Import ipfilter 3.4.35 onto vendor branch

author: darrenr <darrenr@FreeBSD.org> 2004-06-21 22:47:51 +0000
committer: darrenr <darrenr@FreeBSD.org> 2004-06-21 22:47:51 +0000
commit: 590450fec65a8e72a8965117398bc8f14938b4a8 (patch)
tree: 699025ff2d567ed726a446a7ca5c3d916f5ca0a4 /contrib/ipfilter
parent: 244f07541460d6bd022a1eea60585315231e9e1c (diff)
download: FreeBSD-src-590450fec65a8e72a8965117398bc8f14938b4a8.zip
FreeBSD-src-590450fec65a8e72a8965117398bc8f14938b4a8.tar.gz
86 files changed, 2160 insertions, 838 deletions
diff --git a/contrib/ipfilter/BSD/kupgrade b/contrib/ipfilter/BSD/kupgrade
index f4cb518..ae0b71f 100644
--- a/contrib/ipfilter/BSD/kupgrade
+++ b/contrib/ipfilter/BSD/kupgrade
@@ -16,6 +16,9 @@ if [ $os = FreeBSD ] ; then
 		echo "Copying /usr/include/osreldate.h to /sys/sys"
 		cp /usr/include/osreldate.h /sys/sys
 	fi
+	if [ -f /sys/contrib/ipfilter/netinet/mlfk_ipl.c ] ; then
+		/bin/cp mlfk_ipl.c /sys/contrib/ipfilter/netinet/
+	fi
 fi
 archdir="/sys/arch/$karch"
 ipfdir=/sys/netinet
diff --git a/contrib/ipfilter/HISTORY b/contrib/ipfilter/HISTORY
index 80b49e2..85a8b5f 100644
--- a/contrib/ipfilter/HISTORY
+++ b/contrib/ipfilter/HISTORY
@@ -22,6 +22,87 @@
 # and especially those who have found the time to port IP Filter to new
 # platforms.
 #
+3.4.35 21/6/2004 - Released
+
+some cases of ICMP checksum alteration were wrong
+
+block packets that fail to create state table entries
+
+correctly handle all return values from ip_natout() when fastrouting
+
+ipmon was not correctly calculating the length of the IPv6 packet (excluded
+ipv6 header length)
+
+3.4.34 20/4/2004 - Released
+
+correct the ICMP packet checksum fixing up when processing ICMP errors for NAT
+
+various changes to ipsend for sending packets with ipv4 options
+
+look for ipmon's pidfile in /var/run and /etc/opt/ipf in Solaris' init script
+
+only allow non-fragmented packets to influence whether or not a logged
+packet is the same as the one logged before.
+
+make "ipfstat -f" output more informative
+
+compatibility for openbsd byte order changes to ip_off/ip_len
+
+disallow "freebsd" as a make target (encourages people to do the wrong thing)
+
+3.4.33	15/12/2003 - Released
+
+pass on messages moving through ipfilter when it is unloading itself on Solaris
+
+add disabling of auto-detach when the module attaches on Solaris
+
+compatibility patches for 'struct ifnet' changes on FreeBSD
+
+implement a maximum for the number of entries in the NAT table (NAT_TABLE_MAX
+and ipf_nattable_max)
+
+fix ipfstat -A
+
+frsynclist() wasn't paying attention to all the places where interface
+names are, like it should.
+
+fix where packet header pointers are pointing to after doing an ipf_pullup
+
+fix comparing ICMP packets with established TCP state where only 8 bytes
+of header are returned in the ICMP error.
+
+3.4.32	18/6/2003 - Released
+
+fix up the behaviour of ipfs
+
+make parsing errors in ipf/ipnat return an error rather than return
+indicating success.
+
+window scaling patch
+
+make ipfstat work as a set{g,u}id thing - gave up privs before opening
+/dev/ipl
+
+checksum adjustment corrections for ICMP & NAT
+
+attempt to always get an mbuf full of data through pullup if possible
+
+Fix bug with NAT and fragments causing system to crash
+
+Add patches for OpenBSD 3.3
+
+stop LKM locking up the machine on modern NetBSD(?)
+
+allow timeouts in NAT rules to over-ride fr_defnatage if LARGE_NAT is defined
+
+Locking patches for IRIX 6.5 from SGI.
+ 
+fix bug in synchronising state sessions where all interfaces were invalidated
+
+fix bug in openbsd 3.2 bridge diffs
+
+fix bug parsing port comparisons in proxy rules
+
 3.4.31	7/12/2002 - Released
 
 Solaris 10 compatibility
diff --git a/contrib/ipfilter/Makefile b/contrib/ipfilter/Makefile
index 2abeb53..44bd106 100644
--- a/contrib/ipfilter/Makefile
+++ b/contrib/ipfilter/Makefile
@@ -3,7 +3,7 @@
 #
 # See the IPFILTER.LICENCE file for details on licencing.
 #
-# $Id: Makefile,v 2.11.2.15 2002/12/02 04:22:56 darrenr Exp $
+# $Id: Makefile,v 2.11.2.17 2004/04/16 23:26:09 darrenr Exp $
 #
 BINDEST=/usr/local/bin
 SBINDEST=/sbin
@@ -84,7 +84,7 @@ all:
 	@echo "solaris	- auto-selects SunOS4.1.x/Solaris 2.3-6/Solaris2.4-6x86"
 	@echo "netbsd	- compile for NetBSD"
 	@echo "openbsd	- compile for OpenBSD"
-	@echo "freebsd	- compile for FreeBSD 2.0, 2.1 or earlier"
+	@echo "freebsd20	- compile for FreeBSD 2.0, 2.1 or earlier"
 	@echo "freebsd22	- compile for FreeBSD-2.2 or greater"
 	@echo "freebsd3	- compile for FreeBSD-3.x"
 	@echo "freebsd4	- compile for FreeBSD-4.x"
@@ -123,7 +123,7 @@ freebsd22: include
 	else \
 		ln -s `uname -v|sed -e 's@^.*:\(/[^: ]*\).*@\1@'`/ioconf.h BSD/$(CPU) ; \
 	fi
-	make freebsd
+	make freebsd20
 
 freebsd4: include
 	if [ x$INET6 = x ] ; then \
@@ -150,7 +150,7 @@ openbsd openbsd21: include
 	(cd BSD/$(CPUDIR); make build TOP=../.. $(MFLAGS) 'DLKM=-D_LKM' "ML=mln_ipl.c"; cd ..)
 	(cd BSD/$(CPUDIR); make -f Makefile.ipsend TOP=../.. $(MFLAGS); cd ..)
 
-freebsd freebsd20 freebsd21: include
+freebsd20 freebsd21: include
 	make setup "TARGOS=BSD" "CPUDIR=$(CPUDIR)"
 	(cd BSD/$(CPUDIR); make build TOP=../.. $(MFLAGS) "ML=mlf_ipl.c"; cd ..)
 	(cd BSD/$(CPUDIR); make -f Makefile.ipsend TOP=../.. $(MFLAGS); cd ..)
@@ -288,3 +288,27 @@ null:
 		exit 1; \
 	fi
 	-@echo make ok
+
+test-solaris test-sunos4 test-sunos5: solaris
+	(cd test && make clean && make)
+
+test-freebsd: freebsd
+	(cd test && make clean && make)
+
+test-freebsd22: freebsd22
+	(cd test && make clean && make)
+
+test-freebsd3: freebsd3
+	(cd test && make clean && make)
+
+test-freebsd4: freebsd4
+	(cd test && make clean && make)
+
+test-netbsd: netbsd
+	(cd test && make clean && make)
+
+test-openbsd: openbsd
+	(cd test && make clean && make)
+
+test-irix: irix
+	(cd test && make clean && make)
diff --git a/contrib/ipfilter/common.c b/contrib/ipfilter/common.c
index 8c72591..fa21fc9 100644
--- a/contrib/ipfilter/common.c
+++ b/contrib/ipfilter/common.c
@@ -263,7 +263,19 @@ int     linenum;
 		return 0;
 	if (!strcasecmp(**seg, "port") && *(*seg + 1) && *(*seg + 2)) {
 		(*seg)++;
-		if (isalnum(***seg) && *(*seg + 2)) {
+		if (!strcmp(**seg, "=") || !strcasecmp(**seg, "eq"))
+			comp = FR_EQUAL;
+		else if (!strcmp(**seg, "!=") || !strcasecmp(**seg, "ne"))
+			comp = FR_NEQUAL;
+		else if (!strcmp(**seg, "<") || !strcasecmp(**seg, "lt"))
+			comp = FR_LESST;
+		else if (!strcmp(**seg, ">") || !strcasecmp(**seg, "gt"))
+			comp = FR_GREATERT;
+		else if (!strcmp(**seg, "<=") || !strcasecmp(**seg, "le"))
+			comp = FR_LESSTE;
+		else if (!strcmp(**seg, ">=") || !strcasecmp(**seg, "ge"))
+			comp = FR_GREATERTE;
+		else if (isalnum(***seg) && *(*seg + 2)) {
 			if (portnum(**seg, pp, linenum) == 0)
 				return -1;
 			(*seg)++;
@@ -285,19 +297,7 @@ int     linenum;
 			}
 			if (portnum(**seg, tp, linenum) == 0)
 				return -1;
-		} else if (!strcmp(**seg, "=") || !strcasecmp(**seg, "eq"))
-			comp = FR_EQUAL;
-		else if (!strcmp(**seg, "!=") || !strcasecmp(**seg, "ne"))
-			comp = FR_NEQUAL;
-		else if (!strcmp(**seg, "<") || !strcasecmp(**seg, "lt"))
-			comp = FR_LESST;
-		else if (!strcmp(**seg, ">") || !strcasecmp(**seg, "gt"))
-			comp = FR_GREATERT;
-		else if (!strcmp(**seg, "<=") || !strcasecmp(**seg, "le"))
-			comp = FR_LESSTE;
-		else if (!strcmp(**seg, ">=") || !strcasecmp(**seg, "ge"))
-			comp = FR_GREATERTE;
-		else {
+		} else {
 			fprintf(stderr, "%d: unknown comparator (%s)\n",
 					linenum, **seg);
 			return -1;
diff --git a/contrib/ipfilter/fil.c b/contrib/ipfilter/fil.c
index a981fcb..1a1da36 100644
--- a/contrib/ipfilter/fil.c
+++ b/contrib/ipfilter/fil.c
@@ -42,6 +42,7 @@
 #  include <sys/mbuf.h>
 # endif
 #else
+# include <sys/cmn_err.h>
 # include <sys/byteorder.h>
 # if SOLARIS2 < 5
 #  include <sys/dditypes.h>
@@ -97,7 +98,7 @@
 
 #if !defined(lint)
 static const char sccsid[] = "@(#)fil.c	1.36 6/5/96 (C) 1993-2000 Darren Reed";
-static const char rcsid[] = "@(#)$Id: fil.c,v 2.35.2.67 2002/12/06 13:28:05 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: fil.c,v 2.35.2.82 2004/06/20 10:27:47 darrenr Exp $";
 #endif
 
 #ifndef	_KERNEL
@@ -144,6 +145,9 @@ fr_info_t	frcache[2];
 static	int	frflushlist __P((int, minor_t, int *, frentry_t **));
 #ifdef	_KERNEL
 static	void	frsynclist __P((frentry_t *));
+# ifndef __sgi
+static	void	*ipf_pullup __P((mb_t *, fr_info_t *, int, void *));
+# endif
 #endif
 
 
@@ -192,19 +196,27 @@ struct	optlist	secopt[8] = {
  * compact the IP header into a structure which contains just the info.
  * which is useful for comparing IP headers with.
  */
-void	fr_makefrip(hlen, ip, fin)
+int	fr_makefrip(hlen, ip, fin)
 int hlen;
 ip_t *ip;
 fr_info_t *fin;
 {
 	u_short optmsk = 0, secmsk = 0, auth = 0;
 	int i, mv, ol, off, p, plen, v;
+#if defined(_KERNEL)
+# if SOLARIS
+	mb_t *m = fin->fin_qfm;
+# else
+	mb_t *m = fin->fin_mp ? *fin->fin_mp : NULL;
+# endif
+#endif
 	fr_ip_t *fi = &fin->fin_fi;
 	struct optlist *op;
 	u_char *s, opt;
 	tcphdr_t *tcp;
 
 	fin->fin_rev = 0;
+	fin->fin_dp = NULL;
 	fin->fin_fr = NULL;
 	fin->fin_tcpf = 0;
 	fin->fin_data[0] = 0;
@@ -218,8 +230,10 @@ fr_info_t *fin;
 	if (v == 4) {
 		fin->fin_id = ip->ip_id;
 		fi->fi_tos = ip->ip_tos;
+#if (OpenBSD >= 200311) && defined(_KERNEL)
+		ip->ip_off = ntohs(ip->ip_off);
+#endif
 		off = (ip->ip_off & IP_OFFMASK);
-		tcp = (tcphdr_t *)((char *)ip + hlen);
 		(*(((u_short *)fi) + 1)) = (*(((u_short *)ip) + 4));
 		fi->fi_src.i6[1] = 0;
 		fi->fi_src.i6[2] = 0;
@@ -233,6 +247,9 @@ fr_info_t *fin;
 		fi->fi_fl = (hlen > sizeof(ip_t)) ? FI_OPTIONS : 0;
 		if (ip->ip_off & (IP_MF|IP_OFFMASK))
 			fi->fi_fl |= FI_FRAG;
+#if (OpenBSD >= 200311) && defined(_KERNEL)
+		ip->ip_len = ntohs(ip->ip_len);
+#endif
 		plen = ip->ip_len;
 		fin->fin_dlen = plen - hlen;
 	}
@@ -244,7 +261,6 @@ fr_info_t *fin;
 		p = ip6->ip6_nxt;
 		fi->fi_p = p;
 		fi->fi_ttl = ip6->ip6_hlim;
-		tcp = (tcphdr_t *)(ip6 + 1);
 		fi->fi_src.in6 = ip6->ip6_src;
 		fi->fi_dst.in6 = ip6->ip6_dst;
 		fin->fin_id = (u_short)(ip6->ip6_flow & 0xffff);
@@ -256,14 +272,23 @@ fr_info_t *fin;
 	}
 #endif
 	else
-		return;
+		return -1;
 
 	fin->fin_off = off;
 	fin->fin_plen = plen;
-	fin->fin_dp = (char *)tcp;
+	tcp = (tcphdr_t *)((char *)ip + hlen);
 	fin->fin_misc = 0;
 	off <<= 3;
 
+	/*
+	 * For both ICMPV6 & ICMP, we attempt to pullup the entire packet into
+	 * a single buffer for recognised error return packets.  Why?  Because 
+	 * the entire data section of the ICMP payload is considered to be of
+	 * significance and maybe required in NAT/state processing, so rather
+	 * than be careful later, attempt to get it all in one buffeer first.
+	 * For TCP we just make sure the _entire_ TCP header is in the first
+	 * buffer for convienience.
+	 */
 	switch (p)
 	{
 #ifdef USE_INET6
@@ -272,7 +297,7 @@ fr_info_t *fin;
 		int minicmpsz = sizeof(struct icmp6_hdr);
 		struct icmp6_hdr *icmp6;
 
-		if (fin->fin_dlen > 1) {
+		if (!(fin->fin_fl & FI_SHORT) && (fin->fin_dlen > 1)) {
 			fin->fin_data[0] = *(u_short *)tcp;
 
 			icmp6 = (struct icmp6_hdr *)tcp;
@@ -287,6 +312,14 @@ fr_info_t *fin;
 			case ICMP6_PACKET_TOO_BIG :
 			case ICMP6_TIME_EXCEEDED :
 			case ICMP6_PARAM_PROB :
+# if defined(KERNEL) && !defined(__sgi)
+				if ((m != NULL) && (M_BLEN(m) < plen)) {
+					ip = ipf_pullup(m, fin, plen, ip);
+					if (ip == NULL)
+						return -1;
+					tcp = (tcphdr_t *)((char *)ip + hlen);
+				}
+# endif /* KERNEL && !__sgi */
 				minicmpsz = ICMP6ERR_IPICMPHLEN;
 				break;
 			default :
@@ -294,22 +327,27 @@ fr_info_t *fin;
 			}
 		}
 
-		if (!(plen >= minicmpsz))
+		if (!(fin->fin_dlen >= minicmpsz))
 			fi->fi_fl |= FI_SHORT;
 
 		break;
 	}
-#endif
+#endif /* USE_INET6 */
+
 	case IPPROTO_ICMP :
 	{
 		int minicmpsz = sizeof(struct icmp);
 		icmphdr_t *icmp;
 
-		if (!off && (fin->fin_dlen > 1)) {
+		if (!off && (fin->fin_dlen > 1) && !(fin->fin_fl & FI_SHORT)) {
 			fin->fin_data[0] = *(u_short *)tcp;
 
 			icmp = (icmphdr_t *)tcp;
 
+			/*
+			 * Minimum ICMP packet is type(1) code(1) cksum(2)
+			 * plus 4 bytes following, totalling 8 bytes.
+			 */
 			switch (icmp->icmp_type)
 			{
 			case ICMP_ECHOREPLY :
@@ -325,7 +363,7 @@ fr_info_t *fin;
 			 */
 			case ICMP_TSTAMP :
 			case ICMP_TSTAMPREPLY :
-				minicmpsz = 20;
+				minicmpsz = ICMP_MINLEN + 12;
 				break;
 			/*
 			 * type(1) + code(1) + cksum(2) + id(2) seq(2) +
@@ -333,9 +371,28 @@ fr_info_t *fin;
 			 */
 			case ICMP_MASKREQ :
 			case ICMP_MASKREPLY :
-				minicmpsz = 12;
+				minicmpsz = ICMP_MINLEN + 4;
+				break;
+			/*
+			 * type(1) + code(1) + cksum(2) + arg(4) ip(20+)
+			 */
+			case ICMP_UNREACH :
+			case ICMP_SOURCEQUENCH :
+			case ICMP_REDIRECT :
+			case ICMP_TIMXCEED :
+			case ICMP_PARAMPROB :
+#if defined(KERNEL) && !defined(__sgi)
+				if ((m != NULL) && (M_BLEN(m) < plen)) {
+					ip = ipf_pullup(m, fin, plen, ip);
+					if (ip == NULL)
+						return -1;
+					tcp = (tcphdr_t *)((char *)ip + hlen);
+				}
+#endif /* KERNEL && !__sgi */
+				minicmpsz = ICMPERR_MINPKTLEN - sizeof(ip_t);
 				break;
 			default :
+				minicmpsz = ICMP_MINLEN;
 				break;
 			}
 		}
@@ -343,9 +400,9 @@ fr_info_t *fin;
 		if ((!(plen >= hlen + minicmpsz) && !off) ||
 		    (off && off < sizeof(struct icmp)))
 			fi->fi_fl |= FI_SHORT;
-
 		break;
 	}
+
 	case IPPROTO_TCP :
 		fi->fi_fl |= FI_TCPUDP;
 #ifdef	USE_INET6
@@ -359,6 +416,20 @@ fr_info_t *fin;
 			     (off && off < sizeof(struct tcphdr)))
 				fi->fi_fl |= FI_SHORT;
 		}
+
+#if defined(KERNEL) && !defined(__sgi)
+		if (!off && !(fi->fi_fl & FI_SHORT)) {
+			int tlen = hlen + (tcp->th_off << 2);
+
+			if ((m != NULL) && (M_BLEN(m) < tlen)) {
+				ip = ipf_pullup(m, fin, tlen, ip);
+				if (ip == NULL)
+					return -1;
+				tcp = (tcphdr_t *)((char *)ip + hlen);
+			}
+		}
+#endif /* _KERNEL && !_sgi */
+
 		if (!(fi->fi_fl & FI_SHORT) && !off)
 			fin->fin_tcpf = tcp->th_flags;
 		goto getports;
@@ -398,12 +469,14 @@ getports:
 		break;
 	}
 
+	fin->fin_dp = (char *)tcp;
+
 #ifdef	USE_INET6
 	if (v == 6) {
 		fi->fi_optmsk = 0;
 		fi->fi_secmsk = 0;
 		fi->fi_auth = 0;
-		return;
+		return 0;
 	}
 #endif
 
@@ -460,6 +533,7 @@ getports:
 	fi->fi_optmsk = optmsk;
 	fi->fi_secmsk = secmsk;
 	fi->fi_auth = auth;
+	return 0;
 }
 
 
@@ -747,7 +821,7 @@ void *m;
 #endif /* IPFILTER_LOG */
 		ATOMIC_INCL(fr->fr_hits);
 		if (passt & FR_ACCOUNT)
-			fr->fr_bytes += (U_QUAD_T)ip->ip_len;
+			fr->fr_bytes += (U_QUAD_T)fin->fin_plen;
 		else
 			fin->fin_icode = fr->fr_icode;
 		fin->fin_rule = rulen;
@@ -810,12 +884,17 @@ int out;
 	int p, len, drop = 0, logit = 0;
 	mb_t *mc = NULL;
 # if !defined(__SVR4) && !defined(__svr4__)
+	/*
+	 * We don't do this section for Solaris because fr_precheck() does a
+	 * pullupmsg() instead, effectively achieving the same result as here
+	 * so no need to duplicate it.
+	 */
 #  ifdef __sgi
 	char hbuf[128];
 #  endif
 	int up;
 
-#  if !SOLARIS && !defined(NETBSD_PF) && \
+#  if !defined(NETBSD_PF) && \
       ((defined(__FreeBSD__) && (__FreeBSD_version < 500011)) || \
        defined(__OpenBSD__) || defined(_BSDI_VERSION))
 	if (fr_checkp != fr_check && fr_running > 0) {
@@ -853,7 +932,7 @@ int out;
 	}
 #  endif /* CSUM_DELAY_DATA */
 
-# ifdef	USE_INET6
+#  ifdef	USE_INET6
 	if (v == 6) {
 		len = ntohs(((ip6_t*)ip)->ip6_plen);
 		if (!len)
@@ -861,17 +940,20 @@ int out;
 		len += sizeof(ip6_t);
 		p = ((ip6_t *)ip)->ip6_nxt;
 	} else
-# endif
+#  endif
 	{
 		p = ip->ip_p;
 		len = ip->ip_len;
 	}
 
+	fin->fin_mp = mp;
+	fin->fin_out = out;
+
 	if ((p == IPPROTO_TCP || p == IPPROTO_UDP ||
 	    (v == 4 && p == IPPROTO_ICMP)
-# ifdef USE_INET6
+#  ifdef USE_INET6
 	    || (v == 6 && p == IPPROTO_ICMPV6)
-# endif
+#  endif
 	   )) {
 		int plen = 0;
 
@@ -891,7 +973,7 @@ int out;
 			case IPPROTO_ESP:
 				plen = 8;
 				break;
-# ifdef USE_INET6
+#  ifdef USE_INET6
 	    		case IPPROTO_ICMPV6 :
 				/*
 				 * XXX does not take intermediate header
@@ -899,8 +981,10 @@ int out;
 				 */
 				plen = ICMP6ERR_MINPKTLEN + 8 - sizeof(ip6_t);
 				break;
-# endif
+#  endif
 			}
+		if ((plen > 0) && (len < hlen + plen))
+			fin->fin_fl |= FI_SHORT;
 		up = MIN(hlen + plen, len);
 
 		if (up > m->m_len) {
@@ -915,14 +999,34 @@ int out;
 			ip = (ip_t *)hbuf;
 #  else /* __ sgi */
 #   ifndef linux
-			if ((*mp = m_pullup(m, up)) == 0) {
-				ATOMIC_INCL(frstats[out].fr_pull[1]);
+			/*
+			 * Having determined that we need to pullup some data,
+			 * try to bring as much of the packet up into a single
+			 * buffer with the first pullup.  This hopefully means
+			 * less need for doing futher pullups.  Not needed for
+			 * Solaris because fr_precheck() does it anyway.
+			 *
+			 * The main potential for trouble here is if MLEN/MHLEN
+			 * become quite small, lets say < 64 bytes...but if
+			 * that did happen, BSD networking as a whole would be
+			 * slow/inefficient.
+			 */
+#    ifdef MHLEN
+			/*
+			 * Assume that M_PKTHDR is set and just work with what
+			 * is left rather than check..  Should not make any
+			 * real difference, anyway.
+			 */
+			if ((MHLEN > up) && (len > up))
+				up = MIN(len, MHLEN);
+#    else
+			if ((MLEN > up) && (len > up))
+				up = MIN(len, MLEN);
+#    endif
+			ip = ipf_pullup(m, fin, up, ip);
+			if (ip == NULL)
 				return -1;
-			} else {
-				ATOMIC_INCL(frstats[out].fr_pull[0]);
-				m = *mp;
-				ip = mtod(m, ip_t *);
-			}
+			m = *mp;
 #   endif /* !linux */
 #  endif /* __sgi */
 		} else
@@ -935,17 +1039,21 @@ int out;
 
 	if ((u_int)ip & 0x3)
 		return 2;
+	fin->fin_mp = mp;
+	fin->fin_out = out;
 	fin->fin_qfm = m;
 	fin->fin_qif = qif;
 # endif
+#else
+	fin->fin_mp = mp;
+	fin->fin_out = out;
 #endif /* _KERNEL */
 	
 	changed = 0;
-	fin->fin_ifp = ifp;
 	fin->fin_v = v;
-	fin->fin_out = out;
-	fin->fin_mp = mp;
-	fr_makefrip(hlen, ip, fin);
+	fin->fin_ifp = ifp;
+	if (fr_makefrip(hlen, ip, fin) == -1)
+		return -1;
 
 #ifdef _KERNEL
 # ifdef	USE_INET6
@@ -1109,6 +1217,10 @@ int out;
 		if (pass & FR_KEEPSTATE) {
 			if (fr_addstate(ip, fin, NULL, 0) == NULL) {
 				ATOMIC_INCL(frstats[out].fr_bads);
+				if (pass & FR_PASS) {
+					pass &= ~FR_PASS;
+					pass |= FR_BLOCK;
+				}
 			} else {
 				ATOMIC_INCL(frstats[out].fr_ads);
 			}
@@ -1290,6 +1402,12 @@ logit:
 			(void) ipfr_fastroute(ip, mc, &mc, fin, &fr->fr_dif);
 	}
 # endif /* !SOLARIS */
+#if (OpenBSD >= 200311) && defined(_KERNEL)
+	if (pass & FR_PASS) {
+		ip->ip_len = htons(ip->ip_len);
+		ip->ip_off = htons(ip->ip_off);
+	}
+#endif
 	return (pass & FR_PASS) ? 0 : error;
 #else /* _KERNEL */
 	if (pass & FR_NOMATCH)
@@ -1387,10 +1505,10 @@ tcphdr_t *tcp;
 	/*
 	 * Both sum and sum2 are partial sums, so combine them together.
 	 */
-	sum = (sum & 0xffff) + (sum >> 16);
-	sum = ~sum & 0xffff;
-	sum2 += sum;
-	sum2 = (sum2 & 0xffff) + (sum2 >> 16);
+	sum += ~sum2 & 0xffff;
+	while (sum > 0xffff)
+		sum = (sum & 0xffff) + (sum >> 16);
+	sum2 = ~sum & 0xffff;
 #  else /* defined(BSD) || defined(sun) */
 {
 	union {
@@ -1531,7 +1649,7 @@ nodata:
  * SUCH DAMAGE.
  *
  *	@(#)uipc_mbuf.c	8.2 (Berkeley) 1/4/94
- * $Id: fil.c,v 2.35.2.67 2002/12/06 13:28:05 darrenr Exp $
+ * $Id: fil.c,v 2.35.2.82 2004/06/20 10:27:47 darrenr Exp $
  */
 /*
  * Copy data from an mbuf chain starting "off" bytes from the beginning,
@@ -1963,12 +2081,40 @@ struct in_addr *inp;
 static void frsynclist(fr)
 register frentry_t *fr;
 {
+	frdest_t *fdp;
+	int i;
+
 	for (; fr; fr = fr->fr_next) {
-		if (fr->fr_ifa != NULL) {
-			fr->fr_ifa = GETUNIT(fr->fr_ifname, fr->fr_ip.fi_v);
-			if (fr->fr_ifa == NULL)
-				fr->fr_ifa = (void *)-1;
+		for (i = 0; i < 4; i++) {
+			if ((fr->fr_ifnames[i][1] == '\0') &&
+			    ((fr->fr_ifnames[i][0] == '-') ||
+			     (fr->fr_ifnames[i][0] == '*'))) {
+				fr->fr_ifas[i] = NULL;
+			} else if (*fr->fr_ifnames[i]) {
+				fr->fr_ifas[i] = GETUNIT(fr->fr_ifnames[i],
+							 fr->fr_v);
+				if (!fr->fr_ifas[i])
+					fr->fr_ifas[i] = (void *)-1;
+			}
+		}
+
+		fdp = &fr->fr_dif;
+		fr->fr_flags &= ~FR_DUP;
+		if (*fdp->fd_ifname) {
+			fdp->fd_ifp = GETUNIT(fdp->fd_ifname, fr->fr_v);
+			if (!fdp->fd_ifp)
+				fdp->fd_ifp = (struct ifnet *)-1;
+			else
+				fr->fr_flags |= FR_DUP;
 		}
+
+		fdp = &fr->fr_tif;
+		if (*fdp->fd_ifname) {
+			fdp->fd_ifp = GETUNIT(fdp->fd_ifname, fr->fr_v);
+			if (!fdp->fd_ifp)
+				fdp->fd_ifp = (struct ifnet *)-1;
+		}
+
 		if (fr->fr_grp)
 			frsynclist(fr->fr_grp);
 	}
@@ -1984,6 +2130,9 @@ void frsync()
      (defined(__FreeBSD_version) && (__FreeBSD_version >= 300000))
 #   if (NetBSD >= 199905) || defined(__OpenBSD__)
 	for (ifp = ifnet.tqh_first; ifp; ifp = ifp->if_list.tqe_next)
+#   elif defined(__FreeBSD_version) && (__FreeBSD_version >= 500043)
+	IFNET_RLOCK();
+	TAILQ_FOREACH(ifp, &ifnet, if_link);
 #   else
 	for (ifp = ifnet.tqh_first; ifp; ifp = ifp->if_link.tqe_next)
 #   endif
@@ -1995,6 +2144,9 @@ void frsync()
 		ip_statesync(ifp);
 	}
 	ip_natsync((struct ifnet *)-1);
+#  if defined(__FreeBSD_version) && (__FreeBSD_version >= 500043)
+	IFNET_RUNLOCK();
+#  endif
 # endif /* !SOLARIS */
 
 	WRITE_ENTER(&ipf_mutex);
@@ -2223,3 +2375,64 @@ mb_t *buf;
 	return ip->ip_len;
 }
 #endif
+
+
+#if defined(_KERNEL) && !defined(__sgi)
+void *ipf_pullup(m, fin, len, ipin)
+mb_t *m;
+fr_info_t *fin;
+int len;
+void *ipin;
+{
+# if SOLARIS
+	qif_t *qf = fin->fin_qif;
+# endif
+	int out = fin->fin_out, dpoff, ipoff;
+	char *ip;
+
+	if (m == NULL)
+		return NULL;
+
+	ipoff = (char *)ipin - MTOD(m, char *);
+	if (fin->fin_dp != NULL)
+		dpoff = (char *)fin->fin_dp - (char *)ipin;
+	else
+		dpoff = 0;
+
+	if (M_BLEN(m) < len) {
+# if SOLARIS
+		qif_t *qf = fin->fin_qif;
+		int inc = 0;
+
+		if (ipoff > 0) {
+			if ((ipoff & 3) != 0) {
+				inc = 4 - (ipoff & 3);
+				if (m->b_rptr - inc >= m->b_datap->db_base)
+					m->b_rptr -= inc;
+				else
+					inc = 0;
+			}
+		}
+		if (!pullupmsg(m, len + ipoff + inc)) {
+			ATOMIC_INCL(frstats[out].fr_pull[1]);
+			return NULL;
+		}
+		m->b_rptr += inc;
+		ATOMIC_INCL(frstats[out].fr_pull[0]);
+		qf->qf_data = MTOD(m, char *) + ipoff;
+# else
+		m = m_pullup(m, len);
+		*fin->fin_mp = m;
+		if (m == NULL) {
+			ATOMIC_INCL(frstats[out].fr_pull[1]);
+			return NULL;
+		}
+		ATOMIC_INCL(frstats[out].fr_pull[0]);
+# endif /* SOLARIS */
+	}
+	ip = MTOD(m, char *) + ipoff;
+	if (fin->fin_dp != NULL)
+		fin->fin_dp = (char *)ip + dpoff;
+	return ip;
+}
+#endif /* _KERNEL */
diff --git a/contrib/ipfilter/fils.c b/contrib/ipfilter/fils.c
index 4092ac4..e21af89 100644
--- a/contrib/ipfilter/fils.c
+++ b/contrib/ipfilter/fils.c
@@ -99,7 +99,7 @@
 
 #if !defined(lint)
 static const char sccsid[] = "@(#)fils.c	1.21 4/20/96 (C) 1993-2000 Darren Reed";
-static const char rcsid[] = "@(#)$Id: fils.c,v 2.21.2.40 2002/12/06 11:40:20 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: fils.c,v 2.21.2.45 2004/04/10 11:45:48 darrenr Exp $";
 #endif
 
 extern	char	*optarg;
@@ -117,6 +117,9 @@ static	char	*filters[4] = { "ipfilter(in)", "ipfilter(out)",
 int	opts = 0;
 int	use_inet6 = 0;
 int	live_kernel = 1;
+int	state_fd = -1;
+int	auth_fd = -1;
+int	ipf_fd = -1;
 
 #ifdef STATETOP
 #define	STSTRSIZE 	80
@@ -236,6 +239,21 @@ char *argv[];
 		}
 	optind = myoptind;
 
+	if (live_kernel == 1) {
+		if ((state_fd = open(IPL_STATE, O_RDONLY)) == -1) {
+			perror("open");
+			exit(-1);
+		}
+		if ((auth_fd = open(IPL_AUTH, O_RDONLY)) == -1) {
+			perror("open");
+			exit(-1);
+		}
+		if ((ipf_fd = open(device, O_RDONLY)) == -1) {
+			perror("open");
+			exit(-1);
+		}
+	}
+
 	if (kern != NULL || memf != NULL)
 	{
 		(void)setuid(getuid());
@@ -404,32 +422,20 @@ ipfrstat_t **ifrstpp;
 fr_authstat_t **frauthstpp;
 u_32_t *frfp;
 {
-	int fd;
-
-	if ((fd = open(device, O_RDONLY)) < 0) {
-		perror("open");
-		exit(-1);
-	}
 
-	if (!(opts & OPT_AUTHSTATS) && ioctl(fd, SIOCGETFS, fiopp) == -1) {
+	if (!(opts & OPT_AUTHSTATS) && ioctl(ipf_fd, SIOCGETFS, fiopp) == -1) {
 		perror("ioctl(ipf:SIOCGETFS)");
 		exit(-1);
 	}
 
 	if ((opts & OPT_IPSTATES)) {
-		int	sfd = open(IPL_STATE, O_RDONLY);
-
-		if (sfd == -1) {
-			perror("open");
-			exit(-1);
-		}
-		if ((ioctl(sfd, SIOCGETFS, ipsstpp) == -1)) {
+		if ((ioctl(state_fd, SIOCGETFS, ipsstpp) == -1)) {
 			perror("ioctl(state:SIOCGETFS)");
 			exit(-1);
 		}
-		close(sfd);
 	}
-	if ((opts & OPT_FRSTATES) && (ioctl(fd, SIOCGFRST, ifrstpp) == -1)) {
+	if ((opts & OPT_FRSTATES) &&
+	    (ioctl(ipf_fd, SIOCGFRST, ifrstpp) == -1)) {
 		perror("ioctl(SIOCGFRST)");
 		exit(-1);
 	}
@@ -438,15 +444,15 @@ u_32_t *frfp;
 		PRINTF("opts %#x name %s\n", opts, device);
 
 	if ((opts & OPT_AUTHSTATS) &&
-	    (ioctl(fd, SIOCATHST, frauthstpp) == -1)) {
+	    (ioctl(auth_fd, SIOCATHST, frauthstpp) == -1)) {
 		perror("ioctl(SIOCATHST)");
 		exit(-1);
 	}
 
-	if (ioctl(fd, SIOCGETFF, frfp) == -1)
+	if (ioctl(ipf_fd, SIOCGETFF, frfp) == -1)
 		perror("ioctl(SIOCGETFF)");
 
-	return fd;
+	return ipf_fd;
 }
 
 
@@ -691,10 +697,10 @@ u_32_t frf;
 			fp->f_st[0].fr_pkl, fp->f_st[1].fr_pkl);
 	PRINTF(" log failures:\t\tinput %lu output %lu\n",
 			fp->f_st[0].fr_skip, fp->f_st[1].fr_skip);
-	PRINTF("fragment state(in):\tkept %lu\tlost %lu\n",
-			fp->f_st[0].fr_nfr, fp->f_st[0].fr_bnfr);
-	PRINTF("fragment state(out):\tkept %lu\tlost %lu\n",
-			fp->f_st[1].fr_nfr, fp->f_st[1].fr_bnfr);
+	PRINTF("fragment state(in):\tkept %lu\tlost %lu\tnot fragmented %lu\n",
+			fp->f_st[0].fr_nfr, fp->f_st[0].fr_bnfr, fp->f_st[0].fr_cfr);
+	PRINTF("fragment state(out):\tkept %lu\tlost %lu\tnot fragmented %lu\n",
+			fp->f_st[1].fr_nfr, fp->f_st[1].fr_bnfr, fp->f_st[1].fr_cfr);
 	PRINTF("packet state(in):\tkept %lu\tlost %lu\n",
 			fp->f_st[0].fr_ads, fp->f_st[0].fr_bads);
 	PRINTF("packet state(out):\tkept %lu\tlost %lu\n",
@@ -849,6 +855,8 @@ ips_stat_t *ipsp;
 			ipsp->iss_miss);
 		PRINTF("\t%lu maximum\n\t%lu no memory\n\t%lu bkts in use\n",
 			ipsp->iss_max, ipsp->iss_nomem, ipsp->iss_inuse);
+		PRINTF("\t%lu logged\n\t%lu log failures\n",
+			ipsp->iss_logged, ipsp->iss_logfail);
 		PRINTF("\t%lu active\n\t%lu expired\n\t%lu closed\n",
 			ipsp->iss_active, ipsp->iss_expire, ipsp->iss_fin);
 		return;
@@ -875,7 +883,7 @@ void showqiflist(kern)
 char *kern;
 {
 	struct nlist qifnlist[2] = {
-		{ "qif_head" },
+		{ "_qif_head" },
 		{ NULL }
 	};
 	qif_t qif, *qf;
@@ -926,7 +934,7 @@ int topclosed;
 {
 	char str1[STSTRSIZE], str2[STSTRSIZE], str3[STSTRSIZE], str4[STSTRSIZE];
 	int maxtsentries = 0, reverse = 0, sorting = STSORT_DEFAULT;
-	int i, j, sfd, winx, tsentry, maxx, maxy, redraw = 0;
+	int i, j, winx, tsentry, maxx, maxy, redraw = 0;
 	ipstate_t *istab[IPSTATE_SIZE], ips;
 	ips_stat_t ipsst, *ipsstp = &ipsst;
 	statetop_t *tstable = NULL, *tp;
@@ -941,12 +949,6 @@ int topclosed;
 	fd_set readfd;
 #endif
 
-	/* open state device */
-	if ((sfd = open(IPL_STATE, O_RDONLY)) == -1) {
-		perror("open");
-		exit(-1);
-	}
-
 	/* init ncurses stuff */
   	initscr();
   	cbreak();
@@ -961,7 +963,7 @@ int topclosed;
 
 		/* get state table */
 		bzero((char *)&ipsst, sizeof(&ipsst));
-		if ((ioctl(sfd, SIOCGETFS, &ipsstp) == -1)) {
+		if ((ioctl(state_fd, SIOCGETFS, &ipsstp) == -1)) {
 			perror("ioctl(SIOCGETFS)");
 			exit(-1);
 		}
@@ -1246,8 +1248,6 @@ int topclosed;
 		}
 	} /* while */
 
-	close(sfd);
-
 	printw("\n");
 	nocbreak();
 	endwin();
@@ -1279,6 +1279,7 @@ ipfrstat_t *ifsp;
 	/*
 	 * Print out the contents (if any) of the fragment cache table.
 	 */
+	PRINTF("\n");
 	for (i = 0; i < IPFT_SIZE; i++)
 		while (ipfrtab[i]) {
 			if (kmemcpy((char *)&ifr, (u_long)ipfrtab[i],
@@ -1287,11 +1288,11 @@ ipfrstat_t *ifsp;
 			PRINTF("%s -> ", hostname(4, &ifr.ipfr_src));
 			if (kmemcpy((char *)&fr, (u_long)ifr.ipfr_rule,
 				    sizeof(fr)) == -1)
-				break;
-			PRINTF("%s %d %d %d %#02x = %#x\n",
-				hostname(4, &ifr.ipfr_dst), ifr.ipfr_id,
-				ifr.ipfr_ttl, ifr.ipfr_p, ifr.ipfr_tos,
-				fr.fr_flags);
+				break; 
+			PRINTF("%s id %d ttl %d pr %d seen0 %d ifp %p tos %#02x = fl %#x\n",
+				hostname(4, &ifr.ipfr_dst), ntohs(ifr.ipfr_id),
+				ifr.ipfr_ttl, ifr.ipfr_p, ifr.ipfr_seen0, 
+				ifr.ipfr_ifp, ifr.ipfr_tos, fr.fr_flags);
 			ipfrtab[i] = ifr.ipfr_next;
 		}
 	if (kmemcpy((char *)ipfrtab, (u_long)ifsp->ifs_nattab,sizeof(ipfrtab)))
diff --git a/contrib/ipfilter/ip_auth.c b/contrib/ipfilter/ip_auth.c
index 604d754..566f203 100644
--- a/contrib/ipfilter/ip_auth.c
+++ b/contrib/ipfilter/ip_auth.c
@@ -104,7 +104,7 @@ extern struct ifqueue   ipintrq;		/* ip packet input queue */
 #endif
 
 #if !defined(lint)
-static const char rcsid[] = "@(#)$Id: ip_auth.c,v 2.11.2.24 2002/12/06 11:40:21 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: ip_auth.c,v 2.11.2.26 2003/09/22 12:37:04 darrenr Exp $";
 #endif
 
 
@@ -314,7 +314,8 @@ int cmd;
 #endif
 {
 	mb_t *m;
-#if defined(_KERNEL) && !SOLARIS
+#if defined(_KERNEL) && !SOLARIS && \
+    (!defined(__FreeBSD_version) || (__FreeBSD_version < 501000))
 	struct ifqueue *ifq;
 	int s;
 #endif
@@ -418,7 +419,8 @@ fr_authioctlloop:
 
 			bzero((char *)&ro, sizeof(ro));
 #  if ((_BSDI_VERSION >= 199802) && (_BSDI_VERSION < 200005)) || \
-       defined(__OpenBSD__) || (defined(IRIX) && (IRIX >= 605))
+      defined(__OpenBSD__) || (defined(IRIX) && (IRIX >= 605)) || \
+      (__FreeBSD_version >= 470102)
 			error = ip_output(m, NULL, &ro, IP_FORWARDING, NULL,
 					  NULL);
 #  else
@@ -436,6 +438,9 @@ fr_authioctlloop:
 # if SOLARIS
 			error = (fr_qin(fra->fra_q, m) == 0) ? EINVAL : 0;
 # else /* SOLARIS */
+#  if __FreeBSD_version >= 501104
+			netisr_dispatch(NETISR_IP, m);
+#  else
 			ifq = &ipintrq;
 			if (IF_QFULL(ifq)) {
 				IF_DROP(ifq);
@@ -443,10 +448,11 @@ fr_authioctlloop:
 				error = ENOBUFS;
 			} else {
 				IF_ENQUEUE(ifq, m);
-#  if IRIX < 605
+#   if IRIX < 605
 				schednetisr(NETISR_IP);
-#  endif
+#   endif
 			}
+#  endif
 # endif /* SOLARIS */
 			if (error)
 				fr_authstats.fas_quefail++;
diff --git a/contrib/ipfilter/ip_compat.h b/contrib/ipfilter/ip_compat.h
index 3eacc73..7674424 100644
--- a/contrib/ipfilter/ip_compat.h
+++ b/contrib/ipfilter/ip_compat.h
@@ -4,7 +4,7 @@
  * See the IPFILTER.LICENCE file for details on licencing.
  *
  * @(#)ip_compat.h	1.8 1/14/96
- * $Id: ip_compat.h,v 2.26.2.47 2002/10/26 06:24:42 darrenr Exp $
+ * $Id: ip_compat.h,v 2.26.2.52 2004/06/09 00:01:14 darrenr Exp $
  */
 
 #ifndef	__IP_COMPAT_H__
@@ -65,7 +65,7 @@
 
 #if defined(__sgi) || defined(bsdi)
 struct  ether_addr {
-        u_char  ether_addr_octet[6];
+	u_char  ether_addr_octet[6];
 };
 #endif
 
@@ -163,6 +163,7 @@ struct file;
 #   define	V4_PART_OF_V6(v6)	v6.s6_addr32[3]
 #  endif
 # endif
+# define	M_BLEN(m)	((m)->b_wptr - (m)->b_rptr)
 
 typedef	struct	qif	{
 	struct	qif	*qf_next;
@@ -172,6 +173,7 @@ typedef	struct	qif	{
 	void	*qf_optr;
 	queue_t	*qf_in;
 	queue_t	*qf_out;
+	void	*qf_data;	/* layer 3 header pointer */
 	struct	qinit	*qf_wqinfo;
 	struct	qinit	*qf_rqinfo;
 	struct	qinit	qf_wqinit;
@@ -260,7 +262,8 @@ typedef u_int32_t       u_32_t;
 #  endif   
 # endif
 # if !defined(_KERNEL) && !defined(IPFILTER_LKM) && !defined(USE_INET6)
-#  if (defined(__FreeBSD_version) && (__FreeBSD_version >= 400000)) || \
+#  if (defined(__FreeBSD_version) && (__FreeBSD_version >= 400000) && \
+       !defined(NOINET6)) || \
       (defined(OpenBSD) && (OpenBSD >= 200111)) || \
       (defined(__NetBSD_Version__) && (__NetBSD_Version__ >= 105000000))
 #   define USE_INET6
@@ -523,6 +526,7 @@ extern	ill_t	*get_unit __P((char *, int));
 #  ifndef linux
 #   define	FREE_MB_T(m)	m_freem(m)
 #   define	MTOD(m,t)	mtod(m,t)
+#   define	M_BLEN(m)	(m)->m_len
 #   define	IRCOPY(a,b,c)	(bcopy((a), (b), (c)), 0)
 #   define	IWCOPY(a,b,c)	(bcopy((a), (b), (c)), 0)
 #   define	IRCOPYPTR	ircopyptr
@@ -541,7 +545,7 @@ extern	ill_t	*get_unit __P((char *, int));
 #  ifndef	linux
 #   define	GETUNIT(n, v)	ifunit(n)
 #   if (defined(NetBSD) && (NetBSD <= 1991011) && (NetBSD >= 199606)) || \
-        (defined(OpenBSD) && (OpenBSD >= 199603))
+       (defined(OpenBSD) && (OpenBSD >= 199603))
 #    define	IFNAME(x)	((struct ifnet *)x)->if_xname
 #   else
 #    define	USE_GETIFNAME	1
@@ -960,7 +964,7 @@ typedef	struct	{
 	__u32	th_seq;
 	__u32	th_ack;
 # if defined(__i386__) || defined(__MIPSEL__) || defined(__alpha__) ||\
-    defined(vax)
+    defined(__vax__)
 	__u8	th_res:4;
 	__u8	th_off:4;
 #else
@@ -982,7 +986,7 @@ typedef	struct	{
 
 typedef	struct	{
 # if defined(__i386__) || defined(__MIPSEL__) || defined(__alpha__) ||\
-    defined(vax)
+    defined(__vax__)
 	__u8	ip_hl:4;
 	__u8	ip_v:4;
 # else
@@ -1206,8 +1210,8 @@ struct	ether_addr	{
 #define	ICMPERR_MINPKTLEN	(20 + 8 + 20)
 #define	ICMPERR_MAXPKTLEN	(20 + 8 + 20 + 8)
 #define	ICMP6_MINLEN		8
-#define	ICMP6ERR_MINPKTLEN	(40 + 8)
-#define	ICMP6ERR_IPICMPHLEN	(40 + 8 + 40)
+#define	ICMP6ERR_IPICMPHLEN	(40 + 8)
+#define	ICMP6ERR_MINPKTLEN	(40 + 8 + 40)
 
 #ifndef	ICMP6_DST_UNREACH
 # define	ICMP6_DST_UNREACH	1
diff --git a/contrib/ipfilter/ip_fil.c b/contrib/ipfilter/ip_fil.c
index 8fcd05d..00e8565 100644
--- a/contrib/ipfilter/ip_fil.c
+++ b/contrib/ipfilter/ip_fil.c
@@ -124,7 +124,7 @@ extern	int	ip6_getpmtu(struct route_in6 *, struct route_in6 *,
 
 #if !defined(lint)
 static const char sccsid[] = "@(#)ip_fil.c	2.41 6/5/96 (C) 1993-2000 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ip_fil.c,v 2.42.2.64 2002/12/06 11:45:45 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: ip_fil.c,v 2.42.2.76 2004/05/12 23:21:03 darrenr Exp $";
 #endif
 
 
@@ -504,9 +504,9 @@ int ipldetach()
     ((__NetBSD_Version__ >= 104200000) || (__FreeBSD_version >= 500011))
 	int error = 0;
 # if __NetBSD_Version__ >= 105150000
-        struct pfil_head *ph_inet = pfil_head_get(PFIL_TYPE_AF, AF_INET);
+	struct pfil_head *ph_inet = pfil_head_get(PFIL_TYPE_AF, AF_INET);
 #  ifdef USE_INET6
-        struct pfil_head *ph_inet6 = pfil_head_get(PFIL_TYPE_AF, AF_INET6);
+	struct pfil_head *ph_inet6 = pfil_head_get(PFIL_TYPE_AF, AF_INET6);
 #  endif
 # endif
 #endif
@@ -651,7 +651,7 @@ int mode;
 	int error = 0, unit = 0, tmp;
 
 #if (BSD >= 199306) && defined(_KERNEL)
-	if ((securelevel >= 2) && (mode & FWRITE))
+	if ((securelevel >= 3) && (mode & FWRITE))
 		return EPERM;
 #endif
 #ifdef	_KERNEL
@@ -1020,8 +1020,8 @@ caddr_t data;
 			while ((f = *ftail))
 				ftail = &f->fr_next;
 		else {
+			ftail = fprev;
 			if (fp->fr_hits) {
-				ftail = fprev;
 				while (--fp->fr_hits && (f = *ftail))
 					ftail = &f->fr_next;
 			}
@@ -1275,7 +1275,7 @@ struct mbuf **mp;
 	frn.fin_ifp = fin->fin_ifp;
 	frn.fin_v = fin->fin_v;
 	frn.fin_out = fin->fin_out;
-	frn.fin_mp = fin->fin_mp;
+	frn.fin_mp = mp;
 
 	ip = mtod(m, ip_t *);
 	hlen = sizeof(*ip);
@@ -1319,9 +1319,10 @@ struct mbuf **mp;
 	m->m_pkthdr.rcvif = NULL;
 # endif
 
-	fr_makefrip(hlen, ip, &frn);
-
-	error = ipfr_fastroute(m, mp, &frn, NULL);
+	if (fr_makefrip(hlen, ip, &frn) == 0)
+		error = ipfr_fastroute(m, mp, &frn, NULL);
+	else
+		error = EINVAL;
 	return error;
 }
 
@@ -1454,7 +1455,13 @@ int dst;
 #endif
 
 	if (avail) {
+		slen = oip->ip_len;
+		oip->ip_len = htons(oip->ip_len);
+		soff = oip->ip_off;
+		oip->ip_off = htons(oip->ip_off);
 		bcopy((char *)oip, (char *)&icmp->icmp_ip, MIN(ohlen, avail));
+		oip->ip_len = slen;
+		oip->ip_off = soff;
 		avail -= MIN(ohlen, avail);
 	}
 
@@ -1475,10 +1482,6 @@ int dst;
 	} else
 #endif
 	{
-		slen = oip->ip_len;
-		oip->ip_len = htons(oip->ip_len);
-		soff = oip->ip_off;
-		oip->ip_off = htons(ip->ip_off);
 
 		ip->ip_src.s_addr = dst4.s_addr;
 		ip->ip_dst.s_addr = oip->ip_src.s_addr;
@@ -1498,13 +1501,7 @@ int dst;
 	fin->fin_hlen = hlen;
 	err = send_ip(oip, fin, &m);
 	fin->fin_hlen = shlen;
-#ifdef	USE_INET6
-	if (fin->fin_v == 4)
-#endif
-	{
-		oip->ip_len = slen;
-		oip->ip_off = soff;
-	}
+
 	return err;
 }
 
@@ -1562,7 +1559,7 @@ frdest_t *fdp;
 	register struct ip *ip, *mhip;
 	register struct mbuf *m = m0;
 	register struct route *ro;
-	int len, off, error = 0, hlen, code;
+	int len, off, error = 0, hlen, code, sout;
 	struct ifnet *ifp, *sifp;
 	struct sockaddr_in *dst;
 	struct route iproute;
@@ -1628,7 +1625,7 @@ frdest_t *fdp;
 	/*
 	 * Route packet.
 	 */
-#if defined(__sgi) && (IRIX >= 605)
+#if (defined(IRIX) && (IRIX >= 605))
 	ROUTE_RDLOCK();
 #endif
 	bzero((caddr_t)ro, sizeof (*ro));
@@ -1647,8 +1644,12 @@ frdest_t *fdp;
 	 * check that we're going in the correct direction.
 	 */
 	if ((fr != NULL) && (fin->fin_rev != 0)) {
-		if ((ifp != NULL) && (fdp == &fr->fr_tif))
+		if ((ifp != NULL) && (fdp == &fr->fr_tif)) {
+# if (defined(IRIX) && (IRIX >= 605))
+			ROUTE_UNLOCK();
+# endif
 			return 0;
+		}
 	} else if (fdp != NULL) {
 		if (fdp->fd_ip.s_addr != 0)
 			dst->sin_addr = fdp->fd_ip;
@@ -1668,13 +1669,12 @@ frdest_t *fdp;
 	rtalloc(ro);
 # endif
 
-#if defined(__sgi) && (IRIX > 602)
-	ROUTE_UNLOCK();
-#endif
-
 	if (!ifp) {
 		if (!fr || !(fr->fr_flags & FR_FASTROUTE)) {
 			error = -2;
+# if (defined(IRIX) && (IRIX >= 605))
+			ROUTE_UNLOCK();
+# endif
 			goto bad;
 		}
 	}
@@ -1687,11 +1687,14 @@ frdest_t *fdp;
 			error = EHOSTUNREACH;
 		else
 			error = ENETUNREACH;
+# if (defined(IRIX) && (IRIX >= 605))
+			ROUTE_UNLOCK();
+# endif
 		goto bad;
 	}
 
 	if (ro->ro_rt->rt_flags & RTF_GATEWAY) {
-#if BSD >= 199306
+#if (BSD >= 199306) || (defined(IRIX) && (IRIX >= 605))
 		dst = (struct sockaddr_in *)ro->ro_rt->rt_gateway;
 #else
 		dst = (struct sockaddr_in *)&ro->ro_rt->rt_gateway;
@@ -1699,6 +1702,10 @@ frdest_t *fdp;
 	}
 	ro->ro_rt->rt_use++;
 
+#if (defined(IRIX) && (IRIX > 602))
+	ROUTE_UNLOCK();
+#endif
+
 	/*
 	 * For input packets which are being "fastrouted", they won't
 	 * go back through output filtering and miss their chance to get
@@ -1706,6 +1713,7 @@ frdest_t *fdp;
 	 */
 	if (fin->fin_out == 0) {
 		sifp = fin->fin_ifp;
+		sout = fin->fin_out;
 		fin->fin_ifp = ifp;
 		fin->fin_out = 1;
 		if ((fin->fin_fr = ipacct[1][fr_active]) &&
@@ -1715,10 +1723,25 @@ frdest_t *fdp;
 		fin->fin_fr = NULL;
 		if (!fr || !(fr->fr_flags & FR_RETMASK))
 			(void) fr_checkstate(ip, fin);
-		(void) ip_natout(ip, fin);
+
+		switch (ip_natout(ip, fin))
+		{
+		case 0 :
+			break;
+		case 1 :
+			ip->ip_sum = 0;
+			break;
+		case -1 :
+			error = EINVAL;
+			goto done;
+			break;
+		}
+
 		fin->fin_ifp = sifp;
+		fin->fin_out = sout;
 	} else
 		ip->ip_sum = 0;
+
 	/*
 	 * If small enough for interface, can just send directly.
 	 */
@@ -1748,8 +1771,14 @@ frdest_t *fdp;
 			ip->ip_sum = in_cksum(m, hlen);
 # endif /* __NetBSD__ && M_CSUM_IPv4 */
 # if	(BSD >= 199306) || (defined(IRIX) && (IRIX >= 605))
+#  ifdef IRIX
+		IFNET_UPPERLOCK(ifp);
+#  endif
 		error = (*ifp->if_output)(ifp, m, (struct sockaddr *)dst,
 					  ro->ro_rt);
+#  ifdef IRIX
+		IFNET_UPPERUNLOCK(ifp);
+#  endif
 # else
 		error = (*ifp->if_output)(ifp, m, (struct sockaddr *)dst);
 # endif
@@ -1895,7 +1924,7 @@ void *ifp;
 	dst->sin_family = AF_INET;
 	dst->sin_addr = ipa;
 # if    (BSD >= 199306) && !defined(__NetBSD__) && !defined(__bsdi__) && \
-        !defined(__OpenBSD__)
+	!defined(__OpenBSD__)
 #  ifdef        RTF_CLONING
 	rtalloc_ign(&iproute, RTF_CLONING);
 #  else
@@ -1947,17 +1976,18 @@ frdest_t *fdp;
 	u_long mtu;
 	int error;
 
-	ifp = NULL;
 	ro = &ip6route;
 	fr = fin->fin_fr;
 	bzero((caddr_t)ro, sizeof(*ro));
 	dst6 = (struct sockaddr_in6 *)&ro->ro_dst;
 	dst6->sin6_family = AF_INET6;
 	dst6->sin6_len = sizeof(struct sockaddr_in6);
-	dst6->sin6_addr = fin->fin_fi.fi_src.in6;
+	dst6->sin6_addr = fin->fin_fi.fi_dst.in6;
 
 	if (fdp != NULL)
 		ifp = fdp->fd_ifp;
+	else
+		ifp = fin->fin_ifp;
 
 	if ((fr != NULL) && (fin->fin_rev != 0)) {
 		if ((ifp != NULL) && (fdp == &fr->fr_tif))
@@ -1966,9 +1996,14 @@ frdest_t *fdp;
 		if (IP6_NOTZERO(&fdp->fd_ip6))
 			dst6->sin6_addr = fdp->fd_ip6.in6;
 	}
-	if ((ifp == NULL) && ((fr == NULL) || !(fr->fr_flags & FR_FASTROUTE)))
+	if (ifp == NULL)
 		return -2;
 
+#if defined(__FreeBSD__) || defined(__NetBSD__) || defined(__OpenBSD__)
+	/* KAME */
+	if (IN6_IS_ADDR_LINKLOCAL(&dst6->sin6_addr))
+		dst6->sin6_addr.s6_addr16[1] = htons(ifp->if_index);
+#endif
 	rtalloc((struct route *)ro);
 
 	if ((ifp == NULL) && (ro->ro_rt != NULL))
@@ -1989,7 +2024,15 @@ frdest_t *fdp;
 		error = ip6_getpmtu(ro_pmtu, ro, ifp, &finaldst, &mtu);
 		if (error == 0) {
 #else
+# ifdef IN6_LINKMTU
+			mtu = IN6_LINKMTU(ifp);
+# else
+#  ifdef ND_IFINFO
+			mtu = ND_IFINFO(ifp)->linkmtu;
+#  else
 			mtu = nd_ifinfo[ifp->if_index].linkmtu;
+#  endif
+# endif
 #endif
 			if (m0->m_pkthdr.len <= mtu)
 				error = nd6_output(ifp, fin->fin_ifp, m0,
diff --git a/contrib/ipfilter/ip_fil.h b/contrib/ipfilter/ip_fil.h
index b97c796..73099ec 100644
--- a/contrib/ipfilter/ip_fil.h
+++ b/contrib/ipfilter/ip_fil.h
@@ -4,7 +4,7 @@
  * See the IPFILTER.LICENCE file for details on licencing.
  *
  * @(#)ip_fil.h	1.35 6/5/96
- * $Id: ip_fil.h,v 2.29.2.34 2002/10/01 15:23:37 darrenr Exp $
+ * $Id: ip_fil.h,v 2.29.2.35 2003/06/07 11:56:02 darrenr Exp $
  */
 
 #ifndef	__IP_FIL_H__
@@ -151,7 +151,7 @@ typedef	struct	fr_info	{
 	u_short	fin_dlen;		/* length of data portion of packet */
 	u_short	fin_id;			/* IP packet id field */
 	u_int	fin_misc;
-	void	*fin_mp;		/* pointer to pointer to mbuf */
+	mb_t	**fin_mp;		/* pointer to pointer to mbuf */
 #if SOLARIS
 	void	*fin_qfm;		/* pointer to mblk where pkt starts */
 	void	*fin_qif;
@@ -628,7 +628,7 @@ extern	void	fr_forgetifp __P((void *));
 extern	void	fr_getstat __P((struct friostat *));
 extern	int	fr_ifpaddr __P((int, void *, struct in_addr *));
 extern	int	fr_lock __P((caddr_t, int *));
-extern  void	fr_makefrip __P((int, ip_t *, fr_info_t *));
+extern  int	fr_makefrip __P((int, ip_t *, fr_info_t *));
 extern	u_short	fr_tcpsum __P((mb_t *, ip_t *, tcphdr_t *));
 extern	int	fr_scanlist __P((u_32_t, ip_t *, fr_info_t *, void *));
 extern	int	fr_tcpudpchk __P((frtuc_t *, fr_info_t *));
diff --git a/contrib/ipfilter/ip_frag.c b/contrib/ipfilter/ip_frag.c
index 0f3b818..73f98c4 100644
--- a/contrib/ipfilter/ip_frag.c
+++ b/contrib/ipfilter/ip_frag.c
@@ -90,7 +90,7 @@ extern struct timeout ipfr_slowtimer_ch;
 
 #if !defined(lint)
 static const char sccsid[] = "@(#)ip_frag.c	1.11 3/24/96 (C) 1993-2000 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ip_frag.c,v 2.10.2.25 2002/12/06 11:40:21 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: ip_frag.c,v 2.10.2.28 2003/06/11 22:28:15 darrenr Exp $";
 #endif
 
 
@@ -195,7 +195,7 @@ ipfr_t *table[];
 
 
 	/*
-	 * Instert the fragment into the fragment table, copy the struct used
+	 * Insert the fragment into the fragment table, copy the struct used
 	 * in the search using bcopy rather than reassign each field.
 	 * Set the ttl to the default.
 	 */
@@ -423,7 +423,26 @@ fr_info_t *fin;
 /*
  * forget any references to this external object.
  */
-void ipfr_forget(nat)
+void ipfr_forget(ptr)
+void *ptr;
+{
+	ipfr_t	*fr;
+	int	idx;
+
+	WRITE_ENTER(&ipf_frag);
+	for (idx = IPFT_SIZE - 1; idx >= 0; idx--)
+		for (fr = ipfr_heads[idx]; fr; fr = fr->ipfr_next)
+			if (fr->ipfr_data == ptr)
+				fr->ipfr_data = NULL;
+
+	RWLOCK_EXIT(&ipf_frag);
+}
+
+
+/*
+ * forget any references to this external object.
+ */
+void ipfr_forgetnat(nat)
 void *nat;
 {
 	ipfr_t	*fr;
@@ -431,7 +450,7 @@ void *nat;
 
 	WRITE_ENTER(&ipf_natfrag);
 	for (idx = IPFT_SIZE - 1; idx >= 0; idx--)
-		for (fr = ipfr_heads[idx]; fr; fr = fr->ipfr_next)
+		for (fr = ipfr_nattab[idx]; fr; fr = fr->ipfr_next)
 			if (fr->ipfr_data == nat)
 				fr->ipfr_data = NULL;
 
diff --git a/contrib/ipfilter/ip_frag.h b/contrib/ipfilter/ip_frag.h
index 4bd6b52..925f285 100644
--- a/contrib/ipfilter/ip_frag.h
+++ b/contrib/ipfilter/ip_frag.h
@@ -4,7 +4,7 @@
  * See the IPFILTER.LICENCE file for details on licencing.
  *
  * @(#)ip_frag.h	1.5 3/24/96
- * $Id: ip_frag.h,v 2.4.2.7 2002/07/06 14:17:51 darrenr Exp $
+ * $Id: ip_frag.h,v 2.4.2.8 2003/06/11 22:28:16 darrenr Exp $
  */
 
 #ifndef	__IP_FRAG_H__
@@ -53,6 +53,7 @@ extern	int	ipfr_nat_newfrag __P((ip_t *, fr_info_t *, struct nat *));
 extern	nat_t	*ipfr_nat_knownfrag __P((ip_t *, fr_info_t *));
 extern	frentry_t *ipfr_knownfrag __P((ip_t *, fr_info_t *));
 extern	void	ipfr_forget __P((void *));
+extern	void	ipfr_forgetnat __P((void *));
 extern	void	ipfr_unload __P((void));
 extern	void	ipfr_fragexpire __P((void));
 
diff --git a/contrib/ipfilter/ip_ftp_pxy.c b/contrib/ipfilter/ip_ftp_pxy.c
index 0108410..ae158de 100644
--- a/contrib/ipfilter/ip_ftp_pxy.c
+++ b/contrib/ipfilter/ip_ftp_pxy.c
@@ -2,7 +2,7 @@
  * Simple FTP transparent proxy for in-kernel use.  For use with the NAT
  * code.
  *
- * $Id: ip_ftp_pxy.c,v 2.7.2.42 2002/11/25 21:42:35 darrenr Exp $
+ * $Id: ip_ftp_pxy.c,v 2.7.2.47 2004/06/21 11:48:07 darrenr Exp $
  */
 #if SOLARIS && defined(_KERNEL)
 extern	kmutex_t	ipf_rw;
@@ -121,7 +121,7 @@ int dlen;
 	int inc, off;
 	nat_t *ipn;
 	mb_t *m;
-#if	SOLARIS
+#if	SOLARIS && defined(_KERNEL)
 	mb_t *m1;
 #endif
 
@@ -207,8 +207,13 @@ int dlen;
 	a1 >>= 24;
 	olen = s - f->ftps_rptr;
 	/* DO NOT change this to snprintf! */
+#if defined(OpenBSD) && (200311 >= 200311)
+	(void) snprintf(newbuf, sizeof(newbuf), "%s %u,%u,%u,%u,%u,%u\r\n",
+		        "PORT", a1, a2, a3, a4, a5, a6);
+#else
 	(void) sprintf(newbuf, "%s %u,%u,%u,%u,%u,%u\r\n",
 		       "PORT", a1, a2, a3, a4, a5, a6);
+#endif
 
 	nlen = strlen(newbuf);
 	inc = nlen - olen;
@@ -221,7 +226,7 @@ int dlen;
 	}
 
 #if !defined(_KERNEL)
-	m = *((mb_t **)fin->fin_mp);
+	m = *fin->fin_mp;
 	bcopy(newbuf, (char *)m + off, nlen);
 #else
 # if SOLARIS
@@ -251,7 +256,7 @@ int dlen;
 	}
 	copyin_mblk(m, off, nlen, newbuf);
 # else
-	m = *((mb_t **)fin->fin_mp);
+	m = *fin->fin_mp;
 	if (inc < 0)
 		m_adj(m, inc);
 	/* the mbuf chain will be extended if necessary by m_copyback() */
@@ -263,7 +268,7 @@ int dlen;
 # endif
 #endif
 	if (inc != 0) {
-#if (SOLARIS || defined(__sgi)) && defined(_KERNEL)
+#if ((SOLARIS || defined(__sgi)) && defined(_KERNEL)) || !defined(_KERNEL)
 		register u_32_t	sum1, sum2;
 
 		sum1 = ip->ip_len;
@@ -542,7 +547,7 @@ int dlen;
 		return 0;
 
 #if !defined(_KERNEL)
-	m = *((mb_t **)fin->fin_mp);
+	m = *fin->fin_mp;
 	m_copyback(m, off, nlen, newbuf);
 #else
 # if SOLARIS
@@ -569,7 +574,7 @@ int dlen;
 	}
 	/*copyin_mblk(m, off, nlen, newbuf);*/
 # else /* SOLARIS */
-	m = *((mb_t **)fin->fin_mp);
+	m = *fin->fin_mp;
 	if (inc < 0)
 		m_adj(m, inc);
 	/* the mbuf chain will be extended if necessary by m_copyback() */
@@ -577,7 +582,7 @@ int dlen;
 # endif /* SOLARIS */
 #endif /* _KERNEL */
 	if (inc != 0) {
-#if (SOLARIS || defined(__sgi)) && defined(_KERNEL)
+#if ((SOLARIS || defined(__sgi)) && defined(_KERNEL)) || !defined(_KERNEL)
 		register u_32_t	sum1, sum2;
 
 		sum1 = ip->ip_len;
@@ -714,7 +719,8 @@ size_t len;
 
 	if (i < 5) {
 #if !defined(_KERNEL) && !defined(KERNEL)
-		fprintf(stdout, "ippr_ftp_client_valid:i(%d) < 5\n", i);
+		fprintf(stdout, "ippr_ftp_client_valid:i(%lu) < 5\n",
+			(u_long)i);
 #endif
 		return 2;
 	}
@@ -750,8 +756,8 @@ size_t len;
 bad_client_command:
 #if !defined(_KERNEL) && !defined(KERNEL)
 		fprintf(stdout,
-			"ippr_ftp_client_valid:bad cmd:len %d i %d c 0x%x\n",
-			i, len, c);
+			"ippr_ftp_client_valid:bad cmd:len %lu i %lu c 0x%x\n",
+			(u_long)i, (u_long)len, c);
 #endif
 		return 1;
 	}
@@ -812,8 +818,8 @@ size_t len;
 bad_server_command:
 #if !defined(_KERNEL) && !defined(KERNEL)
 		fprintf(stdout,
-			"ippr_ftp_server_valid:bad cmd:len %d i %d c 0x%x\n",
-			i, len, c);
+			"ippr_ftp_server_valid:bad cmd:len %lu i %lu c 0x%x\n",
+			(u_long)i, (u_long)len, c);
 #endif
 		return 1;
 	}
@@ -875,7 +881,7 @@ int rv;
 #if	SOLARIS && defined(_KERNEL)
 	m = fin->fin_qfm;
 #else
-	m = *((mb_t **)fin->fin_mp);
+	m = *fin->fin_mp;
 #endif
 
 #ifndef	_KERNEL
@@ -1025,9 +1031,9 @@ int rv;
 		printf("inc %d sel %d rv %d\n", inc, sel, rv);
 		printf("th_seq %x ftps_seq %x/%x\n", thseq, f->ftps_seq[0],
 			f->ftps_seq[1]);
-		printf("ackmin %x ackoff %d\n", aps->aps_ackmin[sel],
+		printf("ackmin %x ackoff %d\n", (u_int)aps->aps_ackmin[sel],
 			aps->aps_ackoff[sel]);
-		printf("seqmin %x seqoff %d\n", aps->aps_seqmin[sel],
+		printf("seqmin %x seqoff %d\n", (u_int)aps->aps_seqmin[sel],
 			aps->aps_seqoff[sel]);
 #endif
 
diff --git a/contrib/ipfilter/ip_log.c b/contrib/ipfilter/ip_log.c
index e57bd69..3628a58 100644
--- a/contrib/ipfilter/ip_log.c
+++ b/contrib/ipfilter/ip_log.c
@@ -3,7 +3,7 @@
  *
  * See the IPFILTER.LICENCE file for details on licencing.
  *
- * $Id: ip_log.c,v 2.5.2.21 2002/10/26 06:21:30 darrenr Exp $
+ * $Id: ip_log.c,v 2.5.2.26 2004/06/20 01:59:01 darrenr Exp $
  */
 #include <sys/param.h>
 #if defined(KERNEL) && !defined(_KERNEL)
@@ -241,16 +241,17 @@ mb_t *m;
 	 */
 	bzero((char *)ipfl.fl_ifname, sizeof(ipfl.fl_ifname));
 # if SOLARIS && defined(_KERNEL)
-	ipfl.fl_unit = (u_char)ifp->ill_ppa;
+	ipfl.fl_unit = (u_int)ifp->ill_ppa;
 	bcopy(ifp->ill_name, ipfl.fl_ifname,
 	      MIN(ifp->ill_name_length, sizeof(ipfl.fl_ifname)));
 	mlen = (flags & FR_LOGBODY) ? MIN(msgdsize(m) - hlen, 128) : 0;
 # else
 #  if (defined(NetBSD) && (NetBSD <= 1991011) && (NetBSD >= 199603)) || \
-	(defined(OpenBSD) && (OpenBSD >= 199603))
+      (defined(OpenBSD) && (OpenBSD >= 199603)) || \
+      (defined(__FreeBSD__) && (__FreeBSD_version >= 501113))
 	strncpy(ipfl.fl_ifname, ifp->if_xname, IFNAMSIZ);
 #  else
-	ipfl.fl_unit = (u_char)ifp->if_unit;
+	ipfl.fl_unit = (u_int)ifp->if_unit;
 	strncpy(ipfl.fl_ifname, ifp->if_name, MIN(sizeof(ipfl.fl_ifname),
 						  sizeof(ifp->if_name)));
 #  endif
@@ -312,7 +313,7 @@ int *types, cnt;
 	 * rather than create a new one.
 	 */
 	MUTEX_ENTER(&ipl_mutex);
-	if (fin != NULL) {
+	if ((fin != NULL) && (fin->fin_off == 0)) {
 		if ((ipll[dev] != NULL) &&
 		    bcmp((char *)fin, (char *)&iplcrc[dev], FI_LCSIZE) == 0) {
 			ipll[dev]->ipl_count++;
@@ -428,7 +429,7 @@ struct uio *uio;
 	SPL_NET(s);
 	MUTEX_ENTER(&ipl_mutex);
 
-	while (!iplused[unit] || !iplt[unit]) {
+	while (iplt[unit] == NULL) {
 # if SOLARIS && defined(_KERNEL)
 		if (!cv_wait_sig(&iplwait, &ipl_mutex)) {
 			MUTEX_EXIT(&ipl_mutex);
diff --git a/contrib/ipfilter/ip_nat.c b/contrib/ipfilter/ip_nat.c
index d8c8622..4193933 100644
--- a/contrib/ipfilter/ip_nat.c
+++ b/contrib/ipfilter/ip_nat.c
@@ -109,12 +109,13 @@ extern struct ifnet vpnif;
 
 #if !defined(lint)
 static const char sccsid[] = "@(#)ip_nat.c	1.11 6/5/96 (C) 1995 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ip_nat.c,v 2.37.2.74 2002/12/06 11:40:21 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: ip_nat.c,v 2.37.2.82 2004/05/30 17:56:52 darrenr Exp $";
 #endif
 
 nat_t	**nat_table[2] = { NULL, NULL },
 	*nat_instances = NULL;
 ipnat_t	*nat_list = NULL;
+u_int	ipf_nattable_max = NAT_TABLE_MAX;
 u_int	ipf_nattable_sz = NAT_TABLE_SZ;
 u_int	ipf_natrules_sz = NAT_SIZE;
 u_int	ipf_rdrrules_sz = RDR_SIZE;
@@ -778,6 +779,8 @@ caddr_t data;
 	if ((aps != NULL) && (aps->aps_data != 0)) {
 		ng.ng_sz += sizeof(ap_session_t);
 		ng.ng_sz += aps->aps_psiz;
+		if (aps->aps_psiz > 4)	/* XXX - sizeof(ipn_data) */
+			ng.ng_sz -= 4;
 	}
 
 	error = IWCOPY((caddr_t)&ng, data, sizeof(ng));
@@ -793,6 +796,7 @@ caddr_t data;
 	nat_save_t ipn, *ipnp, *ipnn = NULL;
 	register nat_t *n, *nat;
 	ap_session_t *aps;
+	size_t dsz;
 	int error;
 
 	error = IRCOPY(data, (caddr_t)&ipnp, sizeof(ipnp));
@@ -824,7 +828,6 @@ caddr_t data;
 	}
 
 	ipn.ipn_next = nat->nat_next;
-	ipn.ipn_dsize = 0;
 	bcopy((char *)nat, (char *)&ipn.ipn_nat, sizeof(ipn.ipn_nat));
 	ipn.ipn_nat.nat_data = NULL;
 
@@ -838,10 +841,13 @@ caddr_t data;
 		      sizeof(ipn.ipn_rule));
 
 	if ((aps = nat->nat_aps)) {
-		ipn.ipn_dsize = sizeof(*aps);
+		dsz = sizeof(*aps);
 		if (aps->aps_data)
-			ipn.ipn_dsize += aps->aps_psiz;
-		KMALLOCS(ipnn, nat_save_t *, sizeof(*ipnn) + ipn.ipn_dsize);
+			dsz += aps->aps_psiz;
+		ipn.ipn_dsize = dsz;
+		if (dsz > sizeof(ipn.ipn_data))
+			dsz -= sizeof(ipn.ipn_data);
+		KMALLOCS(ipnn, nat_save_t *, sizeof(*ipnn) + dsz);
 		if (ipnn == NULL)
 			return ENOMEM;
 		bcopy((char *)&ipn, (char *)ipnn, sizeof(ipn));
@@ -850,14 +856,14 @@ caddr_t data;
 		if (aps->aps_data) {
 			bcopy(aps->aps_data, ipnn->ipn_data + sizeof(*aps),
 			      aps->aps_psiz);
-			ipnn->ipn_dsize += aps->aps_psiz;
 		}
 		error = IWCOPY((caddr_t)ipnn, ipnp,
-			       sizeof(ipn) + ipn.ipn_dsize);
+			       sizeof(ipn) + dsz);
 		if (error)
 			error = EFAULT;
-		KFREES(ipnn, sizeof(*ipnn) + ipn.ipn_dsize);
+		KFREES(ipnn, sizeof(*ipnn) + dsz);
 	} else {
+		ipn.ipn_dsize = 0;
 		error = IWCOPY((caddr_t)&ipn, ipnp, sizeof(ipn));
 		if (error)
 			error = EFAULT;
@@ -885,12 +891,12 @@ caddr_t data;
 		return EFAULT;
 	nat = NULL;
 	if (ipn.ipn_dsize) {
-		KMALLOCS(ipnn, nat_save_t *, sizeof(ipn) + ipn.ipn_dsize);
+		KMALLOCS(ipnn, nat_save_t *, sizeof(*ipnn) + ipn.ipn_dsize);
 		if (ipnn == NULL)
 			return ENOMEM;
 		bcopy((char *)&ipn, (char *)ipnn, sizeof(ipn));
-		error = IRCOPY((caddr_t)ipnp, (caddr_t)ipn.ipn_data,
-			       ipn.ipn_dsize);
+		error = IRCOPY((caddr_t)ipnp + offsetof(nat_save_t, ipn_data),
+			       (caddr_t)ipnn->ipn_data, ipn.ipn_dsize);
 		if (error) {
 			error = EFAULT;
 			goto junkput;
@@ -1065,7 +1071,7 @@ struct nat *natd;
 	 * If there's a fragment table entry too for this nat entry, then
 	 * dereference that as well.
 	 */
-	ipfr_forget((void *)natd);
+	ipfr_forgetnat((void *)natd);
 	aps_free(natd->nat_aps);
 	nat_stats.ns_inuse--;
 	KFREE(natd);
@@ -1163,6 +1169,11 @@ int direction;
 	qif_t *qf = fin->fin_qif;
 #endif
 
+	if (nat_stats.ns_inuse >= ipf_nattable_max) {
+		nat_stats.ns_memfail++;
+		return NULL;
+	}
+
 	nflags = flags & np->in_flags;
 	if (flags & IPN_TCPUDP) {
 		tcp = (tcphdr_t *)fin->fin_dp;
@@ -1174,6 +1185,17 @@ int direction;
 	KMALLOC(nat, nat_t *);
 	if (nat == NULL) {
 		nat_stats.ns_memfail++;
+		/*
+		 * Try to automatically tune the max # of entries in the
+		 * table allowed to be less than what will cause kmem_alloc()
+		 * to fail and try to eliminate panics due to out of memory
+		 * conditions arising.
+		 */
+		if (ipf_nattable_max > ipf_nattable_sz) {
+			ipf_nattable_max = nat_stats.ns_inuse - 100;
+			printf("ipf_nattable_max reduced to %d\n",
+				ipf_nattable_max);
+		}
 		return NULL;
 	}
 
@@ -1430,7 +1452,7 @@ int direction;
 	CALC_SUMD(sum1, sum2, sumd);
 	nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16);
 #if SOLARIS && defined(_KERNEL) && (SOLARIS2 >= 6)
-	if ((flags & IPN_TCPUDP) && dohwcksum &&
+	if ((flags & IPN_TCP) && dohwcksum &&
 	    (qf->qf_ill->ill_ick.ick_magic == ICK_M_CTL_MAGIC)) {
 		if (direction == NAT_OUTBOUND)
 			sum1 = LONG_SUM(ntohl(in.s_addr));
@@ -1682,6 +1704,7 @@ int dir;
 		return NULL;
 
 	flags = 0;
+	sumd2 = 0;
 	*nflags = IPN_ICMPERR;
 	icmp = (icmphdr_t *)fin->fin_dp;
 	oip = (ip_t *)&icmp->icmp_ip;
@@ -1735,137 +1758,75 @@ int dir;
 
 	CALC_SUMD(sum1, sum2, sumd);
 
-	if (nat->nat_dir == NAT_OUTBOUND) {
-		/*
-		 * Fix IP checksum of the offending IP packet to adjust for
-		 * the change in the IP address.
-		 *
-		 * Normally, you would expect that the ICMP checksum of the 
-		 * ICMP error message needs to be adjusted as well for the
-		 * IP address change in oip.
-		 * However, this is a NOP, because the ICMP checksum is 
-		 * calculated over the complete ICMP packet, which includes the
-		 * changed oip IP addresses and oip->ip_sum. However, these 
-		 * two changes cancel each other out (if the delta for
-		 * the IP address is x, then the delta for ip_sum is minus x), 
-		 * so no change in the icmp_cksum is necessary.
-		 *
-		 * Be careful that nat_dir refers to the direction of the
-		 * offending IP packet (oip), not to its ICMP response (icmp)
-		 */
-		fix_datacksum(&oip->ip_sum, sumd);
+	/*
+	 * Fix IP checksum of the offending IP packet to adjust for
+	 * the change in the IP address.
+	 *
+	 * Normally, you would expect that the ICMP checksum of the 
+	 * ICMP error message needs to be adjusted as well for the
+	 * IP address change in oip.
+	 * However, this is a NOP, because the ICMP checksum is 
+	 * calculated over the complete ICMP packet, which includes the
+	 * changed oip IP addresses and oip->ip_sum. However, these 
+	 * two changes cancel each other out (if the delta for
+	 * the IP address is x, then the delta for ip_sum is minus x), 
+	 * so no change in the icmp_cksum is necessary.
+	 *
+	 * Be careful that nat_dir refers to the direction of the
+	 * offending IP packet (oip), not to its ICMP response (icmp)
+	 */
+	fix_datacksum(&oip->ip_sum, sumd);
+	/* Fix icmp cksum : IP Addr + Cksum */
 
+	/*
+	 * Fix UDP pseudo header checksum to compensate for the
+	 * IP address change.
+	 */
+	if ((oip->ip_p == IPPROTO_UDP) && (dlen >= 8) && udp->uh_sum) {
 		/*
-		 * Fix UDP pseudo header checksum to compensate for the
-		 * IP address change.
+		 * The UDP checksum is optional, only adjust it 
+		 * if it has been set.
 		 */
-		if (oip->ip_p == IPPROTO_UDP && udp->uh_sum) {
-			/*
-			 * The UDP checksum is optional, only adjust it 
-			 * if it has been set.
-			 */
-			sum1 = ntohs(udp->uh_sum);
-			fix_datacksum(&udp->uh_sum, sumd);
-			sum2 = ntohs(udp->uh_sum);
-
-			/*
-			 * Fix ICMP checksum to compensate the UDP 
-			 * checksum adjustment.
-			 */
-			CALC_SUMD(sum1, sum2, sumd);
-			sumd2 = sumd;
-		}
+		sum1 = ntohs(udp->uh_sum);
+		fix_datacksum(&udp->uh_sum, sumd);
+		sum2 = ntohs(udp->uh_sum);
 
 		/*
-		 * Fix TCP pseudo header checksum to compensate for the 
-		 * IP address change. Before we can do the change, we
-		 * must make sure that oip is sufficient large to hold
-		 * the TCP checksum (normally it does not!).
+		 * Fix ICMP checksum to compensate the UDP 
+		 * checksum adjustment.
 		 */
-		if (oip->ip_p == IPPROTO_TCP && dlen >= 18) {
-		
-			sum1 = ntohs(tcp->th_sum);
-			fix_datacksum(&tcp->th_sum, sumd);
-			sum2 = ntohs(tcp->th_sum);
-
-			/*
-			 * Fix ICMP checksum to compensate the TCP 
-			 * checksum adjustment.
-			 */
-			CALC_SUMD(sum1, sum2, sumd);
-			sumd2 = sumd;
-		}
-	} else {
+		sumd2 = sumd << 1;
+		CALC_SUMD(sum1, sum2, sumd);
+		sumd2 += sumd;
+	}
 
-		/*
-		 * Fix IP checksum of the offending IP packet to adjust for
-		 * the change in the IP address.
-		 *
-		 * Normally, you would expect that the ICMP checksum of the 
-		 * ICMP error message needs to be adjusted as well for the
-		 * IP address change in oip.
-		 * However, this is a NOP, because the ICMP checksum is 
-		 * calculated over the complete ICMP packet, which includes the
-		 * changed oip IP addresses and oip->ip_sum. However, these 
-		 * two changes cancel each other out (if the delta for
-		 * the IP address is x, then the delta for ip_sum is minus x), 
-		 * so no change in the icmp_cksum is necessary.
-		 *
-		 * Be careful that nat_dir refers to the direction of the
-		 * offending IP packet (oip), not to its ICMP response (icmp)
-		 */
-		fix_datacksum(&oip->ip_sum, sumd);
+	/*
+	 * Fix TCP pseudo header checksum to compensate for the 
+	 * IP address change. Before we can do the change, we
+	 * must make sure that oip is sufficient large to hold
+	 * the TCP checksum (normally it does not!).
+	 */
+	else if ((oip->ip_p == IPPROTO_TCP) && (dlen >= 18)) {
+		sum1 = ntohs(tcp->th_sum);
+		fix_datacksum(&tcp->th_sum, sumd);
+		sum2 = ntohs(tcp->th_sum);
 
-/* XXX FV : without having looked at Solaris source code, it seems unlikely
- * that SOLARIS would compensate this in the kernel (a body of an IP packet 
- * in the data section of an ICMP packet). I have the feeling that this should
- * be unconditional, but I'm not in a position to check.
- */
-#if !SOLARIS && !defined(__sgi)
 		/*
-		 * Fix UDP pseudo header checksum to compensate for the
-		 * IP address change.
+		 * Fix ICMP checksum to compensate the TCP 
+		 * checksum adjustment.
 		 */
-		if (oip->ip_p == IPPROTO_UDP && udp->uh_sum) {
-			/*
-			 * The UDP checksum is optional, only adjust it 
-			 * if it has been set 
-			 */
-			sum1 = ntohs(udp->uh_sum);
-			fix_datacksum(&udp->uh_sum, sumd);
-			sum2 = ntohs(udp->uh_sum);
-
-			/*
-			 * Fix ICMP checksum to compensate the UDP 
-			 * checksum adjustment.
-			 */
-			CALC_SUMD(sum1, sum2, sumd);
-			sumd2 = sumd;
-		}
-		
-		/* 
-		 * Fix TCP pseudo header checksum to compensate for the 
-		 * IP address change. Before we can do the change, we
-		 * must make sure that oip is sufficient large to hold
-		 * the TCP checksum (normally it does not!).
-		 */
-		if (oip->ip_p == IPPROTO_TCP && dlen >= 18) {
-		
-			sum1 = ntohs(tcp->th_sum);
-			fix_datacksum(&tcp->th_sum, sumd);
-			sum2 = ntohs(tcp->th_sum);
-
-			/*
-			 * Fix ICMP checksum to compensate the TCP
-			 * checksum adjustment.
-			 */
-			CALC_SUMD(sum1, sum2, sumd);
-			sumd2 = sumd;
-		}
-#endif
+		sumd2 = sumd << 1;
+		CALC_SUMD(sum1, sum2, sumd);
+		sumd2 += sumd;
+	} else {
+		sumd2 = (sumd >> 16); 
+		if (nat->nat_dir == NAT_OUTBOUND)
+			sumd2 = ~sumd2;
+		else
+			sumd2 = ~sumd2 + 1;
 	}
 
-	if ((flags & IPN_TCPUDP) != 0) {
+	if (((flags & IPN_TCPUDP) != 0) && (dlen >= 4)) {
 		/*
 		 * Step 2 :
 		 * For offending TCP/UDP IP packets, translate the ports as
@@ -1885,17 +1846,14 @@ int dir;
 		 * include the TCP checksum. So we have to check if the
 		 * ip->ip_len actually holds the TCP checksum of the oip!
 		 */
-
 		if (nat->nat_oport == tcp->th_dport) {
 			if (tcp->th_sport != nat->nat_inport) {
 				/*
 				 * Fix ICMP checksum to compensate port
 				 * adjustment.
 				 */
-				sum1 = ntohs(tcp->th_sport);
-				sum2 = ntohs(nat->nat_inport);
-				CALC_SUMD(sum1, sum2, sumd);
-				sumd2 += sumd;
+				sum1 = ntohs(nat->nat_inport);
+				sum2 = ntohs(tcp->th_sport);
 				tcp->th_sport = nat->nat_inport;
 
 				/*
@@ -1907,16 +1865,18 @@ int dir;
 				 * The UDP checksum is optional, only adjust
 				 * it if it has been set.
 				 */
-				if (oip->ip_p == IPPROTO_UDP && udp->uh_sum) {
+				if ((oip->ip_p == IPPROTO_UDP) &&
+				    (dlen >= 8) && udp->uh_sum) {
+					sumd = sum1 - sum2;
+					sumd2 += sumd;
 
 					sum1 = ntohs(udp->uh_sum);
 					fix_datacksum(&udp->uh_sum, sumd);
 					sum2 = ntohs(udp->uh_sum);
 
 					/*
-					 * Fix ICMP checksum to 
-					 * compensate UDP checksum 
-					 * adjustment.
+					 * Fix ICMP checksum to compensate
+					 * UDP checksum adjustment.
 					 */
 					CALC_SUMD(sum1, sum2, sumd);
 					sumd2 += sumd;
@@ -1928,63 +1888,73 @@ int dir;
 				 * packet flows the other direction compared to
 				 * the ICMP message.
 				 */
-				if (oip->ip_p == IPPROTO_TCP && dlen >= 18) {
-
-					sum1 = ntohs(tcp->th_sum);
-					fix_datacksum(&tcp->th_sum, sumd);
-					sum2 = ntohs(tcp->th_sum);
-
-					/*
-					 * Fix ICMP checksum to 
-					 * compensate TCP checksum 
-					 * adjustment.
-					 */
-					CALC_SUMD(sum1, sum2, sumd);
-					sumd2 += sumd;
+				if (oip->ip_p == IPPROTO_TCP) {
+					if (dlen >= 18) {
+						sumd = sum1 - sum2;
+						sumd2 += sumd;
+
+						sum1 = ntohs(tcp->th_sum);
+						fix_datacksum(&tcp->th_sum,
+							      sumd);
+						sum2 = ntohs(tcp->th_sum);
+
+						/*
+						 * Fix ICMP checksum to 
+						 * compensate TCP checksum 
+						 * adjustment.
+						 */
+						CALC_SUMD(sum1, sum2, sumd);
+						sumd2 += sumd;
+					} else {
+						sumd = sum2 - sum1 + 1;
+						sumd2 += sumd;
+					}
 				}
 			}
-		} else {
-			if (tcp->th_dport != nat->nat_outport) {
-				/*
-				 * Fix ICMP checksum to compensate port
-				 * adjustment.
-				 */
-				sum1 = ntohs(tcp->th_dport);
-				sum2 = ntohs(nat->nat_outport);
-				CALC_SUMD(sum1, sum2, sumd);
+		} else if (tcp->th_dport != nat->nat_outport) {
+			/*
+			 * Fix ICMP checksum to compensate port
+			 * adjustment.
+			 */
+			sum1 = ntohs(nat->nat_outport);
+			sum2 = ntohs(tcp->th_dport);
+			tcp->th_dport = nat->nat_outport;
+
+			/*
+			 * Fix udp checksum to compensate port
+			 * adjustment.   NOTE : the offending IP
+			 * packet flows the other direction compared
+			 * to the ICMP message.
+			 *
+			 * The UDP checksum is optional, only adjust
+			 * it if it has been set.
+			 */
+			if ((oip->ip_p == IPPROTO_UDP) &&
+			    (dlen >= 8) && udp->uh_sum) {
+				sumd = sum1 - sum2;
 				sumd2 += sumd;
-				tcp->th_dport = nat->nat_outport;
+
+				sum1 = ntohs(udp->uh_sum);
+				fix_datacksum(&udp->uh_sum, sumd);
+				sum2 = ntohs(udp->uh_sum);
 
 				/*
-				 * Fix udp checksum to compensate port
-				 * adjustment.   NOTE : the offending IP
-				 * packet flows the other direction compared
-				 * to the ICMP message.
-				 *
-				 * The UDP checksum is optional, only adjust
-				 * it if it has been set.
+				 * Fix ICMP checksum to compensate
+				 * UDP checksum adjustment.
 				 */
-				if (oip->ip_p == IPPROTO_UDP && udp->uh_sum) {
-
-					sum1 = ntohs(udp->uh_sum);
-					fix_datacksum(&udp->uh_sum, sumd);
-					sum2 = ntohs(udp->uh_sum);
+				CALC_SUMD(sum1, sum2, sumd);
+			}
 
-					/*
-					 * Fix ICMP checksum to compensate
-					 * UDP checksum adjustment.
-					 */
-					CALC_SUMD(sum1, sum2, sumd);
+			/*
+			 * Fix tcp checksum (if present) to compensate
+			 * port adjustment. NOTE : the offending IP
+			 * packet flows the other direction compared to
+			 * the ICMP message.
+			 */
+			if (oip->ip_p == IPPROTO_TCP) {
+				if (dlen >= 18) {
+					sumd = sum1 - sum2;
 					sumd2 += sumd;
-				}
-
-				/*
-				 * Fix tcp checksum (if present) to compensate
-				 * port adjustment. NOTE : the offending IP
-				 * packet flows the other direction compared to
-				 * the ICMP message.
-				 */
-				if (oip->ip_p == IPPROTO_TCP && dlen >= 18) {
 
 					sum1 = ntohs(tcp->th_sum);
 					fix_datacksum(&tcp->th_sum, sumd);
@@ -1995,18 +1965,18 @@ int dir;
 					 * UDP checksum adjustment.
 					 */
 					CALC_SUMD(sum1, sum2, sumd);
-					sumd2 += sumd;
+				} else {
+					sumd = sum2 - sum1;
+					if (nat->nat_dir == NAT_OUTBOUND)
+						sumd++;
 				}
 			}
+			sumd2 += sumd;
 		}
 		if (sumd2) {
 			sumd2 = (sumd2 & 0xffff) + (sumd2 >> 16);
 			sumd2 = (sumd2 & 0xffff) + (sumd2 >> 16);
-			if (nat->nat_dir == NAT_OUTBOUND) {
-				fix_outcksum(fin, &icmp->icmp_cksum, sumd2);
-			} else {
-				fix_incksum(fin, &icmp->icmp_cksum, sumd2);
-			}
+			fix_incksum(fin, &icmp->icmp_cksum, sumd2);
 		}
 	}
 	if (oip->ip_p == IPPROTO_ICMP)
@@ -2476,13 +2446,9 @@ maskloop:
 			s1 = LONG_SUM(ntohl(fin->fin_saddr));
 			s2 = LONG_SUM(ntohl(nat->nat_outip.s_addr));
 			CALC_SUMD(s1, s2, sumd);
-
-			if (nat->nat_dir == NAT_OUTBOUND)
-				fix_outcksum(fin, &ip->ip_sum, sumd);
-			else
-				fix_incksum(fin, &ip->ip_sum, sumd);
+			fix_outcksum(fin, &ip->ip_sum, sumd);
 		}
-#if (SOLARIS || defined(__sgi)) && defined(_KERNEL)
+#if (SOLARIS || defined(__sgi)) || !defined(_KERNEL)
 		else {
 			if (nat->nat_dir == NAT_OUTBOUND)
 				fix_outcksum(fin, &ip->ip_sum, nat->nat_ipsumd);
@@ -2510,7 +2476,8 @@ maskloop:
 				if (nat->nat_age < fr_defnaticmpage)
 					nat->nat_age = fr_defnaticmpage;
 #ifdef LARGE_NAT
-				else if (nat->nat_age > fr_defnatage)
+				else if ((!np || !np->in_age[1]) &&
+				         (nat->nat_age > fr_defnatage))
 					nat->nat_age = fr_defnatage;
 #endif
 				/*
@@ -2703,19 +2670,19 @@ maskloop:
 		nat->nat_bytes += ip->ip_len;
 		nat->nat_pkts++;
 		MUTEX_EXIT(&nat->nat_lock);
-		ip->ip_dst = nat->nat_inip;
-		fin->fin_fi.fi_daddr = nat->nat_inip.s_addr;
 
 		/*
 		 * Fix up checksums, not by recalculating them, but
 		 * simply computing adjustments.
 		 */
-#if (SOLARIS || defined(__sgi)) && defined(_KERNEL)
 		if (nat->nat_dir == NAT_OUTBOUND)
 			fix_incksum(fin, &ip->ip_sum, nat->nat_ipsumd);
 		else
 			fix_outcksum(fin, &ip->ip_sum, nat->nat_ipsumd);
-#endif
+
+		ip->ip_dst = nat->nat_inip;
+		fin->fin_fi.fi_daddr = nat->nat_inip.s_addr;
+
 		if ((fin->fin_off == 0) && !(fin->fin_fl & FI_SHORT)) {
 
 			if ((nat->nat_inport != 0) && (tcp != NULL)) {
@@ -2731,7 +2698,8 @@ maskloop:
 				if (nat->nat_age < fr_defnaticmpage)
 					nat->nat_age = fr_defnaticmpage;
 #ifdef LARGE_NAT
-				else if (nat->nat_age > fr_defnatage)
+				else if ((!np || !np->in_age[0]) &&
+					 (nat->nat_age > fr_defnatage))
 					nat->nat_age = fr_defnatage;
 #endif
 				/*
@@ -2983,7 +2951,7 @@ u_short *csump;
 			if (&cp[1] >= ep)
 				break;
 			advance = cp[1];
-			if (&cp[advance] >= ep)
+			if (&cp[advance] > ep)
 				break;
 			switch (opt) {
 			case TCPOPT_MAXSEG:
diff --git a/contrib/ipfilter/ip_nat.h b/contrib/ipfilter/ip_nat.h
index e052449..14e9d25 100644
--- a/contrib/ipfilter/ip_nat.h
+++ b/contrib/ipfilter/ip_nat.h
@@ -4,7 +4,7 @@
  * See the IPFILTER.LICENCE file for details on licencing.
  *
  * @(#)ip_nat.h	1.5 2/4/96
- * $Id: ip_nat.h,v 2.17.2.28 2002/11/03 13:06:21 darrenr Exp $
+ * $Id: ip_nat.h,v 2.17.2.32 2004/02/11 15:16:37 darrenr Exp $
  */
 
 #ifndef	__IP_NAT_H__
@@ -34,26 +34,39 @@
 			 * a setup with 1000-2000 networks to NAT.
 			 */
 #ifndef	NAT_SIZE
-# define	NAT_SIZE	127
+# ifdef	LARGE_NAT
+#  define	NAT_SIZE	2047
+# else
+#  define	NAT_SIZE	127
+# endif
 #endif
 #ifndef	RDR_SIZE
-# define	RDR_SIZE	127
+# ifdef	LARGE_NAT
+#  define	RDR_SIZE	2047
+# else
+#  define	RDR_SIZE	127
+# endif
 #endif
 #ifndef	HOSTMAP_SIZE
-# define	HOSTMAP_SIZE	127
+# ifdef	LARGE_NAT
+#  define	HOSTMAP_SIZE	8191
+# else
+#  define	HOSTMAP_SIZE	2047
+# endif
 #endif
-#ifndef	NAT_TABLE_SZ
-# define	NAT_TABLE_SZ	127
+#ifndef NAT_TABLE_MAX
+# ifdef	LARGE_NAT
+#  define	NAT_TABLE_MAX	180000
+# else
+#  define	NAT_TABLE_MAX	30000
+# endif
 #endif
-#ifdef	LARGE_NAT
-#undef	NAT_SIZE
-#undef	RDR_SIZE
-#undef	NAT_TABLE_SZ
-#undef	HOSTMAP_SIZE	127
-#define	NAT_SIZE	2047
-#define	RDR_SIZE	2047
-#define	NAT_TABLE_SZ	16383
-#define	HOSTMAP_SIZE	8191
+#ifndef	NAT_TABLE_SZ
+# ifdef	LARGE_NAT
+#  define	NAT_TABLE_SZ	16383
+# else
+#  define	NAT_TABLE_SZ	2047
+# endif
 #endif
 #ifndef	APR_LABELLEN
 #define	APR_LABELLEN	16
diff --git a/contrib/ipfilter/ip_raudio_pxy.c b/contrib/ipfilter/ip_raudio_pxy.c
index ddd5ea3..12d3981 100644
--- a/contrib/ipfilter/ip_raudio_pxy.c
+++ b/contrib/ipfilter/ip_raudio_pxy.c
@@ -1,5 +1,5 @@
 /*
- * $Id: ip_raudio_pxy.c,v 1.7.2.8 2002/01/13 04:58:29 darrenr Exp $
+ * $Id: ip_raudio_pxy.c,v 1.7.2.9 2003/04/26 05:59:39 darrenr Exp $
  */
 #if SOLARIS && defined(_KERNEL)
 extern	kmutex_t	ipf_rw;
@@ -66,9 +66,6 @@ nat_t *nat;
 	tcphdr_t *tcp;
 	int len = 0;
 	mb_t *m;
-#if	SOLARIS
-	mb_t *m1;
-#endif
 
 	/*
 	 * If we've already processed the start messages, then nothing left
@@ -181,9 +178,6 @@ nat_t *nat;
 	nat_t *ipn;
 	u_char swp;
 	mb_t *m;
-#if	SOLARIS
-	mb_t *m1;
-#endif
 
 	/*
 	 * Wait until we've seen the end of the start messages and even then
diff --git a/contrib/ipfilter/ip_rcmd_pxy.c b/contrib/ipfilter/ip_rcmd_pxy.c
index 3fecf49..93cd32b 100644
--- a/contrib/ipfilter/ip_rcmd_pxy.c
+++ b/contrib/ipfilter/ip_rcmd_pxy.c
@@ -1,5 +1,5 @@
 /*
- * $Id: ip_rcmd_pxy.c,v 1.4.2.6 2002/10/01 15:24:59 darrenr Exp $
+ * $Id: ip_rcmd_pxy.c,v 1.4.2.7 2003/04/26 05:59:39 darrenr Exp $
  */
 /*
  * Simple RCMD transparent proxy for in-kernel use.  For use with the NAT
@@ -88,9 +88,6 @@ nat_t *nat;
 	u_short sp;
 	nat_t *ipn;
 	mb_t *m;
-#if	SOLARIS
-	mb_t *m1;
-#endif
 
 	tcp = (tcphdr_t *)fin->fin_dp;
 
diff --git a/contrib/ipfilter/ip_sfil.c b/contrib/ipfilter/ip_sfil.c
index 0cb2181..9e995d9 100644
--- a/contrib/ipfilter/ip_sfil.c
+++ b/contrib/ipfilter/ip_sfil.c
@@ -7,7 +7,7 @@
  */
 #if !defined(lint)
 static const char sccsid[] = "%W% %G% (C) 1993-2000 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ip_sfil.c,v 2.23.2.24 2002/12/06 11:42:22 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: ip_sfil.c,v 2.23.2.27 2003/06/12 16:03:14 darrenr Exp $";
 #endif
 
 #include <sys/types.h>
@@ -623,8 +623,8 @@ caddr_t data;
 			while ((f = *ftail))
 				ftail = &f->fr_next;
 		else {
+			ftail = fprev;
 			if (fp->fr_hits) {
-				ftail = fprev;
 				while (--fp->fr_hits && (f = *ftail))
 					ftail = &f->fr_next;
 			}
@@ -785,15 +785,14 @@ fr_info_t *fin;
 	tcp2->th_sport = tcp->th_dport;
 	if (tcp->th_flags & TH_ACK) {
 		tcp2->th_seq = tcp->th_ack;
-		tcp2->th_flags = TH_RST|TH_ACK;
+		tcp2->th_flags = TH_RST;
 	} else {
 		tcp2->th_ack = ntohl(tcp->th_seq);
 		tcp2->th_ack += tlen;
 		tcp2->th_ack = htonl(tcp2->th_ack);
-		tcp2->th_flags = TH_RST;
+		tcp2->th_flags = TH_RST|TH_ACK;
 	}
 	tcp2->th_off = sizeof(struct tcphdr) >> 2;
-	tcp2->th_flags = TH_RST|TH_ACK;
 
 	/*
 	 * This is to get around a bug in the Solaris 2.4/2.5 TCP checksum
diff --git a/contrib/ipfilter/ip_state.c b/contrib/ipfilter/ip_state.c
index 5ab78cc..4934279 100644
--- a/contrib/ipfilter/ip_state.c
+++ b/contrib/ipfilter/ip_state.c
@@ -93,7 +93,7 @@
 
 #if !defined(lint)
 static const char sccsid[] = "@(#)ip_state.c	1.8 6/5/96 (C) 1993-2000 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ip_state.c,v 2.30.2.77 2002/12/06 11:40:24 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: ip_state.c,v 2.30.2.88 2004/01/05 12:46:05 darrenr Exp $";
 #endif
 
 #ifndef	MIN
@@ -921,7 +921,8 @@ tcphdr_t *tcp;
 		fdata->td_wscale = wscale;
 	else if (wscale == -2)
 		fdata->td_wscale = tdata->td_wscale = 0;
-	win <<= fdata->td_wscale;
+	if (!(tcp->th_flags & TH_SYN))
+		win <<= fdata->td_wscale;
 
 	if ((fdata->td_end == 0) &&
 	    (!is->is_fsm || ((tcp->th_flags & TH_OPENING) == TH_OPENING))) {
@@ -955,14 +956,15 @@ tcphdr_t *tcp;
 	    (SEQ_GE(seq, fdata->td_end - maxwin)) &&
 /* XXX what about big packets */
 #define MAXACKWINDOW 66000
-	    (ackskew >= -MAXACKWINDOW) &&
-	    (ackskew <= MAXACKWINDOW)) {
-		/* if ackskew < 0 then this should be due to fragented
+	    (-ackskew <= (MAXACKWINDOW << tdata->td_wscale)) &&
+	    ( ackskew <= (MAXACKWINDOW << tdata->td_wscale))) {
+
+		/* if ackskew < 0 then this should be due to fragmented
 		 * packets. There is no way to know the length of the
 		 * total packet in advance.
 		 * We do know the total length from the fragment cache though.
 		 * Note however that there might be more sessions with
-		 * exactly the same source and destination paramters in the
+		 * exactly the same source and destination parameters in the
 		 * state cache (and source and destination is the only stuff
 		 * that is saved in the fragment cache). Note further that
 		 * some TCP connections in the state cache are hashed with
@@ -1208,6 +1210,10 @@ fr_info_t *fin;
 
 	oip = (ip_t *)((char *)ic + ICMPERR_ICMPHLEN);
 	ohlen = oip->ip_hl << 2;
+	/*
+	 * Check if the at least the old IP header (with options) and
+	 * 8 bytes of payload is present.
+	 */
 	if (fin->fin_plen < ICMPERR_MAXPKTLEN + ohlen - sizeof(*oip))
 		return NULL;
 
@@ -1224,7 +1230,7 @@ fr_info_t *fin;
 	 * may be too big to be in this buffer but not so big that it's
 	 * outside the ICMP packet, leading to TCP deref's causing problems.
 	 * This is possible because we don't know how big oip_hl is when we
-	 * do the pullup early in fr_check() and thus can't gaurantee it is
+	 * do the pullup early in fr_check() and thus can't guarantee it is
 	 * all here now.
 	 */
 #ifdef  _KERNEL
@@ -1251,9 +1257,43 @@ fr_info_t *fin;
 	bzero((char *)&src, sizeof(src));
 	bzero((char *)&dst, sizeof(dst));
 	bzero((char *)&ofin, sizeof(ofin));
+	/*
+	 * We make an fin entry to be able to feed it to
+	 * matchsrcdst.  Note that not all fields are encessary
+	 * but this is the cleanest way. Note further that we
+	 * fill in fin_mp such that if someone uses it we'll get
+	 * a kernel panic. fr_matchsrcdst does not use this.
+	 */
 	ofin.fin_ifp = fin->fin_ifp;
 	ofin.fin_out = !fin->fin_out;
+	ofin.fin_mp = NULL;
 	ofin.fin_v = 4;
+	/*
+	 * watch out here, as ip is in host order and oip in network
+	 * order. Any change we make must be undone afterwards, like
+	 * oip->ip_off - it is still in network byte order so fix it.
+	 */
+	savelen = oip->ip_len;
+	oip->ip_len = len;
+	oip->ip_off = ntohs(oip->ip_off);
+	(void) fr_makefrip(ohlen, oip, &ofin);
+	/*
+	 * Reset the short flag here because in fr_matchsrcdst() the flags
+	 * for the current packet (fin_fl) are compared against * those for
+	 * the existing session.
+	 */
+	ofin.fin_fl &= ~FI_SHORT;
+
+	/*
+	 * Put old values of ip_len and ip_off back as we don't know
+	 * if we have to forward the packet (or process it again.
+	 */
+	oip->ip_len = savelen;
+	oip->ip_off = htons(oip->ip_off);
+
+#if SOLARIS
+	ofin.fin_qfm = NULL;
+#endif
 	fr = NULL;
 
 	switch (oip->ip_p)
@@ -1262,7 +1302,7 @@ fr_info_t *fin;
 		icmp = (icmphdr_t *)((char *)oip + ohlen);
 
 		/*
-		 * a ICMP error can only be generated as a result of an
+		 * an ICMP error can only be generated as a result of an
 		 * ICMP query, not as the response on an ICMP error
 		 *
 		 * XXX theoretically ICMP_ECHOREP and the other reply's are
@@ -1286,18 +1326,15 @@ fr_info_t *fin;
 		hv += icmp->icmp_seq;
 		hv %= fr_statesize;
 
-		savelen = oip->ip_len;
-		oip->ip_len = len;
-		fr_makefrip(ohlen, oip, &ofin);
-		oip->ip_len = savelen;
-
 		READ_ENTER(&ipf_state);
 		for (isp = &ips_table[hv]; (is = *isp); isp = &is->is_hnext)
 			if ((is->is_p == pr) && (is->is_v == 4) &&
+			    (is->is_icmppkts < is->is_pkts) &&
 			    fr_matchsrcdst(is, src, dst, &ofin, NULL) &&
-			    fr_matchicmpqueryreply(is->is_v, is, icmp, fin->fin_rev)) {
+			    fr_matchicmpqueryreply(is->is_v, is, icmp,
+						   fin->fin_rev)) {
 				ips_stats.iss_hits++;
-				is->is_pkts++;
+				is->is_icmppkts++;
 				is->is_bytes += ip->ip_len;
 				fr = is->is_rule;
 				break;
@@ -1326,20 +1363,7 @@ fr_info_t *fin;
 	hv += dport;
 	hv += sport;
 	hv %= fr_statesize;
-	/*
-	 * we make an fin entry to be able to feed it to
-	 * matchsrcdst note that not all fields are encessary
-	 * but this is the cleanest way. Note further we fill
-	 * in fin_mp such that if someone uses it we'll get
-	 * a kernel panic. fr_matchsrcdst does not use this.
-	 *
-	 * watch out here, as ip is in host order and oip in network
-	 * order. Any change we make must be undone afterwards.
-	 */
-	savelen = oip->ip_len;
-	oip->ip_len = len;
-	fr_makefrip(ohlen, oip, &ofin);
-	oip->ip_len = savelen;
+
 	READ_ENTER(&ipf_state);
 	for (isp = &ips_table[hv]; (is = *isp); isp = &is->is_hnext) {
 		/*
@@ -1347,13 +1371,16 @@ fr_info_t *fin;
 		 * encapsulated packet was allowed through the
 		 * other way around. Note that the minimal amount
 		 * of info present does not allow for checking against
-		 * tcp internals such as seq and ack numbers.
+		 * tcp internals such as seq and ack numbers.  Only the
+		 * ports are known to be present and can be even if the
+		 * short flag is set.
 		 */
 		if ((is->is_p == pr) && (is->is_v == 4) &&
+		    (is->is_icmppkts < is->is_pkts) &&
 		    fr_matchsrcdst(is, src, dst, &ofin, tcp)) {
 			fr = is->is_rule;
 			ips_stats.iss_hits++;
-			is->is_pkts++;
+			is->is_icmppkts++;
 			is->is_bytes += fin->fin_plen;
 			/*
 			 * we deliberately do not touch the timeouts
@@ -1675,8 +1702,8 @@ void *ifp;
 	for (is = ips_list; is; is = is->is_next) {
 		for (i = 0; i < 4; i++) {
 			if (is->is_ifp[i] == ifp) {
-				is->is_ifpin = GETUNIT(is->is_ifname[i],
-						       is->is_v);
+				is->is_ifp[i] = GETUNIT(is->is_ifname[i],
+							is->is_v);
 				if (!is->is_ifp[i])
 					is->is_ifp[i] = (void *)-1;
 			}
@@ -1843,17 +1870,41 @@ int dir, fsm;
 			state[dir] = TCPS_SYN_SENT;
 			newage = fr_tcptimeout;
 		}
+		
+		/* 
+		 * It is apparently possible that a hosts sends two syncs
+		 * before the remote party is able to respond with a SA. In
+		 * such a case the remote server sometimes ACK's the second
+		 * sync, and then responds with a SA. The following code
+		 * is used to prevent this ack from being blocked.
+		 *
+		 * We do not reset the timeout here to fr_tcptimeout because
+		 * a connection connect timeout does not renew after every
+		 * packet that is sent.  We need to set newage to something
+		 * to indicate the packet has passed the check for its flags
+		 * being valid in the TCP FSM.
+		 */
+		else if ((ostate == TCPS_SYN_SENT) &&
+		         ((flags & (TH_FIN|TH_SYN|TH_RST|TH_ACK)) == TH_ACK)) {
+			newage = *age;
+		}
+
 		/*
 		 * The next piece of code makes it possible to get
 		 * already established connections into the state table
 		 * after a restart or reload of the filter rules; this
 		 * does not work when a strict 'flags S keep state' is
-		 * used for tcp connections of course
+		 * used for tcp connections of course, however, use a
+		 * lower time-out so the state disappears quickly if
+		 * the other side does not pick it up.
 		 */
-		if (!fsm && (flags & (TH_FIN|TH_SYN|TH_RST|TH_ACK)) == TH_ACK) {
+		else if (!fsm &&
+			 (flags & (TH_FIN|TH_SYN|TH_RST|TH_ACK)) == TH_ACK) {
 			/* we saw an A, guess 'dir' is in ESTABLISHED mode */
-			if (state[1 - dir] == TCPS_CLOSED ||
-			    state[1 - dir] == TCPS_ESTABLISHED) {
+			if (ostate == TCPS_CLOSED) {
+				state[dir] = TCPS_ESTABLISHED;
+				newage = fr_tcptimeout;
+			} else if (ostate == TCPS_ESTABLISHED) {
 				state[dir] = TCPS_ESTABLISHED;
 				newage = fr_tcpidletimeout;
 			}
@@ -2056,7 +2107,7 @@ u_int type;
 	int types[1];
 
 	ipsl.isl_type = type;
-	ipsl.isl_pkts = is->is_pkts;
+	ipsl.isl_pkts = is->is_pkts + is->is_icmppkts;
 	ipsl.isl_bytes = is->is_bytes;
 	ipsl.isl_src = is->is_src;
 	ipsl.isl_dst = is->is_dst;
@@ -2084,7 +2135,11 @@ u_int type;
 	sizes[0] = sizeof(ipsl);
 	types[0] = 0;
 
-	(void) ipllog(IPL_LOGSTATE, NULL, items, sizes, types, 1);
+	if (ipllog(IPL_LOGSTATE, NULL, items, sizes, types, 1)) {
+		ATOMIC_INCL(ips_stats.iss_logged);
+	} else {
+		ATOMIC_INCL(ips_stats.iss_logfail);
+	}
 }
 #endif
 
@@ -2134,12 +2189,30 @@ fr_info_t *fin;
 	bzero((char *)&ofin, sizeof(ofin));
 	ofin.fin_out = !fin->fin_out;
 	ofin.fin_ifp = fin->fin_ifp;
+	ofin.fin_mp = NULL;
 	ofin.fin_v = 6;
+#if SOLARIS
+	ofin.fin_qfm = NULL;
+#endif
+	/*
+	 * We make a fin entry to be able to feed it to
+	 * matchsrcdst. Note that not all fields are necessary
+	 * but this is the cleanest way. Note further we fill
+	 * in fin_mp such that if someone uses it we'll get
+	 * a kernel panic. fr_matchsrcdst does not use this.
+	 *
+	 * watch out here, as ip is in host order and oip in network
+	 * order. Any change we make must be undone afterwards.
+	 */
+	savelen = oip->ip6_plen;
+	oip->ip6_plen = ip->ip6_plen - sizeof(*ip) - ICMPERR_ICMPHLEN;
+	fr_makefrip(sizeof(*oip), (ip_t *)oip, &ofin);
+	oip->ip6_plen = savelen;
 
 	if (oip->ip6_nxt == IPPROTO_ICMPV6) {
 		oic = (struct icmp6_hdr *)(oip + 1);
 		/*
-		 * a ICMP error can only be generated as a result of an
+		 * an ICMP error can only be generated as a result of an
 		 * ICMP query, not as the response on an ICMP error
 		 *
 		 * XXX theoretically ICMP_ECHOREP and the other reply's are
@@ -2160,10 +2233,6 @@ fr_info_t *fin;
 		hv += oic->icmp6_seq;
 		hv %= fr_statesize;
 
-		oip->ip6_plen = ntohs(oip->ip6_plen);
-		fr_makefrip(sizeof(*oip), (ip_t *)oip, &ofin);
-		oip->ip6_plen = htons(oip->ip6_plen);
-
 		READ_ENTER(&ipf_state);
 		for (isp = &ips_table[hv]; (is = *isp); isp = &is->is_hnext)
 			if ((is->is_p == pr) &&
@@ -2207,20 +2276,7 @@ fr_info_t *fin;
 	hv += dport;
 	hv += sport;
 	hv %= fr_statesize;
-	/*
-	 * we make an fin entry to be able to feed it to
-	 * matchsrcdst note that not all fields are encessary
-	 * but this is the cleanest way. Note further we fill
-	 * in fin_mp such that if someone uses it we'll get
-	 * a kernel panic. fr_matchsrcdst does not use this.
-	 *
-	 * watch out here, as ip is in host order and oip in network
-	 * order. Any change we make must be undone afterwards.
-	 */
-	savelen = oip->ip6_plen;
-	oip->ip6_plen = ip->ip6_plen - sizeof(*ip) - ICMPERR_ICMPHLEN;
-	fr_makefrip(sizeof(*oip), (ip_t *)oip, &ofin);
-	oip->ip6_plen = savelen;
+
 	READ_ENTER(&ipf_state);
 	for (isp = &ips_table[hv]; (is = *isp); isp = &is->is_hnext) {
 		/*
diff --git a/contrib/ipfilter/ip_state.h b/contrib/ipfilter/ip_state.h
index 35368c4..d155302 100644
--- a/contrib/ipfilter/ip_state.h
+++ b/contrib/ipfilter/ip_state.h
@@ -4,7 +4,7 @@
  * See the IPFILTER.LICENCE file for details on licencing.
  *
  * @(#)ip_state.h	1.3 1/12/96 (C) 1995 Darren Reed
- * $Id: ip_state.h,v 2.13.2.13 2002/06/27 14:40:29 darrenr Exp $
+ * $Id: ip_state.h,v 2.13.2.14 2003/11/15 11:47:46 darrenr Exp $
  */
 #ifndef	__IP_STATE_H__
 #define	__IP_STATE_H__
@@ -62,6 +62,7 @@ typedef struct ipstate {
 	frentry_t	*is_rule;
 	U_QUAD_T	is_pkts;
 	U_QUAD_T	is_bytes;
+	U_QUAD_T	is_icmppkts;
 	union	i6addr	is_src;
 	union	i6addr	is_dst;
 	void	*is_ifp[4];
diff --git a/contrib/ipfilter/ipf.c b/contrib/ipfilter/ipf.c
index b6a60c7..cf85280 100644
--- a/contrib/ipfilter/ipf.c
+++ b/contrib/ipfilter/ipf.c
@@ -50,7 +50,7 @@
 
 #if !defined(lint)
 static const char sccsid[] = "@(#)ipf.c	1.23 6/5/96 (C) 1993-2000 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ipf.c,v 2.10.2.19 2002/12/06 11:41:13 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: ipf.c,v 2.10.2.23 2003/06/27 14:39:13 darrenr Exp $";
 #endif
 
 #if	SOLARIS
@@ -61,6 +61,7 @@ extern	char	*index __P((const char *, int));
 #endif
 
 extern	char	*optarg;
+extern	int	optind;
 
 void	frsync __P((void));
 void	zerostats __P((void));
@@ -72,15 +73,16 @@ int	use_inet6 = 0;
 static	int	fd = -1;
 
 static	void	procfile __P((char *, char *)), flushfilter __P((char *));
-static	void	set_state __P((u_int)), showstats __P((friostat_t *));
+static	int	set_state __P((u_int));
+static	void	showstats __P((friostat_t *));
 static	void	packetlogon __P((char *)), swapactive __P((void));
 static	int	opendevice __P((char *));
 static	void	closedevice __P((void));
 static	char	*getline __P((char *, size_t, FILE *, int *));
 static	char	*ipfname = IPL_NAME;
-static	void	usage __P((void));
+static	void	usage __P((char *));
 static	int	showversion __P((void));
-static	int	get_flags __P((void));
+static	int	get_flags __P((int *));
 
 
 #if SOLARIS
@@ -89,9 +91,10 @@ static	int	get_flags __P((void));
 # define	OPTS	"6AdDEf:F:Il:noPrsvVyzZ"
 #endif
 
-static void usage()
+static void usage(name)
+char *name;
 {
-	fprintf(stderr, "usage: ipf [-%s] %s %s %s\n", OPTS,
+	fprintf(stderr, "usage: %s [-%s] %s %s %s\n", name, OPTS,
 		"[-l block|pass|nomatch]", "[-F i|o|a|s|S]", "[-f filename]");
 	exit(1);
 }
@@ -103,6 +106,9 @@ char *argv[];
 {
 	int c;
 
+	if (argc < 2)
+		usage(argv[0]);
+
 	while ((c = getopt(argc, argv, OPTS)) != -1) {
 		switch (c)
 		{
@@ -113,10 +119,12 @@ char *argv[];
 			opts &= ~OPT_INACTIVE;
 			break;
 		case 'E' :
-			set_state((u_int)1);
+			if (set_state((u_int)1))
+				exit(1);
 			break;
 		case 'D' :
-			set_state((u_int)0);
+			if (set_state((u_int)0))
+				exit(1);
 			break;
 		case 'd' :
 			opts |= OPT_DEBUG;
@@ -168,12 +176,16 @@ char *argv[];
 		case 'Z' :
 			zerostats();
 			break;
+		case '?' :
 		default :
-			usage();
+			usage(argv[0]);
 			break;
 		}
 	}
 
+	if (optind < 2)
+		usage(argv[0]);
+
 	if (fd != -1)
 		(void) close(fd);
 
@@ -186,53 +198,82 @@ static int opendevice(ipfdev)
 char *ipfdev;
 {
 	if (opts & OPT_DONOTHING)
-		return -2;
+		return 0;
 
 	if (!ipfdev)
 		ipfdev = ipfname;
 
-	if (!(opts & OPT_DONOTHING) && fd == -1)
-		if ((fd = open(ipfdev, O_RDWR)) == -1)
-			if ((fd = open(ipfdev, O_RDONLY)) == -1) {
-				perror("open device");
-				if (errno == ENODEV)
-					fprintf(stderr, "IPFilter enabled?\n");
-			}
-	return fd;
+	/*
+	 * shouldn't we really be testing for fd < 0 here and below?
+	 */
+
+	if (fd != -1)
+		return 0;
+
+	if ((fd = open(ipfdev, O_RDWR)) == -1) {
+		if ((fd = open(ipfdev, O_RDONLY)) == -1) {
+			perror("open device");
+			if (errno == ENODEV)
+				fprintf(stderr, "IPFilter enabled?\n");
+			return -1;
+		}
+	}
+
+	return 0;
 }
 
 
 static void closedevice()
 {
-	close(fd);
+	if (fd != -1)
+		close(fd);
 	fd = -1;
 }
 
 
-static	int	get_flags()
+/*
+ * Return codes:
+ *	0	Success
+ *	!0	Failure (and an error message has already been printed)
+ */
+static	int	get_flags(i)
+int	*i;
 {
-	int i;
 
-	if ((opendevice(ipfname) != -2) && (ioctl(fd, SIOCGETFF, &i) == -1)) {
-		perror("SIOCGETFF");
+	if (opts & OPT_DONOTHING)
 		return 0;
+
+	if (opendevice(ipfname) < 0)
+		return -1;
+
+	if (ioctl(fd, SIOCGETFF, i) == -1) {
+		perror("SIOCGETFF");
+		return -1;
 	}
-	return i;
+	return 0;
 }
 
 
-static	void	set_state(enable)
+static	int	set_state(enable)
 u_int	enable;
 {
-	if (opendevice(ipfname) != -2)
-		if (ioctl(fd, SIOCFRENB, &enable) == -1) {
-			if (errno == EBUSY)
-				fprintf(stderr,
-					"IP Filter: already initialized\n");
-			else
-				perror("SIOCFRENB");
+	if (opts & OPT_DONOTHING)
+		return 0;
+
+	if (opendevice(ipfname))
+		return -1;
+
+	if (ioctl(fd, SIOCFRENB, &enable) == -1) {
+		if (errno == EBUSY)
+			/* Not really an error */
+			fprintf(stderr,
+				"IP Filter: already initialized\n");
+		else {
+			perror("SIOCFRENB");
+			return -1;
 		}
-	return;
+	}
+	return 0;
 }
 
 static	void	procfile(name, file)
@@ -243,8 +284,10 @@ char	*name, *file;
 	struct	frentry	*fr;
 	u_int	add, del;
 	int     linenum = 0;
+	int	parsestatus;
 
-	(void) opendevice(ipfname);
+	if (opendevice(ipfname) == -1)
+		exit(1);
 
 	if (opts & OPT_INACTIVE) {
 		add = SIOCADIFR;
@@ -284,9 +327,18 @@ char	*name, *file;
 		if (opts & OPT_VERBOSE)
 			(void)fprintf(stderr, "[%s]\n", line);
 
-		fr = parse(line, linenum);
+		parsestatus = 1;
+		fr = parse(line, linenum, &parsestatus);
 		(void)fflush(stdout);
 
+		if (parsestatus != 0) {
+			fprintf(stderr, "%s: %s: %s error (%d), quitting\n",
+			    name, file,
+			    ((parsestatus < 0)? "parse": "internal"),
+			    parsestatus);
+			exit(1);
+		}
+
 		if (fr) {
 			if (opts & OPT_ZERORULEST)
 				add = SIOCZRLST;
@@ -311,6 +363,7 @@ char	*name, *file;
 				if (ioctl(fd, add, &fr) == -1) {
 					fprintf(stderr, "%d:", linenum);
 					perror("ioctl(SIOCZRLST)");
+					exit(1);
 				} else {
 #ifdef	USE_QUAD_T
 					printf("hits %qd bytes %qd ",
@@ -327,11 +380,13 @@ char	*name, *file;
 				if (ioctl(fd, del, &fr) == -1) {
 					fprintf(stderr, "%d:", linenum);
 					perror("ioctl(delete rule)");
+					exit(1);
 				}
 			} else if (!(opts & OPT_DONOTHING)) {
 				if (ioctl(fd, add, &fr) == -1) {
 					fprintf(stderr, "%d:", linenum);
 					perror("ioctl(add/insert rule)");
+					exit(1);
 				}
 			}
 		}
@@ -346,7 +401,7 @@ char	*name, *file;
 
 /*
  * Similar to fgets(3) but can handle '\\' and NL is converted to NUL.
- * Returns NULL if error occured, EOF encounterd or input line is too long.
+ * Returns NULL if error occurred, EOF encounterd or input line is too long.
  */
 static char *getline(str, size, file, linenum)
 register char	*str;
@@ -360,7 +415,7 @@ int	*linenum;
 	do {
 		for (p = str, s = size;; p += (len - 1), s -= (len - 1)) {
 			/*
-			 * if an error occured, EOF was encounterd, or there
+			 * if an error occurred, EOF was encounterd, or there
 			 * was no room to put NUL, return NULL.
 			 */
 			if (fgets(p, s, file) == NULL)
@@ -391,7 +446,9 @@ char	*opt;
 {
 	int	flag;
 
-	flag = get_flags();
+	if (get_flags(&flag))
+		exit(1);
+
 	if (flag != 0) {
 		if ((opts & (OPT_DONOTHING|OPT_VERBOSE)) == OPT_VERBOSE)
 			printf("log flag is currently %#x\n", flag);
@@ -415,11 +472,27 @@ char	*opt;
 			printf("set log flag: block\n");
 	}
 
-	if (opendevice(ipfname) != -2 && (ioctl(fd, SIOCSETFF, &flag) != 0))
-		perror("ioctl(SIOCSETFF)");
+	if (opendevice(ipfname) == -1) {
+		exit(1);
+	}
+
+	if (!(opts & OPT_DONOTHING)) {
+		if (ioctl(fd, SIOCSETFF, &flag) != 0) {
+			perror("ioctl(SIOCSETFF)");
+			exit(1);
+		}
+	}
 
 	if ((opts & (OPT_DONOTHING|OPT_VERBOSE)) == OPT_VERBOSE) {
-		flag = get_flags();
+		/*
+		 * Even though the ioctls above succeeded, it
+		 * is possible that a calling script/program
+		 * relies on the following verbose mode string.
+		 * Thus, we still take an error exit if get_flags
+		 * fails here.
+		 */
+		if (get_flags(&flag))
+			exit(1);
 		printf("log flag is now %#x\n", flag);
 	}
 }
@@ -430,8 +503,11 @@ char	*arg;
 {
 	int	fl = 0, rem;
 
-	if (!arg || !*arg)
-		return;
+	if (!arg || !*arg) {
+		fprintf(stderr, "-F: no filter specified\n");
+		exit(1);
+	}
+
 	if (!strcmp(arg, "s") || !strcmp(arg, "S")) {
 		if (*arg == 'S')
 			fl = 0;
@@ -440,13 +516,22 @@ char	*arg;
 		rem = fl;
 
 		closedevice();
-		if (opendevice(IPL_STATE) != -2) {
+
+		if (opendevice(IPL_STATE) == -1) {
+			exit(1);
+		}
+
+		if (!(opts & OPT_DONOTHING)) {
 			if (use_inet6) {
-				if (ioctl(fd, SIOCIPFL6, &fl) == -1)
+				if (ioctl(fd, SIOCIPFL6, &fl) == -1) {
 					perror("ioctl(SIOCIPFL6)");
+					exit(1);
+				}
 			} else {
-				if (ioctl(fd, SIOCIPFFL, &fl) == -1)
+				if (ioctl(fd, SIOCIPFFL, &fl) == -1) {
 					perror("ioctl(SIOCIPFFL)");
+					exit(1);
+				}
 			}
 		}
 		if ((opts & (OPT_DONOTHING|OPT_VERBOSE)) == OPT_VERBOSE) {
@@ -465,13 +550,21 @@ char	*arg;
 	fl |= (opts & FR_INACTIVE);
 	rem = fl;
 
-	if (opendevice(ipfname) != -2) {
+	if (opendevice(ipfname) == -1) {
+		exit(1);
+	}
+
+	if (!(opts & OPT_DONOTHING)) {
 		if (use_inet6) {
-			if (ioctl(fd, SIOCIPFL6, &fl) == -1)
+			if (ioctl(fd, SIOCIPFL6, &fl) == -1) {
 				perror("ioctl(SIOCIPFL6)");
+				exit(1);
+			}
 		} else {
-			if (ioctl(fd, SIOCIPFFL, &fl) == -1)
+			if (ioctl(fd, SIOCIPFFL, &fl) == -1) {
 				perror("ioctl(SIOCIPFFL)");
+				exit(1);
+			}
 		}
 	}
 	if ((opts & (OPT_DONOTHING|OPT_VERBOSE)) == OPT_VERBOSE) {
@@ -487,10 +580,18 @@ static void swapactive()
 {
 	int in = 2;
 
-	if (opendevice(ipfname) != -2 && ioctl(fd, SIOCSWAPA, &in) == -1)
-		perror("ioctl(SIOCSWAPA)");
-	else
-		printf("Set %d now inactive\n", in);
+	if (opendevice(ipfname) == -1) {
+		exit(1);
+	}
+
+
+	if (!(opts & OPT_DONOTHING)) {
+		if (ioctl(fd, SIOCSWAPA, &in) == -1) {
+			perror("ioctl(SIOCSWAPA)");
+			exit(1);
+		}
+	}
+	printf("Set %d now inactive\n", in);
 }
 
 
@@ -498,10 +599,16 @@ void frsync()
 {
 	int frsyn = 0;
 
-	if (opendevice(ipfname) != -2 && ioctl(fd, SIOCFRSYN, &frsyn) == -1)
-		perror("SIOCFRSYN");
-	else
-		printf("filter sync'd\n");
+	if (opendevice(ipfname) == -1)
+		exit(1);
+
+	if (!(opts & OPT_DONOTHING)) {
+		if (ioctl(fd, SIOCFRSYN, &frsyn) == -1) {
+			perror("SIOCFRSYN");
+			exit(1);
+		}
+	}
+	printf("filter sync'd\n");
 }
 
 
@@ -510,7 +617,10 @@ void zerostats()
 	friostat_t	fio;
 	friostat_t	*fiop = &fio;
 
-	if (opendevice(ipfname) != -2) {
+	if (opendevice(ipfname) == -1)
+		exit(1);
+
+	if (!(opts & OPT_DONOTHING)) {
 		if (ioctl(fd, SIOCFRZST, &fiop) == -1) {
 			perror("ioctl(SIOCFRZST)");
 			exit(-1);
@@ -522,7 +632,7 @@ void zerostats()
 
 
 /*
- * read the kernel stats for packets blocked and passed
+ * Read the kernel stats for packets blocked and passed
  */
 static void showstats(fp)
 friostat_t	*fp;
@@ -556,19 +666,26 @@ friostat_t	*fp;
 #if SOLARIS
 static void blockunknown()
 {
-	u_32_t	flag;
+	int	flag;
 
 	if (opendevice(ipfname) == -1)
-		return;
+		exit(1);
+
+	if (get_flags(&flag))
+		exit(1);
 
-	flag = get_flags();
 	if ((opts & (OPT_DONOTHING|OPT_VERBOSE)) == OPT_VERBOSE)
 		printf("log flag is currently %#x\n", flag);
 
 	flag ^= FF_BLOCKNONIP;
 
-	if (opendevice(ipfname) != -2 && ioctl(fd, SIOCSETFF, &flag))
-		perror("ioctl(SIOCSETFF)");
+	if (opendevice(ipfname) == -1)
+		exit(1);
+
+	if (!(opts & OPT_DONOTHING)) {
+		if (ioctl(fd, SIOCSETFF, &flag))
+			perror("ioctl(SIOCSETFF)");
+	}
 
 	if ((opts & (OPT_DONOTHING|OPT_VERBOSE)) == OPT_VERBOSE) {
 		if (ioctl(fd, SIOCGETFF, &flag))
@@ -580,13 +697,15 @@ static void blockunknown()
 #endif
 
 
+/*
+ * nonzero return value means caller should exit with error
+ */
 static int showversion()
 {
 	struct friostat fio;
 	struct friostat *fiop=&fio;
-	u_32_t flags;
+	int flags, vfd;
 	char *s;
-	int vfd;
 
 	printf("ipf: %s (%d)\n", IPL_VERSION, (int)sizeof(frentry_t));
 
@@ -601,11 +720,14 @@ static int showversion()
 		return 1;
 	}
 	close(vfd);
-	flags = get_flags();
 
 	printf("Kernel: %-*.*s\n", (int)sizeof(fio.f_version),
 		(int)sizeof(fio.f_version), fio.f_version);
 	printf("Running: %s\n", fio.f_running ? "yes" : "no");
+
+	if (get_flags(&flags)) {
+		return 1;
+	}
 	printf("Log Flags: %#x = ", flags);
 	s = "";
 	if (flags & FF_LOGPASS) {
diff --git a/contrib/ipfilter/ipf.h b/contrib/ipfilter/ipf.h
index e9c3a02..9260d03f 100644
--- a/contrib/ipfilter/ipf.h
+++ b/contrib/ipfilter/ipf.h
@@ -4,7 +4,7 @@
  * See the IPFILTER.LICENCE file for details on licencing.
  *
  * @(#)ipf.h	1.12 6/5/96
- * $Id: ipf.h,v 2.9.2.6 2002/01/03 08:00:12 darrenr Exp $
+ * $Id: ipf.h,v 2.9.2.7 2003/05/15 17:45:33 darrenr Exp $
  */
 
 #ifndef	__IPF_H__
@@ -62,7 +62,7 @@ struct nat;
 extern	char	*strdup __P((char *));
 #endif
 
-extern	struct	frentry	*parse __P((char *, int));
+extern	struct	frentry	*parse __P((char *, int, int *));
 
 extern	void	printfr __P((struct frentry *));
 extern	void	binprint __P((struct frentry *)), initparse __P((void));
diff --git a/contrib/ipfilter/ipfs.c b/contrib/ipfilter/ipfs.c
index 84fadc0..ffbd71b 100644
--- a/contrib/ipfilter/ipfs.c
+++ b/contrib/ipfilter/ipfs.c
@@ -45,7 +45,7 @@
 #include "ipf.h"
 
 #if !defined(lint)
-static const char rcsid[] = "@(#)$Id: ipfs.c,v 2.6.2.12 2002/09/26 12:25:19 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: ipfs.c,v 2.6.2.15 2003/05/31 02:12:21 darrenr Exp $";
 #endif
 
 #ifndef	IPF_SAVEDIR
@@ -63,6 +63,7 @@ extern	char	*index __P((const char *, int));
 #endif
 
 extern	char	*optarg;
+extern	int	optind;
 
 int	main __P((int, char *[]));
 void	usage __P((void));
@@ -80,22 +81,24 @@ int	writenat __P((int, char *));
 char	*concat __P((char *, char *));
 
 int	opts = 0;
+char	*progname;
 
 
 void usage()
 {
 	fprintf(stderr, "\
-usage: ipfs [-nv] -l\n\
-usage: ipfs [-nv] -u\n\
-usage: ipfs [-nv] [-d <dir>] -R\n\
-usage: ipfs [-nv] [-d <dir>] -W\n\
-usage: ipfs [-nv] -N [-f <file> | -d <dir>] -r\n\
-usage: ipfs [-nv] -S [-f <file> | -d <dir>] -r\n\
-usage: ipfs [-nv] -N [-f <file> | -d <dir>] -w\n\
-usage: ipfs [-nv] -S [-f <file> | -d <dir>] -w\n\
-usage: ipfs [-nv] -N [-f <filename> | -d <dir> ] -i <if1>,<if2>\n\
-usage: ipfs [-nv] -S [-f <filename> | -d <dir> ] -i <if1>,<if2>\n\
-");
+usage: %s [-nv] -l\n\
+usage: %s [-nv] -u\n\
+usage: %s [-nv] [-d <dir>] -R\n\
+usage: %s [-nv] [-d <dir>] -W\n\
+usage: %s [-nv] -N [-f <file> | -d <dir>] -r\n\
+usage: %s [-nv] -S [-f <file> | -d <dir>] -r\n\
+usage: %s [-nv] -N [-f <file> | -d <dir>] -w\n\
+usage: %s [-nv] -S [-f <file> | -d <dir>] -w\n\
+usage: %s [-nv] -N [-f <filename> | -d <dir> ] -i <if1>,<if2>\n\
+usage: %s [-nv] -S [-f <filename> | -d <dir> ] -i <if1>,<if2>\n\
+", progname, progname, progname, progname, progname, progname,
+		progname, progname, progname, progname);
 	exit(1);
 }
 
@@ -214,6 +217,8 @@ char *argv[];
 	int c, lock = -1, devfd = -1, err = 0, rw = -1, ns = -1, set = 0;
 	char *dirname = NULL, *filename = NULL, *ifs = NULL;
 
+	progname = argv[0];
+
 	while ((c = getopt(argc, argv, "d:f:i:lNnSRruvWw")) != -1)
 		switch (c)
 		{
@@ -287,10 +292,14 @@ char *argv[];
 			rw = 3;
 			set = 1;
 			break;
+		case '?' :
 		default :
 			usage();
 		}
 
+	if (optind < 2)
+		usage();
+
 	if (filename == NULL) {
 		if (ns == 0) {
 			if (dirname == NULL)
@@ -560,9 +569,11 @@ int readnat(fd, file)
 int fd;
 char *file;
 {
-	nat_save_t ipn, *in, *ipnhead = NULL, *in1, *ipntail = NULL, *ipnp;
+	nat_save_t ipn, *in, *ipnhead = NULL, *in1, *ipntail = NULL;
 	int nfd = -1, i;
 	nat_t *nat;
+	char *s;
+	int n;
 
 	if (!file)
 		file = IPF_NATFILE;
@@ -575,7 +586,6 @@ char *file;
 	}
 
 	bzero((char *)&ipn, sizeof(ipn));
-	ipnp = &ipn;
 
 	/*
 	 * 1. Read all state information in.
@@ -597,30 +607,35 @@ char *file;
 		}
 
 		if (ipn.ipn_dsize > 0) {
-			char *s = ipnp->ipn_data;
-			int n = ipnp->ipn_dsize;
+			n = ipn.ipn_dsize;
 
-			n -= sizeof(ipnp->ipn_data);
+			if (n > sizeof(ipn.ipn_data))
+				n -= sizeof(ipn.ipn_data);
+			else
+				n = 0;
 			in = malloc(sizeof(*in) + n);
 			if (!in)
 				break;
 
-			s += sizeof(ipnp->ipn_data);
-			i = read(nfd, s, n);
-			if (i == 0)
-				break;
-			if (i != n) {
-				fprintf(stderr, "incomplete read: %d != %d\n",
-					i, n);
-				close(nfd);
-				return 1;
+			if (n > 0) {
+				s = in->ipn_data + sizeof(in->ipn_data);
+				i = read(nfd, s, n);
+				if (i == 0)
+					break;
+				if (i != n) {
+					fprintf(stderr,
+						"incomplete read: %d != %d\n",
+						i, n);
+					close(nfd);
+					return 1;
+				}
 			}
 		} else
 			in = (nat_save_t *)malloc(sizeof(*in));
-		bcopy((char *)ipnp, (char *)in, sizeof(ipn));
+		bcopy((char *)&ipn, (char *)in, sizeof(ipn));
 
 		/*
-		 * Check to see if this is the first state entry that will
+		 * Check to see if this is the first NAT entry that will
 		 * reference a particular rule and if so, flag it as such
 		 * else just adjust the rule pointer to become a pointer to
 		 * the other.  We do this so we have a means later for tracking
@@ -650,6 +665,7 @@ char *file;
 	} while (1);
 
 	close(nfd);
+	nfd = -1;
 
 	for (in = ipnhead; in; in = in->ipn_next) {
 		if (opts & OPT_VERBOSE)
@@ -758,6 +774,7 @@ char *dirname;
 		dirname = IPF_SAVEDIR;
 
 	if (chdir(dirname)) {
+		fprintf(stderr, "IPF_SAVEDIR=%s: ", dirname);
 		perror("chdir(IPF_SAVEDIR)");
 		return 1;
 	}
diff --git a/contrib/ipfilter/ipft_ef.c b/contrib/ipfilter/ipft_ef.c
index 6b34ac0..c8ae3f2 100644
--- a/contrib/ipfilter/ipft_ef.c
+++ b/contrib/ipfilter/ipft_ef.c
@@ -52,7 +52,7 @@ etherfind -n -t
 
 #if !defined(lint)
 static const char sccsid[] = "@(#)ipft_ef.c	1.6 2/4/96 (C)1995 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ipft_ef.c,v 2.2.2.4 2002/12/06 11:40:25 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: ipft_ef.c,v 2.2.2.5 2003/05/19 12:02:35 darrenr Exp $";
 #endif
 
 static	int	etherf_open __P((char *));
@@ -108,9 +108,9 @@ int	cnt, *dir;
 
 	bzero(&pkt, sizeof(pkt));
 
-	if (sscanf(lbuf, "%s %s %s %s %s %s", len, prot, src, dst,
+	if (sscanf(lbuf, "%7s %7s %15s %15s %15s %15s", len, prot, src, dst,
 		   sprt, dprt) != 6)
-		if (sscanf(lbuf, "%s %s %s %s %s %s %s", time,
+		if (sscanf(lbuf, "%7s %7s %7s %15s %15s %15s %15s", time,
 			   len, prot, src, dst, sprt, dprt) != 7)
 			return -1;
 
diff --git a/contrib/ipfilter/ipft_td.c b/contrib/ipfilter/ipft_td.c
index b3b7d17..99beab5 100644
--- a/contrib/ipfilter/ipft_td.c
+++ b/contrib/ipfilter/ipft_td.c
@@ -61,7 +61,7 @@ tcpdump -nqte
 
 #if !defined(lint)
 static const char sccsid[] = "@(#)ipft_td.c	1.8 2/4/96 (C)1995 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ipft_td.c,v 2.2.2.4 2002/12/06 11:40:26 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: ipft_td.c,v 2.2.2.6 2003/05/31 02:13:04 darrenr Exp $";
 #endif
 
 static	int	tcpd_open __P((char *));
@@ -131,12 +131,13 @@ int	cnt, *dir;
 
 	bzero(&pkt, sizeof(pkt));
 
-	if ((n = sscanf(lbuf, "%s > %s: %s", src, dst, misc)) != 3)
-		if ((n = sscanf(lbuf, "%s %s > %s: %s",
+	if ((n = sscanf(lbuf, "%31s > %31s: %255s", src, dst, misc)) != 3)
+		if ((n = sscanf(lbuf, "%31s %31s > %31s: %255s",
 				time, src, dst, misc)) != 4)
-			if ((n = sscanf(lbuf, "%s %s: %s > %s: %s",
+			if ((n = sscanf(lbuf, "%31s %31s: %31s > %31s: %255s",
 					link1, link2, src, dst, misc)) != 5) {
-				n = sscanf(lbuf, "%s %s %s: %s > %s: %s",
+				n = sscanf(lbuf,
+					   "%31s %31s %31s: %31s > %31s: %255s",
 					   time, link1, link2, src, dst, misc);
 				if (n != 6)
 					return -1;
diff --git a/contrib/ipfilter/ipl.h b/contrib/ipfilter/ipl.h
index 2a23a44..b975ee9 100644
--- a/contrib/ipfilter/ipl.h
+++ b/contrib/ipfilter/ipl.h
@@ -4,12 +4,12 @@
  * See the IPFILTER.LICENCE file for details on licencing.
  *
  * @(#)ipl.h	1.21 6/5/96
- * $Id: ipl.h,v 2.15.2.38 2002/12/07 02:40:05 darrenr Exp $
+ * $Id: ipl.h,v 2.15.2.44 2004/06/03 17:28:20 darrenr Exp $
  */
 
 #ifndef	__IPL_H__
 #define	__IPL_H__
 
-#define	IPL_VERSION	"IP Filter: v3.4.31"
+#define	IPL_VERSION	"IP Filter: v3.4.35"
 
 #endif
diff --git a/contrib/ipfilter/iplang/iplang_l.l b/contrib/ipfilter/iplang/iplang_l.l
index 4139792..cc31781 100644
--- a/contrib/ipfilter/iplang/iplang_l.l
+++ b/contrib/ipfilter/iplang/iplang_l.l
@@ -6,7 +6,7 @@
  * provided that this notice is preserved and due credit is given
  * to the original author and the contributors.
  *
- * $Id: iplang_l.l,v 2.2 2000/02/18 00:18:05 darrenr Exp $
+ * $Id: iplang_l.l,v 2.2.2.1 2003/07/28 01:15:59 darrenr Exp $
  */
 #include <stdio.h>
 #include <string.h>
@@ -318,5 +318,6 @@ void swallow()
 		while ((c != '\n') && (c != EOF))
 			c = input();
 	}
-	unput(c);
+	if (c != EOF)
+		unput(c);
 }
diff --git a/contrib/ipfilter/ipmon.c b/contrib/ipfilter/ipmon.c
index 2c563d7..2e4b2b5 100644
--- a/contrib/ipfilter/ipmon.c
+++ b/contrib/ipfilter/ipmon.c
@@ -68,7 +68,7 @@
 
 #if !defined(lint)
 static const char sccsid[] = "@(#)ipmon.c	1.21 6/5/96 (C)1993-2000 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ipmon.c,v 2.12.2.37 2002/12/06 11:40:26 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: ipmon.c,v 2.12.2.40 2004/05/12 23:21:55 darrenr Exp $";
 #endif
 
 
@@ -920,6 +920,7 @@ int	blen;
 	}
 #if (SOLARIS || \
 	(defined(NetBSD) && (NetBSD <= 1991011) && (NetBSD >= 199603)) || \
+	(defined(__FreeBSD__) && (__FreeBSD_version >= 501113)) || \
 	(defined(OpenBSD) && (OpenBSD >= 199603))) || defined(linux)
 	{
 	char	ifname[sizeof(ipf->fl_ifname) + 1];
@@ -991,7 +992,7 @@ int	blen;
 		p = (u_short)ip6->ip6_nxt;
 		s = (u_32_t *)&ip6->ip6_src;
 		d = (u_32_t *)&ip6->ip6_dst;
-		plen = ntohs(ip6->ip6_plen);
+		plen = hl + ntohs(ip6->ip6_plen);
 #else
 		sprintf(t, "ipv6");
 		goto printipflog;
@@ -1105,11 +1106,12 @@ int	blen;
 					ipc->ip_hl << 2, i);
 				t += strlen(t);
 				if (ipoff & IP_OFFMASK) {
-					(void) sprintf(t, " frag %s%s%hu@%hu",
-						ipoff & IP_MF ? "+" : "",
-						ipoff & IP_DF ? "-" : "",
+					(void) sprintf(t, " (frag %d:%hu@%hu%s%s)",
+						ntohs(ipc->ip_id),
 						i - (ipc->ip_hl<<2),
-						(ipoff & IP_OFFMASK) << 3);
+						(ipoff & IP_OFFMASK) << 3,
+						ipoff & IP_MF ? "+" : "",
+						ipoff & IP_DF ? "-" : "");
 				}
 			}
 		}
@@ -1120,10 +1122,11 @@ int	blen;
 			hostname(res, v, d), proto, hl, plen);
 		t += strlen(t);
 		if (off & IP_OFFMASK)
-			(void) sprintf(t, " frag %s%s%hu@%hu",
+			(void) sprintf(t, " (frag %d:%hu@%hu%s%s)",
+				ntohs(ip->ip_id),
+				plen - hl, (off & IP_OFFMASK) << 3,
 				ipoff & IP_MF ? "+" : "",
-				ipoff & IP_DF ? "-" : "",
-				plen - hl, (off & IP_OFFMASK) << 3);
+				ipoff & IP_DF ? "-" : "");
 	}
 	t += strlen(t);
 
diff --git a/contrib/ipfilter/ipnat.c b/contrib/ipfilter/ipnat.c
index 2c10939..69e7959 100644
--- a/contrib/ipfilter/ipnat.c
+++ b/contrib/ipfilter/ipnat.c
@@ -60,7 +60,7 @@ extern	char	*sys_errlist[];
 
 #if !defined(lint)
 static const char sccsid[] ="@(#)ipnat.c	1.9 6/5/96 (C) 1993 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ipnat.c,v 2.16.2.22 2002/12/06 11:40:26 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: ipnat.c,v 2.16.2.25 2003/06/05 14:00:28 darrenr Exp $";
 #endif
 
 
@@ -71,27 +71,31 @@ int	use_inet6 = 0;
 char	thishost[MAXHOSTNAMELEN];
 
 extern	char	*optarg;
+extern	int	optind;
+#if 0
 extern	ipnat_t	*natparse __P((char *, int));
+#endif
 extern	void	natparsefile __P((int, char *, int));
 extern	void	printnat __P((ipnat_t *, int));
 extern	void	printactivenat __P((nat_t *, int));
 extern	void	printhostmap __P((hostmap_t *, u_int));
 extern	char	*getsumd __P((u_32_t));
 
-void	dostats __P((natstat_t *, int)), flushtable __P((int, int));
+static int	dostats __P((natstat_t *, int));
+static int	flushtable __P((int, int));
 void	usage __P((char *));
 int	countbits __P((u_32_t));
 char	*getnattype __P((ipnat_t *));
 int	main __P((int, char*[]));
 void	printaps __P((ap_session_t *, int));
-void	showhostmap __P((natstat_t *nsp));
-void	natstat_dead __P((natstat_t *, char *));
+static int	showhostmap __P((natstat_t *nsp));
+static int	natstat_dead __P((natstat_t *, char *));
 
 
 void usage(name)
 char *name;
 {
-	fprintf(stderr, "%s: [-CFhlnrsv] [-f filename]\n", name);
+	fprintf(stderr, "Usage: %s [-CFhlnrsv] [-f filename]\n", name);
 	exit(1);
 }
 
@@ -153,10 +157,14 @@ char *argv[];
 		case 'v' :
 			opts |= OPT_VERBOSE;
 			break;
+		case '?' :
 		default :
 			usage(argv[0]);
 		}
 
+	if (optind < 2)
+		usage(argv[0]);
+
 	if ((kernel != NULL) || (core != NULL)) {
 		(void) setgid(getgid());
 		(void) setuid(getuid());
@@ -189,27 +197,36 @@ char *argv[];
 		if (openkmem(kernel, core) == -1)
 			exit(1);
 
-		natstat_dead(nsp, kernel);
-		if (opts & (OPT_LIST|OPT_STAT))
-			dostats(nsp, opts);
+		if (natstat_dead(nsp, kernel))
+			exit(1);
+		if (opts & (OPT_LIST|OPT_STAT)) {
+			if (dostats(nsp, opts))
+				exit(1);
+		}
 		exit(0);
 	}
 
 	if (opts & (OPT_FLUSH|OPT_CLEAR))
-		flushtable(fd, opts);
-	if (file)
+		if (flushtable(fd, opts))
+		    exit(1);
+	if (file) {
+		/* NB natparsefile exits with nonzero in case of error */
 		natparsefile(fd, file, opts);
+	}
 	if (opts & (OPT_LIST|OPT_STAT))
-		dostats(nsp, opts);
+		if (dostats(nsp, opts))
+			exit(1);
+
+	/* TBD why not exit(0)? */
 	return 0;
 }
 
 
 /*
- * Read nat statistic information in using a symbol table and memory file
+ * Read NAT statistic information in using a symbol table and memory file
  * rather than doing ioctl's.
  */
-void natstat_dead(nsp, kernel)
+static int natstat_dead(nsp, kernel)
 natstat_t *nsp;
 char *kernel;
 {
@@ -229,12 +246,12 @@ char *kernel;
 
 	if (nlist(kernel, nat_nlist) == -1) {
 		fprintf(stderr, "nlist error\n");
-		return;
+		return -1;
 	}
 
 	/*
 	 * Normally the ioctl copies all of these values into the structure
-	 * for us, before returning it to useland, so here we must copy each
+	 * for us, before returning it to userland, so here we must copy each
 	 * one in individually.
 	 */
 	kmemcpy((char *)&tables, nat_nlist[0].n_value, sizeof(tables));
@@ -257,18 +274,21 @@ char *kernel;
 		sizeof(nsp->ns_instances));
 	kmemcpy((char *)&nsp->ns_apslist, nat_nlist[8].n_value,
 		sizeof(nsp->ns_apslist));
+
+	return 0;
 }
 
 
 /*
  * Display NAT statistics.
  */
-void dostats(nsp, opts)
+static int dostats(nsp, opts)
 natstat_t *nsp;
 int opts;
 {
 	nat_t **nt[2], *np, nat;
 	ipnat_t	ipn;
+	int rc = 0;
 
 	/*
 	 * Show statistics ?
@@ -297,6 +317,7 @@ int opts;
 			if (kmemcpy((char *)&ipn, (long)nsp->ns_list,
 				    sizeof(ipn))) {
 				perror("kmemcpy");
+				rc = -1;
 				break;
 			}
 			if (opts & OPT_HITS)
@@ -309,28 +330,40 @@ int opts;
 		if (kmemcpy((char *)nt[0], (long)nsp->ns_table[0],
 			    sizeof(**nt) * NAT_SIZE)) {
 			perror("kmemcpy");
-			return;
+			rc = -1;
+		}
+		if (rc) {
+			free(nt[0]);
+			return rc;
 		}
 
 		printf("\nList of active sessions:\n");
 
 		for (np = nsp->ns_instances; np; np = nat.nat_next) {
-			if (kmemcpy((char *)&nat, (long)np, sizeof(nat)))
+			if (kmemcpy((char *)&nat, (long)np, sizeof(nat))) {
+				/* TBD Is this an error? If so, return -1 */
 				break;
+			}
 			printactivenat(&nat, opts);
 		}
 
-		if (opts & OPT_VERBOSE)
-			showhostmap(nsp);
+		if (opts & OPT_VERBOSE) {
+			if (showhostmap(nsp)) {
+				free(nt[0]);
+				return -1;
+			}
+		}
+
 		free(nt[0]);
 	}
+	return 0;
 }
 
 
 /*
- * display the active host mapping table.
+ * Display the active host mapping table.
  */
-void showhostmap(nsp)
+static int showhostmap(nsp)
 natstat_t *nsp;
 {
 	hostmap_t hm, *hmp, **maptable;
@@ -343,7 +376,8 @@ natstat_t *nsp;
 	if (kmemcpy((char *)maptable, (u_long)nsp->ns_maptable,
 		    sizeof(hostmap_t *) * nsp->ns_hostmap_sz)) {
 		perror("kmemcpy (maptable)");
-		return;
+		free(maptable);
+		return -1;
 	}
 
 	for (hv = 0; hv < nsp->ns_hostmap_sz; hv++) {
@@ -352,7 +386,8 @@ natstat_t *nsp;
 		while (hmp) {
 			if (kmemcpy((char *)&hm, (u_long)hmp, sizeof(hm))) {
 				perror("kmemcpy (hostmap)");
-				return;
+				free(maptable);
+				return -1;
 			}
 
 			printhostmap(&hm, hv);
@@ -360,6 +395,7 @@ natstat_t *nsp;
 		}
 	}
 	free(maptable);
+	return 0;
 }
 
 
@@ -367,24 +403,31 @@ natstat_t *nsp;
  * Issue an ioctl to flush either the NAT rules table or the active mapping
  * table or both.
  */
-void flushtable(fd, opts)
+static int flushtable(fd, opts)
 int fd, opts;
 {
 	int n = 0;
+	int rc = 0;
 
 	if (opts & OPT_FLUSH) {
 		n = 0;
-		if (!(opts & OPT_NODO) && ioctl(fd, SIOCIPFFL, &n) == -1)
+		if (!(opts & OPT_NODO) && ioctl(fd, SIOCIPFFL, &n) == -1) {
 			perror("ioctl(SIOCFLNAT)");
-		else
+			rc = -1;
+		} else {
 			printf("%d entries flushed from NAT table\n", n);
+		}
 	}
 
 	if (opts & OPT_CLEAR) {
 		n = 1;
-		if (!(opts & OPT_NODO) && ioctl(fd, SIOCIPFFL, &n) == -1)
+		if (!(opts & OPT_NODO) && ioctl(fd, SIOCIPFFL, &n) == -1) {
 			perror("ioctl(SIOCCNATL)");
-		else
+			rc = -1;
+		} else {
 			printf("%d entries flushed from NAT list\n", n);
+		}
 	}
+
+	return rc;
 }
diff --git a/contrib/ipfilter/ipsend/in_var.h b/contrib/ipfilter/ipsend/in_var.h
index 63980ef..b935259 100644
--- a/contrib/ipfilter/ipsend/in_var.h
+++ b/contrib/ipfilter/ipsend/in_var.h
@@ -76,7 +76,7 @@ struct	ifqueue	ipintrq;		/* ip packet input queue */
 	     (ia) != NULL && (ia)->ia_ifp != (ifp);			  \
 	     (ia) = (ia)->ia_next);					  \
 }
-#endif KERNEL
+#endif /* KERNEL */
 
 /*
  * Per-interface router version information is kept in this list.
diff --git a/contrib/ipfilter/ipsend/ipsend.1 b/contrib/ipfilter/ipsend/ipsend.1
index 04d895d..f2f8066 100644
--- a/contrib/ipfilter/ipsend/ipsend.1
+++ b/contrib/ipfilter/ipsend/ipsend.1
@@ -51,7 +51,7 @@ enable debugging mode.
 .TP
 .BR \-f \0<offset>
 The \fI-f\fP allows the IP offset field in the IP header to be set to an
-arbitrary value, which can be specified in decimal or hexidecimal.
+arbitrary value, which can be specified in decimal or hexadecimal.
 .TP
 .BR \-g \0<gateway>
 Specify the hostname of the gateway through which to route packets.  This
diff --git a/contrib/ipfilter/ipsend/ipsend.5 b/contrib/ipfilter/ipsend/ipsend.5
index 1e4e82e..f713147 100644
--- a/contrib/ipfilter/ipsend/ipsend.5
+++ b/contrib/ipfilter/ipsend/ipsend.5
@@ -102,7 +102,7 @@ route installed in the kernel.
 is used to describe an IP (version 4) packet.  IP header fields can be
 specified, including options, followed by a data section which may contain
 further protocol headers.
-.SH IPV4
+.SH IPv4
 .TP
 .B hl <number>
 manually specifies the IP header length (automatically adjusts with the
@@ -116,7 +116,7 @@ set the type of service (TOS) field in the IP header.  Default is 0.
 .TP
 .B len <number>
 manually specifies the length of the IP packet.  The length will automatically
-be adjusted to accomodate data or further protocol headers.
+be adjusted to accommodate data or further protocol headers.
 .TP
 .B off <number>
 sets the fragment offset field of the IP packet.  Default is 0.
@@ -158,7 +158,7 @@ is used to indicate the a ICMP protocol header is to follow.  See the
 is used to indicate that raw data is to be included in the IP packet.  See the
 \fBDATA\fP section for details on options available.
 .SH "IPv4 Options"
-these keywords indicate that the releveant IP option should be added to the
+these keywords indicate that the relevant IP option should be added to the
 IP header (the header length field will be adjusted appropriately).
 .TP
 .B nop
@@ -210,7 +210,7 @@ Strict Source Route [RFC 791].
 Address Extension
 .TP
 .B visa
-Expermental Access Control.
+Experimental Access Control.
 .TP
 .B imitd
 IMI Traffic Descriptor.
@@ -314,7 +314,7 @@ bytes with any particular data).
 indicates that the string provided should be added to the current packet as
 data.  A string may be a consecutive list of characters and numbers (with
 no white spaces) or bounded by "'s (may not contain them, even if \\'d).
-The \\ charcater is recognised with the appropriate C escaped values, including
+The \\ character is recognised with the appropriate C escaped values, including
 octal numbers.
 .TP
 .B file <filename>
diff --git a/contrib/ipfilter/ipsend/ipsend.c b/contrib/ipfilter/ipsend/ipsend.c
index 4e3f050..cdf18a7 100644
--- a/contrib/ipfilter/ipsend/ipsend.c
+++ b/contrib/ipfilter/ipsend/ipsend.c
@@ -24,8 +24,10 @@
 #include <arpa/inet.h>
 #include <netinet/in_systm.h>
 #include <netinet/ip.h>
+#include <netinet/ip_var.h>
 #include <netinet/tcp.h>
 #include <netinet/udp.h>
+#include <netinet/udp_var.h>
 #include <netinet/ip_icmp.h>
 #ifndef	linux
 #include <netinet/ip_var.h>
@@ -34,7 +36,7 @@
 
 #if !defined(lint)
 static const char sccsid[] = "@(#)ipsend.c	1.5 12/10/95 (C)1995 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ipsend.c,v 2.2.2.6 2002/12/06 11:40:35 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: ipsend.c,v 2.2.2.7 2004/04/10 11:50:52 darrenr Exp $";
 #endif
 
 
@@ -69,6 +71,7 @@ char	default_device[] = "lan0";
 
 static	void	usage __P((char *));
 static	void	do_icmp __P((ip_t *, char *));
+void udpcksum(ip_t *, struct udphdr *, int);
 int	main __P((int, char **));
 
 
@@ -168,6 +171,37 @@ struct in_addr gwip;
 	return send_packet(wfd, mtu, ip, gwip);
 }
 
+void
+udpcksum(ip_t *ip, struct udphdr *udp, int len)
+{
+	union pseudoh {
+		struct hdr {
+			u_short len;
+			u_char ttl;
+			u_char proto;
+			u_32_t src;
+			u_32_t dst;
+		} h;
+		u_short w[6];
+	} ph;
+	u_32_t temp32;
+	u_short cksum, *opts;
+
+	ph.h.len = htons(len);
+	ph.h.ttl = 0;
+	ph.h.proto = IPPROTO_UDP;
+	ph.h.src = ip->ip_src.s_addr;
+	ph.h.dst = ip->ip_dst.s_addr;
+	temp32 = 0;
+	opts = &ph.w[0];
+	temp32 += opts[0] + opts[1] + opts[2] + opts[3] + opts[4] + opts[5];
+	temp32 = (temp32 >> 16) + (temp32 & 65535);
+	temp32 += (temp32 >> 16);
+	udp->uh_sum = temp32 & 65535;
+	udp->uh_sum = chksum((u_short *)udp, len);
+	if (udp->uh_sum == 0)
+		udp->uh_sum = 0xffff;
+}
 
 int main(argc, argv)
 int	argc;
@@ -175,8 +209,10 @@ char	**argv;
 {
 	FILE	*langfile = NULL;
 	struct	tcpiphdr *ti;
+	struct	udpiphdr *ui;
 	struct	in_addr	gwip;
 	tcphdr_t	*tcp;
+	udphdr_t	*udp;
 	ip_t	*ip;
 	char	*name =  argv[0], host[MAXHOSTNAMELEN + 1];
 	char	*gateway = NULL, *dev = NULL;
@@ -188,7 +224,10 @@ char	**argv;
 	 */
 	ip = (ip_t *)calloc(1, 65536);
 	ti = (struct tcpiphdr *)ip;
+	ui = (struct udpiphdr *)ip;
 	tcp = (tcphdr_t *)&ti->ti_sport;
+	udp = (udphdr_t *)&ui->ui_sport;
+	ui->ui_ulen = htons(sizeof(*udp));
 	ip->ip_len = sizeof(*ip);
 	ip->ip_hl = sizeof(*ip) >> 2;
 
@@ -342,27 +381,35 @@ char	**argv;
 		exit(2);
 	    }
 
+	if (ip->ip_p != IPPROTO_TCP && ip->ip_p != IPPROTO_UDP) {
+		fprintf(stderr,"Unsupported protocol %d\n", ip->ip_p);
+		exit(2);
+	}
+
 	if (olen)
 	    {
-		caddr_t	ipo = (caddr_t)ip;
+		int hlen;
+		char *p;
 
 		printf("Options: %d\n", olen);
-		ti = (struct tcpiphdr *)malloc(olen + ip->ip_len);
-		if(!ti)
+		hlen = sizeof(*ip) + olen;
+		ip->ip_hl = hlen >> 2;
+		ip->ip_len += olen;
+		p = (char *)malloc(65536);
+		if(!p)
 		    {
 			fprintf(stderr,"malloc failed\n");
 			exit(2);
 		    } 
-
-		bcopy((char *)ip, (char *)ti, sizeof(*ip));
-		ip = (ip_t *)ti;
-		ip->ip_hl = (olen >> 2);
-		bcopy(options, (char *)(ip + 1), olen);
-		bcopy((char *)tcp, (char *)(ip + 1) + olen, sizeof(*tcp));
-		ip->ip_len += olen;
-		bcopy((char *)ip, (char *)ipo, ip->ip_len);
-		ip = (ip_t *)ipo;
-		tcp = (tcphdr_t *)((char *)(ip + 1) + olen);
+		bcopy(ip, p, sizeof(*ip));
+		bcopy(options, p + sizeof(*ip), olen);
+		bcopy(ip + 1, p + hlen, ip->ip_len - hlen);
+		ip = (ip_t *)p;
+		if (ip->ip_p == IPPROTO_TCP) {
+			tcp = (tcphdr_t *)((char *)ip + hlen);
+		} else {
+			udp = (udphdr_t *)((char *)ip + hlen);
+		}
 	    }
 
 	if (ip->ip_p == IPPROTO_TCP)
@@ -399,9 +446,13 @@ char	**argv;
 		printf("Flags:   %#x\n", tcp->th_flags);
 	printf("mtu:     %d\n", mtu);
 
+	if (ip->ip_p == IPPROTO_UDP) {
+		udp->uh_sum = 0;
+		udpcksum(ip, udp, (ip->ip_len) - (ip->ip_hl << 2));
+	}
 #ifdef	DOSOCKET
-	if (tcp->th_dport)
-		return do_socket(dev, mtu, ti, gwip);
+	if (ip->ip_p == IPPROTO_TCP && tcp->th_dport)
+		return do_socket(dev, mtu, (struct tcpiphdr *)ip, gwip);
 #endif
-	return send_packets(dev, mtu, (ip_t *)ti, gwip);
+	return send_packets(dev, mtu, ip, gwip);
 }
diff --git a/contrib/ipfilter/ipsend/ipsopt.c b/contrib/ipfilter/ipsend/ipsopt.c
index 5759bf9..144c86f 100644
--- a/contrib/ipfilter/ipsend/ipsopt.c
+++ b/contrib/ipfilter/ipsend/ipsopt.c
@@ -25,7 +25,7 @@
 
 #if !defined(lint)
 static const char sccsid[] = "@(#)ipsopt.c	1.2 1/11/96 (C)1995 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ipsopt.c,v 2.1.4.4 2002/12/06 11:40:35 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: ipsopt.c,v 2.1.4.5 2004/04/10 11:50:52 darrenr Exp $";
 #endif
 
 
@@ -98,7 +98,10 @@ char *class;
 			len += val;
 		} else
 			*op++ = io->on_siz;
-		*op++ = IPOPT_MINOFF;
+		if (io->on_value == IPOPT_TS)
+			*op++ = IPOPT_MINOFF + 1;
+		else
+			*op++ = IPOPT_MINOFF;
 
 		while (class && *class) {
 			t = NULL;
diff --git a/contrib/ipfilter/ipt.c b/contrib/ipfilter/ipt.c
index d33a38d..5a20f24 100644
--- a/contrib/ipfilter/ipt.c
+++ b/contrib/ipfilter/ipt.c
@@ -64,7 +64,7 @@
 
 #if !defined(lint)
 static const char sccsid[] = "@(#)ipt.c	1.19 6/3/96 (C) 1993-2000 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ipt.c,v 2.6.2.24 2002/12/06 11:40:26 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: ipt.c,v 2.6.2.26 2003/11/09 17:22:21 darrenr Exp $";
 #endif
 
 extern	char	*optarg;
@@ -72,7 +72,7 @@ extern	struct frentry	*ipfilter[2][2];
 extern	struct ipread	snoop, etherf, tcpd, pcap, iptext, iphex;
 extern	struct ifnet	*get_unit __P((char *, int));
 extern	void	init_ifp __P((void));
-extern	ipnat_t	*natparse __P((char *, int));
+extern	ipnat_t	*natparse __P((char *, int, int *));
 extern	int	fr_running;
 
 int	opts = 0;
@@ -310,6 +310,7 @@ char *file;
 	int     linenum, i;
 	void	*fr;
 	FILE	*fp;
+	int	parsestatus;
 
 	if (!strcmp(file, "-"))
 		fp = stdin;
@@ -346,7 +347,21 @@ char *file;
 		/* fake an `ioctl' call :) */
 
 		if ((opts & OPT_NAT) != 0) {
-			if (!(fr = natparse(line, linenum)))
+			parsestatus = 1;
+			fr = natparse(line, linenum, &parsestatus);
+			if (parsestatus != 0) {
+				if (*line) {
+					fprintf(stderr,
+					    "%d: syntax error in \"%s\"\n",
+					    linenum, line);
+				}
+				fprintf(stderr, "%s: %s error (%d), quitting\n",
+				    file,
+				    ((parsestatus < 0)? "parse": "internal"),
+				    parsestatus);
+				exit(1);
+			}
+			if (!fr)
 				continue;
 
 			if (rremove == 0) {
@@ -367,8 +382,19 @@ char *file;
 						fr, i);
 			}
 		} else {
-			if (!(fr = parse(line, linenum)))
+			fr = parse(line, linenum, &parsestatus);
+
+			if (parsestatus != 0) {
+			    fprintf(stderr, "%s: %s error (%d), quitting\n",
+				file,
+				((parsestatus < 0)? "parse": "internal"),
+				parsestatus);
+			    exit(1);
+			}
+
+			if (!fr) {
 				continue;
+			}
 
 			if (rremove == 0) {
 				i = IPL_EXTERN(ioctl)(0, SIOCADAFR,
diff --git a/contrib/ipfilter/kmem.c b/contrib/ipfilter/kmem.c
index 470d257..5723ba3 100644
--- a/contrib/ipfilter/kmem.c
+++ b/contrib/ipfilter/kmem.c
@@ -46,14 +46,14 @@
 
 #if !defined(lint)
 static const char sccsid[] = "@(#)kmem.c	1.4 1/12/96 (C) 1992 Darren Reed";
-static const char rcsid[] = "@(#)$Id: kmem.c,v 2.2.2.16 2002/12/06 11:40:27 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: kmem.c,v 2.2.2.18 2003/11/09 17:22:22 darrenr Exp $";
 #endif
 
 #ifdef	__sgi
 typedef	int 	kvm_t;
 
 static	int	kvm_fd = -1;
-static	char	*kvm_errstr;
+static	char	*kvm_errstr = NULL;
 
 kvm_t *kvm_open(kernel, core, swap, mode, errstr)
 char *kernel, *core, *swap;
@@ -79,8 +79,10 @@ size_t size;
 	int r;
 
 	if (lseek(*kvm, pos, 0) == -1) {
-		fprintf(stderr, "%s", kvm_errstr);
-		perror("lseek");
+		if (kvm_errstr != NULL) {
+			fprintf(stderr, "%s:", kvm_errstr);
+			perror("lseek");
+		}
 		return -1;
 	}
 
@@ -103,7 +105,7 @@ char	*kern, *core;
 		kvm_t *uk;
 	} k;
 
-	kvm_f = kvm_open(kern, core, NULL, O_RDONLY, "");
+	kvm_f = kvm_open(kern, core, NULL, O_RDONLY, NULL);
 	if (kvm_f == NULL)
 	    {
 		perror("openkmem:open");
diff --git a/contrib/ipfilter/man/ipf.5 b/contrib/ipfilter/man/ipf.5
index 8c7dac0..835d775 100644
--- a/contrib/ipfilter/man/ipf.5
+++ b/contrib/ipfilter/man/ipf.5
@@ -1,10 +1,10 @@
 .TH IPF 5
 .SH NAME
-ipf, ipf.conf \- IP packet filter rule syntax
+ipf, ipf.conf, ipf6.conf \- IP packet filter rule syntax
 .SH DESCRIPTION
 .PP
 A rule file for \fBipf\fP may have any name or even be stdin.  As
-\fBipfstat\fP produces parseable rules as output when displaying the internal
+\fBipfstat\fP produces parsable rules as output when displaying the internal
 kernel filter lists, it is quite plausible to use its output to feed back
 into \fBipf\fP.  Thus, to remove all filters on input packets, the following
 could be done:
@@ -37,7 +37,7 @@ log	= "log" [ "body" ] [ "first" ] [ "or-block" ] [ "level" loglevel ] .
 call	= "call" [ "now" ] function-name .
 skip	= "skip" decnumber .
 dup	= "dup-to" interface-name[":"ipaddr] .
-froute	= "fastroute" | "to" interface-name .
+froute	= "fastroute" | "to" interface-name[":"ipaddr] .
 protocol = "tcp/udp" | "udp" | "tcp" | "icmp" | decnumber .
 srcdst	= "all" | fromto .
 fromto	= "from" [ "!" ] object "to" [ "!" ] object .
@@ -116,7 +116,7 @@ below).
 Filters are installed by default at the end of the kernel's filter
 lists, prepending the rule with \fB@n\fP will cause it to be inserted
 as the n'th entry in the current list. This is especially useful when
-modifying and testing active filter rulesets. See ipf(1) for more
+modifying and testing active filter rulesets. See ipf(8) for more
 information.
 .SH ACTIONS
 .PP
@@ -136,7 +136,7 @@ with a rule which is being applied to TCP packets.  When using
 \fBreturn-icmp\fP or \fBreturn-icmp-as-dest\fP, it is possible to specify
 the actual unreachable `type'.  That is, whether it is a network
 unreachable, port unreachable or even administratively
-prohibitied. This is done by enclosing the ICMP code associated with
+prohibited. This is done by enclosing the ICMP code associated with
 it in parenthesis directly following \fBreturn-icmp\fP or
 \fBreturn-icmp-as-dest\fP as follows:
 .nf
@@ -386,7 +386,7 @@ against, e.g.:
 .TP
 .B icmp-type
 is only effective when used with \fBproto icmp\fP and must NOT be used
-in conjuction with \fBflags\fP.  There are a number of types, which can be
+in conjunction with \fBflags\fP.  There are a number of types, which can be
 referred to by an abbreviation recognised by this language, or the numbers
 with which they are associated can be used.  The most important from
 a security point of view is the ICMP redirect.
@@ -427,7 +427,7 @@ indicates that the rule should be put in group (number n) rather than group 0.
 .PP
 When a packet is logged, with either the \fBlog\fP action or option,
 the headers of the packet are written to the \fBipl\fP packet logging
-psuedo-device. Immediately following the \fBlog\fP keyword, the
+pseudo-device. Immediately following the \fBlog\fP keyword, the
 following qualifiers may be used (in order):
 .TP
 .B body
diff --git a/contrib/ipfilter/man/ipf.8 b/contrib/ipfilter/man/ipf.8
index 8688566..60261d2 100644
--- a/contrib/ipfilter/man/ipf.8
+++ b/contrib/ipfilter/man/ipf.8
@@ -112,7 +112,7 @@ the current interface status list.
 .TP
 .B \-z
 For each rule in the input file, reset the statistics for it to zero and
-display the statistics prior to them being zero'd.
+display the statistics prior to them being zeroed.
 .TP
 .B \-Z
 Zero global statistics held in the kernel for filtering only (this doesn't
diff --git a/contrib/ipfilter/man/ipfstat.8 b/contrib/ipfilter/man/ipfstat.8
index f641d59..c506a15 100644
--- a/contrib/ipfilter/man/ipfstat.8
+++ b/contrib/ipfilter/man/ipfstat.8
@@ -64,7 +64,7 @@ This option is only valid in combination with \fB\-t\fP. Limit the state top
 display to show only state entries whose destination IP address and port
 match the addport argument. The addrport specification is of the form
 ipaddress[,port].  The ipaddress and port should be either numerical or the
-string "any" (specifying any ip address resp. any port). If the \fB\-D\fP
+string "any" (specifying any IP address resp. any port). If the \fB\-D\fP
 option is not specified, it defaults to "\fB\-D\fP any,any".
 .TP
 .B \-f
@@ -140,7 +140,7 @@ kernel.
 Using the \fB\-t\fP option \fBipfstat\fP will enter the state top mode. In
 this mode the state table is displayed similar to the way \fBtop\fP displays
 the process table. The \fB\-C\fP, \fB\-D\fP, \fB\-P\fP, \fB\-S\fP and \fB\-T\fP 
-commandline options can be used to restrict the state entries that will be 
+command line options can be used to restrict the state entries that will be 
 shown and to specify the frequency of display updates.
 .PP
 In state top mode, the following keys can be used to influence the displayed
diff --git a/contrib/ipfilter/man/ipftest.1 b/contrib/ipfilter/man/ipftest.1
index e7cc13a..bbfbc0c 100644
--- a/contrib/ipfilter/man/ipftest.1
+++ b/contrib/ipfilter/man/ipftest.1
@@ -1,6 +1,6 @@
 .TH ipftest 1
 .SH NAME
-ipftest \- test packet filter rules with arbitary input.
+ipftest \- test packet filter rules with arbitrary input.
 .SH SYNOPSIS
 .B ipftest
 [
diff --git a/contrib/ipfilter/man/ipl.4 b/contrib/ipfilter/man/ipl.4
index 7c6d46e..0368f03 100644
--- a/contrib/ipfilter/man/ipl.4
+++ b/contrib/ipfilter/man/ipl.4
@@ -7,7 +7,7 @@ packet headers of packets you wish to log.  If a packet header is to be
 logged, the entire header is logged (including any IP options \- TCP/UDP
 options are not included when it calculates header size) or not at all.
 The packet contents are also logged after the header.  If the log reader
-is busy or otherwise unable to read log records, upto IPLLOGSIZE (8192 is the
+is busy or otherwise unable to read log records, up to IPLLOGSIZE (8192 is the
 default) bytes of data are stored.
 .PP
 Prepending every packet header logged is a structure containing information
diff --git a/contrib/ipfilter/man/ipmon.8 b/contrib/ipfilter/man/ipmon.8
index 6a40802..2827797 100644
--- a/contrib/ipfilter/man/ipmon.8
+++ b/contrib/ipfilter/man/ipmon.8
@@ -82,11 +82,11 @@ are displayed to the same output 'device' (stderr or syslog).
 .TP
 .B \-b
 For rules which log the body of a packet, generate hex output representing
-the packet contents afte the headers.
+the packet contents after the headers.
 .TP
 .B \-D
 Cause ipmon to turn itself into a daemon.  Using subshells or backgrounding
-of ipmon is not required to turn it into an orphan so it can run indefinately.
+of ipmon is not required to turn it into an orphan so it can run indefinitely.
 .TP
 .B "\-f <device>"
 specify an alternative device/file from which to read the log information
@@ -170,3 +170,5 @@ recorded data.
 .SH SEE ALSO
 ipl(4), ipf(8), ipfstat(8), ipnat(8)
 .SH BUGS
+.PP
+If you find any, please send email to me at darrenr@pobox.com
diff --git a/contrib/ipfilter/man/ipnat.5 b/contrib/ipfilter/man/ipnat.5
index fe45464..2bedd0c 100644
--- a/contrib/ipfilter/man/ipnat.5
+++ b/contrib/ipfilter/man/ipnat.5
@@ -12,16 +12,16 @@ map ::= mapit ifname fromto "->" dstipmask [ mapport ] mapoptions.
 mapblock ::= "map-block" ifname ipmask "->" ipmask [ ports ] mapoptions.
 redir ::= "rdr" ifname ipmask dport "->" ip [ "," ip ] rdrport rdroptions .
 
-dport ::= "port" portnum [ "-" portnum ] .
-ports ::= "ports" numports | "auto" .
-rdrport ::= "port" portnum .
+dport ::= "port" number [ "-" number ] .
+ports ::= "ports" number | "auto" .
+rdrport ::= "port" number .
 mapit ::= "map" | "bimap" .
 fromto ::= "from" object "to" object .
 ipmask ::= ip "/" bits | ip "/" mask | ip "netmask" mask .
 dstipmask ::= ipmask | "range" ip "-" ip .
 mapport ::= "portmap" tcpudp portspec .
 mapoptions ::= [ tcpudp ] [ "frag" ] [ age ] [ clamp ] .
-rdroptions ::= [ tcpudp ] [ rr ] [ "frag" ] [ age ] [ clamp ] .
+rdroptions ::= [ tcpudp | protocol ] [ rr ] [ "frag" ] [ age ] [ clamp ] .
 
 object  :: = addr [ port-comp | port-range ] .
 addr    :: = "any" | nummask | host-name [ "mask" ipaddr | "mask" hexnumber ] .
@@ -31,14 +31,14 @@ port-range :: = "port" port-num range port-num .
 rr ::= "round-robin" .
 age ::= "age" decnumber [ "/" decnumber ] .
 clamp ::= "mssclamp" decnumber .
-tcpudp ::= "tcp/udp" | protocol .
+tcpudp ::= "tcp/udp" | "tcp" | "udp" .
 
 protocol ::= protocol-name | decnumber .
-nummask ::= host-name [ "/" decnumber ] .
-portspec ::= "auto" | portnumber ":" portnumber .
-portnumber ::= number { numbers } .
+nummask ::= host-name [ "/" number ] .
+portspec ::= "auto" | number ":" number .
 ifname ::= 'A' - 'Z' { 'A' - 'Z' } numbers .
 
+number ::= numbers [ number ] .
 numbers ::= '0' | '1' | '2' | '3' | '4' | '5' | '6' | '7' | '8' | '9' .
 .fi
 .PP
@@ -134,9 +134,9 @@ If more refined timeouts are required than those available globally for
 NAT settings, this allows you to set them for \fBnon-TCP\fP use.
 .SH TRANSLATION
 .PP
-To the right of the "->" is the address and port specificaton which will be
+To the right of the "->" is the address and port specification which will be
 written into the packet providing it has already successful matched the
-prior constraints.  The case of redirections (\fBrdr\fP) is the simpliest:
+prior constraints.  The case of redirections (\fBrdr\fP) is the simplest:
 the new destination address is that specified in the rule.  For \fBmap\fP
 rules, the destination address will be one for which the tuple combining
 the new source and destination is known to be unique.  If the packet is
@@ -187,7 +187,7 @@ automatically, as required.  This will not effect the display of rules
 using "ipnat -l", only the internal application order.
 .SH EXAMPLES
 .PP
-This section deals with the \fBmap\fP command and it's variations.
+This section deals with the \fBmap\fP command and its variations.
 .PP
 To change IP#'s used internally from network 10 into an ISP provided 8 bit
 subnet at 209.1.2.0 through the ppp0 interface, the following would be used:
@@ -214,7 +214,7 @@ map ppp0 10.0.0.0/8 -> 209.1.2.0/24
 .fi
 .PP
 so that all TCP/UDP packets were port mapped and only other protocols, such as
-ICMP, only have their IP# changed.  In some instaces, it is more appropriate
+ICMP, only have their IP# changed.  In some instances, it is more appropriate
 to use the keyword \fBauto\fP in place of an actual range of port numbers if
 you want to guarantee simultaneous access to all within the given range.
 However, in the above case, it would default to 1 port per IP address, since
@@ -228,7 +228,7 @@ map ppp0 172.192.0.0/16 -> 209.1.2.0/24 portmap tcp/udp auto
 which would result in each IP address being given a small range of ports to
 use (252).  The problem here is that the \fBmap\fP directive tells the NAT
 code to use the next address/port pair available for an outgoing connection,
-resulting in no easily discernable relation between external addresses/ports
+resulting in no easily discernible relation between external addresses/ports
 and internal ones.  This is overcome by using \fBmap-block\fP as follows:
 .LP
 .nf
diff --git a/contrib/ipfilter/mln_ipl.c b/contrib/ipfilter/mln_ipl.c
index 35c0e28..b170940 100644
--- a/contrib/ipfilter/mln_ipl.c
+++ b/contrib/ipfilter/mln_ipl.c
@@ -220,7 +220,9 @@ static int ipl_remove()
 #ifdef OpenBSD
 		VOP_LOCK(nd.ni_vp, LK_EXCLUSIVE | LK_RETRY, curproc);
 #else
+# if !defined(__NetBSD_Version__) || (__NetBSD_Version__ < 106000000)
 		vn_lock(nd.ni_vp, LK_EXCLUSIVE | LK_RETRY);
+# endif
 #endif
 		VOP_LEASE(nd.ni_dvp, curproc, curproc->p_ucred, LEASE_WRITE);
 		(void) VOP_REMOVE(nd.ni_dvp, nd.ni_vp, &nd.ni_cnd);
diff --git a/contrib/ipfilter/natparse.c b/contrib/ipfilter/natparse.c
index d46107e..7246234 100644
--- a/contrib/ipfilter/natparse.c
+++ b/contrib/ipfilter/natparse.c
@@ -56,7 +56,7 @@ extern	char	*sys_errlist[];
 
 #if !defined(lint)
 static const char sccsid[] ="@(#)ipnat.c	1.9 6/5/96 (C) 1993 Darren Reed";
-static const char rcsid[] = "@(#)$Id: natparse.c,v 1.17.2.27 2002/12/06 11:40:27 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: natparse.c,v 1.17.2.29 2003/05/15 17:45:34 darrenr Exp $";
 #endif
 
 
@@ -68,7 +68,7 @@ extern	void	printnat __P((ipnat_t *, int));
 extern	int	countbits __P((u_32_t));
 extern	char	*proto;
 
-ipnat_t	*natparse __P((char *, int));
+ipnat_t	*natparse __P((char *, int, int *));
 void	natparsefile __P((int, char *, int));
 void	nat_setgroupmap __P((struct ipnat *));
 
@@ -98,10 +98,16 @@ ipnat_t *n;
 
 /*
  * Parse a line of input from the ipnat configuration file
+ *
+ * status:
+ *	< 0	error
+ *	= 0	OK
+ *	> 0	programmer error
  */
-ipnat_t *natparse(line, linenum)
+ipnat_t *natparse(line, linenum, status)
 char *line;
 int linenum;
+int *status;
 {
 	static ipnat_t ipn;
 	struct protoent *pr;
@@ -110,6 +116,7 @@ int linenum;
 	int i, cnt;
 	char *port1a = NULL, *port1b = NULL, *port2a = NULL;
 
+	*status = 100;		/* default to error */
 	proto = NULL;
 
 	/*
@@ -121,8 +128,10 @@ int linenum;
 		*s = '\0';
 	while (*line && isspace(*line))
 		line++;
-	if (!*line)
+	if (!*line) {
+		*status = 0;
 		return NULL;
+	}
 
 	bzero((char *)&ipn, sizeof(ipn));
 	cnt = 0;
@@ -137,6 +146,7 @@ int linenum;
 
 	if (cnt < 3) {
 		fprintf(stderr, "%d: not enough segments in line\n", linenum);
+		*status = -1;
 		return NULL;
 	}
 
@@ -156,6 +166,7 @@ int linenum;
 	else {
 		fprintf(stderr, "%d: unknown mapping: \"%s\"\n",
 			linenum, *cpp);
+		*status = -1;
 		return NULL;
 	}
 
@@ -174,12 +185,14 @@ int linenum;
 			cpp++;
 			if (strcasecmp(*cpp, "from")) {
 				fprintf(stderr, "Missing from after !\n");
+				*status = -1;
 				return NULL;
 			}
 			ipn.in_flags |= IPN_NOTSRC;
 		} else if (**cpp == '!') {
 			if (strcasecmp(*cpp + 1, "from")) {
 				fprintf(stderr, "Missing from after !\n");
+				*status = -1;
 				return NULL;
 			}
 			ipn.in_flags |= IPN_NOTSRC;
@@ -187,6 +200,7 @@ int linenum;
 		if ((ipn.in_flags & IPN_NOTSRC) &&
 		    (ipn.in_redir & (NAT_MAP|NAT_MAPBLK))) {
 			fprintf(stderr, "Cannot use '! from' with map\n");
+			*status = -1;
 			return NULL;
 		}
 
@@ -196,12 +210,14 @@ int linenum;
 			if (hostmask(&cpp, (u_32_t *)&ipn.in_srcip,
 				     (u_32_t *)&ipn.in_srcmsk, &ipn.in_sport,
 				     &ipn.in_scmp, &ipn.in_stop, linenum)) {
+				*status = -1;
 				return NULL;
 			}
 		} else {
 			if (hostmask(&cpp, (u_32_t *)&ipn.in_inip,
 				     (u_32_t *)&ipn.in_inmsk, &ipn.in_sport,
 				     &ipn.in_scmp, &ipn.in_stop, linenum)) {
+				*status = -1;
 				return NULL;
 			}
 		}
@@ -217,22 +233,26 @@ int linenum;
 		if (strcasecmp(*cpp, "to")) {
 			fprintf(stderr, "%d: unexpected keyword (%s) - to\n",
 				linenum, *cpp);
+			*status = -1;
 			return NULL;
 		}
 		if ((ipn.in_flags & IPN_NOTDST) &&
 		    (ipn.in_redir & (NAT_REDIRECT))) {
 			fprintf(stderr, "Cannot use '! to' with rdr\n");
+			*status = -1;
 			return NULL;
 		}
 
 		if (!*++cpp) {
 			fprintf(stderr, "%d: missing host after to\n", linenum);
+			*status = -1;
 			return NULL;
 		}
 		if (ipn.in_redir == NAT_REDIRECT) {
 			if (hostmask(&cpp, (u_32_t *)&ipn.in_outip,
 				     (u_32_t *)&ipn.in_outmsk, &ipn.in_dport,
 				     &ipn.in_dcmp, &ipn.in_dtop, linenum)) {
+				*status = -1;
 				return NULL;
 			}
 			ipn.in_pmin = htons(ipn.in_dport);
@@ -240,6 +260,7 @@ int linenum;
 			if (hostmask(&cpp, (u_32_t *)&ipn.in_srcip,
 				     (u_32_t *)&ipn.in_srcmsk, &ipn.in_dport,
 				     &ipn.in_dcmp, &ipn.in_dtop, linenum)) {
+				*status = -1;
 				return NULL;
 			}
 		}
@@ -247,30 +268,39 @@ int linenum;
 		s = *cpp;
 		if (!s) {
 			fprintf(stderr, "%d: short line\n", linenum);
+			*status = -1;
 			return NULL;
 		}
 		t = strchr(s, '/');
 		if (!t) {
 			fprintf(stderr, "%d: no netmask on LHS\n", linenum);
+			*status = -1;
 			return NULL;
 		}
 		*t++ = '\0';
 		if (ipn.in_redir == NAT_REDIRECT) {
-			if (hostnum((u_32_t *)&ipn.in_outip, s, linenum) == -1)
+			if (hostnum((u_32_t *)&ipn.in_outip, s, linenum) == -1){
+				*status = -1;
 				return NULL;
+			}
 			if (genmask(t, (u_32_t *)&ipn.in_outmsk) == -1) {
+				*status = -1;
 				return NULL;
 			}
 		} else {
-			if (hostnum((u_32_t *)&ipn.in_inip, s, linenum) == -1)
+			if (hostnum((u_32_t *)&ipn.in_inip, s, linenum) == -1) {
+				*status = -1;
 				return NULL;
+			}
 			if (genmask(t, (u_32_t *)&ipn.in_inmsk) == -1) {
+				*status = -1;
 				return NULL;
 			}
 		}
 		cpp++;
 		if (!*cpp) {
 			fprintf(stderr, "%d: short line\n", linenum);
+			*status = -1;
 			return NULL;
 		}
 	}
@@ -283,6 +313,7 @@ int linenum;
 		if (strcasecmp(*cpp, "port")) {
 			fprintf(stderr, "%d: missing fields - 1st port\n",
 				linenum);
+			*status = -1;
 			return NULL;
 		}
 
@@ -292,6 +323,7 @@ int linenum;
 			fprintf(stderr,
 				"%d: missing fields (destination port)\n",
 				linenum);
+			*status = -1;
 			return NULL;
 		}
 
@@ -319,10 +351,12 @@ int linenum;
 	 */
 	if (!*cpp) {
 		fprintf(stderr, "%d: missing fields (->)\n", linenum);
+		*status = -1;
 		return NULL;
 	}
 	if (strcmp(*cpp, "->")) {
 		fprintf(stderr, "%d: missing ->\n", linenum);
+		*status = -1;
 		return NULL;
 	}
 	cpp++;
@@ -330,6 +364,7 @@ int linenum;
 	if (!*cpp) {
 		fprintf(stderr, "%d: missing fields (%s)\n",
 			linenum, ipn.in_redir ? "destination" : "target");
+		*status = -1;
 		return NULL;
 	}
 
@@ -341,6 +376,7 @@ int linenum;
 				fprintf(stderr, "%d: missing fields (%s)\n",
 					linenum,
 					ipn.in_redir ? "destination":"target");
+				*status = -1;
 				return NULL;
 			}
 		}
@@ -358,6 +394,7 @@ int linenum;
 			fprintf(stderr,
 				"%d: desination range not specified\n",
 				linenum);
+			*status = -1;
 			return NULL;
 		}
 	} else if (ipn.in_redir != NAT_REDIRECT) {
@@ -371,6 +408,7 @@ int linenum;
 			fprintf(stderr,
 				"%d: missing fields (dest netmask)\n",
 				linenum);
+			*status = -1;
 			return NULL;
 		}
 		if (*dnetm == '/')
@@ -383,20 +421,25 @@ int linenum;
 			ipn.in_flags |= IPN_SPLIT;
 			*dnetm++ = '\0';
 		}
-		if (hostnum((u_32_t *)&ipn.in_inip, *cpp, linenum) == -1)
+		if (hostnum((u_32_t *)&ipn.in_inip, *cpp, linenum) == -1) {
+			*status = -1;
 			return NULL;
+		}
 #if SOLARIS
 		if (ntohl(ipn.in_inip) == INADDR_LOOPBACK) {
 			fprintf(stderr,
 				"localhost as destination not supported\n");
+			*status = -1;
 			return NULL;
 		}
 #endif
 	} else {
 		if (!strcmp(*cpp, ipn.in_ifname))
 			*cpp = "0";
-		if (hostnum((u_32_t *)&ipn.in_outip, *cpp, linenum) == -1)
+		if (hostnum((u_32_t *)&ipn.in_outip, *cpp, linenum) == -1) {
+			*status = -1;
 			return NULL;
+		}
 	}
 	cpp++;
 
@@ -406,6 +449,7 @@ int linenum;
 				fprintf(stderr,
 					"%d: expected \"ports\" - got \"%s\"\n",
 					linenum, *cpp);
+				*status = -1;
 				return NULL;
 			}
 			cpp++;
@@ -413,6 +457,7 @@ int linenum;
 				fprintf(stderr,
 					"%d: missing argument to \"ports\"\n",
 					linenum);
+				*status = -1;
 				return NULL;
 			}
 			if (!strcasecmp(*cpp, "auto"))
@@ -426,12 +471,14 @@ int linenum;
 		if (*cpp && (strrchr(*cpp, '/') != NULL)) {
 			fprintf(stderr, "%d: No netmask supported in %s\n",
 				linenum, "destination host for redirect");
+			*status = -1;
 			return NULL;
 		}
 
 		if (!*cpp) {
 			fprintf(stderr, "%d: Missing destination port %s\n",
 				linenum, "in redirect");
+			*status = -1;
 			return NULL;
 		}
 
@@ -440,6 +487,7 @@ int linenum;
 		if (strcasecmp(*cpp, "port")) {
 			fprintf(stderr, "%d: missing fields - 2nd port (%s)\n",
 				linenum, *cpp);
+			*status = -1;
 			return NULL;
 		}
 		cpp++;
@@ -447,6 +495,7 @@ int linenum;
 			fprintf(stderr,
 				"%d: missing fields (destination port)\n",
 				linenum);
+			*status = -1;
 			return NULL;
 		}
 
@@ -458,17 +507,25 @@ int linenum;
 	if (ipn.in_redir & (NAT_MAP|NAT_MAPBLK)) {
 		if (ipn.in_flags & IPN_IPRANGE) {
 			if (hostnum((u_32_t *)&ipn.in_outmsk, dnetm,
-				    linenum) == -1)
+				    linenum) == -1) {
+				*status = -1;
 				return NULL;
-		} else if (genmask(dnetm, (u_32_t *)&ipn.in_outmsk))
+			}
+		} else if (genmask(dnetm, (u_32_t *)&ipn.in_outmsk)) {
+			*status = -1;
 			return NULL;
+		}
 	} else {
 		if (ipn.in_flags & IPN_SPLIT) {
 			if (hostnum((u_32_t *)&ipn.in_inmsk, dnetm,
-				    linenum) == -1)
+				    linenum) == -1) {
+				*status = -1;
 				return NULL;
-		} else if (genmask("255.255.255.255", (u_32_t *)&ipn.in_inmsk))
+			}
+		} else if (genmask("255.255.255.255", (u_32_t *)&ipn.in_inmsk)){
+			*status = -1;
 			return NULL;
+		}
 		if (!*cpp) {
 			ipn.in_flags |= IPN_TCP; /* XXX- TCP only by default */
 			proto = "tcp";
@@ -494,6 +551,7 @@ int linenum;
 						fprintf(stderr,
 						"%d: Unknown protocol %s\n",
 							linenum, proto);
+						*status = -1;
 						return NULL;
 					} else
 						ipn.in_p = atoi(proto);
@@ -520,6 +578,7 @@ int linenum;
 					fprintf(stderr,
 						"%d: age with no parameters\n",
 						linenum);
+					*status = -1;
 					return NULL;
 				}
 
@@ -541,6 +600,7 @@ int linenum;
 					fprintf(stderr,
 					   "%d: mssclamp with no parameters\n",
 						linenum);
+					*status = -1;
 					return NULL;
 				}
 			}
@@ -549,26 +609,33 @@ int linenum;
 				fprintf(stderr,
 				"%d: extra junk at the end of the line: %s\n",
 					linenum, *cpp);
+				*status = -1;
 				return NULL;
 			}
 		}
 	}
 
 	if ((ipn.in_redir == NAT_REDIRECT) && !(ipn.in_flags & IPN_FILTER)) {
-		if (!portnum(port1a, &ipn.in_pmin, linenum))
+		if (!portnum(port1a, &ipn.in_pmin, linenum)) {
+			*status = -1;
 			return NULL;
+		}
 		ipn.in_pmin = htons(ipn.in_pmin);
 		if (port1b != NULL) {
-			if (!portnum(port1b, &ipn.in_pmax, linenum))
+			if (!portnum(port1b, &ipn.in_pmax, linenum)) {
+				*status = -1;
 				return NULL;
+			}
 			ipn.in_pmax = htons(ipn.in_pmax);
 		} else
 			ipn.in_pmax = ipn.in_pmin;
 	}
 
 	if ((ipn.in_redir & NAT_BIMAP) == NAT_REDIRECT) {
-		if (!portnum(port2a, &ipn.in_pnext, linenum))
+		if (!portnum(port2a, &ipn.in_pnext, linenum)) {
+			*status = -1;
 			return NULL;
+		}
 		ipn.in_pnext = htons(ipn.in_pnext);
 	}
 
@@ -586,13 +653,18 @@ int linenum;
 		ipn.in_flags |= IPN_FRAG;
 	}
 
-	if (!*cpp)
+	if (!*cpp) {
+		*status = 0;
 		return &ipn;
+	}
 
 	if (ipn.in_redir != NAT_BIMAP && !strcasecmp(*cpp, "proxy")) {
+		u_short pport;
+
 		if (ipn.in_redir == NAT_BIMAP) {
 			fprintf(stderr, "%d: cannot use proxy with bimap\n",
 				linenum);
+			*status = -1;
 			return NULL;
 		}
 		cpp++;
@@ -600,6 +672,7 @@ int linenum;
 			fprintf(stderr,
 				"%d: missing parameter for \"proxy\"\n",
 				linenum);
+			*status = -1;
 			return NULL;
 		}
 		dport = NULL;
@@ -610,6 +683,7 @@ int linenum;
 				fprintf(stderr,
 					"%d: missing parameter for \"port\"\n",
 					linenum);
+				*status = -1;
 				return NULL;
 			}
 
@@ -620,11 +694,13 @@ int linenum;
 				fprintf(stderr,
 					"%d: missing parameter for \"proxy\"\n",
 					linenum);
+				*status = -1;
 				return NULL;
 			}
 		} else {
 			fprintf(stderr,
 				"%d: missing keyword \"port\"\n", linenum);
+			*status = -1;
 			return NULL;
 		}
 
@@ -637,9 +713,17 @@ int linenum;
 		} else
 			ipn.in_p = 0;
 
-		if (dport && !portnum(dport, &ipn.in_dport, linenum))
+		if (dport && !portnum(dport, &pport, linenum))
 			return NULL;
-		ipn.in_dport = htons(ipn.in_dport);
+		if (ipn.in_dcmp != 0) {
+			if (pport != ipn.in_dport) {
+				fprintf(stderr,
+					"%d: mismatch in port numbers\n",
+					linenum);
+				return NULL;
+			}
+		} else
+			ipn.in_dport = htons(pport);
 
 		(void) strncpy(ipn.in_plabel, *cpp, sizeof(ipn.in_plabel));
 		cpp++;
@@ -648,6 +732,7 @@ int linenum;
 		if (ipn.in_redir == NAT_BIMAP) {
 			fprintf(stderr, "%d: cannot use portmap with bimap\n",
 				linenum);
+			*status = -1;
 			return NULL;
 		}
 		cpp++;
@@ -655,6 +740,7 @@ int linenum;
 			fprintf(stderr,
 				"%d: missing expression following portmap\n",
 				linenum);
+			*status = -1;
 			return NULL;
 		}
 
@@ -670,6 +756,7 @@ int linenum;
 			fprintf(stderr,
 				"%d: expected protocol name - got \"%s\"\n",
 				linenum, *cpp);
+			*status = -1;
 			return NULL;
 		}
 		proto = *cpp;
@@ -677,6 +764,7 @@ int linenum;
 
 		if (!*cpp) {
 			fprintf(stderr, "%d: no port range found\n", linenum);
+			*status = -1;
 			return NULL;
 		}
 
@@ -691,12 +779,15 @@ int linenum;
 				fprintf(stderr,
 					"%d: no port range in \"%s\"\n",
 					linenum, *cpp);
+				*status = -1;
 				return NULL;
 			}
 			*t++ = '\0';
 			if (!portnum(*cpp, &ipn.in_pmin, linenum) ||
-			    !portnum(t, &ipn.in_pmax, linenum))
+			    !portnum(t, &ipn.in_pmax, linenum)) {
+				*status = -1;
 				return NULL;
+			}
 			ipn.in_pmin = htons(ipn.in_pmin);
 			ipn.in_pmax = htons(ipn.in_pmax);
 			cpp++;
@@ -713,6 +804,7 @@ int linenum;
 		if (!*cpp) {
 			fprintf(stderr, "%d: age with no parameters\n",
 				linenum);
+			*status = -1;
 			return NULL;
 		}
 		ipn.in_age[0] = atoi(*cpp);
@@ -732,6 +824,7 @@ int linenum;
 		} else {
 			fprintf(stderr, "%d: mssclamp with no parameters\n",
 				linenum);
+			*status = -1;
 			return NULL;
 		}
 	}
@@ -739,8 +832,11 @@ int linenum;
 	if (*cpp) {
 		fprintf(stderr, "%d: extra junk at the end of the line: %s\n",
 			linenum, *cpp);
+		*status = -1;
 		return NULL;
 	}
+
+	*status = 0;
 	return &ipn;
 }
 
@@ -754,6 +850,7 @@ int opts;
 	ipnat_t	*np;
 	FILE	*fp;
 	int	linenum = 0;
+	int	parsestatus;
 
 	if (strcmp(file, "-")) {
 		if (!(fp = fopen(file, "r"))) {
@@ -770,11 +867,20 @@ int opts;
 		if ((s = strchr(line, '\n')))
 			*s = '\0';
 
-		if (!(np = natparse(line, linenum))) {
-			if (*line)
+		parsestatus = 1;
+		np = natparse(line, linenum, &parsestatus);
+		if (parsestatus != 0) {
+			if (*line) {
 				fprintf(stderr, "%d: syntax error in \"%s\"\n",
 					linenum, line);
-		} else {
+			}
+			fprintf(stderr, "%s: %s error (%d), quitting\n",
+			    file,
+			    ((parsestatus < 0)? "parse": "internal"),
+			    parsestatus);
+			exit(1);
+		}
+		if (np) {
 			if ((opts & OPT_VERBOSE) && np)
 				printnat(np, opts);
 			if (!(opts & OPT_NODO)) {
diff --git a/contrib/ipfilter/parse.c b/contrib/ipfilter/parse.c
index 1147ee1..0d8a617 100644
--- a/contrib/ipfilter/parse.c
+++ b/contrib/ipfilter/parse.c
@@ -68,10 +68,16 @@ extern	u_char	flags[];
 /* parse()
  *
  * parse a line read from the input filter rule file
+ *
+ * status:
+ *	< 0	error
+ *	= 0	OK
+ *	> 0	programmer error
  */
-struct	frentry	*parse(line, linenum)
+struct	frentry	*parse(line, linenum, status)
 char	*line;
 int     linenum;
+int	*status;	/* good, bad, or indifferent */
 {
 	static	struct	frentry	fil;
 	char	*cps[31], **cpp, *endptr, *s;
@@ -79,10 +85,14 @@ int     linenum;
 	int	i, cnt = 1, j, ch;
 	u_int	k;
 
+	*status = 100;	/* default to error */
+
 	while (*line && isspace(*line))
 		line++;
-	if (!*line)
+	if (!*line) {
+		*status = 0;
 		return NULL;
+	}
 
 	bzero((char *)&fil, sizeof(fil));
 	fil.fr_mip.fi_v = 0xf;
@@ -100,6 +110,7 @@ int     linenum;
 
 	if (cnt < 3) {
 		fprintf(stderr, "%d: not enough segments in line\n", linenum);
+		*status = -1;
 		return NULL;
 	}
 
@@ -143,6 +154,7 @@ int     linenum;
 					fprintf(stderr,
 					"%d: unrecognised icmp code %s\n",
 						linenum, *cpp + 20);
+					*status = -1;
 					return NULL;
 				}
 				fil.fr_icode = j;
@@ -172,6 +184,7 @@ int     linenum;
 		else {
 			fprintf(stderr, "%d: integer must follow skip\n",
 				linenum);
+			*status = -1;
 			return NULL;
 		}
 	} else if (!strcasecmp("log", *cpp)) {
@@ -190,8 +203,11 @@ int     linenum;
 		}
 		if (!strcasecmp(*(cpp+1), "level")) {
 			cpp++;
-			if (loglevel(cpp, &fil.fr_loglevel, linenum) == -1)
+			if (loglevel(cpp, &fil.fr_loglevel, linenum) == -1) {
+				/* NB loglevel prints its own error message */
+				*status = -1;
 				return NULL;
+			}
 			cpp++;
 		}
 	} else {
@@ -199,10 +215,12 @@ int     linenum;
 		 * Doesn't start with one of the action words
 		 */
 		fprintf(stderr, "%d: unknown keyword (%s)\n", linenum, *cpp);
+		*status = -1;
 		return NULL;
 	}
 	if (!*++cpp) {
 		fprintf(stderr, "%d: missing 'in'/'out' keyword\n", linenum);
+		*status = -1;
 		return NULL;
 	}
 
@@ -218,16 +236,19 @@ int     linenum;
 			fprintf(stderr,
 				"%d: Can only use return-icmp with 'in'\n",
 				linenum);
+			*status = -1;
 			return NULL;
 		} else if (fil.fr_flags & FR_RETRST) {
 			fprintf(stderr,
 				"%d: Can only use return-rst with 'in'\n", 
 				linenum);
+			*status = -1;
 			return NULL;
 		}
 	}
 	if (!*++cpp) {
 		fprintf(stderr, "%d: missing source specification\n", linenum);
+		*status = -1;
 		return NULL;
 	}
 
@@ -235,6 +256,7 @@ int     linenum;
 		if (!*++cpp) {
 			fprintf(stderr, "%d: missing source specification\n",
 				linenum);
+			*status = -1;
 			return NULL;
 		}
 		if (fil.fr_flags & FR_PASS)
@@ -254,14 +276,17 @@ int     linenum;
 				fprintf(stderr,
 					"%d: or-block must be used with pass\n",
 					linenum);
+				*status = -1;
 				return NULL;
 			}
 			fil.fr_flags |= FR_LOGORBLOCK;
 			cpp++;
 		}
 		if (*cpp && !strcasecmp(*cpp, "level")) {
-			if (loglevel(cpp, &fil.fr_loglevel, linenum) == -1)
+			if (loglevel(cpp, &fil.fr_loglevel, linenum) == -1) {
+				*status = -1;
 				return NULL;
+			}
 			cpp++;
 			cpp++;
 		}
@@ -271,6 +296,7 @@ int     linenum;
 		if (fil.fr_skip != 0) {
 			fprintf(stderr, "%d: cannot use skip with quick\n",
 				linenum);
+			*status = -1;
 			return NULL;
 		}
 		cpp++;
@@ -287,6 +313,7 @@ int     linenum;
 		if (!*++cpp) {
 			fprintf(stderr, "%d: interface name missing\n",
 				linenum);
+			*status = -1;
 			return NULL;
 		}
 
@@ -307,28 +334,35 @@ int     linenum;
 				fprintf(stderr,
 					"%d: %s can only be used with TCP\n",
 					linenum, "return-rst");
+				*status = -1;
 				return NULL;
 			}
+			*status = 0;
 			return &fil;
 		}
 
 		if (*cpp) {
 			if (!strcasecmp(*cpp, "dup-to") && *(cpp + 1)) {
 				cpp++;
-				if (to_interface(&fil.fr_dif, *cpp, linenum))
+				if (to_interface(&fil.fr_dif, *cpp, linenum)) {
+					*status = -1;
 					return NULL;
+				}
 				cpp++;
 			}
 			if (*cpp && !strcasecmp(*cpp, "to") && *(cpp + 1)) {
 				cpp++;
-				if (to_interface(&fil.fr_tif, *cpp, linenum))
+				if (to_interface(&fil.fr_tif, *cpp, linenum)) {
+					*status = -1;
 					return NULL;
+				}
 				cpp++;
 			} else if (*cpp && !strcasecmp(*cpp, "fastroute")) {
 				if (!(fil.fr_flags & FR_INQUE)) {
 					fprintf(stderr,
 						"can only use %s with 'in'\n",
 						"fastroute");
+					*status = -1;
 					return NULL;
 				}
 				fil.fr_flags |= FR_FASTROUTE;
@@ -366,6 +400,7 @@ int     linenum;
 	if (*cpp && !strcasecmp(*cpp, "tos")) {
 		if (!*++cpp) {
 			fprintf(stderr, "%d: tos missing value\n", linenum);
+			*status = -1;
 			return NULL;
 		}
 		fil.fr_tos = strtol(*cpp, NULL, 0);
@@ -377,6 +412,7 @@ int     linenum;
 		if (!*++cpp) {
 			fprintf(stderr, "%d: ttl missing hopcount value\n",
 				linenum);
+			*status = -1;
 			return NULL;
 		}
 		if (ratoi(*cpp, &i, 0, 255))
@@ -384,6 +420,7 @@ int     linenum;
 		else {
 			fprintf(stderr, "%d: invalid ttl (%s)\n",
 				linenum, *cpp);
+			*status = -1;
 			return NULL;
 		}
 		fil.fr_mip.fi_ttl = 0xff;
@@ -397,6 +434,7 @@ int     linenum;
 	if (*cpp && !strcasecmp(*cpp, "proto")) {
 		if (!*++cpp) {
 			fprintf(stderr, "%d: protocol name missing\n", linenum);
+			*status = -1;
 			return NULL;
 		}
 		proto = *cpp++;
@@ -412,6 +450,7 @@ int     linenum;
 				fprintf(stderr,
 					"%d: unknown protocol (%s)\n",
 					linenum, proto);
+				*status = -1;
 				return NULL;
 			}
 			if (p)
@@ -422,6 +461,7 @@ int     linenum;
 					fprintf(stderr,
 						"%d: unknown protocol (%s)\n",
 						linenum, proto);
+					*status = -1;
 					return NULL;		
 				}
 				fil.fr_proto = i;
@@ -433,6 +473,7 @@ int     linenum;
 	    ((fil.fr_flags & FR_RETMASK) == FR_RETRST)) {
 		fprintf(stderr, "%d: %s can only be used with TCP\n",
 			linenum, "return-rst");
+		*status = -1;
 		return NULL;
 	}
 
@@ -442,21 +483,26 @@ int     linenum;
 
 	if (!*cpp) {
 		fprintf(stderr, "%d: missing source specification\n", linenum);
+		*status = -1;
 		return NULL;
 	}
 	if (!strcasecmp(*cpp, "all")) {
 		cpp++;
-		if (!*cpp)
+		if (!*cpp) {
+			*status = 0;
 			return &fil;
+		}
 	} else {
 		if (strcasecmp(*cpp, "from")) {
 			fprintf(stderr, "%d: unexpected keyword (%s) - from\n",
 				linenum, *cpp);
+			*status = -1;
 			return NULL;
 		}
 		if (!*++cpp) {
 			fprintf(stderr, "%d: missing host after from\n",
 				linenum);
+			*status = -1;
 			return NULL;
 		}
 		if (!strcmp(*cpp, "!")) {
@@ -465,6 +511,7 @@ int     linenum;
 				fprintf(stderr,
 					"%d: missing host after from\n",
 					linenum);
+				*status = -1;
 				return NULL;
 			}
 		} else if (**cpp == '!') {
@@ -475,6 +522,7 @@ int     linenum;
 		if (hostmask(&cpp, (u_32_t *)&fil.fr_src,
 			     (u_32_t *)&fil.fr_smsk, &fil.fr_sport, &ch,
 			     &fil.fr_stop, linenum)) {
+			*status = -1;
 			return NULL;
 		}
 
@@ -484,12 +532,14 @@ int     linenum;
 			fprintf(stderr,
 				"%d: cannot use port and neither tcp or udp\n",
 				linenum);
+			*status = -1;
 			return NULL;
 		}
 
 		fil.fr_scmp = ch;
 		if (!*cpp) {
 			fprintf(stderr, "%d: missing to fields\n", linenum);
+			*status = -1;
 			return NULL;
 		}
 
@@ -499,10 +549,12 @@ int     linenum;
 		if (strcasecmp(*cpp, "to")) {
 			fprintf(stderr, "%d: unexpected keyword (%s) - to\n",
 				linenum, *cpp);
+			*status = -1;
 			return NULL;
 		}
 		if (!*++cpp) {
 			fprintf(stderr, "%d: missing host after to\n", linenum);
+			*status = -1;
 			return NULL;
 		}
 		ch = 0;
@@ -512,6 +564,7 @@ int     linenum;
 				fprintf(stderr,
 					"%d: missing host after from\n",
 					linenum);
+				*status = -1;
 				return NULL;
 			}
 		} else if (**cpp == '!') {
@@ -521,6 +574,7 @@ int     linenum;
 		if (hostmask(&cpp, (u_32_t *)&fil.fr_dst,
 			     (u_32_t *)&fil.fr_dmsk, &fil.fr_dport, &ch,
 			     &fil.fr_dtop, linenum)) {
+			*status = -1;
 			return NULL;
 		}
 		if ((ch != 0) && (fil.fr_proto != IPPROTO_TCP) &&
@@ -529,6 +583,7 @@ int     linenum;
 			fprintf(stderr,
 				"%d: cannot use port and neither tcp or udp\n",
 				linenum);
+			*status = -1;
 			return NULL;
 		}
 
@@ -542,20 +597,25 @@ int     linenum;
 	if (fil.fr_proto && (fil.fr_dcmp || fil.fr_scmp) &&
 	    fil.fr_proto != IPPROTO_TCP && fil.fr_proto != IPPROTO_UDP) {
 		fprintf(stderr, "%d: port operation on non tcp/udp\n", linenum);
+		*status = -1;
 		return NULL;
 	}
 	if (fil.fr_icmp && fil.fr_proto != IPPROTO_ICMP) {
 		fprintf(stderr, "%d: icmp comparisons on wrong protocol\n",
 			linenum);
+		*status = -1;
 		return NULL;
 	}
 
-	if (!*cpp)
+	if (!*cpp) {
+		*status = 0;
 		return &fil;
+	}
 
 	if (*cpp && !strcasecmp(*cpp, "flags")) {
 		if (!*++cpp) {
 			fprintf(stderr, "%d: no flags present\n", linenum);
+			*status = -1;
 			return NULL;
 		}
 		fil.fr_tcpf = tcp_flags(*cpp, &fil.fr_tcpfm, linenum);
@@ -567,8 +627,10 @@ int     linenum;
 	 */
 	if ((fil.fr_v == 4) && *cpp && (!strcasecmp(*cpp, "with") ||
 	     !strcasecmp(*cpp, "and")))
-		if (extras(&cpp, &fil, linenum))
+		if (extras(&cpp, &fil, linenum)) {
+			*status = -1;
 			return NULL;
+		}
 
 	/*
 	 * icmp types for use with the icmp protocol
@@ -579,10 +641,13 @@ int     linenum;
 			fprintf(stderr,
 				"%d: icmp with wrong protocol (%d)\n",
 				linenum, fil.fr_proto);
+			*status = -1;
 			return NULL;
 		}
-		if (addicmp(&cpp, &fil, linenum))
+		if (addicmp(&cpp, &fil, linenum)) {
+			*status = -1;
 			return NULL;
+		}
 		fil.fr_icmp = htons(fil.fr_icmp);
 		fil.fr_icmpm = htons(fil.fr_icmpm);
 	}
@@ -591,8 +656,10 @@ int     linenum;
 	 * Keep something...
 	 */
 	while (*cpp && !strcasecmp(*cpp, "keep"))
-		if (addkeep(&cpp, &fil, linenum))
+		if (addkeep(&cpp, &fil, linenum)) {
+			*status = -1;
 			return NULL;
+		}
 
 	/*
 	 * This is here to enforce the old interface binding behaviour.
@@ -614,10 +681,12 @@ int     linenum;
 		if (fil.fr_skip != 0) {
 			fprintf(stderr, "%d: cannot use skip with head\n",
 				linenum);
+			*status = -1;
 			return NULL;
 		}
 		if (!*++cpp) {
 			fprintf(stderr, "%d: head without group #\n", linenum);
+			*status = -1;
 			return NULL;
 		}
 		if (ratoui(*cpp, &k, 0, UINT_MAX))
@@ -625,6 +694,7 @@ int     linenum;
 		else {
 			fprintf(stderr, "%d: invalid group (%s)\n",
 				linenum, *cpp);
+			*status = -1;
 			return NULL;
 		}
 		cpp++;
@@ -637,6 +707,7 @@ int     linenum;
 		if (!*++cpp) {
 			fprintf(stderr, "%d: group without group #\n",
 				linenum);
+			*status = -1;
 			return NULL;
 		}
 		if (ratoui(*cpp, &k, 0, UINT_MAX))
@@ -644,6 +715,7 @@ int     linenum;
 		else {
 			fprintf(stderr, "%d: invalid group (%s)\n",
 				linenum, *cpp);
+			*status = -1;
 			return NULL;
 		}
 		cpp++;
@@ -657,6 +729,7 @@ int     linenum;
 		for (; *cpp; cpp++)
 			fprintf(stderr, "%s ", *cpp);
 		fprintf(stderr, "]\n");
+		*status = -1;
 		return NULL;
 	}
 
@@ -665,6 +738,7 @@ int     linenum;
 	 */
 	if ((fil.fr_tcpf || fil.fr_tcpfm) && fil.fr_proto != IPPROTO_TCP) {
 		fprintf(stderr, "%d: TCP protocol not specified\n", linenum);
+		*status = -1;
 		return NULL;
 	}
 	if (!(fil.fr_ip.fi_fl & FI_TCPUDP) && (fil.fr_proto != IPPROTO_TCP) &&
@@ -676,6 +750,7 @@ int     linenum;
 			fprintf(stderr,
 				"%d: port comparisons for non-TCP/UDP\n",
 				linenum);
+			*status = -1;
 			return NULL;
 		}
 	}
@@ -685,9 +760,11 @@ int     linenum;
 		fprintf(stderr,
 			"%d: must use 'with frags' with 'keep frags'\n",
 			linenum);
+		*status = -1;
 		return NULL;
 	}
 */
+	*status = 0;
 	return &fil;
 }
 
diff --git a/contrib/ipfilter/perl/Services b/contrib/ipfilter/perl/Services
index 4649727..401fff0 100644
--- a/contrib/ipfilter/perl/Services
+++ b/contrib/ipfilter/perl/Services
@@ -1993,7 +1993,7 @@
 7002 afs3-prserver users&groupsdatabase
 7003 afs3-vlserver volumelocationdatabase
 7004 afs3-kaserver AFS/Kerberosauthenticationservice
-7005 afs3-volser volumemanagmentserver
+7005 afs3-volser volumemanagementserver
 7006 afs3-errors errorinterpretationservice
 7007 afs3-bos basicoverseerprocess
 7008 afs3-update server-to-serverupdater
diff --git a/contrib/ipfilter/printnat.c b/contrib/ipfilter/printnat.c
index aa791eb..5a12b32 100644
--- a/contrib/ipfilter/printnat.c
+++ b/contrib/ipfilter/printnat.c
@@ -58,7 +58,7 @@ extern	char	*sys_errlist[];
 #endif
 
 #if !defined(lint)
-static const char rcsid[] = "@(#)$Id: printnat.c,v 1.1.2.13 2002/12/06 11:40:27 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: printnat.c,v 1.1.2.15 2003/03/22 15:31:49 darrenr Exp $";
 #endif
 
 
@@ -399,7 +399,6 @@ int opts;
 			       np->in_space, np->in_flags,
 			       np->in_pmax, np->in_use);
 	} else {
-		np->in_nextip.s_addr = htonl(np->in_nextip.s_addr);
 		if (!(np->in_flags & IPN_FILTER)) {
 			printf("%s/", inet_ntoa(np->in_in[0]));
 			bits = countbits(np->in_in[1].s_addr);
@@ -422,6 +421,8 @@ int opts;
 		}
 		if (*np->in_plabel) {
 			printf(" proxy port");
+			if (np->in_dcmp != 0)
+				np->in_dport = htons(np->in_dport);
 			if (np->in_dport != 0) {
 				if (pr != NULL)
 					sv = getservbyport(np->in_dport,
@@ -473,8 +474,12 @@ int opts;
 			printf(" age %d/%d", np->in_age[0], np->in_age[1]);
 		printf("\n");
 		if (opts & OPT_DEBUG) {
+			struct in_addr nip;
+
+			nip.s_addr = htonl(np->in_nextip.s_addr);
+
 			printf("\tspace %lu nextip %s pnext %d", np->in_space,
-			       inet_ntoa(np->in_nextip), np->in_pnext);
+			       inet_ntoa(nip), np->in_pnext);
 			printf(" flags %x use %u\n",
 			       np->in_flags, np->in_use);
 		}
diff --git a/contrib/ipfilter/printstate.c b/contrib/ipfilter/printstate.c
index 7362a5b..624493b 100644
--- a/contrib/ipfilter/printstate.c
+++ b/contrib/ipfilter/printstate.c
@@ -47,22 +47,26 @@ int opts;
 #else
 	PRINTF("\tpkts %ld bytes %ld", ips.is_pkts, ips.is_bytes);
 #endif
-	if (ips.is_p == IPPROTO_TCP)
+	if (ips.is_p == IPPROTO_TCP) {
 #if defined(NetBSD) && (NetBSD >= 199905) && (NetBSD < 1991011) || \
 (__FreeBSD_version >= 220000) || defined(__OpenBSD__)
-		PRINTF("\t%hu -> %hu %x:%x %u<<%d:%u<<%d",
+		PRINTF("\t%hu -> %hu %x:%x (max %x:%x)\n",
 			ntohs(ips.is_sport), ntohs(ips.is_dport),
 			ips.is_send, ips.is_dend,
+			ips.is_maxsend, ips.is_maxdend);
+		PRINTF("\t%u<<%d:%u<<%d",
 			ips.is_maxswin>>ips.is_swscale, ips.is_swscale,
 			ips.is_maxdwin>>ips.is_dwscale, ips.is_dwscale);
 #else
-		PRINTF("\t%hu -> %hu %x:%x %u<<%d:%u<<%d",
+		PRINTF("\t%hu -> %hu %x:%x (max %x:%x)\n",
 			ntohs(ips.is_sport), ntohs(ips.is_dport),
 			ips.is_send, ips.is_dend,
+			ips.is_maxsend, ips.is_maxdend);
+		PRINTF("\t%u<<%d:%u<<%d",
 			ips.is_maxswin>>ips.is_swscale, ips.is_swscale,
 			ips.is_maxdwin>>ips.is_dwscale, ips.is_dwscale);
 #endif
-	else if (ips.is_p == IPPROTO_UDP)
+	} else if (ips.is_p == IPPROTO_UDP)
 		PRINTF(" %hu -> %hu", ntohs(ips.is_sport),
 			ntohs(ips.is_dport));
 	else if (ips.is_p == IPPROTO_ICMP
diff --git a/contrib/ipfilter/test/Makefile b/contrib/ipfilter/test/Makefile
index c24ba46..a7a6c29 100644
--- a/contrib/ipfilter/test/Makefile
+++ b/contrib/ipfilter/test/Makefile
@@ -51,7 +51,7 @@ i1 i2 i3 i4 i5 i6 i7 i8 i9 i10 i11 i12:
 n1 n2 n3 n4 n5 n6 n7:
 	@/bin/sh ./nattest $@
 
-ni1 ni2 ni3 ni4 ni5:
+ni1 ni2 ni3 ni4 ni5 ni7 ni8 ni10 ni11:
 	@/bin/sh ./natipftest $@
 
 in1 in2 in3 in4:
diff --git a/contrib/ipfilter/test/README.TXT b/contrib/ipfilter/test/README.TXT
new file mode 100644
index 0000000..0b62145
--- /dev/null
+++ b/contrib/ipfilter/test/README.TXT
@@ -0,0 +1,30 @@
+The contents of this directory sub tree is dedicated to regression testing
+of IPFilter.
+
+The tests are broken down into these groups:
+f    - filter rule tests
+i    - parsing & printing test of ipf rules
+in   - parsing & printing test of ipnat rules
+ipv6 - ipv6 filter rule tests
+l    - logging test
+n    - NAT testing
+ni   - combined NAT & IPF tests
+
+      TEST
+f1  - block/pass, in/out.
+f2  - proto
+f3  - from IP#
+f4  - to #IP
+f5  - source port
+f6  - destination port
+f7  - icmp-type, code
+f8  - flags
+f9  - ipoptions
+f10 - ipoptions
+f11 - keep frag/state
+f12 - short/frag
+f13 - keep frag/state (fragmented packets)
+f14 - from !host, to !host
+f15 - groups
+f16 - skip
+f17 - TCP state transition on flags
diff --git a/contrib/ipfilter/test/expected/i11 b/contrib/ipfilter/test/expected/i11
index 9268c66..ddf8000 100644
--- a/contrib/ipfilter/test/expected/i11
+++ b/contrib/ipfilter/test/expected/i11
@@ -2,3 +2,4 @@ pass in on ed0(!) proto tcp from 127.0.0.1/32 to 127.0.0.1/32 port = 23 keep sta
 block in log first on lo0(!) proto tcp/udp from any to any keep state
 pass in proto udp from 127.0.0.1/32 to 127.0.0.1/32 port = 2049 keep frags
 pass in proto udp from 127.0.0.1/32 to 127.0.0.1/32 port = 53 keep state keep frags
+pass in proto tcp from any port > 1024 to 127.0.0.1/32 port = 25 keep state
diff --git a/contrib/ipfilter/test/expected/in1 b/contrib/ipfilter/test/expected/in1
index 73e39f9..c507db7 100644
--- a/contrib/ipfilter/test/expected/in1
+++ b/contrib/ipfilter/test/expected/in1
@@ -22,3 +22,4 @@ map ppp0 192.168.0.0/16 -> 0.0.0.0/32 portmap tcp 10000:19999 age 30/30
 map le0 0.0.0.0/0 -> 0.0.0.0/32 frag age 10/10
 map le0 192.168.0.0/16 -> range 203.1.1.23-203.1.3.45 frag age 10/20
 map ppp0 192.168.0.0/16 -> 0.0.0.0/32 portmap tcp 10000:19999 frag age 30/30
+map fxp0 from 192.168.0.0/18 to any port = ftp -> 1.2.3.4/32 proxy port ftp ftp/tcp
diff --git a/contrib/ipfilter/test/expected/ni1 b/contrib/ipfilter/test/expected/ni1
index 29eac73..724d38e 100644
--- a/contrib/ipfilter/test/expected/ni1
+++ b/contrib/ipfilter/test/expected/ni1
@@ -1,3 +1,4 @@
-4500 0028 4706 4000 0111 ced8 0606 0606 0404 0404 afc9 829e 0014 0b2d 0402 0000 3be5 468d 000a cfc3
-4500 0038 809a 0000 ff01 8f31 0303 0303 0202 0202 0b00 a537 0000 0000 4500 0028 4703 4000 0111 ef89 0202 0202 0404 0404 afc9 829e 0014 1d4f
+4500 0028 4706 4000 0111 1eac 0606 0606 0404 0404 afc9 829e 0014 6308 0402 0000 3be5 468d 000a cfc3
+4500 0038 809a 0000 ff01 3121 0303 0303 0202 0202 0b00 5773 0000 0000 4500 0028 4706 4000 0111 26b4 0202 0202 0404 0404 afc9 829e 0014 6b10
+4500 0044 809a 0000 ff01 3115 0303 0303 0202 0202 0b00 0131 0000 0000 4500 0028 4706 4000 0111 26b4 0202 0202 0404 0404 afc9 829e 0014 6b10 0402 0000 3be5 468d 000a cfc3
 -------------------------------
diff --git a/contrib/ipfilter/test/expected/ni10 b/contrib/ipfilter/test/expected/ni10
new file mode 100644
index 0000000..e784581
--- /dev/null
+++ b/contrib/ipfilter/test/expected/ni10
@@ -0,0 +1,5 @@
+4500 003c 4706 4000 ff06 20a2 0404 0404 0606 0606 5000 0050 0000 0001 0000 0000 a002 16d0 d0da 0000 0204 05b4 0402 080a 0047 fbb0 0000 0000 0103 0300
+4500 0038 809a 0000 ff01 2f1f 0202 0202 0404 0404 0303 acab 0000 0000 4500 003c 4706 4000 ff06 28aa 0404 0404 0202 0202 5000 0050 0000 0001
+4500 0058 809a 0000 ff01 2cfd 0303 0303 0404 0404 0303 113f 0000 0000 4500 003c 4706 4000 ff06 20a2 0404 0404 0606 0606 5000 0050 0000 0001 0000 0000 a002 16d0 d0da 0000 0204 05b4 0402 080a 0047 fbb0 0000 0000 0103 0300
+4500 0038 809a 0000 ff01 2b1b 0303 0303 0505 0505 0303 acab 0000 0000 4500 003c 4706 4000 ff06 28ab 0404 0404 0202 0201 5000 0050 0000 0001
+-------------------------------
diff --git a/contrib/ipfilter/test/expected/ni11 b/contrib/ipfilter/test/expected/ni11
new file mode 100644
index 0000000..8cc37f4
--- /dev/null
+++ b/contrib/ipfilter/test/expected/ni11
@@ -0,0 +1,5 @@
+4500 003c 4706 4000 ff06 2aac 0404 0404 0101 0101 5000 9d58 0000 0001 0000 0000 a002 16d0 3ddc 0000 0204 05b4 0402 080a 0047 fbb0 0000 0000 0103 0300
+4500 0038 809a 0000 ff01 271f 0a02 0202 0404 0404 0303 a7fb 0000 0000 4500 003c 4706 4000 ff06 20aa 0404 0404 0a02 0202 5000 0500 0000 0001
+4500 0058 809a 0000 ff01 2cfd 0303 0303 0404 0404 0303 0735 0000 0000 4500 003c 4706 4000 ff06 2aac 0404 0404 0101 0101 5000 9d58 0000 0001 0000 0000 a002 16d0 3ddc 0000 0204 05b4 0402 080a 0047 fbb0 0000 0000 0103 0300
+4500 0038 809a 0000 ff01 2b1b 0303 0303 0505 0505 0303 0fa3 0000 0000 4500 003c 4706 4000 ff06 2aab 0404 0404 0101 0102 5000 9d58 0000 0001
+-------------------------------
diff --git a/contrib/ipfilter/test/expected/ni2 b/contrib/ipfilter/test/expected/ni2
index b849e41..bf05cf0 100644
--- a/contrib/ipfilter/test/expected/ni2
+++ b/contrib/ipfilter/test/expected/ni2
@@ -1,10 +1,10 @@
-4510 002c bd0d 4000 3e06 ea1d 0101 0101 c0a8 0133 9c40 0077 a664 2485 0000 0000 6002 4000 2ca8 0000 0204 05b4
-4500 002c ce83 4000 7e06 98b7 c0a8 0133 0a01 0201 0077 05f6 fbdf 1a21 a664 2486 6012 2238 c0a8 0000 0204 05b4
-4510 0028 bd0e 4000 3e06 ea20 0101 0101 c0a8 0133 9c40 0077 a664 2486 fbdf 1a22 5010 4470 29e3 0000
-4500 005b cf83 4000 7e06 9788 c0a8 0133 0a01 0201 0077 05f6 fbdf 1a22 a664 2486 5018 2238 ce2a 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0a
-4510 0028 bd18 4000 3e06 ea16 0101 0101 c0a8 0133 9c40 0077 a664 2486 fbdf 1a55 5010 4470 29b0 0000
-4510 002e bd1e 4000 3e06 ea0a 0101 0101 c0a8 0133 9c40 0077 a664 2486 fbdf 1a55 5018 4470 1c98 0000 0000 0000 0d0a
-4500 0048 e383 4000 7e06 839b c0a8 0133 0a01 0201 0077 05f6 fbdf 1a55 a664 248c 5018 2232 d80a 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
-4500 05dc e483 4000 7e06 7d07 c0a8 0133 0a01 0201 0077 05f6 fbdf 1a75 a664 248c 5010 2232 9f2d 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 1111 2222 3331 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
-4500 0038 d71d 4000 4001 f0be 0101 0101 c0a8 0133 0304 348b 0000 05a0 4500 05dc e483 4000 7e06 8707 c0a8 0133 0101 0101 0077 9c40 fbdf 1a75
+4510 002c bd0d 4000 3e06 bbd1 0101 0101 c0a8 0133 9c40 0077 a664 2485 0000 0000 6002 4000 2ca8 0000 0204 05b4
+4500 002c ce83 4000 7e06 606b c0a8 0133 0a01 0201 0077 05f6 fbdf 1a21 a664 2486 6012 2238 c0a8 0000 0204 05b4
+4510 0028 bd0e 4000 3e06 bbd4 0101 0101 c0a8 0133 9c40 0077 a664 2486 fbdf 1a22 5010 4470 29e3 0000
+4500 005b cf83 4000 7e06 5f3c c0a8 0133 0a01 0201 0077 05f6 fbdf 1a22 a664 2486 5018 2238 ce2a 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0a
+4510 0028 bd18 4000 3e06 bbca 0101 0101 c0a8 0133 9c40 0077 a664 2486 fbdf 1a55 5010 4470 29b0 0000
+4510 002e bd1e 4000 3e06 bbbe 0101 0101 c0a8 0133 9c40 0077 a664 2486 fbdf 1a55 5018 4470 1c98 0000 0000 0000 0d0a
+4500 0048 e383 4000 7e06 4b4f c0a8 0133 0a01 0201 0077 05f6 fbdf 1a55 a664 248c 5018 2232 d80a 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
+4500 05dc e483 4000 7e06 44bb c0a8 0133 0a01 0201 0077 05f6 fbdf 1a75 a664 248c 5010 2232 9f2d 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 1111 2222 3331 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 1111 2222 3333 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
+4500 0038 d71d 4000 4001 9fca 0101 0101 c0a8 0133 0304 444f 0000 05a0 4500 05dc e483 4000 7e06 4ebb c0a8 0133 0101 0101 0077 9c40 fbdf 1a75
 -------------------------------
diff --git a/contrib/ipfilter/test/expected/ni3 b/contrib/ipfilter/test/expected/ni3
index cd0f5d9..cf535f3 100644
--- a/contrib/ipfilter/test/expected/ni3
+++ b/contrib/ipfilter/test/expected/ni3
@@ -1,4 +1,4 @@
-4500 003c 4706 4000 ff06 28aa 0606 0606 0404 0404 5000 0050 0000 0001 0000 0000 a002 16d0 d0da 0000 0204 05b4 0402 080a 0047 fbb0 0000 0000 0103 0300
-4500 0038 809a 0000 ff01 3323 0303 0303 0202 0202 0303 acab 0000 0000 4500 003c 4706 4000 ff06 28aa 0202 0202 0404 0404 5000 0050 0000 0001
-4500 0058 809a 0000 ff01 3303 0303 0303 0202 0202 0303 0937 0000 0000 4500 003c 4706 4000 ff06 28aa 0202 0202 0404 0404 5000 0050 0000 0001 0000 0000 a002 16d0 d8e2 0000 0204 05b4 0402 080a 0047 fbb0 0000 0000 0103 0300
+4500 003c 4706 4000 ff06 20a2 0606 0606 0404 0404 5000 0050 0000 0001 0000 0000 a002 16d0 d0da 0000 0204 05b4 0402 080a 0047 fbb0 0000 0000 0103 0300
+4500 0038 809a 0000 ff01 3121 0303 0303 0202 0202 0303 acab 0000 0000 4500 003c 4706 4000 ff06 28aa 0202 0202 0404 0404 5000 0050 0000 0001
+4500 0058 809a 0000 ff01 3101 0303 0303 0202 0202 0303 0937 0000 0000 4500 003c 4706 4000 ff06 28aa 0202 0202 0404 0404 5000 0050 0000 0001 0000 0000 a002 16d0 d8e2 0000 0204 05b4 0402 080a 0047 fbb0 0000 0000 0103 0300
 -------------------------------
diff --git a/contrib/ipfilter/test/expected/ni4 b/contrib/ipfilter/test/expected/ni4
index bd7179f..95382cd 100644
--- a/contrib/ipfilter/test/expected/ni4
+++ b/contrib/ipfilter/test/expected/ni4
@@ -1,4 +1,4 @@
-4500 003c 4706 4000 ff06 28aa 0606 0606 0404 0404 9c40 0050 0000 0001 0000 0000 a002 16d0 849a 0000 0204 05b4 0402 080a 0047 fbb0 0000 0000 0103 0300
-4500 0038 809a 0000 ff01 3323 0303 0303 0202 0202 0303 acab 0000 0000 4500 003c 4706 4000 ff06 28aa 0202 0202 0404 0404 5000 0050 0000 0001
-4500 0058 809a 0000 ff01 3303 0303 0303 0202 0202 0303 0937 0000 0000 4500 003c 4706 4000 ff06 28aa 0202 0202 0404 0404 5000 0050 0000 0001 0000 0000 a002 16d0 d8e2 0000 0204 05b4 0402 080a 0047 fbb0 0000 0000 0103 0300
+4500 003c 4706 4000 ff06 20a2 0606 0606 0404 0404 9c40 0050 0000 0001 0000 0000 a002 16d0 849a 0000 0204 05b4 0402 080a 0047 fbb0 0000 0000 0103 0300
+4500 0038 809a 0000 ff01 3121 0303 0303 0202 0202 0303 acab 0000 0000 4500 003c 4706 4000 ff06 28aa 0202 0202 0404 0404 5000 0050 0000 0001
+4500 0058 809a 0000 ff01 3101 0303 0303 0202 0202 0303 0937 0000 0000 4500 003c 4706 4000 ff06 28aa 0202 0202 0404 0404 5000 0050 0000 0001 0000 0000 a002 16d0 d8e2 0000 0204 05b4 0402 080a 0047 fbb0 0000 0000 0103 0300
 -------------------------------
diff --git a/contrib/ipfilter/test/expected/ni5 b/contrib/ipfilter/test/expected/ni5
index 74c615f..449c2c4 100644
--- a/contrib/ipfilter/test/expected/ni5
+++ b/contrib/ipfilter/test/expected/ni5
@@ -1,28 +1,28 @@
-4500 002c 10c9 4000 ff06 3289 0101 0101 96cb e002 8032 0015 bd6b c9c8 0000 0000 6002 2238 f5a2 0000 0204 05b4
+4500 002c 10c9 4000 ff06 f232 0101 0101 96cb e002 8032 0015 bd6b c9c8 0000 0000 6002 2238 f5a2 0000 0204 05b4
 4500 002c ffdd 4000 ef06 5374 96cb e002 c0a8 0103 0015 8032 3786 76c4 bd6b c9c9 6012 269c 8369 0000 0204 0584
-4500 0028 10ca 4000 ff06 328c 0101 0101 96cb e002 8032 0015 bd6b c9c9 3786 76c5 5010 269c 5aa0 0000
+4500 0028 10ca 4000 ff06 f235 0101 0101 96cb e002 8032 0015 bd6b c9c9 3786 76c5 5010 269c 5aa0 0000
 4500 006f ffde 4000 ef06 5330 96cb e002 c0a8 0103 0015 8032 3786 76c5 bd6b c9c9 5018 269c 967e 0000 3232 302d 636f 6f6d 6273 2e61 6e75 2e65 6475 2e61 7520 4e63 4654 5064 2053 6572 7665 7220 2866 7265 6520 6564 7563 6174 696f 6e61 6c20 6c69 6365 6e73 6529 2072 6561 6479 2e0d 0a
-4500 0028 10cb 4000 ff06 328b 0101 0101 96cb e002 8032 0015 bd6b c9c9 3786 770c 5010 269c 5a59 0000
+4500 0028 10cb 4000 ff06 f234 0101 0101 96cb e002 8032 0015 bd6b c9c9 3786 770c 5010 269c 5a59 0000
 ippr_ftp_server_valid:junk after cmd[220-Maintained by RSSS and RSPAS IT Staff (previously known as Coombs Comp]
 4500 00c7 ffdf 4000 ef06 52d7 96cb e002 c0a8 0103 0015 8032 3786 770c bd6b c9c9 5018 269c 1087 0000 3232 302d 0d0a 3232 302d 4d61 696e 7461 696e 6564 2062 7920 5253 5353 2061 6e64 2052 5350 4153 2049 5420 5374 6166 6620 2870 7265 7669 6f75 736c 7920 6b6e 6f77 6e20 6173 2043 6f6f 6d62 7320 436f 6d70 7574 696e 6720 556e 6974 290d 0a32 3230 2d41 6e79 2070 726f 626c 656d 7320 636f 6e74 6163 7420 6674 706d 6173 7465 7240 636f 6f6d 6273 2e61 6e75 2e65 6475 2e61 750d 0a32 3230 2d0d 0a32 3230 200d 0a
-4500 0028 10cc 4000 ff06 328a 0101 0101 96cb e002 8032 0015 bd6b c9c9 3786 77ab 5010 269c 59ba 0000
-4500 0038 10cd 4000 ff06 3279 0101 0101 96cb e002 8032 0015 bd6b c9c9 3786 77ab 5018 269c d1c5 0000 5553 4552 2061 6e6f 6e79 6d6f 7573 0d0a
+4500 0028 10cc 4000 ff06 f233 0101 0101 96cb e002 8032 0015 bd6b c9c9 3786 77ab 5010 269c 59ba 0000
+4500 0038 10cd 4000 ff06 f222 0101 0101 96cb e002 8032 0015 bd6b c9c9 3786 77ab 5018 269c d1c5 0000 5553 4552 2061 6e6f 6e79 6d6f 7573 0d0a
 4500 0028 ffe0 4000 ef06 5375 96cb e002 c0a8 0103 0015 8032 3786 77ab bd6b c9d9 5010 269c 9a00 0000
 4500 006c ffe1 4000 ef06 5330 96cb e002 c0a8 0103 0015 8032 3786 77ab bd6b c9d9 5018 269c b00f 0000 3333 3120 4775 6573 7420 6c6f 6769 6e20 6f6b 2c20 7365 6e64 2079 6f75 7220 636f 6d70 6c65 7465 2065 2d6d 6169 6c20 6164 6472 6573 7320 6173 2070 6173 7377 6f72 642e 0d0a
-4500 0028 10ce 4000 ff06 3288 0101 0101 96cb e002 8032 0015 bd6b c9d9 3786 77ef 5010 269c 5966 0000
-4500 0036 10cf 4000 ff06 3279 0101 0101 96cb e002 8032 0015 bd6b c9d9 3786 77ef 5018 269c 373f 0000 5041 5353 2061 7661 6c6f 6e40 0d0a
+4500 0028 10ce 4000 ff06 f231 0101 0101 96cb e002 8032 0015 bd6b c9d9 3786 77ef 5010 269c 5966 0000
+4500 0036 10cf 4000 ff06 f222 0101 0101 96cb e002 8032 0015 bd6b c9d9 3786 77ef 5018 269c 373f 0000 5041 5353 2061 7661 6c6f 6e40 0d0a
 4500 005f ffe2 4000 ef06 533c 96cb e002 c0a8 0103 0015 8032 3786 77ef bd6b c9e7 5018 269c 895e 0000 3233 302d 596f 7520 6172 6520 7573 6572 2023 3420 6f66 2035 3020 7369 6d75 6c74 616e 656f 7573 2075 7365 7273 2061 6c6c 6f77 6564 2e0d 0a
-4500 0028 10d0 4000 ff06 3286 0101 0101 96cb e002 8032 0015 bd6b c9e7 3786 7826 5010 269c 5921 0000
+4500 0028 10d0 4000 ff06 f22f 0101 0101 96cb e002 8032 0015 bd6b c9e7 3786 7826 5010 269c 5921 0000
 4500 0099 ffe3 4000 ef06 5301 96cb e002 c0a8 0103 0015 8032 3786 7826 bd6b c9e7 5018 269c d399 0000 3233 302d 0d0a 3233 302d 0d0a 3233 302d 4869 2e20 2057 6527 7265 2063 6c65 616e 696e 6720 7570 2e20 2041 6e79 2066 6565 6462 6163 6b20 6d6f 7374 2077 656c 636f 6d65 2e20 3130 2041 7567 2030 300d 0a32 3330 2d0d 0a32 3330 204c 6f67 6765 6420 696e 2061 6e6f 6e79 6d6f 7573 6c79 2e0d 0a
-4500 0028 10d1 4000 ff06 3285 0101 0101 96cb e002 8032 0015 bd6b c9e7 3786 7897 5010 269c 58b0 0000
-4500 0030 10d2 4000 ff06 327c 0101 0101 96cb e002 8032 0015 bd6b c9e7 3786 7897 5018 269c 86ae 0000 5459 5045 2049 0d0a
+4500 0028 10d1 4000 ff06 f22e 0101 0101 96cb e002 8032 0015 bd6b c9e7 3786 7897 5010 269c 58b0 0000
+4500 0030 10d2 4000 ff06 f225 0101 0101 96cb e002 8032 0015 bd6b c9e7 3786 7897 5018 269c 86ae 0000 5459 5045 2049 0d0a
 4500 0038 ffe4 4000 ef06 5361 96cb e002 c0a8 0103 0015 8032 3786 7897 bd6b c9ef 5018 269c 5fae 0000 3230 3020 5479 7065 206f 6b61 792e 0d0a
-4500 0028 10d3 4000 ff06 3283 0101 0101 96cb e002 8032 0015 bd6b c9ef 3786 78a7 5010 269c 5898 0000
-4500 003d 10d4 4000 ff06 3269 0101 0101 96cb e002 8032 0015 bd6b c9ef 3786 78a7 5018 269c 4b67 0000 504f 5254 2031 2c31 2c31 2c31 2c31 3238 2c35 310d 0a
+4500 0028 10d3 4000 ff06 f22c 0101 0101 96cb e002 8032 0015 bd6b c9ef 3786 78a7 5010 269c 5898 0000
+4500 003d 10d4 4000 ff06 f216 0101 0101 96cb e002 8032 0015 bd6b c9ef 3786 78a7 5018 269c 4b67 0000 504f 5254 2031 2c31 2c31 2c31 2c31 3238 2c35 310d 0a
 4500 0046 ffe5 4000 ef06 5352 96cb e002 c0a8 0103 0015 8032 3786 78a7 bd6b ca0c 5018 269c dbc3 0000 3230 3020 504f 5254 2063 6f6d 6d61 6e64 2073 7563 6365 7373 6675 6c2e 0d0a
-4500 0030 10d5 4000 ff06 3279 0101 0101 96cb e002 8032 0015 bd6b ca04 3786 78c5 5018 269c 866b 0000 5459 5045 2041 0d0a
+4500 0030 10d5 4000 ff06 f222 0101 0101 96cb e002 8032 0015 bd6b ca04 3786 78c5 5018 269c 866b 0000 5459 5045 2041 0d0a
 4500 0038 ffe6 4000 ef06 535f 96cb e002 c0a8 0103 0015 8032 3786 78c5 bd6b ca14 5018 269c 5f5b 0000 3230 3020 5479 7065 206f 6b61 792e 0d0a
-4500 002e 10d6 4000 ff06 327a 0101 0101 96cb e002 8032 0015 bd6b ca0c 3786 78d5 5018 269c a994 0000 4e4c 5354 0d0a
+4500 002e 10d6 4000 ff06 f223 0101 0101 96cb e002 8032 0015 bd6b ca0c 3786 78d5 5018 269c a994 0000 4e4c 5354 0d0a
 4500 002c ffe7 4000 ef06 536a 96cb e002 c0a8 0103 0014 8033 d9f8 11d4 0000 0000 6002 2238 d190 0000 0204 0584
 4500 002c 10d7 4000 ff06 327b c0a8 0103 96cb e002 8033 0014 bd78 5c12 d9f8 11d5 6012 02f8 d734 0000 0204 0584
 4500 0028 ffe8 4000 ef06 536d 96cb e002 c0a8 0103 0014 8033 d9f8 11d5 bd78 5c13 5010 269c cb1d 0000
@@ -34,14 +34,14 @@ ippr_ftp_server_valid:junk after cmd[220-Maintained by RSSS and RSPAS IT Staff (
 4500 0028 10da 4000 ff06 327c c0a8 0103 96cb e002 8033 0014 bd78 5c13 d9f8 1211 5010 6348 8e35 0000
 4500 0028 10db 4000 ff06 327b c0a8 0103 96cb e002 8033 0014 bd78 5c13 d9f8 1211 5011 6348 8e34 0000
 4500 0028 ffec 4000 ef06 5369 96cb e002 c0a8 0103 0014 8033 d9f8 1211 bd78 5c14 5010 269c cae0 0000
-4500 0028 10dc 4000 ff06 327a 0101 0101 96cb e002 8032 0015 bd6b ca12 3786 790a 5010 269c 5812 0000
+4500 0028 10dc 4000 ff06 f223 0101 0101 96cb e002 8032 0015 bd6b ca12 3786 790a 5010 269c 5812 0000
 4500 0040 ffed 4000 ef06 5350 96cb e002 c0a8 0103 0015 8032 3786 790a bd6b ca1a 5018 269c 7c9e 0000 3232 3620 4c69 7374 696e 6720 636f 6d70 6c65 7465 642e 0d0a
-4500 0030 10dd 4000 ff06 3271 0101 0101 96cb e002 8032 0015 bd6b ca12 3786 7922 5018 269c 85f8 0000 5459 5045 2049 0d0a
+4500 0030 10dd 4000 ff06 f21a 0101 0101 96cb e002 8032 0015 bd6b ca12 3786 7922 5018 269c 85f8 0000 5459 5045 2049 0d0a
 4500 0038 ffee 4000 ef06 5357 96cb e002 c0a8 0103 0015 8032 3786 7922 bd6b ca22 5018 269c 5ef0 0000 3230 3020 5479 7065 206f 6b61 792e 0d0a
-4500 0028 10de 4000 ff06 3278 0101 0101 96cb e002 8032 0015 bd6b ca1a 3786 7932 5010 269c 57e2 0000
-4500 002e 10df 4000 ff06 3271 0101 0101 96cb e002 8032 0015 bd6b ca1a 3786 7932 5018 269c b020 0000 5155 4954 0d0a
+4500 0028 10de 4000 ff06 f221 0101 0101 96cb e002 8032 0015 bd6b ca1a 3786 7932 5010 269c 57e2 0000
+4500 002e 10df 4000 ff06 f21a 0101 0101 96cb e002 8032 0015 bd6b ca1a 3786 7932 5018 269c b020 0000 5155 4954 0d0a
 4500 0036 ffef 4000 ef06 5358 96cb e002 c0a8 0103 0015 8032 3786 7932 bd6b ca28 5018 269c a93c 0000 3232 3120 476f 6f64 6279 652e 0d0a
-4500 0028 10e0 4000 ff06 3276 0101 0101 96cb e002 8032 0015 bd6b ca20 3786 7940 5011 269c 57cd 0000
+4500 0028 10e0 4000 ff06 f21f 0101 0101 96cb e002 8032 0015 bd6b ca20 3786 7940 5011 269c 57cd 0000
 4500 0028 fff0 4000 ef06 5365 96cb e002 c0a8 0103 0015 8032 3786 7940 bd6b ca28 5011 269c 981b 0000
 4500 0028 10e1 4000 ff06 3275 c0a8 0103 96cb e002 8032 0015 bd6b ca25 3786 7941 5010 269c 981e 0000
 4500 0028 fff1 4000 ef06 5364 96cb e002 c0a8 0103 0015 8032 3786 7941 bd6b ca29 5010 269c 981a 0000
diff --git a/contrib/ipfilter/test/expected/ni7 b/contrib/ipfilter/test/expected/ni7
new file mode 100644
index 0000000..d03ec58
--- /dev/null
+++ b/contrib/ipfilter/test/expected/ni7
@@ -0,0 +1,3 @@
+4500 0028 4706 4000 0111 1eac 0404 0404 0606 0606 afc9 829e 0014 6308 0402 0000 3be5 468d 000a cfc3
+4500 0038 809a 0000 ff01 2f1f 0202 0202 0404 0404 0b00 f91c 0000 0000 4500 0028 4706 4000 0111 26b4 0404 0404 0202 0202 afc9 829e 0014 c966
+-------------------------------
diff --git a/contrib/ipfilter/test/expected/ni8 b/contrib/ipfilter/test/expected/ni8
new file mode 100644
index 0000000..ebee8bc
--- /dev/null
+++ b/contrib/ipfilter/test/expected/ni8
@@ -0,0 +1,5 @@
+4500 003c 4706 4000 ff06 2aac 0404 0404 0101 0101 5000 9d58 0000 0001 0000 0000 a002 16d0 3ddc 0000 0204 05b4 0402 080a 0047 fbb0 0000 0000 0103 0300
+4500 0038 809a 0000 ff01 271f 0a02 0202 0404 0404 0303 a7fb 0000 0000 4500 003c 4706 4000 ff06 20aa 0404 0404 0a02 0202 5000 0500 0000 0001
+4500 0058 809a 0000 ff01 26ff 0a02 0202 0404 0404 0303 1137 0000 0000 4500 003c 4706 4000 ff06 20aa 0404 0404 0a02 0202 5000 0500 0000 0001 0000 0000 a002 16d0 cc32 0000 0204 05b4 0402 080a 0047 fbb0 0000 0000 0103 0300
+4500 0038 809a 0000 ff01 2b1b 0303 0303 0505 0505 0303 0fa3 0000 0000 4500 003c 4706 4000 ff06 2aab 0404 0404 0101 0102 5000 9d58 0000 0001
+-------------------------------
diff --git a/contrib/ipfilter/test/input/f12 b/contrib/ipfilter/test/input/f12
index 5d9c1de..682202f 100644
--- a/contrib/ipfilter/test/input/f12
+++ b/contrib/ipfilter/test/input/f12
@@ -1,35 +1,35 @@
 # 1.1.1.1,1025 -> 2.1.1.1,25 TTL=63 TCP DF  SYN
-45 00 0028 0000 4000 3f 06 0000 01010101 02010101
+45 00 0028 0000 4000 3f 06 36cd 01010101 02010101
 0401 0019 00000000 00000000 50 02 2000 0000 0000
 
 # 1.1.1.1,1025 -> 2.1.1.1,25 TTL=63 TCP DF  ACK
-45 00 0028 0000 4000 3f 06 0000 01010101 02010101
+45 00 0028 0000 4000 3f 06 36cd 01010101 02010101
 0401 0019 00000000 00000000 50 10 2000 0000 0000
 
 # 1.1.1.1,1025 -> 2.1.1.1,25 TTL=63 TCP DF MF FO=0 ACK
-45 00 0028 0000 6000 3f 06 0000 01010101 02010101
+45 00 0028 0000 6000 3f 06 16cd 01010101 02010101
 0401 0019 00000000 00000000 50 10 2000 0000 0000
 
 # 1.1.1.1,1025 -> 2.1.1.1,25 TTL=63 TCP DF FO=0
-45 00 001c 0000 6000 3f 06 0000 01010101 02010101
+45 00 001c 0000 6000 3f 06 16d9 01010101 02010101
 0401 0019 00000000
 
 # 1.1.1.1 -> 2.1.1.1 TTL=63 TCP DF FO=1 ACK
-45 00 001c 0000 6001 3f 06 0000 01010101 02010101
+45 00 001c 0000 6001 3f 06 16d8 01010101 02010101
 00000000 50 10 2000
 
 # 1.1.1.1 -> 2.1.1.1 TTL=63 UDP DF MF FO=0
-45 00 0014 0000 6000 3f 11 0000 01010101 02010101
+45 00 0014 0000 6000 3f 11 16d6 01010101 02010101
 
 # 1.1.1.1,53 -> 2.1.1.1,53 TTL=63 UDP MF FO=0
-45 00 0018 0000 2000 3f 11 0000 01010101 02010101
+45 00 0018 0000 2000 3f 11 56d2 01010101 02010101
 0035 0035
 
 # 1.1.1.1,1 -> 2.1.1.1,1 TTL=63 UDP MF FO=0
-45 00 001c 0000 2000 3f 11 0000 01010101 02010101
+45 00 001c 0000 2000 3f 11 56ce 01010101 02010101
 0001 0001 0004 0000
 
 # 1.1.1.1,53 -> 2.1.1.1,53 TTL=63 UDP MF FO=0
-45 00 001c 0000 2000 3f 11 0000 01010101 02010101
+45 00 001c 0000 2000 3f 11 56ce 01010101 02010101
 0035 0035 0004 0000
 
diff --git a/contrib/ipfilter/test/input/f13 b/contrib/ipfilter/test/input/f13
index ccd74a3..d1c04d8 100644
--- a/contrib/ipfilter/test/input/f13
+++ b/contrib/ipfilter/test/input/f13
@@ -1,51 +1,51 @@
 # 1.1.1.1,1025 -> 2.1.1.1,25 TTL=63 TCP DF,MF,FO=0  SYN
-45 00 0028 0001 4000 3f 06 0000 01010101 02010101
+45 00 0028 0001 4000 3f 06 36cc 01010101 02010101
 0401 0019 00000000 00000000 50 02 2000 0000 0000
 
 # 1.1.1.1,1025 -> 2.1.1.1,25 TTL=63 TCP MF  ACK
-45 00 0024 0002 2000 3f 06 0000 01010101 02010101
+45 00 0024 0002 2000 3f 06 56cf 01010101 02010101
 0401001900000000 0000000050102000
 
 # 1.1.1.1,1025 -> 2.1.1.1,25 TTL=63 TCP FO=2  ACK
-45 00 002c 0002 0002 3f 06 0000 01010101 02010101
+45 00 002c 0002 0002 3f 06 76c5 01010101 02010101
 0000000000010203 0405060708090a0b 0c0d0e0f10111213
 
 # 1.1.1.1,1025 -> 2.1.1.1,25 TTL=63 TCP DF MF FO=0 SYN
-45 00 0028 0003 6000 3f 06 0000 01010101 02010101
+45 00 0028 0003 6000 3f 06 16ca 01010101 02010101
 0401 0019 00000000 00000000 50 10 2000 0000 0000
 
 # 1.1.1.1,1025 -> 2.1.1.1,25 TTL=63 TCP DF FO=0
-45 00 001c 0004 6000 3f 06 0000 01010101 02010101
+45 00 001c 0004 6000 3f 06 16d5 01010101 02010101
 0401 0019 00000000
 
 # 1.1.1.1 -> 2.1.1.1 TTL=63 TCP DF FO=1 SYN
-45 00 001c 0005 6001 3f 06 0000 01010101 02010101
+45 00 001c 0005 6001 3f 06 16d3 01010101 02010101
 00000000 50 10 2000
 
 # 1.1.1.1 -> 2.1.1.1 TTL=63 UDP DF MF FO=0
-45 00 0014 0006 6000 3f 11 0000 01010101 02010101
+45 00 0014 0006 6000 3f 11 16d0 01010101 02010101
 
 # 1.1.1.1,53 -> 2.1.1.1,53 TTL=63 UDP MF FO=0
-45 00 0018 0007 2000 3f 11 0000 01010101 02010101
+45 00 0018 0007 2000 3f 11 56cb 01010101 02010101
 0035 0035
 
 # 1.1.1.1,53 -> 2.1.1.1,53 TTL=63 UDP MF FO=0
-45 00 001c 0008 2000 3f 11 0000 01010101 02010101
+45 00 001c 0008 2000 3f 11 56c6 01010101 02010101
 0035003500040000
 
 # 1.1.1.1,53 -> 2.1.1.1,54 TTL=63 UDP MF FO=0 (short)
-45 00 0018 0008 2000 3f 11 0000 01010101 02010101
+45 00 0018 0008 2000 3f 11 56ca 01010101 02010101
 00350036
 
 # 1.1.1.1,21 -> 2.1.1.1,54 TTL=63 UDP MF FO=0
-45 00 001c 0008 2000 3f 11 0000 01010101 02010101
+45 00 001c 0008 2000 3f 11 56c6 01010101 02010101
 0015003600040000
 
 # 1.1.1.1,21 -> 2.1.1.1,54 TTL=63 TCP MF FO=0
-45 00 001c 0008 2000 3f 06 0000 01010101 02010101
+45 00 001c 0008 2000 3f 06 56d1 01010101 02010101
 0015 0036 00000000 00000000 50 02 2000 0000 0000
 
 # 1.1.1.1 -> 2.1.1.1 TTL=63 UDP FO=1
-45 00 001c 0008 0001 3f 11 0000 01010101 02010101
+45 00 001c 0008 0001 3f 11 76c5 01010101 02010101
 0000000000000000
 
diff --git a/contrib/ipfilter/test/input/f17 b/contrib/ipfilter/test/input/f17
index 7ab1aab..1eba7e7 100644
--- a/contrib/ipfilter/test/input/f17
+++ b/contrib/ipfilter/test/input/f17
@@ -1,61 +1,61 @@
 # (1.1.1.1,54076,seq=0xbfd08989) -> (2.2.2.2,25,seq=0) SYN
 [out,ppp0]
-4500 003c 8262 0000 4006 8417 0101 0101
+4500 003c 8262 0000 4006 f254 0101 0101
 0202 0202 d33c 0019 bfd0 8989 0000 0000
-a002 4000 6190 0000 0204 05b4 0103 0300
+a002 4000 cfcd 0000 0204 05b4 0103 0300
 0101 080a 008e 17f7 0000 0000
 
 # (2.2.2.2,25,seq=0x40203436) -> (1.1.1.1,54076,seq=0xbfdfcbc9) ACK
 [in,ppp0]
-4500 003c 8262 0000 1106 b317 0202 0202
+4500 003c 8262 0000 1106 2155 0202 0202
 0101 0101 0019 d33c 4020 3436 bfdf cbc9
-5010 4000 fb0c 0000 0204 0584 0103 0300
+5010 4000 694a 0000 0204 0584 0103 0300
 0101 080a 008e 17f7 0000 0000
 
 # (1.1.1.1,54076,seq=0xbfd08989) -> (2.2.2.2,25,seq=0x0) SYN
 [out,ppp0]
-4500 003c 8265 0000 4006 8414 0101 0101
+4500 003c 8265 0000 4006 f251 0101 0101
 0202 0202 d33c 0019 bfd0 8989 0000 0000
-a002 4000 6185 0000 0204 05b4 0103 0300
+a002 4000 cfc2 0000 0204 05b4 0103 0300
 0101 080a 008e 1802 0000 0000
 
 # (2.2.2.2,25,seq=0xed674d4e) -> (1.1.1.1,54076,seq=0xbfd0898a) SYN-ACK
 [in,ppp0]
-4500 002c 7442 4000 2906 6947 0202 0202
+4500 002c 7442 4000 2906 d784 0202 0202
 0101 0101 0019 d33c ed67 4d4e bfd0 898a
-6012 2118 ab84 0000 0204 0584
+6012 2118 19c2 0000 0204 0584
 
 #
 # (2.2.2.2,25,seq=0xbfd0898a) -> (1.1.1.1,54076,seq=0xed674d4e) ACK
 [out,ppp0]
-4500 002c 8262 0000 4006 8417 0101 0101
+4500 002c 8262 0000 4006 f264 0101 0101
 0202 0202 d33c 0019 bfd0 898a ed67 4d4e
 5010 4000 6190 0000 0000
 
 # (1.1.1.1,54076,seq=0xcfd08989) -> (2.2.2.2,25,seq=0x0) SYN
 [out,ppp0]
-4500 003c 8265 0000 4006 8414 0101 0101
+4500 003c 8265 0000 4006 f251 0101 0101
 0202 0202 d33c 0019 cfd0 8989 0000 0000
-a002 4000 6185 0000 0204 05b4 0103 0300
+a002 4000 bfc2 0000 0204 05b4 0103 0300
 0101 080a 008e 1802 0000 0000
 
 # (1.1.1.1,54076,seq=0xcfd08989) -> (2.2.2.2,25,seq=0x0) SYN
 [out,ppp0]
-4500 003c 8266 0000 4006 8413 0101 0101
+4500 003c 8266 0000 4006 f250 0101 0101
 0202 0202 d33c 0019 cfd0 8989 0000 0000
-a002 4000 6185 0000 0204 05b4 0103 0300
+a002 4000 bfc2 0000 0204 05b4 0103 0300
 0101 080a 008e 1802 0000 0000
 
 # (2.2.2.2,25,seq=0xed674d4e) -> (1.1.1.1,54076,seq=0xcfd0898a) SYN-ACK
 [in,ppp0]
-4500 002c 7442 4000 2906 6947 0202 0202
+4500 002c 7442 4000 2906 d784 0202 0202
 0101 0101 0019 d33c ed67 4d4e cfd0 898a
-6012 2118 ab84 0000 0204 0584
+6012 2118 09c2 0000 0204 0584
 
 #
 # (2.2.2.2,25,seq=0xcfd0898a) -> (1.1.1.1,54076,seq=0xed674d4e) ACK
 [out,ppp0]
-4500 002c 8262 0000 4006 8417 0101 0101
+4500 002c 8262 0000 4006 f264 0101 0101
 0202 0202 d33c 0019 cfd0 898a ed67 4d4e
 5010 4000 6190 0000 0000
 
diff --git a/contrib/ipfilter/test/input/ni1 b/contrib/ipfilter/test/input/ni1
index a099f80..dc2f05e 100644
--- a/contrib/ipfilter/test/input/ni1
+++ b/contrib/ipfilter/test/input/ni1
@@ -1,6 +1,19 @@
 #v tos len id   off  ttl p sum  src       dst
 # ICMP timeout exceeded in reply to a ICMP packet going out.
-[out,df0] 45 00 0028 4706 4000 01 11 ced8 0202 0202 0404 0404 afc9 829e 0014 1335 0402 0000 3be5 468d 000a cfc3
+[out,df0]
+4500 0028 4706 4000 0111 26b4 0202 0202
+0404 0404 afc9 829e 0014 6b10 0402 0000
+3be5 468d 000a cfc3
 
-[in,df0] 45 00 0038 809a 0000 ff 01 8f31 0303 0303 0101 0101 0b00 ad3f 0000 0000 4500 0028 4703 4000 0111 e781 0606 0606 0404 0404 afc9 829e 0014 1547
+[in,df0]
+4500 0038 809a 0000 ff01 2919 0303 0303
+0606 0606 0b00 5f7b 0000 0000
+4500 0028 4706 4000 0111 1eac 0606 0606 0404 0404
+afc9 829e 0014 6308
+
+[in,df0]
+4500 0044 809a 0000 ff01 290d 0303 0303
+0606 0606 0b00 0939 0000 0000
+4500 0028 4706 4000 0111 1eac 0606 0606 0404 0404
+afc9 829e 0014 6308 0402 0000 3be5 468d 000a cfc3
 
diff --git a/contrib/ipfilter/test/input/ni10 b/contrib/ipfilter/test/input/ni10
new file mode 100644
index 0000000..041326f
--- /dev/null
+++ b/contrib/ipfilter/test/input/ni10
@@ -0,0 +1,19 @@
+#v tos len id   off  ttl p sum  src       dst
+# ICMP dest unreachable with 64 bits in payload (in reply to a TCP packet
+# going out)
+[in,df0] 45 00 00 3c 47 06 40 00 ff 06 28 aa 04 04 04 04 02 02 02 02 50 00 00 50 00 00 00 01 00 00 00 00 a0 02 16 d0 d8 e2 00 00 02 04 05 b4 04 02 08 0a 00 47 fb b0 00 00 00 00 01 03 03 00 
+
+[out,df0]
+4500 0038 809a 0000 ff01 2d1d 0303 0303 0404 0404
+0303 acab 0000 0000
+4500 003c 4706 4000 ff06 20a2 0404 0404 0606 0606
+5000 0050 0000 0001
+
+# ICMP dest unreachable with whole packet in payload (40 bytes = 320 bits)
+[out,df0] 45 00 00 58 80 9a 00 00 ff 01 2c fd 03 03 03 03 04 04 04 04 03 03 11 3f 00 00 00 00 45 00 00 3c 47 06 40 00 ff 06 20 a2 04 04 04 04 06 06 06 06 50 00 00 50 00 00 00 01 00 00 00 00 a0 02 16 d0 d0 da 00 00 02 04 05 b4 04 02 08 0a 00 47 fb b0 00 00 00 00 01 03 03 00
+
+[out,df0]
+4500 0038 809a 0000 ff01 2b1b 0303 0303 0505 0505
+0303 acab 0000 0000
+4500 003c 4706 4000 ff06 28ab 0404 0404 0202 0201 5000 0050 0000 0001
+
diff --git a/contrib/ipfilter/test/input/ni11 b/contrib/ipfilter/test/input/ni11
new file mode 100644
index 0000000..788e603
--- /dev/null
+++ b/contrib/ipfilter/test/input/ni11
@@ -0,0 +1,24 @@
+#v tos len id   off  ttl p sum  src       dst
+# ICMP dest unreachable with 64 bits in payload (in reply to a TCP packet
+# going out)
+[in,df0] 45 00 00 3c 47 06 40 00 ff 06 20 aa 04 04 04 04 0a 02 02 02 50 00 05 00 00 00 00 01 00 00 00 00 a0 02 16 d0 cc 32 00 00 02 04 05 b4 04 02 08 0a 00 47 fb b0 00 00 00 00 01 03 03 00 
+
+[out,df0]
+4500 0038 809a 0000 ff01 2d1d 0303 0303 0404 0404
+0303 0fa3 0000 0000
+4500 003c 4706 4000 ff06 2aac 0404 0404 0101 0101
+5000 9d58 0000 0001
+
+# ICMP dest unreachable with whole packet in payload (40 bytes = 320 bits)
+[out,df0]
+4500 0058 809a 0000 ff01 2cfd 0303 0303 0404 0404
+0303 0735 0000 0000
+4500 003c 4706 4000 ff06 2aac 0404 0404 0101 0101
+5000 9d58 0000 0001 0000 0000 a002 16d0 3ddc 0000
+0204 05b4 0402 080a 0047 fbb0 0000 0000 0103 0300
+
+[out,df0]
+4500 0038 809a 0000 ff01 2b1b 0303 0303 0505 0505
+0303 0fa3 0000 0000
+4500 003c 4706 4000 ff06 2aab 0404 0404 0101 0102 5000 9d58 0000 0001
+
diff --git a/contrib/ipfilter/test/input/ni2 b/contrib/ipfilter/test/input/ni2
index 3f7dbcb..b16cd02 100644
--- a/contrib/ipfilter/test/input/ni2
+++ b/contrib/ipfilter/test/input/ni2
@@ -1,27 +1,27 @@
 # Test of fragmentation required coming from the inside.
 [out,xl0]
-4510 002c bd0d 4000 3e06 ea1d
+4510 002c bd0d 4000 3e06 b1d1
 0a01 0201
 c0a8 0133
 05f6 0077 a664 2485 0000 0000
 6002 4000 b8f2 0000 0204 05b4
 
 [in,xl0]
-4500 002c ce83 4000 7e06 98b7
+4500 002c ce83 4000 7e06 606b
 c0a8 0133
 0a01 0201
 0077 05f6 fbdf 1a21 a664 2486
 6012 2238 c0a8 0000 0204 05b4 0000
 
 [out,xl0]
-4510 0028 bd0e 4000 3e06 ea20
+4510 0028 bd0e 4000 3e06 b1d4
 0a01 0201
 c0a8 0133
 05f6 0077 a664 2486 fbdf 1a22
 5010 4470 b62d 0000
 
 [in,xl0]
-4500 005b cf83 4000 7e06 9788
+4500 005b cf83 4000 7e06 5f3c
 c0a8 0133
 0a01 0201
 0077 05f6 fbdf 1a22 a664 2486
@@ -31,21 +31,21 @@ c0a8 0133
 0000 0000 0000 0000 0000 0a
 
 [out,xl0]
-4510 0028 bd18 4000 3e06 ea16
+4510 0028 bd18 4000 3e06 b1ca
 0a01 0201
 c0a8 0133
 05f6 0077 a664 2486 fbdf 1a55
 5010 4470 b5fa 0000
 
 [out,xl0]
-4510 002e bd1e 4000 3e06 ea0a
+4510 002e bd1e 4000 3e06 b1be
 0a01 0201
 c0a8 0133
 05f6 0077 a664 2486 fbdf 1a55
 5018 4470 a8e2 0000 0000 0000 0d0a
 
 [in,xl0]
-4500 0048 e383 4000 7e06 839b
+4500 0048 e383 4000 7e06 4b4f
 c0a8 0133
 0a01 0201
 0077 05f6 fbdf 1a55 a664 248c
@@ -54,7 +54,7 @@ c0a8 0133
 0000 0000 0000 0000
 
 [in,xl0]
-4500 05dc e483 4000 7e06 7d07
+4500 05dc e483 4000 7e06 44bb
 c0a8 0133
 0a01 0201
 0077 05f6 fbdf 1a75 a664 248c
@@ -152,10 +152,10 @@ c0a8 0133
 0000 0000 0000 0000 0000 0000
 
 [out,xl0]
-4500 0038 d71d 4000 4001 ce16
+4500 0038 d71d 4000 4001 7d22
 c0a8 6401
 c0a8 0133
-0304 cad5 0000 05a0 4500 05dc
-e483 4000 7e06 7d07 c0a8 0133 0a01 0201
+0304 da99 0000 05a0 4500 05dc
+e483 4000 7e06 44bb c0a8 0133 0a01 0201
 0077 05f6 fbdf 1a75
 
diff --git a/contrib/ipfilter/test/input/ni3 b/contrib/ipfilter/test/input/ni3
index 44aa663..feb4b29 100644
--- a/contrib/ipfilter/test/input/ni3
+++ b/contrib/ipfilter/test/input/ni3
@@ -3,8 +3,8 @@
 # going out)
 [out,df0] 45 00 00 3c 47 06 40 00 ff 06 28 aa 02 02 02 02 04 04 04 04 50 00 00 50 00 00 00 01 00 00 00 00 a0 02 16 d0 d8 e2 00 00 02 04 05 b4 04 02 08 0a 00 47 fb b0 00 00 00 00 01 03 03 00 
 
-[in,df0] 45 00 00 38 80 9a 00 00 ff 01 33 23 03 03 03 03 01 01 01 01 03 03 ac ab 00 00 00 00 45 00 00 3c 47 06 40 00 ff 06 20 a2 06 06 06 06 04 04 04 04 50 00 00 50 00 00 00 01
+[in,df0] 45 00 00 38 80 9a 00 00 ff 01 29 19 03 03 03 03 06 06 06 06 03 03 ac ac 00 00 00 00 45 00 00 3c 47 06 40 00 ff 06 20 a2 06 06 06 06 04 04 04 04 50 00 00 50 00 00 00 01
 
 # ICMP dest unreachable with whole packet in payload (40 bytes = 320 bits)
-[in,df0] 45 00 00 58 80 9a 00 00 ff 01 33 03 03 03 03 03 01 01 01 01 03 03 11 3f 00 00 00 00 45 00 00 3c 47 06 40 00 ff 06 20 a2 06 06 06 06 04 04 04 04 50 00 00 50 00 00 00 01 00 00 00 00 a0 02 16 d0 d0 da 00 00 02 04 05 b4 04 02 08 0a 00 47 fb b0 00 00 00 00 01 03 03 00
+[in,df0] 45 00 00 58 80 9a 00 00 ff 01 28 f9 03 03 03 03 06 06 06 06 03 03 11 3f 00 00 00 00 45 00 00 3c 47 06 40 00 ff 06 20 a2 06 06 06 06 04 04 04 04 50 00 00 50 00 00 00 01 00 00 00 00 a0 02 16 d0 d0 da 00 00 02 04 05 b4 04 02 08 0a 00 47 fb b0 00 00 00 00 01 03 03 00
 
diff --git a/contrib/ipfilter/test/input/ni4 b/contrib/ipfilter/test/input/ni4
index 445d7c8..b2be550 100644
--- a/contrib/ipfilter/test/input/ni4
+++ b/contrib/ipfilter/test/input/ni4
@@ -3,8 +3,8 @@
 # going out)
 [out,df0] 45 00 00 3c 47 06 40 00 ff 06 28 aa 02 02 02 02 04 04 04 04 50 00 00 50 00 00 00 01 00 00 00 00 a0 02 16 d0 d8 e2 00 00 02 04 05 b4 04 02 08 0a 00 47 fb b0 00 00 00 00 01 03 03 00 
 
-[in,df0] 45 00 00 38 80 9a 00 00 ff 01 33 23 03 03 03 03 01 01 01 01 03 03 60 6b 00 00 00 00 45 00 00 3c 47 06 40 00 ff 06 20 a2 06 06 06 06 04 04 04 04 9c 40 00 50 00 00 00 01
+[in,df0] 45 00 00 38 80 9a 00 00 ff 01 29 19 03 03 03 03 06 06 06 06 03 03 60 6c 00 00 00 00 45 00 00 3c 47 06 40 00 ff 06 20 a2 06 06 06 06 04 04 04 04 9c 40 00 50 00 00 00 01
 
 # ICMP dest unreachable with whole packet in payload (40 bytes = 320 bits)
-[in,df0] 45 00 00 58 80 9a 00 00 ff 01 33 03 03 03 03 03 01 01 01 01 03 03 11 3f 00 00 00 00 45 00 00 3c 47 06 40 00 ff 06 20 a2 06 06 06 06 04 04 04 04 9c 40 00 50 00 00 00 01 00 00 00 00 a0 02 16 d0 84 9a 00 00 02 04 05 b4 04 02 08 0a 00 47 fb b0 00 00 00 00 01 03 03 00
+[in,df0] 45 00 00 58 80 9a 00 00 ff 01 28 f9 03 03 03 03 06 06 06 06 03 03 11 3f 00 00 00 00 45 00 00 3c 47 06 40 00 ff 06 20 a2 06 06 06 06 04 04 04 04 9c 40 00 50 00 00 00 01 00 00 00 00 a0 02 16 d0 84 9a 00 00 02 04 05 b4 04 02 08 0a 00 47 fb b0 00 00 00 00 01 03 03 00
 
diff --git a/contrib/ipfilter/test/input/ni5 b/contrib/ipfilter/test/input/ni5
index b6ff31a..a8aec23 100644
--- a/contrib/ipfilter/test/input/ni5
+++ b/contrib/ipfilter/test/input/ni5
@@ -4,7 +4,7 @@
 6002 2238 35f9 0000 0204 05b4
 
 [in,ppp0]
-4500 002c ffdd 4000 ef06 5374 96cb e002
+4500 002c ffdd 4000 ef06 131e 96cb e002
 0101 0101 0015 8032 3786 76c4 bd6b c9c9
 6012 269c 4313 0000 0204 0584
 
@@ -14,7 +14,7 @@
 5010 269c 9af6 0000
 
 [in,ppp0]
-4500 006f ffde 4000 ef06 5330 96cb e002
+4500 006f ffde 4000 ef06 12da 96cb e002
 0101 0101 0015 8032 3786 76c5 bd6b c9c9
 5018 269c 5628 0000 3232 302d 636f 6f6d
 6273 2e61 6e75 2e65 6475 2e61 7520 4e63
@@ -28,7 +28,7 @@
 5010 269c 9aaf 0000
 
 [in,ppp0]
-4500 00c7 ffdf 4000 ef06 52d7 96cb e002
+4500 00c7 ffdf 4000 ef06 1281 96cb e002
 0101 0101 0015 8032 3786 770c bd6b c9c9
 5018 269c d030 0000 3232 302d 0d0a 3232
 302d 4d61 696e 7461 696e 6564 2062 7920
@@ -54,12 +54,12 @@
 6e79 6d6f 7573 0d0a
 
 [in,ppp0]
-4500 0028 ffe0 4000 ef06 5375 96cb e002
+4500 0028 ffe0 4000 ef06 131f 96cb e002
 0101 0101 0015 8032 3786 77ab bd6b c9d9
 5010 269c 59aa 0000
 
 [in,ppp0]
-4500 006c ffe1 4000 ef06 5330 96cb e002
+4500 006c ffe1 4000 ef06 12da 96cb e002
 0101 0101 0015 8032 3786 77ab bd6b c9d9
 5018 269c 6fb9 0000 3333 3120 4775 6573
 7420 6c6f 6769 6e20 6f6b 2c20 7365 6e64
@@ -79,7 +79,7 @@
 6c6f 6e40 0d0a
 
 [in,ppp0]
-4500 005f ffe2 4000 ef06 533c 96cb e002
+4500 005f ffe2 4000 ef06 12e6 96cb e002
 0101 0101 0015 8032 3786 77ef bd6b c9e7
 5018 269c 4908 0000 3233 302d 596f 7520
 6172 6520 7573 6572 2023 3420 6f66 2035
@@ -92,7 +92,7 @@
 5010 269c 9977 0000
 
 [in,ppp0]
-4500 0099 ffe3 4000 ef06 5301 96cb e002
+4500 0099 ffe3 4000 ef06 12ab 96cb e002
 0101 0101 0015 8032 3786 7826 bd6b c9e7
 5018 269c 9343 0000 3233 302d 0d0a 3233
 302d 0d0a 3233 302d 4869 2e20 2057 6527
@@ -114,7 +114,7 @@
 5018 269c c704 0000 5459 5045 2049 0d0a
 
 [in,ppp0]
-4500 0038 ffe4 4000 ef06 5361 96cb e002
+4500 0038 ffe4 4000 ef06 130b 96cb e002
 0101 0101 0015 8032 3786 7897 bd6b c9ef
 5018 269c 1f58 0000 3230 3020 5479 7065
 206f 6b61 792e 0d0a
@@ -132,7 +132,7 @@
 0a
 
 [in,ppp0]
-4500 0046 ffe5 4000 ef06 5352 96cb e002
+4500 0046 ffe5 4000 ef06 12fc 96cb e002
 0101 0101 0015 8032 3786 78a7 bd6b ca08
 5018 269c 9b71 0000 3230 3020 504f 5254
 2063 6f6d 6d61 6e64 2073 7563 6365 7373
@@ -144,7 +144,7 @@
 5018 269c c6bd 0000 5459 5045 2041 0d0a
 
 [in,ppp0]
-4500 0038 ffe6 4000 ef06 535f 96cb e002
+4500 0038 ffe6 4000 ef06 1309 96cb e002
 0101 0101 0015 8032 3786 78c5 bd6b ca10
 5018 269c 1f09 0000 3230 3020 5479 7065
 206f 6b61 792e 0d0a
@@ -155,7 +155,7 @@
 5018 269c e9e6 0000 4e4c 5354 0d0a
 
 [in,ppp0]
-4500 002c ffe7 4000 ef06 536a 96cb e002
+4500 002c ffe7 4000 ef06 1314 96cb e002
 0101 0101 0014 8033 d9f8 11d4 0000 0000
 6002 2238 913a 0000 0204 0584
 
@@ -165,12 +165,12 @@
 6012 02f8 d734 0000 0204 0584
 
 [in,ppp0]
-4500 0028 ffe8 4000 ef06 536d 96cb e002
+4500 0028 ffe8 4000 ef06 1317 96cb e002
 0101 0101 0014 8033 d9f8 11d5 bd78 5c13
 5010 269c 8ac7 0000
 
 [in,ppp0]
-4500 005d ffe9 4000 ef06 5337 96cb e002
+4500 005d ffe9 4000 ef06 12e1 96cb e002
 0101 0101 0015 8032 3786 78d5 bd6b ca16
 5018 269c ae7e 0000 3135 3020 4f70 656e
 696e 6720 4153 4349 4920 6d6f 6465 2064
@@ -183,7 +183,7 @@
 5010 6348 8e71 0000
 
 [in,ppp0]
-4500 0063 ffea 4000 ef06 5330 96cb e002
+4500 0063 ffea 4000 ef06 12da 96cb e002
 0101 0101 0014 8033 d9f8 11d5 bd78 5c13
 5018 269c 62bf 0000 636f 6f6d 6273 7061
 7065 7273 0d0a 6465 7074 730d 0a66 6f75
@@ -197,7 +197,7 @@
 5010 6348 8e36 0000
 
 [in,ppp0]
-4500 0028 ffeb 4000 ef06 536a 96cb e002
+4500 0028 ffeb 4000 ef06 1314 96cb e002
 0101 0101 0014 8033 d9f8 1210 bd78 5c13
 5011 269c 8a8b 0000
 
@@ -212,7 +212,7 @@
 5011 6348 8e34 0000
 
 [in,ppp0]
-4500 0028 ffec 4000 ef06 5369 96cb e002
+4500 0028 ffec 4000 ef06 1313 96cb e002
 0101 0101 0014 8033 d9f8 1211 bd78 5c14
 5010 269c 8a8a 0000
 
@@ -222,7 +222,7 @@
 5010 269c 9864 0000
 
 [in,ppp0]
-4500 0040 ffed 4000 ef06 5350 96cb e002
+4500 0040 ffed 4000 ef06 12fa 96cb e002
 0101 0101 0015 8032 3786 790a bd6b ca16
 5018 269c 3c4c 0000 3232 3620 4c69 7374
 696e 6720 636f 6d70 6c65 7465 642e 0d0a
@@ -233,7 +233,7 @@
 5018 269c c64a 0000 5459 5045 2049 0d0a
 
 [in,ppp0]
-4500 0038 ffee 4000 ef06 5357 96cb e002
+4500 0038 ffee 4000 ef06 1301 96cb e002
 0101 0101 0015 8032 3786 7922 bd6b ca1e
 5018 269c 1e9e 0000 3230 3020 5479 7065
 206f 6b61 792e 0d0a
@@ -249,7 +249,7 @@
 5018 269c f072 0000 5155 4954 0d0a
 
 [in,ppp0]
-4500 0036 ffef 4000 ef06 5358 96cb e002
+4500 0036 ffef 4000 ef06 1302 96cb e002
 0101 0101 0015 8032 3786 7932 bd6b ca24
 5018 269c 68ea 0000 3232 3120 476f 6f64
 6279 652e 0d0a
@@ -260,7 +260,7 @@
 5011 269c 981f 0000
 
 [in,ppp0]
-4500 0028 fff0 4000 ef06 5365 96cb e002
+4500 0028 fff0 4000 ef06 130f 96cb e002
 0101 0101 0015 8032 3786 7940 bd6b ca24
 5011 269c 57c9 0000
 
@@ -270,7 +270,7 @@
 5010 269c 981e 0000
 
 [in,ppp0]
-4500 0028 fff1 4000 ef06 5364 96cb e002
+4500 0028 fff1 4000 ef06 130e 96cb e002
 0101 0101 0015 8032 3786 7941 bd6b ca25
 5010 269c 57c8 0000
 
diff --git a/contrib/ipfilter/test/input/ni7 b/contrib/ipfilter/test/input/ni7
new file mode 100644
index 0000000..954bb7b
--- /dev/null
+++ b/contrib/ipfilter/test/input/ni7
@@ -0,0 +1,13 @@
+#v tos len id   off  ttl p sum  src       dst
+# ICMP timeout exceeded in reply to a ICMP packet coming in.
+[in,df0]
+4500 0028 4706 4000 0111 26b4 0404 0404
+0202 0202 afc9 829e 0014 6b10 0402 0000
+3be5 468d 000a cfc3
+
+[out,df0]
+4500 0038 809a 0000 ff01 2d1d 0303 0303
+0404 0404 0b00 0125 0000 0000
+4500 0028 4706 4000 0111 1eac 0404 0404 0606 0606
+afc9 829e 0014 c15e
+
diff --git a/contrib/ipfilter/test/input/ni8 b/contrib/ipfilter/test/input/ni8
new file mode 100644
index 0000000..788e603
--- /dev/null
+++ b/contrib/ipfilter/test/input/ni8
@@ -0,0 +1,24 @@
+#v tos len id   off  ttl p sum  src       dst
+# ICMP dest unreachable with 64 bits in payload (in reply to a TCP packet
+# going out)
+[in,df0] 45 00 00 3c 47 06 40 00 ff 06 20 aa 04 04 04 04 0a 02 02 02 50 00 05 00 00 00 00 01 00 00 00 00 a0 02 16 d0 cc 32 00 00 02 04 05 b4 04 02 08 0a 00 47 fb b0 00 00 00 00 01 03 03 00 
+
+[out,df0]
+4500 0038 809a 0000 ff01 2d1d 0303 0303 0404 0404
+0303 0fa3 0000 0000
+4500 003c 4706 4000 ff06 2aac 0404 0404 0101 0101
+5000 9d58 0000 0001
+
+# ICMP dest unreachable with whole packet in payload (40 bytes = 320 bits)
+[out,df0]
+4500 0058 809a 0000 ff01 2cfd 0303 0303 0404 0404
+0303 0735 0000 0000
+4500 003c 4706 4000 ff06 2aac 0404 0404 0101 0101
+5000 9d58 0000 0001 0000 0000 a002 16d0 3ddc 0000
+0204 05b4 0402 080a 0047 fbb0 0000 0000 0103 0300
+
+[out,df0]
+4500 0038 809a 0000 ff01 2b1b 0303 0303 0505 0505
+0303 0fa3 0000 0000
+4500 003c 4706 4000 ff06 2aab 0404 0404 0101 0102 5000 9d58 0000 0001
+
diff --git a/contrib/ipfilter/test/regress/i11 b/contrib/ipfilter/test/regress/i11
index c257f51..68e9283 100644
--- a/contrib/ipfilter/test/regress/i11
+++ b/contrib/ipfilter/test/regress/i11
@@ -2,3 +2,4 @@ pass in on ed0 proto tcp from localhost to localhost port = telnet keep state
 block in log first on lo0 proto tcp/udp from any to any keep state
 pass in proto udp from localhost to localhost port = 2049 keep frags
 pass in proto udp from localhost to localhost port = 53 keep state keep frags
+pass in proto tcp from any port gt 1024 to localhost port eq 25 keep state
diff --git a/contrib/ipfilter/test/regress/in1 b/contrib/ipfilter/test/regress/in1
index 6f3b063..59c5754 100644
--- a/contrib/ipfilter/test/regress/in1
+++ b/contrib/ipfilter/test/regress/in1
@@ -22,3 +22,4 @@ map ppp0 192.168.0.0/16 -> 0/32 portmap tcp 10000:19999 age 30
 map le0 0/0 -> 0/32 frag age 10
 map le0 192.168.0.0/16 -> range 203.1.1.23-203.1.3.45 frag age 10/20
 map ppp0 192.168.0.0/16 -> 0/32 portmap tcp 10000:19999 frag age 30
+map fxp0 from 192.168.0.0/18 to 0/0 port = 21 -> 1.2.3.4/32 proxy port 21 ftp/tcp
diff --git a/contrib/ipfilter/test/regress/ni10.ipf b/contrib/ipfilter/test/regress/ni10.ipf
new file mode 100644
index 0000000..4151b6e
--- /dev/null
+++ b/contrib/ipfilter/test/regress/ni10.ipf
@@ -0,0 +1,4 @@
+block in all
+block out all
+pass in proto udp from any to any keep state
+pass in proto tcp from any to any flags S keep state
diff --git a/contrib/ipfilter/test/regress/ni10.nat b/contrib/ipfilter/test/regress/ni10.nat
new file mode 100644
index 0000000..5257818
--- /dev/null
+++ b/contrib/ipfilter/test/regress/ni10.nat
@@ -0,0 +1 @@
+rdr df0 2.2.2.2/32 port 0 -> 6.6.6.6 port 0 ip
diff --git a/contrib/ipfilter/test/regress/ni11.ipf b/contrib/ipfilter/test/regress/ni11.ipf
new file mode 100644
index 0000000..4151b6e
--- /dev/null
+++ b/contrib/ipfilter/test/regress/ni11.ipf
@@ -0,0 +1,4 @@
+block in all
+block out all
+pass in proto udp from any to any keep state
+pass in proto tcp from any to any flags S keep state
diff --git a/contrib/ipfilter/test/regress/ni11.nat b/contrib/ipfilter/test/regress/ni11.nat
new file mode 100644
index 0000000..87e9673
--- /dev/null
+++ b/contrib/ipfilter/test/regress/ni11.nat
@@ -0,0 +1 @@
+rdr df0 10.0.0.0/8 port 1000-2000 -> 1.1.1.1 port 40000 tcp/udp
diff --git a/contrib/ipfilter/test/regress/ni7.ipf b/contrib/ipfilter/test/regress/ni7.ipf
new file mode 100644
index 0000000..4151b6e
--- /dev/null
+++ b/contrib/ipfilter/test/regress/ni7.ipf
@@ -0,0 +1,4 @@
+block in all
+block out all
+pass in proto udp from any to any keep state
+pass in proto tcp from any to any flags S keep state
diff --git a/contrib/ipfilter/test/regress/ni7.nat b/contrib/ipfilter/test/regress/ni7.nat
new file mode 100644
index 0000000..5257818
--- /dev/null
+++ b/contrib/ipfilter/test/regress/ni7.nat
@@ -0,0 +1 @@
+rdr df0 2.2.2.2/32 port 0 -> 6.6.6.6 port 0 ip
diff --git a/contrib/ipfilter/test/regress/ni8.ipf b/contrib/ipfilter/test/regress/ni8.ipf
new file mode 100644
index 0000000..6666241
--- /dev/null
+++ b/contrib/ipfilter/test/regress/ni8.ipf
@@ -0,0 +1 @@
+pass in quick proto tcp from any to any flags S/SAFR keep state
diff --git a/contrib/ipfilter/test/regress/ni8.nat b/contrib/ipfilter/test/regress/ni8.nat
new file mode 100644
index 0000000..87e9673
--- /dev/null
+++ b/contrib/ipfilter/test/regress/ni8.nat
@@ -0,0 +1 @@
+rdr df0 10.0.0.0/8 port 1000-2000 -> 1.1.1.1 port 40000 tcp/udp
diff --git a/contrib/ipfilter/test/vfycksum.pl b/contrib/ipfilter/test/vfycksum.pl
new file mode 100755
index 0000000..b6a2076
--- /dev/null
+++ b/contrib/ipfilter/test/vfycksum.pl
@@ -0,0 +1,264 @@
+
+#
+# validate the IPv4 header checksum.
+# $bytes[] is an array of 16bit values, with $cnt elements in the array.
+#
+sub dosum {
+	local($seed) = $_[0];
+	local($start) = $_[1];
+	local($max) = $_[2];
+	local($idx) = $start;
+	local($lsum) = $seed;
+
+	for ($idx = $start, $lsum = $seed; $idx < $max; $idx++) {
+		$lsum += $bytes[$idx];
+	}
+	while ($lsum > 65535) {
+		$lsum = ($lsum & 0xffff) + ($lsum >> 16);
+	}
+	$lsum = ~$lsum & 0xffff;
+	return $lsum;
+}
+
+sub ipv4check {
+	local($base) = $_[0];
+	$hl = $bytes[$base] / 256;
+	return if (($hl >> 4) != 4);	# IPv4 ?
+	$hl &= 0xf;
+	$hl <<= 1;			# get the header length in 16bit words
+
+	$hs = &dosum(0, $base, $base + $hl);
+	$osum = $bytes[$base + 5];
+
+	if ($hs != 0) {
+		$bytes[$base + 5] = 0;
+		$hs2 = &dosum($base, 0, $base + $hl);
+		$bytes[$base + 5] = $osum;
+		printf " IP: (%x) %x != %x", $hs, $osum, $hs2;
+	} else {
+		print " IP($base): ok ";
+	}
+
+	#
+	# Recognise TCP & UDP and calculate checksums for each of these.
+	#
+	if (($bytes[$base + 4] & 0xff) == 6) {
+		&tcpcheck($base);
+	}
+
+	if (($bytes[$base + 4] & 0xff) == 17) {
+		&udpcheck($base);
+	}
+
+	if (($bytes[$base + 4] & 0xff) == 1) {
+		&icmpcheck($base);
+	}
+	if ($base == 0) {
+		print "\n";
+	}
+}
+
+sub tcpcheck {
+	local($base) = $_[0];
+	local($hl) = $bytes[$base] / 256;
+	return if (($hl >> 4) != 4);
+	return if ($bytes[3] & 0x1fff);
+	$hl &= 0xf;
+	$hl <<= 1;
+
+	local($hs2);
+	local($hs) = 6;	# TCP
+	local($len) = $bytes[$base + 1] - ($hl << 1);
+	$hs += $len;
+	$hs += $bytes[$base + 6];	# source address
+	$hs += $bytes[$base + 7];
+	$hs += $bytes[$base + 8];	# destination address
+	$hs += $bytes[$base + 9];
+	local($tcpsum) = $hs;
+
+	local($thl) = $bytes[$base + $hl + 6] >> 8;
+	$thl &= 0xf0;
+	$thl >>= 2;
+	if (($bytes[$base + 1] > ($cnt - $base) * 2) ||
+	    (($cnt - $base) * 2 < $hl + 20) ||
+	    (($cnt - $base) * 2 < $hl + $thl)) {
+		print " TCP: missing data";
+		return;
+	}
+
+	local($tcpat) = $base + $hl;
+	$hs = &dosum($tcpsum, $tcpat, $cnt);
+	if ($hs != 0) {
+		local($osum) = $bytes[$tcpat + 8];
+		$bytes[$base + $hl + 8] = 0;
+		$hs2 = &dosum($tcpsum, $tcpat, $cnt);
+		$bytes[$tcpat + 8] = $osum;
+		printf " TCP: (%x) %x != %x", $hs, $osum, $hs2;
+	} else {
+		print " TCP: ok";
+	}
+}
+
+sub udpcheck {
+	local($base) = $_[0];
+	local($hl) = $bytes[0] / 256;
+	return if (($hl >> 4) != 4);
+	return if ($bytes[3] & 0x1fff);
+	$hl &= 0xf;
+	$hl <<= 1;
+
+	local($hs2);
+	local($hs) = 17;	# UDP
+	local($len) = $bytes[$base + 1] - ($hl << 1);
+	$hs += $len;
+	$hs += $bytes[$base + 6];	# source address
+	$hs += $bytes[$base + 7];
+	$hs += $bytes[$base + 8];	# destination address
+	$hs += $bytes[$base + 9];
+	local($udpsum) = $hs;
+
+	if ($bytes[$base + 1] > ($cnt - $base) * 2) {
+		print " UDP: missing data(1)";
+		return;
+	} elsif ($bytes[$base + 1] < ($hl << 1) + 8) {
+		print " UDP: missing data(2)";
+		return;
+	} elsif (($cnt - $base) * 2 < ($hl << 1) + 8) {
+		print " UDP: missing data(3)";
+		return;
+	}
+
+	local($udpat) = $base + $hl;
+	$hs = &dosum($udpsum, $udpat, $cnt);
+	local($osum) = $bytes[$udpat + 3];
+
+	#
+	# It is valid for UDP packets to have a 0 checksum field.
+	# If it is 0, then display what it would otherwise be.
+	#
+	if ($osum == 0) {
+		printf " UDP: => %x", $hs;
+	} elsif ($hs != 0) {
+		$bytes[$udpat + 3] = 0;
+		$hs2 = &dosum($udpsum, $udpat, $cnt);
+		$bytes[$udpat + 3] = $osum;
+		printf " UDP: (%x) %x != %x", $hs, $osum, $hs2;
+	} else {
+		print " UDP: ok";
+	}
+}
+
+sub icmpcheck {
+	local($base) = $_[0];
+	local($hl) = $bytes[$base + 0] / 256;
+	return if (($hl >> 4) != 4);
+	return if ($bytes[3] & 0x1fff);
+	$hl &= 0xf;
+	$hl <<= 1;
+
+	local($hs);
+	local($hs2);
+
+	local($len) = $bytes[$base + 1] - ($hl << 1);
+
+	if ($len > $cnt * 2) {
+		print "missing icmp data\n";
+	}
+
+	local($osum) = $bytes[$base + $hl + 1];
+	$bytes[$hl + 1] = 0;
+	for ($i = $base + $hl, $hs2 = 0; $i < $cnt; $i++) {
+		$hs2 += $bytes[$i];
+	}
+	$hs = $hs2 + $osum;
+	while ($hs2 > 65535) {
+		$hs2 = ($hs2 & 0xffff) + ($hs2 >> 16);
+	}
+	while ($hs > 65535) {
+		$hs = ($hs & 0xffff) + ($hs >> 16);
+	}
+	$hs2 = ~$hs2 & 0xffff;
+	$hs = ~$hs & 0xffff;
+
+	if ($osum != $hs2) {
+		printf " ICMP: (%x) %x != %x", $hs, $osum, $hs2;
+	} else {
+		print " ICMP: ok";
+	}
+	if ($base == 0) {
+		$type = $bytes[$hl] >> 8;
+		if ($type == 3 || $type == 4 || $type == 5 ||
+		    $type == 11 || $type == 12) {
+			&ipv4check($hl + 4);
+		}
+	}
+}
+
+while ($#ARGV >= 0) {
+	open(I, "$ARGV[0]") || die $!;
+	print "--- $ARGV[0] ---\n";
+	$multi = 0;
+	while (<I>) {
+		chop;
+		s/#.*//g;
+
+		#
+		# If the first non-comment, non-empty line of input starts
+		# with a '[', then allow the input to be a multi-line hex
+		# string, otherwise it has to be all on one line.
+		#
+		if (/^\[/) {
+			$multi=1;
+			s/^\[[^]]*\]//g;
+
+		}
+		s/^ *//g;
+		if (length == 0) {
+			next if ($cnt == 0);
+			&ipv4check(0);
+			$cnt = 0;
+			$multi = 0;
+			next;
+		}
+
+		#
+		# look for 16 bits, represented with leading 0's as required,
+		# in hex.
+		#
+		s/\t/ /g;
+		while (/^[0-9a-fA-F][0-9a-fA-F] [0-9a-fA-F][0-9a-fA-F] .*/) {
+			s/^([0-9a-fA-F][0-9a-fA-F]) ([0-9a-fA-F][0-9a-fA-F]) (.*)/$1$2 $3/;
+		}
+		while (/.* [0-9a-fA-F][0-9a-fA-F] [0-9a-fA-F][0-9a-fA-F] .*/) {
+$b=$_;
+			s/(.*?) ([0-9a-fA-F][0-9a-fA-F]) ([0-9a-fA-F][0-9a-fA-F]) (.*)/$1 $2$3 $4/g;
+		}
+		while (/^[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F].*/) {
+			$x = $_;
+			$x =~ s/([0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F]).*/$1/;
+			$x =~ s/ *//g;
+			$y = hex $x;
+			s/[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F] *(.*)/$1/;
+			$bytes[$cnt] = $y;
+			$cnt++;
+		}
+
+		#
+		# Pick up stragler bytes.
+		#
+		if (/^[0-9a-fA-F][0-9a-fA-F]/) {
+			$y = hex $_;
+			$bytes[$cnt++] = $y * 256;
+		}
+		if ($multi == 0 && $cnt > 0) {
+			&ipv4check(0);
+			$cnt = 0;
+		}
+	}
+
+	if ($cnt > 0) {
+		&ipv4check(0);
+	}
+	close(I);
+	shift(@ARGV);
+}
author	darrenr <darrenr@FreeBSD.org>	2004-06-21 22:47:51 +0000
committer	darrenr <darrenr@FreeBSD.org>	2004-06-21 22:47:51 +0000
commit	590450fec65a8e72a8965117398bc8f14938b4a8 (patch)
tree	699025ff2d567ed726a446a7ca5c3d916f5ca0a4 /contrib/ipfilter
parent	244f07541460d6bd022a1eea60585315231e9e1c (diff)
download	FreeBSD-src-590450fec65a8e72a8965117398bc8f14938b4a8.zip FreeBSD-src-590450fec65a8e72a8965117398bc8f14938b4a8.tar.gz