Fix two more UAF in route_bgp: move DEBUG_INFO before etcp_send

- route_bgp_send_nat_info: moved ip_to_str(pkt->nat_ip) log before etcp_send
- route_bgp_send_nat_check_req: moved ip_to_str(pkt->interface_ip) log before etcp_send

Both were reading from pkt memory that could be freed by etcp_send callback.

src/route_bgp.c

@@ -1064,11 +1064,11 @@ void route_bgp_send_nat_info(struct ETCP_CONN* conn, uint8_t socket_id, uint32_t
     }
     e->dgram = (uint8_t*)pkt;
     e->len = sizeof(struct BGP_NAT_INFO);
-    etcp_send(conn, e);
     DEBUG_INFO(DEBUG_CATEGORY_BGP, "route_bgp_send_nat_info to %s: socket_id=%u type=%s ip=%s port=%u",
                conn->log_name, socket_id,
                nat_type == NAT_TYPE_OPEN ? "OPEN" : "RESTRICTED",
                 ip_to_str(pkt->nat_ip, AF_INET).str, (unsigned)nat_port);
+    etcp_send(conn, e);
 }
 
 void route_bgp_send_nat_check_req(struct ETCP_CONN* conn, uint8_t socket_id) {
@@ -1099,11 +1099,11 @@ void route_bgp_send_nat_check_req(struct ETCP_CONN* conn, uint8_t socket_id) {
     }
     e->dgram = (uint8_t*)pkt;
     e->len = sizeof(struct BGP_NAT_CHECK_REQ);
-    etcp_send(conn, e);
     DEBUG_INFO(DEBUG_CATEGORY_BGP, "route_bgp_send_nat_check_req to %s: socket_id=%u interface=%s:%u",
                conn->log_name, socket_id,
                ip_to_str(&pkt->interface_ip, AF_INET).str,
                (unsigned)ntohs(pkt->interface_port));
+    etcp_send(conn, e);
 }
 
 void route_bgp_request_nat_check_all(struct ROUTE_BGP* bgp) {