ip_forward() looked the route up with NHR_REF and released the nexthop
on each early exit: blackhole and reject routes, and packets that IPsec
consumed. ip_forward() runs in the network epoch, which keeps the
nexthop valid without a reference, as ip_tryforward() already relies
on.
Look the nexthop up without a reference and take one right before
ip_output(), which may release and replace the route it is given. The
packets that are dropped or leave through IPsec no longer write to the
nexthop reference count, which every CPU forwarding to that nexthop
shares. If the nexthop is being destroyed by then, ip_output() gets an
empty route and does its own lookup.
No functional change intended.
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")