pf: dedupe layer 4 protocol code in pf_setup_pdesc()

[kp]

Summary

In pf_setup_pdesc() the code for analysing TCP and UDP headers was
the same for v4 and v6. Deduplicate by moving the protocol switch
after the address family switch.
ok henning@ claudio@

Obtained from: OpenBSD, bluhm <[e-mail]>, 72cf18cc6e
Sponsored by: Rubicon Communications, LLC ("Netgate")

[zlei]

I'm a little nervous about this change. It seems invalid combinations such as IPv4/ICMPv6 and IPv6/ICMP are now possible after the change. Do we have some pre-checks about those combinations ?

[kp]

In D46647#1063679, @zlei wrote:

I'm a little nervous about this change. It seems invalid combinations such as IPv4/ICMPv6 and IPv6/ICMP are now possible after the change. Do we have some pre-checks about those combinations ?

There's an explicit test in pf_test() where we drop such packets. It's introduced in D46649. That's after pf_setup_pdesc(), but I'd argue that that's fine. pf_setup_pdesc() is only meant to set up a context struct, it doesn't have to do the full packet validation.