This commit was generated by cvs2svn to compensate for changes in r145510,

which included commits to RCS files with non-trunk default branches.

13 files changed, 1099 insertions, 68 deletions

diff --git a/contrib/ipfilter/man/Makefile b/contrib/ipfilter/man/Makefile
index 05164d7..3f12ccb 100644
--- a/contrib/ipfilter/man/Makefile
+++ b/contrib/ipfilter/man/Makefile
@@ -1,9 +1,7 @@
 #
 # Copyright (C) 1993-1998 by Darren Reed.
 #
-# Redistribution and use in source and binary forms are permitted
-# provided that this notice is preserved and due credit is given
-# to the original author and the contributors.
+# See the IPFILTER.LICENCE file for details on licencing.
 #
 
 all:
@@ -12,12 +10,19 @@ install:
 	$(INSTALL) -m 0644 -c -o root -g bin ipftest.1 $(MANDIR)/man1
 	$(INSTALL) -m 0644 -c -o root -g bin ipnat.8 $(MANDIR)/man8
 	$(INSTALL) -m 0644 -c -o root -g bin ipf.4 $(MANDIR)/man4
+	$(INSTALL) -m 0644 -c -o root -g bin ipfilter.4 $(MANDIR)/man4
 	$(INSTALL) -m 0644 -c -o root -g bin ipl.4 $(MANDIR)/man4
 	$(INSTALL) -m 0644 -c -o root -g bin ipnat.4 $(MANDIR)/man4
 	$(INSTALL) -m 0644 -c -o root -g bin ipf.5 $(MANDIR)/man5
+	$(INSTALL) -m 0644 -c -o root -g bin ipfilter.5 $(MANDIR)/man5
 	$(INSTALL) -m 0644 -c -o root -g bin ipnat.5 $(MANDIR)/man5
 	$(INSTALL) -m 0644 -c -o root -g bin ipf.8 $(MANDIR)/man8
 	$(INSTALL) -m 0644 -c -o root -g bin ipfs.8 $(MANDIR)/man8
 	$(INSTALL) -m 0644 -c -o root -g bin ipmon.8 $(MANDIR)/man8
+	$(INSTALL) -m 0644 -c -o root -g bin ipmon.5 $(MANDIR)/man5
+	$(INSTALL) -m 0644 -c -o root -g bin ippool.8 $(MANDIR)/man8
+	$(INSTALL) -m 0644 -c -o root -g bin ippool.5 $(MANDIR)/man5
+	$(INSTALL) -m 0644 -c -o root -g bin ipscan.8 $(MANDIR)/man8
+	$(INSTALL) -m 0644 -c -o root -g bin ipscan.5 $(MANDIR)/man5
 	$(INSTALL) -m 0644 -c -o root -g bin ipfstat.8 $(MANDIR)/man8
 	@echo "Remember to rebuild the whatis database."
diff --git a/contrib/ipfilter/man/ipfilter.4 b/contrib/ipfilter/man/ipfilter.4
new file mode 100644
index 0000000..cf8ca9f
--- /dev/null
+++ b/contrib/ipfilter/man/ipfilter.4
@@ -0,0 +1,241 @@
+.\"	$NetBSD$
+.\"
+.TH IP\ FILTER 4
+.SH NAME
+ipfilter \- Introduction to IP packet filtering
+.SH DESCRIPTION
+IP Filter is a TCP/IP packet filter, suitable for use in a firewall
+environment. To use, it can either be used as a loadable kernel module or
+incorporated into your UNIX kernel; use as a loadable kernel module where
+possible is highly recommended. Scripts are provided to install and patch
+system files, as required.
+.SH FEATURES
+The IP packet filter can:
+.IP
+explicitly deny/permit any packet from passing through
+.IP
+distinguish between various interfaces
+.IP
+filter by IP networks or hosts
+.IP
+selectively filter any IP protocol
+.IP
+selectively filter fragmented IP packets
+.IP
+selectively filter packets with IP options
+.IP
+send back an ICMP error/TCP reset for blocked packets
+.IP
+keep packet state information for TCP, UDP and ICMP packet flows
+.IP
+keep fragment state information for any IP packet, applying the same rule 
+to all fragments.
+.IP
+act as a Network Address Translator (NAT)
+.IP
+use redirection to setup true transparent proxy connections
+.IP
+provide packet header details to a user program for authentication
+.IP
+in addition, supports temporary storage of pre-authenticated rules for passing packets through
+.PP
+Special provision is made for the three most common Internet protocols, TCP,
+UDP and ICMP. The IP Packet filter allows filtering of:
+.IP
+Inverted host/net matchingTCP/UDP packets by port number or a port number
+range
+.IP
+ICMP packets by type/code
+.IP
+"established" TCP packets
+.IP
+On any arbitrary combination of TCP flags
+.IP
+"short" (fragmented) IP packets with incomplete headers can be filtered
+.IP
+any of the 19 IP options or 8 registered IP security classes TOS (Type of 
+Service) field in packets
+.PP
+To keep track of the performance of the IP packet filter, a logging device
+is used which supports logging of:
+.IP
+the TCP/UDP/ICMP and IP packet headers
+.IP
+the first 128 bytes of the packet (including headers)
+.PP
+A packet can be logged when:
+.IP
+it is successfully passed through
+.IP
+it is blocked from passing through
+.IP
+it matches a rule setup to look for suspicious packets
+.PP
+IP Filter keeps its own set of statistics on:
+.IP
+packets blocked 
+.IP
+packets (and bytes!) used for accounting
+.IP
+packets passed
+.lP
+packets logged
+.IP
+attempts to log which failed (buffer full)
+.IP
+and much more, for packets going both in and out.
+
+.SH Tools
+The current implementation provides a small set of tools, which can easily
+be used and integrated with regular unix shells and tools. A brief description 
+of the tools provided:
+.PP
+ipf(8)
+reads in a set of rules, from either stdin or a file, and adds them to
+the kernels current list (appending them). It can also be used to flush the
+current filter set or delete individual filter rules. The file format is
+described in ipf(5).
+.PP
+ipfs(8)
+is a utility to temporarily lock the IP Filter kernel tables (state tables
+and NAT mappings) and write them to disk. After that the system can be
+rebooted, and ipfs can be used to read these tables from disk and restore
+them into the kernel. This way the system can be rebooted without the 
+connections being terminated.
+.PP
+ipfstat(8)
+interrogates the kernel for statistics on packet filtering, so
+far, and retrieves the list of filters in operation for inbound and outbound
+packets.
+.PP
+ipftest(1)
+reads in a filter rule file and then applies sample IP packets to
+the rule file. This allows for testing of filter list and examination of how
+a packet is passed along through it.
+.PP
+ipmon(8)
+reads buffered data from the logging device (default is /dev/ipl)
+for output to either:
+.IP
+screen (standard output) 
+.IP
+file
+.IP
+syslog
+.PP
+ipsend(1)
+generates arbitary IP packets for ethernet connected machines.
+.PP
+ipresend(1)
+reads in a data file of saved IP packets (ie
+snoop/tcpdump/etherfind output) and sends it back across the network.
+.PP
+iptest(1)
+contains a set of test "programs" which send out a series of IP
+packets, aimed at testing the strength of the TCP/IP stack at which it is
+aimed at. WARNING: this may crash machine(s) targeted!
+.PP
+ipnat(8)
+reads in a set of rules, from either stdin or a file and adds them
+to the kernels current list of active NAT rules. NAT rules can also be
+deleted using ipnat. The format of the configuration file to be used
+with ipnat is described in ipnat(5).
+.PP
+For use in your own programs (e.g. for writing of transparent application
+proxies), the programming interface and the associated ioctl's are
+documented in ipf(4).
+
+Documentation on ioctl's and the format of data saved
+to the logging character device is provided in ipl(4)
+so that you may develop your own applications to work with or in place of any 
+of the above.
+
+Similar, the interface to the NAT code is documented in ipnat(4).
+
+.SH PACKET PROCESSING FLOW
+The following diagram illustrates the flow of TCP/IP packets through the 
+various stages introduced by IP Filter.
+.PP
+.nf
+                                   IN
+                                    |
+                                    V
+          +-------------------------+--------------------------+
+          |                         |                          |
+          |                         V                          |
+          |            Network Address Translation             |
+          |                         |                          |
+          |         authenticated   |                          |
+          |       +-------<---------+                          |
+          |       |                 |                          |
+          |       |                 V                          |
+          |       V           IP Accounting                    |
+          |       |                 |                          |
+          |       |                 V                          |
+          |       |        Fragment Cache Check--+             |
+          |       |                 |            |             |
+          |       V                 V            V             |
+          |       |         Packet State Check-->+             |
+          |       |                 |            |             |
+          |       |       +->--+    |            |             |
+          |       |       |    |    V            |             |
+          |       V   groups   IP Filtering      V             |
+          |       |       |    |    |            |             |
+          |       |       +--<-+    |            |             |
+          |       |                 |            |             |
+          |       +---------------->|<-----------+             |
+          |                         |                          |
+          |                         V                          |
+          |                +---<----+                          |
+          |                |        |                          |
+          |            function     |                          |
+          |                |        V                          |
+          |                +--->----+                          |
+          |                         |                          |
+          |                         V                          |
+       +--|---<--- fast-route ---<--+                          |
+       |  |                         |                          |
+       |  |                         V                          |
+       |  +-------------------------+--------------------------+
+       |                            |
+       |                        pass only
+       |                            |
+       |                            V
+       V               [KERNEL TCP/IP Processing]
+       |                            |
+       |  +-------------------------+--------------------------+
+       |  |                         |                          |
+       |  |                         V                          |
+       |  |                Fragment Cache Check--+             |
+       |  |                         |            |             |
+       |  |                         V            V             |
+       |  |                 Packet State Check-->+             |
+       |  |                         |            |             |
+       |  |                         V            |             |
+       V  |                    IP Filtering      |             |
+       |  |                         |            V             |
+       |  |                         |<-----------+             |
+       |  |                         V                          |
+       |  |                   IP Accounting                    |
+       |  |                         |                          |
+       |  |                         V                          |
+       |  |            Network Address Translation             |
+       |  |                         |                          |
+       |  |                         V                          |
+       |  +-------------------------+--------------------------+
+       |                            |
+       |                        pass only
+       V                            |
+       +--------------------------->|
+                                    V
+                                   OUT
+.fi
+
+.SH MORE INFORMATION
+More information (including pointers to the FAQ and the mailing list) can be
+obtained from the sofware's official homepage: www.ipfilter.org
+
+.SH SEE ALSO
+ipf(4), ipf(5), ipf(8), ipfilter(5), ipfs(8), ipfstat(8), ipftest(1),
+ipl(4), ipmon(8), ipnat(8), ipnat(4),
+
diff --git a/contrib/ipfilter/man/ipfilter.4.mandoc b/contrib/ipfilter/man/ipfilter.4.mandoc
new file mode 100644
index 0000000..72534a7
--- /dev/null
+++ b/contrib/ipfilter/man/ipfilter.4.mandoc
@@ -0,0 +1,267 @@
+.Dd December 8, 2000
+.Dt IP\ FILTER 4
+.Os
+.Sh NAME
+.Nm IP Filter
+.Nd Introduction to IP packet filtering
+.Sh DESCRIPTION
+IP Filter is a TCP/IP packet filter, suitable for use in a firewall
+environment. To use, it can either be used as a loadable kernel module or
+incorporated into your UNIX kernel; use as a loadable kernel module where
+possible is highly recommended. Scripts are provided to install and patch
+system files, as required.
+.Sh FEATURES
+The IP packet filter can:
+.Bl -bullet -offset indent -compact
+.It
+explicitly deny/permit any packet from passing through
+.It
+distinguish between various interfaces
+.It
+filter by IP networks or hosts
+.It
+selectively filter any IP protocol
+.It
+selectively filter fragmented IP packets
+.It
+selectively filter packets with IP options
+.It
+send back an ICMP error/TCP reset for blocked packets
+.It
+keep packet state information for TCP, UDP and ICMP packet flows
+.It
+keep fragment state information for any IP packet, applying the same rule 
+to all fragments.
+.It
+act as a Network Address Translator (NAT)
+.It
+use redirection to setup true transparent proxy connections
+.It
+provide packet header details to a user program for authentication
+.It
+in addition, supports temporary storage of pre-authenticated rules for passing packets through
+.El
+.Pp
+Special provision is made for the three most common Internet protocols, TCP,
+UDP and ICMP. The IP Packet filter allows filtering of:
+.Bl -bullet -offset indent -compact
+.It
+Inverted host/net matchingTCP/UDP packets by port number or a port number
+range
+.It
+ICMP packets by type/code
+.It
+"established" TCP packets
+.It
+On any arbitrary combination of TCP flags
+.It
+"short" (fragmented) IP packets with incomplete headers can be filtered
+.It
+any of the 19 IP options or 8 registered IP security classes TOS (Type of 
+Service) field in packets
+.El
+.Pp
+To keep track of the performance of the IP packet filter, a logging device
+is used which supports logging of:
+.Bl -bullet -offset indent -compact
+.It
+the TCP/UDP/ICMP and IP packet headers
+.It
+the first 128 bytes of the packet (including headers)
+.El
+.Pp
+A packet can be logged when:
+.Bl -bullet -offset indent -compact
+.It
+it is successfully passed through
+.It
+it is blocked from passing through
+.It
+it matches a rule setup to look for suspicious packets
+.El
+.Pp
+IP Filter keeps its own set of statistics on:
+.Bl -bullet -offset indent -compact
+.It
+packets blocked 
+.It
+packets (and bytes!) used for accounting
+.It
+packets passed
+.li
+packets logged
+.It
+attempts to log which failed (buffer full)
+.El
+and much more, for packets going both in and out.
+
+.Sh Tools
+The current implementation provides a small set of tools, which can easily
+be used and integrated with regular unix shells and tools. A brief description 
+of the tools provided:
+.Pp
+.Xr ipf 8
+reads in a set of rules, from either stdin or a file, and adds them to
+the kernels current list (appending them). It can also be used to flush the
+current filter set or delete individual filter rules. The file format is
+described in
+.Xr ipf 5 .
+.Pp
+.Xr ipfs 8
+is a utility to temporarily lock the IP Filter kernel tables (state tables
+and NAT mappings) and write them to disk. After that the system can be
+rebooted, and ipfs can be used to read these tables from disk and restore
+them into the kernel. This way the system can be rebooted without the 
+connections being terminated.
+.Pp
+.Xr ipfstat 8
+interrogates the kernel for statistics on packet filtering, so
+far, and retrieves the list of filters in operation for inbound and outbound
+packets.
+.Pp
+.Xr ipftest 1
+reads in a filter rule file and then applies sample IP packets to
+the rule file. This allows for testing of filter list and examination of how
+a packet is passed along through it.
+.Pp
+.Xr ipmon 8
+reads buffered data from the logging device (default is /dev/ipl)
+for output to either:
+.Bl  -bullet -offset indent -compact
+.It
+screen (standard output) 
+.It
+file
+.It
+syslog
+.El
+.Pp
+.Xr ipsend 1
+generates arbitary IP packets for ethernet connected machines.
+.Pp
+.Xr ipresend 1
+reads in a data file of saved IP packets (ie
+snoop/tcpdump/etherfind output) and sends it back across the network.
+.Pp
+.Xr iptest 1
+contains a set of test "programs" which send out a series of IP
+packets, aimed at testing the strength of the TCP/IP stack at which it is
+aimed at. WARNING: this may crash machine(s) targeted!
+.Pp
+.Xr ipnat 8
+reads in a set of rules, from either stdin or a file and adds them
+to the kernels current list of active NAT rules. NAT rules can also be
+deleted using ipnat. The format of the configuration file to be used
+with ipnat is described in 
+.Xr ipnat 5 .
+.Pp
+For use in your own programs (e.g. for writing of transparent application
+proxies), the programming interface and the associated ioctl's are
+documented in
+.Xr ipf 4 .
+
+Documentation on ioctl's and the format of data saved
+to the logging character device is provided in
+.Xr ipl 4 
+so that you may develop your own applications to work with or in place of any 
+of the above.
+
+Similar, the interface to the NAT code is documented in 
+.Xr ipnat 4 .
+
+.Sh PACKET PROCESSING FLOW
+The following diagram illustrates the flow of TCP/IP packets through the 
+various stages introduced by IP Filter.
+.Pp
+.nf
+                                   IN
+                                    |
+                                    V
+          +-------------------------+--------------------------+
+          |                         |                          |
+          |                         V                          |
+          |            Network Address Translation             |
+          |                         |                          |
+          |         authenticated   |                          |
+          |       +-------<---------+                          |
+          |       |                 |                          |
+          |       |                 V                          |
+          |       V           IP Accounting                    |
+          |       |                 |                          |
+          |       |                 V                          |
+          |       |        Fragment Cache Check--+             |
+          |       |                 |            |             |
+          |       V                 V            V             |
+          |       |         Packet State Check-->+             |
+          |       |                 |            |             |
+          |       |       +->--+    |            |             |
+          |       |       |    |    V            |             |
+          |       V   groups   IP Filtering      V             |
+          |       |       |    |    |            |             |
+          |       |       +--<-+    |            |             |
+          |       |                 |            |             |
+          |       +---------------->|<-----------+             |
+          |                         |                          |
+          |                         V                          |
+          |                +---<----+                          |
+          |                |        |                          |
+          |            function     |                          |
+          |                |        V                          |
+          |                +--->----+                          |
+          |                         |                          |
+          |                         V                          |
+       +--|---<--- fast-route ---<--+                          |
+       |  |                         |                          |
+       |  |                         V                          |
+       |  +-------------------------+--------------------------+
+       |                            |
+       |                        pass only
+       |                            |
+       |                            V
+       V               [KERNEL TCP/IP Processing]
+       |                            |
+       |  +-------------------------+--------------------------+
+       |  |                         |                          |
+       |  |                         V                          |
+       |  |                Fragment Cache Check--+             |
+       |  |                         |            |             |
+       |  |                         V            V             |
+       |  |                 Packet State Check-->+             |
+       |  |                         |            |             |
+       |  |                         V            |             |
+       V  |                    IP Filtering      |             |
+       |  |                         |            V             |
+       |  |                         |<-----------+             |
+       |  |                         V                          |
+       |  |                   IP Accounting                    |
+       |  |                         |                          |
+       |  |                         V                          |
+       |  |            Network Address Translation             |
+       |  |                         |                          |
+       |  |                         V                          |
+       |  +-------------------------+--------------------------+
+       |                            |
+       |                        pass only
+       V                            |
+       +--------------------------->|
+                                    V
+                                   OUT
+.fi
+
+.Sh MORE INFORMATION
+More information (including pointers to the FAQ and the mailing list) can be
+obtained from the sofware's official homepage: www.ipfilter.org
+
+.Sh SEE ALSO
+.Xr ipf 4 ,
+.Xr ipf 5 ,
+.Xr ipf 8 ,
+.Xr ipfilter 5 ,
+.Xr ipfs 8 ,
+.Xr ipfstat 8 ,
+.Xr ipftest 1 ,
+.Xr ipl 4 ,
+.Xr ipmon 8 ,
+.Xr ipnat 4 ,
+.Xr ipnat 8 ,
+
diff --git a/contrib/ipfilter/man/ipfs.8 b/contrib/ipfilter/man/ipfs.8
index b07935a..52f6fcb 100644
--- a/contrib/ipfilter/man/ipfs.8
+++ b/contrib/ipfilter/man/ipfs.8
@@ -1,3 +1,5 @@
+.\"	$NetBSD$
+.\"
 .TH IPFS 8
 .SH NAME
 ipfs \- saves and restores information for NAT and state tables.
@@ -54,7 +56,7 @@ and
 options for saving state information.
 .TP
 .B \-n
-Don't actually take any action that would effect information stored in
+Don't actually take any action that would affect information stored in
 the kernel or on disk.
 .TP
 .B \-v
@@ -90,17 +92,17 @@ and does not change the lock once complete.
 .B \-R
 Restores all saved state information, if any, from two files,
 \fIipstate.ipf\fP and \fIipnat.ipf\fP, stored in the \fI/var/db/ipf\fP
-directory unless otherwise specified the
+directory unless otherwise specified by the
 .B \-d
-option is used.  The state tables are locked at the beginning of this
+option.  The state tables are locked at the beginning of this
 operation and unlocked once complete.
 .TP
 .B \-W
 Saves in-kernel state information, if any, out to two files,
 \fIipstate.ipf\fP and \fIipnat.ipf\fP, stored in the \fI/var/db/ipf\fP
-directory unless otherwise specified the
+directory unless otherwise specified by the
 .B \-d
-option is used.  The state tables are locked at the beginning of this
+option.  The state tables are locked at the beginning of this
 operation and unlocked once complete.
 .DT
 .SH FILES
diff --git a/contrib/ipfilter/man/ipl.4 b/contrib/ipfilter/man/ipl.4
index 0368f03..d45749b 100644
--- a/contrib/ipfilter/man/ipl.4
+++ b/contrib/ipfilter/man/ipl.4
@@ -1,3 +1,5 @@
+.\"	$NetBSD$
+.\"
 .TH IPL 4
 .SH NAME
 ipl \- IP packet log device
@@ -50,7 +52,7 @@ a buffer big enough to hold at least 1 complete log record - reading of partial
 log records is not supported.
 .PP
 If the packet contents are more than 128 bytes when \fBlog body\fP is used,
-then only 128 bytes of the packet contents is logged.
+then only 128 bytes of the packet contents are logged.
 .PP
 Although it is only possible to read from the \fBipl\fP device, opening it
 for writing is required when using an ioctl which changes any kernel data.
@@ -76,4 +78,4 @@ ipf(4)
 .SH BUGS
 Packet headers are dropped when the internal buffer (static size) fills.
 .SH FILES
-/dev/ipl
+/dev/ipl0
diff --git a/contrib/ipfilter/man/ipmon.5 b/contrib/ipfilter/man/ipmon.5
new file mode 100644
index 0000000..bc48466
--- /dev/null
+++ b/contrib/ipfilter/man/ipmon.5
@@ -0,0 +1,69 @@
+.\"	$NetBSD$
+.\"
+.TH IPMON 5
+.SH NAME
+ipmon, ipmon.conf \- ipmon configuration file format
+.SH DESCRIPTION
+The format for files accepted by ipmon is described by the following grammar:
+.LP
+.nf
+"match" "{" matchlist "}" "do" "{" doing "}" ";"
+
+matchlist ::= matching [ "," matching ] .
+matching  ::= direction | dstip | dstport | every | group | interface |
+              logtag | nattag | protocol | result | rule | srcip | srcport .
+
+dolist ::= doing [ "," doing ] .
+doing  ::= execute | save | syslog .
+
+direction ::= "in" | "out" .
+dstip     ::= "dstip" "=" ipv4 "/" number .
+dstport   ::= "dstport" "=" number .
+every     ::= "every" every-options .
+execute   ::= "execute" "=" string .
+group     ::= "group" "=" string | "group" "=" number .
+interface ::= "interface" "=" string .
+logtag    ::= "logtag" "=" string | "logtag" "=" number .
+nattag    ::= "nattag" "=" string .
+protocol  ::= "protocol" "=" string | "protocol" "=" number .
+result    ::= "result" "=" result-option .
+rule      ::= "rule" "=" number .
+srcip     ::= "srcip" "=" ipv4 "/" number .
+srcport   ::= "srcport" "=" number .
+type      ::= "type" "=" ipftype .
+ipv4      ::= number "." number "." number "." number .
+
+every-options ::= "second" | number "seconds" | "packet" | number "packets" .
+result-option ::= "pass" | "block" | "short" | "nomatch" | "log" .
+ipftype ::= "ipf" | "nat" | "state" .
+
+.fi
+.PP
+In addition, lines that start with a # are considered to be comments.
+.TP
+.SH OVERVIEW
+.PP
+The ipmon configuration file is used for defining rules to be executed when
+logging records are read from
+.B /dev/ipl.
+.PP
+At present, only IPv4 matching is available for source/destination address
+matching.
+.SH MATCHING
+.PP
+Each rule for ipmon consists of two primary segments: the first describes how
+the log record is to be matched, the second defines what action to take if
+there is a positive match.  All entries of the rules present in the file are
+compared for matches - there is no first or last rule match.
+.SH FILES
+/dev/ipl
+.br
+/dev/ipf
+.br
+/dev/ipnat
+.br
+/dev/ipstate
+.br
+/etc/ipmon.conf
+.SH SEE ALSO
+ipmon(8), ipl(4)
diff --git a/contrib/ipfilter/man/ipnat.5 b/contrib/ipfilter/man/ipnat.5
index 2bedd0c..7db3308 100644
--- a/contrib/ipfilter/man/ipnat.5
+++ b/contrib/ipfilter/man/ipnat.5
@@ -1,3 +1,5 @@
+.\"	$NetBSD$
+.\"
 .TH IPNAT 5
 .SH NAME
 ipnat, ipnat.conf \- IP NAT file format
@@ -7,45 +9,47 @@ The format for files accepted by ipnat is described by the following grammar:
 .nf
 ipmap :: = mapblock | redir | map .
 
-map ::= mapit ifname ipmask "->" dstipmask [ mapport ] mapoptions.
-map ::= mapit ifname fromto "->" dstipmask [ mapport ] mapoptions.
-mapblock ::= "map-block" ifname ipmask "->" ipmask [ ports ] mapoptions.
+map ::= mapit ifname lhs "->" dstipmask [ mapicmp | mapport | mapproxy ]
+        mapoptions .
+mapblock ::= "map-block" ifname lhs "->" ipmask [ ports ] mapoptions .
 redir ::= "rdr" ifname ipmask dport "->" ip [ "," ip ] rdrport rdroptions .
 
-dport ::= "port" number [ "-" number ] .
-ports ::= "ports" number | "auto" .
-rdrport ::= "port" number .
+lhs ::= ipmask | fromto .
+dport ::= "port" portnum [ "-" portnum ] .
+ports ::= "ports" numports | "auto" .
+rdrport ::= "port" portnum .
 mapit ::= "map" | "bimap" .
 fromto ::= "from" object "to" object .
 ipmask ::= ip "/" bits | ip "/" mask | ip "netmask" mask .
 dstipmask ::= ipmask | "range" ip "-" ip .
+mapicmp ::= "icmpidmap" "icmp" number ":" number .
 mapport ::= "portmap" tcpudp portspec .
 mapoptions ::= [ tcpudp ] [ "frag" ] [ age ] [ clamp ] .
-rdroptions ::= [ tcpudp | protocol ] [ rr ] [ "frag" ] [ age ] [ clamp ] .
+rdroptions ::= rdrproto [ rr ] [ "frag" ] [ age ] [ clamp ] [ rdrproxy ] .
 
-object  :: = addr [ port-comp | port-range ] .
-addr    :: = "any" | nummask | host-name [ "mask" ipaddr | "mask" hexnumber ] .
+object :: = addr [ port-comp | port-range ] .
+addr :: = "any" | nummask | host-name [ "mask" ipaddr | "mask" hexnumber ] .
 port-comp :: = "port" compare port-num .
 port-range :: = "port" port-num range port-num .
+rdrproto ::= tcpudp | protocol .
 
 rr ::= "round-robin" .
 age ::= "age" decnumber [ "/" decnumber ] .
 clamp ::= "mssclamp" decnumber .
-tcpudp ::= "tcp/udp" | "tcp" | "udp" .
+tcpudp ::= "tcp/udp" | protocol .
+mapproxy ::= "proxy" "port" port proxy-name '/' protocol
+rdrproxy ::= "proxy" proxy-name .
 
 protocol ::= protocol-name | decnumber .
-nummask ::= host-name [ "/" number ] .
-portspec ::= "auto" | number ":" number .
+nummask ::= host-name [ "/" decnumber ] .
+portspec ::= "auto" | portnumber ":" portnumber .
+port ::= portnumber | port-name .
+portnumber ::= number { numbers } .
 ifname ::= 'A' - 'Z' { 'A' - 'Z' } numbers .
 
-number ::= numbers [ number ] .
 numbers ::= '0' | '1' | '2' | '3' | '4' | '5' | '6' | '7' | '8' | '9' .
 .fi
 .PP
-In addition to this, # is used to mark the start of a comment and may
-appear at the end of a line with a NAT rule (as described above) or on its
-own lines.  Blank lines are ignored.
-.PP
 For standard NAT functionality, a rule should start with \fBmap\fP and then
 proceeds to specify the interface for which outgoing packets will have their
 source address rewritten.
@@ -101,41 +105,12 @@ or as
 map de0 from 10.1.0.0/16 to any -> 201.2.3.4/32
 .fi
 .LP
-For even greater control, one may negate either of the "from" or "to" clauses
-with a preceding exclamation mark ("!").  Please note that one may not use a
-negated "from" within a \fBmap\fP rule or a negated "to" within a \fBrdr\fP
-rule.  Such a rule might look like the following:
-.LP
-.nf
-+map de0 from 10.1.0.0/16 ! to 10.1.0.0/16 -> 201.2.3.4/32
-.fi
-.PP
 Only IP address and port numbers can be compared against.  This is available
 with all NAT rules.
-.SH COMMAND QUALIFIERS
-At the end of each rule, a number of qualifiers can be used to change how
-the rule works.  They are as follows:
-.TP
-protocol
-A specific protocol may be given either by its name (as found in
-/etc/protocols) or its number.  A special case for supporting both
-TCP and UDP is allowed with the name \fBtcp/udp\fP.
-.TP
-.B round-robin
-Once a rule with this term has been successfully used, it is put at the
-bottom of the list of those available so that each one will get used, in
-turn, in a list of matching left hand sides.
-.TP
-.B frag
-This qualifier is currently has no impact on NAT operation.
-.TP
-.B age
-If more refined timeouts are required than those available globally for
-NAT settings, this allows you to set them for \fBnon-TCP\fP use.
 .SH TRANSLATION
 .PP
 To the right of the "->" is the address and port specification which will be
-written into the packet providing it has already successful matched the
+written into the packet providing it has already successfully matched the
 prior constraints.  The case of redirections (\fBrdr\fP) is the simplest:
 the new destination address is that specified in the rule.  For \fBmap\fP
 rules, the destination address will be one for which the tuple combining
@@ -149,13 +124,76 @@ the packet will not be translated.  The \fBmap-block\fP is more limited in
 how it searches for a new, free and unique tuple, in that it will used an
 algorithm to determine what the new source address should be, along with the
 range of available ports - the IP address is never changed and nor does the
-port number ever exceed its alloted range.
+port number ever exceed its allotted range.
+.SH ICMPIDMAP
+.PP
+ICMP messages can be divided into two groups: "errors" and "queries". ICMP
+errors are generated as a response of another IP packet. IP Filter will take
+care that ICMP errors that are the response of a NAT-ed IP packet are
+handled properly.
+.PP
+For 4 types of ICMP queries (echo request, timestamp request, information 
+request and address mask request) IP Filter supports an additional mapping
+called "ICMP id mapping". All these 4 types of ICMP queries use a unique
+identifier called the ICMP id. This id is set by the process sending the
+ICMP query and it is usually equal to the process id. The receiver of the
+ICMP query will use the same id in its response, thus enabling the
+sender to recognize that the incoming ICMP reply is intended for him and is
+an answer to a query that he made. The "ICMP id mapping" feature modifies 
+these ICMP id in a way identical to \fBportmap\fP for TCP or UDP.
+.PP
+The reason that you might want this, is that using this feature you don't
+need an IP address per host behind the NAT box, that wants to do ICMP queries.
+The two numbers behind the \fBicmpidmap\fP keyword are the first and the
+last icmp id number that can be used. There is one important caveat: if you
+map to an IP address that belongs to the NAT box itself (notably if you have
+only a single public IP address), then you must ensure that the NAT box does
+not use the \fBicmpidmap\fP range that you specified in the \fBmap\fP rule.
+Since the ICMP id is usually the process id, it is wise to restrict the
+largest permittable process id (PID) on your operating system to e.g. 63999 and
+use the range 64000:65535 for ICMP id mapping. Changing the maximal PID is
+system dependent. For most BSD derived systems can be done by changing 
+PID_MAX in /usr/include/sys/proc.h and then rebuild the system.
 .SH KERNEL PROXIES
 .PP
 IP Filter comes with a few, simple, proxies built into the code that is loaded
 into the kernel to allow secondary channels to be opened without forcing the
-packets through a user program.
-.SH TRNSPARENT PROXIES
+packets through a user program.  The current state of the proxies is listed
+below, as one of three states:
+.HP
+Aging - protocol is roughly understood from
+the time at which the proxy was written but it is not well tested or
+maintained;
+.HP
+Developmental - basic functionality exists, works most of the time but
+may be problematic in extended real use;
+.HP
+Experimental - rough support for the protocol at best, may or may not
+work as testing has been at best sporadic, possible large scale changes
+to the code in order to properly support the protocol.
+.HP
+Mature - well tested, protocol is properly
+understood by the proxy;
+.PP
+The currently compiled in proxy list is as follows:
+.HP
+FTP - Mature
+.HP
+IRC - Experimental
+.HP
+rpcbind - Experimental
+.HP
+H.323 - Experimental
+.HP
+Real Audio (PNA) - Aging
+.HP
+IPsec - Developmental
+.HP
+netbios - Experimental
+.HP
+R-command - Mature
+
+.SH TRANSPARENT PROXIES
 .PP
 True transparent proxying should be performed using the redirect (\fBrdr\fP)
 rules directing ports to localhost (127.0.0.1) with the proxy program doing
@@ -226,7 +264,13 @@ map ppp0 172.192.0.0/16 -> 209.1.2.0/24 portmap tcp/udp auto
 .fi
 .PP
 which would result in each IP address being given a small range of ports to
-use (252).  The problem here is that the \fBmap\fP directive tells the NAT
+use (252).  In all cases, the new port number that is used is deterministic.
+That is, port X will always map to port Y.
+WARNING: It is not advisable to use the \fBauto\fP feature if you are map'ing
+to a /32 (i.e. 0/32) because the NAT code will try to map multiple hosts to
+the same port number, outgoing and ultimately this will only succeed for one
+of them.
+The problem here is that the \fBmap\fP directive tells the NAT
 code to use the next address/port pair available for an outgoing connection,
 resulting in no easily discernible relation between external addresses/ports
 and internal ones.  This is overcome by using \fBmap-block\fP as follows:
@@ -241,7 +285,6 @@ own.  As opposed to the above use of \fBmap\fP, if for some reason the user
 of (say) 172.192.0.2 wanted 260 simultaneous connections going out, they would
 be limited to 252 with \fBmap-block\fP but would just \fImove on\fP to the next
 IP address with the \fBmap\fP command.
-.SH FILES
 /dev/ipnat
 .br
 /etc/services
diff --git a/contrib/ipfilter/man/ipnat.8 b/contrib/ipfilter/man/ipnat.8
index 3b365ed..49a09be 100644
--- a/contrib/ipfilter/man/ipnat.8
+++ b/contrib/ipfilter/man/ipnat.8
@@ -1,10 +1,18 @@
+.\"	$NetBSD$
+.\"
 .TH IPNAT 8
 .SH NAME
-ipnat \- user interface to the NAT
+ipnat \- user interface to the NAT subsystem
 .SH SYNOPSIS
 .B ipnat
 [
-.B \-lnrsvCF
+.B \-dhlnrsvCF
+]
+[
+.B \-M core
+]
+[
+.B \-N system
 ]
 .B \-f <\fIfilename\fP>
 .SH DESCRIPTION
@@ -16,33 +24,48 @@ Each rule processed by \fBipnat\fP
 is added to the kernels internal lists if there are no parsing problems.
 Rules are added to the end of the internal lists, matching the order in
 which they appear when given to \fBipnat\fP.
+.PP
+Note that if
+\fBipf(8)\fP
+is not enabled when NAT is configured, it will be enabled
+automatically, as the same kernel facilities are used for
+NAT functionality.  In addition, packet forwarding must be
+enabled.
 .SH OPTIONS
 .TP
 .B \-C
 delete all entries in the current NAT rule listing (NAT rules)
+ .TP
+.B \-d
+Enable printing of some extra debugging information.
 .TP
 .B \-F
 delete all active entries in the current NAT translation table (currently
 active NAT mappings)
 .TP
+.B \-h
+Print number of hits for each MAP/Redirect filter.
+.TP
 .B \-l
 Show the list of current NAT table entry mappings.
 .TP
 .B \-n
-This flag (no-change) prevents \fBipnat\fP from actually making any ioctl
+This flag (no-change) prevents \fBipf\fP from actually making any ioctl
 calls or doing anything which would alter the currently running kernel.
 .TP
-.B \-s
-Retrieve and display NAT statistics
-.TP
 .B \-r
 Remove matching NAT rules rather than add them to the internal lists
 .TP
+.B \-s
+Retrieve and display NAT statistics
+.TP
 .B \-v
 Turn verbose mode on.  Displays information relating to rule processing
 and active rules/table entries.
 .DT
 .SH FILES
 /dev/ipnat
+.br
+/usr/share/examples/ipf  Directory with examples.
 .SH SEE ALSO
 ipnat(5), ipf(8), ipfstat(8)
diff --git a/contrib/ipfilter/man/ippool.5 b/contrib/ipfilter/man/ippool.5
new file mode 100644
index 0000000..c9eaaca
--- /dev/null
+++ b/contrib/ipfilter/man/ippool.5
@@ -0,0 +1,155 @@
+.\"	$NetBSD$
+.\"
+.TH IPPOOL 5
+.SH NAME
+ippool, ippool.conf \- IP Pool file format
+.SH DESCRIPTION
+The format for files accepted by ippool is described by the following grammar:
+.LP
+.nf
+line ::= table | groupmap .
+table ::= "table" role tabletype .
+groupmap ::= "group-map" inout role number ipfgroup
+tabletype ::= ipftree | ipfhash .
+
+role ::= "role" "=" "ipf" .
+inout ::= "in" | "out" .
+
+ipftree ::= "type" "=" "tree" number "{" addrlist "}" .
+ipfhash ::= "type" "=" "hash" number hashopts "{" hashlist "}" .
+
+ipfgroup ::= setgroup hashopts "{" grouplist "}" |
+             hashopts "{" setgrouplist "}" .
+setgroup ::= "group" "=" groupname .
+
+hashopts ::= size [ seed ] | seed .
+
+size ::= "size" number .
+seed ::= "seed" number .
+
+addrlist ::= [ "!" ] addrmask ";" [ addrlist ] .
+grouplist ::= groupentry ";" [ grouplist ] | addrmask ";" [ grouplist ] .
+
+setgrouplist ::= groupentry ";" [ setgrouplist ] .
+
+groupentry ::= addrmask "," setgroup .
+
+hashlist ::= hashentry ";" [ hashlist ] .
+hashentry ::= addrmask .
+
+addrmask ::= ipaddr | ipaddr "/" mask .
+
+mask ::= number | ipaddr .
+
+groupname ::= number | name .
+
+number ::= digit { digit } .
+
+ipaddr  = host-num "." host-num "." host-num "." host-num .
+host-num = digit [ digit [ digit ] ] .
+
+digit ::= "0" | "1" | "2" | "3" | "4" | "5" | "6" | "7" | "8" | "9" .
+name ::= letter { letter | digit } .
+.fi
+.PP
+The IP pool configuration file is used for defining a single object that
+contains a reference to multiple IP address/netmask pairs.  A pool may consist
+of a mixture of netmask sizes, from 0 to 32.
+.PP
+At this point in time, only IPv4 addressing is supported.
+.TP
+.SH OVERVIEW
+.PP
+The IP pool configuration file provides for defining two different mechanisms
+for improving speed in matching IP addresses with rules.
+The first,
+.B table
+, defines a lookup
+.I table
+to provide a single reference in a
+filter rule to multiple targets and the second,
+.B group-map
+, provides a mechanism to target multiple groups from a single filter line.
+.PP
+The
+.B group-map
+command can only be used with filter rules that use the
+.B call
+command to invoke either
+.B fr_srcgrpmap
+or
+.B fr_dstgrpmap
+, to use the source or destination address,
+respectively, for determining which filter group to jump to next for
+continuation of filter packet processing.
+.SH POOL TYPES
+.PP
+Two storage formats are provided: hash tables and tree structure.  The hash
+table is intended for use with objects all containing the same netmask or a
+few different sized netmasks of non-overlapping address space and the tree
+is designed for being able to support exceptions to a covering mask, in
+addition to normal searching as you would do with a table.  It is not possible
+to use the tree data storage type with
+.B group-map
+configuration entries.
+.SH POOL ROLES
+.PP
+When a pool is defined in the configruation file, it must have an associated
+role.  At present the only supported role is
+.B ipf.
+Future development will see futher expansion of their use by other sections
+of IPFilter code.
+.SH EXAMPLES
+The following examples show how the pool configuration file is used with
+the ipf configuration file to enhance the ability for the ipf configuration
+file to be succinct in meaning.
+.TP
+1
+The first example shows how a filter rule makes reference to a specific
+pool for matching of the source address.
+.nf
+pass in from pool/100 to any
+.fi
+.PP
+The pool configuration, which matches IP addresses 1.1.1.1 and any
+in 2.2.0.0/16, except for those in 2.2.2.0/24.
+.PP
+.nf
+table role = ipf type = tree number = 100
+        { 1.1.1.1/32; 2.2.0.0/16; !2.2.2.0/24 };
+.fi
+.TP
+2
+The following ipf.conf extract uses the
+fr_srcgrpmap/fr_dstgrpmap lookups to use the
+.B group-map
+facility to lookup the next group to use for filter processing, providing
+the
+.B call
+filter rule is matched.
+.nf
+call now fr_srcgrpmap/1010 in all
+call now fr_dstgrpmap/2010 out all
+pass in all group 1020
+block in all group 1030
+pass out all group 2020
+block out all group 2040
+.fi
+.PP
+A ippool configuration to work with the above ipf.conf file might
+look like this:
+.PP
+.nf
+group-map in role = ipf number = 1010
+	{ 1.1.1.1/32, group = 1020; 3.3.0.0/16, group = 1030; };
+group-map out role = ipf number = 2010 group = 2020
+	{ 2.2.2.2/32; 4.4.0.0/16; 5.0.0.0/8, group = 2040; };
+.fi
+.SH FILES
+/dev/iplookup
+.br
+/etc/ippool.conf
+.br
+/etc/hosts
+.SH SEE ALSO
+ippool(8), hosts(5), ipf(5), ipf(8), ipnat(8)
diff --git a/contrib/ipfilter/man/ippool.8 b/contrib/ipfilter/man/ippool.8
new file mode 100644
index 0000000..6ed1e88
--- /dev/null
+++ b/contrib/ipfilter/man/ippool.8
@@ -0,0 +1,126 @@
+.\"	$NetBSD$
+.\"
+.TH IPPOOL 8
+.SH NAME
+ippool \- user interface to the IPFilter pools
+.SH SYNOPSIS
+.br
+.B ippool
+-a [-dnv] [-m <name>] [-o <role>] -i <ipaddr>[/<netmask>]
+.br
+.B ippool
+-A [-dnv] [-m <name>] [-o <role>] [-S <seed>] [-t <type>]
+.br
+.B ippool
+-f <file> [-dnuv]
+.br
+.B ippool
+-F [-dv] [-o <role>] [-t <type>]
+.br
+.B ippool
+-l [-dv] [-m <name>] [-t <type>]
+.br
+.B ippool
+-r [-dnv] [-m <name>] [-o <role>] -i <ipaddr>[/<netmask>]
+.br
+.B ippool
+-R [-dnv] [-m <name>] [-o <role>] [-t <type>]
+.br
+.B ippool
+-s [-dtv] [-M <core>] [-N <namelist>]
+.SH DESCRIPTION
+.PP
+.B Ippool
+is used to manage information stored in the IP pools subsystem of IPFilter.
+Configuration file information may be parsed and loaded into the kernel,
+currently configured pools removed or changed as well as inspected.
+.PP
+The command line options used are broken into two sections: the global
+options and the instance specific options.
+.SH GLOBAL OPTIONS
+.TP
+.B \-d
+Toggle debugging of processing the configuration file.
+.TP
+.B \-n
+This flag (no-change) prevents
+.B ippool
+from actually making any ioctl
+calls or doing anything which would alter the currently running kernel.
+.TP
+.B \-v
+Turn verbose mode on.
+.SH COMMAND OPTIONS
+.TP
+.B -a
+Add a new data node to an existing pool in the kernel.
+.TP
+.B -A
+Add a new (empty) pool to the kernel.
+.TP
+.B -f <file>
+Read in IP pool configuration information from the file and load it into
+the kernel.
+.TP
+.B -F
+Flush loaded pools from the kernel.
+.TP
+.B -l
+Display a list of pools currently loaded into the kernel.
+.TP
+.B -r
+Remove an existing data node from a pool in the kernel.
+.TP
+.B -R
+Remove an existing pool from within the kernel.
+.TP
+.B -s
+Display IP pool statistical information.
+.SH OPTIONS
+.TP
+.B -i <ipaddr>[/<netmask>]
+Sets the IP address for the operation being undertaken with an
+all-one's mask or, optionally, a specific netmask given in either
+the dotted-quad notation or a single integer.
+.TP
+.B -m <name>
+Sets the pool name for the current operation.
+.TP
+.B -M <core>
+Specify an alternative path to /dev/kmem to retrieve statistical information
+from.
+.TP
+.B -N <namelist>
+Specify an alternative path to lookup symbol name information from when
+retrieving statistical information.
+.TP
+.B -o <role>
+Sets the role with which this pool is to be used.  Currently only
+.B ipf,
+.B auth
+and
+.B count
+are accepted as arguments to this option.
+.TP
+.B -S <seed>
+Sets the hashing seed to the number specified.  Only for use with
+.B hash
+type pools.
+.TP
+.B -t <type>
+Sets the type of pool being defined.  Myst be one of
+.B tree,
+.B hash,
+.B group-map.
+.TP
+.B -u
+When parsing a configuration file, rather than load new pool data into the
+kernel, unload it.
+.DT
+.SH FILES
+.br
+/dev/iplookup
+.br
+/etc/ippool.conf
+.SH SEE ALSO
+ippool(5), ipf(8), ipfstat(8)
diff --git a/contrib/ipfilter/man/ipscan.5 b/contrib/ipfilter/man/ipscan.5
new file mode 100644
index 0000000..4a00174
--- /dev/null
+++ b/contrib/ipfilter/man/ipscan.5
@@ -0,0 +1,52 @@
+.\"	$NetBSD$
+.\"
+.TH IPSCAN 5
+.SH NAME
+ipscan, ipscan.conf \- ipscan file format
+.SH DESCRIPTION
+.PP
+WARNING: This feature is to be considered experimental and may change
+significantly until a final implementation is drawn up.
+.PP
+The format for files accept by ipscan currently follow this rough grammar:
+.LP
+.nf
+line     ::= name ":" matchup [ "," matchup ] "=" action .
+matchup  ::= "(" ")" | "(" literal ")" | "(" literal "," match ")" .
+action   ::= result | result "else" result .
+result   ::= "close" | "track" | redirect .
+redirect ::= "redirect" ip-address [ "(" "," port-number ")" ] .
+match    ::= { match-char }
+match-char ::= "*" | "?" | "."
+.fi
+.PP
+In this example an ip-address is a dotted-quad IPv4 address and a port-number
+is a number betwee 1 and 65535, inclusive.  The match string is must be of
+same length as the literal string that it is matching (literal).  The length
+of either string is limited to 16 bytes.
+.PP
+Currently, the redirect option is not yet been implemented.
+.LP
+.nf
+#
+# * = match any character, . = exact match, ? = case insensitive
+#
+# Scan for anything that looks like HTTP and redirect it to the local
+# proxy.  One catch - this feature (redirect) is not yet implemented.
+#
+http : ("GET ", "???." ) = redirect(127.0.0.1)
+#
+# Track ssh connections (i.e do nothing)
+#
+ssh : (), ("SSH-") = track
+#
+# Things which look like smtp to be tracked else closed.
+# Client can start with EHLO (ESMTP) or HELO (SMTP).
+#
+smtp : ("HELO ", "**??."), ("220 ", "....") = track else close
+#
+.fi
+.SH FILES
+/etc/ipscan.conf
+.SH SEE ALSO
+ipscan(8)
diff --git a/contrib/ipfilter/man/ipscan.8 b/contrib/ipfilter/man/ipscan.8
new file mode 100644
index 0000000..d3ce952
--- /dev/null
+++ b/contrib/ipfilter/man/ipscan.8
@@ -0,0 +1,44 @@
+.\"	$NetBSD$
+.\"
+.TH IPSCAN 8
+.SH NAME
+ipscan \- user interface to the IPFilter content scanning
+.SH SYNOPSIS
+.B ipscan
+[
+.B \-dlnrsv
+] [
+]
+.B \-f <\fIfilename\fP>
+.SH DESCRIPTION
+.PP
+\fBipscan\fP opens the filename given (treating "\-" as stdin) and parses the
+file to build up a content scanning configuration to load into the kernel.
+Currently only the first 16 bytes of a connection can be compared.
+.SH OPTIONS
+.TP
+.B \-d
+Toggle debugging of processing the configuration file.
+.TP
+.B \-l
+Show the list of currently configured content scanning entries.
+.TP
+.B \-n
+This flag (no-change) prevents \fBipscan\fP from actually making any ioctl
+calls or doing anything which would alter the currently running kernel.
+.TP
+.B \-r
+Remove commands from kernel configuration as they are read from the
+configuration file rather than adding new ones.
+.TP
+.B \-s
+Retrieve and display content scanning statistics
+.TP
+.B \-v
+Turn verbose mode on.
+.DT
+.SH FILES
+/dev/ipscan
+/etc/ipscan.conf
+.SH SEE ALSO
+ipscan(5), ipf(8)
diff --git a/contrib/ipfilter/man/mkfilters.1 b/contrib/ipfilter/man/mkfilters.1
index b5fd9dc..3bac7d1 100644
--- a/contrib/ipfilter/man/mkfilters.1
+++ b/contrib/ipfilter/man/mkfilters.1
@@ -1,3 +1,5 @@
+.\"	$NetBSD$
+.\"
 .TH MKFILTERS 1
 .SH NAME
 mkfilters \- generate a minimal firewall ruleset for ipfilter