/usr/src/sys/netinet/ip

Bug Summary

File:	netinet/ip_output.c
Warning:	line 665, column 6 Branch condition evaluates to a garbage value
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple amd64-unknown-openbsd7.4 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name ip_output.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model static -mframe-pointer=all -relaxed-aliasing -ffp-contract=on -fno-rounding-math -mconstructor-aliases -ffreestanding -mcmodel=kernel -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -target-feature -sse2 -target-feature -sse -target-feature -3dnow -target-feature -mmx -target-feature +save-args -target-feature +retpoline-external-thunk -disable-red-zone -no-implicit-float -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -nostdsysteminc -nobuiltininc -resource-dir /usr/local/llvm16/lib/clang/16 -I /usr/src/sys -I /usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -I /usr/src/sys/arch -I /usr/src/sys/dev/pci/drm/include -I /usr/src/sys/dev/pci/drm/include/uapi -I /usr/src/sys/dev/pci/drm/amd/include/asic_reg -I /usr/src/sys/dev/pci/drm/amd/include -I /usr/src/sys/dev/pci/drm/amd/amdgpu -I /usr/src/sys/dev/pci/drm/amd/display -I /usr/src/sys/dev/pci/drm/amd/display/include -I /usr/src/sys/dev/pci/drm/amd/display/dc -I /usr/src/sys/dev/pci/drm/amd/display/amdgpu_dm -I /usr/src/sys/dev/pci/drm/amd/pm/inc -I /usr/src/sys/dev/pci/drm/amd/pm/legacy-dpm -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/inc -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu11 -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu12 -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu13 -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/inc -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/hwmgr -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/smumgr -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/inc -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/inc/pmfw_if -I /usr/src/sys/dev/pci/drm/amd/display/dc/inc -I /usr/src/sys/dev/pci/drm/amd/display/dc/inc/hw -I /usr/src/sys/dev/pci/drm/amd/display/dc/clk_mgr -I /usr/src/sys/dev/pci/drm/amd/display/modules/inc -I /usr/src/sys/dev/pci/drm/amd/display/modules/hdcp -I /usr/src/sys/dev/pci/drm/amd/display/dmub/inc -I /usr/src/sys/dev/pci/drm/i915 -D DDB -D DIAGNOSTIC -D KTRACE -D ACCOUNTING -D KMEMSTATS -D PTRACE -D POOL_DEBUG -D CRYPTO -D SYSVMSG -D SYSVSEM -D SYSVSHM -D UVM_SWAP_ENCRYPT -D FFS -D FFS2 -D FFS_SOFTUPDATES -D UFS_DIRHASH -D QUOTA -D EXT2FS -D MFS -D NFSCLIENT -D NFSSERVER -D CD9660 -D UDF -D MSDOSFS -D FIFO -D FUSE -D SOCKET_SPLICE -D TCP_ECN -D TCP_SIGNATURE -D INET6 -D IPSEC -D PPP_BSDCOMP -D PPP_DEFLATE -D PIPEX -D MROUTING -D MPLS -D BOOT_CONFIG -D USER_PCICONF -D APERTURE -D MTRR -D NTFS -D SUSPEND -D HIBERNATE -D PCIVERBOSE -D USBVERBOSE -D WSDISPLAY_COMPAT_USL -D WSDISPLAY_COMPAT_RAWKBD -D WSDISPLAY_DEFAULTSCREENS=6 -D X86EMU -D ONEWIREVERBOSE -D MULTIPROCESSOR -D MAXUSERS=80 -D _KERNEL -O2 -Wno-pointer-sign -Wno-address-of-packed-member -Wno-constant-conversion -Wno-unused-but-set-variable -Wno-gnu-folding-constant -fdebug-compilation-dir=/usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fcf-protection=branch -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -o /home/ben/Projects/scan/2024-01-11-110808-61670-1 -x c /usr/src/sys/netinet/ip_output.c
1/*	$OpenBSD: ip_output.c,v 1.392 2023/12/01 15:30:47 bluhm Exp $	*/
2/*	$NetBSD: ip_output.c,v 1.28 1996/02/13 23:43:07 christos Exp $	*/

4/*
* Copyright (c) 1982, 1986, 1988, 1990, 1993
*	The Regents of the University of California.  All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
* 3. Neither the name of the University nor the names of its contributors
*    may be used to endorse or promote products derived from this software
*    without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
*	@(#)ip_output.c	8.3 (Berkeley) 1/21/94
*/

35#include "pf.h"

37#include <sys/param.h>
38#include <sys/systm.h>
39#include <sys/mbuf.h>
40#include <sys/protosw.h>
41#include <sys/socket.h>
42#include <sys/socketvar.h>
43#include <sys/proc.h>
44#include <sys/kernel.h>

46#include <net/if.h>
47#include <net/if_var.h>
48#include <net/if_enc.h>
49#include <net/route.h>

51#include <netinet/in.h>
52#include <netinet/ip.h>
53#include <netinet/in_pcb.h>
54#include <netinet/in_var.h>
55#include <netinet/ip_var.h>
56#include <netinet/ip_icmp.h>
57#include <netinet/tcp.h>
58#include <netinet/udp.h>
59#include <netinet/tcp_timer.h>
60#include <netinet/tcp_var.h>
61#include <netinet/udp_var.h>

63#if NPF1 > 0
64#include <net/pfvar.h>
65#endif

67#ifdef IPSEC1
68#ifdef ENCDEBUG
69#define DPRINTF(fmt, args...)do { } while (0)						\
do {								\
if (encdebug)						\
	printf("%s: " fmt "\n", __func__, ## args);	\
} while (0)
74#else
75#define DPRINTF(fmt, args...)do { } while (0)						\
do { } while (0)
77#endif
78#endif /* IPSEC */

80int ip_pcbopts(struct mbuf **, struct mbuf *);
81int ip_multicast_if(struct ip_mreqn *, u_int, unsigned int *);
82int ip_setmoptions(int, struct ip_moptions **, struct mbuf *, u_int);
83void ip_mloopback(struct ifnet *, struct mbuf *, struct sockaddr_in *);
84static u_int16_t in_cksum_phdr(u_int32_t, u_int32_t, u_int32_t);
85void in_delayed_cksum(struct mbuf *);

87int ip_output_ipsec_lookup(struct mbuf *m, int hlen, const u_char seclevel[],
  struct tdb **, int ipsecflowinfo);
89void ip_output_ipsec_pmtu_update(struct tdb *, struct route *, struct in_addr,
  int, int);
91int ip_output_ipsec_send(struct tdb *, struct mbuf *, struct route *, int);

93/*
* IP output.  The packet in mbuf chain m contains a skeletal IP
* header (with len, off, ttl, proto, tos, src, dst).
* The mbuf chain containing the packet will be freed.
* The mbuf opt, if present, will not be freed.
*/
99int
100ip_output(struct mbuf *m, struct mbuf *opt, struct route *ro, int flags,
  struct ip_moptions *imo, const u_char seclevel[], u_int32_t ipsecflowinfo)
102{
struct ip *ip;
struct ifnet *ifp = NULL((void *)0);
struct mbuf_list ml;
int hlen = sizeof (struct ip);
int error = 0;
struct route iproute;
struct sockaddr_in *dst;
struct tdb *tdb = NULL((void *)0);
u_long mtu;
112#if NPF1 > 0
u_int orig_rtableid;
114#endif

NET_ASSERT_LOCKED()do { int _s = rw_status(&netlock); if ((splassert_ctl >
 0) && (_s != 0x0001UL && _s != 0x0002UL)) splassert_fail
(0x0002UL, _s, __func__); } while (0);
1
Assuming 'splassert_ctl' is <= 0→
2
←
Loop condition is false.  Exiting loop→

118#ifdef	DIAGNOSTIC1
if ((m->m_flagsm_hdr.mh_flags & M_PKTHDR0x0002) == 0)
3
←
Assuming the condition is false→
4
←
Taking false branch→
panic("ip_output no HDR");
121#endif
if (opt)
5
←
Assuming 'opt' is null→
6
←
Taking false branch→
m = ip_insertoptions(m, opt, &hlen);

ip = mtod(m, struct ip *)((struct ip *)((m)->m_hdr.mh_data));

/*
* Fill in IP header.
*/
if ((flags & (IP_FORWARDING0x1|IP_RAWOUTPUT0x2)) == 0) {
7
←
Assuming the condition is false→
8
←
Taking false branch→
ip->ip_v = IPVERSION4;
ip->ip_off &= htons(IP_DF)(__uint16_t)(__builtin_constant_p(0x4000) ? (__uint16_t)(((__uint16_t
)(0x4000) & 0xffU) << 8 | ((__uint16_t)(0x4000) &
 0xff00U) >> 8) : __swap16md(0x4000));
ip->ip_id = htons(ip_randomid())(__uint16_t)(__builtin_constant_p(ip_randomid()) ? (__uint16_t
)(((__uint16_t)(ip_randomid()) & 0xffU) << 8 | ((__uint16_t
)(ip_randomid()) & 0xff00U) >> 8) : __swap16md(ip_randomid
()));
ip->ip_hl = hlen >> 2;
ipstat_inc(ips_localout);
} else {
hlen = ip->ip_hl << 2;
}

/*
* We should not send traffic to 0/8 say both Stevens and RFCs
* 5735 section 3 and 1122 sections 3.2.1.3 and 3.3.6.
*/
if ((ntohl(ip->ip_dst.s_addr)(__uint32_t)(__builtin_constant_p(ip->ip_dst.s_addr) ? (__uint32_t
)(((__uint32_t)(ip->ip_dst.s_addr) & 0xff) << 24
 | ((__uint32_t)(ip->ip_dst.s_addr) & 0xff00) <<
| ((__uint32_t)(ip->ip_dst.s_addr) & 0xff0000) >>
| ((__uint32_t)(ip->ip_dst.s_addr) & 0xff000000) >>
 24) : __swap32md(ip->ip_dst.s_addr)) >> IN_CLASSA_NSHIFT24) == 0) {
9
←
'?' condition is false→
10
←
Assuming the condition is false→
11
←
Taking false branch→
error = ENETUNREACH51;
goto bad;
}

149#if NPF1 > 0
orig_rtableid = m->m_pkthdrM_dat.MH.MH_pkthdr.ph_rtableid;
151reroute:
152#endif

/*
* Do a route lookup now in case we need the source address to
* do an SPD lookup in IPsec; for most packets, the source address
* is set at a higher level protocol. ICMPs and other packets
* though (e.g., traceroute) have a source address of zeroes.
*/
if (ro == NULL((void *)0)) {
12
←
Assuming 'ro' is not equal to NULL→
13
←
Taking false branch→
ro = &iproute;
memset(ro, 0, sizeof(*ro))__builtin_memset((ro), (0), (sizeof(*ro)));
}

dst = satosin(&ro->ro_dst);

/*
* If there is a cached route, check that it is to the same
* destination and is still up.  If not, free it and try again.
*/
if (!rtisvalid(ro->ro_rt) ||
14
←
Assuming the condition is false→
17
←
Taking false branch→
   dst->sin_addr.s_addr != ip->ip_dst.s_addr ||
15
←
Assuming 'dst->sin_addr.s_addr' is equal to 'ip->ip_dst.s_addr'→
   ro->ro_tableid != m->m_pkthdrM_dat.MH.MH_pkthdr.ph_rtableid) {
16
←
Assuming field 'ro_tableid' is equal to field 'ph_rtableid'→
rtfree(ro->ro_rt);
ro->ro_rt = NULL((void *)0);
}

if (ro->ro_rt == NULL((void *)0)) {
18
←
Assuming field 'ro_rt' is not equal to NULL→
dst->sin_family = AF_INET2;
dst->sin_len = sizeof(*dst);
dst->sin_addr = ip->ip_dst;
ro->ro_tableid = m->m_pkthdrM_dat.MH.MH_pkthdr.ph_rtableid;
}

if ((IN_MULTICAST(ip->ip_dst.s_addr)(((u_int32_t)(ip->ip_dst.s_addr) & ((u_int32_t) (__uint32_t
)(__builtin_constant_p((u_int32_t)(0xf0000000)) ? (__uint32_t
)(((__uint32_t)((u_int32_t)(0xf0000000)) & 0xff) <<
| ((__uint32_t)((u_int32_t)(0xf0000000)) & 0xff00) <<
| ((__uint32_t)((u_int32_t)(0xf0000000)) & 0xff0000) >>
| ((__uint32_t)((u_int32_t)(0xf0000000)) & 0xff000000)
 >> 24) : __swap32md((u_int32_t)(0xf0000000))))) == ((u_int32_t
) (__uint32_t)(__builtin_constant_p((u_int32_t)(0xe0000000)) ?
 (__uint32_t)(((__uint32_t)((u_int32_t)(0xe0000000)) & 0xff
) << 24 | ((__uint32_t)((u_int32_t)(0xe0000000)) & 0xff00
) << 8 | ((__uint32_t)((u_int32_t)(0xe0000000)) & 0xff0000
) >> 8 | ((__uint32_t)((u_int32_t)(0xe0000000)) & 0xff000000
) >> 24) : __swap32md((u_int32_t)(0xe0000000))))) ||
19
←
Taking false branch→
20
←
'?' condition is true→
21
←
'?' condition is true→
22
←
Assuming the condition is false→
   (ip->ip_dst.s_addr == INADDR_BROADCAST((u_int32_t) (__uint32_t)(__builtin_constant_p((u_int32_t)(0xffffffff
)) ? (__uint32_t)(((__uint32_t)((u_int32_t)(0xffffffff)) &
 0xff) << 24 | ((__uint32_t)((u_int32_t)(0xffffffff)) &
 0xff00) << 8 | ((__uint32_t)((u_int32_t)(0xffffffff)) &
 0xff0000) >> 8 | ((__uint32_t)((u_int32_t)(0xffffffff)
) & 0xff000000) >> 24) : __swap32md((u_int32_t)(0xffffffff
)))))) &&
23
←
'?' condition is true→
24
←
Assuming the condition is false→
   imo != NULL((void *)0) && (ifp = if_get(imo->imo_ifidx)) != NULL((void *)0)) {

mtu = ifp->if_mtuif_data.ifi_mtu;
if (ip->ip_src.s_addr == INADDR_ANY((u_int32_t) (__uint32_t)(__builtin_constant_p((u_int32_t)(0x00000000
)) ? (__uint32_t)(((__uint32_t)((u_int32_t)(0x00000000)) &
 0xff) << 24 | ((__uint32_t)((u_int32_t)(0x00000000)) &
 0xff00) << 8 | ((__uint32_t)((u_int32_t)(0x00000000)) &
 0xff0000) >> 8 | ((__uint32_t)((u_int32_t)(0x00000000)
) & 0xff000000) >> 24) : __swap32md((u_int32_t)(0x00000000
))))) {
	struct in_ifaddr *ia;

	IFP_TO_IA(ifp, ia)do { struct ifaddr *ifa; do { int _s = rw_status(&netlock
); if ((splassert_ctl > 0) && (_s != 0x0001UL &&
 _s != 0x0002UL)) splassert_fail(0x0002UL, _s, __func__); } while
 (0); for((ifa) = ((&(ifp)->if_addrlist)->tqh_first
); (ifa) != ((void *)0); (ifa) = ((ifa)->ifa_list.tqe_next
)) { if (ifa->ifa_addr->sa_family == 2) break; } (ia) =
 ifatoia(ifa); } while ( 0);
	if (ia != NULL((void *)0))
		ip->ip_src = ia->ia_addr.sin_addr;
}
} else {
struct in_ifaddr *ia;

if (ro->ro_rt24.1
Field 'ro_rt' is not equal to NULL
 == NULL((void *)0))
25
←
Taking false branch→
	ro->ro_rt = rtalloc_mpath(&ro->ro_dst,
	    &ip->ip_src.s_addr, ro->ro_tableid);

if (ro->ro_rt25.1
Field 'ro_rt' is not equal to NULL
 == NULL((void *)0)) {
26
←
Taking false branch→
	ipstat_inc(ips_noroute);
	error = EHOSTUNREACH65;
	goto bad;
}

ia = ifatoia(ro->ro_rt->rt_ifa);
if (ISSET(ro->ro_rt->rt_flags, RTF_LOCAL)((ro->ro_rt->rt_flags) & (0x200000)))
27
←
Assuming the condition is false→
28
←
Taking false branch→
	ifp = if_get(rtable_loindex(m->m_pkthdrM_dat.MH.MH_pkthdr.ph_rtableid));
else
	ifp = if_get(ro->ro_rt->rt_ifidx);
/*
 * We aren't using rtisvalid() here because the UP/DOWN state
 * machine is broken with some Ethernet drivers like em(4).
 * As a result we might try to use an invalid cached route
 * entry while an interface is being detached.
 */
if (ifp == NULL((void *)0)) {
29
←
Assuming 'ifp' is not equal to NULL→
30
←
Taking false branch→
	ipstat_inc(ips_noroute);
	error = EHOSTUNREACH65;
	goto bad;
}
if ((mtu = ro->ro_rt->rt_mturt_rmx.rmx_mtu) == 0)
31
←
Assuming the condition is false→
32
←
Taking false branch→
	mtu = ifp->if_mtuif_data.ifi_mtu;

if (ro->ro_rt->rt_flags & RTF_GATEWAY0x2)
33
←
Assuming the condition is false→
	dst = satosin(ro->ro_rt->rt_gateway);

/* Set the source IP address */
if (ip->ip_src.s_addr == INADDR_ANY((u_int32_t) (__uint32_t)(__builtin_constant_p((u_int32_t)(0x00000000
)) ? (__uint32_t)(((__uint32_t)((u_int32_t)(0x00000000)) &
 0xff) << 24 | ((__uint32_t)((u_int32_t)(0x00000000)) &
 0xff00) << 8 | ((__uint32_t)((u_int32_t)(0x00000000)) &
 0xff0000) >> 8 | ((__uint32_t)((u_int32_t)(0x00000000)
) & 0xff000000) >> 24) : __swap32md((u_int32_t)(0x00000000
)))) && ia)
34
←
'?' condition is true→
35
←
Assuming the condition is false→
	ip->ip_src = ia->ia_addr.sin_addr;
}

237#ifdef IPSEC1
if (ipsec_in_use || seclevel != NULL((void *)0)) {
36
←
Assuming 'ipsec_in_use' is 0→
37
←
Assuming 'seclevel' is not equal to NULL→
38
←
Taking true branch→
/* Do we have any pending SAs to apply ? */
error = ip_output_ipsec_lookup(m, hlen, seclevel, &tdb,
    ipsecflowinfo);
if (error38.1
'error' is 0
) {
39
←
Taking false branch→
	/* Should silently drop packet */
	if (error == -EINVAL22)
		error = 0;
	goto bad;
}
if (tdb39.1
'tdb' is not equal to NULL
 != NULL((void *)0)) {
40
←
Taking true branch→
	/*
	 * If it needs TCP/UDP hardware-checksumming, do the
	 * computation now.
	 */
	in_proto_cksum_out(m, NULL((void *)0));
}
}
256#endif /* IPSEC */

if (IN_MULTICAST(ip->ip_dst.s_addr)(((u_int32_t)(ip->ip_dst.s_addr) & ((u_int32_t) (__uint32_t
)(__builtin_constant_p((u_int32_t)(0xf0000000)) ? (__uint32_t
)(((__uint32_t)((u_int32_t)(0xf0000000)) & 0xff) <<
| ((__uint32_t)((u_int32_t)(0xf0000000)) & 0xff00) <<
| ((__uint32_t)((u_int32_t)(0xf0000000)) & 0xff0000) >>
| ((__uint32_t)((u_int32_t)(0xf0000000)) & 0xff000000)
 >> 24) : __swap32md((u_int32_t)(0xf0000000))))) == ((u_int32_t
) (__uint32_t)(__builtin_constant_p((u_int32_t)(0xe0000000)) ?
 (__uint32_t)(((__uint32_t)((u_int32_t)(0xe0000000)) & 0xff
) << 24 | ((__uint32_t)((u_int32_t)(0xe0000000)) & 0xff00
) << 8 | ((__uint32_t)((u_int32_t)(0xe0000000)) & 0xff0000
) >> 8 | ((__uint32_t)((u_int32_t)(0xe0000000)) & 0xff000000
) >> 24) : __swap32md((u_int32_t)(0xe0000000))))) ||
41
←
'?' condition is true→
42
←
'?' condition is true→
   (ip->ip_dst.s_addr == INADDR_BROADCAST((u_int32_t) (__uint32_t)(__builtin_constant_p((u_int32_t)(0xffffffff
)) ? (__uint32_t)(((__uint32_t)((u_int32_t)(0xffffffff)) &
 0xff) << 24 | ((__uint32_t)((u_int32_t)(0xffffffff)) &
 0xff00) << 8 | ((__uint32_t)((u_int32_t)(0xffffffff)) &
 0xff0000) >> 8 | ((__uint32_t)((u_int32_t)(0xffffffff)
) & 0xff000000) >> 24) : __swap32md((u_int32_t)(0xffffffff
)))))) {
43
←
'?' condition is true→

m->m_flagsm_hdr.mh_flags |= (ip->ip_dst.s_addr == INADDR_BROADCAST((u_int32_t) (__uint32_t)(__builtin_constant_p((u_int32_t)(0xffffffff
)) ? (__uint32_t)(((__uint32_t)((u_int32_t)(0xffffffff)) &
 0xff) << 24 | ((__uint32_t)((u_int32_t)(0xffffffff)) &
 0xff00) << 8 | ((__uint32_t)((u_int32_t)(0xffffffff)) &
 0xff0000) >> 8 | ((__uint32_t)((u_int32_t)(0xffffffff)
) & 0xff000000) >> 24) : __swap32md((u_int32_t)(0xffffffff
))))) ?
	M_BCAST0x0100 : M_MCAST0x0200;

/*
 * IP destination address is multicast.  Make sure "dst"
 * still points to the address in "ro".  (It may have been
 * changed to point to a gateway address, above.)
 */
dst = satosin(&ro->ro_dst);

/*
 * See if the caller provided any multicast options
 */
if (imo != NULL((void *)0))
	ip->ip_ttl = imo->imo_ttl;
else
	ip->ip_ttl = IP_DEFAULT_MULTICAST_TTL1;

/*
 * if we don't know the outgoing ifp yet, we can't generate
 * output
 */
if (!ifp) {
	ipstat_inc(ips_noroute);
	error = EHOSTUNREACH65;
	goto bad;
}

/*
 * Confirm that the outgoing interface supports multicast,
 * but only if the packet actually is going out on that
 * interface (i.e., no IPsec is applied).
 */
if ((((m->m_flagsm_hdr.mh_flags & M_MCAST0x0200) &&
      (ifp->if_flags & IFF_MULTICAST0x8000) == 0) ||
     ((m->m_flagsm_hdr.mh_flags & M_BCAST0x0100) &&
      (ifp->if_flags & IFF_BROADCAST0x2) == 0)) && (tdb == NULL((void *)0))) {
	ipstat_inc(ips_noroute);
	error = ENETUNREACH51;
	goto bad;
}

/*
 * If source address not specified yet, use address
 * of outgoing interface.
 */
if (ip->ip_src.s_addr == INADDR_ANY((u_int32_t) (__uint32_t)(__builtin_constant_p((u_int32_t)(0x00000000
)) ? (__uint32_t)(((__uint32_t)((u_int32_t)(0x00000000)) &
 0xff) << 24 | ((__uint32_t)((u_int32_t)(0x00000000)) &
 0xff00) << 8 | ((__uint32_t)((u_int32_t)(0x00000000)) &
 0xff0000) >> 8 | ((__uint32_t)((u_int32_t)(0x00000000)
) & 0xff000000) >> 24) : __swap32md((u_int32_t)(0x00000000
))))) {
	struct in_ifaddr *ia;

	IFP_TO_IA(ifp, ia)do { struct ifaddr *ifa; do { int _s = rw_status(&netlock
); if ((splassert_ctl > 0) && (_s != 0x0001UL &&
 _s != 0x0002UL)) splassert_fail(0x0002UL, _s, __func__); } while
 (0); for((ifa) = ((&(ifp)->if_addrlist)->tqh_first
); (ifa) != ((void *)0); (ifa) = ((ifa)->ifa_list.tqe_next
)) { if (ifa->ifa_addr->sa_family == 2) break; } (ia) =
 ifatoia(ifa); } while ( 0);
	if (ia != NULL((void *)0))
		ip->ip_src = ia->ia_addr.sin_addr;
}

if ((imo == NULL((void *)0) || imo->imo_loop) &&
    in_hasmulti(&ip->ip_dst, ifp)) {
	/*
	 * If we belong to the destination multicast group
	 * on the outgoing interface, and the caller did not
	 * forbid loopback, loop back a copy.
	 * Can't defer TCP/UDP checksumming, do the
	 * computation now.
	 */
	in_proto_cksum_out(m, NULL((void *)0));
	ip_mloopback(ifp, m, dst);
}
327#ifdef MROUTING1
else {
	/*
	 * If we are acting as a multicast router, perform
	 * multicast forwarding as if the packet had just
	 * arrived on the interface to which we are about
	 * to send.  The multicast forwarding function
	 * recursively calls this function, using the
	 * IP_FORWARDING flag to prevent infinite recursion.
	 *
	 * Multicasts that are looped back by ip_mloopback(),
	 * above, will be forwarded by the ip_input() routine,
	 * if necessary.
	 */
	if (ipmforwarding && ip_mrouter[ifp->if_rdomainif_data.ifi_rdomain] &&
	    (flags & IP_FORWARDING0x1) == 0) {
		int rv;

		KERNEL_LOCK()_kernel_lock();
		rv = ip_mforward(m, ifp);
		KERNEL_UNLOCK()_kernel_unlock();
		if (rv != 0)
			goto bad;
	}
}
352#endif
/*
 * Multicasts with a time-to-live of zero may be looped-
 * back, above, but must not be transmitted on a network.
 * Also, multicasts addressed to the loopback interface
 * are not sent -- the above call to ip_mloopback() will
 * loop back a copy if this host actually belongs to the
 * destination group on the loopback interface.
 */
if (ip->ip_ttl == 0 || (ifp->if_flags & IFF_LOOPBACK0x8) != 0)
	goto bad;

goto sendit;
}

/*
* Look for broadcast address and verify user is allowed to send
* such a packet; if the packet is going in an IPsec tunnel, skip
* this check.
*/
if ((tdb43.1
'tdb' is not equal to NULL
 == NULL((void *)0)) && ((dst->sin_addr.s_addr == INADDR_BROADCAST((u_int32_t) (__uint32_t)(__builtin_constant_p((u_int32_t)(0xffffffff
)) ? (__uint32_t)(((__uint32_t)((u_int32_t)(0xffffffff)) &
 0xff) << 24 | ((__uint32_t)((u_int32_t)(0xffffffff)) &
 0xff00) << 8 | ((__uint32_t)((u_int32_t)(0xffffffff)) &
 0xff0000) >> 8 | ((__uint32_t)((u_int32_t)(0xffffffff)
) & 0xff000000) >> 24) : __swap32md((u_int32_t)(0xffffffff
))))) ||
   (ro && ro->ro_rt && ISSET(ro->ro_rt->rt_flags, RTF_BROADCAST)((ro->ro_rt->rt_flags) & (0x400000))))) {
if ((ifp->if_flags & IFF_BROADCAST0x2) == 0) {
	error = EADDRNOTAVAIL49;
	goto bad;
}
if ((flags & IP_ALLOWBROADCAST0x0020) == 0) {
	error = EACCES13;
	goto bad;
}

/* Don't allow broadcast messages to be fragmented */
if (ntohs(ip->ip_len)(__uint16_t)(__builtin_constant_p(ip->ip_len) ? (__uint16_t
)(((__uint16_t)(ip->ip_len) & 0xffU) << 8 | ((__uint16_t
)(ip->ip_len) & 0xff00U) >> 8) : __swap16md(ip->
ip_len)) > ifp->if_mtuif_data.ifi_mtu) {
	error = EMSGSIZE40;
	goto bad;
}
m->m_flagsm_hdr.mh_flags |= M_BCAST0x0100;
} else
m->m_flagsm_hdr.mh_flags &= ~M_BCAST0x0100;

392sendit:
/*
* If we're doing Path MTU discovery, we need to set DF unless
* the route's MTU is locked.
*/
if ((flags & IP_MTUDISC0x0800) && ro && ro->ro_rt &&
44
←
Assuming the condition is false→
   (ro->ro_rt->rt_locksrt_rmx.rmx_locks & RTV_MTU0x1) == 0)
ip->ip_off |= htons(IP_DF)(__uint16_t)(__builtin_constant_p(0x4000) ? (__uint16_t)(((__uint16_t
)(0x4000) & 0xffU) << 8 | ((__uint16_t)(0x4000) &
 0xff00U) >> 8) : __swap16md(0x4000));

401#ifdef IPSEC1
/*
* Check if the packet needs encapsulation.
*/
if (tdb44.1
'tdb' is not equal to NULL
 != NULL((void *)0)) {
45
←
Taking true branch→
/* Callee frees mbuf */
error = ip_output_ipsec_send(tdb, m, ro,
48
←
Calling 'ip_output_ipsec_send'→
    (flags & IP_FORWARDING0x1) ? 1 : 0);
46
←
Assuming the condition is false→
47
←
'?' condition is false→
goto done;
}
411#endif /* IPSEC */

/*
* Packet filter
*/
416#if NPF1 > 0
if (pf_test(AF_INET2, (flags & IP_FORWARDING0x1) ? PF_FWD : PF_OUT,
   ifp, &m) != PF_PASS) {
error = EACCES13;
goto bad;
}
if (m == NULL((void *)0))
goto done;
ip = mtod(m, struct ip *)((struct ip *)((m)->m_hdr.mh_data));
hlen = ip->ip_hl << 2;
if ((m->m_pkthdrM_dat.MH.MH_pkthdr.pf.flags & (PF_TAG_REROUTE0x20 | PF_TAG_GENERATED0x01)) ==
   (PF_TAG_REROUTE0x20 | PF_TAG_GENERATED0x01))
/* already rerun the route lookup, go on */
m->m_pkthdrM_dat.MH.MH_pkthdr.pf.flags &= ~(PF_TAG_GENERATED0x01 | PF_TAG_REROUTE0x20);
else if (m->m_pkthdrM_dat.MH.MH_pkthdr.pf.flags & PF_TAG_REROUTE0x20) {
/* tag as generated to skip over pf_test on rerun */
m->m_pkthdrM_dat.MH.MH_pkthdr.pf.flags |= PF_TAG_GENERATED0x01;
ro = NULL((void *)0);
if_put(ifp); /* drop reference since target changed */
ifp = NULL((void *)0);
goto reroute;
}
438#endif

440#ifdef IPSEC1
if (ipsec_in_use && (flags & IP_FORWARDING0x1) && (ipforwarding == 2) &&
   (m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE0x0001, NULL((void *)0)) == NULL((void *)0))) {
error = EHOSTUNREACH65;
goto bad;
}
446#endif

/*
* If TSO or small enough for interface, can just send directly.
*/
error = if_output_tso(ifp, &m, sintosa(dst), ro->ro_rt, mtu);
if (error || m == NULL((void *)0))
goto done;

/*
* Too large for interface; fragment if possible.
* Must be able to put at least 8 bytes per fragment.
*/
if (ip->ip_off & htons(IP_DF)(__uint16_t)(__builtin_constant_p(0x4000) ? (__uint16_t)(((__uint16_t
)(0x4000) & 0xffU) << 8 | ((__uint16_t)(0x4000) &
 0xff00U) >> 8) : __swap16md(0x4000))) {
460#ifdef IPSEC1
if (ip_mtudisc)
	ipsec_adjust_mtu(m, ifp->if_mtuif_data.ifi_mtu);
463#endif
error = EMSGSIZE40;
465#if NPF1 > 0
/* pf changed routing table, use orig rtable for path MTU */
if (ro->ro_tableid != orig_rtableid) {
	rtfree(ro->ro_rt);
	ro->ro_tableid = orig_rtableid;
	ro->ro_rt = icmp_mtudisc_clone(
	    satosin(&ro->ro_dst)->sin_addr, ro->ro_tableid, 0);
}
473#endif
/*
 * This case can happen if the user changed the MTU
 * of an interface after enabling IP on it.  Because
 * most netifs don't keep track of routes pointing to
 * them, there is no way for one to update all its
 * routes when the MTU is changed.
 */
if (rtisvalid(ro->ro_rt) &&
    ISSET(ro->ro_rt->rt_flags, RTF_HOST)((ro->ro_rt->rt_flags) & (0x4)) &&
    !(ro->ro_rt->rt_locksrt_rmx.rmx_locks & RTV_MTU0x1) &&
    (ro->ro_rt->rt_mturt_rmx.rmx_mtu > ifp->if_mtuif_data.ifi_mtu)) {
	ro->ro_rt->rt_mturt_rmx.rmx_mtu = ifp->if_mtuif_data.ifi_mtu;
}
ipstat_inc(ips_cantfrag);
goto bad;
}

if ((error = ip_fragment(m, &ml, ifp, mtu)) ||
   (error = if_output_ml(ifp, &ml, sintosa(dst), ro->ro_rt)))
goto done;
ipstat_inc(ips_fragmented);

496done:
if (ro == &iproute && ro->ro_rt)
rtfree(ro->ro_rt);
if_put(ifp);
500#ifdef IPSEC1
tdb_unref(tdb);
502#endif /* IPSEC */
return (error);

505bad:
m_freem(m);
goto done;
508}

510#ifdef IPSEC1
511int
512ip_output_ipsec_lookup(struct mbuf *m, int hlen, const u_char seclevel[],
  struct tdb **tdbout, int ipsecflowinfo)
514{
struct m_tag *mtag;
struct tdb_ident *tdbi;
struct tdb *tdb;
struct ipsec_ids *ids = NULL((void *)0);
int error;

/* Do we have any pending SAs to apply ? */
if (ipsecflowinfo)
ids = ipsp_ids_lookup(ipsecflowinfo);
error = ipsp_spd_lookup(m, AF_INET2, hlen, IPSP_DIRECTION_OUT0x2,
   NULL((void *)0), seclevel, &tdb, ids);
ipsp_ids_free(ids);
if (error || tdb == NULL((void *)0)) {
*tdbout = NULL((void *)0);
return error;
}
/* Loop detection */
for (mtag = m_tag_first(m); mtag != NULL((void *)0); mtag = m_tag_next(m, mtag)) {
if (mtag->m_tag_id != PACKET_TAG_IPSEC_OUT_DONE0x0002)
	continue;
tdbi = (struct tdb_ident *)(mtag + 1);
if (tdbi->spi == tdb->tdb_spi &&
    tdbi->proto == tdb->tdb_sproto &&
    tdbi->rdomain == tdb->tdb_rdomain &&
    !memcmp(&tdbi->dst, &tdb->tdb_dst,__builtin_memcmp((&tdbi->dst), (&tdb->tdb_dst),
 (sizeof(union sockaddr_union)))
    sizeof(union sockaddr_union))__builtin_memcmp((&tdbi->dst), (&tdb->tdb_dst),
 (sizeof(union sockaddr_union)))) {
	/* no IPsec needed */
	tdb_unref(tdb);
	*tdbout = NULL((void *)0);
	return 0;
}
}
*tdbout = tdb;
return 0;
549}

551void
552ip_output_ipsec_pmtu_update(struct tdb *tdb, struct route *ro,
  struct in_addr dst, int rtableid, int transportmode)
554{
struct rtentry *rt = NULL((void *)0);
int rt_mtucloned = 0;

/* Find a host route to store the mtu in */
if (ro != NULL((void *)0))
rt = ro->ro_rt;
/* but don't add a PMTU route for transport mode SAs */
if (transportmode)
rt = NULL((void *)0);
else if (rt == NULL((void *)0) || (rt->rt_flags & RTF_HOST0x4) == 0) {
rt = icmp_mtudisc_clone(dst, rtableid, 1);
rt_mtucloned = 1;
}
DPRINTF("spi %08x mtu %d rt %p cloned %d",do { } while (0)
   ntohl(tdb->tdb_spi), tdb->tdb_mtu, rt, rt_mtucloned)do { } while (0);
if (rt != NULL((void *)0)) {
rt->rt_mturt_rmx.rmx_mtu = tdb->tdb_mtu;
if (ro != NULL((void *)0) && ro->ro_rt != NULL((void *)0)) {
	rtfree(ro->ro_rt);
	ro->ro_rt = rtalloc(&ro->ro_dst, RT_RESOLVE1, rtableid);
}
if (rt_mtucloned)
	rtfree(rt);
}
579}

581int
582ip_output_ipsec_send(struct tdb *tdb, struct mbuf *m, struct route *ro, int fwd)
583{
struct mbuf_list ml;
struct ifnet *encif = NULL((void *)0);
struct ip *ip;
struct in_addr dst;
u_int len;
int error, rtableid, tso = 0;
49
←
'error' declared without an initial value→

591#if NPF1 > 0
/*
* Packet filter
*/
if ((encif = enc_getif(tdb->tdb_rdomain, tdb->tdb_tap)) == NULL((void *)0) ||
50
←
Assuming the condition is false→
53
←
Taking false branch→
   pf_test(AF_INET2, fwd50.1
'fwd' is 0
 ? PF_FWD : PF_OUT, encif, &m) != PF_PASS) {
51
←
'?' condition is false→
52
←
Assuming the condition is false→
m_freem(m);
return EACCES13;
}
if (m == NULL((void *)0))
54
←
Assuming 'm' is not equal to NULL→
55
←
Taking false branch→
return 0;
/*
* PF_TAG_REROUTE handling or not...
* Packet is entering IPsec so the routing is
* already overruled by the IPsec policy.
* Until now the change was not reconsidered.
* What's the behaviour?
*/
609#endif

/* Check if we can chop the TCP packet */
ip = mtod(m, struct ip *)((struct ip *)((m)->m_hdr.mh_data));
if (ISSET(m->m_pkthdr.csum_flags, M_TCP_TSO)((m->M_dat.MH.MH_pkthdr.csum_flags) & (0x8000)) &&
56
←
Assuming the condition is false→
   m->m_pkthdrM_dat.MH.MH_pkthdr.ph_mss <= tdb->tdb_mtu) {
tso = 1;
len = m->m_pkthdrM_dat.MH.MH_pkthdr.ph_mss;
} else
len = ntohs(ip->ip_len)(__uint16_t)(__builtin_constant_p(ip->ip_len) ? (__uint16_t
)(((__uint16_t)(ip->ip_len) & 0xffU) << 8 | ((__uint16_t
)(ip->ip_len) & 0xff00U) >> 8) : __swap16md(ip->
ip_len));
57
←
'?' condition is false→

/* Check if we are allowed to fragment */
dst = ip->ip_dst;
rtableid = m->m_pkthdrM_dat.MH.MH_pkthdr.ph_rtableid;
if (ip_mtudisc && (ip->ip_off & htons(IP_DF)(__uint16_t)(__builtin_constant_p(0x4000) ? (__uint16_t)(((__uint16_t
)(0x4000) & 0xffU) << 8 | ((__uint16_t)(0x4000) &
 0xff00U) >> 8) : __swap16md(0x4000))) && tdb->tdb_mtu &&
58
←
Assuming 'ip_mtudisc' is 0→
   len > tdb->tdb_mtu && tdb->tdb_mtutimeout > gettime()) {
int transportmode;

transportmode = (tdb->tdb_dst.sa.sa_family == AF_INET2) &&
    (tdb->tdb_dst.sin.sin_addr.s_addr == dst.s_addr);
ip_output_ipsec_pmtu_update(tdb, ro, dst, rtableid,
    transportmode);
ipsec_adjust_mtu(m, tdb->tdb_mtu);
m_freem(m);
return EMSGSIZE40;
}
/* propagate IP_DF for v4-over-v6 */
if (ip_mtudisc58.1
'ip_mtudisc' is 0
 && ip->ip_off & htons(IP_DF)(__uint16_t)(__builtin_constant_p(0x4000) ? (__uint16_t)(((__uint16_t
)(0x4000) & 0xffU) << 8 | ((__uint16_t)(0x4000) &
 0xff00U) >> 8) : __swap16md(0x4000)))
SET(m->m_pkthdr.csum_flags, M_IPV6_DF_OUT)((m->M_dat.MH.MH_pkthdr.csum_flags) |= (0x1000));

/*
* Clear these -- they'll be set in the recursive invocation
* as needed.
*/
m->m_flagsm_hdr.mh_flags &= ~(M_MCAST0x0200 | M_BCAST0x0100);

if (tso58.2
'tso' is 0
) {
59
←
Taking false branch→
error = tcp_chopper(m, &ml, encif, len);
if (error)
	goto done;
} else {
CLR(m->m_pkthdr.csum_flags, M_TCP_TSO)((m->M_dat.MH.MH_pkthdr.csum_flags) &= ~(0x8000));
in_proto_cksum_out(m, encif);
ml_init(&ml);
ml_enqueue(&ml, m);
}

KERNEL_LOCK()_kernel_lock();
while ((m = ml_dequeue(&ml)) != NULL((void *)0)) {
60
←
Assuming the condition is false→
61
←
Loop condition is false. Execution continues on line 663→
/* Callee frees mbuf */
error = ipsp_process_packet(m, tdb, AF_INET2, 0);
if (error)
	break;
}
KERNEL_UNLOCK()_kernel_unlock();
done:
if (error) {
62
←
Branch condition evaluates to a garbage value
ml_purge(&ml);
ipsecstat_inc(ipsec_odrops);
tdbstat_inc(tdb, tdb_odrops);
}
if (!error && tso)
tcpstat_inc(tcps_outswtso);
if (ip_mtudisc && error == EMSGSIZE40)
ip_output_ipsec_pmtu_update(tdb, ro, dst, rtableid, 0);
return error;
675}
676#endif /* IPSEC */

678int
679ip_fragment(struct mbuf *m0, struct mbuf_list *ml, struct ifnet *ifp,
  u_long mtu)
681{
struct ip *ip;
int firstlen, hlen, tlen, len, off;
int error;

ml_init(ml);
ml_enqueue(ml, m0);

ip = mtod(m0, struct ip *)((struct ip *)((m0)->m_hdr.mh_data));
hlen = ip->ip_hl << 2;
tlen = m0->m_pkthdrM_dat.MH.MH_pkthdr.len;
len = (mtu - hlen) &~ 7;
if (len < 8) {
error = EMSGSIZE40;
goto bad;
}
firstlen = len;

/*
* If we are doing fragmentation, we can't defer TCP/UDP
* checksumming; compute the checksum and clear the flag.
*/
in_proto_cksum_out(m0, NULL((void *)0));

/*
* Loop through length of payload after first fragment,
* make new header and copy data of each part and link onto chain.
*/
for (off = hlen + firstlen; off < tlen; off += len) {
struct mbuf *m;
struct ip *mhip;
int mhlen;

MGETHDR(m, M_DONTWAIT, MT_HEADER)m = m_gethdr((0x0002), (2));
if (m == NULL((void *)0)) {
	error = ENOBUFS55;
	goto bad;
}
ml_enqueue(ml, m);
if ((error = m_dup_pkthdr(m, m0, M_DONTWAIT0x0002)) != 0)
	goto bad;
m->m_datam_hdr.mh_data += max_linkhdr;
mhip = mtod(m, struct ip *)((struct ip *)((m)->m_hdr.mh_data));
*mhip = *ip;
if (hlen > sizeof(struct ip)) {
	mhlen = ip_optcopy(ip, mhip) + sizeof(struct ip);
	mhip->ip_hl = mhlen >> 2;
} else
	mhlen = sizeof(struct ip);
m->m_lenm_hdr.mh_len = mhlen;

mhip->ip_off = ((off - hlen) >> 3) +
    (ntohs(ip->ip_off)(__uint16_t)(__builtin_constant_p(ip->ip_off) ? (__uint16_t
)(((__uint16_t)(ip->ip_off) & 0xffU) << 8 | ((__uint16_t
)(ip->ip_off) & 0xff00U) >> 8) : __swap16md(ip->
ip_off)) & ~IP_MF0x2000);
if (ip->ip_off & htons(IP_MF)(__uint16_t)(__builtin_constant_p(0x2000) ? (__uint16_t)(((__uint16_t
)(0x2000) & 0xffU) << 8 | ((__uint16_t)(0x2000) &
 0xff00U) >> 8) : __swap16md(0x2000)))
	mhip->ip_off |= IP_MF0x2000;
if (off + len >= tlen)
	len = tlen - off;
else
	mhip->ip_off |= IP_MF0x2000;
mhip->ip_off = htons(mhip->ip_off)(__uint16_t)(__builtin_constant_p(mhip->ip_off) ? (__uint16_t
)(((__uint16_t)(mhip->ip_off) & 0xffU) << 8 | ((
__uint16_t)(mhip->ip_off) & 0xff00U) >> 8) : __swap16md
(mhip->ip_off));

m->m_pkthdrM_dat.MH.MH_pkthdr.len = mhlen + len;
mhip->ip_len = htons(m->m_pkthdr.len)(__uint16_t)(__builtin_constant_p(m->M_dat.MH.MH_pkthdr.len
) ? (__uint16_t)(((__uint16_t)(m->M_dat.MH.MH_pkthdr.len) &
 0xffU) << 8 | ((__uint16_t)(m->M_dat.MH.MH_pkthdr.len
) & 0xff00U) >> 8) : __swap16md(m->M_dat.MH.MH_pkthdr
.len));
m->m_nextm_hdr.mh_next = m_copym(m0, off, len, M_NOWAIT0x0002);
if (m->m_nextm_hdr.mh_next == NULL((void *)0)) {
	error = ENOBUFS55;
	goto bad;
}

in_hdr_cksum_out(m, ifp);
}

/*
* Update first fragment by trimming what's been copied out
* and updating header, then send each fragment (in order).
*/
if (hlen + firstlen < tlen) {
m_adj(m0, hlen + firstlen - tlen);
ip->ip_off |= htons(IP_MF)(__uint16_t)(__builtin_constant_p(0x2000) ? (__uint16_t)(((__uint16_t
)(0x2000) & 0xffU) << 8 | ((__uint16_t)(0x2000) &
 0xff00U) >> 8) : __swap16md(0x2000));
}
ip->ip_len = htons(m0->m_pkthdr.len)(__uint16_t)(__builtin_constant_p(m0->M_dat.MH.MH_pkthdr.len
) ? (__uint16_t)(((__uint16_t)(m0->M_dat.MH.MH_pkthdr.len)
 & 0xffU) << 8 | ((__uint16_t)(m0->M_dat.MH.MH_pkthdr
.len) & 0xff00U) >> 8) : __swap16md(m0->M_dat.MH
.MH_pkthdr.len));

in_hdr_cksum_out(m0, ifp);

ipstat_add(ips_ofragments, ml_len(ml)((ml)->ml_len));
return (0);

768bad:
ipstat_inc(ips_odropped);
ml_purge(ml);
return (error);
772}

774/*
* Insert IP options into preformed packet.
* Adjust IP destination as required for IP source routing,
* as indicated by a non-zero in_addr at the start of the options.
*/
779struct mbuf *
780ip_insertoptions(struct mbuf *m, struct mbuf *opt, int *phlen)
781{
struct ipoption *p = mtod(opt, struct ipoption *)((struct ipoption *)((opt)->m_hdr.mh_data));
struct mbuf *n;
struct ip *ip = mtod(m, struct ip *)((struct ip *)((m)->m_hdr.mh_data));
unsigned int optlen;

optlen = opt->m_lenm_hdr.mh_len - sizeof(p->ipopt_dst);
if (optlen + ntohs(ip->ip_len)(__uint16_t)(__builtin_constant_p(ip->ip_len) ? (__uint16_t
)(((__uint16_t)(ip->ip_len) & 0xffU) << 8 | ((__uint16_t
)(ip->ip_len) & 0xff00U) >> 8) : __swap16md(ip->
ip_len)) > IP_MAXPACKET65535)
return (m);		/* XXX should fail */

/* check if options will fit to IP header */
if ((optlen + sizeof(struct ip)) > (0x0f << 2)) {
*phlen = sizeof(struct ip);
return (m);
}

if (p->ipopt_dst.s_addr)
ip->ip_dst = p->ipopt_dst;
if (m->m_flagsm_hdr.mh_flags & M_EXT0x0001 || m->m_datam_hdr.mh_data - optlen < m->m_pktdatM_dat.MH.MH_dat.MH_databuf) {
MGETHDR(n, M_DONTWAIT, MT_HEADER)n = m_gethdr((0x0002), (2));
if (n == NULL((void *)0))
	return (m);
M_MOVE_HDR(n, m)do { (n)->M_dat.MH.MH_pkthdr = (m)->M_dat.MH.MH_pkthdr;
 (m)->m_hdr.mh_flags &= ~0x0002; { ((&(m)->M_dat
.MH.MH_pkthdr.ph_tags)->slh_first) = ((void *)0); }; (m)->
M_dat.MH.MH_pkthdr.pf.statekey = ((void *)0); } while ( 0);
n->m_pkthdrM_dat.MH.MH_pkthdr.len += optlen;
m->m_lenm_hdr.mh_len -= sizeof(struct ip);
m->m_datam_hdr.mh_data += sizeof(struct ip);
n->m_nextm_hdr.mh_next = m;
m = n;
m->m_lenm_hdr.mh_len = optlen + sizeof(struct ip);
m->m_datam_hdr.mh_data += max_linkhdr;
memcpy(mtod(m, caddr_t), ip, sizeof(struct ip))__builtin_memcpy((((caddr_t)((m)->m_hdr.mh_data))), (ip), (
sizeof(struct ip)));
} else {
m->m_datam_hdr.mh_data -= optlen;
m->m_lenm_hdr.mh_len += optlen;
m->m_pkthdrM_dat.MH.MH_pkthdr.len += optlen;
memmove(mtod(m, caddr_t), (caddr_t)ip, sizeof(struct ip))__builtin_memmove((((caddr_t)((m)->m_hdr.mh_data))), ((caddr_t
)ip), (sizeof(struct ip)));
}
ip = mtod(m, struct ip *)((struct ip *)((m)->m_hdr.mh_data));
memcpy(ip + 1, p->ipopt_list, optlen)__builtin_memcpy((ip + 1), (p->ipopt_list), (optlen));
*phlen = sizeof(struct ip) + optlen;
ip->ip_len = htons(ntohs(ip->ip_len) + optlen)(__uint16_t)(__builtin_constant_p((__uint16_t)(__builtin_constant_p
(ip->ip_len) ? (__uint16_t)(((__uint16_t)(ip->ip_len) &
 0xffU) << 8 | ((__uint16_t)(ip->ip_len) & 0xff00U
) >> 8) : __swap16md(ip->ip_len)) + optlen) ? (__uint16_t
)(((__uint16_t)((__uint16_t)(__builtin_constant_p(ip->ip_len
) ? (__uint16_t)(((__uint16_t)(ip->ip_len) & 0xffU) <<
| ((__uint16_t)(ip->ip_len) & 0xff00U) >> 8) :
 __swap16md(ip->ip_len)) + optlen) & 0xffU) << 8
 | ((__uint16_t)((__uint16_t)(__builtin_constant_p(ip->ip_len
) ? (__uint16_t)(((__uint16_t)(ip->ip_len) & 0xffU) <<
| ((__uint16_t)(ip->ip_len) & 0xff00U) >> 8) :
 __swap16md(ip->ip_len)) + optlen) & 0xff00U) >>
 8) : __swap16md((__uint16_t)(__builtin_constant_p(ip->ip_len
) ? (__uint16_t)(((__uint16_t)(ip->ip_len) & 0xffU) <<
| ((__uint16_t)(ip->ip_len) & 0xff00U) >> 8) :
 __swap16md(ip->ip_len)) + optlen));
return (m);
823}

825/*
* Copy options from ip to jp,
* omitting those not copied during fragmentation.
*/
829int
830ip_optcopy(struct ip *ip, struct ip *jp)
831{
u_char *cp, *dp;
int opt, optlen, cnt;

cp = (u_char *)(ip + 1);
dp = (u_char *)(jp + 1);
cnt = (ip->ip_hl << 2) - sizeof (struct ip);
for (; cnt > 0; cnt -= optlen, cp += optlen) {
opt = cp[0];
if (opt == IPOPT_EOL0)
	break;
if (opt == IPOPT_NOP1) {
	/* Preserve for IP mcast tunnel's LSRR alignment. */
	*dp++ = IPOPT_NOP1;
	optlen = 1;
	continue;
}
848#ifdef DIAGNOSTIC1
if (cnt < IPOPT_OLEN1 + sizeof(*cp))
	panic("malformed IPv4 option passed to ip_optcopy");
851#endif
optlen = cp[IPOPT_OLEN1];
853#ifdef DIAGNOSTIC1
if (optlen < IPOPT_OLEN1 + sizeof(*cp) || optlen > cnt)
	panic("malformed IPv4 option passed to ip_optcopy");
856#endif
/* bogus lengths should have been caught by ip_dooptions */
if (optlen > cnt)
	optlen = cnt;
if (IPOPT_COPIED(opt)((opt)&0x80)) {
	memcpy(dp, cp, optlen)__builtin_memcpy((dp), (cp), (optlen));
	dp += optlen;
}
}
for (optlen = dp - (u_char *)(jp+1); optlen & 0x3; optlen++)
*dp++ = IPOPT_EOL0;
return (optlen);
868}

870/*
* IP socket option processing.
*/
873int
874ip_ctloutput(int op, struct socket *so, int level, int optname,
  struct mbuf *m)
876{
struct inpcb *inp = sotoinpcb(so)((struct inpcb *)(so)->so_pcb);
int optval = 0;
struct proc *p = curproc({struct cpu_info *__ci; asm volatile("movq %%gs:%P1,%0" : "=r"
 (__ci) :"n" (__builtin_offsetof(struct cpu_info, ci_self)));
 __ci;})->ci_curproc; /* XXX */
int error = 0;
u_int rtableid, rtid = 0;

if (level != IPPROTO_IP0)
return (EINVAL22);

rtableid = p->p_p->ps_rtableid;

switch (op) {
case PRCO_SETOPT1:
switch (optname) {
case IP_OPTIONS1:
	return (ip_pcbopts(&inp->inp_options, m));

case IP_TOS3:
case IP_TTL4:
case IP_MINTTL32:
case IP_RECVOPTS5:
case IP_RECVRETOPTS6:
case IP_RECVDSTADDR7:
case IP_RECVIF30:
case IP_RECVTTL31:
case IP_RECVDSTPORT33:
case IP_RECVRTABLE35:
case IP_IPSECFLOWINFO36:
	if (m == NULL((void *)0) || m->m_lenm_hdr.mh_len != sizeof(int))
		error = EINVAL22;
	else {
		optval = *mtod(m, int *)((int *)((m)->m_hdr.mh_data));
		switch (optname) {

		case IP_TOS3:
			inp->inp_ipinp_hu.hu_ip.ip_tos = optval;
			break;

		case IP_TTL4:
			if (optval > 0 && optval <= MAXTTL255)
				inp->inp_ipinp_hu.hu_ip.ip_ttl = optval;
			else if (optval == -1)
				inp->inp_ipinp_hu.hu_ip.ip_ttl = ip_defttl;
			else
				error = EINVAL22;
			break;

		case IP_MINTTL32:
			if (optval >= 0 && optval <= MAXTTL255)
				inp->inp_ip_minttl = optval;
			else
				error = EINVAL22;
			break;
930#define	OPTSET(bit) \
if (optval) \
inp->inp_flags |= bit; \
else \
inp->inp_flags &= ~bit;

		case IP_RECVOPTS5:
			OPTSET(INP_RECVOPTS0x001);
			break;

		case IP_RECVRETOPTS6:
			OPTSET(INP_RECVRETOPTS0x002);
			break;

		case IP_RECVDSTADDR7:
			OPTSET(INP_RECVDSTADDR0x004);
			break;
		case IP_RECVIF30:
			OPTSET(INP_RECVIF0x080);
			break;
		case IP_RECVTTL31:
			OPTSET(INP_RECVTTL0x040);
			break;
		case IP_RECVDSTPORT33:
			OPTSET(INP_RECVDSTPORT0x200);
			break;
		case IP_RECVRTABLE35:
			OPTSET(INP_RECVRTABLE0x400);
			break;
		case IP_IPSECFLOWINFO36:
			OPTSET(INP_IPSECFLOWINFO0x800);
			break;
		}
	}
	break;
965#undef OPTSET

case IP_MULTICAST_IF9:
case IP_MULTICAST_TTL10:
case IP_MULTICAST_LOOP11:
case IP_ADD_MEMBERSHIP12:
case IP_DROP_MEMBERSHIP13:
	error = ip_setmoptions(optname, &inp->inp_moptionsinp_mou.mou_mo, m,
	    inp->inp_rtableid);
	break;

case IP_PORTRANGE19:
	if (m == NULL((void *)0) || m->m_lenm_hdr.mh_len != sizeof(int))
		error = EINVAL22;
	else {
		optval = *mtod(m, int *)((int *)((m)->m_hdr.mh_data));

		switch (optval) {

		case IP_PORTRANGE_DEFAULT0:
			inp->inp_flags &= ~(INP_LOWPORT0x020);
			inp->inp_flags &= ~(INP_HIGHPORT0x010);
			break;

		case IP_PORTRANGE_HIGH1:
			inp->inp_flags &= ~(INP_LOWPORT0x020);
			inp->inp_flags |= INP_HIGHPORT0x010;
			break;

		case IP_PORTRANGE_LOW2:
			inp->inp_flags &= ~(INP_HIGHPORT0x010);
			inp->inp_flags |= INP_LOWPORT0x020;
			break;

		default:

			error = EINVAL22;
			break;
		}
	}
	break;
case IP_AUTH_LEVEL20:
case IP_ESP_TRANS_LEVEL21:
case IP_ESP_NETWORK_LEVEL22:
case IP_IPCOMP_LEVEL29:
1010#ifndef IPSEC1
	error = EOPNOTSUPP45;
1012#else
	if (m == NULL((void *)0) || m->m_lenm_hdr.mh_len != sizeof(int)) {
		error = EINVAL22;
		break;
	}
	optval = *mtod(m, int *)((int *)((m)->m_hdr.mh_data));

	if (optval < IPSEC_LEVEL_BYPASS0x00 ||
	    optval > IPSEC_LEVEL_UNIQUE0x04) {
		error = EINVAL22;
		break;
	}

	switch (optname) {
	case IP_AUTH_LEVEL20:
		if (optval < IPSEC_AUTH_LEVEL_DEFAULT0x01 &&
		    suser(p)) {
			error = EACCES13;
			break;
		}
		inp->inp_seclevel[SL_AUTH0] = optval;
		break;

	case IP_ESP_TRANS_LEVEL21:
		if (optval < IPSEC_ESP_TRANS_LEVEL_DEFAULT0x01 &&
		    suser(p)) {
			error = EACCES13;
			break;
		}
		inp->inp_seclevel[SL_ESP_TRANS1] = optval;
		break;

	case IP_ESP_NETWORK_LEVEL22:
		if (optval < IPSEC_ESP_NETWORK_LEVEL_DEFAULT0x01 &&
		    suser(p)) {
			error = EACCES13;
			break;
		}
		inp->inp_seclevel[SL_ESP_NETWORK2] = optval;
		break;
	case IP_IPCOMP_LEVEL29:
		if (optval < IPSEC_IPCOMP_LEVEL_DEFAULT0x01 &&
		    suser(p)) {
			error = EACCES13;
			break;
		}
		inp->inp_seclevel[SL_IPCOMP3] = optval;
		break;
	}
1061#endif
	break;

case IP_IPSEC_LOCAL_ID23:
case IP_IPSEC_REMOTE_ID24:
	error = EOPNOTSUPP45;
	break;
case SO_RTABLE0x1021:
	if (m == NULL((void *)0) || m->m_lenm_hdr.mh_len < sizeof(u_int)) {
		error = EINVAL22;
		break;
	}
	rtid = *mtod(m, u_int *)((u_int *)((m)->m_hdr.mh_data));
	if (inp->inp_rtableid == rtid)
		break;
	/* needs privileges to switch when already set */
	if (rtableid != rtid && rtableid != 0 &&
	    (error = suser(p)) != 0)
		break;
	/* table must exist */
	if (!rtable_exists(rtid)) {
		error = EINVAL22;
		break;
	}
	error = in_pcbset_rtableid(inp, rtid);
	break;
case IP_PIPEX34:
	if (m != NULL((void *)0) && m->m_lenm_hdr.mh_len == sizeof(int))
		inp->inp_pipex = *mtod(m, int *)((int *)((m)->m_hdr.mh_data));
	else
		error = EINVAL22;
	break;

default:
	error = ENOPROTOOPT42;
	break;
}
break;

case PRCO_GETOPT0:
switch (optname) {
case IP_OPTIONS1:
case IP_RETOPTS8:
	if (inp->inp_options) {
		m->m_lenm_hdr.mh_len = inp->inp_options->m_lenm_hdr.mh_len;
		memcpy(mtod(m, caddr_t),__builtin_memcpy((((caddr_t)((m)->m_hdr.mh_data))), (((caddr_t
)((inp->inp_options)->m_hdr.mh_data))), (m->m_hdr.mh_len
))
		    mtod(inp->inp_options, caddr_t), m->m_len)__builtin_memcpy((((caddr_t)((m)->m_hdr.mh_data))), (((caddr_t
)((inp->inp_options)->m_hdr.mh_data))), (m->m_hdr.mh_len
));
	} else
		m->m_lenm_hdr.mh_len = 0;
	break;

case IP_TOS3:
case IP_TTL4:
case IP_MINTTL32:
case IP_RECVOPTS5:
case IP_RECVRETOPTS6:
case IP_RECVDSTADDR7:
case IP_RECVIF30:
case IP_RECVTTL31:
case IP_RECVDSTPORT33:
case IP_RECVRTABLE35:
case IP_IPSECFLOWINFO36:
case IP_IPDEFTTL37:
	m->m_lenm_hdr.mh_len = sizeof(int);
	switch (optname) {

	case IP_TOS3:
		optval = inp->inp_ipinp_hu.hu_ip.ip_tos;
		break;

	case IP_TTL4:
		optval = inp->inp_ipinp_hu.hu_ip.ip_ttl;
		break;

	case IP_MINTTL32:
		optval = inp->inp_ip_minttl;
		break;

	case IP_IPDEFTTL37:
		optval = ip_defttl;
		break;

1143#define	OPTBIT(bit)(inp->inp_flags & bit ? 1 : 0)	(inp->inp_flags & bit ? 1 : 0)

	case IP_RECVOPTS5:
		optval = OPTBIT(INP_RECVOPTS)(inp->inp_flags & 0x001 ? 1 : 0);
		break;

	case IP_RECVRETOPTS6:
		optval = OPTBIT(INP_RECVRETOPTS)(inp->inp_flags & 0x002 ? 1 : 0);
		break;

	case IP_RECVDSTADDR7:
		optval = OPTBIT(INP_RECVDSTADDR)(inp->inp_flags & 0x004 ? 1 : 0);
		break;
	case IP_RECVIF30:
		optval = OPTBIT(INP_RECVIF)(inp->inp_flags & 0x080 ? 1 : 0);
		break;
	case IP_RECVTTL31:
		optval = OPTBIT(INP_RECVTTL)(inp->inp_flags & 0x040 ? 1 : 0);
		break;
	case IP_RECVDSTPORT33:
		optval = OPTBIT(INP_RECVDSTPORT)(inp->inp_flags & 0x200 ? 1 : 0);
		break;
	case IP_RECVRTABLE35:
		optval = OPTBIT(INP_RECVRTABLE)(inp->inp_flags & 0x400 ? 1 : 0);
		break;
	case IP_IPSECFLOWINFO36:
		optval = OPTBIT(INP_IPSECFLOWINFO)(inp->inp_flags & 0x800 ? 1 : 0);
		break;
	}
	*mtod(m, int *)((int *)((m)->m_hdr.mh_data)) = optval;
	break;

case IP_MULTICAST_IF9:
case IP_MULTICAST_TTL10:
case IP_MULTICAST_LOOP11:
case IP_ADD_MEMBERSHIP12:
case IP_DROP_MEMBERSHIP13:
	error = ip_getmoptions(optname, inp->inp_moptionsinp_mou.mou_mo, m);
	break;

case IP_PORTRANGE19:
	m->m_lenm_hdr.mh_len = sizeof(int);

	if (inp->inp_flags & INP_HIGHPORT0x010)
		optval = IP_PORTRANGE_HIGH1;
	else if (inp->inp_flags & INP_LOWPORT0x020)
		optval = IP_PORTRANGE_LOW2;
	else
		optval = 0;

	*mtod(m, int *)((int *)((m)->m_hdr.mh_data)) = optval;
	break;

case IP_AUTH_LEVEL20:
case IP_ESP_TRANS_LEVEL21:
case IP_ESP_NETWORK_LEVEL22:
case IP_IPCOMP_LEVEL29:
1200#ifndef IPSEC1
	m->m_lenm_hdr.mh_len = sizeof(int);
	*mtod(m, int *)((int *)((m)->m_hdr.mh_data)) = IPSEC_LEVEL_NONE0x00;
1203#else
	m->m_lenm_hdr.mh_len = sizeof(int);
	switch (optname) {
	case IP_AUTH_LEVEL20:
		optval = inp->inp_seclevel[SL_AUTH0];
		break;

	case IP_ESP_TRANS_LEVEL21:
		optval = inp->inp_seclevel[SL_ESP_TRANS1];
		break;

	case IP_ESP_NETWORK_LEVEL22:
		optval = inp->inp_seclevel[SL_ESP_NETWORK2];
		break;
	case IP_IPCOMP_LEVEL29:
		optval = inp->inp_seclevel[SL_IPCOMP3];
		break;
	}
	*mtod(m, int *)((int *)((m)->m_hdr.mh_data)) = optval;
1222#endif
	break;
case IP_IPSEC_LOCAL_ID23:
case IP_IPSEC_REMOTE_ID24:
	error = EOPNOTSUPP45;
	break;
case SO_RTABLE0x1021:
	m->m_lenm_hdr.mh_len = sizeof(u_int);
	*mtod(m, u_int *)((u_int *)((m)->m_hdr.mh_data)) = inp->inp_rtableid;
	break;
case IP_PIPEX34:
	m->m_lenm_hdr.mh_len = sizeof(int);
	*mtod(m, int *)((int *)((m)->m_hdr.mh_data)) = inp->inp_pipex;
	break;
default:
	error = ENOPROTOOPT42;
	break;
}
break;
}
return (error);
1243}

1245/*
* Set up IP options in pcb for insertion in output packets.
* Store in mbuf with pointer in pcbopt, adding pseudo-option
* with destination address if source routed.
*/
1250int
1251ip_pcbopts(struct mbuf **pcbopt, struct mbuf *m)
1252{
struct mbuf *n;
struct ipoption *p;
int cnt, off, optlen;
u_char *cp;
u_char opt;

/* turn off any old options */
m_freem(*pcbopt);
*pcbopt = NULL((void *)0);
if (m == NULL((void *)0) || m->m_lenm_hdr.mh_len == 0) {
/*
 * Only turning off any previous options.
 */
return (0);
}

if (m->m_lenm_hdr.mh_len % sizeof(int32_t) ||
   m->m_lenm_hdr.mh_len > MAX_IPOPTLEN40 + sizeof(struct in_addr))
return (EINVAL22);

/* Don't sleep because NET_LOCK() is hold. */
if ((n = m_get(M_NOWAIT0x0002, MT_SOOPTS4)) == NULL((void *)0))
return (ENOBUFS55);
p = mtod(n, struct ipoption *)((struct ipoption *)((n)->m_hdr.mh_data));
memset(p, 0, sizeof (*p))__builtin_memset((p), (0), (sizeof (*p)));	/* 0 = IPOPT_EOL, needed for padding */
n->m_lenm_hdr.mh_len = sizeof(struct in_addr);

off = 0;
cnt = m->m_lenm_hdr.mh_len;
cp = mtod(m, u_char *)((u_char *)((m)->m_hdr.mh_data));

while (cnt > 0) {
opt = cp[IPOPT_OPTVAL0];

if (opt == IPOPT_NOP1 || opt == IPOPT_EOL0) {
	optlen = 1;
} else {
	if (cnt < IPOPT_OLEN1 + sizeof(*cp))
		goto bad;
	optlen = cp[IPOPT_OLEN1];
	if (optlen < IPOPT_OLEN1  + sizeof(*cp) || optlen > cnt)
		goto bad;
}
switch (opt) {
default:
	memcpy(p->ipopt_list + off, cp, optlen)__builtin_memcpy((p->ipopt_list + off), (cp), (optlen));
	break;

case IPOPT_LSRR131:
case IPOPT_SSRR137:
	/*
	 * user process specifies route as:
	 *	->A->B->C->D
	 * D must be our final destination (but we can't
	 * check that since we may not have connected yet).
	 * A is first hop destination, which doesn't appear in
	 * actual IP option, but is stored before the options.
	 */
	if (optlen < IPOPT_MINOFF4 - 1 + sizeof(struct in_addr))
		goto bad;

	/*
	 * Optlen is smaller because first address is popped.
	 * Cnt and cp will be adjusted a bit later to reflect
	 * this.
	 */
	optlen -= sizeof(struct in_addr);
	p->ipopt_list[off + IPOPT_OPTVAL0] = opt;
	p->ipopt_list[off + IPOPT_OLEN1] = optlen;

	/*
	 * Move first hop before start of options.
	 */
	memcpy(&p->ipopt_dst, cp + IPOPT_OFFSET,__builtin_memcpy((&p->ipopt_dst), (cp + 2), (sizeof(struct
 in_addr)))
	    sizeof(struct in_addr))__builtin_memcpy((&p->ipopt_dst), (cp + 2), (sizeof(struct
 in_addr)));
	cp += sizeof(struct in_addr);
	cnt -= sizeof(struct in_addr);
	/*
	 * Then copy rest of options
	 */
	memcpy(p->ipopt_list + off + IPOPT_OFFSET,__builtin_memcpy((p->ipopt_list + off + 2), (cp + 2), (optlen
 - 2))
	    cp + IPOPT_OFFSET, optlen - IPOPT_OFFSET)__builtin_memcpy((p->ipopt_list + off + 2), (cp + 2), (optlen
 - 2));
	break;
}
off += optlen;
cp += optlen;
cnt -= optlen;

if (opt == IPOPT_EOL0)
	break;
}
/* pad options to next word, since p was zeroed just adjust off */
off = (off + sizeof(int32_t) - 1) & ~(sizeof(int32_t) - 1);
n->m_lenm_hdr.mh_len += off;
if (n->m_lenm_hdr.mh_len > sizeof(*p)) {
bad:
m_freem(n);
return (EINVAL22);
}

*pcbopt = n;
return (0);
1355}

1357/*
* Lookup the interface based on the information in the ip_mreqn struct.
*/
1360int
1361ip_multicast_if(struct ip_mreqn *mreq, u_int rtableid, unsigned int *ifidx)
1362{
struct sockaddr_in sin;
struct rtentry *rt;

/*
* In case userland provides the imr_ifindex use this as interface.
* If no interface address was provided, use the interface of
* the route to the given multicast address.
*/
if (mreq->imr_ifindex != 0) {
*ifidx = mreq->imr_ifindex;
} else if (mreq->imr_address.s_addr == INADDR_ANY((u_int32_t) (__uint32_t)(__builtin_constant_p((u_int32_t)(0x00000000
)) ? (__uint32_t)(((__uint32_t)((u_int32_t)(0x00000000)) &
 0xff) << 24 | ((__uint32_t)((u_int32_t)(0x00000000)) &
 0xff00) << 8 | ((__uint32_t)((u_int32_t)(0x00000000)) &
 0xff0000) >> 8 | ((__uint32_t)((u_int32_t)(0x00000000)
) & 0xff000000) >> 24) : __swap32md((u_int32_t)(0x00000000
))))) {
memset(&sin, 0, sizeof(sin))__builtin_memset((&sin), (0), (sizeof(sin)));
sin.sin_len = sizeof(sin);
sin.sin_family = AF_INET2;
sin.sin_addr = mreq->imr_multiaddr;
rt = rtalloc(sintosa(&sin), RT_RESOLVE1, rtableid);
if (!rtisvalid(rt)) {
	rtfree(rt);
	return EADDRNOTAVAIL49;
}
*ifidx = rt->rt_ifidx;
rtfree(rt);
} else {
memset(&sin, 0, sizeof(sin))__builtin_memset((&sin), (0), (sizeof(sin)));
sin.sin_len = sizeof(sin);
sin.sin_family = AF_INET2;
sin.sin_addr = mreq->imr_address;
rt = rtalloc(sintosa(&sin), 0, rtableid);
if (!rtisvalid(rt) || !ISSET(rt->rt_flags, RTF_LOCAL)((rt->rt_flags) & (0x200000))) {
	rtfree(rt);
	return EADDRNOTAVAIL49;
}
*ifidx = rt->rt_ifidx;
rtfree(rt);
}

return 0;
1400}

1402/*
* Set the IP multicast options in response to user setsockopt().
*/
1405int
1406ip_setmoptions(int optname, struct ip_moptions **imop, struct mbuf *m,
  u_int rtableid)
1408{
struct in_addr addr;
struct in_ifaddr *ia;
struct ip_mreqn mreqn;
struct ifnet *ifp = NULL((void *)0);
struct ip_moptions *imo = *imop;
struct in_multi **immp;
struct sockaddr_in sin;
unsigned int ifidx;
int i, error = 0;
u_char loop;

if (imo == NULL((void *)0)) {
/*
 * No multicast option buffer attached to the pcb;
 * allocate one and initialize to default values.
 */
imo = malloc(sizeof(*imo), M_IPMOPTS53, M_WAITOK0x0001|M_ZERO0x0008);
immp = mallocarray(IP_MIN_MEMBERSHIPS15, sizeof(*immp), M_IPMOPTS53,
    M_WAITOK0x0001|M_ZERO0x0008);
*imop = imo;
imo->imo_ifidx = 0;
imo->imo_ttl = IP_DEFAULT_MULTICAST_TTL1;
imo->imo_loop = IP_DEFAULT_MULTICAST_LOOP1;
imo->imo_num_memberships = 0;
imo->imo_max_memberships = IP_MIN_MEMBERSHIPS15;
imo->imo_membership = immp;
}

switch (optname) {

case IP_MULTICAST_IF9:
/*
 * Select the interface for outgoing multicast packets.
 */
if (m == NULL((void *)0)) {
	error = EINVAL22;
	break;
}
if (m->m_lenm_hdr.mh_len == sizeof(struct in_addr)) {
	addr = *(mtod(m, struct in_addr *)((struct in_addr *)((m)->m_hdr.mh_data)));
} else if (m->m_lenm_hdr.mh_len == sizeof(struct ip_mreq) ||
    m->m_lenm_hdr.mh_len == sizeof(struct ip_mreqn)) {
	memset(&mreqn, 0, sizeof(mreqn))__builtin_memset((&mreqn), (0), (sizeof(mreqn)));
	memcpy(&mreqn, mtod(m, void *), m->m_len)__builtin_memcpy((&mreqn), (((void *)((m)->m_hdr.mh_data
))), (m->m_hdr.mh_len));

	/*
	 * If an interface index is given use this
	 * index to set the imo_ifidx but check first
	 * that the interface actually exists.
	 * In the other case just set the addr to
	 * the imr_address and fall through to the
	 * regular code.
	 */
	if (mreqn.imr_ifindex != 0) {
		ifp = if_get(mreqn.imr_ifindex);
		if (ifp == NULL((void *)0) ||
		    ifp->if_rdomainif_data.ifi_rdomain != rtable_l2(rtableid)) {
			error = EADDRNOTAVAIL49;
			if_put(ifp);
			break;
		}
		imo->imo_ifidx = ifp->if_index;
		if_put(ifp);
		break;
	} else
		addr = mreqn.imr_address;
} else {
	error = EINVAL22;
	break;
}
/*
 * INADDR_ANY is used to remove a previous selection.
 * When no interface is selected, a default one is
 * chosen every time a multicast packet is sent.
 */
if (addr.s_addr == INADDR_ANY((u_int32_t) (__uint32_t)(__builtin_constant_p((u_int32_t)(0x00000000
)) ? (__uint32_t)(((__uint32_t)((u_int32_t)(0x00000000)) &
 0xff) << 24 | ((__uint32_t)((u_int32_t)(0x00000000)) &
 0xff00) << 8 | ((__uint32_t)((u_int32_t)(0x00000000)) &
 0xff0000) >> 8 | ((__uint32_t)((u_int32_t)(0x00000000)
) & 0xff000000) >> 24) : __swap32md((u_int32_t)(0x00000000
))))) {
	imo->imo_ifidx = 0;
	break;
}
/*
 * The selected interface is identified by its local
 * IP address.  Find the interface and confirm that
 * it supports multicasting.
 */
memset(&sin, 0, sizeof(sin))__builtin_memset((&sin), (0), (sizeof(sin)));
sin.sin_len = sizeof(sin);
sin.sin_family = AF_INET2;
sin.sin_addr = addr;
ia = ifatoia(ifa_ifwithaddr(sintosa(&sin), rtableid));
if (ia == NULL((void *)0) ||
    (ia->ia_ifpia_ifa.ifa_ifp->if_flags & IFF_MULTICAST0x8000) == 0) {
	error = EADDRNOTAVAIL49;
	break;
}
imo->imo_ifidx = ia->ia_ifpia_ifa.ifa_ifp->if_index;
break;

case IP_MULTICAST_TTL10:
/*
 * Set the IP time-to-live for outgoing multicast packets.
 */
if (m == NULL((void *)0) || m->m_lenm_hdr.mh_len != 1) {
	error = EINVAL22;
	break;
}
imo->imo_ttl = *(mtod(m, u_char *)((u_char *)((m)->m_hdr.mh_data)));
break;

case IP_MULTICAST_LOOP11:
/*
 * Set the loopback flag for outgoing multicast packets.
 * Must be zero or one.
 */
if (m == NULL((void *)0) || m->m_lenm_hdr.mh_len != 1 ||
   (loop = *(mtod(m, u_char *)((u_char *)((m)->m_hdr.mh_data)))) > 1) {
	error = EINVAL22;
	break;
}
imo->imo_loop = loop;
break;

case IP_ADD_MEMBERSHIP12:
/*
 * Add a multicast group membership.
 * Group must be a valid IP multicast address.
 */
if (m == NULL((void *)0) || !(m->m_lenm_hdr.mh_len == sizeof(struct ip_mreq) ||
    m->m_lenm_hdr.mh_len == sizeof(struct ip_mreqn))) {
	error = EINVAL22;
	break;
}
memset(&mreqn, 0, sizeof(mreqn))__builtin_memset((&mreqn), (0), (sizeof(mreqn)));
memcpy(&mreqn, mtod(m, void *), m->m_len)__builtin_memcpy((&mreqn), (((void *)((m)->m_hdr.mh_data
))), (m->m_hdr.mh_len));
if (!IN_MULTICAST(mreqn.imr_multiaddr.s_addr)(((u_int32_t)(mreqn.imr_multiaddr.s_addr) & ((u_int32_t) (
__uint32_t)(__builtin_constant_p((u_int32_t)(0xf0000000)) ? (
__uint32_t)(((__uint32_t)((u_int32_t)(0xf0000000)) & 0xff
) << 24 | ((__uint32_t)((u_int32_t)(0xf0000000)) & 0xff00
) << 8 | ((__uint32_t)((u_int32_t)(0xf0000000)) & 0xff0000
) >> 8 | ((__uint32_t)((u_int32_t)(0xf0000000)) & 0xff000000
) >> 24) : __swap32md((u_int32_t)(0xf0000000))))) == ((
u_int32_t) (__uint32_t)(__builtin_constant_p((u_int32_t)(0xe0000000
)) ? (__uint32_t)(((__uint32_t)((u_int32_t)(0xe0000000)) &
 0xff) << 24 | ((__uint32_t)((u_int32_t)(0xe0000000)) &
 0xff00) << 8 | ((__uint32_t)((u_int32_t)(0xe0000000)) &
 0xff0000) >> 8 | ((__uint32_t)((u_int32_t)(0xe0000000)
) & 0xff000000) >> 24) : __swap32md((u_int32_t)(0xe0000000
)))))) {
	error = EINVAL22;
	break;
}

error = ip_multicast_if(&mreqn, rtableid, &ifidx);
if (error)
	break;

/*
 * See if we found an interface, and confirm that it
 * supports multicast.
 */
ifp = if_get(ifidx);
if (ifp == NULL((void *)0) || ifp->if_rdomainif_data.ifi_rdomain != rtable_l2(rtableid) ||
    (ifp->if_flags & IFF_MULTICAST0x8000) == 0) {
	error = EADDRNOTAVAIL49;
	if_put(ifp);
	break;
}

/*
 * See if the membership already exists or if all the
 * membership slots are full.
 */
for (i = 0; i < imo->imo_num_memberships; ++i) {
	if (imo->imo_membership[i]->inm_ifidxinm_ifma.ifma_ifidx == ifidx &&
	    imo->imo_membership[i]->inm_addrinm_sin.sin_addr.s_addr
				== mreqn.imr_multiaddr.s_addr)
		break;
}
if (i < imo->imo_num_memberships) {
	error = EADDRINUSE48;
	if_put(ifp);
	break;
}
if (imo->imo_num_memberships == imo->imo_max_memberships) {
	struct in_multi **nmships, **omships;
	size_t newmax;
	/*
	 * Resize the vector to next power-of-two minus 1. If
	 * the size would exceed the maximum then we know we've
	 * really run out of entries. Otherwise, we reallocate
	 * the vector.
	 */
	nmships = NULL((void *)0);
	omships = imo->imo_membership;
	newmax = ((imo->imo_max_memberships + 1) * 2) - 1;
	if (newmax <= IP_MAX_MEMBERSHIPS4095) {
		nmships = mallocarray(newmax, sizeof(*nmships),
		    M_IPMOPTS53, M_NOWAIT0x0002|M_ZERO0x0008);
		if (nmships != NULL((void *)0)) {
			memcpy(nmships, omships,__builtin_memcpy((nmships), (omships), (sizeof(*omships) * imo
->imo_max_memberships))
			    sizeof(*omships) *__builtin_memcpy((nmships), (omships), (sizeof(*omships) * imo
->imo_max_memberships))
			    imo->imo_max_memberships)__builtin_memcpy((nmships), (omships), (sizeof(*omships) * imo
->imo_max_memberships));
			free(omships, M_IPMOPTS53,
			    sizeof(*omships) *
			    imo->imo_max_memberships);
			imo->imo_membership = nmships;
			imo->imo_max_memberships = newmax;
		}
	}
	if (nmships == NULL((void *)0)) {
		error = ENOBUFS55;
		if_put(ifp);
		break;
	}
}
/*
 * Everything looks good; add a new record to the multicast
 * address list for the given interface.
 */
if ((imo->imo_membership[i] =
    in_addmulti(&mreqn.imr_multiaddr, ifp)) == NULL((void *)0)) {
	error = ENOBUFS55;
	if_put(ifp);
	break;
}
++imo->imo_num_memberships;
if_put(ifp);
break;

case IP_DROP_MEMBERSHIP13:
/*
 * Drop a multicast group membership.
 * Group must be a valid IP multicast address.
 */
if (m == NULL((void *)0) || !(m->m_lenm_hdr.mh_len == sizeof(struct ip_mreq) ||
    m->m_lenm_hdr.mh_len == sizeof(struct ip_mreqn))) {
	error = EINVAL22;
	break;
}
memset(&mreqn, 0, sizeof(mreqn))__builtin_memset((&mreqn), (0), (sizeof(mreqn)));
memcpy(&mreqn, mtod(m, void *), m->m_len)__builtin_memcpy((&mreqn), (((void *)((m)->m_hdr.mh_data
))), (m->m_hdr.mh_len));
if (!IN_MULTICAST(mreqn.imr_multiaddr.s_addr)(((u_int32_t)(mreqn.imr_multiaddr.s_addr) & ((u_int32_t) (
__uint32_t)(__builtin_constant_p((u_int32_t)(0xf0000000)) ? (
__uint32_t)(((__uint32_t)((u_int32_t)(0xf0000000)) & 0xff
) << 24 | ((__uint32_t)((u_int32_t)(0xf0000000)) & 0xff00
) << 8 | ((__uint32_t)((u_int32_t)(0xf0000000)) & 0xff0000
) >> 8 | ((__uint32_t)((u_int32_t)(0xf0000000)) & 0xff000000
) >> 24) : __swap32md((u_int32_t)(0xf0000000))))) == ((
u_int32_t) (__uint32_t)(__builtin_constant_p((u_int32_t)(0xe0000000
)) ? (__uint32_t)(((__uint32_t)((u_int32_t)(0xe0000000)) &
 0xff) << 24 | ((__uint32_t)((u_int32_t)(0xe0000000)) &
 0xff00) << 8 | ((__uint32_t)((u_int32_t)(0xe0000000)) &
 0xff0000) >> 8 | ((__uint32_t)((u_int32_t)(0xe0000000)
) & 0xff000000) >> 24) : __swap32md((u_int32_t)(0xe0000000
)))))) {
	error = EINVAL22;
	break;
}

/*
 * If an interface address was specified, get a pointer
 * to its ifnet structure.
 */
error = ip_multicast_if(&mreqn, rtableid, &ifidx);
if (error)
	break;

/*
 * Find the membership in the membership array.
 */
for (i = 0; i < imo->imo_num_memberships; ++i) {
	if ((ifidx == 0 ||
	    imo->imo_membership[i]->inm_ifidxinm_ifma.ifma_ifidx == ifidx) &&
	     imo->imo_membership[i]->inm_addrinm_sin.sin_addr.s_addr ==
	     mreqn.imr_multiaddr.s_addr)
		break;
}
if (i == imo->imo_num_memberships) {
	error = EADDRNOTAVAIL49;
	break;
}
/*
 * Give up the multicast address record to which the
 * membership points.
 */
in_delmulti(imo->imo_membership[i]);
/*
 * Remove the gap in the membership array.
 */
for (++i; i < imo->imo_num_memberships; ++i)
	imo->imo_membership[i-1] = imo->imo_membership[i];
--imo->imo_num_memberships;
break;

default:
error = EOPNOTSUPP45;
break;
}

/*
* If all options have default values, no need to keep the data.
*/
if (imo->imo_ifidx == 0 &&
   imo->imo_ttl == IP_DEFAULT_MULTICAST_TTL1 &&
   imo->imo_loop == IP_DEFAULT_MULTICAST_LOOP1 &&
   imo->imo_num_memberships == 0) {
free(imo->imo_membership , M_IPMOPTS53,
    imo->imo_max_memberships * sizeof(struct in_multi *));
free(*imop, M_IPMOPTS53, sizeof(**imop));
*imop = NULL((void *)0);
}

return (error);
1695}

1697/*
* Return the IP multicast options in response to user getsockopt().
*/
1700int
1701ip_getmoptions(int optname, struct ip_moptions *imo, struct mbuf *m)
1702{
u_char *ttl;
u_char *loop;
struct in_addr *addr;
struct in_ifaddr *ia;
struct ifnet *ifp;

switch (optname) {

case IP_MULTICAST_IF9:
addr = mtod(m, struct in_addr *)((struct in_addr *)((m)->m_hdr.mh_data));
m->m_lenm_hdr.mh_len = sizeof(struct in_addr);
if (imo == NULL((void *)0) || (ifp = if_get(imo->imo_ifidx)) == NULL((void *)0))
	addr->s_addr = INADDR_ANY((u_int32_t) (__uint32_t)(__builtin_constant_p((u_int32_t)(0x00000000
)) ? (__uint32_t)(((__uint32_t)((u_int32_t)(0x00000000)) &
 0xff) << 24 | ((__uint32_t)((u_int32_t)(0x00000000)) &
 0xff00) << 8 | ((__uint32_t)((u_int32_t)(0x00000000)) &
 0xff0000) >> 8 | ((__uint32_t)((u_int32_t)(0x00000000)
) & 0xff000000) >> 24) : __swap32md((u_int32_t)(0x00000000
))));
else {
	IFP_TO_IA(ifp, ia)do { struct ifaddr *ifa; do { int _s = rw_status(&netlock
); if ((splassert_ctl > 0) && (_s != 0x0001UL &&
 _s != 0x0002UL)) splassert_fail(0x0002UL, _s, __func__); } while
 (0); for((ifa) = ((&(ifp)->if_addrlist)->tqh_first
); (ifa) != ((void *)0); (ifa) = ((ifa)->ifa_list.tqe_next
)) { if (ifa->ifa_addr->sa_family == 2) break; } (ia) =
 ifatoia(ifa); } while ( 0);
	addr->s_addr = (ia == NULL((void *)0)) ? INADDR_ANY((u_int32_t) (__uint32_t)(__builtin_constant_p((u_int32_t)(0x00000000
)) ? (__uint32_t)(((__uint32_t)((u_int32_t)(0x00000000)) &
 0xff) << 24 | ((__uint32_t)((u_int32_t)(0x00000000)) &
 0xff00) << 8 | ((__uint32_t)((u_int32_t)(0x00000000)) &
 0xff0000) >> 8 | ((__uint32_t)((u_int32_t)(0x00000000)
) & 0xff000000) >> 24) : __swap32md((u_int32_t)(0x00000000
))))
			: ia->ia_addr.sin_addr.s_addr;
	if_put(ifp);
}
return (0);

case IP_MULTICAST_TTL10:
ttl = mtod(m, u_char *)((u_char *)((m)->m_hdr.mh_data));
m->m_lenm_hdr.mh_len = 1;
*ttl = (imo == NULL((void *)0)) ? IP_DEFAULT_MULTICAST_TTL1
		     : imo->imo_ttl;
return (0);

case IP_MULTICAST_LOOP11:
loop = mtod(m, u_char *)((u_char *)((m)->m_hdr.mh_data));
m->m_lenm_hdr.mh_len = 1;
*loop = (imo == NULL((void *)0)) ? IP_DEFAULT_MULTICAST_LOOP1
		      : imo->imo_loop;
return (0);

default:
return (EOPNOTSUPP45);
}
1741}

1743/*
* Discard the IP multicast options.
*/
1746void
1747ip_freemoptions(struct ip_moptions *imo)
1748{
int i;

if (imo != NULL((void *)0)) {
for (i = 0; i < imo->imo_num_memberships; ++i)
	in_delmulti(imo->imo_membership[i]);
free(imo->imo_membership, M_IPMOPTS53,
    imo->imo_max_memberships * sizeof(struct in_multi *));
free(imo, M_IPMOPTS53, sizeof(*imo));
}
1758}

1760/*
* Routine called from ip_output() to loop back a copy of an IP multicast
* packet to the input queue of a specified interface.
*/
1764void
1765ip_mloopback(struct ifnet *ifp, struct mbuf *m, struct sockaddr_in *dst)
1766{
struct mbuf *copym;

copym = m_dup_pkt(m, max_linkhdr, M_DONTWAIT0x0002);
if (copym != NULL((void *)0)) {
/*
 * We don't bother to fragment if the IP length is greater
 * than the interface's MTU.  Can this possibly matter?
 */
in_hdr_cksum_out(copym, NULL((void *)0));
if_input_local(ifp, copym, dst->sin_family);
}
1778}

1780void
1781in_hdr_cksum_out(struct mbuf *m, struct ifnet *ifp)
1782{
struct ip *ip = mtod(m, struct ip *)((struct ip *)((m)->m_hdr.mh_data));

ip->ip_sum = 0;
if (in_ifcap_cksum(m, ifp, IFCAP_CSUM_IPv40x00000001)) {
SET(m->m_pkthdr.csum_flags, M_IPV4_CSUM_OUT)((m->M_dat.MH.MH_pkthdr.csum_flags) |= (0x0001));
} else {
ipstat_inc(ips_outswcsum);
ip->ip_sum = in_cksum(m, ip->ip_hl << 2);
CLR(m->m_pkthdr.csum_flags, M_IPV4_CSUM_OUT)((m->M_dat.MH.MH_pkthdr.csum_flags) &= ~(0x0001));
}
1793}

1795/*
*	Compute significant parts of the IPv4 checksum pseudo-header
*	for use in a delayed TCP/UDP checksum calculation.
*/
1799static u_int16_t
1800in_cksum_phdr(u_int32_t src, u_int32_t dst, u_int32_t lenproto)
1801{
u_int32_t sum;

sum = lenproto +
     (u_int16_t)(src >> 16) +
     (u_int16_t)(src /*& 0xffff*/) +
     (u_int16_t)(dst >> 16) +
     (u_int16_t)(dst /*& 0xffff*/);

sum = (u_int16_t)(sum >> 16) + (u_int16_t)(sum /*& 0xffff*/);

if (sum > 0xffff)
sum -= 0xffff;

return (sum);
1816}

1818/*
* Process a delayed payload checksum calculation.
*/
1821void
1822in_delayed_cksum(struct mbuf *m)
1823{
struct ip *ip;
u_int16_t csum, offset;

ip = mtod(m, struct ip *)((struct ip *)((m)->m_hdr.mh_data));
offset = ip->ip_hl << 2;
csum = in4_cksum(m, 0, offset, m->m_pkthdrM_dat.MH.MH_pkthdr.len - offset);
if (csum == 0 && ip->ip_p == IPPROTO_UDP17)
csum = 0xffff;

switch (ip->ip_p) {
case IPPROTO_TCP6:
offset += offsetof(struct tcphdr, th_sum)__builtin_offsetof(struct tcphdr, th_sum);
break;

case IPPROTO_UDP17:
offset += offsetof(struct udphdr, uh_sum)__builtin_offsetof(struct udphdr, uh_sum);
break;

case IPPROTO_ICMP1:
offset += offsetof(struct icmp, icmp_cksum)__builtin_offsetof(struct icmp, icmp_cksum);
break;

default:
return;
}

if ((offset + sizeof(u_int16_t)) > m->m_lenm_hdr.mh_len)
m_copyback(m, offset, sizeof(csum), &csum, M_NOWAIT0x0002);
else
*(u_int16_t *)(mtod(m, caddr_t)((caddr_t)((m)->m_hdr.mh_data)) + offset) = csum;
1854}

1856void
1857in_proto_cksum_out(struct mbuf *m, struct ifnet *ifp)
1858{
struct ip *ip = mtod(m, struct ip *)((struct ip *)((m)->m_hdr.mh_data));

/* some hw and in_delayed_cksum need the pseudo header cksum */
if (m->m_pkthdrM_dat.MH.MH_pkthdr.csum_flags &
   (M_TCP_CSUM_OUT0x0002|M_UDP_CSUM_OUT0x0004|M_ICMP_CSUM_OUT0x0200)) {
u_int16_t csum = 0, offset;

offset = ip->ip_hl << 2;
if (ISSET(m->m_pkthdr.csum_flags, M_TCP_TSO)((m->M_dat.MH.MH_pkthdr.csum_flags) & (0x8000)) &&
    in_ifcap_cksum(m, ifp, IFCAP_TSOv40x00001000)) {
	csum = in_cksum_phdr(ip->ip_src.s_addr,
	    ip->ip_dst.s_addr, htonl(ip->ip_p)(__uint32_t)(__builtin_constant_p(ip->ip_p) ? (__uint32_t)
(((__uint32_t)(ip->ip_p) & 0xff) << 24 | ((__uint32_t
)(ip->ip_p) & 0xff00) << 8 | ((__uint32_t)(ip->
ip_p) & 0xff0000) >> 8 | ((__uint32_t)(ip->ip_p)
 & 0xff000000) >> 24) : __swap32md(ip->ip_p)));
} else if (ISSET(m->m_pkthdr.csum_flags,((m->M_dat.MH.MH_pkthdr.csum_flags) & (0x0002|0x0004))
    M_TCP_CSUM_OUT|M_UDP_CSUM_OUT)((m->M_dat.MH.MH_pkthdr.csum_flags) & (0x0002|0x0004))) {
	csum = in_cksum_phdr(ip->ip_src.s_addr,
	    ip->ip_dst.s_addr, htonl(ntohs(ip->ip_len) -(__uint32_t)(__builtin_constant_p((__uint16_t)(__builtin_constant_p
(ip->ip_len) ? (__uint16_t)(((__uint16_t)(ip->ip_len) &
 0xffU) << 8 | ((__uint16_t)(ip->ip_len) & 0xff00U
) >> 8) : __swap16md(ip->ip_len)) - offset + ip->
ip_p) ? (__uint32_t)(((__uint32_t)((__uint16_t)(__builtin_constant_p
(ip->ip_len) ? (__uint16_t)(((__uint16_t)(ip->ip_len) &
 0xffU) << 8 | ((__uint16_t)(ip->ip_len) & 0xff00U
) >> 8) : __swap16md(ip->ip_len)) - offset + ip->
ip_p) & 0xff) << 24 | ((__uint32_t)((__uint16_t)(__builtin_constant_p
(ip->ip_len) ? (__uint16_t)(((__uint16_t)(ip->ip_len) &
 0xffU) << 8 | ((__uint16_t)(ip->ip_len) & 0xff00U
) >> 8) : __swap16md(ip->ip_len)) - offset + ip->
ip_p) & 0xff00) << 8 | ((__uint32_t)((__uint16_t)(__builtin_constant_p
(ip->ip_len) ? (__uint16_t)(((__uint16_t)(ip->ip_len) &
 0xffU) << 8 | ((__uint16_t)(ip->ip_len) & 0xff00U
) >> 8) : __swap16md(ip->ip_len)) - offset + ip->
ip_p) & 0xff0000) >> 8 | ((__uint32_t)((__uint16_t)
(__builtin_constant_p(ip->ip_len) ? (__uint16_t)(((__uint16_t
)(ip->ip_len) & 0xffU) << 8 | ((__uint16_t)(ip->
ip_len) & 0xff00U) >> 8) : __swap16md(ip->ip_len
)) - offset + ip->ip_p) & 0xff000000) >> 24) : __swap32md
((__uint16_t)(__builtin_constant_p(ip->ip_len) ? (__uint16_t
)(((__uint16_t)(ip->ip_len) & 0xffU) << 8 | ((__uint16_t
)(ip->ip_len) & 0xff00U) >> 8) : __swap16md(ip->
ip_len)) - offset + ip->ip_p))
	    offset + ip->ip_p)(__uint32_t)(__builtin_constant_p((__uint16_t)(__builtin_constant_p
(ip->ip_len) ? (__uint16_t)(((__uint16_t)(ip->ip_len) &
 0xffU) << 8 | ((__uint16_t)(ip->ip_len) & 0xff00U
) >> 8) : __swap16md(ip->ip_len)) - offset + ip->
ip_p) ? (__uint32_t)(((__uint32_t)((__uint16_t)(__builtin_constant_p
(ip->ip_len) ? (__uint16_t)(((__uint16_t)(ip->ip_len) &
 0xffU) << 8 | ((__uint16_t)(ip->ip_len) & 0xff00U
) >> 8) : __swap16md(ip->ip_len)) - offset + ip->
ip_p) & 0xff) << 24 | ((__uint32_t)((__uint16_t)(__builtin_constant_p
(ip->ip_len) ? (__uint16_t)(((__uint16_t)(ip->ip_len) &
 0xffU) << 8 | ((__uint16_t)(ip->ip_len) & 0xff00U
) >> 8) : __swap16md(ip->ip_len)) - offset + ip->
ip_p) & 0xff00) << 8 | ((__uint32_t)((__uint16_t)(__builtin_constant_p
(ip->ip_len) ? (__uint16_t)(((__uint16_t)(ip->ip_len) &
 0xffU) << 8 | ((__uint16_t)(ip->ip_len) & 0xff00U
) >> 8) : __swap16md(ip->ip_len)) - offset + ip->
ip_p) & 0xff0000) >> 8 | ((__uint32_t)((__uint16_t)
(__builtin_constant_p(ip->ip_len) ? (__uint16_t)(((__uint16_t
)(ip->ip_len) & 0xffU) << 8 | ((__uint16_t)(ip->
ip_len) & 0xff00U) >> 8) : __swap16md(ip->ip_len
)) - offset + ip->ip_p) & 0xff000000) >> 24) : __swap32md
((__uint16_t)(__builtin_constant_p(ip->ip_len) ? (__uint16_t
)(((__uint16_t)(ip->ip_len) & 0xffU) << 8 | ((__uint16_t
)(ip->ip_len) & 0xff00U) >> 8) : __swap16md(ip->
ip_len)) - offset + ip->ip_p)));
}
if (ip->ip_p == IPPROTO_TCP6)
	offset += offsetof(struct tcphdr, th_sum)__builtin_offsetof(struct tcphdr, th_sum);
else if (ip->ip_p == IPPROTO_UDP17)
	offset += offsetof(struct udphdr, uh_sum)__builtin_offsetof(struct udphdr, uh_sum);
else if (ip->ip_p == IPPROTO_ICMP1)
	offset += offsetof(struct icmp, icmp_cksum)__builtin_offsetof(struct icmp, icmp_cksum);
if ((offset + sizeof(u_int16_t)) > m->m_lenm_hdr.mh_len)
	m_copyback(m, offset, sizeof(csum), &csum, M_NOWAIT0x0002);
else
	*(u_int16_t *)(mtod(m, caddr_t)((caddr_t)((m)->m_hdr.mh_data)) + offset) = csum;
}

if (m->m_pkthdrM_dat.MH.MH_pkthdr.csum_flags & M_TCP_CSUM_OUT0x0002) {
if (!in_ifcap_cksum(m, ifp, IFCAP_CSUM_TCPv40x00000002) ||
    ip->ip_hl != 5) {
	tcpstat_inc(tcps_outswcsum);
	in_delayed_cksum(m);
	m->m_pkthdrM_dat.MH.MH_pkthdr.csum_flags &= ~M_TCP_CSUM_OUT0x0002; /* Clear */
}
} else if (m->m_pkthdrM_dat.MH.MH_pkthdr.csum_flags & M_UDP_CSUM_OUT0x0004) {
if (!in_ifcap_cksum(m, ifp, IFCAP_CSUM_UDPv40x00000004) ||
    ip->ip_hl != 5) {
	udpstat_inc(udps_outswcsum);
	in_delayed_cksum(m);
	m->m_pkthdrM_dat.MH.MH_pkthdr.csum_flags &= ~M_UDP_CSUM_OUT0x0004; /* Clear */
}
} else if (m->m_pkthdrM_dat.MH.MH_pkthdr.csum_flags & M_ICMP_CSUM_OUT0x0200) {
in_delayed_cksum(m);
m->m_pkthdrM_dat.MH.MH_pkthdr.csum_flags &= ~M_ICMP_CSUM_OUT0x0200; /* Clear */
}
1907}

1909int
1910in_ifcap_cksum(struct mbuf *m, struct ifnet *ifp, int ifcap)
1911{
if ((ifp == NULL((void *)0)) ||
   !ISSET(ifp->if_capabilities, ifcap)((ifp->if_data.ifi_capabilities) & (ifcap)) ||
   (ifp->if_bridgeidx != 0))
return (0);
/*
* Simplex interface sends packet back without hardware cksum.
* Keep this check in sync with the condition where ether_resolve()
* calls if_input_local().
*/
if (ISSET(m->m_flags, M_BCAST)((m->m_hdr.mh_flags) & (0x0100)) &&
   ISSET(ifp->if_flags, IFF_SIMPLEX)((ifp->if_flags) & (0x800)) &&
   !m->m_pkthdrM_dat.MH.MH_pkthdr.pf.routed)
return (0);
return (1);
1926}