[PATCH 15/19] bhyve: build FADT table by basl

[corvink]

Summary

Building the FADT table by basl will allow it to be loaded by qemu's
ACPI table loader.

This is the 15. patch required to merge D36983

[markj]

usr.sbin/bhyve/acpi.c

595

659

718

Hmm, this was simply missing before? I think this is correct given that the field is present in version 6.1 of the acpi spec.

[corvink]

• I've compared the ACPI output before and after this commit and fixed all entries

[corvink]

• inline defines

[jhb]

It would be nice to be able to use ACPI_TABLE_FADT, but there are some risks: 1) when ACPI-CA is updated this file would also have to be updated since it may now have new fields (though maybe an initial memset of the table to 0 would be good enough in practice for future proofing) and 2) you'd need a way to deal with storing references to pointers like basl_table_add_pointer but based on an offset instead (though you could use offsetof, something like basl_table_add_pointer(fadt, offsetof(ACPI_TABLE_FADT, FACS), sizeof(fadt_table.FACS)). OTOH, I think it would be more readable and you could avoid having to set unneeded fields and only focus on setting the non-zero fields that matter. You might also then need variants of things like building the table header or GAS structures that write to a caller-provided buffer instead of appending bytes to a table.

usr.sbin/bhyve/acpi.c

799

[jhb]

In D36998#850181, @jhb wrote:

It would be nice to be able to use ACPI_TABLE_FADT, but there are some risks: 1) when ACPI-CA is updated this file would also have to be updated since it may now have new fields (though maybe an initial memset of the table to 0 would be good enough in practice for future proofing) and 2) you'd need a way to deal with storing references to pointers like basl_table_add_pointer but based on an offset instead (though you could use offsetof, something like basl_table_add_pointer(fadt, offsetof(ACPI_TABLE_FADT, FACS), sizeof(fadt_table.FACS)). OTOH, I think it would be more readable and you could avoid having to set unneeded fields and only focus on setting the non-zero fields that matter. You might also then need variants of things like building the table header or GAS structures that write to a caller-provided buffer instead of appending bytes to a table.

Hmmm, looks like you already use the basl_table_add_* variant for checksums and lengths, so that might not be all that awkward to do for pointers. Also, another way to handle the common header would be to still use the existing function for the common header, but when you append a filled-out FADT table do something like basl_table_append_bytes(&fadt_table->FACS, sizeof(fadt_table) - offsetof(ACPI_FADT_TABLE, FACS)).

[corvink]

ACPI-CA contains struct definitions for most tables. I thought about making use of them. This would required to make add_checksum, add_lengths and add_pointer public available. It also requires that you build the table by using the struct, then adding it by append_bytes and at the end you have to add patches for checksums, lengths and pointer. So, building a table would be similar to my basl_table_append_header function. If you prefer that style, I can change it.

[corvink]

• use ACPI_TABLE_* structs for building

[jhb]

Thanks

usr.sbin/bhyve/acpi.c

 static int                 pf_dummynet_route(struct pf_pdesc *,
                             struct pf_kstate *, struct pf_krule *,
                             struct ifnet *, struct sockaddr *, struct mbuf **);
 static int                 pf_test_eth_rule(int, struct pfi_kkif *,
                             struct mbuf **);
 static int                 pf_test_rule(struct pf_krule **, struct pf_kstate **,
                             struct pfi_kkif *, struct mbuf *, int,
                             struct pf_pdesc *, struct pf_krule **,
-                            struct pf_kruleset **, struct inpcb *);
+                            struct pf_kruleset **, struct inpcb *, int);
 static int                 pf_create_state(struct pf_krule *, struct pf_krule *,
                             struct pf_krule *, struct pf_pdesc *,
                             struct pf_ksrc_node *, struct pf_state_key *,
                             struct pf_state_key *, struct mbuf *, int,
                             u_int16_t, u_int16_t, int *, struct pfi_kkif *,
                             struct pf_kstate **, int, u_int16_t, u_int16_t,
                             int, struct pf_krule_slist *, struct pf_udp_mapping *);
 static int                 pf_state_key_addr_setup(struct pf_pdesc *, struct mbuf *,
#endif /* INET6 */
         }
 
         return (action);
 }
 
 static int
 pf_test_rule(struct pf_krule **rm, struct pf_kstate **sm, struct pfi_kkif *kif,
     struct mbuf *m, int off, struct pf_pdesc *pd, struct pf_krule **am,
-    struct pf_kruleset **rsm, struct inpcb *inp)
+    struct pf_kruleset **rsm, struct inpcb *inp, int hdrlen)
 {
         struct pf_krule                *nr = NULL;
         struct pf_addr                * const saddr = pd->src;
         struct pf_addr                * const daddr = pd->dst;
         sa_family_t                 af = pd->af;
         struct pf_krule                *r, *a = NULL;
         struct pf_kruleset        *ruleset = NULL;
         struct pf_krule_slist    match_rules;
         struct pf_krule_item    *ri;
         struct pf_ksrc_node        *nsn = NULL;
         struct tcphdr                *th = &pd->hdr.tcp;
         struct pf_state_key        *sk = NULL, *nk = NULL;
         u_short                  reason, transerror;
-        int                         rewrite = 0, hdrlen = 0;
+        int                      rewrite = 0;
         int                      tag = -1;
         int                      asd = 0;
         int                      match = 0;
         int                         state_icmp = 0, icmp_dir, multi;
         u_int16_t                 sport = 0, dport = 0, virtual_type, virtual_id;
         u_int16_t                 bproto_sum = 0, bip_sum = 0;
         u_int8_t                 icmptype = 0, icmpcode = 0;
         struct pf_kanchor_stackframe        anchor_stack[PF_ANCHOR_STACKSIZE];
if (inp != NULL) {
                 pd->lookup.gid = inp->inp_cred->cr_groups[0];
                 pd->lookup.done = 1;
         }
 
         switch (pd->proto) {
         case IPPROTO_TCP:
                 sport = th->th_sport;
                 dport = th->th_dport;
-                hdrlen = sizeof(*th);
                 break;
         case IPPROTO_UDP:
                 sport = pd->hdr.udp.uh_sport;
                 dport = pd->hdr.udp.uh_dport;
-                hdrlen = sizeof(pd->hdr.udp);
                 break;
         case IPPROTO_SCTP:
                 sport = pd->hdr.sctp.src_port;
                 dport = pd->hdr.sctp.dest_port;
-                hdrlen = sizeof(pd->hdr.sctp);
                 break;
 #ifdef INET
         case IPPROTO_ICMP:
                 if (pd->af != AF_INET)
                         break;
-                hdrlen = sizeof(pd->hdr.icmp);
                 icmptype = pd->hdr.icmp.icmp_type;
                 icmpcode = pd->hdr.icmp.icmp_code;
                 state_icmp = pf_icmp_mapping(pd, icmptype,
                     &icmp_dir, &multi, &virtual_id, &virtual_type);
                 if (icmp_dir == PF_IN) {
                         sport = virtual_id;
                         dport = virtual_type;
                 } else {
                         sport = virtual_type;
                         dport = virtual_id;
                 }
                 break;
 #endif /* INET */
 #ifdef INET6
         case IPPROTO_ICMPV6:
                 if (af != AF_INET6)
                         break;
-                hdrlen = sizeof(pd->hdr.icmp6);
                 icmptype = pd->hdr.icmp6.icmp6_type;
                 icmpcode = pd->hdr.icmp6.icmp6_code;
                 state_icmp = pf_icmp_mapping(pd, icmptype,
                     &icmp_dir, &multi, &virtual_id, &virtual_type);
                 if (icmp_dir == PF_IN) {
                         sport = virtual_id;
                         dport = virtual_type;
                 } else {
                         sport = virtual_type;
                         dport = virtual_id;
                 }
 
                 break;
 #endif /* INET6 */
         default:
-                sport = dport = hdrlen = 0;
+                sport = dport = 0;
                 break;
         }
 
         r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr);
 
         /* check packet for BINAT/NAT/RDR */
         transerror = pf_get_translation(pd, m, off, kif, &nsn, &sk,
             &nk, saddr, daddr, sport, dport, anchor_stack, &nr, &udp_mapping);
case  SCTP_ADD_IP_ADDRESS: {
                         PF_RULES_RLOCK();
                         sm = NULL;
                         /*
                          * New connections need to be floating, because
                          * we cannot know what interfaces it will use.
                          * That's why we pass V_pfi_all rather than kif.
                          */
                         ret = pf_test_rule(&r, &sm, V_pfi_all,
-                            j->m, off, &j->pd, &ra, &rs, NULL);
+                            j->m, off, &j->pd, &ra, &rs, NULL,
+                            sizeof(j->pd.hdr.sctp));
                         PF_RULES_RUNLOCK();
                         SDT_PROBE4(pf, sctp, multihome, test, kif, r, j->m, ret);
                         if (ret != PF_DROP && sm != NULL) {
                                 /* Inherit v_tag values. */
                                 if (sm->direction == s->direction) {
                                         sm->src.scrub->pfss_v_tag = s->src.scrub->pfss_v_tag;
                                         sm->dst.scrub->pfss_v_tag = s->dst.scrub->pfss_v_tag;
                                 } else {
if (pf_pdesc_to_dnflow(pd, r, s, &dnflow)) {
                                 pf_dummynet_flag_remove(*m0, pd->pf_mtag);
                         }
                 }
         }
 
         return (0);
 }
 
+int
+pf_setup_pdesc(sa_family_t af, int dir, struct pf_pdesc *pd, struct mbuf *m,
+    u_short *action, u_short *reason, struct pfi_kkif *kif, struct pf_krule **a,
+    struct pf_krule **r, struct pf_kruleset **ruleset, int *off, int *hdrlen,
+    struct pf_rule_actions *default_actions)
+{
+
+        TAILQ_INIT(&pd->sctp_multihome_jobs);
+        if (default_actions != NULL)
+                memcpy(&pd->act, default_actions, sizeof(pd->act));
+        pd->pf_mtag = pf_find_mtag(m);
+
+        if (pd->pf_mtag && pd->pf_mtag->dnpipe) {
+                pd->act.dnpipe = pd->pf_mtag->dnpipe;
+                pd->act.flags = pd->pf_mtag->dnflags;
+        }
+
+        pd->af = af;
+
+        switch (af) {
 #ifdef INET
+        case AF_INET: {
+                struct ip *h;
+
+                h = mtod(m, struct ip *);
+                *off = h->ip_hl << 2;
+                if (*off < (int)sizeof(*h)) {
+                        *action = PF_DROP;
+                        REASON_SET(reason, PFRES_SHORT);
+                        return (-1);
+                }
+                pd->src = (struct pf_addr *)&h->ip_src;
+                pd->dst = (struct pf_addr *)&h->ip_dst;
+                pd->sport = pd->dport = NULL;
+                pd->ip_sum = &h->ip_sum;
+                pd->proto_sum = NULL;
+                pd->proto = h->ip_p;
+                pd->dir = dir;
+                pd->sidx = (dir == PF_IN) ? 0 : 1;
+                pd->didx = (dir == PF_IN) ? 1 : 0;
+                pd->tos = h->ip_tos;
+                pd->tot_len = ntohs(h->ip_len);
+                pd->act.rtableid = -1;
+
+                /* fragments not reassembled handled later */
+                if (h->ip_off & htons(IP_MF | IP_OFFMASK))
+                        return (0);
+
+                switch (h->ip_p) {
+                case IPPROTO_TCP: {
+                        struct tcphdr *th = &pd->hdr.tcp;
+
+                        if (!pf_pull_hdr(m, *off, th, sizeof(*th), action,
+                                reason, AF_INET))
+                                return (-1);
+                        *hdrlen = sizeof(*th);
+                        pd->p_len = pd->tot_len - *off - (th->th_off << 2);
+                        pd->sport = &th->th_sport;
+                        pd->dport = &th->th_dport;
+                        break;
+                }
+                case IPPROTO_UDP: {
+                        struct udphdr *uh = &pd->hdr.udp;
+
+                        if (!pf_pull_hdr(m, *off, uh, sizeof(*uh), action,
+                                reason, AF_INET))
+                                return (-1);
+                        *hdrlen = sizeof(*uh);
+                        if (uh->uh_dport == 0 ||
+                            ntohs(uh->uh_ulen) > m->m_pkthdr.len - *off ||
+                            ntohs(uh->uh_ulen) < sizeof(struct udphdr)) {
+                                *action = PF_DROP;
+                                REASON_SET(reason, PFRES_SHORT);
+                                return (-1);
+                        }
+                        pd->sport = &uh->uh_sport;
+                        pd->dport = &uh->uh_dport;
+                        break;
+                }
+                case IPPROTO_SCTP: {
+                        if (!pf_pull_hdr(m, *off, &pd->hdr.sctp, sizeof(pd->hdr.sctp),
+                            action, reason, AF_INET)) {
+                                return (-1);
+                        }
+                        *hdrlen = sizeof(pd->hdr.sctp);
+                        pd->p_len = pd->tot_len - *off;
+
+                        pd->sport = &pd->hdr.sctp.src_port;
+                        pd->dport = &pd->hdr.sctp.dest_port;
+                        if (pd->hdr.sctp.src_port == 0 || pd->hdr.sctp.dest_port == 0) {
+                                *action = PF_DROP;
+                                REASON_SET(reason, PFRES_SHORT);
+                                return (-1);
+                        }
+                        if (pf_scan_sctp(m, *off, pd, kif) != PF_PASS) {
+                                *action = PF_DROP;
+                                REASON_SET(reason, PFRES_SHORT);
+                                return (-1);
+                        }
+                        break;
+                }
+                case IPPROTO_ICMP: {
+                        if (!pf_pull_hdr(m, *off, &pd->hdr.icmp, ICMP_MINLEN,
+                                action, reason, AF_INET))
+                                return (-1);
+                        *hdrlen = ICMP_MINLEN;
+                        break;
+                }
+                }
+                break;
+        }
+#endif
+#ifdef INET6
+        case AF_INET6: {
+                struct ip6_hdr *h;
+                int terminal = 0;
+
+                h = mtod(m, struct ip6_hdr *);
+                pd->src = (struct pf_addr *)&h->ip6_src;
+                pd->dst = (struct pf_addr *)&h->ip6_dst;
+                pd->sport = pd->dport = NULL;
+                pd->ip_sum = NULL;
+                pd->proto_sum = NULL;
+                pd->dir = dir;
+                pd->sidx = (dir == PF_IN) ? 0 : 1;
+                pd->didx = (dir == PF_IN) ? 1 : 0;
+                pd->tos = IPV6_DSCP(h);
+                pd->tot_len = ntohs(h->ip6_plen) + sizeof(struct ip6_hdr);
+                *off = ((caddr_t)h - m->m_data) + sizeof(struct ip6_hdr);
+                pd->proto = h->ip6_nxt;
+                pd->act.rtableid = -1;
+
+                do {
+                        switch (pd->proto) {
+                        case IPPROTO_FRAGMENT:
+                                if (kif == NULL || r == NULL) /* pflog */
+                                        *action = PF_DROP;
+                                else
+                                        *action = pf_test_fragment(r, kif,
+                                            m, h, pd, a, ruleset);
+                                if (*action == PF_DROP)
+                                        REASON_SET(reason, PFRES_FRAG);
+                                return (-1);
+                        case IPPROTO_ROUTING: {
+                                struct ip6_rthdr rthdr;
+
+                                if (pd->rh_cnt++) {
+                                        DPFPRINTF(PF_DEBUG_MISC,
+                                            ("pf: IPv6 more than one rthdr"));
+                                        *action = PF_DROP;
+                                        REASON_SET(reason, PFRES_IPOPTIONS);
+                                        return (-1);
+                                }
+                                if (!pf_pull_hdr(m, *off, &rthdr, sizeof(rthdr),
+                                        NULL, reason, pd->af)) {
+                                        DPFPRINTF(PF_DEBUG_MISC,
+                                            ("pf: IPv6 short rthdr"));
+                                        *action = PF_DROP;
+                                        REASON_SET(reason, PFRES_SHORT);
+                                        return (-1);
+                                }
+                                if (rthdr.ip6r_type == IPV6_RTHDR_TYPE_0) {
+                                        DPFPRINTF(PF_DEBUG_MISC,
+                                            ("pf: IPv6 rthdr0"));
+                                        *action = PF_DROP;
+                                        REASON_SET(reason, PFRES_IPOPTIONS);
+                                        return (-1);
+                                }
+                                /* FALLTHROUGH */
+                        }
+                        case IPPROTO_AH:
+                        case IPPROTO_HOPOPTS:
+                        case IPPROTO_DSTOPTS: {
+                                /* get next header and header length */
+                                struct ip6_ext opt6;
+
+                                if (!pf_pull_hdr(m, *off, &opt6, sizeof(opt6),
+                                        NULL, reason, pd->af)) {
+                                        DPFPRINTF(PF_DEBUG_MISC,
+                                            ("pf: IPv6 short opt"));
+                                        *action = PF_DROP;
+                                        return (-1);
+                                }
+                                if (pd->proto == IPPROTO_AH)
+                                        *off += (opt6.ip6e_len + 2) * 4;
+                                else
+                                        *off += (opt6.ip6e_len + 1) * 8;
+                                pd->proto = opt6.ip6e_nxt;
+                                /* goto the next header */
+                                break;
+                        }
+                        default:
+                                terminal++;
+                                break;
+                        }
+                } while (!terminal);
+
+                switch (pd->proto) {
+                case IPPROTO_TCP: {
+                        struct tcphdr *th = &pd->hdr.tcp;
+
+                        if (!pf_pull_hdr(m, *off, th, sizeof(*th), action,
+                                reason, AF_INET6))
+                                return (-1);
+                        *hdrlen = sizeof(*th);
+                        pd->p_len = pd->tot_len - *off - (th->th_off << 2);
+                        pd->sport = &th->th_sport;
+                        pd->dport = &th->th_dport;
+                        break;
+                }
+                case IPPROTO_UDP: {
+                        struct udphdr *uh = &pd->hdr.udp;
+
+                        if (!pf_pull_hdr(m, *off, uh, sizeof(*uh), action,
+                                reason, AF_INET6))
+                                return (-1);
+                        *hdrlen = sizeof(*uh);
+                        if (uh->uh_dport == 0 ||
+                            ntohs(uh->uh_ulen) > m->m_pkthdr.len - *off ||
+                            ntohs(uh->uh_ulen) < sizeof(struct udphdr)) {
+                                *action = PF_DROP;
+                                REASON_SET(reason, PFRES_SHORT);
+                                return (-1);
+                        }
+                        pd->sport = &uh->uh_sport;
+                        pd->dport = &uh->uh_dport;
+                        break;
+                }
+                case IPPROTO_SCTP: {
+                        if (!pf_pull_hdr(m, *off, &pd->hdr.sctp, sizeof(pd->hdr.sctp),
+                            action, reason, AF_INET6)) {
+                                return (-1);
+                        }
+                        *hdrlen = sizeof(pd->hdr.sctp);
+                        pd->p_len = pd->tot_len - *off;
+
+                        pd->sport = &pd->hdr.sctp.src_port;
+                        pd->dport = &pd->hdr.sctp.dest_port;
+                        if (pd->hdr.sctp.src_port == 0 || pd->hdr.sctp.dest_port == 0) {
+                                *action = PF_DROP;
+                                REASON_SET(reason, PFRES_SHORT);
+                                return (-1);
+                        }
+                        if (pf_scan_sctp(m, *off, pd, kif) != PF_PASS) {
+                                *action = PF_DROP;
+                                REASON_SET(reason, PFRES_SHORT);
+                                return (-1);
+                        }
+                        break;
+                }
+                case IPPROTO_ICMPV6: {
+                        size_t icmp_hlen = sizeof(struct icmp6_hdr);
+
+                        if (!pf_pull_hdr(m, *off, &pd->hdr.icmp6, icmp_hlen,
+                                action, reason, AF_INET6))
+                                return (-1);
+                        /* ICMP headers we look further into to match state */
+                        switch (pd->hdr.icmp6.icmp6_type) {
+                        case MLD_LISTENER_QUERY:
+                        case MLD_LISTENER_REPORT:
+                                icmp_hlen = sizeof(struct mld_hdr);
+                                break;
+                        case ND_NEIGHBOR_SOLICIT:
+                        case ND_NEIGHBOR_ADVERT:
+                                icmp_hlen = sizeof(struct nd_neighbor_solicit);
+                                break;
+                        }
+                        if (icmp_hlen > sizeof(struct icmp6_hdr) &&
+                            !pf_pull_hdr(m, *off, &pd->hdr.icmp6, icmp_hlen,
+                                action, reason, AF_INET6))
+                                return (-1);
+                        *hdrlen = icmp_hlen;
+                        break;
+                }
+                }
+                break;
+        }
+#endif
+        default:
+                panic("pf_setup_pdesc called with illegal af %u", af);
+        }
+        return (0);
+}
+
+#ifdef INET
 int
 pf_test(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0,
     struct inpcb *inp, struct pf_rule_actions *default_actions)
 {
         struct pfi_kkif         *kif;
         u_short                         action, reason = 0;
         struct mbuf                *m = *m0;
         struct ip                *h = NULL;
         struct m_tag            *mtag;
         struct pf_krule                *a = NULL, *r = &V_pf_default_rule, *tr, *nr;
         struct pf_kstate        *s = NULL;
         struct pf_kruleset        *ruleset = NULL;
         struct pf_pdesc          pd;
-        int                         off, dirndx, use_2nd_queue = 0;
+        int                         off, hdrlen, dirndx, use_2nd_queue = 0;
         uint16_t                 tag;
         uint8_t                  rt;
 
         PF_RULES_RLOCK_TRACKER;
         KASSERT(dir == PF_IN || dir == PF_OUT, ("%s: bad direction %d\n", __func__, dir));
         M_ASSERTPKTHDR(m);
 
         if (!V_pf_status.running)
pf_test(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0,
         }
 
         if (__predict_false(! M_WRITABLE(*m0))) {
                 m = *m0 = m_unshare(*m0, M_NOWAIT);
                 if (*m0 == NULL)
                         return (PF_DROP);
         }
 
+        if (__predict_false(m->m_len < sizeof(struct ip)) &&
+            (m = *m0 = m_pullup(*m0, sizeof(struct ip))) == NULL) {
+                DPFPRINTF(PF_DEBUG_URGENT,
+                    ("pf_test: m_len < sizeof(struct ip), pullup failed\n"));
+                PF_RULES_RUNLOCK();
+                return (PF_DROP);
+        }
+
         memset(&pd, 0, sizeof(pd));
-        TAILQ_INIT(&pd.sctp_multihome_jobs);
-        if (default_actions != NULL)
-                memcpy(&pd.act, default_actions, sizeof(pd.act));
-        pd.pf_mtag = pf_find_mtag(m);
+        pd.dir = dir;
 
+        if (pf_normalize_ip(m0, kif, &reason, &pd) != PF_PASS) {
+                /* We do IP header normalization and packet reassembly here */
+                action = PF_DROP;
+                goto done;
+        }
+        m = *m0;        /* pf_normalize messes with m0 */
+        h = mtod(m, struct ip *);
+
+        if (pf_setup_pdesc(AF_INET, dir, &pd, m, &action, &reason, kif, &a, &r,
+                &ruleset, &off, &hdrlen, default_actions) == -1) {
+                if (action != PF_PASS)
+                        pd.act.log |= PF_LOG_FORCE;
+                goto done;
+        }
+
         if (pd.pf_mtag != NULL && (pd.pf_mtag->flags & PF_MTAG_FLAG_ROUTE_TO)) {
                 pd.pf_mtag->flags &= ~PF_MTAG_FLAG_ROUTE_TO;
 
                 ifp = ifnet_byindexgen(pd.pf_mtag->if_index,
                     pd.pf_mtag->if_idxgen);
                 if (ifp == NULL || ifp->if_flags & IFF_DYING) {
                         PF_RULES_RUNLOCK();
                         m_freem(*m0);
                         *m0 = NULL;
                         return (PF_PASS);
                 }
                 PF_RULES_RUNLOCK();
                 (ifp->if_output)(ifp, m, sintosa(&pd.pf_mtag->dst), NULL);
                 *m0 = NULL;
                 return (PF_PASS);
         }
 
-        if (pd.pf_mtag && pd.pf_mtag->dnpipe) {
-                pd.act.dnpipe = pd.pf_mtag->dnpipe;
-                pd.act.flags = pd.pf_mtag->dnflags;
-        }
-
         if (ip_dn_io_ptr != NULL && pd.pf_mtag != NULL &&
             pd.pf_mtag->flags & PF_MTAG_FLAG_DUMMYNET) {
                 /* Dummynet re-injects packets after they've
                  * completed their delay. We've already
                  * processed them, so pass unconditionally. */
 
                 /* But only once. We may see the packet multiple times (e.g.
                  * PFIL_IN/PFIL_OUT). */
                 pf_dummynet_flag_remove(m, pd.pf_mtag);
                 PF_RULES_RUNLOCK();
 
                 return (PF_PASS);
         }
 
-        pd.sport = pd.dport = NULL;
-        pd.proto_sum = NULL;
-        pd.dir = dir;
-        pd.sidx = (dir == PF_IN) ? 0 : 1;
-        pd.didx = (dir == PF_IN) ? 1 : 0;
-        pd.af = AF_INET;
-        pd.act.rtableid = -1;
-
-        if (__predict_false(m->m_len < sizeof(struct ip)) &&
-            (m = *m0 = m_pullup(*m0, sizeof(struct ip))) == NULL) {
-                DPFPRINTF(PF_DEBUG_URGENT,
-                    ("pf_test: m_len < sizeof(struct ip), pullup failed\n"));
-                PF_RULES_RUNLOCK();
-                return (PF_DROP);
-        }
-        h = mtod(m, struct ip *);
-        off = h->ip_hl << 2;
-
         if (__predict_false(ip_divert_ptr != NULL) &&
             ((mtag = m_tag_locate(m, MTAG_PF_DIVERT, 0, NULL)) != NULL)) {
                 struct pf_divert_mtag *dt = (struct pf_divert_mtag *)(mtag+1);
                 if ((dt->idir == PF_DIVERT_MTAG_DIR_IN && dir == PF_IN) ||
                     (dt->idir == PF_DIVERT_MTAG_DIR_OUT && dir == PF_OUT)) {
                         if (pd.pf_mtag == NULL &&
                             ((pd.pf_mtag = pf_get_mtag(m)) == NULL)) {
                                 action = PF_DROP;
                                 goto done;
                         }
                         pd.pf_mtag->flags |= PF_MTAG_FLAG_PACKET_LOOPED;
                 }
                 if (pd.pf_mtag && pd.pf_mtag->flags & PF_MTAG_FLAG_FASTFWD_OURS_PRESENT) {
                         m->m_flags |= M_FASTFWD_OURS;
                         pd.pf_mtag->flags &= ~PF_MTAG_FLAG_FASTFWD_OURS_PRESENT;
                 }
                 m_tag_delete(m, mtag);
 
                 mtag = m_tag_locate(m, MTAG_IPFW_RULE, 0, NULL);
                 if (mtag != NULL)
                         m_tag_delete(m, mtag);
-        } else if (pf_normalize_ip(m0, kif, &reason, &pd) != PF_PASS) {
-                /* We do IP header normalization and packet reassembly here */
-                action = PF_DROP;
-                goto done;
         }
-        m = *m0;        /* pf_normalize messes with m0 */
-        h = mtod(m, struct ip *);
 
-        off = h->ip_hl << 2;
-        if (off < (int)sizeof(struct ip)) {
-                action = PF_DROP;
-                REASON_SET(&reason, PFRES_SHORT);
-                pd.act.log = PF_LOG_FORCE;
-                goto done;
-        }
-
-        pd.src = (struct pf_addr *)&h->ip_src;
-        pd.dst = (struct pf_addr *)&h->ip_dst;
-        pd.ip_sum = &h->ip_sum;
-        pd.proto = h->ip_p;
-        pd.tos = h->ip_tos & ~IPTOS_ECN_MASK;
-        pd.tot_len = ntohs(h->ip_len);
-
         /* handle fragments that didn't get reassembled by normalization */
         if (h->ip_off & htons(IP_MF | IP_OFFMASK)) {
                 action = pf_test_fragment(&r, kif, m, h, &pd, &a, &ruleset);
                 goto done;
         }
 
         switch (h->ip_p) {
         case IPPROTO_TCP: {
-                if (!pf_pull_hdr(m, off, &pd.hdr.tcp, sizeof(pd.hdr.tcp),
-                    &action, &reason, AF_INET)) {
-                        if (action != PF_PASS)
-                                pd.act.log = PF_LOG_FORCE;
-                        goto done;
-                }
-                pd.p_len = pd.tot_len - off - (pd.hdr.tcp.th_off << 2);
 
-                pd.sport = &pd.hdr.tcp.th_sport;
-                pd.dport = &pd.hdr.tcp.th_dport;
-
                 /* Respond to SYN with a syncookie. */
                 if ((pd.hdr.tcp.th_flags & (TH_SYN|TH_ACK|TH_RST)) == TH_SYN &&
                     pd.dir == PF_IN && pf_synflood_check(&pd)) {
                         pf_syncookie_send(m, off, &pd);
                         action = PF_DROP;
                         break;
                 }
 
if (action == PF_PASS) {
 
                                 s->src.seqhi = ntohl(pd.hdr.tcp.th_ack) - 1;
                                 s->src.seqlo = ntohl(pd.hdr.tcp.th_seq) - 1;
                                 pf_set_protostate(s, PF_PEER_SRC, PF_TCPS_PROXY_DST);
                                 action = pf_synproxy(&pd, &s, &reason);
                                 break;
                         } else {
                                 action = pf_test_rule(&r, &s, kif, m, off, &pd,
-                                    &a, &ruleset, inp);
+                                    &a, &ruleset, inp, hdrlen);
                         }
                 }
                 break;
         }
 
         case IPPROTO_UDP: {
-                if (!pf_pull_hdr(m, off, &pd.hdr.udp, sizeof(pd.hdr.udp),
-                    &action, &reason, AF_INET)) {
-                        if (action != PF_PASS)
-                                pd.act.log = PF_LOG_FORCE;
-                        goto done;
-                }
-                pd.sport = &pd.hdr.udp.uh_sport;
-                pd.dport = &pd.hdr.udp.uh_dport;
-                if (pd.hdr.udp.uh_dport == 0 ||
-                    ntohs(pd.hdr.udp.uh_ulen) > m->m_pkthdr.len - off ||
-                    ntohs(pd.hdr.udp.uh_ulen) < sizeof(struct udphdr)) {
-                        action = PF_DROP;
-                        REASON_SET(&reason, PFRES_SHORT);
-                        goto done;
-                }
                 action = pf_test_state_udp(&s, kif, m, off, h, &pd);
                 if (action == PF_PASS) {
                         if (V_pfsync_update_state_ptr != NULL)
                                 V_pfsync_update_state_ptr(s);
                         r = s->rule.ptr;
                         a = s->anchor.ptr;
                 } else if (s == NULL)
                         action = pf_test_rule(&r, &s, kif, m, off, &pd,
-                            &a, &ruleset, inp);
+                            &a, &ruleset, inp, hdrlen);
                 break;
         }
 
         case IPPROTO_SCTP: {
-                if (!pf_pull_hdr(m, off, &pd.hdr.sctp, sizeof(pd.hdr.sctp),
-                    &action, &reason, AF_INET)) {
-                        if (action != PF_PASS)
-                                pd.act.log |= PF_LOG_FORCE;
-                        goto done;
-                }
-                pd.p_len = pd.tot_len - off;
-
-                pd.sport = &pd.hdr.sctp.src_port;
-                pd.dport = &pd.hdr.sctp.dest_port;
-                if (pd.hdr.sctp.src_port == 0 || pd.hdr.sctp.dest_port == 0) {
-                        action = PF_DROP;
-                        REASON_SET(&reason, PFRES_SHORT);
-                        goto done;
-                }
                 action = pf_normalize_sctp(dir, kif, m, 0, off, h, &pd);
                 if (action == PF_DROP)
                         goto done;
                 action = pf_test_state_sctp(&s, kif, m, off, h, &pd,
                     &reason);
                 if (action == PF_PASS) {
                         if (V_pfsync_update_state_ptr != NULL)
                                 V_pfsync_update_state_ptr(s);
                         r = s->rule.ptr;
                         a = s->anchor.ptr;
                 } else if (s == NULL) {
                         action = pf_test_rule(&r, &s, kif, m, off,
-                            &pd, &a, &ruleset, inp);
+                            &pd, &a, &ruleset, inp, hdrlen);
                 }
                 break;
         }
 
         case IPPROTO_ICMP: {
-                if (!pf_pull_hdr(m, off, &pd.hdr.icmp, ICMP_MINLEN,
-                    &action, &reason, AF_INET)) {
-                        if (action != PF_PASS)
-                                pd.act.log = PF_LOG_FORCE;
-                        goto done;
-                }
                 action = pf_test_state_icmp(&s, kif, m, off, h, &pd, &reason);
                 if (action == PF_PASS) {
                         if (V_pfsync_update_state_ptr != NULL)
                                 V_pfsync_update_state_ptr(s);
                         r = s->rule.ptr;
                         a = s->anchor.ptr;
                 } else if (s == NULL)
                         action = pf_test_rule(&r, &s, kif, m, off, &pd,
-                            &a, &ruleset, inp);
+                            &a, &ruleset, inp, hdrlen);
                 break;
         }
 
         case IPPROTO_ICMPV6: {
                 action = PF_DROP;
                 DPFPRINTF(PF_DEBUG_MISC,
                     ("pf: dropping IPv4 packet with ICMPv6 payload\n"));
                 goto done;
         }
 
         default:
                 action = pf_test_state_other(&s, kif, m, &pd);
                 if (action == PF_PASS) {
                         if (V_pfsync_update_state_ptr != NULL)
                                 V_pfsync_update_state_ptr(s);
                         r = s->rule.ptr;
                         a = s->anchor.ptr;
                 } else if (s == NULL)
                         action = pf_test_rule(&r, &s, kif, m, off, &pd,
-                            &a, &ruleset, inp);
+                            &a, &ruleset, inp, hdrlen);
                 break;
         }
 
 done:
         PF_RULES_RUNLOCK();
         if (action == PF_PASS && h->ip_hl > 5 &&
             !((s && s->state_flags & PFSTATE_ALLOWOPTS) || r->allow_opts)) {
                 action = PF_DROP;
pf_test6(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0, struct inpcb *inp,
         u_short                         action, reason = 0;
         struct mbuf                *m = *m0, *n = NULL;
         struct m_tag            *mtag;
         struct ip6_hdr                *h = NULL;
         struct pf_krule                *a = NULL, *r = &V_pf_default_rule, *tr, *nr;
         struct pf_kstate        *s = NULL;
         struct pf_kruleset        *ruleset = NULL;
         struct pf_pdesc          pd;
-        int                         off, terminal = 0, dirndx, rh_cnt = 0, use_2nd_queue = 0;
+        int                         off, hdrlen, dirndx, use_2nd_queue = 0;
         uint16_t                 tag;
         uint8_t                  rt;
 
         PF_RULES_RLOCK_TRACKER;
         KASSERT(dir == PF_IN || dir == PF_OUT, ("%s: bad direction %d\n", __func__, dir));
         M_ASSERTPKTHDR(m);
 
         if (!V_pf_status.running)
pf_test6(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0, struct inpcb *inp,
         }
 
         if (__predict_false(! M_WRITABLE(*m0))) {
                 m = *m0 = m_unshare(*m0, M_NOWAIT);
                 if (*m0 == NULL)
                         return (PF_DROP);
         }
 
+        if (__predict_false(m->m_len < sizeof(struct ip6_hdr)) &&
+            (m = *m0 = m_pullup(*m0, sizeof(struct ip6_hdr))) == NULL) {
+                DPFPRINTF(PF_DEBUG_URGENT,
+                    ("pf_test6: m_len < sizeof(struct ip6_hdr)"
+                     ", pullup failed\n"));
+                PF_RULES_RUNLOCK();
+                return (PF_DROP);
+        }
+
         memset(&pd, 0, sizeof(pd));
-        TAILQ_INIT(&pd.sctp_multihome_jobs);
-        if (default_actions != NULL)
-                memcpy(&pd.act, default_actions, sizeof(pd.act));
-        pd.pf_mtag = pf_find_mtag(m);
+        pd.dir = dir;
 
+        /* We do IP header normalization and packet reassembly here */
+        if (pf_normalize_ip6(m0, kif, &reason, &pd) != PF_PASS) {
+                action = PF_DROP;
+                goto done;
+        }
+        m = *m0;        /* pf_normalize messes with m0 */
+        h = mtod(m, struct ip6_hdr *);
+        off = ((caddr_t)h - m->m_data) + sizeof(struct ip6_hdr);
+
+        if (pf_setup_pdesc(AF_INET6, dir, &pd, m, &action, &reason, kif, &a, &r,
+                &ruleset, &off, &hdrlen, default_actions) == -1) {
+                if (action != PF_PASS)
+                        pd.act.log |= PF_LOG_FORCE;
+                goto done;
+        }
+
         if (pd.pf_mtag != NULL && (pd.pf_mtag->flags & PF_MTAG_FLAG_ROUTE_TO)) {
                 pd.pf_mtag->flags &= ~PF_MTAG_FLAG_ROUTE_TO;
 
                 ifp = ifnet_byindexgen(pd.pf_mtag->if_index,
                     pd.pf_mtag->if_idxgen);
                 if (ifp == NULL || ifp->if_flags & IFF_DYING) {
                         PF_RULES_RUNLOCK();
                         m_freem(*m0);
                         *m0 = NULL;
                         return (PF_PASS);
                 }
                 PF_RULES_RUNLOCK();
                 nd6_output_ifp(ifp, ifp, m,
                     (struct sockaddr_in6 *)&pd.pf_mtag->dst, NULL);
                 *m0 = NULL;
                 return (PF_PASS);
         }
 
-        if (pd.pf_mtag && pd.pf_mtag->dnpipe) {
-                pd.act.dnpipe = pd.pf_mtag->dnpipe;
-                pd.act.flags = pd.pf_mtag->dnflags;
-        }
-
         if (ip_dn_io_ptr != NULL && pd.pf_mtag != NULL &&
             pd.pf_mtag->flags & PF_MTAG_FLAG_DUMMYNET) {
                 pf_dummynet_flag_remove(m, pd.pf_mtag);
                 /* Dummynet re-injects packets after they've
                  * completed their delay. We've already
                  * processed them, so pass unconditionally. */
                 PF_RULES_RUNLOCK();
                 return (PF_PASS);
         }
 
-        pd.sport = pd.dport = NULL;
-        pd.ip_sum = NULL;
-        pd.proto_sum = NULL;
-        pd.dir = dir;
-        pd.sidx = (dir == PF_IN) ? 0 : 1;
-        pd.didx = (dir == PF_IN) ? 1 : 0;
-        pd.af = AF_INET6;
-        pd.act.rtableid = -1;
-
-        if (__predict_false(m->m_len < sizeof(struct ip6_hdr)) &&
-            (m = *m0 = m_pullup(*m0, sizeof(struct ip6_hdr))) == NULL) {
-                DPFPRINTF(PF_DEBUG_URGENT,
-                    ("pf_test6: m_len < sizeof(struct ip6_hdr)"
-                     ", pullup failed\n"));
-                PF_RULES_RUNLOCK();
-                return (PF_DROP);
-        }
-        h = mtod(m, struct ip6_hdr *);
-        off = ((caddr_t)h - m->m_data) + sizeof(struct ip6_hdr);
-
-        /* We do IP header normalization and packet reassembly here */
-        if (pf_normalize_ip6(m0, kif, &reason, &pd) != PF_PASS) {
-                action = PF_DROP;
-                goto done;
-        }
-        m = *m0;        /* pf_normalize messes with m0 */
-        h = mtod(m, struct ip6_hdr *);
-        off = ((caddr_t)h - m->m_data) + sizeof(struct ip6_hdr);
-
         /*
          * we do not support jumbogram.  if we keep going, zero ip6_plen
          * will do something bad, so drop the packet for now.
          */
         if (htons(h->ip6_plen) == 0) {
                 action = PF_DROP;
                 REASON_SET(&reason, PFRES_NORM);        /*XXX*/
                 goto done;
         }
 
-        pd.src = (struct pf_addr *)&h->ip6_src;
-        pd.dst = (struct pf_addr *)&h->ip6_dst;
-        pd.tos = IPV6_DSCP(h);
-        pd.tot_len = ntohs(h->ip6_plen) + sizeof(struct ip6_hdr);
-
-        pd.proto = h->ip6_nxt;
-        do {
-                switch (pd.proto) {
-                case IPPROTO_FRAGMENT:
-                        action = pf_test_fragment(&r, kif, m, h, &pd, &a,
-                            &ruleset);
-                        if (action == PF_DROP)
-                                REASON_SET(&reason, PFRES_FRAG);
-                        goto done;
-                case IPPROTO_ROUTING: {
-                        struct ip6_rthdr rthdr;
-
-                        if (rh_cnt++) {
-                                DPFPRINTF(PF_DEBUG_MISC,
-                                    ("pf: IPv6 more than one rthdr\n"));
-                                action = PF_DROP;
-                                REASON_SET(&reason, PFRES_IPOPTIONS);
-                                pd.act.log = PF_LOG_FORCE;
-                                goto done;
-                        }
-                        if (!pf_pull_hdr(m, off, &rthdr, sizeof(rthdr), NULL,
-                            &reason, pd.af)) {
-                                DPFPRINTF(PF_DEBUG_MISC,
-                                    ("pf: IPv6 short rthdr\n"));
-                                action = PF_DROP;
-                                REASON_SET(&reason, PFRES_SHORT);
-                                pd.act.log = PF_LOG_FORCE;
-                                goto done;
-                        }
-                        if (rthdr.ip6r_type == IPV6_RTHDR_TYPE_0) {
-                                DPFPRINTF(PF_DEBUG_MISC,
-                                    ("pf: IPv6 rthdr0\n"));
-                                action = PF_DROP;
-                                REASON_SET(&reason, PFRES_IPOPTIONS);
-                                pd.act.log = PF_LOG_FORCE;
-                                goto done;
-                        }
-                        /* FALLTHROUGH */
-                }
-                case IPPROTO_AH:
-                case IPPROTO_HOPOPTS:
-                case IPPROTO_DSTOPTS: {
-                        /* get next header and header length */
-                        struct ip6_ext  opt6;
-
-                        if (!pf_pull_hdr(m, off, &opt6, sizeof(opt6),
-                            NULL, &reason, pd.af)) {
-                                DPFPRINTF(PF_DEBUG_MISC,
-                                    ("pf: IPv6 short opt\n"));
-                                action = PF_DROP;
-                                pd.act.log = PF_LOG_FORCE;
-                                goto done;
-                        }
-                        if (pd.proto == IPPROTO_AH)
-                                off += (opt6.ip6e_len + 2) * 4;
-                        else
-                                off += (opt6.ip6e_len + 1) * 8;
-                        pd.proto = opt6.ip6e_nxt;
-                        /* goto the next header */
-                        break;
-                }
-                default:
-                        terminal++;
-                        break;
-                }
-        } while (!terminal);
-
         /* if there's no routing header, use unmodified mbuf for checksumming */
         if (!n)
                 n = m;
 
         switch (pd.proto) {
         case IPPROTO_TCP: {
-                if (!pf_pull_hdr(m, off, &pd.hdr.tcp, sizeof(pd.hdr.tcp),
-                    &action, &reason, AF_INET6)) {
-                        if (action != PF_PASS)
-                                pd.act.log |= PF_LOG_FORCE;
-                        goto done;
-                }
-                pd.p_len = pd.tot_len - off - (pd.hdr.tcp.th_off << 2);
-                pd.sport = &pd.hdr.tcp.th_sport;
-                pd.dport = &pd.hdr.tcp.th_dport;
-
                 /* Respond to SYN with a syncookie. */
                 if ((pd.hdr.tcp.th_flags & (TH_SYN|TH_ACK|TH_RST)) == TH_SYN &&
                     pd.dir == PF_IN && pf_synflood_check(&pd)) {
                         pf_syncookie_send(m, off, &pd);
                         action = PF_DROP;
                         break;
                 }
 
if (action == PF_PASS) {
                                 s->src.seqhi = ntohl(pd.hdr.tcp.th_ack) - 1;
                                 s->src.seqlo = ntohl(pd.hdr.tcp.th_seq) - 1;
                                 pf_set_protostate(s, PF_PEER_SRC, PF_TCPS_PROXY_DST);
 
                                 action = pf_synproxy(&pd, &s, &reason);
                                 break;
                         } else {
                                 action = pf_test_rule(&r, &s, kif, m, off, &pd,
-                                    &a, &ruleset, inp);
+                                    &a, &ruleset, inp, hdrlen);
                         }
                 }
                 break;
         }
 
         case IPPROTO_UDP: {
-                if (!pf_pull_hdr(m, off, &pd.hdr.udp, sizeof(pd.hdr.udp),
-                    &action, &reason, AF_INET6)) {
-                        if (action != PF_PASS)
-                                pd.act.log |= PF_LOG_FORCE;
-                        goto done;
-                }
-                pd.sport = &pd.hdr.udp.uh_sport;
-                pd.dport = &pd.hdr.udp.uh_dport;
-                if (pd.hdr.udp.uh_dport == 0 ||
-                    ntohs(pd.hdr.udp.uh_ulen) > m->m_pkthdr.len - off ||
-                    ntohs(pd.hdr.udp.uh_ulen) < sizeof(struct udphdr)) {
-                        action = PF_DROP;
-                        REASON_SET(&reason, PFRES_SHORT);
-                        goto done;
-                }
                 action = pf_test_state_udp(&s, kif, m, off, h, &pd);
                 if (action == PF_PASS) {
                         if (V_pfsync_update_state_ptr != NULL)
                                 V_pfsync_update_state_ptr(s);
                         r = s->rule.ptr;
                         a = s->anchor.ptr;
                 } else if (s == NULL)
                         action = pf_test_rule(&r, &s, kif, m, off, &pd,
-                            &a, &ruleset, inp);
+                            &a, &ruleset, inp, hdrlen);
                 break;
         }
 
         case IPPROTO_SCTP: {
-                if (!pf_pull_hdr(m, off, &pd.hdr.sctp, sizeof(pd.hdr.sctp),
-                    &action, &reason, AF_INET6)) {
-                        if (action != PF_PASS)
-                                pd.act.log |= PF_LOG_FORCE;
-                        goto done;
-                }
-                pd.sport = &pd.hdr.sctp.src_port;
-                pd.dport = &pd.hdr.sctp.dest_port;
-                if (pd.hdr.sctp.src_port == 0 || pd.hdr.sctp.dest_port == 0) {
-                        action = PF_DROP;
-                        REASON_SET(&reason, PFRES_SHORT);
-                        goto done;
-                }
                 action = pf_normalize_sctp(dir, kif, m, 0, off, h, &pd);
                 if (action == PF_DROP)
                         goto done;
                 action = pf_test_state_sctp(&s, kif, m, off, h, &pd,
                     &reason);
                 if (action == PF_PASS) {
                         if (V_pfsync_update_state_ptr != NULL)
                                 V_pfsync_update_state_ptr(s);
                         r = s->rule.ptr;
                         a = s->anchor.ptr;
                 } else if (s == NULL) {
                         action = pf_test_rule(&r, &s, kif, m, off,
-                            &pd, &a, &ruleset, inp);
+                            &pd, &a, &ruleset, inp, hdrlen);
                 }
                 break;
         }
 
         case IPPROTO_ICMP: {
                 action = PF_DROP;
                 DPFPRINTF(PF_DEBUG_MISC,
                     ("pf: dropping IPv6 packet with ICMPv4 payload\n"));
                 goto done;
         }
 
         case IPPROTO_ICMPV6: {
-                if (!pf_pull_hdr(m, off, &pd.hdr.icmp6, sizeof(pd.hdr.icmp6),
-                    &action, &reason, AF_INET6)) {
-                        if (action != PF_PASS)
-                                pd.act.log |= PF_LOG_FORCE;
-                        goto done;
-                }
                 action = pf_test_state_icmp(&s, kif, m, off, h, &pd, &reason);
                 if (action == PF_PASS) {
                         if (V_pfsync_update_state_ptr != NULL)
                                 V_pfsync_update_state_ptr(s);
                         r = s->rule.ptr;
                         a = s->anchor.ptr;
                 } else if (s == NULL)
                         action = pf_test_rule(&r, &s, kif, m, off, &pd,
-                            &a, &ruleset, inp);
+                            &a, &ruleset, inp, hdrlen);
                 break;
         }
 
         default:
                 action = pf_test_state_other(&s, kif, m, &pd);
                 if (action == PF_PASS) {
                         if (V_pfsync_update_state_ptr != NULL)
                                 V_pfsync_update_state_ptr(s);
                         r = s->rule.ptr;
                         a = s->anchor.ptr;
                 } else if (s == NULL)
                         action = pf_test_rule(&r, &s, kif, m, off, &pd,
-                            &a, &ruleset, inp);
+                            &a, &ruleset, inp, hdrlen);
                 break;
         }
 
 done:
         PF_RULES_RUNLOCK();
         if (n != m) {
                 m_freem(n);
                 n = NULL;
         }
 
         /* handle dangerous IPv6 extension headers. */
-        if (action == PF_PASS && rh_cnt &&
+        if (action == PF_PASS && pd.rh_cnt &&
             !((s && s->state_flags & PFSTATE_ALLOWOPTS) || r->allow_opts)) {
                 action = PF_DROP;
                 REASON_SET(&reason, PFRES_IPOPTIONS);
                 pd.act.log = r->log;
                 DPFPRINTF(PF_DEBUG_MISC,
                     ("pf: dropping packet with dangerous v6 headers\n"));
         }