Put kif and dir into pdesc an use this instead of passing the values

around.  This is a mechanical change.  Initialize pd2 and use it
where appropriate.
ok henning on an earlier version; ok mpf

1 files changed, 120 insertions, 128 deletions

diff --git a/sys/net/pf.c b/sys/net/pf.c
index 10cdf7956f9..c48ad99c6de 100644
--- a/sys/net/pf.c
+++ b/sys/net/pf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pf.c,v 1.777 2011/09/19 12:51:52 bluhm Exp $ */
+/*	$OpenBSD: pf.c,v 1.778 2011/09/20 10:51:18 bluhm Exp $ */
 
 /*
  * Copyright (c) 2001 Daniel Hartmeier
@@ -178,39 +178,34 @@ u_int32_t		 pf_tcp_iss(struct pf_pdesc *);
 void			 pf_rule_to_actions(struct pf_rule *,
 			    struct pf_rule_actions *);
 int			 pf_test_rule(struct pf_rule **, struct pf_state **,
-			    int, struct pfi_kif *, struct mbuf *,
-			    struct pf_pdesc *, struct pf_rule **,
+			    struct mbuf *, struct pf_pdesc *, struct pf_rule **,
 			    struct pf_ruleset **);
 static __inline int	 pf_create_state(struct pf_rule *, struct pf_rule *,
 			    struct pf_rule *, struct pf_pdesc *,
 			    struct pf_state_key **, struct pf_state_key **,
-			    struct mbuf *, int *, struct pfi_kif *,
-			    struct pf_state **, int, struct pf_rule_slist *,
-			    struct pf_rule_actions *, struct pf_src_node *[]);
+			    struct mbuf *, int *, struct pf_state **, int,
+			    struct pf_rule_slist *, struct pf_rule_actions *,
+			    struct pf_src_node *[]);
 int			 pf_state_key_setup(struct pf_pdesc *, struct
 			    pf_state_key **, struct pf_state_key **, int);
 int			 pf_tcp_track_full(struct pf_state_peer *,
 			    struct pf_state_peer *, struct pf_state **,
-			    struct pfi_kif *, struct mbuf *,
-			    struct pf_pdesc *, u_short *, int *);
+			    struct mbuf *, struct pf_pdesc *, u_short *, int *);
 int			 pf_tcp_track_sloppy(struct pf_state_peer *,
 			    struct pf_state_peer *, struct pf_state **,
 			    struct pf_pdesc *, u_short *);
-int			 pf_test_state_tcp(struct pf_state **, int,
-			    struct pfi_kif *, struct mbuf *,
+int			 pf_test_state_tcp(struct pf_state **, struct mbuf *,
 			    struct pf_pdesc *, u_short *);
-int			 pf_test_state_udp(struct pf_state **, int,
-			    struct pfi_kif *, struct mbuf *,
+int			 pf_test_state_udp(struct pf_state **, struct mbuf *,
 			    struct pf_pdesc *);
 int			 pf_icmp_state_lookup(struct pf_state_key_cmp *,
 			    struct pf_pdesc *, struct pf_state **,
-			    struct mbuf *, int, struct pfi_kif *, u_int16_t,
-			    u_int16_t, int, int *, int, int);
-int			 pf_test_state_icmp(struct pf_state **, int,
-			    struct pfi_kif *, struct mbuf *,
+			    struct mbuf *, u_int16_t, u_int16_t, int, int *,
+			    int, int);
+int			 pf_test_state_icmp(struct pf_state **, struct mbuf *,
 			    struct pf_pdesc *, u_short *);
-int			 pf_test_state_other(struct pf_state **, int,
-			    struct pfi_kif *, struct mbuf *, struct pf_pdesc *);
+int			 pf_test_state_other(struct pf_state **, struct mbuf *,
+			    struct pf_pdesc *);
 void			 pf_route(struct mbuf **, struct pf_rule *, int,
 			    struct ifnet *, struct pf_state *);
 void			 pf_route6(struct mbuf **, struct pf_rule *, int,
@@ -239,8 +234,7 @@ struct pf_state		*pf_find_state(struct pfi_kif *,
 int			 pf_src_connlimit(struct pf_state **);
 int			 pf_check_congestion(struct ifqueue *);
 int			 pf_match_rcvif(struct mbuf *, struct pf_rule *);
-void			 pf_counters_inc(int, int,
-			    struct pf_pdesc *, struct pfi_kif *,
+void			 pf_counters_inc(int, struct pf_pdesc *,
 			    struct pf_state *, struct pf_rule *,
 			    struct pf_rule *);
 
@@ -2432,7 +2426,7 @@ pf_addr_inc(struct pf_addr *addr, sa_family_t af)
 #endif /* INET6 */
 
 int
-pf_socket_lookup(int direction, struct pf_pdesc *pd)
+pf_socket_lookup(struct pf_pdesc *pd)
 {
 	struct pf_addr		*saddr, *daddr;
 	u_int16_t		 sport, dport;
@@ -2462,7 +2456,7 @@ pf_socket_lookup(int direction, struct pf_pdesc *pd)
 	default:
 		return (-1);
 	}
-	if (direction == PF_IN) {
+	if (pd->dir == PF_IN) {
 		saddr = pd->src;
 		daddr = pd->dst;
 	} else {
@@ -2738,9 +2732,8 @@ pf_rule_to_actions(struct pf_rule *r, struct pf_rule_actions *a)
 	} while (0)
 
 int
-pf_test_rule(struct pf_rule **rm, struct pf_state **sm, int direction,
-    struct pfi_kif *kif, struct mbuf *m, struct pf_pdesc *pd,
-    struct pf_rule **am, struct pf_ruleset **rsm)
+pf_test_rule(struct pf_rule **rm, struct pf_state **sm, struct mbuf *m,
+    struct pf_pdesc *pd, struct pf_rule **am, struct pf_ruleset **rsm)
 {
 	struct pf_rule		*lastr = NULL;
 	struct pf_rule		*r;
@@ -2774,7 +2767,7 @@ pf_test_rule(struct pf_rule **rm, struct pf_state **sm, int direction,
 		ifq = &ip6intrq;
 #endif
 
-	if (direction == PF_IN && pf_check_congestion(ifq)) {
+	if (pd->dir == PF_IN && pf_check_congestion(ifq)) {
 		REASON_SET(&reason, PFRES_CONGEST);
 		return (PF_DROP);
 	}
@@ -2818,9 +2811,9 @@ pf_test_rule(struct pf_rule **rm, struct pf_state **sm, int direction,
 	r = TAILQ_FIRST(pf_main_ruleset.rules.active.ptr);
 	while (r != NULL) {
 		r->evaluations++;
-		PF_TEST_ATTRIB((pfi_kif_match(r->kif, kif) == r->ifnot),
+		PF_TEST_ATTRIB((pfi_kif_match(r->kif, pd->kif) == r->ifnot),
 			r->skip[PF_SKIP_IFP].ptr);
-		PF_TEST_ATTRIB((r->direction && r->direction != direction),
+		PF_TEST_ATTRIB((r->direction && r->direction != pd->dir),
 			r->skip[PF_SKIP_DIR].ptr);
 		PF_TEST_ATTRIB((r->onrdomain >= 0  &&
 		    (r->onrdomain == pd->rdomain) == r->ifnot),
@@ -2830,7 +2823,7 @@ pf_test_rule(struct pf_rule **rm, struct pf_state **sm, int direction,
 		PF_TEST_ATTRIB((r->proto && r->proto != pd->proto),
 			r->skip[PF_SKIP_PROTO].ptr);
 		PF_TEST_ATTRIB((PF_MISMATCHAW(&r->src.addr, &pd->nsaddr, pd->af,
-		    r->src.neg, kif, act.rtableid)),
+		    r->src.neg, pd->kif, act.rtableid)),
 			r->skip[PF_SKIP_SRC_ADDR].ptr);
 		PF_TEST_ATTRIB((PF_MISMATCHAW(&r->dst.addr, &pd->ndaddr, pd->af,
 		    r->dst.neg, NULL, act.rtableid)),
@@ -2873,14 +2866,14 @@ pf_test_rule(struct pf_rule **rm, struct pf_state **sm, int direction,
 			/* tcp/udp only. uid.op always 0 in other cases */
 			PF_TEST_ATTRIB((r->uid.op && (pd->lookup.done ||
 			    (pd->lookup.done =
-			    pf_socket_lookup(direction, pd), 1)) &&
+			    pf_socket_lookup(pd), 1)) &&
 			    !pf_match_uid(r->uid.op, r->uid.uid[0],
 			    r->uid.uid[1], pd->lookup.uid)),
 				TAILQ_NEXT(r, entries));
 			/* tcp/udp only. gid.op always 0 in other cases */
 			PF_TEST_ATTRIB((r->gid.op && (pd->lookup.done ||
 			    (pd->lookup.done =
-			    pf_socket_lookup(direction, pd), 1)) &&
+			    pf_socket_lookup(pd), 1)) &&
 			    !pf_match_gid(r->gid.op, r->gid.gid[0],
 			    r->gid.gid[1], pd->lookup.gid)),
 				TAILQ_NEXT(r, entries));
@@ -2933,16 +2926,16 @@ pf_test_rule(struct pf_rule **rm, struct pf_state **sm, int direction,
 					goto cleanup;
 				}
 				if (r->log || act.log & PF_LOG_MATCHES)
-					PFLOG_PACKET(kif, m, direction,
-					    reason, r, a, ruleset, pd);
+					PFLOG_PACKET(m, reason, r, a, ruleset,
+					    pd);
 			} else {
 				match = 1;
 				*rm = r;
 				*am = a;
 				*rsm = ruleset;
 				if (act.log & PF_LOG_MATCHES)
-					PFLOG_PACKET(kif, m, direction,
-					    reason, r, a, ruleset, pd);
+					PFLOG_PACKET(m, reason, r, a, ruleset,
+					    pd);
 			}
 
 			if ((*rm)->quick)
@@ -2970,7 +2963,7 @@ pf_test_rule(struct pf_rule **rm, struct pf_state **sm, int direction,
 	REASON_SET(&reason, PFRES_MATCH);
 
 	if (r->log || act.log & PF_LOG_MATCHES)
-		PFLOG_PACKET(kif, m, direction, reason, r, a, ruleset, pd);
+		PFLOG_PACKET(m, reason, r, a, ruleset, pd);
 
 	if (pd->virtual_proto != PF_VPROTO_FRAGMENT &&
 	    (r->action == PF_DROP) &&
@@ -2995,7 +2988,7 @@ pf_test_rule(struct pf_rule **rm, struct pf_state **sm, int direction,
 				    pd->src, th->th_dport, th->th_sport,
 				    ntohl(th->th_ack), ack, TH_RST|TH_ACK, 0, 0,
 				    r->return_ttl, 1, 0, pd->rdomain,
-				    pd->eh, kif->pfik_ifp);
+				    pd->eh, pd->kif->pfik_ifp);
 			}
 		} else if ((pd->proto != IPPROTO_ICMP ||
 		    ICMP_INFOTYPE(icmptype)) && pd->af == AF_INET &&
@@ -3037,8 +3030,8 @@ pf_test_rule(struct pf_rule **rm, struct pf_state **sm, int direction,
 			goto cleanup;
 		}
 
-		action = pf_create_state(r, a, nr, pd, &skw, &sks, m,
-		    &rewrite, kif, sm, tag, &rules, &act, sns);
+		action = pf_create_state(r, a, nr, pd, &skw, &sks, m, &rewrite,
+		    sm, tag, &rules, &act, sns);
 
 		if (action != PF_PASS)
 			return (action);
@@ -3067,7 +3060,7 @@ pf_test_rule(struct pf_rule **rm, struct pf_state **sm, int direction,
 
 #if NPFSYNC > 0
 	if (*sm != NULL && !ISSET((*sm)->state_flags, PFSTATE_NOSYNC) &&
-	    direction == PF_OUT && pfsync_up()) {
+	    pd->dir == PF_OUT && pfsync_up()) {
 		/*
 		 * We want the state created, but we dont
 		 * want to send this in case a partner
@@ -3096,9 +3089,9 @@ cleanup:
 static __inline int
 pf_create_state(struct pf_rule *r, struct pf_rule *a, struct pf_rule *nr,
     struct pf_pdesc *pd, struct pf_state_key **skw, struct pf_state_key **sks,
-    struct mbuf *m, int *rewrite, struct pfi_kif *kif,
-    struct pf_state **sm, int tag, struct pf_rule_slist *rules,
-    struct pf_rule_actions *act, struct pf_src_node *sns[PF_SN_MAX])
+    struct mbuf *m, int *rewrite, struct pf_state **sm, int tag,
+    struct pf_rule_slist *rules, struct pf_rule_actions *act,
+    struct pf_src_node *sns[PF_SN_MAX])
 {
 	struct pf_state		*s = NULL;
 	struct tcphdr		*th = pd->hdr.tcp;
@@ -3218,7 +3211,7 @@ pf_create_state(struct pf_rule *r, struct pf_rule *a, struct pf_rule *nr,
 		goto csfailed;
 	}
 
-	if (pf_state_insert(BOUND_IFACE(r, kif), *skw, *sks, s)) {
+	if (pf_state_insert(BOUND_IFACE(r, pd->kif), *skw, *sks, s)) {
 		pf_state_key_detach(s, PF_SK_STACK);
 		pf_state_key_detach(s, PF_SK_WIRE);
 		*sks = *skw = NULL;
@@ -3412,8 +3405,8 @@ pf_translate(struct pf_pdesc *pd, struct pf_addr *saddr, u_int16_t sport,
 
 int
 pf_tcp_track_full(struct pf_state_peer *src, struct pf_state_peer *dst,
-	struct pf_state **state, struct pfi_kif *kif, struct mbuf *m,
-	struct pf_pdesc *pd, u_short *reason, int *copyback)
+    struct pf_state **state, struct mbuf *m, struct pf_pdesc *pd,
+    u_short *reason, int *copyback)
 {
 	struct tcphdr		*th = pd->hdr.tcp;
 	u_int16_t		 win = ntohs(th->th_win);
@@ -3702,7 +3695,7 @@ pf_tcp_track_full(struct pf_state_peer *src, struct pf_state_peer *dst,
 				    th->th_sport, ntohl(th->th_ack), 0,
 				    TH_RST, 0, 0,
 				    (*state)->rule.ptr->return_ttl, 1, 0,
-				    pd->rdomain, pd->eh, kif->pfik_ifp);
+				    pd->rdomain, pd->eh, pd->kif->pfik_ifp);
 			src->seqlo = 0;
 			src->seqhi = 1;
 			src->max_win = 1;
@@ -3804,8 +3797,8 @@ pf_tcp_track_sloppy(struct pf_state_peer *src, struct pf_state_peer *dst,
 }
 
 int
-pf_test_state_tcp(struct pf_state **state, int direction, struct pfi_kif *kif,
-    struct mbuf *m, struct pf_pdesc *pd, u_short *reason)
+pf_test_state_tcp(struct pf_state **state, struct mbuf *m, struct pf_pdesc *pd,
+    u_short *reason)
 {
 	struct pf_state_key_cmp	 key;
 	struct tcphdr		*th = pd->hdr.tcp;
@@ -3816,7 +3809,7 @@ pf_test_state_tcp(struct pf_state **state, int direction, struct pfi_kif *kif,
 	key.af = pd->af;
 	key.proto = IPPROTO_TCP;
 	key.rdomain = pd->rdomain;
-	if (direction == PF_IN)	{	/* wire side, straight */
+	if (pd->dir == PF_IN)	{	/* wire side, straight */
 		PF_ACPY(&key.addr[0], pd->src, key.af);
 		PF_ACPY(&key.addr[1], pd->dst, key.af);
 		key.port[0] = th->th_sport;
@@ -3828,9 +3821,9 @@ pf_test_state_tcp(struct pf_state **state, int direction, struct pfi_kif *kif,
 		key.port[0] = th->th_dport;
 	}
 
-	STATE_LOOKUP(kif, &key, direction, *state, m);
+	STATE_LOOKUP(pd->kif, &key, pd->dir, *state, m);
 
-	if (direction == (*state)->direction) {
+	if (pd->dir == (*state)->direction) {
 		src = &(*state)->src;
 		dst = &(*state)->dst;
 	} else {
@@ -3841,7 +3834,7 @@ pf_test_state_tcp(struct pf_state **state, int direction, struct pfi_kif *kif,
 	sk = (*state)->key[pd->didx];
 
 	if ((*state)->src.state == PF_TCPS_PROXY_SRC) {
-		if (direction != (*state)->direction) {
+		if (pd->dir != (*state)->direction) {
 			REASON_SET(reason, PFRES_SYNPROXY);
 			return (PF_SYNPROXY_DROP);
 		}
@@ -3870,7 +3863,7 @@ pf_test_state_tcp(struct pf_state **state, int direction, struct pfi_kif *kif,
 			(*state)->src.state = PF_TCPS_PROXY_DST;
 	}
 	if ((*state)->src.state == PF_TCPS_PROXY_DST) {
-		if (direction == (*state)->direction) {
+		if (pd->dir == (*state)->direction) {
 			if (((th->th_flags & (TH_SYN|TH_ACK)) != TH_ACK) ||
 			    (ntohl(th->th_ack) != (*state)->src.seqhi + 1) ||
 			    (ntohl(th->th_seq) != (*state)->src.seqlo + 1)) {
@@ -3943,7 +3936,7 @@ pf_test_state_tcp(struct pf_state **state, int direction, struct pfi_kif *kif,
 		if (pf_tcp_track_sloppy(src, dst, state, pd, reason) == PF_DROP)
 			return (PF_DROP);
 	} else {
-		if (pf_tcp_track_full(src, dst, state, kif, m, pd, reason,
+		if (pf_tcp_track_full(src, dst, state, m, pd, reason,
 		    &copyback) == PF_DROP)
 			return (PF_DROP);
 	}
@@ -3975,8 +3968,7 @@ pf_test_state_tcp(struct pf_state **state, int direction, struct pfi_kif *kif,
 }
 
 int
-pf_test_state_udp(struct pf_state **state, int direction, struct pfi_kif *kif,
-    struct mbuf *m, struct pf_pdesc *pd)
+pf_test_state_udp(struct pf_state **state, struct mbuf *m, struct pf_pdesc *pd)
 {
 	struct pf_state_peer	*src, *dst;
 	struct pf_state_key_cmp	 key;
@@ -3985,7 +3977,7 @@ pf_test_state_udp(struct pf_state **state, int direction, struct pfi_kif *kif,
 	key.af = pd->af;
 	key.proto = IPPROTO_UDP;
 	key.rdomain = pd->rdomain;
-	if (direction == PF_IN)	{	/* wire side, straight */
+	if (pd->dir == PF_IN)	{	/* wire side, straight */
 		PF_ACPY(&key.addr[0], pd->src, key.af);
 		PF_ACPY(&key.addr[1], pd->dst, key.af);
 		key.port[0] = uh->uh_sport;
@@ -3997,9 +3989,9 @@ pf_test_state_udp(struct pf_state **state, int direction, struct pfi_kif *kif,
 		key.port[0] = uh->uh_dport;
 	}
 
-	STATE_LOOKUP(kif, &key, direction, *state, m);
+	STATE_LOOKUP(pd->kif, &key, pd->dir, *state, m);
 
-	if (direction == (*state)->direction) {
+	if (pd->dir == (*state)->direction) {
 		src = &(*state)->src;
 		dst = &(*state)->dst;
 	} else {
@@ -4044,9 +4036,8 @@ pf_test_state_udp(struct pf_state **state, int direction, struct pfi_kif *kif,
 
 int
 pf_icmp_state_lookup(struct pf_state_key_cmp *key, struct pf_pdesc *pd,
-    struct pf_state **state, struct mbuf *m, int direction, struct pfi_kif *kif,
-    u_int16_t icmpid, u_int16_t type, int icmp_dir, int *iidx, int multi,
-    int inner)
+    struct pf_state **state, struct mbuf *m, u_int16_t icmpid, u_int16_t type,
+    int icmp_dir, int *iidx, int multi, int inner)
 {
 	key->af = pd->af;
 	key->proto = pd->proto;
@@ -4080,12 +4071,12 @@ pf_icmp_state_lookup(struct pf_state_key_cmp *key, struct pf_pdesc *pd,
 		PF_ACPY(&key->addr[pd->sidx], pd->src, key->af);
 	PF_ACPY(&key->addr[pd->didx], pd->dst, key->af);
 
-	STATE_LOOKUP(kif, key, direction, *state, m);
+	STATE_LOOKUP(pd->kif, key, pd->dir, *state, m);
 
 	/* Is this ICMP message flowing in right direction? */
 	if ((*state)->rule.ptr->type &&
-	    (((!inner && (*state)->direction == direction) ||
-	    (inner && (*state)->direction != direction)) ?
+	    (((!inner && (*state)->direction == pd->dir) ||
+	    (inner && (*state)->direction != pd->dir)) ?
 	    PF_IN : PF_OUT) != icmp_dir) {
 		if (pf_status.debug >= LOG_NOTICE) {
 			log(LOG_NOTICE,
@@ -4100,8 +4091,8 @@ pf_icmp_state_lookup(struct pf_state_key_cmp *key, struct pf_pdesc *pd,
 }
 
 int
-pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kif *kif,
-    struct mbuf *m, struct pf_pdesc *pd, u_short *reason)
+pf_test_state_icmp(struct pf_state **state, struct mbuf *m,
+    struct pf_pdesc *pd, u_short *reason)
 {
 	struct pf_addr  *saddr = pd->src, *daddr = pd->dst;
 	u_int16_t	 icmpid, *icmpsum, virtual_id, virtual_type;
@@ -4132,15 +4123,15 @@ pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kif *kif,
 		 * ICMP query/reply message not related to a TCP/UDP packet.
 		 * Search for an ICMP state.
 		 */
-		ret = pf_icmp_state_lookup(&key, pd, state, m, direction,
-		    kif, virtual_id, virtual_type, icmp_dir, &iidx,
+		ret = pf_icmp_state_lookup(&key, pd, state, m,
+		    virtual_id, virtual_type, icmp_dir, &iidx,
 		    PF_ICMP_MULTI_NONE, 0);
 		if (ret >= 0) {
 			if (ret == PF_DROP && pd->af == AF_INET6 &&
 			    icmp_dir == PF_OUT) {
 				ret = pf_icmp_state_lookup(&key, pd, state, m,
-				    direction, kif, virtual_id, virtual_type,
-				    icmp_dir, &iidx, multi, 0);
+				    virtual_id, virtual_type, icmp_dir, &iidx,
+				    multi, 0);
 				if (ret >= 0)
 					return (ret);
 			} else
@@ -4229,11 +4220,15 @@ pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kif *kif,
 		u_int16_t	*ipsum2;
 		int		ipoff2;
 
+		/* Initialize pd2 fields valid for both packets with pd. */
+		bzero(&pd2, sizeof(pd2));
 		pd2.af = pd->af;
+		pd2.dir = pd->dir;
+		pd2.kif = pd->kif;
 		pd2.rdomain = pd->rdomain;
 		/* Payload packet is from the opposite direction. */
-		pd2.sidx = (direction == PF_IN) ? 1 : 0;
-		pd2.didx = (direction == PF_IN) ? 0 : 1;
+		pd2.sidx = (pd2.dir == PF_IN) ? 1 : 0;
+		pd2.didx = (pd2.dir == PF_IN) ? 0 : 1;
 		switch (pd->af) {
 #ifdef INET
 		case AF_INET:
@@ -4316,9 +4311,9 @@ pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kif *kif,
 			key.port[pd2.sidx] = th.th_sport;
 			key.port[pd2.didx] = th.th_dport;
 
-			STATE_LOOKUP(kif, &key, direction, *state, m);
+			STATE_LOOKUP(pd2.kif, &key, pd2.dir, *state, m);
 
-			if (direction == (*state)->direction) {
+			if (pd2.dir == (*state)->direction) {
 				src = &(*state)->dst;
 				dst = &(*state)->src;
 			} else {
@@ -4442,7 +4437,7 @@ pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kif *kif,
 			key.port[pd2.sidx] = uh.uh_sport;
 			key.port[pd2.didx] = uh.uh_dport;
 
-			STATE_LOOKUP(kif, &key, direction, *state, m);
+			STATE_LOOKUP(pd2.kif, &key, pd2.dir, *state, m);
 
 			/* translate source/destination address, if necessary */
 			if ((*state)->key[PF_SK_WIRE] !=
@@ -4517,8 +4512,8 @@ pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kif *kif,
 			    &icmp_dir, &multi, &virtual_id, &virtual_type);
 
 			ret = pf_icmp_state_lookup(&key, &pd2, state, m,
-			    direction, kif, virtual_id, virtual_type,
-			    icmp_dir, &iidx, PF_ICMP_MULTI_NONE, 1);
+			    virtual_id, virtual_type, icmp_dir, &iidx,
+			    PF_ICMP_MULTI_NONE, 1);
 			if (ret >= 0)
 				return (ret);
 
@@ -4582,14 +4577,13 @@ pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kif *kif,
 			pf_icmp_mapping(&pd2, iih.icmp6_type,
 			    &icmp_dir, &multi, &virtual_id, &virtual_type);
 			ret = pf_icmp_state_lookup(&key, &pd2, state, m,
-			    direction, kif, virtual_id, virtual_type,
-			    icmp_dir, &iidx, PF_ICMP_MULTI_NONE, 1);
+			    virtual_id, virtual_type, icmp_dir, &iidx,
+			    PF_ICMP_MULTI_NONE, 1);
 			if (ret >= 0) {
 				if (ret == PF_DROP && pd->af == AF_INET6 &&
 				    icmp_dir == PF_OUT) {
 					ret = pf_icmp_state_lookup(&key, pd,
-					    state, m, direction, kif,
-					    virtual_id, virtual_type,
+					    state, m, virtual_id, virtual_type,
 					    icmp_dir, &iidx, multi, 1);
 					if (ret >= 0)
 						return (ret);
@@ -4648,7 +4642,7 @@ pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kif *kif,
 			PF_ACPY(&key.addr[pd2.didx], pd2.dst, key.af);
 			key.port[0] = key.port[1] = 0;
 
-			STATE_LOOKUP(kif, &key, direction, *state, m);
+			STATE_LOOKUP(pd2.kif, &key, pd2.dir, *state, m);
 
 			/* translate source/destination address, if necessary */
 			if ((*state)->key[PF_SK_WIRE] !=
@@ -4701,8 +4695,8 @@ pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kif *kif,
 }
 
 int
-pf_test_state_other(struct pf_state **state, int direction, struct pfi_kif *kif,
-    struct mbuf *m, struct pf_pdesc *pd)
+pf_test_state_other(struct pf_state **state, struct mbuf *m,
+    struct pf_pdesc *pd)
 {
 	struct pf_state_peer	*src, *dst;
 	struct pf_state_key_cmp	 key;
@@ -4710,7 +4704,7 @@ pf_test_state_other(struct pf_state **state, int direction, struct pfi_kif *kif,
 	key.af = pd->af;
 	key.proto = pd->proto;
 	key.rdomain = pd->rdomain;
-	if (direction == PF_IN)	{
+	if (pd->dir == PF_IN)	{
 		PF_ACPY(&key.addr[0], pd->src, key.af);
 		PF_ACPY(&key.addr[1], pd->dst, key.af);
 		key.port[0] = key.port[1] = 0;
@@ -4720,9 +4714,9 @@ pf_test_state_other(struct pf_state **state, int direction, struct pfi_kif *kif,
 		key.port[1] = key.port[0] = 0;
 	}
 
-	STATE_LOOKUP(kif, &key, direction, *state, m);
+	STATE_LOOKUP(pd->kif, &key, pd->dir, *state, m);
 
-	if (direction == (*state)->direction) {
+	if (pd->dir == (*state)->direction) {
 		src = &(*state)->src;
 		dst = &(*state)->dst;
 	} else {
@@ -5571,8 +5565,9 @@ pf_walk_header6(struct mbuf *m, struct ip6_hdr *h, int *off, int *extoff,
 }
 
 int
-pf_setup_pdesc(sa_family_t af, int dir, struct pf_pdesc *pd, void *pdhdrs,
-    struct mbuf **m0, u_short *action, u_short *reason)
+pf_setup_pdesc(sa_family_t af, int dir, struct pfi_kif *kif,
+    struct pf_pdesc *pd, void *pdhdrs, struct mbuf **m0, u_short *action,
+    u_short *reason)
 {
 	struct mbuf *m = *m0;
 
@@ -5580,6 +5575,7 @@ pf_setup_pdesc(sa_family_t af, int dir, struct pf_pdesc *pd, void *pdhdrs,
 	pd->hdr.any = pdhdrs;
 	pd->af = af;
 	pd->dir = dir;
+	pd->kif = kif;		/* kif is NULL when called by pflog */
 	pd->sidx = (dir == PF_IN) ? 0 : 1;
 	pd->didx = (dir == PF_IN) ? 1 : 0;
 
@@ -5800,17 +5796,17 @@ pf_setup_pdesc(sa_family_t af, int dir, struct pf_pdesc *pd, void *pdhdrs,
 }
 
 void
-pf_counters_inc(int dir, int action, struct pf_pdesc *pd,
-    struct pfi_kif *kif, struct pf_state *s,
+pf_counters_inc(int action, struct pf_pdesc *pd, struct pf_state *s,
     struct pf_rule *r, struct pf_rule *a)
 {
 	int dirndx;
-	kif->pfik_bytes[pd->af == AF_INET6][dir == PF_OUT][action != PF_PASS]
-	    += pd->tot_len;
-	kif->pfik_packets[pd->af == AF_INET6][dir == PF_OUT][action != PF_PASS]++;
+	pd->kif->pfik_bytes[pd->af == AF_INET6][pd->dir == PF_OUT]
+	    [action != PF_PASS] += pd->tot_len;
+	pd->kif->pfik_packets[pd->af == AF_INET6][pd->dir == PF_OUT]
+	    [action != PF_PASS]++;
 
 	if (action == PF_PASS || r->action == PF_DROP) {
-		dirndx = (dir == PF_OUT);
+		dirndx = (pd->dir == PF_OUT);
 		r->packets[dirndx]++;
 		r->bytes[dirndx] += pd->tot_len;
 		if (a != NULL) {
@@ -5825,7 +5821,7 @@ pf_counters_inc(int dir, int action, struct pf_pdesc *pd,
 				sni->sn->packets[dirndx]++;
 				sni->sn->bytes[dirndx] += pd->tot_len;
 			}
-			dirndx = (dir == s->direction) ? 0 : 1;
+			dirndx = (pd->dir == s->direction) ? 0 : 1;
 			s->packets[dirndx]++;
 			s->bytes[dirndx] += pd->tot_len;
 
@@ -5839,14 +5835,14 @@ pf_counters_inc(int dir, int action, struct pf_pdesc *pd,
 			    (s == NULL) ? pd->src :
 			    &s->key[(s->direction == PF_IN)]->
 				addr[(s->direction == PF_OUT)],
-			    pd->af, pd->tot_len, dir == PF_OUT,
+			    pd->af, pd->tot_len, pd->dir == PF_OUT,
 			    r->action == PF_PASS, r->src.neg);
 		if (r->dst.addr.type == PF_ADDR_TABLE)
 			pfr_update_stats(r->dst.addr.p.tbl,
 			    (s == NULL) ? pd->dst :
 			    &s->key[(s->direction == PF_IN)]->
 				addr[(s->direction == PF_IN)],
-			    pd->af, pd->tot_len, dir == PF_OUT,
+			    pd->af, pd->tot_len, pd->dir == PF_OUT,
 			    r->action == PF_PASS, r->dst.neg);
 	}
 }
@@ -5898,7 +5894,8 @@ pf_test(sa_family_t af, int fwdir, struct ifnet *ifp, struct mbuf **m0,
 		return (PF_PASS);
 	}
 
-	if (pf_setup_pdesc(af, dir, &pd, &pdhdrs, m0, &action, &reason) == -1) {
+	if (pf_setup_pdesc(af, dir, kif, &pd, &pdhdrs, m0, &action, &reason)
+	    == -1) {
 		if (action == PF_PASS)
 			return (PF_PASS);
 		m = *m0;
@@ -5915,7 +5912,7 @@ pf_test(sa_family_t af, int fwdir, struct ifnet *ifp, struct mbuf **m0,
 		 * handle fragments that aren't reassembled by
 		 * normalization
 		 */
-		action = pf_test_rule(&r, &s, dir, kif, m, &pd, &a, &ruleset);
+		action = pf_test_rule(&r, &s, m, &pd, &a, &ruleset);
 		if (action != PF_PASS)
 			REASON_SET(&reason, PFRES_FRAG);
 		break;
@@ -5924,10 +5921,10 @@ pf_test(sa_family_t af, int fwdir, struct ifnet *ifp, struct mbuf **m0,
 	case IPPROTO_TCP: {
 		if ((pd.hdr.tcp->th_flags & TH_ACK) && pd.p_len == 0)
 			pqid = 1;
-		action = pf_normalize_tcp(dir, m, &pd);
+		action = pf_normalize_tcp(m, &pd);
 		if (action == PF_DROP)
 			goto done;
-		action = pf_test_state_tcp(&s, dir, kif, m, &pd, &reason);
+		action = pf_test_state_tcp(&s, m, &pd, &reason);
 		if (action == PF_PASS) {
 #if NPFSYNC > 0
 			pfsync_update_state(s);
@@ -5936,8 +5933,7 @@ pf_test(sa_family_t af, int fwdir, struct ifnet *ifp, struct mbuf **m0,
 			a = s->anchor.ptr;
 			pd.pflog |= s->log;
 		} else if (s == NULL)
-			action = pf_test_rule(&r, &s, dir, kif,
-			    m, &pd, &a, &ruleset);
+			action = pf_test_rule(&r, &s, m, &pd, &a, &ruleset);
 
 		if (s) {
 			if (s->max_mss)
@@ -5949,7 +5945,7 @@ pf_test(sa_family_t af, int fwdir, struct ifnet *ifp, struct mbuf **m0,
 	}
 
 	case IPPROTO_UDP: {
-		action = pf_test_state_udp(&s, dir, kif, m, &pd);
+		action = pf_test_state_udp(&s, m, &pd);
 		if (action == PF_PASS) {
 #if NPFSYNC > 0
 			pfsync_update_state(s);
@@ -5958,8 +5954,7 @@ pf_test(sa_family_t af, int fwdir, struct ifnet *ifp, struct mbuf **m0,
 			a = s->anchor.ptr;
 			pd.pflog |= s->log;
 		} else if (s == NULL)
-			action = pf_test_rule(&r, &s, dir, kif,
-			    m, &pd, &a, &ruleset);
+			action = pf_test_rule(&r, &s, m, &pd, &a, &ruleset);
 		break;
 	}
 
@@ -5971,7 +5966,7 @@ pf_test(sa_family_t af, int fwdir, struct ifnet *ifp, struct mbuf **m0,
 			    "dropping IPv6 packet with ICMPv4 payload");
 			goto done;
 		}
-		action = pf_test_state_icmp(&s, dir, kif, m, &pd, &reason);
+		action = pf_test_state_icmp(&s, m, &pd, &reason);
 		if (action == PF_PASS) {
 #if NPFSYNC > 0
 			pfsync_update_state(s);
@@ -5980,8 +5975,7 @@ pf_test(sa_family_t af, int fwdir, struct ifnet *ifp, struct mbuf **m0,
 			a = s->anchor.ptr;
 			pd.pflog |= s->log;
 		} else if (s == NULL)
-			action = pf_test_rule(&r, &s, dir, kif,
-			    m, &pd, &a, &ruleset);
+			action = pf_test_rule(&r, &s, m, &pd, &a, &ruleset);
 		break;
 	}
 
@@ -5993,7 +5987,7 @@ pf_test(sa_family_t af, int fwdir, struct ifnet *ifp, struct mbuf **m0,
 			    "dropping IPv4 packet with ICMPv6 payload");
 			goto done;
 		}
-		action = pf_test_state_icmp(&s, dir, kif, m, &pd, &reason);
+		action = pf_test_state_icmp(&s, m, &pd, &reason);
 		if (action == PF_PASS) {
 #if NPFSYNC > 0
 			pfsync_update_state(s);
@@ -6002,13 +5996,12 @@ pf_test(sa_family_t af, int fwdir, struct ifnet *ifp, struct mbuf **m0,
 			a = s->anchor.ptr;
 			pd.pflog |= s->log;
 		} else if (s == NULL)
-			action = pf_test_rule(&r, &s, dir, kif,
-			    m, &pd, &a, &ruleset);
+			action = pf_test_rule(&r, &s, m, &pd, &a, &ruleset);
 		break;
 	}
 
 	default:
-		action = pf_test_state_other(&s, dir, kif, m, &pd);
+		action = pf_test_state_other(&s, m, &pd);
 		if (action == PF_PASS) {
 #if NPFSYNC > 0
 			pfsync_update_state(s);
@@ -6017,8 +6010,7 @@ pf_test(sa_family_t af, int fwdir, struct ifnet *ifp, struct mbuf **m0,
 			a = s->anchor.ptr;
 			pd.pflog |= s->log;
 		} else if (s == NULL)
-			action = pf_test_rule(&r, &s, dir, kif,
-			    m, &pd, &a, &ruleset);
+			action = pf_test_rule(&r, &s, m, &pd, &a, &ruleset);
 		break;
 	}
 
@@ -6062,7 +6054,7 @@ done:
 		}
 	}
 
-	if (dir == PF_IN && s && s->key[PF_SK_STACK])
+	if (pd.dir == PF_IN && s && s->key[PF_SK_STACK])
 		m->m_pkthdr.pf.statekey = s->key[PF_SK_STACK];
 
 #ifdef ALTQ
@@ -6083,10 +6075,10 @@ done:
 		    (pd.af == AF_INET6 && IN6_IS_ADDR_LOOPBACK(&pd.dst->v6)))
 			m->m_pkthdr.pf.flags |= PF_TAG_TRANSLATE_LOCALHOST;
 	/* We need to redo the route lookup on outgoing routes. */
-	if (pd.destchg && dir == PF_OUT)
+	if (pd.destchg && pd.dir == PF_OUT)
 		m->m_pkthdr.pf.flags |= PF_TAG_REROUTE;
 
-	if (dir == PF_IN && action == PF_PASS && r->divert.port) {
+	if (pd.dir == PF_IN && action == PF_PASS && r->divert.port) {
 		struct pf_divert *divert;
 
 		if ((divert = pf_get_divert(m))) {
@@ -6110,16 +6102,16 @@ done:
 		struct pf_rule_item	*ri;
 
 		if (pd.pflog & PF_LOG_FORCE || r->log & PF_LOG_ALL)
-			PFLOG_PACKET(kif, m, dir, reason, r, a, ruleset, &pd);
+			PFLOG_PACKET(m, reason, r, a, ruleset, &pd);
 		if (s) {
 			SLIST_FOREACH(ri, &s->match_rules, entry)
 				if (ri->r->log & PF_LOG_ALL)
-					PFLOG_PACKET(kif, m, dir, reason,
+					PFLOG_PACKET(m, reason,
 					    ri->r, a, ruleset, &pd);
 		}
 	}
 
-	pf_counters_inc(dir, action, &pd, kif, s, r, a);
+	pf_counters_inc(action, &pd, s, r, a);
 
 	switch (action) {
 	case PF_SYNPROXY_DROP:
@@ -6130,10 +6122,10 @@ done:
 		break;
 	case PF_DIVERT:
 		if (pd.af == AF_INET)
-			divert_packet(m, dir);
+			divert_packet(m, pd.dir);
 #ifdef INET6
 		if (pd.af == AF_INET6)
-			divert6_packet(m, dir);
+			divert6_packet(m, pd.dir);
 #endif
 		*m0 = NULL;
 		action = PF_PASS;
@@ -6142,10 +6134,10 @@ done:
 		/* pf_route can free the mbuf causing *m0 to become NULL */
 		if (r->rt) {
 			if (pd.af == AF_INET)
-				pf_route(m0, r, dir, kif->pfik_ifp, s);
+				pf_route(m0, r, pd.dir, pd.kif->pfik_ifp, s);
 #ifdef INET6
 			if (pd.af == AF_INET6)
-				pf_route6(m0, r, dir, kif->pfik_ifp, s);
+				pf_route6(m0, r, pd.dir, pd.kif->pfik_ifp, s);
 #endif
 		}
 		break;