1 | /* |
2 | * Copyright (c) 2000-2023 Apple Inc. All rights reserved. |
3 | * |
4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ |
5 | * |
6 | * This file contains Original Code and/or Modifications of Original Code |
7 | * as defined in and that are subject to the Apple Public Source License |
8 | * Version 2.0 (the 'License'). You may not use this file except in |
9 | * compliance with the License. The rights granted to you under the License |
10 | * may not be used to create, or enable the creation or redistribution of, |
11 | * unlawful or unlicensed copies of an Apple operating system, or to |
12 | * circumvent, violate, or enable the circumvention or violation of, any |
13 | * terms of an Apple operating system software license agreement. |
14 | * |
15 | * Please obtain a copy of the License at |
16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. |
17 | * |
18 | * The Original Code and all software distributed under the License are |
19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER |
20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, |
21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, |
22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. |
23 | * Please see the License for the specific language governing rights and |
24 | * limitations under the License. |
25 | * |
26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
27 | */ |
28 | /* |
29 | * Copyright (c) 1980, 1986, 1991, 1993 |
30 | * The Regents of the University of California. All rights reserved. |
31 | * |
32 | * Redistribution and use in source and binary forms, with or without |
33 | * modification, are permitted provided that the following conditions |
34 | * are met: |
35 | * 1. Redistributions of source code must retain the above copyright |
36 | * notice, this list of conditions and the following disclaimer. |
37 | * 2. Redistributions in binary form must reproduce the above copyright |
38 | * notice, this list of conditions and the following disclaimer in the |
39 | * documentation and/or other materials provided with the distribution. |
40 | * 3. All advertising materials mentioning features or use of this software |
41 | * must display the following acknowledgement: |
42 | * This product includes software developed by the University of |
43 | * California, Berkeley and its contributors. |
44 | * 4. Neither the name of the University nor the names of its contributors |
45 | * may be used to endorse or promote products derived from this software |
46 | * without specific prior written permission. |
47 | * |
48 | * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND |
49 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
50 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
51 | * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE |
52 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
53 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
54 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
55 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
56 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
57 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
58 | * SUCH DAMAGE. |
59 | * |
60 | * @(#)route.c 8.2 (Berkeley) 11/15/93 |
61 | * $FreeBSD: src/sys/net/route.c,v 1.59.2.3 2001/07/29 19:18:02 ume Exp $ |
62 | */ |
63 | |
64 | #include <sys/param.h> |
65 | #include <sys/sysctl.h> |
66 | #include <sys/systm.h> |
67 | #include <sys/malloc.h> |
68 | #include <sys/mbuf.h> |
69 | #include <sys/socket.h> |
70 | #include <sys/domain.h> |
71 | #include <sys/stat.h> |
72 | #include <sys/ubc.h> |
73 | #include <sys/vnode.h> |
74 | #include <sys/syslog.h> |
75 | #include <sys/queue.h> |
76 | #include <sys/mcache.h> |
77 | #include <sys/priv.h> |
78 | #include <sys/protosw.h> |
79 | #include <sys/sdt.h> |
80 | #include <sys/kernel.h> |
81 | #include <kern/locks.h> |
82 | #include <kern/zalloc.h> |
83 | |
84 | #include <net/dlil.h> |
85 | #include <net/if.h> |
86 | #include <net/route.h> |
87 | #include <net/ntstat.h> |
88 | #include <net/nwk_wq.h> |
89 | #if NECP |
90 | #include <net/necp.h> |
91 | #endif /* NECP */ |
92 | |
93 | #include <netinet/in.h> |
94 | #include <netinet/in_var.h> |
95 | #include <netinet/ip_var.h> |
96 | #include <netinet/ip.h> |
97 | #include <netinet/ip6.h> |
98 | #include <netinet/in_arp.h> |
99 | |
100 | #include <netinet6/ip6_var.h> |
101 | #include <netinet6/in6_var.h> |
102 | #include <netinet6/nd6.h> |
103 | |
104 | #include <net/if_dl.h> |
105 | |
106 | #include <net/sockaddr_utils.h> |
107 | |
108 | #include <libkern/OSAtomic.h> |
109 | #include <libkern/OSDebug.h> |
110 | |
111 | #include <pexpert/pexpert.h> |
112 | |
113 | #if CONFIG_MACF |
114 | #include <sys/kauth.h> |
115 | #endif |
116 | |
117 | #include <sys/constrained_ctypes.h> |
118 | |
119 | /* |
120 | * Synchronization notes: |
121 | * |
122 | * Routing entries fall under two locking domains: the global routing table |
123 | * lock (rnh_lock) and the per-entry lock (rt_lock); the latter is a mutex that |
124 | * resides (statically defined) in the rtentry structure. |
125 | * |
126 | * The locking domains for routing are defined as follows: |
127 | * |
128 | * The global routing lock is used to serialize all accesses to the radix |
129 | * trees defined by rt_tables[], as well as the tree of masks. This includes |
130 | * lookups, insertions and removals of nodes to/from the respective tree. |
131 | * It is also used to protect certain fields in the route entry that aren't |
132 | * often modified and/or require global serialization (more details below.) |
133 | * |
134 | * The per-route entry lock is used to serialize accesses to several routing |
135 | * entry fields (more details below.) Acquiring and releasing this lock is |
136 | * done via RT_LOCK() and RT_UNLOCK() routines. |
137 | * |
138 | * In cases where both rnh_lock and rt_lock must be held, the former must be |
139 | * acquired first in order to maintain lock ordering. It is not a requirement |
140 | * that rnh_lock be acquired first before rt_lock, but in case both must be |
141 | * acquired in succession, the correct lock ordering must be followed. |
142 | * |
143 | * The fields of the rtentry structure are protected in the following way: |
144 | * |
145 | * rt_nodes[] |
146 | * |
147 | * - Routing table lock (rnh_lock). |
148 | * |
149 | * rt_parent, rt_mask, rt_llinfo_free, rt_tree_genid |
150 | * |
151 | * - Set once during creation and never changes; no locks to read. |
152 | * |
153 | * rt_flags, rt_genmask, rt_llinfo, rt_rmx, rt_refcnt, rt_gwroute |
154 | * |
155 | * - Routing entry lock (rt_lock) for read/write access. |
156 | * |
157 | * - Some values of rt_flags are either set once at creation time, |
158 | * or aren't currently used, and thus checking against them can |
159 | * be done without rt_lock: RTF_GATEWAY, RTF_HOST, RTF_DYNAMIC, |
160 | * RTF_DONE, RTF_XRESOLVE, RTF_STATIC, RTF_BLACKHOLE, RTF_ANNOUNCE, |
161 | * RTF_USETRAILERS, RTF_WASCLONED, RTF_PINNED, RTF_LOCAL, |
162 | * RTF_BROADCAST, RTF_MULTICAST, RTF_IFSCOPE, RTF_IFREF. |
163 | * |
164 | * rt_key, rt_gateway, rt_ifp, rt_ifa |
165 | * |
166 | * - Always written/modified with both rnh_lock and rt_lock held. |
167 | * |
168 | * - May be read freely with rnh_lock held, else must hold rt_lock |
169 | * for read access; holding both locks for read is also okay. |
170 | * |
171 | * - In the event rnh_lock is not acquired, or is not possible to be |
172 | * acquired across the operation, setting RTF_CONDEMNED on a route |
173 | * entry will prevent its rt_key, rt_gateway, rt_ifp and rt_ifa |
174 | * from being modified. This is typically done on a route that |
175 | * has been chosen for a removal (from the tree) prior to dropping |
176 | * the rt_lock, so that those values will remain the same until |
177 | * the route is freed. |
178 | * |
179 | * When rnh_lock is held rt_setgate(), rt_setif(), and rtsetifa() are |
180 | * single-threaded, thus exclusive. This flag will also prevent the |
181 | * route from being looked up via rt_lookup(). |
182 | * |
183 | * rt_genid |
184 | * |
185 | * - Assumes that 32-bit writes are atomic; no locks. |
186 | * |
187 | * rt_dlt, rt_output |
188 | * |
189 | * - Currently unused; no locks. |
190 | * |
191 | * Operations on a route entry can be described as follows: |
192 | * |
193 | * CREATE an entry with reference count set to 0 as part of RTM_ADD/RESOLVE. |
194 | * |
195 | * INSERTION of an entry into the radix tree holds the rnh_lock, checks |
196 | * for duplicates and then adds the entry. rtrequest returns the entry |
197 | * after bumping up the reference count to 1 (for the caller). |
198 | * |
199 | * LOOKUP of an entry holds the rnh_lock and bumps up the reference count |
200 | * before returning; it is valid to also bump up the reference count using |
201 | * RT_ADDREF after the lookup has returned an entry. |
202 | * |
203 | * REMOVAL of an entry from the radix tree holds the rnh_lock, removes the |
204 | * entry but does not decrement the reference count. Removal happens when |
205 | * the route is explicitly deleted (RTM_DELETE) or when it is in the cached |
206 | * state and it expires. The route is said to be "down" when it is no |
207 | * longer present in the tree. Freeing the entry will happen on the last |
208 | * reference release of such a "down" route. |
209 | * |
210 | * RT_ADDREF/RT_REMREF operates on the routing entry which increments/ |
211 | * decrements the reference count, rt_refcnt, atomically on the rtentry. |
212 | * rt_refcnt is modified only using this routine. The general rule is to |
213 | * do RT_ADDREF in the function that is passing the entry as an argument, |
214 | * in order to prevent the entry from being freed by the callee. |
215 | */ |
216 | extern void kdp_set_gateway_mac(void *gatewaymac); |
217 | |
218 | __private_extern__ struct rtstat rtstat = { |
219 | .rts_badredirect = 0, |
220 | .rts_dynamic = 0, |
221 | .rts_newgateway = 0, |
222 | .rts_unreach = 0, |
223 | .rts_wildcard = 0, |
224 | .rts_badrtgwroute = 0 |
225 | }; |
226 | struct radix_node_head *rt_tables[AF_MAX + 1]; |
227 | |
228 | static LCK_GRP_DECLARE(rnh_lock_grp, "route" ); |
229 | LCK_MTX_DECLARE(rnh_lock_data, &rnh_lock_grp); /* global routing tables mutex */ |
230 | |
231 | int rttrash = 0; /* routes not in table but not freed */ |
232 | |
233 | boolean_t trigger_v6_defrtr_select = FALSE; |
234 | unsigned int rte_debug = 0; |
235 | |
236 | /* Possible flags for rte_debug */ |
237 | #define RTD_DEBUG 0x1 /* enable or disable rtentry debug facility */ |
238 | #define RTD_TRACE 0x2 /* trace alloc, free, refcnt and lock */ |
239 | #define RTD_NO_FREE 0x4 /* don't free (good to catch corruptions) */ |
240 | |
241 | #define RTE_NAME "rtentry" /* name for zone and rt_lock */ |
242 | |
243 | static struct zone *rte_zone; /* special zone for rtentry */ |
244 | #define RTE_ZONE_MAX 65536 /* maximum elements in zone */ |
245 | #define RTE_ZONE_NAME RTE_NAME /* name of rtentry zone */ |
246 | |
247 | #define RTD_INUSE 0xFEEDFACE /* entry is in use */ |
248 | #define RTD_FREED 0xDEADBEEF /* entry is freed */ |
249 | |
250 | #define MAX_SCOPE_ADDR_STR_LEN (MAX_IPv6_STR_LEN + 6) |
251 | |
252 | /* Lock group and attribute for routing entry locks */ |
253 | static LCK_ATTR_DECLARE(rte_mtx_attr, 0, 0); |
254 | static LCK_GRP_DECLARE(rte_mtx_grp, RTE_NAME); |
255 | |
256 | /* For gdb */ |
257 | __private_extern__ unsigned int ctrace_stack_size = CTRACE_STACK_SIZE; |
258 | __private_extern__ unsigned int ctrace_hist_size = CTRACE_HIST_SIZE; |
259 | |
260 | /* |
261 | * Debug variant of rtentry structure. |
262 | */ |
263 | struct rtentry_dbg { |
264 | struct rtentry rtd_entry; /* rtentry */ |
265 | struct rtentry rtd_entry_saved; /* saved rtentry */ |
266 | uint32_t rtd_inuse; /* in use pattern */ |
267 | uint16_t rtd_refhold_cnt; /* # of rtref */ |
268 | uint16_t rtd_refrele_cnt; /* # of rtunref */ |
269 | uint32_t rtd_lock_cnt; /* # of locks */ |
270 | uint32_t rtd_unlock_cnt; /* # of unlocks */ |
271 | /* |
272 | * Alloc and free callers. |
273 | */ |
274 | ctrace_t rtd_alloc; |
275 | ctrace_t rtd_free; |
276 | /* |
277 | * Circular lists of rtref and rtunref callers. |
278 | */ |
279 | ctrace_t rtd_refhold[CTRACE_HIST_SIZE]; |
280 | ctrace_t rtd_refrele[CTRACE_HIST_SIZE]; |
281 | /* |
282 | * Circular lists of locks and unlocks. |
283 | */ |
284 | ctrace_t rtd_lock[CTRACE_HIST_SIZE]; |
285 | ctrace_t rtd_unlock[CTRACE_HIST_SIZE]; |
286 | /* |
287 | * Trash list linkage |
288 | */ |
289 | TAILQ_ENTRY(rtentry_dbg) rtd_trash_link; |
290 | }; |
291 | __CCT_DECLARE_CONSTRAINED_PTR_TYPES(struct rtentry_dbg, rtentry_dbg); |
292 | |
293 | /* List of trash route entries protected by rnh_lock */ |
294 | static TAILQ_HEAD(, rtentry_dbg) rttrash_head; |
295 | |
296 | static void rte_lock_init(struct rtentry *); |
297 | static void rte_lock_destroy(struct rtentry *); |
298 | static inline struct rtentry *rte_alloc_debug(void); |
299 | static inline void rte_free_debug(struct rtentry *); |
300 | static inline void rte_lock_debug(struct rtentry_dbg *); |
301 | static inline void rte_unlock_debug(struct rtentry_dbg *); |
302 | static void rt_maskedcopy(const struct sockaddr *, |
303 | struct sockaddr *, const struct sockaddr *); |
304 | static void rtable_init(void **); |
305 | static inline void rtref_audit(struct rtentry_dbg *); |
306 | static inline void rtunref_audit(struct rtentry_dbg *); |
307 | static struct rtentry *rtalloc1_common_locked(struct sockaddr *, int, uint32_t, |
308 | unsigned int); |
309 | static int rtrequest_common_locked(int, struct sockaddr *, |
310 | struct sockaddr *, struct sockaddr *, int, struct rtentry **, |
311 | unsigned int); |
312 | static struct rtentry *rtalloc1_locked(struct sockaddr *, int, uint32_t); |
313 | static void rtalloc_ign_common_locked(struct route *, uint32_t, unsigned int); |
314 | static inline void sin6_set_ifscope(struct sockaddr *, unsigned int); |
315 | static inline void sin6_set_embedded_ifscope(struct sockaddr *, unsigned int); |
316 | static inline unsigned int sin6_get_embedded_ifscope(struct sockaddr *); |
317 | static struct sockaddr *ma_copy(int, struct sockaddr *, |
318 | struct sockaddr_storage *, unsigned int); |
319 | static struct sockaddr *sa_trim(struct sockaddr *, uint8_t); |
320 | static struct radix_node *node_lookup(struct sockaddr *, struct sockaddr *, |
321 | unsigned int); |
322 | static struct radix_node *node_lookup_default(int); |
323 | static struct rtentry *rt_lookup_common(boolean_t, boolean_t, struct sockaddr *, |
324 | struct sockaddr *, struct radix_node_head *, unsigned int); |
325 | static int rn_match_ifscope(struct radix_node *, void *); |
326 | static struct ifaddr *ifa_ifwithroute_common_locked(int, |
327 | const struct sockaddr *, const struct sockaddr *, unsigned int); |
328 | static struct rtentry *rte_alloc(void); |
329 | static void rte_free(struct rtentry *); |
330 | static void rtfree_common(struct rtentry *, boolean_t); |
331 | static void rte_if_ref(struct ifnet *, int); |
332 | static void rt_set_idleref(struct rtentry *); |
333 | static void rt_clear_idleref(struct rtentry *); |
334 | static void rt_str4(struct rtentry *, char *, uint32_t, char *, uint32_t); |
335 | static void rt_str6(struct rtentry *, char *, uint32_t, char *, uint32_t); |
336 | static boolean_t route_ignore_protocol_cloning_for_dst(struct rtentry *, struct sockaddr *); |
337 | |
338 | uint32_t route_genid_inet = 0; |
339 | uint32_t route_genid_inet6 = 0; |
340 | |
341 | #define ASSERT_SINIFSCOPE(sa) { \ |
342 | if ((sa)->sa_family != AF_INET || \ |
343 | (sa)->sa_len < sizeof (struct sockaddr_in)) \ |
344 | panic("%s: bad sockaddr_in %p", __func__, sa); \ |
345 | } |
346 | |
347 | #define ASSERT_SIN6IFSCOPE(sa) { \ |
348 | if ((sa)->sa_family != AF_INET6 || \ |
349 | (sa)->sa_len < sizeof (struct sockaddr_in6)) \ |
350 | panic("%s: bad sockaddr_in6 %p", __func__, sa); \ |
351 | } |
352 | |
353 | /* |
354 | * Argument to leaf-matching routine; at present it is scoped routing |
355 | * specific but can be expanded in future to include other search filters. |
356 | */ |
357 | struct matchleaf_arg { |
358 | unsigned int ifscope; /* interface scope */ |
359 | }; |
360 | |
361 | /* |
362 | * For looking up the non-scoped default route (sockaddr instead |
363 | * of sockaddr_in for convenience). |
364 | */ |
365 | static struct sockaddr sin_def = { |
366 | .sa_len = sizeof(struct sockaddr_in), |
367 | .sa_family = AF_INET, |
368 | .sa_data = { 0, } |
369 | }; |
370 | |
371 | static struct sockaddr_in6 sin6_def = { |
372 | .sin6_len = sizeof(struct sockaddr_in6), |
373 | .sin6_family = AF_INET6, |
374 | .sin6_port = 0, |
375 | .sin6_flowinfo = 0, |
376 | .sin6_addr = IN6ADDR_ANY_INIT, |
377 | .sin6_scope_id = 0 |
378 | }; |
379 | |
380 | /* |
381 | * Interface index (scope) of the primary interface; determined at |
382 | * the time when the default, non-scoped route gets added, changed |
383 | * or deleted. Protected by rnh_lock. |
384 | */ |
385 | static unsigned int primary_ifscope = IFSCOPE_NONE; |
386 | static unsigned int primary6_ifscope = IFSCOPE_NONE; |
387 | |
388 | #define INET_DEFAULT(sa) \ |
389 | ((sa)->sa_family == AF_INET && SIN(sa)->sin_addr.s_addr == 0) |
390 | |
391 | #define INET6_DEFAULT(sa) \ |
392 | ((sa)->sa_family == AF_INET6 && \ |
393 | IN6_IS_ADDR_UNSPECIFIED(&SIN6(sa)->sin6_addr)) |
394 | |
395 | #define SA_DEFAULT(sa) (INET_DEFAULT(sa) || INET6_DEFAULT(sa)) |
396 | #define RT(r) ((rtentry_ref_t)r) |
397 | #define RN(r) ((struct radix_node *)r) |
398 | #define RT_HOST(r) (RT(r)->rt_flags & RTF_HOST) |
399 | |
400 | #define ROUTE_VERBOSE_LOGGING 0 |
401 | unsigned int rt_verbose = ROUTE_VERBOSE_LOGGING; |
402 | SYSCTL_DECL(_net_route); |
403 | SYSCTL_UINT(_net_route, OID_AUTO, verbose, CTLFLAG_RW | CTLFLAG_LOCKED, |
404 | &rt_verbose, ROUTE_VERBOSE_LOGGING, "" ); |
405 | |
406 | static void |
407 | rtable_init(void **table) |
408 | { |
409 | struct domain *dom; |
410 | |
411 | domain_proto_mtx_lock_assert_held(); |
412 | |
413 | TAILQ_FOREACH(dom, &domains, dom_entry) { |
414 | if (dom->dom_rtattach != NULL) { |
415 | dom->dom_rtattach(&table[dom->dom_family], |
416 | dom->dom_rtoffset); |
417 | } |
418 | } |
419 | } |
420 | |
421 | /* |
422 | * Called by route_dinit(). |
423 | */ |
424 | void |
425 | route_init(void) |
426 | { |
427 | int size; |
428 | |
429 | _CASSERT(offsetof(struct route, ro_rt) == |
430 | offsetof(struct route_in6, ro_rt)); |
431 | _CASSERT(offsetof(struct route, ro_srcia) == |
432 | offsetof(struct route_in6, ro_srcia)); |
433 | _CASSERT(offsetof(struct route, ro_flags) == |
434 | offsetof(struct route_in6, ro_flags)); |
435 | _CASSERT(offsetof(struct route, ro_dst) == |
436 | offsetof(struct route_in6, ro_dst)); |
437 | |
438 | PE_parse_boot_argn(arg_string: "rte_debug" , arg_ptr: &rte_debug, max_arg: sizeof(rte_debug)); |
439 | if (rte_debug != 0) { |
440 | rte_debug |= RTD_DEBUG; |
441 | } |
442 | |
443 | lck_mtx_lock(rnh_lock); |
444 | rn_init(); /* initialize all zeroes, all ones, mask table */ |
445 | lck_mtx_unlock(rnh_lock); |
446 | rtable_init(table: (void **)rt_tables); |
447 | |
448 | if (rte_debug & RTD_DEBUG) { |
449 | size = sizeof(struct rtentry_dbg); |
450 | } else { |
451 | size = sizeof(struct rtentry); |
452 | } |
453 | |
454 | rte_zone = zone_create(RTE_ZONE_NAME, size, flags: ZC_NONE); |
455 | |
456 | TAILQ_INIT(&rttrash_head); |
457 | } |
458 | |
459 | /* |
460 | * Given a route, determine whether or not it is the non-scoped default |
461 | * route; dst typically comes from rt_key(rt) but may be coming from |
462 | * a separate place when rt is in the process of being created. |
463 | */ |
464 | boolean_t |
465 | rt_primary_default(struct rtentry *rt, struct sockaddr *dst) |
466 | { |
467 | return SA_DEFAULT(dst) && !(rt->rt_flags & RTF_IFSCOPE); |
468 | } |
469 | |
470 | /* |
471 | * Set the ifscope of the primary interface; caller holds rnh_lock. |
472 | */ |
473 | void |
474 | set_primary_ifscope(int af, unsigned int ifscope) |
475 | { |
476 | if (af == AF_INET) { |
477 | primary_ifscope = ifscope; |
478 | } else { |
479 | primary6_ifscope = ifscope; |
480 | } |
481 | } |
482 | |
483 | /* |
484 | * Return the ifscope of the primary interface; caller holds rnh_lock. |
485 | */ |
486 | unsigned int |
487 | get_primary_ifscope(int af) |
488 | { |
489 | return af == AF_INET ? primary_ifscope : primary6_ifscope; |
490 | } |
491 | |
492 | /* |
493 | * Set the scope ID of a given a sockaddr_in. |
494 | */ |
495 | void |
496 | sin_set_ifscope(struct sockaddr *sa, unsigned int ifscope) |
497 | { |
498 | /* Caller must pass in sockaddr_in */ |
499 | ASSERT_SINIFSCOPE(sa); |
500 | |
501 | SINIFSCOPE(sa)->sin_scope_id = ifscope; |
502 | } |
503 | |
504 | /* |
505 | * Set the scope ID of given a sockaddr_in6. |
506 | */ |
507 | static inline void |
508 | sin6_set_ifscope(struct sockaddr *sa, unsigned int ifscope) |
509 | { |
510 | /* Caller must pass in sockaddr_in6 */ |
511 | ASSERT_SIN6IFSCOPE(sa); |
512 | |
513 | SIN6IFSCOPE(sa)->sin6_scope_id = ifscope; |
514 | } |
515 | |
516 | /* |
517 | * Given a sockaddr_in, return the scope ID to the caller. |
518 | */ |
519 | unsigned int |
520 | sin_get_ifscope(struct sockaddr *sa) |
521 | { |
522 | /* Caller must pass in sockaddr_in */ |
523 | ASSERT_SINIFSCOPE(sa); |
524 | |
525 | return SINIFSCOPE(sa)->sin_scope_id; |
526 | } |
527 | |
528 | /* |
529 | * Given a sockaddr_in6, return the scope ID to the caller. |
530 | */ |
531 | unsigned int |
532 | sin6_get_ifscope(struct sockaddr *sa) |
533 | { |
534 | /* Caller must pass in sockaddr_in6 */ |
535 | ASSERT_SIN6IFSCOPE(sa); |
536 | |
537 | return SIN6IFSCOPE(sa)->sin6_scope_id; |
538 | } |
539 | |
540 | static inline void |
541 | sin6_set_embedded_ifscope(struct sockaddr *sa, unsigned int ifscope) |
542 | { |
543 | if (!in6_embedded_scope) { |
544 | SIN6(sa)->sin6_scope_id = ifscope; |
545 | return; |
546 | } |
547 | |
548 | /* Caller must pass in sockaddr_in6 */ |
549 | ASSERT_SIN6IFSCOPE(sa); |
550 | VERIFY(IN6_IS_SCOPE_EMBED(&(SIN6(sa)->sin6_addr))); |
551 | |
552 | SIN6(sa)->sin6_addr.s6_addr16[1] = htons((uint16_t)ifscope); |
553 | } |
554 | |
555 | static inline unsigned int |
556 | sin6_get_embedded_ifscope(struct sockaddr *sa) |
557 | { |
558 | if (!in6_embedded_scope) { |
559 | return SIN6(sa)->sin6_scope_id; |
560 | } |
561 | /* Caller must pass in sockaddr_in6 */ |
562 | ASSERT_SIN6IFSCOPE(sa); |
563 | |
564 | return ntohs(SIN6(sa)->sin6_addr.s6_addr16[1]); |
565 | } |
566 | |
567 | /* |
568 | * Copy a sockaddr_{in,in6} src to a dst storage and set scope ID into dst. |
569 | * |
570 | * To clear the scope ID, pass is a NULL pifscope. To set the scope ID, pass |
571 | * in a non-NULL pifscope with non-zero ifscope. Otherwise if pifscope is |
572 | * non-NULL and ifscope is IFSCOPE_NONE, the existing scope ID is left intact. |
573 | * In any case, the effective scope ID value is returned to the caller via |
574 | * pifscope, if it is non-NULL. |
575 | */ |
576 | struct sockaddr * |
577 | sa_copy(struct sockaddr *src, struct sockaddr_storage *dst, |
578 | unsigned int *pifscope) |
579 | { |
580 | int af = src->sa_family; |
581 | unsigned int ifscope = (pifscope != NULL) ? *pifscope : IFSCOPE_NONE; |
582 | |
583 | VERIFY(af == AF_INET || af == AF_INET6); |
584 | |
585 | bzero(s: dst, n: sizeof(*dst)); |
586 | |
587 | if (af == AF_INET) { |
588 | SOCKADDR_COPY(src, dst, sizeof(struct sockaddr_in)); |
589 | dst->ss_len = sizeof(struct sockaddr_in); |
590 | if (pifscope == NULL || ifscope != IFSCOPE_NONE) { |
591 | sin_set_ifscope(SA(dst), ifscope); |
592 | } |
593 | } else { |
594 | SOCKADDR_COPY(src, dst, sizeof(struct sockaddr_in6)); |
595 | dst->ss_len = sizeof(struct sockaddr_in6); |
596 | if (pifscope != NULL && |
597 | IN6_IS_SCOPE_EMBED(&SIN6(dst)->sin6_addr)) { |
598 | unsigned int eifscope; |
599 | /* |
600 | * If the address contains the embedded scope ID, |
601 | * use that as the value for sin6_scope_id as long |
602 | * the caller doesn't insist on clearing it (by |
603 | * passing NULL) or setting it. |
604 | */ |
605 | eifscope = sin6_get_embedded_ifscope(SA(dst)); |
606 | if (eifscope != IFSCOPE_NONE && ifscope == IFSCOPE_NONE) { |
607 | ifscope = eifscope; |
608 | } |
609 | if (ifscope != IFSCOPE_NONE) { |
610 | /* Set ifscope from pifscope or eifscope */ |
611 | sin6_set_ifscope(SA(dst), ifscope); |
612 | } else { |
613 | /* If sin6_scope_id has a value, use that one */ |
614 | ifscope = sin6_get_ifscope(SA(dst)); |
615 | } |
616 | /* |
617 | * If sin6_scope_id is set but the address doesn't |
618 | * contain the equivalent embedded value, set it. |
619 | */ |
620 | if (ifscope != IFSCOPE_NONE && eifscope != ifscope) { |
621 | sin6_set_embedded_ifscope(SA(dst), ifscope); |
622 | } |
623 | } else if (pifscope == NULL || ifscope != IFSCOPE_NONE) { |
624 | sin6_set_ifscope(SA(dst), ifscope); |
625 | } |
626 | } |
627 | |
628 | if (pifscope != NULL) { |
629 | *pifscope = (af == AF_INET) ? sin_get_ifscope(SA(dst)) : |
630 | sin6_get_ifscope(SA(dst)); |
631 | } |
632 | |
633 | return SA(dst); |
634 | } |
635 | |
636 | /* |
637 | * Copy a mask from src to a dst storage and set scope ID into dst. |
638 | */ |
639 | static struct sockaddr * |
640 | ma_copy(int af, struct sockaddr *src, struct sockaddr_storage *dst, |
641 | unsigned int ifscope) |
642 | { |
643 | VERIFY(af == AF_INET || af == AF_INET6); |
644 | |
645 | bzero(s: dst, n: sizeof(*dst)); |
646 | rt_maskedcopy(src, SA(dst), src); |
647 | |
648 | /* |
649 | * The length of the mask sockaddr would need to be adjusted |
650 | * to cover the additional {sin,sin6}_ifscope field; when ifscope |
651 | * is IFSCOPE_NONE, we'd end up clearing the scope ID field on |
652 | * the destination mask in addition to extending the length |
653 | * of the sockaddr, as a side effect. This is okay, as any |
654 | * trailing zeroes would be skipped by rn_addmask prior to |
655 | * inserting or looking up the mask in the mask tree. |
656 | */ |
657 | if (af == AF_INET) { |
658 | SINIFSCOPE(dst)->sin_scope_id = ifscope; |
659 | SINIFSCOPE(dst)->sin_len = |
660 | offsetof(struct sockaddr_inifscope, sin_scope_id) + |
661 | sizeof(SINIFSCOPE(dst)->sin_scope_id); |
662 | } else { |
663 | SIN6IFSCOPE(dst)->sin6_scope_id = ifscope; |
664 | SIN6IFSCOPE(dst)->sin6_len = |
665 | offsetof(struct sockaddr_in6, sin6_scope_id) + |
666 | sizeof(SIN6IFSCOPE(dst)->sin6_scope_id); |
667 | } |
668 | |
669 | return SA(dst); |
670 | } |
671 | |
672 | /* |
673 | * Trim trailing zeroes on a sockaddr and update its length. |
674 | */ |
675 | static struct sockaddr * |
676 | sa_trim(struct sockaddr *sa, uint8_t skip) |
677 | { |
678 | caddr_t cp; |
679 | caddr_t base = (caddr_t)__SA_UTILS_CONV_TO_BYTES(sa) + skip; |
680 | |
681 | if (sa->sa_len <= skip) { |
682 | return sa; |
683 | } |
684 | |
685 | for (cp = base + (sa->sa_len - skip); cp > base && cp[-1] == 0;) { |
686 | cp--; |
687 | } |
688 | |
689 | sa->sa_len = (uint8_t)(cp - base) + skip; |
690 | if (sa->sa_len < skip) { |
691 | /* Must not happen, and if so, panic */ |
692 | panic("%s: broken logic (sa_len %d < skip %d )" , __func__, |
693 | sa->sa_len, skip); |
694 | /* NOTREACHED */ |
695 | } else if (sa->sa_len == skip) { |
696 | /* If we end up with all zeroes, then there's no mask */ |
697 | sa->sa_len = 0; |
698 | } |
699 | |
700 | return sa; |
701 | } |
702 | |
703 | /* |
704 | * Called by rtm_msg{1,2} routines to "scrub" socket address structures of |
705 | * kernel private information, so that clients of the routing socket will |
706 | * not be confused by the presence of the information, or the side effect of |
707 | * the increased length due to that. The source sockaddr is not modified; |
708 | * instead, the scrubbing happens on the destination sockaddr storage that |
709 | * is passed in by the caller. |
710 | * |
711 | * Scrubbing entails: |
712 | * - removing embedded scope identifiers from network mask and destination |
713 | * IPv4 and IPv6 socket addresses |
714 | * - optionally removing global scope interface hardware addresses from |
715 | * link-layer interface addresses when the MAC framework check fails. |
716 | */ |
717 | struct sockaddr * |
718 | rtm_scrub(int type, int idx, struct sockaddr *hint, struct sockaddr *sa, |
719 | void *buf __sized_by(buflen), uint32_t buflen, kauth_cred_t *credp) |
720 | { |
721 | struct sockaddr_storage *ss = (struct sockaddr_storage *)buf; |
722 | struct sockaddr *ret = sa; |
723 | |
724 | VERIFY(buf != NULL && buflen >= sizeof(*ss)); |
725 | bzero(s: buf, n: buflen); |
726 | |
727 | switch (idx) { |
728 | case RTAX_DST: |
729 | /* |
730 | * If this is for an AF_INET/AF_INET6 destination address, |
731 | * call sa_copy() to clear the scope ID field. |
732 | */ |
733 | if (sa->sa_family == AF_INET && |
734 | SINIFSCOPE(sa)->sin_scope_id != IFSCOPE_NONE) { |
735 | ret = sa_copy(src: sa, dst: ss, NULL); |
736 | } else if (sa->sa_family == AF_INET6 && |
737 | SIN6IFSCOPE(sa)->sin6_scope_id != IFSCOPE_NONE) { |
738 | ret = sa_copy(src: sa, dst: ss, NULL); |
739 | } |
740 | break; |
741 | |
742 | case RTAX_NETMASK: { |
743 | uint8_t skip, af; |
744 | /* |
745 | * If this is for a mask, we can't tell whether or not there |
746 | * is an valid scope ID value, as the span of bytes between |
747 | * sa_len and the beginning of the mask (offset of sin_addr in |
748 | * the case of AF_INET, or sin6_addr for AF_INET6) may be |
749 | * filled with all-ones by rn_addmask(), and hence we cannot |
750 | * rely on sa_family. Because of this, we use the sa_family |
751 | * of the hint sockaddr (RTAX_{DST,IFA}) as indicator as to |
752 | * whether or not the mask is to be treated as one for AF_INET |
753 | * or AF_INET6. Clearing the scope ID field involves setting |
754 | * it to IFSCOPE_NONE followed by calling sa_trim() to trim |
755 | * trailing zeroes from the storage sockaddr, which reverses |
756 | * what was done earlier by ma_copy() on the source sockaddr. |
757 | */ |
758 | if (hint == NULL || |
759 | ((af = hint->sa_family) != AF_INET && af != AF_INET6)) { |
760 | break; /* nothing to do */ |
761 | } |
762 | skip = (af == AF_INET) ? |
763 | offsetof(struct sockaddr_in, sin_addr) : |
764 | offsetof(struct sockaddr_in6, sin6_addr); |
765 | |
766 | if (sa->sa_len > skip && sa->sa_len <= sizeof(*ss)) { |
767 | SOCKADDR_COPY(sa, ss, sa->sa_len); |
768 | /* |
769 | * Don't use {sin,sin6}_set_ifscope() as sa_family |
770 | * and sa_len for the netmask might not be set to |
771 | * the corresponding expected values of the hint. |
772 | */ |
773 | if (hint->sa_family == AF_INET) { |
774 | SINIFSCOPE(ss)->sin_scope_id = IFSCOPE_NONE; |
775 | } else { |
776 | SIN6IFSCOPE(ss)->sin6_scope_id = IFSCOPE_NONE; |
777 | } |
778 | ret = sa_trim(SA(ss), skip); |
779 | |
780 | /* |
781 | * For AF_INET6 mask, set sa_len appropriately unless |
782 | * this is requested via systl_dumpentry(), in which |
783 | * case we return the raw value. |
784 | */ |
785 | if (hint->sa_family == AF_INET6 && |
786 | type != RTM_GET && type != RTM_GET2) { |
787 | SA(ret)->sa_len = sizeof(struct sockaddr_in6); |
788 | } |
789 | } |
790 | break; |
791 | } |
792 | case RTAX_GATEWAY: { |
793 | /* |
794 | * Break if the gateway is not AF_LINK type (indirect routes) |
795 | * |
796 | * Else, if is, check if it is resolved. If not yet resolved |
797 | * simply break else scrub the link layer address. |
798 | */ |
799 | if ((sa->sa_family != AF_LINK) || (SDL(sa)->sdl_alen == 0)) { |
800 | break; |
801 | } |
802 | OS_FALLTHROUGH; |
803 | } |
804 | |
805 | case RTAX_IFP: { |
806 | if (sa->sa_family == AF_LINK && credp) { |
807 | struct sockaddr_dl *sdl = SDL(buf); |
808 | const void *bytes; |
809 | size_t size; |
810 | |
811 | /* caller should handle worst case: SOCK_MAXADDRLEN */ |
812 | VERIFY(buflen >= sa->sa_len); |
813 | |
814 | SOCKADDR_COPY(sa, sdl, sa->sa_len); |
815 | bytes = dlil_ifaddr_bytes(sdl, &size, credp); |
816 | if (bytes != CONST_LLADDR(sdl)) { |
817 | VERIFY(sdl->sdl_alen == size); |
818 | bcopy(src: bytes, LLADDR(sdl), n: size); |
819 | } |
820 | ret = SA(sdl); |
821 | } |
822 | break; |
823 | } |
824 | default: |
825 | break; |
826 | } |
827 | |
828 | return ret; |
829 | } |
830 | |
831 | /* |
832 | * Callback leaf-matching routine for rn_matchaddr_args used |
833 | * for looking up an exact match for a scoped route entry. |
834 | */ |
835 | static int |
836 | rn_match_ifscope(struct radix_node *rn, void *arg) |
837 | { |
838 | rtentry_ref_t rt = (rtentry_ref_t)rn; |
839 | struct matchleaf_arg *ma = arg; |
840 | int af = rt_key(rt)->sa_family; |
841 | |
842 | if (!(rt->rt_flags & RTF_IFSCOPE) || (af != AF_INET && af != AF_INET6)) { |
843 | return 0; |
844 | } |
845 | |
846 | return af == AF_INET ? |
847 | (SINIFSCOPE(rt_key(rt))->sin_scope_id == ma->ifscope) : |
848 | (SIN6IFSCOPE(rt_key(rt))->sin6_scope_id == ma->ifscope); |
849 | } |
850 | |
851 | /* |
852 | * Atomically increment route generation counter |
853 | */ |
854 | void |
855 | routegenid_update(void) |
856 | { |
857 | routegenid_inet_update(); |
858 | routegenid_inet6_update(); |
859 | } |
860 | |
861 | void |
862 | routegenid_inet_update(void) |
863 | { |
864 | os_atomic_inc(&route_genid_inet, relaxed); |
865 | } |
866 | |
867 | void |
868 | routegenid_inet6_update(void) |
869 | { |
870 | os_atomic_inc(&route_genid_inet6, relaxed); |
871 | } |
872 | |
873 | /* |
874 | * Packet routing routines. |
875 | */ |
876 | void |
877 | rtalloc(struct route *ro) |
878 | { |
879 | rtalloc_ign(ro, 0); |
880 | } |
881 | |
882 | void |
883 | rtalloc_scoped(struct route *ro, unsigned int ifscope) |
884 | { |
885 | rtalloc_scoped_ign(ro, 0, ifscope); |
886 | } |
887 | |
888 | static void |
889 | rtalloc_ign_common_locked(struct route *ro, uint32_t ignore, |
890 | unsigned int ifscope) |
891 | { |
892 | rtentry_ref_t rt; |
893 | |
894 | if ((rt = ro->ro_rt) != NULL) { |
895 | RT_LOCK_SPIN(rt); |
896 | if (rt->rt_ifp != NULL && !ROUTE_UNUSABLE(ro)) { |
897 | RT_UNLOCK(rt); |
898 | return; |
899 | } |
900 | RT_UNLOCK(rt); |
901 | ROUTE_RELEASE_LOCKED(ro); /* rnh_lock already held */ |
902 | } |
903 | ro->ro_rt = rtalloc1_common_locked(SA(&ro->ro_dst), 1, ignore, ifscope); |
904 | if (ro->ro_rt != NULL) { |
905 | RT_GENID_SYNC(ro->ro_rt); |
906 | RT_LOCK_ASSERT_NOTHELD(ro->ro_rt); |
907 | } |
908 | } |
909 | |
910 | void |
911 | rtalloc_ign(struct route *ro, uint32_t ignore) |
912 | { |
913 | LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_NOTOWNED); |
914 | lck_mtx_lock(rnh_lock); |
915 | rtalloc_ign_common_locked(ro, ignore, IFSCOPE_NONE); |
916 | lck_mtx_unlock(rnh_lock); |
917 | } |
918 | |
919 | void |
920 | rtalloc_scoped_ign(struct route *ro, uint32_t ignore, unsigned int ifscope) |
921 | { |
922 | LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_NOTOWNED); |
923 | lck_mtx_lock(rnh_lock); |
924 | rtalloc_ign_common_locked(ro, ignore, ifscope); |
925 | lck_mtx_unlock(rnh_lock); |
926 | } |
927 | |
928 | static struct rtentry * |
929 | rtalloc1_locked(struct sockaddr *dst, int report, uint32_t ignflags) |
930 | { |
931 | return rtalloc1_common_locked(dst, report, ignflags, IFSCOPE_NONE); |
932 | } |
933 | |
934 | struct rtentry * |
935 | rtalloc1_scoped_locked(struct sockaddr *dst, int report, uint32_t ignflags, |
936 | unsigned int ifscope) |
937 | { |
938 | return rtalloc1_common_locked(dst, report, ignflags, ifscope); |
939 | } |
940 | |
941 | static boolean_t |
942 | route_ignore_protocol_cloning_for_dst(struct rtentry *rt, struct sockaddr *dst) |
943 | { |
944 | /* |
945 | * For now keep protocol cloning for any type of IPv4 |
946 | * destination. |
947 | */ |
948 | if (dst->sa_family != AF_INET6) { |
949 | return FALSE; |
950 | } |
951 | |
952 | /* |
953 | * Limit protocol route creation of IPv6 ULA destinations |
954 | * from default route, |
955 | * Just to be safe, even though it doesn't affect routability, |
956 | * still allow protocol cloned routes if we happen to hit |
957 | * default route over companion link for ULA destination. |
958 | */ |
959 | if (!IFNET_IS_COMPANION_LINK(rt->rt_ifp) && |
960 | (rt->rt_flags & RTF_GATEWAY) && |
961 | (rt->rt_flags & RTF_PRCLONING) && |
962 | SA_DEFAULT(rt_key(rt)) && |
963 | (IN6_IS_ADDR_UNIQUE_LOCAL(&SIN6(dst)->sin6_addr) || IN6_IS_SCOPE_EMBED(&SIN6(dst)->sin6_addr))) { |
964 | return TRUE; |
965 | } |
966 | return FALSE; |
967 | } |
968 | |
969 | struct rtentry * |
970 | rtalloc1_common_locked(struct sockaddr *dst, int report, uint32_t ignflags, |
971 | unsigned int ifscope) |
972 | { |
973 | struct radix_node_head *rnh = rt_tables[dst->sa_family]; |
974 | rtentry_ref_t rt = NULL; |
975 | rtentry_ref_t newrt = NULL; |
976 | struct rt_addrinfo info; |
977 | uint32_t nflags; |
978 | int err = 0; |
979 | u_char msgtype = RTM_MISS; |
980 | |
981 | if (rnh == NULL) { |
982 | goto unreachable; |
983 | } |
984 | |
985 | if (!in6_embedded_scope && dst->sa_family == AF_INET6) { |
986 | if (IN6_IS_SCOPE_EMBED(&SIN6(dst)->sin6_addr) && |
987 | SIN6(dst)->sin6_scope_id == 0) { |
988 | SIN6(dst)->sin6_scope_id = ifscope; |
989 | } |
990 | } |
991 | |
992 | /* |
993 | * Find the longest prefix or exact (in the scoped case) address match; |
994 | * callee adds a reference to entry and checks for root node as well |
995 | */ |
996 | rt = rt_lookup(FALSE, dst, NULL, rnh, ifscope); |
997 | if (rt == NULL) { |
998 | goto unreachable; |
999 | } |
1000 | |
1001 | /* |
1002 | * Explicitly ignore protocol cloning for certain destinations. |
1003 | * Some checks below are kind of redundant, as for now, RTF_PRCLONING |
1004 | * is only set on indirect (RTF_GATEWAY) routes. |
1005 | * Also, we do this only when the route lookup above, resulted in default |
1006 | * route. |
1007 | * This is done to ensure, the resulting indirect host route doesn't |
1008 | * interfere when routing table gets configured with a indirect subnet |
1009 | * route/direct subnet route that is more specific than the current |
1010 | * parent route of the resulting protocol cloned route. |
1011 | * |
1012 | * At the crux of it all, it is a problem that we maintain host cache |
1013 | * in the routing table. We should revisit this for a generic solution. |
1014 | */ |
1015 | if (route_ignore_protocol_cloning_for_dst(rt, dst)) { |
1016 | ignflags |= RTF_PRCLONING; |
1017 | } |
1018 | |
1019 | RT_LOCK_SPIN(rt); |
1020 | newrt = rt; |
1021 | nflags = rt->rt_flags & ~ignflags; |
1022 | RT_UNLOCK(rt); |
1023 | |
1024 | if (report && (nflags & (RTF_CLONING | RTF_PRCLONING))) { |
1025 | /* |
1026 | * We are apparently adding (report = 0 in delete). |
1027 | * If it requires that it be cloned, do so. |
1028 | * (This implies it wasn't a HOST route.) |
1029 | */ |
1030 | err = rtrequest_locked(RTM_RESOLVE, dst, NULL, NULL, 0, &newrt); |
1031 | if (err) { |
1032 | /* |
1033 | * If the cloning didn't succeed, maybe what we |
1034 | * have from lookup above will do. Return that; |
1035 | * no need to hold another reference since it's |
1036 | * already done. |
1037 | */ |
1038 | newrt = rt; |
1039 | goto miss; |
1040 | } |
1041 | |
1042 | /* |
1043 | * We cloned it; drop the original route found during lookup. |
1044 | * The resulted cloned route (newrt) would now have an extra |
1045 | * reference held during rtrequest. |
1046 | */ |
1047 | rtfree_locked(rt); |
1048 | |
1049 | /* |
1050 | * If the newly created cloned route is a direct host route |
1051 | * then also check if it is to a router or not. |
1052 | * If it is, then set the RTF_ROUTER flag on the host route |
1053 | * for the gateway. |
1054 | * |
1055 | * XXX It is possible for the default route to be created post |
1056 | * cloned route creation of router's IP. |
1057 | * We can handle that corner case by special handing for RTM_ADD |
1058 | * of default route. |
1059 | */ |
1060 | if ((newrt->rt_flags & (RTF_HOST | RTF_LLINFO)) == |
1061 | (RTF_HOST | RTF_LLINFO)) { |
1062 | rtentry_ref_t defrt = NULL; |
1063 | struct sockaddr_storage def_key; |
1064 | |
1065 | bzero(s: &def_key, n: sizeof(def_key)); |
1066 | def_key.ss_len = rt_key(newrt)->sa_len; |
1067 | def_key.ss_family = rt_key(newrt)->sa_family; |
1068 | |
1069 | defrt = rtalloc1_scoped_locked(SA(&def_key), |
1070 | report: 0, ignflags: 0, ifscope: newrt->rt_ifp->if_index); |
1071 | |
1072 | if (defrt) { |
1073 | if (sa_equal(rt_key(newrt), defrt->rt_gateway)) { |
1074 | newrt->rt_flags |= RTF_ROUTER; |
1075 | } |
1076 | rtfree_locked(defrt); |
1077 | } |
1078 | } |
1079 | |
1080 | if ((rt = newrt) && (rt->rt_flags & RTF_XRESOLVE)) { |
1081 | /* |
1082 | * If the new route specifies it be |
1083 | * externally resolved, then go do that. |
1084 | */ |
1085 | msgtype = RTM_RESOLVE; |
1086 | goto miss; |
1087 | } |
1088 | } |
1089 | goto done; |
1090 | |
1091 | unreachable: |
1092 | /* |
1093 | * Either we hit the root or couldn't find any match, |
1094 | * Which basically means "cant get there from here" |
1095 | */ |
1096 | rtstat.rts_unreach++; |
1097 | |
1098 | miss: |
1099 | if (report) { |
1100 | /* |
1101 | * If required, report the failure to the supervising |
1102 | * Authorities. |
1103 | * For a delete, this is not an error. (report == 0) |
1104 | */ |
1105 | bzero(s: (caddr_t)&info, n: sizeof(info)); |
1106 | info.rti_info[RTAX_DST] = dst; |
1107 | rt_missmsg(msgtype, &info, 0, err); |
1108 | } |
1109 | done: |
1110 | return newrt; |
1111 | } |
1112 | |
1113 | struct rtentry * |
1114 | rtalloc1(struct sockaddr *dst, int report, uint32_t ignflags) |
1115 | { |
1116 | rtentry_ref_t entry; |
1117 | LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_NOTOWNED); |
1118 | lck_mtx_lock(rnh_lock); |
1119 | entry = rtalloc1_locked(dst, report, ignflags); |
1120 | lck_mtx_unlock(rnh_lock); |
1121 | return entry; |
1122 | } |
1123 | |
1124 | struct rtentry * |
1125 | rtalloc1_scoped(struct sockaddr *dst, int report, uint32_t ignflags, |
1126 | unsigned int ifscope) |
1127 | { |
1128 | rtentry_ref_t entry; |
1129 | LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_NOTOWNED); |
1130 | lck_mtx_lock(rnh_lock); |
1131 | entry = rtalloc1_scoped_locked(dst, report, ignflags, ifscope); |
1132 | lck_mtx_unlock(rnh_lock); |
1133 | return entry; |
1134 | } |
1135 | |
1136 | /* |
1137 | * Remove a reference count from an rtentry. |
1138 | * If the count gets low enough, take it out of the routing table |
1139 | */ |
1140 | void |
1141 | rtfree_locked(struct rtentry *rt) |
1142 | { |
1143 | rtfree_common(rt, TRUE); |
1144 | } |
1145 | |
1146 | static void |
1147 | rtfree_common(struct rtentry *rt, boolean_t locked) |
1148 | { |
1149 | struct radix_node_head *rnh; |
1150 | |
1151 | LCK_MTX_ASSERT(rnh_lock, locked ? |
1152 | LCK_MTX_ASSERT_OWNED : LCK_MTX_ASSERT_NOTOWNED); |
1153 | |
1154 | /* |
1155 | * Atomically decrement the reference count and if it reaches 0, |
1156 | * and there is a close function defined, call the close function. |
1157 | */ |
1158 | RT_LOCK_SPIN(rt); |
1159 | if (rtunref(rt) > 0) { |
1160 | RT_UNLOCK(rt); |
1161 | return; |
1162 | } |
1163 | |
1164 | /* |
1165 | * To avoid violating lock ordering, we must drop rt_lock before |
1166 | * trying to acquire the global rnh_lock. If we are called with |
1167 | * rnh_lock held, then we already have exclusive access; otherwise |
1168 | * we do the lock dance. |
1169 | */ |
1170 | if (!locked) { |
1171 | /* |
1172 | * Note that we check it again below after grabbing rnh_lock, |
1173 | * since it is possible that another thread doing a lookup wins |
1174 | * the race, grabs the rnh_lock first, and bumps up reference |
1175 | * count in which case the route should be left alone as it is |
1176 | * still in use. It's also possible that another thread frees |
1177 | * the route after we drop rt_lock; to prevent the route from |
1178 | * being freed, we hold an extra reference. |
1179 | */ |
1180 | RT_ADDREF_LOCKED(rt); |
1181 | RT_UNLOCK(rt); |
1182 | lck_mtx_lock(rnh_lock); |
1183 | RT_LOCK_SPIN(rt); |
1184 | if (rtunref(rt) > 0) { |
1185 | /* We've lost the race, so abort */ |
1186 | RT_UNLOCK(rt); |
1187 | goto done; |
1188 | } |
1189 | } |
1190 | |
1191 | /* |
1192 | * We may be blocked on other lock(s) as part of freeing |
1193 | * the entry below, so convert from spin to full mutex. |
1194 | */ |
1195 | RT_CONVERT_LOCK(rt); |
1196 | |
1197 | LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED); |
1198 | |
1199 | /* Negative refcnt must never happen */ |
1200 | if (rt->rt_refcnt != 0) { |
1201 | panic("rt %p invalid refcnt %d" , rt, rt->rt_refcnt); |
1202 | /* NOTREACHED */ |
1203 | } |
1204 | /* Idle refcnt must have been dropped during rtunref() */ |
1205 | VERIFY(!(rt->rt_flags & RTF_IFREF)); |
1206 | |
1207 | /* |
1208 | * find the tree for that address family |
1209 | * Note: in the case of igmp packets, there might not be an rnh |
1210 | */ |
1211 | rnh = rt_tables[rt_key(rt)->sa_family]; |
1212 | |
1213 | /* |
1214 | * On last reference give the "close method" a chance to cleanup |
1215 | * private state. This also permits (for IPv4 and IPv6) a chance |
1216 | * to decide if the routing table entry should be purged immediately |
1217 | * or at a later time. When an immediate purge is to happen the |
1218 | * close routine typically issues RTM_DELETE which clears the RTF_UP |
1219 | * flag on the entry so that the code below reclaims the storage. |
1220 | */ |
1221 | if (rnh != NULL && rnh->rnh_close != NULL) { |
1222 | rnh->rnh_close((struct radix_node *)rt, rnh); |
1223 | } |
1224 | |
1225 | /* |
1226 | * If we are no longer "up" (and ref == 0) then we can free the |
1227 | * resources associated with the route. |
1228 | */ |
1229 | if (!(rt->rt_flags & RTF_UP)) { |
1230 | rtentry_ref_t rt_parent; |
1231 | struct ifaddr *rt_ifa; |
1232 | |
1233 | rt->rt_flags |= RTF_DEAD; |
1234 | if (rt->rt_nodes->rn_flags & (RNF_ACTIVE | RNF_ROOT)) { |
1235 | panic("rt %p freed while in radix tree" , rt); |
1236 | /* NOTREACHED */ |
1237 | } |
1238 | /* |
1239 | * the rtentry must have been removed from the routing table |
1240 | * so it is represented in rttrash; remove that now. |
1241 | */ |
1242 | (void) OSDecrementAtomic(&rttrash); |
1243 | if (rte_debug & RTD_DEBUG) { |
1244 | TAILQ_REMOVE(&rttrash_head, (rtentry_dbg_ref_t)rt, |
1245 | rtd_trash_link); |
1246 | } |
1247 | |
1248 | /* |
1249 | * release references on items we hold them on.. |
1250 | * e.g other routes and ifaddrs. |
1251 | */ |
1252 | if ((rt_parent = rt->rt_parent) != NULL) { |
1253 | rt->rt_parent = NULL; |
1254 | } |
1255 | |
1256 | if ((rt_ifa = rt->rt_ifa) != NULL) { |
1257 | rt->rt_ifa = NULL; |
1258 | } |
1259 | |
1260 | /* |
1261 | * Now free any attached link-layer info. |
1262 | */ |
1263 | if (rt->rt_llinfo != NULL) { |
1264 | VERIFY(rt->rt_llinfo_free != NULL); |
1265 | (*rt->rt_llinfo_free)(rt->rt_llinfo); |
1266 | rt->rt_llinfo = NULL; |
1267 | } |
1268 | |
1269 | /* Destroy eventhandler lists context */ |
1270 | eventhandler_lists_ctxt_destroy(evthdlr_lists_ctxt: &rt->rt_evhdlr_ctxt); |
1271 | |
1272 | /* |
1273 | * Route is no longer in the tree and refcnt is 0; |
1274 | * we have exclusive access, so destroy it. |
1275 | */ |
1276 | RT_UNLOCK(rt); |
1277 | rte_lock_destroy(rt); |
1278 | |
1279 | if (rt_parent != NULL) { |
1280 | rtfree_locked(rt: rt_parent); |
1281 | } |
1282 | |
1283 | if (rt_ifa != NULL) { |
1284 | ifa_remref(ifa: rt_ifa); |
1285 | } |
1286 | |
1287 | /* |
1288 | * The key is separately alloc'd so free it (see rt_setgate()). |
1289 | * This also frees the gateway, as they are always malloc'd |
1290 | * together. |
1291 | */ |
1292 | rt_key_free(rt); |
1293 | |
1294 | /* |
1295 | * Free any statistics that may have been allocated |
1296 | */ |
1297 | nstat_route_detach(rte: rt); |
1298 | |
1299 | /* |
1300 | * and the rtentry itself of course |
1301 | */ |
1302 | rte_free(rt); |
1303 | } else { |
1304 | /* |
1305 | * The "close method" has been called, but the route is |
1306 | * still in the radix tree with zero refcnt, i.e. "up" |
1307 | * and in the cached state. |
1308 | */ |
1309 | RT_UNLOCK(rt); |
1310 | } |
1311 | done: |
1312 | if (!locked) { |
1313 | lck_mtx_unlock(rnh_lock); |
1314 | } |
1315 | } |
1316 | |
1317 | void |
1318 | rtfree(struct rtentry *rt) |
1319 | { |
1320 | rtfree_common(rt, FALSE); |
1321 | } |
1322 | |
1323 | /* |
1324 | * Decrements the refcount but does not free the route when |
1325 | * the refcount reaches zero. Unless you have really good reason, |
1326 | * use rtfree not rtunref. |
1327 | */ |
1328 | int |
1329 | rtunref(struct rtentry *p) |
1330 | { |
1331 | RT_LOCK_ASSERT_HELD(p); |
1332 | |
1333 | if (p->rt_refcnt == 0) { |
1334 | panic("%s(%p) bad refcnt" , __func__, p); |
1335 | /* NOTREACHED */ |
1336 | } else if (--p->rt_refcnt == 0) { |
1337 | /* |
1338 | * Release any idle reference count held on the interface; |
1339 | * if the route is eligible, still UP and the refcnt becomes |
1340 | * non-zero at some point in future before it is purged from |
1341 | * the routing table, rt_set_idleref() will undo this. |
1342 | */ |
1343 | rt_clear_idleref(p); |
1344 | } |
1345 | |
1346 | if (rte_debug & RTD_DEBUG) { |
1347 | rtunref_audit((rtentry_dbg_ref_t)p); |
1348 | } |
1349 | |
1350 | /* Return new value */ |
1351 | return p->rt_refcnt; |
1352 | } |
1353 | |
1354 | static inline void |
1355 | rtunref_audit(struct rtentry_dbg *rte) |
1356 | { |
1357 | uint16_t idx; |
1358 | |
1359 | if (rte->rtd_inuse != RTD_INUSE) { |
1360 | panic("rtunref: on freed rte=%p" , rte); |
1361 | /* NOTREACHED */ |
1362 | } |
1363 | idx = os_atomic_inc_orig(&rte->rtd_refrele_cnt, relaxed) % CTRACE_HIST_SIZE; |
1364 | if (rte_debug & RTD_TRACE) { |
1365 | ctrace_record(&rte->rtd_refrele[idx]); |
1366 | } |
1367 | } |
1368 | |
1369 | /* |
1370 | * Add a reference count from an rtentry. |
1371 | */ |
1372 | void |
1373 | rtref(struct rtentry *p) |
1374 | { |
1375 | RT_LOCK_ASSERT_HELD(p); |
1376 | |
1377 | VERIFY((p->rt_flags & RTF_DEAD) == 0); |
1378 | if (++p->rt_refcnt == 0) { |
1379 | panic("%s(%p) bad refcnt" , __func__, p); |
1380 | /* NOTREACHED */ |
1381 | } else if (p->rt_refcnt == 1) { |
1382 | /* |
1383 | * Hold an idle reference count on the interface, |
1384 | * if the route is eligible for it. |
1385 | */ |
1386 | rt_set_idleref(p); |
1387 | } |
1388 | |
1389 | if (rte_debug & RTD_DEBUG) { |
1390 | rtref_audit((rtentry_dbg_ref_t)p); |
1391 | } |
1392 | } |
1393 | |
1394 | static inline void |
1395 | rtref_audit(struct rtentry_dbg *rte) |
1396 | { |
1397 | uint16_t idx; |
1398 | |
1399 | if (rte->rtd_inuse != RTD_INUSE) { |
1400 | panic("rtref_audit: on freed rte=%p" , rte); |
1401 | /* NOTREACHED */ |
1402 | } |
1403 | idx = os_atomic_inc_orig(&rte->rtd_refhold_cnt, relaxed) % CTRACE_HIST_SIZE; |
1404 | if (rte_debug & RTD_TRACE) { |
1405 | ctrace_record(&rte->rtd_refhold[idx]); |
1406 | } |
1407 | } |
1408 | |
1409 | void |
1410 | rtsetifa(struct rtentry *rt, struct ifaddr *ifa) |
1411 | { |
1412 | LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED); |
1413 | |
1414 | RT_LOCK_ASSERT_HELD(rt); |
1415 | |
1416 | if (rt->rt_ifa == ifa) { |
1417 | return; |
1418 | } |
1419 | |
1420 | /* Become a regular mutex, just in case */ |
1421 | RT_CONVERT_LOCK(rt); |
1422 | |
1423 | /* Release the old ifa */ |
1424 | if (rt->rt_ifa) { |
1425 | ifa_remref(ifa: rt->rt_ifa); |
1426 | } |
1427 | |
1428 | /* Set rt_ifa */ |
1429 | rt->rt_ifa = ifa; |
1430 | |
1431 | /* Take a reference to the ifa */ |
1432 | if (rt->rt_ifa) { |
1433 | ifa_addref(ifa: rt->rt_ifa); |
1434 | } |
1435 | } |
1436 | |
1437 | /* |
1438 | * Force a routing table entry to the specified |
1439 | * destination to go through the given gateway. |
1440 | * Normally called as a result of a routing redirect |
1441 | * message from the network layer. |
1442 | */ |
1443 | void |
1444 | rtredirect(struct ifnet *ifp, struct sockaddr *dst, struct sockaddr *gateway, |
1445 | struct sockaddr *netmask, int flags, struct sockaddr *src, |
1446 | struct rtentry **rtp) |
1447 | { |
1448 | rtentry_ref_t rt = NULL; |
1449 | int error = 0; |
1450 | short *stat = 0; |
1451 | struct rt_addrinfo info; |
1452 | struct ifaddr *ifa = NULL; |
1453 | unsigned int ifscope = (ifp != NULL) ? ifp->if_index : IFSCOPE_NONE; |
1454 | struct sockaddr_storage ss; |
1455 | int af = src->sa_family; |
1456 | |
1457 | LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_NOTOWNED); |
1458 | lck_mtx_lock(rnh_lock); |
1459 | |
1460 | /* |
1461 | * Transform src into the internal routing table form for |
1462 | * comparison against rt_gateway below. |
1463 | */ |
1464 | if ((af == AF_INET) || (af == AF_INET6)) { |
1465 | src = sa_copy(src, dst: &ss, pifscope: &ifscope); |
1466 | } |
1467 | |
1468 | /* |
1469 | * Verify the gateway is directly reachable; if scoped routing |
1470 | * is enabled, verify that it is reachable from the interface |
1471 | * where the ICMP redirect arrived on. |
1472 | */ |
1473 | if ((ifa = ifa_ifwithnet_scoped(gateway, ifscope)) == NULL) { |
1474 | error = ENETUNREACH; |
1475 | goto out; |
1476 | } |
1477 | |
1478 | /* Lookup route to the destination (from the original IP header) */ |
1479 | rt = rtalloc1_scoped_locked(dst, report: 0, RTF_CLONING | RTF_PRCLONING, ifscope); |
1480 | if (rt != NULL) { |
1481 | RT_LOCK(rt); |
1482 | } |
1483 | |
1484 | /* |
1485 | * If the redirect isn't from our current router for this dst, |
1486 | * it's either old or wrong. If it redirects us to ourselves, |
1487 | * we have a routing loop, perhaps as a result of an interface |
1488 | * going down recently. Holding rnh_lock here prevents the |
1489 | * possibility of rt_ifa/ifa's ifa_addr from changing (e.g. |
1490 | * in_ifinit), so okay to access ifa_addr without locking. |
1491 | */ |
1492 | if (!(flags & RTF_DONE) && rt != NULL && |
1493 | (!sa_equal(src, rt->rt_gateway) || !sa_equal(rt->rt_ifa->ifa_addr, |
1494 | ifa->ifa_addr))) { |
1495 | error = EINVAL; |
1496 | } else { |
1497 | ifa_remref(ifa); |
1498 | if ((ifa = ifa_ifwithaddr(gateway))) { |
1499 | ifa_remref(ifa); |
1500 | ifa = NULL; |
1501 | error = EHOSTUNREACH; |
1502 | } |
1503 | } |
1504 | |
1505 | if (ifa) { |
1506 | ifa_remref(ifa); |
1507 | ifa = NULL; |
1508 | } |
1509 | |
1510 | if (error) { |
1511 | if (rt != NULL) { |
1512 | RT_UNLOCK(rt); |
1513 | } |
1514 | goto done; |
1515 | } |
1516 | |
1517 | /* |
1518 | * Create a new entry if we just got back a wildcard entry |
1519 | * or the the lookup failed. This is necessary for hosts |
1520 | * which use routing redirects generated by smart gateways |
1521 | * to dynamically build the routing tables. |
1522 | */ |
1523 | if ((rt == NULL) || (rt_mask(rt) != NULL && rt_mask(rt)->sa_len < 2)) { |
1524 | goto create; |
1525 | } |
1526 | /* |
1527 | * Don't listen to the redirect if it's |
1528 | * for a route to an interface. |
1529 | */ |
1530 | RT_LOCK_ASSERT_HELD(rt); |
1531 | if (rt->rt_flags & RTF_GATEWAY) { |
1532 | if (((rt->rt_flags & RTF_HOST) == 0) && (flags & RTF_HOST)) { |
1533 | /* |
1534 | * Changing from route to net => route to host. |
1535 | * Create new route, rather than smashing route |
1536 | * to net; similar to cloned routes, the newly |
1537 | * created host route is scoped as well. |
1538 | */ |
1539 | create: |
1540 | if (rt != NULL) { |
1541 | RT_UNLOCK(rt); |
1542 | } |
1543 | flags |= RTF_GATEWAY | RTF_DYNAMIC; |
1544 | error = rtrequest_scoped_locked(RTM_ADD, dst, |
1545 | gateway, netmask, flags, NULL, ifscope); |
1546 | stat = &rtstat.rts_dynamic; |
1547 | } else { |
1548 | /* |
1549 | * Smash the current notion of the gateway to |
1550 | * this destination. Should check about netmask!!! |
1551 | */ |
1552 | rt->rt_flags |= RTF_MODIFIED; |
1553 | flags |= RTF_MODIFIED; |
1554 | stat = &rtstat.rts_newgateway; |
1555 | /* |
1556 | * add the key and gateway (in one malloc'd chunk). |
1557 | */ |
1558 | error = rt_setgate(rt, rt_key(rt), gateway); |
1559 | RT_UNLOCK(rt); |
1560 | } |
1561 | } else { |
1562 | RT_UNLOCK(rt); |
1563 | error = EHOSTUNREACH; |
1564 | } |
1565 | done: |
1566 | if (rt != NULL) { |
1567 | RT_LOCK_ASSERT_NOTHELD(rt); |
1568 | if (!error) { |
1569 | /* Enqueue event to refresh flow route entries */ |
1570 | route_event_enqueue_nwk_wq_entry(rt, NULL, ROUTE_ENTRY_REFRESH, NULL, FALSE); |
1571 | if (rtp) { |
1572 | *rtp = rt; |
1573 | } else { |
1574 | rtfree_locked(rt); |
1575 | } |
1576 | } else { |
1577 | rtfree_locked(rt); |
1578 | } |
1579 | } |
1580 | out: |
1581 | if (error) { |
1582 | rtstat.rts_badredirect++; |
1583 | } else { |
1584 | if (stat != NULL) { |
1585 | (*stat)++; |
1586 | } |
1587 | |
1588 | if (af == AF_INET) { |
1589 | routegenid_inet_update(); |
1590 | } else if (af == AF_INET6) { |
1591 | routegenid_inet6_update(); |
1592 | } |
1593 | } |
1594 | lck_mtx_unlock(rnh_lock); |
1595 | bzero(s: (caddr_t)&info, n: sizeof(info)); |
1596 | info.rti_info[RTAX_DST] = dst; |
1597 | info.rti_info[RTAX_GATEWAY] = gateway; |
1598 | info.rti_info[RTAX_NETMASK] = netmask; |
1599 | info.rti_info[RTAX_AUTHOR] = src; |
1600 | rt_missmsg(RTM_REDIRECT, &info, flags, error); |
1601 | } |
1602 | |
1603 | /* |
1604 | * Routing table ioctl interface. |
1605 | */ |
1606 | int |
1607 | rtioctl(unsigned long req, caddr_t data, struct proc *p) |
1608 | { |
1609 | #pragma unused(p, req, data) |
1610 | return ENXIO; |
1611 | } |
1612 | |
1613 | struct ifaddr * |
1614 | ifa_ifwithroute( |
1615 | int flags, |
1616 | const struct sockaddr *dst, |
1617 | const struct sockaddr *gateway) |
1618 | { |
1619 | struct ifaddr *ifa; |
1620 | |
1621 | lck_mtx_lock(rnh_lock); |
1622 | ifa = ifa_ifwithroute_locked(flags, dst, gateway); |
1623 | lck_mtx_unlock(rnh_lock); |
1624 | |
1625 | return ifa; |
1626 | } |
1627 | |
1628 | struct ifaddr * |
1629 | ifa_ifwithroute_locked(int flags, const struct sockaddr *dst, |
1630 | const struct sockaddr *gateway) |
1631 | { |
1632 | return ifa_ifwithroute_common_locked((flags & ~RTF_IFSCOPE), dst, |
1633 | gateway, IFSCOPE_NONE); |
1634 | } |
1635 | |
1636 | struct ifaddr * |
1637 | ifa_ifwithroute_scoped_locked(int flags, const struct sockaddr *dst, |
1638 | const struct sockaddr *gateway, unsigned int ifscope) |
1639 | { |
1640 | if (ifscope != IFSCOPE_NONE) { |
1641 | flags |= RTF_IFSCOPE; |
1642 | } else { |
1643 | flags &= ~RTF_IFSCOPE; |
1644 | } |
1645 | |
1646 | return ifa_ifwithroute_common_locked(flags, dst, gateway, ifscope); |
1647 | } |
1648 | |
1649 | static struct ifaddr * |
1650 | ifa_ifwithroute_common_locked(int flags, const struct sockaddr *dst, |
1651 | const struct sockaddr *gw, unsigned int ifscope) |
1652 | { |
1653 | struct ifaddr *ifa = NULL; |
1654 | rtentry_ref_t rt = NULL; |
1655 | struct sockaddr_storage dst_ss, gw_ss; |
1656 | |
1657 | if (!in6_embedded_scope) { |
1658 | const struct sockaddr_in6 *dst_addr = SIN6(dst); |
1659 | if (dst->sa_family == AF_INET6 && |
1660 | IN6_IS_SCOPE_EMBED(&dst_addr->sin6_addr) && |
1661 | ifscope == IFSCOPE_NONE) { |
1662 | ifscope = dst_addr->sin6_scope_id; |
1663 | VERIFY(ifscope != IFSCOPE_NONE); |
1664 | } |
1665 | |
1666 | const struct sockaddr_in6 *gw_addr = SIN6(gw); |
1667 | if (dst->sa_family == AF_INET6 && |
1668 | IN6_IS_SCOPE_EMBED(&gw_addr->sin6_addr) && |
1669 | ifscope == IFSCOPE_NONE) { |
1670 | ifscope = gw_addr->sin6_scope_id; |
1671 | VERIFY(ifscope != IFSCOPE_NONE); |
1672 | } |
1673 | |
1674 | if (ifscope != IFSCOPE_NONE) { |
1675 | flags |= RTF_IFSCOPE; |
1676 | } else { |
1677 | flags &= ~RTF_IFSCOPE; |
1678 | } |
1679 | } |
1680 | |
1681 | LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED); |
1682 | |
1683 | /* |
1684 | * Just in case the sockaddr passed in by the caller |
1685 | * contains a scope ID, make sure to clear it since |
1686 | * interface addresses aren't scoped. |
1687 | */ |
1688 | if (dst != NULL && |
1689 | ((dst->sa_family == AF_INET) || |
1690 | (dst->sa_family == AF_INET6))) { |
1691 | dst = sa_copy(__DECONST_SA(dst), dst: &dst_ss, IN6_NULL_IF_EMBEDDED_SCOPE(&ifscope)); |
1692 | } |
1693 | |
1694 | if (gw != NULL && |
1695 | ((gw->sa_family == AF_INET) || |
1696 | (gw->sa_family == AF_INET6))) { |
1697 | gw = sa_copy(__DECONST_SA(gw), dst: &gw_ss, IN6_NULL_IF_EMBEDDED_SCOPE(&ifscope)); |
1698 | } |
1699 | |
1700 | if (!(flags & RTF_GATEWAY)) { |
1701 | /* |
1702 | * If we are adding a route to an interface, |
1703 | * and the interface is a pt to pt link |
1704 | * we should search for the destination |
1705 | * as our clue to the interface. Otherwise |
1706 | * we can use the local address. |
1707 | */ |
1708 | if (flags & RTF_HOST) { |
1709 | ifa = ifa_ifwithdstaddr(dst); |
1710 | } |
1711 | if (ifa == NULL) { |
1712 | ifa = ifa_ifwithaddr_scoped(gw, ifscope); |
1713 | } |
1714 | } else { |
1715 | /* |
1716 | * If we are adding a route to a remote net |
1717 | * or host, the gateway may still be on the |
1718 | * other end of a pt to pt link. |
1719 | */ |
1720 | if ((flags & RTF_IFSCOPE) != 0 && ifscope != IFSCOPE_NONE) { |
1721 | ifa = ifa_ifwithdstaddr_scoped(gw, ifscope); |
1722 | } |
1723 | if (ifa == NULL) { |
1724 | ifa = ifa_ifwithdstaddr(gw); |
1725 | } |
1726 | } |
1727 | if (ifa == NULL) { |
1728 | ifa = ifa_ifwithnet_scoped(gw, ifscope); |
1729 | } |
1730 | if (ifa == NULL) { |
1731 | /* Workaround to avoid gcc warning regarding const variable */ |
1732 | rt = rtalloc1_scoped_locked(__DECONST_SA(dst), |
1733 | report: 0, ignflags: 0, ifscope); |
1734 | if (rt != NULL) { |
1735 | RT_LOCK_SPIN(rt); |
1736 | ifa = rt->rt_ifa; |
1737 | if (ifa != NULL) { |
1738 | /* Become a regular mutex */ |
1739 | RT_CONVERT_LOCK(rt); |
1740 | ifa_addref(ifa); |
1741 | } |
1742 | RT_REMREF_LOCKED(rt); |
1743 | RT_UNLOCK(rt); |
1744 | rt = NULL; |
1745 | } |
1746 | } |
1747 | /* |
1748 | * Holding rnh_lock here prevents the possibility of ifa from |
1749 | * changing (e.g. in_ifinit), so it is safe to access its |
1750 | * ifa_addr (here and down below) without locking. |
1751 | */ |
1752 | if (ifa != NULL && ifa->ifa_addr->sa_family != dst->sa_family) { |
1753 | struct ifaddr *newifa; |
1754 | /* Callee adds reference to newifa upon success */ |
1755 | newifa = ifaof_ifpforaddr(dst, ifa->ifa_ifp); |
1756 | if (newifa != NULL) { |
1757 | ifa_remref(ifa); |
1758 | ifa = newifa; |
1759 | } |
1760 | } |
1761 | /* |
1762 | * If we are adding a gateway, it is quite possible that the |
1763 | * routing table has a static entry in place for the gateway, |
1764 | * that may not agree with info garnered from the interfaces. |
1765 | * The routing table should carry more precedence than the |
1766 | * interfaces in this matter. Must be careful not to stomp |
1767 | * on new entries from rtinit, hence (ifa->ifa_addr != gw). |
1768 | */ |
1769 | if ((ifa == NULL || (gw != NULL && |
1770 | !sa_equal(ifa->ifa_addr, __DECONST_SA(gw)))) && |
1771 | (rt = rtalloc1_scoped_locked(__DECONST_SA(gw), |
1772 | report: 0, ignflags: 0, ifscope)) != NULL) { |
1773 | if (ifa != NULL) { |
1774 | ifa_remref(ifa); |
1775 | } |
1776 | RT_LOCK_SPIN(rt); |
1777 | ifa = rt->rt_ifa; |
1778 | if (ifa != NULL) { |
1779 | /* Become a regular mutex */ |
1780 | RT_CONVERT_LOCK(rt); |
1781 | ifa_addref(ifa); |
1782 | } |
1783 | RT_REMREF_LOCKED(rt); |
1784 | RT_UNLOCK(rt); |
1785 | } |
1786 | /* |
1787 | * If an interface scope was specified, the interface index of |
1788 | * the found ifaddr must be equivalent to that of the scope; |
1789 | * otherwise there is no match. |
1790 | */ |
1791 | if ((flags & RTF_IFSCOPE) && |
1792 | ifa != NULL && ifa->ifa_ifp->if_index != ifscope) { |
1793 | ifa_remref(ifa); |
1794 | ifa = NULL; |
1795 | } |
1796 | |
1797 | /* |
1798 | * ifa's address family must match destination's address family |
1799 | * after all is said and done. |
1800 | */ |
1801 | if (ifa != NULL && |
1802 | ifa->ifa_addr->sa_family != dst->sa_family) { |
1803 | ifa_remref(ifa); |
1804 | ifa = NULL; |
1805 | } |
1806 | |
1807 | return ifa; |
1808 | } |
1809 | |
1810 | static int rt_fixdelete(struct radix_node *, void *); |
1811 | static int rt_fixchange(struct radix_node *, void *); |
1812 | |
1813 | struct rtfc_arg { |
1814 | struct rtentry *rt0; |
1815 | struct radix_node_head *rnh; |
1816 | }; |
1817 | |
1818 | int |
1819 | rtrequest_locked(int req, struct sockaddr *dst, struct sockaddr *gateway, |
1820 | struct sockaddr *netmask, int flags, struct rtentry **ret_nrt) |
1821 | { |
1822 | return rtrequest_common_locked(req, dst, gateway, netmask, |
1823 | (flags & ~RTF_IFSCOPE), ret_nrt, IFSCOPE_NONE); |
1824 | } |
1825 | |
1826 | int |
1827 | rtrequest_scoped_locked(int req, struct sockaddr *dst, |
1828 | struct sockaddr *gateway, struct sockaddr *netmask, int flags, |
1829 | struct rtentry **ret_nrt, unsigned int ifscope) |
1830 | { |
1831 | if (ifscope != IFSCOPE_NONE) { |
1832 | flags |= RTF_IFSCOPE; |
1833 | } else { |
1834 | flags &= ~RTF_IFSCOPE; |
1835 | } |
1836 | |
1837 | return rtrequest_common_locked(req, dst, gateway, netmask, |
1838 | flags, ret_nrt, ifscope); |
1839 | } |
1840 | |
1841 | /* |
1842 | * Do appropriate manipulations of a routing tree given all the bits of |
1843 | * info needed. |
1844 | * |
1845 | * Storing the scope ID in the radix key is an internal job that should be |
1846 | * left to routines in this module. Callers should specify the scope value |
1847 | * to the "scoped" variants of route routines instead of manipulating the |
1848 | * key itself. This is typically done when creating a scoped route, e.g. |
1849 | * rtrequest(RTM_ADD). Once such a route is created and marked with the |
1850 | * RTF_IFSCOPE flag, callers can simply use its rt_key(rt) to clone it |
1851 | * (RTM_RESOLVE) or to remove it (RTM_DELETE). An exception to this is |
1852 | * during certain routing socket operations where the search key might be |
1853 | * derived from the routing message itself, in which case the caller must |
1854 | * specify the destination address and scope value for RTM_ADD/RTM_DELETE. |
1855 | */ |
1856 | static int |
1857 | rtrequest_common_locked(int req, struct sockaddr *dst0, |
1858 | struct sockaddr *gateway, struct sockaddr *netmask, int flags, |
1859 | struct rtentry **ret_nrt, unsigned int ifscope) |
1860 | { |
1861 | int error = 0; |
1862 | rtentry_ref_t rt; |
1863 | struct radix_node *rn; |
1864 | struct radix_node_head *rnh; |
1865 | struct ifaddr *ifa = NULL; |
1866 | struct sockaddr *ndst, *dst = dst0; |
1867 | struct sockaddr_storage ss, mask; |
1868 | struct timeval caltime; |
1869 | int af = dst->sa_family; |
1870 | void (*ifa_rtrequest)(int, struct rtentry *, struct sockaddr *); |
1871 | |
1872 | #define senderr(x) { error = x; goto bad; } |
1873 | |
1874 | DTRACE_ROUTE6(rtrequest, int, req, struct sockaddr *, dst0, |
1875 | struct sockaddr *, gateway, struct sockaddr *, netmask, |
1876 | int, flags, unsigned int, ifscope); |
1877 | |
1878 | LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED); |
1879 | |
1880 | #if !(DEVELOPMENT || DEBUG) |
1881 | /* |
1882 | * Setting the global internet flag external is only for testing |
1883 | */ |
1884 | flags &= ~RTF_GLOBAL; |
1885 | #endif /* !(DEVELOPMENT || DEBUG) */ |
1886 | |
1887 | /* |
1888 | * Find the correct routing tree to use for this Address Family |
1889 | */ |
1890 | if ((rnh = rt_tables[af]) == NULL) { |
1891 | senderr(ESRCH); |
1892 | } |
1893 | /* |
1894 | * If we are adding a host route then we don't want to put |
1895 | * a netmask in the tree |
1896 | */ |
1897 | if (flags & RTF_HOST) { |
1898 | netmask = NULL; |
1899 | } |
1900 | |
1901 | /* |
1902 | * If Scoped Routing is enabled, use a local copy of the destination |
1903 | * address to store the scope ID into. This logic is repeated below |
1904 | * in the RTM_RESOLVE handler since the caller does not normally |
1905 | * specify such a flag during a resolve, as well as for the handling |
1906 | * of IPv4 link-local address; instead, it passes in the route used for |
1907 | * cloning for which the scope info is derived from. Note also that |
1908 | * in the case of RTM_DELETE, the address passed in by the caller |
1909 | * might already contain the scope ID info when it is the key itself, |
1910 | * thus making RTF_IFSCOPE unnecessary; one instance where it is |
1911 | * explicitly set is inside route_output() as part of handling a |
1912 | * routing socket request. |
1913 | */ |
1914 | if (req != RTM_RESOLVE && ((af == AF_INET) || (af == AF_INET6))) { |
1915 | /* Transform dst into the internal routing table form */ |
1916 | dst = sa_copy(src: dst, dst: &ss, pifscope: &ifscope); |
1917 | |
1918 | /* Transform netmask into the internal routing table form */ |
1919 | if (netmask != NULL) { |
1920 | netmask = ma_copy(af, src: netmask, dst: &mask, ifscope); |
1921 | } |
1922 | |
1923 | if (ifscope != IFSCOPE_NONE) { |
1924 | flags |= RTF_IFSCOPE; |
1925 | } |
1926 | } else if ((flags & RTF_IFSCOPE) && |
1927 | (af != AF_INET && af != AF_INET6)) { |
1928 | senderr(EINVAL); |
1929 | } |
1930 | |
1931 | if (ifscope == IFSCOPE_NONE) { |
1932 | flags &= ~RTF_IFSCOPE; |
1933 | } |
1934 | |
1935 | if (!in6_embedded_scope) { |
1936 | if (af == AF_INET6 && |
1937 | IN6_IS_SCOPE_EMBED(&SIN6(dst)->sin6_addr) && |
1938 | SIN6(dst)->sin6_scope_id == IFSCOPE_NONE) { |
1939 | SIN6(dst)->sin6_scope_id = ifscope; |
1940 | if (in6_embedded_scope_debug) { |
1941 | VERIFY(SIN6(dst)->sin6_scope_id != IFSCOPE_NONE); |
1942 | } |
1943 | } |
1944 | |
1945 | if (af == AF_INET6 && |
1946 | IN6_IS_SCOPE_EMBED(&SIN6(dst)->sin6_addr) && |
1947 | ifscope == IFSCOPE_NONE) { |
1948 | ifscope = SIN6(dst)->sin6_scope_id; |
1949 | flags |= RTF_IFSCOPE; |
1950 | if (in6_embedded_scope_debug) { |
1951 | VERIFY(ifscope!= IFSCOPE_NONE); |
1952 | } |
1953 | } |
1954 | } |
1955 | |
1956 | switch (req) { |
1957 | case RTM_DELETE: { |
1958 | rtentry_ref_t gwrt = NULL; |
1959 | boolean_t was_router = FALSE; |
1960 | uint32_t old_rt_refcnt = 0; |
1961 | /* |
1962 | * Remove the item from the tree and return it. |
1963 | * Complain if it is not there and do no more processing. |
1964 | */ |
1965 | if ((rn = rnh->rnh_deladdr(dst, netmask, rnh)) == NULL) { |
1966 | senderr(ESRCH); |
1967 | } |
1968 | if (rn->rn_flags & (RNF_ACTIVE | RNF_ROOT)) { |
1969 | panic("rtrequest delete" ); |
1970 | /* NOTREACHED */ |
1971 | } |
1972 | rt = RT(rn); |
1973 | |
1974 | RT_LOCK(rt); |
1975 | old_rt_refcnt = rt->rt_refcnt; |
1976 | rt->rt_flags &= ~RTF_UP; |
1977 | /* |
1978 | * Release any idle reference count held on the interface |
1979 | * as this route is no longer externally visible. |
1980 | */ |
1981 | rt_clear_idleref(rt); |
1982 | /* |
1983 | * Take an extra reference to handle the deletion of a route |
1984 | * entry whose reference count is already 0; e.g. an expiring |
1985 | * cloned route entry or an entry that was added to the table |
1986 | * with 0 reference. If the caller is interested in this route, |
1987 | * we will return it with the reference intact. Otherwise we |
1988 | * will decrement the reference via rtfree_locked() and then |
1989 | * possibly deallocate it. |
1990 | */ |
1991 | RT_ADDREF_LOCKED(rt); |
1992 | |
1993 | /* |
1994 | * For consistency, in case the caller didn't set the flag. |
1995 | */ |
1996 | rt->rt_flags |= RTF_CONDEMNED; |
1997 | |
1998 | /* |
1999 | * Clear RTF_ROUTER if it's set. |
2000 | */ |
2001 | if (rt->rt_flags & RTF_ROUTER) { |
2002 | was_router = TRUE; |
2003 | VERIFY(rt->rt_flags & RTF_HOST); |
2004 | rt->rt_flags &= ~RTF_ROUTER; |
2005 | } |
2006 | |
2007 | /* |
2008 | * Enqueue work item to invoke callback for this route entry |
2009 | * |
2010 | * If the old count is 0, it implies that last reference is being |
2011 | * removed and there's no one listening for this route event. |
2012 | */ |
2013 | if (old_rt_refcnt != 0) { |
2014 | route_event_enqueue_nwk_wq_entry(rt, NULL, |
2015 | ROUTE_ENTRY_DELETED, NULL, TRUE); |
2016 | } |
2017 | |
2018 | /* |
2019 | * Now search what's left of the subtree for any cloned |
2020 | * routes which might have been formed from this node. |
2021 | */ |
2022 | if ((rt->rt_flags & (RTF_CLONING | RTF_PRCLONING)) && |
2023 | rt_mask(rt)) { |
2024 | RT_UNLOCK(rt); |
2025 | rnh->rnh_walktree_from(rnh, dst, rt_mask(rt), |
2026 | rt_fixdelete, rt); |
2027 | RT_LOCK(rt); |
2028 | } |
2029 | |
2030 | if (was_router) { |
2031 | struct route_event rt_ev; |
2032 | route_event_init(p_route_ev: &rt_ev, rt, NULL, route_ev_code: ROUTE_LLENTRY_DELETED); |
2033 | RT_UNLOCK(rt); |
2034 | (void) rnh->rnh_walktree(rnh, |
2035 | route_event_walktree, (void *)&rt_ev); |
2036 | RT_LOCK(rt); |
2037 | } |
2038 | |
2039 | /* |
2040 | * Remove any external references we may have. |
2041 | */ |
2042 | if ((gwrt = rt->rt_gwroute) != NULL) { |
2043 | rt->rt_gwroute = NULL; |
2044 | } |
2045 | |
2046 | /* |
2047 | * give the protocol a chance to keep things in sync. |
2048 | */ |
2049 | if ((ifa = rt->rt_ifa) != NULL) { |
2050 | IFA_LOCK_SPIN(ifa); |
2051 | ifa_rtrequest = ifa->ifa_rtrequest; |
2052 | IFA_UNLOCK(ifa); |
2053 | if (ifa_rtrequest != NULL) { |
2054 | ifa_rtrequest(RTM_DELETE, rt, NULL); |
2055 | } |
2056 | /* keep reference on rt_ifa */ |
2057 | ifa = NULL; |
2058 | } |
2059 | |
2060 | /* |
2061 | * one more rtentry floating around that is not |
2062 | * linked to the routing table. |
2063 | */ |
2064 | (void) OSIncrementAtomic(&rttrash); |
2065 | if (rte_debug & RTD_DEBUG) { |
2066 | TAILQ_INSERT_TAIL(&rttrash_head, |
2067 | (rtentry_dbg_ref_t)rt, rtd_trash_link); |
2068 | } |
2069 | |
2070 | /* |
2071 | * If this is the (non-scoped) default route, clear |
2072 | * the interface index used for the primary ifscope. |
2073 | */ |
2074 | if (rt_primary_default(rt, rt_key(rt))) { |
2075 | set_primary_ifscope(rt_key(rt)->sa_family, |
2076 | IFSCOPE_NONE); |
2077 | if ((rt->rt_flags & RTF_STATIC) && |
2078 | rt_key(rt)->sa_family == PF_INET6) { |
2079 | trigger_v6_defrtr_select = TRUE; |
2080 | } |
2081 | } |
2082 | |
2083 | #if NECP |
2084 | /* |
2085 | * If this is a change in a default route, update |
2086 | * necp client watchers to re-evaluate |
2087 | */ |
2088 | if (SA_DEFAULT(rt_key(rt))) { |
2089 | if (rt->rt_ifp != NULL) { |
2090 | ifnet_touch_lastupdown(interface: rt->rt_ifp); |
2091 | } |
2092 | necp_update_all_clients(); |
2093 | } |
2094 | #endif /* NECP */ |
2095 | |
2096 | RT_UNLOCK(rt); |
2097 | |
2098 | /* |
2099 | * This might result in another rtentry being freed if |
2100 | * we held its last reference. Do this after the rtentry |
2101 | * lock is dropped above, as it could lead to the same |
2102 | * lock being acquired if gwrt is a clone of rt. |
2103 | */ |
2104 | if (gwrt != NULL) { |
2105 | rtfree_locked(rt: gwrt); |
2106 | } |
2107 | |
2108 | /* |
2109 | * If the caller wants it, then it can have it, |
2110 | * but it's up to it to free the rtentry as we won't be |
2111 | * doing it. |
2112 | */ |
2113 | if (ret_nrt != NULL) { |
2114 | /* Return the route to caller with reference intact */ |
2115 | *ret_nrt = rt; |
2116 | } else { |
2117 | /* Dereference or deallocate the route */ |
2118 | rtfree_locked(rt); |
2119 | } |
2120 | if (af == AF_INET) { |
2121 | routegenid_inet_update(); |
2122 | } else if (af == AF_INET6) { |
2123 | routegenid_inet6_update(); |
2124 | } |
2125 | break; |
2126 | } |
2127 | case RTM_RESOLVE: |
2128 | if (ret_nrt == NULL || (rt = *ret_nrt) == NULL) { |
2129 | senderr(EINVAL); |
2130 | } |
2131 | /* |
2132 | * According to the UNIX conformance tests, we need to return |
2133 | * ENETUNREACH when the parent route is RTF_REJECT. |
2134 | * However, there isn't any point in cloning RTF_REJECT |
2135 | * routes, so we immediately return an error. |
2136 | */ |
2137 | if (rt->rt_flags & RTF_REJECT) { |
2138 | if (rt->rt_flags & RTF_HOST) { |
2139 | senderr(EHOSTUNREACH); |
2140 | } else { |
2141 | senderr(ENETUNREACH); |
2142 | } |
2143 | } |
2144 | /* |
2145 | * If cloning, we have the parent route given by the caller |
2146 | * and will use its rt_gateway, rt_rmx as part of the cloning |
2147 | * process below. Since rnh_lock is held at this point, the |
2148 | * parent's rt_ifa and rt_gateway will not change, and its |
2149 | * relevant rt_flags will not change as well. The only thing |
2150 | * that could change are the metrics, and thus we hold the |
2151 | * parent route's rt_lock later on during the actual copying |
2152 | * of rt_rmx. |
2153 | */ |
2154 | ifa = rt->rt_ifa; |
2155 | ifa_addref(ifa); |
2156 | flags = rt->rt_flags & |
2157 | ~(RTF_CLONING | RTF_PRCLONING | RTF_STATIC); |
2158 | flags |= RTF_WASCLONED; |
2159 | gateway = rt->rt_gateway; |
2160 | if ((netmask = rt->rt_genmask) == NULL) { |
2161 | flags |= RTF_HOST; |
2162 | } |
2163 | |
2164 | if (af != AF_INET && af != AF_INET6) { |
2165 | goto makeroute; |
2166 | } |
2167 | |
2168 | /* |
2169 | * When scoped routing is enabled, cloned entries are |
2170 | * always scoped according to the interface portion of |
2171 | * the parent route. The exception to this are IPv4 |
2172 | * link local addresses, or those routes that are cloned |
2173 | * from a RTF_PROXY route. For the latter, the clone |
2174 | * gets to keep the RTF_PROXY flag. |
2175 | */ |
2176 | if ((af == AF_INET && |
2177 | IN_LINKLOCAL(ntohl(SIN(dst)->sin_addr.s_addr))) || |
2178 | (rt->rt_flags & RTF_PROXY)) { |
2179 | ifscope = IFSCOPE_NONE; |
2180 | flags &= ~RTF_IFSCOPE; |
2181 | /* |
2182 | * These types of cloned routes aren't currently |
2183 | * eligible for idle interface reference counting. |
2184 | */ |
2185 | flags |= RTF_NOIFREF; |
2186 | } else { |
2187 | if (flags & RTF_IFSCOPE) { |
2188 | ifscope = (af == AF_INET) ? |
2189 | sin_get_ifscope(rt_key(rt)) : |
2190 | sin6_get_ifscope(rt_key(rt)); |
2191 | } else { |
2192 | ifscope = rt->rt_ifp->if_index; |
2193 | flags |= RTF_IFSCOPE; |
2194 | } |
2195 | VERIFY(ifscope != IFSCOPE_NONE); |
2196 | } |
2197 | |
2198 | /* |
2199 | * Transform dst into the internal routing table form, |
2200 | * clearing out the scope ID field if ifscope isn't set. |
2201 | */ |
2202 | dst = sa_copy(src: dst, dst: &ss, pifscope: (ifscope == IFSCOPE_NONE) ? |
2203 | NULL : &ifscope); |
2204 | |
2205 | /* Transform netmask into the internal routing table form */ |
2206 | if (netmask != NULL) { |
2207 | netmask = ma_copy(af, src: netmask, dst: &mask, ifscope); |
2208 | } |
2209 | |
2210 | goto makeroute; |
2211 | |
2212 | case RTM_ADD: |
2213 | if ((flags & RTF_GATEWAY) && !gateway) { |
2214 | panic("rtrequest: RTF_GATEWAY but no gateway" ); |
2215 | /* NOTREACHED */ |
2216 | } |
2217 | if (flags & RTF_IFSCOPE) { |
2218 | ifa = ifa_ifwithroute_scoped_locked(flags, dst: dst0, |
2219 | gateway, ifscope); |
2220 | } else { |
2221 | ifa = ifa_ifwithroute_locked(flags, dst: dst0, gateway); |
2222 | } |
2223 | if (ifa == NULL) { |
2224 | senderr(ENETUNREACH); |
2225 | } |
2226 | makeroute: |
2227 | /* |
2228 | * We land up here for both RTM_RESOLVE and RTM_ADD |
2229 | * when we decide to create a route. |
2230 | */ |
2231 | if ((rt = rte_alloc()) == NULL) { |
2232 | senderr(ENOBUFS); |
2233 | } |
2234 | Bzero(rt, sizeof(*rt)); |
2235 | rte_lock_init(rt); |
2236 | eventhandler_lists_ctxt_init(evthdlr_lists_ctxt: &rt->rt_evhdlr_ctxt); |
2237 | getmicrotime(&caltime); |
2238 | rt->base_calendartime = caltime.tv_sec; |
2239 | rt->base_uptime = net_uptime(); |
2240 | RT_LOCK(rt); |
2241 | rt->rt_flags = RTF_UP | flags; |
2242 | |
2243 | /* |
2244 | * Point the generation ID to the tree's. |
2245 | */ |
2246 | switch (af) { |
2247 | case AF_INET: |
2248 | rt->rt_tree_genid = &route_genid_inet; |
2249 | break; |
2250 | case AF_INET6: |
2251 | rt->rt_tree_genid = &route_genid_inet6; |
2252 | break; |
2253 | default: |
2254 | break; |
2255 | } |
2256 | |
2257 | /* |
2258 | * Add the gateway. Possibly re-malloc-ing the storage for it |
2259 | * also add the rt_gwroute if possible. |
2260 | */ |
2261 | if ((error = rt_setgate(rt, dst, gateway)) != 0) { |
2262 | int tmp = error; |
2263 | RT_UNLOCK(rt); |
2264 | nstat_route_detach(rte: rt); |
2265 | rte_lock_destroy(rt); |
2266 | rte_free(rt); |
2267 | senderr(tmp); |
2268 | } |
2269 | |
2270 | /* |
2271 | * point to the (possibly newly malloc'd) dest address. |
2272 | */ |
2273 | ndst = rt_key(rt); |
2274 | |
2275 | /* |
2276 | * make sure it contains the value we want (masked if needed). |
2277 | */ |
2278 | if (netmask) { |
2279 | rt_maskedcopy(dst, ndst, netmask); |
2280 | } else { |
2281 | SOCKADDR_COPY(dst, ndst, dst->sa_len); |
2282 | } |
2283 | |
2284 | /* |
2285 | * Note that we now have a reference to the ifa. |
2286 | * This moved from below so that rnh->rnh_addaddr() can |
2287 | * examine the ifa and ifa->ifa_ifp if it so desires. |
2288 | */ |
2289 | rtsetifa(rt, ifa); |
2290 | rt->rt_ifp = rt->rt_ifa->ifa_ifp; |
2291 | |
2292 | /* XXX mtu manipulation will be done in rnh_addaddr -- itojun */ |
2293 | |
2294 | rn = rnh->rnh_addaddr((caddr_t)ndst, (caddr_t)netmask, |
2295 | rnh, rt->rt_nodes); |
2296 | if (rn == 0) { |
2297 | rtentry_ref_t rt2; |
2298 | /* |
2299 | * Uh-oh, we already have one of these in the tree. |
2300 | * We do a special hack: if the route that's already |
2301 | * there was generated by the protocol-cloning |
2302 | * mechanism, then we just blow it away and retry |
2303 | * the insertion of the new one. |
2304 | */ |
2305 | if (flags & RTF_IFSCOPE) { |
2306 | rt2 = rtalloc1_scoped_locked(dst: dst0, report: 0, |
2307 | RTF_CLONING | RTF_PRCLONING, ifscope); |
2308 | } else { |
2309 | rt2 = rtalloc1_locked(dst, report: 0, |
2310 | RTF_CLONING | RTF_PRCLONING); |
2311 | } |
2312 | if (rt2 && rt2->rt_parent) { |
2313 | /* |
2314 | * rnh_lock is held here, so rt_key and |
2315 | * rt_gateway of rt2 will not change. |
2316 | */ |
2317 | (void) rtrequest_locked(RTM_DELETE, rt_key(rt2), |
2318 | gateway: rt2->rt_gateway, rt_mask(rt2), |
2319 | flags: rt2->rt_flags, ret_nrt: 0); |
2320 | rtfree_locked(rt: rt2); |
2321 | rn = rnh->rnh_addaddr((caddr_t)ndst, |
2322 | (caddr_t)netmask, rnh, rt->rt_nodes); |
2323 | } else if (rt2) { |
2324 | /* undo the extra ref we got */ |
2325 | rtfree_locked(rt: rt2); |
2326 | } |
2327 | } |
2328 | |
2329 | /* |
2330 | * If it still failed to go into the tree, |
2331 | * then un-make it (this should be a function) |
2332 | */ |
2333 | if (rn == NULL) { |
2334 | char dbuf[MAX_IPv6_STR_LEN], gbuf[MAX_IPv6_STR_LEN]; |
2335 | |
2336 | rt_str(rt, dbuf, sizeof(dbuf), gbuf, sizeof(gbuf)); |
2337 | os_log_error(OS_LOG_DEFAULT, "%s: route already exists: " |
2338 | "%s->%s->%s" , |
2339 | __func__, dbuf, gbuf, |
2340 | ((rt->rt_ifp != NULL) ? |
2341 | rt->rt_ifp->if_xname : "" )); |
2342 | |
2343 | /* Clear gateway route */ |
2344 | rt_set_gwroute(rt, rt_key(rt), NULL); |
2345 | if (rt->rt_ifa) { |
2346 | ifa_remref(ifa: rt->rt_ifa); |
2347 | rt->rt_ifa = NULL; |
2348 | } |
2349 | rt_key_free(rt); |
2350 | RT_UNLOCK(rt); |
2351 | nstat_route_detach(rte: rt); |
2352 | rte_lock_destroy(rt); |
2353 | rte_free(rt); |
2354 | senderr(EEXIST); |
2355 | } |
2356 | |
2357 | rt->rt_parent = NULL; |
2358 | |
2359 | /* |
2360 | * If we got here from RESOLVE, then we are cloning so clone |
2361 | * the rest, and note that we are a clone (and increment the |
2362 | * parent's references). rnh_lock is still held, which prevents |
2363 | * a lookup from returning the newly-created route. Hence |
2364 | * holding and releasing the parent's rt_lock while still |
2365 | * holding the route's rt_lock is safe since the new route |
2366 | * is not yet externally visible. |
2367 | */ |
2368 | if (req == RTM_RESOLVE) { |
2369 | RT_LOCK_SPIN(*ret_nrt); |
2370 | VERIFY((*ret_nrt)->rt_expire == 0 || |
2371 | (*ret_nrt)->rt_rmx.rmx_expire != 0); |
2372 | VERIFY((*ret_nrt)->rt_expire != 0 || |
2373 | (*ret_nrt)->rt_rmx.rmx_expire == 0); |
2374 | rt->rt_rmx = (*ret_nrt)->rt_rmx; |
2375 | rt_setexpire(rt, (*ret_nrt)->rt_expire); |
2376 | if ((*ret_nrt)->rt_flags & |
2377 | (RTF_CLONING | RTF_PRCLONING)) { |
2378 | rt->rt_parent = (*ret_nrt); |
2379 | RT_ADDREF_LOCKED(*ret_nrt); |
2380 | } |
2381 | RT_UNLOCK(*ret_nrt); |
2382 | } |
2383 | |
2384 | /* |
2385 | * if this protocol has something to add to this then |
2386 | * allow it to do that as well. |
2387 | */ |
2388 | IFA_LOCK_SPIN(ifa); |
2389 | ifa_rtrequest = ifa->ifa_rtrequest; |
2390 | IFA_UNLOCK(ifa); |
2391 | if (ifa_rtrequest != NULL) { |
2392 | /* |
2393 | * Can not use SA(ret_nrt ? *ret_nrt : NULL), |
2394 | * because *ret_nrt is not a sockadr. |
2395 | */ |
2396 | ifa_rtrequest(req, rt, |
2397 | __unsafe_forge_single(struct sockaddr*, ret_nrt ? *ret_nrt : NULL)); |
2398 | } |
2399 | ifa_remref(ifa); |
2400 | ifa = NULL; |
2401 | |
2402 | /* |
2403 | * If this is the (non-scoped) default route, record |
2404 | * the interface index used for the primary ifscope. |
2405 | */ |
2406 | if (rt_primary_default(rt, rt_key(rt))) { |
2407 | set_primary_ifscope(rt_key(rt)->sa_family, |
2408 | ifscope: rt->rt_ifp->if_index); |
2409 | } |
2410 | |
2411 | #if NECP |
2412 | /* |
2413 | * If this is a change in a default route, update |
2414 | * necp client watchers to re-evaluate |
2415 | */ |
2416 | if (SA_DEFAULT(rt_key(rt))) { |
2417 | /* |
2418 | * Mark default routes as (potentially) leading to the global internet |
2419 | * this can be used for policy decisions. |
2420 | * The clone routes will inherit this flag. |
2421 | * We check against the host flag as this works for default routes that have |
2422 | * a gateway and defaults routes when all subnets are local. |
2423 | */ |
2424 | if (req == RTM_ADD && (rt->rt_flags & RTF_HOST) == 0) { |
2425 | rt->rt_flags |= RTF_GLOBAL; |
2426 | } |
2427 | if (rt->rt_ifp != NULL) { |
2428 | ifnet_touch_lastupdown(interface: rt->rt_ifp); |
2429 | } |
2430 | necp_update_all_clients(); |
2431 | } |
2432 | #endif /* NECP */ |
2433 | |
2434 | /* |
2435 | * actually return a resultant rtentry and |
2436 | * give the caller a single reference. |
2437 | */ |
2438 | if (ret_nrt) { |
2439 | *ret_nrt = rt; |
2440 | RT_ADDREF_LOCKED(rt); |
2441 | } |
2442 | |
2443 | if (af == AF_INET) { |
2444 | routegenid_inet_update(); |
2445 | } else if (af == AF_INET6) { |
2446 | routegenid_inet6_update(); |
2447 | } |
2448 | |
2449 | RT_GENID_SYNC(rt); |
2450 | |
2451 | /* |
2452 | * We repeat the same procedures from rt_setgate() here |
2453 | * because they weren't completed when we called it earlier, |
2454 | * since the node was embryonic. |
2455 | */ |
2456 | if ((rt->rt_flags & RTF_GATEWAY) && rt->rt_gwroute != NULL) { |
2457 | rt_set_gwroute(rt, rt_key(rt), rt->rt_gwroute); |
2458 | } |
2459 | |
2460 | if (req == RTM_ADD && |
2461 | !(rt->rt_flags & RTF_HOST) && rt_mask(rt) != NULL) { |
2462 | struct rtfc_arg arg; |
2463 | arg.rnh = rnh; |
2464 | arg.rt0 = rt; |
2465 | RT_UNLOCK(rt); |
2466 | rnh->rnh_walktree_from(rnh, rt_key(rt), rt_mask(rt), |
2467 | rt_fixchange, &arg); |
2468 | } else { |
2469 | RT_UNLOCK(rt); |
2470 | } |
2471 | |
2472 | nstat_route_new_entry(rt); |
2473 | break; |
2474 | } |
2475 | bad: |
2476 | if (ifa) { |
2477 | ifa_remref(ifa); |
2478 | } |
2479 | return error; |
2480 | } |
2481 | #undef senderr |
2482 | |
2483 | int |
2484 | rtrequest(int req, struct sockaddr *dst, struct sockaddr *gateway, |
2485 | struct sockaddr *netmask, int flags, struct rtentry **ret_nrt) |
2486 | { |
2487 | int error; |
2488 | LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_NOTOWNED); |
2489 | lck_mtx_lock(rnh_lock); |
2490 | error = rtrequest_locked(req, dst, gateway, netmask, flags, ret_nrt); |
2491 | lck_mtx_unlock(rnh_lock); |
2492 | return error; |
2493 | } |
2494 | |
2495 | int |
2496 | rtrequest_scoped(int req, struct sockaddr *dst, struct sockaddr *gateway, |
2497 | struct sockaddr *netmask, int flags, struct rtentry **ret_nrt, |
2498 | unsigned int ifscope) |
2499 | { |
2500 | int error; |
2501 | LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_NOTOWNED); |
2502 | lck_mtx_lock(rnh_lock); |
2503 | error = rtrequest_scoped_locked(req, dst, gateway, netmask, flags, |
2504 | ret_nrt, ifscope); |
2505 | lck_mtx_unlock(rnh_lock); |
2506 | return error; |
2507 | } |
2508 | |
2509 | /* |
2510 | * Called from rtrequest(RTM_DELETE, ...) to fix up the route's ``family'' |
2511 | * (i.e., the routes related to it by the operation of cloning). This |
2512 | * routine is iterated over all potential former-child-routes by way of |
2513 | * rnh->rnh_walktree_from() above, and those that actually are children of |
2514 | * the late parent (passed in as VP here) are themselves deleted. |
2515 | */ |
2516 | static int |
2517 | rt_fixdelete(struct radix_node *rn, void *vp) |
2518 | { |
2519 | rtentry_ref_t rt = (rtentry_ref_t)rn; |
2520 | rtentry_ref_t rt0 = (rtentry_ref_t)vp; |
2521 | |
2522 | LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED); |
2523 | |
2524 | RT_LOCK(rt); |
2525 | if (rt->rt_parent == rt0 && |
2526 | !(rt->rt_flags & (RTF_CLONING | RTF_PRCLONING))) { |
2527 | /* |
2528 | * Safe to drop rt_lock and use rt_key, since holding |
2529 | * rnh_lock here prevents another thread from calling |
2530 | * rt_setgate() on this route. |
2531 | */ |
2532 | RT_UNLOCK(rt); |
2533 | return rtrequest_locked(RTM_DELETE, rt_key(rt), NULL, |
2534 | rt_mask(rt), flags: rt->rt_flags, NULL); |
2535 | } |
2536 | RT_UNLOCK(rt); |
2537 | return 0; |
2538 | } |
2539 | |
2540 | /* |
2541 | * This routine is called from rt_setgate() to do the analogous thing for |
2542 | * adds and changes. There is the added complication in this case of a |
2543 | * middle insert; i.e., insertion of a new network route between an older |
2544 | * network route and (cloned) host routes. For this reason, a simple check |
2545 | * of rt->rt_parent is insufficient; each candidate route must be tested |
2546 | * against the (mask, value) of the new route (passed as before in vp) |
2547 | * to see if the new route matches it. |
2548 | * |
2549 | * XXX - it may be possible to do fixdelete() for changes and reserve this |
2550 | * routine just for adds. I'm not sure why I thought it was necessary to do |
2551 | * changes this way. |
2552 | */ |
2553 | static int |
2554 | rt_fixchange(struct radix_node *rn, void *vp) |
2555 | { |
2556 | rtentry_ref_t rt = (rtentry_ref_t)rn; |
2557 | struct rtfc_arg *ap = vp; |
2558 | rtentry_ref_t rt0 = ap->rt0; |
2559 | struct radix_node_head *rnh = ap->rnh; |
2560 | u_char *xk1, *xm1, *xk2, *xmp; |
2561 | int i, len; |
2562 | |
2563 | LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED); |
2564 | |
2565 | RT_LOCK(rt); |
2566 | |
2567 | if (!rt->rt_parent || |
2568 | (rt->rt_flags & (RTF_CLONING | RTF_PRCLONING))) { |
2569 | RT_UNLOCK(rt); |
2570 | return 0; |
2571 | } |
2572 | |
2573 | if (rt->rt_parent == rt0) { |
2574 | goto delete_rt; |
2575 | } |
2576 | |
2577 | /* |
2578 | * There probably is a function somewhere which does this... |
2579 | * if not, there should be. |
2580 | */ |
2581 | len = imin(rt_key(rt0)->sa_len, rt_key(rt)->sa_len); |
2582 | |
2583 | xk1 = (u_char *)rt_key(rt0); |
2584 | xm1 = (u_char *)rt_mask(rt0); |
2585 | xk2 = (u_char *)rt_key(rt); |
2586 | |
2587 | /* |
2588 | * Avoid applying a less specific route; do this only if the parent |
2589 | * route (rt->rt_parent) is a network route, since otherwise its mask |
2590 | * will be NULL if it is a cloning host route. |
2591 | */ |
2592 | if ((xmp = (u_char *)rt_mask(rt->rt_parent)) != NULL) { |
2593 | int mlen = rt_mask(rt->rt_parent)->sa_len; |
2594 | if (mlen > rt_mask(rt0)->sa_len) { |
2595 | RT_UNLOCK(rt); |
2596 | return 0; |
2597 | } |
2598 | |
2599 | for (i = rnh->rnh_treetop->rn_offset; i < mlen; i++) { |
2600 | if ((xmp[i] & ~(xmp[i] ^ xm1[i])) != xmp[i]) { |
2601 | RT_UNLOCK(rt); |
2602 | return 0; |
2603 | } |
2604 | } |
2605 | } |
2606 | |
2607 | for (i = rnh->rnh_treetop->rn_offset; i < len; i++) { |
2608 | if ((xk2[i] & xm1[i]) != xk1[i]) { |
2609 | RT_UNLOCK(rt); |
2610 | return 0; |
2611 | } |
2612 | } |
2613 | |
2614 | /* |
2615 | * OK, this node is a clone, and matches the node currently being |
2616 | * changed/added under the node's mask. So, get rid of it. |
2617 | */ |
2618 | delete_rt: |
2619 | /* |
2620 | * Safe to drop rt_lock and use rt_key, since holding rnh_lock here |
2621 | * prevents another thread from calling rt_setgate() on this route. |
2622 | */ |
2623 | RT_UNLOCK(rt); |
2624 | return rtrequest_locked(RTM_DELETE, rt_key(rt), NULL, |
2625 | rt_mask(rt), flags: rt->rt_flags, NULL); |
2626 | } |
2627 | |
2628 | /* |
2629 | * Round up sockaddr len to multiples of 32-bytes. This will reduce |
2630 | * or even eliminate the need to re-allocate the chunk of memory used |
2631 | * for rt_key and rt_gateway in the event the gateway portion changes. |
2632 | * Certain code paths (e.g. IPsec) are notorious for caching the address |
2633 | * of rt_gateway; this rounding-up would help ensure that the gateway |
2634 | * portion never gets deallocated (though it may change contents) and |
2635 | * thus greatly simplifies things. |
2636 | */ |
2637 | #define SA_SIZE(x) (-(-((uintptr_t)(x)) & -(32))) |
2638 | |
2639 | /* |
2640 | * Sets the gateway and/or gateway route portion of a route; may be |
2641 | * called on an existing route to modify the gateway portion. Both |
2642 | * rt_key and rt_gateway are allocated out of the same memory chunk. |
2643 | * Route entry lock must be held by caller; this routine will return |
2644 | * with the lock held. |
2645 | */ |
2646 | int |
2647 | rt_setgate(struct rtentry *rt, struct sockaddr *dst, struct sockaddr *gate) |
2648 | { |
2649 | int dlen = (int)SA_SIZE(dst->sa_len), glen = (int)SA_SIZE(gate->sa_len); |
2650 | struct radix_node_head *rnh = NULL; |
2651 | boolean_t loop = FALSE; |
2652 | |
2653 | if (dst->sa_family != AF_INET && dst->sa_family != AF_INET6) { |
2654 | return EINVAL; |
2655 | } |
2656 | |
2657 | rnh = rt_tables[dst->sa_family]; |
2658 | LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED); |
2659 | RT_LOCK_ASSERT_HELD(rt); |
2660 | |
2661 | /* |
2662 | * If this is for a route that is on its way of being removed, |
2663 | * or is temporarily frozen, reject the modification request. |
2664 | */ |
2665 | if (rt->rt_flags & RTF_CONDEMNED) { |
2666 | return EBUSY; |
2667 | } |
2668 | |
2669 | /* Add an extra ref for ourselves */ |
2670 | RT_ADDREF_LOCKED(rt); |
2671 | |
2672 | if (rt->rt_flags & RTF_GATEWAY) { |
2673 | if ((dst->sa_len == gate->sa_len) && |
2674 | (dst->sa_family == AF_INET || dst->sa_family == AF_INET6)) { |
2675 | struct sockaddr_storage dst_ss, gate_ss; |
2676 | |
2677 | (void) sa_copy(src: dst, dst: &dst_ss, NULL); |
2678 | (void) sa_copy(src: gate, dst: &gate_ss, NULL); |
2679 | |
2680 | loop = sa_equal(SA(&dst_ss), SA(&gate_ss)); |
2681 | } else { |
2682 | loop = (dst->sa_len == gate->sa_len && |
2683 | sa_equal(dst, gate)); |
2684 | } |
2685 | } |
2686 | |
2687 | /* |
2688 | * A (cloning) network route with the destination equal to the gateway |
2689 | * will create an endless loop (see notes below), so disallow it. |
2690 | */ |
2691 | if (((rt->rt_flags & (RTF_HOST | RTF_GATEWAY | RTF_LLINFO)) == |
2692 | RTF_GATEWAY) && loop) { |
2693 | /* Release extra ref */ |
2694 | RT_REMREF_LOCKED(rt); |
2695 | return EADDRNOTAVAIL; |
2696 | } |
2697 | |
2698 | /* |
2699 | * A host route with the destination equal to the gateway |
2700 | * will interfere with keeping LLINFO in the routing |
2701 | * table, so disallow it. |
2702 | */ |
2703 | if (((rt->rt_flags & (RTF_HOST | RTF_GATEWAY | RTF_LLINFO)) == |
2704 | (RTF_HOST | RTF_GATEWAY)) && loop) { |
2705 | /* |
2706 | * The route might already exist if this is an RTM_CHANGE |
2707 | * or a routing redirect, so try to delete it. |
2708 | */ |
2709 | if (rt_key(rt) != NULL) { |
2710 | /* |
2711 | * Safe to drop rt_lock and use rt_key, rt_gateway, |
2712 | * since holding rnh_lock here prevents another thread |
2713 | * from calling rt_setgate() on this route. |
2714 | */ |
2715 | RT_UNLOCK(rt); |
2716 | (void) rtrequest_locked(RTM_DELETE, rt_key(rt), |
2717 | gateway: rt->rt_gateway, rt_mask(rt), flags: rt->rt_flags, NULL); |
2718 | RT_LOCK(rt); |
2719 | } |
2720 | /* Release extra ref */ |
2721 | RT_REMREF_LOCKED(rt); |
2722 | return EADDRNOTAVAIL; |
2723 | } |
2724 | |
2725 | /* |
2726 | * The destination is not directly reachable. Get a route |
2727 | * to the next-hop gateway and store it in rt_gwroute. |
2728 | */ |
2729 | if (rt->rt_flags & RTF_GATEWAY) { |
2730 | rtentry_ref_t gwrt; |
2731 | unsigned int ifscope; |
2732 | |
2733 | if (dst->sa_family == AF_INET) { |
2734 | ifscope = sin_get_ifscope(sa: dst); |
2735 | } else if (dst->sa_family == AF_INET6) { |
2736 | ifscope = sin6_get_ifscope(sa: dst); |
2737 | } else { |
2738 | ifscope = IFSCOPE_NONE; |
2739 | } |
2740 | |
2741 | RT_UNLOCK(rt); |
2742 | /* |
2743 | * Don't ignore RTF_CLONING, since we prefer that rt_gwroute |
2744 | * points to a clone rather than a cloning route; see above |
2745 | * check for cloning loop avoidance (dst == gate). |
2746 | */ |
2747 | gwrt = rtalloc1_scoped_locked(dst: gate, report: 1, RTF_PRCLONING, ifscope); |
2748 | if (gwrt != NULL) { |
2749 | RT_LOCK_ASSERT_NOTHELD(gwrt); |
2750 | } |
2751 | RT_LOCK(rt); |
2752 | |
2753 | /* |
2754 | * Cloning loop avoidance: |
2755 | * |
2756 | * In the presence of protocol-cloning and bad configuration, |
2757 | * it is possible to get stuck in bottomless mutual recursion |
2758 | * (rtrequest rt_setgate rtalloc1). We avoid this by not |
2759 | * allowing protocol-cloning to operate for gateways (which |
2760 | * is probably the correct choice anyway), and avoid the |
2761 | * resulting reference loops by disallowing any route to run |
2762 | * through itself as a gateway. This is obviously mandatory |
2763 | * when we get rt->rt_output(). It implies that a route to |
2764 | * the gateway must already be present in the system in order |
2765 | * for the gateway to be referred to by another route. |
2766 | */ |
2767 | if (gwrt == rt) { |
2768 | RT_REMREF_LOCKED(gwrt); |
2769 | /* Release extra ref */ |
2770 | RT_REMREF_LOCKED(rt); |
2771 | return EADDRINUSE; /* failure */ |
2772 | } |
2773 | |
2774 | /* |
2775 | * If scoped, the gateway route must use the same interface; |
2776 | * we're holding rnh_lock now, so rt_gateway and rt_ifp of gwrt |
2777 | * should not change and are freely accessible. |
2778 | */ |
2779 | if (ifscope != IFSCOPE_NONE && (rt->rt_flags & RTF_IFSCOPE) && |
2780 | gwrt != NULL && gwrt->rt_ifp != NULL && |
2781 | gwrt->rt_ifp->if_index != ifscope) { |
2782 | rtfree_locked(rt: gwrt); /* rt != gwrt, no deadlock */ |
2783 | /* Release extra ref */ |
2784 | RT_REMREF_LOCKED(rt); |
2785 | return (rt->rt_flags & RTF_HOST) ? |
2786 | EHOSTUNREACH : ENETUNREACH; |
2787 | } |
2788 | |
2789 | /* Check again since we dropped the lock above */ |
2790 | if (rt->rt_flags & RTF_CONDEMNED) { |
2791 | if (gwrt != NULL) { |
2792 | rtfree_locked(rt: gwrt); |
2793 | } |
2794 | /* Release extra ref */ |
2795 | RT_REMREF_LOCKED(rt); |
2796 | return EBUSY; |
2797 | } |
2798 | |
2799 | /* Set gateway route; callee adds ref to gwrt if non-NULL */ |
2800 | rt_set_gwroute(rt, dst, gwrt); |
2801 | |
2802 | /* |
2803 | * In case the (non-scoped) default route gets modified via |
2804 | * an ICMP redirect, record the interface index used for the |
2805 | * primary ifscope. Also done in rt_setif() to take care |
2806 | * of the non-redirect cases. |
2807 | */ |
2808 | if (rt_primary_default(rt, dst) && rt->rt_ifp != NULL) { |
2809 | set_primary_ifscope(af: dst->sa_family, |
2810 | ifscope: rt->rt_ifp->if_index); |
2811 | } |
2812 | |
2813 | #if NECP |
2814 | /* |
2815 | * If this is a change in a default route, update |
2816 | * necp client watchers to re-evaluate |
2817 | */ |
2818 | if (SA_DEFAULT(dst)) { |
2819 | necp_update_all_clients(); |
2820 | } |
2821 | #endif /* NECP */ |
2822 | |
2823 | /* |
2824 | * Tell the kernel debugger about the new default gateway |
2825 | * if the gateway route uses the primary interface, or |
2826 | * if we are in a transient state before the non-scoped |
2827 | * default gateway is installed (similar to how the system |
2828 | * was behaving in the past). In future, it would be good |
2829 | * to do all this only when KDP is enabled. |
2830 | */ |
2831 | if ((dst->sa_family == AF_INET) && |
2832 | gwrt != NULL && gwrt->rt_gateway->sa_family == AF_LINK && |
2833 | (gwrt->rt_ifp->if_index == get_primary_ifscope(AF_INET) || |
2834 | get_primary_ifscope(AF_INET) == IFSCOPE_NONE)) { |
2835 | kdp_set_gateway_mac(SDL(gwrt->rt_gateway)-> |
2836 | sdl_data); |
2837 | } |
2838 | |
2839 | /* Release extra ref from rtalloc1() */ |
2840 | if (gwrt != NULL) { |
2841 | RT_REMREF(gwrt); |
2842 | } |
2843 | } |
2844 | |
2845 | /* |
2846 | * Prepare to store the gateway in rt_gateway. Both dst and gateway |
2847 | * are stored one after the other in the same malloc'd chunk. If we |
2848 | * have room, reuse the old buffer since rt_gateway already points |
2849 | * to the right place. Otherwise, malloc a new block and update |
2850 | * the 'dst' address and point rt_gateway to the right place. |
2851 | */ |
2852 | if (rt->rt_gateway == NULL || glen > SA_SIZE(rt->rt_gateway->sa_len)) { |
2853 | caddr_t new; |
2854 | |
2855 | /* The underlying allocation is done with M_WAITOK set */ |
2856 | new = kalloc_data(dlen + glen, Z_WAITOK | Z_ZERO); |
2857 | if (new == NULL) { |
2858 | /* Clear gateway route */ |
2859 | rt_set_gwroute(rt, dst, NULL); |
2860 | /* Release extra ref */ |
2861 | RT_REMREF_LOCKED(rt); |
2862 | return ENOBUFS; |
2863 | } |
2864 | |
2865 | /* |
2866 | * Copy from 'dst' and not rt_key(rt) because we can get |
2867 | * here to initialize a newly allocated route entry, in |
2868 | * which case rt_key(rt) is NULL (and so does rt_gateway). |
2869 | */ |
2870 | SOCKADDR_COPY(dst, new, dst->sa_len); |
2871 | rt_key_free(rt); /* free old block; NULL is okay */ |
2872 | rt->rt_nodes->rn_key = new; |
2873 | rt->rt_gateway = SA(new + dlen); |
2874 | } |
2875 | |
2876 | /* |
2877 | * Copy the new gateway value into the memory chunk. |
2878 | */ |
2879 | SOCKADDR_COPY(gate, rt->rt_gateway, gate->sa_len); |
2880 | |
2881 | /* |
2882 | * For consistency between rt_gateway and rt_key(gwrt). |
2883 | */ |
2884 | if ((rt->rt_flags & RTF_GATEWAY) && rt->rt_gwroute != NULL && |
2885 | (rt->rt_gwroute->rt_flags & RTF_IFSCOPE)) { |
2886 | if (rt->rt_gateway->sa_family == AF_INET && |
2887 | rt_key(rt->rt_gwroute)->sa_family == AF_INET) { |
2888 | sin_set_ifscope(sa: rt->rt_gateway, |
2889 | ifscope: sin_get_ifscope(rt_key(rt->rt_gwroute))); |
2890 | } else if (rt->rt_gateway->sa_family == AF_INET6 && |
2891 | rt_key(rt->rt_gwroute)->sa_family == AF_INET6) { |
2892 | sin6_set_ifscope(sa: rt->rt_gateway, |
2893 | ifscope: sin6_get_ifscope(rt_key(rt->rt_gwroute))); |
2894 | } |
2895 | } |
2896 | |
2897 | /* |
2898 | * This isn't going to do anything useful for host routes, so |
2899 | * don't bother. Also make sure we have a reasonable mask |
2900 | * (we don't yet have one during adds). |
2901 | */ |
2902 | if (!(rt->rt_flags & RTF_HOST) && rt_mask(rt) != 0) { |
2903 | struct rtfc_arg arg; |
2904 | arg.rnh = rnh; |
2905 | arg.rt0 = rt; |
2906 | RT_UNLOCK(rt); |
2907 | rnh->rnh_walktree_from(rnh, rt_key(rt), rt_mask(rt), |
2908 | rt_fixchange, &arg); |
2909 | RT_LOCK(rt); |
2910 | } |
2911 | |
2912 | /* Release extra ref */ |
2913 | RT_REMREF_LOCKED(rt); |
2914 | return 0; |
2915 | } |
2916 | |
2917 | #undef SA_SIZE |
2918 | |
2919 | void |
2920 | rt_set_gwroute(struct rtentry *rt, struct sockaddr *dst, struct rtentry *gwrt) |
2921 | { |
2922 | boolean_t gwrt_isrouter; |
2923 | |
2924 | LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED); |
2925 | RT_LOCK_ASSERT_HELD(rt); |
2926 | |
2927 | if (gwrt != NULL) { |
2928 | RT_ADDREF(gwrt); /* for this routine */ |
2929 | } |
2930 | /* |
2931 | * Get rid of existing gateway route; if rt_gwroute is already |
2932 | * set to gwrt, this is slightly redundant (though safe since |
2933 | * we held an extra ref above) but makes the code simpler. |
2934 | */ |
2935 | if (rt->rt_gwroute != NULL) { |
2936 | rtentry_ref_t ogwrt = rt->rt_gwroute; |
2937 | |
2938 | VERIFY(rt != ogwrt); /* sanity check */ |
2939 | rt->rt_gwroute = NULL; |
2940 | RT_UNLOCK(rt); |
2941 | rtfree_locked(rt: ogwrt); |
2942 | RT_LOCK(rt); |
2943 | VERIFY(rt->rt_gwroute == NULL); |
2944 | } |
2945 | |
2946 | /* |
2947 | * And associate the new gateway route. |
2948 | */ |
2949 | if ((rt->rt_gwroute = gwrt) != NULL) { |
2950 | RT_ADDREF(gwrt); /* for rt */ |
2951 | |
2952 | if (rt->rt_flags & RTF_WASCLONED) { |
2953 | /* rt_parent might be NULL if rt is embryonic */ |
2954 | gwrt_isrouter = (rt->rt_parent != NULL && |
2955 | |
---|