cam: Initialize wired to false

[imp]

Summary

As part of converting the code to a while loop, the unconditional
initialization of wired to false was lost.

Sponsored by: Netflix

[jrtc27]

sys/cam/cam_periph.c

615

The control flow here is also a bit weird, would make more sense to me as:

while (resource_find_dev(...) == 0 && !wired) {
    if (...) {
        wired = true;
    }
    ...
    if (...) {
        wired = true;
    }
}
if (wired)
    unit = dunit;

[jrtc27]

sys/cam/cam_periph.c

615

Or probably !wired && resource_find_dev(...) == 0 so it doesn't mess with dunit after wired becomes true

[imp]

sys/cam/cam_periph.c

615

Yea, maybe true. Also true that it likely is more likely to introduce a new bug. I'll look at making that structural change in a separate commit that i can take more time to validate so there aren't other hidden dragons... like the fact that we hit continue and reset wired to false which would
break your suggested reordering. Otherwise we would just do 'break' at that point.

[jrtc27]

sys/cam/cam_periph.c

615

I see, initially read it as iterating over property names and thus only one would ever be true... but indeed that's not what it does. Agreed it's not for this diff.

[mjg]

As noted in the mail I don't know what this code is supposed to be doing, so I'm not going to review anything.

However, setting 'wired = false' upfront restores the previously seen behavior and fixes the immediate regression, so I would say this should be committed and any other tinkering should come in later.

sys/cam/cam_periph.c

 static int                 pf_dummynet_route(struct pf_pdesc *,
                             struct pf_kstate *, struct pf_krule *,
                             struct ifnet *, struct sockaddr *, struct mbuf **);
 static int                 pf_test_eth_rule(int, struct pfi_kkif *,
                             struct mbuf **);
 static int                 pf_test_rule(struct pf_krule **, struct pf_kstate **,
                             struct pfi_kkif *, struct mbuf *, int,
                             struct pf_pdesc *, struct pf_krule **,
-                            struct pf_kruleset **, struct inpcb *);
+                            struct pf_kruleset **, struct inpcb *, int);
 static int                 pf_create_state(struct pf_krule *, struct pf_krule *,
                             struct pf_krule *, struct pf_pdesc *,
                             struct pf_ksrc_node *, struct pf_state_key *,
                             struct pf_state_key *, struct mbuf *, int,
                             u_int16_t, u_int16_t, int *, struct pfi_kkif *,
                             struct pf_kstate **, int, u_int16_t, u_int16_t,
                             int, struct pf_krule_slist *, struct pf_udp_mapping *);
 static int                 pf_state_key_addr_setup(struct pf_pdesc *, struct mbuf *,
#endif /* INET6 */
         }
 
         return (action);
 }
 
 static int
 pf_test_rule(struct pf_krule **rm, struct pf_kstate **sm, struct pfi_kkif *kif,
     struct mbuf *m, int off, struct pf_pdesc *pd, struct pf_krule **am,
-    struct pf_kruleset **rsm, struct inpcb *inp)
+    struct pf_kruleset **rsm, struct inpcb *inp, int hdrlen)
 {
         struct pf_krule                *nr = NULL;
         struct pf_addr                * const saddr = pd->src;
         struct pf_addr                * const daddr = pd->dst;
         sa_family_t                 af = pd->af;
         struct pf_krule                *r, *a = NULL;
         struct pf_kruleset        *ruleset = NULL;
         struct pf_krule_slist    match_rules;
         struct pf_krule_item    *ri;
         struct pf_ksrc_node        *nsn = NULL;
         struct tcphdr                *th = &pd->hdr.tcp;
         struct pf_state_key        *sk = NULL, *nk = NULL;
         u_short                  reason, transerror;
-        int                         rewrite = 0, hdrlen = 0;
+        int                      rewrite = 0;
         int                      tag = -1;
         int                      asd = 0;
         int                      match = 0;
         int                         state_icmp = 0, icmp_dir, multi;
         u_int16_t                 sport = 0, dport = 0, virtual_type, virtual_id;
         u_int16_t                 bproto_sum = 0, bip_sum = 0;
         u_int8_t                 icmptype = 0, icmpcode = 0;
         struct pf_kanchor_stackframe        anchor_stack[PF_ANCHOR_STACKSIZE];
if (inp != NULL) {
                 pd->lookup.gid = inp->inp_cred->cr_groups[0];
                 pd->lookup.done = 1;
         }
 
         switch (pd->proto) {
         case IPPROTO_TCP:
                 sport = th->th_sport;
                 dport = th->th_dport;
-                hdrlen = sizeof(*th);
                 break;
         case IPPROTO_UDP:
                 sport = pd->hdr.udp.uh_sport;
                 dport = pd->hdr.udp.uh_dport;
-                hdrlen = sizeof(pd->hdr.udp);
                 break;
         case IPPROTO_SCTP:
                 sport = pd->hdr.sctp.src_port;
                 dport = pd->hdr.sctp.dest_port;
-                hdrlen = sizeof(pd->hdr.sctp);
                 break;
 #ifdef INET
         case IPPROTO_ICMP:
                 if (pd->af != AF_INET)
                         break;
-                hdrlen = sizeof(pd->hdr.icmp);
                 icmptype = pd->hdr.icmp.icmp_type;
                 icmpcode = pd->hdr.icmp.icmp_code;
                 state_icmp = pf_icmp_mapping(pd, icmptype,
                     &icmp_dir, &multi, &virtual_id, &virtual_type);
                 if (icmp_dir == PF_IN) {
                         sport = virtual_id;
                         dport = virtual_type;
                 } else {
                         sport = virtual_type;
                         dport = virtual_id;
                 }
                 break;
 #endif /* INET */
 #ifdef INET6
         case IPPROTO_ICMPV6:
                 if (af != AF_INET6)
                         break;
-                hdrlen = sizeof(pd->hdr.icmp6);
                 icmptype = pd->hdr.icmp6.icmp6_type;
                 icmpcode = pd->hdr.icmp6.icmp6_code;
                 state_icmp = pf_icmp_mapping(pd, icmptype,
                     &icmp_dir, &multi, &virtual_id, &virtual_type);
                 if (icmp_dir == PF_IN) {
                         sport = virtual_id;
                         dport = virtual_type;
                 } else {
                         sport = virtual_type;
                         dport = virtual_id;
                 }
 
                 break;
 #endif /* INET6 */
         default:
-                sport = dport = hdrlen = 0;
+                sport = dport = 0;
                 break;
         }
 
         r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr);
 
         /* check packet for BINAT/NAT/RDR */
         transerror = pf_get_translation(pd, m, off, kif, &nsn, &sk,
             &nk, saddr, daddr, sport, dport, anchor_stack, &nr, &udp_mapping);
case  SCTP_ADD_IP_ADDRESS: {
                         PF_RULES_RLOCK();
                         sm = NULL;
                         /*
                          * New connections need to be floating, because
                          * we cannot know what interfaces it will use.
                          * That's why we pass V_pfi_all rather than kif.
                          */
                         ret = pf_test_rule(&r, &sm, V_pfi_all,
-                            j->m, off, &j->pd, &ra, &rs, NULL);
+                            j->m, off, &j->pd, &ra, &rs, NULL,
+                            sizeof(j->pd.hdr.sctp));
                         PF_RULES_RUNLOCK();
                         SDT_PROBE4(pf, sctp, multihome, test, kif, r, j->m, ret);
                         if (ret != PF_DROP && sm != NULL) {
                                 /* Inherit v_tag values. */
                                 if (sm->direction == s->direction) {
                                         sm->src.scrub->pfss_v_tag = s->src.scrub->pfss_v_tag;
                                         sm->dst.scrub->pfss_v_tag = s->dst.scrub->pfss_v_tag;
                                 } else {
if (pf_pdesc_to_dnflow(pd, r, s, &dnflow)) {
                                 pf_dummynet_flag_remove(*m0, pd->pf_mtag);
                         }
                 }
         }
 
         return (0);
 }
 
+int
+pf_setup_pdesc(sa_family_t af, int dir, struct pf_pdesc *pd, struct mbuf *m,
+    u_short *action, u_short *reason, struct pfi_kkif *kif, struct pf_krule **a,
+    struct pf_krule **r, struct pf_kruleset **ruleset, int *off, int *hdrlen,
+    struct pf_rule_actions *default_actions)
+{
+
+        TAILQ_INIT(&pd->sctp_multihome_jobs);
+        if (default_actions != NULL)
+                memcpy(&pd->act, default_actions, sizeof(pd->act));
+        pd->pf_mtag = pf_find_mtag(m);
+
+        if (pd->pf_mtag && pd->pf_mtag->dnpipe) {
+                pd->act.dnpipe = pd->pf_mtag->dnpipe;
+                pd->act.flags = pd->pf_mtag->dnflags;
+        }
+
+        pd->af = af;
+
+        switch (af) {
 #ifdef INET
+        case AF_INET: {
+                struct ip *h;
+
+                h = mtod(m, struct ip *);
+                *off = h->ip_hl << 2;
+                if (*off < (int)sizeof(*h)) {
+                        *action = PF_DROP;
+                        REASON_SET(reason, PFRES_SHORT);
+                        return (-1);
+                }
+                pd->src = (struct pf_addr *)&h->ip_src;
+                pd->dst = (struct pf_addr *)&h->ip_dst;
+                pd->sport = pd->dport = NULL;
+                pd->ip_sum = &h->ip_sum;
+                pd->proto_sum = NULL;
+                pd->proto = h->ip_p;
+                pd->dir = dir;
+                pd->sidx = (dir == PF_IN) ? 0 : 1;
+                pd->didx = (dir == PF_IN) ? 1 : 0;
+                pd->tos = h->ip_tos;
+                pd->tot_len = ntohs(h->ip_len);
+                pd->act.rtableid = -1;
+
+                /* fragments not reassembled handled later */
+                if (h->ip_off & htons(IP_MF | IP_OFFMASK))
+                        return (0);
+
+                switch (h->ip_p) {
+                case IPPROTO_TCP: {
+                        struct tcphdr *th = &pd->hdr.tcp;
+
+                        if (!pf_pull_hdr(m, *off, th, sizeof(*th), action,
+                                reason, AF_INET))
+                                return (-1);
+                        *hdrlen = sizeof(*th);
+                        pd->p_len = pd->tot_len - *off - (th->th_off << 2);
+                        pd->sport = &th->th_sport;
+                        pd->dport = &th->th_dport;
+                        break;
+                }
+                case IPPROTO_UDP: {
+                        struct udphdr *uh = &pd->hdr.udp;
+
+                        if (!pf_pull_hdr(m, *off, uh, sizeof(*uh), action,
+                                reason, AF_INET))
+                                return (-1);
+                        *hdrlen = sizeof(*uh);
+                        if (uh->uh_dport == 0 ||
+                            ntohs(uh->uh_ulen) > m->m_pkthdr.len - *off ||
+                            ntohs(uh->uh_ulen) < sizeof(struct udphdr)) {
+                                *action = PF_DROP;
+                                REASON_SET(reason, PFRES_SHORT);
+                                return (-1);
+                        }
+                        pd->sport = &uh->uh_sport;
+                        pd->dport = &uh->uh_dport;
+                        break;
+                }
+                case IPPROTO_SCTP: {
+                        if (!pf_pull_hdr(m, *off, &pd->hdr.sctp, sizeof(pd->hdr.sctp),
+                            action, reason, AF_INET)) {
+                                return (-1);
+                        }
+                        *hdrlen = sizeof(pd->hdr.sctp);
+                        pd->p_len = pd->tot_len - *off;
+
+                        pd->sport = &pd->hdr.sctp.src_port;
+                        pd->dport = &pd->hdr.sctp.dest_port;
+                        if (pd->hdr.sctp.src_port == 0 || pd->hdr.sctp.dest_port == 0) {
+                                *action = PF_DROP;
+                                REASON_SET(reason, PFRES_SHORT);
+                                return (-1);
+                        }
+                        if (pf_scan_sctp(m, *off, pd, kif) != PF_PASS) {
+                                *action = PF_DROP;
+                                REASON_SET(reason, PFRES_SHORT);
+                                return (-1);
+                        }
+                        break;
+                }
+                case IPPROTO_ICMP: {
+                        if (!pf_pull_hdr(m, *off, &pd->hdr.icmp, ICMP_MINLEN,
+                                action, reason, AF_INET))
+                                return (-1);
+                        *hdrlen = ICMP_MINLEN;
+                        break;
+                }
+                }
+                break;
+        }
+#endif
+#ifdef INET6
+        case AF_INET6: {
+                struct ip6_hdr *h;
+                int terminal = 0;
+
+                h = mtod(m, struct ip6_hdr *);
+                pd->src = (struct pf_addr *)&h->ip6_src;
+                pd->dst = (struct pf_addr *)&h->ip6_dst;
+                pd->sport = pd->dport = NULL;
+                pd->ip_sum = NULL;
+                pd->proto_sum = NULL;
+                pd->dir = dir;
+                pd->sidx = (dir == PF_IN) ? 0 : 1;
+                pd->didx = (dir == PF_IN) ? 1 : 0;
+                pd->tos = IPV6_DSCP(h);
+                pd->tot_len = ntohs(h->ip6_plen) + sizeof(struct ip6_hdr);
+                *off = ((caddr_t)h - m->m_data) + sizeof(struct ip6_hdr);
+                pd->proto = h->ip6_nxt;
+                pd->act.rtableid = -1;
+
+                do {
+                        switch (pd->proto) {
+                        case IPPROTO_FRAGMENT:
+                                if (kif == NULL || r == NULL) /* pflog */
+                                        *action = PF_DROP;
+                                else
+                                        *action = pf_test_fragment(r, kif,
+                                            m, h, pd, a, ruleset);
+                                if (*action == PF_DROP)
+                                        REASON_SET(reason, PFRES_FRAG);
+                                return (-1);
+                        case IPPROTO_ROUTING: {
+                                struct ip6_rthdr rthdr;
+
+                                if (pd->rh_cnt++) {
+                                        DPFPRINTF(PF_DEBUG_MISC,
+                                            ("pf: IPv6 more than one rthdr"));
+                                        *action = PF_DROP;
+                                        REASON_SET(reason, PFRES_IPOPTIONS);
+                                        return (-1);
+                                }
+                                if (!pf_pull_hdr(m, *off, &rthdr, sizeof(rthdr),
+                                        NULL, reason, pd->af)) {
+                                        DPFPRINTF(PF_DEBUG_MISC,
+                                            ("pf: IPv6 short rthdr"));
+                                        *action = PF_DROP;
+                                        REASON_SET(reason, PFRES_SHORT);
+                                        return (-1);
+                                }
+                                if (rthdr.ip6r_type == IPV6_RTHDR_TYPE_0) {
+                                        DPFPRINTF(PF_DEBUG_MISC,
+                                            ("pf: IPv6 rthdr0"));
+                                        *action = PF_DROP;
+                                        REASON_SET(reason, PFRES_IPOPTIONS);
+                                        return (-1);
+                                }
+                                /* FALLTHROUGH */
+                        }
+                        case IPPROTO_AH:
+                        case IPPROTO_HOPOPTS:
+                        case IPPROTO_DSTOPTS: {
+                                /* get next header and header length */
+                                struct ip6_ext opt6;
+
+                                if (!pf_pull_hdr(m, *off, &opt6, sizeof(opt6),
+                                        NULL, reason, pd->af)) {
+                                        DPFPRINTF(PF_DEBUG_MISC,
+                                            ("pf: IPv6 short opt"));
+                                        *action = PF_DROP;
+                                        return (-1);
+                                }
+                                if (pd->proto == IPPROTO_AH)
+                                        *off += (opt6.ip6e_len + 2) * 4;
+                                else
+                                        *off += (opt6.ip6e_len + 1) * 8;
+                                pd->proto = opt6.ip6e_nxt;
+                                /* goto the next header */
+                                break;
+                        }
+                        default:
+                                terminal++;
+                                break;
+                        }
+                } while (!terminal);
+
+                switch (pd->proto) {
+                case IPPROTO_TCP: {
+                        struct tcphdr *th = &pd->hdr.tcp;
+
+                        if (!pf_pull_hdr(m, *off, th, sizeof(*th), action,
+                                reason, AF_INET6))
+                                return (-1);
+                        *hdrlen = sizeof(*th);
+                        pd->p_len = pd->tot_len - *off - (th->th_off << 2);
+                        pd->sport = &th->th_sport;
+                        pd->dport = &th->th_dport;
+                        break;
+                }
+                case IPPROTO_UDP: {
+                        struct udphdr *uh = &pd->hdr.udp;
+
+                        if (!pf_pull_hdr(m, *off, uh, sizeof(*uh), action,
+                                reason, AF_INET6))
+                                return (-1);
+                        *hdrlen = sizeof(*uh);
+                        if (uh->uh_dport == 0 ||
+                            ntohs(uh->uh_ulen) > m->m_pkthdr.len - *off ||
+                            ntohs(uh->uh_ulen) < sizeof(struct udphdr)) {
+                                *action = PF_DROP;
+                                REASON_SET(reason, PFRES_SHORT);
+                                return (-1);
+                        }
+                        pd->sport = &uh->uh_sport;
+                        pd->dport = &uh->uh_dport;
+                        break;
+                }
+                case IPPROTO_SCTP: {
+                        if (!pf_pull_hdr(m, *off, &pd->hdr.sctp, sizeof(pd->hdr.sctp),
+                            action, reason, AF_INET6)) {
+                                return (-1);
+                        }
+                        *hdrlen = sizeof(pd->hdr.sctp);
+                        pd->p_len = pd->tot_len - *off;
+
+                        pd->sport = &pd->hdr.sctp.src_port;
+                        pd->dport = &pd->hdr.sctp.dest_port;
+                        if (pd->hdr.sctp.src_port == 0 || pd->hdr.sctp.dest_port == 0) {
+                                *action = PF_DROP;
+                                REASON_SET(reason, PFRES_SHORT);
+                                return (-1);
+                        }
+                        if (pf_scan_sctp(m, *off, pd, kif) != PF_PASS) {
+                                *action = PF_DROP;
+                                REASON_SET(reason, PFRES_SHORT);
+                                return (-1);
+                        }
+                        break;
+                }
+                case IPPROTO_ICMPV6: {
+                        size_t icmp_hlen = sizeof(struct icmp6_hdr);
+
+                        if (!pf_pull_hdr(m, *off, &pd->hdr.icmp6, icmp_hlen,
+                                action, reason, AF_INET6))
+                                return (-1);
+                        /* ICMP headers we look further into to match state */
+                        switch (pd->hdr.icmp6.icmp6_type) {
+                        case MLD_LISTENER_QUERY:
+                        case MLD_LISTENER_REPORT:
+                                icmp_hlen = sizeof(struct mld_hdr);
+                                break;
+                        case ND_NEIGHBOR_SOLICIT:
+                        case ND_NEIGHBOR_ADVERT:
+                                icmp_hlen = sizeof(struct nd_neighbor_solicit);
+                                break;
+                        }
+                        if (icmp_hlen > sizeof(struct icmp6_hdr) &&
+                            !pf_pull_hdr(m, *off, &pd->hdr.icmp6, icmp_hlen,
+                                action, reason, AF_INET6))
+                                return (-1);
+                        *hdrlen = icmp_hlen;
+                        break;
+                }
+                }
+                break;
+        }
+#endif
+        default:
+                panic("pf_setup_pdesc called with illegal af %u", af);
+        }
+        return (0);
+}
+
+#ifdef INET
 int
 pf_test(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0,
     struct inpcb *inp, struct pf_rule_actions *default_actions)
 {
         struct pfi_kkif         *kif;
         u_short                         action, reason = 0;
         struct mbuf                *m = *m0;
         struct ip                *h = NULL;
         struct m_tag            *mtag;
         struct pf_krule                *a = NULL, *r = &V_pf_default_rule, *tr, *nr;
         struct pf_kstate        *s = NULL;
         struct pf_kruleset        *ruleset = NULL;
         struct pf_pdesc          pd;
-        int                         off, dirndx, use_2nd_queue = 0;
+        int                         off, hdrlen, dirndx, use_2nd_queue = 0;
         uint16_t                 tag;
         uint8_t                  rt;
 
         PF_RULES_RLOCK_TRACKER;
         KASSERT(dir == PF_IN || dir == PF_OUT, ("%s: bad direction %d\n", __func__, dir));
         M_ASSERTPKTHDR(m);
 
         if (!V_pf_status.running)
pf_test(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0,
         }
 
         if (__predict_false(! M_WRITABLE(*m0))) {
                 m = *m0 = m_unshare(*m0, M_NOWAIT);
                 if (*m0 == NULL)
                         return (PF_DROP);
         }
 
+        if (__predict_false(m->m_len < sizeof(struct ip)) &&
+            (m = *m0 = m_pullup(*m0, sizeof(struct ip))) == NULL) {
+                DPFPRINTF(PF_DEBUG_URGENT,
+                    ("pf_test: m_len < sizeof(struct ip), pullup failed\n"));
+                PF_RULES_RUNLOCK();
+                return (PF_DROP);
+        }
+
         memset(&pd, 0, sizeof(pd));
-        TAILQ_INIT(&pd.sctp_multihome_jobs);
-        if (default_actions != NULL)
-                memcpy(&pd.act, default_actions, sizeof(pd.act));
-        pd.pf_mtag = pf_find_mtag(m);
+        pd.dir = dir;
 
+        if (pf_normalize_ip(m0, kif, &reason, &pd) != PF_PASS) {
+                /* We do IP header normalization and packet reassembly here */
+                action = PF_DROP;
+                goto done;
+        }
+        m = *m0;        /* pf_normalize messes with m0 */
+        h = mtod(m, struct ip *);
+
+        if (pf_setup_pdesc(AF_INET, dir, &pd, m, &action, &reason, kif, &a, &r,
+                &ruleset, &off, &hdrlen, default_actions) == -1) {
+                if (action != PF_PASS)
+                        pd.act.log |= PF_LOG_FORCE;
+                goto done;
+        }
+
         if (pd.pf_mtag != NULL && (pd.pf_mtag->flags & PF_MTAG_FLAG_ROUTE_TO)) {
                 pd.pf_mtag->flags &= ~PF_MTAG_FLAG_ROUTE_TO;
 
                 ifp = ifnet_byindexgen(pd.pf_mtag->if_index,
                     pd.pf_mtag->if_idxgen);
                 if (ifp == NULL || ifp->if_flags & IFF_DYING) {
                         PF_RULES_RUNLOCK();
                         m_freem(*m0);
                         *m0 = NULL;
                         return (PF_PASS);
                 }
                 PF_RULES_RUNLOCK();
                 (ifp->if_output)(ifp, m, sintosa(&pd.pf_mtag->dst), NULL);
                 *m0 = NULL;
                 return (PF_PASS);
         }
 
-        if (pd.pf_mtag && pd.pf_mtag->dnpipe) {
-                pd.act.dnpipe = pd.pf_mtag->dnpipe;
-                pd.act.flags = pd.pf_mtag->dnflags;
-        }
-
         if (ip_dn_io_ptr != NULL && pd.pf_mtag != NULL &&
             pd.pf_mtag->flags & PF_MTAG_FLAG_DUMMYNET) {
                 /* Dummynet re-injects packets after they've
                  * completed their delay. We've already
                  * processed them, so pass unconditionally. */
 
                 /* But only once. We may see the packet multiple times (e.g.
                  * PFIL_IN/PFIL_OUT). */
                 pf_dummynet_flag_remove(m, pd.pf_mtag);
                 PF_RULES_RUNLOCK();
 
                 return (PF_PASS);
         }
 
-        pd.sport = pd.dport = NULL;
-        pd.proto_sum = NULL;
-        pd.dir = dir;
-        pd.sidx = (dir == PF_IN) ? 0 : 1;
-        pd.didx = (dir == PF_IN) ? 1 : 0;
-        pd.af = AF_INET;
-        pd.act.rtableid = -1;
-
-        if (__predict_false(m->m_len < sizeof(struct ip)) &&
-            (m = *m0 = m_pullup(*m0, sizeof(struct ip))) == NULL) {
-                DPFPRINTF(PF_DEBUG_URGENT,
-                    ("pf_test: m_len < sizeof(struct ip), pullup failed\n"));
-                PF_RULES_RUNLOCK();
-                return (PF_DROP);
-        }
-        h = mtod(m, struct ip *);
-        off = h->ip_hl << 2;
-
         if (__predict_false(ip_divert_ptr != NULL) &&
             ((mtag = m_tag_locate(m, MTAG_PF_DIVERT, 0, NULL)) != NULL)) {
                 struct pf_divert_mtag *dt = (struct pf_divert_mtag *)(mtag+1);
                 if ((dt->idir == PF_DIVERT_MTAG_DIR_IN && dir == PF_IN) ||
                     (dt->idir == PF_DIVERT_MTAG_DIR_OUT && dir == PF_OUT)) {
                         if (pd.pf_mtag == NULL &&
                             ((pd.pf_mtag = pf_get_mtag(m)) == NULL)) {
                                 action = PF_DROP;
                                 goto done;
                         }
                         pd.pf_mtag->flags |= PF_MTAG_FLAG_PACKET_LOOPED;
                 }
                 if (pd.pf_mtag && pd.pf_mtag->flags & PF_MTAG_FLAG_FASTFWD_OURS_PRESENT) {
                         m->m_flags |= M_FASTFWD_OURS;
                         pd.pf_mtag->flags &= ~PF_MTAG_FLAG_FASTFWD_OURS_PRESENT;
                 }
                 m_tag_delete(m, mtag);
 
                 mtag = m_tag_locate(m, MTAG_IPFW_RULE, 0, NULL);
                 if (mtag != NULL)
                         m_tag_delete(m, mtag);
-        } else if (pf_normalize_ip(m0, kif, &reason, &pd) != PF_PASS) {
-                /* We do IP header normalization and packet reassembly here */
-                action = PF_DROP;
-                goto done;
         }
-        m = *m0;        /* pf_normalize messes with m0 */
-        h = mtod(m, struct ip *);
 
-        off = h->ip_hl << 2;
-        if (off < (int)sizeof(struct ip)) {
-                action = PF_DROP;
-                REASON_SET(&reason, PFRES_SHORT);
-                pd.act.log = PF_LOG_FORCE;
-                goto done;
-        }
-
-        pd.src = (struct pf_addr *)&h->ip_src;
-        pd.dst = (struct pf_addr *)&h->ip_dst;
-        pd.ip_sum = &h->ip_sum;
-        pd.proto = h->ip_p;
-        pd.tos = h->ip_tos & ~IPTOS_ECN_MASK;
-        pd.tot_len = ntohs(h->ip_len);
-
         /* handle fragments that didn't get reassembled by normalization */
         if (h->ip_off & htons(IP_MF | IP_OFFMASK)) {
                 action = pf_test_fragment(&r, kif, m, h, &pd, &a, &ruleset);
                 goto done;
         }
 
         switch (h->ip_p) {
         case IPPROTO_TCP: {
-                if (!pf_pull_hdr(m, off, &pd.hdr.tcp, sizeof(pd.hdr.tcp),
-                    &action, &reason, AF_INET)) {
-                        if (action != PF_PASS)
-                                pd.act.log = PF_LOG_FORCE;
-                        goto done;
-                }
-                pd.p_len = pd.tot_len - off - (pd.hdr.tcp.th_off << 2);
 
-                pd.sport = &pd.hdr.tcp.th_sport;
-                pd.dport = &pd.hdr.tcp.th_dport;
-
                 /* Respond to SYN with a syncookie. */
                 if ((pd.hdr.tcp.th_flags & (TH_SYN|TH_ACK|TH_RST)) == TH_SYN &&
                     pd.dir == PF_IN && pf_synflood_check(&pd)) {
                         pf_syncookie_send(m, off, &pd);
                         action = PF_DROP;
                         break;
                 }
 
if (action == PF_PASS) {
 
                                 s->src.seqhi = ntohl(pd.hdr.tcp.th_ack) - 1;
                                 s->src.seqlo = ntohl(pd.hdr.tcp.th_seq) - 1;
                                 pf_set_protostate(s, PF_PEER_SRC, PF_TCPS_PROXY_DST);
                                 action = pf_synproxy(&pd, &s, &reason);
                                 break;
                         } else {
                                 action = pf_test_rule(&r, &s, kif, m, off, &pd,
-                                    &a, &ruleset, inp);
+                                    &a, &ruleset, inp, hdrlen);
                         }
                 }
                 break;
         }
 
         case IPPROTO_UDP: {
-                if (!pf_pull_hdr(m, off, &pd.hdr.udp, sizeof(pd.hdr.udp),
-                    &action, &reason, AF_INET)) {
-                        if (action != PF_PASS)
-                                pd.act.log = PF_LOG_FORCE;
-                        goto done;
-                }
-                pd.sport = &pd.hdr.udp.uh_sport;
-                pd.dport = &pd.hdr.udp.uh_dport;
-                if (pd.hdr.udp.uh_dport == 0 ||
-                    ntohs(pd.hdr.udp.uh_ulen) > m->m_pkthdr.len - off ||
-                    ntohs(pd.hdr.udp.uh_ulen) < sizeof(struct udphdr)) {
-                        action = PF_DROP;
-                        REASON_SET(&reason, PFRES_SHORT);
-                        goto done;
-                }
                 action = pf_test_state_udp(&s, kif, m, off, h, &pd);
                 if (action == PF_PASS) {
                         if (V_pfsync_update_state_ptr != NULL)
                                 V_pfsync_update_state_ptr(s);
                         r = s->rule.ptr;
                         a = s->anchor.ptr;
                 } else if (s == NULL)
                         action = pf_test_rule(&r, &s, kif, m, off, &pd,
-                            &a, &ruleset, inp);
+                            &a, &ruleset, inp, hdrlen);
                 break;
         }
 
         case IPPROTO_SCTP: {
-                if (!pf_pull_hdr(m, off, &pd.hdr.sctp, sizeof(pd.hdr.sctp),
-                    &action, &reason, AF_INET)) {
-                        if (action != PF_PASS)
-                                pd.act.log |= PF_LOG_FORCE;
-                        goto done;
-                }
-                pd.p_len = pd.tot_len - off;
-
-                pd.sport = &pd.hdr.sctp.src_port;
-                pd.dport = &pd.hdr.sctp.dest_port;
-                if (pd.hdr.sctp.src_port == 0 || pd.hdr.sctp.dest_port == 0) {
-                        action = PF_DROP;
-                        REASON_SET(&reason, PFRES_SHORT);
-                        goto done;
-                }
                 action = pf_normalize_sctp(dir, kif, m, 0, off, h, &pd);
                 if (action == PF_DROP)
                         goto done;
                 action = pf_test_state_sctp(&s, kif, m, off, h, &pd,
                     &reason);
                 if (action == PF_PASS) {
                         if (V_pfsync_update_state_ptr != NULL)
                                 V_pfsync_update_state_ptr(s);
                         r = s->rule.ptr;
                         a = s->anchor.ptr;
                 } else if (s == NULL) {
                         action = pf_test_rule(&r, &s, kif, m, off,
-                            &pd, &a, &ruleset, inp);
+                            &pd, &a, &ruleset, inp, hdrlen);
                 }
                 break;
         }
 
         case IPPROTO_ICMP: {
-                if (!pf_pull_hdr(m, off, &pd.hdr.icmp, ICMP_MINLEN,
-                    &action, &reason, AF_INET)) {
-                        if (action != PF_PASS)
-                                pd.act.log = PF_LOG_FORCE;
-                        goto done;
-                }
                 action = pf_test_state_icmp(&s, kif, m, off, h, &pd, &reason);
                 if (action == PF_PASS) {
                         if (V_pfsync_update_state_ptr != NULL)
                                 V_pfsync_update_state_ptr(s);
                         r = s->rule.ptr;
                         a = s->anchor.ptr;
                 } else if (s == NULL)
                         action = pf_test_rule(&r, &s, kif, m, off, &pd,
-                            &a, &ruleset, inp);
+                            &a, &ruleset, inp, hdrlen);
                 break;
         }
 
         case IPPROTO_ICMPV6: {
                 action = PF_DROP;
                 DPFPRINTF(PF_DEBUG_MISC,
                     ("pf: dropping IPv4 packet with ICMPv6 payload\n"));
                 goto done;
         }
 
         default:
                 action = pf_test_state_other(&s, kif, m, &pd);
                 if (action == PF_PASS) {
                         if (V_pfsync_update_state_ptr != NULL)
                                 V_pfsync_update_state_ptr(s);
                         r = s->rule.ptr;
                         a = s->anchor.ptr;
                 } else if (s == NULL)
                         action = pf_test_rule(&r, &s, kif, m, off, &pd,
-                            &a, &ruleset, inp);
+                            &a, &ruleset, inp, hdrlen);
                 break;
         }
 
 done:
         PF_RULES_RUNLOCK();
         if (action == PF_PASS && h->ip_hl > 5 &&
             !((s && s->state_flags & PFSTATE_ALLOWOPTS) || r->allow_opts)) {
                 action = PF_DROP;
pf_test6(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0, struct inpcb *inp,
         u_short                         action, reason = 0;
         struct mbuf                *m = *m0, *n = NULL;
         struct m_tag            *mtag;
         struct ip6_hdr                *h = NULL;
         struct pf_krule                *a = NULL, *r = &V_pf_default_rule, *tr, *nr;
         struct pf_kstate        *s = NULL;
         struct pf_kruleset        *ruleset = NULL;
         struct pf_pdesc          pd;
-        int                         off, terminal = 0, dirndx, rh_cnt = 0, use_2nd_queue = 0;
+        int                         off, hdrlen, dirndx, use_2nd_queue = 0;
         uint16_t                 tag;
         uint8_t                  rt;
 
         PF_RULES_RLOCK_TRACKER;
         KASSERT(dir == PF_IN || dir == PF_OUT, ("%s: bad direction %d\n", __func__, dir));
         M_ASSERTPKTHDR(m);
 
         if (!V_pf_status.running)
pf_test6(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0, struct inpcb *inp,
         }
 
         if (__predict_false(! M_WRITABLE(*m0))) {
                 m = *m0 = m_unshare(*m0, M_NOWAIT);
                 if (*m0 == NULL)
                         return (PF_DROP);
         }
 
+        if (__predict_false(m->m_len < sizeof(struct ip6_hdr)) &&
+            (m = *m0 = m_pullup(*m0, sizeof(struct ip6_hdr))) == NULL) {
+                DPFPRINTF(PF_DEBUG_URGENT,
+                    ("pf_test6: m_len < sizeof(struct ip6_hdr)"
+                     ", pullup failed\n"));
+                PF_RULES_RUNLOCK();
+                return (PF_DROP);
+        }
+
         memset(&pd, 0, sizeof(pd));
-        TAILQ_INIT(&pd.sctp_multihome_jobs);
-        if (default_actions != NULL)
-                memcpy(&pd.act, default_actions, sizeof(pd.act));
-        pd.pf_mtag = pf_find_mtag(m);
+        pd.dir = dir;
 
+        /* We do IP header normalization and packet reassembly here */
+        if (pf_normalize_ip6(m0, kif, &reason, &pd) != PF_PASS) {
+                action = PF_DROP;
+                goto done;
+        }
+        m = *m0;        /* pf_normalize messes with m0 */
+        h = mtod(m, struct ip6_hdr *);
+        off = ((caddr_t)h - m->m_data) + sizeof(struct ip6_hdr);
+
+        if (pf_setup_pdesc(AF_INET6, dir, &pd, m, &action, &reason, kif, &a, &r,
+                &ruleset, &off, &hdrlen, default_actions) == -1) {
+                if (action != PF_PASS)
+                        pd.act.log |= PF_LOG_FORCE;
+                goto done;
+        }
+
         if (pd.pf_mtag != NULL && (pd.pf_mtag->flags & PF_MTAG_FLAG_ROUTE_TO)) {
                 pd.pf_mtag->flags &= ~PF_MTAG_FLAG_ROUTE_TO;
 
                 ifp = ifnet_byindexgen(pd.pf_mtag->if_index,
                     pd.pf_mtag->if_idxgen);
                 if (ifp == NULL || ifp->if_flags & IFF_DYING) {
                         PF_RULES_RUNLOCK();
                         m_freem(*m0);
                         *m0 = NULL;
                         return (PF_PASS);
                 }
                 PF_RULES_RUNLOCK();
                 nd6_output_ifp(ifp, ifp, m,
                     (struct sockaddr_in6 *)&pd.pf_mtag->dst, NULL);
                 *m0 = NULL;
                 return (PF_PASS);
         }
 
-        if (pd.pf_mtag && pd.pf_mtag->dnpipe) {
-                pd.act.dnpipe = pd.pf_mtag->dnpipe;
-                pd.act.flags = pd.pf_mtag->dnflags;
-        }
-
         if (ip_dn_io_ptr != NULL && pd.pf_mtag != NULL &&
             pd.pf_mtag->flags & PF_MTAG_FLAG_DUMMYNET) {
                 pf_dummynet_flag_remove(m, pd.pf_mtag);
                 /* Dummynet re-injects packets after they've
                  * completed their delay. We've already
                  * processed them, so pass unconditionally. */
                 PF_RULES_RUNLOCK();
                 return (PF_PASS);
         }
 
-        pd.sport = pd.dport = NULL;
-        pd.ip_sum = NULL;
-        pd.proto_sum = NULL;
-        pd.dir = dir;
-        pd.sidx = (dir == PF_IN) ? 0 : 1;
-        pd.didx = (dir == PF_IN) ? 1 : 0;
-        pd.af = AF_INET6;
-        pd.act.rtableid = -1;
-
-        if (__predict_false(m->m_len < sizeof(struct ip6_hdr)) &&
-            (m = *m0 = m_pullup(*m0, sizeof(struct ip6_hdr))) == NULL) {
-                DPFPRINTF(PF_DEBUG_URGENT,
-                    ("pf_test6: m_len < sizeof(struct ip6_hdr)"
-                     ", pullup failed\n"));
-                PF_RULES_RUNLOCK();
-                return (PF_DROP);
-        }
-        h = mtod(m, struct ip6_hdr *);
-        off = ((caddr_t)h - m->m_data) + sizeof(struct ip6_hdr);
-
-        /* We do IP header normalization and packet reassembly here */
-        if (pf_normalize_ip6(m0, kif, &reason, &pd) != PF_PASS) {
-                action = PF_DROP;
-                goto done;
-        }
-        m = *m0;        /* pf_normalize messes with m0 */
-        h = mtod(m, struct ip6_hdr *);
-        off = ((caddr_t)h - m->m_data) + sizeof(struct ip6_hdr);
-
         /*
          * we do not support jumbogram.  if we keep going, zero ip6_plen
          * will do something bad, so drop the packet for now.
          */
         if (htons(h->ip6_plen) == 0) {
                 action = PF_DROP;
                 REASON_SET(&reason, PFRES_NORM);        /*XXX*/
                 goto done;
         }
 
-        pd.src = (struct pf_addr *)&h->ip6_src;
-        pd.dst = (struct pf_addr *)&h->ip6_dst;
-        pd.tos = IPV6_DSCP(h);
-        pd.tot_len = ntohs(h->ip6_plen) + sizeof(struct ip6_hdr);
-
-        pd.proto = h->ip6_nxt;
-        do {
-                switch (pd.proto) {
-                case IPPROTO_FRAGMENT:
-                        action = pf_test_fragment(&r, kif, m, h, &pd, &a,
-                            &ruleset);
-                        if (action == PF_DROP)
-                                REASON_SET(&reason, PFRES_FRAG);
-                        goto done;
-                case IPPROTO_ROUTING: {
-                        struct ip6_rthdr rthdr;
-
-                        if (rh_cnt++) {
-                                DPFPRINTF(PF_DEBUG_MISC,
-                                    ("pf: IPv6 more than one rthdr\n"));
-                                action = PF_DROP;
-                                REASON_SET(&reason, PFRES_IPOPTIONS);
-                                pd.act.log = PF_LOG_FORCE;
-                                goto done;
-                        }
-                        if (!pf_pull_hdr(m, off, &rthdr, sizeof(rthdr), NULL,
-                            &reason, pd.af)) {
-                                DPFPRINTF(PF_DEBUG_MISC,
-                                    ("pf: IPv6 short rthdr\n"));
-                                action = PF_DROP;
-                                REASON_SET(&reason, PFRES_SHORT);
-                                pd.act.log = PF_LOG_FORCE;
-                                goto done;
-                        }
-                        if (rthdr.ip6r_type == IPV6_RTHDR_TYPE_0) {
-                                DPFPRINTF(PF_DEBUG_MISC,
-                                    ("pf: IPv6 rthdr0\n"));
-                                action = PF_DROP;
-                                REASON_SET(&reason, PFRES_IPOPTIONS);
-                                pd.act.log = PF_LOG_FORCE;
-                                goto done;
-                        }
-                        /* FALLTHROUGH */
-                }
-                case IPPROTO_AH:
-                case IPPROTO_HOPOPTS:
-                case IPPROTO_DSTOPTS: {
-                        /* get next header and header length */
-                        struct ip6_ext  opt6;
-
-                        if (!pf_pull_hdr(m, off, &opt6, sizeof(opt6),
-                            NULL, &reason, pd.af)) {
-                                DPFPRINTF(PF_DEBUG_MISC,
-                                    ("pf: IPv6 short opt\n"));
-                                action = PF_DROP;
-                                pd.act.log = PF_LOG_FORCE;
-                                goto done;
-                        }
-                        if (pd.proto == IPPROTO_AH)
-                                off += (opt6.ip6e_len + 2) * 4;
-                        else
-                                off += (opt6.ip6e_len + 1) * 8;
-                        pd.proto = opt6.ip6e_nxt;
-                        /* goto the next header */
-                        break;
-                }
-                default:
-                        terminal++;
-                        break;
-                }
-        } while (!terminal);
-
         /* if there's no routing header, use unmodified mbuf for checksumming */
         if (!n)
                 n = m;
 
         switch (pd.proto) {
         case IPPROTO_TCP: {
-                if (!pf_pull_hdr(m, off, &pd.hdr.tcp, sizeof(pd.hdr.tcp),
-                    &action, &reason, AF_INET6)) {
-                        if (action != PF_PASS)
-                                pd.act.log |= PF_LOG_FORCE;
-                        goto done;
-                }
-                pd.p_len = pd.tot_len - off - (pd.hdr.tcp.th_off << 2);
-                pd.sport = &pd.hdr.tcp.th_sport;
-                pd.dport = &pd.hdr.tcp.th_dport;
-
                 /* Respond to SYN with a syncookie. */
                 if ((pd.hdr.tcp.th_flags & (TH_SYN|TH_ACK|TH_RST)) == TH_SYN &&
                     pd.dir == PF_IN && pf_synflood_check(&pd)) {
                         pf_syncookie_send(m, off, &pd);
                         action = PF_DROP;
                         break;
                 }
 
if (action == PF_PASS) {
                                 s->src.seqhi = ntohl(pd.hdr.tcp.th_ack) - 1;
                                 s->src.seqlo = ntohl(pd.hdr.tcp.th_seq) - 1;
                                 pf_set_protostate(s, PF_PEER_SRC, PF_TCPS_PROXY_DST);
 
                                 action = pf_synproxy(&pd, &s, &reason);
                                 break;
                         } else {
                                 action = pf_test_rule(&r, &s, kif, m, off, &pd,
-                                    &a, &ruleset, inp);
+                                    &a, &ruleset, inp, hdrlen);
                         }
                 }
                 break;
         }
 
         case IPPROTO_UDP: {
-                if (!pf_pull_hdr(m, off, &pd.hdr.udp, sizeof(pd.hdr.udp),
-                    &action, &reason, AF_INET6)) {
-                        if (action != PF_PASS)
-                                pd.act.log |= PF_LOG_FORCE;
-                        goto done;
-                }
-                pd.sport = &pd.hdr.udp.uh_sport;
-                pd.dport = &pd.hdr.udp.uh_dport;
-                if (pd.hdr.udp.uh_dport == 0 ||
-                    ntohs(pd.hdr.udp.uh_ulen) > m->m_pkthdr.len - off ||
-                    ntohs(pd.hdr.udp.uh_ulen) < sizeof(struct udphdr)) {
-                        action = PF_DROP;
-                        REASON_SET(&reason, PFRES_SHORT);
-                        goto done;
-                }
                 action = pf_test_state_udp(&s, kif, m, off, h, &pd);
                 if (action == PF_PASS) {
                         if (V_pfsync_update_state_ptr != NULL)
                                 V_pfsync_update_state_ptr(s);
                         r = s->rule.ptr;
                         a = s->anchor.ptr;
                 } else if (s == NULL)
                         action = pf_test_rule(&r, &s, kif, m, off, &pd,
-                            &a, &ruleset, inp);
+                            &a, &ruleset, inp, hdrlen);
                 break;
         }
 
         case IPPROTO_SCTP: {
-                if (!pf_pull_hdr(m, off, &pd.hdr.sctp, sizeof(pd.hdr.sctp),
-                    &action, &reason, AF_INET6)) {
-                        if (action != PF_PASS)
-                                pd.act.log |= PF_LOG_FORCE;
-                        goto done;
-                }
-                pd.sport = &pd.hdr.sctp.src_port;
-                pd.dport = &pd.hdr.sctp.dest_port;
-                if (pd.hdr.sctp.src_port == 0 || pd.hdr.sctp.dest_port == 0) {
-                        action = PF_DROP;
-                        REASON_SET(&reason, PFRES_SHORT);
-                        goto done;
-                }
                 action = pf_normalize_sctp(dir, kif, m, 0, off, h, &pd);
                 if (action == PF_DROP)
                         goto done;
                 action = pf_test_state_sctp(&s, kif, m, off, h, &pd,
                     &reason);
                 if (action == PF_PASS) {
                         if (V_pfsync_update_state_ptr != NULL)
                                 V_pfsync_update_state_ptr(s);
                         r = s->rule.ptr;
                         a = s->anchor.ptr;
                 } else if (s == NULL) {
                         action = pf_test_rule(&r, &s, kif, m, off,
-                            &pd, &a, &ruleset, inp);
+                            &pd, &a, &ruleset, inp, hdrlen);
                 }
                 break;
         }
 
         case IPPROTO_ICMP: {
                 action = PF_DROP;
                 DPFPRINTF(PF_DEBUG_MISC,
                     ("pf: dropping IPv6 packet with ICMPv4 payload\n"));
                 goto done;
         }
 
         case IPPROTO_ICMPV6: {
-                if (!pf_pull_hdr(m, off, &pd.hdr.icmp6, sizeof(pd.hdr.icmp6),
-                    &action, &reason, AF_INET6)) {
-                        if (action != PF_PASS)
-                                pd.act.log |= PF_LOG_FORCE;
-                        goto done;
-                }
                 action = pf_test_state_icmp(&s, kif, m, off, h, &pd, &reason);
                 if (action == PF_PASS) {
                         if (V_pfsync_update_state_ptr != NULL)
                                 V_pfsync_update_state_ptr(s);
                         r = s->rule.ptr;
                         a = s->anchor.ptr;
                 } else if (s == NULL)
                         action = pf_test_rule(&r, &s, kif, m, off, &pd,
-                            &a, &ruleset, inp);
+                            &a, &ruleset, inp, hdrlen);
                 break;
         }
 
         default:
                 action = pf_test_state_other(&s, kif, m, &pd);
                 if (action == PF_PASS) {
                         if (V_pfsync_update_state_ptr != NULL)
                                 V_pfsync_update_state_ptr(s);
                         r = s->rule.ptr;
                         a = s->anchor.ptr;
                 } else if (s == NULL)
                         action = pf_test_rule(&r, &s, kif, m, off, &pd,
-                            &a, &ruleset, inp);
+                            &a, &ruleset, inp, hdrlen);
                 break;
         }
 
 done:
         PF_RULES_RUNLOCK();
         if (n != m) {
                 m_freem(n);
                 n = NULL;
         }
 
         /* handle dangerous IPv6 extension headers. */
-        if (action == PF_PASS && rh_cnt &&
+        if (action == PF_PASS && pd.rh_cnt &&
             !((s && s->state_flags & PFSTATE_ALLOWOPTS) || r->allow_opts)) {
                 action = PF_DROP;
                 REASON_SET(&reason, PFRES_IPOPTIONS);
                 pd.act.log = r->log;
                 DPFPRINTF(PF_DEBUG_MISC,
                     ("pf: dropping packet with dangerous v6 headers\n"));
         }