* Someone imported a lot of files with the wrong CVS tag, so lots of files need

  that fixed in them....
* Keep unnecessary files out of the non-vendor part of this CVS repository.

17 files changed, 212 insertions, 130 deletions

diff --git a/contrib/ipfilter/man/ipf.4 b/contrib/ipfilter/man/ipf.4
index b1188c8..dfef858 100644
--- a/contrib/ipfilter/man/ipf.4
+++ b/contrib/ipfilter/man/ipf.4
@@ -36,8 +36,8 @@ However, the full complement is as follows:
 	ioctl(fd, SIOCFRSYN, u_int *)
 	ioctl(fd, SIOCFRZST, struct friostat **)
 	ioctl(fd, SIOCZRLST, struct frentry **)
-	ioctl(fd, SIOCAUTHW, struct frauth_t **)
-	ioctl(fd, SIOCAUTHR, struct frauth_t **)
+	ioctl(fd, SIOCAUTHW, struct fr_info **)
+	ioctl(fd, SIOCAUTHR, struct fr_info **)
 	ioctl(fd, SIOCATHST, struct fr_authstat **)
 .fi
 .PP
@@ -123,7 +123,7 @@ Flags which are recognised in fr_flags:
      FR_RETRST       0x000080   /* return a TCP RST packet if blocked */
      FR_RETICMP      0x000100   /* return an ICMP packet if blocked */
      FR_FAKEICMP     0x00180    /* Return ICMP unreachable with fake source */
-     FR_NOMATCH      0x000200   /* No match occurred */
+     FR_NOMATCH      0x000200   /* no match occured */
      FR_ACCOUNT      0x000400   /* count packet bytes */
      FR_KEEPFRAG     0x000800   /* keep fragment information */
      FR_KEEPSTATE    0x001000   /* keep `connection' state information */
diff --git a/contrib/ipfilter/man/ipf.5 b/contrib/ipfilter/man/ipf.5
index 2f998b5..d6b6ac1 100644
--- a/contrib/ipfilter/man/ipf.5
+++ b/contrib/ipfilter/man/ipf.5
@@ -20,12 +20,13 @@ described using the following grammar in BNF:
 \fC
 .nf
 filter-rule = [ insert ] action in-out [ options ] [ tos ] [ ttl ]
-	      [ proto ] [ ip ] [ group ].
+	      [ proto ] ip [ group ].
 
 insert	= "@" decnumber .
 action	= block | "pass" | log | "count" | skip | auth | call .
 in-out	= "in" | "out" .
-options	= [ log ] [ "quick" ] [ "on" interface-name [ dup ] [ froute ] ] .
+options	= [ log ] [ tag ] [ "quick" ] [ "on" interface-name [ dup ]
+           [ froute ] [ replyto ] ] .
 tos	= "tos" decnumber | "tos" hexnumber .
 ttl	= "ttl" decnumber .
 proto	= "proto" protocol .
@@ -33,19 +34,24 @@ ip	= srcdst [ flags ] [ with withopt ] [ icmp ] [ keep ] .
 group	= [ "head" decnumber ] [ "group" decnumber ] .
 
 block	= "block" [ return-icmp[return-code] | "return-rst" ] .
-auth    = "auth" | "preauth" .
 log	= "log" [ "body" ] [ "first" ] [ "or-block" ] [ "level" loglevel ] .
-call	= "call" [ "now" ] function-name .
+tag     = "tag" tagid .
 skip	= "skip" decnumber .
-dup	= "dup-to" interface-name[":"ipaddr] .
-froute	= "fastroute" | "to" interface-name[":"ipaddr] .
+auth	= "auth" | "preauth" .
+call	= "call" [ "now" ] function-name .
+dup	= "dup-to" interface-name [ ":" ipaddr ] .
+froute	= "fastroute" | "to" interface-name [ ":" ipaddr ] .
+replyto = "reply-to" interface-name [ ":" ipaddr ] .
 protocol = "tcp/udp" | "udp" | "tcp" | "icmp" | decnumber .
 srcdst	= "all" | fromto .
 fromto	= "from" [ "!" ] object "to" [ "!" ] object .
 
 return-icmp = "return-icmp" | "return-icmp-as-dest" .
+return-code = "(" icmp-code ")" .
 object	= addr [ port-comp | port-range ] .
 addr	= "any" | nummask | host-name [ "mask" ipaddr | "mask" hexnumber ] .
+addr	= "any" | "<thishost>" | nummask |
+	  host-name [ "mask" ipaddr | "mask" hexnumber ] .
 port-comp = "port" compare port-num .
 port-range = "port" port-num range port-num .
 flags	= "flags" flag { flag } [ "/" flag { flag } ] .
@@ -206,6 +212,13 @@ indicates that, should this be the last matching rule, the packet
 header will be written to the \fBipl\fP log (as described in the
 LOGGING section below).
 .TP
+.B tag tagid
+indicates that, if this rule causes the packet to be logged or entered
+in the state table, the tagid will be logged as part of the log entry.
+This can be used to quickly match "similar" rules in scripts that post
+process the log files for e.g. generation of security reports or accounting
+purposes. The tagid is a 32 bit unsigned integer.
+.TP
 .B quick
 allows "short-cut" rules in order to speed up the filter or override
 later rules.  If a packet matches a filter rule which is marked as
@@ -375,7 +388,7 @@ against, e.g.:
 			# packets with ONLY the SYN flag set.
 
 	... flags SA
-			# becomes "flags SA/AUPRFSC" and will match any
+			# becomes "flags SA/AUPRFS" and will match any
 			# packet with only the SYN and ACK flags set.
 
 	... flags S/SA
diff --git a/contrib/ipfilter/man/ipf.8 b/contrib/ipfilter/man/ipf.8
index 661375a..bcf9307 100644
--- a/contrib/ipfilter/man/ipf.8
+++ b/contrib/ipfilter/man/ipf.8
@@ -5,11 +5,14 @@ ipf \- alters packet filtering lists for IP packet input and output
 .SH SYNOPSIS
 .B ipf
 [
-.B \-6AdDEInoPrsUvVyzZ
+.B \-6AcdDEInoPrsvVyzZ
 ] [
 .B \-l
 <block|pass|nomatch>
 ] [
+.B \-T
+<optionlist>
+] [
 .B \-F
 <i|o|a|s|S>
 ]
@@ -37,6 +40,15 @@ This option is required to parse IPv6 rules and to have them loaded.
 .B \-A
 Set the list to make changes to the active list (default).
 .TP
+.B \-c <language>
+This option causes \fBipf\fP to generate output files for a compiler that
+supports \fBlanguage\fI.  At present, the only target language supported is
+\fBC\fB (-cc) for which two files - \fBip_rules.c\fP
+and \fBip_rules.h\fP are generated in the \fBCURRENT DIRECTORY\fP when
+\fBipf\fP is being run.  These files can be used with the
+\fBIPFILTER_COMPILED\fP kernel option to build filter rules staticly into
+the kernel.
+.TP
 .B \-d
 Turn debug mode on.  Causes a hexdump of filter rules to be generated as
 it processes each one.
@@ -59,7 +71,7 @@ To flush entries from the state table, the \fB-F\fP option is used in
 conjunction with either "s" (removes state information about any non-fully
 established connections) or "S" (deletes the entire state table).  Only
 one of the two options may be given.  A fully established connection
-will show up in \fBipfstat -s\fP output as 4/4, with deviations either
+will show up in \fBipfstat -s\fP output as 5/5, with deviations either
 way indicating it is not fully established any more.
 .TP
 .BR \-f \0<filename>
@@ -93,10 +105,22 @@ Remove matching filter rules rather than add them to the internal lists
 .TP
 .B \-s
 Swap the active filter list in use to be the "other" one.
-.TP
-.B \-U
-(SOLARIS 2 ONLY) Block packets travelling along the data stream which aren't
-recognised as IP packets.  They will be printed out on the console.
+.B \-T <optionlist>
+This option allows run-time changing of IPFilter kernel variables.  Some
+variables require IPFilter to be in a disabled state (\fB-D\fP) for changing,
+others do not.  The optionlist parameter is a comma separated list of tuning
+commands.  A tuning command is either "list" (retrieve a list of all variables
+in the kernel, their maximum, minimum and current value), a single variable
+name (retrieve its current value) and a variable name with a following
+assignment to set a new value.  Some examples follow.
+.nf
+# Print out all IPFilter kernel tunable parameters
+ipf -T list
+# Display the current TCP idle timeout and then set it to 3600
+ipf -D -T fr_tcpidletimeout,fr_tcpidletimeout=3600 -E
+# Display current values for fr_pass and fr_chksrc, then set fr_chksrc to 1.
+ipf -T fr_pass,fr_chksrc,fr_chksrc=1
+.fi
 .TP
 .B \-v
 Turn verbose mode on.  Displays information relating to rule processing.
diff --git a/contrib/ipfilter/man/ipfilter.4 b/contrib/ipfilter/man/ipfilter.4
index cf8ca9f..09eb4db 100644
--- a/contrib/ipfilter/man/ipfilter.4
+++ b/contrib/ipfilter/man/ipfilter.4
@@ -1,4 +1,4 @@
-.\"	$NetBSD$
+.\"	$FreeBSD$
 .\"
 .TH IP\ FILTER 4
 .SH NAME
diff --git a/contrib/ipfilter/man/ipfs.8 b/contrib/ipfilter/man/ipfs.8
index 52f6fcb..01d0c70 100644
--- a/contrib/ipfilter/man/ipfs.8
+++ b/contrib/ipfilter/man/ipfs.8
@@ -1,4 +1,4 @@
-.\"	$NetBSD$
+.\"	$FreeBSD$
 .\"
 .TH IPFS 8
 .SH NAME
diff --git a/contrib/ipfilter/man/ipfstat.8 b/contrib/ipfilter/man/ipfstat.8
index e2f38a0..8e413e2 100644
--- a/contrib/ipfilter/man/ipfstat.8
+++ b/contrib/ipfilter/man/ipfstat.8
@@ -5,15 +5,12 @@ ipfstat \- reports on packet filter statistics and filter list
 .SH SYNOPSIS
 .B ipfstat
 [
-.B \-6aAfghIinosv
-] [
-.B \-d
-<device>
+.B \-6aAdfghIilnoRsv
 ]
-
+.br
 .B ipfstat -t
 [
-.B \-C
+.B \-6C
 ] [
 .B \-D
 <addrport>
@@ -26,12 +23,8 @@ ipfstat \- reports on packet filter statistics and filter list
 ] [
 .B \-T
 <refresh time>
-] [
-.B \-d
-<device>
 ]
 .SH DESCRIPTION
-.PP
 \fBipfstat\fP examines /dev/kmem using the symbols \fB_fr_flags\fP,
 \fB_frstats\fP, \fB_filterin\fP, and \fB_filterout\fP.
 To run and work, it needs to be able to read both /dev/kmem and the
@@ -43,7 +36,7 @@ accumulated over time as the kernel has put packets through the filter.
 .SH OPTIONS
 .TP
 .B \-6
-Display filter lists for IPv6, if available.
+Display filter lists and states for IPv6, if available.
 .TP
 .B \-a
 Display the accounting filter list and show bytes counted against each rule.
@@ -57,13 +50,13 @@ Display "closed" states as well in the top. Normally, a TCP connection is
 not displayed when it reaches the CLOSE_WAIT protocol state. With this
 option enabled, all state entries are displayed.
 .TP
-.BR \-d \0<device>
-Use a device other than \fB/dev/ipl\fP for interfacing with the kernel.
+.BR \-d
+Produce debugging output when displaying data.
 .TP
 .BR \-D \0<addrport>
 This option is only valid in combination with \fB\-t\fP. Limit the state top
 display to show only state entries whose destination IP address and port
-match the addport argument. The addrport specification is of the form
+match the addrport argument. The addrport specification is of the form
 ipaddress[,port].  The ipaddress and port should be either numerical or the
 string "any" (specifying any IP address resp. any port). If the \fB\-D\fP
 option is not specified, it defaults to "\fB\-D\fP any,any".
@@ -99,6 +92,10 @@ argument can be a protocol name (as defined in \fB/etc/protocols\fP) or a
 protocol number. If this option is not specified, state entries for any
 protocol are specified.
 .TP
+.BR \-R
+Don't try to resolve addresses to hostnames and ports to services while
+printing statistics.
+.TP
 .B \-s
 Show packet/flow state information (statistics only).
 .TP
@@ -108,15 +105,15 @@ Show held state information (in the kernel) if any is present (no statistics).
 .BR \-S \0<addrport>
 This option is only valid in combination with \fB\-t\fP. Limit the state top
 display to show only state entries whose source IP address and port match
-the addport argument. The addrport specification is of the form
+the addrport argument. The addrport specification is of the form
 ipaddress[,port].  The ipaddress and port should be either numerical or the
-string "any" (specifying any ip address resp. any port). If the \fB\-S\fP
+string "any" (specifying any IP address resp. any port). If the \fB\-S\fP
 option is not specified, it defaults to "\fB\-S\fP any,any".
 .TP
 .B \-t
-Show the state table in a way similar to they way \fBtop(1)\fP shows the process
-table. States can be sorted using a number of different ways. This options
-requires \fBncurses(3)\fP and needs to be compiled in. It may not be available on
+Show the state table in a way similar to the way \fBtop(1)\fP shows the process
+table. States can be sorted using a number of different ways. This option
+requires \fBcurses(3)\fP and needs to be compiled in. It may not be available on
 all operating systems. See below, for more information on the keys that can
 be used while ipfstat is in top mode.
 .TP
@@ -137,6 +134,10 @@ parameters are present.
 When supplied with either \fB\-i\fP or \fB\-o\fP, it will retrieve and display
 the appropriate list of filter rules currently installed and in use by the
 kernel.
+.PP
+One of the statistics that \fBipfstat\fP shows is \fBticks\fP.
+This number indicates how long the filter has been enabled.
+The number is incremented every half\-second.
 .SH STATE TOP
 Using the \fB\-t\fP option \fBipfstat\fP will enter the state top mode. In
 this mode the state table is displayed similar to the way \fBtop\fP displays
@@ -147,7 +148,9 @@ shown and to specify the frequency of display updates.
 In state top mode, the following keys can be used to influence the displayed
 information:
 .TP
-\fBd\fP select information to display.
+\fBb\fP show packets/bytes from backward direction.
+.TP
+\fBf\fP show packets/bytes from forward direction. (default)
 .TP
 \fBl\fP redraw the screen.
 .TP
@@ -167,13 +170,12 @@ and protocol filters or the refresh frequency. This must be done from the
 command line.
 .PP
 The screen must have at least 80 columns. This is however not checked.
+When running state top in IPv6 mode, the screen must be much wider to display
+the very long IPv6 addresses.
 .PP
 Only the first X-5 entries that match the sort and filter criteria are
-displayed (where X is the number of rows on the display. There is no way to 
-see more entries.
-.PP
-No support for IPv6
-.PP
+displayed (where X is the number of rows on the display. The only way to see
+more entries is to resize the screen.
 .SH FILES
 /dev/kmem
 .br
diff --git a/contrib/ipfilter/man/ipftest.1 b/contrib/ipfilter/man/ipftest.1
index 936445c..df8320a 100644
--- a/contrib/ipfilter/man/ipftest.1
+++ b/contrib/ipfilter/man/ipftest.1
@@ -5,19 +5,31 @@ ipftest \- test packet filter rules with arbitrary input.
 .SH SYNOPSIS
 .B ipftest
 [
-.B \-vbdPRSTEHX
+.B \-6bdDoRvx
+] [
+.B \-F
+input-format
+] [
+.B \-i
+<filename>
 ] [
 .B \-I
 interface
-]
-.B \-r
+] [
+.B \-l
 <filename>
-[
-.B \-i
+] [
+.B \-N
 <filename>
 ] [
-.B \-s
-<ipaddress>
+.B \-P
+<filename>
+] [
+.B \-r
+<filename>
+] [
+.B \-T
+<optionlist>
 ]
 .SH DESCRIPTION
 .PP
@@ -26,70 +38,69 @@ filter rules without having to put them in place, in operation and proceed
 to test their effectiveness.  The hope is that this minimises disruptions
 in providing a secure IP environment.
 .PP
-\fBipftest\fP will parse any standard ruleset for use with \fBipf\fP
+\fBipftest\fP will parse any standard ruleset for use with \fBipf\fP,
+\fBipnat\fP and/or \fBippool\fP
 and apply input, returning output as to the result.  However, \fBipftest\fP
 will return one of three values for packets passed through the filter:
 pass, block or nomatch.  This is intended to give the operator a better
 idea of what is happening with packets passing through their filter
 ruleset.
 .PP
-When used without either of \fB\-S\fP, \fB\-T\fP or \fB\-E\fP,
-\fBipftest\fP uses its own text input format to generate "fake" IP packets.
-The format used is as follows:
-.nf
-		"in"|"out" "on" if ["tcp"|"udp"|"icmp"]
-			srchost[,srcport] dsthost[,destport] [FSRPAU]
-.fi
-.PP
-This allows for a packet going "in" or "out" of an interface (if) to be
-generated, being one of the three main protocols (optionally), and if
-either TCP or UDP, a port parameter is also expected.  If TCP is selected,
-it is possible to (optionally) supply TCP flags at the end.  Some examples
-are:
-.nf
-		# a UDP packet coming in on le0
-		in on le0 udp 10.1.1.1,2210 10.2.1.5,23
-		# an IP packet coming in on le0 from localhost - hmm :)
-		in on le0 localhost 10.4.12.1
-		# a TCP packet going out of le0 with the SYN flag set.
-		out on le0 tcp 10.4.12.1,2245 10.1.1.1,23 S
-.fi
+At least one of \fB\-N\fP, \fB-P\fP or \fB\-r\fP must be specified.
 .SH OPTIONS
 .TP
-.B \-v
-Verbose mode.  This provides more information about which parts of rule
-matching the input packet passes and fails.
-.TP
-.B \-d
-Turn on filter rule debugging.  Currently, this only shows you what caused
-the rule to not match in the IP header checking (addresses/netmasks, etc).
+.B \-6
+Use IPv6.
 .TP
 .B \-b
 Cause the output to be a brief summary (one-word) of the result of passing
 the packet through the filter; either "pass", "block" or "nomatch".
 This is used in the regression testing.
 .TP
-.BR \-I \0<interface>
-Set the interface name (used in rule matching) to be the name supplied.
-This is useful with the \fB\-P, \-S, \-T\fP and \fB\-E\fP options, where it is
-not otherwise possible to associate a packet with an interface.  Normal
-"text packets" can override this setting.
+.B \-d
+Turn on filter rule debugging.  Currently, this only shows you what caused
+the rule to not match in the IP header checking (addresses/netmasks, etc).
 .TP
-.B \-P
+.B \-D
+Dump internal tables before exiting.
+This excludes log messages.
+.TP
+.B \-F
+This option is used to select which input format the input file is in.
+The following formats are available: etherfind, hex, pcap, snoop, tcpdump,text.
+.RS
+.TP
+.B etherfind
+The input file is to be text output from etherfind.  The text formats which
+are currently supported are those which result from the following etherfind
+option combinations:
+.PP
+.nf
+		etherfind -n
+		etherfind -n -t
+.fi
+.TP
+.B hex
+The input file is to be hex digits, representing the binary makeup of the
+packet.  No length correction is made, if an incorrect length is put in
+the IP header.  A packet may be broken up over several lines of hex digits,
+a blank line indicating the end of the packet.  It is possible to specify
+both the interface name and direction of the packet (for filtering purposes)
+at the start of the line using this format: [direction,interface]  To define
+a packet going in on le0, we would use \fB[in,le0]\fP - the []'s are required
+and part of the input syntax.
+.HP
+.B pcap
 The input file specified by \fB\-i\fP is a binary file produced using libpcap
 (i.e., tcpdump version 3).  Packets are read from this file as being input
 (for rule purposes).  An interface maybe specified using \fB\-I\fP.
 .TP
-.B \-R
-Remove rules rather than load them.  This is not a toggle option, so once
-set, it cannot be reset by further use of -R.
-.TP
-.B \-S
+.B snoop
 The input file is to be in "snoop" format (see RFC 1761).  Packets are read
 from this file and used as input from any interface.  This is perhaps the
 most useful input type, currently.
 .TP
-.B \-T
+.B tcpdump
 The input file is to be text output from tcpdump.  The text formats which
 are currently supported are those which result from the following tcpdump
 option combinations:
@@ -101,42 +112,77 @@ option combinations:
 		tcpdump -nqtt
 		tcpdump -nqte
 .fi
-.LP
 .TP
-.B \-H
-The input file is to be hex digits, representing the binary makeup of the
-packet.  No length correction is made, if an incorrect length is put in
-the IP header.  A packet may be broken up over several lines of hex digits,
-a blank line indicating the end of the packet.  It is possible to specify
-both the interface name and direction of the packet (for filtering purposes)
-at the start of the line using this format: [direction,interface]  To define
-a packet going in on le0, we would use \fB[in,le0]\fP - the []'s are required
-and part of the input syntax.
-.TP
-.B \-X
-The input file is composed of text descriptions of IP packets.
-.TP
-.B \-E
-The input file is to be text output from etherfind.  The text formats which
-are currently supported are those which result from the following etherfind
-option combinations:
+.B text
+The input file is in \fBipftest\fP text input format.
+This is the default if no \fB\-F\fP argument is specified.
+The format used is as follows:
+.nf
+	"in"|"out" "on" if ["tcp"|"udp"|"icmp"]
+		srchost[,srcport] dsthost[,destport] [FSRPAU]
+.fi
 .PP
+This allows for a packet going "in" or "out" of an interface (if) to be
+generated, being one of the three main protocols (optionally), and if
+either TCP or UDP, a port parameter is also expected.  If TCP is selected,
+it is possible to (optionally) supply TCP flags at the end.  Some examples
+are:
 .nf
-		etherfind -n
-		etherfind -n -t
+	# a UDP packet coming in on le0
+	in on le0 udp 10.1.1.1,2210 10.2.1.5,23
+	# an IP packet coming in on le0 from localhost - hmm :)
+	in on le0 localhost 10.4.12.1
+	# a TCP packet going out of le0 with the SYN flag set.
+	out on le0 tcp 10.4.12.1,2245 10.1.1.1,23 S
 .fi
 .LP
+.RE
+.DT
 .TP
 .BR \-i \0<filename>
 Specify the filename from which to take input.  Default is stdin.
 .TP
+.BR \-I \0<interface>
+Set the interface name (used in rule matching) to be the name supplied.
+This is useful where it is
+not otherwise possible to associate a packet with an interface.  Normal
+"text packets" can override this setting.
+.TP
+.BR \-l \0<filename>
+Dump log messages generated during testing to the specified file.
+.TP
+.BR \-N \0<filename>
+Specify the filename from which to read NAT rules in \fBipnat\fP(5) format.
+.TP
+.B \-o
+Save output packets that would have been written to each interface in
+a file /tmp/\fIinterface_name\fP in raw format.
+.TP
+.BR \-P \0<filename>
+Read IP pool configuration information in \fBippool\fP(5) format from the
+specified file.
+.TP
 .BR \-r \0<filename>
-Specify the filename from which to read filter rules.
+Specify the filename from which to read filter rules in \fBipf\fP(5) format.
+.TP
+.B \-R
+Don't attempt to convert IP addresses to hostnames.
+.TP
+.BR \-T \0<optionlist>
+This option simulates the run-time changing of IPFilter kernel variables
+available with the \fB\-T\fP option of \fBipf\fP.
+The optionlist parameter is a comma separated list of tuning
+commands.  A tuning command is either "list" (retrieve a list of all variables
+in the kernel, their maximum, minimum and current value), a single variable
+name (retrieve its current value) and a variable name with a following
+assignment to set a new value.  See \fBipf\fP(8) for examples.
+.TP
+.B \-v
+Verbose mode.  This provides more information about which parts of rule
+matching the input packet passes and fails.
 .TP
-.BR \-s \0<ipaddress>
-Where the input format is incapable of telling \fBipftest\fP whther a packet is
-going in or out, setting this option to an IP address results in the direction
-being set to out if the source matches or in if the destination matches. 
+.B \-x
+Print a hex dump of each packet before printing the decoded contents.
 .SH SEE ALSO
 ipf(5), ipf(8), snoop(1m), tcpdump(8), etherfind(8c)
 .SH BUGS
diff --git a/contrib/ipfilter/man/ipl.4 b/contrib/ipfilter/man/ipl.4
index d45749b..da1d9e6 100644
--- a/contrib/ipfilter/man/ipl.4
+++ b/contrib/ipfilter/man/ipl.4
@@ -1,4 +1,4 @@
-.\"	$NetBSD$
+.\"	$FreeBSD$
 .\"
 .TH IPL 4
 .SH NAME
diff --git a/contrib/ipfilter/man/ipmon.5 b/contrib/ipfilter/man/ipmon.5
index bc48466..081fc08 100644
--- a/contrib/ipfilter/man/ipmon.5
+++ b/contrib/ipfilter/man/ipmon.5
@@ -1,4 +1,4 @@
-.\"	$NetBSD$
+.\"	$FreeBSD$
 .\"
 .TH IPMON 5
 .SH NAME
diff --git a/contrib/ipfilter/man/ipmon.8 b/contrib/ipfilter/man/ipmon.8
index d7f94df..48b2a41 100644
--- a/contrib/ipfilter/man/ipmon.8
+++ b/contrib/ipfilter/man/ipmon.8
@@ -47,11 +47,8 @@ long).
 4. The group and rule number of the rule, e.g., \fB@0:17\fP. These can be
 viewed with \fBipfstat -n\fP.
 .LP
-5. The action: \fBp\fP for passed, \fBb\fP for blocked, \fBS\fP for a short
-packet, \fBn\fP did not match any rules, \fBL\fP for a log rule.  The order
-of precedence in showing flags is: S, p, b, n, L.  A capital \fBP\fP or
-\fBB\fP means that the packet has been logged due to a global logging
-setting, not a particular rule.
+5. The action: \fBp\fP for passed, \fBb\fP for blocked, \fB\fP for a short
+packet, \fBn\fP did not match any rules or \fBL\fP for a log rule.
 .LP
 6. The addresses.
 This is actually three fields: the source address and port
diff --git a/contrib/ipfilter/man/ipnat.5 b/contrib/ipfilter/man/ipnat.5
index 7db3308..210f09a 100644
--- a/contrib/ipfilter/man/ipnat.5
+++ b/contrib/ipfilter/man/ipnat.5
@@ -1,4 +1,4 @@
-.\"	$NetBSD$
+.\"	$FreeBSD$
 .\"
 .TH IPNAT 5
 .SH NAME
diff --git a/contrib/ipfilter/man/ipnat.8 b/contrib/ipfilter/man/ipnat.8
index 49a09be..87f2da5 100644
--- a/contrib/ipfilter/man/ipnat.8
+++ b/contrib/ipfilter/man/ipnat.8
@@ -1,4 +1,4 @@
-.\"	$NetBSD$
+.\"	$FreeBSD$
 .\"
 .TH IPNAT 8
 .SH NAME
diff --git a/contrib/ipfilter/man/ippool.5 b/contrib/ipfilter/man/ippool.5
index c9eaaca..974a0e8 100644
--- a/contrib/ipfilter/man/ippool.5
+++ b/contrib/ipfilter/man/ippool.5
@@ -1,4 +1,4 @@
-.\"	$NetBSD$
+.\"	$FreeBSD$
 .\"
 .TH IPPOOL 5
 .SH NAME
diff --git a/contrib/ipfilter/man/ippool.8 b/contrib/ipfilter/man/ippool.8
index 6ed1e88..986812a 100644
--- a/contrib/ipfilter/man/ippool.8
+++ b/contrib/ipfilter/man/ippool.8
@@ -1,4 +1,4 @@
-.\"	$NetBSD$
+.\"	$FreeBSD$
 .\"
 .TH IPPOOL 8
 .SH NAME
diff --git a/contrib/ipfilter/man/ipscan.5 b/contrib/ipfilter/man/ipscan.5
index 4a00174..91bf9b0 100644
--- a/contrib/ipfilter/man/ipscan.5
+++ b/contrib/ipfilter/man/ipscan.5
@@ -1,4 +1,4 @@
-.\"	$NetBSD$
+.\"	$FreeBSD$
 .\"
 .TH IPSCAN 5
 .SH NAME
diff --git a/contrib/ipfilter/man/ipscan.8 b/contrib/ipfilter/man/ipscan.8
index d3ce952..513dc94 100644
--- a/contrib/ipfilter/man/ipscan.8
+++ b/contrib/ipfilter/man/ipscan.8
@@ -1,4 +1,4 @@
-.\"	$NetBSD$
+.\"	$FreeBSD$
 .\"
 .TH IPSCAN 8
 .SH NAME
diff --git a/contrib/ipfilter/man/mkfilters.1 b/contrib/ipfilter/man/mkfilters.1
index 3bac7d1..89a8d47 100644
--- a/contrib/ipfilter/man/mkfilters.1
+++ b/contrib/ipfilter/man/mkfilters.1
@@ -1,4 +1,4 @@
-.\"	$NetBSD$
+.\"	$FreeBSD$
 .\"
 .TH MKFILTERS 1
 .SH NAME