The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/net/route.c

Version: -  FREEBSD  -  FREEBSD-13-STABLE  -  FREEBSD-13-0  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  l41  -  OPENBSD  -  linux-2.6  -  MK84  -  PLAN9  -  xnu-8792 
SearchContext: -  none  -  3  -  10 

    1 /*-
    2  * Copyright (c) 1980, 1986, 1991, 1993
    3  *      The Regents of the University of California.  All rights reserved.
    4  *
    5  * Redistribution and use in source and binary forms, with or without
    6  * modification, are permitted provided that the following conditions
    7  * are met:
    8  * 1. Redistributions of source code must retain the above copyright
    9  *    notice, this list of conditions and the following disclaimer.
   10  * 2. Redistributions in binary form must reproduce the above copyright
   11  *    notice, this list of conditions and the following disclaimer in the
   12  *    documentation and/or other materials provided with the distribution.
   13  * 4. Neither the name of the University nor the names of its contributors
   14  *    may be used to endorse or promote products derived from this software
   15  *    without specific prior written permission.
   16  *
   17  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
   18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
   21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
   25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
   27  * SUCH DAMAGE.
   28  *
   29  *      @(#)route.c     8.3.1.1 (Berkeley) 2/23/95
   30  * $FreeBSD: releng/7.4/sys/net/route.c 189029 2009-02-25 11:18:18Z rwatson $
   31  */
   32 /************************************************************************
   33  * Note: In this file a 'fib' is a "forwarding information base"        *
   34  * Which is the new name for an in kernel routing (next hop) table.     *
   35  ***********************************************************************/
   36 
   37 #include "opt_inet.h"
   38 #include "opt_route.h"
   39 #include "opt_mrouting.h"
   40 
   41 #include <sys/param.h>
   42 #include <sys/systm.h>
   43 #include <sys/malloc.h>
   44 #include <sys/mbuf.h>
   45 #include <sys/socket.h>
   46 #include <sys/sysctl.h>
   47 #include <sys/sysproto.h>
   48 #include <sys/proc.h>
   49 #include <sys/domain.h>
   50 #include <sys/kernel.h>
   51 
   52 #include <net/if.h>
   53 #include <net/route.h>
   54 
   55 #include <netinet/in.h>
   56 #include <netinet/ip_mroute.h>
   57 
   58 #include <vm/uma.h>
   59 
   60 #ifndef ROUTETABLES
   61  #define RT_NUMFIBS 1
   62  #define RT_MAXFIBS 1
   63 #else
   64  /* while we use 4 bits in the mbuf flags,
   65   * we are limited to 16
   66   */
   67  #define RT_MAXFIBS 16
   68  #if ROUTETABLES > RT_MAXFIBS
   69   #define RT_NUMFIBS RT_MAXFIBS
   70   #error "ROUTETABLES defined too big"
   71  #else
   72   #if ROUTETABLES == 0
   73    #define RT_NUMFIBS 1
   74   #else
   75    #define RT_NUMFIBS ROUTETABLES
   76   #endif
   77  #endif
   78 #endif
   79 
   80 u_int rt_numfibs = RT_NUMFIBS;
   81 SYSCTL_INT(_net, OID_AUTO, fibs, CTLFLAG_RD, &rt_numfibs, 0, "");
   82 /*
   83  * Allow the boot code to allow LESS than RT_MAXFIBS to be used.
   84  * We can't do more because storage is statically allocated for now.
   85  */
   86 TUNABLE_INT("net.fibs", &rt_numfibs);
   87 
   88 /*
   89  * By default add routes to all fibs for new interfaces.
   90  * Once this is set to 0 then only allocate routes on interface
   91  * changes for the FIB of the caller when adding a new set of addresses
   92  * to an interface.  XXX this is a shotgun aproach to a problem that needs
   93  * a more fine grained solution.. that will come.
   94  */
   95 u_int rt_add_addr_allfibs = 1;
   96 SYSCTL_INT(_net, OID_AUTO, add_addr_allfibs, CTLFLAG_RW,
   97     &rt_add_addr_allfibs, 0, "");
   98 TUNABLE_INT("net.add_addr_allfibs", &rt_add_addr_allfibs);
   99 
  100 static struct rtstat rtstat;
  101 
  102 /* by default only the first 'row' of tables will be accessed. */
  103 /* 
  104  * XXXMRT When we fix netstat, and do this differnetly,
  105  * we can allocate this dynamically. As long as we are keeping
  106  * things backwards compaitble we need to allocate this 
  107  * statically.
  108  */
  109 struct radix_node_head *rt_tables[RT_MAXFIBS][AF_MAX+1];
  110 
  111 static int      rttrash;                /* routes not in table but not freed */
  112 
  113 static void rt_maskedcopy(struct sockaddr *,
  114             struct sockaddr *, struct sockaddr *);
  115 
  116 /* compare two sockaddr structures */
  117 #define sa_equal(a1, a2) (bcmp((a1), (a2), (a1)->sa_len) == 0)
  118 
  119 /*
  120  * Convert a 'struct radix_node *' to a 'struct rtentry *'.
  121  * The operation can be done safely (in this code) because a
  122  * 'struct rtentry' starts with two 'struct radix_node''s, the first
  123  * one representing leaf nodes in the routing tree, which is
  124  * what the code in radix.c passes us as a 'struct radix_node'.
  125  *
  126  * But because there are a lot of assumptions in this conversion,
  127  * do not cast explicitly, but always use the macro below.
  128  */
  129 #define RNTORT(p)       ((struct rtentry *)(p))
  130 
  131 static uma_zone_t rtzone;               /* Routing table UMA zone. */
  132 
  133 #if 0
  134 /* default fib for tunnels to use */
  135 u_int tunnel_fib = 0;
  136 SYSCTL_INT(_net, OID_AUTO, tunnelfib, CTLFLAG_RD, &tunnel_fib, 0, "");
  137 #endif
  138 
  139 /*
  140  * handler for net.my_fibnum
  141  */
  142 static int
  143 sysctl_my_fibnum(SYSCTL_HANDLER_ARGS)
  144 {
  145         int fibnum;
  146         int error;
  147  
  148         fibnum = curthread->td_proc->p_fibnum;
  149         error = sysctl_handle_int(oidp, &fibnum, 0, req);
  150         return (error);
  151 }
  152 
  153 SYSCTL_PROC(_net, OID_AUTO, my_fibnum, CTLTYPE_INT|CTLFLAG_RD,
  154             NULL, 0, &sysctl_my_fibnum, "I", "default FIB of caller");
  155 
  156 static void
  157 route_init(void)
  158 {
  159         int table;
  160         struct domain *dom;
  161         int fam;
  162 
  163         /* whack teh tunable ints into  line. */
  164         if (rt_numfibs > RT_MAXFIBS)
  165                 rt_numfibs = RT_MAXFIBS;
  166         if (rt_numfibs == 0)
  167                 rt_numfibs = 1;
  168         rtzone = uma_zcreate("rtentry", sizeof(struct rtentry), NULL, NULL,
  169             NULL, NULL, UMA_ALIGN_PTR, 0);
  170         rn_init();      /* initialize all zeroes, all ones, mask table */
  171 
  172         for (dom = domains; dom; dom = dom->dom_next) {
  173                 if (dom->dom_rtattach)  {
  174                         for  (table = 0; table < rt_numfibs; table++) {
  175                                 if ( (fam = dom->dom_family) == AF_INET ||
  176                                     table == 0) {
  177                                         /* for now only AF_INET has > 1 table */
  178                                         /* XXX MRT 
  179                                          * rtattach will be also called
  180                                          * from vfs_export.c but the
  181                                          * offset will be 0
  182                                          * (only for AF_INET and AF_INET6
  183                                          * which don't need it anyhow)
  184                                          */
  185                                         dom->dom_rtattach(
  186                                             (void **)&rt_tables[table][fam],
  187                                             dom->dom_rtoffset);
  188                                 } else {
  189                                         break;
  190                                 }
  191                         }
  192                 }
  193         }
  194 }
  195 
  196 #ifndef _SYS_SYSPROTO_H_
  197 struct setfib_args {
  198         int     fibnum;
  199 };
  200 #endif
  201 int
  202 setfib(struct thread *td, struct setfib_args *uap)
  203 {
  204         if (uap->fibnum < 0 || uap->fibnum >= rt_numfibs)
  205                 return EINVAL;
  206         td->td_proc->p_fibnum = uap->fibnum;
  207         return (0);
  208 }
  209 
  210 /*
  211  * Packet routing routines.
  212  */
  213 void
  214 rtalloc(struct route *ro)
  215 {
  216         rtalloc_ign_fib(ro, 0UL, 0);
  217 }
  218 
  219 void
  220 rtalloc_fib(struct route *ro, u_int fibnum)
  221 {
  222         rtalloc_ign_fib(ro, 0UL, fibnum);
  223 }
  224 
  225 void
  226 rtalloc_ign(struct route *ro, u_long ignore)
  227 {
  228         struct rtentry *rt;
  229 
  230         if ((rt = ro->ro_rt) != NULL) {
  231                 if (rt->rt_ifp != NULL && rt->rt_flags & RTF_UP)
  232                         return;
  233                 RTFREE(rt);
  234                 ro->ro_rt = NULL;
  235         }
  236         ro->ro_rt = rtalloc1_fib(&ro->ro_dst, 1, ignore, 0);
  237         if (ro->ro_rt)
  238                 RT_UNLOCK(ro->ro_rt);
  239 }
  240 
  241 void
  242 rtalloc_ign_fib(struct route *ro, u_long ignore, u_int fibnum)
  243 {
  244         struct rtentry *rt;
  245 
  246         if ((rt = ro->ro_rt) != NULL) {
  247                 if (rt->rt_ifp != NULL && rt->rt_flags & RTF_UP)
  248                         return;
  249                 RTFREE(rt);
  250                 ro->ro_rt = NULL;
  251         }
  252         ro->ro_rt = rtalloc1_fib(&ro->ro_dst, 1, ignore, fibnum);
  253         if (ro->ro_rt)
  254                 RT_UNLOCK(ro->ro_rt);
  255 }
  256 
  257 /*
  258  * Look up the route that matches the address given
  259  * Or, at least try.. Create a cloned route if needed.
  260  *
  261  * The returned route, if any, is locked.
  262  */
  263 struct rtentry *
  264 rtalloc1(struct sockaddr *dst, int report, u_long ignflags)
  265 {
  266         return (rtalloc1_fib(dst, report, ignflags, 0));
  267 }
  268 
  269 struct rtentry *
  270 rtalloc1_fib(struct sockaddr *dst, int report, u_long ignflags,
  271                     u_int fibnum)
  272 {
  273         struct radix_node_head *rnh;
  274         struct rtentry *rt;
  275         struct radix_node *rn;
  276         struct rtentry *newrt;
  277         struct rt_addrinfo info;
  278         u_long nflags;
  279         int err = 0, msgtype = RTM_MISS;
  280         int needlock;
  281 
  282         KASSERT((fibnum < rt_numfibs), ("rtalloc1_fib: bad fibnum"));
  283         if (dst->sa_family != AF_INET)  /* Only INET supports > 1 fib now */
  284                 fibnum = 0;
  285         rnh = rt_tables[fibnum][dst->sa_family];
  286         newrt = NULL;
  287         /*
  288          * Look up the address in the table for that Address Family
  289          */
  290         if (rnh == NULL) {
  291                 rtstat.rts_unreach++;
  292                 goto miss2;
  293         }
  294         needlock = !(ignflags & RTF_RNH_LOCKED);
  295         if (needlock)
  296                 RADIX_NODE_HEAD_LOCK(rnh);
  297 #ifdef INVARIANTS
  298         else
  299                 RADIX_NODE_HEAD_LOCK_ASSERT(rnh);
  300 #endif
  301         if ((rn = rnh->rnh_matchaddr(dst, rnh)) &&
  302             (rn->rn_flags & RNF_ROOT) == 0) {
  303                 /*
  304                  * If we find it and it's not the root node, then
  305                  * get a reference on the rtentry associated.
  306                  */
  307                 newrt = rt = RNTORT(rn);
  308                 nflags = rt->rt_flags & ~ignflags;
  309                 if (report && (nflags & RTF_CLONING)) {
  310                         /*
  311                          * We are apparently adding (report = 0 in delete).
  312                          * If it requires that it be cloned, do so.
  313                          * (This implies it wasn't a HOST route.)
  314                          */
  315                         err = rtrequest_fib(RTM_RESOLVE, dst, NULL,
  316                                               NULL, 0, &newrt, fibnum);
  317                         if (err) {
  318                                 /*
  319                                  * If the cloning didn't succeed, maybe
  320                                  * what we have will do. Return that.
  321                                  */
  322                                 newrt = rt;             /* existing route */
  323                                 RT_LOCK(newrt);
  324                                 RT_ADDREF(newrt);
  325                                 goto miss;
  326                         }
  327                         KASSERT(newrt, ("no route and no error"));
  328                         RT_LOCK(newrt);
  329                         if (newrt->rt_flags & RTF_XRESOLVE) {
  330                                 /*
  331                                  * If the new route specifies it be
  332                                  * externally resolved, then go do that.
  333                                  */
  334                                 msgtype = RTM_RESOLVE;
  335                                 goto miss;
  336                         }
  337                         /* Inform listeners of the new route. */
  338                         bzero(&info, sizeof(info));
  339                         info.rti_info[RTAX_DST] = rt_key(newrt);
  340                         info.rti_info[RTAX_NETMASK] = rt_mask(newrt);
  341                         info.rti_info[RTAX_GATEWAY] = newrt->rt_gateway;
  342                         if (newrt->rt_ifp != NULL) {
  343                                 info.rti_info[RTAX_IFP] =
  344                                     newrt->rt_ifp->if_addr->ifa_addr;
  345                                 info.rti_info[RTAX_IFA] = newrt->rt_ifa->ifa_addr;
  346                         }
  347                         rt_missmsg(RTM_ADD, &info, newrt->rt_flags, 0);
  348                 } else {
  349                         KASSERT(rt == newrt, ("locking wrong route"));
  350                         RT_LOCK(newrt);
  351                         RT_ADDREF(newrt);
  352                 }
  353                 if (needlock)
  354                         RADIX_NODE_HEAD_UNLOCK(rnh);
  355         } else {
  356                 /*
  357                  * Either we hit the root or couldn't find any match,
  358                  * Which basically means
  359                  * "caint get there frm here"
  360                  */
  361                 rtstat.rts_unreach++;
  362         miss:
  363                 if (needlock)
  364                         RADIX_NODE_HEAD_UNLOCK(rnh);
  365         miss2:  if (report) {
  366                         /*
  367                          * If required, report the failure to the supervising
  368                          * Authorities.
  369                          * For a delete, this is not an error. (report == 0)
  370                          */
  371                         bzero(&info, sizeof(info));
  372                         info.rti_info[RTAX_DST] = dst;
  373                         rt_missmsg(msgtype, &info, 0, err);
  374                 }
  375         }
  376         if (newrt)
  377                 RT_LOCK_ASSERT(newrt);
  378         return (newrt);
  379 }
  380 
  381 /*
  382  * Remove a reference count from an rtentry.
  383  * If the count gets low enough, take it out of the routing table
  384  */
  385 void
  386 rtfree(struct rtentry *rt)
  387 {
  388         struct radix_node_head *rnh;
  389 
  390         KASSERT(rt != NULL,("%s: NULL rt", __func__));
  391         rnh = rt_tables[rt->rt_fibnum][rt_key(rt)->sa_family];
  392         KASSERT(rnh != NULL,("%s: NULL rnh", __func__));
  393 
  394         RT_LOCK_ASSERT(rt);
  395 
  396         /*
  397          * The callers should use RTFREE_LOCKED() or RTFREE(), so
  398          * we should come here exactly with the last reference.
  399          */
  400         RT_REMREF(rt);
  401         if (rt->rt_refcnt > 0) {
  402                 printf("%s: %p has %lu refs\n", __func__, rt, rt->rt_refcnt);
  403                 goto done;
  404         }
  405 
  406         /*
  407          * On last reference give the "close method" a chance
  408          * to cleanup private state.  This also permits (for
  409          * IPv4 and IPv6) a chance to decide if the routing table
  410          * entry should be purged immediately or at a later time.
  411          * When an immediate purge is to happen the close routine
  412          * typically calls rtexpunge which clears the RTF_UP flag
  413          * on the entry so that the code below reclaims the storage.
  414          */
  415         if (rt->rt_refcnt == 0 && rnh->rnh_close)
  416                 rnh->rnh_close((struct radix_node *)rt, rnh);
  417 
  418         /*
  419          * If we are no longer "up" (and ref == 0)
  420          * then we can free the resources associated
  421          * with the route.
  422          */
  423         if ((rt->rt_flags & RTF_UP) == 0) {
  424                 if (rt->rt_nodes->rn_flags & (RNF_ACTIVE | RNF_ROOT))
  425                         panic("rtfree 2");
  426                 /*
  427                  * the rtentry must have been removed from the routing table
  428                  * so it is represented in rttrash.. remove that now.
  429                  */
  430                 rttrash--;
  431 #ifdef  DIAGNOSTIC
  432                 if (rt->rt_refcnt < 0) {
  433                         printf("rtfree: %p not freed (neg refs)\n", rt);
  434                         goto done;
  435                 }
  436 #endif
  437                 /*
  438                  * release references on items we hold them on..
  439                  * e.g other routes and ifaddrs.
  440                  */
  441                 if (rt->rt_ifa)
  442                         IFAFREE(rt->rt_ifa);
  443                 rt->rt_parent = NULL;           /* NB: no refcnt on parent */
  444 
  445                 /*
  446                  * The key is separatly alloc'd so free it (see rt_setgate()).
  447                  * This also frees the gateway, as they are always malloc'd
  448                  * together.
  449                  */
  450                 Free(rt_key(rt));
  451 
  452                 /*
  453                  * and the rtentry itself of course
  454                  */
  455                 RT_LOCK_DESTROY(rt);
  456                 uma_zfree(rtzone, rt);
  457                 return;
  458         }
  459 done:
  460         RT_UNLOCK(rt);
  461 }
  462 
  463 
  464 /*
  465  * Force a routing table entry to the specified
  466  * destination to go through the given gateway.
  467  * Normally called as a result of a routing redirect
  468  * message from the network layer.
  469  */
  470 void
  471 rtredirect(struct sockaddr *dst,
  472         struct sockaddr *gateway,
  473         struct sockaddr *netmask,
  474         int flags,
  475         struct sockaddr *src)
  476 {
  477 
  478         rtredirect_fib(dst, gateway, netmask, flags, src, 0);
  479 }
  480 
  481 void
  482 rtredirect_fib(struct sockaddr *dst,
  483         struct sockaddr *gateway,
  484         struct sockaddr *netmask,
  485         int flags,
  486         struct sockaddr *src,
  487         u_int fibnum)
  488 {
  489         struct rtentry *rt, *rt0 = NULL;
  490         int error = 0;
  491         short *stat = NULL;
  492         struct rt_addrinfo info;
  493         struct ifaddr *ifa;
  494         struct radix_node_head *rnh =
  495             rt_tables[fibnum][dst->sa_family];
  496 
  497         /* verify the gateway is directly reachable */
  498         if ((ifa = ifa_ifwithnet(gateway)) == NULL) {
  499                 error = ENETUNREACH;
  500                 goto out;
  501         }
  502         rt = rtalloc1_fib(dst, 0, 0UL, fibnum); /* NB: rt is locked */
  503         /*
  504          * If the redirect isn't from our current router for this dst,
  505          * it's either old or wrong.  If it redirects us to ourselves,
  506          * we have a routing loop, perhaps as a result of an interface
  507          * going down recently.
  508          */
  509         if (!(flags & RTF_DONE) && rt &&
  510              (!sa_equal(src, rt->rt_gateway) || rt->rt_ifa != ifa))
  511                 error = EINVAL;
  512         else if (ifa_ifwithaddr(gateway))
  513                 error = EHOSTUNREACH;
  514         if (error)
  515                 goto done;
  516         /*
  517          * Create a new entry if we just got back a wildcard entry
  518          * or the the lookup failed.  This is necessary for hosts
  519          * which use routing redirects generated by smart gateways
  520          * to dynamically build the routing tables.
  521          */
  522         if (rt == NULL || (rt_mask(rt) && rt_mask(rt)->sa_len < 2))
  523                 goto create;
  524         /*
  525          * Don't listen to the redirect if it's
  526          * for a route to an interface.
  527          */
  528         if (rt->rt_flags & RTF_GATEWAY) {
  529                 if (((rt->rt_flags & RTF_HOST) == 0) && (flags & RTF_HOST)) {
  530                         /*
  531                          * Changing from route to net => route to host.
  532                          * Create new route, rather than smashing route to net.
  533                          */
  534                 create:
  535                         rt0 = rt;
  536                         rt = NULL;
  537                 
  538                         flags |=  RTF_GATEWAY | RTF_DYNAMIC;
  539                         bzero((caddr_t)&info, sizeof(info));
  540                         info.rti_info[RTAX_DST] = dst;
  541                         info.rti_info[RTAX_GATEWAY] = gateway;
  542                         info.rti_info[RTAX_NETMASK] = netmask;
  543                         info.rti_ifa = ifa;
  544                         info.rti_flags = flags;
  545                         if (rt0 != NULL)
  546                                 RT_UNLOCK(rt0); /* drop lock to avoid LOR with RNH */
  547                         error = rtrequest1_fib(RTM_ADD, &info, &rt, fibnum);
  548                         if (rt != NULL) {
  549                                 RT_LOCK(rt);
  550                                 EVENTHANDLER_INVOKE(route_redirect_event, rt0, rt, dst);
  551                                 flags = rt->rt_flags;
  552                         }
  553                         if (rt0)
  554                                 RTFREE(rt0);
  555                         
  556                         stat = &rtstat.rts_dynamic;
  557                 } else {
  558                         struct rtentry *gwrt;
  559 
  560                         /*
  561                          * Smash the current notion of the gateway to
  562                          * this destination.  Should check about netmask!!!
  563                          */
  564                         rt->rt_flags |= RTF_MODIFIED;
  565                         flags |= RTF_MODIFIED;
  566                         stat = &rtstat.rts_newgateway;
  567                         /*
  568                          * add the key and gateway (in one malloc'd chunk).
  569                          */
  570                         RT_UNLOCK(rt);
  571                         RADIX_NODE_HEAD_LOCK(rnh);
  572                         RT_LOCK(rt);
  573                         rt_setgate(rt, rt_key(rt), gateway);
  574                         gwrt = rtalloc1(gateway, 1, RTF_RNH_LOCKED);
  575                         RADIX_NODE_HEAD_UNLOCK(rnh);
  576                         EVENTHANDLER_INVOKE(route_redirect_event, rt, gwrt, dst);
  577                         RTFREE_LOCKED(gwrt);
  578                 }
  579         } else
  580                 error = EHOSTUNREACH;
  581 done:
  582         if (rt)
  583                 RTFREE_LOCKED(rt);
  584 out:
  585         if (error)
  586                 rtstat.rts_badredirect++;
  587         else if (stat != NULL)
  588                 (*stat)++;
  589         bzero((caddr_t)&info, sizeof(info));
  590         info.rti_info[RTAX_DST] = dst;
  591         info.rti_info[RTAX_GATEWAY] = gateway;
  592         info.rti_info[RTAX_NETMASK] = netmask;
  593         info.rti_info[RTAX_AUTHOR] = src;
  594         rt_missmsg(RTM_REDIRECT, &info, flags, error);
  595 }
  596 
  597 int
  598 rtioctl(u_long req, caddr_t data)
  599 {
  600         return (rtioctl_fib(req, data, 0));
  601 }
  602 
  603 /*
  604  * Routing table ioctl interface.
  605  */
  606 int
  607 rtioctl_fib(u_long req, caddr_t data, u_int fibnum)
  608 {
  609 
  610         /*
  611          * If more ioctl commands are added here, make sure the proper
  612          * super-user checks are being performed because it is possible for
  613          * prison-root to make it this far if raw sockets have been enabled
  614          * in jails.
  615          */
  616 #ifdef INET
  617         /* Multicast goop, grrr... */
  618         return mrt_ioctl ? mrt_ioctl(req, data, fibnum) : EOPNOTSUPP;
  619 #else /* INET */
  620         return ENXIO;
  621 #endif /* INET */
  622 }
  623 
  624 struct ifaddr *
  625 ifa_ifwithroute(int flags, struct sockaddr *dst, struct sockaddr *gateway)
  626 {
  627         return (ifa_ifwithroute_fib(flags, dst, gateway, 0));
  628 }
  629 
  630 struct ifaddr *
  631 ifa_ifwithroute_fib(int flags, struct sockaddr *dst, struct sockaddr *gateway,
  632                                 u_int fibnum)
  633 {
  634         register struct ifaddr *ifa;
  635         int not_found = 0;
  636 
  637         if ((flags & RTF_GATEWAY) == 0) {
  638                 /*
  639                  * If we are adding a route to an interface,
  640                  * and the interface is a pt to pt link
  641                  * we should search for the destination
  642                  * as our clue to the interface.  Otherwise
  643                  * we can use the local address.
  644                  */
  645                 ifa = NULL;
  646                 if (flags & RTF_HOST)
  647                         ifa = ifa_ifwithdstaddr(dst);
  648                 if (ifa == NULL)
  649                         ifa = ifa_ifwithaddr(gateway);
  650         } else {
  651                 /*
  652                  * If we are adding a route to a remote net
  653                  * or host, the gateway may still be on the
  654                  * other end of a pt to pt link.
  655                  */
  656                 ifa = ifa_ifwithdstaddr(gateway);
  657         }
  658         if (ifa == NULL)
  659                 ifa = ifa_ifwithnet(gateway);
  660         if (ifa == NULL) {
  661                 struct rtentry *rt = rtalloc1_fib(gateway, 0, RTF_RNH_LOCKED, fibnum);
  662                 if (rt == NULL)
  663                         return (NULL);
  664                 /*
  665                  * dismiss a gateway that is reachable only
  666                  * through the default router
  667                  */
  668                 switch (gateway->sa_family) {
  669                 case AF_INET:
  670                         if (satosin(rt_key(rt))->sin_addr.s_addr == INADDR_ANY)
  671                                 not_found = 1;
  672                         break;
  673                 case AF_INET6:
  674                         if (IN6_IS_ADDR_UNSPECIFIED(&satosin6(rt_key(rt))->sin6_addr))
  675                                 not_found = 1;
  676                         break;
  677                 default:
  678                         break;
  679                 }
  680                 RT_REMREF(rt);
  681                 RT_UNLOCK(rt);
  682                 if (not_found)
  683                         return (NULL);
  684                 if ((ifa = rt->rt_ifa) == NULL)
  685                         return (NULL);
  686         }
  687         if (ifa->ifa_addr->sa_family != dst->sa_family) {
  688                 struct ifaddr *oifa = ifa;
  689                 ifa = ifaof_ifpforaddr(dst, ifa->ifa_ifp);
  690                 if (ifa == NULL)
  691                         ifa = oifa;
  692         }
  693         return (ifa);
  694 }
  695 
  696 static walktree_f_t rt_fixdelete;
  697 static walktree_f_t rt_fixchange;
  698 
  699 struct rtfc_arg {
  700         struct rtentry *rt0;
  701         struct radix_node_head *rnh;
  702 };
  703 
  704 /*
  705  * Do appropriate manipulations of a routing tree given
  706  * all the bits of info needed
  707  */
  708 int
  709 rtrequest(int req,
  710         struct sockaddr *dst,
  711         struct sockaddr *gateway,
  712         struct sockaddr *netmask,
  713         int flags,
  714         struct rtentry **ret_nrt)
  715 {
  716         return (rtrequest_fib(req, dst, gateway, netmask, flags, ret_nrt, 0));
  717 }
  718 
  719 int
  720 rtrequest_fib(int req,
  721         struct sockaddr *dst,
  722         struct sockaddr *gateway,
  723         struct sockaddr *netmask,
  724         int flags,
  725         struct rtentry **ret_nrt,
  726         u_int fibnum)
  727 {
  728         struct rt_addrinfo info;
  729 
  730         if (dst->sa_len == 0)
  731                 return(EINVAL);
  732 
  733         bzero((caddr_t)&info, sizeof(info));
  734         info.rti_flags = flags;
  735         info.rti_info[RTAX_DST] = dst;
  736         info.rti_info[RTAX_GATEWAY] = gateway;
  737         info.rti_info[RTAX_NETMASK] = netmask;
  738         return rtrequest1_fib(req, &info, ret_nrt, fibnum);
  739 }
  740 
  741 /*
  742  * These (questionable) definitions of apparent local variables apply
  743  * to the next two functions.  XXXXXX!!!
  744  */
  745 #define dst     info->rti_info[RTAX_DST]
  746 #define gateway info->rti_info[RTAX_GATEWAY]
  747 #define netmask info->rti_info[RTAX_NETMASK]
  748 #define ifaaddr info->rti_info[RTAX_IFA]
  749 #define ifpaddr info->rti_info[RTAX_IFP]
  750 #define flags   info->rti_flags
  751 
  752 int
  753 rt_getifa(struct rt_addrinfo *info)
  754 {
  755         return (rt_getifa_fib(info, 0));
  756 }
  757 
  758 int
  759 rt_getifa_fib(struct rt_addrinfo *info, u_int fibnum)
  760 {
  761         struct ifaddr *ifa;
  762         int error = 0;
  763 
  764         /*
  765          * ifp may be specified by sockaddr_dl
  766          * when protocol address is ambiguous.
  767          */
  768         if (info->rti_ifp == NULL && ifpaddr != NULL &&
  769             ifpaddr->sa_family == AF_LINK &&
  770             (ifa = ifa_ifwithnet(ifpaddr)) != NULL)
  771                 info->rti_ifp = ifa->ifa_ifp;
  772         if (info->rti_ifa == NULL && ifaaddr != NULL)
  773                 info->rti_ifa = ifa_ifwithaddr(ifaaddr);
  774         if (info->rti_ifa == NULL) {
  775                 struct sockaddr *sa;
  776 
  777                 sa = ifaaddr != NULL ? ifaaddr :
  778                     (gateway != NULL ? gateway : dst);
  779                 if (sa != NULL && info->rti_ifp != NULL)
  780                         info->rti_ifa = ifaof_ifpforaddr(sa, info->rti_ifp);
  781                 else if (dst != NULL && gateway != NULL)
  782                         info->rti_ifa = ifa_ifwithroute_fib(flags, dst, gateway,
  783                                                         fibnum);
  784                 else if (sa != NULL)
  785                         info->rti_ifa = ifa_ifwithroute_fib(flags, sa, sa,
  786                                                         fibnum);
  787         }
  788         if ((ifa = info->rti_ifa) != NULL) {
  789                 if (info->rti_ifp == NULL)
  790                         info->rti_ifp = ifa->ifa_ifp;
  791         } else
  792                 error = ENETUNREACH;
  793         return (error);
  794 }
  795 
  796 /*
  797  * Expunges references to a route that's about to be reclaimed.
  798  * The route must be locked.
  799  */
  800 int
  801 rtexpunge(struct rtentry *rt)
  802 {
  803         struct radix_node *rn;
  804         struct radix_node_head *rnh;
  805         struct ifaddr *ifa;
  806         int error = 0;
  807 
  808         rnh = rt_tables[rt->rt_fibnum][rt_key(rt)->sa_family];
  809         RT_LOCK_ASSERT(rt);
  810         RADIX_NODE_HEAD_LOCK_ASSERT(rnh);
  811 #if 0
  812         /*
  813          * We cannot assume anything about the reference count
  814          * because protocols call us in many situations; often
  815          * before unwinding references to the table entry.
  816          */
  817         KASSERT(rt->rt_refcnt <= 1, ("bogus refcnt %ld", rt->rt_refcnt));
  818 #endif
  819         /*
  820          * Find the correct routing tree to use for this Address Family
  821          */
  822         rnh = rt_tables[rt->rt_fibnum][rt_key(rt)->sa_family];
  823         if (rnh == NULL)
  824                 return (EAFNOSUPPORT);
  825 
  826         /*
  827          * Remove the item from the tree; it should be there,
  828          * but when callers invoke us blindly it may not (sigh).
  829          */
  830         rn = rnh->rnh_deladdr(rt_key(rt), rt_mask(rt), rnh);
  831         if (rn == NULL) {
  832                 error = ESRCH;
  833                 goto bad;
  834         }
  835         KASSERT((rn->rn_flags & (RNF_ACTIVE | RNF_ROOT)) == 0,
  836                 ("unexpected flags 0x%x", rn->rn_flags));
  837         KASSERT(rt == RNTORT(rn),
  838                 ("lookup mismatch, rt %p rn %p", rt, rn));
  839 
  840         rt->rt_flags &= ~RTF_UP;
  841 
  842         /*
  843          * Now search what's left of the subtree for any cloned
  844          * routes which might have been formed from this node.
  845          */
  846         if ((rt->rt_flags & RTF_CLONING) && rt_mask(rt))
  847                 rnh->rnh_walktree_from(rnh, rt_key(rt), rt_mask(rt),
  848                                        rt_fixdelete, rt);
  849 
  850         /*
  851          * Remove any external references we may have.
  852          * This might result in another rtentry being freed if
  853          * we held its last reference.
  854          */
  855         if (rt->rt_gwroute) {
  856                 RTFREE(rt->rt_gwroute);
  857                 rt->rt_gwroute = NULL;
  858         }
  859 
  860         /*
  861          * Give the protocol a chance to keep things in sync.
  862          */
  863         if ((ifa = rt->rt_ifa) && ifa->ifa_rtrequest) {
  864                 struct rt_addrinfo info;
  865 
  866                 bzero((caddr_t)&info, sizeof(info));
  867                 info.rti_flags = rt->rt_flags;
  868                 info.rti_info[RTAX_DST] = rt_key(rt);
  869                 info.rti_info[RTAX_GATEWAY] = rt->rt_gateway;
  870                 info.rti_info[RTAX_NETMASK] = rt_mask(rt);
  871                 ifa->ifa_rtrequest(RTM_DELETE, rt, &info);
  872         }
  873 
  874         /*
  875          * one more rtentry floating around that is not
  876          * linked to the routing table.
  877          */
  878         rttrash++;
  879 bad:
  880         return (error);
  881 }
  882 
  883 int
  884 rtrequest1(int req, struct rt_addrinfo *info, struct rtentry **ret_nrt)
  885 {
  886         return (rtrequest1_fib(req, info, ret_nrt, 0));
  887 }
  888 
  889 int
  890 rtrequest1_fib(int req, struct rt_addrinfo *info, struct rtentry **ret_nrt,
  891                                 u_int fibnum)
  892 {
  893         int error = 0, needlock = 0;
  894         register struct rtentry *rt;
  895         register struct radix_node *rn;
  896         register struct radix_node_head *rnh;
  897         struct ifaddr *ifa;
  898         struct sockaddr *ndst;
  899 #define senderr(x) { error = x ; goto bad; }
  900 
  901         KASSERT((fibnum < rt_numfibs), ("rtrequest1_fib: bad fibnum"));
  902         if (dst->sa_family != AF_INET)  /* Only INET supports > 1 fib now */
  903                 fibnum = 0;
  904         /*
  905          * Find the correct routing tree to use for this Address Family
  906          */
  907         rnh = rt_tables[fibnum][dst->sa_family];
  908         if (rnh == NULL)
  909                 return (EAFNOSUPPORT);
  910         needlock = ((flags & RTF_RNH_LOCKED) == 0);
  911         flags &= ~RTF_RNH_LOCKED;
  912         if (needlock)
  913                 RADIX_NODE_HEAD_LOCK(rnh);
  914         else
  915                 RADIX_NODE_HEAD_LOCK_ASSERT(rnh);
  916         /*
  917          * If we are adding a host route then we don't want to put
  918          * a netmask in the tree, nor do we want to clone it.
  919          */
  920         if (flags & RTF_HOST) {
  921                 netmask = NULL;
  922                 flags &= ~RTF_CLONING;
  923         }
  924         switch (req) {
  925         case RTM_DELETE:
  926                 /*
  927                  * Remove the item from the tree and return it.
  928                  * Complain if it is not there and do no more processing.
  929                  */
  930                 rn = rnh->rnh_deladdr(dst, netmask, rnh);
  931                 if (rn == NULL)
  932                         senderr(ESRCH);
  933                 if (rn->rn_flags & (RNF_ACTIVE | RNF_ROOT))
  934                         panic ("rtrequest delete");
  935                 rt = RNTORT(rn);
  936                 RT_LOCK(rt);
  937                 RT_ADDREF(rt);
  938                 rt->rt_flags &= ~RTF_UP;
  939 
  940                 /*
  941                  * Now search what's left of the subtree for any cloned
  942                  * routes which might have been formed from this node.
  943                  */
  944                 if ((rt->rt_flags & RTF_CLONING) &&
  945                     rt_mask(rt)) {
  946                         rnh->rnh_walktree_from(rnh, dst, rt_mask(rt),
  947                                                rt_fixdelete, rt);
  948                 }
  949 
  950                 /*
  951                  * Remove any external references we may have.
  952                  * This might result in another rtentry being freed if
  953                  * we held its last reference.
  954                  */
  955                 if (rt->rt_gwroute) {
  956                         RTFREE(rt->rt_gwroute);
  957                         rt->rt_gwroute = NULL;
  958                 }
  959 
  960                 /*
  961                  * give the protocol a chance to keep things in sync.
  962                  */
  963                 if ((ifa = rt->rt_ifa) && ifa->ifa_rtrequest)
  964                         ifa->ifa_rtrequest(RTM_DELETE, rt, info);
  965 
  966                 /*
  967                  * One more rtentry floating around that is not
  968                  * linked to the routing table. rttrash will be decremented
  969                  * when RTFREE(rt) is eventually called.
  970                  */
  971                 rttrash++;
  972 
  973                 /*
  974                  * If the caller wants it, then it can have it,
  975                  * but it's up to it to free the rtentry as we won't be
  976                  * doing it.
  977                  */
  978                 if (ret_nrt) {
  979                         *ret_nrt = rt;
  980                         RT_UNLOCK(rt);
  981                 } else
  982                         RTFREE_LOCKED(rt);
  983                 break;
  984 
  985         case RTM_RESOLVE:
  986                 if (ret_nrt == NULL || (rt = *ret_nrt) == NULL)
  987                         senderr(EINVAL);
  988                 ifa = rt->rt_ifa;
  989                 /* XXX locking? */
  990                 flags = rt->rt_flags &
  991                     ~(RTF_CLONING | RTF_STATIC);
  992                 flags |= RTF_WASCLONED;
  993                 gateway = rt->rt_gateway;
  994                 if ((netmask = rt->rt_genmask) == NULL)
  995                         flags |= RTF_HOST;
  996                 goto makeroute;
  997 
  998         case RTM_ADD:
  999                 if ((flags & RTF_GATEWAY) && !gateway)
 1000                         senderr(EINVAL);
 1001                 if (dst && gateway && (dst->sa_family != gateway->sa_family) && 
 1002                     (gateway->sa_family != AF_UNSPEC) && (gateway->sa_family != AF_LINK))
 1003                         senderr(EINVAL);
 1004 
 1005                 if (info->rti_ifa == NULL && (error = rt_getifa_fib(info, fibnum)))
 1006                         senderr(error);
 1007                 ifa = info->rti_ifa;
 1008 
 1009         makeroute:
 1010                 rt = uma_zalloc(rtzone, M_NOWAIT | M_ZERO);
 1011                 if (rt == NULL)
 1012                         senderr(ENOBUFS);
 1013                 RT_LOCK_INIT(rt);
 1014                 rt->rt_flags = RTF_UP | flags;
 1015                 rt->rt_fibnum = fibnum;
 1016                 /*
 1017                  * Add the gateway. Possibly re-malloc-ing the storage for it
 1018                  * also add the rt_gwroute if possible.
 1019                  */
 1020                 RT_LOCK(rt);
 1021                 if ((error = rt_setgate(rt, dst, gateway)) != 0) {
 1022                         RT_LOCK_DESTROY(rt);
 1023                         uma_zfree(rtzone, rt);
 1024                         senderr(error);
 1025                 }
 1026 
 1027                 /*
 1028                  * point to the (possibly newly malloc'd) dest address.
 1029                  */
 1030                 ndst = (struct sockaddr *)rt_key(rt);
 1031 
 1032                 /*
 1033                  * make sure it contains the value we want (masked if needed).
 1034                  */
 1035                 if (netmask) {
 1036                         rt_maskedcopy(dst, ndst, netmask);
 1037                 } else
 1038                         bcopy(dst, ndst, dst->sa_len);
 1039 
 1040                 /*
 1041                  * Note that we now have a reference to the ifa.
 1042                  * This moved from below so that rnh->rnh_addaddr() can
 1043                  * examine the ifa and  ifa->ifa_ifp if it so desires.
 1044                  */
 1045                 IFAREF(ifa);
 1046                 rt->rt_ifa = ifa;
 1047                 rt->rt_ifp = ifa->ifa_ifp;
 1048 
 1049                 /* XXX mtu manipulation will be done in rnh_addaddr -- itojun */
 1050                 rn = rnh->rnh_addaddr(ndst, netmask, rnh, rt->rt_nodes);
 1051                 if (rn == NULL) {
 1052                         struct rtentry *rt2;
 1053                         /*
 1054                          * Uh-oh, we already have one of these in the tree.
 1055                          * We do a special hack: if the route that's already
 1056                          * there was generated by the cloning mechanism
 1057                          * then we just blow it away and retry the insertion
 1058                          * of the new one.
 1059                          */
 1060                         rt2 = rtalloc1_fib(dst, 0, RTF_RNH_LOCKED, fibnum);
 1061                         if (rt2 && rt2->rt_parent) {
 1062                                 rtexpunge(rt2);
 1063                                 RT_UNLOCK(rt2);
 1064                                 rn = rnh->rnh_addaddr(ndst, netmask,
 1065                                                       rnh, rt->rt_nodes);
 1066                         } else if (rt2) {
 1067                                 /* undo the extra ref we got */
 1068                                 RTFREE_LOCKED(rt2);
 1069                         }
 1070                 }
 1071 
 1072                 /*
 1073                  * If it still failed to go into the tree,
 1074                  * then un-make it (this should be a function)
 1075                  */
 1076                 if (rn == NULL) {
 1077                         if (rt->rt_gwroute)
 1078                                 RTFREE(rt->rt_gwroute);
 1079                         if (rt->rt_ifa)
 1080                                 IFAFREE(rt->rt_ifa);
 1081                         Free(rt_key(rt));
 1082                         RT_LOCK_DESTROY(rt);
 1083                         uma_zfree(rtzone, rt);
 1084                         senderr(EEXIST);
 1085                 }
 1086 
 1087                 rt->rt_parent = NULL;
 1088 
 1089                 /*
 1090                  * If we got here from RESOLVE, then we are cloning
 1091                  * so clone the rest, and note that we
 1092                  * are a clone (and increment the parent's references)
 1093                  */
 1094                 if (req == RTM_RESOLVE) {
 1095                         KASSERT(ret_nrt && *ret_nrt,
 1096                                 ("no route to clone from"));
 1097                         rt->rt_rmx = (*ret_nrt)->rt_rmx; /* copy metrics */
 1098                         rt->rt_rmx.rmx_pksent = 0; /* reset packet counter */
 1099                         if ((*ret_nrt)->rt_flags & RTF_CLONING) {
 1100                                 /*
 1101                                  * NB: We do not bump the refcnt on the parent
 1102                                  * entry under the assumption that it will
 1103                                  * remain so long as we do.  This is
 1104                                  * important when deleting the parent route
 1105                                  * as this operation requires traversing
 1106                                  * the tree to delete all clones and futzing
 1107                                  * with refcnts requires us to double-lock
 1108                                  * parent through this back reference.
 1109                                  */
 1110                                 rt->rt_parent = *ret_nrt;
 1111                         }
 1112                 }
 1113 
 1114                 /*
 1115                  * If this protocol has something to add to this then
 1116                  * allow it to do that as well.
 1117                  */
 1118                 if (ifa->ifa_rtrequest)
 1119                         ifa->ifa_rtrequest(req, rt, info);
 1120 
 1121                 /*
 1122                  * We repeat the same procedure from rt_setgate() here because
 1123                  * it doesn't fire when we call it there because the node
 1124                  * hasn't been added to the tree yet.
 1125                  */
 1126                 if (req == RTM_ADD &&
 1127                     !(rt->rt_flags & RTF_HOST) && rt_mask(rt) != NULL) {
 1128                         struct rtfc_arg arg;
 1129                         arg.rnh = rnh;
 1130                         arg.rt0 = rt;
 1131                         rnh->rnh_walktree_from(rnh, rt_key(rt), rt_mask(rt),
 1132                                                rt_fixchange, &arg);
 1133                 }
 1134 
 1135                 /*
 1136                  * actually return a resultant rtentry and
 1137                  * give the caller a single reference.
 1138                  */
 1139                 if (ret_nrt) {
 1140                         *ret_nrt = rt;
 1141                         RT_ADDREF(rt);
 1142                 }
 1143                 RT_UNLOCK(rt);
 1144                 break;
 1145         default:
 1146                 error = EOPNOTSUPP;
 1147         }
 1148 bad:
 1149         if (needlock)
 1150                 RADIX_NODE_HEAD_UNLOCK(rnh);
 1151         return (error);
 1152 #undef senderr
 1153 }
 1154 
 1155 #undef dst
 1156 #undef gateway
 1157 #undef netmask
 1158 #undef ifaaddr
 1159 #undef ifpaddr
 1160 #undef flags
 1161 
 1162 /*
 1163  * Called from rtrequest(RTM_DELETE, ...) to fix up the route's ``family''
 1164  * (i.e., the routes related to it by the operation of cloning).  This
 1165  * routine is iterated over all potential former-child-routes by way of
 1166  * rnh->rnh_walktree_from() above, and those that actually are children of
 1167  * the late parent (passed in as VP here) are themselves deleted.
 1168  */
 1169 static int
 1170 rt_fixdelete(struct radix_node *rn, void *vp)
 1171 {
 1172         struct rtentry *rt = RNTORT(rn);
 1173         struct rtentry *rt0 = vp;
 1174 
 1175         if (rt->rt_parent == rt0 &&
 1176             !(rt->rt_flags & (RTF_PINNED | RTF_CLONING))) {
 1177                 return rtrequest_fib(RTM_DELETE, rt_key(rt), NULL, rt_mask(rt),
 1178                                  rt->rt_flags|RTF_RNH_LOCKED, NULL, rt->rt_fibnum);
 1179         }
 1180         return 0;
 1181 }
 1182 
 1183 /*
 1184  * This routine is called from rt_setgate() to do the analogous thing for
 1185  * adds and changes.  There is the added complication in this case of a
 1186  * middle insert; i.e., insertion of a new network route between an older
 1187  * network route and (cloned) host routes.  For this reason, a simple check
 1188  * of rt->rt_parent is insufficient; each candidate route must be tested
 1189  * against the (mask, value) of the new route (passed as before in vp)
 1190  * to see if the new route matches it.
 1191  *
 1192  * XXX - it may be possible to do fixdelete() for changes and reserve this
 1193  * routine just for adds.  I'm not sure why I thought it was necessary to do
 1194  * changes this way.
 1195  */
 1196 
 1197 static int
 1198 rt_fixchange(struct radix_node *rn, void *vp)
 1199 {
 1200         struct rtentry *rt = RNTORT(rn);
 1201         struct rtfc_arg *ap = vp;
 1202         struct rtentry *rt0 = ap->rt0;
 1203         struct radix_node_head *rnh = ap->rnh;
 1204         u_char *xk1, *xm1, *xk2, *xmp;
 1205         int i, len, mlen;
 1206 
 1207         /* make sure we have a parent, and route is not pinned or cloning */
 1208         if (!rt->rt_parent ||
 1209             (rt->rt_flags & (RTF_PINNED | RTF_CLONING)))
 1210                 return 0;
 1211 
 1212         if (rt->rt_parent == rt0)       /* parent match */
 1213                 goto delete_rt;
 1214         /*
 1215          * There probably is a function somewhere which does this...
 1216          * if not, there should be.
 1217          */
 1218         len = imin(rt_key(rt0)->sa_len, rt_key(rt)->sa_len);
 1219 
 1220         xk1 = (u_char *)rt_key(rt0);
 1221         xm1 = (u_char *)rt_mask(rt0);
 1222         xk2 = (u_char *)rt_key(rt);
 1223 
 1224         /* avoid applying a less specific route */
 1225         xmp = (u_char *)rt_mask(rt->rt_parent);
 1226         mlen = rt_key(rt->rt_parent)->sa_len;
 1227         if (mlen > rt_key(rt0)->sa_len)         /* less specific route */
 1228                 return 0;
 1229         for (i = rnh->rnh_treetop->rn_offset; i < mlen; i++)
 1230                 if ((xmp[i] & ~(xmp[i] ^ xm1[i])) != xmp[i])
 1231                         return 0;       /* less specific route */
 1232 
 1233         for (i = rnh->rnh_treetop->rn_offset; i < len; i++)
 1234                 if ((xk2[i] & xm1[i]) != xk1[i])
 1235                         return 0;       /* no match */
 1236 
 1237         /*
 1238          * OK, this node is a clone, and matches the node currently being
 1239          * changed/added under the node's mask.  So, get rid of it.
 1240          */
 1241 delete_rt:
 1242         return rtrequest_fib(RTM_DELETE, rt_key(rt), NULL,
 1243                          rt_mask(rt), rt->rt_flags, NULL, rt->rt_fibnum);
 1244 }
 1245 
 1246 int
 1247 rt_setgate(struct rtentry *rt, struct sockaddr *dst, struct sockaddr *gate)
 1248 {
 1249         /* XXX dst may be overwritten, can we move this to below */
 1250         struct radix_node_head *rnh = rt_tables[rt->rt_fibnum][dst->sa_family];
 1251         int dlen = SA_SIZE(dst), glen = SA_SIZE(gate);
 1252 
 1253 again:
 1254         RT_LOCK_ASSERT(rt);
 1255         RADIX_NODE_HEAD_LOCK_ASSERT(rnh);
 1256 
 1257         /*
 1258          * A host route with the destination equal to the gateway
 1259          * will interfere with keeping LLINFO in the routing
 1260          * table, so disallow it.
 1261          */
 1262         if (((rt->rt_flags & (RTF_HOST|RTF_GATEWAY|RTF_LLINFO)) ==
 1263                                         (RTF_HOST|RTF_GATEWAY)) &&
 1264             dst->sa_len == gate->sa_len &&
 1265             bcmp(dst, gate, dst->sa_len) == 0) {
 1266                 /*
 1267                  * The route might already exist if this is an RTM_CHANGE
 1268                  * or a routing redirect, so try to delete it.
 1269                  */
 1270                 if (rt_key(rt))
 1271                         rtexpunge(rt);
 1272                 return EADDRNOTAVAIL;
 1273         }
 1274 
 1275         /*
 1276          * Cloning loop avoidance in case of bad configuration.
 1277          */
 1278         if (rt->rt_flags & RTF_GATEWAY) {
 1279                 struct rtentry *gwrt;
 1280 
 1281                 RT_UNLOCK(rt);          /* XXX workaround LOR */
 1282                 gwrt = rtalloc1_fib(gate, 1, RTF_RNH_LOCKED, rt->rt_fibnum);
 1283                 if (gwrt == rt) {
 1284                         RT_REMREF(rt);
 1285                         return (EADDRINUSE); /* failure */
 1286                 }
 1287                 /*
 1288                  * Try to reacquire the lock on rt, and if it fails,
 1289                  * clean state and restart from scratch.
 1290                  */
 1291                 if (!RT_TRYLOCK(rt)) {
 1292                         RTFREE_LOCKED(gwrt);
 1293                         RT_LOCK(rt);
 1294                         goto again;
 1295                 }
 1296                 /*
 1297                  * If there is already a gwroute, then drop it. If we
 1298                  * are asked to replace route with itself, then do
 1299                  * not leak its refcounter.
 1300                  */
 1301                 if (rt->rt_gwroute != NULL) {
 1302                         if (rt->rt_gwroute == gwrt) {
 1303                                 RT_REMREF(rt->rt_gwroute);
 1304                         } else
 1305                                 RTFREE(rt->rt_gwroute);
 1306                 }
 1307 
 1308                 if ((rt->rt_gwroute = gwrt) != NULL)
 1309                         RT_UNLOCK(rt->rt_gwroute);
 1310         }
 1311 
 1312         /*
 1313          * Prepare to store the gateway in rt->rt_gateway.
 1314          * Both dst and gateway are stored one after the other in the same
 1315          * malloc'd chunk. If we have room, we can reuse the old buffer,
 1316          * rt_gateway already points to the right place.
 1317          * Otherwise, malloc a new block and update the 'dst' address.
 1318          */
 1319         if (rt->rt_gateway == NULL || glen > SA_SIZE(rt->rt_gateway)) {
 1320                 caddr_t new;
 1321 
 1322                 R_Malloc(new, caddr_t, dlen + glen);
 1323                 if (new == NULL)
 1324                         return ENOBUFS;
 1325                 /*
 1326                  * XXX note, we copy from *dst and not *rt_key(rt) because
 1327                  * rt_setgate() can be called to initialize a newly
 1328                  * allocated route entry, in which case rt_key(rt) == NULL
 1329                  * (and also rt->rt_gateway == NULL).
 1330                  * Free()/free() handle a NULL argument just fine.
 1331                  */
 1332                 bcopy(dst, new, dlen);
 1333                 Free(rt_key(rt));       /* free old block, if any */
 1334                 rt_key(rt) = (struct sockaddr *)new;
 1335                 rt->rt_gateway = (struct sockaddr *)(new + dlen);
 1336         }
 1337 
 1338         /*
 1339          * Copy the new gateway value into the memory chunk.
 1340          */
 1341         bcopy(gate, rt->rt_gateway, glen);
 1342 
 1343         /*
 1344          * This isn't going to do anything useful for host routes, so
 1345          * don't bother.  Also make sure we have a reasonable mask
 1346          * (we don't yet have one during adds).
 1347          */
 1348         if (!(rt->rt_flags & RTF_HOST) && rt_mask(rt) != 0) {
 1349                 struct rtfc_arg arg;
 1350 
 1351                 arg.rnh = rnh;
 1352                 arg.rt0 = rt;
 1353                 rnh->rnh_walktree_from(rnh, rt_key(rt), rt_mask(rt),
 1354                                        rt_fixchange, &arg);
 1355         }
 1356 
 1357         return 0;
 1358 }
 1359 
 1360 static void
 1361 rt_maskedcopy(struct sockaddr *src, struct sockaddr *dst, struct sockaddr *netmask)
 1362 {
 1363         register u_char *cp1 = (u_char *)src;
 1364         register u_char *cp2 = (u_char *)dst;
 1365         register u_char *cp3 = (u_char *)netmask;
 1366         u_char *cplim = cp2 + *cp3;
 1367         u_char *cplim2 = cp2 + *cp1;
 1368 
 1369         *cp2++ = *cp1++; *cp2++ = *cp1++; /* copies sa_len & sa_family */
 1370         cp3 += 2;
 1371         if (cplim > cplim2)
 1372                 cplim = cplim2;
 1373         while (cp2 < cplim)
 1374                 *cp2++ = *cp1++ & *cp3++;
 1375         if (cp2 < cplim2)
 1376                 bzero((caddr_t)cp2, (unsigned)(cplim2 - cp2));
 1377 }
 1378 
 1379 /*
 1380  * Set up a routing table entry, normally
 1381  * for an interface.
 1382  */
 1383 #define _SOCKADDR_TMPSIZE 128 /* Not too big.. kernel stack size is limited */
 1384 static inline int
 1385 rtinit1(struct ifaddr *ifa, int cmd, int flags, int fibnum)
 1386 {
 1387         struct sockaddr *dst;
 1388         struct sockaddr *netmask;
 1389         struct rtentry *rt = NULL;
 1390         struct rt_addrinfo info;
 1391         int error = 0;
 1392         int startfib, endfib;
 1393         char tempbuf[_SOCKADDR_TMPSIZE];
 1394         int didwork = 0;
 1395         int a_failure = 0;
 1396 
 1397         if (flags & RTF_HOST) {
 1398                 dst = ifa->ifa_dstaddr;
 1399                 netmask = NULL;
 1400         } else {
 1401                 dst = ifa->ifa_addr;
 1402                 netmask = ifa->ifa_netmask;
 1403         }
 1404         if ( dst->sa_family != AF_INET)
 1405                 fibnum = 0;
 1406         if (fibnum == -1) {
 1407                 if (rt_add_addr_allfibs == 0 && cmd == (int)RTM_ADD) {
 1408                         startfib = endfib = curthread->td_proc->p_fibnum;
 1409                 } else {
 1410                         startfib = 0;
 1411                         endfib = rt_numfibs - 1;
 1412                 }
 1413         } else {
 1414                 KASSERT((fibnum < rt_numfibs), ("rtinit1: bad fibnum"));
 1415                 startfib = fibnum;
 1416                 endfib = fibnum;
 1417         }
 1418         if (dst->sa_len == 0)
 1419                 return(EINVAL);
 1420 
 1421         /*
 1422          * If it's a delete, check that if it exists,
 1423          * it's on the correct interface or we might scrub
 1424          * a route to another ifa which would
 1425          * be confusing at best and possibly worse.
 1426          */
 1427         if (cmd == RTM_DELETE) {
 1428                 /*
 1429                  * It's a delete, so it should already exist..
 1430                  * If it's a net, mask off the host bits
 1431                  * (Assuming we have a mask)
 1432                  * XXX this is kinda inet specific..
 1433                  */
 1434                 if (netmask != NULL) {
 1435                         rt_maskedcopy(dst, (struct sockaddr *)tempbuf, netmask);
 1436                         dst = (struct sockaddr *)tempbuf;
 1437                 }
 1438         }
 1439         /*
 1440          * Now go through all the requested tables (fibs) and do the
 1441          * requested action. Realistically, this will either be fib 0
 1442          * for protocols that don't do multiple tables or all the
 1443          * tables for those that do. XXX For this version only AF_INET.
 1444          * When that changes code should be refactored to protocol
 1445          * independent parts and protocol dependent parts.
 1446          */
 1447         for ( fibnum = startfib; fibnum <= endfib; fibnum++) {
 1448                 if (cmd == RTM_DELETE) {
 1449                         struct radix_node_head *rnh;
 1450                         struct radix_node *rn;
 1451                         /*
 1452                          * Look up an rtentry that is in the routing tree and
 1453                          * contains the correct info.
 1454                          */
 1455                         if ((rnh = rt_tables[fibnum][dst->sa_family]) == NULL)
 1456                                 /* this table doesn't exist but others might */
 1457                                 continue;
 1458                         RADIX_NODE_HEAD_LOCK(rnh);
 1459                         rn = rnh->rnh_lookup(dst, netmask, rnh);
 1460                         error = (rn == NULL ||
 1461                             (rn->rn_flags & RNF_ROOT) ||
 1462                             RNTORT(rn)->rt_ifa != ifa ||
 1463                             !sa_equal((struct sockaddr *)rn->rn_key, dst));
 1464                         RADIX_NODE_HEAD_UNLOCK(rnh);
 1465                         if (error) {
 1466                                 /* this is only an error if bad on ALL tables */
 1467                                 continue;
 1468                         }
 1469                 }
 1470                 /*
 1471                  * Do the actual request
 1472                  */
 1473                 bzero((caddr_t)&info, sizeof(info));
 1474                 info.rti_ifa = ifa;
 1475                 info.rti_flags = flags | ifa->ifa_flags;
 1476                 info.rti_info[RTAX_DST] = dst;
 1477                 info.rti_info[RTAX_GATEWAY] = ifa->ifa_addr;
 1478                 info.rti_info[RTAX_NETMASK] = netmask;
 1479                 error = rtrequest1_fib(cmd, &info, &rt, fibnum);
 1480                 if (error == 0 && rt != NULL) {
 1481                         /*
 1482                          * notify any listening routing agents of the change
 1483                          */
 1484                         RT_LOCK(rt);
 1485                         rt_newaddrmsg(cmd, ifa, error, rt);
 1486                         if (cmd == RTM_DELETE) {
 1487                                 /*
 1488                                  * If we are deleting, and we found an entry, then
 1489                                  * it's been removed from the tree.. now throw it away.
 1490                                  */
 1491                                 RTFREE_LOCKED(rt);
 1492                         } else {
 1493                                 if (cmd == RTM_ADD) {
 1494                                         /*
 1495                                          * We just wanted to add it.. we don't actually
 1496                                          * need a reference.
 1497                                          */
 1498                                         RT_REMREF(rt);
 1499                                 }
 1500                                 RT_UNLOCK(rt);
 1501                         }
 1502                         didwork = 1;
 1503                 }
 1504                 if (error)
 1505                         a_failure = error;
 1506         }
 1507         if (cmd == RTM_DELETE) {
 1508                 if (didwork) {
 1509                         error = 0;
 1510                 } else {
 1511                         /* we only give an error if it wasn't in any table */
 1512                         error = ((flags & RTF_HOST) ?
 1513                             EHOSTUNREACH : ENETUNREACH);
 1514                 }
 1515         } else {
 1516                 if (a_failure) {
 1517                         /* return an error if any of them failed */
 1518                         error = a_failure;
 1519                 }
 1520         }
 1521         return (error);
 1522 }
 1523 
 1524 /* special one for inet internal use. may not use. */
 1525 int
 1526 rtinit_fib(struct ifaddr *ifa, int cmd, int flags)
 1527 {
 1528         return (rtinit1(ifa, cmd, flags, -1));
 1529 }
 1530 
 1531 /*
 1532  * Set up a routing table entry, normally
 1533  * for an interface.
 1534  */
 1535 int
 1536 rtinit(struct ifaddr *ifa, int cmd, int flags)
 1537 {
 1538         struct sockaddr *dst;
 1539         int fib = 0;
 1540 
 1541         if (flags & RTF_HOST) {
 1542                 dst = ifa->ifa_dstaddr;
 1543         } else {
 1544                 dst = ifa->ifa_addr;
 1545         }
 1546 
 1547         if (dst->sa_family == AF_INET)
 1548                 fib = -1;
 1549         return (rtinit1(ifa, cmd, flags, fib));
 1550 }
 1551 
 1552 /*
 1553  * rt_check() is invoked on each layer 2 output path, prior to
 1554  * encapsulating outbound packets.
 1555  *
 1556  * The function is mostly used to find a routing entry for the gateway,
 1557  * which in some protocol families could also point to the link-level
 1558  * address for the gateway itself (the side effect of revalidating the
 1559  * route to the destination is rather pointless at this stage, we did it
 1560  * already a moment before in the pr_output() routine to locate the ifp
 1561  * and gateway to use).
 1562  *
 1563  * When we remove the layer-3 to layer-2 mapping tables from the
 1564  * routing table, this function can be removed.
 1565  *
 1566  * === On input ===
 1567  *   *dst is the address of the NEXT HOP (which coincides with the
 1568  *      final destination if directly reachable);
 1569  *   *lrt0 points to the cached route to the final destination;
 1570  *   *lrt is not meaningful;
 1571  *      (*lrt0 has no ref held on it by us so REMREF is not needed.
 1572  *      Refs only account for major structural references and not usages,
 1573  *      which is actually a bit of a problem.)
 1574  *
 1575  * === Operation ===
 1576  * If the route is marked down try to find a new route.  If the route
 1577  * to the gateway is gone, try to setup a new route.  Otherwise,
 1578  * if the route is marked for packets to be rejected, enforce that.
 1579  * Note that rtalloc returns an rtentry with an extra REF that we may
 1580  * need to lose.
 1581  *
 1582  * === On return ===
 1583  *   *dst is unchanged;
 1584  *   *lrt0 points to the (possibly new) route to the final destination
 1585  *   *lrt points to the route to the next hop   [LOCKED]
 1586  *
 1587  * Their values are meaningful ONLY if no error is returned.
 1588  *
 1589  * To follow this you have to remember that:
 1590  * RT_REMREF reduces the reference count by 1 but doesn't check it for 0 (!)
 1591  * RTFREE_LOCKED includes an RT_REMREF (or an rtfree if refs == 1)
 1592  *    and an RT_UNLOCK
 1593  * RTFREE does an RT_LOCK and an RTFREE_LOCKED
 1594  * The gwroute pointer counts as a reference on the rtentry to which it points.
 1595  * so when we add it we use the ref that rtalloc gives us and when we lose it
 1596  * we need to remove the reference.
 1597  * RT_TEMP_UNLOCK does an RT_ADDREF before freeing the lock, and
 1598  * RT_RELOCK locks it (it can't have gone away due to the ref) and
 1599  * drops the ref, possibly freeing it and zeroing the pointer if
 1600  * the ref goes to 0 (unlocking in the process).
 1601  */
 1602 int
 1603 rt_check(struct rtentry **lrt, struct rtentry **lrt0, struct sockaddr *dst)
 1604 {
 1605         struct rtentry *rt;
 1606         struct rtentry *rt0;
 1607         u_int fibnum;
 1608 
 1609         KASSERT(*lrt0 != NULL, ("rt_check"));
 1610         rt0 = *lrt0;
 1611         rt = NULL;
 1612         fibnum = rt0->rt_fibnum;
 1613 
 1614         /* NB: the locking here is tortuous... */
 1615         RT_LOCK(rt0);
 1616 retry:
 1617         if (rt0 && (rt0->rt_flags & RTF_UP) == 0) {
 1618                 /* Current rt0 is useless, try get a replacement. */
 1619                 RT_UNLOCK(rt0);
 1620                 rt0 = NULL;
 1621         }
 1622         if (rt0 == NULL) {
 1623                 rt0 = rtalloc1_fib(dst, 1, 0UL, fibnum);
 1624                 if (rt0 == NULL) {
 1625                         return (EHOSTUNREACH);
 1626                 }
 1627                 RT_REMREF(rt0); /* don't need the reference. */
 1628         }
 1629 
 1630         if (rt0->rt_flags & RTF_GATEWAY) {
 1631                 if ((rt = rt0->rt_gwroute) != NULL) {
 1632                         RT_LOCK(rt);            /* NB: gwroute */
 1633                         if ((rt->rt_flags & RTF_UP) == 0) {
 1634                                 /* gw route is dud. ignore/lose it */
 1635                                 RTFREE_LOCKED(rt); /* unref (&unlock) gwroute */
 1636                                 rt = rt0->rt_gwroute = NULL;
 1637                         }
 1638                 }
 1639                 
 1640                 if (rt == NULL) {  /* NOT AN ELSE CLAUSE */
 1641                         RT_TEMP_UNLOCK(rt0); /* MUST return to undo this */
 1642                         rt = rtalloc1_fib(rt0->rt_gateway, 1, 0UL, fibnum);
 1643                         if ((rt == rt0) || (rt == NULL)) {
 1644                                 /* the best we can do is not good enough */
 1645                                 if (rt) {
 1646                                         RT_REMREF(rt); /* assumes ref > 0 */
 1647                                         RT_UNLOCK(rt);
 1648                                 }
 1649                                 RTFREE(rt0); /* lock, unref, (unlock) */
 1650                                 return (ENETUNREACH);
 1651                         }
 1652                         /*
 1653                          * Relock it and lose the added reference.  All sorts
 1654                          * of things could have happenned while we had no
 1655                          * lock on it, so check for them.  rt need to be
 1656                          * unlocked to avoid possible deadlock.
 1657                          */
 1658                         RT_UNLOCK(rt);
 1659                         RT_RELOCK(rt0);
 1660                         if (rt0 == NULL || ((rt0->rt_flags & RTF_UP) == 0)) {
 1661                                 /* Ru-roh.. what we had is no longer any good */
 1662                                 RTFREE(rt);
 1663                                 goto retry;
 1664                         }
 1665                         /* 
 1666                          * While we were away, someone replaced the gateway.
 1667                          * Since a reference count is involved we can't just
 1668                          * overwrite it.
 1669                          */
 1670                         if (rt0->rt_gwroute) {
 1671                                 if (rt0->rt_gwroute != rt)
 1672                                         RTFREE(rt);
 1673                         } else {
 1674                                 rt0->rt_gwroute = rt;
 1675                         }
 1676                         /* 
 1677                          * Since rt was not locked, we need recheck that
 1678                          * it still may be used (e.g. up)
 1679                          */
 1680                         goto retry;
 1681                 }
 1682                 RT_LOCK_ASSERT(rt);
 1683                 RT_UNLOCK(rt0);
 1684         } else {
 1685                 /* think of rt as having the lock from now on.. */
 1686                 rt = rt0;
 1687         }
 1688         /* XXX why are we inspecting rmx_expire? */
 1689         if ((rt->rt_flags & RTF_REJECT) &&
 1690             (rt->rt_rmx.rmx_expire == 0 ||
 1691             time_uptime < rt->rt_rmx.rmx_expire)) {
 1692                 RT_UNLOCK(rt);
 1693                 return (rt == rt0 ? EHOSTDOWN : EHOSTUNREACH);
 1694         }
 1695 
 1696         *lrt = rt;
 1697         *lrt0 = rt0;
 1698         return (0);
 1699 }
 1700 
 1701 /* This must be before ip6_init2(), which is now SI_ORDER_MIDDLE */
 1702 SYSINIT(route, SI_SUB_PROTO_DOMAIN, SI_ORDER_THIRD, route_init, 0);

Cache object: f0b88117436e2132960ac6cb3426c0cb


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.