route.c source code [xnu/bsd/net/route.c]

1	/*
2	* Copyright (c) 2000-2023 Apple Inc. All rights reserved.
3	*
4	* @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5	*
6	* This file contains Original Code and/or Modifications of Original Code
7	* as defined in and that are subject to the Apple Public Source License
8	* Version 2.0 (the 'License'). You may not use this file except in
9	* compliance with the License. The rights granted to you under the License
10	* may not be used to create, or enable the creation or redistribution of,
11	* unlawful or unlicensed copies of an Apple operating system, or to
12	* circumvent, violate, or enable the circumvention or violation of, any
13	* terms of an Apple operating system software license agreement.
14	*
15	* Please obtain a copy of the License at
16	* http://www.opensource.apple.com/apsl/ and read it before using this file.
17	*
18	* The Original Code and all software distributed under the License are
19	* distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20	* EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21	* INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22	* FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23	* Please see the License for the specific language governing rights and
24	* limitations under the License.
25	*
26	* @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27	*/
28	/*
29	* Copyright (c) 1980, 1986, 1991, 1993
30	* The Regents of the University of California. All rights reserved.
31	*
32	* Redistribution and use in source and binary forms, with or without
33	* modification, are permitted provided that the following conditions
34	* are met:
35	* 1. Redistributions of source code must retain the above copyright
36	* notice, this list of conditions and the following disclaimer.
37	* 2. Redistributions in binary form must reproduce the above copyright
38	* notice, this list of conditions and the following disclaimer in the
39	* documentation and/or other materials provided with the distribution.
40	* 3. All advertising materials mentioning features or use of this software
41	* must display the following acknowledgement:
42	* This product includes software developed by the University of
43	* California, Berkeley and its contributors.
44	* 4. Neither the name of the University nor the names of its contributors
45	* may be used to endorse or promote products derived from this software
46	* without specific prior written permission.
47	*
48	* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
49	* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
50	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
51	* ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
52	* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
53	* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
54	* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
55	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
56	* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
57	* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
58	* SUCH DAMAGE.
59	*
60	* @(#)route.c 8.2 (Berkeley) 11/15/93
61	* $FreeBSD: src/sys/net/route.c,v 1.59.2.3 2001/07/29 19:18:02 ume Exp $
62	*/
63
64	#include <sys/param.h>
65	#include <sys/sysctl.h>
66	#include <sys/systm.h>
67	#include <sys/malloc.h>
68	#include <sys/mbuf.h>
69	#include <sys/socket.h>
70	#include <sys/domain.h>
71	#include <sys/stat.h>
72	#include <sys/ubc.h>
73	#include <sys/vnode.h>
74	#include <sys/syslog.h>
75	#include <sys/queue.h>
76	#include <sys/mcache.h>
77	#include <sys/priv.h>
78	#include <sys/protosw.h>
79	#include <sys/sdt.h>
80	#include <sys/kernel.h>
81	#include <kern/locks.h>
82	#include <kern/zalloc.h>
83
84	#include <net/dlil.h>
85	#include <net/if.h>
86	#include <net/route.h>
87	#include <net/ntstat.h>
88	#include <net/nwk_wq.h>
89	#if NECP
90	#include <net/necp.h>
91	#endif /* NECP */
92
93	#include <netinet/in.h>
94	#include <netinet/in_var.h>
95	#include <netinet/ip_var.h>
96	#include <netinet/ip.h>
97	#include <netinet/ip6.h>
98	#include <netinet/in_arp.h>
99
100	#include <netinet6/ip6_var.h>
101	#include <netinet6/in6_var.h>
102	#include <netinet6/nd6.h>
103
104	#include <net/if_dl.h>
105
106	#include <net/sockaddr_utils.h>
107
108	#include <libkern/OSAtomic.h>
109	#include <libkern/OSDebug.h>
110
111	#include <pexpert/pexpert.h>
112
113	#if CONFIG_MACF
114	#include <sys/kauth.h>
115	#endif
116
117	#include <sys/constrained_ctypes.h>
118
119	/*
120	* Synchronization notes:
121	*
122	* Routing entries fall under two locking domains: the global routing table
123	* lock (rnh_lock) and the per-entry lock (rt_lock); the latter is a mutex that
124	* resides (statically defined) in the rtentry structure.
125	*
126	* The locking domains for routing are defined as follows:
127	*
128	* The global routing lock is used to serialize all accesses to the radix
129	* trees defined by rt_tables[], as well as the tree of masks. This includes
130	* lookups, insertions and removals of nodes to/from the respective tree.
131	* It is also used to protect certain fields in the route entry that aren't
132	* often modified and/or require global serialization (more details below.)
133	*
134	* The per-route entry lock is used to serialize accesses to several routing
135	* entry fields (more details below.) Acquiring and releasing this lock is
136	* done via RT_LOCK() and RT_UNLOCK() routines.
137	*
138	* In cases where both rnh_lock and rt_lock must be held, the former must be
139	* acquired first in order to maintain lock ordering. It is not a requirement
140	* that rnh_lock be acquired first before rt_lock, but in case both must be
141	* acquired in succession, the correct lock ordering must be followed.
142	*
143	* The fields of the rtentry structure are protected in the following way:
144	*
145	* rt_nodes[]
146	*
147	* - Routing table lock (rnh_lock).
148	*
149	* rt_parent, rt_mask, rt_llinfo_free, rt_tree_genid
150	*
151	* - Set once during creation and never changes; no locks to read.
152	*
153	* rt_flags, rt_genmask, rt_llinfo, rt_rmx, rt_refcnt, rt_gwroute
154	*
155	* - Routing entry lock (rt_lock) for read/write access.
156	*
157	* - Some values of rt_flags are either set once at creation time,
158	* or aren't currently used, and thus checking against them can
159	* be done without rt_lock: RTF_GATEWAY, RTF_HOST, RTF_DYNAMIC,
160	* RTF_DONE, RTF_XRESOLVE, RTF_STATIC, RTF_BLACKHOLE, RTF_ANNOUNCE,
161	* RTF_USETRAILERS, RTF_WASCLONED, RTF_PINNED, RTF_LOCAL,
162	* RTF_BROADCAST, RTF_MULTICAST, RTF_IFSCOPE, RTF_IFREF.
163	*
164	* rt_key, rt_gateway, rt_ifp, rt_ifa
165	*
166	* - Always written/modified with both rnh_lock and rt_lock held.
167	*
168	* - May be read freely with rnh_lock held, else must hold rt_lock
169	* for read access; holding both locks for read is also okay.
170	*
171	* - In the event rnh_lock is not acquired, or is not possible to be
172	* acquired across the operation, setting RTF_CONDEMNED on a route
173	* entry will prevent its rt_key, rt_gateway, rt_ifp and rt_ifa
174	* from being modified. This is typically done on a route that
175	* has been chosen for a removal (from the tree) prior to dropping
176	* the rt_lock, so that those values will remain the same until
177	* the route is freed.
178	*
179	* When rnh_lock is held rt_setgate(), rt_setif(), and rtsetifa() are
180	* single-threaded, thus exclusive. This flag will also prevent the
181	* route from being looked up via rt_lookup().
182	*
183	* rt_genid
184	*
185	* - Assumes that 32-bit writes are atomic; no locks.
186	*
187	* rt_dlt, rt_output
188	*
189	* - Currently unused; no locks.
190	*
191	* Operations on a route entry can be described as follows:
192	*
193	* CREATE an entry with reference count set to 0 as part of RTM_ADD/RESOLVE.
194	*
195	* INSERTION of an entry into the radix tree holds the rnh_lock, checks
196	* for duplicates and then adds the entry. rtrequest returns the entry
197	* after bumping up the reference count to 1 (for the caller).
198	*
199	* LOOKUP of an entry holds the rnh_lock and bumps up the reference count
200	* before returning; it is valid to also bump up the reference count using
201	* RT_ADDREF after the lookup has returned an entry.
202	*
203	* REMOVAL of an entry from the radix tree holds the rnh_lock, removes the
204	* entry but does not decrement the reference count. Removal happens when
205	* the route is explicitly deleted (RTM_DELETE) or when it is in the cached
206	* state and it expires. The route is said to be "down" when it is no
207	* longer present in the tree. Freeing the entry will happen on the last
208	* reference release of such a "down" route.
209	*
210	* RT_ADDREF/RT_REMREF operates on the routing entry which increments/
211	* decrements the reference count, rt_refcnt, atomically on the rtentry.
212	* rt_refcnt is modified only using this routine. The general rule is to
213	* do RT_ADDREF in the function that is passing the entry as an argument,
214	* in order to prevent the entry from being freed by the callee.
215	*/
216	extern void kdp_set_gateway_mac(void *gatewaymac);
217
218	__private_extern__ struct rtstat rtstat = {
219	.rts_badredirect = `0`,
220	.rts_dynamic = `0`,
221	.rts_newgateway = `0`,
222	.rts_unreach = `0`,
223	.rts_wildcard = `0`,
224	.rts_badrtgwroute = `0`
225	};
226	struct radix_node_head *rt_tables[AF_MAX + `1`];
227
228	static LCK_GRP_DECLARE(rnh_lock_grp, "route");
229	LCK_MTX_DECLARE(rnh_lock_data, &rnh_lock_grp); / global routing tables mutex /
230
231	int rttrash = `0`; / routes not in table but not freed /
232
233	boolean_t trigger_v6_defrtr_select = FALSE;
234	unsigned int rte_debug = `0`;
235
236	/ Possible flags for rte_debug /
237	#define RTD_DEBUG 0x1 /* enable or disable rtentry debug facility */
238	#define RTD_TRACE 0x2 /* trace alloc, free, refcnt and lock */
239	#define RTD_NO_FREE 0x4 /* don't free (good to catch corruptions) */
240
241	#define RTE_NAME "rtentry" /* name for zone and rt_lock */
242
243	static struct zone rte_zone; /* special zone for rtentry /
244	#define RTE_ZONE_MAX 65536 /* maximum elements in zone */
245	#define RTE_ZONE_NAME RTE_NAME /* name of rtentry zone */
246
247	#define RTD_INUSE 0xFEEDFACE /* entry is in use */
248	#define RTD_FREED 0xDEADBEEF /* entry is freed */
249
250	#define MAX_SCOPE_ADDR_STR_LEN (MAX_IPv6_STR_LEN + 6)
251
252	/ Lock group and attribute for routing entry locks /
253	static LCK_ATTR_DECLARE(rte_mtx_attr, `0`, `0`);
254	static LCK_GRP_DECLARE(rte_mtx_grp, RTE_NAME);
255
256	/ For gdb /
257	__private_extern__ unsigned int ctrace_stack_size = CTRACE_STACK_SIZE;
258	__private_extern__ unsigned int ctrace_hist_size = CTRACE_HIST_SIZE;
259
260	/*
261	* Debug variant of rtentry structure.
262	*/
263	struct rtentry_dbg {
264	struct rtentry rtd_entry; / rtentry /
265	struct rtentry rtd_entry_saved; / saved rtentry /
266	uint32_t rtd_inuse; / in use pattern /
267	uint16_t rtd_refhold_cnt; / # of rtref /
268	uint16_t rtd_refrele_cnt; / # of rtunref /
269	uint32_t rtd_lock_cnt; / # of locks /
270	uint32_t rtd_unlock_cnt; / # of unlocks /
271	/*
272	* Alloc and free callers.
273	*/
274	ctrace_t rtd_alloc;
275	ctrace_t rtd_free;
276	/*
277	* Circular lists of rtref and rtunref callers.
278	*/
279	ctrace_t rtd_refhold[CTRACE_HIST_SIZE];
280	ctrace_t rtd_refrele[CTRACE_HIST_SIZE];
281	/*
282	* Circular lists of locks and unlocks.
283	*/
284	ctrace_t rtd_lock[CTRACE_HIST_SIZE];
285	ctrace_t rtd_unlock[CTRACE_HIST_SIZE];
286	/*
287	* Trash list linkage
288	*/
289	TAILQ_ENTRY(rtentry_dbg) rtd_trash_link;
290	};
291	__CCT_DECLARE_CONSTRAINED_PTR_TYPES(struct rtentry_dbg, rtentry_dbg);
292
293	/ List of trash route entries protected by rnh_lock /
294	static TAILQ_HEAD(, rtentry_dbg) rttrash_head;
295
296	static void rte_lock_init(struct rtentry *);
297	static void rte_lock_destroy(struct rtentry *);
298	static inline struct rtentry rte_alloc_debug(void*);
299	static inline void rte_free_debug(struct rtentry *);
300	static inline void rte_lock_debug(struct rtentry_dbg *);
301	static inline void rte_unlock_debug(struct rtentry_dbg *);
302	static void rt_maskedcopy(const struct sockaddr *,
303	struct sockaddr , const* struct sockaddr *);
304	static void rtable_init(void **);
305	static inline void rtref_audit(struct rtentry_dbg *);
306	static inline void rtunref_audit(struct rtentry_dbg *);
307	static struct rtentry rtalloc1_common_locked(struct* sockaddr , int*, uint32_t,
308	unsigned int);
309	static int rtrequest_common_locked(int, struct sockaddr *,
310	struct sockaddr , struct* sockaddr , int, struct* rtentry **,
311	unsigned int);
312	static struct rtentry rtalloc1_locked(struct* sockaddr , int*, uint32_t);
313	static void rtalloc_ign_common_locked(struct route , uint32_t, unsigned* int);
314	static inline void sin6_set_ifscope(struct sockaddr , unsigned* int);
315	static inline void sin6_set_embedded_ifscope(struct sockaddr , unsigned* int);
316	static inline unsigned int sin6_get_embedded_ifscope(struct sockaddr *);
317	static struct sockaddr ma_copy(int, struct* sockaddr *,
318	struct sockaddr_storage , unsigned* int);
319	static struct sockaddr sa_trim(struct* sockaddr *, uint8_t);
320	static struct radix_node node_lookup(struct* sockaddr , struct* sockaddr *,
321	unsigned int);
322	static struct radix_node node_lookup_default(int*);
323	static struct rtentry rt_lookup_common(boolean_t, boolean_t, struct* sockaddr *,
324	struct sockaddr , struct* radix_node_head , unsigned* int);
325	static int rn_match_ifscope(struct radix_node , void* *);
326	static struct ifaddr ifa_ifwithroute_common_locked(int*,
327	const struct sockaddr , const* struct sockaddr , unsigned* int);
328	static struct rtentry rte_alloc(void*);
329	static void rte_free(struct rtentry *);
330	static void rtfree_common(struct rtentry *, boolean_t);
331	static void rte_if_ref(struct ifnet , int*);
332	static void rt_set_idleref(struct rtentry *);
333	static void rt_clear_idleref(struct rtentry *);
334	static void rt_str4(struct rtentry , char* , uint32_t, char* *, uint32_t);
335	static void rt_str6(struct rtentry , char* , uint32_t, char* *, uint32_t);
336	static boolean_t route_ignore_protocol_cloning_for_dst(struct rtentry , struct* sockaddr *);
337
338	uint32_t route_genid_inet = `0`;
339	uint32_t route_genid_inet6 = `0`;
340
341	#define ASSERT_SINIFSCOPE(sa) { \
342	if ((sa)->sa_family != AF_INET \|\| \
343	(sa)->sa_len < sizeof (struct sockaddr_in)) \
344	panic("%s: bad sockaddr_in %p", __func__, sa); \
345	}
346
347	#define ASSERT_SIN6IFSCOPE(sa) { \
348	if ((sa)->sa_family != AF_INET6 \|\| \
349	(sa)->sa_len < sizeof (struct sockaddr_in6)) \
350	panic("%s: bad sockaddr_in6 %p", __func__, sa); \
351	}
352
353	/*
354	* Argument to leaf-matching routine; at present it is scoped routing
355	* specific but can be expanded in future to include other search filters.
356	*/
357	struct matchleaf_arg {
358	unsigned int ifscope; / interface scope /
359	};
360
361	/*
362	* For looking up the non-scoped default route (sockaddr instead
363	* of sockaddr_in for convenience).
364	*/
365	static struct sockaddr sin_def = {
366	.sa_len = sizeof(struct sockaddr_in),
367	.sa_family = AF_INET,
368	.sa_data = { `0`, }
369	};
370
371	static struct sockaddr_in6 sin6_def = {
372	.sin6_len = sizeof(struct sockaddr_in6),
373	.sin6_family = AF_INET6,
374	.sin6_port = `0`,
375	.sin6_flowinfo = `0`,
376	.sin6_addr = IN6ADDR_ANY_INIT,
377	.sin6_scope_id = `0`
378	};
379
380	/*
381	* Interface index (scope) of the primary interface; determined at
382	* the time when the default, non-scoped route gets added, changed
383	* or deleted. Protected by rnh_lock.
384	*/
385	static unsigned int primary_ifscope = IFSCOPE_NONE;
386	static unsigned int primary6_ifscope = IFSCOPE_NONE;
387
388	#define INET_DEFAULT(sa) \
389	((sa)->sa_family == AF_INET && SIN(sa)->sin_addr.s_addr == 0)
390
391	#define INET6_DEFAULT(sa) \
392	((sa)->sa_family == AF_INET6 && \
393	IN6_IS_ADDR_UNSPECIFIED(&SIN6(sa)->sin6_addr))
394
395	#define SA_DEFAULT(sa) (INET_DEFAULT(sa) \|\| INET6_DEFAULT(sa))
396	#define RT(r) ((rtentry_ref_t)r)
397	#define RN(r) ((struct radix_node *)r)
398	#define RT_HOST(r) (RT(r)->rt_flags & RTF_HOST)
399
400	#define ROUTE_VERBOSE_LOGGING 0
401	unsigned int rt_verbose = ROUTE_VERBOSE_LOGGING;
402	SYSCTL_DECL(_net_route);
403	SYSCTL_UINT(_net_route, OID_AUTO, verbose, CTLFLAG_RW \| CTLFLAG_LOCKED,
404	&rt_verbose, ROUTE_VERBOSE_LOGGING, "");
405
406	static void
407	rtable_init(void **table)
408	{
409	struct domain *dom;
410
411	domain_proto_mtx_lock_assert_held();
412
413	TAILQ_FOREACH(dom, &domains, dom_entry) {
414	if (dom->dom_rtattach != NULL) {
415	dom->dom_rtattach(&table[dom->dom_family],
416	dom->dom_rtoffset);
417	}
418	}
419	}
420
421	/*
422	* Called by route_dinit().
423	*/
424	void
425	route_init(void)
426	{
427	int size;
428
429	_CASSERT(offsetof(struct route, ro_rt) ==
430	offsetof(struct route_in6, ro_rt));
431	_CASSERT(offsetof(struct route, ro_srcia) ==
432	offsetof(struct route_in6, ro_srcia));
433	_CASSERT(offsetof(struct route, ro_flags) ==
434	offsetof(struct route_in6, ro_flags));
435	_CASSERT(offsetof(struct route, ro_dst) ==
436	offsetof(struct route_in6, ro_dst));
437
438	PE_parse_boot_argn(arg_string: "rte_debug", arg_ptr: &rte_debug, max_arg: sizeof(rte_debug));
439	if (rte_debug != `0`) {
440	rte_debug \|= RTD_DEBUG;
441	}
442
443	lck_mtx_lock(rnh_lock);
444	rn_init(); / initialize all zeroes, all ones, mask table /
445	lck_mtx_unlock(rnh_lock);
446	rtable_init(table: (void **)rt_tables);
447
448	if (rte_debug & RTD_DEBUG) {
449	size = sizeof(struct rtentry_dbg);
450	} else {
451	size = sizeof(struct rtentry);
452	}
453
454	rte_zone = zone_create(RTE_ZONE_NAME, size, flags: ZC_NONE);
455
456	TAILQ_INIT(&rttrash_head);
457	}
458
459	/*
460	* Given a route, determine whether or not it is the non-scoped default
461	* route; dst typically comes from rt_key(rt) but may be coming from
462	* a separate place when rt is in the process of being created.
463	*/
464	boolean_t
465	rt_primary_default(struct rtentry rt, struct* sockaddr *dst)
466	{
467	return SA_DEFAULT(dst) && !(rt->rt_flags & RTF_IFSCOPE);
468	}
469
470	/*
471	* Set the ifscope of the primary interface; caller holds rnh_lock.
472	*/
473	void
474	set_primary_ifscope(int af, unsigned int ifscope)
475	{
476	if (af == AF_INET) {
477	primary_ifscope = ifscope;
478	} else {
479	primary6_ifscope = ifscope;
480	}
481	}
482
483	/*
484	* Return the ifscope of the primary interface; caller holds rnh_lock.
485	*/
486	unsigned int
487	get_primary_ifscope(int af)
488	{
489	return af == AF_INET ? primary_ifscope : primary6_ifscope;
490	}
491
492	/*
493	* Set the scope ID of a given a sockaddr_in.
494	*/
495	void
496	sin_set_ifscope(struct sockaddr sa, unsigned* int ifscope)
497	{
498	/ Caller must pass in sockaddr_in /
499	ASSERT_SINIFSCOPE(sa);
500
501	SINIFSCOPE(sa)->sin_scope_id = ifscope;
502	}
503
504	/*
505	* Set the scope ID of given a sockaddr_in6.
506	*/
507	static inline void
508	sin6_set_ifscope(struct sockaddr sa, unsigned* int ifscope)
509	{
510	/ Caller must pass in sockaddr_in6 /
511	ASSERT_SIN6IFSCOPE(sa);
512
513	SIN6IFSCOPE(sa)->sin6_scope_id = ifscope;
514	}
515
516	/*
517	* Given a sockaddr_in, return the scope ID to the caller.
518	*/
519	unsigned int
520	sin_get_ifscope(struct sockaddr *sa)
521	{
522	/ Caller must pass in sockaddr_in /
523	ASSERT_SINIFSCOPE(sa);
524
525	return SINIFSCOPE(sa)->sin_scope_id;
526	}
527
528	/*
529	* Given a sockaddr_in6, return the scope ID to the caller.
530	*/
531	unsigned int
532	sin6_get_ifscope(struct sockaddr *sa)
533	{
534	/ Caller must pass in sockaddr_in6 /
535	ASSERT_SIN6IFSCOPE(sa);
536
537	return SIN6IFSCOPE(sa)->sin6_scope_id;
538	}
539
540	static inline void
541	sin6_set_embedded_ifscope(struct sockaddr sa, unsigned* int ifscope)
542	{
543	if (!in6_embedded_scope) {
544	SIN6(sa)->sin6_scope_id = ifscope;
545	return;
546	}
547
548	/ Caller must pass in sockaddr_in6 /
549	ASSERT_SIN6IFSCOPE(sa);
550	VERIFY(IN6_IS_SCOPE_EMBED(&(SIN6(sa)->sin6_addr)));
551
552	SIN6(sa)->sin6_addr.s6_addr16[`1`] = htons((uint16_t)ifscope);
553	}
554
555	static inline unsigned int
556	sin6_get_embedded_ifscope(struct sockaddr *sa)
557	{
558	if (!in6_embedded_scope) {
559	return SIN6(sa)->sin6_scope_id;
560	}
561	/ Caller must pass in sockaddr_in6 /
562	ASSERT_SIN6IFSCOPE(sa);
563
564	return ntohs(SIN6(sa)->sin6_addr.s6_addr16[`1`]);
565	}
566
567	/*
568	* Copy a sockaddr_{in,in6} src to a dst storage and set scope ID into dst.
569	*
570	* To clear the scope ID, pass is a NULL pifscope. To set the scope ID, pass
571	* in a non-NULL pifscope with non-zero ifscope. Otherwise if pifscope is
572	* non-NULL and ifscope is IFSCOPE_NONE, the existing scope ID is left intact.
573	* In any case, the effective scope ID value is returned to the caller via
574	* pifscope, if it is non-NULL.
575	*/
576	struct sockaddr *
577	sa_copy(struct sockaddr src, struct* sockaddr_storage *dst,
578	unsigned int *pifscope)
579	{
580	int af = src->sa_family;
581	unsigned int ifscope = (pifscope != NULL) ? *pifscope : IFSCOPE_NONE;
582
583	VERIFY(af == AF_INET \|\| af == AF_INET6);
584
585	bzero(s: dst, n: sizeof(*dst));
586
587	if (af == AF_INET) {
588	SOCKADDR_COPY(src, dst, sizeof(struct sockaddr_in));
589	dst->ss_len = sizeof(struct sockaddr_in);
590	if (pifscope == NULL \|\| ifscope != IFSCOPE_NONE) {
591	sin_set_ifscope(SA(dst), ifscope);
592	}
593	} else {
594	SOCKADDR_COPY(src, dst, sizeof(struct sockaddr_in6));
595	dst->ss_len = sizeof(struct sockaddr_in6);
596	if (pifscope != NULL &&
597	IN6_IS_SCOPE_EMBED(&SIN6(dst)->sin6_addr)) {
598	unsigned int eifscope;
599	/*
600	* If the address contains the embedded scope ID,
601	* use that as the value for sin6_scope_id as long
602	* the caller doesn't insist on clearing it (by
603	* passing NULL) or setting it.
604	*/
605	eifscope = sin6_get_embedded_ifscope(SA(dst));
606	if (eifscope != IFSCOPE_NONE && ifscope == IFSCOPE_NONE) {
607	ifscope = eifscope;
608	}
609	if (ifscope != IFSCOPE_NONE) {
610	/ Set ifscope from pifscope or eifscope /
611	sin6_set_ifscope(SA(dst), ifscope);
612	} else {
613	/ If sin6_scope_id has a value, use that one /
614	ifscope = sin6_get_ifscope(SA(dst));
615	}
616	/*
617	* If sin6_scope_id is set but the address doesn't
618	* contain the equivalent embedded value, set it.
619	*/
620	if (ifscope != IFSCOPE_NONE && eifscope != ifscope) {
621	sin6_set_embedded_ifscope(SA(dst), ifscope);
622	}
623	} else if (pifscope == NULL \|\| ifscope != IFSCOPE_NONE) {
624	sin6_set_ifscope(SA(dst), ifscope);
625	}
626	}
627
628	if (pifscope != NULL) {
629	*pifscope = (af == AF_INET) ? sin_get_ifscope(SA(dst)) :
630	sin6_get_ifscope(SA(dst));
631	}
632
633	return SA(dst);
634	}
635
636	/*
637	* Copy a mask from src to a dst storage and set scope ID into dst.
638	*/
639	static struct sockaddr *
640	ma_copy(int af, struct sockaddr src, struct* sockaddr_storage *dst,
641	unsigned int ifscope)
642	{
643	VERIFY(af == AF_INET \|\| af == AF_INET6);
644
645	bzero(s: dst, n: sizeof(*dst));
646	rt_maskedcopy(src, SA(dst), src);
647
648	/*
649	* The length of the mask sockaddr would need to be adjusted
650	* to cover the additional {sin,sin6}_ifscope field; when ifscope
651	* is IFSCOPE_NONE, we'd end up clearing the scope ID field on
652	* the destination mask in addition to extending the length
653	* of the sockaddr, as a side effect. This is okay, as any
654	* trailing zeroes would be skipped by rn_addmask prior to
655	* inserting or looking up the mask in the mask tree.
656	*/
657	if (af == AF_INET) {
658	SINIFSCOPE(dst)->sin_scope_id = ifscope;
659	SINIFSCOPE(dst)->sin_len =
660	offsetof(struct sockaddr_inifscope, sin_scope_id) +
661	sizeof(SINIFSCOPE(dst)->sin_scope_id);
662	} else {
663	SIN6IFSCOPE(dst)->sin6_scope_id = ifscope;
664	SIN6IFSCOPE(dst)->sin6_len =
665	offsetof(struct sockaddr_in6, sin6_scope_id) +
666	sizeof(SIN6IFSCOPE(dst)->sin6_scope_id);
667	}
668
669	return SA(dst);
670	}
671
672	/*
673	* Trim trailing zeroes on a sockaddr and update its length.
674	*/
675	static struct sockaddr *
676	sa_trim(struct sockaddr *sa, uint8_t skip)
677	{
678	caddr_t cp;
679	caddr_t base = (caddr_t)__SA_UTILS_CONV_TO_BYTES(sa) + skip;
680
681	if (sa->sa_len <= skip) {
682	return sa;
683	}
684
685	for (cp = base + (sa->sa_len - skip); cp > base && cp[-`1`] == `0`;) {
686	cp--;
687	}
688
689	sa->sa_len = (uint8_t)(cp - base) + skip;
690	if (sa->sa_len < skip) {
691	/ Must not happen, and if so, panic /
692	panic("%s: broken logic (sa_len %d < skip %d )", __func__,
693	sa->sa_len, skip);
694	/ NOTREACHED /
695	} else if (sa->sa_len == skip) {
696	/ If we end up with all zeroes, then there's no mask /
697	sa->sa_len = `0`;
698	}
699
700	return sa;
701	}
702
703	/*
704	* Called by rtm_msg{1,2} routines to "scrub" socket address structures of
705	* kernel private information, so that clients of the routing socket will
706	* not be confused by the presence of the information, or the side effect of
707	* the increased length due to that. The source sockaddr is not modified;
708	* instead, the scrubbing happens on the destination sockaddr storage that
709	* is passed in by the caller.
710	*
711	* Scrubbing entails:
712	* - removing embedded scope identifiers from network mask and destination
713	* IPv4 and IPv6 socket addresses
714	* - optionally removing global scope interface hardware addresses from
715	* link-layer interface addresses when the MAC framework check fails.
716	*/
717	struct sockaddr *
718	rtm_scrub(int type, int idx, struct sockaddr hint, struct* sockaddr *sa,
719	void buf __sized_by(buflen), uint32_t buflen, kauth_cred_t credp)
720	{
721	struct sockaddr_storage ss = (struct* sockaddr_storage *)buf;
722	struct sockaddr *ret = sa;
723
724	VERIFY(buf != NULL && buflen >= sizeof(*ss));
725	bzero(s: buf, n: buflen);
726
727	switch (idx) {
728	case RTAX_DST:
729	/*
730	* If this is for an AF_INET/AF_INET6 destination address,
731	* call sa_copy() to clear the scope ID field.
732	*/
733	if (sa->sa_family == AF_INET &&
734	SINIFSCOPE(sa)->sin_scope_id != IFSCOPE_NONE) {
735	ret = sa_copy(src: sa, dst: ss, NULL);
736	} else if (sa->sa_family == AF_INET6 &&
737	SIN6IFSCOPE(sa)->sin6_scope_id != IFSCOPE_NONE) {
738	ret = sa_copy(src: sa, dst: ss, NULL);
739	}
740	break;
741
742	case RTAX_NETMASK: {
743	uint8_t skip, af;
744	/*
745	* If this is for a mask, we can't tell whether or not there
746	* is an valid scope ID value, as the span of bytes between
747	* sa_len and the beginning of the mask (offset of sin_addr in
748	* the case of AF_INET, or sin6_addr for AF_INET6) may be
749	* filled with all-ones by rn_addmask(), and hence we cannot
750	* rely on sa_family. Because of this, we use the sa_family
751	* of the hint sockaddr (RTAX_{DST,IFA}) as indicator as to
752	* whether or not the mask is to be treated as one for AF_INET
753	* or AF_INET6. Clearing the scope ID field involves setting
754	* it to IFSCOPE_NONE followed by calling sa_trim() to trim
755	* trailing zeroes from the storage sockaddr, which reverses
756	* what was done earlier by ma_copy() on the source sockaddr.
757	*/
758	if (hint == NULL \|\|
759	((af = hint->sa_family) != AF_INET && af != AF_INET6)) {
760	break; / nothing to do /
761	}
762	skip = (af == AF_INET) ?
763	offsetof(struct sockaddr_in, sin_addr) :
764	offsetof(struct sockaddr_in6, sin6_addr);
765
766	if (sa->sa_len > skip && sa->sa_len <= sizeof(*ss)) {
767	SOCKADDR_COPY(sa, ss, sa->sa_len);
768	/*
769	* Don't use {sin,sin6}_set_ifscope() as sa_family
770	* and sa_len for the netmask might not be set to
771	* the corresponding expected values of the hint.
772	*/
773	if (hint->sa_family == AF_INET) {
774	SINIFSCOPE(ss)->sin_scope_id = IFSCOPE_NONE;
775	} else {
776	SIN6IFSCOPE(ss)->sin6_scope_id = IFSCOPE_NONE;
777	}
778	ret = sa_trim(SA(ss), skip);
779
780	/*
781	* For AF_INET6 mask, set sa_len appropriately unless
782	* this is requested via systl_dumpentry(), in which
783	* case we return the raw value.
784	*/
785	if (hint->sa_family == AF_INET6 &&
786	type != RTM_GET && type != RTM_GET2) {
787	SA(ret)->sa_len = sizeof(struct sockaddr_in6);
788	}
789	}
790	break;
791	}
792	case RTAX_GATEWAY: {
793	/*
794	* Break if the gateway is not AF_LINK type (indirect routes)
795	*
796	* Else, if is, check if it is resolved. If not yet resolved
797	* simply break else scrub the link layer address.
798	*/
799	if ((sa->sa_family != AF_LINK) \|\| (SDL(sa)->sdl_alen == `0`)) {
800	break;
801	}
802	OS_FALLTHROUGH;
803	}
804
805	case RTAX_IFP: {
806	if (sa->sa_family == AF_LINK && credp) {
807	struct sockaddr_dl *sdl = SDL(buf);
808	const void *bytes;
809	size_t size;
810
811	/ caller should handle worst case: SOCK_MAXADDRLEN /
812	VERIFY(buflen >= sa->sa_len);
813
814	SOCKADDR_COPY(sa, sdl, sa->sa_len);
815	bytes = dlil_ifaddr_bytes(sdl, &size, credp);
816	if (bytes != CONST_LLADDR(sdl)) {
817	VERIFY(sdl->sdl_alen == size);
818	bcopy(src: bytes, LLADDR(sdl), n: size);
819	}
820	ret = SA(sdl);
821	}
822	break;
823	}
824	default:
825	break;
826	}
827
828	return ret;
829	}
830
831	/*
832	* Callback leaf-matching routine for rn_matchaddr_args used
833	* for looking up an exact match for a scoped route entry.
834	*/
835	static int
836	rn_match_ifscope(struct radix_node rn, void* *arg)
837	{
838	rtentry_ref_t rt = (rtentry_ref_t)rn;
839	struct matchleaf_arg *ma = arg;
840	int af = rt_key(rt)->sa_family;
841
842	if (!(rt->rt_flags & RTF_IFSCOPE) \|\| (af != AF_INET && af != AF_INET6)) {
843	return `0`;
844	}
845
846	return af == AF_INET ?
847	(SINIFSCOPE(rt_key(rt))->sin_scope_id == ma->ifscope) :
848	(SIN6IFSCOPE(rt_key(rt))->sin6_scope_id == ma->ifscope);
849	}
850
851	/*
852	* Atomically increment route generation counter
853	*/
854	void
855	routegenid_update(void)
856	{
857	routegenid_inet_update();
858	routegenid_inet6_update();
859	}
860
861	void
862	routegenid_inet_update(void)
863	{
864	os_atomic_inc(&route_genid_inet, relaxed);
865	}
866
867	void
868	routegenid_inet6_update(void)
869	{
870	os_atomic_inc(&route_genid_inet6, relaxed);
871	}
872
873	/*
874	* Packet routing routines.
875	*/
876	void
877	rtalloc(struct route *ro)
878	{
879	rtalloc_ign(ro, `0`);
880	}
881
882	void
883	rtalloc_scoped(struct route ro, unsigned* int ifscope)
884	{
885	rtalloc_scoped_ign(ro, `0`, ifscope);
886	}
887
888	static void
889	rtalloc_ign_common_locked(struct route *ro, uint32_t ignore,
890	unsigned int ifscope)
891	{
892	rtentry_ref_t rt;
893
894	if ((rt = ro->ro_rt) != NULL) {
895	RT_LOCK_SPIN(rt);
896	if (rt->rt_ifp != NULL && !ROUTE_UNUSABLE(ro)) {
897	RT_UNLOCK(rt);
898	return;
899	}
900	RT_UNLOCK(rt);
901	ROUTE_RELEASE_LOCKED(ro); / rnh_lock already held /
902	}
903	ro->ro_rt = rtalloc1_common_locked(SA(&ro->ro_dst), `1`, ignore, ifscope);
904	if (ro->ro_rt != NULL) {
905	RT_GENID_SYNC(ro->ro_rt);
906	RT_LOCK_ASSERT_NOTHELD(ro->ro_rt);
907	}
908	}
909
910	void
911	rtalloc_ign(struct route *ro, uint32_t ignore)
912	{
913	LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_NOTOWNED);
914	lck_mtx_lock(rnh_lock);
915	rtalloc_ign_common_locked(ro, ignore, IFSCOPE_NONE);
916	lck_mtx_unlock(rnh_lock);
917	}
918
919	void
920	rtalloc_scoped_ign(struct route ro, uint32_t ignore, unsigned* int ifscope)
921	{
922	LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_NOTOWNED);
923	lck_mtx_lock(rnh_lock);
924	rtalloc_ign_common_locked(ro, ignore, ifscope);
925	lck_mtx_unlock(rnh_lock);
926	}
927
928	static struct rtentry *
929	rtalloc1_locked(struct sockaddr dst, int* report, uint32_t ignflags)
930	{
931	return rtalloc1_common_locked(dst, report, ignflags, IFSCOPE_NONE);
932	}
933
934	struct rtentry *
935	rtalloc1_scoped_locked(struct sockaddr dst, int* report, uint32_t ignflags,
936	unsigned int ifscope)
937	{
938	return rtalloc1_common_locked(dst, report, ignflags, ifscope);
939	}
940
941	static boolean_t
942	route_ignore_protocol_cloning_for_dst(struct rtentry rt, struct* sockaddr *dst)
943	{
944	/*
945	* For now keep protocol cloning for any type of IPv4
946	* destination.
947	*/
948	if (dst->sa_family != AF_INET6) {
949	return FALSE;
950	}
951
952	/*
953	* Limit protocol route creation of IPv6 ULA destinations
954	* from default route,
955	* Just to be safe, even though it doesn't affect routability,
956	* still allow protocol cloned routes if we happen to hit
957	* default route over companion link for ULA destination.
958	*/
959	if (!IFNET_IS_COMPANION_LINK(rt->rt_ifp) &&
960	(rt->rt_flags & RTF_GATEWAY) &&
961	(rt->rt_flags & RTF_PRCLONING) &&
962	SA_DEFAULT(rt_key(rt)) &&
963	(IN6_IS_ADDR_UNIQUE_LOCAL(&SIN6(dst)->sin6_addr) \|\| IN6_IS_SCOPE_EMBED(&SIN6(dst)->sin6_addr))) {
964	return TRUE;
965	}
966	return FALSE;
967	}
968
969	struct rtentry *
970	rtalloc1_common_locked(struct sockaddr dst, int* report, uint32_t ignflags,
971	unsigned int ifscope)
972	{
973	struct radix_node_head *rnh = rt_tables[dst->sa_family];
974	rtentry_ref_t rt = NULL;
975	rtentry_ref_t newrt = NULL;
976	struct rt_addrinfo info;
977	uint32_t nflags;
978	int err = `0`;
979	u_char msgtype = RTM_MISS;
980
981	if (rnh == NULL) {
982	goto unreachable;
983	}
984
985	if (!in6_embedded_scope && dst->sa_family == AF_INET6) {
986	if (IN6_IS_SCOPE_EMBED(&SIN6(dst)->sin6_addr) &&
987	SIN6(dst)->sin6_scope_id == `0`) {
988	SIN6(dst)->sin6_scope_id = ifscope;
989	}
990	}
991
992	/*
993	* Find the longest prefix or exact (in the scoped case) address match;
994	* callee adds a reference to entry and checks for root node as well
995	*/
996	rt = rt_lookup(FALSE, dst, NULL, rnh, ifscope);
997	if (rt == NULL) {
998	goto unreachable;
999	}
1000
1001	/*
1002	* Explicitly ignore protocol cloning for certain destinations.
1003	* Some checks below are kind of redundant, as for now, RTF_PRCLONING
1004	* is only set on indirect (RTF_GATEWAY) routes.
1005	* Also, we do this only when the route lookup above, resulted in default
1006	* route.
1007	* This is done to ensure, the resulting indirect host route doesn't
1008	* interfere when routing table gets configured with a indirect subnet
1009	* route/direct subnet route that is more specific than the current
1010	* parent route of the resulting protocol cloned route.
1011	*
1012	* At the crux of it all, it is a problem that we maintain host cache
1013	* in the routing table. We should revisit this for a generic solution.
1014	*/
1015	if (route_ignore_protocol_cloning_for_dst(rt, dst)) {
1016	ignflags \|= RTF_PRCLONING;
1017	}
1018
1019	RT_LOCK_SPIN(rt);
1020	newrt = rt;
1021	nflags = rt->rt_flags & ~ignflags;
1022	RT_UNLOCK(rt);
1023
1024	if (report && (nflags & (RTF_CLONING \| RTF_PRCLONING))) {
1025	/*
1026	* We are apparently adding (report = 0 in delete).
1027	* If it requires that it be cloned, do so.
1028	* (This implies it wasn't a HOST route.)
1029	*/
1030	err = rtrequest_locked(RTM_RESOLVE, dst, NULL, NULL, `0`, &newrt);
1031	if (err) {
1032	/*
1033	* If the cloning didn't succeed, maybe what we
1034	* have from lookup above will do. Return that;
1035	* no need to hold another reference since it's
1036	* already done.
1037	*/
1038	newrt = rt;
1039	goto miss;
1040	}
1041
1042	/*
1043	* We cloned it; drop the original route found during lookup.
1044	* The resulted cloned route (newrt) would now have an extra
1045	* reference held during rtrequest.
1046	*/
1047	rtfree_locked(rt);
1048
1049	/*
1050	* If the newly created cloned route is a direct host route
1051	* then also check if it is to a router or not.
1052	* If it is, then set the RTF_ROUTER flag on the host route
1053	* for the gateway.
1054	*
1055	* XXX It is possible for the default route to be created post
1056	* cloned route creation of router's IP.
1057	* We can handle that corner case by special handing for RTM_ADD
1058	* of default route.
1059	*/
1060	if ((newrt->rt_flags & (RTF_HOST \| RTF_LLINFO)) ==
1061	(RTF_HOST \| RTF_LLINFO)) {
1062	rtentry_ref_t defrt = NULL;
1063	struct sockaddr_storage def_key;
1064
1065	bzero(s: &def_key, n: sizeof(def_key));
1066	def_key.ss_len = rt_key(newrt)->sa_len;
1067	def_key.ss_family = rt_key(newrt)->sa_family;
1068
1069	defrt = rtalloc1_scoped_locked(SA(&def_key),
1070	report: `0`, ignflags: `0`, ifscope: newrt->rt_ifp->if_index);
1071
1072	if (defrt) {
1073	if (sa_equal(rt_key(newrt), defrt->rt_gateway)) {
1074	newrt->rt_flags \|= RTF_ROUTER;
1075	}
1076	rtfree_locked(defrt);
1077	}
1078	}
1079
1080	if ((rt = newrt) && (rt->rt_flags & RTF_XRESOLVE)) {
1081	/*
1082	* If the new route specifies it be
1083	* externally resolved, then go do that.
1084	*/
1085	msgtype = RTM_RESOLVE;
1086	goto miss;
1087	}
1088	}
1089	goto done;
1090
1091	unreachable:
1092	/*
1093	* Either we hit the root or couldn't find any match,
1094	* Which basically means "cant get there from here"
1095	*/
1096	rtstat.rts_unreach++;
1097
1098	miss:
1099	if (report) {
1100	/*
1101	* If required, report the failure to the supervising
1102	* Authorities.
1103	* For a delete, this is not an error. (report == 0)
1104	*/
1105	bzero(s: (caddr_t)&info, n: sizeof(info));
1106	info.rti_info[RTAX_DST] = dst;
1107	rt_missmsg(msgtype, &info, `0`, err);
1108	}
1109	done:
1110	return newrt;
1111	}
1112
1113	struct rtentry *
1114	rtalloc1(struct sockaddr dst, int* report, uint32_t ignflags)
1115	{
1116	rtentry_ref_t entry;
1117	LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_NOTOWNED);
1118	lck_mtx_lock(rnh_lock);
1119	entry = rtalloc1_locked(dst, report, ignflags);
1120	lck_mtx_unlock(rnh_lock);
1121	return entry;
1122	}
1123
1124	struct rtentry *
1125	rtalloc1_scoped(struct sockaddr dst, int* report, uint32_t ignflags,
1126	unsigned int ifscope)
1127	{
1128	rtentry_ref_t entry;
1129	LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_NOTOWNED);
1130	lck_mtx_lock(rnh_lock);
1131	entry = rtalloc1_scoped_locked(dst, report, ignflags, ifscope);
1132	lck_mtx_unlock(rnh_lock);
1133	return entry;
1134	}
1135
1136	/*
1137	* Remove a reference count from an rtentry.
1138	* If the count gets low enough, take it out of the routing table
1139	*/
1140	void
1141	rtfree_locked(struct rtentry *rt)
1142	{
1143	rtfree_common(rt, TRUE);
1144	}
1145
1146	static void
1147	rtfree_common(struct rtentry *rt, boolean_t locked)
1148	{
1149	struct radix_node_head *rnh;
1150
1151	LCK_MTX_ASSERT(rnh_lock, locked ?
1152	LCK_MTX_ASSERT_OWNED : LCK_MTX_ASSERT_NOTOWNED);
1153
1154	/*
1155	* Atomically decrement the reference count and if it reaches 0,
1156	* and there is a close function defined, call the close function.
1157	*/
1158	RT_LOCK_SPIN(rt);
1159	if (rtunref(rt) > `0`) {
1160	RT_UNLOCK(rt);
1161	return;
1162	}
1163
1164	/*
1165	* To avoid violating lock ordering, we must drop rt_lock before
1166	* trying to acquire the global rnh_lock. If we are called with
1167	* rnh_lock held, then we already have exclusive access; otherwise
1168	* we do the lock dance.
1169	*/
1170	if (!locked) {
1171	/*
1172	* Note that we check it again below after grabbing rnh_lock,
1173	* since it is possible that another thread doing a lookup wins
1174	* the race, grabs the rnh_lock first, and bumps up reference
1175	* count in which case the route should be left alone as it is
1176	* still in use. It's also possible that another thread frees
1177	* the route after we drop rt_lock; to prevent the route from
1178	* being freed, we hold an extra reference.
1179	*/
1180	RT_ADDREF_LOCKED(rt);
1181	RT_UNLOCK(rt);
1182	lck_mtx_lock(rnh_lock);
1183	RT_LOCK_SPIN(rt);
1184	if (rtunref(rt) > `0`) {
1185	/ We've lost the race, so abort /
1186	RT_UNLOCK(rt);
1187	goto done;
1188	}
1189	}
1190
1191	/*
1192	* We may be blocked on other lock(s) as part of freeing
1193	* the entry below, so convert from spin to full mutex.
1194	*/
1195	RT_CONVERT_LOCK(rt);
1196
1197	LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
1198
1199	/ Negative refcnt must never happen /
1200	if (rt->rt_refcnt != `0`) {
1201	panic("rt %p invalid refcnt %d", rt, rt->rt_refcnt);
1202	/ NOTREACHED /
1203	}
1204	/ Idle refcnt must have been dropped during rtunref() /
1205	VERIFY(!(rt->rt_flags & RTF_IFREF));
1206
1207	/*
1208	* find the tree for that address family
1209	* Note: in the case of igmp packets, there might not be an rnh
1210	*/
1211	rnh = rt_tables[rt_key(rt)->sa_family];
1212
1213	/*
1214	* On last reference give the "close method" a chance to cleanup
1215	* private state. This also permits (for IPv4 and IPv6) a chance
1216	* to decide if the routing table entry should be purged immediately
1217	* or at a later time. When an immediate purge is to happen the
1218	* close routine typically issues RTM_DELETE which clears the RTF_UP
1219	* flag on the entry so that the code below reclaims the storage.
1220	*/
1221	if (rnh != NULL && rnh->rnh_close != NULL) {
1222	rnh->rnh_close((struct radix_node *)rt, rnh);
1223	}
1224
1225	/*
1226	* If we are no longer "up" (and ref == 0) then we can free the
1227	* resources associated with the route.
1228	*/
1229	if (!(rt->rt_flags & RTF_UP)) {
1230	rtentry_ref_t rt_parent;
1231	struct ifaddr *rt_ifa;
1232
1233	rt->rt_flags \|= RTF_DEAD;
1234	if (rt->rt_nodes->rn_flags & (RNF_ACTIVE \| RNF_ROOT)) {
1235	panic("rt %p freed while in radix tree", rt);
1236	/ NOTREACHED /
1237	}
1238	/*
1239	* the rtentry must have been removed from the routing table
1240	* so it is represented in rttrash; remove that now.
1241	*/
1242	(void) OSDecrementAtomic(&rttrash);
1243	if (rte_debug & RTD_DEBUG) {
1244	TAILQ_REMOVE(&rttrash_head, (rtentry_dbg_ref_t)rt,
1245	rtd_trash_link);
1246	}
1247
1248	/*
1249	* release references on items we hold them on..
1250	* e.g other routes and ifaddrs.
1251	*/
1252	if ((rt_parent = rt->rt_parent) != NULL) {
1253	rt->rt_parent = NULL;
1254	}
1255
1256	if ((rt_ifa = rt->rt_ifa) != NULL) {
1257	rt->rt_ifa = NULL;
1258	}
1259
1260	/*
1261	* Now free any attached link-layer info.
1262	*/
1263	if (rt->rt_llinfo != NULL) {
1264	VERIFY(rt->rt_llinfo_free != NULL);
1265	(*rt->rt_llinfo_free)(rt->rt_llinfo);
1266	rt->rt_llinfo = NULL;
1267	}
1268
1269	/ Destroy eventhandler lists context /
1270	eventhandler_lists_ctxt_destroy(evthdlr_lists_ctxt: &rt->rt_evhdlr_ctxt);
1271
1272	/*
1273	* Route is no longer in the tree and refcnt is 0;
1274	* we have exclusive access, so destroy it.
1275	*/
1276	RT_UNLOCK(rt);
1277	rte_lock_destroy(rt);
1278
1279	if (rt_parent != NULL) {
1280	rtfree_locked(rt: rt_parent);
1281	}
1282
1283	if (rt_ifa != NULL) {
1284	ifa_remref(ifa: rt_ifa);
1285	}
1286
1287	/*
1288	* The key is separately alloc'd so free it (see rt_setgate()).
1289	* This also frees the gateway, as they are always malloc'd
1290	* together.
1291	*/
1292	rt_key_free(rt);
1293
1294	/*
1295	* Free any statistics that may have been allocated
1296	*/
1297	nstat_route_detach(rte: rt);
1298
1299	/*
1300	* and the rtentry itself of course
1301	*/
1302	rte_free(rt);
1303	} else {
1304	/*
1305	* The "close method" has been called, but the route is
1306	* still in the radix tree with zero refcnt, i.e. "up"
1307	* and in the cached state.
1308	*/
1309	RT_UNLOCK(rt);
1310	}
1311	done:
1312	if (!locked) {
1313	lck_mtx_unlock(rnh_lock);
1314	}
1315	}
1316
1317	void
1318	rtfree(struct rtentry *rt)
1319	{
1320	rtfree_common(rt, FALSE);
1321	}
1322
1323	/*
1324	* Decrements the refcount but does not free the route when
1325	* the refcount reaches zero. Unless you have really good reason,
1326	* use rtfree not rtunref.
1327	*/
1328	int
1329	rtunref(struct rtentry *p)
1330	{
1331	RT_LOCK_ASSERT_HELD(p);
1332
1333	if (p->rt_refcnt == `0`) {
1334	panic("%s(%p) bad refcnt", __func__, p);
1335	/ NOTREACHED /
1336	} else if (--p->rt_refcnt == `0`) {
1337	/*
1338	* Release any idle reference count held on the interface;
1339	* if the route is eligible, still UP and the refcnt becomes
1340	* non-zero at some point in future before it is purged from
1341	* the routing table, rt_set_idleref() will undo this.
1342	*/
1343	rt_clear_idleref(p);
1344	}
1345
1346	if (rte_debug & RTD_DEBUG) {
1347	rtunref_audit((rtentry_dbg_ref_t)p);
1348	}
1349
1350	/ Return new value /
1351	return p->rt_refcnt;
1352	}
1353
1354	static inline void
1355	rtunref_audit(struct rtentry_dbg *rte)
1356	{
1357	uint16_t idx;
1358
1359	if (rte->rtd_inuse != RTD_INUSE) {
1360	panic("rtunref: on freed rte=%p", rte);
1361	/ NOTREACHED /
1362	}
1363	idx = os_atomic_inc_orig(&rte->rtd_refrele_cnt, relaxed) % CTRACE_HIST_SIZE;
1364	if (rte_debug & RTD_TRACE) {
1365	ctrace_record(&rte->rtd_refrele[idx]);
1366	}
1367	}
1368
1369	/*
1370	* Add a reference count from an rtentry.
1371	*/
1372	void
1373	rtref(struct rtentry *p)
1374	{
1375	RT_LOCK_ASSERT_HELD(p);
1376
1377	VERIFY((p->rt_flags & RTF_DEAD) == `0`);
1378	if (++p->rt_refcnt == `0`) {
1379	panic("%s(%p) bad refcnt", __func__, p);
1380	/ NOTREACHED /
1381	} else if (p->rt_refcnt == `1`) {
1382	/*
1383	* Hold an idle reference count on the interface,
1384	* if the route is eligible for it.
1385	*/
1386	rt_set_idleref(p);
1387	}
1388
1389	if (rte_debug & RTD_DEBUG) {
1390	rtref_audit((rtentry_dbg_ref_t)p);
1391	}
1392	}
1393
1394	static inline void
1395	rtref_audit(struct rtentry_dbg *rte)
1396	{
1397	uint16_t idx;
1398
1399	if (rte->rtd_inuse != RTD_INUSE) {
1400	panic("rtref_audit: on freed rte=%p", rte);
1401	/ NOTREACHED /
1402	}
1403	idx = os_atomic_inc_orig(&rte->rtd_refhold_cnt, relaxed) % CTRACE_HIST_SIZE;
1404	if (rte_debug & RTD_TRACE) {
1405	ctrace_record(&rte->rtd_refhold[idx]);
1406	}
1407	}
1408
1409	void
1410	rtsetifa(struct rtentry rt, struct* ifaddr *ifa)
1411	{
1412	LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
1413
1414	RT_LOCK_ASSERT_HELD(rt);
1415
1416	if (rt->rt_ifa == ifa) {
1417	return;
1418	}
1419
1420	/ Become a regular mutex, just in case /
1421	RT_CONVERT_LOCK(rt);
1422
1423	/ Release the old ifa /
1424	if (rt->rt_ifa) {
1425	ifa_remref(ifa: rt->rt_ifa);
1426	}
1427
1428	/ Set rt_ifa /
1429	rt->rt_ifa = ifa;
1430
1431	/ Take a reference to the ifa /
1432	if (rt->rt_ifa) {
1433	ifa_addref(ifa: rt->rt_ifa);
1434	}
1435	}
1436
1437	/*
1438	* Force a routing table entry to the specified
1439	* destination to go through the given gateway.
1440	* Normally called as a result of a routing redirect
1441	* message from the network layer.
1442	*/
1443	void
1444	rtredirect(struct ifnet ifp, struct* sockaddr dst, struct* sockaddr *gateway,
1445	struct sockaddr netmask, int* flags, struct sockaddr *src,
1446	struct rtentry **rtp)
1447	{
1448	rtentry_ref_t rt = NULL;
1449	int error = `0`;
1450	short *stat = `0`;
1451	struct rt_addrinfo info;
1452	struct ifaddr *ifa = NULL;
1453	unsigned int ifscope = (ifp != NULL) ? ifp->if_index : IFSCOPE_NONE;
1454	struct sockaddr_storage ss;
1455	int af = src->sa_family;
1456
1457	LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_NOTOWNED);
1458	lck_mtx_lock(rnh_lock);
1459
1460	/*
1461	* Transform src into the internal routing table form for
1462	* comparison against rt_gateway below.
1463	*/
1464	if ((af == AF_INET) \|\| (af == AF_INET6)) {
1465	src = sa_copy(src, dst: &ss, pifscope: &ifscope);
1466	}
1467
1468	/*
1469	* Verify the gateway is directly reachable; if scoped routing
1470	* is enabled, verify that it is reachable from the interface
1471	* where the ICMP redirect arrived on.
1472	*/
1473	if ((ifa = ifa_ifwithnet_scoped(gateway, ifscope)) == NULL) {
1474	error = ENETUNREACH;
1475	goto out;
1476	}
1477
1478	/ Lookup route to the destination (from the original IP header) /
1479	rt = rtalloc1_scoped_locked(dst, report: `0`, RTF_CLONING \| RTF_PRCLONING, ifscope);
1480	if (rt != NULL) {
1481	RT_LOCK(rt);
1482	}
1483
1484	/*
1485	* If the redirect isn't from our current router for this dst,
1486	* it's either old or wrong. If it redirects us to ourselves,
1487	* we have a routing loop, perhaps as a result of an interface
1488	* going down recently. Holding rnh_lock here prevents the
1489	* possibility of rt_ifa/ifa's ifa_addr from changing (e.g.
1490	* in_ifinit), so okay to access ifa_addr without locking.
1491	*/
1492	if (!(flags & RTF_DONE) && rt != NULL &&
1493	(!sa_equal(src, rt->rt_gateway) \|\| !sa_equal(rt->rt_ifa->ifa_addr,
1494	ifa->ifa_addr))) {
1495	error = EINVAL;
1496	} else {
1497	ifa_remref(ifa);
1498	if ((ifa = ifa_ifwithaddr(gateway))) {
1499	ifa_remref(ifa);
1500	ifa = NULL;
1501	error = EHOSTUNREACH;
1502	}
1503	}
1504
1505	if (ifa) {
1506	ifa_remref(ifa);
1507	ifa = NULL;
1508	}
1509
1510	if (error) {
1511	if (rt != NULL) {
1512	RT_UNLOCK(rt);
1513	}
1514	goto done;
1515	}
1516
1517	/*
1518	* Create a new entry if we just got back a wildcard entry
1519	* or the the lookup failed. This is necessary for hosts
1520	* which use routing redirects generated by smart gateways
1521	* to dynamically build the routing tables.
1522	*/
1523	if ((rt == NULL) \|\| (rt_mask(rt) != NULL && rt_mask(rt)->sa_len < `2`)) {
1524	goto create;
1525	}
1526	/*
1527	* Don't listen to the redirect if it's
1528	* for a route to an interface.
1529	*/
1530	RT_LOCK_ASSERT_HELD(rt);
1531	if (rt->rt_flags & RTF_GATEWAY) {
1532	if (((rt->rt_flags & RTF_HOST) == `0`) && (flags & RTF_HOST)) {
1533	/*
1534	* Changing from route to net => route to host.
1535	* Create new route, rather than smashing route
1536	* to net; similar to cloned routes, the newly
1537	* created host route is scoped as well.
1538	*/
1539	create:
1540	if (rt != NULL) {
1541	RT_UNLOCK(rt);
1542	}
1543	flags \|= RTF_GATEWAY \| RTF_DYNAMIC;
1544	error = rtrequest_scoped_locked(RTM_ADD, dst,
1545	gateway, netmask, flags, NULL, ifscope);
1546	stat = &rtstat.rts_dynamic;
1547	} else {
1548	/*
1549	* Smash the current notion of the gateway to
1550	* this destination. Should check about netmask!!!
1551	*/
1552	rt->rt_flags \|= RTF_MODIFIED;
1553	flags \|= RTF_MODIFIED;
1554	stat = &rtstat.rts_newgateway;
1555	/*
1556	* add the key and gateway (in one malloc'd chunk).
1557	*/
1558	error = rt_setgate(rt, rt_key(rt), gateway);
1559	RT_UNLOCK(rt);
1560	}
1561	} else {
1562	RT_UNLOCK(rt);
1563	error = EHOSTUNREACH;
1564	}
1565	done:
1566	if (rt != NULL) {
1567	RT_LOCK_ASSERT_NOTHELD(rt);
1568	if (!error) {
1569	/ Enqueue event to refresh flow route entries /
1570	route_event_enqueue_nwk_wq_entry(rt, NULL, ROUTE_ENTRY_REFRESH, NULL, FALSE);
1571	if (rtp) {
1572	*rtp = rt;
1573	} else {
1574	rtfree_locked(rt);
1575	}
1576	} else {
1577	rtfree_locked(rt);
1578	}
1579	}
1580	out:
1581	if (error) {
1582	rtstat.rts_badredirect++;
1583	} else {
1584	if (stat != NULL) {
1585	(*stat)++;
1586	}
1587
1588	if (af == AF_INET) {
1589	routegenid_inet_update();
1590	} else if (af == AF_INET6) {
1591	routegenid_inet6_update();
1592	}
1593	}
1594	lck_mtx_unlock(rnh_lock);
1595	bzero(s: (caddr_t)&info, n: sizeof(info));
1596	info.rti_info[RTAX_DST] = dst;
1597	info.rti_info[RTAX_GATEWAY] = gateway;
1598	info.rti_info[RTAX_NETMASK] = netmask;
1599	info.rti_info[RTAX_AUTHOR] = src;
1600	rt_missmsg(RTM_REDIRECT, &info, flags, error);
1601	}
1602
1603	/*
1604	* Routing table ioctl interface.
1605	*/
1606	int
1607	rtioctl(unsigned long req, caddr_t data, struct proc *p)
1608	{
1609	#pragma unused(p, req, data)
1610	return ENXIO;
1611	}
1612
1613	struct ifaddr *
1614	ifa_ifwithroute(
1615	int flags,
1616	const struct sockaddr *dst,
1617	const struct sockaddr *gateway)
1618	{
1619	struct ifaddr *ifa;
1620
1621	lck_mtx_lock(rnh_lock);
1622	ifa = ifa_ifwithroute_locked(flags, dst, gateway);
1623	lck_mtx_unlock(rnh_lock);
1624
1625	return ifa;
1626	}
1627
1628	struct ifaddr *
1629	ifa_ifwithroute_locked(int flags, const struct sockaddr *dst,
1630	const struct sockaddr *gateway)
1631	{
1632	return ifa_ifwithroute_common_locked((flags & ~RTF_IFSCOPE), dst,
1633	gateway, IFSCOPE_NONE);
1634	}
1635
1636	struct ifaddr *
1637	ifa_ifwithroute_scoped_locked(int flags, const struct sockaddr *dst,
1638	const struct sockaddr gateway, unsigned* int ifscope)
1639	{
1640	if (ifscope != IFSCOPE_NONE) {
1641	flags \|= RTF_IFSCOPE;
1642	} else {
1643	flags &= ~RTF_IFSCOPE;
1644	}
1645
1646	return ifa_ifwithroute_common_locked(flags, dst, gateway, ifscope);
1647	}
1648
1649	static struct ifaddr *
1650	ifa_ifwithroute_common_locked(int flags, const struct sockaddr *dst,
1651	const struct sockaddr gw, unsigned* int ifscope)
1652	{
1653	struct ifaddr *ifa = NULL;
1654	rtentry_ref_t rt = NULL;
1655	struct sockaddr_storage dst_ss, gw_ss;
1656
1657	if (!in6_embedded_scope) {
1658	const struct sockaddr_in6 *dst_addr = SIN6(dst);
1659	if (dst->sa_family == AF_INET6 &&
1660	IN6_IS_SCOPE_EMBED(&dst_addr->sin6_addr) &&
1661	ifscope == IFSCOPE_NONE) {
1662	ifscope = dst_addr->sin6_scope_id;
1663	VERIFY(ifscope != IFSCOPE_NONE);
1664	}
1665
1666	const struct sockaddr_in6 *gw_addr = SIN6(gw);
1667	if (dst->sa_family == AF_INET6 &&
1668	IN6_IS_SCOPE_EMBED(&gw_addr->sin6_addr) &&
1669	ifscope == IFSCOPE_NONE) {
1670	ifscope = gw_addr->sin6_scope_id;
1671	VERIFY(ifscope != IFSCOPE_NONE);
1672	}
1673
1674	if (ifscope != IFSCOPE_NONE) {
1675	flags \|= RTF_IFSCOPE;
1676	} else {
1677	flags &= ~RTF_IFSCOPE;
1678	}
1679	}
1680
1681	LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
1682
1683	/*
1684	* Just in case the sockaddr passed in by the caller
1685	* contains a scope ID, make sure to clear it since
1686	* interface addresses aren't scoped.
1687	*/
1688	if (dst != NULL &&
1689	((dst->sa_family == AF_INET) \|\|
1690	(dst->sa_family == AF_INET6))) {
1691	dst = sa_copy(__DECONST_SA(dst), dst: &dst_ss, IN6_NULL_IF_EMBEDDED_SCOPE(&ifscope));
1692	}
1693
1694	if (gw != NULL &&
1695	((gw->sa_family == AF_INET) \|\|
1696	(gw->sa_family == AF_INET6))) {
1697	gw = sa_copy(__DECONST_SA(gw), dst: &gw_ss, IN6_NULL_IF_EMBEDDED_SCOPE(&ifscope));
1698	}
1699
1700	if (!(flags & RTF_GATEWAY)) {
1701	/*
1702	* If we are adding a route to an interface,
1703	* and the interface is a pt to pt link
1704	* we should search for the destination
1705	* as our clue to the interface. Otherwise
1706	* we can use the local address.
1707	*/
1708	if (flags & RTF_HOST) {
1709	ifa = ifa_ifwithdstaddr(dst);
1710	}
1711	if (ifa == NULL) {
1712	ifa = ifa_ifwithaddr_scoped(gw, ifscope);
1713	}
1714	} else {
1715	/*
1716	* If we are adding a route to a remote net
1717	* or host, the gateway may still be on the
1718	* other end of a pt to pt link.
1719	*/
1720	if ((flags & RTF_IFSCOPE) != `0` && ifscope != IFSCOPE_NONE) {
1721	ifa = ifa_ifwithdstaddr_scoped(gw, ifscope);
1722	}
1723	if (ifa == NULL) {
1724	ifa = ifa_ifwithdstaddr(gw);
1725	}
1726	}
1727	if (ifa == NULL) {
1728	ifa = ifa_ifwithnet_scoped(gw, ifscope);
1729	}
1730	if (ifa == NULL) {
1731	/ Workaround to avoid gcc warning regarding const variable /
1732	rt = rtalloc1_scoped_locked(__DECONST_SA(dst),
1733	report: `0`, ignflags: `0`, ifscope);
1734	if (rt != NULL) {
1735	RT_LOCK_SPIN(rt);
1736	ifa = rt->rt_ifa;
1737	if (ifa != NULL) {
1738	/ Become a regular mutex /
1739	RT_CONVERT_LOCK(rt);
1740	ifa_addref(ifa);
1741	}
1742	RT_REMREF_LOCKED(rt);
1743	RT_UNLOCK(rt);
1744	rt = NULL;
1745	}
1746	}
1747	/*
1748	* Holding rnh_lock here prevents the possibility of ifa from
1749	* changing (e.g. in_ifinit), so it is safe to access its
1750	* ifa_addr (here and down below) without locking.
1751	*/
1752	if (ifa != NULL && ifa->ifa_addr->sa_family != dst->sa_family) {
1753	struct ifaddr *newifa;
1754	/ Callee adds reference to newifa upon success /
1755	newifa = ifaof_ifpforaddr(dst, ifa->ifa_ifp);
1756	if (newifa != NULL) {
1757	ifa_remref(ifa);
1758	ifa = newifa;
1759	}
1760	}
1761	/*
1762	* If we are adding a gateway, it is quite possible that the
1763	* routing table has a static entry in place for the gateway,
1764	* that may not agree with info garnered from the interfaces.
1765	* The routing table should carry more precedence than the
1766	* interfaces in this matter. Must be careful not to stomp
1767	* on new entries from rtinit, hence (ifa->ifa_addr != gw).
1768	*/
1769	if ((ifa == NULL \|\| (gw != NULL &&
1770	!sa_equal(ifa->ifa_addr, __DECONST_SA(gw)))) &&
1771	(rt = rtalloc1_scoped_locked(__DECONST_SA(gw),
1772	report: `0`, ignflags: `0`, ifscope)) != NULL) {
1773	if (ifa != NULL) {
1774	ifa_remref(ifa);
1775	}
1776	RT_LOCK_SPIN(rt);
1777	ifa = rt->rt_ifa;
1778	if (ifa != NULL) {
1779	/ Become a regular mutex /
1780	RT_CONVERT_LOCK(rt);
1781	ifa_addref(ifa);
1782	}
1783	RT_REMREF_LOCKED(rt);
1784	RT_UNLOCK(rt);
1785	}
1786	/*
1787	* If an interface scope was specified, the interface index of
1788	* the found ifaddr must be equivalent to that of the scope;
1789	* otherwise there is no match.
1790	*/
1791	if ((flags & RTF_IFSCOPE) &&
1792	ifa != NULL && ifa->ifa_ifp->if_index != ifscope) {
1793	ifa_remref(ifa);
1794	ifa = NULL;
1795	}
1796
1797	/*
1798	* ifa's address family must match destination's address family
1799	* after all is said and done.
1800	*/
1801	if (ifa != NULL &&
1802	ifa->ifa_addr->sa_family != dst->sa_family) {
1803	ifa_remref(ifa);
1804	ifa = NULL;
1805	}
1806
1807	return ifa;
1808	}
1809
1810	static int rt_fixdelete(struct radix_node , void* *);
1811	static int rt_fixchange(struct radix_node , void* *);
1812
1813	struct rtfc_arg {
1814	struct rtentry *rt0;
1815	struct radix_node_head *rnh;
1816	};
1817
1818	int
1819	rtrequest_locked(int req, struct sockaddr dst, struct* sockaddr *gateway,
1820	struct sockaddr netmask, int* flags, struct rtentry **ret_nrt)
1821	{
1822	return rtrequest_common_locked(req, dst, gateway, netmask,
1823	(flags & ~RTF_IFSCOPE), ret_nrt, IFSCOPE_NONE);
1824	}
1825
1826	int
1827	rtrequest_scoped_locked(int req, struct sockaddr *dst,
1828	struct sockaddr gateway, struct* sockaddr netmask, int* flags,
1829	struct rtentry *ret_nrt, unsigned* int ifscope)
1830	{
1831	if (ifscope != IFSCOPE_NONE) {
1832	flags \|= RTF_IFSCOPE;
1833	} else {
1834	flags &= ~RTF_IFSCOPE;
1835	}
1836
1837	return rtrequest_common_locked(req, dst, gateway, netmask,
1838	flags, ret_nrt, ifscope);
1839	}
1840
1841	/*
1842	* Do appropriate manipulations of a routing tree given all the bits of
1843	* info needed.
1844	*
1845	* Storing the scope ID in the radix key is an internal job that should be
1846	* left to routines in this module. Callers should specify the scope value
1847	* to the "scoped" variants of route routines instead of manipulating the
1848	* key itself. This is typically done when creating a scoped route, e.g.
1849	* rtrequest(RTM_ADD). Once such a route is created and marked with the
1850	* RTF_IFSCOPE flag, callers can simply use its rt_key(rt) to clone it
1851	* (RTM_RESOLVE) or to remove it (RTM_DELETE). An exception to this is
1852	* during certain routing socket operations where the search key might be
1853	* derived from the routing message itself, in which case the caller must
1854	* specify the destination address and scope value for RTM_ADD/RTM_DELETE.
1855	*/
1856	static int
1857	rtrequest_common_locked(int req, struct sockaddr *dst0,
1858	struct sockaddr gateway, struct* sockaddr netmask, int* flags,
1859	struct rtentry *ret_nrt, unsigned* int ifscope)
1860	{
1861	int error = `0`;
1862	rtentry_ref_t rt;
1863	struct radix_node *rn;
1864	struct radix_node_head *rnh;
1865	struct ifaddr *ifa = NULL;
1866	struct sockaddr ndst, dst = dst0;
1867	struct sockaddr_storage ss, mask;
1868	struct timeval caltime;
1869	int af = dst->sa_family;
1870	void (ifa_rtrequest)(int, struct* rtentry , struct* sockaddr *);
1871
1872	#define senderr(x) { error = x; goto bad; }
1873
1874	DTRACE_ROUTE6(rtrequest, int, req, struct sockaddr *, dst0,
1875	struct sockaddr , gateway, struct* sockaddr *, netmask,
1876	int, flags, unsigned int, ifscope);
1877
1878	LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
1879
1880	#if !(DEVELOPMENT \|\| DEBUG)
1881	/*
1882	* Setting the global internet flag external is only for testing
1883	*/
1884	flags &= ~RTF_GLOBAL;
1885	#endif /* !(DEVELOPMENT \|\| DEBUG) */
1886
1887	/*
1888	* Find the correct routing tree to use for this Address Family
1889	*/
1890	if ((rnh = rt_tables[af]) == NULL) {
1891	senderr(ESRCH);
1892	}
1893	/*
1894	* If we are adding a host route then we don't want to put
1895	* a netmask in the tree
1896	*/
1897	if (flags & RTF_HOST) {
1898	netmask = NULL;
1899	}
1900
1901	/*
1902	* If Scoped Routing is enabled, use a local copy of the destination
1903	* address to store the scope ID into. This logic is repeated below
1904	* in the RTM_RESOLVE handler since the caller does not normally
1905	* specify such a flag during a resolve, as well as for the handling
1906	* of IPv4 link-local address; instead, it passes in the route used for
1907	* cloning for which the scope info is derived from. Note also that
1908	* in the case of RTM_DELETE, the address passed in by the caller
1909	* might already contain the scope ID info when it is the key itself,
1910	* thus making RTF_IFSCOPE unnecessary; one instance where it is
1911	* explicitly set is inside route_output() as part of handling a
1912	* routing socket request.
1913	*/
1914	if (req != RTM_RESOLVE && ((af == AF_INET) \|\| (af == AF_INET6))) {
1915	/ Transform dst into the internal routing table form /
1916	dst = sa_copy(src: dst, dst: &ss, pifscope: &ifscope);
1917
1918	/ Transform netmask into the internal routing table form /
1919	if (netmask != NULL) {
1920	netmask = ma_copy(af, src: netmask, dst: &mask, ifscope);
1921	}
1922
1923	if (ifscope != IFSCOPE_NONE) {
1924	flags \|= RTF_IFSCOPE;
1925	}
1926	} else if ((flags & RTF_IFSCOPE) &&
1927	(af != AF_INET && af != AF_INET6)) {
1928	senderr(EINVAL);
1929	}
1930
1931	if (ifscope == IFSCOPE_NONE) {
1932	flags &= ~RTF_IFSCOPE;
1933	}
1934
1935	if (!in6_embedded_scope) {
1936	if (af == AF_INET6 &&
1937	IN6_IS_SCOPE_EMBED(&SIN6(dst)->sin6_addr) &&
1938	SIN6(dst)->sin6_scope_id == IFSCOPE_NONE) {
1939	SIN6(dst)->sin6_scope_id = ifscope;
1940	if (in6_embedded_scope_debug) {
1941	VERIFY(SIN6(dst)->sin6_scope_id != IFSCOPE_NONE);
1942	}
1943	}
1944
1945	if (af == AF_INET6 &&
1946	IN6_IS_SCOPE_EMBED(&SIN6(dst)->sin6_addr) &&
1947	ifscope == IFSCOPE_NONE) {
1948	ifscope = SIN6(dst)->sin6_scope_id;
1949	flags \|= RTF_IFSCOPE;
1950	if (in6_embedded_scope_debug) {
1951	VERIFY(ifscope!= IFSCOPE_NONE);
1952	}
1953	}
1954	}
1955
1956	switch (req) {
1957	case RTM_DELETE: {
1958	rtentry_ref_t gwrt = NULL;
1959	boolean_t was_router = FALSE;
1960	uint32_t old_rt_refcnt = `0`;
1961	/*
1962	* Remove the item from the tree and return it.
1963	* Complain if it is not there and do no more processing.
1964	*/
1965	if ((rn = rnh->rnh_deladdr(dst, netmask, rnh)) == NULL) {
1966	senderr(ESRCH);
1967	}
1968	if (rn->rn_flags & (RNF_ACTIVE \| RNF_ROOT)) {
1969	panic("rtrequest delete");
1970	/ NOTREACHED /
1971	}
1972	rt = RT(rn);
1973
1974	RT_LOCK(rt);
1975	old_rt_refcnt = rt->rt_refcnt;
1976	rt->rt_flags &= ~RTF_UP;
1977	/*
1978	* Release any idle reference count held on the interface
1979	* as this route is no longer externally visible.
1980	*/
1981	rt_clear_idleref(rt);
1982	/*
1983	* Take an extra reference to handle the deletion of a route
1984	* entry whose reference count is already 0; e.g. an expiring
1985	* cloned route entry or an entry that was added to the table
1986	* with 0 reference. If the caller is interested in this route,
1987	* we will return it with the reference intact. Otherwise we
1988	* will decrement the reference via rtfree_locked() and then
1989	* possibly deallocate it.
1990	*/
1991	RT_ADDREF_LOCKED(rt);
1992
1993	/*
1994	* For consistency, in case the caller didn't set the flag.
1995	*/
1996	rt->rt_flags \|= RTF_CONDEMNED;
1997
1998	/*
1999	* Clear RTF_ROUTER if it's set.
2000	*/
2001	if (rt->rt_flags & RTF_ROUTER) {
2002	was_router = TRUE;
2003	VERIFY(rt->rt_flags & RTF_HOST);
2004	rt->rt_flags &= ~RTF_ROUTER;
2005	}
2006
2007	/*
2008	* Enqueue work item to invoke callback for this route entry
2009	*
2010	* If the old count is 0, it implies that last reference is being
2011	* removed and there's no one listening for this route event.
2012	*/
2013	if (old_rt_refcnt != `0`) {
2014	route_event_enqueue_nwk_wq_entry(rt, NULL,
2015	ROUTE_ENTRY_DELETED, NULL, TRUE);
2016	}
2017
2018	/*
2019	* Now search what's left of the subtree for any cloned
2020	* routes which might have been formed from this node.
2021	*/
2022	if ((rt->rt_flags & (RTF_CLONING \| RTF_PRCLONING)) &&
2023	rt_mask(rt)) {
2024	RT_UNLOCK(rt);
2025	rnh->rnh_walktree_from(rnh, dst, rt_mask(rt),
2026	rt_fixdelete, rt);
2027	RT_LOCK(rt);
2028	}
2029
2030	if (was_router) {
2031	struct route_event rt_ev;
2032	route_event_init(p_route_ev: &rt_ev, rt, NULL, route_ev_code: ROUTE_LLENTRY_DELETED);
2033	RT_UNLOCK(rt);
2034	(void) rnh->rnh_walktree(rnh,
2035	route_event_walktree, (void *)&rt_ev);
2036	RT_LOCK(rt);
2037	}
2038
2039	/*
2040	* Remove any external references we may have.
2041	*/
2042	if ((gwrt = rt->rt_gwroute) != NULL) {
2043	rt->rt_gwroute = NULL;
2044	}
2045
2046	/*
2047	* give the protocol a chance to keep things in sync.
2048	*/
2049	if ((ifa = rt->rt_ifa) != NULL) {
2050	IFA_LOCK_SPIN(ifa);
2051	ifa_rtrequest = ifa->ifa_rtrequest;
2052	IFA_UNLOCK(ifa);
2053	if (ifa_rtrequest != NULL) {
2054	ifa_rtrequest(RTM_DELETE, rt, NULL);
2055	}
2056	/ keep reference on rt_ifa /
2057	ifa = NULL;
2058	}
2059
2060	/*
2061	* one more rtentry floating around that is not
2062	* linked to the routing table.
2063	*/
2064	(void) OSIncrementAtomic(&rttrash);
2065	if (rte_debug & RTD_DEBUG) {
2066	TAILQ_INSERT_TAIL(&rttrash_head,
2067	(rtentry_dbg_ref_t)rt, rtd_trash_link);
2068	}
2069
2070	/*
2071	* If this is the (non-scoped) default route, clear
2072	* the interface index used for the primary ifscope.
2073	*/
2074	if (rt_primary_default(rt, rt_key(rt))) {
2075	set_primary_ifscope(rt_key(rt)->sa_family,
2076	IFSCOPE_NONE);
2077	if ((rt->rt_flags & RTF_STATIC) &&
2078	rt_key(rt)->sa_family == PF_INET6) {
2079	trigger_v6_defrtr_select = TRUE;
2080	}
2081	}
2082
2083	#if NECP
2084	/*
2085	* If this is a change in a default route, update
2086	* necp client watchers to re-evaluate
2087	*/
2088	if (SA_DEFAULT(rt_key(rt))) {
2089	if (rt->rt_ifp != NULL) {
2090	ifnet_touch_lastupdown(interface: rt->rt_ifp);
2091	}
2092	necp_update_all_clients();
2093	}
2094	#endif /* NECP */
2095
2096	RT_UNLOCK(rt);
2097
2098	/*
2099	* This might result in another rtentry being freed if
2100	* we held its last reference. Do this after the rtentry
2101	* lock is dropped above, as it could lead to the same
2102	* lock being acquired if gwrt is a clone of rt.
2103	*/
2104	if (gwrt != NULL) {
2105	rtfree_locked(rt: gwrt);
2106	}
2107
2108	/*
2109	* If the caller wants it, then it can have it,
2110	* but it's up to it to free the rtentry as we won't be
2111	* doing it.
2112	*/
2113	if (ret_nrt != NULL) {
2114	/ Return the route to caller with reference intact /
2115	*ret_nrt = rt;
2116	} else {
2117	/ Dereference or deallocate the route /
2118	rtfree_locked(rt);
2119	}
2120	if (af == AF_INET) {
2121	routegenid_inet_update();
2122	} else if (af == AF_INET6) {
2123	routegenid_inet6_update();
2124	}
2125	break;
2126	}
2127	case RTM_RESOLVE:
2128	if (ret_nrt == NULL \|\| (rt = *ret_nrt) == NULL) {
2129	senderr(EINVAL);
2130	}
2131	/*
2132	* According to the UNIX conformance tests, we need to return
2133	* ENETUNREACH when the parent route is RTF_REJECT.
2134	* However, there isn't any point in cloning RTF_REJECT
2135	* routes, so we immediately return an error.
2136	*/
2137	if (rt->rt_flags & RTF_REJECT) {
2138	if (rt->rt_flags & RTF_HOST) {
2139	senderr(EHOSTUNREACH);
2140	} else {
2141	senderr(ENETUNREACH);
2142	}
2143	}
2144	/*
2145	* If cloning, we have the parent route given by the caller
2146	* and will use its rt_gateway, rt_rmx as part of the cloning
2147	* process below. Since rnh_lock is held at this point, the
2148	* parent's rt_ifa and rt_gateway will not change, and its
2149	* relevant rt_flags will not change as well. The only thing
2150	* that could change are the metrics, and thus we hold the
2151	* parent route's rt_lock later on during the actual copying
2152	* of rt_rmx.
2153	*/
2154	ifa = rt->rt_ifa;
2155	ifa_addref(ifa);
2156	flags = rt->rt_flags &
2157	~(RTF_CLONING \| RTF_PRCLONING \| RTF_STATIC);
2158	flags \|= RTF_WASCLONED;
2159	gateway = rt->rt_gateway;
2160	if ((netmask = rt->rt_genmask) == NULL) {
2161	flags \|= RTF_HOST;
2162	}
2163
2164	if (af != AF_INET && af != AF_INET6) {
2165	goto makeroute;
2166	}
2167
2168	/*
2169	* When scoped routing is enabled, cloned entries are
2170	* always scoped according to the interface portion of
2171	* the parent route. The exception to this are IPv4
2172	* link local addresses, or those routes that are cloned
2173	* from a RTF_PROXY route. For the latter, the clone
2174	* gets to keep the RTF_PROXY flag.
2175	*/
2176	if ((af == AF_INET &&
2177	IN_LINKLOCAL(ntohl(SIN(dst)->sin_addr.s_addr))) \|\|
2178	(rt->rt_flags & RTF_PROXY)) {
2179	ifscope = IFSCOPE_NONE;
2180	flags &= ~RTF_IFSCOPE;
2181	/*
2182	* These types of cloned routes aren't currently
2183	* eligible for idle interface reference counting.
2184	*/
2185	flags \|= RTF_NOIFREF;
2186	} else {
2187	if (flags & RTF_IFSCOPE) {
2188	ifscope = (af == AF_INET) ?
2189	sin_get_ifscope(rt_key(rt)) :
2190	sin6_get_ifscope(rt_key(rt));
2191	} else {
2192	ifscope = rt->rt_ifp->if_index;
2193	flags \|= RTF_IFSCOPE;
2194	}
2195	VERIFY(ifscope != IFSCOPE_NONE);
2196	}
2197
2198	/*
2199	* Transform dst into the internal routing table form,
2200	* clearing out the scope ID field if ifscope isn't set.
2201	*/
2202	dst = sa_copy(src: dst, dst: &ss, pifscope: (ifscope == IFSCOPE_NONE) ?
2203	NULL : &ifscope);
2204
2205	/ Transform netmask into the internal routing table form /
2206	if (netmask != NULL) {
2207	netmask = ma_copy(af, src: netmask, dst: &mask, ifscope);
2208	}
2209
2210	goto makeroute;
2211
2212	case RTM_ADD:
2213	if ((flags & RTF_GATEWAY) && !gateway) {
2214	panic("rtrequest: RTF_GATEWAY but no gateway");
2215	/ NOTREACHED /
2216	}
2217	if (flags & RTF_IFSCOPE) {
2218	ifa = ifa_ifwithroute_scoped_locked(flags, dst: dst0,
2219	gateway, ifscope);
2220	} else {
2221	ifa = ifa_ifwithroute_locked(flags, dst: dst0, gateway);
2222	}
2223	if (ifa == NULL) {
2224	senderr(ENETUNREACH);
2225	}
2226	makeroute:
2227	/*
2228	* We land up here for both RTM_RESOLVE and RTM_ADD
2229	* when we decide to create a route.
2230	*/
2231	if ((rt = rte_alloc()) == NULL) {
2232	senderr(ENOBUFS);
2233	}
2234	Bzero(rt, sizeof(*rt));
2235	rte_lock_init(rt);
2236	eventhandler_lists_ctxt_init(evthdlr_lists_ctxt: &rt->rt_evhdlr_ctxt);
2237	getmicrotime(&caltime);
2238	rt->base_calendartime = caltime.tv_sec;
2239	rt->base_uptime = net_uptime();
2240	RT_LOCK(rt);
2241	rt->rt_flags = RTF_UP \| flags;
2242
2243	/*
2244	* Point the generation ID to the tree's.
2245	*/
2246	switch (af) {
2247	case AF_INET:
2248	rt->rt_tree_genid = &route_genid_inet;
2249	break;
2250	case AF_INET6:
2251	rt->rt_tree_genid = &route_genid_inet6;
2252	break;
2253	default:
2254	break;
2255	}
2256
2257	/*
2258	* Add the gateway. Possibly re-malloc-ing the storage for it
2259	* also add the rt_gwroute if possible.
2260	*/
2261	if ((error = rt_setgate(rt, dst, gateway)) != `0`) {
2262	int tmp = error;
2263	RT_UNLOCK(rt);
2264	nstat_route_detach(rte: rt);
2265	rte_lock_destroy(rt);
2266	rte_free(rt);
2267	senderr(tmp);
2268	}
2269
2270	/*
2271	* point to the (possibly newly malloc'd) dest address.
2272	*/
2273	ndst = rt_key(rt);
2274
2275	/*
2276	* make sure it contains the value we want (masked if needed).
2277	*/
2278	if (netmask) {
2279	rt_maskedcopy(dst, ndst, netmask);
2280	} else {
2281	SOCKADDR_COPY(dst, ndst, dst->sa_len);
2282	}
2283
2284	/*
2285	* Note that we now have a reference to the ifa.
2286	* This moved from below so that rnh->rnh_addaddr() can
2287	* examine the ifa and ifa->ifa_ifp if it so desires.
2288	*/
2289	rtsetifa(rt, ifa);
2290	rt->rt_ifp = rt->rt_ifa->ifa_ifp;
2291
2292	/ XXX mtu manipulation will be done in rnh_addaddr -- itojun /
2293
2294	rn = rnh->rnh_addaddr((caddr_t)ndst, (caddr_t)netmask,
2295	rnh, rt->rt_nodes);
2296	if (rn == `0`) {
2297	rtentry_ref_t rt2;
2298	/*
2299	* Uh-oh, we already have one of these in the tree.
2300	* We do a special hack: if the route that's already
2301	* there was generated by the protocol-cloning
2302	* mechanism, then we just blow it away and retry
2303	* the insertion of the new one.
2304	*/
2305	if (flags & RTF_IFSCOPE) {
2306	rt2 = rtalloc1_scoped_locked(dst: dst0, report: `0`,
2307	RTF_CLONING \| RTF_PRCLONING, ifscope);
2308	} else {
2309	rt2 = rtalloc1_locked(dst, report: `0`,
2310	RTF_CLONING \| RTF_PRCLONING);
2311	}
2312	if (rt2 && rt2->rt_parent) {
2313	/*
2314	* rnh_lock is held here, so rt_key and
2315	* rt_gateway of rt2 will not change.
2316	*/
2317	(void) rtrequest_locked(RTM_DELETE, rt_key(rt2),
2318	gateway: rt2->rt_gateway, rt_mask(rt2),
2319	flags: rt2->rt_flags, ret_nrt: `0`);
2320	rtfree_locked(rt: rt2);
2321	rn = rnh->rnh_addaddr((caddr_t)ndst,
2322	(caddr_t)netmask, rnh, rt->rt_nodes);
2323	} else if (rt2) {
2324	/ undo the extra ref we got /
2325	rtfree_locked(rt: rt2);
2326	}
2327	}
2328
2329	/*
2330	* If it still failed to go into the tree,
2331	* then un-make it (this should be a function)
2332	*/
2333	if (rn == NULL) {
2334	char dbuf[MAX_IPv6_STR_LEN], gbuf[MAX_IPv6_STR_LEN];
2335
2336	rt_str(rt, dbuf, sizeof(dbuf), gbuf, sizeof(gbuf));
2337	os_log_error(OS_LOG_DEFAULT, "%s: route already exists: "
2338	"%s->%s->%s",
2339	__func__, dbuf, gbuf,
2340	((rt->rt_ifp != NULL) ?
2341	rt->rt_ifp->if_xname : ""));
2342
2343	/ Clear gateway route /
2344	rt_set_gwroute(rt, rt_key(rt), NULL);
2345	if (rt->rt_ifa) {
2346	ifa_remref(ifa: rt->rt_ifa);
2347	rt->rt_ifa = NULL;
2348	}
2349	rt_key_free(rt);
2350	RT_UNLOCK(rt);
2351	nstat_route_detach(rte: rt);
2352	rte_lock_destroy(rt);
2353	rte_free(rt);
2354	senderr(EEXIST);
2355	}
2356
2357	rt->rt_parent = NULL;
2358
2359	/*
2360	* If we got here from RESOLVE, then we are cloning so clone
2361	* the rest, and note that we are a clone (and increment the
2362	* parent's references). rnh_lock is still held, which prevents
2363	* a lookup from returning the newly-created route. Hence
2364	* holding and releasing the parent's rt_lock while still
2365	* holding the route's rt_lock is safe since the new route
2366	* is not yet externally visible.
2367	*/
2368	if (req == RTM_RESOLVE) {
2369	RT_LOCK_SPIN(*ret_nrt);
2370	VERIFY((*ret_nrt)->rt_expire == `0` \|\|
2371	(*ret_nrt)->rt_rmx.rmx_expire != `0`);
2372	VERIFY((*ret_nrt)->rt_expire != `0` \|\|
2373	(*ret_nrt)->rt_rmx.rmx_expire == `0`);
2374	rt->rt_rmx = (*ret_nrt)->rt_rmx;
2375	rt_setexpire(rt, (*ret_nrt)->rt_expire);
2376	if ((*ret_nrt)->rt_flags &
2377	(RTF_CLONING \| RTF_PRCLONING)) {
2378	rt->rt_parent = (*ret_nrt);
2379	RT_ADDREF_LOCKED(*ret_nrt);
2380	}
2381	RT_UNLOCK(*ret_nrt);
2382	}
2383
2384	/*
2385	* if this protocol has something to add to this then
2386	* allow it to do that as well.
2387	*/
2388	IFA_LOCK_SPIN(ifa);
2389	ifa_rtrequest = ifa->ifa_rtrequest;
2390	IFA_UNLOCK(ifa);
2391	if (ifa_rtrequest != NULL) {
2392	/*
2393	* Can not use SA(ret_nrt ? *ret_nrt : NULL),
2394	* because *ret_nrt is not a sockadr.
2395	*/
2396	ifa_rtrequest(req, rt,
2397	__unsafe_forge_single(struct sockaddr, ret_nrt ? ret_nrt : NULL));
2398	}
2399	ifa_remref(ifa);
2400	ifa = NULL;
2401
2402	/*
2403	* If this is the (non-scoped) default route, record
2404	* the interface index used for the primary ifscope.
2405	*/
2406	if (rt_primary_default(rt, rt_key(rt))) {
2407	set_primary_ifscope(rt_key(rt)->sa_family,
2408	ifscope: rt->rt_ifp->if_index);
2409	}
2410
2411	#if NECP
2412	/*
2413	* If this is a change in a default route, update
2414	* necp client watchers to re-evaluate
2415	*/
2416	if (SA_DEFAULT(rt_key(rt))) {
2417	/*
2418	* Mark default routes as (potentially) leading to the global internet
2419	* this can be used for policy decisions.
2420	* The clone routes will inherit this flag.
2421	* We check against the host flag as this works for default routes that have
2422	* a gateway and defaults routes when all subnets are local.
2423	*/
2424	if (req == RTM_ADD && (rt->rt_flags & RTF_HOST) == `0`) {
2425	rt->rt_flags \|= RTF_GLOBAL;
2426	}
2427	if (rt->rt_ifp != NULL) {
2428	ifnet_touch_lastupdown(interface: rt->rt_ifp);
2429	}
2430	necp_update_all_clients();
2431	}
2432	#endif /* NECP */
2433
2434	/*
2435	* actually return a resultant rtentry and
2436	* give the caller a single reference.
2437	*/
2438	if (ret_nrt) {
2439	*ret_nrt = rt;
2440	RT_ADDREF_LOCKED(rt);
2441	}
2442
2443	if (af == AF_INET) {
2444	routegenid_inet_update();
2445	} else if (af == AF_INET6) {
2446	routegenid_inet6_update();
2447	}
2448
2449	RT_GENID_SYNC(rt);
2450
2451	/*
2452	* We repeat the same procedures from rt_setgate() here
2453	* because they weren't completed when we called it earlier,
2454	* since the node was embryonic.
2455	*/
2456	if ((rt->rt_flags & RTF_GATEWAY) && rt->rt_gwroute != NULL) {
2457	rt_set_gwroute(rt, rt_key(rt), rt->rt_gwroute);
2458	}
2459
2460	if (req == RTM_ADD &&
2461	!(rt->rt_flags & RTF_HOST) && rt_mask(rt) != NULL) {
2462	struct rtfc_arg arg;
2463	arg.rnh = rnh;
2464	arg.rt0 = rt;
2465	RT_UNLOCK(rt);
2466	rnh->rnh_walktree_from(rnh, rt_key(rt), rt_mask(rt),
2467	rt_fixchange, &arg);
2468	} else {
2469	RT_UNLOCK(rt);
2470	}
2471
2472	nstat_route_new_entry(rt);
2473	break;
2474	}
2475	bad:
2476	if (ifa) {
2477	ifa_remref(ifa);
2478	}
2479	return error;
2480	}
2481	#undef senderr
2482
2483	int
2484	rtrequest(int req, struct sockaddr dst, struct* sockaddr *gateway,
2485	struct sockaddr netmask, int* flags, struct rtentry **ret_nrt)
2486	{
2487	int error;
2488	LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_NOTOWNED);
2489	lck_mtx_lock(rnh_lock);
2490	error = rtrequest_locked(req, dst, gateway, netmask, flags, ret_nrt);
2491	lck_mtx_unlock(rnh_lock);
2492	return error;
2493	}
2494
2495	int
2496	rtrequest_scoped(int req, struct sockaddr dst, struct* sockaddr *gateway,
2497	struct sockaddr netmask, int* flags, struct rtentry **ret_nrt,
2498	unsigned int ifscope)
2499	{
2500	int error;
2501	LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_NOTOWNED);
2502	lck_mtx_lock(rnh_lock);
2503	error = rtrequest_scoped_locked(req, dst, gateway, netmask, flags,
2504	ret_nrt, ifscope);
2505	lck_mtx_unlock(rnh_lock);
2506	return error;
2507	}
2508
2509	/*
2510	* Called from rtrequest(RTM_DELETE, ...) to fix up the route's ``family''
2511	* (i.e., the routes related to it by the operation of cloning). This
2512	* routine is iterated over all potential former-child-routes by way of
2513	* rnh->rnh_walktree_from() above, and those that actually are children of
2514	* the late parent (passed in as VP here) are themselves deleted.
2515	*/
2516	static int
2517	rt_fixdelete(struct radix_node rn, void* *vp)
2518	{
2519	rtentry_ref_t rt = (rtentry_ref_t)rn;
2520	rtentry_ref_t rt0 = (rtentry_ref_t)vp;
2521
2522	LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
2523
2524	RT_LOCK(rt);
2525	if (rt->rt_parent == rt0 &&
2526	!(rt->rt_flags & (RTF_CLONING \| RTF_PRCLONING))) {
2527	/*
2528	* Safe to drop rt_lock and use rt_key, since holding
2529	* rnh_lock here prevents another thread from calling
2530	* rt_setgate() on this route.
2531	*/
2532	RT_UNLOCK(rt);
2533	return rtrequest_locked(RTM_DELETE, rt_key(rt), NULL,
2534	rt_mask(rt), flags: rt->rt_flags, NULL);
2535	}
2536	RT_UNLOCK(rt);
2537	return `0`;
2538	}
2539
2540	/*
2541	* This routine is called from rt_setgate() to do the analogous thing for
2542	* adds and changes. There is the added complication in this case of a
2543	* middle insert; i.e., insertion of a new network route between an older
2544	* network route and (cloned) host routes. For this reason, a simple check
2545	* of rt->rt_parent is insufficient; each candidate route must be tested
2546	* against the (mask, value) of the new route (passed as before in vp)
2547	* to see if the new route matches it.
2548	*
2549	* XXX - it may be possible to do fixdelete() for changes and reserve this
2550	* routine just for adds. I'm not sure why I thought it was necessary to do
2551	* changes this way.
2552	*/
2553	static int
2554	rt_fixchange(struct radix_node rn, void* *vp)
2555	{
2556	rtentry_ref_t rt = (rtentry_ref_t)rn;
2557	struct rtfc_arg *ap = vp;
2558	rtentry_ref_t rt0 = ap->rt0;
2559	struct radix_node_head *rnh = ap->rnh;
2560	u_char xk1, xm1, xk2, xmp;
2561	int i, len;
2562
2563	LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
2564
2565	RT_LOCK(rt);
2566
2567	if (!rt->rt_parent \|\|
2568	(rt->rt_flags & (RTF_CLONING \| RTF_PRCLONING))) {
2569	RT_UNLOCK(rt);
2570	return `0`;
2571	}
2572
2573	if (rt->rt_parent == rt0) {
2574	goto delete_rt;
2575	}
2576
2577	/*
2578	* There probably is a function somewhere which does this...
2579	* if not, there should be.
2580	*/
2581	len = imin(rt_key(rt0)->sa_len, rt_key(rt)->sa_len);
2582
2583	xk1 = (u_char *)rt_key(rt0);
2584	xm1 = (u_char *)rt_mask(rt0);
2585	xk2 = (u_char *)rt_key(rt);
2586
2587	/*
2588	* Avoid applying a less specific route; do this only if the parent
2589	* route (rt->rt_parent) is a network route, since otherwise its mask
2590	* will be NULL if it is a cloning host route.
2591	*/
2592	if ((xmp = (u_char *)rt_mask(rt->rt_parent)) != NULL) {
2593	int mlen = rt_mask(rt->rt_parent)->sa_len;
2594	if (mlen > rt_mask(rt0)->sa_len) {
2595	RT_UNLOCK(rt);
2596	return `0`;
2597	}
2598
2599	for (i = rnh->rnh_treetop->rn_offset; i < mlen; i++) {
2600	if ((xmp[i] & ~(xmp[i] ^ xm1[i])) != xmp[i]) {
2601	RT_UNLOCK(rt);
2602	return `0`;
2603	}
2604	}
2605	}
2606
2607	for (i = rnh->rnh_treetop->rn_offset; i < len; i++) {
2608	if ((xk2[i] & xm1[i]) != xk1[i]) {
2609	RT_UNLOCK(rt);
2610	return `0`;
2611	}
2612	}
2613
2614	/*
2615	* OK, this node is a clone, and matches the node currently being
2616	* changed/added under the node's mask. So, get rid of it.
2617	*/
2618	delete_rt:
2619	/*
2620	* Safe to drop rt_lock and use rt_key, since holding rnh_lock here
2621	* prevents another thread from calling rt_setgate() on this route.
2622	*/
2623	RT_UNLOCK(rt);
2624	return rtrequest_locked(RTM_DELETE, rt_key(rt), NULL,
2625	rt_mask(rt), flags: rt->rt_flags, NULL);
2626	}
2627
2628	/*
2629	* Round up sockaddr len to multiples of 32-bytes. This will reduce
2630	* or even eliminate the need to re-allocate the chunk of memory used
2631	* for rt_key and rt_gateway in the event the gateway portion changes.
2632	* Certain code paths (e.g. IPsec) are notorious for caching the address
2633	* of rt_gateway; this rounding-up would help ensure that the gateway
2634	* portion never gets deallocated (though it may change contents) and
2635	* thus greatly simplifies things.
2636	*/
2637	#define SA_SIZE(x) (-(-((uintptr_t)(x)) & -(32)))
2638
2639	/*
2640	* Sets the gateway and/or gateway route portion of a route; may be
2641	* called on an existing route to modify the gateway portion. Both
2642	* rt_key and rt_gateway are allocated out of the same memory chunk.
2643	* Route entry lock must be held by caller; this routine will return
2644	* with the lock held.
2645	*/
2646	int
2647	rt_setgate(struct rtentry rt, struct* sockaddr dst, struct* sockaddr *gate)
2648	{
2649	int dlen = (int)SA_SIZE(dst->sa_len), glen = (int)SA_SIZE(gate->sa_len);
2650	struct radix_node_head *rnh = NULL;
2651	boolean_t loop = FALSE;
2652
2653	if (dst->sa_family != AF_INET && dst->sa_family != AF_INET6) {
2654	return EINVAL;
2655	}
2656
2657	rnh = rt_tables[dst->sa_family];
2658	LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
2659	RT_LOCK_ASSERT_HELD(rt);
2660
2661	/*
2662	* If this is for a route that is on its way of being removed,
2663	* or is temporarily frozen, reject the modification request.
2664	*/
2665	if (rt->rt_flags & RTF_CONDEMNED) {
2666	return EBUSY;
2667	}
2668
2669	/ Add an extra ref for ourselves /
2670	RT_ADDREF_LOCKED(rt);
2671
2672	if (rt->rt_flags & RTF_GATEWAY) {
2673	if ((dst->sa_len == gate->sa_len) &&
2674	(dst->sa_family == AF_INET \|\| dst->sa_family == AF_INET6)) {
2675	struct sockaddr_storage dst_ss, gate_ss;
2676
2677	(void) sa_copy(src: dst, dst: &dst_ss, NULL);
2678	(void) sa_copy(src: gate, dst: &gate_ss, NULL);
2679
2680	loop = sa_equal(SA(&dst_ss), SA(&gate_ss));
2681	} else {
2682	loop = (dst->sa_len == gate->sa_len &&
2683	sa_equal(dst, gate));
2684	}
2685	}
2686
2687	/*
2688	* A (cloning) network route with the destination equal to the gateway
2689	* will create an endless loop (see notes below), so disallow it.
2690	*/
2691	if (((rt->rt_flags & (RTF_HOST \| RTF_GATEWAY \| RTF_LLINFO)) ==
2692	RTF_GATEWAY) && loop) {
2693	/ Release extra ref /
2694	RT_REMREF_LOCKED(rt);
2695	return EADDRNOTAVAIL;
2696	}
2697
2698	/*
2699	* A host route with the destination equal to the gateway
2700	* will interfere with keeping LLINFO in the routing
2701	* table, so disallow it.
2702	*/
2703	if (((rt->rt_flags & (RTF_HOST \| RTF_GATEWAY \| RTF_LLINFO)) ==
2704	(RTF_HOST \| RTF_GATEWAY)) && loop) {
2705	/*
2706	* The route might already exist if this is an RTM_CHANGE
2707	* or a routing redirect, so try to delete it.
2708	*/
2709	if (rt_key(rt) != NULL) {
2710	/*
2711	* Safe to drop rt_lock and use rt_key, rt_gateway,
2712	* since holding rnh_lock here prevents another thread
2713	* from calling rt_setgate() on this route.
2714	*/
2715	RT_UNLOCK(rt);
2716	(void) rtrequest_locked(RTM_DELETE, rt_key(rt),
2717	gateway: rt->rt_gateway, rt_mask(rt), flags: rt->rt_flags, NULL);
2718	RT_LOCK(rt);
2719	}
2720	/ Release extra ref /
2721	RT_REMREF_LOCKED(rt);
2722	return EADDRNOTAVAIL;
2723	}
2724
2725	/*
2726	* The destination is not directly reachable. Get a route
2727	* to the next-hop gateway and store it in rt_gwroute.
2728	*/
2729	if (rt->rt_flags & RTF_GATEWAY) {
2730	rtentry_ref_t gwrt;
2731	unsigned int ifscope;
2732
2733	if (dst->sa_family == AF_INET) {
2734	ifscope = sin_get_ifscope(sa: dst);
2735	} else if (dst->sa_family == AF_INET6) {
2736	ifscope = sin6_get_ifscope(sa: dst);
2737	} else {
2738	ifscope = IFSCOPE_NONE;
2739	}
2740
2741	RT_UNLOCK(rt);
2742	/*
2743	* Don't ignore RTF_CLONING, since we prefer that rt_gwroute
2744	* points to a clone rather than a cloning route; see above
2745	* check for cloning loop avoidance (dst == gate).
2746	*/
2747	gwrt = rtalloc1_scoped_locked(dst: gate, report: `1`, RTF_PRCLONING, ifscope);
2748	if (gwrt != NULL) {
2749	RT_LOCK_ASSERT_NOTHELD(gwrt);
2750	}
2751	RT_LOCK(rt);
2752
2753	/*
2754	* Cloning loop avoidance:
2755	*
2756	* In the presence of protocol-cloning and bad configuration,
2757	* it is possible to get stuck in bottomless mutual recursion
2758	* (rtrequest rt_setgate rtalloc1). We avoid this by not
2759	* allowing protocol-cloning to operate for gateways (which
2760	* is probably the correct choice anyway), and avoid the
2761	* resulting reference loops by disallowing any route to run
2762	* through itself as a gateway. This is obviously mandatory
2763	* when we get rt->rt_output(). It implies that a route to
2764	* the gateway must already be present in the system in order
2765	* for the gateway to be referred to by another route.
2766	*/
2767	if (gwrt == rt) {
2768	RT_REMREF_LOCKED(gwrt);
2769	/ Release extra ref /
2770	RT_REMREF_LOCKED(rt);
2771	return EADDRINUSE; / failure /
2772	}
2773
2774	/*
2775	* If scoped, the gateway route must use the same interface;
2776	* we're holding rnh_lock now, so rt_gateway and rt_ifp of gwrt
2777	* should not change and are freely accessible.
2778	*/
2779	if (ifscope != IFSCOPE_NONE && (rt->rt_flags & RTF_IFSCOPE) &&
2780	gwrt != NULL && gwrt->rt_ifp != NULL &&
2781	gwrt->rt_ifp->if_index != ifscope) {
2782	rtfree_locked(rt: gwrt); / rt != gwrt, no deadlock /
2783	/ Release extra ref /
2784	RT_REMREF_LOCKED(rt);
2785	return (rt->rt_flags & RTF_HOST) ?
2786	EHOSTUNREACH : ENETUNREACH;
2787	}
2788
2789	/ Check again since we dropped the lock above /
2790	if (rt->rt_flags & RTF_CONDEMNED) {
2791	if (gwrt != NULL) {
2792	rtfree_locked(rt: gwrt);
2793	}
2794	/ Release extra ref /
2795	RT_REMREF_LOCKED(rt);
2796	return EBUSY;
2797	}
2798
2799	/ Set gateway route; callee adds ref to gwrt if non-NULL /
2800	rt_set_gwroute(rt, dst, gwrt);
2801
2802	/*
2803	* In case the (non-scoped) default route gets modified via
2804	* an ICMP redirect, record the interface index used for the
2805	* primary ifscope. Also done in rt_setif() to take care
2806	* of the non-redirect cases.
2807	*/
2808	if (rt_primary_default(rt, dst) && rt->rt_ifp != NULL) {
2809	set_primary_ifscope(af: dst->sa_family,
2810	ifscope: rt->rt_ifp->if_index);
2811	}
2812
2813	#if NECP
2814	/*
2815	* If this is a change in a default route, update
2816	* necp client watchers to re-evaluate
2817	*/
2818	if (SA_DEFAULT(dst)) {
2819	necp_update_all_clients();
2820	}
2821	#endif /* NECP */
2822
2823	/*
2824	* Tell the kernel debugger about the new default gateway
2825	* if the gateway route uses the primary interface, or
2826	* if we are in a transient state before the non-scoped
2827	* default gateway is installed (similar to how the system
2828	* was behaving in the past). In future, it would be good
2829	* to do all this only when KDP is enabled.
2830	*/
2831	if ((dst->sa_family == AF_INET) &&
2832	gwrt != NULL && gwrt->rt_gateway->sa_family == AF_LINK &&
2833	(gwrt->rt_ifp->if_index == get_primary_ifscope(AF_INET) \|\|
2834	get_primary_ifscope(AF_INET) == IFSCOPE_NONE)) {
2835	kdp_set_gateway_mac(SDL(gwrt->rt_gateway)->
2836	sdl_data);
2837	}
2838
2839	/ Release extra ref from rtalloc1() /
2840	if (gwrt != NULL) {
2841	RT_REMREF(gwrt);
2842	}
2843	}
2844
2845	/*
2846	* Prepare to store the gateway in rt_gateway. Both dst and gateway
2847	* are stored one after the other in the same malloc'd chunk. If we
2848	* have room, reuse the old buffer since rt_gateway already points
2849	* to the right place. Otherwise, malloc a new block and update
2850	* the 'dst' address and point rt_gateway to the right place.
2851	*/
2852	if (rt->rt_gateway == NULL \|\| glen > SA_SIZE(rt->rt_gateway->sa_len)) {
2853	caddr_t new;
2854
2855	/ The underlying allocation is done with M_WAITOK set /
2856	new = kalloc_data(dlen + glen, Z_WAITOK \| Z_ZERO);
2857	if (new == NULL) {
2858	/ Clear gateway route /
2859	rt_set_gwroute(rt, dst, NULL);
2860	/ Release extra ref /
2861	RT_REMREF_LOCKED(rt);
2862	return ENOBUFS;
2863	}
2864
2865	/*
2866	* Copy from 'dst' and not rt_key(rt) because we can get
2867	* here to initialize a newly allocated route entry, in
2868	* which case rt_key(rt) is NULL (and so does rt_gateway).
2869	*/
2870	SOCKADDR_COPY(dst, new, dst->sa_len);
2871	rt_key_free(rt); / free old block; NULL is okay /
2872	rt->rt_nodes->rn_key = new;
2873	rt->rt_gateway = SA(new + dlen);
2874	}
2875
2876	/*
2877	* Copy the new gateway value into the memory chunk.
2878	*/
2879	SOCKADDR_COPY(gate, rt->rt_gateway, gate->sa_len);
2880
2881	/*
2882	* For consistency between rt_gateway and rt_key(gwrt).
2883	*/
2884	if ((rt->rt_flags & RTF_GATEWAY) && rt->rt_gwroute != NULL &&
2885	(rt->rt_gwroute->rt_flags & RTF_IFSCOPE)) {
2886	if (rt->rt_gateway->sa_family == AF_INET &&
2887	rt_key(rt->rt_gwroute)->sa_family == AF_INET) {
2888	sin_set_ifscope(sa: rt->rt_gateway,
2889	ifscope: sin_get_ifscope(rt_key(rt->rt_gwroute)));
2890	} else if (rt->rt_gateway->sa_family == AF_INET6 &&
2891	rt_key(rt->rt_gwroute)->sa_family == AF_INET6) {
2892	sin6_set_ifscope(sa: rt->rt_gateway,
2893	ifscope: sin6_get_ifscope(rt_key(rt->rt_gwroute)));
2894	}
2895	}
2896
2897	/*
2898	* This isn't going to do anything useful for host routes, so
2899	* don't bother. Also make sure we have a reasonable mask
2900	* (we don't yet have one during adds).
2901	*/
2902	if (!(rt->rt_flags & RTF_HOST) && rt_mask(rt) != `0`) {
2903	struct rtfc_arg arg;
2904	arg.rnh = rnh;
2905	arg.rt0 = rt;
2906	RT_UNLOCK(rt);
2907	rnh->rnh_walktree_from(rnh, rt_key(rt), rt_mask(rt),
2908	rt_fixchange, &arg);
2909	RT_LOCK(rt);
2910	}
2911
2912	/ Release extra ref /
2913	RT_REMREF_LOCKED(rt);
2914	return `0`;
2915	}
2916
2917	#undef SA_SIZE
2918
2919	void
2920	rt_set_gwroute(struct rtentry rt, struct* sockaddr dst, struct* rtentry *gwrt)
2921	{
2922	boolean_t gwrt_isrouter;
2923
2924	LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
2925	RT_LOCK_ASSERT_HELD(rt);
2926
2927	if (gwrt != NULL) {
2928	RT_ADDREF(gwrt); / for this routine /
2929	}
2930	/*
2931	* Get rid of existing gateway route; if rt_gwroute is already
2932	* set to gwrt, this is slightly redundant (though safe since
2933	* we held an extra ref above) but makes the code simpler.
2934	*/
2935	if (rt->rt_gwroute != NULL) {
2936	rtentry_ref_t ogwrt = rt->rt_gwroute;
2937
2938	VERIFY(rt != ogwrt); / sanity check /
2939	rt->rt_gwroute = NULL;
2940	RT_UNLOCK(rt);
2941	rtfree_locked(rt: ogwrt);
2942	RT_LOCK(rt);
2943	VERIFY(rt->rt_gwroute == NULL);
2944	}
2945
2946	/*
2947	* And associate the new gateway route.
2948	*/
2949	if ((rt->rt_gwroute = gwrt) != NULL) {
2950	RT_ADDREF(gwrt); / for rt /
2951
2952	if (rt->rt_flags & RTF_WASCLONED) {
2953	/ rt_parent might be NULL if rt is embryonic /
2954	gwrt_isrouter = (rt->rt_parent != NULL &&
2955	SA_DEFAULT(rt_key(rt->rt_parent)) &&
2956	!RT_HOST(rt->rt_parent));
2957	} else {
2958	gwrt_isrouter = (SA_DEFAULT(dst) && !RT_HOST(rt));
2959	}
2960
2961	/ If gwrt points to a default router, mark it accordingly /
2962	if (gwrt_isrouter && RT_HOST(gwrt) &&
2963	!(gwrt->rt_flags & RTF_ROUTER)) {
2964	RT_LOCK(gwrt);
2965	gwrt->rt_flags \|= RTF_ROUTER;
2966	RT_UNLOCK(gwrt);
2967	}
2968
2969	RT_REMREF(gwrt); / for this routine /
2970	}
2971	}
2972
2973	static void
2974	rt_maskedcopy(const struct sockaddr src, struct* sockaddr *dst,
2975	const struct sockaddr *netmask)
2976	{
2977	const char *netmaskp = &netmask->sa_data[`0`];
2978	const char *srcp = &src->sa_data[`0`];
2979	char *dstp = &dst->sa_data[`0`];
2980	const char maskend = (char* *)dst
2981	+ MIN(netmask->sa_len, src->sa_len);
2982	const char srcend = (char* *)dst + src->sa_len;
2983
2984	dst->sa_len = src->sa_len;
2985	dst->sa_family = src->sa_family;
2986
2987	while (dstp < maskend) {
2988	dstp++ = srcp++ & *netmaskp++;
2989	}
2990	if (dstp < srcend) {
2991	memset(s: dstp, c: `0`, n: (size_t)(srcend - dstp));
2992	}
2993	}
2994
2995	/*
2996	* Lookup an AF_INET/AF_INET6 scoped or non-scoped route depending on the
2997	* ifscope value passed in by the caller (IFSCOPE_NONE implies non-scoped).
2998	*/
2999	static struct radix_node *
3000	node_lookup(struct sockaddr dst, struct* sockaddr *netmask,
3001	unsigned int ifscope)
3002	{
3003	struct radix_node_head *rnh;
3004	struct radix_node *rn;
3005	struct sockaddr_storage ss, mask;
3006	int af = dst->sa_family;
3007	struct matchleaf_arg ma = { .ifscope = ifscope };
3008	rn_matchf_t *f = rn_match_ifscope;
3009	void *w = &ma;
3010
3011	if (af != AF_INET && af != AF_INET6) {
3012	return NULL;
3013	}
3014
3015	rnh = rt_tables[af];
3016
3017	/*
3018	* Transform dst into the internal routing table form,
3019	* clearing out the scope ID field if ifscope isn't set.
3020	*/
3021	dst = sa_copy(src: dst, dst: &ss, pifscope: (ifscope == IFSCOPE_NONE) ? NULL : &ifscope);
3022
3023	/ Transform netmask into the internal routing table form /
3024	if (netmask != NULL) {
3025	netmask = ma_copy(af, src: netmask, dst: &mask, ifscope);
3026	}
3027
3028	if (ifscope == IFSCOPE_NONE) {
3029	f = w = NULL;
3030	}
3031
3032	rn = rnh->rnh_lookup_args(dst, netmask, rnh, f, w);
3033	if (rn != NULL && (rn->rn_flags & RNF_ROOT)) {
3034	rn = NULL;
3035	}
3036
3037	return rn;
3038	}
3039
3040	/*
3041	* Lookup the AF_INET/AF_INET6 non-scoped default route.
3042	*/
3043	static struct radix_node *
3044	node_lookup_default(int af)
3045	{
3046	struct radix_node_head *rnh;
3047
3048	VERIFY(af == AF_INET \|\| af == AF_INET6);
3049	rnh = rt_tables[af];
3050
3051	return af == AF_INET ? rnh->rnh_lookup(&sin_def, NULL, rnh) :
3052	rnh->rnh_lookup(&sin6_def, NULL, rnh);
3053	}
3054
3055	boolean_t
3056	rt_ifa_is_dst(struct sockaddr dst, struct* ifaddr *ifa)
3057	{
3058	boolean_t result = FALSE;
3059
3060	if (ifa == NULL \|\| ifa->ifa_addr == NULL) {
3061	return result;
3062	}
3063
3064	IFA_LOCK_SPIN(ifa);
3065
3066	if (dst->sa_family == ifa->ifa_addr->sa_family &&
3067	((dst->sa_family == AF_INET &&
3068	SIN(dst)->sin_addr.s_addr ==
3069	SIN(ifa->ifa_addr)->sin_addr.s_addr) \|\|
3070	(dst->sa_family == AF_INET6 &&
3071	SA6_ARE_ADDR_EQUAL(SIN6(dst), SIN6(ifa->ifa_addr))))) {
3072	result = TRUE;
3073	}
3074
3075	IFA_UNLOCK(ifa);
3076
3077	return result;
3078	}
3079
3080	/*
3081	* Common routine to lookup/match a route. It invokes the lookup/matchaddr
3082	* callback which could be address family-specific. The main difference
3083	* between the two (at least for AF_INET/AF_INET6) is that a lookup does
3084	* not alter the expiring state of a route, whereas a match would unexpire
3085	* or revalidate the route.
3086	*
3087	* The optional scope or interface index property of a route allows for a
3088	* per-interface route instance. This permits multiple route entries having
3089	* the same destination (but not necessarily the same gateway) to exist in
3090	* the routing table; each of these entries is specific to the corresponding
3091	* interface. This is made possible by storing the scope ID value into the
3092	* radix key, thus making each route entry unique. These scoped entries
3093	* exist along with the regular, non-scoped entries in the same radix tree
3094	* for a given address family (AF_INET/AF_INET6); the scope logically
3095	* partitions it into multiple per-interface sub-trees.
3096	*
3097	* When a scoped route lookup is performed, the routing table is searched for
3098	* the best match that would result in a route using the same interface as the
3099	* one associated with the scope (the exception to this are routes that point
3100	* to the loopback interface). The search rule follows the longest matching
3101	* prefix with the additional interface constraint.
3102	*/
3103	static struct rtentry *
3104	rt_lookup_common(boolean_t lookup_only, boolean_t coarse, struct sockaddr *dst,
3105	struct sockaddr netmask, struct* radix_node_head rnh, unsigned* int ifscope)
3106	{
3107	struct radix_node rn0, rn = NULL;
3108	int af = dst->sa_family;
3109	struct sockaddr_storage dst_ss;
3110	struct sockaddr_storage mask_ss;
3111	boolean_t dontcare;
3112	#if (DEVELOPMENT \|\| DEBUG)
3113	char dbuf[MAX_SCOPE_ADDR_STR_LEN], gbuf[MAX_IPv6_STR_LEN];
3114	char s_dst[MAX_IPv6_STR_LEN], s_netmask[MAX_IPv6_STR_LEN];
3115	#endif
3116	VERIFY(!coarse \|\| ifscope == IFSCOPE_NONE);
3117
3118	LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
3119	/*
3120	* While we have rnh_lock held, see if we need to schedule the timer.
3121	*/
3122	if (nd6_sched_timeout_want) {
3123	nd6_sched_timeout(NULL, NULL);
3124	}
3125
3126	if (!lookup_only) {
3127	netmask = NULL;
3128	}
3129
3130	/*
3131	* Non-scoped route lookup.
3132	*/
3133	if (af != AF_INET && af != AF_INET6) {
3134	rn = rnh->rnh_matchaddr(dst, rnh);
3135
3136	/*
3137	* Don't return a root node; also, rnh_matchaddr callback
3138	* would have done the necessary work to clear RTPRF_OURS
3139	* for certain protocol families.
3140	*/
3141	if (rn != NULL && (rn->rn_flags & RNF_ROOT)) {
3142	rn = NULL;
3143	}
3144	if (rn != NULL) {
3145	RT_LOCK_SPIN(RT(rn));
3146	if (!(RT(rn)->rt_flags & RTF_CONDEMNED)) {
3147	RT_ADDREF_LOCKED(RT(rn));
3148	RT_UNLOCK(RT(rn));
3149	} else {
3150	RT_UNLOCK(RT(rn));
3151	rn = NULL;
3152	}
3153	}
3154	return RT(rn);
3155	}
3156
3157	/ Transform dst/netmask into the internal routing table form /
3158	dst = sa_copy(src: dst, dst: &dst_ss, pifscope: &ifscope);
3159	if (netmask != NULL) {
3160	netmask = ma_copy(af, src: netmask, dst: &mask_ss, ifscope);
3161	}
3162	dontcare = (ifscope == IFSCOPE_NONE);
3163
3164	#if (DEVELOPMENT \|\| DEBUG)
3165	if (rt_verbose > `2`) {
3166	if (af == AF_INET) {
3167	(void) inet_ntop(af, &SIN(dst)->sin_addr.s_addr,
3168	s_dst, sizeof(s_dst));
3169	} else {
3170	(void) inet_ntop(af, &SIN6(dst)->sin6_addr,
3171	s_dst, sizeof(s_dst));
3172	}
3173
3174	if (netmask != NULL && af == AF_INET) {
3175	(void) inet_ntop(af, &SIN(netmask)->sin_addr.s_addr,
3176	s_netmask, sizeof(s_netmask));
3177	}
3178	if (netmask != NULL && af == AF_INET6) {
3179	(void) inet_ntop(af, &SIN6(netmask)->sin6_addr,
3180	s_netmask, sizeof(s_netmask));
3181	} else {
3182	*s_netmask = `'\0'`;
3183	}
3184	os_log(OS_LOG_DEFAULT, "%s:%d (%d, %d, %s, %s, %u)\n",
3185	__func__, __LINE__, lookup_only, coarse, s_dst, s_netmask, ifscope);
3186	}
3187	#endif
3188
3189	/*
3190	* Scoped route lookup:
3191	*
3192	* We first perform a non-scoped lookup for the original result.
3193	* Afterwards, depending on whether or not the caller has specified
3194	* a scope, we perform a more specific scoped search and fallback
3195	* to this original result upon failure.
3196	*/
3197	rn0 = rn = node_lookup(dst, netmask, IFSCOPE_NONE);
3198
3199	/*
3200	* If the caller did not specify a scope, use the primary scope
3201	* derived from the system's non-scoped default route. If, for
3202	* any reason, there is no primary interface, ifscope will be
3203	* set to IFSCOPE_NONE; if the above lookup resulted in a route,
3204	* we'll do a more-specific search below, scoped to the interface
3205	* of that route.
3206	*/
3207	if (dontcare) {
3208	ifscope = get_primary_ifscope(af);
3209	}
3210
3211	/*
3212	* Keep the original result if either of the following is true:
3213	*
3214	* 1) The interface portion of the route has the same interface
3215	* index as the scope value and it is marked with RTF_IFSCOPE.
3216	* 2) The route uses the loopback interface, in which case the
3217	* destination (host/net) is local/loopback.
3218	*
3219	* Otherwise, do a more specified search using the scope;
3220	* we're holding rnh_lock now, so rt_ifp should not change.
3221	*/
3222	if (rn != NULL) {
3223	rtentry_ref_t rt = RT(rn);
3224	#if (DEVELOPMENT \|\| DEBUG)
3225	if (rt_verbose > `2`) {
3226	rt_str(rt, dbuf, sizeof(dbuf), gbuf, sizeof(gbuf));
3227	os_log(OS_LOG_DEFAULT, "%s unscoped search %p to %s->%s->%s ifa_ifp %s\n",
3228	__func__, rt,
3229	dbuf, gbuf,
3230	(rt->rt_ifp != NULL) ? rt->rt_ifp->if_xname : "",
3231	(rt->rt_ifa->ifa_ifp != NULL) ?
3232	rt->rt_ifa->ifa_ifp->if_xname : "");
3233	}
3234	#endif
3235	if (!(rt->rt_ifp->if_flags & IFF_LOOPBACK) \|\|
3236	(rt->rt_flags & RTF_GATEWAY)) {
3237	if (rt->rt_ifp->if_index != ifscope) {
3238	/*
3239	* Wrong interface; keep the original result
3240	* only if the caller did not specify a scope,
3241	* and do a more specific scoped search using
3242	* the scope of the found route. Otherwise,
3243	* start again from scratch.
3244	*
3245	* For loopback scope we keep the unscoped
3246	* route for local addresses
3247	*/
3248	rn = NULL;
3249	if (dontcare) {
3250	ifscope = rt->rt_ifp->if_index;
3251	} else if (ifscope != lo_ifp->if_index \|\|
3252	rt_ifa_is_dst(dst, ifa: rt->rt_ifa) == FALSE) {
3253	rn0 = NULL;
3254	}
3255	} else if (!(rt->rt_flags & RTF_IFSCOPE)) {
3256	/*
3257	* Right interface, except that this route
3258	* isn't marked with RTF_IFSCOPE. Do a more
3259	* specific scoped search. Keep the original
3260	* result and return it it in case the scoped
3261	* search fails.
3262	*/
3263	rn = NULL;
3264	}
3265	}
3266	}
3267
3268	/*
3269	* Scoped search. Find the most specific entry having the same
3270	* interface scope as the one requested. The following will result
3271	* in searching for the longest prefix scoped match.
3272	*/
3273	if (rn == NULL) {
3274	rn = node_lookup(dst, netmask, ifscope);
3275	#if (DEVELOPMENT \|\| DEBUG)
3276	if (rt_verbose > `2` && rn != NULL) {
3277	rtentry_ref_t rt = RT(rn);
3278	rt_str(rt, dbuf, sizeof(dbuf), gbuf, sizeof(gbuf));
3279	os_log(OS_LOG_DEFAULT, "%s scoped search %p to %s->%s->%s ifa %s\n",
3280	__func__, rt,
3281	dbuf, gbuf,
3282	(rt->rt_ifp != NULL) ? rt->rt_ifp->if_xname : "",
3283	(rt->rt_ifa->ifa_ifp != NULL) ?
3284	rt->rt_ifa->ifa_ifp->if_xname : "");
3285	}
3286	#endif
3287	}
3288	/*
3289	* Use the original result if either of the following is true:
3290	*
3291	* 1) The scoped search did not yield any result.
3292	* 2) The caller insists on performing a coarse-grained lookup.
3293	* 3) The result from the scoped search is a scoped default route,
3294	* and the original (non-scoped) result is not a default route,
3295	* i.e. the original result is a more specific host/net route.
3296	* 4) The scoped search yielded a net route but the original
3297	* result is a host route, i.e. the original result is treated
3298	* as a more specific route.
3299	*/
3300	if (rn == NULL \|\| coarse \|\| (rn0 != NULL &&
3301	((SA_DEFAULT(rt_key(RT(rn))) && !SA_DEFAULT(rt_key(RT(rn0)))) \|\|
3302	(!RT_HOST(rn) && RT_HOST(rn0))))) {
3303	rn = rn0;
3304	}
3305
3306	/*
3307	* If we still don't have a route, use the non-scoped default
3308	* route as long as the interface portion satistifes the scope.
3309	*/
3310	if (rn == NULL && (rn = node_lookup_default(af)) != NULL &&
3311	RT(rn)->rt_ifp->if_index != ifscope) {
3312	rn = NULL;
3313	}
3314
3315	if (rn != NULL) {
3316	/*
3317	* Manually clear RTPRF_OURS using rt_validate() and
3318	* bump up the reference count after, and not before;
3319	* we only get here for AF_INET/AF_INET6. node_lookup()
3320	* has done the check against RNF_ROOT, so we can be sure
3321	* that we're not returning a root node here.
3322	*/
3323	RT_LOCK_SPIN(RT(rn));
3324	if (rt_validate(RT(rn))) {
3325	RT_ADDREF_LOCKED(RT(rn));
3326	RT_UNLOCK(RT(rn));
3327	} else {
3328	RT_UNLOCK(RT(rn));
3329	rn = NULL;
3330	}
3331	}
3332	#if (DEVELOPMENT \|\| DEBUG)
3333	if (rt_verbose > `2`) {
3334	if (rn == NULL) {
3335	os_log(OS_LOG_DEFAULT, "%s %u return NULL\n", __func__, ifscope);
3336	} else {
3337	rtentry_ref_t rt = RT(rn);
3338
3339	rt_str(rt, dbuf, sizeof(dbuf), gbuf, sizeof(gbuf));
3340
3341	os_log(OS_LOG_DEFAULT, "%s %u return %p to %s->%s->%s ifa_ifp %s\n",
3342	__func__, ifscope, rt,
3343	dbuf, gbuf,
3344	(rt->rt_ifp != NULL) ? rt->rt_ifp->if_xname : "",
3345	(rt->rt_ifa->ifa_ifp != NULL) ?
3346	rt->rt_ifa->ifa_ifp->if_xname : "");
3347	}
3348	}
3349	#endif
3350	return RT(rn);
3351	}
3352
3353	struct rtentry *
3354	rt_lookup(boolean_t lookup_only, struct sockaddr dst, struct* sockaddr *netmask,
3355	struct radix_node_head rnh, unsigned* int ifscope)
3356	{
3357	return rt_lookup_common(lookup_only, FALSE, dst, netmask,
3358	rnh, ifscope);
3359	}
3360
3361	struct rtentry *
3362	rt_lookup_coarse(boolean_t lookup_only, struct sockaddr *dst,
3363	struct sockaddr netmask, struct* radix_node_head *rnh)
3364	{
3365	return rt_lookup_common(lookup_only, TRUE, dst, netmask,
3366	rnh, IFSCOPE_NONE);
3367	}
3368
3369	boolean_t
3370	rt_validate(struct rtentry *rt)
3371	{
3372	RT_LOCK_ASSERT_HELD(rt);
3373
3374	if ((rt->rt_flags & (RTF_UP \| RTF_CONDEMNED)) == RTF_UP) {
3375	int af = rt_key(rt)->sa_family;
3376
3377	if (af == AF_INET) {
3378	(void) in_validate(RN(rt));
3379	} else if (af == AF_INET6) {
3380	(void) in6_validate(RN(rt));
3381	}
3382	} else {
3383	rt = NULL;
3384	}
3385
3386	return rt != NULL;
3387	}
3388
3389	/*
3390	* Set up a routing table entry, normally
3391	* for an interface.
3392	*/
3393	int
3394	rtinit(struct ifaddr ifa, uint8_t cmd, int* flags)
3395	{
3396	int error;
3397
3398	LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_NOTOWNED);
3399
3400	lck_mtx_lock(rnh_lock);
3401	error = rtinit_locked(ifa, cmd, flags);
3402	lck_mtx_unlock(rnh_lock);
3403
3404	return error;
3405	}
3406
3407	int
3408	rtinit_locked(struct ifaddr ifa, uint8_t cmd, int* flags)
3409	{
3410	struct radix_node_head *rnh;
3411	uint8_t nbuf[`128`]; / long enough for IPv6 /
3412	char dbuf[MAX_IPv6_STR_LEN], gbuf[MAX_IPv6_STR_LEN];
3413	char abuf[MAX_IPv6_STR_LEN];
3414	rtentry_ref_t rt = NULL;
3415	struct sockaddr *dst;
3416	struct sockaddr *netmask;
3417	int error = `0`;
3418
3419	/*
3420	* Holding rnh_lock here prevents the possibility of ifa from
3421	* changing (e.g. in_ifinit), so it is safe to access its
3422	* ifa_{dst}addr (here and down below) without locking.
3423	*/
3424	LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
3425
3426	if (flags & RTF_HOST) {
3427	dst = ifa->ifa_dstaddr;
3428	netmask = NULL;
3429	} else {
3430	dst = ifa->ifa_addr;
3431	netmask = ifa->ifa_netmask;
3432	}
3433
3434	if (dst->sa_len == `0`) {
3435	log(LOG_ERR, "%s: %s failed, invalid dst sa_len %d\n",
3436	__func__, rtm2str(cmd), dst->sa_len);
3437	error = EINVAL;
3438	goto done;
3439	}
3440	if (netmask != NULL && netmask->sa_len > sizeof(nbuf)) {
3441	log(LOG_ERR, "%s: %s failed, mask sa_len %d too large\n",
3442	__func__, rtm2str(cmd), dst->sa_len);
3443	error = EINVAL;
3444	goto done;
3445	}
3446
3447	if (rt_verbose) {
3448	if (dst->sa_family == AF_INET) {
3449	(void) inet_ntop(AF_INET, &SIN(dst)->sin_addr.s_addr,
3450	abuf, sizeof(abuf));
3451	} else if (dst->sa_family == AF_INET6) {
3452	(void) inet_ntop(AF_INET6, &SIN6(dst)->sin6_addr,
3453	abuf, sizeof(abuf));
3454	}
3455	}
3456
3457	if ((rnh = rt_tables[dst->sa_family]) == NULL) {
3458	error = EINVAL;
3459	goto done;
3460	}
3461
3462	/*
3463	* If it's a delete, check that if it exists, it's on the correct
3464	* interface or we might scrub a route to another ifa which would
3465	* be confusing at best and possibly worse.
3466	*/
3467	if (cmd == RTM_DELETE) {
3468	/*
3469	* It's a delete, so it should already exist..
3470	* If it's a net, mask off the host bits
3471	* (Assuming we have a mask)
3472	*/
3473	if (netmask != NULL) {
3474	rt_maskedcopy(src: dst, SA(nbuf), netmask);
3475	dst = SA(nbuf);
3476	}
3477	/*
3478	* Get an rtentry that is in the routing tree and contains
3479	* the correct info. Note that we perform a coarse-grained
3480	* lookup here, in case there is a scoped variant of the
3481	* subnet/prefix route which we should ignore, as we never
3482	* add a scoped subnet/prefix route as part of adding an
3483	* interface address.
3484	*/
3485	rt = rt_lookup_coarse(TRUE, dst, NULL, rnh);
3486	if (rt != NULL) {
3487	if (rt_verbose) {
3488	rt_str(rt, dbuf, sizeof(dbuf), gbuf, sizeof(gbuf));
3489	}
3490
3491	/*
3492	* Ok so we found the rtentry. it has an extra reference
3493	* for us at this stage. we won't need that so
3494	* lop that off now.
3495	*/
3496	RT_LOCK(rt);
3497	if (rt->rt_ifa != ifa) {
3498	/*
3499	* If the interface address in the rtentry
3500	* doesn't match the interface we are using,
3501	* then we don't want to delete it, so return
3502	* an error. This seems to be the only point
3503	* of this whole RTM_DELETE clause.
3504	*/
3505	#if (DEVELOPMENT \|\| DEBUG)
3506	if (rt_verbose) {
3507	log(LOG_DEBUG, "%s: not removing "
3508	"route to %s->%s->%s, flags 0x%x, "
3509	"ifaddr %s, rt_ifa 0x%llx != "
3510	"ifa 0x%llx\n", __func__, dbuf,
3511	gbuf, ((rt->rt_ifp != NULL) ?
3512	rt->rt_ifp->if_xname : ""),
3513	rt->rt_flags, abuf,
3514	(uint64_t)VM_KERNEL_ADDRPERM(
3515	rt->rt_ifa),
3516	(uint64_t)VM_KERNEL_ADDRPERM(ifa));
3517	}
3518	#endif /* (DEVELOPMENT \|\| DEBUG) */
3519	RT_REMREF_LOCKED(rt);
3520	RT_UNLOCK(rt);
3521	rt = NULL;
3522	error = ((flags & RTF_HOST) ?
3523	EHOSTUNREACH : ENETUNREACH);
3524	goto done;
3525	} else if (rt->rt_flags & RTF_STATIC) {
3526	/*
3527	* Don't remove the subnet/prefix route if
3528	* this was manually added from above.
3529	*/
3530	#if (DEVELOPMENT \|\| DEBUG)
3531	if (rt_verbose) {
3532	log(LOG_DEBUG, "%s: not removing "
3533	"static route to %s->%s->%s, "
3534	"flags 0x%x, ifaddr %s\n", __func__,
3535	dbuf, gbuf, ((rt->rt_ifp != NULL) ?
3536	rt->rt_ifp->if_xname : ""),
3537	rt->rt_flags, abuf);
3538	}
3539	#endif /* (DEVELOPMENT \|\| DEBUG) */
3540	RT_REMREF_LOCKED(rt);
3541	RT_UNLOCK(rt);
3542	rt = NULL;
3543	error = EBUSY;
3544	goto done;
3545	}
3546	if (rt_verbose) {
3547	log(LOG_INFO, "%s: removing route to "
3548	"%s->%s->%s, flags 0x%x, ifaddr %s\n",
3549	__func__, dbuf, gbuf,
3550	((rt->rt_ifp != NULL) ?
3551	rt->rt_ifp->if_xname : ""),
3552	rt->rt_flags, abuf);
3553	}
3554	RT_REMREF_LOCKED(rt);
3555	RT_UNLOCK(rt);
3556	rt = NULL;
3557	}
3558	}
3559	/*
3560	* Do the actual request
3561	*/
3562	if ((error = rtrequest_locked(req: cmd, dst, gateway: ifa->ifa_addr, netmask,
3563	flags: flags \| ifa->ifa_flags, ret_nrt: &rt)) != `0`) {
3564	goto done;
3565	}
3566
3567	VERIFY(rt != NULL);
3568
3569	if (rt_verbose) {
3570	rt_str(rt, dbuf, sizeof(dbuf), gbuf, sizeof(gbuf));
3571	}
3572
3573	switch (cmd) {
3574	case RTM_DELETE:
3575	/*
3576	* If we are deleting, and we found an entry, then it's
3577	* been removed from the tree. Notify any listening
3578	* routing agents of the change and throw it away.
3579	*/
3580	RT_LOCK(rt);
3581	rt_newaddrmsg(cmd, ifa, error, rt);
3582	RT_UNLOCK(rt);
3583	if (rt_verbose) {
3584	log(LOG_INFO, "%s: removed route to %s->%s->%s, "
3585	"flags 0x%x, ifaddr %s\n", __func__, dbuf, gbuf,
3586	((rt->rt_ifp != NULL) ? rt->rt_ifp->if_xname : ""),
3587	rt->rt_flags, abuf);
3588	}
3589	rtfree_locked(rt);
3590	break;
3591
3592	case RTM_ADD:
3593	/*
3594	* We are adding, and we have a returned routing entry.
3595	* We need to sanity check the result. If it came back
3596	* with an unexpected interface, then it must have already
3597	* existed or something.
3598	*/
3599	RT_LOCK(rt);
3600	if (rt->rt_ifa != ifa) {
3601	void (*ifa_rtrequest)
3602	(int, struct rtentry , struct* sockaddr *);
3603	#if (DEVELOPMENT \|\| DEBUG)
3604	if (rt_verbose) {
3605	if (!(rt->rt_ifa->ifa_ifp->if_flags &
3606	(IFF_POINTOPOINT \| IFF_LOOPBACK))) {
3607	log(LOG_ERR, "%s: %s route to %s->%s->%s, "
3608	"flags 0x%x, ifaddr %s, rt_ifa 0x%llx != "
3609	"ifa 0x%llx\n", __func__, rtm2str(cmd),
3610	dbuf, gbuf, ((rt->rt_ifp != NULL) ?
3611	rt->rt_ifp->if_xname : ""), rt->rt_flags,
3612	abuf,
3613	(uint64_t)VM_KERNEL_ADDRPERM(rt->rt_ifa),
3614	(uint64_t)VM_KERNEL_ADDRPERM(ifa));
3615	}
3616
3617	log(LOG_DEBUG, "%s: %s route to %s->%s->%s, "
3618	"flags 0x%x, ifaddr %s, rt_ifa was 0x%llx "
3619	"now 0x%llx\n", __func__, rtm2str(cmd),
3620	dbuf, gbuf, ((rt->rt_ifp != NULL) ?
3621	rt->rt_ifp->if_xname : ""), rt->rt_flags,
3622	abuf,
3623	(uint64_t)VM_KERNEL_ADDRPERM(rt->rt_ifa),
3624	(uint64_t)VM_KERNEL_ADDRPERM(ifa));
3625	}
3626	#endif /* (DEVELOPMENT \|\| DEBUG) */
3627
3628	/*
3629	* Ask that the protocol in question
3630	* remove anything it has associated with
3631	* this route and ifaddr.
3632	*/
3633	ifa_rtrequest = rt->rt_ifa->ifa_rtrequest;
3634	if (ifa_rtrequest != NULL) {
3635	ifa_rtrequest(RTM_DELETE, rt, NULL);
3636	}
3637	/*
3638	* Set the route's ifa.
3639	*/
3640	rtsetifa(rt, ifa);
3641
3642	if (rt->rt_ifp != ifa->ifa_ifp) {
3643	/*
3644	* Purge any link-layer info caching.
3645	*/
3646	if (rt->rt_llinfo_purge != NULL) {
3647	rt->rt_llinfo_purge(rt);
3648	}
3649	/*
3650	* Adjust route ref count for the interfaces.
3651	*/
3652	if (rt->rt_if_ref_fn != NULL) {
3653	rt->rt_if_ref_fn(ifa->ifa_ifp, `1`);
3654	rt->rt_if_ref_fn(rt->rt_ifp, -`1`);
3655	}
3656	}
3657
3658	/*
3659	* And substitute in references to the ifaddr
3660	* we are adding.
3661	*/
3662	rt->rt_ifp = ifa->ifa_ifp;
3663	/*
3664	* If rmx_mtu is not locked, update it
3665	* to the MTU used by the new interface.
3666	*/
3667	if (!(rt->rt_rmx.rmx_locks & RTV_MTU)) {
3668	rt->rt_rmx.rmx_mtu = rt->rt_ifp->if_mtu;
3669	if (dst->sa_family == AF_INET &&
3670	INTF_ADJUST_MTU_FOR_CLAT46(rt->rt_ifp)) {
3671	rt->rt_rmx.rmx_mtu = IN6_LINKMTU(rt->rt_ifp);
3672	/ Further adjust the size for CLAT46 expansion /
3673	rt->rt_rmx.rmx_mtu -= CLAT46_HDR_EXPANSION_OVERHD;
3674	}
3675	}
3676
3677	/*
3678	* Now ask the protocol to check if it needs
3679	* any special processing in its new form.
3680	*/
3681	ifa_rtrequest = ifa->ifa_rtrequest;
3682	if (ifa_rtrequest != NULL) {
3683	ifa_rtrequest(RTM_ADD, rt, NULL);
3684	}
3685	} else {
3686	if (rt_verbose) {
3687	log(LOG_INFO, "%s: added route to %s->%s->%s, "
3688	"flags 0x%x, ifaddr %s\n", __func__, dbuf,
3689	gbuf, ((rt->rt_ifp != NULL) ?
3690	rt->rt_ifp->if_xname : ""), rt->rt_flags,
3691	abuf);
3692	}
3693	}
3694	/*
3695	* notify any listening routing agents of the change
3696	*/
3697	rt_newaddrmsg(cmd, ifa, error, rt);
3698	/*
3699	* We just wanted to add it; we don't actually need a
3700	* reference. This will result in a route that's added
3701	* to the routing table without a reference count. The
3702	* RTM_DELETE code will do the necessary step to adjust
3703	* the reference count at deletion time.
3704	*/
3705	RT_REMREF_LOCKED(rt);
3706	RT_UNLOCK(rt);
3707	break;
3708
3709	default:
3710	VERIFY(`0`);
3711	/ NOTREACHED /
3712	}
3713	done:
3714	return error;
3715	}
3716
3717	static void
3718	rt_set_idleref(struct rtentry *rt)
3719	{
3720	RT_LOCK_ASSERT_HELD(rt);
3721
3722	/*
3723	* We currently keep idle refcnt only on unicast cloned routes
3724	* that aren't marked with RTF_NOIFREF.
3725	*/
3726	if (rt->rt_parent != NULL && !(rt->rt_flags &
3727	(RTF_NOIFREF \| RTF_BROADCAST \| RTF_MULTICAST)) &&
3728	(rt->rt_flags & (RTF_UP \| RTF_WASCLONED \| RTF_IFREF)) ==
3729	(RTF_UP \| RTF_WASCLONED)) {
3730	rt_clear_idleref(rt); / drop existing refcnt if any /
3731	rt->rt_if_ref_fn = rte_if_ref;
3732	/ Become a regular mutex, just in case /
3733	RT_CONVERT_LOCK(rt);
3734	rt->rt_if_ref_fn(rt->rt_ifp, `1`);
3735	rt->rt_flags \|= RTF_IFREF;
3736	}
3737	}
3738
3739	void
3740	rt_clear_idleref(struct rtentry *rt)
3741	{
3742	RT_LOCK_ASSERT_HELD(rt);
3743
3744	if (rt->rt_if_ref_fn != NULL) {
3745	VERIFY((rt->rt_flags & (RTF_NOIFREF \| RTF_IFREF)) == RTF_IFREF);
3746	/ Become a regular mutex, just in case /
3747	RT_CONVERT_LOCK(rt);
3748	rt->rt_if_ref_fn(rt->rt_ifp, -`1`);
3749	rt->rt_flags &= ~RTF_IFREF;
3750	rt->rt_if_ref_fn = NULL;
3751	}
3752	}
3753
3754	void
3755	rt_set_proxy(struct rtentry *rt, boolean_t set)
3756	{
3757	lck_mtx_lock(rnh_lock);
3758	RT_LOCK(rt);
3759	/*
3760	* Search for any cloned routes which might have
3761	* been formed from this node, and delete them.
3762	*/
3763	if (rt->rt_flags & (RTF_CLONING \| RTF_PRCLONING)) {
3764	struct radix_node_head *rnh = rt_tables[rt_key(rt)->sa_family];
3765
3766	if (set) {
3767	rt->rt_flags \|= RTF_PROXY;
3768	} else {
3769	rt->rt_flags &= ~RTF_PROXY;
3770	}
3771
3772	RT_UNLOCK(rt);
3773	if (rnh != NULL && rt_mask(rt)) {
3774	rnh->rnh_walktree_from(rnh, rt_key(rt), rt_mask(rt),
3775	rt_fixdelete, rt);
3776	}
3777	} else {
3778	RT_UNLOCK(rt);
3779	}
3780	lck_mtx_unlock(rnh_lock);
3781	}
3782
3783	static void
3784	rte_lock_init(struct rtentry *rt)
3785	{
3786	lck_mtx_init(lck: &rt->rt_lock, grp: &rte_mtx_grp, attr: &rte_mtx_attr);
3787	}
3788
3789	static void
3790	rte_lock_destroy(struct rtentry *rt)
3791	{
3792	RT_LOCK_ASSERT_NOTHELD(rt);
3793	lck_mtx_destroy(lck: &rt->rt_lock, grp: &rte_mtx_grp);
3794	}
3795
3796	void
3797	rt_lock(struct rtentry *rt, boolean_t spin)
3798	{
3799	RT_LOCK_ASSERT_NOTHELD(rt);
3800	if (spin) {
3801	lck_mtx_lock_spin(lck: &rt->rt_lock);
3802	} else {
3803	lck_mtx_lock(lck: &rt->rt_lock);
3804	}
3805	if (rte_debug & RTD_DEBUG) {
3806	rte_lock_debug((rtentry_dbg_ref_t)rt);
3807	}
3808	}
3809
3810	void
3811	rt_unlock(struct rtentry *rt)
3812	{
3813	if (rte_debug & RTD_DEBUG) {
3814	rte_unlock_debug((rtentry_dbg_ref_t)rt);
3815	}
3816	lck_mtx_unlock(lck: &rt->rt_lock);
3817	}
3818
3819	static inline void
3820	rte_lock_debug(struct rtentry_dbg *rte)
3821	{
3822	uint32_t idx;
3823
3824	RT_LOCK_ASSERT_HELD((rtentry_ref_t)rte);
3825	idx = os_atomic_inc_orig(&rte->rtd_lock_cnt, relaxed) % CTRACE_HIST_SIZE;
3826	if (rte_debug & RTD_TRACE) {
3827	ctrace_record(&rte->rtd_lock[idx]);
3828	}
3829	}
3830
3831	static inline void
3832	rte_unlock_debug(struct rtentry_dbg *rte)
3833	{
3834	uint32_t idx;
3835
3836	RT_LOCK_ASSERT_HELD((rtentry_ref_t)rte);
3837	idx = os_atomic_inc_orig(&rte->rtd_unlock_cnt, relaxed) % CTRACE_HIST_SIZE;
3838	if (rte_debug & RTD_TRACE) {
3839	ctrace_record(&rte->rtd_unlock[idx]);
3840	}
3841	}
3842
3843	static struct rtentry *
3844	rte_alloc(void)
3845	{
3846	if (rte_debug & RTD_DEBUG) {
3847	return rte_alloc_debug();
3848	}
3849
3850	return (rtentry_ref_t)zalloc(zone: rte_zone);
3851	}
3852
3853	static void
3854	rte_free(struct rtentry *p)
3855	{
3856	if (rte_debug & RTD_DEBUG) {
3857	rte_free_debug(p);
3858	return;
3859	}
3860
3861	if (p->rt_refcnt != `0`) {
3862	panic("rte_free: rte=%p refcnt=%d non-zero", p, p->rt_refcnt);
3863	/ NOTREACHED /
3864	}
3865
3866	zfree(rte_zone, p);
3867	}
3868
3869	static void
3870	rte_if_ref(struct ifnet ifp, int* cnt)
3871	{
3872	struct kev_msg ev_msg;
3873	struct net_event_data ev_data;
3874	uint32_t old;
3875
3876	/ Force cnt to 1 increment/decrement /
3877	if (cnt < -`1` \|\| cnt > `1`) {
3878	panic("%s: invalid count argument (%d)", __func__, cnt);
3879	/ NOTREACHED /
3880	}
3881	old = os_atomic_add_orig(&ifp->if_route_refcnt, cnt, relaxed);
3882	if (cnt < `0` && old == `0`) {
3883	panic("%s: ifp=%p negative route refcnt!", __func__, ifp);
3884	/ NOTREACHED /
3885	}
3886	/*
3887	* The following is done without first holding the ifnet lock,
3888	* for performance reasons. The relevant ifnet fields, with
3889	* the exception of the if_idle_flags, are never changed
3890	* during the lifetime of the ifnet. The if_idle_flags
3891	* may possibly be modified, so in the event that the value
3892	* is stale because IFRF_IDLE_NOTIFY was cleared, we'd end up
3893	* sending the event anyway. This is harmless as it is just
3894	* a notification to the monitoring agent in user space, and
3895	* it is expected to check via SIOCGIFGETRTREFCNT again anyway.
3896	*/
3897	if ((ifp->if_idle_flags & IFRF_IDLE_NOTIFY) && cnt < `0` && old == `1`) {
3898	bzero(s: &ev_msg, n: sizeof(ev_msg));
3899	bzero(s: &ev_data, n: sizeof(ev_data));
3900
3901	ev_msg.vendor_code = KEV_VENDOR_APPLE;
3902	ev_msg.kev_class = KEV_NETWORK_CLASS;
3903	ev_msg.kev_subclass = KEV_DL_SUBCLASS;
3904	ev_msg.event_code = KEV_DL_IF_IDLE_ROUTE_REFCNT;
3905
3906	strlcpy(dst: &ev_data.if_name[`0`], src: ifp->if_name, IFNAMSIZ);
3907
3908	ev_data.if_family = ifp->if_family;
3909	ev_data.if_unit = ifp->if_unit;
3910	ev_msg.dv[`0`].data_length = sizeof(struct net_event_data);
3911	ev_msg.dv[`0`].data_ptr = &ev_data;
3912
3913	dlil_post_complete_msg(NULL, &ev_msg);
3914	}
3915	}
3916
3917	static inline struct rtentry *
3918	rte_alloc_debug(void)
3919	{
3920	rtentry_dbg_ref_t rte;
3921
3922	rte = ((rtentry_dbg_ref_t)zalloc(zone: rte_zone));
3923	if (rte != NULL) {
3924	bzero(s: rte, n: sizeof(*rte));
3925	if (rte_debug & RTD_TRACE) {
3926	ctrace_record(&rte->rtd_alloc);
3927	}
3928	rte->rtd_inuse = RTD_INUSE;
3929	}
3930	return (rtentry_ref_t)rte;
3931	}
3932
3933	static inline void
3934	rte_free_debug(struct rtentry *p)
3935	{
3936	rtentry_dbg_ref_t rte = (rtentry_dbg_ref_t)p;
3937
3938	if (p->rt_refcnt != `0`) {
3939	panic("rte_free: rte=%p refcnt=%d", p, p->rt_refcnt);
3940	/ NOTREACHED /
3941	}
3942	if (rte->rtd_inuse == RTD_FREED) {
3943	panic("rte_free: double free rte=%p", rte);
3944	/ NOTREACHED /
3945	} else if (rte->rtd_inuse != RTD_INUSE) {
3946	panic("rte_free: corrupted rte=%p", rte);
3947	/ NOTREACHED /
3948	}
3949	bcopy(src: (caddr_t)p, dst: (caddr_t)&rte->rtd_entry_saved, n: sizeof(*p));
3950	/ Preserve rt_lock to help catch use-after-free cases /
3951	bzero(s: (caddr_t)p, offsetof(struct rtentry, rt_lock));
3952
3953	rte->rtd_inuse = RTD_FREED;
3954
3955	if (rte_debug & RTD_TRACE) {
3956	ctrace_record(&rte->rtd_free);
3957	}
3958
3959	if (!(rte_debug & RTD_NO_FREE)) {
3960	zfree(rte_zone, p);
3961	}
3962	}
3963
3964	void
3965	ctrace_record(ctrace_t *tr)
3966	{
3967	tr->th = current_thread();
3968	bzero(s: tr->pc, n: sizeof(tr->pc));
3969	(void) OSBacktrace(bt: tr->pc, CTRACE_STACK_SIZE);
3970	}
3971
3972	void
3973	route_clear(struct route *ro)
3974	{
3975	if (ro == NULL) {
3976	return;
3977	}
3978
3979	if (ro->ro_rt != NULL) {
3980	rtfree(rt: ro->ro_rt);
3981	ro->ro_rt = NULL;
3982	}
3983
3984	if (ro->ro_srcia != NULL) {
3985	ifa_remref(ifa: ro->ro_srcia);
3986	ro->ro_srcia = NULL;
3987	}
3988	return;
3989	}
3990
3991
3992	void
3993	route_copyout(struct route dst, const* struct route *src, size_t length)
3994	{
3995	/ Copy everything (rt, srcif, flags, dst) from src /
3996	bcopy(src, dst, n: length);
3997
3998	/ Hold one reference for the local copy of struct route /
3999	if (dst->ro_rt != NULL) {
4000	RT_ADDREF(dst->ro_rt);
4001	}
4002
4003	/ Hold one reference for the local copy of struct ifaddr /
4004	if (dst->ro_srcia != NULL) {
4005	ifa_addref(ifa: dst->ro_srcia);
4006	}
4007	}
4008
4009	void
4010	route_copyin(struct route src, struct* route *dst, size_t length)
4011	{
4012	/*
4013	* No cached route at the destination?
4014	* If none, then remove old references if present
4015	* and copy entire src route.
4016	*/
4017	if (dst->ro_rt == NULL) {
4018	/*
4019	* Ditch the address in the cached copy (dst) since
4020	* we're about to take everything there is in src.
4021	*/
4022	if (dst->ro_srcia != NULL) {
4023	ifa_remref(ifa: dst->ro_srcia);
4024	}
4025	/*
4026	* Copy everything (rt, srcia, flags, dst) from src; the
4027	* references to rt and/or srcia were held at the time
4028	* of storage and are kept intact.
4029	*/
4030	bcopy(src, dst, n: length);
4031	goto done;
4032	}
4033
4034	/*
4035	* We know dst->ro_rt is not NULL here.
4036	* If the src->ro_rt is the same, update srcia and flags
4037	* and ditch the route in the local copy.
4038	*/
4039	if (dst->ro_rt == src->ro_rt) {
4040	dst->ro_flags = src->ro_flags;
4041
4042	if (dst->ro_srcia != src->ro_srcia) {
4043	if (dst->ro_srcia != NULL) {
4044	ifa_remref(ifa: dst->ro_srcia);
4045	}
4046	dst->ro_srcia = src->ro_srcia;
4047	} else if (src->ro_srcia != NULL) {
4048	ifa_remref(ifa: src->ro_srcia);
4049	}
4050	rtfree(rt: src->ro_rt);
4051	goto done;
4052	}
4053
4054	/*
4055	* If they are dst's ro_rt is not equal to src's,
4056	* and src'd rt is not NULL, then remove old references
4057	* if present and copy entire src route.
4058	*/
4059	if (src->ro_rt != NULL) {
4060	rtfree(rt: dst->ro_rt);
4061
4062	if (dst->ro_srcia != NULL) {
4063	ifa_remref(ifa: dst->ro_srcia);
4064	}
4065	bcopy(src, dst, n: length);
4066	goto done;
4067	}
4068
4069	/*
4070	* Here, dst's cached route is not NULL but source's is.
4071	* Just get rid of all the other cached reference in src.
4072	*/
4073	if (src->ro_srcia != NULL) {
4074	/*
4075	* Ditch src address in the local copy (src) since we're
4076	* not caching the route entry anyway (ro_rt is NULL).
4077	*/
4078	ifa_remref(ifa: src->ro_srcia);
4079	}
4080	done:
4081	/ This function consumes the references on src /
4082	src->ro_rt = NULL;
4083	src->ro_srcia = NULL;
4084	}
4085
4086	/*
4087	* route_to_gwroute will find the gateway route for a given route.
4088	*
4089	* If the route is down, look the route up again.
4090	* If the route goes through a gateway, get the route to the gateway.
4091	* If the gateway route is down, look it up again.
4092	* If the route is set to reject, verify it hasn't expired.
4093	*
4094	* If the returned route is non-NULL, the caller is responsible for
4095	* releasing the reference and unlocking the route.
4096	*/
4097	#define senderr(e) { error = (e); goto bad; }
4098	errno_t
4099	route_to_gwroute(const struct sockaddr net_dest, struct* rtentry *hint0,
4100	struct rtentry **out_route)
4101	{
4102	uint64_t timenow;
4103	rtentry_ref_t rt = hint0;
4104	rtentry_ref_t hint = hint0;
4105	errno_t error = `0`;
4106	unsigned int ifindex;
4107	boolean_t gwroute;
4108
4109	*out_route = NULL;
4110
4111	if (rt == NULL) {
4112	return `0`;
4113	}
4114
4115	/*
4116	* Next hop determination. Because we may involve the gateway route
4117	* in addition to the original route, locking is rather complicated.
4118	* The general concept is that regardless of whether the route points
4119	* to the original route or to the gateway route, this routine takes
4120	* an extra reference on such a route. This extra reference will be
4121	* released at the end.
4122	*
4123	* Care must be taken to ensure that the "hint0" route never gets freed
4124	* via rtfree(), since the caller may have stored it inside a struct
4125	* route with a reference held for that placeholder.
4126	*/
4127	RT_LOCK_SPIN(rt);
4128	ifindex = rt->rt_ifp->if_index;
4129	RT_ADDREF_LOCKED(rt);
4130	if (!(rt->rt_flags & RTF_UP)) {
4131	RT_REMREF_LOCKED(rt);
4132	RT_UNLOCK(rt);
4133	/ route is down, find a new one /
4134	hint = rt = rtalloc1_scoped(
4135	__DECONST_SA(net_dest), report: `1`, ignflags: `0`, ifscope: ifindex);
4136	if (hint != NULL) {
4137	RT_LOCK_SPIN(rt);
4138	ifindex = rt->rt_ifp->if_index;
4139	} else {
4140	senderr(EHOSTUNREACH);
4141	}
4142	}
4143
4144	/*
4145	* We have a reference to "rt" by now; it will either
4146	* be released or freed at the end of this routine.
4147	*/
4148	RT_LOCK_ASSERT_HELD(rt);
4149	if ((gwroute = (rt->rt_flags & RTF_GATEWAY))) {
4150	rtentry_ref_t gwrt = rt->rt_gwroute;
4151	struct sockaddr_storage ss;
4152	struct sockaddr *gw = SA(&ss);
4153
4154	VERIFY(rt == hint);
4155	RT_ADDREF_LOCKED(hint);
4156
4157	/ If there's no gateway rt, look it up /
4158	if (gwrt == NULL) {
4159	SOCKADDR_COPY(rt->rt_gateway, gw, MIN(sizeof(ss),
4160	rt->rt_gateway->sa_len));
4161	gw->sa_len = MIN(sizeof(ss), rt->rt_gateway->sa_len);
4162	RT_UNLOCK(rt);
4163	goto lookup;
4164	}
4165	/ Become a regular mutex /
4166	RT_CONVERT_LOCK(rt);
4167
4168	/*
4169	* Take gwrt's lock while holding route's lock;
4170	* this is okay since gwrt never points back
4171	* to "rt", so no lock ordering issues.
4172	*/
4173	RT_LOCK_SPIN(gwrt);
4174	if (!(gwrt->rt_flags & RTF_UP)) {
4175	rt->rt_gwroute = NULL;
4176	RT_UNLOCK(gwrt);
4177	SOCKADDR_COPY(rt->rt_gateway, gw, MIN(sizeof(ss),
4178	rt->rt_gateway->sa_len));
4179	gw->sa_len = MIN(sizeof(ss), rt->rt_gateway->sa_len);
4180	RT_UNLOCK(rt);
4181	rtfree(rt: gwrt);
4182	lookup:
4183	lck_mtx_lock(rnh_lock);
4184	gwrt = rtalloc1_scoped_locked(dst: gw, report: `1`, ignflags: `0`, ifscope: ifindex);
4185
4186	RT_LOCK(rt);
4187	/*
4188	* Bail out if the route is down, no route
4189	* to gateway, circular route, or if the
4190	* gateway portion of "rt" has changed.
4191	*/
4192	if (!(rt->rt_flags & RTF_UP) \|\| gwrt == NULL \|\|
4193	gwrt == rt \|\| !sa_equal(gw, rt->rt_gateway)) {
4194	if (gwrt == rt) {
4195	RT_REMREF_LOCKED(gwrt);
4196	gwrt = NULL;
4197	}
4198	VERIFY(rt == hint);
4199	RT_REMREF_LOCKED(hint);
4200	hint = NULL;
4201	RT_UNLOCK(rt);
4202	if (gwrt != NULL) {
4203	rtfree_locked(rt: gwrt);
4204	}
4205	lck_mtx_unlock(rnh_lock);
4206	senderr(EHOSTUNREACH);
4207	}
4208	VERIFY(gwrt != NULL);
4209	/*
4210	* Set gateway route; callee adds ref to gwrt;
4211	* gwrt has an extra ref from rtalloc1() for
4212	* this routine.
4213	*/
4214	rt_set_gwroute(rt, rt_key(rt), gwrt);
4215	VERIFY(rt == hint);
4216	RT_REMREF_LOCKED(rt); / hint still holds a refcnt /
4217	RT_UNLOCK(rt);
4218	lck_mtx_unlock(rnh_lock);
4219	rt = gwrt;
4220	} else {
4221	RT_ADDREF_LOCKED(gwrt);
4222	RT_UNLOCK(gwrt);
4223	VERIFY(rt == hint);
4224	RT_REMREF_LOCKED(rt); / hint still holds a refcnt /
4225	RT_UNLOCK(rt);
4226	rt = gwrt;
4227	}
4228	VERIFY(rt == gwrt && rt != hint);
4229
4230	/*
4231	* This is an opportunity to revalidate the parent route's
4232	* rt_gwroute, in case it now points to a dead route entry.
4233	* Parent route won't go away since the clone (hint) holds
4234	* a reference to it. rt == gwrt.
4235	*/
4236	RT_LOCK_SPIN(hint);
4237	if ((hint->rt_flags & (RTF_WASCLONED \| RTF_UP)) ==
4238	(RTF_WASCLONED \| RTF_UP)) {
4239	rtentry_ref_t prt = hint->rt_parent;
4240	VERIFY(prt != NULL);
4241
4242	RT_CONVERT_LOCK(hint);
4243	RT_ADDREF(prt);
4244	RT_UNLOCK(hint);
4245	rt_revalidate_gwroute(prt, rt);
4246	RT_REMREF(prt);
4247	} else {
4248	RT_UNLOCK(hint);
4249	}
4250
4251	/ Clean up "hint" now; see notes above regarding hint0 /
4252	if (hint == hint0) {
4253	RT_REMREF(hint);
4254	} else {
4255	rtfree(rt: hint);
4256	}
4257	hint = NULL;
4258
4259	/ rt == gwrt; if it is now down, give up /
4260	RT_LOCK_SPIN(rt);
4261	if (!(rt->rt_flags & RTF_UP)) {
4262	RT_UNLOCK(rt);
4263	senderr(EHOSTUNREACH);
4264	}
4265	}
4266
4267	if (rt->rt_flags & RTF_REJECT) {
4268	VERIFY(rt->rt_expire == `0` \|\| rt->rt_rmx.rmx_expire != `0`);
4269	VERIFY(rt->rt_expire != `0` \|\| rt->rt_rmx.rmx_expire == `0`);
4270	timenow = net_uptime();
4271	if (rt->rt_expire == `0` \|\| timenow < rt->rt_expire) {
4272	RT_UNLOCK(rt);
4273	senderr(!gwroute ? EHOSTDOWN : EHOSTUNREACH);
4274	}
4275	}
4276
4277	/ Become a regular mutex /
4278	RT_CONVERT_LOCK(rt);
4279
4280	/ Caller is responsible for cleaning up "rt" /
4281	*out_route = rt;
4282	return `0`;
4283
4284	bad:
4285	/ Clean up route (either it is "rt" or "gwrt") /
4286	if (rt != NULL) {
4287	RT_LOCK_SPIN(rt);
4288	if (rt == hint0) {
4289	RT_REMREF_LOCKED(rt);
4290	RT_UNLOCK(rt);
4291	} else {
4292	RT_UNLOCK(rt);
4293	rtfree(rt);
4294	}
4295	}
4296	return error;
4297	}
4298	#undef senderr
4299
4300	void
4301	rt_revalidate_gwroute(struct rtentry rt, struct* rtentry *gwrt)
4302	{
4303	VERIFY(gwrt != NULL);
4304
4305	RT_LOCK_SPIN(rt);
4306	if ((rt->rt_flags & (RTF_GATEWAY \| RTF_UP)) == (RTF_GATEWAY \| RTF_UP) &&
4307	rt->rt_ifp == gwrt->rt_ifp && rt->rt_gateway->sa_family ==
4308	rt_key(gwrt)->sa_family && (rt->rt_gwroute == NULL \|\|
4309	!(rt->rt_gwroute->rt_flags & RTF_UP))) {
4310	boolean_t isequal;
4311	VERIFY(rt->rt_flags & (RTF_CLONING \| RTF_PRCLONING));
4312
4313	if (rt->rt_gateway->sa_family == AF_INET \|\|
4314	rt->rt_gateway->sa_family == AF_INET6) {
4315	struct sockaddr_storage key_ss, gw_ss;
4316	/*
4317	* We need to compare rt_key and rt_gateway; create
4318	* local copies to get rid of any ifscope association.
4319	*/
4320	(void) sa_copy(rt_key(gwrt), dst: &key_ss, NULL);
4321	(void) sa_copy(src: rt->rt_gateway, dst: &gw_ss, NULL);
4322
4323	isequal = sa_equal(SA(&key_ss), SA(&gw_ss));
4324	} else {
4325	isequal = sa_equal(rt_key(gwrt), rt->rt_gateway);
4326	}
4327
4328	/ If they are the same, update gwrt /
4329	if (isequal) {
4330	RT_UNLOCK(rt);
4331	lck_mtx_lock(rnh_lock);
4332	RT_LOCK(rt);
4333	rt_set_gwroute(rt, rt_key(rt), gwrt);
4334	RT_UNLOCK(rt);
4335	lck_mtx_unlock(rnh_lock);
4336	} else {
4337	RT_UNLOCK(rt);
4338	}
4339	} else {
4340	RT_UNLOCK(rt);
4341	}
4342	}
4343
4344	static void
4345	rt_str4(struct rtentry rt, char* ds, uint32_t dslen, char* *gs, uint32_t gslen)
4346	{
4347	VERIFY(rt_key(rt)->sa_family == AF_INET);
4348
4349	if (ds != NULL) {
4350	(void) inet_ntop(AF_INET,
4351	&SIN(rt_key(rt))->sin_addr.s_addr, ds, dslen);
4352	if (dslen >= MAX_SCOPE_ADDR_STR_LEN &&
4353	SINIFSCOPE(rt_key(rt))->sin_scope_id != IFSCOPE_NONE) {
4354	char scpstr[`16`];
4355
4356	snprintf(scpstr, count: sizeof(scpstr), "@%u",
4357	SINIFSCOPE(rt_key(rt))->sin_scope_id);
4358
4359	strlcat(dst: ds, src: scpstr, n: dslen);
4360	}
4361	}
4362
4363	if (gs != NULL) {
4364	if (rt->rt_flags & RTF_GATEWAY) {
4365	(void) inet_ntop(AF_INET,
4366	&SIN(rt->rt_gateway)->sin_addr.s_addr, gs, gslen);
4367	} else if (rt->rt_ifp != NULL) {
4368	snprintf(gs, count: gslen, "link#%u", rt->rt_ifp->if_unit);
4369	} else {
4370	snprintf(gs, count: gslen, "%s", "link");
4371	}
4372	}
4373	}
4374
4375	static void
4376	rt_str6(struct rtentry rt, char* ds, uint32_t dslen, char* *gs, uint32_t gslen)
4377	{
4378	VERIFY(rt_key(rt)->sa_family == AF_INET6);
4379
4380	if (ds != NULL) {
4381	(void) inet_ntop(AF_INET6,
4382	&SIN6(rt_key(rt))->sin6_addr, ds, dslen);
4383	if (dslen >= MAX_SCOPE_ADDR_STR_LEN &&
4384	SIN6IFSCOPE(rt_key(rt))->sin6_scope_id != IFSCOPE_NONE) {
4385	char scpstr[`16`];
4386
4387	snprintf(scpstr, count: sizeof(scpstr), "@%u",
4388	SIN6IFSCOPE(rt_key(rt))->sin6_scope_id);
4389
4390	strlcat(dst: ds, src: scpstr, n: dslen);
4391	}
4392	}
4393
4394	if (gs != NULL) {
4395	if (rt->rt_flags & RTF_GATEWAY) {
4396	(void) inet_ntop(AF_INET6,
4397	&SIN6(rt->rt_gateway)->sin6_addr, gs, gslen);
4398	} else if (rt->rt_ifp != NULL) {
4399	snprintf(gs, count: gslen, "link#%u", rt->rt_ifp->if_unit);
4400	} else {
4401	snprintf(gs, count: gslen, "%s", "link");
4402	}
4403	}
4404	}
4405
4406	void
4407	rt_str(struct rtentry rt, char* ds, uint32_t dslen, char* *gs, uint32_t gslen)
4408	{
4409	switch (rt_key(rt)->sa_family) {
4410	case AF_INET:
4411	rt_str4(rt, ds, dslen, gs, gslen);
4412	break;
4413	case AF_INET6:
4414	rt_str6(rt, ds, dslen, gs, gslen);
4415	break;
4416	default:
4417	if (ds != NULL) {
4418	bzero(s: ds, n: dslen);
4419	}
4420	if (gs != NULL) {
4421	bzero(s: gs, n: gslen);
4422	}
4423	break;
4424	}
4425	}
4426
4427	void
4428	route_event_init(struct route_event p_route_ev, struct* rtentry *rt,
4429	struct rtentry gwrt, int* route_ev_code)
4430	{
4431	VERIFY(p_route_ev != NULL);
4432	bzero(s: p_route_ev, n: sizeof(*p_route_ev));
4433
4434	p_route_ev->rt = rt;
4435	p_route_ev->gwrt = gwrt;
4436	p_route_ev->route_event_code = route_ev_code;
4437	}
4438
4439	struct route_event_nwk_wq_entry {
4440	struct nwk_wq_entry nwk_wqe;
4441	struct route_event rt_ev_arg;
4442	};
4443
4444	static void
4445	route_event_callback(struct nwk_wq_entry *nwk_item)
4446	{
4447	struct route_event_nwk_wq_entry *p_ev = __container_of(nwk_item,
4448	struct route_event_nwk_wq_entry, nwk_wqe);
4449
4450	rtentry_ref_t rt = p_ev->rt_ev_arg.rt;
4451	eventhandler_tag evtag = p_ev->rt_ev_arg.evtag;
4452	int route_ev_code = p_ev->rt_ev_arg.route_event_code;
4453
4454	if (route_ev_code == ROUTE_EVHDLR_DEREGISTER) {
4455	VERIFY(evtag != NULL);
4456	EVENTHANDLER_DEREGISTER(&rt->rt_evhdlr_ctxt, route_event,
4457	evtag);
4458	rtfree(rt);
4459	kfree_type(struct route_event_nwk_wq_entry, p_ev);
4460	return;
4461	}
4462
4463	EVENTHANDLER_INVOKE(&rt->rt_evhdlr_ctxt, route_event, rt_key(rt),
4464	route_ev_code, SA(&p_ev->rt_ev_arg.rtev_ipaddr),
4465	rt->rt_flags);
4466
4467	/ The code enqueuing the route event held a reference /
4468	rtfree(rt);
4469	/ XXX No reference is taken on gwrt /
4470	kfree_type(struct route_event_nwk_wq_entry, p_ev);
4471	}
4472
4473	int
4474	route_event_walktree(struct radix_node rn, void* *arg)
4475	{
4476	struct route_event p_route_ev = (struct* route_event *)arg;
4477	rtentry_ref_t rt = (rtentry_ref_t)rn;
4478	rtentry_ref_t gwrt = p_route_ev->rt;
4479
4480	LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
4481
4482	RT_LOCK(rt);
4483
4484	/ Return if the entry is pending cleanup /
4485	if (rt->rt_flags & RTPRF_OURS) {
4486	RT_UNLOCK(rt);
4487	return `0`;
4488	}
4489
4490	/ Return if it is not an indirect route /
4491	if (!(rt->rt_flags & RTF_GATEWAY)) {
4492	RT_UNLOCK(rt);
4493	return `0`;
4494	}
4495
4496	if (rt->rt_gwroute != gwrt) {
4497	RT_UNLOCK(rt);
4498	return `0`;
4499	}
4500
4501	route_event_enqueue_nwk_wq_entry(rt, gwrt, p_route_ev->route_event_code,
4502	NULL, TRUE);
4503	RT_UNLOCK(rt);
4504
4505	return `0`;
4506	}
4507
4508	void
4509	route_event_enqueue_nwk_wq_entry(struct rtentry rt, struct* rtentry *gwrt,
4510	uint32_t route_event_code, eventhandler_tag evtag, boolean_t rt_locked)
4511	{
4512	struct route_event_nwk_wq_entry *p_rt_ev = NULL;
4513	struct sockaddr *p_gw_saddr = NULL;
4514
4515	p_rt_ev = kalloc_type(struct route_event_nwk_wq_entry,
4516	Z_WAITOK \| Z_ZERO \| Z_NOFAIL);
4517
4518	/*
4519	* If the intent is to de-register, don't take
4520	* reference, route event registration already takes
4521	* a reference on route.
4522	*/
4523	if (route_event_code != ROUTE_EVHDLR_DEREGISTER) {
4524	/ The reference is released by route_event_callback /
4525	if (rt_locked) {
4526	RT_ADDREF_LOCKED(rt);
4527	} else {
4528	RT_ADDREF(rt);
4529	}
4530	}
4531
4532	p_rt_ev->rt_ev_arg.rt = rt;
4533	p_rt_ev->rt_ev_arg.gwrt = gwrt;
4534	p_rt_ev->rt_ev_arg.evtag = evtag;
4535
4536	if (gwrt != NULL) {
4537	p_gw_saddr = gwrt->rt_gateway;
4538	} else {
4539	p_gw_saddr = rt->rt_gateway;
4540	}
4541
4542	VERIFY(p_gw_saddr->sa_len <= sizeof(p_rt_ev->rt_ev_arg.rt_addr));
4543	SOCKADDR_COPY(p_gw_saddr, &(p_rt_ev->rt_ev_arg.rtev_ipaddr), p_gw_saddr->sa_len);
4544
4545	p_rt_ev->rt_ev_arg.route_event_code = route_event_code;
4546	p_rt_ev->nwk_wqe.func = route_event_callback;
4547	nwk_wq_enqueue(nwk_item: &p_rt_ev->nwk_wqe);
4548	}
4549
4550	const char *
4551	route_event2str(int route_event)
4552	{
4553	const char *route_event_str = "ROUTE_EVENT_UNKNOWN";
4554	switch (route_event) {
4555	case ROUTE_STATUS_UPDATE:
4556	route_event_str = "ROUTE_STATUS_UPDATE";
4557	break;
4558	case ROUTE_ENTRY_REFRESH:
4559	route_event_str = "ROUTE_ENTRY_REFRESH";
4560	break;
4561	case ROUTE_ENTRY_DELETED:
4562	route_event_str = "ROUTE_ENTRY_DELETED";
4563	break;
4564	case ROUTE_LLENTRY_RESOLVED:
4565	route_event_str = "ROUTE_LLENTRY_RESOLVED";
4566	break;
4567	case ROUTE_LLENTRY_UNREACH:
4568	route_event_str = "ROUTE_LLENTRY_UNREACH";
4569	break;
4570	case ROUTE_LLENTRY_CHANGED:
4571	route_event_str = "ROUTE_LLENTRY_CHANGED";
4572	break;
4573	case ROUTE_LLENTRY_STALE:
4574	route_event_str = "ROUTE_LLENTRY_STALE";
4575	break;
4576	case ROUTE_LLENTRY_TIMEDOUT:
4577	route_event_str = "ROUTE_LLENTRY_TIMEDOUT";
4578	break;
4579	case ROUTE_LLENTRY_DELETED:
4580	route_event_str = "ROUTE_LLENTRY_DELETED";
4581	break;
4582	case ROUTE_LLENTRY_EXPIRED:
4583	route_event_str = "ROUTE_LLENTRY_EXPIRED";
4584	break;
4585	case ROUTE_LLENTRY_PROBED:
4586	route_event_str = "ROUTE_LLENTRY_PROBED";
4587	break;
4588	case ROUTE_EVHDLR_DEREGISTER:
4589	route_event_str = "ROUTE_EVHDLR_DEREGISTER";
4590	break;
4591	default:
4592	/ Init'd to ROUTE_EVENT_UNKNOWN /
4593	break;
4594	}
4595	return route_event_str;
4596	}
4597
4598	int
4599	route_op_entitlement_check(struct socket *so,
4600	kauth_cred_t cred,
4601	int route_op_type,
4602	boolean_t allow_root)
4603	{
4604	if (so != NULL) {
4605	if (route_op_type == ROUTE_OP_READ) {
4606	/*
4607	* If needed we can later extend this for more
4608	* granular entitlements and return a bit set of
4609	* allowed accesses.
4610	*/
4611	if (soopt_cred_check(so, PRIV_NET_RESTRICTED_ROUTE_NC_READ,
4612	allow_root, false) == `0`) {
4613	return `0`;
4614	} else {
4615	return -`1`;
4616	}
4617	}
4618	} else if (cred != NULL) {
4619	uid_t uid = kauth_cred_getuid(cred: cred);
4620
4621	/ uid is 0 for root /
4622	if (uid != `0` \|\| !allow_root) {
4623	if (route_op_type == ROUTE_OP_READ) {
4624	if (priv_check_cred(cred,
4625	PRIV_NET_RESTRICTED_ROUTE_NC_READ, flags: `0`) == `0`) {
4626	return `0`;
4627	} else {
4628	return -`1`;
4629	}
4630	}
4631	}
4632	}
4633	return -`1`;
4634	}
4635
4636	/*
4637	* RTM_xxx.
4638	*
4639	* The switch statement below does nothing at runtime, as it serves as a
4640	* compile time check to ensure that all of the RTM_xxx constants are
4641	* unique. This works as long as this routine gets updated each time a
4642	* new RTM_xxx constant gets added.
4643	*
4644	* Any failures at compile time indicates duplicated RTM_xxx values.
4645	*/
4646	static __attribute__((unused)) void
4647	rtm_cassert(void)
4648	{
4649	/*
4650	* This is equivalent to _CASSERT() and the compiler wouldn't
4651	* generate any instructions, thus for compile time only.
4652	*/
4653	switch ((u_int16_t)`0`) {
4654	case `0`:
4655
4656	/ bsd/net/route.h /
4657	case RTM_ADD:
4658	case RTM_DELETE:
4659	case RTM_CHANGE:
4660	case RTM_GET:
4661	case RTM_LOSING:
4662	case RTM_REDIRECT:
4663	case RTM_MISS:
4664	case RTM_LOCK:
4665	case RTM_OLDADD:
4666	case RTM_OLDDEL:
4667	case RTM_RESOLVE:
4668	case RTM_NEWADDR:
4669	case RTM_DELADDR:
4670	case RTM_IFINFO:
4671	case RTM_NEWMADDR:
4672	case RTM_DELMADDR:
4673	case RTM_IFINFO2:
4674	case RTM_NEWMADDR2:
4675	case RTM_GET2:
4676
4677	/ bsd/net/route_private.h /
4678	case RTM_GET_SILENT:
4679	case RTM_GET_EXT:
4680	;
4681	}
4682	}
4683
4684	static __attribute__((unused)) void
4685	rtv_cassert(void)
4686	{
4687	switch ((u_int16_t)`0`) {
4688	case `0`:
4689
4690	/ bsd/net/route.h /
4691	case RTV_MTU:
4692	case RTV_HOPCOUNT:
4693	case RTV_EXPIRE:
4694	case RTV_RPIPE:
4695	case RTV_SPIPE:
4696	case RTV_SSTHRESH:
4697	case RTV_RTT:
4698	case RTV_RTTVAR:
4699
4700	/ net/route_private.h /
4701	case RTV_REFRESH_HOST:
4702	;
4703	}
4704	}
4705

Browse the source code of xnu/bsd/net/route.c