M1: pf.c compiles into pf.ko

module/include/compat/net/if_types.h

@@ -13,4 +13,5 @@
 #define IFT_PFLOG	0xf0
 #define IFT_PFSYNC	0xf1
 #define IFT_CARP	0xf8
+#define IFT_ENC		0xf4	/* Encapsulation (OpenBSD net/if_types.h) */
 #endif

module/include/compat/net/ifq.h

@@ -13,7 +13,7 @@
  * pfk.h before this header. */
 struct mbuf;
 struct mbuf_list;
-struct ifnet;
+struct pfk_ifnet;
 struct pfk_ifnet;
 struct pf_queuespec;
 
@@ -60,7 +60,7 @@ extern const struct ifq_ops * const ifq_fqcodel_ops;
 extern const struct pfq_ops * const pfq_hfsc_ops;
 extern const struct pfq_ops * const pfq_fqcodel_ops;
 
-void		 ifq_init(struct ifqueue *, struct ifnet *, unsigned int);
+void		 ifq_init(struct ifqueue *, struct pfk_ifnet *, unsigned int);
 void		 ifq_init_maxlen(struct ifqueue *, unsigned int);
 void		 ifq_attach(struct ifqueue *, const struct ifq_ops *, void *);
 void		 ifq_destroy(struct ifqueue *);

module/include/compat/net/rtable.h

@@ -11,9 +11,12 @@ struct pf_rtentry {
 	void		*rt_addr;	/* destination */
 	unsigned int	 rt_ifidx;	/* egress ifindex */
 	unsigned int	 rt_flags;
+#ifndef RTF_UP
+#define	RTF_UP		0x1	/* route usable (OpenBSD net/route.h) */
+#endif
 	int		 rt_listid;
 	int		 rt_labelid;
-	void		*rt_ifa;
+	void		*rt_ifa;	/* BSD in_ifaddr/in6_ifaddr view */
 };
 
 int		rtable_exists(unsigned int rtableid);

module/include/compat/netinet/in.h

@@ -3,6 +3,10 @@
 #define _PFK_NETINET_IN_H
 #include <linux/in.h>
 #include <linux/in6.h>
+/* BSD protocol number aliases (OpenBSD <netinet/in.h>) */
+#ifndef IPPROTO_IPV4
+#define IPPROTO_IPV4	IPPROTO_IPIP	/* IP inside IP */
+#endif
 /* BSD IP-level option numbers (Linux uapi uses different values) */
 #define PF_IP_OPTIONS		1
 #define PF_IP_RECORD_ROUTE	7

module/include/pfk.h

@@ -218,6 +218,7 @@ struct ip6_frag {
 /* PF mbuf tags (our namespace; upstream uses PACKET_TAG_PF_*) */
 #define PACKET_TAG_PF_REASSEMBLED	0x50460001
 #define PACKET_TAG_PF_REFRAGMENTED	0x50460002
+#define PACKET_TAG_PF_DIVERT		0x50460003
 
 /* OpenBSD builds the kernel with DIAGNOSTIC (extra KASSERT coverage) */
 #ifndef DIAGNOSTIC
@@ -326,6 +327,7 @@ struct pfk_rwlock {
 #define PFKIOC_TYPE(nr)     (((nr) >> PFKXIOC_TYPESHIFT) & ((1U<<PFKXIOC_TYPEBITS)-1))
 #define PFKIOC_NR(nr)       (((nr) >> PFKXIOC_NRSHIFT) & ((1U<<PFKXIOC_NRBITS)-1))
 #define PFKIOC_DIR(nr)      (((nr) >> PFKXIOC_DIRSHIFT) & ((1U<<PFKXIOC_DIRBITS)-1))
+#define PFKIOC_SIZE(nr)     (((nr) >> PFKXIOC_SIZESHIFT) & ((1U<<PFKXIOC_SIZEBITS)-1))
 
 /* BSD host<->big endian names (the kernel uses cpu_to_beXX spellings) */
 #ifndef htobe16
@@ -580,10 +582,187 @@ unhandled_af(int af)
 
 /* mbuf + BSD wire structs + pf ifnet registry */
 #include "compat/net/ifq.h"
+#include "compat/net/rtable.h"
+#include "compat/sys/percpu.h"
+#include "compat/netinet/in.h"
 #include "pfk_mbuf.h"
 #include "pfk_net.h"
 #include "pfk_if.h"
 
+/* ---------------------------------------------------------------- M1 glue */
+/* BSD parameter helpers (OpenBSD <sys/param.h>) */
+#ifndef imax
+#define imax(a, b)	((a) > (b) ? (a) : (b))
+#endif
+#ifndef imin
+#define imin(a, b)	((a) < (b) ? (a) : (b))
+#endif
+#define ALIGNED_POINTER(p, t) ((((unsigned long)(p) % __alignof__(t)) == 0) && \
+	(((unsigned long)(p) % sizeof(t)) == 0))
+
+/* BSD asserts with message */
+#define KASSERTMSG(cond, fmt...)	KASSERT(cond)
+
+/* BSD process sentinel (OpenBSD <sys/proc.h> NO_PID) */
+#ifndef NO_PID
+#define NO_PID		((pid_t)-1)
+#endif
+
+/* BSD atomic swap helpers (OpenBSD <sys/atomic.h>): like Linux cmpxchg but
+ * return the old value on success and 0/NULL on failure (OpenBSD semantics
+ * as used by pf.c). */
+#define atomic_cas_ptr(p, o, n) \
+	((cmpxchg((p), (o), (n)) == (o)) ? (o) : (typeof(o))NULL)
+#define atomic_cas_uint(p, o, n) \
+	((cmpxchg((p), (o), (n)) == (unsigned int)(o)) ? (unsigned int)(o) : 0u)
+
+/* SMR → Linux RCU */
+static inline void smr_read_enter(void) { rcu_read_lock(); }
+static inline void smr_read_leave(void) { rcu_read_unlock(); }
+
+/*
+ * struct inpcb — OpenBSD's kernel PCB view as used by PF (pf.c:
+ * pf_socket_lookup/pf_mbuf_link_inpcb/pf_state_key_link_inpcb).  The port
+ * does not have BSD PCBs: one struct inpcb is created per successful Linux
+ * socket lookup and lives as long as PF holds references to it (mbufs,
+ * state keys).  Implemented in compat/pfk_pcb.c.
+ */
+struct pfk_socket {		/* BSD struct socket fields PF consumes */
+	uid_t		so_euid;
+	gid_t		so_egid;
+	pid_t		so_cpid;
+};
+struct inpcb {
+	refcount_t		inp_refcnt;
+	struct pf_state_key	*inp_pf_sk;	/* PF state linkage */
+	struct sock		*inp_sock;	/* backing Linux socket */
+	struct pfk_socket	inp_soinfo_storage;
+	struct pfk_socket	*inp_socket;	/* → storage above */
+};
+struct inpcbtable {		/* OpenBSD PCB table head (opaque handle) */
+	int		pfk_unused;
+};
+extern struct inpcbtable tcbtable, udbtable, tcb6table, udb6table;
+
+struct inpcb *in_pcbref(struct inpcb *);
+void	in_pcbunref(struct inpcb *);
+struct inpcb *in_pcblookup(struct inpcbtable *, struct in_addr faddr,
+	    u_int fport, struct in_addr laddr, u_int lport, u_int rtableid);
+struct inpcb *in_pcblookup_listen(struct inpcbtable *, struct in_addr laddr,
+	    u_int lport, struct mbuf *m, u_int rtableid);
+struct inpcb *in6_pcblookup(struct inpcbtable *, const struct in6_addr *faddr,
+	    u_int fport, const struct in6_addr *laddr, u_int lport,
+	    u_int rtableid);
+struct inpcb *in6_pcblookup_listen(struct inpcbtable *, struct in6_addr *laddr,
+	    u_int lport, struct mbuf *m, u_int rtableid);
+int	pfk_pcb_init(void);
+void	pfk_pcb_exit(void);
+
+/* OpenBSD counters(9): per-CPU u64 slots (struct cpumem from percpu.h) */
+struct cpumem *counters_alloc(u_int count);
+void	counters_free(struct cpumem *);
+void	counters_inc(struct cpumem *, u_int idx);
+void	counters_zero(struct cpumem *, u_int count);
+void	counters_read(struct cpumem *, uint64_t *result, u_int count,
+	    uint64_t *scratch);
+
+/* task/timeout static initializers (OpenBSD <sys/task.h> <sys/timeout.h>) */
+#define TASK_INITIALIZER(_f, _a)	{ .ta_data = (_a), .ta_func = (_f) }
+#define TIMEOUT_INITIALIZER(_f, _a)	{ .fn = (_f), .arg = (_a) }
+
+/* timeout_add_msec: timeout_add() already takes milliseconds upstream */
+int	timeout_add_msec(struct timeout *to, int msecs);
+
+/* curcpu(9): OpenBSD per-CPU info; only ci_schedstate.spc_schedflags is
+ * consumed by pf.c (SPCF_SHOULDYIELD).  Mapped to need_resched(). */
+struct pfk_schedstate { int spc_schedflags; };
+struct pfk_cpu_info { struct pfk_schedstate ci_schedstate; };
+#define SPCF_SHOULDYIELD	0x1
+struct pfk_cpu_info *pfk_curcpu(void);
+#define curcpu()		pfk_curcpu()
+
+/* interface refcounting (OpenBSD if_get/if_put/if_get_smr) */
+struct pfk_ifnet *if_get(int ifidx);
+struct pfk_ifnet *if_get_smr(int ifidx);
+void	if_put(struct pfk_ifnet *ifp);
+int	if_congested(void);
+void	pfk_if_congestion(void);	/* stamp "tx resources exhausted" now */
+
+/* OpenBSD route/rtable API for PF (compat/pfk_rtable.c over the Linux FIB) */
+#define RT_RESOLVE	1	/* rtalloc() flag: resolve the route */
+/* PFLINUX: `sa` is const void * so BSD sintosa/sin6tosa/sstosa macro
+ * results (which keep their concrete sockaddr types) pass directly. */
+struct pf_rtentry *rtalloc(const void *sa, int, unsigned int);
+struct pf_rtentry *rtalloc_mpath(const void *sa, uint32_t *,
+	    unsigned int);
+int	rtisvalid(struct pf_rtentry *);
+void	rtfree(struct pf_rtentry *);
+#define sstosa(ss)	((struct sockaddr *)(void *)(ss))
+
+/* BSD in_ifaddr/in6_ifaddr views (OpenBSD <netinet/in_var.h>).  The Linux
+ * in_ifaddr tag is already taken, so the port keeps its own types. */
+struct pfk_in_ifaddr {
+	struct ifaddr	ifa_ifa;
+	struct sockaddr_in ia_addr;
+};
+struct pfk_in6_ifaddr {
+	struct ifaddr	ifa_ifa;
+	struct sockaddr_in6 ia_addr;
+};
+#define ifatoia(ifa)	((struct pfk_in_ifaddr *)(void *)(ifa))
+#define ifatoia6(ifa)	((struct pfk_in6_ifaddr *)(void *)(ifa))
+
+/* OpenBSD sysctl-backed globals (pfk_kern.c) */
+extern int ip_forwarding;	/* 0 off, 1 on, 2 ipsec-only (we: init-synced) */
+extern int ip_directedbcast;	/* accept directed broadcast */
+extern int ipmultipath;		/* multipath routing enable */
+extern int ip6_multipath;
+extern int ip_mtudisc;		/* PMTU discovery */
+extern int ip_defttl;		/* default IPv4 TTL */
+extern u_int max_linkhdr;	/* max link-level header size */
+void	pfk_sysctl_sync(void);	/* mirror Linux sysctls into BSD globals */
+extern tcp_seq tcp_iss;		/* tcp initial send seq # (random salt) */
+
+/* ip_output/ip_forward flags (OpenBSD <netinet/ip_var.h>) */
+#define IP_FORWARDING		0x0001
+#define IP_ALLOWBROADCAST	0x0002
+#define IP_MINMTU		0x0004
+#define IP_REDIRECT		0x0008
+#define IP_FORWARDING_IPSEC	0x0010
+#define IPTTLDEC		1
+
+/* BSD IPv4 layer entry points used by pf.c (compat/pfk_ip4.c).  ip_output/
+ * ip_forward/ip6_output clash with Linux declarations, so the staging seds
+ * rename them to pfk_* (see stage-port.sh). */
+void	ip_send(struct mbuf *);
+void	ip6_send(struct mbuf *);
+void	icmp_error(struct mbuf *, u_int type, u_int code, u_int dest,
+	    u_int mtu);
+int	ip_fragment(struct mbuf *, struct mbuf_list *, struct pfk_ifnet *,
+	    int);
+int	pfk_ip_output(struct mbuf *, void *, void *, u_int, void *, void *,
+	    u_int);
+void	pfk_ip_forward(struct mbuf *, struct pfk_ifnet *, void *, u_int);
+int	pfk_ip6_output(struct mbuf *, void *, void *, u_int, void *, void *);
+
+/* BSD checksum helpers (compat/pfk_ip4.c) */
+u_int16_t in_cksum(struct mbuf *, int);
+u_int16_t in4_cksum(struct mbuf *m, __u8 nxt, u_int32_t off, u_int32_t len);
+u_int16_t in6_cksum(struct mbuf *m, __u8 nxt, u_int32_t off, u_int32_t len);
+void	in_hdr_cksum_out(struct mbuf *, void *);
+
+/* divert layer (pfsrc/divert_sock.c; BSD AF_DIVERT semantics) */
+void	divert_packet(struct mbuf *, int dir, u_int16_t divert_port);
+void	divert6_packet(struct mbuf *, int dir, u_int16_t divert_port);
+
+/* BSD statistics hooks: counters live in pf_status_fcounters/pf_kif in the
+ * port; the netinet ip/tcp counters are not ported (no-op).  */
+#define ipstat_inc(c)		do { } while (0)
+#define tcpstat_inc(c)		do { } while (0)
+
+/* BSD SEQ helpers (OpenBSD <netinet/tcp_seq.h>) */
+#define SEQ_LEQ(a, b)		((int)((a) - (b)) <= 0)
+
 struct pf_source;
 #define SEC_TO_NSEC(x)	((uint64_t)(x) * 1000000000ULL)
 #define NSEC_TO_SEC(x)	((x) / 1000000000ULL)
@@ -626,6 +805,9 @@ struct m_tag *m_tag_get(int type, int len, int flags);
 #define PF_TAG_REFRAGMENTED_PACKET 0x0020
 #define PF_TAG_SYNCOOKIE_RECREATED	0x0040
 #define PF_TAG_SYNCOOKIE		0x0080
+/* m_pkthdr.pf.flag bits, continuing the upstream bit space */
+#define PF_TAG_DIVERTED_PACKET	0x0100
+#define PF_TAG_PROCESSED		0x0200
 
 /* OpenBSD route entry (kernel-internal PF type; pointer use only) */
 struct pf_rtentry;
@@ -896,10 +1078,14 @@ timersub(const struct timeval *tvp, const struct timeval *uvp,
 	}
 }
 
-/* IPv6 forwarding state (OpenBSD sys/netinet6 variables) */
+/* IPv6 forwarding state (OpenBSD sys/netinet6 variables).
+ * ip6_output/ip6_forward flag values per OpenBSD <netinet6/ip6_var.h>;
+ * IPV6_MINMTU/IPV6_UNSPECSRC are omitted: upstream PF code never uses
+ * them and IPV6_MINMTU already means 1280 above (name clash upstream). */
 extern int ip6_forwarding;
-#define IPV6_FORWARDING		0x1
-#define IPV6_FORWARDING_IPSEC	0x2
+#define IPV6_FORWARDING		0x02
+#define IPV6_REDIRECT		0x08
+#define IPV6_FORWARDING_IPSEC	0x10
 #define ip6s_cantforward	0
 #define ip6stat_inc(c)		do { } while (0)
 
@@ -996,4 +1182,20 @@ void pf_update_state_timeout(struct pf_state *, int);
 
 void pfk_mod_init_done(void);
 
+/* pf.c entry points that are non-static upstream but have no header
+ * prototype at this include order (-Wmissing-prototypes). */
+struct pf_anchor_stackframe;
+struct pf_anchor;
+struct pf_ruleset;
+void	pf_anchor_stack_init(void);
+int	pf_anchor_stack_is_full(struct pf_anchor_stackframe *);
+int	pf_anchor_stack_is_empty(struct pf_anchor_stackframe *);
+struct pf_anchor_stackframe *pf_anchor_stack_top(void);
+int	pf_anchor_stack_push(struct pf_ruleset *, struct pf_rule *,
+	    struct pf_rule *, struct pf_anchor *, int);
+int	pf_anchor_stack_pop(struct pf_ruleset **, struct pf_rule **,
+	    struct pf_rule **, struct pf_anchor **, int *);
+struct inpcb;
+void	pf_remove_divert_state(struct inpcb *);
+
 #endif /* _PFK_H */

module/include/pfk_if.h

@@ -86,13 +86,16 @@ struct pfk_ifnet *pfk_if_next(struct pfk_ifnet *ifp);
 struct pfk_ifnet *pfk_if_next_from(int *idp);
 struct net_device *ip_rt_get_default_dev(struct net *net);
 
-/* xmit API used by pf_route/pf output (implemented in pfk_xmit.c) */
+/* xmit API used by pf_route/pf output (implemented in pfk_xmit.c).
+ * PFLINUX: `dst` is void * so BSD accessor macros (sintosa/sin6tosa,
+ * which keep the sockaddr_in/sockaddr_in6 type for field access) can be
+ * passed directly, as staged pf.c does. */
 int if_output_tso(struct pfk_ifnet *ifp, struct mbuf **mp,
-	struct sockaddr *dst, void *rt, int mtu);
+	void *dst, void *rt, int mtu);
 int if_output_ml(struct pfk_ifnet *ifp, struct mbuf_list *ml,
-	struct sockaddr *dst, void *rt);
+	void *dst, void *rt);
 int if_enqueue(struct pfk_ifnet *ifp, struct mbuf *m);
-int pfk_if_output(struct pfk_ifnet *ifp, struct mbuf *m, struct sockaddr *dst, void *rt);
+int pfk_if_output(struct pfk_ifnet *ifp, struct mbuf *m, void *dst, void *rt);
 
 /* addr lookups (ifa_ifwithaddr, in_ifwithaddr etc.) */
 struct ifaddr *pfk_ifwithaddr(const struct sockaddr *sa);

module/include/pfk_mbuf.h

@@ -91,6 +91,26 @@ struct pkthdr {
 #define M_BCAST		0x0020
 #define M_MCAST		0x0040
 #define M_LOOP		0x0080
+/* m_pkthdr.csum_flags bits (OpenBSD <sys/mbuf.h> names, port values).
+ * PFLINUX: the port does not trust driver offload yet; ingress packets get
+ * no IN_OK bit and pf.c re-checksums in software (pf_check_tcp_cksum). */
+#define M_TCP_CSUM_IN_OK	0x0001
+#define M_TCP_CSUM_IN_BAD	0x0002
+#define M_TCP_CSUM_OUT		0x0004
+#define M_UDP_CSUM_IN_OK	0x0010
+#define M_UDP_CSUM_IN_BAD	0x0020
+#define M_UDP_CSUM_OUT		0x0040
+#define M_ICMP_CSUM_OUT		0x0100
+#define M_IPV4_CSUM_OUT		0x0200
+#define M_FLOWID		0x0400
+/* m_copym/m_dup "copy everything" length (OpenBSD <sys/mbuf.h>) */
+#ifndef M_COPYALL
+#define M_COPYALL		1000000000
+#endif
+/* BSD M_PREPEND (OpenBSD <sys/mbuf.h>): m = m_prepend(m, h, f) */
+#ifndef M_PREPEND
+#define M_PREPEND(m, h, f)	((m) = m_prepend((m), (h), (f)))
+#endif
 #define M_SKIP_FIREWALL	0x0100
 #define M_BPF_MCAST	0x0200
 #define M_PROMISC	0x0400
@@ -127,6 +147,9 @@ void  pfk_m_setpkthdr(struct mbuf *m);
 
 struct mbuf *m_copym(struct mbuf *m, int off, int len, int wait);
 struct mbuf *m_dup(struct mbuf *m, int wait);	/* full dup + headroom */
+struct mbuf *m_prepend(struct mbuf *m, int len, int how);
+struct mbuf *m_split(struct mbuf *m, int len, int flags);
+struct mbuf *m_dup_pkt(struct mbuf *m, u_int hdr, int how);
 #define m_copypacket(m, w) m_copym((m), 0, 0, (w))
 void  m_adj(struct mbuf *m, int dlen);
 void  m_trim(struct mbuf *m, int dlen);

module/include/pfk_net.h

@@ -83,12 +83,19 @@ struct pf_icmp {
 		__be16	ih_id[2];	/* id, seq */
 		struct { __u8 type, code; __be16 cksum; } ih_type_hdr;
 		__be32	ih_gwaddr;
+		__u8	ih_pptr;	/* ICMP_PARAMPROB pointer byte */
+		__be32	ih_void;
+		struct { __be16 ipm_void; __be16 ipm_nextmtu; } ih_pmtu;
 		struct ih_frags { __be16 ih_rrechk; __be16 ih_length; } ih_frag;
 	} icmp_hun;
 #define	icmp_id		icmp_hun.ih_id[0]
 #define icmp_seq	icmp_hun.ih_id[1]
 #define icmp_cksum_alt	icmp_hun.ih_type_hdr.cksum
 #define icmp_gwaddr	icmp_hun.ih_gwaddr
+#define icmp_pptr	icmp_hun.ih_pptr
+#define icmp_void	icmp_hun.ih_void
+#define icmp_pmvoid	icmp_hun.ih_pmtu.ipm_void
+#define icmp_nextmtu	icmp_hun.ih_pmtu.ipm_nextmtu
 	union {
 		__s8	id_pad[8];
 		__be16		id_ipid[2];
@@ -136,8 +143,31 @@ struct pf_icmp {
 #define ICMP_ADDRESS		17
 #define ICMP_ADDRESSREPLY	18
 #define ICMP_MAXTYPE		18
+/* OpenBSD <netinet/ip_icmp.h> additional type/code constants (values are
+ * RFC/IANA-frozen; names as used by pf.c). */
+#define ICMP_IREQ		15	/* information request */
+#define ICMP_IREQREPLY		16	/* information reply */
+#define ICMP_MASKREQ		17	/* address mask request */
+#define ICMP_MASKREPLY		18	/* address mask reply */
+#define ICMP_IPV6_WHEREAREYOU	33	/* IPv6 where-are-you */
+#define ICMP_IPV6_IAMHERE	34	/* IPv6 i-am-here */
+#define ICMP_MOBILE_REGREQUEST	35	/* mobile registration req */
+#define ICMP_MOBILE_REGREPLY	36	/* mobile registration reply */
+#define ICMP_MINLEN		8	/* abs minimum */
+#define ICMP_PARAMPROB_ERRATPTR	0	/* error at indicated pointer */
+#define ICMP_PARAMPROB_OPTABSENT 1	/* req. opt. absent */
+#define ICMP_PARAMPROB_LENGTH	2	/* bad length */
+#define ICMP_ECHOREQUEST	ICMP_ECHO
+#define ICMP_INFOTYPE(type) \
+	((type) == ICMP_ECHOREPLY || (type) == ICMP_ECHO || \
+	(type) == ICMP_ROUTERADVERT || (type) == ICMP_ROUTERSOLICIT || \
+	(type) == ICMP_TSTAMP || (type) == ICMP_TSTAMPREPLY || \
+	(type) == ICMP_IREQ || (type) == ICMP_IREQREPLY || \
+	(type) == ICMP_MASKREQ || (type) == ICMP_MASKREPLY)
 
 /* ---- IPv6 (OpenBSD <netinet/ip6.h> ctl-union + macros) ---- */
+#define IPV6_DEFHLIM	64	/* default hop limit */
+#define IPV6_HLIMDEC	1	/* subtracted when forwarding */
 struct pf_ip6_hdr {
 	union {
 		struct ip6_hdrctl {
@@ -146,10 +176,12 @@ struct pf_ip6_hdr {
 			__u8 ip6_un1_nxt;
 			__u8 ip6_un1_hlim;
 		} ip6_un1;
+		__u8 ip6_un2_vfc;	/* version << 4 | tclass >> 4 */
 	} ip6_ctlun;
 	struct in6_addr ip6_src;
 	struct in6_addr ip6_dst;
 };
+#define ip6_vfc		ip6_ctlun.ip6_un2_vfc
 #define ip6_flow	ip6_ctlun.ip6_un1->ip6_un1_flow
 #define ip6_plen	ip6_ctlun.ip6_un1.ip6_un1_plen
 #define ip6_nxt		ip6_ctlun.ip6_un1.ip6_un1_nxt
@@ -189,6 +221,7 @@ struct pf_icmp6 {
 			__be16	icmp6_seq;
 		} un_h;
 	} icmp6_dataun;
+#define icmp6_pptr	icmp6_dataun.un_data32[0]	/* parameter prob */
 };
 #define icmp6_id	icmp6_dataun.un_h.icmp6_id
 #define icmp6_seq	icmp6_dataun.un_h.icmp6_seq
@@ -220,4 +253,81 @@ __sum16 pfk_icmp6_cksum(const struct pf_ip6_hdr *ip6,
 void pfk_send_icmp_error(int family, struct sk_buff *skb_in, int type,
 	int code, __be32 info);
 
+/* ---- IPv6 extension/option headers (OpenBSD <netinet/ip6.h>) ---- */
+struct ip6_opt {
+	__u8	ip6o_type;
+	__u8	ip6o_len;
+};
+#define IP6OPT_PAD1		0x00
+#define IP6OPT_PADN		0x01
+#define IP6OPT_JUMBO		0xC2
+#define IP6OPT_ROUTER_ALERT	0x05
+#define IP6OPT_MINLEN		2
+struct ip6_opt_jumbo {
+	__u8	ip6oj_type;
+	__u8	ip6oj_len;
+	__u8	ip6oj_jumbo_len[4];
+};
+#define IP6OPT_JUMBO_LEN	6
+struct ip6_opt_router {
+	__u8	ip6or_type;
+	__u8	ip6or_len;
+	__u8	ip6or_value[2];
+};
+struct ip6_rthdr {
+	__u8	ip6r_nxt;
+	__u8	ip6r_len;
+	__u8	ip6r_type;
+	__u8	ip6r_segleft;
+};
+#define IPV6_RTHDR_TYPE_0	0
+struct ip6_rthdr0 {
+	__u8	ip6r0_nxt;
+	__u8	ip6r0_len;
+	__u8	ip6r0_type;
+	__u8	ip6r0_segleft;
+	__u32	ip6r0_reserved;
+};
+
+/* ---- ICMPv6 types/codes (OpenBSD <netinet/icmp6.h>, RFC-frozen values) ---- */
+#define ICMP6_PARAM_PROB		 4
+#define ICMP6_WRUREQUEST		 139	/* who-are-you / NI query */
+#define ICMP6_WRUREPLY			 140
+#define ICMP6_NI_QUERY			 139
+#define ICMP6_NI_REPLY			 140
+#define ICMP6_MAXTYPE			 201
+#define ICMP6_DST_UNREACH_NOROUTE	 0
+#define ICMP6_DST_UNREACH_ADMIN		 1
+#define ICMP6_DST_UNREACH_BEYONDSCOPE	 2
+#define ICMP6_DST_UNREACH_ADDR		 3
+#define ICMP6_DST_UNREACH_NOPORT		 4
+#define ICMP6_TIME_EXCEED_TRANSIT	 0
+#define ICMP6_TIME_EXCEED_REASSEMBLY	 1
+#define ICMP6_PARAMPROB_HEADER		 0
+#define ICMP6_PARAMPROB_NEXTHEADER	 1
+#define ICMP6_PARAMPROB_OPTION		 2
+#define MLD_LISTENER_QUERY		 130
+#define MLD_LISTENER_REPORT		 131
+#define MLD_LISTENER_DONE		 132
+#define MLDV2_LISTENER_REPORT		 143
+#define MLD_MTRACE_RESP			 200
+#define MLD_MTRACE			 201
+#define ND_ROUTER_SOLICIT		 133
+#define ND_ROUTER_ADVERT		 134
+#define ND_NEIGHBOR_SOLICIT		 135
+#define ND_NEIGHBOR_ADVERT		 136
+#define ND_REDIRECT			 137
+
+/* ---- TCP (OpenBSD <netinet/tcp.h>/<netinet/tcp_var.h>/<netinet/tcp_seq.h>) */
+#define TCP_NSTATES		11	/* netinet/tcp_fsm.h */
+#define TCP_MAXWIN		65535	/* max value for (unscaled) window */
+#define TCP_MAX_WINSHIFT	14	/* max window shift */
+#define TCPOPT_SACK		5
+#define TCPOLEN_SACK		8	/* 2*sizeof(tcp_seq) */
+struct sackblk {
+	__u32	start;		/* start seq no. of sack block */
+	__u32	end;		/* end seq no. */
+};
+typedef __u32 tcp_seq;
+
 #endif /* _PFK_NET_H */