Change the IPv4 pr_input function to the way IPv6 is implemented,

to get rid of struct ip6protosw and some wrapper functions.  It is
more consistent to have less different structures.  The divert_input
functions cannot be called anyway, so remove them.
OK visa@ mpi@

22 files changed, 197 insertions, 275 deletions

diff --git a/sys/netinet/igmp.c b/sys/netinet/igmp.c
index 5e4d2a26bd3..ea76ca0b39f 100644
--- a/sys/netinet/igmp.c
+++ b/sys/netinet/igmp.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: igmp.c,v 1.61 2017/01/25 17:34:31 bluhm Exp $	*/
+/*	$OpenBSD: igmp.c,v 1.62 2017/01/29 19:58:47 bluhm Exp $	*/
 /*	$NetBSD: igmp.c,v 1.15 1996/02/13 23:41:25 christos Exp $	*/
 
 /*
@@ -107,7 +107,7 @@ void igmp_checktimer(struct ifnet *);
 void igmp_sendpkt(struct ifnet *, struct in_multi *, int, in_addr_t);
 int rti_fill(struct in_multi *);
 struct router_info * rti_find(struct ifnet *);
-void igmp_input_if(struct ifnet *, struct mbuf *, int, int);
+int igmp_input_if(struct ifnet *, struct mbuf **, int *, int);
 int igmp_sysctl_igmpstat(void *, size_t *, void *);
 
 void
@@ -208,26 +208,29 @@ rti_delete(struct ifnet *ifp)
 	}
 }
 
-void
-igmp_input(struct mbuf *m, int iphlen, int proto)
+int
+igmp_input(struct mbuf **mp, int *offp, int proto)
 {
 	struct ifnet *ifp;
 
 	igmpstat_inc(igps_rcv_total);
 
-	ifp = if_get(m->m_pkthdr.ph_ifidx);
+	ifp = if_get((*mp)->m_pkthdr.ph_ifidx);
 	if (ifp == NULL) {
-		m_freem(m);
-		return;
+		m_freem(*mp);
+		return IPPROTO_DONE;
 	}
 
-	igmp_input_if(ifp, m, iphlen, proto);
+	proto = igmp_input_if(ifp, mp, offp, proto);
 	if_put(ifp);
+	return proto;
 }
 
-void
-igmp_input_if(struct ifnet *ifp, struct mbuf *m, int iphlen, int proto)
+int
+igmp_input_if(struct ifnet *ifp, struct mbuf **mp, int *offp, int proto)
 {
+	struct mbuf *m = *mp;
+	int iphlen = *offp;
 	struct ip *ip = mtod(m, struct ip *);
 	struct igmp *igmp;
 	int igmplen;
@@ -246,13 +249,13 @@ igmp_input_if(struct ifnet *ifp, struct mbuf *m, int iphlen, int proto)
 	if (igmplen < IGMP_MINLEN) {
 		igmpstat_inc(igps_rcv_tooshort);
 		m_freem(m);
-		return;
+		return IPPROTO_DONE;
 	}
 	minlen = iphlen + IGMP_MINLEN;
 	if ((m->m_flags & M_EXT || m->m_len < minlen) &&
 	    (m = m_pullup(m, minlen)) == NULL) {
 		igmpstat_inc(igps_rcv_tooshort);
-		return;
+		return IPPROTO_DONE;
 	}
 
 	/*
@@ -264,7 +267,7 @@ igmp_input_if(struct ifnet *ifp, struct mbuf *m, int iphlen, int proto)
 	if (in_cksum(m, igmplen)) {
 		igmpstat_inc(igps_rcv_badsum);
 		m_freem(m);
-		return;
+		return IPPROTO_DONE;
 	}
 	m->m_data -= iphlen;
 	m->m_len += iphlen;
@@ -282,7 +285,7 @@ igmp_input_if(struct ifnet *ifp, struct mbuf *m, int iphlen, int proto)
 			rti = rti_find(ifp);
 			if (rti == NULL) {
 				m_freem(m);
-				return;
+				return IPPROTO_DONE;
 			}
 			rti->rti_type = IGMP_v1_ROUTER;
 			rti->rti_age = 0;
@@ -290,7 +293,7 @@ igmp_input_if(struct ifnet *ifp, struct mbuf *m, int iphlen, int proto)
 			if (ip->ip_dst.s_addr != INADDR_ALLHOSTS_GROUP) {
 				igmpstat_inc(igps_rcv_badqueries);
 				m_freem(m);
-				return;
+				return IPPROTO_DONE;
 			}
 
 			/*
@@ -315,7 +318,7 @@ igmp_input_if(struct ifnet *ifp, struct mbuf *m, int iphlen, int proto)
 			if (!IN_MULTICAST(ip->ip_dst.s_addr)) {
 				igmpstat_inc(igps_rcv_badqueries);
 				m_freem(m);
-				return;
+				return IPPROTO_DONE;
 			}
 
 			timer = igmp->igmp_code * PR_FASTHZ / IGMP_TIMER_SCALE;
@@ -372,7 +375,7 @@ igmp_input_if(struct ifnet *ifp, struct mbuf *m, int iphlen, int proto)
 		    igmp->igmp_group.s_addr != ip->ip_dst.s_addr) {
 			igmpstat_inc(igps_rcv_badreports);
 			m_freem(m);
-			return;
+			return IPPROTO_DONE;
 		}
 
 		/*
@@ -438,7 +441,7 @@ igmp_input_if(struct ifnet *ifp, struct mbuf *m, int iphlen, int proto)
 		    igmp->igmp_group.s_addr != ip->ip_dst.s_addr) {
 			igmpstat_inc(igps_rcv_badreports);
 			m_freem(m);
-			return;
+			return IPPROTO_DONE;
 		}
 
 		/*
@@ -487,7 +490,7 @@ igmp_input_if(struct ifnet *ifp, struct mbuf *m, int iphlen, int proto)
 	 * Pass all valid IGMP packets up to any process(es) listening
 	 * on a raw IGMP socket.
 	 */
-	rip_input(m, iphlen, proto);
+	return rip_input(mp, offp, proto);
 }
 
 void
diff --git a/sys/netinet/igmp_var.h b/sys/netinet/igmp_var.h
index 33e32b180b9..4aeaebc5f9e 100644
--- a/sys/netinet/igmp_var.h
+++ b/sys/netinet/igmp_var.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: igmp_var.h,v 1.11 2017/01/25 17:34:31 bluhm Exp $	*/
+/*	$OpenBSD: igmp_var.h,v 1.12 2017/01/29 19:58:47 bluhm Exp $	*/
 /*	$NetBSD: igmp_var.h,v 1.9 1996/02/13 23:41:31 christos Exp $	*/
 
 /*
@@ -110,7 +110,7 @@ igmpstat_inc(enum igmpstat_counters c)
 #define	IGMP_RANDOM_DELAY(X)	(arc4random_uniform(X) + 1)
 
 void	igmp_init(void);
-void	igmp_input(struct mbuf *, int, int);
+int	igmp_input(struct mbuf **, int *, int);
 void	igmp_joingroup(struct in_multi *);
 void	igmp_leavegroup(struct in_multi *);
 void	igmp_fasttimo(void);
diff --git a/sys/netinet/in_proto.c b/sys/netinet/in_proto.c
index ea67e5cb113..4d124afdc36 100644
--- a/sys/netinet/in_proto.c
+++ b/sys/netinet/in_proto.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: in_proto.c,v 1.71 2016/12/22 11:04:44 rzalamena Exp $	*/
+/*	$OpenBSD: in_proto.c,v 1.72 2017/01/29 19:58:47 bluhm Exp $	*/
 /*	$NetBSD: in_proto.c,v 1.14 1996/02/18 18:58:32 christos Exp $	*/
 
 /*
@@ -289,7 +289,7 @@ struct protosw inetsw[] = {
 #endif /* NPFSYNC > 0 */
 #if NPF > 0
 { SOCK_RAW,	&inetdomain,	IPPROTO_DIVERT,	PR_ATOMIC|PR_ADDR,
-  divert_input,	0,		0,		rip_ctloutput,
+  0,		0,		0,		rip_ctloutput,
   divert_usrreq,
   divert_init,	0,		0,		0,		divert_sysctl
 },
diff --git a/sys/netinet/ip_carp.c b/sys/netinet/ip_carp.c
index dc28054a35a..fe96a4519ee 100644
--- a/sys/netinet/ip_carp.c
+++ b/sys/netinet/ip_carp.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ip_carp.c,v 1.300 2017/01/25 17:34:31 bluhm Exp $	*/
+/*	$OpenBSD: ip_carp.c,v 1.301 2017/01/29 19:58:47 bluhm Exp $	*/
 
 /*
  * Copyright (c) 2002 Michael Shalayeff. All rights reserved.
@@ -214,7 +214,10 @@ int	carp_hmac_verify(struct carp_vhost_entry *, u_int32_t *,
 int	carp_input(struct ifnet *, struct mbuf *, void *);
 void	carp_proto_input_c(struct ifnet *, struct mbuf *,
 	    struct carp_header *, int, sa_family_t);
-void	carp_proto_input_if(struct ifnet *, struct mbuf *, int);
+int	carp_proto_input_if(struct ifnet *, struct mbuf **, int *, int);
+#ifdef INET6
+int	carp6_proto_input_if(struct ifnet *, struct mbuf **, int *, int);
+#endif
 void	carpattach(int);
 void	carpdetach(struct carp_softc *);
 int	carp_prepare_ad(struct mbuf *, struct carp_vhost_entry *,
@@ -411,19 +414,20 @@ carp_hmac_verify(struct carp_vhost_entry *vhe, u_int32_t counter[2],
 	return (1);
 }
 
-void
-carp_proto_input(struct mbuf *m, int hlen, int proto)
+int
+carp_proto_input(struct mbuf **mp, int *offp, int proto)
 {
 	struct ifnet *ifp;
 
-	ifp = if_get(m->m_pkthdr.ph_ifidx);
+	ifp = if_get((*mp)->m_pkthdr.ph_ifidx);
 	if (ifp == NULL) {
-		m_freem(m);
-		return;
+		m_freem(*mp);
+		return IPPROTO_DONE;
 	}
 
-	carp_proto_input_if(ifp, m, hlen);
+	proto = carp_proto_input_if(ifp, mp, offp, proto);
 	if_put(ifp);
+	return proto;
 }
 
 /*
@@ -431,9 +435,10 @@ carp_proto_input(struct mbuf *m, int hlen, int proto)
  * we have rearranged checks order compared to the rfc,
  * but it seems more efficient this way or not possible otherwise.
  */
-void
-carp_proto_input_if(struct ifnet *ifp, struct mbuf *m, int hlen)
+int
+carp_proto_input_if(struct ifnet *ifp, struct mbuf **mp, int *offp, int proto)
 {
+	struct mbuf *m = *mp;
 	struct ip *ip = mtod(m, struct ip *);
 	struct carp_softc *sc = NULL;
 	struct carp_header *ch;
@@ -443,7 +448,7 @@ carp_proto_input_if(struct ifnet *ifp, struct mbuf *m, int hlen)
 
 	if (!carp_opts[CARPCTL_ALLOW]) {
 		m_freem(m);
-		return;
+		return IPPROTO_DONE;
 	}
 
 	ismulti = IN_MULTICAST(ip->ip_dst.s_addr);
@@ -456,7 +461,7 @@ carp_proto_input_if(struct ifnet *ifp, struct mbuf *m, int hlen)
 		    ("packet received on non-carp interface: %s",
 		     ifp->if_xname));
 		m_freem(m);
-		return;
+		return IPPROTO_DONE;
 	}
 
 	/* verify that the IP TTL is 255.  */
@@ -465,7 +470,7 @@ carp_proto_input_if(struct ifnet *ifp, struct mbuf *m, int hlen)
 		CARP_LOG(LOG_NOTICE, sc, ("received ttl %d != %d on %s",
 		    ip->ip_ttl, CARP_DFLTTL, ifp->if_xname));
 		m_freem(m);
-		return;
+		return IPPROTO_DONE;
 	}
 
 	/*
@@ -479,12 +484,12 @@ carp_proto_input_if(struct ifnet *ifp, struct mbuf *m, int hlen)
 		CARP_LOG(LOG_INFO, sc, ("packet too short %d on %s",
 		    m->m_pkthdr.len, ifp->if_xname));
 		m_freem(m);
-		return;
+		return IPPROTO_DONE;
 	}
 
 	if ((m = m_pullup(m, len)) == NULL) {
 		carpstats.carps_hdrops++;
-		return;
+		return IPPROTO_DONE;
 	}
 	ip = mtod(m, struct ip *);
 	ch = (struct carp_header *)(mtod(m, caddr_t) + iplen);
@@ -496,38 +501,35 @@ carp_proto_input_if(struct ifnet *ifp, struct mbuf *m, int hlen)
 		CARP_LOG(LOG_INFO, sc, ("checksum failed on %s",
 		    ifp->if_xname));
 		m_freem(m);
-		return;
+		return IPPROTO_DONE;
 	}
 	m->m_data -= iplen;
 
 	carp_proto_input_c(ifp, m, ch, ismulti, AF_INET);
+	return IPPROTO_DONE;
 }
 
 #ifdef INET6
-int	carp6_proto_input_if(struct ifnet *, struct mbuf *, int *);
-
 int
 carp6_proto_input(struct mbuf **mp, int *offp, int proto)
 {
-	struct mbuf *m = *mp;
 	struct ifnet *ifp;
-	int rv;
 
-	ifp = if_get(m->m_pkthdr.ph_ifidx);
+	ifp = if_get((*mp)->m_pkthdr.ph_ifidx);
 	if (ifp == NULL) {
-		m_freem(m);
-		return (IPPROTO_DONE);
+		m_freem(*mp);
+		return IPPROTO_DONE;
 	}
 
-	rv = carp6_proto_input_if(ifp, m, offp);
+	proto = carp6_proto_input_if(ifp, mp, offp, proto);
 	if_put(ifp);
-
-	return (rv);
+	return proto;
 }
 
 int
-carp6_proto_input_if(struct ifnet *ifp, struct mbuf *m, int *offp)
+carp6_proto_input_if(struct ifnet *ifp, struct mbuf **mp, int *offp, int proto)
 {
+	struct mbuf *m = *mp;
 	struct carp_softc *sc = NULL;
 	struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
 	struct carp_header *ch;
@@ -537,7 +539,7 @@ carp6_proto_input_if(struct ifnet *ifp, struct mbuf *m, int *offp)
 
 	if (!carp_opts[CARPCTL_ALLOW]) {
 		m_freem(m);
-		return (IPPROTO_DONE);
+		return IPPROTO_DONE;
 	}
 
 	/* check if received on a valid carp interface */
@@ -546,7 +548,7 @@ carp6_proto_input_if(struct ifnet *ifp, struct mbuf *m, int *offp)
 		CARP_LOG(LOG_INFO, sc, ("packet received on non-carp interface: %s",
 		    ifp->if_xname));
 		m_freem(m);
-		return (IPPROTO_DONE);
+		return IPPROTO_DONE;
 	}
 
 	/* verify that the IP TTL is 255 */
@@ -555,7 +557,7 @@ carp6_proto_input_if(struct ifnet *ifp, struct mbuf *m, int *offp)
 		CARP_LOG(LOG_NOTICE, sc, ("received ttl %d != %d on %s",
 		    ip6->ip6_hlim, CARP_DFLTTL, ifp->if_xname));
 		m_freem(m);
-		return (IPPROTO_DONE);
+		return IPPROTO_DONE;
 	}
 
 	/* verify that we have a complete carp packet */
@@ -563,7 +565,7 @@ carp6_proto_input_if(struct ifnet *ifp, struct mbuf *m, int *offp)
 	if ((m = m_pullup(m, *offp + sizeof(*ch))) == NULL) {
 		carpstats.carps_badlen++;
 		CARP_LOG(LOG_INFO, sc, ("packet size %u too small", len));
-		return (IPPROTO_DONE);
+		return IPPROTO_DONE;
 	}
 	ch = (struct carp_header *)(mtod(m, caddr_t) + *offp);
 
@@ -574,12 +576,12 @@ carp6_proto_input_if(struct ifnet *ifp, struct mbuf *m, int *offp)
 		CARP_LOG(LOG_INFO, sc, ("checksum failed, on %s",
 		    ifp->if_xname));
 		m_freem(m);
-		return (IPPROTO_DONE);
+		return IPPROTO_DONE;
 	}
 	m->m_data -= *offp;
 
 	carp_proto_input_c(ifp, m, ch, 1, AF_INET6);
-	return (IPPROTO_DONE);
+	return IPPROTO_DONE;
 }
 #endif /* INET6 */
 
diff --git a/sys/netinet/ip_carp.h b/sys/netinet/ip_carp.h
index 8ec1979135a..dc68fbaf732 100644
--- a/sys/netinet/ip_carp.h
+++ b/sys/netinet/ip_carp.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ip_carp.h,v 1.39 2017/01/25 17:34:31 bluhm Exp $	*/
+/*	$OpenBSD: ip_carp.h,v 1.40 2017/01/29 19:58:47 bluhm Exp $	*/
 
 /*
  * Copyright (c) 2002 Michael Shalayeff. All rights reserved.
@@ -163,7 +163,7 @@ struct carpreq {
 
 #ifdef _KERNEL
 void		 carp_ifdetach (struct ifnet *);
-void		 carp_proto_input (struct mbuf *, int, int);
+int		 carp_proto_input(struct mbuf **, int *, int);
 void		 carp_carpdev_state(void *);
 void		 carp_group_demote_adj(struct ifnet *, int, char *);
 int		 carp6_proto_input(struct mbuf **, int *, int);
diff --git a/sys/netinet/ip_divert.c b/sys/netinet/ip_divert.c
index 1bdf3bf75fa..327f4268acb 100644
--- a/sys/netinet/ip_divert.c
+++ b/sys/netinet/ip_divert.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: ip_divert.c,v 1.42 2017/01/25 17:34:31 bluhm Exp $ */
+/*      $OpenBSD: ip_divert.c,v 1.43 2017/01/29 19:58:47 bluhm Exp $ */
 
 /*
  * Copyright (c) 2009 Michele Marchetto <michele@openbsd.org>
@@ -71,12 +71,6 @@ divert_init(void)
 	in_pcbinit(&divbtable, divbhashsize);
 }
 
-void
-divert_input(struct mbuf *m, int iphlen, int proto)
-{
-	m_freem(m);
-}
-
 int
 divert_output(struct inpcb *inp, struct mbuf *m, struct mbuf *nam,
     struct mbuf *control)
diff --git a/sys/netinet/ip_ether.c b/sys/netinet/ip_ether.c
index 7ccfa42575b..d8213651e08 100644
--- a/sys/netinet/ip_ether.c
+++ b/sys/netinet/ip_ether.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ip_ether.c,v 1.82 2017/01/25 17:34:31 bluhm Exp $  */
+/*	$OpenBSD: ip_ether.c,v 1.83 2017/01/29 19:58:47 bluhm Exp $  */
 /*
  * The author of this code is Angelos D. Keromytis (kermit@adk.gr)
  *
@@ -86,51 +86,16 @@ struct etheripstat etheripstat;
 
 /*
  * etherip_input gets called when we receive an encapsulated packet.
- * Only a wrapper for the IPv4 case.
  */
-void
-etherip_input(struct mbuf *m, int iphlen, int proto)
-{
-	struct ip *ip;
-
-	ip = mtod(m, struct ip *);
-
-	switch (ip->ip_p) {
-#if NBRIDGE > 0
-	case IPPROTO_ETHERIP:
-		/* If we do not accept EtherIP explicitly, drop. */
-		if (!etherip_allow && (m->m_flags & (M_AUTH|M_CONF)) == 0) {
-			DPRINTF(("etherip_input(): dropped due to policy\n"));
-			etheripstat.etherip_pdrops++;
-			m_freem(m);
-			return;
-		}
-		etherip_decap(m, iphlen);
-		return;
-#endif
-#ifdef MPLS
-	case IPPROTO_MPLS:
-		mplsip_decap(m, iphlen);
-		return;
-#endif
-	default:
-		DPRINTF(("etherip_input(): dropped, unhandled protocol\n"));
-		etheripstat.etherip_pdrops++;
-		m_freem(m);
-		return;
-	}
-}
-
-#ifdef INET6
 int
-etherip_input6(struct mbuf **mp, int *offp, int proto)
+etherip_input(struct mbuf **mp, int *offp, int proto)
 {
 	switch (proto) {
 #if NBRIDGE > 0
 	case IPPROTO_ETHERIP:
 		/* If we do not accept EtherIP explicitly, drop. */
 		if (!etherip_allow && ((*mp)->m_flags & (M_AUTH|M_CONF)) == 0) {
-			DPRINTF(("etherip_input6(): dropped due to policy\n"));
+			DPRINTF(("etherip_input(): dropped due to policy\n"));
 			etheripstat.etherip_pdrops++;
 			m_freem(*mp);
 			return IPPROTO_DONE;
@@ -144,13 +109,12 @@ etherip_input6(struct mbuf **mp, int *offp, int proto)
 		return IPPROTO_DONE;
 #endif
 	default:
-		DPRINTF(("etherip_input6(): dropped, unhandled protocol\n"));
+		DPRINTF(("etherip_input(): dropped, unhandled protocol\n"));
 		etheripstat.etherip_pdrops++;
 		m_freem(*mp);
 		return IPPROTO_DONE;
 	}
 }
-#endif
 
 #if NBRIDGE > 0
 void
diff --git a/sys/netinet/ip_ether.h b/sys/netinet/ip_ether.h
index 4aa03c15f7c..89b244ee863 100644
--- a/sys/netinet/ip_ether.h
+++ b/sys/netinet/ip_ether.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ip_ether.h,v 1.19 2017/01/25 17:34:31 bluhm Exp $ */
+/*	$OpenBSD: ip_ether.h,v 1.20 2017/01/29 19:58:47 bluhm Exp $ */
 /*
  * The author of this code is Angelos D. Keromytis (angelos@adk.gr)
  *
@@ -72,10 +72,7 @@ struct etherip_header {
 struct tdb;
 
 int	etherip_output(struct mbuf *, struct tdb *, struct mbuf **, int);
-void	etherip_input(struct mbuf *, int, int);
-#ifdef INET6
-int	etherip_input6(struct mbuf **, int *, int);
-#endif
+int	etherip_input(struct mbuf **, int *, int);
 int	etherip_sysctl(int *, u_int, void *, size_t *, void *, size_t);
 
 extern int etherip_allow;
diff --git a/sys/netinet/ip_gre.c b/sys/netinet/ip_gre.c
index 4f480767882..9fed51128f6 100644
--- a/sys/netinet/ip_gre.c
+++ b/sys/netinet/ip_gre.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: ip_gre.c,v 1.61 2017/01/25 17:34:31 bluhm Exp $ */
+/*      $OpenBSD: ip_gre.c,v 1.62 2017/01/29 19:58:47 bluhm Exp $ */
 /*	$NetBSD: ip_gre.c,v 1.9 1999/10/25 19:18:11 drochner Exp $ */
 
 /*
@@ -215,14 +215,16 @@ gre_input2(struct mbuf *m, int hlen, int proto)
  * routine is called whenever IP gets a packet with proto type
  * IPPROTO_GRE and a local destination address).
  */
-void
-gre_input(struct mbuf *m, int hlen, int proto)
+int
+gre_input(struct mbuf **mp, int *offp, int proto)
 {
+	struct mbuf *m = *mp;
+	int hlen = *offp;
 	int ret;
 
 	if (!gre_allow) {
 	        m_freem(m);
-		return;
+		return IPPROTO_DONE;
 	}
 
 #ifdef PIPEX
@@ -231,7 +233,7 @@ gre_input(struct mbuf *m, int hlen, int proto)
 
 		if ((session = pipex_pptp_lookup_session(m)) != NULL) {
 			if (pipex_pptp_input(m, session) == NULL)
-				return;
+				return IPPROTO_DONE;
 		}
 	}
 #endif
@@ -245,7 +247,8 @@ gre_input(struct mbuf *m, int hlen, int proto)
 	 * but we're not set to accept them.
 	 */
 	if (!ret)
-		rip_input(m, hlen, proto);
+		return rip_input(mp, offp, proto);
+	return IPPROTO_DONE;
 }
 
 /*
@@ -255,9 +258,10 @@ gre_input(struct mbuf *m, int hlen, int proto)
  * between IP header and payload.
  */
 
-void
-gre_mobile_input(struct mbuf *m, int hlen, int proto)
+int
+gre_mobile_input(struct mbuf **mp, int *offp, int proto)
 {
+	struct mbuf *m = *mp;
 	struct ip *ip;
 	struct mobip_h *mip;
 	struct gre_softc *sc;
@@ -266,19 +270,19 @@ gre_mobile_input(struct mbuf *m, int hlen, int proto)
 
 	if (!ip_mobile_allow) {
 	        m_freem(m);
-		return;
+		return IPPROTO_DONE;
 	}
 
 	if ((sc = gre_lookup(m, proto)) == NULL) {
 		/* No matching tunnel or tunnel is down. */
 		m_freem(m);
-		return;
+		return IPPROTO_DONE;
 	}
 
 	if (m->m_len < sizeof(*mip)) {
 		m = m_pullup(m, sizeof(*mip));
 		if (m == NULL)
-			return;
+			return IPPROTO_DONE;
 	}
 	ip = mtod(m, struct ip *);
 	mip = mtod(m, struct mobip_h *);
@@ -298,7 +302,7 @@ gre_mobile_input(struct mbuf *m, int hlen, int proto)
 	if (m->m_len < (ip->ip_hl << 2) + msiz) {
 		m = m_pullup(m, (ip->ip_hl << 2) + msiz);
 		if (m == NULL)
-			return;
+			return IPPROTO_DONE;
 		ip = mtod(m, struct ip *);
 		mip = mtod(m, struct mobip_h *);
 	}
@@ -308,7 +312,7 @@ gre_mobile_input(struct mbuf *m, int hlen, int proto)
 
 	if (gre_in_cksum((u_short *) &mip->mh, msiz) != 0) {
 		m_freem(m);
-		return;
+		return IPPROTO_DONE;
 	}
 
 	memmove(ip + (ip->ip_hl << 2), ip + (ip->ip_hl << 2) + msiz, 
@@ -331,6 +335,7 @@ gre_mobile_input(struct mbuf *m, int hlen, int proto)
 #endif
 
 	niq_enqueue(&ipintrq, m);
+	return IPPROTO_DONE;
 }
 
 /*
diff --git a/sys/netinet/ip_gre.h b/sys/netinet/ip_gre.h
index c4394519c25..338764dfb84 100644
--- a/sys/netinet/ip_gre.h
+++ b/sys/netinet/ip_gre.h
@@ -1,4 +1,4 @@
-/*      $OpenBSD: ip_gre.h,v 1.10 2017/01/25 17:34:31 bluhm Exp $ */
+/*      $OpenBSD: ip_gre.h,v 1.11 2017/01/29 19:58:47 bluhm Exp $ */
 /*	$NetBSD: ip_gre.h,v 1.3 1998/10/07 23:33:02 thorpej Exp $ */
 
 /*
@@ -64,12 +64,10 @@
 }
 
 #ifdef _KERNEL
-void gre_input(struct mbuf *, int, int);
-void gre_mobile_input(struct mbuf *, int, int);
-
+int	gre_input(struct mbuf **, int *, int);
+int	gre_mobile_input(struct mbuf **, int *, int);
 int     ipmobile_sysctl(int *, u_int, void *, size_t *, void *, size_t);
 int     gre_sysctl(int *, u_int, void *, size_t *, void *, size_t);
 int     gre_usrreq(struct socket *, int, struct mbuf *, struct mbuf *, struct mbuf *, struct proc *);
-
 #endif /* _KERNEL */
 #endif /* _NETINET_IP_GRE_H_ */
diff --git a/sys/netinet/ip_icmp.c b/sys/netinet/ip_icmp.c
index b75ed391bb2..792195d9cc0 100644
--- a/sys/netinet/ip_icmp.c
+++ b/sys/netinet/ip_icmp.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ip_icmp.c,v 1.161 2017/01/26 13:03:47 bluhm Exp $	*/
+/*	$OpenBSD: ip_icmp.c,v 1.162 2017/01/29 19:58:47 bluhm Exp $	*/
 /*	$NetBSD: ip_icmp.c,v 1.19 1996/02/13 23:42:22 christos Exp $	*/
 
 /*
@@ -128,7 +128,7 @@ int *icmpctl_vars[ICMPCTL_MAXID] = ICMPCTL_VARS;
 void icmp_mtudisc_timeout(struct rtentry *, struct rttimer *);
 int icmp_ratelimit(const struct in_addr *, const int, const int);
 void icmp_redirect_timeout(struct rtentry *, struct rttimer *);
-void icmp_input_if(struct ifnet *, struct mbuf *, int, int);
+int icmp_input_if(struct ifnet *, struct mbuf **, int *, int);
 
 void
 icmp_init(void)
@@ -303,24 +303,27 @@ icmp_error(struct mbuf *n, int type, int code, u_int32_t dest, int destmtu)
 /*
  * Process a received ICMP message.
  */
-void
-icmp_input(struct mbuf *m, int hlen, int proto)
+int
+icmp_input(struct mbuf **mp, int *offp, int proto)
 {
 	struct ifnet *ifp;
 
-	ifp = if_get(m->m_pkthdr.ph_ifidx);
+	ifp = if_get((*mp)->m_pkthdr.ph_ifidx);
 	if (ifp == NULL) {
-		m_freem(m);
-		return;
+		m_freem(*mp);
+		return IPPROTO_DONE;
 	}
 
-	icmp_input_if(ifp, m, hlen, proto);
+	proto = icmp_input_if(ifp, mp, offp, proto);
 	if_put(ifp);
+	return proto;
 }
 
-void
-icmp_input_if(struct ifnet *ifp, struct mbuf *m, int hlen, int proto)
+int
+icmp_input_if(struct ifnet *ifp, struct mbuf **mp, int *offp, int proto)
 {
+	struct mbuf *m = *mp;
+	int hlen = *offp;
 	struct icmp *icp;
 	struct ip *ip = mtod(m, struct ip *);
 	struct sockaddr_in sin;
@@ -351,7 +354,7 @@ icmp_input_if(struct ifnet *ifp, struct mbuf *m, int hlen, int proto)
 	i = hlen + min(icmplen, ICMP_ADVLENMIN);
 	if (m->m_len < i && (m = m_pullup(m, i)) == NULL) {
 		icmpstat.icps_tooshort++;
-		return;
+		return IPPROTO_DONE;
 	}
 	ip = mtod(m, struct ip *);
 	if (in4_cksum(m, 0, hlen, icmplen)) {
@@ -474,7 +477,7 @@ icmp_input_if(struct ifnet *ifp, struct mbuf *m, int hlen, int proto)
 				if ((m = m_pullup(m, (ip->ip_hl << 2) +
 				    ICMP_V6ADVLEN(icp))) == NULL) {
 					icmpstat.icps_tooshort++;
-					return;
+					return IPPROTO_DONE;
 				}
 				ip = mtod(m, struct ip *);
 				icp = (struct icmp *)
@@ -588,7 +591,7 @@ reflect:
 		icmpstat.icps_outhist[icp->icmp_type]++;
 		if (!icmp_reflect(m, &opts, NULL))
 			icmp_send(m, opts);
-		return;
+		return IPPROTO_DONE;
 
 	case ICMP_REDIRECT:
 	{
@@ -680,11 +683,11 @@ reflect:
 	}
 
 raw:
-	rip_input(m, hlen, proto);
-	return;
+	return rip_input(mp, offp, proto);
 
 freeit:
 	m_freem(m);
+	return IPPROTO_DONE;
 }
 
 /*
diff --git a/sys/netinet/ip_icmp.h b/sys/netinet/ip_icmp.h
index 54fed25106f..04b02c33d18 100644
--- a/sys/netinet/ip_icmp.h
+++ b/sys/netinet/ip_icmp.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ip_icmp.h,v 1.28 2017/01/25 17:34:31 bluhm Exp $	*/
+/*	$OpenBSD: ip_icmp.h,v 1.29 2017/01/29 19:58:47 bluhm Exp $	*/
 /*	$NetBSD: ip_icmp.h,v 1.10 1996/02/13 23:42:28 christos Exp $	*/
 
 /*
@@ -232,7 +232,7 @@ struct icmp_ext_obj_hdr {
 struct mbuf *
 	icmp_do_error(struct mbuf *, int, int, u_int32_t, int);
 void	icmp_error(struct mbuf *, int, int, u_int32_t, int);
-void	icmp_input(struct mbuf *, int, int);
+int	icmp_input(struct mbuf **, int *, int);
 void	icmp_init(void);
 int	icmp_reflect(struct mbuf *, struct mbuf **, struct in_ifaddr *);
 void	icmp_send(struct mbuf *, struct mbuf *);
diff --git a/sys/netinet/ip_input.c b/sys/netinet/ip_input.c
index dbb9eed2566..07d6219c1aa 100644
--- a/sys/netinet/ip_input.c
+++ b/sys/netinet/ip_input.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ip_input.c,v 1.292 2017/01/25 17:34:31 bluhm Exp $	*/
+/*	$OpenBSD: ip_input.c,v 1.293 2017/01/29 19:58:47 bluhm Exp $	*/
 /*	$NetBSD: ip_input.c,v 1.30 1996/03/16 23:53:58 christos Exp $	*/
 
 /*
@@ -584,7 +584,7 @@ found:
 	 * Switch out to protocol's input routine.
 	 */
 	ipstat_inc(ips_delivered);
-	(*inetsw[ip_protox[ip->ip_p]].pr_input)(m, hlen, ip->ip_p);
+	(*inetsw[ip_protox[ip->ip_p]].pr_input)(&m, &hlen, ip->ip_p);
 	return;
 bad:
 	m_freem(m);
diff --git a/sys/netinet/ip_ipip.c b/sys/netinet/ip_ipip.c
index 138e225ef8a..528c96bd984 100644
--- a/sys/netinet/ip_ipip.c
+++ b/sys/netinet/ip_ipip.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ip_ipip.c,v 1.70 2017/01/25 17:34:31 bluhm Exp $ */
+/*	$OpenBSD: ip_ipip.c,v 1.71 2017/01/29 19:58:47 bluhm Exp $ */
 /*
  * The authors of this code are John Ioannidis (ji@tla.org),
  * Angelos D. Keromytis (kermit@csd.uch.gr) and
@@ -86,45 +86,21 @@ int ipip_allow = 0;
 
 struct ipipstat ipipstat;
 
-#ifdef INET6
 /*
- * Really only a wrapper for ipip_input(), for use with IPv6.
+ * Really only a wrapper for ipip_input(), for use with pr_input.
  */
 int
-ip4_input6(struct mbuf **mp, int *offp, int proto)
+ip4_input(struct mbuf **mp, int *offp, int proto)
 {
 	/* If we do not accept IP-in-IP explicitly, drop.  */
 	if (!ipip_allow && ((*mp)->m_flags & (M_AUTH|M_CONF)) == 0) {
-		DPRINTF(("ip4_input6(): dropped due to policy\n"));
+		DPRINTF(("ip4_input(): dropped due to policy\n"));
 		ipipstat.ipips_pdrops++;
 		m_freem(*mp);
 		return IPPROTO_DONE;
 	}
 
-	ipip_input(*mp, *offp, NULL, proto);
-	return IPPROTO_DONE;
-}
-#endif /* INET6 */
-
-/*
- * Really only a wrapper for ipip_input(), for use with IPv4.
- */
-void
-ip4_input(struct mbuf *m, int iphlen, int proto)
-{
-	struct ip *ip;
-
-	/* If we do not accept IP-in-IP explicitly, drop.  */
-	if (!ipip_allow && (m->m_flags & (M_AUTH|M_CONF)) == 0) {
-		DPRINTF(("ip4_input(): dropped due to policy\n"));
-		ipipstat.ipips_pdrops++;
-		m_freem(m);
-		return;
-	}
-
-	ip = mtod(m, struct ip *);
-
-	ipip_input(m, iphlen, NULL, ip->ip_p);
+	return ipip_input(mp, offp, NULL, proto);
 }
 
 /*
@@ -135,9 +111,11 @@ ip4_input(struct mbuf *m, int iphlen, int proto)
  * tunnel.
  */
 
-void
-ipip_input(struct mbuf *m, int iphlen, struct ifnet *gifp, int proto)
+int
+ipip_input(struct mbuf **mp, int *offp, struct ifnet *gifp, int proto)
 {
+	struct mbuf *m = *mp;
+	int iphlen = *offp;
 	struct sockaddr_in *sin;
 	struct ifnet *ifp;
 	struct niqueue *ifq = NULL;
@@ -167,7 +145,7 @@ ipip_input(struct mbuf *m, int iphlen, struct ifnet *gifp, int proto)
 	default:
 		ipipstat.ipips_family++;
 		m_freem(m);
-		return /* EAFNOSUPPORT */;
+		return IPPROTO_DONE;
 	}
 
 	/* Bring the IP header in the first mbuf, if not there already */
@@ -175,7 +153,7 @@ ipip_input(struct mbuf *m, int iphlen, struct ifnet *gifp, int proto)
 		if ((m = m_pullup(m, hlen)) == NULL) {
 			DPRINTF(("ipip_input(): m_pullup() failed\n"));
 			ipipstat.ipips_hdrops++;
-			return;
+			return IPPROTO_DONE;
 		}
 	}
 
@@ -203,7 +181,7 @@ ipip_input(struct mbuf *m, int iphlen, struct ifnet *gifp, int proto)
 	if (m->m_pkthdr.len < sizeof(struct ip)) {
 		ipipstat.ipips_hdrops++;
 		m_freem(m);
-		return;
+		return IPPROTO_DONE;
 	}
 
 	switch (proto) {
@@ -219,7 +197,7 @@ ipip_input(struct mbuf *m, int iphlen, struct ifnet *gifp, int proto)
 	default:
 		ipipstat.ipips_family++;
 		m_freem(m);
-		return; /* EAFNOSUPPORT */
+		return IPPROTO_DONE;
 	}
 
 	/*
@@ -229,7 +207,7 @@ ipip_input(struct mbuf *m, int iphlen, struct ifnet *gifp, int proto)
 		if ((m = m_pullup(m, hlen)) == NULL) {
 			DPRINTF(("ipip_input(): m_pullup() failed\n"));
 			ipipstat.ipips_hdrops++;
-			return;
+			return IPPROTO_DONE;
 		}
 	}
 
@@ -253,7 +231,7 @@ ipip_input(struct mbuf *m, int iphlen, struct ifnet *gifp, int proto)
 			DPRINTF(("ipip_input(): ip_ecn_egress() failed"));
 			ipipstat.ipips_pdrops++;
 			m_freem(m);
-			return;
+			return IPPROTO_DONE;
 		}
 		/* re-calculate the checksum if ip_tos was changed */
 		if (itos != ipo->ip_tos) {
@@ -273,7 +251,7 @@ ipip_input(struct mbuf *m, int iphlen, struct ifnet *gifp, int proto)
 			DPRINTF(("ipip_input(): ip_ecn_egress() failed"));
 			ipipstat.ipips_pdrops++;
 			m_freem(m);
-			return;
+			return IPPROTO_DONE;
 		}
 		ip6->ip6_flow &= ~htonl(0xff << 20);
 		ip6->ip6_flow |= htonl((u_int32_t) itos << 20);
@@ -316,7 +294,7 @@ ipip_input(struct mbuf *m, int iphlen, struct ifnet *gifp, int proto)
 			ipipstat.ipips_spoof++;
 			m_freem(m);
 			rtfree(rt);
-			return;
+			return IPPROTO_DONE;
  		}
 		rtfree(rt);
  	} else {
@@ -361,8 +339,8 @@ ipip_input(struct mbuf *m, int iphlen, struct ifnet *gifp, int proto)
 		ipipstat.ipips_qfull++;
 		DPRINTF(("ipip_input(): packet dropped because of full "
 		    "queue\n"));
-		return;
 	}
+	return IPPROTO_DONE;
 }
 
 int
diff --git a/sys/netinet/ip_ipsp.h b/sys/netinet/ip_ipsp.h
index 823dd78105e..1b42b3e66e7 100644
--- a/sys/netinet/ip_ipsp.h
+++ b/sys/netinet/ip_ipsp.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ip_ipsp.h,v 1.176 2017/01/26 13:03:47 bluhm Exp $	*/
+/*	$OpenBSD: ip_ipsp.h,v 1.177 2017/01/29 19:58:47 bluhm Exp $	*/
 /*
  * The authors of this code are John Ioannidis (ji@tla.org),
  * Angelos D. Keromytis (kermit@csd.uch.gr),
@@ -475,14 +475,10 @@ int	ipe4_attach(void);
 int	ipe4_init(struct tdb *, struct xformsw *, struct ipsecinit *);
 int	ipe4_zeroize(struct tdb *);
 void	ipe4_input(struct mbuf *, int, int);
-void	ipip_input(struct mbuf *, int, struct ifnet *, int);
+int	ipip_input(struct mbuf **, int *, struct ifnet *, int);
 int	ipip_output(struct mbuf *, struct tdb *, struct mbuf **, int, int);
 
-void	ip4_input(struct mbuf *, int, int);
-
-#ifdef INET6
-int	ip4_input6(struct mbuf **, int *, int);
-#endif /* INET6 */
+int	ip4_input(struct mbuf **, int *, int);
 
 /* XF_AH */
 int 	ah_attach(void);
@@ -492,7 +488,7 @@ int	ah_input(struct mbuf *, struct tdb *, int, int);
 int	ah_output(struct mbuf *, struct tdb *, struct mbuf **, int, int);
 int	ah_sysctl(int *, u_int, void *, size_t *, void *, size_t);
 
-void	ah4_input(struct mbuf *, int, int);
+int	ah4_input(struct mbuf **, int *, int);
 void	ah4_ctlinput(int, struct sockaddr *, u_int, void *);
 void	udpencap_ctlinput(int, struct sockaddr *, u_int, void *);
 
@@ -508,7 +504,7 @@ int	esp_input(struct mbuf *, struct tdb *, int, int);
 int	esp_output(struct mbuf *, struct tdb *, struct mbuf **, int, int);
 int	esp_sysctl(int *, u_int, void *, size_t *, void *, size_t);
 
-void	esp4_input(struct mbuf *, int, int);
+int	esp4_input(struct mbuf **, int *, int);
 void	esp4_ctlinput(int, struct sockaddr *, u_int, void *);
 
 #ifdef INET6
@@ -522,9 +518,7 @@ int	ipcomp_zeroize(struct tdb *);
 int	ipcomp_input(struct mbuf *, struct tdb *, int, int);
 int	ipcomp_output(struct mbuf *, struct tdb *, struct mbuf **, int, int);
 int	ipcomp_sysctl(int *, u_int, void *, size_t *, void *, size_t);
-
-void	ipcomp4_input(struct mbuf *, int, int);
-
+int	ipcomp4_input(struct mbuf **, int *, int);
 #ifdef INET6
 int	ipcomp6_input(struct mbuf **, int *, int);
 #endif /* INET6 */
diff --git a/sys/netinet/ip_var.h b/sys/netinet/ip_var.h
index 003c6a75bb2..f1fd4e20754 100644
--- a/sys/netinet/ip_var.h
+++ b/sys/netinet/ip_var.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ip_var.h,v 1.66 2017/01/25 17:34:31 bluhm Exp $	*/
+/*	$OpenBSD: ip_var.h,v 1.67 2017/01/29 19:58:47 bluhm Exp $	*/
 /*	$NetBSD: ip_var.h,v 1.16 1996/02/13 23:43:20 christos Exp $	*/
 
 /*
@@ -252,7 +252,7 @@ void	 ipv4_input(struct mbuf *);
 void	 ip_forward(struct mbuf *, struct ifnet *, struct rtentry *, int);
 int	 rip_ctloutput(int, struct socket *, int, int, struct mbuf **);
 void	 rip_init(void);
-void	 rip_input(struct mbuf *, int, int);
+int	 rip_input(struct mbuf **, int *, int);
 int	 rip_output(struct mbuf *, ...);
 int	 rip_usrreq(struct socket *,
 	    int, struct mbuf *, struct mbuf *, struct mbuf *, struct proc *);
diff --git a/sys/netinet/ipsec_input.c b/sys/netinet/ipsec_input.c
index 116b7bc77e2..c5952707aaa 100644
--- a/sys/netinet/ipsec_input.c
+++ b/sys/netinet/ipsec_input.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ipsec_input.c,v 1.140 2017/01/26 13:03:47 bluhm Exp $	*/
+/*	$OpenBSD: ipsec_input.c,v 1.141 2017/01/29 19:58:47 bluhm Exp $	*/
 /*
  * The authors of this code are John Ioannidis (ji@tla.org),
  * Angelos D. Keromytis (kermit@csd.uch.gr) and
@@ -148,7 +148,7 @@ ipsec_common_input(struct mbuf *m, int skip, int protoff, int af, int sproto,
 	    (sproto == IPPROTO_IPCOMP && !ipcomp_enable)) {
 		switch (af) {
 		case AF_INET:
-			rip_input(m, skip, sproto);
+			rip_input(&m, &skip, sproto);
 			break;
 #ifdef INET6
 		case AF_INET6:
@@ -696,12 +696,12 @@ ipcomp_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp, void *newp,
 }
 
 /* IPv4 AH wrapper. */
-void
-ah4_input(struct mbuf *m, int skip, int proto)
+int
+ah4_input(struct mbuf **mp, int *offp, int proto)
 {
-	ipsec_common_input(m, skip, offsetof(struct ip, ip_p), AF_INET,
-	    IPPROTO_AH, 0);
-	return;
+	ipsec_common_input(*mp, *offp, offsetof(struct ip, ip_p), AF_INET,
+	    proto, 0);
+	return IPPROTO_DONE;
 }
 
 /* IPv4 AH callback. */
@@ -736,11 +736,12 @@ ah4_ctlinput(int cmd, struct sockaddr *sa, u_int rdomain, void *v)
 }
 
 /* IPv4 ESP wrapper. */
-void
-esp4_input(struct mbuf *m, int skip, int proto)
+int
+esp4_input(struct mbuf **mp, int *offp, int proto)
 {
-	ipsec_common_input(m, skip, offsetof(struct ip, ip_p), AF_INET,
-	    IPPROTO_ESP, 0);
+	ipsec_common_input(*mp, *offp, offsetof(struct ip, ip_p), AF_INET,
+	    proto, 0);
+	return IPPROTO_DONE;
 }
 
 /* IPv4 ESP callback. */
@@ -762,11 +763,12 @@ esp4_input_cb(struct mbuf *m, ...)
 }
 
 /* IPv4 IPCOMP wrapper */
-void
-ipcomp4_input(struct mbuf *m, int skip, int proto)
+int
+ipcomp4_input(struct mbuf **mp, int *offp, int proto)
 {
-	ipsec_common_input(m, skip, offsetof(struct ip, ip_p), AF_INET,
-	    IPPROTO_IPCOMP, 0);
+	ipsec_common_input(*mp, *offp, offsetof(struct ip, ip_p), AF_INET,
+	    proto, 0);
+	return IPPROTO_DONE;
 }
 
 /* IPv4 IPCOMP callback */
diff --git a/sys/netinet/raw_ip.c b/sys/netinet/raw_ip.c
index 5a02613ca4f..a9d55bfc7ea 100644
--- a/sys/netinet/raw_ip.c
+++ b/sys/netinet/raw_ip.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: raw_ip.c,v 1.93 2017/01/25 17:34:31 bluhm Exp $	*/
+/*	$OpenBSD: raw_ip.c,v 1.94 2017/01/29 19:58:47 bluhm Exp $	*/
 /*	$NetBSD: raw_ip.c,v 1.25 1996/02/18 18:58:33 christos Exp $	*/
 
 /*
@@ -115,9 +115,10 @@ rip_init(void)
 
 struct sockaddr_in ripsrc = { sizeof(ripsrc), AF_INET };
 
-void
-rip_input(struct mbuf *m, int hlen, int proto)
+int
+rip_input(struct mbuf **mp, int *offp, int proto)
 {
+	struct mbuf *m = *mp;
 	struct ip *ip = mtod(m, struct ip *);
 	struct inpcb *inp, *last = NULL;
 	struct mbuf *opts = NULL;
@@ -198,6 +199,7 @@ rip_input(struct mbuf *m, int hlen, int proto)
 		counters[ips_delivered]--;
 		counters_leave(&ref, ipcounters);
 	}
+	return IPPROTO_DONE;
 }
 
 /*
diff --git a/sys/netinet/tcp_input.c b/sys/netinet/tcp_input.c
index c16afb14e3b..ecbd0008044 100644
--- a/sys/netinet/tcp_input.c
+++ b/sys/netinet/tcp_input.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: tcp_input.c,v 1.336 2017/01/25 17:34:31 bluhm Exp $	*/
+/*	$OpenBSD: tcp_input.c,v 1.337 2017/01/29 19:58:47 bluhm Exp $	*/
 /*	$NetBSD: tcp_input.c,v 1.23 1996/02/13 23:43:44 christos Exp $	*/
 
 /*
@@ -351,24 +351,15 @@ tcp_flush_queue(struct tcpcb *tp)
 	return (flags);
 }
 
-#ifdef INET6
-int
-tcp6_input(struct mbuf **mp, int *offp, int proto)
-{
-	struct mbuf *m = *mp;
-
-	tcp_input(m, *offp, proto);
-	return IPPROTO_DONE;
-}
-#endif
-
 /*
  * TCP input routine, follows pages 65-76 of the
  * protocol specification dated September, 1981 very closely.
  */
-void
-tcp_input(struct mbuf *m, int iphlen, int proto)
+int
+tcp_input(struct mbuf **mp, int *offp, int proto)
 {
+	struct mbuf *m = *mp;
+	int iphlen = *offp;
 	struct ip *ip;
 	struct inpcb *inp = NULL;
 	u_int8_t *optp = NULL;
@@ -424,7 +415,7 @@ tcp_input(struct mbuf *m, int iphlen, int proto)
 		break;
 	default:
 		m_freem(m);
-		return;	/*EAFNOSUPPORT*/
+		return IPPROTO_DONE;
 	}
 
 	/*
@@ -436,7 +427,7 @@ tcp_input(struct mbuf *m, int iphlen, int proto)
 #ifdef DIAGNOSTIC
 		if (iphlen < sizeof(struct ip)) {
 			m_freem(m);
-			return;
+			return IPPROTO_DONE;
 		}
 #endif /* DIAGNOSTIC */
 		break;
@@ -445,20 +436,20 @@ tcp_input(struct mbuf *m, int iphlen, int proto)
 #ifdef DIAGNOSTIC
 		if (iphlen < sizeof(struct ip6_hdr)) {
 			m_freem(m);
-			return;
+			return IPPROTO_DONE;
 		}
 #endif /* DIAGNOSTIC */
 		break;
 #endif
 	default:
 		m_freem(m);
-		return;
+		return IPPROTO_DONE;
 	}
 
 	IP6_EXTHDR_GET(th, struct tcphdr *, m, iphlen, sizeof(*th));
 	if (!th) {
 		tcpstat.tcps_rcvshort++;
-		return;
+		return IPPROTO_DONE;
 	}
 
 	tlen = m->m_pkthdr.len - iphlen;
@@ -552,7 +543,7 @@ tcp_input(struct mbuf *m, int iphlen, int proto)
 		IP6_EXTHDR_GET(th, struct tcphdr *, m, iphlen, off);
 		if (!th) {
 			tcpstat.tcps_rcvshort++;
-			return;
+			return IPPROTO_DONE;
 		}
 		optlen = off - sizeof(struct tcphdr);
 		optp = (u_int8_t *)(th + 1);
@@ -874,7 +865,7 @@ findpcb:
 					tcpstat.tcps_dropsyn++;
 					goto drop;
 				}
-				return;
+				return IPPROTO_DONE;
 			}
 		}
 	}
@@ -1067,7 +1058,7 @@ findpcb:
 				if (so->so_snd.sb_cc ||
 				    tp->t_flags & TF_NEEDOUTPUT)
 					(void) tcp_output(tp);
-				return;
+				return IPPROTO_DONE;
 			}
 		} else if (th->th_ack == tp->snd_una &&
 		    TAILQ_EMPTY(&tp->t_segq) &&
@@ -1114,7 +1105,7 @@ findpcb:
 			tp->t_flags &= ~TF_BLOCKOUTPUT;
 			if (tp->t_flags & (TF_ACKNOW|TF_NEEDOUTPUT))
 				(void) tcp_output(tp);
-			return;
+			return IPPROTO_DONE;
 		}
 	}
 
@@ -2167,7 +2158,7 @@ dodata:							/* XXX */
 	 */
 	if (tp->t_flags & (TF_ACKNOW|TF_NEEDOUTPUT))
 		(void) tcp_output(tp);
-	return;
+	return IPPROTO_DONE;
 
 badsyn:
 	/*
@@ -2195,7 +2186,7 @@ dropafterack:
 	m_freem(m);
 	tp->t_flags |= TF_ACKNOW;
 	(void) tcp_output(tp);
-	return;
+	return IPPROTO_DONE;
 
 dropwithreset_ratelim:
 	/*
@@ -2229,7 +2220,7 @@ dropwithreset:
 		    (tcp_seq)0, TH_RST|TH_ACK, m->m_pkthdr.ph_rtableid);
 	}
 	m_freem(m);
-	return;
+	return IPPROTO_DONE;
 
 drop:
 	/*
@@ -2251,7 +2242,7 @@ drop:
 	}
 
 	m_freem(m);
-	return;
+	return IPPROTO_DONE;
 }
 
 int
diff --git a/sys/netinet/tcp_var.h b/sys/netinet/tcp_var.h
index 34fba69a0a0..fdf468af7d5 100644
--- a/sys/netinet/tcp_var.h
+++ b/sys/netinet/tcp_var.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: tcp_var.h,v 1.119 2017/01/26 13:03:47 bluhm Exp $	*/
+/*	$OpenBSD: tcp_var.h,v 1.120 2017/01/29 19:58:47 bluhm Exp $	*/
 /*	$NetBSD: tcp_var.h,v 1.17 1996/02/13 23:44:24 christos Exp $	*/
 
 /*
@@ -610,10 +610,7 @@ struct tcpcb *
 int	 tcp_dooptions(struct tcpcb *, u_char *, int, struct tcphdr *,
 		struct mbuf *, int, struct tcp_opt_info *, u_int);
 void	 tcp_init(void);
-#ifdef INET6
-int	 tcp6_input(struct mbuf **, int *, int);
-#endif
-void	 tcp_input(struct mbuf *, int, int);
+int	 tcp_input(struct mbuf **, int *, int);
 int	 tcp_mss(struct tcpcb *, int);
 void	 tcp_mss_update(struct tcpcb *);
 u_int	 tcp_hdrsz(struct tcpcb *);
diff --git a/sys/netinet/udp_usrreq.c b/sys/netinet/udp_usrreq.c
index 5039c60214f..6d94c7c0917 100644
--- a/sys/netinet/udp_usrreq.c
+++ b/sys/netinet/udp_usrreq.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: udp_usrreq.c,v 1.228 2017/01/26 13:03:47 bluhm Exp $	*/
+/*	$OpenBSD: udp_usrreq.c,v 1.229 2017/01/29 19:58:47 bluhm Exp $	*/
 /*	$NetBSD: udp_usrreq.c,v 1.28 1996/03/16 23:54:03 christos Exp $	*/
 
 /*
@@ -147,20 +147,11 @@ udp_init(void)
 	in_pcbinit(&udbtable, UDB_INITIAL_HASH_SIZE);
 }
 
-#ifdef INET6
 int
-udp6_input(struct mbuf **mp, int *offp, int proto)
+udp_input(struct mbuf **mp, int *offp, int proto)
 {
 	struct mbuf *m = *mp;
-
-	udp_input(m, *offp, proto);
-	return IPPROTO_DONE;
-}
-#endif
-
-void
-udp_input(struct mbuf *m, int iphlen, int proto)
-{
+	int iphlen = *offp;
 	struct ip *ip;
 	struct udphdr *uh;
 	struct inpcb *inp = NULL;
@@ -218,7 +209,7 @@ udp_input(struct mbuf *m, int iphlen, int proto)
 	IP6_EXTHDR_GET(uh, struct udphdr *, m, iphlen, sizeof(struct udphdr));
 	if (!uh) {
 		udpstat_inc(udps_hdrops);
-		return;
+		return IPPROTO_DONE;
 	}
 
 	/* Check for illegal destination port 0 */
@@ -324,7 +315,7 @@ udp_input(struct mbuf *m, int iphlen, int proto)
 		if (m->m_pkthdr.len - skip < sizeof(u_int32_t)) {
 			/* packet too short */
 			m_freem(m);
-			return;
+			return IPPROTO_DONE;
 		}
 		m_copydata(m, skip, sizeof(u_int32_t), (caddr_t) &spi);
 		/*
@@ -334,7 +325,7 @@ udp_input(struct mbuf *m, int iphlen, int proto)
 		if (spi != 0) {
 			if ((m = m_pullup(m, skip)) == NULL) {
 				udpstat_inc(udps_hdrops);
-				return;
+				return IPPROTO_DONE;
 			}
 
 			/* remove the UDP header */
@@ -346,7 +337,7 @@ udp_input(struct mbuf *m, int iphlen, int proto)
 			espstat.esps_udpencin++;
 			ipsec_common_input(m, skip, protoff,
 			    srcsa.sa.sa_family, IPPROTO_ESP, 1);
-			return;
+			return IPPROTO_DONE;
 		}
 	}
 #endif
@@ -396,7 +387,7 @@ udp_input(struct mbuf *m, int iphlen, int proto)
 	    !(m->m_pkthdr.pf.flags & PF_TAG_DIVERTED) &&
 #endif
 	    vxlan_lookup(m, uh, iphlen, &srcsa.sa, &dstsa.sa) != 0)
-		return;
+		return IPPROTO_DONE;
 #endif
 
 	if (m->m_flags & (M_BCAST|M_MCAST)) {
@@ -548,7 +539,7 @@ udp_input(struct mbuf *m, int iphlen, int proto)
 			goto bad;
 		}
 		sorwakeup(last->inp_socket);
-		return;
+		return IPPROTO_DONE;
 	}
 	/*
 	 * Locate pcb for datagram.
@@ -601,7 +592,7 @@ udp_input(struct mbuf *m, int iphlen, int proto)
 				icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_PORT,
 				    0, 0);
 			}
-			return;
+			return IPPROTO_DONE;
 		}
 	}
 	KASSERT(sotoinpcb(inp->inp_socket) == inp);
@@ -686,7 +677,8 @@ udp_input(struct mbuf *m, int iphlen, int proto)
 			if ((m = pipex_l2tp_input(m, off, session,
 			    ipsecflowinfo)) == NULL) {
 				m_freem(opts);
-				return; /* the packet is handled by PIPEX */
+				/* the packet is handled by PIPEX */
+				return IPPROTO_DONE;
 			}
 		}
 	}
@@ -699,10 +691,11 @@ udp_input(struct mbuf *m, int iphlen, int proto)
 		goto bad;
 	}
 	sorwakeup(inp->inp_socket);
-	return;
+	return IPPROTO_DONE;
 bad:
 	m_freem(m);
 	m_freem(opts);
+	return IPPROTO_DONE;
 }
 
 /*
diff --git a/sys/netinet/udp_var.h b/sys/netinet/udp_var.h
index b5689307ac2..1194da4c42f 100644
--- a/sys/netinet/udp_var.h
+++ b/sys/netinet/udp_var.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: udp_var.h,v 1.30 2017/01/26 13:03:47 bluhm Exp $	*/
+/*	$OpenBSD: udp_var.h,v 1.31 2017/01/29 19:58:47 bluhm Exp $	*/
 /*	$NetBSD: udp_var.h,v 1.12 1996/02/13 23:44:41 christos Exp $	*/
 
 /*
@@ -138,11 +138,10 @@ extern struct	udpstat udpstat;
 
 #ifdef INET6
 void	udp6_ctlinput(int, struct sockaddr *, u_int, void *);
-int	udp6_input(struct mbuf **, int *, int);
 #endif /* INET6 */
 void	 udp_ctlinput(int, struct sockaddr *, u_int, void *);
 void	 udp_init(void);
-void	 udp_input(struct mbuf *, int, int);
+int	 udp_input(struct mbuf **, int *, int);
 #ifdef INET6
 int	 udp6_output(struct inpcb *, struct mbuf *, struct mbuf *,
 	struct mbuf *);