/usr/src/usr.sbin/mrouted/vif.c

Bug Summary

File:	src/usr.sbin/mrouted/vif.c
Warning:	line 579, column 15 Access to field 'al_addr' results in a dereference of a null pointer (loaded from variable 'g')
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name vif.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/usr.sbin/mrouted/obj -resource-dir /usr/local/lib/clang/13.0.0 -I /usr/src/usr.sbin/mrouted -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/usr.sbin/mrouted/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/usr.sbin/mrouted/vif.c
1/*	$NetBSD: vif.c,v 1.6 1995/12/10 10:07:19 mycroft Exp $	*/

3/*
* The mrouted program is covered by the license in the accompanying file
* named "LICENSE".  Use of the mrouted program represents acceptance of
* the terms and conditions listed in that file.
*
* The mrouted program is COPYRIGHT 1989 by The Board of Trustees of
* Leland Stanford Junior University.
*/


13#include "defs.h"
14#include <fcntl.h>

16/*
* Exported variables.
*/
19struct uvif	uvifs[MAXVIFS32];	/* array of virtual interfaces		    */
20vifi_t		numvifs;	/* number of vifs in use		    */
21int		vifs_down;	/* 1=>some interfaces are down		    */
22int		phys_vif;	/* An enabled vif			    */
23int		udp_socket;	/* Since the honkin' kernel doesn't support */
		/* ioctls on raw IP sockets, we need a UDP  */
		/* socket as well as our IGMP (raw) socket. */
		/* How dumb.                                */
27int		vifs_with_neighbors;	/* == 1 if I am a leaf		    */

29typedef struct {
      vifi_t  vifi;
      struct listaddr *g;
int    q_time;
33} cbk_t;

35/*
* Forward declarations.
*/
38static void start_vif(vifi_t vifi);
39static void start_vif2(vifi_t vifi);
40static void stop_vif(vifi_t vifi);
41static void age_old_hosts(void);
42static void send_probe_on_vif(struct uvif *v);
43static int info_version(char *p, int);
44static void DelVif(void *arg);
45static int SetTimer(int vifi, struct listaddr *g);
46static int DeleteTimer(int id);
47static void SendQuery(void *arg);
48static int SetQueryTimer(struct listaddr *g, vifi_t vifi, int to_expire,
  int q_time);


52/*
* Initialize the virtual interfaces, but do not install
* them in the kernel.  Start routing on all vifs that are
* not down or disabled.
*/
57void
58init_vifs(void)
59{
  vifi_t vifi;
  struct uvif *v;
  int enabled_vifs, enabled_phyints;
  extern char *configfilename;

  numvifs = 0;
  vifs_with_neighbors = 0;
  vifs_down = FALSE0;

  /*
   * Configure the vifs based on the interface configuration of the
   * the kernel and the contents of the configuration file.
   * (Open a UDP socket for ioctl use in the config procedures.)
   */
  if ((udp_socket = socket(AF_INET2, SOCK_DGRAM2, 0)) == -1)
logit(LOG_ERR3, errno(*__errno()), "UDP socket");
  logit(LOG_INFO6,0,"Getting vifs from kernel interfaces");
  config_vifs_from_kernel();
  logit(LOG_INFO6,0,"Getting vifs from %s",configfilename);
  config_vifs_from_file();

  /*
   * Quit if there are fewer than two enabled vifs.
   */
  enabled_vifs    = 0;
  enabled_phyints = 0;
  phys_vif	    = -1;
  for (vifi = 0, v = uvifs; vifi < numvifs; ++vifi, ++v) {
if (!(v->uv_flags & VIFF_DISABLED0x0200)) {
   ++enabled_vifs;
   if (!(v->uv_flags & VIFF_TUNNEL0x1)) {
if (phys_vif == -1)
    phys_vif = vifi;
++enabled_phyints;
   }
}
  }
  if (enabled_vifs < 2)
logit(LOG_ERR3, 0, "can't forward: %s",
   enabled_vifs == 0 ? "no enabled vifs" : "only one enabled vif");

  if (enabled_phyints == 0)
logit(LOG_WARNING4, 0,
   "no enabled interfaces, forwarding via tunnels only");

  logit(LOG_INFO6, 0, "Installing vifs in mrouted...");
  for (vifi = 0, v = uvifs; vifi < numvifs; ++vifi, ++v) {
if (!(v->uv_flags & VIFF_DISABLED0x0200)) {
   if (!(v->uv_flags & VIFF_DOWN0x0100)) {
if (v->uv_flags & VIFF_TUNNEL0x1)
    logit(LOG_INFO6, 0, "vif #%d, tunnel %s -> %s", vifi,
		inet_fmt(v->uv_lcl_addr, s1),
		inet_fmt(v->uv_rmt_addr, s2));
else
    logit(LOG_INFO6, 0, "vif #%d, phyint %s", vifi,
		inet_fmt(v->uv_lcl_addr, s1));
start_vif2(vifi);
   } else logit(LOG_INFO6, 0,
     "%s is not yet up; vif #%u not in service",
     v->uv_name, vifi);
}
  }
122}

124/*
* Start routing on all virtual interfaces that are not down or
* administratively disabled.
*/
128void
129init_installvifs(void)
130{
  vifi_t vifi;
  struct uvif *v;

  logit(LOG_INFO6, 0, "Installing vifs in kernel...");
  for (vifi = 0, v = uvifs; vifi < numvifs; ++vifi, ++v) {
if (!(v->uv_flags & VIFF_DISABLED0x0200)) {
   if (!(v->uv_flags & VIFF_DOWN0x0100)) {
if (v->uv_flags & VIFF_TUNNEL0x1)
    logit(LOG_INFO6, 0, "vif #%d, tunnel %s -> %s", vifi,
		inet_fmt(v->uv_lcl_addr, s1),
		inet_fmt(v->uv_rmt_addr, s2));
else
    logit(LOG_INFO6, 0, "vif #%d, phyint %s", vifi,
		inet_fmt(v->uv_lcl_addr, s1));
k_add_vif(vifi, &uvifs[vifi]);
   } else logit(LOG_INFO6, 0,
     "%s is not yet up; vif #%u not in service",
     v->uv_name, vifi);
}
  }
151}

153/*
* See if any interfaces have changed from up state to down, or vice versa,
* including any non-multicast-capable interfaces that are in use as local
* tunnel end-points.  Ignore interfaces that have been administratively
* disabled.
*/
159void
160check_vif_state(void)
161{
  vifi_t vifi;
  struct uvif *v;
  struct ifreq ifr;

  vifs_down = FALSE0;
  for (vifi = 0, v = uvifs; vifi < numvifs; ++vifi, ++v) {

if (v->uv_flags & VIFF_DISABLED0x0200) continue;

strncpy(ifr.ifr_name, v->uv_name, IFNAMSIZ16);
if (ioctl(udp_socket, SIOCGIFFLAGS(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct ifreq) & 0x1fff) << 16) | ((('i')) <<
 8) | ((17))), (char *)&ifr) == -1)
   logit(LOG_ERR3, errno(*__errno()),
"ioctl SIOCGIFFLAGS for %s", ifr.ifr_name);

if (v->uv_flags & VIFF_DOWN0x0100) {
   if (ifr.ifr_flagsifr_ifru.ifru_flags & IFF_UP0x1) {
v->uv_flags &= ~VIFF_DOWN0x0100;
start_vif(vifi);
logit(LOG_INFO6, 0,
    "%s has come up; vif #%u now in service",
    v->uv_name, vifi);
   }
   else vifs_down = TRUE1;
}
else {
   if (!(ifr.ifr_flagsifr_ifru.ifru_flags & IFF_UP0x1)) {
stop_vif(vifi);
v->uv_flags |= VIFF_DOWN0x0100;
logit(LOG_INFO6, 0,
    "%s has gone down; vif #%u taken out of service",
    v->uv_name, vifi);
vifs_down = TRUE1;
   }
}
  }
197}

199/*
* Send a probe message on vif v
*/
202static void
203send_probe_on_vif(struct uvif *v)
204{
  char *p;
  int datalen = 0;
  struct listaddr *nbr;
  int i;

  p = send_buf + MIN_IP_HEADER_LEN20 + IGMP_MINLEN8;

  for (i = 0; i < 4; i++)
*p++ = ((char *)&(dvmrp_genid))[i];
  datalen += 4;

  /*
   * add the neighbor list on the interface to the message
   */
  nbr = v->uv_neighbors;

  while (nbr) {
for (i = 0; i < 4; i++)
   *p++ = ((char *)&nbr->al_addr)[i];
datalen +=4;
nbr = nbr->al_next;
  }

  send_igmp(v->uv_lcl_addr,
     (v->uv_flags & VIFF_TUNNEL0x1) ? v->uv_rmt_addr
     : dvmrp_group,
     IGMP_DVMRP0x13, DVMRP_PROBE1,
     htonl(MROUTED_LEVEL |(__uint32_t)(__builtin_constant_p(((8 << 8) | 3 | ((0x02
 | 0x04 | 0x08) << 16) | (1 << 24)) | ((v->uv_flags
 & 0x1000) ? 0 : (( vifs_with_neighbors == 1 ) ? 0x010000
 : 0))) ? (__uint32_t)(((__uint32_t)(((8 << 8) | 3 | ((
0x02 | 0x04 | 0x08) << 16) | (1 << 24)) | ((v->
uv_flags & 0x1000) ? 0 : (( vifs_with_neighbors == 1 ) ? 0x010000
 : 0))) & 0xff) << 24 | ((__uint32_t)(((8 << 8
) | 3 | ((0x02 | 0x04 | 0x08) << 16) | (1 << 24))
 | ((v->uv_flags & 0x1000) ? 0 : (( vifs_with_neighbors
 == 1 ) ? 0x010000 : 0))) & 0xff00) << 8 | ((__uint32_t
)(((8 << 8) | 3 | ((0x02 | 0x04 | 0x08) << 16) | (
<< 24)) | ((v->uv_flags & 0x1000) ? 0 : (( vifs_with_neighbors
 == 1 ) ? 0x010000 : 0))) & 0xff0000) >> 8 | ((__uint32_t
)(((8 << 8) | 3 | ((0x02 | 0x04 | 0x08) << 16) | (
<< 24)) | ((v->uv_flags & 0x1000) ? 0 : (( vifs_with_neighbors
 == 1 ) ? 0x010000 : 0))) & 0xff000000) >> 24) : __swap32md
(((8 << 8) | 3 | ((0x02 | 0x04 | 0x08) << 16) | (
<< 24)) | ((v->uv_flags & 0x1000) ? 0 : (( vifs_with_neighbors
 == 1 ) ? 0x010000 : 0))))
     ((v->uv_flags & VIFF_LEAF) ? 0 : LEAF_FLAGS))(__uint32_t)(__builtin_constant_p(((8 << 8) | 3 | ((0x02
 | 0x04 | 0x08) << 16) | (1 << 24)) | ((v->uv_flags
 & 0x1000) ? 0 : (( vifs_with_neighbors == 1 ) ? 0x010000
 : 0))) ? (__uint32_t)(((__uint32_t)(((8 << 8) | 3 | ((
0x02 | 0x04 | 0x08) << 16) | (1 << 24)) | ((v->
uv_flags & 0x1000) ? 0 : (( vifs_with_neighbors == 1 ) ? 0x010000
 : 0))) & 0xff) << 24 | ((__uint32_t)(((8 << 8
) | 3 | ((0x02 | 0x04 | 0x08) << 16) | (1 << 24))
 | ((v->uv_flags & 0x1000) ? 0 : (( vifs_with_neighbors
 == 1 ) ? 0x010000 : 0))) & 0xff00) << 8 | ((__uint32_t
)(((8 << 8) | 3 | ((0x02 | 0x04 | 0x08) << 16) | (
<< 24)) | ((v->uv_flags & 0x1000) ? 0 : (( vifs_with_neighbors
 == 1 ) ? 0x010000 : 0))) & 0xff0000) >> 8 | ((__uint32_t
)(((8 << 8) | 3 | ((0x02 | 0x04 | 0x08) << 16) | (
<< 24)) | ((v->uv_flags & 0x1000) ? 0 : (( vifs_with_neighbors
 == 1 ) ? 0x010000 : 0))) & 0xff000000) >> 24) : __swap32md
(((8 << 8) | 3 | ((0x02 | 0x04 | 0x08) << 16) | (
<< 24)) | ((v->uv_flags & 0x1000) ? 0 : (( vifs_with_neighbors
 == 1 ) ? 0x010000 : 0)))),
     datalen);
235}

237/*
* Add a vifi to the kernel and start routing on it.
*/
240static void
241start_vif(vifi_t vifi)
242{
  /*
   * Install the interface in the kernel's vif structure.
   */
  k_add_vif(vifi, &uvifs[vifi]);

  start_vif2(vifi);
249}

251/*
* Add a vifi to all the user-level data structures but don't add
* it to the kernel yet.
*/
255static void
256start_vif2(vifi_t vifi)
257{
  struct uvif *v;
  u_int32_t src;
  struct phaddr *p;

  v   = &uvifs[vifi];
  src = v->uv_lcl_addr;

  /*
   * Update the existing route entries to take into account the new vif.
   */
  add_vif_to_routes(vifi);

  if (!(v->uv_flags & VIFF_TUNNEL0x1)) {
/*
* Join the DVMRP multicast group on the interface.
* (This is not strictly necessary, since the kernel promiscuously
* receives IGMP packets addressed to ANY IP multicast group while
* multicast routing is enabled.  However, joining the group allows
* this host to receive non-IGMP packets as well, such as 'pings'.)
*/
k_join(dvmrp_group, src);

/*
* Join the ALL-ROUTERS multicast group on the interface.
* This allows mtrace requests to loop back if they are run
* on the multicast router.
*/
k_join(allrtrs_group, src);

/*
* Install an entry in the routing table for the subnet to which
* the interface is connected.
*/
start_route_updates();
update_route(v->uv_subnet, v->uv_subnetmask, 0, 0, vifi);
for (p = v->uv_addrs; p; p = p->pa_next) {
   start_route_updates();
   update_route(p->pa_subnet, p->pa_subnetmask, 0, 0, vifi);
}

/*
* Until neighbors are discovered, assume responsibility for sending
* periodic group membership queries to the subnet.  Send the first
* query.
*/
v->uv_flags |= VIFF_QUERIER0x0400;
send_igmp(src, allhosts_group, IGMP_HOST_MEMBERSHIP_QUERY0x11,
     (v->uv_flags & VIFF_IGMPV10x2000) ? 0 :
     IGMP_MAX_HOST_REPORT_DELAY10 * IGMP_TIMER_SCALE10, 0, 0);
age_old_hosts();
  }

  v->uv_leaf_timer = LEAF_CONFIRMATION_TIME200;

  /*
   * Send a probe via the new vif to look for neighbors.
   */
  send_probe_on_vif(v);
316}

318/*
* Stop routing on the specified virtual interface.
*/
321static void
322stop_vif(vifi_t vifi)
323{
  struct uvif *v;
  struct listaddr *a;
  struct phaddr *p;

  v = &uvifs[vifi];

  if (!(v->uv_flags & VIFF_TUNNEL0x1)) {
/*
* Depart from the DVMRP multicast group on the interface.
*/
k_leave(dvmrp_group, v->uv_lcl_addr);

/*
* Depart from the ALL-ROUTERS multicast group on the interface.
*/
k_leave(allrtrs_group, v->uv_lcl_addr);

/*
* Update the entry in the routing table for the subnet to which
* the interface is connected, to take into account the interface
* failure.
*/
start_route_updates();
update_route(v->uv_subnet, v->uv_subnetmask, UNREACHABLE32, 0, vifi);
for (p = v->uv_addrs; p; p = p->pa_next) {
   start_route_updates();
   update_route(p->pa_subnet, p->pa_subnetmask, UNREACHABLE32, 0, vifi);
}

/*
* Discard all group addresses.  (No need to tell kernel;
* the k_del_vif() call, below, will clean up kernel state.)
*/
while (v->uv_groups != NULL((void *)0)) {
   a = v->uv_groups;
   v->uv_groups = a->al_next;
   free((char *)a);
}

v->uv_flags &= ~VIFF_QUERIER0x0400;
  }

  /*
   * Update the existing route entries to take into account the vif failure.
   */
  delete_vif_from_routes(vifi);

  /*
   * Delete the interface from the kernel's vif structure.
   */
  k_del_vif(vifi);

  /*
   * Discard all neighbor addresses.
   */
  if (v->uv_neighbors)
vifs_with_neighbors--;

  while (v->uv_neighbors != NULL((void *)0)) {
a = v->uv_neighbors;
v->uv_neighbors = a->al_next;
free((char *)a);
  }
387}


390/*
* stop routing on all vifs
*/
393void
394stop_all_vifs(void)
395{
  vifi_t vifi;
  struct uvif *v;
  struct listaddr *a;
  struct vif_acl *acl;

  for (vifi = 0; vifi < numvifs; vifi++) {
v = &uvifs[vifi];
while (v->uv_groups != NULL((void *)0)) {
   a = v->uv_groups;
   v->uv_groups = a->al_next;
   free((char *)a);
}
while (v->uv_neighbors != NULL((void *)0)) {
   a = v->uv_neighbors;
   v->uv_neighbors = a->al_next;
   free((char *)a);
}
while (v->uv_acl != NULL((void *)0)) {
   acl = v->uv_acl;
   v->uv_acl = acl->acl_next;
   free((char *)acl);
}
  }
419}


422/*
* Find the virtual interface from which an incoming packet arrived,
* based on the packet's source and destination IP addresses.
*/
426vifi_t
427find_vif(u_int32_t src, u_int32_t dst)
428{
  vifi_t vifi;
  struct uvif *v;
  struct phaddr *p;

  for (vifi = 0, v = uvifs; vifi < numvifs; ++vifi, ++v) {
if (!(v->uv_flags & (VIFF_DOWN0x0100|VIFF_DISABLED0x0200))) {
   if (v->uv_flags & VIFF_TUNNEL0x1) {
if (src == v->uv_rmt_addr && dst == v->uv_lcl_addr)
    return(vifi);
   }
   else {
if ((src & v->uv_subnetmask) == v->uv_subnet &&
    ((v->uv_subnetmask == 0xffffffff) ||
     (src != v->uv_subnetbcast)))
    return(vifi);
for (p=v->uv_addrs; p; p=p->pa_next) {
    if ((src & p->pa_subnetmask) == p->pa_subnet &&
	((p->pa_subnetmask == 0xffffffff) ||
	 (src != p->pa_subnetbcast)))
	return(vifi);
}
   }
}
  }
  return (NO_VIF((vifi_t)32));
454}

456static void
457age_old_hosts(void)
458{
  vifi_t vifi;
  struct uvif *v;
  struct listaddr *g;

  /*
   * Decrement the old-hosts-present timer for each
   * active group on each vif.
   */
  for (vifi = 0, v = uvifs; vifi < numvifs; vifi++, v++)
      for (g = v->uv_groups; g != NULL((void *)0); g = g->al_next)
   if (g->al_old)
g->al_old--;
471}


474/*
* Send group membership queries to all subnets for which I am querier.
*/
477void
478query_groups(void)
479{
  vifi_t vifi;
  struct uvif *v;

  for (vifi = 0, v = uvifs; vifi < numvifs; vifi++, v++) {
if (v->uv_flags & VIFF_QUERIER0x0400) {
   send_igmp(v->uv_lcl_addr, allhosts_group,
      IGMP_HOST_MEMBERSHIP_QUERY0x11,
      (v->uv_flags & VIFF_IGMPV10x2000) ? 0 :
      IGMP_MAX_HOST_REPORT_DELAY10 * IGMP_TIMER_SCALE10, 0, 0);
}
  }
  age_old_hosts();
492}

494/*
* Process an incoming host membership query
*/
497void
498accept_membership_query(u_int32_t src, u_int32_t dst, u_int32_t group,
  int tmo)
500{
  vifi_t vifi;
  struct uvif *v;

  if ((vifi = find_vif(src, dst)) == NO_VIF((vifi_t)32) ||
(uvifs[vifi].uv_flags & VIFF_TUNNEL0x1)) {
logit(LOG_INFO6, 0,
   "ignoring group membership query from non-adjacent host %s",
   inet_fmt(src, s1));
return;
  }

  v = &uvifs[vifi];

  /*
   * If we consider ourselves the querier for this vif, but hear a
   * query from a router with a lower IP address, yield to them.
   *
   * This is done here as well as in the neighbor discovery in case
   * there is a querier that doesn't speak DVMRP.
   *
   * XXX If this neighbor doesn't speak DVMRP, then we need to create
   * some neighbor state for him so that we can time him out!
   */
  if ((v->uv_flags & VIFF_QUERIER0x0400) &&
(ntohl(src)(__uint32_t)(__builtin_constant_p(src) ? (__uint32_t)(((__uint32_t
)(src) & 0xff) << 24 | ((__uint32_t)(src) & 0xff00
) << 8 | ((__uint32_t)(src) & 0xff0000) >> 8 |
 ((__uint32_t)(src) & 0xff000000) >> 24) : __swap32md
(src)) < ntohl(v->uv_lcl_addr)(__uint32_t)(__builtin_constant_p(v->uv_lcl_addr) ? (__uint32_t
)(((__uint32_t)(v->uv_lcl_addr) & 0xff) << 24 | (
(__uint32_t)(v->uv_lcl_addr) & 0xff00) << 8 | ((
__uint32_t)(v->uv_lcl_addr) & 0xff0000) >> 8 | (
(__uint32_t)(v->uv_lcl_addr) & 0xff000000) >> 24
) : __swap32md(v->uv_lcl_addr)))) {
   v->uv_flags &= ~VIFF_QUERIER0x0400;

  }
529}

531/*
* Process an incoming group membership report.
*/
534void
535accept_group_report(u_int32_t src, u_int32_t dst, u_int32_t group,
  int r_type)
537{
  vifi_t vifi;
  struct uvif *v;
  struct listaddr *g;

  if ((vifi = find_vif(src, dst)) == NO_VIF((vifi_t)32) ||
1
Assuming the condition is false→
3
←
Taking false branch→
(uvifs[vifi].uv_flags & VIFF_TUNNEL0x1)) {
2
←
Assuming the condition is false→
logit(LOG_INFO6, 0,
   "ignoring group membership report from non-adjacent host %s",
   inet_fmt(src, s1));
return;
  }

  v = &uvifs[vifi];

  /*
   * Look for the group in our group list; if found, reset its timer.
   */
  for (g = v->uv_groups; g != NULL((void *)0); g = g->al_next) {
4
←
Assuming 'g' is equal to NULL→
5
←
Loop condition is false. Execution continues on line 574→
if (group == g->al_addr) {
   if (r_type == IGMP_v1_HOST_MEMBERSHIP_REPORT0x12)
g->al_old = OLD_AGE_THRESHOLD2;

   /** delete old timers, set a timer for expiration **/
   g->al_timer = GROUP_EXPIRE_TIME270;
   if (g->al_query)
g->al_query = DeleteTimer(g->al_query);
   if (g->al_timerid)
g->al_timerid = DeleteTimer(g->al_timerid);
   g->al_timerid = SetTimer(vifi, g);
   break;
}
  }

  /*
   * If not found, add it to the list and update kernel cache.
   */
  if (g5.1
'g' is equal to NULL
 == NULL((void *)0)) {
6
←
Taking true branch→
g = malloc(sizeof(struct listaddr));
7
←
Value assigned to 'g'→
if (g == NULL((void *)0))
8
←
Assuming 'g' is equal to NULL→
9
←
Taking true branch→
   logit(LOG_ERR3, 0, "ran out of memory");    /* fatal */

g->al_addr   = group;
10
←
Access to field 'al_addr' results in a dereference of a null pointer (loaded from variable 'g')
if (r_type == IGMP_v2_HOST_MEMBERSHIP_REPORT0x16)
   g->al_old = 0;
else
   g->al_old = OLD_AGE_THRESHOLD2;

/** set a timer for expiration **/
      g->al_query = 0;
g->al_timer  = GROUP_EXPIRE_TIME270;
time(&g->al_ctime);
g->al_timerid = SetTimer(vifi, g);
g->al_next   = v->uv_groups;
v->uv_groups = g;

update_lclgrp(vifi, group);
  }

  /*
   * Check if a graft is necessary for this group
   */
  chkgrp_graft(vifi, group);
600}


603void
604accept_leave_message(u_int32_t src, u_int32_t dst, u_int32_t group)
605{
  vifi_t vifi;
  struct uvif *v;
  struct listaddr *g;

  if ((vifi = find_vif(src, dst)) == NO_VIF((vifi_t)32) ||
(uvifs[vifi].uv_flags & VIFF_TUNNEL0x1)) {
logit(LOG_INFO6, 0,
   "ignoring group leave report from non-adjacent host %s",
   inet_fmt(src, s1));
return;
  }

  v = &uvifs[vifi];

  if (!(v->uv_flags & VIFF_QUERIER0x0400) || (v->uv_flags & VIFF_IGMPV10x2000))
return;

  /*
   * Look for the group in our group list in order to set up a short-timeout
   * query.
   */
  for (g = v->uv_groups; g != NULL((void *)0); g = g->al_next) {
if (group == g->al_addr) {
   logit(LOG_DEBUG7, 0,
"[vif.c, _accept_leave_message] %d %d \n",
g->al_old, g->al_query);

   /* Ignore the leave message if there are old hosts present */
   if (g->al_old)
return;

   /* still waiting for a reply to a query, ignore the leave */
   if (g->al_query)
return;

   /** delete old timer set a timer for expiration **/
   if (g->al_timerid)
g->al_timerid = DeleteTimer(g->al_timerid);

   /** send a group specific querry **/
   g->al_timer = LEAVE_EXPIRE_TIME3;
   send_igmp(v->uv_lcl_addr, g->al_addr,
      IGMP_HOST_MEMBERSHIP_QUERY0x11,
      LEAVE_EXPIRE_TIME3 / 3 * IGMP_TIMER_SCALE10,
      g->al_addr, 0);
   g->al_query = SetQueryTimer(g, vifi, g->al_timer / 3,
		LEAVE_EXPIRE_TIME3 / 3 * IGMP_TIMER_SCALE10);
   g->al_timerid = SetTimer(vifi, g);
   break;
}
  }
657}


660/*
* Send a periodic probe on all vifs.
* Useful to determine one-way interfaces.
* Detect neighbor loss faster.
*/
665void
666probe_for_neighbors(void)
667{
  vifi_t vifi;
  struct uvif *v;

  for (vifi = 0, v = uvifs; vifi < numvifs; vifi++, v++) {
if (!(v->uv_flags & (VIFF_DOWN0x0100|VIFF_DISABLED0x0200))) {
   send_probe_on_vif(v);
}
  }
676}


679/*
* Send a list of all of our neighbors to the requestor, `src'.
*/
682void
683accept_neighbor_request(u_int32_t src, u_int32_t dst)
684{
  vifi_t vifi;
  struct uvif *v;
  u_char *p, *ncount;
  struct listaddr *la;
  int	datalen;
  u_int32_t temp_addr, us, them = src;

  /* Determine which of our addresses to use as the source of our response
   * to this query.
   */
  if (IN_MULTICAST(ntohl(dst))(((u_int32_t)((__uint32_t)(__builtin_constant_p(dst) ? (__uint32_t
)(((__uint32_t)(dst) & 0xff) << 24 | ((__uint32_t)(
dst) & 0xff00) << 8 | ((__uint32_t)(dst) & 0xff0000
) >> 8 | ((__uint32_t)(dst) & 0xff000000) >> 24
) : __swap32md(dst))) & ((u_int32_t)(0xf0000000))) == ((u_int32_t
)(0xe0000000)))) { /* query sent to a multicast group */
int udp;		/* find best interface to reply on */
struct sockaddr_in addr;
int addrlen = sizeof(addr);

memset(&addr, 0, sizeof addr);
addr.sin_family = AF_INET2;
addr.sin_len = sizeof addr;
addr.sin_addr.s_addr = dst;
addr.sin_port = htons(2000)(__uint16_t)(__builtin_constant_p(2000) ? (__uint16_t)(((__uint16_t
)(2000) & 0xffU) << 8 | ((__uint16_t)(2000) & 0xff00U
) >> 8) : __swap16md(2000)); /* any port over 1024 will do... */
if ((udp = socket(AF_INET2, SOCK_DGRAM2, 0)) == -1
   || connect(udp, (struct sockaddr *) &addr, sizeof(addr)) == -1
   || getsockname(udp, (struct sockaddr *) &addr, &addrlen) == -1) {
   logit(LOG_WARNING4, errno(*__errno()), "Determining local address");
   close(udp);
   return;
}
close(udp);
us = addr.sin_addr.s_addr;
  } else			/* query sent to us alone */
us = dst;

717#define PUT_ADDR(a)temp_addr = (__uint32_t)(__builtin_constant_p(a) ? (__uint32_t
)(((__uint32_t)(a) & 0xff) << 24 | ((__uint32_t)(a)
 & 0xff00) << 8 | ((__uint32_t)(a) & 0xff0000) >>
| ((__uint32_t)(a) & 0xff000000) >> 24) : __swap32md
(a)); *p++ = temp_addr >> 24; *p++ = (temp_addr >>
 16) & 0xFF; *p++ = (temp_addr >> 8) & 0xFF; *p
++ = temp_addr & 0xFF;	temp_addr = ntohl(a)(__uint32_t)(__builtin_constant_p(a) ? (__uint32_t)(((__uint32_t
)(a) & 0xff) << 24 | ((__uint32_t)(a) & 0xff00)
 << 8 | ((__uint32_t)(a) & 0xff0000) >> 8 | (
(__uint32_t)(a) & 0xff000000) >> 24) : __swap32md(a
)); \
	*p++ = temp_addr >> 24; \
	*p++ = (temp_addr >> 16) & 0xFF; \
	*p++ = (temp_addr >> 8) & 0xFF; \
	*p++ = temp_addr & 0xFF;

  p = (u_char *) (send_buf + MIN_IP_HEADER_LEN20 + IGMP_MINLEN8);
  datalen = 0;

  for (vifi = 0, v = uvifs; vifi < numvifs; vifi++, v++) {
if (v->uv_flags & VIFF_DISABLED0x0200)
   continue;

ncount = 0;

for (la = v->uv_neighbors; la; la = la->al_next) {

   /* Make sure that there's room for this neighbor... */
   if (datalen + (ncount == 0 ? 4 + 3 + 4 : 4) > MAX_DVMRP_DATA_LEN( 576 - 60 - 8 )) {
send_igmp(us, them, IGMP_DVMRP0x13, DVMRP_NEIGHBORS4,
	  htonl(MROUTED_LEVEL)(__uint32_t)(__builtin_constant_p(((8 << 8) | 3 | ((0x02
 | 0x04 | 0x08) << 16) | (1 << 24))) ? (__uint32_t
)(((__uint32_t)(((8 << 8) | 3 | ((0x02 | 0x04 | 0x08) <<
 16) | (1 << 24))) & 0xff) << 24 | ((__uint32_t
)(((8 << 8) | 3 | ((0x02 | 0x04 | 0x08) << 16) | (
<< 24))) & 0xff00) << 8 | ((__uint32_t)(((8
 << 8) | 3 | ((0x02 | 0x04 | 0x08) << 16) | (1 <<
 24))) & 0xff0000) >> 8 | ((__uint32_t)(((8 <<
 8) | 3 | ((0x02 | 0x04 | 0x08) << 16) | (1 << 24
))) & 0xff000000) >> 24) : __swap32md(((8 << 8
) | 3 | ((0x02 | 0x04 | 0x08) << 16) | (1 << 24))
)), datalen);
p = (u_char *) (send_buf + MIN_IP_HEADER_LEN20 + IGMP_MINLEN8);
datalen = 0;
ncount = 0;
   }

   /* Put out the header for this neighbor list... */
   if (ncount == 0) {
PUT_ADDR(v->uv_lcl_addr)temp_addr = (__uint32_t)(__builtin_constant_p(v->uv_lcl_addr
) ? (__uint32_t)(((__uint32_t)(v->uv_lcl_addr) & 0xff)
 << 24 | ((__uint32_t)(v->uv_lcl_addr) & 0xff00)
 << 8 | ((__uint32_t)(v->uv_lcl_addr) & 0xff0000
) >> 8 | ((__uint32_t)(v->uv_lcl_addr) & 0xff000000
) >> 24) : __swap32md(v->uv_lcl_addr)); *p++ = temp_addr
 >> 24; *p++ = (temp_addr >> 16) & 0xFF; *p++
 = (temp_addr >> 8) & 0xFF; *p++ = temp_addr & 0xFF
;;
*p++ = v->uv_metric;
*p++ = v->uv_threshold;
ncount = p;
*p++ = 0;
datalen += 4 + 3;
   }

   PUT_ADDR(la->al_addr)temp_addr = (__uint32_t)(__builtin_constant_p(la->al_addr)
 ? (__uint32_t)(((__uint32_t)(la->al_addr) & 0xff) <<
| ((__uint32_t)(la->al_addr) & 0xff00) << 8 |
 ((__uint32_t)(la->al_addr) & 0xff0000) >> 8 | (
(__uint32_t)(la->al_addr) & 0xff000000) >> 24) :
 __swap32md(la->al_addr)); *p++ = temp_addr >> 24; *
p++ = (temp_addr >> 16) & 0xFF; *p++ = (temp_addr >>
 8) & 0xFF; *p++ = temp_addr & 0xFF;;
   datalen += 4;
   (*ncount)++;
}
  }

  if (datalen != 0)
send_igmp(us, them, IGMP_DVMRP0x13, DVMRP_NEIGHBORS4, htonl(MROUTED_LEVEL)(__uint32_t)(__builtin_constant_p(((8 << 8) | 3 | ((0x02
 | 0x04 | 0x08) << 16) | (1 << 24))) ? (__uint32_t
)(((__uint32_t)(((8 << 8) | 3 | ((0x02 | 0x04 | 0x08) <<
 16) | (1 << 24))) & 0xff) << 24 | ((__uint32_t
)(((8 << 8) | 3 | ((0x02 | 0x04 | 0x08) << 16) | (
<< 24))) & 0xff00) << 8 | ((__uint32_t)(((8
 << 8) | 3 | ((0x02 | 0x04 | 0x08) << 16) | (1 <<
 24))) & 0xff0000) >> 8 | ((__uint32_t)(((8 <<
 8) | 3 | ((0x02 | 0x04 | 0x08) << 16) | (1 << 24
))) & 0xff000000) >> 24) : __swap32md(((8 << 8
) | 3 | ((0x02 | 0x04 | 0x08) << 16) | (1 << 24))
)),
  datalen);
762}

764/*
* Send a list of all of our neighbors to the requestor, `src'.
*/
767void
768accept_neighbor_request2(u_int32_t src, u_int32_t dst)
769{
  vifi_t vifi;
  struct uvif *v;
  u_char *p, *ncount;
  struct listaddr *la;
  int	datalen;
  u_int32_t us, them = src;

  /* Determine which of our addresses to use as the source of our response
   * to this query.
   */
  if (IN_MULTICAST(ntohl(dst))(((u_int32_t)((__uint32_t)(__builtin_constant_p(dst) ? (__uint32_t
)(((__uint32_t)(dst) & 0xff) << 24 | ((__uint32_t)(
dst) & 0xff00) << 8 | ((__uint32_t)(dst) & 0xff0000
) >> 8 | ((__uint32_t)(dst) & 0xff000000) >> 24
) : __swap32md(dst))) & ((u_int32_t)(0xf0000000))) == ((u_int32_t
)(0xe0000000)))) { /* query sent to a multicast group */
int udp;		/* find best interface to reply on */
struct sockaddr_in addr;
int addrlen = sizeof(addr);

memset(&addr, 0, sizeof addr);
addr.sin_family = AF_INET2;
addr.sin_len = sizeof addr;
addr.sin_addr.s_addr = dst;
addr.sin_port = htons(2000)(__uint16_t)(__builtin_constant_p(2000) ? (__uint16_t)(((__uint16_t
)(2000) & 0xffU) << 8 | ((__uint16_t)(2000) & 0xff00U
) >> 8) : __swap16md(2000)); /* any port over 1024 will do... */
if ((udp = socket(AF_INET2, SOCK_DGRAM2, 0)) == -1
   || connect(udp, (struct sockaddr *) &addr, sizeof(addr)) == -1
   || getsockname(udp, (struct sockaddr *) &addr, &addrlen) == -1) {
   logit(LOG_WARNING4, errno(*__errno()), "Determining local address");
   close(udp);
   return;
}
close(udp);
us = addr.sin_addr.s_addr;
  } else			/* query sent to us alone */
us = dst;

  p = (u_char *) (send_buf + MIN_IP_HEADER_LEN20 + IGMP_MINLEN8);
  datalen = 0;

  for (vifi = 0, v = uvifs; vifi < numvifs; vifi++, v++) {
u_short vflags = v->uv_flags;
u_char rflags = 0;
if (vflags & VIFF_TUNNEL0x1)
   rflags |= DVMRP_NF_TUNNEL0x01;
if (vflags & VIFF_SRCRT0x2)
   rflags |= DVMRP_NF_SRCRT0x02;
if (vflags & VIFF_DOWN0x0100)
   rflags |= DVMRP_NF_DOWN0x10;
if (vflags & VIFF_DISABLED0x0200)
   rflags |= DVMRP_NF_DISABLED0x20;
if (vflags & VIFF_QUERIER0x0400)
   rflags |= DVMRP_NF_QUERIER0x40;
if (vflags & VIFF_LEAF0x1000)
   rflags |= DVMRP_NF_LEAF0x80;
ncount = 0;
la = v->uv_neighbors;
if (la == NULL((void *)0)) {
   /*
    * include down & disabled interfaces and interfaces on
    * leaf nets.
    */
   if (rflags & DVMRP_NF_TUNNEL0x01)
rflags |= DVMRP_NF_DOWN0x10;
   if (datalen > MAX_DVMRP_DATA_LEN( 576 - 60 - 8 ) - 12) {
send_igmp(us, them, IGMP_DVMRP0x13, DVMRP_NEIGHBORS26,
	  htonl(MROUTED_LEVEL)(__uint32_t)(__builtin_constant_p(((8 << 8) | 3 | ((0x02
 | 0x04 | 0x08) << 16) | (1 << 24))) ? (__uint32_t
)(((__uint32_t)(((8 << 8) | 3 | ((0x02 | 0x04 | 0x08) <<
 16) | (1 << 24))) & 0xff) << 24 | ((__uint32_t
)(((8 << 8) | 3 | ((0x02 | 0x04 | 0x08) << 16) | (
<< 24))) & 0xff00) << 8 | ((__uint32_t)(((8
 << 8) | 3 | ((0x02 | 0x04 | 0x08) << 16) | (1 <<
 24))) & 0xff0000) >> 8 | ((__uint32_t)(((8 <<
 8) | 3 | ((0x02 | 0x04 | 0x08) << 16) | (1 << 24
))) & 0xff000000) >> 24) : __swap32md(((8 << 8
) | 3 | ((0x02 | 0x04 | 0x08) << 16) | (1 << 24))
)), datalen);
p = (u_char *) (send_buf + MIN_IP_HEADER_LEN20 + IGMP_MINLEN8);
datalen = 0;
   }
   *(u_int*)p = v->uv_lcl_addr;
   p += 4;
   *p++ = v->uv_metric;
   *p++ = v->uv_threshold;
   *p++ = rflags;
   *p++ = 1;
   *(u_int*)p =  v->uv_rmt_addr;
   p += 4;
   datalen += 12;
} else {
   for ( ; la; la = la->al_next) {
/* Make sure that there's room for this neighbor... */
if (datalen + (ncount == 0 ? 4+4+4 : 4) > MAX_DVMRP_DATA_LEN( 576 - 60 - 8 )) {
    send_igmp(us, them, IGMP_DVMRP0x13, DVMRP_NEIGHBORS26,
	      htonl(MROUTED_LEVEL)(__uint32_t)(__builtin_constant_p(((8 << 8) | 3 | ((0x02
 | 0x04 | 0x08) << 16) | (1 << 24))) ? (__uint32_t
)(((__uint32_t)(((8 << 8) | 3 | ((0x02 | 0x04 | 0x08) <<
 16) | (1 << 24))) & 0xff) << 24 | ((__uint32_t
)(((8 << 8) | 3 | ((0x02 | 0x04 | 0x08) << 16) | (
<< 24))) & 0xff00) << 8 | ((__uint32_t)(((8
 << 8) | 3 | ((0x02 | 0x04 | 0x08) << 16) | (1 <<
 24))) & 0xff0000) >> 8 | ((__uint32_t)(((8 <<
 8) | 3 | ((0x02 | 0x04 | 0x08) << 16) | (1 << 24
))) & 0xff000000) >> 24) : __swap32md(((8 << 8
) | 3 | ((0x02 | 0x04 | 0x08) << 16) | (1 << 24))
)), datalen);
    p = (u_char *) (send_buf + MIN_IP_HEADER_LEN20 + IGMP_MINLEN8);
    datalen = 0;
    ncount = 0;
}
/* Put out the header for this neighbor list... */
if (ncount == 0) {
    *(u_int*)p = v->uv_lcl_addr;
    p += 4;
    *p++ = v->uv_metric;
    *p++ = v->uv_threshold;
    *p++ = rflags;
    ncount = p;
    *p++ = 0;
    datalen += 4 + 4;
}
*(u_int*)p = la->al_addr;
p += 4;
datalen += 4;
(*ncount)++;
   }
}
  }
  if (datalen != 0)
send_igmp(us, them, IGMP_DVMRP0x13, DVMRP_NEIGHBORS26, htonl(MROUTED_LEVEL)(__uint32_t)(__builtin_constant_p(((8 << 8) | 3 | ((0x02
 | 0x04 | 0x08) << 16) | (1 << 24))) ? (__uint32_t
)(((__uint32_t)(((8 << 8) | 3 | ((0x02 | 0x04 | 0x08) <<
 16) | (1 << 24))) & 0xff) << 24 | ((__uint32_t
)(((8 << 8) | 3 | ((0x02 | 0x04 | 0x08) << 16) | (
<< 24))) & 0xff00) << 8 | ((__uint32_t)(((8
 << 8) | 3 | ((0x02 | 0x04 | 0x08) << 16) | (1 <<
 24))) & 0xff0000) >> 8 | ((__uint32_t)(((8 <<
 8) | 3 | ((0x02 | 0x04 | 0x08) << 16) | (1 << 24
))) & 0xff000000) >> 24) : __swap32md(((8 << 8
) | 3 | ((0x02 | 0x04 | 0x08) << 16) | (1 << 24))
)),
  datalen);
875}

877void
878accept_info_request(u_int32_t src, u_int32_t dst, u_char *p, int datalen)
879{
  u_char *q;
  int len;
  int outlen = 0;

  q = (u_char *) (send_buf + MIN_IP_HEADER_LEN20 + IGMP_MINLEN8);

  /* To be general, this must deal properly with breaking up over-sized
   * packets.  That implies passing a length to each function, and
   * allowing each function to request to be called again.  Right now,
   * we're only implementing the one thing we are positive will fit into
   * a single packet, so we wimp out.
   */
  while (datalen > 0) {
len = 0;
switch (*p) {
   case DVMRP_INFO_VERSION1:
len = info_version(q, (u_char *)send_buf + RECV_BUF_SIZE8192 - q);
break;

   case DVMRP_INFO_NEIGHBORS2:
   default:
logit(LOG_INFO6, 0, "ignoring unknown info type %d", *p);
break;
}
*(q+1) = len++;
outlen += len * 4;
q += len * 4;
len = (*(p+1) + 1) * 4;
p += len;
datalen -= len;
  }

  if (outlen != 0)
send_igmp(INADDR_ANY((u_int32_t)(0x00000000)), src, IGMP_DVMRP0x13, DVMRP_INFO_REPLY11,
	htonl(MROUTED_LEVEL)(__uint32_t)(__builtin_constant_p(((8 << 8) | 3 | ((0x02
 | 0x04 | 0x08) << 16) | (1 << 24))) ? (__uint32_t
)(((__uint32_t)(((8 << 8) | 3 | ((0x02 | 0x04 | 0x08) <<
 16) | (1 << 24))) & 0xff) << 24 | ((__uint32_t
)(((8 << 8) | 3 | ((0x02 | 0x04 | 0x08) << 16) | (
<< 24))) & 0xff00) << 8 | ((__uint32_t)(((8
 << 8) | 3 | ((0x02 | 0x04 | 0x08) << 16) | (1 <<
 24))) & 0xff0000) >> 8 | ((__uint32_t)(((8 <<
 8) | 3 | ((0x02 | 0x04 | 0x08) << 16) | (1 << 24
))) & 0xff000000) >> 24) : __swap32md(((8 << 8
) | 3 | ((0x02 | 0x04 | 0x08) << 16) | (1 << 24))
)), outlen);
915}

917/*
* Information response -- return version string
*/
920static int
921info_version(char *p, int len)
922{
  extern char versionstring[];

  if (len < 5)
return (0);
  *p++ = DVMRP_INFO_VERSION1;
  p++;	/* skip over length */
  *p++ = 0;	/* zero out */
  *p++ = 0;	/* reserved fields */
  strlcpy(p, versionstring, len - 4);

  len = strlen(p);
  return ((len + 3) / 4);
935}

937/*
* Process an incoming neighbor-list message.
*/
940void
941accept_neighbors(u_int32_t src, u_int32_t dst, u_char *p, int datalen,
  u_int32_t level)
943{
  logit(LOG_INFO6, 0, "ignoring spurious DVMRP neighbor list from %s to %s",
inet_fmt(src, s1), inet_fmt(dst, s2));
946}


949/*
* Process an incoming neighbor-list message.
*/
952void
953accept_neighbors2(u_int32_t src, u_int32_t dst, u_char *p, int datalen,
  u_int32_t level)
955{
  logit(LOG_INFO6, 0, "ignoring spurious DVMRP neighbor list2 from %s to %s",
inet_fmt(src, s1), inet_fmt(dst, s2));
958}

960/*
* Process an incoming info reply message.
*/
963void
964accept_info_reply(u_int32_t src, u_int32_t dst, u_char *p, int datalen)
965{
  logit(LOG_INFO6, 0, "ignoring spurious DVMRP info reply from %s to %s",
inet_fmt(src, s1), inet_fmt(dst, s2));
968}


971/*
* Update the neighbor entry for neighbor 'addr' on vif 'vifi'.
* 'msgtype' is the type of DVMRP message received from the neighbor.
* Return TRUE if 'addr' is a valid neighbor, FALSE otherwise.
*/
976int
977update_neighbor(vifi_t vifi, u_int32_t addr, int msgtype, char *p,
  int datalen, u_int32_t level)
979{
  struct uvif *v;
  struct listaddr *n;
  u_int32_t genid = 0;
  u_int32_t router;
  u_int32_t send_tables = 0;
  int do_reset = FALSE0;
  int nflags;

  v = &uvifs[vifi];
  nflags = (level >> 16) & 0xff;

  /*
   * Confirm that 'addr' is a valid neighbor address on vif 'vifi'.
   * IT IS ASSUMED that this was preceded by a call to find_vif(), which
   * checks that 'addr' is either a valid remote tunnel endpoint or a
   * non-broadcast address belonging to a directly-connected subnet.
   * Therefore, here we check only that 'addr' is not our own address
   * (due to an impostor or erroneous loopback) or an address of the form
   * {subnet,0} ("the unknown host").  These checks are not performed in
   * find_vif() because those types of address are acceptable for some
   * types of IGMP message (such as group membership reports).
   */
  if (!(v->uv_flags & VIFF_TUNNEL0x1) &&
(addr == v->uv_lcl_addr ||
addr == v->uv_subnet )) {
logit(LOG_WARNING4, 0,
   "received DVMRP message from 'the unknown host' or self: %s",
   inet_fmt(addr, s1));
return (FALSE0);
  }

  /*
   * Look for addr in list of neighbors.
   */
  for (n = v->uv_neighbors; n != NULL((void *)0); n = n->al_next) {
if (addr == n->al_addr) {
   break;
}
  }

  /*
   * Found it.  Reset its timer, and check for a version change
   */
  if (n) {
n->al_timer = 0;

/*
* update the neighbors version and protocol number
* if changed => router went down and came up,
* so take action immediately.
*/
if ((n->al_pv != (level & 0xff)) ||
   (n->al_mv != ((level >> 8) & 0xff))) {

   do_reset = TRUE1;
   logit(LOG_DEBUG7, 0,
"version change neighbor %s [old:%d.%d, new:%d.%d]",
inet_fmt(addr, s1),
n->al_pv, n->al_mv, level&0xff, (level >> 8) & 0xff);

   n->al_pv = level & 0xff;
   n->al_mv = (level >> 8) & 0xff;
}
  } else {
/*
* If not found, add it to the list.  If the neighbor has a lower
* IP address than me, yield querier duties to it.
*/
logit(LOG_DEBUG7, 0, "New neighbor %s on vif %d v%d.%d nf 0x%02x",
   inet_fmt(addr, s1), vifi, level & 0xff, (level >> 8) & 0xff,
   (level >> 16) & 0xff);

n = malloc(sizeof(struct listaddr));
if (n == NULL((void *)0))
   logit(LOG_ERR3, 0, "ran out of memory");    /* fatal */

n->al_addr      = addr;
n->al_pv	= level & 0xff;
n->al_mv	= (level >> 8) & 0xff;
n->al_genid	= 0;

time(&n->al_ctime);
n->al_timer     = 0;
n->al_next      = v->uv_neighbors;

/*
* If we thought that we had no neighbors on this vif, send a route
* report to the vif.  If this is just a new neighbor on the same
* vif, send the route report just to the new neighbor.
*/
if (v->uv_neighbors == NULL((void *)0)) {
   send_tables = (v->uv_flags & VIFF_TUNNEL0x1) ? addr : dvmrp_group;
   vifs_with_neighbors++;
} else {
   send_tables = addr;
}

v->uv_neighbors = n;

if (!(v->uv_flags & VIFF_TUNNEL0x1) &&
   ntohl(addr)(__uint32_t)(__builtin_constant_p(addr) ? (__uint32_t)(((__uint32_t
)(addr) & 0xff) << 24 | ((__uint32_t)(addr) & 0xff00
) << 8 | ((__uint32_t)(addr) & 0xff0000) >> 8
 | ((__uint32_t)(addr) & 0xff000000) >> 24) : __swap32md
(addr)) < ntohl(v->uv_lcl_addr)(__uint32_t)(__builtin_constant_p(v->uv_lcl_addr) ? (__uint32_t
)(((__uint32_t)(v->uv_lcl_addr) & 0xff) << 24 | (
(__uint32_t)(v->uv_lcl_addr) & 0xff00) << 8 | ((
__uint32_t)(v->uv_lcl_addr) & 0xff0000) >> 8 | (
(__uint32_t)(v->uv_lcl_addr) & 0xff000000) >> 24
) : __swap32md(v->uv_lcl_addr)))
   v->uv_flags &= ~VIFF_QUERIER0x0400;
  }

  /*
   * Check if the router gen-ids are the same.
   * Need to reset the prune state of the router if not.
   * Also check for one-way interfaces by seeing if we are in our
   * neighbor's list of known routers.
   */
  if (msgtype == DVMRP_PROBE1) {

/* Check genid neighbor flag.  Also check version number; 3.3 and
* 3.4 didn't set this flag. */
if ((((level >> 16) & 0xff) & NF_GENID0x04) ||
   (((level & 0xff) == 3) && (((level >> 8) & 0xff) > 2))) {

   int i;

   if (datalen < 4) {
logit(LOG_WARNING4, 0,
    "received truncated probe message from %s (len %d)",
    inet_fmt(addr, s1), datalen);
return (FALSE0);
   }

   for (i = 0; i < 4; i++)
     ((char *)&genid)[i] = *p++;
   datalen -= 4;

   if (n->al_genid == 0)
n->al_genid = genid;
   else if (n->al_genid != genid) {
logit(LOG_DEBUG7, 0,
    "new genid neigbor %s on vif %d [old:%x, new:%x]",
    inet_fmt(addr, s1), vifi, n->al_genid, genid);

n->al_genid = genid;
do_reset = TRUE1;
   }

   /*
    * loop through router list and check for one-way ifs.
    */

   v->uv_flags |= VIFF_ONEWAY0x0800;

   while (datalen > 0) {
if (datalen < 4) {
    logit(LOG_WARNING4, 0,
	"received truncated probe message from %s (len %d)",
	inet_fmt(addr, s1), datalen);
    return (FALSE0);
}
for (i = 0; i < 4; i++)
  ((char *)&router)[i] = *p++;
datalen -= 4;
if (router == v->uv_lcl_addr) {
    v->uv_flags &= ~VIFF_ONEWAY0x0800;
    break;
}
   }
}
  }
  if (n->al_flags != nflags) {
n->al_flags = nflags;

if (n->al_flags & NF_LEAF0x01) {
   /*XXX If we have non-leaf neighbors then we know we shouldn't
    * mark this vif as a leaf.  For now we just count on other
    * probes and/or reports resetting the timer. */
   if (!v->uv_leaf_timer)
v->uv_leaf_timer = LEAF_CONFIRMATION_TIME200;
} else {
   /* If we get a leaf to non-leaf transition, we *must* update
    * the routing table. */
   if (v->uv_flags & VIFF_LEAF0x1000 && send_tables == 0)
send_tables = addr;
   v->uv_flags &= ~VIFF_LEAF0x1000;
   v->uv_leaf_timer = 0;
}
  }
  if (do_reset) {
reset_neighbor_state(vifi, addr);
if (!send_tables)
   send_tables = addr;
  }
  if (send_tables)
report(ALL_ROUTES0, vifi, send_tables);

  return (TRUE1);
1171}


1174/*
* On every timer interrupt, advance the timer in each neighbor and
* group entry on every vif.
*/
1178void
1179age_vifs(void)
1180{
  vifi_t vifi;
  struct uvif *v;
  struct listaddr *a, *prev_a, *n;
  u_int32_t addr;

  for (vifi = 0, v = uvifs; vifi < numvifs; ++vifi, ++v ) {
if (v->uv_leaf_timer && (v->uv_leaf_timer -= TIMER_INTERVAL5 == 0)) {
v->uv_flags |= VIFF_LEAF0x1000;
}

for (prev_a = (struct listaddr *)&(v->uv_neighbors),
    a = v->uv_neighbors;
    a != NULL((void *)0);
    prev_a = a, a = a->al_next) {

   if ((a->al_timer += TIMER_INTERVAL5) < NEIGHBOR_EXPIRE_TIME140)
continue;

   /*
    * Neighbor has expired; delete it from the neighbor list,
    * delete it from the 'dominants' and 'subordinates arrays of
    * any route entries and assume querier duties unless there is
    * another neighbor with a lower IP address than mine.
    */
   addr = a->al_addr;
   prev_a->al_next = a->al_next;
   free((char *)a);
   a = prev_a;

   delete_neighbor_from_routes(addr, vifi);

   if (v->uv_neighbors == NULL((void *)0))
vifs_with_neighbors--;

   v->uv_leaf_timer = LEAF_CONFIRMATION_TIME200;

   if (!(v->uv_flags & VIFF_TUNNEL0x1)) {
v->uv_flags |= VIFF_QUERIER0x0400;
for (n = v->uv_neighbors; n != NULL((void *)0); n = n->al_next) {
    if (ntohl(n->al_addr)(__uint32_t)(__builtin_constant_p(n->al_addr) ? (__uint32_t
)(((__uint32_t)(n->al_addr) & 0xff) << 24 | ((__uint32_t
)(n->al_addr) & 0xff00) << 8 | ((__uint32_t)(n->
al_addr) & 0xff0000) >> 8 | ((__uint32_t)(n->al_addr
) & 0xff000000) >> 24) : __swap32md(n->al_addr)) < ntohl(v->uv_lcl_addr)(__uint32_t)(__builtin_constant_p(v->uv_lcl_addr) ? (__uint32_t
)(((__uint32_t)(v->uv_lcl_addr) & 0xff) << 24 | (
(__uint32_t)(v->uv_lcl_addr) & 0xff00) << 8 | ((
__uint32_t)(v->uv_lcl_addr) & 0xff0000) >> 8 | (
(__uint32_t)(v->uv_lcl_addr) & 0xff000000) >> 24
) : __swap32md(v->uv_lcl_addr))) {
	v->uv_flags &= ~VIFF_QUERIER0x0400;
    }
    if (!(n->al_flags & NF_LEAF0x01)) {
	v->uv_leaf_timer = 0;
    }
}
   }
}
  }
1230}

1232/*
* Returns the neighbor info struct for a given neighbor
*/
1235struct listaddr *
1236neighbor_info(vifi_t vifi, u_int32_t addr)
1237{
  struct listaddr *u;

  for (u = uvifs[vifi].uv_neighbors; u; u = u->al_next)
if (u->al_addr == addr)
   return u;

  return NULL((void *)0);
1245}

1247/*
* Print the contents of the uvifs array on file 'fp'.
*/
1250void
1251dump_vifs(FILE *fp)
1252{
  vifi_t vifi;
  struct uvif *v;
  struct listaddr *a;
  struct phaddr *p;
  struct sioc_vif_req v_req;

  fprintf(fp, "vifs_with_neighbors = %d\n", vifs_with_neighbors);

  if (vifs_with_neighbors == 1)
fprintf(fp,"[This host is a leaf]\n\n");

  fprintf(fp,
  "\nVirtual Interface Table\n%s",
  "Vif  Name  Local-Address                               ");
  fprintf(fp,
  "M  Thr  Rate   Flags\n");

  for (vifi = 0, v = uvifs; vifi < numvifs; vifi++, v++) {

fprintf(fp, "%2u %6s  %-15s %6s: %-18s %2u %3u  %5u  ",
vifi,
v->uv_name,
inet_fmt(v->uv_lcl_addr, s1),
(v->uv_flags & VIFF_TUNNEL0x1) ?
	"tunnel":
	"subnet",
(v->uv_flags & VIFF_TUNNEL0x1) ?
	inet_fmt(v->uv_rmt_addr, s2) :
	inet_fmts(v->uv_subnet, v->uv_subnetmask, s3),
v->uv_metric,
v->uv_threshold,
v->uv_rate_limit);

if (v->uv_flags & VIFF_ONEWAY0x0800)   fprintf(fp, " one-way");
if (v->uv_flags & VIFF_DOWN0x0100)     fprintf(fp, " down");
if (v->uv_flags & VIFF_DISABLED0x0200) fprintf(fp, " disabled");
if (v->uv_flags & VIFF_QUERIER0x0400)  fprintf(fp, " querier");
if (v->uv_flags & VIFF_SRCRT0x2)    fprintf(fp, " src-rt");
if (v->uv_flags & VIFF_LEAF0x1000)	 fprintf(fp, " leaf");
if (v->uv_flags & VIFF_IGMPV10x2000)	 fprintf(fp, " IGMPv1");
fprintf(fp, "\n");

if (v->uv_addrs != NULL((void *)0)) {
   fprintf(fp, "                alternate subnets: %s\n",
    inet_fmts(v->uv_addrs->pa_subnet, v->uv_addrs->pa_subnetmask, s1));
   for (p = v->uv_addrs->pa_next; p; p = p->pa_next) {
fprintf(fp, "                                   %s\n",
	inet_fmts(p->pa_subnet, p->pa_subnetmask, s1));
   }
}

if (v->uv_neighbors != NULL((void *)0)) {
   fprintf(fp, "                            peers: %s (%d.%d) (0x%x)\n",
    inet_fmt(v->uv_neighbors->al_addr, s1),
    v->uv_neighbors->al_pv, v->uv_neighbors->al_mv,
    v->uv_neighbors->al_flags);
   for (a = v->uv_neighbors->al_next; a != NULL((void *)0); a = a->al_next) {
fprintf(fp, "                                   %s (%d.%d) (0x%x)\n",
	inet_fmt(a->al_addr, s1), a->al_pv, a->al_mv,
	a->al_flags);
   }
}

if (v->uv_groups != NULL((void *)0)) {
   fprintf(fp, "                           groups: %-15s\n",
    inet_fmt(v->uv_groups->al_addr, s1));
   for (a = v->uv_groups->al_next; a != NULL((void *)0); a = a->al_next) {
fprintf(fp, "                                   %-15s\n",
	inet_fmt(a->al_addr, s1));
   }
}
if (v->uv_acl != NULL((void *)0)) {
   struct vif_acl *acl;

   fprintf(fp, "                       boundaries: %-18s\n",
    inet_fmts(v->uv_acl->acl_addr, v->uv_acl->acl_mask, s1));
   for (acl = v->uv_acl->acl_next; acl != NULL((void *)0); acl = acl->acl_next) {
fprintf(fp, "                                 : %-18s\n",
	inet_fmts(acl->acl_addr, acl->acl_mask, s1));
   }
}
v_req.vifi = vifi;
if (ioctl(udp_socket, SIOCGETVIFCNT(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct sioc_vif_req) & 0x1fff) << 16) | ((('u')) <<
 8) | ((51))), (char *)&v_req) == -1) {
   logit(LOG_WARNING4, 0,
"SIOCGETVIFCNT fails");
}
else {
   fprintf(fp, "                         pkts in : %ld\n",
    v_req.icount);
   fprintf(fp, "                         pkts out: %ld\n",
    v_req.ocount);
}
fprintf(fp, "\n");
  }
  fprintf(fp, "\n");
1348}

1350/*
* Time out record of a group membership on a vif
*/
1353static void
1354DelVif(void *arg)
1355{
  cbk_t *cbk = (cbk_t *)arg;
  vifi_t vifi = cbk->vifi;
  struct uvif *v = &uvifs[vifi];
  struct listaddr *a, **anp, *g = cbk->g;

  /*
   * Group has expired
   * delete all kernel cache entries with this group
   */
  if (g->al_query)
DeleteTimer(g->al_query);

  delete_lclgrp(vifi, g->al_addr);

  anp = &(v->uv_groups);
  while ((a = *anp) != NULL((void *)0)) {
if (a == g) {
   *anp = a->al_next;
   free((char *)a);
} else {
   anp = &a->al_next;
}
  }

  free(cbk);
1381}

1383/*
* Set a timer to delete the record of a group membership on a vif.
*/
1386static int
1387SetTimer(int vifi, struct listaddr *g)
1388{
  cbk_t *cbk;

  cbk = malloc(sizeof(cbk_t));
  cbk->g = g;
  cbk->vifi = vifi;
  return timer_setTimer(g->al_timer, (cfunc_t)DelVif, (void *)cbk);
1395}

1397/*
* Delete a timer that was set above.
*/
1400static int
1401DeleteTimer(int id)
1402{
  timer_clearTimer(id);
  return 0;
1405}

1407/*
* Send a group-specific query.
*/
1410static void
1411SendQuery(void *arg)
1412{
  cbk_t *cbk = (cbk_t *)arg;
  struct uvif *v = &uvifs[cbk->vifi];

  send_igmp(v->uv_lcl_addr, cbk->g->al_addr,
     IGMP_HOST_MEMBERSHIP_QUERY0x11,
     cbk->q_time, cbk->g->al_addr, 0);
  cbk->g->al_query = 0;
  free(cbk);
1421}

1423/*
* Set a timer to send a group-specific query.
*/
1426static int
1427SetQueryTimer(struct listaddr *g, vifi_t vifi, int to_expire, int q_time)
1428{
  cbk_t *cbk;

  cbk = malloc(sizeof(cbk_t));
  cbk->g = g;
  cbk->q_time = q_time;
  cbk->vifi = vifi;
  return timer_setTimer(to_expire, (cfunc_t)SendQuery, (void *)cbk);
1436}