1/*
2 * Copyright (c) 2000-2023 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28/*
29 * Copyright (c) 1980, 1986, 1991, 1993
30 * The Regents of the University of California. All rights reserved.
31 *
32 * Redistribution and use in source and binary forms, with or without
33 * modification, are permitted provided that the following conditions
34 * are met:
35 * 1. Redistributions of source code must retain the above copyright
36 * notice, this list of conditions and the following disclaimer.
37 * 2. Redistributions in binary form must reproduce the above copyright
38 * notice, this list of conditions and the following disclaimer in the
39 * documentation and/or other materials provided with the distribution.
40 * 3. All advertising materials mentioning features or use of this software
41 * must display the following acknowledgement:
42 * This product includes software developed by the University of
43 * California, Berkeley and its contributors.
44 * 4. Neither the name of the University nor the names of its contributors
45 * may be used to endorse or promote products derived from this software
46 * without specific prior written permission.
47 *
48 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
49 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
50 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
51 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
52 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
53 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
54 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
55 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
56 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
57 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
58 * SUCH DAMAGE.
59 *
60 * @(#)route.c 8.2 (Berkeley) 11/15/93
61 * $FreeBSD: src/sys/net/route.c,v 1.59.2.3 2001/07/29 19:18:02 ume Exp $
62 */
63
64#include <sys/param.h>
65#include <sys/sysctl.h>
66#include <sys/systm.h>
67#include <sys/malloc.h>
68#include <sys/mbuf.h>
69#include <sys/socket.h>
70#include <sys/domain.h>
71#include <sys/stat.h>
72#include <sys/ubc.h>
73#include <sys/vnode.h>
74#include <sys/syslog.h>
75#include <sys/queue.h>
76#include <sys/mcache.h>
77#include <sys/priv.h>
78#include <sys/protosw.h>
79#include <sys/sdt.h>
80#include <sys/kernel.h>
81#include <kern/locks.h>
82#include <kern/zalloc.h>
83
84#include <net/dlil.h>
85#include <net/if.h>
86#include <net/route.h>
87#include <net/ntstat.h>
88#include <net/nwk_wq.h>
89#if NECP
90#include <net/necp.h>
91#endif /* NECP */
92
93#include <netinet/in.h>
94#include <netinet/in_var.h>
95#include <netinet/ip_var.h>
96#include <netinet/ip.h>
97#include <netinet/ip6.h>
98#include <netinet/in_arp.h>
99
100#include <netinet6/ip6_var.h>
101#include <netinet6/in6_var.h>
102#include <netinet6/nd6.h>
103
104#include <net/if_dl.h>
105
106#include <net/sockaddr_utils.h>
107
108#include <libkern/OSAtomic.h>
109#include <libkern/OSDebug.h>
110
111#include <pexpert/pexpert.h>
112
113#if CONFIG_MACF
114#include <sys/kauth.h>
115#endif
116
117#include <sys/constrained_ctypes.h>
118
119/*
120 * Synchronization notes:
121 *
122 * Routing entries fall under two locking domains: the global routing table
123 * lock (rnh_lock) and the per-entry lock (rt_lock); the latter is a mutex that
124 * resides (statically defined) in the rtentry structure.
125 *
126 * The locking domains for routing are defined as follows:
127 *
128 * The global routing lock is used to serialize all accesses to the radix
129 * trees defined by rt_tables[], as well as the tree of masks. This includes
130 * lookups, insertions and removals of nodes to/from the respective tree.
131 * It is also used to protect certain fields in the route entry that aren't
132 * often modified and/or require global serialization (more details below.)
133 *
134 * The per-route entry lock is used to serialize accesses to several routing
135 * entry fields (more details below.) Acquiring and releasing this lock is
136 * done via RT_LOCK() and RT_UNLOCK() routines.
137 *
138 * In cases where both rnh_lock and rt_lock must be held, the former must be
139 * acquired first in order to maintain lock ordering. It is not a requirement
140 * that rnh_lock be acquired first before rt_lock, but in case both must be
141 * acquired in succession, the correct lock ordering must be followed.
142 *
143 * The fields of the rtentry structure are protected in the following way:
144 *
145 * rt_nodes[]
146 *
147 * - Routing table lock (rnh_lock).
148 *
149 * rt_parent, rt_mask, rt_llinfo_free, rt_tree_genid
150 *
151 * - Set once during creation and never changes; no locks to read.
152 *
153 * rt_flags, rt_genmask, rt_llinfo, rt_rmx, rt_refcnt, rt_gwroute
154 *
155 * - Routing entry lock (rt_lock) for read/write access.
156 *
157 * - Some values of rt_flags are either set once at creation time,
158 * or aren't currently used, and thus checking against them can
159 * be done without rt_lock: RTF_GATEWAY, RTF_HOST, RTF_DYNAMIC,
160 * RTF_DONE, RTF_XRESOLVE, RTF_STATIC, RTF_BLACKHOLE, RTF_ANNOUNCE,
161 * RTF_USETRAILERS, RTF_WASCLONED, RTF_PINNED, RTF_LOCAL,
162 * RTF_BROADCAST, RTF_MULTICAST, RTF_IFSCOPE, RTF_IFREF.
163 *
164 * rt_key, rt_gateway, rt_ifp, rt_ifa
165 *
166 * - Always written/modified with both rnh_lock and rt_lock held.
167 *
168 * - May be read freely with rnh_lock held, else must hold rt_lock
169 * for read access; holding both locks for read is also okay.
170 *
171 * - In the event rnh_lock is not acquired, or is not possible to be
172 * acquired across the operation, setting RTF_CONDEMNED on a route
173 * entry will prevent its rt_key, rt_gateway, rt_ifp and rt_ifa
174 * from being modified. This is typically done on a route that
175 * has been chosen for a removal (from the tree) prior to dropping
176 * the rt_lock, so that those values will remain the same until
177 * the route is freed.
178 *
179 * When rnh_lock is held rt_setgate(), rt_setif(), and rtsetifa() are
180 * single-threaded, thus exclusive. This flag will also prevent the
181 * route from being looked up via rt_lookup().
182 *
183 * rt_genid
184 *
185 * - Assumes that 32-bit writes are atomic; no locks.
186 *
187 * rt_dlt, rt_output
188 *
189 * - Currently unused; no locks.
190 *
191 * Operations on a route entry can be described as follows:
192 *
193 * CREATE an entry with reference count set to 0 as part of RTM_ADD/RESOLVE.
194 *
195 * INSERTION of an entry into the radix tree holds the rnh_lock, checks
196 * for duplicates and then adds the entry. rtrequest returns the entry
197 * after bumping up the reference count to 1 (for the caller).
198 *
199 * LOOKUP of an entry holds the rnh_lock and bumps up the reference count
200 * before returning; it is valid to also bump up the reference count using
201 * RT_ADDREF after the lookup has returned an entry.
202 *
203 * REMOVAL of an entry from the radix tree holds the rnh_lock, removes the
204 * entry but does not decrement the reference count. Removal happens when
205 * the route is explicitly deleted (RTM_DELETE) or when it is in the cached
206 * state and it expires. The route is said to be "down" when it is no
207 * longer present in the tree. Freeing the entry will happen on the last
208 * reference release of such a "down" route.
209 *
210 * RT_ADDREF/RT_REMREF operates on the routing entry which increments/
211 * decrements the reference count, rt_refcnt, atomically on the rtentry.
212 * rt_refcnt is modified only using this routine. The general rule is to
213 * do RT_ADDREF in the function that is passing the entry as an argument,
214 * in order to prevent the entry from being freed by the callee.
215 */
216extern void kdp_set_gateway_mac(void *gatewaymac);
217
218__private_extern__ struct rtstat rtstat = {
219 .rts_badredirect = 0,
220 .rts_dynamic = 0,
221 .rts_newgateway = 0,
222 .rts_unreach = 0,
223 .rts_wildcard = 0,
224 .rts_badrtgwroute = 0
225};
226struct radix_node_head *rt_tables[AF_MAX + 1];
227
228static LCK_GRP_DECLARE(rnh_lock_grp, "route");
229LCK_MTX_DECLARE(rnh_lock_data, &rnh_lock_grp); /* global routing tables mutex */
230
231int rttrash = 0; /* routes not in table but not freed */
232
233boolean_t trigger_v6_defrtr_select = FALSE;
234unsigned int rte_debug = 0;
235
236/* Possible flags for rte_debug */
237#define RTD_DEBUG 0x1 /* enable or disable rtentry debug facility */
238#define RTD_TRACE 0x2 /* trace alloc, free, refcnt and lock */
239#define RTD_NO_FREE 0x4 /* don't free (good to catch corruptions) */
240
241#define RTE_NAME "rtentry" /* name for zone and rt_lock */
242
243static struct zone *rte_zone; /* special zone for rtentry */
244#define RTE_ZONE_MAX 65536 /* maximum elements in zone */
245#define RTE_ZONE_NAME RTE_NAME /* name of rtentry zone */
246
247#define RTD_INUSE 0xFEEDFACE /* entry is in use */
248#define RTD_FREED 0xDEADBEEF /* entry is freed */
249
250#define MAX_SCOPE_ADDR_STR_LEN (MAX_IPv6_STR_LEN + 6)
251
252/* Lock group and attribute for routing entry locks */
253static LCK_ATTR_DECLARE(rte_mtx_attr, 0, 0);
254static LCK_GRP_DECLARE(rte_mtx_grp, RTE_NAME);
255
256/* For gdb */
257__private_extern__ unsigned int ctrace_stack_size = CTRACE_STACK_SIZE;
258__private_extern__ unsigned int ctrace_hist_size = CTRACE_HIST_SIZE;
259
260/*
261 * Debug variant of rtentry structure.
262 */
263struct rtentry_dbg {
264 struct rtentry rtd_entry; /* rtentry */
265 struct rtentry rtd_entry_saved; /* saved rtentry */
266 uint32_t rtd_inuse; /* in use pattern */
267 uint16_t rtd_refhold_cnt; /* # of rtref */
268 uint16_t rtd_refrele_cnt; /* # of rtunref */
269 uint32_t rtd_lock_cnt; /* # of locks */
270 uint32_t rtd_unlock_cnt; /* # of unlocks */
271 /*
272 * Alloc and free callers.
273 */
274 ctrace_t rtd_alloc;
275 ctrace_t rtd_free;
276 /*
277 * Circular lists of rtref and rtunref callers.
278 */
279 ctrace_t rtd_refhold[CTRACE_HIST_SIZE];
280 ctrace_t rtd_refrele[CTRACE_HIST_SIZE];
281 /*
282 * Circular lists of locks and unlocks.
283 */
284 ctrace_t rtd_lock[CTRACE_HIST_SIZE];
285 ctrace_t rtd_unlock[CTRACE_HIST_SIZE];
286 /*
287 * Trash list linkage
288 */
289 TAILQ_ENTRY(rtentry_dbg) rtd_trash_link;
290};
291__CCT_DECLARE_CONSTRAINED_PTR_TYPES(struct rtentry_dbg, rtentry_dbg);
292
293/* List of trash route entries protected by rnh_lock */
294static TAILQ_HEAD(, rtentry_dbg) rttrash_head;
295
296static void rte_lock_init(struct rtentry *);
297static void rte_lock_destroy(struct rtentry *);
298static inline struct rtentry *rte_alloc_debug(void);
299static inline void rte_free_debug(struct rtentry *);
300static inline void rte_lock_debug(struct rtentry_dbg *);
301static inline void rte_unlock_debug(struct rtentry_dbg *);
302static void rt_maskedcopy(const struct sockaddr *,
303 struct sockaddr *, const struct sockaddr *);
304static void rtable_init(void **);
305static inline void rtref_audit(struct rtentry_dbg *);
306static inline void rtunref_audit(struct rtentry_dbg *);
307static struct rtentry *rtalloc1_common_locked(struct sockaddr *, int, uint32_t,
308 unsigned int);
309static int rtrequest_common_locked(int, struct sockaddr *,
310 struct sockaddr *, struct sockaddr *, int, struct rtentry **,
311 unsigned int);
312static struct rtentry *rtalloc1_locked(struct sockaddr *, int, uint32_t);
313static void rtalloc_ign_common_locked(struct route *, uint32_t, unsigned int);
314static inline void sin6_set_ifscope(struct sockaddr *, unsigned int);
315static inline void sin6_set_embedded_ifscope(struct sockaddr *, unsigned int);
316static inline unsigned int sin6_get_embedded_ifscope(struct sockaddr *);
317static struct sockaddr *ma_copy(int, struct sockaddr *,
318 struct sockaddr_storage *, unsigned int);
319static struct sockaddr *sa_trim(struct sockaddr *, uint8_t);
320static struct radix_node *node_lookup(struct sockaddr *, struct sockaddr *,
321 unsigned int);
322static struct radix_node *node_lookup_default(int);
323static struct rtentry *rt_lookup_common(boolean_t, boolean_t, struct sockaddr *,
324 struct sockaddr *, struct radix_node_head *, unsigned int);
325static int rn_match_ifscope(struct radix_node *, void *);
326static struct ifaddr *ifa_ifwithroute_common_locked(int,
327 const struct sockaddr *, const struct sockaddr *, unsigned int);
328static struct rtentry *rte_alloc(void);
329static void rte_free(struct rtentry *);
330static void rtfree_common(struct rtentry *, boolean_t);
331static void rte_if_ref(struct ifnet *, int);
332static void rt_set_idleref(struct rtentry *);
333static void rt_clear_idleref(struct rtentry *);
334static void rt_str4(struct rtentry *, char *, uint32_t, char *, uint32_t);
335static void rt_str6(struct rtentry *, char *, uint32_t, char *, uint32_t);
336static boolean_t route_ignore_protocol_cloning_for_dst(struct rtentry *, struct sockaddr *);
337
338uint32_t route_genid_inet = 0;
339uint32_t route_genid_inet6 = 0;
340
341#define ASSERT_SINIFSCOPE(sa) { \
342 if ((sa)->sa_family != AF_INET || \
343 (sa)->sa_len < sizeof (struct sockaddr_in)) \
344 panic("%s: bad sockaddr_in %p", __func__, sa); \
345}
346
347#define ASSERT_SIN6IFSCOPE(sa) { \
348 if ((sa)->sa_family != AF_INET6 || \
349 (sa)->sa_len < sizeof (struct sockaddr_in6)) \
350 panic("%s: bad sockaddr_in6 %p", __func__, sa); \
351}
352
353/*
354 * Argument to leaf-matching routine; at present it is scoped routing
355 * specific but can be expanded in future to include other search filters.
356 */
357struct matchleaf_arg {
358 unsigned int ifscope; /* interface scope */
359};
360
361/*
362 * For looking up the non-scoped default route (sockaddr instead
363 * of sockaddr_in for convenience).
364 */
365static struct sockaddr sin_def = {
366 .sa_len = sizeof(struct sockaddr_in),
367 .sa_family = AF_INET,
368 .sa_data = { 0, }
369};
370
371static struct sockaddr_in6 sin6_def = {
372 .sin6_len = sizeof(struct sockaddr_in6),
373 .sin6_family = AF_INET6,
374 .sin6_port = 0,
375 .sin6_flowinfo = 0,
376 .sin6_addr = IN6ADDR_ANY_INIT,
377 .sin6_scope_id = 0
378};
379
380/*
381 * Interface index (scope) of the primary interface; determined at
382 * the time when the default, non-scoped route gets added, changed
383 * or deleted. Protected by rnh_lock.
384 */
385static unsigned int primary_ifscope = IFSCOPE_NONE;
386static unsigned int primary6_ifscope = IFSCOPE_NONE;
387
388#define INET_DEFAULT(sa) \
389 ((sa)->sa_family == AF_INET && SIN(sa)->sin_addr.s_addr == 0)
390
391#define INET6_DEFAULT(sa) \
392 ((sa)->sa_family == AF_INET6 && \
393 IN6_IS_ADDR_UNSPECIFIED(&SIN6(sa)->sin6_addr))
394
395#define SA_DEFAULT(sa) (INET_DEFAULT(sa) || INET6_DEFAULT(sa))
396#define RT(r) ((rtentry_ref_t)r)
397#define RN(r) ((struct radix_node *)r)
398#define RT_HOST(r) (RT(r)->rt_flags & RTF_HOST)
399
400#define ROUTE_VERBOSE_LOGGING 0
401unsigned int rt_verbose = ROUTE_VERBOSE_LOGGING;
402SYSCTL_DECL(_net_route);
403SYSCTL_UINT(_net_route, OID_AUTO, verbose, CTLFLAG_RW | CTLFLAG_LOCKED,
404 &rt_verbose, ROUTE_VERBOSE_LOGGING, "");
405
406static void
407rtable_init(void **table)
408{
409 struct domain *dom;
410
411 domain_proto_mtx_lock_assert_held();
412
413 TAILQ_FOREACH(dom, &domains, dom_entry) {
414 if (dom->dom_rtattach != NULL) {
415 dom->dom_rtattach(&table[dom->dom_family],
416 dom->dom_rtoffset);
417 }
418 }
419}
420
421/*
422 * Called by route_dinit().
423 */
424void
425route_init(void)
426{
427 int size;
428
429 _CASSERT(offsetof(struct route, ro_rt) ==
430 offsetof(struct route_in6, ro_rt));
431 _CASSERT(offsetof(struct route, ro_srcia) ==
432 offsetof(struct route_in6, ro_srcia));
433 _CASSERT(offsetof(struct route, ro_flags) ==
434 offsetof(struct route_in6, ro_flags));
435 _CASSERT(offsetof(struct route, ro_dst) ==
436 offsetof(struct route_in6, ro_dst));
437
438 PE_parse_boot_argn(arg_string: "rte_debug", arg_ptr: &rte_debug, max_arg: sizeof(rte_debug));
439 if (rte_debug != 0) {
440 rte_debug |= RTD_DEBUG;
441 }
442
443 lck_mtx_lock(rnh_lock);
444 rn_init(); /* initialize all zeroes, all ones, mask table */
445 lck_mtx_unlock(rnh_lock);
446 rtable_init(table: (void **)rt_tables);
447
448 if (rte_debug & RTD_DEBUG) {
449 size = sizeof(struct rtentry_dbg);
450 } else {
451 size = sizeof(struct rtentry);
452 }
453
454 rte_zone = zone_create(RTE_ZONE_NAME, size, flags: ZC_NONE);
455
456 TAILQ_INIT(&rttrash_head);
457}
458
459/*
460 * Given a route, determine whether or not it is the non-scoped default
461 * route; dst typically comes from rt_key(rt) but may be coming from
462 * a separate place when rt is in the process of being created.
463 */
464boolean_t
465rt_primary_default(struct rtentry *rt, struct sockaddr *dst)
466{
467 return SA_DEFAULT(dst) && !(rt->rt_flags & RTF_IFSCOPE);
468}
469
470/*
471 * Set the ifscope of the primary interface; caller holds rnh_lock.
472 */
473void
474set_primary_ifscope(int af, unsigned int ifscope)
475{
476 if (af == AF_INET) {
477 primary_ifscope = ifscope;
478 } else {
479 primary6_ifscope = ifscope;
480 }
481}
482
483/*
484 * Return the ifscope of the primary interface; caller holds rnh_lock.
485 */
486unsigned int
487get_primary_ifscope(int af)
488{
489 return af == AF_INET ? primary_ifscope : primary6_ifscope;
490}
491
492/*
493 * Set the scope ID of a given a sockaddr_in.
494 */
495void
496sin_set_ifscope(struct sockaddr *sa, unsigned int ifscope)
497{
498 /* Caller must pass in sockaddr_in */
499 ASSERT_SINIFSCOPE(sa);
500
501 SINIFSCOPE(sa)->sin_scope_id = ifscope;
502}
503
504/*
505 * Set the scope ID of given a sockaddr_in6.
506 */
507static inline void
508sin6_set_ifscope(struct sockaddr *sa, unsigned int ifscope)
509{
510 /* Caller must pass in sockaddr_in6 */
511 ASSERT_SIN6IFSCOPE(sa);
512
513 SIN6IFSCOPE(sa)->sin6_scope_id = ifscope;
514}
515
516/*
517 * Given a sockaddr_in, return the scope ID to the caller.
518 */
519unsigned int
520sin_get_ifscope(struct sockaddr *sa)
521{
522 /* Caller must pass in sockaddr_in */
523 ASSERT_SINIFSCOPE(sa);
524
525 return SINIFSCOPE(sa)->sin_scope_id;
526}
527
528/*
529 * Given a sockaddr_in6, return the scope ID to the caller.
530 */
531unsigned int
532sin6_get_ifscope(struct sockaddr *sa)
533{
534 /* Caller must pass in sockaddr_in6 */
535 ASSERT_SIN6IFSCOPE(sa);
536
537 return SIN6IFSCOPE(sa)->sin6_scope_id;
538}
539
540static inline void
541sin6_set_embedded_ifscope(struct sockaddr *sa, unsigned int ifscope)
542{
543 if (!in6_embedded_scope) {
544 SIN6(sa)->sin6_scope_id = ifscope;
545 return;
546 }
547
548 /* Caller must pass in sockaddr_in6 */
549 ASSERT_SIN6IFSCOPE(sa);
550 VERIFY(IN6_IS_SCOPE_EMBED(&(SIN6(sa)->sin6_addr)));
551
552 SIN6(sa)->sin6_addr.s6_addr16[1] = htons((uint16_t)ifscope);
553}
554
555static inline unsigned int
556sin6_get_embedded_ifscope(struct sockaddr *sa)
557{
558 if (!in6_embedded_scope) {
559 return SIN6(sa)->sin6_scope_id;
560 }
561 /* Caller must pass in sockaddr_in6 */
562 ASSERT_SIN6IFSCOPE(sa);
563
564 return ntohs(SIN6(sa)->sin6_addr.s6_addr16[1]);
565}
566
567/*
568 * Copy a sockaddr_{in,in6} src to a dst storage and set scope ID into dst.
569 *
570 * To clear the scope ID, pass is a NULL pifscope. To set the scope ID, pass
571 * in a non-NULL pifscope with non-zero ifscope. Otherwise if pifscope is
572 * non-NULL and ifscope is IFSCOPE_NONE, the existing scope ID is left intact.
573 * In any case, the effective scope ID value is returned to the caller via
574 * pifscope, if it is non-NULL.
575 */
576struct sockaddr *
577sa_copy(struct sockaddr *src, struct sockaddr_storage *dst,
578 unsigned int *pifscope)
579{
580 int af = src->sa_family;
581 unsigned int ifscope = (pifscope != NULL) ? *pifscope : IFSCOPE_NONE;
582
583 VERIFY(af == AF_INET || af == AF_INET6);
584
585 bzero(s: dst, n: sizeof(*dst));
586
587 if (af == AF_INET) {
588 SOCKADDR_COPY(src, dst, sizeof(struct sockaddr_in));
589 dst->ss_len = sizeof(struct sockaddr_in);
590 if (pifscope == NULL || ifscope != IFSCOPE_NONE) {
591 sin_set_ifscope(SA(dst), ifscope);
592 }
593 } else {
594 SOCKADDR_COPY(src, dst, sizeof(struct sockaddr_in6));
595 dst->ss_len = sizeof(struct sockaddr_in6);
596 if (pifscope != NULL &&
597 IN6_IS_SCOPE_EMBED(&SIN6(dst)->sin6_addr)) {
598 unsigned int eifscope;
599 /*
600 * If the address contains the embedded scope ID,
601 * use that as the value for sin6_scope_id as long
602 * the caller doesn't insist on clearing it (by
603 * passing NULL) or setting it.
604 */
605 eifscope = sin6_get_embedded_ifscope(SA(dst));
606 if (eifscope != IFSCOPE_NONE && ifscope == IFSCOPE_NONE) {
607 ifscope = eifscope;
608 }
609 if (ifscope != IFSCOPE_NONE) {
610 /* Set ifscope from pifscope or eifscope */
611 sin6_set_ifscope(SA(dst), ifscope);
612 } else {
613 /* If sin6_scope_id has a value, use that one */
614 ifscope = sin6_get_ifscope(SA(dst));
615 }
616 /*
617 * If sin6_scope_id is set but the address doesn't
618 * contain the equivalent embedded value, set it.
619 */
620 if (ifscope != IFSCOPE_NONE && eifscope != ifscope) {
621 sin6_set_embedded_ifscope(SA(dst), ifscope);
622 }
623 } else if (pifscope == NULL || ifscope != IFSCOPE_NONE) {
624 sin6_set_ifscope(SA(dst), ifscope);
625 }
626 }
627
628 if (pifscope != NULL) {
629 *pifscope = (af == AF_INET) ? sin_get_ifscope(SA(dst)) :
630 sin6_get_ifscope(SA(dst));
631 }
632
633 return SA(dst);
634}
635
636/*
637 * Copy a mask from src to a dst storage and set scope ID into dst.
638 */
639static struct sockaddr *
640ma_copy(int af, struct sockaddr *src, struct sockaddr_storage *dst,
641 unsigned int ifscope)
642{
643 VERIFY(af == AF_INET || af == AF_INET6);
644
645 bzero(s: dst, n: sizeof(*dst));
646 rt_maskedcopy(src, SA(dst), src);
647
648 /*
649 * The length of the mask sockaddr would need to be adjusted
650 * to cover the additional {sin,sin6}_ifscope field; when ifscope
651 * is IFSCOPE_NONE, we'd end up clearing the scope ID field on
652 * the destination mask in addition to extending the length
653 * of the sockaddr, as a side effect. This is okay, as any
654 * trailing zeroes would be skipped by rn_addmask prior to
655 * inserting or looking up the mask in the mask tree.
656 */
657 if (af == AF_INET) {
658 SINIFSCOPE(dst)->sin_scope_id = ifscope;
659 SINIFSCOPE(dst)->sin_len =
660 offsetof(struct sockaddr_inifscope, sin_scope_id) +
661 sizeof(SINIFSCOPE(dst)->sin_scope_id);
662 } else {
663 SIN6IFSCOPE(dst)->sin6_scope_id = ifscope;
664 SIN6IFSCOPE(dst)->sin6_len =
665 offsetof(struct sockaddr_in6, sin6_scope_id) +
666 sizeof(SIN6IFSCOPE(dst)->sin6_scope_id);
667 }
668
669 return SA(dst);
670}
671
672/*
673 * Trim trailing zeroes on a sockaddr and update its length.
674 */
675static struct sockaddr *
676sa_trim(struct sockaddr *sa, uint8_t skip)
677{
678 caddr_t cp;
679 caddr_t base = (caddr_t)__SA_UTILS_CONV_TO_BYTES(sa) + skip;
680
681 if (sa->sa_len <= skip) {
682 return sa;
683 }
684
685 for (cp = base + (sa->sa_len - skip); cp > base && cp[-1] == 0;) {
686 cp--;
687 }
688
689 sa->sa_len = (uint8_t)(cp - base) + skip;
690 if (sa->sa_len < skip) {
691 /* Must not happen, and if so, panic */
692 panic("%s: broken logic (sa_len %d < skip %d )", __func__,
693 sa->sa_len, skip);
694 /* NOTREACHED */
695 } else if (sa->sa_len == skip) {
696 /* If we end up with all zeroes, then there's no mask */
697 sa->sa_len = 0;
698 }
699
700 return sa;
701}
702
703/*
704 * Called by rtm_msg{1,2} routines to "scrub" socket address structures of
705 * kernel private information, so that clients of the routing socket will
706 * not be confused by the presence of the information, or the side effect of
707 * the increased length due to that. The source sockaddr is not modified;
708 * instead, the scrubbing happens on the destination sockaddr storage that
709 * is passed in by the caller.
710 *
711 * Scrubbing entails:
712 * - removing embedded scope identifiers from network mask and destination
713 * IPv4 and IPv6 socket addresses
714 * - optionally removing global scope interface hardware addresses from
715 * link-layer interface addresses when the MAC framework check fails.
716 */
717struct sockaddr *
718rtm_scrub(int type, int idx, struct sockaddr *hint, struct sockaddr *sa,
719 void *buf __sized_by(buflen), uint32_t buflen, kauth_cred_t *credp)
720{
721 struct sockaddr_storage *ss = (struct sockaddr_storage *)buf;
722 struct sockaddr *ret = sa;
723
724 VERIFY(buf != NULL && buflen >= sizeof(*ss));
725 bzero(s: buf, n: buflen);
726
727 switch (idx) {
728 case RTAX_DST:
729 /*
730 * If this is for an AF_INET/AF_INET6 destination address,
731 * call sa_copy() to clear the scope ID field.
732 */
733 if (sa->sa_family == AF_INET &&
734 SINIFSCOPE(sa)->sin_scope_id != IFSCOPE_NONE) {
735 ret = sa_copy(src: sa, dst: ss, NULL);
736 } else if (sa->sa_family == AF_INET6 &&
737 SIN6IFSCOPE(sa)->sin6_scope_id != IFSCOPE_NONE) {
738 ret = sa_copy(src: sa, dst: ss, NULL);
739 }
740 break;
741
742 case RTAX_NETMASK: {
743 uint8_t skip, af;
744 /*
745 * If this is for a mask, we can't tell whether or not there
746 * is an valid scope ID value, as the span of bytes between
747 * sa_len and the beginning of the mask (offset of sin_addr in
748 * the case of AF_INET, or sin6_addr for AF_INET6) may be
749 * filled with all-ones by rn_addmask(), and hence we cannot
750 * rely on sa_family. Because of this, we use the sa_family
751 * of the hint sockaddr (RTAX_{DST,IFA}) as indicator as to
752 * whether or not the mask is to be treated as one for AF_INET
753 * or AF_INET6. Clearing the scope ID field involves setting
754 * it to IFSCOPE_NONE followed by calling sa_trim() to trim
755 * trailing zeroes from the storage sockaddr, which reverses
756 * what was done earlier by ma_copy() on the source sockaddr.
757 */
758 if (hint == NULL ||
759 ((af = hint->sa_family) != AF_INET && af != AF_INET6)) {
760 break; /* nothing to do */
761 }
762 skip = (af == AF_INET) ?
763 offsetof(struct sockaddr_in, sin_addr) :
764 offsetof(struct sockaddr_in6, sin6_addr);
765
766 if (sa->sa_len > skip && sa->sa_len <= sizeof(*ss)) {
767 SOCKADDR_COPY(sa, ss, sa->sa_len);
768 /*
769 * Don't use {sin,sin6}_set_ifscope() as sa_family
770 * and sa_len for the netmask might not be set to
771 * the corresponding expected values of the hint.
772 */
773 if (hint->sa_family == AF_INET) {
774 SINIFSCOPE(ss)->sin_scope_id = IFSCOPE_NONE;
775 } else {
776 SIN6IFSCOPE(ss)->sin6_scope_id = IFSCOPE_NONE;
777 }
778 ret = sa_trim(SA(ss), skip);
779
780 /*
781 * For AF_INET6 mask, set sa_len appropriately unless
782 * this is requested via systl_dumpentry(), in which
783 * case we return the raw value.
784 */
785 if (hint->sa_family == AF_INET6 &&
786 type != RTM_GET && type != RTM_GET2) {
787 SA(ret)->sa_len = sizeof(struct sockaddr_in6);
788 }
789 }
790 break;
791 }
792 case RTAX_GATEWAY: {
793 /*
794 * Break if the gateway is not AF_LINK type (indirect routes)
795 *
796 * Else, if is, check if it is resolved. If not yet resolved
797 * simply break else scrub the link layer address.
798 */
799 if ((sa->sa_family != AF_LINK) || (SDL(sa)->sdl_alen == 0)) {
800 break;
801 }
802 OS_FALLTHROUGH;
803 }
804
805 case RTAX_IFP: {
806 if (sa->sa_family == AF_LINK && credp) {
807 struct sockaddr_dl *sdl = SDL(buf);
808 const void *bytes;
809 size_t size;
810
811 /* caller should handle worst case: SOCK_MAXADDRLEN */
812 VERIFY(buflen >= sa->sa_len);
813
814 SOCKADDR_COPY(sa, sdl, sa->sa_len);
815 bytes = dlil_ifaddr_bytes(sdl, &size, credp);
816 if (bytes != CONST_LLADDR(sdl)) {
817 VERIFY(sdl->sdl_alen == size);
818 bcopy(src: bytes, LLADDR(sdl), n: size);
819 }
820 ret = SA(sdl);
821 }
822 break;
823 }
824 default:
825 break;
826 }
827
828 return ret;
829}
830
831/*
832 * Callback leaf-matching routine for rn_matchaddr_args used
833 * for looking up an exact match for a scoped route entry.
834 */
835static int
836rn_match_ifscope(struct radix_node *rn, void *arg)
837{
838 rtentry_ref_t rt = (rtentry_ref_t)rn;
839 struct matchleaf_arg *ma = arg;
840 int af = rt_key(rt)->sa_family;
841
842 if (!(rt->rt_flags & RTF_IFSCOPE) || (af != AF_INET && af != AF_INET6)) {
843 return 0;
844 }
845
846 return af == AF_INET ?
847 (SINIFSCOPE(rt_key(rt))->sin_scope_id == ma->ifscope) :
848 (SIN6IFSCOPE(rt_key(rt))->sin6_scope_id == ma->ifscope);
849}
850
851/*
852 * Atomically increment route generation counter
853 */
854void
855routegenid_update(void)
856{
857 routegenid_inet_update();
858 routegenid_inet6_update();
859}
860
861void
862routegenid_inet_update(void)
863{
864 os_atomic_inc(&route_genid_inet, relaxed);
865}
866
867void
868routegenid_inet6_update(void)
869{
870 os_atomic_inc(&route_genid_inet6, relaxed);
871}
872
873/*
874 * Packet routing routines.
875 */
876void
877rtalloc(struct route *ro)
878{
879 rtalloc_ign(ro, 0);
880}
881
882void
883rtalloc_scoped(struct route *ro, unsigned int ifscope)
884{
885 rtalloc_scoped_ign(ro, 0, ifscope);
886}
887
888static void
889rtalloc_ign_common_locked(struct route *ro, uint32_t ignore,
890 unsigned int ifscope)
891{
892 rtentry_ref_t rt;
893
894 if ((rt = ro->ro_rt) != NULL) {
895 RT_LOCK_SPIN(rt);
896 if (rt->rt_ifp != NULL && !ROUTE_UNUSABLE(ro)) {
897 RT_UNLOCK(rt);
898 return;
899 }
900 RT_UNLOCK(rt);
901 ROUTE_RELEASE_LOCKED(ro); /* rnh_lock already held */
902 }
903 ro->ro_rt = rtalloc1_common_locked(SA(&ro->ro_dst), 1, ignore, ifscope);
904 if (ro->ro_rt != NULL) {
905 RT_GENID_SYNC(ro->ro_rt);
906 RT_LOCK_ASSERT_NOTHELD(ro->ro_rt);
907 }
908}
909
910void
911rtalloc_ign(struct route *ro, uint32_t ignore)
912{
913 LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_NOTOWNED);
914 lck_mtx_lock(rnh_lock);
915 rtalloc_ign_common_locked(ro, ignore, IFSCOPE_NONE);
916 lck_mtx_unlock(rnh_lock);
917}
918
919void
920rtalloc_scoped_ign(struct route *ro, uint32_t ignore, unsigned int ifscope)
921{
922 LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_NOTOWNED);
923 lck_mtx_lock(rnh_lock);
924 rtalloc_ign_common_locked(ro, ignore, ifscope);
925 lck_mtx_unlock(rnh_lock);
926}
927
928static struct rtentry *
929rtalloc1_locked(struct sockaddr *dst, int report, uint32_t ignflags)
930{
931 return rtalloc1_common_locked(dst, report, ignflags, IFSCOPE_NONE);
932}
933
934struct rtentry *
935rtalloc1_scoped_locked(struct sockaddr *dst, int report, uint32_t ignflags,
936 unsigned int ifscope)
937{
938 return rtalloc1_common_locked(dst, report, ignflags, ifscope);
939}
940
941static boolean_t
942route_ignore_protocol_cloning_for_dst(struct rtentry *rt, struct sockaddr *dst)
943{
944 /*
945 * For now keep protocol cloning for any type of IPv4
946 * destination.
947 */
948 if (dst->sa_family != AF_INET6) {
949 return FALSE;
950 }
951
952 /*
953 * Limit protocol route creation of IPv6 ULA destinations
954 * from default route,
955 * Just to be safe, even though it doesn't affect routability,
956 * still allow protocol cloned routes if we happen to hit
957 * default route over companion link for ULA destination.
958 */
959 if (!IFNET_IS_COMPANION_LINK(rt->rt_ifp) &&
960 (rt->rt_flags & RTF_GATEWAY) &&
961 (rt->rt_flags & RTF_PRCLONING) &&
962 SA_DEFAULT(rt_key(rt)) &&
963 (IN6_IS_ADDR_UNIQUE_LOCAL(&SIN6(dst)->sin6_addr) || IN6_IS_SCOPE_EMBED(&SIN6(dst)->sin6_addr))) {
964 return TRUE;
965 }
966 return FALSE;
967}
968
969struct rtentry *
970rtalloc1_common_locked(struct sockaddr *dst, int report, uint32_t ignflags,
971 unsigned int ifscope)
972{
973 struct radix_node_head *rnh = rt_tables[dst->sa_family];
974 rtentry_ref_t rt = NULL;
975 rtentry_ref_t newrt = NULL;
976 struct rt_addrinfo info;
977 uint32_t nflags;
978 int err = 0;
979 u_char msgtype = RTM_MISS;
980
981 if (rnh == NULL) {
982 goto unreachable;
983 }
984
985 if (!in6_embedded_scope && dst->sa_family == AF_INET6) {
986 if (IN6_IS_SCOPE_EMBED(&SIN6(dst)->sin6_addr) &&
987 SIN6(dst)->sin6_scope_id == 0) {
988 SIN6(dst)->sin6_scope_id = ifscope;
989 }
990 }
991
992 /*
993 * Find the longest prefix or exact (in the scoped case) address match;
994 * callee adds a reference to entry and checks for root node as well
995 */
996 rt = rt_lookup(FALSE, dst, NULL, rnh, ifscope);
997 if (rt == NULL) {
998 goto unreachable;
999 }
1000
1001 /*
1002 * Explicitly ignore protocol cloning for certain destinations.
1003 * Some checks below are kind of redundant, as for now, RTF_PRCLONING
1004 * is only set on indirect (RTF_GATEWAY) routes.
1005 * Also, we do this only when the route lookup above, resulted in default
1006 * route.
1007 * This is done to ensure, the resulting indirect host route doesn't
1008 * interfere when routing table gets configured with a indirect subnet
1009 * route/direct subnet route that is more specific than the current
1010 * parent route of the resulting protocol cloned route.
1011 *
1012 * At the crux of it all, it is a problem that we maintain host cache
1013 * in the routing table. We should revisit this for a generic solution.
1014 */
1015 if (route_ignore_protocol_cloning_for_dst(rt, dst)) {
1016 ignflags |= RTF_PRCLONING;
1017 }
1018
1019 RT_LOCK_SPIN(rt);
1020 newrt = rt;
1021 nflags = rt->rt_flags & ~ignflags;
1022 RT_UNLOCK(rt);
1023
1024 if (report && (nflags & (RTF_CLONING | RTF_PRCLONING))) {
1025 /*
1026 * We are apparently adding (report = 0 in delete).
1027 * If it requires that it be cloned, do so.
1028 * (This implies it wasn't a HOST route.)
1029 */
1030 err = rtrequest_locked(RTM_RESOLVE, dst, NULL, NULL, 0, &newrt);
1031 if (err) {
1032 /*
1033 * If the cloning didn't succeed, maybe what we
1034 * have from lookup above will do. Return that;
1035 * no need to hold another reference since it's
1036 * already done.
1037 */
1038 newrt = rt;
1039 goto miss;
1040 }
1041
1042 /*
1043 * We cloned it; drop the original route found during lookup.
1044 * The resulted cloned route (newrt) would now have an extra
1045 * reference held during rtrequest.
1046 */
1047 rtfree_locked(rt);
1048
1049 /*
1050 * If the newly created cloned route is a direct host route
1051 * then also check if it is to a router or not.
1052 * If it is, then set the RTF_ROUTER flag on the host route
1053 * for the gateway.
1054 *
1055 * XXX It is possible for the default route to be created post
1056 * cloned route creation of router's IP.
1057 * We can handle that corner case by special handing for RTM_ADD
1058 * of default route.
1059 */
1060 if ((newrt->rt_flags & (RTF_HOST | RTF_LLINFO)) ==
1061 (RTF_HOST | RTF_LLINFO)) {
1062 rtentry_ref_t defrt = NULL;
1063 struct sockaddr_storage def_key;
1064
1065 bzero(s: &def_key, n: sizeof(def_key));
1066 def_key.ss_len = rt_key(newrt)->sa_len;
1067 def_key.ss_family = rt_key(newrt)->sa_family;
1068
1069 defrt = rtalloc1_scoped_locked(SA(&def_key),
1070 report: 0, ignflags: 0, ifscope: newrt->rt_ifp->if_index);
1071
1072 if (defrt) {
1073 if (sa_equal(rt_key(newrt), defrt->rt_gateway)) {
1074 newrt->rt_flags |= RTF_ROUTER;
1075 }
1076 rtfree_locked(defrt);
1077 }
1078 }
1079
1080 if ((rt = newrt) && (rt->rt_flags & RTF_XRESOLVE)) {
1081 /*
1082 * If the new route specifies it be
1083 * externally resolved, then go do that.
1084 */
1085 msgtype = RTM_RESOLVE;
1086 goto miss;
1087 }
1088 }
1089 goto done;
1090
1091unreachable:
1092 /*
1093 * Either we hit the root or couldn't find any match,
1094 * Which basically means "cant get there from here"
1095 */
1096 rtstat.rts_unreach++;
1097
1098miss:
1099 if (report) {
1100 /*
1101 * If required, report the failure to the supervising
1102 * Authorities.
1103 * For a delete, this is not an error. (report == 0)
1104 */
1105 bzero(s: (caddr_t)&info, n: sizeof(info));
1106 info.rti_info[RTAX_DST] = dst;
1107 rt_missmsg(msgtype, &info, 0, err);
1108 }
1109done:
1110 return newrt;
1111}
1112
1113struct rtentry *
1114rtalloc1(struct sockaddr *dst, int report, uint32_t ignflags)
1115{
1116 rtentry_ref_t entry;
1117 LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_NOTOWNED);
1118 lck_mtx_lock(rnh_lock);
1119 entry = rtalloc1_locked(dst, report, ignflags);
1120 lck_mtx_unlock(rnh_lock);
1121 return entry;
1122}
1123
1124struct rtentry *
1125rtalloc1_scoped(struct sockaddr *dst, int report, uint32_t ignflags,
1126 unsigned int ifscope)
1127{
1128 rtentry_ref_t entry;
1129 LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_NOTOWNED);
1130 lck_mtx_lock(rnh_lock);
1131 entry = rtalloc1_scoped_locked(dst, report, ignflags, ifscope);
1132 lck_mtx_unlock(rnh_lock);
1133 return entry;
1134}
1135
1136/*
1137 * Remove a reference count from an rtentry.
1138 * If the count gets low enough, take it out of the routing table
1139 */
1140void
1141rtfree_locked(struct rtentry *rt)
1142{
1143 rtfree_common(rt, TRUE);
1144}
1145
1146static void
1147rtfree_common(struct rtentry *rt, boolean_t locked)
1148{
1149 struct radix_node_head *rnh;
1150
1151 LCK_MTX_ASSERT(rnh_lock, locked ?
1152 LCK_MTX_ASSERT_OWNED : LCK_MTX_ASSERT_NOTOWNED);
1153
1154 /*
1155 * Atomically decrement the reference count and if it reaches 0,
1156 * and there is a close function defined, call the close function.
1157 */
1158 RT_LOCK_SPIN(rt);
1159 if (rtunref(rt) > 0) {
1160 RT_UNLOCK(rt);
1161 return;
1162 }
1163
1164 /*
1165 * To avoid violating lock ordering, we must drop rt_lock before
1166 * trying to acquire the global rnh_lock. If we are called with
1167 * rnh_lock held, then we already have exclusive access; otherwise
1168 * we do the lock dance.
1169 */
1170 if (!locked) {
1171 /*
1172 * Note that we check it again below after grabbing rnh_lock,
1173 * since it is possible that another thread doing a lookup wins
1174 * the race, grabs the rnh_lock first, and bumps up reference
1175 * count in which case the route should be left alone as it is
1176 * still in use. It's also possible that another thread frees
1177 * the route after we drop rt_lock; to prevent the route from
1178 * being freed, we hold an extra reference.
1179 */
1180 RT_ADDREF_LOCKED(rt);
1181 RT_UNLOCK(rt);
1182 lck_mtx_lock(rnh_lock);
1183 RT_LOCK_SPIN(rt);
1184 if (rtunref(rt) > 0) {
1185 /* We've lost the race, so abort */
1186 RT_UNLOCK(rt);
1187 goto done;
1188 }
1189 }
1190
1191 /*
1192 * We may be blocked on other lock(s) as part of freeing
1193 * the entry below, so convert from spin to full mutex.
1194 */
1195 RT_CONVERT_LOCK(rt);
1196
1197 LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
1198
1199 /* Negative refcnt must never happen */
1200 if (rt->rt_refcnt != 0) {
1201 panic("rt %p invalid refcnt %d", rt, rt->rt_refcnt);
1202 /* NOTREACHED */
1203 }
1204 /* Idle refcnt must have been dropped during rtunref() */
1205 VERIFY(!(rt->rt_flags & RTF_IFREF));
1206
1207 /*
1208 * find the tree for that address family
1209 * Note: in the case of igmp packets, there might not be an rnh
1210 */
1211 rnh = rt_tables[rt_key(rt)->sa_family];
1212
1213 /*
1214 * On last reference give the "close method" a chance to cleanup
1215 * private state. This also permits (for IPv4 and IPv6) a chance
1216 * to decide if the routing table entry should be purged immediately
1217 * or at a later time. When an immediate purge is to happen the
1218 * close routine typically issues RTM_DELETE which clears the RTF_UP
1219 * flag on the entry so that the code below reclaims the storage.
1220 */
1221 if (rnh != NULL && rnh->rnh_close != NULL) {
1222 rnh->rnh_close((struct radix_node *)rt, rnh);
1223 }
1224
1225 /*
1226 * If we are no longer "up" (and ref == 0) then we can free the
1227 * resources associated with the route.
1228 */
1229 if (!(rt->rt_flags & RTF_UP)) {
1230 rtentry_ref_t rt_parent;
1231 struct ifaddr *rt_ifa;
1232
1233 rt->rt_flags |= RTF_DEAD;
1234 if (rt->rt_nodes->rn_flags & (RNF_ACTIVE | RNF_ROOT)) {
1235 panic("rt %p freed while in radix tree", rt);
1236 /* NOTREACHED */
1237 }
1238 /*
1239 * the rtentry must have been removed from the routing table
1240 * so it is represented in rttrash; remove that now.
1241 */
1242 (void) OSDecrementAtomic(&rttrash);
1243 if (rte_debug & RTD_DEBUG) {
1244 TAILQ_REMOVE(&rttrash_head, (rtentry_dbg_ref_t)rt,
1245 rtd_trash_link);
1246 }
1247
1248 /*
1249 * release references on items we hold them on..
1250 * e.g other routes and ifaddrs.
1251 */
1252 if ((rt_parent = rt->rt_parent) != NULL) {
1253 rt->rt_parent = NULL;
1254 }
1255
1256 if ((rt_ifa = rt->rt_ifa) != NULL) {
1257 rt->rt_ifa = NULL;
1258 }
1259
1260 /*
1261 * Now free any attached link-layer info.
1262 */
1263 if (rt->rt_llinfo != NULL) {
1264 VERIFY(rt->rt_llinfo_free != NULL);
1265 (*rt->rt_llinfo_free)(rt->rt_llinfo);
1266 rt->rt_llinfo = NULL;
1267 }
1268
1269 /* Destroy eventhandler lists context */
1270 eventhandler_lists_ctxt_destroy(evthdlr_lists_ctxt: &rt->rt_evhdlr_ctxt);
1271
1272 /*
1273 * Route is no longer in the tree and refcnt is 0;
1274 * we have exclusive access, so destroy it.
1275 */
1276 RT_UNLOCK(rt);
1277 rte_lock_destroy(rt);
1278
1279 if (rt_parent != NULL) {
1280 rtfree_locked(rt: rt_parent);
1281 }
1282
1283 if (rt_ifa != NULL) {
1284 ifa_remref(ifa: rt_ifa);
1285 }
1286
1287 /*
1288 * The key is separately alloc'd so free it (see rt_setgate()).
1289 * This also frees the gateway, as they are always malloc'd
1290 * together.
1291 */
1292 rt_key_free(rt);
1293
1294 /*
1295 * Free any statistics that may have been allocated
1296 */
1297 nstat_route_detach(rte: rt);
1298
1299 /*
1300 * and the rtentry itself of course
1301 */
1302 rte_free(rt);
1303 } else {
1304 /*
1305 * The "close method" has been called, but the route is
1306 * still in the radix tree with zero refcnt, i.e. "up"
1307 * and in the cached state.
1308 */
1309 RT_UNLOCK(rt);
1310 }
1311done:
1312 if (!locked) {
1313 lck_mtx_unlock(rnh_lock);
1314 }
1315}
1316
1317void
1318rtfree(struct rtentry *rt)
1319{
1320 rtfree_common(rt, FALSE);
1321}
1322
1323/*
1324 * Decrements the refcount but does not free the route when
1325 * the refcount reaches zero. Unless you have really good reason,
1326 * use rtfree not rtunref.
1327 */
1328int
1329rtunref(struct rtentry *p)
1330{
1331 RT_LOCK_ASSERT_HELD(p);
1332
1333 if (p->rt_refcnt == 0) {
1334 panic("%s(%p) bad refcnt", __func__, p);
1335 /* NOTREACHED */
1336 } else if (--p->rt_refcnt == 0) {
1337 /*
1338 * Release any idle reference count held on the interface;
1339 * if the route is eligible, still UP and the refcnt becomes
1340 * non-zero at some point in future before it is purged from
1341 * the routing table, rt_set_idleref() will undo this.
1342 */
1343 rt_clear_idleref(p);
1344 }
1345
1346 if (rte_debug & RTD_DEBUG) {
1347 rtunref_audit((rtentry_dbg_ref_t)p);
1348 }
1349
1350 /* Return new value */
1351 return p->rt_refcnt;
1352}
1353
1354static inline void
1355rtunref_audit(struct rtentry_dbg *rte)
1356{
1357 uint16_t idx;
1358
1359 if (rte->rtd_inuse != RTD_INUSE) {
1360 panic("rtunref: on freed rte=%p", rte);
1361 /* NOTREACHED */
1362 }
1363 idx = os_atomic_inc_orig(&rte->rtd_refrele_cnt, relaxed) % CTRACE_HIST_SIZE;
1364 if (rte_debug & RTD_TRACE) {
1365 ctrace_record(&rte->rtd_refrele[idx]);
1366 }
1367}
1368
1369/*
1370 * Add a reference count from an rtentry.
1371 */
1372void
1373rtref(struct rtentry *p)
1374{
1375 RT_LOCK_ASSERT_HELD(p);
1376
1377 VERIFY((p->rt_flags & RTF_DEAD) == 0);
1378 if (++p->rt_refcnt == 0) {
1379 panic("%s(%p) bad refcnt", __func__, p);
1380 /* NOTREACHED */
1381 } else if (p->rt_refcnt == 1) {
1382 /*
1383 * Hold an idle reference count on the interface,
1384 * if the route is eligible for it.
1385 */
1386 rt_set_idleref(p);
1387 }
1388
1389 if (rte_debug & RTD_DEBUG) {
1390 rtref_audit((rtentry_dbg_ref_t)p);
1391 }
1392}
1393
1394static inline void
1395rtref_audit(struct rtentry_dbg *rte)
1396{
1397 uint16_t idx;
1398
1399 if (rte->rtd_inuse != RTD_INUSE) {
1400 panic("rtref_audit: on freed rte=%p", rte);
1401 /* NOTREACHED */
1402 }
1403 idx = os_atomic_inc_orig(&rte->rtd_refhold_cnt, relaxed) % CTRACE_HIST_SIZE;
1404 if (rte_debug & RTD_TRACE) {
1405 ctrace_record(&rte->rtd_refhold[idx]);
1406 }
1407}
1408
1409void
1410rtsetifa(struct rtentry *rt, struct ifaddr *ifa)
1411{
1412 LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
1413
1414 RT_LOCK_ASSERT_HELD(rt);
1415
1416 if (rt->rt_ifa == ifa) {
1417 return;
1418 }
1419
1420 /* Become a regular mutex, just in case */
1421 RT_CONVERT_LOCK(rt);
1422
1423 /* Release the old ifa */
1424 if (rt->rt_ifa) {
1425 ifa_remref(ifa: rt->rt_ifa);
1426 }
1427
1428 /* Set rt_ifa */
1429 rt->rt_ifa = ifa;
1430
1431 /* Take a reference to the ifa */
1432 if (rt->rt_ifa) {
1433 ifa_addref(ifa: rt->rt_ifa);
1434 }
1435}
1436
1437/*
1438 * Force a routing table entry to the specified
1439 * destination to go through the given gateway.
1440 * Normally called as a result of a routing redirect
1441 * message from the network layer.
1442 */
1443void
1444rtredirect(struct ifnet *ifp, struct sockaddr *dst, struct sockaddr *gateway,
1445 struct sockaddr *netmask, int flags, struct sockaddr *src,
1446 struct rtentry **rtp)
1447{
1448 rtentry_ref_t rt = NULL;
1449 int error = 0;
1450 short *stat = 0;
1451 struct rt_addrinfo info;
1452 struct ifaddr *ifa = NULL;
1453 unsigned int ifscope = (ifp != NULL) ? ifp->if_index : IFSCOPE_NONE;
1454 struct sockaddr_storage ss;
1455 int af = src->sa_family;
1456
1457 LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_NOTOWNED);
1458 lck_mtx_lock(rnh_lock);
1459
1460 /*
1461 * Transform src into the internal routing table form for
1462 * comparison against rt_gateway below.
1463 */
1464 if ((af == AF_INET) || (af == AF_INET6)) {
1465 src = sa_copy(src, dst: &ss, pifscope: &ifscope);
1466 }
1467
1468 /*
1469 * Verify the gateway is directly reachable; if scoped routing
1470 * is enabled, verify that it is reachable from the interface
1471 * where the ICMP redirect arrived on.
1472 */
1473 if ((ifa = ifa_ifwithnet_scoped(gateway, ifscope)) == NULL) {
1474 error = ENETUNREACH;
1475 goto out;
1476 }
1477
1478 /* Lookup route to the destination (from the original IP header) */
1479 rt = rtalloc1_scoped_locked(dst, report: 0, RTF_CLONING | RTF_PRCLONING, ifscope);
1480 if (rt != NULL) {
1481 RT_LOCK(rt);
1482 }
1483
1484 /*
1485 * If the redirect isn't from our current router for this dst,
1486 * it's either old or wrong. If it redirects us to ourselves,
1487 * we have a routing loop, perhaps as a result of an interface
1488 * going down recently. Holding rnh_lock here prevents the
1489 * possibility of rt_ifa/ifa's ifa_addr from changing (e.g.
1490 * in_ifinit), so okay to access ifa_addr without locking.
1491 */
1492 if (!(flags & RTF_DONE) && rt != NULL &&
1493 (!sa_equal(src, rt->rt_gateway) || !sa_equal(rt->rt_ifa->ifa_addr,
1494 ifa->ifa_addr))) {
1495 error = EINVAL;
1496 } else {
1497 ifa_remref(ifa);
1498 if ((ifa = ifa_ifwithaddr(gateway))) {
1499 ifa_remref(ifa);
1500 ifa = NULL;
1501 error = EHOSTUNREACH;
1502 }
1503 }
1504
1505 if (ifa) {
1506 ifa_remref(ifa);
1507 ifa = NULL;
1508 }
1509
1510 if (error) {
1511 if (rt != NULL) {
1512 RT_UNLOCK(rt);
1513 }
1514 goto done;
1515 }
1516
1517 /*
1518 * Create a new entry if we just got back a wildcard entry
1519 * or the the lookup failed. This is necessary for hosts
1520 * which use routing redirects generated by smart gateways
1521 * to dynamically build the routing tables.
1522 */
1523 if ((rt == NULL) || (rt_mask(rt) != NULL && rt_mask(rt)->sa_len < 2)) {
1524 goto create;
1525 }
1526 /*
1527 * Don't listen to the redirect if it's
1528 * for a route to an interface.
1529 */
1530 RT_LOCK_ASSERT_HELD(rt);
1531 if (rt->rt_flags & RTF_GATEWAY) {
1532 if (((rt->rt_flags & RTF_HOST) == 0) && (flags & RTF_HOST)) {
1533 /*
1534 * Changing from route to net => route to host.
1535 * Create new route, rather than smashing route
1536 * to net; similar to cloned routes, the newly
1537 * created host route is scoped as well.
1538 */
1539create:
1540 if (rt != NULL) {
1541 RT_UNLOCK(rt);
1542 }
1543 flags |= RTF_GATEWAY | RTF_DYNAMIC;
1544 error = rtrequest_scoped_locked(RTM_ADD, dst,
1545 gateway, netmask, flags, NULL, ifscope);
1546 stat = &rtstat.rts_dynamic;
1547 } else {
1548 /*
1549 * Smash the current notion of the gateway to
1550 * this destination. Should check about netmask!!!
1551 */
1552 rt->rt_flags |= RTF_MODIFIED;
1553 flags |= RTF_MODIFIED;
1554 stat = &rtstat.rts_newgateway;
1555 /*
1556 * add the key and gateway (in one malloc'd chunk).
1557 */
1558 error = rt_setgate(rt, rt_key(rt), gateway);
1559 RT_UNLOCK(rt);
1560 }
1561 } else {
1562 RT_UNLOCK(rt);
1563 error = EHOSTUNREACH;
1564 }
1565done:
1566 if (rt != NULL) {
1567 RT_LOCK_ASSERT_NOTHELD(rt);
1568 if (!error) {
1569 /* Enqueue event to refresh flow route entries */
1570 route_event_enqueue_nwk_wq_entry(rt, NULL, ROUTE_ENTRY_REFRESH, NULL, FALSE);
1571 if (rtp) {
1572 *rtp = rt;
1573 } else {
1574 rtfree_locked(rt);
1575 }
1576 } else {
1577 rtfree_locked(rt);
1578 }
1579 }
1580out:
1581 if (error) {
1582 rtstat.rts_badredirect++;
1583 } else {
1584 if (stat != NULL) {
1585 (*stat)++;
1586 }
1587
1588 if (af == AF_INET) {
1589 routegenid_inet_update();
1590 } else if (af == AF_INET6) {
1591 routegenid_inet6_update();
1592 }
1593 }
1594 lck_mtx_unlock(rnh_lock);
1595 bzero(s: (caddr_t)&info, n: sizeof(info));
1596 info.rti_info[RTAX_DST] = dst;
1597 info.rti_info[RTAX_GATEWAY] = gateway;
1598 info.rti_info[RTAX_NETMASK] = netmask;
1599 info.rti_info[RTAX_AUTHOR] = src;
1600 rt_missmsg(RTM_REDIRECT, &info, flags, error);
1601}
1602
1603/*
1604 * Routing table ioctl interface.
1605 */
1606int
1607rtioctl(unsigned long req, caddr_t data, struct proc *p)
1608{
1609#pragma unused(p, req, data)
1610 return ENXIO;
1611}
1612
1613struct ifaddr *
1614ifa_ifwithroute(
1615 int flags,
1616 const struct sockaddr *dst,
1617 const struct sockaddr *gateway)
1618{
1619 struct ifaddr *ifa;
1620
1621 lck_mtx_lock(rnh_lock);
1622 ifa = ifa_ifwithroute_locked(flags, dst, gateway);
1623 lck_mtx_unlock(rnh_lock);
1624
1625 return ifa;
1626}
1627
1628struct ifaddr *
1629ifa_ifwithroute_locked(int flags, const struct sockaddr *dst,
1630 const struct sockaddr *gateway)
1631{
1632 return ifa_ifwithroute_common_locked((flags & ~RTF_IFSCOPE), dst,
1633 gateway, IFSCOPE_NONE);
1634}
1635
1636struct ifaddr *
1637ifa_ifwithroute_scoped_locked(int flags, const struct sockaddr *dst,
1638 const struct sockaddr *gateway, unsigned int ifscope)
1639{
1640 if (ifscope != IFSCOPE_NONE) {
1641 flags |= RTF_IFSCOPE;
1642 } else {
1643 flags &= ~RTF_IFSCOPE;
1644 }
1645
1646 return ifa_ifwithroute_common_locked(flags, dst, gateway, ifscope);
1647}
1648
1649static struct ifaddr *
1650ifa_ifwithroute_common_locked(int flags, const struct sockaddr *dst,
1651 const struct sockaddr *gw, unsigned int ifscope)
1652{
1653 struct ifaddr *ifa = NULL;
1654 rtentry_ref_t rt = NULL;
1655 struct sockaddr_storage dst_ss, gw_ss;
1656
1657 if (!in6_embedded_scope) {
1658 const struct sockaddr_in6 *dst_addr = SIN6(dst);
1659 if (dst->sa_family == AF_INET6 &&
1660 IN6_IS_SCOPE_EMBED(&dst_addr->sin6_addr) &&
1661 ifscope == IFSCOPE_NONE) {
1662 ifscope = dst_addr->sin6_scope_id;
1663 VERIFY(ifscope != IFSCOPE_NONE);
1664 }
1665
1666 const struct sockaddr_in6 *gw_addr = SIN6(gw);
1667 if (dst->sa_family == AF_INET6 &&
1668 IN6_IS_SCOPE_EMBED(&gw_addr->sin6_addr) &&
1669 ifscope == IFSCOPE_NONE) {
1670 ifscope = gw_addr->sin6_scope_id;
1671 VERIFY(ifscope != IFSCOPE_NONE);
1672 }
1673
1674 if (ifscope != IFSCOPE_NONE) {
1675 flags |= RTF_IFSCOPE;
1676 } else {
1677 flags &= ~RTF_IFSCOPE;
1678 }
1679 }
1680
1681 LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
1682
1683 /*
1684 * Just in case the sockaddr passed in by the caller
1685 * contains a scope ID, make sure to clear it since
1686 * interface addresses aren't scoped.
1687 */
1688 if (dst != NULL &&
1689 ((dst->sa_family == AF_INET) ||
1690 (dst->sa_family == AF_INET6))) {
1691 dst = sa_copy(__DECONST_SA(dst), dst: &dst_ss, IN6_NULL_IF_EMBEDDED_SCOPE(&ifscope));
1692 }
1693
1694 if (gw != NULL &&
1695 ((gw->sa_family == AF_INET) ||
1696 (gw->sa_family == AF_INET6))) {
1697 gw = sa_copy(__DECONST_SA(gw), dst: &gw_ss, IN6_NULL_IF_EMBEDDED_SCOPE(&ifscope));
1698 }
1699
1700 if (!(flags & RTF_GATEWAY)) {
1701 /*
1702 * If we are adding a route to an interface,
1703 * and the interface is a pt to pt link
1704 * we should search for the destination
1705 * as our clue to the interface. Otherwise
1706 * we can use the local address.
1707 */
1708 if (flags & RTF_HOST) {
1709 ifa = ifa_ifwithdstaddr(dst);
1710 }
1711 if (ifa == NULL) {
1712 ifa = ifa_ifwithaddr_scoped(gw, ifscope);
1713 }
1714 } else {
1715 /*
1716 * If we are adding a route to a remote net
1717 * or host, the gateway may still be on the
1718 * other end of a pt to pt link.
1719 */
1720 if ((flags & RTF_IFSCOPE) != 0 && ifscope != IFSCOPE_NONE) {
1721 ifa = ifa_ifwithdstaddr_scoped(gw, ifscope);
1722 }
1723 if (ifa == NULL) {
1724 ifa = ifa_ifwithdstaddr(gw);
1725 }
1726 }
1727 if (ifa == NULL) {
1728 ifa = ifa_ifwithnet_scoped(gw, ifscope);
1729 }
1730 if (ifa == NULL) {
1731 /* Workaround to avoid gcc warning regarding const variable */
1732 rt = rtalloc1_scoped_locked(__DECONST_SA(dst),
1733 report: 0, ignflags: 0, ifscope);
1734 if (rt != NULL) {
1735 RT_LOCK_SPIN(rt);
1736 ifa = rt->rt_ifa;
1737 if (ifa != NULL) {
1738 /* Become a regular mutex */
1739 RT_CONVERT_LOCK(rt);
1740 ifa_addref(ifa);
1741 }
1742 RT_REMREF_LOCKED(rt);
1743 RT_UNLOCK(rt);
1744 rt = NULL;
1745 }
1746 }
1747 /*
1748 * Holding rnh_lock here prevents the possibility of ifa from
1749 * changing (e.g. in_ifinit), so it is safe to access its
1750 * ifa_addr (here and down below) without locking.
1751 */
1752 if (ifa != NULL && ifa->ifa_addr->sa_family != dst->sa_family) {
1753 struct ifaddr *newifa;
1754 /* Callee adds reference to newifa upon success */
1755 newifa = ifaof_ifpforaddr(dst, ifa->ifa_ifp);
1756 if (newifa != NULL) {
1757 ifa_remref(ifa);
1758 ifa = newifa;
1759 }
1760 }
1761 /*
1762 * If we are adding a gateway, it is quite possible that the
1763 * routing table has a static entry in place for the gateway,
1764 * that may not agree with info garnered from the interfaces.
1765 * The routing table should carry more precedence than the
1766 * interfaces in this matter. Must be careful not to stomp
1767 * on new entries from rtinit, hence (ifa->ifa_addr != gw).
1768 */
1769 if ((ifa == NULL || (gw != NULL &&
1770 !sa_equal(ifa->ifa_addr, __DECONST_SA(gw)))) &&
1771 (rt = rtalloc1_scoped_locked(__DECONST_SA(gw),
1772 report: 0, ignflags: 0, ifscope)) != NULL) {
1773 if (ifa != NULL) {
1774 ifa_remref(ifa);
1775 }
1776 RT_LOCK_SPIN(rt);
1777 ifa = rt->rt_ifa;
1778 if (ifa != NULL) {
1779 /* Become a regular mutex */
1780 RT_CONVERT_LOCK(rt);
1781 ifa_addref(ifa);
1782 }
1783 RT_REMREF_LOCKED(rt);
1784 RT_UNLOCK(rt);
1785 }
1786 /*
1787 * If an interface scope was specified, the interface index of
1788 * the found ifaddr must be equivalent to that of the scope;
1789 * otherwise there is no match.
1790 */
1791 if ((flags & RTF_IFSCOPE) &&
1792 ifa != NULL && ifa->ifa_ifp->if_index != ifscope) {
1793 ifa_remref(ifa);
1794 ifa = NULL;
1795 }
1796
1797 /*
1798 * ifa's address family must match destination's address family
1799 * after all is said and done.
1800 */
1801 if (ifa != NULL &&
1802 ifa->ifa_addr->sa_family != dst->sa_family) {
1803 ifa_remref(ifa);
1804 ifa = NULL;
1805 }
1806
1807 return ifa;
1808}
1809
1810static int rt_fixdelete(struct radix_node *, void *);
1811static int rt_fixchange(struct radix_node *, void *);
1812
1813struct rtfc_arg {
1814 struct rtentry *rt0;
1815 struct radix_node_head *rnh;
1816};
1817
1818int
1819rtrequest_locked(int req, struct sockaddr *dst, struct sockaddr *gateway,
1820 struct sockaddr *netmask, int flags, struct rtentry **ret_nrt)
1821{
1822 return rtrequest_common_locked(req, dst, gateway, netmask,
1823 (flags & ~RTF_IFSCOPE), ret_nrt, IFSCOPE_NONE);
1824}
1825
1826int
1827rtrequest_scoped_locked(int req, struct sockaddr *dst,
1828 struct sockaddr *gateway, struct sockaddr *netmask, int flags,
1829 struct rtentry **ret_nrt, unsigned int ifscope)
1830{
1831 if (ifscope != IFSCOPE_NONE) {
1832 flags |= RTF_IFSCOPE;
1833 } else {
1834 flags &= ~RTF_IFSCOPE;
1835 }
1836
1837 return rtrequest_common_locked(req, dst, gateway, netmask,
1838 flags, ret_nrt, ifscope);
1839}
1840
1841/*
1842 * Do appropriate manipulations of a routing tree given all the bits of
1843 * info needed.
1844 *
1845 * Storing the scope ID in the radix key is an internal job that should be
1846 * left to routines in this module. Callers should specify the scope value
1847 * to the "scoped" variants of route routines instead of manipulating the
1848 * key itself. This is typically done when creating a scoped route, e.g.
1849 * rtrequest(RTM_ADD). Once such a route is created and marked with the
1850 * RTF_IFSCOPE flag, callers can simply use its rt_key(rt) to clone it
1851 * (RTM_RESOLVE) or to remove it (RTM_DELETE). An exception to this is
1852 * during certain routing socket operations where the search key might be
1853 * derived from the routing message itself, in which case the caller must
1854 * specify the destination address and scope value for RTM_ADD/RTM_DELETE.
1855 */
1856static int
1857rtrequest_common_locked(int req, struct sockaddr *dst0,
1858 struct sockaddr *gateway, struct sockaddr *netmask, int flags,
1859 struct rtentry **ret_nrt, unsigned int ifscope)
1860{
1861 int error = 0;
1862 rtentry_ref_t rt;
1863 struct radix_node *rn;
1864 struct radix_node_head *rnh;
1865 struct ifaddr *ifa = NULL;
1866 struct sockaddr *ndst, *dst = dst0;
1867 struct sockaddr_storage ss, mask;
1868 struct timeval caltime;
1869 int af = dst->sa_family;
1870 void (*ifa_rtrequest)(int, struct rtentry *, struct sockaddr *);
1871
1872#define senderr(x) { error = x; goto bad; }
1873
1874 DTRACE_ROUTE6(rtrequest, int, req, struct sockaddr *, dst0,
1875 struct sockaddr *, gateway, struct sockaddr *, netmask,
1876 int, flags, unsigned int, ifscope);
1877
1878 LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
1879
1880#if !(DEVELOPMENT || DEBUG)
1881 /*
1882 * Setting the global internet flag external is only for testing
1883 */
1884 flags &= ~RTF_GLOBAL;
1885#endif /* !(DEVELOPMENT || DEBUG) */
1886
1887 /*
1888 * Find the correct routing tree to use for this Address Family
1889 */
1890 if ((rnh = rt_tables[af]) == NULL) {
1891 senderr(ESRCH);
1892 }
1893 /*
1894 * If we are adding a host route then we don't want to put
1895 * a netmask in the tree
1896 */
1897 if (flags & RTF_HOST) {
1898 netmask = NULL;
1899 }
1900
1901 /*
1902 * If Scoped Routing is enabled, use a local copy of the destination
1903 * address to store the scope ID into. This logic is repeated below
1904 * in the RTM_RESOLVE handler since the caller does not normally
1905 * specify such a flag during a resolve, as well as for the handling
1906 * of IPv4 link-local address; instead, it passes in the route used for
1907 * cloning for which the scope info is derived from. Note also that
1908 * in the case of RTM_DELETE, the address passed in by the caller
1909 * might already contain the scope ID info when it is the key itself,
1910 * thus making RTF_IFSCOPE unnecessary; one instance where it is
1911 * explicitly set is inside route_output() as part of handling a
1912 * routing socket request.
1913 */
1914 if (req != RTM_RESOLVE && ((af == AF_INET) || (af == AF_INET6))) {
1915 /* Transform dst into the internal routing table form */
1916 dst = sa_copy(src: dst, dst: &ss, pifscope: &ifscope);
1917
1918 /* Transform netmask into the internal routing table form */
1919 if (netmask != NULL) {
1920 netmask = ma_copy(af, src: netmask, dst: &mask, ifscope);
1921 }
1922
1923 if (ifscope != IFSCOPE_NONE) {
1924 flags |= RTF_IFSCOPE;
1925 }
1926 } else if ((flags & RTF_IFSCOPE) &&
1927 (af != AF_INET && af != AF_INET6)) {
1928 senderr(EINVAL);
1929 }
1930
1931 if (ifscope == IFSCOPE_NONE) {
1932 flags &= ~RTF_IFSCOPE;
1933 }
1934
1935 if (!in6_embedded_scope) {
1936 if (af == AF_INET6 &&
1937 IN6_IS_SCOPE_EMBED(&SIN6(dst)->sin6_addr) &&
1938 SIN6(dst)->sin6_scope_id == IFSCOPE_NONE) {
1939 SIN6(dst)->sin6_scope_id = ifscope;
1940 if (in6_embedded_scope_debug) {
1941 VERIFY(SIN6(dst)->sin6_scope_id != IFSCOPE_NONE);
1942 }
1943 }
1944
1945 if (af == AF_INET6 &&
1946 IN6_IS_SCOPE_EMBED(&SIN6(dst)->sin6_addr) &&
1947 ifscope == IFSCOPE_NONE) {
1948 ifscope = SIN6(dst)->sin6_scope_id;
1949 flags |= RTF_IFSCOPE;
1950 if (in6_embedded_scope_debug) {
1951 VERIFY(ifscope!= IFSCOPE_NONE);
1952 }
1953 }
1954 }
1955
1956 switch (req) {
1957 case RTM_DELETE: {
1958 rtentry_ref_t gwrt = NULL;
1959 boolean_t was_router = FALSE;
1960 uint32_t old_rt_refcnt = 0;
1961 /*
1962 * Remove the item from the tree and return it.
1963 * Complain if it is not there and do no more processing.
1964 */
1965 if ((rn = rnh->rnh_deladdr(dst, netmask, rnh)) == NULL) {
1966 senderr(ESRCH);
1967 }
1968 if (rn->rn_flags & (RNF_ACTIVE | RNF_ROOT)) {
1969 panic("rtrequest delete");
1970 /* NOTREACHED */
1971 }
1972 rt = RT(rn);
1973
1974 RT_LOCK(rt);
1975 old_rt_refcnt = rt->rt_refcnt;
1976 rt->rt_flags &= ~RTF_UP;
1977 /*
1978 * Release any idle reference count held on the interface
1979 * as this route is no longer externally visible.
1980 */
1981 rt_clear_idleref(rt);
1982 /*
1983 * Take an extra reference to handle the deletion of a route
1984 * entry whose reference count is already 0; e.g. an expiring
1985 * cloned route entry or an entry that was added to the table
1986 * with 0 reference. If the caller is interested in this route,
1987 * we will return it with the reference intact. Otherwise we
1988 * will decrement the reference via rtfree_locked() and then
1989 * possibly deallocate it.
1990 */
1991 RT_ADDREF_LOCKED(rt);
1992
1993 /*
1994 * For consistency, in case the caller didn't set the flag.
1995 */
1996 rt->rt_flags |= RTF_CONDEMNED;
1997
1998 /*
1999 * Clear RTF_ROUTER if it's set.
2000 */
2001 if (rt->rt_flags & RTF_ROUTER) {
2002 was_router = TRUE;
2003 VERIFY(rt->rt_flags & RTF_HOST);
2004 rt->rt_flags &= ~RTF_ROUTER;
2005 }
2006
2007 /*
2008 * Enqueue work item to invoke callback for this route entry
2009 *
2010 * If the old count is 0, it implies that last reference is being
2011 * removed and there's no one listening for this route event.
2012 */
2013 if (old_rt_refcnt != 0) {
2014 route_event_enqueue_nwk_wq_entry(rt, NULL,
2015 ROUTE_ENTRY_DELETED, NULL, TRUE);
2016 }
2017
2018 /*
2019 * Now search what's left of the subtree for any cloned
2020 * routes which might have been formed from this node.
2021 */
2022 if ((rt->rt_flags & (RTF_CLONING | RTF_PRCLONING)) &&
2023 rt_mask(rt)) {
2024 RT_UNLOCK(rt);
2025 rnh->rnh_walktree_from(rnh, dst, rt_mask(rt),
2026 rt_fixdelete, rt);
2027 RT_LOCK(rt);
2028 }
2029
2030 if (was_router) {
2031 struct route_event rt_ev;
2032 route_event_init(p_route_ev: &rt_ev, rt, NULL, route_ev_code: ROUTE_LLENTRY_DELETED);
2033 RT_UNLOCK(rt);
2034 (void) rnh->rnh_walktree(rnh,
2035 route_event_walktree, (void *)&rt_ev);
2036 RT_LOCK(rt);
2037 }
2038
2039 /*
2040 * Remove any external references we may have.
2041 */
2042 if ((gwrt = rt->rt_gwroute) != NULL) {
2043 rt->rt_gwroute = NULL;
2044 }
2045
2046 /*
2047 * give the protocol a chance to keep things in sync.
2048 */
2049 if ((ifa = rt->rt_ifa) != NULL) {
2050 IFA_LOCK_SPIN(ifa);
2051 ifa_rtrequest = ifa->ifa_rtrequest;
2052 IFA_UNLOCK(ifa);
2053 if (ifa_rtrequest != NULL) {
2054 ifa_rtrequest(RTM_DELETE, rt, NULL);
2055 }
2056 /* keep reference on rt_ifa */
2057 ifa = NULL;
2058 }
2059
2060 /*
2061 * one more rtentry floating around that is not
2062 * linked to the routing table.
2063 */
2064 (void) OSIncrementAtomic(&rttrash);
2065 if (rte_debug & RTD_DEBUG) {
2066 TAILQ_INSERT_TAIL(&rttrash_head,
2067 (rtentry_dbg_ref_t)rt, rtd_trash_link);
2068 }
2069
2070 /*
2071 * If this is the (non-scoped) default route, clear
2072 * the interface index used for the primary ifscope.
2073 */
2074 if (rt_primary_default(rt, rt_key(rt))) {
2075 set_primary_ifscope(rt_key(rt)->sa_family,
2076 IFSCOPE_NONE);
2077 if ((rt->rt_flags & RTF_STATIC) &&
2078 rt_key(rt)->sa_family == PF_INET6) {
2079 trigger_v6_defrtr_select = TRUE;
2080 }
2081 }
2082
2083#if NECP
2084 /*
2085 * If this is a change in a default route, update
2086 * necp client watchers to re-evaluate
2087 */
2088 if (SA_DEFAULT(rt_key(rt))) {
2089 if (rt->rt_ifp != NULL) {
2090 ifnet_touch_lastupdown(interface: rt->rt_ifp);
2091 }
2092 necp_update_all_clients();
2093 }
2094#endif /* NECP */
2095
2096 RT_UNLOCK(rt);
2097
2098 /*
2099 * This might result in another rtentry being freed if
2100 * we held its last reference. Do this after the rtentry
2101 * lock is dropped above, as it could lead to the same
2102 * lock being acquired if gwrt is a clone of rt.
2103 */
2104 if (gwrt != NULL) {
2105 rtfree_locked(rt: gwrt);
2106 }
2107
2108 /*
2109 * If the caller wants it, then it can have it,
2110 * but it's up to it to free the rtentry as we won't be
2111 * doing it.
2112 */
2113 if (ret_nrt != NULL) {
2114 /* Return the route to caller with reference intact */
2115 *ret_nrt = rt;
2116 } else {
2117 /* Dereference or deallocate the route */
2118 rtfree_locked(rt);
2119 }
2120 if (af == AF_INET) {
2121 routegenid_inet_update();
2122 } else if (af == AF_INET6) {
2123 routegenid_inet6_update();
2124 }
2125 break;
2126 }
2127 case RTM_RESOLVE:
2128 if (ret_nrt == NULL || (rt = *ret_nrt) == NULL) {
2129 senderr(EINVAL);
2130 }
2131 /*
2132 * According to the UNIX conformance tests, we need to return
2133 * ENETUNREACH when the parent route is RTF_REJECT.
2134 * However, there isn't any point in cloning RTF_REJECT
2135 * routes, so we immediately return an error.
2136 */
2137 if (rt->rt_flags & RTF_REJECT) {
2138 if (rt->rt_flags & RTF_HOST) {
2139 senderr(EHOSTUNREACH);
2140 } else {
2141 senderr(ENETUNREACH);
2142 }
2143 }
2144 /*
2145 * If cloning, we have the parent route given by the caller
2146 * and will use its rt_gateway, rt_rmx as part of the cloning
2147 * process below. Since rnh_lock is held at this point, the
2148 * parent's rt_ifa and rt_gateway will not change, and its
2149 * relevant rt_flags will not change as well. The only thing
2150 * that could change are the metrics, and thus we hold the
2151 * parent route's rt_lock later on during the actual copying
2152 * of rt_rmx.
2153 */
2154 ifa = rt->rt_ifa;
2155 ifa_addref(ifa);
2156 flags = rt->rt_flags &
2157 ~(RTF_CLONING | RTF_PRCLONING | RTF_STATIC);
2158 flags |= RTF_WASCLONED;
2159 gateway = rt->rt_gateway;
2160 if ((netmask = rt->rt_genmask) == NULL) {
2161 flags |= RTF_HOST;
2162 }
2163
2164 if (af != AF_INET && af != AF_INET6) {
2165 goto makeroute;
2166 }
2167
2168 /*
2169 * When scoped routing is enabled, cloned entries are
2170 * always scoped according to the interface portion of
2171 * the parent route. The exception to this are IPv4
2172 * link local addresses, or those routes that are cloned
2173 * from a RTF_PROXY route. For the latter, the clone
2174 * gets to keep the RTF_PROXY flag.
2175 */
2176 if ((af == AF_INET &&
2177 IN_LINKLOCAL(ntohl(SIN(dst)->sin_addr.s_addr))) ||
2178 (rt->rt_flags & RTF_PROXY)) {
2179 ifscope = IFSCOPE_NONE;
2180 flags &= ~RTF_IFSCOPE;
2181 /*
2182 * These types of cloned routes aren't currently
2183 * eligible for idle interface reference counting.
2184 */
2185 flags |= RTF_NOIFREF;
2186 } else {
2187 if (flags & RTF_IFSCOPE) {
2188 ifscope = (af == AF_INET) ?
2189 sin_get_ifscope(rt_key(rt)) :
2190 sin6_get_ifscope(rt_key(rt));
2191 } else {
2192 ifscope = rt->rt_ifp->if_index;
2193 flags |= RTF_IFSCOPE;
2194 }
2195 VERIFY(ifscope != IFSCOPE_NONE);
2196 }
2197
2198 /*
2199 * Transform dst into the internal routing table form,
2200 * clearing out the scope ID field if ifscope isn't set.
2201 */
2202 dst = sa_copy(src: dst, dst: &ss, pifscope: (ifscope == IFSCOPE_NONE) ?
2203 NULL : &ifscope);
2204
2205 /* Transform netmask into the internal routing table form */
2206 if (netmask != NULL) {
2207 netmask = ma_copy(af, src: netmask, dst: &mask, ifscope);
2208 }
2209
2210 goto makeroute;
2211
2212 case RTM_ADD:
2213 if ((flags & RTF_GATEWAY) && !gateway) {
2214 panic("rtrequest: RTF_GATEWAY but no gateway");
2215 /* NOTREACHED */
2216 }
2217 if (flags & RTF_IFSCOPE) {
2218 ifa = ifa_ifwithroute_scoped_locked(flags, dst: dst0,
2219 gateway, ifscope);
2220 } else {
2221 ifa = ifa_ifwithroute_locked(flags, dst: dst0, gateway);
2222 }
2223 if (ifa == NULL) {
2224 senderr(ENETUNREACH);
2225 }
2226makeroute:
2227 /*
2228 * We land up here for both RTM_RESOLVE and RTM_ADD
2229 * when we decide to create a route.
2230 */
2231 if ((rt = rte_alloc()) == NULL) {
2232 senderr(ENOBUFS);
2233 }
2234 Bzero(rt, sizeof(*rt));
2235 rte_lock_init(rt);
2236 eventhandler_lists_ctxt_init(evthdlr_lists_ctxt: &rt->rt_evhdlr_ctxt);
2237 getmicrotime(&caltime);
2238 rt->base_calendartime = caltime.tv_sec;
2239 rt->base_uptime = net_uptime();
2240 RT_LOCK(rt);
2241 rt->rt_flags = RTF_UP | flags;
2242
2243 /*
2244 * Point the generation ID to the tree's.
2245 */
2246 switch (af) {
2247 case AF_INET:
2248 rt->rt_tree_genid = &route_genid_inet;
2249 break;
2250 case AF_INET6:
2251 rt->rt_tree_genid = &route_genid_inet6;
2252 break;
2253 default:
2254 break;
2255 }
2256
2257 /*
2258 * Add the gateway. Possibly re-malloc-ing the storage for it
2259 * also add the rt_gwroute if possible.
2260 */
2261 if ((error = rt_setgate(rt, dst, gateway)) != 0) {
2262 int tmp = error;
2263 RT_UNLOCK(rt);
2264 nstat_route_detach(rte: rt);
2265 rte_lock_destroy(rt);
2266 rte_free(rt);
2267 senderr(tmp);
2268 }
2269
2270 /*
2271 * point to the (possibly newly malloc'd) dest address.
2272 */
2273 ndst = rt_key(rt);
2274
2275 /*
2276 * make sure it contains the value we want (masked if needed).
2277 */
2278 if (netmask) {
2279 rt_maskedcopy(dst, ndst, netmask);
2280 } else {
2281 SOCKADDR_COPY(dst, ndst, dst->sa_len);
2282 }
2283
2284 /*
2285 * Note that we now have a reference to the ifa.
2286 * This moved from below so that rnh->rnh_addaddr() can
2287 * examine the ifa and ifa->ifa_ifp if it so desires.
2288 */
2289 rtsetifa(rt, ifa);
2290 rt->rt_ifp = rt->rt_ifa->ifa_ifp;
2291
2292 /* XXX mtu manipulation will be done in rnh_addaddr -- itojun */
2293
2294 rn = rnh->rnh_addaddr((caddr_t)ndst, (caddr_t)netmask,
2295 rnh, rt->rt_nodes);
2296 if (rn == 0) {
2297 rtentry_ref_t rt2;
2298 /*
2299 * Uh-oh, we already have one of these in the tree.
2300 * We do a special hack: if the route that's already
2301 * there was generated by the protocol-cloning
2302 * mechanism, then we just blow it away and retry
2303 * the insertion of the new one.
2304 */
2305 if (flags & RTF_IFSCOPE) {
2306 rt2 = rtalloc1_scoped_locked(dst: dst0, report: 0,
2307 RTF_CLONING | RTF_PRCLONING, ifscope);
2308 } else {
2309 rt2 = rtalloc1_locked(dst, report: 0,
2310 RTF_CLONING | RTF_PRCLONING);
2311 }
2312 if (rt2 && rt2->rt_parent) {
2313 /*
2314 * rnh_lock is held here, so rt_key and
2315 * rt_gateway of rt2 will not change.
2316 */
2317 (void) rtrequest_locked(RTM_DELETE, rt_key(rt2),
2318 gateway: rt2->rt_gateway, rt_mask(rt2),
2319 flags: rt2->rt_flags, ret_nrt: 0);
2320 rtfree_locked(rt: rt2);
2321 rn = rnh->rnh_addaddr((caddr_t)ndst,
2322 (caddr_t)netmask, rnh, rt->rt_nodes);
2323 } else if (rt2) {
2324 /* undo the extra ref we got */
2325 rtfree_locked(rt: rt2);
2326 }
2327 }
2328
2329 /*
2330 * If it still failed to go into the tree,
2331 * then un-make it (this should be a function)
2332 */
2333 if (rn == NULL) {
2334 char dbuf[MAX_IPv6_STR_LEN], gbuf[MAX_IPv6_STR_LEN];
2335
2336 rt_str(rt, dbuf, sizeof(dbuf), gbuf, sizeof(gbuf));
2337 os_log_error(OS_LOG_DEFAULT, "%s: route already exists: "
2338 "%s->%s->%s",
2339 __func__, dbuf, gbuf,
2340 ((rt->rt_ifp != NULL) ?
2341 rt->rt_ifp->if_xname : ""));
2342
2343 /* Clear gateway route */
2344 rt_set_gwroute(rt, rt_key(rt), NULL);
2345 if (rt->rt_ifa) {
2346 ifa_remref(ifa: rt->rt_ifa);
2347 rt->rt_ifa = NULL;
2348 }
2349 rt_key_free(rt);
2350 RT_UNLOCK(rt);
2351 nstat_route_detach(rte: rt);
2352 rte_lock_destroy(rt);
2353 rte_free(rt);
2354 senderr(EEXIST);
2355 }
2356
2357 rt->rt_parent = NULL;
2358
2359 /*
2360 * If we got here from RESOLVE, then we are cloning so clone
2361 * the rest, and note that we are a clone (and increment the
2362 * parent's references). rnh_lock is still held, which prevents
2363 * a lookup from returning the newly-created route. Hence
2364 * holding and releasing the parent's rt_lock while still
2365 * holding the route's rt_lock is safe since the new route
2366 * is not yet externally visible.
2367 */
2368 if (req == RTM_RESOLVE) {
2369 RT_LOCK_SPIN(*ret_nrt);
2370 VERIFY((*ret_nrt)->rt_expire == 0 ||
2371 (*ret_nrt)->rt_rmx.rmx_expire != 0);
2372 VERIFY((*ret_nrt)->rt_expire != 0 ||
2373 (*ret_nrt)->rt_rmx.rmx_expire == 0);
2374 rt->rt_rmx = (*ret_nrt)->rt_rmx;
2375 rt_setexpire(rt, (*ret_nrt)->rt_expire);
2376 if ((*ret_nrt)->rt_flags &
2377 (RTF_CLONING | RTF_PRCLONING)) {
2378 rt->rt_parent = (*ret_nrt);
2379 RT_ADDREF_LOCKED(*ret_nrt);
2380 }
2381 RT_UNLOCK(*ret_nrt);
2382 }
2383
2384 /*
2385 * if this protocol has something to add to this then
2386 * allow it to do that as well.
2387 */
2388 IFA_LOCK_SPIN(ifa);
2389 ifa_rtrequest = ifa->ifa_rtrequest;
2390 IFA_UNLOCK(ifa);
2391 if (ifa_rtrequest != NULL) {
2392 /*
2393 * Can not use SA(ret_nrt ? *ret_nrt : NULL),
2394 * because *ret_nrt is not a sockadr.
2395 */
2396 ifa_rtrequest(req, rt,
2397 __unsafe_forge_single(struct sockaddr*, ret_nrt ? *ret_nrt : NULL));
2398 }
2399 ifa_remref(ifa);
2400 ifa = NULL;
2401
2402 /*
2403 * If this is the (non-scoped) default route, record
2404 * the interface index used for the primary ifscope.
2405 */
2406 if (rt_primary_default(rt, rt_key(rt))) {
2407 set_primary_ifscope(rt_key(rt)->sa_family,
2408 ifscope: rt->rt_ifp->if_index);
2409 }
2410
2411#if NECP
2412 /*
2413 * If this is a change in a default route, update
2414 * necp client watchers to re-evaluate
2415 */
2416 if (SA_DEFAULT(rt_key(rt))) {
2417 /*
2418 * Mark default routes as (potentially) leading to the global internet
2419 * this can be used for policy decisions.
2420 * The clone routes will inherit this flag.
2421 * We check against the host flag as this works for default routes that have
2422 * a gateway and defaults routes when all subnets are local.
2423 */
2424 if (req == RTM_ADD && (rt->rt_flags & RTF_HOST) == 0) {
2425 rt->rt_flags |= RTF_GLOBAL;
2426 }
2427 if (rt->rt_ifp != NULL) {
2428 ifnet_touch_lastupdown(interface: rt->rt_ifp);
2429 }
2430 necp_update_all_clients();
2431 }
2432#endif /* NECP */
2433
2434 /*
2435 * actually return a resultant rtentry and
2436 * give the caller a single reference.
2437 */
2438 if (ret_nrt) {
2439 *ret_nrt = rt;
2440 RT_ADDREF_LOCKED(rt);
2441 }
2442
2443 if (af == AF_INET) {
2444 routegenid_inet_update();
2445 } else if (af == AF_INET6) {
2446 routegenid_inet6_update();
2447 }
2448
2449 RT_GENID_SYNC(rt);
2450
2451 /*
2452 * We repeat the same procedures from rt_setgate() here
2453 * because they weren't completed when we called it earlier,
2454 * since the node was embryonic.
2455 */
2456 if ((rt->rt_flags & RTF_GATEWAY) && rt->rt_gwroute != NULL) {
2457 rt_set_gwroute(rt, rt_key(rt), rt->rt_gwroute);
2458 }
2459
2460 if (req == RTM_ADD &&
2461 !(rt->rt_flags & RTF_HOST) && rt_mask(rt) != NULL) {
2462 struct rtfc_arg arg;
2463 arg.rnh = rnh;
2464 arg.rt0 = rt;
2465 RT_UNLOCK(rt);
2466 rnh->rnh_walktree_from(rnh, rt_key(rt), rt_mask(rt),
2467 rt_fixchange, &arg);
2468 } else {
2469 RT_UNLOCK(rt);
2470 }
2471
2472 nstat_route_new_entry(rt);
2473 break;
2474 }
2475bad:
2476 if (ifa) {
2477 ifa_remref(ifa);
2478 }
2479 return error;
2480}
2481#undef senderr
2482
2483int
2484rtrequest(int req, struct sockaddr *dst, struct sockaddr *gateway,
2485 struct sockaddr *netmask, int flags, struct rtentry **ret_nrt)
2486{
2487 int error;
2488 LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_NOTOWNED);
2489 lck_mtx_lock(rnh_lock);
2490 error = rtrequest_locked(req, dst, gateway, netmask, flags, ret_nrt);
2491 lck_mtx_unlock(rnh_lock);
2492 return error;
2493}
2494
2495int
2496rtrequest_scoped(int req, struct sockaddr *dst, struct sockaddr *gateway,
2497 struct sockaddr *netmask, int flags, struct rtentry **ret_nrt,
2498 unsigned int ifscope)
2499{
2500 int error;
2501 LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_NOTOWNED);
2502 lck_mtx_lock(rnh_lock);
2503 error = rtrequest_scoped_locked(req, dst, gateway, netmask, flags,
2504 ret_nrt, ifscope);
2505 lck_mtx_unlock(rnh_lock);
2506 return error;
2507}
2508
2509/*
2510 * Called from rtrequest(RTM_DELETE, ...) to fix up the route's ``family''
2511 * (i.e., the routes related to it by the operation of cloning). This
2512 * routine is iterated over all potential former-child-routes by way of
2513 * rnh->rnh_walktree_from() above, and those that actually are children of
2514 * the late parent (passed in as VP here) are themselves deleted.
2515 */
2516static int
2517rt_fixdelete(struct radix_node *rn, void *vp)
2518{
2519 rtentry_ref_t rt = (rtentry_ref_t)rn;
2520 rtentry_ref_t rt0 = (rtentry_ref_t)vp;
2521
2522 LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
2523
2524 RT_LOCK(rt);
2525 if (rt->rt_parent == rt0 &&
2526 !(rt->rt_flags & (RTF_CLONING | RTF_PRCLONING))) {
2527 /*
2528 * Safe to drop rt_lock and use rt_key, since holding
2529 * rnh_lock here prevents another thread from calling
2530 * rt_setgate() on this route.
2531 */
2532 RT_UNLOCK(rt);
2533 return rtrequest_locked(RTM_DELETE, rt_key(rt), NULL,
2534 rt_mask(rt), flags: rt->rt_flags, NULL);
2535 }
2536 RT_UNLOCK(rt);
2537 return 0;
2538}
2539
2540/*
2541 * This routine is called from rt_setgate() to do the analogous thing for
2542 * adds and changes. There is the added complication in this case of a
2543 * middle insert; i.e., insertion of a new network route between an older
2544 * network route and (cloned) host routes. For this reason, a simple check
2545 * of rt->rt_parent is insufficient; each candidate route must be tested
2546 * against the (mask, value) of the new route (passed as before in vp)
2547 * to see if the new route matches it.
2548 *
2549 * XXX - it may be possible to do fixdelete() for changes and reserve this
2550 * routine just for adds. I'm not sure why I thought it was necessary to do
2551 * changes this way.
2552 */
2553static int
2554rt_fixchange(struct radix_node *rn, void *vp)
2555{
2556 rtentry_ref_t rt = (rtentry_ref_t)rn;
2557 struct rtfc_arg *ap = vp;
2558 rtentry_ref_t rt0 = ap->rt0;
2559 struct radix_node_head *rnh = ap->rnh;
2560 u_char *xk1, *xm1, *xk2, *xmp;
2561 int i, len;
2562
2563 LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
2564
2565 RT_LOCK(rt);
2566
2567 if (!rt->rt_parent ||
2568 (rt->rt_flags & (RTF_CLONING | RTF_PRCLONING))) {
2569 RT_UNLOCK(rt);
2570 return 0;
2571 }
2572
2573 if (rt->rt_parent == rt0) {
2574 goto delete_rt;
2575 }
2576
2577 /*
2578 * There probably is a function somewhere which does this...
2579 * if not, there should be.
2580 */
2581 len = imin(rt_key(rt0)->sa_len, rt_key(rt)->sa_len);
2582
2583 xk1 = (u_char *)rt_key(rt0);
2584 xm1 = (u_char *)rt_mask(rt0);
2585 xk2 = (u_char *)rt_key(rt);
2586
2587 /*
2588 * Avoid applying a less specific route; do this only if the parent
2589 * route (rt->rt_parent) is a network route, since otherwise its mask
2590 * will be NULL if it is a cloning host route.
2591 */
2592 if ((xmp = (u_char *)rt_mask(rt->rt_parent)) != NULL) {
2593 int mlen = rt_mask(rt->rt_parent)->sa_len;
2594 if (mlen > rt_mask(rt0)->sa_len) {
2595 RT_UNLOCK(rt);
2596 return 0;
2597 }
2598
2599 for (i = rnh->rnh_treetop->rn_offset; i < mlen; i++) {
2600 if ((xmp[i] & ~(xmp[i] ^ xm1[i])) != xmp[i]) {
2601 RT_UNLOCK(rt);
2602 return 0;
2603 }
2604 }
2605 }
2606
2607 for (i = rnh->rnh_treetop->rn_offset; i < len; i++) {
2608 if ((xk2[i] & xm1[i]) != xk1[i]) {
2609 RT_UNLOCK(rt);
2610 return 0;
2611 }
2612 }
2613
2614 /*
2615 * OK, this node is a clone, and matches the node currently being
2616 * changed/added under the node's mask. So, get rid of it.
2617 */
2618delete_rt:
2619 /*
2620 * Safe to drop rt_lock and use rt_key, since holding rnh_lock here
2621 * prevents another thread from calling rt_setgate() on this route.
2622 */
2623 RT_UNLOCK(rt);
2624 return rtrequest_locked(RTM_DELETE, rt_key(rt), NULL,
2625 rt_mask(rt), flags: rt->rt_flags, NULL);
2626}
2627
2628/*
2629 * Round up sockaddr len to multiples of 32-bytes. This will reduce
2630 * or even eliminate the need to re-allocate the chunk of memory used
2631 * for rt_key and rt_gateway in the event the gateway portion changes.
2632 * Certain code paths (e.g. IPsec) are notorious for caching the address
2633 * of rt_gateway; this rounding-up would help ensure that the gateway
2634 * portion never gets deallocated (though it may change contents) and
2635 * thus greatly simplifies things.
2636 */
2637#define SA_SIZE(x) (-(-((uintptr_t)(x)) & -(32)))
2638
2639/*
2640 * Sets the gateway and/or gateway route portion of a route; may be
2641 * called on an existing route to modify the gateway portion. Both
2642 * rt_key and rt_gateway are allocated out of the same memory chunk.
2643 * Route entry lock must be held by caller; this routine will return
2644 * with the lock held.
2645 */
2646int
2647rt_setgate(struct rtentry *rt, struct sockaddr *dst, struct sockaddr *gate)
2648{
2649 int dlen = (int)SA_SIZE(dst->sa_len), glen = (int)SA_SIZE(gate->sa_len);
2650 struct radix_node_head *rnh = NULL;
2651 boolean_t loop = FALSE;
2652
2653 if (dst->sa_family != AF_INET && dst->sa_family != AF_INET6) {
2654 return EINVAL;
2655 }
2656
2657 rnh = rt_tables[dst->sa_family];
2658 LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
2659 RT_LOCK_ASSERT_HELD(rt);
2660
2661 /*
2662 * If this is for a route that is on its way of being removed,
2663 * or is temporarily frozen, reject the modification request.
2664 */
2665 if (rt->rt_flags & RTF_CONDEMNED) {
2666 return EBUSY;
2667 }
2668
2669 /* Add an extra ref for ourselves */
2670 RT_ADDREF_LOCKED(rt);
2671
2672 if (rt->rt_flags & RTF_GATEWAY) {
2673 if ((dst->sa_len == gate->sa_len) &&
2674 (dst->sa_family == AF_INET || dst->sa_family == AF_INET6)) {
2675 struct sockaddr_storage dst_ss, gate_ss;
2676
2677 (void) sa_copy(src: dst, dst: &dst_ss, NULL);
2678 (void) sa_copy(src: gate, dst: &gate_ss, NULL);
2679
2680 loop = sa_equal(SA(&dst_ss), SA(&gate_ss));
2681 } else {
2682 loop = (dst->sa_len == gate->sa_len &&
2683 sa_equal(dst, gate));
2684 }
2685 }
2686
2687 /*
2688 * A (cloning) network route with the destination equal to the gateway
2689 * will create an endless loop (see notes below), so disallow it.
2690 */
2691 if (((rt->rt_flags & (RTF_HOST | RTF_GATEWAY | RTF_LLINFO)) ==
2692 RTF_GATEWAY) && loop) {
2693 /* Release extra ref */
2694 RT_REMREF_LOCKED(rt);
2695 return EADDRNOTAVAIL;
2696 }
2697
2698 /*
2699 * A host route with the destination equal to the gateway
2700 * will interfere with keeping LLINFO in the routing
2701 * table, so disallow it.
2702 */
2703 if (((rt->rt_flags & (RTF_HOST | RTF_GATEWAY | RTF_LLINFO)) ==
2704 (RTF_HOST | RTF_GATEWAY)) && loop) {
2705 /*
2706 * The route might already exist if this is an RTM_CHANGE
2707 * or a routing redirect, so try to delete it.
2708 */
2709 if (rt_key(rt) != NULL) {
2710 /*
2711 * Safe to drop rt_lock and use rt_key, rt_gateway,
2712 * since holding rnh_lock here prevents another thread
2713 * from calling rt_setgate() on this route.
2714 */
2715 RT_UNLOCK(rt);
2716 (void) rtrequest_locked(RTM_DELETE, rt_key(rt),
2717 gateway: rt->rt_gateway, rt_mask(rt), flags: rt->rt_flags, NULL);
2718 RT_LOCK(rt);
2719 }
2720 /* Release extra ref */
2721 RT_REMREF_LOCKED(rt);
2722 return EADDRNOTAVAIL;
2723 }
2724
2725 /*
2726 * The destination is not directly reachable. Get a route
2727 * to the next-hop gateway and store it in rt_gwroute.
2728 */
2729 if (rt->rt_flags & RTF_GATEWAY) {
2730 rtentry_ref_t gwrt;
2731 unsigned int ifscope;
2732
2733 if (dst->sa_family == AF_INET) {
2734 ifscope = sin_get_ifscope(sa: dst);
2735 } else if (dst->sa_family == AF_INET6) {
2736 ifscope = sin6_get_ifscope(sa: dst);
2737 } else {
2738 ifscope = IFSCOPE_NONE;
2739 }
2740
2741 RT_UNLOCK(rt);
2742 /*
2743 * Don't ignore RTF_CLONING, since we prefer that rt_gwroute
2744 * points to a clone rather than a cloning route; see above
2745 * check for cloning loop avoidance (dst == gate).
2746 */
2747 gwrt = rtalloc1_scoped_locked(dst: gate, report: 1, RTF_PRCLONING, ifscope);
2748 if (gwrt != NULL) {
2749 RT_LOCK_ASSERT_NOTHELD(gwrt);
2750 }
2751 RT_LOCK(rt);
2752
2753 /*
2754 * Cloning loop avoidance:
2755 *
2756 * In the presence of protocol-cloning and bad configuration,
2757 * it is possible to get stuck in bottomless mutual recursion
2758 * (rtrequest rt_setgate rtalloc1). We avoid this by not
2759 * allowing protocol-cloning to operate for gateways (which
2760 * is probably the correct choice anyway), and avoid the
2761 * resulting reference loops by disallowing any route to run
2762 * through itself as a gateway. This is obviously mandatory
2763 * when we get rt->rt_output(). It implies that a route to
2764 * the gateway must already be present in the system in order
2765 * for the gateway to be referred to by another route.
2766 */
2767 if (gwrt == rt) {
2768 RT_REMREF_LOCKED(gwrt);
2769 /* Release extra ref */
2770 RT_REMREF_LOCKED(rt);
2771 return EADDRINUSE; /* failure */
2772 }
2773
2774 /*
2775 * If scoped, the gateway route must use the same interface;
2776 * we're holding rnh_lock now, so rt_gateway and rt_ifp of gwrt
2777 * should not change and are freely accessible.
2778 */
2779 if (ifscope != IFSCOPE_NONE && (rt->rt_flags & RTF_IFSCOPE) &&
2780 gwrt != NULL && gwrt->rt_ifp != NULL &&
2781 gwrt->rt_ifp->if_index != ifscope) {
2782 rtfree_locked(rt: gwrt); /* rt != gwrt, no deadlock */
2783 /* Release extra ref */
2784 RT_REMREF_LOCKED(rt);
2785 return (rt->rt_flags & RTF_HOST) ?
2786 EHOSTUNREACH : ENETUNREACH;
2787 }
2788
2789 /* Check again since we dropped the lock above */
2790 if (rt->rt_flags & RTF_CONDEMNED) {
2791 if (gwrt != NULL) {
2792 rtfree_locked(rt: gwrt);
2793 }
2794 /* Release extra ref */
2795 RT_REMREF_LOCKED(rt);
2796 return EBUSY;
2797 }
2798
2799 /* Set gateway route; callee adds ref to gwrt if non-NULL */
2800 rt_set_gwroute(rt, dst, gwrt);
2801
2802 /*
2803 * In case the (non-scoped) default route gets modified via
2804 * an ICMP redirect, record the interface index used for the
2805 * primary ifscope. Also done in rt_setif() to take care
2806 * of the non-redirect cases.
2807 */
2808 if (rt_primary_default(rt, dst) && rt->rt_ifp != NULL) {
2809 set_primary_ifscope(af: dst->sa_family,
2810 ifscope: rt->rt_ifp->if_index);
2811 }
2812
2813#if NECP
2814 /*
2815 * If this is a change in a default route, update
2816 * necp client watchers to re-evaluate
2817 */
2818 if (SA_DEFAULT(dst)) {
2819 necp_update_all_clients();
2820 }
2821#endif /* NECP */
2822
2823 /*
2824 * Tell the kernel debugger about the new default gateway
2825 * if the gateway route uses the primary interface, or
2826 * if we are in a transient state before the non-scoped
2827 * default gateway is installed (similar to how the system
2828 * was behaving in the past). In future, it would be good
2829 * to do all this only when KDP is enabled.
2830 */
2831 if ((dst->sa_family == AF_INET) &&
2832 gwrt != NULL && gwrt->rt_gateway->sa_family == AF_LINK &&
2833 (gwrt->rt_ifp->if_index == get_primary_ifscope(AF_INET) ||
2834 get_primary_ifscope(AF_INET) == IFSCOPE_NONE)) {
2835 kdp_set_gateway_mac(SDL(gwrt->rt_gateway)->
2836 sdl_data);
2837 }
2838
2839 /* Release extra ref from rtalloc1() */
2840 if (gwrt != NULL) {
2841 RT_REMREF(gwrt);
2842 }
2843 }
2844
2845 /*
2846 * Prepare to store the gateway in rt_gateway. Both dst and gateway
2847 * are stored one after the other in the same malloc'd chunk. If we
2848 * have room, reuse the old buffer since rt_gateway already points
2849 * to the right place. Otherwise, malloc a new block and update
2850 * the 'dst' address and point rt_gateway to the right place.
2851 */
2852 if (rt->rt_gateway == NULL || glen > SA_SIZE(rt->rt_gateway->sa_len)) {
2853 caddr_t new;
2854
2855 /* The underlying allocation is done with M_WAITOK set */
2856 new = kalloc_data(dlen + glen, Z_WAITOK | Z_ZERO);
2857 if (new == NULL) {
2858 /* Clear gateway route */
2859 rt_set_gwroute(rt, dst, NULL);
2860 /* Release extra ref */
2861 RT_REMREF_LOCKED(rt);
2862 return ENOBUFS;
2863 }
2864
2865 /*
2866 * Copy from 'dst' and not rt_key(rt) because we can get
2867 * here to initialize a newly allocated route entry, in
2868 * which case rt_key(rt) is NULL (and so does rt_gateway).
2869 */
2870 SOCKADDR_COPY(dst, new, dst->sa_len);
2871 rt_key_free(rt); /* free old block; NULL is okay */
2872 rt->rt_nodes->rn_key = new;
2873 rt->rt_gateway = SA(new + dlen);
2874 }
2875
2876 /*
2877 * Copy the new gateway value into the memory chunk.
2878 */
2879 SOCKADDR_COPY(gate, rt->rt_gateway, gate->sa_len);
2880
2881 /*
2882 * For consistency between rt_gateway and rt_key(gwrt).
2883 */
2884 if ((rt->rt_flags & RTF_GATEWAY) && rt->rt_gwroute != NULL &&
2885 (rt->rt_gwroute->rt_flags & RTF_IFSCOPE)) {
2886 if (rt->rt_gateway->sa_family == AF_INET &&
2887 rt_key(rt->rt_gwroute)->sa_family == AF_INET) {
2888 sin_set_ifscope(sa: rt->rt_gateway,
2889 ifscope: sin_get_ifscope(rt_key(rt->rt_gwroute)));
2890 } else if (rt->rt_gateway->sa_family == AF_INET6 &&
2891 rt_key(rt->rt_gwroute)->sa_family == AF_INET6) {
2892 sin6_set_ifscope(sa: rt->rt_gateway,
2893 ifscope: sin6_get_ifscope(rt_key(rt->rt_gwroute)));
2894 }
2895 }
2896
2897 /*
2898 * This isn't going to do anything useful for host routes, so
2899 * don't bother. Also make sure we have a reasonable mask
2900 * (we don't yet have one during adds).
2901 */
2902 if (!(rt->rt_flags & RTF_HOST) && rt_mask(rt) != 0) {
2903 struct rtfc_arg arg;
2904 arg.rnh = rnh;
2905 arg.rt0 = rt;
2906 RT_UNLOCK(rt);
2907 rnh->rnh_walktree_from(rnh, rt_key(rt), rt_mask(rt),
2908 rt_fixchange, &arg);
2909 RT_LOCK(rt);
2910 }
2911
2912 /* Release extra ref */
2913 RT_REMREF_LOCKED(rt);
2914 return 0;
2915}
2916
2917#undef SA_SIZE
2918
2919void
2920rt_set_gwroute(struct rtentry *rt, struct sockaddr *dst, struct rtentry *gwrt)
2921{
2922 boolean_t gwrt_isrouter;
2923
2924 LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
2925 RT_LOCK_ASSERT_HELD(rt);
2926
2927 if (gwrt != NULL) {
2928 RT_ADDREF(gwrt); /* for this routine */
2929 }
2930 /*
2931 * Get rid of existing gateway route; if rt_gwroute is already
2932 * set to gwrt, this is slightly redundant (though safe since
2933 * we held an extra ref above) but makes the code simpler.
2934 */
2935 if (rt->rt_gwroute != NULL) {
2936 rtentry_ref_t ogwrt = rt->rt_gwroute;
2937
2938 VERIFY(rt != ogwrt); /* sanity check */
2939 rt->rt_gwroute = NULL;
2940 RT_UNLOCK(rt);
2941 rtfree_locked(rt: ogwrt);
2942 RT_LOCK(rt);
2943 VERIFY(rt->rt_gwroute == NULL);
2944 }
2945
2946 /*
2947 * And associate the new gateway route.
2948 */
2949 if ((rt->rt_gwroute = gwrt) != NULL) {
2950 RT_ADDREF(gwrt); /* for rt */
2951
2952 if (rt->rt_flags & RTF_WASCLONED) {
2953 /* rt_parent might be NULL if rt is embryonic */
2954 gwrt_isrouter = (rt->rt_parent != NULL &&
2955