if (m->m_len < hlen + 2 * sizeof(u_int16_t)) { if ((m = m_pullup(m, hlen + 2 * sizeof(u_int16_t))) == 0) return ENOBUFS; ip = mtod(m, struct ip *); }
static struct mbuf *ip_insertoptions __P((struct mbuf *, struct mbuf *, int *));static void ip_mloopback	__P((struct ifnet *, struct mbuf *, struct sockaddr_in *));#if defined(IPFILTER) || defined(IPFILTER_LKM)int (*fr_checkp) __P((struct ip *, int, struct ifnet *, int, struct mbuf **));#endif/* * IP output.  The packet in mbuf chain m contains a skeletal IP * header (with len, off, ttl, proto, tos, src, dst). * The mbuf chain containing the packet will be freed. * The mbuf opt, if present, will not be freed. */int#if __STDC__ip_output(struct mbuf *m0, ...)#elseip_output(m0, va_alist)	struct mbuf *m0;	va_dcl#endif{	register struct ip *ip, *mhip;	register struct ifnet *ifp;	register struct mbuf *m = m0;	register int hlen = sizeof (struct ip);	int len, off, error = 0;	struct route iproute;	struct sockaddr_in *dst;	struct in_ifaddr *ia;	struct mbuf *opt;	struct route *ro;	int flags;	struct ip_moptions *imo;	va_list ap;#ifdef IPSEC	struct mbuf *mp;        struct udphdr *udp;        struct tcphdr *tcp;	struct expiration *exp;#endif	va_start(ap, m0);	opt = va_arg(ap, struct mbuf *);	ro = va_arg(ap, struct route *);	flags = va_arg(ap, int);	imo = va_arg(ap, struct ip_moptions *);	va_end(ap);#ifdef	DIAGNOSTIC	if ((m->m_flags & M_PKTHDR) == 0)		panic("ip_output no HDR");#endif	if (opt) {		m = ip_insertoptions(m, opt, &len);		hlen = len;	}	ip = mtod(m, struct ip *);	/*	 * Fill in IP header.	 */	if ((flags & (IP_FORWARDING|IP_RAWOUTPUT)) == 0) {		ip->ip_v = IPVERSION;		ip->ip_off &= IP_DF;		ip->ip_id = htons(ip_id++);		ip->ip_hl = hlen >> 2;		ipstat.ips_localout++;	} else {		hlen = ip->ip_hl << 2;	}#ifdef IPSEC	/*	 * Check if the packet needs encapsulation	 */	if (!(flags & IP_ENCAPSULATED)) {		struct route_enc {			struct	rtentry *re_rt;			struct	sockaddr_encap re_dst;		} re0, *re = &re0;		struct sockaddr_encap *dst, *gw;		struct tdb *tdb;		bzero((caddr_t) re, sizeof(*re));		dst = (struct sockaddr_encap *) &re->re_dst;		dst->sen_family = AF_ENCAP;		dst->sen_len = SENT_IP4_LEN;		dst->sen_type = SENT_IP4;		dst->sen_ip_src = ip->ip_src;		dst->sen_ip_dst = ip->ip_dst;		dst->sen_proto = ip->ip_p;		if (m->m_len < hlen + 2 * sizeof(u_int16_t)) {		    if ((m = m_pullup(m, hlen + 2 * sizeof(u_int16_t))) == 0)			goto bad;		    ip = mtod(m, struct ip *);		}		switch (ip->ip_p) {		case IPPROTO_UDP:			udp = (struct udphdr *) (mtod(m, u_char *) + hlen);			dst->sen_sport = ntohs(udp->uh_sport);			dst->sen_dport = ntohs(udp->uh_dport);			break;		case IPPROTO_TCP:			tcp = (struct tcphdr *) (mtod(m, u_char *) + hlen);			dst->sen_sport = ntohs(tcp->th_sport);			dst->sen_dport = ntohs(tcp->th_dport);			break;		default:			dst->sen_sport = 0;			dst->sen_dport = 0;		}		rtalloc((struct route *) re);		if (re->re_rt == NULL)			goto no_encap;		gw = (struct sockaddr_encap *) (re->re_rt->rt_gateway);		/*		 * There might be a specific route, that tells us to avoid		 * doing IPsec; this is useful for specific routes that we		 * don't want to have IPsec applied on.		 */		if ((gw != NULL) && (gw->sen_ipsp_dst.s_addr == 0) &&		    (gw->sen_ipsp_sproto == 0) && (gw->sen_ipsp_spi == 0))			goto no_encap;		if (gw == NULL || gw->sen_type != SENT_IPSP) {#ifdef ENCDEBUG			if (encdebug)				printf("ip_output(): no gw or gw data not IPSP\n");#endif /* ENCDEBUG */			RTFREE(re->re_rt);			error = EHOSTUNREACH;			goto bad;		}		ip->ip_len = htons((u_short)ip->ip_len);		ip->ip_off = htons((u_short)ip->ip_off);		ip->ip_sum = 0;		/*		 * At this point we have an IPSP "gateway" (tunnel) spec.		 * Use the destination of the tunnel and the SPI to		 * look up the necessary Tunnel Control Block. Look it up,		 * and then pass it, along with the packet and the gw,		 * to the appropriate transformation.		 */		tdb = (struct tdb *) gettdb(gw->sen_ipsp_spi, gw->sen_ipsp_dst,					    gw->sen_ipsp_sproto);#ifdef ENCDEBUG		if (encdebug && (tdb == NULL))		  printf("ip_output(): non-existant TDB for SA %08x/%x/%d\n",			 ntohl(gw->sen_ipsp_spi), gw->sen_ipsp_dst,			 gw->sen_ipsp_sproto);#endif ENCDEBUG		/* Fix the ip_src field if necessary */		if ((ip->ip_src.s_addr == INADDR_ANY) && tdb)		 	ip->ip_src = tdb->tdb_src;		/* Now fix the checksum */		ip->ip_sum = in_cksum(m, hlen);#ifdef ENCDEBUG		if (encdebug)			printf("ip_output(): tdb=%08x, tdb->tdb_xform=0x%x, tdb->tdb_xform->xf_output=%x, sproto=%x\n", tdb, tdb->tdb_xform, tdb->tdb_xform->xf_output, tdb->tdb_sproto);#endif /* ENCDEBUG */		while (tdb && tdb->tdb_xform) {			m0 = NULL;			/* Check if the SPI is invalid */			if (tdb->tdb_flags & TDBF_INVALID) {				log(LOG_ALERT, "ip_output(): attempt to use invalid SA %08x/%x/%x", ntohl(tdb->tdb_spi), tdb->tdb_dst, tdb->tdb_sproto);				m_freem(m);				RTFREE(re->re_rt);				return ENXIO;			}			/* Check for tunneling */			if (tdb->tdb_flags & TDBF_TUNNELING) {#ifdef ENCDEBUG			        if (encdebug)			                printf("ip_output(): tunneling\n");#endif /* ENCDEBUG */				/* 				 * Register first use, 				 * setup expiration timer 				 */				if (tdb->tdb_first_use == 0) {				    tdb->tdb_first_use = time.tv_sec;				    				    if (tdb->tdb_flags & TDBF_FIRSTUSE) {					exp = get_expiration();					if (exp == (struct expiration *) NULL) {					    log(LOG_WARNING, "ip_output(): out of memory for expiration timer");					    m_freem(m);					    RTFREE(re->re_rt);					    return ENOBUFS;					}					exp->exp_dst.s_addr = tdb->tdb_dst.s_addr;					exp->exp_spi = tdb->tdb_spi;					exp->exp_sproto = tdb->tdb_sproto;					exp->exp_timeout = tdb->tdb_first_use + tdb->tdb_exp_first_use;					put_expiration(exp);				    }				    if ((tdb->tdb_flags & TDBF_SOFT_FIRSTUSE) &&					(tdb->tdb_soft_first_use <=					tdb->tdb_exp_first_use)) {					exp = get_expiration();					if (exp == (struct expiration *) NULL) {					    log(LOG_WARNING, "ip_output(): out of memory for expiration timer");					    m_freem(m);					    RTFREE(re->re_rt);					    return ENOBUFS;					}					exp->exp_dst.s_addr = tdb->tdb_dst.s_addr;					exp->exp_spi = tdb->tdb_spi;					exp->exp_sproto = tdb->tdb_sproto;					exp->exp_timeout = tdb->tdb_first_use + tdb->tdb_soft_first_use;										put_expiration(exp);				    }				}							    				error = ipe4_output(m, gw, tdb, &mp);				if (mp == NULL)				        error = EFAULT;				if (error) {				        RTFREE(re->re_rt);					return error;				}				m = mp;			}#ifdef ENCDEBUG			if (encdebug)				printf("ip_output(): calling %s\n",				       tdb->tdb_xform->xf_name);#endif /* ENCDEBUG */			/* Register first use, setup expiration timer */			if (tdb->tdb_first_use == 0) {			    tdb->tdb_first_use = time.tv_sec;			    			    if (tdb->tdb_flags & TDBF_FIRSTUSE) {				exp = get_expiration();				if (exp == (struct expiration *) NULL) {				    log(LOG_WARNING, "ip_output(): out of memory for expiration timer");				    m_freem(m);				    RTFREE(re->re_rt);				    return ENOBUFS;				}				exp->exp_dst.s_addr = tdb->tdb_dst.s_addr;				exp->exp_spi = tdb->tdb_spi;				exp->exp_sproto = tdb->tdb_sproto;				exp->exp_timeout = tdb->tdb_first_use + 						   tdb->tdb_exp_first_use;				put_expiration(exp);			    }			    if ((tdb->tdb_flags & TDBF_SOFT_FIRSTUSE) &&				(tdb->tdb_soft_first_use <= 				 tdb->tdb_exp_first_use)) {				exp = get_expiration();				if (exp == (struct expiration *) NULL) {				    log(LOG_WARNING, "ip_output(): out of memory for expiration timer");				    m_freem(m);				    RTFREE(re->re_rt);				    return ENOBUFS;				}				exp->exp_dst.s_addr = tdb->tdb_dst.s_addr;				exp->exp_spi = tdb->tdb_spi;				exp->exp_sproto = tdb->tdb_sproto;				exp->exp_timeout = tdb->tdb_first_use + 						   tdb->tdb_soft_first_use;								put_expiration(exp);			    }			}			error = (*(tdb->tdb_xform->xf_output))(m, gw, tdb, &mp);			if (mp == NULL)				error = EFAULT;			if (error) {				RTFREE(re->re_rt);				return error;			}			tdb = tdb->tdb_onext;			m = mp;		}		/*		 * At this point, m is pointing to an mbuf chain with the		 * processed packet. Call ourselves recursively, but		 * bypass the encap code.		 */		RTFREE(re->re_rt);		ip = mtod(m, struct ip *);		NTOHS(ip->ip_len);		NTOHS(ip->ip_off);		return ip_output(m, NULL, NULL, IP_ENCAPSULATED | IP_RAWOUTPUT,				 NULL);no_encap:		/* This is for possible future use, don't move or delete */		if (re->re_rt)			RTFREE(re->re_rt);	}#endif /* IPSEC */	/*	 * Route packet.	 */	if (ro == 0) {		ro = &iproute;		bzero((caddr_t)ro, sizeof (*ro));	}	dst = satosin(&ro->ro_dst);	/*	 * If there is a cached route,	 * check that it is to the same destination	 * and is still up.  If not, free it and try again.	 */	if (ro->ro_rt && ((ro->ro_rt->rt_flags & RTF_UP) == 0 ||	    dst->sin_addr.s_addr != ip->ip_dst.s_addr)) {		RTFREE(ro->ro_rt);		ro->ro_rt = (struct rtentry *)0;	}	if (ro->ro_rt == 0) {		dst->sin_family = AF_INET;		dst->sin_len = sizeof(*dst);		dst->sin_addr = ip->ip_dst;	}	/*	 * If routing to interface only,	 * short circuit routing lookup.	 */	if (flags & IP_ROUTETOIF) {		if ((ia = ifatoia(ifa_ifwithdstaddr(sintosa(dst)))) == 0 &&		    (ia = ifatoia(ifa_ifwithnet(sintosa(dst)))) == 0) {			ipstat.ips_noroute++;			error = ENETUNREACH;			goto bad;		}		ifp = ia->ia_ifp;		ip->ip_ttl = 1;	} else {		if (ro->ro_rt == 0)			rtalloc(ro);		if (ro->ro_rt == 0) {			ipstat.ips_noroute++;			error = EHOSTUNREACH;			goto bad;		}		ia = ifatoia(ro->ro_rt->rt_ifa);		ifp = ro->ro_rt->rt_ifp;		ro->ro_rt->rt_use++;		if (ro->ro_rt->rt_flags & RTF_GATEWAY)			dst = satosin(ro->ro_rt->rt_gateway);	}	if (IN_MULTICAST(ip->ip_dst.s_addr)) {		struct in_multi *inm;		m->m_flags |= M_MCAST;		/*		 * IP destination address is multicast.  Make sure "dst"		 * still points to the address in "ro".  (It may have been		 * changed to point to a gateway address, above.)		 */		dst = satosin(&ro->ro_dst);		/*		 * See if the caller provided any multicast options		 */		if (imo != NULL) {			ip->ip_ttl = imo->imo_multicast_ttl;			if (imo->imo_multicast_ifp != NULL)				ifp = imo->imo_multicast_ifp;		} else			ip->ip_ttl = IP_DEFAULT_MULTICAST_TTL;		/*		 * Confirm that the outgoing interface supports multicast.		 */		if ((ifp->if_flags & IFF_MULTICAST) == 0) {			ipstat.ips_noroute++;			error = ENETUNREACH;			goto bad;		}		/*		 * If source address not specified yet, use address		 * of outgoing interface.		 */		if (ip->ip_src.s_addr == INADDR_ANY) {			register struct in_ifaddr *ia;			for (ia = in_ifaddr.tqh_first; ia; ia = ia->ia_list.tqe_next)				if (ia->ia_ifp == ifp) {					ip->ip_src = ia->ia_addr.sin_addr;					break;				}		}		IN_LOOKUP_MULTI(ip->ip_dst, ifp, inm);		if (inm != NULL &&		   (imo == NULL || imo->imo_multicast_loop)) {			/*			 * If we belong to the destination multicast group			 * on the outgoing interface, and the caller did not			 * forbid loopback, loop back a copy.			 */			ip_mloopback(ifp, m, dst);		}#ifdef MROUTING		else {			/*			 * If we are acting as a multicast router, perform			 * multicast forwarding as if the packet had just			 * arrived on the interface to which we are about			 * to send.  The multicast forwarding function			 * recursively calls this function, using the			 * IP_FORWARDING flag to prevent infinite recursion.			 *			 * Multicasts that are looped back by ip_mloopback(),			 * above, will be forwarded by the ip_input() routine,			 * if necessary.			 */			extern struct socket *ip_mrouter;			if (ip_mrouter && (flags & IP_FORWARDING) == 0) {				if (ip_mforward(m, ifp) != 0) {					m_freem(m);					goto done;				}			}		}#endif		/*		 * Multicasts with a time-to-live of zero may be looped-		 * back, above, but must not be transmitted on a network.		 * Also, multicasts addressed to the loopback interface		 * are not sent -- the above call to ip_mloopback() will		 * loop back a copy if this host actually belongs to the		 * destination group on the loopback interface.		 */		if (ip->ip_ttl == 0 || (ifp->if_flags & IFF_LOOPBACK) != 0) {			m_freem(m);			goto done;		}		goto sendit;	}#ifndef notdef	/*	 * If source address not specified yet, use address	 * of outgoing interface.	 */	if (ip->ip_src.s_addr == INADDR_ANY)		ip->ip_src = ia->ia_addr.sin_addr;#endif	/*	 * Look for broadcast address and	 * and verify user is allowed to send	 * such a packet.	 */	if (in_broadcast(dst->sin_addr, ifp)) {		if ((ifp->if_flags & IFF_BROADCAST) == 0) {			error = EADDRNOTAVAIL;			goto bad;		}		if ((flags & IP_ALLOWBROADCAST) == 0) {			error = EACCES;			goto bad;		}		/* don't allow broadcast messages to be fragmented */		if ((u_int16_t)ip->ip_len > ifp->if_mtu) {			error = EMSGSIZE;			goto bad;		}		m->m_flags |= M_BCAST;	} else		m->m_flags &= ~M_BCAST;#if defined(IPFILTER) || defined(IPFILTER_LKM)	/*	 * looks like most checking has been done now...do a filter check	 */	{		struct mbuf *m0 = m;		if (fr_checkp && (*fr_checkp)(ip, hlen, ifp, 1, &m0)) {			error = EHOSTUNREACH;			goto done;		} else			ip = mtod(m = m0, struct ip *);	}#endifsendit:	/*	 * If small enough for interface, can just send directly.	 */	if ((u_int16_t)ip->ip_len <= ifp->if_mtu) {		ip->ip_len = htons((u_int16_t)ip->ip_len);		ip->ip_off = htons((u_int16_t)ip->ip_off);		ip->ip_sum = 0;		ip->ip_sum = in_cksum(m, hlen);		error = (*ifp->if_output)(ifp, m, sintosa(dst), ro->ro_rt);		goto done;	}	/*	 * Too large for interface; fragment if possible.	 * Must be able to put at least 8 bytes per fragment.	 */	if (ip->ip_off & IP_DF) {		error = EMSGSIZE;		ipstat.ips_cantfrag++;		goto bad;	}	len = (ifp->if_mtu - hlen) &~ 7;	if (len < 8) {		error = EMSGSIZE;		goto bad;	}    {	int mhlen, firstlen = len;	struct mbuf **mnext = &m->m_nextpkt;	/*	 * Loop through length of segment after first fragment,	 * make new header and copy data of each part and link onto chain.	 */	m0 = m;	mhlen = sizeof (struct ip);	for (off = hlen + len; off < (u_int16_t)ip->ip_len; off += len) {		MGETHDR(m, M_DONTWAIT, MT_HEADER);		if (m == 0) {			error = ENOBUFS;			ipstat.ips_odropped++;			goto sendorfree;		}		*mnext = m;		mnext = &m->m_nextpkt;		m->m_data += max_linkhdr;		mhip = mtod(m, struct ip *);		*mhip = *ip;		if (hlen > sizeof (struct ip)) {			mhlen = ip_optcopy(ip, mhip) + sizeof (struct ip);			mhip->ip_hl = mhlen >> 2;		}		m->m_len = mhlen;		mhip->ip_off = ((off - hlen) >> 3) + (ip->ip_off & ~IP_MF);		if (ip->ip_off & IP_MF)			mhip->ip_off |= IP_MF;		if (off + len >= (u_int16_t)ip->ip_len)			len = (u_int16_t)ip->ip_len - off;		else			mhip->ip_off |= IP_MF;		mhip->ip_len = htons((u_int16_t)(len + mhlen));		m->m_next = m_copy(m0, off, len);		if (m->m_next == 0) {			error = ENOBUFS;	/* ??? */			ipstat.ips_odropped++;			goto sendorfree;		}		m->m_pkthdr.len = mhlen + len;		m->m_pkthdr.rcvif = (struct ifnet *)0;		mhip->ip_off = htons((u_int16_t)mhip->ip_off);		mhip->ip_sum = 0;		mhip->ip_sum = in_cksum(m, mhlen);		ipstat.ips_ofragments++;	}	/*	 * Update first fragment by trimming what's been copied out	 * and updating header, then send each fragment (in order).	 */	m = m0;	m_adj(m, hlen + firstlen - (u_int16_t)ip->ip_len);	m->m_pkthdr.len = hlen + firstlen;	ip->ip_len = htons((u_int16_t)m->m_pkthdr.len);	ip->ip_off = htons((u_int16_t)(ip->ip_off | IP_MF));	ip->ip_sum = 0;	ip->ip_sum = in_cksum(m, hlen);sendorfree:	for (m = m0; m; m = m0) {		m0 = m->m_nextpkt;		m->m_nextpkt = 0;		if (error == 0)			error = (*ifp->if_output)(ifp, m, sintosa(dst),			    ro->ro_rt);		else			m_freem(m);	}	if (error == 0)		ipstat.ips_fragmented++;    }done:	if (ro == &iproute && (flags & IP_ROUTETOIF) == 0 && ro->ro_rt)		RTFREE(ro->ro_rt);	return (error);bad:	m_freem(m0);	goto done;}/* * Insert IP options into preformed packet. * Adjust IP destination as required for IP source routing, * as indicated by a non-zero in_addr at the start of the options. */static struct mbuf *ip_insertoptions(m, opt, phlen)	register struct mbuf *m;	struct mbuf *opt;	int *phlen;{	register struct ipoption *p = mtod(opt, struct ipoption *);	struct mbuf *n;	register struct ip *ip = mtod(m, struct ip *);	unsigned optlen;	optlen = opt->m_len - sizeof(p->ipopt_dst);	if (optlen + (u_int16_t)ip->ip_len > IP_MAXPACKET)		return (m);		/* XXX should fail */	if (p->ipopt_dst.s_addr)		ip->ip_dst = p->ipopt_dst;	if (m->m_flags & M_EXT || m->m_data - optlen < m->m_pktdat) {		MGETHDR(n, M_DONTWAIT, MT_HEADER);		if (n == 0)			return (m);		n->m_pkthdr.len = m->m_pkthdr.len + optlen;		m->m_len -= sizeof(struct ip);		m->m_data += sizeof(struct ip);		n->m_next = m;		m = n;		m->m_len = optlen + sizeof(struct ip);		m->m_data += max_linkhdr;		bcopy((caddr_t)ip, mtod(m, caddr_t), sizeof(struct ip));	} else {		m->m_data -= optlen;		m->m_len += optlen;		m->m_pkthdr.len += optlen;		ovbcopy((caddr_t)ip, mtod(m, caddr_t), sizeof(struct ip));	}	ip = mtod(m, struct ip *);	bcopy((caddr_t)p->ipopt_list, (caddr_t)(ip + 1), (unsigned)optlen);	*phlen = sizeof(struct ip) + optlen;	ip->ip_len += optlen;	return (m);}