/usr/src/usr.sbin/mrouted/route.c

Bug Summary

File:	src/usr.sbin/mrouted/route.c
Warning:	line 291, column 22 Access to field 'rt_origin' results in a dereference of a null pointer (loaded from variable 'r')
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name route.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/usr.sbin/mrouted/obj -resource-dir /usr/local/lib/clang/13.0.0 -I /usr/src/usr.sbin/mrouted -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/usr.sbin/mrouted/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/usr.sbin/mrouted/route.c
1/*	$NetBSD: route.c,v 1.5 1995/12/10 10:07:12 mycroft Exp $	*/

3/*
* The mrouted program is covered by the license in the accompanying file
* named "LICENSE".  Use of the mrouted program represents acceptance of
* the terms and conditions listed in that file.
*
* The mrouted program is COPYRIGHT 1989 by The Board of Trustees of
* Leland Stanford Junior University.
*/


13#include "defs.h"


16/*
* This define statement saves a lot of space later
*/
19#define RT_ADDR(struct rtentry *)&routing_table	(struct rtentry *)&routing_table

21/*
* Exported variables.
*/
24int routes_changed;			/* 1=>some routes have changed */
25int delay_change_reports;		/* 1=>postpone change reports  */


28/*
* The routing table is shared with prune.c , so must not be static.
*/
31struct rtentry *routing_table;		/* pointer to list of route entries */

33/*
* Private variables.
*/
36static struct rtentry *rtp;		/* pointer to a route entry         */
37static struct rtentry *rt_end;		/* pointer to last route entry      */
38unsigned int nroutes;			/* current number of route entries  */

40/*
* Private functions.
*/
43static int init_children_and_leaves(struct rtentry *r, vifi_t parent);
44static int find_route(u_int32_t origin, u_int32_t mask);
45static void create_route(u_int32_t origin, u_int32_t mask);
46static void discard_route(struct rtentry *prev_r);
47static int compare_rts(const void *rt1, const void *rt2);
48static int report_chunk(struct rtentry *start_rt, vifi_t vifi, u_int32_t dst);

50/*
* Initialize the routing table and associated variables.
*/
53void
54init_routes()
55{
  routing_table        = NULL((void *)0);
  rt_end		 = RT_ADDR(struct rtentry *)&routing_table;
  nroutes		 = 0;
  routes_changed       = FALSE0;
  delay_change_reports = FALSE0;
61}


64/*
* Initialize the children and leaf bits for route 'r', along with the
* associated dominant, subordinate, and leaf timing data structures.
* Return TRUE if this changes the value of either the children or
* leaf bitmaps for 'r'.
*/
70static int
71init_children_and_leaves(struct rtentry *r, vifi_t parent)
72{
  vifi_t vifi;
  struct uvif *v;
  vifbitmap_t old_children, old_leaves;

  VIFM_COPY(r->rt_children, old_children)((old_children) = (r->rt_children));
  VIFM_COPY(r->rt_leaves,   old_leaves  )((old_leaves) = (r->rt_leaves));

  VIFM_CLRALL(r->rt_children)((r->rt_children) = 0x00000000);
  VIFM_CLRALL(r->rt_leaves)((r->rt_leaves) = 0x00000000);
  r->rt_flags &= ~RTF_LEAF_TIMING0x02;

  for (vifi = 0, v = uvifs; vifi < numvifs; ++vifi, ++v) {
r->rt_dominants   [vifi] = 0;
r->rt_subordinates[vifi] = 0;

if (vifi != parent && !(v->uv_flags & (VIFF_DOWN0x0100|VIFF_DISABLED0x0200))) {
   VIFM_SET(vifi, r->rt_children)((r->rt_children) |= (1 << (vifi)));
   if (v->uv_neighbors == NULL((void *)0)) {
VIFM_SET(vifi, r->rt_leaves)((r->rt_leaves) |= (1 << (vifi)));
r->rt_leaf_timers[vifi] = 0;
   }
   else {
r->rt_leaf_timers[vifi] = LEAF_CONFIRMATION_TIME200;
r->rt_flags |= RTF_LEAF_TIMING0x02;
   }
}
else {
   r->rt_leaf_timers[vifi] = 0;
}
  }

  return (!VIFM_SAME(r->rt_children, old_children)((r->rt_children) == (old_children)) ||
   !VIFM_SAME(r->rt_leaves,   old_leaves)((r->rt_leaves) == (old_leaves)));
106}


109/*
* A new vif has come up -- update the children and leaf bitmaps in all route
* entries to take that into account.
*/
113void
114add_vif_to_routes(vifi_t vifi)
115{
  struct rtentry *r;
  struct uvif *v;

  v = &uvifs[vifi];
  for (r = routing_table; r != NULL((void *)0); r = r->rt_next) {
if (r->rt_metric != UNREACHABLE32 &&
   !VIFM_ISSET(vifi, r->rt_children)((r->rt_children) & (1 << (vifi)))) {
   VIFM_SET(vifi, r->rt_children)((r->rt_children) |= (1 << (vifi)));
   r->rt_dominants   [vifi] = 0;
   r->rt_subordinates[vifi] = 0;
   if (v->uv_neighbors == NULL((void *)0)) {
VIFM_SET(vifi, r->rt_leaves)((r->rt_leaves) |= (1 << (vifi)));
r->rt_leaf_timers[vifi] = 0;
   }
   else {
VIFM_CLR(vifi, r->rt_leaves)((r->rt_leaves) &= ~(1 << (vifi)));
r->rt_leaf_timers[vifi] = LEAF_CONFIRMATION_TIME200;
r->rt_flags |= RTF_LEAF_TIMING0x02;
   }
   update_table_entry(r);
}
  }
138}


141/*
* A vif has gone down -- expire all routes that have that vif as parent,
* and update the children bitmaps in all other route entries to take into
* account the failed vif.
*/
146void
147delete_vif_from_routes(vifi_t vifi)
148{
  struct rtentry *r;

  for (r = routing_table; r != NULL((void *)0); r = r->rt_next) {
if (r->rt_metric != UNREACHABLE32) {
   if (vifi == r->rt_parent) {
del_table_entry(r, 0, DEL_ALL_ROUTES1);
r->rt_timer    = ROUTE_EXPIRE_TIME200;
r->rt_metric   = UNREACHABLE32;
r->rt_flags   |= RTF_CHANGED0x01;
routes_changed = TRUE1;
   }
   else if (VIFM_ISSET(vifi, r->rt_children)((r->rt_children) & (1 << (vifi)))) {
VIFM_CLR(vifi, r->rt_children)((r->rt_children) &= ~(1 << (vifi)));
VIFM_CLR(vifi, r->rt_leaves)((r->rt_leaves) &= ~(1 << (vifi)));
r->rt_subordinates[vifi] = 0;
r->rt_leaf_timers [vifi] = 0;
update_table_entry(r);
   }
   else {
r->rt_dominants[vifi] = 0;
   }
}
  }
172}


175/*
* A neighbor has failed or become unreachable.  If that neighbor was
* considered a dominant or subordinate router in any route entries,
* take appropriate action.
*/
180void
181delete_neighbor_from_routes(u_int32_t addr, vifi_t vifi)
182{
  struct rtentry *r;
  struct uvif *v;

  v = &uvifs[vifi];
  for (r = routing_table; r != NULL((void *)0); r = r->rt_next) {
if (r->rt_metric != UNREACHABLE32) {
   if (r->rt_dominants[vifi] == addr) {
VIFM_SET(vifi, r->rt_children)((r->rt_children) |= (1 << (vifi)));
r->rt_dominants   [vifi] = 0;
r->rt_subordinates[vifi] = 0;
if (v->uv_neighbors == NULL((void *)0)) {
    VIFM_SET(vifi, r->rt_leaves)((r->rt_leaves) |= (1 << (vifi)));
    r->rt_leaf_timers[vifi] = 0;
}
else {
    VIFM_CLR(vifi, r->rt_leaves)((r->rt_leaves) &= ~(1 << (vifi)));
    r->rt_leaf_timers[vifi] = LEAF_CONFIRMATION_TIME200;
    r->rt_flags |= RTF_LEAF_TIMING0x02;
}
update_table_entry(r);
   }
   else if (r->rt_subordinates[vifi] == addr) {
r->rt_subordinates[vifi] = 0;
if (v->uv_neighbors == NULL((void *)0)) {
    VIFM_SET(vifi, r->rt_leaves)((r->rt_leaves) |= (1 << (vifi)));
    update_table_entry(r);
}
else {
    r->rt_leaf_timers[vifi] = LEAF_CONFIRMATION_TIME200;
    r->rt_flags |= RTF_LEAF_TIMING0x02;
}
   }
   else if (v->uv_neighbors == NULL((void *)0) &&
     r->rt_leaf_timers[vifi] != 0) {
VIFM_SET(vifi, r->rt_leaves)((r->rt_leaves) |= (1 << (vifi)));
r->rt_leaf_timers[vifi] = 0;
update_table_entry(r);
   }
}
  }
223}


226/*
* Prepare for a sequence of ordered route updates by initializing a pointer
* to the start of the routing table.  The pointer is used to remember our
* position in the routing table in order to avoid searching from the
* beginning for each update; this relies on having the route reports in
* a single message be in the same order as the route entries in the routing
* table.
*/
234void
235start_route_updates(void)
236{
  rtp = RT_ADDR(struct rtentry *)&routing_table;
238}


241/*
* Starting at the route entry following the one to which 'rtp' points,
* look for a route entry matching the specified origin and mask.  If a
* match is found, return TRUE and leave 'rtp' pointing at the found entry.
* If no match is found, return FALSE and leave 'rtp' pointing to the route
* entry preceding the point at which the new origin should be inserted.
* This code is optimized for the normal case in which the first entry to
* be examined is the matching entry.
*/
250static int
251find_route(u_int32_t origin, u_int32_t mask)
252{
  struct rtentry *r;

  r = rtp->rt_next;
  while (r != NULL((void *)0)) {
if (origin == r->rt_origin && mask == r->rt_originmask) {
   rtp = r;
   return (TRUE1);
}
if (ntohl(mask)(__uint32_t)(__builtin_constant_p(mask) ? (__uint32_t)(((__uint32_t
)(mask) & 0xff) << 24 | ((__uint32_t)(mask) & 0xff00
) << 8 | ((__uint32_t)(mask) & 0xff0000) >> 8
 | ((__uint32_t)(mask) & 0xff000000) >> 24) : __swap32md
(mask)) < ntohl(r->rt_originmask)(__uint32_t)(__builtin_constant_p(r->rt_originmask) ? (__uint32_t
)(((__uint32_t)(r->rt_originmask) & 0xff) << 24 |
 ((__uint32_t)(r->rt_originmask) & 0xff00) << 8 |
 ((__uint32_t)(r->rt_originmask) & 0xff0000) >> 8
 | ((__uint32_t)(r->rt_originmask) & 0xff000000) >>
 24) : __swap32md(r->rt_originmask)) ||
   (mask == r->rt_originmask &&
    ntohl(origin)(__uint32_t)(__builtin_constant_p(origin) ? (__uint32_t)(((__uint32_t
)(origin) & 0xff) << 24 | ((__uint32_t)(origin) &
 0xff00) << 8 | ((__uint32_t)(origin) & 0xff0000) >>
| ((__uint32_t)(origin) & 0xff000000) >> 24) : __swap32md
(origin)) < ntohl(r->rt_origin)(__uint32_t)(__builtin_constant_p(r->rt_origin) ? (__uint32_t
)(((__uint32_t)(r->rt_origin) & 0xff) << 24 | ((
__uint32_t)(r->rt_origin) & 0xff00) << 8 | ((__uint32_t
)(r->rt_origin) & 0xff0000) >> 8 | ((__uint32_t)
(r->rt_origin) & 0xff000000) >> 24) : __swap32md
(r->rt_origin)))) {
   rtp = r;
   r = r->rt_next;
}
else break;
  }
  return (FALSE0);
270}

272/*
* Create a new routing table entry for the specified origin and link it into
* the routing table.  The shared variable 'rtp' is assumed to point to the
* routing entry after which the new one should be inserted.  It is left
* pointing to the new entry.
*
* Only the origin, originmask, originwidth and flags fields are initialized
* in the new route entry; the caller is responsible for filling in the rest.
*/
281static void
282create_route(u_int32_t origin, u_int32_t mask)
283{
  struct rtentry *r;

  if ((r = malloc(sizeof(struct rtentry) +
39
←
Value assigned to 'r'→
40
←
Assuming pointer value is null→
41
←
Taking true branch→
(2 * numvifs * sizeof(u_int32_t)) +
(numvifs * sizeof(u_int)))) == NULL((void *)0)) {
logit(LOG_ERR3, 0, "ran out of memory");	/* fatal */
  }
  r->rt_origin     = origin;
42
←
Access to field 'rt_origin' results in a dereference of a null pointer (loaded from variable 'r')
  r->rt_originmask = mask;
  if      (((char *)&mask)[3] != 0) r->rt_originwidth = 4;
  else if (((char *)&mask)[2] != 0) r->rt_originwidth = 3;
  else if (((char *)&mask)[1] != 0) r->rt_originwidth = 2;
  else                              r->rt_originwidth = 1;
  r->rt_flags        = 0;
  r->rt_dominants    = (u_int32_t *)(r + 1);
  r->rt_subordinates = (u_int32_t *)(r->rt_dominants + numvifs);
  r->rt_leaf_timers  = (u_int *)(r->rt_subordinates + numvifs);
  r->rt_groups       = NULL((void *)0);

  r->rt_next = rtp->rt_next;
  rtp->rt_next = r;
  r->rt_prev = rtp;
  if (r->rt_next != NULL((void *)0))
    (r->rt_next)->rt_prev = r;
  else
    rt_end = r;
  rtp = r;
  ++nroutes;
312}


315/*
* Discard the routing table entry following the one to which 'prev_r' points.
*/
318static void
319discard_route(struct rtentry *prev_r)
320{
  struct rtentry *r;

  r = prev_r->rt_next;
  prev_r->rt_next = r->rt_next;
  if (prev_r->rt_next != NULL((void *)0))
    (prev_r->rt_next)->rt_prev = prev_r;
  else
    rt_end = prev_r;
  free((char *)r);
  --nroutes;
331}


334/*
* Process a route report for a single origin, creating or updating the
* corresponding routing table entry if necessary.  'src' is either the
* address of a neighboring router from which the report arrived, or zero
* to indicate a change of status of one of our own interfaces.
*/
340void
341update_route(u_int32_t origin, u_int32_t mask, u_int metric, u_int32_t src,
  vifi_t vifi)
343{
  struct rtentry *r;
  u_int adj_metric;

  /*
   * Compute an adjusted metric, taking into account the cost of the
   * subnet or tunnel over which the report arrived, and normalizing
   * all unreachable/poisoned metrics into a single value.
   */
  if (src != 0 && (metric < 1 || metric >= 2*UNREACHABLE32)) {
32
←
Assuming 'src' is equal to 0→
logit(LOG_WARNING4, 0,
   "%s reports out-of-range metric %u for origin %s",
   inet_fmt(src, s1), metric, inet_fmts(origin, mask, s2));
return;
  }
  adj_metric = metric + uvifs[vifi].uv_metric;
  if (adj_metric > UNREACHABLE32) adj_metric = UNREACHABLE32;
33
←
Assuming 'adj_metric' is <= UNREACHABLE→
34
←
Taking false branch→

  /*
   * Look up the reported origin in the routing table.
   */
  if (!find_route(origin, mask)) {
35
←
Taking true branch→
/*
* Not found.
* Don't create a new entry if the report says it's unreachable,
* or if the reported origin and mask are invalid.
*/
if (adj_metric == UNREACHABLE32) {
36
←
Assuming 'adj_metric' is not equal to UNREACHABLE→
37
←
Taking false branch→
   return;
}
if (src37.1
'src' is equal to 0
 != 0 && !inet_valid_subnet(origin, mask)) {
   logit(LOG_WARNING4, 0,
"%s reports an invalid origin (%s) and/or mask (%08x)",
inet_fmt(src, s1), inet_fmt(origin, s2), ntohl(mask)(__uint32_t)(__builtin_constant_p(mask) ? (__uint32_t)(((__uint32_t
)(mask) & 0xff) << 24 | ((__uint32_t)(mask) & 0xff00
) << 8 | ((__uint32_t)(mask) & 0xff0000) >> 8
 | ((__uint32_t)(mask) & 0xff000000) >> 24) : __swap32md
(mask)));
   return;
}

/*
* OK, create the new routing entry.  'rtp' will be left pointing
* to the new entry.
*/
create_route(origin, mask);
38
←
Calling 'create_route'→

/*
* Now "steal away" any sources that belong under this route
* by deleting any cache entries they might have created
* and allowing the kernel to re-request them.
*/
steal_sources(rtp);

rtp->rt_metric = UNREACHABLE32;	/* temporary; updated below */
  }

  /*
   * We now have a routing entry for the reported origin.  Update it?
   */
  r = rtp;
  if (r->rt_metric == UNREACHABLE32) {
/*
* The routing entry is for a formerly-unreachable or new origin.
* If the report claims reachability, update the entry to use
* the reported route.
*/
if (adj_metric == UNREACHABLE32)
   return;

r->rt_parent   = vifi;
init_children_and_leaves(r, vifi);

r->rt_gateway  = src;
r->rt_timer    = 0;
r->rt_metric   = adj_metric;
r->rt_flags   |= RTF_CHANGED0x01;
routes_changed = TRUE1;
update_table_entry(r);
  }
  else if (src == r->rt_gateway) {
/*
* The report has come either from the interface directly-connected
* to the origin subnet (src and r->rt_gateway both equal zero) or
* from the gateway we have chosen as the best first-hop gateway back
* towards the origin (src and r->rt_gateway not equal zero).  Reset
* the route timer and, if the reported metric has changed, update
* our entry accordingly.
*/
r->rt_timer = 0;
if (adj_metric == r->rt_metric)
   return;

if (adj_metric == UNREACHABLE32) {
   del_table_entry(r, 0, DEL_ALL_ROUTES1);
   r->rt_timer = ROUTE_EXPIRE_TIME200;
}
else if (adj_metric < r->rt_metric) {
   if (init_children_and_leaves(r, vifi)) {
update_table_entry(r);
   }
}
r->rt_metric   = adj_metric;
r->rt_flags   |= RTF_CHANGED0x01;
routes_changed = TRUE1;
  }
  else if (src == 0 ||
    (r->rt_gateway != 0 &&
     (adj_metric < r->rt_metric ||
      (adj_metric == r->rt_metric &&
(ntohl(src)(__uint32_t)(__builtin_constant_p(src) ? (__uint32_t)(((__uint32_t
)(src) & 0xff) << 24 | ((__uint32_t)(src) & 0xff00
) << 8 | ((__uint32_t)(src) & 0xff0000) >> 8 |
 ((__uint32_t)(src) & 0xff000000) >> 24) : __swap32md
(src)) < ntohl(r->rt_gateway)(__uint32_t)(__builtin_constant_p(r->rt_gateway) ? (__uint32_t
)(((__uint32_t)(r->rt_gateway) & 0xff) << 24 | (
(__uint32_t)(r->rt_gateway) & 0xff00) << 8 | ((__uint32_t
)(r->rt_gateway) & 0xff0000) >> 8 | ((__uint32_t
)(r->rt_gateway) & 0xff000000) >> 24) : __swap32md
(r->rt_gateway)) ||
 r->rt_timer >= ROUTE_SWITCH_TIME140))))) {
/*
* The report is for an origin we consider reachable; the report
* comes either from one of our own interfaces or from a gateway
* other than the one we have chosen as the best first-hop gateway
* back towards the origin.  If the source of the update is one of
* our own interfaces, or if the origin is not a directly-connected
* subnet and the reported metric for that origin is better than
* what our routing entry says, update the entry to use the new
* gateway and metric.  We also switch gateways if the reported
* metric is the same as the one in the route entry and the gateway
* associated with the route entry has not been heard from recently,
* or if the metric is the same but the reporting gateway has a lower
* IP address than the gateway associated with the route entry.
* Did you get all that?
*/
if (r->rt_parent != vifi || adj_metric < r->rt_metric) {
   /*
    * XXX Why do we do this if we are just changing the metric?
    */
   r->rt_parent = vifi;
   if (init_children_and_leaves(r, vifi)) {
update_table_entry(r);
   }
}
r->rt_gateway  = src;
r->rt_timer    = 0;
r->rt_metric   = adj_metric;
r->rt_flags   |= RTF_CHANGED0x01;
routes_changed = TRUE1;
  }
  else if (vifi != r->rt_parent) {
/*
* The report came from a vif other than the route's parent vif.
* Update the children and leaf info, if necessary.
*/
if (VIFM_ISSET(vifi, r->rt_children)((r->rt_children) & (1 << (vifi)))) {
   /*
    * Vif is a child vif for this route.
    */
   if (metric  < r->rt_metric ||
(metric == r->rt_metric &&
 ntohl(src)(__uint32_t)(__builtin_constant_p(src) ? (__uint32_t)(((__uint32_t
)(src) & 0xff) << 24 | ((__uint32_t)(src) & 0xff00
) << 8 | ((__uint32_t)(src) & 0xff0000) >> 8 |
 ((__uint32_t)(src) & 0xff000000) >> 24) : __swap32md
(src)) < ntohl(uvifs[vifi].uv_lcl_addr)(__uint32_t)(__builtin_constant_p(uvifs[vifi].uv_lcl_addr) ? (
__uint32_t)(((__uint32_t)(uvifs[vifi].uv_lcl_addr) & 0xff
) << 24 | ((__uint32_t)(uvifs[vifi].uv_lcl_addr) & 0xff00
) << 8 | ((__uint32_t)(uvifs[vifi].uv_lcl_addr) & 0xff0000
) >> 8 | ((__uint32_t)(uvifs[vifi].uv_lcl_addr) & 0xff000000
) >> 24) : __swap32md(uvifs[vifi].uv_lcl_addr)))) {
/*
 * Neighbor has lower metric to origin (or has same metric
 * and lower IP address) -- it becomes the dominant router,
 * and vif is no longer a child for me.
 */
VIFM_CLR(vifi, r->rt_children)((r->rt_children) &= ~(1 << (vifi)));
VIFM_CLR(vifi, r->rt_leaves)((r->rt_leaves) &= ~(1 << (vifi)));
r->rt_dominants   [vifi] = src;
r->rt_subordinates[vifi] = 0;
r->rt_leaf_timers [vifi] = 0;
update_table_entry(r);
   }
   else if (metric > UNREACHABLE32) {	/* "poisoned reverse" */
/*
 * Neighbor considers this vif to be on path to route's
 * origin; if no subordinate recorded, record this neighbor
 * as subordinate and clear the leaf flag.
 */
if (r->rt_subordinates[vifi] == 0) {
    VIFM_CLR(vifi, r->rt_leaves)((r->rt_leaves) &= ~(1 << (vifi)));
    r->rt_subordinates[vifi] = src;
    r->rt_leaf_timers [vifi] = 0;
    update_table_entry(r);
}
   }
   else if (src == r->rt_subordinates[vifi]) {
/*
 * Current subordinate no longer considers this vif to be on
 * path to route's origin; it is no longer a subordinate
 * router, and we set the leaf confirmation timer to give
 * us time to hear from other subordinates.
 */
r->rt_subordinates[vifi] = 0;
if (uvifs[vifi].uv_neighbors == NULL((void *)0) ||
    uvifs[vifi].uv_neighbors->al_next == NULL((void *)0)) {
    VIFM_SET(vifi, r->rt_leaves)((r->rt_leaves) |= (1 << (vifi)));
    update_table_entry(r);
}
else {
    r->rt_leaf_timers [vifi] = LEAF_CONFIRMATION_TIME200;
    r->rt_flags |= RTF_LEAF_TIMING0x02;
}
   }

}
else if (src == r->rt_dominants[vifi] &&
 (metric  > r->rt_metric ||
  (metric == r->rt_metric &&
   ntohl(src)(__uint32_t)(__builtin_constant_p(src) ? (__uint32_t)(((__uint32_t
)(src) & 0xff) << 24 | ((__uint32_t)(src) & 0xff00
) << 8 | ((__uint32_t)(src) & 0xff0000) >> 8 |
 ((__uint32_t)(src) & 0xff000000) >> 24) : __swap32md
(src)) > ntohl(uvifs[vifi].uv_lcl_addr)(__uint32_t)(__builtin_constant_p(uvifs[vifi].uv_lcl_addr) ? (
__uint32_t)(((__uint32_t)(uvifs[vifi].uv_lcl_addr) & 0xff
) << 24 | ((__uint32_t)(uvifs[vifi].uv_lcl_addr) & 0xff00
) << 8 | ((__uint32_t)(uvifs[vifi].uv_lcl_addr) & 0xff0000
) >> 8 | ((__uint32_t)(uvifs[vifi].uv_lcl_addr) & 0xff000000
) >> 24) : __swap32md(uvifs[vifi].uv_lcl_addr))))) {
   /*
    * Current dominant no longer has a lower metric to origin
    * (or same metric and lower IP address); we adopt the vif
    * as our own child.
    */
   VIFM_SET(vifi, r->rt_children)((r->rt_children) |= (1 << (vifi)));
   r->rt_dominants  [vifi] = 0;
   if (metric > UNREACHABLE32) {
r->rt_subordinates[vifi] = src;
   }
   else if (uvifs[vifi].uv_neighbors == NULL((void *)0) ||
     uvifs[vifi].uv_neighbors->al_next == NULL((void *)0)) {
VIFM_SET(vifi, r->rt_leaves)((r->rt_leaves) |= (1 << (vifi)));
   }
   else {
r->rt_leaf_timers[vifi] = LEAF_CONFIRMATION_TIME200;
r->rt_flags |= RTF_LEAF_TIMING0x02;
   }
   update_table_entry(r);
}
  }
563}


566/*
* On every timer interrupt, advance the timer in each routing entry.
*/
569void
570age_routes(void)
571{
  struct rtentry *r;
  struct rtentry *prev_r;
  vifi_t vifi;

  for (prev_r = RT_ADDR(struct rtentry *)&routing_table, r = routing_table;
r != NULL((void *)0);
prev_r = r, r = r->rt_next) {

if ((r->rt_timer += TIMER_INTERVAL5) < ROUTE_EXPIRE_TIME200) {
   /*
    * Route is still good; see if any leaf timers need to be
    * advanced.
    */
   if (r->rt_flags & RTF_LEAF_TIMING0x02) {
r->rt_flags &= ~RTF_LEAF_TIMING0x02;
for (vifi = 0; vifi < numvifs; ++vifi) {
    if (r->rt_leaf_timers[vifi] != 0) {
	/*
	 * Unlike other timers, leaf timers decrement.
	 */
	if ((r->rt_leaf_timers[vifi] -= TIMER_INTERVAL5) == 0){
593#ifdef NOTYET
	    /* If the vif is a physical leaf but has neighbors,
	     * it is not a tree leaf.  If I am a leaf, then no
	     * interface with neighbors is a tree leaf. */
	    if (!(((uvifs[vifi].uv_flags & VIFF_LEAF0x1000) ||
		   (vifs_with_neighbors == 1)) &&
		  (uvifs[vifi].uv_neighbors != NULL((void *)0)))) {
600#endif
		VIFM_SET(vifi, r->rt_leaves)((r->rt_leaves) |= (1 << (vifi)));
		update_table_entry(r);
603#ifdef NOTYET
	    }
605#endif
	}
	else {
	    r->rt_flags |= RTF_LEAF_TIMING0x02;
	}
    }
}
   }
}
else if (r->rt_timer >= ROUTE_DISCARD_TIME340) {
   /*
    * Time to garbage-collect the route entry.
    */
   del_table_entry(r, 0, DEL_ALL_ROUTES1);
   discard_route(prev_r);
   r = prev_r;
}
else if (r->rt_metric != UNREACHABLE32) {
   /*
    * Time to expire the route entry.  If the gateway is zero,
    * i.e., it is a route to a directly-connected subnet, just
    * set the timer back to zero; such routes expire only when
    * the interface to the subnet goes down.
    */
   if (r->rt_gateway == 0) {
r->rt_timer = 0;
   }
   else {
del_table_entry(r, 0, DEL_ALL_ROUTES1);
r->rt_metric   = UNREACHABLE32;
r->rt_flags   |= RTF_CHANGED0x01;
routes_changed = TRUE1;
   }
}
  }
640}


643/*
* Mark all routes as unreachable.  This function is called only from
* hup() in preparation for informing all neighbors that we are going
* off the air.  For consistency, we ought also to delete all reachable
* route entries from the kernel, but since we are about to exit we rely
* on the kernel to do its own cleanup -- no point in making all those
* expensive kernel calls now.
*/
651void
652expire_all_routes(void)
653{
  struct rtentry *r;

  for (r = routing_table; r != NULL((void *)0); r = r->rt_next) {
r->rt_metric   = UNREACHABLE32;
r->rt_flags   |= RTF_CHANGED0x01;
routes_changed = TRUE1;
  }
661}


664/*
* Delete all the routes in the routing table.
*/
667void
668free_all_routes(void)
669{
  struct rtentry *r;

  r = RT_ADDR(struct rtentry *)&routing_table;

  while (r->rt_next)
discard_route(r);
676}


679/*
* Process an incoming neighbor probe message.
*/
682void
683accept_probe(u_int32_t src, u_int32_t dst, char *p, int datalen,
  u_int32_t level)
685{
  vifi_t vifi;

  if ((vifi = find_vif(src, dst)) == NO_VIF((vifi_t)32)) {
logit(LOG_INFO6, 0,
   "ignoring probe from non-neighbor %s", inet_fmt(src, s1));
return;
  }

  update_neighbor(vifi, src, DVMRP_PROBE1, p, datalen, level);
695}

697struct newrt {
u_int32_t mask;
u_int32_t origin;
int metric;
int pad;
702};

704static int
705compare_rts(const void *rt1, const void *rt2)
706{
  struct newrt *r1 = (struct newrt *)rt1;
  struct newrt *r2 = (struct newrt *)rt2;
  u_int32_t m1 = ntohl(r1->mask)(__uint32_t)(__builtin_constant_p(r1->mask) ? (__uint32_t)
(((__uint32_t)(r1->mask) & 0xff) << 24 | ((__uint32_t
)(r1->mask) & 0xff00) << 8 | ((__uint32_t)(r1->
mask) & 0xff0000) >> 8 | ((__uint32_t)(r1->mask)
 & 0xff000000) >> 24) : __swap32md(r1->mask));
  u_int32_t m2 = ntohl(r2->mask)(__uint32_t)(__builtin_constant_p(r2->mask) ? (__uint32_t)
(((__uint32_t)(r2->mask) & 0xff) << 24 | ((__uint32_t
)(r2->mask) & 0xff00) << 8 | ((__uint32_t)(r2->
mask) & 0xff0000) >> 8 | ((__uint32_t)(r2->mask)
 & 0xff000000) >> 24) : __swap32md(r2->mask));
  u_int32_t o1, o2;

  if (m1 > m2)
return (-1);
  if (m1 < m2)
return (1);

  /* masks are equal */
  o1 = ntohl(r1->origin)(__uint32_t)(__builtin_constant_p(r1->origin) ? (__uint32_t
)(((__uint32_t)(r1->origin) & 0xff) << 24 | ((__uint32_t
)(r1->origin) & 0xff00) << 8 | ((__uint32_t)(r1->
origin) & 0xff0000) >> 8 | ((__uint32_t)(r1->origin
) & 0xff000000) >> 24) : __swap32md(r1->origin));
  o2 = ntohl(r2->origin)(__uint32_t)(__builtin_constant_p(r2->origin) ? (__uint32_t
)(((__uint32_t)(r2->origin) & 0xff) << 24 | ((__uint32_t
)(r2->origin) & 0xff00) << 8 | ((__uint32_t)(r2->
origin) & 0xff0000) >> 8 | ((__uint32_t)(r2->origin
) & 0xff000000) >> 24) : __swap32md(r2->origin));
  if (o1 > o2)
return (-1);
  if (o1 < o2)
return (1);
  return (0);
726}

728/*
* Process an incoming route report message.
*/
731void
732accept_report(u_int32_t src, u_int32_t dst, char *p, int datalen,
  u_int32_t level)
734{
  vifi_t vifi;
  int width, i, nrt = 0;
  int metric;
  u_int32_t mask;
  u_int32_t origin;
  struct newrt rt[4096];

  if ((vifi = find_vif(src, dst)) == NO_VIF((vifi_t)32)) {
1
Assuming the condition is false→
2
←
Taking false branch→
logit(LOG_INFO6, 0,
   "ignoring route report from non-neighbor %s", inet_fmt(src, s1));
return;
  }

  if (!update_neighbor(vifi, src, DVMRP_REPORT2, NULL((void *)0), 0, level))
3
←
Assuming the condition is false→
4
←
Taking false branch→
return;

  if (datalen > 2*4096) {
5
←
Assuming the condition is false→
6
←
Taking false branch→
logit(LOG_INFO6, 0,
   "ignoring oversize (%d bytes) route report from %s",
   datalen, inet_fmt(src, s1));
return;
  }

  while (datalen > 0) {	/* Loop through per-mask lists. */
7
←
Assuming 'datalen' is > 0→
8
←
Loop condition is true.  Entering loop body→
26
←
Assuming 'datalen' is <= 0→
27
←
Loop condition is false. Execution continues on line 797→

if (datalen < 3) {
9
←
Assuming 'datalen' is >= 3→
10
←
Taking false branch→
   logit(LOG_WARNING4, 0,
"received truncated route report from %s",
inet_fmt(src, s1));
   return;
}
((u_char *)&mask)[0] = 0xff;            width = 1;
if ((((u_char *)&mask)[1] = *p++) != 0) width = 2;
11
←
Assuming the condition is false→
12
←
Taking false branch→
if ((((u_char *)&mask)[2] = *p++) != 0) width = 3;
13
←
Assuming the condition is false→
14
←
Taking false branch→
if ((((u_char *)&mask)[3] = *p++) != 0) width = 4;
15
←
Assuming the condition is false→
16
←
Taking false branch→
if (!inet_valid_mask(ntohl(mask)(__uint32_t)(__builtin_constant_p(mask) ? (__uint32_t)(((__uint32_t
)(mask) & 0xff) << 24 | ((__uint32_t)(mask) & 0xff00
) << 8 | ((__uint32_t)(mask) & 0xff0000) >> 8
 | ((__uint32_t)(mask) & 0xff000000) >> 24) : __swap32md
(mask)))) {
17
←
'?' condition is false→
18
←
Assuming the condition is false→
19
←
Taking false branch→
   logit(LOG_WARNING4, 0,
"%s reports bogus netmask 0x%08x (%s)",
inet_fmt(src, s1), ntohl(mask)(__uint32_t)(__builtin_constant_p(mask) ? (__uint32_t)(((__uint32_t
)(mask) & 0xff) << 24 | ((__uint32_t)(mask) & 0xff00
) << 8 | ((__uint32_t)(mask) & 0xff0000) >> 8
 | ((__uint32_t)(mask) & 0xff000000) >> 24) : __swap32md
(mask)), inet_fmt(mask, s2));
   return;
}
datalen -= 3;

do {			/* Loop through (origin, metric) pairs */
25
←
Loop condition is false.  Exiting loop→
   if (datalen < width + 1) {
20
←
Assuming the condition is false→
21
←
Taking false branch→
logit(LOG_WARNING4, 0,
    "received truncated route report from %s",
    inet_fmt(src, s1));
return;
   }
   origin = 0;
   for (i = 0; i < width; ++i)
22
←
Loop condition is true.  Entering loop body→
23
←
Loop condition is false. Execution continues on line 788→
((char *)&origin)[i] = *p++;
   metric = *p++;
   datalen -= width + 1;
   rt[nrt].mask   = mask;
   rt[nrt].origin = origin;
   rt[nrt].metric = (metric & 0x7f);
   ++nrt;
} while (!(metric & 0x80));
24
←
Assuming the condition is false→
  }

  qsort((char*)rt, nrt, sizeof(rt[0]), compare_rts);
  start_route_updates();
  /*
   * If the last entry is default, change mask from 0xff000000 to 0
   */
  if (rt[nrt-1].origin == 0)
28
←
Assuming field 'origin' is not equal to 0→
29
←
Taking false branch→
rt[nrt-1].mask = 0;

  logit(LOG_DEBUG7, 0, "Updating %d routes from %s to %s", nrt,
inet_fmt(src, s1), inet_fmt(dst, s2));
  for (i = 0; i < nrt; ++i) {
30
←
Loop condition is true.  Entering loop body→
if (i30.1
'i' is equal to 0
 != 0 && rt[i].origin == rt[i-1].origin &&
      rt[i].mask == rt[i-1].mask) {
   logit(LOG_WARNING4, 0, "%s reports duplicate route for %s",
inet_fmt(src, s1), inet_fmts(rt[i].origin, rt[i].mask, s2));
   continue;
}
update_route(rt[i].origin, rt[i].mask, rt[i].metric,
31
←
Calling 'update_route'→
     src, vifi);
  }

  if (routes_changed && !delay_change_reports)
report_to_all_neighbors(CHANGED_ROUTES1);
820}


823/*
* Send a route report message to destination 'dst', via virtual interface
* 'vifi'.  'which_routes' specifies ALL_ROUTES or CHANGED_ROUTES.
*/
827void
828report(int which_routes, vifi_t vifi, u_int32_t dst)
829{
  struct rtentry *r;
  char *p;
  int i;
  int datalen = 0;
  int width = 0;
  u_int32_t mask = 0;
  u_int32_t src;
  u_int32_t nflags;

  src = uvifs[vifi].uv_lcl_addr;

  p = send_buf + MIN_IP_HEADER_LEN20 + IGMP_MINLEN8;

843#ifdef NOTYET
  /* If I'm not a leaf, but the neighbor is a leaf, only advertise default */
  if ((vifs_with_neighbors != 1) && (uvifs[vifi].uv_flags & VIFF_LEAF0x1000)) {
    *p++ = 0;       /* 0xff000000 mask */
    *p++ = 0;
    *p++ = 0;
    *p++ = 0;       /* class A net 0.0.0.0 == default */
    *p++ = 0x81;    /*XXX metric 1, is this safe? */
    datalen += 5;
    send_igmp(src, dst, IGMP_DVMRP0x13, DVMRP_REPORT2,
              htonl(MROUTED_LEVEL)(__uint32_t)(__builtin_constant_p(((8 << 8) | 3 | ((0x02
 | 0x04 | 0x08) << 16) | (1 << 24))) ? (__uint32_t
)(((__uint32_t)(((8 << 8) | 3 | ((0x02 | 0x04 | 0x08) <<
 16) | (1 << 24))) & 0xff) << 24 | ((__uint32_t
)(((8 << 8) | 3 | ((0x02 | 0x04 | 0x08) << 16) | (
<< 24))) & 0xff00) << 8 | ((__uint32_t)(((8
 << 8) | 3 | ((0x02 | 0x04 | 0x08) << 16) | (1 <<
 24))) & 0xff0000) >> 8 | ((__uint32_t)(((8 <<
 8) | 3 | ((0x02 | 0x04 | 0x08) << 16) | (1 << 24
))) & 0xff000000) >> 24) : __swap32md(((8 << 8
) | 3 | ((0x02 | 0x04 | 0x08) << 16) | (1 << 24))
)), datalen);
    return;
  }
856#endif

  nflags = (uvifs[vifi].uv_flags & VIFF_LEAF0x1000) ? 0 : LEAF_FLAGS(( vifs_with_neighbors == 1 ) ? 0x010000 : 0);

  for (r = rt_end; r != RT_ADDR(struct rtentry *)&routing_table; r = r->rt_prev) {

if (which_routes == CHANGED_ROUTES1 && !(r->rt_flags & RTF_CHANGED0x01))
   continue;

/*
* If there is no room for this route in the current message,
* send the message and start a new one.
*/
if (datalen + ((r->rt_originmask == mask) ?
       (width + 1) :
       (r->rt_originwidth + 4)) > MAX_DVMRP_DATA_LEN( 576 - 60 - 8 )) {
   *(p-1) |= 0x80;
   send_igmp(src, dst, IGMP_DVMRP0x13, DVMRP_REPORT2,
      htonl(MROUTED_LEVEL | nflags)(__uint32_t)(__builtin_constant_p(((8 << 8) | 3 | ((0x02
 | 0x04 | 0x08) << 16) | (1 << 24)) | nflags) ? (
__uint32_t)(((__uint32_t)(((8 << 8) | 3 | ((0x02 | 0x04
 | 0x08) << 16) | (1 << 24)) | nflags) & 0xff
) << 24 | ((__uint32_t)(((8 << 8) | 3 | ((0x02 | 0x04
 | 0x08) << 16) | (1 << 24)) | nflags) & 0xff00
) << 8 | ((__uint32_t)(((8 << 8) | 3 | ((0x02 | 0x04
 | 0x08) << 16) | (1 << 24)) | nflags) & 0xff0000
) >> 8 | ((__uint32_t)(((8 << 8) | 3 | ((0x02 | 0x04
 | 0x08) << 16) | (1 << 24)) | nflags) & 0xff000000
) >> 24) : __swap32md(((8 << 8) | 3 | ((0x02 | 0x04
 | 0x08) << 16) | (1 << 24)) | nflags)), datalen);

   p = send_buf + MIN_IP_HEADER_LEN20 + IGMP_MINLEN8;
   datalen = 0;
   mask = 0;
}

if (r->rt_originmask != mask || datalen == 0) {
   mask  = r->rt_originmask;
   width = r->rt_originwidth;
   if (datalen != 0) *(p-1) |= 0x80;
   *p++ = ((char *)&mask)[1];
   *p++ = ((char *)&mask)[2];
   *p++ = ((char *)&mask)[3];
   datalen += 3;
}

for (i = 0; i < width; ++i)
   *p++ = ((char *)&(r->rt_origin))[i];

*p++ = (r->rt_parent == vifi && r->rt_metric != UNREACHABLE32) ?
   (char)(r->rt_metric + UNREACHABLE32) :  /* "poisoned reverse" */
(char)(r->rt_metric);

datalen += width + 1;
  }

  if (datalen != 0) {
*(p-1) |= 0x80;
send_igmp(src, dst, IGMP_DVMRP0x13, DVMRP_REPORT2,
  htonl(MROUTED_LEVEL | nflags)(__uint32_t)(__builtin_constant_p(((8 << 8) | 3 | ((0x02
 | 0x04 | 0x08) << 16) | (1 << 24)) | nflags) ? (
__uint32_t)(((__uint32_t)(((8 << 8) | 3 | ((0x02 | 0x04
 | 0x08) << 16) | (1 << 24)) | nflags) & 0xff
) << 24 | ((__uint32_t)(((8 << 8) | 3 | ((0x02 | 0x04
 | 0x08) << 16) | (1 << 24)) | nflags) & 0xff00
) << 8 | ((__uint32_t)(((8 << 8) | 3 | ((0x02 | 0x04
 | 0x08) << 16) | (1 << 24)) | nflags) & 0xff0000
) >> 8 | ((__uint32_t)(((8 << 8) | 3 | ((0x02 | 0x04
 | 0x08) << 16) | (1 << 24)) | nflags) & 0xff000000
) >> 24) : __swap32md(((8 << 8) | 3 | ((0x02 | 0x04
 | 0x08) << 16) | (1 << 24)) | nflags)), datalen);
  }
906}


909/*
* Send a route report message to all neighboring routers.
* 'which_routes' specifies ALL_ROUTES or CHANGED_ROUTES.
*/
913void
914report_to_all_neighbors(int which_routes)
915{
  vifi_t vifi;
  struct uvif *v;
  struct rtentry *r;
  int routes_changed_before;

  /*
   * Remember the state of the global routes_changed flag before
   * generating the reports, and clear the flag.
   */
  routes_changed_before = routes_changed;
  routes_changed = FALSE0;


  for (vifi = 0, v = uvifs; vifi < numvifs; ++vifi, ++v) {
if (v->uv_neighbors != NULL((void *)0)) {
   report(which_routes, vifi,
   (v->uv_flags & VIFF_TUNNEL0x1) ? v->uv_rmt_addr
   : dvmrp_group);
}
  }

  /*
   * If there were changed routes before we sent the reports AND
   * if no new changes occurred while sending the reports, clear
   * the change flags in the individual route entries.  If changes
   * did occur while sending the reports, new reports will be
   * generated at the next timer interrupt.
   */
  if (routes_changed_before && !routes_changed) {
for (r = routing_table; r != NULL((void *)0); r = r->rt_next) {
   r->rt_flags &= ~RTF_CHANGED0x01;
}
  }

  /*
   * Set a flag to inhibit further reports of changed routes until the
   * next timer interrupt.  This is to alleviate update storms.
   */
  delay_change_reports = TRUE1;
955}

957/*
* Send a route report message to destination 'dst', via virtual interface
* 'vifi'.  'which_routes' specifies ALL_ROUTES or CHANGED_ROUTES.
*/
961static int
962report_chunk(struct rtentry *start_rt, vifi_t vifi, u_int32_t dst)
963{
  struct rtentry *r;
  char *p;
  int i;
  int nrt = 0;
  int datalen = 0;
  int width = 0;
  u_int32_t mask = 0;
  u_int32_t src;
  u_int32_t nflags;

  src = uvifs[vifi].uv_lcl_addr;
  p = send_buf + MIN_IP_HEADER_LEN20 + IGMP_MINLEN8;

  nflags = (uvifs[vifi].uv_flags & VIFF_LEAF0x1000) ? 0 : LEAF_FLAGS(( vifs_with_neighbors == 1 ) ? 0x010000 : 0);

  for (r = start_rt; r != RT_ADDR(struct rtentry *)&routing_table; r = r->rt_prev) {

981#ifdef NOTYET
/* Don't send poisoned routes back to parents if I am a leaf */
if ((vifs_with_neighbors == 1) && (r->rt_parent == vifi)
&& (r->rt_metric > 1)) {
   ++nrt;
   continue;
}
988#endif

/*
* If there is no room for this route in the current message,
* send it & return how many routes we sent.
*/
if (datalen + ((r->rt_originmask == mask) ?
       (width + 1) :
       (r->rt_originwidth + 4)) > MAX_DVMRP_DATA_LEN( 576 - 60 - 8 )) {
   *(p-1) |= 0x80;
   send_igmp(src, dst, IGMP_DVMRP0x13, DVMRP_REPORT2,
      htonl(MROUTED_LEVEL | nflags)(__uint32_t)(__builtin_constant_p(((8 << 8) | 3 | ((0x02
 | 0x04 | 0x08) << 16) | (1 << 24)) | nflags) ? (
__uint32_t)(((__uint32_t)(((8 << 8) | 3 | ((0x02 | 0x04
 | 0x08) << 16) | (1 << 24)) | nflags) & 0xff
) << 24 | ((__uint32_t)(((8 << 8) | 3 | ((0x02 | 0x04
 | 0x08) << 16) | (1 << 24)) | nflags) & 0xff00
) << 8 | ((__uint32_t)(((8 << 8) | 3 | ((0x02 | 0x04
 | 0x08) << 16) | (1 << 24)) | nflags) & 0xff0000
) >> 8 | ((__uint32_t)(((8 << 8) | 3 | ((0x02 | 0x04
 | 0x08) << 16) | (1 << 24)) | nflags) & 0xff000000
) >> 24) : __swap32md(((8 << 8) | 3 | ((0x02 | 0x04
 | 0x08) << 16) | (1 << 24)) | nflags)), datalen);
   return (nrt);
}
if (r->rt_originmask != mask || datalen == 0) {
   mask  = r->rt_originmask;
   width = r->rt_originwidth;
   if (datalen != 0) *(p-1) |= 0x80;
   *p++ = ((char *)&mask)[1];
   *p++ = ((char *)&mask)[2];
   *p++ = ((char *)&mask)[3];
   datalen += 3;
}
for (i = 0; i < width; ++i)
   *p++ = ((char *)&(r->rt_origin))[i];

*p++ = (r->rt_parent == vifi && r->rt_metric != UNREACHABLE32) ?
   (char)(r->rt_metric + UNREACHABLE32) :  /* "poisoned reverse" */
(char)(r->rt_metric);
++nrt;
datalen += width + 1;
  }
  if (datalen != 0) {
*(p-1) |= 0x80;
send_igmp(src, dst, IGMP_DVMRP0x13, DVMRP_REPORT2,
  htonl(MROUTED_LEVEL | nflags)(__uint32_t)(__builtin_constant_p(((8 << 8) | 3 | ((0x02
 | 0x04 | 0x08) << 16) | (1 << 24)) | nflags) ? (
__uint32_t)(((__uint32_t)(((8 << 8) | 3 | ((0x02 | 0x04
 | 0x08) << 16) | (1 << 24)) | nflags) & 0xff
) << 24 | ((__uint32_t)(((8 << 8) | 3 | ((0x02 | 0x04
 | 0x08) << 16) | (1 << 24)) | nflags) & 0xff00
) << 8 | ((__uint32_t)(((8 << 8) | 3 | ((0x02 | 0x04
 | 0x08) << 16) | (1 << 24)) | nflags) & 0xff0000
) >> 8 | ((__uint32_t)(((8 << 8) | 3 | ((0x02 | 0x04
 | 0x08) << 16) | (1 << 24)) | nflags) & 0xff000000
) >> 24) : __swap32md(((8 << 8) | 3 | ((0x02 | 0x04
 | 0x08) << 16) | (1 << 24)) | nflags)), datalen);
  }
  return (nrt);
1026}

1028/*
* send the next chunk of our routing table to all neighbors.
* return the length of the smallest chunk we sent out.
*/
1032int
1033report_next_chunk(void)
1034{
  vifi_t vifi;
  struct uvif *v;
  struct rtentry *sr;
  int i, n = 0, min = 20000;
  static int start_rt;

  if (nroutes <= 0)
return (0);

  /*
   * find this round's starting route.
   */
  for (sr = rt_end, i = start_rt; --i >= 0; ) {
sr = sr->rt_prev;
if (sr == RT_ADDR(struct rtentry *)&routing_table)
   sr = rt_end;
  }

  /*
   * send one chunk of routes starting at this round's start to
   * all our neighbors.
   */
  for (vifi = 0, v = uvifs; vifi < numvifs; ++vifi, ++v) {
if ((v->uv_neighbors != NULL((void *)0))
1059#ifdef NOTYET
&& !(v->uv_flags & VIFF_LEAF0x1000)
1061#endif
) {
   n = report_chunk(sr, vifi,
	     (v->uv_flags & VIFF_TUNNEL0x1) ? v->uv_rmt_addr
	     : dvmrp_group);
   if (n < min)
min = n;
}
  }
  if (min == 20000)
min = 0;	/* Neighborless router didn't send any routes */

  n = min;
  logit(LOG_INFO6, 0, "update %d starting at %d of %d",
n, (nroutes - start_rt), nroutes);

  start_rt = (start_rt + n) % nroutes;
  return (n);
1079}


1082/*
* Print the contents of the routing table on file 'fp'.
*/
1085void
1086dump_routes(FILE *fp)
1087{
  struct rtentry *r;
  vifi_t i;


  fprintf(fp,
   "Multicast Routing Table (%u %s)\n%s\n",
   nroutes, (nroutes == 1) ? "entry" : "entries",
   " Origin-Subnet      From-Gateway    Metric Tmr In-Vif  Out-Vifs");

  for (r = routing_table; r != NULL((void *)0); r = r->rt_next) {

fprintf(fp, " %-18s %-15s ",
inet_fmts(r->rt_origin, r->rt_originmask, s1),
(r->rt_gateway == 0) ? "" : inet_fmt(r->rt_gateway, s2));

fprintf(fp, (r->rt_metric == UNREACHABLE32) ? "  NR " : "%4u ",
r->rt_metric);

fprintf(fp, "  %3u %3u   ", r->rt_timer, r->rt_parent);

for (i = 0; i < numvifs; ++i) {
   if (VIFM_ISSET(i, r->rt_children)((r->rt_children) & (1 << (i)))) {
fprintf(fp, " %u%c",
	i, VIFM_ISSET(i, r->rt_leaves)((r->rt_leaves) & (1 << (i))) ? '*' : ' ');
   }
}
fprintf(fp, "\n");
  }
  fprintf(fp, "\n");
1117}

1119struct rtentry *
1120determine_route(u_int32_t src)
1121{
  struct rtentry *rt;

  for (rt = routing_table; rt != NULL((void *)0); rt = rt->rt_next) {
if (rt->rt_origin == (src & rt->rt_originmask))
   break;
  }
  return rt;
1129}