1/* 2 * Copyright (c) 2000-2012 Apple Inc. All rights reserved. 3 * 4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ 5 * 6 * This file contains Original Code and/or Modifications of Original Code 7 * as defined in and that are subject to the Apple Public Source License 8 * Version 2.0 (the 'License'). You may not use this file except in 9 * compliance with the License. The rights granted to you under the License 10 * may not be used to create, or enable the creation or redistribution of, 11 * unlawful or unlicensed copies of an Apple operating system, or to 12 * circumvent, violate, or enable the circumvention or violation of, any 13 * terms of an Apple operating system software license agreement. 14 * 15 * Please obtain a copy of the License at 16 * http://www.opensource.apple.com/apsl/ and read it before using this file. 17 * 18 * The Original Code and all software distributed under the License are 19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER 20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, 21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, 22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. 23 * Please see the License for the specific language governing rights and 24 * limitations under the License. 25 * 26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ 27 */ 28/* 29 * Copyright (c) 1980, 1986, 1991, 1993 30 * The Regents of the University of California. All rights reserved. 31 * 32 * Redistribution and use in source and binary forms, with or without 33 * modification, are permitted provided that the following conditions 34 * are met: 35 * 1. Redistributions of source code must retain the above copyright 36 * notice, this list of conditions and the following disclaimer. 37 * 2. Redistributions in binary form must reproduce the above copyright 38 * notice, this list of conditions and the following disclaimer in the 39 * documentation and/or other materials provided with the distribution. 40 * 3. All advertising materials mentioning features or use of this software 41 * must display the following acknowledgement: 42 * This product includes software developed by the University of 43 * California, Berkeley and its contributors. 44 * 4. Neither the name of the University nor the names of its contributors 45 * may be used to endorse or promote products derived from this software 46 * without specific prior written permission. 47 * 48 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 49 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 50 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 51 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 52 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 53 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 54 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 55 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 56 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 57 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 58 * SUCH DAMAGE. 59 * 60 * @(#)route.c 8.2 (Berkeley) 11/15/93 61 * $FreeBSD: src/sys/net/route.c,v 1.59.2.3 2001/07/29 19:18:02 ume Exp $ 62 */ 63 64#include <sys/param.h> 65#include <sys/sysctl.h> 66#include <sys/systm.h> 67#include <sys/malloc.h> 68#include <sys/mbuf.h> 69#include <sys/socket.h> 70#include <sys/domain.h> 71#include <sys/syslog.h> 72#include <sys/queue.h> 73#include <sys/mcache.h> 74#include <sys/protosw.h> 75#include <kern/lock.h> 76#include <kern/zalloc.h> 77 78#include <net/if.h> 79#include <net/route.h> 80#include <net/ntstat.h> 81 82#include <netinet/in.h> 83#include <netinet/in_var.h> 84#include <netinet/ip_mroute.h> 85#include <netinet/ip_var.h> 86#include <netinet/ip6.h> 87 88#if INET6 89#include <netinet6/ip6_var.h> 90#include <netinet6/in6_var.h> 91#endif /* INET6 */ 92 93#include <net/if_dl.h> 94 95#include <libkern/OSAtomic.h> 96#include <libkern/OSDebug.h> 97 98#include <pexpert/pexpert.h> 99 100/* 101 * Synchronization notes: 102 * 103 * Routing entries fall under two locking domains: the global routing table 104 * lock (rnh_lock) and the per-entry lock (rt_lock); the latter is a mutex that 105 * resides (statically defined) in the rtentry structure. 106 * 107 * The locking domains for routing are defined as follows: 108 * 109 * The global routing lock is used to serialize all accesses to the radix 110 * trees defined by rt_tables[], as well as the tree of masks. This includes 111 * lookups, insertions and removals of nodes to/from the respective tree. 112 * It is also used to protect certain fields in the route entry that aren't 113 * often modified and/or require global serialization (more details below.) 114 * 115 * The per-route entry lock is used to serialize accesses to several routing 116 * entry fields (more details below.) Acquiring and releasing this lock is 117 * done via RT_LOCK() and RT_UNLOCK() routines. 118 * 119 * In cases where both rnh_lock and rt_lock must be held, the former must be 120 * acquired first in order to maintain lock ordering. It is not a requirement 121 * that rnh_lock be acquired first before rt_lock, but in case both must be 122 * acquired in succession, the correct lock ordering must be followed. 123 * 124 * The fields of the rtentry structure are protected in the following way: 125 * 126 * rt_nodes[] 127 * 128 * - Routing table lock (rnh_lock). 129 * 130 * rt_parent, rt_mask, rt_llinfo_free 131 * 132 * - Set once during creation and never changes; no locks to read. 133 * 134 * rt_flags, rt_genmask, rt_llinfo, rt_rmx, rt_refcnt, rt_gwroute 135 * 136 * - Routing entry lock (rt_lock) for read/write access. 137 * 138 * - Some values of rt_flags are either set once at creation time, 139 * or aren't currently used, and thus checking against them can 140 * be done without rt_lock: RTF_GATEWAY, RTF_HOST, RTF_DYNAMIC, 141 * RTF_DONE, RTF_XRESOLVE, RTF_STATIC, RTF_BLACKHOLE, RTF_ANNOUNCE, 142 * RTF_USETRAILERS, RTF_WASCLONED, RTF_PINNED, RTF_LOCAL, 143 * RTF_BROADCAST, RTF_MULTICAST, RTF_IFSCOPE, RTF_IFREF. 144 * 145 * rt_key, rt_gateway, rt_ifp, rt_ifa 146 * 147 * - Always written/modified with both rnh_lock and rt_lock held. 148 * 149 * - May be read freely with rnh_lock held, else must hold rt_lock 150 * for read access; holding both locks for read is also okay. 151 * 152 * - In the event rnh_lock is not acquired, or is not possible to be 153 * acquired across the operation, setting RTF_CONDEMNED on a route 154 * entry will prevent its rt_key, rt_gateway, rt_ifp and rt_ifa 155 * from being modified. This is typically done on a route that 156 * has been chosen for a removal (from the tree) prior to dropping 157 * the rt_lock, so that those values will remain the same until 158 * the route is freed. 159 * 160 * When rnh_lock is held rt_setgate(), rt_setif(), and rtsetifa() are 161 * single-threaded, thus exclusive. This flag will also prevent the 162 * route from being looked up via rt_lookup(). 163 * 164 * generation_id 165 * 166 * - Assumes that 32-bit writes are atomic; no locks. 167 * 168 * rt_dlt, rt_output 169 * 170 * - Currently unused; no locks. 171 * 172 * Operations on a route entry can be described as follows: 173 * 174 * CREATE an entry with reference count set to 0 as part of RTM_ADD/RESOLVE. 175 * 176 * INSERTION of an entry into the radix tree holds the rnh_lock, checks 177 * for duplicates and then adds the entry. rtrequest returns the entry 178 * after bumping up the reference count to 1 (for the caller). 179 * 180 * LOOKUP of an entry holds the rnh_lock and bumps up the reference count 181 * before returning; it is valid to also bump up the reference count using 182 * RT_ADDREF after the lookup has returned an entry. 183 * 184 * REMOVAL of an entry from the radix tree holds the rnh_lock, removes the 185 * entry but does not decrement the reference count. Removal happens when 186 * the route is explicitly deleted (RTM_DELETE) or when it is in the cached 187 * state and it expires. The route is said to be "down" when it is no 188 * longer present in the tree. Freeing the entry will happen on the last 189 * reference release of such a "down" route. 190 * 191 * RT_ADDREF/RT_REMREF operates on the routing entry which increments/ 192 * decrements the reference count, rt_refcnt, atomically on the rtentry. 193 * rt_refcnt is modified only using this routine. The general rule is to 194 * do RT_ADDREF in the function that is passing the entry as an argument, 195 * in order to prevent the entry from being freed by the callee. 196 */ 197 198#define equal(a1, a2) (bcmp((caddr_t)(a1), (caddr_t)(a2), (a1)->sa_len) == 0) 199 200extern void kdp_set_gateway_mac (void *gatewaymac); 201 202extern struct domain routedomain; 203struct route_cb route_cb; 204__private_extern__ struct rtstat rtstat = { 0, 0, 0, 0, 0 }; 205struct radix_node_head *rt_tables[AF_MAX+1]; 206 207decl_lck_mtx_data(,rnh_lock_data); /* global routing tables mutex */ 208lck_mtx_t *rnh_lock = &rnh_lock_data; 209static lck_attr_t *rnh_lock_attr; 210static lck_grp_t *rnh_lock_grp; 211static lck_grp_attr_t *rnh_lock_grp_attr; 212 213/* Lock group and attribute for routing entry locks */ 214static lck_attr_t *rte_mtx_attr; 215static lck_grp_t *rte_mtx_grp; 216static lck_grp_attr_t *rte_mtx_grp_attr; 217 218int rttrash = 0; /* routes not in table but not freed */ 219 220unsigned int rte_debug; 221 222/* Possible flags for rte_debug */ 223#define RTD_DEBUG 0x1 /* enable or disable rtentry debug facility */ 224#define RTD_TRACE 0x2 /* trace alloc, free, refcnt and lock */ 225#define RTD_NO_FREE 0x4 /* don't free (good to catch corruptions) */ 226 227#define RTE_NAME "rtentry" /* name for zone and rt_lock */ 228 229static struct zone *rte_zone; /* special zone for rtentry */ 230#define RTE_ZONE_MAX 65536 /* maximum elements in zone */ 231#define RTE_ZONE_NAME RTE_NAME /* name of rtentry zone */ 232 233#define RTD_INUSE 0xFEEDFACE /* entry is in use */ 234#define RTD_FREED 0xDEADBEEF /* entry is freed */ 235 236/* For gdb */ 237__private_extern__ unsigned int ctrace_stack_size = CTRACE_STACK_SIZE; 238__private_extern__ unsigned int ctrace_hist_size = CTRACE_HIST_SIZE; 239 240/* 241 * Debug variant of rtentry structure. 242 */ 243struct rtentry_dbg { 244 struct rtentry rtd_entry; /* rtentry */ 245 struct rtentry rtd_entry_saved; /* saved rtentry */ 246 uint32_t rtd_inuse; /* in use pattern */ 247 uint16_t rtd_refhold_cnt; /* # of rtref */ 248 uint16_t rtd_refrele_cnt; /* # of rtunref */ 249 uint32_t rtd_lock_cnt; /* # of locks */ 250 uint32_t rtd_unlock_cnt; /* # of unlocks */ 251 /* 252 * Alloc and free callers. 253 */ 254 ctrace_t rtd_alloc; 255 ctrace_t rtd_free; 256 /* 257 * Circular lists of rtref and rtunref callers. 258 */ 259 ctrace_t rtd_refhold[CTRACE_HIST_SIZE]; 260 ctrace_t rtd_refrele[CTRACE_HIST_SIZE]; 261 /* 262 * Circular lists of locks and unlocks. 263 */ 264 ctrace_t rtd_lock[CTRACE_HIST_SIZE]; 265 ctrace_t rtd_unlock[CTRACE_HIST_SIZE]; 266 /* 267 * Trash list linkage 268 */ 269 TAILQ_ENTRY(rtentry_dbg) rtd_trash_link; 270}; 271 272/* List of trash route entries protected by rnh_lock */ 273static TAILQ_HEAD(, rtentry_dbg) rttrash_head; 274 275static void rte_lock_init(struct rtentry *); 276static void rte_lock_destroy(struct rtentry *); 277static inline struct rtentry *rte_alloc_debug(void); 278static inline void rte_free_debug(struct rtentry *); 279static inline void rte_lock_debug(struct rtentry_dbg *); 280static inline void rte_unlock_debug(struct rtentry_dbg *); 281static void rt_maskedcopy(struct sockaddr *, 282 struct sockaddr *, struct sockaddr *); 283static void rtable_init(void **); 284static inline void rtref_audit(struct rtentry_dbg *); 285static inline void rtunref_audit(struct rtentry_dbg *); 286static struct rtentry *rtalloc1_common_locked(struct sockaddr *, int, uint32_t, 287 unsigned int); 288static int rtrequest_common_locked(int, struct sockaddr *, 289 struct sockaddr *, struct sockaddr *, int, struct rtentry **, 290 unsigned int); 291static struct rtentry *rtalloc1_locked(struct sockaddr *, int, uint32_t); 292static void rtalloc_ign_common_locked(struct route *, uint32_t, unsigned int); 293static inline void sin6_set_ifscope(struct sockaddr *, unsigned int); 294static inline void sin6_set_embedded_ifscope(struct sockaddr *, unsigned int); 295static inline unsigned int sin6_get_embedded_ifscope(struct sockaddr *); 296static struct sockaddr *sa_copy(struct sockaddr *, struct sockaddr_storage *, 297 unsigned int *); 298static struct sockaddr *ma_copy(int, struct sockaddr *, 299 struct sockaddr_storage *, unsigned int); 300static struct sockaddr *sa_trim(struct sockaddr *, int); 301static struct radix_node *node_lookup(struct sockaddr *, struct sockaddr *, 302 unsigned int); 303static struct radix_node *node_lookup_default(int); 304static int rn_match_ifscope(struct radix_node *, void *); 305static struct ifaddr *ifa_ifwithroute_common_locked(int, 306 const struct sockaddr *, const struct sockaddr *, unsigned int); 307static struct rtentry *rte_alloc(void); 308static void rte_free(struct rtentry *); 309static void rtfree_common(struct rtentry *, boolean_t); 310static void rte_if_ref(struct ifnet *, int); 311 312uint32_t route_generation = 0; 313 314/* 315 * sockaddr_in with scope ID field; this is used internally to keep 316 * track of scoped route entries in the routing table. The fact that 317 * such a value is embedded in the structure is an artifact of the 318 * current implementation which could change in future. 319 */ 320struct sockaddr_inifscope { 321 __uint8_t sin_len; 322 sa_family_t sin_family; 323 in_port_t sin_port; 324 struct in_addr sin_addr; 325 /* 326 * To avoid possible conflict with an overlaid sockaddr_inarp 327 * having sin_other set to SIN_PROXY, we use the first 4-bytes 328 * of sin_zero since sin_srcaddr is one of the unused fields 329 * in sockaddr_inarp. 330 */ 331 union { 332 char sin_zero[8]; 333 struct { 334 __uint32_t ifscope; 335 } _in_index; 336 } un; 337#define sin_scope_id un._in_index.ifscope 338}; 339 340#define SINIFSCOPE(sa) ((struct sockaddr_inifscope *)(size_t)(sa)) 341#define SIN6IFSCOPE(sa) SIN6(sa) 342 343#define ASSERT_SINIFSCOPE(sa) { \ 344 if ((sa)->sa_family != AF_INET || \ 345 (sa)->sa_len < sizeof (struct sockaddr_in)) \ 346 panic("%s: bad sockaddr_in %p\n", __func__, sa); \ 347} 348 349#define ASSERT_SIN6IFSCOPE(sa) { \ 350 if ((sa)->sa_family != AF_INET6 || \ 351 (sa)->sa_len < sizeof (struct sockaddr_in6)) \ 352 panic("%s: bad sockaddr_in %p\n", __func__, sa); \ 353} 354 355/* 356 * Argument to leaf-matching routine; at present it is scoped routing 357 * specific but can be expanded in future to include other search filters. 358 */ 359struct matchleaf_arg { 360 unsigned int ifscope; /* interface scope */ 361}; 362 363/* 364 * For looking up the non-scoped default route (sockaddr instead 365 * of sockaddr_in for convenience). 366 */ 367static struct sockaddr sin_def = { 368 sizeof (struct sockaddr_in), AF_INET, { 0, } 369}; 370 371static struct sockaddr_in6 sin6_def = { 372 sizeof (struct sockaddr_in6), AF_INET6, 0, 0, IN6ADDR_ANY_INIT, 0 373}; 374 375/* 376 * Interface index (scope) of the primary interface; determined at 377 * the time when the default, non-scoped route gets added, changed 378 * or deleted. Protected by rnh_lock. 379 */ 380static unsigned int primary_ifscope = IFSCOPE_NONE; 381static unsigned int primary6_ifscope = IFSCOPE_NONE; 382 383#define INET_DEFAULT(sa) \ 384 ((sa)->sa_family == AF_INET && SIN(sa)->sin_addr.s_addr == 0) 385 386#define INET6_DEFAULT(sa) \ 387 ((sa)->sa_family == AF_INET6 && \ 388 IN6_IS_ADDR_UNSPECIFIED(&SIN6(sa)->sin6_addr)) 389 390#define SA_DEFAULT(sa) (INET_DEFAULT(sa) || INET6_DEFAULT(sa)) 391#define RT(r) ((struct rtentry *)r) 392#define RN(r) ((struct radix_node *)r) 393#define RT_HOST(r) (RT(r)->rt_flags & RTF_HOST) 394 395SYSCTL_DECL(_net_idle_route); 396 397static int rt_if_idle_expire_timeout = RT_IF_IDLE_EXPIRE_TIMEOUT; 398SYSCTL_INT(_net_idle_route, OID_AUTO, expire_timeout, CTLFLAG_RW|CTLFLAG_LOCKED, 399 &rt_if_idle_expire_timeout, 0, "Default expiration time on routes for " 400 "interface idle reference counting"); 401 402/* 403 * Given a route, determine whether or not it is the non-scoped default 404 * route; dst typically comes from rt_key(rt) but may be coming from 405 * a separate place when rt is in the process of being created. 406 */ 407boolean_t 408rt_primary_default(struct rtentry *rt, struct sockaddr *dst) 409{ 410 return (SA_DEFAULT(dst) && !(rt->rt_flags & RTF_IFSCOPE)); 411} 412 413/* 414 * Set the ifscope of the primary interface; caller holds rnh_lock. 415 */ 416void 417set_primary_ifscope(int af, unsigned int ifscope) 418{ 419 if (af == AF_INET) 420 primary_ifscope = ifscope; 421 else 422 primary6_ifscope = ifscope; 423} 424 425/* 426 * Return the ifscope of the primary interface; caller holds rnh_lock. 427 */ 428unsigned int 429get_primary_ifscope(int af) 430{ 431 return (af == AF_INET ? primary_ifscope : primary6_ifscope); 432} 433 434/* 435 * Set the scope ID of a given a sockaddr_in. 436 */ 437void 438sin_set_ifscope(struct sockaddr *sa, unsigned int ifscope) 439{ 440 /* Caller must pass in sockaddr_in */ 441 ASSERT_SINIFSCOPE(sa); 442 443 SINIFSCOPE(sa)->sin_scope_id = ifscope; 444} 445 446/* 447 * Set the scope ID of given a sockaddr_in6. 448 */ 449static inline void 450sin6_set_ifscope(struct sockaddr *sa, unsigned int ifscope) 451{ 452 /* Caller must pass in sockaddr_in6 */ 453 ASSERT_SIN6IFSCOPE(sa); 454 455 SIN6IFSCOPE(sa)->sin6_scope_id = ifscope; 456} 457 458/* 459 * Given a sockaddr_in, return the scope ID to the caller. 460 */ 461unsigned int 462sin_get_ifscope(struct sockaddr *sa) 463{ 464 /* Caller must pass in sockaddr_in */ 465 ASSERT_SINIFSCOPE(sa); 466 467 return (SINIFSCOPE(sa)->sin_scope_id); 468} 469 470/* 471 * Given a sockaddr_in6, return the scope ID to the caller. 472 */ 473unsigned int 474sin6_get_ifscope(struct sockaddr *sa) 475{ 476 /* Caller must pass in sockaddr_in6 */ 477 ASSERT_SIN6IFSCOPE(sa); 478 479 return (SIN6IFSCOPE(sa)->sin6_scope_id); 480} 481 482static inline void 483sin6_set_embedded_ifscope(struct sockaddr *sa, unsigned int ifscope) 484{ 485 /* Caller must pass in sockaddr_in6 */ 486 ASSERT_SIN6IFSCOPE(sa); 487 VERIFY(IN6_IS_SCOPE_EMBED(&(SIN6(sa)->sin6_addr))); 488 489 SIN6(sa)->sin6_addr.s6_addr16[1] = htons(ifscope); 490} 491 492static inline unsigned int 493sin6_get_embedded_ifscope(struct sockaddr *sa) 494{ 495 /* Caller must pass in sockaddr_in6 */ 496 ASSERT_SIN6IFSCOPE(sa); 497 498 return (ntohs(SIN6(sa)->sin6_addr.s6_addr16[1])); 499} 500 501/* 502 * Copy a sockaddr_{in,in6} src to a dst storage and set scope ID into dst. 503 * 504 * To clear the scope ID, pass is a NULL pifscope. To set the scope ID, pass 505 * in a non-NULL pifscope with non-zero ifscope. Otherwise if pifscope is 506 * non-NULL and ifscope is IFSCOPE_NONE, the existing scope ID is left intact. 507 * In any case, the effective scope ID value is returned to the caller via 508 * pifscope, if it is non-NULL. 509 */ 510static struct sockaddr * 511sa_copy(struct sockaddr *src, struct sockaddr_storage *dst, 512 unsigned int *pifscope) 513{ 514 int af = src->sa_family; 515 unsigned int ifscope = (pifscope != NULL) ? *pifscope : IFSCOPE_NONE; 516 517 VERIFY(af == AF_INET || af == AF_INET6); 518 519 bzero(dst, sizeof (*dst)); 520 521 if (af == AF_INET) { 522 bcopy(src, dst, sizeof (struct sockaddr_in)); 523 if (pifscope == NULL || ifscope != IFSCOPE_NONE) 524 sin_set_ifscope(SA(dst), ifscope); 525 } else { 526 bcopy(src, dst, sizeof (struct sockaddr_in6)); 527 if (pifscope != NULL && 528 IN6_IS_SCOPE_EMBED(&SIN6(dst)->sin6_addr)) { 529 unsigned int eifscope; 530 /* 531 * If the address contains the embedded scope ID, 532 * use that as the value for sin6_scope_id as long 533 * the caller doesn't insist on clearing it (by 534 * passing NULL) or setting it. 535 */ 536 eifscope = sin6_get_embedded_ifscope(SA(dst)); 537 if (eifscope != IFSCOPE_NONE && ifscope == IFSCOPE_NONE) 538 ifscope = eifscope; 539 sin6_set_ifscope(SA(dst), ifscope); 540 /* 541 * If sin6_scope_id is set but the address doesn't 542 * contain the equivalent embedded value, set it. 543 */ 544 if (ifscope != IFSCOPE_NONE && eifscope != ifscope) 545 sin6_set_embedded_ifscope(SA(dst), ifscope); 546 } else if (pifscope == NULL || ifscope != IFSCOPE_NONE) { 547 sin6_set_ifscope(SA(dst), ifscope); 548 } 549 } 550 551 if (pifscope != NULL) { 552 *pifscope = (af == AF_INET) ? sin_get_ifscope(SA(dst)) : 553 sin6_get_ifscope(SA(dst)); 554 } 555 556 return (SA(dst)); 557} 558 559/* 560 * Copy a mask from src to a dst storage and set scope ID into dst. 561 */ 562static struct sockaddr * 563ma_copy(int af, struct sockaddr *src, struct sockaddr_storage *dst, 564 unsigned int ifscope) 565{ 566 VERIFY(af == AF_INET || af == AF_INET6); 567 568 bzero(dst, sizeof (*dst)); 569 rt_maskedcopy(src, SA(dst), src); 570 571 /* 572 * The length of the mask sockaddr would need to be adjusted 573 * to cover the additional {sin,sin6}_ifscope field; when ifscope 574 * is IFSCOPE_NONE, we'd end up clearing the scope ID field on 575 * the destination mask in addition to extending the length 576 * of the sockaddr, as a side effect. This is okay, as any 577 * trailing zeroes would be skipped by rn_addmask prior to 578 * inserting or looking up the mask in the mask tree. 579 */ 580 if (af == AF_INET) { 581 SINIFSCOPE(dst)->sin_scope_id = ifscope; 582 SINIFSCOPE(dst)->sin_len = 583 offsetof(struct sockaddr_inifscope, sin_scope_id) + 584 sizeof (SINIFSCOPE(dst)->sin_scope_id); 585 } else { 586 SIN6IFSCOPE(dst)->sin6_scope_id = ifscope; 587 SIN6IFSCOPE(dst)->sin6_len = 588 offsetof(struct sockaddr_in6, sin6_scope_id) + 589 sizeof (SIN6IFSCOPE(dst)->sin6_scope_id); 590 } 591 592 return (SA(dst)); 593} 594 595/* 596 * Trim trailing zeroes on a sockaddr and update its length. 597 */ 598static struct sockaddr * 599sa_trim(struct sockaddr *sa, int skip) 600{ 601 caddr_t cp, base = (caddr_t)sa + skip; 602 603 if (sa->sa_len <= skip) 604 return (sa); 605 606 for (cp = base + (sa->sa_len - skip); cp > base && cp[-1] == 0;) 607 cp--; 608 609 sa->sa_len = (cp - base) + skip; 610 if (sa->sa_len < skip) { 611 /* Must not happen, and if so, panic */ 612 panic("%s: broken logic (sa_len %d < skip %d )", __func__, 613 sa->sa_len, skip); 614 /* NOTREACHED */ 615 } else if (sa->sa_len == skip) { 616 /* If we end up with all zeroes, then there's no mask */ 617 sa->sa_len = 0; 618 } 619 620 return (sa); 621} 622 623/* 624 * Called by rtm_msg{1,2} routines to "scrub" the scope ID field away from 625 * the socket address structure, so that clients of the routing socket will 626 * not be confused by the presence of the information, or the side effect of 627 * the increased length due to that. The source sockaddr is not modified; 628 * instead, the scrubbing happens on the destination sockaddr storage that 629 * is passed in by the caller. 630 */ 631struct sockaddr * 632rtm_scrub_ifscope(int type, int idx, struct sockaddr *hint, struct sockaddr *sa, 633 struct sockaddr_storage *ss) 634{ 635 struct sockaddr *ret = sa; 636 637 switch (idx) { 638 case RTAX_DST: 639 /* 640 * If this is for an AF_INET/AF_INET6 destination address, 641 * call sa_copy() to clear the scope ID field. 642 */ 643 if (sa->sa_family == AF_INET && 644 SINIFSCOPE(sa)->sin_scope_id != IFSCOPE_NONE) { 645 ret = sa_copy(sa, ss, NULL); 646 } else if (sa->sa_family == AF_INET6 && 647 SIN6IFSCOPE(sa)->sin6_scope_id != IFSCOPE_NONE) { 648 ret = sa_copy(sa, ss, NULL); 649 } 650 break; 651 652 case RTAX_NETMASK: { 653 int skip, af; 654 /* 655 * If this is for a mask, we can't tell whether or not there 656 * is an valid scope ID value, as the span of bytes between 657 * sa_len and the beginning of the mask (offset of sin_addr in 658 * the case of AF_INET, or sin6_addr for AF_INET6) may be 659 * filled with all-ones by rn_addmask(), and hence we cannot 660 * rely on sa_family. Because of this, we use the sa_family 661 * of the hint sockaddr (RTAX_{DST,IFA}) as indicator as to 662 * whether or not the mask is to be treated as one for AF_INET 663 * or AF_INET6. Clearing the scope ID field involves setting 664 * it to IFSCOPE_NONE followed by calling sa_trim() to trim 665 * trailing zeroes from the storage sockaddr, which reverses 666 * what was done earlier by ma_copy() on the source sockaddr. 667 */ 668 if (hint == NULL || 669 ((af = hint->sa_family) != AF_INET && af != AF_INET6)) 670 break; /* nothing to do */ 671 672 skip = (af == AF_INET) ? 673 offsetof(struct sockaddr_in, sin_addr) : 674 offsetof(struct sockaddr_in6, sin6_addr); 675 676 if (sa->sa_len > skip && sa->sa_len <= sizeof (*ss)) { 677 bzero(ss, sizeof (*ss)); 678 bcopy(sa, ss, sa->sa_len); 679 /* 680 * Don't use {sin,sin6}_set_ifscope() as sa_family 681 * and sa_len for the netmask might not be set to 682 * the corresponding expected values of the hint. 683 */ 684 if (hint->sa_family == AF_INET) 685 SINIFSCOPE(ss)->sin_scope_id = IFSCOPE_NONE; 686 else 687 SIN6IFSCOPE(ss)->sin6_scope_id = IFSCOPE_NONE; 688 ret = sa_trim(SA(ss), skip); 689 690 /* 691 * For AF_INET6 mask, set sa_len appropriately unless 692 * this is requested via systl_dumpentry(), in which 693 * case we return the raw value. 694 */ 695 if (hint->sa_family == AF_INET6 && 696 type != RTM_GET && type != RTM_GET2) 697 SA(ret)->sa_len = sizeof (struct sockaddr_in6); 698 } 699 break; 700 } 701 default: 702 break; 703 } 704 705 return (ret); 706} 707 708/* 709 * Callback leaf-matching routine for rn_matchaddr_args used 710 * for looking up an exact match for a scoped route entry. 711 */ 712static int 713rn_match_ifscope(struct radix_node *rn, void *arg) 714{ 715 struct rtentry *rt = (struct rtentry *)rn; 716 struct matchleaf_arg *ma = arg; 717 int af = rt_key(rt)->sa_family; 718 719 if (!(rt->rt_flags & RTF_IFSCOPE) || (af != AF_INET && af != AF_INET6)) 720 return (0); 721 722 return (af == AF_INET ? 723 (SINIFSCOPE(rt_key(rt))->sin_scope_id == ma->ifscope) : 724 (SIN6IFSCOPE(rt_key(rt))->sin6_scope_id == ma->ifscope)); 725} 726 727static void 728rtable_init(void **table) 729{ 730 struct domain *dom; 731 for (dom = domains; dom; dom = dom->dom_next) 732 if (dom->dom_rtattach) 733 dom->dom_rtattach(&table[dom->dom_family], 734 dom->dom_rtoffset); 735} 736 737void 738route_init(void) 739{ 740 int size; 741 742 PE_parse_boot_argn("rte_debug", &rte_debug, sizeof (rte_debug)); 743 if (rte_debug != 0) 744 rte_debug |= RTD_DEBUG; 745 746 rnh_lock_grp_attr = lck_grp_attr_alloc_init(); 747 rnh_lock_grp = lck_grp_alloc_init("route", rnh_lock_grp_attr); 748 rnh_lock_attr = lck_attr_alloc_init(); 749 lck_mtx_init(rnh_lock, rnh_lock_grp, rnh_lock_attr); 750 751 rte_mtx_grp_attr = lck_grp_attr_alloc_init(); 752 rte_mtx_grp = lck_grp_alloc_init(RTE_NAME, rte_mtx_grp_attr); 753 rte_mtx_attr = lck_attr_alloc_init(); 754 755 lck_mtx_lock(rnh_lock); 756 rn_init(); /* initialize all zeroes, all ones, mask table */ 757 lck_mtx_unlock(rnh_lock); 758 rtable_init((void **)rt_tables); 759 760 if (rte_debug & RTD_DEBUG) 761 size = sizeof (struct rtentry_dbg); 762 else 763 size = sizeof (struct rtentry); 764 765 rte_zone = zinit(size, RTE_ZONE_MAX * size, 0, RTE_ZONE_NAME); 766 if (rte_zone == NULL) 767 panic("route_init: failed allocating rte_zone"); 768 769 zone_change(rte_zone, Z_EXPAND, TRUE); 770 zone_change(rte_zone, Z_CALLERACCT, FALSE); 771 zone_change(rte_zone, Z_NOENCRYPT, TRUE); 772 773 TAILQ_INIT(&rttrash_head); 774} 775 776/* 777 * Atomically increment route generation counter 778 */ 779void 780routegenid_update(void) 781{ 782 (void) atomic_add_32_ov(&route_generation, 1); 783} 784 785/* 786 * Packet routing routines. 787 */ 788void 789rtalloc(struct route *ro) 790{ 791 rtalloc_ign(ro, 0); 792} 793 794void 795rtalloc_scoped(struct route *ro, unsigned int ifscope) 796{ 797 rtalloc_scoped_ign(ro, 0, ifscope); 798} 799 800static void 801rtalloc_ign_common_locked(struct route *ro, uint32_t ignore, 802 unsigned int ifscope) 803{ 804 struct rtentry *rt; 805 806 if ((rt = ro->ro_rt) != NULL) { 807 RT_LOCK_SPIN(rt); 808 if (rt->rt_ifp != NULL && (rt->rt_flags & RTF_UP) && 809 rt->generation_id == route_generation) { 810 RT_UNLOCK(rt); 811 return; 812 } 813 RT_UNLOCK(rt); 814 rtfree_locked(rt); 815 ro->ro_rt = NULL; 816 } 817 ro->ro_rt = rtalloc1_common_locked(&ro->ro_dst, 1, ignore, ifscope); 818 if (ro->ro_rt != NULL) { 819 ro->ro_rt->generation_id = route_generation; 820 RT_LOCK_ASSERT_NOTHELD(ro->ro_rt); 821 } 822} 823 824void 825rtalloc_ign(struct route *ro, uint32_t ignore) 826{ 827 lck_mtx_assert(rnh_lock, LCK_MTX_ASSERT_NOTOWNED); 828 lck_mtx_lock(rnh_lock); 829 rtalloc_ign_common_locked(ro, ignore, IFSCOPE_NONE); 830 lck_mtx_unlock(rnh_lock); 831} 832 833void 834rtalloc_scoped_ign(struct route *ro, uint32_t ignore, unsigned int ifscope) 835{ 836 lck_mtx_assert(rnh_lock, LCK_MTX_ASSERT_NOTOWNED); 837 lck_mtx_lock(rnh_lock); 838 rtalloc_ign_common_locked(ro, ignore, ifscope); 839 lck_mtx_unlock(rnh_lock); 840} 841 842static struct rtentry * 843rtalloc1_locked(struct sockaddr *dst, int report, uint32_t ignflags) 844{ 845 return (rtalloc1_common_locked(dst, report, ignflags, IFSCOPE_NONE)); 846} 847 848struct rtentry * 849rtalloc1_scoped_locked(struct sockaddr *dst, int report, uint32_t ignflags, 850 unsigned int ifscope) 851{ 852 return (rtalloc1_common_locked(dst, report, ignflags, ifscope)); 853} 854 855/* 856 * Look up the route that matches the address given 857 * Or, at least try.. Create a cloned route if needed. 858 */ 859static struct rtentry * 860rtalloc1_common_locked(struct sockaddr *dst, int report, uint32_t ignflags, 861 unsigned int ifscope) 862{ 863 struct radix_node_head *rnh = rt_tables[dst->sa_family]; 864 struct rtentry *rt, *newrt = NULL; 865 struct rt_addrinfo info; 866 uint32_t nflags; 867 int err = 0, msgtype = RTM_MISS; 868 869 if (rnh == NULL) 870 goto unreachable; 871 872 /* 873 * Find the longest prefix or exact (in the scoped case) address match; 874 * callee adds a reference to entry and checks for root node as well 875 */ 876 rt = rt_lookup(FALSE, dst, NULL, rnh, ifscope); 877 if (rt == NULL) 878 goto unreachable; 879 880 RT_LOCK_SPIN(rt); 881 newrt = rt; 882 nflags = rt->rt_flags & ~ignflags; 883 RT_UNLOCK(rt); 884 if (report && (nflags & (RTF_CLONING | RTF_PRCLONING))) { 885 /* 886 * We are apparently adding (report = 0 in delete). 887 * If it requires that it be cloned, do so. 888 * (This implies it wasn't a HOST route.) 889 */ 890 err = rtrequest_locked(RTM_RESOLVE, dst, NULL, NULL, 0, &newrt); 891 if (err) { 892 /* 893 * If the cloning didn't succeed, maybe what we 894 * have from lookup above will do. Return that; 895 * no need to hold another reference since it's 896 * already done. 897 */ 898 newrt = rt; 899 goto miss; 900 } 901 902 /* 903 * We cloned it; drop the original route found during lookup. 904 * The resulted cloned route (newrt) would now have an extra 905 * reference held during rtrequest. 906 */ 907 rtfree_locked(rt); 908 if ((rt = newrt) && (rt->rt_flags & RTF_XRESOLVE)) { 909 /* 910 * If the new route specifies it be 911 * externally resolved, then go do that. 912 */ 913 msgtype = RTM_RESOLVE; 914 goto miss; 915 } 916 } 917 goto done; 918 919unreachable: 920 /* 921 * Either we hit the root or couldn't find any match, 922 * Which basically means "cant get there from here" 923 */ 924 rtstat.rts_unreach++; 925miss: 926 if (report) { 927 /* 928 * If required, report the failure to the supervising 929 * Authorities. 930 * For a delete, this is not an error. (report == 0) 931 */ 932 bzero((caddr_t)&info, sizeof(info)); 933 info.rti_info[RTAX_DST] = dst; 934 rt_missmsg(msgtype, &info, 0, err); 935 } 936done: 937 return (newrt); 938} 939 940struct rtentry * 941rtalloc1(struct sockaddr *dst, int report, uint32_t ignflags) 942{ 943 struct rtentry * entry; 944 lck_mtx_assert(rnh_lock, LCK_MTX_ASSERT_NOTOWNED); 945 lck_mtx_lock(rnh_lock); 946 entry = rtalloc1_locked(dst, report, ignflags); 947 lck_mtx_unlock(rnh_lock); 948 return (entry); 949} 950 951struct rtentry * 952rtalloc1_scoped(struct sockaddr *dst, int report, uint32_t ignflags, 953 unsigned int ifscope) 954{ 955 struct rtentry * entry; 956 lck_mtx_assert(rnh_lock, LCK_MTX_ASSERT_NOTOWNED); 957 lck_mtx_lock(rnh_lock); 958 entry = rtalloc1_scoped_locked(dst, report, ignflags, ifscope); 959 lck_mtx_unlock(rnh_lock); 960 return (entry); 961} 962 963/* 964 * Remove a reference count from an rtentry. 965 * If the count gets low enough, take it out of the routing table 966 */ 967void 968rtfree_locked(struct rtentry *rt) 969{ 970 rtfree_common(rt, TRUE); 971} 972 973static void 974rtfree_common(struct rtentry *rt, boolean_t locked) 975{ 976 struct radix_node_head *rnh; 977 978 /* 979 * Atomically decrement the reference count and if it reaches 0, 980 * and there is a close function defined, call the close function. 981 */ 982 RT_LOCK_SPIN(rt); 983 if (rtunref(rt) > 0) { 984 RT_UNLOCK(rt); 985 return; 986 } 987 988 /* 989 * To avoid violating lock ordering, we must drop rt_lock before 990 * trying to acquire the global rnh_lock. If we are called with 991 * rnh_lock held, then we already have exclusive access; otherwise 992 * we do the lock dance. 993 */ 994 if (!locked) { 995 /* 996 * Note that we check it again below after grabbing rnh_lock, 997 * since it is possible that another thread doing a lookup wins 998 * the race, grabs the rnh_lock first, and bumps up the reference 999 * count in which case the route should be left alone as it is 1000 * still in use. It's also possible that another thread frees 1001 * the route after we drop rt_lock; to prevent the route from 1002 * being freed, we hold an extra reference. 1003 */ 1004 RT_ADDREF_LOCKED(rt); 1005 RT_UNLOCK(rt); 1006 lck_mtx_lock(rnh_lock); 1007 RT_LOCK_SPIN(rt); 1008 RT_REMREF_LOCKED(rt); 1009 if (rt->rt_refcnt > 0) { 1010 /* We've lost the race, so abort */ 1011 RT_UNLOCK(rt); 1012 goto done; 1013 } 1014 } 1015 1016 /* 1017 * We may be blocked on other lock(s) as part of freeing 1018 * the entry below, so convert from spin to full mutex. 1019 */ 1020 RT_CONVERT_LOCK(rt); 1021 1022 lck_mtx_assert(rnh_lock, LCK_MTX_ASSERT_OWNED); 1023 1024 /* Negative refcnt must never happen */ 1025 if (rt->rt_refcnt != 0) 1026 panic("rt %p invalid refcnt %d", rt, rt->rt_refcnt); 1027 1028 /* 1029 * find the tree for that address family 1030 * Note: in the case of igmp packets, there might not be an rnh 1031 */ 1032 rnh = rt_tables[rt_key(rt)->sa_family]; 1033 1034 /* 1035 * On last reference give the "close method" a chance to cleanup 1036 * private state. This also permits (for IPv4 and IPv6) a chance 1037 * to decide if the routing table entry should be purged immediately 1038 * or at a later time. When an immediate purge is to happen the 1039 * close routine typically issues RTM_DELETE which clears the RTF_UP 1040 * flag on the entry so that the code below reclaims the storage. 1041 */ 1042 if (rnh != NULL && rnh->rnh_close != NULL) 1043 rnh->rnh_close((struct radix_node *)rt, rnh); 1044 1045 /* 1046 * If we are no longer "up" (and ref == 0) then we can free the 1047 * resources associated with the route. 1048 */ 1049 if (!(rt->rt_flags & RTF_UP)) { 1050 struct rtentry *rt_parent; 1051 struct ifaddr *rt_ifa; 1052 1053 if (rt->rt_nodes->rn_flags & (RNF_ACTIVE | RNF_ROOT)) 1054 panic("rt %p freed while in radix tree\n", rt); 1055 /* 1056 * the rtentry must have been removed from the routing table 1057 * so it is represented in rttrash; remove that now. 1058 */ 1059 (void) OSDecrementAtomic(&rttrash); 1060 if (rte_debug & RTD_DEBUG) { 1061 TAILQ_REMOVE(&rttrash_head, (struct rtentry_dbg *)rt, 1062 rtd_trash_link); 1063 } 1064 1065 /* 1066 * release references on items we hold them on.. 1067 * e.g other routes and ifaddrs. 1068 */ 1069 if ((rt_parent = rt->rt_parent) != NULL) 1070 rt->rt_parent = NULL; 1071 1072 if ((rt_ifa = rt->rt_ifa) != NULL) 1073 rt->rt_ifa = NULL; 1074 1075 /* 1076 * Now free any attached link-layer info. 1077 */ 1078 if (rt->rt_llinfo != NULL) { 1079 if (rt->rt_llinfo_free != NULL) 1080 (*rt->rt_llinfo_free)(rt->rt_llinfo); 1081 else 1082 R_Free(rt->rt_llinfo); 1083 rt->rt_llinfo = NULL; 1084 } 1085 1086 /* 1087 * Route is no longer in the tree and refcnt is 0; 1088 * we have exclusive access, so destroy it. 1089 */ 1090 RT_UNLOCK(rt); 1091 1092 if (rt_parent != NULL) 1093 rtfree_locked(rt_parent); 1094 1095 if (rt_ifa != NULL) 1096 IFA_REMREF(rt_ifa); 1097 1098 /* 1099 * The key is separately alloc'd so free it (see rt_setgate()). 1100 * This also frees the gateway, as they are always malloc'd 1101 * together. 1102 */ 1103 R_Free(rt_key(rt)); 1104 1105 /* 1106 * Free any statistics that may have been allocated 1107 */ 1108 nstat_route_detach(rt); 1109 1110 /* 1111 * and the rtentry itself of course 1112 */ 1113 rte_lock_destroy(rt); 1114 rte_free(rt); 1115 } else { 1116 /* 1117 * The "close method" has been called, but the route is 1118 * still in the radix tree with zero refcnt, i.e. "up" 1119 * and in the cached state. 1120 */ 1121 RT_UNLOCK(rt); 1122 } 1123done: 1124 if (!locked) 1125 lck_mtx_unlock(rnh_lock); 1126} 1127 1128void 1129rtfree(struct rtentry *rt) 1130{ 1131 rtfree_common(rt, FALSE); 1132} 1133 1134/* 1135 * Decrements the refcount but does not free the route when 1136 * the refcount reaches zero. Unless you have really good reason, 1137 * use rtfree not rtunref. 1138 */ 1139int 1140rtunref(struct rtentry *p) 1141{ 1142 RT_LOCK_ASSERT_HELD(p); 1143 1144 if (p->rt_refcnt == 0) 1145 panic("%s(%p) bad refcnt\n", __func__, p); 1146 1147 --p->rt_refcnt; 1148 1149 if (rte_debug & RTD_DEBUG) 1150 rtunref_audit((struct rtentry_dbg *)p); 1151 1152 /* Return new value */ 1153 return (p->rt_refcnt); 1154} 1155 1156static inline void 1157rtunref_audit(struct rtentry_dbg *rte) 1158{ 1159 uint16_t idx; 1160 1161 if (rte->rtd_inuse != RTD_INUSE) 1162 panic("rtunref: on freed rte=%p\n", rte); 1163 1164 idx = atomic_add_16_ov(&rte->rtd_refrele_cnt, 1) % CTRACE_HIST_SIZE; 1165 if (rte_debug & RTD_TRACE) 1166 ctrace_record(&rte->rtd_refrele[idx]); 1167} 1168 1169/* 1170 * Add a reference count from an rtentry. 1171 */ 1172void 1173rtref(struct rtentry *p) 1174{ 1175 RT_LOCK_ASSERT_HELD(p); 1176 1177 if (++p->rt_refcnt == 0) 1178 panic("%s(%p) bad refcnt\n", __func__, p); 1179 1180 if (rte_debug & RTD_DEBUG) 1181 rtref_audit((struct rtentry_dbg *)p); 1182} 1183 1184static inline void 1185rtref_audit(struct rtentry_dbg *rte) 1186{ 1187 uint16_t idx; 1188 1189 if (rte->rtd_inuse != RTD_INUSE) 1190 panic("rtref_audit: on freed rte=%p\n", rte); 1191 1192 idx = atomic_add_16_ov(&rte->rtd_refhold_cnt, 1) % CTRACE_HIST_SIZE; 1193 if (rte_debug & RTD_TRACE) 1194 ctrace_record(&rte->rtd_refhold[idx]); 1195} 1196 1197void 1198rtsetifa(struct rtentry *rt, struct ifaddr* ifa) 1199{ 1200 lck_mtx_assert(rnh_lock, LCK_MTX_ASSERT_OWNED); 1201 1202 RT_LOCK_ASSERT_HELD(rt); 1203 1204 if (rt->rt_ifa == ifa) 1205 return; 1206 1207 /* Become a regular mutex, just in case */ 1208 RT_CONVERT_LOCK(rt); 1209 1210 /* Release the old ifa */ 1211 if (rt->rt_ifa) 1212 IFA_REMREF(rt->rt_ifa); 1213 1214 /* Set rt_ifa */ 1215 rt->rt_ifa = ifa; 1216 1217 /* Take a reference to the ifa */ 1218 if (rt->rt_ifa) 1219 IFA_ADDREF(rt->rt_ifa); 1220} 1221 1222/* 1223 * Force a routing table entry to the specified 1224 * destination to go through the given gateway. 1225 * Normally called as a result of a routing redirect 1226 * message from the network layer. 1227 */ 1228void 1229rtredirect(struct ifnet *ifp, struct sockaddr *dst, struct sockaddr *gateway, 1230 struct sockaddr *netmask, int flags, struct sockaddr *src, 1231 struct rtentry **rtp) 1232{ 1233 struct rtentry *rt = NULL; 1234 int error = 0; 1235 short *stat = 0; 1236 struct rt_addrinfo info; 1237 struct ifaddr *ifa = NULL; 1238 unsigned int ifscope = (ifp != NULL) ? ifp->if_index : IFSCOPE_NONE; 1239 struct sockaddr_storage ss; 1240 1241 lck_mtx_assert(rnh_lock, LCK_MTX_ASSERT_NOTOWNED); 1242 lck_mtx_lock(rnh_lock); 1243 1244 /* 1245 * Transform src into the internal routing table form for 1246 * comparison against rt_gateway below. 1247 */ 1248#if INET6 1249 if ((src->sa_family == AF_INET && ip_doscopedroute) || 1250 (src->sa_family == AF_INET6 && ip6_doscopedroute)) 1251#else 1252 if (src->sa_family == AF_INET && ip_doscopedroute) 1253#endif /* !INET6 */ 1254 src = sa_copy(src, &ss, &ifscope); 1255 1256 /* 1257 * Verify the gateway is directly reachable; if scoped routing 1258 * is enabled, verify that it is reachable from the interface 1259 * where the ICMP redirect arrived on. 1260 */ 1261 if ((ifa = ifa_ifwithnet_scoped(gateway, ifscope)) == NULL) { 1262 error = ENETUNREACH; 1263 goto out; 1264 } 1265 1266 /* Lookup route to the destination (from the original IP header) */ 1267 rt = rtalloc1_scoped_locked(dst, 0, RTF_CLONING|RTF_PRCLONING, ifscope); 1268 if (rt != NULL) 1269 RT_LOCK(rt); 1270 1271 /* 1272 * If the redirect isn't from our current router for this dst, 1273 * it's either old or wrong. If it redirects us to ourselves, 1274 * we have a routing loop, perhaps as a result of an interface 1275 * going down recently. Holding rnh_lock here prevents the 1276 * possibility of rt_ifa/ifa's ifa_addr from changing (e.g. 1277 * in_ifinit), so okay to access ifa_addr without locking. 1278 */ 1279 if (!(flags & RTF_DONE) && rt != NULL && 1280 (!equal(src, rt->rt_gateway) || !equal(rt->rt_ifa->ifa_addr, 1281 ifa->ifa_addr))) { 1282 error = EINVAL; 1283 } else { 1284 IFA_REMREF(ifa); 1285 if ((ifa = ifa_ifwithaddr(gateway))) { 1286 IFA_REMREF(ifa); 1287 ifa = NULL; 1288 error = EHOSTUNREACH; 1289 } 1290 } 1291 1292 if (ifa) { 1293 IFA_REMREF(ifa); 1294 ifa = NULL; 1295 } 1296 1297 if (error) { 1298 if (rt != NULL) 1299 RT_UNLOCK(rt); 1300 goto done; 1301 } 1302 1303 /* 1304 * Create a new entry if we just got back a wildcard entry 1305 * or the the lookup failed. This is necessary for hosts 1306 * which use routing redirects generated by smart gateways 1307 * to dynamically build the routing tables. 1308 */ 1309 if ((rt == NULL) || (rt_mask(rt) != NULL && rt_mask(rt)->sa_len < 2)) 1310 goto create; 1311 /* 1312 * Don't listen to the redirect if it's 1313 * for a route to an interface. 1314 */ 1315 RT_LOCK_ASSERT_HELD(rt); 1316 if (rt->rt_flags & RTF_GATEWAY) { 1317 if (((rt->rt_flags & RTF_HOST) == 0) && (flags & RTF_HOST)) { 1318 /* 1319 * Changing from route to net => route to host. 1320 * Create new route, rather than smashing route 1321 * to net; similar to cloned routes, the newly 1322 * created host route is scoped as well. 1323 */ 1324create: 1325 if (rt != NULL) 1326 RT_UNLOCK(rt); 1327 flags |= RTF_GATEWAY | RTF_DYNAMIC; 1328 error = rtrequest_scoped_locked(RTM_ADD, dst, 1329 gateway, netmask, flags, NULL, ifscope); 1330 stat = &rtstat.rts_dynamic; 1331 } else { 1332 /* 1333 * Smash the current notion of the gateway to 1334 * this destination. Should check about netmask!!! 1335 */ 1336 rt->rt_flags |= RTF_MODIFIED; 1337 flags |= RTF_MODIFIED; 1338 stat = &rtstat.rts_newgateway; 1339 /* 1340 * add the key and gateway (in one malloc'd chunk). 1341 */ 1342 error = rt_setgate(rt, rt_key(rt), gateway); 1343 RT_UNLOCK(rt); 1344 } 1345 } else { 1346 RT_UNLOCK(rt); 1347 error = EHOSTUNREACH; 1348 } 1349done: 1350 if (rt != NULL) { 1351 RT_LOCK_ASSERT_NOTHELD(rt); 1352 if (rtp && !error) 1353 *rtp = rt; 1354 else 1355 rtfree_locked(rt); 1356 } 1357out: 1358 if (error) { 1359 rtstat.rts_badredirect++; 1360 } else { 1361 if (stat != NULL) 1362 (*stat)++; 1363 if (use_routegenid) 1364 routegenid_update(); 1365 } 1366 lck_mtx_unlock(rnh_lock); 1367 bzero((caddr_t)&info, sizeof(info)); 1368 info.rti_info[RTAX_DST] = dst; 1369 info.rti_info[RTAX_GATEWAY] = gateway; 1370 info.rti_info[RTAX_NETMASK] = netmask; 1371 info.rti_info[RTAX_AUTHOR] = src; 1372 rt_missmsg(RTM_REDIRECT, &info, flags, error); 1373} 1374 1375/* 1376* Routing table ioctl interface. 1377*/ 1378int 1379rtioctl(unsigned long req, caddr_t data, struct proc *p) 1380{ 1381#pragma unused(p) 1382#if INET && MROUTING 1383 return mrt_ioctl(req, data); 1384#else 1385#pragma unused(req) 1386#pragma unused(data) 1387 return ENXIO; 1388#endif 1389} 1390 1391struct ifaddr * 1392ifa_ifwithroute( 1393 int flags, 1394 const struct sockaddr *dst, 1395 const struct sockaddr *gateway) 1396{ 1397 struct ifaddr *ifa; 1398 1399 lck_mtx_lock(rnh_lock); 1400 ifa = ifa_ifwithroute_locked(flags, dst, gateway); 1401 lck_mtx_unlock(rnh_lock); 1402 1403 return (ifa); 1404} 1405 1406struct ifaddr * 1407ifa_ifwithroute_locked(int flags, const struct sockaddr *dst, 1408 const struct sockaddr *gateway) 1409{ 1410 return (ifa_ifwithroute_common_locked((flags & ~RTF_IFSCOPE), dst, 1411 gateway, IFSCOPE_NONE)); 1412} 1413 1414struct ifaddr * 1415ifa_ifwithroute_scoped_locked(int flags, const struct sockaddr *dst, 1416 const struct sockaddr *gateway, unsigned int ifscope) 1417{ 1418 if (ifscope != IFSCOPE_NONE) 1419 flags |= RTF_IFSCOPE; 1420 else 1421 flags &= ~RTF_IFSCOPE; 1422 1423 return (ifa_ifwithroute_common_locked(flags, dst, gateway, ifscope)); 1424} 1425 1426static struct ifaddr * 1427ifa_ifwithroute_common_locked(int flags, const struct sockaddr *dst, 1428 const struct sockaddr *gw, unsigned int ifscope) 1429{ 1430 struct ifaddr *ifa = NULL; 1431 struct rtentry *rt = NULL; 1432 struct sockaddr_storage dst_ss, gw_ss; 1433 1434 lck_mtx_assert(rnh_lock, LCK_MTX_ASSERT_OWNED); 1435 1436 /* 1437 * Just in case the sockaddr passed in by the caller 1438 * contains a scope ID, make sure to clear it since 1439 * interface addresses aren't scoped. 1440 */ 1441#if INET6 1442 if (dst != NULL && 1443 ((dst->sa_family == AF_INET && ip_doscopedroute) || 1444 (dst->sa_family == AF_INET6 && ip6_doscopedroute))) 1445#else 1446 if (dst != NULL && dst->sa_family == AF_INET && ip_doscopedroute) 1447#endif /* !INET6 */ 1448 dst = sa_copy(SA((uintptr_t)dst), &dst_ss, NULL); 1449 1450#if INET6 1451 if (gw != NULL && 1452 ((gw->sa_family == AF_INET && ip_doscopedroute) || 1453 (gw->sa_family == AF_INET6 && ip6_doscopedroute))) 1454#else 1455 if (gw != NULL && gw->sa_family == AF_INET && ip_doscopedroute) 1456#endif /* !INET6 */ 1457 gw = sa_copy(SA((uintptr_t)gw), &gw_ss, NULL); 1458 1459 if (!(flags & RTF_GATEWAY)) { 1460 /* 1461 * If we are adding a route to an interface, 1462 * and the interface is a pt to pt link 1463 * we should search for the destination 1464 * as our clue to the interface. Otherwise 1465 * we can use the local address. 1466 */ 1467 if (flags & RTF_HOST) { 1468 ifa = ifa_ifwithdstaddr(dst); 1469 } 1470 if (ifa == NULL) 1471 ifa = ifa_ifwithaddr_scoped(gw, ifscope); 1472 } else { 1473 /* 1474 * If we are adding a route to a remote net 1475 * or host, the gateway may still be on the 1476 * other end of a pt to pt link. 1477 */ 1478 ifa = ifa_ifwithdstaddr(gw); 1479 } 1480 if (ifa == NULL) 1481 ifa = ifa_ifwithnet_scoped(gw, ifscope); 1482 if (ifa == NULL) { 1483 /* Workaround to avoid gcc warning regarding const variable */ 1484 rt = rtalloc1_scoped_locked((struct sockaddr *)(size_t)dst, 1485 0, 0, ifscope); 1486 if (rt != NULL) { 1487 RT_LOCK_SPIN(rt); 1488 ifa = rt->rt_ifa; 1489 if (ifa != NULL) { 1490 /* Become a regular mutex */ 1491 RT_CONVERT_LOCK(rt); 1492 IFA_ADDREF(ifa); 1493 } 1494 RT_REMREF_LOCKED(rt); 1495 RT_UNLOCK(rt); 1496 rt = NULL; 1497 } 1498 } 1499 /* 1500 * Holding rnh_lock here prevents the possibility of ifa from 1501 * changing (e.g. in_ifinit), so it is safe to access its 1502 * ifa_addr (here and down below) without locking. 1503 */ 1504 if (ifa != NULL && ifa->ifa_addr->sa_family != dst->sa_family) { 1505 struct ifaddr *newifa; 1506 /* Callee adds reference to newifa upon success */ 1507 newifa = ifaof_ifpforaddr(dst, ifa->ifa_ifp); 1508 if (newifa != NULL) { 1509 IFA_REMREF(ifa); 1510 ifa = newifa; 1511 } 1512 } 1513 /* 1514 * If we are adding a gateway, it is quite possible that the 1515 * routing table has a static entry in place for the gateway, 1516 * that may not agree with info garnered from the interfaces. 1517 * The routing table should carry more precedence than the 1518 * interfaces in this matter. Must be careful not to stomp 1519 * on new entries from rtinit, hence (ifa->ifa_addr != gw). 1520 */ 1521 if ((ifa == NULL || 1522 !equal(ifa->ifa_addr, (struct sockaddr *)(size_t)gw)) && 1523 (rt = rtalloc1_scoped_locked((struct sockaddr *)(size_t)gw, 1524 0, 0, ifscope)) != NULL) { 1525 if (ifa != NULL) 1526 IFA_REMREF(ifa); 1527 RT_LOCK_SPIN(rt); 1528 ifa = rt->rt_ifa; 1529 if (ifa != NULL) { 1530 /* Become a regular mutex */ 1531 RT_CONVERT_LOCK(rt); 1532 IFA_ADDREF(ifa); 1533 } 1534 RT_REMREF_LOCKED(rt); 1535 RT_UNLOCK(rt); 1536 } 1537 /* 1538 * If an interface scope was specified, the interface index of 1539 * the found ifaddr must be equivalent to that of the scope; 1540 * otherwise there is no match. 1541 */ 1542 if ((flags & RTF_IFSCOPE) && 1543 ifa != NULL && ifa->ifa_ifp->if_index != ifscope) { 1544 IFA_REMREF(ifa); 1545 ifa = NULL; 1546 } 1547 1548 return (ifa); 1549} 1550 1551static int rt_fixdelete(struct radix_node *, void *); 1552static int rt_fixchange(struct radix_node *, void *); 1553 1554struct rtfc_arg { 1555 struct rtentry *rt0; 1556 struct radix_node_head *rnh; 1557}; 1558 1559int 1560rtrequest_locked(int req, struct sockaddr *dst, struct sockaddr *gateway, 1561 struct sockaddr *netmask, int flags, struct rtentry **ret_nrt) 1562{ 1563 return (rtrequest_common_locked(req, dst, gateway, netmask, 1564 (flags & ~RTF_IFSCOPE), ret_nrt, IFSCOPE_NONE)); 1565} 1566 1567int 1568rtrequest_scoped_locked(int req, struct sockaddr *dst, 1569 struct sockaddr *gateway, struct sockaddr *netmask, int flags, 1570 struct rtentry **ret_nrt, unsigned int ifscope) 1571{ 1572 if (ifscope != IFSCOPE_NONE) 1573 flags |= RTF_IFSCOPE; 1574 else 1575 flags &= ~RTF_IFSCOPE; 1576 1577 return (rtrequest_common_locked(req, dst, gateway, netmask, 1578 flags, ret_nrt, ifscope)); 1579} 1580 1581/* 1582 * Do appropriate manipulations of a routing tree given all the bits of 1583 * info needed. 1584 * 1585 * Storing the scope ID in the radix key is an internal job that should be 1586 * left to routines in this module. Callers should specify the scope value 1587 * to the "scoped" variants of route routines instead of manipulating the 1588 * key itself. This is typically done when creating a scoped route, e.g. 1589 * rtrequest(RTM_ADD). Once such a route is created and marked with the 1590 * RTF_IFSCOPE flag, callers can simply use its rt_key(rt) to clone it 1591 * (RTM_RESOLVE) or to remove it (RTM_DELETE). An exception to this is 1592 * during certain routing socket operations where the search key might be 1593 * derived from the routing message itself, in which case the caller must 1594 * specify the destination address and scope value for RTM_ADD/RTM_DELETE. 1595 */ 1596static int 1597rtrequest_common_locked(int req, struct sockaddr *dst0, 1598 struct sockaddr *gateway, struct sockaddr *netmask, int flags, 1599 struct rtentry **ret_nrt, unsigned int ifscope) 1600{ 1601 int error = 0; 1602 struct rtentry *rt; 1603 struct radix_node *rn; 1604 struct radix_node_head *rnh; 1605 struct ifaddr *ifa = NULL; 1606 struct sockaddr *ndst, *dst = dst0; 1607 struct sockaddr_storage ss, mask; 1608 struct timeval curr_calendartime; 1609 int af = dst->sa_family; 1610 void (*ifa_rtrequest)(int, struct rtentry *, struct sockaddr *); 1611 1612#define senderr(x) { error = x ; goto bad; } 1613 1614 lck_mtx_assert(rnh_lock, LCK_MTX_ASSERT_OWNED); 1615 /* 1616 * Find the correct routing tree to use for this Address Family 1617 */ 1618 if ((rnh = rt_tables[af]) == NULL) 1619 senderr(ESRCH); 1620 /* 1621 * If we are adding a host route then we don't want to put 1622 * a netmask in the tree 1623 */ 1624 if (flags & RTF_HOST) 1625 netmask = NULL; 1626 1627 /* 1628 * If Scoped Routing is enabled, use a local copy of the destination 1629 * address to store the scope ID into. This logic is repeated below 1630 * in the RTM_RESOLVE handler since the caller does not normally 1631 * specify such a flag during a resolve, as well as for the handling 1632 * of IPv4 link-local address; instead, it passes in the route used for 1633 * cloning for which the scope info is derived from. Note also that 1634 * in the case of RTM_DELETE, the address passed in by the caller 1635 * might already contain the scope ID info when it is the key itself, 1636 * thus making RTF_IFSCOPE unnecessary; one instance where it is 1637 * explicitly set is inside route_output() as part of handling a 1638 * routing socket request. 1639 */ 1640#if INET6 1641 if (req != RTM_RESOLVE && 1642 ((af == AF_INET && ip_doscopedroute) || 1643 (af == AF_INET6 && ip6_doscopedroute))) { 1644#else 1645 if (req != RTM_RESOLVE && af == AF_INET && ip_doscopedroute) { 1646#endif /* !INET6 */ 1647 /* Transform dst into the internal routing table form */ 1648 dst = sa_copy(dst, &ss, &ifscope); 1649 1650 /* Transform netmask into the internal routing table form */ 1651 if (netmask != NULL) 1652 netmask = ma_copy(af, netmask, &mask, ifscope); 1653 1654 if (ifscope != IFSCOPE_NONE) 1655 flags |= RTF_IFSCOPE; 1656 } else { 1657 if ((flags & RTF_IFSCOPE) && (af != AF_INET && af != AF_INET6)) 1658 senderr(EINVAL); 1659 1660#if INET6 1661 if ((af == AF_INET && !ip_doscopedroute) || 1662 (af == AF_INET6 && !ip6_doscopedroute)) 1663#else 1664 if (af == AF_INET && !ip_doscopedroute) 1665#endif /* !INET6 */ 1666 ifscope = IFSCOPE_NONE; 1667 } 1668 1669 if (ifscope == IFSCOPE_NONE) 1670 flags &= ~RTF_IFSCOPE; 1671 1672 switch (req) { 1673 case RTM_DELETE: { 1674 struct rtentry *gwrt = NULL; 1675 /* 1676 * Remove the item from the tree and return it. 1677 * Complain if it is not there and do no more processing. 1678 */ 1679 if ((rn = rnh->rnh_deladdr(dst, netmask, rnh)) == NULL) 1680 senderr(ESRCH); 1681 if (rn->rn_flags & (RNF_ACTIVE | RNF_ROOT)) 1682 panic ("rtrequest delete"); 1683 rt = (struct rtentry *)rn; 1684 1685 /* 1686 * Take an extra reference to handle the deletion of a route 1687 * entry whose reference count is already 0; e.g. an expiring 1688 * cloned route entry or an entry that was added to the table 1689 * with 0 reference. If the caller is interested in this route, 1690 * we will return it with the reference intact. Otherwise we 1691 * will decrement the reference via rtfree_locked() and then 1692 * possibly deallocate it. 1693 */ 1694 RT_LOCK(rt); 1695 RT_ADDREF_LOCKED(rt); 1696 rt->rt_flags &= ~RTF_UP; 1697 1698 /* 1699 * For consistency, in case the caller didn't set the flag. 1700 */ 1701 rt->rt_flags |= RTF_CONDEMNED; 1702 1703 /* 1704 * Clear RTF_ROUTER if it's set. 1705 */ 1706 if (rt->rt_flags & RTF_ROUTER) { 1707 VERIFY(rt->rt_flags & RTF_HOST); 1708 rt->rt_flags &= ~RTF_ROUTER; 1709 } 1710 1711 /* 1712 * Now search what's left of the subtree for any cloned 1713 * routes which might have been formed from this node. 1714 */ 1715 if ((rt->rt_flags & (RTF_CLONING | RTF_PRCLONING)) && 1716 rt_mask(rt)) { 1717 RT_UNLOCK(rt); 1718 rnh->rnh_walktree_from(rnh, dst, rt_mask(rt), 1719 rt_fixdelete, rt); 1720 RT_LOCK(rt); 1721 } 1722 1723 /* 1724 * Remove any external references we may have. 1725 */ 1726 if ((gwrt = rt->rt_gwroute) != NULL) 1727 rt->rt_gwroute = NULL; 1728 1729 /* 1730 * give the protocol a chance to keep things in sync. 1731 */ 1732 if ((ifa = rt->rt_ifa) != NULL) { 1733 IFA_LOCK_SPIN(ifa); 1734 ifa_rtrequest = ifa->ifa_rtrequest; 1735 IFA_UNLOCK(ifa); 1736 if (ifa_rtrequest != NULL) 1737 ifa_rtrequest(RTM_DELETE, rt, NULL); 1738 /* keep reference on rt_ifa */ 1739 ifa = NULL; 1740 } 1741 1742 /* 1743 * one more rtentry floating around that is not 1744 * linked to the routing table. 1745 */ 1746 (void) OSIncrementAtomic(&rttrash); 1747 if (rte_debug & RTD_DEBUG) { 1748 TAILQ_INSERT_TAIL(&rttrash_head, 1749 (struct rtentry_dbg *)rt, rtd_trash_link); 1750 } 1751 1752 /* 1753 * If this is the (non-scoped) default route, clear 1754 * the interface index used for the primary ifscope. 1755 */ 1756 if (rt_primary_default(rt, rt_key(rt))) { 1757 set_primary_ifscope(rt_key(rt)->sa_family, 1758 IFSCOPE_NONE); 1759 } 1760 rt_clear_idleref(rt); 1761 1762 RT_UNLOCK(rt); 1763 1764 /* 1765 * This might result in another rtentry being freed if 1766 * we held its last reference. Do this after the rtentry 1767 * lock is dropped above, as it could lead to the same 1768 * lock being acquired if gwrt is a clone of rt. 1769 */ 1770 if (gwrt != NULL) 1771 rtfree_locked(gwrt); 1772 1773 /* 1774 * If the caller wants it, then it can have it, 1775 * but it's up to it to free the rtentry as we won't be 1776 * doing it. 1777 */ 1778 if (ret_nrt != NULL) { 1779 /* Return the route to caller with reference intact */ 1780 *ret_nrt = rt; 1781 } else { 1782 /* Dereference or deallocate the route */ 1783 rtfree_locked(rt); 1784 } 1785 break; 1786 } 1787 case RTM_RESOLVE: 1788 if (ret_nrt == NULL || (rt = *ret_nrt) == NULL) 1789 senderr(EINVAL); 1790 /* 1791 * If cloning, we have the parent route given by the caller 1792 * and will use its rt_gateway, rt_rmx as part of the cloning 1793 * process below. Since rnh_lock is held at this point, the 1794 * parent's rt_ifa and rt_gateway will not change, and its 1795 * relevant rt_flags will not change as well. The only thing 1796 * that could change are the metrics, and thus we hold the 1797 * parent route's rt_lock later on during the actual copying 1798 * of rt_rmx. 1799 */ 1800 ifa = rt->rt_ifa; 1801 IFA_ADDREF(ifa); 1802 flags = rt->rt_flags & 1803 ~(RTF_CLONING | RTF_PRCLONING | RTF_STATIC); 1804 flags |= RTF_WASCLONED; 1805 gateway = rt->rt_gateway; 1806 if ((netmask = rt->rt_genmask) == NULL) 1807 flags |= RTF_HOST; 1808 1809#if INET6 1810 if ((af != AF_INET && af != AF_INET6) || 1811 (af == AF_INET && !ip_doscopedroute) || 1812 (af == AF_INET6 && !ip6_doscopedroute)) 1813#else 1814 if (af != AF_INET || !ip_doscopedroute) 1815#endif /* !INET6 */ 1816 goto makeroute; 1817 1818 /* 1819 * When scoped routing is enabled, cloned entries are 1820 * always scoped according to the interface portion of 1821 * the parent route. The exception to this are IPv4 1822 * link local addresses, or those routes that are cloned 1823 * from a RTF_PROXY route. For the latter, the clone 1824 * gets to keep the RTF_PROXY flag. 1825 */ 1826 if ((af == AF_INET && 1827 IN_LINKLOCAL(ntohl(SIN(dst)->sin_addr.s_addr))) || 1828 (rt->rt_flags & RTF_PROXY)) { 1829 ifscope = IFSCOPE_NONE; 1830 flags &= ~RTF_IFSCOPE; 1831 } else { 1832 if (flags & RTF_IFSCOPE) { 1833 ifscope = (af == AF_INET) ? 1834 sin_get_ifscope(rt_key(rt)) : 1835 sin6_get_ifscope(rt_key(rt)); 1836 } else { 1837 ifscope = rt->rt_ifp->if_index; 1838 flags |= RTF_IFSCOPE; 1839 } 1840 VERIFY(ifscope != IFSCOPE_NONE); 1841 } 1842 1843 /* 1844 * Transform dst into the internal routing table form, 1845 * clearing out the scope ID field if ifscope isn't set. 1846 */ 1847 dst = sa_copy(dst, &ss, (ifscope == IFSCOPE_NONE) ? 1848 NULL : &ifscope); 1849 1850 /* Transform netmask into the internal routing table form */ 1851 if (netmask != NULL) 1852 netmask = ma_copy(af, netmask, &mask, ifscope); 1853 1854 goto makeroute; 1855 1856 case RTM_ADD: 1857 if ((flags & RTF_GATEWAY) && !gateway) 1858 panic("rtrequest: RTF_GATEWAY but no gateway"); 1859 1860 if (flags & RTF_IFSCOPE) { 1861 ifa = ifa_ifwithroute_scoped_locked(flags, dst0, 1862 gateway, ifscope); 1863 } else { 1864 ifa = ifa_ifwithroute_locked(flags, dst0, gateway); 1865 } 1866 if (ifa == NULL) 1867 senderr(ENETUNREACH); 1868makeroute: 1869 getmicrotime(&curr_calendartime); 1870 if ((rt = rte_alloc()) == NULL) 1871 senderr(ENOBUFS); 1872 Bzero(rt, sizeof(*rt)); 1873 rte_lock_init(rt); 1874 rt->base_calendartime = curr_calendartime.tv_sec; 1875 rt->base_uptime = net_uptime(); 1876 RT_LOCK(rt); 1877 rt->rt_flags = RTF_UP | flags; 1878 1879 /* 1880 * Add the gateway. Possibly re-malloc-ing the storage for it 1881 * also add the rt_gwroute if possible. 1882 */ 1883 if ((error = rt_setgate(rt, dst, gateway)) != 0) { 1884 int tmp = error; 1885 RT_UNLOCK(rt); 1886 nstat_route_detach(rt); 1887 rte_lock_destroy(rt); 1888 rte_free(rt); 1889 senderr(tmp); 1890 } 1891 1892 /* 1893 * point to the (possibly newly malloc'd) dest address. 1894 */ 1895 ndst = rt_key(rt); 1896 1897 /* 1898 * make sure it contains the value we want (masked if needed). 1899 */ 1900 if (netmask) 1901 rt_maskedcopy(dst, ndst, netmask); 1902 else 1903 Bcopy(dst, ndst, dst->sa_len); 1904 1905 /* 1906 * Note that we now have a reference to the ifa. 1907 * This moved from below so that rnh->rnh_addaddr() can 1908 * examine the ifa and ifa->ifa_ifp if it so desires. 1909 */ 1910 rtsetifa(rt, ifa); 1911 rt->rt_ifp = rt->rt_ifa->ifa_ifp; 1912 1913 /* XXX mtu manipulation will be done in rnh_addaddr -- itojun */ 1914 1915 rn = rnh->rnh_addaddr((caddr_t)ndst, (caddr_t)netmask, 1916 rnh, rt->rt_nodes); 1917 if (rn == 0) { 1918 struct rtentry *rt2; 1919 /* 1920 * Uh-oh, we already have one of these in the tree. 1921 * We do a special hack: if the route that's already 1922 * there was generated by the protocol-cloning 1923 * mechanism, then we just blow it away and retry 1924 * the insertion of the new one. 1925 */ 1926 if (flags & RTF_IFSCOPE) { 1927 rt2 = rtalloc1_scoped_locked(dst0, 0, 1928 RTF_CLONING | RTF_PRCLONING, ifscope); 1929 } else { 1930 rt2 = rtalloc1_locked(dst, 0, 1931 RTF_CLONING | RTF_PRCLONING); 1932 } 1933 if (rt2 && rt2->rt_parent) { 1934 /* 1935 * rnh_lock is held here, so rt_key and 1936 * rt_gateway of rt2 will not change. 1937 */ 1938 (void) rtrequest_locked(RTM_DELETE, rt_key(rt2), 1939 rt2->rt_gateway, rt_mask(rt2), 1940 rt2->rt_flags, 0); 1941 rtfree_locked(rt2); 1942 rn = rnh->rnh_addaddr((caddr_t)ndst, 1943 (caddr_t)netmask, 1944 rnh, rt->rt_nodes); 1945 } else if (rt2) { 1946 /* undo the extra ref we got */ 1947 rtfree_locked(rt2); 1948 } 1949 } 1950 1951 /* 1952 * If it still failed to go into the tree, 1953 * then un-make it (this should be a function) 1954 */ 1955 if (rn == NULL) { 1956 /* Clear gateway route */ 1957 rt_set_gwroute(rt, rt_key(rt), NULL); 1958 if (rt->rt_ifa) { 1959 IFA_REMREF(rt->rt_ifa); 1960 rt->rt_ifa = NULL; 1961 } 1962 R_Free(rt_key(rt)); 1963 RT_UNLOCK(rt); 1964 nstat_route_detach(rt); 1965 rte_lock_destroy(rt); 1966 rte_free(rt); 1967 senderr(EEXIST); 1968 } 1969 1970 rt->rt_parent = NULL; 1971 1972 /* 1973 * If we got here from RESOLVE, then we are cloning so clone 1974 * the rest, and note that we are a clone (and increment the 1975 * parent's references). rnh_lock is still held, which prevents 1976 * a lookup from returning the newly-created route. Hence 1977 * holding and releasing the parent's rt_lock while still 1978 * holding the route's rt_lock is safe since the new route 1979 * is not yet externally visible. 1980 */ 1981 if (req == RTM_RESOLVE) { 1982 RT_LOCK_SPIN(*ret_nrt); 1983 VERIFY((*ret_nrt)->rt_expire == 0 || 1984 (*ret_nrt)->rt_rmx.rmx_expire != 0); 1985 VERIFY((*ret_nrt)->rt_expire != 0 || 1986 (*ret_nrt)->rt_rmx.rmx_expire == 0); 1987 rt->rt_rmx = (*ret_nrt)->rt_rmx; 1988 rt_setexpire(rt, (*ret_nrt)->rt_expire); 1989 if ((*ret_nrt)->rt_flags & (RTF_CLONING | RTF_PRCLONING)) { 1990 rt->rt_parent = (*ret_nrt); 1991 RT_ADDREF_LOCKED(*ret_nrt); 1992 } 1993 RT_UNLOCK(*ret_nrt); 1994 1995 /* 1996 * Enable interface reference counting for unicast 1997 * cloned routes and bump up the reference count. 1998 */ 1999 if (rt->rt_parent != NULL && 2000 !(rt->rt_flags & (RTF_BROADCAST | RTF_MULTICAST))) { 2001 rt_set_idleref(rt); 2002 } 2003 } 2004 2005 /* 2006 * if this protocol has something to add to this then 2007 * allow it to do that as well. 2008 */ 2009 IFA_LOCK_SPIN(ifa); 2010 ifa_rtrequest = ifa->ifa_rtrequest; 2011 IFA_UNLOCK(ifa); 2012 if (ifa_rtrequest != NULL) 2013 ifa_rtrequest(req, rt, SA(ret_nrt ? *ret_nrt : NULL)); 2014 IFA_REMREF(ifa); 2015 ifa = NULL; 2016 2017 /* 2018 * If this is the (non-scoped) default route, record 2019 * the interface index used for the primary ifscope. 2020 */ 2021 if (rt_primary_default(rt, rt_key(rt))) { 2022 set_primary_ifscope(rt_key(rt)->sa_family, 2023 rt->rt_ifp->if_index); 2024 } 2025 2026 /* 2027 * actually return a resultant rtentry and 2028 * give the caller a single reference. 2029 */ 2030 if (ret_nrt) { 2031 *ret_nrt = rt; 2032 RT_ADDREF_LOCKED(rt); 2033 } 2034 2035 /* 2036 * We repeat the same procedures from rt_setgate() here 2037 * because they weren't completed when we called it earlier, 2038 * since the node was embryonic. 2039 */ 2040 if ((rt->rt_flags & RTF_GATEWAY) && rt->rt_gwroute != NULL) 2041 rt_set_gwroute(rt, rt_key(rt), rt->rt_gwroute); 2042 2043 if (req == RTM_ADD && 2044 !(rt->rt_flags & RTF_HOST) && rt_mask(rt) != NULL) { 2045 struct rtfc_arg arg; 2046 arg.rnh = rnh; 2047 arg.rt0 = rt; 2048 RT_UNLOCK(rt); 2049 rnh->rnh_walktree_from(rnh, rt_key(rt), rt_mask(rt), 2050 rt_fixchange, &arg); 2051 } else { 2052 RT_UNLOCK(rt); 2053 } 2054 2055 nstat_route_new_entry(rt); 2056 break; 2057 } 2058bad: 2059 if (ifa) 2060 IFA_REMREF(ifa); 2061 return (error); 2062} 2063#undef senderr 2064 2065int 2066rtrequest(int req, struct sockaddr *dst, struct sockaddr *gateway, 2067 struct sockaddr *netmask, int flags, struct rtentry **ret_nrt) 2068{ 2069 int error; 2070 lck_mtx_assert(rnh_lock, LCK_MTX_ASSERT_NOTOWNED); 2071 lck_mtx_lock(rnh_lock); 2072 error = rtrequest_locked(req, dst, gateway, netmask, flags, ret_nrt); 2073 lck_mtx_unlock(rnh_lock); 2074 return (error); 2075} 2076 2077int 2078rtrequest_scoped(int req, struct sockaddr *dst, struct sockaddr *gateway, 2079 struct sockaddr *netmask, int flags, struct rtentry **ret_nrt, 2080 unsigned int ifscope) 2081{ 2082 int error; 2083 lck_mtx_assert(rnh_lock, LCK_MTX_ASSERT_NOTOWNED); 2084 lck_mtx_lock(rnh_lock); 2085 error = rtrequest_scoped_locked(req, dst, gateway, netmask, flags, 2086 ret_nrt, ifscope); 2087 lck_mtx_unlock(rnh_lock); 2088 return (error); 2089} 2090 2091/* 2092 * Called from rtrequest(RTM_DELETE, ...) to fix up the route's ``family'' 2093 * (i.e., the routes related to it by the operation of cloning). This 2094 * routine is iterated over all potential former-child-routes by way of 2095 * rnh->rnh_walktree_from() above, and those that actually are children of 2096 * the late parent (passed in as VP here) are themselves deleted. 2097 */ 2098static int 2099rt_fixdelete(struct radix_node *rn, void *vp) 2100{ 2101 struct rtentry *rt = (struct rtentry *)rn; 2102 struct rtentry *rt0 = vp; 2103 2104 lck_mtx_assert(rnh_lock, LCK_MTX_ASSERT_OWNED); 2105 2106 RT_LOCK(rt); 2107 if (rt->rt_parent == rt0 && 2108 !(rt->rt_flags & (RTF_PINNED | RTF_CLONING | RTF_PRCLONING))) { 2109 /* 2110 * Safe to drop rt_lock and use rt_key, since holding 2111 * rnh_lock here prevents another thread from calling 2112 * rt_setgate() on this route. 2113 */ 2114 RT_UNLOCK(rt); 2115 return (rtrequest_locked(RTM_DELETE, rt_key(rt), NULL, 2116 rt_mask(rt), rt->rt_flags, NULL)); 2117 } 2118 RT_UNLOCK(rt); 2119 return 0; 2120} 2121 2122/* 2123 * This routine is called from rt_setgate() to do the analogous thing for 2124 * adds and changes. There is the added complication in this case of a 2125 * middle insert; i.e., insertion of a new network route between an older 2126 * network route and (cloned) host routes. For this reason, a simple check 2127 * of rt->rt_parent is insufficient; each candidate route must be tested 2128 * against the (mask, value) of the new route (passed as before in vp) 2129 * to see if the new route matches it. 2130 * 2131 * XXX - it may be possible to do fixdelete() for changes and reserve this 2132 * routine just for adds. I'm not sure why I thought it was necessary to do 2133 * changes this way. 2134 */ 2135static int 2136rt_fixchange(struct radix_node *rn, void *vp) 2137{ 2138 struct rtentry *rt = (struct rtentry *)rn; 2139 struct rtfc_arg *ap = vp; 2140 struct rtentry *rt0 = ap->rt0; 2141 struct radix_node_head *rnh = ap->rnh; 2142 u_char *xk1, *xm1, *xk2, *xmp; 2143 int i, len; 2144 2145 lck_mtx_assert(rnh_lock, LCK_MTX_ASSERT_OWNED); 2146 2147 RT_LOCK(rt); 2148 2149 if (!rt->rt_parent || 2150 (rt->rt_flags & (RTF_PINNED | RTF_CLONING | RTF_PRCLONING))) { 2151 RT_UNLOCK(rt); 2152 return (0); 2153 } 2154 2155 if (rt->rt_parent == rt0) 2156 goto delete_rt; 2157 2158 /* 2159 * There probably is a function somewhere which does this... 2160 * if not, there should be. 2161 */ 2162 len = imin(rt_key(rt0)->sa_len, rt_key(rt)->sa_len); 2163 2164 xk1 = (u_char *)rt_key(rt0); 2165 xm1 = (u_char *)rt_mask(rt0); 2166 xk2 = (u_char *)rt_key(rt); 2167 2168 /* 2169 * Avoid applying a less specific route; do this only if the parent 2170 * route (rt->rt_parent) is a network route, since otherwise its mask 2171 * will be NULL if it is a cloning host route. 2172 */ 2173 if ((xmp = (u_char *)rt_mask(rt->rt_parent)) != NULL) { 2174 int mlen = rt_mask(rt->rt_parent)->sa_len; 2175 if (mlen > rt_mask(rt0)->sa_len) { 2176 RT_UNLOCK(rt); 2177 return (0); 2178 } 2179 2180 for (i = rnh->rnh_treetop->rn_offset; i < mlen; i++) { 2181 if ((xmp[i] & ~(xmp[i] ^ xm1[i])) != xmp[i]) { 2182 RT_UNLOCK(rt); 2183 return (0); 2184 } 2185 } 2186 } 2187 2188 for (i = rnh->rnh_treetop->rn_offset; i < len; i++) { 2189 if ((xk2[i] & xm1[i]) != xk1[i]) { 2190 RT_UNLOCK(rt); 2191 return (0); 2192 } 2193 } 2194 2195 /* 2196 * OK, this node is a clone, and matches the node currently being 2197 * changed/added under the node's mask. So, get rid of it. 2198 */ 2199delete_rt: 2200 /* 2201 * Safe to drop rt_lock and use rt_key, since holding rnh_lock here 2202 * prevents another thread from calling rt_setgate() on this route. 2203 */ 2204 RT_UNLOCK(rt); 2205 return (rtrequest_locked(RTM_DELETE, rt_key(rt), NULL, 2206 rt_mask(rt), rt->rt_flags, NULL)); 2207} 2208 2209/* 2210 * Round up sockaddr len to multiples of 32-bytes. This will reduce 2211 * or even eliminate the need to re-allocate the chunk of memory used 2212 * for rt_key and rt_gateway in the event the gateway portion changes. 2213 * Certain code paths (e.g. IPSec) are notorious for caching the address 2214 * of rt_gateway; this rounding-up would help ensure that the gateway 2215 * portion never gets deallocated (though it may change contents) and 2216 * thus greatly simplifies things. 2217 */ 2218#define SA_SIZE(x) (-(-((uintptr_t)(x)) & -(32))) 2219 2220/* 2221 * Sets the gateway and/or gateway route portion of a route; may be 2222 * called on an existing route to modify the gateway portion. Both 2223 * rt_key and rt_gateway are allocated out of the same memory chunk. 2224 * Route entry lock must be held by caller; this routine will return 2225 * with the lock held. 2226 */ 2227int 2228rt_setgate(struct rtentry *rt, struct sockaddr *dst, struct sockaddr *gate) 2229{ 2230 int dlen = SA_SIZE(dst->sa_len), glen = SA_SIZE(gate->sa_len); 2231 struct radix_node_head *rnh = rt_tables[dst->sa_family]; 2232 boolean_t loop = FALSE; 2233 2234 lck_mtx_assert(rnh_lock, LCK_MTX_ASSERT_OWNED); 2235 RT_LOCK_ASSERT_HELD(rt); 2236 2237 /* 2238 * If this is for a route that is on its way of being removed, 2239 * or is temporarily frozen, reject the modification request. 2240 */ 2241 if (rt->rt_flags & RTF_CONDEMNED) 2242 return (EBUSY); 2243 2244 /* Add an extra ref for ourselves */ 2245 RT_ADDREF_LOCKED(rt); 2246 2247 if (rt->rt_flags & RTF_GATEWAY) { 2248 if ((dst->sa_len == gate->sa_len) && 2249 (dst->sa_family == AF_INET || dst->sa_family == AF_INET6)) { 2250 struct sockaddr_storage dst_ss, gate_ss; 2251 2252 (void) sa_copy(dst, &dst_ss, NULL); 2253 (void) sa_copy(gate, &gate_ss, NULL); 2254 2255 loop = equal(SA(&dst_ss), SA(&gate_ss)); 2256 } else { 2257 loop = (dst->sa_len == gate->sa_len && 2258 equal(dst, gate)); 2259 } 2260 } 2261 2262 /* 2263 * A (cloning) network route with the destination equal to the gateway 2264 * will create an endless loop (see notes below), so disallow it. 2265 */ 2266 if (((rt->rt_flags & (RTF_HOST|RTF_GATEWAY|RTF_LLINFO)) == 2267 RTF_GATEWAY) && loop) { 2268 /* Release extra ref */ 2269 RT_REMREF_LOCKED(rt); 2270 return (EADDRNOTAVAIL); 2271 } 2272 2273 /* 2274 * A host route with the destination equal to the gateway 2275 * will interfere with keeping LLINFO in the routing 2276 * table, so disallow it. 2277 */ 2278 if (((rt->rt_flags & (RTF_HOST|RTF_GATEWAY|RTF_LLINFO)) == 2279 (RTF_HOST|RTF_GATEWAY)) && loop) { 2280 /* 2281 * The route might already exist if this is an RTM_CHANGE 2282 * or a routing redirect, so try to delete it. 2283 */ 2284 if (rt_key(rt) != NULL) { 2285 /* 2286 * Safe to drop rt_lock and use rt_key, rt_gateway, 2287 * since holding rnh_lock here prevents another thread 2288 * from calling rt_setgate() on this route. 2289 */ 2290 RT_UNLOCK(rt); 2291 (void) rtrequest_locked(RTM_DELETE, rt_key(rt), 2292 rt->rt_gateway, rt_mask(rt), rt->rt_flags, NULL); 2293 RT_LOCK(rt); 2294 } 2295 /* Release extra ref */ 2296 RT_REMREF_LOCKED(rt); 2297 return (EADDRNOTAVAIL); 2298 } 2299 2300 /* 2301 * The destination is not directly reachable. Get a route 2302 * to the next-hop gateway and store it in rt_gwroute. 2303 */ 2304 if (rt->rt_flags & RTF_GATEWAY) { 2305 struct rtentry *gwrt; 2306 unsigned int ifscope; 2307 2308 if (dst->sa_family == AF_INET) 2309 ifscope = sin_get_ifscope(dst); 2310 else if (dst->sa_family == AF_INET6) 2311 ifscope = sin6_get_ifscope(dst); 2312 else 2313 ifscope = IFSCOPE_NONE; 2314 2315 RT_UNLOCK(rt); 2316 /* 2317 * Don't ignore RTF_CLONING, since we prefer that rt_gwroute 2318 * points to a clone rather than a cloning route; see above 2319 * check for cloning loop avoidance (dst == gate). 2320 */ 2321 gwrt = rtalloc1_scoped_locked(gate, 1, RTF_PRCLONING, ifscope); 2322 if (gwrt != NULL) 2323 RT_LOCK_ASSERT_NOTHELD(gwrt); 2324 RT_LOCK(rt); 2325 2326 /* 2327 * Cloning loop avoidance: 2328 * 2329 * In the presence of protocol-cloning and bad configuration, 2330 * it is possible to get stuck in bottomless mutual recursion 2331 * (rtrequest rt_setgate rtalloc1). We avoid this by not 2332 * allowing protocol-cloning to operate for gateways (which 2333 * is probably the correct choice anyway), and avoid the 2334 * resulting reference loops by disallowing any route to run 2335 * through itself as a gateway. This is obviously mandatory 2336 * when we get rt->rt_output(). It implies that a route to 2337 * the gateway must already be present in the system in order 2338 * for the gateway to be referred to by another route. 2339 */ 2340 if (gwrt == rt) { 2341 RT_REMREF_LOCKED(gwrt); 2342 /* Release extra ref */ 2343 RT_REMREF_LOCKED(rt); 2344 return (EADDRINUSE); /* failure */ 2345 } 2346 2347 /* 2348 * If scoped, the gateway route must use the same interface; 2349 * we're holding rnh_lock now, so rt_gateway and rt_ifp of gwrt 2350 * should not change and are freely accessible. 2351 */ 2352 if (ifscope != IFSCOPE_NONE && (rt->rt_flags & RTF_IFSCOPE) && 2353 gwrt != NULL && gwrt->rt_ifp != NULL && 2354 gwrt->rt_ifp->if_index != ifscope) { 2355 rtfree_locked(gwrt); /* rt != gwrt, no deadlock */ 2356 /* Release extra ref */ 2357 RT_REMREF_LOCKED(rt); 2358 return ((rt->rt_flags & RTF_HOST) ? 2359 EHOSTUNREACH : ENETUNREACH); 2360 } 2361 2362 /* Check again since we dropped the lock above */ 2363 if (rt->rt_flags & RTF_CONDEMNED) { 2364 if (gwrt != NULL) 2365 rtfree_locked(gwrt); 2366 /* Release extra ref */ 2367 RT_REMREF_LOCKED(rt); 2368 return (EBUSY); 2369 } 2370 2371 /* Set gateway route; callee adds ref to gwrt if non-NULL */ 2372 rt_set_gwroute(rt, dst, gwrt); 2373 2374 /* 2375 * In case the (non-scoped) default route gets modified via 2376 * an ICMP redirect, record the interface index used for the 2377 * primary ifscope. Also done in rt_setif() to take care 2378 * of the non-redirect cases. 2379 */ 2380 if (rt_primary_default(rt, dst) && rt->rt_ifp != NULL) { 2381 set_primary_ifscope(dst->sa_family, 2382 rt->rt_ifp->if_index); 2383 } 2384 2385 /* 2386 * Tell the kernel debugger about the new default gateway 2387 * if the gateway route uses the primary interface, or 2388 * if we are in a transient state before the non-scoped 2389 * default gateway is installed (similar to how the system 2390 * was behaving in the past). In future, it would be good 2391 * to do all this only when KDP is enabled. 2392 */ 2393 if ((dst->sa_family == AF_INET) && 2394 gwrt != NULL && gwrt->rt_gateway->sa_family == AF_LINK && 2395 (gwrt->rt_ifp->if_index == get_primary_ifscope(AF_INET) || 2396 get_primary_ifscope(AF_INET) == IFSCOPE_NONE)) { 2397 kdp_set_gateway_mac(SDL((void *)gwrt->rt_gateway)-> 2398 sdl_data); 2399 } 2400 2401 /* Release extra ref from rtalloc1() */ 2402 if (gwrt != NULL) 2403 RT_REMREF(gwrt); 2404 } 2405 2406 /* 2407 * Prepare to store the gateway in rt_gateway. Both dst and gateway 2408 * are stored one after the other in the same malloc'd chunk. If we 2409 * have room, reuse the old buffer since rt_gateway already points 2410 * to the right place. Otherwise, malloc a new block and update 2411 * the 'dst' address and point rt_gateway to the right place. 2412 */ 2413 if (rt->rt_gateway == NULL || glen > SA_SIZE(rt->rt_gateway->sa_len)) { 2414 caddr_t new; 2415 2416 /* The underlying allocation is done with M_WAITOK set */ 2417 R_Malloc(new, caddr_t, dlen + glen); 2418 if (new == NULL) { 2419 /* Clear gateway route */ 2420 rt_set_gwroute(rt, dst, NULL); 2421 /* Release extra ref */ 2422 RT_REMREF_LOCKED(rt); 2423 return (ENOBUFS); 2424 } 2425 2426 /* 2427 * Copy from 'dst' and not rt_key(rt) because we can get 2428 * here to initialize a newly allocated route entry, in 2429 * which case rt_key(rt) is NULL (and so does rt_gateway). 2430 */ 2431 bzero(new, dlen + glen); 2432 Bcopy(dst, new, dst->sa_len); 2433 R_Free(rt_key(rt)); /* free old block; NULL is okay */ 2434 rt->rt_nodes->rn_key = new; 2435 rt->rt_gateway = (struct sockaddr *)(new + dlen); 2436 } 2437 2438 /* 2439 * Copy the new gateway value into the memory chunk. 2440 */ 2441 Bcopy(gate, rt->rt_gateway, gate->sa_len); 2442 2443 /* 2444 * For consistency between rt_gateway and rt_key(gwrt). 2445 */ 2446 if ((rt->rt_flags & RTF_GATEWAY) && rt->rt_gwroute != NULL && 2447 (rt->rt_gwroute->rt_flags & RTF_IFSCOPE)) { 2448 if (rt->rt_gateway->sa_family == AF_INET && 2449 rt_key(rt->rt_gwroute)->sa_family == AF_INET) { 2450 sin_set_ifscope(rt->rt_gateway, 2451 sin_get_ifscope(rt_key(rt->rt_gwroute))); 2452 } else if (rt->rt_gateway->sa_family == AF_INET6 && 2453 rt_key(rt->rt_gwroute)->sa_family == AF_INET6) { 2454 sin6_set_ifscope(rt->rt_gateway, 2455 sin6_get_ifscope(rt_key(rt->rt_gwroute))); 2456 } 2457 } 2458 2459 /* 2460 * This isn't going to do anything useful for host routes, so 2461 * don't bother. Also make sure we have a reasonable mask 2462 * (we don't yet have one during adds). 2463 */ 2464 if (!(rt->rt_flags & RTF_HOST) && rt_mask(rt) != 0) { 2465 struct rtfc_arg arg; 2466 arg.rnh = rnh; 2467 arg.rt0 = rt; 2468 RT_UNLOCK(rt); 2469 rnh->rnh_walktree_from(rnh, rt_key(rt), rt_mask(rt), 2470 rt_fixchange, &arg); 2471 RT_LOCK(rt); 2472 } 2473 2474 /* Release extra ref */ 2475 RT_REMREF_LOCKED(rt); 2476 return (0); 2477} 2478 2479#undef SA_SIZE 2480 2481void 2482rt_set_gwroute(struct rtentry *rt, struct sockaddr *dst, struct rtentry *gwrt) 2483{ 2484 boolean_t gwrt_isrouter; 2485 2486 lck_mtx_assert(rnh_lock, LCK_MTX_ASSERT_OWNED); 2487 RT_LOCK_ASSERT_HELD(rt); 2488 2489 if (gwrt != NULL) 2490 RT_ADDREF(gwrt); /* for this routine */ 2491 2492 /* 2493 * Get rid of existing gateway route; if rt_gwroute is already 2494 * set to gwrt, this is slightly redundant (though safe since 2495 * we held an extra ref above) but makes the code simpler. 2496 */ 2497 if (rt->rt_gwroute != NULL) { 2498 struct rtentry *ogwrt = rt->rt_gwroute; 2499 2500 VERIFY(rt != ogwrt); /* sanity check */ 2501 rt->rt_gwroute = NULL; 2502 RT_UNLOCK(rt); 2503 rtfree_locked(ogwrt); 2504 RT_LOCK(rt); 2505 VERIFY(rt->rt_gwroute == NULL); 2506 } 2507 2508 /* 2509 * And associate the new gateway route. 2510 */ 2511 if ((rt->rt_gwroute = gwrt) != NULL) { 2512 RT_ADDREF(gwrt); /* for rt */ 2513 2514 if (rt->rt_flags & RTF_WASCLONED) { 2515 /* rt_parent might be NULL if rt is embryonic */ 2516 gwrt_isrouter = (rt->rt_parent != NULL && 2517 SA_DEFAULT(rt_key(rt->rt_parent)) && 2518 !RT_HOST(rt->rt_parent)); 2519 } else { 2520 gwrt_isrouter = (SA_DEFAULT(dst) && !RT_HOST(rt)); 2521 } 2522 2523 /* If gwrt points to a default router, mark it accordingly */ 2524 if (gwrt_isrouter && RT_HOST(gwrt) && 2525 !(gwrt->rt_flags & RTF_ROUTER)) { 2526 RT_LOCK(gwrt); 2527 gwrt->rt_flags |= RTF_ROUTER; 2528 RT_UNLOCK(gwrt); 2529 } 2530 2531 RT_REMREF(gwrt); /* for this routine */ 2532 } 2533} 2534 2535static void 2536rt_maskedcopy(struct sockaddr *src, struct sockaddr *dst, 2537 struct sockaddr *netmask) 2538{ 2539 u_char *cp1 = (u_char *)src; 2540 u_char *cp2 = (u_char *)dst; 2541 u_char *cp3 = (u_char *)netmask; 2542 u_char *cplim = cp2 + *cp3; 2543 u_char *cplim2 = cp2 + *cp1; 2544 2545 *cp2++ = *cp1++; *cp2++ = *cp1++; /* copies sa_len & sa_family */ 2546 cp3 += 2; 2547 if (cplim > cplim2) 2548 cplim = cplim2; 2549 while (cp2 < cplim) 2550 *cp2++ = *cp1++ & *cp3++; 2551 if (cp2 < cplim2) 2552 bzero((caddr_t)cp2, (unsigned)(cplim2 - cp2)); 2553} 2554 2555/* 2556 * Lookup an AF_INET/AF_INET6 scoped or non-scoped route depending on the 2557 * ifscope value passed in by the caller (IFSCOPE_NONE implies non-scoped). 2558 */ 2559static struct radix_node * 2560node_lookup(struct sockaddr *dst, struct sockaddr *netmask, 2561 unsigned int ifscope) 2562{ 2563 struct radix_node_head *rnh; 2564 struct radix_node *rn; 2565 struct sockaddr_storage ss, mask; 2566 int af = dst->sa_family; 2567 struct matchleaf_arg ma = { ifscope }; 2568 rn_matchf_t *f = rn_match_ifscope; 2569 void *w = &ma; 2570 2571 if (af != AF_INET && af != AF_INET6) 2572 return (NULL); 2573 2574 rnh = rt_tables[af]; 2575 2576 /* 2577 * Transform dst into the internal routing table form, 2578 * clearing out the scope ID field if ifscope isn't set. 2579 */ 2580 dst = sa_copy(dst, &ss, (ifscope == IFSCOPE_NONE) ? NULL : &ifscope); 2581 2582 /* Transform netmask into the internal routing table form */ 2583 if (netmask != NULL) 2584 netmask = ma_copy(af, netmask, &mask, ifscope); 2585 2586 if (ifscope == IFSCOPE_NONE) 2587 f = w = NULL; 2588 2589 rn = rnh->rnh_lookup_args(dst, netmask, rnh, f, w); 2590 if (rn != NULL && (rn->rn_flags & RNF_ROOT)) 2591 rn = NULL; 2592 2593 return (rn); 2594} 2595 2596/* 2597 * Lookup the AF_INET/AF_INET6 non-scoped default route. 2598 */ 2599static struct radix_node * 2600node_lookup_default(int af) 2601{ 2602 struct radix_node_head *rnh; 2603 2604 VERIFY(af == AF_INET || af == AF_INET6); 2605 rnh = rt_tables[af]; 2606 2607 return (af == AF_INET ? rnh->rnh_lookup(&sin_def, NULL, rnh) : 2608 rnh->rnh_lookup(&sin6_def, NULL, rnh)); 2609} 2610 2611/* 2612 * Common routine to lookup/match a route. It invokes the lookup/matchaddr 2613 * callback which could be address family-specific. The main difference 2614 * between the two (at least for AF_INET/AF_INET6) is that a lookup does 2615 * not alter the expiring state of a route, whereas a match would unexpire 2616 * or revalidate the route. 2617 * 2618 * The optional scope or interface index property of a route allows for a 2619 * per-interface route instance. This permits multiple route entries having 2620 * the same destination (but not necessarily the same gateway) to exist in 2621 * the routing table; each of these entries is specific to the corresponding 2622 * interface. This is made possible by storing the scope ID value into the 2623 * radix key, thus making each route entry unique. These scoped entries 2624 * exist along with the regular, non-scoped entries in the same radix tree 2625 * for a given address family (AF_INET/AF_INET6); the scope logically 2626 * partitions it into multiple per-interface sub-trees. 2627 * 2628 * When a scoped route lookup is performed, the routing table is searched for 2629 * the best match that would result in a route using the same interface as the 2630 * one associated with the scope (the exception to this are routes that point 2631 * to the loopback interface). The search rule follows the longest matching 2632 * prefix with the additional interface constraint. 2633 */ 2634struct rtentry * 2635rt_lookup(boolean_t lookup_only, struct sockaddr *dst, struct sockaddr *netmask, 2636 struct radix_node_head *rnh, unsigned int ifscope) 2637{ 2638 struct radix_node *rn0, *rn; 2639 boolean_t dontcare; 2640 int af = dst->sa_family; 2641 struct sockaddr_storage dst_ss, mask_ss; 2642 2643 lck_mtx_assert(rnh_lock, LCK_MTX_ASSERT_OWNED); 2644 2645 if (!lookup_only) 2646 netmask = NULL; 2647 2648 /* 2649 * Non-scoped route lookup. 2650 */ 2651#if INET6 2652 if ((af != AF_INET && af != AF_INET6) || 2653 (af == AF_INET && !ip_doscopedroute) || 2654 (af == AF_INET6 && !ip6_doscopedroute)) { 2655#else 2656 if (af != AF_INET || !ip_doscopedroute) { 2657#endif /* !INET6 */ 2658 rn = rnh->rnh_matchaddr(dst, rnh); 2659 2660 /* 2661 * Don't return a root node; also, rnh_matchaddr callback 2662 * would have done the necessary work to clear RTPRF_OURS 2663 * for certain protocol families. 2664 */ 2665 if (rn != NULL && (rn->rn_flags & RNF_ROOT)) 2666 rn = NULL; 2667 if (rn != NULL) { 2668 RT_LOCK_SPIN(RT(rn)); 2669 if (!(RT(rn)->rt_flags & RTF_CONDEMNED)) { 2670 RT_ADDREF_LOCKED(RT(rn)); 2671 RT_UNLOCK(RT(rn)); 2672 } else { 2673 RT_UNLOCK(RT(rn)); 2674 rn = NULL; 2675 } 2676 } 2677 return (RT(rn)); 2678 } 2679 2680 /* Transform dst/netmask into the internal routing table form */ 2681 dst = sa_copy(dst, &dst_ss, &ifscope); 2682 if (netmask != NULL) 2683 netmask = ma_copy(af, netmask, &mask_ss, ifscope); 2684 dontcare = (ifscope == IFSCOPE_NONE); 2685 2686 /* 2687 * Scoped route lookup: 2688 * 2689 * We first perform a non-scoped lookup for the original result. 2690 * Afterwards, depending on whether or not the caller has specified 2691 * a scope, we perform a more specific scoped search and fallback 2692 * to this original result upon failure. 2693 */ 2694 rn0 = rn = node_lookup(dst, netmask, IFSCOPE_NONE); 2695 2696 /* 2697 * If the caller did not specify a scope, use the primary scope 2698 * derived from the system's non-scoped default route. If, for 2699 * any reason, there is no primary interface, ifscope will be 2700 * set to IFSCOPE_NONE; if the above lookup resulted in a route, 2701 * we'll do a more-specific search below, scoped to the interface 2702 * of that route. 2703 */ 2704 if (dontcare) 2705 ifscope = get_primary_ifscope(af); 2706 2707 /* 2708 * Keep the original result if either of the following is true: 2709 * 2710 * 1) The interface portion of the route has the same interface 2711 * index as the scope value and it is marked with RTF_IFSCOPE. 2712 * 2) The route uses the loopback interface, in which case the 2713 * destination (host/net) is local/loopback. 2714 * 2715 * Otherwise, do a more specified search using the scope; 2716 * we're holding rnh_lock now, so rt_ifp should not change. 2717 */ 2718 if (rn != NULL) { 2719 struct rtentry *rt = RT(rn); 2720 if (rt->rt_ifp != lo_ifp) { 2721 if (rt->rt_ifp->if_index != ifscope) { 2722 /* 2723 * Wrong interface; keep the original result 2724 * only if the caller did not specify a scope, 2725 * and do a more specific scoped search using 2726 * the scope of the found route. Otherwise, 2727 * start again from scratch. 2728 */ 2729 rn = NULL; 2730 if (dontcare) 2731 ifscope = rt->rt_ifp->if_index; 2732 else 2733 rn0 = NULL; 2734 } else if (!(rt->rt_flags & RTF_IFSCOPE)) { 2735 /* 2736 * Right interface, except that this route 2737 * isn't marked with RTF_IFSCOPE. Do a more 2738 * specific scoped search. Keep the original 2739 * result and return it it in case the scoped 2740 * search fails. 2741 */ 2742 rn = NULL; 2743 } 2744 } 2745 } 2746 2747 /* 2748 * Scoped search. Find the most specific entry having the same 2749 * interface scope as the one requested. The following will result 2750 * in searching for the longest prefix scoped match. 2751 */ 2752 if (rn == NULL) 2753 rn = node_lookup(dst, netmask, ifscope); 2754 2755 /* 2756 * Use the original result if either of the following is true: 2757 * 2758 * 1) The scoped search did not yield any result. 2759 * 2) The result from the scoped search is a scoped default route, 2760 * and the original (non-scoped) result is not a default route, 2761 * i.e. the original result is a more specific host/net route. 2762 * 3) The scoped search yielded a net route but the original 2763 * result is a host route, i.e. the original result is treated 2764 * as a more specific route. 2765 */ 2766 if (rn == NULL || (rn0 != NULL && 2767 ((SA_DEFAULT(rt_key(RT(rn))) && !SA_DEFAULT(rt_key(RT(rn0)))) || 2768 (!RT_HOST(rn) && RT_HOST(rn0))))) 2769 rn = rn0; 2770 2771 /* 2772 * If we still don't have a route, use the non-scoped default 2773 * route as long as the interface portion satistifes the scope. 2774 */ 2775 if (rn == NULL && (rn = node_lookup_default(af)) != NULL && 2776 RT(rn)->rt_ifp->if_index != ifscope) 2777 rn = NULL; 2778 2779 if (rn != NULL) { 2780 /* 2781 * Manually clear RTPRF_OURS using rt_validate() and 2782 * bump up the reference count after, and not before; 2783 * we only get here for AF_INET/AF_INET6. node_lookup() 2784 * has done the check against RNF_ROOT, so we can be sure 2785 * that we're not returning a root node here. 2786 */ 2787 RT_LOCK_SPIN(RT(rn)); 2788 if (rt_validate(RT(rn))) { 2789 RT_ADDREF_LOCKED(RT(rn)); 2790 RT_UNLOCK(RT(rn)); 2791 } else { 2792 RT_UNLOCK(RT(rn)); 2793 rn = NULL; 2794 } 2795 } 2796 2797 return (RT(rn)); 2798} 2799 2800boolean_t 2801rt_validate(struct rtentry *rt) 2802{ 2803 RT_LOCK_ASSERT_HELD(rt); 2804 2805 if ((rt->rt_flags & (RTF_UP | RTF_CONDEMNED)) == RTF_UP) { 2806 int af = rt_key(rt)->sa_family; 2807 2808 if (af == AF_INET) 2809 (void) in_validate(RN(rt)); 2810 else if (af == AF_INET6) 2811 (void) in6_validate(RN(rt)); 2812 } else { 2813 rt = NULL; 2814 } 2815 2816 return (rt != NULL); 2817} 2818 2819/* 2820 * Set up a routing table entry, normally 2821 * for an interface. 2822 */ 2823int 2824rtinit(struct ifaddr *ifa, int cmd, int flags) 2825{ 2826 int error; 2827 lck_mtx_assert(rnh_lock, LCK_MTX_ASSERT_NOTOWNED); 2828 lck_mtx_lock(rnh_lock); 2829 error = rtinit_locked(ifa, cmd, flags); 2830 lck_mtx_unlock(rnh_lock); 2831 return (error); 2832} 2833 2834int 2835rtinit_locked(struct ifaddr *ifa, int cmd, int flags) 2836{ 2837 struct rtentry *rt; 2838 struct sockaddr *dst; 2839 struct sockaddr *deldst; 2840 struct mbuf *m = 0; 2841 struct rtentry *nrt = 0; 2842 u_int32_t ifa_flags; 2843 int error; 2844 2845 /* 2846 * Holding rnh_lock here prevents the possibility of ifa from 2847 * changing (e.g. in_ifinit), so it is safe to access its 2848 * ifa_{dst}addr (here and down below) without locking. 2849 */ 2850 dst = flags & RTF_HOST ? ifa->ifa_dstaddr : ifa->ifa_addr; 2851 /* 2852 * If it's a delete, check that if it exists, it's on the correct 2853 * interface or we might scrub a route to another ifa which would 2854 * be confusing at best and possibly worse. 2855 */ 2856 if (cmd == RTM_DELETE) { 2857 /* 2858 * It's a delete, so it should already exist.. 2859 * If it's a net, mask off the host bits 2860 * (Assuming we have a mask) 2861 */ 2862 if ((flags & RTF_HOST) == 0 && ifa->ifa_netmask) { 2863 m = m_get(M_DONTWAIT, MT_SONAME); 2864 if (m == NULL) { 2865 return(ENOBUFS); 2866 } 2867 deldst = mtod(m, struct sockaddr *); 2868 rt_maskedcopy(dst, deldst, ifa->ifa_netmask); 2869 dst = deldst; 2870 } 2871 /* 2872 * Get an rtentry that is in the routing tree and 2873 * contains the correct info. (if this fails, can't get there). 2874 * We set "report" to FALSE so that if it doesn't exist, 2875 * it doesn't report an error or clone a route, etc. etc. 2876 */ 2877 rt = rtalloc1_locked(dst, 0, 0); 2878 if (rt) { 2879 /* 2880 * Ok so we found the rtentry. it has an extra reference 2881 * for us at this stage. we won't need that so 2882 * lop that off now. 2883 */ 2884 RT_LOCK_SPIN(rt); 2885 if (rt->rt_ifa != ifa) { 2886 RT_REMREF_LOCKED(rt); 2887 RT_UNLOCK(rt); 2888 /* 2889 * If the interface in the rtentry doesn't match 2890 * the interface we are using, then we don't 2891 * want to delete it, so return an error. 2892 * This seems to be the only point of 2893 * this whole RTM_DELETE clause. 2894 */ 2895 if (m) 2896 (void) m_free(m); 2897 return (flags & RTF_HOST ? EHOSTUNREACH 2898 : ENETUNREACH); 2899 } else { 2900 RT_REMREF_LOCKED(rt); 2901 RT_UNLOCK(rt); 2902 } 2903 } 2904 /* XXX */ 2905#if 0 2906 else { 2907 /* 2908 * One would think that as we are deleting, and we know 2909 * it doesn't exist, we could just return at this point 2910 * with an "ELSE" clause, but apparently not.. 2911 */ 2912 lck_mtx_unlock(rnh_lock); 2913 return (flags & RTF_HOST ? EHOSTUNREACH 2914 : ENETUNREACH); 2915 } 2916#endif 2917 } 2918 /* 2919 * Do the actual request 2920 */ 2921 IFA_LOCK_SPIN(ifa); 2922 ifa_flags = ifa->ifa_flags; 2923 IFA_UNLOCK(ifa); 2924 error = rtrequest_locked(cmd, dst, ifa->ifa_addr, ifa->ifa_netmask, 2925 flags | ifa_flags, &nrt); 2926 if (m) 2927 (void) m_free(m); 2928 /* 2929 * If we are deleting, and we found an entry, then 2930 * it's been removed from the tree.. now throw it away. 2931 */ 2932 if (cmd == RTM_DELETE && error == 0 && (rt = nrt)) { 2933 /* 2934 * notify any listening routing agents of the change 2935 */ 2936 RT_LOCK(rt); 2937 rt_newaddrmsg(cmd, ifa, error, nrt); 2938 if (use_routegenid) 2939 routegenid_update(); 2940 RT_UNLOCK(rt); 2941 rtfree_locked(rt); 2942 } 2943 2944 /* 2945 * We are adding, and we have a returned routing entry. 2946 * We need to sanity check the result. 2947 */ 2948 if (cmd == RTM_ADD && error == 0 && (rt = nrt)) { 2949 RT_LOCK(rt); 2950 /* 2951 * If it came back with an unexpected interface, then it must 2952 * have already existed or something. (XXX) 2953 */ 2954 if (rt->rt_ifa != ifa) { 2955 void (*ifa_rtrequest) 2956 (int, struct rtentry *, struct sockaddr *); 2957 2958 if (!(rt->rt_ifa->ifa_ifp->if_flags & 2959 (IFF_POINTOPOINT|IFF_LOOPBACK))) 2960 printf("rtinit: wrong ifa (%p) was (%p)\n", 2961 ifa, rt->rt_ifa); 2962 /* 2963 * Ask that the protocol in question 2964 * remove anything it has associated with 2965 * this route and ifaddr. 2966 */ 2967 IFA_LOCK_SPIN(rt->rt_ifa); 2968 ifa_rtrequest = rt->rt_ifa->ifa_rtrequest; 2969 IFA_UNLOCK(rt->rt_ifa); 2970 if (ifa_rtrequest != NULL) 2971 ifa_rtrequest(RTM_DELETE, rt, SA(0)); 2972 /* 2973 * Set the route's ifa. 2974 */ 2975 rtsetifa(rt, ifa); 2976 2977 if (rt->rt_ifp != ifa->ifa_ifp) { 2978 /* 2979 * Purge any link-layer info caching. 2980 */ 2981 if (rt->rt_llinfo_purge != NULL) 2982 rt->rt_llinfo_purge(rt); 2983 /* 2984 * Adjust route ref count for the interfaces. 2985 */ 2986 if (rt->rt_if_ref_fn != NULL) { 2987 rt->rt_if_ref_fn(ifa->ifa_ifp, 1); 2988 rt->rt_if_ref_fn(rt->rt_ifp, -1); 2989 } 2990 } 2991 2992 /* 2993 * And substitute in references to the ifaddr 2994 * we are adding. 2995 */ 2996 rt->rt_ifp = ifa->ifa_ifp; 2997 rt->rt_rmx.rmx_mtu = ifa->ifa_ifp->if_mtu; /*XXX*/ 2998 /* 2999 * Now ask the protocol to check if it needs 3000 * any special processing in its new form. 3001 */ 3002 IFA_LOCK_SPIN(ifa); 3003 ifa_rtrequest = ifa->ifa_rtrequest; 3004 IFA_UNLOCK(ifa); 3005 if (ifa_rtrequest != NULL) 3006 ifa_rtrequest(RTM_ADD, rt, SA(0)); 3007 } 3008 /* 3009 * notify any listenning routing agents of the change 3010 */ 3011 rt_newaddrmsg(cmd, ifa, error, nrt); 3012 if (use_routegenid) 3013 routegenid_update(); 3014 /* 3015 * We just wanted to add it; we don't actually need a 3016 * reference. This will result in a route that's added 3017 * to the routing table without a reference count. The 3018 * RTM_DELETE code will do the necessary step to adjust 3019 * the reference count at deletion time. 3020 */ 3021 RT_REMREF_LOCKED(rt); 3022 RT_UNLOCK(rt); 3023 } 3024 return (error); 3025} 3026 3027u_int64_t 3028rt_expiry(struct rtentry *rt, u_int64_t base, u_int32_t delta) 3029{ 3030 u_int64_t retval; 3031 3032 /* 3033 * If the interface of the route doesn't demand aggressive draining, 3034 * return the expiration time based on the caller-supplied delta. 3035 * Otherwise use the more aggressive route expiration delta (or 3036 * the caller-supplied delta, whichever is less.) 3037 */ 3038 if (rt->rt_ifp == NULL || rt->rt_ifp->if_want_aggressive_drain == 0) 3039 retval = base + delta; 3040 else 3041 retval = base + MIN(rt_if_idle_expire_timeout, delta); 3042 3043 return (retval); 3044} 3045 3046void 3047rt_set_idleref(struct rtentry *rt) 3048{ 3049 RT_LOCK_ASSERT_HELD(rt); 3050 3051 rt_clear_idleref(rt); 3052 rt->rt_if_ref_fn = rte_if_ref; 3053 rt->rt_if_ref_fn(rt->rt_ifp, 1); 3054 rt->rt_flags |= RTF_IFREF; 3055} 3056 3057void 3058rt_clear_idleref(struct rtentry *rt) 3059{ 3060 RT_LOCK_ASSERT_HELD(rt); 3061 3062 if (rt->rt_if_ref_fn != NULL) { 3063 rt->rt_if_ref_fn(rt->rt_ifp, -1); 3064 rt->rt_flags &= ~RTF_IFREF; 3065 rt->rt_if_ref_fn = NULL; 3066 } 3067} 3068 3069void 3070rt_set_proxy(struct rtentry *rt, boolean_t set) 3071{ 3072 lck_mtx_lock(rnh_lock); 3073 RT_LOCK(rt); 3074 /* 3075 * Search for any cloned routes which might have 3076 * been formed from this node, and delete them. 3077 */ 3078 if (rt->rt_flags & (RTF_CLONING | RTF_PRCLONING)) { 3079 struct radix_node_head *rnh = rt_tables[rt_key(rt)->sa_family]; 3080 3081 if (set) 3082 rt->rt_flags |= RTF_PROXY; 3083 else 3084 rt->rt_flags &= ~RTF_PROXY; 3085 3086 RT_UNLOCK(rt); 3087 if (rnh != NULL && rt_mask(rt)) { 3088 rnh->rnh_walktree_from(rnh, rt_key(rt), rt_mask(rt), 3089 rt_fixdelete, rt); 3090 } 3091 } else { 3092 RT_UNLOCK(rt); 3093 } 3094 lck_mtx_unlock(rnh_lock); 3095} 3096 3097static void 3098rte_lock_init(struct rtentry *rt) 3099{ 3100 lck_mtx_init(&rt->rt_lock, rte_mtx_grp, rte_mtx_attr); 3101} 3102 3103static void 3104rte_lock_destroy(struct rtentry *rt) 3105{ 3106 RT_LOCK_ASSERT_NOTHELD(rt); 3107 lck_mtx_destroy(&rt->rt_lock, rte_mtx_grp); 3108} 3109 3110void 3111rt_lock(struct rtentry *rt, boolean_t spin) 3112{ 3113 RT_LOCK_ASSERT_NOTHELD(rt); 3114 if (spin) 3115 lck_mtx_lock_spin(&rt->rt_lock); 3116 else 3117 lck_mtx_lock(&rt->rt_lock); 3118 if (rte_debug & RTD_DEBUG) 3119 rte_lock_debug((struct rtentry_dbg *)rt); 3120} 3121 3122void 3123rt_unlock(struct rtentry *rt) 3124{ 3125 RT_LOCK_ASSERT_HELD(rt); 3126 if (rte_debug & RTD_DEBUG) 3127 rte_unlock_debug((struct rtentry_dbg *)rt); 3128 lck_mtx_unlock(&rt->rt_lock); 3129 3130} 3131 3132static inline void 3133rte_lock_debug(struct rtentry_dbg *rte) 3134{ 3135 uint32_t idx; 3136 3137 idx = atomic_add_32_ov(&rte->rtd_lock_cnt, 1) % CTRACE_HIST_SIZE; 3138 if (rte_debug & RTD_TRACE) 3139 ctrace_record(&rte->rtd_lock[idx]); 3140} 3141 3142static inline void 3143rte_unlock_debug(struct rtentry_dbg *rte) 3144{ 3145 uint32_t idx; 3146 3147 idx = atomic_add_32_ov(&rte->rtd_unlock_cnt, 1) % CTRACE_HIST_SIZE; 3148 if (rte_debug & RTD_TRACE) 3149 ctrace_record(&rte->rtd_unlock[idx]); 3150} 3151 3152static struct rtentry * 3153rte_alloc(void) 3154{ 3155 if (rte_debug & RTD_DEBUG) 3156 return (rte_alloc_debug()); 3157 3158 return ((struct rtentry *)zalloc(rte_zone)); 3159} 3160 3161static void 3162rte_free(struct rtentry *p) 3163{ 3164 if (rte_debug & RTD_DEBUG) { 3165 rte_free_debug(p); 3166 return; 3167 } 3168 3169 if (p->rt_refcnt != 0) 3170 panic("rte_free: rte=%p refcnt=%d non-zero\n", p, p->rt_refcnt); 3171 3172 zfree(rte_zone, p); 3173} 3174 3175static void 3176rte_if_ref(struct ifnet *ifp, int cnt) 3177{ 3178 struct kev_msg ev_msg; 3179 struct net_event_data ev_data; 3180 uint32_t old; 3181 3182 /* Force cnt to 1 increment/decrement */ 3183 if (cnt < -1 || cnt > 1) 3184 panic("%s: invalid count argument (%d)", __func__, cnt); 3185 3186 old = atomic_add_32_ov(&ifp->if_route_refcnt, cnt); 3187 if (cnt < 0 && old == 0) 3188 panic("%s: ifp=%p negative route refcnt!", __func__, ifp); 3189 3190 /* 3191 * The following is done without first holding the ifnet lock, 3192 * for performance reasons. The relevant ifnet fields, with 3193 * the exception of the if_idle_flags, are never changed 3194 * during the lifetime of the ifnet. The if_idle_flags 3195 * may possibly be modified, so in the event that the value 3196 * is stale because IFRF_IDLE_NOTIFY was cleared, we'd end up 3197 * sending the event anyway. This is harmless as it is just 3198 * a notification to the monitoring agent in user space, and 3199 * it is expected to check via SIOCGIFGETRTREFCNT again anyway. 3200 */ 3201 if ((ifp->if_idle_flags & IFRF_IDLE_NOTIFY) && cnt < 0 && old == 1) { 3202 bzero(&ev_msg, sizeof (ev_msg)); 3203 bzero(&ev_data, sizeof (ev_data)); 3204 3205 ev_msg.vendor_code = KEV_VENDOR_APPLE; 3206 ev_msg.kev_class = KEV_NETWORK_CLASS; 3207 ev_msg.kev_subclass = KEV_DL_SUBCLASS; 3208 ev_msg.event_code = KEV_DL_IF_IDLE_ROUTE_REFCNT; 3209 3210 strlcpy(&ev_data.if_name[0], ifp->if_name, IFNAMSIZ); 3211 3212 ev_data.if_family = ifp->if_family; 3213 ev_data.if_unit = ifp->if_unit; 3214 ev_msg.dv[0].data_length = sizeof (struct net_event_data); 3215 ev_msg.dv[0].data_ptr = &ev_data; 3216 3217 kev_post_msg(&ev_msg); 3218 } 3219} 3220 3221static inline struct rtentry * 3222rte_alloc_debug(void) 3223{ 3224 struct rtentry_dbg *rte; 3225 3226 rte = ((struct rtentry_dbg *)zalloc(rte_zone)); 3227 if (rte != NULL) { 3228 bzero(rte, sizeof (*rte)); 3229 if (rte_debug & RTD_TRACE) 3230 ctrace_record(&rte->rtd_alloc); 3231 rte->rtd_inuse = RTD_INUSE; 3232 } 3233 return ((struct rtentry *)rte); 3234} 3235 3236static inline void 3237rte_free_debug(struct rtentry *p) 3238{ 3239 struct rtentry_dbg *rte = (struct rtentry_dbg *)p; 3240 3241 if (p->rt_refcnt != 0) 3242 panic("rte_free: rte=%p refcnt=%d\n", p, p->rt_refcnt); 3243 3244 if (rte->rtd_inuse == RTD_FREED) 3245 panic("rte_free: double free rte=%p\n", rte); 3246 else if (rte->rtd_inuse != RTD_INUSE) 3247 panic("rte_free: corrupted rte=%p\n", rte); 3248 3249 bcopy((caddr_t)p, (caddr_t)&rte->rtd_entry_saved, sizeof (*p)); 3250 /* Preserve rt_lock to help catch use-after-free cases */ 3251 bzero((caddr_t)p, offsetof(struct rtentry, rt_lock)); 3252 3253 rte->rtd_inuse = RTD_FREED; 3254 3255 if (rte_debug & RTD_TRACE) 3256 ctrace_record(&rte->rtd_free); 3257 3258 if (!(rte_debug & RTD_NO_FREE)) 3259 zfree(rte_zone, p); 3260} 3261 3262void 3263ctrace_record(ctrace_t *tr) 3264{ 3265 tr->th = current_thread(); 3266 bzero(tr->pc, sizeof (tr->pc)); 3267 (void) OSBacktrace(tr->pc, CTRACE_STACK_SIZE); 3268} 3269 3270__private_extern__ void 3271route_copyout( 3272 struct route *dst, 3273 const struct route *src, 3274 size_t length) 3275{ 3276 /* Copy everything (rt, dst, flags) from ifnet */ 3277 bcopy(src, dst, length); 3278 3279 /* Hold one reference for the local copy of struct route */ 3280 if (dst->ro_rt != NULL) 3281 RT_ADDREF(dst->ro_rt); 3282} 3283 3284__private_extern__ void 3285route_copyin( 3286 struct route *src, 3287 struct route *dst, 3288 size_t length) 3289{ 3290 /* No cached route in the ifnet? */ 3291 if (dst->ro_rt == NULL) { 3292 /* 3293 * Copy everything (rt, dst, flags) from ip_forward(); 3294 * the reference to the route was held at the time 3295 * it was allocated and is kept intact. 3296 */ 3297 bcopy(src, dst, length); 3298 } else if (src->ro_rt != NULL) { 3299 /* 3300 * If the same, update just the ro_flags and ditch the one 3301 * in the local copy. Else ditch the one that is currently 3302 * cached, and cache the new route. 3303 */ 3304 if (dst->ro_rt == src->ro_rt) { 3305 dst->ro_flags = src->ro_flags; 3306 rtfree(src->ro_rt); 3307 } else { 3308 rtfree(dst->ro_rt); 3309 bcopy(src, dst, length); 3310 } 3311 } 3312 3313 /* This function consumes the reference */ 3314 src->ro_rt = NULL; 3315} 3316 3317/* 3318 * route_to_gwroute will find the gateway route for a given route. 3319 * 3320 * If the route is down, look the route up again. 3321 * If the route goes through a gateway, get the route to the gateway. 3322 * If the gateway route is down, look it up again. 3323 * If the route is set to reject, verify it hasn't expired. 3324 * 3325 * If the returned route is non-NULL, the caller is responsible for 3326 * releasing the reference and unlocking the route. 3327 */ 3328#define senderr(e) { error = (e); goto bad; } 3329errno_t 3330route_to_gwroute(const struct sockaddr *net_dest, struct rtentry *hint0, 3331 struct rtentry **out_route) 3332{ 3333 uint64_t timenow; 3334 struct rtentry *rt = hint0, *hint = hint0; 3335 errno_t error = 0; 3336 unsigned int ifindex; 3337 boolean_t gwroute; 3338 3339 *out_route = NULL; 3340 3341 if (rt == NULL) 3342 return (0); 3343 3344 /* 3345 * Next hop determination. Because we may involve the gateway route 3346 * in addition to the original route, locking is rather complicated. 3347 * The general concept is that regardless of whether the route points 3348 * to the original route or to the gateway route, this routine takes 3349 * an extra reference on such a route. This extra reference will be 3350 * released at the end. 3351 * 3352 * Care must be taken to ensure that the "hint0" route never gets freed 3353 * via rtfree(), since the caller may have stored it inside a struct 3354 * route with a reference held for that placeholder. 3355 */ 3356 RT_LOCK_SPIN(rt); 3357 ifindex = rt->rt_ifp->if_index; 3358 RT_ADDREF_LOCKED(rt); 3359 if (!(rt->rt_flags & RTF_UP)) { 3360 RT_REMREF_LOCKED(rt); 3361 RT_UNLOCK(rt); 3362 /* route is down, find a new one */ 3363 hint = rt = rtalloc1_scoped((struct sockaddr *) 3364 (size_t)net_dest, 1, 0, ifindex); 3365 if (hint != NULL) { 3366 RT_LOCK_SPIN(rt); 3367 ifindex = rt->rt_ifp->if_index; 3368 } else { 3369 senderr(EHOSTUNREACH); 3370 } 3371 } 3372 3373 /* 3374 * We have a reference to "rt" by now; it will either 3375 * be released or freed at the end of this routine. 3376 */ 3377 RT_LOCK_ASSERT_HELD(rt); 3378 if ((gwroute = (rt->rt_flags & RTF_GATEWAY))) { 3379 struct rtentry *gwrt = rt->rt_gwroute; 3380 struct sockaddr_storage ss; 3381 struct sockaddr *gw = (struct sockaddr *)&ss; 3382 3383 VERIFY(rt == hint); 3384 RT_ADDREF_LOCKED(hint); 3385 3386 /* If there's no gateway rt, look it up */ 3387 if (gwrt == NULL) { 3388 bcopy(rt->rt_gateway, gw, MIN(sizeof (ss), 3389 rt->rt_gateway->sa_len)); 3390 RT_UNLOCK(rt); 3391 goto lookup; 3392 } 3393 /* Become a regular mutex */ 3394 RT_CONVERT_LOCK(rt); 3395 3396 /* 3397 * Take gwrt's lock while holding route's lock; 3398 * this is okay since gwrt never points back 3399 * to "rt", so no lock ordering issues. 3400 */ 3401 RT_LOCK_SPIN(gwrt); 3402 if (!(gwrt->rt_flags & RTF_UP)) { 3403 rt->rt_gwroute = NULL; 3404 RT_UNLOCK(gwrt); 3405 bcopy(rt->rt_gateway, gw, MIN(sizeof (ss), 3406 rt->rt_gateway->sa_len)); 3407 RT_UNLOCK(rt); 3408 rtfree(gwrt); 3409lookup: 3410 lck_mtx_lock(rnh_lock); 3411 gwrt = rtalloc1_scoped_locked(gw, 1, 0, ifindex); 3412 3413 RT_LOCK(rt); 3414 /* 3415 * Bail out if the route is down, no route 3416 * to gateway, circular route, or if the 3417 * gateway portion of "rt" has changed. 3418 */ 3419 if (!(rt->rt_flags & RTF_UP) || gwrt == NULL || 3420 gwrt == rt || !equal(gw, rt->rt_gateway)) { 3421 if (gwrt == rt) { 3422 RT_REMREF_LOCKED(gwrt); 3423 gwrt = NULL; 3424 } 3425 VERIFY(rt == hint); 3426 RT_REMREF_LOCKED(hint); 3427 hint = NULL; 3428 RT_UNLOCK(rt); 3429 if (gwrt != NULL) 3430 rtfree_locked(gwrt); 3431 lck_mtx_unlock(rnh_lock); 3432 senderr(EHOSTUNREACH); 3433 } 3434 VERIFY(gwrt != NULL); 3435 /* 3436 * Set gateway route; callee adds ref to gwrt; 3437 * gwrt has an extra ref from rtalloc1() for 3438 * this routine. 3439 */ 3440 rt_set_gwroute(rt, rt_key(rt), gwrt); 3441 VERIFY(rt == hint); 3442 RT_REMREF_LOCKED(rt); /* hint still holds a refcnt */ 3443 RT_UNLOCK(rt); 3444 lck_mtx_unlock(rnh_lock); 3445 rt = gwrt; 3446 } else { 3447 RT_ADDREF_LOCKED(gwrt); 3448 RT_UNLOCK(gwrt); 3449 VERIFY(rt == hint); 3450 RT_REMREF_LOCKED(rt); /* hint still holds a refcnt */ 3451 RT_UNLOCK(rt); 3452 rt = gwrt; 3453 } 3454 VERIFY(rt == gwrt && rt != hint); 3455 3456 /* 3457 * This is an opportunity to revalidate the parent route's 3458 * rt_gwroute, in case it now points to a dead route entry. 3459 * Parent route won't go away since the clone (hint) holds 3460 * a reference to it. rt == gwrt. 3461 */ 3462 RT_LOCK_SPIN(hint); 3463 if ((hint->rt_flags & (RTF_WASCLONED | RTF_UP)) == 3464 (RTF_WASCLONED | RTF_UP)) { 3465 struct rtentry *prt = hint->rt_parent; 3466 VERIFY(prt != NULL); 3467 3468 RT_CONVERT_LOCK(hint); 3469 RT_ADDREF(prt); 3470 RT_UNLOCK(hint); 3471 rt_revalidate_gwroute(prt, rt); 3472 RT_REMREF(prt); 3473 } else { 3474 RT_UNLOCK(hint); 3475 } 3476 3477 /* Clean up "hint" now; see notes above regarding hint0 */ 3478 if (hint == hint0) 3479 RT_REMREF(hint); 3480 else 3481 rtfree(hint); 3482 hint = NULL; 3483 3484 /* rt == gwrt; if it is now down, give up */ 3485 RT_LOCK_SPIN(rt); 3486 if (!(rt->rt_flags & RTF_UP)) { 3487 RT_UNLOCK(rt); 3488 senderr(EHOSTUNREACH); 3489 } 3490 } 3491 3492 if (rt->rt_flags & RTF_REJECT) { 3493 VERIFY(rt->rt_expire == 0 || rt->rt_rmx.rmx_expire != 0); 3494 VERIFY(rt->rt_expire != 0 || rt->rt_rmx.rmx_expire == 0); 3495 timenow = net_uptime(); 3496 if (rt->rt_expire == 0 || timenow < rt->rt_expire) { 3497 RT_UNLOCK(rt); 3498 senderr(!gwroute ? EHOSTDOWN : EHOSTUNREACH); 3499 } 3500 } 3501 3502 /* Become a regular mutex */ 3503 RT_CONVERT_LOCK(rt); 3504 3505 /* Caller is responsible for cleaning up "rt" */ 3506 *out_route = rt; 3507 return (0); 3508 3509bad: 3510 /* Clean up route (either it is "rt" or "gwrt") */ 3511 if (rt != NULL) { 3512 RT_LOCK_SPIN(rt); 3513 if (rt == hint0) { 3514 RT_REMREF_LOCKED(rt); 3515 RT_UNLOCK(rt); 3516 } else { 3517 RT_UNLOCK(rt); 3518 rtfree(rt); 3519 } 3520 } 3521 return (error); 3522} 3523#undef senderr 3524 3525void 3526rt_revalidate_gwroute(struct rtentry *rt, struct rtentry *gwrt) 3527{ 3528 VERIFY(rt->rt_flags & (RTF_CLONING | RTF_PRCLONING)); 3529 VERIFY(gwrt != NULL); 3530 3531 RT_LOCK_SPIN(rt); 3532 if ((rt->rt_flags & (RTF_GATEWAY | RTF_UP)) == (RTF_GATEWAY | RTF_UP) && 3533 rt->rt_ifp == gwrt->rt_ifp && rt->rt_gateway->sa_family == 3534 rt_key(gwrt)->sa_family && (rt->rt_gwroute == NULL || 3535 !(rt->rt_gwroute->rt_flags & RTF_UP))) { 3536 boolean_t isequal; 3537 3538 if (rt->rt_gateway->sa_family == AF_INET || 3539 rt->rt_gateway->sa_family == AF_INET6) { 3540 struct sockaddr_storage key_ss, gw_ss; 3541 /* 3542 * We need to compare rt_key and rt_gateway; create 3543 * local copies to get rid of any ifscope association. 3544 */ 3545 (void) sa_copy(rt_key(gwrt), &key_ss, NULL); 3546 (void) sa_copy(rt->rt_gateway, &gw_ss, NULL); 3547 3548 isequal = equal(SA(&key_ss), SA(&gw_ss)); 3549 } else { 3550 isequal = equal(rt_key(gwrt), rt->rt_gateway); 3551 } 3552 3553 /* If they are the same, update gwrt */ 3554 if (isequal) { 3555 RT_UNLOCK(rt); 3556 lck_mtx_lock(rnh_lock); 3557 RT_LOCK(rt); 3558 rt_set_gwroute(rt, rt_key(rt), gwrt); 3559 RT_UNLOCK(rt); 3560 lck_mtx_unlock(rnh_lock); 3561 } else { 3562 RT_UNLOCK(rt); 3563 } 3564 } else { 3565 RT_UNLOCK(rt); 3566 } 3567} 3568