1 /*
2  * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
3  * Use is subject to license terms.
4  *
5  * Copyright (c) 1983, 1988, 1993
6  *	The Regents of the University of California.  All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. All advertising materials mentioning features or use of this software
17  *    must display the following acknowledgment:
18  *	This product includes software developed by the University of
19  *	California, Berkeley and its contributors.
20  * 4. Neither the name of the University nor the names of its contributors
21  *    may be used to endorse or promote products derived from this software
22  *    without specific prior written permission.
23  *
24  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
25  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
28  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
29  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
30  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
33  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34  * SUCH DAMAGE.
35  *
36  * $FreeBSD: src/sbin/routed/table.c,v 1.15 2000/08/11 08:24:38 sheldonh Exp $
37  */
38 
39 #pragma ident	"%Z%%M%	%I%	%E% SMI"
40 
41 #include "defs.h"
42 #include <fcntl.h>
43 #include <stropts.h>
44 #include <sys/tihdr.h>
45 #include <inet/mib2.h>
46 #include <inet/ip.h>
47 
48 /* This structure is used to store a disassembled routing socket message. */
49 struct rt_addrinfo {
50 	int	rti_addrs;
51 	struct sockaddr_storage *rti_info[RTAX_MAX];
52 };
53 
54 static struct rt_spare *rts_better(struct rt_entry *);
55 static struct rt_spare rts_empty = EMPTY_RT_SPARE;
56 static void set_need_flash(void);
57 static void rtbad(struct rt_entry *, struct interface *);
58 static int rt_xaddrs(struct rt_addrinfo *, struct sockaddr_storage *,
59     char *, int);
60 static struct interface *gwkludge_iflookup(in_addr_t, in_addr_t, in_addr_t);
61 
62 struct radix_node_head *rhead;		/* root of the radix tree */
63 
64 /* Flash update needed.  _B_TRUE to suppress the 1st. */
65 boolean_t need_flash = _B_TRUE;
66 
67 struct timeval age_timer;		/* next check of old routes */
68 struct timeval need_kern = {		/* need to update kernel table */
69 	EPOCH+MIN_WAITTIME-1, 0
70 };
71 
72 static uint32_t	total_routes;
73 
74 #define	ROUNDUP_LONG(a) \
75 	((a) > 0 ? (1 + (((a) - 1) | (sizeof (long) - 1))) : sizeof (long))
76 
77 /*
78  * It is desirable to "aggregate" routes, to combine differing routes of
79  * the same metric and next hop into a common route with a smaller netmask
80  * or to suppress redundant routes, routes that add no information to
81  * routes with smaller netmasks.
82  *
83  * A route is redundant if and only if any and all routes with smaller
84  * but matching netmasks and nets are the same.  Since routes are
85  * kept sorted in the radix tree, redundant routes always come second.
86  *
87  * There are two kinds of aggregations.  First, two routes of the same bit
88  * mask and differing only in the least significant bit of the network
89  * number can be combined into a single route with a coarser mask.
90  *
91  * Second, a route can be suppressed in favor of another route with a more
92  * coarse mask provided no incompatible routes with intermediate masks
93  * are present.  The second kind of aggregation involves suppressing routes.
94  * A route must not be suppressed if an incompatible route exists with
95  * an intermediate mask, since the suppressed route would be covered
96  * by the intermediate.
97  *
98  * This code relies on the radix tree walk encountering routes
99  * sorted first by address, with the smallest address first.
100  */
101 
102 static struct ag_info ag_slots[NUM_AG_SLOTS], *ag_avail, *ag_corsest,
103 	*ag_finest;
104 
105 #ifdef DEBUG_AG
106 #define	CHECK_AG() do { int acnt = 0; struct ag_info *cag;	\
107 	for (cag = ag_avail; cag != NULL; cag = cag->ag_fine)	\
108 		acnt++;						\
109 	for (cag = ag_corsest; cag != NULL; cag = cag->ag_fine)	\
110 		acnt++;						\
111 	if (acnt != NUM_AG_SLOTS)				\
112 		abort();					\
113 } while (_B_FALSE)
114 #else
115 #define	CHECK_AG()	(void)0
116 #endif
117 
118 
119 /*
120  * Output the contents of an aggregation table slot.
121  *	This function must always be immediately followed with the deletion
122  *	of the target slot.
123  */
124 static void
125 ag_out(struct ag_info *ag, void (*out)(struct ag_info *))
126 {
127 	struct ag_info *ag_cors;
128 	uint32_t bit;
129 
130 
131 	/* Forget it if this route should not be output for split-horizon. */
132 	if (ag->ag_state & AGS_SPLIT_HZ)
133 		return;
134 
135 	/*
136 	 * If we output both the even and odd twins, then the immediate parent,
137 	 * if it is present, is redundant, unless the parent manages to
138 	 * aggregate into something coarser.
139 	 * On successive calls, this code detects the even and odd twins,
140 	 * and marks the parent.
141 	 *
142 	 * Note that the order in which the radix tree code emits routes
143 	 * ensures that the twins are seen before the parent is emitted.
144 	 */
145 	ag_cors = ag->ag_cors;
146 	if (ag_cors != NULL &&
147 	    ag_cors->ag_mask == (ag->ag_mask << 1) &&
148 	    ag_cors->ag_dst_h == (ag->ag_dst_h & ag_cors->ag_mask)) {
149 		ag_cors->ag_state |= ((ag_cors->ag_dst_h == ag->ag_dst_h) ?
150 		    AGS_REDUN0 : AGS_REDUN1);
151 	}
152 
153 	/*
154 	 * Skip it if this route is itself redundant.
155 	 *
156 	 * It is ok to change the contents of the slot here, since it is
157 	 * always deleted next.
158 	 */
159 	if (ag->ag_state & AGS_REDUN0) {
160 		if (ag->ag_state & AGS_REDUN1)
161 			return;		/* quit if fully redundant */
162 		/* make it finer if it is half-redundant */
163 		bit = (-ag->ag_mask) >> 1;
164 		ag->ag_dst_h |= bit;
165 		ag->ag_mask |= bit;
166 
167 	} else if (ag->ag_state & AGS_REDUN1) {
168 		/* make it finer if it is half-redundant */
169 		bit = (-ag->ag_mask) >> 1;
170 		ag->ag_mask |= bit;
171 	}
172 	out(ag);
173 }
174 
175 
176 static void
177 ag_del(struct ag_info *ag)
178 {
179 	CHECK_AG();
180 
181 	if (ag->ag_cors == NULL)
182 		ag_corsest = ag->ag_fine;
183 	else
184 		ag->ag_cors->ag_fine = ag->ag_fine;
185 
186 	if (ag->ag_fine == NULL)
187 		ag_finest = ag->ag_cors;
188 	else
189 		ag->ag_fine->ag_cors = ag->ag_cors;
190 
191 	ag->ag_fine = ag_avail;
192 	ag_avail = ag;
193 
194 	CHECK_AG();
195 }
196 
197 
198 /* Look for a route that can suppress the given route. */
199 static struct ag_info *
200 ag_find_suppressor(struct ag_info *ag)
201 {
202 	struct ag_info *ag_cors;
203 	in_addr_t dst_h = ag->ag_dst_h;
204 
205 	for (ag_cors = ag->ag_cors; ag_cors != NULL;
206 	    ag_cors = ag_cors->ag_cors) {
207 
208 		if ((dst_h & ag_cors->ag_mask) == ag_cors->ag_dst_h) {
209 			/*
210 			 * We found a route with a coarser mask that covers
211 			 * the given target.  It can suppress the target
212 			 * only if it has a good enough metric and it
213 			 * either has the same (gateway, ifp), or if its state
214 			 * includes AGS_CORS_GATE or the target's state
215 			 * includes AGS_FINE_GATE.
216 			 */
217 			if (ag_cors->ag_pref <= ag->ag_pref &&
218 			    (((ag->ag_nhop == ag_cors->ag_nhop) &&
219 			    (ag->ag_ifp == ag_cors->ag_ifp)) ||
220 			    ag_cors->ag_state & AGS_CORS_GATE ||
221 			    ag->ag_state & AGS_FINE_GATE)) {
222 				return (ag_cors);
223 			}
224 		}
225 	}
226 
227 	return (NULL);
228 }
229 
230 
231 /*
232  * Flush routes waiting for aggregation.
233  * This must not suppress a route unless it is known that among all routes
234  * with coarser masks that match it, the one with the longest mask is
235  * appropriate.  This is ensured by scanning the routes in lexical order,
236  * and with the most restrictive mask first among routes to the same
237  * destination.
238  */
239 void
240 ag_flush(in_addr_t lim_dst_h,	/* flush routes to here */
241     in_addr_t lim_mask,		/* matching this mask */
242     void (*out)(struct ag_info *))
243 {
244 	struct ag_info *ag, *ag_cors, *ag_supr;
245 	in_addr_t dst_h;
246 
247 
248 	for (ag = ag_finest; ag != NULL && ag->ag_mask >= lim_mask;
249 	    ag = ag_cors) {
250 		/* Get the next route now, before we delete ag. */
251 		ag_cors = ag->ag_cors;
252 
253 		/* Work on only the specified routes. */
254 		dst_h = ag->ag_dst_h;
255 		if ((dst_h & lim_mask) != lim_dst_h)
256 			continue;
257 
258 		/*
259 		 * Don't try to suppress the route if its state doesn't
260 		 * include AGS_SUPPRESS.
261 		 */
262 		if (!(ag->ag_state & AGS_SUPPRESS)) {
263 			ag_out(ag, out);
264 			ag_del(ag);
265 			continue;
266 		}
267 
268 		ag_supr = ag_find_suppressor(ag);
269 		if (ag_supr == NULL) {
270 			/*
271 			 * We didn't find a route which suppresses the
272 			 * target, so the target can go out.
273 			 */
274 			ag_out(ag, out);
275 		} else {
276 			/*
277 			 * We found a route which suppresses the target, so
278 			 * don't output the target.
279 			 */
280 			if (TRACEACTIONS) {
281 				trace_misc("aggregated away %s",
282 				    rtname(htonl(ag->ag_dst_h), ag->ag_mask,
283 				    ag->ag_nhop));
284 				trace_misc("on coarser route %s",
285 				    rtname(htonl(ag_supr->ag_dst_h),
286 				    ag_supr->ag_mask, ag_supr->ag_nhop));
287 			}
288 			/*
289 			 * If the suppressed target was redundant, then
290 			 * mark the suppressor as redundant.
291 			 */
292 			if (AG_IS_REDUN(ag->ag_state) &&
293 			    ag_supr->ag_mask == (ag->ag_mask<<1)) {
294 				if (ag_supr->ag_dst_h == dst_h)
295 					ag_supr->ag_state |= AGS_REDUN0;
296 				else
297 					ag_supr->ag_state |= AGS_REDUN1;
298 			}
299 			if (ag->ag_tag != ag_supr->ag_tag)
300 				ag_supr->ag_tag = 0;
301 			if (ag->ag_nhop != ag_supr->ag_nhop)
302 				ag_supr->ag_nhop = 0;
303 		}
304 
305 		/* The route has either been output or suppressed */
306 		ag_del(ag);
307 	}
308 
309 	CHECK_AG();
310 }
311 
312 
313 /* Try to aggregate a route with previous routes. */
314 void
315 ag_check(in_addr_t dst,
316     in_addr_t	mask,
317     in_addr_t	gate,
318     struct interface *ifp,
319     in_addr_t	nhop,
320     uint8_t	metric,
321     uint8_t	pref,
322     uint32_t	seqno,
323     uint16_t	tag,
324     uint16_t	state,
325     void (*out)(struct ag_info *))	/* output using this */
326 {
327 	struct ag_info *ag, *nag, *ag_cors;
328 	in_addr_t xaddr;
329 	int tmp;
330 	struct interface *xifp;
331 
332 	dst = ntohl(dst);
333 
334 	/*
335 	 * Don't bother trying to aggregate routes with non-contiguous
336 	 * subnet masks.
337 	 *
338 	 * (X & -X) contains a single bit if and only if X is a power of 2.
339 	 * (X + (X & -X)) == 0 if and only if X is a power of 2.
340 	 */
341 	if ((mask & -mask) + mask != 0) {
342 		struct ag_info nc_ag;
343 
344 		nc_ag.ag_dst_h = dst;
345 		nc_ag.ag_mask = mask;
346 		nc_ag.ag_gate = gate;
347 		nc_ag.ag_ifp = ifp;
348 		nc_ag.ag_nhop = nhop;
349 		nc_ag.ag_metric = metric;
350 		nc_ag.ag_pref = pref;
351 		nc_ag.ag_tag = tag;
352 		nc_ag.ag_state = state;
353 		nc_ag.ag_seqno = seqno;
354 		out(&nc_ag);
355 		return;
356 	}
357 
358 	/* Search for the right slot in the aggregation table. */
359 	ag_cors = NULL;
360 	ag = ag_corsest;
361 	while (ag != NULL) {
362 		if (ag->ag_mask >= mask)
363 			break;
364 
365 		/*
366 		 * Suppress old routes (i.e. combine with compatible routes
367 		 * with coarser masks) as we look for the right slot in the
368 		 * aggregation table for the new route.
369 		 * A route to an address less than the current destination
370 		 * will not be affected by the current route or any route
371 		 * seen hereafter.  That means it is safe to suppress it.
372 		 * This check keeps poor routes (e.g. with large hop counts)
373 		 * from preventing suppression of finer routes.
374 		 */
375 		if (ag_cors != NULL && ag->ag_dst_h < dst &&
376 		    (ag->ag_state & AGS_SUPPRESS) &&
377 		    ag_cors->ag_pref <= ag->ag_pref &&
378 		    (ag->ag_dst_h & ag_cors->ag_mask) == ag_cors->ag_dst_h &&
379 		    ((ag_cors->ag_nhop == ag->ag_nhop &&
380 		    (ag_cors->ag_ifp == ag->ag_ifp))||
381 			(ag->ag_state & AGS_FINE_GATE) ||
382 			(ag_cors->ag_state & AGS_CORS_GATE))) {
383 			/*
384 			 * If the suppressed target was redundant,
385 			 * then mark the suppressor redundant.
386 			 */
387 			if (AG_IS_REDUN(ag->ag_state) &&
388 			    ag_cors->ag_mask == (ag->ag_mask << 1)) {
389 				if (ag_cors->ag_dst_h == dst)
390 					ag_cors->ag_state |= AGS_REDUN0;
391 				else
392 					ag_cors->ag_state |= AGS_REDUN1;
393 			}
394 			if (ag->ag_tag != ag_cors->ag_tag)
395 				ag_cors->ag_tag = 0;
396 			if (ag->ag_nhop != ag_cors->ag_nhop)
397 				ag_cors->ag_nhop = 0;
398 			ag_del(ag);
399 			CHECK_AG();
400 		} else {
401 			ag_cors = ag;
402 		}
403 		ag = ag_cors->ag_fine;
404 	}
405 
406 	/*
407 	 * If we find the even/odd twin of the new route, and if the
408 	 * masks and so forth are equal, we can aggregate them.
409 	 * We can probably promote one of the pair.
410 	 *
411 	 * Since the routes are encountered in lexical order,
412 	 * the new route must be odd.  However, the second or later
413 	 * times around this loop, it could be the even twin promoted
414 	 * from the even/odd pair of twins of the finer route.
415 	 */
416 	while (ag != NULL && ag->ag_mask == mask &&
417 	    ((ag->ag_dst_h ^ dst) & (mask<<1)) == 0) {
418 
419 		/*
420 		 * Here we know the target route and the route in the current
421 		 * slot have the same netmasks and differ by at most the
422 		 * last bit.  They are either for the same destination, or
423 		 * for an even/odd pair of destinations.
424 		 */
425 		if (ag->ag_dst_h == dst) {
426 			if (ag->ag_nhop == nhop && ag->ag_ifp == ifp) {
427 				/*
428 				 * We have two routes to the same destination,
429 				 * with the same nexthop and interface.
430 				 * Routes are encountered in lexical order,
431 				 * so a route is never promoted until the
432 				 * parent route is already present.  So we
433 				 * know that the new route is a promoted (or
434 				 * aggregated) pair and the route already in
435 				 * the slot is the explicit route.
436 				 *
437 				 * Prefer the best route if their metrics
438 				 * differ, or the aggregated one if not,
439 				 * following a sort of longest-match rule.
440 				 */
441 				if (pref <= ag->ag_pref) {
442 					ag->ag_gate = gate;
443 					ag->ag_ifp = ifp;
444 					ag->ag_nhop = nhop;
445 					ag->ag_tag = tag;
446 					ag->ag_metric = metric;
447 					ag->ag_pref = pref;
448 					if (seqno > ag->ag_seqno)
449 						ag->ag_seqno = seqno;
450 					tmp = ag->ag_state;
451 					ag->ag_state = state;
452 					state = tmp;
453 				}
454 
455 				/*
456 				 * Some bits are set if they are set on
457 				 * either route, except when the route is
458 				 * for an interface.
459 				 */
460 				if (!(ag->ag_state & AGS_IF))
461 					ag->ag_state |=
462 					    (state & (AGS_AGGREGATE_EITHER |
463 					    AGS_REDUN0 | AGS_REDUN1));
464 
465 				return;
466 			} else {
467 				/*
468 				 * multiple routes to same dest/mask with
469 				 * differing gate nexthop/or ifp. Flush
470 				 * both out.
471 				 */
472 				break;
473 			}
474 		}
475 
476 		/*
477 		 * If one of the routes can be promoted and the other can
478 		 * be suppressed, it may be possible to combine them or
479 		 * worthwhile to promote one.
480 		 *
481 		 * Any route that can be promoted is always
482 		 * marked to be eligible to be suppressed.
483 		 */
484 		if (!((state & AGS_AGGREGATE) &&
485 		    (ag->ag_state & AGS_SUPPRESS)) &&
486 		    !((ag->ag_state & AGS_AGGREGATE) && (state & AGS_SUPPRESS)))
487 			break;
488 
489 		/*
490 		 * A pair of even/odd twin routes can be combined
491 		 * if either is redundant, or if they are via the
492 		 * same gateway and have the same metric.
493 		 */
494 		if (AG_IS_REDUN(ag->ag_state) || AG_IS_REDUN(state) ||
495 		    (ag->ag_nhop == nhop && ag->ag_ifp == ifp &&
496 		    ag->ag_pref == pref &&
497 		    (state & ag->ag_state & AGS_AGGREGATE) != 0)) {
498 
499 			/*
500 			 * We have both the even and odd pairs.
501 			 * Since the routes are encountered in order,
502 			 * the route in the slot must be the even twin.
503 			 *
504 			 * Combine and promote (aggregate) the pair of routes.
505 			 */
506 			if (seqno < ag->ag_seqno)
507 				seqno = ag->ag_seqno;
508 			if (!AG_IS_REDUN(state))
509 				state &= ~AGS_REDUN1;
510 			if (AG_IS_REDUN(ag->ag_state))
511 				state |= AGS_REDUN0;
512 			else
513 				state &= ~AGS_REDUN0;
514 			state |= (ag->ag_state & AGS_AGGREGATE_EITHER);
515 			if (ag->ag_tag != tag)
516 				tag = 0;
517 			if (ag->ag_nhop != nhop)
518 				nhop = 0;
519 
520 			/*
521 			 * Get rid of the even twin that was already
522 			 * in the slot.
523 			 */
524 			ag_del(ag);
525 
526 		} else if (ag->ag_pref >= pref &&
527 		    (ag->ag_state & AGS_AGGREGATE)) {
528 			/*
529 			 * If we cannot combine the pair, maybe the route
530 			 * with the worse metric can be promoted.
531 			 *
532 			 * Promote the old, even twin, by giving its slot
533 			 * in the table to the new, odd twin.
534 			 */
535 			ag->ag_dst_h = dst;
536 
537 			xaddr = ag->ag_gate;
538 			ag->ag_gate = gate;
539 			gate = xaddr;
540 
541 			xifp = ag->ag_ifp;
542 			ag->ag_ifp = ifp;
543 			ifp = xifp;
544 
545 			xaddr = ag->ag_nhop;
546 			ag->ag_nhop = nhop;
547 			nhop = xaddr;
548 
549 			tmp = ag->ag_tag;
550 			ag->ag_tag = tag;
551 			tag = tmp;
552 
553 			/*
554 			 * The promoted route is even-redundant only if the
555 			 * even twin was fully redundant.  It is not
556 			 * odd-redundant because the odd-twin will still be
557 			 * in the table.
558 			 */
559 			tmp = ag->ag_state;
560 			if (!AG_IS_REDUN(tmp))
561 				tmp &= ~AGS_REDUN0;
562 			tmp &= ~AGS_REDUN1;
563 			ag->ag_state = state;
564 			state = tmp;
565 
566 			tmp = ag->ag_metric;
567 			ag->ag_metric = metric;
568 			metric = tmp;
569 
570 			tmp = ag->ag_pref;
571 			ag->ag_pref = pref;
572 			pref = tmp;
573 
574 			/* take the newest sequence number */
575 			if (seqno <= ag->ag_seqno)
576 				seqno = ag->ag_seqno;
577 			else
578 				ag->ag_seqno = seqno;
579 
580 		} else {
581 			if (!(state & AGS_AGGREGATE))
582 				break;	/* cannot promote either twin */
583 
584 			/*
585 			 * Promote the new, odd twin by shaving its
586 			 * mask and address.
587 			 * The promoted route is odd-redundant only if the
588 			 * odd twin was fully redundant.  It is not
589 			 * even-redundant because the even twin is still in
590 			 * the table.
591 			 */
592 			if (!AG_IS_REDUN(state))
593 				state &= ~AGS_REDUN1;
594 			state &= ~AGS_REDUN0;
595 			if (seqno < ag->ag_seqno)
596 				seqno = ag->ag_seqno;
597 			else
598 				ag->ag_seqno = seqno;
599 		}
600 
601 		mask <<= 1;
602 		dst &= mask;
603 
604 		if (ag_cors == NULL) {
605 			ag = ag_corsest;
606 			break;
607 		}
608 		ag = ag_cors;
609 		ag_cors = ag->ag_cors;
610 	}
611 
612 	/*
613 	 * When we can no longer promote and combine routes,
614 	 * flush the old route in the target slot.  Also flush
615 	 * any finer routes that we know will never be aggregated by
616 	 * the new route.
617 	 *
618 	 * In case we moved toward coarser masks,
619 	 * get back where we belong
620 	 */
621 	if (ag != NULL && ag->ag_mask < mask) {
622 		ag_cors = ag;
623 		ag = ag->ag_fine;
624 	}
625 
626 	/* Empty the target slot */
627 	if (ag != NULL && ag->ag_mask == mask) {
628 		ag_flush(ag->ag_dst_h, ag->ag_mask, out);
629 		ag = (ag_cors == NULL) ? ag_corsest : ag_cors->ag_fine;
630 	}
631 
632 #ifdef DEBUG_AG
633 	if (ag == NULL && ag_cors != ag_finest)
634 		abort();
635 	if (ag_cors == NULL && ag != ag_corsest)
636 		abort();
637 	if (ag != NULL && ag->ag_cors != ag_cors)
638 		abort();
639 	if (ag_cors != NULL && ag_cors->ag_fine != ag)
640 		abort();
641 	CHECK_AG();
642 #endif
643 
644 	/* Save the new route on the end of the table. */
645 	nag = ag_avail;
646 	ag_avail = nag->ag_fine;
647 
648 	nag->ag_dst_h = dst;
649 	nag->ag_mask = mask;
650 	nag->ag_ifp = ifp;
651 	nag->ag_gate = gate;
652 	nag->ag_nhop = nhop;
653 	nag->ag_metric = metric;
654 	nag->ag_pref = pref;
655 	nag->ag_tag = tag;
656 	nag->ag_state = state;
657 	nag->ag_seqno = seqno;
658 
659 	nag->ag_fine = ag;
660 	if (ag != NULL)
661 		ag->ag_cors = nag;
662 	else
663 		ag_finest = nag;
664 	nag->ag_cors = ag_cors;
665 	if (ag_cors == NULL)
666 		ag_corsest = nag;
667 	else
668 		ag_cors->ag_fine = nag;
669 	CHECK_AG();
670 }
671 
672 
673 static const char *
674 rtm_type_name(uchar_t type)
675 {
676 	static const char *rtm_types[] = {
677 		"RTM_ADD",
678 		"RTM_DELETE",
679 		"RTM_CHANGE",
680 		"RTM_GET",
681 		"RTM_LOSING",
682 		"RTM_REDIRECT",
683 		"RTM_MISS",
684 		"RTM_LOCK",
685 		"RTM_OLDADD",
686 		"RTM_OLDDEL",
687 		"RTM_RESOLVE",
688 		"RTM_NEWADDR",
689 		"RTM_DELADDR",
690 		"RTM_IFINFO",
691 		"RTM_NEWMADDR",
692 		"RTM_DELMADDR"
693 	};
694 #define	NEW_RTM_PAT	"RTM type %#x"
695 	static char name0[sizeof (NEW_RTM_PAT) + 2];
696 
697 	if (type > sizeof (rtm_types) / sizeof (rtm_types[0]) || type == 0) {
698 		(void) snprintf(name0, sizeof (name0), NEW_RTM_PAT, type);
699 		return (name0);
700 	} else {
701 		return (rtm_types[type-1]);
702 	}
703 #undef	NEW_RTM_PAT
704 }
705 
706 
707 static void
708 dump_rt_msg(const char *act, struct rt_msghdr *rtm, int mlen)
709 {
710 	const char *mtype;
711 	uchar_t *cp;
712 	int i, j;
713 	char buffer[16*3 + 1], *ibs;
714 	struct ifa_msghdr *ifam;
715 	struct if_msghdr *ifm;
716 
717 	switch (rtm->rtm_type) {
718 	case RTM_NEWADDR:
719 	case RTM_DELADDR:
720 		mtype = "ifam";
721 		break;
722 	case RTM_IFINFO:
723 		mtype = "ifm";
724 		break;
725 	default:
726 		mtype = "rtm";
727 		break;
728 	}
729 	trace_misc("%s %s %d bytes", act, mtype, mlen);
730 	if (mlen > rtm->rtm_msglen) {
731 		trace_misc("%s: extra %d bytes ignored", mtype,
732 		    mlen - rtm->rtm_msglen);
733 		mlen = rtm->rtm_msglen;
734 	} else if (mlen < rtm->rtm_msglen) {
735 		trace_misc("%s: truncated by %d bytes", mtype,
736 		    rtm->rtm_msglen - mlen);
737 	}
738 	switch (rtm->rtm_type) {
739 	case RTM_NEWADDR:
740 	case RTM_DELADDR:
741 		ifam = (struct ifa_msghdr *)rtm;
742 		trace_misc("ifam: msglen %d version %d type %d addrs %X",
743 		    ifam->ifam_msglen, ifam->ifam_version, ifam->ifam_type,
744 		    ifam->ifam_addrs);
745 		trace_misc("ifam: flags %X index %d metric %d",
746 		    ifam->ifam_flags, ifam->ifam_index, ifam->ifam_metric);
747 		cp = (uchar_t *)(ifam + 1);
748 		break;
749 	case RTM_IFINFO:
750 		ifm = (struct if_msghdr *)rtm;
751 		trace_misc("ifm: msglen %d version %d type %d addrs %X",
752 		    ifm->ifm_msglen, ifm->ifm_version, ifm->ifm_type,
753 		    ifm->ifm_addrs);
754 		ibs = if_bit_string(ifm->ifm_flags, _B_TRUE);
755 		if (ibs == NULL) {
756 			trace_misc("ifm: flags %#x index %d", ifm->ifm_flags,
757 			    ifm->ifm_index);
758 		} else {
759 			trace_misc("ifm: flags %s index %d", ibs,
760 			    ifm->ifm_index);
761 			free(ibs);
762 		}
763 		cp = (uchar_t *)(ifm + 1);
764 		break;
765 	default:
766 		trace_misc("rtm: msglen %d version %d type %d index %d",
767 		    rtm->rtm_msglen, rtm->rtm_version, rtm->rtm_type,
768 		    rtm->rtm_index);
769 		trace_misc("rtm: flags %X addrs %X pid %d seq %d",
770 		    rtm->rtm_flags, rtm->rtm_addrs, rtm->rtm_pid, rtm->rtm_seq);
771 		trace_misc("rtm: errno %d use %d inits %X", rtm->rtm_errno,
772 		    rtm->rtm_use, rtm->rtm_inits);
773 		cp = (uchar_t *)(rtm + 1);
774 		break;
775 	}
776 	i = mlen - (cp - (uint8_t *)rtm);
777 	while (i > 0) {
778 		buffer[0] = '\0';
779 		ibs = buffer;
780 		for (j = 0; j < 16 && i > 0; j++, i--)
781 			ibs += sprintf(ibs, " %02X", *cp++);
782 		trace_misc("addr%s", buffer);
783 	}
784 }
785 
786 /*
787  * Tell the kernel to add, delete or change a route
788  * Pass k_state from khash in for diagnostic info.
789  */
790 static void
791 rtioctl(int action,			/* RTM_DELETE, etc */
792     in_addr_t dst,
793     in_addr_t gate,
794     in_addr_t mask,
795     struct interface *ifp,
796     uint8_t metric,
797     int flags)
798 {
799 	static int rt_sock_seqno = 0;
800 	struct {
801 		struct rt_msghdr w_rtm;
802 		struct sockaddr_in w_dst;
803 		struct sockaddr_in w_gate;
804 		uint8_t w_space[512];
805 	} w;
806 	struct sockaddr_in w_mask;
807 	struct sockaddr_dl w_ifp;
808 	uint8_t *cp;
809 	long cc;
810 #define	PAT " %-10s %s metric=%d flags=%#x"
811 #define	ARGS rtm_type_name(action), rtname(dst, mask, gate), metric, flags
812 
813 again:
814 	(void) memset(&w, 0, sizeof (w));
815 	(void) memset(&w_mask, 0, sizeof (w_mask));
816 	(void) memset(&w_ifp, 0, sizeof (w_ifp));
817 	cp = w.w_space;
818 	w.w_rtm.rtm_msglen = sizeof (struct rt_msghdr) +
819 	    2 * ROUNDUP_LONG(sizeof (struct sockaddr_in));
820 	w.w_rtm.rtm_version = RTM_VERSION;
821 	w.w_rtm.rtm_type = action;
822 	w.w_rtm.rtm_flags = flags;
823 	w.w_rtm.rtm_seq = ++rt_sock_seqno;
824 	w.w_rtm.rtm_addrs = RTA_DST|RTA_GATEWAY;
825 	if (metric != 0 || action == RTM_CHANGE) {
826 		w.w_rtm.rtm_rmx.rmx_hopcount = metric;
827 		w.w_rtm.rtm_inits |= RTV_HOPCOUNT;
828 	}
829 	w.w_dst.sin_family = AF_INET;
830 	w.w_dst.sin_addr.s_addr = dst;
831 	w.w_gate.sin_family = AF_INET;
832 	w.w_gate.sin_addr.s_addr = gate;
833 	if (mask == HOST_MASK) {
834 		w.w_rtm.rtm_flags |= RTF_HOST;
835 	} else {
836 		w.w_rtm.rtm_addrs |= RTA_NETMASK;
837 		w_mask.sin_family = AF_INET;
838 		w_mask.sin_addr.s_addr = htonl(mask);
839 		(void) memmove(cp, &w_mask, sizeof (w_mask));
840 		cp += ROUNDUP_LONG(sizeof (struct sockaddr_in));
841 		w.w_rtm.rtm_msglen += ROUNDUP_LONG(sizeof (struct sockaddr_in));
842 	}
843 	if (ifp == NULL)
844 		ifp = iflookup(gate);
845 
846 	if ((ifp == NULL) || (ifp->int_phys == NULL)) {
847 		trace_misc("no ifp for" PAT, ARGS);
848 	} else {
849 		if (ifp->int_phys->phyi_index > UINT16_MAX) {
850 			trace_misc("ifindex %d is too big for sdl_index",
851 			    ifp->int_phys->phyi_index);
852 		} else {
853 			w_ifp.sdl_family = AF_LINK;
854 			w.w_rtm.rtm_addrs |= RTA_IFP;
855 			w_ifp.sdl_index = ifp->int_phys->phyi_index;
856 			(void) memmove(cp, &w_ifp, sizeof (w_ifp));
857 			w.w_rtm.rtm_msglen +=
858 			    ROUNDUP_LONG(sizeof (struct sockaddr_dl));
859 		}
860 	}
861 
862 
863 	if (!no_install) {
864 		if (TRACERTS)
865 			dump_rt_msg("write", &w.w_rtm, w.w_rtm.rtm_msglen);
866 		cc = write(rt_sock, &w, w.w_rtm.rtm_msglen);
867 		if (cc < 0) {
868 			if (errno == ESRCH && (action == RTM_CHANGE ||
869 			    action == RTM_DELETE)) {
870 				trace_act("route disappeared before" PAT, ARGS);
871 				if (action == RTM_CHANGE) {
872 					action = RTM_ADD;
873 					goto again;
874 				}
875 				return;
876 			}
877 			writelog(LOG_WARNING, "write(rt_sock)" PAT ": %s ",
878 			    ARGS, rip_strerror(errno));
879 			return;
880 		} else if (cc != w.w_rtm.rtm_msglen) {
881 			msglog("write(rt_sock) wrote %ld instead of %d for" PAT,
882 			    cc, w.w_rtm.rtm_msglen, ARGS);
883 			return;
884 		}
885 	}
886 	if (TRACEKERNEL)
887 		trace_misc("write kernel" PAT, ARGS);
888 #undef PAT
889 #undef ARGS
890 }
891 
892 
893 /* Hash table containing our image of the kernel forwarding table. */
894 #define	KHASH_SIZE 71			/* should be prime */
895 #define	KHASH(a, m) khash_bins[((a) ^ (m)) % KHASH_SIZE]
896 static struct khash *khash_bins[KHASH_SIZE];
897 
898 #define	K_KEEP_LIM	30	/* k_keep */
899 
900 static struct khash *
901 kern_find(in_addr_t dst, in_addr_t mask, in_addr_t gate,
902     struct interface *ifp, struct khash ***ppk)
903 {
904 	struct khash *k, **pk;
905 
906 	for (pk = &KHASH(dst, mask); (k = *pk) != NULL; pk = &k->k_next) {
907 		if (k->k_dst == dst && k->k_mask == mask &&
908 		    (gate == 0 || k->k_gate == gate) &&
909 		    (ifp == NULL || k->k_ifp == ifp)) {
910 			break;
911 		}
912 	}
913 	if (ppk != NULL)
914 		*ppk = pk;
915 	return (k);
916 }
917 
918 
919 /*
920  * Find out if there is an alternate route to a given destination
921  * off of a given interface.
922  */
923 static struct khash *
924 kern_alternate(in_addr_t dst, in_addr_t mask, in_addr_t gate,
925     struct interface *ifp, struct khash ***ppk)
926 {
927 	struct khash *k, **pk;
928 
929 	for (pk = &KHASH(dst, mask); (k = *pk) != NULL; pk = &k->k_next) {
930 		if (k->k_dst == dst && k->k_mask == mask &&
931 		    (k->k_gate != gate) &&
932 		    (k->k_ifp == ifp)) {
933 			break;
934 		}
935 	}
936 	if (ppk != NULL)
937 		*ppk = pk;
938 	return (k);
939 }
940 
941 static struct khash *
942 kern_add(in_addr_t dst, uint32_t mask, in_addr_t gate, struct interface *ifp)
943 {
944 	struct khash *k, **pk;
945 
946 	k = kern_find(dst, mask, gate, ifp, &pk);
947 	if (k != NULL)
948 		return (k);
949 
950 	k = rtmalloc(sizeof (*k), "kern_add");
951 
952 	(void) memset(k, 0, sizeof (*k));
953 	k->k_dst = dst;
954 	k->k_mask = mask;
955 	k->k_state = KS_NEW;
956 	k->k_keep = now.tv_sec;
957 	k->k_gate = gate;
958 	k->k_ifp = ifp;
959 	*pk = k;
960 
961 	return (k);
962 }
963 
964 /* delete all khash entries that are wired through the interface ifp */
965 void
966 kern_flush_ifp(struct interface *ifp)
967 {
968 	struct khash *k, *kprev, *knext;
969 	int i;
970 
971 	for (i = 0; i < KHASH_SIZE; i++) {
972 		kprev = NULL;
973 		for (k = khash_bins[i]; k != NULL; k = knext) {
974 			knext = k->k_next;
975 			if (k->k_ifp == ifp) {
976 				if (kprev != NULL)
977 					kprev->k_next = k->k_next;
978 				else
979 					khash_bins[i] = k->k_next;
980 				free(k);
981 				continue;
982 			}
983 			kprev = k;
984 		}
985 	}
986 }
987 
988 /*
989  * rewire khash entries that currently go through oldifp to
990  * go through newifp.
991  */
992 void
993 kern_rewire_ifp(struct interface *oldifp, struct interface *newifp)
994 {
995 	struct khash *k;
996 	int i;
997 
998 	for (i = 0; i < KHASH_SIZE; i++) {
999 		for (k = khash_bins[i]; k; k = k->k_next) {
1000 			if (k->k_ifp == oldifp) {
1001 				k->k_ifp = newifp;
1002 				trace_misc("kern_rewire_ifp k 0x%lx "
1003 				    "from %s to %s", k, oldifp->int_name,
1004 				    newifp->int_name);
1005 			}
1006 		}
1007 	}
1008 }
1009 
1010 
1011 /*
1012  * Check that a static route it is still in the daemon table, and not
1013  * deleted by interfaces coming and going.  This is also the routine
1014  * responsible for adding new static routes to the daemon table.
1015  */
1016 static void
1017 kern_check_static(struct khash *k, struct interface *ifp)
1018 {
1019 	struct rt_entry *rt;
1020 	struct rt_spare new;
1021 	uint16_t rt_state = RS_STATIC;
1022 
1023 	(void) memset(&new, 0, sizeof (new));
1024 	new.rts_ifp = ifp;
1025 	new.rts_gate = k->k_gate;
1026 	new.rts_router = (ifp != NULL) ? ifp->int_addr : loopaddr;
1027 	new.rts_metric = k->k_metric;
1028 	new.rts_time = now.tv_sec;
1029 	new.rts_origin = RO_STATIC;
1030 
1031 	rt = rtget(k->k_dst, k->k_mask);
1032 	if ((ifp != NULL && !IS_IFF_ROUTING(ifp->int_if_flags)) ||
1033 	    (k->k_state & KS_PRIVATE))
1034 		rt_state |= RS_NOPROPAGATE;
1035 
1036 	if (rt != NULL) {
1037 		if ((rt->rt_state & RS_STATIC) == 0) {
1038 			/*
1039 			 * We are already tracking this dest/mask
1040 			 * via RIP/RDISC. Ignore the static route,
1041 			 * because we don't currently have a good
1042 			 * way to compare metrics on static routes
1043 			 * with rip metrics, and therefore cannot
1044 			 * mix and match the two.
1045 			 */
1046 			return;
1047 		}
1048 		rt_state |= rt->rt_state;
1049 		if (rt->rt_state != rt_state)
1050 			rtchange(rt, rt_state, &new, 0);
1051 	} else {
1052 		rtadd(k->k_dst, k->k_mask, rt_state, &new);
1053 	}
1054 }
1055 
1056 
1057 /* operate on a kernel entry */
1058 static void
1059 kern_ioctl(struct khash *k,
1060     int action,			/* RTM_DELETE, etc */
1061     int flags)
1062 {
1063 	if (((k->k_state & (KS_IF|KS_PASSIVE)) == KS_IF) ||
1064 	    (k->k_state & KS_DEPRE_IF)) {
1065 		/*
1066 		 * Prevent execution of RTM_DELETE, RTM_ADD or
1067 		 * RTM_CHANGE of interface routes
1068 		 */
1069 		trace_act("Blocking execution of %s  %s --> %s ",
1070 		    rtm_type_name(action),
1071 		    addrname(k->k_dst, k->k_mask, 0), naddr_ntoa(k->k_gate));
1072 		return;
1073 	}
1074 
1075 	switch (action) {
1076 	case RTM_DELETE:
1077 		k->k_state &= ~KS_DYNAMIC;
1078 		if (k->k_state & KS_DELETED)
1079 			return;
1080 		k->k_state |= KS_DELETED;
1081 		break;
1082 	case RTM_ADD:
1083 		k->k_state &= ~KS_DELETED;
1084 		break;
1085 	case RTM_CHANGE:
1086 		if (k->k_state & KS_DELETED) {
1087 			action = RTM_ADD;
1088 			k->k_state &= ~KS_DELETED;
1089 		}
1090 		break;
1091 	}
1092 
1093 	rtioctl(action, k->k_dst, k->k_gate, k->k_mask, k->k_ifp,
1094 	    k->k_metric, flags);
1095 }
1096 
1097 
1098 /* add a route the kernel told us */
1099 static void
1100 rtm_add(struct rt_msghdr *rtm,
1101     struct rt_addrinfo *info,
1102     time_t keep,
1103     boolean_t interf_route,
1104     struct interface *ifptr)
1105 {
1106 	struct khash *k;
1107 	struct interface *ifp = ifptr;
1108 	in_addr_t mask, gate = 0;
1109 	static struct msg_limit msg_no_ifp;
1110 
1111 	if (rtm->rtm_flags & RTF_HOST) {
1112 		mask = HOST_MASK;
1113 	} else if (INFO_MASK(info) != 0) {
1114 		mask = ntohl(S_ADDR(INFO_MASK(info)));
1115 	} else {
1116 		writelog(LOG_WARNING,
1117 		    "ignore %s without mask", rtm_type_name(rtm->rtm_type));
1118 		return;
1119 	}
1120 
1121 	/*
1122 	 * Find the interface toward the gateway.
1123 	 */
1124 	if (INFO_GATE(info) != NULL)
1125 		gate = S_ADDR(INFO_GATE(info));
1126 
1127 	if (ifp == NULL) {
1128 		if (INFO_GATE(info) != NULL)
1129 			ifp = iflookup(gate);
1130 		if (ifp == NULL)
1131 			msglim(&msg_no_ifp, gate,
1132 			    "route %s --> %s nexthop is not directly connected",
1133 			    addrname(S_ADDR(INFO_DST(info)), mask, 0),
1134 			    naddr_ntoa(gate));
1135 	}
1136 
1137 	k = kern_add(S_ADDR(INFO_DST(info)), mask, gate, ifp);
1138 
1139 	if (k->k_state & KS_NEW)
1140 		k->k_keep = now.tv_sec+keep;
1141 	if (INFO_GATE(info) == 0) {
1142 		trace_act("note %s without gateway",
1143 		    rtm_type_name(rtm->rtm_type));
1144 		k->k_metric = HOPCNT_INFINITY;
1145 	} else if (INFO_GATE(info)->ss_family != AF_INET) {
1146 		trace_act("note %s with gateway AF=%d",
1147 		    rtm_type_name(rtm->rtm_type),
1148 		    INFO_GATE(info)->ss_family);
1149 		k->k_metric = HOPCNT_INFINITY;
1150 	} else {
1151 		k->k_gate = S_ADDR(INFO_GATE(info));
1152 		k->k_metric = rtm->rtm_rmx.rmx_hopcount;
1153 		if (k->k_metric < 0)
1154 			k->k_metric = 0;
1155 		else if (k->k_metric > HOPCNT_INFINITY-1)
1156 			k->k_metric = HOPCNT_INFINITY-1;
1157 	}
1158 
1159 	if ((k->k_state & KS_NEW) && interf_route) {
1160 		if (k->k_gate != 0 && findifaddr(k->k_gate) == NULL)
1161 			k->k_state |= KS_DEPRE_IF;
1162 		else
1163 			k->k_state |= KS_IF;
1164 	}
1165 
1166 	k->k_state &= ~(KS_NEW | KS_DELETE | KS_ADD | KS_CHANGE | KS_DEL_ADD |
1167 	    KS_STATIC | KS_GATEWAY | KS_DELETED | KS_PRIVATE | KS_CHECK);
1168 	if (rtm->rtm_flags & RTF_GATEWAY)
1169 		k->k_state |= KS_GATEWAY;
1170 	if (rtm->rtm_flags & RTF_STATIC)
1171 		k->k_state |= KS_STATIC;
1172 	if (rtm->rtm_flags & RTF_PRIVATE)
1173 		k->k_state |= KS_PRIVATE;
1174 
1175 
1176 	if (rtm->rtm_flags & (RTF_DYNAMIC | RTF_MODIFIED)) {
1177 		if (INFO_AUTHOR(info) != 0 &&
1178 		    INFO_AUTHOR(info)->ss_family == AF_INET)
1179 			ifp = iflookup(S_ADDR(INFO_AUTHOR(info)));
1180 		else
1181 			ifp = NULL;
1182 		if (should_supply(ifp) && (ifp == NULL ||
1183 		    !(ifp->int_state & IS_REDIRECT_OK))) {
1184 			/*
1185 			 * Routers are not supposed to listen to redirects,
1186 			 * so delete it if it came via an unknown interface
1187 			 * or the interface does not have special permission.
1188 			 */
1189 			k->k_state &= ~KS_DYNAMIC;
1190 			k->k_state |= KS_DELETE;
1191 			LIM_SEC(need_kern, 0);
1192 			trace_act("mark for deletion redirected %s --> %s"
1193 			    " via %s",
1194 			    addrname(k->k_dst, k->k_mask, 0),
1195 			    naddr_ntoa(k->k_gate),
1196 			    ifp ? ifp->int_name : "unknown interface");
1197 		} else {
1198 			k->k_state |= KS_DYNAMIC;
1199 			k->k_redirect_time = now.tv_sec;
1200 			trace_act("accept redirected %s --> %s via %s",
1201 			    addrname(k->k_dst, k->k_mask, 0),
1202 			    naddr_ntoa(k->k_gate),
1203 			    ifp ? ifp->int_name : "unknown interface");
1204 		}
1205 		return;
1206 	}
1207 
1208 	/*
1209 	 * If it is not a static route, quit until the next comparison
1210 	 * between the kernel and daemon tables, when it will be deleted.
1211 	 */
1212 	if (!(k->k_state & KS_STATIC)) {
1213 		if (!(k->k_state & (KS_IF|KS_DEPRE_IF|KS_FILE)))
1214 			k->k_state |= KS_DELETE;
1215 		LIM_SEC(need_kern, k->k_keep);
1216 		return;
1217 	}
1218 
1219 	/*
1220 	 * Put static routes with real metrics into the daemon table so
1221 	 * they can be advertised.
1222 	 */
1223 
1224 	kern_check_static(k, ifp);
1225 }
1226 
1227 
1228 /* deal with packet loss */
1229 static void
1230 rtm_lose(struct rt_msghdr *rtm, struct rt_addrinfo *info)
1231 {
1232 	if (INFO_GATE(info) == NULL || INFO_GATE(info)->ss_family != AF_INET) {
1233 		trace_act("ignore %s without gateway",
1234 		    rtm_type_name(rtm->rtm_type));
1235 		age(0);
1236 		return;
1237 	}
1238 
1239 	if (rdisc_ok)
1240 		rdisc_age(S_ADDR(INFO_GATE(info)));
1241 	age(S_ADDR(INFO_GATE(info)));
1242 }
1243 
1244 
1245 /*
1246  * Make the gateway slot of an info structure point to something
1247  * useful.  If it is not already useful, but it specifies an interface,
1248  * then fill in the sockaddr_in provided and point it there.
1249  */
1250 static int
1251 get_info_gate(struct sockaddr_storage **ssp, struct sockaddr_in *sin)
1252 {
1253 	struct sockaddr_dl *sdl = (struct sockaddr_dl *)*ssp;
1254 	struct interface *ifp;
1255 
1256 	if (sdl == NULL)
1257 		return (0);
1258 	if ((sdl)->sdl_family == AF_INET)
1259 		return (1);
1260 	if ((sdl)->sdl_family != AF_LINK)
1261 		return (0);
1262 
1263 	ifp = ifwithindex(sdl->sdl_index, _B_TRUE);
1264 	if (ifp == NULL)
1265 		return (0);
1266 
1267 	sin->sin_addr.s_addr = ifp->int_addr;
1268 	sin->sin_family = AF_INET;
1269 	/* LINTED */
1270 	*ssp = (struct sockaddr_storage *)sin;
1271 
1272 	return (1);
1273 }
1274 
1275 
1276 /*
1277  * Clean the kernel table by copying it to the daemon image.
1278  * Eventually the daemon will delete any extra routes.
1279  */
1280 void
1281 sync_kern(void)
1282 {
1283 	int i;
1284 	struct khash *k;
1285 	struct {
1286 		struct T_optmgmt_req req;
1287 		struct opthdr hdr;
1288 	} req;
1289 	union {
1290 		struct T_optmgmt_ack ack;
1291 		unsigned char space[64];
1292 	} ack;
1293 	struct opthdr *rh;
1294 	struct strbuf cbuf, dbuf;
1295 	int ipfd, nroutes, flags, r;
1296 	mib2_ipRouteEntry_t routes[8];
1297 	mib2_ipRouteEntry_t *rp;
1298 	struct rt_msghdr rtm;
1299 	struct rt_addrinfo info;
1300 	struct sockaddr_in sin_dst;
1301 	struct sockaddr_in sin_gate;
1302 	struct sockaddr_in sin_mask;
1303 	struct sockaddr_in sin_author;
1304 	struct interface *ifp;
1305 	char ifname[LIFNAMSIZ + 1];
1306 
1307 	for (i = 0; i < KHASH_SIZE; i++) {
1308 		for (k = khash_bins[i]; k != NULL; k = k->k_next) {
1309 			if (!(k->k_state & (KS_IF|KS_DEPRE_IF)))
1310 				k->k_state |= KS_CHECK;
1311 		}
1312 	}
1313 
1314 	ipfd = open(IP_DEV_NAME, O_RDWR);
1315 	if (ipfd == -1) {
1316 		msglog("open " IP_DEV_NAME ": %s", rip_strerror(errno));
1317 		goto hash_clean;
1318 	}
1319 
1320 	req.req.PRIM_type = T_OPTMGMT_REQ;
1321 	req.req.OPT_offset = (caddr_t)&req.hdr - (caddr_t)&req;
1322 	req.req.OPT_length = sizeof (req.hdr);
1323 	req.req.MGMT_flags = T_CURRENT;
1324 
1325 	req.hdr.level = MIB2_IP;
1326 	req.hdr.name = 0;
1327 	req.hdr.len = 0;
1328 
1329 	cbuf.buf = (caddr_t)&req;
1330 	cbuf.len = sizeof (req);
1331 
1332 	if (putmsg(ipfd, &cbuf, NULL, 0) == -1) {
1333 		msglog("T_OPTMGMT_REQ putmsg: %s", rip_strerror(errno));
1334 		goto hash_clean;
1335 	}
1336 
1337 	for (;;) {
1338 		cbuf.buf = (caddr_t)&ack;
1339 		cbuf.maxlen = sizeof (ack);
1340 		dbuf.buf = (caddr_t)routes;
1341 		dbuf.maxlen = sizeof (routes);
1342 		flags = 0;
1343 		r = getmsg(ipfd, &cbuf, &dbuf, &flags);
1344 		if (r == -1) {
1345 			msglog("T_OPTMGMT_REQ getmsg: %s", rip_strerror(errno));
1346 			goto hash_clean;
1347 		}
1348 
1349 		if (cbuf.len < sizeof (struct T_optmgmt_ack) ||
1350 		    ack.ack.PRIM_type != T_OPTMGMT_ACK ||
1351 		    ack.ack.MGMT_flags != T_SUCCESS ||
1352 		    ack.ack.OPT_length < sizeof (struct opthdr)) {
1353 			msglog("bad T_OPTMGMT response; len=%d prim=%d "
1354 			    "flags=%d optlen=%d", cbuf.len, ack.ack.PRIM_type,
1355 			    ack.ack.MGMT_flags, ack.ack.OPT_length);
1356 			goto hash_clean;
1357 		}
1358 		/* LINTED */
1359 		rh = (struct opthdr *)((caddr_t)&ack + ack.ack.OPT_offset);
1360 		if (rh->level == 0 && rh->name == 0) {
1361 			break;
1362 		}
1363 		if (rh->level != MIB2_IP || rh->name != MIB2_IP_21) {
1364 			while (r == MOREDATA) {
1365 				r = getmsg(ipfd, NULL, &dbuf, &flags);
1366 			}
1367 			continue;
1368 		}
1369 		break;
1370 	}
1371 
1372 	(void) memset(&rtm, 0, sizeof (rtm));
1373 	(void) memset(&info, 0, sizeof (info));
1374 	(void) memset(&sin_dst, 0, sizeof (sin_dst));
1375 	(void) memset(&sin_gate, 0, sizeof (sin_gate));
1376 	(void) memset(&sin_mask, 0, sizeof (sin_mask));
1377 	(void) memset(&sin_author, 0, sizeof (sin_author));
1378 	sin_dst.sin_family = AF_INET;
1379 	/* LINTED */
1380 	info.rti_info[RTAX_DST] = (struct sockaddr_storage *)&sin_dst;
1381 	sin_gate.sin_family = AF_INET;
1382 	/* LINTED */
1383 	info.rti_info[RTAX_GATEWAY] = (struct sockaddr_storage *)&sin_gate;
1384 	sin_mask.sin_family = AF_INET;
1385 	/* LINTED */
1386 	info.rti_info[RTAX_NETMASK] = (struct sockaddr_storage *)&sin_mask;
1387 	sin_dst.sin_family = AF_INET;
1388 	/* LINTED */
1389 	info.rti_info[RTAX_AUTHOR] = (struct sockaddr_storage *)&sin_author;
1390 
1391 	for (;;) {
1392 		nroutes = dbuf.len / sizeof (mib2_ipRouteEntry_t);
1393 		for (rp = routes; nroutes > 0; ++rp, nroutes--) {
1394 
1395 			/*
1396 			 * Ignore IRE cache, broadcast, and local address
1397 			 * entries; they're not subject to routing socket
1398 			 * control.
1399 			 */
1400 			if (rp->ipRouteInfo.re_ire_type &
1401 			    (IRE_BROADCAST | IRE_CACHE | IRE_LOCAL))
1402 				continue;
1403 
1404 			/* ignore multicast addresses */
1405 			if (IN_MULTICAST(ntohl(rp->ipRouteDest)))
1406 				continue;
1407 
1408 
1409 #ifdef DEBUG_KERNEL_ROUTE_READ
1410 			(void) fprintf(stderr, "route type %d, ire type %08X, "
1411 			    "flags %08X: %s", rp->ipRouteType,
1412 			    rp->ipRouteInfo.re_ire_type,
1413 			    rp->ipRouteInfo.re_flags,
1414 			    naddr_ntoa(rp->ipRouteDest));
1415 			(void) fprintf(stderr, " %s",
1416 			    naddr_ntoa(rp->ipRouteMask));
1417 			(void) fprintf(stderr, " %s\n",
1418 			    naddr_ntoa(rp->ipRouteNextHop));
1419 #endif
1420 
1421 			/* Fake up the needed entries */
1422 			rtm.rtm_flags = rp->ipRouteInfo.re_flags;
1423 			rtm.rtm_type = RTM_GET;
1424 			rtm.rtm_rmx.rmx_hopcount = rp->ipRouteMetric1;
1425 
1426 			(void) memset(ifname, 0, sizeof (ifname));
1427 			if (rp->ipRouteIfIndex.o_length <
1428 			    sizeof (rp->ipRouteIfIndex.o_bytes))
1429 				rp->ipRouteIfIndex.o_bytes[
1430 				    rp->ipRouteIfIndex.o_length] = '\0';
1431 				(void) strncpy(ifname,
1432 				    rp->ipRouteIfIndex.o_bytes,
1433 				    sizeof (ifname));
1434 
1435 			/*
1436 			 * First try to match up on gwkludge entries
1437 			 * before trying to match ifp by name.
1438 			 */
1439 			if ((ifp = gwkludge_iflookup(rp->ipRouteDest,
1440 			    rp->ipRouteNextHop,
1441 			    ntohl(rp->ipRouteMask))) == NULL)
1442 				ifp = ifwithname(ifname);
1443 
1444 			info.rti_addrs = RTA_DST | RTA_GATEWAY | RTA_NETMASK;
1445 			if (rp->ipRouteInfo.re_ire_type & IRE_HOST_REDIRECT)
1446 				info.rti_addrs |= RTA_AUTHOR;
1447 			sin_dst.sin_addr.s_addr = rp->ipRouteDest;
1448 			sin_gate.sin_addr.s_addr = rp->ipRouteNextHop;
1449 			sin_mask.sin_addr.s_addr = rp->ipRouteMask;
1450 			sin_author.sin_addr.s_addr =
1451 			    rp->ipRouteInfo.re_src_addr;
1452 
1453 			/*
1454 			 * Note static routes and interface routes, and also
1455 			 * preload the image of the kernel table so that
1456 			 * we can later clean it, as well as avoid making
1457 			 * unneeded changes.  Keep the old kernel routes for a
1458 			 * few seconds to allow a RIP or router-discovery
1459 			 * response to be heard.
1460 			 */
1461 			rtm_add(&rtm, &info, MAX_WAITTIME,
1462 			    ((rp->ipRouteInfo.re_ire_type &
1463 			    (IRE_INTERFACE|IRE_LOOPBACK)) != 0), ifp);
1464 		}
1465 		if (r == 0) {
1466 			break;
1467 		}
1468 		r = getmsg(ipfd, NULL, &dbuf, &flags);
1469 	}
1470 
1471 hash_clean:
1472 	if (ipfd != -1)
1473 		(void) close(ipfd);
1474 	for (i = 0; i < KHASH_SIZE; i++) {
1475 		for (k = khash_bins[i]; k != NULL; k = k->k_next) {
1476 
1477 			/*
1478 			 * KS_DELETED routes have been removed from the
1479 			 * kernel, but we keep them around for reasons
1480 			 * stated in del_static(), so we skip the check
1481 			 * for KS_DELETED routes here.
1482 			 */
1483 			if ((k->k_state & (KS_CHECK|KS_DELETED)) == KS_CHECK) {
1484 
1485 				if (!(k->k_state & KS_DYNAMIC))
1486 				    writelog(LOG_WARNING,
1487 					"%s --> %s disappeared from kernel",
1488 					addrname(k->k_dst, k->k_mask, 0),
1489 					naddr_ntoa(k->k_gate));
1490 				del_static(k->k_dst, k->k_mask, k->k_gate,
1491 				    k->k_ifp, 1);
1492 
1493 			}
1494 		}
1495 	}
1496 }
1497 
1498 
1499 /* Listen to announcements from the kernel */
1500 void
1501 read_rt(void)
1502 {
1503 	long cc;
1504 	struct interface *ifp;
1505 	struct sockaddr_in gate_sin;
1506 	in_addr_t mask, gate;
1507 	union {
1508 		struct {
1509 			struct rt_msghdr rtm;
1510 			struct sockaddr_storage addrs[RTA_NUMBITS];
1511 		} r;
1512 		struct if_msghdr ifm;
1513 	} m;
1514 	char str[100], *strp;
1515 	struct rt_addrinfo info;
1516 
1517 
1518 	for (;;) {
1519 		cc = read(rt_sock, &m, sizeof (m));
1520 		if (cc <= 0) {
1521 			if (cc < 0 && errno != EWOULDBLOCK)
1522 				LOGERR("read(rt_sock)");
1523 			return;
1524 		}
1525 
1526 		if (TRACERTS)
1527 			dump_rt_msg("read", &m.r.rtm, cc);
1528 
1529 		if (cc < m.r.rtm.rtm_msglen) {
1530 			msglog("routing message truncated (%d < %d)",
1531 			    cc, m.r.rtm.rtm_msglen);
1532 		}
1533 
1534 		if (m.r.rtm.rtm_version != RTM_VERSION) {
1535 			msglog("bogus routing message version %d",
1536 			    m.r.rtm.rtm_version);
1537 			continue;
1538 		}
1539 
1540 		ifp = NULL;
1541 
1542 		if (m.r.rtm.rtm_type == RTM_IFINFO ||
1543 		    m.r.rtm.rtm_type == RTM_NEWADDR ||
1544 		    m.r.rtm.rtm_type == RTM_DELADDR) {
1545 			strp = if_bit_string(m.ifm.ifm_flags, _B_TRUE);
1546 			if (strp == NULL) {
1547 				strp = str;
1548 				(void) sprintf(str, "%#x", m.ifm.ifm_flags);
1549 			}
1550 			ifp = ifwithindex(m.ifm.ifm_index,
1551 			    m.r.rtm.rtm_type != RTM_DELADDR);
1552 			if (ifp == NULL) {
1553 				char ifname[LIFNAMSIZ], *ifnamep;
1554 
1555 				ifnamep = if_indextoname(m.ifm.ifm_index,
1556 				    ifname);
1557 				if (ifnamep == NULL) {
1558 					trace_act("note %s with flags %s"
1559 					    " for unknown interface index #%d",
1560 					    rtm_type_name(m.r.rtm.rtm_type),
1561 					    strp, m.ifm.ifm_index);
1562 				} else {
1563 					trace_act("note %s with flags %s"
1564 					    " for unknown interface %s",
1565 					    rtm_type_name(m.r.rtm.rtm_type),
1566 					    strp, ifnamep);
1567 				}
1568 			} else {
1569 				trace_act("note %s with flags %s for %s",
1570 				    rtm_type_name(m.r.rtm.rtm_type),
1571 				    strp, ifp->int_name);
1572 			}
1573 			if (strp != str)
1574 				free(strp);
1575 
1576 			/*
1577 			 * After being informed of a change to an interface,
1578 			 * check them all now if the check would otherwise
1579 			 * be a long time from now, if the interface is
1580 			 * not known, or if the interface has been turned
1581 			 * off or on.
1582 			 */
1583 			if (ifscan_timer.tv_sec-now.tv_sec >=
1584 			    CHECK_BAD_INTERVAL || ifp == NULL ||
1585 			    ((ifp->int_if_flags ^ m.ifm.ifm_flags) &
1586 				IFF_UP) != 0)
1587 				ifscan_timer.tv_sec = now.tv_sec;
1588 			continue;
1589 		} else {
1590 			if (m.r.rtm.rtm_index != 0)
1591 				ifp = ifwithindex(m.r.rtm.rtm_index, 1);
1592 		}
1593 
1594 		(void) strlcpy(str, rtm_type_name(m.r.rtm.rtm_type),
1595 		    sizeof (str));
1596 		strp = &str[strlen(str)];
1597 		if (m.r.rtm.rtm_type <= RTM_CHANGE)
1598 			strp += snprintf(strp, sizeof (str) - (strp - str),
1599 			    " from pid %d", (int)m.r.rtm.rtm_pid);
1600 
1601 		/* LINTED */
1602 		(void) rt_xaddrs(&info, (struct sockaddr_storage *)(&m.r.rtm +
1603 		    1), (char *)&m + cc, m.r.rtm.rtm_addrs);
1604 
1605 		if (INFO_DST(&info) == 0) {
1606 			trace_act("ignore %s without dst", str);
1607 			continue;
1608 		}
1609 
1610 		if (INFO_DST(&info)->ss_family != AF_INET) {
1611 			trace_act("ignore %s for AF %d", str,
1612 			    INFO_DST(&info)->ss_family);
1613 			continue;
1614 		}
1615 
1616 		mask = ((INFO_MASK(&info) != 0) ?
1617 		    ntohl(S_ADDR(INFO_MASK(&info))) :
1618 		    (m.r.rtm.rtm_flags & RTF_HOST) ?
1619 		    HOST_MASK : std_mask(S_ADDR(INFO_DST(&info))));
1620 
1621 		strp += snprintf(strp, sizeof (str) - (strp - str), ": %s",
1622 		    addrname(S_ADDR(INFO_DST(&info)), mask, 0));
1623 
1624 		if (IN_MULTICAST(ntohl(S_ADDR(INFO_DST(&info))))) {
1625 			trace_act("ignore multicast %s", str);
1626 			continue;
1627 		}
1628 
1629 		if (m.r.rtm.rtm_flags & RTF_LLINFO) {
1630 			trace_act("ignore ARP %s", str);
1631 			continue;
1632 		}
1633 
1634 		if (get_info_gate(&INFO_GATE(&info), &gate_sin)) {
1635 			gate = S_ADDR(INFO_GATE(&info));
1636 			strp += snprintf(strp, sizeof (str) - (strp - str),
1637 			    " --> %s", naddr_ntoa(gate));
1638 		} else {
1639 			gate = 0;
1640 		}
1641 
1642 		if (INFO_AUTHOR(&info) != 0)
1643 			strp += snprintf(strp, sizeof (str) - (strp - str),
1644 			    " by authority of %s",
1645 			    saddr_ntoa(INFO_AUTHOR(&info)));
1646 
1647 		switch (m.r.rtm.rtm_type) {
1648 		case RTM_ADD:
1649 		case RTM_CHANGE:
1650 		case RTM_REDIRECT:
1651 			if (m.r.rtm.rtm_errno != 0) {
1652 				trace_act("ignore %s with \"%s\" error",
1653 				    str, rip_strerror(m.r.rtm.rtm_errno));
1654 			} else {
1655 				trace_act("%s", str);
1656 				rtm_add(&m.r.rtm, &info, 0,
1657 				    !(m.r.rtm.rtm_flags & RTF_GATEWAY) &&
1658 				    m.r.rtm.rtm_type != RTM_REDIRECT, ifp);
1659 
1660 			}
1661 			break;
1662 
1663 		case RTM_DELETE:
1664 			if (m.r.rtm.rtm_errno != 0 &&
1665 			    m.r.rtm.rtm_errno != ESRCH) {
1666 				trace_act("ignore %s with \"%s\" error",
1667 				    str, rip_strerror(m.r.rtm.rtm_errno));
1668 			} else {
1669 				trace_act("%s", str);
1670 				del_static(S_ADDR(INFO_DST(&info)), mask,
1671 				    gate, ifp, 1);
1672 			}
1673 			break;
1674 
1675 		case RTM_LOSING:
1676 			trace_act("%s", str);
1677 			rtm_lose(&m.r.rtm, &info);
1678 			break;
1679 
1680 		default:
1681 			trace_act("ignore %s", str);
1682 			break;
1683 		}
1684 	}
1685 }
1686 
1687 
1688 /*
1689  * Disassemble a routing message.  The result is an array of pointers
1690  * to sockaddr_storage structures stored in the info argument.
1691  *
1692  * ss is a pointer to the beginning of the data following the
1693  * rt_msghdr contained in the routing socket message, which consists
1694  * of a string of concatenated sockaddr structure of different types.
1695  *
1696  * Extended attributes can be appended at the end of the list.
1697  */
1698 static int
1699 rt_xaddrs(struct rt_addrinfo *info,
1700     struct sockaddr_storage *ss,
1701     char *lim,
1702     int addrs)
1703 {
1704 	int retv = 0;
1705 	int i;
1706 	int abit;
1707 	int complaints;
1708 	static int prev_complaints;
1709 
1710 #define	XBAD_AF		0x1
1711 #define	XBAD_SHORT	0x2
1712 #define	XBAD_LONG	0x4
1713 
1714 	(void) memset(info, 0, sizeof (*info));
1715 	info->rti_addrs = addrs;
1716 	complaints = 0;
1717 	for (i = 0, abit = 1; i < RTAX_MAX && (char *)ss < lim;
1718 	    i++, abit <<= 1) {
1719 		if ((addrs & abit) == 0)
1720 			continue;
1721 		info->rti_info[i] = ss;
1722 		/* Horrible interface here */
1723 		switch (ss->ss_family) {
1724 		case AF_UNIX:
1725 			/* LINTED */
1726 			ss = (struct sockaddr_storage *)(
1727 			    (struct sockaddr_un *)ss + 1);
1728 			break;
1729 		case AF_INET:
1730 			/* LINTED */
1731 			ss = (struct sockaddr_storage *)(
1732 			    (struct sockaddr_in *)ss + 1);
1733 			break;
1734 		case AF_LINK:
1735 			/* LINTED */
1736 			ss = (struct sockaddr_storage *)(
1737 			    (struct sockaddr_dl *)ss + 1);
1738 			break;
1739 		case AF_INET6:
1740 			/* LINTED */
1741 			ss = (struct sockaddr_storage *)(
1742 			    (struct sockaddr_in6 *)ss + 1);
1743 			break;
1744 		default:
1745 			if (!(prev_complaints & XBAD_AF))
1746 				writelog(LOG_WARNING,
1747 				    "unknown address family %d "
1748 				    "encountered", ss->ss_family);
1749 			if (complaints & XBAD_AF)
1750 				goto xaddr_done;
1751 			/* LINTED */
1752 			ss = (struct sockaddr_storage *)(
1753 			    (struct sockaddr *)ss + 1);
1754 			complaints |= XBAD_AF;
1755 			info->rti_addrs &= abit - 1;
1756 			addrs = info->rti_addrs;
1757 			retv = -1;
1758 			break;
1759 		}
1760 		if ((char *)ss > lim) {
1761 			if (!(prev_complaints & XBAD_SHORT))
1762 				msglog("sockaddr %d too short by %d "
1763 				    "bytes", i + 1, (char *)ss - lim);
1764 			complaints |= XBAD_SHORT;
1765 			info->rti_info[i] = NULL;
1766 			info->rti_addrs &= abit - 1;
1767 			retv = -1;
1768 			goto xaddr_done;
1769 		}
1770 	}
1771 
1772 	while (((char *)ss + sizeof (rtm_ext_t)) <= lim) {
1773 		rtm_ext_t *tp;
1774 		char *nxt;
1775 
1776 		/* LINTED: alignment */
1777 		tp = (rtm_ext_t *)ss;
1778 		nxt = (char *)(tp + 1) + tp->rtmex_len;
1779 
1780 		if (!IS_P2ALIGNED(tp->rtmex_len, sizeof (uint32_t)) ||
1781 		    nxt > lim) {
1782 			break;
1783 		}
1784 
1785 		/* LINTED: alignment */
1786 		ss = (struct sockaddr_storage *)nxt;
1787 	}
1788 
1789 	if ((char *)ss != lim) {
1790 		if ((char *)ss > lim) {
1791 			if (!(prev_complaints & XBAD_SHORT))
1792 				msglog("routing message too short by %d bytes",
1793 				    (char *)ss - lim);
1794 			complaints |= XBAD_SHORT;
1795 		} else if (!(prev_complaints & XBAD_LONG)) {
1796 			msglog("%d bytes of routing message left over",
1797 			    lim - (char *)ss);
1798 			complaints |= XBAD_LONG;
1799 		}
1800 		retv = -1;
1801 	}
1802 xaddr_done:
1803 	prev_complaints = complaints;
1804 	return (retv);
1805 }
1806 
1807 
1808 /* after aggregating, note routes that belong in the kernel */
1809 static void
1810 kern_out(struct ag_info *ag)
1811 {
1812 	struct khash *k;
1813 
1814 	/*
1815 	 * Do not install bad routes if they are not already present.
1816 	 * This includes routes that had RS_NET_SYN for interfaces that
1817 	 * recently died.
1818 	 */
1819 	if (ag->ag_metric == HOPCNT_INFINITY) {
1820 		k = kern_find(htonl(ag->ag_dst_h), ag->ag_mask,
1821 		    ag->ag_nhop, ag->ag_ifp, NULL);
1822 		if (k == NULL)
1823 			return;
1824 	} else {
1825 		k = kern_add(htonl(ag->ag_dst_h), ag->ag_mask, ag->ag_nhop,
1826 		    ag->ag_ifp);
1827 	}
1828 
1829 	if (k->k_state & KS_NEW) {
1830 		/* will need to add new entry to the kernel table */
1831 		k->k_state = KS_ADD;
1832 		if (ag->ag_state & AGS_GATEWAY)
1833 			k->k_state |= KS_GATEWAY;
1834 		if (ag->ag_state & AGS_IF)
1835 			k->k_state |= KS_IF;
1836 		if (ag->ag_state & AGS_PASSIVE)
1837 			k->k_state |= KS_PASSIVE;
1838 		if (ag->ag_state & AGS_FILE)
1839 			k->k_state |= KS_FILE;
1840 		k->k_gate = ag->ag_nhop;
1841 		k->k_ifp = ag->ag_ifp;
1842 		k->k_metric = ag->ag_metric;
1843 		return;
1844 	}
1845 
1846 	if ((k->k_state & (KS_STATIC|KS_DEPRE_IF)) ||
1847 	    ((k->k_state & (KS_IF|KS_PASSIVE)) == KS_IF)) {
1848 		return;
1849 	}
1850 
1851 	/* modify existing kernel entry if necessary */
1852 	if (k->k_gate == ag->ag_nhop && k->k_ifp == ag->ag_ifp &&
1853 	    k->k_metric != ag->ag_metric) {
1854 			/*
1855 			 * Must delete bad interface routes etc.
1856 			 * to change them.
1857 			 */
1858 			if (k->k_metric == HOPCNT_INFINITY)
1859 				k->k_state |= KS_DEL_ADD;
1860 			k->k_gate = ag->ag_nhop;
1861 			k->k_metric = ag->ag_metric;
1862 			k->k_state |= KS_CHANGE;
1863 	}
1864 
1865 	/*
1866 	 * If the daemon thinks the route should exist, forget
1867 	 * about any redirections.
1868 	 * If the daemon thinks the route should exist, eventually
1869 	 * override manual intervention by the operator.
1870 	 */
1871 	if ((k->k_state & (KS_DYNAMIC | KS_DELETED)) != 0) {
1872 		k->k_state &= ~KS_DYNAMIC;
1873 		k->k_state |= (KS_ADD | KS_DEL_ADD);
1874 	}
1875 
1876 	if ((k->k_state & KS_GATEWAY) && !(ag->ag_state & AGS_GATEWAY)) {
1877 		k->k_state &= ~KS_GATEWAY;
1878 		k->k_state |= (KS_ADD | KS_DEL_ADD);
1879 	} else if (!(k->k_state & KS_GATEWAY) && (ag->ag_state & AGS_GATEWAY)) {
1880 		k->k_state |= KS_GATEWAY;
1881 		k->k_state |= (KS_ADD | KS_DEL_ADD);
1882 	}
1883 
1884 	/*
1885 	 * Deleting-and-adding is necessary to change aspects of a route.
1886 	 * Just delete instead of deleting and then adding a bad route.
1887 	 * Otherwise, we want to keep the route in the kernel.
1888 	 */
1889 	if (k->k_metric == HOPCNT_INFINITY && (k->k_state & KS_DEL_ADD))
1890 		k->k_state |= KS_DELETE;
1891 	else
1892 		k->k_state &= ~KS_DELETE;
1893 #undef RT
1894 }
1895 
1896 /*
1897  * Update our image of the kernel forwarding table using the given
1898  * route from our internal routing table.
1899  */
1900 
1901 /*ARGSUSED1*/
1902 static int
1903 walk_kern(struct radix_node *rn, void *argp)
1904 {
1905 #define	RT ((struct rt_entry *)rn)
1906 	uint8_t metric, pref;
1907 	uint_t ags = 0;
1908 	int i;
1909 	struct rt_spare *rts;
1910 
1911 	/* Do not install synthetic routes */
1912 	if (RT->rt_state & RS_NET_SYN)
1913 		return (0);
1914 
1915 	/*
1916 	 * Do not install static routes here. Only
1917 	 * read_rt->rtm_add->kern_add should install those
1918 	 */
1919 	if ((RT->rt_state & RS_STATIC) &&
1920 	    (RT->rt_spares[0].rts_origin != RO_FILE))
1921 		return (0);
1922 
1923 	/* Do not clobber kernel if this is a route for a dead interface */
1924 	if (RT->rt_state & RS_BADIF)
1925 		return (0);
1926 
1927 	if (!(RT->rt_state & RS_IF)) {
1928 		/* This is an ordinary route, not for an interface. */
1929 
1930 		/*
1931 		 * aggregate, ordinary good routes without regard to
1932 		 * their metric
1933 		 */
1934 		pref = 1;
1935 		ags |= (AGS_GATEWAY | AGS_SUPPRESS | AGS_AGGREGATE);
1936 
1937 		/*
1938 		 * Do not install host routes directly to hosts, to avoid
1939 		 * interfering with ARP entries in the kernel table.
1940 		 */
1941 		if (RT_ISHOST(RT) && ntohl(RT->rt_dst) == RT->rt_gate)
1942 			return (0);
1943 
1944 	} else {
1945 		/*
1946 		 * This is an interface route.
1947 		 * Do not install routes for "external" remote interfaces.
1948 		 */
1949 		if (RT->rt_ifp != NULL && (RT->rt_ifp->int_state & IS_EXTERNAL))
1950 			return (0);
1951 
1952 		/* Interfaces should override received routes. */
1953 		pref = 0;
1954 		ags |= (AGS_IF | AGS_CORS_GATE);
1955 		if (RT->rt_ifp != NULL &&
1956 		    !(RT->rt_ifp->int_if_flags & IFF_LOOPBACK) &&
1957 		    (RT->rt_ifp->int_state & (IS_PASSIVE|IS_ALIAS)) ==
1958 		    IS_PASSIVE) {
1959 			ags |= AGS_PASSIVE;
1960 		}
1961 
1962 		/*
1963 		 * If it is not an interface, or an alias for an interface,
1964 		 * it must be a "gateway."
1965 		 *
1966 		 * If it is a "remote" interface, it is also a "gateway" to
1967 		 * the kernel if is not a alias.
1968 		 */
1969 		if (RT->rt_ifp == NULL || (RT->rt_ifp->int_state & IS_REMOTE)) {
1970 
1971 			ags |= (AGS_GATEWAY | AGS_SUPPRESS);
1972 
1973 			/*
1974 			 * Do not aggregate IS_PASSIVE routes.
1975 			 */
1976 			if (!(RT->rt_ifp->int_state & IS_PASSIVE))
1977 				ags |= AGS_AGGREGATE;
1978 		}
1979 	}
1980 
1981 	metric = RT->rt_metric;
1982 	if (metric == HOPCNT_INFINITY) {
1983 		/* If the route is dead, try hard to aggregate. */
1984 		pref = HOPCNT_INFINITY;
1985 		ags |= (AGS_FINE_GATE | AGS_SUPPRESS);
1986 		ags &= ~(AGS_IF | AGS_CORS_GATE);
1987 	}
1988 
1989 	/*
1990 	 * dump all routes that have the same metric as rt_spares[0]
1991 	 * into the kern_table, to be added to the kernel.
1992 	 */
1993 	for (i = 0; i < RT->rt_num_spares; i++) {
1994 		rts = &RT->rt_spares[i];
1995 
1996 		/* Do not install external routes */
1997 		if (rts->rts_flags & RTS_EXTERNAL)
1998 			continue;
1999 
2000 		if (rts->rts_metric == metric) {
2001 			ag_check(RT->rt_dst, RT->rt_mask,
2002 			    rts->rts_router, rts->rts_ifp, rts->rts_gate,
2003 			    metric, pref, 0, 0,
2004 			    (rts->rts_origin & RO_FILE) ? (ags|AGS_FILE) : ags,
2005 			    kern_out);
2006 		}
2007 	}
2008 	return (0);
2009 #undef RT
2010 }
2011 
2012 
2013 /* Update the kernel table to match the daemon table. */
2014 static void
2015 fix_kern(void)
2016 {
2017 	int i;
2018 	struct khash *k, *pk, *knext;
2019 
2020 
2021 	need_kern = age_timer;
2022 
2023 	/* Walk daemon table, updating the copy of the kernel table. */
2024 	(void) rn_walktree(rhead, walk_kern, NULL);
2025 	ag_flush(0, 0, kern_out);
2026 
2027 	for (i = 0; i < KHASH_SIZE; i++) {
2028 		pk = NULL;
2029 		for (k = khash_bins[i]; k != NULL;  k = knext) {
2030 			knext = k->k_next;
2031 
2032 			/* Do not touch local interface routes */
2033 			if ((k->k_state & KS_DEPRE_IF) ||
2034 			    (k->k_state & (KS_IF|KS_PASSIVE)) == KS_IF) {
2035 				pk = k;
2036 				continue;
2037 			}
2038 
2039 			/* Do not touch static routes */
2040 			if (k->k_state & KS_STATIC) {
2041 				kern_check_static(k, 0);
2042 				pk = k;
2043 				continue;
2044 			}
2045 
2046 			/* check hold on routes deleted by the operator */
2047 			if (k->k_keep > now.tv_sec) {
2048 				/* ensure we check when the hold is over */
2049 				LIM_SEC(need_kern, k->k_keep);
2050 				pk = k;
2051 				continue;
2052 			}
2053 
2054 			if ((k->k_state & KS_DELETE) &&
2055 			    !(k->k_state & KS_DYNAMIC)) {
2056 				if ((k->k_dst == RIP_DEFAULT) &&
2057 				    (k->k_ifp != NULL) &&
2058 				    (kern_alternate(RIP_DEFAULT,
2059 				    k->k_mask, k->k_gate, k->k_ifp,
2060 				    NULL) == NULL))
2061 					rdisc_restore(k->k_ifp);
2062 				kern_ioctl(k, RTM_DELETE, 0);
2063 				if (pk != NULL)
2064 					pk->k_next = knext;
2065 				else
2066 					khash_bins[i] = knext;
2067 				free(k);
2068 				continue;
2069 			}
2070 
2071 			if (k->k_state & KS_DEL_ADD)
2072 				kern_ioctl(k, RTM_DELETE, 0);
2073 
2074 			if (k->k_state & KS_ADD) {
2075 				if ((k->k_dst == RIP_DEFAULT) &&
2076 				    (k->k_ifp != NULL))
2077 					rdisc_suppress(k->k_ifp);
2078 				kern_ioctl(k, RTM_ADD,
2079 				    ((0 != (k->k_state & (KS_GATEWAY |
2080 					KS_DYNAMIC))) ? RTF_GATEWAY : 0));
2081 			} else if (k->k_state & KS_CHANGE) {
2082 				/*
2083 				 * Should be using RTM_CHANGE here, but
2084 				 * since RTM_CHANGE is currently
2085 				 * not multipath-aware, and assumes
2086 				 * that RTF_GATEWAY implies the gateway
2087 				 * of the route for dst has to be
2088 				 * changed, we play safe, and do a del + add.
2089 				 */
2090 				kern_ioctl(k,  RTM_DELETE, 0);
2091 				kern_ioctl(k, RTM_ADD,
2092 				    ((0 != (k->k_state & (KS_GATEWAY |
2093 					KS_DYNAMIC))) ? RTF_GATEWAY : 0));
2094 			}
2095 			k->k_state &= ~(KS_ADD|KS_CHANGE|KS_DEL_ADD);
2096 
2097 			/*
2098 			 * Mark this route to be deleted in the next cycle.
2099 			 * This deletes routes that disappear from the
2100 			 * daemon table, since the normal aging code
2101 			 * will clear the bit for routes that have not
2102 			 * disappeared from the daemon table.
2103 			 */
2104 			k->k_state |= KS_DELETE;
2105 			pk = k;
2106 		}
2107 	}
2108 }
2109 
2110 
2111 /* Delete a static route in the image of the kernel table. */
2112 void
2113 del_static(in_addr_t dst, in_addr_t mask, in_addr_t gate,
2114     struct interface *ifp, int gone)
2115 {
2116 	struct khash *k;
2117 	struct rt_entry *rt;
2118 
2119 	/*
2120 	 * Just mark it in the table to be deleted next time the kernel
2121 	 * table is updated.
2122 	 * If it has already been deleted, mark it as such, and set its
2123 	 * keep-timer so that it will not be deleted again for a while.
2124 	 * This lets the operator delete a route added by the daemon
2125 	 * and add a replacement.
2126 	 */
2127 	k = kern_find(dst, mask, gate, ifp, NULL);
2128 	if (k != NULL && (gate == 0 || k->k_gate == gate)) {
2129 		k->k_state &= ~(KS_STATIC | KS_DYNAMIC | KS_CHECK);
2130 		k->k_state |= KS_DELETE;
2131 		if (gone) {
2132 			k->k_state |= KS_DELETED;
2133 			k->k_keep = now.tv_sec + K_KEEP_LIM;
2134 		}
2135 	}
2136 
2137 	rt = rtget(dst, mask);
2138 	if (rt != NULL && (rt->rt_state & RS_STATIC))
2139 		rtbad(rt, NULL);
2140 }
2141 
2142 
2143 /*
2144  * Delete all routes generated from ICMP Redirects that use a given gateway,
2145  * as well as old redirected routes.
2146  */
2147 void
2148 del_redirects(in_addr_t bad_gate, time_t old)
2149 {
2150 	int i;
2151 	struct khash *k;
2152 	boolean_t dosupply = should_supply(NULL);
2153 
2154 	for (i = 0; i < KHASH_SIZE; i++) {
2155 		for (k = khash_bins[i]; k != NULL; k = k->k_next) {
2156 			if (!(k->k_state & KS_DYNAMIC) ||
2157 			    (k->k_state & (KS_STATIC|KS_IF|KS_DEPRE_IF)))
2158 				continue;
2159 
2160 			if (k->k_gate != bad_gate && k->k_redirect_time > old &&
2161 			    !dosupply)
2162 				continue;
2163 
2164 			k->k_state |= KS_DELETE;
2165 			k->k_state &= ~KS_DYNAMIC;
2166 			need_kern.tv_sec = now.tv_sec;
2167 			trace_act("mark redirected %s --> %s for deletion",
2168 			    addrname(k->k_dst, k->k_mask, 0),
2169 			    naddr_ntoa(k->k_gate));
2170 		}
2171 	}
2172 }
2173 
2174 /* Start the daemon tables. */
2175 void
2176 rtinit(void)
2177 {
2178 	int i;
2179 	struct ag_info *ag;
2180 
2181 	/* Initialize the radix trees */
2182 	rn_init();
2183 	(void) rn_inithead((void**)&rhead, 32);
2184 
2185 	/* mark all of the slots in the table free */
2186 	ag_avail = ag_slots;
2187 	for (ag = ag_slots, i = 1; i < NUM_AG_SLOTS; i++) {
2188 		ag->ag_fine = ag+1;
2189 		ag++;
2190 	}
2191 }
2192 
2193 
2194 static struct sockaddr_in dst_sock = {AF_INET};
2195 static struct sockaddr_in mask_sock = {AF_INET};
2196 
2197 
2198 static void
2199 set_need_flash(void)
2200 {
2201 	if (!need_flash) {
2202 		need_flash = _B_TRUE;
2203 		/*
2204 		 * Do not send the flash update immediately.  Wait a little
2205 		 * while to hear from other routers.
2206 		 */
2207 		no_flash.tv_sec = now.tv_sec + MIN_WAITTIME;
2208 	}
2209 }
2210 
2211 
2212 /* Get a particular routing table entry */
2213 struct rt_entry *
2214 rtget(in_addr_t dst, in_addr_t mask)
2215 {
2216 	struct rt_entry *rt;
2217 
2218 	dst_sock.sin_addr.s_addr = dst;
2219 	mask_sock.sin_addr.s_addr = htonl(mask);
2220 	rt = (struct rt_entry *)rhead->rnh_lookup(&dst_sock, &mask_sock, rhead);
2221 	if (rt == NULL || rt->rt_dst != dst || rt->rt_mask != mask)
2222 		return (NULL);
2223 
2224 	return (rt);
2225 }
2226 
2227 
2228 /* Find a route to dst as the kernel would. */
2229 struct rt_entry *
2230 rtfind(in_addr_t dst)
2231 {
2232 	dst_sock.sin_addr.s_addr = dst;
2233 	return ((struct rt_entry *)rhead->rnh_matchaddr(&dst_sock, rhead));
2234 }
2235 
2236 
2237 /* add a route to the table */
2238 void
2239 rtadd(in_addr_t	dst,
2240     in_addr_t	mask,
2241     uint16_t	state,			/* rt_state for the entry */
2242     struct	rt_spare *new)
2243 {
2244 	struct rt_entry *rt;
2245 	in_addr_t smask;
2246 	int i;
2247 	struct rt_spare *rts;
2248 
2249 	/* This is the only function that increments total_routes. */
2250 	if (total_routes == MAX_ROUTES) {
2251 		msglog("have maximum (%d) routes", total_routes);
2252 		return;
2253 	}
2254 
2255 	rt = rtmalloc(sizeof (*rt), "rtadd");
2256 	(void) memset(rt, 0, sizeof (*rt));
2257 	rt->rt_spares = rtmalloc(SPARE_INC  * sizeof (struct rt_spare),
2258 	    "rtadd");
2259 	rt->rt_num_spares = SPARE_INC;
2260 	(void) memset(rt->rt_spares, 0, SPARE_INC  * sizeof (struct rt_spare));
2261 	for (rts = rt->rt_spares, i = rt->rt_num_spares; i != 0; i--, rts++)
2262 		rts->rts_metric = HOPCNT_INFINITY;
2263 
2264 	rt->rt_nodes->rn_key = (uint8_t *)&rt->rt_dst_sock;
2265 	rt->rt_dst = dst;
2266 	rt->rt_dst_sock.sin_family = AF_INET;
2267 	if (mask != HOST_MASK) {
2268 		smask = std_mask(dst);
2269 		if ((smask & ~mask) == 0 && mask > smask)
2270 			state |= RS_SUBNET;
2271 	}
2272 	mask_sock.sin_addr.s_addr = htonl(mask);
2273 	rt->rt_mask = mask;
2274 	rt->rt_spares[0] = *new;
2275 	rt->rt_state = state;
2276 	rt->rt_time = now.tv_sec;
2277 	rt->rt_poison_metric = HOPCNT_INFINITY;
2278 	rt->rt_seqno = update_seqno;
2279 
2280 	if (TRACEACTIONS)
2281 		trace_add_del("Add", rt);
2282 
2283 	need_kern.tv_sec = now.tv_sec;
2284 	set_need_flash();
2285 
2286 	if (NULL == rhead->rnh_addaddr(&rt->rt_dst_sock, &mask_sock, rhead,
2287 	    rt->rt_nodes)) {
2288 		msglog("rnh_addaddr() failed for %s mask=%s",
2289 		    naddr_ntoa(dst), naddr_ntoa(htonl(mask)));
2290 		free(rt);
2291 	}
2292 
2293 	total_routes++;
2294 }
2295 
2296 
2297 /* notice a changed route */
2298 void
2299 rtchange(struct rt_entry *rt,
2300     uint16_t	state,			/* new state bits */
2301     struct rt_spare *new,
2302     char	*label)
2303 {
2304 	if (rt->rt_metric != new->rts_metric) {
2305 		/*
2306 		 * Fix the kernel immediately if it seems the route
2307 		 * has gone bad, since there may be a working route that
2308 		 * aggregates this route.
2309 		 */
2310 		if (new->rts_metric == HOPCNT_INFINITY) {
2311 			need_kern.tv_sec = now.tv_sec;
2312 			if (new->rts_time >= now.tv_sec - EXPIRE_TIME)
2313 				new->rts_time = now.tv_sec - EXPIRE_TIME;
2314 		}
2315 		rt->rt_seqno = update_seqno;
2316 		set_need_flash();
2317 	}
2318 
2319 	if (rt->rt_gate != new->rts_gate) {
2320 		need_kern.tv_sec = now.tv_sec;
2321 		rt->rt_seqno = update_seqno;
2322 		set_need_flash();
2323 	}
2324 
2325 	state |= (rt->rt_state & RS_SUBNET);
2326 
2327 	/* Keep various things from deciding ageless routes are stale. */
2328 	if (!AGE_RT(state, rt->rt_spares[0].rts_origin, new->rts_ifp))
2329 		new->rts_time = now.tv_sec;
2330 
2331 	if (TRACEACTIONS)
2332 		trace_change(rt, state, new,
2333 		    label ? label : "Chg   ");
2334 
2335 	rt->rt_state = state;
2336 	/*
2337 	 * If the interface state of the new primary route is good,
2338 	 * turn off RS_BADIF flag
2339 	 */
2340 	if ((rt->rt_state & RS_BADIF) &&
2341 	    IS_IFF_UP(new->rts_ifp->int_if_flags) &&
2342 	    !(new->rts_ifp->int_state & (IS_BROKE | IS_SICK)))
2343 		rt->rt_state &= ~(RS_BADIF);
2344 
2345 	rt->rt_spares[0] = *new;
2346 }
2347 
2348 
2349 /* check for a better route among the spares */
2350 static struct rt_spare *
2351 rts_better(struct rt_entry *rt)
2352 {
2353 	struct rt_spare *rts, *rts1;
2354 	int i;
2355 
2356 	/* find the best alternative among the spares */
2357 	rts = rt->rt_spares+1;
2358 	for (i = rt->rt_num_spares, rts1 = rts+1; i > 2; i--, rts1++) {
2359 		if (BETTER_LINK(rt, rts1, rts))
2360 			rts = rts1;
2361 	}
2362 
2363 	return (rts);
2364 }
2365 
2366 
2367 /* switch to a backup route */
2368 void
2369 rtswitch(struct rt_entry *rt,
2370     struct rt_spare *rts)
2371 {
2372 	struct rt_spare swap;
2373 	char label[10];
2374 
2375 	/* Do not change permanent routes */
2376 	if (0 != (rt->rt_state & (RS_MHOME | RS_STATIC |
2377 	    RS_NET_SYN | RS_IF)))
2378 		return;
2379 
2380 	/* find the best alternative among the spares */
2381 	if (rts == NULL)
2382 		rts = rts_better(rt);
2383 
2384 	/* Do not bother if it is not worthwhile. */
2385 	if (!BETTER_LINK(rt, rts, rt->rt_spares))
2386 		return;
2387 
2388 	swap = rt->rt_spares[0];
2389 	(void) snprintf(label, sizeof (label), "Use #%d",
2390 	    (int)(rts - rt->rt_spares));
2391 	rtchange(rt, rt->rt_state & ~(RS_NET_SYN), rts, label);
2392 
2393 	if (swap.rts_metric == HOPCNT_INFINITY) {
2394 		*rts = rts_empty;
2395 	} else {
2396 		*rts = swap;
2397 	}
2398 
2399 }
2400 
2401 
2402 void
2403 rtdelete(struct rt_entry *rt)
2404 {
2405 	struct rt_entry *deleted_rt;
2406 	struct rt_spare *rts;
2407 	int i;
2408 	in_addr_t gate = rt->rt_gate; /* for debugging */
2409 
2410 	if (TRACEACTIONS)
2411 		trace_add_del("Del", rt);
2412 
2413 	for (i = 0; i < rt->rt_num_spares; i++) {
2414 		rts = &rt->rt_spares[i];
2415 		rts_delete(rt, rts);
2416 	}
2417 
2418 	dst_sock.sin_addr.s_addr = rt->rt_dst;
2419 	mask_sock.sin_addr.s_addr = htonl(rt->rt_mask);
2420 	if (rt != (deleted_rt =
2421 	    ((struct rt_entry *)rhead->rnh_deladdr(&dst_sock, &mask_sock,
2422 	    rhead)))) {
2423 		msglog("rnh_deladdr(%s) failed; found rt 0x%lx",
2424 		    rtname(rt->rt_dst, rt->rt_mask, gate), deleted_rt);
2425 		if (deleted_rt != NULL)
2426 			free(deleted_rt);
2427 	}
2428 	total_routes--;
2429 	free(rt);
2430 
2431 	if (dst_sock.sin_addr.s_addr == RIP_DEFAULT) {
2432 		/*
2433 		 * we just deleted the default route. Trigger rdisc_sort
2434 		 * so that we can recover from any rdisc information that
2435 		 * is valid
2436 		 */
2437 		rdisc_timer.tv_sec = 0;
2438 	}
2439 }
2440 
2441 void
2442 rts_delete(struct rt_entry *rt, struct rt_spare *rts)
2443 {
2444 	struct khash *k;
2445 
2446 	trace_upslot(rt, rts, &rts_empty);
2447 	k = kern_find(rt->rt_dst, rt->rt_mask,
2448 	    rts->rts_gate, rts->rts_ifp, NULL);
2449 	if (k != NULL &&
2450 	    !(k->k_state & KS_DEPRE_IF) &&
2451 	    ((k->k_state & (KS_IF|KS_PASSIVE)) != KS_IF)) {
2452 		k->k_state |= KS_DELETE;
2453 		need_kern.tv_sec = now.tv_sec;
2454 	}
2455 
2456 	*rts = rts_empty;
2457 }
2458 
2459 /*
2460  * Get rid of a bad route, and try to switch to a replacement.
2461  * If the route has gone bad because of a bad interface,
2462  * the information about the dead interface is available in badifp
2463  * for the purpose of sanity checks, if_flags checks etc.
2464  */
2465 static void
2466 rtbad(struct rt_entry *rt, struct interface *badifp)
2467 {
2468 	struct rt_spare new;
2469 	uint16_t rt_state;
2470 
2471 
2472 	if (badifp == NULL || (rt->rt_spares[0].rts_ifp == badifp)) {
2473 		/* Poison the route */
2474 		new = rt->rt_spares[0];
2475 		new.rts_metric = HOPCNT_INFINITY;
2476 		rt_state = rt->rt_state & ~(RS_IF | RS_LOCAL | RS_STATIC);
2477 	}
2478 
2479 	if (badifp != NULL) {
2480 		/*
2481 		 * Dont mark the rtentry bad unless the ifp for the primary
2482 		 * route is the bad ifp
2483 		 */
2484 		if (rt->rt_spares[0].rts_ifp != badifp)
2485 			return;
2486 		/*
2487 		 * badifp has just gone bad. We want to keep this
2488 		 * rt_entry around so that we tell our rip-neighbors
2489 		 * about the bad route, but we can't do anything
2490 		 * to the kernel itself, so mark it as RS_BADIF
2491 		 */
2492 		trace_misc("rtbad:Setting RS_BADIF (%s)", badifp->int_name);
2493 		rt_state |= RS_BADIF;
2494 		new.rts_ifp = &dummy_ifp;
2495 	}
2496 	rtchange(rt, rt_state, &new, 0);
2497 	rtswitch(rt, 0);
2498 }
2499 
2500 
2501 /*
2502  * Junk a RS_NET_SYN or RS_LOCAL route,
2503  *	unless it is needed by another interface.
2504  */
2505 void
2506 rtbad_sub(struct rt_entry *rt, struct interface *badifp)
2507 {
2508 	struct interface *ifp, *ifp1;
2509 	struct intnet *intnetp;
2510 	uint_t state;
2511 
2512 
2513 	ifp1 = NULL;
2514 	state = 0;
2515 
2516 	if (rt->rt_state & RS_LOCAL) {
2517 		/*
2518 		 * Is this the route through loopback for the interface?
2519 		 * If so, see if it is used by any other interfaces, such
2520 		 * as a point-to-point interface with the same local address.
2521 		 */
2522 		for (ifp = ifnet; ifp != NULL; ifp = ifp->int_next) {
2523 			/* Retain it if another interface needs it. */
2524 			if (ifp->int_addr == rt->rt_ifp->int_addr) {
2525 				state |= RS_LOCAL;
2526 				ifp1 = ifp;
2527 				break;
2528 			}
2529 		}
2530 
2531 	}
2532 
2533 	if (!(state & RS_LOCAL)) {
2534 		/*
2535 		 * Retain RIPv1 logical network route if there is another
2536 		 * interface that justifies it.
2537 		 */
2538 		if (rt->rt_state & RS_NET_SYN) {
2539 			for (ifp = ifnet; ifp != NULL; ifp = ifp->int_next) {
2540 				if ((ifp->int_state & IS_NEED_NET_SYN) &&
2541 				    rt->rt_mask == ifp->int_std_mask &&
2542 				    rt->rt_dst == ifp->int_std_addr) {
2543 					state |= RS_NET_SYN;
2544 					ifp1 = ifp;
2545 					break;
2546 				}
2547 			}
2548 		}
2549 
2550 		/* or if there is an authority route that needs it. */
2551 		for (intnetp = intnets; intnetp != NULL;
2552 		    intnetp = intnetp->intnet_next) {
2553 			if (intnetp->intnet_addr == rt->rt_dst &&
2554 			    intnetp->intnet_mask == rt->rt_mask) {
2555 				state |= (RS_NET_SYN | RS_NET_INT);
2556 				break;
2557 			}
2558 		}
2559 	}
2560 
2561 	if (ifp1 != NULL || (state & RS_NET_SYN)) {
2562 		struct rt_spare new = rt->rt_spares[0];
2563 		new.rts_ifp = ifp1;
2564 		rtchange(rt, ((rt->rt_state & ~(RS_NET_SYN|RS_LOCAL)) | state),
2565 		    &new, 0);
2566 	} else {
2567 		rtbad(rt, badifp);
2568 	}
2569 }
2570 
2571 /*
2572  * Called while walking the table looking for sick interfaces
2573  * or after a time change.
2574  */
2575 int
2576 walk_bad(struct radix_node *rn,
2577     void *argp)
2578 {
2579 #define	RT ((struct rt_entry *)rn)
2580 	struct rt_spare *rts;
2581 	int i, j = -1;
2582 
2583 	/* fix any spare routes through the interface */
2584 	for (i = 1; i < RT->rt_num_spares; i++) {
2585 		rts = &((struct rt_entry *)rn)->rt_spares[i];
2586 
2587 		if (rts->rts_metric < HOPCNT_INFINITY &&
2588 		    (rts->rts_ifp == NULL ||
2589 		    (rts->rts_ifp->int_state & IS_BROKE)))
2590 			rts_delete(RT, rts);
2591 		else {
2592 			if (rts->rts_origin != RO_NONE)
2593 				j = i;
2594 		}
2595 	}
2596 
2597 	/*
2598 	 * Deal with the main route
2599 	 * finished if it has been handled before or if its interface is ok
2600 	 */
2601 	if (RT->rt_ifp == NULL || !(RT->rt_ifp->int_state & IS_BROKE))
2602 		return (0);
2603 
2604 	/* Bad routes for other than interfaces are easy. */
2605 	if (!(RT->rt_state & (RS_IF | RS_NET_SYN | RS_LOCAL))) {
2606 		if (j > 0) {
2607 			RT->rt_spares[0].rts_metric = HOPCNT_INFINITY;
2608 			rtswitch(RT, NULL);
2609 		} else {
2610 			rtbad(RT, (struct interface *)argp);
2611 		}
2612 		return (0);
2613 	}
2614 
2615 	rtbad_sub(RT, (struct interface *)argp);
2616 	return (0);
2617 #undef RT
2618 }
2619 
2620 /*
2621  * Called while walking the table to replace a duplicate interface
2622  * with a backup.
2623  */
2624 int
2625 walk_rewire(struct radix_node *rn, void *argp)
2626 {
2627 	struct rt_entry *RT = (struct rt_entry *)rn;
2628 	struct rewire_data *wire = (struct rewire_data *)argp;
2629 	struct rt_spare *rts;
2630 	int i;
2631 
2632 	/* fix any spare routes through the interface */
2633 	rts = RT->rt_spares;
2634 	for (i = RT->rt_num_spares; i > 0; i--, rts++) {
2635 		if (rts->rts_ifp == wire->if_old) {
2636 			rts->rts_ifp = wire->if_new;
2637 			if ((RT->rt_dst == RIP_DEFAULT) &&
2638 			    (wire->if_old->int_state & IS_SUPPRESS_RDISC))
2639 				rdisc_suppress(rts->rts_ifp);
2640 			if ((rts->rts_metric += wire->metric_delta) >
2641 			    HOPCNT_INFINITY)
2642 				rts->rts_metric = HOPCNT_INFINITY;
2643 
2644 			/*
2645 			 * If the main route is getting a worse metric,
2646 			 * then it may be time to switch to a backup.
2647 			 */
2648 			if (i == RT->rt_num_spares && wire->metric_delta > 0) {
2649 				rtswitch(RT, NULL);
2650 			}
2651 		}
2652 	}
2653 
2654 	return (0);
2655 }
2656 
2657 /* Check the age of an individual route. */
2658 static int
2659 walk_age(struct radix_node *rn, void *argp)
2660 {
2661 #define	RT ((struct rt_entry *)rn)
2662 	struct interface *ifp;
2663 	struct rt_spare *rts;
2664 	int i;
2665 	in_addr_t age_bad_gate = *(in_addr_t *)argp;
2666 
2667 
2668 	/*
2669 	 * age all of the spare routes, including the primary route
2670 	 * currently in use
2671 	 */
2672 	rts = RT->rt_spares;
2673 	for (i = RT->rt_num_spares; i != 0; i--, rts++) {
2674 
2675 		ifp = rts->rts_ifp;
2676 		if (i == RT->rt_num_spares) {
2677 			if (!AGE_RT(RT->rt_state, rts->rts_origin, ifp)) {
2678 				/*
2679 				 * Keep various things from deciding ageless
2680 				 * routes are stale
2681 				 */
2682 				rts->rts_time = now.tv_sec;
2683 				continue;
2684 			}
2685 
2686 			/* forget RIP routes after RIP has been turned off. */
2687 			if (rip_sock < 0) {
2688 				rts->rts_time = now_stale + 1;
2689 			}
2690 		}
2691 
2692 		/* age failing routes */
2693 		if (age_bad_gate == rts->rts_gate &&
2694 		    rts->rts_time >= now_stale) {
2695 			rts->rts_time -= SUPPLY_INTERVAL;
2696 		}
2697 
2698 		/* trash the spare routes when they go bad */
2699 		if (rts->rts_origin == RO_RIP &&
2700 		    ((rip_sock < 0) ||
2701 		    (rts->rts_metric < HOPCNT_INFINITY &&
2702 		    now_garbage > rts->rts_time)) &&
2703 		    i != RT->rt_num_spares) {
2704 			rts_delete(RT, rts);
2705 		}
2706 	}
2707 
2708 
2709 	/* finished if the active route is still fresh */
2710 	if (now_stale <= RT->rt_time)
2711 		return (0);
2712 
2713 	/* try to switch to an alternative */
2714 	rtswitch(RT, NULL);
2715 
2716 	/* Delete a dead route after it has been publically mourned. */
2717 	if (now_garbage > RT->rt_time) {
2718 		rtdelete(RT);
2719 		return (0);
2720 	}
2721 
2722 	/* Start poisoning a bad route before deleting it. */
2723 	if (now.tv_sec - RT->rt_time > EXPIRE_TIME) {
2724 		struct rt_spare new = RT->rt_spares[0];
2725 
2726 		new.rts_metric = HOPCNT_INFINITY;
2727 		rtchange(RT, RT->rt_state, &new, 0);
2728 	}
2729 	return (0);
2730 }
2731 
2732 
2733 /* Watch for dead routes and interfaces. */
2734 void
2735 age(in_addr_t bad_gate)
2736 {
2737 	struct interface *ifp;
2738 	int need_query = 0;
2739 
2740 	/*
2741 	 * If not listening to RIP, there is no need to age the routes in
2742 	 * the table.
2743 	 */
2744 	age_timer.tv_sec = (now.tv_sec
2745 	    + ((rip_sock < 0) ? NEVER : SUPPLY_INTERVAL));
2746 
2747 	/*
2748 	 * Check for dead IS_REMOTE interfaces by timing their
2749 	 * transmissions.
2750 	 */
2751 	for (ifp = ifnet; ifp; ifp = ifp->int_next) {
2752 		if (!(ifp->int_state & IS_REMOTE))
2753 			continue;
2754 
2755 		/* ignore unreachable remote interfaces */
2756 		if (!check_remote(ifp))
2757 			continue;
2758 
2759 		/* Restore remote interface that has become reachable */
2760 		if (ifp->int_state & IS_BROKE)
2761 			if_ok(ifp, "remote ", _B_FALSE);
2762 
2763 		if (ifp->int_act_time != NEVER &&
2764 		    now.tv_sec - ifp->int_act_time > EXPIRE_TIME) {
2765 			writelog(LOG_NOTICE,
2766 			    "remote interface %s to %s timed out after"
2767 			    " %ld:%ld",
2768 			    ifp->int_name,
2769 			    naddr_ntoa(ifp->int_dstaddr),
2770 			    (now.tv_sec - ifp->int_act_time)/60,
2771 			    (now.tv_sec - ifp->int_act_time)%60);
2772 			if_sick(ifp, _B_FALSE);
2773 		}
2774 
2775 		/*
2776 		 * If we have not heard from the other router
2777 		 * recently, ask it.
2778 		 */
2779 		if (now.tv_sec >= ifp->int_query_time) {
2780 			ifp->int_query_time = NEVER;
2781 			need_query = 1;
2782 		}
2783 	}
2784 
2785 	/* Age routes. */
2786 	(void) rn_walktree(rhead, walk_age, &bad_gate);
2787 
2788 	/*
2789 	 * delete old redirected routes to keep the kernel table small
2790 	 * and prevent blackholes
2791 	 */
2792 	del_redirects(bad_gate, now.tv_sec-STALE_TIME);
2793 
2794 	/* Update the kernel routing table. */
2795 	fix_kern();
2796 
2797 	/* poke reticent remote gateways */
2798 	if (need_query)
2799 		rip_query();
2800 }
2801 
2802 void
2803 kern_dump(void)
2804 {
2805 	int i;
2806 	struct khash *k;
2807 
2808 	for (i = 0; i < KHASH_SIZE; i++) {
2809 		for (k = khash_bins[i]; k != NULL; k = k->k_next)
2810 			trace_khash(k);
2811 	}
2812 }
2813 
2814 
2815 static struct interface *
2816 gwkludge_iflookup(in_addr_t dstaddr, in_addr_t addr, in_addr_t mask)
2817 {
2818 	uint32_t int_state;
2819 	struct interface *ifp;
2820 
2821 	for (ifp = ifnet; ifp != NULL; ifp = ifp->int_next) {
2822 		int_state = ifp->int_state;
2823 
2824 		if (!(int_state & IS_REMOTE))
2825 			continue;
2826 
2827 		if (ifp->int_dstaddr == dstaddr && ifp->int_addr == addr &&
2828 		    ifp->int_mask == mask)
2829 			return (ifp);
2830 	}
2831 	return (NULL);
2832 }
2833