Remove ip6fw. Since ipfw has full functional IPv6 support now and - in

contrast to ip6fw - is properly lockes, it is time to retire ip6fw.

5 files changed, 0 insertions, 2072 deletions

diff --git a/sbin/Makefile b/sbin/Makefile
index a2daff4..d96d29a 100644
--- a/sbin/Makefile
+++ b/sbin/Makefile
@@ -38,7 +38,6 @@ SUBDIR=	adjkerntz \
 	gvinum \
 	ifconfig \
 	init \
-	${_ip6fw} \
 	${_ipf} \
 	ipfw \
 	kldconfig \
@@ -112,7 +111,6 @@ _pflogd=	pflogd
 .endif
 
 .if ${MK_INET6} != "no"
-_ip6fw=		ip6fw
 _ping6=		ping6
 .endif
 
diff --git a/sbin/ip6fw/Makefile b/sbin/ip6fw/Makefile
deleted file mode 100644
index 17f330d..0000000
--- a/sbin/ip6fw/Makefile
+++ /dev/null
@@ -1,7 +0,0 @@
-# $FreeBSD$
-
-PROG=   ip6fw
-WARNS?=	2
-MAN=	ip6fw.8
-
-.include <bsd.prog.mk>
diff --git a/sbin/ip6fw/ip6fw.8 b/sbin/ip6fw/ip6fw.8
deleted file mode 100644
index 9d296cf..0000000
--- a/sbin/ip6fw/ip6fw.8
+++ /dev/null
@@ -1,582 +0,0 @@
-.\"
-.\" $FreeBSD$
-.\"
-.\"	$KAME$
-.\"
-.\" Copyright (C) 1998, 1999, 2000 and 2001 WIDE Project.
-.\" All rights reserved.
-.\"
-.\" Redistribution and use in source and binary forms, with or without
-.\" modification, are permitted provided that the following conditions
-.\" are met:
-.\" 1. Redistributions of source code must retain the above copyright
-.\"    notice, this list of conditions and the following disclaimer.
-.\" 2. Redistributions in binary form must reproduce the above copyright
-.\"    notice, this list of conditions and the following disclaimer in the
-.\"    documentation and/or other materials provided with the distribution.
-.\" 3. Neither the name of the project nor the names of its contributors
-.\"    may be used to endorse or promote products derived from this software
-.\"    without specific prior written permission.
-.\"
-.\" THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
-.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
-.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-.\" SUCH DAMAGE.
-.\"
-.Dd March 13, 2000
-.Dt IP6FW 8
-.Os
-.Sh NAME
-.Nm ip6fw
-.Nd controlling utility for IPv6 firewall
-.Sh SYNOPSIS
-.Nm
-.Op Fl nq
-.Oo
-.Fl p Ar preproc
-.Oo Fl D
-.Ar macro Ns Op = Ns Ar value
-.Oc
-.Op Fl U Ar macro
-.Oc
-.Ar pathname
-.Nm
-.Op Fl n
-.Op Fl f | Fl q
-flush
-.Nm
-.Op Fl nq
-zero
-.Op Ar number ...
-.Nm
-.Op Fl n
-delete
-.Ar number ...
-.Nm
-.Op Fl aftN
-list
-.Op Ar number ...
-.Nm
-.Op Fl ftN
-show
-.Op Ar number ...
-.Nm
-.Op Fl nq
-add
-.Op Ar number
-.Ar action
-.Op log
-.Ar proto
-from
-.Ar src
-to
-.Ar dst
-.Op via Ar name | ipv6no
-.Op Ar options
-.Sh DESCRIPTION
-To ease configuration, rules can be put into a file which is
-processed using
-.Nm
-as shown in the first synopsis line.
-An absolute
-.Ar pathname
-must be used.
-The file
-will be read line by line and applied as arguments to the
-.Nm
-utility.
-.Pp
-Optionally, a preprocessor can be specified using
-.Fl p Ar preproc
-where
-.Ar pathname
-is to be piped through.
-Useful preprocessors include
-.Xr cpp 1
-and
-.Xr m4 1 .
-If
-.Ar preproc
-does not start with a slash
-.Pq Ql /
-as its first character, the usual
-.Ev PATH
-name search is performed.
-Care should be taken with this in environments where not all
-file systems are mounted (yet) by the time
-.Nm
-is being run (e.g.\& when they are mounted over NFS).
-Once
-.Fl p
-has been specified, optional
-.Fl D
-and
-.Fl U
-specifications can follow and will be passed on to the preprocessor.
-This allows for flexible configuration files (like conditionalizing
-them on the local hostname) and the use of macros to centralize
-frequently required arguments like IP addresses.
-.Pp
-The
-.Nm
-code works by going through the rule-list for each packet,
-until a match is found.
-All rules have two associated counters, a packet count and
-a byte count.
-These counters are updated when a packet matches the rule.
-.Pp
-The rules are ordered by a
-.Dq line-number
-from 1 to 65534 that is used
-to order and delete rules.
-Rules are tried in increasing order, and the
-first rule that matches a packet applies.
-Multiple rules may share the same number and apply in
-the order in which they were added.
-.Pp
-If a rule is added without a number, it is numbered 100 higher
-than the previous rule.
-If the highest defined rule number is
-greater than 65434, new rules are appended to the last rule.
-.Pp
-The delete operation deletes the first rule with number
-.Ar number ,
-if any.
-.Pp
-The list command prints out the current rule set.
-.Pp
-The show command is equivalent to `ip6fw -a list'.
-.Pp
-The zero operation zeroes the counters associated with rule number
-.Ar number .
-.Pp
-The flush operation removes all rules.
-.Pp
-Any command beginning with a
-.Sq # ,
-or being all blank, is ignored.
-.Pp
-One rule is always present:
-.Bd -literal -offset center
-65535 deny all from any to any
-.Ed
-.Pp
-This rule is the default policy, i.e., do not allow anything at all.
-Your job in setting up rules is to modify this policy to match your
-needs.
-.Pp
-The following options are available:
-.Bl -tag -width flag
-.It Fl a
-While listing, show counter values.
-See also
-.Dq show
-command.
-.It Fl f
-Do not ask for confirmation for commands that can cause problems if misused
-(ie; flush).
-.Ar Note ,
-if there is no tty associated with the process, this is implied.
-.It Fl n
-Only check syntax of the command strings,
-without actually passing them into the kernel.
-.It Fl q
-While adding, zeroing or flushing, be quiet about actions (implies '-f').
-This is useful for adjusting rules by executing multiple ip6fw commands in a
-script (e.g.\& sh /etc/rc.firewall), or by processing a file of many ip6fw rules,
-across a remote login session.
-If a flush is performed in normal
-(verbose) mode, it prints a message.
-Because all rules are flushed, the
-message cannot be delivered to the login session, the login session is
-closed and the remainder of the ruleset is not processed.
-Access to the
-console is required to recover.
-.It Fl t
-While listing, show last match timestamp.
-.It Fl N
-Try to resolve addresses and service names in output.
-.El
-.Pp
-.Ar action :
-.Bl -hang -offset flag -width 16n
-.It Ar allow
-Allow packets that match rule.
-The search terminates.
-Aliases are
-.Ar pass ,
-.Ar permit ,
-and
-.Ar accept .
-.It Ar deny
-Discard packets that match this rule.
-The search terminates.
-.Ar Drop
-is an alias for
-.Ar deny .
-.It Ar reject
-(Deprecated.)
-Discard packets that match this rule, and try to send an ICMPv6
-host unreachable notice.
-The search terminates.
-.It Ar unreach code
-Discard packets that match this rule, and try to send an ICMPv6
-unreachable notice with code
-.Ar code ,
-where
-.Ar code
-is a number from zero to 255, or one of these aliases:
-.Ar noroute ,
-.Ar admin ,
-.Ar notneighbor ,
-.Ar addr ,
-or
-.Ar noport ,
-The search terminates.
-.It Ar reset
-TCP packets only.
-Discard packets that match this rule,
-and try to send a TCP reset (RST) notice.
-The search terminates
-.It Ar count
-Update counters for all packets that match rule.
-The search continues with the next rule.
-.It Ar skipto number
-Skip all subsequent rules numbered less than
-.Ar number .
-The search continues with the first rule numbered
-.Ar number
-or higher.
-.El
-.Pp
-If the kernel was compiled with
-.Dv IPV6FIREWALL_VERBOSE ,
-then when a packet matches a rule with the
-.Dq log
-keyword or a clear/resetlog is performed, a message will be logged to
-.Xr syslogd 8 ,
-or, if that fails, to the console.
-If the kernel was compiled with the
-.Dv IPV6FIREWALL_VERBOSE_LIMIT
-option, then logging will cease after the number of packets
-specified by the option are received for that particular
-chain entry.
-When this limit is reached, the limit and rule number will be logged.
-Logging may then be re-enabled by clearing
-the packet counter for that entry.
-.Pp
-The
-.Xr syslogd 8
-logging and the default log limit are adjustable dynamically through the
-.Xr sysctl 8
-interface.
-.Pp
-.Ar proto :
-.Bl -hang -offset flag -width 16n
-.It Ar ipv6
-All packets match.
-The alias
-.Ar all
-has the same effect.
-.It Ar tcp
-Only TCP packets match.
-.It Ar udp
-Only UDP packets match.
-.It Ar ipv6-icmp
-Only ICMPv6 packets match.
-.It Ar <number|name>
-Only packets for the specified protocol matches (see
-.Pa /etc/protocols
-for a complete list).
-.El
-.Pp
-.Ar src
-and
-.Ar dst :
-.Bl -hang -offset flag
-.It Ar <address/prefixlen>
-.Op Ar ports
-.El
-.Pp
-The
-.Em <address/prefixlen>
-may be specified as:
-.Bl -hang -offset flag -width 16n
-.It Ar ipv6no
-An ipv6number of the form
-.Li fec0::1:2:3:4 .
-.It Ar ipv6no/prefixlen
-An ipv6number with a prefix length of the form
-.Li fec0::1:2:3:4/112 .
-.El
-.Pp
-The sense of the match can be inverted by preceding an address with the
-.Dq not
-modifier, causing all other addresses to be matched instead.
-This
-does not affect the selection of port numbers.
-.Pp
-With the TCP and UDP protocols, optional
-.Em ports
-may be specified as:
-.Pp
-.Bl -hang -offset flag
-.It Ns {port|port-port} Ns Op ,port Ns Op ,...
-.El
-.Pp
-Service names (from
-.Pa /etc/services )
-may be used instead of numeric port values.
-A range may only be specified as the first value,
-and the length of the port list is limited to
-.Dv IPV6_FW_MAX_PORTS
-(as defined in
-.In netinet6/ip6_fw.h )
-ports.
-.Pp
-Fragmented packets which have a non-zero offset (i.e., not the first
-fragment) will never match a rule which has one or more port
-specifications.
-See the
-.Ar frag
-option for details on matching fragmented packets.
-.Pp
-Rules can apply to packets when they are incoming, or outgoing, or both.
-The
-.Ar in
-keyword indicates the rule should only match incoming packets.
-The
-.Ar out
-keyword indicates the rule should only match outgoing packets.
-.Pp
-To match packets going through a certain interface, specify
-the interface using
-.Ar via :
-.Bl -hang -offset flag -width 16n
-.It Ar via ifX
-Packet must be going through interface
-.Ar ifX .
-.It Ar via if*
-Packet must be going through interface
-.Ar ifX ,
-where X is any unit number.
-.It Ar via any
-Packet must be going through
-.Em some
-interface.
-.It Ar via ipv6no
-Packet must be going through the interface having IPv6 address
-.Ar ipv6no .
-.El
-.Pp
-The
-.Ar via
-keyword causes the interface to always be checked.
-If
-.Ar recv
-or
-.Ar xmit
-is used instead of
-.Ar via ,
-then the only receive or transmit interface (respectively) is checked.
-By specifying both, it is possible to match packets based on both receive
-and transmit interface, e.g.:
-.Pp
-.Dl "ip6fw add 100 deny ip from any to any out recv ed0 xmit ed1"
-.Pp
-The
-.Ar recv
-interface can be tested on either incoming or outgoing packets, while the
-.Ar xmit
-interface can only be tested on outgoing packets.
-So
-.Ar out
-is required (and
-.Ar in
-invalid) whenever
-.Ar xmit
-is used.
-Specifying
-.Ar via
-together with
-.Ar xmit
-or
-.Ar recv
-is invalid.
-.Pp
-A packet may not have a receive or transmit interface: packets originating
-from the local host have no receive interface, while packets destined for
-the local host have no transmit interface.
-.Pp
-Additional
-.Ar options :
-.Bl -hang -offset flag -width 16n
-.It frag
-Matches if the packet is a fragment and this is not the first fragment
-of the datagram.
-.Ar frag
-may not be used in conjunction with either
-.Ar tcpflags
-or TCP/UDP port specifications.
-.It in
-Matches if this packet was on the way in.
-.It out
-Matches if this packet was on the way out.
-.It ipv6options Ar spec
-Matches if the IPv6 header contains the comma separated list of
-options specified in
-.Ar spec .
-The supported IPv6 options are:
-.Ar hopopt
-(hop-by-hop options header),
-.Ar route
-(routing header),
-.Ar frag
-(fragment header),
-.Ar esp
-(encapsulating security payload),
-.Ar ah
-(authentication header),
-.Ar nonxt
-(no next header), and
-.Ar opts
-(destination options header).
-The absence of a particular option may be denoted
-with a
-.Dq \&!
-.Em ( "not working yet" ) .
-.It established
-Matches packets that have the RST or ACK bits set.
-TCP packets only.
-.It setup
-Matches packets that have the SYN bit set but no ACK bit.
-TCP packets only.
-.It tcpflags Ar spec
-Matches if the TCP header contains the comma separated list of
-flags specified in
-.Ar spec .
-The supported TCP flags are:
-.Ar fin ,
-.Ar syn ,
-.Ar rst ,
-.Ar psh ,
-.Ar ack ,
-and
-.Ar urg .
-The absence of a particular flag may be denoted
-with a
-.Dq \&! .
-A rule which contains a
-.Ar tcpflags
-specification can never match a fragmented packet which has
-a non-zero offset.
-See the
-.Ar frag
-option for details on matching fragmented packets.
-.It icmptypes Ar types
-Matches if the ICMPv6 type is in the list
-.Ar types .
-The list may be specified as any combination of ranges
-or individual types separated by commas.
-.El
-.Sh CHECKLIST
-Here are some important points to consider when designing your
-rules:
-.Bl -bullet -offset flag
-.It
-Remember that you filter both packets going in and out.
-Most connections need packets going in both directions.
-.It
-Remember to test very carefully.
-It is a good idea to be near the console when doing this.
-.It
-Do not forget the loopback interface.
-.El
-.Sh FINE POINTS
-There is one kind of packet that the firewall will always discard,
-that is an IPv6 fragment with a fragment offset of one.
-This is a valid packet, but it only has one use, to try to circumvent
-firewalls.
-.Pp
-If you are logged in over a network, loading the KLD version of
-.Nm
-is probably not as straightforward as you would think
-.Em ( "not supported" ) .
-I recommend this command line:
-.Bd -literal -offset center
-kldload ip6fw && \e
-ip6fw add 32000 allow all from any to any
-.Ed
-.Pp
-Along the same lines, doing an
-.Bd -literal -offset center
-ip6fw flush
-.Ed
-.Pp
-in similar surroundings is also a bad idea.
-.Sh PACKET DIVERSION
-not supported.
-.Sh EXAMPLES
-This command adds an entry which denies all tcp packets from
-.Em hacker.evil.org
-to the telnet port of
-.Em wolf.tambov.su
-from being forwarded by the host:
-.Pp
-.Dl ip6fw add deny tcp from hacker.evil.org to wolf.tambov.su 23
-.Pp
-This one disallows any connection from the entire hackers network to
-my host:
-.Pp
-.Dl ip6fw add deny all from fec0::123:45:67:0/112 to my.host.org
-.Pp
-Here is a good usage of the list command to see accounting records
-and timestamp information:
-.Pp
-.Dl ip6fw -at l
-.Pp
-or in short form without timestamps:
-.Pp
-.Dl ip6fw -a l
-.Sh SEE ALSO
-.Xr ip 4 ,
-.Xr ipfirewall 4 ,
-.Xr protocols 5 ,
-.Xr services 5 ,
-.Xr reboot 8 ,
-.Xr sysctl 8 ,
-.Xr syslogd 8
-.Sh HISTORY
-A
-.Nm
-utility first appeared in
-.Fx 4.0 .
-.Sh AUTHORS
-.An Ugen J. S. Antsilevich ,
-.An Poul-Henning Kamp ,
-.An Alex Nash ,
-.An Archie Cobbs .
-.Pp
-.An -nosplit
-API based upon code written by
-.An Daniel Boulet
-for BSDI.
-.Sh BUGS
-.Em WARNING!!WARNING!!WARNING!!WARNING!!WARNING!!WARNING!!WARNING!!
-.Pp
-This program can put your computer in rather unusable state.
-When
-using it for the first time, work on the console of the computer, and
-do
-.Em NOT
-do anything you do not understand.
-.Pp
-When manipulating/adding chain entries, service and protocol names are
-not accepted.
diff --git a/sbin/ip6fw/ip6fw.c b/sbin/ip6fw/ip6fw.c
deleted file mode 100644
index 9ceabbf..0000000
--- a/sbin/ip6fw/ip6fw.c
+++ /dev/null
@@ -1,1453 +0,0 @@
-/*	$KAME: ip6fw.c,v 1.14 2003/10/02 19:36:25 itojun Exp $	*/
-
-/*
- * Copyright (C) 1998, 1999, 2000 and 2001 WIDE Project.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-/*
- * Copyright (c) 1996 Alex Nash, Paul Traina, Poul-Henning Kamp
- * Copyright (c) 1994 Ugen J.S.Antsilevich
- *
- * Idea and grammar partially left from:
- * Copyright (c) 1993 Daniel Boulet
- *
- * Redistribution and use in source forms, with and without modification,
- * are permitted provided that this entire comment appears intact.
- *
- * Redistribution in binary form may occur without any restrictions.
- * Obviously, it would be nice if you gave credit where credit is due
- * but requiring it would be too onerous.
- *
- * This software is provided ``AS IS'' without any warranties of any kind.
- *
- * NEW command line interface for IP firewall facility
- *
- * $Id: ip6fw.c,v 1.1.2.2.2.2 1999/05/14 05:13:50 shin Exp $
- * $FreeBSD$
- */
-
-#include <sys/types.h>
-#include <sys/queue.h>
-#include <sys/socket.h>
-#include <sys/sockio.h>
-#include <sys/time.h>
-#include <sys/ioctl.h>
-#include <sys/wait.h>
-
-#include <ctype.h>
-#include <err.h>
-#include <limits.h>
-#include <netdb.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <stdarg.h>
-#include <string.h>
-#include <time.h>
-#include <timeconv.h>
-#include <unistd.h>
-#include <errno.h>
-#include <signal.h>
-#include <sysexits.h>
-
-#include <net/if.h>
-#include <netinet/in.h>
-#include <netinet/in_systm.h>
-#include <netinet/ip6.h>
-#include <netinet/icmp6.h>
-#include <netinet6/ip6_fw.h>
-#include <netinet/tcp.h>
-#include <arpa/inet.h>
-
-int 		lineno = -1;
-
-int 		s;				/* main RAW socket 	   */
-int 		do_resolv=0;			/* Would try to resolv all */
-int		do_acct=0;			/* Show packet/byte count  */
-int		do_time=0;			/* Show time stamps        */
-int		do_quiet=0;			/* Be quiet in add and flush  */
-int		do_force=0;			/* Don't ask for confirmation */
-int		do_test=0;			/* Don't load into Kernel */
-
-struct icmpcode {
-	int	code;
-	char	*str;
-};
-
-static struct icmpcode icmp6codes[] = {
-      { ICMP6_DST_UNREACH_NOROUTE,	"noroute" },
-      { ICMP6_DST_UNREACH_ADMIN,	"admin" },
-      { ICMP6_DST_UNREACH_NOTNEIGHBOR,	"notneighbor" },
-      { ICMP6_DST_UNREACH_ADDR,		"addr" },
-      { ICMP6_DST_UNREACH_NOPORT,	"noport" },
-      { 0, NULL }
-};
-
-static char ntop_buf[INET6_ADDRSTRLEN];
-
-static void show_usage(const char *fmt, ...);
-
-static int
-mask_bits(u_char *m_ad, int m_len)
-{
-	int h_num = 0,i;
-
-	for (i = 0; i < m_len; i++, m_ad++) {
-		if (*m_ad != 0xff)
-			break;
-		h_num += 8;
-	}
-	if (i < m_len) {
-		switch (*m_ad) {
-#define	MASKLEN(m, l)	case m: h_num += l; break
-		MASKLEN(0xfe, 7);
-		MASKLEN(0xfc, 6);
-		MASKLEN(0xf8, 5);
-		MASKLEN(0xf0, 4);
-		MASKLEN(0xe0, 3);
-		MASKLEN(0xc0, 2);
-		MASKLEN(0x80, 1);
-#undef	MASKLEN
-		}
-	}
-	return h_num;
-}
-
-static int pl2m[9] = { 0x00, 0x80, 0xc0, 0xe0, 0xf0, 0xf8, 0xfc, 0xfe, 0xff };
-
-struct in6_addr *plen2mask(int n)
-{
-	static struct in6_addr ia;
-	u_char	*p;
-	int	i;
-
-	memset(&ia, 0, sizeof(struct in6_addr));
-	p = (u_char *)&ia;
-	for (i = 0; i < 16; i++, p++, n -= 8) {
-		if (n >= 8) {
-			*p = 0xff;
-			continue;
-		}
-		*p = pl2m[n];
-		break;
-	}
-	return &ia;
-}
-
-void
-print_port(prot, port, comma)
-	u_char  prot;
-	u_short port;
-	const char *comma;
-{
-	struct servent *se;
-	struct protoent *pe;
-	const char *protocol;
-	int printed = 0;
-
-	if (do_resolv) {
-		pe = getprotobynumber(prot);
-		if (pe)
-			protocol = pe->p_name;
-		else
-			protocol = NULL;
-
-		se = getservbyport(htons(port), protocol);
-		if (se) {
-			printf("%s%s", comma, se->s_name);
-			printed = 1;
-		}
-	}
-	if (!printed)
-		printf("%s%d",comma,port);
-}
-
-static void
-print_iface(char *key, union ip6_fw_if *un, int byname)
-{
-
-	if (byname) {
-		printf(" %s %s", key, un->fu_via_if.name);
-	} else if (!IN6_IS_ADDR_UNSPECIFIED(&un->fu_via_ip6)) {
-		printf(" %s %s", key, inet_ntop(AF_INET6,&un->fu_via_ip6,ntop_buf,sizeof(ntop_buf)));
-	} else
-		printf(" %s any", key);
-}
-
-static void
-print_reject_code(int code)
-{
-	struct icmpcode *ic;
-
-	for (ic = icmp6codes; ic->str; ic++)
-		if (ic->code == code) {
-			printf("%s", ic->str);
-			return;
-		}
-	printf("%u", code);
-}
-
-static void
-show_ip6fw(struct ip6_fw *chain)
-{
-	char *comma;
-	struct hostent *he;
-	struct protoent *pe;
-	int i, mb;
-	int nsp = IPV6_FW_GETNSRCP(chain);
-	int ndp = IPV6_FW_GETNDSTP(chain);
-
-	if (do_resolv)
-		setservent(1/*stayopen*/);
-
-	printf("%05u ", chain->fw_number);
-
-	if (do_acct)
-		printf("%10lu %10lu ",chain->fw_pcnt,chain->fw_bcnt);
-
-	if (do_time)
-	{
-		if (chain->timestamp)
-		{
-			char timestr[30];
-			time_t t = _long_to_time(chain->timestamp);
-
-			strcpy(timestr, ctime(&t));
-			*strchr(timestr, '\n') = '\0';
-			printf("%s ", timestr);
-		}
-		else
-			printf("                         ");
-	}
-
-	switch (chain->fw_flg & IPV6_FW_F_COMMAND)
-	{
-		case IPV6_FW_F_ACCEPT:
-			printf("allow");
-			break;
-		case IPV6_FW_F_DENY:
-			printf("deny");
-			break;
-		case IPV6_FW_F_COUNT:
-			printf("count");
-			break;
-		case IPV6_FW_F_DIVERT:
-			printf("divert %u", chain->fw_divert_port);
-			break;
-		case IPV6_FW_F_TEE:
-			printf("tee %u", chain->fw_divert_port);
-			break;
-		case IPV6_FW_F_SKIPTO:
-			printf("skipto %u", chain->fw_skipto_rule);
-			break;
-		case IPV6_FW_F_REJECT:
-			if (chain->fw_reject_code == IPV6_FW_REJECT_RST)
-				printf("reset");
-			else {
-				printf("unreach ");
-				print_reject_code(chain->fw_reject_code);
-			}
-			break;
-		default:
-			errx(EX_OSERR, "impossible");
-	}
-
-	if (chain->fw_flg & IPV6_FW_F_PRN)
-		printf(" log");
-
-	pe = getprotobynumber(chain->fw_prot);
-	if (pe)
-		printf(" %s", pe->p_name);
-	else
-		printf(" %u", chain->fw_prot);
-
-	printf(" from %s", chain->fw_flg & IPV6_FW_F_INVSRC ? "not " : "");
-
-	mb=mask_bits((u_char *)&chain->fw_smsk,sizeof(chain->fw_smsk));
-	if (mb==128 && do_resolv) {
-		he=gethostbyaddr((char *)&(chain->fw_src),sizeof(chain->fw_src),AF_INET6);
-		if (he==NULL) {
-			printf(inet_ntop(AF_INET6,&chain->fw_src,ntop_buf,sizeof(ntop_buf)));
-		} else
-			printf("%s",he->h_name);
-	} else {
-		if (mb!=128) {
-			if (mb == 0) {
-				printf("any");
-			} else {
-				printf(inet_ntop(AF_INET6,&chain->fw_src,ntop_buf,sizeof(ntop_buf)));
-				printf("/%d",mb);
-			}
-		} else
-			printf(inet_ntop(AF_INET6,&chain->fw_src,ntop_buf,sizeof(ntop_buf)));
-	}
-
-	if (chain->fw_prot == IPPROTO_TCP || chain->fw_prot == IPPROTO_UDP) {
-		comma = " ";
-		for (i = 0; i < nsp; i++) {
-			print_port(chain->fw_prot, chain->fw_pts[i], comma);
-			if (i==0 && (chain->fw_flg & IPV6_FW_F_SRNG))
-				comma = "-";
-			else
-				comma = ",";
-		}
-	}
-
-	printf(" to %s", chain->fw_flg & IPV6_FW_F_INVDST ? "not " : "");
-
-	mb=mask_bits((u_char *)&chain->fw_dmsk,sizeof(chain->fw_dmsk));
-	if (mb==128 && do_resolv) {
-		he=gethostbyaddr((char *)&(chain->fw_dst),sizeof(chain->fw_dst),AF_INET6);
-		if (he==NULL) {
-			printf(inet_ntop(AF_INET6,&chain->fw_dst,ntop_buf,sizeof(ntop_buf)));
-		} else
-			printf("%s",he->h_name);
-	} else {
-		if (mb!=128) {
-			if (mb == 0) {
-				printf("any");
-			} else {
-				printf(inet_ntop(AF_INET6,&chain->fw_dst,ntop_buf,sizeof(ntop_buf)));
-				printf("/%d",mb);
-			}
-		} else
-			printf(inet_ntop(AF_INET6,&chain->fw_dst,ntop_buf,sizeof(ntop_buf)));
-	}
-
-	if (chain->fw_prot == IPPROTO_TCP || chain->fw_prot == IPPROTO_UDP) {
-		comma = " ";
-		for (i = 0; i < ndp; i++) {
-			print_port(chain->fw_prot, chain->fw_pts[nsp+i], comma);
-			if (i==0 && (chain->fw_flg & IPV6_FW_F_DRNG))
-				comma = "-";
-			else
-				comma = ",";
-		}
-	}
-
-	/* Direction */
-	if ((chain->fw_flg & IPV6_FW_F_IN) && !(chain->fw_flg & IPV6_FW_F_OUT))
-		printf(" in");
-	if (!(chain->fw_flg & IPV6_FW_F_IN) && (chain->fw_flg & IPV6_FW_F_OUT))
-		printf(" out");
-
-	/* Handle hack for "via" backwards compatibility */
-	if ((chain->fw_flg & IF6_FW_F_VIAHACK) == IF6_FW_F_VIAHACK) {
-		print_iface("via",
-		    &chain->fw_in_if, chain->fw_flg & IPV6_FW_F_IIFNAME);
-	} else {
-		/* Receive interface specified */
-		if (chain->fw_flg & IPV6_FW_F_IIFACE)
-			print_iface("recv", &chain->fw_in_if,
-			    chain->fw_flg & IPV6_FW_F_IIFNAME);
-		/* Transmit interface specified */
-		if (chain->fw_flg & IPV6_FW_F_OIFACE)
-			print_iface("xmit", &chain->fw_out_if,
-			    chain->fw_flg & IPV6_FW_F_OIFNAME);
-	}
-
-	if (chain->fw_flg & IPV6_FW_F_FRAG)
-		printf(" frag");
-
-	if (chain->fw_ip6opt || chain->fw_ip6nopt) {
-		int 	_opt_printed = 0;
-#define	PRINTOPT(x)	{if (_opt_printed) printf(",");\
-			printf(x); _opt_printed = 1;}
-
-		printf(" ip6opt ");
-		if (chain->fw_ip6opt  & IPV6_FW_IP6OPT_HOPOPT) PRINTOPT("hopopt");
-		if (chain->fw_ip6nopt & IPV6_FW_IP6OPT_HOPOPT) PRINTOPT("!hopopt");
-		if (chain->fw_ip6opt  & IPV6_FW_IP6OPT_ROUTE)  PRINTOPT("route");
-		if (chain->fw_ip6nopt & IPV6_FW_IP6OPT_ROUTE)  PRINTOPT("!route");
-		if (chain->fw_ip6opt  & IPV6_FW_IP6OPT_FRAG)  PRINTOPT("frag");
-		if (chain->fw_ip6nopt & IPV6_FW_IP6OPT_FRAG)  PRINTOPT("!frag");
-		if (chain->fw_ip6opt  & IPV6_FW_IP6OPT_ESP)    PRINTOPT("esp");
-		if (chain->fw_ip6nopt & IPV6_FW_IP6OPT_ESP)    PRINTOPT("!esp");
-		if (chain->fw_ip6opt  & IPV6_FW_IP6OPT_AH)     PRINTOPT("ah");
-		if (chain->fw_ip6nopt & IPV6_FW_IP6OPT_AH)     PRINTOPT("!ah");
-		if (chain->fw_ip6opt  & IPV6_FW_IP6OPT_NONXT)  PRINTOPT("nonxt");
-		if (chain->fw_ip6nopt & IPV6_FW_IP6OPT_NONXT)  PRINTOPT("!nonxt");
-		if (chain->fw_ip6opt  & IPV6_FW_IP6OPT_OPTS)   PRINTOPT("opts");
-		if (chain->fw_ip6nopt & IPV6_FW_IP6OPT_OPTS)   PRINTOPT("!opts");
-	}
-
-	if (chain->fw_ipflg & IPV6_FW_IF_TCPEST)
-		printf(" established");
-	else if (chain->fw_tcpf == IPV6_FW_TCPF_SYN &&
-	    chain->fw_tcpnf == IPV6_FW_TCPF_ACK)
-		printf(" setup");
-	else if (chain->fw_tcpf || chain->fw_tcpnf) {
-		int 	_flg_printed = 0;
-#define	PRINTFLG(x)	{if (_flg_printed) printf(",");\
-			printf(x); _flg_printed = 1;}
-
-		printf(" tcpflg ");
-		if (chain->fw_tcpf  & IPV6_FW_TCPF_FIN)  PRINTFLG("fin");
-		if (chain->fw_tcpnf & IPV6_FW_TCPF_FIN)  PRINTFLG("!fin");
-		if (chain->fw_tcpf  & IPV6_FW_TCPF_SYN)  PRINTFLG("syn");
-		if (chain->fw_tcpnf & IPV6_FW_TCPF_SYN)  PRINTFLG("!syn");
-		if (chain->fw_tcpf  & IPV6_FW_TCPF_RST)  PRINTFLG("rst");
-		if (chain->fw_tcpnf & IPV6_FW_TCPF_RST)  PRINTFLG("!rst");
-		if (chain->fw_tcpf  & IPV6_FW_TCPF_PSH)  PRINTFLG("psh");
-		if (chain->fw_tcpnf & IPV6_FW_TCPF_PSH)  PRINTFLG("!psh");
-		if (chain->fw_tcpf  & IPV6_FW_TCPF_ACK)  PRINTFLG("ack");
-		if (chain->fw_tcpnf & IPV6_FW_TCPF_ACK)  PRINTFLG("!ack");
-		if (chain->fw_tcpf  & IPV6_FW_TCPF_URG)  PRINTFLG("urg");
-		if (chain->fw_tcpnf & IPV6_FW_TCPF_URG)  PRINTFLG("!urg");
-	}
-	if (chain->fw_flg & IPV6_FW_F_ICMPBIT) {
-		int type_index;
-		int first = 1;
-
-		printf(" icmptype");
-
-		for (type_index = 0; type_index < IPV6_FW_ICMPTYPES_DIM * sizeof(unsigned) * 8; ++type_index)
-			if (chain->fw_icmp6types[type_index / (sizeof(unsigned) * 8)] &
-				(1U << (type_index % (sizeof(unsigned) * 8)))) {
-				printf("%c%d", first == 1 ? ' ' : ',', type_index);
-				first = 0;
-			}
-	}
-	printf("\n");
-	if (do_resolv)
-		endservent();
-}
-
-void
-list(ac, av)
-	int	ac;
-	char 	**av;
-{
-	struct ip6_fw *r, *rules, *n;
-	int l,i;
-	unsigned long rulenum;
-	int nalloc, bytes, maxbytes;
-
-	/* extract rules from kernel, resizing array as necessary */
-	rules = NULL;
-	nalloc = sizeof *rules;
-	bytes = nalloc;
-	maxbytes = 65536 * sizeof *rules;
-	while (bytes >= nalloc) {
-		if ((n = realloc(rules, nalloc * 2 + 200)) == NULL)
-			err(EX_OSERR, "realloc");
-		bytes = nalloc = nalloc * 2 + 200;
-		rules = n;
-		i = getsockopt(s, IPPROTO_IPV6, IPV6_FW_GET, rules, &bytes);
-		if ((i < 0 && errno != EINVAL) || nalloc > maxbytes)
-			err(EX_OSERR, "getsockopt(IPV6_FW_GET)");
-	}
-	if (!ac) {
-		/* display all rules */
-		for (r = rules, l = bytes; l >= sizeof rules[0];
-			 r++, l-=sizeof rules[0])
-			show_ip6fw(r);
-	}
-	else {
-		/* display specific rules requested on command line */
-		int exitval = 0;
-
-		while (ac--) {
-			char *endptr;
-			int seen;
-
-			/* convert command line rule # */
-			rulenum = strtoul(*av++, &endptr, 10);
-			if (*endptr) {
-				exitval = 1;
-				warn("invalid rule number: %s", av[-1]);
-				continue;
-			}
-			seen = 0;
-			for (r = rules, l = bytes;
-				 l >= sizeof rules[0] && r->fw_number <= rulenum;
-				 r++, l-=sizeof rules[0])
-				if (rulenum == r->fw_number) {
-					show_ip6fw(r);
-					seen = 1;
-				}
-			if (!seen) {
-				exitval = 1;
-				warnx("rule %lu does not exist", rulenum);
-			}
-		}
-		if (exitval != 0)
-			exit(exitval);
-	}
-}
-
-static void
-show_usage(const char *fmt, ...)
-{
-	if (fmt) {
-		char buf[100];
-		va_list args;
-
-		va_start(args, fmt);
-		vsnprintf(buf, sizeof(buf), fmt, args);
-		va_end(args);
-		warnx("error: %s", buf);
-	}
-	fprintf(stderr, "usage: ip6fw [options]\n"
-"    flush\n"
-"    add [number] rule\n"
-"    delete number ...\n"
-"    list [number ...]\n"
-"    show [number ...]\n"
-"    zero [number ...]\n"
-"  rule:  action proto src dst extras...\n"
-"    action:\n"
-"      {allow|permit|accept|pass|deny|drop|reject|unreach code|\n"
-"       reset|count|skipto num} [log]\n"
-"    proto: {ipv6|tcp|udp|ipv6-icmp|<number>}\n"
-"    src: from [not] {any|ipv6[/prefixlen]} [{port|port-port},[port],...]\n"
-"    dst: to [not] {any|ipv6[/prefixlen]} [{port|port-port},[port],...]\n"
-"  extras:\n"
-"    fragment     (may not be used with ports or tcpflags)\n"
-"    in\n"
-"    out\n"
-"    {xmit|recv|via} {iface|ipv6|any}\n"
-"    {established|setup}\n"
-"    tcpflags [!]{syn|fin|rst|ack|psh|urg},...\n"
-"    ipv6options [!]{hopopt|route|frag|esp|ah|nonxt|opts},...\n"
-"    icmptypes {type[,type]}...\n");
-
-	exit(1);
-}
-
-static int
-lookup_host (host, addr, family)
-	char *host;
-	u_char *addr;
-	int family;
-{
-	struct hostent *he;
-
-	if (inet_pton(family, host, addr) != 1) {
-		if ((he = gethostbyname2(host, family)) == NULL)
-			return(-1);
-		memcpy(addr, he->h_addr_list[0], he->h_length);
-	}	
-	return(0);
-}
-
-void
-fill_ip6(ipno, mask, acp, avp)
-	struct in6_addr *ipno, *mask;
-	int *acp;
-	char ***avp;
-{
-	int ac = *acp;
-	char **av = *avp;
-	char *p = 0, md = 0;
-	int i;
-
-	if (ac && !strncmp(*av,"any",strlen(*av))) {
-		*ipno = *mask = in6addr_any; av++; ac--;
-	} else {
-		p = strchr(*av, '/');
-		if (p) {
-			md = *p;
-			*p++ = '\0';
-		}
-
-		if (lookup_host(*av, (u_char *)ipno, AF_INET6) != 0)
-			show_usage("hostname ``%s'' unknown", *av);
-		switch (md) {
-			case '/':
-				if (atoi(p) == 0) {
-					*mask = in6addr_any;
-				} else if (atoi(p) > 128) {
-					show_usage("bad width ``%s''", p);
-				} else {
-					*mask = *(plen2mask(atoi(p)));
-				}
-				break;
-			default:
-				*mask = *(plen2mask(128));
-				break;
-		}
-		for (i = 0; i < sizeof(*ipno); i++)
-			ipno->s6_addr[i] &= mask->s6_addr[i];
-		av++;
-		ac--;
-	}
-	*acp = ac;
-	*avp = av;
-}
-
-static void
-fill_reject_code6(u_short *codep, char *str)
-{
-	struct icmpcode *ic;
-	u_long val;
-	char *s;
-
-	val = strtoul(str, &s, 0);
-	if (s != str && *s == '\0' && val < 0x100) {
-		*codep = val;
-		return;
-	}
-	for (ic = icmp6codes; ic->str; ic++)
-		if (!strcasecmp(str, ic->str)) {
-			*codep = ic->code;
-			return;
-		}
-	show_usage("unknown ICMP6 unreachable code ``%s''", str);
-}
-
-static void
-add_port(cnt, ptr, off, port)
-	u_short *cnt, *ptr, off, port;
-{
-	if (off + *cnt >= IPV6_FW_MAX_PORTS)
-		errx(1, "too many ports (max is %d)", IPV6_FW_MAX_PORTS);
-	ptr[off+*cnt] = port;
-	(*cnt)++;
-}
-
-static int
-lookup_port(const char *arg, int test, int nodash)
-{
-	int		val;
-	char		*earg, buf[32];
-	struct servent	*s;
-
-	snprintf(buf, sizeof(buf), "%s", arg);
-	buf[strcspn(arg, nodash ? "-," : ",")] = 0;
-	val = (int) strtoul(buf, &earg, 0);
-	if (!*buf || *earg) {
-		setservent(1);
-		if ((s = getservbyname(buf, NULL))) {
-			val = htons(s->s_port);
-		} else {
-			if (!test) {
-				errx(1, "unknown port ``%s''", arg);
-			}
-			val = -1;
-		}
-	} else {
-		if (val < 0 || val > 0xffff) {
-			if (!test) {
-				errx(1, "port ``%s'' out of range", arg);
-			}
-			val = -1;
-		}
-	}
-	return(val);
-}
-
-int
-fill_port(cnt, ptr, off, arg)
-	u_short *cnt, *ptr, off;
-	char *arg;
-{
-	char *s;
-	int initial_range = 0;
-
-	s = arg + strcspn(arg, "-,");	/* first port name can't have a dash */
-	if (*s == '-') {
-		*s++ = '\0';
-		if (strchr(arg, ','))
-			errx(1, "port range must be first in list");
-		add_port(cnt, ptr, off, *arg ? lookup_port(arg, 0, 0) : 0x0000);
-		arg = s;
-		s = strchr(arg,',');
-		if (s)
-			*s++ = '\0';
-		add_port(cnt, ptr, off, *arg ? lookup_port(arg, 0, 0) : 0xffff);
-		arg = s;
-		initial_range = 1;
-	}
-	while (arg != NULL) {
-		s = strchr(arg,',');
-		if (s)
-			*s++ = '\0';
-		add_port(cnt, ptr, off, lookup_port(arg, 0, 0));
-		arg = s;
-	}
-	return initial_range;
-}
-
-void
-fill_tcpflag(set, reset, vp)
-	u_char *set, *reset;
-	char **vp;
-{
-	char *p = *vp,*q;
-	u_char *d;
-
-	while (p && *p) {
-		struct tpcflags {
-			char * name;
-			u_char value;
-		} flags[] = {
-			{ "syn", IPV6_FW_TCPF_SYN },
-			{ "fin", IPV6_FW_TCPF_FIN },
-			{ "ack", IPV6_FW_TCPF_ACK },
-			{ "psh", IPV6_FW_TCPF_PSH },
-			{ "rst", IPV6_FW_TCPF_RST },
-			{ "urg", IPV6_FW_TCPF_URG }
-		};
-		int i;
-
-		if (*p == '!') {
-			p++;
-			d = reset;
-		} else {
-			d = set;
-		}
-		q = strchr(p, ',');
-		if (q)
-			*q++ = '\0';
-		for (i = 0; i < sizeof(flags) / sizeof(flags[0]); ++i)
-			if (!strncmp(p, flags[i].name, strlen(p))) {
-				*d |= flags[i].value;
-				break;
-			}
-		if (i == sizeof(flags) / sizeof(flags[0]))
-			show_usage("invalid tcp flag ``%s''", p);
-		p = q;
-	}
-}
-
-static void
-fill_ip6opt(u_char *set, u_char *reset, char **vp)
-{
-	char *p = *vp,*q;
-	u_char *d;
-
-	while (p && *p) {
-		if (*p == '!') {
-			p++;
-			d = reset;
-		} else {
-			d = set;
-		}
-		q = strchr(p, ',');
-		if (q)
-			*q++ = '\0';
-		if (!strncmp(p,"hopopt",strlen(p))) *d |= IPV6_FW_IP6OPT_HOPOPT;
-		if (!strncmp(p,"route",strlen(p)))  *d |= IPV6_FW_IP6OPT_ROUTE;
-		if (!strncmp(p,"frag",strlen(p)))   *d |= IPV6_FW_IP6OPT_FRAG;
-		if (!strncmp(p,"esp",strlen(p)))    *d |= IPV6_FW_IP6OPT_ESP;
-		if (!strncmp(p,"ah",strlen(p)))     *d |= IPV6_FW_IP6OPT_AH;
-		if (!strncmp(p,"nonxt",strlen(p)))  *d |= IPV6_FW_IP6OPT_NONXT;
-		if (!strncmp(p,"opts",strlen(p)))   *d |= IPV6_FW_IP6OPT_OPTS;
-		p = q;
-	}
-}
-
-void
-fill_icmptypes(types, vp, fw_flg)
-	u_long *types;
-	char **vp;
-	u_short *fw_flg;
-{
-	char *c = *vp;
-
-	while (*c)
-	{
-		unsigned long icmptype;
-
-		if ( *c == ',' )
-			++c;
-
-		icmptype = strtoul(c, &c, 0);
-
-		if ( *c != ',' && *c != '\0' )
-			show_usage("invalid ICMP6 type");
-
-		if (icmptype >= IPV6_FW_ICMPTYPES_DIM * sizeof(unsigned) * 8)
-			show_usage("ICMP6 type out of range");
-
-		types[icmptype / (sizeof(unsigned) * 8)] |=
-			1 << (icmptype % (sizeof(unsigned) * 8));
-		*fw_flg |= IPV6_FW_F_ICMPBIT;
-	}
-}
-
-void
-delete(ac,av)
-	int ac;
-	char **av;
-{
-	struct ip6_fw rule;
-	int i;
-	int exitval = 0;
-
-	memset(&rule, 0, sizeof rule);
-
-	av++; ac--;
-
-	/* Rule number */
-	while (ac && isdigit(**av)) {
-		rule.fw_number = atoi(*av); av++; ac--;
-		if (!do_test) {
-			i = setsockopt(s, IPPROTO_IPV6, IPV6_FW_DEL, &rule, sizeof rule);
-			if (i) {
-				exitval = 1;
-				warn("rule %u: setsockopt(%s)", rule.fw_number, "IPV6_FW_DEL");
-			}
-		}
-	}
-	if (exitval != 0)
-		exit(exitval);
-}
-
-static void
-verify_interface(union ip6_fw_if *ifu)
-{
-	struct ifreq ifr;
-
-	strlcpy(ifr.ifr_name, ifu->fu_via_if.name, sizeof(ifr.ifr_name));
-
-	if (ioctl(s, SIOCGIFFLAGS, &ifr) < 0)
-		warnx("warning: interface ``%s'' does not exist", ifr.ifr_name);
-}
-
-static void
-fill_iface(char *which, union ip6_fw_if *ifu, int *byname, int ac, char *arg)
-{
-	if (!ac)
-	    show_usage("missing argument for ``%s''", which);
-
-	/* Parse the interface or address */
-	if (!strcmp(arg, "any")) {
-		ifu->fu_via_ip6 = in6addr_any;
-		*byname = 0;
-	} else if (!isdigit(*arg)) {
-		*byname = 1;
-		strlcpy(ifu->fu_via_if.name, arg, sizeof(ifu->fu_via_if.name));
-		/*
-		 * We assume that strings containing '*', '?', or '['
-		 * are ment to be shell pattern.
-		 */
-		if (strpbrk(arg, "*?[") != NULL) {
-			ifu->fu_via_if.glob = 1;
-		} else {
-			ifu->fu_via_if.glob = 0;
-			verify_interface(ifu);
-		}
-	} else if (inet_pton(AF_INET6, arg, &ifu->fu_via_ip6) != 1) {
-		show_usage("bad ip6 address ``%s''", arg);
-	} else
-		*byname = 0;
-}
-
-static void
-add(ac,av)
-	int ac;
-	char **av;
-{
-	struct ip6_fw rule;
-	int i;
-	u_char proto;
-	struct protoent *pe;
-	int saw_xmrc = 0, saw_via = 0;
-
-	memset(&rule, 0, sizeof rule);
-
-	av++; ac--;
-
-	/* Rule number */
-	if (ac && isdigit(**av)) {
-		rule.fw_number = atoi(*av); av++; ac--;
-	}
-
-	/* Action */
-	if (ac == 0)
-		show_usage("missing action");
-	if (!strncmp(*av,"accept",strlen(*av))
-		    || !strncmp(*av,"pass",strlen(*av))
-		    || !strncmp(*av,"allow",strlen(*av))
-		    || !strncmp(*av,"permit",strlen(*av))) {
-		rule.fw_flg |= IPV6_FW_F_ACCEPT; av++; ac--;
-	} else if (!strncmp(*av,"count",strlen(*av))) {
-		rule.fw_flg |= IPV6_FW_F_COUNT; av++; ac--;
-	}
-#if 0
-	else if (!strncmp(*av,"divert",strlen(*av))) {
-		rule.fw_flg |= IPV6_FW_F_DIVERT; av++; ac--;
-		if (!ac)
-			show_usage("missing divert port");
-		rule.fw_divert_port = strtoul(*av, NULL, 0); av++; ac--;
-		if (rule.fw_divert_port == 0) {
-			struct servent *s;
-			setservent(1);
-			s = getservbyname(av[-1], "divert");
-			if (s != NULL)
-				rule.fw_divert_port = ntohs(s->s_port);
-			else
-				show_usage("illegal divert port");
-		}
-	} else if (!strncmp(*av,"tee",strlen(*av))) {
-		rule.fw_flg |= IPV6_FW_F_TEE; av++; ac--;
-		if (!ac)
-			show_usage("missing divert port");
-		rule.fw_divert_port = strtoul(*av, NULL, 0); av++; ac--;
-		if (rule.fw_divert_port == 0) {
-			struct servent *s;
-			setservent(1);
-			s = getservbyname(av[-1], "divert");
-			if (s != NULL)
-				rule.fw_divert_port = ntohs(s->s_port);
-			else
-				show_usage("illegal divert port");
-		}
-	}
-#endif
-	else if (!strncmp(*av,"skipto",strlen(*av))) {
-		rule.fw_flg |= IPV6_FW_F_SKIPTO; av++; ac--;
-		if (!ac)
-			show_usage("missing skipto rule number");
-		rule.fw_skipto_rule = strtoul(*av, NULL, 0); av++; ac--;
-	} else if ((!strncmp(*av,"deny",strlen(*av))
-		    || !strncmp(*av,"drop",strlen(*av)))) {
-		rule.fw_flg |= IPV6_FW_F_DENY; av++; ac--;
-	} else if (!strncmp(*av,"reject",strlen(*av))) {
-		rule.fw_flg |= IPV6_FW_F_REJECT; av++; ac--;
-		rule.fw_reject_code = ICMP6_DST_UNREACH_NOROUTE;
-	} else if (!strncmp(*av,"reset",strlen(*av))) {
-		rule.fw_flg |= IPV6_FW_F_REJECT; av++; ac--;
-		rule.fw_reject_code = IPV6_FW_REJECT_RST;	/* check TCP later */
-	} else if (!strncmp(*av,"unreach",strlen(*av))) {
-		rule.fw_flg |= IPV6_FW_F_REJECT; av++; ac--;
-		fill_reject_code6(&rule.fw_reject_code, *av); av++; ac--;
-	} else {
-		show_usage("invalid action ``%s''", *av);
-	}
-
-	/* [log] */
-	if (ac && !strncmp(*av,"log",strlen(*av))) {
-		rule.fw_flg |= IPV6_FW_F_PRN; av++; ac--;
-	}
-
-	/* protocol */
-	if (ac == 0)
-		show_usage("missing protocol");
-	if ((proto = atoi(*av)) > 0) {
-		rule.fw_prot = proto; av++; ac--;
-	} else if (!strncmp(*av,"all",strlen(*av))) {
-		rule.fw_prot = IPPROTO_IPV6; av++; ac--;
-	} else if ((pe = getprotobyname(*av)) != NULL) {
-		rule.fw_prot = pe->p_proto; av++; ac--;
-	} else {
-		show_usage("invalid protocol ``%s''", *av);
-	}
-
-	if (rule.fw_prot != IPPROTO_TCP
-	    && (rule.fw_flg & IPV6_FW_F_COMMAND) == IPV6_FW_F_REJECT
-	    && rule.fw_reject_code == IPV6_FW_REJECT_RST)
-		show_usage("``reset'' is only valid for tcp packets");
-
-	/* from */
-	if (ac && !strncmp(*av,"from",strlen(*av))) { av++; ac--; }
-	else
-		show_usage("missing ``from''");
-
-	if (ac && !strncmp(*av,"not",strlen(*av))) {
-		rule.fw_flg |= IPV6_FW_F_INVSRC;
-		av++; ac--;
-	}
-	if (!ac)
-		show_usage("missing arguments");
-
-	fill_ip6(&rule.fw_src, &rule.fw_smsk, &ac, &av);
-
-	if (ac && (isdigit(**av) || lookup_port(*av, 1, 1) >= 0)) {
-		u_short nports = 0;
-
-		if (fill_port(&nports, rule.fw_pts, 0, *av))
-			rule.fw_flg |= IPV6_FW_F_SRNG;
-		IPV6_FW_SETNSRCP(&rule, nports);
-		av++; ac--;
-	}
-
-	/* to */
-	if (ac && !strncmp(*av,"to",strlen(*av))) { av++; ac--; }
-	else
-		show_usage("missing ``to''");
-
-	if (ac && !strncmp(*av,"not",strlen(*av))) {
-		rule.fw_flg |= IPV6_FW_F_INVDST;
-		av++; ac--;
-	}
-	if (!ac)
-		show_usage("missing arguments");
-
-	fill_ip6(&rule.fw_dst, &rule.fw_dmsk, &ac, &av);
-
-	if (ac && (isdigit(**av) || lookup_port(*av, 1, 1) >= 0)) {
-		u_short	nports = 0;
-
-		if (fill_port(&nports,
-		    rule.fw_pts, IPV6_FW_GETNSRCP(&rule), *av))
-			rule.fw_flg |= IPV6_FW_F_DRNG;
-		IPV6_FW_SETNDSTP(&rule, nports);
-		av++; ac--;
-	}
-
-	if ((rule.fw_prot != IPPROTO_TCP) && (rule.fw_prot != IPPROTO_UDP)
-	    && (IPV6_FW_GETNSRCP(&rule) || IPV6_FW_GETNDSTP(&rule))) {
-		show_usage("only TCP and UDP protocols are valid"
-		    " with port specifications");
-	}
-
-	while (ac) {
-		if (!strncmp(*av,"in",strlen(*av))) {
-			rule.fw_flg |= IPV6_FW_F_IN;
-			av++; ac--; continue;
-		}
-		if (!strncmp(*av,"out",strlen(*av))) {
-			rule.fw_flg |= IPV6_FW_F_OUT;
-			av++; ac--; continue;
-		}
-		if (ac && !strncmp(*av,"xmit",strlen(*av))) {
-			union ip6_fw_if ifu;
-			int byname;
-
-			if (saw_via) {
-badviacombo:
-				show_usage("``via'' is incompatible"
-				    " with ``xmit'' and ``recv''");
-			}
-			saw_xmrc = 1;
-			av++; ac--;
-			fill_iface("xmit", &ifu, &byname, ac, *av);
-			rule.fw_out_if = ifu;
-			rule.fw_flg |= IPV6_FW_F_OIFACE;
-			if (byname)
-				rule.fw_flg |= IPV6_FW_F_OIFNAME;
-			av++; ac--; continue;
-		}
-		if (ac && !strncmp(*av,"recv",strlen(*av))) {
-			union ip6_fw_if ifu;
-			int byname;
-
-			if (saw_via)
-				goto badviacombo;
-			saw_xmrc = 1;
-			av++; ac--;
-			fill_iface("recv", &ifu, &byname, ac, *av);
-			rule.fw_in_if = ifu;
-			rule.fw_flg |= IPV6_FW_F_IIFACE;
-			if (byname)
-				rule.fw_flg |= IPV6_FW_F_IIFNAME;
-			av++; ac--; continue;
-		}
-		if (ac && !strncmp(*av,"via",strlen(*av))) {
-			union ip6_fw_if ifu;
-			int byname = 0;
-
-			if (saw_xmrc)
-				goto badviacombo;
-			saw_via = 1;
-			av++; ac--;
-			fill_iface("via", &ifu, &byname, ac, *av);
-			rule.fw_out_if = rule.fw_in_if = ifu;
-			if (byname)
-				rule.fw_flg |=
-				    (IPV6_FW_F_IIFNAME | IPV6_FW_F_OIFNAME);
-			av++; ac--; continue;
-		}
-		if (!strncmp(*av,"fragment",strlen(*av))) {
-			rule.fw_flg |= IPV6_FW_F_FRAG;
-			av++; ac--; continue;
-		}
-		if (!strncmp(*av,"ipv6options",strlen(*av))) {
-			av++; ac--;
-			if (!ac)
-				show_usage("missing argument"
-				    " for ``ipv6options''");
-			fill_ip6opt(&rule.fw_ip6opt, &rule.fw_ip6nopt, av);
-			av++; ac--; continue;
-		}
-		if (rule.fw_prot == IPPROTO_TCP) {
-			if (!strncmp(*av,"established",strlen(*av))) {
-				rule.fw_ipflg |= IPV6_FW_IF_TCPEST;
-				av++; ac--; continue;
-			}
-			if (!strncmp(*av,"setup",strlen(*av))) {
-				rule.fw_tcpf  |= IPV6_FW_TCPF_SYN;
-				rule.fw_tcpnf  |= IPV6_FW_TCPF_ACK;
-				av++; ac--; continue;
-			}
-			if (!strncmp(*av,"tcpflags",strlen(*av))) {
-				av++; ac--;
-				if (!ac)
-					show_usage("missing argument"
-					    " for ``tcpflags''");
-				fill_tcpflag(&rule.fw_tcpf, &rule.fw_tcpnf, av);
-				av++; ac--; continue;
-			}
-		}
-		if (rule.fw_prot == IPPROTO_ICMPV6) {
-			if (!strncmp(*av,"icmptypes",strlen(*av))) {
-				av++; ac--;
-				if (!ac)
-					show_usage("missing argument"
-					    " for ``icmptypes''");
-				fill_icmptypes(rule.fw_icmp6types,
-				    av, &rule.fw_flg);
-				av++; ac--; continue;
-			}
-		}
-		show_usage("unknown argument ``%s''", *av);
-	}
-
-	/* No direction specified -> do both directions */
-	if (!(rule.fw_flg & (IPV6_FW_F_OUT|IPV6_FW_F_IN)))
-		rule.fw_flg |= (IPV6_FW_F_OUT|IPV6_FW_F_IN);
-
-	/* Sanity check interface check, but handle "via" case separately */
-	if (saw_via) {
-		if (rule.fw_flg & IPV6_FW_F_IN)
-			rule.fw_flg |= IPV6_FW_F_IIFACE;
-		if (rule.fw_flg & IPV6_FW_F_OUT)
-			rule.fw_flg |= IPV6_FW_F_OIFACE;
-	} else if ((rule.fw_flg & IPV6_FW_F_OIFACE) && (rule.fw_flg & IPV6_FW_F_IN))
-		show_usage("can't check xmit interface of incoming packets");
-
-	/* frag may not be used in conjunction with ports or TCP flags */
-	if (rule.fw_flg & IPV6_FW_F_FRAG) {
-		if (rule.fw_tcpf || rule.fw_tcpnf)
-			show_usage("can't mix 'frag' and tcpflags");
-
-		if (rule.fw_nports)
-			show_usage("can't mix 'frag' and port specifications");
-	}
-
-	if (!do_quiet)
-		show_ip6fw(&rule);
-	if (!do_test) {
-		i = setsockopt(s, IPPROTO_IPV6, IPV6_FW_ADD, &rule, sizeof rule);
-		if (i)
-			err(EX_UNAVAILABLE, "setsockopt(%s)", "IPV6_FW_ADD");
-	}
-}
-
-static void
-zero (ac, av)
-	int ac;
-	char **av;
-{
-	av++; ac--;
-
-	if (!ac) {
-		/* clear all entries */
-		if (!do_test) {
-			if (setsockopt(s,IPPROTO_IPV6,IPV6_FW_ZERO,NULL,0)<0)
-				err(EX_UNAVAILABLE, "setsockopt(%s)", "IPV6_FW_ZERO");
-			if (!do_quiet)
-				printf("Accounting cleared.\n");
-		} else if (!do_quiet)
-			printf("Accounting not cleared.\n");
-	} else {
-		struct ip6_fw rule;
-		int failed = 0;
-
-		memset(&rule, 0, sizeof rule);
-		while (ac) {
-			/* Rule number */
-			if (isdigit(**av)) {
-				rule.fw_number = atoi(*av); av++; ac--;
-				if (!do_test) {
-					if (setsockopt(s, IPPROTO_IPV6,
-				    		IPV6_FW_ZERO, &rule, sizeof rule)) {
-						warn("rule %u: setsockopt(%s)", rule.fw_number,"IPV6_FW_ZERO");
-						failed = 1;
-					}
-					if (!do_quiet)
-						printf("Entry %d cleared\n",
-					    		rule.fw_number);
-				}
-				else if (!do_quiet)
-					printf("Entry %d not cleared\n",
-						rule.fw_number);
-			} else
-				show_usage("invalid rule number ``%s''", *av);
-		}
-		if (failed != 0)
-			exit(failed);
-	}
-}
-
-int
-ip6fw_main(ac,av)
-	int 	ac;
-	char 	**av;
-{
-	int 		ch;
-
-	/* init optind to 1 */
-	optind = 1;
-
-	if ( ac == 1 ) {
-		show_usage(NULL);
-	}
-
-	/* Set the force flag for non-interactive processes */
-	do_force = !isatty(STDIN_FILENO);
-
-	while ((ch = getopt(ac, av ,"afnqtN")) != -1)
-	switch(ch) {
-		case 'a':
-			do_acct=1;
-			break;
-		case 'f':
-			do_force=1;
-			break;
-		case 'n':
-			do_test=1;
-			break;
-		case 'q':
-			do_quiet=1;
-			break;
-		case 't':
-			do_time=1;
-			break;
-		case 'N':
-	 		do_resolv=1;
-			break;
-		default:
-			show_usage(NULL);
-	}
-
-	ac -= optind;
-	if (*(av+=optind)==NULL) {
-		 show_usage("Bad arguments");
-	}
-
-	if (!strncmp(*av, "add", strlen(*av))) {
-		add(ac,av);
-	} else if (!strncmp(*av, "delete", strlen(*av))) {
-		delete(ac,av);
-	} else if (!strncmp(*av, "flush", strlen(*av))) {
-		int do_flush = 0;
-
-		if ( do_force || do_quiet )
-			do_flush = 1;
-		else {
-			int c;
-
-			/* Ask the user */
-			printf("Are you sure? [yn] ");
-			do {
-                    		fflush(stdout);
-				c = toupper(getc(stdin));
-				while (c != '\n' && getc(stdin) != '\n')
-					if (feof(stdin))
-						return (0);
-			} while (c != 'Y' && c != 'N');
-			printf("\n");
-			if (c == 'Y')
-				do_flush = 1;
-		}
-		if ( do_flush ) {
-			if (!do_test) {
-				if (setsockopt(s,IPPROTO_IPV6,IPV6_FW_FLUSH,NULL,0) < 0)
-					err(EX_UNAVAILABLE, "setsockopt(%s)", "IPV6_FW_FLUSH");
-			
-				if (!do_quiet)
-					printf("Flushed all rules.\n");
-			} else if (!do_quiet)
-				printf("Rules not flushed.\n");
-		}
-	} else if (!strncmp(*av, "zero", strlen(*av))) {
-		zero(ac,av);
-	} else if (!strncmp(*av, "print", strlen(*av))) {
-		list(--ac,++av);
-	} else if (!strncmp(*av, "list", strlen(*av))) {
-		list(--ac,++av);
-	} else if (!strncmp(*av, "show", strlen(*av))) {
-		do_acct++;
-		list(--ac,++av);
-	} else {
-		show_usage("Bad arguments");
-	}
-	return 0;
-}
-
-int
-main(ac, av)
-	int	ac;
-	char	**av;
-{
-#define	MAX_ARGS	32
-#define	WHITESP		" \t\f\v\n\r"
-	char	buf[BUFSIZ];
-	char	*a, *p, *args[MAX_ARGS], *cmd = NULL;
-	char	linename[10];
-	int 	i, c, lineno, nflag, qflag, pflag, status;
-	FILE	*f = NULL;
-	pid_t	preproc = 0;
-
-	s = socket( AF_INET6, SOCK_RAW, IPPROTO_RAW );
-	if ( s < 0 )
-		err(EX_UNAVAILABLE, "socket");
-
-	setbuf(stdout,0);
-
-	/*
-	 * Only interpret the last command line argument as a file to
-	 * be preprocessed if it is specified as an absolute pathname.
-	 */
-
-	if (ac > 1 && av[ac - 1][0] == '/' && access(av[ac - 1], R_OK) == 0) {
-		nflag = qflag = pflag = i = 0;
-		lineno = 0;
-
-		while ((c = getopt(ac, av, "D:U:np:q")) != -1)
-			switch(c) {
-			case 'D':
-				if (!pflag)
-					errx(EX_USAGE, "-D requires -p");
-				if (i > MAX_ARGS - 2)
-					errx(EX_USAGE,
-					     "too many -D or -U options");
-				args[i++] = "-D";
-				args[i++] = optarg;
-				break;
-
-			case 'U':
-				if (!pflag)
-					errx(EX_USAGE, "-U requires -p");
-				if (i > MAX_ARGS - 2)
-					errx(EX_USAGE,
-					     "too many -D or -U options");
-				args[i++] = "-U";
-				args[i++] = optarg;
-				break;
-
-			case 'n':
-				nflag = 1;
-				break;
-
-			case 'p':
-				pflag = 1;
-				cmd = optarg;
-				args[0] = cmd;
-				i = 1;
-				break;
-
-			case 'q':
-				qflag = 1;
-				break;
-
-			default:
-				show_usage(NULL);
-			}
-
-		av += optind;
-		ac -= optind;
-		if (ac != 1)
-			show_usage("extraneous filename arguments");
-
-		if ((f = fopen(av[0], "r")) == NULL)
-			err(EX_UNAVAILABLE, "fopen: %s", av[0]);
-
-		if (pflag) {
-			/* pipe through preprocessor (cpp or m4) */
-			int pipedes[2];
-
-			args[i] = 0;
-
-			if (pipe(pipedes) == -1)
-				err(EX_OSERR, "cannot create pipe");
-
-			switch((preproc = fork())) {
-			case -1:
-				err(EX_OSERR, "cannot fork");
-
-			case 0:
-				/* child */
-				if (dup2(fileno(f), 0) == -1 ||
-				    dup2(pipedes[1], 1) == -1)
-					err(EX_OSERR, "dup2()");
-				fclose(f);
-				close(pipedes[1]);
-				close(pipedes[0]);
-				execvp(cmd, args);
-				err(EX_OSERR, "execvp(%s) failed", cmd);
-
-			default:
-				/* parent */
-				fclose(f);
-				close(pipedes[1]);
-				if ((f = fdopen(pipedes[0], "r")) == NULL) {
-					int savederrno = errno;
-
-					(void)kill(preproc, SIGTERM);
-					errno = savederrno;
-					err(EX_OSERR, "fdopen()");
-				}
-			}
-		}
-
-		while (fgets(buf, BUFSIZ, f)) {
-			lineno++;
-			sprintf(linename, "Line %d", lineno);
-			args[0] = linename;
-
-			if (*buf == '#')
-				continue;
-			if ((p = strchr(buf, '#')) != NULL)
-				*p = '\0';
-			i=1;
-			if (qflag) args[i++]="-q";
-			if (nflag) args[i++]="-n";
-			for (a = strtok(buf, WHITESP);
-			    a && i < MAX_ARGS; a = strtok(NULL, WHITESP), i++)
-				args[i] = a;
-			if (i == (qflag? 2: 1))
-				continue;
-			if (i == MAX_ARGS)
-				errx(EX_USAGE, "%s: too many arguments", linename);
-			args[i] = NULL;
-
-			ip6fw_main(i, args);
-		}
-		fclose(f);
-		if (pflag) {
-			if (waitpid(preproc, &status, 0) != -1) {
-				if (WIFEXITED(status)) {
-					if (WEXITSTATUS(status) != EX_OK)
-						errx(EX_UNAVAILABLE,
-						     "preprocessor exited with status %d",
-						     WEXITSTATUS(status));
-				} else if (WIFSIGNALED(status)) {
-					errx(EX_UNAVAILABLE,
-					     "preprocessor exited with signal %d",
-					     WTERMSIG(status));
-				}
-			}
-		}
-	} else
-		ip6fw_main(ac,av);
-	return 0;
-}
diff --git a/sbin/ip6fw/sample.sh b/sbin/ip6fw/sample.sh
deleted file mode 100644
index 0064140..0000000
--- a/sbin/ip6fw/sample.sh
+++ /dev/null
@@ -1,28 +0,0 @@
-#!/bin/sh -
-# $FreeBSD$
-
-fwcmd=/sbin/ip6fw
-
-$fwcmd -f flush
-
-#
-# loopback
-#
-$fwcmd add 1000 pass      all from any to any via lo0
-
-#
-# ND
-#
-# DAD
-$fwcmd add 2000 pass ipv6-icmp from ff02::/16 to ::
-$fwcmd add 2100 pass ipv6-icmp from :: to ff02::/16
-# RS, RA, NS, NA, redirect...
-$fwcmd add 2300 pass ipv6-icmp from fe80::/10 to fe80::/10
-$fwcmd add 2400 pass ipv6-icmp from fe80::/10 to ff02::/16
-
-$fwcmd add 5000 pass tcp from any to any established
-
-# RIPng
-$fwcmd add 6000 pass udp from fe80::/10 521 to ff02::9 521
-
-$fwcmd add 65000 pass log all from any to any