Submitted by: Whistle Communications (archie Cobbs)

these are quite extensive additions to the ipfw code.
they include a change to the API because the old method was
broken, but the user view is kept the same.

The new code allows a particular match to skip forward to a particular
line number, so that blocks of rules can be
used without checking all the intervening rules.
There are also many more ways of rejecting
connections especially TCP related, and
many many more ...

see the man page for a complete description.

8 files changed, 1085 insertions, 528 deletions

diff --git a/sbin/ipfw/Makefile b/sbin/ipfw/Makefile
index 3effc23..1bc6fa4 100644
--- a/sbin/ipfw/Makefile
+++ b/sbin/ipfw/Makefile
@@ -1,5 +1,7 @@
 PROG=   ipfw
 
+COPTS+=	-Wall
+
 MAN8=	ipfw.8
 
 .include <bsd.prog.mk>
diff --git a/sbin/ipfw/ipfw.8 b/sbin/ipfw/ipfw.8
index 6bfa4cd..7198d04 100644
--- a/sbin/ipfw/ipfw.8
+++ b/sbin/ipfw/ipfw.8
@@ -19,10 +19,10 @@ flush
 .Fl q
 .Oc
 zero
-.Op Ar number
+.Op Ar number ...
 .Nm ipfw
 delete
-.Ar number
+.Ar number ...
 .Nm ipfw
 .Op Fl aftN
 list
@@ -122,41 +122,101 @@ Try to resolve addresses and service names in output.
 .Bl -hang -offset flag -width 1234567890123456
 .It Ar allow
 Allow packets that match rule.
-The search terminates.
-.It Ar pass
-Same as allow.
-.It Ar accept
-Same as allow.
-.It Ar count
-Update counters for all packets that match rule.
-The search continues with the next rule.
+The search terminates. Aliases are
+.Ar pass ,
+.Ar permit ,
+and
+.Ar accept .
 .It Ar deny
 Discard packets that match this rule.
 The search terminates.
+.Ar Drop
+is an alias for
+.Ar deny .
 .It Ar reject
-Discard packets that match this rule, and try to send an ICMP notice.
+(Deprecated.) Discard packets that match this rule, and try to send an ICMP
+host unreachable notice.
 The search terminates.
+.It Ar unreach code
+Discard packets that match this rule, and try to send an ICMP
+unreachable notice with code
+.Ar code ,
+where
+.Ar code
+is a number from zero to 255, or one of these aliases:
+.Ar net ,
+.Ar host ,
+.Ar protocol ,
+.Ar port ,
+.Ar needfrag ,
+.Ar srcfail ,
+.Ar net-unknown ,
+.Ar host-unknown ,
+.Ar isolated ,
+.Ar net-prohib ,
+.Ar host-prohib ,
+.Ar tosnet ,
+.Ar toshost ,
+.Ar filter-prohib ,
+.Ar host-precedence ,
+or
+.Ar precedence-cutoff .
+The search terminates.
+.It Ar reset
+TCP packets only. Discard packets that match this rule,
+and try to send a TCP reset (RST) notice.
+The search terminates.
+.It Ar count
+Update counters for all packets that match rule.
+The search continues with the next rule.
 .It Ar divert port
-Divert packets that match this rule to the divert socket bound to port
+Divert packets that match this rule to the
+.Xr divert 4
+socket bound to port
 .Ar port .
 The search terminates.
+.It Ar tee port
+Send a copy of packets matching this rule to the
+.Xr divert 4
+socket bound to port
+.Ar port .
+The search continues with the next rule.
+.It Ar skipto number
+Skip all subsequent rules numbered less than
+.Ar number .
+The search continues with the first rule numbered
+.Ar number
+or higher.
 .El
 .Pp
-When a packet matches a rule with the ``log''
-keyword, a message will be printed on the console.
+If a packet matches more than one
+.Ar divert
+and/or
+.Ar tee
+rule, all but the last are ignored.
+.Pp
+If the kernel was compiled with
+.Dv IPFIREWALL_VERBOSE ,
+then when a packet matches a rule with the ``log''
+keyword a message will be printed on the console.
 If the kernel was compiled with the
-.Dv IP_FIREWALL_VERBOSE_LIMIT
+.Dv IPFIREWALL_VERBOSE_LIMIT
 option, then logging will cease after the number of packets
 specified by the option are received for that particular
 chain entry.  Logging may then be re-enabled by clearing
 the packet counter for that entry.
 .Pp
+Console logging and the log limit are adjustable dynamically
+through the
+.Xr sysctl 8
+interface.
+.Pp
 .Ar proto :
 .Bl -hang -offset flag -width 1234567890123456
 .It Ar ip
-All packets match.
-.It Ar all
-All packets match.
+All packets match. The alias
+.Ar all
+has the same effect.
 .It Ar tcp
 Only TCP packets match.
 .It Ar udp
@@ -172,7 +232,6 @@ for a complete list).
 .Ar src 
 and
 .Ar dst :
-.Pp
 .Bl -hang -offset flag
 .It Ar <address/mask>
 .Op Ar ports
@@ -217,20 +276,72 @@ and the port list is limited to
 .Pa /usr/src/sys/netinet/ip_fw.h )
 ports.
 .Pp
-If ``via''
-.Ar name
-is specified, only packets received via or on their way out of an interface
-matching
-.Ar name
-will match this rule.
+Rules can apply to packets when they are incoming, or outgoing, or both.
+The
+.Ar in
+keyword indicates the rule should only match incoming packets.
+The
+.Ar out
+keyword indicates the rule should only match outgoing packets.
 .Pp
-If ``via''
-.Ar ipno
-is specified, only packets received via or on their way out of an interface
-having the address
-.Ar ipno
-will match this rule.
+To match packets going through a certain interface, specify
+the interface using
+.Ar via :
+.Bl -hang -offset flag -width 1234567890123456
+.It Ar via ifX
+Packet must be going through interface
+.Ar ifX.
+.It Ar via if*
+Packet must be going through interface
+.Ar ifX ,
+where X is any unit number.
+.It Ar via any
+Packet must be going through
+.Em some
+interface.
+.It Ar via ipno
+Packet must be going through the interface having IP address
+.Ar ipno .
+.El
+.Pp
+The
+.Ar via
+keyword causes the interface to always be checked.
+If
+.Ar recv
+or
+.Ar xmit
+is used instead of
+.Ar via ,
+then the only receive or transmit interface (respectively) is checked.
+By specifying both, it is possible to match packets based on both receive
+and transmit interface, e.g.:
+.Pp
+.Dl "ipfw add 100 deny ip from any to any out recv ed0 xmit ed1"
 .Pp
+The
+.Ar recv
+interface can be tested on either incoming or outgoing packets, while the
+.Ar xmit
+interface can only be tested on outgoing packets. So
+.Ar out
+is required (and
+.Ar in
+invalid) whenver
+.Ar xmit
+is used. Specifying
+.Ar via
+together with
+.Ar xmit
+or
+.Ar recv
+is invalid.
+.Pp
+A packet may not have a receive or transmit interface: packets originating
+from the local host have no receive interface. while packets destined for
+the local host have no transmit interface.
+.Pp
+Additional
 .Ar options :
 .Bl -hang -offset flag -width 1234567890123456
 .It frag
@@ -350,11 +461,11 @@ This rule diverts all incoming packets from 192.168.2.0/24 to divert port 5000:
 .Sh SEE ALSO
 .Xr divert 4 ,
 .Xr ip 4 ,
-.Xr ipfirewall 4 ,
 .Xr protocols 5 ,
 .Xr services 5 ,
 .Xr reboot 8 ,
-.Xr syslogd 8
+.Xr syslogd 8 ,
+.Xr sysctl 8
 .Sh BUGS
 .Pp
 .Em WARNING!!WARNING!!WARNING!!WARNING!!WARNING!!WARNING!!WARNING!!
@@ -367,6 +478,12 @@ do anything you don't understand.
 .Pp
 When manipulating/adding chain entries, service and protocol names are
 not accepted.
+.Pp
+Incoming packet fragments diverted by
+.Ar divert
+are reassembled before delivery to the socket, whereas fragments diverted via
+.Ar tee
+are not.
 .Sh AUTHORS
 Ugen J. S. Antsilevich,
 Poul-Henning Kamp,
diff --git a/sbin/ipfw/ipfw.c b/sbin/ipfw/ipfw.c
index 1254721..7a426ec 100644
--- a/sbin/ipfw/ipfw.c
+++ b/sbin/ipfw/ipfw.c
@@ -16,7 +16,7 @@
  *
  * NEW command line interface for IP firewall facility
  *
- * $Id: ipfw.c,v 1.41 1997/03/05 12:08:44 bde Exp $
+ * $Id: ipfw.c,v 1.42 1997/03/29 03:32:28 imp Exp $
  *
  */
 
@@ -32,18 +32,23 @@
 #include <netdb.h>
 #include <stdio.h>
 #include <stdlib.h>
+#include <stdarg.h>
 #include <string.h>
 #include <time.h>
 #include <unistd.h>
 
 #include <net/if.h>
 #include <netinet/in.h>
+#include <netinet/in_systm.h>
+#include <netinet/ip_var.h>
+#include <netinet/ip.h>
+#include <netinet/ip_icmp.h>
 #include <netinet/ip_fw.h>
 #include <netinet/tcp.h>
 #include <arpa/inet.h>
 
-int 	lineno = -1;
-char 		progname[BUFSIZ];		/* Program name for errors */
+extern char	*__progname;
+int 		lineno = -1;
 
 int 		s;				/* main RAW socket 	   */
 int 		do_resolv=0;			/* Would try to resolv all */
@@ -52,9 +57,33 @@ int		do_time=0;			/* Show time stamps        */
 int		do_quiet=0;			/* Be quiet in add and flush  */
 int		do_force=0;			/* Don't ask for confirmation */
 
-int
-mask_bits(m_ad)
-	struct in_addr m_ad;
+struct icmpcode {
+	int	code;
+	char	*str;
+};
+
+static struct icmpcode icmpcodes[] = {
+      { ICMP_UNREACH_NET,		"net" },
+      { ICMP_UNREACH_HOST,		"host" },
+      { ICMP_UNREACH_PROTOCOL,		"protocol" },
+      { ICMP_UNREACH_PORT,		"port" },
+      { ICMP_UNREACH_NEEDFRAG,		"needfrag" },
+      { ICMP_UNREACH_SRCFAIL,		"srcfail" },
+      { ICMP_UNREACH_NET_UNKNOWN,	"net-unknown" },
+      { ICMP_UNREACH_HOST_UNKNOWN,	"host-unknown" },
+      { ICMP_UNREACH_ISOLATED,		"isolated" },
+      { ICMP_UNREACH_NET_PROHIB,	"net-prohib" },
+      { ICMP_UNREACH_HOST_PROHIB,	"host-prohib" },
+      { ICMP_UNREACH_TOSNET,		"tosnet" },
+      { ICMP_UNREACH_TOSHOST,		"toshost" },
+      { ICMP_UNREACH_FILTER_PROHIB,	"filter-prohib" },
+      { ICMP_UNREACH_HOST_PRECEDENCE,	"host-precedence" },
+      { ICMP_UNREACH_PRECEDENCE_CUTOFF,	"precedence-cutoff" },
+      { 0, NULL }
+};
+
+static int
+mask_bits(struct in_addr m_ad)
 {
 	int h_fnd=0,h_num=0,i;
 	u_long mask;
@@ -101,15 +130,47 @@ print_port(prot, port, comma)
 		printf("%s%d",comma,port);
 }
 
-void
-show_ipfw(chain)
-	struct ip_fw *chain;
+static void
+print_iface(char *key, union ip_fw_if *un, int byname)
+{
+	char ifnb[FW_IFNLEN+1];
+
+	if (byname) {
+		strncpy(ifnb, un->fu_via_if.name, FW_IFNLEN);
+		ifnb[FW_IFNLEN]='\0';
+		if (un->fu_via_if.unit == -1)
+			printf(" %s %s*", key, ifnb);
+		else 
+			printf(" %s %s%d", key, ifnb, un->fu_via_if.unit);
+	} else if (un->fu_via_ip.s_addr != 0) {
+		printf(" %s %s", key, inet_ntoa(un->fu_via_ip));
+	} else
+		printf(" %s any", key);
+}
+
+static void
+print_reject_code(int code)
+{
+	struct icmpcode *ic;
+
+	for (ic = icmpcodes; ic->str; ic++)
+		if (ic->code == code) {
+			printf("%s", ic->str);
+			return;
+		}
+	printf("%u", code);
+}
+
+static void
+show_ipfw(struct ip_fw *chain)
 {
 	char *comma;
 	u_long adrt;
 	struct hostent *he;
 	struct protoent *pe;
 	int i, mb;
+	int nsp = IP_FW_GETNSRCP(chain);
+	int ndp = IP_FW_GETNDSTP(chain);
 
 	if (do_resolv)
 		setservent(1/*stayopen*/);
@@ -138,17 +199,28 @@ show_ipfw(chain)
 		case IP_FW_F_ACCEPT:
 			printf("allow");
 			break;
-		case IP_FW_F_DIVERT:
-			printf("divert %u", chain->fw_divert_port);
+		case IP_FW_F_DENY:
+			printf("deny");
 			break;
 		case IP_FW_F_COUNT:
 			printf("count");
 			break;
-		case IP_FW_F_DENY:
-			if (chain->fw_flg & IP_FW_F_ICMPRPL)
-				printf("reject");
-			else
-				printf("deny");
+		case IP_FW_F_DIVERT:
+			printf("divert %u", chain->fw_divert_port);
+			break;
+		case IP_FW_F_TEE:
+			printf("tee %u", chain->fw_divert_port);
+			break;
+		case IP_FW_F_SKIPTO:
+			printf("skipto %u", chain->fw_skipto_rule);
+			break;
+		case IP_FW_F_REJECT:
+			if (chain->fw_reject_code == IP_FW_REJECT_RST)
+				printf("reset");
+			else {
+				printf("unreach ");
+				print_reject_code(chain->fw_reject_code);
+			}
 			break;
 		default:
 			errx(1, "impossible");
@@ -161,7 +233,7 @@ show_ipfw(chain)
 	if (pe)
 		printf(" %s", pe->p_name);
 	else
-		printf("%u", chain->fw_prot);
+		printf(" %u", chain->fw_prot);
 
 	printf(" from %s", chain->fw_flg & IP_FW_F_INVSRC ? "not " : "");
 
@@ -192,9 +264,9 @@ show_ipfw(chain)
 			printf(inet_ntoa(chain->fw_src));
 	}
 
-	if (chain->fw_prot != IPPROTO_IP) {
+	if (chain->fw_prot == IPPROTO_TCP || chain->fw_prot == IPPROTO_UDP) {
 		comma = " ";
-		for (i=0;i<chain->fw_nsp; i++ ) {
+		for (i = 0; i < nsp; i++) {
 			print_port(chain->fw_prot, chain->fw_pts[i], comma);
 			if (i==0 && (chain->fw_flg & IP_FW_F_SRNG))
 				comma = "-";
@@ -232,35 +304,36 @@ show_ipfw(chain)
 			printf(inet_ntoa(chain->fw_dst));
 	}
 
-	comma = " ";
-	for (i=0;i<chain->fw_ndp;i++) {
-		print_port(chain->fw_prot, chain->fw_pts[chain->fw_nsp+i],
-			   comma);
-		if (i==0 && (chain->fw_flg & IP_FW_F_DRNG))
-			comma = "-";
-		else
-		    comma = ",";
-	    }
+	if (chain->fw_prot == IPPROTO_TCP || chain->fw_prot == IPPROTO_UDP) {
+		comma = " ";
+		for (i = 0; i < ndp; i++) {
+			print_port(chain->fw_prot, chain->fw_pts[nsp+i], comma);
+			if (i==0 && (chain->fw_flg & IP_FW_F_DRNG))
+				comma = "-";
+			else
+				comma = ",";
+		}
+	}
 
-	if ((chain->fw_flg & IP_FW_F_IN) && (chain->fw_flg & IP_FW_F_OUT))
-		; 
-	else if (chain->fw_flg & IP_FW_F_IN)
+	/* Direction */
+	if ((chain->fw_flg & IP_FW_F_IN) && !(chain->fw_flg & IP_FW_F_OUT))
 		printf(" in");
-	else if (chain->fw_flg & IP_FW_F_OUT)
+	if (!(chain->fw_flg & IP_FW_F_IN) && (chain->fw_flg & IP_FW_F_OUT))
 		printf(" out");
 
-	if (chain->fw_flg&IP_FW_F_IFNAME && chain->fw_via_name[0]) {
-		char ifnb[FW_IFNLEN+1];
-		printf(" via ");
-		strncpy(ifnb,chain->fw_via_name,FW_IFNLEN);
-		ifnb[FW_IFNLEN]='\0';
-		if (chain->fw_flg & IP_FW_F_IFUWILD)
-			printf("%s*",ifnb);
-		else 
-			printf("%s%d",ifnb,chain->fw_via_unit);
-	} else if (chain->fw_via_ip.s_addr) {
-		printf(" via ");
-		printf(inet_ntoa(chain->fw_via_ip));
+	/* Handle hack for "via" backwards compatibility */
+	if ((chain->fw_flg & IF_FW_F_VIAHACK) == IF_FW_F_VIAHACK) {
+		print_iface("via",
+		    &chain->fw_in_if, chain->fw_flg & IP_FW_F_IIFNAME);
+	} else {
+		/* Receive interface specified */
+		if (chain->fw_flg & IP_FW_F_IIFACE)
+			print_iface("recv", &chain->fw_in_if,
+			    chain->fw_flg & IP_FW_F_IIFNAME);
+		/* Transmit interface specified */
+		if (chain->fw_flg & IP_FW_F_OIFACE)
+			print_iface("xmit", &chain->fw_out_if,
+			    chain->fw_flg & IP_FW_F_OIFNAME);
 	}
 
 	if (chain->fw_flg & IP_FW_F_FRAG)
@@ -342,44 +415,50 @@ list(ac, av)
 		show_ipfw(r);
 }
 
-void
-show_usage(str)
-	char	*str;
+static void
+show_usage(const char *fmt, ...)
 {
-	if (str)
-		fprintf(stderr,"%s: ERROR - %s\n",progname,str);
+	if (fmt) {
+		char buf[100];
+		va_list args;
+
+		va_start(args, fmt);
+		vsnprintf(buf, sizeof(buf), fmt, args);
+		va_end(args);
+		warnx("error: %s", buf);
+	} else
+		warnx("error");
 	fprintf(stderr,
 "Usage:\n"
-"\t%s [options]\n"
-"\t\tflush\n"
-"\t\tadd [number] rule\n"
-"\t\tdelete number\n"
-"\t\tlist [number]\n"
-"\t\tshow [number]\n"
-"\t\tzero [number]\n"
-"\trule:\taction proto src dst extras...\n"
-"\t\taction: {allow|deny|reject|count|divert port} [log]\n"
-"\t\tproto: {ip|tcp|udp|icmp|<number>}}\n"
-"\t\tsrc: from {any|ip[{/bits|:mask}]} [{port|port-port},[port],...]\n"
-"\t\tdst: to {any|ip[{/bits|:mask}]} [{port|port-port},[port],...]\n"
-"\textras:\n"
-"\t\tfragment\n"
-"\t\t{in|out|inout}\n"
-"\t\tvia {ifname|ip}\n"
-"\t\t{established|setup}\n"
-"\t\ttcpflags [!]{syn|fin|rst|ack|psh|urg},...\n"
-"\t\tipoptions [!]{ssrr|lsrr|rr|ts},...\n"
-"\t\ticmptypes {type},...\n"
-"\t\tproto {ipproto},...\n"
-, progname
-);
-
-		
-	fprintf(stderr,"See man %s(8) for proper usage.\n",progname);
-	exit (1);
+"  %s [options]\n"
+"    flush\n"
+"    add [number] rule\n"
+"    delete number ...\n"
+"    list [number]\n"
+"    show [number]\n"
+"    zero [number ...]\n"
+"  rule:  action proto src dst extras...\n"
+"    action:\n"
+"      {allow|permit|accept|pass|deny|drop|reject|unreach code|\n"
+"       reset|count|skipto num|divert port|tee port} [log]\n"
+"    proto: {ip|tcp|udp|icmp|<number>}\n"
+"    src: from [not] {any|ip[{/bits|:mask}]} [{port|port-port},[port],...]\n"
+"    dst: to [not] {any|ip[{/bits|:mask}]} [{port|port-port},[port],...]\n"
+"  extras:\n"
+"    fragment\n"
+"    in\n"
+"    out\n"
+"    {xmit|recv|via} {iface|ip|any}\n"
+"    {established|setup}\n"
+"    tcpflags [!]{syn|fin|rst|ack|psh|urg},...\n"
+"    ipoptions [!]{ssrr|lsrr|rr|ts},...\n"
+"    icmptypes {type[,type]}...\n",
+__progname);
+
+	errx(1, "see man %s(8) for proper usage.", __progname);
 }
 
-int
+static int
 lookup_host (host, ipaddr)
 	char *host;
 	struct in_addr *ipaddr;
@@ -415,22 +494,25 @@ fill_ip(ipno, mask, acp, avp)
 			*p++ = '\0'; 
 		}
 
-		if (lookup_host(*av,ipno) != 0)
-			show_usage("ip number\n");
+		if (lookup_host(*av, ipno) != 0)
+			show_usage("hostname ``%s'' unknown", *av);
 		switch (md) {
 			case ':':
 				if (!inet_aton(p,mask))
-					show_usage("ip number\n");
+					show_usage("bad netmask ``%s''", p);
 				break;
 			case '/':
 				if (atoi(p) == 0) {
 					mask->s_addr = 0;
+				} else if (atoi(p) > 32) {
+					show_usage("bad width ``%s''", p);
 				} else {
-					mask->s_addr = htonl(0xffffffff << (32 - atoi(p)));
+					mask->s_addr =
+					    htonl(~0 << (32 - atoi(p)));
 				}
 				break;
 			default:
-				mask->s_addr = htonl(0xffffffff);
+				mask->s_addr = htonl(~0);
 				break;
 		}
 		ipno->s_addr &= mask->s_addr;
@@ -441,7 +523,27 @@ fill_ip(ipno, mask, acp, avp)
 	*avp = av;
 }
 
-void
+static void
+fill_reject_code(u_short *codep, char *str)
+{
+	struct icmpcode *ic;
+	u_long val;
+	char *s;
+
+	val = strtoul(str, &s, 0);
+	if (s != str && *s == '\0' && val < 0x100) {
+		*codep = val;
+		return;
+	}
+	for (ic = icmpcodes; ic->str; ic++)
+		if (!strcasecmp(str, ic->str)) {
+			*codep = ic->code;
+			return;
+		}
+	show_usage("unknown ICMP unreachable code ``%s''", str);
+}
+
+static void
 add_port(cnt, ptr, off, port)
 	u_short *cnt, *ptr, off, port;
 {
@@ -520,15 +622,13 @@ fill_tcpflag(set, reset, vp)
 				break;
 			}
 		if (i == sizeof(flags) / sizeof(flags[0]))
-			show_usage("invalid tcp flag\n");
+			show_usage("invalid tcp flag ``%s''", p);
 		p = q;
 	}
 }
 
-void
-fill_ipopt(set, reset, vp)
-	u_char *set, *reset;
-	char **vp;
+static void
+fill_ipopt(u_char *set, u_char *reset, char **vp)
 {
 	char *p = *vp,*q;
 	u_char *d;
@@ -593,18 +693,16 @@ delete(ac,av)
 	av++; ac--;
 
 	/* Rule number */
-	if (ac && isdigit(**av)) {
+	while (ac && isdigit(**av)) {
 		rule.fw_number = atoi(*av); av++; ac--;
+		i = setsockopt(s, IPPROTO_IP, IP_FW_DEL, &rule, sizeof rule);
+		if (i)
+			warn("setsockopt(%s)", "IP_FW_DEL");
 	}
-
-	i = setsockopt(s, IPPROTO_IP, IP_FW_DEL, &rule, sizeof rule);
-	if (i)
-		err(1,"setsockopt(IP_FW_DEL)");
 }
 
-int
-verify_interface(rule)
-	struct ip_fw *rule;
+static void
+verify_interface(union ip_fw_if *ifu)
 {
 	struct ifreq ifr;
 
@@ -613,16 +711,42 @@ verify_interface(rule)
 	 *	If a wildcard was specified, check for unit 0.
 	 */
 	snprintf(ifr.ifr_name, sizeof(ifr.ifr_name), "%s%d", 
-			 rule->fw_via_name,
-			 rule->fw_flg & IP_FW_F_IFUWILD ? 0 : rule->fw_via_unit);
+			 ifu->fu_via_if.name,
+			 ifu->fu_via_if.unit == -1 ? 0 : ifu->fu_via_if.unit);
 
 	if (ioctl(s, SIOCGIFFLAGS, &ifr) < 0)
-		return(-1);	/* interface isn't recognized by the kernel */
+		warnx("warning: interface ``%s'' does not exist", ifr.ifr_name);
+}
 
-	return(0); /* interface exists */
+static void
+fill_iface(char *which, union ip_fw_if *ifu, int *byname, int ac, char *arg)
+{
+	if (!ac)
+	    show_usage("missing argument for ``%s''", which);
+
+	/* Parse the interface or address */
+	if (!strcmp(arg, "any")) {
+		ifu->fu_via_ip.s_addr = 0;
+		*byname = 0;
+	} else if (!isdigit(*arg)) {
+		char *q;
+
+		*byname = 1;
+		strncpy(ifu->fu_via_if.name, arg, sizeof(ifu->fu_via_if.name));
+		ifu->fu_via_if.name[sizeof(ifu->fu_via_if.name) - 1] = '\0';
+		for (q = ifu->fu_via_if.name;
+		    *q && !isdigit(*q) && *q != '*'; q++)
+			continue;
+		ifu->fu_via_if.unit = (*q == '*') ? -1 : atoi(q);
+		*q = '\0';
+		verify_interface(ifu);
+	} else if (!inet_aton(arg, &ifu->fu_via_ip)) {
+		show_usage("bad ip address ``%s''", arg);
+	} else
+		*byname = 0;
 }
 
-void
+static void
 add(ac,av)
 	int ac;
 	char **av;
@@ -631,6 +755,7 @@ add(ac,av)
 	int i;
 	u_char proto;
 	struct protoent *pe;
+	int saw_xmrc = 0, saw_via = 0;
 	
 	memset(&rule, 0, sizeof rule);
 
@@ -642,26 +767,48 @@ add(ac,av)
 	}
 
 	/* Action */
-	if (ac && (!strncmp(*av,"accept",strlen(*av))
+	if (ac == 0)
+		show_usage("missing action");
+	if (!strncmp(*av,"accept",strlen(*av))
 		    || !strncmp(*av,"pass",strlen(*av))
 		    || !strncmp(*av,"allow",strlen(*av))
-		    || !strncmp(*av,"permit",strlen(*av)))) {
+		    || !strncmp(*av,"permit",strlen(*av))) {
 		rule.fw_flg |= IP_FW_F_ACCEPT; av++; ac--;
-	} else if (ac && !strncmp(*av,"count",strlen(*av))) {
+	} else if (!strncmp(*av,"count",strlen(*av))) {
 		rule.fw_flg |= IP_FW_F_COUNT; av++; ac--;
-	} else if (ac && !strncmp(*av,"divert",strlen(*av))) {
+	} else if (!strncmp(*av,"divert",strlen(*av))) {
 		rule.fw_flg |= IP_FW_F_DIVERT; av++; ac--;
 		if (!ac)
 			show_usage("missing divert port");
 		rule.fw_divert_port = strtoul(*av, NULL, 0); av++; ac--;
 		if (rule.fw_divert_port == 0)
 			show_usage("illegal divert port");
-	} else if (ac && (!strncmp(*av,"deny",strlen(*av)))) {
+	} else if (!strncmp(*av,"tee",strlen(*av))) {
+		rule.fw_flg |= IP_FW_F_TEE; av++; ac--;
+		if (!ac)
+			show_usage("missing divert port");
+		rule.fw_divert_port = strtoul(*av, NULL, 0); av++; ac--;
+		if (rule.fw_divert_port == 0)
+			show_usage("illegal divert port");
+	} else if (!strncmp(*av,"skipto",strlen(*av))) {
+		rule.fw_flg |= IP_FW_F_SKIPTO; av++; ac--;
+		if (!ac)
+			show_usage("missing skipto rule number");
+		rule.fw_skipto_rule = strtoul(*av, NULL, 0); av++; ac--;
+	} else if ((!strncmp(*av,"deny",strlen(*av))
+		    || !strncmp(*av,"drop",strlen(*av)))) {
 		rule.fw_flg |= IP_FW_F_DENY; av++; ac--;
-	} else if (ac && !strncmp(*av,"reject",strlen(*av))) {
-		rule.fw_flg |= IP_FW_F_DENY|IP_FW_F_ICMPRPL; av++; ac--;
+	} else if (!strncmp(*av,"reject",strlen(*av))) {
+		rule.fw_flg |= IP_FW_F_REJECT; av++; ac--;
+		rule.fw_reject_code = ICMP_UNREACH_HOST;
+	} else if (!strncmp(*av,"reset",strlen(*av))) {
+		rule.fw_flg |= IP_FW_F_REJECT; av++; ac--;
+		rule.fw_reject_code = IP_FW_REJECT_RST;	/* check TCP later */
+	} else if (!strncmp(*av,"unreach",strlen(*av))) {
+		rule.fw_flg |= IP_FW_F_REJECT; av++; ac--;
+		fill_reject_code(&rule.fw_reject_code, *av); av++; ac--;
 	} else {
-		show_usage("missing/unrecognized action\n");
+		show_usage("invalid action ``%s''", *av);
 	}
 
 	/* [log] */
@@ -670,103 +817,142 @@ add(ac,av)
 	}
 
 	/* protocol */
-	if (ac) {
-		if ((proto = atoi(*av)) > 0) {
-			rule.fw_prot = proto; av++; ac--;
-		} else if (!strncmp(*av,"all",strlen(*av))) {
-			rule.fw_prot = IPPROTO_IP; av++; ac--;
-		} else if ((pe = getprotobyname(*av)) != NULL) {
-			rule.fw_prot = pe->p_proto; av++; ac--;
-		} else {
-			show_usage("invalid protocol\n");
-		}
-	} else
-		show_usage("missing protocol\n");
+	if (ac == 0)
+		show_usage("missing protocol");
+	if ((proto = atoi(*av)) > 0) {
+		rule.fw_prot = proto; av++; ac--;
+	} else if (!strncmp(*av,"all",strlen(*av))) {
+		rule.fw_prot = IPPROTO_IP; av++; ac--;
+	} else if ((pe = getprotobyname(*av)) != NULL) {
+		rule.fw_prot = pe->p_proto; av++; ac--;
+	} else {
+		show_usage("invalid protocol ``%s''", *av);
+	}
+
+	if (rule.fw_prot != IPPROTO_TCP
+	    && (rule.fw_flg & IP_FW_F_COMMAND) == IP_FW_F_REJECT
+	    && rule.fw_reject_code == IP_FW_REJECT_RST)
+		show_usage("``reset'' is only valid for tcp packets");
 
 	/* from */
 	if (ac && !strncmp(*av,"from",strlen(*av))) { av++; ac--; }
-	else show_usage("missing ``from''\n");
+	else
+		show_usage("missing ``from''");
 
 	if (ac && !strncmp(*av,"not",strlen(*av))) {
 		rule.fw_flg |= IP_FW_F_INVSRC;
 		av++; ac--;
 	}
-	if (!ac) show_usage("Missing arguments\n");
+	if (!ac)
+		show_usage("missing arguments");
 
 	fill_ip(&rule.fw_src, &rule.fw_smsk, &ac, &av);
 
 	if (ac && isdigit(**av)) {
-		if (fill_port(&rule.fw_nsp, &rule.fw_pts, 0, *av, 0))
+		u_short nports = 0;
+
+		if (fill_port(&nports, rule.fw_pts, 0, *av))
 			rule.fw_flg |= IP_FW_F_SRNG;
+		IP_FW_SETNSRCP(&rule, nports);
 		av++; ac--;
 	}
 
 	/* to */
 	if (ac && !strncmp(*av,"to",strlen(*av))) { av++; ac--; }
-	else show_usage("missing ``to''\n");
+	else
+		show_usage("missing ``to''");
 
 	if (ac && !strncmp(*av,"not",strlen(*av))) {
 		rule.fw_flg |= IP_FW_F_INVDST;
 		av++; ac--;
 	}
-	if (!ac) show_usage("Missing arguments\n");
+	if (!ac)
+		show_usage("missing arguments");
 
 	fill_ip(&rule.fw_dst, &rule.fw_dmsk, &ac, &av);
 
 	if (ac && isdigit(**av)) {
-		if (fill_port(&rule.fw_ndp, &rule.fw_pts, rule.fw_nsp, *av, 0))
+		u_short	nports = 0;
+
+		if (fill_port(&nports,
+		    rule.fw_pts, IP_FW_GETNSRCP(&rule), *av))
 			rule.fw_flg |= IP_FW_F_DRNG;
+		IP_FW_SETNDSTP(&rule, nports);
 		av++; ac--;
 	}
 
-	if ((rule.fw_prot != IPPROTO_TCP) &&
-	    (rule.fw_prot != IPPROTO_UDP) &&
-	    (rule.fw_nsp || rule.fw_ndp)) {
-		show_usage("only TCP and UDP protocols are valid with port specifications");
+	if ((rule.fw_prot != IPPROTO_TCP) && (rule.fw_prot != IPPROTO_UDP)
+	    && (IP_FW_GETNSRCP(&rule) || IP_FW_GETNDSTP(&rule))) {
+		show_usage("only TCP and UDP protocols are valid"
+		    " with port specifications");
 	}
 
 	while (ac) {
-		if (ac && !strncmp(*av,"via",strlen(*av))) {
-			if (rule.fw_via_ip.s_addr || (rule.fw_flg & IP_FW_F_IFNAME)) {
-				show_usage("multiple 'via' options specified");
-			}
-
-			av++; ac--; 
-			if (!ac) {
-				show_usage("'via' option specified with no interface.");
-			}
-			if (!isdigit(**av)) {
-				char *q;
-
-				strncpy(rule.fw_via_name, *av, sizeof(rule.fw_via_name));
-				rule.fw_via_name[sizeof(rule.fw_via_name) - 1] = '\0';
-				for (q = rule.fw_via_name; *q && !isdigit(*q) && *q != '*'; q++)
-					continue;
-				if (*q == '*')
-					rule.fw_flg |= IP_FW_F_IFUWILD;
-				else
-					rule.fw_via_unit = atoi(q);
-				*q = '\0';
-				rule.fw_flg |= IP_FW_F_IFNAME;
-				if (verify_interface(&rule) != 0)
-					fprintf(stderr, "Warning: interface does not exist\n");
-			} else if (inet_aton(*av,&rule.fw_via_ip) == INADDR_NONE) {
-				show_usage("bad IP# after via\n");
+		if (!strncmp(*av,"in",strlen(*av))) { 
+			rule.fw_flg |= IP_FW_F_IN;
+			av++; ac--; continue;
+		}
+		if (!strncmp(*av,"out",strlen(*av))) { 
+			rule.fw_flg |= IP_FW_F_OUT;
+			av++; ac--; continue;
+		}
+		if (ac && !strncmp(*av,"xmit",strlen(*av))) {
+			union ip_fw_if ifu;
+			int byname;
+
+			if (saw_via) {
+badviacombo:
+				show_usage("``via'' is incompatible"
+				    " with ``xmit'' and ``recv''");
 			}
+			saw_xmrc = 1;
 			av++; ac--; 
-			continue;
+			fill_iface("xmit", &ifu, &byname, ac, *av);
+			rule.fw_out_if = ifu;
+			rule.fw_flg |= IP_FW_F_OIFACE;
+			if (byname)
+				rule.fw_flg |= IP_FW_F_OIFNAME;
+			av++; ac--; continue;
 		}
-		if (!strncmp(*av,"fragment",strlen(*av))) { 
-			rule.fw_flg |= IP_FW_F_FRAG; av++; ac--; continue;
+		if (ac && !strncmp(*av,"recv",strlen(*av))) {
+			union ip_fw_if ifu;
+			int byname;
+
+			if (saw_via)
+				goto badviacombo;
+			saw_xmrc = 1;
+			av++; ac--; 
+			fill_iface("recv", &ifu, &byname, ac, *av);
+			rule.fw_in_if = ifu;
+			rule.fw_flg |= IP_FW_F_IIFACE;
+			if (byname)
+				rule.fw_flg |= IP_FW_F_IIFNAME;
+			av++; ac--; continue;
 		}
-		if (!strncmp(*av,"in",strlen(*av))) { 
-			rule.fw_flg |= IP_FW_F_IN; av++; ac--; continue;
+		if (ac && !strncmp(*av,"via",strlen(*av))) {
+			union ip_fw_if ifu;
+			int byname = 0;
+
+			if (saw_xmrc)
+				goto badviacombo;
+			saw_via = 1;
+			av++; ac--; 
+			fill_iface("via", &ifu, &byname, ac, *av);
+			rule.fw_out_if = rule.fw_in_if = ifu;
+			if (byname)
+				rule.fw_flg |=
+				    (IP_FW_F_IIFNAME | IP_FW_F_OIFNAME);
+			av++; ac--; continue;
 		}
-		if (!strncmp(*av,"out",strlen(*av))) { 
-			rule.fw_flg |= IP_FW_F_OUT; av++; ac--; continue;
+		if (!strncmp(*av,"fragment",strlen(*av))) {
+			rule.fw_flg |= IP_FW_F_FRAG;
+			av++; ac--; continue;
 		}
-		if (ac > 1 && !strncmp(*av,"ipoptions",strlen(*av))) { 
+		if (!strncmp(*av,"ipoptions",strlen(*av))) { 
 			av++; ac--; 
+			if (!ac)
+				show_usage("missing argument"
+				    " for ``ipoptions''");
 			fill_ipopt(&rule.fw_ipopt, &rule.fw_ipnopt, av);
 			av++; ac--; continue;
 		}
@@ -780,31 +966,50 @@ add(ac,av)
 				rule.fw_tcpnf  |= IP_FW_TCPF_ACK;
 				av++; ac--; continue;
 			}
-			if (ac > 1 && !strncmp(*av,"tcpflags",strlen(*av))) { 
+			if (!strncmp(*av,"tcpflags",strlen(*av))) { 
 				av++; ac--; 
+				if (!ac)
+					show_usage("missing argument"
+					    " for ``tcpflags''");
 				fill_tcpflag(&rule.fw_tcpf, &rule.fw_tcpnf, av);
 				av++; ac--; continue;
 			}
 		}
 		if (rule.fw_prot == IPPROTO_ICMP) {
-			if (ac > 1 && !strncmp(*av,"icmptypes",strlen(*av))) {
+			if (!strncmp(*av,"icmptypes",strlen(*av))) {
 				av++; ac--;
-				fill_icmptypes(rule.fw_icmptypes, av, &rule.fw_flg);
+				if (!ac)
+					show_usage("missing argument"
+					    " for ``icmptypes''");
+				fill_icmptypes(rule.fw_icmptypes,
+				    av, &rule.fw_flg);
 				av++; ac--; continue;
 			}
 		}
-		printf("%d %s\n",ac,*av);
-		show_usage("Unknown argument\n");
+		show_usage("unknown argument ``%s''", *av);
 	}
 
+	/* No direction specified -> do both directions */
+	if (!(rule.fw_flg & (IP_FW_F_OUT|IP_FW_F_IN)))
+		rule.fw_flg |= (IP_FW_F_OUT|IP_FW_F_IN);
+
+	/* Sanity check interface check, but handle "via" case separately */
+	if (saw_via) {
+		if (rule.fw_flg & IP_FW_F_IN)
+			rule.fw_flg |= IP_FW_F_IIFACE;
+		if (rule.fw_flg & IP_FW_F_OUT)
+			rule.fw_flg |= IP_FW_F_OIFACE;
+	} else if ((rule.fw_flg & IP_FW_F_OIFACE) && (rule.fw_flg & IP_FW_F_IN))
+		show_usage("can't check xmit interface of incoming packets");
+
 	if (!do_quiet)
 		show_ipfw(&rule);
 	i = setsockopt(s, IPPROTO_IP, IP_FW_ADD, &rule, sizeof rule);
 	if (i)
-		err(1,"setsockopt(IP_FW_ADD)");
+		err(1, "setsockopt(%s)", "IP_FW_ADD");
 }
 
-void
+static void
 zero (ac, av)
 	int ac;
 	char **av;
@@ -813,28 +1018,26 @@ zero (ac, av)
 
 	if (!ac) {
 		/* clear all entries */
-		if (setsockopt(s,IPPROTO_IP,IP_FW_ZERO,NULL,0)<0) {
-			fprintf(stderr,"%s: setsockopt failed.\n",progname);
-			exit(1);
-		} 
+		if (setsockopt(s,IPPROTO_IP,IP_FW_ZERO,NULL,0)<0)
+			err(1, "setsockopt(%s)", "IP_FW_ZERO");
 		if (!do_quiet)
 			printf("Accounting cleared.\n");
 	} else {
-		/* clear a specific entry */
 		struct ip_fw rule;
 
 		memset(&rule, 0, sizeof rule);
-
-		/* Rule number */
-		if (isdigit(**av)) {
-			rule.fw_number = atoi(*av); av++; ac--;
-
-			if (setsockopt(s, IPPROTO_IP, IP_FW_ZERO, &rule, sizeof rule))
-				err(1, "setsockopt(Zero)");
-			printf("Entry %d cleared\n", rule.fw_number);
-		}
-		else {
-			show_usage("expected number");
+		while (ac) {
+			/* Rule number */
+			if (isdigit(**av)) {
+				rule.fw_number = atoi(*av); av++; ac--;
+				if (setsockopt(s, IPPROTO_IP,
+				    IP_FW_ZERO, &rule, sizeof rule))
+					warn("setsockopt(%s)", "IP_FW_ZERO");
+				else
+					printf("Entry %d cleared\n",
+					    rule.fw_number);
+			} else
+				show_usage("invalid rule number ``%s''", *av);
 		}
 	}
 }
@@ -874,7 +1077,7 @@ ipfw_main(ac,av)
 	 		do_resolv=1;
 			break;
 		default:
-			show_usage("Unrecognised switch");
+			show_usage("invalid flag ``-%c''", ch);
 	}
 
 	ac -= optind;
@@ -908,10 +1111,8 @@ ipfw_main(ac,av)
 				do_flush = 1;
 		}
 		if ( do_flush ) {
-			if (setsockopt(s,IPPROTO_IP,IP_FW_FLUSH,NULL,0)<0) {
-				fprintf(stderr,"%s: setsockopt failed.\n",progname);
-				exit(1);
-			}
+			if (setsockopt(s,IPPROTO_IP,IP_FW_FLUSH,NULL,0) < 0)
+				err(1, "setsockopt(%s)", "IP_FW_FLUSH");
 			if (!do_quiet)
 				printf("Flushed all rules.\n");
 		}
@@ -936,47 +1137,34 @@ main(ac, av)
 	char	**av;
 {
 #define MAX_ARGS	32
+#define WHITESP		" \t\f\v\n\r"
 	char	buf[BUFSIZ];
-	char	*args[MAX_ARGS];
+	char	*a, *args[MAX_ARGS];
 	char	linename[10];
 	int 	i;
 	FILE	*f;
 
-	strncpy(progname,*av, sizeof(progname));
-	progname[sizeof(progname) - 1] = '\0';
-
 	s = socket( AF_INET, SOCK_RAW, IPPROTO_RAW );
-	if ( s < 0 ) {
-		fprintf(stderr,"%s: Can't open raw socket.\n"
-			"Must be root to use this program.\n",progname);
-		exit(1);
-	}
+	if ( s < 0 )
+		err(1, "socket");
 
 	setbuf(stdout,0);
 
 	if (av[1] && !access(av[1], R_OK)) {
 		lineno = 0;
-		f = fopen(av[1], "r");
+		if ((f = fopen(av[1], "r")) == NULL)
+			err(1, "fopen: %s", av[1]);
 		while (fgets(buf, BUFSIZ, f)) {
-			if (buf[strlen(buf)-1]=='\n')
-				buf[strlen(buf)-1] = 0;
 
 			lineno++;
 			sprintf(linename, "Line %d", lineno);
 			args[0] = linename;
 
-			args[1] = buf;
-			while(*args[1] == ' ')
-				args[1]++;
-			i = 2;
-			while((args[i] = strchr(args[i-1],' '))) {
-				*(args[i]++) = 0;
-				while(*args[i] == ' ')
-					args[i]++;
-				i++;
-			}
-			if (*args[i-1] == 0)
-				i--;
+			for (i = 1, a = strtok(buf, WHITESP);
+			    a && i < MAX_ARGS; a = strtok(NULL, WHITESP), i++)
+				args[i] = a;
+			if (i == MAX_ARGS)
+				errx(1, "%s: too many arguments", linename);
 			args[i] = NULL;
 
 			ipfw_main(i, args); 
diff --git a/sys/netinet/ip_divert.c b/sys/netinet/ip_divert.c
index dab1864..0c941a3 100644
--- a/sys/netinet/ip_divert.c
+++ b/sys/netinet/ip_divert.c
@@ -30,7 +30,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	$Id: ip_divert.c,v 1.10 1997/05/26 03:33:48 peter Exp $
+ *	$Id: ip_divert.c,v 1.11 1997/06/01 15:58:44 peter Exp $
  */
 
 #include <sys/param.h>
@@ -124,13 +124,20 @@ div_init(void)
 void
 div_input(struct mbuf *m, int hlen)
 {
-	register struct ip *ip = mtod(m, struct ip *);
-	register struct inpcb *inp;
-	register struct socket *sa;
+	struct ip *ip;
+	struct inpcb *inp;
+	struct socket *sa;
 
 	/* Sanity check */
 	if (ip_divert_port == 0)
-		panic("div_input");
+		panic("div_input: port is 0");
+
+	/* Assure header */
+	if (m->m_len < sizeof(struct ip) &&
+	    (m = m_pullup(m, sizeof(struct ip))) == 0) {
+		return;
+	}
+	ip = mtod(m, struct ip *);
 
 	/* Record divert port */
 	divsrc.sin_port = htons(ip_divert_port);
@@ -145,6 +152,12 @@ div_input(struct mbuf *m, int hlen)
 	if (hlen) {
 		struct ifaddr *ifa;
 
+#ifdef DIAGNOSTIC
+		/* Sanity check */
+		if (!(m->m_flags & M_PKTHDR))
+			panic("div_input: no pkt hdr");
+#endif
+
 		/* More fields affected by ip_input() */
 		HTONS(ip->ip_id);
 
diff --git a/sys/netinet/ip_fw.c b/sys/netinet/ip_fw.c
index 71fa62c..0886a43 100644
--- a/sys/netinet/ip_fw.c
+++ b/sys/netinet/ip_fw.c
@@ -12,7 +12,7 @@
  *
  * This software is provided ``AS IS'' without any warranties of any kind.
  *
- *	$Id: ip_fw.c,v 1.56 1997/04/06 11:09:03 dufault Exp $
+ *	$Id: ip_fw.c,v 1.3 1997/05/15 04:20:17 archie Exp $
  */
 
 /*
@@ -37,11 +37,14 @@
 #include <netinet/in.h>
 #include <netinet/in_systm.h>
 #include <netinet/ip.h>
-#include <netinet/tcp.h>
-#include <netinet/udp.h>
 #include <netinet/ip_var.h>
 #include <netinet/ip_icmp.h>
 #include <netinet/ip_fw.h>
+#include <netinet/tcp.h>
+#include <netinet/tcp_timer.h>
+#include <netinet/tcp_var.h>
+#include <netinet/tcpip.h>
+#include <netinet/udp.h>
 
 static int fw_debug = 1;
 #ifdef IPFIREWALL_VERBOSE
@@ -74,24 +77,25 @@ SYSCTL_INT(_net_inet_ip_fw, OID_AUTO, verbose_limit, CTLFLAG_RW, &fw_verbose_lim
 #define dprint_ip(a)	if (!fw_debug); else print_ip(a)
 
 static int	add_entry __P((struct ip_fw_head *chainptr, struct ip_fw *frwl));
-static int	del_entry __P((struct ip_fw_head *chainptr, struct ip_fw *frwl));
+static int	del_entry __P((struct ip_fw_head *chainptr, u_short number));
 static int	zero_entry __P((struct mbuf *m));
-static struct ip_fw *
-		check_ipfw_struct __P(( struct mbuf *m));
+static struct ip_fw *check_ipfw_struct __P((struct ip_fw *m));
+static struct ip_fw *check_ipfw_mbuf __P((struct mbuf *fw));
 static int	ipopts_match __P((struct ip *ip, struct ip_fw *f));
 static int	port_match __P((u_short *portptr, int nports, u_short port,
 				int range_flag));
 static int	tcpflg_match __P((struct tcphdr *tcp, struct ip_fw *f));
 static int	icmptype_match __P((struct icmp *  icmp, struct ip_fw * f));
-static void	ipfw_report __P((char *txt, int rule, struct ip *ip, int counter, struct ifnet *rif));
+static void	ipfw_report __P((struct ip_fw *f, struct ip *ip,
+				struct ifnet *rif, struct ifnet *oif));
 
 #ifdef IPFIREWALL_MODULE
 static ip_fw_chk_t *old_chk_ptr;
 static ip_fw_ctl_t *old_ctl_ptr;
 #endif
 
-static int	ip_fw_chk __P((struct ip **pip, int hlen, struct ifnet *rif,
-			       int dirport, struct mbuf **m));
+static int	ip_fw_chk __P((struct ip **pip, int hlen,
+			struct ifnet *oif, int ignport, struct mbuf **m));
 static int	ip_fw_ctl __P((int stage, struct mbuf **mm));
 
 static char err_prefix[] = "ip_fw_ctl:";
@@ -214,17 +218,88 @@ ipopts_match(struct ip *ip, struct ip_fw *f)
 		return 0;
 }
 
+static inline int
+iface_match(struct ifnet *ifp, union ip_fw_if *ifu, int byname)
+{
+	/* Check by name or by IP address */
+	if (byname) {
+		/* Check unit number (-1 is wildcard) */
+		if (ifu->fu_via_if.unit != -1
+		    && ifp->if_unit != ifu->fu_via_if.unit)
+			return(0);
+		/* Check name */
+		if (strncmp(ifp->if_name, ifu->fu_via_if.name, FW_IFNLEN))
+			return(0);
+		return(1);
+	} else if (ifu->fu_via_ip.s_addr != 0) {	/* Zero == wildcard */
+		struct ifaddr *ia;
+
+		for (ia = ifp->if_addrhead.tqh_first;
+		    ia != NULL; ia = ia->ifa_link.tqe_next) {
+			if (ia->ifa_addr == NULL)
+				continue;
+			if (ia->ifa_addr->sa_family != AF_INET)
+				continue;
+			if (ifu->fu_via_ip.s_addr != ((struct sockaddr_in *)
+			    (ia->ifa_addr))->sin_addr.s_addr)
+				continue;
+			return(1);
+		}
+		return(0);
+	}
+	return(1);
+}
+
 static void
-ipfw_report(char *txt, int rule, struct ip *ip, int counter, struct ifnet *rif)
+ipfw_report(struct ip_fw *f, struct ip *ip,
+	struct ifnet *rif, struct ifnet *oif)
 {
-	struct tcphdr *tcp = (struct tcphdr *) ((u_long *) ip + ip->ip_hl);
-	struct udphdr *udp = (struct udphdr *) ((u_long *) ip + ip->ip_hl);
-	struct icmp *icmp = (struct icmp *) ((u_long *) ip + ip->ip_hl);
-	if (!fw_verbose)
-		return;
-	if (fw_verbose_limit != 0 && counter > fw_verbose_limit)
+	static int counter;
+	struct tcphdr *const tcp = (struct tcphdr *) ((u_long *) ip+ ip->ip_hl);
+	struct udphdr *const udp = (struct udphdr *) ((u_long *) ip+ ip->ip_hl);
+	struct icmp *const icmp = (struct icmp *) ((u_long *) ip + ip->ip_hl);
+	char *cmd;
+	int count;
+
+	/* Print command name */
+	printf("ipfw: %d ", f ? f->fw_number : -1);
+	if (!f)
+		printf("Refuse");
+	else
+		switch (f->fw_flg & IP_FW_F_COMMAND) {
+		case IP_FW_F_DENY:
+			printf("Deny");
+			break;
+		case IP_FW_F_REJECT:
+			if (f->fw_reject_code == IP_FW_REJECT_RST)
+				printf("Reset");
+			else
+				printf("Unreach");
+			break;
+		case IP_FW_F_ACCEPT:
+			printf("Accept");
+			break;
+		case IP_FW_F_COUNT:
+			printf("Count");
+			break;
+		case IP_FW_F_DIVERT:
+			printf("Divert %d", f->fw_divert_port);
+			break;
+		case IP_FW_F_TEE:
+			printf("Tee %d", f->fw_divert_port);
+			break;
+		case IP_FW_F_SKIPTO:
+			printf("SkipTo %d", f->fw_skipto_rule);
+			break;
+		default:	
+			printf("UNKNOWN");
+			break;
+		}
+	printf(" ");
+
+	count = f ? f->fw_pcnt : ++counter;
+	if (fw_verbose_limit != 0 && count > fw_verbose_limit)
 		return;
-	printf("ipfw: %d %s ",rule, txt);
 	switch (ip->ip_p) {
 	case IPPROTO_TCP:
 		printf("TCP ");
@@ -253,66 +328,57 @@ ipfw_report(char *txt, int rule, struct ip *ip, int counter, struct ifnet *rif)
 		print_ip(ip->ip_dst);
 		break;
 	}
-	printf(" via %s%d", rif->if_name, rif->if_unit);
+	if (oif)
+		printf(" out via %s%d", oif->if_name, oif->if_unit);
+	else if (rif)
+		printf(" in via %s%d", rif->if_name, rif->if_unit);
 	if ((ip->ip_off & IP_OFFMASK)) 
 		printf(" Fragment = %d",ip->ip_off & IP_OFFMASK);
 	printf("\n");
-	if (fw_verbose_limit != 0 && counter == fw_verbose_limit)
-		printf("ipfw: limit reached on rule #%d\n", rule);
+	if (fw_verbose_limit != 0 && count == fw_verbose_limit)
+		printf("ipfw: limit reached on rule #%d\n",
+		f ? f->fw_number : -1);
 }
 
 /*
- * We overload the "dirport" parameter:
+ * Parameters:
  *
- *   If dirport is negative, packet is outgoing; otherwise incoming.
- *   The low order 16 bits of dirport, if non-zero, indicate that
- *   we should ignore all ``divert <port>'' rules, where <port> is
- *   the low order 16 bits.
+ *	ip	Pointer to packet header (struct ip *)
+ *	hlen	Packet header length
+ *	oif	Outgoing interface, or NULL if packet is incoming
+ *	ignport	Ignore all divert/tee rules to this port (if non-zero)
+ *	*m	The packet; we set to NULL when/if we nuke it.
  *
  * Return value:
  *
- *   -1		The packet was denied/rejected and has been dropped 
- *    0		The packet is to be accepted; route normally
- *   <port>	Divert the packet to divert <port>, if any socket
- *		is bound to it; otherwise just drop it.
+ *	0	The packet is to be accepted and routed normally OR
+ *      	the packet was denied/rejected and has been dropped;
+ *		in the latter case, *m is equal to NULL upon return.
+ *	port	Divert the packet to port.
  */
 
 static int 
 ip_fw_chk(struct ip **pip, int hlen,
-	struct ifnet *rif, int dirport, struct mbuf **m)
+	struct ifnet *oif, int ignport, struct mbuf **m)
 {
 	struct ip_fw_chain *chain;
-	register struct ip_fw *f = NULL;
+	struct ip_fw *rule;
 	struct ip *ip = *pip;
-	struct tcphdr *tcp = (struct tcphdr *) ((u_long *) ip + ip->ip_hl);
-	struct udphdr *udp = (struct udphdr *) ((u_long *) ip + ip->ip_hl);
-	struct icmp *icmp = (struct icmp *) ((u_long *) ip + ip->ip_hl);
-	struct ifaddr *ia = NULL, *ia_p;
-	struct in_addr src, dst, ia_i;
+	struct ifnet *const rif = (*m)->m_pkthdr.rcvif;
 	u_short src_port, dst_port, offset;
 
-	src = ip->ip_src;
-	dst = ip->ip_dst;
-
-	/*
-	 * If we got interface from which packet came-store pointer to it's
-	 * first adress
-	 */
-	if (rif != NULL)
-		ia = rif->if_addrhead.tqh_first;
-
 	/*
 	 * Go down the chain, looking for enlightment
 	 */
 	for (chain=ip_fw_chain.lh_first; chain; chain = chain->chain.le_next) {
-		f = chain->rule;
+		register struct ip_fw *const f = chain->rule;
 
 		/* Check direction inbound */
-		if (dirport >= 0 && !(f->fw_flg & IP_FW_F_IN))
+		if (!oif && !(f->fw_flg & IP_FW_F_IN))
 			continue;
 
 		/* Check direction outbound */
-		if (dirport < 0 && !(f->fw_flg & IP_FW_F_OUT))
+		if (oif && !(f->fw_flg & IP_FW_F_OUT))
 			continue;
 
 		/* Fragments */
@@ -321,169 +387,234 @@ ip_fw_chk(struct ip **pip, int hlen,
 
 		/* If src-addr doesn't match, not this rule. */
 		if ((f->fw_flg & IP_FW_F_INVSRC) != 0
-		  ^ (src.s_addr & f->fw_smsk.s_addr) != f->fw_src.s_addr)
+		  ^ (ip->ip_src.s_addr & f->fw_smsk.s_addr) != f->fw_src.s_addr)
 			continue;
 
 		/* If dest-addr doesn't match, not this rule. */
 		if ((f->fw_flg & IP_FW_F_INVDST) != 0
-		  ^ (dst.s_addr & f->fw_dmsk.s_addr) != f->fw_dst.s_addr)
-			continue;
-
-		/* If a i/f name was specified, and we don't know */
-		if ((f->fw_flg & IP_FW_F_IFNAME) && !rif)
+		  ^ (ip->ip_dst.s_addr & f->fw_dmsk.s_addr) != f->fw_dst.s_addr)
 			continue;
 
-		/* If a i/f name was specified, check it */
-		if ((f->fw_flg & IP_FW_F_IFNAME) && f->fw_via_name[0]) {
+		/* Interface check */
+		if ((f->fw_flg & IF_FW_F_VIAHACK) == IF_FW_F_VIAHACK) {
+			struct ifnet *const iface = oif ? oif : rif;
 
-			/* Not same unit, don't match */
-			if (!(f->fw_flg & IP_FW_F_IFUWILD) && rif->if_unit != f->fw_via_unit)
+			/* Backwards compatibility hack for "via" */
+			if (!iface || !iface_match(iface,
+			    &f->fw_in_if, f->fw_flg & IP_FW_F_OIFNAME))
 				continue;
-
-			/* Not same name */
-			if (strncmp(rif->if_name, f->fw_via_name, FW_IFNLEN))
+		} else {
+			/* Check receive interface */
+			if ((f->fw_flg & IP_FW_F_IIFACE)
+			    && (!rif || !iface_match(rif,
+			      &f->fw_in_if, f->fw_flg & IP_FW_F_IIFNAME)))
 				continue;
-		}
-
-		/* If a i/f addr was specified, check it */
-		if (!(f->fw_flg & IP_FW_F_IFNAME) && f->fw_via_ip.s_addr) {
-			int match = 0;
-
-			for (ia_p = ia; ia_p != NULL; 
-			     ia_p = ia_p->ifa_link.tqe_next) {
-				if ((ia_p->ifa_addr == NULL))
-					continue;
-				if (ia_p->ifa_addr->sa_family != AF_INET)
-					continue;
-				ia_i.s_addr =
-				    ((struct sockaddr_in *)
-				    (ia_p->ifa_addr))->sin_addr.s_addr;
-				if (ia_i.s_addr != f->fw_via_ip.s_addr)
-					continue;
-				match = 1;
-				break;
-			}
-			if (!match)
+			/* Check outgoing interface */
+			if ((f->fw_flg & IP_FW_F_OIFACE)
+			    && (!oif || !iface_match(oif,
+			      &f->fw_out_if, f->fw_flg & IP_FW_F_OIFNAME)))
 				continue;
 		}
 
-		/* 
-		 * Check IP options
-		 */
-		if (f->fw_ipopt != f->fw_ipnopt)
-			if (!ipopts_match(ip, f))
-				continue;
+		/* Check IP options */
+		if (f->fw_ipopt != f->fw_ipnopt && !ipopts_match(ip, f))
+			continue;
 			
-		/* If wildcard, match */
+		/* Check protocol; if wildcard, match */
 		if (f->fw_prot == IPPROTO_IP)
 			goto got_match;
 
-		/* If different, dont match */
+		/* If different, don't match */
 		if (ip->ip_p != f->fw_prot) 
 			continue;
 
+		/* Get fragment offset (if any) */
+		offset = (ip->ip_off & IP_OFFMASK);
+
+#define PULLUP_TO(len)	do {						\
+			    if ((*m)->m_len < (len)			\
+				&& (*m = m_pullup(*m, (len))) == 0) {	\
+				    goto bogusfrag;			\
+			    }						\
+			    *pip = ip = mtod(*m, struct ip *);		\
+			} while (0)
+
+		/* Protocol specific checks */
 		switch (ip->ip_p) {
 		case IPPROTO_TCP:
-			offset = ip->ip_off & IP_OFFMASK;
-			if (offset == 1) {
-				static int frag_counter = 0;
-				++frag_counter;
-				ipfw_report("Refuse", -1, ip, frag_counter, rif);
-				m_freem(*m);
-				return -1;
-			}
-			if ((offset == 0) &&
-			    (f->fw_tcpf != f->fw_tcpnf) &&
-			    !tcpflg_match(tcp, f))
-				continue;
+		    {
+			struct tcphdr *tcp;
 
+			if (offset == 1)	/* cf. RFC 1858 */
+				goto bogusfrag;
+			if (offset != 0)	/* Flags, ports aren't valid */
+				break;
+			PULLUP_TO(hlen + 14);
+			tcp = (struct tcphdr *) ((u_long *)ip + ip->ip_hl);
+			if (f->fw_tcpf != f->fw_tcpnf && !tcpflg_match(tcp, f))
+				continue;
 			src_port = ntohs(tcp->th_sport);
 			dst_port = ntohs(tcp->th_dport);
 			goto check_ports;
+		    }
 
 		case IPPROTO_UDP:
+		    {
+			struct udphdr *udp;
+
+			if (offset != 0)	/* Ports aren't valid */
+				break;
+			PULLUP_TO(hlen + 4);
+			udp = (struct udphdr *) ((u_long *)ip + ip->ip_hl);
 			src_port = ntohs(udp->uh_sport);
 			dst_port = ntohs(udp->uh_dport);
-
 check_ports:
-			if (!port_match(&f->fw_pts[0], f->fw_nsp,
-					src_port, f->fw_flg & IP_FW_F_SRNG))
+			if (!port_match(&f->fw_pts[0],
+			    IP_FW_GETNSRCP(f), src_port,
+			    f->fw_flg & IP_FW_F_SRNG))
 				continue;
-			if (!port_match(&f->fw_pts[f->fw_nsp], f->fw_ndp,
-					dst_port, f->fw_flg & IP_FW_F_DRNG)) 
+			if (!port_match(&f->fw_pts[IP_FW_GETNSRCP(f)],
+			    IP_FW_GETNDSTP(f), dst_port,
+			    f->fw_flg & IP_FW_F_DRNG)) 
 				continue;
 			break;
+		    }
 
 		case IPPROTO_ICMP:
+		    {
+			struct icmp *icmp;
+
+			if (offset != 0)	/* Type isn't valid */
+				break;
+			PULLUP_TO(hlen + 2);
+			icmp = (struct icmp *) ((u_long *)ip + ip->ip_hl);
 			if (!icmptype_match(icmp, f))
 				continue;
-			goto got_match;
-
-		default:
 			break;
+		    }
+
+bogusfrag:
+			if (fw_verbose)
+				ipfw_report(NULL, ip, rif, oif);
+			goto dropit;
 		}
 
 got_match:
-		f->fw_pcnt++;
-		f->fw_bcnt+=ip->ip_len;
-		f->timestamp = time.tv_sec;
-		if (f->fw_flg & IP_FW_F_PRN) {
-			if ((f->fw_flg & IP_FW_F_COMMAND) == IP_FW_F_ACCEPT) {
-				ipfw_report("Allow",
-					f->fw_number, ip, f->fw_pcnt, rif);
-			} else if ((f->fw_flg & IP_FW_F_COMMAND)
-			    == IP_FW_F_DIVERT) {
-				if (f->fw_divert_port != (dirport & 0xffff))
-					ipfw_report("Divert", f->fw_number,
-							ip, f->fw_pcnt, rif);
-			} else if ((f->fw_flg & IP_FW_F_COMMAND)
-			    == IP_FW_F_COUNT) {
-				ipfw_report("Count",
-					f->fw_number, ip, f->fw_pcnt, rif);
-			} else {
-				ipfw_report("Deny",
-					f->fw_number, ip, f->fw_pcnt, rif);
-			}
+		/* Ignore divert/tee rule if socket port is "ignport" */
+		switch (f->fw_flg & IP_FW_F_COMMAND) {
+		case IP_FW_F_DIVERT:
+		case IP_FW_F_TEE:
+			if (f->fw_divert_port == ignport)
+				continue;       /* ignore this rule */
+			break;
 		}
 
+		/* Update statistics */
+		f->fw_pcnt += 1;
+		f->fw_bcnt += ip->ip_len;
+		f->timestamp = time.tv_sec;
+
+		/* Log to console if desired */
+		if ((f->fw_flg & IP_FW_F_PRN) && fw_verbose)
+			ipfw_report(f, ip, rif, oif);
+
 		/* Take appropriate action */
-		if ((f->fw_flg & IP_FW_F_COMMAND) == IP_FW_F_ACCEPT) {
-			return 0;
-		} else if ((f->fw_flg & IP_FW_F_COMMAND) == IP_FW_F_COUNT) {
+		switch (f->fw_flg & IP_FW_F_COMMAND) {
+		case IP_FW_F_ACCEPT:
+			return(0);
+		case IP_FW_F_COUNT:
 			continue;
-		} else if ((f->fw_flg & IP_FW_F_COMMAND) == IP_FW_F_DIVERT) {
-			if (f->fw_divert_port == (dirport & 0xffff))
-				continue;	/* ignore this rule */
-			return (f->fw_divert_port);
-		} else
-			break;		/* ie, deny/reject */
+		case IP_FW_F_DIVERT:
+			return(f->fw_divert_port);
+		case IP_FW_F_TEE:
+			/*
+			 * XXX someday tee packet here, but beware that you
+			 * can't use m_copym() or m_copypacket() because
+			 * the divert input routine modifies the mbuf
+			 * (and these routines only increment reference
+			 * counts in the case of mbuf clusters), so need
+			 * to write custom routine.
+			 */
+			continue;
+		case IP_FW_F_SKIPTO:
+#ifdef DIAGNOSTIC
+			while (chain->chain.le_next
+			    && chain->chain.le_next->rule->fw_number
+				< f->fw_skipto_rule)
+#else
+			while (chain->chain.le_next->rule->fw_number
+			    < f->fw_skipto_rule)
+#endif
+				chain = chain->chain.le_next;
+			continue;
+		}
+
+		/* Deny/reject this packet using this rule */
+		rule = f;
+		break;
 	}
 
 #ifdef DIAGNOSTIC
-	if (!chain)			/* rule 65535 should always be there */
+	/* Rule 65535 should always be there and should always match */
+	if (!chain)
 		panic("ip_fw: chain");
-	if (!f)	
-		panic("ip_fw: entry");
 #endif
 
 	/*
 	 * At this point, we're going to drop the packet.
-	 * Send an ICMP only if all of the following are true:
+	 * Send a reject notice if all of the following are true:
 	 *
-	 * - The packet is an incoming packet
-	 * - The packet matched a deny rule
+	 * - The packet matched a reject rule
 	 * - The packet is not an ICMP packet
-	 * - The rule has the special ICMP reply flag set
+	 * - The packet is not a multicast or broadcast packet
 	 */
-	if (dirport >= 0
-	    && (f->fw_flg & IP_FW_F_COMMAND) == IP_FW_F_DENY
-	    && (ip->ip_p != IPPROTO_ICMP)
-	    && (f->fw_flg & IP_FW_F_ICMPRPL)) {
-		icmp_error(*m, ICMP_UNREACH, ICMP_UNREACH_PORT, 0L, 0);
-		return -1;
-	}
-	m_freem(*m);
-	return -1;
+	if ((rule->fw_flg & IP_FW_F_COMMAND) == IP_FW_F_REJECT
+	    && ip->ip_p != IPPROTO_ICMP
+	    && !((*m)->m_flags & (M_BCAST|M_MCAST))
+	    && !IN_MULTICAST(ntohl(ip->ip_dst.s_addr))) {
+		switch (rule->fw_reject_code) {
+		case IP_FW_REJECT_RST:
+		  {
+			struct tcphdr *const tcp =
+				(struct tcphdr *) ((u_long *)ip + ip->ip_hl);
+			struct tcpiphdr ti;
+
+			if (offset != 0 || (tcp->th_flags & TH_RST))
+				break;
+			ti.ti_i = *((struct ipovly *) ip);
+			ti.ti_t = *tcp;
+			NTOHL(ti.ti_seq);
+			NTOHL(ti.ti_ack);
+			ti.ti_len = ip->ip_len - hlen - (ti.ti_off << 2);
+			if (tcp->th_flags & TH_ACK) {
+				tcp_respond(NULL, &ti, *m,
+				    (tcp_seq)0, ntohl(tcp->th_ack), TH_RST);
+			} else {
+				if (tcp->th_flags & TH_SYN)
+					ti.ti_len++;
+				tcp_respond(NULL, &ti, *m, ti.ti_seq
+				    + ti.ti_len, (tcp_seq)0, TH_RST|TH_ACK);
+			}
+			*m = NULL;
+			break;
+		  }
+		default:	/* Send an ICMP unreachable using code */
+			icmp_error(*m, ICMP_UNREACH,
+			    rule->fw_reject_code, 0L, 0);
+			*m = NULL;
+			break;
+		}
+	}
+
+dropit:
+	/*
+	 * Finally, drop the packet.
+	 */
+	if (*m) {
+		m_freem(*m);
+		*m = NULL;
+	}
+	return(0);
 }
 
 static int
@@ -518,6 +649,7 @@ add_entry(struct ip_fw_head *chainptr, struct ip_fw *frwl)
 		if (fwc)  free(fwc, M_IPFW);
 		if (ftmp) free(ftmp, M_IPFW);
 		splx(s);
+		dprintf(("%s bad rule number\n", err_prefix));
 		return (EINVAL);
         }
 
@@ -553,7 +685,7 @@ add_entry(struct ip_fw_head *chainptr, struct ip_fw *frwl)
 }
 
 static int
-del_entry(struct ip_fw_head *chainptr, struct ip_fw *frwl)
+del_entry(struct ip_fw_head *chainptr, u_short number)
 {
 	struct ip_fw_chain *fcp;
 	int s;
@@ -561,9 +693,9 @@ del_entry(struct ip_fw_head *chainptr, struct ip_fw *frwl)
 	s = splnet();
 
 	fcp = chainptr->lh_first; 
-	if (frwl->fw_number != (u_short)-1) {
+	if (number != (u_short)-1) {
 		for (; fcp; fcp = fcp->chain.le_next) {
-			if (fcp->rule->fw_number == frwl->fw_number) {
+			if (fcp->rule->fw_number == number) {
 				LIST_REMOVE(fcp, chain);
 				splx(s);
 				free(fcp->rule, M_IPFW);
@@ -585,10 +717,9 @@ zero_entry(struct mbuf *m)
 	int s;
 
 	if (m) {
-		frwl = check_ipfw_struct(m);
-
-		if (!frwl)
+		if (m->m_len != sizeof(struct ip_fw))
 			return(EINVAL);
+		frwl = mtod(m, struct ip_fw *);
 	}
 	else
 		frwl = NULL;
@@ -606,56 +737,80 @@ zero_entry(struct mbuf *m)
 		}
 	splx(s);
 
+#if 0
 	if ( frwl )
 		printf("ipfw: Entry %d cleared.\n", frwl->fw_number);
 	else
 		printf("ipfw: Accounting cleared.\n");
+#endif
 	return(0);
 }
 
 static struct ip_fw *
-check_ipfw_struct(struct mbuf *m)
+check_ipfw_mbuf(struct mbuf *m)
 {
-	struct ip_fw *frwl;
-
+	/* Check length */
 	if (m->m_len != sizeof(struct ip_fw)) {
 		dprintf(("%s len=%d, want %d\n", err_prefix, m->m_len,
 		    sizeof(struct ip_fw)));
 		return (NULL);
 	}
-	frwl = mtod(m, struct ip_fw *);
+	return(check_ipfw_struct(mtod(m, struct ip_fw *)));
+}
 
+static struct ip_fw *
+check_ipfw_struct(struct ip_fw *frwl)
+{
+	/* Check for invalid flag bits */
 	if ((frwl->fw_flg & ~IP_FW_F_MASK) != 0) {
 		dprintf(("%s undefined flag bits set (flags=%x)\n",
 		    err_prefix, frwl->fw_flg));
 		return (NULL);
 	}
-
-	/* If neither In nor Out, then both */
-	if (!(frwl->fw_flg & (IP_FW_F_IN | IP_FW_F_OUT)))
-		frwl->fw_flg |= IP_FW_F_IN | IP_FW_F_OUT;
-
-	if ((frwl->fw_flg & IP_FW_F_SRNG) && frwl->fw_nsp < 2) {
+	/* Must apply to incoming or outgoing (or both) */
+	if (!(frwl->fw_flg & (IP_FW_F_IN | IP_FW_F_OUT))) {
+		dprintf(("%s neither in nor out\n", err_prefix));
+		return (NULL);
+	}
+	/* Empty interface name is no good */
+	if (((frwl->fw_flg & IP_FW_F_IIFNAME)
+	      && !*frwl->fw_in_if.fu_via_if.name)
+	    || ((frwl->fw_flg & IP_FW_F_OIFNAME)
+	      && !*frwl->fw_out_if.fu_via_if.name)) {
+		dprintf(("%s empty interface name\n", err_prefix));
+		return (NULL);
+	}
+	/* Sanity check interface matching */
+	if ((frwl->fw_flg & IF_FW_F_VIAHACK) == IF_FW_F_VIAHACK) {
+		;		/* allow "via" backwards compatibility */
+	} else if ((frwl->fw_flg & IP_FW_F_IN)
+	    && (frwl->fw_flg & IP_FW_F_OIFACE)) {
+		dprintf(("%s outgoing interface check on incoming\n",
+		    err_prefix));
+		return (NULL);
+	}
+	/* Sanity check port ranges */
+	if ((frwl->fw_flg & IP_FW_F_SRNG) && IP_FW_GETNSRCP(frwl) < 2) {
 		dprintf(("%s src range set but n_src_p=%d\n",
-		    err_prefix, frwl->fw_nsp));
+		    err_prefix, IP_FW_GETNSRCP(frwl)));
 		return (NULL);
 	}
-	if ((frwl->fw_flg & IP_FW_F_DRNG) && frwl->fw_ndp < 2) {
+	if ((frwl->fw_flg & IP_FW_F_DRNG) && IP_FW_GETNDSTP(frwl) < 2) {
 		dprintf(("%s dst range set but n_dst_p=%d\n",
-		    err_prefix, frwl->fw_ndp));
+		    err_prefix, IP_FW_GETNDSTP(frwl)));
 		return (NULL);
 	}
-	if (frwl->fw_nsp + frwl->fw_ndp > IP_FW_MAX_PORTS) {
+	if (IP_FW_GETNSRCP(frwl) + IP_FW_GETNDSTP(frwl) > IP_FW_MAX_PORTS) {
 		dprintf(("%s too many ports (%d+%d)\n",
-		    err_prefix, frwl->fw_nsp, frwl->fw_ndp));
+		    err_prefix, IP_FW_GETNSRCP(frwl), IP_FW_GETNDSTP(frwl)));
 		return (NULL);
 	}
 	/*
-	 *	ICMP protocol doesn't use port range
+	 *	Protocols other than TCP/UDP don't use port range
 	 */
 	if ((frwl->fw_prot != IPPROTO_TCP) &&
 	    (frwl->fw_prot != IPPROTO_UDP) &&
-	    (frwl->fw_nsp || frwl->fw_ndp)) {
+	    (IP_FW_GETNSRCP(frwl) || IP_FW_GETNDSTP(frwl))) {
 		dprintf(("%s port(s) specified for non TCP/UDP rule\n",
 		    err_prefix));
 		return(NULL);
@@ -672,12 +827,34 @@ check_ipfw_struct(struct mbuf *m)
 		return(NULL);
 	}
 
-	/* Diverting to port zero is illegal */
-	if ((frwl->fw_flg & IP_FW_F_COMMAND) == IP_FW_F_DIVERT
-	     && frwl->fw_divert_port == 0) {
-		dprintf(("ip_fw_ctl: can't divert to port 0\n"));
-		return (NULL);
+	/* Check command specific stuff */
+	switch (frwl->fw_flg & IP_FW_F_COMMAND)
+	{
+	case IP_FW_F_REJECT:
+		if (frwl->fw_reject_code >= 0x100
+		    && !(frwl->fw_prot == IPPROTO_TCP
+		      && frwl->fw_reject_code == IP_FW_REJECT_RST)) {
+			dprintf(("%s unknown reject code\n", err_prefix));
+			return(NULL);
+		}
+		break;
+	case IP_FW_F_DIVERT:		/* Diverting to port zero is invalid */
+	case IP_FW_F_TEE:
+		if (frwl->fw_divert_port == 0) {
+			dprintf(("%s can't divert to port 0\n", err_prefix));
+			return (NULL);
+		}
+		break;
+	case IP_FW_F_DENY:
+	case IP_FW_F_ACCEPT:
+	case IP_FW_F_COUNT:
+	case IP_FW_F_SKIPTO:
+		break;
+	default:
+		dprintf(("%s invalid command\n", err_prefix));
+		return(NULL);
 	}
+
 	return frwl;
 }
 
@@ -728,21 +905,31 @@ ip_fw_ctl(int stage, struct mbuf **mm)
 		return (EINVAL);
 	}
 
-	if (stage == IP_FW_ADD || stage == IP_FW_DEL) {
-		struct ip_fw *frwl = check_ipfw_struct(m);
-
-		if (!frwl) {
-			if (m) (void)m_free(m);
-			return (EINVAL);
-		}
+	if (stage == IP_FW_ADD) {
+		struct ip_fw *frwl = check_ipfw_mbuf(m);
 
-		if (stage == IP_FW_ADD)
-			error = add_entry(&ip_fw_chain, frwl);
+		if (!frwl)
+			error = EINVAL;
 		else
-			error = del_entry(&ip_fw_chain, frwl);
+			error = add_entry(&ip_fw_chain, frwl);
 		if (m) (void)m_free(m);
 		return error;
 	}
+	if (stage == IP_FW_DEL) {
+		if (m->m_len != sizeof(struct ip_fw)) {
+			dprintf(("%s len=%d, want %d\n", err_prefix, m->m_len,
+			    sizeof(struct ip_fw)));
+			error = EINVAL;
+		} else if (mtod(m, struct ip_fw *)->fw_number == (u_short)-1) {
+			dprintf(("%s can't delete rule 65535\n", err_prefix));
+			error = EINVAL;
+		} else
+			error = del_entry(&ip_fw_chain,
+			    mtod(m, struct ip_fw *)->fw_number);
+		if (m) (void)m_free(m);
+		return error;
+	}
+
 	dprintf(("%s unknown request %d\n", err_prefix, stage));
 	if (m) (void)m_free(m);
 	return (EINVAL);
@@ -760,8 +947,10 @@ ip_fw_init(void)
 	bzero(&deny, sizeof deny);
 	deny.fw_prot = IPPROTO_IP;
 	deny.fw_number = (u_short)-1;
-	deny.fw_flg = IP_FW_F_IN | IP_FW_F_OUT;
-	add_entry(&ip_fw_chain, &deny);
+	deny.fw_flg |= IP_FW_F_DENY;
+	deny.fw_flg |= IP_FW_F_IN | IP_FW_F_OUT;
+	if (check_ipfw_struct(&deny) == NULL || add_entry(&ip_fw_chain, &deny))
+		panic(__FUNCTION__);
 
 	printf("IP packet filtering initialized, "
 #ifdef IPDIVERT
diff --git a/sys/netinet/ip_fw.h b/sys/netinet/ip_fw.h
index b3ae6ad..96d7357 100644
--- a/sys/netinet/ip_fw.h
+++ b/sys/netinet/ip_fw.h
@@ -11,51 +11,84 @@
  *
  * This software is provided ``AS IS'' without any warranties of any kind.
  *
- *	$Id$
+ *	$Id: ip_fw.h,v 1.1 1997/05/09 17:46:45 archie Exp $
  */
 
+#ifndef _IP_FW_H
+#define _IP_FW_H
+
+/*
+ * This union structure identifies an interface, either explicitly
+ * by name or implicitly by IP address. The flags IP_FW_F_IIFNAME
+ * and IP_FW_F_OIFNAME say how to interpret this structure. An
+ * interface unit number of -1 matches any unit number, while an
+ * IP address of 0.0.0.0 indicates matches any interface.
+ *
+ * The receive and transmit interfaces are only compared against the
+ * the packet if the corresponding bit (IP_FW_F_IIFACE or IP_FW_F_OIFACE)
+ * is set. Note some packets lack a receive or transmit interface
+ * (in which case the missing "interface" never matches).
+ */
+
+union ip_fw_if {
+    struct in_addr fu_via_ip;	/* Specified by IP address */
+    struct {			/* Specified by interface name */
+#define FW_IFNLEN	6	/* To keep structure on 2^x boundary */
+	    char  name[FW_IFNLEN];
+	    short unit;		/* -1 means match any unit */
+    } fu_via_if;
+};
+
 /*
  * Format of an IP firewall descriptor
  *
  * fw_src, fw_dst, fw_smsk, fw_dmsk are always stored in network byte order.
  * fw_flg and fw_n*p are stored in host byte order (of course).
  * Port numbers are stored in HOST byte order.
+ * Warning: setsockopt() will fail if sizeof(struct ip_fw) > MLEN (108)
  */
-#ifndef _IP_FW_H
-#define _IP_FW_H
 
 struct ip_fw {
     u_long fw_pcnt,fw_bcnt;		/* Packet and byte counters */
     struct in_addr fw_src, fw_dst;	/* Source and destination IP addr */
     struct in_addr fw_smsk, fw_dmsk;	/* Mask for src and dest IP addr */
-    union {
-	struct in_addr fu_via_ip;	/* Specified by IP address */
-	struct {			/* Specified by interface name */
-#define FW_IFNLEN	6		/* To keep structure on 2^x boundary */
-		char  fu_via_name[FW_IFNLEN];
-		short fu_via_unit;
-	} fu_via_if;
-    } fu_via_un;
-#define fw_via_ip	fu_via_un.fu_via_ip
-#define fw_via_name	fu_via_un.fu_via_if.fu_via_name
-#define fw_via_unit	fu_via_un.fu_via_if.fu_via_unit
-    u_short fw_number;
+    u_short fw_number;			/* Rule number */
     u_short fw_flg;			/* Flags word */
-    u_short fw_nsp, fw_ndp;             /* N'of src ports and # of dst ports */
-    					/* in ports array (dst ports follow */
-    					/* src ports; max of 10 ports in all; */
-    					/* count of 0 means match all ports) */
-#define IP_FW_MAX_PORTS	10      	/* A reasonable maximum */
-    u_short fw_pts[IP_FW_MAX_PORTS];    /* Array of port numbers to match */
+#define IP_FW_MAX_PORTS	10		/* A reasonable maximum */
+    u_short fw_pts[IP_FW_MAX_PORTS];	/* Array of port numbers to match */
     u_char fw_ipopt,fw_ipnopt;		/* IP options set/unset */
     u_char fw_tcpf,fw_tcpnf;		/* TCP flags set/unset */
 #define IP_FW_ICMPTYPES_DIM (256 / (sizeof(unsigned) * 8))
     unsigned fw_icmptypes[IP_FW_ICMPTYPES_DIM]; /* ICMP types bitmap */
-    long timestamp;         		/* timestamp (tv_sec) of last match */
-    u_short fw_divert_port;		/* Divert port (options IPDIVERT) */
+    long timestamp;			/* timestamp (tv_sec) of last match */
+    union ip_fw_if fw_in_if, fw_out_if;	/* Incoming and outgoing interfaces */
+    union {
+	u_short fu_divert_port;		/* Divert/tee port (options IPDIVERT) */
+	u_short fu_skipto_rule;		/* SKIPTO command rule number */
+	u_short fu_reject_code;		/* REJECT response code */
+    } fw_un;
     u_char fw_prot;			/* IP protocol */
+    u_char fw_nports;			/* N'of src ports and # of dst ports */
+					/* in ports array (dst ports follow */
+					/* src ports; max of 10 ports in all; */
+					/* count of 0 means match all ports) */
 };
 
+#define IP_FW_GETNSRCP(rule)		((rule)->fw_nports & 0x0f)
+#define IP_FW_SETNSRCP(rule, n)		do {				\
+					  (rule)->fw_nports &= ~0x0f;	\
+					  (rule)->fw_nports |= (n);	\
+					} while (0)
+#define IP_FW_GETNDSTP(rule)		((rule)->fw_nports >> 4)
+#define IP_FW_SETNDSTP(rule, n)		do {				\
+					  (rule)->fw_nports &= ~0xf0;	\
+					  (rule)->fw_nports |= (n) << 4;\
+					} while (0)
+
+#define fw_divert_port	fw_un.fu_divert_port
+#define fw_skipto_rule	fw_un.fu_skipto_rule
+#define fw_reject_code	fw_un.fu_reject_code
+
 struct ip_fw_chain {
         LIST_ENTRY(ip_fw_chain) chain;
         struct ip_fw    *rule;
@@ -64,37 +97,55 @@ struct ip_fw_chain {
 /*
  * Values for "flags" field .
  */
-#define IP_FW_F_INVSRC	0x0001	/* Invert sense of src check	      */
-#define IP_FW_F_INVDST	0x0002	/* Invert sense of dst check	      */
-#define IP_FW_F_IN	0x0004	/* Inbound 			      */
-#define IP_FW_F_OUT	0x0008	/* Outbound			      */
+#define IP_FW_F_IN	0x0001	/* Check inbound packets		*/
+#define IP_FW_F_OUT	0x0002	/* Check outbound packets		*/
+#define IP_FW_F_IIFACE	0x0004	/* Apply inbound interface test		*/
+#define IP_FW_F_OIFACE	0x0008	/* Apply outbound interface test	*/
+
+#define IP_FW_F_COMMAND 0x0070	/* Mask for type of chain entry:	*/
+#define IP_FW_F_DENY	0x0000	/* This is a deny rule			*/
+#define IP_FW_F_REJECT	0x0010	/* Deny and send a response packet	*/
+#define IP_FW_F_ACCEPT	0x0020	/* This is an accept rule		*/
+#define IP_FW_F_COUNT	0x0030	/* This is a count rule			*/
+#define IP_FW_F_DIVERT	0x0040	/* This is a divert rule		*/
+#define IP_FW_F_TEE	0x0050	/* This is a tee rule			*/
+#define IP_FW_F_SKIPTO	0x0060	/* This is a skipto rule		*/
+
+#define IP_FW_F_PRN	0x0080	/* Print if this rule matches		*/
 
-#define IP_FW_F_COMMAND 0x0030	/* Mask for type of chain entry:      */
-#define IP_FW_F_ACCEPT	0x0010	/* This is an accept rule	      */
-#define IP_FW_F_COUNT	0x0020	/* This is a count rule		      */
-#define IP_FW_F_DIVERT	0x0030	/* This is a divert rule	      */
-#define IP_FW_F_DENY	0x0000	/* This is a deny rule	              */
+#define IP_FW_F_SRNG	0x0100	/* The first two src ports are a min	*
+				 * and max range (stored in host byte	*
+				 * order).				*/
 
-#define IP_FW_F_PRN	0x0040	/* Print if this rule matches	      */
-#define IP_FW_F_ICMPRPL	0x0080	/* Send back icmp unreachable packet  */
+#define IP_FW_F_DRNG	0x0200	/* The first two dst ports are a min	*
+				 * and max range (stored in host byte	*
+				 * order).				*/
 
-#define IP_FW_F_SRNG	0x0100	/* The first two src ports are a min  *
-				 * and max range (stored in host byte *
-				 * order).                            */
+#define IP_FW_F_IIFNAME	0x0400	/* In interface by name/unit (not IP)	*/
+#define IP_FW_F_OIFNAME	0x0800	/* Out interface by name/unit (not IP)	*/
 
-#define IP_FW_F_DRNG	0x0200	/* The first two dst ports are a min  *
-				 * and max range (stored in host byte *
-				 * order).                            */
+#define IP_FW_F_INVSRC	0x1000	/* Invert sense of src check		*/
+#define IP_FW_F_INVDST	0x2000	/* Invert sense of dst check		*/
 
-#define IP_FW_F_IFNAME	0x0400	/* Use interface name/unit (not IP)   */
+#define IP_FW_F_FRAG	0x4000	/* Fragment				*/
 
-#define IP_FW_F_FRAG	0x0800	/* Fragment			      */
+#define IP_FW_F_ICMPBIT 0x8000	/* ICMP type bitmap is valid		*/
 
-#define IP_FW_F_ICMPBIT 0x1000	/* ICMP type bitmap is valid          */
+#define IP_FW_F_MASK	0xFFFF	/* All possible flag bits mask		*/
 
-#define IP_FW_F_IFUWILD	0x2000	/* Match all interface units          */
+/*
+ * For backwards compatibility with rules specifying "via iface" but
+ * not restricted to only "in" or "out" packets, we define this combination
+ * of bits to represent this configuration.
+ */
+
+#define IF_FW_F_VIAHACK	(IP_FW_F_IN|IP_FW_F_OUT|IP_FW_F_IIFACE|IP_FW_F_OIFACE)
 
-#define IP_FW_F_MASK	0x3FFF	/* All possible flag bits mask        */
+/*
+ * Definitions for REJECT response codes.
+ * Values less than 256 correspond to ICMP unreachable codes.
+ */
+#define IP_FW_REJECT_RST	0x0100		/* TCP packets: send RST */
 
 /*
  * Definitions for IP option names.
diff --git a/sys/netinet/ip_input.c b/sys/netinet/ip_input.c
index 538d1c8..903adaf 100644
--- a/sys/netinet/ip_input.c
+++ b/sys/netinet/ip_input.c
@@ -31,7 +31,7 @@
  * SUCH DAMAGE.
  *
  *	@(#)ip_input.c	8.2 (Berkeley) 1/4/94
- * $Id: ip_input.c,v 1.61 1997/04/03 10:47:10 darrenr Exp $
+ * $Id: ip_input.c,v 1.62 1997/05/11 18:05:37 tegge Exp $
  *	$ANA: ip_input.c,v 1.5 1996/09/18 14:34:59 wollman Exp $
  */
 
@@ -334,25 +334,24 @@ tooshort:
 #endif
 #ifdef COMPAT_IPFW
 	if (ip_fw_chk_ptr) {
-		int action;
-
 #ifdef IPDIVERT
-		action = (*ip_fw_chk_ptr)(&ip, hlen,
-				m->m_pkthdr.rcvif, ip_divert_ignore, &m);
+		u_short port;
+
+		port = (*ip_fw_chk_ptr)(&ip, hlen, NULL, ip_divert_ignore, &m);
 		ip_divert_ignore = 0;
-#else
-		action = (*ip_fw_chk_ptr)(&ip, hlen, m->m_pkthdr.rcvif, 0, &m);
-#endif
-		if (action == -1)
-			return;
-		if (action != 0) {
-#ifdef IPDIVERT
-			frag_divert_port = action;
+		if (port) {			/* Divert packet */
+			frag_divert_port = port;
 			goto ours;
+		}
 #else
-			goto bad;	/* ipfw said divert but we can't */
-#endif
+		/* If ipfw says divert, we have to just drop packet */
+		if ((*ip_fw_chk_ptr)(&ip, hlen, NULL, 0, &m)) {
+			m_freem(m);
+			m = NULL;
 		}
+#endif
+		if (!m)
+			return;
 	}
 
         if (ip_nat_ptr && !(*ip_nat_ptr)(&ip, &m, m->m_pkthdr.rcvif, IP_NAT_IN))
@@ -521,9 +520,10 @@ found:
 
 #ifdef IPDIVERT
 	/*
-	 * Divert packets here to the divert protocol if required
+	 * Divert reassembled packets to the divert protocol if required
 	 */
 	if (frag_divert_port) {
+		ipstat.ips_delivered++;
 		ip_divert_port = frag_divert_port;
 		frag_divert_port = 0;
 		(*inetsw[ip_protox[IPPROTO_DIVERT]].pr_input)(m, hlen);
diff --git a/sys/netinet/ip_output.c b/sys/netinet/ip_output.c
index defc06a..4401f6b 100644
--- a/sys/netinet/ip_output.c
+++ b/sys/netinet/ip_output.c
@@ -31,7 +31,7 @@
  * SUCH DAMAGE.
  *
  *	@(#)ip_output.c	8.3 (Berkeley) 1/21/94
- *	$Id: ip_output.c,v 1.55 1997/04/27 20:01:07 wollman Exp $
+ *	$Id: ip_output.c,v 1.56 1997/05/06 21:22:04 fenner Exp $
  */
 
 #define _IP_VHL
@@ -357,7 +357,7 @@ sendit:
         /*
 	 * IpHack's section.
 	 * - Xlate: translate packet's addr/port (NAT).
-	 * - Firewall: deny/allow
+	 * - Firewall: deny/allow/etc.
 	 * - Wrap: fake packet's addr/port <unimpl.>
 	 * - Encapsulate: put it in another IP and send out. <unimp.>
 	 */ 
@@ -372,27 +372,24 @@ sendit:
 	 * Check with the firewall...
 	 */
 	if (ip_fw_chk_ptr) {
-		int action;
-
 #ifdef IPDIVERT
-		action = (*ip_fw_chk_ptr)(&ip,
-				hlen, ifp, (~0 << 16) | ip_divert_ignore, &m);
+		ip_divert_port = (*ip_fw_chk_ptr)(&ip,
+		    hlen, ifp, ip_divert_ignore, &m);
 		ip_divert_ignore = 0;
-#else
-		action = (*ip_fw_chk_ptr)(&ip, hlen, ifp, (~0 << 16), &m);
-#endif
-		if (action == -1) {
-			error = EACCES;		/* XXX is this appropriate? */
-			goto done;
-		} else if (action != 0) {
-#ifdef IPDIVERT
-			ip_divert_port = action;	/* divert to port */
+		if (ip_divert_port) {		/* Divert packet */
 			(*inetsw[ip_protox[IPPROTO_DIVERT]].pr_input)(m, 0);
 			goto done;
+		}
 #else
-			m_freem(m);	/* ipfw says divert, but we can't */
+		/* If ipfw says divert, we have to just drop packet */
+		if ((*ip_fw_chk_ptr)(&ip, hlen, ifp, 0, &m)) {
+			m_freem(m);
 			goto done;
+		}
 #endif
+		if (!m) {
+			error = EACCES;
+			goto done;
 		}
 	}
 #endif /* COMPAT_IPFW */