ip->ip_len = htons(ntohs(ip->ip_len) + hlen);
ipv4_input(m)	struct mbuf *m;{	register struct ip *ip;	register struct ipq *fp;	struct in_ifaddr *ia;	struct ipqent *ipqe;	int hlen, mff, len;	in_addr_t pfrdr = 0;#ifdef IPSEC	int error, s;	struct tdb *tdb;	struct tdb_ident *tdbi;	struct m_tag *mtag;#endif /* IPSEC */	/*	 * If no IP addresses have been set yet but the interfaces	 * are receiving, can't do anything with incoming packets yet.	 */	if (in_ifaddr.tqh_first == 0)		goto bad;	ipstat.ips_total++;	if (m->m_len < sizeof (struct ip) &&	    (m = m_pullup(m, sizeof (struct ip))) == NULL) {		ipstat.ips_toosmall++;		return;	}	ip = mtod(m, struct ip *);	if (ip->ip_v != IPVERSION) {		ipstat.ips_badvers++;		goto bad;	}	hlen = ip->ip_hl << 2;	if (hlen < sizeof(struct ip)) {	/* minimum header length */		ipstat.ips_badhlen++;		goto bad;	}	if (hlen > m->m_len) {		if ((m = m_pullup(m, hlen)) == NULL) {			ipstat.ips_badhlen++;			return;		}		ip = mtod(m, struct ip *);	}	/* 127/8 must not appear on wire - RFC1122 */	if ((ntohl(ip->ip_dst.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET ||	    (ntohl(ip->ip_src.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET) {		if ((m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) == 0) {			ipstat.ips_badaddr++;			goto bad;		}	}	if ((m->m_pkthdr.csum & M_IPV4_CSUM_IN_OK) == 0) {		if (m->m_pkthdr.csum & M_IPV4_CSUM_IN_BAD) {			ipstat.ips_inhwcsum++;			ipstat.ips_badsum++;			goto bad;		}		if (in_cksum(m, hlen) != 0) {			ipstat.ips_badsum++;			goto bad;		}	} else {		m->m_pkthdr.csum &= ~M_IPV4_CSUM_IN_OK;		ipstat.ips_inhwcsum++;	}	/* Retrieve the packet lenght. */	len = ntohs(ip->ip_len);	/*	 * Convert fields to host representation.	 */	if (len < hlen) {		ipstat.ips_badlen++;		goto bad;	}	/*	 * Check that the amount of data in the buffers	 * is at least as much as the IP header would have us expect.	 * Trim mbufs if longer than we expect.	 * Drop packet if shorter than we expect.	 */	if (m->m_pkthdr.len < len) {		ipstat.ips_tooshort++;		goto bad;	}	if (m->m_pkthdr.len > len) {		if (m->m_len == m->m_pkthdr.len) {			m->m_len = len;			m->m_pkthdr.len = len;		} else			m_adj(m, len - m->m_pkthdr.len);	}#if NPF > 0	/*	 * Packet filter	 */	pfrdr = ip->ip_dst.s_addr;	if (pf_test(PF_IN, m->m_pkthdr.rcvif, &m) != PF_PASS)		goto bad;	if (m == NULL)		return;	ip = mtod(m, struct ip *);	hlen = ip->ip_hl << 2;	pfrdr = (pfrdr != ip->ip_dst.s_addr);#endif	/*	 * Process options and, if not destined for us,	 * ship it on.  ip_dooptions returns 1 when an	 * error was detected (causing an icmp message	 * to be sent and the original packet to be freed).	 */	ip_nhops = 0;		/* for source routed packets */	if (hlen > sizeof (struct ip) && ip_dooptions(m)) {	        return;	}	/*	 * Check our list of addresses, to see if the packet is for us.	 */	if ((ia = in_iawithaddr(ip->ip_dst, m)) != NULL &&	    (ia->ia_ifp->if_flags & IFF_UP))		goto ours;	if (IN_MULTICAST(ip->ip_dst.s_addr)) {		struct in_multi *inm;#ifdef MROUTING		extern struct socket *ip_mrouter;		if (m->m_flags & M_EXT) {			if ((m = m_pullup(m, hlen)) == NULL) {				ipstat.ips_toosmall++;				return;			}			ip = mtod(m, struct ip *);		}		if (ip_mrouter) {			/*			 * If we are acting as a multicast router, all			 * incoming multicast packets are passed to the			 * kernel-level multicast forwarding function.			 * The packet is returned (relatively) intact; if			 * ip_mforward() returns a non-zero value, the packet			 * must be discarded, else it may be accepted below.			 *			 * (The IP ident field is put in the same byte order			 * as expected when ip_mforward() is called from			 * ip_output().)			 */			if (ip_mforward(m, m->m_pkthdr.rcvif) != 0) {				ipstat.ips_cantforward++;				m_freem(m);				return;			}			/*			 * The process-level routing demon needs to receive			 * all multicast IGMP packets, whether or not this			 * host belongs to their destination groups.			 */			if (ip->ip_p == IPPROTO_IGMP)				goto ours;			ipstat.ips_forward++;		}#endif		/*		 * See if we belong to the destination multicast group on the		 * arrival interface.		 */		IN_LOOKUP_MULTI(ip->ip_dst, m->m_pkthdr.rcvif, inm);		if (inm == NULL) {			ipstat.ips_cantforward++;			m_freem(m);			return;		}		goto ours;	}	if (ip->ip_dst.s_addr == INADDR_BROADCAST ||	    ip->ip_dst.s_addr == INADDR_ANY)		goto ours;	/*	 * Not for us; forward if possible and desirable.	 */	if (ipforwarding == 0) {		ipstat.ips_cantforward++;		m_freem(m);	} else {#ifdef IPSEC	        /*		 * IPsec policy check for forwarded packets. Look at		 * inner-most IPsec SA used.		 */		mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL);                s = splnet();		if (mtag != NULL) {			tdbi = (struct tdb_ident *)(mtag + 1);			tdb = gettdb(tdbi->spi, &tdbi->dst, tdbi->proto);		} else			tdb = NULL;	        ipsp_spd_lookup(m, AF_INET, hlen, &error,		    IPSP_DIRECTION_IN, tdb, NULL);                splx(s);		/* Error or otherwise drop-packet indication */		if (error) {			ipstat.ips_cantforward++;			m_freem(m);			return;		}		/*		 * Fall through, forward packet. Outbound IPsec policy		 * checking will occur in ip_output().		 */#endif /* IPSEC */		ip_forward(m, pfrdr);	}	return;ours:	/*	 * If offset or IP_MF are set, must reassemble.	 * Otherwise, nothing need be done.	 * (We could look in the reassembly queue to see	 * if the packet was previously fragmented,	 * but it's not worth the time; just let them time out.)	 */	if (ip->ip_off &~ htons(IP_DF | IP_RF)) {		if (m->m_flags & M_EXT) {		/* XXX */			if ((m = m_pullup(m, hlen)) == NULL) {				ipstat.ips_toosmall++;				return;			}			ip = mtod(m, struct ip *);		}		/*		 * Look for queue of fragments		 * of this datagram.		 */		ipq_lock();		for (fp = ipq.lh_first; fp != NULL; fp = fp->ipq_q.le_next)			if (ip->ip_id == fp->ipq_id &&			    ip->ip_src.s_addr == fp->ipq_src.s_addr &&			    ip->ip_dst.s_addr == fp->ipq_dst.s_addr &&			    ip->ip_p == fp->ipq_p)				goto found;		fp = 0;found:		/*		 * Adjust ip_len to not reflect header,		 * set ipqe_mff if more fragments are expected,		 * convert offset of this to bytes.		 */		ip->ip_len = htons(ntohs(ip->ip_len) - hlen);		mff = (ip->ip_off & htons(IP_MF)) != 0;		if (mff) {			/*			 * Make sure that fragments have a data length			 * that's a non-zero multiple of 8 bytes.			 */			if (ntohs(ip->ip_len) == 0 ||			    (ntohs(ip->ip_len) & 0x7) != 0) {				ipstat.ips_badfrags++;				ipq_unlock();				goto bad;			}		}		ip->ip_off = htons(ntohs(ip->ip_off) << 3);		/*		 * If datagram marked as having more fragments		 * or if this is not the first fragment,		 * attempt reassembly; if it succeeds, proceed.		 */		if (mff || ip->ip_off) {			ipstat.ips_fragments++;			if (ip_frags + 1 > ip_maxqueue) {				ip_flush();				ipstat.ips_rcvmemdrop++;				ipq_unlock();				goto bad;			}			ipqe = pool_get(&ipqent_pool, PR_NOWAIT);			if (ipqe == NULL) {				ipstat.ips_rcvmemdrop++;				ipq_unlock();				goto bad;			}			ip_frags++;			ipqe->ipqe_mff = mff;			ipqe->ipqe_m = m;			ipqe->ipqe_ip = ip;			m = ip_reass(ipqe, fp);			if (m == 0) {				ipq_unlock();				return;			}			ipstat.ips_reassembled++;			ip = mtod(m, struct ip *);			hlen = ip->ip_hl << 2;		} else			if (fp)				ip_freef(fp);		ipq_unlock();	}#ifdef IPSEC        /*         * If it's a protected packet for us, skip the policy check.         * That's because we really only care about the properties of         * the protected packet, and not the intermediate versions.         * While this is not the most paranoid setting, it allows         * some flexibility in handling nested tunnels (in setting up	 * the policies).         */        if ((ip->ip_p == IPPROTO_ESP) || (ip->ip_p == IPPROTO_AH) ||	    (ip->ip_p == IPPROTO_IPCOMP))          goto skipipsec;	/*	 * If the protected packet was tunneled, then we need to	 * verify the protected packet's information, not the	 * external headers. Thus, skip the policy lookup for the	 * external packet, and keep the IPsec information linked on	 * the packet header (the encapsulation routines know how	 * to deal with that).	 */	if ((ip->ip_p == IPPROTO_IPIP) || (ip->ip_p == IPPROTO_IPV6))	  goto skipipsec;	/*	 * If the protected packet is TCP or UDP, we'll do the	 * policy check in the respective input routine, so we can	 * check for bypass sockets.	 */	if ((ip->ip_p == IPPROTO_TCP) || (ip->ip_p == IPPROTO_UDP))	  goto skipipsec;	/*	 * IPsec policy check for local-delivery packets. Look at the	 * inner-most SA that protected the packet. This is in fact	 * a bit too restrictive (it could end up causing packets to	 * be dropped that semantically follow the policy, e.g., in	 * certain SA-bundle configurations); but the alternative is	 * very complicated (and requires keeping track of what	 * kinds of tunneling headers have been seen in-between the	 * IPsec headers), and I don't think we lose much functionality	 * that's needed in the real world (who uses bundles anyway ?).	 */	mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL);        s = splnet();	if (mtag) {		tdbi = (struct tdb_ident *)(mtag + 1);	        tdb = gettdb(tdbi->spi, &tdbi->dst, tdbi->proto);	} else		tdb = NULL;	ipsp_spd_lookup(m, AF_INET, hlen, &error, IPSP_DIRECTION_IN,	    tdb, NULL);        splx(s);	/* Error or otherwise drop-packet indication. */	if (error) {	        ipstat.ips_cantforward++;		m_freem(m);		return;	} skipipsec:	/* Otherwise, just fall through and deliver the packet */#endif /* IPSEC */	/*	 * Switch out to protocol's input routine.	 */	ipstat.ips_delivered++;	(*inetsw[ip_protox[ip->ip_p]].pr_input)(m, hlen, NULL, 0);	return;bad:	m_freem(m);}