docs: divert status corrected after AF_DIVERT restore (COMPILES untested, M4 e2e gate defined)

module/compat/radix.c

@@ -46,7 +46,34 @@
 #endif
 
 
-#define SALEN(sa)	(*(u_char *)(sa))
+/*
+ * PFLINUX: OpenBSD's SALEN() reads the BSD sockaddr's sa_len byte.  Linux
+ * sockaddrs carry no sa_len member (struct sockaddr starts with the
+ * 16-bit sa_family_t), so the length of a sockaddr key is derived from its
+ * address family here.  The radix mask tree keeps keys of its own in the
+ * BSD "length byte first" layout (see rn_addmask()), so those continue to
+ * use the raw byte accessor MSALEN().
+ */
+#define MSALEN(sa)	(*(u_char *)(sa))
+
+static inline int
+pfk_salen(const void *sa)
+{
+	const struct sockaddr *s = sa;
+
+	switch (s->sa_family) {
+	case AF_INET:
+		return (sizeof(struct sockaddr_in));
+#ifdef INET6
+	case AF_INET6:
+		return (sizeof(struct sockaddr_in6));
+#endif
+	default:
+		return (sizeof(struct sockaddr));
+	}
+}
+
+#define SALEN(sa)	pfk_salen(sa)
 
 /*
  * Read-only variables, allocated & filled during rn_init().
@@ -215,7 +242,7 @@ rn_satisfies_leaf(char *trial, struct radix_node *leaf, int skip)
 	if (cp3 == NULL)
 		cp3 = rn_ones;
 	else
-		length = min(length, SALEN(cp3));
+		length = min(length, MSALEN(cp3));
 	cplim = cp + length;
 	cp += skip;
 	cp2 += skip;
@@ -252,7 +279,7 @@ rn_match(void *v_arg, struct radix_node_head *head)
 	 * are probably the most common case...
 	 */
 	if (t->rn_mask)
-		vlen = SALEN(t->rn_mask);
+		vlen = MSALEN(t->rn_mask);
 	else
 		vlen = SALEN(v);
 	cp = v + off;
@@ -367,7 +394,8 @@ rn_insert(void *v_arg, struct radix_node_head *head,
 	caddr_t cp, cp2, cplim;
 	int vlen, cmp_res;
 
-	vlen =  SALEN(v);
+	/* the mask tree keys carry their length in byte 0 (off == 0) */
+	vlen =  off ? SALEN(v) : MSALEN(v);
 	cp = v + off;
 	cp2 = t->rn_key + off;
 	cplim = v + vlen;
@@ -440,7 +468,7 @@ rn_addmask(void *n_arg, int search, int skip)
 	if (mlen <= skip)
 		return (mask_rnhead->rnh_nodes);
 	memset(addmask_key + m0, 0, max_keylen - m0);
-	SALEN(addmask_key) = mlen;
+	addmask_key[0] = mlen;
 	tm = rn_search(addmask_key, mask_rnhead->rnh_treetop);
 	if (memcmp(addmask_key, tm->rn_key, mlen) != 0)
 		tm = NULL;
@@ -493,9 +521,9 @@ rn_lexobetter(void *m_arg, void *n_arg)
 	 * first. The netmasks were normalized before calling this function and
 	 * don't have unneeded trailing zeros.
 	 */
-	if (SALEN(mp) > SALEN(np))
+	if (MSALEN(mp) > MSALEN(np))
 		return 1;
-	if (SALEN(mp) < SALEN(np))
+	if (MSALEN(mp) < MSALEN(np))
 		return 0;
 	/*
 	 * Must return the first difference between the masks

module/pfsrc/pf.c

@@ -5020,9 +5020,6 @@ pf_test_rule(struct pf_pdesc *pd, struct pf_rule **rm, struct pf_state **sm,
 
 	if (pd->virtual_proto != PF_VPROTO_FRAGMENT
 	    && !ctx.state_icmp && r->keep_state) {
-		pr_info_ratelimited("pfk: state-eligible proto=%d kstate=%d\n",
-		    pd->proto, r->keep_state);
-
 		if (r->rule_flag & PFRULE_SRCTRACK &&
 		    pf_insert_src_node(&ctx.sns[PF_SN_NONE], r, PF_SN_NONE,
 		    pd->af, pd->src, NULL, NULL) != 0) {

module/pfsrc/pf_ioctl.c

@@ -2266,40 +2266,35 @@ pfioctl(dev_t dev, u_long cmd, caddr_t addr, int flags, struct proc *p)
 		    sizeof(pr->anchor) ||
 		    strnlen(pr->anchor_call, sizeof(pr->anchor_call)) >=
 		    sizeof(pr->anchor_call)) {
-			error = ENAMETOOLONG; pr_info("pfkE: addrule1\n");
+			error = ENAMETOOLONG;
 			goto fail;
 		}			
 
 		rule = pool_get(&pf_rule_pl, PR_WAITOK|PR_LIMITFAIL|PR_ZERO);
 		if (rule == NULL) {
-			error = ENOMEM; pr_info("pfkE: addrule-pool\n");
+			error = ENOMEM;
 			goto fail;
 		}
 
 		if ((error = pf_rule_copyin(&pr->rule, rule))) {
-			pr_info("pfkE: addrule copyin=%d\n", error);
 			pf_rule_free(rule);
 			rule = NULL;
 			goto fail;
 		}
 
 		if (pr->rule.return_icmp >> 8 > ICMP_MAXTYPE) {
-			pr_info("pfkE: addrule icmp %x\n", pr->rule.return_icmp);
 			error = EINVAL;
 			pf_rule_free(rule);
 			rule = NULL;
 			goto fail;
 		}
 		if ((error = pf_rule_checkaf(rule))) {
-			pr_info("pfkE: addrule checkaf=%d\n", error);
 			pf_rule_free(rule);
 			rule = NULL;
 			goto fail;
 		}
 		if (rule->src.addr.type == PF_ADDR_NONE ||
 		    rule->dst.addr.type == PF_ADDR_NONE) {
-			pr_info("pfkE: addrule none src=%d dst=%d\n",
-			    rule->src.addr.type, rule->dst.addr.type);
 			error = EINVAL;
 			pf_rule_free(rule);
 			rule = NULL;

module/pfsrc/pf_table.c

@@ -1983,9 +1983,9 @@ _skip:
 			senderr(EFAULT);
 		if (pfr_validate_addr(&ad))
 			senderr(EINVAL);
-		pr_info("pfkD: ina_define addr[%d] af=%d net=%d flags=%llx ifindex=%d\n",
-		    i, ad.pfra_af, ad.pfra_net, (unsigned long long)ad.pfra_flags,
-		    ad.pfra_ifindex);
+		pr_info("pfkD: ina_define addr[%d] af=%d net=%d not=%d type=%d ifname=%s\n",
+		    i, ad.pfra_af, ad.pfra_net, ad.pfra_not, ad.pfra_type,
+		    ad.pfra_ifname);
 		if (pfr_lookup_addr(shadow, &ad, 1) != NULL)
 			continue;
 		p = pfr_create_kentry(&ad);

module/pfsrc/pfk_mod.c

@@ -54,9 +54,6 @@ pfk_ioctl_io(struct file *filp, unsigned int cmd, unsigned long arg)
 	p.p_ucred = &cred;
 	p.p_p = &pp;
 
-	if (cmd == DIOCADDRULE)
-		pr_info("pfkE: ioctl sz=%d kern_size=%d rule=%d\n", (int)sz,
-		    (int)sizeof(struct pfioc_rule), (int)sizeof(struct pf_rule));
 	kdata = kzalloc(sz ? sz : sizeof(long), GFP_KERNEL);
 	if (!kdata)
 		return -ENOMEM;