed(struct rt_addrinfo *info, struct ifnet *ifp,
460     struct nhop_object *nh, union sockaddr_union *saun, struct ucred *cred)
461 {
462 #if defined(INET) || defined(INET6)
463 	struct epoch_tracker et;
464 #endif
465 
466 	/* First, see if the returned address is part of the jail. */
467 	if (prison_if(cred, nh->nh_ifa->ifa_addr) == 0) {
468 		info->rti_info[RTAX_IFA] = nh->nh_ifa->ifa_addr;
469 		return (0);
470 	}
471 
472 	switch (info->rti_info[RTAX_DST]->sa_family) {
473 #ifdef INET
474 	case AF_INET:
475 	{
476 		struct in_addr ia;
477 		struct ifaddr *ifa;
478 		int found;
479 
480 		found = 0;
481 		/*
482 		 * Try to find an address on the given outgoing interface
483 		 * that belongs to the jail.
484 		 */
485 		NET_EPOCH_ENTER(et);
486 		CK_STAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
487 			struct sockaddr *sa;
488 			sa = ifa->ifa_addr;
489 			if (sa->sa_family != AF_INET)
490 				continue;
491 			ia = ((struct sockaddr_in *)sa)->sin_addr;
492 			if (prison_check_ip4(cred, &ia) == 0) {
493 				found = 1;
494 				break;
495 			}
496 		}
497 		NET_EPOCH_EXIT(et);
498 		if (!found) {
499 			/*
500 			 * As a last resort return the 'default' jail address.
501 			 */
502 			ia = ((struct sockaddr_in *)nh->nh_ifa->ifa_addr)->
503 			    sin_addr;
504 			if (prison_get_ip4(cred, &ia) != 0)
505 				return (ESRCH);
506 		}
507 		bzero(&saun->sin, sizeof(struct sockaddr_in));
508 		saun->sin.sin_len = sizeof(struct sockaddr_in);
509 		saun->sin.sin_family = AF_INET;
510 		saun->sin.sin_addr.s_addr = ia.s_addr;
511 		info->rti_info[RTAX_IFA] = (struct sockaddr *)&saun->sin;
512 		break;
513 	}
514 #endif
515 #ifdef INET6
516 	case AF_INET6:
517 	{
518 		struct in6_addr ia6;
519 		struct ifaddr *ifa;
520 		int found;
521 
522 		found = 0;
523 		/*
524 		 * Try to find an address on the given outgoing interface
525 		 * that belongs to the jail.
526 		 */
527 		NET_EPOCH_ENTER(et);
528 		CK_STAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
529 			struct sockaddr *sa;
530 			sa = ifa->ifa_addr;
531 			if (sa->sa_family != AF_INET6)
532 				continue;
533 			bcopy(&((struct sockaddr_in6 *)sa)->sin6_addr,
534 			    &ia6, sizeof(struct in6_addr));
535 			if (prison_check_ip6(cred, &ia6) == 0) {
536 				found = 1;
537 				break;
538 			}
539 		}
540 		NET_EPOCH_EXIT(et);
541 		if (!found) {
542 			/*
543 			 * As a last resort return the 'default' jail address.
544 			 */
545 			ia6 = ((struct sockaddr_in6 *)nh->nh_ifa->ifa_addr)->
546 			    sin6_addr;
547 			if (prison_get_ip6(cred, &ia6) != 0)
548 				return (ESRCH);
549 		}
550 		bzero(&saun->sin6, sizeof(struct sockaddr_in6));
551 		saun->sin6.sin6_len = sizeof(struct sockaddr_in6);
552 		saun->sin6.sin6_family = AF_INET6;
553 		bcopy(&ia6, &saun->sin6.sin6_addr, sizeof(struct in6_addr));
554 		if (sa6_recoverscope(&saun->sin6) != 0)
555 			return (ESRCH);
556 		info->rti_info[RTAX_IFA] = (struct sockaddr *)&saun->sin6;
557 		break;
558 	}
559 #endif
560 	default:
561 		return (ESRCH);
562 	}
563 	return (0);
564 }
565 
566 /*
567  * Fills in @info based on userland-provided @rtm message.
568  *
569  * Returns 0 on success.
570  */
571 static int
572 fill_addrinfo(struct rt_msghdr *rtm, int len, u_int fibnum, struct rt_addrinfo *info)
573 {
574 	int error;
575 	sa_family_t saf;
576 
577 	rtm->rtm_pid = curproc->p_pid;
578 	info->rti_addrs = rtm->rtm_addrs;
579 
580 	info->rti_mflags = rtm->rtm_inits;
581 	info->rti_rmx = &rtm->rtm_rmx;
582 
583 	/*
584 	 * rt_xaddrs() performs s6_addr[2] := sin6_scope_id for AF_INET6
585 	 * link-local address because rtrequest requires addresses with
586 	 * embedded scope id.
587 	 */
588 	if (rt_xaddrs((caddr_t)(rtm + 1), len + (caddr_t)rtm, info))
589 		return (EINVAL);
590 
591 	if (rtm->rtm_flags & RTF_RNH_LOCKED)
592 		return (EINVAL);
593 	info->rti_flags = rtm->rtm_flags;
594 	if (info->rti_info[RTAX_DST] == NULL ||
595 	    info->rti_info[RTAX_DST]->sa_family >= AF_MAX ||
596 	    (info->rti_info[RTAX_GATEWAY] != NULL &&
597 	     info->rti_info[RTAX_GATEWAY]->sa_family >= AF_MAX))
598 		return (EINVAL);
599 	saf = info->rti_info[RTAX_DST]->sa_family;
600 	/*
601 	 * Verify that the caller has the appropriate privilege; RTM_GET
602 	 * is the only operation the non-superuser is allowed.
603 	 */
604 	if (rtm->rtm_type != RTM_GET) {
605 		error = priv_check(curthread, PRIV_NET_ROUTE);
606 		if (error != 0)
607 			return (error);
608 	}
609 
610 	/*
611 	 * The given gateway address may be an interface address.
612 	 * For example, issuing a "route change" command on a route
613 	 * entry that was created from a tunnel, and the gateway
614 	 * address given is the local end point. In this case the
615 	 * RTF_GATEWAY flag must be cleared or the destination will
616 	 * not be reachable even though there is no error message.
617 	 */
618 	if (info->rti_info[RTAX_GATEWAY] != NULL &&
619 	    info->rti_info[RTAX_GATEWAY]->sa_family != AF_LINK) {
620 		struct rt_addrinfo ginfo;
621 		struct sockaddr *gdst;
622 		struct sockaddr_storage ss;
623 
624 		bzero(&ginfo, sizeof(ginfo));
625 		bzero(&ss, sizeof(ss));
626 		ss.ss_len = sizeof(ss);
627 
628 		ginfo.rti_info[RTAX_GATEWAY] = (struct sockaddr *)&ss;
629 		gdst = info->rti_info[RTAX_GATEWAY];
630 
631 		/*
632 		 * A host route through the loopback interface is
633 		 * installed for each interface adddress. In pre 8.0
634 		 * releases the interface address of a PPP link type
635 		 * is not reachable locally. This behavior is fixed as
636 		 * part of the new L2/L3 redesign and rewrite work. The
637 		 * signature of this interface address route is the
638 		 * AF_LINK sa_family type of the gateway, and the
639 		 * rt_ifp has the IFF_LOOPBACK flag set.
640 		 */
641 		if (rib_lookup_info(fibnum, gdst, NHR_REF, 0, &ginfo) == 0) {
642 			if (ss.ss_family == AF_LINK &&
643 			    ginfo.rti_ifp->if_flags & IFF_LOOPBACK) {
644 				info->rti_flags &= ~RTF_GATEWAY;
645 				info->rti_flags |= RTF_GWFLAG_COMPAT;
646 			}
647 			rib_free_info(&ginfo);
648 		}
649 	}
650 
651 	return (0);
652 }
653 
654 /*
655  * Handles RTM_GET message from routing socket, returning matching rt.
656  *
657  * Returns:
658  * 0 on success, with locked and referenced matching rt in @rt_nrt
659  * errno of failure
660  */
661 static int
662 handle_rtm_get(struct rt_addrinfo *info, u_int fibnum,
663     struct rt_msghdr *rtm, struct rtentry **ret_nrt)
664 {
665 	RIB_RLOCK_TRACKER;
666 	struct rtentry *rt;
667 	struct rib_head *rnh;
668 	sa_family_t saf;
669 
670 	saf = info->rti_info[RTAX_DST]->sa_family;
671 
672 	rnh = rt_tables_get_rnh(fibnum, saf);
673 	if (rnh == NULL)
674 		return (EAFNOSUPPORT);
675 
676 	RIB_RLOCK(rnh);
677 
678 	if (info->rti_info[RTAX_NETMASK] == NULL) {
679 		/*
680 		 * Provide longest prefix match for
681 		 * address lookup (no mask).
682 		 * 'route -n get addr'
683 		 */
684 		rt = (struct rtentry *) rnh->rnh_matchaddr(
685 		    info->rti_info[RTAX_DST], &rnh->head);
686 	} else
687 		rt = (struct rtentry *) rnh->rnh_lookup(
688 		    info->rti_info[RTAX_DST],
689 		    info->rti_info[RTAX_NETMASK], &rnh->head);
690 
691 	if (rt == NULL) {
692 		RIB_RUNLOCK(rnh);
693 		return (ESRCH);
694 	}
695 #ifdef RADIX_MPATH
696 	/*
697 	 * for RTM_GET, gate is optional even with multipath.
698 	 * if gate == NULL the first match is returned.
699 	 * (no need to call rt_mpath_matchgate if gate == NULL)
700 	 */
701 	if (rt_mpath_capable(rnh) && info->rti_info[RTAX_GATEWAY]) {
702 		rt = rt_mpath_matchgate(rt, info->rti_info[RTAX_GATEWAY]);
703 		if (!rt) {
704 			RIB_RUNLOCK(rnh);
705 			return (ESRCH);
706 		}
707 	}
708 #endif
709 	/*
710 	 * If performing proxied L2 entry insertion, and
711 	 * the actual PPP host entry is found, perform
712 	 * another search to retrieve the prefix route of
713 	 * the local end point of the PPP link.
714 	 * TODO: move this logic to userland.
715 	 */
716 	if (rtm->rtm_flags & RTF_ANNOUNCE) {
717 		struct sockaddr laddr;
718 		struct nhop_object *nh;
719 
720 		nh = rt->rt_nhop;
721 		if (nh->nh_ifp != NULL &&
722 		    nh->nh_ifp->if_type == IFT_PROPVIRTUAL) {
723 			struct epoch_tracker et;
724 			struct ifaddr *ifa;
725 
726 			NET_EPOCH_ENTER(et);
727 			ifa = ifa_ifwithnet(info->rti_info[RTAX_DST], 1,
728 					RT_ALL_FIBS);
729 			NET_EPOCH_EXIT(et);
730 			if (ifa != NULL)
731 				rt_maskedcopy(ifa->ifa_addr,
732 					      &laddr,
733 					      ifa->ifa_netmask);
734 		} else
735 			rt_maskedcopy(nh->nh_ifa->ifa_addr,
736 				      &laddr,
737 				      nh->nh_ifa->ifa_netmask);
738 		/*
739 		 * refactor rt and no lock operation necessary
740 		 */
741 		rt = (struct rtentry *)rnh->rnh_matchaddr(&laddr,
742 		    &rnh->head);
743 		if (rt == NULL) {
744 			RIB_RUNLOCK(rnh);
745 			return (ESRCH);
746 		}
747 	}
748 	RT_LOCK(rt);
749 	RT_ADDREF(rt);
750 	RIB_RUNLOCK(rnh);
751 
752 	*ret_nrt = rt;
753 
754 	return (0);
755 }
756 
757 /*
758  * Update sockaddrs, flags, etc in @prtm based on @rt data.
759  * Assumes @rt is locked.
760  * rtm can be reallocated.
761  *
762  * Returns 0 on success, along with pointer to (potentially reallocated)
763  *  rtm.
764  *
765  */
766 static int
767 update_rtm_from_rte(struct rt_addrinfo *info, struct rt_msghdr **prtm,
768     int alloc_len, struct rtentry *rt)
769 {
770 	struct sockaddr_storage netmask_ss;
771 	struct walkarg w;
772 	union sockaddr_union saun;
773 	struct rt_msghdr *rtm, *orig_rtm = NULL;
774 	struct nhop_object *nh;
775 	struct ifnet *ifp;
776 	int error, len;
777 
778 	RT_LOCK_ASSERT(rt);
779 
780 	rtm = *prtm;
781 
782 	nh = rt->rt_nhop;
783 	info->rti_info[RTAX_DST] = rt_key(rt);
784 	info->rti_info[RTAX_GATEWAY] = &nh->gw_sa;
785 	info->rti_info[RTAX_NETMASK] = rtsock_fix_netmask(rt_key(rt),
786 	    rt_mask(rt), &netmask_ss);
787 	info->rti_info[RTAX_GENMASK] = 0;
788 	ifp = nh->nh_ifp;
789 	if (rtm->rtm_addrs & (RTA_IFP | RTA_IFA)) {
790 		if (ifp) {
791 			info->rti_info[RTAX_IFP] =
792 			    ifp->if_addr->ifa_addr;
793 			error = rtm_get_jailed(info, ifp, nh,
794 			    &saun, curthread->td_ucred);
795 			if (error != 0)
796 				return (error);
797 			if (ifp->if_flags & IFF_POINTOPOINT)
798 				info->rti_info[RTAX_BRD] =
799 				    nh->nh_ifa->ifa_dstaddr;
800 			rtm->rtm_index = ifp->if_index;
801 		} else {
802 			info->rti_info[RTAX_IFP] = NULL;
803 			info->rti_info[RTAX_IFA] = NULL;
804 		}
805 	} else if (ifp != NULL)
806 		rtm->rtm_index = ifp->if_index;
807 
808 	/* Check if we need to realloc storage */
809 	rtsock_msg_buffer(rtm->rtm_type, info, NULL, &len);
810 	if (len > alloc_len) {
811 		struct rt_msghdr *tmp_rtm;
812 
813 		tmp_rtm = malloc(len, M_TEMP, M_NOWAIT);
814 		if (tmp_rtm == NULL)
815 			return (ENOBUFS);
816 		bcopy(rtm, tmp_rtm, rtm->rtm_msglen);
817 		orig_rtm = rtm;
818 		rtm = tmp_rtm;
819 		alloc_len = len;
820 
821 		/*
822 		 * Delay freeing original rtm as info contains
823 		 * data referencing it.
824 		 */
825 	}
826 
827 	w.w_tmem = (caddr_t)rtm;
828 	w.w_tmemsize = alloc_len;
829 	rtsock_msg_buffer(rtm->rtm_type, info, &w, &len);
830 
831 	if (rt->rt_flags & RTF_GWFLAG_COMPAT)
832 		rtm->rtm_flags = RTF_GATEWAY |
833 			(rt->rt_flags & ~RTF_GWFLAG_COMPAT);
834 	else
835 		rtm->rtm_flags = rt->rt_flags;
836 	rt_getmetrics(rt, &rtm->rtm_rmx);
837 	rtm->rtm_addrs = info->rti_addrs;
838 
839 	if (orig_rtm != NULL)
840 		free(orig_rtm, M_TEMP);
841 	*prtm = rtm;
842 
843 	return (0);
844 }
845 
846 /*ARGSUSED*/
847 static int
848 route_output(struct mbuf *m, struct socket *so, ...)
849 {
850 	struct rt_msghdr *rtm = NULL;
851 	struct rtentry *rt = NULL;
852 	struct rt_addrinfo info;
853 	struct epoch_tracker et;
854 #ifdef INET6
855 	struct sockaddr_storage ss;
856 	struct sockaddr_in6 *sin6;
857 	int i, rti_need_deembed = 0;
858 #endif
859 	int alloc_len = 0, len, error = 0, fibnum;
860 	sa_family_t saf = AF_UNSPEC;
861 	struct walkarg w;
862 
863 	fibnum = so->so_fibnum;
864 
865 #define senderr(e) { error = e; goto flush;}
866 	if (m == NULL || ((m->m_len < sizeof(long)) &&
867 		       (m = m_pullup(m, sizeof(long))) == NULL))
868 		return (ENOBUFS);
869 	if ((m->m_flags & M_PKTHDR) == 0)
870 		panic("route_output");
871 	NET_EPOCH_ENTER(et);
872 	len = m->m_pkthdr.len;
873 	if (len < sizeof(*rtm) ||
874 	    len != mtod(m, struct rt_msghdr *)->rtm_msglen)
875 		senderr(EINVAL);
876 
877 	/*
878 	 * Most of current messages are in range 200-240 bytes,
879 	 * minimize possible re-allocation on reply using larger size
880 	 * buffer aligned on 1k boundaty.
881 	 */
882 	alloc_len = roundup2(len, 1024);
883 	if ((rtm = malloc(alloc_len, M_TEMP, M_NOWAIT)) == NULL)
884 		senderr(ENOBUFS);
885 
886 	m_copydata(m, 0, len, (caddr_t)rtm);
887 	bzero(&info, sizeof(info));
888 	bzero(&w, sizeof(w));
889 
890 	if (rtm->rtm_version != RTM_VERSION) {
891 		/* Do not touch message since format is unknown */
892 		free(rtm, M_TEMP);
893 		rtm = NULL;
894 		senderr(EPROTONOSUPPORT);
895 	}
896 
897 	/*
898 	 * Starting from here, it is possible
899 	 * to alter original message and insert
900 	 * caller PID and error value.
901 	 */
902 
903 	if ((error = fill_addrinfo(rtm, len, fibnum, &info)) != 0) {
904 		senderr(error);
905 	}
906 
907 	saf = info.rti_info[RTAX_DST]->sa_family;
908 
909 	/* support for new ARP code */
910 	if (rtm->rtm_flags & RTF_LLDATA) {
911 		error = lla_rt_output(rtm, &info);
912 #ifdef INET6
913 		if (error == 0)
914 			rti_need_deembed = (V_deembed_scopeid) ? 1 : 0;
915 #endif
916 		goto flush;
917 	}
918 
919 	switch (rtm->rtm_type) {
920 		struct rtentry *saved_nrt;
921 
922 	case RTM_ADD:
923 	case RTM_CHANGE:
924 		if (rtm->rtm_type == RTM_ADD) {
925 			if (info.rti_info[RTAX_GATEWAY] == NULL)
926 				senderr(EINVAL);
927 		}
928 		saved_nrt = NULL;
929 		error = rtrequest1_fib(rtm->rtm_type, &info, &saved_nrt,
930 		    fibnum);
931 		if (error == 0 && saved_nrt != NULL) {
932 #ifdef INET6
933 			rti_need_deembed = (V_deembed_scopeid) ? 1 : 0;
934 #endif
935 			RT_LOCK(saved_nrt);
936 			rtm->rtm_index = saved_nrt->rt_ifp->if_index;
937 			RT_REMREF(saved_nrt);
938 			RT_UNLOCK(saved_nrt);
939 		}
940 		break;
941 
942 	case RTM_DELETE:
943 		saved_nrt = NULL;
944 		error = rtrequest1_fib(RTM_DELETE, &info, &saved_nrt, fibnum);
945 		if (error == 0) {
946 			RT_LOCK(saved_nrt);
947 			rt = saved_nrt;
948 			goto report;
949 		}
950 #ifdef INET6
951 		/* rt_msg2() will not be used when RTM_DELETE fails. */
952 		rti_need_deembed = (V_deembed_scopeid) ? 1 : 0;
953 #endif
954 		break;
955 
956 	case RTM_GET:
957 		error = handle_rtm_get(&info, fibnum, rtm, &rt);
958 		if (error != 0)
959 			senderr(error);
960 
961 report:
962 		RT_LOCK_ASSERT(rt);
963 		if (!can_export_rte(curthread->td_ucred, rt)) {
964 			RT_UNLOCK(rt);
965 			senderr(ESRCH);
966 		}
967 		error = update_rtm_from_rte(&info, &rtm, alloc_len, rt);
968 		/*
969 		 * Note that some sockaddr pointers may have changed to
970 		 * point to memory outsize @rtm. Some may be pointing
971 		 * to the on-stack variables.
972 		 * Given that, any pointer in @info CANNOT BE USED.
973 		 */
974 
975 		/*
976 		 * scopeid deembedding has been performed while
977 		 * writing updated rtm in rtsock_msg_buffer().
978 		 * With that in mind, skip deembedding procedure below.
979 		 */
980 #ifdef INET6
981 		rti_need_deembed = 0;
982 #endif
983 		RT_UNLOCK(rt);
984 		if (error != 0)
985 			senderr(error);
986 		break;
987 
988 	default:
989 		senderr(EOPNOTSUPP);
990 	}
991 
992 flush:
993 	NET_EPOCH_EXIT(et);
994 	if (rt != NULL)
995 		RTFREE(rt);
996 
997 #ifdef INET6
998 	if (rtm != NULL) {
999 		if (rti_need_deembed) {
1000 			/* sin6_scope_id is recovered before sending rtm. */
1001 			sin6 = (struct sockaddr_in6 *)&ss;
1002 			for (i = 0; i < RTAX_MAX; i++) {
1003 				if (info.rti_info[i] == NULL)
1004 					continue;
1005 				if (info.rti_info[i]->sa_family != AF_INET6)
1006 					continue;
1007 				bcopy(info.rti_info[i], sin6, sizeof(*sin6));
1008 				if (sa6_recoverscope(sin6) == 0)
1009 					bcopy(sin6, info.rti_info[i],
1010 						    sizeof(*sin6));
1011 			}
1012 		}
1013 	}
1014 #endif
1015 	send_rtm_reply(so, rtm, m, saf, fibnum, error);
1016 
1017 	return (error);
1018 }
1019 
1020 /*
1021  * Sends the prepared reply message in @rtm to all rtsock clients.
1022  * Frees @m and @rtm.
1023  *
1024  */
1025 static void
1026 send_rtm_reply(struct socket *so, struct rt_msghdr *rtm, struct mbuf *m,
1027     sa_family_t saf, u_int fibnum, int rtm_errno)
1028 {
1029 	struct rawcb *rp = NULL;
1030 
1031 	/*
1032 	 * Check to see if we don't want our own messages.
1033 	 */
1034 	if ((so->so_options & SO_USELOOPBACK) == 0) {
1035 		if (V_route_cb.any_count <= 1) {
1036 			if (rtm != NULL)
1037 				free(rtm, M_TEMP);
1038 			m_freem(m);
1039 			return;
1040 		}
1041 		/* There is another listener, so construct message */
1042 		rp = sotorawcb(so);
1043 	}
1044 
1045 	if (rtm != NULL) {
1046 		if (rtm_errno!= 0)
1047 			rtm->rtm_errno = rtm_errno;
1048 		else
1049 			rtm->rtm_flags |= RTF_DONE;
1050 
1051 		m_copyback(m, 0, rtm->rtm_msglen, (caddr_t)rtm);
1052 		if (m->m_pkthdr.len < rtm->rtm_msglen) {
1053 			m_freem(m);
1054 			m = NULL;
1055 		} else if (m->m_pkthdr.len > rtm->rtm_msglen)
1056 			m_adj(m, rtm->rtm_msglen - m->m_pkthdr.len);
1057 
1058 		free(rtm, M_TEMP);
1059 	}
1060 	if (m != NULL) {
1061 		M_SETFIB(m, fibnum);
1062 		m->m_flags |= RTS_FILTER_FIB;
1063 		if (rp) {
1064 			/*
1065 			 * XXX insure we don't get a copy by
1066 			 * invalidating our protocol
1067 			 */
1068 			unsigned short family = rp->rcb_proto.sp_family;
1069 			rp->rcb_proto.sp_family = 0;
1070 			rt_dispatch(m, saf);
1071 			rp->rcb_proto.sp_family = family;
1072 		} else
1073 			rt_dispatch(m, saf);
1074 	}
1075 }
1076 
1077 
1078 static void
1079 rt_getmetrics(const struct rtentry *rt, struct rt_metrics *out)
1080 {
1081 
1082 	bzero(out, sizeof(*out));
1083 	out->rmx_mtu = rt->rt_nhop->nh_mtu;
1084 	out->rmx_weight = rt->rt_weight;
1085 	out->rmx_pksent = counter_u64_fetch(rt->rt_pksent);
1086 	out->rmx_nhidx = nhop_get_idx(rt->rt_nhop);
1087 	/* Kernel -> userland timebase conversion. */
1088 	out->rmx_expire = rt->rt_expire ?
1089 	    rt->rt_expire - time_uptime + time_second : 0;
1090 }
1091 
1092 /*
1093  * Extract the addresses of the passed sockaddrs.
1094  * Do a little sanity checking so as to avoid bad memory references.
1095  * This data is derived straight from userland.
1096  */
1097 static int
1098 rt_xaddrs(caddr_t cp, caddr_t cplim, struct rt_addrinfo *rtinfo)
1099 {
1100 	struct sockaddr *sa;
1101 	int i;
1102 
1103 	for (i = 0; i < RTAX_MAX && cp < cplim; i++) {
1104 		if ((rtinfo->rti_addrs & (1 << i)) == 0)
1105 			continue;
1106 		sa = (struct sockaddr *)cp;
1107 		/*
1108 		 * It won't fit.
1109 		 */
1110 		if (cp + sa->sa_len > cplim)
1111 			return (EINVAL);
1112 		/*
1113 		 * there are no more.. quit now
1114 		 * If there are more bits, they are in error.
1115 		 * I've seen this. route(1) can evidently generate these.
1116 		 * This causes kernel to core dump.
1117 		 * for compatibility, If we see this, point to a safe address.
1118 		 */
1119 		if (sa->sa_len == 0) {
1120 			rtinfo->rti_info[i] = &sa_zero;
1121 			return (0); /* should be EINVAL but for compat */
1122 		}
1123 		/* accept it */
1124 #ifdef INET6
1125 		if (sa->sa_family == AF_INET6)
1126 			sa6_embedscope((struct sockaddr_in6 *)sa,
1127 			    V_ip6_use_defzone);
1128 #endif
1129 		rtinfo->rti_info[i] = sa;
1130 		cp += SA_SIZE(sa);
1131 	}
1132 	return (0);
1133 }
1134 
1135 /*
1136  * Fill in @dmask with valid netmask leaving original @smask
1137  * intact. Mostly used with radix netmasks.
1138  */
1139 static struct sockaddr *
1140 rtsock_fix_netmask(struct sockaddr *dst, struct sockaddr *smask,
1141     struct sockaddr_storage *dmask)
1142 {
1143 	if (dst == NULL || smask == NULL)
1144 		return (NULL);
1145 
1146 	memset(dmask, 0, dst->sa_len);
1147 	memcpy(dmask, smask, smask->sa_len);
1148 	dmask->ss_len = dst->sa_len;
1149 	dmask->ss_family = dst->sa_family;
1150 
1151 	return ((struct sockaddr *)dmask);
1152 }
1153 
1154 /*
1155  * Writes information related to @rtinfo object to newly-allocated mbuf.
1156  * Assumes MCLBYTES is enough to construct any message.
1157  * Used for OS notifications of vaious events (if/ifa announces,etc)
1158  *
1159  * Returns allocated mbuf or NULL on failure.
1160  */
1161 static struct mbuf *
1162 rtsock_msg_mbuf(int type, struct rt_addrinfo *rtinfo)
1163 {
1164 	struct rt_msghdr *rtm;
1165 	struct mbuf *m;
1166 	int i;
1167 	struct sockaddr *sa;
1168 #ifdef INET6
1169 	struct sockaddr_storage ss;
1170 	struct sockaddr_in6 *sin6;
1171 #endif
1172 	int len, dlen;
1173 
1174 	switch (type) {
1175 
1176 	case RTM_DELADDR:
1177 	case RTM_NEWADDR:
1178 		len = sizeof(struct ifa_msghdr);
1179 		break;
1180 
1181 	case RTM_DELMADDR:
1182 	case RTM_NEWMADDR:
1183 		len = sizeof(struct ifma_msghdr);
1184 		break;
1185 
1186 	case RTM_IFINFO:
1187 		len = sizeof(struct if_msghdr);
1188 		break;
1189 
1190 	case RTM_IFANNOUNCE:
1191 	case RTM_IEEE80211:
1192 		len = sizeof(struct if_announcemsghdr);
1193 		break;
1194 
1195 	default:
1196 		len = sizeof(struct rt_msghdr);
1197 	}
1198 
1199 	/* XXXGL: can we use MJUMPAGESIZE cluster here? */
1200 	KASSERT(len <= MCLBYTES, ("%s: message too big", __func__));
1201 	if (len > MHLEN)
1202 		m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
1203 	else
1204 		m = m_gethdr(M_NOWAIT, MT_DATA);
1205 	if (m == NULL)
1206 		return (m);
1207 
1208 	m->m_pkthdr.len = m->m_len = len;
1209 	rtm = mtod(m, struct rt_msghdr *);
1210 	bzero((caddr_t)rtm, len);
1211 	for (i = 0; i < RTAX_MAX; i++) {
1212 		if ((sa = rtinfo->rti_info[i]) == NULL)
1213 			continue;
1214 		rtinfo->rti_addrs |= (1 << i);
1215 		dlen = SA_SIZE(sa);
1216 #ifdef INET6
1217 		if (V_deembed_scopeid && sa->sa_family == AF_INET6) {
1218 			sin6 = (struct sockaddr_in6 *)&ss;
1219 			bcopy(sa, sin6, sizeof(*sin6));
1220 			if (sa6_recoverscope(sin6) == 0)
1221 				sa = (struct sockaddr *)sin6;
1222 		}
1223 #endif
1224 		m_copyback(m, len, dlen, (caddr_t)sa);
1225 		len += dlen;
1226 	}
1227 	if (m->m_pkthdr.len != len) {
1228 		m_freem(m);
1229 		return (NULL);
1230 	}
1231 	rtm->rtm_msglen = len;
1232 	rtm->rtm_version = RTM_VERSION;
1233 	rtm->rtm_type = type;
1234 	return (m);
1235 }
1236 
1237 /*
1238  * Writes information related to @rtinfo object to preallocated buffer.
1239  * Stores needed size in @plen. If @w is NULL, calculates size without
1240  * writing.
1241  * Used for sysctl dumps and rtsock answers (RTM_DEL/RTM_GET) generation.
1242  *
1243  * Returns 0 on success.
1244  *
1245  */
1246 static int
1247 rtsock_msg_buffer(int type, struct rt_addrinfo *rtinfo, struct walkarg *w, int *plen)
1248 {
1249 	int i;
1250 	int len, buflen = 0, dlen;
1251 	caddr_t cp = NULL;
1252 	struct rt_msghdr *rtm = NULL;
1253 #ifdef INET6
1254 	struct sockaddr_storage ss;
1255 	struct sockaddr_in6 *sin6;
1256 #endif
1257 #ifdef COMPAT_FREEBSD32
1258 	bool compat32 = false;
1259 #endif
1260 
1261 	switch (type) {
1262 
1263 	case RTM_DELADDR:
1264 	case RTM_NEWADDR:
1265 		if (w != NULL && w->w_op == NET_RT_IFLISTL) {
1266 #ifdef COMPAT_FREEBSD32
1267 			if (w->w_req->flags & SCTL_MASK32) {
1268 				len = sizeof(struct ifa_msghdrl32);
1269 				compat32 = true;
1270 			} else
1271 #endif
1272 				len = sizeof(struct ifa_msghdrl);
1273 		} else
1274 			len = sizeof(struct ifa_msghdr);
1275 		break;
1276 
1277 	case RTM_IFINFO:
1278 #ifdef COMPAT_FREEBSD32
1279 		if (w != NULL && w->w_req->flags & SCTL_MASK32) {
1280 			if (w->w_op == NET_RT_IFLISTL)
1281 				len = sizeof(struct if_msghdrl32);
1282 			else
1283 				len = sizeof(struct if_msghdr32);
1284 			compat32 = true;
1285 			break;
1286 		}
1287 #endif
1288 		if (w != NULL && w->w_op == NET_RT_IFLISTL)
1289 			len = sizeof(struct if_msghdrl);
1290 		else
1291 			len = sizeof(struct if_msghdr);
1292 		break;
1293 
1294 	case RTM_NEWMADDR:
1295 		len = sizeof(struct ifma_msghdr);
1296 		break;
1297 
1298 	default:
1299 		len = sizeof(struct rt_msghdr);
1300 	}
1301 
1302 	if (w != NULL) {
1303 		rtm = (struct rt_msghdr *)w->w_tmem;
1304 		buflen = w->w_tmemsize - len;
1305 		cp = (caddr_t)w->w_tmem + len;
1306 	}
1307 
1308 	rtinfo->rti_addrs = 0;
1309 	for (i = 0; i < RTAX_MAX; i++) {
1310 		struct sockaddr *sa;
1311 
1312 		if ((sa = rtinfo->rti_info[i]) == NULL)
1313 			continue;
1314 		rtinfo->rti_addrs |= (1 << i);
1315 #ifdef COMPAT_FREEBSD32
1316 		if (compat32)
1317 			dlen = SA_SIZE32(sa);
1318 		else
1319 #endif
1320 			dlen = SA_SIZE(sa);
1321 		if (cp != NULL && buflen >= dlen) {
1322 #ifdef INET6
1323 			if (V_deembed_scopeid && sa->sa_family == AF_INET6) {
1324 				sin6 = (struct sockaddr_in6 *)&ss;
1325 				bcopy(sa, sin6, sizeof(*sin6));
1326 				if (sa6_recoverscope(sin6) == 0)
1327 					sa = (struct sockaddr *)sin6;
1328 			}
1329 #endif
1330 			bcopy((caddr_t)sa, cp, (unsigned)dlen);
1331 			cp += dlen;
1332 			buflen -= dlen;
1333 		} else if (cp != NULL) {
1334 			/*
1335 			 * Buffer too small. Count needed size
1336 			 * and return with error.
1337 			 */
1338 			cp = NULL;
1339 		}
1340 
1341 		len += dlen;
1342 	}
1343 
1344 	if (cp != NULL) {
1345 		dlen = ALIGN(len) - len;
1346 		if (buflen < dlen)
1347 			cp = NULL;
1348 		else {
1349 			bzero(cp, dlen);
1350 			cp += dlen;
1351 			buflen -= dlen;
1352 		}
1353 	}
1354 	len = ALIGN(len);
1355 
1356 	if (cp != NULL) {
1357 		/* fill header iff buffer is large enough */
1358 		rtm->rtm_version = RTM_VERSION;
1359 		rtm->rtm_type = type;
1360 		rtm->rtm_msglen = len;
1361 	}
1362 
1363 	*plen = len;
1364 
1365 	if (w != NULL && cp == NULL)
1366 		return (ENOBUFS);
1367 
1368 	return (0);
1369 }
1370 
1371 /*
1372  * This routine is called to generate a message from the routing
1373  * socket indicating that a redirect has occurred, a routing lookup
1374  * has failed, or that a protocol has detected timeouts to a particular
1375  * destination.
1376  */
1377 void
1378 rt_missmsg_fib(int type, struct rt_addrinfo *rtinfo, int flags, int error,
1379     int fibnum)
1380 {
1381 	struct rt_msghdr *rtm;
1382 	struct mbuf *m;
1383 	struct sockaddr *sa = rtinfo->rti_info[RTAX_DST];
1384 
1385 	if (V_route_cb.any_count == 0)
1386 		return;
1387 	m = rtsock_msg_mbuf(type, rtinfo);
1388 	if (m == NULL)
1389 		return;
1390 
1391 	if (fibnum != RT_ALL_FIBS) {
1392 		KASSERT(fibnum >= 0 && fibnum < rt_numfibs, ("%s: fibnum out "
1393 		    "of range 0 <= %d < %d", __func__, fibnum, rt_numfibs));
1394 		M_SETFIB(m, fibnum);
1395 		m->m_flags |= RTS_FILTER_FIB;
1396 	}
1397 
1398 	rtm = mtod(m, struct rt_msghdr *);
1399 	rtm->rtm_flags = RTF_DONE | flags;
1400 	rtm->rtm_errno = error;
1401 	rtm->rtm_addrs = rtinfo->rti_addrs;
1402 	rt_dispatch(m, sa ? sa->sa_family : AF_UNSPEC);
1403 }
1404 
1405 void
1406 rt_missmsg(int type, struct rt_addrinfo *rtinfo, int flags, int error)
1407 {
1408 
1409 	rt_missmsg_fib(type, rtinfo, flags, error, RT_ALL_FIBS);
1410 }
1411 
1412 /*
1413  * This routine is called to generate a message from the routing
1414  * socket indicating that the status of a network interface has changed.
1415  */
1416 void
1417 rt_ifmsg(struct ifnet *ifp)
1418 {
1419 	struct if_msghdr *ifm;
1420 	struct mbuf *m;
1421 	struct rt_addrinfo info;
1422 
1423 	if (V_route_cb.any_count == 0)
1424 		return;
1425 	bzero((caddr_t)&info, sizeof(info));
1426 	m = rtsock_msg_mbuf(RTM_IFINFO, &info);
1427 	if (m == NULL)
1428 		return;
1429 	ifm = mtod(m, struct if_msghdr *);
1430 	ifm->ifm_index = ifp->if_index;
1431 	ifm->ifm_flags = ifp->if_flags | ifp->if_drv_flags;
1432 	if_data_copy(ifp, &ifm->ifm_data);
1433 	ifm->ifm_addrs = 0;
1434 	rt_dispatch(m, AF_UNSPEC);
1435 }
1436 
1437 /*
1438  * Announce interface address arrival/withdraw.
1439  * Please do not call directly, use rt_addrmsg().
1440  * Assume input data to be valid.
1441  * Returns 0 on success.
1442  */
1443 int
1444 rtsock_addrmsg(int cmd, struct ifaddr *ifa, int fibnum)
1445 {
1446 	struct rt_addrinfo info;
1447 	struct sockaddr *sa;
1448 	int ncmd;
1449 	struct mbuf *m;
1450 	struct ifa_msghdr *ifam;
1451 	struct ifnet *ifp = ifa->ifa_ifp;
1452 	struct sockaddr_storage ss;
1453 
1454 	if (V_route_cb.any_count == 0)
1455 		return (0);
1456 
1457 	ncmd = cmd == RTM_ADD ? RTM_NEWADDR : RTM_DELADDR;
1458 
1459 	bzero((caddr_t)&info, sizeof(info));
1460 	info.rti_info[RTAX_IFA] = sa = ifa->ifa_addr;
1461 	info.rti_info[RTAX_IFP] = ifp->if_addr->ifa_addr;
1462 	info.rti_info[RTAX_NETMASK] = rtsock_fix_netmask(
1463 	    info.rti_info[RTAX_IFA], ifa->ifa_netmask, &ss);
1464 	info.rti_info[RTAX_BRD] = ifa->ifa_dstaddr;
1465 	if ((m = rtsock_msg_mbuf(ncmd, &info)) == NULL)
1466 		return (ENOBUFS);
1467 	ifam = mtod(m, struct ifa_msghdr *);
1468 	ifam->ifam_index = ifp->if_index;
1469 	ifam->ifam_metric = ifa->ifa_ifp->if_metric;
1470 	ifam->ifam_flags = ifa->ifa_flags;
1471 	ifam->ifam_addrs = info.rti_addrs;
1472 
1473 	if (fibnum != RT_ALL_FIBS) {
1474 		M_SETFIB(m, fibnum);
1475 		m->m_flags |= RTS_FILTER_FIB;
1476 	}
1477 
1478 	rt_dispatch(m, sa ? sa->sa_family : AF_UNSPEC);
1479 
1480 	return (0);
1481 }
1482 
1483 /*
1484  * Announce route addition/removal to rtsock based on @rt data.
1485  * Callers are advives to use rt_routemsg() instead of using this
1486  *  function directly.
1487  * Assume @rt data is consistent.
1488  *
1489  * Returns 0 on success.
1490  */
1491 int
1492 rtsock_routemsg(int cmd, struct rtentry *rt, struct ifnet *ifp, int rti_addrs,
1493     int fibnum)
1494 {
1495 	struct sockaddr_storage ss;
1496 	struct rt_addrinfo info;
1497 
1498 	if (V_route_cb.any_count == 0)
1499 		return (0);
1500 
1501 	bzero((caddr_t)&info, sizeof(info));
1502 	info.rti_info[RTAX_DST] = rt_key(rt);
1503 	info.rti_info[RTAX_NETMASK] = rtsock_fix_netmask(rt_key(rt), rt_mask(rt), &ss);
1504 	info.rti_info[RTAX_GATEWAY] = &rt->rt_nhop->gw_sa;
1505 	info.rti_flags = rt->rt_flags;
1506 	info.rti_ifp = ifp;
1507 
1508 	return (rtsock_routemsg_info(cmd, &info, fibnum));
1509 }
1510 
1511 int
1512 rtsock_routemsg_info(int cmd, struct rt_addrinfo *info, int fibnum)
1513 {
1514 	struct rt_msghdr *rtm;
1515 	struct sockaddr *sa;
1516 	struct mbuf *m;
1517 
1518 	if (V_route_cb.any_count == 0)
1519 		return (0);
1520 
1521 	if (info->rti_flags & RTF_HOST)
1522 		info->rti_info[RTAX_NETMASK] = NULL;
1523 
1524 	m = rtsock_msg_mbuf(cmd, info);
1525 	if (m == NULL)
1526 		return (ENOBUFS);
1527 
1528 	if (fibnum != RT_ALL_FIBS) {
1529 		KASSERT(fibnum >= 0 && fibnum < rt_numfibs, ("%s: fibnum out "
1530 		    "of range 0 <= %d < %d", __func__, fibnum, rt_numfibs));
1531 		M_SETFIB(m, fibnum);
1532 		m->m_flags |= RTS_FILTER_FIB;
1533 	}
1534 
1535 	rtm = mtod(m, struct rt_msghdr *);
1536 	rtm->rtm_addrs = info->rti_addrs;
1537 	if (info->rti_ifp != NULL)
1538 		rtm->rtm_index = info->rti_ifp->if_index;
1539 	/* Add RTF_DONE to indicate command 'completion' required by API */
1540 	info->rti_flags |= RTF_DONE;
1541 	/* Reported routes has to be up */
1542 	if (cmd == RTM_ADD || cmd == RTM_CHANGE)
1543 		info->rti_flags |= RTF_UP;
1544 	rtm->rtm_flags = info->rti_flags;
1545 
1546 	sa = info->rti_info[RTAX_DST];
1547 	rt_dispatch(m, sa ? sa->sa_family : AF_UNSPEC);
1548 
1549 	return (0);
1550 }
1551 
1552 /*
1553  * This is the analogue to the rt_newaddrmsg which performs the same
1554  * function but for multicast group memberhips.  This is easier since
1555  * there is no route state to worry about.
1556  */
1557 void
1558 rt_newmaddrmsg(int cmd, struct ifmultiaddr *ifma)
1559 {
1560 	struct rt_addrinfo info;
1561 	struct mbuf *m = NULL;
1562 	struct ifnet *ifp = ifma->ifma_ifp;
1563 	struct ifma_msghdr *ifmam;
1564 
1565 	if (V_route_cb.any_count == 0)
1566 		return;
1567 
1568 	bzero((caddr_t)&info, sizeof(info));
1569 	info.rti_info[RTAX_IFA] = ifma->ifma_addr;
1570 	if (ifp && ifp->if_addr)
1571 		info.rti_info[RTAX_IFP] = ifp->if_addr->ifa_addr;
1572 	else
1573 		info.rti_info[RTAX_IFP] = NULL;
1574 	/*
1575 	 * If a link-layer address is present, present it as a ``gateway''
1576 	 * (similarly to how ARP entries, e.g., are presented).
1577 	 */
1578 	info.rti_info[RTAX_GATEWAY] = ifma->ifma_lladdr;
1579 	m = rtsock_msg_mbuf(cmd, &info);
1580 	if (m == NULL)
1581 		return;
1582 	ifmam = mtod(m, struct ifma_msghdr *);
1583 	KASSERT(ifp != NULL, ("%s: link-layer multicast address w/o ifp\n",
1584 	    __func__));
1585 	ifmam->ifmam_index = ifp->if_index;
1586 	ifmam->ifmam_addrs = info.rti_addrs;
1587 	rt_dispatch(m, ifma->ifma_addr ? ifma->ifma_addr->sa_family : AF_UNSPEC);
1588 }
1589 
1590 static struct mbuf *
1591 rt_makeifannouncemsg(struct ifnet *ifp, int type, int what,
1592 	struct rt_addrinfo *info)
1593 {
1594 	struct if_announcemsghdr *ifan;
1595 	struct mbuf *m;
1596 
1597 	if (V_route_cb.any_count == 0)
1598 		return NULL;
1599 	bzero((caddr_t)info, sizeof(*info));
1600 	m = rtsock_msg_mbuf(type, info);
1601 	if (m != NULL) {
1602 		ifan = mtod(m, struct if_announcemsghdr *);
1603 		ifan->ifan_index = ifp->if_index;
1604 		strlcpy(ifan->ifan_name, ifp->if_xname,
1605 			sizeof(ifan->ifan_name));
1606 		ifan->ifan_what = what;
1607 	}
1608 	return m;
1609 }
1610 
1611 /*
1612  * This is called to generate routing socket messages indicating
1613  * IEEE80211 wireless events.
1614  * XXX we piggyback on the RTM_IFANNOUNCE msg format in a clumsy way.
1615  */
1616 void
1617 rt_ieee80211msg(struct ifnet *ifp, int what, void *data, size_t data_len)
1618 {
1619 	struct mbuf *m;
1620 	struct rt_addrinfo info;
1621 
1622 	m = rt_makeifannouncemsg(ifp, RTM_IEEE80211, what, &info);
1623 	if (m != NULL) {
1624 		/*
1625 		 * Append the ieee80211 data.  Try to stick it in the
1626 		 * mbuf containing the ifannounce msg; otherwise allocate
1627 		 * a new mbuf and append.
1628 		 *
1629 		 * NB: we assume m is a single mbuf.
1630 		 */
1631 		if (data_len > M_TRAILINGSPACE(m)) {
1632 			struct mbuf *n = m_get(M_NOWAIT, MT_DATA);
1633 			if (n == NULL) {
1634 				m_freem(m);
1635 				return;
1636 			}
1637 			bcopy(data, mtod(n, void *), data_len);
1638 			n->m_len = data_len;
1639 			m->m_next = n;
1640 		} else if (data_len > 0) {
1641 			bcopy(data, mtod(m, u_int8_t *) + m->m_len, data_len);
1642 			m->m_len += data_len;
1643 		}
1644 		if (m->m_flags & M_PKTHDR)
1645 			m->m_pkthdr.len += data_len;
1646 		mtod(m, struct if_announcemsghdr *)->ifan_msglen += data_len;
1647 		rt_dispatch(m, AF_UNSPEC);
1648 	}
1649 }
1650 
1651 /*
1652  * This is called to generate routing socket messages indicating
1653  * network interface arrival and departure.
1654  */
1655 void
1656 rt_ifannouncemsg(struct ifnet *ifp, int what)
1657 {
1658 	struct mbuf *m;
1659 	struct rt_addrinfo info;
1660 
1661 	m = rt_makeifannouncemsg(ifp, RTM_IFANNOUNCE, what, &info);
1662 	if (m != NULL)
1663 		rt_dispatch(m, AF_UNSPEC);
1664 }
1665 
1666 static void
1667 rt_dispatch(struct mbuf *m, sa_family_t saf)
1668 {
1669 	struct m_tag *tag;
1670 
1671 	/*
1672 	 * Preserve the family from the sockaddr, if any, in an m_tag for
1673 	 * use when injecting the mbuf into the routing socket buffer from
1674 	 * the netisr.
1675 	 */
1676 	if (saf != AF_UNSPEC) {
1677 		tag = m_tag_get(PACKET_TAG_RTSOCKFAM, sizeof(unsigned short),
1678 		    M_NOWAIT);
1679 		if (tag == NULL) {
1680 			m_freem(m);
1681 			return;
1682 		}
1683 		*(unsigned short *)(tag + 1) = saf;
1684 		m_tag_prepend(m, tag);
1685 	}
1686 #ifdef VIMAGE
1687 	if (V_loif)
1688 		m->m_pkthdr.rcvif = V_loif;
1689 	else {
1690 		m_freem(m);
1691 		return;
1692 	}
1693 #endif
1694 	netisr_queue(NETISR_ROUTE, m);	/* mbuf is free'd on failure. */
1695 }
1696 
1697 /*
1698  * Checks if rte can be exported v.r.t jails/vnets.
1699  *
1700  * Returns 1 if it can, 0 otherwise.
1701  */
1702 static int
1703 can_export_rte(struct ucred *td_ucred, const struct rtentry *rt)
1704 {
1705 
1706 	if ((rt->rt_flags & RTF_HOST) == 0
1707 	    ? jailed_without_vnet(td_ucred)
1708 	    : prison_if(td_ucred, rt_key_const(rt)) != 0)
1709 		return (0);
1710 	return (1);
1711 }
1712 
1713 /*
1714  * This is used in dumping the kernel table via sysctl().
1715  */
1716 static int
1717 sysctl_dumpentry(struct radix_node *rn, void *vw)
1718 {
1719 	struct walkarg *w = vw;
1720 	struct rtentry *rt = (struct rtentry *)rn;
1721 	int error = 0, size;
1722 	struct rt_addrinfo info;
1723 	struct sockaddr_storage ss;
1724 
1725 	NET_EPOCH_ASSERT();
1726 
1727 	if (w->w_op == NET_RT_FLAGS && !(rt->rt_flags & w->w_arg))
1728 		return 0;
1729 	if (!can_export_rte(w->w_req->td->td_ucred, rt))
1730 		return (0);
1731 	bzero((caddr_t)&info, sizeof(info));
1732 	info.rti_info[RTAX_DST] = rt_key(rt);
1733 	info.rti_info[RTAX_GATEWAY] = &rt->rt_nhop->gw_sa;
1734 	info.rti_info[RTAX_NETMASK] = rtsock_fix_netmask(rt_key(rt),
1735 	    rt_mask(rt), &ss);
1736 	info.rti_info[RTAX_GENMASK] = 0;
1737 	if (rt->rt_ifp && !(rt->rt_ifp->if_flags & IFF_DYING)) {
1738 		info.rti_info[RTAX_IFP] = rt->rt_ifp->if_addr->ifa_addr;
1739 		info.rti_info[RTAX_IFA] = rt->rt_ifa->ifa_addr;
1740 		if (rt->rt_ifp->if_flags & IFF_POINTOPOINT)
1741 			info.rti_info[RTAX_BRD] = rt->rt_ifa->ifa_dstaddr;
1742 	}
1743 	if ((error = rtsock_msg_buffer(RTM_GET, &info, w, &size)) != 0)
1744 		return (error);
1745 	if (w->w_req && w->w_tmem) {
1746 		struct rt_msghdr *rtm = (struct rt_msghdr *)w->w_tmem;
1747 
1748 		bzero(&rtm->rtm_index,
1749 		    sizeof(*rtm) - offsetof(struct rt_msghdr, rtm_index));
1750 		if (rt->rt_flags & RTF_GWFLAG_COMPAT)
1751 			rtm->rtm_flags = RTF_GATEWAY |
1752 				(rt->rt_flags & ~RTF_GWFLAG_COMPAT);
1753 		else
1754 			rtm->rtm_flags = rt->rt_flags;
1755 		rt_getmetrics(rt, &rtm->rtm_rmx);
1756 		rtm->rtm_index = rt->rt_ifp->if_index;
1757 		rtm->rtm_addrs = info.rti_addrs;
1758 		error = SYSCTL_OUT(w->w_req, (caddr_t)rtm, size);
1759 		return (error);
1760 	}
1761 	return (error);
1762 }
1763 
1764 static int
1765 sysctl_iflist_ifml(struct ifnet *ifp, const struct if_data *src_ifd,
1766     struct rt_addrinfo *info, struct walkarg *w, int len)
1767 {
1768 	struct if_msghdrl *ifm;
1769 	struct if_data *ifd;
1770 
1771 	ifm = (struct if_msghdrl *)w->w_tmem;
1772 
1773 #ifdef COMPAT_FREEBSD32
1774 	if (w->w_req->flags & SCTL_MASK32) {
1775 		struct if_msghdrl32 *ifm32;
1776 
1777 		ifm32 = (struct if_msghdrl32 *)ifm;
1778 		ifm32->ifm_addrs = info->rti_addrs;
1779 		ifm32->ifm_flags = ifp->if_flags | ifp->if_drv_flags;
1780 		ifm32->ifm_index = ifp->if_index;
1781 		ifm32->_ifm_spare1 = 0;
1782 		ifm32->ifm_len = sizeof(*ifm32);
1783 		ifm32->ifm_data_off = offsetof(struct if_msghdrl32, ifm_data);
1784 		ifm32->_ifm_spare2 = 0;
1785 		ifd = &ifm32->ifm_data;
1786 	} else
1787 #endif
1788 	{
1789 		ifm->ifm_addrs = info->rti_addrs;
1790 		ifm->ifm_flags = ifp->if_flags | ifp->if_drv_flags;
1791 		ifm->ifm_index = ifp->if_index;
1792 		ifm->_ifm_spare1 = 0;
1793 		ifm->ifm_len = sizeof(*ifm);
1794 		ifm->ifm_data_off = offsetof(struct if_msghdrl, ifm_data);
1795 		ifm->_ifm_spare2 = 0;
1796 		ifd = &ifm->ifm_data;
1797 	}
1798 
1799 	memcpy(ifd, src_ifd, sizeof(*ifd));
1800 
1801 	return (SYSCTL_OUT(w->w_req, (caddr_t)ifm, len));
1802 }
1803 
1804 static int
1805 sysctl_iflist_ifm(struct ifnet *ifp, const struct if_data *src_ifd,
1806     struct rt_addrinfo *info, struct walkarg *w, int len)
1807 {
1808 	struct if_msghdr *ifm;
1809 	struct if_data *ifd;
1810 
1811 	ifm = (struct if_msghdr *)w->w_tmem;
1812 
1813 #ifdef COMPAT_FREEBSD32
1814 	if (w->w_req->flags & SCTL_MASK32) {
1815 		struct if_msghdr32 *ifm32;
1816 
1817 		ifm32 = (struct if_msghdr32 *)ifm;
1818 		ifm32->ifm_addrs = info->rti_addrs;
1819 		ifm32->ifm_flags = ifp->if_flags | ifp->if_drv_flags;
1820 		ifm32->ifm_index = ifp->if_index;
1821 		ifm32->_ifm_spare1 = 0;
1822 		ifd = &ifm32->ifm_data;
1823 	} else
1824 #endif
1825 	{
1826 		ifm->ifm_addrs = info->rti_addrs;
1827 		ifm->ifm_flags = ifp->if_flags | ifp->if_drv_flags;
1828 		ifm->ifm_index = ifp->if_index;
1829 		ifm->_ifm_spare1 = 0;
1830 		ifd = &ifm->ifm_data;
1831 	}
1832 
1833 	memcpy(ifd, src_ifd, sizeof(*ifd));
1834 
1835 	return (SYSCTL_OUT(w->w_req, (caddr_t)ifm, len));
1836 }
1837 
1838 static int
1839 sysctl_iflist_ifaml(struct ifaddr *ifa, struct rt_addrinfo *info,
1840     struct walkarg *w, int len)
1841 {
1842 	struct ifa_msghdrl *ifam;
1843 	struct if_data *ifd;
1844 
1845 	ifam = (struct ifa_msghdrl *)w->w_tmem;
1846 
1847 #ifdef COMPAT_FREEBSD32
1848 	if (w->w_req->flags & SCTL_MASK32) {
1849 		struct ifa_msghdrl32 *ifam32;
1850 
1851 		ifam32 = (struct ifa_msghdrl32 *)ifam;
1852 		ifam32->ifam_addrs = info->rti_addrs;
1853 		ifam32->ifam_flags = ifa->ifa_flags;
1854 		ifam32->ifam_index = ifa->ifa_ifp->if_index;
1855 		ifam32->_ifam_spare1 = 0;
1856 		ifam32->ifam_len = sizeof(*ifam32);
1857 		ifam32->ifam_data_off =
1858 		    offsetof(struct ifa_msghdrl32, ifam_data);
1859 		ifam32->ifam_metric = ifa->ifa_ifp->if_metric;
1860 		ifd = &ifam32->ifam_data;
1861 	} else
1862 #endif
1863 	{
1864 		ifam->ifam_addrs = info->rti_addrs;
1865 		ifam->ifam_flags = ifa->ifa_flags;
1866 		ifam->ifam_index = ifa->ifa_ifp->if_index;
1867 		ifam->_ifam_spare1 = 0;
1868 		ifam->ifam_len = sizeof(*ifam);
1869 		ifam->ifam_data_off = offsetof(struct ifa_msghdrl, ifam_data);
1870 		ifam->ifam_metric = ifa->ifa_ifp->if_metric;
1871 		ifd = &ifam->ifam_data;
1872 	}
1873 
1874 	bzero(ifd, sizeof(*ifd));
1875 	ifd->ifi_datalen = sizeof(struct if_data);
1876 	ifd->ifi_ipackets = counter_u64_fetch(ifa->ifa_ipackets);
1877 	ifd->ifi_opackets = counter_u64_fetch(ifa->ifa_opackets);
1878 	ifd->ifi_ibytes = counter_u64_fetch(ifa->ifa_ibytes);
1879 	ifd->ifi_obytes = counter_u64_fetch(ifa->ifa_obytes);
1880 
1881 	/* Fixup if_data carp(4) vhid. */
1882 	if (carp_get_vhid_p != NULL)
1883 		ifd->ifi_vhid = (*carp_get_vhid_p)(ifa);
1884 
1885 	return (SYSCTL_OUT(w->w_req, w->w_tmem, len));
1886 }
1887 
1888 static int
1889 sysctl_iflist_ifam(struct ifaddr *ifa, struct rt_addrinfo *info,
1890     struct walkarg *w, int len)
1891 {
1892 	struct ifa_msghdr *ifam;
1893 
1894 	ifam = (struct ifa_msghdr *)w->w_tmem;
1895 	ifam->ifam_addrs = info->rti_addrs;
1896 	ifam->ifam_flags = ifa->ifa_flags;
1897 	ifam->ifam_index = ifa->ifa_ifp->if_index;
1898 	ifam->_ifam_spare1 = 0;
1899 	ifam->ifam_metric = ifa->ifa_ifp->if_metric;
1900 
1901 	return (SYSCTL_OUT(w->w_req, w->w_tmem, len));
1902 }
1903 
1904 static int
1905 sysctl_iflist(int af, struct walkarg *w)
1906 {
1907 	struct ifnet *ifp;
1908 	struct ifaddr *ifa;
1909 	struct if_data ifd;
1910 	struct rt_addrinfo info;
1911 	int len, error = 0;
1912 	struct sockaddr_storage ss;
1913 
1914 	bzero((caddr_t)&info, sizeof(info));
1915 	bzero(&ifd, sizeof(ifd));
1916 	CK_STAILQ_FOREACH(ifp, &V_ifnet, if_link) {
1917 		if (w->w_arg && w->w_arg != ifp->if_index)
1918 			continue;
1919 		if_data_copy(ifp, &ifd);
1920 		ifa = ifp->if_addr;
1921 		info.rti_info[RTAX_IFP] = ifa->ifa_addr;
1922 		error = rtsock_msg_buffer(RTM_IFINFO, &info, w, &len);
1923 		if (error != 0)
1924 			goto done;
1925 		info.rti_info[RTAX_IFP] = NULL;
1926 		if (w->w_req && w->w_tmem) {
1927 			if (w->w_op == NET_RT_IFLISTL)
1928 				error = sysctl_iflist_ifml(ifp, &ifd, &info, w,
1929 				    len);
1930 			else
1931 				error = sysctl_iflist_ifm(ifp, &ifd, &info, w,
1932 				    len);
1933 			if (error)
1934 				goto done;
1935 		}
1936 		while ((ifa = CK_STAILQ_NEXT(ifa, ifa_link)) != NULL) {
1937 			if (af && af != ifa->ifa_addr->sa_family)
1938 				continue;
1939 			if (prison_if(w->w_req->td->td_ucred,
1940 			    ifa->ifa_addr) != 0)
1941 				continue;
1942 			info.rti_info[RTAX_IFA] = ifa->ifa_addr;
1943 			info.rti_info[RTAX_NETMASK] = rtsock_fix_netmask(
1944 			    ifa->ifa_addr, ifa->ifa_netmask, &ss);
1945 			info.rti_info[RTAX_BRD] = ifa->ifa_dstaddr;
1946 			error = rtsock_msg_buffer(RTM_NEWADDR, &info, w, &len);
1947 			if (error != 0)
1948 				goto done;
1949 			if (w->w_req && w->w_tmem) {
1950 				if (w->w_op == NET_RT_IFLISTL)
1951 					error = sysctl_iflist_ifaml(ifa, &info,
1952 					    w, len);
1953 				else
1954 					error = sysctl_iflist_ifam(ifa, &info,
1955 					    w, len);
1956 				if (error)
1957 					goto done;
1958 			}
1959 		}
1960 		info.rti_info[RTAX_IFA] = NULL;
1961 		info.rti_info[RTAX_NETMASK] = NULL;
1962 		info.rti_info[RTAX_BRD] = NULL;
1963 	}
1964 done:
1965 	return (error);
1966 }
1967 
1968 static int
1969 sysctl_ifmalist(int af, struct walkarg *w)
1970 {
1971 	struct rt_addrinfo info;
1972 	struct ifaddr *ifa;
1973 	struct ifmultiaddr *ifma;
1974 	struct ifnet *ifp;
1975 	int error, len;
1976 
1977 	NET_EPOCH_ASSERT();
1978 
1979 	error = 0;
1980 	bzero((caddr_t)&info, sizeof(info));
1981 
1982 	CK_STAILQ_FOREACH(ifp, &V_ifnet, if_link) {
1983 		if (w->w_arg && w->w_arg != ifp->if_index)
1984 			continue;
1985 		ifa = ifp->if_addr;
1986 		info.rti_info[RTAX_IFP] = ifa ? ifa->ifa_addr : NULL;
1987 		CK_STAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
1988 			if (af && af != ifma->ifma_addr->sa_family)
1989 				continue;
1990 			if (prison_if(w->w_req->td->td_ucred,
1991 			    ifma->ifma_addr) != 0)
1992 				continue;
1993 			info.rti_info[RTAX_IFA] = ifma->ifma_addr;
1994 			info.rti_info[RTAX_GATEWAY] =
1995 			    (ifma->ifma_addr->sa_family != AF_LINK) ?
1996 			    ifma->ifma_lladdr : NULL;
1997 			error = rtsock_msg_buffer(RTM_NEWMADDR, &info, w, &len);
1998 			if (error != 0)
1999 				break;
2000 			if (w->w_req && w->w_tmem) {
2001 				struct ifma_msghdr *ifmam;
2002 
2003 				ifmam = (struct ifma_msghdr *)w->w_tmem;
2004 				ifmam->ifmam_index = ifma->ifma_ifp->if_index;
2005 				ifmam->ifmam_flags = 0;
2006 				ifmam->ifmam_addrs = info.rti_addrs;
2007 				ifmam->_ifmam_spare1 = 0;
2008 				error = SYSCTL_OUT(w->w_req, w->w_tmem, len);
2009 				if (error != 0)
2010 					break;
2011 			}
2012 		}
2013 		if (error != 0)
2014 			break;
2015 	}
2016 	return (error);
2017 }
2018 
2019 static int
2020 sysctl_rtsock(SYSCTL_HANDLER_ARGS)
2021 {
2022 	RIB_RLOCK_TRACKER;
2023 	struct epoch_tracker et;
2024 	int	*name = (int *)arg1;
2025 	u_int	namelen = arg2;
2026 	struct rib_head *rnh = NULL; /* silence compiler. */
2027 	int	i, lim, error = EINVAL;
2028 	int	fib = 0;
2029 	u_char	af;
2030 	struct	walkarg w;
2031 
2032 	name ++;
2033 	namelen--;
2034 	if (req->newptr)
2035 		return (EPERM);
2036 	if (name[1] == NET_RT_DUMP || name[1] == NET_RT_NHOP) {
2037 		if (namelen == 3)
2038 			fib = req->td->td_proc->p_fibnum;
2039 		else if (namelen == 4)
2040 			fib = (name[3] == RT_ALL_FIBS) ?
2041 			    req->td->td_proc->p_fibnum : name[3];
2042 		else
2043 			return ((namelen < 3) ? EISDIR : ENOTDIR);
2044 		if (fib < 0 || fib >= rt_numfibs)
2045 			return (EINVAL);
2046 	} else if (namelen != 3)
2047 		return ((namelen < 3) ? EISDIR : ENOTDIR);
2048 	af = name[0];
2049 	if (af > AF_MAX)
2050 		return (EINVAL);
2051 	bzero(&w, sizeof(w));
2052 	w.w_op = name[1];
2053 	w.w_arg = name[2];
2054 	w.w_req = req;
2055 
2056 	error = sysctl_wire_old_buffer(req, 0);
2057 	if (error)
2058 		return (error);
2059 
2060 	/*
2061 	 * Allocate reply buffer in advance.
2062 	 * All rtsock messages has maximum length of u_short.
2063 	 */
2064 	w.w_tmemsize = 65536;
2065 	w.w_tmem = malloc(w.w_tmemsize, M_TEMP, M_WAITOK);
2066 
2067 	NET_EPOCH_ENTER(et);
2068 	switch (w.w_op) {
2069 	case NET_RT_DUMP:
2070 	case NET_RT_FLAGS:
2071 		if (af == 0) {			/* dump all tables */
2072 			i = 1;
2073 			lim = AF_MAX;
2074 		} else				/* dump only one table */
2075 			i = lim = af;
2076 
2077 		/*
2078 		 * take care of llinfo entries, the caller must
2079 		 * specify an AF
2080 		 */
2081 		if (w.w_op == NET_RT_FLAGS &&
2082 		    (w.w_arg == 0 || w.w_arg & RTF_LLINFO)) {
2083 			if (af != 0)
2084 				error = lltable_sysctl_dumparp(af, w.w_req);
2085 			else
2086 				error = EINVAL;
2087 			break;
2088 		}
2089 		/*
2090 		 * take care of routing entries
2091 		 */
2092 		for (error = 0; error == 0 && i <= lim; i++) {
2093 			rnh = rt_tables_get_rnh(fib, i);
2094 			if (rnh != NULL) {
2095 				RIB_RLOCK(rnh);
2096 			    	error = rnh->rnh_walktree(&rnh->head,
2097 				    sysctl_dumpentry, &w);
2098 				RIB_RUNLOCK(rnh);
2099 			} else if (af != 0)
2100 				error = EAFNOSUPPORT;
2101 		}
2102 		break;
2103 	case NET_RT_NHOP:
2104 		/* Allow dumping one specific af/fib at a time */
2105 		if (namelen < 4) {
2106 			error = EINVAL;
2107 			break;
2108 		}
2109 		fib = name[3];
2110 		if (fib < 0 || fib > rt_numfibs) {
2111 			error = EINVAL;
2112 			break;
2113 		}
2114 		rnh = rt_tables_get_rnh(fib, af);
2115 		if (rnh == NULL) {
2116 			error = EAFNOSUPPORT;
2117 			break;
2118 		}
2119 		if (w.w_op == NET_RT_NHOP)
2120 			error = nhops_dump_sysctl(rnh, w.w_req);
2121 		break;
2122 	case NET_RT_IFLIST:
2123 	case NET_RT_IFLISTL:
2124 		error = sysctl_iflist(af, &w);
2125 		break;
2126 
2127 	case NET_RT_IFMALIST:
2128 		error = sysctl_ifmalist(af, &w);
2129 		break;
2130 	}
2131 	NET_EPOCH_EXIT(et);
2132 
2133 	free(w.w_tmem, M_TEMP);
2134 	return (error);
2135 }
2136 
2137 static SYSCTL_NODE(_net, PF_ROUTE, routetable, CTLFLAG_RD | CTLFLAG_MPSAFE,
2138     sysctl_rtsock, "Return route tables and interface/address lists");
2139 
2140 /*
2141  * Definitions of protocols supported in the ROUTE domain.
2142  */
2143 
2144 static struct domain routedomain;		/* or at least forward */
2145 
2146 static struct protosw routesw[] = {
2147 {
2148 	.pr_type =		SOCK_RAW,
2149 	.pr_domain =		&routedomain,
2150 	.pr_flags =		PR_ATOMIC|PR_ADDR,
2151 	.pr_output =		route_output,
2152 	.pr_ctlinput =		raw_ctlinput,
2153 	.pr_init =		raw_init,
2154 	.pr_usrreqs =		&route_usrreqs
2155 }
2156 };
2157 
2158 static struct domain routedomain = {
2159 	.dom_family =		PF_ROUTE,
2160 	.dom_name =		 "route",
2161 	.dom_protosw =		routesw,
2162 	.dom_protoswNPROTOSW =	&routesw[nitems(routesw)]
2163 };
2164 
2165 VNET_DOMAIN_SET(route);
2166 
2167 #ifdef DDB
2168 /*
2169  * Unfortunately, RTF_ values are expressed as raw masks rather than powers of
2170  * 2, so we cannot use them as nice C99 initializer indices below.
2171  */
2172 static const char * const rtf_flag_strings[] = {
2173 	"UP",
2174 	"GATEWAY",
2175 	"HOST",
2176 	"REJECT",
2177 	"DYNAMIC",
2178 	"MODIFIED",
2179 	"DONE",
2180 	"UNUSED_0x80",
2181 	"UNUSED_0x100",
2182 	"XRESOLVE",
2183 	"LLDATA",
2184 	"STATIC",
2185 	"BLACKHOLE",
2186 	"UNUSED_0x2000",
2187 	"PROTO2",
2188 	"PROTO1",
2189 	"UNUSED_0x10000",
2190 	"UNUSED_0x20000",
2191 	"PROTO3",
2192 	"FIXEDMTU",
2193 	"PINNED",
2194 	"LOCAL",
2195 	"BROADCAST",
2196 	"MULTICAST",
2197 	/* Big gap. */
2198 	[28] = "STICKY",
2199 	[30] = "RNH_LOCKED",
2200 	[31] = "GWFLAG_COMPAT",
2201 };
2202 
2203 static const char * __pure
2204 rt_flag_name(unsigned idx)
2205 {
2206 	if (idx >= nitems(rtf_flag_strings))
2207 		return ("INVALID_FLAG");
2208 	if (rtf_flag_strings[idx] == NULL)
2209 		return ("UNKNOWN");
2210 	return (rtf_flag_strings[idx]);
2211 }
2212 
2213 static void
2214 rt_dumpaddr_ddb(const char *name, const struct sockaddr *sa)
2215 {
2216 	char buf[INET6_ADDRSTRLEN], *res;
2217 
2218 	res = NULL;
2219 	if (sa == NULL)
2220 		res = "NULL";
2221 	else if (sa->sa_family == AF_INET) {
2222 		res = inet_ntop(AF_INET,
2223 		    &((const struct sockaddr_in *)sa)->sin_addr,
2224 		    buf, sizeof(buf));
2225 	} else if (sa->sa_family == AF_INET6) {
2226 		res = inet_ntop(AF_INET6,
2227 		    &((const struct sockaddr_in6 *)sa)->sin6_addr,
2228 		    buf, sizeof(buf));
2229 	} else if (sa->sa_family == AF_LINK) {
2230 		res = "on link";
2231 	}
2232 
2233 	if (res != NULL) {
2234 		db_printf("%s <%s> ", name, res);
2235 		return;
2236 	}
2237 
2238 	db_printf("%s <af:%d> ", name, sa->sa_family);
2239 }
2240 
2241 static int
2242 rt_dumpentry_ddb(struct radix_node *rn, void *arg __unused)
2243 {
2244 	struct sockaddr_storage ss;
2245 	struct rtentry *rt;
2246 	int flags, idx;
2247 
2248 	/* If RNTORT is important, put it in a header. */
2249 	rt = (void *)rn;
2250 
2251 	rt_dumpaddr_ddb("dst", rt_key(rt));
2252 	rt_dumpaddr_ddb("gateway", &rt->rt_nhop->gw_sa);
2253 	rt_dumpaddr_ddb("netmask", rtsock_fix_netmask(rt_key(rt), rt_mask(rt),
2254 	    &ss));
2255 	if (rt->rt_ifp != NULL && (rt->rt_ifp->if_flags & IFF_DYING) == 0) {
2256 		rt_dumpaddr_ddb("ifp", rt->rt_ifp->if_addr->ifa_addr);
2257 		rt_dumpaddr_ddb("ifa", rt->rt_ifa->ifa_addr);
2258 	}
2259 
2260 	db_printf("flags ");
2261 	flags = rt->rt_flags;
2262 	if (flags == 0)
2263 		db_printf("none");
2264 
2265 	while ((idx = ffs(flags)) > 0) {
2266 		idx--;
2267 
2268 		if (flags != rt->rt_flags)
2269 			db_printf(",");
2270 		db_printf("%s", rt_flag_name(idx));
2271 
2272 		flags &= ~(1ul << idx);
2273 	}
2274 
2275 	db_printf("\n");
2276 	return (0);
2277 }
2278 
2279 DB_SHOW_COMMAND(routetable, db_show_routetable_cmd)
2280 {
2281 	struct rib_head *rnh;
2282 	int error, i, lim;
2283 
2284 	if (have_addr)
2285 		i = lim = addr;
2286 	else {
2287 		i = 1;
2288 		lim = AF_MAX;
2289 	}
2290 
2291 	for (; i <= lim; i++) {
2292 		rnh = rt_tables_get_rnh(0, i);
2293 		if (rnh == NULL) {
2294 			if (have_addr) {
2295 				db_printf("%s: AF %d not supported?\n",
2296 				    __func__, i);
2297 				break;
2298 			}
2299 			continue;
2300 		}
2301 
2302 		if (!have_addr && i > 1)
2303 			db_printf("\n");
2304 
2305 		db_printf("Route table for AF %d%s%s%s:\n", i,
2306 		    (i == AF_INET || i == AF_INET6) ? " (" : "",
2307 		    (i == AF_INET) ? "INET" : (i == AF_INET6) ? "INET6" : "",
2308 		    (i == AF_INET || i == AF_INET6) ? ")" : "");
2309 
2310 		error = rnh->rnh_walktree(&rnh->head, rt_dumpentry_ddb, NULL);
2311 		if (error != 0)
2312 			db_printf("%s: walktree(%d): %d\n", __func__, i,
2313 			    error);
2314 	}
2315 }
2316 
2317 _DB_FUNC(_show, route, db_show_route_cmd, db_show_table, CS_OWN, NULL)
2318 {
2319 	char buf[INET6_ADDRSTRLEN], *bp;
2320 	const void *dst_addrp;
2321 	struct sockaddr *dstp;
2322 	struct rtentry *rt;
2323 	union {
2324 		struct sockaddr_in dest_sin;
2325 		struct sockaddr_in6 dest_sin6;
2326 	} u;
2327 	uint16_t hextets[8];
2328 	unsigned i, tets;
2329 	int t, af, exp, tokflags;
2330 
2331 	/*
2332 	 * Undecoded address family.  No double-colon expansion seen yet.
2333 	 */
2334 	af = -1;
2335 	exp = -1;
2336 	/* Assume INET6 to start; we can work back if guess was wrong. */
2337 	tokflags = DRT_WSPACE | DRT_HEX | DRT_HEXADECIMAL;
2338 
2339 	/*
2340 	 * db_command has lexed 'show route' for us.
2341 	 */
2342 	t = db_read_token_flags(tokflags);
2343 	if (t == tWSPACE)
2344 		t = db_read_token_flags(tokflags);
2345 
2346 	/*
2347 	 * tEOL: Just 'show route' isn't a valid mode.
2348 	 * tMINUS: It's either '-h' or some invalid option.  Regardless, usage.
2349 	 */
2350 	if (t == tEOL || t == tMINUS)
2351 		goto usage;
2352 
2353 	db_unread_token(t);
2354 
2355 	tets = nitems(hextets);
2356 
2357 	/*
2358 	 * Each loop iteration, we expect to read one octet (v4) or hextet
2359 	 * (v6), followed by an appropriate field separator ('.' or ':' or
2360 	 * '::').
2361 	 *
2362 	 * At the start of each loop, we're looking for a number (octet or
2363 	 * hextet).
2364 	 *
2365 	 * INET6 addresses have a special case where they may begin with '::'.
2366 	 */
2367 	for (i = 0; i < tets; i++) {
2368 		t = db_read_token_flags(tokflags);
2369 
2370 		if (t == tCOLONCOLON) {
2371 			/* INET6 with leading '::' or invalid. */
2372 			if (i != 0) {
2373 				db_printf("Parse error: unexpected extra "
2374 				    "colons.\n");
2375 				goto exit;
2376 			}
2377 
2378 			af = AF_INET6;
2379 			exp = i;
2380 			hextets[i] = 0;
2381 			continue;
2382 		} else if (t == tNUMBER) {
2383 			/*
2384 			 * Lexer separates out '-' as tMINUS, but make the
2385 			 * assumption explicit here.
2386 			 */
2387 			MPASS(db_tok_number >= 0);
2388 
2389 			if (af == AF_INET && db_tok_number > UINT8_MAX) {
2390 				db_printf("Not a valid v4 octet: %ld\n",
2391 				    (long)db_tok_number);
2392 				goto exit;
2393 			}
2394 			hextets[i] = db_tok_number;
2395 		} else if (t == tEOL) {
2396 			/*
2397 			 * We can only detect the end of an IPv6 address in
2398 			 * compact representation with EOL.
2399 			 */
2400 			if (af != AF_INET6 || exp < 0) {
2401 				db_printf("Parse failed.  Got unexpected EOF "
2402 				    "when the address is not a compact-"
2403 				    "representation IPv6 address.\n");
2404 				goto exit;
2405 			}
2406 			break;
2407 		} else {
2408 			db_printf("Parse failed.  Unexpected token %d.\n", t);
2409 			goto exit;
2410 		}
2411 
2412 		/* Next, look for a separator, if appropriate. */
2413 		if (i == tets - 1)
2414 			continue;
2415 
2416 		t = db_read_token_flags(tokflags);
2417 		if (af < 0) {
2418 			if (t == tCOLON) {
2419 				af = AF_INET6;
2420 				continue;
2421 			}
2422 			if (t == tCOLONCOLON) {
2423 				af = AF_INET6;
2424 				i++;
2425 				hextets[i] = 0;
2426 				exp = i;
2427 				continue;
2428 			}
2429 			if (t == tDOT) {
2430 				unsigned hn, dn;
2431 
2432 				af = AF_INET;
2433 				/* Need to fixup the first parsed number. */
2434 				if (hextets[0] > 0x255 ||
2435 				    (hextets[0] & 0xf0) > 0x90 ||
2436 				    (hextets[0] & 0xf) > 9) {
2437 					db_printf("Not a valid v4 octet: %x\n",
2438 					    hextets[0]);
2439 					goto exit;
2440 				}
2441 
2442 				hn = hextets[0];
2443 				dn = (hn >> 8) * 100 +
2444 				    ((hn >> 4) & 0xf) * 10 +
2445 				    (hn & 0xf);
2446 
2447 				hextets[0] = dn;
2448 
2449 				/* Switch to decimal for remaining octets. */
2450 				tokflags &= ~DRT_RADIX_MASK;
2451 				tokflags |= DRT_DECIMAL;
2452 
2453 				tets = 4;
2454 				continue;
2455 			}
2456 
2457 			db_printf("Parse error.  Unexpected token %d.\n", t);
2458 			goto exit;
2459 		} else if (af == AF_INET) {
2460 			if (t == tDOT)
2461 				continue;
2462 			db_printf("Expected '.' (%d) between octets but got "
2463 			    "(%d).\n", tDOT, t);
2464 			goto exit;
2465 
2466 		} else if (af == AF_INET6) {
2467 			if (t == tCOLON)
2468 				continue;
2469 			if (t == tCOLONCOLON) {
2470 				if (exp < 0) {
2471 					i++;
2472 					hextets[i] = 0;
2473 					exp = i;
2474 					continue;
2475 				}
2476 				db_printf("Got bogus second '::' in v6 "
2477 				    "address.\n");
2478 				goto exit;
2479 			}
2480 			if (t == tEOL) {
2481 				/*
2482 				 * Handle in the earlier part of the loop
2483 				 * because we need to handle trailing :: too.
2484 				 */
2485 				db_unread_token(t);
2486 				continue;
2487 			}
2488 
2489 			db_printf("Expected ':' (%d) or '::' (%d) between "
2490 			    "hextets but got (%d).\n", tCOLON, tCOLONCOLON, t);
2491 			goto exit;
2492 		}
2493 	}
2494 
2495 	/* Check for trailing garbage. */
2496 	if (i == tets) {
2497 		t = db_read_token_flags(tokflags);
2498 		if (t != tEOL) {
2499 			db_printf("Got unexpected garbage after address "
2500 			    "(%d).\n", t);
2501 			goto exit;
2502 		}
2503 	}
2504 
2505 	/*
2506 	 * Need to expand compact INET6 addresses.
2507 	 *
2508 	 * Technically '::' for a single ':0:' is MUST NOT but just in case,
2509 	 * don't bother expanding that form (exp >= 0 && i == tets case).
2510 	 */
2511 	if (af == AF_INET6 && exp >= 0 && i < tets) {
2512 		if (exp + 1 < i) {
2513 			memmove(&hextets[exp + 1 + (nitems(hextets) - i)],
2514 			    &hextets[exp + 1],
2515 			    (i - (exp + 1)) * sizeof(hextets[0]));
2516 		}
2517 		memset(&hextets[exp + 1], 0, (nitems(hextets) - i) *
2518 		    sizeof(hextets[0]));
2519 	}
2520 
2521 	memset(&u, 0, sizeof(u));
2522 	if (af == AF_INET) {
2523 		u.dest_sin.sin_family = AF_INET;
2524 		u.dest_sin.sin_len = sizeof(u.dest_sin);
2525 		u.dest_sin.sin_addr.s_addr = htonl(
2526 		    ((uint32_t)hextets[0] << 24) |
2527 		    ((uint32_t)hextets[1] << 16) |
2528 		    ((uint32_t)hextets[2] << 8) |
2529 		    (uint32_t)hextets[3]);
2530 		dstp = (void *)&u.dest_sin;
2531 		dst_addrp = &u.dest_sin.sin_addr;
2532 	} else if (af == AF_INET6) {
2533 		u.dest_sin6.sin6_family = AF_INET6;
2534 		u.dest_sin6.sin6_len = sizeof(u.dest_sin6);
2535 		for (i = 0; i < nitems(hextets); i++)
2536 			u.dest_sin6.sin6_addr.s6_addr16[i] = htons(hextets[i]);
2537 		dstp = (void *)&u.dest_sin6;
2538 		dst_addrp = &u.dest_sin6.sin6_addr;
2539 	} else {
2540 		MPASS(false);
2541 		/* UNREACHABLE */
2542 		/* Appease Clang false positive: */
2543 		dstp = NULL;
2544 	}
2545 
2546 	bp = inet_ntop(af, dst_addrp, buf, sizeof(buf));
2547 	if (bp != NULL)
2548 		db_printf("Looking up route to destination '%s'\n", bp);
2549 
2550 	CURVNET_SET(vnet0);
2551 	rt = rtalloc1(dstp, 0, RTF_RNH_LOCKED);
2552 	CURVNET_RESTORE();
2553 
2554 	if (rt == NULL) {
2555 		db_printf("Could not get route for that server.\n");
2556 		return;
2557 	}
2558 
2559 	rt_dumpentry_ddb((void *)rt, NULL);
2560 	RTFREE_LOCKED(rt);
2561 
2562 	return;
2563 usage:
2564 	db_printf("Usage: 'show route <address>'\n"
2565 	    "  Currently accepts only dotted-decimal INET or colon-separated\n"
2566 	    "  hextet INET6 addresses.\n");
2567 exit:
2568 	db_skip_to_eol();
2569 }
2570 #endif
2571