sbin/sysctl: Fix CTLFLAG_SKIP for adjacent nodes

[freqlabs]

Summary

The OID is saved when we encounter CTLFLAG_SKIP so that descendants can be skipped as well. We then must not update the skip OID until we are out of the node. This was achieved by resetting the skip OID once the prefix no longer matches, but the case where the OID reset on is also CTLFLAG_SKIP was not accounted for.

Reported by: mav
Sponsored by: iXsystems, Inc.

[mav]

Makes sense and works for me.

sbin/sysctl/sysctl.c

 static int                 pf_dummynet_route(struct pf_pdesc *,
                             struct pf_kstate *, struct pf_krule *,
                             struct ifnet *, struct sockaddr *, struct mbuf **);
 static int                 pf_test_eth_rule(int, struct pfi_kkif *,
                             struct mbuf **);
 static int                 pf_test_rule(struct pf_krule **, struct pf_kstate **,
                             struct pfi_kkif *, struct mbuf *, int,
                             struct pf_pdesc *, struct pf_krule **,
-                            struct pf_kruleset **, struct inpcb *);
+                            struct pf_kruleset **, struct inpcb *, int);
 static int                 pf_create_state(struct pf_krule *, struct pf_krule *,
                             struct pf_krule *, struct pf_pdesc *,
                             struct pf_ksrc_node *, struct pf_state_key *,
                             struct pf_state_key *, struct mbuf *, int,
                             u_int16_t, u_int16_t, int *, struct pfi_kkif *,
                             struct pf_kstate **, int, u_int16_t, u_int16_t,
                             int, struct pf_krule_slist *, struct pf_udp_mapping *);
 static int                 pf_state_key_addr_setup(struct pf_pdesc *, struct mbuf *,
#endif /* INET6 */
         }
 
         return (action);
 }
 
 static int
 pf_test_rule(struct pf_krule **rm, struct pf_kstate **sm, struct pfi_kkif *kif,
     struct mbuf *m, int off, struct pf_pdesc *pd, struct pf_krule **am,
-    struct pf_kruleset **rsm, struct inpcb *inp)
+    struct pf_kruleset **rsm, struct inpcb *inp, int hdrlen)
 {
         struct pf_krule                *nr = NULL;
         struct pf_addr                * const saddr = pd->src;
         struct pf_addr                * const daddr = pd->dst;
         sa_family_t                 af = pd->af;
         struct pf_krule                *r, *a = NULL;
         struct pf_kruleset        *ruleset = NULL;
         struct pf_krule_slist    match_rules;
         struct pf_krule_item    *ri;
         struct pf_ksrc_node        *nsn = NULL;
         struct tcphdr                *th = &pd->hdr.tcp;
         struct pf_state_key        *sk = NULL, *nk = NULL;
         u_short                  reason, transerror;
-        int                         rewrite = 0, hdrlen = 0;
+        int                      rewrite = 0;
         int                      tag = -1;
         int                      asd = 0;
         int                      match = 0;
         int                         state_icmp = 0, icmp_dir, multi;
         u_int16_t                 sport = 0, dport = 0, virtual_type, virtual_id;
         u_int16_t                 bproto_sum = 0, bip_sum = 0;
         u_int8_t                 icmptype = 0, icmpcode = 0;
         struct pf_kanchor_stackframe        anchor_stack[PF_ANCHOR_STACKSIZE];
if (inp != NULL) {
                 pd->lookup.gid = inp->inp_cred->cr_groups[0];
                 pd->lookup.done = 1;
         }
 
         switch (pd->proto) {
         case IPPROTO_TCP:
                 sport = th->th_sport;
                 dport = th->th_dport;
-                hdrlen = sizeof(*th);
                 break;
         case IPPROTO_UDP:
                 sport = pd->hdr.udp.uh_sport;
                 dport = pd->hdr.udp.uh_dport;
-                hdrlen = sizeof(pd->hdr.udp);
                 break;
         case IPPROTO_SCTP:
                 sport = pd->hdr.sctp.src_port;
                 dport = pd->hdr.sctp.dest_port;
-                hdrlen = sizeof(pd->hdr.sctp);
                 break;
 #ifdef INET
         case IPPROTO_ICMP:
                 if (pd->af != AF_INET)
                         break;
-                hdrlen = sizeof(pd->hdr.icmp);
                 icmptype = pd->hdr.icmp.icmp_type;
                 icmpcode = pd->hdr.icmp.icmp_code;
                 state_icmp = pf_icmp_mapping(pd, icmptype,
                     &icmp_dir, &multi, &virtual_id, &virtual_type);
                 if (icmp_dir == PF_IN) {
                         sport = virtual_id;
                         dport = virtual_type;
                 } else {
                         sport = virtual_type;
                         dport = virtual_id;
                 }
                 break;
 #endif /* INET */
 #ifdef INET6
         case IPPROTO_ICMPV6:
                 if (af != AF_INET6)
                         break;
-                hdrlen = sizeof(pd->hdr.icmp6);
                 icmptype = pd->hdr.icmp6.icmp6_type;
                 icmpcode = pd->hdr.icmp6.icmp6_code;
                 state_icmp = pf_icmp_mapping(pd, icmptype,
                     &icmp_dir, &multi, &virtual_id, &virtual_type);
                 if (icmp_dir == PF_IN) {
                         sport = virtual_id;
                         dport = virtual_type;
                 } else {
                         sport = virtual_type;
                         dport = virtual_id;
                 }
 
                 break;
 #endif /* INET6 */
         default:
-                sport = dport = hdrlen = 0;
+                sport = dport = 0;
                 break;
         }
 
         r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr);
 
         /* check packet for BINAT/NAT/RDR */
         transerror = pf_get_translation(pd, m, off, kif, &nsn, &sk,
             &nk, saddr, daddr, sport, dport, anchor_stack, &nr, &udp_mapping);
case  SCTP_ADD_IP_ADDRESS: {
                         PF_RULES_RLOCK();
                         sm = NULL;
                         /*
                          * New connections need to be floating, because
                          * we cannot know what interfaces it will use.
                          * That's why we pass V_pfi_all rather than kif.
                          */
                         ret = pf_test_rule(&r, &sm, V_pfi_all,
-                            j->m, off, &j->pd, &ra, &rs, NULL);
+                            j->m, off, &j->pd, &ra, &rs, NULL,
+                            sizeof(j->pd.hdr.sctp));
                         PF_RULES_RUNLOCK();
                         SDT_PROBE4(pf, sctp, multihome, test, kif, r, j->m, ret);
                         if (ret != PF_DROP && sm != NULL) {
                                 /* Inherit v_tag values. */
                                 if (sm->direction == s->direction) {
                                         sm->src.scrub->pfss_v_tag = s->src.scrub->pfss_v_tag;
                                         sm->dst.scrub->pfss_v_tag = s->dst.scrub->pfss_v_tag;
                                 } else {
if (pf_pdesc_to_dnflow(pd, r, s, &dnflow)) {
                                 pf_dummynet_flag_remove(*m0, pd->pf_mtag);
                         }
                 }
         }
 
         return (0);
 }
 
+int
+pf_setup_pdesc(sa_family_t af, int dir, struct pf_pdesc *pd, struct mbuf *m,
+    u_short *action, u_short *reason, struct pfi_kkif *kif, struct pf_krule **a,
+    struct pf_krule **r, struct pf_kruleset **ruleset, int *off, int *hdrlen,
+    struct pf_rule_actions *default_actions)
+{
+
+        TAILQ_INIT(&pd->sctp_multihome_jobs);
+        if (default_actions != NULL)
+                memcpy(&pd->act, default_actions, sizeof(pd->act));
+        pd->pf_mtag = pf_find_mtag(m);
+
+        if (pd->pf_mtag && pd->pf_mtag->dnpipe) {
+                pd->act.dnpipe = pd->pf_mtag->dnpipe;
+                pd->act.flags = pd->pf_mtag->dnflags;
+        }
+
+        pd->af = af;
+
+        switch (af) {
 #ifdef INET
+        case AF_INET: {
+                struct ip *h;
+
+                h = mtod(m, struct ip *);
+                *off = h->ip_hl << 2;
+                if (*off < (int)sizeof(*h)) {
+                        *action = PF_DROP;
+                        REASON_SET(reason, PFRES_SHORT);
+                        return (-1);
+                }
+                pd->src = (struct pf_addr *)&h->ip_src;
+                pd->dst = (struct pf_addr *)&h->ip_dst;
+                pd->sport = pd->dport = NULL;
+                pd->ip_sum = &h->ip_sum;
+                pd->proto_sum = NULL;
+                pd->proto = h->ip_p;
+                pd->dir = dir;
+                pd->sidx = (dir == PF_IN) ? 0 : 1;
+                pd->didx = (dir == PF_IN) ? 1 : 0;
+                pd->tos = h->ip_tos;
+                pd->tot_len = ntohs(h->ip_len);
+                pd->act.rtableid = -1;
+
+                /* fragments not reassembled handled later */
+                if (h->ip_off & htons(IP_MF | IP_OFFMASK))
+                        return (0);
+
+                switch (h->ip_p) {
+                case IPPROTO_TCP: {
+                        struct tcphdr *th = &pd->hdr.tcp;
+
+                        if (!pf_pull_hdr(m, *off, th, sizeof(*th), action,
+                                reason, AF_INET))
+                                return (-1);
+                        *hdrlen = sizeof(*th);
+                        pd->p_len = pd->tot_len - *off - (th->th_off << 2);
+                        pd->sport = &th->th_sport;
+                        pd->dport = &th->th_dport;
+                        break;
+                }
+                case IPPROTO_UDP: {
+                        struct udphdr *uh = &pd->hdr.udp;
+
+                        if (!pf_pull_hdr(m, *off, uh, sizeof(*uh), action,
+                                reason, AF_INET))
+                                return (-1);
+                        *hdrlen = sizeof(*uh);
+                        if (uh->uh_dport == 0 ||
+                            ntohs(uh->uh_ulen) > m->m_pkthdr.len - *off ||
+                            ntohs(uh->uh_ulen) < sizeof(struct udphdr)) {
+                                *action = PF_DROP;
+                                REASON_SET(reason, PFRES_SHORT);
+                                return (-1);
+                        }
+                        pd->sport = &uh->uh_sport;
+                        pd->dport = &uh->uh_dport;
+                        break;
+                }
+                case IPPROTO_SCTP: {
+                        if (!pf_pull_hdr(m, *off, &pd->hdr.sctp, sizeof(pd->hdr.sctp),
+                            action, reason, AF_INET)) {
+                                return (-1);
+                        }
+                        *hdrlen = sizeof(pd->hdr.sctp);
+                        pd->p_len = pd->tot_len - *off;
+
+                        pd->sport = &pd->hdr.sctp.src_port;
+                        pd->dport = &pd->hdr.sctp.dest_port;
+                        if (pd->hdr.sctp.src_port == 0 || pd->hdr.sctp.dest_port == 0) {
+                                *action = PF_DROP;
+                                REASON_SET(reason, PFRES_SHORT);
+                                return (-1);
+                        }
+                        if (pf_scan_sctp(m, *off, pd, kif) != PF_PASS) {
+                                *action = PF_DROP;
+                                REASON_SET(reason, PFRES_SHORT);
+                                return (-1);
+                        }
+                        break;
+                }
+                case IPPROTO_ICMP: {
+                        if (!pf_pull_hdr(m, *off, &pd->hdr.icmp, ICMP_MINLEN,
+                                action, reason, AF_INET))
+                                return (-1);
+                        *hdrlen = ICMP_MINLEN;
+                        break;
+                }
+                }
+                break;
+        }
+#endif
+#ifdef INET6
+        case AF_INET6: {
+                struct ip6_hdr *h;
+                int terminal = 0;
+
+                h = mtod(m, struct ip6_hdr *);
+                pd->src = (struct pf_addr *)&h->ip6_src;
+                pd->dst = (struct pf_addr *)&h->ip6_dst;
+                pd->sport = pd->dport = NULL;
+                pd->ip_sum = NULL;
+                pd->proto_sum = NULL;
+                pd->dir = dir;
+                pd->sidx = (dir == PF_IN) ? 0 : 1;
+                pd->didx = (dir == PF_IN) ? 1 : 0;
+                pd->tos = IPV6_DSCP(h);
+                pd->tot_len = ntohs(h->ip6_plen) + sizeof(struct ip6_hdr);
+                *off = ((caddr_t)h - m->m_data) + sizeof(struct ip6_hdr);
+                pd->proto = h->ip6_nxt;
+                pd->act.rtableid = -1;
+
+                do {
+                        switch (pd->proto) {
+                        case IPPROTO_FRAGMENT:
+                                if (kif == NULL || r == NULL) /* pflog */
+                                        *action = PF_DROP;
+                                else
+                                        *action = pf_test_fragment(r, kif,
+                                            m, h, pd, a, ruleset);
+                                if (*action == PF_DROP)
+                                        REASON_SET(reason, PFRES_FRAG);
+                                return (-1);
+                        case IPPROTO_ROUTING: {
+                                struct ip6_rthdr rthdr;
+
+                                if (pd->rh_cnt++) {
+                                        DPFPRINTF(PF_DEBUG_MISC,
+                                            ("pf: IPv6 more than one rthdr"));
+                                        *action = PF_DROP;
+                                        REASON_SET(reason, PFRES_IPOPTIONS);
+                                        return (-1);
+                                }
+                                if (!pf_pull_hdr(m, *off, &rthdr, sizeof(rthdr),
+                                        NULL, reason, pd->af)) {
+                                        DPFPRINTF(PF_DEBUG_MISC,
+                                            ("pf: IPv6 short rthdr"));
+                                        *action = PF_DROP;
+                                        REASON_SET(reason, PFRES_SHORT);
+                                        return (-1);
+                                }
+                                if (rthdr.ip6r_type == IPV6_RTHDR_TYPE_0) {
+                                        DPFPRINTF(PF_DEBUG_MISC,
+                                            ("pf: IPv6 rthdr0"));
+                                        *action = PF_DROP;
+                                        REASON_SET(reason, PFRES_IPOPTIONS);
+                                        return (-1);
+                                }
+                                /* FALLTHROUGH */
+                        }
+                        case IPPROTO_AH:
+                        case IPPROTO_HOPOPTS:
+                        case IPPROTO_DSTOPTS: {
+                                /* get next header and header length */
+                                struct ip6_ext opt6;
+
+                                if (!pf_pull_hdr(m, *off, &opt6, sizeof(opt6),
+                                        NULL, reason, pd->af)) {
+                                        DPFPRINTF(PF_DEBUG_MISC,
+                                            ("pf: IPv6 short opt"));
+                                        *action = PF_DROP;
+                                        return (-1);
+                                }
+                                if (pd->proto == IPPROTO_AH)
+                                        *off += (opt6.ip6e_len + 2) * 4;
+                                else
+                                        *off += (opt6.ip6e_len + 1) * 8;
+                                pd->proto = opt6.ip6e_nxt;
+                                /* goto the next header */
+                                break;
+                        }
+                        default:
+                                terminal++;
+                                break;
+                        }
+                } while (!terminal);
+
+                switch (pd->proto) {
+                case IPPROTO_TCP: {
+                        struct tcphdr *th = &pd->hdr.tcp;
+
+                        if (!pf_pull_hdr(m, *off, th, sizeof(*th), action,
+                                reason, AF_INET6))
+                                return (-1);
+                        *hdrlen = sizeof(*th);
+                        pd->p_len = pd->tot_len - *off - (th->th_off << 2);
+                        pd->sport = &th->th_sport;
+                        pd->dport = &th->th_dport;
+                        break;
+                }
+                case IPPROTO_UDP: {
+                        struct udphdr *uh = &pd->hdr.udp;
+
+                        if (!pf_pull_hdr(m, *off, uh, sizeof(*uh), action,
+                                reason, AF_INET6))
+                                return (-1);
+                        *hdrlen = sizeof(*uh);
+                        if (uh->uh_dport == 0 ||
+                            ntohs(uh->uh_ulen) > m->m_pkthdr.len - *off ||
+                            ntohs(uh->uh_ulen) < sizeof(struct udphdr)) {
+                                *action = PF_DROP;
+                                REASON_SET(reason, PFRES_SHORT);
+                                return (-1);
+                        }
+                        pd->sport = &uh->uh_sport;
+                        pd->dport = &uh->uh_dport;
+                        break;
+                }
+                case IPPROTO_SCTP: {
+                        if (!pf_pull_hdr(m, *off, &pd->hdr.sctp, sizeof(pd->hdr.sctp),
+                            action, reason, AF_INET6)) {
+                                return (-1);
+                        }
+                        *hdrlen = sizeof(pd->hdr.sctp);
+                        pd->p_len = pd->tot_len - *off;
+
+                        pd->sport = &pd->hdr.sctp.src_port;
+                        pd->dport = &pd->hdr.sctp.dest_port;
+                        if (pd->hdr.sctp.src_port == 0 || pd->hdr.sctp.dest_port == 0) {
+                                *action = PF_DROP;
+                                REASON_SET(reason, PFRES_SHORT);
+                                return (-1);
+                        }
+                        if (pf_scan_sctp(m, *off, pd, kif) != PF_PASS) {
+                                *action = PF_DROP;
+                                REASON_SET(reason, PFRES_SHORT);
+                                return (-1);
+                        }
+                        break;
+                }
+                case IPPROTO_ICMPV6: {
+                        size_t icmp_hlen = sizeof(struct icmp6_hdr);
+
+                        if (!pf_pull_hdr(m, *off, &pd->hdr.icmp6, icmp_hlen,
+                                action, reason, AF_INET6))
+                                return (-1);
+                        /* ICMP headers we look further into to match state */
+                        switch (pd->hdr.icmp6.icmp6_type) {
+                        case MLD_LISTENER_QUERY:
+                        case MLD_LISTENER_REPORT:
+                                icmp_hlen = sizeof(struct mld_hdr);
+                                break;
+                        case ND_NEIGHBOR_SOLICIT:
+                        case ND_NEIGHBOR_ADVERT:
+                                icmp_hlen = sizeof(struct nd_neighbor_solicit);
+                                break;
+                        }
+                        if (icmp_hlen > sizeof(struct icmp6_hdr) &&
+                            !pf_pull_hdr(m, *off, &pd->hdr.icmp6, icmp_hlen,
+                                action, reason, AF_INET6))
+                                return (-1);
+                        *hdrlen = icmp_hlen;
+                        break;
+                }
+                }
+                break;
+        }
+#endif
+        default:
+                panic("pf_setup_pdesc called with illegal af %u", af);
+        }
+        return (0);
+}
+
+#ifdef INET
 int
 pf_test(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0,
     struct inpcb *inp, struct pf_rule_actions *default_actions)
 {
         struct pfi_kkif         *kif;
         u_short                         action, reason = 0;
         struct mbuf                *m = *m0;
         struct ip                *h = NULL;
         struct m_tag            *mtag;
         struct pf_krule                *a = NULL, *r = &V_pf_default_rule, *tr, *nr;
         struct pf_kstate        *s = NULL;
         struct pf_kruleset        *ruleset = NULL;
         struct pf_pdesc          pd;
-        int                         off, dirndx, use_2nd_queue = 0;
+        int                         off, hdrlen, dirndx, use_2nd_queue = 0;
         uint16_t                 tag;
         uint8_t                  rt;
 
         PF_RULES_RLOCK_TRACKER;
         KASSERT(dir == PF_IN || dir == PF_OUT, ("%s: bad direction %d\n", __func__, dir));
         M_ASSERTPKTHDR(m);
 
         if (!V_pf_status.running)
pf_test(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0,
         }
 
         if (__predict_false(! M_WRITABLE(*m0))) {
                 m = *m0 = m_unshare(*m0, M_NOWAIT);
                 if (*m0 == NULL)
                         return (PF_DROP);
         }
 
+        if (__predict_false(m->m_len < sizeof(struct ip)) &&
+            (m = *m0 = m_pullup(*m0, sizeof(struct ip))) == NULL) {
+                DPFPRINTF(PF_DEBUG_URGENT,
+                    ("pf_test: m_len < sizeof(struct ip), pullup failed\n"));
+                PF_RULES_RUNLOCK();
+                return (PF_DROP);
+        }
+
         memset(&pd, 0, sizeof(pd));
-        TAILQ_INIT(&pd.sctp_multihome_jobs);
-        if (default_actions != NULL)
-                memcpy(&pd.act, default_actions, sizeof(pd.act));
-        pd.pf_mtag = pf_find_mtag(m);
+        pd.dir = dir;
 
+        if (pf_normalize_ip(m0, kif, &reason, &pd) != PF_PASS) {
+                /* We do IP header normalization and packet reassembly here */
+                action = PF_DROP;
+                goto done;
+        }
+        m = *m0;        /* pf_normalize messes with m0 */
+        h = mtod(m, struct ip *);
+
+        if (pf_setup_pdesc(AF_INET, dir, &pd, m, &action, &reason, kif, &a, &r,
+                &ruleset, &off, &hdrlen, default_actions) == -1) {
+                if (action != PF_PASS)
+                        pd.act.log |= PF_LOG_FORCE;
+                goto done;
+        }
+
         if (pd.pf_mtag != NULL && (pd.pf_mtag->flags & PF_MTAG_FLAG_ROUTE_TO)) {
                 pd.pf_mtag->flags &= ~PF_MTAG_FLAG_ROUTE_TO;
 
                 ifp = ifnet_byindexgen(pd.pf_mtag->if_index,
                     pd.pf_mtag->if_idxgen);
                 if (ifp == NULL || ifp->if_flags & IFF_DYING) {
                         PF_RULES_RUNLOCK();
                         m_freem(*m0);
                         *m0 = NULL;
                         return (PF_PASS);
                 }
                 PF_RULES_RUNLOCK();
                 (ifp->if_output)(ifp, m, sintosa(&pd.pf_mtag->dst), NULL);
                 *m0 = NULL;
                 return (PF_PASS);
         }
 
-        if (pd.pf_mtag && pd.pf_mtag->dnpipe) {
-                pd.act.dnpipe = pd.pf_mtag->dnpipe;
-                pd.act.flags = pd.pf_mtag->dnflags;
-        }
-
         if (ip_dn_io_ptr != NULL && pd.pf_mtag != NULL &&
             pd.pf_mtag->flags & PF_MTAG_FLAG_DUMMYNET) {
                 /* Dummynet re-injects packets after they've
                  * completed their delay. We've already
                  * processed them, so pass unconditionally. */
 
                 /* But only once. We may see the packet multiple times (e.g.
                  * PFIL_IN/PFIL_OUT). */
                 pf_dummynet_flag_remove(m, pd.pf_mtag);
                 PF_RULES_RUNLOCK();
 
                 return (PF_PASS);
         }
 
-        pd.sport = pd.dport = NULL;
-        pd.proto_sum = NULL;
-        pd.dir = dir;
-        pd.sidx = (dir == PF_IN) ? 0 : 1;
-        pd.didx = (dir == PF_IN) ? 1 : 0;
-        pd.af = AF_INET;
-        pd.act.rtableid = -1;
-
-        if (__predict_false(m->m_len < sizeof(struct ip)) &&
-            (m = *m0 = m_pullup(*m0, sizeof(struct ip))) == NULL) {
-                DPFPRINTF(PF_DEBUG_URGENT,
-                    ("pf_test: m_len < sizeof(struct ip), pullup failed\n"));
-                PF_RULES_RUNLOCK();
-                return (PF_DROP);
-        }
-        h = mtod(m, struct ip *);
-        off = h->ip_hl << 2;
-
         if (__predict_false(ip_divert_ptr != NULL) &&
             ((mtag = m_tag_locate(m, MTAG_PF_DIVERT, 0, NULL)) != NULL)) {
                 struct pf_divert_mtag *dt = (struct pf_divert_mtag *)(mtag+1);
                 if ((dt->idir == PF_DIVERT_MTAG_DIR_IN && dir == PF_IN) ||
                     (dt->idir == PF_DIVERT_MTAG_DIR_OUT && dir == PF_OUT)) {
                         if (pd.pf_mtag == NULL &&
                             ((pd.pf_mtag = pf_get_mtag(m)) == NULL)) {
                                 action = PF_DROP;
                                 goto done;
                         }
                         pd.pf_mtag->flags |= PF_MTAG_FLAG_PACKET_LOOPED;
                 }
                 if (pd.pf_mtag && pd.pf_mtag->flags & PF_MTAG_FLAG_FASTFWD_OURS_PRESENT) {
                         m->m_flags |= M_FASTFWD_OURS;
                         pd.pf_mtag->flags &= ~PF_MTAG_FLAG_FASTFWD_OURS_PRESENT;
                 }
                 m_tag_delete(m, mtag);
 
                 mtag = m_tag_locate(m, MTAG_IPFW_RULE, 0, NULL);
                 if (mtag != NULL)
                         m_tag_delete(m, mtag);
-        } else if (pf_normalize_ip(m0, kif, &reason, &pd) != PF_PASS) {
-                /* We do IP header normalization and packet reassembly here */
-                action = PF_DROP;
-                goto done;
         }
-        m = *m0;        /* pf_normalize messes with m0 */
-        h = mtod(m, struct ip *);
 
-        off = h->ip_hl << 2;
-        if (off < (int)sizeof(struct ip)) {
-                action = PF_DROP;
-                REASON_SET(&reason, PFRES_SHORT);
-                pd.act.log = PF_LOG_FORCE;
-                goto done;
-        }
-
-        pd.src = (struct pf_addr *)&h->ip_src;
-        pd.dst = (struct pf_addr *)&h->ip_dst;
-        pd.ip_sum = &h->ip_sum;
-        pd.proto = h->ip_p;
-        pd.tos = h->ip_tos & ~IPTOS_ECN_MASK;
-        pd.tot_len = ntohs(h->ip_len);
-
         /* handle fragments that didn't get reassembled by normalization */
         if (h->ip_off & htons(IP_MF | IP_OFFMASK)) {
                 action = pf_test_fragment(&r, kif, m, h, &pd, &a, &ruleset);
                 goto done;
         }
 
         switch (h->ip_p) {
         case IPPROTO_TCP: {
-                if (!pf_pull_hdr(m, off, &pd.hdr.tcp, sizeof(pd.hdr.tcp),
-                    &action, &reason, AF_INET)) {
-                        if (action != PF_PASS)
-                                pd.act.log = PF_LOG_FORCE;
-                        goto done;
-                }
-                pd.p_len = pd.tot_len - off - (pd.hdr.tcp.th_off << 2);
 
-                pd.sport = &pd.hdr.tcp.th_sport;
-                pd.dport = &pd.hdr.tcp.th_dport;
-
                 /* Respond to SYN with a syncookie. */
                 if ((pd.hdr.tcp.th_flags & (TH_SYN|TH_ACK|TH_RST)) == TH_SYN &&
                     pd.dir == PF_IN && pf_synflood_check(&pd)) {
                         pf_syncookie_send(m, off, &pd);
                         action = PF_DROP;
                         break;
                 }
 
if (action == PF_PASS) {
 
                                 s->src.seqhi = ntohl(pd.hdr.tcp.th_ack) - 1;
                                 s->src.seqlo = ntohl(pd.hdr.tcp.th_seq) - 1;
                                 pf_set_protostate(s, PF_PEER_SRC, PF_TCPS_PROXY_DST);
                                 action = pf_synproxy(&pd, &s, &reason);
                                 break;
                         } else {
                                 action = pf_test_rule(&r, &s, kif, m, off, &pd,
-                                    &a, &ruleset, inp);
+                                    &a, &ruleset, inp, hdrlen);
                         }
                 }
                 break;
         }
 
         case IPPROTO_UDP: {
-                if (!pf_pull_hdr(m, off, &pd.hdr.udp, sizeof(pd.hdr.udp),
-                    &action, &reason, AF_INET)) {
-                        if (action != PF_PASS)
-                                pd.act.log = PF_LOG_FORCE;
-                        goto done;
-                }
-                pd.sport = &pd.hdr.udp.uh_sport;
-                pd.dport = &pd.hdr.udp.uh_dport;
-                if (pd.hdr.udp.uh_dport == 0 ||
-                    ntohs(pd.hdr.udp.uh_ulen) > m->m_pkthdr.len - off ||
-                    ntohs(pd.hdr.udp.uh_ulen) < sizeof(struct udphdr)) {
-                        action = PF_DROP;
-                        REASON_SET(&reason, PFRES_SHORT);
-                        goto done;
-                }
                 action = pf_test_state_udp(&s, kif, m, off, h, &pd);
                 if (action == PF_PASS) {
                         if (V_pfsync_update_state_ptr != NULL)
                                 V_pfsync_update_state_ptr(s);
                         r = s->rule.ptr;
                         a = s->anchor.ptr;
                 } else if (s == NULL)
                         action = pf_test_rule(&r, &s, kif, m, off, &pd,
-                            &a, &ruleset, inp);
+                            &a, &ruleset, inp, hdrlen);
                 break;
         }
 
         case IPPROTO_SCTP: {
-                if (!pf_pull_hdr(m, off, &pd.hdr.sctp, sizeof(pd.hdr.sctp),
-                    &action, &reason, AF_INET)) {
-                        if (action != PF_PASS)
-                                pd.act.log |= PF_LOG_FORCE;
-                        goto done;
-                }
-                pd.p_len = pd.tot_len - off;
-
-                pd.sport = &pd.hdr.sctp.src_port;
-                pd.dport = &pd.hdr.sctp.dest_port;
-                if (pd.hdr.sctp.src_port == 0 || pd.hdr.sctp.dest_port == 0) {
-                        action = PF_DROP;
-                        REASON_SET(&reason, PFRES_SHORT);
-                        goto done;
-                }
                 action = pf_normalize_sctp(dir, kif, m, 0, off, h, &pd);
                 if (action == PF_DROP)
                         goto done;
                 action = pf_test_state_sctp(&s, kif, m, off, h, &pd,
                     &reason);
                 if (action == PF_PASS) {
                         if (V_pfsync_update_state_ptr != NULL)
                                 V_pfsync_update_state_ptr(s);
                         r = s->rule.ptr;
                         a = s->anchor.ptr;
                 } else if (s == NULL) {
                         action = pf_test_rule(&r, &s, kif, m, off,
-                            &pd, &a, &ruleset, inp);
+                            &pd, &a, &ruleset, inp, hdrlen);
                 }
                 break;
         }
 
         case IPPROTO_ICMP: {
-                if (!pf_pull_hdr(m, off, &pd.hdr.icmp, ICMP_MINLEN,
-                    &action, &reason, AF_INET)) {
-                        if (action != PF_PASS)
-                                pd.act.log = PF_LOG_FORCE;
-                        goto done;
-                }
                 action = pf_test_state_icmp(&s, kif, m, off, h, &pd, &reason);
                 if (action == PF_PASS) {
                         if (V_pfsync_update_state_ptr != NULL)
                                 V_pfsync_update_state_ptr(s);
                         r = s->rule.ptr;
                         a = s->anchor.ptr;
                 } else if (s == NULL)
                         action = pf_test_rule(&r, &s, kif, m, off, &pd,
-                            &a, &ruleset, inp);
+                            &a, &ruleset, inp, hdrlen);
                 break;
         }
 
         case IPPROTO_ICMPV6: {
                 action = PF_DROP;
                 DPFPRINTF(PF_DEBUG_MISC,
                     ("pf: dropping IPv4 packet with ICMPv6 payload\n"));
                 goto done;
         }
 
         default:
                 action = pf_test_state_other(&s, kif, m, &pd);
                 if (action == PF_PASS) {
                         if (V_pfsync_update_state_ptr != NULL)
                                 V_pfsync_update_state_ptr(s);
                         r = s->rule.ptr;
                         a = s->anchor.ptr;
                 } else if (s == NULL)
                         action = pf_test_rule(&r, &s, kif, m, off, &pd,
-                            &a, &ruleset, inp);
+                            &a, &ruleset, inp, hdrlen);
                 break;
         }
 
 done:
         PF_RULES_RUNLOCK();
         if (action == PF_PASS && h->ip_hl > 5 &&
             !((s && s->state_flags & PFSTATE_ALLOWOPTS) || r->allow_opts)) {
                 action = PF_DROP;
pf_test6(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0, struct inpcb *inp,
         u_short                         action, reason = 0;
         struct mbuf                *m = *m0, *n = NULL;
         struct m_tag            *mtag;
         struct ip6_hdr                *h = NULL;
         struct pf_krule                *a = NULL, *r = &V_pf_default_rule, *tr, *nr;
         struct pf_kstate        *s = NULL;
         struct pf_kruleset        *ruleset = NULL;
         struct pf_pdesc          pd;
-        int                         off, terminal = 0, dirndx, rh_cnt = 0, use_2nd_queue = 0;
+        int                         off, hdrlen, dirndx, use_2nd_queue = 0;
         uint16_t                 tag;
         uint8_t                  rt;
 
         PF_RULES_RLOCK_TRACKER;
         KASSERT(dir == PF_IN || dir == PF_OUT, ("%s: bad direction %d\n", __func__, dir));
         M_ASSERTPKTHDR(m);
 
         if (!V_pf_status.running)
pf_test6(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0, struct inpcb *inp,
         }
 
         if (__predict_false(! M_WRITABLE(*m0))) {
                 m = *m0 = m_unshare(*m0, M_NOWAIT);
                 if (*m0 == NULL)
                         return (PF_DROP);
         }
 
+        if (__predict_false(m->m_len < sizeof(struct ip6_hdr)) &&
+            (m = *m0 = m_pullup(*m0, sizeof(struct ip6_hdr))) == NULL) {
+                DPFPRINTF(PF_DEBUG_URGENT,
+                    ("pf_test6: m_len < sizeof(struct ip6_hdr)"
+                     ", pullup failed\n"));
+                PF_RULES_RUNLOCK();
+                return (PF_DROP);
+        }
+
         memset(&pd, 0, sizeof(pd));
-        TAILQ_INIT(&pd.sctp_multihome_jobs);
-        if (default_actions != NULL)
-                memcpy(&pd.act, default_actions, sizeof(pd.act));
-        pd.pf_mtag = pf_find_mtag(m);
+        pd.dir = dir;
 
+        /* We do IP header normalization and packet reassembly here */
+        if (pf_normalize_ip6(m0, kif, &reason, &pd) != PF_PASS) {
+                action = PF_DROP;
+                goto done;
+        }
+        m = *m0;        /* pf_normalize messes with m0 */
+        h = mtod(m, struct ip6_hdr *);
+        off = ((caddr_t)h - m->m_data) + sizeof(struct ip6_hdr);
+
+        if (pf_setup_pdesc(AF_INET6, dir, &pd, m, &action, &reason, kif, &a, &r,
+                &ruleset, &off, &hdrlen, default_actions) == -1) {
+                if (action != PF_PASS)
+                        pd.act.log |= PF_LOG_FORCE;
+                goto done;
+        }
+
         if (pd.pf_mtag != NULL && (pd.pf_mtag->flags & PF_MTAG_FLAG_ROUTE_TO)) {
                 pd.pf_mtag->flags &= ~PF_MTAG_FLAG_ROUTE_TO;
 
                 ifp = ifnet_byindexgen(pd.pf_mtag->if_index,
                     pd.pf_mtag->if_idxgen);
                 if (ifp == NULL || ifp->if_flags & IFF_DYING) {
                         PF_RULES_RUNLOCK();
                         m_freem(*m0);
                         *m0 = NULL;
                         return (PF_PASS);
                 }
                 PF_RULES_RUNLOCK();
                 nd6_output_ifp(ifp, ifp, m,
                     (struct sockaddr_in6 *)&pd.pf_mtag->dst, NULL);
                 *m0 = NULL;
                 return (PF_PASS);
         }
 
-        if (pd.pf_mtag && pd.pf_mtag->dnpipe) {
-                pd.act.dnpipe = pd.pf_mtag->dnpipe;
-                pd.act.flags = pd.pf_mtag->dnflags;
-        }
-
         if (ip_dn_io_ptr != NULL && pd.pf_mtag != NULL &&
             pd.pf_mtag->flags & PF_MTAG_FLAG_DUMMYNET) {
                 pf_dummynet_flag_remove(m, pd.pf_mtag);
                 /* Dummynet re-injects packets after they've
                  * completed their delay. We've already
                  * processed them, so pass unconditionally. */
                 PF_RULES_RUNLOCK();
                 return (PF_PASS);
         }
 
-        pd.sport = pd.dport = NULL;
-        pd.ip_sum = NULL;
-        pd.proto_sum = NULL;
-        pd.dir = dir;
-        pd.sidx = (dir == PF_IN) ? 0 : 1;
-        pd.didx = (dir == PF_IN) ? 1 : 0;
-        pd.af = AF_INET6;
-        pd.act.rtableid = -1;
-
-        if (__predict_false(m->m_len < sizeof(struct ip6_hdr)) &&
-            (m = *m0 = m_pullup(*m0, sizeof(struct ip6_hdr))) == NULL) {
-                DPFPRINTF(PF_DEBUG_URGENT,
-                    ("pf_test6: m_len < sizeof(struct ip6_hdr)"
-                     ", pullup failed\n"));
-                PF_RULES_RUNLOCK();
-                return (PF_DROP);
-        }
-        h = mtod(m, struct ip6_hdr *);
-        off = ((caddr_t)h - m->m_data) + sizeof(struct ip6_hdr);
-
-        /* We do IP header normalization and packet reassembly here */
-        if (pf_normalize_ip6(m0, kif, &reason, &pd) != PF_PASS) {
-                action = PF_DROP;
-                goto done;
-        }
-        m = *m0;        /* pf_normalize messes with m0 */
-        h = mtod(m, struct ip6_hdr *);
-        off = ((caddr_t)h - m->m_data) + sizeof(struct ip6_hdr);
-
         /*
          * we do not support jumbogram.  if we keep going, zero ip6_plen
          * will do something bad, so drop the packet for now.
          */
         if (htons(h->ip6_plen) == 0) {
                 action = PF_DROP;
                 REASON_SET(&reason, PFRES_NORM);        /*XXX*/
                 goto done;
         }
 
-        pd.src = (struct pf_addr *)&h->ip6_src;
-        pd.dst = (struct pf_addr *)&h->ip6_dst;
-        pd.tos = IPV6_DSCP(h);
-        pd.tot_len = ntohs(h->ip6_plen) + sizeof(struct ip6_hdr);
-
-        pd.proto = h->ip6_nxt;
-        do {
-                switch (pd.proto) {
-                case IPPROTO_FRAGMENT:
-                        action = pf_test_fragment(&r, kif, m, h, &pd, &a,
-                            &ruleset);
-                        if (action == PF_DROP)
-                                REASON_SET(&reason, PFRES_FRAG);
-                        goto done;
-                case IPPROTO_ROUTING: {
-                        struct ip6_rthdr rthdr;
-
-                        if (rh_cnt++) {
-                                DPFPRINTF(PF_DEBUG_MISC,
-                                    ("pf: IPv6 more than one rthdr\n"));
-                                action = PF_DROP;
-                                REASON_SET(&reason, PFRES_IPOPTIONS);
-                                pd.act.log = PF_LOG_FORCE;
-                                goto done;
-                        }
-                        if (!pf_pull_hdr(m, off, &rthdr, sizeof(rthdr), NULL,
-                            &reason, pd.af)) {
-                                DPFPRINTF(PF_DEBUG_MISC,
-                                    ("pf: IPv6 short rthdr\n"));
-                                action = PF_DROP;
-                                REASON_SET(&reason, PFRES_SHORT);
-                                pd.act.log = PF_LOG_FORCE;
-                                goto done;
-                        }
-                        if (rthdr.ip6r_type == IPV6_RTHDR_TYPE_0) {
-                                DPFPRINTF(PF_DEBUG_MISC,
-                                    ("pf: IPv6 rthdr0\n"));
-                                action = PF_DROP;
-                                REASON_SET(&reason, PFRES_IPOPTIONS);
-                                pd.act.log = PF_LOG_FORCE;
-                                goto done;
-                        }
-                        /* FALLTHROUGH */
-                }
-                case IPPROTO_AH:
-                case IPPROTO_HOPOPTS:
-                case IPPROTO_DSTOPTS: {
-                        /* get next header and header length */
-                        struct ip6_ext  opt6;
-
-                        if (!pf_pull_hdr(m, off, &opt6, sizeof(opt6),
-                            NULL, &reason, pd.af)) {
-                                DPFPRINTF(PF_DEBUG_MISC,
-                                    ("pf: IPv6 short opt\n"));
-                                action = PF_DROP;
-                                pd.act.log = PF_LOG_FORCE;
-                                goto done;
-                        }
-                        if (pd.proto == IPPROTO_AH)
-                                off += (opt6.ip6e_len + 2) * 4;
-                        else
-                                off += (opt6.ip6e_len + 1) * 8;
-                        pd.proto = opt6.ip6e_nxt;
-                        /* goto the next header */
-                        break;
-                }
-                default:
-                        terminal++;
-                        break;
-                }
-        } while (!terminal);
-
         /* if there's no routing header, use unmodified mbuf for checksumming */
         if (!n)
                 n = m;
 
         switch (pd.proto) {
         case IPPROTO_TCP: {
-                if (!pf_pull_hdr(m, off, &pd.hdr.tcp, sizeof(pd.hdr.tcp),
-                    &action, &reason, AF_INET6)) {
-                        if (action != PF_PASS)
-                                pd.act.log |= PF_LOG_FORCE;
-                        goto done;
-                }
-                pd.p_len = pd.tot_len - off - (pd.hdr.tcp.th_off << 2);
-                pd.sport = &pd.hdr.tcp.th_sport;
-                pd.dport = &pd.hdr.tcp.th_dport;
-
                 /* Respond to SYN with a syncookie. */
                 if ((pd.hdr.tcp.th_flags & (TH_SYN|TH_ACK|TH_RST)) == TH_SYN &&
                     pd.dir == PF_IN && pf_synflood_check(&pd)) {
                         pf_syncookie_send(m, off, &pd);
                         action = PF_DROP;
                         break;
                 }
 
if (action == PF_PASS) {
                                 s->src.seqhi = ntohl(pd.hdr.tcp.th_ack) - 1;
                                 s->src.seqlo = ntohl(pd.hdr.tcp.th_seq) - 1;
                                 pf_set_protostate(s, PF_PEER_SRC, PF_TCPS_PROXY_DST);
 
                                 action = pf_synproxy(&pd, &s, &reason);
                                 break;
                         } else {
                                 action = pf_test_rule(&r, &s, kif, m, off, &pd,
-                                    &a, &ruleset, inp);
+                                    &a, &ruleset, inp, hdrlen);
                         }
                 }
                 break;
         }
 
         case IPPROTO_UDP: {
-                if (!pf_pull_hdr(m, off, &pd.hdr.udp, sizeof(pd.hdr.udp),
-                    &action, &reason, AF_INET6)) {
-                        if (action != PF_PASS)
-                                pd.act.log |= PF_LOG_FORCE;
-                        goto done;
-                }
-                pd.sport = &pd.hdr.udp.uh_sport;
-                pd.dport = &pd.hdr.udp.uh_dport;
-                if (pd.hdr.udp.uh_dport == 0 ||
-                    ntohs(pd.hdr.udp.uh_ulen) > m->m_pkthdr.len - off ||
-                    ntohs(pd.hdr.udp.uh_ulen) < sizeof(struct udphdr)) {
-                        action = PF_DROP;
-                        REASON_SET(&reason, PFRES_SHORT);
-                        goto done;
-                }
                 action = pf_test_state_udp(&s, kif, m, off, h, &pd);
                 if (action == PF_PASS) {
                         if (V_pfsync_update_state_ptr != NULL)
                                 V_pfsync_update_state_ptr(s);
                         r = s->rule.ptr;
                         a = s->anchor.ptr;
                 } else if (s == NULL)
                         action = pf_test_rule(&r, &s, kif, m, off, &pd,
-                            &a, &ruleset, inp);
+                            &a, &ruleset, inp, hdrlen);
                 break;
         }
 
         case IPPROTO_SCTP: {
-                if (!pf_pull_hdr(m, off, &pd.hdr.sctp, sizeof(pd.hdr.sctp),
-                    &action, &reason, AF_INET6)) {
-                        if (action != PF_PASS)
-                                pd.act.log |= PF_LOG_FORCE;
-                        goto done;
-                }
-                pd.sport = &pd.hdr.sctp.src_port;
-                pd.dport = &pd.hdr.sctp.dest_port;
-                if (pd.hdr.sctp.src_port == 0 || pd.hdr.sctp.dest_port == 0) {
-                        action = PF_DROP;
-                        REASON_SET(&reason, PFRES_SHORT);
-                        goto done;
-                }
                 action = pf_normalize_sctp(dir, kif, m, 0, off, h, &pd);
                 if (action == PF_DROP)
                         goto done;
                 action = pf_test_state_sctp(&s, kif, m, off, h, &pd,
                     &reason);
                 if (action == PF_PASS) {
                         if (V_pfsync_update_state_ptr != NULL)
                                 V_pfsync_update_state_ptr(s);
                         r = s->rule.ptr;
                         a = s->anchor.ptr;
                 } else if (s == NULL) {
                         action = pf_test_rule(&r, &s, kif, m, off,
-                            &pd, &a, &ruleset, inp);
+                            &pd, &a, &ruleset, inp, hdrlen);
                 }
                 break;
         }
 
         case IPPROTO_ICMP: {
                 action = PF_DROP;
                 DPFPRINTF(PF_DEBUG_MISC,
                     ("pf: dropping IPv6 packet with ICMPv4 payload\n"));
                 goto done;
         }
 
         case IPPROTO_ICMPV6: {
-                if (!pf_pull_hdr(m, off, &pd.hdr.icmp6, sizeof(pd.hdr.icmp6),
-                    &action, &reason, AF_INET6)) {
-                        if (action != PF_PASS)
-                                pd.act.log |= PF_LOG_FORCE;
-                        goto done;
-                }
                 action = pf_test_state_icmp(&s, kif, m, off, h, &pd, &reason);
                 if (action == PF_PASS) {
                         if (V_pfsync_update_state_ptr != NULL)
                                 V_pfsync_update_state_ptr(s);
                         r = s->rule.ptr;
                         a = s->anchor.ptr;
                 } else if (s == NULL)
                         action = pf_test_rule(&r, &s, kif, m, off, &pd,
-                            &a, &ruleset, inp);
+                            &a, &ruleset, inp, hdrlen);
                 break;
         }
 
         default:
                 action = pf_test_state_other(&s, kif, m, &pd);
                 if (action == PF_PASS) {
                         if (V_pfsync_update_state_ptr != NULL)
                                 V_pfsync_update_state_ptr(s);
                         r = s->rule.ptr;
                         a = s->anchor.ptr;
                 } else if (s == NULL)
                         action = pf_test_rule(&r, &s, kif, m, off, &pd,
-                            &a, &ruleset, inp);
+                            &a, &ruleset, inp, hdrlen);
                 break;
         }
 
 done:
         PF_RULES_RUNLOCK();
         if (n != m) {
                 m_freem(n);
                 n = NULL;
         }
 
         /* handle dangerous IPv6 extension headers. */
-        if (action == PF_PASS && rh_cnt &&
+        if (action == PF_PASS && pd.rh_cnt &&
             !((s && s->state_flags & PFSTATE_ALLOWOPTS) || r->allow_opts)) {
                 action = PF_DROP;
                 REASON_SET(&reason, PFRES_IPOPTIONS);
                 pd.act.log = r->log;
                 DPFPRINTF(PF_DEBUG_MISC,
                     ("pf: dropping packet with dangerous v6 headers\n"));
         }