xref: /freebsd/sys/netinet/ip_output.c (revision 09e8dea79366f1e5b3a73e8a271b26e4b6bf2e6a)
1 /*
2  * Copyright (c) 1982, 1986, 1988, 1990, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. All advertising materials mentioning features or use of this software
14  *    must display the following acknowledgement:
15  *	This product includes software developed by the University of
16  *	California, Berkeley and its contributors.
17  * 4. Neither the name of the University nor the names of its contributors
18  *    may be used to endorse or promote products derived from this software
19  *    without specific prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  *	@(#)ip_output.c	8.3 (Berkeley) 1/21/94
34  * $FreeBSD$
35  */
36 
37 #define _IP_VHL
38 
39 #include "opt_ipfw.h"
40 #include "opt_ipdn.h"
41 #include "opt_ipdivert.h"
42 #include "opt_ipfilter.h"
43 #include "opt_ipsec.h"
44 #include "opt_pfil_hooks.h"
45 #include "opt_random_ip_id.h"
46 
47 #include <sys/param.h>
48 #include <sys/systm.h>
49 #include <sys/kernel.h>
50 #include <sys/malloc.h>
51 #include <sys/mbuf.h>
52 #include <sys/protosw.h>
53 #include <sys/socket.h>
54 #include <sys/socketvar.h>
55 
56 #include <net/if.h>
57 #include <net/route.h>
58 
59 #include <netinet/in.h>
60 #include <netinet/in_systm.h>
61 #include <netinet/ip.h>
62 #include <netinet/in_pcb.h>
63 #include <netinet/in_var.h>
64 #include <netinet/ip_var.h>
65 
66 #include <machine/in_cksum.h>
67 
68 static MALLOC_DEFINE(M_IPMOPTS, "ip_moptions", "internet multicast options");
69 
70 #ifdef IPSEC
71 #include <netinet6/ipsec.h>
72 #include <netkey/key.h>
73 #ifdef IPSEC_DEBUG
74 #include <netkey/key_debug.h>
75 #else
76 #define	KEYDEBUG(lev,arg)
77 #endif
78 #endif /*IPSEC*/
79 
80 #include <netinet/ip_fw.h>
81 #include <netinet/ip_dummynet.h>
82 
83 #define print_ip(x, a, y)	 printf("%s %d.%d.%d.%d%s",\
84 				x, (ntohl(a.s_addr)>>24)&0xFF,\
85 				  (ntohl(a.s_addr)>>16)&0xFF,\
86 				  (ntohl(a.s_addr)>>8)&0xFF,\
87 				  (ntohl(a.s_addr))&0xFF, y);
88 
89 u_short ip_id;
90 
91 static struct mbuf *ip_insertoptions(struct mbuf *, struct mbuf *, int *);
92 static struct ifnet *ip_multicast_if(struct in_addr *, int *);
93 static void	ip_mloopback
94 	(struct ifnet *, struct mbuf *, struct sockaddr_in *, int);
95 static int	ip_getmoptions
96 	(struct sockopt *, struct ip_moptions *);
97 static int	ip_pcbopts(int, struct mbuf **, struct mbuf *);
98 static int	ip_setmoptions
99 	(struct sockopt *, struct ip_moptions **);
100 
101 int	ip_optcopy(struct ip *, struct ip *);
102 
103 
104 extern	struct protosw inetsw[];
105 
106 /*
107  * IP output.  The packet in mbuf chain m contains a skeletal IP
108  * header (with len, off, ttl, proto, tos, src, dst).
109  * The mbuf chain containing the packet will be freed.
110  * The mbuf opt, if present, will not be freed.
111  */
112 int
113 ip_output(m0, opt, ro, flags, imo)
114 	struct mbuf *m0;
115 	struct mbuf *opt;
116 	struct route *ro;
117 	int flags;
118 	struct ip_moptions *imo;
119 {
120 	struct ip *ip, *mhip;
121 	struct ifnet *ifp = NULL;	/* keep compiler happy */
122 	struct mbuf *m;
123 	int hlen = sizeof (struct ip);
124 	int len, off, error = 0;
125 	struct sockaddr_in *dst = NULL;	/* keep compiler happy */
126 	struct in_ifaddr *ia;
127 	int isbroadcast, sw_csum;
128 	struct in_addr pkt_dst;
129 #ifdef IPSEC
130 	struct route iproute;
131 	struct socket *so = NULL;
132 	struct secpolicy *sp = NULL;
133 #endif
134 	struct ip_fw_args args;
135 	int src_was_INADDR_ANY = 0;	/* as the name says... */
136 #ifdef PFIL_HOOKS
137 	struct packet_filter_hook *pfh;
138 	struct mbuf *m1;
139 	int rv;
140 #endif /* PFIL_HOOKS */
141 
142 	args.eh = NULL;
143 	args.rule = NULL;
144 	args.next_hop = NULL;
145 	args.divert_rule = 0;			/* divert cookie */
146 
147 	/* Grab info from MT_TAG mbufs prepended to the chain. */
148 	for (; m0 && m0->m_type == MT_TAG; m0 = m0->m_next) {
149 		switch(m0->m_tag_id) {
150 		default:
151 			printf("ip_output: unrecognised MT_TAG tag %d\n",
152 			    m0->m_tag_id);
153 			break;
154 
155 		case PACKET_TAG_DUMMYNET:
156 			/*
157 			 * the packet was already tagged, so part of the
158 			 * processing was already done, and we need to go down.
159 			 * Get parameters from the header.
160 			 */
161 			args.rule = ((struct dn_pkt *)m0)->rule;
162 			opt = NULL ;
163 			ro = & ( ((struct dn_pkt *)m0)->ro ) ;
164 			imo = NULL ;
165 			dst = ((struct dn_pkt *)m0)->dn_dst ;
166 			ifp = ((struct dn_pkt *)m0)->ifp ;
167 			flags = ((struct dn_pkt *)m0)->flags ;
168 			break;
169 
170 		case PACKET_TAG_DIVERT:
171 			args.divert_rule = (int)m0->m_data & 0xffff;
172 			break;
173 
174 		case PACKET_TAG_IPFORWARD:
175 			args.next_hop = (struct sockaddr_in *)m0->m_data;
176 			break;
177 		}
178 	}
179 	m = m0;
180 
181 	KASSERT(!m || (m->m_flags & M_PKTHDR) != 0, ("ip_output: no HDR"));
182 
183 	KASSERT(ro != NULL, ("ip_output: no route, proto %d",
184 	    mtod(m, struct ip *)->ip_p));
185 
186 #ifdef IPSEC
187 	so = ipsec_getsocket(m);
188 	(void)ipsec_setsocket(m, NULL);
189 #endif
190 	if (args.rule != NULL) {	/* dummynet already saw us */
191 		ip = mtod(m, struct ip *);
192 		hlen = IP_VHL_HL(ip->ip_vhl) << 2 ;
193 		ia = ifatoia(ro->ro_rt->rt_ifa);
194 		goto sendit;
195 	}
196 
197 	if (opt) {
198 		m = ip_insertoptions(m, opt, &len);
199 		hlen = len;
200 	}
201 	ip = mtod(m, struct ip *);
202 	pkt_dst = args.next_hop ? args.next_hop->sin_addr : ip->ip_dst;
203 
204 	/*
205 	 * Fill in IP header.
206 	 */
207 	if ((flags & (IP_FORWARDING|IP_RAWOUTPUT)) == 0) {
208 		ip->ip_vhl = IP_MAKE_VHL(IPVERSION, hlen >> 2);
209 		ip->ip_off &= IP_DF;
210 #ifdef RANDOM_IP_ID
211 		ip->ip_id = ip_randomid();
212 #else
213 		ip->ip_id = htons(ip_id++);
214 #endif
215 		ipstat.ips_localout++;
216 	} else {
217 		hlen = IP_VHL_HL(ip->ip_vhl) << 2;
218 	}
219 
220 	dst = (struct sockaddr_in *)&ro->ro_dst;
221 	/*
222 	 * If there is a cached route,
223 	 * check that it is to the same destination
224 	 * and is still up.  If not, free it and try again.
225 	 * The address family should also be checked in case of sharing the
226 	 * cache with IPv6.
227 	 */
228 	if (ro->ro_rt && ((ro->ro_rt->rt_flags & RTF_UP) == 0 ||
229 			  dst->sin_family != AF_INET ||
230 			  dst->sin_addr.s_addr != pkt_dst.s_addr)) {
231 		RTFREE(ro->ro_rt);
232 		ro->ro_rt = (struct rtentry *)0;
233 	}
234 	if (ro->ro_rt == 0) {
235 		bzero(dst, sizeof(*dst));
236 		dst->sin_family = AF_INET;
237 		dst->sin_len = sizeof(*dst);
238 		dst->sin_addr = pkt_dst;
239 	}
240 	/*
241 	 * If routing to interface only,
242 	 * short circuit routing lookup.
243 	 */
244 	if (flags & IP_ROUTETOIF) {
245 		if ((ia = ifatoia(ifa_ifwithdstaddr(sintosa(dst)))) == 0 &&
246 		    (ia = ifatoia(ifa_ifwithnet(sintosa(dst)))) == 0) {
247 			ipstat.ips_noroute++;
248 			error = ENETUNREACH;
249 			goto bad;
250 		}
251 		ifp = ia->ia_ifp;
252 		ip->ip_ttl = 1;
253 		isbroadcast = in_broadcast(dst->sin_addr, ifp);
254 	} else if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) &&
255 	    imo != NULL && imo->imo_multicast_ifp != NULL) {
256 		/*
257 		 * Bypass the normal routing lookup for multicast
258 		 * packets if the interface is specified.
259 		 */
260 		ifp = imo->imo_multicast_ifp;
261 		IFP_TO_IA(ifp, ia);
262 		isbroadcast = 0;	/* fool gcc */
263 	} else {
264 		/*
265 		 * If this is the case, we probably don't want to allocate
266 		 * a protocol-cloned route since we didn't get one from the
267 		 * ULP.  This lets TCP do its thing, while not burdening
268 		 * forwarding or ICMP with the overhead of cloning a route.
269 		 * Of course, we still want to do any cloning requested by
270 		 * the link layer, as this is probably required in all cases
271 		 * for correct operation (as it is for ARP).
272 		 */
273 		if (ro->ro_rt == 0)
274 			rtalloc_ign(ro, RTF_PRCLONING);
275 		if (ro->ro_rt == 0) {
276 			ipstat.ips_noroute++;
277 			error = EHOSTUNREACH;
278 			goto bad;
279 		}
280 		ia = ifatoia(ro->ro_rt->rt_ifa);
281 		ifp = ro->ro_rt->rt_ifp;
282 		ro->ro_rt->rt_use++;
283 		if (ro->ro_rt->rt_flags & RTF_GATEWAY)
284 			dst = (struct sockaddr_in *)ro->ro_rt->rt_gateway;
285 		if (ro->ro_rt->rt_flags & RTF_HOST)
286 			isbroadcast = (ro->ro_rt->rt_flags & RTF_BROADCAST);
287 		else
288 			isbroadcast = in_broadcast(dst->sin_addr, ifp);
289 	}
290 	if (IN_MULTICAST(ntohl(pkt_dst.s_addr))) {
291 		struct in_multi *inm;
292 
293 		m->m_flags |= M_MCAST;
294 		/*
295 		 * IP destination address is multicast.  Make sure "dst"
296 		 * still points to the address in "ro".  (It may have been
297 		 * changed to point to a gateway address, above.)
298 		 */
299 		dst = (struct sockaddr_in *)&ro->ro_dst;
300 		/*
301 		 * See if the caller provided any multicast options
302 		 */
303 		if (imo != NULL) {
304 			ip->ip_ttl = imo->imo_multicast_ttl;
305 			if (imo->imo_multicast_vif != -1)
306 				ip->ip_src.s_addr =
307 				    ip_mcast_src(imo->imo_multicast_vif);
308 		} else
309 			ip->ip_ttl = IP_DEFAULT_MULTICAST_TTL;
310 		/*
311 		 * Confirm that the outgoing interface supports multicast.
312 		 */
313 		if ((imo == NULL) || (imo->imo_multicast_vif == -1)) {
314 			if ((ifp->if_flags & IFF_MULTICAST) == 0) {
315 				ipstat.ips_noroute++;
316 				error = ENETUNREACH;
317 				goto bad;
318 			}
319 		}
320 		/*
321 		 * If source address not specified yet, use address
322 		 * of outgoing interface.
323 		 */
324 		if (ip->ip_src.s_addr == INADDR_ANY) {
325 			/* Interface may have no addresses. */
326 			if (ia != NULL)
327 				ip->ip_src = IA_SIN(ia)->sin_addr;
328 		}
329 
330 		if (ip_mrouter && (flags & IP_FORWARDING) == 0) {
331 			/*
332 			 * XXX
333 			 * delayed checksums are not currently
334 			 * compatible with IP multicast routing
335 			 */
336 			if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
337 				in_delayed_cksum(m);
338 				m->m_pkthdr.csum_flags &=
339 					~CSUM_DELAY_DATA;
340 			}
341 		}
342 		IN_LOOKUP_MULTI(pkt_dst, ifp, inm);
343 		if (inm != NULL &&
344 		   (imo == NULL || imo->imo_multicast_loop)) {
345 			/*
346 			 * If we belong to the destination multicast group
347 			 * on the outgoing interface, and the caller did not
348 			 * forbid loopback, loop back a copy.
349 			 */
350 			ip_mloopback(ifp, m, dst, hlen);
351 		}
352 		else {
353 			/*
354 			 * If we are acting as a multicast router, perform
355 			 * multicast forwarding as if the packet had just
356 			 * arrived on the interface to which we are about
357 			 * to send.  The multicast forwarding function
358 			 * recursively calls this function, using the
359 			 * IP_FORWARDING flag to prevent infinite recursion.
360 			 *
361 			 * Multicasts that are looped back by ip_mloopback(),
362 			 * above, will be forwarded by the ip_input() routine,
363 			 * if necessary.
364 			 */
365 			if (ip_mrouter && (flags & IP_FORWARDING) == 0) {
366 				/*
367 				 * Check if rsvp daemon is running. If not, don't
368 				 * set ip_moptions. This ensures that the packet
369 				 * is multicast and not just sent down one link
370 				 * as prescribed by rsvpd.
371 				 */
372 				if (!rsvp_on)
373 				  imo = NULL;
374 				if (ip_mforward(ip, ifp, m, imo) != 0) {
375 					m_freem(m);
376 					goto done;
377 				}
378 			}
379 		}
380 
381 		/*
382 		 * Multicasts with a time-to-live of zero may be looped-
383 		 * back, above, but must not be transmitted on a network.
384 		 * Also, multicasts addressed to the loopback interface
385 		 * are not sent -- the above call to ip_mloopback() will
386 		 * loop back a copy if this host actually belongs to the
387 		 * destination group on the loopback interface.
388 		 */
389 		if (ip->ip_ttl == 0 || ifp->if_flags & IFF_LOOPBACK) {
390 			m_freem(m);
391 			goto done;
392 		}
393 
394 		goto sendit;
395 	}
396 #ifndef notdef
397 	/*
398 	 * If the source address is not specified yet, use the address
399 	 * of the outoing interface. In case, keep note we did that, so
400 	 * if the the firewall changes the next-hop causing the output
401 	 * interface to change, we can fix that.
402 	 */
403 	if (ip->ip_src.s_addr == INADDR_ANY) {
404 		/* Interface may have no addresses. */
405 		if (ia != NULL) {
406 			ip->ip_src = IA_SIN(ia)->sin_addr;
407 			src_was_INADDR_ANY = 1;
408 		}
409 	}
410 #endif /* notdef */
411 	/*
412 	 * Verify that we have any chance at all of being able to queue
413 	 *      the packet or packet fragments
414 	 */
415 	if ((ifp->if_snd.ifq_len + ip->ip_len / ifp->if_mtu + 1) >=
416 		ifp->if_snd.ifq_maxlen) {
417 			error = ENOBUFS;
418 			ipstat.ips_odropped++;
419 			goto bad;
420 	}
421 
422 	/*
423 	 * Look for broadcast address and
424 	 * verify user is allowed to send
425 	 * such a packet.
426 	 */
427 	if (isbroadcast) {
428 		if ((ifp->if_flags & IFF_BROADCAST) == 0) {
429 			error = EADDRNOTAVAIL;
430 			goto bad;
431 		}
432 		if ((flags & IP_ALLOWBROADCAST) == 0) {
433 			error = EACCES;
434 			goto bad;
435 		}
436 		/* don't allow broadcast messages to be fragmented */
437 		if ((u_short)ip->ip_len > ifp->if_mtu) {
438 			error = EMSGSIZE;
439 			goto bad;
440 		}
441 		m->m_flags |= M_BCAST;
442 	} else {
443 		m->m_flags &= ~M_BCAST;
444 	}
445 
446 sendit:
447 #ifdef IPSEC
448 	/* get SP for this packet */
449 	if (so == NULL)
450 		sp = ipsec4_getpolicybyaddr(m, IPSEC_DIR_OUTBOUND, flags, &error);
451 	else
452 		sp = ipsec4_getpolicybysock(m, IPSEC_DIR_OUTBOUND, so, &error);
453 
454 	if (sp == NULL) {
455 		ipsecstat.out_inval++;
456 		goto bad;
457 	}
458 
459 	error = 0;
460 
461 	/* check policy */
462 	switch (sp->policy) {
463 	case IPSEC_POLICY_DISCARD:
464 		/*
465 		 * This packet is just discarded.
466 		 */
467 		ipsecstat.out_polvio++;
468 		goto bad;
469 
470 	case IPSEC_POLICY_BYPASS:
471 	case IPSEC_POLICY_NONE:
472 		/* no need to do IPsec. */
473 		goto skip_ipsec;
474 
475 	case IPSEC_POLICY_IPSEC:
476 		if (sp->req == NULL) {
477 			/* acquire a policy */
478 			error = key_spdacquire(sp);
479 			goto bad;
480 		}
481 		break;
482 
483 	case IPSEC_POLICY_ENTRUST:
484 	default:
485 		printf("ip_output: Invalid policy found. %d\n", sp->policy);
486 	}
487     {
488 	struct ipsec_output_state state;
489 	bzero(&state, sizeof(state));
490 	state.m = m;
491 	if (flags & IP_ROUTETOIF) {
492 		state.ro = &iproute;
493 		bzero(&iproute, sizeof(iproute));
494 	} else
495 		state.ro = ro;
496 	state.dst = (struct sockaddr *)dst;
497 
498 	ip->ip_sum = 0;
499 
500 	/*
501 	 * XXX
502 	 * delayed checksums are not currently compatible with IPsec
503 	 */
504 	if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
505 		in_delayed_cksum(m);
506 		m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
507 	}
508 
509 	ip->ip_len = htons(ip->ip_len);
510 	ip->ip_off = htons(ip->ip_off);
511 
512 	error = ipsec4_output(&state, sp, flags);
513 
514 	m = state.m;
515 	if (flags & IP_ROUTETOIF) {
516 		/*
517 		 * if we have tunnel mode SA, we may need to ignore
518 		 * IP_ROUTETOIF.
519 		 */
520 		if (state.ro != &iproute || state.ro->ro_rt != NULL) {
521 			flags &= ~IP_ROUTETOIF;
522 			ro = state.ro;
523 		}
524 	} else
525 		ro = state.ro;
526 	dst = (struct sockaddr_in *)state.dst;
527 	if (error) {
528 		/* mbuf is already reclaimed in ipsec4_output. */
529 		m0 = NULL;
530 		switch (error) {
531 		case EHOSTUNREACH:
532 		case ENETUNREACH:
533 		case EMSGSIZE:
534 		case ENOBUFS:
535 		case ENOMEM:
536 			break;
537 		default:
538 			printf("ip4_output (ipsec): error code %d\n", error);
539 			/*fall through*/
540 		case ENOENT:
541 			/* don't show these error codes to the user */
542 			error = 0;
543 			break;
544 		}
545 		goto bad;
546 	}
547     }
548 
549 	/* be sure to update variables that are affected by ipsec4_output() */
550 	ip = mtod(m, struct ip *);
551 #ifdef _IP_VHL
552 	hlen = IP_VHL_HL(ip->ip_vhl) << 2;
553 #else
554 	hlen = ip->ip_hl << 2;
555 #endif
556 	if (ro->ro_rt == NULL) {
557 		if ((flags & IP_ROUTETOIF) == 0) {
558 			printf("ip_output: "
559 				"can't update route after IPsec processing\n");
560 			error = EHOSTUNREACH;	/*XXX*/
561 			goto bad;
562 		}
563 	} else {
564 		ia = ifatoia(ro->ro_rt->rt_ifa);
565 		ifp = ro->ro_rt->rt_ifp;
566 	}
567 
568 	/* make it flipped, again. */
569 	ip->ip_len = ntohs(ip->ip_len);
570 	ip->ip_off = ntohs(ip->ip_off);
571 skip_ipsec:
572 #endif /*IPSEC*/
573 
574 	/*
575 	 * IpHack's section.
576 	 * - Xlate: translate packet's addr/port (NAT).
577 	 * - Firewall: deny/allow/etc.
578 	 * - Wrap: fake packet's addr/port <unimpl.>
579 	 * - Encapsulate: put it in another IP and send out. <unimp.>
580 	 */
581 #ifdef PFIL_HOOKS
582 	/*
583 	 * Run through list of hooks for output packets.
584 	 */
585 	m1 = m;
586 	pfh = pfil_hook_get(PFIL_OUT, &inetsw[ip_protox[IPPROTO_IP]].pr_pfh);
587 	for (; pfh; pfh = TAILQ_NEXT(pfh, pfil_link))
588 		if (pfh->pfil_func) {
589 			rv = pfh->pfil_func(ip, hlen, ifp, 1, &m1);
590 			if (rv) {
591 				error = EHOSTUNREACH;
592 				goto done;
593 			}
594 			m = m1;
595 			if (m == NULL)
596 				goto done;
597 			ip = mtod(m, struct ip *);
598 		}
599 #endif /* PFIL_HOOKS */
600 
601 	/*
602 	 * Check with the firewall...
603 	 * but not if we are already being fwd'd from a firewall.
604 	 */
605 	if (fw_enable && IPFW_LOADED && !args.next_hop) {
606 		struct sockaddr_in *old = dst;
607 
608 		args.m = m;
609 		args.next_hop = dst;
610 		args.oif = ifp;
611 		off = ip_fw_chk_ptr(&args);
612 		m = args.m;
613 		dst = args.next_hop;
614 
615                 /*
616 		 * On return we must do the following:
617 		 * m == NULL	-> drop the pkt (old interface, deprecated)
618 		 * (off & IP_FW_PORT_DENY_FLAG)	-> drop the pkt (new interface)
619 		 * 1<=off<= 0xffff		-> DIVERT
620 		 * (off & IP_FW_PORT_DYNT_FLAG)	-> send to a DUMMYNET pipe
621 		 * (off & IP_FW_PORT_TEE_FLAG)	-> TEE the packet
622 		 * dst != old			-> IPFIREWALL_FORWARD
623 		 * off==0, dst==old		-> accept
624 		 * If some of the above modules are not compiled in, then
625 		 * we should't have to check the corresponding condition
626 		 * (because the ipfw control socket should not accept
627 		 * unsupported rules), but better play safe and drop
628 		 * packets in case of doubt.
629 		 */
630 		if ( (off & IP_FW_PORT_DENY_FLAG) || m == NULL) {
631 			if (m)
632 				m_freem(m);
633 			error = EACCES;
634 			goto done;
635 		}
636 		ip = mtod(m, struct ip *);
637 		if (off == 0 && dst == old)		/* common case */
638 			goto pass;
639                 if (DUMMYNET_LOADED && (off & IP_FW_PORT_DYNT_FLAG) != 0) {
640 			/*
641 			 * pass the pkt to dummynet. Need to include
642 			 * pipe number, m, ifp, ro, dst because these are
643 			 * not recomputed in the next pass.
644 			 * All other parameters have been already used and
645 			 * so they are not needed anymore.
646 			 * XXX note: if the ifp or ro entry are deleted
647 			 * while a pkt is in dummynet, we are in trouble!
648 			 */
649 			args.ro = ro;
650 			args.dst = dst;
651 			args.flags = flags;
652 
653 			error = ip_dn_io_ptr(m, off & 0xffff, DN_TO_IP_OUT,
654 				&args);
655 			goto done;
656 		}
657 #ifdef IPDIVERT
658 		if (off != 0 && (off & IP_FW_PORT_DYNT_FLAG) == 0) {
659 			struct mbuf *clone = NULL;
660 
661 			/* Clone packet if we're doing a 'tee' */
662 			if ((off & IP_FW_PORT_TEE_FLAG) != 0)
663 				clone = m_dup(m, M_DONTWAIT);
664 
665 			/*
666 			 * XXX
667 			 * delayed checksums are not currently compatible
668 			 * with divert sockets.
669 			 */
670 			if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
671 				in_delayed_cksum(m);
672 				m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
673 			}
674 
675 			/* Restore packet header fields to original values */
676 			ip->ip_len = htons(ip->ip_len);
677 			ip->ip_off = htons(ip->ip_off);
678 
679 			/* Deliver packet to divert input routine */
680 			divert_packet(m, 0, off & 0xffff, args.divert_rule);
681 
682 			/* If 'tee', continue with original packet */
683 			if (clone != NULL) {
684 				m = clone;
685 				ip = mtod(m, struct ip *);
686 				goto pass;
687 			}
688 			goto done;
689 		}
690 #endif
691 
692 		/* IPFIREWALL_FORWARD */
693 		/*
694 		 * Check dst to make sure it is directly reachable on the
695 		 * interface we previously thought it was.
696 		 * If it isn't (which may be likely in some situations) we have
697 		 * to re-route it (ie, find a route for the next-hop and the
698 		 * associated interface) and set them here. This is nested
699 		 * forwarding which in most cases is undesirable, except where
700 		 * such control is nigh impossible. So we do it here.
701 		 * And I'm babbling.
702 		 */
703 		if (off == 0 && old != dst) { /* FORWARD, dst has changed */
704 #if 0
705 			/*
706 			 * XXX To improve readability, this block should be
707 			 * changed into a function call as below:
708 			 */
709 			error = ip_ipforward(&m, &dst, &ifp);
710 			if (error)
711 				goto bad;
712 			if (m == NULL) /* ip_input consumed the mbuf */
713 				goto done;
714 #else
715 			struct in_ifaddr *ia;
716 
717 			/*
718 			 * XXX sro_fwd below is static, and a pointer
719 			 * to it gets passed to routines downstream.
720 			 * This could have surprisingly bad results in
721 			 * practice, because its content is overwritten
722 			 * by subsequent packets.
723 			 */
724 			/* There must be a better way to do this next line... */
725 			static struct route sro_fwd;
726 			struct route *ro_fwd = &sro_fwd;
727 
728 #if 0
729 			print_ip("IPFIREWALL_FORWARD: New dst ip: ",
730 			    dst->sin_addr, "\n");
731 #endif
732 
733 			/*
734 			 * We need to figure out if we have been forwarded
735 			 * to a local socket. If so, then we should somehow
736 			 * "loop back" to ip_input, and get directed to the
737 			 * PCB as if we had received this packet. This is
738 			 * because it may be dificult to identify the packets
739 			 * you want to forward until they are being output
740 			 * and have selected an interface. (e.g. locally
741 			 * initiated packets) If we used the loopback inteface,
742 			 * we would not be able to control what happens
743 			 * as the packet runs through ip_input() as
744 			 * it is done through a ISR.
745 			 */
746 			LIST_FOREACH(ia,
747 			    INADDR_HASH(dst->sin_addr.s_addr), ia_hash) {
748 				/*
749 				 * If the addr to forward to is one
750 				 * of ours, we pretend to
751 				 * be the destination for this packet.
752 				 */
753 				if (IA_SIN(ia)->sin_addr.s_addr ==
754 						 dst->sin_addr.s_addr)
755 					break;
756 			}
757 			if (ia) {	/* tell ip_input "dont filter" */
758 				struct m_hdr tag;
759 
760 				tag.mh_type = MT_TAG;
761 				tag.mh_flags = PACKET_TAG_IPFORWARD;
762 				tag.mh_data = (caddr_t)args.next_hop;
763 				tag.mh_next = m;
764 
765 				if (m->m_pkthdr.rcvif == NULL)
766 					m->m_pkthdr.rcvif = ifunit("lo0");
767 				if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
768 					m->m_pkthdr.csum_flags |=
769 					    CSUM_DATA_VALID | CSUM_PSEUDO_HDR;
770 					m0->m_pkthdr.csum_data = 0xffff;
771 				}
772 				m->m_pkthdr.csum_flags |=
773 				    CSUM_IP_CHECKED | CSUM_IP_VALID;
774 				ip->ip_len = htons(ip->ip_len);
775 				ip->ip_off = htons(ip->ip_off);
776 				ip_input((struct mbuf *)&tag);
777 				goto done;
778 			}
779 			/* Some of the logic for this was
780 			 * nicked from above.
781 			 *
782 			 * This rewrites the cached route in a local PCB.
783 			 * Is this what we want to do?
784 			 */
785 			bcopy(dst, &ro_fwd->ro_dst, sizeof(*dst));
786 
787 			ro_fwd->ro_rt = 0;
788 			rtalloc_ign(ro_fwd, RTF_PRCLONING);
789 
790 			if (ro_fwd->ro_rt == 0) {
791 				ipstat.ips_noroute++;
792 				error = EHOSTUNREACH;
793 				goto bad;
794 			}
795 
796 			ia = ifatoia(ro_fwd->ro_rt->rt_ifa);
797 			ifp = ro_fwd->ro_rt->rt_ifp;
798 			ro_fwd->ro_rt->rt_use++;
799 			if (ro_fwd->ro_rt->rt_flags & RTF_GATEWAY)
800 				dst = (struct sockaddr_in *)
801 					ro_fwd->ro_rt->rt_gateway;
802 			if (ro_fwd->ro_rt->rt_flags & RTF_HOST)
803 				isbroadcast =
804 				    (ro_fwd->ro_rt->rt_flags & RTF_BROADCAST);
805 			else
806 				isbroadcast = in_broadcast(dst->sin_addr, ifp);
807 			if (ro->ro_rt)
808 				RTFREE(ro->ro_rt);
809 			ro->ro_rt = ro_fwd->ro_rt;
810 			dst = (struct sockaddr_in *)&ro_fwd->ro_dst;
811 
812 #endif	/* ... block to be put into a function */
813 			/*
814 			 * If we added a default src ip earlier,
815 			 * which would have been gotten from the-then
816 			 * interface, do it again, from the new one.
817 			 */
818 			if (src_was_INADDR_ANY)
819 				ip->ip_src = IA_SIN(ia)->sin_addr;
820 			goto pass ;
821 		}
822 
823                 /*
824                  * if we get here, none of the above matches, and
825                  * we have to drop the pkt
826                  */
827 		m_freem(m);
828                 error = EACCES; /* not sure this is the right error msg */
829                 goto done;
830 	}
831 
832 pass:
833 	/* 127/8 must not appear on wire - RFC1122. */
834 	if ((ntohl(ip->ip_dst.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET ||
835 	    (ntohl(ip->ip_src.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET) {
836 		if ((ifp->if_flags & IFF_LOOPBACK) == 0) {
837 			ipstat.ips_badaddr++;
838 			error = EADDRNOTAVAIL;
839 			goto bad;
840 		}
841 	}
842 
843 	m->m_pkthdr.csum_flags |= CSUM_IP;
844 	sw_csum = m->m_pkthdr.csum_flags & ~ifp->if_hwassist;
845 	if (sw_csum & CSUM_DELAY_DATA) {
846 		in_delayed_cksum(m);
847 		sw_csum &= ~CSUM_DELAY_DATA;
848 	}
849 	m->m_pkthdr.csum_flags &= ifp->if_hwassist;
850 
851 	/*
852 	 * If small enough for interface, or the interface will take
853 	 * care of the fragmentation for us, can just send directly.
854 	 */
855 	if ((u_short)ip->ip_len <= ifp->if_mtu ||
856 	    ifp->if_hwassist & CSUM_FRAGMENT) {
857 		ip->ip_len = htons(ip->ip_len);
858 		ip->ip_off = htons(ip->ip_off);
859 		ip->ip_sum = 0;
860 		if (sw_csum & CSUM_DELAY_IP) {
861 			if (ip->ip_vhl == IP_VHL_BORING) {
862 				ip->ip_sum = in_cksum_hdr(ip);
863 			} else {
864 				ip->ip_sum = in_cksum(m, hlen);
865 			}
866 		}
867 
868 		/* Record statistics for this interface address. */
869 		if (!(flags & IP_FORWARDING) && ia) {
870 			ia->ia_ifa.if_opackets++;
871 			ia->ia_ifa.if_obytes += m->m_pkthdr.len;
872 		}
873 
874 #ifdef IPSEC
875 		/* clean ipsec history once it goes out of the node */
876 		ipsec_delaux(m);
877 #endif
878 
879 		error = (*ifp->if_output)(ifp, m,
880 				(struct sockaddr *)dst, ro->ro_rt);
881 		goto done;
882 	}
883 	/*
884 	 * Too large for interface; fragment if possible.
885 	 * Must be able to put at least 8 bytes per fragment.
886 	 */
887 	if (ip->ip_off & IP_DF) {
888 		error = EMSGSIZE;
889 		/*
890 		 * This case can happen if the user changed the MTU
891 		 * of an interface after enabling IP on it.  Because
892 		 * most netifs don't keep track of routes pointing to
893 		 * them, there is no way for one to update all its
894 		 * routes when the MTU is changed.
895 		 */
896 		if ((ro->ro_rt->rt_flags & (RTF_UP | RTF_HOST))
897 		    && !(ro->ro_rt->rt_rmx.rmx_locks & RTV_MTU)
898 		    && (ro->ro_rt->rt_rmx.rmx_mtu > ifp->if_mtu)) {
899 			ro->ro_rt->rt_rmx.rmx_mtu = ifp->if_mtu;
900 		}
901 		ipstat.ips_cantfrag++;
902 		goto bad;
903 	}
904 	len = (ifp->if_mtu - hlen) &~ 7;
905 	if (len < 8) {
906 		error = EMSGSIZE;
907 		goto bad;
908 	}
909 
910 	/*
911 	 * if the interface will not calculate checksums on
912 	 * fragmented packets, then do it here.
913 	 */
914 	if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA &&
915 	    (ifp->if_hwassist & CSUM_IP_FRAGS) == 0) {
916 		in_delayed_cksum(m);
917 		m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
918 	}
919 
920 	if (len > PAGE_SIZE) {
921 		/*
922 		 * Fragement large datagrams such that each segment
923 		 * contains a multiple of PAGE_SIZE amount of data,
924 		 * plus headers. This enables a receiver to perform
925 		 * page-flipping zero-copy optimizations.
926 		 */
927 
928 		int newlen;
929 		struct mbuf *mtmp;
930 
931 		for (mtmp = m, off = 0;
932 		     mtmp && ((off + mtmp->m_len) <= ifp->if_mtu);
933 		     mtmp = mtmp->m_next) {
934 			off += mtmp->m_len;
935 		}
936 		/*
937 		 * firstlen (off - hlen) must be aligned on an
938 		 * 8-byte boundary
939 		 */
940 		if (off < hlen)
941 			goto smart_frag_failure;
942 		off = ((off - hlen) & ~7) + hlen;
943 		newlen = (~PAGE_MASK) & ifp->if_mtu;
944 		if ((newlen + sizeof (struct ip)) > ifp->if_mtu) {
945 			/* we failed, go back the default */
946 smart_frag_failure:
947 			newlen = len;
948 			off = hlen + len;
949 		}
950 
951 /*		printf("ipfrag: len = %d, hlen = %d, mhlen = %d, newlen = %d, off = %d\n",
952 		len, hlen, sizeof (struct ip), newlen, off);*/
953 
954 		len = newlen;
955 
956 	} else {
957 		off = hlen + len;
958 	}
959 
960 
961 
962     {
963 	int mhlen, firstlen = off - hlen;
964 	struct mbuf **mnext = &m->m_nextpkt;
965 	int nfrags = 1;
966 
967 	/*
968 	 * Loop through length of segment after first fragment,
969 	 * make new header and copy data of each part and link onto chain.
970 	 */
971 	m0 = m;
972 	mhlen = sizeof (struct ip);
973 	for (; off < (u_short)ip->ip_len; off += len) {
974 		MGETHDR(m, M_DONTWAIT, MT_HEADER);
975 		if (m == 0) {
976 			error = ENOBUFS;
977 			ipstat.ips_odropped++;
978 			goto sendorfree;
979 		}
980 		m->m_flags |= (m0->m_flags & M_MCAST) | M_FRAG;
981 		m->m_data += max_linkhdr;
982 		mhip = mtod(m, struct ip *);
983 		*mhip = *ip;
984 		if (hlen > sizeof (struct ip)) {
985 			mhlen = ip_optcopy(ip, mhip) + sizeof (struct ip);
986 			mhip->ip_vhl = IP_MAKE_VHL(IPVERSION, mhlen >> 2);
987 		}
988 		m->m_len = mhlen;
989 		mhip->ip_off = ((off - hlen) >> 3) + ip->ip_off;
990 		if (off + len >= (u_short)ip->ip_len)
991 			len = (u_short)ip->ip_len - off;
992 		else
993 			mhip->ip_off |= IP_MF;
994 		mhip->ip_len = htons((u_short)(len + mhlen));
995 		m->m_next = m_copy(m0, off, len);
996 		if (m->m_next == 0) {
997 			(void) m_free(m);
998 			error = ENOBUFS;	/* ??? */
999 			ipstat.ips_odropped++;
1000 			goto sendorfree;
1001 		}
1002 		m->m_pkthdr.len = mhlen + len;
1003 		m->m_pkthdr.rcvif = (struct ifnet *)0;
1004 		m->m_pkthdr.csum_flags = m0->m_pkthdr.csum_flags;
1005 		mhip->ip_off = htons(mhip->ip_off);
1006 		mhip->ip_sum = 0;
1007 		if (sw_csum & CSUM_DELAY_IP) {
1008 			if (mhip->ip_vhl == IP_VHL_BORING) {
1009 				mhip->ip_sum = in_cksum_hdr(mhip);
1010 			} else {
1011 				mhip->ip_sum = in_cksum(m, mhlen);
1012 			}
1013 		}
1014 		*mnext = m;
1015 		mnext = &m->m_nextpkt;
1016 		nfrags++;
1017 	}
1018 	ipstat.ips_ofragments += nfrags;
1019 
1020 	/* set first/last markers for fragment chain */
1021 	m->m_flags |= M_LASTFRAG;
1022 	m0->m_flags |= M_FIRSTFRAG | M_FRAG;
1023 	m0->m_pkthdr.csum_data = nfrags;
1024 
1025 	/*
1026 	 * Update first fragment by trimming what's been copied out
1027 	 * and updating header, then send each fragment (in order).
1028 	 */
1029 	m = m0;
1030 	m_adj(m, hlen + firstlen - (u_short)ip->ip_len);
1031 	m->m_pkthdr.len = hlen + firstlen;
1032 	ip->ip_len = htons((u_short)m->m_pkthdr.len);
1033 	ip->ip_off |= IP_MF;
1034 	ip->ip_off = htons(ip->ip_off);
1035 	ip->ip_sum = 0;
1036 	if (sw_csum & CSUM_DELAY_IP) {
1037 		if (ip->ip_vhl == IP_VHL_BORING) {
1038 			ip->ip_sum = in_cksum_hdr(ip);
1039 		} else {
1040 			ip->ip_sum = in_cksum(m, hlen);
1041 		}
1042 	}
1043 sendorfree:
1044 	for (m = m0; m; m = m0) {
1045 		m0 = m->m_nextpkt;
1046 		m->m_nextpkt = 0;
1047 #ifdef IPSEC
1048 		/* clean ipsec history once it goes out of the node */
1049 		ipsec_delaux(m);
1050 #endif
1051 		if (error == 0) {
1052 			/* Record statistics for this interface address. */
1053 			if (ia != NULL) {
1054 				ia->ia_ifa.if_opackets++;
1055 				ia->ia_ifa.if_obytes += m->m_pkthdr.len;
1056 			}
1057 
1058 			error = (*ifp->if_output)(ifp, m,
1059 			    (struct sockaddr *)dst, ro->ro_rt);
1060 		} else
1061 			m_freem(m);
1062 	}
1063 
1064 	if (error == 0)
1065 		ipstat.ips_fragmented++;
1066     }
1067 done:
1068 #ifdef IPSEC
1069 	if (ro == &iproute && ro->ro_rt) {
1070 		RTFREE(ro->ro_rt);
1071 		ro->ro_rt = NULL;
1072 	}
1073 	if (sp != NULL) {
1074 		KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
1075 			printf("DP ip_output call free SP:%p\n", sp));
1076 		key_freesp(sp);
1077 	}
1078 #endif /* IPSEC */
1079 	return (error);
1080 bad:
1081 	m_freem(m);
1082 	goto done;
1083 }
1084 
1085 void
1086 in_delayed_cksum(struct mbuf *m)
1087 {
1088 	struct ip *ip;
1089 	u_short csum, offset;
1090 
1091 	ip = mtod(m, struct ip *);
1092 	offset = IP_VHL_HL(ip->ip_vhl) << 2 ;
1093 	csum = in_cksum_skip(m, ip->ip_len, offset);
1094 	if (m->m_pkthdr.csum_flags & CSUM_UDP && csum == 0)
1095 		csum = 0xffff;
1096 	offset += m->m_pkthdr.csum_data;	/* checksum offset */
1097 
1098 	if (offset + sizeof(u_short) > m->m_len) {
1099 		printf("delayed m_pullup, m->len: %d  off: %d  p: %d\n",
1100 		    m->m_len, offset, ip->ip_p);
1101 		/*
1102 		 * XXX
1103 		 * this shouldn't happen, but if it does, the
1104 		 * correct behavior may be to insert the checksum
1105 		 * in the existing chain instead of rearranging it.
1106 		 */
1107 		m = m_pullup(m, offset + sizeof(u_short));
1108 	}
1109 	*(u_short *)(m->m_data + offset) = csum;
1110 }
1111 
1112 /*
1113  * Insert IP options into preformed packet.
1114  * Adjust IP destination as required for IP source routing,
1115  * as indicated by a non-zero in_addr at the start of the options.
1116  *
1117  * XXX This routine assumes that the packet has no options in place.
1118  */
1119 static struct mbuf *
1120 ip_insertoptions(m, opt, phlen)
1121 	register struct mbuf *m;
1122 	struct mbuf *opt;
1123 	int *phlen;
1124 {
1125 	register struct ipoption *p = mtod(opt, struct ipoption *);
1126 	struct mbuf *n;
1127 	register struct ip *ip = mtod(m, struct ip *);
1128 	unsigned optlen;
1129 
1130 	optlen = opt->m_len - sizeof(p->ipopt_dst);
1131 	if (optlen + (u_short)ip->ip_len > IP_MAXPACKET)
1132 		return (m);		/* XXX should fail */
1133 	if (p->ipopt_dst.s_addr)
1134 		ip->ip_dst = p->ipopt_dst;
1135 	if (m->m_flags & M_EXT || m->m_data - optlen < m->m_pktdat) {
1136 		MGETHDR(n, M_DONTWAIT, MT_HEADER);
1137 		if (n == 0)
1138 			return (m);
1139 		n->m_pkthdr.rcvif = (struct ifnet *)0;
1140 		n->m_pkthdr.len = m->m_pkthdr.len + optlen;
1141 		m->m_len -= sizeof(struct ip);
1142 		m->m_data += sizeof(struct ip);
1143 		n->m_next = m;
1144 		m = n;
1145 		m->m_len = optlen + sizeof(struct ip);
1146 		m->m_data += max_linkhdr;
1147 		(void)memcpy(mtod(m, void *), ip, sizeof(struct ip));
1148 	} else {
1149 		m->m_data -= optlen;
1150 		m->m_len += optlen;
1151 		m->m_pkthdr.len += optlen;
1152 		ovbcopy((caddr_t)ip, mtod(m, caddr_t), sizeof(struct ip));
1153 	}
1154 	ip = mtod(m, struct ip *);
1155 	bcopy(p->ipopt_list, ip + 1, optlen);
1156 	*phlen = sizeof(struct ip) + optlen;
1157 	ip->ip_vhl = IP_MAKE_VHL(IPVERSION, *phlen >> 2);
1158 	ip->ip_len += optlen;
1159 	return (m);
1160 }
1161 
1162 /*
1163  * Copy options from ip to jp,
1164  * omitting those not copied during fragmentation.
1165  */
1166 int
1167 ip_optcopy(ip, jp)
1168 	struct ip *ip, *jp;
1169 {
1170 	register u_char *cp, *dp;
1171 	int opt, optlen, cnt;
1172 
1173 	cp = (u_char *)(ip + 1);
1174 	dp = (u_char *)(jp + 1);
1175 	cnt = (IP_VHL_HL(ip->ip_vhl) << 2) - sizeof (struct ip);
1176 	for (; cnt > 0; cnt -= optlen, cp += optlen) {
1177 		opt = cp[0];
1178 		if (opt == IPOPT_EOL)
1179 			break;
1180 		if (opt == IPOPT_NOP) {
1181 			/* Preserve for IP mcast tunnel's LSRR alignment. */
1182 			*dp++ = IPOPT_NOP;
1183 			optlen = 1;
1184 			continue;
1185 		}
1186 
1187 		KASSERT(cnt >= IPOPT_OLEN + sizeof(*cp),
1188 		    ("ip_optcopy: malformed ipv4 option"));
1189 		optlen = cp[IPOPT_OLEN];
1190 		KASSERT(optlen >= IPOPT_OLEN + sizeof(*cp) && optlen <= cnt,
1191 		    ("ip_optcopy: malformed ipv4 option"));
1192 
1193 		/* bogus lengths should have been caught by ip_dooptions */
1194 		if (optlen > cnt)
1195 			optlen = cnt;
1196 		if (IPOPT_COPIED(opt)) {
1197 			bcopy(cp, dp, optlen);
1198 			dp += optlen;
1199 		}
1200 	}
1201 	for (optlen = dp - (u_char *)(jp+1); optlen & 0x3; optlen++)
1202 		*dp++ = IPOPT_EOL;
1203 	return (optlen);
1204 }
1205 
1206 /*
1207  * IP socket option processing.
1208  */
1209 int
1210 ip_ctloutput(so, sopt)
1211 	struct socket *so;
1212 	struct sockopt *sopt;
1213 {
1214 	struct	inpcb *inp = sotoinpcb(so);
1215 	int	error, optval;
1216 
1217 	error = optval = 0;
1218 	if (sopt->sopt_level != IPPROTO_IP) {
1219 		return (EINVAL);
1220 	}
1221 
1222 	switch (sopt->sopt_dir) {
1223 	case SOPT_SET:
1224 		switch (sopt->sopt_name) {
1225 		case IP_OPTIONS:
1226 #ifdef notyet
1227 		case IP_RETOPTS:
1228 #endif
1229 		{
1230 			struct mbuf *m;
1231 			if (sopt->sopt_valsize > MLEN) {
1232 				error = EMSGSIZE;
1233 				break;
1234 			}
1235 			MGET(m, sopt->sopt_td ? M_TRYWAIT : M_DONTWAIT, MT_HEADER);
1236 			if (m == 0) {
1237 				error = ENOBUFS;
1238 				break;
1239 			}
1240 			m->m_len = sopt->sopt_valsize;
1241 			error = sooptcopyin(sopt, mtod(m, char *), m->m_len,
1242 					    m->m_len);
1243 
1244 			return (ip_pcbopts(sopt->sopt_name, &inp->inp_options,
1245 					   m));
1246 		}
1247 
1248 		case IP_TOS:
1249 		case IP_TTL:
1250 		case IP_RECVOPTS:
1251 		case IP_RECVRETOPTS:
1252 		case IP_RECVDSTADDR:
1253 		case IP_RECVIF:
1254 		case IP_FAITH:
1255 			error = sooptcopyin(sopt, &optval, sizeof optval,
1256 					    sizeof optval);
1257 			if (error)
1258 				break;
1259 
1260 			switch (sopt->sopt_name) {
1261 			case IP_TOS:
1262 				inp->inp_ip_tos = optval;
1263 				break;
1264 
1265 			case IP_TTL:
1266 				inp->inp_ip_ttl = optval;
1267 				break;
1268 #define	OPTSET(bit) \
1269 	if (optval) \
1270 		inp->inp_flags |= bit; \
1271 	else \
1272 		inp->inp_flags &= ~bit;
1273 
1274 			case IP_RECVOPTS:
1275 				OPTSET(INP_RECVOPTS);
1276 				break;
1277 
1278 			case IP_RECVRETOPTS:
1279 				OPTSET(INP_RECVRETOPTS);
1280 				break;
1281 
1282 			case IP_RECVDSTADDR:
1283 				OPTSET(INP_RECVDSTADDR);
1284 				break;
1285 
1286 			case IP_RECVIF:
1287 				OPTSET(INP_RECVIF);
1288 				break;
1289 
1290 			case IP_FAITH:
1291 				OPTSET(INP_FAITH);
1292 				break;
1293 			}
1294 			break;
1295 #undef OPTSET
1296 
1297 		case IP_MULTICAST_IF:
1298 		case IP_MULTICAST_VIF:
1299 		case IP_MULTICAST_TTL:
1300 		case IP_MULTICAST_LOOP:
1301 		case IP_ADD_MEMBERSHIP:
1302 		case IP_DROP_MEMBERSHIP:
1303 			error = ip_setmoptions(sopt, &inp->inp_moptions);
1304 			break;
1305 
1306 		case IP_PORTRANGE:
1307 			error = sooptcopyin(sopt, &optval, sizeof optval,
1308 					    sizeof optval);
1309 			if (error)
1310 				break;
1311 
1312 			switch (optval) {
1313 			case IP_PORTRANGE_DEFAULT:
1314 				inp->inp_flags &= ~(INP_LOWPORT);
1315 				inp->inp_flags &= ~(INP_HIGHPORT);
1316 				break;
1317 
1318 			case IP_PORTRANGE_HIGH:
1319 				inp->inp_flags &= ~(INP_LOWPORT);
1320 				inp->inp_flags |= INP_HIGHPORT;
1321 				break;
1322 
1323 			case IP_PORTRANGE_LOW:
1324 				inp->inp_flags &= ~(INP_HIGHPORT);
1325 				inp->inp_flags |= INP_LOWPORT;
1326 				break;
1327 
1328 			default:
1329 				error = EINVAL;
1330 				break;
1331 			}
1332 			break;
1333 
1334 #ifdef IPSEC
1335 		case IP_IPSEC_POLICY:
1336 		{
1337 			caddr_t req;
1338 			size_t len = 0;
1339 			int priv;
1340 			struct mbuf *m;
1341 			int optname;
1342 
1343 			if ((error = soopt_getm(sopt, &m)) != 0) /* XXX */
1344 				break;
1345 			if ((error = soopt_mcopyin(sopt, m)) != 0) /* XXX */
1346 				break;
1347 			priv = (sopt->sopt_td != NULL &&
1348 				suser(sopt->sopt_td) != 0) ? 0 : 1;
1349 			req = mtod(m, caddr_t);
1350 			len = m->m_len;
1351 			optname = sopt->sopt_name;
1352 			error = ipsec4_set_policy(inp, optname, req, len, priv);
1353 			m_freem(m);
1354 			break;
1355 		}
1356 #endif /*IPSEC*/
1357 
1358 		default:
1359 			error = ENOPROTOOPT;
1360 			break;
1361 		}
1362 		break;
1363 
1364 	case SOPT_GET:
1365 		switch (sopt->sopt_name) {
1366 		case IP_OPTIONS:
1367 		case IP_RETOPTS:
1368 			if (inp->inp_options)
1369 				error = sooptcopyout(sopt,
1370 						     mtod(inp->inp_options,
1371 							  char *),
1372 						     inp->inp_options->m_len);
1373 			else
1374 				sopt->sopt_valsize = 0;
1375 			break;
1376 
1377 		case IP_TOS:
1378 		case IP_TTL:
1379 		case IP_RECVOPTS:
1380 		case IP_RECVRETOPTS:
1381 		case IP_RECVDSTADDR:
1382 		case IP_RECVIF:
1383 		case IP_PORTRANGE:
1384 		case IP_FAITH:
1385 			switch (sopt->sopt_name) {
1386 
1387 			case IP_TOS:
1388 				optval = inp->inp_ip_tos;
1389 				break;
1390 
1391 			case IP_TTL:
1392 				optval = inp->inp_ip_ttl;
1393 				break;
1394 
1395 #define	OPTBIT(bit)	(inp->inp_flags & bit ? 1 : 0)
1396 
1397 			case IP_RECVOPTS:
1398 				optval = OPTBIT(INP_RECVOPTS);
1399 				break;
1400 
1401 			case IP_RECVRETOPTS:
1402 				optval = OPTBIT(INP_RECVRETOPTS);
1403 				break;
1404 
1405 			case IP_RECVDSTADDR:
1406 				optval = OPTBIT(INP_RECVDSTADDR);
1407 				break;
1408 
1409 			case IP_RECVIF:
1410 				optval = OPTBIT(INP_RECVIF);
1411 				break;
1412 
1413 			case IP_PORTRANGE:
1414 				if (inp->inp_flags & INP_HIGHPORT)
1415 					optval = IP_PORTRANGE_HIGH;
1416 				else if (inp->inp_flags & INP_LOWPORT)
1417 					optval = IP_PORTRANGE_LOW;
1418 				else
1419 					optval = 0;
1420 				break;
1421 
1422 			case IP_FAITH:
1423 				optval = OPTBIT(INP_FAITH);
1424 				break;
1425 			}
1426 			error = sooptcopyout(sopt, &optval, sizeof optval);
1427 			break;
1428 
1429 		case IP_MULTICAST_IF:
1430 		case IP_MULTICAST_VIF:
1431 		case IP_MULTICAST_TTL:
1432 		case IP_MULTICAST_LOOP:
1433 		case IP_ADD_MEMBERSHIP:
1434 		case IP_DROP_MEMBERSHIP:
1435 			error = ip_getmoptions(sopt, inp->inp_moptions);
1436 			break;
1437 
1438 #ifdef IPSEC
1439 		case IP_IPSEC_POLICY:
1440 		{
1441 			struct mbuf *m = NULL;
1442 			caddr_t req = NULL;
1443 			size_t len = 0;
1444 
1445 			if (m != 0) {
1446 				req = mtod(m, caddr_t);
1447 				len = m->m_len;
1448 			}
1449 			error = ipsec4_get_policy(sotoinpcb(so), req, len, &m);
1450 			if (error == 0)
1451 				error = soopt_mcopyout(sopt, m); /* XXX */
1452 			if (error == 0)
1453 				m_freem(m);
1454 			break;
1455 		}
1456 #endif /*IPSEC*/
1457 
1458 		default:
1459 			error = ENOPROTOOPT;
1460 			break;
1461 		}
1462 		break;
1463 	}
1464 	return (error);
1465 }
1466 
1467 /*
1468  * Set up IP options in pcb for insertion in output packets.
1469  * Store in mbuf with pointer in pcbopt, adding pseudo-option
1470  * with destination address if source routed.
1471  */
1472 static int
1473 ip_pcbopts(optname, pcbopt, m)
1474 	int optname;
1475 	struct mbuf **pcbopt;
1476 	register struct mbuf *m;
1477 {
1478 	register int cnt, optlen;
1479 	register u_char *cp;
1480 	u_char opt;
1481 
1482 	/* turn off any old options */
1483 	if (*pcbopt)
1484 		(void)m_free(*pcbopt);
1485 	*pcbopt = 0;
1486 	if (m == (struct mbuf *)0 || m->m_len == 0) {
1487 		/*
1488 		 * Only turning off any previous options.
1489 		 */
1490 		if (m)
1491 			(void)m_free(m);
1492 		return (0);
1493 	}
1494 
1495 	if (m->m_len % sizeof(int32_t))
1496 		goto bad;
1497 	/*
1498 	 * IP first-hop destination address will be stored before
1499 	 * actual options; move other options back
1500 	 * and clear it when none present.
1501 	 */
1502 	if (m->m_data + m->m_len + sizeof(struct in_addr) >= &m->m_dat[MLEN])
1503 		goto bad;
1504 	cnt = m->m_len;
1505 	m->m_len += sizeof(struct in_addr);
1506 	cp = mtod(m, u_char *) + sizeof(struct in_addr);
1507 	ovbcopy(mtod(m, caddr_t), (caddr_t)cp, (unsigned)cnt);
1508 	bzero(mtod(m, caddr_t), sizeof(struct in_addr));
1509 
1510 	for (; cnt > 0; cnt -= optlen, cp += optlen) {
1511 		opt = cp[IPOPT_OPTVAL];
1512 		if (opt == IPOPT_EOL)
1513 			break;
1514 		if (opt == IPOPT_NOP)
1515 			optlen = 1;
1516 		else {
1517 			if (cnt < IPOPT_OLEN + sizeof(*cp))
1518 				goto bad;
1519 			optlen = cp[IPOPT_OLEN];
1520 			if (optlen < IPOPT_OLEN + sizeof(*cp) || optlen > cnt)
1521 				goto bad;
1522 		}
1523 		switch (opt) {
1524 
1525 		default:
1526 			break;
1527 
1528 		case IPOPT_LSRR:
1529 		case IPOPT_SSRR:
1530 			/*
1531 			 * user process specifies route as:
1532 			 *	->A->B->C->D
1533 			 * D must be our final destination (but we can't
1534 			 * check that since we may not have connected yet).
1535 			 * A is first hop destination, which doesn't appear in
1536 			 * actual IP option, but is stored before the options.
1537 			 */
1538 			if (optlen < IPOPT_MINOFF - 1 + sizeof(struct in_addr))
1539 				goto bad;
1540 			m->m_len -= sizeof(struct in_addr);
1541 			cnt -= sizeof(struct in_addr);
1542 			optlen -= sizeof(struct in_addr);
1543 			cp[IPOPT_OLEN] = optlen;
1544 			/*
1545 			 * Move first hop before start of options.
1546 			 */
1547 			bcopy((caddr_t)&cp[IPOPT_OFFSET+1], mtod(m, caddr_t),
1548 			    sizeof(struct in_addr));
1549 			/*
1550 			 * Then copy rest of options back
1551 			 * to close up the deleted entry.
1552 			 */
1553 			ovbcopy((caddr_t)(&cp[IPOPT_OFFSET+1] +
1554 			    sizeof(struct in_addr)),
1555 			    (caddr_t)&cp[IPOPT_OFFSET+1],
1556 			    (unsigned)cnt + sizeof(struct in_addr));
1557 			break;
1558 		}
1559 	}
1560 	if (m->m_len > MAX_IPOPTLEN + sizeof(struct in_addr))
1561 		goto bad;
1562 	*pcbopt = m;
1563 	return (0);
1564 
1565 bad:
1566 	(void)m_free(m);
1567 	return (EINVAL);
1568 }
1569 
1570 /*
1571  * XXX
1572  * The whole multicast option thing needs to be re-thought.
1573  * Several of these options are equally applicable to non-multicast
1574  * transmission, and one (IP_MULTICAST_TTL) totally duplicates a
1575  * standard option (IP_TTL).
1576  */
1577 
1578 /*
1579  * following RFC1724 section 3.3, 0.0.0.0/8 is interpreted as interface index.
1580  */
1581 static struct ifnet *
1582 ip_multicast_if(a, ifindexp)
1583 	struct in_addr *a;
1584 	int *ifindexp;
1585 {
1586 	int ifindex;
1587 	struct ifnet *ifp;
1588 
1589 	if (ifindexp)
1590 		*ifindexp = 0;
1591 	if (ntohl(a->s_addr) >> 24 == 0) {
1592 		ifindex = ntohl(a->s_addr) & 0xffffff;
1593 		if (ifindex < 0 || if_index < ifindex)
1594 			return NULL;
1595 		ifp = ifnet_byindex(ifindex);
1596 		if (ifindexp)
1597 			*ifindexp = ifindex;
1598 	} else {
1599 		INADDR_TO_IFP(*a, ifp);
1600 	}
1601 	return ifp;
1602 }
1603 
1604 /*
1605  * Set the IP multicast options in response to user setsockopt().
1606  */
1607 static int
1608 ip_setmoptions(sopt, imop)
1609 	struct sockopt *sopt;
1610 	struct ip_moptions **imop;
1611 {
1612 	int error = 0;
1613 	int i;
1614 	struct in_addr addr;
1615 	struct ip_mreq mreq;
1616 	struct ifnet *ifp;
1617 	struct ip_moptions *imo = *imop;
1618 	struct route ro;
1619 	struct sockaddr_in *dst;
1620 	int ifindex;
1621 	int s;
1622 
1623 	if (imo == NULL) {
1624 		/*
1625 		 * No multicast option buffer attached to the pcb;
1626 		 * allocate one and initialize to default values.
1627 		 */
1628 		imo = (struct ip_moptions*)malloc(sizeof(*imo), M_IPMOPTS,
1629 		    M_WAITOK);
1630 
1631 		if (imo == NULL)
1632 			return (ENOBUFS);
1633 		*imop = imo;
1634 		imo->imo_multicast_ifp = NULL;
1635 		imo->imo_multicast_addr.s_addr = INADDR_ANY;
1636 		imo->imo_multicast_vif = -1;
1637 		imo->imo_multicast_ttl = IP_DEFAULT_MULTICAST_TTL;
1638 		imo->imo_multicast_loop = IP_DEFAULT_MULTICAST_LOOP;
1639 		imo->imo_num_memberships = 0;
1640 	}
1641 
1642 	switch (sopt->sopt_name) {
1643 	/* store an index number for the vif you wanna use in the send */
1644 	case IP_MULTICAST_VIF:
1645 		if (legal_vif_num == 0) {
1646 			error = EOPNOTSUPP;
1647 			break;
1648 		}
1649 		error = sooptcopyin(sopt, &i, sizeof i, sizeof i);
1650 		if (error)
1651 			break;
1652 		if (!legal_vif_num(i) && (i != -1)) {
1653 			error = EINVAL;
1654 			break;
1655 		}
1656 		imo->imo_multicast_vif = i;
1657 		break;
1658 
1659 	case IP_MULTICAST_IF:
1660 		/*
1661 		 * Select the interface for outgoing multicast packets.
1662 		 */
1663 		error = sooptcopyin(sopt, &addr, sizeof addr, sizeof addr);
1664 		if (error)
1665 			break;
1666 		/*
1667 		 * INADDR_ANY is used to remove a previous selection.
1668 		 * When no interface is selected, a default one is
1669 		 * chosen every time a multicast packet is sent.
1670 		 */
1671 		if (addr.s_addr == INADDR_ANY) {
1672 			imo->imo_multicast_ifp = NULL;
1673 			break;
1674 		}
1675 		/*
1676 		 * The selected interface is identified by its local
1677 		 * IP address.  Find the interface and confirm that
1678 		 * it supports multicasting.
1679 		 */
1680 		s = splimp();
1681 		ifp = ip_multicast_if(&addr, &ifindex);
1682 		if (ifp == NULL || (ifp->if_flags & IFF_MULTICAST) == 0) {
1683 			splx(s);
1684 			error = EADDRNOTAVAIL;
1685 			break;
1686 		}
1687 		imo->imo_multicast_ifp = ifp;
1688 		if (ifindex)
1689 			imo->imo_multicast_addr = addr;
1690 		else
1691 			imo->imo_multicast_addr.s_addr = INADDR_ANY;
1692 		splx(s);
1693 		break;
1694 
1695 	case IP_MULTICAST_TTL:
1696 		/*
1697 		 * Set the IP time-to-live for outgoing multicast packets.
1698 		 * The original multicast API required a char argument,
1699 		 * which is inconsistent with the rest of the socket API.
1700 		 * We allow either a char or an int.
1701 		 */
1702 		if (sopt->sopt_valsize == 1) {
1703 			u_char ttl;
1704 			error = sooptcopyin(sopt, &ttl, 1, 1);
1705 			if (error)
1706 				break;
1707 			imo->imo_multicast_ttl = ttl;
1708 		} else {
1709 			u_int ttl;
1710 			error = sooptcopyin(sopt, &ttl, sizeof ttl,
1711 					    sizeof ttl);
1712 			if (error)
1713 				break;
1714 			if (ttl > 255)
1715 				error = EINVAL;
1716 			else
1717 				imo->imo_multicast_ttl = ttl;
1718 		}
1719 		break;
1720 
1721 	case IP_MULTICAST_LOOP:
1722 		/*
1723 		 * Set the loopback flag for outgoing multicast packets.
1724 		 * Must be zero or one.  The original multicast API required a
1725 		 * char argument, which is inconsistent with the rest
1726 		 * of the socket API.  We allow either a char or an int.
1727 		 */
1728 		if (sopt->sopt_valsize == 1) {
1729 			u_char loop;
1730 			error = sooptcopyin(sopt, &loop, 1, 1);
1731 			if (error)
1732 				break;
1733 			imo->imo_multicast_loop = !!loop;
1734 		} else {
1735 			u_int loop;
1736 			error = sooptcopyin(sopt, &loop, sizeof loop,
1737 					    sizeof loop);
1738 			if (error)
1739 				break;
1740 			imo->imo_multicast_loop = !!loop;
1741 		}
1742 		break;
1743 
1744 	case IP_ADD_MEMBERSHIP:
1745 		/*
1746 		 * Add a multicast group membership.
1747 		 * Group must be a valid IP multicast address.
1748 		 */
1749 		error = sooptcopyin(sopt, &mreq, sizeof mreq, sizeof mreq);
1750 		if (error)
1751 			break;
1752 
1753 		if (!IN_MULTICAST(ntohl(mreq.imr_multiaddr.s_addr))) {
1754 			error = EINVAL;
1755 			break;
1756 		}
1757 		s = splimp();
1758 		/*
1759 		 * If no interface address was provided, use the interface of
1760 		 * the route to the given multicast address.
1761 		 */
1762 		if (mreq.imr_interface.s_addr == INADDR_ANY) {
1763 			bzero((caddr_t)&ro, sizeof(ro));
1764 			dst = (struct sockaddr_in *)&ro.ro_dst;
1765 			dst->sin_len = sizeof(*dst);
1766 			dst->sin_family = AF_INET;
1767 			dst->sin_addr = mreq.imr_multiaddr;
1768 			rtalloc(&ro);
1769 			if (ro.ro_rt == NULL) {
1770 				error = EADDRNOTAVAIL;
1771 				splx(s);
1772 				break;
1773 			}
1774 			ifp = ro.ro_rt->rt_ifp;
1775 			rtfree(ro.ro_rt);
1776 		}
1777 		else {
1778 			ifp = ip_multicast_if(&mreq.imr_interface, NULL);
1779 		}
1780 
1781 		/*
1782 		 * See if we found an interface, and confirm that it
1783 		 * supports multicast.
1784 		 */
1785 		if (ifp == NULL || (ifp->if_flags & IFF_MULTICAST) == 0) {
1786 			error = EADDRNOTAVAIL;
1787 			splx(s);
1788 			break;
1789 		}
1790 		/*
1791 		 * See if the membership already exists or if all the
1792 		 * membership slots are full.
1793 		 */
1794 		for (i = 0; i < imo->imo_num_memberships; ++i) {
1795 			if (imo->imo_membership[i]->inm_ifp == ifp &&
1796 			    imo->imo_membership[i]->inm_addr.s_addr
1797 						== mreq.imr_multiaddr.s_addr)
1798 				break;
1799 		}
1800 		if (i < imo->imo_num_memberships) {
1801 			error = EADDRINUSE;
1802 			splx(s);
1803 			break;
1804 		}
1805 		if (i == IP_MAX_MEMBERSHIPS) {
1806 			error = ETOOMANYREFS;
1807 			splx(s);
1808 			break;
1809 		}
1810 		/*
1811 		 * Everything looks good; add a new record to the multicast
1812 		 * address list for the given interface.
1813 		 */
1814 		if ((imo->imo_membership[i] =
1815 		    in_addmulti(&mreq.imr_multiaddr, ifp)) == NULL) {
1816 			error = ENOBUFS;
1817 			splx(s);
1818 			break;
1819 		}
1820 		++imo->imo_num_memberships;
1821 		splx(s);
1822 		break;
1823 
1824 	case IP_DROP_MEMBERSHIP:
1825 		/*
1826 		 * Drop a multicast group membership.
1827 		 * Group must be a valid IP multicast address.
1828 		 */
1829 		error = sooptcopyin(sopt, &mreq, sizeof mreq, sizeof mreq);
1830 		if (error)
1831 			break;
1832 
1833 		if (!IN_MULTICAST(ntohl(mreq.imr_multiaddr.s_addr))) {
1834 			error = EINVAL;
1835 			break;
1836 		}
1837 
1838 		s = splimp();
1839 		/*
1840 		 * If an interface address was specified, get a pointer
1841 		 * to its ifnet structure.
1842 		 */
1843 		if (mreq.imr_interface.s_addr == INADDR_ANY)
1844 			ifp = NULL;
1845 		else {
1846 			ifp = ip_multicast_if(&mreq.imr_interface, NULL);
1847 			if (ifp == NULL) {
1848 				error = EADDRNOTAVAIL;
1849 				splx(s);
1850 				break;
1851 			}
1852 		}
1853 		/*
1854 		 * Find the membership in the membership array.
1855 		 */
1856 		for (i = 0; i < imo->imo_num_memberships; ++i) {
1857 			if ((ifp == NULL ||
1858 			     imo->imo_membership[i]->inm_ifp == ifp) &&
1859 			     imo->imo_membership[i]->inm_addr.s_addr ==
1860 			     mreq.imr_multiaddr.s_addr)
1861 				break;
1862 		}
1863 		if (i == imo->imo_num_memberships) {
1864 			error = EADDRNOTAVAIL;
1865 			splx(s);
1866 			break;
1867 		}
1868 		/*
1869 		 * Give up the multicast address record to which the
1870 		 * membership points.
1871 		 */
1872 		in_delmulti(imo->imo_membership[i]);
1873 		/*
1874 		 * Remove the gap in the membership array.
1875 		 */
1876 		for (++i; i < imo->imo_num_memberships; ++i)
1877 			imo->imo_membership[i-1] = imo->imo_membership[i];
1878 		--imo->imo_num_memberships;
1879 		splx(s);
1880 		break;
1881 
1882 	default:
1883 		error = EOPNOTSUPP;
1884 		break;
1885 	}
1886 
1887 	/*
1888 	 * If all options have default values, no need to keep the mbuf.
1889 	 */
1890 	if (imo->imo_multicast_ifp == NULL &&
1891 	    imo->imo_multicast_vif == -1 &&
1892 	    imo->imo_multicast_ttl == IP_DEFAULT_MULTICAST_TTL &&
1893 	    imo->imo_multicast_loop == IP_DEFAULT_MULTICAST_LOOP &&
1894 	    imo->imo_num_memberships == 0) {
1895 		free(*imop, M_IPMOPTS);
1896 		*imop = NULL;
1897 	}
1898 
1899 	return (error);
1900 }
1901 
1902 /*
1903  * Return the IP multicast options in response to user getsockopt().
1904  */
1905 static int
1906 ip_getmoptions(sopt, imo)
1907 	struct sockopt *sopt;
1908 	register struct ip_moptions *imo;
1909 {
1910 	struct in_addr addr;
1911 	struct in_ifaddr *ia;
1912 	int error, optval;
1913 	u_char coptval;
1914 
1915 	error = 0;
1916 	switch (sopt->sopt_name) {
1917 	case IP_MULTICAST_VIF:
1918 		if (imo != NULL)
1919 			optval = imo->imo_multicast_vif;
1920 		else
1921 			optval = -1;
1922 		error = sooptcopyout(sopt, &optval, sizeof optval);
1923 		break;
1924 
1925 	case IP_MULTICAST_IF:
1926 		if (imo == NULL || imo->imo_multicast_ifp == NULL)
1927 			addr.s_addr = INADDR_ANY;
1928 		else if (imo->imo_multicast_addr.s_addr) {
1929 			/* return the value user has set */
1930 			addr = imo->imo_multicast_addr;
1931 		} else {
1932 			IFP_TO_IA(imo->imo_multicast_ifp, ia);
1933 			addr.s_addr = (ia == NULL) ? INADDR_ANY
1934 				: IA_SIN(ia)->sin_addr.s_addr;
1935 		}
1936 		error = sooptcopyout(sopt, &addr, sizeof addr);
1937 		break;
1938 
1939 	case IP_MULTICAST_TTL:
1940 		if (imo == 0)
1941 			optval = coptval = IP_DEFAULT_MULTICAST_TTL;
1942 		else
1943 			optval = coptval = imo->imo_multicast_ttl;
1944 		if (sopt->sopt_valsize == 1)
1945 			error = sooptcopyout(sopt, &coptval, 1);
1946 		else
1947 			error = sooptcopyout(sopt, &optval, sizeof optval);
1948 		break;
1949 
1950 	case IP_MULTICAST_LOOP:
1951 		if (imo == 0)
1952 			optval = coptval = IP_DEFAULT_MULTICAST_LOOP;
1953 		else
1954 			optval = coptval = imo->imo_multicast_loop;
1955 		if (sopt->sopt_valsize == 1)
1956 			error = sooptcopyout(sopt, &coptval, 1);
1957 		else
1958 			error = sooptcopyout(sopt, &optval, sizeof optval);
1959 		break;
1960 
1961 	default:
1962 		error = ENOPROTOOPT;
1963 		break;
1964 	}
1965 	return (error);
1966 }
1967 
1968 /*
1969  * Discard the IP multicast options.
1970  */
1971 void
1972 ip_freemoptions(imo)
1973 	register struct ip_moptions *imo;
1974 {
1975 	register int i;
1976 
1977 	if (imo != NULL) {
1978 		for (i = 0; i < imo->imo_num_memberships; ++i)
1979 			in_delmulti(imo->imo_membership[i]);
1980 		free(imo, M_IPMOPTS);
1981 	}
1982 }
1983 
1984 /*
1985  * Routine called from ip_output() to loop back a copy of an IP multicast
1986  * packet to the input queue of a specified interface.  Note that this
1987  * calls the output routine of the loopback "driver", but with an interface
1988  * pointer that might NOT be a loopback interface -- evil, but easier than
1989  * replicating that code here.
1990  */
1991 static void
1992 ip_mloopback(ifp, m, dst, hlen)
1993 	struct ifnet *ifp;
1994 	register struct mbuf *m;
1995 	register struct sockaddr_in *dst;
1996 	int hlen;
1997 {
1998 	register struct ip *ip;
1999 	struct mbuf *copym;
2000 
2001 	copym = m_copy(m, 0, M_COPYALL);
2002 	if (copym != NULL && (copym->m_flags & M_EXT || copym->m_len < hlen))
2003 		copym = m_pullup(copym, hlen);
2004 	if (copym != NULL) {
2005 		/*
2006 		 * We don't bother to fragment if the IP length is greater
2007 		 * than the interface's MTU.  Can this possibly matter?
2008 		 */
2009 		ip = mtod(copym, struct ip *);
2010 		ip->ip_len = htons(ip->ip_len);
2011 		ip->ip_off = htons(ip->ip_off);
2012 		ip->ip_sum = 0;
2013 		if (ip->ip_vhl == IP_VHL_BORING) {
2014 			ip->ip_sum = in_cksum_hdr(ip);
2015 		} else {
2016 			ip->ip_sum = in_cksum(copym, hlen);
2017 		}
2018 		/*
2019 		 * NB:
2020 		 * It's not clear whether there are any lingering
2021 		 * reentrancy problems in other areas which might
2022 		 * be exposed by using ip_input directly (in
2023 		 * particular, everything which modifies the packet
2024 		 * in-place).  Yet another option is using the
2025 		 * protosw directly to deliver the looped back
2026 		 * packet.  For the moment, we'll err on the side
2027 		 * of safety by using if_simloop().
2028 		 */
2029 #if 1 /* XXX */
2030 		if (dst->sin_family != AF_INET) {
2031 			printf("ip_mloopback: bad address family %d\n",
2032 						dst->sin_family);
2033 			dst->sin_family = AF_INET;
2034 		}
2035 #endif
2036 
2037 #ifdef notdef
2038 		copym->m_pkthdr.rcvif = ifp;
2039 		ip_input(copym);
2040 #else
2041 		/* if the checksum hasn't been computed, mark it as valid */
2042 		if (copym->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
2043 			copym->m_pkthdr.csum_flags |=
2044 			    CSUM_DATA_VALID | CSUM_PSEUDO_HDR;
2045 			copym->m_pkthdr.csum_data = 0xffff;
2046 		}
2047 		if_simloop(ifp, copym, dst->sin_family, 0);
2048 #endif
2049 	}
2050 }
2051