xref: /freebsd/sys/netinet/ip_output.c (revision daf1cffce2e07931f27c6c6998652e90df6ba87e)
1 /*
2  * Copyright (c) 1982, 1986, 1988, 1990, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. All advertising materials mentioning features or use of this software
14  *    must display the following acknowledgement:
15  *	This product includes software developed by the University of
16  *	California, Berkeley and its contributors.
17  * 4. Neither the name of the University nor the names of its contributors
18  *    may be used to endorse or promote products derived from this software
19  *    without specific prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  *	@(#)ip_output.c	8.3 (Berkeley) 1/21/94
34  * $FreeBSD$
35  */
36 
37 #define _IP_VHL
38 
39 #include "opt_ipfw.h"
40 #include "opt_ipdn.h"
41 #include "opt_ipdivert.h"
42 #include "opt_ipfilter.h"
43 #include "opt_ipsec.h"
44 
45 #include <sys/param.h>
46 #include <sys/systm.h>
47 #include <sys/kernel.h>
48 #include <sys/malloc.h>
49 #include <sys/mbuf.h>
50 #include <sys/protosw.h>
51 #include <sys/socket.h>
52 #include <sys/socketvar.h>
53 #include <sys/proc.h>
54 
55 #include <net/if.h>
56 #include <net/route.h>
57 
58 #include <netinet/in.h>
59 #include <netinet/in_systm.h>
60 #include <netinet/ip.h>
61 #include <netinet/in_pcb.h>
62 #include <netinet/in_var.h>
63 #include <netinet/ip_var.h>
64 
65 #include "faith.h"
66 
67 #ifdef vax
68 #include <machine/mtpr.h>
69 #endif
70 #include <machine/in_cksum.h>
71 
72 static MALLOC_DEFINE(M_IPMOPTS, "ip_moptions", "internet multicast options");
73 
74 #ifdef IPSEC
75 #include <netinet6/ipsec.h>
76 #include <netkey/key.h>
77 #ifdef IPSEC_DEBUG
78 #include <netkey/key_debug.h>
79 #else
80 #define	KEYDEBUG(lev,arg)
81 #endif
82 #endif /*IPSEC*/
83 
84 #include <netinet/ip_fw.h>
85 
86 #ifdef DUMMYNET
87 #include <netinet/ip_dummynet.h>
88 #endif
89 
90 #ifdef IPFIREWALL_FORWARD_DEBUG
91 #define print_ip(a)	 printf("%ld.%ld.%ld.%ld",(ntohl(a.s_addr)>>24)&0xFF,\
92 				 		  (ntohl(a.s_addr)>>16)&0xFF,\
93 						  (ntohl(a.s_addr)>>8)&0xFF,\
94 						  (ntohl(a.s_addr))&0xFF);
95 #endif
96 
97 u_short ip_id;
98 
99 static struct mbuf *ip_insertoptions __P((struct mbuf *, struct mbuf *, int *));
100 static void	ip_mloopback
101 	__P((struct ifnet *, struct mbuf *, struct sockaddr_in *, int));
102 static int	ip_getmoptions
103 	__P((struct sockopt *, struct ip_moptions *));
104 static int	ip_pcbopts __P((int, struct mbuf **, struct mbuf *));
105 static int	ip_setmoptions
106 	__P((struct sockopt *, struct ip_moptions **));
107 
108 int	ip_optcopy __P((struct ip *, struct ip *));
109 extern int (*fr_checkp) __P((struct ip *, int, struct ifnet *, int, struct mbuf **));
110 
111 
112 extern	struct protosw inetsw[];
113 
114 /*
115  * IP output.  The packet in mbuf chain m contains a skeletal IP
116  * header (with len, off, ttl, proto, tos, src, dst).
117  * The mbuf chain containing the packet will be freed.
118  * The mbuf opt, if present, will not be freed.
119  */
120 int
121 ip_output(m0, opt, ro, flags, imo)
122 	struct mbuf *m0;
123 	struct mbuf *opt;
124 	struct route *ro;
125 	int flags;
126 	struct ip_moptions *imo;
127 {
128 	struct ip *ip, *mhip;
129 	struct ifnet *ifp;
130 	struct mbuf *m = m0;
131 	int hlen = sizeof (struct ip);
132 	int len, off, error = 0;
133 	struct sockaddr_in *dst;
134 	struct in_ifaddr *ia;
135 	int isbroadcast;
136 #ifdef IPSEC
137 	struct route iproute;
138 	struct socket *so = NULL;
139 	struct secpolicy *sp = NULL;
140 #endif
141 	u_int16_t divert_cookie;		/* firewall cookie */
142 #ifdef IPFIREWALL_FORWARD
143 	int fwd_rewrite_src = 0;
144 #endif
145 	struct ip_fw_chain *rule = NULL;
146 
147 #ifdef IPDIVERT
148 	/* Get and reset firewall cookie */
149 	divert_cookie = ip_divert_cookie;
150 	ip_divert_cookie = 0;
151 #else
152 	divert_cookie = 0;
153 #endif
154 
155 	/*
156 	 * NOTE: If IP_SOCKINMRCVIF flag is set, 'socket *' is kept in
157 	 * m->m_pkthdr.rcvif for later IPSEC check. In this case,
158 	 * m->m_pkthdr will be NULL cleared after the contents is saved in
159 	 * 'so'.
160 	 * NULL clearance of rcvif should be natural because the packet should
161 	 * have been sent from my own socket and has no rcvif in this case.
162 	 * It is also necessary because someone might consider it as
163 	 * 'ifnet *', and cause SEGV.
164 	 */
165 #if defined(IPFIREWALL) && defined(DUMMYNET)
166         /*
167          * dummynet packet are prepended a vestigial mbuf with
168          * m_type = MT_DUMMYNET and m_data pointing to the matching
169          * rule.
170          */
171         if (m->m_type == MT_DUMMYNET) {
172             /*
173              * the packet was already tagged, so part of the
174              * processing was already done, and we need to go down.
175              * Get parameters from the header.
176              */
177             rule = (struct ip_fw_chain *)(m->m_data) ;
178 	    opt = NULL ;
179 	    ro = & ( ((struct dn_pkt *)m)->ro ) ;
180 	    imo = NULL ;
181 	    dst = ((struct dn_pkt *)m)->dn_dst ;
182 	    ifp = ((struct dn_pkt *)m)->ifp ;
183 	    flags = ((struct dn_pkt *)m)->flags ;
184 
185             m0 = m = m->m_next ;
186 #ifdef IPSEC
187 	    if ((flags & IP_SOCKINMRCVIF) != 0) {
188 	        so = (struct socket *)m->m_pkthdr.rcvif;
189 	        m->m_pkthdr.rcvif = NULL;
190 	    }
191 #endif
192             ip = mtod(m, struct ip *);
193             hlen = IP_VHL_HL(ip->ip_vhl) << 2 ;
194             goto sendit;
195         } else
196             rule = NULL ;
197 #endif
198 #ifdef IPSEC
199 	if ((flags & IP_SOCKINMRCVIF) != 0) {
200 		so = (struct socket *)m->m_pkthdr.rcvif;
201 		m->m_pkthdr.rcvif = NULL;
202 	}
203 #endif
204 
205 #ifdef	DIAGNOSTIC
206 	if ((m->m_flags & M_PKTHDR) == 0)
207 		panic("ip_output no HDR");
208 	if (!ro)
209 		panic("ip_output no route, proto = %d",
210 		      mtod(m, struct ip *)->ip_p);
211 #endif
212 	if (opt) {
213 		m = ip_insertoptions(m, opt, &len);
214 		hlen = len;
215 	}
216 	ip = mtod(m, struct ip *);
217 	/*
218 	 * Fill in IP header.
219 	 */
220 	if ((flags & (IP_FORWARDING|IP_RAWOUTPUT)) == 0) {
221 		ip->ip_vhl = IP_MAKE_VHL(IPVERSION, hlen >> 2);
222 		ip->ip_off &= IP_DF;
223 		ip->ip_id = htons(ip_id++);
224 		ipstat.ips_localout++;
225 	} else {
226 		hlen = IP_VHL_HL(ip->ip_vhl) << 2;
227 	}
228 
229 	dst = (struct sockaddr_in *)&ro->ro_dst;
230 	/*
231 	 * If there is a cached route,
232 	 * check that it is to the same destination
233 	 * and is still up.  If not, free it and try again.
234 	 */
235 	if (ro->ro_rt && ((ro->ro_rt->rt_flags & RTF_UP) == 0 ||
236 	   dst->sin_addr.s_addr != ip->ip_dst.s_addr)) {
237 		RTFREE(ro->ro_rt);
238 		ro->ro_rt = (struct rtentry *)0;
239 	}
240 	if (ro->ro_rt == 0) {
241 		dst->sin_family = AF_INET;
242 		dst->sin_len = sizeof(*dst);
243 		dst->sin_addr = ip->ip_dst;
244 	}
245 	/*
246 	 * If routing to interface only,
247 	 * short circuit routing lookup.
248 	 */
249 #define ifatoia(ifa)	((struct in_ifaddr *)(ifa))
250 #define sintosa(sin)	((struct sockaddr *)(sin))
251 	if (flags & IP_ROUTETOIF) {
252 		if ((ia = ifatoia(ifa_ifwithdstaddr(sintosa(dst)))) == 0 &&
253 		    (ia = ifatoia(ifa_ifwithnet(sintosa(dst)))) == 0) {
254 			ipstat.ips_noroute++;
255 			error = ENETUNREACH;
256 			goto bad;
257 		}
258 		ifp = ia->ia_ifp;
259 		ip->ip_ttl = 1;
260 		isbroadcast = in_broadcast(dst->sin_addr, ifp);
261 	} else {
262 		/*
263 		 * If this is the case, we probably don't want to allocate
264 		 * a protocol-cloned route since we didn't get one from the
265 		 * ULP.  This lets TCP do its thing, while not burdening
266 		 * forwarding or ICMP with the overhead of cloning a route.
267 		 * Of course, we still want to do any cloning requested by
268 		 * the link layer, as this is probably required in all cases
269 		 * for correct operation (as it is for ARP).
270 		 */
271 		if (ro->ro_rt == 0)
272 			rtalloc_ign(ro, RTF_PRCLONING);
273 		if (ro->ro_rt == 0) {
274 			ipstat.ips_noroute++;
275 			error = EHOSTUNREACH;
276 			goto bad;
277 		}
278 		ia = ifatoia(ro->ro_rt->rt_ifa);
279 		ifp = ro->ro_rt->rt_ifp;
280 		ro->ro_rt->rt_use++;
281 		if (ro->ro_rt->rt_flags & RTF_GATEWAY)
282 			dst = (struct sockaddr_in *)ro->ro_rt->rt_gateway;
283 		if (ro->ro_rt->rt_flags & RTF_HOST)
284 			isbroadcast = (ro->ro_rt->rt_flags & RTF_BROADCAST);
285 		else
286 			isbroadcast = in_broadcast(dst->sin_addr, ifp);
287 	}
288 	if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr))) {
289 		struct in_multi *inm;
290 
291 		m->m_flags |= M_MCAST;
292 		/*
293 		 * IP destination address is multicast.  Make sure "dst"
294 		 * still points to the address in "ro".  (It may have been
295 		 * changed to point to a gateway address, above.)
296 		 */
297 		dst = (struct sockaddr_in *)&ro->ro_dst;
298 		/*
299 		 * See if the caller provided any multicast options
300 		 */
301 		if (imo != NULL) {
302 			ip->ip_ttl = imo->imo_multicast_ttl;
303 			if (imo->imo_multicast_ifp != NULL)
304 				ifp = imo->imo_multicast_ifp;
305 			if (imo->imo_multicast_vif != -1)
306 				ip->ip_src.s_addr =
307 				    ip_mcast_src(imo->imo_multicast_vif);
308 		} else
309 			ip->ip_ttl = IP_DEFAULT_MULTICAST_TTL;
310 		/*
311 		 * Confirm that the outgoing interface supports multicast.
312 		 */
313 		if ((imo == NULL) || (imo->imo_multicast_vif == -1)) {
314 			if ((ifp->if_flags & IFF_MULTICAST) == 0) {
315 				ipstat.ips_noroute++;
316 				error = ENETUNREACH;
317 				goto bad;
318 			}
319 		}
320 		/*
321 		 * If source address not specified yet, use address
322 		 * of outgoing interface.
323 		 */
324 		if (ip->ip_src.s_addr == INADDR_ANY) {
325 			register struct in_ifaddr *ia1;
326 
327 			for (ia1 = in_ifaddrhead.tqh_first; ia1;
328 			     ia1 = ia1->ia_link.tqe_next)
329 				if (ia1->ia_ifp == ifp) {
330 					ip->ip_src = IA_SIN(ia1)->sin_addr;
331 					break;
332 				}
333 		}
334 
335 		IN_LOOKUP_MULTI(ip->ip_dst, ifp, inm);
336 		if (inm != NULL &&
337 		   (imo == NULL || imo->imo_multicast_loop)) {
338 			/*
339 			 * If we belong to the destination multicast group
340 			 * on the outgoing interface, and the caller did not
341 			 * forbid loopback, loop back a copy.
342 			 */
343 			ip_mloopback(ifp, m, dst, hlen);
344 		}
345 		else {
346 			/*
347 			 * If we are acting as a multicast router, perform
348 			 * multicast forwarding as if the packet had just
349 			 * arrived on the interface to which we are about
350 			 * to send.  The multicast forwarding function
351 			 * recursively calls this function, using the
352 			 * IP_FORWARDING flag to prevent infinite recursion.
353 			 *
354 			 * Multicasts that are looped back by ip_mloopback(),
355 			 * above, will be forwarded by the ip_input() routine,
356 			 * if necessary.
357 			 */
358 			if (ip_mrouter && (flags & IP_FORWARDING) == 0) {
359 				/*
360 				 * Check if rsvp daemon is running. If not, don't
361 				 * set ip_moptions. This ensures that the packet
362 				 * is multicast and not just sent down one link
363 				 * as prescribed by rsvpd.
364 				 */
365 				if (!rsvp_on)
366 				  imo = NULL;
367 				if (ip_mforward(ip, ifp, m, imo) != 0) {
368 					m_freem(m);
369 					goto done;
370 				}
371 			}
372 		}
373 
374 		/*
375 		 * Multicasts with a time-to-live of zero may be looped-
376 		 * back, above, but must not be transmitted on a network.
377 		 * Also, multicasts addressed to the loopback interface
378 		 * are not sent -- the above call to ip_mloopback() will
379 		 * loop back a copy if this host actually belongs to the
380 		 * destination group on the loopback interface.
381 		 */
382 		if (ip->ip_ttl == 0 || ifp->if_flags & IFF_LOOPBACK) {
383 			m_freem(m);
384 			goto done;
385 		}
386 
387 		goto sendit;
388 	}
389 #ifndef notdef
390 	/*
391 	 * If source address not specified yet, use address
392 	 * of outgoing interface.
393 	 */
394 	if (ip->ip_src.s_addr == INADDR_ANY) {
395 		ip->ip_src = IA_SIN(ia)->sin_addr;
396 #ifdef IPFIREWALL_FORWARD
397 		/* Keep note that we did this - if the firewall changes
398 		 * the next-hop, our interface may change, changing the
399 		 * default source IP. It's a shame so much effort happens
400 		 * twice. Oh well.
401 		 */
402 		fwd_rewrite_src++;
403 #endif /* IPFIREWALL_FORWARD */
404 	}
405 #endif /* notdef */
406 	/*
407 	 * Verify that we have any chance at all of being able to queue
408 	 *      the packet or packet fragments
409 	 */
410 	if ((ifp->if_snd.ifq_len + ip->ip_len / ifp->if_mtu + 1) >=
411 		ifp->if_snd.ifq_maxlen) {
412 			error = ENOBUFS;
413 			goto bad;
414 	}
415 
416 	/*
417 	 * Look for broadcast address and
418 	 * and verify user is allowed to send
419 	 * such a packet.
420 	 */
421 	if (isbroadcast) {
422 		if ((ifp->if_flags & IFF_BROADCAST) == 0) {
423 			error = EADDRNOTAVAIL;
424 			goto bad;
425 		}
426 		if ((flags & IP_ALLOWBROADCAST) == 0) {
427 			error = EACCES;
428 			goto bad;
429 		}
430 		/* don't allow broadcast messages to be fragmented */
431 		if ((u_short)ip->ip_len > ifp->if_mtu) {
432 			error = EMSGSIZE;
433 			goto bad;
434 		}
435 		m->m_flags |= M_BCAST;
436 	} else {
437 		m->m_flags &= ~M_BCAST;
438 	}
439 
440 sendit:
441 	/*
442 	 * IpHack's section.
443 	 * - Xlate: translate packet's addr/port (NAT).
444 	 * - Firewall: deny/allow/etc.
445 	 * - Wrap: fake packet's addr/port <unimpl.>
446 	 * - Encapsulate: put it in another IP and send out. <unimp.>
447 	 */
448 	if (fr_checkp) {
449 		struct  mbuf    *m1 = m;
450 
451 		if ((error = (*fr_checkp)(ip, hlen, ifp, 1, &m1)) || !m1)
452 			goto done;
453 		ip = mtod(m = m1, struct ip *);
454 	}
455 
456 	/*
457 	 * Check with the firewall...
458 	 */
459 	if (fw_enable && ip_fw_chk_ptr) {
460 		struct sockaddr_in *old = dst;
461 
462 		off = (*ip_fw_chk_ptr)(&ip,
463 		    hlen, ifp, &divert_cookie, &m, &rule, &dst);
464                 /*
465                  * On return we must do the following:
466                  * m == NULL         -> drop the pkt
467                  * 1<=off<= 0xffff   -> DIVERT
468                  * (off & 0x10000)   -> send to a DUMMYNET pipe
469                  * (off & 0x20000)   -> TEE the packet
470                  * dst != old        -> IPFIREWALL_FORWARD
471                  * off==0, dst==old  -> accept
472                  * If some of the above modules is not compiled in, then
473                  * we should't have to check the corresponding condition
474                  * (because the ipfw control socket should not accept
475                  * unsupported rules), but better play safe and drop
476                  * packets in case of doubt.
477                  */
478 		if (!m) { /* firewall said to reject */
479 			error = EACCES;
480 			goto done;
481 		}
482 		if (off == 0 && dst == old) /* common case */
483 			goto pass ;
484 #ifdef DUMMYNET
485                 if ((off & IP_FW_PORT_DYNT_FLAG) != 0) {
486                     /*
487                      * pass the pkt to dummynet. Need to include
488                      * pipe number, m, ifp, ro, dst because these are
489                      * not recomputed in the next pass.
490                      * All other parameters have been already used and
491                      * so they are not needed anymore.
492                      * XXX note: if the ifp or ro entry are deleted
493                      * while a pkt is in dummynet, we are in trouble!
494                      */
495                     dummynet_io(off & 0xffff, DN_TO_IP_OUT, m,ifp,ro,dst,rule,
496 				flags);
497 			goto done;
498 		}
499 #endif
500 #ifdef IPDIVERT
501 		if (off != 0 && (off & IP_FW_PORT_DYNT_FLAG) == 0) {
502 			struct mbuf *clone = NULL;
503 
504 			/* Clone packet if we're doing a 'tee' */
505 			if ((off & IP_FW_PORT_TEE_FLAG) != 0)
506 				clone = m_dup(m, M_DONTWAIT);
507 
508 			/* Restore packet header fields to original values */
509 			HTONS(ip->ip_len);
510 			HTONS(ip->ip_off);
511 
512 			/* Deliver packet to divert input routine */
513 			ip_divert_cookie = divert_cookie;
514 			divert_packet(m, 0, off & 0xffff);
515 
516 			/* If 'tee', continue with original packet */
517 			if (clone != NULL) {
518 				m = clone;
519 				ip = mtod(m, struct ip *);
520 				goto pass;
521 			}
522 			goto done;
523 		}
524 #endif
525 
526 #ifdef IPFIREWALL_FORWARD
527 		/* Here we check dst to make sure it's directly reachable on the
528 		 * interface we previously thought it was.
529 		 * If it isn't (which may be likely in some situations) we have
530 		 * to re-route it (ie, find a route for the next-hop and the
531 		 * associated interface) and set them here. This is nested
532 		 * forwarding which in most cases is undesirable, except where
533 		 * such control is nigh impossible. So we do it here.
534 		 * And I'm babbling.
535 		 */
536 		if (off == 0 && old != dst) {
537 			struct in_ifaddr *ia;
538 
539 			/* It's changed... */
540 			/* There must be a better way to do this next line... */
541 			static struct route sro_fwd, *ro_fwd = &sro_fwd;
542 #ifdef IPFIREWALL_FORWARD_DEBUG
543 			printf("IPFIREWALL_FORWARD: New dst ip: ");
544 			print_ip(dst->sin_addr);
545 			printf("\n");
546 #endif
547 			/*
548 			 * We need to figure out if we have been forwarded
549 			 * to a local socket. If so then we should somehow
550 			 * "loop back" to ip_input, and get directed to the
551 			 * PCB as if we had received this packet. This is
552 			 * because it may be dificult to identify the packets
553 			 * you want to forward until they are being output
554 			 * and have selected an interface. (e.g. locally
555 			 * initiated packets) If we used the loopback inteface,
556 			 * we would not be able to control what happens
557 			 * as the packet runs through ip_input() as
558 			 * it is done through a ISR.
559 			 */
560 			for (ia = TAILQ_FIRST(&in_ifaddrhead); ia;
561 					ia = TAILQ_NEXT(ia, ia_link)) {
562 				/*
563 				 * If the addr to forward to is one
564 				 * of ours, we pretend to
565 				 * be the destination for this packet.
566 				 */
567 				if (IA_SIN(ia)->sin_addr.s_addr ==
568 						 dst->sin_addr.s_addr)
569 					break;
570 			}
571 			if (ia) {
572 				/* tell ip_input "dont filter" */
573 				ip_fw_fwd_addr = dst;
574 				if (m->m_pkthdr.rcvif == NULL)
575 					m->m_pkthdr.rcvif = ifunit("lo0");
576 				ip->ip_len = htons((u_short)ip->ip_len);
577 				ip->ip_off = htons((u_short)ip->ip_off);
578 				ip->ip_sum = 0;
579 				if (ip->ip_vhl == IP_VHL_BORING) {
580 					ip->ip_sum = in_cksum_hdr(ip);
581 				} else {
582 					ip->ip_sum = in_cksum(m, hlen);
583 				}
584 				ip_input(m);
585 				goto done;
586 			}
587 			/* Some of the logic for this was
588 			 * nicked from above.
589 			 *
590 			 * This rewrites the cached route in a local PCB.
591 			 * Is this what we want to do?
592 			 */
593 			bcopy(dst, &ro_fwd->ro_dst, sizeof(*dst));
594 
595 			ro_fwd->ro_rt = 0;
596 			rtalloc_ign(ro_fwd, RTF_PRCLONING);
597 
598 			if (ro_fwd->ro_rt == 0) {
599 				ipstat.ips_noroute++;
600 				error = EHOSTUNREACH;
601 				goto bad;
602 			}
603 
604 			ia = ifatoia(ro_fwd->ro_rt->rt_ifa);
605 			ifp = ro_fwd->ro_rt->rt_ifp;
606 			ro_fwd->ro_rt->rt_use++;
607 			if (ro_fwd->ro_rt->rt_flags & RTF_GATEWAY)
608 				dst = (struct sockaddr_in *)ro_fwd->ro_rt->rt_gateway;
609 			if (ro_fwd->ro_rt->rt_flags & RTF_HOST)
610 				isbroadcast =
611 				    (ro_fwd->ro_rt->rt_flags & RTF_BROADCAST);
612 			else
613 				isbroadcast = in_broadcast(dst->sin_addr, ifp);
614 			RTFREE(ro->ro_rt);
615 			ro->ro_rt = ro_fwd->ro_rt;
616 			dst = (struct sockaddr_in *)&ro_fwd->ro_dst;
617 
618 			/*
619 			 * If we added a default src ip earlier,
620 			 * which would have been gotten from the-then
621 			 * interface, do it again, from the new one.
622 			 */
623 			if (fwd_rewrite_src)
624 				ip->ip_src = IA_SIN(ia)->sin_addr;
625 			goto pass ;
626 		}
627 #endif /* IPFIREWALL_FORWARD */
628                 /*
629                  * if we get here, none of the above matches, and
630                  * we have to drop the pkt
631                  */
632 		m_freem(m);
633                 error = EACCES; /* not sure this is the right error msg */
634                 goto done;
635 	}
636 
637 pass:
638 #ifdef IPSEC
639 	/* get SP for this packet */
640 	if (so == NULL)
641 		sp = ipsec4_getpolicybyaddr(m, IPSEC_DIR_OUTBOUND, flags, &error);
642 	else
643 		sp = ipsec4_getpolicybysock(m, IPSEC_DIR_OUTBOUND, so, &error);
644 
645 	if (sp == NULL) {
646 		ipsecstat.out_inval++;
647 		goto bad;
648 	}
649 
650 	error = 0;
651 
652 	/* check policy */
653 	switch (sp->policy) {
654 	case IPSEC_POLICY_DISCARD:
655 		/*
656 		 * This packet is just discarded.
657 		 */
658 		ipsecstat.out_polvio++;
659 		goto bad;
660 
661 	case IPSEC_POLICY_BYPASS:
662 	case IPSEC_POLICY_NONE:
663 		/* no need to do IPsec. */
664 		goto skip_ipsec;
665 
666 	case IPSEC_POLICY_IPSEC:
667 		if (sp->req == NULL) {
668 			/* XXX should be panic ? */
669 			printf("ip_output: No IPsec request specified.\n");
670 			error = EINVAL;
671 			goto bad;
672 		}
673 		break;
674 
675 	case IPSEC_POLICY_ENTRUST:
676 	default:
677 		printf("ip_output: Invalid policy found. %d\n", sp->policy);
678 	}
679 
680 	ip->ip_len = htons((u_short)ip->ip_len);
681 	ip->ip_off = htons((u_short)ip->ip_off);
682 	ip->ip_sum = 0;
683 
684     {
685 	struct ipsec_output_state state;
686 	bzero(&state, sizeof(state));
687 	state.m = m;
688 	if (flags & IP_ROUTETOIF) {
689 		state.ro = &iproute;
690 		bzero(&iproute, sizeof(iproute));
691 	} else
692 		state.ro = ro;
693 	state.dst = (struct sockaddr *)dst;
694 
695 	error = ipsec4_output(&state, sp, flags);
696 
697 	m = state.m;
698 	if (flags & IP_ROUTETOIF) {
699 		/*
700 		 * if we have tunnel mode SA, we may need to ignore
701 		 * IP_ROUTETOIF.
702 		 */
703 		if (state.ro != &iproute || state.ro->ro_rt != NULL) {
704 			flags &= ~IP_ROUTETOIF;
705 			ro = state.ro;
706 		}
707 	} else
708 		ro = state.ro;
709 	dst = (struct sockaddr_in *)state.dst;
710 	if (error) {
711 		/* mbuf is already reclaimed in ipsec4_output. */
712 		m0 = NULL;
713 		switch (error) {
714 		case EHOSTUNREACH:
715 		case ENETUNREACH:
716 		case EMSGSIZE:
717 		case ENOBUFS:
718 		case ENOMEM:
719 			break;
720 		default:
721 			printf("ip4_output (ipsec): error code %d\n", error);
722 			/*fall through*/
723 		case ENOENT:
724 			/* don't show these error codes to the user */
725 			error = 0;
726 			break;
727 		}
728 		goto bad;
729 	}
730     }
731 
732 	/* be sure to update variables that are affected by ipsec4_output() */
733 	ip = mtod(m, struct ip *);
734 #ifdef _IP_VHL
735 	hlen = IP_VHL_HL(ip->ip_vhl) << 2;
736 #else
737 	hlen = ip->ip_hl << 2;
738 #endif
739 	if (ro->ro_rt == NULL) {
740 		if ((flags & IP_ROUTETOIF) == 0) {
741 			printf("ip_output: "
742 				"can't update route after IPsec processing\n");
743 			error = EHOSTUNREACH;	/*XXX*/
744 			goto bad;
745 		}
746 	} else {
747 		/* nobody uses ia beyond here */
748 		ifp = ro->ro_rt->rt_ifp;
749 	}
750 
751 	/* make it flipped, again. */
752 	ip->ip_len = ntohs((u_short)ip->ip_len);
753 	ip->ip_off = ntohs((u_short)ip->ip_off);
754 skip_ipsec:
755 #endif /*IPSEC*/
756 
757 	/*
758 	 * If small enough for interface, can just send directly.
759 	 */
760 	if ((u_short)ip->ip_len <= ifp->if_mtu) {
761 		ip->ip_len = htons((u_short)ip->ip_len);
762 		ip->ip_off = htons((u_short)ip->ip_off);
763 		ip->ip_sum = 0;
764 		if (ip->ip_vhl == IP_VHL_BORING) {
765 			ip->ip_sum = in_cksum_hdr(ip);
766 		} else {
767 			ip->ip_sum = in_cksum(m, hlen);
768 		}
769 		error = (*ifp->if_output)(ifp, m,
770 				(struct sockaddr *)dst, ro->ro_rt);
771 		goto done;
772 	}
773 	/*
774 	 * Too large for interface; fragment if possible.
775 	 * Must be able to put at least 8 bytes per fragment.
776 	 */
777 	if (ip->ip_off & IP_DF) {
778 		error = EMSGSIZE;
779 		/*
780 		 * This case can happen if the user changed the MTU
781 		 * of an interface after enabling IP on it.  Because
782 		 * most netifs don't keep track of routes pointing to
783 		 * them, there is no way for one to update all its
784 		 * routes when the MTU is changed.
785 		 */
786 		if ((ro->ro_rt->rt_flags & (RTF_UP | RTF_HOST))
787 		    && !(ro->ro_rt->rt_rmx.rmx_locks & RTV_MTU)
788 		    && (ro->ro_rt->rt_rmx.rmx_mtu > ifp->if_mtu)) {
789 			ro->ro_rt->rt_rmx.rmx_mtu = ifp->if_mtu;
790 		}
791 		ipstat.ips_cantfrag++;
792 		goto bad;
793 	}
794 	len = (ifp->if_mtu - hlen) &~ 7;
795 	if (len < 8) {
796 		error = EMSGSIZE;
797 		goto bad;
798 	}
799 
800     {
801 	int mhlen, firstlen = len;
802 	struct mbuf **mnext = &m->m_nextpkt;
803 
804 	/*
805 	 * Loop through length of segment after first fragment,
806 	 * make new header and copy data of each part and link onto chain.
807 	 */
808 	m0 = m;
809 	mhlen = sizeof (struct ip);
810 	for (off = hlen + len; off < (u_short)ip->ip_len; off += len) {
811 		MGETHDR(m, M_DONTWAIT, MT_HEADER);
812 		if (m == 0) {
813 			error = ENOBUFS;
814 			ipstat.ips_odropped++;
815 			goto sendorfree;
816 		}
817 		m->m_flags |= (m0->m_flags & M_MCAST);
818 		m->m_data += max_linkhdr;
819 		mhip = mtod(m, struct ip *);
820 		*mhip = *ip;
821 		if (hlen > sizeof (struct ip)) {
822 			mhlen = ip_optcopy(ip, mhip) + sizeof (struct ip);
823 			mhip->ip_vhl = IP_MAKE_VHL(IPVERSION, mhlen >> 2);
824 		}
825 		m->m_len = mhlen;
826 		mhip->ip_off = ((off - hlen) >> 3) + (ip->ip_off & ~IP_MF);
827 		if (ip->ip_off & IP_MF)
828 			mhip->ip_off |= IP_MF;
829 		if (off + len >= (u_short)ip->ip_len)
830 			len = (u_short)ip->ip_len - off;
831 		else
832 			mhip->ip_off |= IP_MF;
833 		mhip->ip_len = htons((u_short)(len + mhlen));
834 		m->m_next = m_copy(m0, off, len);
835 		if (m->m_next == 0) {
836 			(void) m_free(m);
837 			error = ENOBUFS;	/* ??? */
838 			ipstat.ips_odropped++;
839 			goto sendorfree;
840 		}
841 		m->m_pkthdr.len = mhlen + len;
842 		m->m_pkthdr.rcvif = (struct ifnet *)0;
843 		mhip->ip_off = htons((u_short)mhip->ip_off);
844 		mhip->ip_sum = 0;
845 		if (mhip->ip_vhl == IP_VHL_BORING) {
846 			mhip->ip_sum = in_cksum_hdr(mhip);
847 		} else {
848 			mhip->ip_sum = in_cksum(m, mhlen);
849 		}
850 		*mnext = m;
851 		mnext = &m->m_nextpkt;
852 		ipstat.ips_ofragments++;
853 	}
854 	/*
855 	 * Update first fragment by trimming what's been copied out
856 	 * and updating header, then send each fragment (in order).
857 	 */
858 	m = m0;
859 	m_adj(m, hlen + firstlen - (u_short)ip->ip_len);
860 	m->m_pkthdr.len = hlen + firstlen;
861 	ip->ip_len = htons((u_short)m->m_pkthdr.len);
862 	ip->ip_off = htons((u_short)(ip->ip_off | IP_MF));
863 	ip->ip_sum = 0;
864 	if (ip->ip_vhl == IP_VHL_BORING) {
865 		ip->ip_sum = in_cksum_hdr(ip);
866 	} else {
867 		ip->ip_sum = in_cksum(m, hlen);
868 	}
869 sendorfree:
870 	for (m = m0; m; m = m0) {
871 		m0 = m->m_nextpkt;
872 		m->m_nextpkt = 0;
873 		if (error == 0)
874 			error = (*ifp->if_output)(ifp, m,
875 			    (struct sockaddr *)dst, ro->ro_rt);
876 		else
877 			m_freem(m);
878 	}
879 
880 	if (error == 0)
881 		ipstat.ips_fragmented++;
882     }
883 done:
884 #ifdef IPSEC
885 	if (ro == &iproute && ro->ro_rt) {
886 		RTFREE(ro->ro_rt);
887 		ro->ro_rt = NULL;
888 	}
889 	if (sp != NULL) {
890 		KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
891 			printf("DP ip_output call free SP:%p\n", sp));
892 		key_freesp(sp);
893 	}
894 #endif /* IPSEC */
895 	return (error);
896 bad:
897 	m_freem(m0);
898 	goto done;
899 }
900 
901 /*
902  * Insert IP options into preformed packet.
903  * Adjust IP destination as required for IP source routing,
904  * as indicated by a non-zero in_addr at the start of the options.
905  *
906  * XXX This routine assumes that the packet has no options in place.
907  */
908 static struct mbuf *
909 ip_insertoptions(m, opt, phlen)
910 	register struct mbuf *m;
911 	struct mbuf *opt;
912 	int *phlen;
913 {
914 	register struct ipoption *p = mtod(opt, struct ipoption *);
915 	struct mbuf *n;
916 	register struct ip *ip = mtod(m, struct ip *);
917 	unsigned optlen;
918 
919 	optlen = opt->m_len - sizeof(p->ipopt_dst);
920 	if (optlen + (u_short)ip->ip_len > IP_MAXPACKET)
921 		return (m);		/* XXX should fail */
922 	if (p->ipopt_dst.s_addr)
923 		ip->ip_dst = p->ipopt_dst;
924 	if (m->m_flags & M_EXT || m->m_data - optlen < m->m_pktdat) {
925 		MGETHDR(n, M_DONTWAIT, MT_HEADER);
926 		if (n == 0)
927 			return (m);
928 		n->m_pkthdr.rcvif = (struct ifnet *)0;
929 		n->m_pkthdr.len = m->m_pkthdr.len + optlen;
930 		m->m_len -= sizeof(struct ip);
931 		m->m_data += sizeof(struct ip);
932 		n->m_next = m;
933 		m = n;
934 		m->m_len = optlen + sizeof(struct ip);
935 		m->m_data += max_linkhdr;
936 		(void)memcpy(mtod(m, void *), ip, sizeof(struct ip));
937 	} else {
938 		m->m_data -= optlen;
939 		m->m_len += optlen;
940 		m->m_pkthdr.len += optlen;
941 		ovbcopy((caddr_t)ip, mtod(m, caddr_t), sizeof(struct ip));
942 	}
943 	ip = mtod(m, struct ip *);
944 	bcopy(p->ipopt_list, ip + 1, optlen);
945 	*phlen = sizeof(struct ip) + optlen;
946 	ip->ip_vhl = IP_MAKE_VHL(IPVERSION, *phlen >> 2);
947 	ip->ip_len += optlen;
948 	return (m);
949 }
950 
951 /*
952  * Copy options from ip to jp,
953  * omitting those not copied during fragmentation.
954  */
955 int
956 ip_optcopy(ip, jp)
957 	struct ip *ip, *jp;
958 {
959 	register u_char *cp, *dp;
960 	int opt, optlen, cnt;
961 
962 	cp = (u_char *)(ip + 1);
963 	dp = (u_char *)(jp + 1);
964 	cnt = (IP_VHL_HL(ip->ip_vhl) << 2) - sizeof (struct ip);
965 	for (; cnt > 0; cnt -= optlen, cp += optlen) {
966 		opt = cp[0];
967 		if (opt == IPOPT_EOL)
968 			break;
969 		if (opt == IPOPT_NOP) {
970 			/* Preserve for IP mcast tunnel's LSRR alignment. */
971 			*dp++ = IPOPT_NOP;
972 			optlen = 1;
973 			continue;
974 		} else
975 			optlen = cp[IPOPT_OLEN];
976 		/* bogus lengths should have been caught by ip_dooptions */
977 		if (optlen > cnt)
978 			optlen = cnt;
979 		if (IPOPT_COPIED(opt)) {
980 			bcopy(cp, dp, optlen);
981 			dp += optlen;
982 		}
983 	}
984 	for (optlen = dp - (u_char *)(jp+1); optlen & 0x3; optlen++)
985 		*dp++ = IPOPT_EOL;
986 	return (optlen);
987 }
988 
989 /*
990  * IP socket option processing.
991  */
992 int
993 ip_ctloutput(so, sopt)
994 	struct socket *so;
995 	struct sockopt *sopt;
996 {
997 	struct	inpcb *inp = sotoinpcb(so);
998 	int	error, optval;
999 
1000 	error = optval = 0;
1001 	if (sopt->sopt_level != IPPROTO_IP) {
1002 		return (EINVAL);
1003 	}
1004 
1005 	switch (sopt->sopt_dir) {
1006 	case SOPT_SET:
1007 		switch (sopt->sopt_name) {
1008 		case IP_OPTIONS:
1009 #ifdef notyet
1010 		case IP_RETOPTS:
1011 #endif
1012 		{
1013 			struct mbuf *m;
1014 			if (sopt->sopt_valsize > MLEN) {
1015 				error = EMSGSIZE;
1016 				break;
1017 			}
1018 			MGET(m, sopt->sopt_p ? M_WAIT : M_DONTWAIT, MT_HEADER);
1019 			if (m == 0) {
1020 				error = ENOBUFS;
1021 				break;
1022 			}
1023 			m->m_len = sopt->sopt_valsize;
1024 			error = sooptcopyin(sopt, mtod(m, char *), m->m_len,
1025 					    m->m_len);
1026 
1027 			return (ip_pcbopts(sopt->sopt_name, &inp->inp_options,
1028 					   m));
1029 		}
1030 
1031 		case IP_TOS:
1032 		case IP_TTL:
1033 		case IP_RECVOPTS:
1034 		case IP_RECVRETOPTS:
1035 		case IP_RECVDSTADDR:
1036 		case IP_RECVIF:
1037 #if defined(NFAITH) && NFAITH > 0
1038 		case IP_FAITH:
1039 #endif
1040 			error = sooptcopyin(sopt, &optval, sizeof optval,
1041 					    sizeof optval);
1042 			if (error)
1043 				break;
1044 
1045 			switch (sopt->sopt_name) {
1046 			case IP_TOS:
1047 				inp->inp_ip_tos = optval;
1048 				break;
1049 
1050 			case IP_TTL:
1051 				inp->inp_ip_ttl = optval;
1052 				break;
1053 #define	OPTSET(bit) \
1054 	if (optval) \
1055 		inp->inp_flags |= bit; \
1056 	else \
1057 		inp->inp_flags &= ~bit;
1058 
1059 			case IP_RECVOPTS:
1060 				OPTSET(INP_RECVOPTS);
1061 				break;
1062 
1063 			case IP_RECVRETOPTS:
1064 				OPTSET(INP_RECVRETOPTS);
1065 				break;
1066 
1067 			case IP_RECVDSTADDR:
1068 				OPTSET(INP_RECVDSTADDR);
1069 				break;
1070 
1071 			case IP_RECVIF:
1072 				OPTSET(INP_RECVIF);
1073 				break;
1074 
1075 #if defined(NFAITH) && NFAITH > 0
1076 			case IP_FAITH:
1077 				OPTSET(INP_FAITH);
1078 				break;
1079 #endif
1080 			}
1081 			break;
1082 #undef OPTSET
1083 
1084 		case IP_MULTICAST_IF:
1085 		case IP_MULTICAST_VIF:
1086 		case IP_MULTICAST_TTL:
1087 		case IP_MULTICAST_LOOP:
1088 		case IP_ADD_MEMBERSHIP:
1089 		case IP_DROP_MEMBERSHIP:
1090 			error = ip_setmoptions(sopt, &inp->inp_moptions);
1091 			break;
1092 
1093 		case IP_PORTRANGE:
1094 			error = sooptcopyin(sopt, &optval, sizeof optval,
1095 					    sizeof optval);
1096 			if (error)
1097 				break;
1098 
1099 			switch (optval) {
1100 			case IP_PORTRANGE_DEFAULT:
1101 				inp->inp_flags &= ~(INP_LOWPORT);
1102 				inp->inp_flags &= ~(INP_HIGHPORT);
1103 				break;
1104 
1105 			case IP_PORTRANGE_HIGH:
1106 				inp->inp_flags &= ~(INP_LOWPORT);
1107 				inp->inp_flags |= INP_HIGHPORT;
1108 				break;
1109 
1110 			case IP_PORTRANGE_LOW:
1111 				inp->inp_flags &= ~(INP_HIGHPORT);
1112 				inp->inp_flags |= INP_LOWPORT;
1113 				break;
1114 
1115 			default:
1116 				error = EINVAL;
1117 				break;
1118 			}
1119 			break;
1120 
1121 #ifdef IPSEC
1122 		case IP_IPSEC_POLICY:
1123 		{
1124 			caddr_t req;
1125 			int priv;
1126 			struct mbuf *m;
1127 			int optname;
1128 
1129 			if ((error = soopt_getm(sopt, &m)) != 0) /* XXX */
1130 				break;
1131 			if ((error = soopt_mcopyin(sopt, m)) != 0) /* XXX */
1132 				break;
1133 			priv = (sopt->sopt_p != NULL &&
1134 				suser(sopt->sopt_p) != 0) ? 0 : 1;
1135 			req = mtod(m, caddr_t);
1136 			optname = sopt->sopt_name;
1137 			error = ipsec4_set_policy(inp, optname, req, priv);
1138 			m_freem(m);
1139 			break;
1140 		}
1141 #endif /*IPSEC*/
1142 
1143 		default:
1144 			error = ENOPROTOOPT;
1145 			break;
1146 		}
1147 		break;
1148 
1149 	case SOPT_GET:
1150 		switch (sopt->sopt_name) {
1151 		case IP_OPTIONS:
1152 		case IP_RETOPTS:
1153 			if (inp->inp_options)
1154 				error = sooptcopyout(sopt,
1155 						     mtod(inp->inp_options,
1156 							  char *),
1157 						     inp->inp_options->m_len);
1158 			else
1159 				sopt->sopt_valsize = 0;
1160 			break;
1161 
1162 		case IP_TOS:
1163 		case IP_TTL:
1164 		case IP_RECVOPTS:
1165 		case IP_RECVRETOPTS:
1166 		case IP_RECVDSTADDR:
1167 		case IP_RECVIF:
1168 		case IP_PORTRANGE:
1169 #if defined(NFAITH) && NFAITH > 0
1170 		case IP_FAITH:
1171 #endif
1172 			switch (sopt->sopt_name) {
1173 
1174 			case IP_TOS:
1175 				optval = inp->inp_ip_tos;
1176 				break;
1177 
1178 			case IP_TTL:
1179 				optval = inp->inp_ip_ttl;
1180 				break;
1181 
1182 #define	OPTBIT(bit)	(inp->inp_flags & bit ? 1 : 0)
1183 
1184 			case IP_RECVOPTS:
1185 				optval = OPTBIT(INP_RECVOPTS);
1186 				break;
1187 
1188 			case IP_RECVRETOPTS:
1189 				optval = OPTBIT(INP_RECVRETOPTS);
1190 				break;
1191 
1192 			case IP_RECVDSTADDR:
1193 				optval = OPTBIT(INP_RECVDSTADDR);
1194 				break;
1195 
1196 			case IP_RECVIF:
1197 				optval = OPTBIT(INP_RECVIF);
1198 				break;
1199 
1200 			case IP_PORTRANGE:
1201 				if (inp->inp_flags & INP_HIGHPORT)
1202 					optval = IP_PORTRANGE_HIGH;
1203 				else if (inp->inp_flags & INP_LOWPORT)
1204 					optval = IP_PORTRANGE_LOW;
1205 				else
1206 					optval = 0;
1207 				break;
1208 
1209 #if defined(NFAITH) && NFAITH > 0
1210 			case IP_FAITH:
1211 				optval = OPTBIT(INP_FAITH);
1212 				break;
1213 #endif
1214 			}
1215 			error = sooptcopyout(sopt, &optval, sizeof optval);
1216 			break;
1217 
1218 		case IP_MULTICAST_IF:
1219 		case IP_MULTICAST_VIF:
1220 		case IP_MULTICAST_TTL:
1221 		case IP_MULTICAST_LOOP:
1222 		case IP_ADD_MEMBERSHIP:
1223 		case IP_DROP_MEMBERSHIP:
1224 			error = ip_getmoptions(sopt, inp->inp_moptions);
1225 			break;
1226 
1227 #ifdef IPSEC
1228 		case IP_IPSEC_POLICY:
1229 		{
1230 			struct mbuf *m;
1231 			caddr_t req = NULL;
1232 
1233 			if (m != 0)
1234 				req = mtod(m, caddr_t);
1235 			error = ipsec4_get_policy(sotoinpcb(so), req, &m);
1236 			if (error == 0)
1237 				error = soopt_mcopyout(sopt, m); /* XXX */
1238 			m_freem(m);
1239 			break;
1240 		}
1241 #endif /*IPSEC*/
1242 
1243 		default:
1244 			error = ENOPROTOOPT;
1245 			break;
1246 		}
1247 		break;
1248 	}
1249 	return (error);
1250 }
1251 
1252 /*
1253  * Set up IP options in pcb for insertion in output packets.
1254  * Store in mbuf with pointer in pcbopt, adding pseudo-option
1255  * with destination address if source routed.
1256  */
1257 static int
1258 ip_pcbopts(optname, pcbopt, m)
1259 	int optname;
1260 	struct mbuf **pcbopt;
1261 	register struct mbuf *m;
1262 {
1263 	register int cnt, optlen;
1264 	register u_char *cp;
1265 	u_char opt;
1266 
1267 	/* turn off any old options */
1268 	if (*pcbopt)
1269 		(void)m_free(*pcbopt);
1270 	*pcbopt = 0;
1271 	if (m == (struct mbuf *)0 || m->m_len == 0) {
1272 		/*
1273 		 * Only turning off any previous options.
1274 		 */
1275 		if (m)
1276 			(void)m_free(m);
1277 		return (0);
1278 	}
1279 
1280 #ifndef	vax
1281 	if (m->m_len % sizeof(int32_t))
1282 		goto bad;
1283 #endif
1284 	/*
1285 	 * IP first-hop destination address will be stored before
1286 	 * actual options; move other options back
1287 	 * and clear it when none present.
1288 	 */
1289 	if (m->m_data + m->m_len + sizeof(struct in_addr) >= &m->m_dat[MLEN])
1290 		goto bad;
1291 	cnt = m->m_len;
1292 	m->m_len += sizeof(struct in_addr);
1293 	cp = mtod(m, u_char *) + sizeof(struct in_addr);
1294 	ovbcopy(mtod(m, caddr_t), (caddr_t)cp, (unsigned)cnt);
1295 	bzero(mtod(m, caddr_t), sizeof(struct in_addr));
1296 
1297 	for (; cnt > 0; cnt -= optlen, cp += optlen) {
1298 		opt = cp[IPOPT_OPTVAL];
1299 		if (opt == IPOPT_EOL)
1300 			break;
1301 		if (opt == IPOPT_NOP)
1302 			optlen = 1;
1303 		else {
1304 			optlen = cp[IPOPT_OLEN];
1305 			if (optlen <= IPOPT_OLEN || optlen > cnt)
1306 				goto bad;
1307 		}
1308 		switch (opt) {
1309 
1310 		default:
1311 			break;
1312 
1313 		case IPOPT_LSRR:
1314 		case IPOPT_SSRR:
1315 			/*
1316 			 * user process specifies route as:
1317 			 *	->A->B->C->D
1318 			 * D must be our final destination (but we can't
1319 			 * check that since we may not have connected yet).
1320 			 * A is first hop destination, which doesn't appear in
1321 			 * actual IP option, but is stored before the options.
1322 			 */
1323 			if (optlen < IPOPT_MINOFF - 1 + sizeof(struct in_addr))
1324 				goto bad;
1325 			m->m_len -= sizeof(struct in_addr);
1326 			cnt -= sizeof(struct in_addr);
1327 			optlen -= sizeof(struct in_addr);
1328 			cp[IPOPT_OLEN] = optlen;
1329 			/*
1330 			 * Move first hop before start of options.
1331 			 */
1332 			bcopy((caddr_t)&cp[IPOPT_OFFSET+1], mtod(m, caddr_t),
1333 			    sizeof(struct in_addr));
1334 			/*
1335 			 * Then copy rest of options back
1336 			 * to close up the deleted entry.
1337 			 */
1338 			ovbcopy((caddr_t)(&cp[IPOPT_OFFSET+1] +
1339 			    sizeof(struct in_addr)),
1340 			    (caddr_t)&cp[IPOPT_OFFSET+1],
1341 			    (unsigned)cnt + sizeof(struct in_addr));
1342 			break;
1343 		}
1344 	}
1345 	if (m->m_len > MAX_IPOPTLEN + sizeof(struct in_addr))
1346 		goto bad;
1347 	*pcbopt = m;
1348 	return (0);
1349 
1350 bad:
1351 	(void)m_free(m);
1352 	return (EINVAL);
1353 }
1354 
1355 /*
1356  * XXX
1357  * The whole multicast option thing needs to be re-thought.
1358  * Several of these options are equally applicable to non-multicast
1359  * transmission, and one (IP_MULTICAST_TTL) totally duplicates a
1360  * standard option (IP_TTL).
1361  */
1362 /*
1363  * Set the IP multicast options in response to user setsockopt().
1364  */
1365 static int
1366 ip_setmoptions(sopt, imop)
1367 	struct sockopt *sopt;
1368 	struct ip_moptions **imop;
1369 {
1370 	int error = 0;
1371 	int i;
1372 	struct in_addr addr;
1373 	struct ip_mreq mreq;
1374 	struct ifnet *ifp;
1375 	struct ip_moptions *imo = *imop;
1376 	struct route ro;
1377 	struct sockaddr_in *dst;
1378 	int s;
1379 
1380 	if (imo == NULL) {
1381 		/*
1382 		 * No multicast option buffer attached to the pcb;
1383 		 * allocate one and initialize to default values.
1384 		 */
1385 		imo = (struct ip_moptions*)malloc(sizeof(*imo), M_IPMOPTS,
1386 		    M_WAITOK);
1387 
1388 		if (imo == NULL)
1389 			return (ENOBUFS);
1390 		*imop = imo;
1391 		imo->imo_multicast_ifp = NULL;
1392 		imo->imo_multicast_vif = -1;
1393 		imo->imo_multicast_ttl = IP_DEFAULT_MULTICAST_TTL;
1394 		imo->imo_multicast_loop = IP_DEFAULT_MULTICAST_LOOP;
1395 		imo->imo_num_memberships = 0;
1396 	}
1397 
1398 	switch (sopt->sopt_name) {
1399 	/* store an index number for the vif you wanna use in the send */
1400 	case IP_MULTICAST_VIF:
1401 		if (legal_vif_num == 0) {
1402 			error = EOPNOTSUPP;
1403 			break;
1404 		}
1405 		error = sooptcopyin(sopt, &i, sizeof i, sizeof i);
1406 		if (error)
1407 			break;
1408 		if (!legal_vif_num(i) && (i != -1)) {
1409 			error = EINVAL;
1410 			break;
1411 		}
1412 		imo->imo_multicast_vif = i;
1413 		break;
1414 
1415 	case IP_MULTICAST_IF:
1416 		/*
1417 		 * Select the interface for outgoing multicast packets.
1418 		 */
1419 		error = sooptcopyin(sopt, &addr, sizeof addr, sizeof addr);
1420 		if (error)
1421 			break;
1422 		/*
1423 		 * INADDR_ANY is used to remove a previous selection.
1424 		 * When no interface is selected, a default one is
1425 		 * chosen every time a multicast packet is sent.
1426 		 */
1427 		if (addr.s_addr == INADDR_ANY) {
1428 			imo->imo_multicast_ifp = NULL;
1429 			break;
1430 		}
1431 		/*
1432 		 * The selected interface is identified by its local
1433 		 * IP address.  Find the interface and confirm that
1434 		 * it supports multicasting.
1435 		 */
1436 		s = splimp();
1437 		INADDR_TO_IFP(addr, ifp);
1438 		if (ifp == NULL || (ifp->if_flags & IFF_MULTICAST) == 0) {
1439 			splx(s);
1440 			error = EADDRNOTAVAIL;
1441 			break;
1442 		}
1443 		imo->imo_multicast_ifp = ifp;
1444 		splx(s);
1445 		break;
1446 
1447 	case IP_MULTICAST_TTL:
1448 		/*
1449 		 * Set the IP time-to-live for outgoing multicast packets.
1450 		 * The original multicast API required a char argument,
1451 		 * which is inconsistent with the rest of the socket API.
1452 		 * We allow either a char or an int.
1453 		 */
1454 		if (sopt->sopt_valsize == 1) {
1455 			u_char ttl;
1456 			error = sooptcopyin(sopt, &ttl, 1, 1);
1457 			if (error)
1458 				break;
1459 			imo->imo_multicast_ttl = ttl;
1460 		} else {
1461 			u_int ttl;
1462 			error = sooptcopyin(sopt, &ttl, sizeof ttl,
1463 					    sizeof ttl);
1464 			if (error)
1465 				break;
1466 			if (ttl > 255)
1467 				error = EINVAL;
1468 			else
1469 				imo->imo_multicast_ttl = ttl;
1470 		}
1471 		break;
1472 
1473 	case IP_MULTICAST_LOOP:
1474 		/*
1475 		 * Set the loopback flag for outgoing multicast packets.
1476 		 * Must be zero or one.  The original multicast API required a
1477 		 * char argument, which is inconsistent with the rest
1478 		 * of the socket API.  We allow either a char or an int.
1479 		 */
1480 		if (sopt->sopt_valsize == 1) {
1481 			u_char loop;
1482 			error = sooptcopyin(sopt, &loop, 1, 1);
1483 			if (error)
1484 				break;
1485 			imo->imo_multicast_loop = !!loop;
1486 		} else {
1487 			u_int loop;
1488 			error = sooptcopyin(sopt, &loop, sizeof loop,
1489 					    sizeof loop);
1490 			if (error)
1491 				break;
1492 			imo->imo_multicast_loop = !!loop;
1493 		}
1494 		break;
1495 
1496 	case IP_ADD_MEMBERSHIP:
1497 		/*
1498 		 * Add a multicast group membership.
1499 		 * Group must be a valid IP multicast address.
1500 		 */
1501 		error = sooptcopyin(sopt, &mreq, sizeof mreq, sizeof mreq);
1502 		if (error)
1503 			break;
1504 
1505 		if (!IN_MULTICAST(ntohl(mreq.imr_multiaddr.s_addr))) {
1506 			error = EINVAL;
1507 			break;
1508 		}
1509 		s = splimp();
1510 		/*
1511 		 * If no interface address was provided, use the interface of
1512 		 * the route to the given multicast address.
1513 		 */
1514 		if (mreq.imr_interface.s_addr == INADDR_ANY) {
1515 			bzero((caddr_t)&ro, sizeof(ro));
1516 			dst = (struct sockaddr_in *)&ro.ro_dst;
1517 			dst->sin_len = sizeof(*dst);
1518 			dst->sin_family = AF_INET;
1519 			dst->sin_addr = mreq.imr_multiaddr;
1520 			rtalloc(&ro);
1521 			if (ro.ro_rt == NULL) {
1522 				error = EADDRNOTAVAIL;
1523 				splx(s);
1524 				break;
1525 			}
1526 			ifp = ro.ro_rt->rt_ifp;
1527 			rtfree(ro.ro_rt);
1528 		}
1529 		else {
1530 			INADDR_TO_IFP(mreq.imr_interface, ifp);
1531 		}
1532 
1533 		/*
1534 		 * See if we found an interface, and confirm that it
1535 		 * supports multicast.
1536 		 */
1537 		if (ifp == NULL || (ifp->if_flags & IFF_MULTICAST) == 0) {
1538 			error = EADDRNOTAVAIL;
1539 			splx(s);
1540 			break;
1541 		}
1542 		/*
1543 		 * See if the membership already exists or if all the
1544 		 * membership slots are full.
1545 		 */
1546 		for (i = 0; i < imo->imo_num_memberships; ++i) {
1547 			if (imo->imo_membership[i]->inm_ifp == ifp &&
1548 			    imo->imo_membership[i]->inm_addr.s_addr
1549 						== mreq.imr_multiaddr.s_addr)
1550 				break;
1551 		}
1552 		if (i < imo->imo_num_memberships) {
1553 			error = EADDRINUSE;
1554 			splx(s);
1555 			break;
1556 		}
1557 		if (i == IP_MAX_MEMBERSHIPS) {
1558 			error = ETOOMANYREFS;
1559 			splx(s);
1560 			break;
1561 		}
1562 		/*
1563 		 * Everything looks good; add a new record to the multicast
1564 		 * address list for the given interface.
1565 		 */
1566 		if ((imo->imo_membership[i] =
1567 		    in_addmulti(&mreq.imr_multiaddr, ifp)) == NULL) {
1568 			error = ENOBUFS;
1569 			splx(s);
1570 			break;
1571 		}
1572 		++imo->imo_num_memberships;
1573 		splx(s);
1574 		break;
1575 
1576 	case IP_DROP_MEMBERSHIP:
1577 		/*
1578 		 * Drop a multicast group membership.
1579 		 * Group must be a valid IP multicast address.
1580 		 */
1581 		error = sooptcopyin(sopt, &mreq, sizeof mreq, sizeof mreq);
1582 		if (error)
1583 			break;
1584 
1585 		if (!IN_MULTICAST(ntohl(mreq.imr_multiaddr.s_addr))) {
1586 			error = EINVAL;
1587 			break;
1588 		}
1589 
1590 		s = splimp();
1591 		/*
1592 		 * If an interface address was specified, get a pointer
1593 		 * to its ifnet structure.
1594 		 */
1595 		if (mreq.imr_interface.s_addr == INADDR_ANY)
1596 			ifp = NULL;
1597 		else {
1598 			INADDR_TO_IFP(mreq.imr_interface, ifp);
1599 			if (ifp == NULL) {
1600 				error = EADDRNOTAVAIL;
1601 				splx(s);
1602 				break;
1603 			}
1604 		}
1605 		/*
1606 		 * Find the membership in the membership array.
1607 		 */
1608 		for (i = 0; i < imo->imo_num_memberships; ++i) {
1609 			if ((ifp == NULL ||
1610 			     imo->imo_membership[i]->inm_ifp == ifp) &&
1611 			     imo->imo_membership[i]->inm_addr.s_addr ==
1612 			     mreq.imr_multiaddr.s_addr)
1613 				break;
1614 		}
1615 		if (i == imo->imo_num_memberships) {
1616 			error = EADDRNOTAVAIL;
1617 			splx(s);
1618 			break;
1619 		}
1620 		/*
1621 		 * Give up the multicast address record to which the
1622 		 * membership points.
1623 		 */
1624 		in_delmulti(imo->imo_membership[i]);
1625 		/*
1626 		 * Remove the gap in the membership array.
1627 		 */
1628 		for (++i; i < imo->imo_num_memberships; ++i)
1629 			imo->imo_membership[i-1] = imo->imo_membership[i];
1630 		--imo->imo_num_memberships;
1631 		splx(s);
1632 		break;
1633 
1634 	default:
1635 		error = EOPNOTSUPP;
1636 		break;
1637 	}
1638 
1639 	/*
1640 	 * If all options have default values, no need to keep the mbuf.
1641 	 */
1642 	if (imo->imo_multicast_ifp == NULL &&
1643 	    imo->imo_multicast_vif == -1 &&
1644 	    imo->imo_multicast_ttl == IP_DEFAULT_MULTICAST_TTL &&
1645 	    imo->imo_multicast_loop == IP_DEFAULT_MULTICAST_LOOP &&
1646 	    imo->imo_num_memberships == 0) {
1647 		free(*imop, M_IPMOPTS);
1648 		*imop = NULL;
1649 	}
1650 
1651 	return (error);
1652 }
1653 
1654 /*
1655  * Return the IP multicast options in response to user getsockopt().
1656  */
1657 static int
1658 ip_getmoptions(sopt, imo)
1659 	struct sockopt *sopt;
1660 	register struct ip_moptions *imo;
1661 {
1662 	struct in_addr addr;
1663 	struct in_ifaddr *ia;
1664 	int error, optval;
1665 	u_char coptval;
1666 
1667 	error = 0;
1668 	switch (sopt->sopt_name) {
1669 	case IP_MULTICAST_VIF:
1670 		if (imo != NULL)
1671 			optval = imo->imo_multicast_vif;
1672 		else
1673 			optval = -1;
1674 		error = sooptcopyout(sopt, &optval, sizeof optval);
1675 		break;
1676 
1677 	case IP_MULTICAST_IF:
1678 		if (imo == NULL || imo->imo_multicast_ifp == NULL)
1679 			addr.s_addr = INADDR_ANY;
1680 		else {
1681 			IFP_TO_IA(imo->imo_multicast_ifp, ia);
1682 			addr.s_addr = (ia == NULL) ? INADDR_ANY
1683 				: IA_SIN(ia)->sin_addr.s_addr;
1684 		}
1685 		error = sooptcopyout(sopt, &addr, sizeof addr);
1686 		break;
1687 
1688 	case IP_MULTICAST_TTL:
1689 		if (imo == 0)
1690 			optval = coptval = IP_DEFAULT_MULTICAST_TTL;
1691 		else
1692 			optval = coptval = imo->imo_multicast_ttl;
1693 		if (sopt->sopt_valsize == 1)
1694 			error = sooptcopyout(sopt, &coptval, 1);
1695 		else
1696 			error = sooptcopyout(sopt, &optval, sizeof optval);
1697 		break;
1698 
1699 	case IP_MULTICAST_LOOP:
1700 		if (imo == 0)
1701 			optval = coptval = IP_DEFAULT_MULTICAST_LOOP;
1702 		else
1703 			optval = coptval = imo->imo_multicast_loop;
1704 		if (sopt->sopt_valsize == 1)
1705 			error = sooptcopyout(sopt, &coptval, 1);
1706 		else
1707 			error = sooptcopyout(sopt, &optval, sizeof optval);
1708 		break;
1709 
1710 	default:
1711 		error = ENOPROTOOPT;
1712 		break;
1713 	}
1714 	return (error);
1715 }
1716 
1717 /*
1718  * Discard the IP multicast options.
1719  */
1720 void
1721 ip_freemoptions(imo)
1722 	register struct ip_moptions *imo;
1723 {
1724 	register int i;
1725 
1726 	if (imo != NULL) {
1727 		for (i = 0; i < imo->imo_num_memberships; ++i)
1728 			in_delmulti(imo->imo_membership[i]);
1729 		free(imo, M_IPMOPTS);
1730 	}
1731 }
1732 
1733 /*
1734  * Routine called from ip_output() to loop back a copy of an IP multicast
1735  * packet to the input queue of a specified interface.  Note that this
1736  * calls the output routine of the loopback "driver", but with an interface
1737  * pointer that might NOT be a loopback interface -- evil, but easier than
1738  * replicating that code here.
1739  */
1740 static void
1741 ip_mloopback(ifp, m, dst, hlen)
1742 	struct ifnet *ifp;
1743 	register struct mbuf *m;
1744 	register struct sockaddr_in *dst;
1745 	int hlen;
1746 {
1747 	register struct ip *ip;
1748 	struct mbuf *copym;
1749 
1750 	copym = m_copy(m, 0, M_COPYALL);
1751 	if (copym != NULL && (copym->m_flags & M_EXT || copym->m_len < hlen))
1752 		copym = m_pullup(copym, hlen);
1753 	if (copym != NULL) {
1754 		/*
1755 		 * We don't bother to fragment if the IP length is greater
1756 		 * than the interface's MTU.  Can this possibly matter?
1757 		 */
1758 		ip = mtod(copym, struct ip *);
1759 		ip->ip_len = htons((u_short)ip->ip_len);
1760 		ip->ip_off = htons((u_short)ip->ip_off);
1761 		ip->ip_sum = 0;
1762 		if (ip->ip_vhl == IP_VHL_BORING) {
1763 			ip->ip_sum = in_cksum_hdr(ip);
1764 		} else {
1765 			ip->ip_sum = in_cksum(copym, hlen);
1766 		}
1767 		/*
1768 		 * NB:
1769 		 * It's not clear whether there are any lingering
1770 		 * reentrancy problems in other areas which might
1771 		 * be exposed by using ip_input directly (in
1772 		 * particular, everything which modifies the packet
1773 		 * in-place).  Yet another option is using the
1774 		 * protosw directly to deliver the looped back
1775 		 * packet.  For the moment, we'll err on the side
1776 		 * of safety by using if_simloop().
1777 		 */
1778 #if 1 /* XXX */
1779 		if (dst->sin_family != AF_INET) {
1780 			printf("ip_mloopback: bad address family %d\n",
1781 						dst->sin_family);
1782 			dst->sin_family = AF_INET;
1783 		}
1784 #endif
1785 
1786 #ifdef notdef
1787 		copym->m_pkthdr.rcvif = ifp;
1788 		ip_input(copym);
1789 #else
1790 		if_simloop(ifp, copym, (struct sockaddr *)dst, 0);
1791 #endif
1792 	}
1793 }
1794