Various cleanup done in ipfw3-head branch including:

- use a uniform mtag format for all packets that exit and re-enter
  the firewall in the middle of a rulechain. On reentry, all tags
  containing reinject info are renamed to MTAG_IPFW_RULE so the
  processing is simpler.

- make ipfw and dummynet use ip_len and ip_off in network format
  everywhere. Conversion is done only once instead of tracking
  the format in every place.

- use a macro FREE_PKT to dispose of mbufs. This eases portability.

On passing i also removed a few typos, staticise or localise variables,
remove useless declarations and other minor things.

Overall the code shrinks a bit and is hopefully more readable.

I have tested functionality for all but ng_ipfw and if_bridge/if_ethersubr.
For ng_ipfw i am actually waiting for feedback from glebius@ because
we might have some small changes to make.
For if_bridge and if_ethersubr feedback would be welcome
(there are still some redundant parts in these two modules that
I would like to remove, but first i need to check functionality).

1 files changed, 10 insertions, 9 deletions

diff --git a/sys/net/if_bridge.c b/sys/net/if_bridge.c
index d0d2242..36fb9d8 100644
--- a/sys/net/if_bridge.c
+++ b/sys/net/if_bridge.c
@@ -3040,25 +3040,26 @@ bridge_pfil(struct mbuf **mp, struct ifnet *bifp, struct ifnet *ifp, int dir)
 	}
 
 	/* XXX this section is also in if_ethersubr.c */
-	if (V_ip_fw_chk_ptr && pfil_ipfw != 0 && dir == PFIL_OUT && ifp != NULL) {
+	// XXX PFIL_OUT or DIR_OUT ?
+	if (V_ip_fw_chk_ptr && pfil_ipfw != 0 &&
+			dir == PFIL_OUT && ifp != NULL) {
 		struct m_tag *mtag;
 
 		error = -1;
-		mtag = m_tag_find(*mp, PACKET_TAG_DUMMYNET, NULL);
+		/* fetch the start point from existing tags, if any */
+		mtag = m_tag_locate(*mp, MTAG_IPFW_RULE, 0, NULL);
 		if (mtag == NULL) {
-			args.slot = 0;
+			args.rule.slot = 0;
 		} else {
 			struct dn_pkt_tag *dn_tag;
 
+			/* XXX can we free the tag after use ? */
 			mtag->m_tag_id = PACKET_TAG_NONE;
 			dn_tag = (struct dn_pkt_tag *)(mtag + 1);
-			if (dn_tag->slot != 0 && V_fw_one_pass)
-				/* packet already partially processed */
+			/* packet already partially processed ? */
+			if (dn_tag->rule.slot != 0 && V_fw_one_pass)
 				goto ipfwpass;
-			args.slot = dn_tag->slot; /* next rule to use */
-			args.chain_id = dn_tag->chain_id;
-			args.rulenum = dn_tag->rulenum;
-			args.rule_id = dn_tag->rule_id;
+			args.rule = dn_tag->rule;
 		}
 
 		args.m = *mp;