xnu-3789.31.2.tar.gz

[apple/xnu.git] / bsd / net / pfvar.h

diff --git a/bsd/net/pfvar.h b/bsd/net/pfvar.h
index fc35db9e733e45351c0c524c223bdbba65f4585f..11e771bf51f9ed3f16607c42c808580cb0f8cc7e 100644 (file)
--- a/bsd/net/pfvar.h
+++ b/bsd/net/pfvar.h
@@ -1,5 +1,5 @@
 /*
 /*

- * Copyright (c) 2007-2009 Apple Inc. All rights reserved.
+ * Copyright (c) 2007-2015 Apple Inc. All rights reserved.

  *
  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
  *
  *
  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
  *


@@ -31,6 +31,7 @@
 
 /*
  * Copyright (c) 2001 Daniel Hartmeier
 
 /*
  * Copyright (c) 2001 Daniel Hartmeier

+ * NAT64 - Copyright (c) 2010 Viagenie Inc. (http://www.viagenie.ca)

  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without


@@ -74,22 +75,22 @@
 extern "C" {
 #endif
 
 extern "C" {
 #endif
 

+#include <stdbool.h>

 #include <sys/param.h>
 #include <sys/types.h>
 #include <sys/queue.h>
 #include <sys/param.h>
 #include <sys/types.h>
 #include <sys/queue.h>

-#include <sys/tree.h>
+#include <libkern/tree.h>

 
 #include <net/radix.h>
 #include <netinet/in.h>
 
 #include <net/radix.h>
 #include <netinet/in.h>

-
+#include <net/if_var.h>

 #ifdef KERNEL
 #include <kern/kern_types.h>
 #include <kern/zalloc.h>
 #ifdef KERNEL
 #include <kern/kern_types.h>
 #include <kern/zalloc.h>

-#include <kern/lock.h>
+#include <kern/locks.h>

 
 #include <machine/endian.h>
 #include <sys/systm.h>
 
 #include <machine/endian.h>
 #include <sys/systm.h>

-#include <net/pf_mtag.h>

 
 #if BYTE_ORDER == BIG_ENDIAN
 #define        htobe64(x)      (x)
 
 #if BYTE_ORDER == BIG_ENDIAN
 #define        htobe64(x)      (x)


@@ -99,8 +100,8 @@ extern "C" {
 
 #define        be64toh(x)      htobe64(x)
 
 
 #define        be64toh(x)      htobe64(x)
 

-__private_extern__ lck_rw_t *pf_perim_lock;
-__private_extern__ lck_mtx_t *pf_lock;
+extern lck_rw_t *pf_perim_lock;
+extern lck_mtx_t *pf_lock;

 
 struct pool {
        struct zone     *pool_zone;     /* pointer to backend zone */
 
 struct pool {
        struct zone     *pool_zone;     /* pointer to backend zone */


@@ -146,17 +147,19 @@ union sockaddr_union {
 struct ip;
 struct ip6_hdr;
 struct tcphdr;
 struct ip;
 struct ip6_hdr;
 struct tcphdr;

-#ifndef NO_APPLE_EXTENSIONS

 struct pf_grev1_hdr;
 struct pf_esp_hdr;
 struct pf_grev1_hdr;
 struct pf_esp_hdr;

-#endif /* !NO_APPLE_EXTENSIONS */

 #endif /* KERNEL */
 
 #endif /* KERNEL */
 

+#define PF_GRE_PPTP_VARIANT    0x01
+

 enum   { PF_INOUT, PF_IN, PF_OUT };
 enum   { PF_PASS, PF_DROP, PF_SCRUB, PF_NOSCRUB, PF_NAT, PF_NONAT,
 enum   { PF_INOUT, PF_IN, PF_OUT };
 enum   { PF_PASS, PF_DROP, PF_SCRUB, PF_NOSCRUB, PF_NAT, PF_NONAT,

-         PF_BINAT, PF_NOBINAT, PF_RDR, PF_NORDR, PF_SYNPROXY_DROP };
+         PF_BINAT, PF_NOBINAT, PF_RDR, PF_NORDR, PF_SYNPROXY_DROP,
+         PF_DUMMYNET, PF_NODUMMYNET, PF_NAT64, PF_NONAT64 };

 enum   { PF_RULESET_SCRUB, PF_RULESET_FILTER, PF_RULESET_NAT,
 enum   { PF_RULESET_SCRUB, PF_RULESET_FILTER, PF_RULESET_NAT,

-         PF_RULESET_BINAT, PF_RULESET_RDR, PF_RULESET_MAX };
+         PF_RULESET_BINAT, PF_RULESET_RDR, PF_RULESET_DUMMYNET, 
+         PF_RULESET_MAX };

 enum   { PF_OP_NONE, PF_OP_IRG, PF_OP_EQ, PF_OP_NE, PF_OP_LT,
          PF_OP_LE, PF_OP_GT, PF_OP_GE, PF_OP_XRG, PF_OP_RRG };
 enum   { PF_DEBUG_NONE, PF_DEBUG_URGENT, PF_DEBUG_MISC, PF_DEBUG_NOISY };
 enum   { PF_OP_NONE, PF_OP_IRG, PF_OP_EQ, PF_OP_NE, PF_OP_LT,
          PF_OP_LE, PF_OP_GT, PF_OP_GE, PF_OP_XRG, PF_OP_RRG };
 enum   { PF_DEBUG_NONE, PF_DEBUG_URGENT, PF_DEBUG_MISC, PF_DEBUG_NOISY };


@@ -173,15 +176,12 @@ enum      { PFTM_TCP_FIRST_PACKET, PFTM_TCP_OPENING, PFTM_TCP_ESTABLISHED,
          PFTM_TCP_CLOSING, PFTM_TCP_FIN_WAIT, PFTM_TCP_CLOSED,
          PFTM_UDP_FIRST_PACKET, PFTM_UDP_SINGLE, PFTM_UDP_MULTIPLE,
          PFTM_ICMP_FIRST_PACKET, PFTM_ICMP_ERROR_REPLY,
          PFTM_TCP_CLOSING, PFTM_TCP_FIN_WAIT, PFTM_TCP_CLOSED,
          PFTM_UDP_FIRST_PACKET, PFTM_UDP_SINGLE, PFTM_UDP_MULTIPLE,
          PFTM_ICMP_FIRST_PACKET, PFTM_ICMP_ERROR_REPLY,

-#ifndef NO_APPLE_EXTENSIONS
-         PFTM_GREv1_FIRST_PACKET, PFTM_GREv1_INITIATING, PFTM_GREv1_ESTABLISHED,
-         PFTM_ESP_FIRST_PACKET, PFTM_ESP_INITIATING, PFTM_ESP_ESTABLISHED,
-#endif /* !NO_APPLE_EXTENSIONS */
-         PFTM_OTHER_FIRST_PACKET, PFTM_OTHER_SINGLE,
+         PFTM_GREv1_FIRST_PACKET, PFTM_GREv1_INITIATING,
+         PFTM_GREv1_ESTABLISHED, PFTM_ESP_FIRST_PACKET, PFTM_ESP_INITIATING,
+         PFTM_ESP_ESTABLISHED, PFTM_OTHER_FIRST_PACKET, PFTM_OTHER_SINGLE,

          PFTM_OTHER_MULTIPLE, PFTM_FRAG, PFTM_INTERVAL,
          PFTM_ADAPTIVE_START, PFTM_ADAPTIVE_END, PFTM_SRC_NODE,
          PFTM_OTHER_MULTIPLE, PFTM_FRAG, PFTM_INTERVAL,
          PFTM_ADAPTIVE_START, PFTM_ADAPTIVE_END, PFTM_SRC_NODE,

-         PFTM_TS_DIFF, PFTM_MAX, PFTM_PURGE, PFTM_UNLINKED,
-         PFTM_UNTIL_PACKET };
+         PFTM_TS_DIFF, PFTM_MAX, PFTM_PURGE, PFTM_UNLINKED };

 
 /* PFTM default values */
 #define PFTM_TCP_FIRST_PACKET_VAL      120     /* First TCP packet */
 
 /* PFTM default values */
 #define PFTM_TCP_FIRST_PACKET_VAL      120     /* First TCP packet */


@@ -195,14 +195,12 @@ enum      { PFTM_TCP_FIRST_PACKET, PFTM_TCP_OPENING, PFTM_TCP_ESTABLISHED,
 #define PFTM_UDP_MULTIPLE_VAL          60      /* Bidirectional */
 #define PFTM_ICMP_FIRST_PACKET_VAL     20      /* First ICMP packet */
 #define PFTM_ICMP_ERROR_REPLY_VAL      10      /* Got error response */
 #define PFTM_UDP_MULTIPLE_VAL          60      /* Bidirectional */
 #define PFTM_ICMP_FIRST_PACKET_VAL     20      /* First ICMP packet */
 #define PFTM_ICMP_ERROR_REPLY_VAL      10      /* Got error response */

-#ifndef NO_APPLE_EXTENSIONS

 #define PFTM_GREv1_FIRST_PACKET_VAL    120
 #define PFTM_GREv1_INITIATING_VAL      30
 #define PFTM_GREv1_ESTABLISHED_VAL     1800
 #define PFTM_ESP_FIRST_PACKET_VAL      120
 #define PFTM_ESP_INITIATING_VAL                30
 #define PFTM_ESP_ESTABLISHED_VAL       900
 #define PFTM_GREv1_FIRST_PACKET_VAL    120
 #define PFTM_GREv1_INITIATING_VAL      30
 #define PFTM_GREv1_ESTABLISHED_VAL     1800
 #define PFTM_ESP_FIRST_PACKET_VAL      120
 #define PFTM_ESP_INITIATING_VAL                30
 #define PFTM_ESP_ESTABLISHED_VAL       900

-#endif /* !NO_APPLE_EXTENSIONS */

 #define PFTM_OTHER_FIRST_PACKET_VAL    60      /* First packet */
 #define PFTM_OTHER_SINGLE_VAL          30      /* Unidirectional */
 #define PFTM_OTHER_MULTIPLE_VAL                60      /* Bidirectional */
 #define PFTM_OTHER_FIRST_PACKET_VAL    60      /* First packet */
 #define PFTM_OTHER_SINGLE_VAL          30      /* Unidirectional */
 #define PFTM_OTHER_MULTIPLE_VAL                60      /* Bidirectional */


@@ -213,9 +211,7 @@ enum        { PFTM_TCP_FIRST_PACKET, PFTM_TCP_OPENING, PFTM_TCP_ESTABLISHED,
 
 enum   { PF_NOPFROUTE, PF_FASTROUTE, PF_ROUTETO, PF_DUPTO, PF_REPLYTO };
 enum   { PF_LIMIT_STATES,
 
 enum   { PF_NOPFROUTE, PF_FASTROUTE, PF_ROUTETO, PF_DUPTO, PF_REPLYTO };
 enum   { PF_LIMIT_STATES,

-#ifndef NO_APPLE_EXTENSIONS

          PF_LIMIT_APP_STATES,
          PF_LIMIT_APP_STATES,

-#endif /* !NO_APPLE_EXTENSIONS */

          PF_LIMIT_SRC_NODES, PF_LIMIT_FRAGS,
          PF_LIMIT_TABLES, PF_LIMIT_TABLE_ENTRIES, PF_LIMIT_MAX };
 #define PF_POOL_IDMASK         0x0f
          PF_LIMIT_SRC_NODES, PF_LIMIT_FRAGS,
          PF_LIMIT_TABLES, PF_LIMIT_TABLE_ENTRIES, PF_LIMIT_MAX };
 #define PF_POOL_IDMASK         0x0f


@@ -286,7 +282,6 @@ struct pf_addr_wrap {
        u_int8_t                 iflags;        /* PFI_AFLAG_* */
 };
 
        u_int8_t                 iflags;        /* PFI_AFLAG_* */
 };
 

-#ifndef NO_APPLE_EXTENSIONS

 struct pf_port_range {
        u_int16_t                       port[2];
        u_int8_t                        op;
 struct pf_port_range {
        u_int16_t                       port[2];
        u_int8_t                        op;


@@ -297,7 +292,6 @@ union pf_rule_xport {
        u_int16_t               call_id;
        u_int32_t               spi;
 };
        u_int16_t               call_id;
        u_int32_t               spi;
 };

-#endif /* !NO_APPLE_EXTENSIONS */

 
 #ifdef KERNEL
 struct pfi_dynaddr {
 
 #ifdef KERNEL
 struct pfi_dynaddr {


@@ -361,6 +355,13 @@ struct pfi_dynaddr {
        (a)->addr32[1] != (b)->addr32[1] || \
        (a)->addr32[0] != (b)->addr32[0])) \
 
        (a)->addr32[1] != (b)->addr32[1] || \
        (a)->addr32[0] != (b)->addr32[0])) \
 

+#define PF_ALEQ(a, b, c) \
+       ((c == AF_INET && (a)->addr32[0] <= (b)->addr32[0]) || \
+       ((a)->addr32[3] <= (b)->addr32[3] && \
+       (a)->addr32[2] <= (b)->addr32[2] && \
+       (a)->addr32[1] <= (b)->addr32[1] && \
+       (a)->addr32[0] <= (b)->addr32[0])) \
+

 #define PF_AZERO(a, c) \
        ((c == AF_INET && !(a)->addr32[0]) || \
        (!(a)->addr32[0] && !(a)->addr32[1] && \
 #define PF_AZERO(a, c) \
        ((c == AF_INET && !(a)->addr32[0]) || \
        (!(a)->addr32[0] && !(a)->addr32[1] && \


@@ -396,6 +397,12 @@ struct pfi_dynaddr {
        (a)->addr32[1] != (b)->addr32[1] || \
        (a)->addr32[0] != (b)->addr32[0]) \
 
        (a)->addr32[1] != (b)->addr32[1] || \
        (a)->addr32[0] != (b)->addr32[0]) \
 

+#define PF_ALEQ(a, b, c) \
+       ((a)->addr32[3] <= (b)->addr32[3] && \
+       (a)->addr32[2] <= (b)->addr32[2] && \
+       (a)->addr32[1] <= (b)->addr32[1] && \
+       (a)->addr32[0] <= (b)->addr32[0]) \
+

 #define PF_AZERO(a, c) \
        (!(a)->addr32[0] && \
        !(a)->addr32[1] && \
 #define PF_AZERO(a, c) \
        (!(a)->addr32[0] && \
        !(a)->addr32[1] && \


@@ -425,6 +432,9 @@ struct pfi_dynaddr {
 #define PF_ANEQ(a, b, c) \
        ((a)->addr32[0] != (b)->addr32[0])
 
 #define PF_ANEQ(a, b, c) \
        ((a)->addr32[0] != (b)->addr32[0])
 

+#define PF_ALEQ(a, b, c) \
+       ((a)->addr32[0] <= (b)->addr32[0])
+

 #define PF_AZERO(a, c) \
        (!(a)->addr32[0])
 
 #define PF_AZERO(a, c) \
        (!(a)->addr32[0])
 


@@ -487,14 +497,8 @@ struct pf_rule_gid {
 
 struct pf_rule_addr {
        struct pf_addr_wrap      addr;
 
 struct pf_rule_addr {
        struct pf_addr_wrap      addr;

-#ifndef NO_APPLE_EXTENSIONS

        union pf_rule_xport      xport;
        u_int8_t                 neg;
        union pf_rule_xport      xport;
        u_int8_t                 neg;

-#else /* NO_APPLE_EXTENSIONS */
-       u_int16_t                port[2];
-       u_int8_t                 neg;
-       u_int8_t                 port_op;
-#endif /* NO_APPLE_EXTENSIONS */

 };
 
 struct pf_pooladdr {
 };
 
 struct pf_pooladdr {


@@ -540,6 +544,7 @@ struct pf_pool {
        u_int16_t                proxy_port[2];
        u_int8_t                 port_op;
        u_int8_t                 opts;
        u_int16_t                proxy_port[2];
        u_int8_t                 port_op;
        u_int8_t                 opts;

+       sa_family_t              af;

 };
 
 
 };
 
 


@@ -690,6 +695,11 @@ struct pf_rule {
        u_int64_t                packets[2];
        u_int64_t                bytes[2];
 
        u_int64_t                packets[2];
        u_int64_t                bytes[2];
 

+       u_int64_t                ticket;
+#define PF_OWNER_NAME_SIZE      64
+       char                     owner[PF_OWNER_NAME_SIZE];
+       u_int32_t                priority;
+

 #ifdef KERNEL
        struct pfi_kif          *kif            __attribute__((aligned(8)));
 #else /* !KERNEL */
 #ifdef KERNEL
        struct pfi_kif          *kif            __attribute__((aligned(8)));
 #else /* !KERNEL */


@@ -757,6 +767,38 @@ struct pf_rule {
        u_int8_t                 allow_opts;
        u_int8_t                 rt;
        u_int8_t                 return_ttl;
        u_int8_t                 allow_opts;
        u_int8_t                 rt;
        u_int8_t                 return_ttl;

+
+/* service class categories */
+#define        SCIDX_MASK              0x0f
+#define        SC_BE                   0x10
+#define        SC_BK_SYS               0x11
+#define        SC_BK                   0x12
+#define        SC_RD                   0x13
+#define        SC_OAM                  0x14
+#define        SC_AV                   0x15
+#define        SC_RV                   0x16
+#define        SC_VI                   0x17
+#define        SC_VO                   0x18
+#define        SC_CTL                  0x19
+
+/* diffserve code points */
+#define        DSCP_MASK               0xfc
+#define        DSCP_CUMASK             0x03
+#define        DSCP_EF                 0xb8
+#define        DSCP_AF11               0x28
+#define        DSCP_AF12               0x30
+#define        DSCP_AF13               0x38
+#define        DSCP_AF21               0x48
+#define        DSCP_AF22               0x50
+#define        DSCP_AF23               0x58
+#define        DSCP_AF31               0x68
+#define        DSCP_AF32               0x70
+#define        DSCP_AF33               0x78
+#define        DSCP_AF41               0x88
+#define        DSCP_AF42               0x90
+#define        DSCP_AF43               0x98
+#define        AF_CLASSMASK            0xe0
+#define        AF_DROPPRECMASK         0x18

        u_int8_t                 tos;
        u_int8_t                 anchor_relative;
        u_int8_t                 anchor_wildcard;
        u_int8_t                 tos;
        u_int8_t                 anchor_relative;
        u_int8_t                 anchor_wildcard;


@@ -765,13 +807,18 @@ struct pf_rule {
 #define PF_FLUSH_GLOBAL                0x02
        u_int8_t                 flush;
 
 #define PF_FLUSH_GLOBAL                0x02
        u_int8_t                 flush;
 

-#ifndef NO_APPLE_EXTENSIONS

        u_int8_t                proto_variant;
        u_int8_t                extfilter; /* Filter mode [PF_EXTFILTER_xxx] */
        u_int8_t                proto_variant;
        u_int8_t                extfilter; /* Filter mode [PF_EXTFILTER_xxx] */

-       u_int8_t                extmap; /* Mapping mode [PF_EXTMAP_xxx] */
-#endif /* !NO_APPLE_EXTENSIONS */
+       u_int8_t                extmap;    /* Mapping mode [PF_EXTMAP_xxx] */
+       u_int32_t               dnpipe;
+       u_int32_t               dntype;

 };
 
 };
 

+/* pf device identifiers */
+#define PFDEV_PF               0
+#define PFDEV_PFM              1
+#define PFDEV_MAX              2
+

 /* rule flags */
 #define        PFRULE_DROP             0x0000
 #define        PFRULE_RETURNRST        0x0001
 /* rule flags */
 #define        PFRULE_DROP             0x0000
 #define        PFRULE_RETURNRST        0x0001


@@ -789,28 +836,32 @@ struct pf_rule {
 #define PFRULE_RANDOMID                0x0800
 #define PFRULE_REASSEMBLE_TCP  0x1000
 
 #define PFRULE_RANDOMID                0x0800
 #define PFRULE_REASSEMBLE_TCP  0x1000
 

+/* rule flags for TOS/DSCP/service class differentiation */
+#define        PFRULE_TOS              0x2000
+#define        PFRULE_DSCP             0x4000
+#define        PFRULE_SC               0x8000
+

 /* rule flags again */
 /* rule flags again */

-#define PFRULE_IFBOUND         0x00010000      /* if-bound */
+#define        PFRULE_IFBOUND          0x00010000      /* if-bound */
+#define        PFRULE_PFM              0x00020000      /* created by pfm device */

 
 

-#define PFSTATE_HIWAT          10000   /* default state table size */
-#define PFSTATE_ADAPT_START    6000    /* default adaptive timeout start */
-#define PFSTATE_ADAPT_END      12000   /* default adaptive timeout end */
+#define        PFSTATE_HIWAT           10000   /* default state table size */
+#define        PFSTATE_ADAPT_START     6000    /* default adaptive timeout start */
+#define        PFSTATE_ADAPT_END       12000   /* default adaptive timeout end */

 
 

-#ifndef NO_APPLE_EXTENSIONS
-#define PFAPPSTATE_HIWAT       10000   /* default same as state table */
+#define        PFAPPSTATE_HIWAT        10000   /* default same as state table */

 
 enum pf_extmap {
        PF_EXTMAP_APD   = 1,    /* Address-port-dependent mapping */
 
 enum pf_extmap {
        PF_EXTMAP_APD   = 1,    /* Address-port-dependent mapping */

-       PF_EXTMAP_AD,                   /* Address-dependent mapping */
-       PF_EXTMAP_EI                    /* Endpoint-independent mapping */
+       PF_EXTMAP_AD,           /* Address-dependent mapping */
+       PF_EXTMAP_EI            /* Endpoint-independent mapping */

 };
 
 enum pf_extfilter {
        PF_EXTFILTER_APD = 1,   /* Address-port-dependent filtering */
 };
 
 enum pf_extfilter {
        PF_EXTFILTER_APD = 1,   /* Address-port-dependent filtering */

-       PF_EXTFILTER_AD,                /* Address-dependent filtering */
-       PF_EXTFILTER_EI                 /* Endpoint-independent filtering */
+       PF_EXTFILTER_AD,        /* Address-dependent filtering */
+       PF_EXTFILTER_EI         /* Endpoint-independent filtering */

 };
 };

-#endif /* !NO_APPLE_EXTENSIONS */

 
 struct pf_threshold {
        u_int32_t       limit;
 
 struct pf_threshold {
        u_int32_t       limit;


@@ -862,7 +913,6 @@ struct pf_state_scrub {
 };
 #endif /* KERNEL */
 
 };
 #endif /* KERNEL */
 

-#ifndef NO_APPLE_EXTENSIONS

 union pf_state_xport {
        u_int16_t       port;
        u_int16_t       call_id;
 union pf_state_xport {
        u_int16_t       port;
        u_int16_t       call_id;


@@ -870,16 +920,9 @@ union pf_state_xport {
 };
 
 struct pf_state_host {
 };
 
 struct pf_state_host {

-       struct pf_addr                  addr;
+       struct pf_addr          addr;

        union pf_state_xport    xport;
 };
        union pf_state_xport    xport;
 };

-#else /* NO_APPLE_EXTENSIONS */
-struct pf_state_host {
-       struct pf_addr  addr;
-       u_int16_t       port;
-       u_int16_t       pad;
-};
-#endif /* NO_APPLE_EXTENSIONS */

 
 #ifdef KERNEL
 struct pf_state_peer {
 
 #ifdef KERNEL
 struct pf_state_peer {


@@ -896,10 +939,7 @@ struct pf_state_peer {
 };
 
 TAILQ_HEAD(pf_state_queue, pf_state);
 };
 
 TAILQ_HEAD(pf_state_queue, pf_state);

-#endif /* KERNEL */

 
 

-#ifndef NO_APPLE_EXTENSIONS
-#ifdef KERNEL

 struct pf_state;
 struct pf_pdesc;
 struct pf_app_state;
 struct pf_state;
 struct pf_pdesc;
 struct pf_app_state;


@@ -931,25 +971,19 @@ struct pf_app_state {
                struct pf_ike_state ike;
        } u;
 };
                struct pf_ike_state ike;
        } u;
 };

-#endif /* KERNEL */
-#define PF_GRE_PPTP_VARIANT    0x01
-#endif /* !NO_APPLE_EXTENSIONS */

 
 

-#ifdef KERNEL

 /* keep synced with struct pf_state, used in RB_FIND */
 struct pf_state_key_cmp {
        struct pf_state_host lan;
        struct pf_state_host gwy;
 /* keep synced with struct pf_state, used in RB_FIND */
 struct pf_state_key_cmp {
        struct pf_state_host lan;
        struct pf_state_host gwy;

-       struct pf_state_host ext;
-       sa_family_t      af;
+       struct pf_state_host ext_lan;
+       struct pf_state_host ext_gwy;
+       sa_family_t      af_lan;
+       sa_family_t      af_gwy;

        u_int8_t         proto;
        u_int8_t         direction;
        u_int8_t         proto;
        u_int8_t         direction;

-#ifndef NO_APPLE_EXTENSIONS

        u_int8_t         proto_variant;
        struct pf_app_state     *app_state;
        u_int8_t         proto_variant;
        struct pf_app_state     *app_state;

-#else /* NO_APPLE_EXTENSIONS */
-       u_int8_t         pad;
-#endif /* NO_APPLE_EXTENSIONS */

 };
 
 TAILQ_HEAD(pf_statelist, pf_state);
 };
 
 TAILQ_HEAD(pf_statelist, pf_state);


@@ -957,21 +991,21 @@ TAILQ_HEAD(pf_statelist, pf_state);
 struct pf_state_key {
        struct pf_state_host lan;
        struct pf_state_host gwy;
 struct pf_state_key {
        struct pf_state_host lan;
        struct pf_state_host gwy;

-       struct pf_state_host ext;
-       sa_family_t      af;
+       struct pf_state_host ext_lan;
+       struct pf_state_host ext_gwy;
+       sa_family_t      af_lan;
+       sa_family_t      af_gwy;

        u_int8_t         proto;
        u_int8_t         direction;
        u_int8_t         proto;
        u_int8_t         direction;

-#ifndef NO_APPLE_EXTENSIONS

        u_int8_t         proto_variant;
        struct pf_app_state     *app_state;
        u_int8_t         proto_variant;
        struct pf_app_state     *app_state;

-#else /* NO_APPLE_EXTENSIONS */
-       u_int8_t         pad;
-#endif /* NO_APPLE_EXTENSIONS */
+       u_int32_t        flowsrc;
+       u_int32_t        flowhash;

 
        RB_ENTRY(pf_state_key)   entry_lan_ext;
        RB_ENTRY(pf_state_key)   entry_ext_gwy;
        struct pf_statelist      states;
 
        RB_ENTRY(pf_state_key)   entry_lan_ext;
        RB_ENTRY(pf_state_key)   entry_ext_gwy;
        struct pf_statelist      states;

-       u_short          refcnt;        /* same size as if_index */
+       u_int32_t        refcnt;

 };
 
 
 };
 
 


@@ -981,6 +1015,14 @@ struct pf_state_cmp {
        u_int32_t        creatorid;
        u_int32_t        pad;
 };
        u_int32_t        creatorid;
        u_int32_t        pad;
 };

+
+/* flowhash key (12-bytes multiple for performance) */
+struct pf_flowhash_key {
+       struct pf_state_host    ap1;    /* address+port blob 1 */
+       struct pf_state_host    ap2;    /* address+port blob 2 */
+       u_int32_t               af;
+       u_int32_t               proto;
+};

 #endif /* KERNEL */
 
 struct hook_desc;
 #endif /* KERNEL */
 
 struct hook_desc;


@@ -1001,9 +1043,7 @@ struct pf_state {
        union pf_rule_ptr        anchor;
        union pf_rule_ptr        nat_rule;
        struct pf_addr           rt_addr;
        union pf_rule_ptr        anchor;
        union pf_rule_ptr        nat_rule;
        struct pf_addr           rt_addr;

-#ifndef NO_APPLE_EXTENSIONS
-       struct hook_desc_head unlink_hooks;
-#endif /* !NO_APPLE_EXTENSIONS */
+       struct hook_desc_head    unlink_hooks;

        struct pf_state_key     *state_key;
        struct pfi_kif          *kif;
        struct pfi_kif          *rt_kif;
        struct pf_state_key     *state_key;
        struct pfi_kif          *kif;
        struct pfi_kif          *rt_kif;


@@ -1041,14 +1081,9 @@ struct pfsync_state_scrub {
 } __packed;
 
 struct pfsync_state_host {
 } __packed;
 
 struct pfsync_state_host {

-       struct pf_addr  addr;
-#ifndef NO_APPLE_EXTENSIONS
+       struct pf_addr          addr;

        union pf_state_xport    xport;
        union pf_state_xport    xport;

-       u_int16_t       pad[2];
-#else /* NO_APPLE_EXTENSIONS */
-       u_int16_t       port;
-       u_int16_t       pad[3];
-#endif /* NO_APPLE_EXTENSIONS */
+       u_int16_t               pad[2];

 } __packed;
 
 struct pfsync_state_peer {
 } __packed;
 
 struct pfsync_state_peer {


@@ -1068,16 +1103,15 @@ struct pfsync_state {
        char             ifname[IFNAMSIZ];
        struct pfsync_state_host lan;
        struct pfsync_state_host gwy;
        char             ifname[IFNAMSIZ];
        struct pfsync_state_host lan;
        struct pfsync_state_host gwy;

-       struct pfsync_state_host ext;
+       struct pfsync_state_host ext_lan;
+       struct pfsync_state_host ext_gwy;

        struct pfsync_state_peer src;
        struct pfsync_state_peer dst;
        struct pf_addr   rt_addr;
        struct pfsync_state_peer src;
        struct pfsync_state_peer dst;
        struct pf_addr   rt_addr;

-#ifndef NO_APPLE_EXTENSIONS

        struct hook_desc_head unlink_hooks;
 #if !defined(__LP64__)
        u_int32_t       _pad[2];
 #endif /* !__LP64__ */
        struct hook_desc_head unlink_hooks;
 #if !defined(__LP64__)
        u_int32_t       _pad[2];
 #endif /* !__LP64__ */

-#endif /* !NO_APPLE_EXTENSIONS */

        u_int32_t        rule;
        u_int32_t        anchor;
        u_int32_t        nat_rule;
        u_int32_t        rule;
        u_int32_t        anchor;
        u_int32_t        nat_rule;


@@ -1086,10 +1120,9 @@ struct pfsync_state {
        u_int32_t        packets[2][2];
        u_int32_t        bytes[2][2];
        u_int32_t        creatorid;
        u_int32_t        packets[2][2];
        u_int32_t        bytes[2][2];
        u_int32_t        creatorid;

-#ifndef NO_APPLE_EXTENSIONS
-    u_int16_t    tag;
-#endif /* !NO_APPLE_EXTENSIONS */
-       sa_family_t      af;
+       u_int16_t        tag;
+       sa_family_t      af_lan;
+       sa_family_t      af_gwy;

        u_int8_t         proto;
        u_int8_t         direction;
        u_int8_t         log;
        u_int8_t         proto;
        u_int8_t         direction;
        u_int8_t         log;


@@ -1097,9 +1130,9 @@ struct pfsync_state {
        u_int8_t         timeout;
        u_int8_t         sync_flags;
        u_int8_t         updates;
        u_int8_t         timeout;
        u_int8_t         sync_flags;
        u_int8_t         updates;

-#ifndef NO_APPLE_EXTENSIONS

        u_int8_t         proto_variant;
        u_int8_t         proto_variant;

-#endif /* !NO_APPLE_EXTENSIONS */
+       u_int8_t         __pad;
+       u_int32_t        flowhash;

 } __packed;
 
 #define PFSYNC_FLAG_COMPRESS   0x01
 } __packed;
 
 #define PFSYNC_FLAG_COMPRESS   0x01


@@ -1187,6 +1220,7 @@ struct pf_anchor {
        struct pf_ruleset        ruleset;
        int                      refcnt;        /* anchor rules */
        int                      match;
        struct pf_ruleset        ruleset;
        int                      refcnt;        /* anchor rules */
        int                      match;

+       char                     owner[PF_OWNER_NAME_SIZE];

 };
 #ifdef KERNEL
 RB_PROTOTYPE_SC(__private_extern__, pf_anchor_global, pf_anchor, entry_global,
 };
 #ifdef KERNEL
 RB_PROTOTYPE_SC(__private_extern__, pf_anchor_global, pf_anchor, entry_global,


@@ -1320,8 +1354,8 @@ RB_PROTOTYPE_SC(__private_extern__, pf_state_tree_ext_gwy, pf_state_key,
 RB_HEAD(pfi_ifhead, pfi_kif);
 
 /* state tables */
 RB_HEAD(pfi_ifhead, pfi_kif);
 
 /* state tables */

-__private_extern__ struct pf_state_tree_lan_ext         pf_statetbl_lan_ext;
-__private_extern__ struct pf_state_tree_ext_gwy         pf_statetbl_ext_gwy;
+extern struct pf_state_tree_lan_ext     pf_statetbl_lan_ext;
+extern struct pf_state_tree_ext_gwy     pf_statetbl_ext_gwy;

 
 /* keep synced with pfi_kif, used in RB_FIND */
 struct pfi_kif_cmp {
 
 /* keep synced with pfi_kif, used in RB_FIND */
 struct pfi_kif_cmp {


@@ -1382,36 +1416,43 @@ struct pf_pdesc {
 #if INET6
                struct icmp6_hdr        *icmp6;
 #endif /* INET6 */
 #if INET6
                struct icmp6_hdr        *icmp6;
 #endif /* INET6 */

-#ifndef NO_APPLE_EXTENSIONS
-               struct pf_grev1_hdr *grev1;
-               struct pf_esp_hdr *esp;
-#endif /* !NO_APPLE_EXTENSIONS */
+               struct pf_grev1_hdr     *grev1;
+               struct pf_esp_hdr       *esp;

                void                    *any;
        } hdr;
                void                    *any;
        } hdr;

-       struct pf_addr   baddr;         /* address before translation */
-       struct pf_addr   naddr;         /* address after translation */
+
+       /* XXX TODO: Change baddr and naddr to *saddr */
+       struct pf_addr   baddr;         /* src address before translation */
+       struct pf_addr   bdaddr;        /* dst address before translation */
+       struct pf_addr   naddr;         /* src address after translation */
+       struct pf_addr   ndaddr;        /* dst address after translation */

        struct pf_rule  *nat_rule;      /* nat/rdr rule applied to packet */
        struct pf_addr  *src;
        struct pf_addr  *dst;
        struct ether_header
                        *eh;
        struct pf_rule  *nat_rule;      /* nat/rdr rule applied to packet */
        struct pf_addr  *src;
        struct pf_addr  *dst;
        struct ether_header
                        *eh;

-#ifndef NO_APPLE_EXTENSIONS

        struct mbuf     *mp;
        struct mbuf     *mp;

-       int                             lmw;    /* lazy writable offset */
-#endif /* !NO_APPLE_EXTENSIONS */
+       int             lmw;            /* lazy writable offset */

        struct pf_mtag  *pf_mtag;
        u_int16_t       *ip_sum;
        struct pf_mtag  *pf_mtag;
        u_int16_t       *ip_sum;

+       u_int32_t        off;           /* protocol header offset */
+       u_int32_t        hdrlen;        /* protocol header length */

        u_int32_t        p_len;         /* total length of payload */
        u_int16_t        flags;         /* Let SCRUB trigger behavior in */
                                        /* state code. Easier than tags */
 #define PFDESC_TCP_NORM        0x0001          /* TCP shall be statefully scrubbed */
 #define PFDESC_IP_REAS 0x0002          /* IP frags would've been reassembled */
        u_int32_t        p_len;         /* total length of payload */
        u_int16_t        flags;         /* Let SCRUB trigger behavior in */
                                        /* state code. Easier than tags */
 #define PFDESC_TCP_NORM        0x0001          /* TCP shall be statefully scrubbed */
 #define PFDESC_IP_REAS 0x0002          /* IP frags would've been reassembled */

+#define PFDESC_IP_FRAG 0x0004          /* This is a fragment */

        sa_family_t      af;
        sa_family_t      af;

+       sa_family_t      naf;           /*  address family after translation */

        u_int8_t         proto;
        u_int8_t         tos;
        u_int8_t         proto;
        u_int8_t         tos;

-#ifndef NO_APPLE_EXTENSIONS
+       u_int8_t         ttl;

        u_int8_t         proto_variant;
        u_int8_t         proto_variant;

-#endif /* !NO_APPLE_EXTENSIONS */
+       mbuf_svc_class_t sc;            /* mbuf service class (MBUF_SVC) */
+       u_int32_t        pktflags;      /* mbuf packet flags (PKTF) */
+       u_int32_t        flowsrc;       /* flow source (FLOWSRC) */
+       u_int32_t        flowhash;      /* flow hash to identify the sender */

 };
 #endif /* KERNEL */
 
 };
 #endif /* KERNEL */
 


@@ -1435,7 +1476,8 @@ struct pf_pdesc {
 #define PFRES_MAXSTATES        12              /* State limit */
 #define PFRES_SRCLIMIT 13              /* Source node/conn limit */
 #define PFRES_SYNPROXY 14              /* SYN proxy */
 #define PFRES_MAXSTATES        12              /* State limit */
 #define PFRES_SRCLIMIT 13              /* Source node/conn limit */
 #define PFRES_SYNPROXY 14              /* SYN proxy */

-#define PFRES_MAX      15              /* total+1 */
+#define PFRES_DUMMYNET 15              /* Dummynet */
+#define PFRES_MAX      16              /* total+1 */

 
 #define PFRES_NAMES { \
        "match", \
 
 #define PFRES_NAMES { \
        "match", \


@@ -1453,6 +1495,7 @@ struct pf_pdesc {
        "state-limit", \
        "src-limit", \
        "synproxy", \
        "state-limit", \
        "src-limit", \
        "synproxy", \

+       "dummynet", \

        NULL \
 }
 
        NULL \
 }
 


@@ -1491,7 +1534,6 @@ struct pf_pdesc {
        NULL \
 }
 
        NULL \
 }
 

-#ifndef NO_APPLE_EXTENSIONS

 /* GREv1 protocol state enumeration */
 #define PFGRE1S_NO_TRAFFIC             0
 #define PFGRE1S_INITIATING             1
 /* GREv1 protocol state enumeration */
 #define PFGRE1S_NO_TRAFFIC             0
 #define PFGRE1S_INITIATING             1


@@ -1513,7 +1555,6 @@ struct pf_pdesc {
 #define PFESPS_NSTATES         3       /* number of state levels */
 
 #define PFESPS_NAMES { "NO_TRAFFIC", "INITIATING", "ESTABLISHED", NULL }
 #define PFESPS_NSTATES         3       /* number of state levels */
 
 #define PFESPS_NAMES { "NO_TRAFFIC", "INITIATING", "ESTABLISHED", NULL }

-#endif /* !NO_APPLE_EXTENSIONS */

 
 /* Other protocol state enumeration */
 #define PFOTHERS_NO_TRAFFIC    0
 
 /* Other protocol state enumeration */
 #define PFOTHERS_NO_TRAFFIC    0


@@ -1574,66 +1615,111 @@ struct pf_status {
 };
 
 struct cbq_opts {
 };
 
 struct cbq_opts {

-       u_int           minburst;
-       u_int           maxburst;
-       u_int           pktsize;
-       u_int           maxpktsize;
-       u_int           ns_per_byte;
-       u_int           maxidle;
-       int             minidle;
-       u_int           offtime;
-       int             flags;
+       u_int32_t       minburst;
+       u_int32_t       maxburst;
+       u_int32_t       pktsize;
+       u_int32_t       maxpktsize;
+       u_int32_t       ns_per_byte;
+       u_int32_t       maxidle;
+       int32_t         minidle;
+       u_int32_t       offtime;
+       u_int32_t       flags;

 };
 
 struct priq_opts {
 };
 
 struct priq_opts {

-       int             flags;
+       u_int32_t       flags;
+};
+
+struct qfq_opts {
+       u_int32_t       flags;
+       u_int32_t       lmax;

 };
 
 struct hfsc_opts {
        /* real-time service curve */
 };
 
 struct hfsc_opts {
        /* real-time service curve */

-       u_int           rtsc_m1;        /* slope of the 1st segment in bps */
-       u_int           rtsc_d;         /* the x-projection of m1 in msec */
-       u_int           rtsc_m2;        /* slope of the 2nd segment in bps */
+       u_int64_t       rtsc_m1;        /* slope of the 1st segment in bps */
+       u_int64_t       rtsc_d;         /* the x-projection of m1 in msec */
+       u_int64_t       rtsc_m2;        /* slope of the 2nd segment in bps */
+       u_int32_t       rtsc_fl;        /* service curve flags */
+#if !defined(__LP64__)
+       u_int32_t       _pad;
+#endif /* !__LP64__ */

        /* link-sharing service curve */
        /* link-sharing service curve */

-       u_int           lssc_m1;
-       u_int           lssc_d;
-       u_int           lssc_m2;
+       u_int64_t       lssc_m1;
+       u_int64_t       lssc_d;
+       u_int64_t       lssc_m2;
+       u_int32_t       lssc_fl;
+#if !defined(__LP64__)
+       u_int32_t       __pad;
+#endif /* !__LP64__ */

        /* upper-limit service curve */
        /* upper-limit service curve */

-       u_int           ulsc_m1;
-       u_int           ulsc_d;
-       u_int           ulsc_m2;
-       int             flags;
+       u_int64_t       ulsc_m1;
+       u_int64_t       ulsc_d;
+       u_int64_t       ulsc_m2;
+       u_int32_t       ulsc_fl;
+       u_int32_t       flags;          /* scheduler flags */
+};
+
+struct fairq_opts {
+       u_int32_t       nbuckets;       /* hash buckets */
+       u_int32_t       flags;
+       u_int64_t       hogs_m1;        /* hog detection bandwidth */
+
+       /* link-sharing service curve */
+       u_int64_t       lssc_m1;
+       u_int64_t       lssc_d;
+       u_int64_t       lssc_m2;

 };
 
 };
 

+/* bandwidth types */
+#define PF_ALTQ_BW_ABSOLUTE    1       /* bw in absolute value (bps) */
+#define PF_ALTQ_BW_PERCENT     2       /* bandwidth in percentage */
+
+/* ALTQ rule flags */
+#define        PF_ALTQF_TBR            0x1     /* enable Token Bucket Regulator */
+
+/* queue rule flags */
+#define        PF_ALTQ_QRF_WEIGHT      0x1     /* weight instead of priority */
+

 struct pf_altq {
        char                     ifname[IFNAMSIZ];
 
 struct pf_altq {
        char                     ifname[IFNAMSIZ];
 

-       void                    *altq_disc;     /* discipline-specific state */
-#if !defined(__LP64__)
-       u_int32_t               _pad;
-#endif /* !__LP64__ */
-       TAILQ_ENTRY(pf_altq)     entries;
+       /* discipline-specific state */
+       void                    *altq_disc __attribute__((aligned(8)));
+       TAILQ_ENTRY(pf_altq)     entries __attribute__((aligned(8)));

 #if !defined(__LP64__)
 #if !defined(__LP64__)

-       u_int32_t               __pad[2];
+       u_int32_t               _pad[2];

 #endif /* !__LP64__ */
 
 #endif /* !__LP64__ */
 

+       u_int32_t                aflags;        /* ALTQ rule flags */
+       u_int32_t                bwtype;        /* bandwidth type */
+

        /* scheduler spec */
        /* scheduler spec */

-       u_int8_t                 scheduler;     /* scheduler type */
-       u_int16_t                tbrsize;       /* tokenbucket regulator size */
-       u_int32_t                ifbandwidth;   /* interface bandwidth */
+       u_int32_t                scheduler;     /* scheduler type */
+       u_int32_t                tbrsize;       /* tokenbucket regulator size */
+       u_int64_t                ifbandwidth;   /* interface bandwidth */

 
        /* queue spec */
        char                     qname[PF_QNAME_SIZE];  /* queue name */
        char                     parent[PF_QNAME_SIZE]; /* parent name */
        u_int32_t                parent_qid;    /* parent queue id */
 
        /* queue spec */
        char                     qname[PF_QNAME_SIZE];  /* queue name */
        char                     parent[PF_QNAME_SIZE]; /* parent name */
        u_int32_t                parent_qid;    /* parent queue id */

-       u_int32_t                bandwidth;     /* queue bandwidth */
-       u_int8_t                 priority;      /* priority */
-       u_int16_t                qlimit;        /* queue size limit */
-       u_int16_t                flags;         /* misc flags */
+       u_int32_t                qrflags;       /* queue rule flags */
+       union {
+               u_int32_t        priority;      /* priority */
+               u_int32_t        weight;        /* weight */
+       };
+       u_int32_t                qlimit;        /* queue size limit */
+       u_int32_t                flags;         /* misc flags */
+#if !defined(__LP64__)
+       u_int32_t               __pad;
+#endif /* !__LP64__ */
+       u_int64_t                bandwidth;     /* queue bandwidth */

        union {
                struct cbq_opts          cbq_opts;
                struct priq_opts         priq_opts;
                struct hfsc_opts         hfsc_opts;
        union {
                struct cbq_opts          cbq_opts;
                struct priq_opts         priq_opts;
                struct hfsc_opts         hfsc_opts;

+               struct fairq_opts        fairq_opts;
+               struct qfq_opts          qfq_opts;

        } pq_u;
 
        u_int32_t                qid;           /* return value */
        } pq_u;
 
        u_int32_t                qid;           /* return value */


@@ -1686,7 +1772,6 @@ struct pfioc_natlook {
        struct pf_addr   daddr;
        struct pf_addr   rsaddr;
        struct pf_addr   rdaddr;
        struct pf_addr   daddr;
        struct pf_addr   rsaddr;
        struct pf_addr   rdaddr;

-#ifndef NO_APPLE_EXTENSIONS

        union pf_state_xport    sxport;
        union pf_state_xport    dxport;
        union pf_state_xport    rsxport;
        union pf_state_xport    sxport;
        union pf_state_xport    dxport;
        union pf_state_xport    rsxport;


@@ -1695,15 +1780,6 @@ struct pfioc_natlook {
        u_int8_t         proto;
        u_int8_t         proto_variant;
        u_int8_t         direction;
        u_int8_t         proto;
        u_int8_t         proto_variant;
        u_int8_t         direction;

-#else /* NO_APPLE_EXTENSIONS */
-       u_int16_t        sport;
-       u_int16_t        dport;
-       u_int16_t        rsport;
-       u_int16_t        rdport;
-       sa_family_t      af;
-       u_int8_t         proto;
-       u_int8_t         direction;
-#endif /* NO_APPLE_EXTENSIONS */

 };
 
 struct pfioc_state {
 };
 
 struct pfioc_state {


@@ -1717,30 +1793,23 @@ struct pfioc_src_node_kill {
        struct pf_rule_addr psnk_dst;
 };
 
        struct pf_rule_addr psnk_dst;
 };
 

-#ifndef NO_APPLE_EXTENSIONS

 struct pfioc_state_addr_kill {
        struct pf_addr_wrap             addr;
        u_int8_t                        reserved_[3];
        u_int8_t                        neg;
        union pf_rule_xport             xport;
 };
 struct pfioc_state_addr_kill {
        struct pf_addr_wrap             addr;
        u_int8_t                        reserved_[3];
        u_int8_t                        neg;
        union pf_rule_xport             xport;
 };

-#endif /* !NO_APPLE_EXTENSIONS */

 
 struct pfioc_state_kill {
        /* XXX returns the number of states killed in psk_af */
        sa_family_t             psk_af;
 
 struct pfioc_state_kill {
        /* XXX returns the number of states killed in psk_af */
        sa_family_t             psk_af;

-#ifndef NO_APPLE_EXTENSIONS

        u_int8_t                psk_proto;
        u_int8_t                psk_proto_variant;
        u_int8_t                _pad;
        struct pfioc_state_addr_kill    psk_src;
        struct pfioc_state_addr_kill    psk_dst;
        u_int8_t                psk_proto;
        u_int8_t                psk_proto_variant;
        u_int8_t                _pad;
        struct pfioc_state_addr_kill    psk_src;
        struct pfioc_state_addr_kill    psk_dst;

-#else /* NO_APPLE_EXTENSIONS */
-       int                     psk_proto;
-       struct pf_rule_addr     psk_src;
-       struct pf_rule_addr     psk_dst;
-#endif /* NO_APPLE_EXTENSIONS */

        char                    psk_ifname[IFNAMSIZ];
        char                    psk_ifname[IFNAMSIZ];

+       char                    psk_ownername[PF_OWNER_NAME_SIZE];

 };
 
 struct pfioc_states {
 };
 
 struct pfioc_states {


@@ -1771,6 +1840,55 @@ struct pfioc_states_64 {
 };
 #endif /* KERNEL */
 
 };
 #endif /* KERNEL */
 

+#define PFTOK_PROCNAME_LEN    64
+#pragma pack(1)
+struct pfioc_token {
+       u_int64_t                       token_value;
+       u_int64_t                       timestamp;
+       pid_t                           pid;
+       char                            proc_name[PFTOK_PROCNAME_LEN];
+};
+#pragma pack()
+
+struct pfioc_kernel_token {
+       SLIST_ENTRY(pfioc_kernel_token) next;
+       struct pfioc_token              token;
+};
+
+struct pfioc_remove_token {
+       u_int64_t                token_value;
+       u_int64_t                refcount;
+};
+
+struct pfioc_tokens {
+       int     size;
+       union {
+               caddr_t                         pgtu_buf;
+               struct pfioc_token              *pgtu_tokens;
+       } pgt_u __attribute__((aligned(8)));
+#define pgt_buf                pgt_u.pgtu_buf
+#define pgt_tokens     pgt_u.pgtu_tokens
+};
+
+#ifdef KERNEL
+struct pfioc_tokens_32 {
+       int     size;
+       union {
+               user32_addr_t           pgtu_buf;
+               user32_addr_t           pgtu_tokens;
+       } pgt_u __attribute__((aligned(8)));
+};
+
+struct pfioc_tokens_64 {
+       int     size;
+       union {
+               user64_addr_t           pgtu_buf;
+               user64_addr_t           pgtu_tokens;
+       } pgt_u __attribute__((aligned(8)));
+};
+#endif /* KERNEL */
+
+

 struct pfioc_src_nodes {
        int     psn_len;
        union {
 struct pfioc_src_nodes {
        int     psn_len;
        union {


@@ -1860,6 +1978,7 @@ struct pfioc_trans_64 {
 };
 #endif /* KERNEL */
 
 };
 #endif /* KERNEL */
 

+

 #define PFR_FLAG_ATOMIC                0x00000001
 #define PFR_FLAG_DUMMY         0x00000002
 #define PFR_FLAG_FEEDBACK      0x00000004
 #define PFR_FLAG_ATOMIC                0x00000001
 #define PFR_FLAG_DUMMY         0x00000002
 #define PFR_FLAG_FEEDBACK      0x00000004


@@ -1948,6 +2067,11 @@ struct pfioc_iface_64 {
 };
 #endif /* KERNEL */
 
 };
 #endif /* KERNEL */
 

+struct pf_ifspeed {
+       char                    ifname[IFNAMSIZ];
+       u_int64_t               baudrate;
+};
+

 /*
  * ioctl operations
  */
 /*
  * ioctl operations
  */


@@ -1955,19 +2079,23 @@ struct pfioc_iface_64 {
 #define DIOCSTART      _IO  ('D',  1)
 #define DIOCSTOP       _IO  ('D',  2)
 #define DIOCADDRULE    _IOWR('D',  4, struct pfioc_rule)
 #define DIOCSTART      _IO  ('D',  1)
 #define DIOCSTOP       _IO  ('D',  2)
 #define DIOCADDRULE    _IOWR('D',  4, struct pfioc_rule)

+#define DIOCGETSTARTERS        _IOWR('D',  5, struct pfioc_tokens)

 #define DIOCGETRULES   _IOWR('D',  6, struct pfioc_rule)
 #define DIOCGETRULE    _IOWR('D',  7, struct pfioc_rule)
 #define DIOCGETRULES   _IOWR('D',  6, struct pfioc_rule)
 #define DIOCGETRULE    _IOWR('D',  7, struct pfioc_rule)

-/* XXX cut 8 - 17 */
+#define DIOCSTARTREF   _IOR ('D',  8, u_int64_t)
+#define DIOCSTOPREF    _IOWR('D',  9, struct pfioc_remove_token)
+/* XXX cut 10 - 17 */

 #define DIOCCLRSTATES  _IOWR('D', 18, struct pfioc_state_kill)
 #define DIOCGETSTATE   _IOWR('D', 19, struct pfioc_state)
 #define DIOCCLRSTATES  _IOWR('D', 18, struct pfioc_state_kill)
 #define DIOCGETSTATE   _IOWR('D', 19, struct pfioc_state)

-#define DIOCSETSTATUSIF _IOWR('D', 20, struct pfioc_if)
+#define DIOCSETSTATUSIF        _IOWR('D', 20, struct pfioc_if)

 #define DIOCGETSTATUS  _IOWR('D', 21, struct pf_status)
 #define DIOCCLRSTATUS  _IO  ('D', 22)
 #define DIOCNATLOOK    _IOWR('D', 23, struct pfioc_natlook)
 #define DIOCSETDEBUG   _IOWR('D', 24, u_int32_t)
 #define DIOCGETSTATES  _IOWR('D', 25, struct pfioc_states)
 #define DIOCCHANGERULE _IOWR('D', 26, struct pfioc_rule)
 #define DIOCGETSTATUS  _IOWR('D', 21, struct pf_status)
 #define DIOCCLRSTATUS  _IO  ('D', 22)
 #define DIOCNATLOOK    _IOWR('D', 23, struct pfioc_natlook)
 #define DIOCSETDEBUG   _IOWR('D', 24, u_int32_t)
 #define DIOCGETSTATES  _IOWR('D', 25, struct pfioc_states)
 #define DIOCCHANGERULE _IOWR('D', 26, struct pfioc_rule)

-/* XXX cut 26 - 28 */
+#define DIOCINSERTRULE _IOWR('D',  27, struct pfioc_rule)
+#define DIOCDELETERULE _IOWR('D',  28, struct pfioc_rule)

 #define DIOCSETTIMEOUT _IOWR('D', 29, struct pfioc_tm)
 #define DIOCGETTIMEOUT _IOWR('D', 30, struct pfioc_tm)
 #define DIOCADDSTATE   _IOWR('D', 37, struct pfioc_state)
 #define DIOCSETTIMEOUT _IOWR('D', 29, struct pfioc_tm)
 #define DIOCGETTIMEOUT _IOWR('D', 30, struct pfioc_tm)
 #define DIOCADDSTATE   _IOWR('D', 37, struct pfioc_state)


@@ -1995,76 +2123,76 @@ struct pfioc_iface_64 {
 #define        DIOCRDELTABLES  _IOWR('D', 62, struct pfioc_table)
 #define        DIOCRGETTABLES  _IOWR('D', 63, struct pfioc_table)
 #define        DIOCRGETTSTATS  _IOWR('D', 64, struct pfioc_table)
 #define        DIOCRDELTABLES  _IOWR('D', 62, struct pfioc_table)
 #define        DIOCRGETTABLES  _IOWR('D', 63, struct pfioc_table)
 #define        DIOCRGETTSTATS  _IOWR('D', 64, struct pfioc_table)

-#define DIOCRCLRTSTATS  _IOWR('D', 65, struct pfioc_table)
+#define DIOCRCLRTSTATS _IOWR('D', 65, struct pfioc_table)

 #define        DIOCRCLRADDRS   _IOWR('D', 66, struct pfioc_table)
 #define        DIOCRADDADDRS   _IOWR('D', 67, struct pfioc_table)
 #define        DIOCRDELADDRS   _IOWR('D', 68, struct pfioc_table)
 #define        DIOCRSETADDRS   _IOWR('D', 69, struct pfioc_table)
 #define        DIOCRGETADDRS   _IOWR('D', 70, struct pfioc_table)
 #define        DIOCRGETASTATS  _IOWR('D', 71, struct pfioc_table)
 #define        DIOCRCLRADDRS   _IOWR('D', 66, struct pfioc_table)
 #define        DIOCRADDADDRS   _IOWR('D', 67, struct pfioc_table)
 #define        DIOCRDELADDRS   _IOWR('D', 68, struct pfioc_table)
 #define        DIOCRSETADDRS   _IOWR('D', 69, struct pfioc_table)
 #define        DIOCRGETADDRS   _IOWR('D', 70, struct pfioc_table)
 #define        DIOCRGETASTATS  _IOWR('D', 71, struct pfioc_table)

-#define DIOCRCLRASTATS  _IOWR('D', 72, struct pfioc_table)
+#define DIOCRCLRASTATS _IOWR('D', 72, struct pfioc_table)

 #define        DIOCRTSTADDRS   _IOWR('D', 73, struct pfioc_table)
 #define        DIOCRSETTFLAGS  _IOWR('D', 74, struct pfioc_table)
 #define DIOCRINADEFINE _IOWR('D', 77, struct pfioc_table)
 #define DIOCOSFPFLUSH  _IO('D', 78)
 #define DIOCOSFPADD    _IOWR('D', 79, struct pf_osfp_ioctl)
 #define DIOCOSFPGET    _IOWR('D', 80, struct pf_osfp_ioctl)
 #define        DIOCRTSTADDRS   _IOWR('D', 73, struct pfioc_table)
 #define        DIOCRSETTFLAGS  _IOWR('D', 74, struct pfioc_table)
 #define DIOCRINADEFINE _IOWR('D', 77, struct pfioc_table)
 #define DIOCOSFPFLUSH  _IO('D', 78)
 #define DIOCOSFPADD    _IOWR('D', 79, struct pf_osfp_ioctl)
 #define DIOCOSFPGET    _IOWR('D', 80, struct pf_osfp_ioctl)

-#define DIOCXBEGIN      _IOWR('D', 81, struct pfioc_trans)
-#define DIOCXCOMMIT     _IOWR('D', 82, struct pfioc_trans)
-#define DIOCXROLLBACK   _IOWR('D', 83, struct pfioc_trans)
+#define DIOCXBEGIN     _IOWR('D', 81, struct pfioc_trans)
+#define DIOCXCOMMIT    _IOWR('D', 82, struct pfioc_trans)
+#define DIOCXROLLBACK  _IOWR('D', 83, struct pfioc_trans)

 #define DIOCGETSRCNODES        _IOWR('D', 84, struct pfioc_src_nodes)
 #define DIOCCLRSRCNODES        _IO('D', 85)
 #define DIOCSETHOSTID  _IOWR('D', 86, u_int32_t)
 #define DIOCIGETIFACES _IOWR('D', 87, struct pfioc_iface)
 #define DIOCSETIFFLAG  _IOWR('D', 89, struct pfioc_iface)
 #define DIOCCLRIFFLAG  _IOWR('D', 90, struct pfioc_iface)
 #define DIOCGETSRCNODES        _IOWR('D', 84, struct pfioc_src_nodes)
 #define DIOCCLRSRCNODES        _IO('D', 85)
 #define DIOCSETHOSTID  _IOWR('D', 86, u_int32_t)
 #define DIOCIGETIFACES _IOWR('D', 87, struct pfioc_iface)
 #define DIOCSETIFFLAG  _IOWR('D', 89, struct pfioc_iface)
 #define DIOCCLRIFFLAG  _IOWR('D', 90, struct pfioc_iface)

-#define DIOCKILLSRCNODES       _IOWR('D', 91, struct pfioc_src_node_kill)
+#define DIOCKILLSRCNODES _IOWR('D', 91, struct pfioc_src_node_kill)
+#define        DIOCGIFSPEED    _IOWR('D', 92, struct pf_ifspeed)

 
 #ifdef KERNEL
 RB_HEAD(pf_src_tree, pf_src_node);
 RB_PROTOTYPE_SC(__private_extern__, pf_src_tree, pf_src_node, entry,
     pf_src_compare);
 
 #ifdef KERNEL
 RB_HEAD(pf_src_tree, pf_src_node);
 RB_PROTOTYPE_SC(__private_extern__, pf_src_tree, pf_src_node, entry,
     pf_src_compare);

-__private_extern__ struct pf_src_tree tree_src_tracking;
+extern struct pf_src_tree tree_src_tracking;

 
 RB_HEAD(pf_state_tree_id, pf_state);
 RB_PROTOTYPE_SC(__private_extern__, pf_state_tree_id, pf_state,
     entry_id, pf_state_compare_id);
 
 RB_HEAD(pf_state_tree_id, pf_state);
 RB_PROTOTYPE_SC(__private_extern__, pf_state_tree_id, pf_state,
     entry_id, pf_state_compare_id);

-__private_extern__ struct pf_state_tree_id tree_id;
-__private_extern__ struct pf_state_queue state_list;
+extern struct pf_state_tree_id tree_id;
+extern struct pf_state_queue state_list;

 
 TAILQ_HEAD(pf_poolqueue, pf_pool);
 
 TAILQ_HEAD(pf_poolqueue, pf_pool);

-__private_extern__ struct pf_poolqueue pf_pools[2];
-__private_extern__ struct pf_palist    pf_pabuf;
-__private_extern__ u_int32_t           ticket_pabuf;
-#if ALTQ
+extern struct pf_poolqueue     pf_pools[2];
+extern struct pf_palist        pf_pabuf;
+extern u_int32_t               ticket_pabuf;
+#if PF_ALTQ

 TAILQ_HEAD(pf_altqqueue, pf_altq);
 TAILQ_HEAD(pf_altqqueue, pf_altq);

-__private_extern__ struct pf_altqqueue pf_altqs[2];
-__private_extern__ u_int32_t           ticket_altqs_active;
-__private_extern__ u_int32_t           ticket_altqs_inactive;
-__private_extern__ int                 altqs_inactive_open;
-__private_extern__ struct pf_altqqueue *pf_altqs_active;
-__private_extern__ struct pf_altqqueue *pf_altqs_inactive;
-#endif /* ALTQ */
-__private_extern__ struct pf_poolqueue *pf_pools_active;
-__private_extern__ struct pf_poolqueue *pf_pools_inactive;
+extern struct pf_altqqueue     pf_altqs[2];
+extern u_int32_t               ticket_altqs_active;
+extern u_int32_t               ticket_altqs_inactive;
+extern int                     altqs_inactive_open;
+extern struct pf_altqqueue     *pf_altqs_active;
+extern struct pf_altqqueue     *pf_altqs_inactive;
+#endif /* PF_ALTQ */
+extern struct pf_poolqueue     *pf_pools_active;
+extern struct pf_poolqueue     *pf_pools_inactive;

 
 __private_extern__ int pf_tbladdr_setup(struct pf_ruleset *,
     struct pf_addr_wrap *);
 __private_extern__ void pf_tbladdr_remove(struct pf_addr_wrap *);
 __private_extern__ void pf_tbladdr_copyout(struct pf_addr_wrap *);
 __private_extern__ void pf_calc_skip_steps(struct pf_rulequeue *);
 
 __private_extern__ int pf_tbladdr_setup(struct pf_ruleset *,
     struct pf_addr_wrap *);
 __private_extern__ void pf_tbladdr_remove(struct pf_addr_wrap *);
 __private_extern__ void pf_tbladdr_copyout(struct pf_addr_wrap *);
 __private_extern__ void pf_calc_skip_steps(struct pf_rulequeue *);

+__private_extern__ u_int32_t pf_calc_state_key_flowhash(struct pf_state_key *);

 
 

-__private_extern__ struct pool pf_src_tree_pl, pf_rule_pl;
-__private_extern__ struct pool pf_state_pl, pf_state_key_pl, pf_pooladdr_pl;
-__private_extern__ struct pool pf_state_scrub_pl;
-#if ALTQ
-__private_extern__ struct pool pf_altq_pl;
-#endif /* ALTQ */
-#ifndef NO_APPLE_EXTENSIONS
-__private_extern__ struct pool pf_app_state_pl;
-#endif /* !NO_APPLE_EXTENSIONS */
+extern struct pool pf_src_tree_pl, pf_rule_pl;
+extern struct pool pf_state_pl, pf_state_key_pl, pf_pooladdr_pl;
+extern struct pool pf_state_scrub_pl;
+#if PF_ALTQ
+extern struct pool pf_altq_pl;
+#endif /* PF_ALTQ */
+extern struct pool pf_app_state_pl;

 
 

-__private_extern__ struct thread *pf_purge_thread;
+extern struct thread *pf_purge_thread;

 
 __private_extern__ void pfinit(void);
 __private_extern__ void pf_purge_thread_fn(void *, wait_result_t);
 
 __private_extern__ void pfinit(void);
 __private_extern__ void pf_purge_thread_fn(void *, wait_result_t);


@@ -2084,29 +2212,28 @@ __private_extern__ void pf_print_flags(u_int8_t);
 __private_extern__ u_int16_t pf_cksum_fixup(u_int16_t, u_int16_t, u_int16_t,
     u_int8_t);
 
 __private_extern__ u_int16_t pf_cksum_fixup(u_int16_t, u_int16_t, u_int16_t,
     u_int8_t);
 

-__private_extern__ struct ifnet *sync_ifp;
-__private_extern__ struct pf_rule pf_default_rule;
+extern struct ifnet *sync_ifp;
+extern struct pf_rule pf_default_rule;

 __private_extern__ void pf_addrcpy(struct pf_addr *, struct pf_addr *,
     u_int8_t);
 __private_extern__ void pf_rm_rule(struct pf_rulequeue *, struct pf_rule *);
 
 __private_extern__ void pf_addrcpy(struct pf_addr *, struct pf_addr *,
     u_int8_t);
 __private_extern__ void pf_rm_rule(struct pf_rulequeue *, struct pf_rule *);
 

+struct ip_fw_args;

 #if INET
 __private_extern__ int pf_test(int, struct ifnet *, struct mbuf **,
 #if INET
 __private_extern__ int pf_test(int, struct ifnet *, struct mbuf **,

-    struct ether_header *);
+    struct ether_header *, struct ip_fw_args *);

 #endif /* INET */
 
 #if INET6
 __private_extern__ int pf_test6(int, struct ifnet *, struct mbuf **,
 #endif /* INET */
 
 #if INET6
 __private_extern__ int pf_test6(int, struct ifnet *, struct mbuf **,

-    struct ether_header *);
+    struct ether_header *, struct ip_fw_args *);

 __private_extern__ void pf_poolmask(struct pf_addr *, struct pf_addr *,
     struct pf_addr *, struct pf_addr *, u_int8_t);
 __private_extern__ void pf_addr_inc(struct pf_addr *, sa_family_t);
 #endif /* INET6 */
 
 __private_extern__ void pf_poolmask(struct pf_addr *, struct pf_addr *,
     struct pf_addr *, struct pf_addr *, u_int8_t);
 __private_extern__ void pf_addr_inc(struct pf_addr *, sa_family_t);
 #endif /* INET6 */
 

-#ifndef NO_APPLE_EXTENSIONS

 __private_extern__ struct mbuf *pf_lazy_makewritable(struct pf_pdesc *,
     struct mbuf *, int);
 __private_extern__ struct mbuf *pf_lazy_makewritable(struct pf_pdesc *,
     struct mbuf *, int);

-#endif /* !NO_APPLE_EXTENSIONS */

 __private_extern__ void *pf_pull_hdr(struct mbuf *, int, void *, int,
     u_short *, u_short *, sa_family_t);
 __private_extern__ void pf_change_a(void *, u_int16_t *, u_int32_t, u_int8_t);
 __private_extern__ void *pf_pull_hdr(struct mbuf *, int, void *, int,
     u_short *, u_short *, sa_family_t);
 __private_extern__ void pf_change_a(void *, u_int16_t *, u_int32_t, u_int8_t);


@@ -2119,10 +2246,8 @@ __private_extern__ int pf_match_addr_range(struct pf_addr *, struct pf_addr *,
     struct pf_addr *, sa_family_t);
 __private_extern__ int pf_match(u_int8_t, u_int32_t, u_int32_t, u_int32_t);
 __private_extern__ int pf_match_port(u_int8_t, u_int16_t, u_int16_t, u_int16_t);
     struct pf_addr *, sa_family_t);
 __private_extern__ int pf_match(u_int8_t, u_int32_t, u_int32_t, u_int32_t);
 __private_extern__ int pf_match_port(u_int8_t, u_int16_t, u_int16_t, u_int16_t);

-#ifndef NO_APPLE_EXTENSIONS

 __private_extern__ int pf_match_xport(u_int8_t, u_int8_t, union pf_rule_xport *,
     union pf_state_xport *);
 __private_extern__ int pf_match_xport(u_int8_t, u_int8_t, union pf_rule_xport *,
     union pf_state_xport *);

-#endif /* !NO_APPLE_EXTENSIONS */

 __private_extern__ int pf_match_uid(u_int8_t, uid_t, uid_t, uid_t);
 __private_extern__ int pf_match_gid(u_int8_t, gid_t, gid_t, gid_t);
 
 __private_extern__ int pf_match_uid(u_int8_t, uid_t, uid_t, uid_t);
 __private_extern__ int pf_match_gid(u_int8_t, gid_t, gid_t, gid_t);
 


@@ -2148,7 +2273,8 @@ __private_extern__ int pf_routable(struct pf_addr *addr, sa_family_t af,
 __private_extern__ int pf_rtlabel_match(struct pf_addr *, sa_family_t,
     struct pf_addr_wrap *);
 __private_extern__ int pf_socket_lookup(int, struct pf_pdesc *);
 __private_extern__ int pf_rtlabel_match(struct pf_addr *, sa_family_t,
     struct pf_addr_wrap *);
 __private_extern__ int pf_socket_lookup(int, struct pf_pdesc *);

-__private_extern__ struct pf_state_key *pf_alloc_state_key(struct pf_state *);
+__private_extern__ struct pf_state_key *pf_alloc_state_key(struct pf_state *,
+    struct pf_state_key *);

 __private_extern__ void pfr_initialize(void);
 __private_extern__ int pfr_match_addr(struct pfr_ktable *, struct pf_addr *,
     sa_family_t);
 __private_extern__ void pfr_initialize(void);
 __private_extern__ int pfr_match_addr(struct pfr_ktable *, struct pf_addr *,
     sa_family_t);


@@ -2158,6 +2284,7 @@ __private_extern__ int pfr_pool_get(struct pfr_ktable *, int *,
     struct pf_addr *, struct pf_addr **, struct pf_addr **, sa_family_t);
 __private_extern__ void pfr_dynaddr_update(struct pfr_ktable *,
     struct pfi_dynaddr *);
     struct pf_addr *, struct pf_addr **, struct pf_addr **, sa_family_t);
 __private_extern__ void pfr_dynaddr_update(struct pfr_ktable *,
     struct pfi_dynaddr *);

+__private_extern__ void pfr_table_copyin_cleanup(struct pfr_table *);

 __private_extern__ struct pfr_ktable *pfr_attach_table(struct pf_ruleset *,
     char *);
 __private_extern__ void pfr_detach_table(struct pfr_ktable *);
 __private_extern__ struct pfr_ktable *pfr_attach_table(struct pf_ruleset *,
     char *);
 __private_extern__ void pfr_detach_table(struct pfr_ktable *);


@@ -2197,7 +2324,7 @@ __private_extern__ int pfr_ina_commit(struct pfr_table *, u_int32_t, int *,
 __private_extern__ int pfr_ina_define(struct pfr_table *, user_addr_t,
     int, int *, int *, u_int32_t, int);
 
 __private_extern__ int pfr_ina_define(struct pfr_table *, user_addr_t,
     int, int *, int *, u_int32_t, int);
 

-__private_extern__ struct pfi_kif *pfi_all;
+extern struct pfi_kif *pfi_all;

 
 __private_extern__ void pfi_initialize(void);
 __private_extern__ struct pfi_kif *pfi_kif_get(const char *);
 
 __private_extern__ void pfi_initialize(void);
 __private_extern__ struct pfi_kif *pfi_kif_get(const char *);


@@ -2221,33 +2348,46 @@ __private_extern__ void pf_tag2tagname(u_int16_t, char *);
 __private_extern__ void pf_tag_ref(u_int16_t);
 __private_extern__ void pf_tag_unref(u_int16_t);
 __private_extern__ int pf_tag_packet(struct mbuf *, struct pf_mtag *,
 __private_extern__ void pf_tag_ref(u_int16_t);
 __private_extern__ void pf_tag_unref(u_int16_t);
 __private_extern__ int pf_tag_packet(struct mbuf *, struct pf_mtag *,

-    int, unsigned int);
+    int, unsigned int, struct pf_pdesc *);
+__private_extern__ void pf_step_into_anchor(int *, struct pf_ruleset **, int,
+    struct pf_rule **, struct pf_rule **,  int *);
+__private_extern__ int pf_step_out_of_anchor(int *, struct pf_ruleset **, int,
+    struct pf_rule **, struct pf_rule **, int *);

 __private_extern__ u_int32_t pf_qname2qid(char *);
 __private_extern__ void pf_qid2qname(u_int32_t, char *);
 __private_extern__ void pf_qid_unref(u_int32_t);
 
 __private_extern__ u_int32_t pf_qname2qid(char *);
 __private_extern__ void pf_qid2qname(u_int32_t, char *);
 __private_extern__ void pf_qid_unref(u_int32_t);
 

-__private_extern__ struct pf_status pf_status;
-__private_extern__ struct pool pf_frent_pl, pf_frag_pl;
+extern struct pf_status pf_status;
+extern struct pool pf_frent_pl, pf_frag_pl;

 
 struct pf_pool_limit {
        void            *pp;
        unsigned         limit;
 };
 
 struct pf_pool_limit {
        void            *pp;
        unsigned         limit;
 };

-__private_extern__ struct pf_pool_limit        pf_pool_limits[PF_LIMIT_MAX];
+extern struct pf_pool_limit    pf_pool_limits[PF_LIMIT_MAX];

 
 __private_extern__ int pf_af_hook(struct ifnet *, struct mbuf **,
 
 __private_extern__ int pf_af_hook(struct ifnet *, struct mbuf **,

-    struct mbuf **, unsigned int, int);
-__private_extern__ int pf_ifaddr_hook(struct ifnet *, unsigned long);
+    struct mbuf **, unsigned int, int, struct ip_fw_args *);
+__private_extern__ int pf_ifaddr_hook(struct ifnet *);

 __private_extern__ void pf_ifnet_hook(struct ifnet *, int);
 
 /*
  * The following are defined with "private extern" storage class for
  * kernel, and "extern" for user-space.
  */
 __private_extern__ void pf_ifnet_hook(struct ifnet *, int);
 
 /*
  * The following are defined with "private extern" storage class for
  * kernel, and "extern" for user-space.
  */

-__private_extern__ struct pf_anchor_global pf_anchors;
-__private_extern__ struct pf_anchor pf_main_anchor;
+extern struct pf_anchor_global pf_anchors;
+extern struct pf_anchor pf_main_anchor;

 #define pf_main_ruleset        pf_main_anchor.ruleset
 
 #define pf_main_ruleset        pf_main_anchor.ruleset
 

+extern int pf_is_enabled;
+extern int16_t pf_nat64_configured;
+#define PF_IS_ENABLED (pf_is_enabled != 0)
+extern u_int32_t pf_hash_seed;
+
+#if PF_ALTQ
+extern u_int32_t altq_allowed;
+#endif /* PF_ALTQ */
+

 /* these ruleset functions can be linked into userland programs (pfctl) */
 __private_extern__ int pf_get_ruleset_number(u_int8_t);
 __private_extern__ void pf_init_ruleset(struct pf_ruleset *);
 /* these ruleset functions can be linked into userland programs (pfctl) */
 __private_extern__ int pf_get_ruleset_number(u_int8_t);
 __private_extern__ void pf_init_ruleset(struct pf_ruleset *);


@@ -2259,6 +2399,8 @@ __private_extern__ void pf_anchor_remove(struct pf_rule *);
 __private_extern__ void pf_remove_if_empty_ruleset(struct pf_ruleset *);
 __private_extern__ struct pf_anchor *pf_find_anchor(const char *);
 __private_extern__ struct pf_ruleset *pf_find_ruleset(const char *);
 __private_extern__ void pf_remove_if_empty_ruleset(struct pf_ruleset *);
 __private_extern__ struct pf_anchor *pf_find_anchor(const char *);
 __private_extern__ struct pf_ruleset *pf_find_ruleset(const char *);

+__private_extern__ struct pf_ruleset *pf_find_ruleset_with_owner(const char *,
+    const char *, int, int *);

 __private_extern__ struct pf_ruleset *pf_find_or_create_ruleset(const char *);
 __private_extern__ void pf_rs_initialize(void);
 
 __private_extern__ struct pf_ruleset *pf_find_or_create_ruleset(const char *);
 __private_extern__ void pf_rs_initialize(void);
 


@@ -2272,6 +2414,8 @@ __private_extern__ int pf_osfp_get(struct pf_osfp_ioctl *);
 __private_extern__ void pf_osfp_initialize(void);
 __private_extern__ int pf_osfp_match(struct pf_osfp_enlist *, pf_osfp_t);
 __private_extern__ struct pf_os_fingerprint *pf_osfp_validate(void);
 __private_extern__ void pf_osfp_initialize(void);
 __private_extern__ int pf_osfp_match(struct pf_osfp_enlist *, pf_osfp_t);
 __private_extern__ struct pf_os_fingerprint *pf_osfp_validate(void);

+__private_extern__ struct pf_mtag *pf_find_mtag(struct mbuf *);
+__private_extern__ struct pf_mtag *pf_get_mtag(struct mbuf *);

 #else /* !KERNEL */
 extern struct pf_anchor_global pf_anchors;
 extern struct pf_anchor pf_main_anchor;
 #else /* !KERNEL */
 extern struct pf_anchor_global pf_anchors;
 extern struct pf_anchor pf_main_anchor;


@@ -2288,6 +2432,8 @@ extern void pf_anchor_remove(struct pf_rule *);
 extern void pf_remove_if_empty_ruleset(struct pf_ruleset *);
 extern struct pf_anchor *pf_find_anchor(const char *);
 extern struct pf_ruleset *pf_find_ruleset(const char *);
 extern void pf_remove_if_empty_ruleset(struct pf_ruleset *);
 extern struct pf_anchor *pf_find_anchor(const char *);
 extern struct pf_ruleset *pf_find_ruleset(const char *);

+extern struct pf_ruleset *pf_find_ruleset_with_owner(const char *,
+    const char *, int, int *);

 extern struct pf_ruleset *pf_find_or_create_ruleset(const char *);
 extern void pf_rs_initialize(void);
 #endif /* !KERNEL */
 extern struct pf_ruleset *pf_find_or_create_ruleset(const char *);
 extern void pf_rs_initialize(void);
 #endif /* !KERNEL */