4 files changed, 19 insertions, 29 deletions

diff --git a/sys/netinet/ip_fastfwd.c b/sys/netinet/ip_fastfwd.c
index 0381d5f2d75c..383436f3df69 100644
--- a/sys/netinet/ip_fastfwd.c
+++ b/sys/netinet/ip_fastfwd.c
@@ -137,7 +137,7 @@ ip_findroute(struct route *ro, struct in_addr dest, struct mbuf *m)
 		ipstat.ips_cantforward++;
 		if (rt)
 			RTFREE(rt);
-		icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_HOST, 0, NULL);
+		icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_HOST, 0, 0);
 		return NULL;
 	}
 	return dst;
@@ -297,7 +297,7 @@ ip_fastforward(struct mbuf *m)
 			return 0;
 		else if (ip_doopts == 2) {
 			icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_FILTER_PROHIB,
-				0, NULL);
+				0, 0);
 			return 1;
 		}
 		/* else ignore IP options and continue */
@@ -407,7 +407,7 @@ passin:
 	if (!ipstealth) {
 #endif
 	if (ip->ip_ttl <= IPTTLDEC) {
-		icmp_error(m, ICMP_TIMXCEED, ICMP_TIMXCEED_INTRANS, 0, NULL);
+		icmp_error(m, ICMP_TIMXCEED, ICMP_TIMXCEED_INTRANS, 0, 0);
 		return 1;
 	}
 
@@ -512,7 +512,7 @@ passout:
 	 */
 	if ((ro.ro_rt->rt_flags & RTF_REJECT) &&
 	    ro.ro_rt->rt_rmx.rmx_expire >= time_second) {
-		icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_HOST, 0, NULL);
+		icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_HOST, 0, 0);
 		goto consumed;
 	}
 
@@ -532,7 +532,7 @@ passout:
 	 * Check if media link state of interface is not down
 	 */
 	if (ifp->if_link_state == LINK_STATE_DOWN) {
-		icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_HOST, 0, NULL);
+		icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_HOST, 0, 0);
 		goto consumed;
 	}
 
@@ -563,7 +563,7 @@ passout:
 		if (ip->ip_off & IP_DF) {
 			ipstat.ips_cantfrag++;
 			icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_NEEDFRAG,
-				0, ifp);
+				0, mtu);
 			goto consumed;
 		} else {
 			/*
diff --git a/sys/netinet/ip_icmp.c b/sys/netinet/ip_icmp.c
index c57b6845cf41..603588fe2b92 100644
--- a/sys/netinet/ip_icmp.c
+++ b/sys/netinet/ip_icmp.c
@@ -133,11 +133,11 @@ extern	struct protosw inetsw[];
  * in response to bad packet ip.
  */
 void
-icmp_error(n, type, code, dest, destifp)
+icmp_error(n, type, code, dest, mtu)
 	struct mbuf *n;
 	int type, code;
 	n_long dest;
-	struct ifnet *destifp;
+	int mtu;
 {
 	register struct ip *oip = mtod(n, struct ip *), *nip;
 	register unsigned oiplen = oip->ip_hl << 2;
@@ -201,8 +201,8 @@ icmp_error(n, type, code, dest, destifp)
 			icp->icmp_pptr = code;
 			code = 0;
 		} else if (type == ICMP_UNREACH &&
-			code == ICMP_UNREACH_NEEDFRAG && destifp) {
-			icp->icmp_nextmtu = htons(destifp->if_mtu);
+			code == ICMP_UNREACH_NEEDFRAG && mtu) {
+			icp->icmp_nextmtu = htons(mtu);
 		}
 	}
 
diff --git a/sys/netinet/ip_icmp.h b/sys/netinet/ip_icmp.h
index 020dd9641915..e212083cc5d8 100644
--- a/sys/netinet/ip_icmp.h
+++ b/sys/netinet/ip_icmp.h
@@ -202,7 +202,7 @@ struct icmp {
 	(type) == ICMP_MASKREQ || (type) == ICMP_MASKREPLY)
 
 #ifdef _KERNEL
-void	icmp_error(struct mbuf *, int, int, n_long, struct ifnet *);
+void	icmp_error(struct mbuf *, int, int, n_long, int);
 void	icmp_input(struct mbuf *, int);
 int	ip_next_mtu(int, int);
 #endif
diff --git a/sys/netinet/ip_input.c b/sys/netinet/ip_input.c
index 712d993e6570..c73aaaa2bf10 100644
--- a/sys/netinet/ip_input.c
+++ b/sys/netinet/ip_input.c
@@ -1714,10 +1714,9 @@ ip_forward(struct mbuf *m, int srcrt)
 {
 	struct ip *ip = mtod(m, struct ip *);
 	struct in_ifaddr *ia = NULL;
-	int error, type = 0, code = 0;
 	struct mbuf *mcopy;
 	struct in_addr dest;
-	struct ifnet *destifp, dummyifp;
+	int error, type = 0, code = 0, mtu = 0;
 
 #ifdef DIAGNOSTIC
 	if (ipprintfs)
@@ -1853,7 +1852,6 @@ ip_forward(struct mbuf *m, int srcrt)
 	}
 	if (mcopy == NULL)
 		return;
-	destifp = NULL;
 
 	switch (error) {
 
@@ -1906,24 +1904,17 @@ ip_forward(struct mbuf *m, int srcrt)
 				/*
 				 * find the correct route for outer IPv4
 				 * header, compute tunnel MTU.
-				 *
-				 * XXX BUG ALERT
-				 * The "dummyifp" code relies upon the fact
-				 * that icmp_error() touches only ifp->if_mtu.
 				 */
-				/*XXX*/
-				destifp = NULL;
 				if (sp->req != NULL
 				 && sp->req->sav != NULL
 				 && sp->req->sav->sah != NULL) {
 					ro = &sp->req->sav->sah->sa_route;
 					if (ro->ro_rt && ro->ro_rt->rt_ifp) {
-						dummyifp.if_mtu =
+						mtu =
 						    ro->ro_rt->rt_rmx.rmx_mtu ?
 						    ro->ro_rt->rt_rmx.rmx_mtu :
 						    ro->ro_rt->rt_ifp->if_mtu;
-						dummyifp.if_mtu -= ipsechdr;
-						destifp = &dummyifp;
+						mtu -= ipsechdr;
 					}
 				}
 
@@ -1941,11 +1932,10 @@ ip_forward(struct mbuf *m, int srcrt)
 		 * to the minimum guaranteed routeable packet size and use
 		 * the same hack as IPSEC to setup a dummyifp for icmp.
 		 */
-		if (ia == NULL) {
-			dummyifp.if_mtu = IP_MSS;
-			destifp = &dummyifp;
-		} else
-			destifp = ia->ia_ifp;
+		if (ia == NULL)
+			mtu = IP_MSS;
+		else
+			mtu = ia->ia_ifp->if_mtu;
 #if defined(IPSEC) || defined(FAST_IPSEC)
 		}
 #endif /*IPSEC || FAST_IPSEC*/
@@ -1974,7 +1964,7 @@ ip_forward(struct mbuf *m, int srcrt)
 		m_freem(mcopy);
 		return;
 	}
-	icmp_error(mcopy, type, code, dest.s_addr, destifp);
+	icmp_error(mcopy, type, code, dest.s_addr, mtu);
 }
 
 void