xref: /freebsd/sys/netinet/ip_output.c (revision 6b3455a7665208c366849f0b2b3bc916fb97516e)
1 /*
2  * Copyright (c) 1982, 1986, 1988, 1990, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 4. Neither the name of the University nor the names of its contributors
14  *    may be used to endorse or promote products derived from this software
15  *    without specific prior written permission.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  *
29  *	@(#)ip_output.c	8.3 (Berkeley) 1/21/94
30  * $FreeBSD$
31  */
32 
33 #include "opt_ipfw.h"
34 #include "opt_ipdn.h"
35 #include "opt_ipdivert.h"
36 #include "opt_ipfilter.h"
37 #include "opt_ipsec.h"
38 #include "opt_mac.h"
39 #include "opt_pfil_hooks.h"
40 #include "opt_random_ip_id.h"
41 #include "opt_mbuf_stress_test.h"
42 
43 #include <sys/param.h>
44 #include <sys/systm.h>
45 #include <sys/kernel.h>
46 #include <sys/mac.h>
47 #include <sys/malloc.h>
48 #include <sys/mbuf.h>
49 #include <sys/protosw.h>
50 #include <sys/socket.h>
51 #include <sys/socketvar.h>
52 #include <sys/sysctl.h>
53 
54 #include <net/if.h>
55 #include <net/route.h>
56 
57 #include <netinet/in.h>
58 #include <netinet/in_systm.h>
59 #include <netinet/ip.h>
60 #include <netinet/in_pcb.h>
61 #include <netinet/in_var.h>
62 #include <netinet/ip_var.h>
63 
64 #ifdef PFIL_HOOKS
65 #include <net/pfil.h>
66 #endif
67 
68 #include <machine/in_cksum.h>
69 
70 static MALLOC_DEFINE(M_IPMOPTS, "ip_moptions", "internet multicast options");
71 
72 #ifdef IPSEC
73 #include <netinet6/ipsec.h>
74 #include <netkey/key.h>
75 #ifdef IPSEC_DEBUG
76 #include <netkey/key_debug.h>
77 #else
78 #define	KEYDEBUG(lev,arg)
79 #endif
80 #endif /*IPSEC*/
81 
82 #ifdef FAST_IPSEC
83 #include <netipsec/ipsec.h>
84 #include <netipsec/xform.h>
85 #include <netipsec/key.h>
86 #endif /*FAST_IPSEC*/
87 
88 #include <netinet/ip_fw.h>
89 #include <netinet/ip_divert.h>
90 #include <netinet/ip_dummynet.h>
91 
92 #define print_ip(x, a, y)	 printf("%s %d.%d.%d.%d%s",\
93 				x, (ntohl(a.s_addr)>>24)&0xFF,\
94 				  (ntohl(a.s_addr)>>16)&0xFF,\
95 				  (ntohl(a.s_addr)>>8)&0xFF,\
96 				  (ntohl(a.s_addr))&0xFF, y);
97 
98 u_short ip_id;
99 
100 #ifdef MBUF_STRESS_TEST
101 int mbuf_frag_size = 0;
102 SYSCTL_INT(_net_inet_ip, OID_AUTO, mbuf_frag_size, CTLFLAG_RW,
103 	&mbuf_frag_size, 0, "Fragment outgoing mbufs to this size");
104 #endif
105 
106 static struct mbuf *ip_insertoptions(struct mbuf *, struct mbuf *, int *);
107 static struct ifnet *ip_multicast_if(struct in_addr *, int *);
108 static void	ip_mloopback
109 	(struct ifnet *, struct mbuf *, struct sockaddr_in *, int);
110 static int	ip_getmoptions
111 	(struct sockopt *, struct ip_moptions *);
112 static int	ip_pcbopts(int, struct mbuf **, struct mbuf *);
113 static int	ip_setmoptions
114 	(struct sockopt *, struct ip_moptions **);
115 
116 int	ip_optcopy(struct ip *, struct ip *);
117 
118 
119 extern	struct protosw inetsw[];
120 
121 /*
122  * IP output.  The packet in mbuf chain m contains a skeletal IP
123  * header (with len, off, ttl, proto, tos, src, dst).
124  * The mbuf chain containing the packet will be freed.
125  * The mbuf opt, if present, will not be freed.
126  * In the IP forwarding case, the packet will arrive with options already
127  * inserted, so must have a NULL opt pointer.
128  */
129 int
130 ip_output(struct mbuf *m, struct mbuf *opt, struct route *ro,
131 	int flags, struct ip_moptions *imo, struct inpcb *inp)
132 {
133 	struct ip *ip;
134 	struct ifnet *ifp = NULL;	/* keep compiler happy */
135 	struct mbuf *m0;
136 	int hlen = sizeof (struct ip);
137 	int len, off, error = 0;
138 	struct sockaddr_in *dst = NULL;	/* keep compiler happy */
139 	struct in_ifaddr *ia = NULL;
140 	int isbroadcast, sw_csum;
141 	struct in_addr pkt_dst;
142 	struct route iproute;
143 	struct m_tag *mtag, *dummytag;
144 #ifdef IPSEC
145 	struct secpolicy *sp = NULL;
146 #endif
147 #ifdef FAST_IPSEC
148 	struct secpolicy *sp = NULL;
149 	struct tdb_ident *tdbi;
150 	int s;
151 #endif /* FAST_IPSEC */
152 	struct ip_fw_args args;
153 	int src_was_INADDR_ANY = 0;	/* as the name says... */
154 
155 	args.eh = NULL;
156 	args.rule = NULL;
157 
158 	M_ASSERTPKTHDR(m);
159 
160 	args.next_hop = m_claim_next(m, PACKET_TAG_IPFORWARD);
161 	dummytag = m_tag_find(m, PACKET_TAG_DUMMYNET, NULL);
162 	if (dummytag != NULL) {
163 		struct dn_pkt_tag *dt = (struct dn_pkt_tag *)(dummytag+1);
164 		/*
165 		 * Prevent lower layers from finding the tag
166 		 * Cleanup and free is done below
167 		 */
168 		m_tag_unlink(m, dummytag);
169 		/*
170 		 * the packet was already tagged, so part of the
171 		 * processing was already done, and we need to go down.
172 		 * Get parameters from the header.
173 		 */
174 		args.rule = dt->rule;
175 		ro = &(dt->ro);
176 		dst = dt->dn_dst;
177 		ifp = dt->ifp;
178 	}
179 
180 	if (ro == NULL) {
181 		ro = &iproute;
182 		bzero(ro, sizeof (*ro));
183 	}
184 
185 	if (inp != NULL)
186 		INP_LOCK_ASSERT(inp);
187 
188 	if (args.rule != NULL) {	/* dummynet already saw us */
189 		ip = mtod(m, struct ip *);
190 		hlen = ip->ip_hl << 2 ;
191 		if (ro->ro_rt)
192 			ia = ifatoia(ro->ro_rt->rt_ifa);
193 		goto sendit;
194 	}
195 
196 	if (opt) {
197 		len = 0;
198 		m = ip_insertoptions(m, opt, &len);
199 		if (len != 0)
200 			hlen = len;
201 	}
202 	ip = mtod(m, struct ip *);
203 	pkt_dst = args.next_hop ? args.next_hop->sin_addr : ip->ip_dst;
204 
205 	/*
206 	 * Fill in IP header.  If we are not allowing fragmentation,
207 	 * then the ip_id field is meaningless, but we don't set it
208 	 * to zero.  Doing so causes various problems when devices along
209 	 * the path (routers, load balancers, firewalls, etc.) illegally
210 	 * disable DF on our packet.  Note that a 16-bit counter
211 	 * will wrap around in less than 10 seconds at 100 Mbit/s on a
212 	 * medium with MTU 1500.  See Steven M. Bellovin, "A Technique
213 	 * for Counting NATted Hosts", Proc. IMW'02, available at
214 	 * <http://www.research.att.com/~smb/papers/fnat.pdf>.
215 	 */
216 	if ((flags & (IP_FORWARDING|IP_RAWOUTPUT)) == 0) {
217 		ip->ip_v = IPVERSION;
218 		ip->ip_hl = hlen >> 2;
219 #ifdef RANDOM_IP_ID
220 		ip->ip_id = ip_randomid();
221 #else
222 		ip->ip_id = htons(ip_id++);
223 #endif
224 		ipstat.ips_localout++;
225 	} else {
226 		hlen = ip->ip_hl << 2;
227 	}
228 
229 	dst = (struct sockaddr_in *)&ro->ro_dst;
230 	/*
231 	 * If there is a cached route,
232 	 * check that it is to the same destination
233 	 * and is still up.  If not, free it and try again.
234 	 * The address family should also be checked in case of sharing the
235 	 * cache with IPv6.
236 	 */
237 	if (ro->ro_rt && ((ro->ro_rt->rt_flags & RTF_UP) == 0 ||
238 			  dst->sin_family != AF_INET ||
239 			  dst->sin_addr.s_addr != pkt_dst.s_addr)) {
240 		RTFREE(ro->ro_rt);
241 		ro->ro_rt = (struct rtentry *)0;
242 	}
243 	if (ro->ro_rt == 0) {
244 		bzero(dst, sizeof(*dst));
245 		dst->sin_family = AF_INET;
246 		dst->sin_len = sizeof(*dst);
247 		dst->sin_addr = pkt_dst;
248 	}
249 	/*
250 	 * If routing to interface only,
251 	 * short circuit routing lookup.
252 	 */
253 	if (flags & IP_ROUTETOIF) {
254 		if ((ia = ifatoia(ifa_ifwithdstaddr(sintosa(dst)))) == 0 &&
255 		    (ia = ifatoia(ifa_ifwithnet(sintosa(dst)))) == 0) {
256 			ipstat.ips_noroute++;
257 			error = ENETUNREACH;
258 			goto bad;
259 		}
260 		ifp = ia->ia_ifp;
261 		ip->ip_ttl = 1;
262 		isbroadcast = in_broadcast(dst->sin_addr, ifp);
263 	} else if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) &&
264 	    imo != NULL && imo->imo_multicast_ifp != NULL) {
265 		/*
266 		 * Bypass the normal routing lookup for multicast
267 		 * packets if the interface is specified.
268 		 */
269 		ifp = imo->imo_multicast_ifp;
270 		IFP_TO_IA(ifp, ia);
271 		isbroadcast = 0;	/* fool gcc */
272 	} else {
273 		/*
274 		 * We want to do any cloning requested by the link layer,
275 		 * as this is probably required in all cases for correct
276 		 * operation (as it is for ARP).
277 		 */
278 		if (ro->ro_rt == 0)
279 			rtalloc_ign(ro, 0);
280 		if (ro->ro_rt == 0) {
281 			ipstat.ips_noroute++;
282 			error = EHOSTUNREACH;
283 			goto bad;
284 		}
285 		ia = ifatoia(ro->ro_rt->rt_ifa);
286 		ifp = ro->ro_rt->rt_ifp;
287 		ro->ro_rt->rt_rmx.rmx_pksent++;
288 		if (ro->ro_rt->rt_flags & RTF_GATEWAY)
289 			dst = (struct sockaddr_in *)ro->ro_rt->rt_gateway;
290 		if (ro->ro_rt->rt_flags & RTF_HOST)
291 			isbroadcast = (ro->ro_rt->rt_flags & RTF_BROADCAST);
292 		else
293 			isbroadcast = in_broadcast(dst->sin_addr, ifp);
294 	}
295 	if (IN_MULTICAST(ntohl(pkt_dst.s_addr))) {
296 		struct in_multi *inm;
297 
298 		m->m_flags |= M_MCAST;
299 		/*
300 		 * IP destination address is multicast.  Make sure "dst"
301 		 * still points to the address in "ro".  (It may have been
302 		 * changed to point to a gateway address, above.)
303 		 */
304 		dst = (struct sockaddr_in *)&ro->ro_dst;
305 		/*
306 		 * See if the caller provided any multicast options
307 		 */
308 		if (imo != NULL) {
309 			ip->ip_ttl = imo->imo_multicast_ttl;
310 			if (imo->imo_multicast_vif != -1)
311 				ip->ip_src.s_addr =
312 				    ip_mcast_src ?
313 				    ip_mcast_src(imo->imo_multicast_vif) :
314 				    INADDR_ANY;
315 		} else
316 			ip->ip_ttl = IP_DEFAULT_MULTICAST_TTL;
317 		/*
318 		 * Confirm that the outgoing interface supports multicast.
319 		 */
320 		if ((imo == NULL) || (imo->imo_multicast_vif == -1)) {
321 			if ((ifp->if_flags & IFF_MULTICAST) == 0) {
322 				ipstat.ips_noroute++;
323 				error = ENETUNREACH;
324 				goto bad;
325 			}
326 		}
327 		/*
328 		 * If source address not specified yet, use address
329 		 * of outgoing interface.
330 		 */
331 		if (ip->ip_src.s_addr == INADDR_ANY) {
332 			/* Interface may have no addresses. */
333 			if (ia != NULL)
334 				ip->ip_src = IA_SIN(ia)->sin_addr;
335 		}
336 
337 		IN_LOOKUP_MULTI(pkt_dst, ifp, inm);
338 		if (inm != NULL &&
339 		   (imo == NULL || imo->imo_multicast_loop)) {
340 			/*
341 			 * If we belong to the destination multicast group
342 			 * on the outgoing interface, and the caller did not
343 			 * forbid loopback, loop back a copy.
344 			 */
345 			ip_mloopback(ifp, m, dst, hlen);
346 		}
347 		else {
348 			/*
349 			 * If we are acting as a multicast router, perform
350 			 * multicast forwarding as if the packet had just
351 			 * arrived on the interface to which we are about
352 			 * to send.  The multicast forwarding function
353 			 * recursively calls this function, using the
354 			 * IP_FORWARDING flag to prevent infinite recursion.
355 			 *
356 			 * Multicasts that are looped back by ip_mloopback(),
357 			 * above, will be forwarded by the ip_input() routine,
358 			 * if necessary.
359 			 */
360 			if (ip_mrouter && (flags & IP_FORWARDING) == 0) {
361 				/*
362 				 * If rsvp daemon is not running, do not
363 				 * set ip_moptions. This ensures that the packet
364 				 * is multicast and not just sent down one link
365 				 * as prescribed by rsvpd.
366 				 */
367 				if (!rsvp_on)
368 					imo = NULL;
369 				if (ip_mforward &&
370 				    ip_mforward(ip, ifp, m, imo) != 0) {
371 					m_freem(m);
372 					goto done;
373 				}
374 			}
375 		}
376 
377 		/*
378 		 * Multicasts with a time-to-live of zero may be looped-
379 		 * back, above, but must not be transmitted on a network.
380 		 * Also, multicasts addressed to the loopback interface
381 		 * are not sent -- the above call to ip_mloopback() will
382 		 * loop back a copy if this host actually belongs to the
383 		 * destination group on the loopback interface.
384 		 */
385 		if (ip->ip_ttl == 0 || ifp->if_flags & IFF_LOOPBACK) {
386 			m_freem(m);
387 			goto done;
388 		}
389 
390 		goto sendit;
391 	}
392 #ifndef notdef
393 	/*
394 	 * If the source address is not specified yet, use the address
395 	 * of the outoing interface. In case, keep note we did that, so
396 	 * if the the firewall changes the next-hop causing the output
397 	 * interface to change, we can fix that.
398 	 */
399 	if (ip->ip_src.s_addr == INADDR_ANY) {
400 		/* Interface may have no addresses. */
401 		if (ia != NULL) {
402 			ip->ip_src = IA_SIN(ia)->sin_addr;
403 			src_was_INADDR_ANY = 1;
404 		}
405 	}
406 #endif /* notdef */
407 #ifdef ALTQ
408 	/*
409 	 * disable packet drop hack.
410 	 * packetdrop should be done by queueing.
411 	 */
412 #else /* !ALTQ */
413 	/*
414 	 * Verify that we have any chance at all of being able to queue
415 	 *      the packet or packet fragments
416 	 */
417 	if ((ifp->if_snd.ifq_len + ip->ip_len / ifp->if_mtu + 1) >=
418 		ifp->if_snd.ifq_maxlen) {
419 			error = ENOBUFS;
420 			ipstat.ips_odropped++;
421 			goto bad;
422 	}
423 #endif /* !ALTQ */
424 
425 	/*
426 	 * Look for broadcast address and
427 	 * verify user is allowed to send
428 	 * such a packet.
429 	 */
430 	if (isbroadcast) {
431 		if ((ifp->if_flags & IFF_BROADCAST) == 0) {
432 			error = EADDRNOTAVAIL;
433 			goto bad;
434 		}
435 		if ((flags & IP_ALLOWBROADCAST) == 0) {
436 			error = EACCES;
437 			goto bad;
438 		}
439 		/* don't allow broadcast messages to be fragmented */
440 		if (ip->ip_len > ifp->if_mtu) {
441 			error = EMSGSIZE;
442 			goto bad;
443 		}
444 		if (flags & IP_SENDONES)
445 			ip->ip_dst.s_addr = INADDR_BROADCAST;
446 		m->m_flags |= M_BCAST;
447 	} else {
448 		m->m_flags &= ~M_BCAST;
449 	}
450 
451 sendit:
452 #ifdef IPSEC
453 	/* get SP for this packet */
454 	if (inp == NULL)
455 		sp = ipsec4_getpolicybyaddr(m, IPSEC_DIR_OUTBOUND,
456 		    flags, &error);
457 	else
458 		sp = ipsec4_getpolicybypcb(m, IPSEC_DIR_OUTBOUND, inp, &error);
459 
460 	if (sp == NULL) {
461 		ipsecstat.out_inval++;
462 		goto bad;
463 	}
464 
465 	error = 0;
466 
467 	/* check policy */
468 	switch (sp->policy) {
469 	case IPSEC_POLICY_DISCARD:
470 		/*
471 		 * This packet is just discarded.
472 		 */
473 		ipsecstat.out_polvio++;
474 		goto bad;
475 
476 	case IPSEC_POLICY_BYPASS:
477 	case IPSEC_POLICY_NONE:
478 	case IPSEC_POLICY_TCP:
479 		/* no need to do IPsec. */
480 		goto skip_ipsec;
481 
482 	case IPSEC_POLICY_IPSEC:
483 		if (sp->req == NULL) {
484 			/* acquire a policy */
485 			error = key_spdacquire(sp);
486 			goto bad;
487 		}
488 		break;
489 
490 	case IPSEC_POLICY_ENTRUST:
491 	default:
492 		printf("ip_output: Invalid policy found. %d\n", sp->policy);
493 	}
494     {
495 	struct ipsec_output_state state;
496 	bzero(&state, sizeof(state));
497 	state.m = m;
498 	if (flags & IP_ROUTETOIF) {
499 		state.ro = &iproute;
500 		bzero(&iproute, sizeof(iproute));
501 	} else
502 		state.ro = ro;
503 	state.dst = (struct sockaddr *)dst;
504 
505 	ip->ip_sum = 0;
506 
507 	/*
508 	 * XXX
509 	 * delayed checksums are not currently compatible with IPsec
510 	 */
511 	if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
512 		in_delayed_cksum(m);
513 		m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
514 	}
515 
516 	ip->ip_len = htons(ip->ip_len);
517 	ip->ip_off = htons(ip->ip_off);
518 
519 	error = ipsec4_output(&state, sp, flags);
520 
521 	m = state.m;
522 	if (flags & IP_ROUTETOIF) {
523 		/*
524 		 * if we have tunnel mode SA, we may need to ignore
525 		 * IP_ROUTETOIF.
526 		 */
527 		if (state.ro != &iproute || state.ro->ro_rt != NULL) {
528 			flags &= ~IP_ROUTETOIF;
529 			ro = state.ro;
530 		}
531 	} else
532 		ro = state.ro;
533 	dst = (struct sockaddr_in *)state.dst;
534 	if (error) {
535 		/* mbuf is already reclaimed in ipsec4_output. */
536 		m = NULL;
537 		switch (error) {
538 		case EHOSTUNREACH:
539 		case ENETUNREACH:
540 		case EMSGSIZE:
541 		case ENOBUFS:
542 		case ENOMEM:
543 			break;
544 		default:
545 			printf("ip4_output (ipsec): error code %d\n", error);
546 			/*fall through*/
547 		case ENOENT:
548 			/* don't show these error codes to the user */
549 			error = 0;
550 			break;
551 		}
552 		goto bad;
553 	}
554 
555 	/* be sure to update variables that are affected by ipsec4_output() */
556 	ip = mtod(m, struct ip *);
557 	hlen = ip->ip_hl << 2;
558 	if (ro->ro_rt == NULL) {
559 		if ((flags & IP_ROUTETOIF) == 0) {
560 			printf("ip_output: "
561 				"can't update route after IPsec processing\n");
562 			error = EHOSTUNREACH;	/*XXX*/
563 			goto bad;
564 		}
565 	} else {
566 		if (state.encap) {
567 			ia = ifatoia(ro->ro_rt->rt_ifa);
568 			ifp = ro->ro_rt->rt_ifp;
569 		}
570 	}
571     }
572 
573 	/* make it flipped, again. */
574 	ip->ip_len = ntohs(ip->ip_len);
575 	ip->ip_off = ntohs(ip->ip_off);
576 skip_ipsec:
577 #endif /*IPSEC*/
578 #ifdef FAST_IPSEC
579 	/*
580 	 * Check the security policy (SP) for the packet and, if
581 	 * required, do IPsec-related processing.  There are two
582 	 * cases here; the first time a packet is sent through
583 	 * it will be untagged and handled by ipsec4_checkpolicy.
584 	 * If the packet is resubmitted to ip_output (e.g. after
585 	 * AH, ESP, etc. processing), there will be a tag to bypass
586 	 * the lookup and related policy checking.
587 	 */
588 	mtag = m_tag_find(m, PACKET_TAG_IPSEC_PENDING_TDB, NULL);
589 	s = splnet();
590 	if (mtag != NULL) {
591 		tdbi = (struct tdb_ident *)(mtag + 1);
592 		sp = ipsec_getpolicy(tdbi, IPSEC_DIR_OUTBOUND);
593 		if (sp == NULL)
594 			error = -EINVAL;	/* force silent drop */
595 		m_tag_delete(m, mtag);
596 	} else {
597 		sp = ipsec4_checkpolicy(m, IPSEC_DIR_OUTBOUND, flags,
598 					&error, inp);
599 	}
600 	/*
601 	 * There are four return cases:
602 	 *    sp != NULL	 	    apply IPsec policy
603 	 *    sp == NULL, error == 0	    no IPsec handling needed
604 	 *    sp == NULL, error == -EINVAL  discard packet w/o error
605 	 *    sp == NULL, error != 0	    discard packet, report error
606 	 */
607 	if (sp != NULL) {
608 		/* Loop detection, check if ipsec processing already done */
609 		KASSERT(sp->req != NULL, ("ip_output: no ipsec request"));
610 		for (mtag = m_tag_first(m); mtag != NULL;
611 		     mtag = m_tag_next(m, mtag)) {
612 			if (mtag->m_tag_cookie != MTAG_ABI_COMPAT)
613 				continue;
614 			if (mtag->m_tag_id != PACKET_TAG_IPSEC_OUT_DONE &&
615 			    mtag->m_tag_id != PACKET_TAG_IPSEC_OUT_CRYPTO_NEEDED)
616 				continue;
617 			/*
618 			 * Check if policy has an SA associated with it.
619 			 * This can happen when an SP has yet to acquire
620 			 * an SA; e.g. on first reference.  If it occurs,
621 			 * then we let ipsec4_process_packet do its thing.
622 			 */
623 			if (sp->req->sav == NULL)
624 				break;
625 			tdbi = (struct tdb_ident *)(mtag + 1);
626 			if (tdbi->spi == sp->req->sav->spi &&
627 			    tdbi->proto == sp->req->sav->sah->saidx.proto &&
628 			    bcmp(&tdbi->dst, &sp->req->sav->sah->saidx.dst,
629 				 sizeof (union sockaddr_union)) == 0) {
630 				/*
631 				 * No IPsec processing is needed, free
632 				 * reference to SP.
633 				 *
634 				 * NB: null pointer to avoid free at
635 				 *     done: below.
636 				 */
637 				KEY_FREESP(&sp), sp = NULL;
638 				splx(s);
639 				goto spd_done;
640 			}
641 		}
642 
643 		/*
644 		 * Do delayed checksums now because we send before
645 		 * this is done in the normal processing path.
646 		 */
647 		if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
648 			in_delayed_cksum(m);
649 			m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
650 		}
651 
652 		ip->ip_len = htons(ip->ip_len);
653 		ip->ip_off = htons(ip->ip_off);
654 
655 		/* NB: callee frees mbuf */
656 		error = ipsec4_process_packet(m, sp->req, flags, 0);
657 		/*
658 		 * Preserve KAME behaviour: ENOENT can be returned
659 		 * when an SA acquire is in progress.  Don't propagate
660 		 * this to user-level; it confuses applications.
661 		 *
662 		 * XXX this will go away when the SADB is redone.
663 		 */
664 		if (error == ENOENT)
665 			error = 0;
666 		splx(s);
667 		goto done;
668 	} else {
669 		splx(s);
670 
671 		if (error != 0) {
672 			/*
673 			 * Hack: -EINVAL is used to signal that a packet
674 			 * should be silently discarded.  This is typically
675 			 * because we asked key management for an SA and
676 			 * it was delayed (e.g. kicked up to IKE).
677 			 */
678 			if (error == -EINVAL)
679 				error = 0;
680 			goto bad;
681 		} else {
682 			/* No IPsec processing for this packet. */
683 		}
684 #ifdef notyet
685 		/*
686 		 * If deferred crypto processing is needed, check that
687 		 * the interface supports it.
688 		 */
689 		mtag = m_tag_find(m, PACKET_TAG_IPSEC_OUT_CRYPTO_NEEDED, NULL);
690 		if (mtag != NULL && (ifp->if_capenable & IFCAP_IPSEC) == 0) {
691 			/* notify IPsec to do its own crypto */
692 			ipsp_skipcrypto_unmark((struct tdb_ident *)(mtag + 1));
693 			error = EHOSTUNREACH;
694 			goto bad;
695 		}
696 #endif
697 	}
698 spd_done:
699 #endif /* FAST_IPSEC */
700 
701 	/*
702 	 * IpHack's section.
703 	 * - Xlate: translate packet's addr/port (NAT).
704 	 * - Firewall: deny/allow/etc.
705 	 * - Wrap: fake packet's addr/port <unimpl.>
706 	 * - Encapsulate: put it in another IP and send out. <unimp.>
707 	 */
708 #ifdef PFIL_HOOKS
709 	/*
710 	 * Run through list of hooks for output packets.
711 	 */
712 	error = pfil_run_hooks(&inet_pfil_hook, &m, ifp, PFIL_OUT);
713 	if (error != 0 || m == NULL)
714 		goto done;
715 	ip = mtod(m, struct ip *);
716 #endif /* PFIL_HOOKS */
717 
718 	/*
719 	 * Check with the firewall...
720 	 * but not if we are already being fwd'd from a firewall.
721 	 */
722 	if (fw_enable && IPFW_LOADED && !args.next_hop) {
723 		struct sockaddr_in *old = dst;
724 
725 		args.m = m;
726 		args.next_hop = dst;
727 		args.oif = ifp;
728 		off = ip_fw_chk_ptr(&args);
729 		m = args.m;
730 		dst = args.next_hop;
731 
732                 /*
733 		 * On return we must do the following:
734 		 * m == NULL	-> drop the pkt (old interface, deprecated)
735 		 * (off & IP_FW_PORT_DENY_FLAG)	-> drop the pkt (new interface)
736 		 * 1<=off<= 0xffff		-> DIVERT
737 		 * (off & IP_FW_PORT_DYNT_FLAG)	-> send to a DUMMYNET pipe
738 		 * (off & IP_FW_PORT_TEE_FLAG)	-> TEE the packet
739 		 * dst != old			-> IPFIREWALL_FORWARD
740 		 * off==0, dst==old		-> accept
741 		 * If some of the above modules are not compiled in, then
742 		 * we should't have to check the corresponding condition
743 		 * (because the ipfw control socket should not accept
744 		 * unsupported rules), but better play safe and drop
745 		 * packets in case of doubt.
746 		 */
747 		if ( (off & IP_FW_PORT_DENY_FLAG) || m == NULL) {
748 			if (m)
749 				m_freem(m);
750 			error = EACCES;
751 			goto done;
752 		}
753 		ip = mtod(m, struct ip *);
754 		if (off == 0 && dst == old)		/* common case */
755 			goto pass;
756                 if (DUMMYNET_LOADED && (off & IP_FW_PORT_DYNT_FLAG) != 0) {
757 			/*
758 			 * pass the pkt to dummynet. Need to include
759 			 * pipe number, m, ifp, ro, dst because these are
760 			 * not recomputed in the next pass.
761 			 * All other parameters have been already used and
762 			 * so they are not needed anymore.
763 			 * XXX note: if the ifp or ro entry are deleted
764 			 * while a pkt is in dummynet, we are in trouble!
765 			 */
766 			args.ro = ro;
767 			args.dst = dst;
768 			args.flags = flags;
769 
770 			error = ip_dn_io_ptr(m, off & 0xffff, DN_TO_IP_OUT,
771 				&args);
772 			goto done;
773 		}
774 #ifdef IPDIVERT
775 		if (off != 0 && (off & IP_FW_PORT_DYNT_FLAG) == 0) {
776 			struct mbuf *clone;
777 
778 			/* Clone packet if we're doing a 'tee' */
779 			if ((off & IP_FW_PORT_TEE_FLAG) != 0)
780 				clone = divert_clone(m);
781 			else
782 				clone = NULL;
783 
784 			/*
785 			 * XXX
786 			 * delayed checksums are not currently compatible
787 			 * with divert sockets.
788 			 */
789 			if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
790 				in_delayed_cksum(m);
791 				m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
792 			}
793 
794 			/* Restore packet header fields to original values */
795 			ip->ip_len = htons(ip->ip_len);
796 			ip->ip_off = htons(ip->ip_off);
797 
798 			/* Deliver packet to divert input routine */
799 			divert_packet(m, 0);
800 
801 			/* If 'tee', continue with original packet */
802 			if (clone != NULL) {
803 				m = clone;
804 				ip = mtod(m, struct ip *);
805 				goto pass;
806 			}
807 			goto done;
808 		}
809 #endif
810 
811 		/* IPFIREWALL_FORWARD */
812 		/*
813 		 * Check dst to make sure it is directly reachable on the
814 		 * interface we previously thought it was.
815 		 * If it isn't (which may be likely in some situations) we have
816 		 * to re-route it (ie, find a route for the next-hop and the
817 		 * associated interface) and set them here. This is nested
818 		 * forwarding which in most cases is undesirable, except where
819 		 * such control is nigh impossible. So we do it here.
820 		 * And I'm babbling.
821 		 */
822 		if (off == 0 && old != dst) { /* FORWARD, dst has changed */
823 #if 0
824 			/*
825 			 * XXX To improve readability, this block should be
826 			 * changed into a function call as below:
827 			 */
828 			error = ip_ipforward(&m, &dst, &ifp);
829 			if (error)
830 				goto bad;
831 			if (m == NULL) /* ip_input consumed the mbuf */
832 				goto done;
833 #else
834 			struct in_ifaddr *ia;
835 
836 			/*
837 			 * XXX sro_fwd below is static, and a pointer
838 			 * to it gets passed to routines downstream.
839 			 * This could have surprisingly bad results in
840 			 * practice, because its content is overwritten
841 			 * by subsequent packets.
842 			 */
843 			/* There must be a better way to do this next line... */
844 			static struct route sro_fwd;
845 			struct route *ro_fwd = &sro_fwd;
846 
847 #if 0
848 			print_ip("IPFIREWALL_FORWARD: New dst ip: ",
849 			    dst->sin_addr, "\n");
850 #endif
851 
852 			/*
853 			 * We need to figure out if we have been forwarded
854 			 * to a local socket. If so, then we should somehow
855 			 * "loop back" to ip_input, and get directed to the
856 			 * PCB as if we had received this packet. This is
857 			 * because it may be dificult to identify the packets
858 			 * you want to forward until they are being output
859 			 * and have selected an interface. (e.g. locally
860 			 * initiated packets) If we used the loopback inteface,
861 			 * we would not be able to control what happens
862 			 * as the packet runs through ip_input() as
863 			 * it is done through an ISR.
864 			 */
865 			LIST_FOREACH(ia,
866 			    INADDR_HASH(dst->sin_addr.s_addr), ia_hash) {
867 				/*
868 				 * If the addr to forward to is one
869 				 * of ours, we pretend to
870 				 * be the destination for this packet.
871 				 */
872 				if (IA_SIN(ia)->sin_addr.s_addr ==
873 						 dst->sin_addr.s_addr)
874 					break;
875 			}
876 			if (ia) {	/* tell ip_input "dont filter" */
877 				mtag = m_tag_get(
878 				    PACKET_TAG_IPFORWARD,
879 				    sizeof(struct sockaddr_in *), M_NOWAIT);
880 				if (mtag == NULL) {
881 					error = ENOBUFS;
882 					goto bad;
883 				}
884 				*(struct sockaddr_in **)(mtag+1) =
885 				    args.next_hop;
886 				m_tag_prepend(m, mtag);
887 
888 				if (m->m_pkthdr.rcvif == NULL)
889 					m->m_pkthdr.rcvif = ifunit("lo0");
890 				if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
891 					m->m_pkthdr.csum_flags |=
892 					    CSUM_DATA_VALID | CSUM_PSEUDO_HDR;
893 					m->m_pkthdr.csum_data = 0xffff;
894 				}
895 				m->m_pkthdr.csum_flags |=
896 				    CSUM_IP_CHECKED | CSUM_IP_VALID;
897 				ip->ip_len = htons(ip->ip_len);
898 				ip->ip_off = htons(ip->ip_off);
899 				ip_input(m);
900 				goto done;
901 			}
902 			/*
903 			 * Some of the logic for this was
904 			 * nicked from above.
905 			 */
906 			bcopy(dst, &ro_fwd->ro_dst, sizeof(*dst));
907 
908 			ro_fwd->ro_rt = 0;
909 			rtalloc_ign(ro_fwd, RTF_CLONING);
910 
911 			if (ro_fwd->ro_rt == 0) {
912 				ipstat.ips_noroute++;
913 				error = EHOSTUNREACH;
914 				goto bad;
915 			}
916 
917 			ia = ifatoia(ro_fwd->ro_rt->rt_ifa);
918 			ifp = ro_fwd->ro_rt->rt_ifp;
919 			ro_fwd->ro_rt->rt_rmx.rmx_pksent++;
920 			if (ro_fwd->ro_rt->rt_flags & RTF_GATEWAY)
921 				dst = (struct sockaddr_in *)
922 					ro_fwd->ro_rt->rt_gateway;
923 			if (ro_fwd->ro_rt->rt_flags & RTF_HOST)
924 				isbroadcast =
925 				    (ro_fwd->ro_rt->rt_flags & RTF_BROADCAST);
926 			else
927 				isbroadcast = in_broadcast(dst->sin_addr, ifp);
928 			if (ro->ro_rt)
929 				RTFREE(ro->ro_rt);
930 			ro->ro_rt = ro_fwd->ro_rt;
931 			dst = (struct sockaddr_in *)&ro_fwd->ro_dst;
932 
933 #endif	/* ... block to be put into a function */
934 			/*
935 			 * If we added a default src ip earlier,
936 			 * which would have been gotten from the-then
937 			 * interface, do it again, from the new one.
938 			 */
939 			if (src_was_INADDR_ANY)
940 				ip->ip_src = IA_SIN(ia)->sin_addr;
941 			goto pass ;
942 		}
943 
944                 /*
945                  * if we get here, none of the above matches, and
946                  * we have to drop the pkt
947                  */
948 		m_freem(m);
949                 error = EACCES; /* not sure this is the right error msg */
950                 goto done;
951 	}
952 
953 pass:
954 	/* 127/8 must not appear on wire - RFC1122. */
955 	if ((ntohl(ip->ip_dst.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET ||
956 	    (ntohl(ip->ip_src.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET) {
957 		if ((ifp->if_flags & IFF_LOOPBACK) == 0) {
958 			ipstat.ips_badaddr++;
959 			error = EADDRNOTAVAIL;
960 			goto bad;
961 		}
962 	}
963 
964 	m->m_pkthdr.csum_flags |= CSUM_IP;
965 	sw_csum = m->m_pkthdr.csum_flags & ~ifp->if_hwassist;
966 	if (sw_csum & CSUM_DELAY_DATA) {
967 		in_delayed_cksum(m);
968 		sw_csum &= ~CSUM_DELAY_DATA;
969 	}
970 	m->m_pkthdr.csum_flags &= ifp->if_hwassist;
971 
972 	/*
973 	 * If small enough for interface, or the interface will take
974 	 * care of the fragmentation for us, can just send directly.
975 	 */
976 	if (ip->ip_len <= ifp->if_mtu || (ifp->if_hwassist & CSUM_FRAGMENT &&
977 	    ((ip->ip_off & IP_DF) == 0))) {
978 		ip->ip_len = htons(ip->ip_len);
979 		ip->ip_off = htons(ip->ip_off);
980 		ip->ip_sum = 0;
981 		if (sw_csum & CSUM_DELAY_IP)
982 			ip->ip_sum = in_cksum(m, hlen);
983 
984 		/* Record statistics for this interface address. */
985 		if (!(flags & IP_FORWARDING) && ia) {
986 			ia->ia_ifa.if_opackets++;
987 			ia->ia_ifa.if_obytes += m->m_pkthdr.len;
988 		}
989 
990 #ifdef IPSEC
991 		/* clean ipsec history once it goes out of the node */
992 		ipsec_delaux(m);
993 #endif
994 
995 #ifdef MBUF_STRESS_TEST
996 		if (mbuf_frag_size && m->m_pkthdr.len > mbuf_frag_size)
997 			m = m_fragment(m, M_DONTWAIT, mbuf_frag_size);
998 #endif
999 		error = (*ifp->if_output)(ifp, m,
1000 				(struct sockaddr *)dst, ro->ro_rt);
1001 		goto done;
1002 	}
1003 
1004 	if (ip->ip_off & IP_DF) {
1005 		error = EMSGSIZE;
1006 		/*
1007 		 * This case can happen if the user changed the MTU
1008 		 * of an interface after enabling IP on it.  Because
1009 		 * most netifs don't keep track of routes pointing to
1010 		 * them, there is no way for one to update all its
1011 		 * routes when the MTU is changed.
1012 		 */
1013 		if ((ro->ro_rt->rt_flags & (RTF_UP | RTF_HOST)) &&
1014 		    (ro->ro_rt->rt_rmx.rmx_mtu > ifp->if_mtu)) {
1015 			ro->ro_rt->rt_rmx.rmx_mtu = ifp->if_mtu;
1016 		}
1017 		ipstat.ips_cantfrag++;
1018 		goto bad;
1019 	}
1020 
1021 	/*
1022 	 * Too large for interface; fragment if possible. If successful,
1023 	 * on return, m will point to a list of packets to be sent.
1024 	 */
1025 	error = ip_fragment(ip, &m, ifp->if_mtu, ifp->if_hwassist, sw_csum);
1026 	if (error)
1027 		goto bad;
1028 	for (; m; m = m0) {
1029 		m0 = m->m_nextpkt;
1030 		m->m_nextpkt = 0;
1031 #ifdef IPSEC
1032 		/* clean ipsec history once it goes out of the node */
1033 		ipsec_delaux(m);
1034 #endif
1035 		if (error == 0) {
1036 			/* Record statistics for this interface address. */
1037 			if (ia != NULL) {
1038 				ia->ia_ifa.if_opackets++;
1039 				ia->ia_ifa.if_obytes += m->m_pkthdr.len;
1040 			}
1041 
1042 			error = (*ifp->if_output)(ifp, m,
1043 			    (struct sockaddr *)dst, ro->ro_rt);
1044 		} else
1045 			m_freem(m);
1046 	}
1047 
1048 	if (error == 0)
1049 		ipstat.ips_fragmented++;
1050 
1051 done:
1052 	if (ro == &iproute && ro->ro_rt) {
1053 		RTFREE(ro->ro_rt);
1054 		ro->ro_rt = NULL;
1055 	}
1056 	if (dummytag) {
1057 		struct dn_pkt_tag *dt = (struct dn_pkt_tag *)(dummytag+1);
1058 		if (dt->ro.ro_rt)
1059 			RTFREE(dt->ro.ro_rt);
1060 		m_tag_free(dummytag);
1061 	}
1062 #ifdef IPSEC
1063 	if (sp != NULL) {
1064 		KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
1065 			printf("DP ip_output call free SP:%p\n", sp));
1066 		key_freesp(sp);
1067 	}
1068 #endif
1069 #ifdef FAST_IPSEC
1070 	if (sp != NULL)
1071 		KEY_FREESP(&sp);
1072 #endif
1073 	return (error);
1074 bad:
1075 	m_freem(m);
1076 	goto done;
1077 }
1078 
1079 /*
1080  * Create a chain of fragments which fit the given mtu. m_frag points to the
1081  * mbuf to be fragmented; on return it points to the chain with the fragments.
1082  * Return 0 if no error. If error, m_frag may contain a partially built
1083  * chain of fragments that should be freed by the caller.
1084  *
1085  * if_hwassist_flags is the hw offload capabilities (see if_data.ifi_hwassist)
1086  * sw_csum contains the delayed checksums flags (e.g., CSUM_DELAY_IP).
1087  */
1088 int
1089 ip_fragment(struct ip *ip, struct mbuf **m_frag, int mtu,
1090 	    u_long if_hwassist_flags, int sw_csum)
1091 {
1092 	int error = 0;
1093 	int hlen = ip->ip_hl << 2;
1094 	int len = (mtu - hlen) & ~7;	/* size of payload in each fragment */
1095 	int off;
1096 	struct mbuf *m0 = *m_frag;	/* the original packet		*/
1097 	int firstlen;
1098 	struct mbuf **mnext;
1099 	int nfrags;
1100 
1101 	if (ip->ip_off & IP_DF) {	/* Fragmentation not allowed */
1102 		ipstat.ips_cantfrag++;
1103 		return EMSGSIZE;
1104 	}
1105 
1106 	/*
1107 	 * Must be able to put at least 8 bytes per fragment.
1108 	 */
1109 	if (len < 8)
1110 		return EMSGSIZE;
1111 
1112 	/*
1113 	 * If the interface will not calculate checksums on
1114 	 * fragmented packets, then do it here.
1115 	 */
1116 	if (m0->m_pkthdr.csum_flags & CSUM_DELAY_DATA &&
1117 	    (if_hwassist_flags & CSUM_IP_FRAGS) == 0) {
1118 		in_delayed_cksum(m0);
1119 		m0->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
1120 	}
1121 
1122 	if (len > PAGE_SIZE) {
1123 		/*
1124 		 * Fragment large datagrams such that each segment
1125 		 * contains a multiple of PAGE_SIZE amount of data,
1126 		 * plus headers. This enables a receiver to perform
1127 		 * page-flipping zero-copy optimizations.
1128 		 *
1129 		 * XXX When does this help given that sender and receiver
1130 		 * could have different page sizes, and also mtu could
1131 		 * be less than the receiver's page size ?
1132 		 */
1133 		int newlen;
1134 		struct mbuf *m;
1135 
1136 		for (m = m0, off = 0; m && (off+m->m_len) <= mtu; m = m->m_next)
1137 			off += m->m_len;
1138 
1139 		/*
1140 		 * firstlen (off - hlen) must be aligned on an
1141 		 * 8-byte boundary
1142 		 */
1143 		if (off < hlen)
1144 			goto smart_frag_failure;
1145 		off = ((off - hlen) & ~7) + hlen;
1146 		newlen = (~PAGE_MASK) & mtu;
1147 		if ((newlen + sizeof (struct ip)) > mtu) {
1148 			/* we failed, go back the default */
1149 smart_frag_failure:
1150 			newlen = len;
1151 			off = hlen + len;
1152 		}
1153 		len = newlen;
1154 
1155 	} else {
1156 		off = hlen + len;
1157 	}
1158 
1159 	firstlen = off - hlen;
1160 	mnext = &m0->m_nextpkt;		/* pointer to next packet */
1161 
1162 	/*
1163 	 * Loop through length of segment after first fragment,
1164 	 * make new header and copy data of each part and link onto chain.
1165 	 * Here, m0 is the original packet, m is the fragment being created.
1166 	 * The fragments are linked off the m_nextpkt of the original
1167 	 * packet, which after processing serves as the first fragment.
1168 	 */
1169 	for (nfrags = 1; off < ip->ip_len; off += len, nfrags++) {
1170 		struct ip *mhip;	/* ip header on the fragment */
1171 		struct mbuf *m;
1172 		int mhlen = sizeof (struct ip);
1173 
1174 		MGETHDR(m, M_DONTWAIT, MT_HEADER);
1175 		if (m == 0) {
1176 			error = ENOBUFS;
1177 			ipstat.ips_odropped++;
1178 			goto done;
1179 		}
1180 		m->m_flags |= (m0->m_flags & M_MCAST) | M_FRAG;
1181 		/*
1182 		 * In the first mbuf, leave room for the link header, then
1183 		 * copy the original IP header including options. The payload
1184 		 * goes into an additional mbuf chain returned by m_copy().
1185 		 */
1186 		m->m_data += max_linkhdr;
1187 		mhip = mtod(m, struct ip *);
1188 		*mhip = *ip;
1189 		if (hlen > sizeof (struct ip)) {
1190 			mhlen = ip_optcopy(ip, mhip) + sizeof (struct ip);
1191 			mhip->ip_v = IPVERSION;
1192 			mhip->ip_hl = mhlen >> 2;
1193 		}
1194 		m->m_len = mhlen;
1195 		/* XXX do we need to add ip->ip_off below ? */
1196 		mhip->ip_off = ((off - hlen) >> 3) + ip->ip_off;
1197 		if (off + len >= ip->ip_len) {	/* last fragment */
1198 			len = ip->ip_len - off;
1199 			m->m_flags |= M_LASTFRAG;
1200 		} else
1201 			mhip->ip_off |= IP_MF;
1202 		mhip->ip_len = htons((u_short)(len + mhlen));
1203 		m->m_next = m_copy(m0, off, len);
1204 		if (m->m_next == 0) {		/* copy failed */
1205 			m_free(m);
1206 			error = ENOBUFS;	/* ??? */
1207 			ipstat.ips_odropped++;
1208 			goto done;
1209 		}
1210 		m->m_pkthdr.len = mhlen + len;
1211 		m->m_pkthdr.rcvif = (struct ifnet *)0;
1212 #ifdef MAC
1213 		mac_create_fragment(m0, m);
1214 #endif
1215 		m->m_pkthdr.csum_flags = m0->m_pkthdr.csum_flags;
1216 		mhip->ip_off = htons(mhip->ip_off);
1217 		mhip->ip_sum = 0;
1218 		if (sw_csum & CSUM_DELAY_IP)
1219 			mhip->ip_sum = in_cksum(m, mhlen);
1220 		*mnext = m;
1221 		mnext = &m->m_nextpkt;
1222 	}
1223 	ipstat.ips_ofragments += nfrags;
1224 
1225 	/* set first marker for fragment chain */
1226 	m0->m_flags |= M_FIRSTFRAG | M_FRAG;
1227 	m0->m_pkthdr.csum_data = nfrags;
1228 
1229 	/*
1230 	 * Update first fragment by trimming what's been copied out
1231 	 * and updating header.
1232 	 */
1233 	m_adj(m0, hlen + firstlen - ip->ip_len);
1234 	m0->m_pkthdr.len = hlen + firstlen;
1235 	ip->ip_len = htons((u_short)m0->m_pkthdr.len);
1236 	ip->ip_off |= IP_MF;
1237 	ip->ip_off = htons(ip->ip_off);
1238 	ip->ip_sum = 0;
1239 	if (sw_csum & CSUM_DELAY_IP)
1240 		ip->ip_sum = in_cksum(m0, hlen);
1241 
1242 done:
1243 	*m_frag = m0;
1244 	return error;
1245 }
1246 
1247 void
1248 in_delayed_cksum(struct mbuf *m)
1249 {
1250 	struct ip *ip;
1251 	u_short csum, offset;
1252 
1253 	ip = mtod(m, struct ip *);
1254 	offset = ip->ip_hl << 2 ;
1255 	csum = in_cksum_skip(m, ip->ip_len, offset);
1256 	if (m->m_pkthdr.csum_flags & CSUM_UDP && csum == 0)
1257 		csum = 0xffff;
1258 	offset += m->m_pkthdr.csum_data;	/* checksum offset */
1259 
1260 	if (offset + sizeof(u_short) > m->m_len) {
1261 		printf("delayed m_pullup, m->len: %d  off: %d  p: %d\n",
1262 		    m->m_len, offset, ip->ip_p);
1263 		/*
1264 		 * XXX
1265 		 * this shouldn't happen, but if it does, the
1266 		 * correct behavior may be to insert the checksum
1267 		 * in the existing chain instead of rearranging it.
1268 		 */
1269 		m = m_pullup(m, offset + sizeof(u_short));
1270 	}
1271 	*(u_short *)(m->m_data + offset) = csum;
1272 }
1273 
1274 /*
1275  * Insert IP options into preformed packet.
1276  * Adjust IP destination as required for IP source routing,
1277  * as indicated by a non-zero in_addr at the start of the options.
1278  *
1279  * XXX This routine assumes that the packet has no options in place.
1280  */
1281 static struct mbuf *
1282 ip_insertoptions(m, opt, phlen)
1283 	register struct mbuf *m;
1284 	struct mbuf *opt;
1285 	int *phlen;
1286 {
1287 	register struct ipoption *p = mtod(opt, struct ipoption *);
1288 	struct mbuf *n;
1289 	register struct ip *ip = mtod(m, struct ip *);
1290 	unsigned optlen;
1291 
1292 	optlen = opt->m_len - sizeof(p->ipopt_dst);
1293 	if (optlen + ip->ip_len > IP_MAXPACKET) {
1294 		*phlen = 0;
1295 		return (m);		/* XXX should fail */
1296 	}
1297 	if (p->ipopt_dst.s_addr)
1298 		ip->ip_dst = p->ipopt_dst;
1299 	if (m->m_flags & M_EXT || m->m_data - optlen < m->m_pktdat) {
1300 		MGETHDR(n, M_DONTWAIT, MT_HEADER);
1301 		if (n == 0) {
1302 			*phlen = 0;
1303 			return (m);
1304 		}
1305 		n->m_pkthdr.rcvif = (struct ifnet *)0;
1306 #ifdef MAC
1307 		mac_create_mbuf_from_mbuf(m, n);
1308 #endif
1309 		n->m_pkthdr.len = m->m_pkthdr.len + optlen;
1310 		m->m_len -= sizeof(struct ip);
1311 		m->m_data += sizeof(struct ip);
1312 		n->m_next = m;
1313 		m = n;
1314 		m->m_len = optlen + sizeof(struct ip);
1315 		m->m_data += max_linkhdr;
1316 		bcopy(ip, mtod(m, void *), sizeof(struct ip));
1317 	} else {
1318 		m->m_data -= optlen;
1319 		m->m_len += optlen;
1320 		m->m_pkthdr.len += optlen;
1321 		bcopy(ip, mtod(m, void *), sizeof(struct ip));
1322 	}
1323 	ip = mtod(m, struct ip *);
1324 	bcopy(p->ipopt_list, ip + 1, optlen);
1325 	*phlen = sizeof(struct ip) + optlen;
1326 	ip->ip_v = IPVERSION;
1327 	ip->ip_hl = *phlen >> 2;
1328 	ip->ip_len += optlen;
1329 	return (m);
1330 }
1331 
1332 /*
1333  * Copy options from ip to jp,
1334  * omitting those not copied during fragmentation.
1335  */
1336 int
1337 ip_optcopy(ip, jp)
1338 	struct ip *ip, *jp;
1339 {
1340 	register u_char *cp, *dp;
1341 	int opt, optlen, cnt;
1342 
1343 	cp = (u_char *)(ip + 1);
1344 	dp = (u_char *)(jp + 1);
1345 	cnt = (ip->ip_hl << 2) - sizeof (struct ip);
1346 	for (; cnt > 0; cnt -= optlen, cp += optlen) {
1347 		opt = cp[0];
1348 		if (opt == IPOPT_EOL)
1349 			break;
1350 		if (opt == IPOPT_NOP) {
1351 			/* Preserve for IP mcast tunnel's LSRR alignment. */
1352 			*dp++ = IPOPT_NOP;
1353 			optlen = 1;
1354 			continue;
1355 		}
1356 
1357 		KASSERT(cnt >= IPOPT_OLEN + sizeof(*cp),
1358 		    ("ip_optcopy: malformed ipv4 option"));
1359 		optlen = cp[IPOPT_OLEN];
1360 		KASSERT(optlen >= IPOPT_OLEN + sizeof(*cp) && optlen <= cnt,
1361 		    ("ip_optcopy: malformed ipv4 option"));
1362 
1363 		/* bogus lengths should have been caught by ip_dooptions */
1364 		if (optlen > cnt)
1365 			optlen = cnt;
1366 		if (IPOPT_COPIED(opt)) {
1367 			bcopy(cp, dp, optlen);
1368 			dp += optlen;
1369 		}
1370 	}
1371 	for (optlen = dp - (u_char *)(jp+1); optlen & 0x3; optlen++)
1372 		*dp++ = IPOPT_EOL;
1373 	return (optlen);
1374 }
1375 
1376 /*
1377  * IP socket option processing.
1378  */
1379 int
1380 ip_ctloutput(so, sopt)
1381 	struct socket *so;
1382 	struct sockopt *sopt;
1383 {
1384 	struct	inpcb *inp = sotoinpcb(so);
1385 	int	error, optval;
1386 
1387 	error = optval = 0;
1388 	if (sopt->sopt_level != IPPROTO_IP) {
1389 		return (EINVAL);
1390 	}
1391 
1392 	switch (sopt->sopt_dir) {
1393 	case SOPT_SET:
1394 		switch (sopt->sopt_name) {
1395 		case IP_OPTIONS:
1396 #ifdef notyet
1397 		case IP_RETOPTS:
1398 #endif
1399 		{
1400 			struct mbuf *m;
1401 			if (sopt->sopt_valsize > MLEN) {
1402 				error = EMSGSIZE;
1403 				break;
1404 			}
1405 			MGET(m, sopt->sopt_td ? M_TRYWAIT : M_DONTWAIT, MT_HEADER);
1406 			if (m == 0) {
1407 				error = ENOBUFS;
1408 				break;
1409 			}
1410 			m->m_len = sopt->sopt_valsize;
1411 			error = sooptcopyin(sopt, mtod(m, char *), m->m_len,
1412 					    m->m_len);
1413 
1414 			return (ip_pcbopts(sopt->sopt_name, &inp->inp_options,
1415 					   m));
1416 		}
1417 
1418 		case IP_TOS:
1419 		case IP_TTL:
1420 		case IP_RECVOPTS:
1421 		case IP_RECVRETOPTS:
1422 		case IP_RECVDSTADDR:
1423 		case IP_RECVTTL:
1424 		case IP_RECVIF:
1425 		case IP_FAITH:
1426 		case IP_ONESBCAST:
1427 			error = sooptcopyin(sopt, &optval, sizeof optval,
1428 					    sizeof optval);
1429 			if (error)
1430 				break;
1431 
1432 			switch (sopt->sopt_name) {
1433 			case IP_TOS:
1434 				inp->inp_ip_tos = optval;
1435 				break;
1436 
1437 			case IP_TTL:
1438 				inp->inp_ip_ttl = optval;
1439 				break;
1440 #define	OPTSET(bit) do {						\
1441 	INP_LOCK(inp);							\
1442 	if (optval)							\
1443 		inp->inp_flags |= bit;					\
1444 	else								\
1445 		inp->inp_flags &= ~bit;					\
1446 	INP_UNLOCK(inp);						\
1447 } while (0)
1448 
1449 			case IP_RECVOPTS:
1450 				OPTSET(INP_RECVOPTS);
1451 				break;
1452 
1453 			case IP_RECVRETOPTS:
1454 				OPTSET(INP_RECVRETOPTS);
1455 				break;
1456 
1457 			case IP_RECVDSTADDR:
1458 				OPTSET(INP_RECVDSTADDR);
1459 				break;
1460 
1461 			case IP_RECVTTL:
1462 				OPTSET(INP_RECVTTL);
1463 				break;
1464 
1465 			case IP_RECVIF:
1466 				OPTSET(INP_RECVIF);
1467 				break;
1468 
1469 			case IP_FAITH:
1470 				OPTSET(INP_FAITH);
1471 				break;
1472 
1473 			case IP_ONESBCAST:
1474 				OPTSET(INP_ONESBCAST);
1475 				break;
1476 			}
1477 			break;
1478 #undef OPTSET
1479 
1480 		case IP_MULTICAST_IF:
1481 		case IP_MULTICAST_VIF:
1482 		case IP_MULTICAST_TTL:
1483 		case IP_MULTICAST_LOOP:
1484 		case IP_ADD_MEMBERSHIP:
1485 		case IP_DROP_MEMBERSHIP:
1486 			error = ip_setmoptions(sopt, &inp->inp_moptions);
1487 			break;
1488 
1489 		case IP_PORTRANGE:
1490 			error = sooptcopyin(sopt, &optval, sizeof optval,
1491 					    sizeof optval);
1492 			if (error)
1493 				break;
1494 
1495 			INP_LOCK(inp);
1496 			switch (optval) {
1497 			case IP_PORTRANGE_DEFAULT:
1498 				inp->inp_flags &= ~(INP_LOWPORT);
1499 				inp->inp_flags &= ~(INP_HIGHPORT);
1500 				break;
1501 
1502 			case IP_PORTRANGE_HIGH:
1503 				inp->inp_flags &= ~(INP_LOWPORT);
1504 				inp->inp_flags |= INP_HIGHPORT;
1505 				break;
1506 
1507 			case IP_PORTRANGE_LOW:
1508 				inp->inp_flags &= ~(INP_HIGHPORT);
1509 				inp->inp_flags |= INP_LOWPORT;
1510 				break;
1511 
1512 			default:
1513 				error = EINVAL;
1514 				break;
1515 			}
1516 			INP_UNLOCK(inp);
1517 			break;
1518 
1519 #if defined(IPSEC) || defined(FAST_IPSEC)
1520 		case IP_IPSEC_POLICY:
1521 		{
1522 			caddr_t req;
1523 			size_t len = 0;
1524 			int priv;
1525 			struct mbuf *m;
1526 			int optname;
1527 
1528 			if ((error = soopt_getm(sopt, &m)) != 0) /* XXX */
1529 				break;
1530 			if ((error = soopt_mcopyin(sopt, m)) != 0) /* XXX */
1531 				break;
1532 			priv = (sopt->sopt_td != NULL &&
1533 				suser(sopt->sopt_td) != 0) ? 0 : 1;
1534 			req = mtod(m, caddr_t);
1535 			len = m->m_len;
1536 			optname = sopt->sopt_name;
1537 			error = ipsec4_set_policy(inp, optname, req, len, priv);
1538 			m_freem(m);
1539 			break;
1540 		}
1541 #endif /*IPSEC*/
1542 
1543 		default:
1544 			error = ENOPROTOOPT;
1545 			break;
1546 		}
1547 		break;
1548 
1549 	case SOPT_GET:
1550 		switch (sopt->sopt_name) {
1551 		case IP_OPTIONS:
1552 		case IP_RETOPTS:
1553 			if (inp->inp_options)
1554 				error = sooptcopyout(sopt,
1555 						     mtod(inp->inp_options,
1556 							  char *),
1557 						     inp->inp_options->m_len);
1558 			else
1559 				sopt->sopt_valsize = 0;
1560 			break;
1561 
1562 		case IP_TOS:
1563 		case IP_TTL:
1564 		case IP_RECVOPTS:
1565 		case IP_RECVRETOPTS:
1566 		case IP_RECVDSTADDR:
1567 		case IP_RECVTTL:
1568 		case IP_RECVIF:
1569 		case IP_PORTRANGE:
1570 		case IP_FAITH:
1571 		case IP_ONESBCAST:
1572 			switch (sopt->sopt_name) {
1573 
1574 			case IP_TOS:
1575 				optval = inp->inp_ip_tos;
1576 				break;
1577 
1578 			case IP_TTL:
1579 				optval = inp->inp_ip_ttl;
1580 				break;
1581 
1582 #define	OPTBIT(bit)	(inp->inp_flags & bit ? 1 : 0)
1583 
1584 			case IP_RECVOPTS:
1585 				optval = OPTBIT(INP_RECVOPTS);
1586 				break;
1587 
1588 			case IP_RECVRETOPTS:
1589 				optval = OPTBIT(INP_RECVRETOPTS);
1590 				break;
1591 
1592 			case IP_RECVDSTADDR:
1593 				optval = OPTBIT(INP_RECVDSTADDR);
1594 				break;
1595 
1596 			case IP_RECVTTL:
1597 				optval = OPTBIT(INP_RECVTTL);
1598 				break;
1599 
1600 			case IP_RECVIF:
1601 				optval = OPTBIT(INP_RECVIF);
1602 				break;
1603 
1604 			case IP_PORTRANGE:
1605 				if (inp->inp_flags & INP_HIGHPORT)
1606 					optval = IP_PORTRANGE_HIGH;
1607 				else if (inp->inp_flags & INP_LOWPORT)
1608 					optval = IP_PORTRANGE_LOW;
1609 				else
1610 					optval = 0;
1611 				break;
1612 
1613 			case IP_FAITH:
1614 				optval = OPTBIT(INP_FAITH);
1615 				break;
1616 
1617 			case IP_ONESBCAST:
1618 				optval = OPTBIT(INP_ONESBCAST);
1619 				break;
1620 			}
1621 			error = sooptcopyout(sopt, &optval, sizeof optval);
1622 			break;
1623 
1624 		case IP_MULTICAST_IF:
1625 		case IP_MULTICAST_VIF:
1626 		case IP_MULTICAST_TTL:
1627 		case IP_MULTICAST_LOOP:
1628 		case IP_ADD_MEMBERSHIP:
1629 		case IP_DROP_MEMBERSHIP:
1630 			error = ip_getmoptions(sopt, inp->inp_moptions);
1631 			break;
1632 
1633 #if defined(IPSEC) || defined(FAST_IPSEC)
1634 		case IP_IPSEC_POLICY:
1635 		{
1636 			struct mbuf *m = NULL;
1637 			caddr_t req = NULL;
1638 			size_t len = 0;
1639 
1640 			if (m != 0) {
1641 				req = mtod(m, caddr_t);
1642 				len = m->m_len;
1643 			}
1644 			error = ipsec4_get_policy(sotoinpcb(so), req, len, &m);
1645 			if (error == 0)
1646 				error = soopt_mcopyout(sopt, m); /* XXX */
1647 			if (error == 0)
1648 				m_freem(m);
1649 			break;
1650 		}
1651 #endif /*IPSEC*/
1652 
1653 		default:
1654 			error = ENOPROTOOPT;
1655 			break;
1656 		}
1657 		break;
1658 	}
1659 	return (error);
1660 }
1661 
1662 /*
1663  * Set up IP options in pcb for insertion in output packets.
1664  * Store in mbuf with pointer in pcbopt, adding pseudo-option
1665  * with destination address if source routed.
1666  */
1667 static int
1668 ip_pcbopts(optname, pcbopt, m)
1669 	int optname;
1670 	struct mbuf **pcbopt;
1671 	register struct mbuf *m;
1672 {
1673 	register int cnt, optlen;
1674 	register u_char *cp;
1675 	u_char opt;
1676 
1677 	/* turn off any old options */
1678 	if (*pcbopt)
1679 		(void)m_free(*pcbopt);
1680 	*pcbopt = 0;
1681 	if (m == (struct mbuf *)0 || m->m_len == 0) {
1682 		/*
1683 		 * Only turning off any previous options.
1684 		 */
1685 		if (m)
1686 			(void)m_free(m);
1687 		return (0);
1688 	}
1689 
1690 	if (m->m_len % sizeof(int32_t))
1691 		goto bad;
1692 	/*
1693 	 * IP first-hop destination address will be stored before
1694 	 * actual options; move other options back
1695 	 * and clear it when none present.
1696 	 */
1697 	if (m->m_data + m->m_len + sizeof(struct in_addr) >= &m->m_dat[MLEN])
1698 		goto bad;
1699 	cnt = m->m_len;
1700 	m->m_len += sizeof(struct in_addr);
1701 	cp = mtod(m, u_char *) + sizeof(struct in_addr);
1702 	bcopy(mtod(m, void *), cp, (unsigned)cnt);
1703 	bzero(mtod(m, void *), sizeof(struct in_addr));
1704 
1705 	for (; cnt > 0; cnt -= optlen, cp += optlen) {
1706 		opt = cp[IPOPT_OPTVAL];
1707 		if (opt == IPOPT_EOL)
1708 			break;
1709 		if (opt == IPOPT_NOP)
1710 			optlen = 1;
1711 		else {
1712 			if (cnt < IPOPT_OLEN + sizeof(*cp))
1713 				goto bad;
1714 			optlen = cp[IPOPT_OLEN];
1715 			if (optlen < IPOPT_OLEN + sizeof(*cp) || optlen > cnt)
1716 				goto bad;
1717 		}
1718 		switch (opt) {
1719 
1720 		default:
1721 			break;
1722 
1723 		case IPOPT_LSRR:
1724 		case IPOPT_SSRR:
1725 			/*
1726 			 * user process specifies route as:
1727 			 *	->A->B->C->D
1728 			 * D must be our final destination (but we can't
1729 			 * check that since we may not have connected yet).
1730 			 * A is first hop destination, which doesn't appear in
1731 			 * actual IP option, but is stored before the options.
1732 			 */
1733 			if (optlen < IPOPT_MINOFF - 1 + sizeof(struct in_addr))
1734 				goto bad;
1735 			m->m_len -= sizeof(struct in_addr);
1736 			cnt -= sizeof(struct in_addr);
1737 			optlen -= sizeof(struct in_addr);
1738 			cp[IPOPT_OLEN] = optlen;
1739 			/*
1740 			 * Move first hop before start of options.
1741 			 */
1742 			bcopy((caddr_t)&cp[IPOPT_OFFSET+1], mtod(m, caddr_t),
1743 			    sizeof(struct in_addr));
1744 			/*
1745 			 * Then copy rest of options back
1746 			 * to close up the deleted entry.
1747 			 */
1748 			bcopy((&cp[IPOPT_OFFSET+1] + sizeof(struct in_addr)),
1749 			    &cp[IPOPT_OFFSET+1],
1750 			    (unsigned)cnt - (IPOPT_MINOFF - 1));
1751 			break;
1752 		}
1753 	}
1754 	if (m->m_len > MAX_IPOPTLEN + sizeof(struct in_addr))
1755 		goto bad;
1756 	*pcbopt = m;
1757 	return (0);
1758 
1759 bad:
1760 	(void)m_free(m);
1761 	return (EINVAL);
1762 }
1763 
1764 /*
1765  * XXX
1766  * The whole multicast option thing needs to be re-thought.
1767  * Several of these options are equally applicable to non-multicast
1768  * transmission, and one (IP_MULTICAST_TTL) totally duplicates a
1769  * standard option (IP_TTL).
1770  */
1771 
1772 /*
1773  * following RFC1724 section 3.3, 0.0.0.0/8 is interpreted as interface index.
1774  */
1775 static struct ifnet *
1776 ip_multicast_if(a, ifindexp)
1777 	struct in_addr *a;
1778 	int *ifindexp;
1779 {
1780 	int ifindex;
1781 	struct ifnet *ifp;
1782 
1783 	if (ifindexp)
1784 		*ifindexp = 0;
1785 	if (ntohl(a->s_addr) >> 24 == 0) {
1786 		ifindex = ntohl(a->s_addr) & 0xffffff;
1787 		if (ifindex < 0 || if_index < ifindex)
1788 			return NULL;
1789 		ifp = ifnet_byindex(ifindex);
1790 		if (ifindexp)
1791 			*ifindexp = ifindex;
1792 	} else {
1793 		INADDR_TO_IFP(*a, ifp);
1794 	}
1795 	return ifp;
1796 }
1797 
1798 /*
1799  * Set the IP multicast options in response to user setsockopt().
1800  */
1801 static int
1802 ip_setmoptions(sopt, imop)
1803 	struct sockopt *sopt;
1804 	struct ip_moptions **imop;
1805 {
1806 	int error = 0;
1807 	int i;
1808 	struct in_addr addr;
1809 	struct ip_mreq mreq;
1810 	struct ifnet *ifp;
1811 	struct ip_moptions *imo = *imop;
1812 	struct route ro;
1813 	struct sockaddr_in *dst;
1814 	int ifindex;
1815 	int s;
1816 
1817 	if (imo == NULL) {
1818 		/*
1819 		 * No multicast option buffer attached to the pcb;
1820 		 * allocate one and initialize to default values.
1821 		 */
1822 		imo = (struct ip_moptions*)malloc(sizeof(*imo), M_IPMOPTS,
1823 		    M_WAITOK);
1824 
1825 		if (imo == NULL)
1826 			return (ENOBUFS);
1827 		*imop = imo;
1828 		imo->imo_multicast_ifp = NULL;
1829 		imo->imo_multicast_addr.s_addr = INADDR_ANY;
1830 		imo->imo_multicast_vif = -1;
1831 		imo->imo_multicast_ttl = IP_DEFAULT_MULTICAST_TTL;
1832 		imo->imo_multicast_loop = IP_DEFAULT_MULTICAST_LOOP;
1833 		imo->imo_num_memberships = 0;
1834 	}
1835 
1836 	switch (sopt->sopt_name) {
1837 	/* store an index number for the vif you wanna use in the send */
1838 	case IP_MULTICAST_VIF:
1839 		if (legal_vif_num == 0) {
1840 			error = EOPNOTSUPP;
1841 			break;
1842 		}
1843 		error = sooptcopyin(sopt, &i, sizeof i, sizeof i);
1844 		if (error)
1845 			break;
1846 		if (!legal_vif_num(i) && (i != -1)) {
1847 			error = EINVAL;
1848 			break;
1849 		}
1850 		imo->imo_multicast_vif = i;
1851 		break;
1852 
1853 	case IP_MULTICAST_IF:
1854 		/*
1855 		 * Select the interface for outgoing multicast packets.
1856 		 */
1857 		error = sooptcopyin(sopt, &addr, sizeof addr, sizeof addr);
1858 		if (error)
1859 			break;
1860 		/*
1861 		 * INADDR_ANY is used to remove a previous selection.
1862 		 * When no interface is selected, a default one is
1863 		 * chosen every time a multicast packet is sent.
1864 		 */
1865 		if (addr.s_addr == INADDR_ANY) {
1866 			imo->imo_multicast_ifp = NULL;
1867 			break;
1868 		}
1869 		/*
1870 		 * The selected interface is identified by its local
1871 		 * IP address.  Find the interface and confirm that
1872 		 * it supports multicasting.
1873 		 */
1874 		s = splimp();
1875 		ifp = ip_multicast_if(&addr, &ifindex);
1876 		if (ifp == NULL || (ifp->if_flags & IFF_MULTICAST) == 0) {
1877 			splx(s);
1878 			error = EADDRNOTAVAIL;
1879 			break;
1880 		}
1881 		imo->imo_multicast_ifp = ifp;
1882 		if (ifindex)
1883 			imo->imo_multicast_addr = addr;
1884 		else
1885 			imo->imo_multicast_addr.s_addr = INADDR_ANY;
1886 		splx(s);
1887 		break;
1888 
1889 	case IP_MULTICAST_TTL:
1890 		/*
1891 		 * Set the IP time-to-live for outgoing multicast packets.
1892 		 * The original multicast API required a char argument,
1893 		 * which is inconsistent with the rest of the socket API.
1894 		 * We allow either a char or an int.
1895 		 */
1896 		if (sopt->sopt_valsize == 1) {
1897 			u_char ttl;
1898 			error = sooptcopyin(sopt, &ttl, 1, 1);
1899 			if (error)
1900 				break;
1901 			imo->imo_multicast_ttl = ttl;
1902 		} else {
1903 			u_int ttl;
1904 			error = sooptcopyin(sopt, &ttl, sizeof ttl,
1905 					    sizeof ttl);
1906 			if (error)
1907 				break;
1908 			if (ttl > 255)
1909 				error = EINVAL;
1910 			else
1911 				imo->imo_multicast_ttl = ttl;
1912 		}
1913 		break;
1914 
1915 	case IP_MULTICAST_LOOP:
1916 		/*
1917 		 * Set the loopback flag for outgoing multicast packets.
1918 		 * Must be zero or one.  The original multicast API required a
1919 		 * char argument, which is inconsistent with the rest
1920 		 * of the socket API.  We allow either a char or an int.
1921 		 */
1922 		if (sopt->sopt_valsize == 1) {
1923 			u_char loop;
1924 			error = sooptcopyin(sopt, &loop, 1, 1);
1925 			if (error)
1926 				break;
1927 			imo->imo_multicast_loop = !!loop;
1928 		} else {
1929 			u_int loop;
1930 			error = sooptcopyin(sopt, &loop, sizeof loop,
1931 					    sizeof loop);
1932 			if (error)
1933 				break;
1934 			imo->imo_multicast_loop = !!loop;
1935 		}
1936 		break;
1937 
1938 	case IP_ADD_MEMBERSHIP:
1939 		/*
1940 		 * Add a multicast group membership.
1941 		 * Group must be a valid IP multicast address.
1942 		 */
1943 		error = sooptcopyin(sopt, &mreq, sizeof mreq, sizeof mreq);
1944 		if (error)
1945 			break;
1946 
1947 		if (!IN_MULTICAST(ntohl(mreq.imr_multiaddr.s_addr))) {
1948 			error = EINVAL;
1949 			break;
1950 		}
1951 		s = splimp();
1952 		/*
1953 		 * If no interface address was provided, use the interface of
1954 		 * the route to the given multicast address.
1955 		 */
1956 		if (mreq.imr_interface.s_addr == INADDR_ANY) {
1957 			bzero((caddr_t)&ro, sizeof(ro));
1958 			dst = (struct sockaddr_in *)&ro.ro_dst;
1959 			dst->sin_len = sizeof(*dst);
1960 			dst->sin_family = AF_INET;
1961 			dst->sin_addr = mreq.imr_multiaddr;
1962 			rtalloc_ign(&ro, RTF_CLONING);
1963 			if (ro.ro_rt == NULL) {
1964 				error = EADDRNOTAVAIL;
1965 				splx(s);
1966 				break;
1967 			}
1968 			ifp = ro.ro_rt->rt_ifp;
1969 			RTFREE(ro.ro_rt);
1970 		}
1971 		else {
1972 			ifp = ip_multicast_if(&mreq.imr_interface, NULL);
1973 		}
1974 
1975 		/*
1976 		 * See if we found an interface, and confirm that it
1977 		 * supports multicast.
1978 		 */
1979 		if (ifp == NULL || (ifp->if_flags & IFF_MULTICAST) == 0) {
1980 			error = EADDRNOTAVAIL;
1981 			splx(s);
1982 			break;
1983 		}
1984 		/*
1985 		 * See if the membership already exists or if all the
1986 		 * membership slots are full.
1987 		 */
1988 		for (i = 0; i < imo->imo_num_memberships; ++i) {
1989 			if (imo->imo_membership[i]->inm_ifp == ifp &&
1990 			    imo->imo_membership[i]->inm_addr.s_addr
1991 						== mreq.imr_multiaddr.s_addr)
1992 				break;
1993 		}
1994 		if (i < imo->imo_num_memberships) {
1995 			error = EADDRINUSE;
1996 			splx(s);
1997 			break;
1998 		}
1999 		if (i == IP_MAX_MEMBERSHIPS) {
2000 			error = ETOOMANYREFS;
2001 			splx(s);
2002 			break;
2003 		}
2004 		/*
2005 		 * Everything looks good; add a new record to the multicast
2006 		 * address list for the given interface.
2007 		 */
2008 		if ((imo->imo_membership[i] =
2009 		    in_addmulti(&mreq.imr_multiaddr, ifp)) == NULL) {
2010 			error = ENOBUFS;
2011 			splx(s);
2012 			break;
2013 		}
2014 		++imo->imo_num_memberships;
2015 		splx(s);
2016 		break;
2017 
2018 	case IP_DROP_MEMBERSHIP:
2019 		/*
2020 		 * Drop a multicast group membership.
2021 		 * Group must be a valid IP multicast address.
2022 		 */
2023 		error = sooptcopyin(sopt, &mreq, sizeof mreq, sizeof mreq);
2024 		if (error)
2025 			break;
2026 
2027 		if (!IN_MULTICAST(ntohl(mreq.imr_multiaddr.s_addr))) {
2028 			error = EINVAL;
2029 			break;
2030 		}
2031 
2032 		s = splimp();
2033 		/*
2034 		 * If an interface address was specified, get a pointer
2035 		 * to its ifnet structure.
2036 		 */
2037 		if (mreq.imr_interface.s_addr == INADDR_ANY)
2038 			ifp = NULL;
2039 		else {
2040 			ifp = ip_multicast_if(&mreq.imr_interface, NULL);
2041 			if (ifp == NULL) {
2042 				error = EADDRNOTAVAIL;
2043 				splx(s);
2044 				break;
2045 			}
2046 		}
2047 		/*
2048 		 * Find the membership in the membership array.
2049 		 */
2050 		for (i = 0; i < imo->imo_num_memberships; ++i) {
2051 			if ((ifp == NULL ||
2052 			     imo->imo_membership[i]->inm_ifp == ifp) &&
2053 			     imo->imo_membership[i]->inm_addr.s_addr ==
2054 			     mreq.imr_multiaddr.s_addr)
2055 				break;
2056 		}
2057 		if (i == imo->imo_num_memberships) {
2058 			error = EADDRNOTAVAIL;
2059 			splx(s);
2060 			break;
2061 		}
2062 		/*
2063 		 * Give up the multicast address record to which the
2064 		 * membership points.
2065 		 */
2066 		in_delmulti(imo->imo_membership[i]);
2067 		/*
2068 		 * Remove the gap in the membership array.
2069 		 */
2070 		for (++i; i < imo->imo_num_memberships; ++i)
2071 			imo->imo_membership[i-1] = imo->imo_membership[i];
2072 		--imo->imo_num_memberships;
2073 		splx(s);
2074 		break;
2075 
2076 	default:
2077 		error = EOPNOTSUPP;
2078 		break;
2079 	}
2080 
2081 	/*
2082 	 * If all options have default values, no need to keep the mbuf.
2083 	 */
2084 	if (imo->imo_multicast_ifp == NULL &&
2085 	    imo->imo_multicast_vif == -1 &&
2086 	    imo->imo_multicast_ttl == IP_DEFAULT_MULTICAST_TTL &&
2087 	    imo->imo_multicast_loop == IP_DEFAULT_MULTICAST_LOOP &&
2088 	    imo->imo_num_memberships == 0) {
2089 		free(*imop, M_IPMOPTS);
2090 		*imop = NULL;
2091 	}
2092 
2093 	return (error);
2094 }
2095 
2096 /*
2097  * Return the IP multicast options in response to user getsockopt().
2098  */
2099 static int
2100 ip_getmoptions(sopt, imo)
2101 	struct sockopt *sopt;
2102 	register struct ip_moptions *imo;
2103 {
2104 	struct in_addr addr;
2105 	struct in_ifaddr *ia;
2106 	int error, optval;
2107 	u_char coptval;
2108 
2109 	error = 0;
2110 	switch (sopt->sopt_name) {
2111 	case IP_MULTICAST_VIF:
2112 		if (imo != NULL)
2113 			optval = imo->imo_multicast_vif;
2114 		else
2115 			optval = -1;
2116 		error = sooptcopyout(sopt, &optval, sizeof optval);
2117 		break;
2118 
2119 	case IP_MULTICAST_IF:
2120 		if (imo == NULL || imo->imo_multicast_ifp == NULL)
2121 			addr.s_addr = INADDR_ANY;
2122 		else if (imo->imo_multicast_addr.s_addr) {
2123 			/* return the value user has set */
2124 			addr = imo->imo_multicast_addr;
2125 		} else {
2126 			IFP_TO_IA(imo->imo_multicast_ifp, ia);
2127 			addr.s_addr = (ia == NULL) ? INADDR_ANY
2128 				: IA_SIN(ia)->sin_addr.s_addr;
2129 		}
2130 		error = sooptcopyout(sopt, &addr, sizeof addr);
2131 		break;
2132 
2133 	case IP_MULTICAST_TTL:
2134 		if (imo == 0)
2135 			optval = coptval = IP_DEFAULT_MULTICAST_TTL;
2136 		else
2137 			optval = coptval = imo->imo_multicast_ttl;
2138 		if (sopt->sopt_valsize == 1)
2139 			error = sooptcopyout(sopt, &coptval, 1);
2140 		else
2141 			error = sooptcopyout(sopt, &optval, sizeof optval);
2142 		break;
2143 
2144 	case IP_MULTICAST_LOOP:
2145 		if (imo == 0)
2146 			optval = coptval = IP_DEFAULT_MULTICAST_LOOP;
2147 		else
2148 			optval = coptval = imo->imo_multicast_loop;
2149 		if (sopt->sopt_valsize == 1)
2150 			error = sooptcopyout(sopt, &coptval, 1);
2151 		else
2152 			error = sooptcopyout(sopt, &optval, sizeof optval);
2153 		break;
2154 
2155 	default:
2156 		error = ENOPROTOOPT;
2157 		break;
2158 	}
2159 	return (error);
2160 }
2161 
2162 /*
2163  * Discard the IP multicast options.
2164  */
2165 void
2166 ip_freemoptions(imo)
2167 	register struct ip_moptions *imo;
2168 {
2169 	register int i;
2170 
2171 	if (imo != NULL) {
2172 		for (i = 0; i < imo->imo_num_memberships; ++i)
2173 			in_delmulti(imo->imo_membership[i]);
2174 		free(imo, M_IPMOPTS);
2175 	}
2176 }
2177 
2178 /*
2179  * Routine called from ip_output() to loop back a copy of an IP multicast
2180  * packet to the input queue of a specified interface.  Note that this
2181  * calls the output routine of the loopback "driver", but with an interface
2182  * pointer that might NOT be a loopback interface -- evil, but easier than
2183  * replicating that code here.
2184  */
2185 static void
2186 ip_mloopback(ifp, m, dst, hlen)
2187 	struct ifnet *ifp;
2188 	register struct mbuf *m;
2189 	register struct sockaddr_in *dst;
2190 	int hlen;
2191 {
2192 	register struct ip *ip;
2193 	struct mbuf *copym;
2194 
2195 	copym = m_copy(m, 0, M_COPYALL);
2196 	if (copym != NULL && (copym->m_flags & M_EXT || copym->m_len < hlen))
2197 		copym = m_pullup(copym, hlen);
2198 	if (copym != NULL) {
2199 		/* If needed, compute the checksum and mark it as valid. */
2200 		if (copym->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
2201 			in_delayed_cksum(copym);
2202 			copym->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
2203 			copym->m_pkthdr.csum_flags |=
2204 			    CSUM_DATA_VALID | CSUM_PSEUDO_HDR;
2205 			copym->m_pkthdr.csum_data = 0xffff;
2206 		}
2207 		/*
2208 		 * We don't bother to fragment if the IP length is greater
2209 		 * than the interface's MTU.  Can this possibly matter?
2210 		 */
2211 		ip = mtod(copym, struct ip *);
2212 		ip->ip_len = htons(ip->ip_len);
2213 		ip->ip_off = htons(ip->ip_off);
2214 		ip->ip_sum = 0;
2215 		ip->ip_sum = in_cksum(copym, hlen);
2216 		/*
2217 		 * NB:
2218 		 * It's not clear whether there are any lingering
2219 		 * reentrancy problems in other areas which might
2220 		 * be exposed by using ip_input directly (in
2221 		 * particular, everything which modifies the packet
2222 		 * in-place).  Yet another option is using the
2223 		 * protosw directly to deliver the looped back
2224 		 * packet.  For the moment, we'll err on the side
2225 		 * of safety by using if_simloop().
2226 		 */
2227 #if 1 /* XXX */
2228 		if (dst->sin_family != AF_INET) {
2229 			printf("ip_mloopback: bad address family %d\n",
2230 						dst->sin_family);
2231 			dst->sin_family = AF_INET;
2232 		}
2233 #endif
2234 
2235 #ifdef notdef
2236 		copym->m_pkthdr.rcvif = ifp;
2237 		ip_input(copym);
2238 #else
2239 		if_simloop(ifp, copym, dst->sin_family, 0);
2240 #endif
2241 	}
2242 }
2243