git: b4a42589116b - main - pf: put kif into struct pf_pdesc
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Thu, 10 Oct 2024 12:37:28 UTC
The branch main has been updated by kp:
URL: https://cgit.FreeBSD.org/src/commit/?id=b4a42589116bcf21e1c07224900dae6caad23c97
commit b4a42589116bcf21e1c07224900dae6caad23c97
Author: Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2024-10-03 12:37:54 +0000
Commit: Kristof Provost <kp@FreeBSD.org>
CommitDate: 2024-10-10 12:10:41 +0000
pf: put kif into struct pf_pdesc
Put kif and dir into pdesc an use this instead of passing the values
around. This is a mechanical change. Initialize pd2 and use it
where appropriate.
ok henning on an earlier version; ok mpf
Obtained from: OpenBSD, bluhm <bluhm@openbsd.org>, 47de5c193e
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D46939
---
sys/net/if_pflog.h | 4 +-
sys/net/pfvar.h | 26 +++----
sys/netpfil/pf/if_pflog.c | 8 +-
sys/netpfil/pf/pf.c | 187 ++++++++++++++++++++++------------------------
sys/netpfil/pf/pf_lb.c | 21 +++---
sys/netpfil/pf/pf_norm.c | 52 +++++++------
6 files changed, 142 insertions(+), 156 deletions(-)
diff --git a/sys/net/if_pflog.h b/sys/net/if_pflog.h
index 58c178e3798a..0f8caef5fe8b 100644
--- a/sys/net/if_pflog.h
+++ b/sys/net/if_pflog.h
@@ -69,9 +69,9 @@ struct pf_ruleset;
struct pfi_kif;
struct pf_pdesc;
-#define PFLOG_PACKET(i,a,b,t,c,d,e,f,g) do { \
+#define PFLOG_PACKET(a,b,t,c,d,e,f,g) do { \
if (pflog_packet_ptr != NULL) \
- pflog_packet_ptr(i,a,b,t,c,d,e,f,g); \
+ pflog_packet_ptr(a,b,t,c,d,e,f,g); \
} while (0)
#endif /* _KERNEL */
#endif /* _NET_IF_PFLOG_H_ */
diff --git a/sys/net/pfvar.h b/sys/net/pfvar.h
index cf7db417034d..f88a619dd184 100644
--- a/sys/net/pfvar.h
+++ b/sys/net/pfvar.h
@@ -1249,8 +1249,8 @@ void pf_state_export(struct pf_state_export *,
/* pflog */
struct pf_kruleset;
struct pf_pdesc;
-typedef int pflog_packet_t(struct pfi_kkif *, struct mbuf *,
- uint8_t, u_int8_t, struct pf_krule *, struct pf_krule *, struct pf_kruleset *,
+typedef int pflog_packet_t(struct mbuf *, uint8_t, u_int8_t,
+ struct pf_krule *, struct pf_krule *, struct pf_kruleset *,
struct pf_pdesc *, int);
extern pflog_packet_t *pflog_packet_ptr;
@@ -1597,6 +1597,8 @@ struct pf_pdesc {
char any[0];
} hdr;
+ struct pfi_kkif *kif; /* incomming interface */
+
struct pf_addr *src; /* src address */
struct pf_addr *dst; /* dst address */
u_int16_t *sport;
@@ -2353,21 +2355,19 @@ extern void pf_addrcpy(struct pf_addr *, struct pf_addr *,
void pf_free_rule(struct pf_krule *);
int pf_test_eth(int, int, struct ifnet *, struct mbuf **, struct inpcb *);
-int pf_scan_sctp(struct mbuf *, int, struct pf_pdesc *, struct pfi_kkif *);
+int pf_scan_sctp(struct mbuf *, struct pf_pdesc *);
#if defined(INET) || defined(INET6)
int pf_test(sa_family_t, int, int, struct ifnet *, struct mbuf **, struct inpcb *,
struct pf_rule_actions *);
#endif
#ifdef INET
-int pf_normalize_ip(struct mbuf **, struct pfi_kkif *, u_short *,
- struct pf_pdesc *);
+int pf_normalize_ip(struct mbuf **, u_short *, struct pf_pdesc *);
#endif /* INET */
#ifdef INET6
int pf_walk_header6(struct mbuf *, struct ip6_hdr *, int *, int *, int *,
uint8_t *, uint32_t *, u_short *);
-int pf_normalize_ip6(struct mbuf **, struct pfi_kkif *, int,
- u_short *, struct pf_pdesc *);
+int pf_normalize_ip6(struct mbuf **, int, u_short *, struct pf_pdesc *);
void pf_poolmask(struct pf_addr *, struct pf_addr*,
struct pf_addr *, struct pf_addr *, sa_family_t);
void pf_addr_inc(struct pf_addr *, sa_family_t);
@@ -2375,10 +2375,8 @@ int pf_max_frag_size(struct mbuf *);
int pf_refragment6(struct ifnet *, struct mbuf **, struct m_tag *, bool);
#endif /* INET6 */
-int pf_multihome_scan_init(struct mbuf *, int, int, struct pf_pdesc *,
- struct pfi_kkif *);
-int pf_multihome_scan_asconf(struct mbuf *, int, int, struct pf_pdesc *,
- struct pfi_kkif *);
+int pf_multihome_scan_init(struct mbuf *, int, int, struct pf_pdesc *);
+int pf_multihome_scan_asconf(struct mbuf *, int, int, struct pf_pdesc *);
u_int32_t pf_new_isn(struct pf_kstate *);
void *pf_pull_hdr(const struct mbuf *, int, void *, int, u_short *, u_short *,
@@ -2400,7 +2398,7 @@ int pf_match_port(u_int8_t, u_int16_t, u_int16_t, u_int16_t);
void pf_normalize_init(void);
void pf_normalize_cleanup(void);
-int pf_normalize_tcp(struct pfi_kkif *, struct mbuf *, struct pf_pdesc *);
+int pf_normalize_tcp(struct mbuf *, struct pf_pdesc *);
void pf_normalize_tcp_cleanup(struct pf_kstate *);
int pf_normalize_tcp_init(struct mbuf *, struct pf_pdesc *,
struct tcphdr *, struct pf_state_peer *, struct pf_state_peer *);
@@ -2409,7 +2407,7 @@ int pf_normalize_tcp_stateful(struct mbuf *, struct pf_pdesc *,
struct pf_state_peer *, struct pf_state_peer *, int *);
int pf_normalize_sctp_init(struct mbuf *, struct pf_pdesc *,
struct pf_state_peer *, struct pf_state_peer *);
-int pf_normalize_sctp(struct pfi_kkif *, struct mbuf *, struct pf_pdesc *);
+int pf_normalize_sctp(struct mbuf *, struct pf_pdesc *);
u_int32_t
pf_state_expires(const struct pf_kstate *);
void pf_purge_expired_fragments(void);
@@ -2625,7 +2623,7 @@ u_short pf_map_addr_sn(u_int8_t, struct pf_krule *,
struct pfi_kkif **nkif, struct pf_addr *,
struct pf_ksrc_node **);
u_short pf_get_translation(struct pf_pdesc *, struct mbuf *,
- int, struct pfi_kkif *, struct pf_ksrc_node **,
+ int, struct pf_ksrc_node **,
struct pf_state_key **, struct pf_state_key **,
struct pf_addr *, struct pf_addr *,
uint16_t, uint16_t, struct pf_kanchor_stackframe *,
diff --git a/sys/netpfil/pf/if_pflog.c b/sys/netpfil/pf/if_pflog.c
index 9276b472a845..4db178b8f279 100644
--- a/sys/netpfil/pf/if_pflog.c
+++ b/sys/netpfil/pf/if_pflog.c
@@ -213,14 +213,14 @@ pflogioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
}
static int
-pflog_packet(struct pfi_kkif *kif, struct mbuf *m,
- uint8_t action, u_int8_t reason, struct pf_krule *rm, struct pf_krule *am,
+pflog_packet(struct mbuf *m, uint8_t action, u_int8_t reason,
+ struct pf_krule *rm, struct pf_krule *am,
struct pf_kruleset *ruleset, struct pf_pdesc *pd, int lookupsafe)
{
struct ifnet *ifn;
struct pfloghdr hdr;
- if (kif == NULL || m == NULL || rm == NULL || pd == NULL)
+ if (m == NULL || rm == NULL || pd == NULL)
return (1);
ifn = V_pflogifs[rm->logif];
@@ -232,7 +232,7 @@ pflog_packet(struct pfi_kkif *kif, struct mbuf *m,
hdr.af = pd->af;
hdr.action = action;
hdr.reason = reason;
- memcpy(hdr.ifname, kif->pfik_name, sizeof(hdr.ifname));
+ memcpy(hdr.ifname, pd->kif->pfik_name, sizeof(hdr.ifname));
if (am == NULL) {
hdr.rulenr = htonl(rm->nr);
diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c
index 4ed3597154a8..d1240dc37a1c 100644
--- a/sys/netpfil/pf/pf.c
+++ b/sys/netpfil/pf/pf.c
@@ -320,45 +320,39 @@ static int pf_dummynet_route(struct pf_pdesc *,
static int pf_test_eth_rule(int, struct pfi_kkif *,
struct mbuf **);
static int pf_test_rule(struct pf_krule **, struct pf_kstate **,
- struct pfi_kkif *, struct mbuf *,
- struct pf_pdesc *, struct pf_krule **,
+ struct mbuf *, struct pf_pdesc *, struct pf_krule **,
struct pf_kruleset **, struct inpcb *);
static int pf_create_state(struct pf_krule *, struct pf_krule *,
struct pf_krule *, struct pf_pdesc *,
struct pf_ksrc_node *, struct pf_state_key *,
struct pf_state_key *, struct mbuf *,
- u_int16_t, u_int16_t, int *, struct pfi_kkif *,
+ u_int16_t, u_int16_t, int *,
struct pf_kstate **, int, u_int16_t, u_int16_t,
struct pf_krule_slist *, struct pf_udp_mapping *);
static int pf_state_key_addr_setup(struct pf_pdesc *, struct mbuf *,
struct pf_state_key_cmp *, int, struct pf_addr *,
int, struct pf_addr *, int);
static int pf_tcp_track_full(struct pf_kstate **,
- struct pfi_kkif *, struct mbuf *,
- struct pf_pdesc *, u_short *, int *);
+ struct mbuf *, struct pf_pdesc *, u_short *, int *);
static int pf_tcp_track_sloppy(struct pf_kstate **,
struct pf_pdesc *, u_short *);
static int pf_test_state_tcp(struct pf_kstate **,
- struct pfi_kkif *, struct mbuf *,
- struct pf_pdesc *, u_short *);
+ struct mbuf *, struct pf_pdesc *, u_short *);
static int pf_test_state_udp(struct pf_kstate **,
- struct pfi_kkif *, struct mbuf *,
- struct pf_pdesc *);
+ struct mbuf *, struct pf_pdesc *);
int pf_icmp_state_lookup(struct pf_state_key_cmp *,
struct pf_pdesc *, struct pf_kstate **, struct mbuf *,
- int, struct pfi_kkif *, u_int16_t, u_int16_t,
+ int, u_int16_t, u_int16_t,
int, int *, int, int);
-static int pf_test_state_icmp(struct pf_kstate **,
- struct pfi_kkif *, struct mbuf *,
+static int pf_test_state_icmp(struct pf_kstate **, struct mbuf *,
struct pf_pdesc *, u_short *);
static void pf_sctp_multihome_detach_addr(const struct pf_kstate *);
static void pf_sctp_multihome_delayed(struct pf_pdesc *,
struct pfi_kkif *, struct pf_kstate *, int);
-static int pf_test_state_sctp(struct pf_kstate **,
- struct pfi_kkif *, struct mbuf *,
+static int pf_test_state_sctp(struct pf_kstate **, struct mbuf *,
struct pf_pdesc *, u_short *);
static int pf_test_state_other(struct pf_kstate **,
- struct pfi_kkif *, struct mbuf *, struct pf_pdesc *);
+ struct mbuf *, struct pf_pdesc *);
static u_int16_t pf_calc_mss(struct pf_addr *, sa_family_t,
int, u_int16_t);
static int pf_check_proto_cksum(struct mbuf *, int, int,
@@ -373,8 +367,7 @@ static struct pf_kstate *pf_find_state(struct pfi_kkif *,
const struct pf_state_key_cmp *, u_int);
static int pf_src_connlimit(struct pf_kstate **);
static int pf_match_rcvif(struct mbuf *, struct pf_krule *);
-static void pf_counters_inc(int,
- struct pf_pdesc *, struct pfi_kkif *,
+static void pf_counters_inc(int, struct pf_pdesc *,
struct pf_kstate *, struct pf_krule *,
struct pf_krule *);
static void pf_overload_task(void *v, int pending);
@@ -422,10 +415,10 @@ enum { PF_ICMP_MULTI_NONE, PF_ICMP_MULTI_LINK };
#define PACKET_LOOPED(pd) ((pd)->pf_mtag && \
(pd)->pf_mtag->flags & PF_MTAG_FLAG_PACKET_LOOPED)
-#define STATE_LOOKUP(i, k, s, pd) \
+#define STATE_LOOKUP(k, s, pd) \
do { \
- (s) = pf_find_state((i), (k), (pd->dir)); \
- SDT_PROBE5(pf, ip, state, lookup, i, k, (pd->dir), pd, (s)); \
+ (s) = pf_find_state((pd->kif), (k), (pd->dir)); \
+ SDT_PROBE5(pf, ip, state, lookup, pd->kif, k, (pd->dir), pd, (s)); \
if ((s) == NULL) \
return (PF_DROP); \
if (PACKET_LOOPED(pd)) \
@@ -3655,7 +3648,7 @@ pf_send_tcp(const struct pf_krule *r, sa_family_t af,
static void
pf_return(struct pf_krule *r, struct pf_krule *nr, struct pf_pdesc *pd,
struct pf_state_key *sk, struct mbuf *m, struct tcphdr *th,
- struct pfi_kkif *kif, u_int16_t bproto_sum, u_int16_t bip_sum,
+ u_int16_t bproto_sum, u_int16_t bip_sum,
u_short *reason, int rtableid)
{
struct pf_addr * const saddr = pd->src;
@@ -4865,7 +4858,7 @@ pf_test_eth_rule(int dir, struct pfi_kkif *kif, struct mbuf **m0)
} while (0)
static int
-pf_test_rule(struct pf_krule **rm, struct pf_kstate **sm, struct pfi_kkif *kif,
+pf_test_rule(struct pf_krule **rm, struct pf_kstate **sm,
struct mbuf *m, struct pf_pdesc *pd, struct pf_krule **am,
struct pf_kruleset **rsm, struct inpcb *inp)
{
@@ -4956,7 +4949,7 @@ pf_test_rule(struct pf_krule **rm, struct pf_kstate **sm, struct pfi_kkif *kif,
r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr);
/* check packet for BINAT/NAT/RDR */
- transerror = pf_get_translation(pd, m, pd->off, kif, &nsn, &sk,
+ transerror = pf_get_translation(pd, m, pd->off, &nsn, &sk,
&nk, saddr, daddr, sport, dport, anchor_stack, &nr, &udp_mapping);
switch (transerror) {
default:
@@ -4971,7 +4964,7 @@ pf_test_rule(struct pf_krule **rm, struct pf_kstate **sm, struct pfi_kkif *kif,
KASSERT(nk != NULL, ("%s: null nk", __func__));
if (nr->log) {
- PFLOG_PACKET(kif, m, PF_PASS, PFRES_MATCH, nr, a,
+ PFLOG_PACKET(m, PF_PASS, PFRES_MATCH, nr, a,
ruleset, pd, 1);
}
@@ -5116,7 +5109,7 @@ pf_test_rule(struct pf_krule **rm, struct pf_kstate **sm, struct pfi_kkif *kif,
while (r != NULL) {
pf_counter_u64_add(&r->evaluations, 1);
- PF_TEST_ATTRIB(pfi_kkif_match(r->kif, kif) == r->ifnot,
+ PF_TEST_ATTRIB(pfi_kkif_match(r->kif, pd->kif) == r->ifnot,
r->skip[PF_SKIP_IFP]);
PF_TEST_ATTRIB(r->direction && r->direction != pd->dir,
r->skip[PF_SKIP_DIR]);
@@ -5125,7 +5118,7 @@ pf_test_rule(struct pf_krule **rm, struct pf_kstate **sm, struct pfi_kkif *kif,
PF_TEST_ATTRIB(r->proto && r->proto != pd->proto,
r->skip[PF_SKIP_PROTO]);
PF_TEST_ATTRIB(PF_MISMATCHAW(&r->src.addr, saddr, pd->af,
- r->src.neg, kif, M_GETFIB(m)),
+ r->src.neg, pd->kif, M_GETFIB(m)),
r->skip[PF_SKIP_SRC_ADDR]);
PF_TEST_ATTRIB(PF_MISMATCHAW(&r->dst.addr, daddr, pd->af,
r->dst.neg, NULL, M_GETFIB(m)),
@@ -5225,7 +5218,7 @@ pf_test_rule(struct pf_krule **rm, struct pf_kstate **sm, struct pfi_kkif *kif,
pf_counter_u64_critical_exit();
pf_rule_to_actions(r, &pd->act);
if (r->log || pd->act.log & PF_LOG_MATCHES)
- PFLOG_PACKET(kif, m,
+ PFLOG_PACKET(m,
r->action, PFRES_MATCH, r,
a, ruleset, pd, 1);
} else {
@@ -5234,7 +5227,7 @@ pf_test_rule(struct pf_krule **rm, struct pf_kstate **sm, struct pfi_kkif *kif,
*am = a;
*rsm = ruleset;
if (pd->act.log & PF_LOG_MATCHES)
- PFLOG_PACKET(kif, m,
+ PFLOG_PACKET(m,
r->action, PFRES_MATCH, r,
a, ruleset, pd, 1);
}
@@ -5262,7 +5255,7 @@ nextrule:
if (r->log || pd->act.log & PF_LOG_MATCHES) {
if (rewrite)
m_copyback(m, pd->off, pd->hdrlen, pd->hdr.any);
- PFLOG_PACKET(kif, m, r->action, reason, r, a, ruleset, pd, 1);
+ PFLOG_PACKET(m, r->action, reason, r, a, ruleset, pd, 1);
}
if (pd->virtual_proto != PF_VPROTO_FRAGMENT &&
@@ -5270,7 +5263,7 @@ nextrule:
((r->rule_flag & PFRULE_RETURNRST) ||
(r->rule_flag & PFRULE_RETURNICMP) ||
(r->rule_flag & PFRULE_RETURN))) {
- pf_return(r, nr, pd, sk, m, th, kif, bproto_sum,
+ pf_return(r, nr, pd, sk, m, th, bproto_sum,
bip_sum, &reason, r->rtableid);
}
@@ -5289,13 +5282,13 @@ nextrule:
(pd->flags & PFDESC_TCP_NORM)))) {
int action;
action = pf_create_state(r, nr, a, pd, nsn, nk, sk, m,
- sport, dport, &rewrite, kif, sm, tag, bproto_sum, bip_sum,
+ sport, dport, &rewrite, sm, tag, bproto_sum, bip_sum,
&match_rules, udp_mapping);
if (action != PF_PASS) {
pf_udp_mapping_release(udp_mapping);
if (action == PF_DROP &&
(r->rule_flag & PFRULE_RETURN))
- pf_return(r, nr, pd, sk, m, th, kif,
+ pf_return(r, nr, pd, sk, m, th,
bproto_sum, bip_sum, &reason,
pd->act.rtableid);
return (action);
@@ -5345,7 +5338,7 @@ static int
pf_create_state(struct pf_krule *r, struct pf_krule *nr, struct pf_krule *a,
struct pf_pdesc *pd, struct pf_ksrc_node *nsn, struct pf_state_key *nk,
struct pf_state_key *sk, struct mbuf *m, u_int16_t sport,
- u_int16_t dport, int *rewrite, struct pfi_kkif *kif, struct pf_kstate **sm,
+ u_int16_t dport, int *rewrite, struct pf_kstate **sm,
int tag, u_int16_t bproto_sum, u_int16_t bip_sum,
struct pf_krule_slist *match_rules, struct pf_udp_mapping *udp_mapping)
{
@@ -5518,7 +5511,7 @@ pf_create_state(struct pf_krule *r, struct pf_krule *nr, struct pf_krule *a,
__func__, nr, sk, nk));
/* Swap sk/nk for PF_OUT. */
- if (pf_state_insert(BOUND_IFACE(s, kif), kif,
+ if (pf_state_insert(BOUND_IFACE(s, pd->kif), pd->kif,
(pd->dir == PF_IN) ? sk : nk,
(pd->dir == PF_IN) ? nk : sk, s)) {
REASON_SET(&reason, PFRES_STATEINS);
@@ -5610,9 +5603,8 @@ drop:
}
static int
-pf_tcp_track_full(struct pf_kstate **state, struct pfi_kkif *kif,
- struct mbuf *m, struct pf_pdesc *pd, u_short *reason,
- int *copyback)
+pf_tcp_track_full(struct pf_kstate **state, struct mbuf *m,
+ struct pf_pdesc *pd, u_short *reason, int *copyback)
{
struct tcphdr *th = &pd->hdr.tcp;
struct pf_state_peer *src, *dst;
@@ -6131,9 +6123,8 @@ pf_synproxy(struct pf_pdesc *pd, struct pf_kstate **state, u_short *reason)
}
static int
-pf_test_state_tcp(struct pf_kstate **state, struct pfi_kkif *kif,
- struct mbuf *m, struct pf_pdesc *pd,
- u_short *reason)
+pf_test_state_tcp(struct pf_kstate **state, struct mbuf *m,
+ struct pf_pdesc *pd, u_short *reason)
{
struct pf_state_key_cmp key;
struct tcphdr *th = &pd->hdr.tcp;
@@ -6156,7 +6147,7 @@ pf_test_state_tcp(struct pf_kstate **state, struct pfi_kkif *kif,
key.port[0] = th->th_dport;
}
- STATE_LOOKUP(kif, &key, *state, pd);
+ STATE_LOOKUP(&key, *state, pd);
if (pd->dir == (*state)->direction) {
src = &(*state)->src;
@@ -6191,7 +6182,7 @@ pf_test_state_tcp(struct pf_kstate **state, struct pfi_kkif *kif,
if (pf_tcp_track_sloppy(state, pd, reason) == PF_DROP)
return (PF_DROP);
} else {
- if (pf_tcp_track_full(state, kif, m, pd, reason,
+ if (pf_tcp_track_full(state, m, pd, reason,
©back) == PF_DROP)
return (PF_DROP);
}
@@ -6222,8 +6213,8 @@ pf_test_state_tcp(struct pf_kstate **state, struct pfi_kkif *kif,
}
static int
-pf_test_state_udp(struct pf_kstate **state, struct pfi_kkif *kif,
- struct mbuf *m, struct pf_pdesc *pd)
+pf_test_state_udp(struct pf_kstate **state, struct mbuf *m,
+ struct pf_pdesc *pd)
{
struct pf_state_peer *src, *dst;
struct pf_state_key_cmp key;
@@ -6245,7 +6236,7 @@ pf_test_state_udp(struct pf_kstate **state, struct pfi_kkif *kif,
key.port[0] = uh->uh_dport;
}
- STATE_LOOKUP(kif, &key, *state, pd);
+ STATE_LOOKUP(&key, *state, pd);
if (pd->dir == (*state)->direction) {
src = &(*state)->src;
@@ -6294,8 +6285,8 @@ pf_test_state_udp(struct pf_kstate **state, struct pfi_kkif *kif,
}
static int
-pf_test_state_sctp(struct pf_kstate **state, struct pfi_kkif *kif,
- struct mbuf *m, struct pf_pdesc *pd, u_short *reason)
+pf_test_state_sctp(struct pf_kstate **state, struct mbuf *m,
+ struct pf_pdesc *pd, u_short *reason)
{
struct pf_state_key_cmp key;
struct pf_state_peer *src, *dst;
@@ -6317,7 +6308,7 @@ pf_test_state_sctp(struct pf_kstate **state, struct pfi_kkif *kif,
key.port[0] = sh->dest_port;
}
- STATE_LOOKUP(kif, &key, *state, pd);
+ STATE_LOOKUP(&key, *state, pd);
if (pd->dir == (*state)->direction) {
src = &(*state)->src;
@@ -6559,7 +6550,8 @@ again:
* we cannot know what interfaces it will use.
* That's why we pass V_pfi_all rather than kif.
*/
- ret = pf_test_rule(&r, &sm, V_pfi_all,
+ j->pd.kif = V_pfi_all;
+ ret = pf_test_rule(&r, &sm,
j->m, &j->pd, &ra, &rs, NULL);
PF_RULES_RUNLOCK();
SDT_PROBE4(pf, sctp, multihome, test, kif, r, j->m, ret);
@@ -6678,7 +6670,7 @@ again:
static int
pf_multihome_scan(struct mbuf *m, int start, int len, struct pf_pdesc *pd,
- struct pfi_kkif *kif, int op)
+ int op)
{
int off = 0;
struct pf_sctp_multihome_job *job;
@@ -6777,7 +6769,7 @@ pf_multihome_scan(struct mbuf *m, int start, int len, struct pf_pdesc *pd,
return (PF_DROP);
ret = pf_multihome_scan(m, start + off + sizeof(ah),
- ntohs(ah.ph.param_length) - sizeof(ah), pd, kif,
+ ntohs(ah.ph.param_length) - sizeof(ah), pd,
SCTP_ADD_IP_ADDRESS);
if (ret != PF_PASS)
return (ret);
@@ -6791,7 +6783,7 @@ pf_multihome_scan(struct mbuf *m, int start, int len, struct pf_pdesc *pd,
NULL, NULL, pd->af))
return (PF_DROP);
ret = pf_multihome_scan(m, start + off + sizeof(ah),
- ntohs(ah.ph.param_length) - sizeof(ah), pd, kif,
+ ntohs(ah.ph.param_length) - sizeof(ah), pd,
SCTP_DEL_IP_ADDRESS);
if (ret != PF_PASS)
return (ret);
@@ -6807,29 +6799,28 @@ pf_multihome_scan(struct mbuf *m, int start, int len, struct pf_pdesc *pd,
return (PF_PASS);
}
int
-pf_multihome_scan_init(struct mbuf *m, int start, int len, struct pf_pdesc *pd,
- struct pfi_kkif *kif)
+pf_multihome_scan_init(struct mbuf *m, int start, int len, struct pf_pdesc *pd)
{
start += sizeof(struct sctp_init_chunk);
len -= sizeof(struct sctp_init_chunk);
- return (pf_multihome_scan(m, start, len, pd, kif, SCTP_ADD_IP_ADDRESS));
+ return (pf_multihome_scan(m, start, len, pd, SCTP_ADD_IP_ADDRESS));
}
int
pf_multihome_scan_asconf(struct mbuf *m, int start, int len,
- struct pf_pdesc *pd, struct pfi_kkif *kif)
+ struct pf_pdesc *pd)
{
start += sizeof(struct sctp_asconf_chunk);
len -= sizeof(struct sctp_asconf_chunk);
- return (pf_multihome_scan(m, start, len, pd, kif, SCTP_ADD_IP_ADDRESS));
+ return (pf_multihome_scan(m, start, len, pd, SCTP_ADD_IP_ADDRESS));
}
int
pf_icmp_state_lookup(struct pf_state_key_cmp *key, struct pf_pdesc *pd,
struct pf_kstate **state, struct mbuf *m, int direction,
- struct pfi_kkif *kif, u_int16_t icmpid, u_int16_t type, int icmp_dir,
+ u_int16_t icmpid, u_int16_t type, int icmp_dir,
int *iidx, int multi, int inner)
{
key->af = pd->af;
@@ -6847,7 +6838,7 @@ pf_icmp_state_lookup(struct pf_state_key_cmp *key, struct pf_pdesc *pd,
pd->didx, pd->dst, multi))
return (PF_DROP);
- STATE_LOOKUP(kif, key, *state, pd);
+ STATE_LOOKUP(key, *state, pd);
if ((*state)->state_flags & PFSTATE_SLOPPY)
return (-1);
@@ -6871,8 +6862,8 @@ pf_icmp_state_lookup(struct pf_state_key_cmp *key, struct pf_pdesc *pd,
}
static int
-pf_test_state_icmp(struct pf_kstate **state, struct pfi_kkif *kif,
- struct mbuf *m, struct pf_pdesc *pd, u_short *reason)
+pf_test_state_icmp(struct pf_kstate **state, struct mbuf *m,
+ struct pf_pdesc *pd, u_short *reason)
{
struct pf_addr *saddr = pd->src, *daddr = pd->dst;
u_int16_t *icmpsum, virtual_id, virtual_type;
@@ -6914,14 +6905,14 @@ pf_test_state_icmp(struct pf_kstate **state, struct pfi_kkif *kif,
* Search for an ICMP state.
*/
ret = pf_icmp_state_lookup(&key, pd, state, m, pd->dir,
- kif, virtual_id, virtual_type, icmp_dir, &iidx,
+ virtual_id, virtual_type, icmp_dir, &iidx,
PF_ICMP_MULTI_NONE, 0);
if (ret >= 0) {
MPASS(*state == NULL);
if (ret == PF_DROP && pd->af == AF_INET6 &&
icmp_dir == PF_OUT) {
ret = pf_icmp_state_lookup(&key, pd, state, m,
- pd->dir, kif, virtual_id, virtual_type,
+ pd->dir, virtual_id, virtual_type,
icmp_dir, &iidx, multi, 0);
if (ret >= 0) {
MPASS(*state == NULL);
@@ -7112,7 +7103,7 @@ pf_test_state_icmp(struct pf_kstate **state, struct pfi_kkif *kif,
key.port[pd2.sidx] = th.th_sport;
key.port[pd2.didx] = th.th_dport;
- STATE_LOOKUP(kif, &key, *state, pd);
+ STATE_LOOKUP(&key, *state, pd);
if (pd->dir == (*state)->direction) {
src = &(*state)->dst;
@@ -7233,7 +7224,7 @@ pf_test_state_icmp(struct pf_kstate **state, struct pfi_kkif *kif,
key.port[pd2.sidx] = uh.uh_sport;
key.port[pd2.didx] = uh.uh_dport;
- STATE_LOOKUP(kif, &key, *state, pd);
+ STATE_LOOKUP(&key, *state, pd);
/* translate source/destination address, if necessary */
if ((*state)->key[PF_SK_WIRE] !=
@@ -7304,7 +7295,7 @@ pf_test_state_icmp(struct pf_kstate **state, struct pfi_kkif *kif,
&icmp_dir, &multi, &virtual_id, &virtual_type);
ret = pf_icmp_state_lookup(&key, &pd2, state, m,
- pd2.dir, kif, virtual_id, virtual_type,
+ pd2.dir, virtual_id, virtual_type,
icmp_dir, &iidx, PF_ICMP_MULTI_NONE, 1);
if (ret >= 0) {
MPASS(*state == NULL);
@@ -7366,14 +7357,14 @@ pf_test_state_icmp(struct pf_kstate **state, struct pfi_kkif *kif,
&icmp_dir, &multi, &virtual_id, &virtual_type);
ret = pf_icmp_state_lookup(&key, &pd2, state, m,
- pd->dir, kif, virtual_id, virtual_type,
+ pd->dir, virtual_id, virtual_type,
icmp_dir, &iidx, PF_ICMP_MULTI_NONE, 1);
if (ret >= 0) {
MPASS(*state == NULL);
if (ret == PF_DROP && pd2.af == AF_INET6 &&
icmp_dir == PF_OUT) {
ret = pf_icmp_state_lookup(&key, &pd2,
- state, m, pd->dir, kif,
+ state, m, pd->dir,
virtual_id, virtual_type,
icmp_dir, &iidx, multi, 1);
if (ret >= 0) {
@@ -7427,7 +7418,7 @@ pf_test_state_icmp(struct pf_kstate **state, struct pfi_kkif *kif,
PF_ACPY(&key.addr[pd2.didx], pd2.dst, key.af);
key.port[0] = key.port[1] = 0;
- STATE_LOOKUP(kif, &key, *state, pd);
+ STATE_LOOKUP(&key, *state, pd);
/* translate source/destination address, if necessary */
if ((*state)->key[PF_SK_WIRE] !=
@@ -7476,8 +7467,8 @@ pf_test_state_icmp(struct pf_kstate **state, struct pfi_kkif *kif,
}
static int
-pf_test_state_other(struct pf_kstate **state, struct pfi_kkif *kif,
- struct mbuf *m, struct pf_pdesc *pd)
+pf_test_state_other(struct pf_kstate **state, struct mbuf *m,
+ struct pf_pdesc *pd)
{
struct pf_state_peer *src, *dst;
struct pf_state_key_cmp key;
@@ -7496,7 +7487,7 @@ pf_test_state_other(struct pf_kstate **state, struct pfi_kkif *kif,
key.port[1] = key.port[0] = 0;
}
- STATE_LOOKUP(kif, &key, *state, pd);
+ STATE_LOOKUP(&key, *state, pd);
if (pd->dir == (*state)->direction) {
src = &(*state)->src;
@@ -8614,6 +8605,7 @@ pf_setup_pdesc(sa_family_t af, int dir, struct pf_pdesc *pd, struct mbuf **m0,
pd->af = af;
pd->dir = dir;
+ pd->kif = kif;
pd->sidx = (dir == PF_IN) ? 0 : 1;
pd->didx = (dir == PF_IN) ? 1 : 0;
@@ -8640,7 +8632,7 @@ pf_setup_pdesc(sa_family_t af, int dir, struct pf_pdesc *pd, struct mbuf **m0,
return (-1);
}
- if (pf_normalize_ip(m0, kif, reason, pd) != PF_PASS) {
+ if (pf_normalize_ip(m0, reason, pd) != PF_PASS) {
/* We do IP header normalization and packet reassembly here */
*action = PF_DROP;
return (-1);
@@ -8722,7 +8714,7 @@ pf_setup_pdesc(sa_family_t af, int dir, struct pf_pdesc *pd, struct mbuf **m0,
}
/* We do IP header normalization and packet reassembly here */
- if (pf_normalize_ip6(m0, kif, fragoff, reason, pd) !=
+ if (pf_normalize_ip6(m0, fragoff, reason, pd) !=
PF_PASS) {
*action = PF_DROP;
return (-1);
@@ -8815,7 +8807,7 @@ pf_setup_pdesc(sa_family_t af, int dir, struct pf_pdesc *pd, struct mbuf **m0,
REASON_SET(reason, PFRES_SHORT);
return (-1);
}
- if (pf_scan_sctp(m, pd->off, pd, kif) != PF_PASS) {
+ if (pf_scan_sctp(m, pd) != PF_PASS) {
*action = PF_DROP;
REASON_SET(reason, PFRES_SHORT);
return (-1);
@@ -8870,8 +8862,7 @@ pf_setup_pdesc(sa_family_t af, int dir, struct pf_pdesc *pd, struct mbuf **m0,
static void
pf_counters_inc(int action, struct pf_pdesc *pd,
- struct pfi_kkif *kif, struct pf_kstate *s,
- struct pf_krule *r, struct pf_krule *a)
+ struct pf_kstate *s, struct pf_krule *r, struct pf_krule *a)
{
struct pf_krule *tr;
int dir = pd->dir;
@@ -8879,10 +8870,10 @@ pf_counters_inc(int action, struct pf_pdesc *pd,
pf_counter_u64_critical_enter();
pf_counter_u64_add_protected(
- &kif->pfik_bytes[pd->af == AF_INET6][dir == PF_OUT][action != PF_PASS],
+ &pd->kif->pfik_bytes[pd->af == AF_INET6][dir == PF_OUT][action != PF_PASS],
pd->tot_len);
pf_counter_u64_add_protected(
- &kif->pfik_packets[pd->af == AF_INET6][dir == PF_OUT][action != PF_PASS],
+ &pd->kif->pfik_packets[pd->af == AF_INET6][dir == PF_OUT][action != PF_PASS],
1);
if (action == PF_PASS || r->action == PF_DROP) {
@@ -9087,7 +9078,7 @@ pf_test(sa_family_t af, int dir, int pflags, struct ifnet *ifp, struct mbuf **m0
if (kif == NULL || r == NULL) /* pflog */
action = PF_DROP;
else
- action = pf_test_rule(&r, &s, kif, m, &pd, &a,
+ action = pf_test_rule(&r, &s, m, &pd, &a,
&ruleset, inp);
if (action != PF_PASS)
REASON_SET(&reason, PFRES_FRAG);
@@ -9104,10 +9095,10 @@ pf_test(sa_family_t af, int dir, int pflags, struct ifnet *ifp, struct mbuf **m0
if ((pd.hdr.tcp.th_flags & TH_ACK) && pd.p_len == 0)
use_2nd_queue = 1;
- action = pf_normalize_tcp(kif, m, &pd);
+ action = pf_normalize_tcp(m, &pd);
if (action == PF_DROP)
goto done;
- action = pf_test_state_tcp(&s, kif, m, &pd, &reason);
+ action = pf_test_state_tcp(&s, m, &pd, &reason);
if (action == PF_PASS) {
if (V_pfsync_update_state_ptr != NULL)
V_pfsync_update_state_ptr(s);
@@ -9133,7 +9124,7 @@ pf_test(sa_family_t af, int dir, int pflags, struct ifnet *ifp, struct mbuf **m0
if (action != PF_PASS)
break;
- action = pf_test_state_tcp(&s, kif, m,
+ action = pf_test_state_tcp(&s, m,
&pd, &reason);
if (action != PF_PASS || s == NULL) {
action = PF_DROP;
@@ -9146,7 +9137,7 @@ pf_test(sa_family_t af, int dir, int pflags, struct ifnet *ifp, struct mbuf **m0
action = pf_synproxy(&pd, &s, &reason);
break;
} else {
- action = pf_test_rule(&r, &s, kif, m, &pd,
+ action = pf_test_rule(&r, &s, m, &pd,
&a, &ruleset, inp);
}
}
@@ -9154,30 +9145,30 @@ pf_test(sa_family_t af, int dir, int pflags, struct ifnet *ifp, struct mbuf **m0
}
case IPPROTO_UDP: {
- action = pf_test_state_udp(&s, kif, m, &pd);
+ action = pf_test_state_udp(&s, m, &pd);
if (action == PF_PASS) {
if (V_pfsync_update_state_ptr != NULL)
V_pfsync_update_state_ptr(s);
r = s->rule;
a = s->anchor;
} else if (s == NULL)
- action = pf_test_rule(&r, &s, kif, m, &pd,
+ action = pf_test_rule(&r, &s, m, &pd,
&a, &ruleset, inp);
break;
}
case IPPROTO_SCTP: {
- action = pf_normalize_sctp(kif, m, &pd);
+ action = pf_normalize_sctp(m, &pd);
if (action == PF_DROP)
goto done;
- action = pf_test_state_sctp(&s, kif, m, &pd, &reason);
+ action = pf_test_state_sctp(&s, m, &pd, &reason);
if (action == PF_PASS) {
if (V_pfsync_update_state_ptr != NULL)
V_pfsync_update_state_ptr(s);
r = s->rule;
a = s->anchor;
} else if (s == NULL) {
- action = pf_test_rule(&r, &s, kif, m,
+ action = pf_test_rule(&r, &s, m,
&pd, &a, &ruleset, inp);
}
break;
@@ -9191,14 +9182,14 @@ pf_test(sa_family_t af, int dir, int pflags, struct ifnet *ifp, struct mbuf **m0
("dropping IPv6 packet with ICMPv4 payload"));
goto done;
}
- action = pf_test_state_icmp(&s, kif, m, &pd, &reason);
+ action = pf_test_state_icmp(&s, m, &pd, &reason);
if (action == PF_PASS) {
if (V_pfsync_update_state_ptr != NULL)
V_pfsync_update_state_ptr(s);
r = s->rule;
a = s->anchor;
} else if (s == NULL)
- action = pf_test_rule(&r, &s, kif, m, &pd,
+ action = pf_test_rule(&r, &s, m, &pd,
&a, &ruleset, inp);
break;
}
@@ -9211,27 +9202,27 @@ pf_test(sa_family_t af, int dir, int pflags, struct ifnet *ifp, struct mbuf **m0
("pf: dropping IPv4 packet with ICMPv6 payload\n"));
goto done;
}
- action = pf_test_state_icmp(&s, kif, m, &pd, &reason);
+ action = pf_test_state_icmp(&s, m, &pd, &reason);
if (action == PF_PASS) {
if (V_pfsync_update_state_ptr != NULL)
V_pfsync_update_state_ptr(s);
r = s->rule;
a = s->anchor;
} else if (s == NULL)
- action = pf_test_rule(&r, &s, kif, m, &pd,
+ action = pf_test_rule(&r, &s, m, &pd,
&a, &ruleset, inp);
break;
}
default:
- action = pf_test_state_other(&s, kif, m, &pd);
+ action = pf_test_state_other(&s, m, &pd);
if (action == PF_PASS) {
if (V_pfsync_update_state_ptr != NULL)
V_pfsync_update_state_ptr(s);
r = s->rule;
a = s->anchor;
} else if (s == NULL)
- action = pf_test_rule(&r, &s, kif, m, &pd,
+ action = pf_test_rule(&r, &s, m, &pd,
&a, &ruleset, inp);
break;
}
@@ -9379,17 +9370,17 @@ done:
lr = r;
if (pd.act.log & PF_LOG_FORCE || lr->log & PF_LOG_ALL)
- PFLOG_PACKET(kif, m, action, reason, lr, a,
+ PFLOG_PACKET(m, action, reason, lr, a,
ruleset, &pd, (s == NULL));
if (s) {
SLIST_FOREACH(ri, &s->match_rules, entry)
if (ri->r->log & PF_LOG_ALL)
- PFLOG_PACKET(kif, m, action,
+ PFLOG_PACKET(m, action,
reason, ri->r, a, ruleset, &pd, 0);
}
}
- pf_counters_inc(action, &pd, kif, s, r, a);
+ pf_counters_inc(action, &pd, s, r, a);
switch (action) {
case PF_SYNPROXY_DROP:
diff --git a/sys/netpfil/pf/pf_lb.c b/sys/netpfil/pf/pf_lb.c
index 227d68f54702..76a7b7f8005f 100644
--- a/sys/netpfil/pf/pf_lb.c
+++ b/sys/netpfil/pf/pf_lb.c
@@ -64,7 +64,7 @@ VNET_DEFINE_STATIC(int, pf_rdr_srcport_rewrite_tries) = 16;
static void pf_hash(struct pf_addr *, struct pf_addr *,
struct pf_poolhashkey *, sa_family_t);
static struct pf_krule *pf_match_translation(struct pf_pdesc *, struct mbuf *,
- struct pfi_kkif *, struct pf_addr *, u_int16_t,
+ struct pf_addr *, u_int16_t,
struct pf_addr *, uint16_t, int,
struct pf_kanchor_stackframe *);
static int pf_get_sport(sa_family_t, uint8_t, struct pf_krule *,
@@ -132,7 +132,7 @@ pf_hash(struct pf_addr *inaddr, struct pf_addr *hash,
static struct pf_krule *
pf_match_translation(struct pf_pdesc *pd, struct mbuf *m,
- struct pfi_kkif *kif, struct pf_addr *saddr, u_int16_t sport,
+ struct pf_addr *saddr, u_int16_t sport,
struct pf_addr *daddr, uint16_t dport, int rs_num,
struct pf_kanchor_stackframe *anchor_stack)
{
@@ -157,7 +157,7 @@ pf_match_translation(struct pf_pdesc *pd, struct mbuf *m,
}
pf_counter_u64_add(&r->evaluations, 1);
- if (pfi_kkif_match(r->kif, kif) == r->ifnot)
+ if (pfi_kkif_match(r->kif, pd->kif) == r->ifnot)
r = r->skip[PF_SKIP_IFP];
else if (r->direction && r->direction != pd->dir)
r = r->skip[PF_SKIP_DIR];
@@ -166,7 +166,7 @@ pf_match_translation(struct pf_pdesc *pd, struct mbuf *m,
else if (r->proto && r->proto != pd->proto)
r = r->skip[PF_SKIP_PROTO];
else if (PF_MISMATCHAW(&src->addr, saddr, pd->af,
- src->neg, kif, M_GETFIB(m)))
+ src->neg, pd->kif, M_GETFIB(m)))
r = r->skip[src == &r->src ? PF_SKIP_SRC_ADDR :
PF_SKIP_DST_ADDR];
else if (src->port_op && !pf_match_port(src->port_op,
@@ -697,9 +697,8 @@ done:
u_short
pf_get_translation(struct pf_pdesc *pd, struct mbuf *m, int off,
- struct pfi_kkif *kif, struct pf_ksrc_node **sn,
- struct pf_state_key **skp, struct pf_state_key **nkp,
- struct pf_addr *saddr, struct pf_addr *daddr,
+ struct pf_ksrc_node **sn, struct pf_state_key **skp,
+ struct pf_state_key **nkp, struct pf_addr *saddr, struct pf_addr *daddr,
uint16_t sport, uint16_t dport, struct pf_kanchor_stackframe *anchor_stack,
struct pf_krule **rp,
struct pf_udp_mapping **udp_mapping)
@@ -717,17 +716,17 @@ pf_get_translation(struct pf_pdesc *pd, struct mbuf *m, int off,
*rp = NULL;
if (pd->dir == PF_OUT) {
- r = pf_match_translation(pd, m, kif, saddr,
+ r = pf_match_translation(pd, m, saddr,
sport, daddr, dport, PF_RULESET_BINAT, anchor_stack);
if (r == NULL)
- r = pf_match_translation(pd, m, kif,
+ r = pf_match_translation(pd, m,
saddr, sport, daddr, dport, PF_RULESET_NAT,
anchor_stack);
} else {
- r = pf_match_translation(pd, m, kif, saddr,
+ r = pf_match_translation(pd, m, saddr,
sport, daddr, dport, PF_RULESET_RDR, anchor_stack);
if (r == NULL)
- r = pf_match_translation(pd, m, kif,
+ r = pf_match_translation(pd, m,
saddr, sport, daddr, dport, PF_RULESET_BINAT,
anchor_stack);
}
diff --git a/sys/netpfil/pf/pf_norm.c b/sys/netpfil/pf/pf_norm.c
index 9eaa20587294..19206d83a732 100644
--- a/sys/netpfil/pf/pf_norm.c
+++ b/sys/netpfil/pf/pf_norm.c
@@ -1047,7 +1047,7 @@ pf_refragment6(struct ifnet *ifp, struct mbuf **m0, struct m_tag *mtag,
#ifdef INET
int
-pf_normalize_ip(struct mbuf **m0, struct pfi_kkif *kif, u_short *reason,
+pf_normalize_ip(struct mbuf **m0, u_short *reason,
struct pf_pdesc *pd)
{
struct mbuf *m = *m0;
@@ -1078,7 +1078,7 @@ pf_normalize_ip(struct mbuf **m0, struct pfi_kkif *kif, u_short *reason,
scrub_compat = (r != NULL);
while (r != NULL) {
pf_counter_u64_add(&r->evaluations, 1);
- if (pfi_kkif_match(r->kif, kif) == r->ifnot)
+ if (pfi_kkif_match(r->kif, pd->kif) == r->ifnot)
r = r->skip[PF_SKIP_IFP];
else if (r->direction && r->direction != pd->dir)
r = r->skip[PF_SKIP_DIR];
@@ -1088,7 +1088,7 @@ pf_normalize_ip(struct mbuf **m0, struct pfi_kkif *kif, u_short *reason,
r = r->skip[PF_SKIP_PROTO];
else if (PF_MISMATCHAW(&r->src.addr,
(struct pf_addr *)&h->ip_src.s_addr, AF_INET,
- r->src.neg, kif, M_GETFIB(m)))
+ r->src.neg, pd->kif, M_GETFIB(m)))
r = r->skip[PF_SKIP_SRC_ADDR];
else if (PF_MISMATCHAW(&r->dst.addr,
(struct pf_addr *)&h->ip_dst.s_addr, AF_INET,
@@ -1201,7 +1201,7 @@ pf_normalize_ip(struct mbuf **m0, struct pfi_kkif *kif, u_short *reason,
REASON_SET(reason, PFRES_FRAG);
drop:
if (r != NULL && r->log)
- PFLOG_PACKET(kif, m, PF_DROP, *reason, r, NULL, NULL, pd, 1);
+ PFLOG_PACKET(m, PF_DROP, *reason, r, NULL, NULL, pd, 1);
return (PF_DROP);
}
@@ -1209,8 +1209,8 @@ pf_normalize_ip(struct mbuf **m0, struct pfi_kkif *kif, u_short *reason,
#ifdef INET6
int
-pf_normalize_ip6(struct mbuf **m0, struct pfi_kkif *kif,
- int off, u_short *reason, struct pf_pdesc *pd)
+pf_normalize_ip6(struct mbuf **m0, int off, u_short *reason,
+ struct pf_pdesc *pd)
{
struct mbuf *m;
struct pf_krule *r;
@@ -1233,7 +1233,7 @@ pf_normalize_ip6(struct mbuf **m0, struct pfi_kkif *kif,
scrub_compat = (r != NULL);
while (r != NULL) {
pf_counter_u64_add(&r->evaluations, 1);
- if (pfi_kkif_match(r->kif, kif) == r->ifnot)
+ if (pfi_kkif_match(r->kif, pd->kif) == r->ifnot)
r = r->skip[PF_SKIP_IFP];
else if (r->direction && r->direction != pd->dir)
r = r->skip[PF_SKIP_DIR];
@@ -1243,7 +1243,7 @@ pf_normalize_ip6(struct mbuf **m0, struct pfi_kkif *kif,
r = r->skip[PF_SKIP_PROTO];
else if (PF_MISMATCHAW(&r->src.addr,
(struct pf_addr *)&pd->src, AF_INET6,
- r->src.neg, kif, M_GETFIB(m)))
+ r->src.neg, pd->kif, M_GETFIB(m)))
r = r->skip[PF_SKIP_SRC_ADDR];
else if (PF_MISMATCHAW(&r->dst.addr,
(struct pf_addr *)&pd->dst, AF_INET6,
@@ -1287,7 +1287,7 @@ pf_normalize_ip6(struct mbuf **m0, struct pfi_kkif *kif,
#endif /* INET6 */
int
*** 129 LINES SKIPPED ***