Not in this commit: Many spammed deltas have been removed to restore

back to the vendor branch.

Re-merge changes from the vendor branch.

Undo the local spammed changes that I could find.  There are probably
more local fixes that were clobbered that I've missed.

11 files changed, 476 insertions, 157 deletions

diff --git a/contrib/ipfilter/ipmon.c b/contrib/ipfilter/ipmon.c
index aed6a82..6145d9d 100644
--- a/contrib/ipfilter/ipmon.c
+++ b/contrib/ipfilter/ipmon.c
@@ -1,43 +1,52 @@
+/* $FreeBSD$ */
 /*
- * Copyright (C) 1993-1997 by Darren Reed.
+ * Copyright (C) 1993-1998 by Darren Reed.
  *
  * Redistribution and use in source and binary forms are permitted
  * provided that this notice is preserved and due credit is given
  * to the original author and the contributors.
  */
 #if !defined(lint)
-static const char sccsid[] = "@(#)ipmon.c	1.21 6/5/96 (C)1993-1997 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ipmon.c,v 2.0.2.29.2.9 1998/05/23 14:29:45 darrenr Exp $";
+static const char sccsid[] = "@(#)ipmon.c	1.21 6/5/96 (C)1993-1998 Darren Reed";
+static const char rcsid[] = "@(#)$Id: ipmon.c,v 2.3.2.4 2000/01/24 12:45:25 darrenr Exp $";
 #endif
 
+#ifndef SOLARIS
+#define SOLARIS (defined(__SVR4) || defined(__svr4__)) && defined(sun)
+#endif
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <sys/param.h>
+#include <sys/file.h>
+#include <sys/time.h>
+#include <sys/socket.h>
+#include <sys/ioctl.h>
+
 #include <stdio.h>
 #include <unistd.h>
 #include <string.h>
 #include <fcntl.h>
 #include <errno.h>
-#include <sys/types.h>
-#ifndef __FreeBSD__
 #if !defined(__SVR4) && !defined(__svr4__)
-#include <strings.h>
-#include <signal.h>
-#include <sys/dir.h>
+# if (__FreeBSD_version >= 300000)
+#  include <sys/dirent.h>
+# else
+#  include <sys/dir.h>
+# endif
 #else
-#include <sys/filio.h>
-#include <sys/byteorder.h>
+# include <sys/filio.h>
+# include <sys/byteorder.h>
 #endif
-#endif
-#include <sys/stat.h>
-#include <sys/param.h>
-#include <sys/file.h>
-#include <sys/time.h>
+#include <strings.h>
+#include <signal.h>
 #include <stdlib.h>
 #include <stddef.h>
-#include <sys/socket.h>
-#include <sys/ioctl.h>
 #include <netinet/in.h>
 #include <netinet/in_systm.h>
 #include <net/if.h>
 #include <netinet/ip.h>
+#include <netinet/tcp_fsm.h>
 #include <netdb.h>
 #include <arpa/inet.h>
 #include <arpa/nameser.h>
@@ -46,7 +55,6 @@ static const char rcsid[] = "@(#)$Id: ipmon.c,v 2.0.2.29.2.9 1998/05/23 14:29:45
 #include <sys/uio.h>
 #ifndef linux
 # include <sys/protosw.h>
-# include <sys/user.h>
 # include <netinet/ip_var.h>
 #endif
 
@@ -87,6 +95,15 @@ struct	flags	tcpfl[] = {
 	{ 0, '\0' }
 };
 
+#if SOLARIS
+static	char	*pidfile = "/etc/opt/ipf/ipmon.pid";
+#else
+# if BSD >= 199306
+static	char	*pidfile = "/var/run/ipmon.pid";
+# else
+static	char	*pidfile = "/etc/ipmon.pid";
+# endif
+#endif
 
 static	char	line[2048];
 static	int	opts = 0;
@@ -101,12 +118,20 @@ static	void	print_ipflog __P((FILE *, char *, int));
 static	void	print_natlog __P((FILE *, char *, int));
 static	void	print_statelog __P((FILE *, char *, int));
 static	void	dumphex __P((FILE *, u_char *, int));
-static	int	read_log __P((int, int *, char *, int, FILE *));
+static	int	read_log __P((int, int *, char *, int));
+static	void	write_pid __P((char *));
+
 char	*hostname __P((int, struct in_addr));
-char	*portname __P((int, char *, u_short));
+char	*portname __P((int, char *, u_int));
 int	main __P((int, char *[]));
 
 static	void	logopts __P((int, char *));
+static	void	init_tabs __P((void));
+static	char	*getproto __P((u_int));
+
+static	char	**protocols = NULL;
+static	char	**udp_ports = NULL;
+static	char	**tcp_ports = NULL;
 
 
 #define	OPT_SYSLOG	0x001
@@ -119,14 +144,14 @@ static	void	logopts __P((int, char *));
 #define	OPT_STATE	0x100
 #define	OPT_FILTER	0x200
 #define	OPT_PORTNUM	0x400
-#define	OPT_ALL		(OPT_NAT|OPT_STATE|OPT_FILTER)
+#define	OPT_LOGALL	(OPT_NAT|OPT_STATE|OPT_FILTER)
 
 #ifndef	LOGFAC
 #define	LOGFAC	LOG_LOCAL0
 #endif
 
 
-static void handlehup(sig)
+void handlehup(sig)
 int sig;
 {
 	FILE	*fp;
@@ -134,14 +159,91 @@ int sig;
 	signal(SIGHUP, handlehup);
 	if (logfile && (fp = fopen(logfile, "a")))
 		newlog = fp;
+	init_tabs();
 	donehup = 1;
 }
 
 
-static int read_log(fd, lenp, buf, bufsize, log)
+static void init_tabs()
+{
+	struct	protoent	*p;
+	struct	servent	*s;
+	char	*name, **tab;
+	u_int	port;
+
+	if (protocols != NULL) {
+		free(protocols);
+		protocols = NULL;
+	}
+	protocols = (char **)malloc(256 * sizeof(*protocols));
+	if (protocols != NULL) {
+		bzero((char *)protocols, 256 * sizeof(*protocols));
+
+		setprotoent(1);
+		while ((p = getprotoent()) != NULL)
+			if (p->p_proto >= 0 && p->p_proto <= 255 &&
+			    p->p_name != NULL)
+				protocols[p->p_proto] = strdup(p->p_name);
+		endprotoent();
+	}
+
+	if (udp_ports != NULL) {
+		free(udp_ports);
+		udp_ports = NULL;
+	}
+	udp_ports = (char **)malloc(65536 * sizeof(*udp_ports));
+	if (udp_ports != NULL)
+		bzero((char *)udp_ports, 65536 * sizeof(*udp_ports));
+
+	if (tcp_ports != NULL) {
+		free(tcp_ports);
+		tcp_ports = NULL;
+	}
+	tcp_ports = (char **)malloc(65536 * sizeof(*tcp_ports));
+	if (tcp_ports != NULL)
+		bzero((char *)tcp_ports, 65536 * sizeof(*tcp_ports));
+
+	setservent(1);
+	while ((s = getservent()) != NULL) {
+		if (s->s_proto == NULL)
+			continue;
+		else if (!strcmp(s->s_proto, "tcp")) {
+			port = (u_int)s->s_port;
+			name = s->s_name;
+			tab = tcp_ports;
+		} else if (!strcmp(s->s_proto, "udp")) {
+			port = (u_int)s->s_port;
+			name = s->s_name;
+			tab = udp_ports;
+		} else
+			continue;
+		if ((port < 0 || port > 65535) || (name == NULL))
+			continue;
+		tab[port] = strdup(name);
+	}
+	endservent();
+}
+
+
+static char *getproto(p)
+u_int p;
+{
+	static char pnum[4];
+	char *s;
+
+	p &= 0xff;
+	s = protocols ? protocols[p] : NULL;
+	if (s == NULL) {
+		sprintf(pnum, "%u", p);
+		s = pnum;
+	}
+	return s;
+}
+
+
+static int read_log(fd, lenp, buf, bufsize)
 int fd, bufsize, *lenp;
 char *buf;
-FILE *log;
 {
 	int	nr;
 
@@ -173,18 +275,24 @@ struct	in_addr	ip;
 char	*portname(res, proto, port)
 int	res;
 char	*proto;
-u_short	port;
+u_int	port;
 {
 	static	char	pname[8];
-	struct	servent	*serv;
+	char	*s;
 
-	(void) sprintf(pname, "%hu", htons(port));
+	port = ntohs(port);
+	port &= 0xffff;
+	(void) sprintf(pname, "%u", port);
 	if (!res || (opts & OPT_PORTNUM))
 		return pname;
-	serv = getservbyport((int)port, proto);
-	if (!serv)
-		return pname;
-	return serv->s_name;
+	s = NULL;
+	if (!strcmp(proto, "tcp"))
+		s = tcp_ports[port];
+	else if (!strcmp(proto, "udp"))
+		s = udp_ports[port];
+	if (s == NULL)
+		s = pname;
+	return s;
 }
 
 
@@ -254,6 +362,7 @@ int	blen;
 	char	*t = line;
 	struct	tm	*tm;
 	int	res, i, len;
+	char	*proto;
 
 	nl = (struct natlog *)((char *)ipl + sizeof(*ipl));
 	res = (opts & OPT_RESOLVE) ? 1 : 0;
@@ -274,20 +383,22 @@ int	blen;
 		strcpy(t, "NAT:MAP ");
 	else if (nl->nl_type == NL_NEWRDR)
 		strcpy(t, "NAT:RDR ");
-	else if (nl->nl_type == ISL_EXPIRE)
+	else if (nl->nl_type == NL_EXPIRE)
 		strcpy(t, "NAT:EXPIRE ");
 	else
 		sprintf(t, "Type: %d ", nl->nl_type);
 	t += strlen(t);
 
+	proto = getproto(nl->nl_p);
+
 	(void) sprintf(t, "%s,%s <- -> ", hostname(res, nl->nl_inip),
-		portname(res, NULL, nl->nl_inport));
+		portname(res, proto, (u_int)nl->nl_inport));
 	t += strlen(t);
 	(void) sprintf(t, "%s,%s ", hostname(res, nl->nl_outip),
-		portname(res, NULL, nl->nl_outport));
+		portname(res, proto, (u_int)nl->nl_outport));
 	t += strlen(t);
 	(void) sprintf(t, "[%s,%s]", hostname(res, nl->nl_origip),
-		portname(res, NULL, nl->nl_origport));
+		portname(res, proto, (u_int)nl->nl_origport));
 	t += strlen(t);
 	if (nl->nl_type == NL_EXPIRE) {
 #ifdef	USE_QUAD_T
@@ -315,8 +426,7 @@ int	blen;
 {
 	struct	ipslog *sl;
 	iplog_t	*ipl = (iplog_t *)buf;
-	struct	protoent *pr;
-	char	*t = line, *proto, pname[6];
+	char	*t = line, *proto;
 	struct	tm	*tm;
 	int	res, i, len;
 
@@ -337,27 +447,29 @@ int	blen;
 
 	if (sl->isl_type == ISL_NEW)
 		strcpy(t, "STATE:NEW ");
-	else if (sl->isl_type == ISL_EXPIRE)
-		strcpy(t, "STATE:EXPIRE ");
+	else if (sl->isl_type == ISL_EXPIRE) {
+		if ((sl->isl_p == IPPROTO_TCP) &&
+		    (sl->isl_state[0] > TCPS_ESTABLISHED ||
+		     sl->isl_state[1] > TCPS_ESTABLISHED))
+			strcpy(t, "STATE:CLOSE ");
+		else
+			strcpy(t, "STATE:EXPIRE ");
+	} else if (sl->isl_type == ISL_FLUSH)
+		strcpy(t, "STATE:FLUSH ");
 	else
 		sprintf(t, "Type: %d ", sl->isl_type);
 	t += strlen(t);
 
-	pr = getprotobynumber((int)sl->isl_p);
-	if (!pr) {
-		proto = pname;
-		sprintf(proto, "%d", (u_int)sl->isl_p);
-	} else
-		proto = pr->p_name;
+	proto = getproto(sl->isl_p);
 
 	if (sl->isl_p == IPPROTO_TCP || sl->isl_p == IPPROTO_UDP) {
 		(void) sprintf(t, "%s,%s -> ",
 			hostname(res, sl->isl_src),
-			portname(res, proto, sl->isl_sport));
+			portname(res, proto, (u_int)sl->isl_sport));
 		t += strlen(t);
 		(void) sprintf(t, "%s,%s PR %s",
 			hostname(res, sl->isl_dst),
-			portname(res, proto, sl->isl_dport), proto);
+			portname(res, proto, (u_int)sl->isl_dport), proto);
 	} else if (sl->isl_p == IPPROTO_ICMP) {
 		(void) sprintf(t, "%s -> ", hostname(res, sl->isl_src));
 		t += strlen(t);
@@ -439,11 +551,10 @@ FILE	*log;
 char	*buf;
 int	blen;
 {
-	struct	protoent *pr;
-	struct	tcphdr	*tp;
+	tcphdr_t	*tp;
 	struct	icmp	*ic;
 	struct	tm	*tm;
-	char	c[3], pname[8], *t, *proto;
+	char	*t, *proto;
 	u_short	hl, p;
 	int	i, lvl, res, len;
 	ip_t	*ipc, *ip;
@@ -483,60 +594,62 @@ int	blen;
 	(defined(OpenBSD) && (OpenBSD >= 199603))) || defined(linux)
 	len = (int)sizeof(ipf->fl_ifname);
 	(void) sprintf(t, "%*.*s", len, len, ipf->fl_ifname);
+	t += strlen(t);
+# if SOLARIS
+	if (isalpha(*(t - 1)))
+		*t++ = '0' + ipf->fl_unit;
+# endif
 #else
 	for (len = 0; len < 3; len++)
-		if (!ipf->fl_ifname[len])
+		if (ipf->fl_ifname[len] == '\0')
 			break;
 	if (ipf->fl_ifname[len])
 		len++;
 	(void) sprintf(t, "%*.*s%u", len, len, ipf->fl_ifname, ipf->fl_unit);
-#endif
 	t += strlen(t);
+#endif
 	(void) sprintf(t, " @%hu:%hu ", ipf->fl_group, ipf->fl_rule + 1);
-	pr = getprotobynumber((int)p);
-	if (!pr) {
-		proto = pname;
-		sprintf(proto, "%d", (u_int)p);
-	} else
-		proto = pr->p_name;
+	t += strlen(t);
+	proto = getproto(p);
 
  	if (ipf->fl_flags & FF_SHORT) {
-		c[0] = 'S';
+		*t++ = 'S';
 		lvl = LOG_ERR;
 	} else if (ipf->fl_flags & FR_PASS) {
 		if (ipf->fl_flags & FR_LOGP)
-			c[0] = 'p';
+			*t++ = 'p';
 		else
-			c[0] = 'P';
+			*t++ = 'P';
 		lvl = LOG_NOTICE;
 	} else if (ipf->fl_flags & FR_BLOCK) {
 		if (ipf->fl_flags & FR_LOGB)
-			c[0] = 'b';
+			*t++ = 'b';
 		else
-			c[0] = 'B';
+			*t++ = 'B';
 		lvl = LOG_WARNING;
 	} else if (ipf->fl_flags & FF_LOGNOMATCH) {
-		c[0] = 'n';
+		*t++ = 'n';
 		lvl = LOG_NOTICE;
 	} else {
-		c[0] = 'L';
+		*t++ = 'L';
 		lvl = LOG_INFO;
 	}
-	c[1] = ' ';
-	c[2] = '\0';
-	(void) strcat(line, c);
-	t = line + strlen(line);
+	if (ipf->fl_loglevel != 0xffff)
+		lvl = ipf->fl_loglevel;
+	*t++ = ' ';
+	*t = '\0';
 
-	if ((p == IPPROTO_TCP || p == IPPROTO_UDP) && !(ip->ip_off & 0x1fff)) {
-		tp = (struct tcphdr *)((char *)ip + hl);
+	if ((p == IPPROTO_TCP || p == IPPROTO_UDP) &&
+	    !(ip->ip_off & IP_OFFMASK)) {
+		tp = (tcphdr_t *)((char *)ip + hl);
 		if (!(ipf->fl_flags & (FI_SHORT << 16))) {
 			(void) sprintf(t, "%s,%s -> ",
 				hostname(res, ip->ip_src),
-				portname(res, proto, tp->th_sport));
+				portname(res, proto, (u_int)tp->th_sport));
 			t += strlen(t);
 			(void) sprintf(t, "%s,%s PR %s len %hu %hu ",
 				hostname(res, ip->ip_dst),
-				portname(res, proto, tp->th_dport),
+				portname(res, proto, (u_int)tp->th_dport),
 				proto, hl, ip->ip_len);
 			t += strlen(t);
 
@@ -545,12 +658,13 @@ int	blen;
 				for (i = 0; tcpfl[i].value; i++)
 					if (tp->th_flags & tcpfl[i].value)
 						*t++ = tcpfl[i].flag;
-			}
-			if (opts & OPT_VERBOSE) {
-				(void) sprintf(t, " %lu %lu %hu",
-					(u_long)tp->th_seq,
-					(u_long)tp->th_ack, tp->th_win);
-				t += strlen(t);
+				if (opts & OPT_VERBOSE) {
+					(void) sprintf(t, " %lu %lu %hu",
+						(u_long)(ntohl(tp->th_seq)),
+						(u_long)(ntohl(tp->th_ack)),
+						ntohs(tp->th_win));
+					t += strlen(t);
+				}
 			}
 			*t = '\0';
 		} else {
@@ -560,7 +674,7 @@ int	blen;
 				hostname(res, ip->ip_dst), proto,
 				hl, ip->ip_len);
 		}
-	} else if (p == IPPROTO_ICMP) {
+	} else if ((p == IPPROTO_ICMP) && !(ip->ip_off & IP_OFFMASK)) {
 		ic = (struct icmp *)((char *)ip + hl);
 		(void) sprintf(t, "%s -> ", hostname(res, ip->ip_src));
 		t += strlen(t);
@@ -573,24 +687,18 @@ int	blen;
 		    ic->icmp_type == ICMP_REDIRECT ||
 		    ic->icmp_type == ICMP_TIMXCEED) {
 			ipc = &ic->icmp_ip;
-			tp = (struct tcphdr *)((char *)ipc + hl);
+			tp = (tcphdr_t *)((char *)ipc + hl);
 
-			p = (u_short)ipc->ip_p;
-			pr = getprotobynumber((int)p);
-			if (!pr) {
-				proto = pname;
-				(void) sprintf(proto, "%d", (int)p);
-			} else
-				proto = pr->p_name;
+			proto = getproto(ipc->ip_p);
 
 			t += strlen(t);
 			(void) sprintf(t, " for %s,%s -",
 				hostname(res, ipc->ip_src),
-				portname(res, proto, tp->th_sport));
+				portname(res, proto, (u_int)tp->th_sport));
 			t += strlen(t);
 			(void) sprintf(t, " %s,%s PR %s len %hu %hu",
 				hostname(res, ipc->ip_dst),
-				portname(res, proto, tp->th_dport),
+				portname(res, proto, (u_int)tp->th_dport),
 				proto, ipc->ip_hl << 2, ipc->ip_len);
 		}
 	} else {
@@ -599,11 +707,12 @@ int	blen;
 		(void) sprintf(t, "%s PR %s len %hu (%hu)",
 			hostname(res, ip->ip_dst), proto, hl, ip->ip_len);
 		t += strlen(t);
-		if (ip->ip_off & 0x1fff)
+		if (ip->ip_off & IP_OFFMASK)
 			(void) sprintf(t, " frag %s%s%hu@%hu",
 				ip->ip_off & IP_MF ? "+" : "",
 				ip->ip_off & IP_DF ? "-" : "",
-				ip->ip_len - hl, (ip->ip_off & 0x1fff) << 3);
+				ip->ip_len - hl,
+				(ip->ip_off & IP_OFFMASK) << 3);
 	}
 	t += strlen(t);
 
@@ -617,6 +726,11 @@ int	blen;
 		t += strlen(t);
 	}
 
+	if (ipf->fl_flags & FR_INQUE)
+		strcpy(t, " IN");
+	else if (ipf->fl_flags & FR_OUTQUE)
+		strcpy(t, " OUT");
+	t += strlen(t);
 	*t++ = '\n';
 	*t++ = '\0';
 	if (opts & OPT_SYSLOG)
@@ -624,7 +738,7 @@ int	blen;
 	else
 		(void) fprintf(log, "%s", line);
 	if (opts & OPT_HEXHDR)
-		dumphex(log, (u_char *)buf, sizeof(iplog_t));
+		dumphex(log, (u_char *)buf, sizeof(iplog_t) + sizeof(*ipf));
 	if (opts & OPT_HEXBODY)
 		dumphex(log, (u_char *)ip, ipf->fl_plen + ipf->fl_hlen);
 }
@@ -638,6 +752,25 @@ char *prog;
 }
 
 
+static void write_pid(file)
+char *file;
+{
+	FILE *fp = NULL;
+	int fd;
+
+	if ((fd = open(file, O_CREAT|O_TRUNC|O_WRONLY, 0644)) >= 0)
+		fp = fdopen(fd, "w");
+	if (!fp) {
+		close(fd);
+		fprintf(stderr, "unable to open/create pid file: %s\n", file);
+		return;
+	}
+	fprintf(fp, "%d", getpid());
+	fclose(fp);
+	close(fd);
+}
+
+
 static void flushlogs(file, log)
 char *file;
 FILE *log;
@@ -709,7 +842,7 @@ char *argv[];
 	int	fd[3], doread, n, i;
 	int	tr, nr, regular[3], c;
 	int	fdt[3], devices = 0, make_daemon = 0;
-	char	buf[512], *iplfile[3];
+	char	buf[512], *iplfile[3], *s;
 	extern	int	optind;
 	extern	char	*optarg;
 
@@ -719,11 +852,14 @@ char *argv[];
 	iplfile[1] = IPNAT_NAME;
 	iplfile[2] = IPSTATE_NAME;
 
-	while ((c = getopt(argc, argv, "?aDf:FhI:nN:o:O:sS:tvxX")) != -1)
+	while ((c = getopt(argc, argv, "?aDf:FhnN:o:O:pP:sS:tvxX")) != -1)
 		switch (c)
 		{
 		case 'a' :
-			opts |= OPT_ALL;
+			opts |= OPT_LOGALL;
+			fdt[0] = IPL_LOGIPF;
+			fdt[1] = IPL_LOGNAT;
+			fdt[2] = IPL_LOGSTATE;
 			break;
 		case 'D' :
 			make_daemon = 1;
@@ -759,8 +895,17 @@ char *argv[];
 		case 'p' :
 			opts |= OPT_PORTNUM;
 			break;
+		case 'P' :
+			pidfile = optarg;
+			break;
 		case 's' :
-			openlog(argv[0], LOG_NDELAY|LOG_PID, LOGFAC);
+			s = strrchr(argv[0], '/');
+			if (s == NULL)
+				s = argv[0];
+			else
+				s++;
+			openlog(s, LOG_NDELAY|LOG_PID, LOGFAC);
+			s = NULL;
 			opts |= OPT_SYSLOG;
 			break;
 		case 'S' :
@@ -786,6 +931,8 @@ char *argv[];
 			usage(argv[0]);
 		}
 
+	init_tabs();
+
 	/*
 	 * Default action is to only open the filter log file.
 	 */
@@ -825,16 +972,19 @@ char *argv[];
 			exit(-1);
 		}
 		setvbuf(log, NULL, _IONBF, 0);
-	}
+	} else
+		log = NULL;
 
-	if (make_daemon && (log != stdout)) {
+	if (make_daemon && ((log != stdout) || (opts & OPT_SYSLOG))) {
 		if (fork() > 0)
 			exit(0);
+		write_pid(pidfile);
 		close(0);
 		close(1);
 		close(2);
 		setsid();
-	}
+	} else
+		write_pid(pidfile);
 
 	signal(SIGHUP, handlehup);
 
@@ -859,7 +1009,7 @@ char *argv[];
 				continue;
 			nr += tr;
 
-			tr = read_log(fd[i], &n, buf, sizeof(buf), log);
+			tr = read_log(fd[i], &n, buf, sizeof(buf));
 			if (donehup) {
 				donehup = 0;
 				if (newlog) {
diff --git a/contrib/ipfilter/ipsend/ipsend.c b/contrib/ipfilter/ipsend/ipsend.c
index 950d5bf..b0d997d 100644
--- a/contrib/ipfilter/ipsend/ipsend.c
+++ b/contrib/ipfilter/ipsend/ipsend.c
@@ -1,5 +1,6 @@
+/* $FreeBSD$ */
 /*
- * ipsend.c (C) 1995-1997 Darren Reed
+ * ipsend.c (C) 1995-1998 Darren Reed
  *
  * This was written to test what size TCP fragments would get through
  * various TCP/IP packet filters, as used in IP firewalls.  In certain
@@ -12,13 +13,14 @@
  */
 #if !defined(lint)
 static const char sccsid[] = "@(#)ipsend.c	1.5 12/10/95 (C)1995 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ipsend.c,v 2.0.2.19.2.1 1998/05/14 14:01:19 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: ipsend.c,v 2.1.2.2 1999/11/28 03:43:44 darrenr Exp $";
 #endif
 #include <stdio.h>
 #include <stdlib.h>
 #include <unistd.h>
 #include <netdb.h>
 #include <string.h>
+#include <sys/param.h>
 #include <sys/types.h>
 #include <sys/time.h>
 #include <sys/socket.h>
@@ -32,7 +34,6 @@ static const char rcsid[] = "@(#)$Id: ipsend.c,v 2.0.2.19.2.1 1998/05/14 14:01:1
 #ifndef	linux
 #include <netinet/ip_var.h>
 #endif
-#include <netinet/ip_compat.h>
 #include "ipsend.h"
 #include "ipf.h"
 
@@ -177,7 +178,8 @@ char	**argv;
 	struct	in_addr	gwip;
 	tcphdr_t	*tcp;
 	ip_t	*ip;
-	char	*name =  argv[0], host[64], *gateway = NULL, *dev = NULL;
+	char	*name =  argv[0], host[MAXHOSTNAMELEN + 1];
+	char	*gateway = NULL, *dev = NULL;
 	char	*src = NULL, *dst, *s;
 	int	mtu = 1500, olen = 0, c, nonl = 0;
 
diff --git a/contrib/ipfilter/ipsend/sbpf.c b/contrib/ipfilter/ipsend/sbpf.c
index 2023b46..2a1ce60 100644
--- a/contrib/ipfilter/ipsend/sbpf.c
+++ b/contrib/ipfilter/ipsend/sbpf.c
@@ -1,5 +1,6 @@
+/* $FreeBSD$ */
 /*
- * (C)opyright 1995-1997 Darren Reed. (from tcplog)
+ * (C)opyright 1995-1998 Darren Reed. (from tcplog)
  *
  * Redistribution and use in source and binary forms are permitted
  * provided that this notice is preserved and due credit is given
@@ -23,7 +24,11 @@
 #include <sys/ioctl.h>
 #if BSD < 199103
 #include <sys/fcntlcom.h>
-#include <sys/dir.h>
+#endif
+#if (__FreeBSD_version >= 300000)
+# include <sys/dirent.h>
+#else
+# include <sys/dir.h>
 #endif
 #include <net/bpf.h>
 
@@ -39,7 +44,7 @@
 
 #if !defined(lint)
 static const char sccsid[] = "@(#)sbpf.c	1.3 8/25/95 (C)1995 Darren Reed";
-static const char rcsid[] = "@(#)$Id: sbpf.c,v 2.0.2.7 1997/10/23 11:42:47 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: sbpf.c,v 2.1 1999/08/04 17:31:13 darrenr Exp $";
 #endif
 
 /*
diff --git a/contrib/ipfilter/ipsend/sock.c b/contrib/ipfilter/ipsend/sock.c
index 13bce21..a998c90 100644
--- a/contrib/ipfilter/ipsend/sock.c
+++ b/contrib/ipfilter/ipsend/sock.c
@@ -1,5 +1,6 @@
+/* $FreeBSD$ */
 /*
- * sock.c (C) 1995-1997 Darren Reed
+ * sock.c (C) 1995-1998 Darren Reed
  *
  * Redistribution and use in source and binary forms are permitted
  * provided that this notice is preserved and due credit is given
@@ -7,7 +8,7 @@
  */
 #if !defined(lint)
 static const char sccsid[] = "@(#)sock.c	1.2 1/11/96 (C)1995 Darren Reed";
-static const char rcsid[] = "@(#)$Id: sock.c,v 2.0.2.9.2.1 1997/11/28 03:36:01 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: sock.c,v 2.1 1999/08/04 17:31:16 darrenr Exp $";
 #endif
 #include <stdio.h>
 #include <unistd.h>
@@ -22,8 +23,10 @@ static const char rcsid[] = "@(#)$Id: sock.c,v 2.0.2.9.2.1 1997/11/28 03:36:01 d
 #ifndef	ultrix
 #include <fcntl.h>
 #endif
-#ifndef __FreeBSD__
-#include <sys/dir.h>
+#if (__FreeBSD_version >= 300000)
+# include <sys/dirent.h>
+#else
+# include <sys/dir.h>
 #endif
 #define _KERNEL
 #define	KERNEL
diff --git a/contrib/ipfilter/man/ipf.4 b/contrib/ipfilter/man/ipf.4
index 303f146..b281c36 100644
--- a/contrib/ipfilter/man/ipf.4
+++ b/contrib/ipfilter/man/ipf.4
@@ -1,3 +1,4 @@
+.\" $FreeBSD$
 .TH IPF 4
 .SH NAME
 ipf \- packet filtering kernel interface
@@ -25,7 +26,19 @@ However, the full complement is as follows:
 	ioctl(fd, SIOCRMIFR, struct frentry *)
 	ioctl(fd, SIOCINAFR, struct frentry *)
 	ioctl(fd, SIOCINIFR, struct frentry *)
+	ioctl(fd, SIOCSETFF, u_int *)
+	ioctl(fd, SIOGGETFF, u_int *)
+	ioctl(fd, SIOCGETFS, struct friostat *)
 	ioctl(fd, SIOCIPFFL, int *)
+	ioctl(fd, SIOCIPFFB, int *)
+	ioctl(fd, SIOCSWAPA, u_int *)
+	ioctl(fd, SIOCFRENB, u_int *)
+	ioctl(fd, SIOCFRSYN, u_int *)
+	ioctl(fd, SIOCFRZST, struct friostat *)
+	ioctl(fd, SIOCZRLST, struct frentry *)
+	ioctl(fd, SIOCAUTHW, struct fr_info *)
+	ioctl(fd, SIOCAUTHR, struct fr_info *)
+	ioctl(fd, SIOCATHST, struct fr_authstat *)
 .fi
 .PP
 The variations, SIOCADAFR vs. SIOCADIFR, allow operation on the two lists,
@@ -44,21 +57,24 @@ which it is inserted is stored in the "fr_hits" field, below.
 typedef struct  frentry {
         struct  frentry *fr_next;
         u_short fr_group;       /* group to which this rule belongs */
-        u_short fr_head;        /* group # which this rule starts */
+        u_short fr_grhead;      /* group # which this rule starts */
         struct  frentry *fr_grp;
         int     fr_ref;         /* reference count - for grouping */
-        struct  ifnet   *fr_ifa;
+        void    *fr_ifa;
+#if BSD >= 199306
+        void    *fr_oifa;
+#endif
         /*
          * These are only incremented when a packet  matches this rule and
          * it is the last match
          */
-        U_QUAD_T  fr_hits;
-        U_QUAD_T  fr_bytes;
+        U_QUAD_T        fr_hits;
+        U_QUAD_T        fr_bytes;
         /*
          * Fields after this may not change whilst in the kernel.
          */
         struct  fr_ip   fr_ip;
-        struct  fr_ip   fr_mip;
+        struct  fr_ip   fr_mip; /* mask structure */
 
         u_char  fr_tcpfm;       /* tcp flags mask */
         u_char  fr_tcpf;        /* tcp flags */
@@ -67,16 +83,20 @@ typedef struct  frentry {
         u_short fr_icmp;
 
         u_char  fr_scmp;        /* data for port comparisons */
-        u_char  fr_dcmp;
+        u_char  fr_dcmp; 
         u_short fr_dport;
         u_short fr_sport;
-        u_short fr_stop;        /* top port for <> and >< */
+        u_short fr_stop;        /* top port for <> and >< */ 
         u_short fr_dtop;        /* top port for <> and >< */
-        u_long  fr_flags;       /* per-rule flags && options (see below) */
-        int     fr_skip;        /* # of rules to skip */
-        int     (*fr_func)();   /* call this function */
+        u_32_t  fr_flags;       /* per-rule flags && options (see below) */
+        u_short fr_skip;        /* # of rules to skip */
+        u_short fr_loglevel;    /* syslog log facility + priority */
+        int     (*fr_func) __P((int, ip_t *, fr_info_t *));
         char    fr_icode;       /* return ICMP code */
         char    fr_ifname[IFNAMSIZ];
+#if BSD > 199306
+        char    fr_oifname[IFNAMSIZ];
+#endif  
         struct  frdest  fr_tif; /* "to" interface */
         struct  frdest  fr_dif; /* duplicate packet interfaces */
 } frentry_t;
@@ -96,12 +116,13 @@ Flags which are recognised in fr_pass:
      FR_OUTQUE       0x000004   /* outgoing packets */
      FR_INQUE        0x000008   /* ingoing packets */
      FR_LOG          0x000010   /* Log */
-     FR_LOGP         0x000011   /* Log-pass */
-     FR_LOGB         0x000012   /* Log-fail */
+     FR_LOGB         0x000011   /* Log-fail */
+     FR_LOGP         0x000012   /* Log-pass */
      FR_LOGBODY      0x000020   /* log the body of packets too */
      FR_LOGFIRST     0x000040   /* log only the first packet to match */
      FR_RETRST       0x000080   /* return a TCP RST packet if blocked */
-     FR__RETICMP     0x000100   /* return an ICMP packet if blocked */
+     FR_RETICMP      0x000100   /* return an ICMP packet if blocked */
+     FR_FAKEICMP     0x00180    /* Return ICMP unreachable with fake source */
      FR_NOMATCH      0x000200   /* no match occured */
      FR_ACCOUNT      0x000400   /* count packet bytes */
      FR_KEEPFRAG     0x000800   /* keep fragment information */
@@ -137,9 +158,11 @@ comparisons) :
 The third ioctl, SIOCIPFFL, flushes either the input filter list, the
 output filter list or both and it returns the number of filters removed
 from the list(s).  The values which it will take and recognise are FR_INQUE
-and FR_OUTQUE (see above).
+and FR_OUTQUE (see above).  This ioctl is also implemented for
+\fB/dev/ipstate\fP and will flush all state tables entries if passed 0
+or just all those which are not established if passed 1.
 
-\fBGeneral Logging Flags\fP
+.IP "\fBGeneral Logging Flags\fP" 0
 There are two flags which can be set to log packets independently of the
 rules used.  These allow for packets which are either passed or blocked
 to be logged.  To set (and clear)/get these flags, two ioctls are
@@ -157,8 +180,7 @@ those provided (clearing/setting all in one).
 .IP SIOCGETFF 16
 Takes a pointer to an unsigned integer as the parameter.  A copy of the
 flags currently in used is copied to user space.
-.LP
-\fBFilter statistics\fP
+.IP "\fBFilter statistics\fP" 0
 Statistics on the various operations performed by this package on packets
 is kept inside the kernel.  These statistics apply to packets traversing
 through the kernel.  To retrieve this structure, use this ioctl:
@@ -173,7 +195,12 @@ struct  friostat        {
         struct  frentry         *f_acctin[2];
         struct  frentry         *f_acctout[2];
         struct  frentry         *f_auth;
-        int     f_active;
+        u_long  f_froute[2];
+        int     f_active;       /* 1 or 0 - active rule set */
+        int     f_defpass;      /* default pass - from fr_pass */
+        int     f_running;      /* 1 if running, else 0 */
+        int     f_logging;      /* 1 if enabled, else 0 */
+        char    f_version[32];  /* version string */
 };
 
 struct	filterstats {
@@ -195,12 +222,28 @@ struct	filterstats {
         u_long  fr_chit;        /* cached hit */
         u_long  fr_pull[2];     /* good and bad pullup attempts */
 #if SOLARIS
+        u_long  fr_notdata;     /* PROTO/PCPROTO that have no data */
+        u_long  fr_nodata;      /* mblks that have no data */
         u_long  fr_bad;         /* bad IP packets to the filter */
         u_long  fr_notip;       /* packets passed through no on ip queue */
         u_long  fr_drop;        /* packets dropped - no info for them! */
 #endif
 };
 .fi
+If we wanted to retrieve all the statistics and reset the counters back to
+0, then the ioctl() call would be made to SIOCFRZST rather than SIOCGETFS.
+In addition to the statistics above, each rule keeps a hit count, counting
+both number of packets and bytes.  To reset these counters for a rule,
+load the various rule information into a frentry structure and call
+SIOCZRLST.
+.IP "Swapping Active lists" 0
+IP Filter supports two lists of rules for filtering and accounting: an
+active list and an inactive list.  This allows for large scale rule base
+changes to be put in place atomically with otherwise minimal interruption.
+Which of the two is active can be changed using the SIOCSWAPA ioctl.  It
+is important to note that no passed argument is recognised and that the
+value returned is that of the list which is now inactive.
+.br
 .SH FILES
 /dev/ipauth
 .br
diff --git a/contrib/ipfilter/man/ipf.5 b/contrib/ipfilter/man/ipf.5
index a186193..d9e9992 100644
--- a/contrib/ipfilter/man/ipf.5
+++ b/contrib/ipfilter/man/ipf.5
@@ -1,3 +1,4 @@
+.\" $FreeBSD$
 .TH IPF 5
 .SH NAME
 ipf, ipf.conf \- IP packet filter rule syntax
@@ -31,17 +32,18 @@ proto	= "proto" protocol .
 ip	= srcdst [ flags ] [ with withopt ] [ icmp ] [ keep ] .
 group	= [ "head" decnumber ] [ "group" decnumber ] .
 
-block	= "block" [ "return-icmp"[return-code] | "return-rst" ] .
+block	= "block" [ icmp[return-code] | "return-rst" ] .
 auth    = "auth" | "preauth" .
-log	= "log" [ "body" ] [ "first" ] [ "or-block" ] .
+log	= "log" [ "body" ] [ "first" ] [ "or-block" ] [ "level" loglevel ] .
 call	= "call" [ "now" ] function-name .
 skip	= "skip" decnumber .
 dup	= "dup-to" interface-name[":"ipaddr] .
 froute	= "fastroute" | "to" interface-name .
 protocol = "tcp/udp" | "udp" | "tcp" | "icmp" | decnumber .
 srcdst	= "all" | fromto .
-fromto	= "from" object "to" object .
+fromto	= "from" [ "!" ] object "to" [ "!" ] object .
 
+icmp	= "return-icmp" | "return-icmp-as-dest" .
 object	= addr [ port-comp | port-range ] .
 addr	= "any" | nummask | host-name [ "mask" ipaddr | "mask" hexnumber ] .
 port-comp = "port" compare port-num .
@@ -51,6 +53,7 @@ with	= "with" | "and" .
 icmp	= "icmp-type" icmp-type [ "code" decnumber ] .
 return-code = "("icmp-code")" .
 keep	= "keep" "state" | "keep" "frags" .
+loglevel = facility"."priority | priority .
 
 nummask	= host-name [ "/" decnumber ] .
 host-name = ipaddr | hostname | "any" .
@@ -70,10 +73,17 @@ icmp-type = "unreach" | "echo" | "echorep" | "squench" | "redir" |
 	    "inforep" | "maskreq" | "maskrep"  | decnumber .
 icmp-code = decumber | "net-unr" | "host-unr" | "proto-unr" | "port-unr" |
 	    "needfrag" | "srcfail" | "net-unk" | "host-unk" | "isolate" |
-	    "net-prohib" | "host-prohib" | "net-tos" | "host-tos" .
+	    "net-prohib" | "host-prohib" | "net-tos" | "host-tos" |
+	    "filter-prohib" | "host-preced" | "cutoff-preced" .
 optlist	= "nop" | "rr" | "zsu" | "mtup" | "mtur" | "encode" | "ts" |
 	  "tr" | "sec" | "lsrr" | "e-sec" | "cipso" | "satid" | "ssrr" |
 	  "addext" | "visa" | "imitd" | "eip" | "finn" .
+facility = "kern" | "user" | "mail" | "daemon" | "auth" | "syslog" |
+	   "lpr" | "news" | "uucp" | "cron" | "ftp" | "authpriv" |
+	   "audit" | "logalert" | "local0" | "local1" | "local2" |
+	   "local3" | "local4" | "local5" | "local6" | "local7" .
+priority = "emerg" | "alert" | "crit" | "err" | "warn" | "notice" |
+	   "info" | "debug" . 
 
 hexnumber = "0" "x" hexstring .
 hexstring = hexdigit [ hexstring ] .
@@ -118,11 +128,23 @@ actions are recognised:
 .B block
 indicates that the packet should be flagged to be dropped. In response
 to blocking a packet, the filter may be instructed to send a reply
-packet, either an ICMP packet (\fBreturn-icmp\fP) or a TCP "reset"
-(\fBreturn-rst\fP).  An ICMP packet may be generated in response to
-any IP packet, and its type may optionally be specified, but a TCP
-reset may only be used with a rule which is being applied to TCP
-packets.
+packet, either an ICMP packet (\fBreturn-icmp\fP), an ICMP packet
+masquerading as being from the original packet's destination
+(\fBreturn-icmp-as-dest\fP), or a TCP "reset" (\fBreturn-rst\fP).  An
+ICMP packet may be generated in response to any IP packet, and its
+type may optionally be specified, but a TCP reset may only be used
+with a rule which is being applied to TCP packets.  When using
+\fBreturn-icmp\fP or \fBreturn-icmp-as-dest\fP, it is possible to specify
+the actual unreachable `type'.  That is, whether it is a network
+unreachable, port unreachable or even administratively
+prohibitied. This is done by enclosing the ICMP code associated with
+it in parenthesis directly following \fBreturn-icmp\fP or
+\fBreturn-icmp-as-dest\fP as follows:
+.nf
+        block return-icmp(11) ...
+.fi
+.PP
+Would return a Type-Of-Service (TOS) ICMP unreachable error.
 .TP
 .B pass
 will flag the packet to be let through the filter.  
@@ -145,10 +167,27 @@ feature is for use by knowledgeable hackers, and is not currently
 documented.
 .TP
 .B "skip <n>"
+causes the filter to skip over the next \fIn\fP filter rules.  If a rule is
+inserted or deleted inside the region being skipped over, then the value of
+\fIn\fP is adjusted appropriately.
 .TP
 .B auth
+this allows authentication to be performed by a user-space program running
+and waiting for packet information to validate.  The packet is held for a
+period of time in an internal buffer whilst it waits for the program to return
+to the kernel the \fIreal\fP flags for whether it should be allowed through
+or not.  Such a program might look at the source address and request some sort
+of authentication from the user (such as a password) before allowing the
+packet through or telling the kernel to drop it if from an unrecognised source.
 .TP
 .B preauth
+tells the filter that for packets of this class, it should look in the
+pre-authenticated list for further clarification.  If no further matching
+rule is found, the packet will be dropped (the FR_PREAUTH is not the same
+as FR_PASS).  If a further matching rule is found, the result from that is
+used in its instead.  This might be used in a situation where a person
+\fIlogs in\fP to the firewall and it sets up some temporary rules defining
+the access for that person.
 .PP
 The next word must be either \fBin\fP or \fBout\fP.  Each packet
 moving through the kernel is either inbound (just been received on an
@@ -195,7 +234,10 @@ which the specified source address would be expected, others may be
 logged and/or dropped.
 .TP
 .B dup-to
-causes the packet to be copied, and the duplicate packet to be sent outbound on the specified interface, optionally with the destination IP address changed to that specified. This is useful for off-host logging, using a network sniffer.
+causes the packet to be copied, and the duplicate packet to be sent
+outbound on the specified interface, optionally with the destination
+IP address changed to that specified. This is useful for off-host
+logging, using a network sniffer.
 .TP
 .B to
 causes the packet to be moved to the outbound queue on the
@@ -394,10 +436,19 @@ indicates that the first 128 bytes of the packet contents will be
 logged after the headers. 
 .TP
 .B first
-??
+If log is being used in conjunction with a "keep" option, it is recommended
+that this option is also applied so that only the triggering packet is logged
+and not every packet which thereafter matches state information.
 .TP
 .B or-block
-indicates that, if for some reason the filter is unable to log the packet (such as the log reader being too slow) then the rule should be interpreted as if the action was \fBblock\fP for this packet.
+indicates that, if for some reason the filter is unable to log the
+packet (such as the log reader being too slow) then the rule should be
+interpreted as if the action was \fBblock\fP for this packet.
+.TP
+.B "level <loglevel>"
+indicates what logging facility and priority, or just priority with
+the default facility being used, will be used to log information about 
+this packet using ipmon's -s option.
 .PP
 See ipl(4) for the format of records written
 to this device. The ipmon(8) program can be used to read and format
@@ -419,7 +470,7 @@ The "fall-through" rule parsing allows for effects such as this:
 .nf
         block in from any to any port < 6000
         pass in from any to any port >= 6000
-        block in from any to port > 6003
+        block in from any to any port > 6003
 .fi
 .PP
 which sets up the range 6000-6003 as being permitted and all others being
@@ -441,14 +492,14 @@ rule such as:
 .fi
 .PP
 would be needed before the first block.  To create a new group for
-processing all inbould packets on le0/le1/lo0, with the default being to block
+processing all inbound packets on le0/le1/lo0, with the default being to block
 all inbound packets, we would do something like:
 .LP
 .nf
        block in all
-       block in on le0 quick all head 100
-       block in on le1 quick all head 200
-       block in on lo0 quick all head 300
+       block in quick on le0 all head 100
+       block in quick on le1 all head 200
+       block in quick on lo0 all head 300
 .fi
 .PP
 
@@ -487,4 +538,4 @@ qualifies all service/port names with the protocol specified.
 .br
 /etc/services
 .SH SEE ALSO
-ipftest(1), iptest(1), ipf(4), ipnat(5), ipf(8), ipfstat(8)
+ipftest(1), iptest(1), mkfilters(1), ipf(4), ipnat(5), ipf(8), ipfstat(8)
diff --git a/contrib/ipfilter/man/ipf.8 b/contrib/ipfilter/man/ipf.8
index 16edfad..9aa4536 100644
--- a/contrib/ipfilter/man/ipf.8
+++ b/contrib/ipfilter/man/ipf.8
@@ -1,10 +1,11 @@
+.\" $FreeBSD$
 .TH IPF 8
 .SH NAME
 ipf \- alters packet filtering lists for IP packet input and output
 .SH SYNOPSIS
 .B ipf
 [
-.B \-AdDEInorsUvyzZ
+.B \-AdDEInoPrsUvVyzZ
 ] [
 .B \-l
 <block|pass|nomatch>
@@ -81,6 +82,9 @@ calls or doing anything which would alter the currently running kernel.
 Force rules by default to be added/deleted to/from the output list, rather
 than the (default) input list.
 .TP
+.B \-P
+Add rules as temporary entries in the authentication rule table.
+.TP
 .B \-r
 Remove matching filter rules rather than add them to the internal lists
 .TP
@@ -94,6 +98,12 @@ recognised as IP packets.  They will be printed out on the console.
 .B \-v
 Turn verbose mode on.  Displays information relating to rule processing.
 .TP
+.B \-V
+Show version information.  This will display the version information compiled
+into the ipf binary and retrieve it from the kernel code (if running/present).
+If it is present in the kernel, information about its current state will be
+displayed (whether logging is active, default filtering, etc).
+.TP
 .B \-y
 Manually resync the in-kernel interface list maintained by IP Filter with
 the current interface status list.
@@ -113,7 +123,7 @@ affect fragment or state statistics).
 .br
 /dev/ipstate
 .SH SEE ALSO
-ipftest(1), ipf(4), ipl(4), ipf(5), ipfstat(8), ipmon(8), ipnat(8)
+ipftest(1), mkfilters(1), ipf(4), ipl(4), ipf(5), ipfstat(8), ipmon(8), ipnat(8)
 .SH DIAGNOSTICS
 .PP
 Needs to be run as root for the packet filtering lists to actually
diff --git a/contrib/ipfilter/man/ipfilter.5 b/contrib/ipfilter/man/ipfilter.5
index 44f3130..ac45146 100644
--- a/contrib/ipfilter/man/ipfilter.5
+++ b/contrib/ipfilter/man/ipfilter.5
@@ -1,7 +1,11 @@
+.\" $FreeBSD$
 .TH IPFILTER 1
 .SH NAME
 IP FIlter
 .SH DESCRIPTION
 .PP
+IP Filter is a package providing packet filtering capabilities for a variety
+of operating systems.  On a properly setup system, it can be used to build a
+firewall.
 .SH SEE ALSO
-ipf(8), ipf(1), ipf(5), ipnat(1), ipnat(5) 
+ipf(8), ipf(1), ipf(5), ipnat(1), ipnat(5), mkfilters(1)
diff --git a/contrib/ipfilter/man/ipfstat.8 b/contrib/ipfilter/man/ipfstat.8
index eff21d3..89adb85 100644
--- a/contrib/ipfilter/man/ipfstat.8
+++ b/contrib/ipfilter/man/ipfstat.8
@@ -1,10 +1,11 @@
+.\" $FreeBSD$
 .TH ipfstat 8
 .SH NAME
 ipfstat \- reports on packet filter statistics and filter list
 .SH SYNOPSIS
 .B ipfstat
 [
-.B \-aAfhIinosv
+.B \-aAfghIinosv
 ] [
 .B \-d
 <device>
@@ -34,6 +35,9 @@ Use a device other than \fB/dev/ipl\fP for interfacing with the kernel.
 Show fragment state information (statistics) and held state information (in
 the kernel) if any is present.
 .TP
+.B \-g
+Show groups currently configured (both active and inactive).
+.TP
 .B \-h
 Show per-rule the number of times each one scores a "hit".  For use in
 combination with \fB\-i\fP.
diff --git a/contrib/ipfilter/man/ipmon.8 b/contrib/ipfilter/man/ipmon.8
index 82898e1..b8b42a3 100644
--- a/contrib/ipfilter/man/ipmon.8
+++ b/contrib/ipfilter/man/ipmon.8
@@ -1,3 +1,4 @@
+.\" $FreeBSD$
 .TH ipmon 8
 .SH NAME
 ipmon \- monitors /dev/ipl for logged packets
@@ -28,6 +29,46 @@ default or a filename, if given on the command line.  Should the \fB\-s\fP
 option be used, output is instead sent to \fBsyslogd(8)\fP.  Messages sent
 via syslog have the day, month and year removed from the message, but the
 time (including microseconds), as recorded in the log, is still included.
+.LP
+Messages generated by ipmon consist of whitespace separated fields.
+Fields common to all messages are:
+.LP
+1. The date of packet receipt. This is suppressed when the message is
+sent to syslog.
+.LP
+2. The time of packet receipt. This is in the form HH:MM:SS.F, for hours,
+minutes seconds, and fractions of a second (which can be several digits
+long).
+.LP
+3. The name of the interface the packet was processed on, e.g., \fBwe1\fP.
+.LP
+4. The group and rule number of the rule, e.g., \fB@0:17\fP. These can be
+viewed with \fBipfstat -n\fP.
+.LP
+5. The action: \fBp\fP for passed or \fBb\fP for blocked.
+.LP
+6. The addresses.
+This is actually three fields: the source address and port
+(separted by a comma), the \fB->\fP symbol, and the destination address
+and port. E.g.: \fB209.53.17.22,80 -> 198.73.220.17,1722\fP.
+.LP
+7. \fBPR\fP followed by the protocol name or number, e.g., \fBPR tcp\fP.
+.LP
+8. \fBlen\fP followed by the header length and total length of the packet,
+e.g., \fBlen 20 40\fP.
+.LP
+If the packet is a TCP packet, there will be an additional field starting
+with a hyphen followed by letters corresponding to any flags that were set.
+See the ipf.conf manual page for a list of letters and their flags.
+.LP
+If the packet is an ICMP packet, there will be two fields at the end,
+the first always being `icmp', and the next being the ICMP message and
+submessage type, separated by a slash, e.g., \fBicmp 3/3\fP for a port
+unreachable message.
+.LP
+In order for \fBipmon\fP to properly work, the kernel option
+\fBIPFILTER_LOG\fP must be turned on in your kernel.  Please see
+\fBoptions(4)\fP for more details.
 .SH OPTIONS
 .TP
 .B \-a
@@ -61,7 +102,12 @@ as for \fB-o\fP.
 .TP
 .B \-s
 Packet information read in will be sent through syslogd rather than
-saved to a file.  The following levels are used:
+saved to a file.  The default facility when compiled and installed is
+\fBlocal0\fP.  The following levels are used:
+.TP
+.B "\-S <device>"
+Set the logfile to be opened for reading state log records from to <device>.
+.TP
 .IP
 .B LOG_INFO
 \- packets logged using the "log" keyword as the action rather
@@ -77,12 +123,12 @@ than pass or block.
 \- packets which have been logged and which can be considered
 "short".
 .TP
-.B "\-S <device>"
-Set the logfile to be opened for reading state log records from to <device>.
-.TP
 .B \-t
 read the input file/device in a manner akin to tail(1).
 .TP
+.B \-v
+show tcp window, ack and sequence fields.
+.TP
 .B \-x
 show the packet data in hex.
 .TP
diff --git a/contrib/ipfilter/man/ipnat.4 b/contrib/ipfilter/man/ipnat.4
index 646c339..cde2639 100644
--- a/contrib/ipfilter/man/ipnat.4
+++ b/contrib/ipfilter/man/ipnat.4
@@ -1,3 +1,4 @@
+.\" $FreeBSD$
 .TH IPNAT 4
 .SH NAME
 ipnat \- Network Address Translation kernel interface
@@ -65,7 +66,7 @@ Recognised values for in_redir:
 .PP
 .LP
 \fBNAT statistics\fP
-Statistics on the the number of packets mapped, going in and out are kept,
+Statistics on the number of packets mapped, going in and out are kept,
 the number of times a new entry is added and deleted (through expiration) to
 the NAT table and the current usage level of the NAT table.
 .PP