xref: /freebsd/sys/netinet/ip_output.c (revision 7660b554bc59a07be0431c17e0e33815818baa69)
1 /*
2  * Copyright (c) 1982, 1986, 1988, 1990, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. All advertising materials mentioning features or use of this software
14  *    must display the following acknowledgement:
15  *	This product includes software developed by the University of
16  *	California, Berkeley and its contributors.
17  * 4. Neither the name of the University nor the names of its contributors
18  *    may be used to endorse or promote products derived from this software
19  *    without specific prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  *	@(#)ip_output.c	8.3 (Berkeley) 1/21/94
34  * $FreeBSD$
35  */
36 
37 #include "opt_ipfw.h"
38 #include "opt_ipdn.h"
39 #include "opt_ipdivert.h"
40 #include "opt_ipfilter.h"
41 #include "opt_ipsec.h"
42 #include "opt_mac.h"
43 #include "opt_pfil_hooks.h"
44 #include "opt_random_ip_id.h"
45 #include "opt_mbuf_stress_test.h"
46 
47 #include <sys/param.h>
48 #include <sys/systm.h>
49 #include <sys/kernel.h>
50 #include <sys/mac.h>
51 #include <sys/malloc.h>
52 #include <sys/mbuf.h>
53 #include <sys/protosw.h>
54 #include <sys/socket.h>
55 #include <sys/socketvar.h>
56 #include <sys/sysctl.h>
57 
58 #include <net/if.h>
59 #include <net/route.h>
60 
61 #include <netinet/in.h>
62 #include <netinet/in_systm.h>
63 #include <netinet/ip.h>
64 #include <netinet/in_pcb.h>
65 #include <netinet/in_var.h>
66 #include <netinet/ip_var.h>
67 
68 #include <machine/in_cksum.h>
69 
70 static MALLOC_DEFINE(M_IPMOPTS, "ip_moptions", "internet multicast options");
71 
72 #ifdef IPSEC
73 #include <netinet6/ipsec.h>
74 #include <netkey/key.h>
75 #ifdef IPSEC_DEBUG
76 #include <netkey/key_debug.h>
77 #else
78 #define	KEYDEBUG(lev,arg)
79 #endif
80 #endif /*IPSEC*/
81 
82 #ifdef FAST_IPSEC
83 #include <netipsec/ipsec.h>
84 #include <netipsec/xform.h>
85 #include <netipsec/key.h>
86 #endif /*FAST_IPSEC*/
87 
88 #include <netinet/ip_fw.h>
89 #include <netinet/ip_dummynet.h>
90 
91 #define print_ip(x, a, y)	 printf("%s %d.%d.%d.%d%s",\
92 				x, (ntohl(a.s_addr)>>24)&0xFF,\
93 				  (ntohl(a.s_addr)>>16)&0xFF,\
94 				  (ntohl(a.s_addr)>>8)&0xFF,\
95 				  (ntohl(a.s_addr))&0xFF, y);
96 
97 u_short ip_id;
98 
99 #ifdef MBUF_STRESS_TEST
100 int mbuf_frag_size = 0;
101 SYSCTL_INT(_net_inet_ip, OID_AUTO, mbuf_frag_size, CTLFLAG_RW,
102 	&mbuf_frag_size, 0, "Fragment outgoing mbufs to this size");
103 #endif
104 
105 static struct mbuf *ip_insertoptions(struct mbuf *, struct mbuf *, int *);
106 static struct ifnet *ip_multicast_if(struct in_addr *, int *);
107 static void	ip_mloopback
108 	(struct ifnet *, struct mbuf *, struct sockaddr_in *, int);
109 static int	ip_getmoptions
110 	(struct sockopt *, struct ip_moptions *);
111 static int	ip_pcbopts(int, struct mbuf **, struct mbuf *);
112 static int	ip_setmoptions
113 	(struct sockopt *, struct ip_moptions **);
114 
115 int	ip_optcopy(struct ip *, struct ip *);
116 
117 
118 extern	struct protosw inetsw[];
119 
120 /*
121  * IP output.  The packet in mbuf chain m contains a skeletal IP
122  * header (with len, off, ttl, proto, tos, src, dst).
123  * The mbuf chain containing the packet will be freed.
124  * The mbuf opt, if present, will not be freed.
125  */
126 int
127 ip_output(struct mbuf *m0, struct mbuf *opt, struct route *ro,
128 	int flags, struct ip_moptions *imo, struct inpcb *inp)
129 {
130 	struct ip *ip;
131 	struct ifnet *ifp = NULL;	/* keep compiler happy */
132 	struct mbuf *m;
133 	int hlen = sizeof (struct ip);
134 	int len, off, error = 0;
135 	struct sockaddr_in *dst = NULL;	/* keep compiler happy */
136 	struct in_ifaddr *ia = NULL;
137 	int isbroadcast, sw_csum;
138 	struct in_addr pkt_dst;
139 #ifdef IPSEC
140 	struct route iproute;
141 	struct secpolicy *sp = NULL;
142 #endif
143 #ifdef FAST_IPSEC
144 	struct route iproute;
145 	struct m_tag *mtag;
146 	struct secpolicy *sp = NULL;
147 	struct tdb_ident *tdbi;
148 	int s;
149 #endif /* FAST_IPSEC */
150 	struct ip_fw_args args;
151 	int src_was_INADDR_ANY = 0;	/* as the name says... */
152 #ifdef PFIL_HOOKS
153 	struct packet_filter_hook *pfh;
154 	struct mbuf *m1;
155 	int rv;
156 #endif /* PFIL_HOOKS */
157 
158 	args.eh = NULL;
159 	args.rule = NULL;
160 	args.next_hop = NULL;
161 	args.divert_rule = 0;			/* divert cookie */
162 
163 	/* Grab info from MT_TAG mbufs prepended to the chain. */
164 	for (; m0 && m0->m_type == MT_TAG; m0 = m0->m_next) {
165 		switch(m0->_m_tag_id) {
166 		default:
167 			printf("ip_output: unrecognised MT_TAG tag %d\n",
168 			    m0->_m_tag_id);
169 			break;
170 
171 		case PACKET_TAG_DUMMYNET:
172 			/*
173 			 * the packet was already tagged, so part of the
174 			 * processing was already done, and we need to go down.
175 			 * Get parameters from the header.
176 			 */
177 			args.rule = ((struct dn_pkt *)m0)->rule;
178 			opt = NULL ;
179 			ro = & ( ((struct dn_pkt *)m0)->ro ) ;
180 			imo = NULL ;
181 			dst = ((struct dn_pkt *)m0)->dn_dst ;
182 			ifp = ((struct dn_pkt *)m0)->ifp ;
183 			flags = ((struct dn_pkt *)m0)->flags ;
184 			break;
185 
186 		case PACKET_TAG_DIVERT:
187 			args.divert_rule = (intptr_t)m0->m_data & 0xffff;
188 			break;
189 
190 		case PACKET_TAG_IPFORWARD:
191 			args.next_hop = (struct sockaddr_in *)m0->m_data;
192 			break;
193 		}
194 	}
195 	m = m0;
196 
197 	M_ASSERTPKTHDR(m);
198 #ifndef FAST_IPSEC
199 	KASSERT(ro != NULL, ("ip_output: no route, proto %d",
200 	    mtod(m, struct ip *)->ip_p));
201 #endif
202 
203 	if (args.rule != NULL) {	/* dummynet already saw us */
204 		ip = mtod(m, struct ip *);
205 		hlen = ip->ip_hl << 2 ;
206 		if (ro->ro_rt)
207 			ia = ifatoia(ro->ro_rt->rt_ifa);
208 		goto sendit;
209 	}
210 
211 	if (opt) {
212 		len = 0;
213 		m = ip_insertoptions(m, opt, &len);
214 		if (len != 0)
215 			hlen = len;
216 	}
217 	ip = mtod(m, struct ip *);
218 	pkt_dst = args.next_hop ? args.next_hop->sin_addr : ip->ip_dst;
219 
220 	/*
221 	 * Fill in IP header.  If we are not allowing fragmentation,
222 	 * then the ip_id field is meaningless, so send it as zero
223 	 * to reduce information leakage.  Otherwise, if we are not
224 	 * randomizing ip_id, then don't bother to convert it to network
225 	 * byte order -- it's just a nonce.  Note that a 16-bit counter
226 	 * will wrap around in less than 10 seconds at 100 Mbit/s on a
227 	 * medium with MTU 1500.  See Steven M. Bellovin, "A Technique
228 	 * for Counting NATted Hosts", Proc. IMW'02, available at
229 	 * <http://www.research.att.com/~smb/papers/fnat.pdf>.
230 	 */
231 	if ((flags & (IP_FORWARDING|IP_RAWOUTPUT)) == 0) {
232 		ip->ip_v = IPVERSION;
233 		ip->ip_hl = hlen >> 2;
234 		if ((ip->ip_off & IP_DF) == 0) {
235 			ip->ip_off = 0;
236 #ifdef RANDOM_IP_ID
237 			ip->ip_id = ip_randomid();
238 #else
239 			ip->ip_id = ip_id++;
240 #endif
241 		} else {
242 			ip->ip_off = IP_DF;
243 			ip->ip_id = 0;
244 		}
245 		ipstat.ips_localout++;
246 	} else {
247 		hlen = ip->ip_hl << 2;
248 	}
249 
250 #ifdef FAST_IPSEC
251 	if (ro == NULL) {
252 		ro = &iproute;
253 		bzero(ro, sizeof (*ro));
254 	}
255 #endif /* FAST_IPSEC */
256 	dst = (struct sockaddr_in *)&ro->ro_dst;
257 	/*
258 	 * If there is a cached route,
259 	 * check that it is to the same destination
260 	 * and is still up.  If not, free it and try again.
261 	 * The address family should also be checked in case of sharing the
262 	 * cache with IPv6.
263 	 */
264 	if (ro->ro_rt && ((ro->ro_rt->rt_flags & RTF_UP) == 0 ||
265 			  dst->sin_family != AF_INET ||
266 			  dst->sin_addr.s_addr != pkt_dst.s_addr)) {
267 		RTFREE(ro->ro_rt);
268 		ro->ro_rt = (struct rtentry *)0;
269 	}
270 	if (ro->ro_rt == 0) {
271 		bzero(dst, sizeof(*dst));
272 		dst->sin_family = AF_INET;
273 		dst->sin_len = sizeof(*dst);
274 		dst->sin_addr = pkt_dst;
275 	}
276 	/*
277 	 * If routing to interface only,
278 	 * short circuit routing lookup.
279 	 */
280 	if (flags & IP_ROUTETOIF) {
281 		if ((ia = ifatoia(ifa_ifwithdstaddr(sintosa(dst)))) == 0 &&
282 		    (ia = ifatoia(ifa_ifwithnet(sintosa(dst)))) == 0) {
283 			ipstat.ips_noroute++;
284 			error = ENETUNREACH;
285 			goto bad;
286 		}
287 		ifp = ia->ia_ifp;
288 		ip->ip_ttl = 1;
289 		isbroadcast = in_broadcast(dst->sin_addr, ifp);
290 	} else if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) &&
291 	    imo != NULL && imo->imo_multicast_ifp != NULL) {
292 		/*
293 		 * Bypass the normal routing lookup for multicast
294 		 * packets if the interface is specified.
295 		 */
296 		ifp = imo->imo_multicast_ifp;
297 		IFP_TO_IA(ifp, ia);
298 		isbroadcast = 0;	/* fool gcc */
299 	} else {
300 		/*
301 		 * If this is the case, we probably don't want to allocate
302 		 * a protocol-cloned route since we didn't get one from the
303 		 * ULP.  This lets TCP do its thing, while not burdening
304 		 * forwarding or ICMP with the overhead of cloning a route.
305 		 * Of course, we still want to do any cloning requested by
306 		 * the link layer, as this is probably required in all cases
307 		 * for correct operation (as it is for ARP).
308 		 */
309 		if (ro->ro_rt == 0)
310 			rtalloc_ign(ro, RTF_PRCLONING);
311 		if (ro->ro_rt == 0) {
312 			ipstat.ips_noroute++;
313 			error = EHOSTUNREACH;
314 			goto bad;
315 		}
316 		ia = ifatoia(ro->ro_rt->rt_ifa);
317 		ifp = ro->ro_rt->rt_ifp;
318 		ro->ro_rt->rt_use++;
319 		if (ro->ro_rt->rt_flags & RTF_GATEWAY)
320 			dst = (struct sockaddr_in *)ro->ro_rt->rt_gateway;
321 		if (ro->ro_rt->rt_flags & RTF_HOST)
322 			isbroadcast = (ro->ro_rt->rt_flags & RTF_BROADCAST);
323 		else
324 			isbroadcast = in_broadcast(dst->sin_addr, ifp);
325 	}
326 	if (IN_MULTICAST(ntohl(pkt_dst.s_addr))) {
327 		struct in_multi *inm;
328 
329 		m->m_flags |= M_MCAST;
330 		/*
331 		 * IP destination address is multicast.  Make sure "dst"
332 		 * still points to the address in "ro".  (It may have been
333 		 * changed to point to a gateway address, above.)
334 		 */
335 		dst = (struct sockaddr_in *)&ro->ro_dst;
336 		/*
337 		 * See if the caller provided any multicast options
338 		 */
339 		if (imo != NULL) {
340 			ip->ip_ttl = imo->imo_multicast_ttl;
341 			if (imo->imo_multicast_vif != -1)
342 				ip->ip_src.s_addr =
343 				    ip_mcast_src ?
344 				    ip_mcast_src(imo->imo_multicast_vif) :
345 				    INADDR_ANY;
346 		} else
347 			ip->ip_ttl = IP_DEFAULT_MULTICAST_TTL;
348 		/*
349 		 * Confirm that the outgoing interface supports multicast.
350 		 */
351 		if ((imo == NULL) || (imo->imo_multicast_vif == -1)) {
352 			if ((ifp->if_flags & IFF_MULTICAST) == 0) {
353 				ipstat.ips_noroute++;
354 				error = ENETUNREACH;
355 				goto bad;
356 			}
357 		}
358 		/*
359 		 * If source address not specified yet, use address
360 		 * of outgoing interface.
361 		 */
362 		if (ip->ip_src.s_addr == INADDR_ANY) {
363 			/* Interface may have no addresses. */
364 			if (ia != NULL)
365 				ip->ip_src = IA_SIN(ia)->sin_addr;
366 		}
367 
368 		if (ip_mrouter && (flags & IP_FORWARDING) == 0) {
369 			/*
370 			 * XXX
371 			 * delayed checksums are not currently
372 			 * compatible with IP multicast routing
373 			 */
374 			if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
375 				in_delayed_cksum(m);
376 				m->m_pkthdr.csum_flags &=
377 					~CSUM_DELAY_DATA;
378 			}
379 		}
380 		IN_LOOKUP_MULTI(pkt_dst, ifp, inm);
381 		if (inm != NULL &&
382 		   (imo == NULL || imo->imo_multicast_loop)) {
383 			/*
384 			 * If we belong to the destination multicast group
385 			 * on the outgoing interface, and the caller did not
386 			 * forbid loopback, loop back a copy.
387 			 */
388 			ip_mloopback(ifp, m, dst, hlen);
389 		}
390 		else {
391 			/*
392 			 * If we are acting as a multicast router, perform
393 			 * multicast forwarding as if the packet had just
394 			 * arrived on the interface to which we are about
395 			 * to send.  The multicast forwarding function
396 			 * recursively calls this function, using the
397 			 * IP_FORWARDING flag to prevent infinite recursion.
398 			 *
399 			 * Multicasts that are looped back by ip_mloopback(),
400 			 * above, will be forwarded by the ip_input() routine,
401 			 * if necessary.
402 			 */
403 			if (ip_mrouter && (flags & IP_FORWARDING) == 0) {
404 				/*
405 				 * If rsvp daemon is not running, do not
406 				 * set ip_moptions. This ensures that the packet
407 				 * is multicast and not just sent down one link
408 				 * as prescribed by rsvpd.
409 				 */
410 				if (!rsvp_on)
411 					imo = NULL;
412 				if (ip_mforward &&
413 				    ip_mforward(ip, ifp, m, imo) != 0) {
414 					m_freem(m);
415 					goto done;
416 				}
417 			}
418 		}
419 
420 		/*
421 		 * Multicasts with a time-to-live of zero may be looped-
422 		 * back, above, but must not be transmitted on a network.
423 		 * Also, multicasts addressed to the loopback interface
424 		 * are not sent -- the above call to ip_mloopback() will
425 		 * loop back a copy if this host actually belongs to the
426 		 * destination group on the loopback interface.
427 		 */
428 		if (ip->ip_ttl == 0 || ifp->if_flags & IFF_LOOPBACK) {
429 			m_freem(m);
430 			goto done;
431 		}
432 
433 		goto sendit;
434 	}
435 #ifndef notdef
436 	/*
437 	 * If the source address is not specified yet, use the address
438 	 * of the outoing interface. In case, keep note we did that, so
439 	 * if the the firewall changes the next-hop causing the output
440 	 * interface to change, we can fix that.
441 	 */
442 	if (ip->ip_src.s_addr == INADDR_ANY) {
443 		/* Interface may have no addresses. */
444 		if (ia != NULL) {
445 			ip->ip_src = IA_SIN(ia)->sin_addr;
446 			src_was_INADDR_ANY = 1;
447 		}
448 	}
449 #endif /* notdef */
450 	/*
451 	 * Verify that we have any chance at all of being able to queue
452 	 *      the packet or packet fragments
453 	 */
454 	if ((ifp->if_snd.ifq_len + ip->ip_len / ifp->if_mtu + 1) >=
455 		ifp->if_snd.ifq_maxlen) {
456 			error = ENOBUFS;
457 			ipstat.ips_odropped++;
458 			goto bad;
459 	}
460 
461 	/*
462 	 * Look for broadcast address and
463 	 * verify user is allowed to send
464 	 * such a packet.
465 	 */
466 	if (isbroadcast) {
467 		if ((ifp->if_flags & IFF_BROADCAST) == 0) {
468 			error = EADDRNOTAVAIL;
469 			goto bad;
470 		}
471 		if ((flags & IP_ALLOWBROADCAST) == 0) {
472 			error = EACCES;
473 			goto bad;
474 		}
475 		/* don't allow broadcast messages to be fragmented */
476 		if (ip->ip_len > ifp->if_mtu) {
477 			error = EMSGSIZE;
478 			goto bad;
479 		}
480 		if (flags & IP_SENDONES)
481 			ip->ip_dst.s_addr = INADDR_BROADCAST;
482 		m->m_flags |= M_BCAST;
483 	} else {
484 		m->m_flags &= ~M_BCAST;
485 	}
486 
487 sendit:
488 #ifdef IPSEC
489 	/* get SP for this packet */
490 	if (inp == NULL)
491 		sp = ipsec4_getpolicybyaddr(m, IPSEC_DIR_OUTBOUND, flags, &error);
492 	else
493 		sp = ipsec4_getpolicybypcb(m, IPSEC_DIR_OUTBOUND, inp, &error);
494 
495 	if (sp == NULL) {
496 		ipsecstat.out_inval++;
497 		goto bad;
498 	}
499 
500 	error = 0;
501 
502 	/* check policy */
503 	switch (sp->policy) {
504 	case IPSEC_POLICY_DISCARD:
505 		/*
506 		 * This packet is just discarded.
507 		 */
508 		ipsecstat.out_polvio++;
509 		goto bad;
510 
511 	case IPSEC_POLICY_BYPASS:
512 	case IPSEC_POLICY_NONE:
513 		/* no need to do IPsec. */
514 		goto skip_ipsec;
515 
516 	case IPSEC_POLICY_IPSEC:
517 		if (sp->req == NULL) {
518 			/* acquire a policy */
519 			error = key_spdacquire(sp);
520 			goto bad;
521 		}
522 		break;
523 
524 	case IPSEC_POLICY_ENTRUST:
525 	default:
526 		printf("ip_output: Invalid policy found. %d\n", sp->policy);
527 	}
528     {
529 	struct ipsec_output_state state;
530 	bzero(&state, sizeof(state));
531 	state.m = m;
532 	if (flags & IP_ROUTETOIF) {
533 		state.ro = &iproute;
534 		bzero(&iproute, sizeof(iproute));
535 	} else
536 		state.ro = ro;
537 	state.dst = (struct sockaddr *)dst;
538 
539 	ip->ip_sum = 0;
540 
541 	/*
542 	 * XXX
543 	 * delayed checksums are not currently compatible with IPsec
544 	 */
545 	if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
546 		in_delayed_cksum(m);
547 		m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
548 	}
549 
550 	ip->ip_len = htons(ip->ip_len);
551 	ip->ip_off = htons(ip->ip_off);
552 
553 	error = ipsec4_output(&state, sp, flags);
554 
555 	m = state.m;
556 	if (flags & IP_ROUTETOIF) {
557 		/*
558 		 * if we have tunnel mode SA, we may need to ignore
559 		 * IP_ROUTETOIF.
560 		 */
561 		if (state.ro != &iproute || state.ro->ro_rt != NULL) {
562 			flags &= ~IP_ROUTETOIF;
563 			ro = state.ro;
564 		}
565 	} else
566 		ro = state.ro;
567 	dst = (struct sockaddr_in *)state.dst;
568 	if (error) {
569 		/* mbuf is already reclaimed in ipsec4_output. */
570 		m0 = NULL;
571 		switch (error) {
572 		case EHOSTUNREACH:
573 		case ENETUNREACH:
574 		case EMSGSIZE:
575 		case ENOBUFS:
576 		case ENOMEM:
577 			break;
578 		default:
579 			printf("ip4_output (ipsec): error code %d\n", error);
580 			/*fall through*/
581 		case ENOENT:
582 			/* don't show these error codes to the user */
583 			error = 0;
584 			break;
585 		}
586 		goto bad;
587 	}
588     }
589 
590 	/* be sure to update variables that are affected by ipsec4_output() */
591 	ip = mtod(m, struct ip *);
592 	hlen = ip->ip_hl << 2;
593 	if (ro->ro_rt == NULL) {
594 		if ((flags & IP_ROUTETOIF) == 0) {
595 			printf("ip_output: "
596 				"can't update route after IPsec processing\n");
597 			error = EHOSTUNREACH;	/*XXX*/
598 			goto bad;
599 		}
600 	} else {
601 		ia = ifatoia(ro->ro_rt->rt_ifa);
602 		ifp = ro->ro_rt->rt_ifp;
603 	}
604 
605 	/* make it flipped, again. */
606 	ip->ip_len = ntohs(ip->ip_len);
607 	ip->ip_off = ntohs(ip->ip_off);
608 skip_ipsec:
609 #endif /*IPSEC*/
610 #ifdef FAST_IPSEC
611 	/*
612 	 * Check the security policy (SP) for the packet and, if
613 	 * required, do IPsec-related processing.  There are two
614 	 * cases here; the first time a packet is sent through
615 	 * it will be untagged and handled by ipsec4_checkpolicy.
616 	 * If the packet is resubmitted to ip_output (e.g. after
617 	 * AH, ESP, etc. processing), there will be a tag to bypass
618 	 * the lookup and related policy checking.
619 	 */
620 	mtag = m_tag_find(m, PACKET_TAG_IPSEC_PENDING_TDB, NULL);
621 	s = splnet();
622 	if (mtag != NULL) {
623 		tdbi = (struct tdb_ident *)(mtag + 1);
624 		sp = ipsec_getpolicy(tdbi, IPSEC_DIR_OUTBOUND);
625 		if (sp == NULL)
626 			error = -EINVAL;	/* force silent drop */
627 		m_tag_delete(m, mtag);
628 	} else {
629 		sp = ipsec4_checkpolicy(m, IPSEC_DIR_OUTBOUND, flags,
630 					&error, inp);
631 	}
632 	/*
633 	 * There are four return cases:
634 	 *    sp != NULL	 	    apply IPsec policy
635 	 *    sp == NULL, error == 0	    no IPsec handling needed
636 	 *    sp == NULL, error == -EINVAL  discard packet w/o error
637 	 *    sp == NULL, error != 0	    discard packet, report error
638 	 */
639 	if (sp != NULL) {
640 		/* Loop detection, check if ipsec processing already done */
641 		KASSERT(sp->req != NULL, ("ip_output: no ipsec request"));
642 		for (mtag = m_tag_first(m); mtag != NULL;
643 		     mtag = m_tag_next(m, mtag)) {
644 			if (mtag->m_tag_cookie != MTAG_ABI_COMPAT)
645 				continue;
646 			if (mtag->m_tag_id != PACKET_TAG_IPSEC_OUT_DONE &&
647 			    mtag->m_tag_id != PACKET_TAG_IPSEC_OUT_CRYPTO_NEEDED)
648 				continue;
649 			/*
650 			 * Check if policy has an SA associated with it.
651 			 * This can happen when an SP has yet to acquire
652 			 * an SA; e.g. on first reference.  If it occurs,
653 			 * then we let ipsec4_process_packet do its thing.
654 			 */
655 			if (sp->req->sav == NULL)
656 				break;
657 			tdbi = (struct tdb_ident *)(mtag + 1);
658 			if (tdbi->spi == sp->req->sav->spi &&
659 			    tdbi->proto == sp->req->sav->sah->saidx.proto &&
660 			    bcmp(&tdbi->dst, &sp->req->sav->sah->saidx.dst,
661 				 sizeof (union sockaddr_union)) == 0) {
662 				/*
663 				 * No IPsec processing is needed, free
664 				 * reference to SP.
665 				 *
666 				 * NB: null pointer to avoid free at
667 				 *     done: below.
668 				 */
669 				KEY_FREESP(&sp), sp = NULL;
670 				splx(s);
671 				goto spd_done;
672 			}
673 		}
674 
675 		/*
676 		 * Do delayed checksums now because we send before
677 		 * this is done in the normal processing path.
678 		 */
679 		if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
680 			in_delayed_cksum(m);
681 			m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
682 		}
683 
684 		ip->ip_len = htons(ip->ip_len);
685 		ip->ip_off = htons(ip->ip_off);
686 
687 		/* NB: callee frees mbuf */
688 		error = ipsec4_process_packet(m, sp->req, flags, 0);
689 		/*
690 		 * Preserve KAME behaviour: ENOENT can be returned
691 		 * when an SA acquire is in progress.  Don't propagate
692 		 * this to user-level; it confuses applications.
693 		 *
694 		 * XXX this will go away when the SADB is redone.
695 		 */
696 		if (error == ENOENT)
697 			error = 0;
698 		splx(s);
699 		goto done;
700 	} else {
701 		splx(s);
702 
703 		if (error != 0) {
704 			/*
705 			 * Hack: -EINVAL is used to signal that a packet
706 			 * should be silently discarded.  This is typically
707 			 * because we asked key management for an SA and
708 			 * it was delayed (e.g. kicked up to IKE).
709 			 */
710 			if (error == -EINVAL)
711 				error = 0;
712 			goto bad;
713 		} else {
714 			/* No IPsec processing for this packet. */
715 		}
716 #ifdef notyet
717 		/*
718 		 * If deferred crypto processing is needed, check that
719 		 * the interface supports it.
720 		 */
721 		mtag = m_tag_find(m, PACKET_TAG_IPSEC_OUT_CRYPTO_NEEDED, NULL);
722 		if (mtag != NULL && (ifp->if_capenable & IFCAP_IPSEC) == 0) {
723 			/* notify IPsec to do its own crypto */
724 			ipsp_skipcrypto_unmark((struct tdb_ident *)(mtag + 1));
725 			error = EHOSTUNREACH;
726 			goto bad;
727 		}
728 #endif
729 	}
730 spd_done:
731 #endif /* FAST_IPSEC */
732 
733 	/*
734 	 * IpHack's section.
735 	 * - Xlate: translate packet's addr/port (NAT).
736 	 * - Firewall: deny/allow/etc.
737 	 * - Wrap: fake packet's addr/port <unimpl.>
738 	 * - Encapsulate: put it in another IP and send out. <unimp.>
739 	 */
740 #ifdef PFIL_HOOKS
741 	/*
742 	 * Run through list of hooks for output packets.
743 	 */
744 	m1 = m;
745 	pfh = pfil_hook_get(PFIL_OUT, &inetsw[ip_protox[IPPROTO_IP]].pr_pfh);
746 	for (; pfh; pfh = TAILQ_NEXT(pfh, pfil_link))
747 		if (pfh->pfil_func) {
748 			rv = pfh->pfil_func(ip, hlen, ifp, 1, &m1);
749 			if (rv) {
750 				error = EHOSTUNREACH;
751 				goto done;
752 			}
753 			m = m1;
754 			if (m == NULL)
755 				goto done;
756 			ip = mtod(m, struct ip *);
757 		}
758 #endif /* PFIL_HOOKS */
759 
760 	/*
761 	 * Check with the firewall...
762 	 * but not if we are already being fwd'd from a firewall.
763 	 */
764 	if (fw_enable && IPFW_LOADED && !args.next_hop) {
765 		struct sockaddr_in *old = dst;
766 
767 		args.m = m;
768 		args.next_hop = dst;
769 		args.oif = ifp;
770 		off = ip_fw_chk_ptr(&args);
771 		m = args.m;
772 		dst = args.next_hop;
773 
774                 /*
775 		 * On return we must do the following:
776 		 * m == NULL	-> drop the pkt (old interface, deprecated)
777 		 * (off & IP_FW_PORT_DENY_FLAG)	-> drop the pkt (new interface)
778 		 * 1<=off<= 0xffff		-> DIVERT
779 		 * (off & IP_FW_PORT_DYNT_FLAG)	-> send to a DUMMYNET pipe
780 		 * (off & IP_FW_PORT_TEE_FLAG)	-> TEE the packet
781 		 * dst != old			-> IPFIREWALL_FORWARD
782 		 * off==0, dst==old		-> accept
783 		 * If some of the above modules are not compiled in, then
784 		 * we should't have to check the corresponding condition
785 		 * (because the ipfw control socket should not accept
786 		 * unsupported rules), but better play safe and drop
787 		 * packets in case of doubt.
788 		 */
789 		if ( (off & IP_FW_PORT_DENY_FLAG) || m == NULL) {
790 			if (m)
791 				m_freem(m);
792 			error = EACCES;
793 			goto done;
794 		}
795 		ip = mtod(m, struct ip *);
796 		if (off == 0 && dst == old)		/* common case */
797 			goto pass;
798                 if (DUMMYNET_LOADED && (off & IP_FW_PORT_DYNT_FLAG) != 0) {
799 			/*
800 			 * pass the pkt to dummynet. Need to include
801 			 * pipe number, m, ifp, ro, dst because these are
802 			 * not recomputed in the next pass.
803 			 * All other parameters have been already used and
804 			 * so they are not needed anymore.
805 			 * XXX note: if the ifp or ro entry are deleted
806 			 * while a pkt is in dummynet, we are in trouble!
807 			 */
808 			args.ro = ro;
809 			args.dst = dst;
810 			args.flags = flags;
811 
812 			error = ip_dn_io_ptr(m, off & 0xffff, DN_TO_IP_OUT,
813 				&args);
814 			goto done;
815 		}
816 #ifdef IPDIVERT
817 		if (off != 0 && (off & IP_FW_PORT_DYNT_FLAG) == 0) {
818 			struct mbuf *clone = NULL;
819 
820 			/* Clone packet if we're doing a 'tee' */
821 			if ((off & IP_FW_PORT_TEE_FLAG) != 0)
822 				clone = m_dup(m, M_DONTWAIT);
823 
824 			/*
825 			 * XXX
826 			 * delayed checksums are not currently compatible
827 			 * with divert sockets.
828 			 */
829 			if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
830 				in_delayed_cksum(m);
831 				m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
832 			}
833 
834 			/* Restore packet header fields to original values */
835 			ip->ip_len = htons(ip->ip_len);
836 			ip->ip_off = htons(ip->ip_off);
837 
838 			/* Deliver packet to divert input routine */
839 			divert_packet(m, 0, off & 0xffff, args.divert_rule);
840 
841 			/* If 'tee', continue with original packet */
842 			if (clone != NULL) {
843 				m = clone;
844 				ip = mtod(m, struct ip *);
845 				goto pass;
846 			}
847 			goto done;
848 		}
849 #endif
850 
851 		/* IPFIREWALL_FORWARD */
852 		/*
853 		 * Check dst to make sure it is directly reachable on the
854 		 * interface we previously thought it was.
855 		 * If it isn't (which may be likely in some situations) we have
856 		 * to re-route it (ie, find a route for the next-hop and the
857 		 * associated interface) and set them here. This is nested
858 		 * forwarding which in most cases is undesirable, except where
859 		 * such control is nigh impossible. So we do it here.
860 		 * And I'm babbling.
861 		 */
862 		if (off == 0 && old != dst) { /* FORWARD, dst has changed */
863 #if 0
864 			/*
865 			 * XXX To improve readability, this block should be
866 			 * changed into a function call as below:
867 			 */
868 			error = ip_ipforward(&m, &dst, &ifp);
869 			if (error)
870 				goto bad;
871 			if (m == NULL) /* ip_input consumed the mbuf */
872 				goto done;
873 #else
874 			struct in_ifaddr *ia;
875 
876 			/*
877 			 * XXX sro_fwd below is static, and a pointer
878 			 * to it gets passed to routines downstream.
879 			 * This could have surprisingly bad results in
880 			 * practice, because its content is overwritten
881 			 * by subsequent packets.
882 			 */
883 			/* There must be a better way to do this next line... */
884 			static struct route sro_fwd;
885 			struct route *ro_fwd = &sro_fwd;
886 
887 #if 0
888 			print_ip("IPFIREWALL_FORWARD: New dst ip: ",
889 			    dst->sin_addr, "\n");
890 #endif
891 
892 			/*
893 			 * We need to figure out if we have been forwarded
894 			 * to a local socket. If so, then we should somehow
895 			 * "loop back" to ip_input, and get directed to the
896 			 * PCB as if we had received this packet. This is
897 			 * because it may be dificult to identify the packets
898 			 * you want to forward until they are being output
899 			 * and have selected an interface. (e.g. locally
900 			 * initiated packets) If we used the loopback inteface,
901 			 * we would not be able to control what happens
902 			 * as the packet runs through ip_input() as
903 			 * it is done through an ISR.
904 			 */
905 			LIST_FOREACH(ia,
906 			    INADDR_HASH(dst->sin_addr.s_addr), ia_hash) {
907 				/*
908 				 * If the addr to forward to is one
909 				 * of ours, we pretend to
910 				 * be the destination for this packet.
911 				 */
912 				if (IA_SIN(ia)->sin_addr.s_addr ==
913 						 dst->sin_addr.s_addr)
914 					break;
915 			}
916 			if (ia) {	/* tell ip_input "dont filter" */
917 				struct m_hdr tag;
918 
919 				tag.mh_type = MT_TAG;
920 				tag.mh_flags = PACKET_TAG_IPFORWARD;
921 				tag.mh_data = (caddr_t)args.next_hop;
922 				tag.mh_next = m;
923 
924 				if (m->m_pkthdr.rcvif == NULL)
925 					m->m_pkthdr.rcvif = ifunit("lo0");
926 				if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
927 					m->m_pkthdr.csum_flags |=
928 					    CSUM_DATA_VALID | CSUM_PSEUDO_HDR;
929 					m0->m_pkthdr.csum_data = 0xffff;
930 				}
931 				m->m_pkthdr.csum_flags |=
932 				    CSUM_IP_CHECKED | CSUM_IP_VALID;
933 				ip->ip_len = htons(ip->ip_len);
934 				ip->ip_off = htons(ip->ip_off);
935 				ip_input((struct mbuf *)&tag);
936 				goto done;
937 			}
938 			/* Some of the logic for this was
939 			 * nicked from above.
940 			 *
941 			 * This rewrites the cached route in a local PCB.
942 			 * Is this what we want to do?
943 			 */
944 			bcopy(dst, &ro_fwd->ro_dst, sizeof(*dst));
945 
946 			ro_fwd->ro_rt = 0;
947 			rtalloc_ign(ro_fwd, RTF_PRCLONING);
948 
949 			if (ro_fwd->ro_rt == 0) {
950 				ipstat.ips_noroute++;
951 				error = EHOSTUNREACH;
952 				goto bad;
953 			}
954 
955 			ia = ifatoia(ro_fwd->ro_rt->rt_ifa);
956 			ifp = ro_fwd->ro_rt->rt_ifp;
957 			ro_fwd->ro_rt->rt_use++;
958 			if (ro_fwd->ro_rt->rt_flags & RTF_GATEWAY)
959 				dst = (struct sockaddr_in *)
960 					ro_fwd->ro_rt->rt_gateway;
961 			if (ro_fwd->ro_rt->rt_flags & RTF_HOST)
962 				isbroadcast =
963 				    (ro_fwd->ro_rt->rt_flags & RTF_BROADCAST);
964 			else
965 				isbroadcast = in_broadcast(dst->sin_addr, ifp);
966 			if (ro->ro_rt)
967 				RTFREE(ro->ro_rt);
968 			ro->ro_rt = ro_fwd->ro_rt;
969 			dst = (struct sockaddr_in *)&ro_fwd->ro_dst;
970 
971 #endif	/* ... block to be put into a function */
972 			/*
973 			 * If we added a default src ip earlier,
974 			 * which would have been gotten from the-then
975 			 * interface, do it again, from the new one.
976 			 */
977 			if (src_was_INADDR_ANY)
978 				ip->ip_src = IA_SIN(ia)->sin_addr;
979 			goto pass ;
980 		}
981 
982                 /*
983                  * if we get here, none of the above matches, and
984                  * we have to drop the pkt
985                  */
986 		m_freem(m);
987                 error = EACCES; /* not sure this is the right error msg */
988                 goto done;
989 	}
990 
991 pass:
992 	/* 127/8 must not appear on wire - RFC1122. */
993 	if ((ntohl(ip->ip_dst.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET ||
994 	    (ntohl(ip->ip_src.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET) {
995 		if ((ifp->if_flags & IFF_LOOPBACK) == 0) {
996 			ipstat.ips_badaddr++;
997 			error = EADDRNOTAVAIL;
998 			goto bad;
999 		}
1000 	}
1001 
1002 	m->m_pkthdr.csum_flags |= CSUM_IP;
1003 	sw_csum = m->m_pkthdr.csum_flags & ~ifp->if_hwassist;
1004 	if (sw_csum & CSUM_DELAY_DATA) {
1005 		in_delayed_cksum(m);
1006 		sw_csum &= ~CSUM_DELAY_DATA;
1007 	}
1008 	m->m_pkthdr.csum_flags &= ifp->if_hwassist;
1009 
1010 	/*
1011 	 * If small enough for interface, or the interface will take
1012 	 * care of the fragmentation for us, can just send directly.
1013 	 */
1014 	if (ip->ip_len <= ifp->if_mtu || ifp->if_hwassist & CSUM_FRAGMENT) {
1015 		ip->ip_len = htons(ip->ip_len);
1016 		ip->ip_off = htons(ip->ip_off);
1017 		ip->ip_sum = 0;
1018 		if (sw_csum & CSUM_DELAY_IP)
1019 			ip->ip_sum = in_cksum(m, hlen);
1020 
1021 		/* Record statistics for this interface address. */
1022 		if (!(flags & IP_FORWARDING) && ia) {
1023 			ia->ia_ifa.if_opackets++;
1024 			ia->ia_ifa.if_obytes += m->m_pkthdr.len;
1025 		}
1026 
1027 #ifdef IPSEC
1028 		/* clean ipsec history once it goes out of the node */
1029 		ipsec_delaux(m);
1030 #endif
1031 
1032 #ifdef MBUF_STRESS_TEST
1033 		if (mbuf_frag_size && m->m_pkthdr.len > mbuf_frag_size)
1034 			m = m_fragment(m, M_DONTWAIT, mbuf_frag_size);
1035 #endif
1036 		error = (*ifp->if_output)(ifp, m,
1037 				(struct sockaddr *)dst, ro->ro_rt);
1038 		goto done;
1039 	}
1040 
1041 	if (ip->ip_off & IP_DF) {
1042 		error = EMSGSIZE;
1043 		/*
1044 		 * This case can happen if the user changed the MTU
1045 		 * of an interface after enabling IP on it.  Because
1046 		 * most netifs don't keep track of routes pointing to
1047 		 * them, there is no way for one to update all its
1048 		 * routes when the MTU is changed.
1049 		 */
1050 		if ((ro->ro_rt->rt_flags & (RTF_UP | RTF_HOST)) &&
1051 		    !(ro->ro_rt->rt_rmx.rmx_locks & RTV_MTU) &&
1052 		    (ro->ro_rt->rt_rmx.rmx_mtu > ifp->if_mtu)) {
1053 			ro->ro_rt->rt_rmx.rmx_mtu = ifp->if_mtu;
1054 		}
1055 		ipstat.ips_cantfrag++;
1056 		goto bad;
1057 	}
1058 
1059 	/*
1060 	 * Too large for interface; fragment if possible. If successful,
1061 	 * on return, m will point to a list of packets to be sent.
1062 	 */
1063 	error = ip_fragment(ip, &m, ifp->if_mtu, ifp->if_hwassist, sw_csum);
1064 	if (error)
1065 		goto bad;
1066 	for (; m; m = m0) {
1067 		m0 = m->m_nextpkt;
1068 		m->m_nextpkt = 0;
1069 #ifdef IPSEC
1070 		/* clean ipsec history once it goes out of the node */
1071 		ipsec_delaux(m);
1072 #endif
1073 		if (error == 0) {
1074 			/* Record statistics for this interface address. */
1075 			if (ia != NULL) {
1076 				ia->ia_ifa.if_opackets++;
1077 				ia->ia_ifa.if_obytes += m->m_pkthdr.len;
1078 			}
1079 
1080 			error = (*ifp->if_output)(ifp, m,
1081 			    (struct sockaddr *)dst, ro->ro_rt);
1082 		} else
1083 			m_freem(m);
1084 	}
1085 
1086 	if (error == 0)
1087 		ipstat.ips_fragmented++;
1088 
1089 done:
1090 #ifdef IPSEC
1091 	if (ro == &iproute && ro->ro_rt) {
1092 		RTFREE(ro->ro_rt);
1093 		ro->ro_rt = NULL;
1094 	}
1095 	if (sp != NULL) {
1096 		KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
1097 			printf("DP ip_output call free SP:%p\n", sp));
1098 		key_freesp(sp);
1099 	}
1100 #endif
1101 #ifdef FAST_IPSEC
1102 	if (ro == &iproute && ro->ro_rt) {
1103 		RTFREE(ro->ro_rt);
1104 		ro->ro_rt = NULL;
1105 	}
1106 	if (sp != NULL)
1107 		KEY_FREESP(&sp);
1108 #endif
1109 	return (error);
1110 bad:
1111 	m_freem(m);
1112 	goto done;
1113 }
1114 
1115 /*
1116  * Create a chain of fragments which fit the given mtu. m_frag points to the
1117  * mbuf to be fragmented; on return it points to the chain with the fragments.
1118  * Return 0 if no error. If error, m_frag may contain a partially built
1119  * chain of fragments that should be freed by the caller.
1120  *
1121  * if_hwassist_flags is the hw offload capabilities (see if_data.ifi_hwassist)
1122  * sw_csum contains the delayed checksums flags (e.g., CSUM_DELAY_IP).
1123  */
1124 int
1125 ip_fragment(struct ip *ip, struct mbuf **m_frag, int mtu,
1126 	    u_long if_hwassist_flags, int sw_csum)
1127 {
1128 	int error = 0;
1129 	int hlen = ip->ip_hl << 2;
1130 	int len = (mtu - hlen) & ~7;	/* size of payload in each fragment */
1131 	int off;
1132 	struct mbuf *m0 = *m_frag;	/* the original packet		*/
1133 	int firstlen;
1134 	struct mbuf **mnext;
1135 	int nfrags;
1136 
1137 	if (ip->ip_off & IP_DF) {	/* Fragmentation not allowed */
1138 		ipstat.ips_cantfrag++;
1139 		return EMSGSIZE;
1140 	}
1141 
1142 	/*
1143 	 * Must be able to put at least 8 bytes per fragment.
1144 	 */
1145 	if (len < 8)
1146 		return EMSGSIZE;
1147 
1148 	/*
1149 	 * If the interface will not calculate checksums on
1150 	 * fragmented packets, then do it here.
1151 	 */
1152 	if (m0->m_pkthdr.csum_flags & CSUM_DELAY_DATA &&
1153 	    (if_hwassist_flags & CSUM_IP_FRAGS) == 0) {
1154 		in_delayed_cksum(m0);
1155 		m0->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
1156 	}
1157 
1158 	if (len > PAGE_SIZE) {
1159 		/*
1160 		 * Fragment large datagrams such that each segment
1161 		 * contains a multiple of PAGE_SIZE amount of data,
1162 		 * plus headers. This enables a receiver to perform
1163 		 * page-flipping zero-copy optimizations.
1164 		 *
1165 		 * XXX When does this help given that sender and receiver
1166 		 * could have different page sizes, and also mtu could
1167 		 * be less than the receiver's page size ?
1168 		 */
1169 		int newlen;
1170 		struct mbuf *m;
1171 
1172 		for (m = m0, off = 0; m && (off+m->m_len) <= mtu; m = m->m_next)
1173 			off += m->m_len;
1174 
1175 		/*
1176 		 * firstlen (off - hlen) must be aligned on an
1177 		 * 8-byte boundary
1178 		 */
1179 		if (off < hlen)
1180 			goto smart_frag_failure;
1181 		off = ((off - hlen) & ~7) + hlen;
1182 		newlen = (~PAGE_MASK) & mtu;
1183 		if ((newlen + sizeof (struct ip)) > mtu) {
1184 			/* we failed, go back the default */
1185 smart_frag_failure:
1186 			newlen = len;
1187 			off = hlen + len;
1188 		}
1189 		len = newlen;
1190 
1191 	} else {
1192 		off = hlen + len;
1193 	}
1194 
1195 	firstlen = off - hlen;
1196 	mnext = &m0->m_nextpkt;		/* pointer to next packet */
1197 
1198 	/*
1199 	 * Loop through length of segment after first fragment,
1200 	 * make new header and copy data of each part and link onto chain.
1201 	 * Here, m0 is the original packet, m is the fragment being created.
1202 	 * The fragments are linked off the m_nextpkt of the original
1203 	 * packet, which after processing serves as the first fragment.
1204 	 */
1205 	for (nfrags = 1; off < ip->ip_len; off += len, nfrags++) {
1206 		struct ip *mhip;	/* ip header on the fragment */
1207 		struct mbuf *m;
1208 		int mhlen = sizeof (struct ip);
1209 
1210 		MGETHDR(m, M_DONTWAIT, MT_HEADER);
1211 		if (m == 0) {
1212 			error = ENOBUFS;
1213 			ipstat.ips_odropped++;
1214 			goto done;
1215 		}
1216 		m->m_flags |= (m0->m_flags & M_MCAST) | M_FRAG;
1217 		/*
1218 		 * In the first mbuf, leave room for the link header, then
1219 		 * copy the original IP header including options. The payload
1220 		 * goes into an additional mbuf chain returned by m_copy().
1221 		 */
1222 		m->m_data += max_linkhdr;
1223 		mhip = mtod(m, struct ip *);
1224 		*mhip = *ip;
1225 		if (hlen > sizeof (struct ip)) {
1226 			mhlen = ip_optcopy(ip, mhip) + sizeof (struct ip);
1227 			mhip->ip_v = IPVERSION;
1228 			mhip->ip_hl = mhlen >> 2;
1229 		}
1230 		m->m_len = mhlen;
1231 		/* XXX do we need to add ip->ip_off below ? */
1232 		mhip->ip_off = ((off - hlen) >> 3) + ip->ip_off;
1233 		if (off + len >= ip->ip_len) {	/* last fragment */
1234 			len = ip->ip_len - off;
1235 			m->m_flags |= M_LASTFRAG;
1236 		} else
1237 			mhip->ip_off |= IP_MF;
1238 		mhip->ip_len = htons((u_short)(len + mhlen));
1239 		m->m_next = m_copy(m0, off, len);
1240 		if (m->m_next == 0) {		/* copy failed */
1241 			m_free(m);
1242 			error = ENOBUFS;	/* ??? */
1243 			ipstat.ips_odropped++;
1244 			goto done;
1245 		}
1246 		m->m_pkthdr.len = mhlen + len;
1247 		m->m_pkthdr.rcvif = (struct ifnet *)0;
1248 #ifdef MAC
1249 		mac_create_fragment(m0, m);
1250 #endif
1251 		m->m_pkthdr.csum_flags = m0->m_pkthdr.csum_flags;
1252 		mhip->ip_off = htons(mhip->ip_off);
1253 		mhip->ip_sum = 0;
1254 		if (sw_csum & CSUM_DELAY_IP)
1255 			mhip->ip_sum = in_cksum(m, mhlen);
1256 		*mnext = m;
1257 		mnext = &m->m_nextpkt;
1258 	}
1259 	ipstat.ips_ofragments += nfrags;
1260 
1261 	/* set first marker for fragment chain */
1262 	m0->m_flags |= M_FIRSTFRAG | M_FRAG;
1263 	m0->m_pkthdr.csum_data = nfrags;
1264 
1265 	/*
1266 	 * Update first fragment by trimming what's been copied out
1267 	 * and updating header.
1268 	 */
1269 	m_adj(m0, hlen + firstlen - ip->ip_len);
1270 	m0->m_pkthdr.len = hlen + firstlen;
1271 	ip->ip_len = htons((u_short)m0->m_pkthdr.len);
1272 	ip->ip_off |= IP_MF;
1273 	ip->ip_off = htons(ip->ip_off);
1274 	ip->ip_sum = 0;
1275 	if (sw_csum & CSUM_DELAY_IP)
1276 		ip->ip_sum = in_cksum(m0, hlen);
1277 
1278 done:
1279 	*m_frag = m0;
1280 	return error;
1281 }
1282 
1283 void
1284 in_delayed_cksum(struct mbuf *m)
1285 {
1286 	struct ip *ip;
1287 	u_short csum, offset;
1288 
1289 	ip = mtod(m, struct ip *);
1290 	offset = ip->ip_hl << 2 ;
1291 	csum = in_cksum_skip(m, ip->ip_len, offset);
1292 	if (m->m_pkthdr.csum_flags & CSUM_UDP && csum == 0)
1293 		csum = 0xffff;
1294 	offset += m->m_pkthdr.csum_data;	/* checksum offset */
1295 
1296 	if (offset + sizeof(u_short) > m->m_len) {
1297 		printf("delayed m_pullup, m->len: %d  off: %d  p: %d\n",
1298 		    m->m_len, offset, ip->ip_p);
1299 		/*
1300 		 * XXX
1301 		 * this shouldn't happen, but if it does, the
1302 		 * correct behavior may be to insert the checksum
1303 		 * in the existing chain instead of rearranging it.
1304 		 */
1305 		m = m_pullup(m, offset + sizeof(u_short));
1306 	}
1307 	*(u_short *)(m->m_data + offset) = csum;
1308 }
1309 
1310 /*
1311  * Insert IP options into preformed packet.
1312  * Adjust IP destination as required for IP source routing,
1313  * as indicated by a non-zero in_addr at the start of the options.
1314  *
1315  * XXX This routine assumes that the packet has no options in place.
1316  */
1317 static struct mbuf *
1318 ip_insertoptions(m, opt, phlen)
1319 	register struct mbuf *m;
1320 	struct mbuf *opt;
1321 	int *phlen;
1322 {
1323 	register struct ipoption *p = mtod(opt, struct ipoption *);
1324 	struct mbuf *n;
1325 	register struct ip *ip = mtod(m, struct ip *);
1326 	unsigned optlen;
1327 
1328 	optlen = opt->m_len - sizeof(p->ipopt_dst);
1329 	if (optlen + ip->ip_len > IP_MAXPACKET) {
1330 		*phlen = 0;
1331 		return (m);		/* XXX should fail */
1332 	}
1333 	if (p->ipopt_dst.s_addr)
1334 		ip->ip_dst = p->ipopt_dst;
1335 	if (m->m_flags & M_EXT || m->m_data - optlen < m->m_pktdat) {
1336 		MGETHDR(n, M_DONTWAIT, MT_HEADER);
1337 		if (n == 0) {
1338 			*phlen = 0;
1339 			return (m);
1340 		}
1341 		n->m_pkthdr.rcvif = (struct ifnet *)0;
1342 #ifdef MAC
1343 		mac_create_mbuf_from_mbuf(m, n);
1344 #endif
1345 		n->m_pkthdr.len = m->m_pkthdr.len + optlen;
1346 		m->m_len -= sizeof(struct ip);
1347 		m->m_data += sizeof(struct ip);
1348 		n->m_next = m;
1349 		m = n;
1350 		m->m_len = optlen + sizeof(struct ip);
1351 		m->m_data += max_linkhdr;
1352 		bcopy(ip, mtod(m, void *), sizeof(struct ip));
1353 	} else {
1354 		m->m_data -= optlen;
1355 		m->m_len += optlen;
1356 		m->m_pkthdr.len += optlen;
1357 		bcopy(ip, mtod(m, void *), sizeof(struct ip));
1358 	}
1359 	ip = mtod(m, struct ip *);
1360 	bcopy(p->ipopt_list, ip + 1, optlen);
1361 	*phlen = sizeof(struct ip) + optlen;
1362 	ip->ip_v = IPVERSION;
1363 	ip->ip_hl = *phlen >> 2;
1364 	ip->ip_len += optlen;
1365 	return (m);
1366 }
1367 
1368 /*
1369  * Copy options from ip to jp,
1370  * omitting those not copied during fragmentation.
1371  */
1372 int
1373 ip_optcopy(ip, jp)
1374 	struct ip *ip, *jp;
1375 {
1376 	register u_char *cp, *dp;
1377 	int opt, optlen, cnt;
1378 
1379 	cp = (u_char *)(ip + 1);
1380 	dp = (u_char *)(jp + 1);
1381 	cnt = (ip->ip_hl << 2) - sizeof (struct ip);
1382 	for (; cnt > 0; cnt -= optlen, cp += optlen) {
1383 		opt = cp[0];
1384 		if (opt == IPOPT_EOL)
1385 			break;
1386 		if (opt == IPOPT_NOP) {
1387 			/* Preserve for IP mcast tunnel's LSRR alignment. */
1388 			*dp++ = IPOPT_NOP;
1389 			optlen = 1;
1390 			continue;
1391 		}
1392 
1393 		KASSERT(cnt >= IPOPT_OLEN + sizeof(*cp),
1394 		    ("ip_optcopy: malformed ipv4 option"));
1395 		optlen = cp[IPOPT_OLEN];
1396 		KASSERT(optlen >= IPOPT_OLEN + sizeof(*cp) && optlen <= cnt,
1397 		    ("ip_optcopy: malformed ipv4 option"));
1398 
1399 		/* bogus lengths should have been caught by ip_dooptions */
1400 		if (optlen > cnt)
1401 			optlen = cnt;
1402 		if (IPOPT_COPIED(opt)) {
1403 			bcopy(cp, dp, optlen);
1404 			dp += optlen;
1405 		}
1406 	}
1407 	for (optlen = dp - (u_char *)(jp+1); optlen & 0x3; optlen++)
1408 		*dp++ = IPOPT_EOL;
1409 	return (optlen);
1410 }
1411 
1412 /*
1413  * IP socket option processing.
1414  */
1415 int
1416 ip_ctloutput(so, sopt)
1417 	struct socket *so;
1418 	struct sockopt *sopt;
1419 {
1420 	struct	inpcb *inp = sotoinpcb(so);
1421 	int	error, optval;
1422 
1423 	error = optval = 0;
1424 	if (sopt->sopt_level != IPPROTO_IP) {
1425 		return (EINVAL);
1426 	}
1427 
1428 	switch (sopt->sopt_dir) {
1429 	case SOPT_SET:
1430 		switch (sopt->sopt_name) {
1431 		case IP_OPTIONS:
1432 #ifdef notyet
1433 		case IP_RETOPTS:
1434 #endif
1435 		{
1436 			struct mbuf *m;
1437 			if (sopt->sopt_valsize > MLEN) {
1438 				error = EMSGSIZE;
1439 				break;
1440 			}
1441 			MGET(m, sopt->sopt_td ? M_TRYWAIT : M_DONTWAIT, MT_HEADER);
1442 			if (m == 0) {
1443 				error = ENOBUFS;
1444 				break;
1445 			}
1446 			m->m_len = sopt->sopt_valsize;
1447 			error = sooptcopyin(sopt, mtod(m, char *), m->m_len,
1448 					    m->m_len);
1449 
1450 			return (ip_pcbopts(sopt->sopt_name, &inp->inp_options,
1451 					   m));
1452 		}
1453 
1454 		case IP_TOS:
1455 		case IP_TTL:
1456 		case IP_RECVOPTS:
1457 		case IP_RECVRETOPTS:
1458 		case IP_RECVDSTADDR:
1459 		case IP_RECVTTL:
1460 		case IP_RECVIF:
1461 		case IP_FAITH:
1462 		case IP_ONESBCAST:
1463 			error = sooptcopyin(sopt, &optval, sizeof optval,
1464 					    sizeof optval);
1465 			if (error)
1466 				break;
1467 
1468 			switch (sopt->sopt_name) {
1469 			case IP_TOS:
1470 				inp->inp_ip_tos = optval;
1471 				break;
1472 
1473 			case IP_TTL:
1474 				inp->inp_ip_ttl = optval;
1475 				break;
1476 #define	OPTSET(bit) \
1477 	if (optval) \
1478 		inp->inp_flags |= bit; \
1479 	else \
1480 		inp->inp_flags &= ~bit;
1481 
1482 			case IP_RECVOPTS:
1483 				OPTSET(INP_RECVOPTS);
1484 				break;
1485 
1486 			case IP_RECVRETOPTS:
1487 				OPTSET(INP_RECVRETOPTS);
1488 				break;
1489 
1490 			case IP_RECVDSTADDR:
1491 				OPTSET(INP_RECVDSTADDR);
1492 				break;
1493 
1494 			case IP_RECVTTL:
1495 				OPTSET(INP_RECVTTL);
1496 				break;
1497 
1498 			case IP_RECVIF:
1499 				OPTSET(INP_RECVIF);
1500 				break;
1501 
1502 			case IP_FAITH:
1503 				OPTSET(INP_FAITH);
1504 				break;
1505 
1506 			case IP_ONESBCAST:
1507 				OPTSET(INP_ONESBCAST);
1508 				break;
1509 			}
1510 			break;
1511 #undef OPTSET
1512 
1513 		case IP_MULTICAST_IF:
1514 		case IP_MULTICAST_VIF:
1515 		case IP_MULTICAST_TTL:
1516 		case IP_MULTICAST_LOOP:
1517 		case IP_ADD_MEMBERSHIP:
1518 		case IP_DROP_MEMBERSHIP:
1519 			error = ip_setmoptions(sopt, &inp->inp_moptions);
1520 			break;
1521 
1522 		case IP_PORTRANGE:
1523 			error = sooptcopyin(sopt, &optval, sizeof optval,
1524 					    sizeof optval);
1525 			if (error)
1526 				break;
1527 
1528 			switch (optval) {
1529 			case IP_PORTRANGE_DEFAULT:
1530 				inp->inp_flags &= ~(INP_LOWPORT);
1531 				inp->inp_flags &= ~(INP_HIGHPORT);
1532 				break;
1533 
1534 			case IP_PORTRANGE_HIGH:
1535 				inp->inp_flags &= ~(INP_LOWPORT);
1536 				inp->inp_flags |= INP_HIGHPORT;
1537 				break;
1538 
1539 			case IP_PORTRANGE_LOW:
1540 				inp->inp_flags &= ~(INP_HIGHPORT);
1541 				inp->inp_flags |= INP_LOWPORT;
1542 				break;
1543 
1544 			default:
1545 				error = EINVAL;
1546 				break;
1547 			}
1548 			break;
1549 
1550 #if defined(IPSEC) || defined(FAST_IPSEC)
1551 		case IP_IPSEC_POLICY:
1552 		{
1553 			caddr_t req;
1554 			size_t len = 0;
1555 			int priv;
1556 			struct mbuf *m;
1557 			int optname;
1558 
1559 			if ((error = soopt_getm(sopt, &m)) != 0) /* XXX */
1560 				break;
1561 			if ((error = soopt_mcopyin(sopt, m)) != 0) /* XXX */
1562 				break;
1563 			priv = (sopt->sopt_td != NULL &&
1564 				suser(sopt->sopt_td) != 0) ? 0 : 1;
1565 			req = mtod(m, caddr_t);
1566 			len = m->m_len;
1567 			optname = sopt->sopt_name;
1568 			error = ipsec4_set_policy(inp, optname, req, len, priv);
1569 			m_freem(m);
1570 			break;
1571 		}
1572 #endif /*IPSEC*/
1573 
1574 		default:
1575 			error = ENOPROTOOPT;
1576 			break;
1577 		}
1578 		break;
1579 
1580 	case SOPT_GET:
1581 		switch (sopt->sopt_name) {
1582 		case IP_OPTIONS:
1583 		case IP_RETOPTS:
1584 			if (inp->inp_options)
1585 				error = sooptcopyout(sopt,
1586 						     mtod(inp->inp_options,
1587 							  char *),
1588 						     inp->inp_options->m_len);
1589 			else
1590 				sopt->sopt_valsize = 0;
1591 			break;
1592 
1593 		case IP_TOS:
1594 		case IP_TTL:
1595 		case IP_RECVOPTS:
1596 		case IP_RECVRETOPTS:
1597 		case IP_RECVDSTADDR:
1598 		case IP_RECVTTL:
1599 		case IP_RECVIF:
1600 		case IP_PORTRANGE:
1601 		case IP_FAITH:
1602 		case IP_ONESBCAST:
1603 			switch (sopt->sopt_name) {
1604 
1605 			case IP_TOS:
1606 				optval = inp->inp_ip_tos;
1607 				break;
1608 
1609 			case IP_TTL:
1610 				optval = inp->inp_ip_ttl;
1611 				break;
1612 
1613 #define	OPTBIT(bit)	(inp->inp_flags & bit ? 1 : 0)
1614 
1615 			case IP_RECVOPTS:
1616 				optval = OPTBIT(INP_RECVOPTS);
1617 				break;
1618 
1619 			case IP_RECVRETOPTS:
1620 				optval = OPTBIT(INP_RECVRETOPTS);
1621 				break;
1622 
1623 			case IP_RECVDSTADDR:
1624 				optval = OPTBIT(INP_RECVDSTADDR);
1625 				break;
1626 
1627 			case IP_RECVTTL:
1628 				optval = OPTBIT(INP_RECVTTL);
1629 				break;
1630 
1631 			case IP_RECVIF:
1632 				optval = OPTBIT(INP_RECVIF);
1633 				break;
1634 
1635 			case IP_PORTRANGE:
1636 				if (inp->inp_flags & INP_HIGHPORT)
1637 					optval = IP_PORTRANGE_HIGH;
1638 				else if (inp->inp_flags & INP_LOWPORT)
1639 					optval = IP_PORTRANGE_LOW;
1640 				else
1641 					optval = 0;
1642 				break;
1643 
1644 			case IP_FAITH:
1645 				optval = OPTBIT(INP_FAITH);
1646 				break;
1647 
1648 			case IP_ONESBCAST:
1649 				optval = OPTBIT(INP_ONESBCAST);
1650 				break;
1651 			}
1652 			error = sooptcopyout(sopt, &optval, sizeof optval);
1653 			break;
1654 
1655 		case IP_MULTICAST_IF:
1656 		case IP_MULTICAST_VIF:
1657 		case IP_MULTICAST_TTL:
1658 		case IP_MULTICAST_LOOP:
1659 		case IP_ADD_MEMBERSHIP:
1660 		case IP_DROP_MEMBERSHIP:
1661 			error = ip_getmoptions(sopt, inp->inp_moptions);
1662 			break;
1663 
1664 #if defined(IPSEC) || defined(FAST_IPSEC)
1665 		case IP_IPSEC_POLICY:
1666 		{
1667 			struct mbuf *m = NULL;
1668 			caddr_t req = NULL;
1669 			size_t len = 0;
1670 
1671 			if (m != 0) {
1672 				req = mtod(m, caddr_t);
1673 				len = m->m_len;
1674 			}
1675 			error = ipsec4_get_policy(sotoinpcb(so), req, len, &m);
1676 			if (error == 0)
1677 				error = soopt_mcopyout(sopt, m); /* XXX */
1678 			if (error == 0)
1679 				m_freem(m);
1680 			break;
1681 		}
1682 #endif /*IPSEC*/
1683 
1684 		default:
1685 			error = ENOPROTOOPT;
1686 			break;
1687 		}
1688 		break;
1689 	}
1690 	return (error);
1691 }
1692 
1693 /*
1694  * Set up IP options in pcb for insertion in output packets.
1695  * Store in mbuf with pointer in pcbopt, adding pseudo-option
1696  * with destination address if source routed.
1697  */
1698 static int
1699 ip_pcbopts(optname, pcbopt, m)
1700 	int optname;
1701 	struct mbuf **pcbopt;
1702 	register struct mbuf *m;
1703 {
1704 	register int cnt, optlen;
1705 	register u_char *cp;
1706 	u_char opt;
1707 
1708 	/* turn off any old options */
1709 	if (*pcbopt)
1710 		(void)m_free(*pcbopt);
1711 	*pcbopt = 0;
1712 	if (m == (struct mbuf *)0 || m->m_len == 0) {
1713 		/*
1714 		 * Only turning off any previous options.
1715 		 */
1716 		if (m)
1717 			(void)m_free(m);
1718 		return (0);
1719 	}
1720 
1721 	if (m->m_len % sizeof(int32_t))
1722 		goto bad;
1723 	/*
1724 	 * IP first-hop destination address will be stored before
1725 	 * actual options; move other options back
1726 	 * and clear it when none present.
1727 	 */
1728 	if (m->m_data + m->m_len + sizeof(struct in_addr) >= &m->m_dat[MLEN])
1729 		goto bad;
1730 	cnt = m->m_len;
1731 	m->m_len += sizeof(struct in_addr);
1732 	cp = mtod(m, u_char *) + sizeof(struct in_addr);
1733 	bcopy(mtod(m, void *), cp, (unsigned)cnt);
1734 	bzero(mtod(m, void *), sizeof(struct in_addr));
1735 
1736 	for (; cnt > 0; cnt -= optlen, cp += optlen) {
1737 		opt = cp[IPOPT_OPTVAL];
1738 		if (opt == IPOPT_EOL)
1739 			break;
1740 		if (opt == IPOPT_NOP)
1741 			optlen = 1;
1742 		else {
1743 			if (cnt < IPOPT_OLEN + sizeof(*cp))
1744 				goto bad;
1745 			optlen = cp[IPOPT_OLEN];
1746 			if (optlen < IPOPT_OLEN + sizeof(*cp) || optlen > cnt)
1747 				goto bad;
1748 		}
1749 		switch (opt) {
1750 
1751 		default:
1752 			break;
1753 
1754 		case IPOPT_LSRR:
1755 		case IPOPT_SSRR:
1756 			/*
1757 			 * user process specifies route as:
1758 			 *	->A->B->C->D
1759 			 * D must be our final destination (but we can't
1760 			 * check that since we may not have connected yet).
1761 			 * A is first hop destination, which doesn't appear in
1762 			 * actual IP option, but is stored before the options.
1763 			 */
1764 			if (optlen < IPOPT_MINOFF - 1 + sizeof(struct in_addr))
1765 				goto bad;
1766 			m->m_len -= sizeof(struct in_addr);
1767 			cnt -= sizeof(struct in_addr);
1768 			optlen -= sizeof(struct in_addr);
1769 			cp[IPOPT_OLEN] = optlen;
1770 			/*
1771 			 * Move first hop before start of options.
1772 			 */
1773 			bcopy((caddr_t)&cp[IPOPT_OFFSET+1], mtod(m, caddr_t),
1774 			    sizeof(struct in_addr));
1775 			/*
1776 			 * Then copy rest of options back
1777 			 * to close up the deleted entry.
1778 			 */
1779 			bcopy((&cp[IPOPT_OFFSET+1] + sizeof(struct in_addr)),
1780 			    &cp[IPOPT_OFFSET+1],
1781 			    (unsigned)cnt + sizeof(struct in_addr));
1782 			break;
1783 		}
1784 	}
1785 	if (m->m_len > MAX_IPOPTLEN + sizeof(struct in_addr))
1786 		goto bad;
1787 	*pcbopt = m;
1788 	return (0);
1789 
1790 bad:
1791 	(void)m_free(m);
1792 	return (EINVAL);
1793 }
1794 
1795 /*
1796  * XXX
1797  * The whole multicast option thing needs to be re-thought.
1798  * Several of these options are equally applicable to non-multicast
1799  * transmission, and one (IP_MULTICAST_TTL) totally duplicates a
1800  * standard option (IP_TTL).
1801  */
1802 
1803 /*
1804  * following RFC1724 section 3.3, 0.0.0.0/8 is interpreted as interface index.
1805  */
1806 static struct ifnet *
1807 ip_multicast_if(a, ifindexp)
1808 	struct in_addr *a;
1809 	int *ifindexp;
1810 {
1811 	int ifindex;
1812 	struct ifnet *ifp;
1813 
1814 	if (ifindexp)
1815 		*ifindexp = 0;
1816 	if (ntohl(a->s_addr) >> 24 == 0) {
1817 		ifindex = ntohl(a->s_addr) & 0xffffff;
1818 		if (ifindex < 0 || if_index < ifindex)
1819 			return NULL;
1820 		ifp = ifnet_byindex(ifindex);
1821 		if (ifindexp)
1822 			*ifindexp = ifindex;
1823 	} else {
1824 		INADDR_TO_IFP(*a, ifp);
1825 	}
1826 	return ifp;
1827 }
1828 
1829 /*
1830  * Set the IP multicast options in response to user setsockopt().
1831  */
1832 static int
1833 ip_setmoptions(sopt, imop)
1834 	struct sockopt *sopt;
1835 	struct ip_moptions **imop;
1836 {
1837 	int error = 0;
1838 	int i;
1839 	struct in_addr addr;
1840 	struct ip_mreq mreq;
1841 	struct ifnet *ifp;
1842 	struct ip_moptions *imo = *imop;
1843 	struct route ro;
1844 	struct sockaddr_in *dst;
1845 	int ifindex;
1846 	int s;
1847 
1848 	if (imo == NULL) {
1849 		/*
1850 		 * No multicast option buffer attached to the pcb;
1851 		 * allocate one and initialize to default values.
1852 		 */
1853 		imo = (struct ip_moptions*)malloc(sizeof(*imo), M_IPMOPTS,
1854 		    M_WAITOK);
1855 
1856 		if (imo == NULL)
1857 			return (ENOBUFS);
1858 		*imop = imo;
1859 		imo->imo_multicast_ifp = NULL;
1860 		imo->imo_multicast_addr.s_addr = INADDR_ANY;
1861 		imo->imo_multicast_vif = -1;
1862 		imo->imo_multicast_ttl = IP_DEFAULT_MULTICAST_TTL;
1863 		imo->imo_multicast_loop = IP_DEFAULT_MULTICAST_LOOP;
1864 		imo->imo_num_memberships = 0;
1865 	}
1866 
1867 	switch (sopt->sopt_name) {
1868 	/* store an index number for the vif you wanna use in the send */
1869 	case IP_MULTICAST_VIF:
1870 		if (legal_vif_num == 0) {
1871 			error = EOPNOTSUPP;
1872 			break;
1873 		}
1874 		error = sooptcopyin(sopt, &i, sizeof i, sizeof i);
1875 		if (error)
1876 			break;
1877 		if (!legal_vif_num(i) && (i != -1)) {
1878 			error = EINVAL;
1879 			break;
1880 		}
1881 		imo->imo_multicast_vif = i;
1882 		break;
1883 
1884 	case IP_MULTICAST_IF:
1885 		/*
1886 		 * Select the interface for outgoing multicast packets.
1887 		 */
1888 		error = sooptcopyin(sopt, &addr, sizeof addr, sizeof addr);
1889 		if (error)
1890 			break;
1891 		/*
1892 		 * INADDR_ANY is used to remove a previous selection.
1893 		 * When no interface is selected, a default one is
1894 		 * chosen every time a multicast packet is sent.
1895 		 */
1896 		if (addr.s_addr == INADDR_ANY) {
1897 			imo->imo_multicast_ifp = NULL;
1898 			break;
1899 		}
1900 		/*
1901 		 * The selected interface is identified by its local
1902 		 * IP address.  Find the interface and confirm that
1903 		 * it supports multicasting.
1904 		 */
1905 		s = splimp();
1906 		ifp = ip_multicast_if(&addr, &ifindex);
1907 		if (ifp == NULL || (ifp->if_flags & IFF_MULTICAST) == 0) {
1908 			splx(s);
1909 			error = EADDRNOTAVAIL;
1910 			break;
1911 		}
1912 		imo->imo_multicast_ifp = ifp;
1913 		if (ifindex)
1914 			imo->imo_multicast_addr = addr;
1915 		else
1916 			imo->imo_multicast_addr.s_addr = INADDR_ANY;
1917 		splx(s);
1918 		break;
1919 
1920 	case IP_MULTICAST_TTL:
1921 		/*
1922 		 * Set the IP time-to-live for outgoing multicast packets.
1923 		 * The original multicast API required a char argument,
1924 		 * which is inconsistent with the rest of the socket API.
1925 		 * We allow either a char or an int.
1926 		 */
1927 		if (sopt->sopt_valsize == 1) {
1928 			u_char ttl;
1929 			error = sooptcopyin(sopt, &ttl, 1, 1);
1930 			if (error)
1931 				break;
1932 			imo->imo_multicast_ttl = ttl;
1933 		} else {
1934 			u_int ttl;
1935 			error = sooptcopyin(sopt, &ttl, sizeof ttl,
1936 					    sizeof ttl);
1937 			if (error)
1938 				break;
1939 			if (ttl > 255)
1940 				error = EINVAL;
1941 			else
1942 				imo->imo_multicast_ttl = ttl;
1943 		}
1944 		break;
1945 
1946 	case IP_MULTICAST_LOOP:
1947 		/*
1948 		 * Set the loopback flag for outgoing multicast packets.
1949 		 * Must be zero or one.  The original multicast API required a
1950 		 * char argument, which is inconsistent with the rest
1951 		 * of the socket API.  We allow either a char or an int.
1952 		 */
1953 		if (sopt->sopt_valsize == 1) {
1954 			u_char loop;
1955 			error = sooptcopyin(sopt, &loop, 1, 1);
1956 			if (error)
1957 				break;
1958 			imo->imo_multicast_loop = !!loop;
1959 		} else {
1960 			u_int loop;
1961 			error = sooptcopyin(sopt, &loop, sizeof loop,
1962 					    sizeof loop);
1963 			if (error)
1964 				break;
1965 			imo->imo_multicast_loop = !!loop;
1966 		}
1967 		break;
1968 
1969 	case IP_ADD_MEMBERSHIP:
1970 		/*
1971 		 * Add a multicast group membership.
1972 		 * Group must be a valid IP multicast address.
1973 		 */
1974 		error = sooptcopyin(sopt, &mreq, sizeof mreq, sizeof mreq);
1975 		if (error)
1976 			break;
1977 
1978 		if (!IN_MULTICAST(ntohl(mreq.imr_multiaddr.s_addr))) {
1979 			error = EINVAL;
1980 			break;
1981 		}
1982 		s = splimp();
1983 		/*
1984 		 * If no interface address was provided, use the interface of
1985 		 * the route to the given multicast address.
1986 		 */
1987 		if (mreq.imr_interface.s_addr == INADDR_ANY) {
1988 			bzero((caddr_t)&ro, sizeof(ro));
1989 			dst = (struct sockaddr_in *)&ro.ro_dst;
1990 			dst->sin_len = sizeof(*dst);
1991 			dst->sin_family = AF_INET;
1992 			dst->sin_addr = mreq.imr_multiaddr;
1993 			rtalloc(&ro);
1994 			if (ro.ro_rt == NULL) {
1995 				error = EADDRNOTAVAIL;
1996 				splx(s);
1997 				break;
1998 			}
1999 			ifp = ro.ro_rt->rt_ifp;
2000 			rtfree(ro.ro_rt);
2001 		}
2002 		else {
2003 			ifp = ip_multicast_if(&mreq.imr_interface, NULL);
2004 		}
2005 
2006 		/*
2007 		 * See if we found an interface, and confirm that it
2008 		 * supports multicast.
2009 		 */
2010 		if (ifp == NULL || (ifp->if_flags & IFF_MULTICAST) == 0) {
2011 			error = EADDRNOTAVAIL;
2012 			splx(s);
2013 			break;
2014 		}
2015 		/*
2016 		 * See if the membership already exists or if all the
2017 		 * membership slots are full.
2018 		 */
2019 		for (i = 0; i < imo->imo_num_memberships; ++i) {
2020 			if (imo->imo_membership[i]->inm_ifp == ifp &&
2021 			    imo->imo_membership[i]->inm_addr.s_addr
2022 						== mreq.imr_multiaddr.s_addr)
2023 				break;
2024 		}
2025 		if (i < imo->imo_num_memberships) {
2026 			error = EADDRINUSE;
2027 			splx(s);
2028 			break;
2029 		}
2030 		if (i == IP_MAX_MEMBERSHIPS) {
2031 			error = ETOOMANYREFS;
2032 			splx(s);
2033 			break;
2034 		}
2035 		/*
2036 		 * Everything looks good; add a new record to the multicast
2037 		 * address list for the given interface.
2038 		 */
2039 		if ((imo->imo_membership[i] =
2040 		    in_addmulti(&mreq.imr_multiaddr, ifp)) == NULL) {
2041 			error = ENOBUFS;
2042 			splx(s);
2043 			break;
2044 		}
2045 		++imo->imo_num_memberships;
2046 		splx(s);
2047 		break;
2048 
2049 	case IP_DROP_MEMBERSHIP:
2050 		/*
2051 		 * Drop a multicast group membership.
2052 		 * Group must be a valid IP multicast address.
2053 		 */
2054 		error = sooptcopyin(sopt, &mreq, sizeof mreq, sizeof mreq);
2055 		if (error)
2056 			break;
2057 
2058 		if (!IN_MULTICAST(ntohl(mreq.imr_multiaddr.s_addr))) {
2059 			error = EINVAL;
2060 			break;
2061 		}
2062 
2063 		s = splimp();
2064 		/*
2065 		 * If an interface address was specified, get a pointer
2066 		 * to its ifnet structure.
2067 		 */
2068 		if (mreq.imr_interface.s_addr == INADDR_ANY)
2069 			ifp = NULL;
2070 		else {
2071 			ifp = ip_multicast_if(&mreq.imr_interface, NULL);
2072 			if (ifp == NULL) {
2073 				error = EADDRNOTAVAIL;
2074 				splx(s);
2075 				break;
2076 			}
2077 		}
2078 		/*
2079 		 * Find the membership in the membership array.
2080 		 */
2081 		for (i = 0; i < imo->imo_num_memberships; ++i) {
2082 			if ((ifp == NULL ||
2083 			     imo->imo_membership[i]->inm_ifp == ifp) &&
2084 			     imo->imo_membership[i]->inm_addr.s_addr ==
2085 			     mreq.imr_multiaddr.s_addr)
2086 				break;
2087 		}
2088 		if (i == imo->imo_num_memberships) {
2089 			error = EADDRNOTAVAIL;
2090 			splx(s);
2091 			break;
2092 		}
2093 		/*
2094 		 * Give up the multicast address record to which the
2095 		 * membership points.
2096 		 */
2097 		in_delmulti(imo->imo_membership[i]);
2098 		/*
2099 		 * Remove the gap in the membership array.
2100 		 */
2101 		for (++i; i < imo->imo_num_memberships; ++i)
2102 			imo->imo_membership[i-1] = imo->imo_membership[i];
2103 		--imo->imo_num_memberships;
2104 		splx(s);
2105 		break;
2106 
2107 	default:
2108 		error = EOPNOTSUPP;
2109 		break;
2110 	}
2111 
2112 	/*
2113 	 * If all options have default values, no need to keep the mbuf.
2114 	 */
2115 	if (imo->imo_multicast_ifp == NULL &&
2116 	    imo->imo_multicast_vif == -1 &&
2117 	    imo->imo_multicast_ttl == IP_DEFAULT_MULTICAST_TTL &&
2118 	    imo->imo_multicast_loop == IP_DEFAULT_MULTICAST_LOOP &&
2119 	    imo->imo_num_memberships == 0) {
2120 		free(*imop, M_IPMOPTS);
2121 		*imop = NULL;
2122 	}
2123 
2124 	return (error);
2125 }
2126 
2127 /*
2128  * Return the IP multicast options in response to user getsockopt().
2129  */
2130 static int
2131 ip_getmoptions(sopt, imo)
2132 	struct sockopt *sopt;
2133 	register struct ip_moptions *imo;
2134 {
2135 	struct in_addr addr;
2136 	struct in_ifaddr *ia;
2137 	int error, optval;
2138 	u_char coptval;
2139 
2140 	error = 0;
2141 	switch (sopt->sopt_name) {
2142 	case IP_MULTICAST_VIF:
2143 		if (imo != NULL)
2144 			optval = imo->imo_multicast_vif;
2145 		else
2146 			optval = -1;
2147 		error = sooptcopyout(sopt, &optval, sizeof optval);
2148 		break;
2149 
2150 	case IP_MULTICAST_IF:
2151 		if (imo == NULL || imo->imo_multicast_ifp == NULL)
2152 			addr.s_addr = INADDR_ANY;
2153 		else if (imo->imo_multicast_addr.s_addr) {
2154 			/* return the value user has set */
2155 			addr = imo->imo_multicast_addr;
2156 		} else {
2157 			IFP_TO_IA(imo->imo_multicast_ifp, ia);
2158 			addr.s_addr = (ia == NULL) ? INADDR_ANY
2159 				: IA_SIN(ia)->sin_addr.s_addr;
2160 		}
2161 		error = sooptcopyout(sopt, &addr, sizeof addr);
2162 		break;
2163 
2164 	case IP_MULTICAST_TTL:
2165 		if (imo == 0)
2166 			optval = coptval = IP_DEFAULT_MULTICAST_TTL;
2167 		else
2168 			optval = coptval = imo->imo_multicast_ttl;
2169 		if (sopt->sopt_valsize == 1)
2170 			error = sooptcopyout(sopt, &coptval, 1);
2171 		else
2172 			error = sooptcopyout(sopt, &optval, sizeof optval);
2173 		break;
2174 
2175 	case IP_MULTICAST_LOOP:
2176 		if (imo == 0)
2177 			optval = coptval = IP_DEFAULT_MULTICAST_LOOP;
2178 		else
2179 			optval = coptval = imo->imo_multicast_loop;
2180 		if (sopt->sopt_valsize == 1)
2181 			error = sooptcopyout(sopt, &coptval, 1);
2182 		else
2183 			error = sooptcopyout(sopt, &optval, sizeof optval);
2184 		break;
2185 
2186 	default:
2187 		error = ENOPROTOOPT;
2188 		break;
2189 	}
2190 	return (error);
2191 }
2192 
2193 /*
2194  * Discard the IP multicast options.
2195  */
2196 void
2197 ip_freemoptions(imo)
2198 	register struct ip_moptions *imo;
2199 {
2200 	register int i;
2201 
2202 	if (imo != NULL) {
2203 		for (i = 0; i < imo->imo_num_memberships; ++i)
2204 			in_delmulti(imo->imo_membership[i]);
2205 		free(imo, M_IPMOPTS);
2206 	}
2207 }
2208 
2209 /*
2210  * Routine called from ip_output() to loop back a copy of an IP multicast
2211  * packet to the input queue of a specified interface.  Note that this
2212  * calls the output routine of the loopback "driver", but with an interface
2213  * pointer that might NOT be a loopback interface -- evil, but easier than
2214  * replicating that code here.
2215  */
2216 static void
2217 ip_mloopback(ifp, m, dst, hlen)
2218 	struct ifnet *ifp;
2219 	register struct mbuf *m;
2220 	register struct sockaddr_in *dst;
2221 	int hlen;
2222 {
2223 	register struct ip *ip;
2224 	struct mbuf *copym;
2225 
2226 	copym = m_copy(m, 0, M_COPYALL);
2227 	if (copym != NULL && (copym->m_flags & M_EXT || copym->m_len < hlen))
2228 		copym = m_pullup(copym, hlen);
2229 	if (copym != NULL) {
2230 		/*
2231 		 * We don't bother to fragment if the IP length is greater
2232 		 * than the interface's MTU.  Can this possibly matter?
2233 		 */
2234 		ip = mtod(copym, struct ip *);
2235 		ip->ip_len = htons(ip->ip_len);
2236 		ip->ip_off = htons(ip->ip_off);
2237 		ip->ip_sum = 0;
2238 		ip->ip_sum = in_cksum(copym, hlen);
2239 		/*
2240 		 * NB:
2241 		 * It's not clear whether there are any lingering
2242 		 * reentrancy problems in other areas which might
2243 		 * be exposed by using ip_input directly (in
2244 		 * particular, everything which modifies the packet
2245 		 * in-place).  Yet another option is using the
2246 		 * protosw directly to deliver the looped back
2247 		 * packet.  For the moment, we'll err on the side
2248 		 * of safety by using if_simloop().
2249 		 */
2250 #if 1 /* XXX */
2251 		if (dst->sin_family != AF_INET) {
2252 			printf("ip_mloopback: bad address family %d\n",
2253 						dst->sin_family);
2254 			dst->sin_family = AF_INET;
2255 		}
2256 #endif
2257 
2258 #ifdef notdef
2259 		copym->m_pkthdr.rcvif = ifp;
2260 		ip_input(copym);
2261 #else
2262 		/* if the checksum hasn't been computed, mark it as valid */
2263 		if (copym->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
2264 			copym->m_pkthdr.csum_flags |=
2265 			    CSUM_DATA_VALID | CSUM_PSEUDO_HDR;
2266 			copym->m_pkthdr.csum_data = 0xffff;
2267 		}
2268 		if_simloop(ifp, copym, dst->sin_family, 0);
2269 #endif
2270 	}
2271 }
2272