]> git.saurik.com Git - apple/xnu.git/blobdiff - bsd/netinet/in_arp.c
xnu-2050.7.9.tar.gz
[apple/xnu.git] / bsd / netinet / in_arp.c
index 6897e77ac87492b9b26765821083930e7db20a02..7dd09e904a7d41ea2a25dd61cd1e1b9a47649dab 100644 (file)
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2004-2008 Apple Inc. All rights reserved.
+ * Copyright (c) 2004-2012 Apple Inc. All rights reserved.
  *
  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
  * 
 #include <sys/kernel.h>
 #include <sys/mbuf.h>
 #include <sys/sysctl.h>
+#include <sys/mcache.h>
+#include <sys/protosw.h>
 #include <string.h>
 #include <net/if_arp.h>
 #include <net/if_dl.h>
 #include <net/dlil.h>
+#include <net/if_types.h>
+#include <net/if_llreach.h>
 #include <net/route.h>
 #include <netinet/if_ether.h>
 #include <netinet/in_var.h>
 #include <kern/zalloc.h>
 
-#define        SA(p) ((struct sockaddr *)(p))
-#define SIN(s) ((struct sockaddr_in *)s)
 #define CONST_LLADDR(s) ((const u_char*)((s)->sdl_data + (s)->sdl_nlen))
-#define        rt_expire rt_rmx.rmx_expire
 #define        equal(a1, a2) (bcmp((caddr_t)(a1), (caddr_t)(a2), (a1)->sa_len) == 0)
 
 static const size_t MAX_HW_LEN = 10;
@@ -99,16 +100,26 @@ static int arpt_down = 20; /* once declared down, don't send for 20 sec */
 int apple_hwcksum_tx = 1;
 int apple_hwcksum_rx = 1;
 
-SYSCTL_INT(_net_link_ether_inet, OID_AUTO, prune_intvl, CTLFLAG_RW,
-          &arpt_prune, 0, "");
-SYSCTL_INT(_net_link_ether_inet, OID_AUTO, max_age, CTLFLAG_RW, 
-          &arpt_keep, 0, "");
-SYSCTL_INT(_net_link_ether_inet, OID_AUTO, host_down_time, CTLFLAG_RW,
-          &arpt_down, 0, "");
-SYSCTL_INT(_net_link_ether_inet, OID_AUTO, apple_hwcksum_tx, CTLFLAG_RW,
-          &apple_hwcksum_tx, 0, "");
-SYSCTL_INT(_net_link_ether_inet, OID_AUTO, apple_hwcksum_rx, CTLFLAG_RW,
-          &apple_hwcksum_rx, 0, "");
+static int arp_llreach_base = (LL_BASE_REACHABLE / 1000); /* seconds */
+
+SYSCTL_INT(_net_link_ether_inet, OID_AUTO, prune_intvl,
+    CTLFLAG_RW | CTLFLAG_LOCKED, &arpt_prune, 0, "");
+
+SYSCTL_INT(_net_link_ether_inet, OID_AUTO, max_age,
+    CTLFLAG_RW | CTLFLAG_LOCKED, &arpt_keep, 0, "");
+
+SYSCTL_INT(_net_link_ether_inet, OID_AUTO, host_down_time,
+    CTLFLAG_RW | CTLFLAG_LOCKED, &arpt_down, 0, "");
+
+SYSCTL_INT(_net_link_ether_inet, OID_AUTO, apple_hwcksum_tx,
+    CTLFLAG_RW | CTLFLAG_LOCKED, &apple_hwcksum_tx, 0, "");
+
+SYSCTL_INT(_net_link_ether_inet, OID_AUTO, apple_hwcksum_rx,
+    CTLFLAG_RW | CTLFLAG_LOCKED, &apple_hwcksum_rx, 0, "");
+
+SYSCTL_INT(_net_link_ether_inet, OID_AUTO, arp_llreach_base,
+    CTLFLAG_RW | CTLFLAG_LOCKED, &arp_llreach_base, LL_BASE_REACHABLE,
+    "default ARP link-layer reachability max lifetime (in seconds)");
 
 struct llinfo_arp {
        /*
@@ -120,7 +131,10 @@ struct llinfo_arp {
         * The following are protected by rt_lock
         */
        struct  mbuf *la_hold;          /* last packet until resolved/timeout */
-       int32_t la_asked;               /* last time we QUERIED for this addr */
+       struct  if_llreach *la_llreach; /* link-layer reachability record */
+       u_int64_t la_lastused;          /* last used timestamp */
+       u_int32_t la_asked;             /* # of requests sent */
+       u_int32_t la_persist;           /* expirable, but stays around */
 };
 
 /*
@@ -139,7 +153,7 @@ struct llinfo_arp {
  *
  *     - Routing lock (rnh_lock)
  *
- * la_hold, la_asked
+ * la_hold, la_asked, la_llreach, la_lastused
  *
  *     - Routing entry lock (rt_lock)
  *
@@ -152,33 +166,36 @@ static LIST_HEAD(, llinfo_arp) llinfo_arp;
 
 static int     arp_inuse, arp_allocated;
 
-static int     arp_maxtries = 5;
+static u_int32_t arp_maxtries = 5;
 static int     useloopback = 1; /* use loopback interface for local traffic */
 static int     arp_proxyall = 0;
 static int     arp_sendllconflict = 0;
 
-SYSCTL_INT(_net_link_ether_inet, OID_AUTO, maxtries, CTLFLAG_RW,
+SYSCTL_INT(_net_link_ether_inet, OID_AUTO, maxtries, CTLFLAG_RW | CTLFLAG_LOCKED,
           &arp_maxtries, 0, "");
-SYSCTL_INT(_net_link_ether_inet, OID_AUTO, useloopback, CTLFLAG_RW,
+SYSCTL_INT(_net_link_ether_inet, OID_AUTO, useloopback, CTLFLAG_RW | CTLFLAG_LOCKED,
           &useloopback, 0, "");
-SYSCTL_INT(_net_link_ether_inet, OID_AUTO, proxyall, CTLFLAG_RW,
+SYSCTL_INT(_net_link_ether_inet, OID_AUTO, proxyall, CTLFLAG_RW | CTLFLAG_LOCKED,
           &arp_proxyall, 0, "");
-SYSCTL_INT(_net_link_ether_inet, OID_AUTO, sendllconflict, CTLFLAG_RW,
+SYSCTL_INT(_net_link_ether_inet, OID_AUTO, sendllconflict, CTLFLAG_RW | CTLFLAG_LOCKED,
           &arp_sendllconflict, 0, "");
 
-static int log_arp_warnings = 0;
+static int log_arp_warnings = 0;       /* Thread safe: no accumulated state */
 
-SYSCTL_INT(_net_link_ether_inet, OID_AUTO, log_arp_warnings, CTLFLAG_RW,
+SYSCTL_INT(_net_link_ether_inet, OID_AUTO, log_arp_warnings,
+       CTLFLAG_RW | CTLFLAG_LOCKED,
        &log_arp_warnings, 0,
        "log arp warning messages");
 
-static int keep_announcements = 1;
-SYSCTL_INT(_net_link_ether_inet, OID_AUTO, keep_announcements, CTLFLAG_RW,
+static int keep_announcements = 1;     /* Thread safe: no aging of state */
+SYSCTL_INT(_net_link_ether_inet, OID_AUTO, keep_announcements,
+       CTLFLAG_RW | CTLFLAG_LOCKED,
        &keep_announcements, 0,
        "keep arp announcements");
 
-static int send_conflicting_probes = 1;
-SYSCTL_INT(_net_link_ether_inet, OID_AUTO, send_conflicting_probes, CTLFLAG_RW,
+static int send_conflicting_probes = 1;        /* Thread safe: no accumulated state */
+SYSCTL_INT(_net_link_ether_inet, OID_AUTO, send_conflicting_probes,
+       CTLFLAG_RW | CTLFLAG_LOCKED,
        &send_conflicting_probes, 0,
        "send conflicting link-local arp probes");
 
@@ -187,6 +204,14 @@ static errno_t arp_lookup_route(const struct in_addr *, int,
 static void arptimer(void *);
 static struct llinfo_arp *arp_llinfo_alloc(void);
 static void arp_llinfo_free(void *);
+static void arp_llinfo_purge(struct rtentry *);
+static void arp_llinfo_get_ri(struct rtentry *, struct rt_reach_info *);
+static void arp_llinfo_get_iflri(struct rtentry *, struct ifnet_llreach_info *);
+
+static __inline void arp_llreach_use(struct llinfo_arp *);
+static __inline int arp_llreach_reachable(struct llinfo_arp *);
+static void arp_llreach_alloc(struct rtentry *, struct ifnet *, void *,
+    unsigned int, boolean_t);
 
 extern u_int32_t       ipv4_ll_arp_aware;
 
@@ -213,6 +238,7 @@ arp_init(void)
                panic("%s: failed allocating llinfo_arp_zone", __func__);
 
        zone_change(llinfo_arp_zone, Z_EXPAND, TRUE);
+       zone_change(llinfo_arp_zone, Z_CALLERACCT, FALSE);
 
        arpinit_done = 1;
 
@@ -242,9 +268,220 @@ arp_llinfo_free(void *arg)
                la->la_hold = NULL;
        }
 
+       /* Purge any link-layer info caching */
+       VERIFY(la->la_rt->rt_llinfo == la);
+       if (la->la_rt->rt_llinfo_purge != NULL)
+               la->la_rt->rt_llinfo_purge(la->la_rt);
+
        zfree(llinfo_arp_zone, la);
 }
 
+static void
+arp_llinfo_purge(struct rtentry *rt)
+{
+       struct llinfo_arp *la = rt->rt_llinfo;
+
+       RT_LOCK_ASSERT_HELD(rt);
+       VERIFY(rt->rt_llinfo_purge == arp_llinfo_purge && la != NULL);
+
+       if (la->la_llreach != NULL) {
+               RT_CONVERT_LOCK(rt);
+               ifnet_llreach_free(la->la_llreach);
+               la->la_llreach = NULL;
+       }
+       la->la_lastused = 0;
+}
+
+static void
+arp_llinfo_get_ri(struct rtentry *rt, struct rt_reach_info *ri)
+{
+       struct llinfo_arp *la = rt->rt_llinfo;
+       struct if_llreach *lr = la->la_llreach;
+
+       if (lr == NULL) {
+               bzero(ri, sizeof (*ri));
+               ri->ri_rssi = IFNET_RSSI_UNKNOWN;
+               ri->ri_lqm = IFNET_LQM_THRESH_OFF;
+               ri->ri_npm = IFNET_NPM_THRESH_UNKNOWN;
+       } else {
+               IFLR_LOCK(lr);
+               /* Export to rt_reach_info structure */
+               ifnet_lr2ri(lr, ri);
+               /* Export ARP send expiration (calendar) time */
+               ri->ri_snd_expire =
+                   ifnet_llreach_up2calexp(lr, la->la_lastused);
+               IFLR_UNLOCK(lr);
+       }
+}
+
+static void
+arp_llinfo_get_iflri(struct rtentry *rt, struct ifnet_llreach_info *iflri)
+{
+       struct llinfo_arp *la = rt->rt_llinfo;
+       struct if_llreach *lr = la->la_llreach;
+
+       if (lr == NULL) {
+               bzero(iflri, sizeof (*iflri));
+               iflri->iflri_rssi = IFNET_RSSI_UNKNOWN;
+               iflri->iflri_lqm = IFNET_LQM_THRESH_OFF;
+               iflri->iflri_npm = IFNET_NPM_THRESH_UNKNOWN;
+       } else {
+               IFLR_LOCK(lr);
+               /* Export to ifnet_llreach_info structure */
+               ifnet_lr2iflri(lr, iflri);
+               /* Export ARP send expiration (uptime) time */
+               iflri->iflri_snd_expire =
+                   ifnet_llreach_up2upexp(lr, la->la_lastused);
+               IFLR_UNLOCK(lr);
+       }
+}
+
+void
+arp_llreach_set_reachable(struct ifnet *ifp, void *addr, unsigned int alen)
+{
+       /* Nothing more to do if it's disabled */
+       if (arp_llreach_base == 0)
+               return;
+
+       ifnet_llreach_set_reachable(ifp, ETHERTYPE_IP, addr, alen);
+}
+
+static __inline void
+arp_llreach_use(struct llinfo_arp *la)
+{
+       if (la->la_llreach != NULL)
+               la->la_lastused = net_uptime();
+}
+
+static __inline int
+arp_llreach_reachable(struct llinfo_arp *la)
+{
+       struct if_llreach *lr;
+       const char *why = NULL;
+
+       /* Nothing more to do if it's disabled; pretend it's reachable  */
+       if (arp_llreach_base == 0)
+               return (1);
+
+       if ((lr = la->la_llreach) == NULL) {
+               /*
+                * Link-layer reachability record isn't present for this
+                * ARP entry; pretend it's reachable and use it as is.
+                */
+               return (1);
+       } else if (ifnet_llreach_reachable(lr)) {
+               /*
+                * Record is present, it's not shared with other ARP
+                * entries and a packet has recently been received
+                * from the remote host; consider it reachable.
+                */
+               if (lr->lr_reqcnt == 1)
+                       return (1);
+
+               /* Prime it up, if this is the first time */
+               if (la->la_lastused == 0) {
+                       VERIFY(la->la_llreach != NULL);
+                       arp_llreach_use(la);
+               }
+
+               /*
+                * Record is present and shared with one or more ARP
+                * entries, and a packet has recently been received
+                * from the remote host.  Since it's shared by more
+                * than one IP addresses, we can't rely on the link-
+                * layer reachability alone; consider it reachable if
+                * this ARP entry has been used "recently."
+                */
+               if (ifnet_llreach_reachable_delta(lr, la->la_lastused))
+                       return (1);
+
+               why = "has alias(es) and hasn't been used in a while";
+       } else {
+               why = "haven't heard from it in a while";
+       }
+
+       if (log_arp_warnings) {
+               char tmp[MAX_IPv4_STR_LEN];
+               u_int64_t now = net_uptime();
+
+               log(LOG_DEBUG, "%s%d: ARP probe(s) needed for %s; "
+                   "%s [lastused %lld, lastrcvd %lld] secs ago\n",
+                   lr->lr_ifp->if_name, lr->lr_ifp->if_unit, inet_ntop(AF_INET,
+                   &SIN(rt_key(la->la_rt))->sin_addr, tmp, sizeof (tmp)), why,
+                   (la->la_lastused ?  (int64_t)(now - la->la_lastused) : -1),
+                   (lr->lr_lastrcvd ?  (int64_t)(now - lr->lr_lastrcvd) : -1));
+
+       }
+       return (0);
+}
+
+/*
+ * Obtain a link-layer source cache entry for the sender.
+ *
+ * NOTE: This is currently only for ARP/Ethernet.
+ */
+static void
+arp_llreach_alloc(struct rtentry *rt, struct ifnet *ifp, void *addr,
+    unsigned int alen, boolean_t solicited)
+{
+       VERIFY(rt->rt_expire == 0 || rt->rt_rmx.rmx_expire != 0);
+       VERIFY(rt->rt_expire != 0 || rt->rt_rmx.rmx_expire == 0);
+       if (arp_llreach_base != 0 &&
+           rt->rt_expire != 0 && rt->rt_ifp != lo_ifp &&
+           ifp->if_addrlen == IF_LLREACH_MAXLEN &&     /* Ethernet */
+           alen == ifp->if_addrlen) {
+               struct llinfo_arp *la = rt->rt_llinfo;
+               struct if_llreach *lr;
+               const char *why = NULL, *type = "";
+
+               /* Become a regular mutex, just in case */
+               RT_CONVERT_LOCK(rt);
+
+               if ((lr = la->la_llreach) != NULL) {
+                       type = (solicited ? "ARP reply" : "ARP announcement");
+                       /*
+                        * If target has changed, create a new record;
+                        * otherwise keep existing record.
+                        */
+                       IFLR_LOCK(lr);
+                       if (bcmp(addr, lr->lr_key.addr, alen) != 0) {
+                               IFLR_UNLOCK(lr);
+                               /* Purge any link-layer info caching */
+                               VERIFY(rt->rt_llinfo_purge != NULL);
+                               rt->rt_llinfo_purge(rt);
+                               lr = NULL;
+                               why = " for different target HW address; "
+                                   "using new llreach record";
+                       } else {
+                               lr->lr_probes = 0;      /* reset probe count */
+                               IFLR_UNLOCK(lr);
+                               if (solicited) {
+                                       why = " for same target HW address; "
+                                           "keeping existing llreach record";
+                               }
+                       }
+               }
+
+               if (lr == NULL) {
+                       lr = la->la_llreach = ifnet_llreach_alloc(ifp,
+                           ETHERTYPE_IP, addr, alen, arp_llreach_base);
+                       if (lr != NULL) {
+                               lr->lr_probes = 0;      /* reset probe count */
+                               if (why == NULL)
+                                       why = "creating new llreach record";
+                       }
+               }
+
+               if (log_arp_warnings && lr != NULL && why != NULL) {
+                       char tmp[MAX_IPv4_STR_LEN];
+
+                       log(LOG_DEBUG, "%s%d: %s%s for %s\n", ifp->if_name,
+                           ifp->if_unit, type, why, inet_ntop(AF_INET,
+                           &SIN(rt_key(rt))->sin_addr, tmp, sizeof (tmp)));
+               }
+       }
+}
+
 /*
  * Free an arp entry.
  */
@@ -263,6 +500,16 @@ arptfree(struct llinfo_arp *la)
                la->la_asked = 0;
                rt->rt_flags &= ~RTF_REJECT;
                RT_UNLOCK(rt);
+       } else if (la->la_persist) {
+               /*
+                * Instead of issuing RTM_DELETE, stop this route entry
+                * from holding an interface idle reference count; if
+                * the route is later reused, arp_validate() will revert
+                * this action.
+                */
+               if (rt->rt_refcnt == 0)
+                       rt_clear_idleref(rt);
+               RT_UNLOCK(rt);
        } else {
                /*
                 * Safe to drop rt_lock and use rt_key, since holding
@@ -275,30 +522,53 @@ arptfree(struct llinfo_arp *la)
        }
 }
 
-/*
- * Timeout routine.  Age arp_tab entries periodically.
- */
-/* ARGSUSED */
-static void
-arptimer(void *ignored_arg)
+void
+in_arpdrain(void *ignored_arg)
 {
 #pragma unused (ignored_arg)
        struct llinfo_arp *la, *ola;
-       struct timeval timenow;
+       uint64_t timenow;
 
        lck_mtx_lock(rnh_lock);
        la = llinfo_arp.lh_first;
-       getmicrotime(&timenow);
+       timenow = net_uptime();
        while ((ola = la) != 0) {
                struct rtentry *rt = la->la_rt;
                la = la->la_le.le_next;
                RT_LOCK(rt);
-               if (rt->rt_expire && rt->rt_expire <= timenow.tv_sec)
+               VERIFY(rt->rt_expire == 0 || rt->rt_rmx.rmx_expire != 0);
+               VERIFY(rt->rt_expire != 0 || rt->rt_rmx.rmx_expire == 0);
+               if (rt->rt_expire && rt->rt_expire <= timenow)
                        arptfree(ola); /* timer has expired, clear */
                else
                        RT_UNLOCK(rt);
        }
        lck_mtx_unlock(rnh_lock);
+}
+
+void
+arp_validate(struct rtentry *rt)
+{
+       struct llinfo_arp *la = rt->rt_llinfo;
+
+       RT_LOCK_ASSERT_HELD(rt);
+       /*
+        * If this is a persistent ARP entry, make it count towards the
+        * interface idleness just like before arptfree() was called.
+        */
+       if (la->la_persist)
+               rt_set_idleref(rt);
+}
+
+/*
+ * Timeout routine.  Age arp_tab entries periodically.
+ */
+/* ARGSUSED */
+static void
+arptimer(void *ignored_arg)
+{
+#pragma unused (ignored_arg)
+       in_arpdrain(NULL);
        timeout(arptimer, (caddr_t)0, arpt_prune * hz);
 }
 
@@ -314,7 +584,7 @@ arp_rtrequest(
        struct sockaddr *gate = rt->rt_gateway;
        struct llinfo_arp *la = rt->rt_llinfo;
        static struct sockaddr_dl null_sdl = {sizeof(null_sdl), AF_LINK, 0, 0, 0, 0, 0, {0}};
-       struct timeval timenow;
+       uint64_t timenow;
 
        if (!arpinit_done) {
                panic("%s: ARP has not been initialized", __func__);
@@ -325,7 +595,7 @@ arp_rtrequest(
 
        if (rt->rt_flags & RTF_GATEWAY)
                return;
-       getmicrotime(&timenow);
+       timenow = net_uptime();
        switch (req) {
 
        case RTM_ADD:
@@ -334,7 +604,7 @@ arp_rtrequest(
                 * such as older version of routed or gated might provide,
                 * restore cloning bit.
                 */
-               if ((rt->rt_flags & RTF_HOST) == 0 &&
+               if ((rt->rt_flags & RTF_HOST) == 0 && rt_mask(rt) != NULL &&
                    SIN(rt_mask(rt))->sin_addr.s_addr != 0xffffffff)
                        rt->rt_flags |= RTF_CLONING;
                if (rt->rt_flags & RTF_CLONING) {
@@ -350,15 +620,17 @@ arp_rtrequest(
                                 * In case we're called before 1.0 sec.
                                 * has elapsed.
                                 */
-                               rt->rt_expire = MAX(timenow.tv_sec, 1);
+                               rt_setexpire(rt, MAX(timenow, 1));
                        }
                        break;
                }
                /* Announce a new entry if requested. */
                if (rt->rt_flags & RTF_ANNOUNCE) {
+                       if (la != NULL)
+                               arp_llreach_use(la); /* Mark use timestamp */
                        RT_UNLOCK(rt);
                        dlil_send_arp(rt->rt_ifp, ARPOP_REQUEST,
-                           SDL(gate), rt_key(rt), NULL, rt_key(rt));
+                           SDL(gate), rt_key(rt), NULL, rt_key(rt), 0);
                        RT_LOCK(rt);
                }
                /*FALLTHROUGH*/
@@ -383,6 +655,9 @@ arp_rtrequest(
                                log(LOG_DEBUG, "%s: malloc failed\n", __func__);
                        break;
                }
+               rt->rt_llinfo_get_ri = arp_llinfo_get_ri;
+               rt->rt_llinfo_get_iflri = arp_llinfo_get_iflri;
+               rt->rt_llinfo_purge = arp_llinfo_purge;
                rt->rt_llinfo_free = arp_llinfo_free;
 
                arp_inuse++, arp_allocated++;
@@ -394,14 +669,16 @@ arp_rtrequest(
                /*
                 * This keeps the multicast addresses from showing up
                 * in `arp -a' listings as unresolved.  It's not actually
-                * functional.  Then the same for broadcast.
+                * functional.  Then the same for broadcast.  For IPv4
+                * link-local address, keep the entry around even after
+                * it has expired.
                 */
                if (IN_MULTICAST(ntohl(SIN(rt_key(rt))->sin_addr.s_addr))) {
                        RT_UNLOCK(rt);
                        dlil_resolve_multi(rt->rt_ifp, rt_key(rt), gate,
                            sizeof(struct sockaddr_dl));
                        RT_LOCK(rt);
-                       rt->rt_expire = 0;
+                       rt_setexpire(rt, 0);
                }
                else if (in_broadcast(SIN(rt_key(rt))->sin_addr, rt->rt_ifp)) {
                        struct sockaddr_dl      *gate_ll = SDL(gate);
@@ -413,26 +690,60 @@ arp_rtrequest(
                        gate_ll->sdl_family = AF_LINK;
                        gate_ll->sdl_len = sizeof(struct sockaddr_dl);
                        /* In case we're called before 1.0 sec. has elapsed */
-                       rt->rt_expire = MAX(timenow.tv_sec, 1);
+                       rt_setexpire(rt, MAX(timenow, 1));
+               } else if (IN_LINKLOCAL(ntohl(SIN(rt_key(rt))->sin_addr.s_addr))) {
+                       /*
+                        * The persistent bit implies that once the ARP
+                        * entry has reached it expiration time, the idle
+                        * reference count to the interface will be released,
+                        * but the ARP entry itself stays in the routing table
+                        * until it is explicitly removed.
+                        */
+                       la->la_persist = 1;
+                       rt->rt_flags |= RTF_STATIC;
                }
 
+               /* Become a regular mutex, just in case */
+               RT_CONVERT_LOCK(rt);
+               IFA_LOCK_SPIN(rt->rt_ifa);
                if (SIN(rt_key(rt))->sin_addr.s_addr ==
                    (IA_SIN(rt->rt_ifa))->sin_addr.s_addr) {
-                   /*
-                    * This test used to be
-                    *  if (loif.if_flags & IFF_UP)
-                    * It allowed local traffic to be forced
-                    * through the hardware by configuring the loopback down.
-                    * However, it causes problems during network configuration
-                    * for boards that can't receive packets they send.
-                    * It is now necessary to clear "useloopback" and remove
-                    * the route to force traffic out to the hardware.
-                    */
-                       rt->rt_expire = 0;
-                       ifnet_lladdr_copy_bytes(rt->rt_ifp, LLADDR(SDL(gate)), SDL(gate)->sdl_alen = 6);
-                       if (useloopback)
-                               rt->rt_ifp = lo_ifp;
+                       IFA_UNLOCK(rt->rt_ifa);
+                       /*
+                        * This test used to be
+                        *      if (loif.if_flags & IFF_UP)
+                        * It allowed local traffic to be forced through the
+                        * hardware by configuring the loopback down.  However,
+                        * it causes problems during network configuration
+                        * for boards that can't receive packets they send.
+                        * It is now necessary to clear "useloopback" and
+                        * remove the route to force traffic out to the
+                        * hardware.
+                        */
+                       rt_setexpire(rt, 0);
+                       ifnet_lladdr_copy_bytes(rt->rt_ifp, LLADDR(SDL(gate)),
+                           SDL(gate)->sdl_alen = rt->rt_ifp->if_addrlen);
+                       if (useloopback) {
+                               if (rt->rt_ifp != lo_ifp) {
+                                       /*
+                                        * Purge any link-layer info caching.
+                                        */
+                                       if (rt->rt_llinfo_purge != NULL)
+                                               rt->rt_llinfo_purge(rt);
 
+                                       /*
+                                        * Adjust route ref count for the
+                                        * interfaces.
+                                        */
+                                       if (rt->rt_if_ref_fn != NULL) {
+                                               rt->rt_if_ref_fn(lo_ifp, 1);
+                                               rt->rt_if_ref_fn(rt->rt_ifp, -1);
+                                       }
+                               }
+                               rt->rt_ifp = lo_ifp;
+                       }
+               } else {
+                       IFA_UNLOCK(rt->rt_ifa);
                }
                break;
 
@@ -449,10 +760,18 @@ arp_rtrequest(
                LIST_REMOVE(la, la_le);
                la->la_le.le_next = NULL;
                la->la_le.le_prev = NULL;
+
+               /*
+                * Purge any link-layer info caching.
+                */
+               if (rt->rt_llinfo_purge != NULL)
+                       rt->rt_llinfo_purge(rt);
+
                rt->rt_flags &= ~RTF_LLINFO;
-               if (la->la_hold != NULL)
+               if (la->la_hold != NULL) {
                        m_freem(la->la_hold);
-               la->la_hold = NULL;
+                       la->la_hold = NULL;
+               }
        }
 }
 
@@ -501,6 +820,13 @@ arp_lookup_route(const struct in_addr *addr, int create, int proxy,
        sin.sin_addr.s_addr = addr->s_addr;
        sin.sin_other = proxy ? SIN_PROXY : 0;
 
+       /*
+        * If the destination is a link-local address, don't
+        * constrain the lookup (don't scope it).
+        */
+       if (IN_LINKLOCAL(ntohl(addr->s_addr)))
+               ifscope = IFSCOPE_NONE;
+
        rt = rtalloc1_scoped((struct sockaddr*)&sin, create, 0, ifscope);
        if (rt == NULL)
                return (ENETUNREACH);
@@ -559,190 +885,6 @@ arp_lookup_route(const struct in_addr *addr, int create, int proxy,
        return (0);
 }
 
-/*
- * arp_route_to_gateway_route will find the gateway route for a given route.
- *
- * If the route is down, look the route up again.
- * If the route goes through a gateway, get the route to the gateway.
- * If the gateway route is down, look it up again.
- * If the route is set to reject, verify it hasn't expired.
- *
- * If the returned route is non-NULL, the caller is responsible for
- * releasing the reference and unlocking the route.
- */
-#define senderr(e) { error = (e); goto bad; }
-__private_extern__ errno_t
-arp_route_to_gateway_route(const struct sockaddr *net_dest, route_t hint0,
-     route_t *out_route)
-{
-       struct timeval timenow;
-       route_t rt = hint0, hint = hint0;
-       errno_t error = 0;
-
-       *out_route = NULL;
-
-       /*
-        * Next hop determination.  Because we may involve the gateway route
-        * in addition to the original route, locking is rather complicated.
-        * The general concept is that regardless of whether the route points
-        * to the original route or to the gateway route, this routine takes
-        * an extra reference on such a route.  This extra reference will be
-        * released at the end.
-        *
-        * Care must be taken to ensure that the "hint0" route never gets freed
-        * via rtfree(), since the caller may have stored it inside a struct
-        * route with a reference held for that placeholder.
-        */
-       if (rt != NULL) {
-               unsigned int ifindex;
-
-               RT_LOCK_SPIN(rt);
-               ifindex = rt->rt_ifp->if_index;
-               RT_ADDREF_LOCKED(rt);
-               if (!(rt->rt_flags & RTF_UP)) {
-                       RT_REMREF_LOCKED(rt);
-                       RT_UNLOCK(rt);
-                       /* route is down, find a new one */
-                       hint = rt = rtalloc1_scoped((struct sockaddr *)
-                           (size_t)net_dest, 1, 0, ifindex);
-                       if (hint != NULL) {
-                               RT_LOCK_SPIN(rt);
-                               ifindex = rt->rt_ifp->if_index;
-                       } else {
-                               senderr(EHOSTUNREACH);
-                       }
-               }
-
-               /*
-                * We have a reference to "rt" by now; it will either
-                * be released or freed at the end of this routine.
-                */
-               RT_LOCK_ASSERT_HELD(rt);
-               if (rt->rt_flags & RTF_GATEWAY) {
-                       struct rtentry *gwrt = rt->rt_gwroute;
-                       struct sockaddr_in gw;
-
-                       /* If there's no gateway rt, look it up */
-                       if (gwrt == NULL) {
-                               gw = *((struct sockaddr_in *)rt->rt_gateway);
-                               RT_UNLOCK(rt);
-                               goto lookup;
-                       }
-                       /* Become a regular mutex */
-                       RT_CONVERT_LOCK(rt);
-
-                       /*
-                        * Take gwrt's lock while holding route's lock;
-                        * this is okay since gwrt never points back
-                        * to "rt", so no lock ordering issues.
-                        */
-                       RT_LOCK_SPIN(gwrt);
-                       if (!(gwrt->rt_flags & RTF_UP)) {
-                               struct rtentry *ogwrt;
-
-                               rt->rt_gwroute = NULL;
-                               RT_UNLOCK(gwrt);
-                               gw = *((struct sockaddr_in *)rt->rt_gateway);
-                               RT_UNLOCK(rt);
-                               rtfree(gwrt);
-lookup:
-                               gwrt = rtalloc1_scoped(
-                                   (struct sockaddr *)&gw, 1, 0, ifindex);
-
-                               RT_LOCK(rt);
-                               /*
-                                * Bail out if the route is down, no route
-                                * to gateway, circular route, or if the
-                                * gateway portion of "rt" has changed.
-                                */
-                               if (!(rt->rt_flags & RTF_UP) ||
-                                   gwrt == NULL || gwrt == rt ||
-                                   !equal(SA(&gw), rt->rt_gateway)) {
-                                       if (gwrt == rt) {
-                                               RT_REMREF_LOCKED(gwrt);
-                                               gwrt = NULL;
-                                       }
-                                       RT_UNLOCK(rt);
-                                       if (gwrt != NULL)
-                                               rtfree(gwrt);
-                                       senderr(EHOSTUNREACH);
-                               }
-
-                               /* Remove any existing gwrt */
-                               ogwrt = rt->rt_gwroute;
-                               if ((rt->rt_gwroute = gwrt) != NULL)
-                                       RT_ADDREF(gwrt);
-
-                               /* Clean up "rt" now while we can */
-                               if (rt == hint0) {
-                                       RT_REMREF_LOCKED(rt);
-                                       RT_UNLOCK(rt);
-                               } else {
-                                       RT_UNLOCK(rt);
-                                       rtfree(rt);
-                               }
-                               rt = gwrt;
-                               /* Now free the replaced gwrt */
-                               if (ogwrt != NULL)
-                                       rtfree(ogwrt);
-                               /* If still no route to gateway, bail out */
-                               if (rt == NULL)
-                                       senderr(EHOSTUNREACH);
-                       } else {
-                               RT_ADDREF_LOCKED(gwrt);
-                               RT_UNLOCK(gwrt);
-                               /* Clean up "rt" now while we can */
-                               if (rt == hint0) {
-                                       RT_REMREF_LOCKED(rt);
-                                       RT_UNLOCK(rt);
-                               } else {
-                                       RT_UNLOCK(rt);
-                                       rtfree(rt);
-                               }
-                               rt = gwrt;
-                       }
-
-                       /* rt == gwrt; if it is now down, give up */
-                       RT_LOCK_SPIN(rt);
-                       if (!(rt->rt_flags & RTF_UP)) {
-                               RT_UNLOCK(rt);
-                               senderr(EHOSTUNREACH);
-                       }
-               }
-
-               if (rt->rt_flags & RTF_REJECT) {
-                       getmicrotime(&timenow);
-                       if (rt->rt_rmx.rmx_expire == 0 ||
-                           timenow.tv_sec < rt->rt_rmx.rmx_expire) {
-                               RT_UNLOCK(rt);
-                               senderr(rt == hint ? EHOSTDOWN : EHOSTUNREACH);
-                       }
-               }
-
-               /* Become a regular mutex */
-               RT_CONVERT_LOCK(rt);
-
-               /* Caller is responsible for cleaning up "rt" */
-               *out_route = rt;
-       }
-       return (0);
-
-bad:
-       /* Clean up route (either it is "rt" or "gwrt") */
-       if (rt != NULL) {
-               RT_LOCK_SPIN(rt);
-               if (rt == hint0) {
-                       RT_REMREF_LOCKED(rt);
-                       RT_UNLOCK(rt);
-               } else {
-                       RT_UNLOCK(rt);
-                       rtfree(rt);
-               }
-       }
-       return (error);
-}
-#undef senderr
-
 /*
  * This is the ARP pre-output routine; care must be taken to ensure that
  * the "hint" route never gets freed via rtfree(), since the caller may
@@ -757,8 +899,9 @@ arp_lookup_ip(ifnet_t ifp, const struct sockaddr_in *net_dest,
        route_t route = NULL;   /* output route */
        errno_t result = 0;
        struct sockaddr_dl      *gateway;
-       struct llinfo_arp       *llinfo;
-       struct timeval timenow;
+       struct llinfo_arp       *llinfo = NULL;
+       uint64_t timenow;
+       int unreachable = 0;
 
        if (net_dest->sin_family != AF_INET)
                return (EAFNOSUPPORT);
@@ -774,7 +917,7 @@ arp_lookup_ip(ifnet_t ifp, const struct sockaddr_in *net_dest,
                 * Callee holds a reference on the route and returns
                 * with the route entry locked, upon success.
                 */
-               result = arp_route_to_gateway_route((const struct sockaddr*)
+               result = route_to_gwroute((const struct sockaddr *)
                    net_dest, hint, &route);
                if (result != 0)
                        return (result);
@@ -832,7 +975,7 @@ arp_lookup_ip(ifnet_t ifp, const struct sockaddr_in *net_dest,
                        RT_LOCK_ASSERT_HELD(route);
        }
 
-       if (result || route == NULL || route->rt_llinfo == NULL) {
+       if (result || route == NULL || (llinfo = route->rt_llinfo) == NULL) {
                char    tmp[MAX_IPv4_STR_LEN];
 
                /* In case result is 0 but no route, return an error */
@@ -851,13 +994,22 @@ arp_lookup_ip(ifnet_t ifp, const struct sockaddr_in *net_dest,
         * Now that we have the right route, is it filled in?
         */
        gateway = SDL(route->rt_gateway);
-       getmicrotime(&timenow);
-       if ((route->rt_rmx.rmx_expire == 0 ||
-           route->rt_rmx.rmx_expire > timenow.tv_sec) && gateway != NULL &&
-           gateway->sdl_family == AF_LINK && gateway->sdl_alen != 0) {
+       timenow = net_uptime();
+       VERIFY(route->rt_expire == 0 || route->rt_rmx.rmx_expire != 0);
+       VERIFY(route->rt_expire != 0 || route->rt_rmx.rmx_expire == 0);
+       if ((route->rt_expire == 0 ||
+           route->rt_expire > timenow) && gateway != NULL &&
+           gateway->sdl_family == AF_LINK && gateway->sdl_alen != 0 &&
+           !(unreachable = !arp_llreach_reachable(llinfo))) {
                bcopy(gateway, ll_dest, MIN(gateway->sdl_len, ll_dest_len));
                result = 0;
+               arp_llreach_use(llinfo);        /* Mark use timestamp */
                goto release;
+       } else if (unreachable) {
+               /*
+                * Discard existing answer in case we need to probe.
+                */
+               gateway->sdl_alen = 0;
        }
 
        if (ifp->if_flags & IFF_NOARP) {
@@ -868,33 +1020,54 @@ arp_lookup_ip(ifnet_t ifp, const struct sockaddr_in *net_dest,
        /*
         * Route wasn't complete/valid. We need to arp.
         */
-       llinfo = route->rt_llinfo;
        if (packet != NULL) {
                if (llinfo->la_hold != NULL)
                        m_freem(llinfo->la_hold);
                llinfo->la_hold = packet;
        }
 
-       if (route->rt_rmx.rmx_expire) {
+       if (route->rt_expire) {
                route->rt_flags &= ~RTF_REJECT;
                if (llinfo->la_asked == 0 ||
-                   route->rt_rmx.rmx_expire != timenow.tv_sec) {
-                       route->rt_rmx.rmx_expire = timenow.tv_sec;
+                   route->rt_expire != timenow) {
+                       rt_setexpire(route, timenow);
                        if (llinfo->la_asked++ < arp_maxtries) {
                                struct ifaddr *rt_ifa = route->rt_ifa;
-                               ifaref(rt_ifa);
+                               struct sockaddr *sa;
+                               u_int32_t rtflags;
+
+                               /* Become a regular mutex, just in case */
+                               RT_CONVERT_LOCK(route);
+                               /* Update probe count, if applicable */
+                               if (llinfo->la_llreach != NULL) {
+                                       IFLR_LOCK_SPIN(llinfo->la_llreach);
+                                       llinfo->la_llreach->lr_probes++;
+                                       IFLR_UNLOCK(llinfo->la_llreach);
+                               }
+                               IFA_LOCK_SPIN(rt_ifa);
+                               IFA_ADDREF_LOCKED(rt_ifa);
+                               sa = rt_ifa->ifa_addr;
+                               IFA_UNLOCK(rt_ifa);
+                               arp_llreach_use(llinfo); /* Mark use timestamp */
+                               rtflags = route->rt_flags;
                                RT_UNLOCK(route);
                                dlil_send_arp(ifp, ARPOP_REQUEST, NULL,
-                                   rt_ifa->ifa_addr, NULL,
-                                   (const struct sockaddr*)net_dest);
-                               ifafree(rt_ifa);
+                                   sa, NULL, (const struct sockaddr*)net_dest,
+                                   rtflags);
+                               IFA_REMREF(rt_ifa);
                                RT_LOCK(route);
                                result = EJUSTRETURN;
                                goto release;
                        } else {
                                route->rt_flags |= RTF_REJECT;
-                               route->rt_rmx.rmx_expire += arpt_down;
+                               rt_setexpire(route, rt_expiry(route,
+                                   route->rt_expire, arpt_down));
                                llinfo->la_asked = 0;
+                               /*
+                                * Clear la_hold; don't free the packet since
+                                * we're not returning EJUSTRETURN; the caller
+                                * will handle the freeing.
+                                */
                                llinfo->la_hold = NULL;
                                result = EHOSTUNREACH;
                                goto release;
@@ -932,40 +1105,85 @@ arp_ip_handle_input(
        struct ifaddr *ifa;
        struct in_ifaddr *ia;
        struct in_ifaddr *best_ia = NULL;
+       struct sockaddr_in best_ia_sin;
        route_t route = NULL;
        char buf[3 * MAX_HW_LEN]; // enough for MAX_HW_LEN byte hw address
        struct llinfo_arp *llinfo;
        errno_t error;
        int created_announcement = 0;
+       int bridged = 0, is_bridge = 0;
 
        /* Do not respond to requests for 0.0.0.0 */
        if (target_ip->sin_addr.s_addr == 0 && arpop == ARPOP_REQUEST)
                goto done;
 
+       if (ifp->if_bridge)
+               bridged = 1;
+       if (ifp->if_type == IFT_BRIDGE)
+               is_bridge = 1;
+
        /*
         * Determine if this ARP is for us
+        * For a bridge, we want to check the address irrespective
+        * of the receive interface.
         */
        lck_rw_lock_shared(in_ifaddr_rwlock);
        TAILQ_FOREACH(ia, INADDR_HASH(target_ip->sin_addr.s_addr), ia_hash) {
-               /* do_bridge should be tested here for bridging */
-               if (ia->ia_ifp == ifp &&
+               IFA_LOCK_SPIN(&ia->ia_ifa);
+               if (((bridged && ia->ia_ifp->if_bridge != NULL) ||
+                   (ia->ia_ifp == ifp)) &&
                    ia->ia_addr.sin_addr.s_addr == target_ip->sin_addr.s_addr) {
                        best_ia = ia;
-                       ifaref(&best_ia->ia_ifa);
+                       best_ia_sin = best_ia->ia_addr;
+                       IFA_ADDREF_LOCKED(&ia->ia_ifa);
+                       IFA_UNLOCK(&ia->ia_ifa);
                        lck_rw_done(in_ifaddr_rwlock);
                        goto match;
                }
+               IFA_UNLOCK(&ia->ia_ifa);
        }
 
        TAILQ_FOREACH(ia, INADDR_HASH(sender_ip->sin_addr.s_addr), ia_hash) {
-               /* do_bridge should be tested here for bridging */
-               if (ia->ia_ifp == ifp &&
+               IFA_LOCK_SPIN(&ia->ia_ifa);
+               if (((bridged && ia->ia_ifp->if_bridge != NULL) ||
+                   (ia->ia_ifp == ifp)) &&
                    ia->ia_addr.sin_addr.s_addr == sender_ip->sin_addr.s_addr) {
                        best_ia = ia;
-                       ifaref(&best_ia->ia_ifa);
+                       best_ia_sin = best_ia->ia_addr;
+                       IFA_ADDREF_LOCKED(&ia->ia_ifa);
+                       IFA_UNLOCK(&ia->ia_ifa);
                        lck_rw_done(in_ifaddr_rwlock);
                        goto match;
                }
+               IFA_UNLOCK(&ia->ia_ifa);
+       }
+
+#define BDG_MEMBER_MATCHES_ARP(addr, ifp, ia)                                  \
+       (ia->ia_ifp->if_bridge == ifp->if_softc &&                              \
+       !bcmp(ifnet_lladdr(ia->ia_ifp), ifnet_lladdr(ifp), ifp->if_addrlen) &&  \
+       addr == ia->ia_addr.sin_addr.s_addr)
+       /*
+        * Check the case when bridge shares its MAC address with
+        * some of its children, so packets are claimed by bridge
+        * itself (bridge_input() does it first), but they are really
+        * meant to be destined to the bridge member.
+        */
+       if (is_bridge) {
+               TAILQ_FOREACH(ia, INADDR_HASH(target_ip->sin_addr.s_addr),
+                   ia_hash) {
+                       IFA_LOCK_SPIN(&ia->ia_ifa);
+                       if (BDG_MEMBER_MATCHES_ARP(target_ip->sin_addr.s_addr,
+                           ifp, ia)) {
+                               ifp = ia->ia_ifp;
+                               best_ia = ia;
+                               best_ia_sin = best_ia->ia_addr;
+                               IFA_ADDREF_LOCKED(&ia->ia_ifa);
+                               IFA_UNLOCK(&ia->ia_ifa);
+                               lck_rw_done(in_ifaddr_rwlock);
+                               goto match;
+                       }
+                       IFA_UNLOCK(&ia->ia_ifa);
+               }
        }
        lck_rw_done(in_ifaddr_rwlock);
 
@@ -976,30 +1194,41 @@ arp_ip_handle_input(
         */
        ifnet_lock_shared(ifp);
        TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
-               if (ifa->ifa_addr->sa_family != AF_INET)
+               IFA_LOCK_SPIN(ifa);
+               if (ifa->ifa_addr->sa_family != AF_INET) {
+                       IFA_UNLOCK(ifa);
                        continue;
+               }
                best_ia = (struct in_ifaddr *)ifa;
-               ifaref(&best_ia->ia_ifa);
-               break;
+               best_ia_sin = best_ia->ia_addr;
+               IFA_ADDREF_LOCKED(ifa);
+               IFA_UNLOCK(ifa);
+               ifnet_lock_done(ifp);
+               goto match;
        }
        ifnet_lock_done(ifp);
 
-       /* If we don't have an IP address on this interface, ignore the packet */
-       if (best_ia == NULL)
+       /*
+        * If we're not a bridge member, or if we are but there's no
+        * IPv4 address to use for the interface, drop the packet.
+        */
+       if (!bridged || best_ia == NULL)
                goto done;
 
 match:
        /* If the packet is from this interface, ignore the packet */
-       if (!bcmp(CONST_LLADDR(sender_hw), ifnet_lladdr(ifp), sender_hw->sdl_len)) {
+       if (!bcmp(CONST_LLADDR(sender_hw), ifnet_lladdr(ifp), sender_hw->sdl_alen)) {
                goto done;
        }
 
        /* Check for a conflict */
-       if (sender_ip->sin_addr.s_addr == best_ia->ia_addr.sin_addr.s_addr) {
+       if (!bridged && sender_ip->sin_addr.s_addr == best_ia_sin.sin_addr.s_addr) {
                struct kev_msg        ev_msg;
                struct kev_in_collision *in_collision;
                u_char  storage[sizeof(struct kev_in_collision) + MAX_HW_LEN];
-               in_collision = (struct kev_in_collision*)storage;
+               bzero(&ev_msg, sizeof(struct kev_msg));
+               bzero(storage, (sizeof(struct kev_in_collision) + MAX_HW_LEN));
+               in_collision = (struct kev_in_collision*)(void *)storage;
                log(LOG_ERR, "%s%d duplicate IP address %s sent from address %s\n",
                        ifp->if_name, ifp->if_unit,
                        inet_ntop(AF_INET, &sender_ip->sin_addr, ipv4str, sizeof(ipv4str)),
@@ -1031,7 +1260,7 @@ match:
         * entry locked, upon success.
         */
        error = arp_lookup_route(&sender_ip->sin_addr,
-           (target_ip->sin_addr.s_addr == best_ia->ia_addr.sin_addr.s_addr &&
+           (target_ip->sin_addr.s_addr == best_ia_sin.sin_addr.s_addr &&
            sender_ip->sin_addr.s_addr != 0), 0, &route, ifp->if_index);
 
        if (error == 0)
@@ -1090,6 +1319,9 @@ match:
                                                sdl_addr_to_hex(sender_hw, buf, sizeof(buf)),
                                                ifp->if_name, ifp->if_unit);
                                        }
+                                       /* Mark use timestamp */
+                                       if (route->rt_llinfo != NULL)
+                                               arp_llreach_use(route->rt_llinfo);
                                        /* We're done with the route */
                                        RT_REMREF_LOCKED(route);
                                        RT_UNLOCK(route);
@@ -1100,21 +1332,19 @@ match:
                                         * This will not force the device to pick a new number if the device
                                         * has already assigned that number.
                                         * This will not imply to the device that we own that address.
+                                        * The link address is always present; it's never freed.
                                         */
                                        ifnet_lock_shared(ifp);
-                                       ifa = TAILQ_FIRST(&ifp->if_addrhead);
-                                       if (ifa != NULL)
-                                               ifaref(ifa);
+                                       ifa = ifp->if_lladdr;
+                                       IFA_ADDREF(ifa);
                                        ifnet_lock_done(ifp);
                                        dlil_send_arp_internal(ifp, ARPOP_REQUEST,
-                                               ifa != NULL ? SDL(ifa->ifa_addr) : NULL,
+                                               SDL(ifa->ifa_addr),
                                                (const struct sockaddr*)sender_ip, sender_hw,
                                                (const struct sockaddr*)target_ip);
-                                       if (ifa != NULL) {
-                                               ifafree(ifa);
-                                               ifa = NULL;
-                                       }
-                               }
+                                       IFA_REMREF(ifa);
+                                       ifa = NULL;
+                               }
                        }
                        goto respond;
                } else if (keep_announcements != 0
@@ -1151,8 +1381,10 @@ match:
        }
 
        RT_LOCK_ASSERT_HELD(route);
+       VERIFY(route->rt_expire == 0 || route->rt_rmx.rmx_expire != 0);
+       VERIFY(route->rt_expire != 0 || route->rt_rmx.rmx_expire == 0);
        gateway = SDL(route->rt_gateway);
-       if (route->rt_ifp != ifp) {
+       if (!bridged && route->rt_ifp != ifp) {
                if (!IN_LINKLOCAL(ntohl(sender_ip->sin_addr.s_addr)) || (ifp->if_eflags & IFEF_ARPLL) == 0) {
                        if (log_arp_warnings)
                                log(LOG_ERR, "arp: %s is on %s%d but got reply from %s on %s%d\n",
@@ -1166,7 +1398,7 @@ match:
                }
                else {
                        /* Don't change a permanent address */
-                       if (route->rt_rmx.rmx_expire == 0) {
+                       if (route->rt_expire == 0) {
                                goto respond;
                        }
 
@@ -1197,6 +1429,19 @@ match:
                                lck_mtx_unlock(rnh_lock);
                                goto respond;
                        }
+                       if (route->rt_ifp != ifp) {
+                               /*
+                                * Purge any link-layer info caching.
+                                */
+                               if (route->rt_llinfo_purge != NULL)
+                                       route->rt_llinfo_purge(route);
+
+                               /* Adjust route ref count for the interfaces */
+                               if (route->rt_if_ref_fn != NULL) {
+                                       route->rt_if_ref_fn(ifp, 1);
+                                       route->rt_if_ref_fn(route->rt_ifp, -1);
+                               }
+                       }
                        /* Change the interface when the existing route is on */
                        route->rt_ifp = ifp;
                        rtsetifa(route, &best_ia->ia_ifa);
@@ -1214,7 +1459,7 @@ match:
        }
 
        if (gateway->sdl_alen && bcmp(LLADDR(gateway), CONST_LLADDR(sender_hw), gateway->sdl_alen)) {
-               if (route->rt_rmx.rmx_expire && log_arp_warnings) {
+               if (route->rt_expire && log_arp_warnings) {
                        char buf2[3 * MAX_HW_LEN];
                        log(LOG_INFO, "arp: %s moved from %s to %s on %s%d\n",
                            inet_ntop(AF_INET, &sender_ip->sin_addr, ipv4str,
@@ -1223,7 +1468,7 @@ match:
                            sdl_addr_to_hex(sender_hw, buf2, sizeof(buf2)),
                            ifp->if_name, ifp->if_unit);
                }
-               else if (route->rt_rmx.rmx_expire == 0) {
+               else if (route->rt_expire == 0) {
                        if (log_arp_warnings) {
                                log(LOG_ERR, "arp: %s attempts to modify "
                                    "permanent entry for %s on %s%d\n",
@@ -1242,30 +1487,38 @@ match:
        bcopy(CONST_LLADDR(sender_hw), LLADDR(gateway), gateway->sdl_alen);
 
        /* Update the expire time for the route and clear the reject flag */
-       if (route->rt_rmx.rmx_expire) {
-               struct timeval timenow;
+       if (route->rt_expire) {
+               uint64_t timenow;
 
-               getmicrotime(&timenow);
-               route->rt_rmx.rmx_expire = timenow.tv_sec + arpt_keep;
+               timenow = net_uptime();
+               rt_setexpire(route,
+                   rt_expiry(route, timenow, arpt_keep));
        }
        route->rt_flags &= ~RTF_REJECT;
 
+       /* cache the gateway (sender HW) address */
+       arp_llreach_alloc(route, ifp, LLADDR(gateway), gateway->sdl_alen,
+           (arpop == ARPOP_REPLY));
+
        /* update the llinfo, send a queued packet if there is one */
        llinfo = route->rt_llinfo;
        llinfo->la_asked = 0;
        if (llinfo->la_hold) {
                struct mbuf *m0;
                m0 = llinfo->la_hold;
-               llinfo->la_hold = 0;
+               llinfo->la_hold = NULL;
 
                RT_UNLOCK(route);
-               dlil_output(ifp, PF_INET, m0, (caddr_t)route, rt_key(route), 0);
+               dlil_output(ifp, PF_INET, m0, (caddr_t)route, rt_key(route), 0, NULL);
                RT_REMREF(route);
                route = NULL;
        }
 
 respond:
        if (route != NULL) {
+               /* Mark use timestamp if we're going to send a reply */
+               if (arpop == ARPOP_REQUEST && route->rt_llinfo != NULL)
+                       arp_llreach_use(route->rt_llinfo);
                RT_REMREF_LOCKED(route);
                RT_UNLOCK(route);
                route = NULL;
@@ -1275,7 +1528,7 @@ respond:
                goto done;
 
        /* If we are not the target, check if we should proxy */
-       if (target_ip->sin_addr.s_addr != best_ia->ia_addr.sin_addr.s_addr) {
+       if (target_ip->sin_addr.s_addr != best_ia_sin.sin_addr.s_addr) {
                /*
                 * Find a proxy route; callee holds a reference on the
                 * route and returns with the route entry locked, upon
@@ -1286,6 +1539,19 @@ respond:
 
                if (error == 0) {
                        RT_LOCK_ASSERT_HELD(route);
+                       /*
+                        * Return proxied ARP replies only on the interface
+                        * or bridge cluster where this network resides.
+                        * Otherwise we may conflict with the host we are
+                        * proxying for.
+                        */
+                       if (route->rt_ifp != ifp &&
+                               (route->rt_ifp->if_bridge != ifp->if_bridge ||
+                                ifp->if_bridge == NULL)) {
+                                       RT_REMREF_LOCKED(route);
+                                       RT_UNLOCK(route);
+                                       goto done;
+                               }
                        proxied = *SDL(route->rt_gateway);
                        target_hw = &proxied;
                } else {
@@ -1316,26 +1582,32 @@ respond:
                                goto done;
                        }
                }
+               /* Mark use timestamp */
+               if (route->rt_llinfo != NULL)
+                       arp_llreach_use(route->rt_llinfo);
                RT_REMREF_LOCKED(route);
                RT_UNLOCK(route);
        }
 
        dlil_send_arp(ifp, ARPOP_REPLY,
            target_hw, (const struct sockaddr*)target_ip,
-           sender_hw, (const struct sockaddr*)sender_ip);
+           sender_hw, (const struct sockaddr*)sender_ip, 0);
 
 done:
        if (best_ia != NULL)
-               ifafree(&best_ia->ia_ifa);
+               IFA_REMREF(&best_ia->ia_ifa);
        return 0;
 }
 
 void
-arp_ifinit(
-       struct ifnet *ifp,
-       struct ifaddr *ifa)
+arp_ifinit(struct ifnet *ifp, struct ifaddr *ifa)
 {
+       struct sockaddr *sa;
+
+       IFA_LOCK(ifa);
        ifa->ifa_rtrequest = arp_rtrequest;
        ifa->ifa_flags |= RTF_CLONING;
-       dlil_send_arp(ifp, ARPOP_REQUEST, NULL, ifa->ifa_addr, NULL, ifa->ifa_addr);
+       sa = ifa->ifa_addr;
+       IFA_UNLOCK(ifa);
+       dlil_send_arp(ifp, ARPOP_REQUEST, NULL, sa, NULL, sa, 0);
 }