www/gitea: Update from 1.1.2 to 1.1.3

[joneum]

Summary

• www/gitea: Update from 1.1.2 to 1.1.3
• Changelog: https://github.com/go-gitea/gitea/releases/tag/v1.1.3

PR: 221371
Submitted by: [e-mail] (maintainer)
Approved by: xxx (mentor)
#Differential Revision: https://reviews.freebsd.org/Dxxxxx

Test Plan

:~/dev/ports/www/gitea % portlint -AC
WARN: Makefile: for new port, make $FreeBSD$ tag in comment section empty, to make SVN happy.
0 fatal errors and 1 warning found.

poudriere testport:

10.3-amd64
10.3-i386
11.1-amd64
11.1-i386
12.0-CURRENT r321899 amd64
12.0-CURRENT r321913 i386

[rene]

Perhaps ask for an MFH, since the new version fixes some security bugs according to the changelog?

[joneum]

In D11939#248806, @rene wrote:

Perhaps ask for an MFH, since the new version fixes some security bugs according to the changelog?

• Fix some security bugs

you're right, Rene, thanks. I will ask for MFH

head/www/gitea/Makefile

 static int                 pf_dummynet_route(struct pf_pdesc *,
                             struct pf_kstate *, struct pf_krule *,
                             struct ifnet *, struct sockaddr *, struct mbuf **);
 static int                 pf_test_eth_rule(int, struct pfi_kkif *,
                             struct mbuf **);
 static int                 pf_test_rule(struct pf_krule **, struct pf_kstate **,
                             struct pfi_kkif *, struct mbuf *, int,
                             struct pf_pdesc *, struct pf_krule **,
-                            struct pf_kruleset **, struct inpcb *);
+                            struct pf_kruleset **, struct inpcb *, int);
 static int                 pf_create_state(struct pf_krule *, struct pf_krule *,
                             struct pf_krule *, struct pf_pdesc *,
                             struct pf_ksrc_node *, struct pf_state_key *,
                             struct pf_state_key *, struct mbuf *, int,
                             u_int16_t, u_int16_t, int *, struct pfi_kkif *,
                             struct pf_kstate **, int, u_int16_t, u_int16_t,
                             int, struct pf_krule_slist *, struct pf_udp_mapping *);
 static int                 pf_state_key_addr_setup(struct pf_pdesc *, struct mbuf *,
#endif /* INET6 */
         }
 
         return (action);
 }
 
 static int
 pf_test_rule(struct pf_krule **rm, struct pf_kstate **sm, struct pfi_kkif *kif,
     struct mbuf *m, int off, struct pf_pdesc *pd, struct pf_krule **am,
-    struct pf_kruleset **rsm, struct inpcb *inp)
+    struct pf_kruleset **rsm, struct inpcb *inp, int hdrlen)
 {
         struct pf_krule                *nr = NULL;
         struct pf_addr                * const saddr = pd->src;
         struct pf_addr                * const daddr = pd->dst;
         sa_family_t                 af = pd->af;
         struct pf_krule                *r, *a = NULL;
         struct pf_kruleset        *ruleset = NULL;
         struct pf_krule_slist    match_rules;
         struct pf_krule_item    *ri;
         struct pf_ksrc_node        *nsn = NULL;
         struct tcphdr                *th = &pd->hdr.tcp;
         struct pf_state_key        *sk = NULL, *nk = NULL;
         u_short                  reason, transerror;
-        int                         rewrite = 0, hdrlen = 0;
+        int                      rewrite = 0;
         int                      tag = -1;
         int                      asd = 0;
         int                      match = 0;
         int                         state_icmp = 0, icmp_dir, multi;
         u_int16_t                 sport = 0, dport = 0, virtual_type, virtual_id;
         u_int16_t                 bproto_sum = 0, bip_sum = 0;
         u_int8_t                 icmptype = 0, icmpcode = 0;
         struct pf_kanchor_stackframe        anchor_stack[PF_ANCHOR_STACKSIZE];
if (inp != NULL) {
                 pd->lookup.gid = inp->inp_cred->cr_groups[0];
                 pd->lookup.done = 1;
         }
 
         switch (pd->proto) {
         case IPPROTO_TCP:
                 sport = th->th_sport;
                 dport = th->th_dport;
-                hdrlen = sizeof(*th);
                 break;
         case IPPROTO_UDP:
                 sport = pd->hdr.udp.uh_sport;
                 dport = pd->hdr.udp.uh_dport;
-                hdrlen = sizeof(pd->hdr.udp);
                 break;
         case IPPROTO_SCTP:
                 sport = pd->hdr.sctp.src_port;
                 dport = pd->hdr.sctp.dest_port;
-                hdrlen = sizeof(pd->hdr.sctp);
                 break;
 #ifdef INET
         case IPPROTO_ICMP:
                 if (pd->af != AF_INET)
                         break;
-                hdrlen = sizeof(pd->hdr.icmp);
                 icmptype = pd->hdr.icmp.icmp_type;
                 icmpcode = pd->hdr.icmp.icmp_code;
                 state_icmp = pf_icmp_mapping(pd, icmptype,
                     &icmp_dir, &multi, &virtual_id, &virtual_type);
                 if (icmp_dir == PF_IN) {
                         sport = virtual_id;
                         dport = virtual_type;
                 } else {
                         sport = virtual_type;
                         dport = virtual_id;
                 }
                 break;
 #endif /* INET */
 #ifdef INET6
         case IPPROTO_ICMPV6:
                 if (af != AF_INET6)
                         break;
-                hdrlen = sizeof(pd->hdr.icmp6);
                 icmptype = pd->hdr.icmp6.icmp6_type;
                 icmpcode = pd->hdr.icmp6.icmp6_code;
                 state_icmp = pf_icmp_mapping(pd, icmptype,
                     &icmp_dir, &multi, &virtual_id, &virtual_type);
                 if (icmp_dir == PF_IN) {
                         sport = virtual_id;
                         dport = virtual_type;
                 } else {
                         sport = virtual_type;
                         dport = virtual_id;
                 }
 
                 break;
 #endif /* INET6 */
         default:
-                sport = dport = hdrlen = 0;
+                sport = dport = 0;
                 break;
         }
 
         r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr);
 
         /* check packet for BINAT/NAT/RDR */
         transerror = pf_get_translation(pd, m, off, kif, &nsn, &sk,
             &nk, saddr, daddr, sport, dport, anchor_stack, &nr, &udp_mapping);
case  SCTP_ADD_IP_ADDRESS: {
                         PF_RULES_RLOCK();
                         sm = NULL;
                         /*
                          * New connections need to be floating, because
                          * we cannot know what interfaces it will use.
                          * That's why we pass V_pfi_all rather than kif.
                          */
                         ret = pf_test_rule(&r, &sm, V_pfi_all,
-                            j->m, off, &j->pd, &ra, &rs, NULL);
+                            j->m, off, &j->pd, &ra, &rs, NULL,
+                            sizeof(j->pd.hdr.sctp));
                         PF_RULES_RUNLOCK();
                         SDT_PROBE4(pf, sctp, multihome, test, kif, r, j->m, ret);
                         if (ret != PF_DROP && sm != NULL) {
                                 /* Inherit v_tag values. */
                                 if (sm->direction == s->direction) {
                                         sm->src.scrub->pfss_v_tag = s->src.scrub->pfss_v_tag;
                                         sm->dst.scrub->pfss_v_tag = s->dst.scrub->pfss_v_tag;
                                 } else {
if (pf_pdesc_to_dnflow(pd, r, s, &dnflow)) {
                                 pf_dummynet_flag_remove(*m0, pd->pf_mtag);
                         }
                 }
         }
 
         return (0);
 }
 
+int
+pf_setup_pdesc(sa_family_t af, int dir, struct pf_pdesc *pd, struct mbuf *m,
+    u_short *action, u_short *reason, struct pfi_kkif *kif, struct pf_krule **a,
+    struct pf_krule **r, struct pf_kruleset **ruleset, int *off, int *hdrlen,
+    struct pf_rule_actions *default_actions)
+{
+
+        TAILQ_INIT(&pd->sctp_multihome_jobs);
+        if (default_actions != NULL)
+                memcpy(&pd->act, default_actions, sizeof(pd->act));
+        pd->pf_mtag = pf_find_mtag(m);
+
+        if (pd->pf_mtag && pd->pf_mtag->dnpipe) {
+                pd->act.dnpipe = pd->pf_mtag->dnpipe;
+                pd->act.flags = pd->pf_mtag->dnflags;
+        }
+
+        pd->af = af;
+
+        switch (af) {
 #ifdef INET
+        case AF_INET: {
+                struct ip *h;
+
+                h = mtod(m, struct ip *);
+                *off = h->ip_hl << 2;
+                if (*off < (int)sizeof(*h)) {
+                        *action = PF_DROP;
+                        REASON_SET(reason, PFRES_SHORT);
+                        return (-1);
+                }
+                pd->src = (struct pf_addr *)&h->ip_src;
+                pd->dst = (struct pf_addr *)&h->ip_dst;
+                pd->sport = pd->dport = NULL;
+                pd->ip_sum = &h->ip_sum;
+                pd->proto_sum = NULL;
+                pd->proto = h->ip_p;
+                pd->dir = dir;
+                pd->sidx = (dir == PF_IN) ? 0 : 1;
+                pd->didx = (dir == PF_IN) ? 1 : 0;
+                pd->tos = h->ip_tos;
+                pd->tot_len = ntohs(h->ip_len);
+                pd->act.rtableid = -1;
+
+                /* fragments not reassembled handled later */
+                if (h->ip_off & htons(IP_MF | IP_OFFMASK))
+                        return (0);
+
+                switch (h->ip_p) {
+                case IPPROTO_TCP: {
+                        struct tcphdr *th = &pd->hdr.tcp;
+
+                        if (!pf_pull_hdr(m, *off, th, sizeof(*th), action,
+                                reason, AF_INET))
+                                return (-1);
+                        *hdrlen = sizeof(*th);
+                        pd->p_len = pd->tot_len - *off - (th->th_off << 2);
+                        pd->sport = &th->th_sport;
+                        pd->dport = &th->th_dport;
+                        break;
+                }
+                case IPPROTO_UDP: {
+                        struct udphdr *uh = &pd->hdr.udp;
+
+                        if (!pf_pull_hdr(m, *off, uh, sizeof(*uh), action,
+                                reason, AF_INET))
+                                return (-1);
+                        *hdrlen = sizeof(*uh);
+                        if (uh->uh_dport == 0 ||
+                            ntohs(uh->uh_ulen) > m->m_pkthdr.len - *off ||
+                            ntohs(uh->uh_ulen) < sizeof(struct udphdr)) {
+                                *action = PF_DROP;
+                                REASON_SET(reason, PFRES_SHORT);
+                                return (-1);
+                        }
+                        pd->sport = &uh->uh_sport;
+                        pd->dport = &uh->uh_dport;
+                        break;
+                }
+                case IPPROTO_SCTP: {
+                        if (!pf_pull_hdr(m, *off, &pd->hdr.sctp, sizeof(pd->hdr.sctp),
+                            action, reason, AF_INET)) {
+                                return (-1);
+                        }
+                        *hdrlen = sizeof(pd->hdr.sctp);
+                        pd->p_len = pd->tot_len - *off;
+
+                        pd->sport = &pd->hdr.sctp.src_port;
+                        pd->dport = &pd->hdr.sctp.dest_port;
+                        if (pd->hdr.sctp.src_port == 0 || pd->hdr.sctp.dest_port == 0) {
+                                *action = PF_DROP;
+                                REASON_SET(reason, PFRES_SHORT);
+                                return (-1);
+                        }
+                        if (pf_scan_sctp(m, *off, pd, kif) != PF_PASS) {
+                                *action = PF_DROP;
+                                REASON_SET(reason, PFRES_SHORT);
+                                return (-1);
+                        }
+                        break;
+                }
+                case IPPROTO_ICMP: {
+                        if (!pf_pull_hdr(m, *off, &pd->hdr.icmp, ICMP_MINLEN,
+                                action, reason, AF_INET))
+                                return (-1);
+                        *hdrlen = ICMP_MINLEN;
+                        break;
+                }
+                }
+                break;
+        }
+#endif
+#ifdef INET6
+        case AF_INET6: {
+                struct ip6_hdr *h;
+                int terminal = 0;
+
+                h = mtod(m, struct ip6_hdr *);
+                pd->src = (struct pf_addr *)&h->ip6_src;
+                pd->dst = (struct pf_addr *)&h->ip6_dst;
+                pd->sport = pd->dport = NULL;
+                pd->ip_sum = NULL;
+                pd->proto_sum = NULL;
+                pd->dir = dir;
+                pd->sidx = (dir == PF_IN) ? 0 : 1;
+                pd->didx = (dir == PF_IN) ? 1 : 0;
+                pd->tos = IPV6_DSCP(h);
+                pd->tot_len = ntohs(h->ip6_plen) + sizeof(struct ip6_hdr);
+                *off = ((caddr_t)h - m->m_data) + sizeof(struct ip6_hdr);
+                pd->proto = h->ip6_nxt;
+                pd->act.rtableid = -1;
+
+                do {
+                        switch (pd->proto) {
+                        case IPPROTO_FRAGMENT:
+                                if (kif == NULL || r == NULL) /* pflog */
+                                        *action = PF_DROP;
+                                else
+                                        *action = pf_test_fragment(r, kif,
+                                            m, h, pd, a, ruleset);
+                                if (*action == PF_DROP)
+                                        REASON_SET(reason, PFRES_FRAG);
+                                return (-1);
+                        case IPPROTO_ROUTING: {
+                                struct ip6_rthdr rthdr;
+
+                                if (pd->rh_cnt++) {
+                                        DPFPRINTF(PF_DEBUG_MISC,
+                                            ("pf: IPv6 more than one rthdr"));
+                                        *action = PF_DROP;
+                                        REASON_SET(reason, PFRES_IPOPTIONS);
+                                        return (-1);
+                                }
+                                if (!pf_pull_hdr(m, *off, &rthdr, sizeof(rthdr),
+                                        NULL, reason, pd->af)) {
+                                        DPFPRINTF(PF_DEBUG_MISC,
+                                            ("pf: IPv6 short rthdr"));
+                                        *action = PF_DROP;
+                                        REASON_SET(reason, PFRES_SHORT);
+                                        return (-1);
+                                }
+                                if (rthdr.ip6r_type == IPV6_RTHDR_TYPE_0) {
+                                        DPFPRINTF(PF_DEBUG_MISC,
+                                            ("pf: IPv6 rthdr0"));
+                                        *action = PF_DROP;
+                                        REASON_SET(reason, PFRES_IPOPTIONS);
+                                        return (-1);
+                                }
+                                /* FALLTHROUGH */
+                        }
+                        case IPPROTO_AH:
+                        case IPPROTO_HOPOPTS:
+                        case IPPROTO_DSTOPTS: {
+                                /* get next header and header length */
+                                struct ip6_ext opt6;
+
+                                if (!pf_pull_hdr(m, *off, &opt6, sizeof(opt6),
+                                        NULL, reason, pd->af)) {
+                                        DPFPRINTF(PF_DEBUG_MISC,
+                                            ("pf: IPv6 short opt"));
+                                        *action = PF_DROP;
+                                        return (-1);
+                                }
+                                if (pd->proto == IPPROTO_AH)
+                                        *off += (opt6.ip6e_len + 2) * 4;
+                                else
+                                        *off += (opt6.ip6e_len + 1) * 8;
+                                pd->proto = opt6.ip6e_nxt;
+                                /* goto the next header */
+                                break;
+                        }
+                        default:
+                                terminal++;
+                                break;
+                        }
+                } while (!terminal);
+
+                switch (pd->proto) {
+                case IPPROTO_TCP: {
+                        struct tcphdr *th = &pd->hdr.tcp;
+
+                        if (!pf_pull_hdr(m, *off, th, sizeof(*th), action,
+                                reason, AF_INET6))
+                                return (-1);
+                        *hdrlen = sizeof(*th);
+                        pd->p_len = pd->tot_len - *off - (th->th_off << 2);
+                        pd->sport = &th->th_sport;
+                        pd->dport = &th->th_dport;
+                        break;
+                }
+                case IPPROTO_UDP: {
+                        struct udphdr *uh = &pd->hdr.udp;
+
+                        if (!pf_pull_hdr(m, *off, uh, sizeof(*uh), action,
+                                reason, AF_INET6))
+                                return (-1);
+                        *hdrlen = sizeof(*uh);
+                        if (uh->uh_dport == 0 ||
+                            ntohs(uh->uh_ulen) > m->m_pkthdr.len - *off ||
+                            ntohs(uh->uh_ulen) < sizeof(struct udphdr)) {
+                                *action = PF_DROP;
+                                REASON_SET(reason, PFRES_SHORT);
+                                return (-1);
+                        }
+                        pd->sport = &uh->uh_sport;
+                        pd->dport = &uh->uh_dport;
+                        break;
+                }
+                case IPPROTO_SCTP: {
+                        if (!pf_pull_hdr(m, *off, &pd->hdr.sctp, sizeof(pd->hdr.sctp),
+                            action, reason, AF_INET6)) {
+                                return (-1);
+                        }
+                        *hdrlen = sizeof(pd->hdr.sctp);
+                        pd->p_len = pd->tot_len - *off;
+
+                        pd->sport = &pd->hdr.sctp.src_port;
+                        pd->dport = &pd->hdr.sctp.dest_port;
+                        if (pd->hdr.sctp.src_port == 0 || pd->hdr.sctp.dest_port == 0) {
+                                *action = PF_DROP;
+                                REASON_SET(reason, PFRES_SHORT);
+                                return (-1);
+                        }
+                        if (pf_scan_sctp(m, *off, pd, kif) != PF_PASS) {
+                                *action = PF_DROP;
+                                REASON_SET(reason, PFRES_SHORT);
+                                return (-1);
+                        }
+                        break;
+                }
+                case IPPROTO_ICMPV6: {
+                        size_t icmp_hlen = sizeof(struct icmp6_hdr);
+
+                        if (!pf_pull_hdr(m, *off, &pd->hdr.icmp6, icmp_hlen,
+                                action, reason, AF_INET6))
+                                return (-1);
+                        /* ICMP headers we look further into to match state */
+                        switch (pd->hdr.icmp6.icmp6_type) {
+                        case MLD_LISTENER_QUERY:
+                        case MLD_LISTENER_REPORT:
+                                icmp_hlen = sizeof(struct mld_hdr);
+                                break;
+                        case ND_NEIGHBOR_SOLICIT:
+                        case ND_NEIGHBOR_ADVERT:
+                                icmp_hlen = sizeof(struct nd_neighbor_solicit);
+                                break;
+                        }
+                        if (icmp_hlen > sizeof(struct icmp6_hdr) &&
+                            !pf_pull_hdr(m, *off, &pd->hdr.icmp6, icmp_hlen,
+                                action, reason, AF_INET6))
+                                return (-1);
+                        *hdrlen = icmp_hlen;
+                        break;
+                }
+                }
+                break;
+        }
+#endif
+        default:
+                panic("pf_setup_pdesc called with illegal af %u", af);
+        }
+        return (0);
+}
+
+#ifdef INET
 int
 pf_test(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0,
     struct inpcb *inp, struct pf_rule_actions *default_actions)
 {
         struct pfi_kkif         *kif;
         u_short                         action, reason = 0;
         struct mbuf                *m = *m0;
         struct ip                *h = NULL;
         struct m_tag            *mtag;
         struct pf_krule                *a = NULL, *r = &V_pf_default_rule, *tr, *nr;
         struct pf_kstate        *s = NULL;
         struct pf_kruleset        *ruleset = NULL;
         struct pf_pdesc          pd;
-        int                         off, dirndx, use_2nd_queue = 0;
+        int                         off, hdrlen, dirndx, use_2nd_queue = 0;
         uint16_t                 tag;
         uint8_t                  rt;
 
         PF_RULES_RLOCK_TRACKER;
         KASSERT(dir == PF_IN || dir == PF_OUT, ("%s: bad direction %d\n", __func__, dir));
         M_ASSERTPKTHDR(m);
 
         if (!V_pf_status.running)
pf_test(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0,
         }
 
         if (__predict_false(! M_WRITABLE(*m0))) {
                 m = *m0 = m_unshare(*m0, M_NOWAIT);
                 if (*m0 == NULL)
                         return (PF_DROP);
         }
 
+        if (__predict_false(m->m_len < sizeof(struct ip)) &&
+            (m = *m0 = m_pullup(*m0, sizeof(struct ip))) == NULL) {
+                DPFPRINTF(PF_DEBUG_URGENT,
+                    ("pf_test: m_len < sizeof(struct ip), pullup failed\n"));
+                PF_RULES_RUNLOCK();
+                return (PF_DROP);
+        }
+
         memset(&pd, 0, sizeof(pd));
-        TAILQ_INIT(&pd.sctp_multihome_jobs);
-        if (default_actions != NULL)
-                memcpy(&pd.act, default_actions, sizeof(pd.act));
-        pd.pf_mtag = pf_find_mtag(m);
+        pd.dir = dir;
 
+        if (pf_normalize_ip(m0, kif, &reason, &pd) != PF_PASS) {
+                /* We do IP header normalization and packet reassembly here */
+                action = PF_DROP;
+                goto done;
+        }
+        m = *m0;        /* pf_normalize messes with m0 */
+        h = mtod(m, struct ip *);
+
+        if (pf_setup_pdesc(AF_INET, dir, &pd, m, &action, &reason, kif, &a, &r,
+                &ruleset, &off, &hdrlen, default_actions) == -1) {
+                if (action != PF_PASS)
+                        pd.act.log |= PF_LOG_FORCE;
+                goto done;
+        }
+
         if (pd.pf_mtag != NULL && (pd.pf_mtag->flags & PF_MTAG_FLAG_ROUTE_TO)) {
                 pd.pf_mtag->flags &= ~PF_MTAG_FLAG_ROUTE_TO;
 
                 ifp = ifnet_byindexgen(pd.pf_mtag->if_index,
                     pd.pf_mtag->if_idxgen);
                 if (ifp == NULL || ifp->if_flags & IFF_DYING) {
                         PF_RULES_RUNLOCK();
                         m_freem(*m0);
                         *m0 = NULL;
                         return (PF_PASS);
                 }
                 PF_RULES_RUNLOCK();
                 (ifp->if_output)(ifp, m, sintosa(&pd.pf_mtag->dst), NULL);
                 *m0 = NULL;
                 return (PF_PASS);
         }
 
-        if (pd.pf_mtag && pd.pf_mtag->dnpipe) {
-                pd.act.dnpipe = pd.pf_mtag->dnpipe;
-                pd.act.flags = pd.pf_mtag->dnflags;
-        }
-
         if (ip_dn_io_ptr != NULL && pd.pf_mtag != NULL &&
             pd.pf_mtag->flags & PF_MTAG_FLAG_DUMMYNET) {
                 /* Dummynet re-injects packets after they've
                  * completed their delay. We've already
                  * processed them, so pass unconditionally. */
 
                 /* But only once. We may see the packet multiple times (e.g.
                  * PFIL_IN/PFIL_OUT). */
                 pf_dummynet_flag_remove(m, pd.pf_mtag);
                 PF_RULES_RUNLOCK();
 
                 return (PF_PASS);
         }
 
-        pd.sport = pd.dport = NULL;
-        pd.proto_sum = NULL;
-        pd.dir = dir;
-        pd.sidx = (dir == PF_IN) ? 0 : 1;
-        pd.didx = (dir == PF_IN) ? 1 : 0;
-        pd.af = AF_INET;
-        pd.act.rtableid = -1;
-
-        if (__predict_false(m->m_len < sizeof(struct ip)) &&
-            (m = *m0 = m_pullup(*m0, sizeof(struct ip))) == NULL) {
-                DPFPRINTF(PF_DEBUG_URGENT,
-                    ("pf_test: m_len < sizeof(struct ip), pullup failed\n"));
-                PF_RULES_RUNLOCK();
-                return (PF_DROP);
-        }
-        h = mtod(m, struct ip *);
-        off = h->ip_hl << 2;
-
         if (__predict_false(ip_divert_ptr != NULL) &&
             ((mtag = m_tag_locate(m, MTAG_PF_DIVERT, 0, NULL)) != NULL)) {
                 struct pf_divert_mtag *dt = (struct pf_divert_mtag *)(mtag+1);
                 if ((dt->idir == PF_DIVERT_MTAG_DIR_IN && dir == PF_IN) ||
                     (dt->idir == PF_DIVERT_MTAG_DIR_OUT && dir == PF_OUT)) {
                         if (pd.pf_mtag == NULL &&
                             ((pd.pf_mtag = pf_get_mtag(m)) == NULL)) {
                                 action = PF_DROP;
                                 goto done;
                         }
                         pd.pf_mtag->flags |= PF_MTAG_FLAG_PACKET_LOOPED;
                 }
                 if (pd.pf_mtag && pd.pf_mtag->flags & PF_MTAG_FLAG_FASTFWD_OURS_PRESENT) {
                         m->m_flags |= M_FASTFWD_OURS;
                         pd.pf_mtag->flags &= ~PF_MTAG_FLAG_FASTFWD_OURS_PRESENT;
                 }
                 m_tag_delete(m, mtag);
 
                 mtag = m_tag_locate(m, MTAG_IPFW_RULE, 0, NULL);
                 if (mtag != NULL)
                         m_tag_delete(m, mtag);
-        } else if (pf_normalize_ip(m0, kif, &reason, &pd) != PF_PASS) {
-                /* We do IP header normalization and packet reassembly here */
-                action = PF_DROP;
-                goto done;
         }
-        m = *m0;        /* pf_normalize messes with m0 */
-        h = mtod(m, struct ip *);
 
-        off = h->ip_hl << 2;
-        if (off < (int)sizeof(struct ip)) {
-                action = PF_DROP;
-                REASON_SET(&reason, PFRES_SHORT);
-                pd.act.log = PF_LOG_FORCE;
-                goto done;
-        }
-
-        pd.src = (struct pf_addr *)&h->ip_src;
-        pd.dst = (struct pf_addr *)&h->ip_dst;
-        pd.ip_sum = &h->ip_sum;
-        pd.proto = h->ip_p;
-        pd.tos = h->ip_tos & ~IPTOS_ECN_MASK;
-        pd.tot_len = ntohs(h->ip_len);
-
         /* handle fragments that didn't get reassembled by normalization */
         if (h->ip_off & htons(IP_MF | IP_OFFMASK)) {
                 action = pf_test_fragment(&r, kif, m, h, &pd, &a, &ruleset);
                 goto done;
         }
 
         switch (h->ip_p) {
         case IPPROTO_TCP: {
-                if (!pf_pull_hdr(m, off, &pd.hdr.tcp, sizeof(pd.hdr.tcp),
-                    &action, &reason, AF_INET)) {
-                        if (action != PF_PASS)
-                                pd.act.log = PF_LOG_FORCE;
-                        goto done;
-                }
-                pd.p_len = pd.tot_len - off - (pd.hdr.tcp.th_off << 2);
 
-                pd.sport = &pd.hdr.tcp.th_sport;
-                pd.dport = &pd.hdr.tcp.th_dport;
-
                 /* Respond to SYN with a syncookie. */
                 if ((pd.hdr.tcp.th_flags & (TH_SYN|TH_ACK|TH_RST)) == TH_SYN &&
                     pd.dir == PF_IN && pf_synflood_check(&pd)) {
                         pf_syncookie_send(m, off, &pd);
                         action = PF_DROP;
                         break;
                 }
 
if (action == PF_PASS) {
 
                                 s->src.seqhi = ntohl(pd.hdr.tcp.th_ack) - 1;
                                 s->src.seqlo = ntohl(pd.hdr.tcp.th_seq) - 1;
                                 pf_set_protostate(s, PF_PEER_SRC, PF_TCPS_PROXY_DST);
                                 action = pf_synproxy(&pd, &s, &reason);
                                 break;
                         } else {
                                 action = pf_test_rule(&r, &s, kif, m, off, &pd,
-                                    &a, &ruleset, inp);
+                                    &a, &ruleset, inp, hdrlen);
                         }
                 }
                 break;
         }
 
         case IPPROTO_UDP: {
-                if (!pf_pull_hdr(m, off, &pd.hdr.udp, sizeof(pd.hdr.udp),
-                    &action, &reason, AF_INET)) {
-                        if (action != PF_PASS)
-                                pd.act.log = PF_LOG_FORCE;
-                        goto done;
-                }
-                pd.sport = &pd.hdr.udp.uh_sport;
-                pd.dport = &pd.hdr.udp.uh_dport;
-                if (pd.hdr.udp.uh_dport == 0 ||
-                    ntohs(pd.hdr.udp.uh_ulen) > m->m_pkthdr.len - off ||
-                    ntohs(pd.hdr.udp.uh_ulen) < sizeof(struct udphdr)) {
-                        action = PF_DROP;
-                        REASON_SET(&reason, PFRES_SHORT);
-                        goto done;
-                }
                 action = pf_test_state_udp(&s, kif, m, off, h, &pd);
                 if (action == PF_PASS) {
                         if (V_pfsync_update_state_ptr != NULL)
                                 V_pfsync_update_state_ptr(s);
                         r = s->rule.ptr;
                         a = s->anchor.ptr;
                 } else if (s == NULL)
                         action = pf_test_rule(&r, &s, kif, m, off, &pd,
-                            &a, &ruleset, inp);
+                            &a, &ruleset, inp, hdrlen);
                 break;
         }
 
         case IPPROTO_SCTP: {
-                if (!pf_pull_hdr(m, off, &pd.hdr.sctp, sizeof(pd.hdr.sctp),
-                    &action, &reason, AF_INET)) {
-                        if (action != PF_PASS)
-                                pd.act.log |= PF_LOG_FORCE;
-                        goto done;
-                }
-                pd.p_len = pd.tot_len - off;
-
-                pd.sport = &pd.hdr.sctp.src_port;
-                pd.dport = &pd.hdr.sctp.dest_port;
-                if (pd.hdr.sctp.src_port == 0 || pd.hdr.sctp.dest_port == 0) {
-                        action = PF_DROP;
-                        REASON_SET(&reason, PFRES_SHORT);
-                        goto done;
-                }
                 action = pf_normalize_sctp(dir, kif, m, 0, off, h, &pd);
                 if (action == PF_DROP)
                         goto done;
                 action = pf_test_state_sctp(&s, kif, m, off, h, &pd,
                     &reason);
                 if (action == PF_PASS) {
                         if (V_pfsync_update_state_ptr != NULL)
                                 V_pfsync_update_state_ptr(s);
                         r = s->rule.ptr;
                         a = s->anchor.ptr;
                 } else if (s == NULL) {
                         action = pf_test_rule(&r, &s, kif, m, off,
-                            &pd, &a, &ruleset, inp);
+                            &pd, &a, &ruleset, inp, hdrlen);
                 }
                 break;
         }
 
         case IPPROTO_ICMP: {
-                if (!pf_pull_hdr(m, off, &pd.hdr.icmp, ICMP_MINLEN,
-                    &action, &reason, AF_INET)) {
-                        if (action != PF_PASS)
-                                pd.act.log = PF_LOG_FORCE;
-                        goto done;
-                }
                 action = pf_test_state_icmp(&s, kif, m, off, h, &pd, &reason);
                 if (action == PF_PASS) {
                         if (V_pfsync_update_state_ptr != NULL)
                                 V_pfsync_update_state_ptr(s);
                         r = s->rule.ptr;
                         a = s->anchor.ptr;
                 } else if (s == NULL)
                         action = pf_test_rule(&r, &s, kif, m, off, &pd,
-                            &a, &ruleset, inp);
+                            &a, &ruleset, inp, hdrlen);
                 break;
         }
 
         case IPPROTO_ICMPV6: {
                 action = PF_DROP;
                 DPFPRINTF(PF_DEBUG_MISC,
                     ("pf: dropping IPv4 packet with ICMPv6 payload\n"));
                 goto done;
         }
 
         default:
                 action = pf_test_state_other(&s, kif, m, &pd);
                 if (action == PF_PASS) {
                         if (V_pfsync_update_state_ptr != NULL)
                                 V_pfsync_update_state_ptr(s);
                         r = s->rule.ptr;
                         a = s->anchor.ptr;
                 } else if (s == NULL)
                         action = pf_test_rule(&r, &s, kif, m, off, &pd,
-                            &a, &ruleset, inp);
+                            &a, &ruleset, inp, hdrlen);
                 break;
         }
 
 done:
         PF_RULES_RUNLOCK();
         if (action == PF_PASS && h->ip_hl > 5 &&
             !((s && s->state_flags & PFSTATE_ALLOWOPTS) || r->allow_opts)) {
                 action = PF_DROP;
pf_test6(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0, struct inpcb *inp,
         u_short                         action, reason = 0;
         struct mbuf                *m = *m0, *n = NULL;
         struct m_tag            *mtag;
         struct ip6_hdr                *h = NULL;
         struct pf_krule                *a = NULL, *r = &V_pf_default_rule, *tr, *nr;
         struct pf_kstate        *s = NULL;
         struct pf_kruleset        *ruleset = NULL;
         struct pf_pdesc          pd;
-        int                         off, terminal = 0, dirndx, rh_cnt = 0, use_2nd_queue = 0;
+        int                         off, hdrlen, dirndx, use_2nd_queue = 0;
         uint16_t                 tag;
         uint8_t                  rt;
 
         PF_RULES_RLOCK_TRACKER;
         KASSERT(dir == PF_IN || dir == PF_OUT, ("%s: bad direction %d\n", __func__, dir));
         M_ASSERTPKTHDR(m);
 
         if (!V_pf_status.running)
pf_test6(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0, struct inpcb *inp,
         }
 
         if (__predict_false(! M_WRITABLE(*m0))) {
                 m = *m0 = m_unshare(*m0, M_NOWAIT);
                 if (*m0 == NULL)
                         return (PF_DROP);
         }
 
+        if (__predict_false(m->m_len < sizeof(struct ip6_hdr)) &&
+            (m = *m0 = m_pullup(*m0, sizeof(struct ip6_hdr))) == NULL) {
+                DPFPRINTF(PF_DEBUG_URGENT,
+                    ("pf_test6: m_len < sizeof(struct ip6_hdr)"
+                     ", pullup failed\n"));
+                PF_RULES_RUNLOCK();
+                return (PF_DROP);
+        }
+
         memset(&pd, 0, sizeof(pd));
-        TAILQ_INIT(&pd.sctp_multihome_jobs);
-        if (default_actions != NULL)
-                memcpy(&pd.act, default_actions, sizeof(pd.act));
-        pd.pf_mtag = pf_find_mtag(m);
+        pd.dir = dir;
 
+        /* We do IP header normalization and packet reassembly here */
+        if (pf_normalize_ip6(m0, kif, &reason, &pd) != PF_PASS) {
+                action = PF_DROP;
+                goto done;
+        }
+        m = *m0;        /* pf_normalize messes with m0 */
+        h = mtod(m, struct ip6_hdr *);
+        off = ((caddr_t)h - m->m_data) + sizeof(struct ip6_hdr);
+
+        if (pf_setup_pdesc(AF_INET6, dir, &pd, m, &action, &reason, kif, &a, &r,
+                &ruleset, &off, &hdrlen, default_actions) == -1) {
+                if (action != PF_PASS)
+                        pd.act.log |= PF_LOG_FORCE;
+                goto done;
+        }
+
         if (pd.pf_mtag != NULL && (pd.pf_mtag->flags & PF_MTAG_FLAG_ROUTE_TO)) {
                 pd.pf_mtag->flags &= ~PF_MTAG_FLAG_ROUTE_TO;
 
                 ifp = ifnet_byindexgen(pd.pf_mtag->if_index,
                     pd.pf_mtag->if_idxgen);
                 if (ifp == NULL || ifp->if_flags & IFF_DYING) {
                         PF_RULES_RUNLOCK();
                         m_freem(*m0);
                         *m0 = NULL;
                         return (PF_PASS);
                 }
                 PF_RULES_RUNLOCK();
                 nd6_output_ifp(ifp, ifp, m,
                     (struct sockaddr_in6 *)&pd.pf_mtag->dst, NULL);
                 *m0 = NULL;
                 return (PF_PASS);
         }
 
-        if (pd.pf_mtag && pd.pf_mtag->dnpipe) {
-                pd.act.dnpipe = pd.pf_mtag->dnpipe;
-                pd.act.flags = pd.pf_mtag->dnflags;
-        }
-
         if (ip_dn_io_ptr != NULL && pd.pf_mtag != NULL &&
             pd.pf_mtag->flags & PF_MTAG_FLAG_DUMMYNET) {
                 pf_dummynet_flag_remove(m, pd.pf_mtag);
                 /* Dummynet re-injects packets after they've
                  * completed their delay. We've already
                  * processed them, so pass unconditionally. */
                 PF_RULES_RUNLOCK();
                 return (PF_PASS);
         }
 
-        pd.sport = pd.dport = NULL;
-        pd.ip_sum = NULL;
-        pd.proto_sum = NULL;
-        pd.dir = dir;
-        pd.sidx = (dir == PF_IN) ? 0 : 1;
-        pd.didx = (dir == PF_IN) ? 1 : 0;
-        pd.af = AF_INET6;
-        pd.act.rtableid = -1;
-
-        if (__predict_false(m->m_len < sizeof(struct ip6_hdr)) &&
-            (m = *m0 = m_pullup(*m0, sizeof(struct ip6_hdr))) == NULL) {
-                DPFPRINTF(PF_DEBUG_URGENT,
-                    ("pf_test6: m_len < sizeof(struct ip6_hdr)"
-                     ", pullup failed\n"));
-                PF_RULES_RUNLOCK();
-                return (PF_DROP);
-        }
-        h = mtod(m, struct ip6_hdr *);
-        off = ((caddr_t)h - m->m_data) + sizeof(struct ip6_hdr);
-
-        /* We do IP header normalization and packet reassembly here */
-        if (pf_normalize_ip6(m0, kif, &reason, &pd) != PF_PASS) {
-                action = PF_DROP;
-                goto done;
-        }
-        m = *m0;        /* pf_normalize messes with m0 */
-        h = mtod(m, struct ip6_hdr *);
-        off = ((caddr_t)h - m->m_data) + sizeof(struct ip6_hdr);
-
         /*
          * we do not support jumbogram.  if we keep going, zero ip6_plen
          * will do something bad, so drop the packet for now.
          */
         if (htons(h->ip6_plen) == 0) {
                 action = PF_DROP;
                 REASON_SET(&reason, PFRES_NORM);        /*XXX*/
                 goto done;
         }
 
-        pd.src = (struct pf_addr *)&h->ip6_src;
-        pd.dst = (struct pf_addr *)&h->ip6_dst;
-        pd.tos = IPV6_DSCP(h);
-        pd.tot_len = ntohs(h->ip6_plen) + sizeof(struct ip6_hdr);
-
-        pd.proto = h->ip6_nxt;
-        do {
-                switch (pd.proto) {
-                case IPPROTO_FRAGMENT:
-                        action = pf_test_fragment(&r, kif, m, h, &pd, &a,
-                            &ruleset);
-                        if (action == PF_DROP)
-                                REASON_SET(&reason, PFRES_FRAG);
-                        goto done;
-                case IPPROTO_ROUTING: {
-                        struct ip6_rthdr rthdr;
-
-                        if (rh_cnt++) {
-                                DPFPRINTF(PF_DEBUG_MISC,
-                                    ("pf: IPv6 more than one rthdr\n"));
-                                action = PF_DROP;
-                                REASON_SET(&reason, PFRES_IPOPTIONS);
-                                pd.act.log = PF_LOG_FORCE;
-                                goto done;
-                        }
-                        if (!pf_pull_hdr(m, off, &rthdr, sizeof(rthdr), NULL,
-                            &reason, pd.af)) {
-                                DPFPRINTF(PF_DEBUG_MISC,
-                                    ("pf: IPv6 short rthdr\n"));
-                                action = PF_DROP;
-                                REASON_SET(&reason, PFRES_SHORT);
-                                pd.act.log = PF_LOG_FORCE;
-                                goto done;
-                        }
-                        if (rthdr.ip6r_type == IPV6_RTHDR_TYPE_0) {
-                                DPFPRINTF(PF_DEBUG_MISC,
-                                    ("pf: IPv6 rthdr0\n"));
-                                action = PF_DROP;
-                                REASON_SET(&reason, PFRES_IPOPTIONS);
-                                pd.act.log = PF_LOG_FORCE;
-                                goto done;
-                        }
-                        /* FALLTHROUGH */
-                }
-                case IPPROTO_AH:
-                case IPPROTO_HOPOPTS:
-                case IPPROTO_DSTOPTS: {
-                        /* get next header and header length */
-                        struct ip6_ext  opt6;
-
-                        if (!pf_pull_hdr(m, off, &opt6, sizeof(opt6),
-                            NULL, &reason, pd.af)) {
-                                DPFPRINTF(PF_DEBUG_MISC,
-                                    ("pf: IPv6 short opt\n"));
-                                action = PF_DROP;
-                                pd.act.log = PF_LOG_FORCE;
-                                goto done;
-                        }
-                        if (pd.proto == IPPROTO_AH)
-                                off += (opt6.ip6e_len + 2) * 4;
-                        else
-                                off += (opt6.ip6e_len + 1) * 8;
-                        pd.proto = opt6.ip6e_nxt;
-                        /* goto the next header */
-                        break;
-                }
-                default:
-                        terminal++;
-                        break;
-                }
-        } while (!terminal);
-
         /* if there's no routing header, use unmodified mbuf for checksumming */
         if (!n)
                 n = m;
 
         switch (pd.proto) {
         case IPPROTO_TCP: {
-                if (!pf_pull_hdr(m, off, &pd.hdr.tcp, sizeof(pd.hdr.tcp),
-                    &action, &reason, AF_INET6)) {
-                        if (action != PF_PASS)
-                                pd.act.log |= PF_LOG_FORCE;
-                        goto done;
-                }
-                pd.p_len = pd.tot_len - off - (pd.hdr.tcp.th_off << 2);
-                pd.sport = &pd.hdr.tcp.th_sport;
-                pd.dport = &pd.hdr.tcp.th_dport;
-
                 /* Respond to SYN with a syncookie. */
                 if ((pd.hdr.tcp.th_flags & (TH_SYN|TH_ACK|TH_RST)) == TH_SYN &&
                     pd.dir == PF_IN && pf_synflood_check(&pd)) {
                         pf_syncookie_send(m, off, &pd);
                         action = PF_DROP;
                         break;
                 }
 
if (action == PF_PASS) {
                                 s->src.seqhi = ntohl(pd.hdr.tcp.th_ack) - 1;
                                 s->src.seqlo = ntohl(pd.hdr.tcp.th_seq) - 1;
                                 pf_set_protostate(s, PF_PEER_SRC, PF_TCPS_PROXY_DST);
 
                                 action = pf_synproxy(&pd, &s, &reason);
                                 break;
                         } else {
                                 action = pf_test_rule(&r, &s, kif, m, off, &pd,
-                                    &a, &ruleset, inp);
+                                    &a, &ruleset, inp, hdrlen);
                         }
                 }
                 break;
         }
 
         case IPPROTO_UDP: {
-                if (!pf_pull_hdr(m, off, &pd.hdr.udp, sizeof(pd.hdr.udp),
-                    &action, &reason, AF_INET6)) {
-                        if (action != PF_PASS)
-                                pd.act.log |= PF_LOG_FORCE;
-                        goto done;
-                }
-                pd.sport = &pd.hdr.udp.uh_sport;
-                pd.dport = &pd.hdr.udp.uh_dport;
-                if (pd.hdr.udp.uh_dport == 0 ||
-                    ntohs(pd.hdr.udp.uh_ulen) > m->m_pkthdr.len - off ||
-                    ntohs(pd.hdr.udp.uh_ulen) < sizeof(struct udphdr)) {
-                        action = PF_DROP;
-                        REASON_SET(&reason, PFRES_SHORT);
-                        goto done;
-                }
                 action = pf_test_state_udp(&s, kif, m, off, h, &pd);
                 if (action == PF_PASS) {
                         if (V_pfsync_update_state_ptr != NULL)
                                 V_pfsync_update_state_ptr(s);
                         r = s->rule.ptr;
                         a = s->anchor.ptr;
                 } else if (s == NULL)
                         action = pf_test_rule(&r, &s, kif, m, off, &pd,
-                            &a, &ruleset, inp);
+                            &a, &ruleset, inp, hdrlen);
                 break;
         }
 
         case IPPROTO_SCTP: {
-                if (!pf_pull_hdr(m, off, &pd.hdr.sctp, sizeof(pd.hdr.sctp),
-                    &action, &reason, AF_INET6)) {
-                        if (action != PF_PASS)
-                                pd.act.log |= PF_LOG_FORCE;
-                        goto done;
-                }
-                pd.sport = &pd.hdr.sctp.src_port;
-                pd.dport = &pd.hdr.sctp.dest_port;
-                if (pd.hdr.sctp.src_port == 0 || pd.hdr.sctp.dest_port == 0) {
-                        action = PF_DROP;
-                        REASON_SET(&reason, PFRES_SHORT);
-                        goto done;
-                }
                 action = pf_normalize_sctp(dir, kif, m, 0, off, h, &pd);
                 if (action == PF_DROP)
                         goto done;
                 action = pf_test_state_sctp(&s, kif, m, off, h, &pd,
                     &reason);
                 if (action == PF_PASS) {
                         if (V_pfsync_update_state_ptr != NULL)
                                 V_pfsync_update_state_ptr(s);
                         r = s->rule.ptr;
                         a = s->anchor.ptr;
                 } else if (s == NULL) {
                         action = pf_test_rule(&r, &s, kif, m, off,
-                            &pd, &a, &ruleset, inp);
+                            &pd, &a, &ruleset, inp, hdrlen);
                 }
                 break;
         }
 
         case IPPROTO_ICMP: {
                 action = PF_DROP;
                 DPFPRINTF(PF_DEBUG_MISC,
                     ("pf: dropping IPv6 packet with ICMPv4 payload\n"));
                 goto done;
         }
 
         case IPPROTO_ICMPV6: {
-                if (!pf_pull_hdr(m, off, &pd.hdr.icmp6, sizeof(pd.hdr.icmp6),
-                    &action, &reason, AF_INET6)) {
-                        if (action != PF_PASS)
-                                pd.act.log |= PF_LOG_FORCE;
-                        goto done;
-                }
                 action = pf_test_state_icmp(&s, kif, m, off, h, &pd, &reason);
                 if (action == PF_PASS) {
                         if (V_pfsync_update_state_ptr != NULL)
                                 V_pfsync_update_state_ptr(s);
                         r = s->rule.ptr;
                         a = s->anchor.ptr;
                 } else if (s == NULL)
                         action = pf_test_rule(&r, &s, kif, m, off, &pd,
-                            &a, &ruleset, inp);
+                            &a, &ruleset, inp, hdrlen);
                 break;
         }
 
         default:
                 action = pf_test_state_other(&s, kif, m, &pd);
                 if (action == PF_PASS) {
                         if (V_pfsync_update_state_ptr != NULL)
                                 V_pfsync_update_state_ptr(s);
                         r = s->rule.ptr;
                         a = s->anchor.ptr;
                 } else if (s == NULL)
                         action = pf_test_rule(&r, &s, kif, m, off, &pd,
-                            &a, &ruleset, inp);
+                            &a, &ruleset, inp, hdrlen);
                 break;
         }
 
 done:
         PF_RULES_RUNLOCK();
         if (n != m) {
                 m_freem(n);
                 n = NULL;
         }
 
         /* handle dangerous IPv6 extension headers. */
-        if (action == PF_PASS && rh_cnt &&
+        if (action == PF_PASS && pd.rh_cnt &&
             !((s && s->state_flags & PFSTATE_ALLOWOPTS) || r->allow_opts)) {
                 action = PF_DROP;
                 REASON_SET(&reason, PFRES_IPOPTIONS);
                 pd.act.log = r->log;
                 DPFPRINTF(PF_DEBUG_MISC,
                     ("pf: dropping packet with dangerous v6 headers\n"));
         }
 

head/www/gitea/distinfo

 static int                 pf_dummynet_route(struct pf_pdesc *,
                             struct pf_kstate *, struct pf_krule *,
                             struct ifnet *, struct sockaddr *, struct mbuf **);
 static int                 pf_test_eth_rule(int, struct pfi_kkif *,
                             struct mbuf **);
 static int                 pf_test_rule(struct pf_krule **, struct pf_kstate **,
                             struct pfi_kkif *, struct mbuf *, int,
                             struct pf_pdesc *, struct pf_krule **,
-                            struct pf_kruleset **, struct inpcb *);
+                            struct pf_kruleset **, struct inpcb *, int);
 static int                 pf_create_state(struct pf_krule *, struct pf_krule *,
                             struct pf_krule *, struct pf_pdesc *,
                             struct pf_ksrc_node *, struct pf_state_key *,
                             struct pf_state_key *, struct mbuf *, int,
                             u_int16_t, u_int16_t, int *, struct pfi_kkif *,
                             struct pf_kstate **, int, u_int16_t, u_int16_t,
                             int, struct pf_krule_slist *, struct pf_udp_mapping *);
 static int                 pf_state_key_addr_setup(struct pf_pdesc *, struct mbuf *,
#endif /* INET6 */
         }
 
         return (action);
 }
 
 static int
 pf_test_rule(struct pf_krule **rm, struct pf_kstate **sm, struct pfi_kkif *kif,
     struct mbuf *m, int off, struct pf_pdesc *pd, struct pf_krule **am,
-    struct pf_kruleset **rsm, struct inpcb *inp)
+    struct pf_kruleset **rsm, struct inpcb *inp, int hdrlen)
 {
         struct pf_krule                *nr = NULL;
         struct pf_addr                * const saddr = pd->src;
         struct pf_addr                * const daddr = pd->dst;
         sa_family_t                 af = pd->af;
         struct pf_krule                *r, *a = NULL;
         struct pf_kruleset        *ruleset = NULL;
         struct pf_krule_slist    match_rules;
         struct pf_krule_item    *ri;
         struct pf_ksrc_node        *nsn = NULL;
         struct tcphdr                *th = &pd->hdr.tcp;
         struct pf_state_key        *sk = NULL, *nk = NULL;
         u_short                  reason, transerror;
-        int                         rewrite = 0, hdrlen = 0;
+        int                      rewrite = 0;
         int                      tag = -1;
         int                      asd = 0;
         int                      match = 0;
         int                         state_icmp = 0, icmp_dir, multi;
         u_int16_t                 sport = 0, dport = 0, virtual_type, virtual_id;
         u_int16_t                 bproto_sum = 0, bip_sum = 0;
         u_int8_t                 icmptype = 0, icmpcode = 0;
         struct pf_kanchor_stackframe        anchor_stack[PF_ANCHOR_STACKSIZE];
if (inp != NULL) {
                 pd->lookup.gid = inp->inp_cred->cr_groups[0];
                 pd->lookup.done = 1;
         }
 
         switch (pd->proto) {
         case IPPROTO_TCP:
                 sport = th->th_sport;
                 dport = th->th_dport;
-                hdrlen = sizeof(*th);
                 break;
         case IPPROTO_UDP:
                 sport = pd->hdr.udp.uh_sport;
                 dport = pd->hdr.udp.uh_dport;
-                hdrlen = sizeof(pd->hdr.udp);
                 break;
         case IPPROTO_SCTP:
                 sport = pd->hdr.sctp.src_port;
                 dport = pd->hdr.sctp.dest_port;
-                hdrlen = sizeof(pd->hdr.sctp);
                 break;
 #ifdef INET
         case IPPROTO_ICMP:
                 if (pd->af != AF_INET)
                         break;
-                hdrlen = sizeof(pd->hdr.icmp);
                 icmptype = pd->hdr.icmp.icmp_type;
                 icmpcode = pd->hdr.icmp.icmp_code;
                 state_icmp = pf_icmp_mapping(pd, icmptype,
                     &icmp_dir, &multi, &virtual_id, &virtual_type);
                 if (icmp_dir == PF_IN) {
                         sport = virtual_id;
                         dport = virtual_type;
                 } else {
                         sport = virtual_type;
                         dport = virtual_id;
                 }
                 break;
 #endif /* INET */
 #ifdef INET6
         case IPPROTO_ICMPV6:
                 if (af != AF_INET6)
                         break;
-                hdrlen = sizeof(pd->hdr.icmp6);
                 icmptype = pd->hdr.icmp6.icmp6_type;
                 icmpcode = pd->hdr.icmp6.icmp6_code;
                 state_icmp = pf_icmp_mapping(pd, icmptype,
                     &icmp_dir, &multi, &virtual_id, &virtual_type);
                 if (icmp_dir == PF_IN) {
                         sport = virtual_id;
                         dport = virtual_type;
                 } else {
                         sport = virtual_type;
                         dport = virtual_id;
                 }
 
                 break;
 #endif /* INET6 */
         default:
-                sport = dport = hdrlen = 0;
+                sport = dport = 0;
                 break;
         }
 
         r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr);
 
         /* check packet for BINAT/NAT/RDR */
         transerror = pf_get_translation(pd, m, off, kif, &nsn, &sk,
             &nk, saddr, daddr, sport, dport, anchor_stack, &nr, &udp_mapping);
case  SCTP_ADD_IP_ADDRESS: {
                         PF_RULES_RLOCK();
                         sm = NULL;
                         /*
                          * New connections need to be floating, because
                          * we cannot know what interfaces it will use.
                          * That's why we pass V_pfi_all rather than kif.
                          */
                         ret = pf_test_rule(&r, &sm, V_pfi_all,
-                            j->m, off, &j->pd, &ra, &rs, NULL);
+                            j->m, off, &j->pd, &ra, &rs, NULL,
+                            sizeof(j->pd.hdr.sctp));
                         PF_RULES_RUNLOCK();
                         SDT_PROBE4(pf, sctp, multihome, test, kif, r, j->m, ret);
                         if (ret != PF_DROP && sm != NULL) {
                                 /* Inherit v_tag values. */
                                 if (sm->direction == s->direction) {
                                         sm->src.scrub->pfss_v_tag = s->src.scrub->pfss_v_tag;
                                         sm->dst.scrub->pfss_v_tag = s->dst.scrub->pfss_v_tag;
                                 } else {
if (pf_pdesc_to_dnflow(pd, r, s, &dnflow)) {
                                 pf_dummynet_flag_remove(*m0, pd->pf_mtag);
                         }
                 }
         }
 
         return (0);
 }
 
+int
+pf_setup_pdesc(sa_family_t af, int dir, struct pf_pdesc *pd, struct mbuf *m,
+    u_short *action, u_short *reason, struct pfi_kkif *kif, struct pf_krule **a,
+    struct pf_krule **r, struct pf_kruleset **ruleset, int *off, int *hdrlen,
+    struct pf_rule_actions *default_actions)
+{
+
+        TAILQ_INIT(&pd->sctp_multihome_jobs);
+        if (default_actions != NULL)
+                memcpy(&pd->act, default_actions, sizeof(pd->act));
+        pd->pf_mtag = pf_find_mtag(m);
+
+        if (pd->pf_mtag && pd->pf_mtag->dnpipe) {
+                pd->act.dnpipe = pd->pf_mtag->dnpipe;
+                pd->act.flags = pd->pf_mtag->dnflags;
+        }
+
+        pd->af = af;
+
+        switch (af) {
 #ifdef INET
+        case AF_INET: {
+                struct ip *h;
+
+                h = mtod(m, struct ip *);
+                *off = h->ip_hl << 2;
+                if (*off < (int)sizeof(*h)) {
+                        *action = PF_DROP;
+                        REASON_SET(reason, PFRES_SHORT);
+                        return (-1);
+                }
+                pd->src = (struct pf_addr *)&h->ip_src;
+                pd->dst = (struct pf_addr *)&h->ip_dst;
+                pd->sport = pd->dport = NULL;
+                pd->ip_sum = &h->ip_sum;
+                pd->proto_sum = NULL;
+                pd->proto = h->ip_p;
+                pd->dir = dir;
+                pd->sidx = (dir == PF_IN) ? 0 : 1;
+                pd->didx = (dir == PF_IN) ? 1 : 0;
+                pd->tos = h->ip_tos;
+                pd->tot_len = ntohs(h->ip_len);
+                pd->act.rtableid = -1;
+
+                /* fragments not reassembled handled later */
+                if (h->ip_off & htons(IP_MF | IP_OFFMASK))
+                        return (0);
+
+                switch (h->ip_p) {
+                case IPPROTO_TCP: {
+                        struct tcphdr *th = &pd->hdr.tcp;
+
+                        if (!pf_pull_hdr(m, *off, th, sizeof(*th), action,
+                                reason, AF_INET))
+                                return (-1);
+                        *hdrlen = sizeof(*th);
+                        pd->p_len = pd->tot_len - *off - (th->th_off << 2);
+                        pd->sport = &th->th_sport;
+                        pd->dport = &th->th_dport;
+                        break;
+                }
+                case IPPROTO_UDP: {
+                        struct udphdr *uh = &pd->hdr.udp;
+
+                        if (!pf_pull_hdr(m, *off, uh, sizeof(*uh), action,
+                                reason, AF_INET))
+                                return (-1);
+                        *hdrlen = sizeof(*uh);
+                        if (uh->uh_dport == 0 ||
+                            ntohs(uh->uh_ulen) > m->m_pkthdr.len - *off ||
+                            ntohs(uh->uh_ulen) < sizeof(struct udphdr)) {
+                                *action = PF_DROP;
+                                REASON_SET(reason, PFRES_SHORT);
+                                return (-1);
+                        }
+                        pd->sport = &uh->uh_sport;
+                        pd->dport = &uh->uh_dport;
+                        break;
+                }
+                case IPPROTO_SCTP: {
+                        if (!pf_pull_hdr(m, *off, &pd->hdr.sctp, sizeof(pd->hdr.sctp),
+                            action, reason, AF_INET)) {
+                                return (-1);
+                        }
+                        *hdrlen = sizeof(pd->hdr.sctp);
+                        pd->p_len = pd->tot_len - *off;
+
+                        pd->sport = &pd->hdr.sctp.src_port;
+                        pd->dport = &pd->hdr.sctp.dest_port;
+                        if (pd->hdr.sctp.src_port == 0 || pd->hdr.sctp.dest_port == 0) {
+                                *action = PF_DROP;
+                                REASON_SET(reason, PFRES_SHORT);
+                                return (-1);
+                        }
+                        if (pf_scan_sctp(m, *off, pd, kif) != PF_PASS) {
+                                *action = PF_DROP;
+                                REASON_SET(reason, PFRES_SHORT);
+                                return (-1);
+                        }
+                        break;
+                }
+                case IPPROTO_ICMP: {
+                        if (!pf_pull_hdr(m, *off, &pd->hdr.icmp, ICMP_MINLEN,
+                                action, reason, AF_INET))
+                                return (-1);
+                        *hdrlen = ICMP_MINLEN;
+                        break;
+                }
+                }
+                break;
+        }
+#endif
+#ifdef INET6
+        case AF_INET6: {
+                struct ip6_hdr *h;
+                int terminal = 0;
+
+                h = mtod(m, struct ip6_hdr *);
+                pd->src = (struct pf_addr *)&h->ip6_src;
+                pd->dst = (struct pf_addr *)&h->ip6_dst;
+                pd->sport = pd->dport = NULL;
+                pd->ip_sum = NULL;
+                pd->proto_sum = NULL;
+                pd->dir = dir;
+                pd->sidx = (dir == PF_IN) ? 0 : 1;
+                pd->didx = (dir == PF_IN) ? 1 : 0;
+                pd->tos = IPV6_DSCP(h);
+                pd->tot_len = ntohs(h->ip6_plen) + sizeof(struct ip6_hdr);
+                *off = ((caddr_t)h - m->m_data) + sizeof(struct ip6_hdr);
+                pd->proto = h->ip6_nxt;
+                pd->act.rtableid = -1;
+
+                do {
+                        switch (pd->proto) {
+                        case IPPROTO_FRAGMENT:
+                                if (kif == NULL || r == NULL) /* pflog */
+                                        *action = PF_DROP;
+                                else
+                                        *action = pf_test_fragment(r, kif,
+                                            m, h, pd, a, ruleset);
+                                if (*action == PF_DROP)
+                                        REASON_SET(reason, PFRES_FRAG);
+                                return (-1);
+                        case IPPROTO_ROUTING: {
+                                struct ip6_rthdr rthdr;
+
+                                if (pd->rh_cnt++) {
+                                        DPFPRINTF(PF_DEBUG_MISC,
+                                            ("pf: IPv6 more than one rthdr"));
+                                        *action = PF_DROP;
+                                        REASON_SET(reason, PFRES_IPOPTIONS);
+                                        return (-1);
+                                }
+                                if (!pf_pull_hdr(m, *off, &rthdr, sizeof(rthdr),
+                                        NULL, reason, pd->af)) {
+                                        DPFPRINTF(PF_DEBUG_MISC,
+                                            ("pf: IPv6 short rthdr"));
+                                        *action = PF_DROP;
+                                        REASON_SET(reason, PFRES_SHORT);
+                                        return (-1);
+                                }
+                                if (rthdr.ip6r_type == IPV6_RTHDR_TYPE_0) {
+                                        DPFPRINTF(PF_DEBUG_MISC,
+                                            ("pf: IPv6 rthdr0"));
+                                        *action = PF_DROP;
+                                        REASON_SET(reason, PFRES_IPOPTIONS);
+                                        return (-1);
+                                }
+                                /* FALLTHROUGH */
+                        }
+                        case IPPROTO_AH:
+                        case IPPROTO_HOPOPTS:
+                        case IPPROTO_DSTOPTS: {
+                                /* get next header and header length */
+                                struct ip6_ext opt6;
+
+                                if (!pf_pull_hdr(m, *off, &opt6, sizeof(opt6),
+                                        NULL, reason, pd->af)) {
+                                        DPFPRINTF(PF_DEBUG_MISC,
+                                            ("pf: IPv6 short opt"));
+                                        *action = PF_DROP;
+                                        return (-1);
+                                }
+                                if (pd->proto == IPPROTO_AH)
+                                        *off += (opt6.ip6e_len + 2) * 4;
+                                else
+                                        *off += (opt6.ip6e_len + 1) * 8;
+                                pd->proto = opt6.ip6e_nxt;
+                                /* goto the next header */
+                                break;
+                        }
+                        default:
+                                terminal++;
+                                break;
+                        }
+                } while (!terminal);
+
+                switch (pd->proto) {
+                case IPPROTO_TCP: {
+                        struct tcphdr *th = &pd->hdr.tcp;
+
+                        if (!pf_pull_hdr(m, *off, th, sizeof(*th), action,
+                                reason, AF_INET6))
+                                return (-1);
+                        *hdrlen = sizeof(*th);
+                        pd->p_len = pd->tot_len - *off - (th->th_off << 2);
+                        pd->sport = &th->th_sport;
+                        pd->dport = &th->th_dport;
+                        break;
+                }
+                case IPPROTO_UDP: {
+                        struct udphdr *uh = &pd->hdr.udp;
+
+                        if (!pf_pull_hdr(m, *off, uh, sizeof(*uh), action,
+                                reason, AF_INET6))
+                                return (-1);
+                        *hdrlen = sizeof(*uh);
+                        if (uh->uh_dport == 0 ||
+                            ntohs(uh->uh_ulen) > m->m_pkthdr.len - *off ||
+                            ntohs(uh->uh_ulen) < sizeof(struct udphdr)) {
+                                *action = PF_DROP;
+                                REASON_SET(reason, PFRES_SHORT);
+                                return (-1);
+                        }
+                        pd->sport = &uh->uh_sport;
+                        pd->dport = &uh->uh_dport;
+                        break;
+                }
+                case IPPROTO_SCTP: {
+                        if (!pf_pull_hdr(m, *off, &pd->hdr.sctp, sizeof(pd->hdr.sctp),
+                            action, reason, AF_INET6)) {
+                                return (-1);
+                        }
+                        *hdrlen = sizeof(pd->hdr.sctp);
+                        pd->p_len = pd->tot_len - *off;
+
+                        pd->sport = &pd->hdr.sctp.src_port;
+                        pd->dport = &pd->hdr.sctp.dest_port;
+                        if (pd->hdr.sctp.src_port == 0 || pd->hdr.sctp.dest_port == 0) {
+                                *action = PF_DROP;
+                                REASON_SET(reason, PFRES_SHORT);
+                                return (-1);
+                        }
+                        if (pf_scan_sctp(m, *off, pd, kif) != PF_PASS) {
+                                *action = PF_DROP;
+                                REASON_SET(reason, PFRES_SHORT);
+                                return (-1);
+                        }
+                        break;
+                }
+                case IPPROTO_ICMPV6: {
+                        size_t icmp_hlen = sizeof(struct icmp6_hdr);
+
+                        if (!pf_pull_hdr(m, *off, &pd->hdr.icmp6, icmp_hlen,
+                                action, reason, AF_INET6))
+                                return (-1);
+                        /* ICMP headers we look further into to match state */
+                        switch (pd->hdr.icmp6.icmp6_type) {
+                        case MLD_LISTENER_QUERY:
+                        case MLD_LISTENER_REPORT:
+                                icmp_hlen = sizeof(struct mld_hdr);
+                                break;
+                        case ND_NEIGHBOR_SOLICIT:
+                        case ND_NEIGHBOR_ADVERT:
+                                icmp_hlen = sizeof(struct nd_neighbor_solicit);
+                                break;
+                        }
+                        if (icmp_hlen > sizeof(struct icmp6_hdr) &&
+                            !pf_pull_hdr(m, *off, &pd->hdr.icmp6, icmp_hlen,
+                                action, reason, AF_INET6))
+                                return (-1);
+                        *hdrlen = icmp_hlen;
+                        break;
+                }
+                }
+                break;
+        }
+#endif
+        default:
+                panic("pf_setup_pdesc called with illegal af %u", af);
+        }
+        return (0);
+}
+
+#ifdef INET
 int
 pf_test(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0,
     struct inpcb *inp, struct pf_rule_actions *default_actions)
 {
         struct pfi_kkif         *kif;
         u_short                         action, reason = 0;
         struct mbuf                *m = *m0;
         struct ip                *h = NULL;
         struct m_tag            *mtag;
         struct pf_krule                *a = NULL, *r = &V_pf_default_rule, *tr, *nr;
         struct pf_kstate        *s = NULL;
         struct pf_kruleset        *ruleset = NULL;
         struct pf_pdesc          pd;
-        int                         off, dirndx, use_2nd_queue = 0;
+        int                         off, hdrlen, dirndx, use_2nd_queue = 0;
         uint16_t                 tag;
         uint8_t                  rt;
 
         PF_RULES_RLOCK_TRACKER;
         KASSERT(dir == PF_IN || dir == PF_OUT, ("%s: bad direction %d\n", __func__, dir));
         M_ASSERTPKTHDR(m);
 
         if (!V_pf_status.running)
pf_test(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0,
         }
 
         if (__predict_false(! M_WRITABLE(*m0))) {
                 m = *m0 = m_unshare(*m0, M_NOWAIT);
                 if (*m0 == NULL)
                         return (PF_DROP);
         }
 
+        if (__predict_false(m->m_len < sizeof(struct ip)) &&
+            (m = *m0 = m_pullup(*m0, sizeof(struct ip))) == NULL) {
+                DPFPRINTF(PF_DEBUG_URGENT,
+                    ("pf_test: m_len < sizeof(struct ip), pullup failed\n"));
+                PF_RULES_RUNLOCK();
+                return (PF_DROP);
+        }
+
         memset(&pd, 0, sizeof(pd));
-        TAILQ_INIT(&pd.sctp_multihome_jobs);
-        if (default_actions != NULL)
-                memcpy(&pd.act, default_actions, sizeof(pd.act));
-        pd.pf_mtag = pf_find_mtag(m);
+        pd.dir = dir;
 
+        if (pf_normalize_ip(m0, kif, &reason, &pd) != PF_PASS) {
+                /* We do IP header normalization and packet reassembly here */
+                action = PF_DROP;
+                goto done;
+        }
+        m = *m0;        /* pf_normalize messes with m0 */
+        h = mtod(m, struct ip *);
+
+        if (pf_setup_pdesc(AF_INET, dir, &pd, m, &action, &reason, kif, &a, &r,
+                &ruleset, &off, &hdrlen, default_actions) == -1) {
+                if (action != PF_PASS)
+                        pd.act.log |= PF_LOG_FORCE;
+                goto done;
+        }
+
         if (pd.pf_mtag != NULL && (pd.pf_mtag->flags & PF_MTAG_FLAG_ROUTE_TO)) {
                 pd.pf_mtag->flags &= ~PF_MTAG_FLAG_ROUTE_TO;
 
                 ifp = ifnet_byindexgen(pd.pf_mtag->if_index,
                     pd.pf_mtag->if_idxgen);
                 if (ifp == NULL || ifp->if_flags & IFF_DYING) {
                         PF_RULES_RUNLOCK();
                         m_freem(*m0);
                         *m0 = NULL;
                         return (PF_PASS);
                 }
                 PF_RULES_RUNLOCK();
                 (ifp->if_output)(ifp, m, sintosa(&pd.pf_mtag->dst), NULL);
                 *m0 = NULL;
                 return (PF_PASS);
         }
 
-        if (pd.pf_mtag && pd.pf_mtag->dnpipe) {
-                pd.act.dnpipe = pd.pf_mtag->dnpipe;
-                pd.act.flags = pd.pf_mtag->dnflags;
-        }
-
         if (ip_dn_io_ptr != NULL && pd.pf_mtag != NULL &&
             pd.pf_mtag->flags & PF_MTAG_FLAG_DUMMYNET) {
                 /* Dummynet re-injects packets after they've
                  * completed their delay. We've already
                  * processed them, so pass unconditionally. */
 
                 /* But only once. We may see the packet multiple times (e.g.
                  * PFIL_IN/PFIL_OUT). */
                 pf_dummynet_flag_remove(m, pd.pf_mtag);
                 PF_RULES_RUNLOCK();
 
                 return (PF_PASS);
         }
 
-        pd.sport = pd.dport = NULL;
-        pd.proto_sum = NULL;
-        pd.dir = dir;
-        pd.sidx = (dir == PF_IN) ? 0 : 1;
-        pd.didx = (dir == PF_IN) ? 1 : 0;
-        pd.af = AF_INET;
-        pd.act.rtableid = -1;
-
-        if (__predict_false(m->m_len < sizeof(struct ip)) &&
-            (m = *m0 = m_pullup(*m0, sizeof(struct ip))) == NULL) {
-                DPFPRINTF(PF_DEBUG_URGENT,
-                    ("pf_test: m_len < sizeof(struct ip), pullup failed\n"));
-                PF_RULES_RUNLOCK();
-                return (PF_DROP);
-        }
-        h = mtod(m, struct ip *);
-        off = h->ip_hl << 2;
-
         if (__predict_false(ip_divert_ptr != NULL) &&
             ((mtag = m_tag_locate(m, MTAG_PF_DIVERT, 0, NULL)) != NULL)) {
                 struct pf_divert_mtag *dt = (struct pf_divert_mtag *)(mtag+1);
                 if ((dt->idir == PF_DIVERT_MTAG_DIR_IN && dir == PF_IN) ||
                     (dt->idir == PF_DIVERT_MTAG_DIR_OUT && dir == PF_OUT)) {
                         if (pd.pf_mtag == NULL &&
                             ((pd.pf_mtag = pf_get_mtag(m)) == NULL)) {
                                 action = PF_DROP;
                                 goto done;
                         }
                         pd.pf_mtag->flags |= PF_MTAG_FLAG_PACKET_LOOPED;
                 }
                 if (pd.pf_mtag && pd.pf_mtag->flags & PF_MTAG_FLAG_FASTFWD_OURS_PRESENT) {
                         m->m_flags |= M_FASTFWD_OURS;
                         pd.pf_mtag->flags &= ~PF_MTAG_FLAG_FASTFWD_OURS_PRESENT;
                 }
                 m_tag_delete(m, mtag);
 
                 mtag = m_tag_locate(m, MTAG_IPFW_RULE, 0, NULL);
                 if (mtag != NULL)
                         m_tag_delete(m, mtag);
-        } else if (pf_normalize_ip(m0, kif, &reason, &pd) != PF_PASS) {
-                /* We do IP header normalization and packet reassembly here */
-                action = PF_DROP;
-                goto done;
         }
-        m = *m0;        /* pf_normalize messes with m0 */
-        h = mtod(m, struct ip *);
 
-        off = h->ip_hl << 2;
-        if (off < (int)sizeof(struct ip)) {
-                action = PF_DROP;
-                REASON_SET(&reason, PFRES_SHORT);
-                pd.act.log = PF_LOG_FORCE;
-                goto done;
-        }
-
-        pd.src = (struct pf_addr *)&h->ip_src;
-        pd.dst = (struct pf_addr *)&h->ip_dst;
-        pd.ip_sum = &h->ip_sum;
-        pd.proto = h->ip_p;
-        pd.tos = h->ip_tos & ~IPTOS_ECN_MASK;
-        pd.tot_len = ntohs(h->ip_len);
-
         /* handle fragments that didn't get reassembled by normalization */
         if (h->ip_off & htons(IP_MF | IP_OFFMASK)) {
                 action = pf_test_fragment(&r, kif, m, h, &pd, &a, &ruleset);
                 goto done;
         }
 
         switch (h->ip_p) {
         case IPPROTO_TCP: {
-                if (!pf_pull_hdr(m, off, &pd.hdr.tcp, sizeof(pd.hdr.tcp),
-                    &action, &reason, AF_INET)) {
-                        if (action != PF_PASS)
-                                pd.act.log = PF_LOG_FORCE;
-                        goto done;
-                }
-                pd.p_len = pd.tot_len - off - (pd.hdr.tcp.th_off << 2);
 
-                pd.sport = &pd.hdr.tcp.th_sport;
-                pd.dport = &pd.hdr.tcp.th_dport;
-
                 /* Respond to SYN with a syncookie. */
                 if ((pd.hdr.tcp.th_flags & (TH_SYN|TH_ACK|TH_RST)) == TH_SYN &&
                     pd.dir == PF_IN && pf_synflood_check(&pd)) {
                         pf_syncookie_send(m, off, &pd);
                         action = PF_DROP;
                         break;
                 }
 
if (action == PF_PASS) {
 
                                 s->src.seqhi = ntohl(pd.hdr.tcp.th_ack) - 1;
                                 s->src.seqlo = ntohl(pd.hdr.tcp.th_seq) - 1;
                                 pf_set_protostate(s, PF_PEER_SRC, PF_TCPS_PROXY_DST);
                                 action = pf_synproxy(&pd, &s, &reason);
                                 break;
                         } else {
                                 action = pf_test_rule(&r, &s, kif, m, off, &pd,
-                                    &a, &ruleset, inp);
+                                    &a, &ruleset, inp, hdrlen);
                         }
                 }
                 break;
         }
 
         case IPPROTO_UDP: {
-                if (!pf_pull_hdr(m, off, &pd.hdr.udp, sizeof(pd.hdr.udp),
-                    &action, &reason, AF_INET)) {
-                        if (action != PF_PASS)
-                                pd.act.log = PF_LOG_FORCE;
-                        goto done;
-                }
-                pd.sport = &pd.hdr.udp.uh_sport;
-                pd.dport = &pd.hdr.udp.uh_dport;
-                if (pd.hdr.udp.uh_dport == 0 ||
-                    ntohs(pd.hdr.udp.uh_ulen) > m->m_pkthdr.len - off ||
-                    ntohs(pd.hdr.udp.uh_ulen) < sizeof(struct udphdr)) {
-                        action = PF_DROP;
-                        REASON_SET(&reason, PFRES_SHORT);
-                        goto done;
-                }
                 action = pf_test_state_udp(&s, kif, m, off, h, &pd);
                 if (action == PF_PASS) {
                         if (V_pfsync_update_state_ptr != NULL)
                                 V_pfsync_update_state_ptr(s);
                         r = s->rule.ptr;
                         a = s->anchor.ptr;
                 } else if (s == NULL)
                         action = pf_test_rule(&r, &s, kif, m, off, &pd,
-                            &a, &ruleset, inp);
+                            &a, &ruleset, inp, hdrlen);
                 break;
         }
 
         case IPPROTO_SCTP: {
-                if (!pf_pull_hdr(m, off, &pd.hdr.sctp, sizeof(pd.hdr.sctp),
-                    &action, &reason, AF_INET)) {
-                        if (action != PF_PASS)
-                                pd.act.log |= PF_LOG_FORCE;
-                        goto done;
-                }
-                pd.p_len = pd.tot_len - off;
-
-                pd.sport = &pd.hdr.sctp.src_port;
-                pd.dport = &pd.hdr.sctp.dest_port;
-                if (pd.hdr.sctp.src_port == 0 || pd.hdr.sctp.dest_port == 0) {
-                        action = PF_DROP;
-                        REASON_SET(&reason, PFRES_SHORT);
-                        goto done;
-                }
                 action = pf_normalize_sctp(dir, kif, m, 0, off, h, &pd);
                 if (action == PF_DROP)
                         goto done;
                 action = pf_test_state_sctp(&s, kif, m, off, h, &pd,
                     &reason);
                 if (action == PF_PASS) {
                         if (V_pfsync_update_state_ptr != NULL)
                                 V_pfsync_update_state_ptr(s);
                         r = s->rule.ptr;
                         a = s->anchor.ptr;
                 } else if (s == NULL) {
                         action = pf_test_rule(&r, &s, kif, m, off,
-                            &pd, &a, &ruleset, inp);
+                            &pd, &a, &ruleset, inp, hdrlen);
                 }
                 break;
         }
 
         case IPPROTO_ICMP: {
-                if (!pf_pull_hdr(m, off, &pd.hdr.icmp, ICMP_MINLEN,
-                    &action, &reason, AF_INET)) {
-                        if (action != PF_PASS)
-                                pd.act.log = PF_LOG_FORCE;
-                        goto done;
-                }
                 action = pf_test_state_icmp(&s, kif, m, off, h, &pd, &reason);
                 if (action == PF_PASS) {
                         if (V_pfsync_update_state_ptr != NULL)
                                 V_pfsync_update_state_ptr(s);
                         r = s->rule.ptr;
                         a = s->anchor.ptr;
                 } else if (s == NULL)
                         action = pf_test_rule(&r, &s, kif, m, off, &pd,
-                            &a, &ruleset, inp);
+                            &a, &ruleset, inp, hdrlen);
                 break;
         }
 
         case IPPROTO_ICMPV6: {
                 action = PF_DROP;
                 DPFPRINTF(PF_DEBUG_MISC,
                     ("pf: dropping IPv4 packet with ICMPv6 payload\n"));
                 goto done;
         }
 
         default:
                 action = pf_test_state_other(&s, kif, m, &pd);
                 if (action == PF_PASS) {
                         if (V_pfsync_update_state_ptr != NULL)
                                 V_pfsync_update_state_ptr(s);
                         r = s->rule.ptr;
                         a = s->anchor.ptr;
                 } else if (s == NULL)
                         action = pf_test_rule(&r, &s, kif, m, off, &pd,
-                            &a, &ruleset, inp);
+                            &a, &ruleset, inp, hdrlen);
                 break;
         }
 
 done:
         PF_RULES_RUNLOCK();
         if (action == PF_PASS && h->ip_hl > 5 &&
             !((s && s->state_flags & PFSTATE_ALLOWOPTS) || r->allow_opts)) {
                 action = PF_DROP;
pf_test6(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0, struct inpcb *inp,
         u_short                         action, reason = 0;
         struct mbuf                *m = *m0, *n = NULL;
         struct m_tag            *mtag;
         struct ip6_hdr                *h = NULL;
         struct pf_krule                *a = NULL, *r = &V_pf_default_rule, *tr, *nr;
         struct pf_kstate        *s = NULL;
         struct pf_kruleset        *ruleset = NULL;
         struct pf_pdesc          pd;
-        int                         off, terminal = 0, dirndx, rh_cnt = 0, use_2nd_queue = 0;
+        int                         off, hdrlen, dirndx, use_2nd_queue = 0;
         uint16_t                 tag;
         uint8_t                  rt;
 
         PF_RULES_RLOCK_TRACKER;
         KASSERT(dir == PF_IN || dir == PF_OUT, ("%s: bad direction %d\n", __func__, dir));
         M_ASSERTPKTHDR(m);
 
         if (!V_pf_status.running)
pf_test6(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0, struct inpcb *inp,
         }
 
         if (__predict_false(! M_WRITABLE(*m0))) {
                 m = *m0 = m_unshare(*m0, M_NOWAIT);
                 if (*m0 == NULL)
                         return (PF_DROP);
         }
 
+        if (__predict_false(m->m_len < sizeof(struct ip6_hdr)) &&
+            (m = *m0 = m_pullup(*m0, sizeof(struct ip6_hdr))) == NULL) {
+                DPFPRINTF(PF_DEBUG_URGENT,
+                    ("pf_test6: m_len < sizeof(struct ip6_hdr)"
+                     ", pullup failed\n"));
+                PF_RULES_RUNLOCK();
+                return (PF_DROP);
+        }
+
         memset(&pd, 0, sizeof(pd));
-        TAILQ_INIT(&pd.sctp_multihome_jobs);
-        if (default_actions != NULL)
-                memcpy(&pd.act, default_actions, sizeof(pd.act));
-        pd.pf_mtag = pf_find_mtag(m);
+        pd.dir = dir;
 
+        /* We do IP header normalization and packet reassembly here */
+        if (pf_normalize_ip6(m0, kif, &reason, &pd) != PF_PASS) {
+                action = PF_DROP;
+                goto done;
+        }
+        m = *m0;        /* pf_normalize messes with m0 */
+        h = mtod(m, struct ip6_hdr *);
+        off = ((caddr_t)h - m->m_data) + sizeof(struct ip6_hdr);
+
+        if (pf_setup_pdesc(AF_INET6, dir, &pd, m, &action, &reason, kif, &a, &r,
+                &ruleset, &off, &hdrlen, default_actions) == -1) {
+                if (action != PF_PASS)
+                        pd.act.log |= PF_LOG_FORCE;
+                goto done;
+        }
+
         if (pd.pf_mtag != NULL && (pd.pf_mtag->flags & PF_MTAG_FLAG_ROUTE_TO)) {
                 pd.pf_mtag->flags &= ~PF_MTAG_FLAG_ROUTE_TO;
 
                 ifp = ifnet_byindexgen(pd.pf_mtag->if_index,
                     pd.pf_mtag->if_idxgen);
                 if (ifp == NULL || ifp->if_flags & IFF_DYING) {
                         PF_RULES_RUNLOCK();
                         m_freem(*m0);
                         *m0 = NULL;
                         return (PF_PASS);
                 }
                 PF_RULES_RUNLOCK();
                 nd6_output_ifp(ifp, ifp, m,
                     (struct sockaddr_in6 *)&pd.pf_mtag->dst, NULL);
                 *m0 = NULL;
                 return (PF_PASS);
         }
 
-        if (pd.pf_mtag && pd.pf_mtag->dnpipe) {
-                pd.act.dnpipe = pd.pf_mtag->dnpipe;
-                pd.act.flags = pd.pf_mtag->dnflags;
-        }
-
         if (ip_dn_io_ptr != NULL && pd.pf_mtag != NULL &&
             pd.pf_mtag->flags & PF_MTAG_FLAG_DUMMYNET) {
                 pf_dummynet_flag_remove(m, pd.pf_mtag);
                 /* Dummynet re-injects packets after they've
                  * completed their delay. We've already
                  * processed them, so pass unconditionally. */
                 PF_RULES_RUNLOCK();
                 return (PF_PASS);
         }
 
-        pd.sport = pd.dport = NULL;
-        pd.ip_sum = NULL;
-        pd.proto_sum = NULL;
-        pd.dir = dir;
-        pd.sidx = (dir == PF_IN) ? 0 : 1;
-        pd.didx = (dir == PF_IN) ? 1 : 0;
-        pd.af = AF_INET6;
-        pd.act.rtableid = -1;
-
-        if (__predict_false(m->m_len < sizeof(struct ip6_hdr)) &&
-            (m = *m0 = m_pullup(*m0, sizeof(struct ip6_hdr))) == NULL) {
-                DPFPRINTF(PF_DEBUG_URGENT,
-                    ("pf_test6: m_len < sizeof(struct ip6_hdr)"
-                     ", pullup failed\n"));
-                PF_RULES_RUNLOCK();
-                return (PF_DROP);
-        }
-        h = mtod(m, struct ip6_hdr *);
-        off = ((caddr_t)h - m->m_data) + sizeof(struct ip6_hdr);
-
-        /* We do IP header normalization and packet reassembly here */
-        if (pf_normalize_ip6(m0, kif, &reason, &pd) != PF_PASS) {
-                action = PF_DROP;
-                goto done;
-        }
-        m = *m0;        /* pf_normalize messes with m0 */
-        h = mtod(m, struct ip6_hdr *);
-        off = ((caddr_t)h - m->m_data) + sizeof(struct ip6_hdr);
-
         /*
          * we do not support jumbogram.  if we keep going, zero ip6_plen
          * will do something bad, so drop the packet for now.
          */
         if (htons(h->ip6_plen) == 0) {
                 action = PF_DROP;
                 REASON_SET(&reason, PFRES_NORM);        /*XXX*/
                 goto done;
         }
 
-        pd.src = (struct pf_addr *)&h->ip6_src;
-        pd.dst = (struct pf_addr *)&h->ip6_dst;
-        pd.tos = IPV6_DSCP(h);
-        pd.tot_len = ntohs(h->ip6_plen) + sizeof(struct ip6_hdr);
-
-        pd.proto = h->ip6_nxt;
-        do {
-                switch (pd.proto) {
-                case IPPROTO_FRAGMENT:
-                        action = pf_test_fragment(&r, kif, m, h, &pd, &a,
-                            &ruleset);
-                        if (action == PF_DROP)
-                                REASON_SET(&reason, PFRES_FRAG);
-                        goto done;
-                case IPPROTO_ROUTING: {
-                        struct ip6_rthdr rthdr;
-
-                        if (rh_cnt++) {
-                                DPFPRINTF(PF_DEBUG_MISC,
-                                    ("pf: IPv6 more than one rthdr\n"));
-                                action = PF_DROP;
-                                REASON_SET(&reason, PFRES_IPOPTIONS);
-                                pd.act.log = PF_LOG_FORCE;
-                                goto done;
-                        }
-                        if (!pf_pull_hdr(m, off, &rthdr, sizeof(rthdr), NULL,
-                            &reason, pd.af)) {
-                                DPFPRINTF(PF_DEBUG_MISC,
-                                    ("pf: IPv6 short rthdr\n"));
-                                action = PF_DROP;
-                                REASON_SET(&reason, PFRES_SHORT);
-                                pd.act.log = PF_LOG_FORCE;
-                                goto done;
-                        }
-                        if (rthdr.ip6r_type == IPV6_RTHDR_TYPE_0) {
-                                DPFPRINTF(PF_DEBUG_MISC,
-                                    ("pf: IPv6 rthdr0\n"));
-                                action = PF_DROP;
-                                REASON_SET(&reason, PFRES_IPOPTIONS);
-                                pd.act.log = PF_LOG_FORCE;
-                                goto done;
-                        }
-                        /* FALLTHROUGH */
-                }
-                case IPPROTO_AH:
-                case IPPROTO_HOPOPTS:
-                case IPPROTO_DSTOPTS: {
-                        /* get next header and header length */
-                        struct ip6_ext  opt6;
-
-                        if (!pf_pull_hdr(m, off, &opt6, sizeof(opt6),
-                            NULL, &reason, pd.af)) {
-                                DPFPRINTF(PF_DEBUG_MISC,
-                                    ("pf: IPv6 short opt\n"));
-                                action = PF_DROP;
-                                pd.act.log = PF_LOG_FORCE;
-                                goto done;
-                        }
-                        if (pd.proto == IPPROTO_AH)
-                                off += (opt6.ip6e_len + 2) * 4;
-                        else
-                                off += (opt6.ip6e_len + 1) * 8;
-                        pd.proto = opt6.ip6e_nxt;
-                        /* goto the next header */
-                        break;
-                }
-                default:
-                        terminal++;
-                        break;
-                }
-        } while (!terminal);
-
         /* if there's no routing header, use unmodified mbuf for checksumming */
         if (!n)
                 n = m;
 
         switch (pd.proto) {
         case IPPROTO_TCP: {
-                if (!pf_pull_hdr(m, off, &pd.hdr.tcp, sizeof(pd.hdr.tcp),
-                    &action, &reason, AF_INET6)) {
-                        if (action != PF_PASS)
-                                pd.act.log |= PF_LOG_FORCE;
-                        goto done;
-                }
-                pd.p_len = pd.tot_len - off - (pd.hdr.tcp.th_off << 2);
-                pd.sport = &pd.hdr.tcp.th_sport;
-                pd.dport = &pd.hdr.tcp.th_dport;
-
                 /* Respond to SYN with a syncookie. */
                 if ((pd.hdr.tcp.th_flags & (TH_SYN|TH_ACK|TH_RST)) == TH_SYN &&
                     pd.dir == PF_IN && pf_synflood_check(&pd)) {
                         pf_syncookie_send(m, off, &pd);
                         action = PF_DROP;
                         break;
                 }
 
if (action == PF_PASS) {
                                 s->src.seqhi = ntohl(pd.hdr.tcp.th_ack) - 1;
                                 s->src.seqlo = ntohl(pd.hdr.tcp.th_seq) - 1;
                                 pf_set_protostate(s, PF_PEER_SRC, PF_TCPS_PROXY_DST);
 
                                 action = pf_synproxy(&pd, &s, &reason);
                                 break;
                         } else {
                                 action = pf_test_rule(&r, &s, kif, m, off, &pd,
-                                    &a, &ruleset, inp);
+                                    &a, &ruleset, inp, hdrlen);
                         }
                 }
                 break;
         }
 
         case IPPROTO_UDP: {
-                if (!pf_pull_hdr(m, off, &pd.hdr.udp, sizeof(pd.hdr.udp),
-                    &action, &reason, AF_INET6)) {
-                        if (action != PF_PASS)
-                                pd.act.log |= PF_LOG_FORCE;
-                        goto done;
-                }
-                pd.sport = &pd.hdr.udp.uh_sport;
-                pd.dport = &pd.hdr.udp.uh_dport;
-                if (pd.hdr.udp.uh_dport == 0 ||
-                    ntohs(pd.hdr.udp.uh_ulen) > m->m_pkthdr.len - off ||
-                    ntohs(pd.hdr.udp.uh_ulen) < sizeof(struct udphdr)) {
-                        action = PF_DROP;
-                        REASON_SET(&reason, PFRES_SHORT);
-                        goto done;
-                }
                 action = pf_test_state_udp(&s, kif, m, off, h, &pd);
                 if (action == PF_PASS) {
                         if (V_pfsync_update_state_ptr != NULL)
                                 V_pfsync_update_state_ptr(s);
                         r = s->rule.ptr;
                         a = s->anchor.ptr;
                 } else if (s == NULL)
                         action = pf_test_rule(&r, &s, kif, m, off, &pd,
-                            &a, &ruleset, inp);
+                            &a, &ruleset, inp, hdrlen);
                 break;
         }
 
         case IPPROTO_SCTP: {
-                if (!pf_pull_hdr(m, off, &pd.hdr.sctp, sizeof(pd.hdr.sctp),
-                    &action, &reason, AF_INET6)) {
-                        if (action != PF_PASS)
-                                pd.act.log |= PF_LOG_FORCE;
-                        goto done;
-                }
-                pd.sport = &pd.hdr.sctp.src_port;
-                pd.dport = &pd.hdr.sctp.dest_port;
-                if (pd.hdr.sctp.src_port == 0 || pd.hdr.sctp.dest_port == 0) {
-                        action = PF_DROP;
-                        REASON_SET(&reason, PFRES_SHORT);
-                        goto done;
-                }
                 action = pf_normalize_sctp(dir, kif, m, 0, off, h, &pd);
                 if (action == PF_DROP)
                         goto done;
                 action = pf_test_state_sctp(&s, kif, m, off, h, &pd,
                     &reason);
                 if (action == PF_PASS) {
                         if (V_pfsync_update_state_ptr != NULL)
                                 V_pfsync_update_state_ptr(s);
                         r = s->rule.ptr;
                         a = s->anchor.ptr;
                 } else if (s == NULL) {
                         action = pf_test_rule(&r, &s, kif, m, off,
-                            &pd, &a, &ruleset, inp);
+                            &pd, &a, &ruleset, inp, hdrlen);
                 }
                 break;
         }
 
         case IPPROTO_ICMP: {
                 action = PF_DROP;
                 DPFPRINTF(PF_DEBUG_MISC,
                     ("pf: dropping IPv6 packet with ICMPv4 payload\n"));
                 goto done;
         }
 
         case IPPROTO_ICMPV6: {
-                if (!pf_pull_hdr(m, off, &pd.hdr.icmp6, sizeof(pd.hdr.icmp6),
-                    &action, &reason, AF_INET6)) {
-                        if (action != PF_PASS)
-                                pd.act.log |= PF_LOG_FORCE;
-                        goto done;
-                }
                 action = pf_test_state_icmp(&s, kif, m, off, h, &pd, &reason);
                 if (action == PF_PASS) {
                         if (V_pfsync_update_state_ptr != NULL)
                                 V_pfsync_update_state_ptr(s);
                         r = s->rule.ptr;
                         a = s->anchor.ptr;
                 } else if (s == NULL)
                         action = pf_test_rule(&r, &s, kif, m, off, &pd,
-                            &a, &ruleset, inp);
+                            &a, &ruleset, inp, hdrlen);
                 break;
         }
 
         default:
                 action = pf_test_state_other(&s, kif, m, &pd);
                 if (action == PF_PASS) {
                         if (V_pfsync_update_state_ptr != NULL)
                                 V_pfsync_update_state_ptr(s);
                         r = s->rule.ptr;
                         a = s->anchor.ptr;
                 } else if (s == NULL)
                         action = pf_test_rule(&r, &s, kif, m, off, &pd,
-                            &a, &ruleset, inp);
+                            &a, &ruleset, inp, hdrlen);
                 break;
         }
 
 done:
         PF_RULES_RUNLOCK();
         if (n != m) {
                 m_freem(n);
                 n = NULL;
         }
 
         /* handle dangerous IPv6 extension headers. */
-        if (action == PF_PASS && rh_cnt &&
+        if (action == PF_PASS && pd.rh_cnt &&
             !((s && s->state_flags & PFSTATE_ALLOWOPTS) || r->allow_opts)) {
                 action = PF_DROP;
                 REASON_SET(&reason, PFRES_IPOPTIONS);
                 pd.act.log = r->log;
                 DPFPRINTF(PF_DEBUG_MISC,
                     ("pf: dropping packet with dangerous v6 headers\n"));
         }