route.c source code [xnu/bsd/net/route.c]

1	/*
2	* Copyright (c) 2000-2023 Apple Inc. All rights reserved.
3	*
4	* @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5	*
6	* This file contains Original Code and/or Modifications of Original Code
7	* as defined in and that are subject to the Apple Public Source License
8	* Version 2.0 (the 'License'). You may not use this file except in
9	* compliance with the License. The rights granted to you under the License
10	* may not be used to create, or enable the creation or redistribution of,
11	* unlawful or unlicensed copies of an Apple operating system, or to
12	* circumvent, violate, or enable the circumvention or violation of, any
13	* terms of an Apple operating system software license agreement.
14	*
15	* Please obtain a copy of the License at
16	* http://www.opensource.apple.com/apsl/ and read it before using this file.
17	*
18	* The Original Code and all software distributed under the License are
19	* distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20	* EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21	* INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22	* FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23	* Please see the License for the specific language governing rights and
24	* limitations under the License.
25	*
26	* @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27	*/
28	/*
29	* Copyright (c) 1980, 1986, 1991, 1993
30	* The Regents of the University of California. All rights reserved.
31	*
32	* Redistribution and use in source and binary forms, with or without
33	* modification, are permitted provided that the following conditions
34	* are met:
35	* 1. Redistributions of source code must retain the above copyright
36	* notice, this list of conditions and the following disclaimer.
37	* 2. Redistributions in binary form must reproduce the above copyright
38	* notice, this list of conditions and the following disclaimer in the
39	* documentation and/or other materials provided with the distribution.
40	* 3. All advertising materials mentioning features or use of this software
41	* must display the following acknowledgement:
42	* This product includes software developed by the University of
43	* California, Berkeley and its contributors.
44	* 4. Neither the name of the University nor the names of its contributors
45	* may be used to endorse or promote products derived from this software
46	* without specific prior written permission.
47	*
48	* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
49	* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
50	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
51	* ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
52	* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
53	* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
54	* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
55	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
56	* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
57	* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
58	* SUCH DAMAGE.
59	*
60	* @(#)route.c 8.2 (Berkeley) 11/15/93
61	* $FreeBSD: src/sys/net/route.c,v 1.59.2.3 2001/07/29 19:18:02 ume Exp $
62	*/
63
64	#include <sys/param.h>
65	#include <sys/sysctl.h>
66	#include <sys/systm.h>
67	#include <sys/malloc.h>
68	#include <sys/mbuf.h>
69	#include <sys/socket.h>
70	#include <sys/domain.h>
71	#include <sys/stat.h>
72	#include <sys/ubc.h>
73	#include <sys/vnode.h>
74	#include <sys/syslog.h>
75	#include <sys/queue.h>
76	#include <sys/mcache.h>
77	#include <sys/priv.h>
78	#include <sys/protosw.h>
79	#include <sys/sdt.h>
80	#include <sys/kernel.h>
81	#include <kern/locks.h>
82	#include <kern/zalloc.h>
83
84	#include <net/dlil.h>
85	#include <net/if.h>
86	#include <net/route.h>
87	#include <net/ntstat.h>
88	#include <net/nwk_wq.h>
89	#if NECP
90	#include <net/necp.h>
91	#endif /* NECP */
92
93	#include <netinet/in.h>
94	#include <netinet/in_var.h>
95	#include <netinet/ip_var.h>
96	#include <netinet/ip.h>
97	#include <netinet/ip6.h>
98	#include <netinet/in_arp.h>
99
100	#include <netinet6/ip6_var.h>
101	#include <netinet6/in6_var.h>
102	#include <netinet6/nd6.h>
103
104	#include <net/if_dl.h>
105
106	#include <net/sockaddr_utils.h>
107
108	#include <libkern/OSAtomic.h>
109	#include <libkern/OSDebug.h>
110
111	#include <pexpert/pexpert.h>
112
113	#if CONFIG_MACF
114	#include <sys/kauth.h>
115	#endif
116
117	#include <sys/constrained_ctypes.h>
118
119	/*
120	* Synchronization notes:
121	*
122	* Routing entries fall under two locking domains: the global routing table
123	* lock (rnh_lock) and the per-entry lock (rt_lock); the latter is a mutex that
124	* resides (statically defined) in the rtentry structure.
125	*
126	* The locking domains for routing are defined as follows:
127	*
128	* The global routing lock is used to serialize all accesses to the radix
129	* trees defined by rt_tables[], as well as the tree of masks. This includes
130	* lookups, insertions and removals of nodes to/from the respective tree.
131	* It is also used to protect certain fields in the route entry that aren't
132	* often modified and/or require global serialization (more details below.)
133	*
134	* The per-route entry lock is used to serialize accesses to several routing
135	* entry fields (more details below.) Acquiring and releasing this lock is
136	* done via RT_LOCK() and RT_UNLOCK() routines.
137	*
138	* In cases where both rnh_lock and rt_lock must be held, the former must be
139	* acquired first in order to maintain lock ordering. It is not a requirement
140	* that rnh_lock be acquired first before rt_lock, but in case both must be
141	* acquired in succession, the correct lock ordering must be followed.
142	*
143	* The fields of the rtentry structure are protected in the following way:
144	*
145	* rt_nodes[]
146	*
147	* - Routing table lock (rnh_lock).
148	*
149	* rt_parent, rt_mask, rt_llinfo_free, rt_tree_genid
150	*
151	* - Set once during creation and never changes; no locks to read.
152	*
153	* rt_flags, rt_genmask, rt_llinfo, rt_rmx, rt_refcnt, rt_gwroute
154	*
155	* - Routing entry lock (rt_lock) for read/write access.
156	*
157	* - Some values of rt_flags are either set once at creation time,
158	* or aren't currently used, and thus checking against them can
159	* be done without rt_lock: RTF_GATEWAY, RTF_HOST, RTF_DYNAMIC,
160	* RTF_DONE, RTF_XRESOLVE, RTF_STATIC, RTF_BLACKHOLE, RTF_ANNOUNCE,
161	* RTF_USETRAILERS, RTF_WASCLONED, RTF_PINNED, RTF_LOCAL,
162	* RTF_BROADCAST, RTF_MULTICAST, RTF_IFSCOPE, RTF_IFREF.
163	*
164	* rt_key, rt_gateway, rt_ifp, rt_ifa
165	*
166	* - Always written/modified with both rnh_lock and rt_lock held.
167	*
168	* - May be read freely with rnh_lock held, else must hold rt_lock
169	* for read access; holding both locks for read is also okay.
170	*
171	* - In the event rnh_lock is not acquired, or is not possible to be
172	* acquired across the operation, setting RTF_CONDEMNED on a route
173	* entry will prevent its rt_key, rt_gateway, rt_ifp and rt_ifa
174	* from being modified. This is typically done on a route that
175	* has been chosen for a removal (from the tree) prior to dropping
176	* the rt_lock, so that those values will remain the same until
177	* the route is freed.
178	*
179	* When rnh_lock is held rt_setgate(), rt_setif(), and rtsetifa() are
180	* single-threaded, thus exclusive. This flag will also prevent the
181	* route from being looked up via rt_lookup().
182	*
183	* rt_genid
184	*
185	* - Assumes that 32-bit writes are atomic; no locks.
186	*
187	* rt_dlt, rt_output
188	*
189	* - Currently unused; no locks.
190	*
191	* Operations on a route entry can be described as follows:
192	*
193	* CREATE an entry with reference count set to 0 as part of RTM_ADD/RESOLVE.
194	*
195	* INSERTION of an entry into the radix tree holds the rnh_lock, checks
196	* for duplicates and then adds the entry. rtrequest returns the entry
197	* after bumping up the reference count to 1 (for the caller).
198	*
199	* LOOKUP of an entry holds the rnh_lock and bumps up the reference count
200	* before returning; it is valid to also bump up the reference count using
201	* RT_ADDREF after the lookup has returned an entry.
202	*
203	* REMOVAL of an entry from the radix tree holds the rnh_lock, removes the
204	* entry but does not decrement the reference count. Removal happens when
205	* the route is explicitly deleted (RTM_DELETE) or when it is in the cached
206	* state and it expires. The route is said to be "down" when it is no
207	* longer present in the tree. Freeing the entry will happen on the last
208	* reference release of such a "down" route.
209	*
210	* RT_ADDREF/RT_REMREF operates on the routing entry which increments/
211	* decrements the reference count, rt_refcnt, atomically on the rtentry.
212	* rt_refcnt is modified only using this routine. The general rule is to
213	* do RT_ADDREF in the function that is passing the entry as an argument,
214	* in order to prevent the entry from being freed by the callee.
215	*/
216	extern void kdp_set_gateway_mac(void *gatewaymac);
217
218	__private_extern__ struct rtstat rtstat = {
219	.rts_badredirect = `0`,
220	.rts_dynamic = `0`,
221	.rts_newgateway = `0`,
222	.rts_unreach = `0`,
223	.rts_wildcard = `0`,
224	.rts_badrtgwroute = `0`
225	};
226	struct radix_node_head *rt_tables[AF_MAX + `1`];
227
228	static LCK_GRP_DECLARE(rnh_lock_grp, "route");
229	LCK_MTX_DECLARE(rnh_lock_data, &rnh_lock_grp); / global routing tables mutex /
230
231	int rttrash = `0`; / routes not in table but not freed /
232
233	boolean_t trigger_v6_defrtr_select = FALSE;
234	unsigned int rte_debug = `0`;
235
236	/ Possible flags for rte_debug /
237	#define RTD_DEBUG 0x1 /* enable or disable rtentry debug facility */
238	#define RTD_TRACE 0x2 /* trace alloc, free, refcnt and lock */
239	#define RTD_NO_FREE 0x4 /* don't free (good to catch corruptions) */
240
241	#define RTE_NAME "rtentry" /* name for zone and rt_lock */
242
243	static struct zone rte_zone; /* special zone for rtentry /
244	#define RTE_ZONE_MAX 65536 /* maximum elements in zone */
245	#define RTE_ZONE_NAME RTE_NAME /* name of rtentry zone */
246
247	#define RTD_INUSE 0xFEEDFACE /* entry is in use */
248	#define RTD_FREED 0xDEADBEEF /* entry is freed */
249
250	#define MAX_SCOPE_ADDR_STR_LEN (MAX_IPv6_STR_LEN + 6)
251
252	/ Lock group and attribute for routing entry locks /
253	static LCK_ATTR_DECLARE(rte_mtx_attr, `0`, `0`);
254	static LCK_GRP_DECLARE(rte_mtx_grp, RTE_NAME);
255
256	/ For gdb /
257	__private_extern__ unsigned int ctrace_stack_size = CTRACE_STACK_SIZE;
258	__private_extern__ unsigned int ctrace_hist_size = CTRACE_HIST_SIZE;
259
260	/*
261	* Debug variant of rtentry structure.
262	*/
263	struct rtentry_dbg {
264	struct rtentry rtd_entry; / rtentry /
265	struct rtentry rtd_entry_saved; / saved rtentry /
266	uint32_t rtd_inuse; / in use pattern /
267	uint16_t rtd_refhold_cnt; / # of rtref /
268	uint16_t rtd_refrele_cnt; / # of rtunref /
269	uint32_t rtd_lock_cnt; / # of locks /
270	uint32_t rtd_unlock_cnt; / # of unlocks /
271	/*
272	* Alloc and free callers.
273	*/
274	ctrace_t rtd_alloc;
275	ctrace_t rtd_free;
276	/*
277	* Circular lists of rtref and rtunref callers.
278	*/
279	ctrace_t rtd_refhold[CTRACE_HIST_SIZE];
280	ctrace_t rtd_refrele[CTRACE_HIST_SIZE];
281	/*
282	* Circular lists of locks and unlocks.
283	*/
284	ctrace_t rtd_lock[CTRACE_HIST_SIZE];
285	ctrace_t rtd_unlock[CTRACE_HIST_SIZE];
286	/*
287	* Trash list linkage
288	*/
289	TAILQ_ENTRY(rtentry_dbg) rtd_trash_link;
290	};
291	__CCT_DECLARE_CONSTRAINED_PTR_TYPES(struct rtentry_dbg, rtentry_dbg);
292
293	/ List of trash route entries protected by rnh_lock /
294	static TAILQ_HEAD(, rtentry_dbg) rttrash_head;
295
296	static void rte_lock_init(struct rtentry *);
297	static void rte_lock_destroy(struct rtentry *);
298	static inline struct rtentry rte_alloc_debug(void*);
299	static inline void rte_free_debug(struct rtentry *);
300	static inline void rte_lock_debug(struct rtentry_dbg *);
301	static inline void rte_unlock_debug(struct rtentry_dbg *);
302	static void rt_maskedcopy(const struct sockaddr *,
303	struct sockaddr , const* struct sockaddr *);
304	static void rtable_init(void **);
305	static inline void rtref_audit(struct rtentry_dbg *);
306	static inline void rtunref_audit(struct rtentry_dbg *);
307	static struct rtentry rtalloc1_common_locked(struct* sockaddr , int*, uint32_t,
308	unsigned int);
309	static int rtrequest_common_locked(int, struct sockaddr *,
310	struct sockaddr , struct* sockaddr , int, struct* rtentry **,
311	unsigned int);
312	static struct rtentry rtalloc1_locked(struct* sockaddr , int*, uint32_t);
313	static void rtalloc_ign_common_locked(struct route , uint32_t, unsigned* int);
314	static inline void sin6_set_ifscope(struct sockaddr , unsigned* int);
315	static inline void sin6_set_embedded_ifscope(struct sockaddr , unsigned* int);
316	static inline unsigned int sin6_get_embedded_ifscope(struct sockaddr *);
317	static struct sockaddr ma_copy(int, struct* sockaddr *,
318	struct sockaddr_storage , unsigned* int);
319	static struct sockaddr sa_trim(struct* sockaddr *, uint8_t);
320	static struct radix_node node_lookup(struct* sockaddr , struct* sockaddr *,
321	unsigned int);
322	static struct radix_node node_lookup_default(int*);
323	static struct rtentry rt_lookup_common(boolean_t, boolean_t, struct* sockaddr *,
324	struct sockaddr , struct* radix_node_head , unsigned* int);
325	static int rn_match_ifscope(struct radix_node , void* *);
326	static struct ifaddr ifa_ifwithroute_common_locked(int*,
327	const struct sockaddr , const* struct sockaddr , unsigned* int);
328	static struct rtentry rte_alloc(void*);
329	static void rte_free(struct rtentry *);
330	static void rtfree_common(struct rtentry *, boolean_t);
331	static void rte_if_ref(struct ifnet , int*);
332	static void rt_set_idleref(struct rtentry *);
333	static void rt_clear_idleref(struct rtentry *);
334	static void rt_str4(struct rtentry , char* , uint32_t, char* *, uint32_t);
335	static void rt_str6(struct rtentry , char* , uint32_t, char* *, uint32_t);
336	static boolean_t route_ignore_protocol_cloning_for_dst(struct rtentry , struct* sockaddr *);
337
338	uint32_t route_genid_inet = `0`;
339	uint32_t route_genid_inet6 = `0`;
340
341	#define ASSERT_SINIFSCOPE(sa) { \
342	if ((sa)->sa_family != AF_INET \|\| \
343	(sa)->sa_len < sizeof (struct sockaddr_in)) \
344	panic("%s: bad sockaddr_in %p", __func__, sa); \
345	}
346
347	#define ASSERT_SIN6IFSCOPE(sa) { \
348	if ((sa)->sa_family != AF_INET6 \|\| \
349	(sa)->sa_len < sizeof (struct sockaddr_in6)) \
350	panic("%s: bad sockaddr_in6 %p", __func__, sa); \
351	}
352
353	/*
354	* Argument to leaf-matching routine; at present it is scoped routing
355	* specific but can be expanded in future to include other search filters.
356	*/
357	struct matchleaf_arg {
358	unsigned int ifscope; / interface scope /
359	};
360
361	/*
362	* For looking up the non-scoped default route (sockaddr instead
363	* of sockaddr_in for convenience).
364	*/
365	static struct sockaddr sin_def = {
366	.sa_len = sizeof(struct sockaddr_in),
367	.sa_family = AF_INET,
368	.sa_data = { `0`, }
369	};
370
371	static struct sockaddr_in6 sin6_def = {
372	.sin6_len = sizeof(struct sockaddr_in6),
373	.sin6_family = AF_INET6,
374	.sin6_port = `0`,
375	.sin6_flowinfo = `0`,
376	.sin6_addr = IN6ADDR_ANY_INIT,
377	.sin6_scope_id = `0`
378	};
379
380	/*
381	* Interface index (scope) of the primary interface; determined at
382	* the time when the default, non-scoped route gets added, changed
383	* or deleted. Protected by rnh_lock.
384	*/
385	static unsigned int primary_ifscope = IFSCOPE_NONE;
386	static unsigned int primary6_ifscope = IFSCOPE_NONE;
387
388	#define INET_DEFAULT(sa) \
389	((sa)->sa_family == AF_INET && SIN(sa)->sin_addr.s_addr == 0)
390
391	#define INET6_DEFAULT(sa) \
392	((sa)->sa_family == AF_INET6 && \
393	IN6_IS_ADDR_UNSPECIFIED(&SIN6(sa)->sin6_addr))
394
395	#define SA_DEFAULT(sa) (INET_DEFAULT(sa) \|\| INET6_DEFAULT(sa))
396	#define RT(r) ((rtentry_ref_t)r)
397	#define RN(r) ((struct radix_node *)r)
398	#define RT_HOST(r) (RT(r)->rt_flags & RTF_HOST)
399
400	#define ROUTE_VERBOSE_LOGGING 0
401	unsigned int rt_verbose = ROUTE_VERBOSE_LOGGING;
402	SYSCTL_DECL(_net_route);
403	SYSCTL_UINT(_net_route, OID_AUTO, verbose, CTLFLAG_RW \| CTLFLAG_LOCKED,
404	&rt_verbose, ROUTE_VERBOSE_LOGGING, "");
405
406	static void
407	rtable_init(void **table)
408	{
409	struct domain *dom;
410
411	domain_proto_mtx_lock_assert_held();
412
413	TAILQ_FOREACH(dom, &domains, dom_entry) {
414	if (dom->dom_rtattach != NULL) {
415	dom->dom_rtattach(&table[dom->dom_family],
416	dom->dom_rtoffset);
417	}
418	}
419	}
420
421	/*
422	* Called by route_dinit().
423	*/
424	void
425	route_init(void)
426	{
427	int size;
428
429	_CASSERT(offsetof(struct route, ro_rt) ==
430	offsetof(struct route_in6, ro_rt));
431	_CASSERT(offsetof(struct route, ro_srcia) ==
432	offsetof(struct route_in6, ro_srcia));
433	_CASSERT(offsetof(struct route, ro_flags) ==
434	offsetof(struct route_in6, ro_flags));
435	_CASSERT(offsetof(struct route, ro_dst) ==
436	offsetof(struct route_in6, ro_dst));
437
438	PE_parse_boot_argn(arg_string: "rte_debug", arg_ptr: &rte_debug, max_arg: sizeof(rte_debug));
439	if (rte_debug != `0`) {
440	rte_debug \|= RTD_DEBUG;
441	}
442
443	lck_mtx_lock(rnh_lock);
444	rn_init(); / initialize all zeroes, all ones, mask table /
445	lck_mtx_unlock(rnh_lock);
446	rtable_init(table: (void **)rt_tables);
447
448	if (rte_debug & RTD_DEBUG) {
449	size = sizeof(struct rtentry_dbg);
450	} else {
451	size = sizeof(struct rtentry);
452	}
453
454	rte_zone = zone_create(RTE_ZONE_NAME, size, flags: ZC_NONE);
455
456	TAILQ_INIT(&rttrash_head);
457	}
458
459	/*
460	* Given a route, determine whether or not it is the non-scoped default
461	* route; dst typically comes from rt_key(rt) but may be coming from
462	* a separate place when rt is in the process of being created.
463	*/
464	boolean_t
465	rt_primary_default(struct rtentry rt, struct* sockaddr *dst)
466	{
467	return SA_DEFAULT(dst) && !(rt->rt_flags & RTF_IFSCOPE);
468	}
469
470	/*
471	* Set the ifscope of the primary interface; caller holds rnh_lock.
472	*/
473	void
474	set_primary_ifscope(int af, unsigned int ifscope)
475	{
476	if (af == AF_INET) {
477	primary_ifscope = ifscope;
478	} else {
479	primary6_ifscope = ifscope;
480	}
481	}
482
483	/*
484	* Return the ifscope of the primary interface; caller holds rnh_lock.
485	*/
486	unsigned int
487	get_primary_ifscope(int af)
488	{
489	return af == AF_INET ? primary_ifscope : primary6_ifscope;
490	}
491
492	/*
493	* Set the scope ID of a given a sockaddr_in.
494	*/
495	void
496	sin_set_ifscope(struct sockaddr sa, unsigned* int ifscope)
497	{
498	/ Caller must pass in sockaddr_in /
499	ASSERT_SINIFSCOPE(sa);
500
501	SINIFSCOPE(sa)->sin_scope_id = ifscope;
502	}
503
504	/*
505	* Set the scope ID of given a sockaddr_in6.
506	*/
507	static inline void
508	sin6_set_ifscope(struct sockaddr sa, unsigned* int ifscope)
509	{
510	/ Caller must pass in sockaddr_in6 /
511	ASSERT_SIN6IFSCOPE(sa);
512
513	SIN6IFSCOPE(sa)->sin6_scope_id = ifscope;
514	}
515
516	/*
517	* Given a sockaddr_in, return the scope ID to the caller.
518	*/
519	unsigned int
520	sin_get_ifscope(struct sockaddr *sa)
521	{
522	/ Caller must pass in sockaddr_in /
523	ASSERT_SINIFSCOPE(sa);
524
525	return SINIFSCOPE(sa)->sin_scope_id;
526	}
527
528	/*
529	* Given a sockaddr_in6, return the scope ID to the caller.
530	*/
531	unsigned int
532	sin6_get_ifscope(struct sockaddr *sa)
533	{
534	/ Caller must pass in sockaddr_in6 /
535	ASSERT_SIN6IFSCOPE(sa);
536
537	return SIN6IFSCOPE(sa)->sin6_scope_id;
538	}
539
540	static inline void
541	sin6_set_embedded_ifscope(struct sockaddr sa, unsigned* int ifscope)
542	{
543	if (!in6_embedded_scope) {
544	SIN6(sa)->sin6_scope_id = ifscope;
545	return;
546	}
547
548	/ Caller must pass in sockaddr_in6 /
549	ASSERT_SIN6IFSCOPE(sa);
550	VERIFY(IN6_IS_SCOPE_EMBED(&(SIN6(sa)->sin6_addr)));
551
552	SIN6(sa)->sin6_addr.s6_addr16[`1`] = htons((uint16_t)ifscope);
553	}
554
555	static inline unsigned int
556	sin6_get_embedded_ifscope(struct sockaddr *sa)
557	{
558	if (!in6_embedded_scope) {
559	return SIN6(sa)->sin6_scope_id;
560	}
561	/ Caller must pass in sockaddr_in6 /
562	ASSERT_SIN6IFSCOPE(sa);
563
564	return ntohs(SIN6(sa)->sin6_addr.s6_addr16[`1`]);
565	}
566
567	/*
568	* Copy a sockaddr_{in,in6} src to a dst storage and set scope ID into dst.
569	*
570	* To clear the scope ID, pass is a NULL pifscope. To set the scope ID, pass
571	* in a non-NULL pifscope with non-zero ifscope. Otherwise if pifscope is
572	* non-NULL and ifscope is IFSCOPE_NONE, the existing scope ID is left intact.
573	* In any case, the effective scope ID value is returned to the caller via
574	* pifscope, if it is non-NULL.
575	*/
576	struct sockaddr *
577	sa_copy(struct sockaddr src, struct* sockaddr_storage *dst,
578	unsigned int *pifscope)
579	{
580	int af = src->sa_family;
581	unsigned int ifscope = (pifscope != NULL) ? *pifscope : IFSCOPE_NONE;
582
583	VERIFY(af == AF_INET \|\| af == AF_INET6);
584
585	bzero(s: dst, n: sizeof(*dst));
586
587	if (af == AF_INET) {
588	SOCKADDR_COPY(src, dst, sizeof(struct sockaddr_in));
589	dst->ss_len = sizeof(struct sockaddr_in);
590	if (pifscope == NULL \|\| ifscope != IFSCOPE_NONE) {
591	sin_set_ifscope(SA(dst), ifscope);
592	}
593	} else {
594	SOCKADDR_COPY(src, dst, sizeof(struct sockaddr_in6));
595	dst->ss_len = sizeof(struct sockaddr_in6);
596	if (pifscope != NULL &&
597	IN6_IS_SCOPE_EMBED(&SIN6(dst)->sin6_addr)) {
598	unsigned int eifscope;
599	/*
600	* If the address contains the embedded scope ID,
601	* use that as the value for sin6_scope_id as long
602	* the caller doesn't insist on clearing it (by
603	* passing NULL) or setting it.
604	*/
605	eifscope = sin6_get_embedded_ifscope(SA(dst));
606	if (eifscope != IFSCOPE_NONE && ifscope == IFSCOPE_NONE) {
607	ifscope = eifscope;
608	}
609	if (ifscope != IFSCOPE_NONE) {
610	/ Set ifscope from pifscope or eifscope /
611	sin6_set_ifscope(SA(dst), ifscope);
612	} else {
613	/ If sin6_scope_id has a value, use that one /
614	ifscope = sin6_get_ifscope(SA(dst));
615	}
616	/*
617	* If sin6_scope_id is set but the address doesn't
618	* contain the equivalent embedded value, set it.
619	*/
620	if (ifscope != IFSCOPE_NONE && eifscope != ifscope) {
621	sin6_set_embedded_ifscope(SA(dst), ifscope);
622	}
623	} else if (pifscope == NULL \|\| ifscope != IFSCOPE_NONE) {
624	sin6_set_ifscope(SA(dst), ifscope);
625	}
626	}
627
628	if (pifscope != NULL) {
629	*pifscope = (af == AF_INET) ? sin_get_ifscope(SA(dst)) :
630	sin6_get_ifscope(SA(dst));
631	}
632
633	return SA(dst);
634	}
635
636	/*
637	* Copy a mask from src to a dst storage and set scope ID into dst.
638	*/
639	static struct sockaddr *
640	ma_copy(int af, struct sockaddr src, struct* sockaddr_storage *dst,
641	unsigned int ifscope)
642	{
643	VERIFY(af == AF_INET \|\| af == AF_INET6);
644
645	bzero(s: dst, n: sizeof(*dst));
646	rt_maskedcopy(src, SA(dst), src);
647
648	/*
649	* The length of the mask sockaddr would need to be adjusted
650	* to cover the additional {sin,sin6}_ifscope field; when ifscope
651	* is IFSCOPE_NONE, we'd end up clearing the scope ID field on
652	* the destination mask in addition to extending the length
653	* of the sockaddr, as a side effect. This is okay, as any
654	* trailing zeroes would be skipped by rn_addmask prior to
655	* inserting or looking up the mask in the mask tree.
656	*/
657	if (af == AF_INET) {
658	SINIFSCOPE(dst)->sin_scope_id = ifscope;
659	SINIFSCOPE(dst)->sin_len =
660	offsetof(struct sockaddr_inifscope, sin_scope_id) +
661	sizeof(SINIFSCOPE(dst)->sin_scope_id);
662	} else {
663	SIN6IFSCOPE(dst)->sin6_scope_id = ifscope;
664	SIN6IFSCOPE(dst)->sin6_len =
665	offsetof(struct sockaddr_in6, sin6_scope_id) +
666	sizeof(SIN6IFSCOPE(dst)->sin6_scope_id);
667	}
668
669	return SA(dst);
670	}
671
672	/*
673	* Trim trailing zeroes on a sockaddr and update its length.
674	*/
675	static struct sockaddr *
676	sa_trim(struct sockaddr *sa, uint8_t skip)
677	{
678	caddr_t cp;
679	caddr_t base = (caddr_t)__SA_UTILS_CONV_TO_BYTES(sa) + skip;
680
681	if (sa->sa_len <= skip) {
682	return sa;
683	}
684
685	for (cp = base + (sa->sa_len - skip); cp > base && cp[-`1`] == `0`;) {
686	cp--;
687	}
688
689	sa->sa_len = (uint8_t)(cp - base) + skip;
690	if (sa->sa_len < skip) {
691	/ Must not happen, and if so, panic /
692	panic("%s: broken logic (sa_len %d < skip %d )", __func__,
693	sa->sa_len, skip);
694	/ NOTREACHED /
695	} else if (sa->sa_len == skip) {
696	/ If we end up with all zeroes, then there's no mask /
697	sa->sa_len = `0`;
698	}
699
700	return sa;
701	}
702
703	/*
704	* Called by rtm_msg{1,2} routines to "scrub" socket address structures of
705	* kernel private information, so that clients of the routing socket will
706	* not be confused by the presence of the information, or the side effect of
707	* the increased length due to that. The source sockaddr is not modified;
708	* instead, the scrubbing happens on the destination sockaddr storage that
709	* is passed in by the caller.
710	*
711	* Scrubbing entails:
712	* - removing embedded scope identifiers from network mask and destination
713	* IPv4 and IPv6 socket addresses
714	* - optionally removing global scope interface hardware addresses from
715	* link-layer interface addresses when the MAC framework check fails.
716	*/
717	struct sockaddr *
718	rtm_scrub(int type, int idx, struct sockaddr hint, struct* sockaddr *sa,
719	void buf __sized_by(buflen), uint32_t buflen, kauth_cred_t credp)
720	{
721	struct sockaddr_storage ss = (struct* sockaddr_storage *)buf;
722	struct sockaddr *ret = sa;
723
724	VERIFY(buf != NULL && buflen >= sizeof(*ss));
725	bzero(s: buf, n: buflen);
726
727	switch (idx) {
728	case RTAX_DST:
729	/*
730	* If this is for an AF_INET/AF_INET6 destination address,
731	* call sa_copy() to clear the scope ID field.
732	*/
733	if (sa->sa_family == AF_INET &&
734	SINIFSCOPE(sa)->sin_scope_id != IFSCOPE_NONE) {
735	ret = sa_copy(src: sa, dst: ss, NULL);
736	} else if (sa->sa_family == AF_INET6 &&
737	SIN6IFSCOPE(sa)->sin6_scope_id != IFSCOPE_NONE) {
738	ret = sa_copy(src: sa, dst: ss, NULL);
739	}
740	break;
741
742	case RTAX_NETMASK: {
743	uint8_t skip, af;
744	/*
745	* If this is for a mask, we can't tell whether or not there
746	* is an valid scope ID value, as the span of bytes between
747	* sa_len and the beginning of the mask (offset of sin_addr in
748	* the case of AF_INET, or sin6_addr for AF_INET6) may be
749	* filled with all-ones by rn_addmask(), and hence we cannot
750	* rely on sa_family. Because of this, we use the sa_family
751	* of the hint sockaddr (RTAX_{DST,IFA}) as indicator as to
752	* whether or not the mask is to be treated as one for AF_INET
753	* or AF_INET6. Clearing the scope ID field involves setting
754	* it to IFSCOPE_NONE followed by calling sa_trim() to trim
755	* trailing zeroes from the storage sockaddr, which reverses
756	* what was done earlier by ma_copy() on the source sockaddr.
757	*/
758	if (hint == NULL \|\|
759	((af = hint->sa_family) != AF_INET && af != AF_INET6)) {
760	break; / nothing to do /
761	}
762	skip = (af == AF_INET) ?
763	offsetof(struct sockaddr_in, sin_addr) :
764	offsetof(struct sockaddr_in6, sin6_addr);
765
766	if (sa->sa_len > skip && sa->sa_len <= sizeof(*ss)) {
767	SOCKADDR_COPY(sa, ss, sa->sa_len);
768	/*
769	* Don't use {sin,sin6}_set_ifscope() as sa_family
770	* and sa_len for the netmask might not be set to
771	* the corresponding expected values of the hint.
772	*/
773	if (hint->sa_family == AF_INET) {
774	SINIFSCOPE(ss)->sin_scope_id = IFSCOPE_NONE;
775	} else {
776	SIN6IFSCOPE(ss)->sin6_scope_id = IFSCOPE_NONE;
777	}
778	ret = sa_trim(SA(ss), skip);
779
780	/*
781	* For AF_INET6 mask, set sa_len appropriately unless
782	* this is requested via systl_dumpentry(), in which
783	* case we return the raw value.
784	*/
785	if (hint->sa_family == AF_INET6 &&
786	type != RTM_GET && type != RTM_GET2) {
787	SA(ret)->sa_len = sizeof(struct sockaddr_in6);
788	}
789	}
790	break;
791	}
792	case RTAX_GATEWAY: {
793	/*
794	* Break if the gateway is not AF_LINK type (indirect routes)
795	*
796	* Else, if is, check if it is resolved. If not yet resolved
797	* simply break else scrub the link layer address.
798	*/
799	if ((sa->sa_family != AF_LINK) \|\| (SDL(sa)->sdl_alen == `0`)) {
800	break;
801	}
802	OS_FALLTHROUGH;
803	}
804
805	case RTAX_IFP: {
806	if (sa->sa_family == AF_LINK && credp) {
807	struct sockaddr_dl *sdl = SDL(buf);
808	const void *bytes;
809	size_t size;
810
811	/ caller should handle worst case: SOCK_MAXADDRLEN /
812	VERIFY(buflen >= sa->sa_len);
813
814	SOCKADDR_COPY(sa, sdl, sa->sa_len);
815	bytes = dlil_ifaddr_bytes(sdl, &size, credp);
816	if (bytes != CONST_LLADDR(sdl)) {
817	VERIFY(sdl->sdl_alen == size);
818	bcopy(src: bytes, LLADDR(sdl), n: size);
819	}
820	ret = SA(sdl);
821	}
822	break;
823	}
824	default:
825	break;
826	}
827
828	return ret;
829	}
830
831	/*
832	* Callback leaf-matching routine for rn_matchaddr_args used
833	* for looking up an exact match for a scoped route entry.
834	*/
835	static int
836	rn_match_ifscope(struct radix_node rn, void* *arg)
837	{
838	rtentry_ref_t rt = (rtentry_ref_t)rn;
839	struct matchleaf_arg *ma = arg;
840	int af = rt_key(rt)->sa_family;
841
842	if (!(rt->rt_flags & RTF_IFSCOPE) \|\| (af != AF_INET && af != AF_INET6)) {
843	return `0`;
844	}
845
846	return af == AF_INET ?
847	(SINIFSCOPE(rt_key(rt))->sin_scope_id == ma->ifscope) :
848	(SIN6IFSCOPE(rt_key(rt))->sin6_scope_id == ma->ifscope);
849	}
850
851	/*
852	* Atomically increment route generation counter
853	*/
854	void
855	routegenid_update(void)
856	{
857	routegenid_inet_update();
858	routegenid_inet6_update();
859	}
860
861	void
862	routegenid_inet_update(void)
863	{
864	os_atomic_inc(&route_genid_inet, relaxed);
865	}
866
867	void
868	routegenid_inet6_update(void)
869	{
870	os_atomic_inc(&route_genid_inet6, relaxed);
871	}
872
873	/*
874	* Packet routing routines.
875	*/
876	void
877	rtalloc(struct route *ro)
878	{
879	rtalloc_ign(ro, `0`);
880	}
881
882	void
883	rtalloc_scoped(struct route ro, unsigned* int ifscope)
884	{
885	rtalloc_scoped_ign(ro, `0`, ifscope);
886	}
887
888	static void
889	rtalloc_ign_common_locked(struct route *ro, uint32_t ignore,
890	unsigned int ifscope)
891	{
892	rtentry_ref_t rt;
893
894	if ((rt = ro->ro_rt) != NULL) {
895	RT_LOCK_SPIN(rt);
896	if (rt->rt_ifp != NULL && !ROUTE_UNUSABLE(ro)) {
897	RT_UNLOCK(rt);
898	return;
899	}
900	RT_UNLOCK(rt);
901	ROUTE_RELEASE_LOCKED(ro); / rnh_lock already held /
902	}
903	ro->ro_rt = rtalloc1_common_locked(SA(&ro->ro_dst), `1`, ignore, ifscope);
904	if (ro->ro_rt != NULL) {
905	RT_GENID_SYNC(ro->ro_rt);
906	RT_LOCK_ASSERT_NOTHELD(ro->ro_rt);
907	}
908	}
909
910	void
911	rtalloc_ign(struct route *ro, uint32_t ignore)
912	{
913	LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_NOTOWNED);
914	lck_mtx_lock(rnh_lock);
915	rtalloc_ign_common_locked(ro, ignore, IFSCOPE_NONE);
916	lck_mtx_unlock(rnh_lock);
917	}
918
919	void
920	rtalloc_scoped_ign(struct route ro, uint32_t ignore, unsigned* int ifscope)
921	{
922	LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_NOTOWNED);
923	lck_mtx_lock(rnh_lock);
924	rtalloc_ign_common_locked(ro, ignore, ifscope);
925	lck_mtx_unlock(rnh_lock);
926	}
927
928	static struct rtentry *
929	rtalloc1_locked(struct sockaddr dst, int* report, uint32_t ignflags)
930	{
931	return rtalloc1_common_locked(dst, report, ignflags, IFSCOPE_NONE);
932	}
933
934	struct rtentry *
935	rtalloc1_scoped_locked(struct sockaddr dst, int* report, uint32_t ignflags,
936	unsigned int ifscope)
937	{
938	return rtalloc1_common_locked(dst, report, ignflags, ifscope);
939	}
940
941	static boolean_t
942	route_ignore_protocol_cloning_for_dst(struct rtentry rt, struct* sockaddr *dst)
943	{
944	/*
945	* For now keep protocol cloning for any type of IPv4
946	* destination.
947	*/
948	if (dst->sa_family != AF_INET6) {
949	return FALSE;
950	}
951
952	/*
953	* Limit protocol route creation of IPv6 ULA destinations
954	* from default route,
955	* Just to be safe, even though it doesn't affect routability,
956	* still allow protocol cloned routes if we happen to hit
957	* default route over companion link for ULA destination.
958	*/
959	if (!IFNET_IS_COMPANION_LINK(rt->rt_ifp) &&
960	(rt->rt_flags & RTF_GATEWAY) &&
961	(rt->rt_flags & RTF_PRCLONING) &&
962	SA_DEFAULT(rt_key(rt)) &&
963	(IN6_IS_ADDR_UNIQUE_LOCAL(&SIN6(dst)->sin6_addr) \|\| IN6_IS_SCOPE_EMBED(&SIN6(dst)->sin6_addr))) {
964	return TRUE;
965	}
966	return FALSE;
967	}
968
969	struct rtentry *
970	rtalloc1_common_locked(struct sockaddr dst, int* report, uint32_t ignflags,
971	unsigned int ifscope)
972	{
973	struct radix_node_head *rnh = rt_tables[dst->sa_family];
974	rtentry_ref_t rt = NULL;
975	rtentry_ref_t newrt = NULL;
976	struct rt_addrinfo info;
977	uint32_t nflags;
978	int err = `0`;
979	u_char msgtype = RTM_MISS;
980
981	if (rnh == NULL) {
982	goto unreachable;
983	}
984
985	if (!in6_embedded_scope && dst->sa_family == AF_INET6) {
986	if (IN6_IS_SCOPE_EMBED(&SIN6(dst)->sin6_addr) &&
987	SIN6(dst)->sin6_scope_id == `0`) {
988	SIN6(dst)->sin6_scope_id = ifscope;
989	}
990	}
991
992	/*
993	* Find the longest prefix or exact (in the scoped case) address match;
994	* callee adds a reference to entry and checks for root node as well
995	*/
996	rt = rt_lookup(FALSE, dst, NULL, rnh, ifscope);
997	if (rt == NULL) {
998	goto unreachable;
999	}
1000
1001	/*
1002	* Explicitly ignore protocol cloning for certain destinations.
1003	* Some checks below are kind of redundant, as for now, RTF_PRCLONING
1004	* is only set on indirect (RTF_GATEWAY) routes.
1005	* Also, we do this only when the route lookup above, resulted in default
1006	* route.
1007	* This is done to ensure, the resulting indirect host route doesn't
1008	* interfere when routing table gets configured with a indirect subnet
1009	* route/direct subnet route that is more specific than the current
1010	* parent route of the resulting protocol cloned route.
1011	*
1012	* At the crux of it all, it is a problem that we maintain host cache
1013	* in the routing table. We should revisit this for a generic solution.
1014	*/
1015	if (route_ignore_protocol_cloning_for_dst(rt, dst)) {
1016	ignflags \|= RTF_PRCLONING;
1017	}
1018
1019	RT_LOCK_SPIN(rt);
1020	newrt = rt;
1021	nflags = rt->rt_flags & ~ignflags;
1022	RT_UNLOCK(rt);
1023
1024	if (report && (nflags & (RTF_CLONING \| RTF_PRCLONING))) {
1025	/*
1026	* We are apparently adding (report = 0 in delete).
1027	* If it requires that it be cloned, do so.
1028	* (This implies it wasn't a HOST route.)
1029	*/
1030	err = rtrequest_locked(RTM_RESOLVE, dst, NULL, NULL, `0`, &newrt);
1031	if (err) {
1032	/*
1033	* If the cloning didn't succeed, maybe what we
1034	* have from lookup above will do. Return that;
1035	* no need to hold another reference since it's
1036	* already done.
1037	*/
1038	newrt = rt;
1039	goto miss;
1040	}
1041
1042	/*
1043	* We cloned it; drop the original route found during lookup.
1044	* The resulted cloned route (newrt) would now have an extra
1045	* reference held during rtrequest.
1046	*/
1047	rtfree_locked(rt);
1048
1049	/*
1050	* If the newly created cloned route is a direct host route
1051	* then also check if it is to a router or not.
1052	* If it is, then set the RTF_ROUTER flag on the host route
1053	* for the gateway.
1054	*
1055	* XXX It is possible for the default route to be created post
1056	* cloned route creation of router's IP.
1057	* We can handle that corner case by special handing for RTM_ADD
1058	* of default route.
1059	*/
1060	if ((newrt->rt_flags & (RTF_HOST \| RTF_LLINFO)) ==
1061	(RTF_HOST \| RTF_LLINFO)) {
1062	rtentry_ref_t defrt = NULL;
1063	struct sockaddr_storage def_key;
1064
1065	bzero(s: &def_key, n: sizeof(def_key));
1066	def_key.ss_len = rt_key(newrt)->sa_len;
1067	def_key.ss_family = rt_key(newrt)->sa_family;
1068
1069	defrt = rtalloc1_scoped_locked(SA(&def_key),
1070	report: `0`, ignflags: `0`, ifscope: newrt->rt_ifp->if_index);
1071
1072	if (defrt) {
1073	if (sa_equal(rt_key(newrt), defrt->rt_gateway)) {
1074	newrt->rt_flags \|= RTF_ROUTER;
1075	}
1076	rtfree_locked(defrt);
1077	}
1078	}
1079
1080	if ((rt = newrt) && (rt->rt_flags & RTF_XRESOLVE)) {
1081	/*
1082	* If the new route specifies it be
1083	* externally resolved, then go do that.
1084	*/
1085	msgtype = RTM_RESOLVE;
1086	goto miss;
1087	}
1088	}
1089	goto done;
1090
1091	unreachable:
1092	/*
1093	* Either we hit the root or couldn't find any match,
1094	* Which basically means "cant get there from here"
1095	*/
1096	rtstat.rts_unreach++;
1097
1098	miss:
1099	if (report) {
1100	/*
1101	* If required, report the failure to the supervising
1102	* Authorities.
1103	* For a delete, this is not an error. (report == 0)
1104	*/
1105	bzero(s: (caddr_t)&info, n: sizeof(info));
1106	info.rti_info[RTAX_DST] = dst;
1107	rt_missmsg(msgtype, &info, `0`, err);
1108	}
1109	done:
1110	return newrt;
1111	}
1112
1113	struct rtentry *
1114	rtalloc1(struct sockaddr dst, int* report, uint32_t ignflags)
1115	{
1116	rtentry_ref_t entry;
1117	LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_NOTOWNED);
1118	lck_mtx_lock(rnh_lock);
1119	entry = rtalloc1_locked(dst, report, ignflags);
1120	lck_mtx_unlock(rnh_lock);
1121	return entry;
1122	}
1123
1124	struct rtentry *
1125	rtalloc1_scoped(struct sockaddr dst, int* report, uint32_t ignflags,
1126	unsigned int ifscope)
1127	{
1128	rtentry_ref_t entry;
1129	LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_NOTOWNED);
1130	lck_mtx_lock(rnh_lock);
1131	entry = rtalloc1_scoped_locked(dst, report, ignflags, ifscope);
1132	lck_mtx_unlock(rnh_lock);
1133	return entry;
1134	}
1135
1136	/*
1137	* Remove a reference count from an rtentry.
1138	* If the count gets low enough, take it out of the routing table
1139	*/
1140	void
1141	rtfree_locked(struct rtentry *rt)
1142	{
1143	rtfree_common(rt, TRUE);
1144	}
1145
1146	static void
1147	rtfree_common(struct rtentry *rt, boolean_t locked)
1148	{
1149	struct radix_node_head *rnh;
1150
1151	LCK_MTX_ASSERT(rnh_lock, locked ?
1152	LCK_MTX_ASSERT_OWNED : LCK_MTX_ASSERT_NOTOWNED);
1153
1154	/*
1155	* Atomically decrement the reference count and if it reaches 0,
1156	* and there is a close function defined, call the close function.
1157	*/
1158	RT_LOCK_SPIN(rt);
1159	if (rtunref(rt) > `0`) {
1160	RT_UNLOCK(rt);
1161	return;
1162	}
1163
1164	/*
1165	* To avoid violating lock ordering, we must drop rt_lock before
1166	* trying to acquire the global rnh_lock. If we are called with
1167	* rnh_lock held, then we already have exclusive access; otherwise
1168	* we do the lock dance.
1169	*/
1170	if (!locked) {
1171	/*
1172	* Note that we check it again below after grabbing rnh_lock,
1173	* since it is possible that another thread doing a lookup wins
1174	* the race, grabs the rnh_lock first, and bumps up reference
1175	* count in which case the route should be left alone as it is
1176	* still in use. It's also possible that another thread frees
1177	* the route after we drop rt_lock; to prevent the route from
1178	* being freed, we hold an extra reference.
1179	*/
1180	RT_ADDREF_LOCKED(rt);
1181	RT_UNLOCK(rt);
1182	lck_mtx_lock(rnh_lock);
1183	RT_LOCK_SPIN(rt);
1184	if (rtunref(rt) > `0`) {
1185	/ We've lost the race, so abort /
1186	RT_UNLOCK(rt);
1187	goto done;
1188	}
1189	}
1190
1191	/*
1192	* We may be blocked on other lock(s) as part of freeing
1193	* the entry below, so convert from spin to full mutex.
1194	*/
1195	RT_CONVERT_LOCK(rt);
1196
1197	LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
1198
1199	/ Negative refcnt must never happen /
1200	if (rt->rt_refcnt != `0`) {
1201	panic("rt %p invalid refcnt %d", rt, rt->rt_refcnt);
1202	/ NOTREACHED /
1203	}
1204	/ Idle refcnt must have been dropped during rtunref() /
1205	VERIFY(!(rt->rt_flags & RTF_IFREF));
1206
1207	/*
1208	* find the tree for that address family
1209	* Note: in the case of igmp packets, there might not be an rnh
1210	*/
1211	rnh = rt_tables[rt_key(rt)->sa_family];
1212
1213	/*
1214	* On last reference give the "close method" a chance to cleanup
1215	* private state. This also permits (for IPv4 and IPv6) a chance
1216	* to decide if the routing table entry should be purged immediately
1217	* or at a later time. When an immediate purge is to happen the
1218	* close routine typically issues RTM_DELETE which clears the RTF_UP
1219	* flag on the entry so that the code below reclaims the storage.
1220	*/
1221	if (rnh != NULL && rnh->rnh_close != NULL) {
1222	rnh->rnh_close((struct radix_node *)rt, rnh);
1223	}
1224
1225	/*
1226	* If we are no longer "up" (and ref == 0) then we can free the
1227	* resources associated with the route.
1228	*/
1229	if (!(rt->rt_flags & RTF_UP)) {
1230	rtentry_ref_t rt_parent;
1231	struct ifaddr *rt_ifa;
1232
1233	rt->rt_flags \|= RTF_DEAD;
1234	if (rt->rt_nodes->rn_flags & (RNF_ACTIVE \| RNF_ROOT)) {
1235	panic("rt %p freed while in radix tree", rt);
1236	/ NOTREACHED /
1237	}
1238	/*
1239	* the rtentry must have been removed from the routing table
1240	* so it is represented in rttrash; remove that now.
1241	*/
1242	(void) OSDecrementAtomic(&rttrash);
1243	if (rte_debug & RTD_DEBUG) {
1244	TAILQ_REMOVE(&rttrash_head, (rtentry_dbg_ref_t)rt,
1245	rtd_trash_link);
1246	}
1247
1248	/*
1249	* release references on items we hold them on..
1250	* e.g other routes and ifaddrs.
1251	*/
1252	if ((rt_parent = rt->rt_parent) != NULL) {
1253	rt->rt_parent = NULL;
1254	}
1255
1256	if ((rt_ifa = rt->rt_ifa) != NULL) {
1257	rt->rt_ifa = NULL;
1258	}
1259
1260	/*
1261	* Now free any attached link-layer info.
1262	*/
1263	if (rt->rt_llinfo != NULL) {
1264	VERIFY(rt->rt_llinfo_free != NULL);
1265	(*rt->rt_llinfo_free)(rt->rt_llinfo);
1266	rt->rt_llinfo = NULL;
1267	}
1268
1269	/ Destroy eventhandler lists context /
1270	eventhandler_lists_ctxt_destroy(evthdlr_lists_ctxt: &rt->rt_evhdlr_ctxt);
1271
1272	/*
1273	* Route is no longer in the tree and refcnt is 0;
1274	* we have exclusive access, so destroy it.
1275	*/
1276	RT_UNLOCK(rt);
1277	rte_lock_destroy(rt);
1278
1279	if (rt_parent != NULL) {
1280	rtfree_locked(rt: rt_parent);
1281	}
1282
1283	if (rt_ifa != NULL) {
1284	ifa_remref(ifa: rt_ifa);
1285	}
1286
1287	/*
1288	* The key is separately alloc'd so free it (see rt_setgate()).
1289	* This also frees the gateway, as they are always malloc'd
1290	* together.
1291	*/
1292	rt_key_free(rt);
1293
1294	/*
1295	* Free any statistics that may have been allocated
1296	*/
1297	nstat_route_detach(rte: rt);
1298
1299	/*
1300	* and the rtentry itself of course
1301	*/
1302	rte_free(rt);
1303	} else {
1304	/*
1305	* The "close method" has been called, but the route is
1306	* still in the radix tree with zero refcnt, i.e. "up"
1307	* and in the cached state.
1308	*/
1309	RT_UNLOCK(rt);
1310	}
1311	done:
1312	if (!locked) {
1313	lck_mtx_unlock(rnh_lock);
1314	}
1315	}
1316
1317	void
1318	rtfree(struct rtentry *rt)
1319	{
1320	rtfree_common(rt, FALSE);
1321	}
1322
1323	/*
1324	* Decrements the refcount but does not free the route when
1325	* the refcount reaches zero. Unless you have really good reason,
1326	* use rtfree not rtunref.
1327	*/
1328	int
1329	rtunref(struct rtentry *p)
1330	{
1331	RT_LOCK_ASSERT_HELD(p);
1332
1333	if (p->rt_refcnt == `0`) {
1334	panic("%s(%p) bad refcnt", __func__, p);
1335	/ NOTREACHED /
1336	} else if (--p->rt_refcnt == `0`) {
1337	/*
1338	* Release any idle reference count held on the interface;
1339	* if the route is eligible, still UP and the refcnt becomes
1340	* non-zero at some point in future before it is purged from
1341	* the routing table, rt_set_idleref() will undo this.
1342	*/
1343	rt_clear_idleref(p);
1344	}
1345
1346	if (rte_debug & RTD_DEBUG) {
1347	rtunref_audit((rtentry_dbg_ref_t)p);
1348	}
1349
1350	/ Return new value /
1351	return p->rt_refcnt;
1352	}
1353
1354	static inline void
1355	rtunref_audit(struct rtentry_dbg *rte)
1356	{
1357	uint16_t idx;
1358
1359	if (rte->rtd_inuse != RTD_INUSE) {
1360	panic("rtunref: on freed rte=%p", rte);
1361	/ NOTREACHED /
1362	}
1363	idx = os_atomic_inc_orig(&rte->rtd_refrele_cnt, relaxed) % CTRACE_HIST_SIZE;
1364	if (rte_debug & RTD_TRACE) {
1365	ctrace_record(&rte->rtd_refrele[idx]);
1366	}
1367	}
1368
1369	/*
1370	* Add a reference count from an rtentry.
1371	*/
1372	void
1373	rtref(struct rtentry *p)
1374	{
1375	RT_LOCK_ASSERT_HELD(p);
1376
1377	VERIFY((p->rt_flags & RTF_DEAD) == `0`);
1378	if (++p->rt_refcnt == `0`) {
1379	panic("%s(%p) bad refcnt", __func__, p);
1380	/ NOTREACHED /
1381	} else if (p->rt_refcnt == `1`) {
1382	/*
1383	* Hold an idle reference count on the interface,
1384	* if the route is eligible for it.
1385	*/
1386	rt_set_idleref(p);
1387	}
1388
1389	if (rte_debug & RTD_DEBUG) {
1390	rtref_audit((rtentry_dbg_ref_t)p);
1391	}
1392	}
1393
1394	static inline void
1395	rtref_audit(struct rtentry_dbg *rte)
1396	{
1397	uint16_t idx;
1398
1399	if (rte->rtd_inuse != RTD_INUSE) {
1400	panic("rtref_audit: on freed rte=%p", rte);
1401	/ NOTREACHED /
1402	}
1403	idx = os_atomic_inc_orig(&rte->rtd_refhold_cnt, relaxed) % CTRACE_HIST_SIZE;
1404	if (rte_debug & RTD_TRACE) {
1405	ctrace_record(&rte->rtd_refhold[idx]);
1406	}
1407	}
1408
1409	void
1410	rtsetifa(struct rtentry rt, struct* ifaddr *ifa)
1411	{
1412	LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
1413
1414	RT_LOCK_ASSERT_HELD(rt);
1415
1416	if (rt->rt_ifa == ifa) {
1417	return;
1418	}
1419
1420	/ Become a regular mutex, just in case /
1421	RT_CONVERT_LOCK(rt);
1422
1423	/ Release the old ifa /
1424	if (rt->rt_ifa) {
1425	ifa_remref(ifa: rt->rt_ifa);
1426	}
1427
1428	/ Set rt_ifa /
1429	rt->rt_ifa = ifa;
1430
1431	/ Take a reference to the ifa /
1432	if (rt->rt_ifa) {
1433	ifa_addref(ifa: rt->rt_ifa);
1434	}
1435	}
1436
1437	/*
1438	* Force a routing table entry to the specified
1439	* destination to go through the given gateway.
1440	* Normally called as a result of a routing redirect
1441	* message from the network layer.
1442	*/
1443	void
1444	rtredirect(struct ifnet ifp, struct* sockaddr dst, struct* sockaddr *gateway,
1445	struct sockaddr netmask, int* flags, struct sockaddr *src,
1446	struct rtentry **rtp)
1447	{
1448	rtentry_ref_t rt = NULL;
1449	int error = `0`;
1450	short *stat = `0`;
1451	struct rt_addrinfo info;
1452	struct ifaddr *ifa = NULL;
1453	unsigned int ifscope = (ifp != NULL) ? ifp->if_index : IFSCOPE_NONE;
1454	struct sockaddr_storage ss;
1455	int af = src->sa_family;
1456
1457	LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_NOTOWNED);
1458	lck_mtx_lock(rnh_lock);
1459
1460	/*
1461	* Transform src into the internal routing table form for
1462	* comparison against rt_gateway below.
1463	*/
1464	if ((af == AF_INET) \|\| (af == AF_INET6)) {
1465	src = sa_copy(src, dst: &ss, pifscope: &ifscope);
1466	}
1467
1468	/*
1469	* Verify the gateway is directly reachable; if scoped routing
1470	* is enabled, verify that it is reachable from the interface
1471	* where the ICMP redirect arrived on.
1472	*/
1473	if ((ifa = ifa_ifwithnet_scoped(gateway, ifscope)) == NULL) {
1474	error = ENETUNREACH;
1475	goto out;
1476	}
1477
1478	/ Lookup route to the destination (from the original IP header) /
1479	rt = rtalloc1_scoped_locked(dst, report: `0`, RTF_CLONING \| RTF_PRCLONING, ifscope);
1480	if (rt != NULL) {
1481	RT_LOCK(rt);
1482	}
1483
1484	/*
1485	* If the redirect isn't from our current router for this dst,
1486	* it's either old or wrong. If it redirects us to ourselves,
1487	* we have a routing loop, perhaps as a result of an interface
1488	* going down recently. Holding rnh_lock here prevents the
1489	* possibility of rt_ifa/ifa's ifa_addr from changing (e.g.
1490	* in_ifinit), so okay to access ifa_addr without locking.
1491	*/
1492	if (!(flags & RTF_DONE) && rt != NULL &&
1493	(!sa_equal(src, rt->rt_gateway) \|\| !sa_equal(rt->rt_ifa->ifa_addr,
1494	ifa->ifa_addr))) {
1495	error = EINVAL;
1496	} else {
1497	ifa_remref(ifa);
1498	if ((ifa = ifa_ifwithaddr(gateway))) {
1499	ifa_remref(ifa);
1500	ifa = NULL;
1501	error = EHOSTUNREACH;
1502	}
1503	}
1504
1505	if (ifa) {
1506	ifa_remref(ifa);
1507	ifa = NULL;
1508	}
1509
1510	if (error) {
1511	if (rt != NULL) {
1512	RT_UNLOCK(rt);
1513	}
1514	goto done;
1515	}
1516
1517	/*
1518	* Create a new entry if we just got back a wildcard entry
1519	* or the the lookup failed. This is necessary for hosts
1520	* which use routing redirects generated by smart gateways
1521	* to dynamically build the routing tables.
1522	*/
1523	if ((rt == NULL) \|\| (rt_mask(rt) != NULL && rt_mask(rt)->sa_len < `2`)) {
1524	goto create;
1525	}
1526	/*
1527	* Don't listen to the redirect if it's
1528	* for a route to an interface.
1529	*/
1530	RT_LOCK_ASSERT_HELD(rt);
1531	if (rt->rt_flags & RTF_GATEWAY) {
1532	if (((rt->rt_flags & RTF_HOST) == `0`) && (flags & RTF_HOST)) {
1533	/*
1534	* Changing from route to net => route to host.
1535	* Create new route, rather than smashing route
1536	* to net; similar to cloned routes, the newly
1537	* created host route is scoped as well.
1538	*/
1539	create:
1540	if (rt != NULL) {
1541	RT_UNLOCK(rt);
1542	}
1543	flags \|= RTF_GATEWAY \| RTF_DYNAMIC;
1544	error = rtrequest_scoped_locked(RTM_ADD, dst,
1545	gateway, netmask, flags, NULL, ifscope);
1546	stat = &rtstat.rts_dynamic;
1547	} else {
1548	/*
1549	* Smash the current notion of the gateway to
1550	* this destination. Should check about netmask!!!
1551	*/
1552	rt->rt_flags \|= RTF_MODIFIED;
1553	flags \|= RTF_MODIFIED;
1554	stat = &rtstat.rts_newgateway;
1555	/*
1556	* add the key and gateway (in one malloc'd chunk).
1557	*/
1558	error = rt_setgate(rt, rt_key(rt), gateway);
1559	RT_UNLOCK(rt);
1560	}
1561	} else {
1562	RT_UNLOCK(rt);
1563	error = EHOSTUNREACH;
1564	}
1565	done:
1566	if (rt != NULL) {
1567	RT_LOCK_ASSERT_NOTHELD(rt);
1568	if (!error) {
1569	/ Enqueue event to refresh flow route entries /
1570	route_event_enqueue_nwk_wq_entry(rt, NULL, ROUTE_ENTRY_REFRESH, NULL, FALSE);
1571	if (rtp) {
1572	*rtp = rt;
1573	} else {
1574	rtfree_locked(rt);
1575	}
1576	} else {
1577	rtfree_locked(rt);
1578	}
1579	}
1580	out:
1581	if (error) {
1582	rtstat.rts_badredirect++;
1583	} else {
1584	if (stat != NULL) {
1585	(*stat)++;
1586	}
1587
1588	if (af == AF_INET) {
1589	routegenid_inet_update();
1590	} else if (af == AF_INET6) {
1591	routegenid_inet6_update();
1592	}
1593	}
1594	lck_mtx_unlock(rnh_lock);
1595	bzero(s: (caddr_t)&info, n: sizeof(info));
1596	info.rti_info[RTAX_DST] = dst;
1597	info.rti_info[RTAX_GATEWAY] = gateway;
1598	info.rti_info[RTAX_NETMASK] = netmask;
1599	info.rti_info[RTAX_AUTHOR] = src;
1600	rt_missmsg(RTM_REDIRECT, &info, flags, error);
1601	}
1602
1603	/*
1604	* Routing table ioctl interface.
1605	*/
1606	int
1607	rtioctl(unsigned long req, caddr_t data, struct proc *p)
1608	{
1609	#pragma unused(p, req, data)
1610	return ENXIO;
1611	}
1612
1613	struct ifaddr *
1614	ifa_ifwithroute(
1615	int flags,
1616	const struct sockaddr *dst,
1617	const struct sockaddr *gateway)
1618	{
1619	struct ifaddr *ifa;
1620
1621	lck_mtx_lock(rnh_lock);
1622	ifa = ifa_ifwithroute_locked(flags, dst, gateway);
1623	lck_mtx_unlock(rnh_lock);
1624
1625	return ifa;
1626	}
1627
1628	struct ifaddr *
1629	ifa_ifwithroute_locked(int flags, const struct sockaddr *dst,
1630	const struct sockaddr *gateway)
1631	{
1632	return ifa_ifwithroute_common_locked((flags & ~RTF_IFSCOPE), dst,
1633	gateway, IFSCOPE_NONE);
1634	}
1635
1636	struct ifaddr *
1637	ifa_ifwithroute_scoped_locked(int flags, const struct sockaddr *dst,
1638	const struct sockaddr gateway, unsigned* int ifscope)
1639	{
1640	if (ifscope != IFSCOPE_NONE) {
1641	flags \|= RTF_IFSCOPE;
1642	} else {
1643	flags &= ~RTF_IFSCOPE;
1644	}
1645
1646	return ifa_ifwithroute_common_locked(flags, dst, gateway, ifscope);
1647	}
1648
1649	static struct ifaddr *
1650	ifa_ifwithroute_common_locked(int flags, const struct sockaddr *dst,
1651	const struct sockaddr gw, unsigned* int ifscope)
1652	{
1653	struct ifaddr *ifa = NULL;
1654	rtentry_ref_t rt = NULL;
1655	struct sockaddr_storage dst_ss, gw_ss;
1656
1657	if (!in6_embedded_scope) {
1658	const struct sockaddr_in6 *dst_addr = SIN6(dst);
1659	if (dst->sa_family == AF_INET6 &&
1660	IN6_IS_SCOPE_EMBED(&dst_addr->sin6_addr) &&
1661	ifscope == IFSCOPE_NONE) {
1662	ifscope = dst_addr->sin6_scope_id;
1663	VERIFY(ifscope != IFSCOPE_NONE);
1664	}
1665
1666	const struct sockaddr_in6 *gw_addr = SIN6(gw);
1667	if (dst->sa_family == AF_INET6 &&
1668	IN6_IS_SCOPE_EMBED(&gw_addr->sin6_addr) &&
1669	ifscope == IFSCOPE_NONE) {
1670	ifscope = gw_addr->sin6_scope_id;
1671	VERIFY(ifscope != IFSCOPE_NONE);
1672	}
1673
1674	if (ifscope != IFSCOPE_NONE) {
1675	flags \|= RTF_IFSCOPE;
1676	} else {
1677	flags &= ~RTF_IFSCOPE;
1678	}
1679	}
1680
1681	LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
1682
1683	/*
1684	* Just in case the sockaddr passed in by the caller
1685	* contains a scope ID, make sure to clear it since
1686	* interface addresses aren't scoped.
1687	*/
1688	if (dst != NULL &&
1689	((dst->sa_family == AF_INET) \|\|
1690	(dst->sa_family == AF_INET6))) {
1691	dst = sa_copy(__DECONST_SA(dst), dst: &dst_ss, IN6_NULL_IF_EMBEDDED_SCOPE(&ifscope));
1692	}
1693
1694	if (gw != NULL &&
1695	((gw->sa_family == AF_INET) \|\|
1696	(gw->sa_family == AF_INET6))) {
1697	gw = sa_copy(__DECONST_SA(gw), dst: &gw_ss, IN6_NULL_IF_EMBEDDED_SCOPE(&ifscope));
1698	}
1699
1700	if (!(flags & RTF_GATEWAY)) {
1701	/*
1702	* If we are adding a route to an interface,
1703	* and the interface is a pt to pt link
1704	* we should search for the destination
1705	* as our clue to the interface. Otherwise
1706	* we can use the local address.
1707	*/
1708	if (flags & RTF_HOST) {
1709	ifa = ifa_ifwithdstaddr(dst);
1710	}
1711	if (ifa == NULL) {
1712	ifa = ifa_ifwithaddr_scoped(gw, ifscope);
1713	}
1714	} else {
1715	/*
1716	* If we are adding a route to a remote net
1717	* or host, the gateway may still be on the
1718	* other end of a pt to pt link.
1719	*/
1720	if ((flags & RTF_IFSCOPE) != `0` && ifscope != IFSCOPE_NONE) {
1721	ifa = ifa_ifwithdstaddr_scoped(gw, ifscope);
1722	}
1723	if (ifa == NULL) {
1724	ifa = ifa_ifwithdstaddr(gw);
1725	}
1726	}
1727	if (ifa == NULL) {
1728	ifa = ifa_ifwithnet_scoped(gw, ifscope);
1729	}
1730	if (ifa == NULL) {
1731	/ Workaround to avoid gcc warning regarding const variable /
1732	rt = rtalloc1_scoped_locked(__DECONST_SA(dst),
1733	report: `0`, ignflags: `0`, ifscope);
1734	if (rt != NULL) {
1735	RT_LOCK_SPIN(rt);
1736	ifa = rt->rt_ifa;
1737	if (ifa != NULL) {
1738	/ Become a regular mutex /
1739	RT_CONVERT_LOCK(rt);
1740	ifa_addref(ifa);
1741	}
1742	RT_REMREF_LOCKED(rt);
1743	RT_UNLOCK(rt);
1744	rt = NULL;
1745	}
1746	}
1747	/*
1748	* Holding rnh_lock here prevents the possibility of ifa from
1749	* changing (e.g. in_ifinit), so it is safe to access its
1750	* ifa_addr (here and down below) without locking.
1751	*/
1752	if (ifa != NULL && ifa->ifa_addr->sa_family != dst->sa_family) {
1753	struct ifaddr *newifa;
1754	/ Callee adds reference to newifa upon success /
1755	newifa = ifaof_ifpforaddr(dst, ifa->ifa_ifp);
1756	if (newifa != NULL) {
1757	ifa_remref(ifa);
1758	ifa = newifa;
1759	}
1760	}
1761	/*
1762	* If we are adding a gateway, it is quite possible that the
1763	* routing table has a static entry in place for the gateway,
1764	* that may not agree with info garnered from the interfaces.
1765	* The routing table should carry more precedence than the
1766	* interfaces in this matter. Must be careful not to stomp
1767	* on new entries from rtinit, hence (ifa->ifa_addr != gw).
1768	*/
1769	if ((ifa == NULL \|\| (gw != NULL &&
1770	!sa_equal(ifa->ifa_addr, __DECONST_SA(gw)))) &&
1771	(rt = rtalloc1_scoped_locked(__DECONST_SA(gw),
1772	report: `0`, ignflags: `0`, ifscope)) != NULL) {
1773	if (ifa != NULL) {
1774	ifa_remref(ifa);
1775	}
1776	RT_LOCK_SPIN(rt);
1777	ifa = rt->rt_ifa;
1778	if (ifa != NULL) {
1779	/ Become a regular mutex /
1780	RT_CONVERT_LOCK(rt);
1781	ifa_addref(ifa);
1782	}
1783	RT_REMREF_LOCKED(rt);
1784	RT_UNLOCK(rt);
1785	}
1786	/*
1787	* If an interface scope was specified, the interface index of
1788	* the found ifaddr must be equivalent to that of the scope;
1789	* otherwise there is no match.
1790	*/
1791	if ((flags & RTF_IFSCOPE) &&
1792	ifa != NULL && ifa->ifa_ifp->if_index != ifscope) {
1793	ifa_remref(ifa);
1794	ifa = NULL;
1795	}
1796
1797	/*
1798	* ifa's address family must match destination's address family
1799	* after all is said and done.
1800	*/
1801	if (ifa != NULL &&
1802	ifa->ifa_addr->sa_family != dst->sa_family) {
1803	ifa_remref(ifa);
1804	ifa = NULL;
1805	}
1806
1807	return ifa;
1808	}
1809
1810	static int rt_fixdelete(struct radix_node , void* *);
1811	static int rt_fixchange(struct radix_node , void* *);
1812
1813	struct rtfc_arg {
1814	struct rtentry *rt0;
1815	struct radix_node_head *rnh;
1816	};
1817
1818	int
1819	rtrequest_locked(int req, struct sockaddr dst, struct* sockaddr *gateway,
1820	struct sockaddr netmask, int* flags, struct rtentry **ret_nrt)
1821	{
1822	return rtrequest_common_locked(req, dst, gateway, netmask,
1823	(flags & ~RTF_IFSCOPE), ret_nrt, IFSCOPE_NONE);
1824	}
1825
1826	int
1827	rtrequest_scoped_locked(int req, struct sockaddr *dst,
1828	struct sockaddr gateway, struct* sockaddr netmask, int* flags,
1829	struct rtentry *ret_nrt, unsigned* int ifscope)
1830	{
1831	if (ifscope != IFSCOPE_NONE) {
1832	flags \|= RTF_IFSCOPE;
1833	} else {
1834	flags &= ~RTF_IFSCOPE;
1835	}
1836
1837	return rtrequest_common_locked(req, dst, gateway, netmask,
1838	flags, ret_nrt, ifscope);
1839	}
1840
1841	/*
1842	* Do appropriate manipulations of a routing tree given all the bits of
1843	* info needed.
1844	*
1845	* Storing the scope ID in the radix key is an internal job that should be
1846	* left to routines in this module. Callers should specify the scope value
1847	* to the "scoped" variants of route routines instead of manipulating the
1848	* key itself. This is typically done when creating a scoped route, e.g.
1849	* rtrequest(RTM_ADD). Once such a route is created and marked with the
1850	* RTF_IFSCOPE flag, callers can simply use its rt_key(rt) to clone it
1851	* (RTM_RESOLVE) or to remove it (RTM_DELETE). An exception to this is
1852	* during certain routing socket operations where the search key might be
1853	* derived from the routing message itself, in which case the caller must
1854	* specify the destination address and scope value for RTM_ADD/RTM_DELETE.
1855	*/
1856	static int
1857	rtrequest_common_locked(int req, struct sockaddr *dst0,
1858	struct sockaddr gateway, struct* sockaddr netmask, int* flags,
1859	struct rtentry *ret_nrt, unsigned* int ifscope)
1860	{
1861	int error = `0`;
1862	rtentry_ref_t rt;
1863	struct radix_node *rn;
1864	struct radix_node_head *rnh;
1865	struct ifaddr *ifa = NULL;
1866	struct sockaddr ndst, dst = dst0;
1867	struct sockaddr_storage ss, mask;
1868	struct timeval caltime;
1869	int af = dst->sa_family;
1870	void (ifa_rtrequest)(int, struct* rtentry , struct* sockaddr *);
1871
1872	#define senderr(x) { error = x; goto bad; }
1873
1874	DTRACE_ROUTE6(rtrequest, int, req, struct sockaddr *, dst0,
1875	struct sockaddr , gateway, struct* sockaddr *, netmask,
1876	int, flags, unsigned int, ifscope);
1877
1878	LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
1879
1880	#if !(DEVELOPMENT \|\| DEBUG)
1881	/*
1882	* Setting the global internet flag external is only for testing
1883	*/
1884	flags &= ~RTF_GLOBAL;
1885	#endif /* !(DEVELOPMENT \|\| DEBUG) */
1886
1887	/*
1888	* Find the correct routing tree to use for this Address Family
1889	*/
1890	if ((rnh = rt_tables[af]) == NULL) {
1891	senderr(ESRCH);
1892	}
1893	/*
1894	* If we are adding a host route then we don't want to put
1895	* a netmask in the tree
1896	*/
1897	if (flags & RTF_HOST) {
1898	netmask = NULL;
1899	}
1900
1901	/*
1902	* If Scoped Routing is enabled, use a local copy of the destination
1903	* address to store the scope ID into. This logic is repeated below
1904	* in the RTM_RESOLVE handler since the caller does not normally
1905	* specify such a flag during a resolve, as well as for the handling
1906	* of IPv4 link-local address; instead, it passes in the route used for
1907	* cloning for which the scope info is derived from. Note also that
1908	* in the case of RTM_DELETE, the address passed in by the caller
1909	* might already contain the scope ID info when it is the key itself,
1910	* thus making RTF_IFSCOPE unnecessary; one instance where it is
1911	* explicitly set is inside route_output() as part of handling a
1912	* routing socket request.
1913	*/
1914	if (req != RTM_RESOLVE && ((af == AF_INET) \|\| (af == AF_INET6))) {
1915	/ Transform dst into the internal routing table form /
1916	dst = sa_copy(src: dst, dst: &ss, pifscope: &ifscope);
1917
1918	/ Transform netmask into the internal routing table form /
1919	if (netmask != NULL) {
1920	netmask = ma_copy(af, src: netmask, dst: &mask, ifscope);
1921	}
1922
1923	if (ifscope != IFSCOPE_NONE) {
1924	flags \|= RTF_IFSCOPE;
1925	}
1926	} else if ((flags & RTF_IFSCOPE) &&
1927	(af != AF_INET && af != AF_INET6)) {
1928	senderr(EINVAL);
1929	}
1930
1931	if (ifscope == IFSCOPE_NONE) {
1932	flags &= ~RTF_IFSCOPE;
1933	}
1934
1935	if (!in6_embedded_scope) {
1936	if (af == AF_INET6 &&
1937	IN6_IS_SCOPE_EMBED(&SIN6(dst)->sin6_addr) &&
1938	SIN6(dst)->sin6_scope_id == IFSCOPE_NONE) {
1939	SIN6(dst)->sin6_scope_id = ifscope;
1940	if (in6_embedded_scope_debug) {
1941	VERIFY(SIN6(dst)->sin6_scope_id != IFSCOPE_NONE);
1942	}
1943	}
1944
1945	if (af == AF_INET6 &&
1946	IN6_IS_SCOPE_EMBED(&SIN6(dst)->sin6_addr) &&
1947	ifscope == IFSCOPE_NONE) {
1948	ifscope = SIN6(dst)->sin6_scope_id;
1949	flags \|= RTF_IFSCOPE;
1950	if (in6_embedded_scope_debug) {
1951	VERIFY(ifscope!= IFSCOPE_NONE);
1952	}
1953	}
1954	}
1955
1956	switch (req) {
1957	case RTM_DELETE: {
1958	rtentry_ref_t gwrt = NULL;
1959	boolean_t was_router = FALSE;
1960	uint32_t old_rt_refcnt = `0`;
1961	/*
1962	* Remove the item from the tree and return it.
1963	* Complain if it is not there and do no more processing.
1964	*/
1965	if ((rn = rnh->rnh_deladdr(dst, netmask, rnh)) == NULL) {
1966	senderr(ESRCH);
1967	}
1968	if (rn->rn_flags & (RNF_ACTIVE \| RNF_ROOT)) {
1969	panic("rtrequest delete");
1970	/ NOTREACHED /
1971	}
1972	rt = RT(rn);
1973
1974	RT_LOCK(rt);
1975	old_rt_refcnt = rt->rt_refcnt;
1976	rt->rt_flags &= ~RTF_UP;
1977	/*
1978	* Release any idle reference count held on the interface
1979	* as this route is no longer externally visible.
1980	*/
1981	rt_clear_idleref(rt);
1982	/*
1983	* Take an extra reference to handle the deletion of a route
1984	* entry whose reference count is already 0; e.g. an expiring
1985	* cloned route entry or an entry that was added to the table
1986	* with 0 reference. If the caller is interested in this route,
1987	* we will return it with the reference intact. Otherwise we
1988	* will decrement the reference via rtfree_locked() and then
1989	* possibly deallocate it.
1990	*/
1991	RT_ADDREF_LOCKED(rt);
1992
1993	/*
1994	* For consistency, in case the caller didn't set the flag.
1995	*/
1996	rt->rt_flags \|= RTF_CONDEMNED;
1997
1998	/*
1999	* Clear RTF_ROUTER if it's set.
2000	*/
2001	if (rt->rt_flags & RTF_ROUTER) {
2002	was_router = TRUE;
2003	VERIFY(rt->rt_flags & RTF_HOST);
2004	rt->rt_flags &= ~RTF_ROUTER;
2005	}
2006
2007	/*
2008	* Enqueue work item to invoke callback for this route entry
2009	*
2010	* If the old count is 0, it implies that last reference is being
2011	* removed and there's no one listening for this route event.
2012	*/
2013	if (old_rt_refcnt != `0`) {
2014	route_event_enqueue_nwk_wq_entry(rt, NULL,
2015	ROUTE_ENTRY_DELETED, NULL, TRUE);
2016	}
2017
2018	/*
2019	* Now search what's left of the subtree for any cloned
2020	* routes which might have been formed from this node.
2021	*/
2022	if ((rt->rt_flags & (RTF_CLONING \| RTF_PRCLONING)) &&
2023	rt_mask(rt)) {
2024	RT_UNLOCK(rt);
2025	rnh->rnh_walktree_from(rnh, dst, rt_mask(rt),
2026	rt_fixdelete, rt);
2027	RT_LOCK(rt);
2028	}
2029
2030	if (was_router) {
2031	struct route_event rt_ev;
2032	route_event_init(p_route_ev: &rt_ev, rt, NULL, route_ev_code: ROUTE_LLENTRY_DELETED);
2033	RT_UNLOCK(rt);
2034	(void) rnh->rnh_walktree(rnh,
2035	route_event_walktree, (void *)&rt_ev);
2036	RT_LOCK(rt);
2037	}
2038
2039	/*
2040	* Remove any external references we may have.
2041	*/
2042	if ((gwrt = rt->rt_gwroute) != NULL) {
2043	rt->rt_gwroute = NULL;
2044	}
2045
2046	/*
2047	* give the protocol a chance to keep things in sync.
2048	*/
2049	if ((ifa = rt->rt_ifa) != NULL) {
2050	IFA_LOCK_SPIN(ifa);
2051	ifa_rtrequest = ifa->ifa_rtrequest;
2052	IFA_UNLOCK(ifa);
2053	if (ifa_rtrequest != NULL) {
2054	ifa_rtrequest(RTM_DELETE, rt, NULL);
2055	}
2056	/ keep reference on rt_ifa /
2057	ifa = NULL;
2058	}
2059
2060	/*
2061	* one more rtentry floating around that is not
2062	* linked to the routing table.
2063	*/
2064	(void) OSIncrementAtomic(&rttrash);
2065	if (rte_debug & RTD_DEBUG) {
2066	TAILQ_INSERT_TAIL(&rttrash_head,
2067	(rtentry_dbg_ref_t)rt, rtd_trash_link);
2068	}
2069
2070	/*
2071	* If this is the (non-scoped) default route, clear
2072	* the interface index used for the primary ifscope.
2073	*/
2074	if (rt_primary_default(rt, rt_key(rt))) {
2075	set_primary_ifscope(rt_key(rt)->sa_family,
2076	IFSCOPE_NONE);
2077	if ((rt->rt_flags & RTF_STATIC) &&
2078	rt_key(rt)->sa_family == PF_INET6) {
2079	trigger_v6_defrtr_select = TRUE;
2080	}
2081	}
2082
2083	#if NECP
2084	/*
2085	* If this is a change in a default route, update
2086	* necp client watchers to re-evaluate
2087	*/
2088	if (SA_DEFAULT(rt_key(rt))) {
2089	if (rt->rt_ifp != NULL) {
2090	ifnet_touch_lastupdown(interface: rt->rt_ifp);
2091	}
2092	necp_update_all_clients();
2093	}
2094	#endif /* NECP */
2095
2096	RT_UNLOCK(rt);
2097
2098	/*
2099	* This might result in another rtentry being freed if
2100	* we held its last reference. Do this after the rtentry
2101	* lock is dropped above, as it could lead to the same
2102	* lock being acquired if gwrt is a clone of rt.
2103	*/
2104	if (gwrt != NULL) {
2105	rtfree_locked(rt: gwrt);
2106	}
2107
2108	/*
2109	* If the caller wants it, then it can have it,
2110	* but it's up to it to free the rtentry as we won't be
2111	* doing it.
2112	*/
2113	if (ret_nrt != NULL) {
2114	/ Return the route to caller with reference intact /
2115	*ret_nrt = rt;
2116	} else {
2117	/ Dereference or deallocate the route /
2118	rtfree_locked(rt);
2119	}
2120	if (af == AF_INET) {
2121	routegenid_inet_update();
2122	} else if (af == AF_INET6) {
2123	routegenid_inet6_update();
2124	}
2125	break;
2126	}
2127	case RTM_RESOLVE:
2128	if (ret_nrt == NULL \|\| (rt = *ret_nrt) == NULL) {
2129	senderr(EINVAL);
2130	}
2131	/*
2132	* According to the UNIX conformance tests, we need to return
2133	* ENETUNREACH when the parent route is RTF_REJECT.
2134	* However, there isn't any point in cloning RTF_REJECT
2135	* routes, so we immediately return an error.
2136	*/
2137	if (rt->rt_flags & RTF_REJECT) {
2138	if (rt->rt_flags & RTF_HOST) {
2139	senderr(EHOSTUNREACH);
2140	} else {
2141	senderr(ENETUNREACH);
2142	}
2143	}
2144	/*
2145	* If cloning, we have the parent route given by the caller
2146	* and will use its rt_gateway, rt_rmx as part of the cloning
2147	* process below. Since rnh_lock is held at this point, the
2148	* parent's rt_ifa and rt_gateway will not change, and its
2149	* relevant rt_flags will not change as well. The only thing
2150	* that could change are the metrics, and thus we hold the
2151	* parent route's rt_lock later on during the actual copying
2152	* of rt_rmx.
2153	*/
2154	ifa = rt->rt_ifa;
2155	ifa_addref(ifa);
2156	flags = rt->rt_flags &
2157	~(RTF_CLONING \| RTF_PRCLONING \| RTF_STATIC);
2158	flags \|= RTF_WASCLONED;
2159	gateway = rt->rt_gateway;
2160	if ((netmask = rt->rt_genmask) == NULL) {
2161	flags \|= RTF_HOST;
2162	}
2163
2164	if (af != AF_INET && af != AF_INET6) {
2165	goto makeroute;
2166	}
2167
2168	/*
2169	* When scoped routing is enabled, cloned entries are
2170	* always scoped according to the interface portion of
2171	* the parent route. The exception to this are IPv4
2172	* link local addresses, or those routes that are cloned
2173	* from a RTF_PROXY route. For the latter, the clone
2174	* gets to keep the RTF_PROXY flag.
2175	*/
2176	if ((af == AF_INET &&
2177	IN_LINKLOCAL(ntohl(SIN(dst)->sin_addr.s_addr))) \|\|
2178	(rt->rt_flags & RTF_PROXY)) {
2179	ifscope = IFSCOPE_NONE;
2180	flags &= ~RTF_IFSCOPE;
2181	/*
2182	* These types of cloned routes aren't currently
2183	* eligible for idle interface reference counting.
2184	*/
2185	flags \|= RTF_NOIFREF;
2186	} else {
2187	if (flags & RTF_IFSCOPE) {
2188	ifscope = (af == AF_INET) ?
2189	sin_get_ifscope(rt_key(rt)) :
2190	sin6_get_ifscope(rt_key(rt));
2191	} else {
2192	ifscope = rt->rt_ifp->if_index;
2193	flags \|= RTF_IFSCOPE;
2194	}
2195	VERIFY(ifscope != IFSCOPE_NONE);
2196	}
2197
2198	/*
2199	* Transform dst into the internal routing table form,
2200	* clearing out the scope ID field if ifscope isn't set.
2201	*/
2202	dst = sa_copy(src: dst, dst: &ss, pifscope: (ifscope == IFSCOPE_NONE) ?
2203	NULL : &ifscope);
2204
2205	/ Transform netmask into the internal routing table form /
2206	if (netmask != NULL) {
2207	netmask = ma_copy(af, src: netmask, dst: &mask, ifscope);
2208	}
2209
2210	goto makeroute;
2211
2212	case RTM_ADD:
2213	if ((flags & RTF_GATEWAY) && !gateway) {
2214	panic("rtrequest: RTF_GATEWAY but no gateway");
2215	/ NOTREACHED /
2216	}
2217	if (flags & RTF_IFSCOPE) {
2218	ifa = ifa_ifwithroute_scoped_locked(flags, dst: dst0,
2219	gateway, ifscope);
2220	} else {
2221	ifa = ifa_ifwithroute_locked(flags, dst: dst0, gateway);
2222	}
2223	if (ifa == NULL) {
2224	senderr(ENETUNREACH);
2225	}
2226	makeroute:
2227	/*
2228	* We land up here for both RTM_RESOLVE and RTM_ADD
2229	* when we decide to create a route.
2230	*/
2231	if ((rt = rte_alloc()) == NULL) {
2232	senderr(ENOBUFS);
2233	}
2234	Bzero(rt, sizeof(*rt));
2235	rte_lock_init(rt);
2236	eventhandler_lists_ctxt_init(evthdlr_lists_ctxt: &rt->rt_evhdlr_ctxt);
2237	getmicrotime(&caltime);
2238	rt->base_calendartime = caltime.tv_sec;
2239	rt->base_uptime = net_uptime();
2240	RT_LOCK(rt);
2241	rt->rt_flags = RTF_UP \| flags;
2242
2243	/*
2244	* Point the generation ID to the tree's.
2245	*/
2246	switch (af) {
2247	case AF_INET:
2248	rt->rt_tree_genid = &route_genid_inet;
2249	break;
2250	case AF_INET6:
2251	rt->rt_tree_genid = &route_genid_inet6;
2252	break;
2253	default:
2254	break;
2255	}
2256
2257	/*
2258	* Add the gateway. Possibly re-malloc-ing the storage for it
2259	* also add the rt_gwroute if possible.
2260	*/
2261	if ((error = rt_setgate(rt, dst, gateway)) != `0`) {
2262	int tmp = error;
2263	RT_UNLOCK(rt);
2264	nstat_route_detach(rte: rt);
2265	rte_lock_destroy(rt);
2266	rte_free(rt);
2267	senderr(tmp);
2268	}
2269
2270	/*
2271	* point to the (possibly newly malloc'd) dest address.
2272	*/
2273	ndst = rt_key(rt);
2274
2275	/*
2276	* make sure it contains the value we want (masked if needed).
2277	*/
2278	if (netmask) {
2279	rt_maskedcopy(dst, ndst, netmask);
2280	} else {
2281	SOCKADDR_COPY(dst, ndst, dst->sa_len);
2282	}
2283
2284	/*
2285	* Note that we now have a reference to the ifa.
2286	* This moved from below so that rnh->rnh_addaddr() can
2287	* examine the ifa and ifa->ifa_ifp if it so desires.
2288	*/
2289	rtsetifa(rt, ifa);
2290	rt->rt_ifp = rt->rt_ifa->ifa_ifp;
2291
2292	/ XXX mtu manipulation will be done in rnh_addaddr -- itojun /
2293
2294	rn = rnh->rnh_addaddr((caddr_t)ndst, (caddr_t)netmask,
2295	rnh, rt->rt_nodes);
2296	if (rn == `0`) {
2297	rtentry_ref_t rt2;
2298	/*
2299	* Uh-oh, we already have one of these in the tree.
2300	* We do a special hack: if the route that's already
2301	* there was generated by the protocol-cloning
2302	* mechanism, then we just blow it away and retry
2303	* the insertion of the new one.
2304	*/
2305	if (flags & RTF_IFSCOPE) {
2306	rt2 = rtalloc1_scoped_locked(dst: dst0, report: `0`,
2307	RTF_CLONING \| RTF_PRCLONING, ifscope);
2308	} else {
2309	rt2 = rtalloc1_locked(dst, report: `0`,
2310	RTF_CLONING \| RTF_PRCLONING);
2311	}
2312	if (rt2 && rt2->rt_parent) {
2313	/*
2314	* rnh_lock is held here, so rt_key and
2315	* rt_gateway of rt2 will not change.
2316	*/
2317	(void) rtrequest_locked(RTM_DELETE, rt_key(rt2),
2318	gateway: rt2->rt_gateway, rt_mask(rt2),
2319	flags: rt2->rt_flags, ret_nrt: `0`);
2320	rtfree_locked(rt: rt2);
2321	rn = rnh->rnh_addaddr((caddr_t)ndst,
2322	(caddr_t)netmask, rnh, rt->rt_nodes);
2323	} else if (rt2) {
2324	/ undo the extra ref we got /
2325	rtfree_locked(rt: rt2);
2326	}
2327	}
2328
2329	/*
2330	* If it still failed to go into the tree,
2331	* then un-make it (this should be a function)
2332	*/
2333	if (rn == NULL) {
2334	char dbuf[MAX_IPv6_STR_LEN], gbuf[MAX_IPv6_STR_LEN];
2335
2336	rt_str(rt, dbuf, sizeof(dbuf), gbuf, sizeof(gbuf));
2337	os_log_error(OS_LOG_DEFAULT, "%s: route already exists: "
2338	"%s->%s->%s",
2339	__func__, dbuf, gbuf,
2340	((rt->rt_ifp != NULL) ?
2341	rt->rt_ifp->if_xname : ""));
2342
2343	/ Clear gateway route /
2344	rt_set_gwroute(rt, rt_key(rt), NULL);
2345	if (rt->rt_ifa) {
2346	ifa_remref(ifa: rt->rt_ifa);
2347	rt->rt_ifa = NULL;
2348	}
2349	rt_key_free(rt);
2350	RT_UNLOCK(rt);
2351	nstat_route_detach(rte: rt);
2352	rte_lock_destroy(rt);
2353	rte_free(rt);
2354	senderr(EEXIST);
2355	}
2356
2357	rt->rt_parent = NULL;
2358
2359	/*
2360	* If we got here from RESOLVE, then we are cloning so clone
2361	* the rest, and note that we are a clone (and increment the
2362	* parent's references). rnh_lock is still held, which prevents
2363	* a lookup from returning the newly-created route. Hence
2364	* holding and releasing the parent's rt_lock while still
2365	* holding the route's rt_lock is safe since the new route
2366	* is not yet externally visible.
2367	*/
2368	if (req == RTM_RESOLVE) {
2369	RT_LOCK_SPIN(*ret_nrt);
2370	VERIFY((*ret_nrt)->rt_expire == `0` \|\|
2371	(*ret_nrt)->rt_rmx.rmx_expire != `0`);
2372	VERIFY((*ret_nrt)->rt_expire != `0` \|\|
2373	(*ret_nrt)->rt_rmx.rmx_expire == `0`);
2374	rt->rt_rmx = (*ret_nrt)->rt_rmx;
2375	rt_setexpire(rt, (*ret_nrt)->rt_expire);
2376	if ((*ret_nrt)->rt_flags &
2377	(RTF_CLONING \| RTF_PRCLONING)) {
2378	rt->rt_parent = (*ret_nrt);
2379	RT_ADDREF_LOCKED(*ret_nrt);
2380	}
2381	RT_UNLOCK(*ret_nrt);
2382	}
2383
2384	/*
2385	* if this protocol has something to add to this then
2386	* allow it to do that as well.
2387	*/
2388	IFA_LOCK_SPIN(ifa);
2389	ifa_rtrequest = ifa->ifa_rtrequest;
2390	IFA_UNLOCK(ifa);
2391	if (ifa_rtrequest != NULL) {
2392	/*
2393	* Can not use SA(ret_nrt ? *ret_nrt : NULL),
2394	* because *ret_nrt is not a sockadr.
2395	*/
2396	ifa_rtrequest(req, rt,
2397	__unsafe_forge_single(struct sockaddr, ret_nrt ? ret_nrt : NULL));
2398	}
2399	ifa_remref(ifa);
2400	ifa = NULL;
2401
2402	/*
2403	* If this is the (non-scoped) default route, record
2404	* the interface index used for the primary ifscope.
2405	*/
2406	if (rt_primary_default(rt, rt_key(rt))) {
2407	set_primary_ifscope(rt_key(rt)->sa_family,
2408	ifscope: rt->rt_ifp->if_index);
2409	}
2410
2411	#if NECP
2412	/*
2413	* If this is a change in a default route, update
2414	* necp client watchers to re-evaluate
2415	*/
2416	if (SA_DEFAULT(rt_key(rt))) {
2417	/*
2418	* Mark default routes as (potentially) leading to the global internet
2419	* this can be used for policy decisions.
2420	* The clone routes will inherit this flag.
2421	* We check against the host flag as this works for default routes that have
2422	* a gateway and defaults routes when all subnets are local.
2423	*/
2424	if (req == RTM_ADD && (rt->rt_flags & RTF_HOST) == `0`) {
2425	rt->rt_flags \|= RTF_GLOBAL;
2426	}
2427	if (rt->rt_ifp != NULL) {
2428	ifnet_touch_lastupdown(interface: rt->rt_ifp);
2429	}
2430	necp_update_all_clients();
2431	}
2432	#endif /* NECP */
2433
2434	/*
2435	* actually return a resultant rtentry and
2436	* give the caller a single reference.
2437	*/
2438	if (ret_nrt) {
2439	*ret_nrt = rt;
2440	RT_ADDREF_LOCKED(rt);
2441	}
2442
2443	if (af == AF_INET) {
2444	routegenid_inet_update();
2445	} else if (af == AF_INET6) {
2446	routegenid_inet6_update();
2447	}
2448
2449	RT_GENID_SYNC(rt);
2450
2451	/*
2452	* We repeat the same procedures from rt_setgate() here
2453	* because they weren't completed when we called it earlier,
2454	* since the node was embryonic.
2455	*/
2456	if ((rt->rt_flags & RTF_GATEWAY) && rt->rt_gwroute != NULL) {
2457	rt_set_gwroute(rt, rt_key(rt), rt->rt_gwroute);
2458	}
2459
2460	if (req == RTM_ADD &&
2461	!(rt->rt_flags & RTF_HOST) && rt_mask(rt) != NULL) {
2462	struct rtfc_arg arg;
2463	arg.rnh = rnh;
2464	arg.rt0 = rt;
2465	RT_UNLOCK(rt);
2466	rnh->rnh_walktree_from(rnh, rt_key(rt), rt_mask(rt),
2467	rt_fixchange, &arg);
2468	} else {
2469	RT_UNLOCK(rt);
2470	}
2471
2472	nstat_route_new_entry(rt);
2473	break;
2474	}
2475	bad:
2476	if (ifa) {
2477	ifa_remref(ifa);
2478	}
2479	return error;
2480	}
2481	#undef senderr
2482
2483	int
2484	rtrequest(int req, struct sockaddr dst, struct* sockaddr *gateway,
2485	struct sockaddr netmask, int* flags, struct rtentry **ret_nrt)
2486	{
2487	int error;
2488	LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_NOTOWNED);
2489	lck_mtx_lock(rnh_lock);
2490	error = rtrequest_locked(req, dst, gateway, netmask, flags, ret_nrt);
2491	lck_mtx_unlock(rnh_lock);
2492	return error;
2493	}
2494
2495	int
2496	rtrequest_scoped(int req, struct sockaddr dst, struct* sockaddr *gateway,
2497	struct sockaddr netmask, int* flags, struct rtentry **ret_nrt,
2498	unsigned int ifscope)
2499	{
2500	int error;
2501	LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_NOTOWNED);
2502	lck_mtx_lock(rnh_lock);
2503	error = rtrequest_scoped_locked(req, dst, gateway, netmask, flags,
2504	ret_nrt, ifscope);
2505	lck_mtx_unlock(rnh_lock);
2506	return error;
2507	}
2508
2509	/*
2510	* Called from rtrequest(RTM_DELETE, ...) to fix up the route's ``family''
2511	* (i.e., the routes related to it by the operation of cloning). This
2512	* routine is iterated over all potential former-child-routes by way of
2513	* rnh->rnh_walktree_from() above, and those that actually are children of
2514	* the late parent (passed in as VP here) are themselves deleted.
2515	*/
2516	static int
2517	rt_fixdelete(struct radix_node rn, void* *vp)
2518	{
2519	rtentry_ref_t rt = (rtentry_ref_t)rn;
2520	rtentry_ref_t rt0 = (rtentry_ref_t)vp;
2521
2522	LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
2523
2524	RT_LOCK(rt);
2525	if (rt->rt_parent == rt0 &&
2526	!(rt->rt_flags & (RTF_CLONING \| RTF_PRCLONING))) {
2527	/*
2528	* Safe to drop rt_lock and use rt_key, since holding
2529	* rnh_lock here prevents another thread from calling
2530	* rt_setgate() on this route.
2531	*/
2532	RT_UNLOCK(rt);
2533	return rtrequest_locked(RTM_DELETE, rt_key(rt), NULL,
2534	rt_mask(rt), flags: rt->rt_flags, NULL);
2535	}
2536	RT_UNLOCK(rt);
2537	return `0`;
2538	}
2539
2540	/*
2541	* This routine is called from rt_setgate() to do the analogous thing for
2542	* adds and changes. There is the added complication in this case of a
2543	* middle insert; i.e., insertion of a new network route between an older
2544	* network route and (cloned) host routes. For this reason, a simple check
2545	* of rt->rt_parent is insufficient; each candidate route must be tested
2546	* against the (mask, value) of the new route (passed as before in vp)
2547	* to see if the new route matches it.
2548	*
2549	* XXX - it may be possible to do fixdelete() for changes and reserve this
2550	* routine just for adds. I'm not sure why I thought it was necessary to do
2551	* changes this way.
2552	*/
2553	static int
2554	rt_fixchange(struct radix_node rn, void* *vp)
2555	{
2556	rtentry_ref_t rt = (rtentry_ref_t)rn;
2557	struct rtfc_arg *ap = vp;
2558	rtentry_ref_t rt0 = ap->rt0;
2559	struct radix_node_head *rnh = ap->rnh;
2560	u_char xk1, xm1, xk2, xmp;
2561	int i, len;
2562
2563	LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
2564
2565	RT_LOCK(rt);
2566
2567	if (!rt->rt_parent \|\|
2568	(rt->rt_flags & (RTF_CLONING \| RTF_PRCLONING))) {
2569	RT_UNLOCK(rt);
2570	return `0`;
2571	}
2572
2573	if (rt->rt_parent == rt0) {
2574	goto delete_rt;
2575	}
2576
2577	/*
2578	* There probably is a function somewhere which does this...
2579	* if not, there should be.
2580	*/
2581	len = imin(rt_key(rt0)->sa_len, rt_key(rt)->sa_len);
2582
2583	xk1 = (u_char *)rt_key(rt0);
2584	xm1 = (u_char *)rt_mask(rt0);
2585	xk2 = (u_char *)rt_key(rt);
2586
2587	/*
2588	* Avoid applying a less specific route; do this only if the parent
2589	* route (rt->rt_parent) is a network route, since otherwise its mask
2590	* will be NULL if it is a cloning host route.
2591	*/
2592	if ((xmp = (u_char *)rt_mask(rt->rt_parent)) != NULL) {
2593	int mlen = rt_mask(rt->rt_parent)->sa_len;
2594	if (mlen > rt_mask(rt0)->sa_len) {
2595	RT_UNLOCK(rt);
2596	return `0`;
2597	}
2598
2599	for (i = rnh->rnh_treetop->rn_offset; i < mlen; i++) {
2600	if ((xmp[i] & ~(xmp[i] ^ xm1[i])) != xmp[i]) {
2601	RT_UNLOCK(rt);
2602	return `0`;
2603	}
2604	}
2605	}
2606
2607	for (i = rnh->rnh_treetop->rn_offset; i < len; i++) {
2608	if ((xk2[i] & xm1[i]) != xk1[i]) {
2609	RT_UNLOCK(rt);
2610	return `0`;
2611	}
2612	}
2613
2614	/*
2615	* OK, this node is a clone, and matches the node currently being
2616	* changed/added under the node's mask. So, get rid of it.
2617	*/
2618	delete_rt:
2619	/*
2620	* Safe to drop rt_lock and use rt_key, since holding rnh_lock here
2621	* prevents another thread from calling rt_setgate() on this route.
2622	*/
2623	RT_UNLOCK(rt);
2624	return rtrequest_locked(RTM_DELETE, rt_key(rt), NULL,
2625	rt_mask(rt), flags: rt->rt_flags, NULL);
2626	}
2627
2628	/*
2629	* Round up sockaddr len to multiples of 32-bytes. This will reduce
2630	* or even eliminate the need to re-allocate the chunk of memory used
2631	* for rt_key and rt_gateway in the event the gateway portion changes.
2632	* Certain code paths (e.g. IPsec) are notorious for caching the address
2633	* of rt_gateway; this rounding-up would help ensure that the gateway
2634	* portion never gets deallocated (though it may change contents) and
2635	* thus greatly simplifies things.
2636	*/
2637	#define SA_SIZE(x) (-(-((uintptr_t)(x)) & -(32)))
2638
2639	/*
2640	* Sets the gateway and/or gateway route portion of a route; may be
2641	* called on an existing route to modify the gateway portion. Both
2642	* rt_key and rt_gateway are allocated out of the same memory chunk.
2643	* Route entry lock must be held by caller; this routine will return
2644	* with the lock held.
2645	*/
2646	int
2647	rt_setgate(struct rtentry rt, struct* sockaddr dst, struct* sockaddr *gate)
2648	{
2649	int dlen = (int)SA_SIZE(dst->sa_len), glen = (int)SA_SIZE(gate->sa_len);
2650	struct radix_node_head *rnh = NULL;
2651	boolean_t loop = FALSE;
2652
2653	if (dst->sa_family != AF_INET && dst->sa_family != AF_INET6) {
2654	return EINVAL;
2655	}
2656
2657	rnh = rt_tables[dst->sa_family];
2658	LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
2659	RT_LOCK_ASSERT_HELD(rt);
2660
2661	/*
2662	* If this is for a route that is on its way of being removed,
2663	* or is temporarily frozen, reject the modification request.
2664	*/
2665	if (rt->rt_flags & RTF_CONDEMNED) {
2666	return EBUSY;
2667	}
2668
2669	/ Add an extra ref for ourselves /
2670	RT_ADDREF_LOCKED(rt);
2671
2672	if (rt->rt_flags & RTF_GATEWAY) {
2673	if ((dst->sa_len == gate->sa_len) &&
2674	(dst->sa_family == AF_INET \|\| dst->sa_family == AF_INET6)) {
2675	struct sockaddr_storage dst_ss, gate_ss;
2676
2677	(void) sa_copy(src: dst, dst: &dst_ss, NULL);
2678	(void) sa_copy(src: gate, dst: &gate_ss, NULL);
2679
2680	loop = sa_equal(SA(&dst_ss), SA(&gate_ss));
2681	} else {
2682	loop = (dst->sa_len == gate->sa_len &&
2683	sa_equal(dst, gate));
2684	}
2685	}
2686
2687	/*
2688	* A (cloning) network route with the destination equal to the gateway
2689	* will create an endless loop (see notes below), so disallow it.
2690	*/
2691	if (((rt->rt_flags & (RTF_HOST \| RTF_GATEWAY \| RTF_LLINFO)) ==
2692	RTF_GATEWAY) && loop) {
2693	/ Release extra ref /
2694	RT_REMREF_LOCKED(rt);
2695	return EADDRNOTAVAIL;
2696	}
2697
2698	/*
2699	* A host route with the destination equal to the gateway
2700	* will interfere with keeping LLINFO in the routing
2701	* table, so disallow it.
2702	*/
2703	if (((rt->rt_flags & (RTF_HOST \| RTF_GATEWAY \| RTF_LLINFO)) ==
2704	(RTF_HOST \| RTF_GATEWAY)) && loop) {
2705	/*
2706	* The route might already exist if this is an RTM_CHANGE
2707	* or a routing redirect, so try to delete it.
2708	*/
2709	if (rt_key(rt) != NULL) {
2710	/*
2711	* Safe to drop rt_lock and use rt_key, rt_gateway,
2712	* since holding rnh_lock here prevents another thread
2713	* from calling rt_setgate() on this route.
2714	*/
2715	RT_UNLOCK(rt);
2716	(void) rtrequest_locked(RTM_DELETE, rt_key(rt),
2717	gateway: rt->rt_gateway, rt_mask(rt), flags: rt->rt_flags, NULL);
2718	RT_LOCK(rt);
2719	}
2720	/ Release extra ref /
2721	RT_REMREF_LOCKED(rt);
2722	return EADDRNOTAVAIL;
2723	}
2724
2725	/*
2726	* The destination is not directly reachable. Get a route
2727	* to the next-hop gateway and store it in rt_gwroute.
2728	*/
2729	if (rt->rt_flags & RTF_GATEWAY) {
2730	rtentry_ref_t gwrt;
2731	unsigned int ifscope;
2732
2733	if (dst->sa_family == AF_INET) {
2734	ifscope = sin_get_ifscope(sa: dst);
2735	} else if (dst->sa_family == AF_INET6) {
2736	ifscope = sin6_get_ifscope(sa: dst);
2737	} else {
2738	ifscope = IFSCOPE_NONE;
2739	}
2740
2741	RT_UNLOCK(rt);
2742	/*
2743	* Don't ignore RTF_CLONING, since we prefer that rt_gwroute
2744	* points to a clone rather than a cloning route; see above
2745	* check for cloning loop avoidance (dst == gate).
2746	*/
2747	gwrt = rtalloc1_scoped_locked(dst: gate, report: `1`, RTF_PRCLONING, ifscope);
2748	if (gwrt != NULL) {
2749	RT_LOCK_ASSERT_NOTHELD(gwrt);
2750	}
2751	RT_LOCK(rt);
2752
2753	/*
2754	* Cloning loop avoidance:
2755	*
2756	* In the presence of protocol-cloning and bad configuration,
2757	* it is possible to get stuck in bottomless mutual recursion
2758	* (rtrequest rt_setgate rtalloc1). We avoid this by not
2759	* allowing protocol-cloning to operate for gateways (which
2760	* is probably the correct choice anyway), and avoid the
2761	* resulting reference loops by disallowing any route to run
2762	* through itself as a gateway. This is obviously mandatory
2763	* when we get rt->rt_output(). It implies that a route to
2764	* the gateway must already be present in the system in order
2765	* for the gateway to be referred to by another route.
2766	*/
2767	if (gwrt == rt) {
2768	RT_REMREF_LOCKED(gwrt);
2769	/ Release extra ref /
2770	RT_REMREF_LOCKED(rt);
2771	return EADDRINUSE; / failure /
2772	}
2773
2774	/*
2775	* If scoped, the gateway route must use the same interface;
2776	* we're holding rnh_lock now, so rt_gateway and rt_ifp of gwrt
2777	* should not change and are freely accessible.
2778	*/
2779	if (ifscope != IFSCOPE_NONE && (rt->rt_flags & RTF_IFSCOPE) &&
2780	gwrt != NULL && gwrt->rt_ifp != NULL &&
2781	gwrt->rt_ifp->if_index != ifscope) {
2782	rtfree_locked(rt: gwrt); / rt != gwrt, no deadlock /
2783	/ Release extra ref /
2784	RT_REMREF_LOCKED(rt);
2785	return (rt->rt_flags & RTF_HOST) ?
2786	EHOSTUNREACH : ENETUNREACH;
2787	}
2788
2789	/ Check again since we dropped the lock above /
2790	if (rt->rt_flags & RTF_CONDEMNED) {
2791	if (gwrt != NULL) {
2792	rtfree_locked(rt: gwrt);
2793	}
2794	/ Release extra ref /
2795	RT_REMREF_LOCKED(rt);
2796	return EBUSY;
2797	}
2798
2799	/ Set gateway route; callee adds ref to gwrt if non-NULL /
2800	rt_set_gwroute(rt, dst, gwrt);
2801
2802	/*
2803	* In case the (non-scoped) default route gets modified via
2804	* an ICMP redirect, record the interface index used for the
2805	* primary ifscope. Also done in rt_setif() to take care
2806	* of the non-redirect cases.
2807	*/
2808	if (rt_primary_default(rt, dst) && rt->rt_ifp != NULL) {
2809	set_primary_ifscope(af: dst->sa_family,
2810	ifscope: rt->rt_ifp->if_index);
2811	}
2812
2813	#if NECP
2814	/*
2815	* If this is a change in a default route, update
2816	* necp client watchers to re-evaluate
2817	*/
2818	if (SA_DEFAULT(dst)) {
2819	necp_update_all_clients();
2820	}
2821	#endif /* NECP */
2822
2823	/*
2824	* Tell the kernel debugger about the new default gateway
2825	* if the gateway route uses the primary interface, or
2826	* if we are in a transient state before the non-scoped
2827	* default gateway is installed (similar to how the system
2828	* was behaving in the past). In future, it would be good
2829	* to do all this only when KDP is enabled.
2830	*/
2831	if ((dst->sa_family == AF_INET) &&
2832	gwrt != NULL && gwrt->rt_gateway->sa_family == AF_LINK &&
2833	(gwrt->rt_ifp->if_index == get_primary_ifscope(AF_INET) \|\|
2834	get_primary_ifscope(AF_INET) == IFSCOPE_NONE)) {
2835	kdp_set_gateway_mac(SDL(gwrt->rt_gateway)->
2836	sdl_data);
2837	}
2838
2839	/ Release extra ref from rtalloc1() /
2840	if (gwrt != NULL) {
2841	RT_REMREF(gwrt);
2842	}
2843	}
2844
2845	/*
2846	* Prepare to store the gateway in rt_gateway. Both dst and gateway
2847	* are stored one after the other in the same malloc'd chunk. If we
2848	* have room, reuse the old buffer since rt_gateway already points
2849	* to the right place. Otherwise, malloc a new block and update
2850	* the 'dst' address and point rt_gateway to the right place.
2851	*/
2852	if (rt->rt_gateway == NULL \|\| glen > SA_SIZE(rt->rt_gateway->sa_len)) {
2853	caddr_t new;
2854
2855	/ The underlying allocation is done with M_WAITOK set /
2856	new = kalloc_data(dlen + glen, Z_WAITOK \| Z_ZERO);
2857	if (new == NULL) {
2858	/ Clear gateway route /
2859	rt_set_gwroute(rt, dst, NULL);
2860	/ Release extra ref /
2861	RT_REMREF_LOCKED(rt);
2862	return ENOBUFS;
2863	}
2864
2865	/*
2866	* Copy from 'dst' and not rt_key(rt) because we can get
2867	* here to initialize a newly allocated route entry, in
2868	* which case rt_key(rt) is NULL (and so does rt_gateway).
2869	*/
2870	SOCKADDR_COPY(dst, new, dst->sa_len);
2871	rt_key_free(rt); / free old block; NULL is okay /
2872	rt->rt_nodes->rn_key = new;
2873	rt->rt_gateway = SA(new + dlen);
2874	}
2875
2876	/*
2877	* Copy the new gateway value into the memory chunk.
2878	*/
2879	SOCKADDR_COPY(gate, rt->rt_gateway, gate->sa_len);
2880
2881	/*
2882	* For consistency between rt_gateway and rt_key(gwrt).
2883	*/
2884	if ((rt->rt_flags & RTF_GATEWAY) && rt->rt_gwroute != NULL &&
2885	(rt->rt_gwroute->rt_flags & RTF_IFSCOPE)) {
2886	if (rt->rt_gateway->sa_family == AF_INET &&
2887	rt_key(rt->rt_gwroute)->sa_family == AF_INET) {
2888	sin_set_ifscope(sa: rt->rt_gateway,
2889	ifscope: sin_get_ifscope(rt_key(rt->rt_gwroute)));
2890	} else if (rt->rt_gateway->sa_family == AF_INET6 &&
2891	rt_key(rt->rt_gwroute)->sa_family == AF_INET6) {
2892	sin6_set_ifscope(sa: rt->rt_gateway,
2893	ifscope: sin6_get_ifscope(rt_key(rt->rt_gwroute)));
2894	}
2895	}
2896
2897	/*
2898	* This isn't going to do anything useful for host routes, so
2899	* don't bother. Also make sure we have a reasonable mask
2900	* (we don't yet have one during adds).
2901	*/
2902	if (!(rt->rt_flags & RTF_HOST) && rt_mask(rt) != `0`) {
2903	struct rtfc_arg arg;
2904	arg.rnh = rnh;
2905	arg.rt0 = rt;
2906	RT_UNLOCK(rt);
2907	rnh->rnh_walktree_from(rnh, rt_key(rt), rt_mask(rt),
2908	rt_fixchange, &arg);
2909	RT_LOCK(rt);
2910	}
2911
2912	/ Release extra ref /
2913	RT_REMREF_LOCKED(rt);
2914	return `0`;
2915	}
2916
2917	#undef SA_SIZE
2918
2919	void
2920	rt_set_gwroute(struct rtentry rt, struct* sockaddr dst, struct* rtentry *gwrt)
2921	{
2922	boolean_t gwrt_isrouter;
2923
2924	LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
2925	RT_LOCK_ASSERT_HELD(rt);
2926
2927	if (gwrt != NULL) {
2928	RT_ADDREF(gwrt); / for this routine /
2929	}
2930	/*
2931	* Get rid of existing gateway route; if rt_gwroute is already
2932	* set to gwrt, this is slightly redundant (though safe since
2933	* we held an extra ref above) but makes the code simpler.
2934	*/
2935	if (rt->rt_gwroute != NULL) {
2936	rtentry_ref_t ogwrt = rt->rt_gwroute;
2937
2938	VERIFY(rt != ogwrt); / sanity check /
2939	rt->rt_gwroute = NULL;
2940	RT_UNLOCK(rt);
2941	rtfree_locked(rt: ogwrt);
2942	RT_LOCK(rt);
2943	VERIFY(rt->rt_gwroute == NULL);
2944	}
2945
2946	/*
2947	* And associate the new gateway route.
2948	*/
2949	if ((rt->rt_gwroute = gwrt) != NULL) {
2950	RT_ADDREF(gwrt); / for rt /
2951
2952	if (rt->rt_flags & RTF_WASCLONED) {
2953	/ rt_parent might be NULL if rt is embryonic /
2954	gwrt_isrouter = (rt->rt_parent != NULL &&
2955

Browse the source code of xnu/bsd/net/route.c