OpenBSD-3/3.4-sys-diffs

   1 diff sys/arch/alpha/alpha/conf.c sys.ipf/arch/alpha/alpha/conf.c
   2 *** sys/arch/alpha/alpha/conf.c Tue Jun  3 09:27:43 2003
   3 --- sys.ipf/arch/alpha/alpha/conf.c     Mon Jun 21 22:20:42 2004
   4 ***************
   5 *** 103,108 ****
   6 --- 103,113 ----
   7   #include "lpt.h"
   8   cdev_decl(lpt);
   9   cdev_decl(prom);                      /* XXX XXX XXX */
  10 + #ifdef IPFILTER
  11 + #define NIPF 1
  12 + #else
  13 + #define NIPF 0
  14 + #endif
  15   cdev_decl(wd);
  16   cdev_decl(fd);
  17   #include "cy.h"
  18 ***************
  19 *** 173,179 ****
  20         cdev_midi_init(NMIDI,midi),     /* 41: MIDI I/O */
  21           cdev_midi_init(NSEQUENCER,sequencer),   /* 42: sequencer I/O */
  22         cdev_disk_init(NRAID,raid),     /* 43: RAIDframe disk driver */
  23 !       cdev_notdef(),                  /* 44 */
  24         cdev_usb_init(NUSB,usb),        /* 45: USB controller */
  25         cdev_usbdev_init(NUHID,uhid),   /* 46: USB generic HID */
  26         cdev_ulpt_init(NULPT,ulpt),     /* 47: USB printer */
  27 --- 178,184 ----
  28         cdev_midi_init(NMIDI,midi),     /* 41: MIDI I/O */
  29           cdev_midi_init(NSEQUENCER,sequencer),   /* 42: sequencer I/O */
  30         cdev_disk_init(NRAID,raid),     /* 43: RAIDframe disk driver */
  31 !       cdev_gen_ipf(NIPF,ipl),         /* 44: IP filter log */
  32         cdev_usb_init(NUSB,usb),        /* 45: USB controller */
  33         cdev_usbdev_init(NUHID,uhid),   /* 46: USB generic HID */
  34         cdev_ulpt_init(NULPT,ulpt),     /* 47: USB printer */
  35 diff sys/arch/hp300/hp300/conf.c sys.ipf/arch/hp300/hp300/conf.c
  36 *** sys/arch/hp300/hp300/conf.c Tue Jun  3 09:27:45 2003
  37 --- sys.ipf/arch/hp300/hp300/conf.c     Mon Jun 21 22:20:43 2004
  38 ***************
  39 *** 122,127 ****
  40 --- 122,133 ----
  41   cdev_decl(xfs_dev);
  42   #endif
  43
  44 + #ifdef IPFILTER
  45 + #define NIPF 1
  46 + #else
  47 + #define NIPF 0
  48 + #endif
  49 +
  50   #include "pf.h"
  51
  52   #include "systrace.h"
  53 ***************
  54 *** 165,171 ****
  55         cdev_disk_init(NRD,rd),         /* 34: RAM disk */
  56         cdev_tty_init(NAPCI,apci),      /* 35: Apollo APCI UARTs */
  57         cdev_ksyms_init(NKSYMS,ksyms),  /* 36: Kernel symbols device */
  58 !       cdev_notdef(),                  /* 37 */
  59         cdev_notdef(),                  /* 38 */
  60         cdev_notdef(),                  /* 39 */
  61         cdev_notdef(),                  /* 40 */
  62 --- 171,177 ----
  63         cdev_disk_init(NRD,rd),         /* 34: RAM disk */
  64         cdev_tty_init(NAPCI,apci),      /* 35: Apollo APCI UARTs */
  65         cdev_ksyms_init(NKSYMS,ksyms),  /* 36: Kernel symbols device */
  66 !       cdev_pf_init(NIPF,ipl),         /* 37: packet filter */
  67         cdev_notdef(),                  /* 38 */
  68         cdev_notdef(),                  /* 39 */
  69         cdev_notdef(),                  /* 40 */
  70 diff sys/arch/hppa/hppa/conf.c sys.ipf/arch/hppa/hppa/conf.c
  71 *** sys/arch/hppa/hppa/conf.c   Tue Jun  3 09:27:46 2003
  72 --- sys.ipf/arch/hppa/hppa/conf.c       Mon Jun 21 22:20:43 2004
  73 ***************
  74 *** 107,112 ****
  75 --- 107,118 ----
  76   #include "com.h"
  77   cdev_decl(com);
  78
  79 + #ifdef IPFILTER
  80 + #define NIPF 1
  81 + #else
  82 + #define NIPF 0
  83 + #endif
  84 +
  85   #include "pf.h"
  86
  87   #include "systrace.h"
  88 ***************
  89 *** 157,162 ****
  90 --- 163,169 ----
  91         cdev_audio_init(NAUDIO,audio),  /* 35: /dev/audio */
  92         cdev_crypto_init(NCRYPTO,crypto), /* 36: /dev/crypto */
  93         cdev_ses_init(NSES,ses),        /* 37: SCSI SES/SAF-TE */
  94 +       cdev_gen_ipf(NIPF,ipl),         /* 38: ip filtering */
  95         cdev_lkm_dummy(),
  96         cdev_lkm_dummy(),
  97         cdev_lkm_dummy(),
  98 diff sys/arch/i386/i386/conf.c sys.ipf/arch/i386/i386/conf.c
  99 *** sys/arch/i386/i386/conf.c   Sat Jun 28 02:57:14 2003
 100 --- sys.ipf/arch/i386/i386/conf.c       Mon Jun 21 22:20:43 2004
 101 ***************
 102 *** 188,193 ****
 103 --- 188,199 ----
 104   #include "radio.h"
 105   #include "gpr.h"
 106
 107 + #ifdef IPFILTER
 108 + #define NIPF 1
 109 + #else
 110 + #define NIPF 0
 111 + #endif
 112 +
 113   /* XXX -- this needs to be supported by config(8)! */
 114   #if (NCOM > 0) && (NPCCOM > 0)
 115   #error com and pccom are mutually exclusive.  Sorry.
 116 ***************
 117 *** 311,317 ****
 118         cdev_usbdev_init(NUSCANNER,uscanner),   /* 77: USB scanners */
 119         cdev_systrace_init(NSYSTRACE,systrace), /* 78: system call tracing */
 120         cdev_oci_init(NBIO,bio),        /* 79: ioctl tunnel */
 121 !       cdev_ch_init(NGPR,gpr)          /* 80: GPR400 SmartCard reader */
 122   };
 123   int   nchrdev = sizeof(cdevsw) / sizeof(cdevsw[0]);
 124
 125 --- 317,325 ----
 126         cdev_usbdev_init(NUSCANNER,uscanner),   /* 77: USB scanners */
 127         cdev_systrace_init(NSYSTRACE,systrace), /* 78: system call tracing */
 128         cdev_oci_init(NBIO,bio),        /* 79: ioctl tunnel */
 129 !       cdev_ch_init(NGPR,gpr),         /* 80: GPR400 SmartCard reader */
 130 !       cdev_gen_ipf(NIPF,ipl)          /* 81: ip filtering */
 131 !
 132   };
 133   int   nchrdev = sizeof(cdevsw) / sizeof(cdevsw[0]);
 134
 135 diff sys/arch/mac68k/mac68k/conf.c sys.ipf/arch/mac68k/mac68k/conf.c
 136 *** sys/arch/mac68k/mac68k/conf.c       Tue Jun  3 09:27:49 2003
 137 --- sys.ipf/arch/mac68k/mac68k/conf.c   Mon Jun 21 22:20:43 2004
 138 ***************
 139 *** 104,109 ****
 140 --- 104,115 ----
 141   cdev_decl(xfs_dev);
 142   #endif
 143
 144 + #ifdef IPFILTER
 145 + #define NIPF 1
 146 + #else
 147 + #define NIPF 0
 148 + #endif
 149 +
 150   #include "pf.h"
 151
 152   #include "systrace.h"
 153 ***************
 154 *** 148,154 ****
 155         cdev_pf_init(NPF,pf),           /* 35: packet filter */
 156         cdev_audio_init(NASC,asc),      /* 36: ASC audio device */
 157         cdev_ksyms_init(NKSYMS,ksyms),  /* 37: Kernel symbols device */
 158 !       cdev_notdef(),                  /* 38 */
 159         cdev_notdef(),                  /* 39 */
 160         cdev_notdef(),                  /* 40 */
 161         cdev_notdef(),                  /* 41 */
 162 --- 154,160 ----
 163         cdev_pf_init(NPF,pf),           /* 35: packet filter */
 164         cdev_audio_init(NASC,asc),      /* 36: ASC audio device */
 165         cdev_ksyms_init(NKSYMS,ksyms),  /* 37: Kernel symbols device */
 166 !       cdev_gen_ipf(NIPF,ipl),         /* 38: IP filter log */
 167         cdev_notdef(),                  /* 39 */
 168         cdev_notdef(),                  /* 40 */
 169         cdev_notdef(),                  /* 41 */
 170 diff sys/arch/macppc/macppc/conf.c sys.ipf/arch/macppc/macppc/conf.c
 171 *** sys/arch/macppc/macppc/conf.c       Sat Jun 28 02:57:14 2003
 172 --- sys.ipf/arch/macppc/macppc/conf.c   Mon Jun 21 22:20:43 2004
 173 ***************
 174 *** 105,110 ****
 175 --- 105,116 ----
 176
 177   #include "tun.h"
 178
 179 + #ifdef IPFILTER
 180 + #define NIPF 1
 181 + #else
 182 + #define NIPF 0
 183 + #endif
 184 +
 185   #ifdef XFS
 186   #include <xfs/nxfs.h>
 187   cdev_decl(xfs_dev);
 188 ***************
 189 *** 191,197 ****
 190         cdev_ss_init(NSS,ss),           /* 42: SCSI scanner */
 191         cdev_ksyms_init(NKSYMS,ksyms),  /* 43: Kernel symbols device */
 192         cdev_audio_init(NAUDIO,audio),  /* 44: generic audio I/O */
 193 !       cdev_notdef(),                  /* 45 */
 194         cdev_notdef(),                  /* 46 */
 195         cdev_crypto_init(NCRYPTO,crypto), /* 47: /dev/crypto */
 196         cdev_notdef(),                  /* 48 */
 197 --- 197,203 ----
 198         cdev_ss_init(NSS,ss),           /* 42: SCSI scanner */
 199         cdev_ksyms_init(NKSYMS,ksyms),  /* 43: Kernel symbols device */
 200         cdev_audio_init(NAUDIO,audio),  /* 44: generic audio I/O */
 201 !       cdev_gen_ipf(NIPF,ipl),         /* 45: IP filter */
 202         cdev_notdef(),                  /* 46 */
 203         cdev_crypto_init(NCRYPTO,crypto), /* 47: /dev/crypto */
 204         cdev_notdef(),                  /* 48 */
 205 diff sys/arch/mvme68k/mvme68k/conf.c sys.ipf/arch/mvme68k/mvme68k/conf.c
 206 *** sys/arch/mvme68k/mvme68k/conf.c     Tue Jun  3 09:27:50 2003
 207 --- sys.ipf/arch/mvme68k/mvme68k/conf.c Mon Jun 21 22:20:43 2004
 208 ***************
 209 *** 148,153 ****
 210 --- 148,159 ----
 211   #include "bpfilter.h"
 212   #include "tun.h"
 213
 214 + #ifdef IPFILTER
 215 + #define NIPF 1
 216 + #else
 217 + #define NIPF 0
 218 + #endif
 219 +
 220   #include "pf.h"
 221
 222   #include "systrace.h"
 223 ***************
 224 *** 202,208 ****
 225         cdev_uk_init(NUK,uk),           /* 41: unknown SCSI */
 226         cdev_ss_init(NSS,ss),           /* 42: SCSI scanner */
 227         cdev_ksyms_init(NKSYMS,ksyms),  /* 43: Kernel symbols device */
 228 !       cdev_lkm_dummy(),               /* 44 */
 229         cdev_lkm_dummy(),               /* 45 */
 230         cdev_lkm_dummy(),               /* 46 */
 231         cdev_lkm_dummy(),               /* 47 */
 232 --- 208,214 ----
 233         cdev_uk_init(NUK,uk),           /* 41: unknown SCSI */
 234         cdev_ss_init(NSS,ss),           /* 42: SCSI scanner */
 235         cdev_ksyms_init(NKSYMS,ksyms),  /* 43: Kernel symbols device */
 236 !       cdev_gen_ipf(NIPF,ipl),         /* 44: IP filter */
 237         cdev_lkm_dummy(),               /* 45 */
 238         cdev_lkm_dummy(),               /* 46 */
 239         cdev_lkm_dummy(),               /* 47 */
 240 diff sys/arch/mvme88k/mvme88k/conf.c sys.ipf/arch/mvme88k/mvme88k/conf.c
 241 *** sys/arch/mvme88k/mvme88k/conf.c     Tue Jun  3 09:27:52 2003
 242 --- sys.ipf/arch/mvme88k/mvme88k/conf.c Mon Jun 21 22:20:43 2004
 243 ***************
 244 *** 97,102 ****
 245 --- 97,108 ----
 246   cdev_decl(lptwo);
 247   #endif /* notyet */
 248
 249 + #ifdef IPFILTER
 250 + #define NIPF 1
 251 + #else
 252 + #define NIPF 0
 253 + #endif
 254 +
 255   #include "pf.h"
 256
 257   #include "systrace.h"
 258 ***************
 259 *** 183,189 ****
 260         cdev_lkm_dummy(),                /* 38 */
 261         cdev_pf_init(NPF,pf),            /* 39: packet filter */
 262         cdev_random_init(1,random),      /* 40: random data source */
 263 !       cdev_notdef(),                   /* 41 */
 264         cdev_notdef(),                   /* 42 */
 265         cdev_ksyms_init(NKSYMS,ksyms),   /* 43: Kernel symbols device */
 266         cdev_notdef(),                   /* 44 */
 267 --- 189,195 ----
 268         cdev_lkm_dummy(),                /* 38 */
 269         cdev_pf_init(NPF,pf),            /* 39: packet filter */
 270         cdev_random_init(1,random),      /* 40: random data source */
 271 !       cdev_gen_ipf(NIPF,ipl),          /* 41: IP filter */
 272         cdev_notdef(),                   /* 42 */
 273         cdev_ksyms_init(NKSYMS,ksyms),   /* 43: Kernel symbols device */
 274         cdev_notdef(),                   /* 44 */
 275 diff sys/arch/mvmeppc/mvmeppc/conf.c sys.ipf/arch/mvmeppc/mvmeppc/conf.c
 276 *** sys/arch/mvmeppc/mvmeppc/conf.c     Wed May 14 10:20:37 2003
 277 --- sys.ipf/arch/mvmeppc/mvmeppc/conf.c Mon Jun 21 22:20:43 2004
 278 ***************
 279 *** 114,119 ****
 280 --- 114,125 ----
 281
 282   #include "ksyms.h"
 283
 284 + #ifdef IPFILTER
 285 + #define NIPF 1
 286 + #else
 287 + #define NIPF 0
 288 + #endif
 289 +
 290   #include "pf.h"
 291
 292   #include "systrace.h"
 293 ***************
 294 *** 167,173 ****
 295         cdev_uk_init(NUK,uk),           /* 41: unknown SCSI */
 296         cdev_ss_init(NSS,ss),           /* 42: SCSI scanner */
 297         cdev_ksyms_init(NKSYMS,ksyms),  /* 43: Kernel symbols device */
 298 !         cdev_notdef(),                  /* 44 */
 299           cdev_notdef(),                  /* 45 */
 300           cdev_notdef(),                  /* 46 */
 301           cdev_notdef(),                  /* 47 */
 302 --- 173,179 ----
 303         cdev_uk_init(NUK,uk),           /* 41: unknown SCSI */
 304         cdev_ss_init(NSS,ss),           /* 42: SCSI scanner */
 305         cdev_ksyms_init(NKSYMS,ksyms),  /* 43: Kernel symbols device */
 306 !       cdev_gen_ipf(NIPF,ipl),         /* 44: IP filter */
 307           cdev_notdef(),                  /* 45 */
 308           cdev_notdef(),                  /* 46 */
 309           cdev_notdef(),                  /* 47 */
 310 diff sys/arch/sparc/sparc/conf.c sys.ipf/arch/sparc/sparc/conf.c
 311 *** sys/arch/sparc/sparc/conf.c Tue Jun  3 09:27:55 2003
 312 --- sys.ipf/arch/sparc/sparc/conf.c     Mon Jun 21 22:20:43 2004
 313 ***************
 314 *** 124,129 ****
 315 --- 124,135 ----
 316   };
 317   int   nblkdev = sizeof(bdevsw) / sizeof(bdevsw[0]);
 318
 319 + #ifdef IPFILTER
 320 + #define NIPF 1
 321 + #else
 322 + #define NIPF 0
 323 + #endif
 324 +
 325   #include "pf.h"
 326
 327   #include "systrace.h"
 328 ***************
 329 *** 194,200 ****
 330         cdev_notdef(),                  /* 57 */
 331         cdev_disk_init(NCD,cd),         /* 58: SCSI CD-ROM */
 332         cdev_pf_init(NPF,pf),           /* 59: packet filter */
 333 !       cdev_notdef(),                  /* 60 */
 334         cdev_notdef(),                  /* 61 */
 335         cdev_notdef(),                  /* 62 */
 336         cdev_notdef(),                  /* 63 */
 337 --- 200,206 ----
 338         cdev_notdef(),                  /* 57 */
 339         cdev_disk_init(NCD,cd),         /* 58: SCSI CD-ROM */
 340         cdev_pf_init(NPF,pf),           /* 59: packet filter */
 341 !       cdev_gen_ipf(NIPF,ipl),         /* 60: ip filtering log */
 342         cdev_notdef(),                  /* 61 */
 343         cdev_notdef(),                  /* 62 */
 344         cdev_notdef(),                  /* 63 */
 345 diff sys/arch/sparc64/sparc64/conf.c sys.ipf/arch/sparc64/sparc64/conf.c
 346 *** sys/arch/sparc64/sparc64/conf.c     Sat Jun 28 02:57:14 2003
 347 --- sys.ipf/arch/sparc64/sparc64/conf.c Mon Jun 21 22:20:44 2004
 348 ***************
 349 *** 110,115 ****
 350 --- 110,121 ----
 351   #include "ucom.h"
 352   #include "uscanner.h"
 353
 354 + #ifdef IPFILTER
 355 + #define NIPF 1
 356 + #else
 357 + #define NIPF 0
 358 + #endif
 359 +
 360   #include "pf.h"
 361
 362   #ifdef XFS
 363 ***************
 364 *** 246,252 ****
 365         cdev_mouse_init(NWSKBD, wskbd), /* 79: keyboards */
 366         cdev_mouse_init(NWSMOUSE, wsmouse), /* 80: mice */
 367         cdev_mouse_init(NWSMUX, wsmux), /* 81: ws multiplexor */
 368 !       cdev_notdef(),                  /* 82 */
 369         cdev_notdef(),                  /* 83 */
 370         cdev_notdef(),                  /* 84 */
 371         cdev_notdef(),                  /* 85 */
 372 --- 252,258 ----
 373         cdev_mouse_init(NWSKBD, wskbd), /* 79: keyboards */
 374         cdev_mouse_init(NWSMOUSE, wsmouse), /* 80: mice */
 375         cdev_mouse_init(NWSMUX, wsmux), /* 81: ws multiplexor */
 376 !       cdev_gen_ipf(NIPF,ipl),         /* 82: IP filter */
 377         cdev_notdef(),                  /* 83 */
 378         cdev_notdef(),                  /* 84 */
 379         cdev_notdef(),                  /* 85 */
 380 diff sys/arch/vax/vax/conf.c sys.ipf/arch/vax/vax/conf.c
 381 *** sys/arch/vax/vax/conf.c     Thu Jun 26 23:06:26 2003
 382 --- sys.ipf/arch/vax/vax/conf.c Mon Jun 21 22:20:44 2004
 383 ***************
 384 *** 353,358 ****
 385 --- 353,364 ----
 386   #include "wskbd.h"
 387   #include "wsmouse.h"
 388
 389 + #ifdef IPFILTER
 390 + #define NIPF 1
 391 + #else
 392 + #define NIPF 0
 393 + #endif
 394 +
 395   #include "pf.h"
 396
 397   #include "systrace.h"
 398 ***************
 399 *** 406,412 ****
 400         cdev_notdef(),                  /* 44  was Datakit */
 401         cdev_notdef(),                  /* 45  was Datakit */
 402         cdev_notdef(),                  /* 46  was Datakit */
 403 !       cdev_notdef(),                  /* 47 */
 404         cdev_notdef(),                  /* 48 */
 405         cdev_systrace_init(NSYSTRACE,systrace), /* 49: system call tracing */
 406         cdev_ksyms_init(NKSYMS,ksyms),  /* 50: Kernel symbols device */
 407 --- 412,418 ----
 408         cdev_notdef(),                  /* 44  was Datakit */
 409         cdev_notdef(),                  /* 45  was Datakit */
 410         cdev_notdef(),                  /* 46  was Datakit */
 411 !       cdev_gen_ipf(NIPF,ipl),         /* 47: IP filter */
 412         cdev_notdef(),                  /* 48 */
 413         cdev_systrace_init(NSYSTRACE,systrace), /* 49: system call tracing */
 414         cdev_ksyms_init(NKSYMS,ksyms),  /* 50: Kernel symbols device */
 415 diff sys/conf/GENERIC sys.ipf/conf/GENERIC
 416 *** sys/conf/GENERIC    Thu May 15 00:24:43 2003
 417 --- sys.ipf/conf/GENERIC        Mon Jun 21 22:20:44 2004
 418 ***************
 419 *** 71,76 ****
 420 --- 71,78 ----
 421   #option               EON             # OSI tunneling over IP
 422   #option               NETATALK        # AppleTalk
 423   #option               CCITT,LLC,HDLC  # X.25
 424 + option                IPFILTER        # IP packet filter for security
 425 + option                IPFILTER_LOG    # use /dev/ipl to log IPF
 426   option                PPP_BSDCOMP     # PPP BSD compression
 427   option                PPP_DEFLATE
 428   #option               MROUTING        # Multicast router
 429 diff sys/conf/files sys.ipf/conf/files
 430 *** sys/conf/files      Fri Aug 22 05:12:07 2003
 431 --- sys.ipf/conf/files  Mon Jun 21 22:20:44 2004
 432 ***************
 433 *** 702,707 ****
 434 --- 702,715 ----
 435   file netinet/tcp_usrreq.c             inet
 436   file netinet/udp_usrreq.c             inet
 437   file netinet/ip_gre.c                 inet
 438 + file netinet/ip_fil.c                 ipfilter
 439 + file netinet/fil.c                    ipfilter
 440 + file netinet/ip_nat.c                 ipfilter
 441 + file netinet/ip_frag.c                        ipfilter
 442 + file netinet/ip_state.c                       ipfilter
 443 + file netinet/ip_proxy.c                       ipfilter
 444 + file netinet/ip_auth.c                        ipfilter
 445 + file netinet/ip_log.c                 ipfilter
 446   file netinet/ip_ipsp.c                        (inet | inet6) & (ipsec | tcp_signature)
 447   file netinet/ip_spd.c                 (inet | inet6) & (ipsec | tcp_signature)
 448   file netinet/ip_ipip.c                        inet | inet6
 449 diff sys/net/bridgestp.c sys.ipf/net/bridgestp.c
 450 *** sys/net/bridgestp.c Tue Jun  3 04:42:56 2003
 451 --- sys.ipf/net/bridgestp.c     Mon Jun 21 22:20:44 2004
 452 ***************
 453 *** 58,63 ****
 454 --- 58,68 ----
 455   #include <netinet/in_var.h>
 456   #include <netinet/ip.h>
 457   #include <netinet/if_ether.h>
 458 +
 459 + #ifdef IPFILTER
 460 + #include <netinet/ip_compat.h>
 461 + #include <netinet/ip_fil.h>
 462 + #endif
 463   #endif
 464
 465   #if NBPFILTER > 0
 466 diff sys/net/if.c sys.ipf/net/if.c
 467 *** sys/net/if.c        Wed Aug 27 10:33:34 2003
 468 --- sys.ipf/net/if.c    Mon Jun 21 22:20:44 2004
 469 ***************
 470 *** 97,102 ****
 471 --- 97,108 ----
 472   #include <netinet6/nd6.h>
 473   #endif
 474
 475 + #ifdef IPFILTER
 476 + #include <netinet/ip_compat.h>
 477 + #include <netinet/ip_fil.h>
 478 + #include <netinet/ip_nat.h>
 479 + #endif
 480 +
 481   #if NBPFILTER > 0
 482   #include <net/bpf.h>
 483   #endif
 484 ***************
 485 *** 480,485 ****
 486 --- 486,496 ----
 487
 488         /* Remove the interface from the list of all interfaces.  */
 489         TAILQ_REMOVE(&ifnet, ifp, if_list);
 490 +
 491 + #ifdef IPFILTER
 492 +       /* XXX More ipf & ipnat cleanup needed.  */
 493 +       frsync(ifp);
 494 + #endif
 495
 496         /*
 497          * Deallocate private resources.
 498 diff sys/net/if_bridge.c sys.ipf/net/if_bridge.c
 499 *** sys/net/if_bridge.c Sat Aug 16 06:32:19 2003
 500 --- sys.ipf/net/if_bridge.c     Mon Jun 21 22:23:56 2004
 501 ***************
 502 *** 66,72 ****
 503 --- 66,76 ----
 504   #include <netinet/ip_ipsp.h>
 505
 506   #include <net/if_enc.h>
 507 + #if (defined(IPFILTER) || defined(IPFILTER_LKM))
 508 + #include <netinet/ip_compat.h>
 509 + #include <netinet/ip_fil.h>
 510   #endif
 511 + #endif
 512
 513   #ifdef INET6
 514   #include <netinet/ip6.h>
 515 ***************
 516 *** 155,161 ****
 517   int   bridge_brlconf(struct bridge_softc *, struct ifbrlconf *);
 518   u_int8_t bridge_filterrule(struct brl_head *, struct ether_header *,
 519       struct mbuf *);
 520 ! #if NPF > 0
 521   struct mbuf *bridge_filter(struct bridge_softc *, int, struct ifnet *,
 522       struct ether_header *, struct mbuf *m);
 523   #endif
 524 --- 159,165 ----
 525   int   bridge_brlconf(struct bridge_softc *, struct ifbrlconf *);
 526   u_int8_t bridge_filterrule(struct brl_head *, struct ether_header *,
 527       struct mbuf *);
 528 ! #if (NPF > 0) || (defined(IPFILTER) || defined(IPFILTER_LKM))
 529   struct mbuf *bridge_filter(struct bridge_softc *, int, struct ifnet *,
 530       struct ether_header *, struct mbuf *m);
 531   #endif
 532 ***************
 533 *** 1168,1174 ****
 534                 m_freem(m);
 535                 return;
 536         }
 537 ! #if NPF > 0
 538         m = bridge_filter(sc, BRIDGE_IN, src_if, &eh, m);
 539         if (m == NULL)
 540                 return;
 541 --- 1172,1178 ----
 542                 m_freem(m);
 543                 return;
 544         }
 545 ! #if (NPF > 0) || (defined(IPFILTER) || defined(IPFILTER_LKM))
 546         m = bridge_filter(sc, BRIDGE_IN, src_if, &eh, m);
 547         if (m == NULL)
 548                 return;
 549 ***************
 550 *** 1211,1217 ****
 551                 m_freem(m);
 552                 return;
 553         }
 554 ! #if NPF > 0
 555         m = bridge_filter(sc, BRIDGE_OUT, dst_if, &eh, m);
 556         if (m == NULL)
 557                 return;
 558 --- 1215,1221 ----
 559                 m_freem(m);
 560                 return;
 561         }
 562 ! #if (NPF > 0) || (defined(IPFILTER) || defined(IPFILTER_LKM))
 563         m = bridge_filter(sc, BRIDGE_OUT, dst_if, &eh, m);
 564         if (m == NULL)
 565                 return;
 566 ***************
 567 *** 1459,1465 ****
 568                         mc = m1;
 569                 }
 570
 571 ! #if NPF > 0
 572                 mc = bridge_filter(sc, BRIDGE_OUT, dst_if, eh, mc);
 573                 if (mc == NULL)
 574                         continue;
 575 --- 1463,1469 ----
 576                         mc = m1;
 577                 }
 578
 579 ! #if (NPF > 0) || (defined(IPFILTER) || defined(IPFILTER_LKM))
 580                 mc = bridge_filter(sc, BRIDGE_OUT, dst_if, eh, mc);
 581                 if (mc == NULL)
 582                         continue;
 583 ***************
 584 *** 2235,2240 ****
 585 --- 2239,2250 ----
 586                          * We don't need to do loop detection, the
 587                          * bridge will do that for us.
 588                          */
 589 + #if defined(IPFILTER) || defined(IPFILTER_LKM)
 590 +                       if (dir == BRIDGE_OUT && fr_checkp &&
 591 +                           ((*fr_checkp)(ip, hlen, &encif[0].sc_if,
 592 +                            1, &m) || !m))
 593 +                               return 1;
 594 + #endif
 595   #if NPF > 0
 596                         switch (af) {
 597   #ifdef INET
 598 ***************
 599 *** 2259,2264 ****
 600 --- 2269,2280 ----
 601                         if (m == NULL)
 602                                 return (1);
 603   #endif /* NPF */
 604 + #if defined(IPFILTER) || defined(IPFILTER_LKM)
 605 +                       if (dir == BRIDGE_IN && fr_checkp &&
 606 +                           ((*fr_checkp)(ip, hlen, &encif[0].sc_if,
 607 +                                         0, &m) || !m))
 608 +                               return 1;
 609 + #endif
 610                         error = ipsp_process_packet(m, tdb, af, 0);
 611                         return (1);
 612                 } else
 613 ***************
 614 *** 2269,2275 ****
 615   }
 616   #endif /* IPSEC */
 617
 618 ! #if NPF > 0
 619   /*
 620    * Filter IP packets by peeking into the ethernet frame.  This violates
 621    * the ISO model, but allows us to act as a IP filter at the data link
 622 --- 2285,2291 ----
 623   }
 624   #endif /* IPSEC */
 625
 626 ! #if (NPF > 0) || (defined(IPFILTER) || defined(IPFILTER_LKM))
 627   /*
 628    * Filter IP packets by peeking into the ethernet frame.  This violates
 629    * the ISO model, but allows us to act as a IP filter at the data link
 630 ***************
 631 *** 2372,2385 ****
 632                         return (NULL);
 633   #endif /* IPSEC */
 634
 635 ! #if NPF > 0
 636                 /* Finally, we get to filter the packet! */
 637                 m->m_pkthdr.rcvif = ifp;
 638                 if (pf_test(dir, ifp, &m) != PF_PASS)
 639                         goto dropit;
 640                 if (m == NULL)
 641                         goto dropit;
 642   #endif /* NPF */
 643
 644                 /* Rebuild the IP header */
 645                 if (m->m_len < hlen && ((m = m_pullup(m, hlen)) == NULL))
 646 --- 2388,2419 ----
 647                         return (NULL);
 648   #endif /* IPSEC */
 649
 650 ! #if defined(IPFILTER) || defined(IPFILTER_LKM) || (NPF > 0)
 651                 /* Finally, we get to filter the packet! */
 652                 m->m_pkthdr.rcvif = ifp;
 653 + #endif
 654 + #if defined(IPFILTER) || defined(IPFILTER_LKM)
 655 +               if (dir == BRIDGE_OUT) {
 656 +                       if (fr_checkp && (*fr_checkp)(ip, hlen, ifp, 1, &m))
 657 +                               goto dropit;
 658 +                       if (m == NULL)
 659 +                               goto dropit;
 660 +               }
 661 + #endif
 662 + #if NPF > 0
 663                 if (pf_test(dir, ifp, &m) != PF_PASS)
 664                         goto dropit;
 665                 if (m == NULL)
 666                         goto dropit;
 667   #endif /* NPF */
 668 + #if defined(IPFILTER) || defined(IPFILTER_LKM)
 669 +               if (dir == BRIDGE_IN) {
 670 +                       if (fr_checkp && (*fr_checkp)(ip, hlen, ifp, 0, &m))
 671 +                               goto dropit;
 672 +                       if (m == NULL)
 673 +                               goto dropit;
 674 +               }
 675 + #endif
 676
 677                 /* Rebuild the IP header */
 678                 if (m->m_len < hlen && ((m = m_pullup(m, hlen)) == NULL))
 679 ***************
 680 *** 2420,2425 ****
 681 --- 2454,2467 ----
 682                         return (NULL);
 683   #endif /* IPSEC */
 684
 685 + #if defined(IPFILTER) || defined(IPFILTER_LKM)
 686 +               if (dir == BRIDGE_OUT) {
 687 +                       if (fr_checkp && (*fr_checkp)(ip, hlen, ifp, 1, &m))
 688 +                               goto dropit;
 689 +                       if (m == NULL)
 690 +                               return (NULL);
 691 +               }
 692 + #endif
 693   #if NPF > 0
 694                 if (pf_test6(dir, ifp, &m) != PF_PASS)
 695                         goto dropit;
 696 ***************
 697 *** 2426,2431 ****
 698 --- 2468,2481 ----
 699                 if (m == NULL)
 700                         return (NULL);
 701   #endif /* NPF */
 702 + #if defined(IPFILTER) || defined(IPFILTER_LKM)
 703 +               if (dir == BRIDGE_IN) {
 704 +                       if (fr_checkp && (*fr_checkp)(ip, hlen, ifp, 0, &m))
 705 +                               goto dropit;
 706 +                       if (m == NULL)
 707 +                               return (NULL);
 708 +               }
 709 + #endif
 710
 711                 break;
 712         }
 713 ***************
 714 *** 2457,2463 ****
 715                 m_freem(m);
 716         return (NULL);
 717   }
 718 ! #endif /* NPF > 0 */
 719
 720   void
 721   bridge_fragment(struct bridge_softc *sc, struct ifnet *ifp,
 722 --- 2507,2513 ----
 723                 m_freem(m);
 724         return (NULL);
 725   }
 726 ! #endif /* (NPF > 0) || (defined(IPFILTER) || defined(IPFILTER_LKM)) */
 727
 728   void
 729   bridge_fragment(struct bridge_softc *sc, struct ifnet *ifp,
 730 diff sys/netinet/in_proto.c sys.ipf/netinet/in_proto.c
 731 *** sys/netinet/in_proto.c      Tue Jun  3 09:28:14 2003
 732 --- sys.ipf/netinet/in_proto.c  Mon Jun 21 22:20:44 2004
 733 ***************
 734 *** 159,164 ****
 735 --- 159,169 ----
 736   #include <netinet/ip_mroute.h>
 737   #endif /* MROUTING */
 738
 739 + #ifdef IPFILTER
 740 + void iplinit __P((void));
 741 + #define ip_init iplinit
 742 + #endif
 743 +
 744   #ifdef INET6
 745   #include <netinet6/ip6_var.h>
 746   #endif /* INET6 */
 747 diff sys/netinet/ip_input.c sys.ipf/netinet/ip_input.c
 748 *** sys/netinet/ip_input.c      Tue Jul 29 13:21:57 2003
 749 --- sys.ipf/netinet/ip_input.c  Mon Jun 21 22:20:45 2004
 750 ***************
 751 *** 147,152 ****
 752 --- 147,156 ----
 753   struct        in_ifaddrhead in_ifaddr;
 754   struct        ifqueue ipintrq;
 755
 756 + #if defined(IPFILTER) || defined(IPFILTER_LKM)
 757 + int   (*fr_checkp) __P((struct ip *, int, struct ifnet *, int, struct mbuf **));
 758 + #endif
 759 +
 760   int   ipq_locked;
 761   static __inline int ipq_lock_try(void);
 762   static __inline void ipq_unlock(void);
 763 ***************
 764 *** 402,407 ****
 765 --- 406,428 ----
 766         ip = mtod(m, struct ip *);
 767         hlen = ip->ip_hl << 2;
 768         pfrdr = (pfrdr != ip->ip_dst.s_addr);
 769 + #endif
 770 +
 771 + #if defined(IPFILTER) || defined(IPFILTER_LKM)
 772 +       /*
 773 +        * Check if we want to allow this packet to be processed.
 774 +        * Consider it to be bad if not.
 775 +        */
 776 +       {
 777 +               struct mbuf *m0 = m;
 778 +               if (fr_checkp && (*fr_checkp)(ip, hlen, m->m_pkthdr.rcvif, 0, &m0)) {
 779 +                       return;
 780 +               }
 781 +               if (m0 == 0) {  /* in case of 'fastroute' */
 782 +                       return;
 783 +               }
 784 +               ip = mtod(m = m0, struct ip *);
 785 +       }
 786   #endif
 787
 788         /*
 789 diff sys/netinet/ip_output.c sys.ipf/netinet/ip_output.c
 790 *** sys/netinet/ip_output.c     Sat Aug 16 06:32:20 2003
 791 --- sys.ipf/netinet/ip_output.c Mon Jun 21 22:20:45 2004
 792 ***************
 793 *** 82,87 ****
 794 --- 82,91 ----
 795   static struct mbuf *ip_insertoptions(struct mbuf *, struct mbuf *, int *);
 796   static void ip_mloopback(struct ifnet *, struct mbuf *, struct sockaddr_in *);
 797
 798 + #if defined(IPFILTER) || defined(IPFILTER_LKM)
 799 + extern int (*fr_checkp) __P((struct ip *, int, struct ifnet *, int, struct mbuf **));
 800 + #endif
 801 +
 802   /*
 803    * IP output.  The packet in mbuf chain m contains a skeletal IP
 804    * header (with len, off, ttl, proto, tos, src, dst).
 805 ***************
 806 *** 555,561 ****
 807 --- 559,589 ----
 808         if (sproto != 0) {
 809                 s = splnet();
 810
 811 + #if defined(IPFILTER) || defined(IPFILTER_LKM)
 812 +               if (fr_checkp) {
 813                 /*
 814 +                * Ok, it's time for a simple round-trip to the IPF/NAT
 815 +                * code with the enc0 interface.
 816 +                */
 817 +                       struct mbuf *m1 = m;
 818 +                       void *ifp = (void *)&encif[0].sc_if;
 819 +
 820 +                       if ((*fr_checkp)(ip, hlen, ifp, 1, &m1)) {
 821 +                               error = EHOSTUNREACH;
 822 +                               splx(s);
 823 +                               goto done;
 824 +                       }
 825 +                       if (m1 == 0) { /* in case of 'fastroute' */
 826 +                               error = 0;
 827 +                               splx(s);
 828 +                               goto done;
 829 +                       }
 830 +                       ip = mtod(m = m1, struct ip *);
 831 +                       hlen = ip->ip_hl << 2;
 832 +               }
 833 + #endif /* IPFILTER */
 834 +
 835 +               /*
 836                  * Packet filter
 837                  */
 838   #if NPF > 0
 839 ***************
 840 *** 653,658 ****
 841 --- 681,705 ----
 842                         m->m_pkthdr.csum &= ~M_UDPV4_CSUM_OUT; /* Clear */
 843                 }
 844         }
 845 +
 846 + #if defined(IPFILTER) || defined(IPFILTER_LKM)
 847 +       /*
 848 +        * looks like most checking has been done now...do a filter check
 849 +        */
 850 +       {
 851 +               struct mbuf *m1 = m;
 852 +
 853 +               if (fr_checkp && (*fr_checkp)(ip, hlen, ifp, 1, &m1)) {
 854 +                       error = EHOSTUNREACH;
 855 +                       goto done;
 856 +               }
 857 +               if (m1 == 0) { /* in case of 'fastroute' */
 858 +                       error = 0;
 859 +                       goto done;
 860 +               }
 861 +               ip = mtod(m = m1, struct ip *);
 862 +       }
 863 + #endif
 864
 865         /*
 866          * Packet filter
 867 diff sys/netinet6/ip6_input.c sys.ipf/netinet6/ip6_input.c
 868 *** sys/netinet6/ip6_input.c    Mon Jun 30 20:30:23 2003
 869 --- sys.ipf/netinet6/ip6_input.c        Mon Jun 21 22:20:45 2004
 870 ***************
 871 *** 128,133 ****
 872 --- 128,137 ----
 873   static int ip6_hopopts_input(u_int32_t *, u_int32_t *, struct mbuf **, int *);
 874   static struct mbuf *ip6_pullexthdr(struct mbuf *, size_t, int);
 875
 876 + #if defined(IPFILTER) || defined(IPFILTER_LKM)
 877 + extern int (*fr_checkp) __P((struct ip *, int, struct ifnet *, int, struct mbuf **));
 878 + #endif
 879 +
 880   /*
 881    * IP6 initialization: fill in IP6 protocol switch table.
 882    * All protocols not implemented in kernel go to raw IP6 protocol handler.
 883 ***************
 884 *** 244,249 ****
 885 --- 248,273 ----
 886                 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr);
 887                 goto bad;
 888         }
 889 +
 890 + #if defined(IPFILTER) || defined(IPFILTER_LKM)
 891 +       /*
 892 +        * Check if we want to allow this packet to be processed.
 893 +        * Consider it to be bad if not.
 894 +        */
 895 +       if (fr_checkp != NULL) {
 896 +               struct mbuf *m0 = m;
 897 +
 898 +               if ((*fr_checkp)((struct ip *)ip6, sizeof(*ip6),
 899 +                               m->m_pkthdr.rcvif, 0, &m0)) {
 900 +                       return;
 901 +               }
 902 +               m = m0;
 903 +               if (m == 0) {  /* in case of 'fastroute' */
 904 +                       return;
 905 +               }
 906 +               ip6 = mtod(m, struct ip6_hdr *);
 907 +       }
 908 + #endif
 909
 910   #if NPF > 0
 911           /*
 912 diff sys/netinet6/ip6_output.c sys.ipf/netinet6/ip6_output.c
 913 *** sys/netinet6/ip6_output.c   Sat Aug 16 06:32:20 2003
 914 --- sys.ipf/netinet6/ip6_output.c       Mon Jun 21 22:20:45 2004
 915 ***************
 916 *** 116,121 ****
 917 --- 116,124 ----
 918
 919   static int ip6_pcbopts(struct ip6_pktopts **, struct mbuf *, struct socket *);
 920   static int ip6_setmoptions(int, struct ip6_moptions **, struct mbuf *);
 921 + #if defined(IPFILTER) || defined(IPFILTER_LKM)
 922 + extern int (*fr_checkp) __P((struct ip *, int, struct ifnet *, int, struct mbuf **));
 923 + #endif
 924   static int ip6_getmoptions(int, struct ip6_moptions *, struct mbuf **);
 925   static int ip6_copyexthdr(struct mbuf **, caddr_t, int);
 926   static int ip6_insertfraghdr(struct mbuf *, struct mbuf *, int,
 927 ***************
 928 *** 122,128 ****
 929         struct ip6_frag **);
 930   static int ip6_insert_jumboopt(struct ip6_exthdrs *, u_int32_t);
 931   static int ip6_splithdr(struct mbuf *, struct ip6_exthdrs *);
 932 ! static int ip6_getpmtu(struct route_in6 *, struct route_in6 *,
 933         struct ifnet *, struct in6_addr *, u_long *);
 934
 935   /*
 936 --- 125,131 ----
 937         struct ip6_frag **);
 938   static int ip6_insert_jumboopt(struct ip6_exthdrs *, u_int32_t);
 939   static int ip6_splithdr(struct mbuf *, struct ip6_exthdrs *);
 940 ! int ip6_getpmtu(struct route_in6 *, struct route_in6 *,
 941         struct ifnet *, struct in6_addr *, u_long *);
 942
 943   /*
 944 ***************
 945 *** 793,798 ****
 946 --- 796,820 ----
 947                 goto done;
 948         ip6 = mtod(m, struct ip6_hdr *);
 949   #endif
 950 +
 951 + #if defined(IPFILTER) || defined(IPFILTER_LKM)
 952 +       /*
 953 +        * looks like most checking has been done now...do a filter check
 954 +        */
 955 +       if (fr_checkp != NULL) {
 956 +               struct mbuf *m1 = m;
 957 +               if ((*fr_checkp)((struct ip *)ip6, sizeof(*ip6), ifp, 1, &m1)) {
 958 +                       error = EHOSTUNREACH;
 959 +                       goto done;
 960 +               }
 961 +               m = m1;
 962 +               if (m1 == 0) { /* in case of 'fastroute' */
 963 +                       error = 0;
 964 +                       goto done;
 965 +               }
 966 +               ip6 = mtod(m, struct ip6_hdr *);
 967 +       }
 968 + #endif
 969
 970         /*
 971          * Send the packet to the outgoing interface.
 972 ***************
 973 *** 1117,1123 ****
 974         return (0);
 975   }
 976
 977 ! static int
 978   ip6_getpmtu(ro_pmtu, ro, ifp, dst, mtup)
 979         struct route_in6 *ro_pmtu, *ro;
 980         struct ifnet *ifp;
 981 --- 1139,1145 ----
 982         return (0);
 983   }
 984
 985 ! int
 986   ip6_getpmtu(ro_pmtu, ro, ifp, dst, mtup)
 987         struct route_in6 *ro_pmtu, *ro;
 988         struct ifnet *ifp;
 989 diff sys/sys/conf.h sys.ipf/sys/conf.h
 990 *** sys/sys/conf.h      Sat Jun 28 02:57:14 2003
 991 --- sys.ipf/sys/conf.h  Mon Jun 21 22:20:45 2004
 992 ***************
 993 *** 358,363 ****
 994 --- 358,370 ----
 995         (dev_type_ioctl((*))) enodev, (dev_type_stop((*))) nullop, \
 996         0, (dev_type_select((*))) enodev, (dev_type_mmap((*))) enodev }
 997
 998 + /* open, close, read, ioctl */
 999 + #define cdev_gen_ipf(c, n) { \
1000 + dev_init(c,n,open), dev_init(c,n,close), dev_init(c,n,read), \
1001 +       (dev_type_write((*))) enodev, dev_init(c,n,ioctl), \
1002 +       (dev_type_stop((*))) enodev, 0, (dev_type_select((*))) enodev, \
1003 +       (dev_type_mmap((*))) enodev }
1004 +
1005   /* open, close, read, write, ioctl, select, nokqfilter */
1006   #define cdev_xfs_init(c, n) { \
1007         dev_init(c,n,open), dev_init(c,n,close), dev_init(c,n,read), \
1008 ***************
1009 *** 578,583 ****
1010 --- 585,591 ----
1011
1012   cdev_decl(bpf);
1013
1014 + cdev_decl(ipl);
1015   cdev_decl(pf);
1016
1017   cdev_decl(tun);