Import IP Filter 4.1.10

29 files changed, 141 insertions, 13 deletions

diff --git a/contrib/ipfilter/test/regress/bpf1 b/contrib/ipfilter/test/regress/bpf1
index 2c80283..5d83b77 100644
--- a/contrib/ipfilter/test/regress/bpf1
+++ b/contrib/ipfilter/test/regress/bpf1
@@ -1,4 +1,4 @@
 pass in bpf-v4 { "0x20 0 0 0xc 0x15 0 0x1 0x1010101 0x6 0 0 0x60 0x6 0 0 0" }
-pass out bpf-v4 { "0x20 0 0 0xc 0x15 0 0x1 0x1010101 0x6 0 0 0x60 0x6 0 0 0" }
+pass out bpf-v4 { "src host 1.1.1.1" }
 pass in bpf-v4 { "0x20 0 0 0x10 0x15 0 0x1 0x1010101 0x6 0 0 0x60 0x6 0 0 0" }
-pass out bpf-v4 { "0x20 0 0 0x10 0x15 0 0x1 0x1010101 0x6 0 0 0x60 0x6 0 0 0" }
+pass out bpf-v4 { "dst host 1.1.1.1" }
diff --git a/contrib/ipfilter/test/regress/f13 b/contrib/ipfilter/test/regress/f13
index f123e47..8106419 100644
--- a/contrib/ipfilter/test/regress/f13
+++ b/contrib/ipfilter/test/regress/f13
@@ -4,3 +4,5 @@ pass in proto udp from any to any port = 53 keep frags
 block in proto udp from any to any port = 53 keep frags
 pass in proto tcp from any to any port = 25 flags S/SA keep state keep frags
 block in proto tcp from any to any port = 25 flags S/SA keep state keep frags
+pass in proto udp from any to any port = 53 keep frags(strict)
+pass in proto tcp from any to any port = 25 keep state(strict)
diff --git a/contrib/ipfilter/test/regress/f18 b/contrib/ipfilter/test/regress/f18
new file mode 100644
index 0000000..acba2b3
--- /dev/null
+++ b/contrib/ipfilter/test/regress/f18
@@ -0,0 +1,4 @@
+pass in from 1.1.1.1 to any
+pass out from 2.2.2.2 to any
+count in from 1.1.1.1 to 3.3.3.3
+count out from 2.2.2.2 to 4.4.4.4
diff --git a/contrib/ipfilter/test/regress/f19 b/contrib/ipfilter/test/regress/f19
new file mode 100644
index 0000000..d7770b8
--- /dev/null
+++ b/contrib/ipfilter/test/regress/f19
@@ -0,0 +1,2 @@
+pass in quick proto tcp all flags S keep state
+pass in quick proto tcp all flags S keep state(limit 1)
diff --git a/contrib/ipfilter/test/regress/f7 b/contrib/ipfilter/test/regress/f7
index 6848a68..be1b969 100644
--- a/contrib/ipfilter/test/regress/f7
+++ b/contrib/ipfilter/test/regress/f7
@@ -4,3 +4,6 @@ block in proto icmp from any to any icmp-type unreach code 3
 pass in proto icmp from any to any icmp-type unreach code 3
 block in proto icmp from any to any icmp-type echorep
 pass in proto icmp from any to any icmp-type echorep
+pass in proto icmp all icmp-type maskreq keep state
+pass in proto icmp all icmp-type timest keep state
+pass in proto icmp all icmp-type inforeq keep state
diff --git a/contrib/ipfilter/test/regress/i1 b/contrib/ipfilter/test/regress/i1
index df60d2b..c86c320 100644
--- a/contrib/ipfilter/test/regress/i1
+++ b/contrib/ipfilter/test/regress/i1
@@ -7,10 +7,12 @@ count in from any to any
 pass in from !any to any
 block in from any to !any
 pass in on ed0 from localhost to localhost
+pass in on ed0,vx0 from localhost to localhost
 block in log first on lo0 from any to any
 pass in log body quick from any to any
 block return-rst in quick on le0 proto tcp from any to any
 block return-icmp in on qe0 from any to any
 block return-icmp(1) in on qe0 from any to any
+block return-icmp-as-dest in on le0 from any to any
 block return-icmp-as-dest(port-unr) in on qe0 from any to any
 pass out on longNICname0 from test.host.dots to test\.host.dots
diff --git a/contrib/ipfilter/test/regress/i11 b/contrib/ipfilter/test/regress/i11
index 2999a85..89b3589 100644
--- a/contrib/ipfilter/test/regress/i11
+++ b/contrib/ipfilter/test/regress/i11
@@ -1,8 +1,10 @@
 pass in on ed0 proto tcp from localhost to localhost port = telnet keep state
-block in log first on lo0 proto tcp/udp from any to any keep state
+block in log first on lo0 proto tcp/udp from any to any port = echo keep state
 pass in proto udp from localhost to localhost port = 20499 keep frag
+pass in proto udp from localhost to localhost port = 2049 keep frag(strict)
 pass in proto udp from localhost to localhost port = 53 keep state keep frags
 pass in on ed0 out-via vx0 proto udp from any to any keep state
 pass out on ppp0 in-via le0 proto tcp from any to any keep state
+pass in on ed0,vx0 out-via vx0,ed0 proto udp from any to any keep state
 pass in proto tcp from any port gt 1024 to localhost port eq 1024 keep state
 pass in proto tcp all flags S keep state(strict,newisn,no-icmp-err,limit 101)
diff --git a/contrib/ipfilter/test/regress/i12 b/contrib/ipfilter/test/regress/i12
index b8b2f3e..5342702 100644
--- a/contrib/ipfilter/test/regress/i12
+++ b/contrib/ipfilter/test/regress/i12
@@ -2,8 +2,9 @@ pass in from 1.1.1.1/32 to 2.2.2.2/32
 pass in from (2.2.2.2/24,3.3.3.3/32) to 4.4.4.4/32
 pass in from (2.2.2.2/24,3.3.3.3/32) to (5.5.5.5/32,6.6.6.6/32)
 pass in from (2.2.2.2/24,3.3.3.3/32) to (5.5.5.5/32,6.6.6.6/32) port = (22,25)
-pass in proto tcp from (2.2.2.2/24,3.3.3.3/32) to (5.5.5.5/32,6.6.6.6/32) port = (53,9)
+pass in proto tcp from (2.2.2.2/24,3.3.3.3/32) port = (53,9) to (5.5.5.5/32,6.6.6.6/32)
 pass in proto udp from (2.2.2.2/24,3.3.3.3/32) to (5.5.5.5/32,6.6.6.6/32) port = (53,9)
 pass in from 10.10.10.10 to 11.11.11.11
 pass in from pool/101 to hash/202
 pass in from hash/303 to pool/404
+pass in from pool=(!1.1.1.1,2.2.2.2,!2.2.0.0/16) to pool = ( 1.1.0.0/16 )
diff --git a/contrib/ipfilter/test/regress/i14 b/contrib/ipfilter/test/regress/i14
index 3c9d7b8..2cd2613 100644
--- a/contrib/ipfilter/test/regress/i14
+++ b/contrib/ipfilter/test/regress/i14
@@ -6,3 +6,5 @@ block in on vm0 proto tcp/udp all head 101
 pass in from 1.1.1.1 to 2.2.2.2 group 101
 pass in proto tcp from 1.0.0.1 to 2.0.0.2 group 101
 pass in proto udp from 2.0.0.2 to 3.0.0.3 group 101
+block in on vm0 proto tcp/udp all head vm0-group
+pass in from 1.1.1.1 to 2.2.2.2 group vm0-group
diff --git a/contrib/ipfilter/test/regress/i16 b/contrib/ipfilter/test/regress/i16
new file mode 100644
index 0000000..5c9144a
--- /dev/null
+++ b/contrib/ipfilter/test/regress/i16
@@ -0,0 +1,3 @@
+0 block out all
+100 pass in all
+10101 pass out proto tcp all
diff --git a/contrib/ipfilter/test/regress/i17 b/contrib/ipfilter/test/regress/i17
new file mode 100644
index 0000000..a995ae5
--- /dev/null
+++ b/contrib/ipfilter/test/regress/i17
@@ -0,0 +1,11 @@
+100 pass in all
+200 pass in proto tcp all
+110 pass in proto udp all
+110 pass in from localhost to any
+pass in all
+pass in from localhost to any
+@0 100 pass in from localhost to any
+@1 pass in from any to localhost
+@0 pass in from 1.1.1.1 to any
+@1 110 pass in from 2.2.2.2 to any
+@2 pass in from 3.3.3.3 to any
diff --git a/contrib/ipfilter/test/regress/i18 b/contrib/ipfilter/test/regress/i18
new file mode 100644
index 0000000..c2845d1
--- /dev/null
+++ b/contrib/ipfilter/test/regress/i18
@@ -0,0 +1,2 @@
+pass in tos (80,0x80,40) all
+block in ttl (0,1,2,3,4,5,6) all
diff --git a/contrib/ipfilter/test/regress/i19 b/contrib/ipfilter/test/regress/i19
new file mode 100644
index 0000000..a09fd56
--- /dev/null
+++ b/contrib/ipfilter/test/regress/i19
@@ -0,0 +1,22 @@
+block in quick log level user.debug proto icmp all
+block in quick log level mail.info proto icmp all
+block in quick log level daemon.notice proto icmp all
+block in quick log level auth.warn proto icmp all
+block in quick log level syslog.err proto icmp all
+block in quick log level lpr.crit proto icmp all
+block in quick log level news.alert proto icmp all
+block in quick log level uucp.emerg proto icmp all
+block in quick log level cron.debug proto icmp all
+block in quick log level ftp.info proto icmp all
+block in quick log level authpriv.notice proto icmp all
+block in quick log level logalert.warn proto icmp all
+block in quick log level local0.err proto icmp all
+block in quick log level local1.crit proto icmp all
+block in quick log level local2.alert proto icmp all
+block in quick log level local3.emerg proto icmp all
+block in quick log level local4.debug proto icmp all
+block in quick log level local5.info proto icmp all
+block in quick log level local6.notice proto icmp all
+block in quick log level local7.warn proto icmp all
+block in quick log level kern.err proto icmp all
+block in quick log level security.emerg proto icmp all
diff --git a/contrib/ipfilter/test/regress/i2 b/contrib/ipfilter/test/regress/i2
index a3b9cd8..50f6107 100644
--- a/contrib/ipfilter/test/regress/i2
+++ b/contrib/ipfilter/test/regress/i2
@@ -5,3 +5,4 @@ block in proto ipv6 from any to any
 block in proto 17 from any to any
 block in proto 250 from any to any
 pass in proto tcp/udp from any to any
+block in proto tcp-udp from any to any
diff --git a/contrib/ipfilter/test/regress/i20 b/contrib/ipfilter/test/regress/i20
new file mode 100644
index 0000000..99039ee
--- /dev/null
+++ b/contrib/ipfilter/test/regress/i20
@@ -0,0 +1,4 @@
+pass in on ppp0 from ppp0/peer to ppp0/32
+block in on hme0 from any to hme0/broadcast
+pass in on bge0 from bge0/network to bge0/32
+block in on eri0 from any to eri0/netmasked
diff --git a/contrib/ipfilter/test/regress/i21 b/contrib/ipfilter/test/regress/i21
new file mode 100644
index 0000000..bf797f9
--- /dev/null
+++ b/contrib/ipfilter/test/regress/i21
@@ -0,0 +1,6 @@
+pass in from port = 10101
+pass out from any to port != 22
+block in from port 20:21
+block out from any to port 10 <> 100
+pass out from any to port = (3,5,7,9)
+block in from port = (20,25)
diff --git a/contrib/ipfilter/test/regress/i4 b/contrib/ipfilter/test/regress/i4
index 7170dc2..8551f76 100644
--- a/contrib/ipfilter/test/regress/i4
+++ b/contrib/ipfilter/test/regress/i4
@@ -5,4 +5,5 @@ pass in proto 17 from localhost port > 32000 to localhost port < 29000
 block in proto udp from any port != \ntp to any port < echo
 block in proto tcp from any port = smtp to any port > 25
 pass in proto tcp/udp from any port 1 >< 3 to any port 1 <> 3
+pass in proto tcp/udp from any port 2:2 to any port 10:20
 pass in log first quick proto tcp from any port > 1023 to any port = 1723 flags S keep state
diff --git a/contrib/ipfilter/test/regress/i6 b/contrib/ipfilter/test/regress/i6
index 1a53089..0b371bd 100644
--- a/contrib/ipfilter/test/regress/i6
+++ b/contrib/ipfilter/test/regress/i6
@@ -7,4 +7,6 @@ pass in on le0 to hme0:10.1.1.1 dup-to qe0:127.0.0.1 from localhost to localhost
 block in quick on qe0 to qe1 from any to any
 block in quick to qe1 from any to any
 pass out quick dup-to hme0 from any to any
+pass out quick on hme0 reply-to hme1 from any to any
+pass in on le0 dup-to qe0:127.0.0.1 reply-to hme1:10.10.10.10 all
 pass in quick fastroute all
diff --git a/contrib/ipfilter/test/regress/i7 b/contrib/ipfilter/test/regress/i7
index 4f3328d..1a82940 100644
--- a/contrib/ipfilter/test/regress/i7
+++ b/contrib/ipfilter/test/regress/i7
@@ -2,3 +2,8 @@ pass in on ed0 proto tcp from localhost to localhost port = 23 flags S/SA
 block in on lo0 proto tcp from any to any flags A
 pass in on lo0 proto tcp from any to any flags /SAP
 block in on lo0 proto tcp from any to any flags 0x80/A
+pass in on lo0 proto tcp from any to any flags S/18
+block in on lo0 proto tcp from any to any flags 2/18
+pass in on lo0 proto tcp from any to any flags 2
+block in on lo0 proto tcp from any to any flags /16
+pass in on lo0 proto tcp from any to any flags 2/SA
diff --git a/contrib/ipfilter/test/regress/i8 b/contrib/ipfilter/test/regress/i8
index bde6ed5..cc984b2 100644
--- a/contrib/ipfilter/test/regress/i8
+++ b/contrib/ipfilter/test/regress/i8
@@ -1,2 +1,31 @@
 pass in proto icmp from localhost to localhost icmp-type timest
 block in proto icmp from any to any icmp-type unreach code 1
+pass in proto icmp all icmp-type unreach code cutoff-preced
+pass in proto icmp all icmp-type unreach code filter-prohib
+pass in proto icmp all icmp-type unreach code isolate
+pass in proto icmp all icmp-type unreach code needfrag
+pass in proto icmp all icmp-type unreach code net-prohib
+pass in proto icmp all icmp-type unreach code net-tos
+pass in proto icmp all icmp-type unreach code host-preced
+pass in proto icmp all icmp-type unreach code host-prohib
+pass in proto icmp all icmp-type unreach code host-tos
+pass in proto icmp all icmp-type unreach code host-unk
+pass in proto icmp all icmp-type unreach code host-unr
+pass in proto icmp all icmp-type unreach code (net-unk,net-unr)
+pass in proto icmp all icmp-type unreach code port-unr
+pass in proto icmp all icmp-type unreach code proto-unr
+pass in proto icmp all icmp-type unreach code srcfail
+pass in proto icmp all icmp-type (echo,echorep)
+pass in proto icmp all icmp-type inforeq
+pass in proto icmp all icmp-type inforep
+pass in proto icmp all icmp-type maskrep
+pass in proto icmp all icmp-type maskreq
+pass in proto icmp all icmp-type paramprob
+pass in proto icmp all icmp-type redir
+pass in proto icmp all icmp-type unreach
+pass in proto icmp all icmp-type routerad
+pass in proto icmp all icmp-type routersol
+pass in proto icmp all icmp-type squench
+pass in proto icmp all icmp-type timest
+pass in proto icmp all icmp-type timestrep
+pass in proto icmp all icmp-type timex
diff --git a/contrib/ipfilter/test/regress/i9 b/contrib/ipfilter/test/regress/i9
index 2b8fb10..a966bed 100644
--- a/contrib/ipfilter/test/regress/i9
+++ b/contrib/ipfilter/test/regress/i9
@@ -2,6 +2,11 @@ pass in from localhost to localhost with short,frags
 block in from any to any with ipopts
 pass in from any to any with opt nop,rr,zsu
 pass in from any to any with opt nop,rr,zsu not opt ssrr,lsrr
-pass in from localhost to localhost with not frag
+pass in from localhost to localhost and not frag
+pass in from localhost to localhost with frags,frag-body
 pass in proto tcp all flags S with not oow keep state
 pass in proto tcp all flags S with not bad,bad-src,bad-nat
+block in quick all with not nat
+block in quick all with not lowttl
+pass in all with mbcast,not bcast,multicast,not state
+pass in from any to any with opt mtur,mtup,encode,ts,tr,sec,cipso,satid,ssrr,visa,imitd,eip,finn,dps,sdb,nsapa,rtralrt,ump,addext,e-sec
diff --git a/contrib/ipfilter/test/regress/in1 b/contrib/ipfilter/test/regress/in1
index 145e3d0..163d834 100644
--- a/contrib/ipfilter/test/regress/in1
+++ b/contrib/ipfilter/test/regress/in1
@@ -3,14 +3,16 @@ map le0 1/32 -> 1/32
 map le0 128.0.0.0/1 -> 0/0
 map le0 10.0.0.0/8 -> 1.2.3.0/24
 map le0 10.0.0.5/8 -> 1.2.3.4/24
+map le0 10.0.0.5/0xff000000 -> 1.2.3.4/24
+map le0 10.0.0.5/0xff -> 1.2.3.4/24
 map le0 192.168.0.0/16 -> range 203.1.1.23-203.1.3.45
 map ppp0 192.168.0.0/16 -> 0/32 portmap tcp 10000:19999
 map ppp0 192.168.0.0/16 -> 0/32 portmap udp 20000:29999
 map ppp0 192.168.0.0/16 -> 0/32 portmap tcp/udp 30000:39999
 map ppp0 192.168.0.0/16 -> 0/32 portmap tcp auto
 map ppp0 192.168.0.0/16 -> 0/32 portmap udp auto
-map ppp0 192.168.0.0/16 -> 0/32 portmap tcp/udp auto
-map ppp0 192.168.0.0/16 -> 0/32 proxy port ftp ftp/tcp
+map ppp0 192.168.0.0/16 -> 0/32 portmap tcpudp auto
+map ppp0 192.168.0.0/16 -> 0/32 proxy port ftp ftp/6
 map ppp0 192.168.0.0/16 -> 0/32 proxy port 1010 ftp/tcp
 map le0 0/0 -> 0/32 frag
 map le0 192.168.0.0/16 -> range 203.1.1.23-203.1.3.45 frag
@@ -25,3 +27,4 @@ map ppp0 192.168.0.0/16 -> 0/32 portmap tcp 10000:19999 frag age 30
 map fxp0 from 192.168.0.0/18 to 0/0 port = 21 -> 1.2.3.4/32 proxy port 21 ftp/tcp
 map thisisalonginte 0/0 -> 0/32 mssclamp 1452 tag freddyliveshere
 map bar0 0/0 -> 0/32 icmpidmap icmp 1000:2000
+map ppp0,adsl0 0/0 -> 0/32
diff --git a/contrib/ipfilter/test/regress/in2 b/contrib/ipfilter/test/regress/in2
index 222a28c..4a86de7 100644
--- a/contrib/ipfilter/test/regress/in2
+++ b/contrib/ipfilter/test/regress/in2
@@ -2,7 +2,10 @@ rdr le0 9.8.7.6/32 port 0 -> 1.1.1.1 port 0 tcp
 rdr le0 9.8.7.6/32 port 0 -> 1.1.1.1 port 0 ip
 rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1 port 80 tcp
 rdr le0 9.8.7.6/32 -> 1.1.1.1 ip
+rdr le0 9.8.7.6/0xff000000 -> 1.1.1.1 ip
+rdr le0 9.8.7.6/0xffff0000 -> 1.1.1.1 ip
 rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1 port 80 tcp
+rdr le0 9.8.7.6/32 port 80 -> 0/0 port 80 tcp
 rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1 port 80 udp
 rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1 port 80 tcp/udp
 rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1 port 80 icmp
@@ -11,7 +14,7 @@ rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1 port 80 tcp round-robin
 rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1,1.1.1.2 port 80 tcp round-robin
 rdr le0 9.8.7.6/32 port 0 -> 1.1.1.1 port 0 ip frag
 rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1 port 80 icmp frag
-rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1,1.1.1.2 port 80 tcp frag
+rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1,1.1.1.2 port 80 tcpudp frag
 rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1 port 80 tcp round-robin frag
 rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1,1.1.1.2 port 80 tcp round-robin frag
 rdr le0 9.8.7.6/32 -> 1.1.1.1 ip frag age 10
@@ -65,3 +68,4 @@ rdr le0 9.8.7.6/32 port 1000-2000 -> 1.1.1.1 port 5555 tcp
 rdr le0 9.8.7.6/32 port 1000-2000 -> 1.1.1.1 port = 5555 tcp
 rdr le0 0/0 -> test.host.dots
 rdr le0 0/0 -> test.host.dots,test.host.dots
+rdr adsl0,ppp0 0/0 port 25 -> 127.0.0.1 port 25
diff --git a/contrib/ipfilter/test/regress/in5 b/contrib/ipfilter/test/regress/in5
index d0a115c..c539b03 100644
--- a/contrib/ipfilter/test/regress/in5
+++ b/contrib/ipfilter/test/regress/in5
@@ -1,9 +1,10 @@
+map le0 from 9.8.7.6/32 port > 1024 to any -> 1.1.1.1 portmap 10000:20000 tcp
 rdr le0 from any to 9.8.7.6/32 port = 0 -> 1.1.1.1 port 0 tcp
-rdr le0 from any to 9.8.7.6/32 port = 0 -> 1.1.1.1 port 0 ip
-rdr le0 from any to 9.8.7.6/32 port = 8888 -> 1.1.1.1 port 888 tcp
-rdr le0 from any to 9.8.7.6/32 port = 8888 -> 1.1.1.1 port 888 ip
-rdr le0 from any to 9.8.7.6/32 port = 8888 -> 1.1.1.1 port 888 tcp
-rdr le0 from any to 9.8.7.6/32 port = 8888 -> 1.1.1.1 port 888 udp
+rdr le0 from any to 9.8.7.6/0xffffffff port = 0 -> 1.1.1.1 port 0 ip
+rdr le0 from any to 9.8.7.6 port = 8888 -> 1.1.1.1 port 888 tcp
+rdr le0 from any to 9.8.7.6/255.255.255.255 port = 8888 -> 1.1.1.1 port 888 ip
+rdr le0 from any to 9.8.7.6 mask 0xffffffff port = 8888 -> 1.1.1.1 port 888 tcp
+rdr le0 from any to 9.8.7.6 mask 255.255.255.255 port = 8888 -> 1.1.1.1 port 888 udp
 rdr le0 from any to 9.8.7.6/32 port = 8888 -> 1.1.1.1 port 888 tcp/udp
 rdr le0 from any to 9.8.7.6/32 -> 1.1.1.1 port 888 icmp
 rdr le0 from any to 9.8.7.6/32 port = 8888 -> 1.1.1.1,1.1.1.2 port 888 tcp
diff --git a/contrib/ipfilter/test/regress/in6 b/contrib/ipfilter/test/regress/in6
index 6948799..932df9b 100644
--- a/contrib/ipfilter/test/regress/in6
+++ b/contrib/ipfilter/test/regress/in6
@@ -1,3 +1,7 @@
 map foo0 from any port = 1 to any port != 0 -> 0/32 udp
+map foo0 from any port eq 1 to any port ne 0 -> 0/32 udp
 map foo0 from any port < 1 to any port > 0 -> 0/32 tcp
+map foo0 from any port lt 1 to any port gt 0 -> 0/32 tcp
 map foo0 from any port <= 1 to any port >= 0 -> 0/32 tcp/udp
+map foo0 from any port le 1 to any port ge 0 -> 0/32 tcp/udp
+map foo0 from any port 1 >< 20 to any port 20 <> 40 -> 0/32 tcp/udp
diff --git a/contrib/ipfilter/test/regress/n13 b/contrib/ipfilter/test/regress/n13
new file mode 100644
index 0000000..8047930
--- /dev/null
+++ b/contrib/ipfilter/test/regress/n13
@@ -0,0 +1 @@
+map le0 192.168.0.0/16 -> range 203.1.1.23-203.1.3.45
diff --git a/contrib/ipfilter/test/regress/n14 b/contrib/ipfilter/test/regress/n14
new file mode 100644
index 0000000..6f5d571
--- /dev/null
+++ b/contrib/ipfilter/test/regress/n14
@@ -0,0 +1 @@
+rdr gre0 0/0 port 80 -> 10.1.1.254,10.1.1.253 port 80 tcp sticky
diff --git a/contrib/ipfilter/test/regress/ni17.nat b/contrib/ipfilter/test/regress/ni17.nat
new file mode 100644
index 0000000..3da6338
--- /dev/null
+++ b/contrib/ipfilter/test/regress/ni17.nat
@@ -0,0 +1,4 @@
+rdr le0 0/0 port 80 -> 10.1.1.252 port 3128 tcp round-robin
+rdr le0 0/0 port 80 -> 10.1.2.252 port 3128 tcp round-robin
+rdr le0 0/0 port 80 -> 10.1.3.252 port 3128 tcp round-robin sticky
+rdr le0 0/0 port 80 -> 10.1.1.253,10.1.2.253 port 3128 tcp round-robin sticky
diff --git a/contrib/ipfilter/test/regress/p2.ipf b/contrib/ipfilter/test/regress/p2.ipf
index 5b58647..4cfb388 100644
--- a/contrib/ipfilter/test/regress/p2.ipf
+++ b/contrib/ipfilter/test/regress/p2.ipf
@@ -1 +1,2 @@
 pass out from hash=(127.0.0.1,4.4.0.0/16) to any
+block in from hash=(127.0.0.1,4.4.0.0/16) to any