From fac399ce37d4ecdacfee7a5425413942af22bc13 Mon Sep 17 00:00:00 2001
From: mpi <mpi@openbsd.org>
Date: Thu, 22 Oct 2015 16:44:54 +0000
Subject: [PATCH] Make sure that the address matching the key (destination) of
 a route entry is attached to this entry.

ok phessler@, bluhm@
---
 sys/net/if.c           | 15 +++------------
 sys/netinet/if_ether.c | 13 ++-----------
 sys/netinet6/nd6.c     | 17 ++---------------
 3 files changed, 7 insertions(+), 38 deletions(-)

diff --git a/sys/net/if.c b/sys/net/if.c
index fb1e0aecb8f..332303834b2 100644
--- a/sys/net/if.c
+++ b/sys/net/if.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if.c,v 1.391 2015/10/22 15:37:47 bluhm Exp $	*/
+/*	$OpenBSD: if.c,v 1.392 2015/10/22 16:44:54 mpi Exp $	*/
 /*	$NetBSD: if.c,v 1.35 1996/05/07 05:26:04 thorpej Exp $	*/
 
 /*
@@ -1321,6 +1321,8 @@ p2p_rtrequest(int req, struct rtentry *rt)
 		if (ifa == NULL)
 			break;
 
+		KASSERT(ifa == rt->rt_ifa);
+
 		/*
 		 * XXX Since lo0 is in the default rdomain we should not
 		 * (ab)use it for any route related to an interface of a
@@ -1335,17 +1337,6 @@ p2p_rtrequest(int req, struct rtentry *rt)
 			break;
 
 		rt->rt_flags &= ~RTF_LLINFO;
-
-		/*
-		 * make sure to set rt->rt_ifa to the interface
-		 * address we are using, otherwise we will have trouble
-		 * with source address selection.
-		 */
-		if (ifa != rt->rt_ifa) {
-			ifafree(rt->rt_ifa);
-			ifa->ifa_refcnt++;
-			rt->rt_ifa = ifa;
-		}
 		break;
 	case RTM_DELETE:
 	case RTM_RESOLVE:
diff --git a/sys/netinet/if_ether.c b/sys/netinet/if_ether.c
index d1c810caaf5..b5b63d1cb4a 100644
--- a/sys/netinet/if_ether.c
+++ b/sys/netinet/if_ether.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_ether.c,v 1.174 2015/10/22 15:37:47 bluhm Exp $	*/
+/*	$OpenBSD: if_ether.c,v 1.175 2015/10/22 16:44:54 mpi Exp $	*/
 /*	$NetBSD: if_ether.c,v 1.31 1996/05/11 12:59:58 mycroft Exp $	*/
 
 /*
@@ -233,17 +233,8 @@ arp_rtrequest(int req, struct rtentry *rt)
 				break;
 		}
 		if (ifa) {
+			KASSERT(ifa == rt->rt_ifa);
 			rt->rt_expire = 0;
-			/*
-			 * make sure to set rt->rt_ifa to the interface
-			 * address we are using, otherwise we will have trouble
-			 * with source address selection.
-			 */
-			if (ifa != rt->rt_ifa) {
-				ifafree(rt->rt_ifa);
-				ifa->ifa_refcnt++;
-				rt->rt_ifa = ifa;
-			}
 		}
 		break;
 
diff --git a/sys/netinet6/nd6.c b/sys/netinet6/nd6.c
index 41be0601bff..3cb55ede1f2 100644
--- a/sys/netinet6/nd6.c
+++ b/sys/netinet6/nd6.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: nd6.c,v 1.157 2015/10/22 15:37:47 bluhm Exp $	*/
+/*	$OpenBSD: nd6.c,v 1.158 2015/10/22 16:44:54 mpi Exp $	*/
 /*	$KAME: nd6.c,v 1.280 2002/06/08 19:52:07 itojun Exp $	*/
 
 /*
@@ -1100,20 +1100,7 @@ nd6_rtrequest(int req, struct rtentry *rt)
 			nd6_llinfo_settimer(ln, -1);
 			ln->ln_state = ND6_LLINFO_REACHABLE;
 			ln->ln_byhint = 0;
-
-			/*
-			 * Make sure rt_ifa be equal to the ifaddr
-			 * corresponding to the address.
-			 * We need this because when we refer
-			 * rt_ifa->ia6_flags in ip6_input, we assume
-			 * that the rt_ifa points to the address instead
-			 * of the loopback address.
-			 */
-			if (ifa != rt->rt_ifa) {
-				ifafree(rt->rt_ifa);
-				ifa->ifa_refcnt++;
-				rt->rt_ifa = ifa;
-			}
+			KASSERT(ifa == rt->rt_ifa);
 		} else if (rt->rt_flags & RTF_ANNOUNCE) {
 			nd6_llinfo_settimer(ln, -1);
 			ln->ln_state = ND6_LLINFO_REACHABLE;
-- 
2.20.1