Created attachment 2472 [details]
Proposed fix

How to reproduce this bug:

just let UdpSocketImpl::DoSendTo always add a SocketIpToS tag by commenting out the condition if (IsManualIpTos ()) (to mimic the case in which a TOS is set). The result is that simple-point-to-point-olsr, mixed-wireless and ipv4-rip crash because we attempt to add a SocketIpTosTag twice.

I found that this issue arises when a packet is sent multiple times. For instance, OLSR sends the same OLSR packet via an UDP socket as many times as the number of interfaces. The reason is that UdpSocketImpl::DoSendTo adds the SocketIpTosTag to the packet but then sends a copy of the packet. Thus, Ipv4L3Protocol removes the tag from the copy of the packet, hence the original packet still has the tag attached. If the (original) packet is sent again (as is the case with OLSR -- and RIP I assume -- packets), an attempt is made to add another SocketIpTos tag to the packet, thus crashing the example.

I propose that the SocketIpTos tag be added to the copy of the packet, just before  passing the copy of the packet to the UdpL4Protocol. This approach is implemented by the attached patch, which makes all the tests pass again (regardless of whether the IsManualIpTos () checks are commented or not).