Import pf userland from OpenBSD 3.7 (OPENBSD_3_7 as of today)

13 files changed, 2864 insertions, 781 deletions

diff --git a/contrib/pf/pfctl/parse.y b/contrib/pf/pfctl/parse.y
index bcfd8a3..179898f 100644
--- a/contrib/pf/pfctl/parse.y
+++ b/contrib/pf/pfctl/parse.y
@@ -1,4 +1,4 @@
-/*	$OpenBSD: parse.y,v 1.449 2004/03/20 23:20:20 david Exp $	*/
+/*	$OpenBSD: parse.y,v 1.482 2005/03/07 13:20:03 henning Exp $	*/
 
 /*
  * Copyright (c) 2001 Markus Friedl.  All rights reserved.
@@ -49,6 +49,7 @@
 #include <errno.h>
 #include <string.h>
 #include <ctype.h>
+#include <math.h>
 #include <err.h>
 #include <limits.h>
 #include <pwd.h>
@@ -117,8 +118,10 @@ struct node_icmp {
 };
 
 enum	{ PF_STATE_OPT_MAX, PF_STATE_OPT_NOSYNC, PF_STATE_OPT_SRCTRACK,
-	    PF_STATE_OPT_MAX_SRC_STATES, PF_STATE_OPT_MAX_SRC_NODES,
-	    PF_STATE_OPT_STATELOCK, PF_STATE_OPT_TIMEOUT };
+	    PF_STATE_OPT_MAX_SRC_STATES, PF_STATE_OPT_MAX_SRC_CONN,
+	    PF_STATE_OPT_MAX_SRC_CONN_RATE, PF_STATE_OPT_MAX_SRC_NODES,
+	    PF_STATE_OPT_OVERLOAD, PF_STATE_OPT_STATELOCK,
+	    PF_STATE_OPT_TIMEOUT };
 
 enum	{ PF_SRCTRACK_NONE, PF_SRCTRACK, PF_SRCTRACK_GLOBAL, PF_SRCTRACK_RULE };
 
@@ -127,6 +130,15 @@ struct node_state_opt {
 	union {
 		u_int32_t	 max_states;
 		u_int32_t	 max_src_states;
+		u_int32_t	 max_src_conn;
+		struct {
+			u_int32_t	limit;
+			u_int32_t	seconds;
+		}		 max_src_conn_rate;
+		struct {
+			u_int8_t	flush;
+			char		tblname[PF_TABLE_NAME_SIZE];
+		}		 overload;
 		u_int32_t	 max_src_nodes;
 		u_int8_t	 src_track;
 		u_int32_t	 statelock;
@@ -175,6 +187,7 @@ struct filter_opts {
 	} flags;
 	struct node_icmp	*icmpspec;
 	u_int32_t		 tos;
+	u_int32_t		 prob;
 	struct {
 		int			 action;
 		struct node_state_opt	*options;
@@ -261,11 +274,13 @@ void	expand_label(char *, size_t, const char *, u_int8_t, struct node_host *,
 void	expand_rule(struct pf_rule *, struct node_if *, struct node_host *,
 	    struct node_proto *, struct node_os*, struct node_host *,
 	    struct node_port *, struct node_host *, struct node_port *,
-	    struct node_uid *, struct node_gid *, struct node_icmp *);
+	    struct node_uid *, struct node_gid *, struct node_icmp *,
+	    const char *);
 int	expand_altq(struct pf_altq *, struct node_if *, struct node_queue *,
 	    struct node_queue_bw bwspec, struct node_queue_opt *);
 int	expand_queue(struct pf_altq *, struct node_if *, struct node_queue *,
 	    struct node_queue_bw, struct node_queue_opt *);
+int	expand_skip_interface(struct node_if *);
 
 int	 check_rulestate(int);
 int	 kw_cmp(const void *, const void *);
@@ -302,7 +317,6 @@ TAILQ_HEAD(loadanchorshead, loadanchors)
 struct loadanchors {
 	TAILQ_ENTRY(loadanchors)	 entries;
 	char				*anchorname;
-	char				*rulesetname;
 	char				*filename;
 };
 
@@ -355,6 +369,10 @@ typedef struct {
 			u_int8_t	 log;
 			u_int8_t	 quick;
 		}			 logquick;
+		struct {
+			int		 neg;
+			char		*name;
+		}			 tagged;
 		struct pf_poolhashkey	*hashkey;
 		struct node_queue	*queue;
 		struct node_queue_opt	 queue_options;
@@ -371,18 +389,6 @@ typedef struct {
 	int lineno;
 } YYSTYPE;
 
-#define PREPARE_ANCHOR_RULE(r, a)				\
-	do {							\
-		memset(&(r), 0, sizeof(r));			\
-		if (strlcpy(r.anchorname, (a),			\
-		    sizeof(r.anchorname)) >=			\
-		    sizeof(r.anchorname)) {			\
-			yyerror("anchor name '%s' too long",	\
-			    (a));				\
-			YYERROR;				\
-		}						\
-	} while (0)
-
 #define DYNIF_MULTIADDR(addr) ((addr).type == PF_ADDR_DYNIFTL && \
 	(!((addr).iflags & PFI_AFLAG_NOALIAS) ||		 \
 	!isdigit((addr).v.ifname[strlen((addr).v.ifname)-1])))
@@ -396,22 +402,24 @@ typedef struct {
 %token	NOROUTE FRAGMENT USER GROUP MAXMSS MAXIMUM TTL TOS DROP TABLE
 %token	REASSEMBLE FRAGDROP FRAGCROP ANCHOR NATANCHOR RDRANCHOR BINATANCHOR
 %token	SET OPTIMIZATION TIMEOUT LIMIT LOGINTERFACE BLOCKPOLICY RANDOMID
-%token	REQUIREORDER SYNPROXY FINGERPRINTS NOSYNC DEBUG HOSTID
+%token	REQUIREORDER SYNPROXY FINGERPRINTS NOSYNC DEBUG SKIP HOSTID
 %token	ANTISPOOF FOR
-%token	BITMASK RANDOM SOURCEHASH ROUNDROBIN STATICPORT
+%token	BITMASK RANDOM SOURCEHASH ROUNDROBIN STATICPORT PROBABILITY
 %token	ALTQ CBQ PRIQ HFSC BANDWIDTH TBRSIZE LINKSHARE REALTIME UPPERLIMIT
 %token	QUEUE PRIORITY QLIMIT
 %token	LOAD
 %token	STICKYADDRESS MAXSRCSTATES MAXSRCNODES SOURCETRACK GLOBAL RULE
-%token	TAGGED TAG IFBOUND GRBOUND FLOATING STATEPOLICY
+%token	MAXSRCCONN MAXSRCCONNRATE OVERLOAD FLUSH
+%token	TAGGED TAG IFBOUND GRBOUND FLOATING STATEPOLICY ROUTE
 %token	<v.string>		STRING
 %token	<v.i>			PORTBINARY
 %type	<v.interface>		interface if_list if_item_not if_item
 %type	<v.number>		number icmptype icmp6type uid gid
 %type	<v.number>		tos not yesno natpass
-%type	<v.i>			no dir log af fragcache sourcetrack
+%type	<v.i>			no dir log af fragcache sourcetrack flush
 %type	<v.i>			unaryop statelock
-%type	<v.b>			action nataction flags flag blockspec
+%type	<v.b>			action nataction scrubaction
+%type	<v.b>			flags flag blockspec
 %type	<v.range>		port rport
 %type	<v.hashkey>		hashkey
 %type	<v.proto>		proto proto_list proto_item
@@ -433,7 +441,7 @@ typedef struct {
 %type	<v.keep_state>		keep
 %type	<v.state_opt>		state_opt_spec state_opt_list state_opt_item
 %type	<v.logquick>		logquick
-%type	<v.interface>		antispoof_ifspc antispoof_iflst
+%type	<v.interface>		antispoof_ifspc antispoof_iflst antispoof_if
 %type	<v.qassign>		qname
 %type	<v.queue>		qassign qassign_list qassign_item
 %type	<v.queue_options>	scheduler
@@ -447,6 +455,7 @@ typedef struct {
 %type	<v.scrub_opts>		scrub_opts scrub_opt scrub_opts_l
 %type	<v.table_opts>		table_opts table_opt table_opts_l
 %type	<v.pool_opts>		pool_opts pool_opt pool_opts_l
+%type	<v.tagged>		tagged
 %%
 
 ruleset		: /* empty */
@@ -487,11 +496,6 @@ option		: SET OPTIMIZATION STRING		{
 				free($3);
 				YYERROR;
 			}
-			if ((ifa_exists($3, 0) == NULL) && strcmp($3, "none")) {
-				yyerror("interface %s doesn't exist", $3);
-				free($3);
-				YYERROR;
-			}
 			if (pfctl_set_logif(pf, $3) != 0) {
 				yyerror("error setting loginterface %s", $3);
 				free($3);
@@ -505,7 +509,7 @@ option		: SET OPTIMIZATION STRING		{
 				YYERROR;
 			}
 			if (pfctl_set_hostid(pf, $3) != 0) {
-				yyerror("error setting loginterface %08x", $3);
+				yyerror("error setting hostid %08x", $3);
 				YYERROR;
 			}
 		}
@@ -531,15 +535,19 @@ option		: SET OPTIMIZATION STRING		{
 		}
 		| SET FINGERPRINTS STRING {
 			if (pf->opts & PF_OPT_VERBOSE)
-				printf("fingerprints %s\n", $3);
+				printf("set fingerprints %s\n", $3);
 			if (check_rulestate(PFCTL_STATE_OPTION)) {
 				free($3);
 				YYERROR;
 			}
-			if (pfctl_file_fingerprints(pf->dev, pf->opts, $3)) {
-				yyerror("error loading fingerprints %s", $3);
-				free($3);
-				YYERROR;
+			if (!pf->anchor[0]) {
+				if (pfctl_file_fingerprints(pf->dev,
+				    pf->opts, $3)) {
+					yyerror("error loading "
+					    "fingerprints %s", $3);
+					free($3);
+					YYERROR;
+				}
 			}
 			free($3);
 		}
@@ -571,6 +579,12 @@ option		: SET OPTIMIZATION STRING		{
 			}
 			free($3);
 		}
+		| SET SKIP interface {
+			if (expand_skip_interface($3) != 0) {
+				yyerror("error setting skip interface(s)");
+				YYERROR;
+			}
+		}
 		;
 
 string		: string STRING				{
@@ -600,9 +614,10 @@ anchorrule	: ANCHOR string	dir interface af proto fromto filter_opts {
 				YYERROR;
 			}
 
-			PREPARE_ANCHOR_RULE(r, $2);
+			memset(&r, 0, sizeof(r));
 			r.direction = $3;
 			r.af = $5;
+			r.prob = $8.prob;
 
 			if ($8.match_tag)
 				if (strlcpy(r.match_tagname, $8.match_tag,
@@ -618,7 +633,8 @@ anchorrule	: ANCHOR string	dir interface af proto fromto filter_opts {
 
 			expand_rule(&r, $4, NULL, $6, $7.src_os,
 			    $7.src.host, $7.src.port, $7.dst.host, $7.dst.port,
-			    0, 0, 0);
+			    0, 0, 0, $2);
+			free($2);
 		}
 		| NATANCHOR string interface af proto fromto {
 			struct pf_rule	r;
@@ -628,8 +644,7 @@ anchorrule	: ANCHOR string	dir interface af proto fromto filter_opts {
 				YYERROR;
 			}
 
-			PREPARE_ANCHOR_RULE(r, $2);
-			free($2);
+			memset(&r, 0, sizeof(r));
 			r.action = PF_NAT;
 			r.af = $4;
 
@@ -638,7 +653,8 @@ anchorrule	: ANCHOR string	dir interface af proto fromto filter_opts {
 
 			expand_rule(&r, $3, NULL, $5, $6.src_os,
 			    $6.src.host, $6.src.port, $6.dst.host, $6.dst.port,
-			    0, 0, 0);
+			    0, 0, 0, $2);
+			free($2);
 		}
 		| RDRANCHOR string interface af proto fromto {
 			struct pf_rule	r;
@@ -648,8 +664,7 @@ anchorrule	: ANCHOR string	dir interface af proto fromto filter_opts {
 				YYERROR;
 			}
 
-			PREPARE_ANCHOR_RULE(r, $2);
-			free($2);
+			memset(&r, 0, sizeof(r));
 			r.action = PF_RDR;
 			r.af = $4;
 
@@ -679,7 +694,8 @@ anchorrule	: ANCHOR string	dir interface af proto fromto filter_opts {
 
 			expand_rule(&r, $3, NULL, $5, $6.src_os,
 			    $6.src.host, $6.src.port, $6.dst.host, $6.dst.port,
-			    0, 0, 0);
+			    0, 0, 0, $2);
+			free($2);
 		}
 		| BINATANCHOR string interface af proto fromto {
 			struct pf_rule	r;
@@ -689,8 +705,7 @@ anchorrule	: ANCHOR string	dir interface af proto fromto filter_opts {
 				YYERROR;
 			}
 
-			PREPARE_ANCHOR_RULE(r, $2);
-			free($2);
+			memset(&r, 0, sizeof(r));
 			r.action = PF_BINAT;
 			r.af = $4;
 			if ($5 != NULL) {
@@ -713,39 +728,24 @@ anchorrule	: ANCHOR string	dir interface af proto fromto filter_opts {
 			decide_address_family($6.src.host, &r.af);
 			decide_address_family($6.dst.host, &r.af);
 
-			pfctl_add_rule(pf, &r);
+			pfctl_add_rule(pf, &r, $2);
+			free($2);
 		}
 		;
 
 loadrule	: LOAD ANCHOR string FROM string	{
-			char			*t;
 			struct loadanchors	*loadanchor;
 
-			t = strsep(&$3, ":");
-			if (*t == '\0' || $3 == NULL || *$3 == '\0') {
-				yyerror("anchor '%s' invalid\n", $3);
-				free(t);
-				YYERROR;
-			}
-			if (strlen(t) >= PF_ANCHOR_NAME_SIZE) {
+			if (strlen($3) >= MAXPATHLEN) {
 				yyerror("anchorname %s too long, max %u\n",
-				    t, PF_ANCHOR_NAME_SIZE - 1);
-				free(t);
-				YYERROR;
-			}
-			if (strlen($3) >= PF_RULESET_NAME_SIZE) {
-				yyerror("rulesetname %s too long, max %u\n",
-				    $3, PF_RULESET_NAME_SIZE - 1);
-				free(t);
+				    $3, MAXPATHLEN - 1);
+				free($3);
 				YYERROR;
 			}
-
 			loadanchor = calloc(1, sizeof(struct loadanchors));
 			if (loadanchor == NULL)
 				err(1, "loadrule: calloc");
-			if ((loadanchor->anchorname = strdup(t)) == NULL)
-				err(1, "loadrule: strdup");
-			if ((loadanchor->rulesetname = strdup($3)) == NULL)
+			if ((loadanchor->anchorname = strdup($3)) == NULL)
 				err(1, "loadrule: strdup");
 			if ((loadanchor->filename = strdup($5)) == NULL)
 				err(1, "loadrule: strdup");
@@ -753,11 +753,20 @@ loadrule	: LOAD ANCHOR string FROM string	{
 			TAILQ_INSERT_TAIL(&loadanchorshead, loadanchor,
 			    entries);
 
-			free(t); /* not $3 */
+			free($3);
 			free($5);
 		};
 
-scrubrule	: SCRUB dir logquick interface af proto fromto scrub_opts
+scrubaction	: no SCRUB {
+			$$.b2 = $$.w = 0;
+			if ($1)
+				$$.b1 = PF_NOSCRUB;
+			else
+				$$.b1 = PF_SCRUB;
+		}
+		;
+
+scrubrule	: scrubaction dir logquick interface af proto fromto scrub_opts
 		{
 			struct pf_rule	r;
 
@@ -766,7 +775,7 @@ scrubrule	: SCRUB dir logquick interface af proto fromto scrub_opts
 
 			memset(&r, 0, sizeof(r));
 
-			r.action = PF_SCRUB;
+			r.action = $1.b1;
 			r.direction = $2;
 
 			r.log = $3.log;
@@ -797,7 +806,7 @@ scrubrule	: SCRUB dir logquick interface af proto fromto scrub_opts
 
 			expand_rule(&r, $4, NULL, $6, $7.src_os,
 			    $7.src.host, $7.src.port, $7.dst.host, $7.dst.port,
-			    NULL, NULL, NULL);
+			    NULL, NULL, NULL, "");
 		}
 		;
 
@@ -857,6 +866,8 @@ scrub_opt	: NODF	{
 		}
 		| REASSEMBLE STRING {
 			if (strcasecmp($2, "tcp") != 0) {
+				yyerror("scrub reassemble supports only tcp, "
+				    "not '%s'", $2);
 				free($2);
 				YYERROR;
 			}
@@ -883,7 +894,7 @@ fragcache	: FRAGMENT REASSEMBLE	{ $$ = 0; /* default */ }
 
 antispoof	: ANTISPOOF logquick antispoof_ifspc af antispoof_opts {
 			struct pf_rule		 r;
-			struct node_host	*h = NULL;
+			struct node_host	*h = NULL, *hh;
 			struct node_if		*i, *j;
 
 			if (check_rulestate(PFCTL_STATE_FILTER))
@@ -909,11 +920,35 @@ antispoof	: ANTISPOOF logquick antispoof_ifspc af antispoof_opts {
 					YYERROR;
 				}
 				j->not = 1;
-				h = ifa_lookup(j->ifname, PFI_AFLAG_NETWORK);
+				if (i->dynamic) {
+					h = calloc(1, sizeof(*h));
+					if (h == NULL)
+						err(1, "address: calloc");
+					h->addr.type = PF_ADDR_DYNIFTL;
+					set_ipmask(h, 128);
+					if (strlcpy(h->addr.v.ifname, i->ifname,
+					    sizeof(h->addr.v.ifname)) >=
+					    sizeof(h->addr.v.ifname)) {
+						free(h);
+						yyerror(
+						    "interface name too long");
+						YYERROR;
+					}
+					hh = malloc(sizeof(*hh));
+					if (hh == NULL)
+						 err(1, "address: malloc");
+					bcopy(h, hh, sizeof(*hh));
+					h->addr.iflags = PFI_AFLAG_NETWORK;
+				} else {
+					h = ifa_lookup(j->ifname,
+					    PFI_AFLAG_NETWORK);
+					hh = NULL;
+				}
 
 				if (h != NULL)
 					expand_rule(&r, j, NULL, NULL, NULL, h,
-					    NULL, NULL, NULL, NULL, NULL, NULL);
+					    NULL, NULL, NULL, NULL, NULL,
+					    NULL, "");
 
 				if ((i->ifa_flags & IFF_LOOPBACK) == 0) {
 					bzero(&r, sizeof(r));
@@ -925,29 +960,40 @@ antispoof	: ANTISPOOF logquick antispoof_ifspc af antispoof_opts {
 					r.af = $4;
 					if (rule_label(&r, $5.label))
 						YYERROR;
-					h = ifa_lookup(i->ifname, 0);
+					if (hh != NULL)
+						h = hh;
+					else
+						h = ifa_lookup(i->ifname, 0);
 					if (h != NULL)
 						expand_rule(&r, NULL, NULL,
 						    NULL, NULL, h, NULL, NULL,
-						    NULL, NULL, NULL, NULL);
-				}
+						    NULL, NULL, NULL, NULL, "");
+				} else
+					free(hh);
 			}
 			free($5.label);
 		}
 		;
 
-antispoof_ifspc	: FOR if_item			{ $$ = $2; }
+antispoof_ifspc	: FOR antispoof_if		{ $$ = $2; }
 		| FOR '{' antispoof_iflst '}'	{ $$ = $3; }
 		;
 
-antispoof_iflst	: if_item			{ $$ = $1; }
-		| antispoof_iflst comma if_item	{
+antispoof_iflst	: antispoof_if				{ $$ = $1; }
+		| antispoof_iflst comma antispoof_if	{
 			$1->tail->next = $3;
 			$1->tail = $3;
 			$$ = $1;
 		}
 		;
 
+antispoof_if  : if_item				{ $$ = $1; }
+		| '(' if_item ')'		{
+			$2->dynamic = 1;
+			$$ = $2;
+		}
+		;
+
 antispoof_opts	:	{ bzero(&antispoof_opts, sizeof antispoof_opts); }
 		    antispoof_opts_l
 			{ $$ = antispoof_opts; }
@@ -1028,6 +1074,7 @@ table_opt	: STRING		{
 			else if (!strcmp($1, "persist"))
 				table_opts.flags |= PFR_TFLAG_PERSIST;
 			else {
+				yyerror("invalid table option '%s'", $1);
 				free($1);
 				YYERROR;
 			}
@@ -1346,14 +1393,15 @@ hfscopts_item	: LINKSHARE bandwidth				{
 			hfsc_opts.linkshare.m2 = $2;
 			hfsc_opts.linkshare.used = 1;
 		}
-		| LINKSHARE '(' bandwidth number bandwidth ')'	{
+		| LINKSHARE '(' bandwidth comma number comma bandwidth ')'
+		    {
 			if (hfsc_opts.linkshare.used) {
 				yyerror("linkshare already specified");
 				YYERROR;
 			}
 			hfsc_opts.linkshare.m1 = $3;
-			hfsc_opts.linkshare.d = $4;
-			hfsc_opts.linkshare.m2 = $5;
+			hfsc_opts.linkshare.d = $5;
+			hfsc_opts.linkshare.m2 = $7;
 			hfsc_opts.linkshare.used = 1;
 		}
 		| REALTIME bandwidth				{
@@ -1364,14 +1412,15 @@ hfscopts_item	: LINKSHARE bandwidth				{
 			hfsc_opts.realtime.m2 = $2;
 			hfsc_opts.realtime.used = 1;
 		}
-		| REALTIME '(' bandwidth number bandwidth ')'	{
+		| REALTIME '(' bandwidth comma number comma bandwidth ')'
+		    {
 			if (hfsc_opts.realtime.used) {
 				yyerror("realtime already specified");
 				YYERROR;
 			}
 			hfsc_opts.realtime.m1 = $3;
-			hfsc_opts.realtime.d = $4;
-			hfsc_opts.realtime.m2 = $5;
+			hfsc_opts.realtime.d = $5;
+			hfsc_opts.realtime.m2 = $7;
 			hfsc_opts.realtime.used = 1;
 		}
 		| UPPERLIMIT bandwidth				{
@@ -1382,14 +1431,15 @@ hfscopts_item	: LINKSHARE bandwidth				{
 			hfsc_opts.upperlimit.m2 = $2;
 			hfsc_opts.upperlimit.used = 1;
 		}
-		| UPPERLIMIT '(' bandwidth number bandwidth ')'	{
+		| UPPERLIMIT '(' bandwidth comma number comma bandwidth ')'
+		    {
 			if (hfsc_opts.upperlimit.used) {
 				yyerror("upperlimit already specified");
 				YYERROR;
 			}
 			hfsc_opts.upperlimit.m1 = $3;
-			hfsc_opts.upperlimit.d = $4;
-			hfsc_opts.upperlimit.m2 = $5;
+			hfsc_opts.upperlimit.d = $5;
+			hfsc_opts.upperlimit.m2 = $7;
 			hfsc_opts.upperlimit.used = 1;
 		}
 		| STRING	{
@@ -1475,6 +1525,7 @@ pfrule		: action dir logquick interface route af proto fromto
 			r.direction = $2;
 			r.log = $3.log;
 			r.quick = $3.quick;
+			r.prob = $9.prob;
 
 			r.af = $6;
 			if ($9.tag)
@@ -1553,6 +1604,7 @@ pfrule		: action dir logquick interface route af proto fromto
 						YYERROR;
 					}
 					srctrack =  o->data.src_track;
+					r.rule_flag |= PFRULE_SRCTRACK;
 					break;
 				case PF_STATE_OPT_MAX_SRC_STATES:
 					if (r.max_src_states) {
@@ -1561,7 +1613,7 @@ pfrule		: action dir logquick interface route af proto fromto
 						    "multiple definitions");
 						YYERROR;
 					}
-					if (o->data.max_src_nodes == 0) {
+					if (o->data.max_src_states == 0) {
 						yyerror("'max-src-states' must "
 						    "be > 0");
 						YYERROR;
@@ -1570,6 +1622,66 @@ pfrule		: action dir logquick interface route af proto fromto
 					    o->data.max_src_states;
 					r.rule_flag |= PFRULE_SRCTRACK;
 					break;
+				case PF_STATE_OPT_OVERLOAD:
+					if (r.overload_tblname[0]) {
+						yyerror("multiple 'overload' "
+						    "table definitions");
+						YYERROR;
+					}
+					if (strlcpy(r.overload_tblname,
+					    o->data.overload.tblname,
+					    PF_TABLE_NAME_SIZE) >=
+					    PF_TABLE_NAME_SIZE) {
+						yyerror("state option: "
+						    "strlcpy");
+						YYERROR;
+					}
+					r.flush = o->data.overload.flush;
+					break;
+				case PF_STATE_OPT_MAX_SRC_CONN:
+					if (r.max_src_conn) {
+						yyerror("state option "
+						    "'max-src-conn' "
+						    "multiple definitions");
+						YYERROR;
+					}
+					if (o->data.max_src_conn == 0) {
+						yyerror("'max-src-conn' "
+						    "must be > 0");
+						YYERROR;
+					}
+					r.max_src_conn =
+					    o->data.max_src_conn;
+					r.rule_flag |= PFRULE_SRCTRACK |
+					    PFRULE_RULESRCTRACK;
+					break;
+				case PF_STATE_OPT_MAX_SRC_CONN_RATE:
+					if (r.max_src_conn_rate.limit) {
+						yyerror("state option "
+						    "'max-src-conn-rate' "
+						    "multiple definitions");
+						YYERROR;
+					}
+					if (!o->data.max_src_conn_rate.limit ||
+					    !o->data.max_src_conn_rate.seconds) {
+						yyerror("'max-src-conn-rate' "
+						    "values must be > 0");
+						YYERROR;
+					}
+					if (o->data.max_src_conn_rate.limit >
+					    PF_THRESHOLD_MAX) {
+						yyerror("'max-src-conn-rate' "
+						   "maximum rate must be < %u",
+						   PF_THRESHOLD_MAX);
+						YYERROR;
+					}
+					r.max_src_conn_rate.limit =
+					    o->data.max_src_conn_rate.limit;
+					r.max_src_conn_rate.seconds =
+					    o->data.max_src_conn_rate.seconds;
+					r.rule_flag |= PFRULE_SRCTRACK |
+					    PFRULE_RULESRCTRACK;
+					break;
 				case PF_STATE_OPT_MAX_SRC_NODES:
 					if (r.max_src_nodes) {
 						yyerror("state option "
@@ -1610,7 +1722,7 @@ pfrule		: action dir logquick interface route af proto fromto
 				o = o->next;
 				free(p);
 			}
-			if (srctrack) {
+			if (r.rule_flag & PFRULE_SRCTRACK) {
 				if (srctrack == PF_SRCTRACK_GLOBAL &&
 				    r.max_src_nodes) {
 					yyerror("'max-src-nodes' is "
@@ -1618,6 +1730,24 @@ pfrule		: action dir logquick interface route af proto fromto
 					    "'source-track global'");
 					YYERROR;
 				}
+				if (srctrack == PF_SRCTRACK_GLOBAL &&
+				    r.max_src_conn) {
+					yyerror("'max-src-conn' is "
+					    "incompatible with "
+					    "'source-track global'");
+					YYERROR;
+				}
+				if (srctrack == PF_SRCTRACK_GLOBAL &&
+				    r.max_src_conn_rate.seconds) {
+					yyerror("'max-src-conn-rate' is "
+					    "incompatible with "
+					    "'source-track global'");
+					YYERROR;
+				}
+				if (r.timeout[PFTM_SRC_NODE] <
+				    r.max_src_conn_rate.seconds)
+					r.timeout[PFTM_SRC_NODE] =
+					    r.max_src_conn_rate.seconds;
 				r.rule_flag |= PFRULE_SRCTRACK;
 				if (srctrack == PF_SRCTRACK_RULE)
 					r.rule_flag |= PFRULE_RULESRCTRACK;
@@ -1698,7 +1828,7 @@ pfrule		: action dir logquick interface route af proto fromto
 
 			expand_rule(&r, $4, $5.host, $7, $8.src_os,
 			    $8.src.host, $8.src.port, $8.dst.host, $8.dst.port,
-			    $9.uid, $9.gid, $9.icmpspec);
+			    $9.uid, $9.gid, $9.icmpspec, "");
 		}
 		;
 
@@ -1788,6 +1918,28 @@ filter_opt	: USER uids {
 			filter_opts.match_tag = $3;
 			filter_opts.match_tag_not = $1;
 		}
+		| PROBABILITY STRING			{
+			char	*e;
+			double	 p = strtod($2, &e);
+
+			if (*e == '%') {
+				p *= 0.01;
+				e++;
+			}
+			if (*e) {
+				yyerror("invalid probability: %s", $2);
+				free($2);
+				YYERROR;
+			}
+			p = floor(p * (UINT_MAX+1.0) + 0.5);
+			if (p < 1.0 || p >= (UINT_MAX+1.0)) {
+				yyerror("invalid probability: %s", $2);
+				free($2);
+				YYERROR;
+			}
+			filter_opts.prob = (u_int32_t)p;
+			free($2);
+		}
 		;
 
 action		: PASS			{ $$.b1 = PF_PASS; $$.b2 = $$.w = 0; }
@@ -1899,11 +2051,6 @@ if_item_not	: not if_item			{ $$ = $2; $$->not = $1; }
 if_item		: STRING			{
 			struct node_host	*n;
 
-			if ((n = ifa_exists($1, 1)) == NULL) {
-				yyerror("unknown interface %s", $1);
-				free($1);
-				YYERROR;
-			}
 			$$ = calloc(1, sizeof(struct node_if));
 			if ($$ == NULL)
 				err(1, "if_item: calloc");
@@ -1914,8 +2061,11 @@ if_item		: STRING			{
 				yyerror("interface name too long");
 				YYERROR;
 			}
+
+			if ((n = ifa_exists($1, 1)) != NULL)
+				$$->ifa_flags = n->ifa_flags;
+
 			free($1);
-			$$->ifa_flags = n->ifa_flags;
 			$$->not = 0;
 			$$->next = NULL;
 			$$->tail = $$;
@@ -2130,6 +2280,26 @@ host		: STRING			{
 			$$->next = NULL;
 			$$->tail = $$;
 		}
+		| ROUTE	STRING		{
+			$$ = calloc(1, sizeof(struct node_host));
+			if ($$ == NULL) {
+				free($2);
+				err(1, "host: calloc");
+			}
+			$$->addr.type = PF_ADDR_RTLABEL;
+			if (strlcpy($$->addr.v.rtlabelname, $2,
+			    sizeof($$->addr.v.rtlabelname)) >=
+			    sizeof($$->addr.v.rtlabelname)) {
+				yyerror("route label too long, max %u chars",
+				    sizeof($$->addr.v.rtlabelname) - 1);
+				free($2);
+				free($$);
+				YYERROR;
+			}
+			$$->next = NULL;
+			$$->tail = $$;
+			free($2);
+		}
 		;
 
 number		: STRING			{
@@ -2150,6 +2320,11 @@ dynaddr		: '(' STRING ')'		{
 			char	*p, *op;
 
 			op = $2;
+			if (!isalpha(op[0])) {
+				yyerror("invalid interface name '%s'", op);
+				free(op);
+				YYERROR;
+			}
 			while ((p = strrchr($2, ':')) != NULL) {
 				if (!strcmp(p+1, "network"))
 					flags |= PFI_AFLAG_NETWORK;
@@ -2173,11 +2348,6 @@ dynaddr		: '(' STRING ')'		{
 				    "interface modifiers");
 				YYERROR;
 			}
-			if (ifa_exists($2, 1) == NULL && strcmp($2, "self")) {
-				yyerror("interface %s does not exist", $2);
-				free(op);
-				YYERROR;
-			}
 			$$ = calloc(1, sizeof(struct node_host));
 			if ($$ == NULL)
 				err(1, "address: calloc");
@@ -2265,7 +2435,7 @@ port		: STRING			{
 				if (atoul($1, &ulval) == 0) {
 					if (ulval > 65535) {
 						free($1);
-						yyerror("illegal port value %d",
+						yyerror("illegal port value %lu",
 						    ulval);
 						YYERROR;
 					}
@@ -2520,7 +2690,7 @@ icmp_item	: icmptype		{
 			if (atoul($3, &ulval) == 0) {
 				if (ulval > 255) {
 					free($3);
-					yyerror("illegal icmp-code %d", ulval);
+					yyerror("illegal icmp-code %lu", ulval);
 					YYERROR;
 				}
 			} else {
@@ -2560,7 +2730,7 @@ icmp6_item	: icmp6type		{
 
 			if (atoul($3, &ulval) == 0) {
 				if (ulval > 255) {
-					yyerror("illegal icmp6-code %ld",
+					yyerror("illegal icmp6-code %lu",
 					    ulval);
 					free($3);
 					YYERROR;
@@ -2592,7 +2762,7 @@ icmptype	: STRING			{
 
 			if (atoul($1, &ulval) == 0) {
 				if (ulval > 255) {
-					yyerror("illegal icmp-type %d", ulval);
+					yyerror("illegal icmp-type %lu", ulval);
 					free($1);
 					YYERROR;
 				}
@@ -2616,7 +2786,7 @@ icmp6type	: STRING			{
 
 			if (atoul($1, &ulval) == 0) {
 				if (ulval > 255) {
-					yyerror("illegal icmp6-type %d", ulval);
+					yyerror("illegal icmp6-type %lu", ulval);
 					free($1);
 					YYERROR;
 				}
@@ -2684,6 +2854,13 @@ keep		: KEEP STATE state_opt_spec	{
 		}
 		;
 
+flush		: /* empty */			{ $$ = 0; }
+		| FLUSH				{ $$ = PF_FLUSH; }
+		| FLUSH GLOBAL			{
+			$$ = PF_FLUSH | PF_FLUSH_GLOBAL;
+		}
+		;
+
 state_opt_spec	: '(' state_opt_list ')'	{ $$ = $2; }
 		| /* empty */			{ $$ = NULL; }
 		;
@@ -2722,6 +2899,43 @@ state_opt_item	: MAXIMUM number		{
 			$$->next = NULL;
 			$$->tail = $$;
 		}
+		| MAXSRCCONN number			{
+			$$ = calloc(1, sizeof(struct node_state_opt));
+			if ($$ == NULL)
+				err(1, "state_opt_item: calloc");
+			$$->type = PF_STATE_OPT_MAX_SRC_CONN;
+			$$->data.max_src_conn = $2;
+			$$->next = NULL;
+			$$->tail = $$;
+		}
+		| MAXSRCCONNRATE number '/' number	{
+			$$ = calloc(1, sizeof(struct node_state_opt));
+			if ($$ == NULL)
+				err(1, "state_opt_item: calloc");
+			$$->type = PF_STATE_OPT_MAX_SRC_CONN_RATE;
+			$$->data.max_src_conn_rate.limit = $2;
+			$$->data.max_src_conn_rate.seconds = $4;
+			$$->next = NULL;
+			$$->tail = $$;
+		}
+		| OVERLOAD '<' STRING '>' flush		{
+			if (strlen($3) >= PF_TABLE_NAME_SIZE) {
+				yyerror("table name '%s' too long", $3);
+				free($3);
+				YYERROR;
+			}
+			$$ = calloc(1, sizeof(struct node_state_opt));
+			if ($$ == NULL)
+				err(1, "state_opt_item: calloc");
+			if (strlcpy($$->data.overload.tblname, $3,
+			    PF_TABLE_NAME_SIZE) >= PF_TABLE_NAME_SIZE)
+				errx(1, "state_opt_item: strlcpy");
+			free($3);
+			$$->type = PF_STATE_OPT_OVERLOAD;
+			$$->data.overload.flush = $5;
+			$$->next = NULL;
+			$$->tail = $$;
+		}
 		| MAXSRCNODES number			{
 			$$ = calloc(1, sizeof(struct node_state_opt));
 			if ($$ == NULL)
@@ -3007,7 +3221,7 @@ nataction	: no NAT natpass {
 		}
 		;
 
-natrule		: nataction interface af proto fromto tag redirpool pool_opts
+natrule		: nataction interface af proto fromto tag tagged redirpool pool_opts
 		{
 			struct pf_rule	r;
 
@@ -3037,46 +3251,55 @@ natrule		: nataction interface af proto fromto tag redirpool pool_opts
 					YYERROR;
 				}
 
+			if ($7.name)
+				if (strlcpy(r.match_tagname, $7.name,
+				    PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
+					yyerror("tag too long, max %u chars",
+					    PF_TAG_NAME_SIZE - 1);
+					YYERROR;
+				}
+			r.match_tag_not = $7.neg;
+
 			if (r.action == PF_NONAT || r.action == PF_NORDR) {
-				if ($7 != NULL) {
+				if ($8 != NULL) {
 					yyerror("translation rule with 'no' "
 					    "does not need '->'");
 					YYERROR;
 				}
 			} else {
-				if ($7 == NULL || $7->host == NULL) {
+				if ($8 == NULL || $8->host == NULL) {
 					yyerror("translation rule requires '-> "
 					    "address'");
 					YYERROR;
 				}
-				if (!r.af && ! $7->host->ifindex)
-					r.af = $7->host->af;
+				if (!r.af && ! $8->host->ifindex)
+					r.af = $8->host->af;
 
-				remove_invalid_hosts(&$7->host, &r.af);
-				if (invalid_redirect($7->host, r.af))
+				remove_invalid_hosts(&$8->host, &r.af);
+				if (invalid_redirect($8->host, r.af))
 					YYERROR;
-				if (check_netmask($7->host, r.af))
+				if (check_netmask($8->host, r.af))
 					YYERROR;
 
-				r.rpool.proxy_port[0] = ntohs($7->rport.a);
+				r.rpool.proxy_port[0] = ntohs($8->rport.a);
 
 				switch (r.action) {
 				case PF_RDR:
-					if (!$7->rport.b && $7->rport.t &&
+					if (!$8->rport.b && $8->rport.t &&
 					    $5.dst.port != NULL) {
 						r.rpool.proxy_port[1] =
-						    ntohs($7->rport.a) +
+						    ntohs($8->rport.a) +
 						    (ntohs(
 						    $5.dst.port->port[1]) -
 						    ntohs(
 						    $5.dst.port->port[0]));
 					} else
 						r.rpool.proxy_port[1] =
-						    ntohs($7->rport.b);
+						    ntohs($8->rport.b);
 					break;
 				case PF_NAT:
 					r.rpool.proxy_port[1] =
-					    ntohs($7->rport.b);
+					    ntohs($8->rport.b);
 					if (!r.rpool.proxy_port[0] &&
 					    !r.rpool.proxy_port[1]) {
 						r.rpool.proxy_port[0] =
@@ -3091,25 +3314,25 @@ natrule		: nataction interface af proto fromto tag redirpool pool_opts
 					break;
 				}
 
-				r.rpool.opts = $8.type;
+				r.rpool.opts = $9.type;
 				if ((r.rpool.opts & PF_POOL_TYPEMASK) ==
-				    PF_POOL_NONE && ($7->host->next != NULL ||
-				    $7->host->addr.type == PF_ADDR_TABLE ||
-				    DYNIF_MULTIADDR($7->host->addr)))
+				    PF_POOL_NONE && ($8->host->next != NULL ||
+				    $8->host->addr.type == PF_ADDR_TABLE ||
+				    DYNIF_MULTIADDR($8->host->addr)))
 					r.rpool.opts = PF_POOL_ROUNDROBIN;
 				if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
 				    PF_POOL_ROUNDROBIN &&
-				    disallow_table($7->host, "tables are only "
+				    disallow_table($8->host, "tables are only "
 				    "supported in round-robin redirection "
 				    "pools"))
 					YYERROR;
 				if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
 				    PF_POOL_ROUNDROBIN &&
-				    disallow_alias($7->host, "interface (%s) "
+				    disallow_alias($8->host, "interface (%s) "
 				    "is only supported in round-robin "
 				    "redirection pools"))
 					YYERROR;
-				if ($7->host->next != NULL) {
+				if ($8->host->next != NULL) {
 					if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
 					    PF_POOL_ROUNDROBIN) {
 						yyerror("only round-robin "
@@ -3120,14 +3343,14 @@ natrule		: nataction interface af proto fromto tag redirpool pool_opts
 				}
 			}
 
-			if ($8.key != NULL)
-				memcpy(&r.rpool.key, $8.key,
+			if ($9.key != NULL)
+				memcpy(&r.rpool.key, $9.key,
 				    sizeof(struct pf_poolhashkey));
 
-			 if ($8.opts)
-				r.rpool.opts |= $8.opts;
+			 if ($9.opts)
+				r.rpool.opts |= $9.opts;
 
-			if ($8.staticport) {
+			if ($9.staticport) {
 				if (r.action != PF_NAT) {
 					yyerror("the 'static-port' option is "
 					    "only valid with nat rules");
@@ -3146,14 +3369,14 @@ natrule		: nataction interface af proto fromto tag redirpool pool_opts
 				r.rpool.proxy_port[1] = 0;
 			}
 
-			expand_rule(&r, $2, $7 == NULL ? NULL : $7->host, $4,
+			expand_rule(&r, $2, $8 == NULL ? NULL : $8->host, $4,
 			    $5.src_os, $5.src.host, $5.src.port, $5.dst.host,
-			    $5.dst.port, 0, 0, 0);
-			free($7);
+			    $5.dst.port, 0, 0, 0, "");
+			free($8);
 		}
 		;
 
-binatrule	: no BINAT natpass interface af proto FROM host TO ipspec tag
+binatrule	: no BINAT natpass interface af proto FROM host TO ipspec tag tagged
 		    redirection
 		{
 			struct pf_rule		binat;
@@ -3174,8 +3397,9 @@ binatrule	: no BINAT natpass interface af proto FROM host TO ipspec tag
 				binat.af = $8->af;
 			if (!binat.af && $10 != NULL && $10->af)
 				binat.af = $10->af;
-			if (!binat.af && $12 != NULL && $12->host)
-				binat.af = $12->host->af;
+
+			if (!binat.af && $13 != NULL && $13->host)
+				binat.af = $13->host->af;
 			if (!binat.af) {
 				yyerror("address family (inet/inet6) "
 				    "undefined");
@@ -3188,6 +3412,7 @@ binatrule	: no BINAT natpass interface af proto FROM host TO ipspec tag
 				binat.ifnot = $4->not;
 				free($4);
 			}
+
 			if ($11 != NULL)
 				if (strlcpy(binat.tagname, $11,
 				    PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
@@ -3195,6 +3420,14 @@ binatrule	: no BINAT natpass interface af proto FROM host TO ipspec tag
 					    PF_TAG_NAME_SIZE - 1);
 					YYERROR;
 				}
+			if ($12.name)
+				if (strlcpy(binat.match_tagname, $12.name,
+				    PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
+					yyerror("tag too long, max %u chars",
+					    PF_TAG_NAME_SIZE - 1);
+					YYERROR;
+				}
+			binat.match_tag_not = $12.neg;
 
 			if ($6 != NULL) {
 				binat.proto = $6->proto;
@@ -3208,12 +3441,12 @@ binatrule	: no BINAT natpass interface af proto FROM host TO ipspec tag
 			    "interface (%s) as the source address of a binat "
 			    "rule"))
 				YYERROR;
-			if ($12 != NULL && $12->host != NULL && disallow_table(
-			    $12->host, "invalid use of table <%s> as the "
+			if ($13 != NULL && $13->host != NULL && disallow_table(
+			    $13->host, "invalid use of table <%s> as the "
 			    "redirect address of a binat rule"))
 				YYERROR;
-			if ($12 != NULL && $12->host != NULL && disallow_alias(
-			    $12->host, "invalid use of interface (%s) as the "
+			if ($13 != NULL && $13->host != NULL && disallow_alias(
+			    $13->host, "invalid use of interface (%s) as the "
 			    "redirect address of a binat rule"))
 				YYERROR;
 
@@ -3247,38 +3480,38 @@ binatrule	: no BINAT natpass interface af proto FROM host TO ipspec tag
 					YYERROR;
 				memcpy(&binat.dst.addr, &$10->addr,
 				    sizeof(binat.dst.addr));
-				binat.dst.not = $10->not;
+				binat.dst.neg = $10->not;
 				free($10);
 			}
 
 			if (binat.action == PF_NOBINAT) {
-				if ($12 != NULL) {
+				if ($13 != NULL) {
 					yyerror("'no binat' rule does not need"
 					    " '->'");
 					YYERROR;
 				}
 			} else {
-				if ($12 == NULL || $12->host == NULL) {
+				if ($13 == NULL || $13->host == NULL) {
 					yyerror("'binat' rule requires"
 					    " '-> address'");
 					YYERROR;
 				}
 
-				remove_invalid_hosts(&$12->host, &binat.af);
-				if (invalid_redirect($12->host, binat.af))
+				remove_invalid_hosts(&$13->host, &binat.af);
+				if (invalid_redirect($13->host, binat.af))
 					YYERROR;
-				if ($12->host->next != NULL) {
+				if ($13->host->next != NULL) {
 					yyerror("binat rule must redirect to "
 					    "a single address");
 					YYERROR;
 				}
-				if (check_netmask($12->host, binat.af))
+				if (check_netmask($13->host, binat.af))
 					YYERROR;
 
 				if (!PF_AZERO(&binat.src.addr.v.a.mask,
 				    binat.af) &&
 				    !PF_AEQ(&binat.src.addr.v.a.mask,
-				    &$12->host->addr.v.a.mask, binat.af)) {
+				    &$13->host->addr.v.a.mask, binat.af)) {
 					yyerror("'binat' source mask and "
 					    "redirect mask must be the same");
 					YYERROR;
@@ -3288,15 +3521,15 @@ binatrule	: no BINAT natpass interface af proto FROM host TO ipspec tag
 				pa = calloc(1, sizeof(struct pf_pooladdr));
 				if (pa == NULL)
 					err(1, "binat: calloc");
-				pa->addr = $12->host->addr;
+				pa->addr = $13->host->addr;
 				pa->ifname[0] = 0;
 				TAILQ_INSERT_TAIL(&binat.rpool.list,
 				    pa, entries);
 
-				free($12);
+				free($13);
 			}
 
-			pfctl_add_rule(pf, &binat);
+			pfctl_add_rule(pf, &binat, "");
 		}
 		;
 
@@ -3304,18 +3537,15 @@ tag		: /* empty */		{ $$ = NULL; }
 		| TAG STRING		{ $$ = $2; }
 		;
 
+tagged		: /* empty */		{ $$.neg = 0; $$.name = NULL; }
+		| not TAGGED string	{ $$.neg = $1; $$.name = $3; }
+		;
+
 route_host	: STRING			{
 			$$ = calloc(1, sizeof(struct node_host));
 			if ($$ == NULL)
 				err(1, "route_host: calloc");
 			$$->ifname = $1;
-			if (ifa_exists($$->ifname, 0) == NULL) {
-				yyerror("routeto: unknown interface %s",
-				    $$->ifname);
-				free($1);
-				free($$);
-				YYERROR;
-			}
 			set_ipmask($$, 128);
 			$$->next = NULL;
 			$$->tail = $$;
@@ -3323,11 +3553,6 @@ route_host	: STRING			{
 		| '(' STRING host ')'		{
 			$$ = $3;
 			$$->ifname = $2;
-			if (ifa_exists($$->ifname, 0) == NULL) {
-				yyerror("routeto: unknown interface %s",
-				    $$->ifname);
-				YYERROR;
-			}
 		}
 		;
 
@@ -3430,6 +3655,8 @@ yesno		: NO			{ $$ = 0; }
 			if (!strcmp($1, "yes"))
 				$$ = 1;
 			else {
+				yyerror("invalid value '%s', expected 'yes' "
+				    "or 'no'", $1);
 				free($1);
 				YYERROR;
 			}
@@ -3493,6 +3720,7 @@ rule_consistent(struct pf_rule *r)
 	case PF_PASS:
 	case PF_DROP:
 	case PF_SCRUB:
+	case PF_NOSCRUB:
 		problems = filter_consistent(r);
 		break;
 	case PF_NAT:
@@ -3530,6 +3758,12 @@ filter_consistent(struct pf_rule *r)
 		yyerror("must indicate address family with icmp-type/code");
 		problems++;
 	}
+	if (r->overload_tblname[0] &&
+	    r->max_src_conn == 0 && r->max_src_conn_rate.seconds == 0) {
+		yyerror("'overload' requires 'max-src-conn' "
+		    "or 'max-src-conn-rate'");
+		problems++;
+	}
 	if ((r->proto == IPPROTO_ICMP && r->af == AF_INET6) ||
 	    (r->proto == IPPROTO_ICMPV6 && r->af == AF_INET)) {
 		yyerror("proto %s doesn't match address family %s",
@@ -3559,7 +3793,7 @@ filter_consistent(struct pf_rule *r)
 		problems++;
 	}
 	if ((r->tagname[0] || r->match_tagname[0]) && !r->keep_state &&
-	    r->action == PF_PASS && !r->anchorname[0]) {
+	    r->action == PF_PASS) {
 		yyerror("tags cannot be used without keep state");
 		problems++;
 	}
@@ -3630,7 +3864,7 @@ process_tabledef(char *name, struct table_opts *opts)
 		    &opts->init_nodes);
 	if (!(pf->opts & PF_OPT_NOACTION) &&
 	    pfctl_define_table(name, opts->flags, opts->init_addr,
-	    pf->anchor, pf->ruleset, &ab, pf->tticket)) {
+	    pf->anchor, &ab, pf->tticket)) {
 		yyerror("cannot define table %s: %s", name,
 		    pfr_strerror(errno));
 		goto _error;
@@ -4096,7 +4330,8 @@ expand_rule(struct pf_rule *r,
     struct node_proto *protos, struct node_os *src_oses,
     struct node_host *src_hosts, struct node_port *src_ports,
     struct node_host *dst_hosts, struct node_port *dst_ports,
-    struct node_uid *uids, struct node_gid *gids, struct node_icmp *icmp_types)
+    struct node_uid *uids, struct node_gid *gids, struct node_icmp *icmp_types,
+    const char *anchor_call)
 {
 	sa_family_t		 af = r->af;
 	int			 added = 0, error = 0;
@@ -4149,11 +4384,12 @@ expand_rule(struct pf_rule *r,
 			r->af = dst_host->af;
 
 		if (*interface->ifname)
-			memcpy(r->ifname, interface->ifname, sizeof(r->ifname));
+			strlcpy(r->ifname, interface->ifname,
+			    sizeof(r->ifname));
 		else if (if_indextoname(src_host->ifindex, ifname))
-			memcpy(r->ifname, ifname, sizeof(r->ifname));
+			strlcpy(r->ifname, ifname, sizeof(r->ifname));
 		else if (if_indextoname(dst_host->ifindex, ifname))
-			memcpy(r->ifname, ifname, sizeof(r->ifname));
+			strlcpy(r->ifname, ifname, sizeof(r->ifname));
 		else
 			memset(r->ifname, '\0', sizeof(r->ifname));
 
@@ -4180,12 +4416,12 @@ expand_rule(struct pf_rule *r,
 		r->ifnot = interface->not;
 		r->proto = proto->proto;
 		r->src.addr = src_host->addr;
-		r->src.not = src_host->not;
+		r->src.neg = src_host->not;
 		r->src.port[0] = src_port->port[0];
 		r->src.port[1] = src_port->port[1];
 		r->src.port_op = src_port->op;
 		r->dst.addr = dst_host->addr;
-		r->dst.not = dst_host->not;
+		r->dst.neg = dst_host->not;
 		r->dst.port[0] = dst_port->port[0];
 		r->dst.port[1] = dst_port->port[1];
 		r->dst.port_op = dst_port->op;
@@ -4248,7 +4484,7 @@ expand_rule(struct pf_rule *r,
 			yyerror("skipping rule due to errors");
 		else {
 			r->nr = pf->rule_nr++;
-			pfctl_add_rule(pf, r);
+			pfctl_add_rule(pf, r, anchor_call);
 			added++;
 		}
 
@@ -4270,6 +4506,42 @@ expand_rule(struct pf_rule *r,
 		yyerror("rule expands to no valid combination");
 }
 
+int
+expand_skip_interface(struct node_if *interfaces)
+{
+	int	errs = 0;
+
+	if (!interfaces || (!interfaces->next && !interfaces->not &&
+	    !strcmp(interfaces->ifname, "none"))) {
+		if (pf->opts & PF_OPT_VERBOSE)
+			printf("set skip on none\n");
+		errs = pfctl_set_interface_flags(pf, "", PFI_IFLAG_SKIP, 0);
+		return (errs);
+	}
+
+	if (pf->opts & PF_OPT_VERBOSE)
+		printf("set skip on {");
+	LOOP_THROUGH(struct node_if, interface, interfaces,
+		if (pf->opts & PF_OPT_VERBOSE)
+			printf(" %s", interface->ifname);
+		if (interface->not) {
+			yyerror("skip on ! <interface> is not supported");
+			errs++;
+		} else
+			errs += pfctl_set_interface_flags(pf,
+			    interface->ifname, PFI_IFLAG_SKIP, 1);
+	);
+	if (pf->opts & PF_OPT_VERBOSE)
+		printf(" }\n");
+
+	FREE_LIST(struct node_if, interfaces);
+
+	if (errs)
+		return (1);
+	else
+		return (0);
+}
+
 #undef FREE_LIST
 #undef LOOP_THROUGH
 
@@ -4320,6 +4592,7 @@ lookup(char *s)
 		{ "fingerprints",	FINGERPRINTS},
 		{ "flags",		FLAGS},
 		{ "floating",		FLOATING},
+		{ "flush",		FLUSH},
 		{ "for",		FOR},
 		{ "fragment",		FRAGMENT},
 		{ "from",		FROM},
@@ -4344,6 +4617,8 @@ lookup(char *s)
 		{ "loginterface",	LOGINTERFACE},
 		{ "max",		MAXIMUM},
 		{ "max-mss",		MAXMSS},
+		{ "max-src-conn",	MAXSRCCONN},
+		{ "max-src-conn-rate",	MAXSRCCONNRATE},
 		{ "max-src-nodes",	MAXSRCNODES},
 		{ "max-src-states",	MAXSRCSTATES},
 		{ "min-ttl",		MINTTL},
@@ -4358,10 +4633,12 @@ lookup(char *s)
 		{ "optimization",	OPTIMIZATION},
 		{ "os",			OS},
 		{ "out",		OUT},
+		{ "overload",		OVERLOAD},
 		{ "pass",		PASS},
 		{ "port",		PORT},
 		{ "priority",		PRIORITY},
 		{ "priq",		PRIQ},
+		{ "probability",	PROBABILITY},
 		{ "proto",		PROTO},
 		{ "qlimit",		QLIMIT},
 		{ "queue",		QUEUE},
@@ -4379,10 +4656,12 @@ lookup(char *s)
 		{ "return-icmp6",	RETURNICMP6},
 		{ "return-rst",		RETURNRST},
 		{ "round-robin",	ROUNDROBIN},
+		{ "route",		ROUTE},
 		{ "route-to",		ROUTETO},
 		{ "rule",		RULE},
 		{ "scrub",		SCRUB},
 		{ "set",		SET},
+		{ "skip",		SKIP},
 		{ "source-hash",	SOURCEHASH},
 		{ "source-track",	SOURCETRACK},
 		{ "state",		STATE},
@@ -4834,7 +5113,7 @@ getservice(char *n)
 
 	if (atoul(n, &ulval) == 0) {
 		if (ulval > 65535) {
-			yyerror("illegal port value %d", ulval);
+			yyerror("illegal port value %lu", ulval);
 			return (-1);
 		}
 		return (htons(ulval));
@@ -4884,7 +5163,7 @@ parseicmpspec(char *w, sa_family_t af)
 		ulval = p->code;
 	}
 	if (ulval > 255) {
-		yyerror("invalid icmp code %ld", ulval);
+		yyerror("invalid icmp code %lu", ulval);
 		return (0);
 	}
 	return (icmptype << 8 | ulval);
@@ -4897,10 +5176,10 @@ pfctl_load_anchors(int dev, int opts, struct pfr_buffer *trans)
 
 	TAILQ_FOREACH(la, &loadanchorshead, entries) {
 		if (opts & PF_OPT_VERBOSE)
-			fprintf(stderr, "\nLoading anchor %s:%s from %s\n",
-			    la->anchorname, la->rulesetname, la->filename);
+			fprintf(stderr, "\nLoading anchor %s from %s\n",
+			    la->anchorname, la->filename);
 		if (pfctl_rules(dev, la->filename, opts, la->anchorname,
-		    la->rulesetname, trans) == -1)
+		    trans) == -1)
 			return (-1);
 	}
 
diff --git a/contrib/pf/pfctl/pf_print_state.c b/contrib/pf/pfctl/pf_print_state.c
index b7cf5ca..a41e9e5 100644
--- a/contrib/pf/pfctl/pf_print_state.c
+++ b/contrib/pf/pfctl/pf_print_state.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pf_print_state.c,v 1.39 2004/02/10 17:48:08 henning Exp $	*/
+/*	$OpenBSD: pf_print_state.c,v 1.40 2004/12/10 22:13:26 henning Exp $	*/
 
 /*
  * Copyright (c) 2001 Daniel Hartmeier
@@ -96,6 +96,9 @@ print_addr(struct pf_addr_wrap *addr, sa_family_t af, int verbose)
 	case PF_ADDR_NOROUTE:
 		printf("no-route");
 		return;
+	case PF_ADDR_RTLABEL:
+		printf("route \"%s\"", addr->v.rtlabelname);
+		return;
 	default:
 		printf("?");
 		return;
diff --git a/contrib/pf/pfctl/pfctl.8 b/contrib/pf/pfctl/pfctl.8
index 6fac2d5..9fdb00e 100644
--- a/contrib/pf/pfctl/pfctl.8
+++ b/contrib/pf/pfctl/pfctl.8
@@ -1,4 +1,4 @@
-.\" $OpenBSD: pfctl.8,v 1.110 2004/03/20 09:31:42 david Exp $
+.\" $OpenBSD: pfctl.8,v 1.118 2005/01/05 23:41:45 jmc Exp $
 .\"
 .\" Copyright (c) 2001 Kjell Wooding.  All rights reserved.
 .\"
@@ -33,17 +33,23 @@
 .Sh SYNOPSIS
 .Nm pfctl
 .Bk -words
-.Op Fl AdeghNnOqRrvz
-.Op Fl a Ar anchor Ns Op Ar :ruleset
-.Op Fl D Ar macro=value
+.Op Fl AdeghmNnOoqRrvz
+.Op Fl a Ar anchor
+.Xo
+.Oo Fl D
+.Ar macro Ns = Ns Ar value Oc
+.Xc
 .Op Fl F Ar modifier
 .Op Fl f Ar file
 .Op Fl i Ar interface
 .Op Fl k Ar host
 .Op Fl p Ar device
 .Op Fl s Ar modifier
-.Op Fl T Ar command Op Ar address ...
-.Op Fl t Ar table
+.Oo Xo
+.Fl t Ar table
+.Fl T Ar command
+.Op Ar address ... Oc
+.Xc
 .Op Fl x Ar level
 .Ek
 .Sh DESCRIPTION
@@ -72,9 +78,14 @@ supported.
 Translation rules are described in
 .Xr pf.conf 5 .
 .Pp
-When the variable pf is set to YES in
-.Xr rc.conf 8 ,
-the rule file specified with the variable pf_rules
+When the variable
+.Va pf
+is set to
+.Dv YES
+in
+.Xr rc.conf.local 8 ,
+the rule file specified with the variable
+.Va pf_rules
 is loaded automatically by the
 .Xr rc 8
 scripts and the packet filter is enabled.
@@ -85,7 +96,7 @@ Forwarding can be enabled by setting the
 variables
 .Em net.inet.ip.forwarding
 and/or
-.Em net.inet6.ip6.forwarding ,
+.Em net.inet6.ip6.forwarding
 to 1.
 Set them permanently in
 .Xr sysctl.conf 5 .
@@ -98,48 +109,59 @@ The options are as follows:
 .It Fl A
 Load only the queue rules present in the rule file.
 Other rules and options are ignored.
-.It Fl a Ar anchor Ns Op Ar :ruleset
+.It Fl a Ar anchor
 Apply flags
 .Fl f ,
-.Fl F
+.Fl F ,
 and
 .Fl s
 only to the rules in the specified
-.Ar anchor
-and optional named ruleset
-.Ar ruleset .
+.Ar anchor .
 In addition to the main ruleset,
 .Nm
-can load and manipulate additional rulesets by name.
-Named rulesets are attached at
-.Ar anchor
-points, which are also referenced by name.
+can load and manipulate additional rulesets by name,
+called anchors.
+The main ruleset is the default anchor.
+.Pp
+Anchors are referenced by name and may be nested,
+with the various components of the anchor path separated by
+.Sq /
+characters, similar to how file system hierarchies are laid out.
+The last component of the anchor path is where ruleset operations are
+performed.
+.Pp
 Evaluation of
 .Ar anchor
 rules from the main ruleset is described in
 .Xr pf.conf 5 .
-For example, to show all filter rules inside anchor
-.Li foo :
+.Pp
+For example, the following will show all filter rules (see the
+.Fl s
+flag below) inside the anchor
+.Li authpf/smith(1234) ,
+which would have been created for user smith by
+.Xr authpf 8 ,
+PID 1234:
 .Bd -literal -offset indent
-# pfctl -a foo -s rules
+# pfctl -a "authpf/smith(1234)" -s rules
 .Ed
 .Pp
-Private tables can also be put inside subrulesets, either by having table
+Private tables can also be put inside anchors, either by having table
 statements in the
 .Xr pf.conf 5
-file that is loaded in the anchor, or by using regular table commands as in:
+file that is loaded in the anchor, or by using regular table commands, as in:
 .Bd -literal -offset indent
-# pfctl -a foo:bar -t mytable -T add 1.2.3.4 5.6.7.8
+# pfctl -a foo/bar -t mytable -T add 1.2.3.4 5.6.7.8
 .Ed
 .Pp
 When a rule referring to a table is loaded in an anchor, the rule will use the
-private table if one is defined, and then fallback to the table defined in the
+private table if one is defined, and then fall back to the table defined in the
 main ruleset, if there is one.
-This is similar to C rules for variables.
+This is similar to C rules for variable scope.
 It is possible to create distinct tables with the same name in the global
 ruleset and in an anchor, but this is often bad design and a warning will be
 issued in that case.
-.It Fl D Ar macro=value
+.It Fl D Ar macro Ns = Ns Ar value
 Define
 .Ar macro
 to be set to
@@ -158,23 +180,23 @@ Flush the filter parameters specified by
 (may be abbreviated):
 .Pp
 .Bl -tag -width xxxxxxxxxxxx -compact
-.It Fl F Ar nat
+.It Fl F Cm nat
 Flush the NAT rules.
-.It Fl F Ar queue
+.It Fl F Cm queue
 Flush the queue rules.
-.It Fl F Ar rules
+.It Fl F Cm rules
 Flush the filter rules.
-.It Fl F Ar state
+.It Fl F Cm state
 Flush the state table (NAT and filter).
-.It Fl F Ar Sources
+.It Fl F Cm Sources
 Flush the source tracking table.
-.It Fl F Ar info
+.It Fl F Cm info
 Flush the filter information (statistics that are not bound to rules).
-.It Fl F Ar Tables
+.It Fl F Cm Tables
 Flush the tables.
-.It Fl F Ar osfp
+.It Fl F Cm osfp
 Flush the passive operating system fingerprints.
-.It Fl F Ar all
+.It Fl F Cm all
 Flush all of the above.
 .El
 .It Fl f Ar file
@@ -216,6 +238,13 @@ to
 .Bd -literal -offset indent
 # pfctl -k host1 -k host2
 .Ed
+.It Fl m
+Merge in explicitly given options without resetting those
+which are omitted.
+Allows single options to be modified without disturbing the others:
+.Bd -literal -offset indent
+# echo "set loginterface fxp0" | pfctl -mf -
+.Ed
 .It Fl N
 Load only the NAT rules present in the rule file.
 Other rules and options are ignored.
@@ -224,6 +253,39 @@ Do not actually load rules, just parse them.
 .It Fl O
 Load only the options present in the rule file.
 Other rules and options are ignored.
+.It Fl o
+Enable the ruleset optimizer.
+The ruleset optimizer attempts to improve rulesets by removing rule
+duplication and making better use of rule ordering.
+Specifically, it does four things:
+.Pp
+.Bl -enum -compact
+.It
+remove duplicate rules
+.It
+remove rules that are a subset of another rule
+.It
+combine multiple rules into a table when advantageous
+.It
+re-order the rules to improve evaluation performance
+.El
+.Pp
+A second
+.Fl o
+may be specified to use the currently loaded ruleset as a feedback profile
+to tailor the optimization of the
+.Ar quick
+rules to the actual network behavior.
+.Pp
+It is important to note that the ruleset optimizer will modify the ruleset
+to improve performance.
+A side effect of the ruleset modification is that per-rule accounting
+statistics will have different meanings than before.
+If per-rule accounting is important for billing purposes or whatnot, either
+the ruleset optimizer should not be used or a
+.Ar label
+field should be added to all of the accounting rules to act as optimization
+barriers.
 .It Fl p Ar device
 Use the device file
 .Ar device
@@ -242,9 +304,9 @@ Show the filter parameters specified by
 (may be abbreviated):
 .Pp
 .Bl -tag -width xxxxxxxxxxxxx -compact
-.It Fl s Ar nat
+.It Fl s Cm nat
 Show the currently loaded NAT rules.
-.It Fl s Ar queue
+.It Fl s Cm queue
 Show the currently loaded queue rules.
 When used together with
 .Fl v ,
@@ -254,51 +316,58 @@ When used together with
 .Nm
 will loop and show updated queue statistics every five seconds, including
 measured bandwidth and packets per second.
-.It Fl s Ar rules
+.It Fl s Cm rules
 Show the currently loaded filter rules.
 When used together with
 .Fl v ,
 the per-rule statistics (number of evaluations,
 packets and bytes) are also shown.
-Note that the 'skip step' optimization done automatically by the kernel
+Note that the
+.Dq skip step
+optimization done automatically by the kernel
 will skip evaluation of rules where possible.
 Packets passed statefully are counted in the rule that created the state
 (even though the rule isn't evaluated more than once for the entire
 connection).
-.It Fl s Ar Anchors
-Show the currently loaded anchors.
+.It Fl s Cm Anchors
+Show the currently loaded anchors directly attached to the main ruleset.
 If
 .Fl a Ar anchor
-is specified as well, the named rulesets currently loaded in the specified
-anchor are shown instead.
-.It Fl s Ar state
+is specified as well, the anchors loaded directly below the given
+.Ar anchor
+are shown instead.
+If
+.Fl v
+is specified, all anchors attached under the target anchor will be
+displayed recursively.
+.It Fl s Cm state
 Show the contents of the state table.
-.It Fl s Ar Sources
+.It Fl s Cm Sources
 Show the contents of the source tracking table.
-.It Fl s Ar info
+.It Fl s Cm info
 Show filter information (statistics and counters).
 When used together with
 .Fl v ,
 source tracking statistics are also shown.
-.It Fl s Ar labels
+.It Fl s Cm labels
 Show per-rule statistics (label, evaluations, packets, bytes) of
 filter rules with labels, useful for accounting.
-.It Fl s Ar timeouts
+.It Fl s Cm timeouts
 Show the current global timeouts.
-.It Fl s Ar memory
+.It Fl s Cm memory
 Show the current pool memory hard limits.
-.It Fl s Ar Tables
+.It Fl s Cm Tables
 Show the list of tables.
-.It Fl s Ar osfp
+.It Fl s Cm osfp
 Show the list of operating system fingerprints.
-.It Fl s Ar Interfaces
+.It Fl s Cm Interfaces
 Show the list of interfaces and interface drivers available to PF.
 When used together with a double
 .Fl v ,
 interface statistics are also shown.
 .Fl i
 can be used to select an interface or a group of interfaces.
-.It Fl s Ar all
+.It Fl s Cm all
 Show all of the above, except for the lists of interfaces and operating
 system fingerprints.
 .El
@@ -309,25 +378,25 @@ Specify the
 Commands include:
 .Pp
 .Bl -tag -width xxxxxxxxxxxx -compact
-.It Fl T Ar kill
+.It Fl T Cm kill
 Kill a table.
-.It Fl T Ar flush
+.It Fl T Cm flush
 Flush all addresses of a table.
-.It Fl T Ar add
+.It Fl T Cm add
 Add one or more addresses in a table.
 Automatically create a nonexisting table.
-.It Fl T Ar delete
+.It Fl T Cm delete
 Delete one or more addresses from a table.
-.It Fl T Ar replace
+.It Fl T Cm replace
 Replace the addresses of the table.
 Automatically create a nonexisting table.
-.It Fl T Ar show
+.It Fl T Cm show
 Show the content (addresses) of a table.
-.It Fl T Ar test
+.It Fl T Cm test
 Test if the given addresses match a table.
-.It Fl T Ar zero
+.It Fl T Cm zero
 Clear all the statistics of a table.
-.It Fl T Ar load
+.It Fl T Cm load
 Load only the table definitions from
 .Xr pf.conf 5 .
 This is used in conjunction with the
@@ -339,16 +408,18 @@ flag, as in:
 .El
 .Pp
 For the
-.Ar add ,
-.Ar delete ,
-.Ar replace
+.Cm add ,
+.Cm delete ,
+.Cm replace ,
 and
-.Ar test
+.Cm test
 commands, the list of addresses can be specified either directly on the command
 line and/or in an unformatted text file, using the
 .Fl f
 flag.
-Comments starting with a "#" are allowed in the text file.
+Comments starting with a
+.Sq #
+are allowed in the text file.
 With these commands, the
 .Fl v
 flag can also be used once or twice, in which case
@@ -365,11 +436,17 @@ The address/network has been changed (negated).
 .It D
 The address/network has been deleted.
 .It M
-The address matches (test operation only).
+The address matches
+.Po
+.Cm test
+operation only
+.Pc .
 .It X
 The address/network is duplicated and therefore ignored.
 .It Y
-The address/network cannot be added/deleted due to conflicting "!" attribute.
+The address/network cannot be added/deleted due to conflicting
+.Sq \&!
+attributes.
 .It Z
 The address/network has been cleared (statistics).
 .El
@@ -381,8 +458,8 @@ flag of
 For example, the following commands define a wide open firewall which will keep
 track of packets going to or coming from the
 .Ox
-ftp server.
-The following commands configure the firewall and send 10 pings to the ftp
+FTP server.
+The following commands configure the firewall and send 10 pings to the FTP
 server:
 .Bd -literal -offset indent
 # printf "table <test> { ftp.openbsd.org }\en \e
@@ -391,11 +468,11 @@ server:
 .Ed
 .Pp
 We can now use the table
-.Ar show
+.Cm show
 command to output, for each address and packet direction, the number of packets
 and bytes that are being passed or blocked by rules referencing the table.
 The time at which the current accounting started is also shown with the
-.Ar Cleared
+.Dq Cleared
 line.
 .Bd -literal -offset indent
 # pfctl -t test -vTshow
@@ -411,7 +488,8 @@ Similarly, it is possible to view global information about the tables
 by using the
 .Fl v
 modifier twice and the
-.Ar show Tables
+.Fl s
+.Cm Tables
 command.
 This will display the number of addresses on each table,
 the number of rules which reference the table, and the global
@@ -432,16 +510,18 @@ packet statistics for the whole table:
 .Ed
 .Pp
 As we can see here, only one packet \- the initial ping request \- matched the
-table; but all packets passing as the result of the state are correctly
+table, but all packets passing as the result of the state are correctly
 accounted for.
 Reloading the table(s) or ruleset will not affect packet accounting in any way.
 The two
-.Ar XPass
+.Dq XPass
 counters are incremented instead of the
-.Ar Pass
-counters when a "stateful" packet is passed but doesn't match the table
-anymore.
-This will happen in our example if someone flushes the table while the ping
+.Dq Pass
+counters when a
+.Dq stateful
+packet is passed but doesn't match the table anymore.
+This will happen in our example if someone flushes the table while the
+.Xr ping 8
 command is running.
 .Pp
 When used with a single
@@ -455,11 +535,11 @@ The flags are defined as follows:
 For constant tables, which cannot be altered outside
 .Xr pf.conf 5 .
 .It p
-For persistent tables, which don't get automatically flushed when no rules
+For persistent tables, which don't get automatically killed when no rules
 refer to them.
 .It a
 For tables which are part of the
-.Ar active
+.Em active
 tableset.
 Tables without this flag do not really exist, cannot contain addresses, and are
 only listed if the
@@ -467,7 +547,7 @@ only listed if the
 flag is given.
 .It i
 For tables which are part of the
-.Ar inactive
+.Em inactive
 tableset.
 This flag can only be witnessed briefly during the loading of
 .Xr pf.conf 5 .
@@ -475,7 +555,7 @@ This flag can only be witnessed briefly during the loading of
 For tables which are referenced (used) by rules.
 .It h
 This flag is set when a table in the main ruleset is hidden by one or more
-tables of the same name in sub-rulesets (anchors).
+tables of the same name from anchors attached below it.
 .El
 .It Fl t Ar table
 Specify the name of the table.
@@ -484,20 +564,20 @@ Produce more verbose output.
 A second use of
 .Fl v
 will produce even more verbose output including ruleset warnings.
-See previous section for its effect on table commands.
+See the previous section for its effect on table commands.
 .It Fl x Ar level
 Set the debug
 .Ar level
 (may be abbreviated) to one of the following:
 .Pp
 .Bl -tag -width xxxxxxxxxxxx -compact
-.It Fl x Ar none
+.It Fl x Cm none
 Don't generate debug messages.
-.It Fl x Ar urgent
+.It Fl x Cm urgent
 Generate debug messages only for serious errors.
-.It Fl x Ar misc
+.It Fl x Cm misc
 Generate debug messages for various errors.
-.It Fl x Ar loud
+.It Fl x Cm loud
 Generate debug messages for common conditions.
 .El
 .It Fl z
@@ -507,12 +587,15 @@ Clear per-rule statistics.
 .Bl -tag -width "/etc/pf.conf" -compact
 .It Pa /etc/pf.conf
 Packet filter rules file.
+.It Pa /etc/pf.os
+Passive operating system fingerprint database.
 .El
 .Sh SEE ALSO
 .Xr pf 4 ,
 .Xr pf.conf 5 ,
 .Xr pf.os 5 ,
 .Xr sysctl.conf 5 ,
+.Xr authpf 8 ,
 .Xr ftp-proxy 8 ,
 .Xr rc 8 ,
 .Xr rc.conf 8 ,
diff --git a/contrib/pf/pfctl/pfctl.c b/contrib/pf/pfctl/pfctl.c
index e13e1f4..2e628e5 100644
--- a/contrib/pf/pfctl/pfctl.c
+++ b/contrib/pf/pfctl/pfctl.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pfctl.c,v 1.213 2004/03/20 09:31:42 david Exp $ */
+/*	$OpenBSD: pfctl.c,v 1.234 2005/03/07 13:52:50 henning Exp $ */
 
 /*
  * Copyright (c) 2001 Daniel Hartmeier
@@ -34,6 +34,7 @@
 #include <sys/types.h>
 #include <sys/ioctl.h>
 #include <sys/socket.h>
+#include <sys/stat.h>
 
 #include <net/if.h>
 #include <netinet/in.h>
@@ -58,23 +59,31 @@ void	 usage(void);
 int	 pfctl_enable(int, int);
 int	 pfctl_disable(int, int);
 int	 pfctl_clear_stats(int, int);
-int	 pfctl_clear_rules(int, int, char *, char *);
-int	 pfctl_clear_nat(int, int, char *, char *);
+int	 pfctl_clear_interface_flags(int, int);
+int	 pfctl_clear_rules(int, int, char *);
+int	 pfctl_clear_nat(int, int, char *);
 int	 pfctl_clear_altq(int, int);
 int	 pfctl_clear_src_nodes(int, int);
 int	 pfctl_clear_states(int, const char *, int);
 int	 pfctl_kill_states(int, const char *, int);
+void	 pfctl_init_options(struct pfctl *);
+int	 pfctl_load_options(struct pfctl *);
+int	 pfctl_load_limit(struct pfctl *, unsigned int, unsigned int);
+int	 pfctl_load_timeout(struct pfctl *, unsigned int, unsigned int);
+int	 pfctl_load_debug(struct pfctl *, unsigned int);
+int	 pfctl_load_logif(struct pfctl *, char *);
+int	 pfctl_load_hostid(struct pfctl *, unsigned int);
 int	 pfctl_get_pool(int, struct pf_pool *, u_int32_t, u_int32_t, int,
-	    char *, char *);
+	    char *);
 void	 pfctl_print_rule_counters(struct pf_rule *, int);
-int	 pfctl_show_rules(int, int, int, char *, char *);
-int	 pfctl_show_nat(int, int, char *, char *);
+int	 pfctl_show_rules(int, int, int, char *);
+int	 pfctl_show_nat(int, int, char *);
 int	 pfctl_show_src_nodes(int, int);
 int	 pfctl_show_states(int, const char *, int);
 int	 pfctl_show_status(int, int);
 int	 pfctl_show_timeouts(int, int);
 int	 pfctl_show_limits(int, int);
-int	 pfctl_debug(int, u_int32_t, int);
+void	 pfctl_debug(int, u_int32_t, int);
 int	 pfctl_clear_rule_counters(int, int);
 int	 pfctl_test_altqsupport(int, int);
 int	 pfctl_show_anchors(int, int, char *);
@@ -121,6 +130,7 @@ static const struct pf_hint pf_hint_normal[] = {
 	{ "tcp.closing",	15 * 60 },
 	{ "tcp.finwait",	45 },
 	{ "tcp.closed",		90 },
+	{ "tcp.tsdiff",		30 },
 	{ NULL,			0 }
 };
 static const struct pf_hint pf_hint_satellite[] = {
@@ -130,6 +140,7 @@ static const struct pf_hint pf_hint_satellite[] = {
 	{ "tcp.closing",	15 * 60 + 5 },
 	{ "tcp.finwait",	45 + 5 },
 	{ "tcp.closed",		90 + 5 },
+	{ "tcp.tsdiff",		60 },
 	{ NULL,			0 }
 };
 static const struct pf_hint pf_hint_conservative[] = {
@@ -139,6 +150,7 @@ static const struct pf_hint pf_hint_conservative[] = {
 	{ "tcp.closing",	60 * 60 },
 	{ "tcp.finwait",	10 * 60 },
 	{ "tcp.closed",		3 * 60 },
+	{ "tcp.tsdiff",		60 },
 	{ NULL,			0 }
 };
 static const struct pf_hint pf_hint_aggressive[] = {
@@ -148,6 +160,7 @@ static const struct pf_hint pf_hint_aggressive[] = {
 	{ "tcp.closing",	60 },
 	{ "tcp.finwait",	30 },
 	{ "tcp.closed",		30 },
+	{ "tcp.tsdiff",		10 },
 	{ NULL,			0 }
 };
 
@@ -189,14 +202,14 @@ usage(void)
 {
 	extern char *__progname;
 
-	fprintf(stderr, "usage: %s [-AdeghNnOqRrvz] ", __progname);
-	fprintf(stderr, "[-a anchor[:ruleset]] [-D macro=value]\n");
+	fprintf(stderr, "usage: %s [-AdeghmNnOoqRrvz] ", __progname);
+	fprintf(stderr, "[-a anchor] [-D macro=value] [-F modifier]\n");
 	fprintf(stderr, "             ");
-	fprintf(stderr, "[-F modifier] [-f file] [-i interface] ");
-	fprintf(stderr, "[-k host] [-p device]\n");
+	fprintf(stderr, "[-f file] [-i interface] [-k host] ");
+	fprintf(stderr, "[-p device] [-s modifier]\n");
 	fprintf(stderr, "             ");
-	fprintf(stderr, "[-s modifier] [-T command [address ...]] ");
-	fprintf(stderr, "[-t table] [-x level]\n");
+	fprintf(stderr, "[-t table -T command [address ...]] ");
+	fprintf(stderr, "[-x level]\n");
 	exit(1);
 }
 
@@ -249,42 +262,31 @@ pfctl_clear_stats(int dev, int opts)
 }
 
 int
-pfctl_clear_rules(int dev, int opts, char *anchorname, char *rulesetname)
+pfctl_clear_interface_flags(int dev, int opts)
 {
-	struct pfr_buffer t;
+	struct pfioc_iface	pi;
 
-	if (*anchorname && !*rulesetname) {
-		struct pfioc_ruleset pr;
-		int mnr, nr, r;
+	if ((opts & PF_OPT_NOACTION) == 0) {
+		bzero(&pi, sizeof(pi));
+		pi.pfiio_flags = PFI_IFLAG_SETABLE_MASK;
 
-		memset(&pr, 0, sizeof(pr));
-		memcpy(pr.anchor, anchorname, sizeof(pr.anchor));
-		if (ioctl(dev, DIOCGETRULESETS, &pr)) {
-			if (errno == EINVAL)
-				fprintf(stderr, "No rulesets in anchor '%s'.\n",
-				    anchorname);
-			else
-				err(1, "DIOCGETRULESETS");
-			return (-1);
-		}
-		mnr = pr.nr;
-		for (nr = mnr - 1; nr >= 0; --nr) {
-			pr.nr = nr;
-			if (ioctl(dev, DIOCGETRULESET, &pr))
-				err(1, "DIOCGETRULESET");
-			r = pfctl_clear_rules(dev, opts | PF_OPT_QUIET,
-			    anchorname, pr.name);
-			if (r)
-				return (r);
-		}
+		if (ioctl(dev, DIOCCLRIFFLAG, &pi))
+			err(1, "DIOCCLRIFFLAG");
 		if ((opts & PF_OPT_QUIET) == 0)
-			fprintf(stderr, "rules cleared\n");
-		return (0);
+			fprintf(stderr, "pf: interface flags reset\n");
 	}
+	return (0);
+}
+
+int
+pfctl_clear_rules(int dev, int opts, char *anchorname)
+{
+	struct pfr_buffer t;
+
 	memset(&t, 0, sizeof(t));
 	t.pfrb_type = PFRB_TRANS;
-	if (pfctl_add_trans(&t, PF_RULESET_SCRUB, anchorname, rulesetname) ||
-	    pfctl_add_trans(&t, PF_RULESET_FILTER, anchorname, rulesetname) ||
+	if (pfctl_add_trans(&t, PF_RULESET_SCRUB, anchorname) ||
+	    pfctl_add_trans(&t, PF_RULESET_FILTER, anchorname) ||
 	    pfctl_trans(dev, &t, DIOCXBEGIN, 0) ||
 	    pfctl_trans(dev, &t, DIOCXCOMMIT, 0))
 		err(1, "pfctl_clear_rules");
@@ -294,43 +296,15 @@ pfctl_clear_rules(int dev, int opts, char *anchorname, char *rulesetname)
 }
 
 int
-pfctl_clear_nat(int dev, int opts, char *anchorname, char *rulesetname)
+pfctl_clear_nat(int dev, int opts, char *anchorname)
 {
 	struct pfr_buffer t;
 
-	if (*anchorname && !*rulesetname) {
-		struct pfioc_ruleset pr;
-		int mnr, nr, r;
-
-		memset(&pr, 0, sizeof(pr));
-		memcpy(pr.anchor, anchorname, sizeof(pr.anchor));
-		if (ioctl(dev, DIOCGETRULESETS, &pr)) {
-			if (errno == EINVAL)
-				fprintf(stderr, "No rulesets in anchor '%s'.\n",
-				    anchorname);
-			else
-				err(1, "DIOCGETRULESETS");
-			return (-1);
-		}
-		mnr = pr.nr;
-		for (nr = mnr - 1; nr >= 0; --nr) {
-			pr.nr = nr;
-			if (ioctl(dev, DIOCGETRULESET, &pr))
-				err(1, "DIOCGETRULESET");
-			r = pfctl_clear_nat(dev, opts | PF_OPT_QUIET,
-			    anchorname, pr.name);
-			if (r)
-				return (r);
-		}
-		if ((opts & PF_OPT_QUIET) == 0)
-			fprintf(stderr, "nat cleared\n");
-		return (0);
-	}
 	memset(&t, 0, sizeof(t));
 	t.pfrb_type = PFRB_TRANS;
-	if (pfctl_add_trans(&t, PF_RULESET_NAT, anchorname, rulesetname) ||
-	    pfctl_add_trans(&t, PF_RULESET_BINAT, anchorname, rulesetname) ||
-	    pfctl_add_trans(&t, PF_RULESET_RDR, anchorname, rulesetname) ||
+	if (pfctl_add_trans(&t, PF_RULESET_NAT, anchorname) ||
+	    pfctl_add_trans(&t, PF_RULESET_BINAT, anchorname) ||
+	    pfctl_add_trans(&t, PF_RULESET_RDR, anchorname) ||
 	    pfctl_trans(dev, &t, DIOCXBEGIN, 0) ||
 	    pfctl_trans(dev, &t, DIOCXCOMMIT, 0))
 		err(1, "pfctl_clear_nat");
@@ -348,7 +322,7 @@ pfctl_clear_altq(int dev, int opts)
 		return (-1);
 	memset(&t, 0, sizeof(t));
 	t.pfrb_type = PFRB_TRANS;
-	if (pfctl_add_trans(&t, PF_RULESET_ALTQ, "", "") ||
+	if (pfctl_add_trans(&t, PF_RULESET_ALTQ, "") ||
 	    pfctl_trans(dev, &t, DIOCXBEGIN, 0) ||
 	    pfctl_trans(dev, &t, DIOCXCOMMIT, 0))
 		err(1, "pfctl_clear_altq");
@@ -492,7 +466,7 @@ pfctl_kill_states(int dev, const char *iface, int opts)
 
 int
 pfctl_get_pool(int dev, struct pf_pool *pool, u_int32_t nr,
-    u_int32_t ticket, int r_action, char *anchorname, char *rulesetname)
+    u_int32_t ticket, int r_action, char *anchorname)
 {
 	struct pfioc_pooladdr pp;
 	struct pf_pooladdr *pa;
@@ -500,7 +474,6 @@ pfctl_get_pool(int dev, struct pf_pool *pool, u_int32_t nr,
 
 	memset(&pp, 0, sizeof(pp));
 	memcpy(pp.anchor, anchorname, sizeof(pp.anchor));
-	memcpy(pp.ruleset, rulesetname, sizeof(pp.ruleset));
 	pp.r_action = r_action;
 	pp.r_num = nr;
 	pp.ticket = ticket;
@@ -578,45 +551,14 @@ pfctl_print_title(char *title)
 }
 
 int
-pfctl_show_rules(int dev, int opts, int format, char *anchorname,
-    char *rulesetname)
+pfctl_show_rules(int dev, int opts, int format, char *anchorname)
 {
 	struct pfioc_rule pr;
 	u_int32_t nr, mnr, header = 0;
 	int rule_numbers = opts & (PF_OPT_VERBOSE2 | PF_OPT_DEBUG);
 
-	if (*anchorname && !*rulesetname) {
-		struct pfioc_ruleset pr;
-		int r;
-
-		memset(&pr, 0, sizeof(pr));
-		memcpy(pr.anchor, anchorname, sizeof(pr.anchor));
-		if (ioctl(dev, DIOCGETRULESETS, &pr)) {
-			if (errno == EINVAL)
-				fprintf(stderr, "No rulesets in anchor '%s'.\n",
-				    anchorname);
-			else
-				err(1, "DIOCGETRULESETS");
-			return (-1);
-		}
-		if (opts & PF_OPT_SHOWALL && pr.nr)
-			pfctl_print_title("FILTER RULES:");
-		mnr = pr.nr;
-		for (nr = 0; nr < mnr; ++nr) {
-			pr.nr = nr;
-			if (ioctl(dev, DIOCGETRULESET, &pr))
-				err(1, "DIOCGETRULESET");
-			r = pfctl_show_rules(dev, opts, format, anchorname,
-			    pr.name);
-			if (r)
-				return (r);
-		}
-		return (0);
-	}
-
 	memset(&pr, 0, sizeof(pr));
 	memcpy(pr.anchor, anchorname, sizeof(pr.anchor));
-	memcpy(pr.ruleset, rulesetname, sizeof(pr.ruleset));
 	if (opts & PF_OPT_SHOWALL) {
 		pr.rule.action = PF_PASS;
 		if (ioctl(dev, DIOCGETRULES, &pr)) {
@@ -645,7 +587,7 @@ pfctl_show_rules(int dev, int opts, int format, char *anchorname,
 		}
 
 		if (pfctl_get_pool(dev, &pr.rule.rpool,
-		    nr, pr.ticket, PF_SCRUB, anchorname, rulesetname) != 0)
+		    nr, pr.ticket, PF_SCRUB, anchorname) != 0)
 			return (-1);
 
 		switch (format) {
@@ -661,7 +603,7 @@ pfctl_show_rules(int dev, int opts, int format, char *anchorname,
 		default:
 			if (pr.rule.label[0] && (opts & PF_OPT_SHOWALL))
 				labels = 1;
-			print_rule(&pr.rule, rule_numbers);
+			print_rule(&pr.rule, pr.anchor_call, rule_numbers);
 			pfctl_print_rule_counters(&pr.rule, opts);
 		}
 		pfctl_clear_pool(&pr.rule.rpool);
@@ -680,7 +622,7 @@ pfctl_show_rules(int dev, int opts, int format, char *anchorname,
 		}
 
 		if (pfctl_get_pool(dev, &pr.rule.rpool,
-		    nr, pr.ticket, PF_PASS, anchorname, rulesetname) != 0)
+		    nr, pr.ticket, PF_PASS, anchorname) != 0)
 			return (-1);
 
 		switch (format) {
@@ -696,7 +638,7 @@ pfctl_show_rules(int dev, int opts, int format, char *anchorname,
 		default:
 			if (pr.rule.label[0] && (opts & PF_OPT_SHOWALL))
 				labels = 1;
-			print_rule(&pr.rule, rule_numbers);
+			print_rule(&pr.rule, pr.anchor_call, rule_numbers);
 			pfctl_print_rule_counters(&pr.rule, opts);
 		}
 		pfctl_clear_pool(&pr.rule.rpool);
@@ -705,42 +647,15 @@ pfctl_show_rules(int dev, int opts, int format, char *anchorname,
 }
 
 int
-pfctl_show_nat(int dev, int opts, char *anchorname, char *rulesetname)
+pfctl_show_nat(int dev, int opts, char *anchorname)
 {
 	struct pfioc_rule pr;
 	u_int32_t mnr, nr;
 	static int nattype[3] = { PF_NAT, PF_RDR, PF_BINAT };
 	int i, dotitle = opts & PF_OPT_SHOWALL;
 
-	if (*anchorname && !*rulesetname) {
-		struct pfioc_ruleset pr;
-		int r;
-
-		memset(&pr, 0, sizeof(pr));
-		memcpy(pr.anchor, anchorname, sizeof(pr.anchor));
-		if (ioctl(dev, DIOCGETRULESETS, &pr)) {
-			if (errno == EINVAL)
-				fprintf(stderr, "No rulesets in anchor '%s'.\n",
-				    anchorname);
-			else
-				err(1, "DIOCGETRULESETS");
-			return (-1);
-		}
-		mnr = pr.nr;
-		for (nr = 0; nr < mnr; ++nr) {
-			pr.nr = nr;
-			if (ioctl(dev, DIOCGETRULESET, &pr))
-				err(1, "DIOCGETRULESET");
-			r = pfctl_show_nat(dev, opts, anchorname, pr.name);
-			if (r)
-				return (r);
-		}
-		return (0);
-	}
-
 	memset(&pr, 0, sizeof(pr));
 	memcpy(pr.anchor, anchorname, sizeof(pr.anchor));
-	memcpy(pr.ruleset, rulesetname, sizeof(pr.ruleset));
 	for (i = 0; i < 3; i++) {
 		pr.rule.action = nattype[i];
 		if (ioctl(dev, DIOCGETRULES, &pr)) {
@@ -755,14 +670,14 @@ pfctl_show_nat(int dev, int opts, char *anchorname, char *rulesetname)
 				return (-1);
 			}
 			if (pfctl_get_pool(dev, &pr.rule.rpool, nr,
-			    pr.ticket, nattype[i], anchorname,
-			    rulesetname) != 0)
+			    pr.ticket, nattype[i], anchorname) != 0)
 				return (-1);
 			if (dotitle) {
 				pfctl_print_title("TRANSLATION RULES:");
 				dotitle = 0;
 			}
-			print_rule(&pr.rule, opts & PF_OPT_VERBOSE2);
+			print_rule(&pr.rule, pr.anchor_call,
+			    opts & PF_OPT_VERBOSE2);
 			pfctl_print_rule_counters(&pr.rule, opts);
 			pfctl_clear_pool(&pr.rule.rpool);
 		}
@@ -886,7 +801,8 @@ pfctl_show_timeouts(int dev, int opts)
 		if (ioctl(dev, DIOCGETTIMEOUT, &pt))
 			err(1, "DIOCGETTIMEOUT");
 		printf("%-20s %10d", pf_timeouts[i].name, pt.seconds);
-		if (i >= PFTM_ADAPTIVE_START && i <= PFTM_ADAPTIVE_END)
+		if (pf_timeouts[i].timeout >= PFTM_ADAPTIVE_START &&
+		    pf_timeouts[i].timeout <= PFTM_ADAPTIVE_END)
 			printf(" states");
 		else
 			printf("s");
@@ -941,13 +857,14 @@ pfctl_add_pool(struct pfctl *pf, struct pf_pool *p, sa_family_t af)
 }
 
 int
-pfctl_add_rule(struct pfctl *pf, struct pf_rule *r)
+pfctl_add_rule(struct pfctl *pf, struct pf_rule *r, const char *anchor_call)
 {
 	u_int8_t		rs_num;
 	struct pfioc_rule	pr;
 
 	switch (r->action) {
 	case PF_SCRUB:
+	case PF_NOSCRUB:
 		if ((loadopt & PFCTL_FLAG_FILTER) == 0)
 			return (0);
 		rs_num = PF_RULESET_SCRUB;
@@ -977,28 +894,59 @@ pfctl_add_rule(struct pfctl *pf, struct pf_rule *r)
 		rs_num = PF_RULESET_BINAT;
 		break;
 	default:
-		errx(1, "Invalid rule type");
+		errx(1, "Invalid rule type %d", r->action);
 		break;
 	}
 
+
+	if ((pf->opts & PF_OPT_OPTIMIZE) && rs_num == PF_RULESET_FILTER) {
+		/*
+		 * We'll do an optimization post-pass before finally adding the
+		 * rules.  Then we'll disable the optimization flag and feed
+		 * the rules right back into this function.
+		 */
+		struct pf_opt_rule *pfr;
+		struct pf_pooladdr *pa;
+
+		if ((pfr = calloc(1, sizeof(*pfr))) == NULL)
+			err(1, "calloc");
+		memcpy(&pfr->por_rule, r, sizeof(*r));
+		if (strlcpy(pfr->por_anchor, anchor_call,
+		    sizeof(pfr->por_anchor)) >= sizeof(pfr->por_anchor))
+			errx(1, "pfctl_add_rule: strlcpy");
+		TAILQ_INSERT_TAIL(&pf->opt_queue, pfr, por_entry);
+
+		if (TAILQ_FIRST(&r->rpool.list) != NULL)  {
+			TAILQ_INIT(&pfr->por_rule.rpool.list);
+			while ((pa = TAILQ_FIRST(&r->rpool.list)) != NULL) {
+				TAILQ_REMOVE(&r->rpool.list, pa, entries);
+				TAILQ_INSERT_TAIL(&pfr->por_rule.rpool.list, pa,
+			    	entries);
+			}
+		} else {
+			memset(&pfr->por_rule.rpool, 0,
+			    sizeof(pfr->por_rule.rpool));
+
+		}
+		return (0);
+	}
+
 	if ((pf->opts & PF_OPT_NOACTION) == 0) {
 		bzero(&pr, sizeof(pr));
 		if (strlcpy(pr.anchor, pf->anchor, sizeof(pr.anchor)) >=
-		    sizeof(pr.anchor) ||
-		    strlcpy(pr.ruleset, pf->ruleset, sizeof(pr.ruleset)) >=
-		    sizeof(pr.ruleset))
+		    sizeof(pr.anchor))
 			errx(1, "pfctl_add_rule: strlcpy");
 		if (pfctl_add_pool(pf, &r->rpool, r->af))
 			return (1);
-		pr.ticket = pfctl_get_ticket(pf->trans, rs_num, pf->anchor,
-		    pf->ruleset);
+		pr.ticket = pfctl_get_ticket(pf->trans, rs_num, pf->anchor);
 		pr.pool_ticket = pf->paddr.ticket;
 		memcpy(&pr.rule, r, sizeof(pr.rule));
+		strlcpy(pr.anchor_call, anchor_call, sizeof(pr.anchor_call));
 		if (ioctl(pf->dev, DIOCADDRULE, &pr))
 			err(1, "DIOCADDRULE");
 	}
 	if (pf->opts & PF_OPT_VERBOSE)
-		print_rule(r, pf->opts & PF_OPT_VERBOSE2);
+		print_rule(r, anchor_call, pf->opts & PF_OPT_VERBOSE2);
 	pfctl_clear_pool(&r->rpool);
 	return (0);
 }
@@ -1027,7 +975,7 @@ pfctl_add_altq(struct pfctl *pf, struct pf_altq *a)
 
 int
 pfctl_rules(int dev, char *filename, int opts, char *anchorname,
-    char *rulesetname, struct pfr_buffer *trans)
+    struct pfr_buffer *trans)
 {
 #define ERR(x) do { warn(x); goto _error; } while(0)
 #define ERRX(x) do { warnx(x); goto _error; } while(0)
@@ -1053,15 +1001,13 @@ pfctl_rules(int dev, char *filename, int opts, char *anchorname,
 	memset(&pf, 0, sizeof(pf));
 	memset(&trs, 0, sizeof(trs));
 	if (strlcpy(trs.pfrt_anchor, anchorname,
-	    sizeof(trs.pfrt_anchor)) >= sizeof(trs.pfrt_anchor) ||
-	    strlcpy(trs.pfrt_ruleset, rulesetname,
-	    sizeof(trs.pfrt_ruleset)) >= sizeof(trs.pfrt_ruleset))
+	    sizeof(trs.pfrt_anchor)) >= sizeof(trs.pfrt_anchor))
 		ERRX("pfctl_rules: strlcpy");
 	if (strcmp(filename, "-") == 0) {
 		fin = stdin;
 		infile = "stdin";
 	} else {
-		if ((fin = fopen(filename, "r")) == NULL) {
+		if ((fin = pfctl_fopen(filename, "r")) == NULL) {
 			warn("%s", filename);
 			return (1);
 		}
@@ -1076,43 +1022,37 @@ pfctl_rules(int dev, char *filename, int opts, char *anchorname,
 	pf.trans = t;
 	pf.rule_nr = 0;
 	pf.anchor = anchorname;
-	pf.ruleset = rulesetname;
+	TAILQ_INIT(&pf.opt_queue);
+	pfctl_init_options(&pf);
 
 	if ((opts & PF_OPT_NOACTION) == 0) {
 		if ((pf.loadopt & PFCTL_FLAG_NAT) != 0) {
-			if (pfctl_add_trans(t, PF_RULESET_NAT, anchorname,
-			    rulesetname) ||
-			    pfctl_add_trans(t, PF_RULESET_BINAT, anchorname,
-			    rulesetname) ||
-			    pfctl_add_trans(t, PF_RULESET_RDR, anchorname,
-			    rulesetname))
+			if (pfctl_add_trans(t, PF_RULESET_NAT, anchorname) ||
+			    pfctl_add_trans(t, PF_RULESET_BINAT, anchorname) ||
+			    pfctl_add_trans(t, PF_RULESET_RDR, anchorname))
 				ERR("pfctl_rules");
 		}
 		if (((altqsupport && (pf.loadopt & PFCTL_FLAG_ALTQ) != 0))) {
-			if (pfctl_add_trans(t, PF_RULESET_ALTQ, anchorname,
-			    rulesetname))
+			if (pfctl_add_trans(t, PF_RULESET_ALTQ, anchorname))
 				ERR("pfctl_rules");
 		}
 		if ((pf.loadopt & PFCTL_FLAG_FILTER) != 0) {
-			if (pfctl_add_trans(t, PF_RULESET_SCRUB, anchorname,
-			    rulesetname) ||
-			    pfctl_add_trans(t, PF_RULESET_FILTER, anchorname,
-			    rulesetname))
+			if (pfctl_add_trans(t, PF_RULESET_SCRUB, anchorname) ||
+			    pfctl_add_trans(t, PF_RULESET_FILTER, anchorname))
 				ERR("pfctl_rules");
 		}
 		if (pf.loadopt & PFCTL_FLAG_TABLE) {
-			if (pfctl_add_trans(t, PF_RULESET_TABLE, anchorname,
-			    rulesetname))
+			if (pfctl_add_trans(t, PF_RULESET_TABLE, anchorname))
 				ERR("pfctl_rules");
 		}
 		if (pfctl_trans(dev, t, DIOCXBEGIN, osize))
 			ERR("DIOCXBEGIN");
 		if (altqsupport && (pf.loadopt & PFCTL_FLAG_ALTQ))
 			pa.ticket = pfctl_get_ticket(t, PF_RULESET_ALTQ,
-			    anchorname, rulesetname);
+			    anchorname);
 		if (pf.loadopt & PFCTL_FLAG_TABLE)
 			pf.tticket = pfctl_get_ticket(t, PF_RULESET_TABLE,
-			    anchorname, rulesetname);
+			    anchorname);
 	}
 	if (parse_rules(fin, &pf) < 0) {
 		if ((opts & PF_OPT_NOACTION) == 0)
@@ -1121,20 +1061,32 @@ pfctl_rules(int dev, char *filename, int opts, char *anchorname,
 		else
 			goto _error;
 	}
+	if (pf.opts & PF_OPT_OPTIMIZE) {
+		if (pfctl_optimize_rules(&pf))
+			ERRX("Failed to optimize ruleset: pf rules not loaded");
+	}
+
 	if ((altqsupport && (pf.loadopt & PFCTL_FLAG_ALTQ) != 0))
 		if (check_commit_altq(dev, opts) != 0)
 			ERRX("errors in altq config");
-	if (fin != stdin)
+
+	if (fin != stdin) {
 		fclose(fin);
+		fin = NULL;
+	}
 
 	/* process "load anchor" directives */
-	if (!anchorname[0] && !rulesetname[0])
+	if (!anchorname[0])
 		if (pfctl_load_anchors(dev, opts, t) == -1)
 			ERRX("load anchors");
 
-	if (trans == NULL && (opts & PF_OPT_NOACTION) == 0)
+	if (trans == NULL && (opts & PF_OPT_NOACTION) == 0) {
+		if (!anchorname[0])
+			if (pfctl_load_options(&pf))
+				goto _error;
 		if (pfctl_trans(dev, t, DIOCXCOMMIT, 0))
 			ERR("DIOCXCOMMIT");
+	}
 	return (0);
 
 _error:
@@ -1143,38 +1095,118 @@ _error:
 			if (pfctl_trans(dev, t, DIOCXROLLBACK, 0))
 				err(1, "DIOCXROLLBACK");
 		exit(1);
-	} else			/* sub ruleset */
+	} else {		/* sub ruleset */
+		if (fin != NULL && fin != stdin)
+			fclose(fin);
 		return (-1);
+	}
 
 #undef ERR
 #undef ERRX
 }
 
+FILE *
+pfctl_fopen(const char *name, const char *mode)
+{
+	struct stat	 st;
+	FILE		*fp;
+
+	fp = fopen(name, mode);
+	if (fp == NULL)
+		return (NULL);
+	if (fstat(fileno(fp), &st)) {
+		fclose(fp);
+		return (NULL);
+	}
+	if (S_ISDIR(st.st_mode)) {
+		fclose(fp);
+		errno = EISDIR;
+		return (NULL);
+	}
+	return (fp);
+}
+
+void
+pfctl_init_options(struct pfctl *pf)
+{
+	pf->timeout[PFTM_TCP_FIRST_PACKET] = PFTM_TCP_FIRST_PACKET_VAL;
+	pf->timeout[PFTM_TCP_OPENING] = PFTM_TCP_OPENING_VAL;
+	pf->timeout[PFTM_TCP_ESTABLISHED] = PFTM_TCP_ESTABLISHED_VAL;
+	pf->timeout[PFTM_TCP_CLOSING] = PFTM_TCP_CLOSING_VAL;
+	pf->timeout[PFTM_TCP_FIN_WAIT] = PFTM_TCP_FIN_WAIT_VAL;
+	pf->timeout[PFTM_TCP_CLOSED] = PFTM_TCP_CLOSED_VAL;
+	pf->timeout[PFTM_UDP_FIRST_PACKET] = PFTM_UDP_FIRST_PACKET_VAL;
+	pf->timeout[PFTM_UDP_SINGLE] = PFTM_UDP_SINGLE_VAL;
+	pf->timeout[PFTM_UDP_MULTIPLE] = PFTM_UDP_MULTIPLE_VAL;
+	pf->timeout[PFTM_ICMP_FIRST_PACKET] = PFTM_ICMP_FIRST_PACKET_VAL;
+	pf->timeout[PFTM_ICMP_ERROR_REPLY] = PFTM_ICMP_ERROR_REPLY_VAL;
+	pf->timeout[PFTM_OTHER_FIRST_PACKET] = PFTM_OTHER_FIRST_PACKET_VAL;
+	pf->timeout[PFTM_OTHER_SINGLE] = PFTM_OTHER_SINGLE_VAL;
+	pf->timeout[PFTM_OTHER_MULTIPLE] = PFTM_OTHER_MULTIPLE_VAL;
+	pf->timeout[PFTM_FRAG] = PFTM_FRAG_VAL;
+	pf->timeout[PFTM_INTERVAL] = PFTM_INTERVAL_VAL;
+	pf->timeout[PFTM_SRC_NODE] = PFTM_SRC_NODE_VAL;
+	pf->timeout[PFTM_TS_DIFF] = PFTM_TS_DIFF_VAL;
+
+	pf->limit[PF_LIMIT_STATES]	= PFSTATE_HIWAT;
+	pf->limit[PF_LIMIT_FRAGS]	= PFFRAG_FRENT_HIWAT;
+	pf->limit[PF_LIMIT_SRC_NODES]	= PFSNODE_HIWAT;
+
+	pf->debug = PF_DEBUG_URGENT;
+}
+
 int
-pfctl_set_limit(struct pfctl *pf, const char *opt, unsigned int limit)
+pfctl_load_options(struct pfctl *pf)
 {
-	struct pfioc_limit pl;
-	int i;
+	int i, error = 0;
 
 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
 		return (0);
 
-	memset(&pl, 0, sizeof(pl));
+	/* load limits */
+	for (i = 0; i < PF_LIMIT_MAX; i++) {
+		if ((pf->opts & PF_OPT_MERGE) && !pf->limit_set[i])
+			continue;
+		if (pfctl_load_limit(pf, i, pf->limit[i]))
+			error = 1;
+	}
+
+	/* load timeouts */
+	for (i = 0; i < PFTM_MAX; i++) {
+		if ((pf->opts & PF_OPT_MERGE) && !pf->timeout_set[i])
+			continue;
+		if (pfctl_load_timeout(pf, i, pf->timeout[i]))
+			error = 1;
+	}
+
+	/* load debug */
+	if (!(pf->opts & PF_OPT_MERGE) || pf->debug_set)
+		if (pfctl_load_debug(pf, pf->debug))
+			error = 1;
+
+	/* load logif */
+	if (!(pf->opts & PF_OPT_MERGE) || pf->ifname_set)
+		if (pfctl_load_logif(pf, pf->ifname))
+			error = 1;
+
+	/* load hostid */
+	if (!(pf->opts & PF_OPT_MERGE) || pf->hostid_set)
+		if (pfctl_load_hostid(pf, pf->hostid))
+			error = 1;
+
+	return (error);
+}
+
+int
+pfctl_set_limit(struct pfctl *pf, const char *opt, unsigned int limit)
+{
+	int i;
+
+
 	for (i = 0; pf_limits[i].name; i++) {
 		if (strcasecmp(opt, pf_limits[i].name) == 0) {
-			pl.index = pf_limits[i].index;
-			pl.limit = limit;
-			if ((pf->opts & PF_OPT_NOACTION) == 0) {
-				if (ioctl(pf->dev, DIOCSETLIMIT, &pl)) {
-					if (errno == EBUSY) {
-						warnx("Current pool "
-						    "size exceeds requested "
-						    "hard limit");
-						return (1);
-					} else
-						err(1, "DIOCSETLIMIT");
-				}
-			}
+			pf->limit[pf_limits[i].index] = limit;
+			pf->limit_set[pf_limits[i].index] = 1;
 			break;
 		}
 	}
@@ -1190,18 +1222,35 @@ pfctl_set_limit(struct pfctl *pf, const char *opt, unsigned int limit)
 }
 
 int
+pfctl_load_limit(struct pfctl *pf, unsigned int index, unsigned int limit)
+{
+	struct pfioc_limit pl;
+
+	memset(&pl, 0, sizeof(pl));
+	pl.index = index;
+	pl.limit = limit;
+	if (ioctl(pf->dev, DIOCSETLIMIT, &pl)) {
+		if (errno == EBUSY)
+			warnx("Current pool size exceeds requested hard limit");
+		else
+			warnx("DIOCSETLIMIT");
+		return (1);
+	}
+	return (0);
+}
+
+int
 pfctl_set_timeout(struct pfctl *pf, const char *opt, int seconds, int quiet)
 {
-	struct pfioc_tm pt;
 	int i;
 
 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
 		return (0);
 
-	memset(&pt, 0, sizeof(pt));
 	for (i = 0; pf_timeouts[i].name; i++) {
 		if (strcasecmp(opt, pf_timeouts[i].name) == 0) {
-			pt.timeout = pf_timeouts[i].timeout;
+			pf->timeout[pf_timeouts[i].timeout] = seconds;
+			pf->timeout_set[pf_timeouts[i].timeout] = 1;
 			break;
 		}
 	}
@@ -1211,11 +1260,6 @@ pfctl_set_timeout(struct pfctl *pf, const char *opt, int seconds, int quiet)
 		return (1);
 	}
 
-	pt.seconds = seconds;
-	if ((pf->opts & PF_OPT_NOACTION) == 0) {
-		if (ioctl(pf->dev, DIOCSETTIMEOUT, &pt))
-			err(1, "DIOCSETTIMEOUT");
-	}
 
 	if (pf->opts & PF_OPT_VERBOSE && ! quiet)
 		printf("set timeout %s %d\n", opt, seconds);
@@ -1224,6 +1268,21 @@ pfctl_set_timeout(struct pfctl *pf, const char *opt, int seconds, int quiet)
 }
 
 int
+pfctl_load_timeout(struct pfctl *pf, unsigned int timeout, unsigned int seconds)
+{
+	struct pfioc_tm pt;
+
+	memset(&pt, 0, sizeof(pt));
+	pt.timeout = timeout;
+	pt.seconds = seconds;
+	if (ioctl(pf->dev, DIOCSETTIMEOUT, &pt)) {
+		warnx("DIOCSETTIMEOUT");
+		return (1);
+	}
+	return (0);
+}
+
+int
 pfctl_set_optimization(struct pfctl *pf, const char *opt)
 {
 	const struct pf_hint *hint;
@@ -1256,23 +1315,19 @@ pfctl_set_optimization(struct pfctl *pf, const char *opt)
 int
 pfctl_set_logif(struct pfctl *pf, char *ifname)
 {
-	struct pfioc_if pi;
 
 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
 		return (0);
 
-	memset(&pi, 0, sizeof(pi));
-	if ((pf->opts & PF_OPT_NOACTION) == 0) {
-		if (!strcmp(ifname, "none"))
-			bzero(pi.ifname, sizeof(pi.ifname));
-		else {
-			if (strlcpy(pi.ifname, ifname,
-			    sizeof(pi.ifname)) >= sizeof(pi.ifname))
-				errx(1, "pfctl_set_logif: strlcpy");
-		}
-		if (ioctl(pf->dev, DIOCSETSTATUSIF, &pi))
-			err(1, "DIOCSETSTATUSIF");
+	if (!strcmp(ifname, "none")) {
+		free(pf->ifname);
+		pf->ifname = NULL;
+	} else {
+		pf->ifname = strdup(ifname);
+		if (!pf->ifname)
+			errx(1, "pfctl_set_logif: strdup");
 	}
+	pf->ifname_set = 1;
 
 	if (pf->opts & PF_OPT_VERBOSE)
 		printf("set loginterface %s\n", ifname);
@@ -1281,6 +1336,24 @@ pfctl_set_logif(struct pfctl *pf, char *ifname)
 }
 
 int
+pfctl_load_logif(struct pfctl *pf, char *ifname)
+{
+	struct pfioc_if pi;
+
+	memset(&pi, 0, sizeof(pi));
+	if (ifname && strlcpy(pi.ifname, ifname,
+	    sizeof(pi.ifname)) >= sizeof(pi.ifname)) {
+		warnx("pfctl_set_logif: strlcpy");
+		return (1);
+	}
+	if (ioctl(pf->dev, DIOCSETSTATUSIF, &pi)) {
+		warnx("DIOCSETSTATUSIF");
+		return (1);
+	}
+	return (0);
+}
+
+int
 pfctl_set_hostid(struct pfctl *pf, u_int32_t hostid)
 {
 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
@@ -1288,9 +1361,8 @@ pfctl_set_hostid(struct pfctl *pf, u_int32_t hostid)
 
 	HTONL(hostid);
 
-	if ((pf->opts & PF_OPT_NOACTION) == 0)
-		if (ioctl(dev, DIOCSETHOSTID, &hostid))
-			err(1, "DIOCSETHOSTID");
+	pf->hostid = hostid;
+	pf->hostid_set = 1;
 
 	if (pf->opts & PF_OPT_VERBOSE)
 		printf("set hostid 0x%08x\n", ntohl(hostid));
@@ -1299,6 +1371,16 @@ pfctl_set_hostid(struct pfctl *pf, u_int32_t hostid)
 }
 
 int
+pfctl_load_hostid(struct pfctl *pf, u_int32_t hostid)
+{
+	if (ioctl(dev, DIOCSETHOSTID, &hostid)) {
+		warnx("DIOCSETHOSTID");
+		return (1);
+	}
+	return (0);
+}
+
+int
 pfctl_set_debug(struct pfctl *pf, char *d)
 {
 	u_int32_t	level;
@@ -1307,18 +1389,20 @@ pfctl_set_debug(struct pfctl *pf, char *d)
 		return (0);
 
 	if (!strcmp(d, "none"))
-		level = PF_DEBUG_NONE;
+		pf->debug = PF_DEBUG_NONE;
 	else if (!strcmp(d, "urgent"))
-		level = PF_DEBUG_URGENT;
+		pf->debug = PF_DEBUG_URGENT;
 	else if (!strcmp(d, "misc"))
-		level = PF_DEBUG_MISC;
+		pf->debug = PF_DEBUG_MISC;
 	else if (!strcmp(d, "loud"))
-		level = PF_DEBUG_NOISY;
+		pf->debug = PF_DEBUG_NOISY;
 	else {
 		warnx("unknown debug level \"%s\"", d);
 		return (-1);
 	}
 
+	pf->debug_set = 1;
+
 	if ((pf->opts & PF_OPT_NOACTION) == 0)
 		if (ioctl(dev, DIOCSETDEBUG, &level))
 			err(1, "DIOCSETDEBUG");
@@ -1330,6 +1414,44 @@ pfctl_set_debug(struct pfctl *pf, char *d)
 }
 
 int
+pfctl_load_debug(struct pfctl *pf, unsigned int level)
+{
+	if (ioctl(pf->dev, DIOCSETDEBUG, &level)) {
+		warnx("DIOCSETDEBUG");
+		return (1);
+	}
+	return (0);
+}
+
+int
+pfctl_set_interface_flags(struct pfctl *pf, char *ifname, int flags, int how)
+{
+	struct pfioc_iface	pi;
+
+	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
+		return (0);
+
+	bzero(&pi, sizeof(pi));
+
+	pi.pfiio_flags = flags;
+
+	if (strlcpy(pi.pfiio_name, ifname, sizeof(pi.pfiio_name)) >=
+	    sizeof(pi.pfiio_name))
+		errx(1, "pfctl_set_interface_flags: strlcpy");
+
+	if ((pf->opts & PF_OPT_NOACTION) == 0) {
+		if (how == 0) {
+			if (ioctl(pf->dev, DIOCCLRIFFLAG, &pi))
+				err(1, "DIOCCLRIFFLAG");
+		} else {
+			if (ioctl(pf->dev, DIOCSETIFFLAG, &pi))
+				err(1, "DIOCSETIFFLAG");
+		}
+	}
+	return (0);
+}
+
+void
 pfctl_debug(int dev, u_int32_t level, int opts)
 {
 	if (ioctl(dev, DIOCSETDEBUG, &level))
@@ -1355,7 +1477,6 @@ pfctl_debug(int dev, u_int32_t level, int opts)
 		}
 		fprintf(stderr, "'\n");
 	}
-	return (0);
 }
 
 int
@@ -1388,48 +1509,37 @@ pfctl_test_altqsupport(int dev, int opts)
 int
 pfctl_show_anchors(int dev, int opts, char *anchorname)
 {
-	u_int32_t nr, mnr;
+	struct pfioc_ruleset	 pr;
+	u_int32_t		 mnr, nr;
 
-	if (!*anchorname) {
-		struct pfioc_anchor pa;
+	memset(&pr, 0, sizeof(pr));
+	memcpy(pr.path, anchorname, sizeof(pr.path));
+	if (ioctl(dev, DIOCGETRULESETS, &pr)) {
+		if (errno == EINVAL)
+			fprintf(stderr, "Anchor '%s' not found.\n",
+			    anchorname);
+		else
+			err(1, "DIOCGETRULESETS");
+		return (-1);
+	}
+	mnr = pr.nr;
+	for (nr = 0; nr < mnr; ++nr) {
+		char sub[MAXPATHLEN];
 
-		memset(&pa, 0, sizeof(pa));
-		if (ioctl(dev, DIOCGETANCHORS, &pa)) {
-			warn("DIOCGETANCHORS");
-			return (-1);
-		}
-		mnr = pa.nr;
-		for (nr = 0; nr < mnr; ++nr) {
-			pa.nr = nr;
-			if (ioctl(dev, DIOCGETANCHOR, &pa)) {
-				warn("DIOCGETANCHOR");
-				return (-1);
-			}
-			if (!(opts & PF_OPT_VERBOSE) &&
-			    !strcmp(pa.name, PF_RESERVED_ANCHOR))
-				continue;
-			printf("  %s\n", pa.name);
+		pr.nr = nr;
+		if (ioctl(dev, DIOCGETRULESET, &pr))
+			err(1, "DIOCGETRULESET");
+		if (!strcmp(pr.name, PF_RESERVED_ANCHOR))
+			continue;
+		sub[0] = 0;
+		if (pr.path[0]) {
+			strlcat(sub, pr.path, sizeof(sub));
+			strlcat(sub, "/", sizeof(sub));
 		}
-	} else {
-		struct pfioc_ruleset pr;
-
-		memset(&pr, 0, sizeof(pr));
-		memcpy(pr.anchor, anchorname, sizeof(pr.anchor));
-		if (ioctl(dev, DIOCGETRULESETS, &pr)) {
-			if (errno == EINVAL)
-				fprintf(stderr, "No rulesets in anchor '%s'.\n",
-				    anchorname);
-			else
-				err(1, "DIOCGETRULESETS");
+		strlcat(sub, pr.name, sizeof(sub));
+		printf("  %s\n", sub);
+		if (opts & PF_OPT_VERBOSE && pfctl_show_anchors(dev, opts, sub))
 			return (-1);
-		}
-		mnr = pr.nr;
-		for (nr = 0; nr < mnr; ++nr) {
-			pr.nr = nr;
-			if (ioctl(dev, DIOCGETRULESET, &pr))
-				err(1, "DIOCGETRULESET");
-			printf("  %s:%s\n", pr.anchor, pr.name);
-		}
 	}
 	return (0);
 }
@@ -1451,14 +1561,13 @@ main(int argc, char *argv[])
 	int	ch;
 	int	mode = O_RDONLY;
 	int	opts = 0;
-	char	anchorname[PF_ANCHOR_NAME_SIZE];
-	char	rulesetname[PF_RULESET_NAME_SIZE];
+	char	anchorname[MAXPATHLEN];
 
 	if (argc < 2)
 		usage();
 
 	while ((ch = getopt(argc, argv,
-	    "a:AdD:eqf:F:ghi:k:nNOp:rRs:t:T:vx:z")) != -1) {
+	    "a:AdD:eqf:F:ghi:k:mnNOop:rRs:t:T:vx:z")) != -1) {
 		switch (ch) {
 		case 'a':
 			anchoropt = optarg;
@@ -1499,6 +1608,9 @@ main(int argc, char *argv[])
 			state_kill[state_killers++] = optarg;
 			mode = O_RDWR;
 			break;
+		case 'm':
+			opts |= PF_OPT_MERGE;
+			break;
 		case 'n':
 			opts |= PF_OPT_NOACTION;
 			break;
@@ -1521,6 +1633,12 @@ main(int argc, char *argv[])
 		case 'R':
 			loadopt |= PFCTL_FLAG_FILTER;
 			break;
+		case 'o':
+			if (opts & PF_OPT_OPTIMIZE)
+				opts |= PF_OPT_OPTIMIZE_PROFILE;
+			else
+				opts |= PF_OPT_OPTIMIZE;
+			break;
 		case 'O':
 			loadopt |= PFCTL_FLAG_OPTION;
 			break;
@@ -1587,31 +1705,11 @@ main(int argc, char *argv[])
 		loadopt = ~0;
 
 	memset(anchorname, 0, sizeof(anchorname));
-	memset(rulesetname, 0, sizeof(rulesetname));
 	if (anchoropt != NULL) {
-		char *t;
-
-		if ((t = strchr(anchoropt, ':')) == NULL) {
-			if (strlcpy(anchorname, anchoropt,
-			    sizeof(anchorname)) >= sizeof(anchorname))
-				errx(1, "anchor name '%s' too long",
-				    anchoropt);
-		} else {
-			char *p;
-
-			if ((p = strdup(anchoropt)) == NULL)
-				err(1, "anchoropt: strdup");
-			t = strsep(&p, ":");
-			if (*t == '\0' || *p == '\0')
-				errx(1, "anchor '%s' invalid", anchoropt);
-			if (strlcpy(anchorname, t, sizeof(anchorname)) >=
-			    sizeof(anchorname))
-				errx(1, "anchor name '%s' too long", t);
-			if (strlcpy(rulesetname, p, sizeof(rulesetname)) >=
-			    sizeof(rulesetname))
-				errx(1, "ruleset name '%s' too long", p);
-			free(t); /* not p */
-		}
+		if (strlcpy(anchorname, anchoropt,
+		    sizeof(anchorname)) >= sizeof(anchorname))
+			errx(1, "anchor name '%s' too long",
+			    anchoropt);
 		loadopt &= PFCTL_FLAG_FILTER|PFCTL_FLAG_NAT|PFCTL_FLAG_TABLE;
 	}
 
@@ -1641,17 +1739,15 @@ main(int argc, char *argv[])
 			break;
 		case 'r':
 			pfctl_load_fingerprints(dev, opts);
-			pfctl_show_rules(dev, opts, 0, anchorname,
-			    rulesetname);
+			pfctl_show_rules(dev, opts, 0, anchorname);
 			break;
 		case 'l':
 			pfctl_load_fingerprints(dev, opts);
-			pfctl_show_rules(dev, opts, 1, anchorname,
-			    rulesetname);
+			pfctl_show_rules(dev, opts, 1, anchorname);
 			break;
 		case 'n':
 			pfctl_load_fingerprints(dev, opts);
-			pfctl_show_nat(dev, opts, anchorname, rulesetname);
+			pfctl_show_nat(dev, opts, anchorname);
 			break;
 		case 'q':
 			pfctl_show_altq(dev, ifaceopt, opts,
@@ -1676,21 +1772,20 @@ main(int argc, char *argv[])
 			opts |= PF_OPT_SHOWALL;
 			pfctl_load_fingerprints(dev, opts);
 
-			pfctl_show_nat(dev, opts, anchorname, rulesetname);
-			pfctl_show_rules(dev, opts, 0, anchorname,
-			    rulesetname);
+			pfctl_show_nat(dev, opts, anchorname);
+			pfctl_show_rules(dev, opts, 0, anchorname);
 			pfctl_show_altq(dev, ifaceopt, opts, 0);
 			pfctl_show_states(dev, ifaceopt, opts);
 			pfctl_show_src_nodes(dev, opts);
 			pfctl_show_status(dev, opts);
-			pfctl_show_rules(dev, opts, 1, anchorname, rulesetname);
+			pfctl_show_rules(dev, opts, 1, anchorname);
 			pfctl_show_timeouts(dev, opts);
 			pfctl_show_limits(dev, opts);
-			pfctl_show_tables(anchorname, rulesetname, opts);
+			pfctl_show_tables(anchorname, opts);
 			pfctl_show_fingerprints(opts);
 			break;
 		case 'T':
-			pfctl_show_tables(anchorname, rulesetname, opts);
+			pfctl_show_tables(anchorname, opts);
 			break;
 		case 'o':
 			pfctl_load_fingerprints(dev, opts);
@@ -1705,10 +1800,10 @@ main(int argc, char *argv[])
 	if (clearopt != NULL) {
 		switch (*clearopt) {
 		case 'r':
-			pfctl_clear_rules(dev, opts, anchorname, rulesetname);
+			pfctl_clear_rules(dev, opts, anchorname);
 			break;
 		case 'n':
-			pfctl_clear_nat(dev, opts, anchorname, rulesetname);
+			pfctl_clear_nat(dev, opts, anchorname);
 			break;
 		case 'q':
 			pfctl_clear_altq(dev, opts);
@@ -1723,22 +1818,23 @@ main(int argc, char *argv[])
 			pfctl_clear_stats(dev, opts);
 			break;
 		case 'a':
-			pfctl_clear_rules(dev, opts, anchorname, rulesetname);
-			pfctl_clear_nat(dev, opts, anchorname, rulesetname);
-			pfctl_clear_tables(anchorname, rulesetname, opts);
-			if (!*anchorname && !*rulesetname) {
+			pfctl_clear_rules(dev, opts, anchorname);
+			pfctl_clear_nat(dev, opts, anchorname);
+			pfctl_clear_tables(anchorname, opts);
+			if (!*anchorname) {
 				pfctl_clear_altq(dev, opts);
 				pfctl_clear_states(dev, ifaceopt, opts);
 				pfctl_clear_src_nodes(dev, opts);
 				pfctl_clear_stats(dev, opts);
 				pfctl_clear_fingerprints(dev, opts);
+				pfctl_clear_interface_flags(dev, opts);
 			}
 			break;
 		case 'o':
 			pfctl_clear_fingerprints(dev, opts);
 			break;
 		case 'T':
-			pfctl_clear_tables(anchorname, rulesetname, opts);
+			pfctl_clear_tables(anchorname, opts);
 			break;
 		}
 	}
@@ -1747,17 +1843,21 @@ main(int argc, char *argv[])
 
 	if (tblcmdopt != NULL) {
 		error = pfctl_command_tables(argc, argv, tableopt,
-		    tblcmdopt, rulesopt, anchorname, rulesetname, opts);
+		    tblcmdopt, rulesopt, anchorname, opts);
 		rulesopt = NULL;
 	}
 
-	if (rulesopt != NULL)
+	if ((rulesopt != NULL) && (!*anchorname))
+		if (pfctl_clear_interface_flags(dev, opts | PF_OPT_QUIET))
+			error = 1;
+
+	if (rulesopt != NULL && !(opts & (PF_OPT_MERGE|PF_OPT_NOACTION)) &&
+	    !anchorname[0] && (loadopt & PFCTL_FLAG_OPTION))
 		if (pfctl_file_fingerprints(dev, opts, PF_OSFP_FILE))
 			error = 1;
 
 	if (rulesopt != NULL) {
-		if (pfctl_rules(dev, rulesopt, opts, anchorname, rulesetname,
-		    NULL))
+		if (pfctl_rules(dev, rulesopt, opts, anchorname, NULL))
 			error = 1;
 		else if (!(opts & PF_OPT_NOACTION) &&
 		    (loadopt & PFCTL_FLAG_TABLE))
diff --git a/contrib/pf/pfctl/pfctl.h b/contrib/pf/pfctl/pfctl.h
index dd39aba..3b943dc 100644
--- a/contrib/pf/pfctl/pfctl.h
+++ b/contrib/pf/pfctl/pfctl.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pfctl.h,v 1.33 2004/02/19 21:37:01 cedric Exp $ */
+/*	$OpenBSD: pfctl.h,v 1.37 2005/01/05 18:23:10 mcbride Exp $ */
 
 /*
  * Copyright (c) 2001 Daniel Hartmeier
@@ -64,8 +64,6 @@ int	 pfr_get_astats(struct pfr_table *, struct pfr_astats *, int *, int);
 int	 pfr_clr_astats(struct pfr_table *, struct pfr_addr *, int, int *, int);
 int	 pfr_tst_addrs(struct pfr_table *, struct pfr_addr *, int, int *, int);
 int	 pfr_set_tflags(struct pfr_table *, int, int, int, int *, int *, int);
-int	 pfr_ina_begin(struct pfr_table *, int *, int *, int);
-int	 pfr_ina_commit(struct pfr_table *, int, int *, int *, int);
 int	 pfr_ina_define(struct pfr_table *, struct pfr_addr *, int, int *,
 	    int *, int, int);
 void	 pfr_buf_clear(struct pfr_buffer *);
@@ -79,13 +77,14 @@ int	 pfi_get_ifaces(const char *, struct pfi_if *, int *, int);
 int	 pfi_clr_istats(const char *, int *, int);
 
 void	 pfctl_print_title(char *);
-int	 pfctl_clear_tables(const char *, const char *, int);
-int	 pfctl_show_tables(const char *, const char *, int);
+int	 pfctl_clear_tables(const char *, int);
+int	 pfctl_show_tables(const char *, int);
 int	 pfctl_command_tables(int, char *[], char *, const char *, char *,
-	    const char *, const char *, int);
+	    const char *, int);
 int	 pfctl_show_altq(int, const char *, int, int);
 void	 warn_namespace_collision(const char *);
 int	 pfctl_show_ifaces(const char *, int);
+FILE	*pfctl_fopen(const char *, const char *);
 
 #ifndef DEFAULT_PRIORITY
 #define DEFAULT_PRIORITY	1
@@ -103,6 +102,8 @@ struct segment {
 	double			x, y, d, m;
 };
 
+extern	int loadopt;
+
 int		 check_commit_altq(int, int);
 void		 pfaltq_store(struct pf_altq *);
 void		 pfaltq_free(struct pf_altq *);
@@ -116,9 +117,9 @@ void	 print_state(struct pf_state *, int);
 int	 unmask(struct pf_addr *, sa_family_t);
 
 int	 pfctl_cmdline_symset(char *);
-int	 pfctl_add_trans(struct pfr_buffer *, int, const char *, const char *);
+int	 pfctl_add_trans(struct pfr_buffer *, int, const char *);
 u_int32_t
-	 pfctl_get_ticket(struct pfr_buffer *, int, const char *, const char *);
+	 pfctl_get_ticket(struct pfr_buffer *, int, const char *);
 int	 pfctl_trans(int, struct pfr_buffer *, u_long, int);
 
 #endif /* _PFCTL_H_ */
diff --git a/contrib/pf/pfctl/pfctl_altq.c b/contrib/pf/pfctl/pfctl_altq.c
index 04e3da6..3f5b087 100644
--- a/contrib/pf/pfctl/pfctl_altq.c
+++ b/contrib/pf/pfctl/pfctl_altq.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pfctl_altq.c,v 1.83 2004/03/14 21:51:44 dhartmei Exp $	*/
+/*	$OpenBSD: pfctl_altq.c,v 1.86 2005/02/28 14:04:51 henning Exp $	*/
 
 /*
  * Copyright (c) 2002
@@ -304,7 +304,8 @@ eval_pfqueue(struct pfctl *pf, struct pf_altq *pa, struct node_queue_bw *bw,
     struct node_queue_opt *opts)
 {
 	/* should be merged with expand_queue */
-	struct pf_altq	*if_pa, *parent;
+	struct pf_altq	*if_pa, *parent, *altq;
+	u_int32_t	 bwsum;
 	int		 error = 0;
 
 	/* find the corresponding interface and copy fields used by queues */
@@ -336,22 +337,35 @@ eval_pfqueue(struct pfctl *pf, struct pf_altq *pa, struct node_queue_bw *bw,
 		pa->qlimit = DEFAULT_QLIMIT;
 
 	if (pa->scheduler == ALTQT_CBQ || pa->scheduler == ALTQT_HFSC) {
-		if ((pa->bandwidth = eval_bwspec(bw,
-		    parent == NULL ? 0 : parent->bandwidth)) == 0) {
-			fprintf(stderr, "bandwidth for %s invalid (%d / %d)\n",
-			    pa->qname, bw->bw_absolute, bw->bw_percent);
-			return (1);
-		}
+		pa->bandwidth = eval_bwspec(bw,
+		    parent == NULL ? 0 : parent->bandwidth);
 
 		if (pa->bandwidth > pa->ifbandwidth) {
 			fprintf(stderr, "bandwidth for %s higher than "
 			    "interface\n", pa->qname);
 			return (1);
 		}
-		if (parent != NULL && pa->bandwidth > parent->bandwidth) {
-			fprintf(stderr, "bandwidth for %s higher than parent\n",
-			    pa->qname);
-			return (1);
+		/* check the sum of the child bandwidth is under parent's */
+		if (parent != NULL) {
+			if (pa->bandwidth > parent->bandwidth) {
+				warnx("bandwidth for %s higher than parent",
+				    pa->qname);
+				return (1);
+			}
+			bwsum = 0;
+			TAILQ_FOREACH(altq, &altqs, entries) {
+				if (strncmp(altq->ifname, pa->ifname,
+				    IFNAMSIZ) == 0 &&
+				    altq->qname[0] != 0 &&
+				    strncmp(altq->parent, pa->parent,
+				    PF_QNAME_SIZE) == 0)
+					bwsum += altq->bandwidth;
+			}
+			bwsum += pa->bandwidth;
+			if (bwsum > parent->bandwidth) {
+				warnx("the sum of the child bandwidth higher"
+				    " than parent \"%s\"", parent->qname);
+			}
 		}
 	}
 
@@ -695,7 +709,7 @@ eval_pfqueue_hfsc(struct pfctl *pf, struct pf_altq *pa)
 	 * for the real-time service curve, the sum of the service curves
 	 * should not exceed 80% of the interface bandwidth.  20% is reserved
 	 * not to over-commit the actual interface bandwidth.
-	 * for the link-sharing service curve, the sum of the child service
+	 * for the linkshare service curve, the sum of the child service
 	 * curve should not exceed the parent service curve.
 	 * for the upper-limit service curve, the assigned bandwidth should
 	 * be smaller than the interface bandwidth, and the upper-limit should
@@ -722,7 +736,7 @@ eval_pfqueue_hfsc(struct pfctl *pf, struct pf_altq *pa)
 		if (strncmp(altq->parent, pa->parent, PF_QNAME_SIZE) != 0)
 			continue;
 
-		/* if the class has a link-sharing service curve, add it. */
+		/* if the class has a linkshare service curve, add it. */
 		if (opts->lssc_m2 != 0 && altq->pq_u.hfsc_opts.lssc_m2 != 0) {
 			sc.m1 = altq->pq_u.hfsc_opts.lssc_m1;
 			sc.d = altq->pq_u.hfsc_opts.lssc_d;
@@ -733,22 +747,35 @@ eval_pfqueue_hfsc(struct pfctl *pf, struct pf_altq *pa)
 
 	/* check the real-time service curve.  reserve 20% of interface bw */
 	if (opts->rtsc_m2 != 0) {
+		/* add this queue to the sum */
+		sc.m1 = opts->rtsc_m1;
+		sc.d = opts->rtsc_d;
+		sc.m2 = opts->rtsc_m2;
+		gsc_add_sc(&rtsc, &sc);
+		/* compare the sum with 80% of the interface */
 		sc.m1 = 0;
 		sc.d = 0;
 		sc.m2 = pa->ifbandwidth / 100 * 80;
 		if (!is_gsc_under_sc(&rtsc, &sc)) {
-			warnx("real-time sc exceeds the interface bandwidth");
+			warnx("real-time sc exceeds 80%% of the interface "
+			    "bandwidth (%s)", rate2str((double)sc.m2));
 			goto err_ret;
 		}
 	}
 
-	/* check the link-sharing service curve. */
+	/* check the linkshare service curve. */
 	if (opts->lssc_m2 != 0) {
+		/* add this queue to the child sum */
+		sc.m1 = opts->lssc_m1;
+		sc.d = opts->lssc_d;
+		sc.m2 = opts->lssc_m2;
+		gsc_add_sc(&lssc, &sc);
+		/* compare the sum of the children with parent's sc */
 		sc.m1 = parent->pq_u.hfsc_opts.lssc_m1;
 		sc.d = parent->pq_u.hfsc_opts.lssc_d;
 		sc.m2 = parent->pq_u.hfsc_opts.lssc_m2;
 		if (!is_gsc_under_sc(&lssc, &sc)) {
-			warnx("link-sharing sc exceeds parent's sc");
+			warnx("linkshare sc exceeds parent's sc");
 			goto err_ret;
 		}
 	}
@@ -1075,6 +1102,7 @@ getifspeed(char *ifname)
 
 	if ((s = socket(AF_INET, SOCK_DGRAM, 0)) < 0)
 		err(1, "socket");
+	bzero(&ifr, sizeof(ifr));
 	if (strlcpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name)) >=
 	    sizeof(ifr.ifr_name))
 		errx(1, "getifspeed: strlcpy");
@@ -1096,6 +1124,7 @@ getifmtu(char *ifname)
 
 	if ((s = socket(AF_INET, SOCK_DGRAM, 0)) < 0)
 		err(1, "socket");
+	bzero(&ifr, sizeof(ifr));
 	if (strlcpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name)) >=
 	    sizeof(ifr.ifr_name))
 		errx(1, "getifmtu: strlcpy");
diff --git a/contrib/pf/pfctl/pfctl_optimize.c b/contrib/pf/pfctl/pfctl_optimize.c
new file mode 100644
index 0000000..6c6803e
--- /dev/null
+++ b/contrib/pf/pfctl/pfctl_optimize.c
@@ -0,0 +1,1563 @@
+/*	$OpenBSD: pfctl_optimize.c,v 1.5 2005/01/03 15:18:10 frantzen Exp $ */
+
+/*
+ * Copyright (c) 2004 Mike Frantzen <frantzen@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <sys/types.h>
+#include <sys/ioctl.h>
+#include <sys/socket.h>
+
+#include <net/if.h>
+#include <net/pfvar.h>
+
+#include <netinet/in.h>
+#include <arpa/inet.h>
+
+#include <assert.h>
+#include <ctype.h>
+#include <err.h>
+#include <errno.h>
+#include <stddef.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "pfctl_parser.h"
+#include "pfctl.h"
+
+/* The size at which a table becomes faster than individual rules */
+#define TABLE_THRESHOLD		6
+
+
+/* #define OPT_DEBUG	1 */
+#ifdef OPT_DEBUG
+# define DEBUG(str, v...) \
+	printf("%s: " str "\n", __FUNCTION__ , ## v)
+#else
+# define DEBUG(str, v...) ((void)0)
+#endif
+
+
+/*
+ * A container that lets us sort a superblock to optimize the skip step jumps
+ */
+struct pf_skip_step {
+	int				ps_count;	/* number of items */
+	TAILQ_HEAD( , pf_opt_rule)	ps_rules;
+	TAILQ_ENTRY(pf_skip_step)	ps_entry;
+};
+
+
+/*
+ * A superblock is a block of adjacent rules of similar action.  If there
+ * are five PASS rules in a row, they all become members of a superblock.
+ * Once we have a superblock, we are free to re-order any rules within it
+ * in order to improve performance; if a packet is passed, it doesn't matter
+ * who passed it.
+ */
+struct superblock {
+	TAILQ_HEAD( , pf_opt_rule)		 sb_rules;
+	TAILQ_ENTRY(superblock)			 sb_entry;
+	struct superblock			*sb_profiled_block;
+	TAILQ_HEAD(skiplist, pf_skip_step)	 sb_skipsteps[PF_SKIP_COUNT];
+};
+TAILQ_HEAD(superblocks, superblock);
+
+
+/*
+ * Description of the PF rule structure.
+ */
+enum {
+    BARRIER,	/* the presence of the field puts the rule in it's own block */
+    BREAK,	/* the field may not differ between rules in a superblock */
+    NOMERGE,	/* the field may not differ between rules when combined */
+    COMBINED,	/* the field may itself be combined with other rules */
+    DC,		/* we just don't care about the field */
+    NEVER};	/* we should never see this field set?!? */
+struct pf_rule_field {
+	const char	*prf_name;
+	int		 prf_type;
+	size_t		 prf_offset;
+	size_t		 prf_size;
+} pf_rule_desc[] = {
+#define PF_RULE_FIELD(field, ty)	\
+    {#field,				\
+    ty,					\
+    offsetof(struct pf_rule, field),	\
+    sizeof(((struct pf_rule *)0)->field)}
+
+
+    /*
+     * The presence of these fields in a rule put the rule in it's own
+     * superblock.  Thus it will not be optimized.  It also prevents the
+     * rule from being re-ordered at all.
+     */
+    PF_RULE_FIELD(label,		BARRIER),
+    PF_RULE_FIELD(prob,			BARRIER),
+    PF_RULE_FIELD(max_states,		BARRIER),
+    PF_RULE_FIELD(max_src_nodes,	BARRIER),
+
+    /*
+     * These fields must be the same between all rules in the same superblock.
+     * These rules are allowed to be re-ordered but only among like rules.
+     * For instance we can re-order all 'tag "foo"' rules because they have the
+     * same tag.  But we can not re-order between a 'tag "foo"' and a
+     * 'tag "bar"' since that would change the meaning of the ruleset.
+     */
+    PF_RULE_FIELD(tagname,		BREAK),
+    PF_RULE_FIELD(keep_state,		BREAK),
+    PF_RULE_FIELD(qname,		BREAK),
+    PF_RULE_FIELD(rt,			BREAK),
+    PF_RULE_FIELD(allow_opts,		BREAK),
+    PF_RULE_FIELD(rule_flag,		BREAK),
+    PF_RULE_FIELD(action,		BREAK),
+
+    /*
+     * Any fields not listed in this structure act as BREAK fields
+     */
+
+
+    /*
+     * These fields must not differ when we merge two rules together but
+     * their difference isn't enough to put the rules in different superblocks.
+     * There are no problems re-ordering any rules with these fields.
+     */
+    PF_RULE_FIELD(af,			NOMERGE),
+    PF_RULE_FIELD(ifnot,		NOMERGE),
+    PF_RULE_FIELD(ifname,		NOMERGE),
+    PF_RULE_FIELD(match_tag_not,	NOMERGE),
+    PF_RULE_FIELD(match_tagname,	NOMERGE),
+    PF_RULE_FIELD(os_fingerprint,	NOMERGE),
+    PF_RULE_FIELD(timeout,		NOMERGE),
+    PF_RULE_FIELD(return_icmp,		NOMERGE),
+    PF_RULE_FIELD(return_icmp6,		NOMERGE),
+    PF_RULE_FIELD(uid,			NOMERGE),
+    PF_RULE_FIELD(gid,			NOMERGE),
+    PF_RULE_FIELD(direction,		NOMERGE),
+    PF_RULE_FIELD(proto,		NOMERGE),
+    PF_RULE_FIELD(type,			NOMERGE),
+    PF_RULE_FIELD(code,			NOMERGE),
+    PF_RULE_FIELD(flags,		NOMERGE),
+    PF_RULE_FIELD(flagset,		NOMERGE),
+    PF_RULE_FIELD(tos,			NOMERGE),
+    PF_RULE_FIELD(src.port,		NOMERGE),
+    PF_RULE_FIELD(dst.port,		NOMERGE),
+    PF_RULE_FIELD(src.port_op,		NOMERGE),
+    PF_RULE_FIELD(dst.port_op,		NOMERGE),
+    PF_RULE_FIELD(src.neg,		NOMERGE),
+    PF_RULE_FIELD(dst.neg,		NOMERGE),
+
+    /* These fields can be merged */
+    PF_RULE_FIELD(src.addr,		COMBINED),
+    PF_RULE_FIELD(dst.addr,		COMBINED),
+
+    /* We just don't care about these fields.  They're set by the kernel */
+    PF_RULE_FIELD(skip,			DC),
+    PF_RULE_FIELD(evaluations,		DC),
+    PF_RULE_FIELD(packets,		DC),
+    PF_RULE_FIELD(bytes,		DC),
+    PF_RULE_FIELD(kif,			DC),
+    PF_RULE_FIELD(anchor,		DC),
+    PF_RULE_FIELD(states,		DC),
+    PF_RULE_FIELD(src_nodes,		DC),
+    PF_RULE_FIELD(nr,			DC),
+    PF_RULE_FIELD(entries,		DC),
+    PF_RULE_FIELD(qid,			DC),
+    PF_RULE_FIELD(pqid,			DC),
+    PF_RULE_FIELD(anchor_relative,	DC),
+    PF_RULE_FIELD(anchor_wildcard,	DC),
+
+    /* These fields should never be set in a PASS/BLOCK rule */
+    PF_RULE_FIELD(natpass,		NEVER),
+    PF_RULE_FIELD(max_mss,		NEVER),
+    PF_RULE_FIELD(min_ttl,		NEVER),
+};
+
+
+
+int	add_opt_table(struct pfctl *, struct pf_opt_tbl **, sa_family_t,
+	    struct pf_rule_addr *);
+int	addrs_combineable(struct pf_rule_addr *, struct pf_rule_addr *);
+int	addrs_equal(struct pf_rule_addr *, struct pf_rule_addr *);
+int	block_feedback(struct pfctl *, struct superblock *);
+int	combine_rules(struct pfctl *, struct superblock *);
+void	comparable_rule(struct pf_rule *, const struct pf_rule *, int);
+int	construct_superblocks(struct pfctl *, struct pf_opt_queue *,
+	    struct superblocks *);
+void	exclude_supersets(struct pf_rule *, struct pf_rule *);
+int	load_feedback_profile(struct pfctl *, struct superblocks *);
+int	optimize_superblock(struct pfctl *, struct superblock *);
+int	pf_opt_create_table(struct pfctl *, struct pf_opt_tbl *);
+void	remove_from_skipsteps(struct skiplist *, struct superblock *,
+	    struct pf_opt_rule *, struct pf_skip_step *);
+int	remove_identical_rules(struct pfctl *, struct superblock *);
+int	reorder_rules(struct pfctl *, struct superblock *, int);
+int	rules_combineable(struct pf_rule *, struct pf_rule *);
+void	skip_append(struct superblock *, int, struct pf_skip_step *,
+	    struct pf_opt_rule *);
+int	skip_compare(int, struct pf_skip_step *, struct pf_opt_rule *);
+void	skip_init(void);
+int	skip_cmp_af(struct pf_rule *, struct pf_rule *);
+int	skip_cmp_dir(struct pf_rule *, struct pf_rule *);
+int	skip_cmp_dst_addr(struct pf_rule *, struct pf_rule *);
+int	skip_cmp_dst_port(struct pf_rule *, struct pf_rule *);
+int	skip_cmp_ifp(struct pf_rule *, struct pf_rule *);
+int	skip_cmp_proto(struct pf_rule *, struct pf_rule *);
+int	skip_cmp_src_addr(struct pf_rule *, struct pf_rule *);
+int	skip_cmp_src_port(struct pf_rule *, struct pf_rule *);
+int	superblock_inclusive(struct superblock *, struct pf_opt_rule *);
+void	superblock_free(struct pfctl *, struct superblock *);
+
+
+int (*skip_comparitors[PF_SKIP_COUNT])(struct pf_rule *, struct pf_rule *);
+const char *skip_comparitors_names[PF_SKIP_COUNT];
+#define PF_SKIP_COMPARITORS {				\
+    { "ifp", PF_SKIP_IFP, skip_cmp_ifp },		\
+    { "dir", PF_SKIP_DIR, skip_cmp_dir },		\
+    { "af", PF_SKIP_AF, skip_cmp_af },			\
+    { "proto", PF_SKIP_PROTO, skip_cmp_proto },		\
+    { "saddr", PF_SKIP_SRC_ADDR, skip_cmp_src_addr },	\
+    { "sport", PF_SKIP_SRC_PORT, skip_cmp_src_port },	\
+    { "daddr", PF_SKIP_DST_ADDR, skip_cmp_dst_addr },	\
+    { "dport", PF_SKIP_DST_PORT, skip_cmp_dst_port }	\
+}
+
+struct pfr_buffer table_buffer;
+int table_identifier;
+
+
+int
+pfctl_optimize_rules(struct pfctl *pf)
+{
+	struct superblocks superblocks;
+	struct superblock *block;
+	struct pf_opt_rule *por;
+	int nr;
+
+	DEBUG("optimizing ruleset");
+	memset(&table_buffer, 0, sizeof(table_buffer));
+	skip_init();
+
+	if (TAILQ_FIRST(&pf->opt_queue))
+		nr = TAILQ_FIRST(&pf->opt_queue)->por_rule.nr;
+
+	TAILQ_INIT(&superblocks);
+	if (construct_superblocks(pf, &pf->opt_queue, &superblocks))
+		goto error;
+
+	if (pf->opts & PF_OPT_OPTIMIZE_PROFILE) {
+		if (load_feedback_profile(pf, &superblocks))
+			goto error;
+	}
+
+	TAILQ_FOREACH(block, &superblocks, sb_entry) {
+		if (optimize_superblock(pf, block))
+			goto error;
+	}
+
+
+	/*
+	 * Optimizations are done so we turn off the optimization flag and
+	 * put the rules right back into the regular codepath.
+	 */
+	pf->opts &= ~PF_OPT_OPTIMIZE;
+
+	while ((block = TAILQ_FIRST(&superblocks))) {
+		TAILQ_REMOVE(&superblocks, block, sb_entry);
+
+		while ((por = TAILQ_FIRST(&block->sb_rules))) {
+			TAILQ_REMOVE(&block->sb_rules, por, por_entry);
+			por->por_rule.nr = nr++;
+			if (pfctl_add_rule(pf, &por->por_rule,
+			    por->por_anchor)) {
+				free(por);
+				goto error;
+			}
+			free(por);
+		}
+		free(block);
+	}
+
+	return (0);
+
+error:
+	while ((por = TAILQ_FIRST(&pf->opt_queue))) {
+		TAILQ_REMOVE(&pf->opt_queue, por, por_entry);
+		if (por->por_src_tbl) {
+			pfr_buf_clear(por->por_src_tbl->pt_buf);
+			free(por->por_src_tbl->pt_buf);
+			free(por->por_src_tbl);
+		}
+		if (por->por_dst_tbl) {
+			pfr_buf_clear(por->por_dst_tbl->pt_buf);
+			free(por->por_dst_tbl->pt_buf);
+			free(por->por_dst_tbl);
+		}
+		free(por);
+	}
+	while ((block = TAILQ_FIRST(&superblocks))) {
+		TAILQ_REMOVE(&superblocks, block, sb_entry);
+		superblock_free(pf, block);
+	}
+	return (1);
+}
+
+
+/*
+ * Go ahead and optimize a superblock
+ */
+int
+optimize_superblock(struct pfctl *pf, struct superblock *block)
+{
+#ifdef OPT_DEBUG
+	struct pf_opt_rule *por;
+#endif /* OPT_DEBUG */
+
+	/* We have a few optimization passes:
+	 *   1) remove duplicate rules or rules that are a subset of other
+	 *      rules
+	 *   2) combine otherwise identical rules with different IP addresses
+	 *      into a single rule and put the addresses in a table.
+	 *   3) re-order the rules to improve kernel skip steps
+	 *   4) re-order the 'quick' rules based on feedback from the
+	 *      active ruleset statistics
+	 *
+	 * XXX combine_rules() doesn't combine v4 and v6 rules.  would just
+	 *     have to keep af in the table container, make af 'COMBINE' and
+	 *     twiddle the af on the merged rule
+	 * XXX maybe add a weighting to the metric on skipsteps when doing
+	 *     reordering.  sometimes two sequential tables will be better
+	 *     that four consecutive interfaces.
+	 * XXX need to adjust the skipstep count of everything after PROTO,
+	 *     since they aren't actually checked on a proto mismatch in
+	 *     pf_test_{tcp, udp, icmp}()
+	 * XXX should i treat proto=0, af=0 or dir=0 special in skepstep
+	 *     calculation since they are a DC?
+	 * XXX keep last skiplist of last superblock to influence this
+	 *     superblock.  '5 inet6 log' should make '3 inet6' come before '4
+	 *     inet' in the next superblock.
+	 * XXX would be useful to add tables for ports
+	 * XXX we can also re-order some mutually exclusive superblocks to
+	 *     try merging superblocks before any of these optimization passes.
+	 *     for instance a single 'log in' rule in the middle of non-logging
+	 *     out rules.
+	 */
+
+	/* shortcut.  there will be alot of 1-rule superblocks */
+	if (!TAILQ_NEXT(TAILQ_FIRST(&block->sb_rules), por_entry))
+		return (0);
+
+#ifdef OPT_DEBUG
+	printf("--- Superblock ---\n");
+	TAILQ_FOREACH(por, &block->sb_rules, por_entry) {
+		printf("  ");
+		print_rule(&por->por_rule, por->por_anchor, 1);
+	}
+#endif /* OPT_DEBUG */
+
+
+	if (remove_identical_rules(pf, block))
+		return (1);
+	if (combine_rules(pf, block))
+		return (1);
+	if ((pf->opts & PF_OPT_OPTIMIZE_PROFILE) &&
+	    TAILQ_FIRST(&block->sb_rules)->por_rule.quick &&
+	    block->sb_profiled_block) {
+		if (block_feedback(pf, block))
+			return (1);
+	} else if (reorder_rules(pf, block, 0)) {
+		return (1);
+	}
+
+	/*
+	 * Don't add any optimization passes below reorder_rules().  It will
+	 * have divided superblocks into smaller blocks for further refinement
+	 * and doesn't put them back together again.  What once was a true
+	 * superblock might have been split into multiple superblocks.
+	 */
+
+#ifdef OPT_DEBUG
+	printf("--- END Superblock ---\n");
+#endif /* OPT_DEBUG */
+	return (0);
+}
+
+
+/*
+ * Optimization pass #1: remove identical rules
+ */
+int
+remove_identical_rules(struct pfctl *pf, struct superblock *block)
+{
+	struct pf_opt_rule *por1, *por2, *por_next, *por2_next;
+	struct pf_rule a, a2, b, b2;
+
+	for (por1 = TAILQ_FIRST(&block->sb_rules); por1; por1 = por_next) {
+		por_next = TAILQ_NEXT(por1, por_entry);
+		for (por2 = por_next; por2; por2 = por2_next) {
+			por2_next = TAILQ_NEXT(por2, por_entry);
+			comparable_rule(&a, &por1->por_rule, DC);
+			comparable_rule(&b, &por2->por_rule, DC);
+			memcpy(&a2, &a, sizeof(a2));
+			memcpy(&b2, &b, sizeof(b2));
+
+			exclude_supersets(&a, &b);
+			exclude_supersets(&b2, &a2);
+			if (memcmp(&a, &b, sizeof(a)) == 0) {
+				DEBUG("removing identical rule  nr%d = *nr%d*",
+				    por1->por_rule.nr, por2->por_rule.nr);
+				TAILQ_REMOVE(&block->sb_rules, por2, por_entry);
+				if (por_next == por2)
+					por_next = TAILQ_NEXT(por1, por_entry);
+				free(por2);
+			} else if (memcmp(&a2, &b2, sizeof(a2)) == 0) {
+				DEBUG("removing identical rule  *nr%d* = nr%d",
+				    por1->por_rule.nr, por2->por_rule.nr);
+				TAILQ_REMOVE(&block->sb_rules, por1, por_entry);
+				free(por1);
+				break;
+			}
+		}
+	}
+
+	return (0);
+}
+
+
+/*
+ * Optimization pass #2: combine similar rules with different addresses
+ * into a single rule and a table
+ */
+int
+combine_rules(struct pfctl *pf, struct superblock *block)
+{
+	struct pf_opt_rule *p1, *p2, *por_next;
+	int src_eq, dst_eq;
+
+	if ((pf->loadopt & PFCTL_FLAG_TABLE) == 0) {
+		warnx("Must enable table loading for optimizations");
+		return (1);
+	}
+
+	/* First we make a pass to combine the rules.  O(n log n) */
+	TAILQ_FOREACH(p1, &block->sb_rules, por_entry) {
+		for (p2 = TAILQ_NEXT(p1, por_entry); p2; p2 = por_next) {
+			por_next = TAILQ_NEXT(p2, por_entry);
+
+			src_eq = addrs_equal(&p1->por_rule.src,
+			    &p2->por_rule.src);
+			dst_eq = addrs_equal(&p1->por_rule.dst,
+			    &p2->por_rule.dst);
+
+			if (src_eq && !dst_eq && p1->por_src_tbl == NULL &&
+			    p2->por_dst_tbl == NULL &&
+			    p2->por_src_tbl == NULL &&
+			    rules_combineable(&p1->por_rule, &p2->por_rule) &&
+			    addrs_combineable(&p1->por_rule.dst,
+			    &p2->por_rule.dst)) {
+				DEBUG("can combine rules  nr%d = nr%d",
+				    p1->por_rule.nr, p2->por_rule.nr);
+				if (p1->por_dst_tbl == NULL &&
+				    add_opt_table(pf, &p1->por_dst_tbl,
+				    p1->por_rule.af, &p1->por_rule.dst))
+					return (1);
+				if (add_opt_table(pf, &p1->por_dst_tbl,
+				    p1->por_rule.af, &p2->por_rule.dst))
+					return (1);
+				p2->por_dst_tbl = p1->por_dst_tbl;
+				if (p1->por_dst_tbl->pt_rulecount >=
+				    TABLE_THRESHOLD) {
+					TAILQ_REMOVE(&block->sb_rules, p2,
+					    por_entry);
+					free(p2);
+				}
+			} else if (!src_eq && dst_eq && p1->por_dst_tbl == NULL
+			    && p2->por_src_tbl == NULL &&
+			    p2->por_dst_tbl == NULL &&
+			    rules_combineable(&p1->por_rule, &p2->por_rule) &&
+			    addrs_combineable(&p1->por_rule.src,
+			    &p2->por_rule.src)) {
+				DEBUG("can combine rules  nr%d = nr%d",
+				    p1->por_rule.nr, p2->por_rule.nr);
+				if (p1->por_src_tbl == NULL &&
+				    add_opt_table(pf, &p1->por_src_tbl,
+				    p1->por_rule.af, &p1->por_rule.src))
+					return (1);
+				if (add_opt_table(pf, &p1->por_src_tbl,
+				    p1->por_rule.af, &p2->por_rule.src))
+					return (1);
+				p2->por_src_tbl = p1->por_src_tbl;
+				if (p1->por_src_tbl->pt_rulecount >=
+				    TABLE_THRESHOLD) {
+					TAILQ_REMOVE(&block->sb_rules, p2,
+					    por_entry);
+					free(p2);
+				}
+			}
+		}
+	}
+
+
+	/*
+	 * Then we make a final pass to create a valid table name and
+	 * insert the name into the rules.
+	 */
+	for (p1 = TAILQ_FIRST(&block->sb_rules); p1; p1 = por_next) {
+		por_next = TAILQ_NEXT(p1, por_entry);
+		assert(p1->por_src_tbl == NULL || p1->por_dst_tbl == NULL);
+
+		if (p1->por_src_tbl && p1->por_src_tbl->pt_rulecount >=
+		    TABLE_THRESHOLD) {
+			if (p1->por_src_tbl->pt_generated) {
+				/* This rule is included in a table */
+				TAILQ_REMOVE(&block->sb_rules, p1, por_entry);
+				free(p1);
+				continue;
+			}
+			p1->por_src_tbl->pt_generated = 1;
+
+			if ((pf->opts & PF_OPT_NOACTION) == 0 &&
+			    pf_opt_create_table(pf, p1->por_src_tbl))
+				return (1);
+
+			pf->tdirty = 1;
+
+			if (pf->opts & PF_OPT_VERBOSE)
+				print_tabledef(p1->por_src_tbl->pt_name,
+				    PFR_TFLAG_CONST, 1,
+				    &p1->por_src_tbl->pt_nodes);
+
+			memset(&p1->por_rule.src.addr, 0,
+			    sizeof(p1->por_rule.src.addr));
+			p1->por_rule.src.addr.type = PF_ADDR_TABLE;
+			strlcpy(p1->por_rule.src.addr.v.tblname,
+			    p1->por_src_tbl->pt_name,
+			    sizeof(p1->por_rule.src.addr.v.tblname));
+
+			pfr_buf_clear(p1->por_src_tbl->pt_buf);
+			free(p1->por_src_tbl->pt_buf);
+			p1->por_src_tbl->pt_buf = NULL;
+		}
+		if (p1->por_dst_tbl && p1->por_dst_tbl->pt_rulecount >=
+		    TABLE_THRESHOLD) {
+			if (p1->por_dst_tbl->pt_generated) {
+				/* This rule is included in a table */
+				TAILQ_REMOVE(&block->sb_rules, p1, por_entry);
+				free(p1);
+				continue;
+			}
+			p1->por_dst_tbl->pt_generated = 1;
+
+			if ((pf->opts & PF_OPT_NOACTION) == 0 &&
+			    pf_opt_create_table(pf, p1->por_dst_tbl))
+				return (1);
+			pf->tdirty = 1;
+
+			if (pf->opts & PF_OPT_VERBOSE)
+				print_tabledef(p1->por_dst_tbl->pt_name,
+				    PFR_TFLAG_CONST, 1,
+				    &p1->por_dst_tbl->pt_nodes);
+
+			memset(&p1->por_rule.dst.addr, 0,
+			    sizeof(p1->por_rule.dst.addr));
+			p1->por_rule.dst.addr.type = PF_ADDR_TABLE;
+			strlcpy(p1->por_rule.dst.addr.v.tblname,
+			    p1->por_dst_tbl->pt_name,
+			    sizeof(p1->por_rule.dst.addr.v.tblname));
+
+			pfr_buf_clear(p1->por_dst_tbl->pt_buf);
+			free(p1->por_dst_tbl->pt_buf);
+			p1->por_dst_tbl->pt_buf = NULL;
+		}
+	}
+
+	return (0);
+}
+
+
+/*
+ * Optimization pass #3: re-order rules to improve skip steps
+ */
+int
+reorder_rules(struct pfctl *pf, struct superblock *block, int depth)
+{
+	struct superblock *newblock;
+	struct pf_skip_step *skiplist;
+	struct pf_opt_rule *por;
+	int i, largest, largest_list, rule_count = 0;
+	TAILQ_HEAD( , pf_opt_rule) head;
+
+	/*
+	 * Calculate the best-case skip steps.  We put each rule in a list
+	 * of other rules with common fields
+	 */
+	for (i = 0; i < PF_SKIP_COUNT; i++) {
+		TAILQ_FOREACH(por, &block->sb_rules, por_entry) {
+			TAILQ_FOREACH(skiplist, &block->sb_skipsteps[i],
+			    ps_entry) {
+				if (skip_compare(i, skiplist, por) == 0)
+					break;
+			}
+			if (skiplist == NULL) {
+				if ((skiplist = calloc(1, sizeof(*skiplist))) ==
+				    NULL)
+					err(1, "calloc");
+				TAILQ_INIT(&skiplist->ps_rules);
+				TAILQ_INSERT_TAIL(&block->sb_skipsteps[i],
+				    skiplist, ps_entry);
+			}
+			skip_append(block, i, skiplist, por);
+		}
+	}
+
+	TAILQ_FOREACH(por, &block->sb_rules, por_entry)
+		rule_count++;
+
+	/*
+	 * Now we're going to ignore any fields that are identical between
+	 * all of the rules in the superblock and those fields which differ
+	 * between every rule in the superblock.
+	 */
+	largest = 0;
+	for (i = 0; i < PF_SKIP_COUNT; i++) {
+		skiplist = TAILQ_FIRST(&block->sb_skipsteps[i]);
+		if (skiplist->ps_count == rule_count) {
+			DEBUG("(%d) original skipstep '%s' is all rules",
+			    depth, skip_comparitors_names[i]);
+			skiplist->ps_count = 0;
+		} else if (skiplist->ps_count == 1) {
+			skiplist->ps_count = 0;
+		} else {
+			DEBUG("(%d) original skipstep '%s' largest jump is %d",
+			    depth, skip_comparitors_names[i],
+			    skiplist->ps_count);
+			if (skiplist->ps_count > largest)
+				largest = skiplist->ps_count;
+		}
+	}
+	if (largest == 0) {
+		/* Ugh.  There is NO commonality in the superblock on which
+		 * optimize the skipsteps optimization.
+		 */
+		goto done;
+	}
+
+	/*
+	 * Now we're going to empty the superblock rule list and re-create
+	 * it based on a more optimal skipstep order.
+	 */
+	TAILQ_INIT(&head);
+	while ((por = TAILQ_FIRST(&block->sb_rules))) {
+		TAILQ_REMOVE(&block->sb_rules, por, por_entry);
+		TAILQ_INSERT_TAIL(&head, por, por_entry);
+	}
+
+
+	while (!TAILQ_EMPTY(&head)) {
+		largest = 1;
+
+		/*
+		 * Find the most useful skip steps remaining
+		 */
+		for (i = 0; i < PF_SKIP_COUNT; i++) {
+			skiplist = TAILQ_FIRST(&block->sb_skipsteps[i]);
+			if (skiplist->ps_count > largest) {
+				largest = skiplist->ps_count;
+				largest_list = i;
+			}
+		}
+
+		if (largest <= 1) {
+			/*
+			 * Nothing useful left.  Leave remaining rules in order.
+			 */
+			DEBUG("(%d) no more commonality for skip steps", depth);
+			while ((por = TAILQ_FIRST(&head))) {
+				TAILQ_REMOVE(&head, por, por_entry);
+				TAILQ_INSERT_TAIL(&block->sb_rules, por,
+				    por_entry);
+			}
+		} else {
+			/*
+			 * There is commonality.  Extract those common rules
+			 * and place them in the ruleset adjacent to each
+			 * other.
+			 */
+			skiplist = TAILQ_FIRST(&block->sb_skipsteps[
+			    largest_list]);
+			DEBUG("(%d) skipstep '%s' largest jump is %d @ #%d",
+			    depth, skip_comparitors_names[largest_list],
+			    largest, TAILQ_FIRST(&TAILQ_FIRST(&block->
+			    sb_skipsteps [largest_list])->ps_rules)->
+			    por_rule.nr);
+			TAILQ_REMOVE(&block->sb_skipsteps[largest_list],
+			    skiplist, ps_entry);
+
+
+			/*
+			 * There may be further commonality inside these
+			 * rules.  So we'll split them off into they're own
+			 * superblock and pass it back into the optimizer.
+			 */
+			if (skiplist->ps_count > 2) {
+				if ((newblock = calloc(1, sizeof(*newblock)))
+				    == NULL) {
+					warn("calloc");
+					return (1);
+				}
+				TAILQ_INIT(&newblock->sb_rules);
+				for (i = 0; i < PF_SKIP_COUNT; i++)
+					TAILQ_INIT(&newblock->sb_skipsteps[i]);
+				TAILQ_INSERT_BEFORE(block, newblock, sb_entry);
+				DEBUG("(%d) splitting off %d rules from superblock @ #%d",
+				    depth, skiplist->ps_count,
+				    TAILQ_FIRST(&skiplist->ps_rules)->
+				    por_rule.nr);
+			} else {
+				newblock = block;
+			}
+
+			while ((por = TAILQ_FIRST(&skiplist->ps_rules))) {
+				TAILQ_REMOVE(&head, por, por_entry);
+				TAILQ_REMOVE(&skiplist->ps_rules, por,
+				    por_skip_entry[largest_list]);
+				TAILQ_INSERT_TAIL(&newblock->sb_rules, por,
+				    por_entry);
+
+				/* Remove this rule from all other skiplists */
+				remove_from_skipsteps(&block->sb_skipsteps[
+				    largest_list], block, por, skiplist);
+			}
+			free(skiplist);
+			if (newblock != block)
+				if (reorder_rules(pf, newblock, depth + 1))
+					return (1);
+		}
+	}
+
+done:
+	for (i = 0; i < PF_SKIP_COUNT; i++) {
+		while ((skiplist = TAILQ_FIRST(&block->sb_skipsteps[i]))) {
+			TAILQ_REMOVE(&block->sb_skipsteps[i], skiplist,
+			    ps_entry);
+			free(skiplist);
+		}
+	}
+
+	return (0);
+}
+
+
+/*
+ * Optimization pass #4: re-order 'quick' rules based on feedback from the
+ * currently running ruleset
+ */
+int
+block_feedback(struct pfctl *pf, struct superblock *block)
+{
+	TAILQ_HEAD( , pf_opt_rule) queue;
+	struct pf_opt_rule *por1, *por2;
+	u_int64_t total_count = 0;
+	struct pf_rule a, b;
+
+
+	/*
+	 * Walk through all of the profiled superblock's rules and copy
+	 * the counters onto our rules.
+	 */
+	TAILQ_FOREACH(por1, &block->sb_profiled_block->sb_rules, por_entry) {
+		comparable_rule(&a, &por1->por_rule, DC);
+		total_count += por1->por_rule.packets;
+		TAILQ_FOREACH(por2, &block->sb_rules, por_entry) {
+			if (por2->por_profile_count)
+				continue;
+			comparable_rule(&b, &por2->por_rule, DC);
+			if (memcmp(&a, &b, sizeof(a)) == 0) {
+				por2->por_profile_count =
+				    por1->por_rule.packets;
+				break;
+			}
+		}
+	}
+	superblock_free(pf, block->sb_profiled_block);
+	block->sb_profiled_block = NULL;
+
+	/*
+	 * Now we pull all of the rules off the superblock and re-insert them
+	 * in sorted order.
+	 */
+
+	TAILQ_INIT(&queue);
+	while ((por1 = TAILQ_FIRST(&block->sb_rules)) != NULL) {
+		TAILQ_REMOVE(&block->sb_rules, por1, por_entry);
+		TAILQ_INSERT_TAIL(&queue, por1, por_entry);
+	}
+
+	while ((por1 = TAILQ_FIRST(&queue)) != NULL) {
+		TAILQ_REMOVE(&queue, por1, por_entry);
+/* XXX I should sort all of the unused rules based on skip steps */
+		TAILQ_FOREACH(por2, &block->sb_rules, por_entry) {
+			if (por1->por_profile_count > por2->por_profile_count) {
+				TAILQ_INSERT_BEFORE(por2, por1, por_entry);
+				break;
+			}
+		}
+		if (por2 == TAILQ_END(&block->sb_rules))
+			TAILQ_INSERT_TAIL(&block->sb_rules, por1, por_entry);
+	}
+
+	return (0);
+}
+
+
+/*
+ * Load the current ruleset from the kernel and try to associate them with
+ * the ruleset we're optimizing.
+ */
+int
+load_feedback_profile(struct pfctl *pf, struct superblocks *superblocks)
+{
+	struct superblock *block, *blockcur;
+	struct superblocks prof_superblocks;
+	struct pf_opt_rule *por;
+	struct pf_opt_queue queue;
+	struct pfioc_rule pr;
+	struct pf_rule a, b;
+	int nr, mnr;
+
+	TAILQ_INIT(&queue);
+	TAILQ_INIT(&prof_superblocks);
+
+	memset(&pr, 0, sizeof(pr));
+	pr.rule.action = PF_PASS;
+	if (ioctl(pf->dev, DIOCGETRULES, &pr)) {
+		warn("DIOCGETRULES");
+		return (1);
+	}
+	mnr = pr.nr;
+
+	DEBUG("Loading %d active rules for a feedback profile", mnr);
+	for (nr = 0; nr < mnr; ++nr) {
+		if ((por = calloc(1, sizeof(*por))) == NULL) {
+			warn("calloc");
+			return (1);
+		}
+		pr.nr = nr;
+		if (ioctl(pf->dev, DIOCGETRULE, &pr)) {
+			warn("DIOCGETRULES");
+			return (1);
+		}
+		memcpy(&por->por_rule, &pr.rule, sizeof(por->por_rule));
+		strlcpy(por->por_anchor, pr.anchor_call,
+		    sizeof(por->por_anchor));
+		if (TAILQ_EMPTY(&por->por_rule.rpool.list))
+			memset(&por->por_rule.rpool, 0,
+			    sizeof(por->por_rule.rpool));
+		TAILQ_INSERT_TAIL(&queue, por, por_entry);
+
+		/* XXX pfctl_get_pool(pf->dev, &pr.rule.rpool, nr, pr.ticket,
+		 *         PF_PASS, pf->anchor) ???
+		 * ... pfctl_clear_pool(&pr.rule.rpool)
+		 */
+	}
+
+	if (construct_superblocks(pf, &queue, &prof_superblocks))
+		return (1);
+
+
+	/*
+	 * Now we try to associate the active ruleset's superblocks with
+	 * the superblocks we're compiling.
+	 */
+	block = TAILQ_FIRST(superblocks);
+	blockcur = TAILQ_FIRST(&prof_superblocks);
+	while (block && blockcur) {
+		comparable_rule(&a, &TAILQ_FIRST(&block->sb_rules)->por_rule,
+		    BREAK);
+		comparable_rule(&b, &TAILQ_FIRST(&blockcur->sb_rules)->por_rule,
+		    BREAK);
+		if (memcmp(&a, &b, sizeof(a)) == 0) {
+			/* The two superblocks lined up */
+			block->sb_profiled_block = blockcur;
+		} else {
+			DEBUG("superblocks don't line up between #%d and #%d",
+			    TAILQ_FIRST(&block->sb_rules)->por_rule.nr,
+			    TAILQ_FIRST(&blockcur->sb_rules)->por_rule.nr);
+			break;
+		}
+		block = TAILQ_NEXT(block, sb_entry);
+		blockcur = TAILQ_NEXT(blockcur, sb_entry);
+	}
+
+
+
+	/* Free any superblocks we couldn't link */
+	while (blockcur) {
+		block = TAILQ_NEXT(blockcur, sb_entry);
+		superblock_free(pf, blockcur);
+		blockcur = block;
+	}
+	return (0);
+}
+
+
+/*
+ * Compare a rule to a skiplist to see if the rule is a member
+ */
+int
+skip_compare(int skipnum, struct pf_skip_step *skiplist,
+    struct pf_opt_rule *por)
+{
+	struct pf_rule *a, *b;
+	if (skipnum >= PF_SKIP_COUNT || skipnum < 0)
+		errx(1, "skip_compare() out of bounds");
+	a = &por->por_rule;
+	b = &TAILQ_FIRST(&skiplist->ps_rules)->por_rule;
+
+	return ((skip_comparitors[skipnum])(a, b));
+}
+
+
+/*
+ * Add a rule to a skiplist
+ */
+void
+skip_append(struct superblock *superblock, int skipnum,
+    struct pf_skip_step *skiplist, struct pf_opt_rule *por)
+{
+	struct pf_skip_step *prev;
+
+	skiplist->ps_count++;
+	TAILQ_INSERT_TAIL(&skiplist->ps_rules, por, por_skip_entry[skipnum]);
+
+	/* Keep the list of skiplists sorted by whichever is larger */
+	while ((prev = TAILQ_PREV(skiplist, skiplist, ps_entry)) &&
+	    prev->ps_count < skiplist->ps_count) {
+		TAILQ_REMOVE(&superblock->sb_skipsteps[skipnum],
+		    skiplist, ps_entry);
+		TAILQ_INSERT_BEFORE(prev, skiplist, ps_entry);
+	}
+}
+
+
+/*
+ * Remove a rule from the other skiplist calculations.
+ */
+void
+remove_from_skipsteps(struct skiplist *head, struct superblock *block,
+    struct pf_opt_rule *por, struct pf_skip_step *active_list)
+{
+	struct pf_skip_step *sk, *next;
+	struct pf_opt_rule *p2;
+	int i, found;
+
+	for (i = 0; i < PF_SKIP_COUNT; i++) {
+		sk = TAILQ_FIRST(&block->sb_skipsteps[i]);
+		if (sk == NULL || sk == active_list || sk->ps_count <= 1)
+			continue;
+		found = 0;
+		do {
+			TAILQ_FOREACH(p2, &sk->ps_rules, por_skip_entry[i])
+				if (p2 == por) {
+					TAILQ_REMOVE(&sk->ps_rules, p2,
+					    por_skip_entry[i]);
+					found = 1;
+					sk->ps_count--;
+					break;
+				}
+		} while (!found && (sk = TAILQ_NEXT(sk, ps_entry)));
+		if (found && sk) {
+			/* Does this change the sorting order? */
+			while ((next = TAILQ_NEXT(sk, ps_entry)) &&
+			    next->ps_count > sk->ps_count) {
+				TAILQ_REMOVE(head, sk, ps_entry);
+				TAILQ_INSERT_AFTER(head, next, sk, ps_entry);
+			}
+#ifdef OPT_DEBUG
+			next = TAILQ_NEXT(sk, ps_entry);
+			assert(next == NULL || next->ps_count <= sk->ps_count);
+#endif /* OPT_DEBUG */
+		}
+	}
+}
+
+
+/* Compare two rules AF field for skiplist construction */
+int
+skip_cmp_af(struct pf_rule *a, struct pf_rule *b)
+{
+	if (a->af != b->af || a->af == 0)
+		return (1);
+	return (0);
+}
+
+/* Compare two rules DIRECTION field for skiplist construction */
+int
+skip_cmp_dir(struct pf_rule *a, struct pf_rule *b)
+{
+	if (a->direction == 0 || a->direction != b->direction)
+		return (1);
+	return (0);
+}
+
+/* Compare two rules DST Address field for skiplist construction */
+int
+skip_cmp_dst_addr(struct pf_rule *a, struct pf_rule *b)
+{
+	if (a->dst.neg != b->dst.neg ||
+	    a->dst.addr.type != b->dst.addr.type)
+		return (1);
+	/* XXX if (a->proto != b->proto && a->proto != 0 && b->proto != 0
+	 *    && (a->proto == IPPROTO_TCP || a->proto == IPPROTO_UDP ||
+	 *    a->proto == IPPROTO_ICMP
+	 *	return (1);
+	 */
+	switch (a->dst.addr.type) {
+	case PF_ADDR_ADDRMASK:
+		if (memcmp(&a->dst.addr.v.a.addr, &b->dst.addr.v.a.addr,
+		    sizeof(a->dst.addr.v.a.addr)) ||
+		    memcmp(&a->dst.addr.v.a.mask, &b->dst.addr.v.a.mask,
+		    sizeof(a->dst.addr.v.a.mask)) ||
+		    (a->dst.addr.v.a.addr.addr32[0] == 0 &&
+		    a->dst.addr.v.a.addr.addr32[1] == 0 &&
+		    a->dst.addr.v.a.addr.addr32[2] == 0 &&
+		    a->dst.addr.v.a.addr.addr32[3] == 0))
+			return (1);
+		return (0);
+	case PF_ADDR_DYNIFTL:
+		if (strcmp(a->dst.addr.v.ifname, b->dst.addr.v.ifname) != 0 ||
+		    a->dst.addr.iflags != a->dst.addr.iflags ||
+		    memcmp(&a->dst.addr.v.a.mask, &b->dst.addr.v.a.mask,
+		    sizeof(a->dst.addr.v.a.mask)))
+			return (1);
+		return (0);
+	case PF_ADDR_NOROUTE:
+		return (0);
+	case PF_ADDR_TABLE:
+		return (strcmp(a->dst.addr.v.tblname, b->dst.addr.v.tblname));
+	}
+	return (1);
+}
+
+/* Compare two rules DST port field for skiplist construction */
+int
+skip_cmp_dst_port(struct pf_rule *a, struct pf_rule *b)
+{
+	/* XXX if (a->proto != b->proto && a->proto != 0 && b->proto != 0
+	 *    && (a->proto == IPPROTO_TCP || a->proto == IPPROTO_UDP ||
+	 *    a->proto == IPPROTO_ICMP
+	 *	return (1);
+	 */
+	if (a->dst.port_op == PF_OP_NONE || a->dst.port_op != b->dst.port_op ||
+	    a->dst.port[0] != b->dst.port[0] ||
+	    a->dst.port[1] != b->dst.port[1])
+		return (1);
+	return (0);
+}
+
+/* Compare two rules IFP field for skiplist construction */
+int
+skip_cmp_ifp(struct pf_rule *a, struct pf_rule *b)
+{
+	if (strcmp(a->ifname, b->ifname) || a->ifname[0] == '\0')
+		return (1);
+	return (a->ifnot != b->ifnot);
+}
+
+/* Compare two rules PROTO field for skiplist construction */
+int
+skip_cmp_proto(struct pf_rule *a, struct pf_rule *b)
+{
+	return (a->proto != b->proto || a->proto == 0);
+}
+
+/* Compare two rules SRC addr field for skiplist construction */
+int
+skip_cmp_src_addr(struct pf_rule *a, struct pf_rule *b)
+{
+	if (a->src.neg != b->src.neg ||
+	    a->src.addr.type != b->src.addr.type)
+		return (1);
+	/* XXX if (a->proto != b->proto && a->proto != 0 && b->proto != 0
+	 *    && (a->proto == IPPROTO_TCP || a->proto == IPPROTO_UDP ||
+	 *    a->proto == IPPROTO_ICMP
+	 *	return (1);
+	 */
+	switch (a->src.addr.type) {
+	case PF_ADDR_ADDRMASK:
+		if (memcmp(&a->src.addr.v.a.addr, &b->src.addr.v.a.addr,
+		    sizeof(a->src.addr.v.a.addr)) ||
+		    memcmp(&a->src.addr.v.a.mask, &b->src.addr.v.a.mask,
+		    sizeof(a->src.addr.v.a.mask)) ||
+		    (a->src.addr.v.a.addr.addr32[0] == 0 &&
+		    a->src.addr.v.a.addr.addr32[1] == 0 &&
+		    a->src.addr.v.a.addr.addr32[2] == 0 &&
+		    a->src.addr.v.a.addr.addr32[3] == 0))
+			return (1);
+		return (0);
+	case PF_ADDR_DYNIFTL:
+		if (strcmp(a->src.addr.v.ifname, b->src.addr.v.ifname) != 0 ||
+		    a->src.addr.iflags != a->src.addr.iflags ||
+		    memcmp(&a->src.addr.v.a.mask, &b->src.addr.v.a.mask,
+		    sizeof(a->src.addr.v.a.mask)))
+			return (1);
+		return (0);
+	case PF_ADDR_NOROUTE:
+		return (0);
+	case PF_ADDR_TABLE:
+		return (strcmp(a->src.addr.v.tblname, b->src.addr.v.tblname));
+	}
+	return (1);
+}
+
+/* Compare two rules SRC port field for skiplist construction */
+int
+skip_cmp_src_port(struct pf_rule *a, struct pf_rule *b)
+{
+	if (a->src.port_op == PF_OP_NONE || a->src.port_op != b->src.port_op ||
+	    a->src.port[0] != b->src.port[0] ||
+	    a->src.port[1] != b->src.port[1])
+		return (1);
+	/* XXX if (a->proto != b->proto && a->proto != 0 && b->proto != 0
+	 *    && (a->proto == IPPROTO_TCP || a->proto == IPPROTO_UDP ||
+	 *    a->proto == IPPROTO_ICMP
+	 *	return (1);
+	 */
+	return (0);
+}
+
+
+void
+skip_init(void)
+{
+	struct {
+		char *name;
+		int skipnum;
+		int (*func)(struct pf_rule *, struct pf_rule *);
+	} comps[] = PF_SKIP_COMPARITORS;
+	int skipnum, i;
+
+	for (skipnum = 0; skipnum < PF_SKIP_COUNT; skipnum++) {
+		for (i = 0; i < sizeof(comps)/sizeof(*comps); i++)
+			if (comps[i].skipnum == skipnum) {
+				skip_comparitors[skipnum] = comps[i].func;
+				skip_comparitors_names[skipnum] = comps[i].name;
+			}
+	}
+	for (skipnum = 0; skipnum < PF_SKIP_COUNT; skipnum++)
+		if (skip_comparitors[skipnum] == NULL)
+			errx(1, "Need to add skip step comparitor to pfctl?!");
+}
+
+/*
+ * Add a host/netmask to a table
+ */
+int
+add_opt_table(struct pfctl *pf, struct pf_opt_tbl **tbl, sa_family_t af,
+    struct pf_rule_addr *addr)
+{
+#ifdef OPT_DEBUG
+	char buf[128];
+#endif /* OPT_DEBUG */
+	static int tablenum = 0;
+	struct node_host node_host;
+
+	if (*tbl == NULL) {
+		if ((*tbl = calloc(1, sizeof(**tbl))) == NULL ||
+		    ((*tbl)->pt_buf = calloc(1, sizeof(*(*tbl)->pt_buf))) ==
+		    NULL)
+			err(1, "calloc");
+		(*tbl)->pt_buf->pfrb_type = PFRB_ADDRS;
+		SIMPLEQ_INIT(&(*tbl)->pt_nodes);
+
+		/* This is just a temporary table name */
+		snprintf((*tbl)->pt_name, sizeof((*tbl)->pt_name), "%s%d",
+		    PF_OPT_TABLE_PREFIX, tablenum++);
+		DEBUG("creating table <%s>", (*tbl)->pt_name);
+	}
+
+	memset(&node_host, 0, sizeof(node_host));
+	node_host.af = af;
+	node_host.addr = addr->addr;
+
+#ifdef OPT_DEBUG
+	DEBUG("<%s> adding %s/%d", (*tbl)->pt_name, inet_ntop(af,
+	    &node_host.addr.v.a.addr, buf, sizeof(buf)),
+	    unmask(&node_host.addr.v.a.mask, af));
+#endif /* OPT_DEBUG */
+
+	if (append_addr_host((*tbl)->pt_buf, &node_host, 0, 0)) {
+		warn("failed to add host");
+		return (1);
+	}
+	if (pf->opts & PF_OPT_VERBOSE) {
+		struct node_tinit *ti;
+
+		if ((ti = calloc(1, sizeof(*ti))) == NULL)
+			err(1, "malloc");
+		if ((ti->host = malloc(sizeof(*ti->host))) == NULL)
+			err(1, "malloc");
+		memcpy(ti->host, &node_host, sizeof(*ti->host));
+		SIMPLEQ_INSERT_TAIL(&(*tbl)->pt_nodes, ti, entries);
+	}
+
+	(*tbl)->pt_rulecount++;
+	if ((*tbl)->pt_rulecount == TABLE_THRESHOLD)
+		DEBUG("table <%s> now faster than skip steps", (*tbl)->pt_name);
+
+	return (0);
+}
+
+
+/*
+ * Do the dirty work of choosing an unused table name and creating it.
+ * (be careful with the table name, it might already be used in another anchor)
+ */
+int
+pf_opt_create_table(struct pfctl *pf, struct pf_opt_tbl *tbl)
+{
+	static int tablenum;
+	struct pfr_table *t;
+
+	if (table_buffer.pfrb_type == 0) {
+		/* Initialize the list of tables */
+		table_buffer.pfrb_type = PFRB_TABLES;
+		for (;;) {
+			pfr_buf_grow(&table_buffer, table_buffer.pfrb_size);
+			table_buffer.pfrb_size = table_buffer.pfrb_msize;
+			if (pfr_get_tables(NULL, table_buffer.pfrb_caddr,
+			    &table_buffer.pfrb_size, PFR_FLAG_ALLRSETS))
+				err(1, "pfr_get_tables");
+			if (table_buffer.pfrb_size <= table_buffer.pfrb_msize)
+				break;
+		}
+		table_identifier = arc4random();
+	}
+
+	/* XXX would be *really* nice to avoid duplicating identical tables */
+
+	/* Now we have to pick a table name that isn't used */
+again:
+	DEBUG("translating temporary table <%s> to <%s%x_%d>", tbl->pt_name,
+	    PF_OPT_TABLE_PREFIX, table_identifier, tablenum);
+	snprintf(tbl->pt_name, sizeof(tbl->pt_name), "%s%x_%d",
+	    PF_OPT_TABLE_PREFIX, table_identifier, tablenum);
+	PFRB_FOREACH(t, &table_buffer) {
+		if (strcasecmp(t->pfrt_name, tbl->pt_name) == 0) {
+			/* Collision.  Try again */
+			DEBUG("wow, table <%s> in use.  trying again",
+			    tbl->pt_name);
+			table_identifier = arc4random();
+			goto again;
+		}
+	}
+	tablenum++;
+
+
+	if (pfctl_define_table(tbl->pt_name, PFR_TFLAG_CONST, 1, pf->anchor,
+	    tbl->pt_buf, pf->tticket)) {
+		warn("failed to create table %s", tbl->pt_name);
+		return (1);
+	}
+	return (0);
+}
+
+/*
+ * Partition the flat ruleset into a list of distinct superblocks
+ */
+int
+construct_superblocks(struct pfctl *pf, struct pf_opt_queue *opt_queue,
+    struct superblocks *superblocks)
+{
+	struct superblock *block = NULL;
+	struct pf_opt_rule *por;
+	int i;
+
+	while (!TAILQ_EMPTY(opt_queue)) {
+		por = TAILQ_FIRST(opt_queue);
+		TAILQ_REMOVE(opt_queue, por, por_entry);
+		if (block == NULL || !superblock_inclusive(block, por)) {
+			if ((block = calloc(1, sizeof(*block))) == NULL) {
+				warn("calloc");
+				return (1);
+			}
+			TAILQ_INIT(&block->sb_rules);
+			for (i = 0; i < PF_SKIP_COUNT; i++)
+				TAILQ_INIT(&block->sb_skipsteps[i]);
+			TAILQ_INSERT_TAIL(superblocks, block, sb_entry);
+		}
+		TAILQ_INSERT_TAIL(&block->sb_rules, por, por_entry);
+	}
+
+	return (0);
+}
+
+
+/*
+ * Compare two rule addresses
+ */
+int
+addrs_equal(struct pf_rule_addr *a, struct pf_rule_addr *b)
+{
+	if (a->neg != b->neg)
+		return (0);
+	return (memcmp(&a->addr, &b->addr, sizeof(a->addr)) == 0);
+}
+
+
+/*
+ * The addresses are not equal, but can we combine them into one table?
+ */
+int
+addrs_combineable(struct pf_rule_addr *a, struct pf_rule_addr *b)
+{
+	if (a->addr.type != PF_ADDR_ADDRMASK ||
+	    b->addr.type != PF_ADDR_ADDRMASK)
+		return (0);
+	if (a->neg != b->neg || a->port_op != b->port_op ||
+	    a->port[0] != b->port[0] || a->port[1] != b->port[1])
+		return (0);
+	return (1);
+}
+
+
+/*
+ * Are we allowed to combine these two rules
+ */
+int
+rules_combineable(struct pf_rule *p1, struct pf_rule *p2)
+{
+	struct pf_rule a, b;
+
+	comparable_rule(&a, p1, COMBINED);
+	comparable_rule(&b, p2, COMBINED);
+	return (memcmp(&a, &b, sizeof(a)) == 0);
+}
+
+
+/*
+ * Can a rule be included inside a superblock
+ */
+int
+superblock_inclusive(struct superblock *block, struct pf_opt_rule *por)
+{
+	struct pf_rule a, b;
+	int i, j;
+
+	/* First check for hard breaks */
+	for (i = 0; i < sizeof(pf_rule_desc)/sizeof(*pf_rule_desc); i++) {
+		if (pf_rule_desc[i].prf_type == BARRIER) {
+			for (j = 0; j < pf_rule_desc[i].prf_size; j++)
+				if (((char *)&por->por_rule)[j +
+				    pf_rule_desc[i].prf_offset] != 0)
+					return (0);
+		}
+	}
+
+	/* 'anchor' heads and per-rule src-track are also hard breaks */
+	if (por->por_anchor[0] != '\0' ||
+	    (por->por_rule.rule_flag & PFRULE_RULESRCTRACK))
+		return (0);
+
+	comparable_rule(&a, &TAILQ_FIRST(&block->sb_rules)->por_rule, NOMERGE);
+	comparable_rule(&b, &por->por_rule, NOMERGE);
+	if (strcmp(TAILQ_FIRST(&block->sb_rules)->por_anchor,
+	    por->por_anchor) == 0 && memcmp(&a, &b, sizeof(a)) == 0)
+		return (1);
+
+#ifdef OPT_DEBUG
+	for (i = 0; i < sizeof(por->por_rule); i++) {
+		int closest = -1;
+		if (((u_int8_t *)&a)[i] != ((u_int8_t *)&b)[i]) {
+			for (j = 0; j < sizeof(pf_rule_desc) /
+			    sizeof(*pf_rule_desc); j++) {
+				if (i >= pf_rule_desc[j].prf_offset &&
+				    i < pf_rule_desc[j].prf_offset +
+				    pf_rule_desc[j].prf_size) {
+					DEBUG("superblock break @ %d due to %s",
+					    por->por_rule.nr,
+					    pf_rule_desc[j].prf_name);
+					return (0);
+				}
+				if (i > pf_rule_desc[j].prf_offset) {
+					if (closest == -1 ||
+					    i-pf_rule_desc[j].prf_offset <
+					    i-pf_rule_desc[closest].prf_offset)
+						closest = j;
+				}
+			}
+
+			if (closest >= 0)
+				DEBUG("superblock break @ %d on %s+%xh",
+				    por->por_rule.nr,
+				    pf_rule_desc[closest].prf_name,
+				    i - pf_rule_desc[closest].prf_offset -
+				    pf_rule_desc[closest].prf_size);
+			else
+				DEBUG("superblock break @ %d on field @ %d",
+				    por->por_rule.nr, i);
+			return (0);
+		}
+	}
+#endif /* OPT_DEBUG */
+
+	return (0);
+}
+
+
+/*
+ * Make a rule that can directly compared by memcmp()
+ */
+void
+comparable_rule(struct pf_rule *dst, const struct pf_rule *src, int type)
+{
+	int i;
+	/*
+	 * To simplify the comparison, we just zero out the fields that are
+	 * allowed to be different and then do a simple memcmp()
+	 */
+	memcpy(dst, src, sizeof(*dst));
+	for (i = 0; i < sizeof(pf_rule_desc)/sizeof(*pf_rule_desc); i++)
+		if (pf_rule_desc[i].prf_type >= type) {
+#ifdef OPT_DEBUG
+			assert(pf_rule_desc[i].prf_type != NEVER ||
+			    *(((char *)dst) + pf_rule_desc[i].prf_offset) == 0);
+#endif /* OPT_DEBUG */
+			memset(((char *)dst) + pf_rule_desc[i].prf_offset, 0,
+			    pf_rule_desc[i].prf_size);
+		}
+}
+
+
+/*
+ * Remove superset information from two rules so we can directly compare them
+ * with memcmp()
+ */
+void
+exclude_supersets(struct pf_rule *super, struct pf_rule *sub)
+{
+	if (super->ifname[0] == '\0')
+		memset(sub->ifname, 0, sizeof(sub->ifname));
+	if (super->direction == PF_INOUT)
+		sub->direction = PF_INOUT;
+	if ((super->proto == 0 || super->proto == sub->proto) &&
+	    super->flags == 0 && super->flagset == 0 && (sub->flags ||
+	    sub->flagset)) {
+		sub->flags = super->flags;
+		sub->flagset = super->flagset;
+	}
+	if (super->proto == 0)
+		sub->proto = 0;
+
+	if (super->src.port_op == 0) {
+		sub->src.port_op = 0;
+		sub->src.port[0] = 0;
+		sub->src.port[1] = 0;
+	}
+	if (super->dst.port_op == 0) {
+		sub->dst.port_op = 0;
+		sub->dst.port[0] = 0;
+		sub->dst.port[1] = 0;
+	}
+
+	if (super->src.addr.type == PF_ADDR_ADDRMASK && !super->src.neg &&
+	    !sub->src.neg && super->src.addr.v.a.mask.addr32[0] == 0 &&
+	    super->src.addr.v.a.mask.addr32[1] == 0 &&
+	    super->src.addr.v.a.mask.addr32[2] == 0 &&
+	    super->src.addr.v.a.mask.addr32[3] == 0)
+		memset(&sub->src.addr, 0, sizeof(sub->src.addr));
+	else if (super->src.addr.type == PF_ADDR_ADDRMASK &&
+	    sub->src.addr.type == PF_ADDR_ADDRMASK &&
+	    super->src.neg == sub->src.neg &&
+	    super->af == sub->af &&
+	    unmask(&super->src.addr.v.a.mask, super->af) <
+	    unmask(&sub->src.addr.v.a.mask, sub->af) &&
+	    super->src.addr.v.a.addr.addr32[0] ==
+	    (sub->src.addr.v.a.addr.addr32[0] &
+	    super->src.addr.v.a.mask.addr32[0]) &&
+	    super->src.addr.v.a.addr.addr32[1] ==
+	    (sub->src.addr.v.a.addr.addr32[1] &
+	    super->src.addr.v.a.mask.addr32[1]) &&
+	    super->src.addr.v.a.addr.addr32[2] ==
+	    (sub->src.addr.v.a.addr.addr32[2] &
+	    super->src.addr.v.a.mask.addr32[2]) &&
+	    super->src.addr.v.a.addr.addr32[3] ==
+	    (sub->src.addr.v.a.addr.addr32[3] &
+	    super->src.addr.v.a.mask.addr32[3])) {
+		/* sub->src.addr is a subset of super->src.addr/mask */
+		memcpy(&sub->src.addr, &super->src.addr, sizeof(sub->src.addr));
+	}
+
+	if (super->dst.addr.type == PF_ADDR_ADDRMASK && !super->dst.neg &&
+	    !sub->dst.neg && super->dst.addr.v.a.mask.addr32[0] == 0 &&
+	    super->dst.addr.v.a.mask.addr32[1] == 0 &&
+	    super->dst.addr.v.a.mask.addr32[2] == 0 &&
+	    super->dst.addr.v.a.mask.addr32[3] == 0)
+		memset(&sub->dst.addr, 0, sizeof(sub->dst.addr));
+	else if (super->dst.addr.type == PF_ADDR_ADDRMASK &&
+	    sub->dst.addr.type == PF_ADDR_ADDRMASK &&
+	    super->dst.neg == sub->dst.neg &&
+	    super->af == sub->af &&
+	    unmask(&super->dst.addr.v.a.mask, super->af) <
+	    unmask(&sub->dst.addr.v.a.mask, sub->af) &&
+	    super->dst.addr.v.a.addr.addr32[0] ==
+	    (sub->dst.addr.v.a.addr.addr32[0] &
+	    super->dst.addr.v.a.mask.addr32[0]) &&
+	    super->dst.addr.v.a.addr.addr32[1] ==
+	    (sub->dst.addr.v.a.addr.addr32[1] &
+	    super->dst.addr.v.a.mask.addr32[1]) &&
+	    super->dst.addr.v.a.addr.addr32[2] ==
+	    (sub->dst.addr.v.a.addr.addr32[2] &
+	    super->dst.addr.v.a.mask.addr32[2]) &&
+	    super->dst.addr.v.a.addr.addr32[3] ==
+	    (sub->dst.addr.v.a.addr.addr32[3] &
+	    super->dst.addr.v.a.mask.addr32[3])) {
+		/* sub->dst.addr is a subset of super->dst.addr/mask */
+		memcpy(&sub->dst.addr, &super->dst.addr, sizeof(sub->dst.addr));
+	}
+
+	if (super->af == 0)
+		sub->af = 0;
+}
+
+
+void
+superblock_free(struct pfctl *pf, struct superblock *block)
+{
+	struct pf_opt_rule *por;
+	while ((por = TAILQ_FIRST(&block->sb_rules))) {
+		TAILQ_REMOVE(&block->sb_rules, por, por_entry);
+		if (por->por_src_tbl) {
+			if (por->por_src_tbl->pt_buf) {
+				pfr_buf_clear(por->por_src_tbl->pt_buf);
+				free(por->por_src_tbl->pt_buf);
+			}
+			free(por->por_src_tbl);
+		}
+		if (por->por_dst_tbl) {
+			if (por->por_dst_tbl->pt_buf) {
+				pfr_buf_clear(por->por_dst_tbl->pt_buf);
+				free(por->por_dst_tbl->pt_buf);
+			}
+			free(por->por_dst_tbl);
+		}
+		free(por);
+	}
+	if (block->sb_profiled_block)
+		superblock_free(pf, block->sb_profiled_block);
+	free(block);
+}
+
diff --git a/contrib/pf/pfctl/pfctl_osfp.c b/contrib/pf/pfctl/pfctl_osfp.c
index 6d1fb99..23e3ccc 100644
--- a/contrib/pf/pfctl/pfctl_osfp.c
+++ b/contrib/pf/pfctl/pfctl_osfp.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pfctl_osfp.c,v 1.8 2004/02/27 10:42:00 henning Exp $ */
+/*	$OpenBSD: pfctl_osfp.c,v 1.12 2005/02/17 13:18:00 aaron Exp $ */
 
 /*
  * Copyright (c) 2003 Mike Frantzen <frantzen@openbsd.org>
@@ -97,8 +97,8 @@ pfctl_file_fingerprints(int dev, int opts, const char *fp_filename)
 
 	pfctl_flush_my_fingerprints(&classes);
 
-	if ((in = fopen(fp_filename, "r")) == NULL) {
-		warn("fopen(%s)", fp_filename);
+	if ((in = pfctl_fopen(fp_filename, "r")) == NULL) {
+		warn("%s", fp_filename);
 		return (1);
 	}
 	class = version = subtype = desc = tcpopts = NULL;
@@ -276,9 +276,9 @@ pfctl_flush_my_fingerprints(struct name_list *list)
 	while ((nm = LIST_FIRST(list)) != NULL) {
 		LIST_REMOVE(nm, nm_entry);
 		pfctl_flush_my_fingerprints(&nm->nm_sublist);
-		fingerprint_count--;
 		free(nm);
 	}
+	fingerprint_count = 0;
 	class_count = 0;
 }
 
@@ -348,7 +348,7 @@ pfctl_get_fingerprint(const char *name)
 
 		if ((wr_name = strdup(name)) == NULL)
 			err(1, "malloc");
-		if ((ptr = index(wr_name, ' ')) == NULL) {
+		if ((ptr = strchr(wr_name, ' ')) == NULL) {
 			free(wr_name);
 			return (PF_OSFP_NOMATCH);
 		}
@@ -508,9 +508,9 @@ found:
 		strlcat(buf, " ", len);
 		strlcat(buf, version_name, len);
 		if (subtype_name) {
-			if (index(version_name, ' '))
+			if (strchr(version_name, ' '))
 				strlcat(buf, " ", len);
-			else if (index(version_name, '.') &&
+			else if (strchr(version_name, '.') &&
 			    isdigit(*subtype_name))
 				strlcat(buf, ".", len);
 			else
@@ -702,9 +702,8 @@ fingerprint_name_entry(struct name_list *list, char *name)
 		nm_entry = calloc(1, sizeof(*nm_entry));
 		if (nm_entry == NULL)
 			err(1, "calloc");
-			LIST_INIT(&nm_entry->nm_sublist);
-			strlcpy(nm_entry->nm_name, name,
-			    sizeof(nm_entry->nm_name));
+		LIST_INIT(&nm_entry->nm_sublist);
+		strlcpy(nm_entry->nm_name, name, sizeof(nm_entry->nm_name));
 	}
 	LIST_INSERT_HEAD(list, nm_entry, nm_entry);
 	return (nm_entry);
diff --git a/contrib/pf/pfctl/pfctl_parser.c b/contrib/pf/pfctl/pfctl_parser.c
index 406c393..4d5ca0d 100644
--- a/contrib/pf/pfctl/pfctl_parser.c
+++ b/contrib/pf/pfctl/pfctl_parser.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pfctl_parser.c,v 1.194 2004/03/15 15:25:44 dhartmei Exp $ */
+/*	$OpenBSD: pfctl_parser.c,v 1.211 2004/12/07 10:33:41 dhartmei Exp $ */
 
 /*
  * Copyright (c) 2001 Daniel Hartmeier
@@ -34,6 +34,8 @@
 #include <sys/types.h>
 #include <sys/ioctl.h>
 #include <sys/socket.h>
+#include <sys/param.h>
+#include <sys/proc.h>
 #include <net/if.h>
 #include <netinet/in.h>
 #include <netinet/in_systm.h>
@@ -62,6 +64,7 @@ void		 print_ugid (u_int8_t, unsigned, unsigned, const char *, unsigned);
 void		 print_flags (u_int8_t);
 void		 print_fromto(struct pf_rule_addr *, pf_osfp_t,
 		    struct pf_rule_addr *, u_int8_t, u_int8_t, int);
+int		 ifa_skip_if(const char *filter, struct node_host *p);
 
 struct node_host	*host_if(const char *, int);
 struct node_host	*host_v4(const char *, int);
@@ -182,6 +185,7 @@ const struct pf_timeout pf_timeouts[] = {
 	{ "tcp.closing",	PFTM_TCP_CLOSING },
 	{ "tcp.finwait",	PFTM_TCP_FIN_WAIT },
 	{ "tcp.closed",		PFTM_TCP_CLOSED },
+	{ "tcp.tsdiff",		PFTM_TS_DIFF },
 	{ "udp.first",		PFTM_UDP_FIRST_PACKET },
 	{ "udp.single",		PFTM_UDP_SINGLE },
 	{ "udp.multiple",	PFTM_UDP_MULTIPLE },
@@ -362,13 +366,13 @@ print_fromto(struct pf_rule_addr *src, pf_osfp_t osfp, struct pf_rule_addr *dst,
 	    PF_AZERO(&src->addr.v.a.mask, AF_INET6) &&
 	    PF_AZERO(&dst->addr.v.a.addr, AF_INET6) &&
 	    PF_AZERO(&dst->addr.v.a.mask, AF_INET6) &&
-	    !src->not && !dst->not &&
+	    !src->neg && !dst->neg &&
 	    !src->port_op && !dst->port_op &&
 	    osfp == PF_OSFP_ANY)
 		printf(" all");
 	else {
 		printf(" from ");
-		if (src->not)
+		if (src->neg)
 			printf("! ");
 		print_addr(&src->addr, af, verbose);
 		if (src->port_op)
@@ -380,7 +384,7 @@ print_fromto(struct pf_rule_addr *src, pf_osfp_t osfp, struct pf_rule_addr *dst,
 			    sizeof(buf)));
 
 		printf(" to ");
-		if (dst->not)
+		if (dst->neg)
 			printf("! ");
 		print_addr(&dst->addr, af, verbose);
 		if (dst->port_op)
@@ -468,6 +472,7 @@ print_pool(struct pf_pool *pool, u_int16_t p1, u_int16_t p2,
 }
 
 const char	*pf_reasons[PFRES_MAX+1] = PFRES_NAMES;
+const char	*pf_lcounters[LCNT_MAX+1] = LCNT_NAMES;
 const char	*pf_fcounters[FCNT_MAX+1] = FCNT_NAMES;
 const char	*pf_scounters[FCNT_MAX+1] = FCNT_NAMES;
 
@@ -570,6 +575,18 @@ print_status(struct pf_status *s, int opts)
 		else
 			printf("%14s\n", "");
 	}
+	if (opts & PF_OPT_VERBOSE) {
+		printf("Limit Counters\n");
+		for (i = 0; i < LCNT_MAX; i++) {
+			printf("  %-25s %14lld ", pf_lcounters[i],
+				    s->lcounters[i]);
+			if (runtime > 0)
+				printf("%14.1f/s\n",
+				    (double)s->lcounters[i] / (double)runtime);
+			else
+				printf("%14s\n", "");
+		}
+	}
 }
 
 void
@@ -589,7 +606,9 @@ print_src_node(struct pf_src_node *sn, int opts)
 	printf(" -> ");
 	aw.v.a.addr = sn->raddr;
 	print_addr(&aw, sn->af, opts & PF_OPT_VERBOSE2);
-	printf(" (%d states)\n", sn->states);
+	printf(" ( states %u, connections %u, rate %u.%u/%us )\n", sn->states,
+	    sn->conn, sn->conn_rate.count / 1000,
+	    (sn->conn_rate.count % 1000) / 100, sn->conn_rate.seconds);
 	if (opts & PF_OPT_VERBOSE) {
 		sec = sn->creation % 60;
 		sn->creation /= 60;
@@ -624,21 +643,22 @@ print_src_node(struct pf_src_node *sn, int opts)
 }
 
 void
-print_rule(struct pf_rule *r, int verbose)
+print_rule(struct pf_rule *r, const char *anchor_call, int verbose)
 {
-	static const char *actiontypes[] = { "pass", "block", "scrub", "nat",
-	    "no nat", "binat", "no binat", "rdr", "no rdr" };
+	static const char *actiontypes[] = { "pass", "block", "scrub",
+	    "no scrub", "nat", "no nat", "binat", "no binat", "rdr", "no rdr" };
 	static const char *anchortypes[] = { "anchor", "anchor", "anchor",
-	    "nat-anchor", "nat-anchor", "binat-anchor", "binat-anchor",
-	    "rdr-anchor", "rdr-anchor" };
+	    "anchor", "nat-anchor", "nat-anchor", "binat-anchor",
+	    "binat-anchor", "rdr-anchor", "rdr-anchor" };
 	int	i, opts;
 
 	if (verbose)
 		printf("@%d ", r->nr);
 	if (r->action > PF_NORDR)
 		printf("action(%d)", r->action);
-	else if (r->anchorname[0])
-		printf("%s %s", anchortypes[r->action], r->anchorname);
+	else if (anchor_call[0])
+		printf("%s \"%s\"", anchortypes[r->action],
+		    anchor_call);
 	else {
 		printf("%s", actiontypes[r->action]);
 		if (r->natpass)
@@ -778,6 +798,21 @@ print_rule(struct pf_rule *r, int verbose)
 		printf(" modulate state");
 	else if (r->keep_state == PF_STATE_SYNPROXY)
 		printf(" synproxy state");
+	if (r->prob) {
+		char	buf[20];
+
+		snprintf(buf, sizeof(buf), "%f", r->prob*100.0/(UINT_MAX+1.0));
+		for (i = strlen(buf)-1; i > 0; i--) {
+			if (buf[i] == '0')
+				buf[i] = '\0';
+			else {
+				if (buf[i] == '.')
+					buf[i] = '\0';
+				break;
+			}
+		}
+		printf(" probability %s%%", buf);
+	}
 	opts = 0;
 	if (r->max_states || r->max_src_nodes || r->max_src_states)
 		opts = 1;
@@ -818,12 +853,35 @@ print_rule(struct pf_rule *r, int verbose)
 			printf("max-src-states %u", r->max_src_states);
 			opts = 0;
 		}
+		if (r->max_src_conn) {
+			if (!opts)
+				printf(", ");
+			printf("max-src-conn %u", r->max_src_conn);
+			opts = 0;
+		}
+		if (r->max_src_conn_rate.limit) {
+			if (!opts)
+				printf(", ");
+			printf("max-src-conn-rate %u/%u",
+			    r->max_src_conn_rate.limit,
+			    r->max_src_conn_rate.seconds);
+			opts = 0;
+		}
 		if (r->max_src_nodes) {
 			if (!opts)
 				printf(", ");
 			printf("max-src-nodes %u", r->max_src_nodes);
 			opts = 0;
 		}
+		if (r->overload_tblname[0]) {
+			if (!opts)
+				printf(", ");
+			printf("overload <%s>", r->overload_tblname);
+			if (r->flush)
+				printf(" flush");
+			if (r->flush & PF_FLUSH_GLOBAL)
+				printf(" global");
+		}
 		if (r->rule_flag & PFRULE_IFBOUND) {
 			if (!opts)
 				printf(", ");
@@ -838,11 +896,17 @@ print_rule(struct pf_rule *r, int verbose)
 		}
 		for (i = 0; i < PFTM_MAX; ++i)
 			if (r->timeout[i]) {
+				int j;
+
 				if (!opts)
 					printf(", ");
 				opts = 0;
-				printf("%s %u", pf_timeouts[i].name,
-				    r->timeout[i]);
+				for (j = 0; j < sizeof(pf_timeouts) /
+				    sizeof(pf_timeouts[0]); ++j)
+					if (pf_timeouts[j].timeout == i)
+						break;
+				printf("%s %u", j == PFTM_MAX ?  "inv.timeout" :
+				    pf_timeouts[j].name, r->timeout[i]);
 			}
 		printf(")");
 	}
@@ -882,7 +946,7 @@ print_rule(struct pf_rule *r, int verbose)
 			printf(" !");
 		printf(" tagged %s", r->match_tagname);
 	}
-	if (!r->anchorname[0] && (r->action == PF_NAT ||
+	if (!anchor_call[0] && (r->action == PF_NAT ||
 	    r->action == PF_BINAT || r->action == PF_RDR)) {
 		printf(" -> ");
 		print_pool(&r->rpool, r->rpool.proxy_port[0],
@@ -949,9 +1013,7 @@ set_ipmask(struct node_host *h, u_int8_t b)
 	int		 i, j = 0;
 
 	m = &h->addr.v.a.mask;
-
-	for (i = 0; i < 4; i++)
-		m->addr32[i] = 0;
+	memset(m, 0, sizeof(*m));
 
 	while (b >= 32) {
 		m->addr32[j++] = 0xffffffff;
@@ -1003,8 +1065,6 @@ ifa_load(void)
 {
 	struct ifaddrs		*ifap, *ifa;
 	struct node_host	*n = NULL, *h = NULL;
-	struct pfr_buffer	 b;
-	struct pfi_if		*p;
 
 	if (getifaddrs(&ifap) < 0)
 		err(1, "getifaddrs");
@@ -1080,43 +1140,6 @@ ifa_load(void)
 		}
 	}
 
-	/* add interface groups, including clonable and dynamic stuff */
-	bzero(&b, sizeof(b));
-	b.pfrb_type = PFRB_IFACES;
-	for (;;) {
-		if (pfr_buf_grow(&b, b.pfrb_size))
-			err(1, "ifa_load: pfr_buf_grow");
-		b.pfrb_size = b.pfrb_msize;
-		if (pfi_get_ifaces(NULL, b.pfrb_caddr, &b.pfrb_size,
-		    PFI_FLAG_GROUP))
-			err(1, "ifa_load: pfi_get_ifaces");
-		if (b.pfrb_size <= b.pfrb_msize)
-			break;
-	}
-	PFRB_FOREACH(p, &b) {
-		n = calloc(1, sizeof(struct node_host));
-		if (n == NULL)
-			err(1, "address: calloc");
-		n->af = AF_LINK;
-		n->ifa_flags = PF_IFA_FLAG_GROUP;
-		if (p->pfif_flags & PFI_IFLAG_DYNAMIC)
-			n->ifa_flags |= PF_IFA_FLAG_DYNAMIC;
-		if (p->pfif_flags & PFI_IFLAG_CLONABLE)
-			n->ifa_flags |= PF_IFA_FLAG_CLONABLE;
-		if (!strcmp(p->pfif_name, "lo"))
-			n->ifa_flags |= IFF_LOOPBACK;
-		if ((n->ifname = strdup(p->pfif_name)) == NULL)
-			err(1, "ifa_load: strdup");
-		n->next = NULL;
-		n->tail = n;
-		if (h == NULL)
-			h = n;
-		else {
-			h->tail->next = n;
-			h->tail = n;
-		}
-	}
-
 	iftab = h;
 	freeifaddrs(ifap);
 }
@@ -1125,12 +1148,7 @@ struct node_host *
 ifa_exists(const char *ifa_name, int group_ok)
 {
 	struct node_host	*n;
-	char			*p, buf[IFNAMSIZ];
-	int			 group;
 
-	group = !isdigit(ifa_name[strlen(ifa_name) - 1]);
-	if (group && !group_ok)
-		return (NULL);
 	if (iftab == NULL)
 		ifa_load();
 
@@ -1138,19 +1156,7 @@ ifa_exists(const char *ifa_name, int group_ok)
 		if (n->af == AF_LINK && !strncmp(n->ifname, ifa_name, IFNAMSIZ))
 			return (n);
 	}
-	if (!group) {
-		/* look for clonable and/or dynamic interface */
-		strlcpy(buf, ifa_name, sizeof(buf));
-		for (p = buf + strlen(buf) - 1; p > buf && isdigit(*p); p--)
-			*p = '\0';
-		for (n = iftab; n != NULL; n = n->next)
-			if (n->af == AF_LINK &&
-			    !strncmp(n->ifname, buf, IFNAMSIZ))
-				break;
-		if (n != NULL && n->ifa_flags &
-		    (PF_IFA_FLAG_DYNAMIC | PF_IFA_FLAG_CLONABLE))
-			return (n);	/* XXX */
-	}
+
 	return (NULL);
 }
 
@@ -1158,19 +1164,17 @@ struct node_host *
 ifa_lookup(const char *ifa_name, int flags)
 {
 	struct node_host	*p = NULL, *h = NULL, *n = NULL;
-	int			 return_all = 0, got4 = 0, got6 = 0;
+	int			 got4 = 0, got6 = 0;
 	const char		 *last_if = NULL;
 
 	if (!strncmp(ifa_name, "self", IFNAMSIZ))
-		return_all = 1;
+		ifa_name = NULL;
 
 	if (iftab == NULL)
 		ifa_load();
 
 	for (p = iftab; p; p = p->next) {
-		if (!((p->af == AF_INET || p->af == AF_INET6) &&
-		    (!strncmp(p->ifname, ifa_name, strlen(ifa_name)) ||
-		    return_all)))
+		if (ifa_skip_if(ifa_name, p))
 			continue;
 		if ((flags & PFI_AFLAG_BROADCAST) && p->af != AF_INET)
 			continue;
@@ -1234,6 +1238,28 @@ ifa_lookup(const char *ifa_name, int flags)
 	return (h);
 }
 
+int
+ifa_skip_if(const char *filter, struct node_host *p)
+{
+	int	n;
+
+	if (p->af != AF_INET && p->af != AF_INET6)
+		return (1);
+	if (filter == NULL || !*filter)
+		return (0);
+	if (!strcmp(p->ifname, filter))
+		return (0);	/* exact match */
+	n = strlen(filter);
+	if (n < 1 || n >= IFNAMSIZ)
+		return (1);	/* sanity check */
+	if (filter[n-1] >= '0' && filter[n-1] <= '9')
+		return (1);	/* only do exact match in that case */
+	if (strncmp(p->ifname, filter, n))
+		return (1);	/* prefix doesn't match */
+	return (p->ifname[n] < '0' || p->ifname[n] > '9');
+}
+
+
 struct node_host *
 host(const char *s)
 {
@@ -1244,7 +1270,7 @@ host(const char *s)
 	if ((p = strrchr(s, '/')) != NULL) {
 		mask = strtol(p+1, &q, 0);
 		if (!q || *q || mask > 128 || q == (p+1)) {
-			fprintf(stderr, "invalid netmask\n");
+			fprintf(stderr, "invalid netmask '%s'\n", p);
 			return (NULL);
 		}
 		if ((ps = malloc(strlen(s) - strlen(p) + 1)) == NULL)
@@ -1398,7 +1424,7 @@ host_dns(const char *s, int v4mask, int v6mask)
 	char			*p, *ps;
 
 	if ((ps = strdup(s)) == NULL)
-		err(1, "host_if: strdup");
+		err(1, "host_dns: strdup");
 	if ((p = strrchr(ps, ':')) != NULL && !strcmp(p, ":0")) {
 		noalias = 1;
 		*p = '\0';
@@ -1407,8 +1433,10 @@ host_dns(const char *s, int v4mask, int v6mask)
 	hints.ai_family = PF_UNSPEC;
 	hints.ai_socktype = SOCK_STREAM; /* DUMMY */
 	error = getaddrinfo(ps, NULL, &hints, &res0);
-	if (error)
+	if (error) {
+		free(ps);
 		return (h);
+	}
 
 	for (res = res0; res; res = res->ai_next) {
 		if (res->ai_family != AF_INET &&
@@ -1532,33 +1560,28 @@ append_addr_host(struct pfr_buffer *b, struct node_host *n, int test, int not)
 }
 
 int
-pfctl_add_trans(struct pfr_buffer *buf, int rs_num, const char *anchor,
-    const char *ruleset)
+pfctl_add_trans(struct pfr_buffer *buf, int rs_num, const char *anchor)
 {
 	struct pfioc_trans_e trans;
 
 	bzero(&trans, sizeof(trans));
 	trans.rs_num = rs_num;
 	if (strlcpy(trans.anchor, anchor,
-	    sizeof(trans.anchor)) >= sizeof(trans.anchor) ||
-	    strlcpy(trans.ruleset, ruleset,
-	    sizeof(trans.ruleset)) >= sizeof(trans.ruleset))
+	    sizeof(trans.anchor)) >= sizeof(trans.anchor))
 		errx(1, "pfctl_add_trans: strlcpy");
 
 	return pfr_buf_add(buf, &trans);
 }
 
 u_int32_t
-pfctl_get_ticket(struct pfr_buffer *buf, int rs_num, const char *anchor,
-    const char *ruleset)
+pfctl_get_ticket(struct pfr_buffer *buf, int rs_num, const char *anchor)
 {
 	struct pfioc_trans_e *p;
 
 	PFRB_FOREACH(p, buf)
-		if (rs_num == p->rs_num && !strcmp(anchor, p->anchor) &&
-		    !strcmp(ruleset, p->ruleset))
+		if (rs_num == p->rs_num && !strcmp(anchor, p->anchor))
 			return (p->ticket);
-	errx(1, "pfr_get_ticket: assertion failed");
+	errx(1, "pfctl_get_ticket: assertion failed");
 }
 
 int
diff --git a/contrib/pf/pfctl/pfctl_parser.h b/contrib/pf/pfctl/pfctl_parser.h
index 125201f..5f32942 100644
--- a/contrib/pf/pfctl/pfctl_parser.h
+++ b/contrib/pf/pfctl/pfctl_parser.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pfctl_parser.h,v 1.74 2004/02/10 22:26:56 dhartmei Exp $ */
+/*	$OpenBSD: pfctl_parser.h,v 1.80 2005/02/07 18:18:14 david Exp $ */
 
 /*
  * Copyright (c) 2001 Daniel Hartmeier
@@ -46,6 +46,9 @@
 #define PF_OPT_DUMMYACTION	0x0100
 #define PF_OPT_DEBUG		0x0200
 #define PF_OPT_SHOWALL		0x0400
+#define PF_OPT_OPTIMIZE		0x0800
+#define PF_OPT_OPTIMIZE_PROFILE	0x1000
+#define PF_OPT_MERGE		0x2000
 
 #define PF_TH_ALL		0xFF
 
@@ -59,6 +62,11 @@
 	NULL \
 }
 
+struct pfr_buffer;	/* forward definition */
+struct pf_opt_rule;
+TAILQ_HEAD(pf_opt_queue, pf_opt_rule);
+
+
 struct pfctl {
 	int dev;
 	int opts;
@@ -72,11 +80,26 @@ struct pfctl {
 	struct pfr_buffer *trans;
 	const char *anchor;
 	const char *ruleset;
+	struct pf_opt_queue opt_queue;
+
+	/* 'set foo' options */
+	u_int32_t	 timeout[PFTM_MAX];
+	u_int32_t	 limit[PF_LIMIT_MAX];
+	u_int32_t	 debug;
+	u_int32_t	 hostid;
+	char		*ifname;
+
+	u_int8_t	 timeout_set[PFTM_MAX];
+	u_int8_t	 limit_set[PF_LIMIT_MAX];
+	u_int8_t	 debug_set;
+	u_int8_t	 hostid_set;
+	u_int8_t	 ifname_set;
 };
 
 struct node_if {
 	char			 ifname[IFNAMSIZ];
 	u_int8_t		 not;
+	u_int8_t		 dynamic; /* antispoof */
 	u_int			 ifa_flags;
 	struct node_if		*next;
 	struct node_if		*tail;
@@ -141,11 +164,33 @@ struct node_tinit {	/* table initializer */
 	char				*file;
 };
 
-struct pfr_buffer;	/* forward definition */
 
-int	pfctl_rules(int, char *, int, char *, char *, struct pfr_buffer *);
+/* optimizer created tables */
+struct pf_opt_tbl {
+	char			 pt_name[PF_TABLE_NAME_SIZE];
+	int			 pt_rulecount;
+	int			 pt_generated;
+	struct node_tinithead	 pt_nodes;
+	struct pfr_buffer	*pt_buf;
+};
+#define PF_OPT_TABLE_PREFIX	"__automatic_"
+
+/* optimizer pf_rule container */
+struct pf_opt_rule {
+	struct pf_rule		 por_rule;
+	struct pf_opt_tbl	*por_src_tbl;
+	struct pf_opt_tbl	*por_dst_tbl;
+	char			 por_anchor[MAXPATHLEN];
+	u_int64_t		 por_profile_count;
+	TAILQ_ENTRY(pf_opt_rule) por_entry;
+	TAILQ_ENTRY(pf_opt_rule) por_skip_entry[PF_SKIP_COUNT];
+};
+
+
+int	pfctl_rules(int, char *, int, char *, struct pfr_buffer *);
+int	pfctl_optimize_rules(struct pfctl *);
 
-int	pfctl_add_rule(struct pfctl *, struct pf_rule *);
+int	pfctl_add_rule(struct pfctl *, struct pf_rule *, const char *);
 int	pfctl_add_altq(struct pfctl *, struct pf_altq *);
 int	pfctl_add_pool(struct pfctl *, struct pf_pool *, sa_family_t);
 void	pfctl_clear_pool(struct pf_pool *);
@@ -156,6 +201,7 @@ int	pfctl_set_limit(struct pfctl *, const char *, unsigned int);
 int	pfctl_set_logif(struct pfctl *, char *);
 int	pfctl_set_hostid(struct pfctl *, u_int32_t);
 int	pfctl_set_debug(struct pfctl *, char *);
+int	pfctl_set_interface_flags(struct pfctl *, char *, int, int);
 
 int	parse_rules(FILE *, struct pfctl *);
 int	parse_flags(char *);
@@ -163,7 +209,7 @@ int	pfctl_load_anchors(int, int, struct pfr_buffer *);
 
 void	print_pool(struct pf_pool *, u_int16_t, u_int16_t, sa_family_t, int);
 void	print_src_node(struct pf_src_node *, int);
-void	print_rule(struct pf_rule *, int);
+void	print_rule(struct pf_rule *, const char *, int);
 void	print_tabledef(const char *, int, int, struct node_tinithead *);
 void	print_status(struct pf_status *, int);
 
@@ -177,8 +223,8 @@ void	 print_altq(const struct pf_altq *, unsigned, struct node_queue_bw *,
 void	 print_queue(const struct pf_altq *, unsigned, struct node_queue_bw *,
 	    int, struct node_queue_opt *);
 
-int	pfctl_define_table(char *, int, int, const char *, const char *,
-	    struct pfr_buffer *, u_int32_t);
+int	pfctl_define_table(char *, int, int, const char *, struct pfr_buffer *,
+	    u_int32_t);
 
 void		 pfctl_clear_fingerprints(int, int);
 int		 pfctl_file_fingerprints(int, int, const char *);
@@ -219,6 +265,7 @@ extern const struct pf_timeout pf_timeouts[];
 
 void			 set_ipmask(struct node_host *, u_int8_t);
 int			 check_netmask(struct node_host *, sa_family_t);
+int			 unmask(struct pf_addr *, sa_family_t);
 void			 ifa_load(void);
 struct node_host	*ifa_exists(const char *, int);
 struct node_host	*ifa_lookup(const char *, int);
diff --git a/contrib/pf/pfctl/pfctl_qstats.c b/contrib/pf/pfctl/pfctl_qstats.c
index 19ca600..1731ce9 100644
--- a/contrib/pf/pfctl/pfctl_qstats.c
+++ b/contrib/pf/pfctl/pfctl_qstats.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pfctl_qstats.c,v 1.29 2004/03/15 15:25:44 dhartmei Exp $ */
+/*	$OpenBSD: pfctl_qstats.c,v 1.30 2004/04/27 21:47:32 kjc Exp $ */
 
 /*
  * Copyright (c) Henning Brauer <henning@openbsd.org>
@@ -90,6 +90,8 @@ pfctl_show_altq(int dev, const char *iface, int opts, int verbose2)
 	if ((nodes = pfctl_update_qstats(dev, &root)) < 0)
 		return (-1);
 
+	if (nodes == 0)
+		printf("No queue in use\n");
 	for (node = root; node != NULL; node = node->next) {
 		if (iface != NULL && strcmp(node->altq.ifname, iface))
 			continue;
@@ -100,11 +102,11 @@ pfctl_show_altq(int dev, const char *iface, int opts, int verbose2)
 		pfctl_print_altq_node(dev, node, 0, opts);
 	}
 
-	while (verbose2) {
+	while (verbose2 && nodes > 0) {
 		printf("\n");
 		fflush(stdout);
 		sleep(STAT_INTERVAL);
-		if (pfctl_update_qstats(dev, &root) == -1)
+		if ((nodes = pfctl_update_qstats(dev, &root)) == -1)
 			return (-1);
 		for (node = root; node != NULL; node = node->next) {
 			if (iface != NULL && strcmp(node->altq.ifname, iface))
diff --git a/contrib/pf/pfctl/pfctl_radix.c b/contrib/pf/pfctl/pfctl_radix.c
index 04fb487..ba004b8 100644
--- a/contrib/pf/pfctl/pfctl_radix.c
+++ b/contrib/pf/pfctl/pfctl_radix.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pfctl_radix.c,v 1.24 2004/02/10 18:29:30 henning Exp $ */
+/*	$OpenBSD: pfctl_radix.c,v 1.26 2004/06/14 20:44:22 cedric Exp $ */
 
 /*
  * Copyright (c) 2002 Cedric Berger
@@ -393,44 +393,6 @@ pfr_tst_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
 }
 
 int
-pfr_ina_begin(struct pfr_table *trs, int *ticket, int *ndel, int flags)
-{
-	struct pfioc_table io;
-
-	bzero(&io, sizeof io);
-	if (trs != NULL)
-		io.pfrio_table = *trs;
-	io.pfrio_flags = flags;
-	if (ioctl(dev, DIOCRINABEGIN, &io))
-		return (-1);
-	if (ndel != NULL)
-		*ndel = io.pfrio_ndel;
-	if (ticket != NULL)
-		*ticket = io.pfrio_ticket;
-	return (0);
-}
-
-int
-pfr_ina_commit(struct pfr_table *trs, int ticket, int *nadd, int *nchange,
-    int flags)
-{
-	struct pfioc_table io;
-
-	bzero(&io, sizeof io);
-	if (trs != NULL)
-		io.pfrio_table = *trs;
-	io.pfrio_flags = flags;
-	io.pfrio_ticket = ticket;
-	if (ioctl(dev, DIOCRINACOMMIT, &io))
-		return (-1);
-	if (nadd != NULL)
-		*nadd = io.pfrio_nadd;
-	if (nchange != NULL)
-		*nchange = io.pfrio_nchange;
-	return (0);
-}
-
-int
 pfr_ina_define(struct pfr_table *tbl, struct pfr_addr *addr, int size,
     int *nadd, int *naddr, int ticket, int flags)
 {
@@ -605,7 +567,7 @@ pfr_buf_load(struct pfr_buffer *b, char *file, int nonetwork,
 	if (!strcmp(file, "-"))
 		fp = stdin;
 	else {
-		fp = fopen(file, "r");
+		fp = pfctl_fopen(file, "r");
 		if (fp == NULL)
 			return (-1);
 	}
diff --git a/contrib/pf/pfctl/pfctl_table.c b/contrib/pf/pfctl/pfctl_table.c
index 7ad55df..9c7ba5b 100644
--- a/contrib/pf/pfctl/pfctl_table.c
+++ b/contrib/pf/pfctl/pfctl_table.c
@@ -1,5 +1,4 @@
-/*	$OpenBSD: pfctl_table.c,v 1.59 2004/03/15 15:25:44 dhartmei Exp $ */
-/* add	$OpenBSD: pfctl_table.c,v 1.61 2004/06/12 22:22:44 cedric Exp $ */
+/*	$OpenBSD: pfctl_table.c,v 1.62 2004/12/22 17:17:55 dhartmei Exp $ */
 
 /*
  * Copyright (c) 2002 Cedric Berger
@@ -54,7 +53,7 @@
 
 extern void	usage(void);
 static int	pfctl_table(int, char *[], char *, const char *, char *,
-		    const char *, const char *, int);
+		    const char *, int);
 static void	print_table(struct pfr_table *, int, int);
 static void	print_tstats(struct pfr_tstats *, int);
 static int	load_addr(struct pfr_buffer *, int, char *[], char *, int);
@@ -103,31 +102,29 @@ static const char	*istats_text[2][2][2] = {
 	} while(0)
 
 int
-pfctl_clear_tables(const char *anchor, const char *ruleset, int opts)
+pfctl_clear_tables(const char *anchor, int opts)
 {
-	return pfctl_table(0, NULL, NULL, "-F", NULL, anchor, ruleset, opts);
+	return pfctl_table(0, NULL, NULL, "-F", NULL, anchor, opts);
 }
 
 int
-pfctl_show_tables(const char *anchor, const char *ruleset, int opts)
+pfctl_show_tables(const char *anchor, int opts)
 {
-	return pfctl_table(0, NULL, NULL, "-s", NULL, anchor, ruleset, opts);
+	return pfctl_table(0, NULL, NULL, "-s", NULL, anchor, opts);
 }
 
 int
 pfctl_command_tables(int argc, char *argv[], char *tname,
-    const char *command, char *file, const char *anchor, const char *ruleset,
-    int opts)
+    const char *command, char *file, const char *anchor, int opts)
 {
 	if (tname == NULL || command == NULL)
 		usage();
-	return pfctl_table(argc, argv, tname, command, file, anchor, ruleset,
-	    opts);
+	return pfctl_table(argc, argv, tname, command, file, anchor, opts);
 }
 
 int
 pfctl_table(int argc, char *argv[], char *tname, const char *command,
-    char *file, const char *anchor, const char *ruleset, int opts)
+    char *file, const char *anchor, int opts)
 {
 	struct pfr_table	 table;
 	struct pfr_buffer	 b, b2;
@@ -152,9 +149,7 @@ pfctl_table(int argc, char *argv[], char *tname, const char *command,
 			errx(1, "pfctl_table: strlcpy");
 	}
 	if (strlcpy(table.pfrt_anchor, anchor,
-	    sizeof(table.pfrt_anchor)) >= sizeof(table.pfrt_anchor) ||
-	    strlcpy(table.pfrt_ruleset, ruleset,
-	    sizeof(table.pfrt_ruleset)) >= sizeof(table.pfrt_ruleset))
+	    sizeof(table.pfrt_anchor)) >= sizeof(table.pfrt_anchor))
 		errx(1, "pfctl_table: strlcpy");
 
 	if (!strcmp(command, "-F")) {
@@ -344,8 +339,6 @@ print_table(struct pfr_table *ta, int verbose, int debug)
 		    ta->pfrt_name);
 		if (ta->pfrt_anchor[0])
 			printf("\t%s", ta->pfrt_anchor);
-		if (ta->pfrt_ruleset[0])
-			printf(":%s", ta->pfrt_ruleset);
 		puts("");
 	} else
 		puts(ta->pfrt_name);
@@ -463,16 +456,14 @@ radix_perror(void)
 
 int
 pfctl_define_table(char *name, int flags, int addrs, const char *anchor,
-    const char *ruleset, struct pfr_buffer *ab, u_int32_t ticket)
+    struct pfr_buffer *ab, u_int32_t ticket)
 {
 	struct pfr_table tbl;
 
 	bzero(&tbl, sizeof(tbl));
 	if (strlcpy(tbl.pfrt_name, name, sizeof(tbl.pfrt_name)) >=
 	    sizeof(tbl.pfrt_name) || strlcpy(tbl.pfrt_anchor, anchor,
-	    sizeof(tbl.pfrt_anchor)) >= sizeof(tbl.pfrt_anchor) ||
-	    strlcpy(tbl.pfrt_ruleset, ruleset, sizeof(tbl.pfrt_ruleset)) >=
-	    sizeof(tbl.pfrt_ruleset))
+	    sizeof(tbl.pfrt_anchor)) >= sizeof(tbl.pfrt_anchor))
 		errx(1, "pfctl_define_table: strlcpy");
 	tbl.pfrt_flags = flags;
 
@@ -586,7 +577,8 @@ print_iface(struct pfi_if *p, int opts)
 	oprintf(flags, PFI_IFLAG_GROUP, "group", &first, 0);
 	oprintf(flags, PFI_IFLAG_CLONABLE, "clonable", &first, 0);
 	oprintf(flags, PFI_IFLAG_DYNAMIC, "dynamic", &first, 0);
-	oprintf(flags, PFI_IFLAG_ATTACHED, "attached", &first, 1);
+	oprintf(flags, PFI_IFLAG_ATTACHED, "attached", &first, 0);
+	oprintf(flags, PFI_IFLAG_SKIP, "skipped", &first, 1);
 	printf("\n");
 
 	if (!(opts & PF_OPT_VERBOSE2))