/usr/src/usr.sbin/mrouted/prune.c

Bug Summary

File:	src/usr.sbin/mrouted/prune.c
Warning:	line 490, column 16 Access to field 'st_origin' results in a dereference of a null pointer (loaded from variable 'st')
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name prune.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/usr.sbin/mrouted/obj -resource-dir /usr/local/lib/clang/13.0.0 -I /usr/src/usr.sbin/mrouted -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/usr.sbin/mrouted/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/usr.sbin/mrouted/prune.c
1/*	$NetBSD: prune.c,v 1.3 1995/12/10 10:07:09 mycroft Exp $	*/

3/*
* The mrouted program is covered by the license in the accompanying file
* named "LICENSE".  Use of the mrouted program represents acceptance of
* the terms and conditions listed in that file.
*
* The mrouted program is COPYRIGHT 1989 by The Board of Trustees of
* Leland Stanford Junior University.
*/


13#include "defs.h"

15extern int cache_lifetime;
16extern int max_prune_lifetime;
17extern struct rtentry *routing_table;

19extern int phys_vif;

21/*
* dither cache lifetime to obtain a value between x and 2*x
*/
24#define CACHE_LIFETIME(x)((x) + (arc4random_uniform(x))) ((x) + (arc4random_uniform(x)))

26struct gtable *kernel_table;		/* ptr to list of kernel grp entries*/
27static struct gtable *kernel_no_route;	/* list of grp entries w/o routes   */
28struct gtable *gtp;			/* pointer for kernel rt entries    */
29unsigned int kroutes;			/* current number of cache entries  */

31/****************************************************************************
                     Functions that are local to prune.c
33****************************************************************************/
34static void		prun_add_ttls(struct gtable *gt);
35static int		pruning_neighbor(vifi_t vifi, u_int32_t addr);
36static int		can_mtrace(vifi_t vifi, u_int32_t addr);
37static struct ptable *	find_prune_entry(u_int32_t vr, struct ptable *pt);
38static void		expire_prune(vifi_t vifi, struct gtable *gt);
39static void		send_prune(struct gtable *gt);
40static void		send_graft(struct gtable *gt);
41static void		send_graft_ack(u_int32_t src, u_int32_t dst,
	    u_int32_t origin, u_int32_t grp);
43static void		update_kernel(struct gtable *g);
44static char *		scaletime(time_t t);

46/*
* Updates the ttl values for each vif.
*/
49static void
50prun_add_ttls(struct gtable *gt)
51{
  struct uvif *v;
  vifi_t vifi;

  for (vifi = 0, v = uvifs; vifi < numvifs; ++vifi, ++v) {
if (VIFM_ISSET(vifi, gt->gt_grpmems)((gt->gt_grpmems) & (1 << (vifi))))
   gt->gt_ttls[vifi] = v->uv_threshold;
else
   gt->gt_ttls[vifi] = 0;
  }
61}

63/*
* checks for scoped multicast addresses
*/
66#define GET_SCOPE(gt){ vifi_t _i; if (((__uint32_t)(__builtin_constant_p((gt)->
gt_mcastgrp) ? (__uint32_t)(((__uint32_t)((gt)->gt_mcastgrp
) & 0xff) << 24 | ((__uint32_t)((gt)->gt_mcastgrp
) & 0xff00) << 8 | ((__uint32_t)((gt)->gt_mcastgrp
) & 0xff0000) >> 8 | ((__uint32_t)((gt)->gt_mcastgrp
) & 0xff000000) >> 24) : __swap32md((gt)->gt_mcastgrp
)) & 0xff000000) == 0xef000000) for (_i = 0; _i < numvifs
; _i++) if (scoped_addr(_i, (gt)->gt_mcastgrp)) (((gt)->
gt_scope) |= (1 << (_i))); } { \
vifi_t _i; \
if ((ntohl((gt)->gt_mcastgrp)(__uint32_t)(__builtin_constant_p((gt)->gt_mcastgrp) ? (__uint32_t
)(((__uint32_t)((gt)->gt_mcastgrp) & 0xff) << 24
 | ((__uint32_t)((gt)->gt_mcastgrp) & 0xff00) <<
| ((__uint32_t)((gt)->gt_mcastgrp) & 0xff0000) >>
| ((__uint32_t)((gt)->gt_mcastgrp) & 0xff000000) >>
 24) : __swap32md((gt)->gt_mcastgrp)) & 0xff000000) == 0xef000000) \
   for (_i = 0; _i < numvifs; _i++) \
if (scoped_addr(_i, (gt)->gt_mcastgrp)) \
    VIFM_SET(_i, (gt)->gt_scope)(((gt)->gt_scope) |= (1 << (_i))); \
}

74int
75scoped_addr(vifi_t vifi, u_int32_t addr)
76{
  struct vif_acl *acl;

  for (acl = uvifs[vifi].uv_acl; acl; acl = acl->acl_next)
if ((addr & acl->acl_mask) == acl->acl_addr)
   return 1;

  return 0;
84}

86/*
* Determine if mcastgrp has a listener on vifi
*/
89int
90grplst_mem(vifi_t vifi, u_int32_t mcastgrp)
91{
  struct listaddr *g;
  struct uvif *v;

  v = &uvifs[vifi];

  for (g = v->uv_groups; g != NULL((void *)0); g = g->al_next)
if (mcastgrp == g->al_addr)
   return 1;

  return 0;
102}

104/*
* Finds the group entry with the specified source and netmask.
* If netmask is 0, it uses the route's netmask.
*
* Returns TRUE if found a match, and the global variable gtp is left
* pointing to entry before the found entry.
* Returns FALSE if no exact match found, gtp is left pointing to before
* the entry in question belongs, or is NULL if the it belongs at the
* head of the list.
*/
114int
115find_src_grp(u_int32_t src, u_int32_t mask, u_int32_t grp)
116{
  struct gtable *gt;

  gtp = NULL((void *)0);
  gt = kernel_table;
  while (gt != NULL((void *)0)) {
if (grp == gt->gt_mcastgrp &&
   (mask ? (gt->gt_route->rt_origin == src &&
     gt->gt_route->rt_originmask == mask) :
    ((src & gt->gt_route->rt_originmask) ==
     gt->gt_route->rt_origin)))
   return TRUE1;
if (ntohl(grp)(__uint32_t)(__builtin_constant_p(grp) ? (__uint32_t)(((__uint32_t
)(grp) & 0xff) << 24 | ((__uint32_t)(grp) & 0xff00
) << 8 | ((__uint32_t)(grp) & 0xff0000) >> 8 |
 ((__uint32_t)(grp) & 0xff000000) >> 24) : __swap32md
(grp)) > ntohl(gt->gt_mcastgrp)(__uint32_t)(__builtin_constant_p(gt->gt_mcastgrp) ? (__uint32_t
)(((__uint32_t)(gt->gt_mcastgrp) & 0xff) << 24 |
 ((__uint32_t)(gt->gt_mcastgrp) & 0xff00) << 8 |
 ((__uint32_t)(gt->gt_mcastgrp) & 0xff0000) >> 8
 | ((__uint32_t)(gt->gt_mcastgrp) & 0xff000000) >>
 24) : __swap32md(gt->gt_mcastgrp)) ||
   (grp == gt->gt_mcastgrp &&
    (ntohl(mask)(__uint32_t)(__builtin_constant_p(mask) ? (__uint32_t)(((__uint32_t
)(mask) & 0xff) << 24 | ((__uint32_t)(mask) & 0xff00
) << 8 | ((__uint32_t)(mask) & 0xff0000) >> 8
 | ((__uint32_t)(mask) & 0xff000000) >> 24) : __swap32md
(mask)) < ntohl(gt->gt_route->rt_originmask)(__uint32_t)(__builtin_constant_p(gt->gt_route->rt_originmask
) ? (__uint32_t)(((__uint32_t)(gt->gt_route->rt_originmask
) & 0xff) << 24 | ((__uint32_t)(gt->gt_route->
rt_originmask) & 0xff00) << 8 | ((__uint32_t)(gt->
gt_route->rt_originmask) & 0xff0000) >> 8 | ((__uint32_t
)(gt->gt_route->rt_originmask) & 0xff000000) >>
 24) : __swap32md(gt->gt_route->rt_originmask)) ||
     (mask == gt->gt_route->rt_originmask &&
      (ntohl(src)(__uint32_t)(__builtin_constant_p(src) ? (__uint32_t)(((__uint32_t
)(src) & 0xff) << 24 | ((__uint32_t)(src) & 0xff00
) << 8 | ((__uint32_t)(src) & 0xff0000) >> 8 |
 ((__uint32_t)(src) & 0xff000000) >> 24) : __swap32md
(src)) > ntohl(gt->gt_route->rt_origin)(__uint32_t)(__builtin_constant_p(gt->gt_route->rt_origin
) ? (__uint32_t)(((__uint32_t)(gt->gt_route->rt_origin)
 & 0xff) << 24 | ((__uint32_t)(gt->gt_route->
rt_origin) & 0xff00) << 8 | ((__uint32_t)(gt->gt_route
->rt_origin) & 0xff0000) >> 8 | ((__uint32_t)(gt
->gt_route->rt_origin) & 0xff000000) >> 24) :
 __swap32md(gt->gt_route->rt_origin))))))) {
   gtp = gt;
   gt = gt->gt_gnext;
}
else break;
  }
  return FALSE0;
139}

141/*
* Check if the neighbor supports pruning
*/
144static int
145pruning_neighbor(vifi_t vifi, u_int32_t addr)
146{
  struct listaddr *n = neighbor_info(vifi, addr);
  int vers;

  if (n == NULL((void *)0))
return 0;

  if (n->al_flags & NF_PRUNE0x02)
return 1;

  /*
   * Versions from 3.0 to 3.4 relied on the version number to identify
   * that they could handle pruning.
   */
  vers = NBR_VERS(n)(((n)->al_pv << 8) + (n)->al_mv);
  return (vers >= 0x0300 && vers <= 0x0304);
162}

164/*
* Can the neighbor in question handle multicast traceroute?
*/
167static int
168can_mtrace(vifi_t vifi, u_int32_t addr)
169{
  struct listaddr *n = neighbor_info(vifi, addr);
  int vers;

  if (n == NULL((void *)0))
return 0;

  if (n->al_flags & NF_MTRACE0x08)
return 1;

  /*
   * Versions 3.3 and 3.4 relied on the version number to identify
   * that they could handle traceroute.
   */
  vers = NBR_VERS(n)(((n)->al_pv << 8) + (n)->al_mv);
  return (vers >= 0x0303 && vers <= 0x0304);
185}

187/*
* Returns the prune entry of the router, or NULL if none exists
*/
190static struct ptable *
191find_prune_entry(u_int32_t vr, struct ptable *pt)
192{
  while (pt) {
if (pt->pt_router == vr)
   return pt;
pt = pt->pt_next;
  }

  return NULL((void *)0);
200}

202/*
* Send a prune message to the dominant router for
* this source.
*
* Record an entry that a prune was sent for this group
*/
208static void
209send_prune(struct gtable *gt)
210{
  struct ptable *pt;
  char *p;
  int i;
  int datalen;
  u_int32_t src;
  u_int32_t dst;
  u_int32_t tmp;

  /* Don't process any prunes if router is not pruning */
  if (pruning == 0)
return;

  /* Can't process a prune if we don't have an associated route */
  if (gt->gt_route == NULL((void *)0))
return;

  /* Don't send a prune to a non-pruning router */
  if (!pruning_neighbor(gt->gt_route->rt_parent, gt->gt_route->rt_gateway))
return;

  /*
   * sends a prune message to the router upstream.
   */
  src = uvifs[gt->gt_route->rt_parent].uv_lcl_addr;
  dst = gt->gt_route->rt_gateway;

  p = send_buf + MIN_IP_HEADER_LEN20 + IGMP_MINLEN8;
  datalen = 0;

  /*
   * determine prune lifetime
   */
  gt->gt_prsent_timer = gt->gt_timer;
  for (pt = gt->gt_pruntbl; pt; pt = pt->pt_next)
if (pt->pt_timer < gt->gt_prsent_timer)
   gt->gt_prsent_timer = pt->pt_timer;

  /*
   * If we have a graft pending, cancel graft retransmission
   */
  gt->gt_grftsnt = 0;

  for (i = 0; i < 4; i++)
*p++ = ((char *)&(gt->gt_route->rt_origin))[i];
  for (i = 0; i < 4; i++)
*p++ = ((char *)&(gt->gt_mcastgrp))[i];
  tmp = htonl(gt->gt_prsent_timer)(__uint32_t)(__builtin_constant_p(gt->gt_prsent_timer) ? (
__uint32_t)(((__uint32_t)(gt->gt_prsent_timer) & 0xff)
 << 24 | ((__uint32_t)(gt->gt_prsent_timer) & 0xff00
) << 8 | ((__uint32_t)(gt->gt_prsent_timer) & 0xff0000
) >> 8 | ((__uint32_t)(gt->gt_prsent_timer) & 0xff000000
) >> 24) : __swap32md(gt->gt_prsent_timer));
  for (i = 0; i < 4; i++)
*p++ = ((char *)&(tmp))[i];
  datalen += 12;

  send_igmp(src, dst, IGMP_DVMRP0x13, DVMRP_PRUNE7,
     htonl(MROUTED_LEVEL)(__uint32_t)(__builtin_constant_p(((8 << 8) | 3 | ((0x02
 | 0x04 | 0x08) << 16) | (1 << 24))) ? (__uint32_t
)(((__uint32_t)(((8 << 8) | 3 | ((0x02 | 0x04 | 0x08) <<
 16) | (1 << 24))) & 0xff) << 24 | ((__uint32_t
)(((8 << 8) | 3 | ((0x02 | 0x04 | 0x08) << 16) | (
<< 24))) & 0xff00) << 8 | ((__uint32_t)(((8
 << 8) | 3 | ((0x02 | 0x04 | 0x08) << 16) | (1 <<
 24))) & 0xff0000) >> 8 | ((__uint32_t)(((8 <<
 8) | 3 | ((0x02 | 0x04 | 0x08) << 16) | (1 << 24
))) & 0xff000000) >> 24) : __swap32md(((8 << 8
) | 3 | ((0x02 | 0x04 | 0x08) << 16) | (1 << 24))
)), datalen);

  logit(LOG_DEBUG7, 0, "sent prune for (%s %s)/%d on vif %d to %s",
    inet_fmts(gt->gt_route->rt_origin, gt->gt_route->rt_originmask, s1),
    inet_fmt(gt->gt_mcastgrp, s2),
    gt->gt_prsent_timer, gt->gt_route->rt_parent,
    inet_fmt(gt->gt_route->rt_gateway, s3));
270}

272/*
* a prune was sent upstream
* so, a graft has to be sent to annul the prune
* set up a graft timer so that if an ack is not
* heard within that time, another graft request
* is sent out.
*/
279static void
280send_graft(struct gtable *gt)
281{
  char *p;
  int i;
  int datalen;
  u_int32_t src;
  u_int32_t dst;

  /* Can't send a graft without an associated route */
  if (gt->gt_route == NULL((void *)0))
return;

  src = uvifs[gt->gt_route->rt_parent].uv_lcl_addr;
  dst = gt->gt_route->rt_gateway;

  p = send_buf + MIN_IP_HEADER_LEN20 + IGMP_MINLEN8;
  datalen = 0;

  for (i = 0; i < 4; i++)
*p++ = ((char *)&(gt->gt_route->rt_origin))[i];
  for (i = 0; i < 4; i++)
*p++ = ((char *)&(gt->gt_mcastgrp))[i];
  datalen += 8;

  if (datalen != 0) {
send_igmp(src, dst, IGMP_DVMRP0x13, DVMRP_GRAFT8,
  htonl(MROUTED_LEVEL)(__uint32_t)(__builtin_constant_p(((8 << 8) | 3 | ((0x02
 | 0x04 | 0x08) << 16) | (1 << 24))) ? (__uint32_t
)(((__uint32_t)(((8 << 8) | 3 | ((0x02 | 0x04 | 0x08) <<
 16) | (1 << 24))) & 0xff) << 24 | ((__uint32_t
)(((8 << 8) | 3 | ((0x02 | 0x04 | 0x08) << 16) | (
<< 24))) & 0xff00) << 8 | ((__uint32_t)(((8
 << 8) | 3 | ((0x02 | 0x04 | 0x08) << 16) | (1 <<
 24))) & 0xff0000) >> 8 | ((__uint32_t)(((8 <<
 8) | 3 | ((0x02 | 0x04 | 0x08) << 16) | (1 << 24
))) & 0xff000000) >> 24) : __swap32md(((8 << 8
) | 3 | ((0x02 | 0x04 | 0x08) << 16) | (1 << 24))
)), datalen);
  }
  logit(LOG_DEBUG7, 0, "sent graft for (%s %s) to %s on vif %d",
inet_fmts(gt->gt_route->rt_origin, gt->gt_route->rt_originmask, s1),
inet_fmt(gt->gt_mcastgrp, s2),
inet_fmt(gt->gt_route->rt_gateway, s3), gt->gt_route->rt_parent);
312}

314/*
* Send an ack that a graft was received
*/
317static void
318send_graft_ack(u_int32_t src, u_int32_t dst, u_int32_t origin, u_int32_t grp)
319{
  char *p;
  int i;
  int datalen;

  p = send_buf + MIN_IP_HEADER_LEN20 + IGMP_MINLEN8;
  datalen = 0;

  for (i = 0; i < 4; i++)
*p++ = ((char *)&(origin))[i];
  for (i = 0; i < 4; i++)
*p++ = ((char *)&(grp))[i];
  datalen += 8;

  send_igmp(src, dst, IGMP_DVMRP0x13, DVMRP_GRAFT_ACK9,
     htonl(MROUTED_LEVEL)(__uint32_t)(__builtin_constant_p(((8 << 8) | 3 | ((0x02
 | 0x04 | 0x08) << 16) | (1 << 24))) ? (__uint32_t
)(((__uint32_t)(((8 << 8) | 3 | ((0x02 | 0x04 | 0x08) <<
 16) | (1 << 24))) & 0xff) << 24 | ((__uint32_t
)(((8 << 8) | 3 | ((0x02 | 0x04 | 0x08) << 16) | (
<< 24))) & 0xff00) << 8 | ((__uint32_t)(((8
 << 8) | 3 | ((0x02 | 0x04 | 0x08) << 16) | (1 <<
 24))) & 0xff0000) >> 8 | ((__uint32_t)(((8 <<
 8) | 3 | ((0x02 | 0x04 | 0x08) << 16) | (1 << 24
))) & 0xff000000) >> 24) : __swap32md(((8 << 8
) | 3 | ((0x02 | 0x04 | 0x08) << 16) | (1 << 24))
)), datalen);

  logit(LOG_DEBUG7, 0, "sent graft ack for (%s, %s) to %s",
inet_fmt(origin, s1), inet_fmt(grp, s2), inet_fmt(dst, s3));
338}

340/*
* Update the kernel cache with all the routes hanging off the group entry
*/
343static void
344update_kernel(struct gtable *g)
345{
  struct stable *st;

  for (st = g->gt_srctbl; st; st = st->st_next)
k_add_rg(st->st_origin, g);
350}

352/****************************************************************************
                        Functions that are used externally
354****************************************************************************/

356/*
* Initialize the kernel table structure
*/
359void
360init_ktable(void)
361{
  kernel_table	= NULL((void *)0);
  kernel_no_route	= NULL((void *)0);
  kroutes		= 0;
365}

367/*
* Add a new table entry for (origin, mcastgrp)
*/
370void
371add_table_entry(u_int32_t origin, u_int32_t mcastgrp)
372{
  struct rtentry *r;
  struct gtable *gt,**gtnp,*prev_gt;
  struct stable *st,**stnp;
  vifi_t i;

378#ifdef DEBUG_MFC
  md_logit(MD_MISS, origin, mcastgrp);
380#endif

  r = determine_route(origin);
  prev_gt = NULL((void *)0);
  if (r == NULL((void *)0)) {
1
Assuming 'r' is not equal to NULL→
2
←
Taking false branch→
/*
* Look for it on the no_route table; if it is found then
* it will be detected as a duplicate below.
*/
for (gt = kernel_no_route; gt; gt = gt->gt_next)
   if (mcastgrp == gt->gt_mcastgrp &&
gt->gt_srctbl && gt->gt_srctbl->st_origin == origin)
	break;
gtnp = &kernel_no_route;
  } else {
gtnp = &r->rt_groups;
while ((gt = *gtnp) != NULL((void *)0)) {
3
←
Assuming the condition is true→
4
←
Loop condition is true.  Entering loop body→
   if (gt->gt_mcastgrp >= mcastgrp)
5
←
Assuming 'mcastgrp' is <= field 'gt_mcastgrp'→
6
←
Taking true branch→
break;
7
←
 Execution continues on line 404→
   gtnp = &gt->gt_next;
   prev_gt = gt;
}
  }

  if (gt7.1
'gt' is not equal to NULL
 == NULL((void *)0) || gt->gt_mcastgrp != mcastgrp) {
8
←
Assuming 'mcastgrp' is equal to field 'gt_mcastgrp'→
9
←
Taking false branch→
gt = malloc(sizeof(struct gtable));
if (gt == NULL((void *)0))
   logit(LOG_ERR3, 0, "ran out of memory");

gt->gt_mcastgrp	    = mcastgrp;
gt->gt_timer	    = CACHE_LIFETIME(cache_lifetime)((cache_lifetime) + (arc4random_uniform(cache_lifetime)));
time(&gt->gt_ctime);
gt->gt_grpmems	    = 0;
gt->gt_scope	    = 0;
gt->gt_prsent_timer = 0;
gt->gt_grftsnt	    = 0;
gt->gt_srctbl	    = NULL((void *)0);
gt->gt_pruntbl	    = NULL((void *)0);
gt->gt_route	    = r;
419#ifdef RSRR
gt->gt_rsrr_cache   = NULL((void *)0);
421#endif

if (r != NULL((void *)0)) {
   /* obtain the multicast group membership list */
   for (i = 0; i < numvifs; i++) {
if (VIFM_ISSET(i, r->rt_children)((r->rt_children) & (1 << (i))) &&
    !(VIFM_ISSET(i, r->rt_leaves)((r->rt_leaves) & (1 << (i)))))
    VIFM_SET(i, gt->gt_grpmems)((gt->gt_grpmems) |= (1 << (i)));

if (VIFM_ISSET(i, r->rt_leaves)((r->rt_leaves) & (1 << (i))) && grplst_mem(i, mcastgrp))
    VIFM_SET(i, gt->gt_grpmems)((gt->gt_grpmems) |= (1 << (i)));
   }
   GET_SCOPE(gt){ vifi_t _i; if (((__uint32_t)(__builtin_constant_p((gt)->
gt_mcastgrp) ? (__uint32_t)(((__uint32_t)((gt)->gt_mcastgrp
) & 0xff) << 24 | ((__uint32_t)((gt)->gt_mcastgrp
) & 0xff00) << 8 | ((__uint32_t)((gt)->gt_mcastgrp
) & 0xff0000) >> 8 | ((__uint32_t)((gt)->gt_mcastgrp
) & 0xff000000) >> 24) : __swap32md((gt)->gt_mcastgrp
)) & 0xff000000) == 0xef000000) for (_i = 0; _i < numvifs
; _i++) if (scoped_addr(_i, (gt)->gt_mcastgrp)) (((gt)->
gt_scope) |= (1 << (_i))); };
   if (VIFM_ISSET(r->rt_parent, gt->gt_scope)((gt->gt_scope) & (1 << (r->rt_parent))))
gt->gt_scope = -1;
   gt->gt_grpmems &= ~gt->gt_scope;
} else {
   gt->gt_scope = -1;
   gt->gt_grpmems = 0;
}

/* update ttls */
prun_add_ttls(gt);

gt->gt_next = *gtnp;
*gtnp = gt;
if (gt->gt_next)
   gt->gt_next->gt_prev = gt;
gt->gt_prev = prev_gt;

if (r) {
   if (find_src_grp(r->rt_origin, r->rt_originmask, gt->gt_mcastgrp)) {
struct gtable *g;

g = gtp ? gtp->gt_gnext : kernel_table;
logit(LOG_WARNING4, 0, "Entry for (%s %s) (rt:%x) exists (rt:%x)",
    inet_fmts(r->rt_origin, r->rt_originmask, s1),
    inet_fmt(g->gt_mcastgrp, s2),
    r, g->gt_route);
   } else {
if (gtp) {
    gt->gt_gnext = gtp->gt_gnext;
    gt->gt_gprev = gtp;
    gtp->gt_gnext = gt;
} else {
    gt->gt_gnext = kernel_table;
    gt->gt_gprev = NULL((void *)0);
    kernel_table = gt;
}
if (gt->gt_gnext)
    gt->gt_gnext->gt_gprev = gt;
   }
} else {
   gt->gt_gnext = gt->gt_gprev = NULL((void *)0);
}
  }

  stnp = &gt->gt_srctbl;
  while ((st = *stnp) != NULL((void *)0)) {
10
←
Assuming the condition is false→
11
←
Loop condition is false. Execution continues on line 485→
if (ntohl(st->st_origin)(__uint32_t)(__builtin_constant_p(st->st_origin) ? (__uint32_t
)(((__uint32_t)(st->st_origin) & 0xff) << 24 | (
(__uint32_t)(st->st_origin) & 0xff00) << 8 | ((__uint32_t
)(st->st_origin) & 0xff0000) >> 8 | ((__uint32_t
)(st->st_origin) & 0xff000000) >> 24) : __swap32md
(st->st_origin)) >= ntohl(origin)(__uint32_t)(__builtin_constant_p(origin) ? (__uint32_t)(((__uint32_t
)(origin) & 0xff) << 24 | ((__uint32_t)(origin) &
 0xff00) << 8 | ((__uint32_t)(origin) & 0xff0000) >>
| ((__uint32_t)(origin) & 0xff000000) >> 24) : __swap32md
(origin)))
   break;
stnp = &st->st_next;
  }

  if (st11.1
'st' is equal to NULL
 == NULL((void *)0) || st->st_origin != origin) {
st = malloc(sizeof(struct stable));
12
←
Value assigned to 'st'→
if (st == NULL((void *)0))
13
←
Assuming 'st' is equal to NULL→
14
←
Taking true branch→
   logit(LOG_ERR3, 0, "ran out of memory");

st->st_origin = origin;
15
←
Access to field 'st_origin' results in a dereference of a null pointer (loaded from variable 'st')
st->st_pktcnt = 0;
st->st_next = *stnp;
*stnp = st;
  } else {
495#ifdef DEBUG_MFC
md_logit(MD_DUPE, origin, mcastgrp);
497#endif
logit(LOG_WARNING4, 0, "kernel entry already exists for (%s %s)",
inet_fmt(origin, s1), inet_fmt(mcastgrp, s2));
/* XXX Doing this should cause no harm, and may ensure
* kernel<>mrouted synchronization */
k_add_rg(origin, gt);
return;
  }

  kroutes++;
  k_add_rg(origin, gt);

  logit(LOG_DEBUG7, 0, "add cache entry (%s %s) gm:%x, parent-vif:%d",
inet_fmt(origin, s1),
inet_fmt(mcastgrp, s2),
gt->gt_grpmems, r ? r->rt_parent : -1);

  /* If there are no leaf vifs
   * which have this group, then
   * mark this src-grp as a prune candidate.
   */
  if (!gt->gt_prsent_timer && !gt->gt_grpmems && r && r->rt_gateway)
send_prune(gt);
520}

522/*
* An mrouter has gone down and come up on an interface
* Forward on that interface immediately
*/
526void
527reset_neighbor_state(vifi_t vifi, u_int32_t addr)
528{
  struct rtentry *r;
  struct gtable *g;
  struct ptable *pt, **ptnp;
  struct stable *st;

  for (g = kernel_table; g; g = g->gt_gnext) {
r = g->gt_route;

/*
* If neighbor was the parent, remove the prune sent state
* and all of the source cache info so that prunes get
* regenerated.
*/
if (vifi == r->rt_parent) {
   if (addr == r->rt_gateway) {
logit(LOG_DEBUG7, 0, "reset_neighbor_state parent reset (%s %s)",
    inet_fmts(r->rt_origin, r->rt_originmask, s1),
    inet_fmt(g->gt_mcastgrp, s2));

g->gt_prsent_timer = 0;
g->gt_grftsnt = 0;
while ((st = g->gt_srctbl)) {
    g->gt_srctbl = st->st_next;
    k_del_rg(st->st_origin, g);
    kroutes--;
    free(st);
}
   }
} else {
   /*
    * Neighbor was not the parent, send grafts to join the groups
    */
   if (g->gt_prsent_timer) {
g->gt_grftsnt = 1;
send_graft(g);
g->gt_prsent_timer = 0;
   }

   /*
    * Remove any prunes that this router has sent us.
    */
   ptnp = &g->gt_pruntbl;
   while ((pt = *ptnp) != NULL((void *)0)) {
if (pt->pt_vifi == vifi && pt->pt_router == addr) {
    *ptnp = pt->pt_next;
    free(pt);
} else
    ptnp = &pt->pt_next;
   }

   /*
    * And see if we want to forward again.
    */
   if (!VIFM_ISSET(vifi, g->gt_grpmems)((g->gt_grpmems) & (1 << (vifi)))) {
if (VIFM_ISSET(vifi, r->rt_children)((r->rt_children) & (1 << (vifi))) &&
    !(VIFM_ISSET(vifi, r->rt_leaves)((r->rt_leaves) & (1 << (vifi)))))
    VIFM_SET(vifi, g->gt_grpmems)((g->gt_grpmems) |= (1 << (vifi)));

if (VIFM_ISSET(vifi, r->rt_leaves)((r->rt_leaves) & (1 << (vifi))) &&
    grplst_mem(vifi, g->gt_mcastgrp))
    VIFM_SET(vifi, g->gt_grpmems)((g->gt_grpmems) |= (1 << (vifi)));

g->gt_grpmems &= ~g->gt_scope;
prun_add_ttls(g);

/* Update kernel state */
update_kernel(g);
596#ifdef RSRR
/* Send route change notification to reservation protocol. */
rsrr_cache_send(g,1);
599#endif /* RSRR */

logit(LOG_DEBUG7, 0, "reset member state (%s %s) gm:%x",
    inet_fmts(r->rt_origin, r->rt_originmask, s1),
    inet_fmt(g->gt_mcastgrp, s2), g->gt_grpmems);
   }
}
  }
607}

609/*
* Delete table entry from the kernel
* del_flag determines how many entries to delete
*/
613void
614del_table_entry(struct rtentry *r, u_int32_t mcastgrp, u_int del_flag)
615{
  struct gtable *g, *prev_g;
  struct stable *st, *prev_st;
  struct ptable *pt, *prev_pt;

  if (del_flag == DEL_ALL_ROUTES1) {
g = r->rt_groups;
while (g) {
   logit(LOG_DEBUG7, 0, "del_table_entry deleting (%s %s)",
inet_fmts(r->rt_origin, r->rt_originmask, s1),
inet_fmt(g->gt_mcastgrp, s2));
   st = g->gt_srctbl;
   while (st) {
if (k_del_rg(st->st_origin, g) < 0) {
    logit(LOG_WARNING4, errno(*__errno()),
	"del_table_entry trying to delete (%s, %s)",
	inet_fmt(st->st_origin, s1),
	inet_fmt(g->gt_mcastgrp, s2));
}
kroutes--;
prev_st = st;
st = st->st_next;
free(prev_st);
   }
   g->gt_srctbl = NULL((void *)0);

   pt = g->gt_pruntbl;
   while (pt) {
prev_pt = pt;
pt = pt->pt_next;
free(prev_pt);
   }
   g->gt_pruntbl = NULL((void *)0);

   if (g->gt_gnext)
g->gt_gnext->gt_gprev = g->gt_gprev;
   if (g->gt_gprev)
g->gt_gprev->gt_gnext = g->gt_gnext;
   else
kernel_table = g->gt_gnext;

656#ifdef RSRR
   /* Send route change notification to reservation protocol. */
   rsrr_cache_send(g,0);
   rsrr_cache_clean(g);
660#endif /* RSRR */
   prev_g = g;
   g = g->gt_next;
   free(prev_g);
}
r->rt_groups = NULL((void *)0);
  }

  /*
   * Dummy routine - someday this may be needed, so it is just there
   */
  if (del_flag == DEL_RTE_GROUP0) {
prev_g = (struct gtable *)&r->rt_groups;
for (g = r->rt_groups; g; g = g->gt_next) {
   if (g->gt_mcastgrp == mcastgrp) {
logit(LOG_DEBUG7, 0, "del_table_entry deleting (%s %s)",
    inet_fmts(r->rt_origin, r->rt_originmask, s1),
    inet_fmt(g->gt_mcastgrp, s2));
st = g->gt_srctbl;
while (st) {
    if (k_del_rg(st->st_origin, g) < 0) {
	logit(LOG_WARNING4, errno(*__errno()),
	    "del_table_entry trying to delete (%s, %s)",
	    inet_fmt(st->st_origin, s1),
	    inet_fmt(g->gt_mcastgrp, s2));
    }
    kroutes--;
    prev_st = st;
    st = st->st_next;
    free(prev_st);
}
g->gt_srctbl = NULL((void *)0);

pt = g->gt_pruntbl;
while (pt) {
    prev_pt = pt;
    pt = pt->pt_next;
    free(prev_pt);
}
g->gt_pruntbl = NULL((void *)0);

if (g->gt_gnext)
    g->gt_gnext->gt_gprev = g->gt_gprev;
if (g->gt_gprev)
    g->gt_gprev->gt_gnext = g->gt_gnext;
else
    kernel_table = g->gt_gnext;

if (prev_g != (struct gtable *)&r->rt_groups)
    g->gt_next->gt_prev = prev_g;
else
    g->gt_next->gt_prev = NULL((void *)0);
prev_g->gt_next = g->gt_next;

714#ifdef RSRR
/* Send route change notification to reservation protocol. */
rsrr_cache_send(g,0);
rsrr_cache_clean(g);
718#endif /* RSRR */
free(g);
g = prev_g;
   } else {
prev_g = g;
   }
}
  }
726}

728/*
* update kernel table entry when a route entry changes
*/
731void
732update_table_entry(struct rtentry *r)
733{
  struct gtable *g;
  struct ptable *pt, *prev_pt;
  vifi_t i;

  for (g = r->rt_groups; g; g = g->gt_next) {
pt = g->gt_pruntbl;
while (pt) {
   prev_pt = pt->pt_next;
   free(pt);
   pt = prev_pt;
}
g->gt_pruntbl = NULL((void *)0);

g->gt_grpmems = 0;

/* obtain the multicast group membership list */
for (i = 0; i < numvifs; i++) {
   if (VIFM_ISSET(i, r->rt_children)((r->rt_children) & (1 << (i))) &&
!(VIFM_ISSET(i, r->rt_leaves)((r->rt_leaves) & (1 << (i)))))
VIFM_SET(i, g->gt_grpmems)((g->gt_grpmems) |= (1 << (i)));

   if (VIFM_ISSET(i, r->rt_leaves)((r->rt_leaves) & (1 << (i))) && grplst_mem(i, g->gt_mcastgrp))
VIFM_SET(i, g->gt_grpmems)((g->gt_grpmems) |= (1 << (i)));
}
if (VIFM_ISSET(r->rt_parent, g->gt_scope)((g->gt_scope) & (1 << (r->rt_parent))))
   g->gt_scope = -1;
g->gt_grpmems &= ~g->gt_scope;

logit(LOG_DEBUG7, 0, "updating cache entries (%s %s) gm:%x",
   inet_fmts(r->rt_origin, r->rt_originmask, s1),
   inet_fmt(g->gt_mcastgrp, s2),
   g->gt_grpmems);

if (g->gt_grpmems && g->gt_prsent_timer) {
   g->gt_grftsnt = 1;
   send_graft(g);
   g->gt_prsent_timer = 0;
}

/* update ttls and add entry into kernel */
prun_add_ttls(g);
update_kernel(g);
776#ifdef RSRR
/* Send route change notification to reservation protocol. */
rsrr_cache_send(g,1);
779#endif /* RSRR */

/* Check if we want to prune this group */
if (!g->gt_prsent_timer && g->gt_grpmems == 0 && r->rt_gateway) {
   g->gt_timer = CACHE_LIFETIME(cache_lifetime)((cache_lifetime) + (arc4random_uniform(cache_lifetime)));
   send_prune(g);
}
  }
787}

789/*
* set the forwarding flag for all mcastgrps on this vifi
*/
792void
793update_lclgrp(vifi_t vifi, u_int32_t mcastgrp)
794{
  struct rtentry *r;
  struct gtable *g;

  logit(LOG_DEBUG7, 0, "group %s joined on vif %d",
inet_fmt(mcastgrp, s1), vifi);

  for (g = kernel_table; g; g = g->gt_gnext) {
if (ntohl(mcastgrp)(__uint32_t)(__builtin_constant_p(mcastgrp) ? (__uint32_t)(((
__uint32_t)(mcastgrp) & 0xff) << 24 | ((__uint32_t)
(mcastgrp) & 0xff00) << 8 | ((__uint32_t)(mcastgrp)
 & 0xff0000) >> 8 | ((__uint32_t)(mcastgrp) & 0xff000000
) >> 24) : __swap32md(mcastgrp)) < ntohl(g->gt_mcastgrp)(__uint32_t)(__builtin_constant_p(g->gt_mcastgrp) ? (__uint32_t
)(((__uint32_t)(g->gt_mcastgrp) & 0xff) << 24 | (
(__uint32_t)(g->gt_mcastgrp) & 0xff00) << 8 | ((
__uint32_t)(g->gt_mcastgrp) & 0xff0000) >> 8 | (
(__uint32_t)(g->gt_mcastgrp) & 0xff000000) >> 24
) : __swap32md(g->gt_mcastgrp)))
   break;

r = g->gt_route;
if (g->gt_mcastgrp == mcastgrp &&
   VIFM_ISSET(vifi, r->rt_children)((r->rt_children) & (1 << (vifi)))) {

   VIFM_SET(vifi, g->gt_grpmems)((g->gt_grpmems) |= (1 << (vifi)));
   g->gt_grpmems &= ~g->gt_scope;
   if (g->gt_grpmems == 0)
continue;

   prun_add_ttls(g);
   logit(LOG_DEBUG7, 0, "update lclgrp (%s %s) gm:%x",
inet_fmts(r->rt_origin, r->rt_originmask, s1),
inet_fmt(g->gt_mcastgrp, s2), g->gt_grpmems);

   update_kernel(g);
820#ifdef RSRR
   /* Send route change notification to reservation protocol. */
   rsrr_cache_send(g,1);
823#endif /* RSRR */
}
  }
826}

828/*
* reset forwarding flag for all mcastgrps on this vifi
*/
831void
832delete_lclgrp(vifi_t vifi, u_int32_t mcastgrp)
833{
  struct rtentry *r;
  struct gtable *g;

  logit(LOG_DEBUG7, 0, "group %s left on vif %d",
inet_fmt(mcastgrp, s1), vifi);

  for (g = kernel_table; g; g = g->gt_gnext) {
if (ntohl(mcastgrp)(__uint32_t)(__builtin_constant_p(mcastgrp) ? (__uint32_t)(((
__uint32_t)(mcastgrp) & 0xff) << 24 | ((__uint32_t)
(mcastgrp) & 0xff00) << 8 | ((__uint32_t)(mcastgrp)
 & 0xff0000) >> 8 | ((__uint32_t)(mcastgrp) & 0xff000000
) >> 24) : __swap32md(mcastgrp)) < ntohl(g->gt_mcastgrp)(__uint32_t)(__builtin_constant_p(g->gt_mcastgrp) ? (__uint32_t
)(((__uint32_t)(g->gt_mcastgrp) & 0xff) << 24 | (
(__uint32_t)(g->gt_mcastgrp) & 0xff00) << 8 | ((
__uint32_t)(g->gt_mcastgrp) & 0xff0000) >> 8 | (
(__uint32_t)(g->gt_mcastgrp) & 0xff000000) >> 24
) : __swap32md(g->gt_mcastgrp)))
   break;

if (g->gt_mcastgrp == mcastgrp) {
   int stop_sending = 1;

   r = g->gt_route;
   /*
    * If this is not a leaf, then we have router neighbors on this
    * vif.  Only turn off forwarding if they have all pruned.
    */
   if (!VIFM_ISSET(vifi, r->rt_leaves)((r->rt_leaves) & (1 << (vifi)))) {
struct listaddr *vr;

for (vr = uvifs[vifi].uv_neighbors; vr; vr = vr->al_next)
  if (find_prune_entry(vr->al_addr, g->gt_pruntbl) == NULL((void *)0)) {
      stop_sending = 0;
      break;
  }
   }

   if (stop_sending) {
VIFM_CLR(vifi, g->gt_grpmems)((g->gt_grpmems) &= ~(1 << (vifi)));
logit(LOG_DEBUG7, 0, "delete lclgrp (%s %s) gm:%x",
    inet_fmts(r->rt_origin, r->rt_originmask, s1),
    inet_fmt(g->gt_mcastgrp, s2), g->gt_grpmems);

prun_add_ttls(g);
update_kernel(g);
870#ifdef RSRR
/* Send route change notification to reservation protocol. */
rsrr_cache_send(g,1);
873#endif /* RSRR */

/*
 * If there are no more members of this particular group,
 *  send prune upstream
 */
if (!g->gt_prsent_timer && g->gt_grpmems == 0 && r->rt_gateway)
    send_prune(g);
   }
}
  }
884}

886/*
* Takes the prune message received and then strips it to
* determine the (src, grp) pair to be pruned.
*
* Adds the router to the (src, grp) entry then.
*
* Determines if further packets have to be sent down that vif
*
* Determines if a corresponding prune message has to be generated
*/
896void
897accept_prune(u_int32_t src, u_int32_t dst, char *p, int datalen)
898{
  u_int32_t prun_src;
  u_int32_t prun_grp;
  u_int32_t prun_tmr;
  vifi_t vifi;
  int i;
  int stop_sending;
  struct rtentry *r;
  struct gtable *g;
  struct ptable *pt;
  struct listaddr *vr;

  /* Don't process any prunes if router is not pruning */
  if (pruning == 0)
return;

  if ((vifi = find_vif(src, dst)) == NO_VIF((vifi_t)32)) {
logit(LOG_INFO6, 0,
   "ignoring prune report from non-neighbor %s",
   inet_fmt(src, s1));
return;
  }

  /* Check if enough data is present */
  if (datalen < 12)
{
   logit(LOG_WARNING4, 0,
"non-decipherable prune from %s",
inet_fmt(src, s1));
   return;
}

  for (i = 0; i< 4; i++)
((char *)&prun_src)[i] = *p++;
  for (i = 0; i< 4; i++)
((char *)&prun_grp)[i] = *p++;
  for (i = 0; i< 4; i++)
((char *)&prun_tmr)[i] = *p++;
  prun_tmr = ntohl(prun_tmr)(__uint32_t)(__builtin_constant_p(prun_tmr) ? (__uint32_t)(((
__uint32_t)(prun_tmr) & 0xff) << 24 | ((__uint32_t)
(prun_tmr) & 0xff00) << 8 | ((__uint32_t)(prun_tmr)
 & 0xff0000) >> 8 | ((__uint32_t)(prun_tmr) & 0xff000000
) >> 24) : __swap32md(prun_tmr));

  logit(LOG_DEBUG7, 0, "%s on vif %d prunes (%s %s)/%d",
inet_fmt(src, s1), vifi,
inet_fmt(prun_src, s2), inet_fmt(prun_grp, s3), prun_tmr);

  /*
   * Find the subnet for the prune
   */
  if (find_src_grp(prun_src, 0, prun_grp)) {
g = gtp ? gtp->gt_gnext : kernel_table;
r = g->gt_route;

if (!VIFM_ISSET(vifi, r->rt_children)((r->rt_children) & (1 << (vifi)))) {
   logit(LOG_WARNING4, 0, "prune received from non-child %s for (%s %s)",
inet_fmt(src, s1), inet_fmt(prun_src, s2),
inet_fmt(prun_grp, s3));
   return;
}
if (VIFM_ISSET(vifi, g->gt_scope)((g->gt_scope) & (1 << (vifi)))) {
   logit(LOG_WARNING4, 0, "prune received from %s on scoped grp (%s %s)",
inet_fmt(src, s1), inet_fmt(prun_src, s2),
inet_fmt(prun_grp, s3));
   return;
}
if ((pt = find_prune_entry(src, g->gt_pruntbl)) != NULL((void *)0)) {
   /*
    * If it's about to expire, then it's only still around because
    * of timer granularity, so don't warn about it.
    */
   if (pt->pt_timer > 10) {
logit(LOG_WARNING4, 0, "%s %d from %s for (%s %s)/%d %s %d %s %x",
    "duplicate prune received on vif",
    vifi, inet_fmt(src, s1), inet_fmt(prun_src, s2),
    inet_fmt(prun_grp, s3), prun_tmr,
    "old timer:", pt->pt_timer, "cur gm:", g->gt_grpmems);
   }
   pt->pt_timer = prun_tmr;
} else {
   /* allocate space for the prune structure */
   pt = malloc(sizeof(struct ptable));
   if (pt == NULL((void *)0))
     logit(LOG_ERR3, 0, "pt: ran out of memory");

   pt->pt_vifi = vifi;
   pt->pt_router = src;
   pt->pt_timer = prun_tmr;

   pt->pt_next = g->gt_pruntbl;
   g->gt_pruntbl = pt;
}

/* Refresh the group's lifetime */
g->gt_timer = CACHE_LIFETIME(cache_lifetime)((cache_lifetime) + (arc4random_uniform(cache_lifetime)));
if (g->gt_timer < prun_tmr)
   g->gt_timer = prun_tmr;

/*
* check if any more packets need to be sent on the
* vif which sent this message
*/
stop_sending = 1;
for (vr = uvifs[vifi].uv_neighbors; vr; vr = vr->al_next)
 if (find_prune_entry(vr->al_addr, g->gt_pruntbl) == NULL((void *)0))  {
     stop_sending = 0;
     break;
 }

if (stop_sending && !grplst_mem(vifi, prun_grp)) {
   VIFM_CLR(vifi, g->gt_grpmems)((g->gt_grpmems) &= ~(1 << (vifi)));
   logit(LOG_DEBUG7, 0, "prune (%s %s), stop sending on vif %d, gm:%x",
inet_fmts(r->rt_origin, r->rt_originmask, s1),
inet_fmt(g->gt_mcastgrp, s2), vifi, g->gt_grpmems);

   prun_add_ttls(g);
   update_kernel(g);
1012#ifdef RSRR
   /* Send route change notification to reservation protocol. */
   rsrr_cache_send(g,1);
1015#endif /* RSRR */
}

/*
* check if all the child routers have expressed no interest
* in this group and if this group does not exist in the
* interface
* Send a prune message then upstream
*/
if (!g->gt_prsent_timer && g->gt_grpmems == 0 && r->rt_gateway) {
   send_prune(g);
}
  } else {
/*
* There is no kernel entry for this group.  Therefore, we can
* simply ignore the prune, as we are not forwarding this traffic
* downstream.
*/
logit(LOG_DEBUG7, 0, "%s (%s %s)/%d from %s",
   "prune message received with no kernel entry for",
   inet_fmt(prun_src, s1), inet_fmt(prun_grp, s2),
   prun_tmr, inet_fmt(src, s3));
return;
  }
1039}

1041/*
* Checks if this mcastgrp is present in the kernel table
* If so and if a prune was sent, it sends a graft upwards
*/
1045void
1046chkgrp_graft(vifi_t vifi, u_int32_t mcastgrp)
1047{
  struct rtentry *r;
  struct gtable *g;

  for (g = kernel_table; g; g = g->gt_gnext) {
if (ntohl(mcastgrp)(__uint32_t)(__builtin_constant_p(mcastgrp) ? (__uint32_t)(((
__uint32_t)(mcastgrp) & 0xff) << 24 | ((__uint32_t)
(mcastgrp) & 0xff00) << 8 | ((__uint32_t)(mcastgrp)
 & 0xff0000) >> 8 | ((__uint32_t)(mcastgrp) & 0xff000000
) >> 24) : __swap32md(mcastgrp)) < ntohl(g->gt_mcastgrp)(__uint32_t)(__builtin_constant_p(g->gt_mcastgrp) ? (__uint32_t
)(((__uint32_t)(g->gt_mcastgrp) & 0xff) << 24 | (
(__uint32_t)(g->gt_mcastgrp) & 0xff00) << 8 | ((
__uint32_t)(g->gt_mcastgrp) & 0xff0000) >> 8 | (
(__uint32_t)(g->gt_mcastgrp) & 0xff000000) >> 24
) : __swap32md(g->gt_mcastgrp)))
   break;

r = g->gt_route;
if (g->gt_mcastgrp == mcastgrp && VIFM_ISSET(vifi, r->rt_children)((r->rt_children) & (1 << (vifi))))
   if (g->gt_prsent_timer) {
VIFM_SET(vifi, g->gt_grpmems)((g->gt_grpmems) |= (1 << (vifi)));

/*
 * If the vif that was joined was a scoped vif,
 * ignore it ; don't graft back
 */
g->gt_grpmems &= ~g->gt_scope;
if (g->gt_grpmems == 0)
    continue;

/* set the flag for graft retransmission */
g->gt_grftsnt = 1;

/* send graft upwards */
send_graft(g);

/* reset the prune timer and update cache timer*/
g->gt_prsent_timer = 0;
g->gt_timer = max_prune_lifetime;

logit(LOG_DEBUG7, 0, "chkgrp graft (%s %s) gm:%x",
    inet_fmts(r->rt_origin, r->rt_originmask, s1),
    inet_fmt(g->gt_mcastgrp, s2), g->gt_grpmems);

prun_add_ttls(g);
update_kernel(g);
1084#ifdef RSRR
/* Send route change notification to reservation protocol. */
rsrr_cache_send(g,1);
1087#endif /* RSRR */
   }
  }
1090}

1092/* determine the multicast group and src
*
* if it does, then determine if a prune was sent
* upstream.
* if prune sent upstream, send graft upstream and send
* ack downstream.
*
* if no prune sent upstream, change the forwarding bit
* for this interface and send ack downstream.
*
* if no entry exists for this group send ack downstream.
*/
1104void
1105accept_graft(u_int32_t src, u_int32_t dst, char *p, int datalen)
1106{
  vifi_t	vifi;
  u_int32_t	graft_src;
  u_int32_t	graft_grp;
  int		i;
  struct rtentry *r;
  struct gtable *g;
  struct ptable *pt, **ptnp;

  if ((vifi = find_vif(src, dst)) == NO_VIF((vifi_t)32)) {
logit(LOG_INFO6, 0,
   "ignoring graft from non-neighbor %s",
   inet_fmt(src, s1));
return;
  }

  if (datalen < 8) {
logit(LOG_WARNING4, 0,
   "received non-decipherable graft from %s",
   inet_fmt(src, s1));
return;
  }

  for (i = 0; i< 4; i++)
((char *)&graft_src)[i] = *p++;
  for (i = 0; i< 4; i++)
((char *)&graft_grp)[i] = *p++;

  logit(LOG_DEBUG7, 0, "%s on vif %d grafts (%s %s)",
inet_fmt(src, s1), vifi,
inet_fmt(graft_src, s2), inet_fmt(graft_grp, s3));

  /*
   * Find the subnet for the graft
   */
  if (find_src_grp(graft_src, 0, graft_grp)) {
g = gtp ? gtp->gt_gnext : kernel_table;
r = g->gt_route;

if (VIFM_ISSET(vifi, g->gt_scope)((g->gt_scope) & (1 << (vifi)))) {
   logit(LOG_WARNING4, 0, "graft received from %s on scoped grp (%s %s)",
inet_fmt(src, s1), inet_fmt(graft_src, s2),
inet_fmt(graft_grp, s3));
   return;
}

ptnp = &g->gt_pruntbl;
while ((pt = *ptnp) != NULL((void *)0)) {
   if ((pt->pt_vifi == vifi) && (pt->pt_router == src)) {
*ptnp = pt->pt_next;
free(pt);

VIFM_SET(vifi, g->gt_grpmems)((g->gt_grpmems) |= (1 << (vifi)));
logit(LOG_DEBUG7, 0, "accept graft (%s %s) gm:%x",
    inet_fmts(r->rt_origin, r->rt_originmask, s1),
    inet_fmt(g->gt_mcastgrp, s2), g->gt_grpmems);

prun_add_ttls(g);
update_kernel(g);
1165#ifdef RSRR
/* Send route change notification to reservation protocol. */
rsrr_cache_send(g,1);
1168#endif /* RSRR */
break;
   } else {
ptnp = &pt->pt_next;
   }
}

/* send ack downstream */
send_graft_ack(dst, src, graft_src, graft_grp);
g->gt_timer = max_prune_lifetime;

if (g->gt_prsent_timer) {
   /* set the flag for graft retransmission */
   g->gt_grftsnt = 1;

   /* send graft upwards */
   send_graft(g);

   /* reset the prune sent timer */
   g->gt_prsent_timer = 0;
}
  } else {
/*
* We have no state for the source and group in question.
* We can simply acknowledge the graft, since we know
* that we have no prune state, and grafts are requests
* to remove prune state.
*/
send_graft_ack(dst, src, graft_src, graft_grp);
logit(LOG_DEBUG7, 0, "%s (%s %s) from %s",
   "graft received with no kernel entry for",
   inet_fmt(graft_src, s1), inet_fmt(graft_grp, s2),
   inet_fmt(src, s3));
return;
  }
1203}

1205/*
* find out which group is involved first of all
* then determine if a graft was sent.
* if no graft sent, ignore the message
* if graft was sent and the ack is from the right
* source, remove the graft timer so that we don't
* have send a graft again
*/
1213void
1214accept_g_ack(u_int32_t src, u_int32_t dst, char *p, int datalen)
1215{
  struct gtable *g;
  vifi_t	vifi;
  u_int32_t	grft_src;
  u_int32_t	grft_grp;
  int		i;

  if ((vifi = find_vif(src, dst)) == NO_VIF((vifi_t)32)) {
logit(LOG_INFO6, 0,
   "ignoring graft ack from non-neighbor %s",
   inet_fmt(src, s1));
return;
  }

  if (datalen < 0  || datalen > 8) {
logit(LOG_WARNING4, 0,
   "received non-decipherable graft ack from %s",
   inet_fmt(src, s1));
return;
  }

  for (i = 0; i< 4; i++)
((char *)&grft_src)[i] = *p++;
  for (i = 0; i< 4; i++)
((char *)&grft_grp)[i] = *p++;

  logit(LOG_DEBUG7, 0, "%s on vif %d acks graft (%s, %s)",
inet_fmt(src, s1), vifi,
inet_fmt(grft_src, s2), inet_fmt(grft_grp, s3));

  /*
   * Find the subnet for the graft ack
   */
  if (find_src_grp(grft_src, 0, grft_grp)) {
g = gtp ? gtp->gt_gnext : kernel_table;
g->gt_grftsnt = 0;
  } else {
logit(LOG_WARNING4, 0, "%s (%s, %s) from %s",
   "rcvd graft ack with no kernel entry for",
   inet_fmt(grft_src, s1), inet_fmt(grft_grp, s2),
   inet_fmt(src, s3));
return;
  }
1258}


1261/*
* free all prune entries and kernel routes
* normally, this should inform the kernel that all of its routes
* are going away, but this is only called by restart(), which is
* about to call MRT_DONE which does that anyway.
*/
1267void
1268free_all_prunes(void)
1269{
  struct rtentry *r;
  struct gtable *g, *prev_g;
  struct stable *s, *prev_s;
  struct ptable *p, *prev_p;

  for (r = routing_table; r; r = r->rt_next) {
g = r->rt_groups;
while (g) {
   s = g->gt_srctbl;
   while (s) {
prev_s = s;
s = s->st_next;
free(prev_s);
   }

   p = g->gt_pruntbl;
   while (p) {
prev_p = p;
p = p->pt_next;
free(prev_p);
   }

   prev_g = g;
   g = g->gt_next;
   free(prev_g);
}
r->rt_groups = NULL((void *)0);
  }
  kernel_table = NULL((void *)0);

  g = kernel_no_route;
  while (g) {
free(g->gt_srctbl);

prev_g = g;
g = g->gt_next;
free(prev_g);
  }
  kernel_no_route = NULL((void *)0);
1309}

1311/*
* When a new route is created, search
* a) The less-specific part of the routing table
* b) The route-less kernel table
* for sources that the new route might want to handle.
*
* "Inheriting" these sources might be cleanest, but simply deleting
* them is easier, and letting the kernel re-request them.
*/
1320void
1321steal_sources(struct rtentry *rt)
1322{
  struct rtentry *rp;
  struct gtable *gt, **gtnp;
  struct stable *st, **stnp;

  for (rp = rt->rt_next; rp; rp = rp->rt_next) {
if ((rt->rt_origin & rp->rt_originmask) == rp->rt_origin) {
   logit(LOG_DEBUG7, 0, "Route for %s stealing sources from %s",
inet_fmts(rt->rt_origin, rt->rt_originmask, s1),
inet_fmts(rp->rt_origin, rp->rt_originmask, s2));
   for (gt = rp->rt_groups; gt; gt = gt->gt_next) {
stnp = &gt->gt_srctbl;
while ((st = *stnp) != NULL((void *)0)) {
    if ((st->st_origin & rt->rt_originmask) == rt->rt_origin) {
	logit(LOG_DEBUG7, 0, "%s stealing (%s %s) from %s",
	    inet_fmts(rt->rt_origin, rt->rt_originmask, s1),
	    inet_fmt(st->st_origin, s3),
	    inet_fmt(gt->gt_mcastgrp, s4),
	    inet_fmts(rp->rt_origin, rp->rt_originmask, s2));
	if (k_del_rg(st->st_origin, gt) < 0) {
	    logit(LOG_WARNING4, errno(*__errno()), "%s (%s, %s)",
		"steal_sources trying to delete",
		inet_fmt(st->st_origin, s1),
		inet_fmt(gt->gt_mcastgrp, s2));
	}
	*stnp = st->st_next;
	kroutes--;
	free(st);
    } else {
	stnp = &st->st_next;
    }
}
   }
}
  }

  gtnp = &kernel_no_route;
  while ((gt = *gtnp) != NULL((void *)0)) {
if (gt->gt_srctbl && ((gt->gt_srctbl->st_origin & rt->rt_originmask)
		    == rt->rt_origin)) {
   logit(LOG_DEBUG7, 0, "%s stealing (%s %s) from %s",
inet_fmts(rt->rt_origin, rt->rt_originmask, s1),
inet_fmt(gt->gt_srctbl->st_origin, s3),
inet_fmt(gt->gt_mcastgrp, s4),
"no_route table");
   if (k_del_rg(gt->gt_srctbl->st_origin, gt) < 0) {
logit(LOG_WARNING4, errno(*__errno()), "%s (%s %s)",
    "steal_sources trying to delete",
    inet_fmt(gt->gt_srctbl->st_origin, s1),
    inet_fmt(gt->gt_mcastgrp, s2));
   }
   kroutes--;
   free(gt->gt_srctbl);
   *gtnp = gt->gt_next;
   if (gt->gt_next)
gt->gt_next->gt_prev = gt->gt_prev;
   free(gt);
} else {
   gtnp = &gt->gt_next;
}
  }
1383}

1385/*
* Advance the timers on all the cache entries.
* If there are any entries whose timers have expired,
* remove these entries from the kernel cache.
*/
1390void
1391age_table_entry(void)
1392{
  struct rtentry *r;
  struct gtable *gt, **gtnptr;
  struct stable *st, **stnp;
  struct ptable *pt, **ptnp;
  struct sioc_sg_req sg_req;

  logit(LOG_DEBUG7, 0, "ageing entries");

  gtnptr = &kernel_table;
  while ((gt = *gtnptr) != NULL((void *)0)) {
r = gt->gt_route;

/* advance the timer for the kernel entry */
gt->gt_timer -= ROUTE_MAX_REPORT_DELAY5;

/* decrement prune timer if need be */
if (gt->gt_prsent_timer > 0) {
   gt->gt_prsent_timer -= ROUTE_MAX_REPORT_DELAY5;
   if (gt->gt_prsent_timer <= 0) {
logit(LOG_DEBUG7, 0, "upstream prune tmo (%s %s)",
    inet_fmts(r->rt_origin, r->rt_originmask, s1),
    inet_fmt(gt->gt_mcastgrp, s2));
gt->gt_prsent_timer = -1;
   }
}

/* retransmit graft if graft sent flag is still set */
if (gt->gt_grftsnt) {
   switch(gt->gt_grftsnt++) {
   case 2:
   case 4:
   case 8:
   case 16:
   case 32:
   case 64:
   case 128:
send_graft(gt);
break;
   default:
break;
   }
}

/*
* Age prunes
*
* If a prune expires, forward again on that vif.
*/
ptnp = &gt->gt_pruntbl;
while ((pt = *ptnp) != NULL((void *)0)) {
   if ((pt->pt_timer -= ROUTE_MAX_REPORT_DELAY5) <= 0) {
logit(LOG_DEBUG7, 0, "expire prune (%s %s) from %s on vif %d",
    inet_fmts(r->rt_origin, r->rt_originmask, s1),
    inet_fmt(gt->gt_mcastgrp, s2),
    inet_fmt(pt->pt_router, s3),
    pt->pt_vifi);

expire_prune(pt->pt_vifi, gt);

/* remove the router's prune entry and await new one */
*ptnp = pt->pt_next;
free(pt);
   } else {
ptnp = &pt->pt_next;
   }
}

/*
* If the cache entry has expired, delete source table entries for
* silent sources.  If there are no source entries left, and there
* are no downstream prunes, then the entry is deleted.
* Otherwise, the cache entry's timer is refreshed.
*/
if (gt->gt_timer <= 0) {
   /* Check for traffic before deleting source entries */
   sg_req.grp.s_addr = gt->gt_mcastgrp;
   stnp = &gt->gt_srctbl;
   while ((st = *stnp) != NULL((void *)0)) {
sg_req.src.s_addr = st->st_origin;
if (ioctl(udp_socket, SIOCGETSGCNT(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct sioc_sg_req) & 0x1fff) << 16) | ((('u')) <<
 8) | ((52))), (char *)&sg_req) == -1) {
    logit(LOG_WARNING4, errno(*__errno()), "%s (%s %s)",
	"age_table_entry: SIOCGETSGCNT failing for",
	inet_fmt(st->st_origin, s1),
	inet_fmt(gt->gt_mcastgrp, s2));
    /* Make sure it gets deleted below */
    sg_req.pktcnt = st->st_pktcnt;
}
if (sg_req.pktcnt == st->st_pktcnt) {
    *stnp = st->st_next;
    logit(LOG_DEBUG7, 0, "age_table_entry deleting (%s %s)",
	inet_fmt(st->st_origin, s1),
	inet_fmt(gt->gt_mcastgrp, s2));
    if (k_del_rg(st->st_origin, gt) < 0) {
	logit(LOG_WARNING4, errno(*__errno()),
	    "age_table_entry trying to delete (%s %s)",
	    inet_fmt(st->st_origin, s1),
	    inet_fmt(gt->gt_mcastgrp, s2));
    }
    kroutes--;
    free(st);
} else {
    st->st_pktcnt = sg_req.pktcnt;
    stnp = &st->st_next;
}
   }

   /*
    * Retain the group entry if we have downstream prunes or if
    * there is at least one source in the list that still has
    * traffic, or if our upstream prune timer is running.
    */
   if (gt->gt_pruntbl != NULL((void *)0) || gt->gt_srctbl != NULL((void *)0) ||
gt->gt_prsent_timer > 0) {
gt->gt_timer = CACHE_LIFETIME(cache_lifetime)((cache_lifetime) + (arc4random_uniform(cache_lifetime)));
if (gt->gt_prsent_timer == -1) {
    if (gt->gt_grpmems == 0)
	send_prune(gt);
    else
	gt->gt_prsent_timer = 0;
}
gtnptr = &gt->gt_gnext;
continue;
   }

   logit(LOG_DEBUG7, 0, "timeout cache entry (%s, %s)",
inet_fmts(r->rt_origin, r->rt_originmask, s1),
inet_fmt(gt->gt_mcastgrp, s2));

   if (gt->gt_prev)
gt->gt_prev->gt_next = gt->gt_next;
   else
gt->gt_route->rt_groups = gt->gt_next;
   if (gt->gt_next)
gt->gt_next->gt_prev = gt->gt_prev;

   if (gt->gt_gprev) {
gt->gt_gprev->gt_gnext = gt->gt_gnext;
gtnptr = &gt->gt_gprev->gt_gnext;
   } else {
kernel_table = gt->gt_gnext;
gtnptr = &kernel_table;
   }
   if (gt->gt_gnext)
gt->gt_gnext->gt_gprev = gt->gt_gprev;

1538#ifdef RSRR
   /* Send route change notification to reservation protocol. */
   rsrr_cache_send(gt,0);
   rsrr_cache_clean(gt);
1542#endif /* RSRR */
   free((char *)gt);
} else {
   if (gt->gt_prsent_timer == -1) {
if (gt->gt_grpmems == 0)
    send_prune(gt);
else
    gt->gt_prsent_timer = 0;
   }
   gtnptr = &gt->gt_gnext;
}
  }

  /*
   * When traversing the no_route table, the decision is much easier.
   * Just delete it if it has timed out.
   */
  gtnptr = &kernel_no_route;
  while ((gt = *gtnptr) != NULL((void *)0)) {
/* advance the timer for the kernel entry */
gt->gt_timer -= ROUTE_MAX_REPORT_DELAY5;

if (gt->gt_timer < 0) {
   if (gt->gt_srctbl) {
if (k_del_rg(gt->gt_srctbl->st_origin, gt) < 0) {
    logit(LOG_WARNING4, errno(*__errno()), "%s (%s %s)",
	"age_table_entry trying to delete no-route",
	inet_fmt(gt->gt_srctbl->st_origin, s1),
	inet_fmt(gt->gt_mcastgrp, s2));
}
free(gt->gt_srctbl);
   }
   *gtnptr = gt->gt_next;
   if (gt->gt_next)
gt->gt_next->gt_prev = gt->gt_prev;

   free((char *)gt);
} else {
   gtnptr = &gt->gt_next;
}
  }
1583}

1585/*
* Modify the kernel to forward packets when one or multiple prunes that
* were received on the vif given by vifi, for the group given by gt,
* have expired.
*/
1590static void
1591expire_prune(vifi_t vifi, struct gtable *gt)
1592{
  /*
   * No need to send a graft, any prunes that we sent
   * will expire before any prunes that we have received.
   */
  if (gt->gt_prsent_timer > 0) {
      logit(LOG_DEBUG7, 0, "prune expired with %d left on %s",
gt->gt_prsent_timer, "prsent_timer");
      gt->gt_prsent_timer = 0;
  }

  /* modify the kernel entry to forward packets */
  if (!VIFM_ISSET(vifi, gt->gt_grpmems)((gt->gt_grpmems) & (1 << (vifi)))) {
      struct rtentry *rt = gt->gt_route;
      VIFM_SET(vifi, gt->gt_grpmems)((gt->gt_grpmems) |= (1 << (vifi)));
      logit(LOG_DEBUG7, 0, "forw again (%s %s) gm:%x vif:%d",
inet_fmts(rt->rt_origin, rt->rt_originmask, s1),
inet_fmt(gt->gt_mcastgrp, s2), gt->gt_grpmems, vifi);

      prun_add_ttls(gt);
      update_kernel(gt);
1613#ifdef RSRR
      /* Send route change notification to reservation protocol. */
      rsrr_cache_send(gt,1);
1616#endif /* RSRR */
  }
1618}


1621static char *
1622scaletime(time_t t)
1623{
  static char buf1[5];
  static char buf2[5];
  static char *buf=buf1;
  char s;
  char *p;

  p = buf;
  if (buf == buf1)
buf = buf2;
  else
buf = buf1;

  if (t < 120) {
s = 's';
  } else if (t < 3600) {
t /= 60;
s = 'm';
  } else if (t < 86400) {
t /= 3600;
s = 'h';
  } else if (t < 864000) {
t /= 86400;
s = 'd';
  } else {
t /= 604800;
s = 'w';
  }
  if (t > 999)
return "*** ";

  snprintf(p, 5, "%3d%c", (int)t, s);

  return p;
1657}

1659/*
* Print the contents of the cache table on file 'fp2'.
*/
1662void
1663dump_cache(FILE *fp2)
1664{
  struct rtentry *r;
  struct gtable *gt;
  struct stable *st;
  vifi_t i;
  time_t thyme = time(NULL((void *)0));

  fprintf(fp2,
   "Multicast Routing Cache Table (%d entries)\n%s", kroutes,
  " Origin             Mcast-group     CTmr  Age Ptmr IVif Forwvifs\n");

  for (gt = kernel_no_route; gt; gt = gt->gt_next) {
if (gt->gt_srctbl) {
   fprintf(fp2, " %-18s %-15s %-4s %-4s    - -1\n",
inet_fmts(gt->gt_srctbl->st_origin, 0xffffffff, s1),
inet_fmt(gt->gt_mcastgrp, s2), scaletime(gt->gt_timer),
scaletime(thyme - gt->gt_ctime));
   fprintf(fp2, ">%s\n", inet_fmt(gt->gt_srctbl->st_origin, s1));
}
  }

  for (gt = kernel_table; gt; gt = gt->gt_gnext) {
r = gt->gt_route;
fprintf(fp2, " %-18s %-15s",
   inet_fmts(r->rt_origin, r->rt_originmask, s1),
   inet_fmt(gt->gt_mcastgrp, s2));

fprintf(fp2, " %-4s", scaletime(gt->gt_timer));

fprintf(fp2, " %-4s %-4s ", scaletime(thyme - gt->gt_ctime),
	gt->gt_prsent_timer ? scaletime(gt->gt_prsent_timer) :
			      "   -");

fprintf(fp2, "%2u%c%c ", r->rt_parent,
   gt->gt_prsent_timer ? 'P' : ' ',
   VIFM_ISSET(r->rt_parent, gt->gt_scope)((gt->gt_scope) & (1 << (r->rt_parent))) ? 'B' : ' ');

for (i = 0; i < numvifs; ++i) {
   if (VIFM_ISSET(i, gt->gt_grpmems)((gt->gt_grpmems) & (1 << (i))))
fprintf(fp2, " %u ", i);
   else if (VIFM_ISSET(i, r->rt_children)((r->rt_children) & (1 << (i))) &&
     !VIFM_ISSET(i, r->rt_leaves)((r->rt_leaves) & (1 << (i))))
fprintf(fp2, " %u%c", i,
	VIFM_ISSET(i, gt->gt_scope)((gt->gt_scope) & (1 << (i))) ? 'b' : 'p');
}
fprintf(fp2, "\n");
for (st = gt->gt_srctbl; st; st = st->st_next) {
   fprintf(fp2, ">%s\n", inet_fmt(st->st_origin, s1));
}
1713#ifdef DEBUG_PRUNES
for (pt = gt->gt_pruntbl; pt; pt = pt->pt_next) {
   fprintf(fp2, "<r:%s v:%d t:%d\n", inet_fmt(pt->pt_router, s1),
pt->pt_vifi, pt->pt_timer);
}
1718#endif
  }
1720}

1722/*
* Traceroute function which returns traceroute replies to the requesting
* router. Also forwards the request to downstream routers.
* NOTE: u_int no is narrowed to u_char
*/
1727void
1728accept_mtrace(u_int32_t src, u_int32_t dst, u_int32_t group,
  char *data, u_int no, int datalen)
1730{
  u_char type;
  struct rtentry *rt;
  struct gtable *gt;
  struct tr_query *qry;
  struct tr_resp  *resp;
  int vifi;
  char *p;
  int rcount;
  int errcode = TR_NO_ERR0;
  int resptype;
  struct timeval tp;
  struct sioc_vif_req v_req;
  struct sioc_sg_req sg_req;

  /* Remember qid across invocations */
  static u_int32_t oqid = 0;

  /* timestamp the request/response */
  gettimeofday(&tp, 0);

  /*
   * Check if it is a query or a response
   */
  if (datalen == QLENsizeof(struct tr_query)) {
type = QUERY1;
logit(LOG_DEBUG7, 0, "Initial traceroute query rcvd from %s to %s",
   inet_fmt(src, s1), inet_fmt(dst, s2));
  }
  else if ((datalen - QLENsizeof(struct tr_query)) % RLENsizeof(struct tr_resp) == 0) {
type = RESP2;
logit(LOG_DEBUG7, 0, "In-transit traceroute query rcvd from %s to %s",
   inet_fmt(src, s1), inet_fmt(dst, s2));
if (IN_MULTICAST(ntohl(dst))(((u_int32_t)((__uint32_t)(__builtin_constant_p(dst) ? (__uint32_t
)(((__uint32_t)(dst) & 0xff) << 24 | ((__uint32_t)(
dst) & 0xff00) << 8 | ((__uint32_t)(dst) & 0xff0000
) >> 8 | ((__uint32_t)(dst) & 0xff000000) >> 24
) : __swap32md(dst))) & ((u_int32_t)(0xf0000000))) == ((u_int32_t
)(0xe0000000)))) {
   logit(LOG_DEBUG7, 0, "Dropping multicast response");
   return;
}
  }
  else {
logit(LOG_WARNING4, 0, "%s from %s to %s",
   "Non decipherable traceroute request received",
   inet_fmt(src, s1), inet_fmt(dst, s2));
return;
  }

  qry = (struct tr_query *)data;

  /*
   * if it is a packet with all reports filled, drop it
   */
  if ((rcount = (datalen - QLENsizeof(struct tr_query))/RLENsizeof(struct tr_resp)) == no) {
logit(LOG_DEBUG7, 0, "packet with all reports filled in");
return;
  }

  logit(LOG_DEBUG7, 0, "s: %s g: %s d: %s ", inet_fmt(qry->tr_src, s1),
   inet_fmt(group, s2), inet_fmt(qry->tr_dst, s3));
  logit(LOG_DEBUG7, 0, "rttl: %d rd: %s", qry->tr_rttlq.ttl,
   inet_fmt(qry->tr_raddr, s1));
  logit(LOG_DEBUG7, 0, "rcount:%d, qid:%06x", rcount, qry->tr_qidq.qid);

  /* determine the routing table entry for this traceroute */
  rt = determine_route(qry->tr_src);
  if (rt) {
logit(LOG_DEBUG7, 0, "rt parent vif: %d rtr: %s metric: %d",
rt->rt_parent, inet_fmt(rt->rt_gateway, s1), rt->rt_metric);
logit(LOG_DEBUG7, 0, "rt origin %s",
inet_fmts(rt->rt_origin, rt->rt_originmask, s1));
  } else
logit(LOG_DEBUG7, 0, "...no route");

  /*
   * Query type packet - check if rte exists
   * Check if the query destination is a vif connected to me.
   * and if so, whether I should start response back
   */
  if (type == QUERY1) {
if (oqid == qry->tr_qidq.qid) {
   /*
    * If the multicast router is a member of the group being
    * queried, and the query is multicasted, then the router can
    * receive multiple copies of the same query.  If we have already
    * replied to this traceroute, just ignore it this time.
    *
    * This is not a total solution, but since if this fails you
    * only get N copies, N <= the number of interfaces on the router,
    * it is not fatal.
    */
   logit(LOG_DEBUG7, 0, "ignoring duplicate traceroute packet");
   return;
}

if (rt == NULL((void *)0)) {
   logit(LOG_DEBUG7, 0, "Mcast traceroute: no route entry %s",
   inet_fmt(qry->tr_src, s1));
   if (IN_MULTICAST(ntohl(dst))(((u_int32_t)((__uint32_t)(__builtin_constant_p(dst) ? (__uint32_t
)(((__uint32_t)(dst) & 0xff) << 24 | ((__uint32_t)(
dst) & 0xff00) << 8 | ((__uint32_t)(dst) & 0xff0000
) >> 8 | ((__uint32_t)(dst) & 0xff000000) >> 24
) : __swap32md(dst))) & ((u_int32_t)(0xf0000000))) == ((u_int32_t
)(0xe0000000))))
return;
}
vifi = find_vif(qry->tr_dst, 0);

if (vifi == NO_VIF((vifi_t)32)) {
   /* The traceroute destination is not on one of my subnet vifs. */
   logit(LOG_DEBUG7, 0, "Destination %s not an interface",
   inet_fmt(qry->tr_dst, s1));
   if (IN_MULTICAST(ntohl(dst))(((u_int32_t)((__uint32_t)(__builtin_constant_p(dst) ? (__uint32_t
)(((__uint32_t)(dst) & 0xff) << 24 | ((__uint32_t)(
dst) & 0xff00) << 8 | ((__uint32_t)(dst) & 0xff0000
) >> 8 | ((__uint32_t)(dst) & 0xff000000) >> 24
) : __swap32md(dst))) & ((u_int32_t)(0xf0000000))) == ((u_int32_t
)(0xe0000000))))
return;
   errcode = TR_WRONG_IF1;
} else if (rt != NULL((void *)0) && !VIFM_ISSET(vifi, rt->rt_children)((rt->rt_children) & (1 << (vifi)))) {
   logit(LOG_DEBUG7, 0, "Destination %s not on forwarding tree for src %s",
   inet_fmt(qry->tr_dst, s1), inet_fmt(qry->tr_src, s2));
   if (IN_MULTICAST(ntohl(dst))(((u_int32_t)((__uint32_t)(__builtin_constant_p(dst) ? (__uint32_t
)(((__uint32_t)(dst) & 0xff) << 24 | ((__uint32_t)(
dst) & 0xff00) << 8 | ((__uint32_t)(dst) & 0xff0000
) >> 8 | ((__uint32_t)(dst) & 0xff000000) >> 24
) : __swap32md(dst))) & ((u_int32_t)(0xf0000000))) == ((u_int32_t
)(0xe0000000))))
return;
   errcode = TR_WRONG_IF1;
}
  }
  else {
/*
* determine which interface the packet came in on
* RESP packets travel hop-by-hop so this either traversed
* a tunnel or came from a directly attached mrouter.
*/
if ((vifi = find_vif(src, dst)) == NO_VIF((vifi_t)32)) {
   logit(LOG_DEBUG7, 0, "Wrong interface for packet");
   errcode = TR_WRONG_IF1;
}
  }

  /* Now that we've decided to send a response, save the qid */
  oqid = qry->tr_qidq.qid;

  logit(LOG_DEBUG7, 0, "Sending traceroute response");

  /* copy the packet to the sending buffer */
  p = send_buf + MIN_IP_HEADER_LEN20 + IGMP_MINLEN8;

  bcopy(data, p, datalen);

  p += datalen;

  /*
   * If there is no room to insert our reply, coopt the previous hop
   * error indication to relay this fact.
   */
  if (p + sizeof(struct tr_resp) > send_buf + RECV_BUF_SIZE8192) {
resp = (struct tr_resp *)p - 1;
resp->tr_rflags = TR_NO_SPACE0x81;
rt = NULL((void *)0);
goto sendit;
  }

  /*
   * fill in initial response fields
   */
  resp = (struct tr_resp *)p;
  bzero(resp, sizeof(struct tr_resp));
  datalen += RLENsizeof(struct tr_resp);

  resp->tr_qarr    = htonl((tp.tv_sec + JAN_1970) << 16)(__uint32_t)(__builtin_constant_p((tp.tv_sec + 2208988800UL) <<
 16) ? (__uint32_t)(((__uint32_t)((tp.tv_sec + 2208988800UL) <<
 16) & 0xff) << 24 | ((__uint32_t)((tp.tv_sec + 2208988800UL
) << 16) & 0xff00) << 8 | ((__uint32_t)((tp.tv_sec
 + 2208988800UL) << 16) & 0xff0000) >> 8 | ((
__uint32_t)((tp.tv_sec + 2208988800UL) << 16) & 0xff000000
) >> 24) : __swap32md((tp.tv_sec + 2208988800UL) <<
 16)) +
		((tp.tv_usec >> 4) & 0xffff);

  resp->tr_rproto  = PROTO_DVMRP1;
  if (errcode != TR_NO_ERR0) {
resp->tr_rflags	 = errcode;
rt = NULL((void *)0);	/* hack to enforce send straight to requestor */
goto sendit;
  }
  resp->tr_outaddr = uvifs[vifi].uv_lcl_addr;
  resp->tr_fttl    = uvifs[vifi].uv_threshold;
  resp->tr_rflags  = TR_NO_ERR0;

  /*
   * obtain # of packets out on interface
   */
  v_req.vifi = vifi;
  if (ioctl(udp_socket, SIOCGETVIFCNT(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct sioc_vif_req) & 0x1fff) << 16) | ((('u')) <<
 8) | ((51))), (char *)&v_req) == 0)
resp->tr_vifout  =  htonl(v_req.ocount)(__uint32_t)(__builtin_constant_p(v_req.ocount) ? (__uint32_t
)(((__uint32_t)(v_req.ocount) & 0xff) << 24 | ((__uint32_t
)(v_req.ocount) & 0xff00) << 8 | ((__uint32_t)(v_req
.ocount) & 0xff0000) >> 8 | ((__uint32_t)(v_req.ocount
) & 0xff000000) >> 24) : __swap32md(v_req.ocount));

  /*
   * fill in scoping & pruning information
   */
  if (rt)
for (gt = rt->rt_groups; gt; gt = gt->gt_next) {
   if (gt->gt_mcastgrp >= group)
break;
}
  else
gt = NULL((void *)0);

  if (gt && gt->gt_mcastgrp == group) {
sg_req.src.s_addr = qry->tr_src;
sg_req.grp.s_addr = group;
if (ioctl(udp_socket, SIOCGETSGCNT(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct sioc_sg_req) & 0x1fff) << 16) | ((('u')) <<
 8) | ((52))), (char *)&sg_req) == 0)
   resp->tr_pktcnt = htonl(sg_req.pktcnt)(__uint32_t)(__builtin_constant_p(sg_req.pktcnt) ? (__uint32_t
)(((__uint32_t)(sg_req.pktcnt) & 0xff) << 24 | ((__uint32_t
)(sg_req.pktcnt) & 0xff00) << 8 | ((__uint32_t)(sg_req
.pktcnt) & 0xff0000) >> 8 | ((__uint32_t)(sg_req.pktcnt
) & 0xff000000) >> 24) : __swap32md(sg_req.pktcnt));

if (VIFM_ISSET(vifi, gt->gt_scope)((gt->gt_scope) & (1 << (vifi))))
   resp->tr_rflags = TR_SCOPED4;
else if (gt->gt_prsent_timer)
   resp->tr_rflags = TR_PRUNED2;
else if (!VIFM_ISSET(vifi, gt->gt_grpmems)((gt->gt_grpmems) & (1 << (vifi)))) {
   if (VIFM_ISSET(vifi, rt->rt_children)((rt->rt_children) & (1 << (vifi))) &&
!VIFM_ISSET(vifi, rt->rt_leaves)((rt->rt_leaves) & (1 << (vifi))))
resp->tr_rflags = TR_OPRUNED3;
   else
resp->tr_rflags = TR_NO_FWD7;
}
  } else {
if (scoped_addr(vifi, group))
   resp->tr_rflags = TR_SCOPED4;
else if (rt && !VIFM_ISSET(vifi, rt->rt_children)((rt->rt_children) & (1 << (vifi))))
   resp->tr_rflags = TR_NO_FWD7;
  }

  /*
   *  if no rte exists, set NO_RTE error
   */
  if (rt == NULL((void *)0)) {
src = dst;		/* the dst address of resp. pkt */
resp->tr_inaddr   = 0;
resp->tr_rflags   = TR_NO_RTE5;
resp->tr_rmtaddr  = 0;
  } else {
/* get # of packets in on interface */
v_req.vifi = rt->rt_parent;
if (ioctl(udp_socket, SIOCGETVIFCNT(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct sioc_vif_req) & 0x1fff) << 16) | ((('u')) <<
 8) | ((51))), (char *)&v_req) == 0)
   resp->tr_vifin = htonl(v_req.icount)(__uint32_t)(__builtin_constant_p(v_req.icount) ? (__uint32_t
)(((__uint32_t)(v_req.icount) & 0xff) << 24 | ((__uint32_t
)(v_req.icount) & 0xff00) << 8 | ((__uint32_t)(v_req
.icount) & 0xff0000) >> 8 | ((__uint32_t)(v_req.icount
) & 0xff000000) >> 24) : __swap32md(v_req.icount));

MASK_TO_VAL(rt->rt_originmask, resp->tr_smask){ u_int32_t _x = (__uint32_t)(__builtin_constant_p(rt->rt_originmask
) ? (__uint32_t)(((__uint32_t)(rt->rt_originmask) & 0xff
) << 24 | ((__uint32_t)(rt->rt_originmask) & 0xff00
) << 8 | ((__uint32_t)(rt->rt_originmask) & 0xff0000
) >> 8 | ((__uint32_t)(rt->rt_originmask) & 0xff000000
) >> 24) : __swap32md(rt->rt_originmask)); (resp->
tr_smask) = 1; while ((_x) <<= 1) (resp->tr_smask)++
; };;
src = uvifs[rt->rt_parent].uv_lcl_addr;
resp->tr_inaddr = src;
resp->tr_rmtaddr = rt->rt_gateway;
if (!VIFM_ISSET(vifi, rt->rt_children)((rt->rt_children) & (1 << (vifi)))) {
   logit(LOG_DEBUG7, 0, "Destination %s not on forwarding tree for src %s",
   inet_fmt(qry->tr_dst, s1), inet_fmt(qry->tr_src, s2));
   resp->tr_rflags = TR_WRONG_IF1;
}
if (rt->rt_metric >= UNREACHABLE32) {
   resp->tr_rflags = TR_NO_RTE5;
   /* Hack to send reply directly */
   rt = NULL((void *)0);
}
  }

1972sendit:
  /*
   * if metric is 1 or no. of reports is 1, send response to requestor
   * else send to upstream router.  If the upstream router can't handle
   * mtrace, set an error code and send to requestor anyway.
   */
  logit(LOG_DEBUG7, 0, "rcount:%d, no:%d", rcount, no);

  if ((rcount + 1 == no) || (rt == NULL((void *)0)) || (rt->rt_metric == 1)) {
resptype = IGMP_MTRACE_REPLY0x1e;
dst = qry->tr_raddr;
  } else
if (!can_mtrace(rt->rt_parent, rt->rt_gateway)) {
   dst = qry->tr_raddr;
   resp->tr_rflags = TR_OLD_ROUTER0x82;
   resptype = IGMP_MTRACE_REPLY0x1e;
} else {
   dst = rt->rt_gateway;
   resptype = IGMP_MTRACE_QUERY0x1f;
}

  if (IN_MULTICAST(ntohl(dst))(((u_int32_t)((__uint32_t)(__builtin_constant_p(dst) ? (__uint32_t
)(((__uint32_t)(dst) & 0xff) << 24 | ((__uint32_t)(
dst) & 0xff00) << 8 | ((__uint32_t)(dst) & 0xff0000
) >> 8 | ((__uint32_t)(dst) & 0xff000000) >> 24
) : __swap32md(dst))) & ((u_int32_t)(0xf0000000))) == ((u_int32_t
)(0xe0000000)))) {
/*
* Send the reply on a known multicast capable vif.
* If we don't have one, we can't source any multicasts anyway.
*/
if (phys_vif != -1) {
   logit(LOG_DEBUG7, 0, "Sending reply to %s from %s",
inet_fmt(dst, s1), inet_fmt(uvifs[phys_vif].uv_lcl_addr, s2));
   k_set_ttl(qry->tr_rttlq.ttl);
   send_igmp(uvifs[phys_vif].uv_lcl_addr, dst,
      resptype, no, group,
      datalen);
   k_set_ttl(1);
} else
   logit(LOG_INFO6, 0, "No enabled phyints -- %s",
	"dropping traceroute reply");
  } else {
logit(LOG_DEBUG7, 0, "Sending %s to %s from %s",
   resptype == IGMP_MTRACE_REPLY0x1e ?  "reply" : "request on",
   inet_fmt(dst, s1), inet_fmt(src, s2));

send_igmp(src, dst,
  resptype, no, group,
  datalen);
  }
  return;
2019}