free_p(&bp);
		Rip_stat.version++;
		return;
	}
	switch(cmd){
	case RIPCMD_RESPONSE:
		if(Rip_trace > 1)
			printf("RIPCMD_RESPONSE from %s \n",inet_ntoa(fsock.address));

		Rip_stat.response++;
		/* See if this interface is on our broadcast list; if so,
		 * use its interval to calculate entry lifetimes. Otherwise,
		 * use default
		 */
		ttl = RIP_TTL;
		for(rl=Rip_list; rl != NULL; rl = rl->next){
			if(rl->iface == iface){
				ttl = rl->interval * 4;
				break;
			}
		}
		(void)pull16(&bp);	/* remove one word of padding */
		while(len_p(bp) >= RIPROUTE){
			pullentry(&entry,&bp);
			proc_rip(iface,fsock.address,&entry,ttl);
		}
		/* If we can't reach the sender of this update, or if
		 * our existing route is not through the interface we
		 * got this update on, add him as a host specific entry
		 */
		if((rp = rt_blookup(fsock.address,32)) != NULL){
			/* Host-specific route already exists, refresh it */
			start_timer(&rp->timer);
		} else if((rp = rt_lookup(fsock.address)) == NULL
		 || rp->iface != iface){
			entry.addr_fam = RIP_IPFAM;
			entry.target = fsock.address;
			entry.metric = 0; /* will get incremented to 1 */
			proc_rip(iface,fsock.address,&entry,ttl);
		}
		if(Rip_merge)
			rt_merge(Rip_trace);
		rip_trigger();
		break;
	case RIPCMD_REQUEST:
		if(Rip_trace > 1)
			printf("RIPCMD_REQUEST\n");

		Rip_stat.request++;
		/* For now, just send the whole table with split horizon
		 * enabled when the source port is RIP_PORT, and send
		 * the whole table with split horizon disable when another
		 * source port is used. This should be replaced with a more
		 * complete implementation that checks for non-global requests
		 */
		if(fsock.port == RIP_PORT)
			send_routes(fsock.address,fsock.port,1,0,1);
		else
			send_routes(fsock.address,fsock.port,0,0,1);
		break;
	default:
		if(Rip_trace > 1)
			printf("RIPCMD: Unknown Type\n");

		Rip_stat.unknown++;
		break;
	} /* switch */
	free_p(&bp);
}
/* Apply a set of heuristics for determining the number of significant bits
 * (i.e., the address mask) in the target address. Needed since RIP doesn't
 * include the address mask for each entry.
 */
int
nbits(target)
int32 target;
{
	int bits;

	if(target == 0)
		return 0;	/* Special case: 0.0.0.0 is the default route */

	/* Check the host-part bytes of
	 * the address to check for byte-wide zeros
	 * which we'll consider to be subnet routes.
	 * e.g.	44.80.0.0 will be considered to be equal to 44.80/16
	 * whereas 44.80.1.0 will be considered to be 44.80.1/24
	 */
	switch (hibyte(hiword(target)) >> 6) {
	case 3:	/* Class C address */
		/*is it a host address ? i.e. are there any 1's in the
		 * host part ?
		 */
		if(target & 0xff)
			bits = 32;
		else
			bits = 24;
		break;
	case 2:  /* Class B address */
		if(target & 0xff)
			bits = 32;
		else if(target & 0xff00)
			bits = 24;
		else
			bits = 16;
		break;
        case 0:	  /* Class A address */
        case 1:
		if(target & 0xff)
			bits = 32;
		else if(target & 0xff00)
			bits = 24;
		else if(target & 0xff0000)
			bits = 16;
		else
			bits = 8;
	}

	return bits;
}
/* Remove and process a RIP response entry from a packet */
static void
proc_rip(iface,gateway,ep,ttl)
struct iface *iface;
int32 gateway;
register struct rip_route *ep;
int32 ttl;
{
	unsigned int bits;
	register struct route *rp;
	int add = 0;	/* action flags */
	int drop = 0;
	int trigger = 0;

	if(ep->addr_fam != RIP_IPFAM) {
		/* Skip non-IP addresses */
		if(Rip_trace > 1)
			printf("RIP_rx: Not an IP RIP packet !\n");
		Rip_stat.addr_family++;
		return;
	}
	/* Guess at the mask, since it's not explicit */
	bits = nbits(ep->target);

	/* Don't ever add a route to myself through somebody! */
	if(bits == 32 && ismyaddr(ep->target) != NULL){
		if(Rip_trace > 1){
			printf("route to self: %s %ld\n",
			 inet_ntoa(ep->target),ep->metric);
		}
		return;
	}
	/* Find existing entry, if any */
	rp = rt_blookup(ep->target,bits);

	/* Don't touch private routes */
	if(rp != NULL && rp->flags.rtprivate)
		return;

	if(rp == NULL){
		if(ep->metric < RIP_INFINITY){
			/* New route; add it and trigger an update */
			add++;
			trigger++;
		}
	} else if(rp->metric == RIP_INFINITY){
		/* Route is in hold-down; ignore this guy */
		if(Rip_trace > 0){
			printf("ignored (hold-down): %s %lu\n",
			 inet_ntoa(ep->target),ep->metric);
		}
	} else if(rp->gateway == gateway && rp->iface == iface){
		/* This is the gateway for the entry we already have;
		 * restart the timer
		 */
		set_timer(&rp->timer,ttl*1000L);
		start_timer(&rp->timer);
		if(rp->metric != ep->metric){
			/* Metric has changed. Update it and trigger an
			 * update. If route has become unavailable, start
			 * the hold-down timeout.
			 */
			if(Rip_trace){
				printf("metric change: %s %lu -> %lu\n",
				 inet_ntoa(ep->target),rp->metric,ep->metric);
			}
			if(ep->metric == RIP_INFINITY)
				rt_timeout(rp);	/* Enter hold-down timeout */
			else
				rp->metric = ep->metric;
			trigger++;
		}
	} else {
		/* Entry is from a different gateway than the current route */
		if(ep->metric < rp->metric){
			/* Switch to a new gateway */
			if(Rip_trace > 0){
				printf("metric better: %s %lu\n",
				 inet_ntoa(ep->target),ep->metric);
			}
			drop++;
			add++;
			trigger++;
		} else {
			/* Metric is no better, stay with current route */
			if(Rip_trace > 1){
				printf("metric not better: %s %lu\n",
				 inet_ntoa(ep->target),ep->metric);
			}
		}
	}
	if(drop){
		/* Switching to a better gateway; delete old entry */
		if(Rip_trace){
			printf("route drop [%s]/%u",
			 inet_ntoa(ep->target),bits);
			if(rp != NULL)
				printf(" %s %s %lu",rp->iface->name,
				 inet_ntoa(rp->gateway),rp->metric);
			printf("\n");
		}
		rt_drop(ep->target,bits);
	}
	if(add){
		/* Add a new entry */
		if(Rip_trace > 0){
			printf("route add [%s]/%u %s",inet_ntoa(ep->target),
			 bits,iface->name);
			printf(" [%s] %u\n",inet_ntoa(gateway),
			 (int)ep->metric);
		}
		rp = rt_add(ep->target,(unsigned) bits,gateway,iface,
		 (int) ep->metric,ttl,0);
	}
	/* If the route changed, mark it for a triggered update */
	if(trigger){
		rp->flags.rttrig = 1;
	}
}
/* Send a RIP request packet to the specified destination */
int
ripreq(dest,replyport)
int32 dest;
uint16 replyport;
{
	struct mbuf *bp;
	struct socket lsock,fsock;
	uint8 *cp;

	lsock.address = INADDR_ANY;
	lsock.port = replyport;

	/* if we were given a valid dest addr, ask it (the routers on that net)
	 * for a default gateway
	 */
	if(dest == 0)
		return 0;

	fsock.address = dest;
	fsock.port = RIP_PORT;

	/* Send out one RIP Request packet as a broadcast to 'dest'  */
	if((bp = alloc_mbuf(RIPHEADER + RIPROUTE)) == NULL)
		return -1;

	cp = putheader(bp->data,RIPCMD_REQUEST,RIPVERSION);
	cp = putentry(cp,0,0L,RIP_INFINITY);
	bp->cnt = RIPHEADER + RIPROUTE;
	send_udp(&lsock, &fsock,0,0,&bp,bp->cnt,0,0);
	Rip_stat.output++;
	return 0;
}
void
pullentry(ep,bpp)
register struct rip_route *ep;
struct mbuf **bpp;
{
	ep->addr_fam = pull16(bpp);
	(void)pull16(bpp);
	ep->target = pull32(bpp);
	(void)pull32(bpp);
	(void)pull32(bpp);
	ep->metric = pull32(bpp);
}

/* Write the header of a RIP packet */
static uint8 *
putheader(cp,command,version)
register uint8 *cp;
enum ripcmd command;
uint8 version;
{
	*cp++ = command;
	*cp++ = version;
	return put16(cp,0);
}

/* Write a single entry into a rip packet */
static uint8 *
putentry(cp,fam,target,metric)
register uint8 *cp;
uint16 fam;
int32 target;
int32 metric;
{
	cp = put16(cp,fam);
	cp = put16(cp,0);
	cp = put32(cp,target);
	cp = put32(cp,0L);
	cp = put32(cp,0L);
	return put32(cp,metric);
}
/* Route timeout handler. If route has already been marked for deletion
 * then delete it. Otherwise mark for deletion and restart timer.
 */
void
rt_timeout(s)
void *s;
{
	register struct route *rp = (struct route *)s;

	stop_timer(&rp->timer);
	if(rp->metric < RIP_INFINITY){
		rp->metric = RIP_INFINITY;
		if(dur_timer(&rp->timer) == 0)
			set_timer(&rp->timer,RIP_TTL*1000L);
		/* wait 2/3 of timeout before garbage collect */
		set_timer(&rp->timer,dur_timer(&rp->timer)*2/3);
		rp->timer.func = (void *)rt_timeout;
		rp->timer.arg = (void *)rp;
		start_timer(&rp->timer);
		/* Route changed; mark it for triggered update */
		rp->flags.rttrig = 1;
		rip_trigger();
	} else {
		rt_drop(rp->target,rp->bits);
	}
}