*** sys/netinet/ip_output.c.dist	Sun Oct  3 19:04:40 2004
--- sys/netinet/ip_output.c	Sat Oct 30 20:56:40 2004
***************
*** 405,410 ****
--- 405,477 ----
  	}
  
  sendit:
+ 
+ 	/* Jump over all PFIL processing if hooks are not active. */
+ 	if (inet_pfil_hook.ph_busy_count == -1)
+ 		goto passout;
+ 
+ 	/* Run through list of hooks for output packets. */
+ 	odst.s_addr = ip->ip_dst.s_addr;
+ 	error = pfil_run_hooks(&inet_pfil_hook, &m, ifp, PFIL_OUT, inp);
+ 	if (error != 0 || m == NULL)
+ 		goto done;
+ 
+ 	ip = mtod(m, struct ip *);
+ 
+ 	/* See if destination IP address was changed by packet filter. */
+ 	if (odst.s_addr != ip->ip_dst.s_addr) {
+ 		m->m_flags |= M_SKIP_FIREWALL;
+ 		if (in_localip(ip->ip_dst)) {
+ 			m->m_flags |= M_FASTFWD_OURS;
+ 			if (m->m_pkthdr.rcvif == NULL)
+ 				m->m_pkthdr.rcvif = loif;
+ 			if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
+ 				m->m_pkthdr.csum_flags |=
+ 				    CSUM_DATA_VALID | CSUM_PSEUDO_HDR;
+ 				m->m_pkthdr.csum_data = 0xffff;
+ 			}
+ 			m->m_pkthdr.csum_flags |=
+ 			    CSUM_IP_CHECKED | CSUM_IP_VALID;
+ 
+ 			error = netisr_queue(NETISR_IP, m);
+ 			goto done;
+ 		} else
+ 			goto again;
+ 	}
+ 
+ #ifdef IPFIREWALL_FORWARD
+ 	/* See if local, if yes, send it to netisr with IP_FASTFWD_OURS. */
+ 	if (m->m_flags & M_FASTFWD_OURS) {
+ 		if (m->m_pkthdr.rcvif == NULL)
+ 			m->m_pkthdr.rcvif = loif;
+ 		if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
+ 			m->m_pkthdr.csum_flags |=
+ 			    CSUM_DATA_VALID | CSUM_PSEUDO_HDR;
+ 			m->m_pkthdr.csum_data = 0xffff;
+ 		}
+ 		m->m_pkthdr.csum_flags |=
+ 			    CSUM_IP_CHECKED | CSUM_IP_VALID;
+ 
+ 		error = netisr_queue(NETISR_IP, m);
+ 		goto done;
+ 	}
+ 	/* Or forward to some other address? */
+ 	fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL);
+ 	if (fwd_tag) {
+ 		if (!in_localip(ip->ip_src) && !in_localaddr(ip->ip_dst)) {
+ 			dst = (struct sockaddr_in *)&ro->ro_dst;
+ 			bcopy((fwd_tag+1), dst, sizeof(struct sockaddr_in));
+ 			m->m_flags |= M_SKIP_FIREWALL;
+ 			m_tag_delete(m, fwd_tag);
+ 			goto again;
+ 		} else {
+ 			m_tag_delete(m, fwd_tag);
+ 			/* Continue. */
+ 		}
+ 	}
+ #endif
+ passout:
+ 
  #ifdef IPSEC
  	/* get SP for this packet */
  	if (inp == NULL)
***************
*** 654,725 ****
  spd_done:
  #endif /* FAST_IPSEC */
  
- 	/* Jump over all PFIL processing if hooks are not active. */
- 	if (inet_pfil_hook.ph_busy_count == -1)
- 		goto passout;
- 
- 	/* Run through list of hooks for output packets. */
- 	odst.s_addr = ip->ip_dst.s_addr;
- 	error = pfil_run_hooks(&inet_pfil_hook, &m, ifp, PFIL_OUT, inp);
- 	if (error != 0 || m == NULL)
- 		goto done;
- 
- 	ip = mtod(m, struct ip *);
- 
- 	/* See if destination IP address was changed by packet filter. */
- 	if (odst.s_addr != ip->ip_dst.s_addr) {
- 		m->m_flags |= M_SKIP_FIREWALL;
- 		if (in_localip(ip->ip_dst)) {
- 			m->m_flags |= M_FASTFWD_OURS;
- 			if (m->m_pkthdr.rcvif == NULL)
- 				m->m_pkthdr.rcvif = loif;
- 			if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
- 				m->m_pkthdr.csum_flags |=
- 				    CSUM_DATA_VALID | CSUM_PSEUDO_HDR;
- 				m->m_pkthdr.csum_data = 0xffff;
- 			}
- 			m->m_pkthdr.csum_flags |=
- 			    CSUM_IP_CHECKED | CSUM_IP_VALID;
- 
- 			error = netisr_queue(NETISR_IP, m);
- 			goto done;
- 		} else
- 			goto again;
- 	}
- 
- #ifdef IPFIREWALL_FORWARD
- 	/* See if local, if yes, send it to netisr with IP_FASTFWD_OURS. */
- 	if (m->m_flags & M_FASTFWD_OURS) {
- 		if (m->m_pkthdr.rcvif == NULL)
- 			m->m_pkthdr.rcvif = loif;
- 		if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
- 			m->m_pkthdr.csum_flags |=
- 			    CSUM_DATA_VALID | CSUM_PSEUDO_HDR;
- 			m->m_pkthdr.csum_data = 0xffff;
- 		}
- 		m->m_pkthdr.csum_flags |=
- 			    CSUM_IP_CHECKED | CSUM_IP_VALID;
- 
- 		error = netisr_queue(NETISR_IP, m);
- 		goto done;
- 	}
- 	/* Or forward to some other address? */
- 	fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL);
- 	if (fwd_tag) {
- 		if (!in_localip(ip->ip_src) && !in_localaddr(ip->ip_dst)) {
- 			dst = (struct sockaddr_in *)&ro->ro_dst;
- 			bcopy((fwd_tag+1), dst, sizeof(struct sockaddr_in));
- 			m->m_flags |= M_SKIP_FIREWALL;
- 			m_tag_delete(m, fwd_tag);
- 			goto again;
- 		} else {
- 			m_tag_delete(m, fwd_tag);
- 			/* Continue. */
- 		}
- 	}
- #endif
- 
- passout:
  	/* 127/8 must not appear on wire - RFC1122. */
  	if ((ntohl(ip->ip_dst.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET ||
  	    (ntohl(ip->ip_src.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET) {
--- 721,726 ----