/usr/src/usr.sbin/ldpd/labelmapping.c

Bug Summary

File:	src/usr.sbin/ldpd/labelmapping.c
Warning:	line 530, column 10 Use of memory after it is freed
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple amd64-unknown-openbsd7.4 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name labelmapping.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/usr.sbin/ldpd/obj -resource-dir /usr/local/llvm16/lib/clang/16 -I /usr/src/usr.sbin/ldpd -internal-isystem /usr/local/llvm16/lib/clang/16/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/usr.sbin/ldpd/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fcf-protection=branch -fno-jump-tables -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/scan/2024-01-11-140451-98009-1 -x c /usr/src/usr.sbin/ldpd/labelmapping.c
1/*	$OpenBSD: labelmapping.c,v 1.69 2023/07/03 11:51:27 claudio Exp $ */

3/*
* Copyright (c) 2014, 2015 Renato Westphal <renato@openbsd.org>
* Copyright (c) 2009 Michele Marchetto <michele@openbsd.org>
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/

20#include <sys/types.h>
21#include <sys/socket.h>
22#include <arpa/inet.h>
23#include <netmpls/mpls.h>
24#include <limits.h>
25#include <stddef.h>
26#include <stdlib.h>
27#include <string.h>

29#include "ldpd.h"
30#include "ldpe.h"
31#include "log.h"

33static void	 enqueue_pdu(struct nbr *, struct ibuf *, uint16_t);
34static int	 gen_label_tlv(struct ibuf *, uint32_t);
35static int	 tlv_decode_label(struct nbr *, struct ldp_msg *, char *,
    uint16_t, uint32_t *);
37static int	 gen_reqid_tlv(struct ibuf *, uint32_t);
38static void	 log_msg_mapping(int, uint16_t, struct nbr *, struct map *);

40static void
41enqueue_pdu(struct nbr *nbr, struct ibuf *buf, uint16_t size)
42{
if (ibuf_set_n16(buf, offsetof(struct ldp_hdr, length)__builtin_offsetof(struct ldp_hdr, length), size) == -1)
fatal(__func__);
evbuf_enqueue(&nbr->tcp->wbuf, buf);
46}

48/* Generic function that handles all Label Message types */
49void
50send_labelmessage(struct nbr *nbr, uint16_t type, struct mapping_head *mh)
51{
struct ibuf		*buf = NULL((void *)0);
struct mapping_entry	*me;
uint16_t		 msg_size, size = 0;
int			 first = 1;
int			 err = 0;

/* nothing to send */
if (TAILQ_EMPTY(mh)(((mh)->tqh_first) == ((void *)0)))
1
Assuming field 'tqh_first' is not equal to null→
2
←
Taking false branch→
return;

while ((me = TAILQ_FIRST(mh)((mh)->tqh_first)) != NULL((void *)0)) {
3
←
Loop condition is true.  Entering loop body→
26
←
Loop condition is true.  Entering loop body→
/* generate pdu */
if (first3.1
'first' is 1
1
'first' is 0
) {
4
←
Taking true branch→
27
←
Taking false branch→
	if ((buf = ibuf_open(nbr->max_pdu_len +
5
←
Assuming the condition is false→
6
←
Taking false branch→
	    LDP_HDR_DEAD_LEN4)) == NULL((void *)0))
		fatal(__func__);

	/* real size will be set up later */
	err |= gen_ldp_hdr(buf, 0);

	size = LDP_HDR_PDU_LEN6;
	first = 0;
}

/* calculate size */
msg_size = LDP_MSG_SIZE8;
msg_size += len_fec_tlv(&me->map);
28
←
Calling 'len_fec_tlv'→
if (me->map.label != NO_LABEL0xffffffffU)
7
←
Assuming field 'label' is equal to NO_LABEL→
8
←
Taking false branch→
	msg_size += LABEL_TLV_SIZE8;
if (me->map.flags & F_MAP_REQ_ID0x01)
9
←
Assuming the condition is false→
10
←
Taking false branch→
	msg_size += REQID_TLV_SIZE8;
if (me->map.flags & F_MAP_STATUS0x02)
11
←
Assuming the condition is false→
12
←
Taking false branch→
	msg_size += STATUS_SIZE14;

/* maximum pdu length exceeded, we need a new ldp pdu */
if (size + msg_size > nbr->max_pdu_len) {
13
←
Assuming the condition is false→
14
←
Taking false branch→
	enqueue_pdu(nbr, buf, size);
	first = 1;
	continue;
}

size += msg_size;

/* append message and tlvs */
err |= gen_msg_hdr(buf, type, msg_size);
err |= gen_fec_tlv(buf, &me->map);
if (me->map.label14.1
Field 'label' is equal to NO_LABEL
 != NO_LABEL0xffffffffU)
15
←
Taking false branch→
	err |= gen_label_tlv(buf, me->map.label);
if (me->map.flags & F_MAP_REQ_ID0x01)
16
←
Taking false branch→
	err |= gen_reqid_tlv(buf, me->map.requestid);
   	if (me->map.flags & F_MAP_PW_STATUS0x20)
17
←
Assuming the condition is false→
18
←
Taking false branch→
	err |= gen_pw_status_tlv(buf, me->map.pw_status);
if (me->map.flags & F_MAP_STATUS0x02)
19
←
Taking false branch→
	err |= gen_status_tlv(buf, me->map.st.status_code,
	    me->map.st.msg_id, me->map.st.msg_type);
if (err) {
20
←
Assuming 'err' is 0→
21
←
Taking false branch→
	ibuf_free(buf);
	mapping_list_clr(mh);
	return;
}

log_msg_mapping(1, type, nbr, &me->map);

TAILQ_REMOVE(mh, me, entry)do { if (((me)->entry.tqe_next) != ((void *)0)) (me)->entry
.tqe_next->entry.tqe_prev = (me)->entry.tqe_prev; else (
mh)->tqh_last = (me)->entry.tqe_prev; *(me)->entry.tqe_prev
 = (me)->entry.tqe_next; ; ; } while (0);
22
←
Assuming field 'tqe_next' is equal to null→
23
←
Taking false branch→
24
←
Loop condition is false.  Exiting loop→
free(me);
25
←
Memory is released→
}

enqueue_pdu(nbr, buf, size);

nbr_fsm(nbr, NBR_EVT_PDU_SENT);
122}

124/* Generic function that handles all Label Message types */
125int
126recv_labelmessage(struct nbr *nbr, char *buf, uint16_t len, uint16_t type)
127{
struct ldp_msg		 msg;
struct tlv		 ft;
uint32_t		 label = NO_LABEL0xffffffffU, reqid = 0;
uint32_t		 pw_status = 0;
uint8_t			 flags = 0;
int			 feclen, lbllen, tlen;
struct mapping_entry	*me;
struct mapping_head	 mh;
struct map		 map;

memcpy(&msg, buf, sizeof(msg));
buf += LDP_MSG_SIZE8;
len -= LDP_MSG_SIZE8;

/* FEC TLV */
if (len < sizeof(ft)) {
session_shutdown(nbr, S_BAD_TLV_LEN0x80000007, msg.id, msg.type);
return (-1);
}

memcpy(&ft, buf, sizeof(ft));
if (ntohs(ft.type)(__uint16_t)(__builtin_constant_p(ft.type) ? (__uint16_t)(((__uint16_t
)(ft.type) & 0xffU) << 8 | ((__uint16_t)(ft.type) &
 0xff00U) >> 8) : __swap16md(ft.type)) != TLV_TYPE_FEC0x0100) {
send_notification(nbr->tcp, S_MISS_MSG0x00000016, msg.id, msg.type);
return (-1);
}
feclen = ntohs(ft.length)(__uint16_t)(__builtin_constant_p(ft.length) ? (__uint16_t)((
(__uint16_t)(ft.length) & 0xffU) << 8 | ((__uint16_t
)(ft.length) & 0xff00U) >> 8) : __swap16md(ft.length
));
if (feclen > len - TLV_HDR_SIZE4) {
session_shutdown(nbr, S_BAD_TLV_LEN0x80000007, msg.id, msg.type);
return (-1);
}

buf += TLV_HDR_SIZE4;	/* just advance to the end of the fec header */
len -= TLV_HDR_SIZE4;

TAILQ_INIT(&mh)do { (&mh)->tqh_first = ((void *)0); (&mh)->tqh_last
 = &(&mh)->tqh_first; } while (0);
do {
memset(&map, 0, sizeof(map));
map.msg_id = msg.id;

if ((tlen = tlv_decode_fec_elm(nbr, &msg, buf, feclen,
    &map)) == -1)
	goto err;
if (map.type == MAP_TYPE_PWID0x80 &&
    !(map.flags & F_MAP_PW_ID0x08) &&
    type != MSG_TYPE_LABELWITHDRAW0x0402 &&
    type != MSG_TYPE_LABELRELEASE0x0403) {
	send_notification(nbr->tcp, S_MISS_MSG0x00000016, msg.id,
	    msg.type);
	return (-1);
}

/*
 * The Wildcard FEC Element can be used only in the
 * Label Withdraw and Label Release messages.
 */
if (map.type == MAP_TYPE_WILDCARD0x01) {
	switch (type) {
	case MSG_TYPE_LABELMAPPING0x0400:
	case MSG_TYPE_LABELREQUEST0x0401:
	case MSG_TYPE_LABELABORTREQ0x0404:
		session_shutdown(nbr, S_UNKNOWN_FEC0x0000000C, msg.id,
		    msg.type);
		goto err;
	default:
		break;
	}
}

/*
 * RFC 5561 - Section 4:
 * "An LDP implementation that supports the Typed Wildcard
 * FEC Element MUST support its use in Label Request, Label
 * Withdraw, and Label Release messages".
 */
if (map.type == MAP_TYPE_TYPED_WCARD0x05) {
	switch (type) {
	case MSG_TYPE_LABELMAPPING0x0400:
	case MSG_TYPE_LABELABORTREQ0x0404:
		session_shutdown(nbr, S_UNKNOWN_FEC0x0000000C, msg.id,
		    msg.type);
		goto err;
	default:
		break;
	}
}

/*
 * LDP supports the use of multiple FEC Elements per
 * FEC for the Label Mapping message only.
 */
if (type != MSG_TYPE_LABELMAPPING0x0400 &&
    tlen != feclen) {
	session_shutdown(nbr, S_BAD_TLV_VAL0x80000008, msg.id, msg.type);
	goto err;
}

mapping_list_add(&mh, &map);

buf += tlen;
len -= tlen;
feclen -= tlen;
} while (feclen > 0);

/* Mandatory Label TLV */
if (type == MSG_TYPE_LABELMAPPING0x0400) {
lbllen = tlv_decode_label(nbr, &msg, buf, len, &label);
if (lbllen == -1)
	goto err;

buf += lbllen;
len -= lbllen;
}

/* Optional Parameters */
while (len > 0) {
struct tlv 	tlv;
uint16_t	tlv_type;
uint16_t	tlv_len;
uint32_t	reqbuf, labelbuf, statusbuf;

if (len < sizeof(tlv)) {
	session_shutdown(nbr, S_BAD_TLV_LEN0x80000007, msg.id, msg.type);
	goto err;
}

memcpy(&tlv, buf, TLV_HDR_SIZE4);
tlv_type = ntohs(tlv.type)(__uint16_t)(__builtin_constant_p(tlv.type) ? (__uint16_t)(((
__uint16_t)(tlv.type) & 0xffU) << 8 | ((__uint16_t)
(tlv.type) & 0xff00U) >> 8) : __swap16md(tlv.type));
tlv_len = ntohs(tlv.length)(__uint16_t)(__builtin_constant_p(tlv.length) ? (__uint16_t)(
((__uint16_t)(tlv.length) & 0xffU) << 8 | ((__uint16_t
)(tlv.length) & 0xff00U) >> 8) : __swap16md(tlv.length
));
if (tlv_len + TLV_HDR_SIZE4 > len) {
	session_shutdown(nbr, S_BAD_TLV_LEN0x80000007, msg.id, msg.type);
	goto err;
}
buf += TLV_HDR_SIZE4;
len -= TLV_HDR_SIZE4;

switch (tlv_type) {
case TLV_TYPE_LABELREQUEST0x0600:
	switch (type) {
	case MSG_TYPE_LABELMAPPING0x0400:
	case MSG_TYPE_LABELREQUEST0x0401:
		if (tlv_len != REQID_TLV_LEN4) {
			session_shutdown(nbr, S_BAD_TLV_LEN0x80000007,
			    msg.id, msg.type);
			goto err;
		}

		flags |= F_MAP_REQ_ID0x01;
		memcpy(&reqbuf, buf, sizeof(reqbuf));
		reqid = ntohl(reqbuf)(__uint32_t)(__builtin_constant_p(reqbuf) ? (__uint32_t)(((__uint32_t
)(reqbuf) & 0xff) << 24 | ((__uint32_t)(reqbuf) &
 0xff00) << 8 | ((__uint32_t)(reqbuf) & 0xff0000) >>
| ((__uint32_t)(reqbuf) & 0xff000000) >> 24) : __swap32md
(reqbuf));
		break;
	default:
		/* ignore */
		break;
	}
	break;
case TLV_TYPE_HOPCOUNT0x0103:
case TLV_TYPE_PATHVECTOR0x0104:
	/* ignore */
	break;
case TLV_TYPE_GENERICLABEL0x0200:
	switch (type) {
	case MSG_TYPE_LABELWITHDRAW0x0402:
	case MSG_TYPE_LABELRELEASE0x0403:
		if (tlv_len != LABEL_TLV_LEN4) {
			session_shutdown(nbr, S_BAD_TLV_LEN0x80000007,
			    msg.id, msg.type);
			goto err;
		}

		memcpy(&labelbuf, buf, sizeof(labelbuf));
		label = ntohl(labelbuf)(__uint32_t)(__builtin_constant_p(labelbuf) ? (__uint32_t)(((
__uint32_t)(labelbuf) & 0xff) << 24 | ((__uint32_t)
(labelbuf) & 0xff00) << 8 | ((__uint32_t)(labelbuf)
 & 0xff0000) >> 8 | ((__uint32_t)(labelbuf) & 0xff000000
) >> 24) : __swap32md(labelbuf));
		break;
	default:
		/* ignore */
		break;
	}
	break;
case TLV_TYPE_ATMLABEL0x0201:
case TLV_TYPE_FRLABEL0x0202:
	switch (type) {
	case MSG_TYPE_LABELWITHDRAW0x0402:
	case MSG_TYPE_LABELRELEASE0x0403:
		/* unsupported */
		session_shutdown(nbr, S_BAD_TLV_VAL0x80000008, msg.id,
		    msg.type);
		goto err;
		break;
	default:
		/* ignore */
		break;
	}
	break;
case TLV_TYPE_STATUS0x0300:
	if (tlv_len != STATUS_TLV_LEN10) {
		session_shutdown(nbr, S_BAD_TLV_LEN0x80000007, msg.id,
		    msg.type);
		goto err;
	}
	/* ignore */
	break;
case TLV_TYPE_PW_STATUS0x896A:
	switch (type) {
	case MSG_TYPE_LABELMAPPING0x0400:
		if (tlv_len != PW_STATUS_TLV_LEN4) {
			session_shutdown(nbr, S_BAD_TLV_LEN0x80000007,
			    msg.id, msg.type);
			goto err;
		}

		flags |= F_MAP_PW_STATUS0x20;
		memcpy(&statusbuf, buf, sizeof(statusbuf));
		pw_status = ntohl(statusbuf)(__uint32_t)(__builtin_constant_p(statusbuf) ? (__uint32_t)((
(__uint32_t)(statusbuf) & 0xff) << 24 | ((__uint32_t
)(statusbuf) & 0xff00) << 8 | ((__uint32_t)(statusbuf
) & 0xff0000) >> 8 | ((__uint32_t)(statusbuf) &
 0xff000000) >> 24) : __swap32md(statusbuf));
		break;
	default:
		/* ignore */
		break;
	}
	break;
default:
	if (!(ntohs(tlv.type)(__uint16_t)(__builtin_constant_p(tlv.type) ? (__uint16_t)(((
__uint16_t)(tlv.type) & 0xffU) << 8 | ((__uint16_t)
(tlv.type) & 0xff00U) >> 8) : __swap16md(tlv.type)) & UNKNOWN_FLAG0x8000))
		send_notification_rtlvs(nbr, S_UNKNOWN_TLV0x00000006,
		    msg.id, msg.type, tlv_type, tlv_len, buf);
	/* ignore unknown tlv */
	break;
}
buf += tlv_len;
len -= tlv_len;
}

/* notify lde about the received message. */
while ((me = TAILQ_FIRST(&mh)((&mh)->tqh_first)) != NULL((void *)0)) {
int imsg_type = IMSG_NONE;

me->map.flags |= flags;
switch (me->map.type) {
case MAP_TYPE_PREFIX0x02:
	switch (me->map.fec.prefix.af) {
	case AF_INET2:
		if (label == MPLS_LABEL_IPV6NULL2) {
			session_shutdown(nbr, S_BAD_TLV_VAL0x80000008,
			    msg.id, msg.type);
			goto err;
		}
		if (!nbr->v4_enabled)
			goto next;
		break;
	case AF_INET624:
		if (label == MPLS_LABEL_IPV4NULL0) {
			session_shutdown(nbr, S_BAD_TLV_VAL0x80000008,
			    msg.id, msg.type);
			goto err;
		}
		if (!nbr->v6_enabled)
			goto next;
		break;
	default:
		fatalx("recv_labelmessage: unknown af");
	}
	break;
case MAP_TYPE_PWID0x80:
	if (label <= MPLS_LABEL_RESERVED_MAX15) {
		session_shutdown(nbr, S_BAD_TLV_VAL0x80000008, msg.id,
		    msg.type);
		goto err;
	}
	if (me->map.flags & F_MAP_PW_STATUS0x20)
		me->map.pw_status = pw_status;
	break;
default:
	break;
}
me->map.label = label;
if (me->map.flags & F_MAP_REQ_ID0x01)
	me->map.requestid = reqid;

log_msg_mapping(0, type, nbr, &me->map);

switch (type) {
case MSG_TYPE_LABELMAPPING0x0400:
	imsg_type = IMSG_LABEL_MAPPING;
	break;
case MSG_TYPE_LABELREQUEST0x0401:
	imsg_type = IMSG_LABEL_REQUEST;
	break;
case MSG_TYPE_LABELWITHDRAW0x0402:
	imsg_type = IMSG_LABEL_WITHDRAW;
	break;
case MSG_TYPE_LABELRELEASE0x0403:
	imsg_type = IMSG_LABEL_RELEASE;
	break;
case MSG_TYPE_LABELABORTREQ0x0404:
	imsg_type = IMSG_LABEL_ABORT;
	break;
default:
	break;
}

ldpe_imsg_compose_lde(imsg_type, nbr->peerid, 0, &me->map,
    sizeof(struct map));

next:
TAILQ_REMOVE(&mh, me, entry)do { if (((me)->entry.tqe_next) != ((void *)0)) (me)->entry
.tqe_next->entry.tqe_prev = (me)->entry.tqe_prev; else (
&mh)->tqh_last = (me)->entry.tqe_prev; *(me)->entry
.tqe_prev = (me)->entry.tqe_next; ; ; } while (0);
free(me);
}

return (0);

err:
mapping_list_clr(&mh);

return (-1);
439}

441/* Other TLV related functions */
442static int
443gen_label_tlv(struct ibuf *buf, uint32_t label)
444{
struct label_tlv	lt;

lt.type = htons(TLV_TYPE_GENERICLABEL)(__uint16_t)(__builtin_constant_p(0x0200) ? (__uint16_t)(((__uint16_t
)(0x0200) & 0xffU) << 8 | ((__uint16_t)(0x0200) &
 0xff00U) >> 8) : __swap16md(0x0200));
lt.length = htons(LABEL_TLV_LEN)(__uint16_t)(__builtin_constant_p(4) ? (__uint16_t)(((__uint16_t
)(4) & 0xffU) << 8 | ((__uint16_t)(4) & 0xff00U
) >> 8) : __swap16md(4));
lt.label = htonl(label)(__uint32_t)(__builtin_constant_p(label) ? (__uint32_t)(((__uint32_t
)(label) & 0xff) << 24 | ((__uint32_t)(label) &
 0xff00) << 8 | ((__uint32_t)(label) & 0xff0000) >>
| ((__uint32_t)(label) & 0xff000000) >> 24) : __swap32md
(label));

return (ibuf_add(buf, &lt, sizeof(lt)));
452}

454static int
455tlv_decode_label(struct nbr *nbr, struct ldp_msg *msg, char *buf,
  uint16_t len, uint32_t *label)
457{
struct label_tlv lt;

if (len < sizeof(lt)) {
session_shutdown(nbr, S_BAD_TLV_LEN0x80000007, msg->id, msg->type);
return (-1);
}
memcpy(&lt, buf, sizeof(lt));

if (!(ntohs(lt.type)(__uint16_t)(__builtin_constant_p(lt.type) ? (__uint16_t)(((__uint16_t
)(lt.type) & 0xffU) << 8 | ((__uint16_t)(lt.type) &
 0xff00U) >> 8) : __swap16md(lt.type)) & TLV_TYPE_GENERICLABEL0x0200)) {
send_notification(nbr->tcp, S_MISS_MSG0x00000016, msg->id, msg->type);
return (-1);
}

switch (htons(lt.type)(__uint16_t)(__builtin_constant_p(lt.type) ? (__uint16_t)(((__uint16_t
)(lt.type) & 0xffU) << 8 | ((__uint16_t)(lt.type) &
 0xff00U) >> 8) : __swap16md(lt.type))) {
case TLV_TYPE_GENERICLABEL0x0200:
if (ntohs(lt.length)(__uint16_t)(__builtin_constant_p(lt.length) ? (__uint16_t)((
(__uint16_t)(lt.length) & 0xffU) << 8 | ((__uint16_t
)(lt.length) & 0xff00U) >> 8) : __swap16md(lt.length
)) != sizeof(lt) - TLV_HDR_SIZE4) {
	session_shutdown(nbr, S_BAD_TLV_LEN0x80000007, msg->id,
	    msg->type);
	return (-1);
}

*label = ntohl(lt.label)(__uint32_t)(__builtin_constant_p(lt.label) ? (__uint32_t)(((
__uint32_t)(lt.label) & 0xff) << 24 | ((__uint32_t)
(lt.label) & 0xff00) << 8 | ((__uint32_t)(lt.label)
 & 0xff0000) >> 8 | ((__uint32_t)(lt.label) & 0xff000000
) >> 24) : __swap32md(lt.label));
if (*label > MPLS_LABEL_MAX((1 << 20) - 1) ||
    (*label <= MPLS_LABEL_RESERVED_MAX15 &&
     *label != MPLS_LABEL_IPV4NULL0 &&
     *label != MPLS_LABEL_IPV6NULL2 &&
     *label != MPLS_LABEL_IMPLNULL3)) {
	session_shutdown(nbr, S_BAD_TLV_VAL0x80000008, msg->id,
	    msg->type);
	return (-1);
}
break;
case TLV_TYPE_ATMLABEL0x0201:
case TLV_TYPE_FRLABEL0x0202:
default:
/* unsupported */
session_shutdown(nbr, S_BAD_TLV_VAL0x80000008, msg->id, msg->type);
return (-1);
}

return (sizeof(lt));
499}

501static int
502gen_reqid_tlv(struct ibuf *buf, uint32_t reqid)
503{
struct reqid_tlv	rt;

rt.type = htons(TLV_TYPE_LABELREQUEST)(__uint16_t)(__builtin_constant_p(0x0600) ? (__uint16_t)(((__uint16_t
)(0x0600) & 0xffU) << 8 | ((__uint16_t)(0x0600) &
 0xff00U) >> 8) : __swap16md(0x0600));
rt.length = htons(REQID_TLV_LEN)(__uint16_t)(__builtin_constant_p(4) ? (__uint16_t)(((__uint16_t
)(4) & 0xffU) << 8 | ((__uint16_t)(4) & 0xff00U
) >> 8) : __swap16md(4));
rt.reqid = htonl(reqid)(__uint32_t)(__builtin_constant_p(reqid) ? (__uint32_t)(((__uint32_t
)(reqid) & 0xff) << 24 | ((__uint32_t)(reqid) &
 0xff00) << 8 | ((__uint32_t)(reqid) & 0xff0000) >>
| ((__uint32_t)(reqid) & 0xff000000) >> 24) : __swap32md
(reqid));

return (ibuf_add(buf, &rt, sizeof(rt)));
511}

513int
514gen_pw_status_tlv(struct ibuf *buf, uint32_t status)
515{
struct pw_status_tlv	st;

st.type = htons(TLV_TYPE_PW_STATUS)(__uint16_t)(__builtin_constant_p(0x896A) ? (__uint16_t)(((__uint16_t
)(0x896A) & 0xffU) << 8 | ((__uint16_t)(0x896A) &
 0xff00U) >> 8) : __swap16md(0x896A));
st.length = htons(PW_STATUS_TLV_LEN)(__uint16_t)(__builtin_constant_p(4) ? (__uint16_t)(((__uint16_t
)(4) & 0xffU) << 8 | ((__uint16_t)(4) & 0xff00U
) >> 8) : __swap16md(4));
st.value = htonl(status)(__uint32_t)(__builtin_constant_p(status) ? (__uint32_t)(((__uint32_t
)(status) & 0xff) << 24 | ((__uint32_t)(status) &
 0xff00) << 8 | ((__uint32_t)(status) & 0xff0000) >>
| ((__uint32_t)(status) & 0xff000000) >> 24) : __swap32md
(status));

return (ibuf_add(buf, &st, sizeof(st)));
523}

525uint16_t
526len_fec_tlv(struct map *map)
527{
uint16_t	 len = TLV_HDR_SIZE4;

switch (map->type) {
29
←
Use of memory after it is freed
case MAP_TYPE_WILDCARD0x01:
len += FEC_ELM_WCARD_LEN1;
break;
case MAP_TYPE_PREFIX0x02:
len += FEC_ELM_PREFIX_MIN_LEN4 +
    PREFIX_SIZE(map->fec.prefix.prefixlen)(((map->fec.prefix.prefixlen) + 7) / 8);
break;
case MAP_TYPE_PWID0x80:
len += FEC_PWID_ELM_MIN_LEN8;
if (map->flags & F_MAP_PW_ID0x08)
	len += PW_STATUS_TLV_LEN4;
if (map->flags & F_MAP_PW_IFMTU0x10)
	len += FEC_SUBTLV_IFMTU_SIZE4;
  		if (map->flags & F_MAP_PW_STATUS0x20)
	len += PW_STATUS_TLV_SIZE8;
break;
case MAP_TYPE_TYPED_WCARD0x05:
len += FEC_ELM_TWCARD_MIN_LEN3;
switch (map->fec.twcard.type) {
case MAP_TYPE_PREFIX0x02:
case MAP_TYPE_PWID0x80:
	len += sizeof(uint16_t);
	break;
default:
	fatalx("len_fec_tlv: unexpected fec type");
}
break;
default:
fatalx("len_fec_tlv: unexpected fec type");
}

return (len);
563}

565int
566gen_fec_tlv(struct ibuf *buf, struct map *map)
567{
struct tlv	ft;
uint16_t	family, len, pw_type, ifmtu;
uint8_t		pw_len = 0, twcard_len;
uint32_t	group_id, pwid;
int		err = 0;

ft.type = htons(TLV_TYPE_FEC)(__uint16_t)(__builtin_constant_p(0x0100) ? (__uint16_t)(((__uint16_t
)(0x0100) & 0xffU) << 8 | ((__uint16_t)(0x0100) &
 0xff00U) >> 8) : __swap16md(0x0100));

switch (map->type) {
case MAP_TYPE_WILDCARD0x01:
ft.length = htons(sizeof(uint8_t))(__uint16_t)(__builtin_constant_p(sizeof(uint8_t)) ? (__uint16_t
)(((__uint16_t)(sizeof(uint8_t)) & 0xffU) << 8 | ((
__uint16_t)(sizeof(uint8_t)) & 0xff00U) >> 8) : __swap16md
(sizeof(uint8_t)));
err |= ibuf_add(buf, &ft, sizeof(ft));
err |= ibuf_add(buf, &map->type, sizeof(map->type));
break;
case MAP_TYPE_PREFIX0x02:
len = PREFIX_SIZE(map->fec.prefix.prefixlen)(((map->fec.prefix.prefixlen) + 7) / 8);
ft.length = htons(sizeof(map->type) + sizeof(family) +(__uint16_t)(__builtin_constant_p(sizeof(map->type) + sizeof
(family) + sizeof(map->fec.prefix.prefixlen) + len) ? (__uint16_t
)(((__uint16_t)(sizeof(map->type) + sizeof(family) + sizeof
(map->fec.prefix.prefixlen) + len) & 0xffU) << 8
 | ((__uint16_t)(sizeof(map->type) + sizeof(family) + sizeof
(map->fec.prefix.prefixlen) + len) & 0xff00U) >>
 8) : __swap16md(sizeof(map->type) + sizeof(family) + sizeof
(map->fec.prefix.prefixlen) + len))
    sizeof(map->fec.prefix.prefixlen) + len)(__uint16_t)(__builtin_constant_p(sizeof(map->type) + sizeof
(family) + sizeof(map->fec.prefix.prefixlen) + len) ? (__uint16_t
)(((__uint16_t)(sizeof(map->type) + sizeof(family) + sizeof
(map->fec.prefix.prefixlen) + len) & 0xffU) << 8
 | ((__uint16_t)(sizeof(map->type) + sizeof(family) + sizeof
(map->fec.prefix.prefixlen) + len) & 0xff00U) >>
 8) : __swap16md(sizeof(map->type) + sizeof(family) + sizeof
(map->fec.prefix.prefixlen) + len));
err |= ibuf_add(buf, &ft, sizeof(ft));
err |= ibuf_add(buf, &map->type, sizeof(map->type));
switch (map->fec.prefix.af) {
case AF_INET2:
	family = htons(AF_IPV4)(__uint16_t)(__builtin_constant_p(0x1) ? (__uint16_t)(((__uint16_t
)(0x1) & 0xffU) << 8 | ((__uint16_t)(0x1) & 0xff00U
) >> 8) : __swap16md(0x1));
	break;
case AF_INET624:
	family = htons(AF_IPV6)(__uint16_t)(__builtin_constant_p(0x2) ? (__uint16_t)(((__uint16_t
)(0x2) & 0xffU) << 8 | ((__uint16_t)(0x2) & 0xff00U
) >> 8) : __swap16md(0x2));
	break;
default:
	fatalx("gen_fec_tlv: unknown af");
	break;
}
err |= ibuf_add(buf, &family, sizeof(family));
err |= ibuf_add(buf, &map->fec.prefix.prefixlen,
    sizeof(map->fec.prefix.prefixlen));
if (len)
	err |= ibuf_add(buf, &map->fec.prefix.prefix, len);
break;
case MAP_TYPE_PWID0x80:
if (map->flags & F_MAP_PW_ID0x08)
	pw_len += FEC_PWID_SIZE4;
if (map->flags & F_MAP_PW_IFMTU0x10)
	pw_len += FEC_SUBTLV_IFMTU_SIZE4;

len = FEC_PWID_ELM_MIN_LEN8 + pw_len;

ft.length = htons(len)(__uint16_t)(__builtin_constant_p(len) ? (__uint16_t)(((__uint16_t
)(len) & 0xffU) << 8 | ((__uint16_t)(len) & 0xff00U
) >> 8) : __swap16md(len));
err |= ibuf_add(buf, &ft, sizeof(ft));

err |= ibuf_add(buf, &map->type, sizeof(uint8_t));
pw_type = map->fec.pwid.type;
if (map->flags & F_MAP_PW_CWORD0x04)
	pw_type |= CONTROL_WORD_FLAG0x8000;
pw_type = htons(pw_type)(__uint16_t)(__builtin_constant_p(pw_type) ? (__uint16_t)(((__uint16_t
)(pw_type) & 0xffU) << 8 | ((__uint16_t)(pw_type) &
 0xff00U) >> 8) : __swap16md(pw_type));
err |= ibuf_add(buf, &pw_type, sizeof(uint16_t));
err |= ibuf_add(buf, &pw_len, sizeof(uint8_t));
group_id = htonl(map->fec.pwid.group_id)(__uint32_t)(__builtin_constant_p(map->fec.pwid.group_id) ?
 (__uint32_t)(((__uint32_t)(map->fec.pwid.group_id) & 0xff
) << 24 | ((__uint32_t)(map->fec.pwid.group_id) &
 0xff00) << 8 | ((__uint32_t)(map->fec.pwid.group_id
) & 0xff0000) >> 8 | ((__uint32_t)(map->fec.pwid
.group_id) & 0xff000000) >> 24) : __swap32md(map->
fec.pwid.group_id));
err |= ibuf_add(buf, &group_id, sizeof(uint32_t));
if (map->flags & F_MAP_PW_ID0x08) {
	pwid = htonl(map->fec.pwid.pwid)(__uint32_t)(__builtin_constant_p(map->fec.pwid.pwid) ? (__uint32_t
)(((__uint32_t)(map->fec.pwid.pwid) & 0xff) << 24
 | ((__uint32_t)(map->fec.pwid.pwid) & 0xff00) <<
| ((__uint32_t)(map->fec.pwid.pwid) & 0xff0000) >>
| ((__uint32_t)(map->fec.pwid.pwid) & 0xff000000) >>
 24) : __swap32md(map->fec.pwid.pwid));
	err |= ibuf_add(buf, &pwid, sizeof(uint32_t));
}
if (map->flags & F_MAP_PW_IFMTU0x10) {
	struct subtlv 	stlv;

	stlv.type = SUBTLV_IFMTU0x01;
	stlv.length = FEC_SUBTLV_IFMTU_SIZE4;
	err |= ibuf_add(buf, &stlv, sizeof(uint16_t));

	ifmtu = htons(map->fec.pwid.ifmtu)(__uint16_t)(__builtin_constant_p(map->fec.pwid.ifmtu) ? (
__uint16_t)(((__uint16_t)(map->fec.pwid.ifmtu) & 0xffU
) << 8 | ((__uint16_t)(map->fec.pwid.ifmtu) & 0xff00U
) >> 8) : __swap16md(map->fec.pwid.ifmtu));
	err |= ibuf_add(buf, &ifmtu, sizeof(uint16_t));
}
break;
case MAP_TYPE_TYPED_WCARD0x05:
len = FEC_ELM_TWCARD_MIN_LEN3;
switch (map->fec.twcard.type) {
case MAP_TYPE_PREFIX0x02:
case MAP_TYPE_PWID0x80:
	len += sizeof(uint16_t);
	break;
default:
	fatalx("gen_fec_tlv: unexpected fec type");
}
ft.length = htons(len)(__uint16_t)(__builtin_constant_p(len) ? (__uint16_t)(((__uint16_t
)(len) & 0xffU) << 8 | ((__uint16_t)(len) & 0xff00U
) >> 8) : __swap16md(len));
err |= ibuf_add(buf, &ft, sizeof(ft));
err |= ibuf_add(buf, &map->type, sizeof(uint8_t));
err |= ibuf_add(buf, &map->fec.twcard.type, sizeof(uint8_t));

switch (map->fec.twcard.type) {
case MAP_TYPE_PREFIX0x02:
	twcard_len = sizeof(uint16_t);
	err |= ibuf_add(buf, &twcard_len, sizeof(uint8_t));

	switch (map->fec.twcard.u.prefix_af) {
	case AF_INET2:
		family = htons(AF_IPV4)(__uint16_t)(__builtin_constant_p(0x1) ? (__uint16_t)(((__uint16_t
)(0x1) & 0xffU) << 8 | ((__uint16_t)(0x1) & 0xff00U
) >> 8) : __swap16md(0x1));
		break;
	case AF_INET624:
		family = htons(AF_IPV6)(__uint16_t)(__builtin_constant_p(0x2) ? (__uint16_t)(((__uint16_t
)(0x2) & 0xffU) << 8 | ((__uint16_t)(0x2) & 0xff00U
) >> 8) : __swap16md(0x2));
		break;
	default:
		fatalx("gen_fec_tlv: unknown af");
		break;
	}

	err |= ibuf_add(buf, &family, sizeof(uint16_t));
	break;
case MAP_TYPE_PWID0x80:
	twcard_len = sizeof(uint16_t);
	err |= ibuf_add(buf, &twcard_len, sizeof(uint8_t));
	pw_type = htons(map->fec.twcard.u.pw_type)(__uint16_t)(__builtin_constant_p(map->fec.twcard.u.pw_type
) ? (__uint16_t)(((__uint16_t)(map->fec.twcard.u.pw_type) &
 0xffU) << 8 | ((__uint16_t)(map->fec.twcard.u.pw_type
) & 0xff00U) >> 8) : __swap16md(map->fec.twcard.
u.pw_type));
	err |= ibuf_add(buf, &pw_type, sizeof(uint16_t));
	break;
default:
	fatalx("gen_fec_tlv: unexpected fec type");
}
break;
default:
break;
}

return (err);
689}

691int
692tlv_decode_fec_elm(struct nbr *nbr, struct ldp_msg *msg, char *buf,
  uint16_t len, struct map *map)
694{
uint16_t	off = 0;
uint8_t		pw_len, twcard_len;

map->type = *buf;
off += sizeof(uint8_t);

switch (map->type) {
case MAP_TYPE_WILDCARD0x01:
if (len == FEC_ELM_WCARD_LEN1)
	return (off);
else {
	session_shutdown(nbr, S_BAD_TLV_VAL0x80000008, msg->id,
	    msg->type);
	return (-1);
}
break;
case MAP_TYPE_PREFIX0x02:
if (len < FEC_ELM_PREFIX_MIN_LEN4) {
	session_shutdown(nbr, S_BAD_TLV_LEN0x80000007, msg->id,
	    msg->type);
	return (-1);
}

/* Address Family */
memcpy(&map->fec.prefix.af, buf + off,
    sizeof(map->fec.prefix.af));
off += sizeof(map->fec.prefix.af);
map->fec.prefix.af = ntohs(map->fec.prefix.af)(__uint16_t)(__builtin_constant_p(map->fec.prefix.af) ? (__uint16_t
)(((__uint16_t)(map->fec.prefix.af) & 0xffU) << 8
 | ((__uint16_t)(map->fec.prefix.af) & 0xff00U) >>
 8) : __swap16md(map->fec.prefix.af));
switch (map->fec.prefix.af) {
case AF_IPV40x1:
	map->fec.prefix.af = AF_INET2;
	break;
case AF_IPV60x2:
	map->fec.prefix.af = AF_INET624;
	break;
default:
	send_notification(nbr->tcp, S_UNSUP_ADDR0x00000017, msg->id,
	    msg->type);
	return (-1);
}

/* Prefix Length */
map->fec.prefix.prefixlen = buf[off];
off += sizeof(uint8_t);
if (len < off + PREFIX_SIZE(map->fec.prefix.prefixlen)(((map->fec.prefix.prefixlen) + 7) / 8)) {
	session_shutdown(nbr, S_BAD_TLV_LEN0x80000007, msg->id,
	    msg->type);
	return (-1);
}

/* Prefix */
memset(&map->fec.prefix.prefix, 0,
    sizeof(map->fec.prefix.prefix));
memcpy(&map->fec.prefix.prefix, buf + off,
    PREFIX_SIZE(map->fec.prefix.prefixlen)(((map->fec.prefix.prefixlen) + 7) / 8));

/* Just in case... */
ldp_applymask(map->fec.prefix.af, &map->fec.prefix.prefix,
    &map->fec.prefix.prefix, map->fec.prefix.prefixlen);

return (off + PREFIX_SIZE(map->fec.prefix.prefixlen)(((map->fec.prefix.prefixlen) + 7) / 8));
case MAP_TYPE_PWID0x80:
if (len < FEC_PWID_ELM_MIN_LEN8) {
	session_shutdown(nbr, S_BAD_TLV_LEN0x80000007, msg->id,
	    msg->type);
	return (-1);
}

/* PW type */
memcpy(&map->fec.pwid.type, buf + off, sizeof(uint16_t));
map->fec.pwid.type = ntohs(map->fec.pwid.type)(__uint16_t)(__builtin_constant_p(map->fec.pwid.type) ? (__uint16_t
)(((__uint16_t)(map->fec.pwid.type) & 0xffU) << 8
 | ((__uint16_t)(map->fec.pwid.type) & 0xff00U) >>
 8) : __swap16md(map->fec.pwid.type));
if (map->fec.pwid.type & CONTROL_WORD_FLAG0x8000) {
	map->flags |= F_MAP_PW_CWORD0x04;
	map->fec.pwid.type &= ~CONTROL_WORD_FLAG0x8000;
}
off += sizeof(uint16_t);

/* PW info Length */
pw_len = buf[off];
off += sizeof(uint8_t);

if (len != FEC_PWID_ELM_MIN_LEN8 + pw_len) {
	session_shutdown(nbr, S_BAD_TLV_LEN0x80000007, msg->id,
	    msg->type);
	return (-1);
}

/* Group ID */
memcpy(&map->fec.pwid.group_id, buf + off, sizeof(uint32_t));
map->fec.pwid.group_id = ntohl(map->fec.pwid.group_id)(__uint32_t)(__builtin_constant_p(map->fec.pwid.group_id) ?
 (__uint32_t)(((__uint32_t)(map->fec.pwid.group_id) & 0xff
) << 24 | ((__uint32_t)(map->fec.pwid.group_id) &
 0xff00) << 8 | ((__uint32_t)(map->fec.pwid.group_id
) & 0xff0000) >> 8 | ((__uint32_t)(map->fec.pwid
.group_id) & 0xff000000) >> 24) : __swap32md(map->
fec.pwid.group_id));
off += sizeof(uint32_t);

/* PW ID */
if (pw_len == 0)
	return (off);

if (pw_len < sizeof(uint32_t)) {
	session_shutdown(nbr, S_BAD_TLV_LEN0x80000007, msg->id,
	    msg->type);
	return (-1);
}

memcpy(&map->fec.pwid.pwid, buf + off, sizeof(uint32_t));
map->fec.pwid.pwid = ntohl(map->fec.pwid.pwid)(__uint32_t)(__builtin_constant_p(map->fec.pwid.pwid) ? (__uint32_t
)(((__uint32_t)(map->fec.pwid.pwid) & 0xff) << 24
 | ((__uint32_t)(map->fec.pwid.pwid) & 0xff00) <<
| ((__uint32_t)(map->fec.pwid.pwid) & 0xff0000) >>
| ((__uint32_t)(map->fec.pwid.pwid) & 0xff000000) >>
 24) : __swap32md(map->fec.pwid.pwid));
map->flags |= F_MAP_PW_ID0x08;
off += sizeof(uint32_t);
pw_len -= sizeof(uint32_t);

/* Optional Interface Parameter Sub-TLVs */
while (pw_len > 0) {
	struct subtlv 	stlv;

	if (pw_len < sizeof(stlv)) {
		session_shutdown(nbr, S_BAD_TLV_LEN0x80000007, msg->id,
		    msg->type);
		return (-1);
	}

	memcpy(&stlv, buf + off, sizeof(stlv));
	if (stlv.length > pw_len) {
		session_shutdown(nbr, S_BAD_TLV_LEN0x80000007, msg->id,
		    msg->type);
		return (-1);
	}

	switch (stlv.type) {
	case SUBTLV_IFMTU0x01:
		if (stlv.length != FEC_SUBTLV_IFMTU_SIZE4) {
			session_shutdown(nbr, S_BAD_TLV_LEN0x80000007,
			    msg->id, msg->type);
			return (-1);
		}
		memcpy(&map->fec.pwid.ifmtu, buf + off +
		    SUBTLV_HDR_SIZE2, sizeof(uint16_t));
		map->fec.pwid.ifmtu = ntohs(map->fec.pwid.ifmtu)(__uint16_t)(__builtin_constant_p(map->fec.pwid.ifmtu) ? (
__uint16_t)(((__uint16_t)(map->fec.pwid.ifmtu) & 0xffU
) << 8 | ((__uint16_t)(map->fec.pwid.ifmtu) & 0xff00U
) >> 8) : __swap16md(map->fec.pwid.ifmtu));
		map->flags |= F_MAP_PW_IFMTU0x10;
		break;
	default:
		/* ignore */
		break;
	}
	off += stlv.length;
	pw_len -= stlv.length;
}

return (off);
case MAP_TYPE_TYPED_WCARD0x05:
if (len < FEC_ELM_TWCARD_MIN_LEN3) {
	session_shutdown(nbr, S_BAD_TLV_LEN0x80000007, msg->id,
	    msg->type);
	return (-1);
}

memcpy(&map->fec.twcard.type, buf + off, sizeof(uint8_t));
off += sizeof(uint8_t);
memcpy(&twcard_len, buf + off, sizeof(uint8_t));
off += sizeof(uint8_t);
if (len != FEC_ELM_TWCARD_MIN_LEN3 + twcard_len) {
	session_shutdown(nbr, S_BAD_TLV_LEN0x80000007, msg->id,
	    msg->type);
	return (-1);
}

switch (map->fec.twcard.type) {
case MAP_TYPE_PREFIX0x02:
	if (twcard_len != sizeof(uint16_t)) {
		session_shutdown(nbr, S_BAD_TLV_LEN0x80000007, msg->id,
		    msg->type);
		return (-1);
	}

	memcpy(&map->fec.twcard.u.prefix_af, buf + off,
	    sizeof(uint16_t));
	map->fec.twcard.u.prefix_af =
	    ntohs(map->fec.twcard.u.prefix_af)(__uint16_t)(__builtin_constant_p(map->fec.twcard.u.prefix_af
) ? (__uint16_t)(((__uint16_t)(map->fec.twcard.u.prefix_af
) & 0xffU) << 8 | ((__uint16_t)(map->fec.twcard.
u.prefix_af) & 0xff00U) >> 8) : __swap16md(map->
fec.twcard.u.prefix_af));
	off += sizeof(uint16_t);

	switch (map->fec.twcard.u.prefix_af) {
	case AF_IPV40x1:
		map->fec.twcard.u.prefix_af = AF_INET2;
		break;
	case AF_IPV60x2:
		map->fec.twcard.u.prefix_af = AF_INET624;
		break;
	default:
		session_shutdown(nbr, S_BAD_TLV_VAL0x80000008, msg->id,
		    msg->type);
		return (-1);
	}
	break;
case MAP_TYPE_PWID0x80:
	if (twcard_len != sizeof(uint16_t)) {
		session_shutdown(nbr, S_BAD_TLV_LEN0x80000007, msg->id,
		    msg->type);
		return (-1);
	}

	memcpy(&map->fec.twcard.u.pw_type, buf + off,
	    sizeof(uint16_t));
	map->fec.twcard.u.pw_type =
	    ntohs(map->fec.twcard.u.pw_type)(__uint16_t)(__builtin_constant_p(map->fec.twcard.u.pw_type
) ? (__uint16_t)(((__uint16_t)(map->fec.twcard.u.pw_type) &
 0xffU) << 8 | ((__uint16_t)(map->fec.twcard.u.pw_type
) & 0xff00U) >> 8) : __swap16md(map->fec.twcard.
u.pw_type));
	/* ignore the reserved bit as per RFC 6667 */
	map->fec.twcard.u.pw_type &= ~PW_TWCARD_RESERVED_BIT0x8000;
	off += sizeof(uint16_t);
	break;
default:
	send_notification(nbr->tcp, S_UNKNOWN_FEC0x0000000C, msg->id,
	    msg->type);
	return (-1);
}

return (off);
default:
send_notification(nbr->tcp, S_UNKNOWN_FEC0x0000000C, msg->id, msg->type);
break;
}

return (-1);
913}

915static void
916log_msg_mapping(int out, uint16_t msg_type, struct nbr *nbr, struct map *map)
917{
log_debug("msg-%s: %s: lsr-id %s, fec %s, label %s",
   (out) ? "out" : "in", msg_name(msg_type), inet_ntoa(nbr->id),
   log_map(map), log_label(map->label));
921}