if (ip->ip_src.s_addr == INADDR_ANY) ip->ip_src = ia->ia_addr.sin_addr;
ip->ip_src = ia->ia_addr.sin_addr;
static struct mbuf *ip_insertoptions __P((struct mbuf *, struct mbuf *, int *));static void ip_mloopback	__P((struct ifnet *, struct mbuf *, struct sockaddr_in *));#if defined(IPFILTER) || defined(IPFILTER_LKM)int (*fr_checkp) __P((struct ip *, int, struct ifnet *, int, struct mbuf **));#endif/* * IP output.  The packet in mbuf chain m contains a skeletal IP * header (with len, off, ttl, proto, tos, src, dst). * The mbuf chain containing the packet will be freed. * The mbuf opt, if present, will not be freed. */int#if __STDC__ip_output(struct mbuf *m0, ...)#elseip_output(m0, va_alist)	struct mbuf *m0;	va_dcl#endif{	register struct ip *ip, *mhip;	register struct ifnet *ifp;	register struct mbuf *m = m0;	register int hlen = sizeof (struct ip);	int len, off, error = 0;	struct route iproute;	struct sockaddr_in *dst;	struct in_ifaddr *ia;	struct mbuf *opt;	struct route *ro;	int flags;	struct ip_moptions *imo;	va_list ap;	u_int8_t sproto = 0, donerouting = 0;#ifdef IPSEC	union sockaddr_union sdst;	u_int32_t sspi;	u_int8_t sa_require = 0, sa_have = 0;	struct inpcb *inp;	struct tdb *tdb;	int s;#endif /* IPSEC */	va_start(ap, m0);	opt = va_arg(ap, struct mbuf *);	ro = va_arg(ap, struct route *);	flags = va_arg(ap, int);	imo = va_arg(ap, struct ip_moptions *);#ifdef IPSEC	inp = va_arg(ap, struct inpcb *);	if (inp && (inp->inp_flags & INP_IPV6) != 0)		panic("ip_output: IPv6 pcb is passed");#endif /* IPSEC */	va_end(ap);#ifdef	DIAGNOSTIC	if ((m->m_flags & M_PKTHDR) == 0)		panic("ip_output no HDR");#endif	if (opt) {		m = ip_insertoptions(m, opt, &len);		hlen = len;	}	ip = mtod(m, struct ip *);	/*	 * Fill in IP header.	 */	if ((flags & (IP_FORWARDING|IP_RAWOUTPUT)) == 0) {		ip->ip_v = IPVERSION;		ip->ip_off &= IP_DF;		ip->ip_id = ip_randomid();		HTONS(ip->ip_id);		ip->ip_hl = hlen >> 2;		ipstat.ips_localout++;	} else {		hlen = ip->ip_hl << 2;	}#ifdef IPSEC	s = splnet();	/*	 * If the higher-level protocol has cached the SA to use, we	 * can avoid the routing lookup if the source address is zero.	 */	if (inp != NULL && inp->inp_tdb != NULL &&	    ip->ip_src.s_addr == INADDR_ANY &&	    tdb->tdb_src.sa.sa_family == AF_INET &&	    tdb->tdb_src.sin.sin_addr.s_addr != INADDR_ANY) {	        ip->ip_src.s_addr = tdb->tdb_src.sin.sin_addr.s_addr;		splx(s);		goto skip_routing;	}	splx(s);#endif /* IPSEC */	/*	 * If we're missing the IP source address, do a route lookup. We'll	 * remember this result, in case we don't need to do any IPsec	 * processing on the packet. We need the source address so we can	 * do an SPD lookup in IPsec; for most packets, the source address	 * is set at a higher level protocol. ICMPs and other packets	 * though (e.g., traceroute) have a source address of zeroes.	 */	if (ip->ip_src.s_addr == INADDR_ANY) {	        donerouting = 1;	        if (ro == 0) {		        ro = &iproute;			bzero((caddr_t)ro, sizeof (*ro));		}		dst = satosin(&ro->ro_dst);		/*		 * If there is a cached route, check that it is to the same		 * destination and is still up.  If not, free it and try again.		 */		if (ro->ro_rt && ((ro->ro_rt->rt_flags & RTF_UP) == 0 ||				  dst->sin_addr.s_addr != ip->ip_dst.s_addr)) {		        RTFREE(ro->ro_rt);			ro->ro_rt = (struct rtentry *)0;		}		if (ro->ro_rt == 0) {		        dst->sin_family = AF_INET;			dst->sin_len = sizeof(*dst);			dst->sin_addr = ip->ip_dst;		}		/*		 * If routing to interface only, short-circuit routing lookup.		 */		if (flags & IP_ROUTETOIF) {		        if ((ia = ifatoia(ifa_ifwithdstaddr(sintosa(dst)))) == 0 &&			    (ia = ifatoia(ifa_ifwithnet(sintosa(dst)))) == 0) {			    ipstat.ips_noroute++;			    error = ENETUNREACH;			    goto bad;			}			ifp = ia->ia_ifp;			ip->ip_ttl = 1;		} else {		        if (ro->ro_rt == 0)			        rtalloc(ro);			if (ro->ro_rt == 0) {			        ipstat.ips_noroute++;				error = EHOSTUNREACH;				goto bad;			}			ia = ifatoia(ro->ro_rt->rt_ifa);			ifp = ro->ro_rt->rt_ifp;			ro->ro_rt->rt_use++;			if (ro->ro_rt->rt_flags & RTF_GATEWAY)			        dst = satosin(ro->ro_rt->rt_gateway);		}		/* Set the source IP address */                if (ip->ip_src.s_addr == INADDR_ANY)		        ip->ip_src = ia->ia_addr.sin_addr;	}#ifdef IPSEC skip_routing:	/* Disallow nested IPsec for now */	if (flags & IP_ENCAPSULATED)	  goto done_spd;	/*	 * splnet is chosen over spltdb because we are not allowed to	 * lower the level, and udp_output calls us in splnet().	 */	s = splnet();	/*	 * Check if there was an outgoing SA bound to the flow	 * from a transport protocol.	 */	if (inp && inp->inp_tdb &&	    inp->inp_tdb->tdb_dst.sa.sa_family == AF_INET &&	    !bcmp(&inp->inp_tdb->tdb_dst.sin.sin_addr,		  &ip->ip_dst, sizeof(ip->ip_dst)))	        tdb = inp->inp_tdb;	else	        tdb = ipsp_spd_lookup(m, AF_INET, hlen, &error);	if (tdb == NULL) {	        splx(s);		if (error == 0) {		        /*			 * No IPsec processing required, we'll just send the			 * packet out.			 */		        sproto = 0;			/* Fall through to routing/multicast handling */		} else {		        /*			 * -EINVAL is used to indicate that the packet should			 * be silently dropped, typically because we've asked			 * key management for an SA.			 */		        if (error == -EINVAL) /* Should silently drop packet */			  error = 0;			m_freem(m);			goto done;		}	} else {	        /* We need to do IPsec */	        bcopy(&tdb->tdb_dst, &sdst, sizeof(sdst));		sspi = tdb->tdb_spi;		sproto = tdb->tdb_sproto;		/*		 * If the socket has set the bypass flags and SA destination		 * matches the IP destination, skip IPsec. This allows		 * IKE packets to travel through IPsec tunnels.		 */		if (inp != NULL && 		    inp->inp_seclevel[SL_AUTH] == IPSEC_LEVEL_BYPASS &&		    inp->inp_seclevel[SL_ESP_TRANS] == IPSEC_LEVEL_BYPASS &&		    inp->inp_seclevel[SL_ESP_NETWORK] == IPSEC_LEVEL_BYPASS &&		    sdst.sa.sa_family == AF_INET &&		    !bcmp(&sdst.sin.sin_addr.s_addr, &ip->ip_dst.s_addr,			  sizeof(ip->ip_dst.s_addr))) {		        splx(s);		        sproto = 0; /* mark as no-IPsec-needed */			goto done_spd;		}		/* What are the socket (or default) security requirements ? */		if (inp == NULL)		        sa_require = get_sa_require(NULL);		else		        sa_require = inp->inp_secrequire;		/*		 * Now we check if this tdb has all the transforms which		 * are required by the socket or our default policy.		 */		SPI_CHAIN_ATTRIB(sa_have, tdb_onext, tdb);		splx(s);		if (sa_require & ~sa_have) {			error = EHOSTUNREACH;			m_freem(m);			goto done;		}		/* If it's not a multicast packet, try to fast-path */		if (!IN_MULTICAST(ip->ip_dst.s_addr)) {			goto sendit;		}	}	/* Fall through to the routing/multicast handling code */ done_spd:#endif /* IPSEC */	if (donerouting == 0) {	        if (ro == 0) {		        ro = &iproute;			bzero((caddr_t)ro, sizeof (*ro));		}		dst = satosin(&ro->ro_dst);		/*		 * If there is a cached route, check that it is to the same		 * destination and is still up.  If not, free it and try again.		 */		if (ro->ro_rt && ((ro->ro_rt->rt_flags & RTF_UP) == 0 ||				  dst->sin_addr.s_addr != ip->ip_dst.s_addr)) {		        RTFREE(ro->ro_rt);			ro->ro_rt = (struct rtentry *)0;		}		if (ro->ro_rt == 0) {		        dst->sin_family = AF_INET;			dst->sin_len = sizeof(*dst);			dst->sin_addr = ip->ip_dst;		}		/*		 * If routing to interface only, short-circuit routing lookup.		 */		if (flags & IP_ROUTETOIF) {		        if ((ia = ifatoia(ifa_ifwithdstaddr(sintosa(dst)))) == 0 &&			    (ia = ifatoia(ifa_ifwithnet(sintosa(dst)))) == 0) {			    ipstat.ips_noroute++;			    error = ENETUNREACH;			    goto bad;			}			ifp = ia->ia_ifp;			ip->ip_ttl = 1;		} else {		        if (ro->ro_rt == 0)			        rtalloc(ro);			if (ro->ro_rt == 0) {			        ipstat.ips_noroute++;				error = EHOSTUNREACH;				goto bad;			}			ia = ifatoia(ro->ro_rt->rt_ifa);			ifp = ro->ro_rt->rt_ifp;			ro->ro_rt->rt_use++;			if (ro->ro_rt->rt_flags & RTF_GATEWAY)			        dst = satosin(ro->ro_rt->rt_gateway);		}		/* Set the source IP address */		ip->ip_src = ia->ia_addr.sin_addr;	}	if (IN_MULTICAST(ip->ip_dst.s_addr)) {		struct in_multi *inm;		m->m_flags |= M_MCAST;		/*		 * IP destination address is multicast.  Make sure "dst"		 * still points to the address in "ro".  (It may have been		 * changed to point to a gateway address, above.)		 */		dst = satosin(&ro->ro_dst);		/*		 * See if the caller provided any multicast options		 */		if (imo != NULL) {			ip->ip_ttl = imo->imo_multicast_ttl;			if (imo->imo_multicast_ifp != NULL)				ifp = imo->imo_multicast_ifp;		} else			ip->ip_ttl = IP_DEFAULT_MULTICAST_TTL;		/*		 * Confirm that the outgoing interface supports multicast,		 * but only if the packet actually is going out on that		 * interface (i.e., no IPsec is applied).		 */		if (((ifp->if_flags & IFF_MULTICAST) == 0) && (sproto == 0)) {			ipstat.ips_noroute++;			error = ENETUNREACH;			goto bad;		}		/*		 * If source address not specified yet, use address		 * of outgoing interface.		 */		if (ip->ip_src.s_addr == INADDR_ANY) {			register struct in_ifaddr *ia;			for (ia = in_ifaddr.tqh_first;			     ia;			     ia = ia->ia_list.tqe_next)				if (ia->ia_ifp == ifp) {					ip->ip_src = ia->ia_addr.sin_addr;					break;				}		}		IN_LOOKUP_MULTI(ip->ip_dst, ifp, inm);		if (inm != NULL &&		   (imo == NULL || imo->imo_multicast_loop)) {			/*			 * If we belong to the destination multicast group			 * on the outgoing interface, and the caller did not			 * forbid loopback, loop back a copy.			 */			ip_mloopback(ifp, m, dst);		}#ifdef MROUTING		else {			/*			 * If we are acting as a multicast router, perform			 * multicast forwarding as if the packet had just			 * arrived on the interface to which we are about			 * to send.  The multicast forwarding function			 * recursively calls this function, using the			 * IP_FORWARDING flag to prevent infinite recursion.			 *			 * Multicasts that are looped back by ip_mloopback(),			 * above, will be forwarded by the ip_input() routine,			 * if necessary.			 */			extern struct socket *ip_mrouter;			if (ip_mrouter && (flags & IP_FORWARDING) == 0) {				if (ip_mforward(m, ifp) != 0) {					m_freem(m);					goto done;				}			}		}#endif		/*		 * Multicasts with a time-to-live of zero may be looped-		 * back, above, but must not be transmitted on a network.		 * Also, multicasts addressed to the loopback interface		 * are not sent -- the above call to ip_mloopback() will		 * loop back a copy if this host actually belongs to the		 * destination group on the loopback interface.		 */		if (ip->ip_ttl == 0 || (ifp->if_flags & IFF_LOOPBACK) != 0) {			m_freem(m);			goto done;		}		goto sendit;	}	/*	 * Look for broadcast address and and verify user is allowed to send	 * such a packet; if the packet is going in an IPsec tunnel, skip	 * this check.	 */	if ((sproto == 0) && (in_broadcast(dst->sin_addr, ifp))) {		if ((ifp->if_flags & IFF_BROADCAST) == 0) {			error = EADDRNOTAVAIL;			goto bad;		}		if ((flags & IP_ALLOWBROADCAST) == 0) {			error = EACCES;			goto bad;		}		/* Don't allow broadcast messages to be fragmented */		if ((u_int16_t)ip->ip_len > ifp->if_mtu) {			error = EMSGSIZE;			goto bad;		}		m->m_flags |= M_BCAST;	} else		m->m_flags &= ~M_BCAST;sendit:#ifdef IPSEC	/*	 * Check if the packet needs encapsulation.	 */	if (sproto != 0) {	        s = splnet();		tdb = gettdb(sspi, &sdst, sproto);		if (tdb == NULL) {			error = EHOSTUNREACH;			m_freem(m);			goto done;		}		/* Massage the IP header for use by the IPsec code */		ip->ip_len = htons((u_short) ip->ip_len);		ip->ip_off = htons((u_short) ip->ip_off);		ip->ip_sum = 0;		/*		 * Clear these -- they'll be set in the recursive invocation		 * as needed.		 */		m->m_flags &= ~(M_MCAST | M_BCAST);		/* Callee frees mbuf */		error = ipsp_process_packet(m, tdb, AF_INET, 0);		splx(s);		return error;  /* Nothing more to be done */	}#endif /* IPSEC */#if defined(IPFILTER) || defined(IPFILTER_LKM)	/*	 * looks like most checking has been done now...do a filter check	 */	{		struct mbuf *m0 = m;		if (fr_checkp && (*fr_checkp)(ip, hlen, ifp, 1, &m0)) {			error = EHOSTUNREACH;			goto done;		} else			ip = mtod(m = m0, struct ip *);	}#endif	/*	 * If small enough for interface, can just send directly.	 */	if ((u_int16_t)ip->ip_len <= ifp->if_mtu) {		ip->ip_len = htons((u_int16_t)ip->ip_len);		ip->ip_off = htons((u_int16_t)ip->ip_off);		ip->ip_sum = 0;		ip->ip_sum = in_cksum(m, hlen);		error = (*ifp->if_output)(ifp, m, sintosa(dst), ro->ro_rt);		goto done;	}	/*	 * Too large for interface; fragment if possible.	 * Must be able to put at least 8 bytes per fragment.	 */	if (ip->ip_off & IP_DF) {		error = EMSGSIZE;		ipstat.ips_cantfrag++;		goto bad;	}	len = (ifp->if_mtu - hlen) &~ 7;	if (len < 8) {		error = EMSGSIZE;		goto bad;	}    {	int mhlen, firstlen = len;	struct mbuf **mnext = &m->m_nextpkt;	/*	 * Loop through length of segment after first fragment,	 * make new header and copy data of each part and link onto chain.	 */	m0 = m;	mhlen = sizeof (struct ip);	for (off = hlen + len; off < (u_int16_t)ip->ip_len; off += len) {		MGETHDR(m, M_DONTWAIT, MT_HEADER);		if (m == 0) {			error = ENOBUFS;			ipstat.ips_odropped++;			goto sendorfree;		}		*mnext = m;		mnext = &m->m_nextpkt;		m->m_data += max_linkhdr;		mhip = mtod(m, struct ip *);		*mhip = *ip;		/* we must inherit MCAST and BCAST flags */		m->m_flags |= m0->m_flags & (M_MCAST|M_BCAST);		if (hlen > sizeof (struct ip)) {			mhlen = ip_optcopy(ip, mhip) + sizeof (struct ip);			mhip->ip_hl = mhlen >> 2;		}		m->m_len = mhlen;		mhip->ip_off = ((off - hlen) >> 3) + (ip->ip_off & ~IP_MF);		if (ip->ip_off & IP_MF)			mhip->ip_off |= IP_MF;		if (off + len >= (u_int16_t)ip->ip_len)			len = (u_int16_t)ip->ip_len - off;		else			mhip->ip_off |= IP_MF;		mhip->ip_len = htons((u_int16_t)(len + mhlen));		m->m_next = m_copy(m0, off, len);		if (m->m_next == 0) {			error = ENOBUFS;	/* ??? */			ipstat.ips_odropped++;			goto sendorfree;		}		m->m_pkthdr.len = mhlen + len;		m->m_pkthdr.rcvif = (struct ifnet *)0;		mhip->ip_off = htons((u_int16_t)mhip->ip_off);		mhip->ip_sum = 0;		mhip->ip_sum = in_cksum(m, mhlen);		ipstat.ips_ofragments++;	}	/*	 * Update first fragment by trimming what's been copied out	 * and updating header, then send each fragment (in order).	 */	m = m0;	m_adj(m, hlen + firstlen - (u_int16_t)ip->ip_len);	m->m_pkthdr.len = hlen + firstlen;	ip->ip_len = htons((u_int16_t)m->m_pkthdr.len);	ip->ip_off = htons((u_int16_t)(ip->ip_off | IP_MF));	ip->ip_sum = 0;	ip->ip_sum = in_cksum(m, hlen);sendorfree:	for (m = m0; m; m = m0) {		m0 = m->m_nextpkt;		m->m_nextpkt = 0;		if (error == 0)			error = (*ifp->if_output)(ifp, m, sintosa(dst),			    ro->ro_rt);		else			m_freem(m);	}	if (error == 0)		ipstat.ips_fragmented++;    }done:	if (ro == &iproute && (flags & IP_ROUTETOIF) == 0 && ro->ro_rt)		RTFREE(ro->ro_rt);	return (error);bad:	m_freem(m0);	goto done;}/* * Insert IP options into preformed packet. * Adjust IP destination as required for IP source routing, * as indicated by a non-zero in_addr at the start of the options. */static struct mbuf *ip_insertoptions(m, opt, phlen)	register struct mbuf *m;	struct mbuf *opt;	int *phlen;{	register struct ipoption *p = mtod(opt, struct ipoption *);	struct mbuf *n;	register struct ip *ip = mtod(m, struct ip *);	unsigned optlen;	optlen = opt->m_len - sizeof(p->ipopt_dst);	if (optlen + (u_int16_t)ip->ip_len > IP_MAXPACKET)		return (m);		/* XXX should fail */	if (p->ipopt_dst.s_addr)		ip->ip_dst = p->ipopt_dst;	if (m->m_flags & M_EXT || m->m_data - optlen < m->m_pktdat) {		MGETHDR(n, M_DONTWAIT, MT_HEADER);		if (n == 0)			return (m);		n->m_pkthdr.len = m->m_pkthdr.len + optlen;		m->m_len -= sizeof(struct ip);		m->m_data += sizeof(struct ip);		n->m_next = m;		m = n;		m->m_len = optlen + sizeof(struct ip);		m->m_data += max_linkhdr;		bcopy((caddr_t)ip, mtod(m, caddr_t), sizeof(struct ip));	} else {		m->m_data -= optlen;		m->m_len += optlen;		m->m_pkthdr.len += optlen;		ovbcopy((caddr_t)ip, mtod(m, caddr_t), sizeof(struct ip));	}	ip = mtod(m, struct ip *);	bcopy((caddr_t)p->ipopt_list, (caddr_t)(ip + 1), (unsigned)optlen);	*phlen = sizeof(struct ip) + optlen;	ip->ip_len += optlen;	return (m);}